diff --git a/Makefile b/Makefile
index 97a461ae8a2..41fe6b22785 100644
--- a/Makefile
+++ b/Makefile
@@ -96,7 +96,7 @@ $(NODE_G_EXE): config.gypi out/Makefile
 
 out/Makefile: common.gypi deps/uv/uv.gyp deps/http_parser/http_parser.gyp \
               deps/zlib/zlib.gyp deps/v8/gypfiles/toolchain.gypi \
-              deps/v8/gypfiles/features.gypi deps/v8/src/v8.gyp node.gyp \
+              deps/v8/gypfiles/features.gypi deps/v8/gypfiles/v8.gyp node.gyp \
               config.gypi
 	$(PYTHON) tools/gyp_node.py -f make
 
diff --git a/README.md b/README.md
index 7342012dc0e..de2023a01d6 100644
--- a/README.md
+++ b/README.md
@@ -1,619 +1,12 @@
-<p align="center">
-  <a href="https://nodejs.org/">
-    <img
-      alt="Node.js"
-      src="https://nodejs.org/static/images/logo-light.svg"
-      width="400"
-    />
-  </a>
-</p>
+This is an automatically updated **experimental**
+version of [Node.js](https://github.com/nodejs/node)
+with the lkgr (last known good revision) of V8.
 
-Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. For
-more information on using Node.js, see the
-[Node.js Website][].
+The daily builds of this repo can be found at
+[`v8-canary`](https://nodejs.org/download/v8-canary/).
+**Do not use this in production!**
 
-The Node.js project is supported by the
-[Node.js Foundation](https://nodejs.org/en/foundation/). Contributions,
-policies, and releases are managed under an
-[open governance model](./GOVERNANCE.md).
+This repository is not owned by `@nodejs/v8`, but they might be able to
+help with issues.
 
-**This project is bound by a [Code of Conduct][].**
-
-
-# Table of Contents
-
-* [Support](#support)
-* [Release Types](#release-types)
-  * [Download](#download)
-    * [Current and LTS Releases](#current-and-lts-releases)
-    * [Nightly Releases](#nightly-releases)
-    * [API Documentation](#api-documentation)
-  * [Verifying Binaries](#verifying-binaries)
-* [Building Node.js](#building-nodejs)
-* [Security](#security)
-* [Current Project Team Members](#current-project-team-members)
-  * [TSC (Technical Steering Committee)](#tsc-technical-steering-committee)
-  * [Collaborators](#collaborators)
-  * [Release Team](#release-team)
-* [Contributing to Node.js](#contributing-to-nodejs)
-
-## Support
-
-Node.js contributors have limited availability to address general support
-questions. Please make sure you are using a [currently-supported version of
-Node.js](https://github.com/nodejs/Release#release-schedule).
-
-When looking for support, please first search for your question in these venues:
-
-* [Node.js Website][]
-* [Node.js Help][]
-* [Open or closed issues in the Node.js GitHub organization](https://github.com/issues?utf8=%E2%9C%93&q=sort%3Aupdated-desc+org%3Anodejs+is%3Aissue)
-
-If you didn't find an answer in one of the official resources above, you can
-search these unofficial resources:
-
-* [Questions tagged 'node.js' on StackOverflow][]
-* [#node.js channel on chat.freenode.net][]. See <http://nodeirc.info/> for more
-  information.
-
-GitHub issues are meant for tracking enhancements and bugs, not general support.
-
-Remember, libre != gratis; the open source license grants you the freedom to use
-and modify, but not commitments of other people's time. Please be respectful,
-and set your expectations accordingly.
-
-## Release Types
-
-The Node.js project maintains multiple types of releases:
-
-* **Current**: Released from active development branches of this repository,
-  versioned by [SemVer](https://semver.org) and signed by a member of the
-  [Release Team](#release-team).
-  Code for Current releases is organized in this repository by major version
-  number. For example: [v4.x](https://github.com/nodejs/node/tree/v4.x).
-  The major version number of Current releases will increment every 6 months
-  allowing for breaking changes to be introduced. This happens in April and
-  October every year. Current release lines beginning in October each year have
-  a maximum support life of 8 months. Current release lines beginning in April
-  each year will convert to LTS (see below) after 6 months and receive further
-  support for 30 months.
-* **LTS**: Releases that receive Long-term Support, with a focus on stability
-  and security. Every second Current release line (major version) will become an
-  LTS line and receive 18 months of _Active LTS_ support and a further 12
-  months of _Maintenance_. LTS release lines are given alphabetically
-  ordered codenames, beginning with v4 Argon. LTS releases are less frequent
-  and will attempt to maintain consistent major and minor version numbers,
-  only incrementing patch version numbers. There are no breaking changes or
-  feature additions, except in some special circumstances.
-* **Nightly**: Versions of code in this repository on the current Current
-  branch, automatically built every 24-hours where changes exist. Use with
-  caution.
-
-More information can be found in the [LTS README](https://github.com/nodejs/LTS/).
-
-### Download
-
-Binaries, installers, and source tarballs are available at
-<https://nodejs.org>.
-
-#### Current and LTS Releases
-**Current** and **LTS** releases are available at
-<https://nodejs.org/download/release/>, listed under their version strings.
-The [latest](https://nodejs.org/download/release/latest/) directory is an
-alias for the latest Current release. The latest LTS release from an LTS
-line is available in the form: latest-_codename_. For example:
-<https://nodejs.org/download/release/latest-argon>.
-
-#### Nightly Releases
-**Nightly** builds are available at
-<https://nodejs.org/download/nightly/>, listed under their version
-string which includes their date (in UTC time) and the commit SHA at
-the HEAD of the release.
-
-#### API Documentation
-**API documentation** is available in each release and nightly
-directory under _docs_. <https://nodejs.org/api/> points to the API
-documentation of the latest stable version.
-
-### Verifying Binaries
-
-Current, LTS, and Nightly download directories all contain a SHASUMS256.txt
-file that lists the SHA checksums for each file available for
-download.
-
-The SHASUMS256.txt can be downloaded using `curl`.
-
-```console
-$ curl -O https://nodejs.org/dist/vx.y.z/SHASUMS256.txt
-```
-
-To check that a downloaded file matches the checksum, run
-it through `sha256sum` with a command such as:
-
-```console
-$ grep node-vx.y.z.tar.gz SHASUMS256.txt | sha256sum -c -
-```
-
-Current and LTS releases (but not Nightlies) also have the GPG detached
-signature of SHASUMS256.txt available as SHASUMS256.txt.sig. You can use `gpg`
-to verify that SHASUMS256.txt has not been tampered with.
-
-To verify SHASUMS256.txt has not been altered, you will first need to import
-all of the GPG keys of individuals authorized to create releases. They are
-listed at the bottom of this README under [Release Team](#release-team).
-Use a command such as this to import the keys:
-
-```console
-$ gpg --keyserver pool.sks-keyservers.net --recv-keys DD8F2338BAE7501E3DD5AC78C273792F7D83545D
-```
-
-See the bottom of this README for a full script to import active release keys.
-
-Next, download the SHASUMS256.txt.sig for the release:
-
-```console
-$ curl -O https://nodejs.org/dist/vx.y.z/SHASUMS256.txt.sig
-```
-
-After downloading the appropriate SHASUMS256.txt and SHASUMS256.txt.sig files,
-you can then use `gpg --verify SHASUMS256.txt.sig SHASUMS256.txt` to verify
-that the file has been signed by an authorized member of the Node.js team.
-
-Once verified, use the SHASUMS256.txt file to get the checksum for
-the binary verification command above.
-
-## Building Node.js
-
-See [BUILDING.md](BUILDING.md) for instructions on how to build
-Node.js from source. The document also contains a list of
-officially supported platforms.
-
-## Security
-
-Security flaws in Node.js should be reported by emailing security@nodejs.org.
-Please do not disclose security bugs publicly until they have been handled by
-the security team.
-
-Your email will be acknowledged within 24 hours, and you will receive a more
-detailed response to your email within 48 hours indicating the next steps in
-handling your report.
-
-There are no hard and fast rules to determine if a bug is worth reporting as
-a security issue. The general rule is an issue worth reporting should allow an
-attacker to compromise the confidentiality, integrity, or availability of the
-Node.js application or its system for which the attacker does not already have
-the capability.
-
-To illustrate the point, here are some examples of past issues and what the
-Security Response Team thinks of them. When in doubt, however, please do send
-us a report nonetheless.
-
-
-### Public disclosure preferred
-
-- [#14519](https://github.com/nodejs/node/issues/14519): _Internal domain
-  function can be used to cause segfaults_. Causing program termination using
-  either the public JavaScript APIs or the private bindings layer APIs requires
-  the ability to execute arbitrary JavaScript code, which is already the highest
-  level of privilege possible.
-
-- [#12141](https://github.com/nodejs/node/pull/12141): _buffer: zero fill
-  Buffer(num) by default_. The buffer constructor behavior was documented,
-  but found to be prone to [mis-use](https://snyk.io/blog/exploiting-buffer/).
-  It has since been changed, but despite much debate, was not considered misuse
-  prone enough to justify fixing in older release lines and breaking our
-  API stability contract.
-
-### Private disclosure preferred
-
-- [CVE-2016-7099](https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/):
-  _Fix invalid wildcard certificate validation check_. This is a high severity
-  defect that would allow a malicious TLS server to serve an invalid wildcard
-  certificate for its hostname and be improperly validated by a Node.js client.
-
-- [#5507](https://github.com/nodejs/node/pull/5507): _Fix a defect that makes
-  the CacheBleed Attack possible_. Many, though not all, OpenSSL vulnerabilities
-  in the TLS/SSL protocols also effect Node.js.
-
-- [CVE-2016-2216](https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/):
-  _Fix defects in HTTP header parsing for requests and responses that can allow
-  response splitting_. While the impact of this vulnerability is application and
-  network dependent, it is remotely exploitable in the HTTP protocol.
-
-When in doubt, please do send us a report.
-
-
-## Current Project Team Members
-
-The Node.js project team comprises a group of core collaborators and a sub-group
-that forms the _Technical Steering Committee_ (TSC) which governs the project.
-For more information about the governance of the Node.js project, see
-[GOVERNANCE.md](./GOVERNANCE.md).
-
-### TSC (Technical Steering Committee)
-
-* [addaleax](https://github.com/addaleax) -
-**Anna Henningsen** &lt;anna@addaleax.net&gt; (she/her)
-* [ChALkeR](https://github.com/ChALkeR) -
-**Сковорода Никита Андреевич** &lt;chalkerx@gmail.com&gt; (he/him)
-* [cjihrig](https://github.com/cjihrig) -
-**Colin Ihrig** &lt;cjihrig@gmail.com&gt;
-* [danbev](https://github.com/danbev) -
-**Daniel Bevenius** &lt;daniel.bevenius@gmail.com&gt;
-* [evanlucas](https://github.com/evanlucas) -
-**Evan Lucas** &lt;evanlucas@me.com&gt; (he/him)
-* [fhinkel](https://github.com/fhinkel) -
-**Franziska Hinkelmann** &lt;franziska.hinkelmann@gmail.com&gt; (she/her)
-* [Fishrock123](https://github.com/Fishrock123) -
-**Jeremiah Senkpiel** &lt;fishrock123@rocketmail.com&gt;
-* [gibfahn](https://github.com/gibfahn) -
-**Gibson Fahnestock** &lt;gibfahn@gmail.com&gt; (he/him)
-* [jasnell](https://github.com/jasnell) -
-**James M Snell** &lt;jasnell@gmail.com&gt; (he/him)
-* [joyeecheung](https://github.com/joyeecheung) -
-**Joyee Cheung** &lt;joyeec9h3@gmail.com&gt; (she/her)
-* [mcollina](https://github.com/mcollina) -
-**Matteo Collina** &lt;matteo.collina@gmail.com&gt; (he/him)
-* [mhdawson](https://github.com/mhdawson) -
-**Michael Dawson** &lt;michael_dawson@ca.ibm.com&gt; (he/him)
-* [MylesBorins](https://github.com/MylesBorins) -
-**Myles Borins** &lt;myles.borins@gmail.com&gt; (he/him)
-* [ofrobots](https://github.com/ofrobots) -
-**Ali Ijaz Sheikh** &lt;ofrobots@google.com&gt;
-* [rvagg](https://github.com/rvagg) -
-**Rod Vagg** &lt;rod@vagg.org&gt;
-* [targos](https://github.com/targos) -
-**Michaël Zasso** &lt;targos@protonmail.com&gt; (he/him)
-* [thefourtheye](https://github.com/thefourtheye) -
-**Sakthipriyan Vairamani** &lt;thechargingvolcano@gmail.com&gt; (he/him)
-* [trevnorris](https://github.com/trevnorris) -
-**Trevor Norris** &lt;trev.norris@gmail.com&gt;
-* [Trott](https://github.com/Trott) -
-**Rich Trott** &lt;rtrott@gmail.com&gt; (he/him)
-
-### TSC Emeriti
-
-* [bnoordhuis](https://github.com/bnoordhuis) -
-**Ben Noordhuis** &lt;info@bnoordhuis.nl&gt;
-* [chrisdickinson](https://github.com/chrisdickinson) -
-**Chris Dickinson** &lt;christopher.s.dickinson@gmail.com&gt;
-* [indutny](https://github.com/indutny) -
-**Fedor Indutny** &lt;fedor.indutny@gmail.com&gt;
-* [isaacs](https://github.com/isaacs) -
-**Isaac Z. Schlueter** &lt;i@izs.me&gt;
-* [joshgav](https://github.com/joshgav) -
-**Josh Gavant** &lt;josh.gavant@outlook.com&gt;
-* [mscdex](https://github.com/mscdex) -
-**Brian White** &lt;mscdex@mscdex.net&gt;
-* [nebrius](https://github.com/nebrius) -
-**Bryan Hughes** &lt;bryan@nebri.us&gt;
-* [orangemocha](https://github.com/orangemocha) -
-**Alexis Campailla** &lt;orangemocha@nodejs.org&gt;
-* [piscisaureus](https://github.com/piscisaureus) -
-**Bert Belder** &lt;bertbelder@gmail.com&gt;
-* [shigeki](https://github.com/shigeki) -
-**Shigeki Ohtsu** &lt;ohtsu@ohtsu.org&gt; (he/him)
-
-### Collaborators
-
-* [addaleax](https://github.com/addaleax) -
-**Anna Henningsen** &lt;anna@addaleax.net&gt; (she/her)
-* [ak239](https://github.com/ak239) -
-**Aleksei Koziatinskii** &lt;ak239spb@gmail.com&gt;
-* [andrasq](https://github.com/andrasq) -
-**Andras** &lt;andras@kinvey.com&gt;
-* [AndreasMadsen](https://github.com/AndreasMadsen) -
-**Andreas Madsen** &lt;amwebdk@gmail.com&gt; (he/him)
-* [AnnaMag](https://github.com/AnnaMag) -
-**Anna M. Kedzierska** &lt;anna.m.kedzierska@gmail.com&gt;
-* [apapirovski](https://github.com/apapirovski) -
-**Anatoli Papirovski** &lt;apapirovski@mac.com&gt; (he/him)
-* [aqrln](https://github.com/aqrln) -
-**Alexey Orlenko** &lt;eaglexrlnk@gmail.com&gt; (he/him)
-* [bengl](https://github.com/bengl) -
-**Bryan English** &lt;bryan@bryanenglish.com&gt; (he/him)
-* [benjamingr](https://github.com/benjamingr) -
-**Benjamin Gruenbaum** &lt;benjamingr@gmail.com&gt;
-* [BethGriggs](https://github.com/BethGriggs) -
-**Beth Griggs** &lt;Bethany.Griggs@uk.ibm.com&gt; (she/her)
-* [bmeck](https://github.com/bmeck) -
-**Bradley Farias** &lt;bradley.meck@gmail.com&gt;
-* [bmeurer](https://github.com/bmeurer) -
-**Benedikt Meurer** &lt;benedikt.meurer@gmail.com&gt;
-* [bnoordhuis](https://github.com/bnoordhuis) -
-**Ben Noordhuis** &lt;info@bnoordhuis.nl&gt;
-* [brendanashworth](https://github.com/brendanashworth) -
-**Brendan Ashworth** &lt;brendan.ashworth@me.com&gt;
-* [BridgeAR](https://github.com/BridgeAR) -
-**Ruben Bridgewater** &lt;ruben@bridgewater.de&gt;
-* [bzoz](https://github.com/bzoz) -
-**Bartosz Sosnowski** &lt;bartosz@janeasystems.com&gt;
-* [calvinmetcalf](https://github.com/calvinmetcalf) -
-**Calvin Metcalf** &lt;calvin.metcalf@gmail.com&gt;
-* [ChALkeR](https://github.com/ChALkeR) -
-**Сковорода Никита Андреевич** &lt;chalkerx@gmail.com&gt; (he/him)
-* [chrisdickinson](https://github.com/chrisdickinson) -
-**Chris Dickinson** &lt;christopher.s.dickinson@gmail.com&gt;
-* [cjihrig](https://github.com/cjihrig) -
-**Colin Ihrig** &lt;cjihrig@gmail.com&gt;
-* [claudiorodriguez](https://github.com/claudiorodriguez) -
-**Claudio Rodriguez** &lt;cjrodr@yahoo.com&gt;
-* [danbev](https://github.com/danbev) -
-**Daniel Bevenius** &lt;daniel.bevenius@gmail.com&gt;
-* [DavidCai1993](https://github.com/DavidCai1993) -
-**David Cai** &lt;davidcai1993@yahoo.com&gt; (he/him)
-* [devsnek](https://github.com/devsnek) -
-**Gus Caplan** &lt;me@gus.host&gt; (he/him)
-* [edsadr](https://github.com/edsadr) -
-**Adrian Estrada** &lt;edsadr@gmail.com&gt; (he/him)
-* [eljefedelrodeodeljefe](https://github.com/eljefedelrodeodeljefe) -
-**Robert Jefe Lindstaedt** &lt;robert.lindstaedt@gmail.com&gt;
-* [estliberitas](https://github.com/estliberitas) -
-**Alexander Makarenko** &lt;estliberitas@gmail.com&gt;
-* [eugeneo](https://github.com/eugeneo) -
-**Eugene Ostroukhov** &lt;eostroukhov@google.com&gt;
-* [evanlucas](https://github.com/evanlucas) -
-**Evan Lucas** &lt;evanlucas@me.com&gt; (he/him)
-* [fhinkel](https://github.com/fhinkel) -
-**Franziska Hinkelmann** &lt;franziska.hinkelmann@gmail.com&gt; (she/her)
-* [firedfox](https://github.com/firedfox) -
-**Daniel Wang** &lt;wangyang0123@gmail.com&gt;
-* [Fishrock123](https://github.com/Fishrock123) -
-**Jeremiah Senkpiel** &lt;fishrock123@rocketmail.com&gt;
-* [gabrielschulhof](https://github.com/gabrielschulhof) -
-**Gabriel Schulhof** &lt;gabriel.schulhof@intel.com&gt;
-* [geek](https://github.com/geek) -
-**Wyatt Preul** &lt;wpreul@gmail.com&gt;
-* [gibfahn](https://github.com/gibfahn) -
-**Gibson Fahnestock** &lt;gibfahn@gmail.com&gt; (he/him)
-* [gireeshpunathil](https://github.com/gireeshpunathil) -
-**Gireesh Punathil** &lt;gpunathi@in.ibm.com&gt; (he/him)
-* [guybedford](https://github.com/guybedford) -
-**Guy Bedford** &lt;guybedford@gmail.com&gt; (he/him)
-* [hashseed](https://github.com/hashseed) -
-**Yang Guo** &lt;yangguo@chromium.org&gt; (he/him)
-* [hiroppy](https://github.com/hiroppy) -
-**Yuta Hiroto** &lt;hello@hiroppy.me&gt; (he/him)
-* [iarna](https://github.com/iarna) -
-**Rebecca Turner** &lt;me@re-becca.org&gt;
-* [imran-iq](https://github.com/imran-iq) -
-**Imran Iqbal** &lt;imran@imraniqbal.org&gt;
-* [imyller](https://github.com/imyller) -
-**Ilkka Myller** &lt;ilkka.myller@nodefield.com&gt;
-* [indutny](https://github.com/indutny) -
-**Fedor Indutny** &lt;fedor.indutny@gmail.com&gt;
-* [italoacasas](https://github.com/italoacasas) -
-**Italo A. Casas** &lt;me@italoacasas.com&gt; (he/him)
-* [JacksonTian](https://github.com/JacksonTian) -
-**Jackson Tian** &lt;shyvo1987@gmail.com&gt;
-* [jasnell](https://github.com/jasnell) -
-**James M Snell** &lt;jasnell@gmail.com&gt; (he/him)
-* [jasongin](https://github.com/jasongin) -
-**Jason Ginchereau** &lt;jasongin@microsoft.com&gt;
-* [jbergstroem](https://github.com/jbergstroem) -
-**Johan Bergström** &lt;bugs@bergstroem.nu&gt;
-* [jhamhader](https://github.com/jhamhader) -
-**Yuval Brik** &lt;yuval@brik.org.il&gt;
-* [jkrems](https://github.com/jkrems) -
-**Jan Krems** &lt;jan.krems@gmail.com&gt; (he/him)
-* [joaocgreis](https://github.com/joaocgreis) -
-**João Reis** &lt;reis@janeasystems.com&gt;
-* [joshgav](https://github.com/joshgav) -
-**Josh Gavant** &lt;josh.gavant@outlook.com&gt;
-* [joyeecheung](https://github.com/joyeecheung) -
-**Joyee Cheung** &lt;joyeec9h3@gmail.com&gt; (she/her)
-* [julianduque](https://github.com/julianduque) -
-**Julian Duque** &lt;julianduquej@gmail.com&gt; (he/him)
-* [JungMinu](https://github.com/JungMinu) -
-**Minwoo Jung** &lt;minwoo@nodesource.com&gt; (he/him)
-* [kfarnung](https://github.com/kfarnung) -
-**Kyle Farnung** &lt;kfarnung@microsoft.com&gt; (he/him)
-* [kunalspathak](https://github.com/kunalspathak) -
-**Kunal Pathak** &lt;kunal.pathak@microsoft.com&gt;
-* [lance](https://github.com/lance) -
-**Lance Ball** &lt;lball@redhat.com&gt;
-* [Leko](https://github.com/Leko) -
-**Shingo Inoue** &lt;leko.noor@gmail.com&gt; (he/him)
-* [lpinca](https://github.com/lpinca) -
-**Luigi Pinca** &lt;luigipinca@gmail.com&gt; (he/him)
-* [lucamaraschi](https://github.com/lucamaraschi) -
-**Luca Maraschi** &lt;luca.maraschi@gmail.com&gt; (he/him)
-* [maclover7](https://github.com/maclover7) -
-**Jon Moss** &lt;me@jonathanmoss.me&gt; (he/him)
-* [mcollina](https://github.com/mcollina) -
-**Matteo Collina** &lt;matteo.collina@gmail.com&gt; (he/him)
-* [mhdawson](https://github.com/mhdawson) -
-**Michael Dawson** &lt;michael_dawson@ca.ibm.com&gt; (he/him)
-* [micnic](https://github.com/micnic) -
-**Nicu Micleușanu** &lt;micnic90@gmail.com&gt; (he/him)
-* [mikeal](https://github.com/mikeal) -
-**Mikeal Rogers** &lt;mikeal.rogers@gmail.com&gt;
-* [misterdjules](https://github.com/misterdjules) -
-**Julien Gilli** &lt;jgilli@nodejs.org&gt;
-* [mmarchini](https://github.com/mmarchini) -
-**Matheus Marchini** &lt;matheus@sthima.com&gt;
-* [MoonBall](https://github.com/MoonBall) -
-**Chen Gang** &lt;gangc.cxy@foxmail.com&gt;
-* [mscdex](https://github.com/mscdex) -
-**Brian White** &lt;mscdex@mscdex.net&gt;
-* [MylesBorins](https://github.com/MylesBorins) -
-**Myles Borins** &lt;myles.borins@gmail.com&gt; (he/him)
-* [not-an-aardvark](https://github.com/not-an-aardvark) -
-**Teddy Katz** &lt;teddy.katz@gmail.com&gt;
-* [ofrobots](https://github.com/ofrobots) -
-**Ali Ijaz Sheikh** &lt;ofrobots@google.com&gt;
-* [orangemocha](https://github.com/orangemocha) -
-**Alexis Campailla** &lt;orangemocha@nodejs.org&gt;
-* [othiym23](https://github.com/othiym23) -
-**Forrest L Norvell** &lt;ogd@aoaioxxysz.net&gt; (he/him)
-* [phillipj](https://github.com/phillipj) -
-**Phillip Johnsen** &lt;johphi@gmail.com&gt;
-* [pmq20](https://github.com/pmq20) -
-**Minqi Pan** &lt;pmq2001@gmail.com&gt;
-* [princejwesley](https://github.com/princejwesley) -
-**Prince John Wesley** &lt;princejohnwesley@gmail.com&gt;
-* [Qard](https://github.com/Qard) -
-**Stephen Belanger** &lt;admin@stephenbelanger.com&gt; (he/him)
-* [refack](https://github.com/refack) -
-**Refael Ackermann** &lt;refack@gmail.com&gt; (he/him)
-* [richardlau](https://github.com/richardlau) -
-**Richard Lau** &lt;riclau@uk.ibm.com&gt;
-* [rmg](https://github.com/rmg) -
-**Ryan Graham** &lt;r.m.graham@gmail.com&gt;
-* [robertkowalski](https://github.com/robertkowalski) -
-**Robert Kowalski** &lt;rok@kowalski.gd&gt;
-* [romankl](https://github.com/romankl) -
-**Roman Klauke** &lt;romaaan.git@gmail.com&gt;
-* [ronkorving](https://github.com/ronkorving) -
-**Ron Korving** &lt;ron@ronkorving.nl&gt;
-* [RReverser](https://github.com/RReverser) -
-**Ingvar Stepanyan** &lt;me@rreverser.com&gt;
-* [rvagg](https://github.com/rvagg) -
-**Rod Vagg** &lt;rod@vagg.org&gt;
-* [saghul](https://github.com/saghul) -
-**Saúl Ibarra Corretgé** &lt;saghul@gmail.com&gt;
-* [sam-github](https://github.com/sam-github) -
-**Sam Roberts** &lt;vieuxtech@gmail.com&gt;
-* [santigimeno](https://github.com/santigimeno) -
-**Santiago Gimeno** &lt;santiago.gimeno@gmail.com&gt;
-* [sebdeckers](https://github.com/sebdeckers) -
-**Sebastiaan Deckers** &lt;sebdeckers83@gmail.com&gt;
-* [seishun](https://github.com/seishun) -
-**Nikolai Vavilov** &lt;vvnicholas@gmail.com&gt;
-* [shigeki](https://github.com/shigeki) -
-**Shigeki Ohtsu** &lt;ohtsu@ohtsu.org&gt; (he/him)
-* [silverwind](https://github.com/silverwind) -
-**Roman Reiss** &lt;me@silverwind.io&gt;
-* [srl295](https://github.com/srl295) -
-**Steven R Loomis** &lt;srloomis@us.ibm.com&gt;
-* [starkwang](https://github.com/starkwang) -
-**Weijia Wang** &lt;starkwang@126.com&gt;
-* [stefanmb](https://github.com/stefanmb) -
-**Stefan Budeanu** &lt;stefan@budeanu.com&gt;
-* [targos](https://github.com/targos) -
-**Michaël Zasso** &lt;targos@protonmail.com&gt; (he/him)
-* [thefourtheye](https://github.com/thefourtheye) -
-**Sakthipriyan Vairamani** &lt;thechargingvolcano@gmail.com&gt; (he/him)
-* [thekemkid](https://github.com/thekemkid) -
-**Glen Keane** &lt;glenkeane.94@gmail.com&gt; (he/him)
-* [thlorenz](https://github.com/thlorenz) -
-**Thorsten Lorenz** &lt;thlorenz@gmx.de&gt;
-* [TimothyGu](https://github.com/TimothyGu) -
-**Tiancheng "Timothy" Gu** &lt;timothygu99@gmail.com&gt; (he/him)
-* [tniessen](https://github.com/tniessen) -
-**Tobias Nießen** &lt;tniessen@tnie.de&gt;
-* [trevnorris](https://github.com/trevnorris) -
-**Trevor Norris** &lt;trev.norris@gmail.com&gt;
-* [trivikr](https://github.com/trivikr) -
-**Trivikram Kamat** &lt;trivikr.dev@gmail.com&gt;
-* [Trott](https://github.com/Trott) -
-**Rich Trott** &lt;rtrott@gmail.com&gt; (he/him)
-* [tunniclm](https://github.com/tunniclm) -
-**Mike Tunnicliffe** &lt;m.j.tunnicliffe@gmail.com&gt;
-* [vdeturckheim](https://github.com/vdeturckheim) -
-**Vladimir de Turckheim** &lt;vlad2t@hotmail.com&gt; (he/him)
-* [vkurchatkin](https://github.com/vkurchatkin) -
-**Vladimir Kurchatkin** &lt;vladimir.kurchatkin@gmail.com&gt;
-* [vsemozhetbyt](https://github.com/vsemozhetbyt) -
-**Vse Mozhet Byt** &lt;vsemozhetbyt@gmail.com&gt; (he/him)
-* [watilde](https://github.com/watilde) -
-**Daijiro Wachi** &lt;daijiro.wachi@gmail.com&gt; (he/him)
-* [watson](https://github.com/watson) -
-**Thomas Watson** &lt;w@tson.dk&gt;
-* [whitlockjc](https://github.com/whitlockjc) -
-**Jeremy Whitlock** &lt;jwhitlock@apache.org&gt;
-* [XadillaX](https://github.com/XadillaX) -
-**Khaidi Chu** &lt;i@2333.moe&gt; (he/him)
-* [yhwang](https://github.com/yhwang) -
-**Yihong Wang** &lt;yh.wang@ibm.com&gt;
-* [yorkie](https://github.com/yorkie) -
-**Yorkie Liu** &lt;yorkiefixer@gmail.com&gt;
-* [yosuke-furukawa](https://github.com/yosuke-furukawa) -
-**Yosuke Furukawa** &lt;yosuke.furukawa@gmail.com&gt;
-
-### Collaborator Emeriti
-
-* [isaacs](https://github.com/isaacs) -
-**Isaac Z. Schlueter** &lt;i@izs.me&gt;
-* [lxe](https://github.com/lxe) -
-**Aleksey Smolenchuk** &lt;lxe@lxe.co&gt;
-* [matthewloring](https://github.com/matthewloring) -
-**Matthew Loring** &lt;mattloring@google.com&gt;
-* [monsanto](https://github.com/monsanto) -
-**Christopher Monsanto** &lt;chris@monsan.to&gt;
-* [Olegas](https://github.com/Olegas) -
-**Oleg Elifantiev** &lt;oleg@elifantiev.ru&gt;
-* [petkaantonov](https://github.com/petkaantonov) -
-**Petka Antonov** &lt;petka_antonov@hotmail.com&gt;
-* [piscisaureus](https://github.com/piscisaureus) -
-**Bert Belder** &lt;bertbelder@gmail.com&gt;
-* [rlidwka](https://github.com/rlidwka) -
-**Alex Kocharin** &lt;alex@kocharin.ru&gt;
-* [tellnes](https://github.com/tellnes) -
-**Christian Tellnes** &lt;christian@tellnes.no&gt;
-
-Collaborators follow the [COLLABORATOR_GUIDE.md](./COLLABORATOR_GUIDE.md) in
-maintaining the Node.js project.
-
-### Release Team
-
-Node.js releases are signed with one of the following GPG keys:
-
-* **Colin Ihrig** &lt;cjihrig@gmail.com&gt;
-`94AE36675C464D64BAFA68DD7434390BDBE9B9C5`
-* **Evan Lucas** &lt;evanlucas@me.com&gt;
-`B9AE9905FFD7803F25714661B63B535A4C206CA9`
-* **Gibson Fahnestock** &lt;gibfahn@gmail.com&gt;
-`77984A986EBC2AA786BC0F66B01FBB92821C587A`
-* **Italo A. Casas** &lt;me@italoacasas.com&gt;
-`56730D5401028683275BD23C23EFEFE93C4CFFFE`
-* **James M Snell** &lt;jasnell@keybase.io&gt;
-`71DCFD284A79C3B38668286BC97EC7A07EDE3FC1`
-* **Jeremiah Senkpiel** &lt;fishrock@keybase.io&gt;
-`FD3A5288F042B6850C66B31F09FE44734EB7990E`
-* **Myles Borins** &lt;myles.borins@gmail.com&gt;
-`C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8`
-* **Rod Vagg** &lt;rod@vagg.org&gt;
-`DD8F2338BAE7501E3DD5AC78C273792F7D83545D`
-
-The full set of trusted release keys can be imported by running:
-
-```shell
-gpg --keyserver pool.sks-keyservers.net --recv-keys 94AE36675C464D64BAFA68DD7434390BDBE9B9C5
-gpg --keyserver pool.sks-keyservers.net --recv-keys FD3A5288F042B6850C66B31F09FE44734EB7990E
-gpg --keyserver pool.sks-keyservers.net --recv-keys 71DCFD284A79C3B38668286BC97EC7A07EDE3FC1
-gpg --keyserver pool.sks-keyservers.net --recv-keys DD8F2338BAE7501E3DD5AC78C273792F7D83545D
-gpg --keyserver pool.sks-keyservers.net --recv-keys C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8
-gpg --keyserver pool.sks-keyservers.net --recv-keys B9AE9905FFD7803F25714661B63B535A4C206CA9
-gpg --keyserver pool.sks-keyservers.net --recv-keys 56730D5401028683275BD23C23EFEFE93C4CFFFE
-gpg --keyserver pool.sks-keyservers.net --recv-keys 77984A986EBC2AA786BC0F66B01FBB92821C587A
-```
-
-See the section above on [Verifying Binaries](#verifying-binaries) for details
-on what to do with these keys to verify that a downloaded file is official.
-
-Previous releases may also have been signed with one of the following GPG keys:
-
-* **Chris Dickinson** &lt;christopher.s.dickinson@gmail.com&gt;
-`9554F04D7259F04124DE6B476D5A82AC7E37093B`
-* **Isaac Z. Schlueter** &lt;i@izs.me&gt;
-`93C7E9E91B49E432C2F75674B0A78B0A6C481CF6`
-* **Julien Gilli** &lt;jgilli@fastmail.fm&gt;
-`114F43EE0176B71C7BC219DD50A3051F888C628D`
-* **Timothy J Fontaine** &lt;tjfontaine@gmail.com&gt;
-`7937DFD2AB06298B2293C3187D33FF9D0246406D`
-
-## Contributing to Node.js
-
-* [Contributing to the project][]
-* [Working Groups][]
-* [Strategic Initiatives][]
-
-[Code of Conduct]: https://github.com/nodejs/admin/blob/master/CODE_OF_CONDUCT.md
-[Contributing to the project]: CONTRIBUTING.md
-[Node.js Help]: https://github.com/nodejs/help
-[Node.js Website]: https://nodejs.org/en/
-[Questions tagged 'node.js' on StackOverflow]: https://stackoverflow.com/questions/tagged/node.js
-[Working Groups]: https://github.com/nodejs/TSC/blob/master/WORKING_GROUPS.md
-[Strategic Initiatives]: https://github.com/nodejs/TSC/blob/master/Strategic-Initiatives.md
-[#node.js channel on chat.freenode.net]: https://webchat.freenode.net?channels=node.js&uio=d4
+This project is bound by a [Code of Conduct](https://github.com/nodejs/TSC/blob/master/CODE_OF_CONDUCT.md). 
diff --git a/common.gypi b/common.gypi
index 2d2bc4f5d56..2d2619dc760 100644
--- a/common.gypi
+++ b/common.gypi
@@ -27,7 +27,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.5',
+    'v8_embedder_string': '-node.0',
 
     # Enable disassembler for `--print-code` v8 options
     'v8_enable_disassembler': 1,
@@ -49,10 +49,10 @@
     'conditions': [
       ['GENERATOR=="ninja"', {
         'obj_dir': '<(PRODUCT_DIR)/obj',
-        'v8_base': '<(PRODUCT_DIR)/obj/deps/v8/src/libv8_base.a',
+        'v8_base': '<(PRODUCT_DIR)/obj/deps/v8/gypfiles/libv8_base.a',
        }, {
          'obj_dir%': '<(PRODUCT_DIR)/obj.target',
-         'v8_base%': '<(PRODUCT_DIR)/obj.target/deps/v8/src/libv8_base.a',
+         'v8_base%': '<(PRODUCT_DIR)/obj.target/deps/v8/gypfiles/libv8_base.a',
       }],
       ['OS == "win"', {
         'os_posix': 0,
diff --git a/deps/v8/.gitignore b/deps/v8/.gitignore
index f07fc1cb622..4534a396099 100644
--- a/deps/v8/.gitignore
+++ b/deps/v8/.gitignore
@@ -36,8 +36,6 @@
 /_*
 /build
 /buildtools
-/gypfiles/.gold_plugin
-/gypfiles/win_toolchain.json
 /hydrogen.cfg
 /obj
 /out
@@ -51,24 +49,25 @@
 /test/fuzzer/wasm_corpus.tar.gz
 /test/mozilla/data
 /test/test262/data
-/test/test262/data.tar
 /test/test262/harness
 /test/wasm-js
 /test/wasm-spec-tests/tests
 /test/wasm-spec-tests/tests.tar.gz
-/testing/gmock
-/testing/gtest/*
-!/testing/gtest/include
-/testing/gtest/include/*
-!/testing/gtest/include/gtest
-/testing/gtest/include/gtest/*
-!/testing/gtest/include/gtest/gtest_prod.h
 /third_party/*
 !/third_party/binutils
 !/third_party/eu-strip
 !/third_party/inspector_protocol
 !/third_party/colorama
 /third_party/colorama/src
+!/third_party/googletest
+/third_party/googletest/src/*
+!/third_party/googletest/src/googletest
+/third_party/googletest/src/googletest/*
+!/third_party/googletest/src/googletest/include
+/third_party/googletest/src/googletest/include/*
+!/third_party/googletest/src/googletest/include/gtest
+/third_party/googletest/src/googletest/include/gtest/*
+!/third_party/googletest/src/googletest/include/gtest/gtest_prod.h
 /tools/clang
 /tools/gcmole/gcmole-tools
 /tools/gcmole/gcmole-tools.tar.gz
@@ -76,6 +75,8 @@
 /tools/jsfunfuzz/jsfunfuzz
 /tools/jsfunfuzz/jsfunfuzz.tar.gz
 /tools/luci-go
+/tools/mips_toolchain
+/tools/mips_toolchain.tar.gz
 /tools/oom_dump/oom_dump
 /tools/oom_dump/oom_dump.o
 /tools/swarming_client
diff --git a/deps/v8/.gn b/deps/v8/.gn
index c80980ea092..573fd030d80 100644
--- a/deps/v8/.gn
+++ b/deps/v8/.gn
@@ -21,5 +21,4 @@ check_targets = []
 # These are the list of GN files that run exec_script. This whitelist exists
 # to force additional review for new uses of exec_script, which is strongly
 # discouraged except for gypi_to_gn calls.
-exec_script_whitelist =
-    build_dotfile_settings.exec_script_whitelist + [ "//test/test262/BUILD.gn" ]
+exec_script_whitelist = build_dotfile_settings.exec_script_whitelist + []
diff --git a/deps/v8/.vpython b/deps/v8/.vpython
index 9ea0da7145b..6a9ce3f693e 100644
--- a/deps/v8/.vpython
+++ b/deps/v8/.vpython
@@ -30,3 +30,16 @@ wheel: <
   name: "infra/python/wheels/psutil/${vpython_platform}"
   version: "version:5.2.2"
 >
+
+# Used by:
+#   build/toolchain/win
+wheel: <
+  name: "infra/python/wheels/pypiwin32/${vpython_platform}"
+  version: "version:219"
+  match_tag: <
+    platform: "win32"
+  >
+  match_tag: <
+    platform: "win_amd64"
+  >
+>
diff --git a/deps/v8/AUTHORS b/deps/v8/AUTHORS
index dfd3eef878c..1b73f538463 100644
--- a/deps/v8/AUTHORS
+++ b/deps/v8/AUTHORS
@@ -136,6 +136,8 @@ Sanjoy Das <sanjoy@playingwithpointers.com>
 Seo Sanghyeon <sanxiyn@gmail.com>
 Stefan Penner <stefan.penner@gmail.com>
 Sylvestre Ledru <sledru@mozilla.com>
+Taketoshi Aono <brn@b6n.ch>
+Teddy Katz <teddy.katz@gmail.com>
 Tiancheng "Timothy" Gu <timothygu99@gmail.com>
 Tobias Burnus <burnus@net-b.de>
 Victor Costan <costan@gmail.com>
diff --git a/deps/v8/BUILD.gn b/deps/v8/BUILD.gn
index 49707659723..ad003f194e2 100644
--- a/deps/v8/BUILD.gn
+++ b/deps/v8/BUILD.gn
@@ -4,18 +4,19 @@
 
 import("//build/config/android/config.gni")
 import("//build/config/arm.gni")
+import("//build/config/clang/clang.gni")
 import("//build/config/dcheck_always_on.gni")
 import("//build/config/host_byteorder.gni")
 import("//build/config/jumbo.gni")
 import("//build/config/mips.gni")
 import("//build/config/sanitizers/sanitizers.gni")
+import("//build_overrides/build.gni")
 
 if (is_android) {
   import("//build/config/android/rules.gni")
 }
 
 import("gni/v8.gni")
-import("gni/isolate.gni")
 import("snapshot_toolchain.gni")
 
 declare_args() {
@@ -56,7 +57,7 @@ declare_args() {
   v8_enable_vtunejit = false
 
   # Sets -dENABLE_HANDLE_ZAPPING.
-  v8_enable_handle_zapping = is_debug
+  v8_enable_handle_zapping = true
 
   # Enable slow dchecks.
   v8_enable_slow_dchecks = false
@@ -64,6 +65,11 @@ declare_args() {
   # Enable fast mksnapshot runs.
   v8_enable_fast_mksnapshot = false
 
+  # Enable embedded builtins.
+  # TODO(jgruber,v8:6666): Support ia32 and maybe MSVC.
+  # TODO(jgruber,v8:6666): Re-enable after the M67 branch point.
+  v8_enable_embedded_builtins = false
+
   # Enable code-generation-time checking of types in the CodeStubAssembler.
   v8_enable_verify_csa = false
 
@@ -319,6 +325,12 @@ config("features") {
   if (v8_check_microtasks_scopes_consistency) {
     defines += [ "V8_CHECK_MICROTASKS_SCOPES_CONSISTENCY" ]
   }
+  if (v8_enable_embedded_builtins) {
+    defines += [ "V8_EMBEDDED_BUILTINS" ]
+  }
+  if (v8_use_multi_snapshots) {
+    defines += [ "V8_MULTI_SNAPSHOTS" ]
+  }
 }
 
 config("toolchain") {
@@ -387,6 +399,9 @@ config("toolchain") {
         "_MIPS_ARCH_MIPS32R6",
         "FPU_MODE_FP64",
       ]
+      if (mips_use_msa) {
+        defines += [ "_MIPS_MSA" ]
+      }
     } else if (mips_arch_variant == "r2") {
       defines += [ "_MIPS_ARCH_MIPS32R2" ]
       if (mips_fpu_mode == "fp64") {
@@ -424,6 +439,9 @@ config("toolchain") {
     }
     if (mips_arch_variant == "r6") {
       defines += [ "_MIPS_ARCH_MIPS64R6" ]
+      if (mips_use_msa) {
+        defines += [ "_MIPS_MSA" ]
+      }
     } else if (mips_arch_variant == "r2") {
       defines += [ "_MIPS_ARCH_MIPS64R2" ]
     }
@@ -514,7 +532,7 @@ config("toolchain") {
 
   if (is_clang) {
     cflags += [
-      "-Wsign-compare",
+      "-Wmissing-field-initializers",
 
       # TODO(hans): Remove once http://crbug.com/428099 is resolved.
       "-Winconsistent-missing-override",
@@ -592,7 +610,6 @@ action("js2c") {
     "src/js/array.js",
     "src/js/typedarray.js",
     "src/js/messages.js",
-    "src/js/spread.js",
     "src/debug/mirrors.js",
     "src/debug/debug.js",
     "src/debug/liveedit.js",
@@ -706,6 +723,8 @@ action("d8_js2c") {
 if (is_android && enable_java_templates) {
   android_assets("v8_external_startup_data_assets") {
     if (v8_use_external_startup_data) {
+      # We don't support side-by-side snapshots on Android within Chromium.
+      assert(!v8_use_multi_snapshots)
       deps = [
         "//v8",
       ]
@@ -745,6 +764,10 @@ if (v8_use_external_startup_data) {
       "$root_out_dir/natives_blob.bin",
     ]
 
+    data = [
+      "$root_out_dir/natives_blob.bin",
+    ]
+
     script = "tools/concatenate-files.py"
 
     args = rebase_path(sources + outputs, root_build_dir)
@@ -793,8 +816,24 @@ action("postmortem-metadata") {
          rebase_path(sources, root_build_dir)
 }
 
-if (v8_use_snapshot) {
-  action("run_mksnapshot") {
+# Template to generate different V8 snapshots based on different runtime flags.
+# Can be invoked with run_mksnapshot(<name>). The target will resolve to
+# run_mksnapshot_<name>. If <name> is "default", no file suffixes will be used.
+# Otherwise files are suffixed, e.g. embedded_<name>.cc and
+# snapshot_blob_<name>.bin.
+#
+# The template exposes the variables:
+#   args: additional flags for mksnapshots
+#   embedded_suffix: a camel case suffix for method names in the embedded
+#       snapshot.
+template("run_mksnapshot") {
+  name = target_name
+  if (name == "default") {
+    suffix = ""
+  } else {
+    suffix = "_$name"
+  }
+  action("run_mksnapshot_" + name) {
     visibility = [ ":*" ]  # Only targets in this file can depend on this.
 
     deps = [
@@ -805,19 +844,33 @@ if (v8_use_snapshot) {
 
     sources = []
 
-    outputs = [
-      "$target_gen_dir/snapshot.cc",
-    ]
+    outputs = []
+
+    data = []
 
     args = [
       "./" + rebase_path(get_label_info(":mksnapshot($v8_snapshot_toolchain)",
                                         "root_out_dir") + "/mksnapshot",
                          root_build_dir),
       "--turbo_instruction_scheduling",
-      "--startup_src",
-      rebase_path("$target_gen_dir/snapshot.cc", root_build_dir),
     ]
 
+    args += invoker.args
+
+    if (v8_enable_embedded_builtins) {
+      outputs += [ "$target_gen_dir/embedded${suffix}.cc" ]
+      args += [
+        "--embedded_src",
+        rebase_path("$target_gen_dir/embedded${suffix}.cc", root_build_dir),
+      ]
+      if (invoker.embedded_variant != "") {
+        args += [
+          "--embedded_variant",
+          invoker.embedded_variant,
+        ]
+      }
+    }
+
     if (v8_random_seed != "0") {
       args += [
         "--random-seed",
@@ -837,10 +890,17 @@ if (v8_use_snapshot) {
     }
 
     if (v8_use_external_startup_data) {
-      outputs += [ "$root_out_dir/snapshot_blob.bin" ]
+      outputs += [ "$root_out_dir/snapshot_blob${suffix}.bin" ]
+      data += [ "$root_out_dir/snapshot_blob${suffix}.bin" ]
       args += [
         "--startup_blob",
-        rebase_path("$root_out_dir/snapshot_blob.bin", root_build_dir),
+        rebase_path("$root_out_dir/snapshot_blob${suffix}.bin", root_build_dir),
+      ]
+    } else {
+      outputs += [ "$target_gen_dir/snapshot${suffix}.cc" ]
+      args += [
+        "--startup_src",
+        rebase_path("$target_gen_dir/snapshot${suffix}.cc", root_build_dir),
       ]
     }
 
@@ -858,6 +918,23 @@ if (v8_use_snapshot) {
   }
 }
 
+if (v8_use_snapshot) {
+  run_mksnapshot("default") {
+    args = []
+    if (v8_enable_embedded_builtins) {
+      embedded_variant = "Default"
+    }
+  }
+  if (v8_use_multi_snapshots) {
+    run_mksnapshot("trusted") {
+      args = [ "--no-untrusted-code-mitigations" ]
+      if (v8_enable_embedded_builtins) {
+        embedded_variant = "Trusted"
+      }
+    }
+  }
+}
+
 action("v8_dump_build_config") {
   script = "tools/testrunner/utils/dump_build_config.py"
   outputs = [
@@ -883,6 +960,14 @@ action("v8_dump_build_config") {
     "v8_target_cpu=\"$v8_target_cpu\"",
     "v8_use_snapshot=$v8_use_snapshot",
   ]
+
+  if (v8_current_cpu == "mips" || v8_current_cpu == "mipsel" ||
+      v8_current_cpu == "mips64" || v8_current_cpu == "mips64el") {
+    args += [
+      "mips_arch_variant=\"$mips_arch_variant\"",
+      "mips_use_msa=$mips_use_msa",
+    ]
+  }
 }
 
 ###############################################################################
@@ -921,12 +1006,13 @@ v8_source_set("v8_nosnapshot") {
     "$target_gen_dir/experimental-extras-libraries.cc",
     "$target_gen_dir/extras-libraries.cc",
     "$target_gen_dir/libraries.cc",
+    "src/snapshot/embedded-empty.cc",
     "src/snapshot/snapshot-empty.cc",
   ]
 
   if (use_jumbo_build == true) {
     jumbo_excluded_sources = [
-      # TODO(mostynb@opera.com): don't exclude these http://crbug.com/752428
+      # TODO(mostynb@vewd.com): don't exclude these http://crbug.com/752428
       # Generated source, contains same variable names as libraries.cc
       "$target_gen_dir/experimental-extras-libraries.cc",
       "$target_gen_dir/libraries.cc",
@@ -936,7 +1022,7 @@ v8_source_set("v8_nosnapshot") {
   configs = [ ":internal_config" ]
 }
 
-if (v8_use_snapshot) {
+if (v8_use_snapshot && !v8_use_external_startup_data) {
   v8_source_set("v8_snapshot") {
     # Only targets in this file and the top-level visibility target can
     # depend on this.
@@ -954,7 +1040,7 @@ if (v8_use_snapshot) {
     public_deps = [
       # This should be public so downstream targets can declare the snapshot
       # output file as their inputs.
-      ":run_mksnapshot",
+      ":run_mksnapshot_default",
     ]
 
     sources = [
@@ -965,9 +1051,13 @@ if (v8_use_snapshot) {
       "src/setup-isolate-deserialize.cc",
     ]
 
+    if (v8_enable_embedded_builtins) {
+      sources += [ "$target_gen_dir/embedded.cc" ]
+    }
+
     if (use_jumbo_build == true) {
       jumbo_excluded_sources = [
-        # TODO(mostynb@opera.com): don't exclude these http://crbug.com/752428
+        # TODO(mostynb@vewd.com): don't exclude these http://crbug.com/752428
         # Generated source, contains same variable names as libraries.cc
         "$target_gen_dir/experimental-extras-libraries.cc",
         "$target_gen_dir/libraries.cc",
@@ -978,7 +1068,7 @@ if (v8_use_snapshot) {
   }
 }
 
-if (v8_use_external_startup_data) {
+if (v8_use_snapshot && v8_use_external_startup_data) {
   v8_source_set("v8_external_snapshot") {
     visibility = [ ":*" ]  # Only targets in this file can depend on this.
 
@@ -990,15 +1080,34 @@ if (v8_use_external_startup_data) {
     ]
     public_deps = [
       ":natives_blob",
-      ":run_mksnapshot",
+      ":run_mksnapshot_default",
     ]
 
+    if (v8_use_multi_snapshots) {
+      public_deps += [ ":run_mksnapshot_trusted" ]
+    }
+
     sources = [
       "src/setup-isolate-deserialize.cc",
       "src/snapshot/natives-external.cc",
       "src/snapshot/snapshot-external.cc",
     ]
 
+    if (v8_enable_embedded_builtins) {
+      sources += [ "$target_gen_dir/embedded.cc" ]
+
+      if (v8_use_multi_snapshots) {
+        sources += [ "$target_gen_dir/embedded_trusted.cc" ]
+
+        if (use_jumbo_build == true) {
+          jumbo_excluded_sources = [
+            # Duplicated symbols with embedded.cc
+            "$target_gen_dir/embedded_trusted.cc",
+          ]
+        }
+      }
+    }
+
     configs = [ ":internal_config" ]
   }
 }
@@ -1018,6 +1127,7 @@ v8_source_set("v8_initializers") {
     "src/builtins/builtins-arguments-gen.cc",
     "src/builtins/builtins-arguments-gen.h",
     "src/builtins/builtins-array-gen.cc",
+    "src/builtins/builtins-array-gen.h",
     "src/builtins/builtins-async-function-gen.cc",
     "src/builtins/builtins-async-gen.cc",
     "src/builtins/builtins-async-gen.h",
@@ -1060,8 +1170,11 @@ v8_source_set("v8_initializers") {
     "src/builtins/builtins-string-gen.h",
     "src/builtins/builtins-symbol-gen.cc",
     "src/builtins/builtins-typedarray-gen.cc",
+    "src/builtins/builtins-typedarray-gen.h",
     "src/builtins/builtins-utils-gen.h",
     "src/builtins/builtins-wasm-gen.cc",
+    "src/builtins/growable-fixed-array-gen.cc",
+    "src/builtins/growable-fixed-array-gen.h",
     "src/builtins/setup-builtins-internal.cc",
     "src/heap/setup-heap-internal.cc",
     "src/ic/accessor-assembler.cc",
@@ -1082,7 +1195,7 @@ v8_source_set("v8_initializers") {
 
   if (use_jumbo_build == true) {
     jumbo_excluded_sources = [
-      # TODO(mostynb@opera.com): don't exclude these http://crbug.com/752428
+      # TODO(mostynb@vewd.com): don't exclude these http://crbug.com/752428
       "src/builtins/builtins-async-iterator-gen.cc",
       "src/builtins/builtins-async-generator-gen.cc",
 
@@ -1193,7 +1306,6 @@ v8_source_set("v8_base") {
     "//base/trace_event/common/trace_event_common.h",
 
     ### gcmole(all) ###
-    "include/v8-debug.h",
     "include/v8-inspector-protocol.h",
     "include/v8-inspector.h",
     "include/v8-platform.h",
@@ -1236,8 +1348,6 @@ v8_source_set("v8_base") {
     "src/assert-scope.h",
     "src/ast/ast-function-literal-id-reindexer.cc",
     "src/ast/ast-function-literal-id-reindexer.h",
-    "src/ast/ast-numbering.cc",
-    "src/ast/ast-numbering.h",
     "src/ast/ast-source-ranges.h",
     "src/ast/ast-traversal-visitor.h",
     "src/ast/ast-value-factory.cc",
@@ -1304,6 +1414,8 @@ v8_source_set("v8_base") {
     "src/builtins/builtins-utils.h",
     "src/builtins/builtins.cc",
     "src/builtins/builtins.h",
+    "src/builtins/constants-table-builder.cc",
+    "src/builtins/constants-table-builder.h",
     "src/cached-powers.cc",
     "src/cached-powers.h",
     "src/callable.h",
@@ -1396,6 +1508,7 @@ v8_source_set("v8_base") {
     "src/compiler/frame-states.h",
     "src/compiler/frame.cc",
     "src/compiler/frame.h",
+    "src/compiler/functional-list.h",
     "src/compiler/gap-resolver.cc",
     "src/compiler/gap-resolver.h",
     "src/compiler/graph-assembler.cc",
@@ -1611,6 +1724,8 @@ v8_source_set("v8_base") {
     "src/extensions/trigger-failure-extension.h",
     "src/external-reference-table.cc",
     "src/external-reference-table.h",
+    "src/external-reference.cc",
+    "src/external-reference.h",
     "src/factory-inl.h",
     "src/factory.cc",
     "src/factory.h",
@@ -1639,6 +1754,8 @@ v8_source_set("v8_base") {
     "src/global-handles.cc",
     "src/global-handles.h",
     "src/globals.h",
+    "src/handler-table.cc",
+    "src/handler-table.h",
     "src/handles-inl.h",
     "src/handles.cc",
     "src/handles.h",
@@ -1670,6 +1787,7 @@ v8_source_set("v8_base") {
     "src/heap/invalidated-slots-inl.h",
     "src/heap/invalidated-slots.cc",
     "src/heap/invalidated-slots.h",
+    "src/heap/item-parallel-job.cc",
     "src/heap/item-parallel-job.h",
     "src/heap/local-allocator.h",
     "src/heap/mark-compact-inl.h",
@@ -1719,6 +1837,8 @@ v8_source_set("v8_base") {
     "src/icu_util.h",
     "src/identity-map.cc",
     "src/identity-map.h",
+    "src/instruction-stream.cc",
+    "src/instruction-stream.h",
     "src/interface-descriptors.cc",
     "src/interface-descriptors.h",
     "src/interpreter/block-coverage-builder.h",
@@ -1835,6 +1955,8 @@ v8_source_set("v8_base") {
     "src/objects/js-array.h",
     "src/objects/js-collection-inl.h",
     "src/objects/js-collection.h",
+    "src/objects/js-promise-inl.h",
+    "src/objects/js-promise.h",
     "src/objects/js-regexp-inl.h",
     "src/objects/js-regexp.h",
     "src/objects/literal-objects-inl.h",
@@ -1842,6 +1964,10 @@ v8_source_set("v8_base") {
     "src/objects/literal-objects.h",
     "src/objects/map-inl.h",
     "src/objects/map.h",
+    "src/objects/maybe-object-inl.h",
+    "src/objects/maybe-object.h",
+    "src/objects/microtask-inl.h",
+    "src/objects/microtask.h",
     "src/objects/module-inl.h",
     "src/objects/module.cc",
     "src/objects/module.h",
@@ -1849,6 +1975,8 @@ v8_source_set("v8_base") {
     "src/objects/name.h",
     "src/objects/object-macros-undef.h",
     "src/objects/object-macros.h",
+    "src/objects/promise-inl.h",
+    "src/objects/promise.h",
     "src/objects/property-descriptor-object-inl.h",
     "src/objects/property-descriptor-object.h",
     "src/objects/regexp-match-info.h",
@@ -1865,8 +1993,6 @@ v8_source_set("v8_base") {
     "src/objects/template-objects.h",
     "src/ostreams.cc",
     "src/ostreams.h",
-    "src/parsing/background-parsing-task.cc",
-    "src/parsing/background-parsing-task.h",
     "src/parsing/duplicate-finder.h",
     "src/parsing/expression-classifier.h",
     "src/parsing/expression-scope-reparenter.cc",
@@ -2019,6 +2145,7 @@ v8_source_set("v8_base") {
     "src/snapshot/default-serializer-allocator.h",
     "src/snapshot/deserializer.cc",
     "src/snapshot/deserializer.h",
+    "src/snapshot/macros.h",
     "src/snapshot/natives-common.cc",
     "src/snapshot/natives.h",
     "src/snapshot/object-deserializer.cc",
@@ -2126,14 +2253,10 @@ v8_source_set("v8_base") {
     "src/wasm/signature-map.h",
     "src/wasm/streaming-decoder.cc",
     "src/wasm/streaming-decoder.h",
-    "src/wasm/wasm-api.cc",
-    "src/wasm/wasm-api.h",
     "src/wasm/wasm-code-manager.cc",
     "src/wasm/wasm-code-manager.h",
     "src/wasm/wasm-code-specialization.cc",
     "src/wasm/wasm-code-specialization.h",
-    "src/wasm/wasm-code-wrapper.cc",
-    "src/wasm/wasm-code-wrapper.h",
     "src/wasm/wasm-constants.h",
     "src/wasm/wasm-debug.cc",
     "src/wasm/wasm-engine.cc",
@@ -2179,7 +2302,7 @@ v8_source_set("v8_base") {
 
   if (use_jumbo_build == true) {
     jumbo_excluded_sources = [
-      # TODO(mostynb@opera.com): don't exclude these http://crbug.com/752428
+      # TODO(mostynb@vewd.com): don't exclude these http://crbug.com/752428
       "src/profiler/heap-snapshot-generator.cc",  # Macro clash in mman-linux.h
 
       # These source files take an unusually large amount of time to
@@ -2334,7 +2457,7 @@ v8_source_set("v8_base") {
     ]
     if (use_jumbo_build) {
       jumbo_excluded_sources += [
-        # TODO(mostynb@opera.com): fix this code so it doesn't need
+        # TODO(mostynb@vewd.com): fix this code so it doesn't need
         # to be excluded, see the comments inside.
         "src/arm64/instructions-arm64-constants.cc",
       ]
@@ -2562,6 +2685,8 @@ v8_component("v8_libbase") {
 
   public_configs = [ ":libbase_config" ]
 
+  data = []
+
   defines = []
 
   if (is_component_build) {
@@ -2570,11 +2695,15 @@ v8_component("v8_libbase") {
 
   if (is_posix) {
     sources += [
-      "src/base/platform/platform-posix-time.cc",
-      "src/base/platform/platform-posix-time.h",
       "src/base/platform/platform-posix.cc",
       "src/base/platform/platform-posix.h",
     ]
+    if (current_os != "aix") {
+      sources += [
+        "src/base/platform/platform-posix-time.cc",
+        "src/base/platform/platform-posix-time.h",
+      ]
+    }
   }
 
   if (is_linux) {
@@ -2646,6 +2775,81 @@ v8_component("v8_libbase") {
       "winmm.lib",
       "ws2_32.lib",
     ]
+
+    if (is_component_build) {
+      # TODO(machenbach): Move the original out of src/base in order to depend
+      # on it.
+      # Copy the VS runtime DLLs into the isolate so that they don't have to be
+      # preinstalled on the target machine. The debug runtimes have a "d" at
+      # the end.
+      if (is_debug) {
+        vcrt_suffix = "d"
+      } else {
+        vcrt_suffix = ""
+      }
+
+      # These runtime files are copied to the output directory by the
+      # vs_toolchain script that runs as part of toolchain configuration.
+      data += [
+        "$root_out_dir/msvcp140${vcrt_suffix}.dll",
+        "$root_out_dir/vccorlib140${vcrt_suffix}.dll",
+        "$root_out_dir/vcruntime140${vcrt_suffix}.dll",
+
+        # Universal Windows 10 CRT files
+        "$root_out_dir/api-ms-win-core-console-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-datetime-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-debug-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-errorhandling-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-file-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-file-l1-2-0.dll",
+        "$root_out_dir/api-ms-win-core-file-l2-1-0.dll",
+        "$root_out_dir/api-ms-win-core-handle-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-heap-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-interlocked-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-libraryloader-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-localization-l1-2-0.dll",
+        "$root_out_dir/api-ms-win-core-memory-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-namedpipe-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-processenvironment-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-processthreads-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-processthreads-l1-1-1.dll",
+        "$root_out_dir/api-ms-win-core-profile-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-rtlsupport-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-string-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-synch-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-synch-l1-2-0.dll",
+        "$root_out_dir/api-ms-win-core-sysinfo-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-timezone-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-core-util-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-conio-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-convert-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-environment-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-filesystem-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-heap-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-locale-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-math-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-multibyte-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-private-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-process-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-runtime-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-stdio-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-string-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-time-l1-1-0.dll",
+        "$root_out_dir/api-ms-win-crt-utility-l1-1-0.dll",
+        "$root_out_dir/ucrtbase${vcrt_suffix}.dll",
+      ]
+      if (is_asan) {
+        if (current_cpu == "x64") {
+          data += [ "$clang_base_path/lib/clang/$clang_version/lib/windows/clang_rt.asan_dynamic-x86_64.dll" ]
+        } else {
+          data += [ "$clang_base_path/lib/clang/$clang_version/lib/windows/clang_rt.asan_dynamic-i386.dll" ]
+        }
+      }
+    }
+  }
+
+  if (is_tsan && !build_with_chromium) {
+    data += [ "tools/sanitizers/tsan_suppressions.txt" ]
   }
 
   # TODO(jochen): Add support for qnx, freebsd, openbsd, netbsd, and solaris.
@@ -2657,12 +2861,12 @@ v8_component("v8_libplatform") {
     "include/libplatform/libplatform-export.h",
     "include/libplatform/libplatform.h",
     "include/libplatform/v8-tracing.h",
-    "src/libplatform/default-background-task-runner.cc",
-    "src/libplatform/default-background-task-runner.h",
     "src/libplatform/default-foreground-task-runner.cc",
     "src/libplatform/default-foreground-task-runner.h",
     "src/libplatform/default-platform.cc",
     "src/libplatform/default-platform.h",
+    "src/libplatform/default-worker-threads-task-runner.cc",
+    "src/libplatform/default-worker-threads-task-runner.h",
     "src/libplatform/task-queue.cc",
     "src/libplatform/task-queue.h",
     "src/libplatform/tracing/trace-buffer.cc",
@@ -2800,10 +3004,6 @@ group("gn_all") {
   if (want_v8_shell) {
     deps += [ ":v8_shell" ]
   }
-
-  if (v8_test_isolation_mode != "noop") {
-    deps += [ ":d8_run" ]
-  }
 }
 
 group("v8_clusterfuzz") {
@@ -2821,13 +3021,6 @@ group("v8_clusterfuzz") {
       ":d8(//build/toolchain/linux:clang_x86_v8_arm)",
     ]
   }
-
-  if (v8_test_isolation_mode != "noop") {
-    deps += [
-      "tools:run-deopt-fuzzer_run",
-      "tools:run-num-fuzzer_run",
-    ]
-  }
 }
 
 group("v8_archive") {
@@ -2838,13 +3031,13 @@ group("v8_archive") {
 
 group("v8_fuzzers") {
   testonly = true
-  deps = [
+  data_deps = [
     ":v8_simple_json_fuzzer",
     ":v8_simple_multi_return_fuzzer",
     ":v8_simple_parser_fuzzer",
+    ":v8_simple_regexp_builtins_fuzzer",
     ":v8_simple_regexp_fuzzer",
     ":v8_simple_wasm_async_fuzzer",
-    ":v8_simple_wasm_call_fuzzer",
     ":v8_simple_wasm_code_fuzzer",
     ":v8_simple_wasm_compile_fuzzer",
     ":v8_simple_wasm_data_section_fuzzer",
@@ -2952,24 +3145,16 @@ v8_executable("d8") {
   }
 
   if (v8_correctness_fuzzer) {
-    deps += [ "tools/foozzie:v8_correctness_fuzzer_resources" ]
+    deps += [ "tools/clusterfuzz:v8_correctness_fuzzer_resources" ]
   }
 
   defines = []
 
   if (v8_enable_vtunejit) {
-    deps += [ "//src/third_party/vtune:v8_vtune" ]
+    deps += [ "src/third_party/vtune:v8_vtune" ]
   }
 }
 
-v8_isolate_run("d8") {
-  deps = [
-    ":d8",
-  ]
-
-  isolate = "//src/d8.isolate"
-}
-
 v8_executable("v8_hello_world") {
   sources = [
     "samples/hello-world.cc",
@@ -3127,6 +3312,25 @@ v8_source_set("parser_fuzzer") {
 v8_fuzzer("parser_fuzzer") {
 }
 
+v8_source_set("regexp_builtins_fuzzer") {
+  sources = [
+    "test/fuzzer/regexp-builtins.cc",
+    "test/fuzzer/regexp_builtins/mjsunit.js.h",
+  ]
+
+  deps = [
+    ":fuzzer_support",
+  ]
+
+  configs = [
+    ":external_config",
+    ":internal_config_base",
+  ]
+}
+
+v8_fuzzer("regexp_builtins_fuzzer") {
+}
+
 v8_source_set("regexp_fuzzer") {
   sources = [
     "test/fuzzer/regexp.cc",
@@ -3218,27 +3422,6 @@ v8_source_set("wasm_code_fuzzer") {
 v8_fuzzer("wasm_code_fuzzer") {
 }
 
-v8_source_set("wasm_call_fuzzer") {
-  sources = [
-    "test/common/wasm/test-signatures.h",
-    "test/fuzzer/wasm-call.cc",
-  ]
-
-  deps = [
-    ":fuzzer_support",
-    ":lib_wasm_fuzzer_common",
-    ":wasm_module_runner",
-  ]
-
-  configs = [
-    ":external_config",
-    ":internal_config_base",
-  ]
-}
-
-v8_fuzzer("wasm_call_fuzzer") {
-}
-
 v8_source_set("lib_wasm_fuzzer_common") {
   sources = [
     "test/fuzzer/wasm-fuzzer-common.cc",
diff --git a/deps/v8/ChangeLog b/deps/v8/ChangeLog
index 1fe3135a011..b824e74a94e 100644
--- a/deps/v8/ChangeLog
+++ b/deps/v8/ChangeLog
@@ -1,3 +1,2863 @@
+2018-03-30: Version 6.7.213
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-30: Version 6.7.212
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-29: Version 6.7.211
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-29: Version 6.7.210
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-29: Version 6.7.209
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-29: Version 6.7.208
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-29: Version 6.7.207
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-29: Version 6.7.206
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-29: Version 6.7.205
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-29: Version 6.7.204
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-28: Version 6.7.203
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-28: Version 6.7.202
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-28: Version 6.7.201
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-28: Version 6.7.200
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-28: Version 6.7.199
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-28: Version 6.7.198
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-28: Version 6.7.197
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-28: Version 6.7.196
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-28: Version 6.7.195
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-28: Version 6.7.194
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-27: Version 6.7.193
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-27: Version 6.7.192
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-27: Version 6.7.191
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-27: Version 6.7.190
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-27: Version 6.7.189
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-27: Version 6.7.188
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-27: Version 6.7.187
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-27: Version 6.7.186
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-27: Version 6.7.185
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-27: Version 6.7.184
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.183
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.182
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.181
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.180
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.179
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.178
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.177
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.176
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.175
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.174
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.173
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.172
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.171
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.170
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.169
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.168
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.167
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-26: Version 6.7.166
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-24: Version 6.7.165
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-24: Version 6.7.164
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-24: Version 6.7.163
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.162
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.161
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.160
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.159
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.158
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.157
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.156
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.155
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.154
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.153
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.152
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.151
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.150
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.149
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.148
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-23: Version 6.7.147
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-22: Version 6.7.146
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-22: Version 6.7.145
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-22: Version 6.7.144
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-22: Version 6.7.143
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-22: Version 6.7.142
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-22: Version 6.7.141
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-22: Version 6.7.140
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.139
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.138
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.137
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.136
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.135
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.134
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.133
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.132
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.131
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.130
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.129
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.128
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.127
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.126
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.125
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.124
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-21: Version 6.7.123
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-20: Version 6.7.122
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-20: Version 6.7.121
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-20: Version 6.7.120
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-20: Version 6.7.119
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-20: Version 6.7.118
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-20: Version 6.7.117
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-20: Version 6.7.116
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-20: Version 6.7.115
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-20: Version 6.7.114
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-20: Version 6.7.113
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-20: Version 6.7.112
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-20: Version 6.7.111
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-20: Version 6.7.110
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-19: Version 6.7.109
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-19: Version 6.7.108
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-19: Version 6.7.107
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-19: Version 6.7.106
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-19: Version 6.7.105
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-19: Version 6.7.104
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-19: Version 6.7.103
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-17: Version 6.7.102
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-16: Version 6.7.101
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-16: Version 6.7.100
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-16: Version 6.7.99
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-16: Version 6.7.98
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-16: Version 6.7.97
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-16: Version 6.7.96
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-16: Version 6.7.95
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-16: Version 6.7.94
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-16: Version 6.7.93
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-16: Version 6.7.92
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-16: Version 6.7.91
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-16: Version 6.7.90
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-16: Version 6.7.89
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.88
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.87
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.86
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.85
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.84
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.83
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.82
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.81
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.80
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.79
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.78
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.77
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.76
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.75
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.74
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-15: Version 6.7.73
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.72
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.71
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.70
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.69
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.68
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.67
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.66
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.65
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.64
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.63
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.62
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.61
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.60
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.59
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.58
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.57
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.56
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.55
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-14: Version 6.7.54
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-13: Version 6.7.53
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-13: Version 6.7.52
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-13: Version 6.7.51
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-13: Version 6.7.50
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-13: Version 6.7.49
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-13: Version 6.7.48
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-13: Version 6.7.47
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-13: Version 6.7.46
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-13: Version 6.7.45
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-12: Version 6.7.44
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-12: Version 6.7.43
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-12: Version 6.7.42
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-12: Version 6.7.41
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-12: Version 6.7.40
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-12: Version 6.7.39
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-12: Version 6.7.38
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-12: Version 6.7.37
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-12: Version 6.7.36
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-12: Version 6.7.35
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-12: Version 6.7.34
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-12: Version 6.7.33
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-12: Version 6.7.32
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-10: Version 6.7.31
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-09: Version 6.7.30
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-09: Version 6.7.29
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-08: Version 6.7.28
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-08: Version 6.7.27
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-08: Version 6.7.26
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-07: Version 6.7.25
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-07: Version 6.7.24
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-07: Version 6.7.23
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-06: Version 6.7.22
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-06: Version 6.7.21
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-06: Version 6.7.20
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-06: Version 6.7.19
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-06: Version 6.7.18
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-06: Version 6.7.17
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-06: Version 6.7.16
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-05: Version 6.7.15
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-05: Version 6.7.14
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-05: Version 6.7.13
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-05: Version 6.7.12
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-05: Version 6.7.11
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-05: Version 6.7.10
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-05: Version 6.7.9
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-02: Version 6.7.8
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-02: Version 6.7.7
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-02: Version 6.7.6
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-02: Version 6.7.5
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-02: Version 6.7.4
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-02: Version 6.7.3
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-02: Version 6.7.2
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-02: Version 6.7.1
+
+        Performance and stability improvements on all platforms.
+
+
+2018-03-01: Version 6.6.356
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-28: Version 6.6.355
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-28: Version 6.6.354
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-28: Version 6.6.353
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-28: Version 6.6.352
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-28: Version 6.6.351
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-28: Version 6.6.350
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-28: Version 6.6.349
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-28: Version 6.6.348
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-28: Version 6.6.347
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-28: Version 6.6.346
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-28: Version 6.6.345
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-28: Version 6.6.344
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-28: Version 6.6.343
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-27: Version 6.6.342
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-27: Version 6.6.341
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-27: Version 6.6.340
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-27: Version 6.6.339
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-27: Version 6.6.338
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-27: Version 6.6.337
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-27: Version 6.6.336
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.335
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.334
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.333
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.332
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.331
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.330
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.329
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.328
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.327
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.326
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.325
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.324
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.323
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.322
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.321
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.320
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-26: Version 6.6.319
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-25: Version 6.6.318
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-25: Version 6.6.317
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-25: Version 6.6.316
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-25: Version 6.6.315
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-24: Version 6.6.314
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-24: Version 6.6.313
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.312
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.311
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.310
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.309
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.308
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.307
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.306
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.305
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.304
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.303
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.302
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.301
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.300
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.299
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-23: Version 6.6.298
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.297
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.296
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.295
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.294
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.293
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.292
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.291
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.290
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.289
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.288
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.287
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.286
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.285
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.284
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-22: Version 6.6.283
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-21: Version 6.6.282
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-21: Version 6.6.281
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-21: Version 6.6.280
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-20: Version 6.6.279
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-20: Version 6.6.278
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-20: Version 6.6.277
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-20: Version 6.6.276
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-20: Version 6.6.275
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-20: Version 6.6.274
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-20: Version 6.6.273
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-20: Version 6.6.272
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-20: Version 6.6.271
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-20: Version 6.6.270
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-20: Version 6.6.269
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-20: Version 6.6.268
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-20: Version 6.6.267
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-19: Version 6.6.266
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-19: Version 6.6.265
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-19: Version 6.6.264
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-19: Version 6.6.263
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-19: Version 6.6.262
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-19: Version 6.6.261
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-17: Version 6.6.260
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-17: Version 6.6.259
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-16: Version 6.6.258
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-16: Version 6.6.257
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-16: Version 6.6.256
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-16: Version 6.6.255
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-15: Version 6.6.254
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-15: Version 6.6.253
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-15: Version 6.6.252
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-14: Version 6.6.251
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-14: Version 6.6.250
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-14: Version 6.6.249
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-14: Version 6.6.248
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-14: Version 6.6.247
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-14: Version 6.6.246
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-14: Version 6.6.245
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-14: Version 6.6.244
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-14: Version 6.6.243
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-14: Version 6.6.242
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-14: Version 6.6.241
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-14: Version 6.6.240
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-13: Version 6.6.239
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-13: Version 6.6.238
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-13: Version 6.6.237
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-13: Version 6.6.236
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-13: Version 6.6.235
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-13: Version 6.6.234
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-12: Version 6.6.233
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-12: Version 6.6.232
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-12: Version 6.6.231
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-12: Version 6.6.230
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-12: Version 6.6.229
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.228
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.227
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.226
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.225
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.224
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.223
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.222
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.221
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.220
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.219
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.218
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.217
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.216
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.215
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.214
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.213
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-09: Version 6.6.212
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.211
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.210
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.209
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.208
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.207
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.206
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.205
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.204
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.203
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.202
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.201
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.200
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.199
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.198
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.197
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-08: Version 6.6.196
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.195
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.194
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.193
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.192
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.191
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.190
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.189
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.188
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.187
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.186
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.185
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.184
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.183
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.182
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.181
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-07: Version 6.6.180
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-06: Version 6.6.179
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-06: Version 6.6.178
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-06: Version 6.6.177
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-06: Version 6.6.176
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-06: Version 6.6.175
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-06: Version 6.6.174
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-06: Version 6.6.173
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-06: Version 6.6.172
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-06: Version 6.6.171
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-06: Version 6.6.170
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-06: Version 6.6.169
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-06: Version 6.6.168
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-06: Version 6.6.167
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-06: Version 6.6.166
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-05: Version 6.6.165
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-05: Version 6.6.164
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-05: Version 6.6.163
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-05: Version 6.6.162
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-05: Version 6.6.161
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-05: Version 6.6.160
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-05: Version 6.6.159
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-05: Version 6.6.158
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-05: Version 6.6.157
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-05: Version 6.6.156
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.155
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.154
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.153
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.152
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.151
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.150
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.149
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.148
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.147
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.146
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.145
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.144
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.143
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.142
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-02: Version 6.6.141
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-01: Version 6.6.140
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-01: Version 6.6.139
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-01: Version 6.6.138
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-01: Version 6.6.137
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-01: Version 6.6.136
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-01: Version 6.6.135
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-01: Version 6.6.134
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-01: Version 6.6.133
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-01: Version 6.6.132
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-01: Version 6.6.131
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-01: Version 6.6.130
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-01: Version 6.6.129
+
+        Performance and stability improvements on all platforms.
+
+
+2018-02-01: Version 6.6.128
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-31: Version 6.6.127
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-31: Version 6.6.126
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-31: Version 6.6.125
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-31: Version 6.6.124
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-31: Version 6.6.123
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-31: Version 6.6.122
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-31: Version 6.6.121
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-31: Version 6.6.120
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-31: Version 6.6.119
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-31: Version 6.6.118
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-31: Version 6.6.117
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-31: Version 6.6.116
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-30: Version 6.6.115
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-30: Version 6.6.114
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-30: Version 6.6.113
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-30: Version 6.6.112
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-30: Version 6.6.111
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-30: Version 6.6.110
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-30: Version 6.6.109
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-30: Version 6.6.108
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-30: Version 6.6.107
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-30: Version 6.6.106
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.105
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.104
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.103
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.102
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.101
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.100
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.99
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.98
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.97
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.96
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.95
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.94
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.93
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.92
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-29: Version 6.6.91
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-27: Version 6.6.90
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-27: Version 6.6.89
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-26: Version 6.6.88
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-26: Version 6.6.87
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-26: Version 6.6.86
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-26: Version 6.6.85
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-26: Version 6.6.84
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-26: Version 6.6.83
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.82
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.81
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.80
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.79
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.78
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.77
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.76
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.75
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.74
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.73
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.72
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.71
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.70
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.69
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.68
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-25: Version 6.6.67
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.66
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.65
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.64
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.63
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.62
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.61
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.60
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.59
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.58
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.57
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.56
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.55
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.54
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.53
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-24: Version 6.6.52
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.51
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.50
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.49
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.48
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.47
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.46
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.45
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.44
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.43
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.42
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.41
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.40
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.39
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.38
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.37
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.36
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.35
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.34
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-23: Version 6.6.33
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.32
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.31
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.30
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.29
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.28
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.27
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.26
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.25
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.24
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.23
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.22
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.21
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.20
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.19
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.18
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.17
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.16
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.15
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.14
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.13
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-22: Version 6.6.12
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-21: Version 6.6.11
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-20: Version 6.6.10
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-20: Version 6.6.9
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-19: Version 6.6.8
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-19: Version 6.6.7
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-19: Version 6.6.6
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-19: Version 6.6.5
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-19: Version 6.6.4
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-19: Version 6.6.3
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-19: Version 6.6.2
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-19: Version 6.6.1
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-18: Version 6.5.257
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-18: Version 6.5.256
+
+        Performance and stability improvements on all platforms.
+
+
+2018-01-18: Version 6.5.255
+
+        Performance and stability improvements on all platforms.
+
+
 2018-01-17: Version 6.5.254
 
         Performance and stability improvements on all platforms.
diff --git a/deps/v8/DEPS b/deps/v8/DEPS
index bc9e4e0a90c..00a45480de2 100644
--- a/deps/v8/DEPS
+++ b/deps/v8/DEPS
@@ -3,64 +3,65 @@
 # all paths in here must match this assumption.
 
 vars = {
+  'build_for_node': False,
   'checkout_instrumented_libraries': False,
   'chromium_url': 'https://chromium.googlesource.com',
-  'build_for_node': False,
+  'download_gcmole': False,
+  'download_jsfunfuzz': False,
+  'download_mips_toolchain': False,
 }
 
 deps = {
   'v8/build':
-    Var('chromium_url') + '/chromium/src/build.git' + '@' + 'b3a78cd03a95c30ff10f863f736249eb04f0f34d',
+    Var('chromium_url') + '/chromium/src/build.git' + '@' + 'e7b36e57bbceeea55bd6603fcc4f6c1de375f5a3',
   'v8/tools/gyp':
     Var('chromium_url') + '/external/gyp.git' + '@' + 'd61a9397e668fa9843c4aa7da9e79460fe590bfb',
   'v8/third_party/icu':
-    Var('chromium_url') + '/chromium/deps/icu.git' + '@' + 'c8ca2962b46670ec89071ffd1291688983cd319c',
+    Var('chromium_url') + '/chromium/deps/icu.git' + '@' + 'd888fd2a1be890f4d35e43f68d6d79f42519a357',
   'v8/third_party/instrumented_libraries':
-    Var('chromium_url') + '/chromium/src/third_party/instrumented_libraries.git' + '@' + 'b7578b4132cf73ca3265e2ee0b7bd0a422a54ebf',
+    Var('chromium_url') + '/chromium/src/third_party/instrumented_libraries.git' + '@' + '323cf32193caecbf074d1a0cb5b02b905f163e0f',
   'v8/buildtools':
-    Var('chromium_url') + '/chromium/buildtools.git' + '@' + '6fe4a3251488f7af86d64fc25cf442e817cf6133',
+    Var('chromium_url') + '/chromium/buildtools.git' + '@' + '3748a2a90871fc25b0455790fa5a6699553f5197',
   'v8/base/trace_event/common':
-    Var('chromium_url') + '/chromium/src/base/trace_event/common.git' + '@' + '0e9a47d74970bee1bbfc063c47215406f8918699',
+    Var('chromium_url') + '/chromium/src/base/trace_event/common.git' + '@' + '211b3ed9d0481b4caddbee1322321b86a483ca1f',
   'v8/third_party/android_ndk': {
-    'url': Var('chromium_url') + '/android_ndk.git' + '@' + 'e951c37287c7d8cd915bf8d4149fd4a06d808b55',
+    'url': Var('chromium_url') + '/android_ndk.git' + '@' + '635bc380968a76f6948fee65f80a0b28db53ae81',
     'condition': 'checkout_android',
   },
   'v8/third_party/android_tools': {
-    'url': Var('chromium_url') + '/android_tools.git' + '@' + 'c78b25872734e0038ae2a333edc645cd96bc232d',
+    'url': Var('chromium_url') + '/android_tools.git' + '@' + 'c22a664c39af72dd8f89200220713dcad811300a',
     'condition': 'checkout_android',
   },
   'v8/third_party/catapult': {
-    'url': Var('chromium_url') + '/catapult.git' + '@' + 'b4826a52853c9c2778d496f6c6fa853f777f94df',
+    'url': Var('chromium_url') + '/catapult.git' + '@' + 'b1c9ad5aa1d025c93dd71880a84c2381909584d5',
     'condition': 'checkout_android',
   },
   'v8/third_party/colorama/src': {
     'url': Var('chromium_url') + '/external/colorama.git' + '@' + '799604a1041e9b3bc5d2789ecbd7e8db2e18e6b8',
     'condition': 'checkout_android',
   },
+  'v8/third_party/googletest/src':
+    Var('chromium_url') + '/external/github.com/google/googletest.git' + '@' + 'a325ad2db5deb623eab740527e559b81c0f39d65',
   'v8/third_party/jinja2':
-    Var('chromium_url') + '/chromium/src/third_party/jinja2.git' + '@' + 'd34383206fa42d52faa10bb9931d6d538f3a57e0',
+    Var('chromium_url') + '/chromium/src/third_party/jinja2.git' + '@' + '45571de473282bd1d8b63a8dfcb1fd268d0635d2',
   'v8/third_party/markupsafe':
     Var('chromium_url') + '/chromium/src/third_party/markupsafe.git' + '@' + '8f45f5cfa0009d2a70589bcda0349b8cb2b72783',
   'v8/tools/swarming_client':
     Var('chromium_url') + '/infra/luci/client-py.git' + '@' + '88229872dd17e71658fe96763feaa77915d8cbd6',
-  'v8/testing/gtest':
-    Var('chromium_url') + '/external/github.com/google/googletest.git' + '@' + '6f8a66431cb592dad629028a50b3dd418a408c87',
-  'v8/testing/gmock':
-    Var('chromium_url') + '/external/googlemock.git' + '@' + '0421b6f358139f02e102c9c332ce19a33faf75be',
   'v8/test/benchmarks/data':
     Var('chromium_url') + '/v8/deps/third_party/benchmarks.git' + '@' + '05d7188267b4560491ff9155c5ee13e207ecd65f',
   'v8/test/mozilla/data':
     Var('chromium_url') + '/v8/deps/third_party/mozilla-tests.git' + '@' + 'f6c578a10ea707b1a8ab0b88943fe5115ce2b9be',
   'v8/test/test262/data':
-    Var('chromium_url') + '/external/github.com/tc39/test262.git' + '@' + '8311965251953d4745aeb68c98fb71fab2eac1d0',
+    Var('chromium_url') + '/external/github.com/tc39/test262.git' + '@' + '0192e0d70e2295fb590f14865da42f0f9dfa64bd',
   'v8/test/test262/harness':
     Var('chromium_url') + '/external/github.com/test262-utils/test262-harness-py.git' + '@' + '0f2acdd882c84cff43b9d60df7574a1901e2cdcd',
   'v8/tools/clang':
-    Var('chromium_url') + '/chromium/src/tools/clang.git' + '@' + '27088876ff821e8a1518383576a43662a3255d56',
+    Var('chromium_url') + '/chromium/src/tools/clang.git' + '@' + '82ac1c9c988260d902e5f2bc73f19792fa3d430c',
   'v8/tools/luci-go':
-    Var('chromium_url') + '/chromium/src/tools/luci-go.git' + '@' + 'd882048313f6f51df29856406fa03b620c1d0205',
+    Var('chromium_url') + '/chromium/src/tools/luci-go.git' + '@' + 'ff0709d4283b1f233dcf0c9fec1672c6ecaed2f1',
   'v8/test/wasm-js':
-    Var('chromium_url') + '/external/github.com/WebAssembly/spec.git' + '@' + 'a25083ac7076b05e3f304ec9e093ef1b1ee09422',
+    Var('chromium_url') + '/external/github.com/WebAssembly/spec.git' + '@' + '586d34770c6445bfb93c9bae8ac50baade7ee168',
 }
 
 recursedeps = [
@@ -78,7 +79,6 @@ include_rules = [
 # checkdeps.py shouldn't check for includes in these directories:
 skip_child_includes = [
   'build',
-  'gypfiles',
   'third_party',
 ]
 
@@ -91,7 +91,9 @@ hooks = [
     'pattern': '.',
     'action': [
         'python',
-        'v8/gypfiles/landmines.py',
+        'v8/build/landmines.py',
+        '--landmine-scripts',
+        'v8/tools/get_landmines.py',
     ],
   },
   # Pull clang-format binaries using checked-in hashes.
@@ -134,21 +136,23 @@ hooks = [
   {
     'name': 'gcmole',
     'pattern': '.',
-    'condition': 'build_for_node != True',
-    # TODO(machenbach): Insert condition and remove GYP_DEFINES dependency.
-    'action': [
-        'python',
-        'v8/tools/gcmole/download_gcmole_tools.py',
+    'condition': 'download_gcmole',
+    'action': [ 'download_from_google_storage',
+                '--bucket', 'chrome-v8-gcmole',
+                '-u', '--no_resume',
+                '-s', 'v8/tools/gcmole/gcmole-tools.tar.gz.sha1',
+                '--platform=linux*',
     ],
   },
   {
     'name': 'jsfunfuzz',
     'pattern': '.',
-    'condition': 'build_for_node != True',
-    # TODO(machenbach): Insert condition and remove GYP_DEFINES dependency.
-    'action': [
-        'python',
-        'v8/tools/jsfunfuzz/download_jsfunfuzz.py',
+    'condition': 'download_jsfunfuzz',
+    'action': [ 'download_from_google_storage',
+                '--bucket', 'chrome-v8-jsfunfuzz',
+                '-u', '--no_resume',
+                '-s', 'v8/tools/jsfunfuzz/jsfunfuzz.tar.gz.sha1',
+                '--platform=linux*',
     ],
   },
   # Pull luci-go binaries (isolate, swarming) using checked-in hashes.
@@ -250,17 +254,39 @@ hooks = [
     ],
   },
   {
-    # Downloads the current stable linux sysroot to build/linux/ if needed.
-    # This sysroot updates at about the same rate that the chrome build deps
-    # change.
-    'name': 'sysroot',
+    'name': 'sysroot_arm',
     'pattern': '.',
-    'condition': 'build_for_node != True',
-    'action': [
-        'python',
-        'v8/build/linux/sysroot_scripts/install-sysroot.py',
-        '--running-as-hook',
-    ],
+    'condition': '(checkout_linux and checkout_arm)',
+    'action': ['python', 'v8/build/linux/sysroot_scripts/install-sysroot.py',
+               '--arch=arm'],
+  },
+  {
+    'name': 'sysroot_arm64',
+    'pattern': '.',
+    'condition': '(checkout_linux and checkout_arm64)',
+    'action': ['python', 'v8/build/linux/sysroot_scripts/install-sysroot.py',
+               '--arch=arm64'],
+  },
+  {
+    'name': 'sysroot_x86',
+    'pattern': '.',
+    'condition': '(checkout_linux and (checkout_x86 or checkout_x64))',
+    'action': ['python', 'v8/build/linux/sysroot_scripts/install-sysroot.py',
+               '--arch=x86'],
+  },
+  {
+    'name': 'sysroot_mips',
+    'pattern': '.',
+    'condition': '(checkout_linux and checkout_mips)',
+    'action': ['python', 'v8/build/linux/sysroot_scripts/install-sysroot.py',
+               '--arch=mips'],
+  },
+  {
+    'name': 'sysroot_x64',
+    'pattern': '.',
+    'condition': 'checkout_linux and checkout_x64',
+    'action': ['python', 'v8/build/linux/sysroot_scripts/install-sysroot.py',
+               '--arch=x64'],
   },
   {
     'name': 'msan_chained_origins',
@@ -307,6 +333,8 @@ hooks = [
     # Note: On Win, this should run after win_toolchain, as it may use it.
     'name': 'clang',
     'pattern': '.',
+    # clang not supported on aix
+    'condition': 'host_os != "aix"',
     'action': ['python', 'v8/tools/clang/scripts/update.py'],
   },
   {
@@ -316,15 +344,20 @@ hooks = [
     'action': [
       'python',
       'v8/build/fuchsia/update_sdk.py',
-      '226f6dd0cad1d6be63a353ce2649423470729ae9',
     ],
   },
   {
-    # A change to a .gyp, .gypi, or to GYP itself should run the generator.
-    'name': 'regyp_if_needed',
+    'name': 'mips_toolchain',
     'pattern': '.',
-    'condition': 'build_for_node != True',
-    'action': ['python', 'v8/gypfiles/gyp_v8', '--running-as-hook'],
+    'condition': 'download_mips_toolchain',
+    'action': [ 'download_from_google_storage',
+                '--no_resume',
+                '--platform=linux',
+                '--no_auth',
+                '-u',
+                '--bucket', 'chromium-v8',
+                '-s', 'v8/tools/mips_toolchain.tar.gz.sha1',
+    ],
   },
   # Download and initialize "vpython" VirtualEnv environment packages.
   {
diff --git a/deps/v8/Makefile b/deps/v8/Makefile
deleted file mode 100644
index 167ebf8c082..00000000000
--- a/deps/v8/Makefile
+++ /dev/null
@@ -1,493 +0,0 @@
-# Copyright 2012 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-# Variable default definitions. Override them by exporting them in your shell.
-OUTDIR ?= out
-TESTJOBS ?=
-GYPFLAGS ?=
-TESTFLAGS ?=
-ANDROID_NDK_HOST_ARCH ?=
-ANDROID_V8 ?= /data/local/tmp/v8
-
-# Special build flags. Use them like this: "make library=shared"
-
-# library=shared || component=shared_library
-ifeq ($(library), shared)
-  GYPFLAGS += -Dcomponent=shared_library
-endif
-ifdef component
-  GYPFLAGS += -Dcomponent=$(component)
-endif
-# disassembler=on
-ifeq ($(disassembler), on)
-  GYPFLAGS += -Dv8_enable_disassembler=1
-endif
-# objectprint=on
-ifeq ($(objectprint), on)
-  GYPFLAGS += -Dv8_object_print=1
-endif
-# verifycsa=on
-ifeq ($(verifycsa), on)
-  GYPFLAGS += -Dv8_enable_verify_csa=1
-endif
-# verifyheap=on
-ifeq ($(verifyheap), on)
-  GYPFLAGS += -Dv8_enable_verify_heap=1
-endif
-# tracemaps=on
-ifeq ($(tracemaps), on)
-  GYPFLAGS += -Dv8_trace_maps=1
-endif
-# concurrentmarking=on
-ifeq ($(concurrentmarking), on)
-  GYPFLAGS += -Dv8_enable_concurrent_marking=1
-endif
-# backtrace=off
-ifeq ($(backtrace), off)
-  GYPFLAGS += -Dv8_enable_backtrace=0
-else
-  GYPFLAGS += -Dv8_enable_backtrace=1
-endif
-# verifypredictable=on
-ifeq ($(verifypredictable), on)
-  GYPFLAGS += -Dv8_enable_verify_predictable=1
-endif
-# snapshot=off
-ifeq ($(snapshot), off)
-  GYPFLAGS += -Dv8_use_snapshot='false'
-endif
-ifeq ($(snapshot), external)
-  GYPFLAGS += -Dv8_use_external_startup_data=1
-endif
-# extrachecks=on/off
-ifeq ($(extrachecks), on)
-  GYPFLAGS += -Ddcheck_always_on=1 -Dv8_enable_handle_zapping=1
-endif
-ifeq ($(extrachecks), off)
-  GYPFLAGS += -Ddcheck_always_on=0 -Dv8_enable_handle_zapping=0
-endif
-# slowdchecks=on/off
-ifeq ($(slowdchecks), on)
-  GYPFLAGS += -Dv8_enable_slow_dchecks=1
-endif
-ifeq ($(slowdchecks), off)
-  GYPFLAGS += -Dv8_enable_slow_dchecks=0
-endif
-# debugsymbols=on
-ifeq ($(debugsymbols), on)
-  GYPFLAGS += -Drelease_extra_cflags=-ggdb3
-endif
-# gdbjit=on/off
-ifeq ($(gdbjit), on)
-  GYPFLAGS += -Dv8_enable_gdbjit=1
-endif
-ifeq ($(gdbjit), off)
-  GYPFLAGS += -Dv8_enable_gdbjit=0
-endif
-# vtunejit=on
-ifeq ($(vtunejit), on)
-  GYPFLAGS += -Dv8_enable_vtunejit=1
-endif
-# unalignedaccess=on
-ifeq ($(unalignedaccess), on)
-  GYPFLAGS += -Dv8_can_use_unaligned_accesses=true
-endif
-# randomseed=12345, disable random seed via randomseed=0
-ifdef randomseed
-  GYPFLAGS += -Dv8_random_seed=$(randomseed)
-endif
-# soname_version=1.2.3
-ifdef soname_version
-  GYPFLAGS += -Dsoname_version=$(soname_version)
-endif
-# werror=no
-ifeq ($(werror), no)
-  GYPFLAGS += -Dwerror=''
-endif
-# strictaliasing=off (workaround for GCC-4.5)
-ifeq ($(strictaliasing), off)
-  GYPFLAGS += -Dv8_no_strict_aliasing=1
-endif
-# regexp=interpreted
-ifeq ($(regexp), interpreted)
-  GYPFLAGS += -Dv8_interpreted_regexp=1
-endif
-# i18nsupport=off
-ifeq ($(i18nsupport), off)
-  GYPFLAGS += -Dv8_enable_i18n_support=0
-  TESTFLAGS += --noi18n
-endif
-# deprecationwarnings=on
-ifeq ($(deprecationwarnings), on)
-  GYPFLAGS += -Dv8_deprecation_warnings=1
-endif
-# vectorstores=on
-ifeq ($(vectorstores), on)
-  GYPFLAGS += -Dv8_vector_stores=1
-endif
-# imminentdeprecationwarnings=on
-ifeq ($(imminentdeprecationwarnings), on)
-  GYPFLAGS += -Dv8_imminent_deprecation_warnings=1
-endif
-# asan=on
-ifeq ($(asan), on)
-  GYPFLAGS += -Dasan=1 -Dclang=1
-  TESTFLAGS += --asan
-  ifeq ($(lsan), on)
-    GYPFLAGS += -Dlsan=1
-  endif
-endif
-ifdef embedscript
-  GYPFLAGS += -Dembed_script=$(embedscript)
-endif
-ifdef warmupscript
-  GYPFLAGS += -Dwarmup_script=$(warmupscript)
-endif
-ifeq ($(goma), on)
-  GYPFLAGS += -Duse_goma=1
-endif
-# v8_os_page_size=0, when 0 or not specified use build OS page size
-ifdef v8_os_page_size
-  ifneq ($(v8_os_page_size), 0)
-    ifneq ($(snapshot), off)
-      GYPFLAGS += -Dv8_os_page_size=$(v8_os_page_size)
-    endif
-  endif
-endif
-# arm specific flags.
-# arm_version=<number | "default">
-ifneq ($(strip $(arm_version)),)
-  GYPFLAGS += -Darm_version=$(arm_version)
-else
-# Deprecated (use arm_version instead): armv7=false/true
-ifeq ($(armv7), false)
-  GYPFLAGS += -Darm_version=6
-else
-ifeq ($(armv7), true)
-  GYPFLAGS += -Darm_version=7
-endif
-endif
-endif
-# hardfp=on/off. Deprecated, use armfloatabi
-ifeq ($(hardfp),on)
-  GYPFLAGS += -Darm_float_abi=hard
-else
-ifeq ($(hardfp),off)
-  GYPFLAGS += -Darm_float_abi=softfp
-endif
-endif
-# fpu: armfpu=xxx
-# xxx: vfp, vfpv3-d16, vfpv3, neon.
-ifeq ($(armfpu),)
-  GYPFLAGS += -Darm_fpu=default
-else
-  GYPFLAGS += -Darm_fpu=$(armfpu)
-endif
-# float abi: armfloatabi=softfp/hard
-ifeq ($(armfloatabi),)
-ifeq ($(hardfp),)
-  GYPFLAGS += -Darm_float_abi=default
-endif
-else
-  GYPFLAGS += -Darm_float_abi=$(armfloatabi)
-endif
-# armthumb=on/off
-ifeq ($(armthumb), off)
-  GYPFLAGS += -Darm_thumb=0
-else
-ifeq ($(armthumb), on)
-  GYPFLAGS += -Darm_thumb=1
-endif
-endif
-# arm_test_noprobe=on
-# With this flag set, by default v8 will only use features implied
-# by the compiler (no probe). This is done by modifying the default
-# values of enable_armv7, enable_vfp3, enable_32dregs and enable_neon.
-# Modifying these flags when launching v8 will enable the probing for
-# the specified values.
-ifeq ($(arm_test_noprobe), on)
-  GYPFLAGS += -Darm_test_noprobe=on
-endif
-# Do not omit the frame pointer, needed for profiling with perf
-ifeq ($(no_omit_framepointer), on)
-  GYPFLAGS += -Drelease_extra_cflags=-fno-omit-frame-pointer
-endif
-
-ifdef android_ndk_root
-  GYPFLAGS += -Dandroid_ndk_root=$(android_ndk_root)
-  export ANDROID_NDK_ROOT = $(android_ndk_root)
-endif
-
-# ----------------- available targets: --------------------
-# - any arch listed in ARCHES (see below)
-# - any mode listed in MODES
-# - every combination <arch>.<mode>, e.g. "ia32.release"
-# - "native": current host's architecture, release mode
-# - any of the above with .check appended, e.g. "ia32.release.check"
-# - "android": cross-compile for Android/ARM
-# - default (no target specified): build all DEFAULT_ARCHES and MODES
-# - "check": build all targets and run all tests
-# - "<arch>.clean" for any <arch> in ARCHES
-# - "clean": clean all ARCHES
-
-# ----------------- internal stuff ------------------------
-
-# Architectures and modes to be compiled. Consider these to be internal
-# variables, don't override them (use the targets instead).
-ARCHES = ia32 x64 arm arm64 mips mipsel mips64 mips64el ppc ppc64 s390 s390x
-ARCHES32 = ia32 arm mips mipsel ppc s390
-DEFAULT_ARCHES = ia32 x64 arm
-MODES = release debug optdebug
-DEFAULT_MODES = release debug
-ANDROID_ARCHES = android_ia32 android_x64 android_arm android_arm64 \
-		 android_mipsel
-
-# List of files that trigger Makefile regeneration:
-GYPFILES = third_party/icu/icu.gypi third_party/icu/icu.gyp \
-	   gypfiles/shim_headers.gypi gypfiles/features.gypi \
-           gypfiles/standalone.gypi \
-	   gypfiles/toolchain.gypi gypfiles/all.gyp gypfiles/mac/asan.gyp \
-	   test/cctest/cctest.gyp test/fuzzer/fuzzer.gyp \
-	   test/unittests/unittests.gyp src/v8.gyp \
-	   tools/parser-shell.gyp testing/gmock.gyp testing/gtest.gyp \
-	   samples/samples.gyp src/third_party/vtune/v8vtune.gyp src/d8.gyp
-
-# If vtunejit=on, the v8vtune.gyp will be appended.
-ifeq ($(vtunejit), on)
-  GYPFILES += src/third_party/vtune/v8vtune.gyp
-endif
-# Generates all combinations of ARCHES and MODES, e.g. "ia32.release".
-BUILDS = $(foreach mode,$(MODES),$(addsuffix .$(mode),$(ARCHES)))
-ANDROID_BUILDS = $(foreach mode,$(MODES), \
-                   $(addsuffix .$(mode),$(ANDROID_ARCHES)))
-# Generates corresponding test targets, e.g. "ia32.release.check".
-CHECKS = $(addsuffix .check,$(BUILDS))
-QUICKCHECKS = $(addsuffix .quickcheck,$(BUILDS))
-ANDROID_CHECKS = $(addsuffix .check,$(ANDROID_BUILDS))
-# File where previously used GYPFLAGS are stored.
-ENVFILE = $(OUTDIR)/environment
-
-.PHONY: all check clean builddeps dependencies $(ENVFILE).new native \
-        qc quickcheck $(QUICKCHECKS) turbocheck \
-        $(addsuffix .quickcheck,$(MODES)) $(addsuffix .quickcheck,$(ARCHES)) \
-        $(ARCHES) $(MODES) $(BUILDS) $(CHECKS) $(addsuffix .clean,$(ARCHES)) \
-        $(addsuffix .check,$(MODES)) $(addsuffix .check,$(ARCHES)) \
-        $(ANDROID_ARCHES) $(ANDROID_BUILDS) $(ANDROID_CHECKS)
-
-# Target definitions. "all" is the default.
-all: $(DEFAULT_MODES)
-
-# Special target for the buildbots to use. Depends on $(OUTDIR)/Makefile
-# having been created before.
-buildbot:
-	$(MAKE) -C "$(OUTDIR)" BUILDTYPE=$(BUILDTYPE) \
-	        builddir="$(abspath $(OUTDIR))/$(BUILDTYPE)"
-
-# Compile targets. MODES and ARCHES are convenience targets.
-.SECONDEXPANSION:
-$(MODES): $(addsuffix .$$@,$(DEFAULT_ARCHES))
-
-$(ARCHES): $(addprefix $$@.,$(DEFAULT_MODES))
-
-# Defines how to build a particular target (e.g. ia32.release).
-$(BUILDS): $(OUTDIR)/Makefile.$$@
-	@$(MAKE) -C "$(OUTDIR)" -f Makefile.$@ \
-	         BUILDTYPE=$(shell echo $(subst .,,$(suffix $@)) | \
-	                     python -c "print \
-	                     raw_input().replace('opt', '').capitalize()") \
-	         builddir="$(shell pwd)/$(OUTDIR)/$@"
-
-native: $(OUTDIR)/Makefile.native
-	@$(MAKE) -C "$(OUTDIR)" -f Makefile.native \
-	         BUILDTYPE=Release \
-	         builddir="$(shell pwd)/$(OUTDIR)/$@"
-
-$(ANDROID_ARCHES): $(addprefix $$@.,$(MODES))
-
-$(ANDROID_BUILDS): $(GYPFILES) $(ENVFILE) Makefile.android
-	@$(MAKE) -f Makefile.android $@ \
-	        ARCH="$(basename $@)" \
-	        MODE="$(subst .,,$(suffix $@))" \
-	        OUTDIR="$(OUTDIR)" \
-	        GYPFLAGS="$(GYPFLAGS)"
-
-# Test targets.
-check: all
-	@gypfiles/run-tests-legacy.py $(TESTJOBS) --outdir=$(OUTDIR) \
-	    --arch=$(shell echo $(DEFAULT_ARCHES) | sed -e 's/ /,/g') \
-	    $(TESTFLAGS)
-
-$(addsuffix .check,$(MODES)): $$(basename $$@)
-	@gypfiles/run-tests-legacy.py $(TESTJOBS) --outdir=$(OUTDIR) \
-	    --mode=$(basename $@) $(TESTFLAGS)
-
-$(addsuffix .check,$(ARCHES)): $$(basename $$@)
-	@gypfiles/run-tests-legacy.py $(TESTJOBS) --outdir=$(OUTDIR) \
-	    --arch=$(basename $@) $(TESTFLAGS)
-
-$(CHECKS): $$(basename $$@)
-	@gypfiles/run-tests-legacy.py $(TESTJOBS) --outdir=$(OUTDIR) \
-	    --arch-and-mode=$(basename $@) $(TESTFLAGS)
-
-$(addsuffix .quickcheck,$(MODES)): $$(basename $$@)
-	@gypfiles/run-tests-legacy.py $(TESTJOBS) --outdir=$(OUTDIR) \
-	    --mode=$(basename $@) $(TESTFLAGS) --quickcheck
-
-$(addsuffix .quickcheck,$(ARCHES)): $$(basename $$@)
-	@gypfiles/run-tests-legacy.py $(TESTJOBS) --outdir=$(OUTDIR) \
-	    --arch=$(basename $@) $(TESTFLAGS) --quickcheck
-
-$(QUICKCHECKS): $$(basename $$@)
-	@gypfiles/run-tests-legacy.py $(TESTJOBS) --outdir=$(OUTDIR) \
-	    --arch-and-mode=$(basename $@) $(TESTFLAGS) --quickcheck
-
-$(addsuffix .sync, $(ANDROID_BUILDS)): $$(basename $$@)
-	@tools/android-sync.sh $(basename $@) $(OUTDIR) \
-	                       $(shell pwd) $(ANDROID_V8)
-
-$(addsuffix .check, $(ANDROID_BUILDS)): $$(basename $$@).sync
-	@gypfiles/run-tests-legacy.py $(TESTJOBS) --outdir=$(OUTDIR) \
-	     --arch-and-mode=$(basename $@) \
-	     --timeout=600 \
-	     --command-prefix="tools/android-run.py" $(TESTFLAGS)
-
-$(addsuffix .check, $(ANDROID_ARCHES)): \
-                $(addprefix $$(basename $$@).,$(MODES)).check
-
-native.check: native
-	@gypfiles/run-tests-legacy.py $(TESTJOBS) --outdir=$(OUTDIR)/native \
-	    --arch-and-mode=. $(TESTFLAGS)
-
-SUPERFASTTESTMODES = ia32.release
-FASTTESTMODES = $(SUPERFASTTESTMODES),x64.release,ia32.optdebug,x64.optdebug,arm.optdebug,arm64.release
-FASTCOMPILEMODES = $(FASTTESTMODES),arm64.optdebug
-
-COMMA = ,
-EMPTY =
-SPACE = $(EMPTY) $(EMPTY)
-quickcheck: $(subst $(COMMA),$(SPACE),$(FASTCOMPILEMODES))
-	gypfiles/run-tests-legacy.py $(TESTJOBS) --outdir=$(OUTDIR) \
-	    --arch-and-mode=$(SUPERFASTTESTMODES) $(TESTFLAGS) --quickcheck \
-	    --download-data mozilla webkit
-	gypfiles/run-tests-legacy.py $(TESTJOBS) --outdir=$(OUTDIR) \
-	    --arch-and-mode=$(FASTTESTMODES) $(TESTFLAGS) --quickcheck
-qc: quickcheck
-
-turbocheck: $(subst $(COMMA),$(SPACE),$(FASTCOMPILEMODES))
-	gypfiles/run-tests-legacy.py $(TESTJOBS) --outdir=$(OUTDIR) \
-	    --arch-and-mode=$(SUPERFASTTESTMODES) $(TESTFLAGS) \
-	    --quickcheck --variants=turbofan --download-data mozilla webkit
-	gypfiles/run-tests-legacy.py $(TESTJOBS) --outdir=$(OUTDIR) \
-	    --arch-and-mode=$(FASTTESTMODES) $(TESTFLAGS) \
-	    --quickcheck --variants=turbofan
-tc: turbocheck
-
-# Clean targets. You can clean each architecture individually, or everything.
-$(addsuffix .clean, $(ARCHES) $(ANDROID_ARCHES)):
-	rm -f $(OUTDIR)/Makefile.$(basename $@)*
-	rm -rf $(OUTDIR)/$(basename $@).release
-	rm -rf $(OUTDIR)/$(basename $@).debug
-	rm -rf $(OUTDIR)/$(basename $@).optdebug
-	find $(OUTDIR) -regex '.*\(host\|target\)\.$(basename $@).*\.mk' -delete
-
-native.clean:
-	rm -f $(OUTDIR)/Makefile.native
-	rm -rf $(OUTDIR)/native
-	find $(OUTDIR) -regex '.*\(host\|target\)\.native\.mk' -delete
-
-clean: $(addsuffix .clean, $(ARCHES) $(ANDROID_ARCHES)) native.clean gtags.clean tags.clean
-
-# GYP file generation targets.
-OUT_MAKEFILES = $(addprefix $(OUTDIR)/Makefile.,$(BUILDS))
-$(OUT_MAKEFILES): $(GYPFILES) $(ENVFILE)
-	$(eval CXX_TARGET_ARCH:=$(shell $(CXX) -v 2>&1 | grep ^Target: | \
-	        cut -f 2 -d " " | cut -f 1 -d "-" ))
-	$(eval CXX_TARGET_ARCH:=$(subst aarch64,arm64,$(CXX_TARGET_ARCH)))
-	$(eval CXX_TARGET_ARCH:=$(subst x86_64,x64,$(CXX_TARGET_ARCH)))
-	$(eval CXX_TARGET_ARCH:=$(subst s390x,s390,$(CXX_TARGET_ARCH)))
-	$(eval CXX_TARGET_ARCH:=$(subst powerpc,ppc,$(CXX_TARGET_ARCH)))
-	$(eval CXX_TARGET_ARCH:=$(subst ppc64,ppc,$(CXX_TARGET_ARCH)))
-	$(eval CXX_TARGET_ARCH:=$(subst ppcle,ppc,$(CXX_TARGET_ARCH)))
-	$(eval V8_TARGET_ARCH:=$(subst .,,$(suffix $(basename $@))))
-	PYTHONPATH="$(shell pwd)/tools/generate_shim_headers:$(shell pwd)/gypfiles:$(PYTHONPATH):$(shell pwd)/tools/gyp/pylib:$(PYTHONPATH)" \
-	GYP_GENERATORS=make \
-	tools/gyp/gyp --generator-output="$(OUTDIR)" gypfiles/all.gyp \
-	              -Igypfiles/standalone.gypi --depth=. \
-	              -Dv8_target_arch=$(V8_TARGET_ARCH) \
-	              $(if $(findstring $(CXX_TARGET_ARCH),$(V8_TARGET_ARCH)), \
-	              -Dtarget_arch=$(V8_TARGET_ARCH), \
-	                  $(if $(shell echo $(ARCHES32) | grep $(V8_TARGET_ARCH)), \
-	                  -Dtarget_arch=ia32,)) \
-	              $(if $(findstring optdebug,$@),-Dv8_optimized_debug=1,) \
-	              -S$(suffix $(basename $@))$(suffix $@) $(GYPFLAGS)
-
-$(OUTDIR)/Makefile.native: $(GYPFILES) $(ENVFILE)
-	PYTHONPATH="$(shell pwd)/tools/generate_shim_headers:$(shell pwd)/gypfiles:$(PYTHONPATH):$(shell pwd)/tools/gyp/pylib:$(PYTHONPATH)" \
-	GYP_GENERATORS=make \
-	tools/gyp/gyp --generator-output="$(OUTDIR)" gypfiles/all.gyp \
-	              -Igypfiles/standalone.gypi --depth=. -S.native $(GYPFLAGS)
-
-# Replaces the old with the new environment file if they're different, which
-# will trigger GYP to regenerate Makefiles.
-$(ENVFILE): $(ENVFILE).new
-	@if test -r $(ENVFILE) && cmp $(ENVFILE).new $(ENVFILE) > /dev/null; \
-	    then rm $(ENVFILE).new; \
-	    else mv $(ENVFILE).new $(ENVFILE); fi
-
-# Stores current GYPFLAGS in a file.
-$(ENVFILE).new:
-	$(eval CXX_TARGET_ARCH:=$(shell $(CXX) -v 2>&1 | grep ^Target: | \
-	        cut -f 2 -d " " | cut -f 1 -d "-" ))
-	$(eval CXX_TARGET_ARCH:=$(subst aarch64,arm64,$(CXX_TARGET_ARCH)))
-	$(eval CXX_TARGET_ARCH:=$(subst x86_64,x64,$(CXX_TARGET_ARCH)))
-	@mkdir -p $(OUTDIR); echo "GYPFLAGS=$(GYPFLAGS) -Dtarget_arch=$(CXX_TARGET_ARCH)" > $(ENVFILE).new;
-
-# Support for the GNU GLOBAL Source Code Tag System.
-gtags.files: $(GYPFILES) $(ENVFILE)
-	@find include src test -name '*.h' -o -name '*.cc' -o -name '*.c' > $@
-
-# We need to manually set the stack limit here, to work around bugs in
-# gmake-3.81 and global-5.7.1 on recent 64-bit Linux systems.
-# Using $(wildcard ...) gracefully ignores non-existing files, so that stale
-# gtags.files after switching branches don't cause recipe failures.
-GPATH GRTAGS GSYMS GTAGS: gtags.files $(wildcard $(shell cat gtags.files 2> /dev/null))
-	@bash -c 'ulimit -s 10240 && GTAGSFORCECPP=yes gtags -i -q -f $<'
-
-gtags.clean:
-	rm -f gtags.files GPATH GRTAGS GSYMS GTAGS
-
-tags: gtags.files $(wildcard $(shell cat gtags.files 2> /dev/null))
-	@(ctags --version | grep 'Exuberant Ctags' >/dev/null) || \
-		(echo "Please install Exuberant Ctags (check 'ctags --version')" >&2; false)
-	ctags --fields=+l -L $<
-
-tags.clean:
-	rm -r tags
-
-dependencies builddeps:
-	$(error Use 'gclient sync' instead)
diff --git a/deps/v8/Makefile.android b/deps/v8/Makefile.android
deleted file mode 100644
index 417152177d7..00000000000
--- a/deps/v8/Makefile.android
+++ /dev/null
@@ -1,72 +0,0 @@
-# Copyright 2012 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-# Those definitions should be consistent with the main Makefile
-ANDROID_ARCHES = android_ia32 android_x64 android_arm android_arm64 \
-		 android_mipsel android_x87
-MODES = release debug
-
-# Generates all combinations of ANDROID ARCHES and MODES,
-# e.g. "android_ia32.release" or "android_arm.release"
-ANDROID_BUILDS = $(foreach mode,$(MODES), \
-                   $(addsuffix .$(mode),$(ANDROID_ARCHES)))
-
-ifeq ($(ARCH), android_arm)
-  DEFINES  = target_arch=arm v8_target_arch=arm
-else ifeq ($(ARCH), android_arm64)
-  DEFINES  = target_arch=arm64 v8_target_arch=arm64
-else ifeq ($(ARCH), android_mipsel)
-  DEFINES  = target_arch=mipsel v8_target_arch=mipsel
-else ifeq ($(ARCH), android_ia32)
-  DEFINES = target_arch=ia32 v8_target_arch=ia32
-else ifeq ($(ARCH), android_x64)
-  DEFINES = target_arch=x64 v8_target_arch=x64
-else ifeq ($(ARCH), android_x87)
-  DEFINES = target_arch=ia32 v8_target_arch=x87
-else
-  $(error Target architecture "${ARCH}" is not supported)
-endif
-
-# Common flags.
-DEFINES += OS=android
-
-.SECONDEXPANSION:
-$(ANDROID_BUILDS): $(OUTDIR)/Makefile.$$@
-	@$(MAKE) -C "$(OUTDIR)" -f Makefile.$@ \
-	          BUILDTYPE=$(shell echo $(subst .,,$(suffix $@)) | \
-	                      python -c "print raw_input().capitalize()") \
-	          builddir="$(shell pwd)/$(OUTDIR)/$@"
-
-# Android GYP file generation targets.
-ANDROID_MAKEFILES = $(addprefix $(OUTDIR)/Makefile.,$(ANDROID_BUILDS))
-$(ANDROID_MAKEFILES):
-	GYP_GENERATORS=make-android \
-	GYP_DEFINES="${DEFINES}" \
-	PYTHONPATH="$(shell pwd)/tools/generate_shim_headers:$(shell pwd)/gypfiles:$(PYTHONPATH)" \
-	tools/gyp/gyp --generator-output="${OUTDIR}" gypfiles/all.gyp \
-	              -Igypfiles/standalone.gypi --depth=. \
-	              -S$(suffix $(basename $@))$(suffix $@) ${GYPFLAGS}
diff --git a/deps/v8/OWNERS b/deps/v8/OWNERS
index 2583a229b6c..f6726316f2a 100644
--- a/deps/v8/OWNERS
+++ b/deps/v8/OWNERS
@@ -1,5 +1,6 @@
 adamk@chromium.org
 ahaas@chromium.org
+aseemgarg@chromium.org
 bbudge@chromium.org
 binji@chromium.org
 bmeurer@chromium.org
@@ -7,6 +8,7 @@ bradnelson@chromium.org
 cbruni@chromium.org
 clemensh@chromium.org
 danno@chromium.org
+delphick@chromium.org
 eholk@chromium.org
 franzih@chromium.org
 gdeepti@chromium.org
@@ -17,26 +19,23 @@ ishell@chromium.org
 jarin@chromium.org
 jgruber@chromium.org
 jkummerow@chromium.org
-jochen@chromium.org
+kschimpf@chromium.org
 leszeks@chromium.org
-littledan@chromium.org
 machenbach@chromium.org
 marja@chromium.org
 mlippautz@chromium.org
 mstarzinger@chromium.org
-mtrofin@chromium.org
 mvstanton@chromium.org
 mythria@chromium.org
 neis@chromium.org
 petermarshall@chromium.org
 rmcilroy@chromium.org
-rossberg@chromium.org
 sergiyb@chromium.org
+sigurds@chromium.org
 tebbi@chromium.org
 titzer@chromium.org
 ulan@chromium.org
 verwaest@chromium.org
-vogelheim@chromium.org
 yangguo@chromium.org
 
 # TEAM: v8-dev@googlegroups.com
diff --git a/deps/v8/PRESUBMIT.py b/deps/v8/PRESUBMIT.py
index b69e8f50891..e6dbb793956 100644
--- a/deps/v8/PRESUBMIT.py
+++ b/deps/v8/PRESUBMIT.py
@@ -153,6 +153,62 @@ def _CheckUnwantedDependencies(input_api, output_api):
   return results
 
 
+def _CheckHeadersHaveIncludeGuards(input_api, output_api):
+  """Ensures that all header files have include guards."""
+  file_inclusion_pattern = r'src/.+\.h'
+
+  def FilterFile(affected_file):
+    black_list = (_EXCLUDED_PATHS +
+                  input_api.DEFAULT_BLACK_LIST)
+    return input_api.FilterSourceFile(
+      affected_file,
+      white_list=(file_inclusion_pattern, ),
+      black_list=black_list)
+
+  leading_src_pattern = input_api.re.compile(r'^src/')
+  dash_dot_slash_pattern = input_api.re.compile(r'[-./]')
+  def PathToGuardMacro(path):
+    """Guards should be of the form V8_PATH_TO_FILE_WITHOUT_SRC_H_."""
+    x = input_api.re.sub(leading_src_pattern, 'v8_', path)
+    x = input_api.re.sub(dash_dot_slash_pattern, '_', x)
+    x = x.upper() + "_"
+    return x
+
+  problems = []
+  for f in input_api.AffectedSourceFiles(FilterFile):
+    local_path = f.LocalPath()
+    guard_macro = PathToGuardMacro(local_path)
+    guard_patterns = [
+            input_api.re.compile(r'^#ifndef ' + guard_macro + '$'),
+            input_api.re.compile(r'^#define ' + guard_macro + '$'),
+            input_api.re.compile(r'^#endif  // ' + guard_macro + '$')]
+    skip_check_pattern = input_api.re.compile(
+            r'^// PRESUBMIT_INTENTIONALLY_MISSING_INCLUDE_GUARD')
+    found_patterns = [ False, False, False ]
+    file_omitted = False
+
+    for line in f.NewContents():
+      for i in range(len(guard_patterns)):
+        if guard_patterns[i].match(line):
+            found_patterns[i] = True
+      if skip_check_pattern.match(line):
+        file_omitted = True
+        break
+
+    if not file_omitted and not all(found_patterns):
+      problems.append(
+        '%s: Missing include guard \'%s\'' % (local_path, guard_macro))
+
+  if problems:
+    return [output_api.PresubmitError(
+        'You added one or more header files without an appropriate\n'
+        'include guard. Add the include guard {#ifndef,#define,#endif}\n'
+        'triplet or omit the check entirely through the magic comment:\n'
+        '"// PRESUBMIT_INTENTIONALLY_MISSING_INCLUDE_GUARD".', problems)]
+  else:
+    return []
+
+
 # TODO(mstarzinger): Similar checking should be made available as part of
 # tools/presubmit.py (note that tools/check-inline-includes.sh exists).
 def _CheckNoInlineHeaderIncludesInNormalHeaders(input_api, output_api):
@@ -230,44 +286,10 @@ def FilterFile(affected_file):
     return []
 
 
-def _CheckMissingFiles(input_api, output_api):
-  """Runs verify_source_deps.py to ensure no files were added that are not in
-  GN.
-  """
-  # We need to wait until we have an input_api object and use this
-  # roundabout construct to import checkdeps because this file is
-  # eval-ed and thus doesn't have __file__.
-  original_sys_path = sys.path
-  try:
-    sys.path = sys.path + [input_api.os_path.join(
-        input_api.PresubmitLocalPath(), 'tools')]
-    from verify_source_deps import missing_gn_files, missing_gyp_files
-  finally:
-    # Restore sys.path to what it was before.
-    sys.path = original_sys_path
-
-  gn_files = missing_gn_files()
-  gyp_files = missing_gyp_files()
-  results = []
-  if gn_files:
-    results.append(output_api.PresubmitError(
-        "You added one or more source files but didn't update the\n"
-        "corresponding BUILD.gn files:\n",
-        gn_files))
-  if gyp_files:
-    results.append(output_api.PresubmitError(
-        "You added one or more source files but didn't update the\n"
-        "corresponding gyp files:\n",
-        gyp_files))
-  return results
-
-
 def _CommonChecks(input_api, output_api):
   """Checks common to both upload and commit."""
   results = []
   results.extend(_CheckCommitMessageBugEntry(input_api, output_api))
-  results.extend(input_api.canned_checks.CheckOwners(
-      input_api, output_api, source_file_filter=None))
   results.extend(input_api.canned_checks.CheckPatchFormatted(
       input_api, output_api))
   results.extend(input_api.canned_checks.CheckGenderNeutral(
@@ -276,9 +298,9 @@ def _CommonChecks(input_api, output_api):
   results.extend(_CheckUnwantedDependencies(input_api, output_api))
   results.extend(
       _CheckNoProductionCodeUsingTestOnlyFunctions(input_api, output_api))
+  results.extend(_CheckHeadersHaveIncludeGuards(input_api, output_api))
   results.extend(
       _CheckNoInlineHeaderIncludesInNormalHeaders(input_api, output_api))
-  results.extend(_CheckMissingFiles(input_api, output_api))
   results.extend(_CheckJSONFiles(input_api, output_api))
   results.extend(_CheckMacroUndefs(input_api, output_api))
   results.extend(input_api.RunTests(
diff --git a/deps/v8/base/trace_event/common/trace_event_common.h b/deps/v8/base/trace_event/common/trace_event_common.h
index 51869ee9525..e2a5ca0c8d4 100644
--- a/deps/v8/base/trace_event/common/trace_event_common.h
+++ b/deps/v8/base/trace_event/common/trace_event_common.h
@@ -2,6 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#ifndef BASE_TRACE_EVENT_COMMON_TRACE_EVENT_COMMON_H_
+#define BASE_TRACE_EVENT_COMMON_TRACE_EVENT_COMMON_H_
+
 // This header file defines the set of trace_event macros without specifying
 // how the events actually get collected and stored. If you need to expose trace
 // events to some other universe, you can copy-and-paste this file as well as
@@ -687,6 +690,11 @@
       TRACE_EVENT_PHASE_ASYNC_END, category_group, name, id,                  \
       TRACE_EVENT_API_CURRENT_THREAD_ID, timestamp, TRACE_EVENT_FLAG_NONE,    \
       arg1_name, arg1_val, arg2_name, arg2_val)
+#define TRACE_EVENT_COPY_ASYNC_END_WITH_TIMESTAMP0(category_group, name, id, \
+                                                   timestamp)                \
+  INTERNAL_TRACE_EVENT_ADD_WITH_ID_TID_AND_TIMESTAMP(                        \
+      TRACE_EVENT_PHASE_ASYNC_END, category_group, name, id,                 \
+      TRACE_EVENT_API_CURRENT_THREAD_ID, timestamp, TRACE_EVENT_FLAG_COPY)
 
 // NESTABLE_ASYNC_* APIs are used to describe an async operation, which can
 // be nested within a NESTABLE_ASYNC event and/or have inner NESTABLE_ASYNC
@@ -1020,6 +1028,14 @@
     }                                                                      \
   } while (0)
 
+// Macro for getting the real base::TimeTicks::Now() which can be overridden in
+// headless when VirtualTime is enabled.
+#define TRACE_TIME_TICKS_NOW() INTERNAL_TRACE_TIME_TICKS_NOW()
+
+// Macro for getting the real base::Time::Now() which can be overridden in
+// headless when VirtualTime is enabled.
+#define TRACE_TIME_NOW() INTERNAL_TRACE_TIME_NOW()
+
 // Notes regarding the following definitions:
 // New values can be added and propagated to third party libraries, but existing
 // definitions must never be changed, because third party libraries may use old
@@ -1094,3 +1110,5 @@
 #define TRACE_EVENT_SCOPE_NAME_GLOBAL ('g')
 #define TRACE_EVENT_SCOPE_NAME_PROCESS ('p')
 #define TRACE_EVENT_SCOPE_NAME_THREAD ('t')
+
+#endif  // BASE_TRACE_EVENT_COMMON_TRACE_EVENT_COMMON_H_
diff --git a/deps/v8/gni/isolate.gni b/deps/v8/gni/isolate.gni
deleted file mode 100644
index 6ad25c27749..00000000000
--- a/deps/v8/gni/isolate.gni
+++ /dev/null
@@ -1,196 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import("//build/config/sanitizers/sanitizers.gni")
-import("//third_party/icu/config.gni")
-import("v8.gni")
-
-declare_args() {
-  # Sets the test isolation mode (noop|prepare|check).
-  v8_test_isolation_mode = "noop"
-}
-
-template("v8_isolate_run") {
-  forward_variables_from(invoker,
-                         "*",
-                         [
-                           "deps",
-                           "isolate",
-                         ])
-
-  # Remember target name as within the action scope the target name will be
-  # different.
-  name = target_name
-
-  assert(defined(invoker.deps))
-  assert(defined(invoker.isolate))
-
-  if (name != "" && v8_test_isolation_mode != "noop") {
-    action(name + "_run") {
-      testonly = true
-
-      deps = invoker.deps
-
-      script = "//tools/isolate_driver.py"
-
-      sources = [
-        invoker.isolate,
-      ]
-
-      inputs = [
-        # Files that are known to be involved in this step.
-        "//tools/swarming_client/isolate.py",
-        "//tools/swarming_client/run_isolated.py",
-      ]
-
-      if (v8_test_isolation_mode == "prepare") {
-        outputs = [
-          "$root_out_dir/$name.isolated.gen.json",
-        ]
-      } else if (v8_test_isolation_mode == "check") {
-        outputs = [
-          "$root_out_dir/$name.isolated",
-          "$root_out_dir/$name.isolated.state",
-        ]
-      }
-
-      # Translate gn to gyp variables.
-      if (v8_code_coverage) {
-        coverage = "1"
-      } else {
-        coverage = "0"
-      }
-      if (is_asan) {
-        asan = "1"
-      } else {
-        asan = "0"
-      }
-      if (is_msan) {
-        msan = "1"
-      } else {
-        msan = "0"
-      }
-      if (is_tsan) {
-        tsan = "1"
-      } else {
-        tsan = "0"
-      }
-      if (is_cfi) {
-        cfi_vptr = "1"
-      } else {
-        cfi_vptr = "0"
-      }
-      if (target_cpu == "x86") {
-        target_arch = "ia32"
-      } else {
-        target_arch = target_cpu
-      }
-      if (is_debug) {
-        configuration_name = "Debug"
-      } else {
-        configuration_name = "Release"
-      }
-      if (is_component_build) {
-        component = "shared_library"
-      } else {
-        component = "static_library"
-      }
-      if (icu_use_data_file) {
-        icu_use_data_file_flag = "1"
-      } else {
-        icu_use_data_file_flag = "0"
-      }
-      if (v8_use_external_startup_data) {
-        use_external_startup_data = "1"
-      } else {
-        use_external_startup_data = "0"
-      }
-      if (is_ubsan_vptr) {
-        ubsan_vptr = "1"
-      } else {
-        ubsan_vptr = "0"
-      }
-      if (v8_use_snapshot) {
-        use_snapshot = "true"
-      } else {
-        use_snapshot = "false"
-      }
-      if (v8_has_valgrind) {
-        has_valgrind = "1"
-      } else {
-        has_valgrind = "0"
-      }
-      if (v8_gcmole) {
-        gcmole = "1"
-      } else {
-        gcmole = "0"
-      }
-
-      # Note, all paths will be rebased in isolate_driver.py to be relative to
-      # the isolate file.
-      args = [
-        v8_test_isolation_mode,
-        "--isolated",
-        rebase_path("$root_out_dir/$name.isolated", root_build_dir),
-        "--isolate",
-        rebase_path(invoker.isolate, root_build_dir),
-
-        # Path variables are used to replace file paths when loading a .isolate
-        # file
-        "--path-variable",
-        "DEPTH",
-        rebase_path("//", root_build_dir),
-        "--path-variable",
-        "PRODUCT_DIR",
-        rebase_path(root_out_dir, root_build_dir),
-
-        # TODO(machenbach): Set variables for remaining features.
-        "--config-variable",
-        "CONFIGURATION_NAME=$configuration_name",
-        "--config-variable",
-        "OS=$target_os",
-        "--config-variable",
-        "asan=$asan",
-        "--config-variable",
-        "cfi_vptr=$cfi_vptr",
-        "--config-variable",
-        "gcmole=$gcmole",
-        "--config-variable",
-        "has_valgrind=$has_valgrind",
-        "--config-variable",
-        "icu_use_data_file_flag=$icu_use_data_file_flag",
-        "--config-variable",
-        "msan=$msan",
-        "--config-variable",
-        "tsan=$tsan",
-        "--config-variable",
-        "coverage=$coverage",
-        "--config-variable",
-        "sanitizer_coverage=$sanitizer_coverage_flags",
-        "--config-variable",
-        "component=$component",
-        "--config-variable",
-        "target_arch=$target_arch",
-        "--config-variable",
-        "ubsan_vptr=$ubsan_vptr",
-        "--config-variable",
-        "v8_use_external_startup_data=$use_external_startup_data",
-        "--config-variable",
-        "v8_use_snapshot=$use_snapshot",
-      ]
-
-      if (is_win) {
-        args += [
-          "--config-variable",
-          "msvs_version=2017",
-        ]
-      } else {
-        args += [
-          "--config-variable",
-          "msvs_version=0",
-        ]
-      }
-    }
-  }
-}
diff --git a/deps/v8/gni/v8.gni b/deps/v8/gni/v8.gni
index ce9953ac68c..2d8da9a6435 100644
--- a/deps/v8/gni/v8.gni
+++ b/deps/v8/gni/v8.gni
@@ -33,7 +33,12 @@ declare_args() {
 
   # Enable the snapshot feature, for fast context creation.
   # http://v8project.blogspot.com/2015/09/custom-startup-snapshots.html
-  v8_use_snapshot = true
+  # TODO(thakis): Make snapshots work in 64-bit win/cross builds,
+  # https://803591
+  v8_use_snapshot = !(is_win && host_os != "win" && target_cpu == "x64")
+
+  # Enable several snapshots side-by-side (e.g. default and for trusted code).
+  v8_use_multi_snapshots = ""
 
   # Use external files for startup data blobs:
   # the JS builtins sources and the start snapshot.
@@ -56,6 +61,11 @@ if (v8_use_external_startup_data == "") {
   v8_use_external_startup_data = v8_use_snapshot && !is_ios
 }
 
+if (v8_use_multi_snapshots == "") {
+  v8_use_multi_snapshots =
+      v8_use_external_startup_data && !build_with_chromium && !use_jumbo_build
+}
+
 if (v8_enable_backtrace == "") {
   v8_enable_backtrace = is_debug && !v8_optimized_debug
 }
@@ -105,6 +115,12 @@ if (is_posix && (v8_enable_backtrace || v8_monolithic)) {
   v8_add_configs += [ "//build/config/gcc:symbol_visibility_default" ]
 }
 
+# On MIPS gcc_target_rpath and ldso_path might be needed for all builds.
+if (target_cpu == "mipsel" || target_cpu == "mips64el" ||
+    target_cpu == "mips" || target_cpu == "mips64") {
+  v8_add_configs += [ "//build/config/gcc:rpath_for_built_shared_libraries" ]
+}
+
 # All templates should be kept in sync.
 template("v8_source_set") {
   if (defined(invoker.split_count) && invoker.split_count > 1 &&
@@ -184,6 +200,7 @@ template("v8_static_library") {
     forward_variables_from(invoker, "*", [ "configs" ])
     configs += invoker.configs
     configs -= v8_remove_configs
+    configs -= [ "//build/config/compiler:thin_archive" ]
     configs += v8_add_configs
   }
 }
diff --git a/deps/v8/gypfiles/all.gyp b/deps/v8/gypfiles/all.gyp
index 2f9cf858c03..5592ee1b36c 100644
--- a/deps/v8/gypfiles/all.gyp
+++ b/deps/v8/gypfiles/all.gyp
@@ -8,46 +8,23 @@
       'target_name': 'All',
       'type': 'none',
       'dependencies': [
-        '../src/d8.gyp:d8',
-        '../test/inspector/inspector.gyp:*',
-        '../test/mkgrokdump/mkgrokdump.gyp:*',
+        'd8.gyp:d8',
+        'inspector-test.gyp:*',
+        'mkgrokdump.gyp:*',
       ],
       'conditions': [
         ['component!="shared_library"', {
           'dependencies': [
-            '../tools/parser-shell.gyp:parser-shell',
+            'parser-shell.gyp:parser-shell',
           ],
         }],
         # These items don't compile for Android on Mac.
         ['host_os!="mac" or OS!="android"', {
           'dependencies': [
-            '../samples/samples.gyp:*',
-            '../test/cctest/cctest.gyp:*',
-            '../test/fuzzer/fuzzer.gyp:*',
-            '../test/unittests/unittests.gyp:*',
-          ],
-        }],
-        ['test_isolation_mode != "noop"', {
-          'dependencies': [
-            '../test/bot_default.gyp:*',
-            '../test/benchmarks/benchmarks.gyp:*',
-            '../test/debugger/debugger.gyp:*',
-            '../test/default.gyp:*',
-            '../test/d8_default.gyp:*',
-            '../test/intl/intl.gyp:*',
-            '../test/message/message.gyp:*',
-            '../test/mjsunit/mjsunit.gyp:*',
-            '../test/mozilla/mozilla.gyp:*',
-            '../test/optimize_for_size.gyp:*',
-            '../test/perf.gyp:*',
-            '../test/preparser/preparser.gyp:*',
-            '../test/test262/test262.gyp:*',
-            '../test/webkit/webkit.gyp:*',
-            '../tools/check-static-initializers.gyp:*',
-            '../tools/gcmole/run_gcmole.gyp:*',
-            '../tools/jsfunfuzz/jsfunfuzz.gyp:*',
-            '../tools/run-deopt-fuzzer.gyp:*',
-            '../tools/run-num-fuzzer.gyp:*',
+            'samples.gyp:*',
+            'cctest.gyp:*',
+            'fuzzer.gyp:*',
+            'unittests.gyp:*',
           ],
         }],
       ]
diff --git a/deps/v8/gypfiles/cctest.gyp b/deps/v8/gypfiles/cctest.gyp
new file mode 100644
index 00000000000..6e7fddae0bd
--- /dev/null
+++ b/deps/v8/gypfiles/cctest.gyp
@@ -0,0 +1,468 @@
+# Copyright 2012 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+{
+  'variables': {
+    'v8_code': 1,
+    'generated_file': '<(SHARED_INTERMEDIATE_DIR)/resources.cc',
+    'cctest_sources': [
+      '../test/cctest/compiler/c-signature.h',
+      '../test/cctest/compiler/call-tester.h',
+      '../test/cctest/compiler/codegen-tester.cc',
+      '../test/cctest/compiler/codegen-tester.h',
+      '../test/cctest/compiler/code-assembler-tester.h',
+      '../test/cctest/compiler/function-tester.cc',
+      '../test/cctest/compiler/function-tester.h',
+      '../test/cctest/compiler/graph-builder-tester.h',
+      '../test/cctest/compiler/test-basic-block-profiler.cc',
+      '../test/cctest/compiler/test-branch-combine.cc',
+      '../test/cctest/compiler/test-run-unwinding-info.cc',
+      '../test/cctest/compiler/test-gap-resolver.cc',
+      '../test/cctest/compiler/test-graph-visualizer.cc',
+      '../test/cctest/compiler/test-code-generator.cc',
+      '../test/cctest/compiler/test-code-assembler.cc',
+      '../test/cctest/compiler/test-instruction.cc',
+      '../test/cctest/compiler/test-js-context-specialization.cc',
+      '../test/cctest/compiler/test-js-constant-cache.cc',
+      '../test/cctest/compiler/test-js-typed-lowering.cc',
+      '../test/cctest/compiler/test-jump-threading.cc',
+      '../test/cctest/compiler/test-linkage.cc',
+      '../test/cctest/compiler/test-loop-analysis.cc',
+      '../test/cctest/compiler/test-machine-operator-reducer.cc',
+      '../test/cctest/compiler/test-multiple-return.cc',
+      '../test/cctest/compiler/test-node.cc',
+      '../test/cctest/compiler/test-operator.cc',
+      '../test/cctest/compiler/test-representation-change.cc',
+      '../test/cctest/compiler/test-run-bytecode-graph-builder.cc',
+      '../test/cctest/compiler/test-run-calls-to-external-references.cc',
+      '../test/cctest/compiler/test-run-deopt.cc',
+      '../test/cctest/compiler/test-run-intrinsics.cc',
+      '../test/cctest/compiler/test-run-jsbranches.cc',
+      '../test/cctest/compiler/test-run-jscalls.cc',
+      '../test/cctest/compiler/test-run-jsexceptions.cc',
+      '../test/cctest/compiler/test-run-jsobjects.cc',
+      '../test/cctest/compiler/test-run-jsops.cc',
+      '../test/cctest/compiler/test-run-load-store.cc',
+      '../test/cctest/compiler/test-run-machops.cc',
+      '../test/cctest/compiler/test-run-native-calls.cc',
+      '../test/cctest/compiler/test-run-retpoline.cc',
+      '../test/cctest/compiler/test-run-stackcheck.cc',
+      '../test/cctest/compiler/test-run-stubs.cc',
+      '../test/cctest/compiler/test-run-tail-calls.cc',
+      '../test/cctest/compiler/test-run-variables.cc',
+      '../test/cctest/compiler/test-run-wasm-machops.cc',
+      '../test/cctest/compiler/value-helper.cc',
+      '../test/cctest/compiler/value-helper.h',
+      '../test/cctest/cctest.cc',
+      '../test/cctest/cctest.h',
+      '../test/cctest/expression-type-collector-macros.h',
+      '../test/cctest/gay-fixed.cc',
+      '../test/cctest/gay-fixed.h',
+      '../test/cctest/gay-precision.cc',
+      '../test/cctest/gay-precision.h',
+      '../test/cctest/gay-shortest.cc',
+      '../test/cctest/gay-shortest.h',
+      '../test/cctest/heap/heap-tester.h',
+      '../test/cctest/heap/heap-utils.cc',
+      '../test/cctest/heap/heap-utils.h',
+      '../test/cctest/heap/test-alloc.cc',
+      '../test/cctest/heap/test-array-buffer-tracker.cc',
+      '../test/cctest/heap/test-compaction.cc',
+      '../test/cctest/heap/test-concurrent-marking.cc',
+      '../test/cctest/heap/test-embedder-tracing.cc',
+      '../test/cctest/heap/test-heap.cc',
+      '../test/cctest/heap/test-incremental-marking.cc',
+      '../test/cctest/heap/test-invalidated-slots.cc',
+      '../test/cctest/heap/test-lab.cc',
+      '../test/cctest/heap/test-mark-compact.cc',
+      '../test/cctest/heap/test-page-promotion.cc',
+      '../test/cctest/heap/test-spaces.cc',
+      '../test/cctest/interpreter/interpreter-tester.cc',
+      '../test/cctest/interpreter/interpreter-tester.h',
+      '../test/cctest/interpreter/source-position-matcher.cc',
+      '../test/cctest/interpreter/source-position-matcher.h',
+      '../test/cctest/interpreter/test-bytecode-generator.cc',
+      '../test/cctest/interpreter/test-interpreter.cc',
+      '../test/cctest/interpreter/test-interpreter-intrinsics.cc',
+      '../test/cctest/interpreter/test-source-positions.cc',
+      '../test/cctest/interpreter/bytecode-expectations-printer.cc',
+      '../test/cctest/interpreter/bytecode-expectations-printer.h',
+      '../test/cctest/libplatform/test-tracing.cc',
+      '../test/cctest/libsampler/test-sampler.cc',
+      '../test/cctest/parsing/test-parse-decision.cc',
+      '../test/cctest/parsing/test-preparser.cc',
+      '../test/cctest/parsing/test-scanner-streams.cc',
+      '../test/cctest/parsing/test-scanner.cc',
+      '../test/cctest/print-extension.cc',
+      '../test/cctest/print-extension.h',
+      '../test/cctest/profiler-extension.cc',
+      '../test/cctest/profiler-extension.h',
+      '../test/cctest/scope-test-helper.h',
+      '../test/cctest/setup-isolate-for-tests.cc',
+      '../test/cctest/setup-isolate-for-tests.h',
+      '../test/cctest/test-access-checks.cc',
+      '../test/cctest/test-accessor-assembler.cc',
+      '../test/cctest/test-accessors.cc',
+      '../test/cctest/test-allocation.cc',
+      '../test/cctest/test-api.cc',
+      '../test/cctest/test-api.h',
+      '../test/cctest/test-api-accessors.cc',
+      '../test/cctest/test-api-interceptors.cc',
+      '../test/cctest/test-array-list.cc',
+      '../test/cctest/test-atomicops.cc',
+      '../test/cctest/test-bignum.cc',
+      '../test/cctest/test-bignum-dtoa.cc',
+      '../test/cctest/test-bit-vector.cc',
+      '../test/cctest/test-circular-queue.cc',
+      '../test/cctest/test-code-layout.cc',
+      '../test/cctest/test-code-stub-assembler.cc',
+      '../test/cctest/test-compiler.cc',
+      '../test/cctest/test-constantpool.cc',
+      '../test/cctest/test-conversions.cc',
+      '../test/cctest/test-cpu-profiler.cc',
+      '../test/cctest/test-date.cc',
+      '../test/cctest/test-debug.cc',
+      '../test/cctest/test-decls.cc',
+      '../test/cctest/test-deoptimization.cc',
+      '../test/cctest/test-dictionary.cc',
+      '../test/cctest/test-diy-fp.cc',
+      '../test/cctest/test-double.cc',
+      '../test/cctest/test-dtoa.cc',
+      '../test/cctest/test-elements-kind.cc',
+      '../test/cctest/test-fast-dtoa.cc',
+      '../test/cctest/test-feedback-vector.cc',
+      '../test/cctest/test-feedback-vector.h',
+      '../test/cctest/test-field-type-tracking.cc',
+      '../test/cctest/test-fixed-dtoa.cc',
+      '../test/cctest/test-flags.cc',
+      '../test/cctest/test-func-name-inference.cc',
+      '../test/cctest/test-global-handles.cc',
+      '../test/cctest/test-global-object.cc',
+      '../test/cctest/test-hashcode.cc',
+      '../test/cctest/test-hashmap.cc',
+      '../test/cctest/test-heap-profiler.cc',
+      '../test/cctest/test-identity-map.cc',
+      '../test/cctest/test-intl.cc',
+      '../test/cctest/test-inobject-slack-tracking.cc',
+      '../test/cctest/test-isolate-independent-builtins.cc',
+      '../test/cctest/test-liveedit.cc',
+      '../test/cctest/test-lockers.cc',
+      '../test/cctest/test-log.cc',
+      '../test/cctest/test-managed.cc',
+      '../test/cctest/test-mementos.cc',
+      '../test/cctest/test-modules.cc',
+      '../test/cctest/test-object.cc',
+      '../test/cctest/test-orderedhashtable.cc',
+      '../test/cctest/test-parsing.cc',
+      '../test/cctest/test-platform.cc',
+      '../test/cctest/test-profile-generator.cc',
+      '../test/cctest/test-random-number-generator.cc',
+      '../test/cctest/test-regexp.cc',
+      '../test/cctest/test-representation.cc',
+      '../test/cctest/test-sampler-api.cc',
+      '../test/cctest/test-serialize.cc',
+      '../test/cctest/test-strings.cc',
+      '../test/cctest/test-symbols.cc',
+      '../test/cctest/test-strtod.cc',
+      '../test/cctest/test-thread-termination.cc',
+      '../test/cctest/test-threads.cc',
+      '../test/cctest/test-trace-event.cc',
+      '../test/cctest/test-traced-value.cc',
+      '../test/cctest/test-transitions.cc',
+      '../test/cctest/test-transitions.h',
+      '../test/cctest/test-typedarrays.cc',
+      '../test/cctest/test-types.cc',
+      '../test/cctest/test-unbound-queue.cc',
+      '../test/cctest/test-unboxed-doubles.cc',
+      '../test/cctest/test-unscopables-hidden-prototype.cc',
+      '../test/cctest/test-usecounters.cc',
+      '../test/cctest/test-utils.cc',
+      '../test/cctest/test-version.cc',
+      '../test/cctest/test-weakmaps.cc',
+      '../test/cctest/test-weaksets.cc',
+      '../test/cctest/trace-extension.cc',
+      '../test/cctest/trace-extension.h',
+      '../test/cctest/types-fuzz.h',
+      '../test/cctest/unicode-helpers.h',
+      '../test/cctest/wasm/test-c-wasm-entry.cc',
+      '../test/cctest/wasm/test-streaming-compilation.cc',
+      '../test/cctest/wasm/test-run-wasm.cc',
+      '../test/cctest/wasm/test-run-wasm-64.cc',
+      '../test/cctest/wasm/test-run-wasm-asmjs.cc',
+      '../test/cctest/wasm/test-run-wasm-atomics.cc',
+      '../test/cctest/wasm/test-run-wasm-interpreter.cc',
+      '../test/cctest/wasm/test-run-wasm-js.cc',
+      '../test/cctest/wasm/test-run-wasm-module.cc',
+      '../test/cctest/wasm/test-run-wasm-relocation.cc',
+      '../test/cctest/wasm/test-run-wasm-sign-extension.cc',
+      '../test/cctest/wasm/test-run-wasm-simd.cc',
+      '../test/cctest/wasm/test-wasm-breakpoints.cc',
+      "../test/cctest/wasm/test-wasm-codegen.cc",
+      '../test/cctest/wasm/test-wasm-interpreter-entry.cc',
+      '../test/cctest/wasm/test-wasm-stack.cc',
+      '../test/cctest/wasm/test-wasm-trap-position.cc',
+      '../test/cctest/wasm/wasm-run-utils.cc',
+      '../test/cctest/wasm/wasm-run-utils.h',
+    ],
+    'cctest_sources_ia32': [
+      '../test/cctest/test-assembler-ia32.cc',
+      '../test/cctest/test-code-stubs.cc',
+      '../test/cctest/test-code-stubs.h',
+      '../test/cctest/test-code-stubs-ia32.cc',
+      '../test/cctest/test-disasm-ia32.cc',
+      '../test/cctest/test-log-stack-tracer.cc',
+      '../test/cctest/test-run-wasm-relocation-ia32.cc',
+    ],
+    'cctest_sources_x64': [
+      '../test/cctest/test-assembler-x64.cc',
+      '../test/cctest/test-code-stubs.cc',
+      '../test/cctest/test-code-stubs.h',
+      '../test/cctest/test-code-stubs-x64.cc',
+      '../test/cctest/test-disasm-x64.cc',
+      '../test/cctest/test-macro-assembler-x64.cc',
+      '../test/cctest/test-log-stack-tracer.cc',
+      '../test/cctest/test-run-wasm-relocation-x64.cc',
+    ],
+    'cctest_sources_arm': [
+      '../test/cctest/assembler-helper-arm.cc',
+      '../test/cctest/assembler-helper-arm.h',
+      '../test/cctest/test-assembler-arm.cc',
+      '../test/cctest/test-code-stubs.cc',
+      '../test/cctest/test-code-stubs.h',
+      '../test/cctest/test-code-stubs-arm.cc',
+      '../test/cctest/test-disasm-arm.cc',
+      '../test/cctest/test-macro-assembler-arm.cc',
+      '../test/cctest/test-run-wasm-relocation-arm.cc',
+      '../test/cctest/test-sync-primitives-arm.cc',
+    ],
+    'cctest_sources_arm64': [
+      '../test/cctest/test-utils-arm64.cc',
+      '../test/cctest/test-utils-arm64.h',
+      '../test/cctest/test-assembler-arm64.cc',
+      '../test/cctest/test-code-stubs.cc',
+      '../test/cctest/test-code-stubs.h',
+      '../test/cctest/test-code-stubs-arm64.cc',
+      '../test/cctest/test-disasm-arm64.cc',
+      '../test/cctest/test-fuzz-arm64.cc',
+      '../test/cctest/test-javascript-arm64.cc',
+      '../test/cctest/test-js-arm64-variables.cc',
+      '../test/cctest/test-run-wasm-relocation-arm64.cc',
+      '../test/cctest/test-sync-primitives-arm64.cc',
+    ],
+    'cctest_sources_s390': [
+      '../test/cctest/test-assembler-s390.cc',
+      '../test/cctest/test-code-stubs.cc',
+      '../test/cctest/test-code-stubs.h',
+      '../test/cctest/test-disasm-s390.cc',
+    ],
+    'cctest_sources_ppc': [
+      '../test/cctest/test-assembler-ppc.cc',
+      '../test/cctest/test-code-stubs.cc',
+      '../test/cctest/test-code-stubs.h',
+      '../test/cctest/test-disasm-ppc.cc',
+    ],
+    'cctest_sources_mips': [
+      '../test/cctest/test-assembler-mips.cc',
+      '../test/cctest/test-code-stubs.cc',
+      '../test/cctest/test-code-stubs.h',
+      '../test/cctest/test-code-stubs-mips.cc',
+      '../test/cctest/test-disasm-mips.cc',
+      '../test/cctest/test-macro-assembler-mips.cc',
+    ],
+    'cctest_sources_mipsel': [
+      '../test/cctest/test-assembler-mips.cc',
+      '../test/cctest/test-code-stubs.cc',
+      '../test/cctest/test-code-stubs.h',
+      '../test/cctest/test-code-stubs-mips.cc',
+      '../test/cctest/test-disasm-mips.cc',
+      '../test/cctest/test-macro-assembler-mips.cc',
+    ],
+    'cctest_sources_mips64': [
+      '../test/cctest/test-assembler-mips64.cc',
+      '../test/cctest/test-code-stubs.cc',
+      '../test/cctest/test-code-stubs.h',
+      '../test/cctest/test-code-stubs-mips64.cc',
+      '../test/cctest/test-disasm-mips64.cc',
+      '../test/cctest/test-macro-assembler-mips64.cc',
+    ],
+    'cctest_sources_mips64el': [
+      '../test/cctest/test-assembler-mips64.cc',
+      '../test/cctest/test-code-stubs.cc',
+      '../test/cctest/test-code-stubs.h',
+      '../test/cctest/test-code-stubs-mips64.cc',
+      '../test/cctest/test-disasm-mips64.cc',
+      '../test/cctest/test-macro-assembler-mips64.cc',
+    ],
+  },
+  'includes': ['toolchain.gypi', 'features.gypi'],
+  'targets': [
+    {
+      'target_name': 'cctest',
+      'type': 'executable',
+      'dependencies': [
+        'resources',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8_libplatform',
+      ],
+      'include_dirs': [
+        '..',
+      ],
+      'sources': [
+        '../test/common/wasm/flag-utils.h',
+        '../test/common/wasm/test-signatures.h',
+        '../test/common/wasm/wasm-macro-gen.h',
+        '../test/common/wasm/wasm-module-runner.cc',
+        '../test/common/wasm/wasm-module-runner.h',
+        '<@(cctest_sources)',
+        '<(generated_file)',
+      ],
+      'conditions': [
+        ['v8_target_arch=="ia32"', {
+          'sources': [
+            '<@(cctest_sources_ia32)',
+          ],
+        }],
+        ['v8_target_arch=="x64"', {
+          'sources': [
+            '<@(cctest_sources_x64)',
+          ],
+        }],
+        ['v8_target_arch=="arm"', {
+          'sources': [
+            '<@(cctest_sources_arm)',
+          ],
+        }],
+        ['v8_target_arch=="arm64"', {
+          'sources': [
+            '<@(cctest_sources_arm64)',
+          ],
+        }],
+        ['v8_target_arch=="s390"', {
+          'sources': [
+            '<@(cctest_sources_s390)',
+          ],
+        }],
+        ['v8_target_arch=="s390x"', {
+          'sources': [
+            '<@(cctest_sources_s390)',
+          ],
+        }],
+        ['v8_target_arch=="ppc"', {
+          'sources': [
+            '<@(cctest_sources_ppc)',
+          ],
+        }],
+        ['v8_target_arch=="ppc64"', {
+          'sources': [
+            '<@(cctest_sources_ppc)',
+          ],
+        }],
+        ['v8_target_arch=="mips"', {
+          'sources': [
+            '<@(cctest_sources_mips)',
+          ],
+        }],
+        ['v8_target_arch=="mipsel"', {
+          'sources': [
+            '<@(cctest_sources_mipsel)',
+          ],
+        }],
+        ['v8_target_arch=="mips64"', {
+          'sources': [
+            '<@(cctest_sources_mips64)',
+          ],
+        }],
+        ['v8_target_arch=="mips64el"', {
+          'sources': [
+            '<@(cctest_sources_mips64el)',
+          ],
+        }],
+        [ 'OS=="win"', {
+          'msvs_settings': {
+            'VCCLCompilerTool': {
+              # MSVS wants this for gay-{precision,shortest}.cc.
+              'AdditionalOptions': ['/bigobj'],
+            },
+          },
+        }],
+        ['v8_target_arch=="ppc" or v8_target_arch=="ppc64" \
+          or v8_target_arch=="arm" or v8_target_arch=="arm64" \
+          or v8_target_arch=="s390" or v8_target_arch=="s390x" \
+          or v8_target_arch=="mips" or v8_target_arch=="mips64" \
+          or v8_target_arch=="mipsel" or v8_target_arch=="mips64el"', {
+          # disable fmadd/fmsub so that expected results match generated code in
+          # RunFloat64MulAndFloat64Add1 and friends.
+          'cflags': ['-ffp-contract=off'],
+        }],
+        ['OS=="aix"', {
+          'ldflags': [ '-Wl,-bbigtoc' ],
+        }],
+        ['component=="shared_library"', {
+          # cctest can't be built against a shared library, so we need to
+          # depend on the underlying static target in that case.
+          'dependencies': ['v8.gyp:v8_maybe_snapshot'],
+          'defines': [ 'BUILDING_V8_SHARED', ]
+        }, {
+          'dependencies': ['v8.gyp:v8'],
+        }],
+        ['v8_use_snapshot=="true"', {
+          'dependencies': ['v8.gyp:v8_initializers'],
+        }],
+      ],
+    },
+    {
+      'target_name': 'resources',
+      'type': 'none',
+      'variables': {
+        'file_list': [
+           '../tools/splaytree.js',
+           '../tools/codemap.js',
+           '../tools/csvparser.js',
+           '../tools/consarray.js',
+           '../tools/profile.js',
+           '../tools/profile_view.js',
+           '../tools/arguments.js',
+           '../tools/logreader.js',
+           '../test/cctest/log-eq-of-logging-and-traversal.js',
+        ],
+      },
+      'actions': [
+        {
+          'action_name': 'js2c',
+          'inputs': [
+            '../tools/js2c.py',
+            '<@(file_list)',
+          ],
+          'outputs': [
+            '<(generated_file)',
+          ],
+          'action': [
+            'python',
+            '../tools/js2c.py',
+            '<@(_outputs)',
+            'TEST',  # type
+            '<@(file_list)',
+          ],
+        }
+      ],
+    },
+    {
+      'target_name': 'generate-bytecode-expectations',
+      'type': 'executable',
+      'dependencies': [
+        'v8.gyp:v8',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8_libplatform',
+      ],
+      'include_dirs+': [
+        '..',
+      ],
+      'sources': [
+        '../test/cctest/interpreter/bytecode-expectations-printer.cc',
+        '../test/cctest/interpreter/bytecode-expectations-printer.h',
+        '../test/cctest/interpreter/generate-bytecode-expectations.cc',
+      ],
+    },
+  ],
+}
diff --git a/deps/v8/gypfiles/coverage_wrapper.py b/deps/v8/gypfiles/coverage_wrapper.py
old mode 100755
new mode 100644
diff --git a/deps/v8/src/d8.gyp b/deps/v8/gypfiles/d8.gyp
similarity index 52%
rename from deps/v8/src/d8.gyp
rename to deps/v8/gypfiles/d8.gyp
index e6a40212cd7..f593a2b044e 100644
--- a/deps/v8/src/d8.gyp
+++ b/deps/v8/gypfiles/d8.gyp
@@ -1,29 +1,6 @@
-# Copyright 2012 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
 
 {
   'variables': {
@@ -32,7 +9,7 @@
     'v8_enable_vtunejit%': 0,
     'v8_enable_i18n_support%': 1,
   },
-  'includes': ['../gypfiles/toolchain.gypi', '../gypfiles/features.gypi'],
+  'includes': ['toolchain.gypi', 'features.gypi'],
   'targets': [
     {
       'target_name': 'd8',
@@ -48,10 +25,10 @@
         '<(DEPTH)',
       ],
       'sources': [
-        'd8.h',
-        'd8.cc',
-        'd8-console.h',
-        'd8-console.cc',
+        '../src/d8.h',
+        '../src/d8.cc',
+        '../src/d8-console.h',
+        '../src/d8-console.cc',
         '<(SHARED_INTERMEDIATE_DIR)/d8-js.cc',
       ],
       'conditions': [
@@ -68,10 +45,10 @@
         ['(OS=="linux" or OS=="mac" or OS=="freebsd" or OS=="netbsd" \
            or OS=="openbsd" or OS=="solaris" or OS=="android" \
            or OS=="qnx" or OS=="aix")', {
-             'sources': [ 'd8-posix.cc', ]
+             'sources': [ '../src/d8-posix.cc', ]
            }],
         [ 'OS=="win"', {
-          'sources': [ 'd8-windows.cc', ]
+          'sources': [ '../src/d8-windows.cc', ]
         }],
         [ 'component!="shared_library"', {
           'conditions': [
@@ -86,7 +63,7 @@
         }],
         ['v8_enable_vtunejit==1', {
           'dependencies': [
-            '../src/third_party/vtune/v8vtune.gyp:v8_vtune',
+            'v8vtune.gyp:v8_vtune',
           ],
         }],
         ['v8_enable_i18n_support==1', {
@@ -107,8 +84,8 @@
       'type': 'none',
       'variables': {
         'js_files': [
-          'd8.js',
-          'js/macros.py',
+          '../src/d8.js',
+          '../src/js/macros.py',
         ],
       },
       'conditions': [
@@ -139,23 +116,4 @@
       ],
     },
   ],
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'd8_run',
-          'type': 'none',
-          'dependencies': [
-            'd8',
-          ],
-          'includes': [
-            '../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'd8.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
 }
diff --git a/deps/v8/gypfiles/features.gypi b/deps/v8/gypfiles/features.gypi
index 8c99b4f0866..69ff763be04 100644
--- a/deps/v8/gypfiles/features.gypi
+++ b/deps/v8/gypfiles/features.gypi
@@ -87,6 +87,9 @@
     # Enable concurrent marking.
     'v8_enable_concurrent_marking%': 1,
 
+    # Enables various testing features.
+    'v8_enable_test_features%': 0,
+
     # Controls the threshold for on-heap/off-heap Typed Arrays.
     'v8_typed_array_max_size_in_heap%': 64,
 
@@ -119,6 +122,9 @@
       ['v8_trace_maps==1', {
         'defines': ['V8_TRACE_MAPS',],
       }],
+      ['v8_enable_test_features==1', {
+        'defines': ['V8_ENABLE_ALLOCATION_TIMEOUT', 'V8_ENABLE_FORCE_SLOW_PATH'],
+      }],
       ['v8_enable_verify_predictable==1', {
         'defines': ['VERIFY_PREDICTABLE',],
       }],
@@ -164,7 +170,7 @@
       },  # Debug
       'Release': {
         'variables': {
-          'v8_enable_handle_zapping%': 0,
+          'v8_enable_handle_zapping%': 1,
         },
         'conditions': [
           ['v8_enable_handle_zapping==1', {
diff --git a/deps/v8/test/fuzzer/fuzzer.gyp b/deps/v8/gypfiles/fuzzer.gyp
similarity index 55%
rename from deps/v8/test/fuzzer/fuzzer.gyp
rename to deps/v8/gypfiles/fuzzer.gyp
index 0c54211290e..f65b7dc6d0f 100644
--- a/deps/v8/test/fuzzer/fuzzer.gyp
+++ b/deps/v8/gypfiles/fuzzer.gyp
@@ -6,7 +6,7 @@
   'variables': {
     'v8_code': 1,
   },
-  'includes': ['../../gypfiles/toolchain.gypi', '../../gypfiles/features.gypi'],
+  'includes': ['toolchain.gypi', 'features.gypi'],
   'targets': [
     {
       'target_name': 'v8_simple_json_fuzzer',
@@ -15,24 +15,24 @@
         'json_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
       'target_name': 'json_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'json.cc',
+      'sources': [
+        '../test/fuzzer/json.cc',
       ],
     },
     {
@@ -42,175 +42,171 @@
         'parser_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
       'target_name': 'parser_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'parser.cc',
+      'sources': [
+        '../test/fuzzer/parser.cc',
       ],
     },
     {
-      'target_name': 'v8_simple_regexp_fuzzer',
+      'target_name': 'v8_simple_regexp_builtins_fuzzer',
       'type': 'executable',
       'dependencies': [
-        'regexp_fuzzer_lib',
+        'regexp_builtins_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
-      'target_name': 'regexp_fuzzer_lib',
+      'target_name': 'regexp_builtins_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'regexp.cc',
+      'sources': [
+        '../test/fuzzer/regexp-builtins.cc',
+        '../test/fuzzer/regexp_builtins/mjsunit.js.h',
       ],
     },
     {
-      'target_name': 'v8_simple_multi_return_fuzzer',
+      'target_name': 'v8_simple_regexp_fuzzer',
       'type': 'executable',
       'dependencies': [
-        'multi_return_fuzzer_lib',
+        'regexp_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
-      'target_name': 'multi_return_fuzzer_lib',
+      'target_name': 'regexp_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        '../compiler/c-signature.h',
-        '../compiler/call-helper.h',
-        '../compiler/raw-machine-assembler-tester.h',
-        'multi-return.cc',
+      'sources': [
+        '../test/fuzzer/regexp.cc',
       ],
     },
     {
-      'target_name': 'v8_simple_wasm_fuzzer',
+      'target_name': 'v8_simple_multi_return_fuzzer',
       'type': 'executable',
       'dependencies': [
-        'wasm_fuzzer_lib',
+        'multi_return_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
-      'target_name': 'wasm_fuzzer_lib',
+      'target_name': 'multi_return_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'wasm.cc',
-        '../common/wasm/wasm-module-runner.cc',
-        '../common/wasm/wasm-module-runner.h',
-        'wasm-fuzzer-common.cc',
-        'wasm-fuzzer-common.h',
+      'sources': [
+        '../test/cctest/compiler/c-signature.h',
+        '../test/cctest/compiler/call-helper.h',
+        '../test/cctest/compiler/raw-machine-assembler-tester.h',
+        '../test/fuzzer/multi-return.cc',
       ],
     },
     {
-      'target_name': 'v8_simple_wasm_async_fuzzer',
+      'target_name': 'v8_simple_wasm_fuzzer',
       'type': 'executable',
       'dependencies': [
-        'wasm_async_fuzzer_lib',
+        'wasm_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
-      'target_name': 'wasm_async_fuzzer_lib',
+      'target_name': 'wasm_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'wasm-async.cc',
-        '../common/wasm/wasm-module-runner.cc',
-        '../common/wasm/wasm-module-runner.h',
-        'wasm-fuzzer-common.cc',
-        'wasm-fuzzer-common.h',
+      'sources': [
+        '../test/fuzzer/wasm.cc',
+        '../test/common/wasm/wasm-module-runner.cc',
+        '../test/common/wasm/wasm-module-runner.h',
+        '../test/fuzzer/wasm-fuzzer-common.cc',
+        '../test/fuzzer/wasm-fuzzer-common.h',
       ],
     },
     {
-      'target_name': 'v8_simple_wasm_call_fuzzer',
+      'target_name': 'v8_simple_wasm_async_fuzzer',
       'type': 'executable',
       'dependencies': [
-        'wasm_call_fuzzer_lib',
+        'wasm_async_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
-      'target_name': 'wasm_call_fuzzer_lib',
+      'target_name': 'wasm_async_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'wasm-call.cc',
-        '../common/wasm/test-signatures.h',
-        '../common/wasm/wasm-module-runner.cc',
-        '../common/wasm/wasm-module-runner.h',
-        'wasm-fuzzer-common.cc',
-        'wasm-fuzzer-common.h',
+      'sources': [
+        '../test/fuzzer/wasm-async.cc',
+        '../test/common/wasm/wasm-module-runner.cc',
+        '../test/common/wasm/wasm-module-runner.h',
+        '../test/fuzzer/wasm-fuzzer-common.cc',
+        '../test/fuzzer/wasm-fuzzer-common.h',
       ],
     },
     {
@@ -220,29 +216,29 @@
         'wasm_code_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
       'target_name': 'wasm_code_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'wasm-code.cc',
-        '../common/wasm/test-signatures.h',
-        '../common/wasm/wasm-module-runner.cc',
-        '../common/wasm/wasm-module-runner.h',
-        'wasm-fuzzer-common.cc',
-        'wasm-fuzzer-common.h',
+      'sources': [
+        '../test/fuzzer/wasm-code.cc',
+        '../test/common/wasm/test-signatures.h',
+        '../test/common/wasm/wasm-module-runner.cc',
+        '../test/common/wasm/wasm-module-runner.h',
+        '../test/fuzzer/wasm-fuzzer-common.cc',
+        '../test/fuzzer/wasm-fuzzer-common.h',
       ],
     },
     {
@@ -252,29 +248,29 @@
         'wasm_compile_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
       'target_name': 'wasm_compile_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'wasm-compile.cc',
-        '../common/wasm/test-signatures.h',
-        '../common/wasm/wasm-module-runner.cc',
-        '../common/wasm/wasm-module-runner.h',
-        'wasm-fuzzer-common.cc',
-        'wasm-fuzzer-common.h',
+      'sources': [
+        '../test/fuzzer/wasm-compile.cc',
+        '../test/common/wasm/test-signatures.h',
+        '../test/common/wasm/wasm-module-runner.cc',
+        '../test/common/wasm/wasm-module-runner.h',
+        '../test/fuzzer/wasm-fuzzer-common.cc',
+        '../test/fuzzer/wasm-fuzzer-common.h',
       ],
     },
     {
@@ -284,28 +280,28 @@
         'wasm_data_section_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
       'target_name': 'wasm_data_section_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'wasm-data-section.cc',
-        '../common/wasm/wasm-module-runner.cc',
-        '../common/wasm/wasm-module-runner.h',
-        'wasm-fuzzer-common.cc',
-        'wasm-fuzzer-common.h',
+      'sources': [
+        '../test/fuzzer/wasm-data-section.cc',
+        '../test/common/wasm/wasm-module-runner.cc',
+        '../test/common/wasm/wasm-module-runner.h',
+        '../test/fuzzer/wasm-fuzzer-common.cc',
+        '../test/fuzzer/wasm-fuzzer-common.h',
       ],
     },
     {
@@ -315,28 +311,28 @@
         'wasm_function_sigs_section_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
       'target_name': 'wasm_function_sigs_section_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'wasm-function-sigs-section.cc',
-        '../common/wasm/wasm-module-runner.cc',
-        '../common/wasm/wasm-module-runner.h',
-        'wasm-fuzzer-common.cc',
-        'wasm-fuzzer-common.h',
+      'sources': [
+        '../test/fuzzer/wasm-function-sigs-section.cc',
+        '../test/common/wasm/wasm-module-runner.cc',
+        '../test/common/wasm/wasm-module-runner.h',
+        '../test/fuzzer/wasm-fuzzer-common.cc',
+        '../test/fuzzer/wasm-fuzzer-common.h',
       ],
     },
     {
@@ -346,28 +342,28 @@
         'wasm_globals_section_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
       'target_name': 'wasm_globals_section_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'wasm-globals-section.cc',
-        '../common/wasm/wasm-module-runner.cc',
-        '../common/wasm/wasm-module-runner.h',
-        'wasm-fuzzer-common.cc',
-        'wasm-fuzzer-common.h',
+      'sources': [
+        '../test/fuzzer/wasm-globals-section.cc',
+        '../test/common/wasm/wasm-module-runner.cc',
+        '../test/common/wasm/wasm-module-runner.h',
+        '../test/fuzzer/wasm-fuzzer-common.cc',
+        '../test/fuzzer/wasm-fuzzer-common.h',
       ],
     },
     {
@@ -377,28 +373,28 @@
         'wasm_imports_section_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
       'target_name': 'wasm_imports_section_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'wasm-imports-section.cc',
-        '../common/wasm/wasm-module-runner.cc',
-        '../common/wasm/wasm-module-runner.h',
-        'wasm-fuzzer-common.cc',
-        'wasm-fuzzer-common.h',
+      'sources': [
+        '../test/fuzzer/wasm-imports-section.cc',
+        '../test/common/wasm/wasm-module-runner.cc',
+        '../test/common/wasm/wasm-module-runner.h',
+        '../test/fuzzer/wasm-fuzzer-common.cc',
+        '../test/fuzzer/wasm-fuzzer-common.h',
       ],
     },
     {
@@ -408,28 +404,28 @@
         'wasm_memory_section_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
       'target_name': 'wasm_memory_section_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'wasm-memory-section.cc',
-        '../common/wasm/wasm-module-runner.cc',
-        '../common/wasm/wasm-module-runner.h',
-        'wasm-fuzzer-common.cc',
-        'wasm-fuzzer-common.h',
+      'sources': [
+        '../test/fuzzer/wasm-memory-section.cc',
+        '../test/common/wasm/wasm-module-runner.cc',
+        '../test/common/wasm/wasm-module-runner.h',
+        '../test/fuzzer/wasm-fuzzer-common.cc',
+        '../test/fuzzer/wasm-fuzzer-common.h',
       ],
     },
     {
@@ -439,28 +435,28 @@
         'wasm_names_section_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
       'target_name': 'wasm_names_section_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'wasm-names-section.cc',
-        '../common/wasm/wasm-module-runner.cc',
-        '../common/wasm/wasm-module-runner.h',
-        'wasm-fuzzer-common.cc',
-        'wasm-fuzzer-common.h',
+      'sources': [
+        '../test/fuzzer/wasm-names-section.cc',
+        '../test/common/wasm/wasm-module-runner.cc',
+        '../test/common/wasm/wasm-module-runner.h',
+        '../test/fuzzer/wasm-fuzzer-common.cc',
+        '../test/fuzzer/wasm-fuzzer-common.h',
       ],
     },
     {
@@ -470,44 +466,44 @@
         'wasm_types_section_fuzzer_lib',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
       'sources': [
-        'fuzzer.cc',
+        '../test/fuzzer/fuzzer.cc',
       ],
     },
     {
       'target_name': 'wasm_types_section_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'wasm-types-section.cc',
-        '../common/wasm/wasm-module-runner.cc',
-        '../common/wasm/wasm-module-runner.h',
-        'wasm-fuzzer-common.cc',
-        'wasm-fuzzer-common.h',
+      'sources': [
+        '../test/fuzzer/wasm-types-section.cc',
+        '../test/common/wasm/wasm-module-runner.cc',
+        '../test/common/wasm/wasm-module-runner.h',
+        '../test/fuzzer/wasm-fuzzer-common.cc',
+        '../test/fuzzer/wasm-fuzzer-common.h',
       ],
     },
     {
       'target_name': 'fuzzer_support',
       'type': 'static_library',
       'dependencies': [
-        '../../src/v8.gyp:v8',
-        '../../src/v8.gyp:v8_libbase',
-        '../../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8_libplatform',
       ],
       'include_dirs': [
-        '../..',
+        '..',
       ],
-      'sources': [  ### gcmole(all) ###
-        'fuzzer-support.cc',
-        'fuzzer-support.h',
+      'sources': [
+        '../test/fuzzer/fuzzer-support.cc',
+        '../test/fuzzer/fuzzer-support.h',
       ],
       'conditions': [
         ['v8_enable_i18n_support==1', {
@@ -519,26 +515,4 @@
       ],
     },
   ],
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'fuzzer_run',
-          'type': 'none',
-          'dependencies': [
-            'v8_simple_json_fuzzer',
-            'v8_simple_parser_fuzzer',
-            'v8_simple_regexp_fuzzer',
-            'v8_simple_wasm_fuzzer',
-          ],
-          'includes': [
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'fuzzer.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
 }
diff --git a/deps/v8/gypfiles/gmock.gyp b/deps/v8/gypfiles/gmock.gyp
new file mode 100644
index 00000000000..a80387298b1
--- /dev/null
+++ b/deps/v8/gypfiles/gmock.gyp
@@ -0,0 +1,72 @@
+# Copyright 2014 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+{
+  'targets': [
+    {
+      'target_name': 'gmock',
+      'type': 'static_library',
+      'dependencies': [
+        'gtest.gyp:gtest',
+      ],
+      'sources': [
+        # Sources based on files in r173 of gmock.
+        '../testing/gmock/include/gmock/gmock-actions.h',
+        '../testing/gmock/include/gmock/gmock-cardinalities.h',
+        '../testing/gmock/include/gmock/gmock-generated-actions.h',
+        '../testing/gmock/include/gmock/gmock-generated-function-mockers.h',
+        '../testing/gmock/include/gmock/gmock-generated-matchers.h',
+        '../testing/gmock/include/gmock/gmock-generated-nice-strict.h',
+        '../testing/gmock/include/gmock/gmock-matchers.h',
+        '../testing/gmock/include/gmock/gmock-spec-builders.h',
+        '../testing/gmock/include/gmock/gmock.h',
+        '../testing/gmock/include/gmock/internal/gmock-generated-internal-utils.h',
+        '../testing/gmock/include/gmock/internal/gmock-internal-utils.h',
+        '../testing/gmock/include/gmock/internal/gmock-port.h',
+        '../testing/gmock/src/gmock-all.cc',
+        '../testing/gmock/src/gmock-cardinalities.cc',
+        '../testing/gmock/src/gmock-internal-utils.cc',
+        '../testing/gmock/src/gmock-matchers.cc',
+        '../testing/gmock/src/gmock-spec-builders.cc',
+        '../testing/gmock/src/gmock.cc',
+        '../testing/gmock-support.h',  # gMock helpers
+        '../testing/gmock_custom/gmock/internal/custom/gmock-port.h',
+      ],
+      'sources!': [
+        '../testing/gmock/src/gmock-all.cc',  # Not needed by our build.
+      ],
+      'include_dirs': [
+        '../testing/gmock_custom',
+        '../testing/gmock',
+        '../testing/gmock/include',
+      ],
+      'all_dependent_settings': {
+        'include_dirs': [
+          '../testing/gmock_custom',
+          '../testing/gmock/include',  # So that gmock headers can find themselves.
+        ],
+      },
+      'export_dependent_settings': [
+        'gtest.gyp:gtest',
+      ],
+      'conditions': [
+        ['want_separate_host_toolset==1', {
+          'toolsets': ['host', 'target'],
+        }, {
+          'toolsets': ['target'],
+        }],
+      ],
+    },
+    {
+      'target_name': 'gmock_main',
+      'type': 'static_library',
+      'dependencies': [
+        'gmock',
+      ],
+      'sources': [
+        '../testing/gmock/src/gmock_main.cc',
+      ],
+    },
+  ],
+}
diff --git a/deps/v8/testing/gtest.gyp b/deps/v8/gypfiles/gtest.gyp
similarity index 50%
rename from deps/v8/testing/gtest.gyp
rename to deps/v8/gypfiles/gtest.gyp
index a94ee884fe9..82ae105293f 100644
--- a/deps/v8/testing/gtest.gyp
+++ b/deps/v8/gypfiles/gtest.gyp
@@ -9,42 +9,42 @@
       'toolsets': ['host', 'target'],
       'type': 'static_library',
       'sources': [
-        'gtest/include/gtest/gtest-death-test.h',
-        'gtest/include/gtest/gtest-message.h',
-        'gtest/include/gtest/gtest-param-test.h',
-        'gtest/include/gtest/gtest-printers.h',
-        'gtest/include/gtest/gtest-spi.h',
-        'gtest/include/gtest/gtest-test-part.h',
-        'gtest/include/gtest/gtest-typed-test.h',
-        'gtest/include/gtest/gtest.h',
-        'gtest/include/gtest/gtest_pred_impl.h',
-        'gtest/include/gtest/internal/gtest-death-test-internal.h',
-        'gtest/include/gtest/internal/gtest-filepath.h',
-        'gtest/include/gtest/internal/gtest-internal.h',
-        'gtest/include/gtest/internal/gtest-linked_ptr.h',
-        'gtest/include/gtest/internal/gtest-param-util-generated.h',
-        'gtest/include/gtest/internal/gtest-param-util.h',
-        'gtest/include/gtest/internal/gtest-port.h',
-        'gtest/include/gtest/internal/gtest-string.h',
-        'gtest/include/gtest/internal/gtest-tuple.h',
-        'gtest/include/gtest/internal/gtest-type-util.h',
-        'gtest/src/gtest-all.cc',
-        'gtest/src/gtest-death-test.cc',
-        'gtest/src/gtest-filepath.cc',
-        'gtest/src/gtest-internal-inl.h',
-        'gtest/src/gtest-port.cc',
-        'gtest/src/gtest-printers.cc',
-        'gtest/src/gtest-test-part.cc',
-        'gtest/src/gtest-typed-test.cc',
-        'gtest/src/gtest.cc',
-        'gtest-support.h',
+        '../testing/gtest/include/gtest/gtest-death-test.h',
+        '../testing/gtest/include/gtest/gtest-message.h',
+        '../testing/gtest/include/gtest/gtest-param-test.h',
+        '../testing/gtest/include/gtest/gtest-printers.h',
+        '../testing/gtest/include/gtest/gtest-spi.h',
+        '../testing/gtest/include/gtest/gtest-test-part.h',
+        '../testing/gtest/include/gtest/gtest-typed-test.h',
+        '../testing/gtest/include/gtest/gtest.h',
+        '../testing/gtest/include/gtest/gtest_pred_impl.h',
+        '../testing/gtest/include/gtest/internal/gtest-death-test-internal.h',
+        '../testing/gtest/include/gtest/internal/gtest-filepath.h',
+        '../testing/gtest/include/gtest/internal/gtest-internal.h',
+        '../testing/gtest/include/gtest/internal/gtest-linked_ptr.h',
+        '../testing/gtest/include/gtest/internal/gtest-param-util-generated.h',
+        '../testing/gtest/include/gtest/internal/gtest-param-util.h',
+        '../testing/gtest/include/gtest/internal/gtest-port.h',
+        '../testing/gtest/include/gtest/internal/gtest-string.h',
+        '../testing/gtest/include/gtest/internal/gtest-tuple.h',
+        '../testing/gtest/include/gtest/internal/gtest-type-util.h',
+        '../testing/gtest/src/gtest-all.cc',
+        '../testing/gtest/src/gtest-death-test.cc',
+        '../testing/gtest/src/gtest-filepath.cc',
+        '../testing/gtest/src/gtest-internal-inl.h',
+        '../testing/gtest/src/gtest-port.cc',
+        '../testing/gtest/src/gtest-printers.cc',
+        '../testing/gtest/src/gtest-test-part.cc',
+        '../testing/gtest/src/gtest-typed-test.cc',
+        '../testing/gtest/src/gtest.cc',
+        '../testing/gtest-support.h',
       ],
       'sources!': [
-        'gtest/src/gtest-all.cc',  # Not needed by our build.
+        '../testing/gtest/src/gtest-all.cc',  # Not needed by our build.
       ],
       'include_dirs': [
-        'gtest',
-        'gtest/include',
+        '../testing/gtest',
+        '../testing/gtest/include',
       ],
       'dependencies': [
         'gtest_prod',
@@ -78,7 +78,7 @@
           'UNIT_TEST',
         ],
         'include_dirs': [
-          'gtest/include',  # So that gtest headers can find themselves.
+          '../testing/gtest/include',  # So that gtest headers can find themselves.
         ],
         'target_conditions': [
           ['_type=="executable"', {
@@ -107,7 +107,7 @@
         'gtest',
       ],
       'sources': [
-        'gtest/src/gtest_main.cc',
+        '../testing/gtest/src/gtest_main.cc',
       ],
     },
     {
@@ -115,7 +115,7 @@
       'toolsets': ['host', 'target'],
       'type': 'none',
       'sources': [
-        'gtest/include/gtest/gtest_prod.h',
+        '../testing/gtest/include/gtest/gtest_prod.h',
       ],
     },
   ],
diff --git a/deps/v8/gypfiles/gyp_v8 b/deps/v8/gypfiles/gyp_v8
old mode 100755
new mode 100644
index 5215f513525..62e13d86e6c
--- a/deps/v8/gypfiles/gyp_v8
+++ b/deps/v8/gypfiles/gyp_v8
@@ -48,7 +48,8 @@ import gyp
 # Add paths so that pymod_do_main(...) can import files.
 sys.path.insert(
     1, os.path.abspath(os.path.join(v8_root, 'tools', 'generate_shim_headers')))
-
+sys.path.append(
+    os.path.abspath(os.path.join(v8_root, 'third_party', 'binutils')))
 
 def GetOutputDirectory():
   """Returns the output directory that GYP will use."""
@@ -108,14 +109,19 @@ def run_gyp(args):
 if __name__ == '__main__':
   args = sys.argv[1:]
 
-  gyp_chromium_no_action = os.environ.get('GYP_CHROMIUM_NO_ACTION', '1')
-  if gyp_chromium_no_action != '0':
-    print 'GYP is now disabled by default.\n'
-    print 'If you really want to run this, set the environment variable '
-    print 'GYP_CHROMIUM_NO_ACTION=0.'
+  gyp_chromium_no_action = os.environ.get('GYP_CHROMIUM_NO_ACTION')
+  if gyp_chromium_no_action == '1':
+    print 'Skipping gyp_v8 due to GYP_CHROMIUM_NO_ACTION env var.'
     sys.exit(0)
 
   running_as_hook = '--running-as-hook'
+  if running_as_hook in args and gyp_chromium_no_action != '0':
+    print 'GYP is now disabled by default in runhooks.\n'
+    print 'If you really want to run this, either run '
+    print '`python gypfiles/gyp_v8` explicitly by hand '
+    print 'or set the environment variable GYP_CHROMIUM_NO_ACTION=0.'
+    sys.exit(0)
+
   if running_as_hook in args:
     args.remove(running_as_hook)
 
diff --git a/deps/v8/gypfiles/inspector-test.gyp b/deps/v8/gypfiles/inspector-test.gyp
new file mode 100644
index 00000000000..c8cc5561a4c
--- /dev/null
+++ b/deps/v8/gypfiles/inspector-test.gyp
@@ -0,0 +1,39 @@
+# Copyright 2016 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+{
+  'variables': {
+    'v8_code': 1,
+  },
+  'includes': ['toolchain.gypi', 'features.gypi'],
+  'targets': [
+    {
+      'target_name': 'inspector-test',
+      'type': 'executable',
+      'dependencies': [
+        'v8.gyp:v8_libplatform',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8',
+      ],
+      'include_dirs': [
+        '..',
+      ],
+      'sources': [
+        '../test/inspector/inspector-test.cc',
+        '../test/inspector/isolate-data.cc',
+        '../test/inspector/isolate-data.h',
+        '../test/inspector/task-runner.cc',
+        '../test/inspector/task-runner.h',
+      ],
+      'conditions': [
+        ['v8_enable_i18n_support==1', {
+          'dependencies': [
+            '<(icu_gyp_path):icui18n',
+            '<(icu_gyp_path):icuuc',
+          ],
+        }],
+      ],
+    },
+  ],
+}
diff --git a/deps/v8/src/inspector/inspector.gyp b/deps/v8/gypfiles/inspector.gyp
similarity index 76%
rename from deps/v8/src/inspector/inspector.gyp
rename to deps/v8/gypfiles/inspector.gyp
index 3d59cc089df..c0b503d9cec 100644
--- a/deps/v8/src/inspector/inspector.gyp
+++ b/deps/v8/gypfiles/inspector.gyp
@@ -4,11 +4,12 @@
 
 {
   'variables': {
-    'protocol_path': '../../third_party/inspector_protocol',
+    'protocol_path': '../third_party/inspector_protocol',
+    'inspector_path': '../src/inspector',
   },
   'includes': [
     'inspector.gypi',
-    '<(PRODUCT_DIR)/../../../third_party/inspector_protocol/inspector_protocol.gypi',
+    '../third_party/inspector_protocol/inspector_protocol.gypi',
   ],
   'targets': [
     { 'target_name': 'inspector_injected_script',
@@ -18,7 +19,7 @@
         {
           'action_name': 'convert_js_to_cpp_char_array',
           'inputs': [
-            'build/xxd.py',
+            '<(inspector_path)/build/xxd.py',
             '<(inspector_injected_script_source)',
           ],
           'outputs': [
@@ -26,9 +27,9 @@
           ],
           'action': [
             'python',
-            'build/xxd.py',
+            '<(inspector_path)/build/xxd.py',
             'InjectedScriptSource_js',
-            'injected-script-source.js',
+            '<(inspector_path)/injected-script-source.js',
             '<@(_outputs)'
           ],
         },
@@ -43,7 +44,7 @@
         {
           'action_name': 'protocol_compatibility',
           'inputs': [
-            'js_protocol.json',
+            '<(inspector_path)/js_protocol.json',
           ],
           'outputs': [
             '<@(SHARED_INTERMEDIATE_DIR)/src/js_protocol.stamp',
@@ -52,7 +53,7 @@
             'python',
             '<(protocol_path)/CheckProtocolCompatibility.py',
             '--stamp', '<@(_outputs)',
-            'js_protocol.json',
+            '<(inspector_path)/js_protocol.json',
           ],
           'message': 'Generating inspector protocol sources from protocol json definition',
         },
@@ -66,8 +67,8 @@
         {
           'action_name': 'protocol_generated_sources',
           'inputs': [
-            'js_protocol.json',
-            'inspector_protocol_config.json',
+            '<(inspector_path)/js_protocol.json',
+            '<(inspector_path)/inspector_protocol_config.json',
             '<@(inspector_protocol_files)',
           ],
           'outputs': [
@@ -76,9 +77,9 @@
           'action': [
             'python',
             '<(protocol_path)/CodeGenerator.py',
-            '--jinja_dir', '../../third_party',
+            '--jinja_dir', '../third_party',
             '--output_base', '<(SHARED_INTERMEDIATE_DIR)/src/inspector',
-            '--config', 'inspector_protocol_config.json',
+            '--config', '<(inspector_path)/inspector_protocol_config.json',
           ],
           'message': 'Generating inspector protocol sources from protocol json',
         },
diff --git a/deps/v8/gypfiles/inspector.gypi b/deps/v8/gypfiles/inspector.gypi
new file mode 100644
index 00000000000..00cbbfaecb7
--- /dev/null
+++ b/deps/v8/gypfiles/inspector.gypi
@@ -0,0 +1,90 @@
+# Copyright 2016 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+{
+  'variables': {
+    'inspector_generated_sources': [
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Forward.h',
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Protocol.cpp',
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Protocol.h',
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Console.cpp',
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Console.h',
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Debugger.cpp',
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Debugger.h',
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/HeapProfiler.cpp',
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/HeapProfiler.h',
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Profiler.cpp',
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Profiler.h',
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Runtime.cpp',
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Runtime.h',
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Schema.cpp',
+      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Schema.h',
+      '<(SHARED_INTERMEDIATE_DIR)/include/inspector/Debugger.h',
+      '<(SHARED_INTERMEDIATE_DIR)/include/inspector/Runtime.h',
+      '<(SHARED_INTERMEDIATE_DIR)/include/inspector/Schema.h',
+    ],
+
+    'inspector_injected_script_source': '../src/inspector/injected-script-source.js',
+    'inspector_generated_injected_script': '<(SHARED_INTERMEDIATE_DIR)/src/inspector/injected-script-source.h',
+
+    'inspector_all_sources': [
+      '<@(inspector_generated_sources)',
+      '<(inspector_generated_injected_script)',
+      '../include/v8-inspector.h',
+      '../include/v8-inspector-protocol.h',
+      '../src/inspector/injected-script.cc',
+      '../src/inspector/injected-script.h',
+      '../src/inspector/inspected-context.cc',
+      '../src/inspector/inspected-context.h',
+      '../src/inspector/remote-object-id.cc',
+      '../src/inspector/remote-object-id.h',
+      '../src/inspector/search-util.cc',
+      '../src/inspector/search-util.h',
+      '../src/inspector/string-16.cc',
+      '../src/inspector/string-16.h',
+      '../src/inspector/string-util.cc',
+      '../src/inspector/string-util.h',
+      '../src/inspector/test-interface.cc',
+      '../src/inspector/test-interface.h',
+      '../src/inspector/v8-console.cc',
+      '../src/inspector/v8-console.h',
+      '../src/inspector/v8-console-agent-impl.cc',
+      '../src/inspector/v8-console-agent-impl.h',
+      '../src/inspector/v8-console-message.cc',
+      '../src/inspector/v8-console-message.h',
+      '../src/inspector/v8-debugger.cc',
+      '../src/inspector/v8-debugger.h',
+      '../src/inspector/v8-debugger-agent-impl.cc',
+      '../src/inspector/v8-debugger-agent-impl.h',
+      '../src/inspector/v8-debugger-script.cc',
+      '../src/inspector/v8-debugger-script.h',
+      '../src/inspector/v8-function-call.cc',
+      '../src/inspector/v8-function-call.h',
+      '../src/inspector/v8-heap-profiler-agent-impl.cc',
+      '../src/inspector/v8-heap-profiler-agent-impl.h',
+      '../src/inspector/v8-injected-script-host.cc',
+      '../src/inspector/v8-injected-script-host.h',
+      '../src/inspector/v8-inspector-impl.cc',
+      '../src/inspector/v8-inspector-impl.h',
+      '../src/inspector/v8-inspector-session-impl.cc',
+      '../src/inspector/v8-inspector-session-impl.h',
+      '../src/inspector/v8-internal-value-type.cc',
+      '../src/inspector/v8-internal-value-type.h',
+      '../src/inspector/v8-profiler-agent-impl.cc',
+      '../src/inspector/v8-profiler-agent-impl.h',
+      '../src/inspector/v8-regex.cc',
+      '../src/inspector/v8-regex.h',
+      '../src/inspector/v8-runtime-agent-impl.cc',
+      '../src/inspector/v8-runtime-agent-impl.h',
+      '../src/inspector/v8-schema-agent-impl.cc',
+      '../src/inspector/v8-schema-agent-impl.h',
+      '../src/inspector/v8-stack-trace-impl.cc',
+      '../src/inspector/v8-stack-trace-impl.h',
+      '../src/inspector/v8-value-utils.cc',
+      '../src/inspector/v8-value-utils.h',
+      '../src/inspector/wasm-translation.cc',
+      '../src/inspector/wasm-translation.h',
+    ]
+  }
+}
diff --git a/deps/v8/gypfiles/isolate.gypi b/deps/v8/gypfiles/isolate.gypi
deleted file mode 100644
index 3e85b530e25..00000000000
--- a/deps/v8/gypfiles/isolate.gypi
+++ /dev/null
@@ -1,100 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Copyright (c) 2012 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# This file is meant to be included into a target to provide a rule
-# to "build" .isolate files into a .isolated file.
-#
-# To use this, create a gyp target with the following form:
-# 'conditions': [
-#   ['test_isolation_mode != "noop"', {
-#     'targets': [
-#       {
-#         'target_name': 'foo_test_run',
-#         'type': 'none',
-#         'dependencies': [
-#           'foo_test',
-#         ],
-#         'includes': [
-#           '../gypfiles/isolate.gypi',
-#         ],
-#         'sources': [
-#           'foo_test.isolate',
-#         ],
-#       },
-#     ],
-#   }],
-# ],
-#
-# Note: foo_test.isolate is included and a source file. It is an inherent
-# property of the .isolate format. This permits to define GYP variables but is
-# a stricter format than GYP so isolate.py can read it.
-#
-# The generated .isolated file will be:
-#   <(PRODUCT_DIR)/foo_test.isolated
-#
-# See http://dev.chromium.org/developers/testing/isolated-testing/for-swes
-# for more information.
-
-{
-  'rules': [
-    {
-      'rule_name': 'isolate',
-      'extension': 'isolate',
-      'inputs': [
-        # Files that are known to be involved in this step.
-        '<(DEPTH)/tools/isolate_driver.py',
-        '<(DEPTH)/tools/swarming_client/isolate.py',
-        '<(DEPTH)/tools/swarming_client/run_isolated.py',
-      ],
-      'outputs': [
-        '<(PRODUCT_DIR)/<(RULE_INPUT_ROOT).isolated',
-      ],
-      'action': [
-        'python',
-        '<(DEPTH)/tools/isolate_driver.py',
-        '<(test_isolation_mode)',
-        '--isolated', '<(PRODUCT_DIR)/<(RULE_INPUT_ROOT).isolated',
-        '--isolate', '<(RULE_INPUT_PATH)',
-
-        # Variables should use the -V FOO=<(FOO) form so frequent values,
-        # like '0' or '1', aren't stripped out by GYP. Run 'isolate.py help'
-        # for more details.
-
-        # Path variables are used to replace file paths when loading a .isolate
-        # file
-        '--path-variable', 'DEPTH', '<(DEPTH)',
-        '--path-variable', 'PRODUCT_DIR', '<(PRODUCT_DIR)',
-
-        '--config-variable', 'CONFIGURATION_NAME=<(CONFIGURATION_NAME)',
-        '--config-variable', 'OS=<(OS)',
-        '--config-variable', 'asan=<(asan)',
-        '--config-variable', 'cfi_vptr=<(cfi_vptr)',
-        '--config-variable', 'gcmole=<(gcmole)',
-        '--config-variable', 'has_valgrind=<(has_valgrind)',
-        '--config-variable', 'icu_use_data_file_flag=<(icu_use_data_file_flag)',
-        '--config-variable', 'msan=<(msan)',
-        '--config-variable', 'tsan=<(tsan)',
-        '--config-variable', 'coverage=<(coverage)',
-        '--config-variable', 'sanitizer_coverage=<(sanitizer_coverage)',
-        '--config-variable', 'component=<(component)',
-        '--config-variable', 'target_arch=<(target_arch)',
-        '--config-variable', 'ubsan_vptr=0',
-        '--config-variable', 'v8_use_external_startup_data=<(v8_use_external_startup_data)',
-        '--config-variable', 'v8_use_snapshot=<(v8_use_snapshot)',
-      ],
-      'conditions': [
-        ['OS=="win"', {
-          'action': [
-            '--config-variable', 'msvs_version=2013',
-          ],
-        }, {
-          'action': [
-            '--config-variable', 'msvs_version=0',
-          ],
-        }],
-      ],
-    },
-  ],
-}
diff --git a/deps/v8/gypfiles/landmine_utils.py b/deps/v8/gypfiles/landmine_utils.py
deleted file mode 100644
index 8bdc2b648b3..00000000000
--- a/deps/v8/gypfiles/landmine_utils.py
+++ /dev/null
@@ -1,123 +0,0 @@
-# Copyright 2014 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-
-import functools
-import logging
-import os
-import shlex
-import sys
-
-
-def memoize(default=None):
-  """This decorator caches the return value of a parameterless pure function"""
-  def memoizer(func):
-    val = []
-    @functools.wraps(func)
-    def inner():
-      if not val:
-        ret = func()
-        val.append(ret if ret is not None else default)
-        if logging.getLogger().isEnabledFor(logging.INFO):
-          print '%s -> %r' % (func.__name__, val[0])
-      return val[0]
-    return inner
-  return memoizer
-
-
-@memoize()
-def IsWindows():
-  return sys.platform in ['win32', 'cygwin']
-
-
-@memoize()
-def IsLinux():
-  return sys.platform.startswith(('linux', 'freebsd'))
-
-
-@memoize()
-def IsMac():
-  return sys.platform == 'darwin'
-
-
-@memoize()
-def gyp_defines():
-  """Parses and returns GYP_DEFINES env var as a dictionary."""
-  return dict(arg.split('=', 1)
-      for arg in shlex.split(os.environ.get('GYP_DEFINES', '')))
-
-
-@memoize()
-def gyp_generator_flags():
-  """Parses and returns GYP_GENERATOR_FLAGS env var as a dictionary."""
-  return dict(arg.split('=', 1)
-      for arg in shlex.split(os.environ.get('GYP_GENERATOR_FLAGS', '')))
-
-
-@memoize()
-def gyp_msvs_version():
-  return os.environ.get('GYP_MSVS_VERSION', '')
-
-
-@memoize()
-def distributor():
-  """
-  Returns a string which is the distributed build engine in use (if any).
-  Possible values: 'goma', 'ib', ''
-  """
-  if 'goma' in gyp_defines():
-    return 'goma'
-  elif IsWindows():
-    if 'CHROME_HEADLESS' in os.environ:
-      return 'ib' # use (win and !goma and headless) as approximation of ib
-
-
-@memoize()
-def platform():
-  """
-  Returns a string representing the platform this build is targeted for.
-  Possible values: 'win', 'mac', 'linux', 'ios', 'android'
-  """
-  if 'OS' in gyp_defines():
-    if 'android' in gyp_defines()['OS']:
-      return 'android'
-    else:
-      return gyp_defines()['OS']
-  elif IsWindows():
-    return 'win'
-  elif IsLinux():
-    return 'linux'
-  else:
-    return 'mac'
-
-
-@memoize()
-def builder():
-  """
-  Returns a string representing the build engine (not compiler) to use.
-  Possible values: 'make', 'ninja', 'xcode', 'msvs', 'scons'
-  """
-  if 'GYP_GENERATORS' in os.environ:
-    # for simplicity, only support the first explicit generator
-    generator = os.environ['GYP_GENERATORS'].split(',')[0]
-    if generator.endswith('-android'):
-      return generator.split('-')[0]
-    elif generator.endswith('-ninja'):
-      return 'ninja'
-    else:
-      return generator
-  else:
-    if platform() == 'android':
-      # Good enough for now? Do any android bots use make?
-      return 'make'
-    elif platform() == 'ios':
-      return 'xcode'
-    elif IsWindows():
-      return 'msvs'
-    elif IsLinux():
-      return 'make'
-    elif IsMac():
-      return 'xcode'
-    else:
-      assert False, 'Don\'t know what builder we\'re using!'
diff --git a/deps/v8/gypfiles/landmines.py b/deps/v8/gypfiles/landmines.py
deleted file mode 100755
index 2a81c66d1a6..00000000000
--- a/deps/v8/gypfiles/landmines.py
+++ /dev/null
@@ -1,245 +0,0 @@
-#!/usr/bin/env python
-# Copyright 2014 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-"""
-This script runs every build as the first hook (See DEPS). If it detects that
-the build should be clobbered, it will delete the contents of the build
-directory.
-
-A landmine is tripped when a builder checks out a different revision, and the
-diff between the new landmines and the old ones is non-null. At this point, the
-build is clobbered.
-"""
-
-import difflib
-import errno
-import gyp_environment
-import logging
-import optparse
-import os
-import re
-import shutil
-import sys
-import subprocess
-import time
-
-import landmine_utils
-
-
-SRC_DIR = os.path.dirname(os.path.dirname(os.path.realpath(__file__)))
-
-
-def get_build_dir(build_tool, is_iphone=False):
-  """
-  Returns output directory absolute path dependent on build and targets.
-  Examples:
-    r'c:\b\build\slave\win\build\src\out'
-    '/mnt/data/b/build/slave/linux/build/src/out'
-    '/b/build/slave/ios_rel_device/build/src/xcodebuild'
-
-  Keep this function in sync with tools/build/scripts/slave/compile.py
-  """
-  ret = None
-  if build_tool == 'xcode':
-    ret = os.path.join(SRC_DIR, 'xcodebuild')
-  elif build_tool in ['make', 'ninja', 'ninja-ios']:  # TODO: Remove ninja-ios.
-    if 'CHROMIUM_OUT_DIR' in os.environ:
-      output_dir = os.environ.get('CHROMIUM_OUT_DIR').strip()
-      if not output_dir:
-        raise Error('CHROMIUM_OUT_DIR environment variable is set but blank!')
-    else:
-      output_dir = landmine_utils.gyp_generator_flags().get('output_dir', 'out')
-    ret = os.path.join(SRC_DIR, output_dir)
-  elif build_tool in ['msvs', 'vs', 'ib']:
-    ret = os.path.join(SRC_DIR, 'build')
-  else:
-    raise NotImplementedError('Unexpected GYP_GENERATORS (%s)' % build_tool)
-  return os.path.abspath(ret)
-
-
-def extract_gn_build_commands(build_ninja_file):
-  """Extracts from a build.ninja the commands to run GN.
-
-  The commands to run GN are the gn rule and build.ninja build step at the
-  top of the build.ninja file. We want to keep these when deleting GN builds
-  since we want to preserve the command-line flags to GN.
-
-  On error, returns the empty string."""
-  result = ""
-  with open(build_ninja_file, 'r') as f:
-    # Read until the second blank line. The first thing GN writes to the file
-    # is the "rule gn" and the second is the section for "build build.ninja",
-    # separated by blank lines.
-    num_blank_lines = 0
-    while num_blank_lines < 2:
-      line = f.readline()
-      if len(line) == 0:
-        return ''  # Unexpected EOF.
-      result += line
-      if line[0] == '\n':
-        num_blank_lines = num_blank_lines + 1
-  return result
-
-def delete_build_dir(build_dir):
-  # GN writes a build.ninja.d file. Note that not all GN builds have args.gn.
-  build_ninja_d_file = os.path.join(build_dir, 'build.ninja.d')
-  if not os.path.exists(build_ninja_d_file):
-    shutil.rmtree(build_dir)
-    return
-
-  # GN builds aren't automatically regenerated when you sync. To avoid
-  # messing with the GN workflow, erase everything but the args file, and
-  # write a dummy build.ninja file that will automatically rerun GN the next
-  # time Ninja is run.
-  build_ninja_file = os.path.join(build_dir, 'build.ninja')
-  build_commands = extract_gn_build_commands(build_ninja_file)
-
-  try:
-    gn_args_file = os.path.join(build_dir, 'args.gn')
-    with open(gn_args_file, 'r') as f:
-      args_contents = f.read()
-  except IOError:
-    args_contents = ''
-
-  shutil.rmtree(build_dir)
-
-  # Put back the args file (if any).
-  os.mkdir(build_dir)
-  if args_contents != '':
-    with open(gn_args_file, 'w') as f:
-      f.write(args_contents)
-
-  # Write the build.ninja file sufficiently to regenerate itself.
-  with open(os.path.join(build_dir, 'build.ninja'), 'w') as f:
-    if build_commands != '':
-      f.write(build_commands)
-    else:
-      # Couldn't parse the build.ninja file, write a default thing.
-      f.write('''rule gn
-command = gn -q gen //out/%s/
-description = Regenerating ninja files
-
-build build.ninja: gn
-generator = 1
-depfile = build.ninja.d
-''' % (os.path.split(build_dir)[1]))
-
-  # Write a .d file for the build which references a nonexistant file. This
-  # will make Ninja always mark the build as dirty.
-  with open(build_ninja_d_file, 'w') as f:
-    f.write('build.ninja: nonexistant_file.gn\n')
-
-
-def needs_clobber(landmines_path, new_landmines):
-  if os.path.exists(landmines_path):
-    with open(landmines_path, 'r') as f:
-      old_landmines = f.readlines()
-    if old_landmines != new_landmines:
-      old_date = time.ctime(os.stat(landmines_path).st_ctime)
-      diff = difflib.unified_diff(old_landmines, new_landmines,
-          fromfile='old_landmines', tofile='new_landmines',
-          fromfiledate=old_date, tofiledate=time.ctime(), n=0)
-      sys.stdout.write('Clobbering due to:\n')
-      sys.stdout.writelines(diff)
-      return True
-  else:
-    sys.stdout.write('Clobbering due to missing landmines file.\n')
-    return True
-  return False
-
-
-def clobber_if_necessary(new_landmines):
-  """Does the work of setting, planting, and triggering landmines."""
-  out_dir = get_build_dir(landmine_utils.builder())
-  landmines_path = os.path.normpath(os.path.join(out_dir, '..', '.landmines'))
-  try:
-    os.makedirs(out_dir)
-  except OSError as e:
-    if e.errno == errno.EEXIST:
-      pass
-
-  if needs_clobber(landmines_path, new_landmines):
-    # Clobber contents of build directory but not directory itself: some
-    # checkouts have the build directory mounted.
-    for f in os.listdir(out_dir):
-      path = os.path.join(out_dir, f)
-      if os.path.basename(out_dir) == 'build':
-        # Only delete build directories and files for MSVS builds as the folder
-        # shares some checked out files and directories.
-        if (os.path.isdir(path) and
-            re.search(r'(?:[Rr]elease)|(?:[Dd]ebug)', f)):
-          delete_build_dir(path)
-        elif (os.path.isfile(path) and
-              (path.endswith('.sln') or
-               path.endswith('.vcxproj') or
-               path.endswith('.vcxproj.user'))):
-          os.unlink(path)
-      else:
-        if os.path.isfile(path):
-          os.unlink(path)
-        elif os.path.isdir(path):
-          delete_build_dir(path)
-    if os.path.basename(out_dir) == 'xcodebuild':
-      # Xcodebuild puts an additional project file structure into build,
-      # while the output folder is xcodebuild.
-      project_dir = os.path.join(SRC_DIR, 'build', 'all.xcodeproj')
-      if os.path.exists(project_dir) and os.path.isdir(project_dir):
-        delete_build_dir(project_dir)
-
-  # Save current set of landmines for next time.
-  with open(landmines_path, 'w') as f:
-    f.writelines(new_landmines)
-
-
-def process_options():
-  """Returns a list of landmine emitting scripts."""
-  parser = optparse.OptionParser()
-  parser.add_option(
-      '-s', '--landmine-scripts', action='append',
-      default=[os.path.join(SRC_DIR, 'gypfiles', 'get_landmines.py')],
-      help='Path to the script which emits landmines to stdout. The target '
-           'is passed to this script via option -t. Note that an extra '
-           'script can be specified via an env var EXTRA_LANDMINES_SCRIPT.')
-  parser.add_option('-v', '--verbose', action='store_true',
-      default=('LANDMINES_VERBOSE' in os.environ),
-      help=('Emit some extra debugging information (default off). This option '
-          'is also enabled by the presence of a LANDMINES_VERBOSE environment '
-          'variable.'))
-
-  options, args = parser.parse_args()
-
-  if args:
-    parser.error('Unknown arguments %s' % args)
-
-  logging.basicConfig(
-      level=logging.DEBUG if options.verbose else logging.ERROR)
-
-  extra_script = os.environ.get('EXTRA_LANDMINES_SCRIPT')
-  if extra_script:
-    return options.landmine_scripts + [extra_script]
-  else:
-    return options.landmine_scripts
-
-
-def main():
-  landmine_scripts = process_options()
-
-  if landmine_utils.builder() in ('dump_dependency_json', 'eclipse'):
-    return 0
-
-  gyp_environment.set_environment()
-
-  landmines = []
-  for s in landmine_scripts:
-    proc = subprocess.Popen([sys.executable, s], stdout=subprocess.PIPE)
-    output, _ = proc.communicate()
-    landmines.extend([('%s\n' % l.strip()) for l in output.splitlines()])
-  clobber_if_necessary(landmines)
-
-  return 0
-
-
-if __name__ == '__main__':
-  sys.exit(main())
diff --git a/deps/v8/gypfiles/mkgrokdump.gyp b/deps/v8/gypfiles/mkgrokdump.gyp
new file mode 100644
index 00000000000..75e8fc75cd6
--- /dev/null
+++ b/deps/v8/gypfiles/mkgrokdump.gyp
@@ -0,0 +1,27 @@
+# Copyright 2017 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+{
+  'variables': {
+    'v8_code': 1,
+  },
+  'includes': ['toolchain.gypi', 'features.gypi'],
+  'targets': [
+    {
+      'target_name': 'mkgrokdump',
+      'type': 'executable',
+      'dependencies': [
+        'v8.gyp:v8',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8_libplatform',
+      ],
+      'include_dirs': [
+        '..',
+      ],
+      'sources': [
+        '../test/mkgrokdump/mkgrokdump.cc',
+      ],
+    },
+  ],
+}
diff --git a/deps/v8/tools/parser-shell.gyp b/deps/v8/gypfiles/parser-shell.gyp
similarity index 89%
rename from deps/v8/tools/parser-shell.gyp
rename to deps/v8/gypfiles/parser-shell.gyp
index 9b94888edfd..464e2676ac8 100644
--- a/deps/v8/tools/parser-shell.gyp
+++ b/deps/v8/gypfiles/parser-shell.gyp
@@ -30,15 +30,15 @@
     'v8_code': 1,
     'v8_enable_i18n_support%': 1,
   },
-  'includes': ['../gypfiles/toolchain.gypi', '../gypfiles/features.gypi'],
+  'includes': ['toolchain.gypi', 'features.gypi'],
   'targets': [
     {
       'target_name': 'parser-shell',
       'type': 'executable',
       'dependencies': [
-        '../src/v8.gyp:v8',
-        '../src/v8.gyp:v8_libbase',
-        '../src/v8.gyp:v8_libplatform',
+        'v8.gyp:v8',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8_libplatform',
       ],
       'conditions': [
         ['v8_enable_i18n_support==1', {
@@ -52,8 +52,8 @@
         '..',
       ],
       'sources': [
-        'parser-shell.cc',
-        'shell-utils.h',
+        '../tools/parser-shell.cc',
+        '../tools/shell-utils.h',
       ],
     },
   ],
diff --git a/deps/v8/gypfiles/run-tests-legacy.py b/deps/v8/gypfiles/run-tests-legacy.py
old mode 100755
new mode 100644
diff --git a/deps/v8/gypfiles/samples.gyp b/deps/v8/gypfiles/samples.gyp
new file mode 100644
index 00000000000..9080c0d445d
--- /dev/null
+++ b/deps/v8/gypfiles/samples.gyp
@@ -0,0 +1,61 @@
+# Copyright 2012 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+{
+  'variables': {
+    'v8_code': 1,
+    'v8_enable_i18n_support%': 1,
+    'v8_toolset_for_shell%': 'target',
+  },
+  'includes': ['toolchain.gypi', 'features.gypi'],
+  'target_defaults': {
+    'type': 'executable',
+    'dependencies': [
+      'v8.gyp:v8',
+      'v8.gyp:v8_libbase',
+      'v8.gyp:v8_libplatform',
+    ],
+    'include_dirs': [
+      '..',
+    ],
+    'conditions': [
+      ['v8_enable_i18n_support==1', {
+        'dependencies': [
+          '<(icu_gyp_path):icui18n',
+          '<(icu_gyp_path):icuuc',
+        ],
+      }],
+      ['OS=="win" and v8_enable_i18n_support==1', {
+        'dependencies': [
+          '<(icu_gyp_path):icudata',
+        ],
+      }],
+    ],
+  },
+  'targets': [
+    {
+      'target_name': 'v8_shell',
+      'sources': [
+        '../samples/shell.cc',
+      ],
+      'conditions': [
+        [ 'want_separate_host_toolset==1', {
+          'toolsets': [ '<(v8_toolset_for_shell)', ],
+        }],
+      ],
+    },
+    {
+      'target_name': 'hello-world',
+      'sources': [
+        '../samples/hello-world.cc',
+      ],
+    },
+    {
+      'target_name': 'process',
+      'sources': [
+        '../samples/process.cc',
+      ],
+    },
+  ],
+}
diff --git a/deps/v8/gypfiles/sysroot_ld_flags.sh b/deps/v8/gypfiles/sysroot_ld_flags.sh
old mode 100755
new mode 100644
diff --git a/deps/v8/gypfiles/toolchain.gypi b/deps/v8/gypfiles/toolchain.gypi
index 80844cecc67..e67a5e22b96 100644
--- a/deps/v8/gypfiles/toolchain.gypi
+++ b/deps/v8/gypfiles/toolchain.gypi
@@ -58,6 +58,9 @@
     # Similar to the ARM hard float ABI but on MIPS.
     'v8_use_mips_abi_hardfloat%': 'true',
 
+    # MIPS MSA support
+    'mips_use_msa%': 0,
+
     # Print to stdout on Android.
     'v8_android_log_stdout%': 0,
 
@@ -439,6 +442,9 @@
                     'cflags': ['-mips32r6'],
                     'ldflags': ['-mips32r6'],
                   }],
+                  ['mips_arch_variant=="r6" and mips_use_msa==1', {
+                    'defines': [ '_MIPS_MSA' ],
+                  }],
                   ['mips_arch_variant=="r2"', {
                     'conditions': [
                       [ 'mips_fpu_mode=="fp64"', {
@@ -507,6 +513,9 @@
                       'FPU_MODE_FP64',
                     ],
                   }],
+                  ['mips_arch_variant=="r6" and mips_use_msa==1', {
+                    'defines': [ '_MIPS_MSA' ],
+                  }],
                   ['mips_arch_variant=="r2"', {
                     'conditions': [
                       [ 'mips_fpu_mode=="fp64"', {
@@ -558,6 +567,9 @@
                   'FPU_MODE_FP64',
                 ],
               }],
+              ['mips_arch_variant=="r6" and mips_use_msa==1', {
+                'defines': [ '_MIPS_MSA' ],
+              }],
               ['mips_arch_variant=="r2"', {
                 'conditions': [
                   ['mips_fpu_mode=="fp64"', {
@@ -640,6 +652,9 @@
                     'cflags': ['-mips32r6'],
                     'ldflags': ['-mips32r6'],
                   }],
+                  ['mips_arch_variant=="r6" and mips_use_msa==1', {
+                    'defines': [ '_MIPS_MSA' ],
+                  }],
                   ['mips_arch_variant=="r2"', {
                     'conditions': [
                       [ 'mips_fpu_mode=="fp64"', {
@@ -721,6 +736,9 @@
                       'FPU_MODE_FP64',
                     ],
                   }],
+                  ['mips_arch_variant=="r6" and mips_use_msa==1', {
+                    'defines': [ '_MIPS_MSA' ],
+                  }],
                   ['mips_arch_variant=="r2"', {
                     'conditions': [
                       [ 'mips_fpu_mode=="fp64"', {
@@ -778,6 +796,9 @@
                   'FPU_MODE_FP64',
                 ],
               }],
+              ['mips_arch_variant=="r6" and mips_use_msa==1', {
+                'defines': [ '_MIPS_MSA' ],
+              }],
               ['mips_arch_variant=="r2"', {
                 'conditions': [
                   ['mips_fpu_mode=="fp64"', {
@@ -877,6 +898,9 @@
                     'cflags': ['-mips64r6', '-mabi=64'],
                     'ldflags': ['-mips64r6', '-mabi=64'],
                   }],
+                  ['mips_arch_variant=="r6" and mips_use_msa==1', {
+                    'defines': [ '_MIPS_MSA' ],
+                  }],
                   ['mips_arch_variant=="r2"', {
                     'defines': ['_MIPS_ARCH_MIPS64R2',],
                     'conditions': [
@@ -895,6 +919,9 @@
                   ['mips_arch_variant=="r6"', {
                     'defines': ['_MIPS_ARCH_MIPS64R6',],
                   }],
+                  ['mips_arch_variant=="r6" and mips_use_msa==1', {
+                    'defines': [ '_MIPS_MSA' ],
+                  }],
                   ['mips_arch_variant=="r2"', {
                     'defines': ['_MIPS_ARCH_MIPS64R2',],
                   }],
@@ -907,6 +934,9 @@
               ['mips_arch_variant=="r6"', {
                 'defines': ['_MIPS_ARCH_MIPS64R6',],
               }],
+              ['mips_arch_variant=="r6" and mips_use_msa==1', {
+                'defines': [ '_MIPS_MSA' ],
+              }],
               ['mips_arch_variant=="r2"', {
                 'defines': ['_MIPS_ARCH_MIPS64R2',],
               }],
@@ -1225,7 +1255,9 @@
           'OBJECT_PRINT',
           'VERIFY_HEAP',
           'DEBUG',
-          'V8_TRACE_MAPS'
+          'V8_TRACE_MAPS',
+          'V8_ENABLE_ALLOCATION_TIMEOUT',
+          'V8_ENABLE_FORCE_SLOW_PATH',
         ],
         'conditions': [
           ['OS=="linux" or OS=="freebsd" or OS=="openbsd" or OS=="netbsd" or \
diff --git a/deps/v8/gypfiles/unittests.gyp b/deps/v8/gypfiles/unittests.gyp
new file mode 100644
index 00000000000..c6d3713b0cf
--- /dev/null
+++ b/deps/v8/gypfiles/unittests.gyp
@@ -0,0 +1,287 @@
+# Copyright 2014 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# The sources are kept automatically in sync with BUILD.gn.
+
+{
+  'variables': {
+    'v8_code': 1,
+    'unittests_sources': [
+      '../test/unittests/allocation-unittest.cc',
+      '../test/unittests/api/access-check-unittest.cc',
+      '../test/unittests/api/exception-unittest.cc',
+      '../test/unittests/api/interceptor-unittest.cc',
+      '../test/unittests/api/isolate-unittest.cc',
+      '../test/unittests/api/remote-object-unittest.cc',
+      '../test/unittests/api/v8-object-unittest.cc',
+      '../test/unittests/asmjs/asm-scanner-unittest.cc',
+      '../test/unittests/asmjs/asm-types-unittest.cc',
+      '../test/unittests/asmjs/switch-logic-unittest.cc',
+      '../test/unittests/base/atomic-utils-unittest.cc',
+      '../test/unittests/base/bits-unittest.cc',
+      '../test/unittests/base/cpu-unittest.cc',
+      '../test/unittests/base/division-by-constant-unittest.cc',
+      '../test/unittests/base/flags-unittest.cc',
+      '../test/unittests/base/functional-unittest.cc',
+      '../test/unittests/base/ieee754-unittest.cc',
+      '../test/unittests/base/logging-unittest.cc',
+      '../test/unittests/base/macros-unittest.cc',
+      '../test/unittests/base/iterator-unittest.cc',
+      '../test/unittests/base/ostreams-unittest.cc',
+      '../test/unittests/base/platform/condition-variable-unittest.cc',
+      '../test/unittests/base/platform/mutex-unittest.cc',
+      '../test/unittests/base/platform/platform-unittest.cc',
+      '../test/unittests/base/platform/semaphore-unittest.cc',
+      '../test/unittests/base/platform/time-unittest.cc',
+      '../test/unittests/base/sys-info-unittest.cc',
+      '../test/unittests/base/template-utils-unittest.cc',
+      '../test/unittests/base/utils/random-number-generator-unittest.cc',
+      '../test/unittests/bigint-unittest.cc',
+      '../test/unittests/cancelable-tasks-unittest.cc',
+      '../test/unittests/char-predicates-unittest.cc',
+      "../test/unittests/code-stub-assembler-unittest.cc",
+      "../test/unittests/code-stub-assembler-unittest.h",
+      '../test/unittests/compiler/branch-elimination-unittest.cc',
+      '../test/unittests/compiler/bytecode-analysis-unittest.cc',
+      '../test/unittests/compiler/checkpoint-elimination-unittest.cc',
+      "../test/unittests/compiler/code-assembler-unittest.cc",
+      "../test/unittests/compiler/code-assembler-unittest.h",
+      '../test/unittests/compiler/common-operator-reducer-unittest.cc',
+      '../test/unittests/compiler/common-operator-unittest.cc',
+      '../test/unittests/compiler/compiler-test-utils.h',
+      '../test/unittests/compiler/control-equivalence-unittest.cc',
+      '../test/unittests/compiler/control-flow-optimizer-unittest.cc',
+      '../test/unittests/compiler/dead-code-elimination-unittest.cc',
+      '../test/unittests/compiler/diamond-unittest.cc',
+      '../test/unittests/compiler/effect-control-linearizer-unittest.cc',
+      '../test/unittests/compiler/graph-reducer-unittest.cc',
+      '../test/unittests/compiler/graph-reducer-unittest.h',
+      '../test/unittests/compiler/graph-trimmer-unittest.cc',
+      '../test/unittests/compiler/graph-unittest.cc',
+      '../test/unittests/compiler/graph-unittest.h',
+      '../test/unittests/compiler/instruction-unittest.cc',
+      '../test/unittests/compiler/instruction-selector-unittest.cc',
+      '../test/unittests/compiler/instruction-selector-unittest.h',
+      '../test/unittests/compiler/instruction-sequence-unittest.cc',
+      '../test/unittests/compiler/instruction-sequence-unittest.h',
+      '../test/unittests/compiler/int64-lowering-unittest.cc',
+      '../test/unittests/compiler/js-builtin-reducer-unittest.cc',
+      '../test/unittests/compiler/js-create-lowering-unittest.cc',
+      '../test/unittests/compiler/js-intrinsic-lowering-unittest.cc',
+      '../test/unittests/compiler/js-operator-unittest.cc',
+      '../test/unittests/compiler/js-typed-lowering-unittest.cc',
+      '../test/unittests/compiler/linkage-tail-call-unittest.cc',
+      '../test/unittests/compiler/live-range-builder.h',
+      '../test/unittests/compiler/regalloc/live-range-unittest.cc',
+      '../test/unittests/compiler/load-elimination-unittest.cc',
+      '../test/unittests/compiler/loop-peeling-unittest.cc',
+      '../test/unittests/compiler/machine-operator-reducer-unittest.cc',
+      '../test/unittests/compiler/machine-operator-unittest.cc',
+      '../test/unittests/compiler/regalloc/move-optimizer-unittest.cc',
+      '../test/unittests/compiler/node-cache-unittest.cc',
+      '../test/unittests/compiler/node-matchers-unittest.cc',
+      '../test/unittests/compiler/node-properties-unittest.cc',
+      '../test/unittests/compiler/node-test-utils.cc',
+      '../test/unittests/compiler/node-test-utils.h',
+      '../test/unittests/compiler/node-unittest.cc',
+      '../test/unittests/compiler/opcodes-unittest.cc',
+      '../test/unittests/compiler/persistent-unittest.cc',
+      '../test/unittests/compiler/regalloc/register-allocator-unittest.cc',
+      '../test/unittests/compiler/schedule-unittest.cc',
+      '../test/unittests/compiler/scheduler-unittest.cc',
+      '../test/unittests/compiler/scheduler-rpo-unittest.cc',
+      '../test/unittests/compiler/simplified-lowering-unittest.cc',
+      '../test/unittests/compiler/simplified-operator-reducer-unittest.cc',
+      '../test/unittests/compiler/simplified-operator-unittest.cc',
+      '../test/unittests/compiler/state-values-utils-unittest.cc',
+      '../test/unittests/compiler/typed-optimization-unittest.cc',
+      '../test/unittests/compiler/typer-unittest.cc',
+      '../test/unittests/compiler/value-numbering-reducer-unittest.cc',
+      '../test/unittests/compiler/zone-stats-unittest.cc',
+      '../test/unittests/compiler-dispatcher/compiler-dispatcher-tracer-unittest.cc',
+      '../test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc',
+      '../test/unittests/compiler-dispatcher/optimizing-compile-dispatcher-unittest.cc',
+      '../test/unittests/compiler-dispatcher/unoptimized-compile-job-unittest.cc',
+      '../test/unittests/counters-unittest.cc',
+      '../test/unittests/detachable-vector-unittest.cc',
+      '../test/unittests/eh-frame-iterator-unittest.cc',
+      '../test/unittests/eh-frame-writer-unittest.cc',
+      '../test/unittests/heap/barrier-unittest.cc',
+      '../test/unittests/heap/bitmap-unittest.cc',
+      '../test/unittests/heap/embedder-tracing-unittest.cc',
+      '../test/unittests/heap/gc-idle-time-handler-unittest.cc',
+      '../test/unittests/heap/gc-tracer-unittest.cc',
+      '../test/unittests/heap/item-parallel-job-unittest.cc',
+      '../test/unittests/heap/marking-unittest.cc',
+      '../test/unittests/heap/memory-reducer-unittest.cc',
+      '../test/unittests/heap/object-stats-unittest.cc',
+      '../test/unittests/heap/heap-unittest.cc',
+      '../test/unittests/heap/scavenge-job-unittest.cc',
+      '../test/unittests/heap/slot-set-unittest.cc',
+      '../test/unittests/heap/spaces-unittest.cc',
+      '../test/unittests/heap/unmapper-unittest.cc',
+      '../test/unittests/heap/worklist-unittest.cc',
+      '../test/unittests/interpreter/bytecodes-unittest.cc',
+      '../test/unittests/interpreter/bytecode-array-builder-unittest.cc',
+      '../test/unittests/interpreter/bytecode-array-iterator-unittest.cc',
+      '../test/unittests/interpreter/bytecode-array-random-iterator-unittest.cc',
+      '../test/unittests/interpreter/bytecode-array-writer-unittest.cc',
+      '../test/unittests/interpreter/bytecode-decoder-unittest.cc',
+      '../test/unittests/interpreter/bytecode-node-unittest.cc',
+      '../test/unittests/interpreter/bytecode-operands-unittest.cc',
+      '../test/unittests/interpreter/bytecode-register-allocator-unittest.cc',
+      '../test/unittests/interpreter/bytecode-register-optimizer-unittest.cc',
+      '../test/unittests/interpreter/bytecode-source-info-unittest.cc',
+      '../test/unittests/interpreter/bytecode-utils.h',
+      '../test/unittests/interpreter/constant-array-builder-unittest.cc',
+      '../test/unittests/interpreter/interpreter-assembler-unittest.cc',
+      '../test/unittests/interpreter/interpreter-assembler-unittest.h',
+      '../test/unittests/libplatform/default-platform-unittest.cc',
+      '../test/unittests/libplatform/task-queue-unittest.cc',
+      '../test/unittests/libplatform/worker-thread-unittest.cc',
+      '../test/unittests/locked-queue-unittest.cc',
+      '../test/unittests/object-unittest.cc',
+      '../test/unittests/parser/ast-value-unittest.cc',
+      '../test/unittests/parser/preparser-unittest.cc',
+      '../test/unittests/register-configuration-unittest.cc',
+      '../test/unittests/run-all-unittests.cc',
+      '../test/unittests/source-position-table-unittest.cc',
+      '../test/unittests/test-helpers.cc',
+      '../test/unittests/test-helpers.h',
+      '../test/unittests/test-utils.h',
+      '../test/unittests/test-utils.cc',
+      '../test/unittests/unicode-unittest.cc',
+      '../test/unittests/utils-unittest.cc',
+      '../test/unittests/value-serializer-unittest.cc',
+      '../test/unittests/zone/segmentpool-unittest.cc',
+      '../test/unittests/zone/zone-allocator-unittest.cc',
+      '../test/unittests/zone/zone-chunk-list-unittest.cc',
+      '../test/unittests/zone/zone-unittest.cc',
+      '../test/unittests/wasm/control-transfer-unittest.cc',
+      '../test/unittests/wasm/decoder-unittest.cc',
+      '../test/unittests/wasm/function-body-decoder-unittest.cc',
+      '../test/unittests/wasm/wasm-code-manager-unittest.cc',
+      '../test/unittests/wasm/leb-helper-unittest.cc',
+      '../test/unittests/wasm/loop-assignment-analysis-unittest.cc',
+      '../test/unittests/wasm/module-decoder-unittest.cc',
+      '../test/unittests/wasm/streaming-decoder-unittest.cc',
+      '../test/unittests/wasm/trap-handler-unittest.cc',
+      '../test/unittests/wasm/wasm-macro-gen-unittest.cc',
+      '../test/unittests/wasm/wasm-module-builder-unittest.cc',
+      '../test/unittests/wasm/wasm-opcodes-unittest.cc',
+    ],
+    'unittests_sources_arm': [
+      '../test/unittests/compiler/arm/instruction-selector-arm-unittest.cc',
+    ],
+    'unittests_sources_arm64': [
+      '../test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc',
+    ],
+    'unittests_sources_ia32': [
+      '../test/unittests/compiler/ia32/instruction-selector-ia32-unittest.cc',
+    ],
+    'unittests_sources_mips': [
+      '../test/unittests/compiler/mips/instruction-selector-mips-unittest.cc',
+    ],
+    'unittests_sources_mips64': [
+      '../test/unittests/compiler/mips64/instruction-selector-mips64-unittest.cc',
+    ],
+    'unittests_sources_x64': [
+      '../test/unittests/compiler/x64/instruction-selector-x64-unittest.cc',
+    ],
+    'unittests_sources_ppc': [
+      '../test/unittests/compiler/ppc/instruction-selector-ppc-unittest.cc',
+    ],
+    'unittests_sources_s390': [
+      '../test/unittests/compiler/s390/instruction-selector-s390-unittest.cc',
+    ],
+  },
+  'includes': ['toolchain.gypi', 'features.gypi'],
+  'targets': [
+    {
+      'target_name': 'unittests',
+      'type': 'executable',
+      'variables': {
+        'optimize': 'max',
+      },
+      'dependencies': [
+        'gmock.gyp:gmock',
+        'gtest.gyp:gtest',
+        'v8.gyp:v8',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8_libplatform',
+        'v8.gyp:v8_maybe_snapshot',
+      ],
+      'include_dirs': [
+        '..',
+      ],
+      'sources': [
+        '<@(unittests_sources)',
+      ],
+      'conditions': [
+        ['v8_target_arch=="arm"', {
+          'sources': [
+            '<@(unittests_sources_arm)',
+          ],
+        }],
+        ['v8_target_arch=="arm64"', {
+          'sources': [
+            '<@(unittests_sources_arm64)',
+          ],
+        }],
+        ['v8_target_arch=="ia32"', {
+          'sources': [
+            '<@(unittests_sources_ia32)',
+          ],
+        }],
+        ['v8_target_arch=="mips"', {
+          'sources': [
+            '<@(unittests_sources_mips)',
+          ],
+        }],
+        ['v8_target_arch=="mipsel"', {
+          'sources': [
+            '<@(unittests_sources_mips)',
+          ],
+        }],
+        ['v8_target_arch=="mips64"', {
+          'sources': [
+            '<@(unittests_sources_mips64)',
+          ],
+        }],
+        ['v8_target_arch=="mips64el"', {
+          'sources': [
+            '<@(unittests_sources_mips64)',
+          ],
+        }],
+        ['v8_target_arch=="x64"', {
+          'sources': [
+            '<@(unittests_sources_x64)',
+          ],
+        }],
+        ['v8_target_arch=="ppc" or v8_target_arch=="ppc64"', {
+          'sources': [
+            '<@(unittests_sources_ppc)',
+          ],
+        }],
+        ['v8_target_arch=="s390" or v8_target_arch=="s390x"', {
+          'sources': [
+            '<@(unittests_sources_s390)',
+          ],
+        }],
+        ['OS=="aix"', {
+          'ldflags': [ '-Wl,-bbigtoc' ],
+        }],
+        ['v8_enable_i18n_support==1', {
+          'dependencies': [
+            '<(icu_gyp_path):icui18n',
+            '<(icu_gyp_path):icuuc',
+          ],
+        }],
+        ['v8_use_snapshot=="true"', {
+          'dependencies': ['v8.gyp:v8_initializers'],
+        }],
+      ],
+    },
+  ],
+}
diff --git a/deps/v8/gypfiles/v8.gyp b/deps/v8/gypfiles/v8.gyp
new file mode 100644
index 00000000000..2e840eb86ea
--- /dev/null
+++ b/deps/v8/gypfiles/v8.gyp
@@ -0,0 +1,2622 @@
+# Copyright 2012 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+{
+  'variables': {
+    'v8_code': 1,
+    'v8_random_seed%': 314159265,
+    'v8_vector_stores%': 0,
+    'embed_script%': "",
+    'warmup_script%': "",
+    'v8_extra_library_files%': [],
+    'v8_experimental_extra_library_files%': [],
+    'mksnapshot_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mksnapshot<(EXECUTABLE_SUFFIX)',
+    'v8_os_page_size%': 0,
+  },
+  'includes': ['toolchain.gypi', 'features.gypi', 'inspector.gypi'],
+  'targets': [
+    {
+      'target_name': 'v8',
+      'dependencies_traverse': 1,
+      'dependencies': ['v8_maybe_snapshot', 'v8_dump_build_config#target'],
+      'conditions': [
+        ['want_separate_host_toolset==1', {
+          'toolsets': ['host', 'target'],
+        }, {
+          'toolsets': ['target'],
+        }],
+        ['component=="shared_library"', {
+          'type': '<(component)',
+          'sources': [
+            # Note: on non-Windows we still build this file so that gyp
+            # has some sources to link into the component.
+            '../src/v8dll-main.cc',
+          ],
+          'include_dirs': [
+            '..',
+          ],
+          'defines': [
+            'BUILDING_V8_SHARED',
+          ],
+          'direct_dependent_settings': {
+            'defines': [
+              'USING_V8_SHARED',
+            ],
+          },
+          'conditions': [
+            ['OS=="mac"', {
+              'xcode_settings': {
+                'OTHER_LDFLAGS': ['-dynamiclib', '-all_load']
+              },
+            }],
+            ['soname_version!=""', {
+              'product_extension': 'so.<(soname_version)',
+            }],
+          ],
+        },
+        {
+          'type': 'none',
+        }],
+      ],
+      'direct_dependent_settings': {
+        'include_dirs': [
+          '../include/',
+        ],
+      },
+    },
+    {
+      # This rule delegates to either v8_snapshot, v8_nosnapshot, or
+      # v8_external_snapshot, depending on the current variables.
+      # The intention is to make the 'calling' rules a bit simpler.
+      'target_name': 'v8_maybe_snapshot',
+      'type': 'none',
+      'conditions': [
+        ['v8_use_snapshot!="true"', {
+          # The dependency on v8_base should come from a transitive
+          # dependency however the Android toolchain requires libv8_base.a
+          # to appear before libv8_snapshot.a so it's listed explicitly.
+          'dependencies': ['v8_base', 'v8_init', 'v8_nosnapshot'],
+        }],
+        ['v8_use_snapshot=="true" and v8_use_external_startup_data==0', {
+          # The dependency on v8_base should come from a transitive
+          # dependency however the Android toolchain requires libv8_base.a
+          # to appear before libv8_snapshot.a so it's listed explicitly.
+          'dependencies': ['v8_base', 'v8_snapshot'],
+        }],
+        ['v8_use_snapshot=="true" and v8_use_external_startup_data==1 and want_separate_host_toolset==0', {
+          'dependencies': ['v8_base', 'v8_external_snapshot'],
+          'inputs': [ '<(PRODUCT_DIR)/snapshot_blob.bin', ],
+        }],
+        ['v8_use_snapshot=="true" and v8_use_external_startup_data==1 and want_separate_host_toolset==1', {
+          'dependencies': ['v8_base', 'v8_external_snapshot'],
+          'target_conditions': [
+            ['_toolset=="host"', {
+              'inputs': [
+                '<(PRODUCT_DIR)/snapshot_blob_host.bin',
+              ],
+            }, {
+              'inputs': [
+                '<(PRODUCT_DIR)/snapshot_blob.bin',
+              ],
+            }],
+          ],
+        }],
+        ['want_separate_host_toolset==1', {
+          'toolsets': ['host', 'target'],
+        }, {
+          'toolsets': ['target'],
+        }],
+      ]
+    },
+    {
+      'target_name': 'v8_init',
+      'type': 'static_library',
+      'dependencies': [
+        'v8_initializers',
+      ],
+      'variables': {
+        'optimize': 'max',
+      },
+      'include_dirs+': [
+        '..',
+        '../include/',
+      ],
+      'sources': [
+        '../src/setup-isolate-full.cc',
+      ],
+      'conditions': [
+        ['want_separate_host_toolset==1', {
+          'toolsets': ['host', 'target'],
+        }, {
+          'toolsets': ['target'],
+        }],
+      ],
+    },
+    {
+      'target_name': 'v8_initializers',
+      'type': 'static_library',
+      'dependencies': [
+        'v8_base',
+      ],
+       'variables': {
+        'optimize': 'max',
+      },
+      'include_dirs+': [
+        '..',
+        '../include/',
+      ],
+      'sources': [
+        '../src/builtins/builtins-arguments-gen.cc',
+        '../src/builtins/builtins-arguments-gen.h',
+        '../src/builtins/builtins-array-gen.cc',
+        '../src/builtins/builtins-array-gen.h',
+        '../src/builtins/builtins-async-function-gen.cc',
+        '../src/builtins/builtins-async-gen.cc',
+        '../src/builtins/builtins-async-gen.h',
+        '../src/builtins/builtins-async-generator-gen.cc',
+        '../src/builtins/builtins-async-iterator-gen.cc',
+        '../src/builtins/builtins-boolean-gen.cc',
+        '../src/builtins/builtins-call-gen.cc',
+        '../src/builtins/builtins-call-gen.h',
+        '../src/builtins/builtins-collections-gen.cc',
+        '../src/builtins/builtins-console-gen.cc',
+        '../src/builtins/builtins-constructor-gen.cc',
+        '../src/builtins/builtins-constructor-gen.h',
+        '../src/builtins/builtins-constructor.h',
+        '../src/builtins/builtins-conversion-gen.cc',
+        '../src/builtins/builtins-date-gen.cc',
+        '../src/builtins/builtins-debug-gen.cc',
+        '../src/builtins/builtins-function-gen.cc',
+        '../src/builtins/builtins-generator-gen.cc',
+        '../src/builtins/builtins-global-gen.cc',
+        '../src/builtins/builtins-handler-gen.cc',
+        '../src/builtins/builtins-ic-gen.cc',
+        '../src/builtins/builtins-internal-gen.cc',
+        '../src/builtins/builtins-interpreter-gen.cc',
+        '../src/builtins/builtins-intl-gen.cc',
+        '../src/builtins/builtins-iterator-gen.h',
+        '../src/builtins/builtins-iterator-gen.cc',
+        '../src/builtins/builtins-math-gen.cc',
+        '../src/builtins/builtins-math-gen.h',
+        '../src/builtins/builtins-number-gen.cc',
+        '../src/builtins/builtins-object-gen.cc',
+        '../src/builtins/builtins-promise-gen.cc',
+        '../src/builtins/builtins-promise-gen.h',
+        '../src/builtins/builtins-proxy-gen.cc',
+        '../src/builtins/builtins-proxy-gen.h',
+        '../src/builtins/builtins-reflect-gen.cc',
+        '../src/builtins/builtins-regexp-gen.cc',
+        '../src/builtins/builtins-regexp-gen.h',
+        '../src/builtins/builtins-sharedarraybuffer-gen.cc',
+        '../src/builtins/builtins-string-gen.cc',
+        '../src/builtins/builtins-string-gen.h',
+        '../src/builtins/builtins-symbol-gen.cc',
+        '../src/builtins/builtins-typedarray-gen.cc',
+        '../src/builtins/builtins-typedarray-gen.h',
+        '../src/builtins/builtins-utils-gen.h',
+        '../src/builtins/builtins-wasm-gen.cc',
+        '../src/builtins/growable-fixed-array-gen.cc',
+        '../src/builtins/growable-fixed-array-gen.h',
+        '../src/builtins/setup-builtins-internal.cc',
+        '../src/heap/setup-heap-internal.cc',
+        '../src/ic/accessor-assembler.cc',
+        '../src/ic/accessor-assembler.h',
+        '../src/ic/binary-op-assembler.cc',
+        '../src/ic/binary-op-assembler.h',
+        '../src/ic/keyed-store-generic.cc',
+        '../src/ic/keyed-store-generic.h',
+        '../src/interpreter/interpreter-assembler.cc',
+        '../src/interpreter/interpreter-assembler.h',
+        '../src/interpreter/interpreter-generator.cc',
+        '../src/interpreter/interpreter-generator.h',
+        '../src/interpreter/interpreter-intrinsics-generator.cc',
+        '../src/interpreter/interpreter-intrinsics-generator.h',
+        '../src/interpreter/setup-interpreter-internal.cc',
+        '../src/interpreter/setup-interpreter.h',
+      ],
+      'conditions': [
+        ['want_separate_host_toolset==1', {
+          'toolsets': ['host', 'target'],
+        }, {
+          'toolsets': ['target'],
+        }],
+        ['v8_target_arch=="ia32"', {
+          'sources': [
+            '../src/builtins/ia32/builtins-ia32.cc',
+          ],
+        }],
+        ['v8_target_arch=="x64"', {
+          'sources': [
+            '../src/builtins/x64/builtins-x64.cc',
+          ],
+        }],
+        ['v8_target_arch=="arm"', {
+          'sources': [
+            '../src/builtins/arm/builtins-arm.cc',
+          ],
+        }],
+        ['v8_target_arch=="arm64"', {
+          'sources': [
+            '../src/builtins/arm64/builtins-arm64.cc',
+          ],
+        }],
+        ['v8_target_arch=="mips" or v8_target_arch=="mipsel"', {
+          'sources': [
+            '../src/builtins/mips/builtins-mips.cc',
+          ],
+        }],
+        ['v8_target_arch=="mips64" or v8_target_arch=="mips64el"', {
+          'sources': [
+            '../src/builtins/mips64/builtins-mips64.cc',
+          ],
+        }],
+        ['v8_target_arch=="ppc" or v8_target_arch=="ppc64"', {
+          'sources': [
+            '../src/builtins/ppc/builtins-ppc.cc',
+          ],
+        }],
+        ['v8_target_arch=="s390" or v8_target_arch=="s390x"', {
+          'sources': [
+            '../src/builtins/s390/builtins-s390.cc',
+          ],
+        }],
+        ['v8_enable_i18n_support==0', {
+          'sources!': [
+            '../src/builtins/builtins-intl-gen.cc',
+          ],
+        }],
+      ],
+    },
+    {
+      'target_name': 'v8_snapshot',
+      'type': 'static_library',
+      'conditions': [
+        ['want_separate_host_toolset==1', {
+          'toolsets': ['host', 'target'],
+          'dependencies': [
+            'mksnapshot#host',
+            'js2c#host',
+          ],
+        }, {
+          'toolsets': ['target'],
+          'dependencies': [
+            'mksnapshot',
+            'js2c',
+          ],
+        }],
+        ['component=="shared_library"', {
+          'defines': [
+            'BUILDING_V8_SHARED',
+          ],
+          'direct_dependent_settings': {
+            'defines': [
+              'USING_V8_SHARED',
+            ],
+          },
+        }],
+      ],
+      'dependencies': [
+        'v8_base',
+      ],
+      'include_dirs+': [
+        '..',
+        '<(DEPTH)',
+      ],
+      'sources': [
+        '<(SHARED_INTERMEDIATE_DIR)/libraries.cc',
+        '<(SHARED_INTERMEDIATE_DIR)/extras-libraries.cc',
+        '<(SHARED_INTERMEDIATE_DIR)/experimental-extras-libraries.cc',
+        '<(INTERMEDIATE_DIR)/snapshot.cc',
+        '../src/setup-isolate-deserialize.cc',
+      ],
+      'actions': [
+        {
+          'action_name': 'run_mksnapshot',
+          'inputs': [
+            '<(mksnapshot_exec)',
+          ],
+          'conditions': [
+            ['embed_script!=""', {
+              'inputs': [
+                '<(embed_script)',
+              ],
+            }],
+            ['warmup_script!=""', {
+              'inputs': [
+                '<(warmup_script)',
+              ],
+            }],
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/snapshot.cc',
+          ],
+          'variables': {
+            'mksnapshot_flags': [],
+            'conditions': [
+              ['v8_random_seed!=0', {
+                'mksnapshot_flags': ['--random-seed', '<(v8_random_seed)'],
+              }],
+              ['v8_vector_stores!=0', {
+                'mksnapshot_flags': ['--vector-stores'],
+              }],
+            ],
+          },
+          'action': [
+            '<(mksnapshot_exec)',
+            '<@(mksnapshot_flags)',
+            '--startup_src', '<@(INTERMEDIATE_DIR)/snapshot.cc',
+            '<(embed_script)',
+            '<(warmup_script)',
+          ],
+        },
+      ],
+    },
+    {
+      'target_name': 'v8_nosnapshot',
+      'type': 'static_library',
+      'dependencies': [
+        'v8_base',
+      ],
+      'include_dirs+': [
+        '..',
+        '<(DEPTH)',
+      ],
+      'sources': [
+        '<(SHARED_INTERMEDIATE_DIR)/libraries.cc',
+        '<(SHARED_INTERMEDIATE_DIR)/extras-libraries.cc',
+        '<(SHARED_INTERMEDIATE_DIR)/experimental-extras-libraries.cc',
+        '../src/snapshot/snapshot-empty.cc',
+      ],
+      'conditions': [
+        ['want_separate_host_toolset==1', {
+          'toolsets': ['host', 'target'],
+          'dependencies': ['js2c#host'],
+        }, {
+          'toolsets': ['target'],
+          'dependencies': ['js2c'],
+        }],
+        ['component=="shared_library"', {
+          'defines': [
+            'BUILDING_V8_SHARED',
+          ],
+        }],
+      ]
+    },
+    {
+      'target_name': 'v8_external_snapshot',
+      'type': 'static_library',
+      'conditions': [
+        [ 'v8_use_external_startup_data==1', {
+          'conditions': [
+            ['want_separate_host_toolset==1', {
+              'toolsets': ['host', 'target'],
+              'dependencies': [
+                'mksnapshot#host',
+                'js2c#host',
+                'natives_blob',
+            ]}, {
+              'toolsets': ['target'],
+              'dependencies': [
+                'mksnapshot',
+                'js2c',
+                'natives_blob',
+              ],
+            }],
+            ['component=="shared_library"', {
+              'defines': [
+                'BUILDING_V8_SHARED',
+              ],
+              'direct_dependent_settings': {
+                'defines': [
+                  'USING_V8_SHARED',
+                ],
+              },
+            }],
+          ],
+          'dependencies': [
+            'v8_base',
+          ],
+          'include_dirs+': [
+            '..',
+            '<(DEPTH)',
+          ],
+          'sources': [
+            '../src/setup-isolate-deserialize.cc',
+            '../src/snapshot/natives-external.cc',
+            '../src/snapshot/snapshot-external.cc',
+          ],
+          'actions': [
+            {
+              'action_name': 'run_mksnapshot (external)',
+              'inputs': [
+                '<(mksnapshot_exec)',
+              ],
+              'variables': {
+                'mksnapshot_flags': [],
+                'conditions': [
+                  ['v8_random_seed!=0', {
+                    'mksnapshot_flags': ['--random-seed', '<(v8_random_seed)'],
+                  }],
+                  ['v8_vector_stores!=0', {
+                    'mksnapshot_flags': ['--vector-stores'],
+                  }],
+                  ['v8_os_page_size!=0', {
+                    'mksnapshot_flags': ['--v8_os_page_size', '<(v8_os_page_size)'],
+                  }],
+                ],
+              },
+              'conditions': [
+                ['embed_script!=""', {
+                  'inputs': [
+                    '<(embed_script)',
+                  ],
+                }],
+                ['warmup_script!=""', {
+                  'inputs': [
+                    '<(warmup_script)',
+                  ],
+                }],
+                ['want_separate_host_toolset==1', {
+                  'target_conditions': [
+                    ['_toolset=="host"', {
+                      'outputs': [
+                        '<(PRODUCT_DIR)/snapshot_blob_host.bin',
+                      ],
+                      'action': [
+                        '<(mksnapshot_exec)',
+                        '<@(mksnapshot_flags)',
+                        '--startup_blob', '<(PRODUCT_DIR)/snapshot_blob_host.bin',
+                        '<(embed_script)',
+                        '<(warmup_script)',
+                      ],
+                    }, {
+                      'outputs': [
+                        '<(PRODUCT_DIR)/snapshot_blob.bin',
+                      ],
+                      'action': [
+                        '<(mksnapshot_exec)',
+                        '<@(mksnapshot_flags)',
+                        '--startup_blob', '<(PRODUCT_DIR)/snapshot_blob.bin',
+                        '<(embed_script)',
+                        '<(warmup_script)',
+                      ],
+                    }],
+                  ],
+                }, {
+                  'outputs': [
+                    '<(PRODUCT_DIR)/snapshot_blob.bin',
+                  ],
+                  'action': [
+                    '<(mksnapshot_exec)',
+                    '<@(mksnapshot_flags)',
+                    '--startup_blob', '<(PRODUCT_DIR)/snapshot_blob.bin',
+                    '<(embed_script)',
+                    '<(warmup_script)',
+                  ],
+                }],
+              ],
+            },
+          ],
+        }],
+      ],
+    },
+    {
+      'target_name': 'v8_base',
+      'type': 'static_library',
+      'dependencies': [
+        'v8_libbase',
+        'v8_libsampler',
+        'inspector.gyp:protocol_generated_sources#target',
+        'inspector.gyp:inspector_injected_script#target',
+      ],
+      'objs': ['foo.o'],
+      'variables': {
+        'optimize': 'max',
+      },
+      'include_dirs+': [
+        '..',
+        '<(DEPTH)',
+        '<(SHARED_INTERMEDIATE_DIR)'
+      ],
+      'sources': [
+        '<@(inspector_all_sources)',
+        '../include//v8-debug.h',
+        '../include//v8-platform.h',
+        '../include//v8-profiler.h',
+        '../include//v8-testing.h',
+        '../include//v8-util.h',
+        '../include//v8-value-serializer-version.h',
+        '../include//v8-version-string.h',
+        '../include//v8-version.h',
+        '../include//v8.h',
+        '../include//v8config.h',
+        '../src/accessors.cc',
+        '../src/accessors.h',
+        '../src/address-map.cc',
+        '../src/address-map.h',
+        '../src/allocation.cc',
+        '../src/allocation.h',
+        '../src/allocation-site-scopes.h',
+        '../src/api.cc',
+        '../src/api.h',
+        '../src/api-arguments-inl.h',
+        '../src/api-arguments.cc',
+        '../src/api-arguments.h',
+        '../src/api-natives.cc',
+        '../src/api-natives.h',
+        '../src/arguments.cc',
+        '../src/arguments.h',
+        '../src/asmjs/asm-js.cc',
+        '../src/asmjs/asm-js.h',
+        '../src/asmjs/asm-names.h',
+        '../src/asmjs/asm-parser.cc',
+        '../src/asmjs/asm-parser.h',
+        '../src/asmjs/asm-scanner.cc',
+        '../src/asmjs/asm-scanner.h',
+        '../src/asmjs/asm-types.cc',
+        '../src/asmjs/asm-types.h',
+        '../src/asmjs/switch-logic.h',
+        '../src/asmjs/switch-logic.cc',
+        '../src/assembler.cc',
+        '../src/assembler.h',
+        '../src/assembler-inl.h',
+        '../src/assert-scope.h',
+        '../src/assert-scope.cc',
+        '../src/ast/ast-function-literal-id-reindexer.cc',
+        '../src/ast/ast-function-literal-id-reindexer.h',
+        '../src/ast/ast-source-ranges.h',
+        '../src/ast/ast-traversal-visitor.h',
+        '../src/ast/ast-value-factory.cc',
+        '../src/ast/ast-value-factory.h',
+        '../src/ast/ast.cc',
+        '../src/ast/ast.h',
+        '../src/ast/compile-time-value.cc',
+        '../src/ast/compile-time-value.h',
+        '../src/ast/context-slot-cache.cc',
+        '../src/ast/context-slot-cache.h',
+        '../src/ast/modules.cc',
+        '../src/ast/modules.h',
+        '../src/ast/prettyprinter.cc',
+        '../src/ast/prettyprinter.h',
+        '../src/ast/scopes.cc',
+        '../src/ast/scopes.h',
+        '../src/ast/variables.cc',
+        '../src/ast/variables.h',
+        '../src/bailout-reason.cc',
+        '../src/bailout-reason.h',
+        '../src/basic-block-profiler.cc',
+        '../src/basic-block-profiler.h',
+        '../src/bignum-dtoa.cc',
+        '../src/bignum-dtoa.h',
+        '../src/bignum.cc',
+        '../src/bignum.h',
+        '../src/bit-vector.cc',
+        '../src/bit-vector.h',
+        '../src/bootstrapper.cc',
+        '../src/bootstrapper.h',
+        '../src/boxed-float.h',
+        '../src/builtins/builtins-api.cc',
+        '../src/builtins/builtins-arraybuffer.cc',
+        '../src/builtins/builtins-array.cc',
+        '../src/builtins/builtins-bigint.cc',
+        '../src/builtins/builtins-boolean.cc',
+        '../src/builtins/builtins-call.cc',
+        '../src/builtins/builtins-callsite.cc',
+        '../src/builtins/builtins-collections.cc',
+        '../src/builtins/builtins-console.cc',
+        '../src/builtins/builtins-constructor.h',
+        '../src/builtins/builtins-dataview.cc',
+        '../src/builtins/builtins-date.cc',
+        '../src/builtins/builtins-definitions.h',
+        '../src/builtins/builtins-descriptors.h',
+        '../src/builtins/builtins-error.cc',
+        '../src/builtins/builtins-function.cc',
+        '../src/builtins/builtins-global.cc',
+        '../src/builtins/builtins-internal.cc',
+        '../src/builtins/builtins-interpreter.cc',
+        '../src/builtins/builtins-json.cc',
+        '../src/builtins/builtins-math.cc',
+        '../src/builtins/builtins-number.cc',
+        '../src/builtins/builtins-object.cc',
+        '../src/builtins/builtins-promise.cc',
+        '../src/builtins/builtins-reflect.cc',
+        '../src/builtins/builtins-regexp.cc',
+        '../src/builtins/builtins-sharedarraybuffer.cc',
+        '../src/builtins/builtins-string.cc',
+        '../src/builtins/builtins-intl.cc',
+        '../src/builtins/builtins-intl.h',
+        '../src/builtins/builtins-symbol.cc',
+        '../src/builtins/builtins-typedarray.cc',
+        '../src/builtins/builtins-utils.h',
+        '../src/builtins/builtins.cc',
+        '../src/builtins/builtins.h',
+        '../src/builtins/constants-table-builder.cc',
+        '../src/builtins/constants-table-builder.h',
+        '../src/cached-powers.cc',
+        '../src/cached-powers.h',
+        '../src/callable.h',
+        '../src/cancelable-task.cc',
+        '../src/cancelable-task.h',
+        '../src/char-predicates.cc',
+        '../src/char-predicates-inl.h',
+        '../src/char-predicates.h',
+        '../src/checks.h',
+        '../src/code-events.h',
+        '../src/code-factory.cc',
+        '../src/code-factory.h',
+        '../src/code-stub-assembler.cc',
+        '../src/code-stub-assembler.h',
+        '../src/code-stubs.cc',
+        '../src/code-stubs.h',
+        '../src/code-stubs-utils.h',
+        '../src/codegen.cc',
+        '../src/codegen.h',
+        '../src/collector.h',
+        '../src/compilation-cache.cc',
+        '../src/compilation-cache.h',
+        '../src/compilation-dependencies.cc',
+        '../src/compilation-dependencies.h',
+        '../src/compilation-info.cc',
+        '../src/compilation-info.h',
+        '../src/compilation-statistics.cc',
+        '../src/compilation-statistics.h',
+        '../src/compiler/access-builder.cc',
+        '../src/compiler/access-builder.h',
+        '../src/compiler/access-info.cc',
+        '../src/compiler/access-info.h',
+        '../src/compiler/all-nodes.cc',
+        '../src/compiler/all-nodes.h',
+        '../src/compiler/allocation-builder.h',
+        '../src/compiler/basic-block-instrumentor.cc',
+        '../src/compiler/basic-block-instrumentor.h',
+        '../src/compiler/branch-elimination.cc',
+        '../src/compiler/branch-elimination.h',
+        '../src/compiler/bytecode-analysis.cc',
+        '../src/compiler/bytecode-analysis.h',
+        '../src/compiler/bytecode-graph-builder.cc',
+        '../src/compiler/bytecode-graph-builder.h',
+        '../src/compiler/bytecode-liveness-map.cc',
+        '../src/compiler/bytecode-liveness-map.h',
+        '../src/compiler/c-linkage.cc',
+        '../src/compiler/checkpoint-elimination.cc',
+        '../src/compiler/checkpoint-elimination.h',
+        '../src/compiler/code-generator-impl.h',
+        '../src/compiler/code-generator.cc',
+        '../src/compiler/code-generator.h',
+        '../src/compiler/code-assembler.cc',
+        '../src/compiler/code-assembler.h',
+        '../src/compiler/common-node-cache.cc',
+        '../src/compiler/common-node-cache.h',
+        '../src/compiler/common-operator-reducer.cc',
+        '../src/compiler/common-operator-reducer.h',
+        '../src/compiler/common-operator.cc',
+        '../src/compiler/common-operator.h',
+        '../src/compiler/control-equivalence.cc',
+        '../src/compiler/control-equivalence.h',
+        '../src/compiler/control-flow-optimizer.cc',
+        '../src/compiler/control-flow-optimizer.h',
+        '../src/compiler/dead-code-elimination.cc',
+        '../src/compiler/dead-code-elimination.h',
+        '../src/compiler/diamond.h',
+        '../src/compiler/effect-control-linearizer.cc',
+        '../src/compiler/effect-control-linearizer.h',
+        '../src/compiler/escape-analysis.cc',
+        '../src/compiler/escape-analysis.h',
+        '../src/compiler/escape-analysis-reducer.cc',
+        '../src/compiler/escape-analysis-reducer.h',
+        '../src/compiler/frame.cc',
+        '../src/compiler/frame.h',
+        '../src/compiler/frame-elider.cc',
+        '../src/compiler/frame-elider.h',
+        '../src/compiler/frame-states.cc',
+        '../src/compiler/frame-states.h',
+        '../src/compiler/functional-list.h',
+        '../src/compiler/gap-resolver.cc',
+        '../src/compiler/gap-resolver.h',
+        '../src/compiler/graph-assembler.cc',
+        '../src/compiler/graph-assembler.h',
+        '../src/compiler/graph-reducer.cc',
+        '../src/compiler/graph-reducer.h',
+        '../src/compiler/graph-trimmer.cc',
+        '../src/compiler/graph-trimmer.h',
+        '../src/compiler/graph-visualizer.cc',
+        '../src/compiler/graph-visualizer.h',
+        '../src/compiler/graph.cc',
+        '../src/compiler/graph.h',
+        '../src/compiler/instruction-codes.h',
+        '../src/compiler/instruction-selector-impl.h',
+        '../src/compiler/instruction-selector.cc',
+        '../src/compiler/instruction-selector.h',
+        '../src/compiler/instruction-scheduler.cc',
+        '../src/compiler/instruction-scheduler.h',
+        '../src/compiler/instruction.cc',
+        '../src/compiler/instruction.h',
+        '../src/compiler/int64-lowering.cc',
+        '../src/compiler/int64-lowering.h',
+        '../src/compiler/js-builtin-reducer.cc',
+        '../src/compiler/js-builtin-reducer.h',
+        '../src/compiler/js-call-reducer.cc',
+        '../src/compiler/js-call-reducer.h',
+        '../src/compiler/js-context-specialization.cc',
+        '../src/compiler/js-context-specialization.h',
+        '../src/compiler/js-create-lowering.cc',
+        '../src/compiler/js-create-lowering.h',
+        '../src/compiler/js-generic-lowering.cc',
+        '../src/compiler/js-generic-lowering.h',
+        '../src/compiler/js-graph.cc',
+        '../src/compiler/js-graph.h',
+        '../src/compiler/js-inlining.cc',
+        '../src/compiler/js-inlining.h',
+        '../src/compiler/js-inlining-heuristic.cc',
+        '../src/compiler/js-inlining-heuristic.h',
+        '../src/compiler/js-intrinsic-lowering.cc',
+        '../src/compiler/js-intrinsic-lowering.h',
+        '../src/compiler/js-native-context-specialization.cc',
+        '../src/compiler/js-native-context-specialization.h',
+        '../src/compiler/js-operator.cc',
+        '../src/compiler/js-operator.h',
+        '../src/compiler/js-type-hint-lowering.cc',
+        '../src/compiler/js-type-hint-lowering.h',
+        '../src/compiler/js-typed-lowering.cc',
+        '../src/compiler/js-typed-lowering.h',
+        '../src/compiler/jump-threading.cc',
+        '../src/compiler/jump-threading.h',
+        '../src/compiler/linkage.cc',
+        '../src/compiler/linkage.h',
+        '../src/compiler/live-range-separator.cc',
+        '../src/compiler/live-range-separator.h',
+        '../src/compiler/load-elimination.cc',
+        '../src/compiler/load-elimination.h',
+        '../src/compiler/loop-analysis.cc',
+        '../src/compiler/loop-analysis.h',
+        '../src/compiler/loop-peeling.cc',
+        '../src/compiler/loop-peeling.h',
+        '../src/compiler/loop-variable-optimizer.cc',
+        '../src/compiler/loop-variable-optimizer.h',
+        '../src/compiler/machine-operator-reducer.cc',
+        '../src/compiler/machine-operator-reducer.h',
+        '../src/compiler/machine-operator.cc',
+        '../src/compiler/machine-operator.h',
+        '../src/compiler/machine-graph-verifier.cc',
+        '../src/compiler/machine-graph-verifier.h',
+        '../src/compiler/memory-optimizer.cc',
+        '../src/compiler/memory-optimizer.h',
+        '../src/compiler/move-optimizer.cc',
+        '../src/compiler/move-optimizer.h',
+        '../src/compiler/node-aux-data.h',
+        '../src/compiler/node-cache.cc',
+        '../src/compiler/node-cache.h',
+        '../src/compiler/node-marker.cc',
+        '../src/compiler/node-marker.h',
+        '../src/compiler/node-matchers.cc',
+        '../src/compiler/node-matchers.h',
+        '../src/compiler/node-properties.cc',
+        '../src/compiler/node-properties.h',
+        '../src/compiler/node.cc',
+        '../src/compiler/node.h',
+        '../src/compiler/opcodes.cc',
+        '../src/compiler/opcodes.h',
+        '../src/compiler/operation-typer.cc',
+        '../src/compiler/operation-typer.h',
+        '../src/compiler/operator-properties.cc',
+        '../src/compiler/operator-properties.h',
+        '../src/compiler/operator.cc',
+        '../src/compiler/operator.h',
+        '../src/compiler/osr.cc',
+        '../src/compiler/osr.h',
+        '../src/compiler/persistent-map.h',
+        '../src/compiler/pipeline.cc',
+        '../src/compiler/pipeline.h',
+        '../src/compiler/pipeline-statistics.cc',
+        '../src/compiler/pipeline-statistics.h',
+        '../src/compiler/property-access-builder.cc',
+        '../src/compiler/property-access-builder.h',
+        '../src/compiler/raw-machine-assembler.cc',
+        '../src/compiler/raw-machine-assembler.h',
+        '../src/compiler/redundancy-elimination.cc',
+        '../src/compiler/redundancy-elimination.h',
+        '../src/compiler/register-allocator.cc',
+        '../src/compiler/register-allocator.h',
+        '../src/compiler/register-allocator-verifier.cc',
+        '../src/compiler/register-allocator-verifier.h',
+        '../src/compiler/representation-change.cc',
+        '../src/compiler/representation-change.h',
+        '../src/compiler/schedule.cc',
+        '../src/compiler/schedule.h',
+        '../src/compiler/scheduler.cc',
+        '../src/compiler/scheduler.h',
+        '../src/compiler/select-lowering.cc',
+        '../src/compiler/select-lowering.h',
+        '../src/compiler/simd-scalar-lowering.cc',
+        '../src/compiler/simd-scalar-lowering.h',
+        '../src/compiler/simplified-lowering.cc',
+        '../src/compiler/simplified-lowering.h',
+        '../src/compiler/simplified-operator-reducer.cc',
+        '../src/compiler/simplified-operator-reducer.h',
+        '../src/compiler/simplified-operator.cc',
+        '../src/compiler/simplified-operator.h',
+        '../src/compiler/compiler-source-position-table.cc',
+        '../src/compiler/compiler-source-position-table.h',
+        '../src/compiler/state-values-utils.cc',
+        '../src/compiler/state-values-utils.h',
+        '../src/compiler/store-store-elimination.cc',
+        '../src/compiler/store-store-elimination.h',
+        '../src/compiler/types.cc',
+        '../src/compiler/types.h',
+        '../src/compiler/type-cache.cc',
+        '../src/compiler/type-cache.h',
+        '../src/compiler/typed-optimization.cc',
+        '../src/compiler/typed-optimization.h',
+        '../src/compiler/typer.cc',
+        '../src/compiler/typer.h',
+        '../src/compiler/unwinding-info-writer.h',
+        '../src/compiler/value-numbering-reducer.cc',
+        '../src/compiler/value-numbering-reducer.h',
+        '../src/compiler/verifier.cc',
+        '../src/compiler/verifier.h',
+        '../src/compiler/wasm-compiler.cc',
+        '../src/compiler/wasm-compiler.h',
+        '../src/compiler/wasm-linkage.cc',
+        '../src/compiler/zone-stats.cc',
+        '../src/compiler/zone-stats.h',
+        '../src/compiler-dispatcher/compiler-dispatcher.cc',
+        '../src/compiler-dispatcher/compiler-dispatcher.h',
+        '../src/compiler-dispatcher/compiler-dispatcher-job.cc',
+        '../src/compiler-dispatcher/compiler-dispatcher-job.h',
+        '../src/compiler-dispatcher/compiler-dispatcher-tracer.cc',
+        '../src/compiler-dispatcher/compiler-dispatcher-tracer.h',
+        '../src/compiler-dispatcher/optimizing-compile-dispatcher.cc',
+        '../src/compiler-dispatcher/optimizing-compile-dispatcher.h',
+        '../src/compiler-dispatcher/unoptimized-compile-job.cc',
+        '../src/compiler-dispatcher/unoptimized-compile-job.h',
+        '../src/compiler.cc',
+        '../src/compiler.h',
+        '../src/contexts-inl.h',
+        '../src/contexts.cc',
+        '../src/contexts.h',
+        '../src/conversions-inl.h',
+        '../src/conversions.cc',
+        '../src/conversions.h',
+        '../src/counters-inl.h',
+        '../src/counters.cc',
+        '../src/counters.h',
+        '../src/date.cc',
+        '../src/date.h',
+        '../src/dateparser-inl.h',
+        '../src/dateparser.cc',
+        '../src/dateparser.h',
+        '../src/debug/debug-coverage.cc',
+        '../src/debug/debug-coverage.h',
+        '../src/debug/debug-evaluate.cc',
+        '../src/debug/debug-evaluate.h',
+        '../src/debug/debug-interface.h',
+        '../src/debug/debug-frames.cc',
+        '../src/debug/debug-frames.h',
+        '../src/debug/debug-scope-iterator.cc',
+        '../src/debug/debug-scope-iterator.h',
+        '../src/debug/debug-scopes.cc',
+        '../src/debug/debug-scopes.h',
+        '../src/debug/debug-stack-trace-iterator.cc',
+        '../src/debug/debug-stack-trace-iterator.h',
+        '../src/debug/debug-type-profile.cc',
+        '../src/debug/debug-type-profile.h',
+        '../src/debug/debug.cc',
+        '../src/debug/debug.h',
+        '../src/debug/interface-types.h',
+        '../src/debug/liveedit.cc',
+        '../src/debug/liveedit.h',
+        '../src/deoptimize-reason.cc',
+        '../src/deoptimize-reason.h',
+        '../src/deoptimizer.cc',
+        '../src/deoptimizer.h',
+        '../src/detachable-vector.h',
+        '../src/disasm.h',
+        '../src/disassembler.cc',
+        '../src/disassembler.h',
+        '../src/diy-fp.cc',
+        '../src/diy-fp.h',
+        '../src/double.h',
+        '../src/dtoa.cc',
+        '../src/dtoa.h',
+        '../src/eh-frame.cc',
+        '../src/eh-frame.h',
+        '../src/elements-kind.cc',
+        '../src/elements-kind.h',
+        '../src/elements.cc',
+        '../src/elements.h',
+        '../src/execution.cc',
+        '../src/execution.h',
+        '../src/extensions/externalize-string-extension.cc',
+        '../src/extensions/externalize-string-extension.h',
+        '../src/extensions/free-buffer-extension.cc',
+        '../src/extensions/free-buffer-extension.h',
+        '../src/extensions/gc-extension.cc',
+        '../src/extensions/gc-extension.h',
+        '../src/extensions/ignition-statistics-extension.cc',
+        '../src/extensions/ignition-statistics-extension.h',
+        '../src/extensions/statistics-extension.cc',
+        '../src/extensions/statistics-extension.h',
+        '../src/extensions/trigger-failure-extension.cc',
+        '../src/extensions/trigger-failure-extension.h',
+        '../src/external-reference-table.cc',
+        '../src/external-reference-table.h',
+        '../src/external-reference.cc',
+        '../src/external-reference.h',
+        '../src/factory-inl.h',
+        '../src/factory.cc',
+        '../src/factory.h',
+        '../src/fast-dtoa.cc',
+        '../src/fast-dtoa.h',
+        '../src/feedback-vector-inl.h',
+        '../src/feedback-vector.cc',
+        '../src/feedback-vector.h',
+        '../src/field-index.h',
+        '../src/field-index-inl.h',
+        '../src/field-type.cc',
+        '../src/field-type.h',
+        '../src/fixed-dtoa.cc',
+        '../src/fixed-dtoa.h',
+        '../src/flag-definitions.h',
+        '../src/flags.cc',
+        '../src/flags.h',
+        '../src/frame-constants.h',
+        '../src/frames-inl.h',
+        '../src/frames.cc',
+        '../src/frames.h',
+        '../src/futex-emulation.cc',
+        '../src/futex-emulation.h',
+        '../src/gdb-jit.cc',
+        '../src/gdb-jit.h',
+        '../src/global-handles.cc',
+        '../src/global-handles.h',
+        '../src/globals.h',
+        '../src/handler-table.cc',
+        '../src/handler-table.h',
+        '../src/handles-inl.h',
+        '../src/handles.cc',
+        '../src/handles.h',
+        '../src/heap-symbols.h',
+        '../src/heap/array-buffer-collector.cc',
+        '../src/heap/array-buffer-collector.h',
+        '../src/heap/array-buffer-tracker-inl.h',
+        '../src/heap/array-buffer-tracker.cc',
+        '../src/heap/array-buffer-tracker.h',
+        '../src/heap/barrier.h',
+        '../src/heap/code-stats.cc',
+        '../src/heap/code-stats.h',
+        '../src/heap/concurrent-marking.cc',
+        '../src/heap/concurrent-marking.h',
+        '../src/heap/embedder-tracing.cc',
+        '../src/heap/embedder-tracing.h',
+        '../src/heap/memory-reducer.cc',
+        '../src/heap/memory-reducer.h',
+        '../src/heap/gc-idle-time-handler.cc',
+        '../src/heap/gc-idle-time-handler.h',
+        '../src/heap/gc-tracer.cc',
+        '../src/heap/gc-tracer.h',
+        '../src/heap/heap-inl.h',
+        '../src/heap/heap.cc',
+        '../src/heap/heap.h',
+        '../src/heap/incremental-marking-inl.h',
+        '../src/heap/incremental-marking-job.cc',
+        '../src/heap/incremental-marking-job.h',
+        '../src/heap/incremental-marking.cc',
+        '../src/heap/incremental-marking.h',
+        '../src/heap/invalidated-slots-inl.h',
+        '../src/heap/invalidated-slots.cc',
+        '../src/heap/invalidated-slots.h',
+        '../src/heap/item-parallel-job.cc',
+        '../src/heap/item-parallel-job.h',
+        '../src/heap/local-allocator.h',
+        '../src/heap/mark-compact-inl.h',
+        '../src/heap/mark-compact.cc',
+        '../src/heap/mark-compact.h',
+        '../src/heap/marking.cc',
+        '../src/heap/marking.h',
+        '../src/heap/object-stats.cc',
+        '../src/heap/object-stats.h',
+        '../src/heap/objects-visiting-inl.h',
+        '../src/heap/objects-visiting.cc',
+        '../src/heap/objects-visiting.h',
+        '../src/heap/remembered-set.h',
+        '../src/heap/scavenge-job.h',
+        '../src/heap/scavenge-job.cc',
+        '../src/heap/scavenger-inl.h',
+        '../src/heap/scavenger.cc',
+        '../src/heap/scavenger.h',
+        '../src/heap/slot-set.h',
+        '../src/heap/spaces-inl.h',
+        '../src/heap/spaces.cc',
+        '../src/heap/spaces.h',
+        '../src/heap/store-buffer.cc',
+        '../src/heap/store-buffer.h',
+        '../src/heap/stress-marking-observer.cc',
+        '../src/heap/stress-marking-observer.h',
+        '../src/heap/stress-scavenge-observer.cc',
+        '../src/heap/stress-scavenge-observer.h',
+        '../src/heap/sweeper.cc',
+        '../src/heap/sweeper.h',
+        '../src/heap/worklist.h',
+        '../src/intl.cc',
+        '../src/intl.h',
+        '../src/icu_util.cc',
+        '../src/icu_util.h',
+        '../src/ic/call-optimization.cc',
+        '../src/ic/call-optimization.h',
+        '../src/ic/handler-configuration.cc',
+        '../src/ic/handler-configuration-inl.h',
+        '../src/ic/handler-configuration.h',
+        '../src/ic/ic-inl.h',
+        '../src/ic/ic-stats.cc',
+        '../src/ic/ic-stats.h',
+        '../src/ic/ic.cc',
+        '../src/ic/ic.h',
+        '../src/identity-map.cc',
+        '../src/identity-map.h',
+        '../src/instruction-stream.cc',
+        '../src/instruction-stream.h',
+        '../src/interface-descriptors.cc',
+        '../src/interface-descriptors.h',
+        '../src/interpreter/block-coverage-builder.h',
+        '../src/interpreter/bytecodes.cc',
+        '../src/interpreter/bytecodes.h',
+        '../src/interpreter/bytecode-array-accessor.cc',
+        '../src/interpreter/bytecode-array-accessor.h',
+        '../src/interpreter/bytecode-array-builder.cc',
+        '../src/interpreter/bytecode-array-builder.h',
+        '../src/interpreter/bytecode-array-iterator.cc',
+        '../src/interpreter/bytecode-array-iterator.h',
+        '../src/interpreter/bytecode-array-random-iterator.cc',
+        '../src/interpreter/bytecode-array-random-iterator.h',
+        '../src/interpreter/bytecode-array-writer.cc',
+        '../src/interpreter/bytecode-array-writer.h',
+        '../src/interpreter/bytecode-decoder.cc',
+        '../src/interpreter/bytecode-decoder.h',
+        '../src/interpreter/bytecode-flags.cc',
+        '../src/interpreter/bytecode-flags.h',
+        '../src/interpreter/bytecode-generator.cc',
+        '../src/interpreter/bytecode-generator.h',
+        '../src/interpreter/bytecode-label.cc',
+        '../src/interpreter/bytecode-label.h',
+        '../src/interpreter/bytecode-node.cc',
+        '../src/interpreter/bytecode-node.h',
+        '../src/interpreter/bytecode-operands.cc',
+        '../src/interpreter/bytecode-operands.h',
+        '../src/interpreter/bytecode-register.cc',
+        '../src/interpreter/bytecode-register.h',
+        '../src/interpreter/bytecode-register-allocator.h',
+        '../src/interpreter/bytecode-register-optimizer.cc',
+        '../src/interpreter/bytecode-register-optimizer.h',
+        '../src/interpreter/bytecode-source-info.cc',
+        '../src/interpreter/bytecode-source-info.h',
+        '../src/interpreter/bytecode-jump-table.h',
+        '../src/interpreter/bytecode-traits.h',
+        '../src/interpreter/constant-array-builder.cc',
+        '../src/interpreter/constant-array-builder.h',
+        '../src/interpreter/control-flow-builders.cc',
+        '../src/interpreter/control-flow-builders.h',
+        '../src/interpreter/handler-table-builder.cc',
+        '../src/interpreter/handler-table-builder.h',
+        '../src/interpreter/interpreter.cc',
+        '../src/interpreter/interpreter.h',
+        '../src/interpreter/interpreter-generator.h',
+        '../src/interpreter/interpreter-intrinsics.cc',
+        '../src/interpreter/interpreter-intrinsics.h',
+        '../src/isolate-inl.h',
+        '../src/isolate.cc',
+        '../src/isolate.h',
+        '../src/json-parser.cc',
+        '../src/json-parser.h',
+        '../src/json-stringifier.cc',
+        '../src/json-stringifier.h',
+        '../src/keys.h',
+        '../src/keys.cc',
+        '../src/label.h',
+        '../src/layout-descriptor-inl.h',
+        '../src/layout-descriptor.cc',
+        '../src/layout-descriptor.h',
+        '../src/locked-queue-inl.h',
+        '../src/locked-queue.h',
+        '../src/log-inl.h',
+        '../src/log-utils.cc',
+        '../src/log-utils.h',
+        '../src/log.cc',
+        '../src/log.h',
+        '../src/lookup-cache-inl.h',
+        '../src/lookup-cache.cc',
+        '../src/lookup-cache.h',
+        '../src/lookup.cc',
+        '../src/lookup.h',
+        '../src/map-updater.cc',
+        '../src/map-updater.h',
+        '../src/macro-assembler-inl.h',
+        '../src/macro-assembler.h',
+        '../src/machine-type.cc',
+        '../src/machine-type.h',
+        '../src/managed.h',
+        '../src/messages.cc',
+        '../src/messages.h',
+        '../src/msan.h',
+        '../src/objects-body-descriptors-inl.h',
+        '../src/objects-body-descriptors.h',
+        '../src/objects-debug.cc',
+        '../src/objects-inl.h',
+        '../src/objects-printer.cc',
+        '../src/objects.cc',
+        '../src/objects.h',
+        '../src/objects/arguments-inl.h',
+        '../src/objects/arguments.h',
+        '../src/objects/bigint.cc',
+        '../src/objects/bigint.h',
+        '../src/objects/code-inl.h',
+        '../src/objects/code.h',
+        '../src/objects/compilation-cache.h',
+        '../src/objects/compilation-cache-inl.h',
+        '../src/objects/data-handler.h',
+        '../src/objects/data-handler-inl.h',
+        '../src/objects/debug-objects-inl.h',
+        '../src/objects/debug-objects.cc',
+        '../src/objects/debug-objects.h',
+        '../src/objects/descriptor-array.h',
+        '../src/objects/dictionary.h',
+        '../src/objects/fixed-array.h',
+        '../src/objects/fixed-array-inl.h',
+        '../src/objects/frame-array.h',
+        '../src/objects/frame-array-inl.h',
+        '../src/objects/hash-table-inl.h',
+        '../src/objects/hash-table.h',
+        '../src/objects/intl-objects.cc',
+        '../src/objects/intl-objects.h',
+        '../src/objects/js-array-inl.h',
+        '../src/objects/js-array.h',
+        '../src/objects/js-collection-inl.h',
+        '../src/objects/js-collection.h',
+        '../src/objects/js-promise-inl.h',
+        '../src/objects/js-promise.h',
+        '../src/objects/js-regexp-inl.h',
+        '../src/objects/js-regexp.h',
+        '../src/objects/literal-objects.cc',
+        '../src/objects/literal-objects-inl.h',
+        '../src/objects/literal-objects.h',
+        '../src/objects/map-inl.h',
+        '../src/objects/map.h',
+        '../src/objects/maybe-object-inl.h',
+        '../src/objects/maybe-object.h',
+        '../src/objects/microtask-inl.h',
+        '../src/objects/microtask.h',
+        '../src/objects/module-inl.h',
+        '../src/objects/module.cc',
+        '../src/objects/module.h',
+        '../src/objects/name-inl.h',
+        '../src/objects/name.h',
+        '../src/objects/object-macros-undef.h',
+        '../src/objects/object-macros.h',
+        '../src/objects/promise-inl.h',
+        '../src/objects/promise.h',
+        '../src/objects/property-descriptor-object-inl.h',
+        '../src/objects/property-descriptor-object.h',
+        '../src/objects/regexp-match-info.h',
+        '../src/objects/scope-info.cc',
+        '../src/objects/scope-info.h',
+        '../src/objects/script.h',
+        '../src/objects/script-inl.h',
+        '../src/objects/shared-function-info-inl.h',
+        '../src/objects/shared-function-info.h',
+        '../src/objects/string-inl.h',
+        '../src/objects/string.h',
+        '../src/objects/string-table.h',
+        '../src/objects/template-objects.cc',
+        '../src/objects/template-objects.h',
+        '../src/ostreams.cc',
+        '../src/ostreams.h',
+        '../src/parsing/duplicate-finder.h',
+        '../src/parsing/expression-classifier.h',
+        '../src/parsing/expression-scope-reparenter.cc',
+        '../src/parsing/expression-scope-reparenter.h',
+        '../src/parsing/func-name-inferrer.cc',
+        '../src/parsing/func-name-inferrer.h',
+        '../src/parsing/parse-info.cc',
+        '../src/parsing/parse-info.h',
+        '../src/parsing/parser-base.h',
+        '../src/parsing/parser.cc',
+        '../src/parsing/parser.h',
+        '../src/parsing/parsing.cc',
+        '../src/parsing/parsing.h',
+        '../src/parsing/pattern-rewriter.cc',
+        '../src/parsing/preparse-data-format.h',
+        '../src/parsing/preparse-data.cc',
+        '../src/parsing/preparse-data.h',
+        '../src/parsing/preparsed-scope-data.cc',
+        '../src/parsing/preparsed-scope-data.h',
+        '../src/parsing/preparser.cc',
+        '../src/parsing/preparser.h',
+        '../src/parsing/rewriter.cc',
+        '../src/parsing/rewriter.h',
+        '../src/parsing/scanner-character-streams.cc',
+        '../src/parsing/scanner-character-streams.h',
+        '../src/parsing/scanner.cc',
+        '../src/parsing/scanner.h',
+        '../src/parsing/token.cc',
+        '../src/parsing/token.h',
+        '../src/pending-compilation-error-handler.cc',
+        '../src/pending-compilation-error-handler.h',
+        '../src/perf-jit.cc',
+        '../src/perf-jit.h',
+        '../src/profiler/allocation-tracker.cc',
+        '../src/profiler/allocation-tracker.h',
+        '../src/profiler/circular-queue-inl.h',
+        '../src/profiler/circular-queue.h',
+        '../src/profiler/cpu-profiler-inl.h',
+        '../src/profiler/cpu-profiler.cc',
+        '../src/profiler/cpu-profiler.h',
+        '../src/profiler/heap-profiler.cc',
+        '../src/profiler/heap-profiler.h',
+        '../src/profiler/heap-snapshot-generator-inl.h',
+        '../src/profiler/heap-snapshot-generator.cc',
+        '../src/profiler/heap-snapshot-generator.h',
+        '../src/profiler/profiler-listener.cc',
+        '../src/profiler/profiler-listener.h',
+        '../src/profiler/profile-generator-inl.h',
+        '../src/profiler/profile-generator.cc',
+        '../src/profiler/profile-generator.h',
+        '../src/profiler/sampling-heap-profiler.cc',
+        '../src/profiler/sampling-heap-profiler.h',
+        '../src/profiler/strings-storage.cc',
+        '../src/profiler/strings-storage.h',
+        '../src/profiler/tick-sample.cc',
+        '../src/profiler/tick-sample.h',
+        '../src/profiler/tracing-cpu-profiler.cc',
+        '../src/profiler/tracing-cpu-profiler.h',
+        '../src/profiler/unbound-queue-inl.h',
+        '../src/profiler/unbound-queue.h',
+        '../src/property-descriptor.cc',
+        '../src/property-descriptor.h',
+        '../src/property-details.h',
+        '../src/property.cc',
+        '../src/property.h',
+        '../src/prototype.h',
+        '../src/regexp/bytecodes-irregexp.h',
+        '../src/regexp/interpreter-irregexp.cc',
+        '../src/regexp/interpreter-irregexp.h',
+        '../src/regexp/jsregexp-inl.h',
+        '../src/regexp/jsregexp.cc',
+        '../src/regexp/jsregexp.h',
+        '../src/regexp/regexp-ast.cc',
+        '../src/regexp/regexp-ast.h',
+        '../src/regexp/regexp-macro-assembler-irregexp-inl.h',
+        '../src/regexp/regexp-macro-assembler-irregexp.cc',
+        '../src/regexp/regexp-macro-assembler-irregexp.h',
+        '../src/regexp/regexp-macro-assembler-tracer.cc',
+        '../src/regexp/regexp-macro-assembler-tracer.h',
+        '../src/regexp/regexp-macro-assembler.cc',
+        '../src/regexp/regexp-macro-assembler.h',
+        '../src/regexp/regexp-parser.cc',
+        '../src/regexp/regexp-parser.h',
+        '../src/regexp/regexp-stack.cc',
+        '../src/regexp/regexp-stack.h',
+        '../src/regexp/regexp-utils.cc',
+        '../src/regexp/regexp-utils.h',
+        '../src/register-configuration.cc',
+        '../src/register-configuration.h',
+        '../src/reglist.h',
+        '../src/runtime-profiler.cc',
+        '../src/runtime-profiler.h',
+        '../src/runtime/runtime-array.cc',
+        '../src/runtime/runtime-atomics.cc',
+        '../src/runtime/runtime-bigint.cc',
+        '../src/runtime/runtime-classes.cc',
+        '../src/runtime/runtime-collections.cc',
+        '../src/runtime/runtime-compiler.cc',
+        '../src/runtime/runtime-date.cc',
+        '../src/runtime/runtime-debug.cc',
+        '../src/runtime/runtime-forin.cc',
+        '../src/runtime/runtime-function.cc',
+        '../src/runtime/runtime-error.cc',
+        '../src/runtime/runtime-futex.cc',
+        '../src/runtime/runtime-generator.cc',
+        '../src/runtime/runtime-intl.cc',
+        '../src/runtime/runtime-internal.cc',
+        '../src/runtime/runtime-interpreter.cc',
+        '../src/runtime/runtime-literals.cc',
+        '../src/runtime/runtime-liveedit.cc',
+        '../src/runtime/runtime-maths.cc',
+        '../src/runtime/runtime-module.cc',
+        '../src/runtime/runtime-numbers.cc',
+        '../src/runtime/runtime-object.cc',
+        '../src/runtime/runtime-operators.cc',
+        '../src/runtime/runtime-promise.cc',
+        '../src/runtime/runtime-proxy.cc',
+        '../src/runtime/runtime-regexp.cc',
+        '../src/runtime/runtime-scopes.cc',
+        '../src/runtime/runtime-strings.cc',
+        '../src/runtime/runtime-symbol.cc',
+        '../src/runtime/runtime-test.cc',
+        '../src/runtime/runtime-typedarray.cc',
+        '../src/runtime/runtime-utils.h',
+        '../src/runtime/runtime-wasm.cc',
+        '../src/runtime/runtime.cc',
+        '../src/runtime/runtime.h',
+        '../src/safepoint-table.cc',
+        '../src/safepoint-table.h',
+        '../src/setup-isolate.h',
+        '../src/signature.h',
+        '../src/simulator-base.cc',
+        '../src/simulator-base.h',
+        '../src/simulator.h',
+        '../src/snapshot/builtin-deserializer-allocator.cc',
+        '../src/snapshot/builtin-deserializer-allocator.h',
+        '../src/snapshot/builtin-deserializer.cc',
+        '../src/snapshot/builtin-deserializer.h',
+        '../src/snapshot/builtin-serializer-allocator.cc',
+        '../src/snapshot/builtin-serializer-allocator.h',
+        '../src/snapshot/builtin-serializer.cc',
+        '../src/snapshot/builtin-serializer.h',
+        '../src/snapshot/builtin-snapshot-utils.cc',
+        '../src/snapshot/builtin-snapshot-utils.h',
+        '../src/snapshot/code-serializer.cc',
+        '../src/snapshot/code-serializer.h',
+        '../src/snapshot/default-deserializer-allocator.cc',
+        '../src/snapshot/default-deserializer-allocator.h',
+        '../src/snapshot/default-serializer-allocator.cc',
+        '../src/snapshot/default-serializer-allocator.h',
+        '../src/snapshot/deserializer.cc',
+        '../src/snapshot/deserializer.h',
+        '../src/snapshot/natives-common.cc',
+        '../src/snapshot/natives.h',
+        '../src/snapshot/object-deserializer.cc',
+        '../src/snapshot/object-deserializer.h',
+        '../src/snapshot/partial-deserializer.cc',
+        '../src/snapshot/partial-deserializer.h',
+        '../src/snapshot/partial-serializer.cc',
+        '../src/snapshot/partial-serializer.h',
+        '../src/snapshot/serializer.cc',
+        '../src/snapshot/serializer-common.cc',
+        '../src/snapshot/serializer-common.h',
+        '../src/snapshot/serializer.h',
+        '../src/snapshot/snapshot-common.cc',
+        '../src/snapshot/snapshot.h',
+        '../src/snapshot/snapshot-source-sink.cc',
+        '../src/snapshot/snapshot-source-sink.h',
+        '../src/snapshot/startup-deserializer.cc',
+        '../src/snapshot/startup-deserializer.h',
+        '../src/snapshot/startup-serializer.cc',
+        '../src/snapshot/startup-serializer.h',
+        '../src/source-position-table.cc',
+        '../src/source-position-table.h',
+        '../src/source-position.cc',
+        '../src/source-position.h',
+        '../src/splay-tree.h',
+        '../src/splay-tree-inl.h',
+        '../src/startup-data-util.cc',
+        '../src/startup-data-util.h',
+        '../src/string-builder.cc',
+        '../src/string-builder.h',
+        '../src/string-case.cc',
+        '../src/string-case.h',
+        '../src/string-hasher-inl.h',
+        '../src/string-hasher.h',
+        '../src/string-search.h',
+        '../src/string-stream.cc',
+        '../src/string-stream.h',
+        '../src/strtod.cc',
+        '../src/strtod.h',
+        '../src/ic/stub-cache.cc',
+        '../src/ic/stub-cache.h',
+        '../src/third_party/utf8-decoder/utf8-decoder.h',
+        '../src/tracing/trace-event.cc',
+        '../src/tracing/trace-event.h',
+        '../src/tracing/traced-value.cc',
+        '../src/tracing/traced-value.h',
+        '../src/tracing/tracing-category-observer.cc',
+        '../src/tracing/tracing-category-observer.h',
+        '../src/transitions-inl.h',
+        '../src/transitions.cc',
+        '../src/transitions.h',
+        '../src/trap-handler/handler-outside.cc',
+        '../src/trap-handler/handler-shared.cc',
+        '../src/trap-handler/trap-handler.h',
+        '../src/trap-handler/trap-handler-internal.h',
+        '../src/type-hints.cc',
+        '../src/type-hints.h',
+        '../src/unicode-inl.h',
+        '../src/unicode.cc',
+        '../src/unicode.h',
+        '../src/unicode-cache-inl.h',
+        '../src/unicode-cache.h',
+        '../src/unicode-decoder.cc',
+        '../src/unicode-decoder.h',
+        '../src/uri.cc',
+        '../src/uri.h',
+        '../src/utils-inl.h',
+        '../src/utils.cc',
+        '../src/utils.h',
+        '../src/v8.cc',
+        '../src/v8.h',
+        '../src/v8memory.h',
+        '../src/v8threads.cc',
+        '../src/v8threads.h',
+        '../src/value-serializer.cc',
+        '../src/value-serializer.h',
+        '../src/vector-slot-pair.cc',
+        '../src/vector-slot-pair.h',
+        '../src/vector.h',
+        '../src/version.cc',
+        '../src/version.h',
+        '../src/visitors.cc',
+        '../src/visitors.h',
+        '../src/vm-state-inl.h',
+        '../src/vm-state.h',
+        '../src/wasm/baseline/liftoff-assembler-defs.h',
+        '../src/wasm/baseline/liftoff-assembler.cc',
+        '../src/wasm/baseline/liftoff-assembler.h',
+        '../src/wasm/baseline/liftoff-compiler.cc',
+        '../src/wasm/baseline/liftoff-register.h',
+        '../src/wasm/compilation-manager.cc',
+        '../src/wasm/compilation-manager.h',
+        '../src/wasm/decoder.h',
+        '../src/wasm/function-body-decoder.cc',
+        '../src/wasm/function-body-decoder.h',
+        '../src/wasm/function-body-decoder-impl.h',
+        '../src/wasm/leb-helper.h',
+        '../src/wasm/local-decl-encoder.cc',
+        '../src/wasm/local-decl-encoder.h',
+        '../src/wasm/memory-tracing.cc',
+        '../src/wasm/memory-tracing.h',
+        '../src/wasm/module-compiler.cc',
+        '../src/wasm/module-compiler.h',
+        '../src/wasm/module-decoder.cc',
+        '../src/wasm/module-decoder.h',
+        '../src/wasm/signature-map.cc',
+        '../src/wasm/signature-map.h',
+        '../src/wasm/streaming-decoder.cc',
+        '../src/wasm/streaming-decoder.h',
+        '../src/wasm/wasm-code-manager.cc',
+        '../src/wasm/wasm-code-manager.h',
+        '../src/wasm/wasm-code-specialization.cc',
+        '../src/wasm/wasm-code-specialization.h',
+        '../src/wasm/wasm-constants.h',
+        '../src/wasm/wasm-debug.cc',
+        '../src/wasm/wasm-engine.cc',
+        '../src/wasm/wasm-engine.h',
+        '../src/wasm/wasm-external-refs.cc',
+        '../src/wasm/wasm-external-refs.h',
+        '../src/wasm/wasm-js.cc',
+        '../src/wasm/wasm-js.h',
+        '../src/wasm/wasm-limits.h',
+        '../src/wasm/wasm-memory.cc',
+        '../src/wasm/wasm-memory.h',
+        '../src/wasm/wasm-module.cc',
+        '../src/wasm/wasm-module.h',
+        '../src/wasm/wasm-module-builder.cc',
+        '../src/wasm/wasm-module-builder.h',
+        '../src/wasm/wasm-interpreter.cc',
+        '../src/wasm/wasm-interpreter.h',
+        '../src/wasm/wasm-objects-inl.h',
+        '../src/wasm/wasm-objects.cc',
+        '../src/wasm/wasm-objects.h',
+        '../src/wasm/wasm-opcodes.cc',
+        '../src/wasm/wasm-opcodes.h',
+        '../src/wasm/wasm-result.cc',
+        '../src/wasm/wasm-result.h',
+        '../src/wasm/wasm-serialization.cc',
+        '../src/wasm/wasm-serialization.h',
+        '../src/wasm/wasm-text.cc',
+        '../src/wasm/wasm-text.h',
+        '../src/wasm/wasm-value.h',
+        '../src/zone/accounting-allocator.cc',
+        '../src/zone/accounting-allocator.h',
+        '../src/zone/zone-segment.cc',
+        '../src/zone/zone-segment.h',
+        '../src/zone/zone.cc',
+        '../src/zone/zone.h',
+        '../src/zone/zone-chunk-list.h',
+        '../src/zone/zone-segment.cc',
+        '../src/zone/zone-segment.h',
+        '../src/zone/zone-allocator.h',
+        '../src/zone/zone-containers.h',
+        '../src/zone/zone-handle-set.h',
+        '../src/zone/zone-list-inl.h',
+      ],
+      'conditions': [
+        ['want_separate_host_toolset==1', {
+          'toolsets': ['host', 'target'],
+        }, {
+          'toolsets': ['target'],
+        }],
+        ['v8_target_arch=="arm"', {
+          'sources': [
+            '../src/arm/assembler-arm-inl.h',
+            '../src/arm/assembler-arm.cc',
+            '../src/arm/assembler-arm.h',
+            '../src/arm/code-stubs-arm.cc',
+            '../src/arm/code-stubs-arm.h',
+            '../src/arm/codegen-arm.cc',
+            '../src/arm/constants-arm.h',
+            '../src/arm/constants-arm.cc',
+            '../src/arm/cpu-arm.cc',
+            '../src/arm/deoptimizer-arm.cc',
+            '../src/arm/disasm-arm.cc',
+            '../src/arm/frame-constants-arm.cc',
+            '../src/arm/frame-constants-arm.h',
+            '../src/arm/interface-descriptors-arm.cc',
+            '../src/arm/interface-descriptors-arm.h',
+            '../src/arm/macro-assembler-arm.cc',
+            '../src/arm/macro-assembler-arm.h',
+            '../src/arm/simulator-arm.cc',
+            '../src/arm/simulator-arm.h',
+            '../src/arm/eh-frame-arm.cc',
+            '../src/compiler/arm/code-generator-arm.cc',
+            '../src/compiler/arm/instruction-codes-arm.h',
+            '../src/compiler/arm/instruction-scheduler-arm.cc',
+            '../src/compiler/arm/instruction-selector-arm.cc',
+            '../src/compiler/arm/unwinding-info-writer-arm.cc',
+            '../src/compiler/arm/unwinding-info-writer-arm.h',
+            '../src/debug/arm/debug-arm.cc',
+            '../src/regexp/arm/regexp-macro-assembler-arm.cc',
+            '../src/regexp/arm/regexp-macro-assembler-arm.h',
+            '../src/wasm/baseline/arm/liftoff-assembler-arm.h',
+          ],
+        }],
+        ['v8_target_arch=="arm64"', {
+          'sources': [
+            '../src/arm64/assembler-arm64.cc',
+            '../src/arm64/assembler-arm64.h',
+            '../src/arm64/assembler-arm64-inl.h',
+            '../src/arm64/codegen-arm64.cc',
+            '../src/arm64/code-stubs-arm64.cc',
+            '../src/arm64/code-stubs-arm64.h',
+            '../src/arm64/constants-arm64.h',
+            '../src/arm64/cpu-arm64.cc',
+            '../src/arm64/decoder-arm64.cc',
+            '../src/arm64/decoder-arm64.h',
+            '../src/arm64/decoder-arm64-inl.h',
+            '../src/arm64/deoptimizer-arm64.cc',
+            '../src/arm64/disasm-arm64.cc',
+            '../src/arm64/disasm-arm64.h',
+            '../src/arm64/frame-constants-arm64.cc',
+            '../src/arm64/frame-constants-arm64.h',
+            '../src/arm64/instructions-arm64-constants.cc',
+            '../src/arm64/instructions-arm64.cc',
+            '../src/arm64/instructions-arm64.h',
+            '../src/arm64/instrument-arm64.cc',
+            '../src/arm64/instrument-arm64.h',
+            '../src/arm64/interface-descriptors-arm64.cc',
+            '../src/arm64/interface-descriptors-arm64.h',
+            '../src/arm64/macro-assembler-arm64.cc',
+            '../src/arm64/macro-assembler-arm64.h',
+            '../src/arm64/macro-assembler-arm64-inl.h',
+            '../src/arm64/simulator-arm64.cc',
+            '../src/arm64/simulator-arm64.h',
+            '../src/arm64/simulator-logic-arm64.cc',
+            '../src/arm64/utils-arm64.cc',
+            '../src/arm64/utils-arm64.h',
+            '../src/arm64/eh-frame-arm64.cc',
+            '../src/compiler/arm64/code-generator-arm64.cc',
+            '../src/compiler/arm64/instruction-codes-arm64.h',
+            '../src/compiler/arm64/instruction-scheduler-arm64.cc',
+            '../src/compiler/arm64/instruction-selector-arm64.cc',
+            '../src/compiler/arm64/unwinding-info-writer-arm64.cc',
+            '../src/compiler/arm64/unwinding-info-writer-arm64.h',
+            '../src/debug/arm64/debug-arm64.cc',
+            '../src/regexp/arm64/regexp-macro-assembler-arm64.cc',
+            '../src/regexp/arm64/regexp-macro-assembler-arm64.h',
+            '../src/wasm/baseline/arm64/liftoff-assembler-arm64.h',
+          ],
+        }],
+        ['v8_target_arch=="ia32"', {
+          'sources': [
+            '../src/ia32/assembler-ia32-inl.h',
+            '../src/ia32/assembler-ia32.cc',
+            '../src/ia32/assembler-ia32.h',
+            '../src/ia32/code-stubs-ia32.cc',
+            '../src/ia32/codegen-ia32.cc',
+            '../src/ia32/cpu-ia32.cc',
+            '../src/ia32/deoptimizer-ia32.cc',
+            '../src/ia32/disasm-ia32.cc',
+            '../src/ia32/frame-constants-ia32.cc',
+            '../src/ia32/frame-constants-ia32.h',
+            '../src/ia32/interface-descriptors-ia32.cc',
+            '../src/ia32/macro-assembler-ia32.cc',
+            '../src/ia32/macro-assembler-ia32.h',
+            '../src/ia32/simulator-ia32.cc',
+            '../src/ia32/simulator-ia32.h',
+            '../src/ia32/sse-instr.h',
+            '../src/compiler/ia32/code-generator-ia32.cc',
+            '../src/compiler/ia32/instruction-codes-ia32.h',
+            '../src/compiler/ia32/instruction-scheduler-ia32.cc',
+            '../src/compiler/ia32/instruction-selector-ia32.cc',
+            '../src/debug/ia32/debug-ia32.cc',
+            '../src/regexp/ia32/regexp-macro-assembler-ia32.cc',
+            '../src/regexp/ia32/regexp-macro-assembler-ia32.h',
+            '../src/wasm/baseline/ia32/liftoff-assembler-ia32.h',
+          ],
+        }],
+        ['v8_target_arch=="mips" or v8_target_arch=="mipsel"', {
+          'sources': [
+            '../src/mips/assembler-mips.cc',
+            '../src/mips/assembler-mips.h',
+            '../src/mips/assembler-mips-inl.h',
+            '../src/mips/codegen-mips.cc',
+            '../src/mips/code-stubs-mips.cc',
+            '../src/mips/code-stubs-mips.h',
+            '../src/mips/constants-mips.cc',
+            '../src/mips/constants-mips.h',
+            '../src/mips/cpu-mips.cc',
+            '../src/mips/deoptimizer-mips.cc',
+            '../src/mips/disasm-mips.cc',
+            '../src/mips/frame-constants-mips.cc',
+            '../src/mips/frame-constants-mips.h',
+            '../src/mips/interface-descriptors-mips.cc',
+            '../src/mips/macro-assembler-mips.cc',
+            '../src/mips/macro-assembler-mips.h',
+            '../src/mips/simulator-mips.cc',
+            '../src/mips/simulator-mips.h',
+            '../src/compiler/mips/code-generator-mips.cc',
+            '../src/compiler/mips/instruction-codes-mips.h',
+            '../src/compiler/mips/instruction-scheduler-mips.cc',
+            '../src/compiler/mips/instruction-selector-mips.cc',
+            '../src/debug/mips/debug-mips.cc',
+            '../src/regexp/mips/regexp-macro-assembler-mips.cc',
+            '../src/regexp/mips/regexp-macro-assembler-mips.h',
+            '../src/wasm/baseline/mips/liftoff-assembler-mips.h',
+          ],
+        }],
+        ['v8_target_arch=="mips64" or v8_target_arch=="mips64el"', {
+          'sources': [
+            '../src/mips64/assembler-mips64.cc',
+            '../src/mips64/assembler-mips64.h',
+            '../src/mips64/assembler-mips64-inl.h',
+            '../src/mips64/codegen-mips64.cc',
+            '../src/mips64/code-stubs-mips64.cc',
+            '../src/mips64/code-stubs-mips64.h',
+            '../src/mips64/constants-mips64.cc',
+            '../src/mips64/constants-mips64.h',
+            '../src/mips64/cpu-mips64.cc',
+            '../src/mips64/deoptimizer-mips64.cc',
+            '../src/mips64/disasm-mips64.cc',
+            '../src/mips64/frame-constants-mips64.cc',
+            '../src/mips64/frame-constants-mips64.h',
+            '../src/mips64/interface-descriptors-mips64.cc',
+            '../src/mips64/macro-assembler-mips64.cc',
+            '../src/mips64/macro-assembler-mips64.h',
+            '../src/mips64/simulator-mips64.cc',
+            '../src/mips64/simulator-mips64.h',
+            '../src/compiler/mips64/code-generator-mips64.cc',
+            '../src/compiler/mips64/instruction-codes-mips64.h',
+            '../src/compiler/mips64/instruction-scheduler-mips64.cc',
+            '../src/compiler/mips64/instruction-selector-mips64.cc',
+            '../src/debug/mips64/debug-mips64.cc',
+            '../src/regexp/mips64/regexp-macro-assembler-mips64.cc',
+            '../src/regexp/mips64/regexp-macro-assembler-mips64.h',
+            '../src/wasm/baseline/mips64/liftoff-assembler-mips64.h',
+          ],
+        }],
+        ['v8_target_arch=="x64"', {
+          'sources': [
+            '../src/compiler/x64/code-generator-x64.cc',
+            '../src/compiler/x64/instruction-codes-x64.h',
+            '../src/compiler/x64/instruction-scheduler-x64.cc',
+            '../src/compiler/x64/instruction-selector-x64.cc',
+            '../src/compiler/x64/unwinding-info-writer-x64.cc',
+            '../src/compiler/x64/unwinding-info-writer-x64.h',
+            '../src/x64/assembler-x64-inl.h',
+            '../src/x64/assembler-x64.cc',
+            '../src/x64/assembler-x64.h',
+            '../src/x64/code-stubs-x64.cc',
+            '../src/x64/codegen-x64.cc',
+            '../src/x64/cpu-x64.cc',
+            '../src/x64/deoptimizer-x64.cc',
+            '../src/x64/disasm-x64.cc',
+            '../src/x64/eh-frame-x64.cc',
+            '../src/x64/frame-constants-x64.cc',
+            '../src/x64/frame-constants-x64.h',
+            '../src/x64/interface-descriptors-x64.cc',
+            '../src/x64/macro-assembler-x64.cc',
+            '../src/x64/macro-assembler-x64.h',
+            '../src/x64/simulator-x64.cc',
+            '../src/x64/simulator-x64.h',
+            '../src/x64/sse-instr.h',
+            '../src/debug/x64/debug-x64.cc',
+            '../src/regexp/x64/regexp-macro-assembler-x64.cc',
+            '../src/regexp/x64/regexp-macro-assembler-x64.h',
+            '../src/third_party/valgrind/valgrind.h',
+            '../src/wasm/baseline/x64/liftoff-assembler-x64.h',
+          ],
+        }],
+        ['v8_target_arch=="x64" and OS=="linux"', {
+            'sources': ['../src/trap-handler/handler-inside.cc']
+        }],
+        ['v8_target_arch=="ppc" or v8_target_arch=="ppc64"', {
+          'sources': [
+            '../src/compiler/ppc/code-generator-ppc.cc',
+            '../src/compiler/ppc/instruction-codes-ppc.h',
+            '../src/compiler/ppc/instruction-scheduler-ppc.cc',
+            '../src/compiler/ppc/instruction-selector-ppc.cc',
+            '../src/debug/ppc/debug-ppc.cc',
+            '../src/ppc/assembler-ppc-inl.h',
+            '../src/ppc/assembler-ppc.cc',
+            '../src/ppc/assembler-ppc.h',
+            '../src/ppc/code-stubs-ppc.cc',
+            '../src/ppc/code-stubs-ppc.h',
+            '../src/ppc/codegen-ppc.cc',
+            '../src/ppc/constants-ppc.h',
+            '../src/ppc/constants-ppc.cc',
+            '../src/ppc/cpu-ppc.cc',
+            '../src/ppc/deoptimizer-ppc.cc',
+            '../src/ppc/disasm-ppc.cc',
+            '../src/ppc/frame-constants-ppc.cc',
+            '../src/ppc/frame-constants-ppc.h',
+            '../src/ppc/interface-descriptors-ppc.cc',
+            '../src/ppc/macro-assembler-ppc.cc',
+            '../src/ppc/macro-assembler-ppc.h',
+            '../src/ppc/simulator-ppc.cc',
+            '../src/ppc/simulator-ppc.h',
+            '../src/regexp/ppc/regexp-macro-assembler-ppc.cc',
+            '../src/regexp/ppc/regexp-macro-assembler-ppc.h',
+            '../src/wasm/baseline/ppc/liftoff-assembler-ppc.h',
+          ],
+        }],
+        ['v8_target_arch=="s390" or v8_target_arch=="s390x"', {
+          'sources': [
+            '../src/compiler/s390/code-generator-s390.cc',
+            '../src/compiler/s390/instruction-codes-s390.h',
+            '../src/compiler/s390/instruction-scheduler-s390.cc',
+            '../src/compiler/s390/instruction-selector-s390.cc',
+            '../src/debug/s390/debug-s390.cc',
+            '../src/regexp/s390/regexp-macro-assembler-s390.cc',
+            '../src/regexp/s390/regexp-macro-assembler-s390.h',
+            '../src/s390/assembler-s390.cc',
+            '../src/s390/assembler-s390.h',
+            '../src/s390/assembler-s390-inl.h',
+            '../src/s390/codegen-s390.cc',
+            '../src/s390/code-stubs-s390.cc',
+            '../src/s390/code-stubs-s390.h',
+            '../src/s390/constants-s390.cc',
+            '../src/s390/constants-s390.h',
+            '../src/s390/cpu-s390.cc',
+            '../src/s390/deoptimizer-s390.cc',
+            '../src/s390/disasm-s390.cc',
+            '../src/s390/frame-constants-s390.cc',
+            '../src/s390/frame-constants-s390.h',
+            '../src/s390/interface-descriptors-s390.cc',
+            '../src/s390/macro-assembler-s390.cc',
+            '../src/s390/macro-assembler-s390.h',
+            '../src/s390/simulator-s390.cc',
+            '../src/s390/simulator-s390.h',
+            '../src/wasm/baseline/s390/liftoff-assembler-s390.h',
+          ],
+        }],
+        ['OS=="win"', {
+          'variables': {
+            'gyp_generators': '<!(echo $GYP_GENERATORS)',
+          },
+          'msvs_disabled_warnings': [4351, 4355, 4800],
+          # When building Official, the .lib is too large and exceeds the 2G
+          # limit. This breaks it into multiple pieces to avoid the limit.
+          # See http://crbug.com/485155.
+          'msvs_shard': 4,
+          # This will prevent V8's .cc files conflicting with the inspector's
+          # .cpp files in the same shard.
+          'msvs_settings': {
+            'VCCLCompilerTool': {
+              'ObjectFile':'$(IntDir)%(Extension)\\',
+            },
+          },
+        }],
+        ['component=="shared_library"', {
+          'defines': [
+            'BUILDING_V8_SHARED',
+          ],
+        }],
+        ['v8_postmortem_support=="true"', {
+          'sources': [
+            '<(SHARED_INTERMEDIATE_DIR)/debug-support.cc',
+          ]
+        }],
+        ['v8_enable_i18n_support==1', {
+          'dependencies': [
+            '<(icu_gyp_path):icui18n',
+            '<(icu_gyp_path):icuuc',
+          ],
+          'conditions': [
+            ['icu_use_data_file_flag==1', {
+              'defines': ['ICU_UTIL_DATA_IMPL=ICU_UTIL_DATA_FILE'],
+            }, { # else icu_use_data_file_flag !=1
+              'conditions': [
+                ['OS=="win"', {
+                  'defines': ['ICU_UTIL_DATA_IMPL=ICU_UTIL_DATA_SHARED'],
+                }, {
+                  'defines': ['ICU_UTIL_DATA_IMPL=ICU_UTIL_DATA_STATIC'],
+                }],
+              ],
+            }],
+          ],
+        }, {  # v8_enable_i18n_support==0
+          'sources!': [
+            '../src/builtins/builtins-intl.cc',
+            '../src/builtins/builtins-intl.h',
+            '../src/char-predicates.cc',
+            '../src/intl.cc',
+            '../src/intl.h',
+            '../src/objects/intl-objects.cc',
+            '../src/objects/intl-objects.h',
+            '../src/runtime/runtime-intl.cc',
+          ],
+        }],
+        ['OS=="win" and v8_enable_i18n_support==1', {
+          'dependencies': [
+            '<(icu_gyp_path):icudata',
+          ],
+        }],
+      ],
+    },
+    {
+      'target_name': 'v8_libbase',
+      'type': '<(component)',
+      'variables': {
+        'optimize': 'max',
+      },
+      'include_dirs+': [
+        '..',
+      ],
+      'sources': [
+        '../src/base/adapters.h',
+        '../src/base/atomic-utils.h',
+        '../src/base/atomicops.h',
+        '../src/base/atomicops_internals_atomicword_compat.h',
+        '../src/base/atomicops_internals_portable.h',
+        '../src/base/atomicops_internals_std.h',
+        '../src/base/base-export.h',
+        '../src/base/bits.cc',
+        '../src/base/bits.h',
+        '../src/base/build_config.h',
+        '../src/base/compiler-specific.h',
+        '../src/base/cpu.cc',
+        '../src/base/cpu.h',
+        '../src/base/division-by-constant.cc',
+        '../src/base/division-by-constant.h',
+        '../src/base/debug/stack_trace.cc',
+        '../src/base/debug/stack_trace.h',
+        '../src/base/export-template.h',
+        '../src/base/file-utils.cc',
+        '../src/base/file-utils.h',
+        '../src/base/flags.h',
+        '../src/base/format-macros.h',
+        '../src/base/free_deleter.h',
+        '../src/base/functional.cc',
+        '../src/base/functional.h',
+        '../src/base/hashmap.h',
+        '../src/base/hashmap-entry.h',
+        '../src/base/ieee754.cc',
+        '../src/base/ieee754.h',
+        '../src/base/iterator.h',
+        '../src/base/lazy-instance.h',
+        '../src/base/logging.cc',
+        '../src/base/logging.h',
+        '../src/base/macros.h',
+        '../src/base/once.cc',
+        '../src/base/once.h',
+        '../src/base/optional.h',
+        '../src/base/page-allocator.cc',
+        '../src/base/page-allocator.h',
+        '../src/base/platform/elapsed-timer.h',
+        '../src/base/platform/time.cc',
+        '../src/base/platform/time.h',
+        '../src/base/platform/condition-variable.cc',
+        '../src/base/platform/condition-variable.h',
+        '../src/base/platform/mutex.cc',
+        '../src/base/platform/mutex.h',
+        '../src/base/platform/platform.h',
+        '../src/base/platform/semaphore.cc',
+        '../src/base/platform/semaphore.h',
+        '../src/base/ring-buffer.h',
+        '../src/base/safe_conversions.h',
+        '../src/base/safe_conversions_impl.h',
+        '../src/base/safe_math.h',
+        '../src/base/safe_math_impl.h',
+        '../src/base/sys-info.cc',
+        '../src/base/sys-info.h',
+        '../src/base/template-utils.h',
+        '../src/base/timezone-cache.h',
+        '../src/base/tsan.h',
+        '../src/base/utils/random-number-generator.cc',
+        '../src/base/utils/random-number-generator.h',
+      ],
+      'target_conditions': [
+        ['OS=="android" and _toolset=="target"', {
+          'libraries': [
+            '-llog',
+          ],
+          'include_dirs': [
+            'src/common/android/include',
+          ],
+        }],
+      ],
+      'conditions': [
+        ['want_separate_host_toolset==1', {
+          'toolsets': ['host', 'target'],
+        }, {
+          'toolsets': ['target'],
+        }],
+        ['component=="shared_library"', {
+          'defines': [
+            'BUILDING_V8_BASE_SHARED',
+          ],
+          'direct_dependent_settings': {
+            'defines': [
+              'USING_V8_BASE_SHARED',
+            ],
+          },
+        }],
+        ['OS=="linux"', {
+            'link_settings': {
+              'libraries': [
+                '-ldl',
+                '-lrt'
+              ],
+            },
+            'sources': [
+              '../src/base/debug/stack_trace_posix.cc',
+              '../src/base/platform/platform-linux.cc',
+              '../src/base/platform/platform-posix.h',
+              '../src/base/platform/platform-posix.cc',
+              '../src/base/platform/platform-posix-time.h',
+              '../src/base/platform/platform-posix-time.cc',
+            ],
+          }
+        ],
+        ['OS=="android"', {
+            'sources': [
+              '../src/base/debug/stack_trace_android.cc',
+              '../src/base/platform/platform-posix.h',
+              '../src/base/platform/platform-posix.cc',
+              '../src/base/platform/platform-posix-time.h',
+              '../src/base/platform/platform-posix-time.cc',
+            ],
+            'link_settings': {
+              'target_conditions': [
+                ['_toolset=="host" and host_os!="mac"', {
+                  # Only include libdl and librt on host builds because they
+                  # are included by default on Android target builds, and we
+                  # don't want to re-include them here since this will change
+                  # library order and break (see crbug.com/469973).
+                  # These libraries do not exist on Mac hosted builds.
+                  'libraries': [
+                    '-ldl',
+                    '-lrt'
+                  ]
+                }]
+              ]
+            },
+            'conditions': [
+              ['host_os=="mac"', {
+                'target_conditions': [
+                  ['_toolset=="host"', {
+                    'sources': [
+                      '../src/base/platform/platform-macos.cc'
+                    ]
+                  }, {
+                    'sources': [
+                      '../src/base/platform/platform-linux.cc'
+                    ]
+                  }],
+                ],
+              }, {
+                'sources': [
+                  '../src/base/platform/platform-linux.cc'
+                ]
+              }],
+            ],
+          },
+        ],
+        ['OS=="qnx"', {
+            'link_settings': {
+              'target_conditions': [
+                ['_toolset=="host" and host_os=="linux"', {
+                  'libraries': [
+                    '-lrt'
+                  ],
+                }],
+                ['_toolset=="target"', {
+                  'libraries': [
+                    '-lbacktrace'
+                  ],
+                }],
+              ],
+            },
+            'sources': [
+              '../src/base/debug/stack_trace_posix.cc',
+              '../src/base/platform/platform-posix.h',
+              '../src/base/platform/platform-posix.cc',
+              '../src/base/platform/platform-posix-time.h',
+              '../src/base/platform/platform-posix-time.cc',
+              '../src/base/qnx-math.h'
+            ],
+            'target_conditions': [
+              ['_toolset=="host" and host_os=="linux"', {
+                'sources': [
+                  '../src/base/platform/platform-linux.cc'
+                ],
+              }],
+              ['_toolset=="host" and host_os=="mac"', {
+                'sources': [
+                  '../src/base/platform/platform-macos.cc'
+                ],
+              }],
+              ['_toolset=="target"', {
+                'sources': [
+                  '../src/base/platform/platform-qnx.cc'
+                ],
+              }],
+            ],
+          },
+        ],
+        ['OS=="freebsd"', {
+            'link_settings': {
+              'libraries': [
+                '-L/usr/local/lib -lexecinfo',
+            ]},
+            'sources': [
+              '../src/base/debug/stack_trace_posix.cc',
+              '../src/base/platform/platform-freebsd.cc',
+              '../src/base/platform/platform-posix.h',
+              '../src/base/platform/platform-posix.cc',
+              '../src/base/platform/platform-posix-time.h',
+              '../src/base/platform/platform-posix-time.cc',
+            ],
+          }
+        ],
+        ['OS=="openbsd"', {
+            'link_settings': {
+              'libraries': [
+                '-L/usr/local/lib -lexecinfo',
+            ]},
+            'sources': [
+              '../src/base/debug/stack_trace_posix.cc',
+              '../src/base/platform/platform-openbsd.cc',
+              '../src/base/platform/platform-posix.h',
+              '../src/base/platform/platform-posix.cc',
+              '../src/base/platform/platform-posix-time.h',
+              '../src/base/platform/platform-posix-time.cc',
+            ],
+          }
+        ],
+        ['OS=="netbsd"', {
+            'link_settings': {
+              'libraries': [
+                '-L/usr/pkg/lib -Wl,-R/usr/pkg/lib -lexecinfo',
+            ]},
+            'sources': [
+              '../src/base/debug/stack_trace_posix.cc',
+              '../src/base/platform/platform-openbsd.cc',
+              '../src/base/platform/platform-posix.h',
+              '../src/base/platform/platform-posix.cc',
+              '../src/base/platform/platform-posix-time.h',
+              '../src/base/platform/platform-posix-time.cc',
+            ],
+          }
+        ],
+        ['OS=="aix"', {
+          'sources': [
+            '../src/base/debug/stack_trace_posix.cc',
+            '../src/base/platform/platform-aix.cc',
+            '../src/base/platform/platform-posix.h',
+            '../src/base/platform/platform-posix.cc'
+          ]},
+        ],
+        ['OS=="fuchsia"', {
+          'sources': [
+            '../src/base/debug/stack_trace_fuchsia.cc',
+            '../src/base/platform/platform-fuchsia.cc',
+          ]},
+        ],
+        ['OS=="solaris"', {
+            'link_settings': {
+              'libraries': [
+                '-lnsl -lrt',
+            ]},
+            'sources': [
+              '../src/base/debug/stack_trace_posix.cc',
+              '../src/base/platform/platform-solaris.cc',
+              '../src/base/platform/platform-posix.h',
+              '../src/base/platform/platform-posix.cc',
+            ],
+          }
+        ],
+        ['OS=="mac"', {
+          'sources': [
+            '../src/base/debug/stack_trace_posix.cc',
+            '../src/base/platform/platform-macos.cc',
+            '../src/base/platform/platform-posix.h',
+            '../src/base/platform/platform-posix.cc',
+            '../src/base/platform/platform-posix-time.h',
+            '../src/base/platform/platform-posix-time.cc',
+          ]},
+        ],
+        ['OS=="win"', {
+          'defines': [
+            '_CRT_RAND_S'  # for rand_s()
+          ],
+          'variables': {
+            'gyp_generators': '<!(echo $GYP_GENERATORS)',
+          },
+          'conditions': [
+            ['gyp_generators=="make"', {
+              'variables': {
+                'build_env': '<!(uname -o)',
+              },
+              'conditions': [
+                ['build_env=="Cygwin"', {
+                  'sources': [
+                    '../src/base/debug/stack_trace_posix.cc',
+                    '../src/base/platform/platform-cygwin.cc',
+                    '../src/base/platform/platform-posix.h',
+                    '../src/base/platform/platform-posix.cc',
+                  ],
+                }, {
+                  'sources': [
+                    '../src/base/debug/stack_trace_win.cc',
+                    '../src/base/platform/platform-win32.cc',
+                    '../src/base/win32-headers.h',
+                  ],
+                }],
+              ],
+              'link_settings':  {
+                'libraries': [ '-lwinmm', '-lws2_32' ],
+              },
+            }, {
+              'sources': [
+                '../src/base/debug/stack_trace_win.cc',
+                '../src/base/platform/platform-win32.cc',
+                '../src/base/win32-headers.h',
+              ],
+              'msvs_disabled_warnings': [4351, 4355, 4800],
+              'link_settings':  {
+                'libraries': [
+                  '-ldbghelp.lib',
+                  '-lshlwapi.lib',
+                  '-lwinmm.lib',
+                  '-lws2_32.lib'
+                ],
+              },
+            }],
+          ],
+        }],
+      ],
+    },
+    {
+      'target_name': 'v8_libplatform',
+      'type': '<(component)',
+      'variables': {
+        'optimize': 'max',
+      },
+      'dependencies': [
+        'v8_libbase',
+      ],
+      'include_dirs+': [
+        '..',
+        '<(DEPTH)',
+        '../include/',
+      ],
+      'sources': [
+        '../include//libplatform/libplatform.h',
+        '../include//libplatform/libplatform-export.h',
+        '../include//libplatform/v8-tracing.h',
+        '../src/libplatform/default-foreground-task-runner.cc',
+        '../src/libplatform/default-foreground-task-runner.h',
+        '../src/libplatform/default-platform.cc',
+        '../src/libplatform/default-platform.h',
+        '../src/libplatform/default-worker-threads-task-runner.cc',
+        '../src/libplatform/default-worker-threads-task-runner.h',
+        '../src/libplatform/task-queue.cc',
+        '../src/libplatform/task-queue.h',
+        '../src/libplatform/tracing/trace-buffer.cc',
+        '../src/libplatform/tracing/trace-buffer.h',
+        '../src/libplatform/tracing/trace-config.cc',
+        '../src/libplatform/tracing/trace-object.cc',
+        '../src/libplatform/tracing/trace-writer.cc',
+        '../src/libplatform/tracing/trace-writer.h',
+        '../src/libplatform/tracing/tracing-controller.cc',
+        '../src/libplatform/worker-thread.cc',
+        '../src/libplatform/worker-thread.h',
+      ],
+      'conditions': [
+        ['want_separate_host_toolset==1', {
+          'toolsets': ['host', 'target'],
+        }, {
+          'toolsets': ['target'],
+        }],
+        ['component=="shared_library"', {
+          'direct_dependent_settings': {
+            'defines': [ 'USING_V8_PLATFORM_SHARED' ],
+          },
+          'defines': [ 'BUILDING_V8_PLATFORM_SHARED' ],
+        }]
+      ],
+      'direct_dependent_settings': {
+        'include_dirs': [
+          '../include/',
+        ],
+      },
+    },
+    {
+      'target_name': 'v8_libsampler',
+      'type': 'static_library',
+      'variables': {
+        'optimize': 'max',
+      },
+      'dependencies': [
+        'v8_libbase',
+      ],
+      'include_dirs+': [
+        '..',
+        '../include/',
+      ],
+      'sources': [
+        '../src/libsampler/sampler.cc',
+        '../src/libsampler/sampler.h'
+      ],
+      'conditions': [
+        ['want_separate_host_toolset==1', {
+          'toolsets': ['host', 'target'],
+        }, {
+          'toolsets': ['target'],
+        }],
+      ],
+      'direct_dependent_settings': {
+        'include_dirs': [
+          '../include/',
+        ],
+      },
+    },
+    {
+      'target_name': 'natives_blob',
+      'type': 'none',
+      'conditions': [
+        [ 'v8_use_external_startup_data==1', {
+          'conditions': [
+            ['want_separate_host_toolset==1', {
+              'dependencies': ['js2c#host'],
+            }, {
+              'dependencies': ['js2c'],
+            }],
+          ],
+          'actions': [{
+            'action_name': 'concatenate_natives_blob',
+            'inputs': [
+              '../tools//concatenate-files.py',
+              '<(SHARED_INTERMEDIATE_DIR)/libraries.bin',
+              '<(SHARED_INTERMEDIATE_DIR)/libraries-extras.bin',
+              '<(SHARED_INTERMEDIATE_DIR)/libraries-experimental-extras.bin',
+            ],
+            'conditions': [
+              ['want_separate_host_toolset==1', {
+                'target_conditions': [
+                  ['_toolset=="host"', {
+                    'outputs': [
+                      '<(PRODUCT_DIR)/natives_blob_host.bin',
+                    ],
+                    'action': [
+                      'python', '<@(_inputs)', '<(PRODUCT_DIR)/natives_blob_host.bin'
+                    ],
+                  }, {
+                    'outputs': [
+                      '<(PRODUCT_DIR)/natives_blob.bin',
+                    ],
+                    'action': [
+                      'python', '<@(_inputs)', '<(PRODUCT_DIR)/natives_blob.bin'
+                    ],
+                  }],
+                ],
+              }, {
+                'outputs': [
+                  '<(PRODUCT_DIR)/natives_blob.bin',
+                ],
+                'action': [
+                  'python', '<@(_inputs)', '<(PRODUCT_DIR)/natives_blob.bin'
+                ],
+              }],
+            ],
+          }],
+        }],
+        ['want_separate_host_toolset==1', {
+          'toolsets': ['host', 'target'],
+        }, {
+          'toolsets': ['target'],
+        }],
+      ]
+    },
+    {
+      'target_name': 'js2c',
+      'type': 'none',
+      'conditions': [
+        ['want_separate_host_toolset==1', {
+          'toolsets': ['host'],
+        }, {
+          'toolsets': ['target'],
+        }],
+      ],
+      'variables': {
+        'library_files': [
+          '../src/js/macros.py',
+          '../src/messages.h',
+          '../src/js/prologue.js',
+          '../src/js/array.js',
+          '../src/js/typedarray.js',
+          '../src/js/messages.js',
+          '../src/debug/mirrors.js',
+          '../src/debug/debug.js',
+          '../src/debug/liveedit.js',
+        ],
+        'libraries_bin_file': '<(SHARED_INTERMEDIATE_DIR)/libraries.bin',
+        'libraries_extras_bin_file': '<(SHARED_INTERMEDIATE_DIR)/libraries-extras.bin',
+        'libraries_experimental_extras_bin_file': '<(SHARED_INTERMEDIATE_DIR)/libraries-experimental-extras.bin',
+        'conditions': [
+          ['v8_enable_i18n_support==1', {
+            'library_files': ['../src/js/intl.js'],
+          }],
+        ],
+      },
+      'actions': [
+        {
+          'action_name': 'js2c',
+          'inputs': [
+            '../tools//js2c.py',
+            '<@(library_files)',
+          ],
+          'outputs': ['<(SHARED_INTERMEDIATE_DIR)/libraries.cc'],
+          'action': [
+            'python',
+            '../tools//js2c.py',
+            '<(SHARED_INTERMEDIATE_DIR)/libraries.cc',
+            'CORE',
+            '<@(library_files)',
+          ],
+        },
+        {
+          'action_name': 'js2c_bin',
+          'inputs': [
+            '../tools//js2c.py',
+            '<@(library_files)',
+          ],
+          'outputs': ['<@(libraries_bin_file)'],
+          'action': [
+            'python',
+            '../tools//js2c.py',
+            '<(SHARED_INTERMEDIATE_DIR)/libraries.cc',
+            'CORE',
+            '<@(library_files)',
+            '--startup_blob', '<@(libraries_bin_file)',
+            '--nojs',
+          ],
+        },
+        {
+          'action_name': 'js2c_extras',
+          'inputs': [
+            '../tools//js2c.py',
+            '<@(v8_extra_library_files)',
+          ],
+          'outputs': ['<(SHARED_INTERMEDIATE_DIR)/extras-libraries.cc'],
+          'action': [
+            'python',
+            '../tools//js2c.py',
+            '<(SHARED_INTERMEDIATE_DIR)/extras-libraries.cc',
+            'EXTRAS',
+            '<@(v8_extra_library_files)',
+          ],
+        },
+        {
+          'action_name': 'js2c_extras_bin',
+          'inputs': [
+            '../tools//js2c.py',
+            '<@(v8_extra_library_files)',
+          ],
+          'outputs': ['<@(libraries_extras_bin_file)'],
+          'action': [
+            'python',
+            '../tools//js2c.py',
+            '<(SHARED_INTERMEDIATE_DIR)/extras-libraries.cc',
+            'EXTRAS',
+            '<@(v8_extra_library_files)',
+            '--startup_blob', '<@(libraries_extras_bin_file)',
+            '--nojs',
+          ],
+        },
+        {
+          'action_name': 'js2c_experimental_extras',
+          'inputs': [
+            '../tools//js2c.py',
+            '<@(v8_experimental_extra_library_files)',
+          ],
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/experimental-extras-libraries.cc',
+          ],
+          'action': [
+            'python',
+            '../tools//js2c.py',
+            '<(SHARED_INTERMEDIATE_DIR)/experimental-extras-libraries.cc',
+            'EXPERIMENTAL_EXTRAS',
+            '<@(v8_experimental_extra_library_files)',
+          ],
+        },
+        {
+          'action_name': 'js2c_experimental_extras_bin',
+          'inputs': [
+            '../tools//js2c.py',
+            '<@(v8_experimental_extra_library_files)',
+          ],
+          'outputs': ['<@(libraries_experimental_extras_bin_file)'],
+          'action': [
+            'python',
+            '../tools//js2c.py',
+            '<(SHARED_INTERMEDIATE_DIR)/experimental-extras-libraries.cc',
+            'EXPERIMENTAL_EXTRAS',
+            '<@(v8_experimental_extra_library_files)',
+            '--startup_blob', '<@(libraries_experimental_extras_bin_file)',
+            '--nojs',
+          ],
+        },
+      ],
+    },
+    {
+      'target_name': 'postmortem-metadata',
+      'type': 'none',
+      'variables': {
+        'heapobject_files': [
+            '../src/objects.h',
+            '../src/objects-inl.h',
+            '../src/objects/code.h',
+            '../src/objects/code-inl.h',
+            '../src/objects/fixed-array.h',
+            '../src/objects/fixed-array-inl.h',
+            '../src/objects/js-array.h',
+            '../src/objects/js-array-inl.h',
+            '../src/objects/js-regexp.h',
+            '../src/objects/js-regexp-inl.h',
+            '../src/objects/map.h',
+            '../src/objects/map-inl.h',
+            '../src/objects/script.h',
+            '../src/objects/script-inl.h',
+            '../src/objects/shared-function-info.h',
+            '../src/objects/shared-function-info-inl.h',
+            '../src/objects/string.h',
+            '../src/objects/string-inl.h',
+        ],
+      },
+      'actions': [
+          {
+            'action_name': 'gen-postmortem-metadata',
+            'inputs': [
+              '../tools//gen-postmortem-metadata.py',
+              '<@(heapobject_files)',
+            ],
+            'outputs': [
+              '<(SHARED_INTERMEDIATE_DIR)/debug-support.cc',
+            ],
+            'action': [
+              'python',
+              '../tools//gen-postmortem-metadata.py',
+              '<@(_outputs)',
+              '<@(heapobject_files)'
+            ]
+          }
+        ]
+    },
+    {
+      'target_name': 'mksnapshot',
+      'type': 'executable',
+      'dependencies': [
+        'v8_base',
+        'v8_init',
+        'v8_libbase',
+        'v8_libplatform',
+        'v8_nosnapshot',
+      ],
+      'include_dirs+': [
+        '..',
+        '<(DEPTH)',
+      ],
+      'sources': [
+        '../src/snapshot/mksnapshot.cc',
+      ],
+      'conditions': [
+        ['v8_enable_i18n_support==1', {
+          'dependencies': [
+            '<(icu_gyp_path):icui18n',
+            '<(icu_gyp_path):icuuc',
+          ]
+        }],
+        ['want_separate_host_toolset==1', {
+          'toolsets': ['host'],
+        }, {
+          'toolsets': ['target'],
+        }],
+      ],
+    },
+    {
+      'target_name': 'v8_dump_build_config',
+      'type': 'none',
+      'variables': {
+      },
+      'actions': [
+        {
+          'action_name': 'v8_dump_build_config',
+          'inputs': [
+            '../tools//testrunner/utils/dump_build_config_gyp.py',
+          ],
+          'outputs': [
+            '<(PRODUCT_DIR)/v8_build_config.json',
+          ],
+          'action': [
+            'python',
+            '../tools//testrunner/utils/dump_build_config_gyp.py',
+            '<(PRODUCT_DIR)/v8_build_config.json',
+            'dcheck_always_on=<(dcheck_always_on)',
+            'is_asan=<(asan)',
+            'is_cfi=<(cfi_vptr)',
+            'is_component_build=<(component)',
+            'is_debug=<(CONFIGURATION_NAME)',
+            # Not available in gyp.
+            'is_gcov_coverage=0',
+            'is_msan=<(msan)',
+            'is_tsan=<(tsan)',
+            # Not available in gyp.
+            'is_ubsan_vptr=0',
+            'target_cpu=<(target_arch)',
+            'v8_enable_i18n_support=<(v8_enable_i18n_support)',
+            'v8_enable_verify_predictable=<(v8_enable_verify_predictable)',
+            'v8_target_cpu=<(v8_target_arch)',
+            'v8_use_snapshot=<(v8_use_snapshot)',
+          ],
+          'conditions': [
+            ['v8_target_arch=="mips" or v8_target_arch=="mipsel" \
+              or v8_target_arch=="mips64" or v8_target_arch=="mips64el"', {
+                'action':[
+                  'mips_arch_variant=<(mips_arch_variant)',
+                  'mips_use_msa=<(mips_use_msa)',
+                ],
+            }],
+          ],
+        },
+      ],
+    },
+    {
+      'target_name': 'v8_monolith',
+      'type': 'none',
+      'direct_dependent_settings': {
+        'include_dirs': [
+          '../include/',
+        ],
+      },
+      'actions': [
+        {
+          'action_name': 'build_with_gn',
+          'inputs': [
+            '../tools//node/build_gn.py',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/gn/obj/libv8_monolith.a',
+            '<(INTERMEDIATE_DIR)/gn/args.gn',
+          ],
+          'action': [
+            '../tools//node/build_gn.py',
+            '--mode', '<(CONFIGURATION_NAME)',
+            '--v8_path', '../',
+            '--build_path', '<(INTERMEDIATE_DIR)/gn',
+            '--host_os', '<(host_os)',
+            '--flag', 'v8_promise_internal_field_count=<(v8_promise_internal_field_count)',
+            '--flag', 'target_cpu="<(target_arch)"',
+            '--flag', 'target_os="<(OS)"',
+            '--flag', 'v8_target_cpu="<(v8_target_arch)"',
+            '--flag', 'v8_embedder_string="<(v8_embedder_string)"',
+            '--flag', 'v8_use_snapshot=<(v8_use_snapshot)',
+            '--flag', 'v8_optimized_debug=<(v8_optimized_debug)',
+            '--flag', 'v8_enable_disassembler=<(v8_enable_disassembler)',
+            '--flag', 'v8_postmortem_support=<(v8_postmortem_support)',
+          ],
+        },
+      ],
+    },
+  ],
+}
diff --git a/deps/v8/gypfiles/v8vtune.gyp b/deps/v8/gypfiles/v8vtune.gyp
new file mode 100644
index 00000000000..2a756d4b808
--- /dev/null
+++ b/deps/v8/gypfiles/v8vtune.gyp
@@ -0,0 +1,36 @@
+# Copyright 2012 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+{
+  'variables': {
+    'v8_code': 1,
+  },
+  'includes': ['toolchain.gypi', 'features.gypi'],
+  'targets': [
+    {
+      'target_name': 'v8_vtune',
+      'type': 'static_library',
+      'dependencies': [
+        'v8.gyp:v8',
+      ],
+      'sources': [
+        '../src/third_party/vtune/ittnotify_config.h',
+        '../src/third_party/vtune/ittnotify_types.h',
+        '../src/third_party/vtune/jitprofiling.cc',
+        '../src/third_party/vtune/jitprofiling.h',
+        '../src/third_party/vtune/v8-vtune.h',
+        '../src/third_party/vtune/vtune-jit.cc',
+        '../src/third_party/vtune/vtune-jit.h',
+      ],
+      'direct_dependent_settings': {
+        'defines': ['ENABLE_VTUNE_JIT_INTERFACE',],
+        'conditions': [
+          ['OS != "win"', {
+            'libraries': ['-ldl',],
+          }],
+        ],
+      },
+    },
+  ],
+}
diff --git a/deps/v8/tools/verify_source_deps.py b/deps/v8/gypfiles/verify_source_deps.py
old mode 100755
new mode 100644
similarity index 86%
rename from deps/v8/tools/verify_source_deps.py
rename to deps/v8/gypfiles/verify_source_deps.py
index c49d51ab5d5..714c6fe84b8
--- a/deps/v8/tools/verify_source_deps.py
+++ b/deps/v8/gypfiles/verify_source_deps.py
@@ -22,19 +22,19 @@
 V8_BASE = os.path.dirname(os.path.dirname(os.path.realpath(__file__)))
 
 GYP_FILES = [
-  os.path.join(V8_BASE, 'src', 'd8.gyp'),
-  os.path.join(V8_BASE, 'src', 'v8.gyp'),
-  os.path.join(V8_BASE, 'src', 'inspector', 'inspector.gypi'),
-  os.path.join(V8_BASE, 'src', 'third_party', 'vtune', 'v8vtune.gyp'),
-  os.path.join(V8_BASE, 'samples', 'samples.gyp'),
-  os.path.join(V8_BASE, 'test', 'cctest', 'cctest.gyp'),
-  os.path.join(V8_BASE, 'test', 'fuzzer', 'fuzzer.gyp'),
-  os.path.join(V8_BASE, 'test', 'unittests', 'unittests.gyp'),
-  os.path.join(V8_BASE, 'test', 'inspector', 'inspector.gyp'),
-  os.path.join(V8_BASE, 'test', 'mkgrokdump', 'mkgrokdump.gyp'),
-  os.path.join(V8_BASE, 'testing', 'gmock.gyp'),
-  os.path.join(V8_BASE, 'testing', 'gtest.gyp'),
-  os.path.join(V8_BASE, 'tools', 'parser-shell.gyp'),
+  os.path.join(V8_BASE, 'gypfiles', 'd8.gyp'),
+  os.path.join(V8_BASE, 'gypfiles', 'v8.gyp'),
+  os.path.join(V8_BASE, 'gypfiles', 'inspector.gypi'),
+  os.path.join(V8_BASE, 'gypfiles', 'v8vtune.gyp'),
+  os.path.join(V8_BASE, 'gypfiles', 'samples.gyp'),
+  os.path.join(V8_BASE, 'gypfiles', 'cctest.gyp'),
+  os.path.join(V8_BASE, 'gypfiles', 'fuzzer.gyp'),
+  os.path.join(V8_BASE, 'gypfiles', 'unittests.gyp'),
+  os.path.join(V8_BASE, 'gypfiles', 'inspector-test.gyp'),
+  os.path.join(V8_BASE, 'gypfiles', 'mkgrokdump.gyp'),
+  os.path.join(V8_BASE, 'gypfiles', 'gmock.gyp'),
+  os.path.join(V8_BASE, 'gypfiles', 'gtest.gyp'),
+  os.path.join(V8_BASE, 'gypfiles', 'parser-shell.gyp'),
 ]
 
 ALL_GYP_PREFIXES = [
diff --git a/deps/v8/gypfiles/win/msvs_dependencies.isolate b/deps/v8/gypfiles/win/msvs_dependencies.isolate
deleted file mode 100644
index 28591266591..00000000000
--- a/deps/v8/gypfiles/win/msvs_dependencies.isolate
+++ /dev/null
@@ -1,97 +0,0 @@
-# Copyright 2016 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# TODO(machenbach): Remove this when crbug.com/669910 is resolved.
-{
-  'conditions': [
-    # Copy the VS runtime DLLs into the isolate so that they
-    # don't have to be preinstalled on the target machine.
-    #
-    # VS2013 runtimes
-    ['OS=="win" and msvs_version==2013 and component=="shared_library" and (CONFIGURATION_NAME=="Debug" or CONFIGURATION_NAME=="Debug_x64")', {
-      'variables': {
-        'files': [
-          '<(PRODUCT_DIR)/msvcp120d.dll',
-          '<(PRODUCT_DIR)/msvcr120d.dll',
-        ],
-      },
-    }],
-    ['OS=="win" and msvs_version==2013 and component=="shared_library" and (CONFIGURATION_NAME=="Release" or CONFIGURATION_NAME=="Release_x64")', {
-      'variables': {
-        'files': [
-          '<(PRODUCT_DIR)/msvcp120.dll',
-          '<(PRODUCT_DIR)/msvcr120.dll',
-        ],
-      },
-    }],
-    # VS2015/2017 runtimes
-    ['OS=="win" and (msvs_version==2015 or msvs_version==2017) and component=="shared_library" and (CONFIGURATION_NAME=="Debug" or CONFIGURATION_NAME=="Debug_x64")', {
-      'variables': {
-        'files': [
-          '<(PRODUCT_DIR)/msvcp140d.dll',
-          '<(PRODUCT_DIR)/vccorlib140d.dll',
-          '<(PRODUCT_DIR)/vcruntime140d.dll',
-          '<(PRODUCT_DIR)/ucrtbased.dll',
-        ],
-      },
-    }],
-    ['OS=="win" and (msvs_version==2015 or msvs_version==2017) and component=="shared_library" and (CONFIGURATION_NAME=="Release" or CONFIGURATION_NAME=="Release_x64")', {
-      'variables': {
-        'files': [
-          '<(PRODUCT_DIR)/msvcp140.dll',
-          '<(PRODUCT_DIR)/vccorlib140.dll',
-          '<(PRODUCT_DIR)/vcruntime140.dll',
-          '<(PRODUCT_DIR)/ucrtbase.dll',
-        ],
-      },
-    }],
-    ['OS=="win" and (msvs_version==2015 or msvs_version==2017) and component=="shared_library"', {
-      # Windows 10 Universal C Runtime binaries.
-      'variables': {
-        'files': [
-          '<(PRODUCT_DIR)/api-ms-win-core-console-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-datetime-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-debug-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-errorhandling-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-file-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-file-l1-2-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-file-l2-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-handle-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-heap-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-interlocked-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-libraryloader-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-localization-l1-2-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-memory-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-namedpipe-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-processenvironment-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-processthreads-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-processthreads-l1-1-1.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-profile-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-rtlsupport-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-string-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-synch-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-synch-l1-2-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-sysinfo-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-timezone-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-core-util-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-conio-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-convert-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-environment-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-filesystem-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-heap-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-locale-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-math-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-multibyte-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-private-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-process-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-runtime-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-stdio-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-string-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-time-l1-1-0.dll',
-          '<(PRODUCT_DIR)/api-ms-win-crt-utility-l1-1-0.dll',
-        ],
-      },
-    }],
-  ],
-}
diff --git a/deps/v8/include/OWNERS b/deps/v8/include/OWNERS
index 28f038f80b2..a0dd55eb72d 100644
--- a/deps/v8/include/OWNERS
+++ b/deps/v8/include/OWNERS
@@ -1,5 +1,6 @@
 adamk@chromium.org
 danno@chromium.org
+yangguo@chromium.org
 
 per-file v8-inspector.h=dgozman@chromium.org
 per-file v8-inspector.h=pfeldman@chromium.org
diff --git a/deps/v8/include/PRESUBMIT.py b/deps/v8/include/PRESUBMIT.py
index 386f2e50061..8002e4dcacb 100644
--- a/deps/v8/include/PRESUBMIT.py
+++ b/deps/v8/include/PRESUBMIT.py
@@ -24,6 +24,6 @@ def header_filter(f):
   return output_api.EnsureCQIncludeTrybotsAreAdded(
     cl,
     [
-      'master.tryserver.chromium.linux:linux_chromium_rel_ng'
+      'luci.chromium.try:linux_chromium_rel_ng'
     ],
     'Automatically added layout test trybots to run tests on CQ.')
diff --git a/deps/v8/include/libplatform/libplatform.h b/deps/v8/include/libplatform/libplatform.h
index 04b47b8d2e1..2c830bf834b 100644
--- a/deps/v8/include/libplatform/libplatform.h
+++ b/deps/v8/include/libplatform/libplatform.h
@@ -38,7 +38,7 @@ V8_PLATFORM_EXPORT std::unique_ptr<v8::Platform> NewDefaultPlatform(
     int thread_pool_size = 0,
     IdleTaskSupport idle_task_support = IdleTaskSupport::kDisabled,
     InProcessStackDumping in_process_stack_dumping =
-        InProcessStackDumping::kEnabled,
+        InProcessStackDumping::kDisabled,
     std::unique_ptr<v8::TracingController> tracing_controller = {});
 
 V8_PLATFORM_EXPORT V8_DEPRECATE_SOON(
@@ -47,7 +47,7 @@ V8_PLATFORM_EXPORT V8_DEPRECATE_SOON(
         int thread_pool_size = 0,
         IdleTaskSupport idle_task_support = IdleTaskSupport::kDisabled,
         InProcessStackDumping in_process_stack_dumping =
-            InProcessStackDumping::kEnabled,
+            InProcessStackDumping::kDisabled,
         v8::TracingController* tracing_controller = nullptr));
 
 /**
@@ -62,8 +62,10 @@ V8_PLATFORM_EXPORT bool PumpMessageLoop(
     v8::Platform* platform, v8::Isolate* isolate,
     MessageLoopBehavior behavior = MessageLoopBehavior::kDoNotWait);
 
-V8_PLATFORM_EXPORT void EnsureEventLoopInitialized(v8::Platform* platform,
-                                                   v8::Isolate* isolate);
+V8_PLATFORM_EXPORT V8_DEPRECATE_SOON(
+    "This function has become obsolete and is essentially a nop",
+    void EnsureEventLoopInitialized(v8::Platform* platform,
+                                    v8::Isolate* isolate));
 
 /**
  * Runs pending idle tasks for at most |idle_time_in_seconds| seconds.
diff --git a/deps/v8/include/v8-debug.h b/deps/v8/include/v8-debug.h
deleted file mode 100644
index 54c0f216aa6..00000000000
--- a/deps/v8/include/v8-debug.h
+++ /dev/null
@@ -1,255 +0,0 @@
-// Copyright 2008 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_V8_DEBUG_H_
-#define V8_V8_DEBUG_H_
-
-#include "v8.h"  // NOLINT(build/include)
-
-/**
- * ATTENTION: The debugger API exposed by this file is deprecated and will be
- *            removed by the end of 2017. Please use the V8 inspector declared
- *            in include/v8-inspector.h instead.
- */
-namespace v8 {
-
-// Debug events which can occur in the V8 JavaScript engine.
-enum DebugEvent {
-  Break = 1,
-  Exception = 2,
-  AfterCompile = 3,
-  CompileError = 4,
-  AsyncTaskEvent = 5,
-};
-
-class V8_EXPORT Debug {
- public:
-  /**
-   * A client object passed to the v8 debugger whose ownership will be taken by
-   * it. v8 is always responsible for deleting the object.
-   */
-  class ClientData {
-   public:
-    virtual ~ClientData() {}
-  };
-
-
-  /**
-   * A message object passed to the debug message handler.
-   */
-  class Message {
-   public:
-    /**
-     * Check type of message.
-     */
-    virtual bool IsEvent() const = 0;
-    virtual bool IsResponse() const = 0;
-    virtual DebugEvent GetEvent() const = 0;
-
-    /**
-     * Indicate whether this is a response to a continue command which will
-     * start the VM running after this is processed.
-     */
-    virtual bool WillStartRunning() const = 0;
-
-    /**
-     * Access to execution state and event data. Don't store these cross
-     * callbacks as their content becomes invalid. These objects are from the
-     * debugger event that started the debug message loop.
-     */
-    virtual Local<Object> GetExecutionState() const = 0;
-    virtual Local<Object> GetEventData() const = 0;
-
-    /**
-     * Get the debugger protocol JSON.
-     */
-    virtual Local<String> GetJSON() const = 0;
-
-    /**
-     * Get the context active when the debug event happened. Note this is not
-     * the current active context as the JavaScript part of the debugger is
-     * running in its own context which is entered at this point.
-     */
-    virtual Local<Context> GetEventContext() const = 0;
-
-    /**
-     * Client data passed with the corresponding request if any. This is the
-     * client_data data value passed into Debug::SendCommand along with the
-     * request that led to the message or NULL if the message is an event. The
-     * debugger takes ownership of the data and will delete it even if there is
-     * no message handler.
-     */
-    virtual ClientData* GetClientData() const = 0;
-
-    virtual Isolate* GetIsolate() const = 0;
-
-    virtual ~Message() {}
-  };
-
-  /**
-   * An event details object passed to the debug event listener.
-   */
-  class EventDetails {
-   public:
-    /**
-     * Event type.
-     */
-    virtual DebugEvent GetEvent() const = 0;
-
-    /**
-     * Access to execution state and event data of the debug event. Don't store
-     * these cross callbacks as their content becomes invalid.
-     */
-    virtual Local<Object> GetExecutionState() const = 0;
-    virtual Local<Object> GetEventData() const = 0;
-
-    /**
-     * Get the context active when the debug event happened. Note this is not
-     * the current active context as the JavaScript part of the debugger is
-     * running in its own context which is entered at this point.
-     */
-    virtual Local<Context> GetEventContext() const = 0;
-
-    /**
-     * Client data passed with the corresponding callback when it was
-     * registered.
-     */
-    virtual Local<Value> GetCallbackData() const = 0;
-
-    /**
-     * This is now a dummy that returns nullptr.
-     */
-    virtual ClientData* GetClientData() const = 0;
-
-    virtual Isolate* GetIsolate() const = 0;
-
-    virtual ~EventDetails() {}
-  };
-
-  /**
-   * Debug event callback function.
-   *
-   * \param event_details object providing information about the debug event
-   *
-   * A EventCallback does not take possession of the event data,
-   * and must not rely on the data persisting after the handler returns.
-   */
-  typedef void (*EventCallback)(const EventDetails& event_details);
-
-  /**
-   * This is now a no-op.
-   */
-  typedef void (*MessageHandler)(const Message& message);
-
-  V8_DEPRECATED("No longer supported", static bool SetDebugEventListener(
-                                           Isolate* isolate, EventCallback that,
-                                           Local<Value> data = Local<Value>()));
-
-  // Schedule a debugger break to happen when JavaScript code is run
-  // in the given isolate.
-  V8_DEPRECATED("No longer supported",
-                static void DebugBreak(Isolate* isolate));
-
-  // Remove scheduled debugger break in given isolate if it has not
-  // happened yet.
-  V8_DEPRECATED("No longer supported",
-                static void CancelDebugBreak(Isolate* isolate));
-
-  // Check if a debugger break is scheduled in the given isolate.
-  V8_DEPRECATED("No longer supported",
-                static bool CheckDebugBreak(Isolate* isolate));
-
-  // This is now a no-op.
-  V8_DEPRECATED("No longer supported",
-                static void SetMessageHandler(Isolate* isolate,
-                                              MessageHandler handler));
-
-  // This is now a no-op.
-  V8_DEPRECATED("No longer supported",
-                static void SendCommand(Isolate* isolate,
-                                        const uint16_t* command, int length,
-                                        ClientData* client_data = NULL));
-
-  /**
-   * Run a JavaScript function in the debugger.
-   * \param fun the function to call
-   * \param data passed as second argument to the function
-   * With this call the debugger is entered and the function specified is called
-   * with the execution state as the first argument. This makes it possible to
-   * get access to information otherwise not available during normal JavaScript
-   * execution e.g. details on stack frames. Receiver of the function call will
-   * be the debugger context global object, however this is a subject to change.
-   * The following example shows a JavaScript function which when passed to
-   * v8::Debug::Call will return the current line of JavaScript execution.
-   *
-   * \code
-   *   function frame_source_line(exec_state) {
-   *     return exec_state.frame(0).sourceLine();
-   *   }
-   * \endcode
-   */
-  V8_DEPRECATED("No longer supported",
-                static MaybeLocal<Value> Call(
-                    Local<Context> context, v8::Local<v8::Function> fun,
-                    Local<Value> data = Local<Value>()));
-
-  // This is now a no-op.
-  V8_DEPRECATED("No longer supported",
-                static void ProcessDebugMessages(Isolate* isolate));
-
-  /**
-   * Debugger is running in its own context which is entered while debugger
-   * messages are being dispatched. This is an explicit getter for this
-   * debugger context. Note that the content of the debugger context is subject
-   * to change. The Context exists only when the debugger is active, i.e. at
-   * least one DebugEventListener or MessageHandler is set.
-   */
-  V8_DEPRECATED("Use v8-inspector",
-                static Local<Context> GetDebugContext(Isolate* isolate));
-
-  /**
-   * While in the debug context, this method returns the top-most non-debug
-   * context, if it exists.
-   */
-  V8_DEPRECATED(
-      "No longer supported",
-      static MaybeLocal<Context> GetDebuggedContext(Isolate* isolate));
-
-  /**
-   * Enable/disable LiveEdit functionality for the given Isolate
-   * (default Isolate if not provided). V8 will abort if LiveEdit is
-   * unexpectedly used. LiveEdit is enabled by default.
-   */
-  V8_DEPRECATED("No longer supported",
-                static void SetLiveEditEnabled(Isolate* isolate, bool enable));
-
-  /**
-   * Returns array of internal properties specific to the value type. Result has
-   * the following format: [<name>, <value>,...,<name>, <value>]. Result array
-   * will be allocated in the current context.
-   */
-  V8_DEPRECATED("No longer supported",
-                static MaybeLocal<Array> GetInternalProperties(
-                    Isolate* isolate, Local<Value> value));
-
-  /**
-   * Defines if the ES2015 tail call elimination feature is enabled or not.
-   * The change of this flag triggers deoptimization of all functions that
-   * contain calls at tail position.
-   */
-  V8_DEPRECATED("No longer supported",
-                static bool IsTailCallEliminationEnabled(Isolate* isolate));
-  V8_DEPRECATED("No longer supported",
-                static void SetTailCallEliminationEnabled(Isolate* isolate,
-                                                          bool enabled));
-};
-
-
-}  // namespace v8
-
-
-#undef EXPORT
-
-
-#endif  // V8_V8_DEBUG_H_
diff --git a/deps/v8/include/v8-platform.h b/deps/v8/include/v8-platform.h
index 2bb14df93e9..80e51aedc08 100644
--- a/deps/v8/include/v8-platform.h
+++ b/deps/v8/include/v8-platform.h
@@ -10,6 +10,8 @@
 #include <memory>
 #include <string>
 
+#include "v8config.h"  // NOLINT(build/include)
+
 namespace v8 {
 
 class Isolate;
@@ -286,13 +288,27 @@ class Platform {
   virtual bool OnCriticalMemoryPressure(size_t length) { return false; }
 
   /**
-   * Gets the number of threads that are used to execute background tasks. Is
-   * used to estimate the number of tasks a work package should be split into.
-   * A return value of 0 means that there are no background threads available.
-   * Note that a value of 0 won't prohibit V8 from posting tasks using
-   * |CallOnBackgroundThread|.
+   * Gets the number of worker threads used by GetWorkerThreadsTaskRunner() and
+   * CallOnWorkerThread(). This can be used to estimate the number of tasks a
+   * work package should be split into. A return value of 0 means that there are
+   * no worker threads available. Note that a value of 0 won't prohibit V8 from
+   * posting tasks using |CallOnWorkerThread|.
+   */
+  virtual int NumberOfWorkerThreads() {
+    return static_cast<int>(NumberOfAvailableBackgroundThreads());
+  }
+
+  /**
+   * Deprecated. Use NumberOfWorkerThreads() instead.
+   * TODO(gab): Remove this when all embedders override
+   * NumberOfWorkerThreads() instead.
    */
-  virtual size_t NumberOfAvailableBackgroundThreads() { return 0; }
+  V8_DEPRECATE_SOON(
+      "NumberOfAvailableBackgroundThreads() is deprecated, use "
+      "NumberOfAvailableBackgroundThreads() instead.",
+      virtual size_t NumberOfAvailableBackgroundThreads()) {
+    return 0;
+  }
 
   /**
    * Returns a TaskRunner which can be used to post a task on the foreground.
@@ -309,11 +325,34 @@ class Platform {
    * Returns a TaskRunner which can be used to post a task on a background.
    * This function should only be called from a foreground thread.
    */
-  virtual std::shared_ptr<v8::TaskRunner> GetBackgroundTaskRunner(
+  V8_DEPRECATE_SOON(
+      "GetBackgroundTaskRunner() is deprecated, use "
+      "GetWorkerThreadsTaskRunner() "
+      "instead.",
+      virtual std::shared_ptr<v8::TaskRunner> GetBackgroundTaskRunner(
+          Isolate* isolate)) {
+    // TODO(gab): Remove this method when all embedders have moved to
+    // GetWorkerThreadsTaskRunner().
+
+    // An implementation needs to be provided here because this is called by the
+    // default GetWorkerThreadsTaskRunner() implementation below. In practice
+    // however, all code either:
+    //  - Overrides GetWorkerThreadsTaskRunner() (thus not making this call) --
+    //    i.e. all v8 code.
+    //  - Overrides this method (thus not making this call) -- i.e. all
+    //    unadapted embedders.
+    abort();
+  }
+
+  /**
+   * Returns a TaskRunner which can be used to post async tasks on a worker.
+   * This function should only be called from a foreground thread.
+   */
+  virtual std::shared_ptr<v8::TaskRunner> GetWorkerThreadsTaskRunner(
       Isolate* isolate) {
-    // TODO(ahaas): Make this function abstract after it got implemented on all
+    // TODO(gab): Make this function abstract after it got implemented on all
     // platforms.
-    return {};
+    return GetBackgroundTaskRunner(isolate);
   }
 
   /**
@@ -323,8 +362,37 @@ class Platform {
    * of tasks wrt order of scheduling, nor is there a guarantee about the
    * thread the task will be run on.
    */
-  virtual void CallOnBackgroundThread(Task* task,
-                                      ExpectedRuntime expected_runtime) = 0;
+  V8_DEPRECATE_SOON(
+      "ExpectedRuntime is deprecated, use CallOnWorkerThread() instead.",
+      virtual void CallOnBackgroundThread(Task* task,
+                                          ExpectedRuntime expected_runtime)) {
+    // An implementation needs to be provided here because this is called by the
+    // default implementation below. In practice however, all code either:
+    //  - Overrides the new method (thus not making this call) -- i.e. all v8
+    //    code.
+    //  - Overrides this method (thus not making this call) -- i.e. all
+    //    unadapted embedders.
+    abort();
+  }
+
+  /**
+   * Schedules a task to be invoked on a worker thread.
+   * TODO(gab): Make pure virtual when all embedders override this instead of
+   * CallOnBackgroundThread().
+   */
+  virtual void CallOnWorkerThread(std::unique_ptr<Task> task) {
+    CallOnBackgroundThread(task.release(), kShortRunningTask);
+  }
+
+  /**
+   * Schedules a task that blocks the main thread to be invoked with
+   * high-priority on a worker thread.
+   */
+  virtual void CallBlockingTaskOnWorkerThread(std::unique_ptr<Task> task) {
+    // Embedders may optionally override this to process these tasks in a high
+    // priority pool.
+    CallOnWorkerThread(std::move(task));
+  }
 
   /**
    * Schedules a task to be invoked on a foreground thread wrt a specific
diff --git a/deps/v8/include/v8-profiler.h b/deps/v8/include/v8-profiler.h
index a86402be924..afa40d25f30 100644
--- a/deps/v8/include/v8-profiler.h
+++ b/deps/v8/include/v8-profiler.h
@@ -335,7 +335,8 @@ class V8_EXPORT CpuProfiler {
   /**
    * Tells the profiler whether the embedder is idle.
    */
-  void SetIdle(bool is_idle);
+  V8_DEPRECATED("Use Isolate::SetIdle(bool) instead.",
+                void SetIdle(bool is_idle));
 
  private:
   CpuProfiler();
@@ -401,7 +402,8 @@ class V8_EXPORT HeapGraphNode {
                          // snapshot items together.
     kConsString = 10,    // Concatenated string. A pair of pointers to strings.
     kSlicedString = 11,  // Sliced string. A fragment of another string.
-    kSymbol = 12         // A Symbol (ES6).
+    kSymbol = 12,        // A Symbol (ES6).
+    kBigInt = 13         // BigInt.
   };
 
   /** Returns node type (see HeapGraphNode::Type). */
@@ -626,6 +628,68 @@ class V8_EXPORT AllocationProfile {
   static const int kNoColumnNumberInfo = Message::kNoColumnInfo;
 };
 
+/**
+ * An object graph consisting of embedder objects and V8 objects.
+ * Edges of the graph are strong references between the objects.
+ * The embedder can build this graph during heap snapshot generation
+ * to include the embedder objects in the heap snapshot.
+ * Usage:
+ * 1) Define derived class of EmbedderGraph::Node for embedder objects.
+ * 2) Set the build embedder graph callback on the heap profiler using
+ *    HeapProfiler::SetBuildEmbedderGraphCallback.
+ * 3) In the callback use graph->AddEdge(node1, node2) to add an edge from
+ *    node1 to node2.
+ * 4) To represent references from/to V8 object, construct V8 nodes using
+ *    graph->V8Node(value).
+ */
+class V8_EXPORT EmbedderGraph {
+ public:
+  class Node {
+   public:
+    Node() = default;
+    virtual ~Node() = default;
+    virtual const char* Name() = 0;
+    virtual size_t SizeInBytes() = 0;
+    /**
+     * The corresponding V8 wrapper node if not null.
+     * During heap snapshot generation the embedder node and the V8 wrapper
+     * node will be merged into one node to simplify retaining paths.
+     */
+    virtual Node* WrapperNode() { return nullptr; }
+    virtual bool IsRootNode() { return false; }
+    /** Must return true for non-V8 nodes. */
+    virtual bool IsEmbedderNode() { return true; }
+    /**
+     * Optional name prefix. It is used in Chrome for tagging detached nodes.
+     */
+    virtual const char* NamePrefix() { return nullptr; }
+
+   private:
+    Node(const Node&) = delete;
+    Node& operator=(const Node&) = delete;
+  };
+
+  /**
+   * Returns a node corresponding to the given V8 value. Ownership is not
+   * transferred. The result pointer is valid while the graph is alive.
+   */
+  virtual Node* V8Node(const v8::Local<v8::Value>& value) = 0;
+
+  /**
+   * Adds the given node to the graph and takes ownership of the node.
+   * Returns a raw pointer to the node that is valid while the graph is alive.
+   */
+  virtual Node* AddNode(std::unique_ptr<Node> node) = 0;
+
+  /**
+   * Adds an edge that represents a strong reference from the given node
+   * |from| to the given node |to|. The nodes must be added to the graph
+   * before calling this function.
+   */
+  virtual void AddEdge(Node* from, Node* to) = 0;
+
+  virtual ~EmbedderGraph() = default;
+};
 
 /**
  * Interface for controlling heap profiling. Instance of the
@@ -665,6 +729,15 @@ class V8_EXPORT HeapProfiler {
   typedef RetainedObjectInfo* (*WrapperInfoCallback)(uint16_t class_id,
                                                      Local<Value> wrapper);
 
+  /**
+   * Callback function invoked during heap snapshot generation to retrieve
+   * the embedder object graph. The callback should use graph->AddEdge(..) to
+   * add references between the objects.
+   * The callback must not trigger garbage collection in V8.
+   */
+  typedef void (*BuildEmbedderGraphCallback)(v8::Isolate* isolate,
+                                             v8::EmbedderGraph* graph);
+
   /** Returns the number of snapshots taken. */
   int GetSnapshotCount();
 
@@ -804,11 +877,16 @@ class V8_EXPORT HeapProfiler {
   void DeleteAllHeapSnapshots();
 
   /** Binds a callback to embedder's class ID. */
-  void SetWrapperClassInfoProvider(
-      uint16_t class_id,
-      WrapperInfoCallback callback);
+  V8_DEPRECATED(
+      "Use SetBuildEmbedderGraphCallback to provide info about embedder nodes",
+      void SetWrapperClassInfoProvider(uint16_t class_id,
+                                       WrapperInfoCallback callback));
+
+  V8_DEPRECATED(
+      "Use SetBuildEmbedderGraphCallback to provide info about embedder nodes",
+      void SetGetRetainerInfosCallback(GetRetainerInfosCallback callback));
 
-  void SetGetRetainerInfosCallback(GetRetainerInfosCallback callback);
+  void SetBuildEmbedderGraphCallback(BuildEmbedderGraphCallback callback);
 
   /**
    * Default value of persistent handle class ID. Must not be used to
diff --git a/deps/v8/include/v8-util.h b/deps/v8/include/v8-util.h
index 15ea225dc12..a3069651222 100644
--- a/deps/v8/include/v8-util.h
+++ b/deps/v8/include/v8-util.h
@@ -196,16 +196,6 @@ class PersistentValueMapBase {
     return SetReturnValueFromVal(&returnValue, Traits::Get(&impl_, key));
   }
 
-  /**
-   * Call Isolate::SetReference with the given parent and the map value.
-   */
-  void SetReference(const K& key,
-      const Persistent<Object>& parent) {
-    GetIsolate()->SetReference(
-      reinterpret_cast<internal::Object**>(parent.val_),
-      reinterpret_cast<internal::Object**>(FromVal(Traits::Get(&impl_, key))));
-  }
-
   /**
    * Call V8::RegisterExternallyReferencedObject with the map value for given
    * key.
diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
index 71f3b774a33..7555557759b 100644
--- a/deps/v8/include/v8-version.h
+++ b/deps/v8/include/v8-version.h
@@ -9,9 +9,9 @@
 // NOTE these macros are used by some of the tool scripts and the build
 // system so their names cannot be changed without changing the scripts.
 #define V8_MAJOR_VERSION 6
-#define V8_MINOR_VERSION 5
-#define V8_BUILD_NUMBER 254
-#define V8_PATCH_LEVEL 43
+#define V8_MINOR_VERSION 7
+#define V8_BUILD_NUMBER 213
+#define V8_PATCH_LEVEL 0
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/deps/v8/include/v8.h b/deps/v8/include/v8.h
index d5b554dc966..9fd9d0887cc 100644
--- a/deps/v8/include/v8.h
+++ b/deps/v8/include/v8.h
@@ -66,6 +66,8 @@ namespace v8 {
 class AccessorSignature;
 class Array;
 class ArrayBuffer;
+class BigInt;
+class BigIntObject;
 class Boolean;
 class BooleanObject;
 class Context;
@@ -145,7 +147,7 @@ class Heap;
 class HeapObject;
 class Isolate;
 class Object;
-struct StreamedSource;
+struct ScriptStreamingData;
 template<typename T> class CustomArguments;
 class PropertyCallbackArguments;
 class FunctionCallbackArguments;
@@ -553,6 +555,14 @@ template <class T> class PersistentBase {
   // TODO(dcarney): remove this.
   V8_INLINE void ClearWeak() { ClearWeak<void>(); }
 
+  /**
+   * Annotates the strong handle with the given label, which is then used by the
+   * heap snapshot generator as a name of the edge from the root to the handle.
+   * The function does not take ownership of the label and assumes that the
+   * label is valid as long as the handle is valid.
+   */
+  V8_INLINE void AnnotateStrongRetainer(const char* label);
+
   /**
    * Allows the embedder to tell the v8 garbage collector that a certain object
    * is alive. Only allowed when the embedder is asked to trace its heap by
@@ -945,7 +955,7 @@ class V8_EXPORT EscapableHandleScope : public HandleScope {
  */
 class V8_EXPORT SealHandleScope {
  public:
-  SealHandleScope(Isolate* isolate);
+  explicit SealHandleScope(Isolate* isolate);
   ~SealHandleScope();
 
   SealHandleScope(const SealHandleScope&) = delete;
@@ -1136,6 +1146,7 @@ class V8_EXPORT Module {
  public:
   /**
    * The different states a module can be in.
+   *
    * This corresponds to the states used in ECMAScript except that "evaluated"
    * is split into kEvaluated and kErrored, indicating success and failure,
    * respectively.
@@ -1186,7 +1197,7 @@ class V8_EXPORT Module {
                                                 Local<Module> referrer);
 
   /**
-   * ModuleDeclarationInstantiation
+   * Instantiates the module and its dependencies.
    *
    * Returns an empty Maybe<bool> if an exception occurred during
    * instantiation. (In the case where the callback throws an exception, that
@@ -1196,16 +1207,19 @@ class V8_EXPORT Module {
                                                       ResolveCallback callback);
 
   /**
-   * ModuleEvaluation
+   * Evaluates the module and its dependencies.
    *
-   * Returns the completion value.
-   * TODO(neis): Be more precise or say nothing.
+   * If status is kInstantiated, run the module's code. On success, set status
+   * to kEvaluated and return the completion value; on failure, set status to
+   * kErrored and propagate the thrown exception (which is then also available
+   * via |GetException|).
    */
   V8_WARN_UNUSED_RESULT MaybeLocal<Value> Evaluate(Local<Context> context);
 
   /**
    * Returns the namespace object of this module.
-   * The module's status must be kEvaluated.
+   *
+   * The module's status must be at least kInstantiated.
    */
   Local<Value> GetModuleNamespace();
 };
@@ -1219,24 +1233,23 @@ class V8_EXPORT Script {
   /**
    * A shorthand for ScriptCompiler::Compile().
    */
-  static V8_DEPRECATE_SOON(
-      "Use maybe version",
-      Local<Script> Compile(Local<String> source,
-                            ScriptOrigin* origin = nullptr));
+  static V8_DEPRECATED("Use maybe version",
+                       Local<Script> Compile(Local<String> source,
+                                             ScriptOrigin* origin = nullptr));
   static V8_WARN_UNUSED_RESULT MaybeLocal<Script> Compile(
       Local<Context> context, Local<String> source,
       ScriptOrigin* origin = nullptr);
 
-  static Local<Script> V8_DEPRECATE_SOON("Use maybe version",
-                                         Compile(Local<String> source,
-                                                 Local<String> file_name));
+  static Local<Script> V8_DEPRECATED("Use maybe version",
+                                     Compile(Local<String> source,
+                                             Local<String> file_name));
 
   /**
    * Runs the script returning the resulting value. It will be run in the
    * context in which it was created (ScriptCompiler::CompileBound or
    * UnboundScript::BindToCurrentContext()).
    */
-  V8_DEPRECATE_SOON("Use maybe version", Local<Value> Run());
+  V8_DEPRECATED("Use maybe version", Local<Value> Run());
   V8_WARN_UNUSED_RESULT MaybeLocal<Value> Run(Local<Context> context);
 
   /**
@@ -1395,14 +1408,14 @@ class V8_EXPORT ScriptCompiler {
     // object is alive.
     const CachedData* GetCachedData() const;
 
-    internal::StreamedSource* impl() const { return impl_; }
+    internal::ScriptStreamingData* impl() const { return impl_; }
 
     // Prevent copying.
     StreamedSource(const StreamedSource&) = delete;
     StreamedSource& operator=(const StreamedSource&) = delete;
 
    private:
-    internal::StreamedSource* impl_;
+    internal::ScriptStreamingData* impl_;
   };
 
   /**
@@ -1546,17 +1559,19 @@ class V8_EXPORT ScriptCompiler {
    * It is possible to specify multiple context extensions (obj in the above
    * example).
    */
-  static V8_DEPRECATE_SOON("Use maybe version",
-                           Local<Function> CompileFunctionInContext(
-                               Isolate* isolate, Source* source,
-                               Local<Context> context, size_t arguments_count,
-                               Local<String> arguments[],
-                               size_t context_extension_count,
-                               Local<Object> context_extensions[]));
+  static V8_DEPRECATED("Use maybe version",
+                       Local<Function> CompileFunctionInContext(
+                           Isolate* isolate, Source* source,
+                           Local<Context> context, size_t arguments_count,
+                           Local<String> arguments[],
+                           size_t context_extension_count,
+                           Local<Object> context_extensions[]));
   static V8_WARN_UNUSED_RESULT MaybeLocal<Function> CompileFunctionInContext(
       Local<Context> context, Source* source, size_t arguments_count,
       Local<String> arguments[], size_t context_extension_count,
-      Local<Object> context_extensions[]);
+      Local<Object> context_extensions[],
+      CompileOptions options = kNoCompileOptions,
+      NoCacheReason no_cache_reason = kNoCacheNoReason);
 
   /**
    * Creates and returns code cache for the specified unbound_script.
@@ -1566,6 +1581,15 @@ class V8_EXPORT ScriptCompiler {
   static CachedData* CreateCodeCache(Local<UnboundScript> unbound_script,
                                      Local<String> source);
 
+  /**
+   * Creates and returns code cache for the specified function that was
+   * previously produced by CompileFunctionInContext.
+   * This will return nullptr if the script cannot be serialized. The
+   * CachedData returned by this function should be owned by the caller.
+   */
+  static CachedData* CreateCodeCacheForFunction(Local<Function> function,
+                                                Local<String> source);
+
  private:
   static V8_WARN_UNUSED_RESULT MaybeLocal<UnboundScript> CompileUnboundInternal(
       Isolate* isolate, Source* source, CompileOptions options,
@@ -1580,7 +1604,7 @@ class V8_EXPORT Message {
  public:
   Local<String> Get() const;
 
-  V8_DEPRECATE_SOON("Use maybe version", Local<String> GetSourceLine() const);
+  V8_DEPRECATED("Use maybe version", Local<String> GetSourceLine() const);
   V8_WARN_UNUSED_RESULT MaybeLocal<String> GetSourceLine(
       Local<Context> context) const;
 
@@ -1606,7 +1630,7 @@ class V8_EXPORT Message {
   /**
    * Returns the number, 1-based, of the line where the error occurred.
    */
-  V8_DEPRECATE_SOON("Use maybe version", int GetLineNumber() const);
+  V8_DEPRECATED("Use maybe version", int GetLineNumber() const);
   V8_WARN_UNUSED_RESULT Maybe<int> GetLineNumber(Local<Context> context) const;
 
   /**
@@ -1630,13 +1654,14 @@ class V8_EXPORT Message {
    * Returns the index within the line of the first character where
    * the error occurred.
    */
-  V8_DEPRECATE_SOON("Use maybe version", int GetStartColumn() const);
+  int GetStartColumn() const;
   V8_WARN_UNUSED_RESULT Maybe<int> GetStartColumn(Local<Context> context) const;
 
   /**
    * Returns the index within the line of the last character where
    * the error occurred.
    */
+  int GetEndColumn() const;
   V8_WARN_UNUSED_RESULT Maybe<int> GetEndColumn(Local<Context> context) const;
 
   /**
@@ -1864,7 +1889,7 @@ class V8_EXPORT ValueSerializer {
      * SharedArrayBuffer object. The embedder must return an ID for the
      * object, using the same ID if this SharedArrayBuffer has already been
      * serialized in this buffer. When deserializing, this ID will be passed to
-     * ValueDeserializer::TransferSharedArrayBuffer as |transfer_id|.
+     * ValueDeserializer::GetSharedArrayBufferFromId as |clone_id|.
      *
      * If the object cannot be serialized, an
      * exception should be thrown and Nothing<uint32_t>() returned.
@@ -1991,6 +2016,13 @@ class V8_EXPORT ValueDeserializer {
      */
     virtual MaybeLocal<WasmCompiledModule> GetWasmModuleFromId(
         Isolate* isolate, uint32_t transfer_id);
+
+    /**
+     * Get a SharedArrayBuffer given a clone_id previously provided
+     * by ValueSerializer::GetSharedArrayBufferId
+     */
+    virtual MaybeLocal<SharedArrayBuffer> GetSharedArrayBufferFromId(
+        Isolate* isolate, uint32_t clone_id);
   };
 
   ValueDeserializer(Isolate* isolate, const uint8_t* data, size_t size);
@@ -2133,6 +2165,11 @@ class V8_EXPORT Value : public Data {
    */
   bool IsObject() const;
 
+  /**
+   * Returns true if this value is a bigint.
+   */
+  bool IsBigInt() const;
+
   /**
    * Returns true if this value is boolean.
    */
@@ -2168,6 +2205,11 @@ class V8_EXPORT Value : public Data {
    */
   bool IsArgumentsObject() const;
 
+  /**
+   * Returns true if this value is a BigInt object.
+   */
+  bool IsBigIntObject() const;
+
   /**
    * Returns true if this value is a Boolean object.
    */
@@ -2308,6 +2350,16 @@ class V8_EXPORT Value : public Data {
    */
   bool IsFloat64Array() const;
 
+  /**
+   * Returns true if this value is a BigInt64Array.
+   */
+  bool IsBigInt64Array() const;
+
+  /**
+   * Returns true if this value is a BigUint64Array.
+   */
+  bool IsBigUint64Array() const;
+
   /**
    * Returns true if this value is a DataView.
    */
@@ -2326,6 +2378,8 @@ class V8_EXPORT Value : public Data {
 
   bool IsWebAssemblyCompiledModule() const;
 
+  V8_WARN_UNUSED_RESULT MaybeLocal<BigInt> ToBigInt(
+      Local<Context> context) const;
   V8_WARN_UNUSED_RESULT MaybeLocal<Boolean> ToBoolean(
       Local<Context> context) const;
   V8_WARN_UNUSED_RESULT MaybeLocal<Number> ToNumber(
@@ -2783,8 +2837,8 @@ class V8_EXPORT String : public Name {
    */
   class V8_EXPORT Utf8Value {
    public:
-    V8_DEPRECATE_SOON("Use Isolate version",
-                      explicit Utf8Value(Local<v8::Value> obj));
+    V8_DEPRECATED("Use Isolate version",
+                  explicit Utf8Value(Local<v8::Value> obj));
     Utf8Value(Isolate* isolate, Local<v8::Value> obj);
     ~Utf8Value();
     char* operator*() { return str_; }
@@ -2808,8 +2862,7 @@ class V8_EXPORT String : public Name {
    */
   class V8_EXPORT Value {
    public:
-    V8_DEPRECATE_SOON("Use Isolate version",
-                      explicit Value(Local<v8::Value> obj));
+    V8_DEPRECATED("Use Isolate version", explicit Value(Local<v8::Value> obj));
     Value(Isolate* isolate, Local<v8::Value> obj);
     ~Value();
     uint16_t* operator*() { return str_; }
@@ -2978,6 +3031,19 @@ class V8_EXPORT Uint32 : public Integer {
   static void CheckCast(v8::Value* obj);
 };
 
+/**
+ * A JavaScript BigInt value (https://tc39.github.io/proposal-bigint)
+ */
+class V8_EXPORT BigInt : public Primitive {
+ public:
+  static Local<BigInt> New(Isolate* isolate, int64_t value);
+  V8_INLINE static BigInt* Cast(v8::Value* obj);
+
+ private:
+  BigInt();
+  static void CheckCast(v8::Value* obj);
+};
+
 /**
  * PropertyAttribute.
  */
@@ -3054,10 +3120,16 @@ enum class KeyCollectionMode { kOwnOnly, kIncludePrototypes };
 
 /**
  * kIncludesIndices allows for integer indices to be collected, while
- * kSkipIndices will exclude integer indicies from being collected.
+ * kSkipIndices will exclude integer indices from being collected.
  */
 enum class IndexFilter { kIncludeIndices, kSkipIndices };
 
+/**
+ * kConvertToString will convert integer indices to strings.
+ * kKeepNumbers will return numbers for integer indices.
+ */
+enum class KeyConversionMode { kConvertToString, kKeepNumbers };
+
 /**
  * Integrity level for objects.
  */
@@ -3192,6 +3264,19 @@ class V8_EXPORT Object : public Value {
       AccessorNameSetterCallback setter = nullptr,
       Local<Value> data = Local<Value>(), PropertyAttribute attributes = None);
 
+  /**
+   * Attempts to create a property with the given name which behaves like a data
+   * property, except that the provided getter is invoked (and provided with the
+   * data value) to supply its value the first time it is read. After the
+   * property is accessed once, it is replaced with an ordinary data property.
+   *
+   * Analogous to Template::SetLazyDataProperty.
+   */
+  V8_WARN_UNUSED_RESULT Maybe<bool> SetLazyDataProperty(
+      Local<Context> context, Local<Name> name,
+      AccessorNameGetterCallback getter, Local<Value> data = Local<Value>(),
+      PropertyAttribute attributes = None);
+
   /**
    * Functionality for private properties.
    * This is an experimental feature, use at your own risk.
@@ -3215,7 +3300,8 @@ class V8_EXPORT Object : public Value {
       Local<Context> context);
   V8_WARN_UNUSED_RESULT MaybeLocal<Array> GetPropertyNames(
       Local<Context> context, KeyCollectionMode mode,
-      PropertyFilter property_filter, IndexFilter index_filter);
+      PropertyFilter property_filter, IndexFilter index_filter,
+      KeyConversionMode key_conversion = KeyConversionMode::kKeepNumbers);
 
   /**
    * This function has the same functionality as GetPropertyNames but
@@ -3233,7 +3319,8 @@ class V8_EXPORT Object : public Value {
    * be enumerated by a for-in statement over this object.
    */
   V8_WARN_UNUSED_RESULT MaybeLocal<Array> GetOwnPropertyNames(
-      Local<Context> context, PropertyFilter filter);
+      Local<Context> context, PropertyFilter filter,
+      KeyConversionMode key_conversion = KeyConversionMode::kKeepNumbers);
 
   /**
    * Get the prototype object.  This does not skip objects marked to
@@ -3443,7 +3530,7 @@ class V8_EXPORT Object : public Value {
   /**
    * Return the isolate to which the Object belongs to.
    */
-  V8_DEPRECATE_SOON("Keep track of isolate correctly", Isolate* GetIsolate());
+  Isolate* GetIsolate();
 
   static Local<Object> New(Isolate* isolate);
 
@@ -4046,11 +4133,15 @@ class V8_EXPORT Proxy : public Object {
 class V8_EXPORT WasmCompiledModule : public Object {
  public:
   typedef std::pair<std::unique_ptr<const uint8_t[]>, size_t> SerializedModule;
-  // A buffer that is owned by the caller.
+  /**
+   * A buffer that is owned by the caller.
+   */
   typedef std::pair<const uint8_t*, size_t> CallerOwnedBuffer;
 
-  // An opaque, native heap object for transferring wasm modules. It
-  // supports move semantics, and does not support copy semantics.
+  /**
+   * An opaque, native heap object for transferring wasm modules. It
+   * supports move semantics, and does not support copy semantics.
+   */
   class TransferrableModule final {
    public:
     TransferrableModule(TransferrableModule&& src) = default;
@@ -4069,35 +4160,41 @@ class V8_EXPORT WasmCompiledModule : public Object {
     OwnedBuffer wire_bytes = {nullptr, 0};
   };
 
-  // Get an in-memory, non-persistable, and context-independent (meaning,
-  // suitable for transfer to another Isolate and Context) representation
-  // of this wasm compiled module.
+  /**
+   * Get an in-memory, non-persistable, and context-independent (meaning,
+   * suitable for transfer to another Isolate and Context) representation
+   * of this wasm compiled module.
+   */
   TransferrableModule GetTransferrableModule();
 
-  // Efficiently re-create a WasmCompiledModule, without recompiling, from
-  // a TransferrableModule.
+  /**
+   * Efficiently re-create a WasmCompiledModule, without recompiling, from
+   * a TransferrableModule.
+   */
   static MaybeLocal<WasmCompiledModule> FromTransferrableModule(
       Isolate* isolate, const TransferrableModule&);
 
-  // Get the wasm-encoded bytes that were used to compile this module.
+  /**
+   * Get the wasm-encoded bytes that were used to compile this module.
+   */
   Local<String> GetWasmWireBytes();
 
-  // Serialize the compiled module. The serialized data does not include the
-  // uncompiled bytes.
+  /**
+   * Serialize the compiled module. The serialized data does not include the
+   * uncompiled bytes.
+   */
   SerializedModule Serialize();
 
-  // If possible, deserialize the module, otherwise compile it from the provided
-  // uncompiled bytes.
+  /**
+   * If possible, deserialize the module, otherwise compile it from the provided
+   * uncompiled bytes.
+   */
   static MaybeLocal<WasmCompiledModule> DeserializeOrCompile(
       Isolate* isolate, const CallerOwnedBuffer& serialized_module,
       const CallerOwnedBuffer& wire_bytes);
   V8_INLINE static WasmCompiledModule* Cast(Value* obj);
 
  private:
-  // TODO(ahaas): please remove the friend once streamed compilation is
-  // implemented
-  friend class WasmModuleObjectBuilder;
-
   static MaybeLocal<WasmCompiledModule> Deserialize(
       Isolate* isolate, const CallerOwnedBuffer& serialized_module,
       const CallerOwnedBuffer& wire_bytes);
@@ -4117,11 +4214,18 @@ class V8_EXPORT WasmCompiledModule : public Object {
 // to simply WasmModuleObjectBuilder
 class V8_EXPORT WasmModuleObjectBuilderStreaming final {
  public:
-  WasmModuleObjectBuilderStreaming(Isolate* isolate);
-  // The buffer passed into OnBytesReceived is owned by the caller.
+  explicit WasmModuleObjectBuilderStreaming(Isolate* isolate);
+  /**
+   * The buffer passed into OnBytesReceived is owned by the caller.
+   */
   void OnBytesReceived(const uint8_t*, size_t size);
   void Finish();
-  void Abort(Local<Value> exception);
+  /**
+   * Abort streaming compilation. If {exception} has a value, then the promise
+   * associated with streaming compilation is rejected with that value. If
+   * {exception} does not have value, the promise does not get rejected.
+   */
+  void Abort(MaybeLocal<Value> exception);
   Local<Promise> GetPromise();
 
   ~WasmModuleObjectBuilderStreaming();
@@ -4140,11 +4244,13 @@ class V8_EXPORT WasmModuleObjectBuilderStreaming final {
   Isolate* isolate_ = nullptr;
 
 #if V8_CC_MSVC
-  // We don't need the static Copy API, so the default
-  // NonCopyablePersistentTraits would be sufficient, however,
-  // MSVC eagerly instantiates the Copy.
-  // We ensure we don't use Copy, however, by compiling with the
-  // defaults everywhere else.
+  /**
+   * We don't need the static Copy API, so the default
+   * NonCopyablePersistentTraits would be sufficient, however,
+   * MSVC eagerly instantiates the Copy.
+   * We ensure we don't use Copy, however, by compiling with the
+   * defaults everywhere else.
+   */
   Persistent<Promise, CopyablePersistentTraits<Promise>> promise_;
 #else
   Persistent<Promise> promise_;
@@ -4154,30 +4260,6 @@ class V8_EXPORT WasmModuleObjectBuilderStreaming final {
   std::shared_ptr<internal::wasm::StreamingDecoder> streaming_decoder_;
 };
 
-class V8_EXPORT WasmModuleObjectBuilder final {
- public:
-  WasmModuleObjectBuilder(Isolate* isolate) : isolate_(isolate) {}
-  // The buffer passed into OnBytesReceived is owned by the caller.
-  void OnBytesReceived(const uint8_t*, size_t size);
-  MaybeLocal<WasmCompiledModule> Finish();
-
- private:
-  Isolate* isolate_ = nullptr;
-  // TODO(ahaas): We probably need none of this below here once streamed
-  // compilation is implemented.
-  typedef std::pair<std::unique_ptr<const uint8_t[]>, size_t> Buffer;
-
-  // Disable copy semantics *in this implementation*. We can choose to
-  // relax this, albeit it's not clear why.
-  WasmModuleObjectBuilder(const WasmModuleObjectBuilder&) = delete;
-  WasmModuleObjectBuilder(WasmModuleObjectBuilder&&) = default;
-  WasmModuleObjectBuilder& operator=(const WasmModuleObjectBuilder&) = delete;
-  WasmModuleObjectBuilder& operator=(WasmModuleObjectBuilder&&) = default;
-
-  std::vector<Buffer> received_buffers_;
-  size_t total_size_ = 0;
-};
-
 #ifndef V8_ARRAY_BUFFER_INTERNAL_FIELD_COUNT
 // The number of required internal fields can be defined by embedder.
 #define V8_ARRAY_BUFFER_INTERNAL_FIELD_COUNT 2
@@ -4223,41 +4305,18 @@ class V8_EXPORT ArrayBuffer : public Object {
      */
     virtual void* AllocateUninitialized(size_t length) = 0;
 
-    /**
-     * Reserved |length| bytes, but do not commit the memory. Must call
-     * |SetProtection| to make memory accessible.
-     */
-    // TODO(eholk): make this pure virtual once blink implements this.
-    virtual void* Reserve(size_t length);
-
     /**
      * Free the memory block of size |length|, pointed to by |data|.
      * That memory is guaranteed to be previously allocated by |Allocate|.
      */
     virtual void Free(void* data, size_t length) = 0;
 
-    enum class AllocationMode { kNormal, kReservation };
-
-    /**
-     * Free the memory block of size |length|, pointed to by |data|.
-     * That memory is guaranteed to be previously allocated by |Allocate| or
-     * |Reserve|, depending on |mode|.
-     */
-    // TODO(eholk): make this pure virtual once blink implements this.
-    virtual void Free(void* data, size_t length, AllocationMode mode);
-
-    enum class Protection { kNoAccess, kReadWrite };
-
     /**
-     * Change the protection on a region of memory.
-     *
-     * On platforms that make a distinction between reserving and committing
-     * memory, changing the protection to kReadWrite must also ensure the memory
-     * is committed.
+     * ArrayBuffer allocation mode. kNormal is a malloc/free style allocation,
+     * while kReservation is for larger allocations with the ability to set
+     * access permissions.
      */
-    // TODO(eholk): make this pure virtual once blink implements this.
-    virtual void SetProtection(void* data, size_t length,
-                               Protection protection);
+    enum class AllocationMode { kNormal, kReservation };
 
     /**
      * malloc/free based convenience allocator.
@@ -4617,6 +4676,37 @@ class V8_EXPORT Float64Array : public TypedArray {
   static void CheckCast(Value* obj);
 };
 
+/**
+ * An instance of BigInt64Array constructor.
+ */
+class V8_EXPORT BigInt64Array : public TypedArray {
+ public:
+  static Local<BigInt64Array> New(Local<ArrayBuffer> array_buffer,
+                                  size_t byte_offset, size_t length);
+  static Local<BigInt64Array> New(Local<SharedArrayBuffer> shared_array_buffer,
+                                  size_t byte_offset, size_t length);
+  V8_INLINE static BigInt64Array* Cast(Value* obj);
+
+ private:
+  BigInt64Array();
+  static void CheckCast(Value* obj);
+};
+
+/**
+ * An instance of BigUint64Array constructor.
+ */
+class V8_EXPORT BigUint64Array : public TypedArray {
+ public:
+  static Local<BigUint64Array> New(Local<ArrayBuffer> array_buffer,
+                                   size_t byte_offset, size_t length);
+  static Local<BigUint64Array> New(Local<SharedArrayBuffer> shared_array_buffer,
+                                   size_t byte_offset, size_t length);
+  V8_INLINE static BigUint64Array* Cast(Value* obj);
+
+ private:
+  BigUint64Array();
+  static void CheckCast(Value* obj);
+};
 
 /**
  * An instance of DataView constructor (ES6 draft 15.13.7).
@@ -4800,6 +4890,20 @@ class V8_EXPORT NumberObject : public Object {
   static void CheckCast(Value* obj);
 };
 
+/**
+ * A BigInt object (https://tc39.github.io/proposal-bigint)
+ */
+class V8_EXPORT BigIntObject : public Object {
+ public:
+  static Local<Value> New(Isolate* isolate, int64_t value);
+
+  Local<BigInt> ValueOf() const;
+
+  V8_INLINE static BigIntObject* Cast(Value* obj);
+
+ private:
+  static void CheckCast(Value* obj);
+};
 
 /**
  * A Boolean object (ECMA-262, 4.3.15).
@@ -4878,9 +4982,8 @@ class V8_EXPORT RegExp : public Object {
    *               static_cast<RegExp::Flags>(kGlobal | kMultiline))
    * is equivalent to evaluating "/foo/gm".
    */
-  static V8_DEPRECATE_SOON("Use maybe version",
-                           Local<RegExp> New(Local<String> pattern,
-                                             Flags flags));
+  static V8_DEPRECATED("Use maybe version",
+                       Local<RegExp> New(Local<String> pattern, Flags flags));
   static V8_WARN_UNUSED_RESULT MaybeLocal<RegExp> New(Local<Context> context,
                                                       Local<String> pattern,
                                                       Flags flags);
@@ -5462,7 +5565,7 @@ class V8_EXPORT FunctionTemplate : public Template {
 
   /**
    * Causes the function template to inherit from a parent function template.
-   * This means the the function's prototype.__proto__ is set to the parent
+   * This means the function's prototype.__proto__ is set to the parent
    * function's prototype.
    **/
   void Inherit(Local<FunctionTemplate> parent);
@@ -5750,7 +5853,7 @@ class V8_EXPORT ObjectTemplate : public Template {
    * \param data A piece of data that will be passed to the callbacks
    *   whenever they are invoked.
    */
-  V8_DEPRECATE_SOON(
+  V8_DEPRECATED(
       "Use SetHandler(const NamedPropertyHandlerConfiguration) "
       "with the kOnlyInterceptStrings flag set.",
       void SetNamedPropertyHandler(
@@ -6139,24 +6242,6 @@ typedef void* (*CreateHistogramCallback)(const char* name,
 
 typedef void (*AddHistogramSampleCallback)(void* histogram, int sample);
 
-// --- Memory Allocation Callback ---
-enum ObjectSpace {
-  kObjectSpaceNewSpace = 1 << 0,
-  kObjectSpaceOldSpace = 1 << 1,
-  kObjectSpaceCodeSpace = 1 << 2,
-  kObjectSpaceMapSpace = 1 << 3,
-  kObjectSpaceLoSpace = 1 << 4,
-  kObjectSpaceAll = kObjectSpaceNewSpace | kObjectSpaceOldSpace |
-                    kObjectSpaceCodeSpace | kObjectSpaceMapSpace |
-                    kObjectSpaceLoSpace
-};
-
-  enum AllocationAction {
-    kAllocationActionAllocate = 1 << 0,
-    kAllocationActionFree = 1 << 1,
-    kAllocationActionAll = kAllocationActionAllocate | kAllocationActionFree
-  };
-
 // --- Enter/Leave Script Callback ---
 typedef void (*BeforeCallEnteredCallback)(Isolate*);
 typedef void (*CallCompletedCallback)(Isolate*);
@@ -6375,6 +6460,15 @@ typedef void (*GCCallback)(GCType type, GCCallbackFlags flags);
 
 typedef void (*InterruptCallback)(Isolate* isolate, void* data);
 
+/**
+ * This callback is invoked when the heap size is close to the heap limit and
+ * V8 is likely to abort with out-of-memory error.
+ * The callback can extend the heap limit by returning a value that is greater
+ * than the current_heap_limit. The initial heap limit is the limit that was
+ * set after heap setup.
+ */
+typedef size_t (*NearHeapLimitCallback)(void* data, size_t current_heap_limit,
+                                        size_t initial_heap_limit);
 
 /**
  * Collection of V8 heap information.
@@ -6508,8 +6602,17 @@ struct JitCodeEvent {
   // statement, and is used to indicate possible break locations.
   enum PositionType { POSITION, STATEMENT_POSITION };
 
+  // There are two different kinds of JitCodeEvents, one for JIT code generated
+  // by the optimizing compiler, and one for byte code generated for the
+  // interpreter.  For JIT_CODE events, the |code_start| member of the event
+  // points to the beginning of jitted assembly code, while for BYTE_CODE
+  // events, |code_start| points to the first bytecode of the interpreted
+  // function.
+  enum CodeType { BYTE_CODE, JIT_CODE };
+
   // Type of event.
   EventType type;
+  CodeType code_type;
   // Start of the instructions.
   void* code_start;
   // Size of the instructions.
@@ -7208,6 +7311,11 @@ class V8_EXPORT Isolate {
   V8_DEPRECATED("CpuProfiler should be created with CpuProfiler::New call.",
                 CpuProfiler* GetCpuProfiler());
 
+  /**
+   * Tells the CPU profiler whether the embedder is idle.
+   */
+  void SetIdle(bool is_idle);
+
   /** Returns true if this isolate has a current context. */
   bool InContext();
 
@@ -7437,7 +7545,7 @@ class V8_EXPORT Isolate {
   /**
    * Enqueues the callback to the Microtask Work Queue
    */
-  void EnqueueMicrotask(MicrotaskCallback microtask, void* data = NULL);
+  void EnqueueMicrotask(MicrotaskCallback callback, void* data = nullptr);
 
   /**
    * Controls how Microtasks are invoked. See MicrotasksPolicy for details.
@@ -7619,6 +7727,23 @@ class V8_EXPORT Isolate {
   /** Set the callback to invoke in case of OOM errors. */
   void SetOOMErrorHandler(OOMErrorCallback that);
 
+  /**
+   * Add a callback to invoke in case the heap size is close to the heap limit.
+   * If multiple callbacks are added, only the most recently added callback is
+   * invoked.
+   */
+  void AddNearHeapLimitCallback(NearHeapLimitCallback callback, void* data);
+
+  /**
+   * Remove the given callback and restore the heap limit to the
+   * given limit. If the given limit is zero, then it is ignored.
+   * If the current heap size is greater than the given limit,
+   * then the heap limit is restored to the minimal limit that
+   * is possible for the current heap size.
+   */
+  void RemoveNearHeapLimitCallback(NearHeapLimitCallback callback,
+                                   size_t heap_limit);
+
   /**
    * Set the callback to invoke to check if code generation from
    * strings should be allowed.
@@ -7874,6 +7999,15 @@ class V8_EXPORT V8 {
    */
   static bool Dispose();
 
+  /**
+   * Initialize the ICU library bundled with V8. The embedder should only
+   * invoke this method when using the bundled ICU. Returns true on success.
+   *
+   * If V8 was compiled with the ICU data in an external file, the location
+   * of the data file has to be provided.
+   */
+  static bool InitializeICU(const char* icu_data_file = nullptr);
+
   /**
    * Initialize the ICU library bundled with V8. The embedder should only
    * invoke this method when using the bundled ICU. If V8 was compiled with
@@ -7947,7 +8081,16 @@ class V8_EXPORT V8 {
    * Enable the default signal handler rather than using one provided by the
    * embedder.
    */
-  static bool RegisterDefaultSignalHandler();
+  V8_DEPRECATE_SOON("Use EnableWebAssemblyTrapHandler",
+                    static bool RegisterDefaultSignalHandler());
+
+  /**
+   * Activate trap-based bounds checking for WebAssembly.
+   *
+   * \param use_v8_signal_handler Whether V8 should install its own signal
+   * handler or rely on the embedder's.
+   */
+  static bool EnableWebAssemblyTrapHandler(bool use_v8_signal_handler);
 
  private:
   V8();
@@ -7967,6 +8110,8 @@ class V8_EXPORT V8 {
                        WeakCallbackInfo<void>::Callback weak_callback);
   static void MakeWeak(internal::Object*** location_addr);
   static void* ClearWeak(internal::Object** location);
+  static void AnnotateStrongRetainer(internal::Object** location,
+                                     const char* label);
   static Value* Eternalize(Isolate* isolate, Value* handle);
 
   static void RegisterExternallyReferencedObject(internal::Object** object,
@@ -8203,7 +8348,7 @@ class V8_EXPORT TryCatch {
    * all TryCatch blocks should be stack allocated because the memory
    * location itself is compared against JavaScript try/catch blocks.
    */
-  TryCatch(Isolate* isolate);
+  explicit TryCatch(Isolate* isolate);
 
   /**
    * Unregisters and deletes this try/catch block.
@@ -8504,6 +8649,11 @@ class V8_EXPORT Context {
    */
   enum EmbedderDataFields { kDebugIdIndex = 0 };
 
+  /**
+   * Return the number of fields allocated for embedder data.
+   */
+  uint32_t GetNumberOfEmbedderDataFields();
+
   /**
    * Gets the embedder data with the given index, which must have been set by a
    * previous call to SetEmbedderData with the same index.
@@ -8759,6 +8909,7 @@ const int kApiInt64Size = sizeof(int64_t);  // NOLINT
 
 // Tag information for HeapObject.
 const int kHeapObjectTag = 1;
+const int kWeakHeapObjectTag = 3;
 const int kHeapObjectTagSize = 2;
 const intptr_t kHeapObjectTagMask = (1 << kHeapObjectTagSize) - 1;
 
@@ -9174,6 +9325,12 @@ P* PersistentBase<T>::ClearWeak() {
     V8::ClearWeak(reinterpret_cast<internal::Object**>(this->val_)));
 }
 
+template <class T>
+void PersistentBase<T>::AnnotateStrongRetainer(const char* label) {
+  V8::AnnotateStrongRetainer(reinterpret_cast<internal::Object**>(this->val_),
+                             label);
+}
+
 template <class T>
 void PersistentBase<T>::RegisterExternalReference(Isolate* isolate) const {
   if (IsEmpty()) return;
@@ -9767,6 +9924,12 @@ Uint32* Uint32::Cast(v8::Value* value) {
   return static_cast<Uint32*>(value);
 }
 
+BigInt* BigInt::Cast(v8::Value* value) {
+#ifdef V8_ENABLE_CHECKS
+  CheckCast(value);
+#endif
+  return static_cast<BigInt*>(value);
+}
 
 Date* Date::Cast(v8::Value* value) {
 #ifdef V8_ENABLE_CHECKS
@@ -9799,6 +9962,12 @@ NumberObject* NumberObject::Cast(v8::Value* value) {
   return static_cast<NumberObject*>(value);
 }
 
+BigIntObject* BigIntObject::Cast(v8::Value* value) {
+#ifdef V8_ENABLE_CHECKS
+  CheckCast(value);
+#endif
+  return static_cast<BigIntObject*>(value);
+}
 
 BooleanObject* BooleanObject::Cast(v8::Value* value) {
 #ifdef V8_ENABLE_CHECKS
diff --git a/deps/v8/infra/config/cq.cfg b/deps/v8/infra/config/cq.cfg
index d57b117f10b..6159b3f1cde 100644
--- a/deps/v8/infra/config/cq.cfg
+++ b/deps/v8/infra/config/cq.cfg
@@ -31,11 +31,7 @@ verifiers {
         triggered_by: "v8_linux64_asan_rel_ng"
       }
       builders { name: "v8_linux64_gcc_compile_dbg" }
-      builders { name: "v8_linux64_gyp_rel_ng" }
-      builders {
-        name: "v8_linux64_gyp_rel_ng_triggered"
-        triggered_by: "v8_linux64_gyp_rel_ng"
-      }
+      builders { name: "v8_linux64_jumbo_compile_rel" }
       builders { name: "v8_linux64_rel_ng" }
       builders {
         name: "v8_linux64_rel_ng_triggered"
@@ -89,17 +85,14 @@ verifiers {
         name: "v8_linux_verify_csa_rel_ng_triggered"
         triggered_by: "v8_linux_verify_csa_rel_ng"
       }
-      builders { name: "v8_mac_rel_ng" }
+      builders { name: "v8_mac64_rel_ng" }
       builders {
-        name: "v8_mac_rel_ng_triggered"
-        triggered_by: "v8_mac_rel_ng"
+        name: "v8_mac64_rel_ng_triggered"
+        triggered_by: "v8_mac64_rel_ng"
       }
       builders { name: "v8_node_linux64_rel" }
       builders { name: "v8_presubmit" }
-      builders {
-        name: "v8_win64_msvc_compile_rel"
-        experiment_percentage: 20
-      }
+      builders { name: "v8_win64_msvc_compile_rel" }
       builders { name: "v8_win64_rel_ng" }
       builders {
         name: "v8_win64_rel_ng_triggered"
diff --git a/deps/v8/infra/mb/gn_isolate_map.pyl b/deps/v8/infra/mb/gn_isolate_map.pyl
new file mode 100644
index 00000000000..8f13079ea3d
--- /dev/null
+++ b/deps/v8/infra/mb/gn_isolate_map.pyl
@@ -0,0 +1,74 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# gn_isolate_map.pyl - A mapping of Ninja build target names to GN labels and
+# test type classifications for the tests that are run on the bots.
+#
+# This file is based on testing/buildbot/gn_isolate_map.pyl for Chromium, but
+# is covering V8 stand-alone tests instead.
+# See https://cs.chromium.org/chromium/src/testing/buildbot/gn_isolate_map.pyl
+# for more detailed documentation.
+
+{
+  "All": {
+    "label": "//:All",
+    "type": "script",
+  },
+  "benchmarks": {
+    "label": "//test/benchmarks:v8_benchmarks",
+    "type": "script",
+  },
+  "bot_default": {
+    "label": "//test:v8_bot_default",
+    "type": "script",
+  },
+  "check-static-initializers": {
+    "label": "//tools:v8_check_static_initializers",
+    "type": "script",
+  },
+  "d8_default": {
+    "label": "//test:v8_d8_default",
+    "type": "script",
+  },
+  "mjsunit": {
+    "label": "//test/mjsunit:v8_mjsunit",
+    "type": "script",
+  },
+  "mozilla": {
+    "label": "//test/mozilla:v8_mozilla",
+    "type": "script",
+  },
+  "optimize_for_size": {
+    "label": "//test:v8_optimize_for_size",
+    "type": "script",
+  },
+  "perf": {
+    "label": "//test:v8_perf",
+    "type": "script",
+  },
+  "jsfunfuzz": {
+    "label": "//tools/jsfunfuzz:v8_jsfunfuzz",
+    "type": "script",
+  },
+  "run-gcmole": {
+    "label": "//tools/gcmole:v8_run_gcmole",
+    "type": "script",
+  },
+  "run-num-fuzzer": {
+    "label": "//test:v8_run_num_fuzzer",
+    "type": "script",
+  },
+  "test262": {
+    "label": "//test/test262:v8_test262",
+    "type": "script",
+  },
+  "unittests": {
+    "label": "//test/unittests:unittests",
+    "type": "script",
+  },
+  "webkit": {
+    "label": "//test/webkit:v8_webkit",
+    "type": "script",
+  },
+}
\ No newline at end of file
diff --git a/deps/v8/infra/mb/mb_config.pyl b/deps/v8/infra/mb/mb_config.pyl
index e025c98f9e2..1a27849e920 100644
--- a/deps/v8/infra/mb/mb_config.pyl
+++ b/deps/v8/infra/mb/mb_config.pyl
@@ -45,565 +45,541 @@
     },
 
     'client.dart.fyi': {
-      'v8-linux-release': 'gn_release_x86_disassembler',
-      'v8-win-release': 'gn_release_x86_disassembler',
-      'v8-mac-release': 'gn_release_x86_disassembler',
+      'v8-linux-release': 'release_x86_disassembler',
+      'v8-win-release': 'release_x86_disassembler',
+      'v8-mac-release': 'release_x86_disassembler',
     },
     'client.dynamorio': {
-      'linux-v8-dr': 'gn_release_x64',
+      'linux-v8-dr': 'release_x64',
     },
     'client.v8': {
       # Linux.
-      'V8 Linux - builder': 'gn_release_x86_gcmole',
-      'V8 Linux - debug builder': 'gn_debug_x86',
-      'V8 Linux - nosnap builder': 'gn_release_x86_no_snap',
-      'V8 Linux - nosnap debug builder': 'gn_debug_x86_no_snap',
-      'V8 Linux - shared': 'gn_release_x86_shared_verify_heap',
-      'V8 Linux - noi18n - debug': 'gn_debug_x86_no_i18n',
-      'V8 Linux - verify csa': 'gn_release_x86_verify_csa',
+      'V8 Linux - builder': 'release_x86_gcmole',
+      'V8 Linux - debug builder': 'debug_x86',
+      'V8 Linux - nosnap builder': 'release_x86_no_snap',
+      'V8 Linux - nosnap debug builder': 'debug_x86_no_snap',
+      'V8 Linux - shared': 'release_x86_shared_verify_heap',
+      'V8 Linux - noi18n - debug': 'debug_x86_no_i18n',
+      'V8 Linux - verify csa': 'release_x86_verify_csa',
       # Linux64.
-      'V8 Linux64 - builder': 'gn_release_x64',
-      'V8 Linux64 - concurrent marking - builder': 'gn_release_x64_concurrent_marking',
-      'V8 Linux64 - debug builder': 'gn_debug_x64',
-      'V8 Linux64 - custom snapshot - debug builder': 'gn_debug_x64_custom',
-      'V8 Linux64 - internal snapshot': 'gn_release_x64_internal',
-      'V8 Linux64 - gyp': 'gyp_release_x64',
-      'V8 Linux64 - verify csa': 'gn_release_x64_verify_csa',
+      'V8 Linux64 - builder': 'release_x64',
+      'V8 Linux64 - concurrent marking - builder': 'release_x64_concurrent_marking',
+      'V8 Linux64 - debug builder': 'debug_x64',
+      'V8 Linux64 - custom snapshot - debug builder': 'debug_x64_custom',
+      'V8 Linux64 - internal snapshot': 'release_x64_internal',
+      'V8 Linux64 - verify csa': 'release_x64_verify_csa',
+      # Jumbo.
+      'V8 Linux64 Jumbo': 'release_x64_jumbo',
+      'V8 Linux64 Jumbo - debug': 'debug_x64_jumbo',
       # Windows.
-      'V8 Win32 - builder': 'gn_release_x86_minimal_symbols',
-      'V8 Win32 - debug builder': 'gn_debug_x86_minimal_symbols',
+      'V8 Win32 - builder': 'release_x86_minimal_symbols',
+      'V8 Win32 - debug builder': 'debug_x86_minimal_symbols',
       'V8 Win32 - nosnap - shared':
-        'gn_release_x86_no_snap_shared_minimal_symbols',
-      'V8 Win32 ASAN': 'gn_release_x86_asan_no_lsan',
-      'V8 Win64': 'gn_release_x64_minimal_symbols',
-      'V8 Win64 - debug': 'gn_debug_x64_minimal_symbols',
-      'V8 Win64 - msvc': 'gn_release_x64_msvc',
+        'release_x86_no_snap_shared_minimal_symbols',
+      # TODO(machenbach): Remove after switching to x64 on infra side.
+      'V8 Win64 ASAN': 'release_x64_asan_no_lsan',
+      'V8 Win64': 'release_x64_minimal_symbols',
+      'V8 Win64 - debug': 'debug_x64_minimal_symbols',
+      'V8 Win64 - msvc': 'release_x64_msvc',
       # Mac.
-      'V8 Mac': 'gn_release_x86',
-      'V8 Mac - debug': 'gn_debug_x86',
-      'V8 Mac64': 'gn_release_x64',
-      'V8 Mac64 - debug': 'gn_debug_x64',
-      'V8 Mac GC Stress': 'gn_debug_x86',
-      'V8 Mac64 ASAN': 'gn_release_x64_asan_no_lsan',
+      'V8 Mac64': 'release_x64',
+      'V8 Mac64 - debug': 'debug_x64',
+      'V8 Mac64 GC Stress': 'debug_x64',
+      'V8 Mac64 ASAN': 'release_x64_asan_no_lsan',
       # Sanitizers.
-      'V8 Linux64 ASAN': 'gn_release_x64_asan',
-      'V8 Linux64 TSAN': 'gn_release_x64_tsan',
+      'V8 Linux64 ASAN': 'release_x64_asan',
+      'V8 Linux64 TSAN': 'release_x64_tsan',
       'V8 Linux64 TSAN - concurrent marking':
-          'gn_release_x64_tsan_concurrent_marking',
-      'V8 Linux - arm64 - sim - MSAN': 'gn_release_simulate_arm64_msan',
+          'release_x64_tsan_concurrent_marking',
+      'V8 Linux - arm64 - sim - MSAN': 'release_simulate_arm64_msan',
       # Misc.
-      'V8 Linux gcc 4.8': 'gn_release_x86_gcc',
-      'V8 Linux64 gcc 4.8 - debug': 'gn_debug_x64_gcc',
+      'V8 Linux gcc 4.8': 'release_x86_gcc',
+      'V8 Linux64 gcc 4.8 - debug': 'debug_x64_gcc',
       # FYI.
-      'V8 Fuchsia': 'gn_release_x64_fuchsia',
-      'V8 Fuchsia - debug': 'gn_debug_x64_fuchsia',
-      'V8 Linux - swarming staging': 'gn_release_x64',
-      'V8 Linux64 - cfi': 'gn_release_x64_cfi',
-      'V8 Linux64 UBSanVptr': 'gn_release_x64_ubsan_vptr',
-      'V8 Linux - vtunejit': 'gn_debug_x86_vtunejit',
-      'V8 Linux64 - gcov coverage': 'gn_release_x64_gcc_coverage',
-      'V8 Linux - predictable': 'gn_release_x86_predictable',
-      'V8 Linux - full debug': 'gn_full_debug_x86',
-      'V8 Linux - interpreted regexp': 'gn_release_x86_interpreted_regexp',
-      'V8 Random Deopt Fuzzer - debug': 'gn_debug_x64',
+      'V8 Fuchsia': 'release_x64_fuchsia',
+      'V8 Fuchsia - debug': 'debug_x64_fuchsia',
+      'V8 Linux64 - cfi': 'release_x64_cfi',
+      'V8 Linux64 UBSanVptr': 'release_x64_ubsan_vptr',
+      'V8 Linux - vtunejit': 'debug_x86_vtunejit',
+      'V8 Linux64 - gcov coverage': 'release_x64_gcc_coverage',
+      'V8 Linux - predictable': 'release_x86_predictable',
+      'V8 Linux - full debug': 'full_debug_x86',
+      'V8 Linux - interpreted regexp': 'release_x86_interpreted_regexp',
+      'V8 Random Deopt Fuzzer - debug': 'debug_x64',
     },
     'client.v8.clusterfuzz': {
-      'V8 Win32 ASAN - release builder':
-        'gn_release_x86_asan_no_lsan_verify_heap',
+      'V8 Win64 ASAN - release builder':
+        'release_x64_asan_no_lsan_verify_heap',
       # Note this is called a debug builder, but it uses a release build
       # configuration with dchecks (which enables DEBUG in V8), since win-asan
       # debug is not supported.
-      'V8 Win32 ASAN - debug builder':
-        'gn_release_x86_asan_no_lsan_verify_heap_dchecks',
+      'V8 Win64 ASAN - debug builder':
+        'release_x64_asan_no_lsan_verify_heap_dchecks',
       'V8 Mac64 ASAN - release builder':
-          'gn_release_x64_asan_no_lsan_edge_verify_heap',
+          'release_x64_asan_no_lsan_edge_verify_heap',
       'V8 Mac64 ASAN - debug builder':
-          'gn_debug_x64_asan_no_lsan_static_edge',
-      'V8 Linux64 - release builder': 'gn_release_x64_correctness_fuzzer',
-      'V8 Linux64 - debug builder': 'gn_debug_x64',
+          'debug_x64_asan_no_lsan_static_edge',
+      'V8 Linux64 - release builder': 'release_x64_correctness_fuzzer',
+      'V8 Linux64 - debug builder': 'debug_x64',
+      'V8 Linux64 - nosnap release builder': 'release_x64_no_snap',
+      'V8 Linux64 - nosnap debug builder': 'debug_x64_no_snap',
       'V8 Linux64 ASAN no inline - release builder':
-          'gn_release_x64_asan_symbolized_edge_verify_heap',
-      'V8 Linux64 ASAN - debug builder': 'gn_debug_x64_asan_edge',
+          'release_x64_asan_symbolized_edge_verify_heap',
+      'V8 Linux64 ASAN - debug builder': 'debug_x64_asan_edge',
       'V8 Linux64 ASAN arm64 - debug builder':
-          'gn_debug_simulate_arm64_asan_edge',
+          'debug_simulate_arm64_asan_edge',
       'V8 Linux ASAN arm - debug builder':
-          'gn_debug_simulate_arm_asan_edge',
+          'debug_simulate_arm_asan_edge',
       'V8 Linux ASAN mipsel - debug builder':
-          'gn_debug_simulate_mipsel_asan_edge',
-      'V8 Linux64 CFI - release builder': 'gn_release_x64_cfi_clusterfuzz',
+          'debug_simulate_mipsel_asan_edge',
+      'V8 Linux64 CFI - release builder': 'release_x64_cfi_clusterfuzz',
       'V8 Linux MSAN no origins':
-          'gn_release_simulate_arm64_msan_no_origins_edge',
+          'release_simulate_arm64_msan_no_origins_edge',
       'V8 Linux MSAN chained origins':
-          'gn_release_simulate_arm64_msan_edge',
-      'V8 Linux64 TSAN - release builder': 'gn_release_x64_tsan',
+          'release_simulate_arm64_msan_edge',
+      'V8 Linux64 TSAN - release builder': 'release_x64_tsan',
       'V8 Linux64 UBSanVptr - release builder':
-          'gn_release_x64_ubsan_vptr_recover_edge',
+          'release_x64_ubsan_vptr_recover_edge',
     },
     'client.v8.ports': {
       # Arm.
-      'V8 Arm - builder': 'gn_release_arm',
-      'V8 Arm - debug builder': 'gn_debug_arm',
-      'V8 Android Arm - builder': 'gn_release_android_arm',
-      'V8 Linux - arm - sim': 'gn_release_simulate_arm',
-      'V8 Linux - arm - sim - debug': 'gn_debug_simulate_arm',
+      'V8 Arm - builder': 'release_arm',
+      'V8 Arm - debug builder': 'debug_arm',
+      'V8 Android Arm - builder': 'release_android_arm',
+      'V8 Linux - arm - sim': 'release_simulate_arm',
+      'V8 Linux - arm - sim - debug': 'debug_simulate_arm',
       # Arm64.
-      'V8 Android Arm64 - builder': 'gn_release_android_arm64',
-      'V8 Linux - arm64 - sim': 'gn_release_simulate_arm64',
-      'V8 Linux - arm64 - sim - debug': 'gn_debug_simulate_arm64',
+      'V8 Android Arm64 - builder': 'release_android_arm64',
+      'V8 Linux - arm64 - sim': 'release_simulate_arm64',
+      'V8 Linux - arm64 - sim - debug': 'debug_simulate_arm64',
       'V8 Linux - arm64 - sim - nosnap - debug':
-          'gn_debug_simulate_arm64_no_snap',
-      'V8 Linux - arm64 - sim - gc stress': 'gn_debug_simulate_arm64',
+          'debug_simulate_arm64_no_snap',
+      'V8 Linux - arm64 - sim - gc stress': 'debug_simulate_arm64',
       # Mips.
-      'V8 Mips - builder': 'gyp_release_mips_no_snap_no_i18n',
-      'V8 Linux - mipsel - sim - builder': 'gn_release_simulate_mipsel',
-      'V8 Linux - mips64el - sim - builder': 'gn_release_simulate_mips64el',
+      'V8 Mips - builder': 'release_mips_no_snap_no_i18n',
+      'V8 Linux - mipsel - sim - builder': 'release_simulate_mipsel',
+      'V8 Linux - mips64el - sim - builder': 'release_simulate_mips64el',
       # PPC.
-      'V8 Linux - ppc - sim': 'gn_release_simulate_ppc',
-      'V8 Linux - ppc64 - sim': 'gn_release_simulate_ppc64',
+      'V8 Linux - ppc - sim': 'release_simulate_ppc',
+      'V8 Linux - ppc64 - sim': 'release_simulate_ppc64',
       # S390.
-      'V8 Linux - s390 - sim': 'gn_release_simulate_s390',
-      'V8 Linux - s390x - sim': 'gn_release_simulate_s390x',
+      'V8 Linux - s390 - sim': 'release_simulate_s390',
+      'V8 Linux - s390x - sim': 'release_simulate_s390x',
     },
     'client.v8.branches': {
-      'V8 Linux - beta branch': 'gn_release_x86',
-      'V8 Linux - beta branch - debug': 'gn_debug_x86',
-      'V8 Linux - stable branch': 'gn_release_x86',
-      'V8 Linux - stable branch - debug': 'gn_debug_x86',
-      'V8 Linux64 - beta branch': 'gn_release_x64',
-      'V8 Linux64 - beta branch - debug': 'gn_debug_x64',
-      'V8 Linux64 - stable branch': 'gn_release_x64',
-      'V8 Linux64 - stable branch - debug': 'gn_debug_x64',
-      'V8 arm - sim - beta branch': 'gn_release_simulate_arm',
-      'V8 arm - sim - beta branch - debug': 'gn_debug_simulate_arm',
-      'V8 arm - sim - stable branch': 'gn_release_simulate_arm',
-      'V8 arm - sim - stable branch - debug': 'gn_debug_simulate_arm',
-      'V8 mips64el - sim - beta branch': 'gn_release_simulate_mips64el',
-      'V8 mips64el - sim - stable branch': 'gn_release_simulate_mips64el',
-      'V8 mipsel - sim - beta branch': 'gn_release_simulate_mipsel',
-      'V8 mipsel - sim - stable branch': 'gn_release_simulate_mipsel',
-      'V8 ppc - sim - beta branch': 'gn_release_simulate_ppc',
-      'V8 ppc - sim - stable branch': 'gn_release_simulate_ppc',
-      'V8 ppc64 - sim - beta branch': 'gn_release_simulate_ppc64',
-      'V8 ppc64 - sim - stable branch': 'gn_release_simulate_ppc64',
-      'V8 s390 - sim - beta branch': 'gn_release_simulate_s390',
-      'V8 s390 - sim - stable branch': 'gn_release_simulate_s390',
-      'V8 s390x - sim - beta branch': 'gn_release_simulate_s390x',
-      'V8 s390x - sim - stable branch': 'gn_release_simulate_s390x',
+      'V8 Linux - beta branch': 'release_x86',
+      'V8 Linux - beta branch - debug': 'debug_x86',
+      'V8 Linux - stable branch': 'release_x86',
+      'V8 Linux - stable branch - debug': 'debug_x86',
+      'V8 Linux64 - beta branch': 'release_x64',
+      'V8 Linux64 - beta branch - debug': 'debug_x64',
+      'V8 Linux64 - stable branch': 'release_x64',
+      'V8 Linux64 - stable branch - debug': 'debug_x64',
+      'V8 arm - sim - beta branch': 'release_simulate_arm',
+      'V8 arm - sim - beta branch - debug': 'debug_simulate_arm',
+      'V8 arm - sim - stable branch': 'release_simulate_arm',
+      'V8 arm - sim - stable branch - debug': 'debug_simulate_arm',
+      'V8 mips64el - sim - beta branch': 'release_simulate_mips64el',
+      'V8 mips64el - sim - stable branch': 'release_simulate_mips64el',
+      'V8 mipsel - sim - beta branch': 'release_simulate_mipsel',
+      'V8 mipsel - sim - stable branch': 'release_simulate_mipsel',
+      'V8 ppc - sim - beta branch': 'release_simulate_ppc',
+      'V8 ppc - sim - stable branch': 'release_simulate_ppc',
+      'V8 ppc64 - sim - beta branch': 'release_simulate_ppc64',
+      'V8 ppc64 - sim - stable branch': 'release_simulate_ppc64',
+      'V8 s390 - sim - beta branch': 'release_simulate_s390',
+      'V8 s390 - sim - stable branch': 'release_simulate_s390',
+      'V8 s390x - sim - beta branch': 'release_simulate_s390x',
+      'V8 s390x - sim - stable branch': 'release_simulate_s390x',
     },
     'tryserver.v8': {
-      'v8_fuchsia_rel_ng': 'gn_release_x64_fuchsia_trybot',
-      'v8_linux_rel_ng': 'gn_release_x86_gcmole_trybot',
-      'v8_linux_verify_csa_rel_ng': 'gn_release_x86_verify_csa',
-      'v8_linux_nodcheck_rel_ng': 'gn_release_x86_minimal_symbols',
-      'v8_linux_dbg_ng': 'gn_debug_x86_trybot',
-      'v8_linux_noi18n_rel_ng': 'gn_release_x86_no_i18n_trybot',
-      'v8_linux_gc_stress_dbg': 'gn_debug_x86_trybot',
-      'v8_linux_nosnap_rel': 'gn_release_x86_no_snap_trybot',
-      'v8_linux_nosnap_dbg': 'gn_debug_x86_no_snap_trybot',
-      'v8_linux_gcc_compile_rel': 'gn_release_x86_gcc_minimal_symbols',
-      'v8_linux_gcc_rel': 'gn_release_x86_gcc_minimal_symbols',
-      'v8_linux_shared_compile_rel': 'gn_release_x86_shared_verify_heap',
-      'v8_linux64_gcc_compile_dbg': 'gn_debug_x64_gcc',
-      'v8_linux64_fyi_rel_ng': 'gn_release_x64_test_features_trybot',
-      'v8_linux64_rel_ng': 'gn_release_x64_test_features_trybot',
-      'v8_linux64_verify_csa_rel_ng': 'gn_release_x64_verify_csa',
-      'v8_linux64_gyp_rel_ng': 'gyp_release_x64',
-      'v8_linux64_asan_rel_ng': 'gn_release_x64_asan_minimal_symbols',
-      'v8_linux64_msan_rel': 'gn_release_simulate_arm64_msan_minimal_symbols',
+      'v8_fuchsia_rel_ng': 'release_x64_fuchsia_trybot',
+      'v8_linux_rel_ng': 'release_x86_gcmole_trybot',
+      'v8_linux_verify_csa_rel_ng': 'release_x86_verify_csa',
+      'v8_linux_nodcheck_rel_ng': 'release_x86_minimal_symbols',
+      'v8_linux_dbg_ng': 'debug_x86_trybot',
+      'v8_linux_noi18n_rel_ng': 'release_x86_no_i18n_trybot',
+      'v8_linux_gc_stress_dbg': 'debug_x86_trybot',
+      'v8_linux_nosnap_rel': 'release_x86_no_snap_trybot',
+      'v8_linux_nosnap_dbg': 'debug_x86_no_snap_trybot',
+      'v8_linux_gcc_compile_rel': 'release_x86_gcc_minimal_symbols',
+      'v8_linux_gcc_rel': 'release_x86_gcc_minimal_symbols',
+      'v8_linux_shared_compile_rel': 'release_x86_shared_verify_heap',
+      'v8_linux64_gcc_compile_dbg': 'debug_x64_gcc',
+      'v8_linux64_fyi_rel_ng': 'release_x64_test_features_trybot',
+      'v8_linux64_rel_ng': 'release_x64_test_features_trybot',
+      'v8_linux64_verify_csa_rel_ng': 'release_x64_verify_csa',
+      'v8_linux64_asan_rel_ng': 'release_x64_asan_minimal_symbols',
+      'v8_linux64_msan_rel': 'release_simulate_arm64_msan_minimal_symbols',
       'v8_linux64_sanitizer_coverage_rel':
-          'gn_release_x64_asan_minimal_symbols_coverage',
-      'v8_linux64_tsan_rel': 'gn_release_x64_tsan_minimal_symbols',
+          'release_x64_asan_minimal_symbols_coverage',
+      'v8_linux64_jumbo_compile_rel': 'release_x64_jumbo_trybot',
+      'v8_linux64_tsan_rel': 'release_x64_tsan_minimal_symbols',
       'v8_linux64_tsan_concurrent_marking_rel_ng':
-          'gn_release_x64_tsan_concurrent_marking_minimal_symbols',
-      'v8_linux64_ubsan_rel_ng': 'gn_release_x64_ubsan_vptr_minimal_symbols',
-      'v8_win_asan_rel_ng': 'gn_release_x86_asan_no_lsan',
-      'v8_win_dbg': 'gn_debug_x86_trybot',
-      'v8_win_compile_dbg': 'gn_debug_x86_trybot',
-      'v8_win_rel_ng': 'gn_release_x86_trybot',
+          'release_x64_tsan_concurrent_marking_minimal_symbols',
+      'v8_linux64_ubsan_rel_ng': 'release_x64_ubsan_vptr_minimal_symbols',
+      # TODO(machenbach): Remove after switching to x64 on infra side.
+      'v8_win_dbg': 'debug_x86_trybot',
+      'v8_win_compile_dbg': 'debug_x86_trybot',
+      'v8_win_rel_ng': 'release_x86_trybot',
       'v8_win_nosnap_shared_rel_ng':
-        'gn_release_x86_no_snap_shared_minimal_symbols',
-      # TODO(machenbach): Rename bot to msvc.
-      'v8_win64_msvc_compile_rel': 'gn_release_x64_msvc',
-      'v8_win64_dbg': 'gn_debug_x64_minimal_symbols',
-      'v8_win64_rel_ng': 'gn_release_x64_trybot',
-      'v8_mac_rel_ng': 'gn_release_x86_trybot',
-      'v8_mac_dbg': 'gn_debug_x86_trybot',
-      'v8_mac_gc_stress_dbg': 'gn_debug_x86_trybot',
-      'v8_mac64_rel': 'gn_release_x64_trybot',
-      'v8_mac64_dbg': 'gn_debug_x64_minimal_symbols',
-      'v8_mac64_asan_rel': 'gn_release_x64_asan_no_lsan',
-      'v8_linux_arm_rel_ng': 'gn_release_simulate_arm_trybot',
-      'v8_linux_arm_dbg': 'gn_debug_simulate_arm',
-      'v8_linux_arm_armv8a_rel': 'gn_release_simulate_arm_trybot',
-      'v8_linux_arm_armv8a_dbg': 'gn_debug_simulate_arm',
-      'v8_linux_arm64_rel_ng': 'gn_release_simulate_arm64_trybot',
-      'v8_linux_arm64_dbg': 'gn_debug_simulate_arm64',
-      'v8_linux_arm64_gc_stress_dbg': 'gn_debug_simulate_arm64',
-      'v8_linux_mipsel_compile_rel': 'gn_release_simulate_mipsel',
-      'v8_linux_mips64el_compile_rel': 'gn_release_simulate_mips64el',
-      'v8_android_arm_compile_rel': 'gn_release_android_arm',
+        'release_x86_no_snap_shared_minimal_symbols',
+      'v8_win64_asan_rel_ng': 'release_x64_asan_no_lsan',
+      'v8_win64_msvc_compile_rel': 'release_x64_msvc',
+      'v8_win64_dbg': 'debug_x64_minimal_symbols',
+      'v8_win64_msvc_rel_ng': 'release_x64_msvc',
+      'v8_win64_rel_ng': 'release_x64_trybot',
+      'v8_mac64_gc_stress_dbg': 'debug_x64_trybot',
+      'v8_mac64_rel_ng': 'release_x64_trybot',
+      'v8_mac64_dbg': 'debug_x64',
+      'v8_mac64_dbg_ng': 'debug_x64',
+      'v8_mac64_asan_rel': 'release_x64_asan_no_lsan',
+      'v8_linux_arm_rel_ng': 'release_simulate_arm_trybot',
+      'v8_linux_arm_dbg': 'debug_simulate_arm',
+      'v8_linux_arm_armv8a_rel': 'release_simulate_arm_trybot',
+      'v8_linux_arm_armv8a_dbg': 'debug_simulate_arm',
+      'v8_linux_arm64_rel_ng': 'release_simulate_arm64_trybot',
+      'v8_linux_arm64_dbg': 'debug_simulate_arm64',
+      'v8_linux_arm64_gc_stress_dbg': 'debug_simulate_arm64',
+      'v8_linux_mipsel_compile_rel': 'release_simulate_mipsel',
+      'v8_linux_mips64el_compile_rel': 'release_simulate_mips64el',
+      'v8_android_arm_compile_rel': 'release_android_arm',
     },
   },
 
 
   # To ease readability, config values are ordered by:
-  # gyp/gn, release/debug, arch type, other values alphabetically.
+  # release/debug, arch type, other values alphabetically.
   'configs': {
     # Developer default configs.
     'default_debug_arm': [
-      'gn', 'debug', 'simulate_arm', 'v8_enable_slow_dchecks',
-      'v8_full_debug'],
+      'debug', 'simulate_arm', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_arm': [
-      'gn', 'debug', 'simulate_arm', 'v8_enable_slow_dchecks'],
+      'debug', 'simulate_arm', 'v8_enable_slow_dchecks'],
     'default_release_arm': [
-      'gn', 'release', 'simulate_arm'],
+      'release', 'simulate_arm'],
     'default_debug_android_arm': [
-      'gn', 'debug', 'arm', 'android', 'crosscompile',
-      'v8_enable_slow_dchecks', 'v8_full_debug'],
+      'debug', 'arm', 'android', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_android_arm': [
-      'gn', 'debug', 'arm', 'android', 'crosscompile',
-      'v8_enable_slow_dchecks' ],
+      'debug', 'arm', 'android', 'v8_enable_slow_dchecks' ],
     'default_release_android_arm': [
-      'gn', 'release', 'arm', 'android', 'crosscompile'],
+      'release', 'arm', 'android'],
     'default_debug_arm64': [
-      'gn', 'debug', 'simulate_arm64', 'v8_enable_slow_dchecks',
-      'v8_full_debug'],
+      'debug', 'simulate_arm64', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_arm64': [
-      'gn', 'debug', 'simulate_arm64', 'v8_enable_slow_dchecks'],
+      'debug', 'simulate_arm64', 'v8_enable_slow_dchecks'],
     'default_release_arm64': [
-      'gn', 'release', 'simulate_arm64'],
+      'release', 'simulate_arm64'],
     'default_debug_mipsel': [
-      'gn', 'debug', 'simulate_mipsel', 'v8_enable_slow_dchecks',
-      'v8_full_debug'],
+      'debug', 'simulate_mipsel', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_mipsel': [
-      'gn', 'debug', 'simulate_mipsel', 'v8_enable_slow_dchecks'],
+      'debug', 'simulate_mipsel', 'v8_enable_slow_dchecks'],
     'default_release_mipsel': [
-      'gn', 'release', 'simulate_mipsel'],
+      'release', 'simulate_mipsel'],
     'default_debug_mips64el': [
-      'gn', 'debug', 'simulate_mips64el', 'v8_enable_slow_dchecks',
-      'v8_full_debug'],
+      'debug', 'simulate_mips64el', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_mips64el': [
-      'gn', 'debug', 'simulate_mips64el', 'v8_enable_slow_dchecks'],
+      'debug', 'simulate_mips64el', 'v8_enable_slow_dchecks'],
     'default_release_mips64el': [
-      'gn', 'release', 'simulate_mips64el'],
+      'release', 'simulate_mips64el'],
     'default_debug_ppc': [
-      'gn', 'debug', 'simulate_ppc', 'v8_enable_slow_dchecks',
-      'v8_full_debug'],
+      'debug', 'simulate_ppc', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_ppc': [
-      'gn', 'debug', 'simulate_ppc', 'v8_enable_slow_dchecks'],
+      'debug', 'simulate_ppc', 'v8_enable_slow_dchecks'],
     'default_release_ppc': [
-      'gn', 'release', 'simulate_ppc'],
+      'release', 'simulate_ppc'],
     'default_debug_ppc64': [
-      'gn', 'debug', 'simulate_ppc64', 'v8_enable_slow_dchecks',
-      'v8_full_debug'],
+      'debug', 'simulate_ppc64', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_ppc64': [
-      'gn', 'debug', 'simulate_ppc64', 'v8_enable_slow_dchecks'],
+      'debug', 'simulate_ppc64', 'v8_enable_slow_dchecks'],
     'default_release_ppc64': [
-      'gn', 'release', 'simulate_ppc64'],
+      'release', 'simulate_ppc64'],
     'default_debug_s390': [
-      'gn', 'debug', 'simulate_s390', 'v8_enable_slow_dchecks',
-      'v8_full_debug'],
+      'debug', 'simulate_s390', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_s390': [
-      'gn', 'debug', 'simulate_s390', 'v8_enable_slow_dchecks'],
+      'debug', 'simulate_s390', 'v8_enable_slow_dchecks'],
     'default_release_s390': [
-      'gn', 'release', 'simulate_s390'],
+      'release', 'simulate_s390'],
     'default_debug_s390x': [
-      'gn', 'debug', 'simulate_s390x', 'v8_enable_slow_dchecks',
-      'v8_full_debug'],
+      'debug', 'simulate_s390x', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_s390x': [
-      'gn', 'debug', 'simulate_s390x', 'v8_enable_slow_dchecks'],
+      'debug', 'simulate_s390x', 'v8_enable_slow_dchecks'],
     'default_release_s390x': [
-      'gn', 'release', 'simulate_s390x'],
+      'release', 'simulate_s390x'],
     'default_debug_x64': [
-      'gn', 'debug', 'x64', 'v8_enable_slow_dchecks', 'v8_full_debug'],
+      'debug', 'x64', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_x64': [
-      'gn', 'debug', 'x64', 'v8_enable_slow_dchecks'],
+      'debug', 'x64', 'v8_enable_slow_dchecks'],
     'default_release_x64': [
-      'gn', 'release', 'x64'],
+      'release', 'x64'],
     'default_debug_x86': [
-      'gn', 'debug', 'x86', 'v8_enable_slow_dchecks', 'v8_full_debug'],
+      'debug', 'x86', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_x86': [
-      'gn', 'debug', 'x86', 'v8_enable_slow_dchecks'],
+      'debug', 'x86', 'v8_enable_slow_dchecks'],
     'default_release_x86': [
-      'gn', 'release', 'x86'],
-
-
-    # GN debug configs for simulators.
-    'gn_debug_simulate_arm': [
-      'gn', 'debug_bot', 'simulate_arm', 'swarming'],
-    'gn_debug_simulate_arm_asan_edge': [
-      'gn', 'debug_bot', 'simulate_arm', 'asan', 'edge'],
-    'gn_debug_simulate_arm64': [
-      'gn', 'debug_bot', 'simulate_arm64', 'swarming'],
-    'gn_debug_simulate_arm64_asan_edge': [
-      'gn', 'debug_bot', 'simulate_arm64', 'asan', 'lsan', 'edge'],
-    'gn_debug_simulate_arm64_no_snap': [
-      'gn', 'debug', 'simulate_arm64', 'shared', 'goma',
-      'v8_optimized_debug', 'swarming', 'v8_snapshot_none'],
-    'gn_debug_simulate_mipsel_asan_edge': [
-      'gn', 'debug_bot', 'simulate_mipsel', 'asan', 'edge'],
-
-    # GN release configs for simulators.
-    'gn_release_simulate_arm': [
-      'gn', 'release_bot', 'simulate_arm', 'swarming'],
-    'gn_release_simulate_arm_trybot': [
-      'gn', 'release_trybot', 'simulate_arm', 'swarming'],
-    'gn_release_simulate_arm64': [
-      'gn', 'release_bot', 'simulate_arm64', 'swarming'],
-    'gn_release_simulate_arm64_msan': [
-      'gn', 'release_bot', 'simulate_arm64', 'msan', 'swarming'],
-    'gn_release_simulate_arm64_msan_minimal_symbols': [
-      'gn', 'release_bot', 'simulate_arm64', 'msan', 'minimal_symbols',
-      'swarming'],
-    'gn_release_simulate_arm64_msan_edge': [
-      'gn', 'release_bot', 'simulate_arm64', 'edge', 'msan'],
-    'gn_release_simulate_arm64_msan_no_origins_edge': [
-      'gn', 'release_bot', 'simulate_arm64', 'edge', 'msan_no_origins'],
-    'gn_release_simulate_arm64_trybot': [
-      'gn', 'release_trybot', 'simulate_arm64', 'swarming'],
-    'gn_release_simulate_mipsel': [
-      'gn', 'release_bot', 'simulate_mipsel', 'swarming'],
-    'gn_release_simulate_mips64el': [
-      'gn', 'release_bot', 'simulate_mips64el', 'swarming'],
-    'gn_release_simulate_ppc': [
-      'gn', 'release_bot', 'simulate_ppc', 'swarming'],
-    'gn_release_simulate_ppc64': [
-      'gn', 'release_bot', 'simulate_ppc64', 'swarming'],
-    'gn_release_simulate_s390': [
-      'gn', 'release_bot', 'simulate_s390', 'swarming'],
-    'gn_release_simulate_s390x': [
-      'gn', 'release_bot', 'simulate_s390x', 'swarming'],
-
-    # GN debug configs for arm.
-    'gn_debug_arm': [
-      'gn', 'debug_bot', 'arm', 'crosscompile', 'hard_float', 'swarming'],
-
-    # GN release configs for arm.
-    'gn_release_arm': [
-      'gn', 'release_bot', 'arm', 'crosscompile', 'hard_float', 'swarming'],
-    'gn_release_android_arm': [
-      'gn', 'release_bot', 'arm', 'android', 'crosscompile',
-      'minimal_symbols', 'swarming'],
-    'gn_release_android_arm64': [
-      'gn', 'release_bot', 'arm64', 'android', 'crosscompile',
-      'minimal_symbols', 'swarming'],
-
-    # GN release configs for x64.
-    'gn_release_x64': [
-      'gn', 'release_bot', 'x64', 'swarming'],
-    'gn_release_x64_asan': [
-      'gn', 'release_bot', 'x64', 'asan', 'lsan', 'swarming'],
-    'gn_release_x64_asan_minimal_symbols': [
-      'gn', 'release_bot', 'x64', 'asan', 'lsan', 'minimal_symbols',
-      'swarming'],
-    'gn_release_x64_asan_minimal_symbols_coverage': [
-      'gn', 'release_bot', 'x64', 'asan', 'bb', 'coverage', 'lsan',
-      'minimal_symbols', 'swarming'],
-    'gn_release_x64_asan_no_lsan': [
-      'gn', 'release_bot', 'x64', 'asan', 'swarming'],
-    'gn_release_x64_asan_no_lsan_edge_verify_heap': [
-      'gn', 'release_bot', 'x64', 'asan', 'edge', 'swarming',
-      'v8_verify_heap'],
-    'gn_release_x64_asan_symbolized_edge_verify_heap': [
-      'gn', 'release_bot', 'x64', 'asan', 'edge', 'lsan', 'symbolized',
+      'release', 'x86'],
+
+
+    # Debug configs for simulators.
+    'debug_simulate_arm': [
+      'debug_bot', 'simulate_arm'],
+    'debug_simulate_arm_asan_edge': [
+      'debug_bot', 'simulate_arm', 'asan', 'edge'],
+    'debug_simulate_arm64': [
+      'debug_bot', 'simulate_arm64'],
+    'debug_simulate_arm64_asan_edge': [
+      'debug_bot', 'simulate_arm64', 'asan', 'lsan', 'edge'],
+    'debug_simulate_arm64_no_snap': [
+      'debug', 'simulate_arm64', 'shared', 'goma', 'v8_optimized_debug',
+      'v8_snapshot_none'],
+    'debug_simulate_mipsel_asan_edge': [
+      'debug_bot', 'simulate_mipsel', 'asan', 'edge'],
+
+    # Release configs for simulators.
+    'release_simulate_arm': [
+      'release_bot', 'simulate_arm'],
+    'release_simulate_arm_trybot': [
+      'release_trybot', 'simulate_arm'],
+    'release_simulate_arm64': [
+      'release_bot', 'simulate_arm64'],
+    'release_simulate_arm64_msan': [
+      'release_bot', 'simulate_arm64', 'msan'],
+    'release_simulate_arm64_msan_minimal_symbols': [
+      'release_bot', 'simulate_arm64', 'msan', 'minimal_symbols'],
+    'release_simulate_arm64_msan_edge': [
+      'release_bot', 'simulate_arm64', 'edge', 'msan'],
+    'release_simulate_arm64_msan_no_origins_edge': [
+      'release_bot', 'simulate_arm64', 'edge', 'msan_no_origins'],
+    'release_simulate_arm64_trybot': [
+      'release_trybot', 'simulate_arm64'],
+    'release_simulate_mipsel': [
+      'release_bot', 'simulate_mipsel'],
+    'release_simulate_mips64el': [
+      'release_bot', 'simulate_mips64el'],
+    'release_simulate_ppc': [
+      'release_bot', 'simulate_ppc'],
+    'release_simulate_ppc64': [
+      'release_bot', 'simulate_ppc64'],
+    'release_simulate_s390': [
+      'release_bot', 'simulate_s390'],
+    'release_simulate_s390x': [
+      'release_bot', 'simulate_s390x'],
+
+    # Debug configs for arm.
+    'debug_arm': [
+      'debug_bot', 'arm', 'hard_float'],
+
+    # Release configs for arm.
+    'release_arm': [
+      'release_bot', 'arm', 'hard_float'],
+    'release_android_arm': [
+      'release_bot', 'arm', 'android', 'minimal_symbols'],
+    'release_android_arm64': [
+      'release_bot', 'arm64', 'android', 'minimal_symbols'],
+
+    # Release configs for x64.
+    'release_x64': [
+      'release_bot', 'x64'],
+    'release_x64_asan': [
+      'release_bot', 'x64', 'asan', 'lsan'],
+    'release_x64_asan_minimal_symbols': [
+      'release_bot', 'x64', 'asan', 'lsan', 'minimal_symbols'],
+    'release_x64_asan_minimal_symbols_coverage': [
+      'release_bot', 'x64', 'asan', 'bb', 'coverage', 'lsan', 'minimal_symbols'],
+    'release_x64_asan_no_lsan': [
+      'release_bot', 'x64', 'asan'],
+    'release_x64_asan_no_lsan_edge_verify_heap': [
+      'release_bot', 'x64', 'asan', 'edge', 'v8_verify_heap'],
+    'release_x64_asan_no_lsan_verify_heap': [
+      'release_bot', 'x64', 'asan', 'v8_verify_heap'],
+    'release_x64_asan_no_lsan_verify_heap_dchecks': [
+      'release_bot', 'x64', 'asan', 'dcheck_always_on',
+      'v8_enable_slow_dchecks', 'v8_verify_heap'],
+    'release_x64_asan_symbolized_edge_verify_heap': [
+      'release_bot', 'x64', 'asan', 'edge', 'lsan', 'symbolized',
       'v8_verify_heap'],
-    'gn_release_x64_cfi': [
-      'gn', 'release_bot', 'x64', 'cfi', 'swarming'],
-    'gn_release_x64_cfi_clusterfuzz': [
-      'gn', 'release_bot', 'x64', 'cfi_clusterfuzz'],
-    'gn_release_x64_msvc': [
-      'gn', 'release_bot', 'x64', 'msvc', 'swarming'],
-    'gn_release_x64_concurrent_marking': [
-      'gn', 'release_bot', 'x64', 'v8_enable_concurrent_marking', 'swarming'],
-    'gn_release_x64_correctness_fuzzer' : [
-      'gn', 'release_bot', 'x64', 'v8_correctness_fuzzer', 'swarming'],
-    'gn_release_x64_fuchsia': [
-      'gn', 'release_bot', 'x64', 'fuchsia', 'swarming'],
-    'gn_release_x64_fuchsia_trybot': [
-      'gn', 'release_trybot', 'x64', 'fuchsia', 'swarming'],
-    'gn_release_x64_gcc_coverage': [
-      'gn', 'release_bot', 'x64', 'coverage', 'gcc'],
-    'gn_release_x64_internal': [
-      'gn', 'release_bot', 'x64', 'swarming', 'v8_snapshot_internal'],
-    'gn_release_x64_minimal_symbols': [
-      'gn', 'release_bot', 'x64', 'minimal_symbols', 'swarming'],
-    'gn_release_x64_trybot': [
-      'gn', 'release_trybot', 'x64', 'swarming'],
-    'gn_release_x64_test_features_trybot': [
-      'gn', 'release_trybot', 'x64', 'swarming', 'v8_enable_test_features'],
-    'gn_release_x64_tsan': [
-      'gn', 'release_bot', 'x64', 'tsan', 'swarming'],
-    'gn_release_x64_tsan_concurrent_marking': [
-      'gn', 'release_bot', 'x64', 'v8_enable_concurrent_marking', 'tsan',
-      'swarming'],
-    'gn_release_x64_tsan_concurrent_marking_minimal_symbols': [
-      'gn', 'release_bot', 'x64', 'v8_enable_concurrent_marking', 'tsan',
-      'minimal_symbols', 'swarming'],
-    'gn_release_x64_tsan_minimal_symbols': [
-      'gn', 'release_bot', 'x64', 'tsan', 'minimal_symbols', 'swarming'],
-    'gn_release_x64_ubsan_vptr': [
-      'gn', 'release_bot', 'x64', 'ubsan_vptr', 'swarming'],
-    'gn_release_x64_ubsan_vptr_recover_edge': [
-      'gn', 'release_bot', 'x64', 'edge', 'ubsan_vptr_recover', 'swarming'],
-    'gn_release_x64_ubsan_vptr_minimal_symbols': [
-      'gn', 'release_bot', 'x64', 'ubsan_vptr', 'minimal_symbols', 'swarming'],
-    'gn_release_x64_verify_csa': [
-      'gn', 'release_bot', 'x64', 'swarming', 'dcheck_always_on',
-      'v8_enable_slow_dchecks', 'v8_verify_csa'],
-
-    # GN debug configs for x64.
-    'gn_debug_x64': [
-      'gn', 'debug_bot', 'x64', 'swarming'],
-    'gn_debug_x64_asan_edge': [
-      'gn', 'debug_bot', 'x64', 'asan', 'lsan', 'edge'],
-    'gn_debug_x64_asan_no_lsan_static_edge': [
-      'gn', 'debug', 'static', 'goma', 'v8_enable_slow_dchecks',
-      'v8_optimized_debug', 'x64', 'asan', 'edge', 'swarming'],
-    'gn_debug_x64_custom': [
-      'gn', 'debug_bot', 'x64', 'swarming', 'v8_snapshot_custom'],
-    'gn_debug_x64_fuchsia': [
-      'gn', 'debug_bot', 'x64', 'fuchsia', 'swarming'],
-    'gn_debug_x64_gcc': [
-      'gn', 'debug_bot', 'x64', 'gcc'],
-    'gn_debug_x64_minimal_symbols': [
-      'gn', 'debug_bot', 'x64', 'minimal_symbols', 'swarming'],
-
-    # GN debug configs for x86.
-    'gn_debug_x86': [
-      'gn', 'debug_bot', 'x86', 'swarming'],
-    'gn_debug_x86_minimal_symbols': [
-      'gn', 'debug_bot', 'x86', 'minimal_symbols', 'swarming'],
-    'gn_debug_x86_no_i18n': [
-      'gn', 'debug_bot', 'x86', 'swarming', 'v8_no_i18n'],
-    'gn_debug_x86_no_snap': [
-      'gn', 'debug_bot', 'x86', 'swarming', 'v8_snapshot_none'],
-    'gn_debug_x86_no_snap_trybot': [
-      'gn', 'debug_trybot', 'x86', 'swarming', 'v8_snapshot_none'],
-    'gn_debug_x86_trybot': [
-      'gn', 'debug_trybot', 'x86', 'swarming'],
-    'gn_debug_x86_vtunejit': [
-      'gn', 'debug_bot', 'x86', 'v8_enable_vtunejit'],
-    'gn_full_debug_x86': [
-      'gn', 'debug', 'x86', 'goma', 'static', 'v8_enable_slow_dchecks',
+    'release_x64_cfi': [
+      'release_bot', 'x64', 'cfi'],
+    'release_x64_cfi_clusterfuzz': [
+      'release_bot', 'x64', 'cfi_clusterfuzz'],
+    'release_x64_msvc': [
+      'release_bot', 'x64', 'msvc'],
+    'release_x64_concurrent_marking': [
+      'release_bot', 'x64', 'v8_enable_concurrent_marking'],
+    'release_x64_correctness_fuzzer' : [
+      'release_bot', 'x64', 'v8_correctness_fuzzer'],
+    'release_x64_fuchsia': [
+      'release_bot', 'x64', 'fuchsia'],
+    'release_x64_fuchsia_trybot': [
+      'release_trybot', 'x64', 'fuchsia'],
+    'release_x64_gcc_coverage': [
+      'release_bot', 'x64', 'coverage', 'gcc'],
+    'release_x64_internal': [
+      'release_bot', 'x64', 'v8_enable_embedded_builtins',
+      'v8_snapshot_internal'],
+    'release_x64_jumbo': [
+      'release_bot', 'x64', 'jumbo'],
+    'release_x64_jumbo_trybot': [
+      'release_trybot', 'x64', 'jumbo'],
+    'release_x64_minimal_symbols': [
+      'release_bot', 'x64', 'minimal_symbols'],
+    'release_x64_no_snap': [
+      'release_bot', 'x64', 'v8_snapshot_none'],
+    'release_x64_trybot': [
+      'release_trybot', 'x64'],
+    'release_x64_test_features_trybot': [
+      'release_trybot', 'x64', 'v8_enable_test_features'],
+    'release_x64_tsan': [
+      'release_bot', 'x64', 'tsan'],
+    'release_x64_tsan_concurrent_marking': [
+      'release_bot', 'x64', 'v8_enable_concurrent_marking', 'tsan'],
+    'release_x64_tsan_concurrent_marking_minimal_symbols': [
+      'release_bot', 'x64', 'v8_enable_concurrent_marking', 'tsan',
+      'minimal_symbols'],
+    'release_x64_tsan_minimal_symbols': [
+      'release_bot', 'x64', 'tsan', 'minimal_symbols'],
+    'release_x64_ubsan_vptr': [
+      'release_bot', 'x64', 'ubsan_vptr'],
+    'release_x64_ubsan_vptr_recover_edge': [
+      'release_bot', 'x64', 'edge', 'ubsan_vptr_recover'],
+    'release_x64_ubsan_vptr_minimal_symbols': [
+      'release_bot', 'x64', 'ubsan_vptr', 'minimal_symbols'],
+    'release_x64_verify_csa': [
+      'release_bot', 'x64', 'dcheck_always_on',
+      'v8_enable_slow_dchecks', 'v8_enable_embedded_builtins', 'v8_verify_csa'],
+
+    # Debug configs for x64.
+    'debug_x64': [
+      'debug_bot', 'x64'],
+    'debug_x64_asan_edge': [
+      'debug_bot', 'x64', 'asan', 'lsan', 'edge'],
+    'debug_x64_asan_no_lsan_static_edge': [
+      'debug', 'static', 'goma', 'v8_enable_slow_dchecks', 'v8_optimized_debug',
+      'x64', 'asan', 'edge'],
+    'debug_x64_custom': [
+      'debug_bot', 'x64', 'v8_snapshot_custom'],
+    'debug_x64_fuchsia': [
+      'debug_bot', 'x64', 'fuchsia'],
+    'debug_x64_gcc': [
+      'debug_bot', 'x64', 'gcc'],
+    'debug_x64_jumbo': [
+      'debug_bot', 'x64', 'jumbo'],
+    'debug_x64_minimal_symbols': [
+      'debug_bot', 'x64', 'minimal_symbols'],
+    'debug_x64_no_snap': [
+      'debug_bot', 'x64', 'v8_snapshot_none'],
+    'debug_x64_trybot': [
+      'debug_trybot', 'x64'],
+
+    # Debug configs for x86.
+    'debug_x86': [
+      'debug_bot', 'x86'],
+    'debug_x86_minimal_symbols': [
+      'debug_bot', 'x86', 'minimal_symbols'],
+    'debug_x86_no_i18n': [
+      'debug_bot', 'x86', 'v8_no_i18n'],
+    'debug_x86_no_snap': [
+      'debug_bot', 'x86', 'v8_snapshot_none'],
+    'debug_x86_no_snap_trybot': [
+      'debug_trybot', 'x86', 'v8_snapshot_none'],
+    'debug_x86_trybot': [
+      'debug_trybot', 'x86'],
+    'debug_x86_vtunejit': [
+      'debug_bot', 'x86', 'v8_enable_vtunejit'],
+    'full_debug_x86': [
+      'debug', 'x86', 'goma', 'static', 'v8_enable_slow_dchecks',
       'v8_full_debug'],
 
-    # GN release configs for x86.
-    'gn_release_x86': [
-      'gn', 'release_bot', 'x86', 'swarming'],
-    'gn_release_x86_asan_no_lsan': [
-      'gn', 'release_bot', 'x86', 'asan', 'clang', 'swarming'],
-    'gn_release_x86_asan_no_lsan_verify_heap': [
-      'gn', 'release_bot', 'x86', 'asan', 'clang', 'swarming',
-      'v8_verify_heap'],
-    'gn_release_x86_asan_no_lsan_verify_heap_dchecks': [
-      'gn', 'release_bot', 'x86', 'asan', 'clang', 'swarming',
-      'dcheck_always_on', 'v8_enable_slow_dchecks', 'v8_verify_heap'],
-    'gn_release_x86_disassembler': [
-      'gn', 'release_bot', 'x86', 'v8_enable_disassembler'],
-    'gn_release_x86_gcc': [
-      'gn', 'release_bot', 'x86', 'gcc'],
-    'gn_release_x86_gcc_minimal_symbols': [
-      'gn', 'release_bot', 'x86', 'gcc', 'minimal_symbols'],
-    'gn_release_x86_gcmole': [
-      'gn', 'release_bot', 'x86', 'gcmole', 'swarming'],
-    'gn_release_x86_gcmole_trybot': [
-      'gn', 'release_trybot', 'x86', 'gcmole', 'swarming'],
-    'gn_release_x86_interpreted_regexp': [
-      'gn', 'release_bot', 'x86', 'v8_interpreted_regexp'],
-    'gn_release_x86_minimal_symbols': [
-      'gn', 'release_bot', 'x86', 'minimal_symbols', 'swarming'],
-    'gn_release_x86_no_i18n_trybot': [
-      'gn', 'release_trybot', 'x86', 'swarming', 'v8_no_i18n'],
-    'gn_release_x86_no_snap': [
-      'gn', 'release_bot', 'x86', 'swarming', 'v8_snapshot_none'],
-    'gn_release_x86_no_snap_shared_minimal_symbols': [
-      'gn', 'release', 'x86', 'goma', 'minimal_symbols', 'shared', 'swarming',
+    # Release configs for x86.
+    'release_x86': [
+      'release_bot', 'x86'],
+    'release_x86_disassembler': [
+      'release_bot', 'x86', 'v8_enable_disassembler'],
+    'release_x86_gcc': [
+      'release_bot', 'x86', 'gcc'],
+    'release_x86_gcc_minimal_symbols': [
+      'release_bot', 'x86', 'gcc', 'minimal_symbols'],
+    'release_x86_gcmole': [
+      'release_bot', 'x86', 'gcmole'],
+    'release_x86_gcmole_trybot': [
+      'release_trybot', 'x86', 'gcmole'],
+    'release_x86_interpreted_regexp': [
+      'release_bot', 'x86', 'v8_interpreted_regexp'],
+    'release_x86_minimal_symbols': [
+      'release_bot', 'x86', 'minimal_symbols'],
+    'release_x86_no_i18n_trybot': [
+      'release_trybot', 'x86', 'v8_no_i18n'],
+    'release_x86_no_snap': [
+      'release_bot', 'x86', 'v8_snapshot_none'],
+    'release_x86_no_snap_shared_minimal_symbols': [
+      'release', 'x86', 'goma', 'minimal_symbols', 'shared',
       'v8_snapshot_none'],
-    'gn_release_x86_no_snap_trybot': [
-      'gn', 'release_trybot', 'x86', 'swarming', 'v8_snapshot_none'],
-    'gn_release_x86_predictable': [
-      'gn', 'release_bot', 'x86', 'v8_enable_verify_predictable'],
-    'gn_release_x86_shared_verify_heap': [
-      'gn', 'release', 'x86', 'goma', 'shared', 'swarming', 'v8_verify_heap'],
-    'gn_release_x86_trybot': [
-      'gn', 'release_trybot', 'x86', 'swarming'],
-    'gn_release_x86_verify_csa': [
-      'gn', 'release_bot', 'x86', 'swarming', 'dcheck_always_on',
+    'release_x86_no_snap_trybot': [
+      'release_trybot', 'x86', 'v8_snapshot_none'],
+    'release_x86_predictable': [
+      'release_bot', 'x86', 'v8_enable_verify_predictable'],
+    'release_x86_shared_verify_heap': [
+      'release', 'x86', 'goma', 'shared', 'v8_verify_heap'],
+    'release_x86_trybot': [
+      'release_trybot', 'x86'],
+    'release_x86_verify_csa': [
+      'release_bot', 'x86', 'dcheck_always_on',
       'v8_enable_slow_dchecks', 'v8_verify_csa'],
 
-    # Gyp release configs for mips.
-    'gyp_release_mips_no_snap_no_i18n': [
-      'gyp', 'release', 'mips', 'crosscompile', 'no_sysroot', 'static',
-      'v8_no_i18n', 'v8_snapshot_none'],
-
-    # Gyp release configs for x64.
-    'gyp_release_x64': [
-      'gyp', 'release_bot', 'x64', 'no_sysroot', 'swarming'],
+    # Release configs for mips.
+    'release_mips_no_snap_no_i18n': [
+      'release', 'mips', 'no_sysroot', 'static', 'v8_no_i18n',
+      'v8_snapshot_none'],
   },
 
   'mixins': {
     'android': {
       'gn_args': 'target_os="android" v8_android_log_stdout=true',
-      'gyp_defines': 'OS=android v8_android_log_stdout=1',
     },
 
     'arm': {
       'gn_args': 'target_cpu="arm"',
-      'gyp_defines': 'target_arch=arm',
     },
 
     'arm64': {
       'gn_args': 'target_cpu="arm64"',
-      'gyp_defines': 'target_arch=arm64',
     },
 
     'asan': {
-      'mixins': ['v8_enable_test_features'],
+      'mixins': ['clang', 'v8_enable_test_features'],
       'gn_args': 'is_asan=true',
-      'gyp_defines': 'clang=1 asan=1',
     },
 
     'bb': {
       'gn_args': 'sanitizer_coverage_flags="bb,trace-pc-guard"',
-      'gyp_defines': 'sanitizer_coverage=bb,trace-pc-guard',
     },
 
     'cfi': {
       'mixins': ['v8_enable_test_features'],
       'gn_args': ('is_cfi=true use_cfi_cast=true use_cfi_diag=true '
                   'use_cfi_recover=false'),
-      'gyp_defines': 'cfi_vptr=1 cfi_diag=1',
     },
 
     'cfi_clusterfuzz': {
       'mixins': ['v8_enable_test_features'],
       'gn_args': ('is_cfi=true use_cfi_cast=true use_cfi_diag=true '
                   'use_cfi_recover=true'),
-      'gyp_defines': 'cfi_vptr=1 cfi_diag=1',
     },
 
     'clang': {
       'gn_args': 'is_clang=true',
-      'gyp_defines': 'clang=1',
     },
 
     'coverage': {
       'gn_args': 'v8_code_coverage=true',
-      'gyp_defines': 'coverage=1',
-    },
-
-    'crosscompile': {
-      'gyp_crosscompile': True,
     },
 
     'dcheck_always_on': {
       'gn_args': 'dcheck_always_on=true',
-      'gyp_defines': 'dcheck_always_on=1',
     },
 
     'debug': {
       'gn_args': 'is_debug=true v8_enable_backtrace=true',
-      'gyp_defines': 'v8_enable_backtrace=1',
     },
 
     'debug_bot': {
@@ -618,7 +594,6 @@
 
     'edge': {
       'gn_args': 'sanitizer_coverage_flags="trace-pc-guard"',
-      'gyp_defines': 'sanitizer_coverage=trace-pc-guard',
     },
 
     'fuchsia': {
@@ -628,44 +603,40 @@
     'gcc': {
       # TODO(machenbach): Remove cxx11 restriction when updating gcc version.
       'gn_args': 'is_clang=false use_cxx11=true',
-      'gyp_defines': 'clang=0',
     },
 
     'gcmole': {
       'gn_args': 'v8_gcmole=true',
-      'gyp_defines': 'gcmole=1',
     },
 
-    'gn': {'type': 'gn'},
-
     'goma': {
-      # The MB code will properly escape goma_dir if necessary in the GYP
-      # code path; the GN code path needs no escaping.
       'gn_args': 'use_goma=true',
-      'gyp_defines': 'use_goma=1',
     },
 
-    'gyp': {'type': 'gyp'},
-
     'hard_float': {
       'gn_args': 'arm_float_abi="hard"',
-      'gyp_defines': 'arm_float_abi=hard',
+    },
+
+    'jumbo': {
+      'gn_args': 'use_jumbo_build=true',
     },
 
     'lsan': {
       'mixins': ['v8_enable_test_features'],
       'gn_args': 'is_lsan=true',
-      'gyp_defines': 'lsan=1',
     },
 
     'minimal_symbols': {
       'gn_args': 'symbol_level=1',
-      'gyp_defines': 'fastbuild=1',
     },
 
     'mips': {
+      'mixins': ['mips_bundled_toolchain'],
       'gn_args': 'target_cpu="mips"',
-      'gyp_defines': 'target_arch=mips',
+    },
+
+    'mips_bundled_toolchain': {
+      'gn_args': 'custom_toolchain="//tools/toolchain:mips-bundled"',
     },
 
     'msan': {
@@ -686,7 +657,6 @@
 
     'no_sysroot': {
       'gn_args': 'use_sysroot=false',
-      'gyp_defines': 'use_sysroot=0',
     },
 
     'release': {
@@ -703,71 +673,53 @@
 
     'shared': {
       'gn_args': 'is_component_build=true',
-      'gyp_defines': 'component=shared_library',
     },
 
     'simulate_arm': {
       'gn_args': 'target_cpu="x86" v8_target_cpu="arm"',
-      'gyp_defines': 'target_arch=ia32 v8_target_arch=arm',
     },
 
     'simulate_arm64': {
       'gn_args': 'target_cpu="x64" v8_target_cpu="arm64"',
-      'gyp_defines': 'target_arch=x64 v8_target_arch=arm64',
     },
 
     'simulate_mipsel': {
       'gn_args':
           'target_cpu="x86" v8_target_cpu="mipsel" mips_arch_variant="r2"',
-      'gyp_defines': 'target_arch=ia32 v8_target_arch=mipsel',
     },
 
     'simulate_mips64el': {
       'gn_args': 'target_cpu="x64" v8_target_cpu="mips64el"',
-      'gyp_defines': 'target_arch=x64 v8_target_arch=mips64el',
     },
 
     'simulate_ppc': {
       'gn_args': 'target_cpu="x86" v8_target_cpu="ppc"',
-      'gyp_defines': 'target_arch=ia32 v8_target_arch=ppc',
     },
 
     'simulate_ppc64': {
       'gn_args': 'target_cpu="x64" v8_target_cpu="ppc64"',
-      'gyp_defines': 'target_arch=x64 v8_target_arch=ppc64',
     },
 
     'simulate_s390': {
       'gn_args': 'target_cpu="x86" v8_target_cpu="s390"',
-      'gyp_defines': 'target_arch=ia32 v8_target_arch=s390',
     },
 
     'simulate_s390x': {
       'gn_args': 'target_cpu="x64" v8_target_cpu="s390x"',
-      'gyp_defines': 'target_arch=x64 v8_target_arch=s390x',
     },
 
     'static': {
       'gn_args': 'is_component_build=false',
-      'gyp_defines': 'component=static_library',
-    },
-
-    'swarming': {
-      'gn_args': 'v8_test_isolation_mode="prepare"',
-      'gyp_defines': 'test_isolation_mode=prepare',
     },
 
     # TODO(machenbach): Remove the symbolized config after the bots are gone.
     'symbolized': {
       'gn_args': 'v8_no_inline=true',
-      'gyp_defines':
-        'release_extra_cflags="-fno-inline-functions -fno-inline"',
     },
 
     'tsan': {
       'mixins': ['v8_enable_test_features'],
       'gn_args': 'is_tsan=true',
-      'gyp_defines': 'clang=1 tsan=1',
     },
 
     'ubsan_vptr': {
@@ -786,7 +738,6 @@
 
     'v8_no_i18n': {
       'gn_args': 'v8_enable_i18n_support=false icu_use_data_file=false',
-      'gyp_defines': 'v8_enable_i18n_support=0 icu_use_data_file_flag=0',
     },
 
     'v8_enable_concurrent_marking': {
@@ -800,12 +751,14 @@
 
     'v8_enable_disassembler': {
       'gn_args': 'v8_enable_disassembler=true',
-      'gyp_defines': 'v8_enable_disassembler=1',
+    },
+
+    'v8_enable_embedded_builtins': {
+      'gn_args': 'v8_enable_embedded_builtins=true',
     },
 
     'v8_enable_slow_dchecks': {
       'gn_args': 'v8_enable_slow_dchecks=true',
-      'gyp_defines': 'v8_enable_slow_dchecks=1',
     },
 
     'v8_enable_test_features': {
@@ -814,50 +767,39 @@
 
     'v8_enable_verify_predictable': {
       'gn_args': 'v8_enable_verify_predictable=true',
-      'gyp_defines': 'v8_enable_verify_predictable=1',
     },
 
     'v8_enable_vtunejit': {
       'gn_args': 'v8_enable_vtunejit=true',
-      'gyp_defines': 'v8_enable_vtunejit=1',
     },
 
     'v8_full_debug': {
       'gn_args': 'v8_optimized_debug=false',
-      'gyp_defines': 'v8_optimized_debug=0',
     },
 
     'v8_interpreted_regexp': {
       'gn_args': 'v8_interpreted_regexp=true',
-      'gyp_defines': 'v8_interpreted_regexp=1',
     },
 
     'v8_optimized_debug': {
       # This is the default in gn for debug.
-      'gyp_defines': 'v8_optimized_debug=1',
     },
 
     'v8_snapshot_custom': {
       # GN path is relative to project root.
       'gn_args': 'v8_embed_script="test/mjsunit/mjsunit.js"',
-
-      # Gyp path is relative to src/v8.gyp.
-      'gyp_defines': 'embed_script=../test/mjsunit/mjsunit.js',
     },
 
     'v8_snapshot_internal': {
       'gn_args': 'v8_use_external_startup_data=false',
-      'gyp_defines': 'v8_use_external_startup_data=0',
     },
 
     'v8_snapshot_none': {
       'gn_args': 'v8_use_snapshot=false',
-      'gyp_defines': 'v8_use_snapshot=false',
     },
 
     'v8_verify_heap': {
       'gn_args': 'v8_enable_verify_heap=true',
-      'gyp_defines': 'v8_enable_verify_heap=1',
     },
 
     'v8_verify_csa': {
@@ -866,12 +808,10 @@
 
     'x64': {
       'gn_args': 'target_cpu="x64"',
-      'gyp_defines': 'target_arch=x64',
     },
 
     'x86': {
       'gn_args': 'target_cpu="x86"',
-      'gyp_defines': 'target_arch=ia32',
     },
   },
 }
diff --git a/deps/v8/samples/process.cc b/deps/v8/samples/process.cc
index f22407a837d..9af1c0b23b7 100644
--- a/deps/v8/samples/process.cc
+++ b/deps/v8/samples/process.cc
@@ -650,10 +650,10 @@ MaybeLocal<String> ReadFile(Isolate* isolate, const string& name) {
   size_t size = ftell(file);
   rewind(file);
 
-  char* chars = new char[size + 1];
-  chars[size] = '\0';
+  std::unique_ptr<char> chars(new char[size + 1]);
+  chars.get()[size] = '\0';
   for (size_t i = 0; i < size;) {
-    i += fread(&chars[i], 1, size - i, file);
+    i += fread(&chars.get()[i], 1, size - i, file);
     if (ferror(file)) {
       fclose(file);
       return MaybeLocal<String>();
@@ -661,8 +661,7 @@ MaybeLocal<String> ReadFile(Isolate* isolate, const string& name) {
   }
   fclose(file);
   MaybeLocal<String> result = String::NewFromUtf8(
-      isolate, chars, NewStringType::kNormal, static_cast<int>(size));
-  delete[] chars;
+      isolate, chars.get(), NewStringType::kNormal, static_cast<int>(size));
   return result;
 }
 
diff --git a/deps/v8/samples/samples.gyp b/deps/v8/samples/samples.gyp
deleted file mode 100644
index e7c26cf2629..00000000000
--- a/deps/v8/samples/samples.gyp
+++ /dev/null
@@ -1,84 +0,0 @@
-# Copyright 2012 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-{
-  'variables': {
-    'v8_code': 1,
-    'v8_enable_i18n_support%': 1,
-    'v8_toolset_for_shell%': 'target',
-  },
-  'includes': ['../gypfiles/toolchain.gypi', '../gypfiles/features.gypi'],
-  'target_defaults': {
-    'type': 'executable',
-    'dependencies': [
-      '../src/v8.gyp:v8',
-      '../src/v8.gyp:v8_libbase',
-      '../src/v8.gyp:v8_libplatform',
-    ],
-    'include_dirs': [
-      '..',
-    ],
-    'conditions': [
-      ['v8_enable_i18n_support==1', {
-        'dependencies': [
-          '<(icu_gyp_path):icui18n',
-          '<(icu_gyp_path):icuuc',
-        ],
-      }],
-      ['OS=="win" and v8_enable_i18n_support==1', {
-        'dependencies': [
-          '<(icu_gyp_path):icudata',
-        ],
-      }],
-    ],
-  },
-  'targets': [
-    {
-      'target_name': 'v8_shell',
-      'sources': [
-        'shell.cc',
-      ],
-      'conditions': [
-        [ 'want_separate_host_toolset==1', {
-          'toolsets': [ '<(v8_toolset_for_shell)', ],
-        }],
-      ],
-    },
-    {
-      'target_name': 'hello-world',
-      'sources': [
-        'hello-world.cc',
-      ],
-    },
-    {
-      'target_name': 'process',
-      'sources': [
-        'process.cc',
-      ],
-    },
-  ],
-}
diff --git a/deps/v8/src/PRESUBMIT.py b/deps/v8/src/PRESUBMIT.py
index d928a606891..b97eefaeb06 100644
--- a/deps/v8/src/PRESUBMIT.py
+++ b/deps/v8/src/PRESUBMIT.py
@@ -24,6 +24,6 @@ def is_api_cc(f):
   return output_api.EnsureCQIncludeTrybotsAreAdded(
     cl,
     [
-      'master.tryserver.chromium.linux:linux_chromium_rel_ng'
+      'luci.chromium.try:linux_chromium_rel_ng'
     ],
     'Automatically added layout test trybots to run tests on CQ.')
diff --git a/deps/v8/src/accessors.cc b/deps/v8/src/accessors.cc
index eb892886857..d422c11a249 100644
--- a/deps/v8/src/accessors.cc
+++ b/deps/v8/src/accessors.cc
@@ -28,6 +28,7 @@ Handle<AccessorInfo> Accessors::MakeAccessor(
   info->set_is_special_data_property(true);
   info->set_is_sloppy(false);
   info->set_replace_on_access(false);
+  info->set_has_no_side_effect(false);
   name = factory->InternalizeName(name);
   info->set_name(*name);
   Handle<Object> get = v8::FromCData(isolate, getter);
@@ -97,6 +98,9 @@ MUST_USE_RESULT MaybeHandle<Object> ReplaceAccessorWithDataProperty(
 
 }  // namespace
 
+//
+// Accessors::ReconfigureToDataProperty
+//
 void Accessors::ReconfigureToDataProperty(
     v8::Local<v8::Name> key, v8::Local<v8::Value> val,
     const v8::PropertyCallbackInfo<v8::Boolean>& info) {
@@ -118,6 +122,18 @@ void Accessors::ReconfigureToDataProperty(
   }
 }
 
+void Accessors::ReconfigureToDataPropertyGetter(
+    v8::Local<v8::Name> name, const v8::PropertyCallbackInfo<v8::Value>& info) {
+  UNREACHABLE();
+}
+
+Handle<AccessorInfo> Accessors::MakeReconfigureToDataPropertyInfo(
+    Isolate* isolate) {
+  Handle<Name> name = isolate->factory()->ReconfigureToDataProperty_string();
+  return MakeAccessor(isolate, name, &ReconfigureToDataPropertyGetter,
+                      &ReconfigureToDataProperty);
+}
+
 //
 // Accessors::ArgumentsIterator
 //
@@ -299,7 +315,6 @@ Handle<AccessorInfo> Accessors::MakeStringLengthInfo(Isolate* isolate) {
                       &StringLengthGetter, nullptr);
 }
 
-
 //
 // Accessors::ScriptColumnOffset
 //
@@ -613,7 +628,7 @@ void Accessors::ScriptEvalFromFunctionNameGetter(
   if (script->has_eval_from_shared()) {
     Handle<SharedFunctionInfo> shared(script->eval_from_shared());
     // Find the name of the function calling eval.
-    result = Handle<Object>(shared->name(), isolate);
+    result = Handle<Object>(shared->Name(), isolate);
   }
   info.GetReturnValue().Set(Utils::ToLocal(result));
 }
diff --git a/deps/v8/src/accessors.h b/deps/v8/src/accessors.h
index 70e6a9200ec..471d634571a 100644
--- a/deps/v8/src/accessors.h
+++ b/deps/v8/src/accessors.h
@@ -33,6 +33,7 @@ class JavaScriptFrame;
   V(function_name, FunctionName)                                    \
   V(function_length, FunctionLength)                                \
   V(function_prototype, FunctionPrototype)                          \
+  V(reconfigure_to_data_property, ReconfigureToDataProperty)        \
   V(script_column_offset, ScriptColumnOffset)                       \
   V(script_compilation_type, ScriptCompilationType)                 \
   V(script_context_data, ScriptContextData)                         \
@@ -48,6 +49,14 @@ class JavaScriptFrame;
   V(script_source_mapping_url, ScriptSourceMappingUrl)              \
   V(string_length, StringLength)
 
+#define SIDE_EFFECT_FREE_ACCESSOR_INFO_LIST(V) \
+  V(ArrayLength)                               \
+  V(BoundFunctionLength)                       \
+  V(BoundFunctionName)                         \
+  V(FunctionName)                              \
+  V(FunctionLength)                            \
+  V(StringLength)
+
 #define ACCESSOR_SETTER_LIST(V) \
   V(ArrayLengthSetter)          \
   V(ErrorStackSetter)           \
@@ -73,6 +82,16 @@ class Accessors : public AllStatic {
   ACCESSOR_SETTER_LIST(ACCESSOR_SETTER_DECLARATION)
 #undef ACCESSOR_SETTER_DECLARATION
 
+  static constexpr int kAccessorInfoCount =
+#define COUNT_ACCESSOR(...) +1
+      ACCESSOR_INFO_LIST(COUNT_ACCESSOR);
+#undef COUNT_ACCESSOR
+
+  static constexpr int kAccessorSetterCount =
+#define COUNT_ACCESSOR(...) +1
+      ACCESSOR_SETTER_LIST(COUNT_ACCESSOR);
+#undef COUNT_ACCESSOR
+
   static void ModuleNamespaceEntryGetter(
       v8::Local<v8::Name> name,
       const v8::PropertyCallbackInfo<v8::Value>& info);
diff --git a/deps/v8/src/allocation.cc b/deps/v8/src/allocation.cc
index e17de159c12..f63c2f292f5 100644
--- a/deps/v8/src/allocation.cc
+++ b/deps/v8/src/allocation.cc
@@ -69,7 +69,7 @@ const int kAllocationTries = 2;
 void* Malloced::New(size_t size) {
   void* result = AllocWithRetry(size);
   if (result == nullptr) {
-    V8::FatalProcessOutOfMemory("Malloced operator new");
+    V8::FatalProcessOutOfMemory(nullptr, "Malloced operator new");
   }
   return result;
 }
@@ -115,7 +115,7 @@ void* AlignedAlloc(size_t size, size_t alignment) {
     if (!OnCriticalMemoryPressure(size + alignment)) break;
   }
   if (result == nullptr) {
-    V8::FatalProcessOutOfMemory("AlignedAlloc");
+    V8::FatalProcessOutOfMemory(nullptr, "AlignedAlloc");
   }
   return result;
 }
@@ -143,6 +143,8 @@ void* GetRandomMmapAddr() { return GetPageAllocator()->GetRandomMmapAddr(); }
 
 void* AllocatePages(void* address, size_t size, size_t alignment,
                     PageAllocator::Permission access) {
+  DCHECK_EQ(address, AlignedAddress(address, alignment));
+  DCHECK_EQ(0UL, size & (GetPageAllocator()->AllocatePageSize() - 1));
   void* result = nullptr;
   for (int i = 0; i < kAllocationTries; ++i) {
     result =
@@ -160,6 +162,7 @@ void* AllocatePages(void* address, size_t size, size_t alignment,
 }
 
 bool FreePages(void* address, const size_t size) {
+  DCHECK_EQ(0UL, size & (GetPageAllocator()->AllocatePageSize() - 1));
   bool result = GetPageAllocator()->FreePages(address, size);
 #if defined(LEAK_SANITIZER)
   if (result) {
@@ -260,7 +263,9 @@ void VirtualMemory::Free() {
   size_t size = size_;
   CHECK(InVM(address, size));
   Reset();
-  CHECK(FreePages(address, size));
+  // FreePages expects size to be aligned to allocation granularity. Trimming
+  // may leave size at only commit granularity. Align it here.
+  CHECK(FreePages(address, RoundUp(size, AllocatePageSize())));
 }
 
 void VirtualMemory::TakeControl(VirtualMemory* from) {
diff --git a/deps/v8/src/allocation.h b/deps/v8/src/allocation.h
index 9bb47c8f05d..13dc3e508f3 100644
--- a/deps/v8/src/allocation.h
+++ b/deps/v8/src/allocation.h
@@ -14,13 +14,16 @@
 namespace v8 {
 namespace internal {
 
+class Isolate;
+
 // This file defines memory allocation functions. If a first attempt at an
 // allocation fails, these functions call back into the embedder, then attempt
 // the allocation a second time. The embedder callback must not reenter V8.
 
 // Called when allocation routines fail to allocate, even with a possible retry.
 // This function should not return, but should terminate the current processing.
-V8_EXPORT_PRIVATE void FatalProcessOutOfMemory(const char* message);
+[[noreturn]] V8_EXPORT_PRIVATE void FatalProcessOutOfMemory(
+    Isolate* isolate, const char* message);
 
 // Superclass for classes managed with new & delete.
 class V8_EXPORT_PRIVATE Malloced {
@@ -38,13 +41,13 @@ T* NewArray(size_t size) {
   if (result == nullptr) {
     V8::GetCurrentPlatform()->OnCriticalMemoryPressure();
     result = new (std::nothrow) T[size];
-    if (result == nullptr) FatalProcessOutOfMemory("NewArray");
+    if (result == nullptr) FatalProcessOutOfMemory(nullptr, "NewArray");
   }
   return result;
 }
 
-template <typename T,
-          typename = typename std::enable_if<IS_TRIVIALLY_COPYABLE(T)>::type>
+template <typename T, typename = typename std::enable_if<
+                          base::is_trivially_copyable<T>::value>::type>
 T* NewArray(size_t size, T default_val) {
   T* result = reinterpret_cast<T*>(NewArray<uint8_t>(sizeof(T) * size));
   for (size_t i = 0; i < size; ++i) result[i] = default_val;
diff --git a/deps/v8/src/api-arguments-inl.h b/deps/v8/src/api-arguments-inl.h
index b8336f97c4f..71e4491530d 100644
--- a/deps/v8/src/api-arguments-inl.h
+++ b/deps/v8/src/api-arguments-inl.h
@@ -13,56 +13,63 @@
 namespace v8 {
 namespace internal {
 
-#define FOR_EACH_CALLBACK(F)           \
-  F(Query, query, Object, v8::Integer) \
-  F(Deleter, deleter, Object, v8::Boolean)
+#define FOR_EACH_CALLBACK(F)                        \
+  F(Query, query, Object, v8::Integer, interceptor) \
+  F(Deleter, deleter, Object, v8::Boolean, Handle<Object>())
 
-#define PREPARE_CALLBACK_INFO(ISOLATE, F, RETURN_VALUE, API_RETURN_TYPE) \
+#define DCHECK_NAME_COMPATIBLE(interceptor, name) \
+  DCHECK(interceptor->is_named());                \
+  DCHECK(!name->IsPrivate());                     \
+  DCHECK_IMPLIES(name->IsSymbol(), interceptor->can_intercept_symbols());
+
+#define PREPARE_CALLBACK_INFO(ISOLATE, F, RETURN_VALUE, API_RETURN_TYPE, \
+                              CALLBACK_INFO)                             \
   if (ISOLATE->needs_side_effect_check() &&                              \
-      !PerformSideEffectCheck(ISOLATE, FUNCTION_ADDR(F))) {              \
+      !PerformSideEffectCheck(ISOLATE, CALLBACK_INFO)) {                 \
     return RETURN_VALUE();                                               \
   }                                                                      \
   VMState<EXTERNAL> state(ISOLATE);                                      \
   ExternalCallbackScope call_scope(ISOLATE, FUNCTION_ADDR(F));           \
   PropertyCallbackInfo<API_RETURN_TYPE> callback_info(begin());
 
-#define CREATE_NAMED_CALLBACK(Function, type, ReturnType, ApiReturnType)      \
-  Handle<ReturnType> PropertyCallbackArguments::CallNamed##Function(          \
+#define CREATE_NAMED_CALLBACK(FUNCTION, TYPE, RETURN_TYPE, API_RETURN_TYPE,   \
+                              INFO_FOR_SIDE_EFFECT)                           \
+  Handle<RETURN_TYPE> PropertyCallbackArguments::CallNamed##FUNCTION(         \
       Handle<InterceptorInfo> interceptor, Handle<Name> name) {               \
-    DCHECK(interceptor->is_named());                                          \
-    DCHECK(!name->IsPrivate());                                               \
-    DCHECK_IMPLIES(name->IsSymbol(), interceptor->can_intercept_symbols());   \
+    DCHECK_NAME_COMPATIBLE(interceptor, name);                                \
     Isolate* isolate = this->isolate();                                       \
     RuntimeCallTimerScope timer(                                              \
-        isolate, RuntimeCallCounterId::kNamed##Function##Callback);           \
-    DCHECK(!name->IsPrivate());                                               \
-    GenericNamedProperty##Function##Callback f =                              \
-        ToCData<GenericNamedProperty##Function##Callback>(                    \
-            interceptor->type());                                             \
-    PREPARE_CALLBACK_INFO(isolate, f, Handle<ReturnType>, ApiReturnType);     \
+        isolate, RuntimeCallCounterId::kNamed##FUNCTION##Callback);           \
+    GenericNamedProperty##FUNCTION##Callback f =                              \
+        ToCData<GenericNamedProperty##FUNCTION##Callback>(                    \
+            interceptor->TYPE());                                             \
+    PREPARE_CALLBACK_INFO(isolate, f, Handle<RETURN_TYPE>, API_RETURN_TYPE,   \
+                          INFO_FOR_SIDE_EFFECT);                              \
     LOG(isolate,                                                              \
-        ApiNamedPropertyAccess("interceptor-named-" #type, holder(), *name)); \
+        ApiNamedPropertyAccess("interceptor-named-" #TYPE, holder(), *name)); \
     f(v8::Utils::ToLocal(name), callback_info);                               \
-    return GetReturnValue<ReturnType>(isolate);                               \
+    return GetReturnValue<RETURN_TYPE>(isolate);                              \
   }
 
 FOR_EACH_CALLBACK(CREATE_NAMED_CALLBACK)
 #undef CREATE_NAMED_CALLBACK
 
-#define CREATE_INDEXED_CALLBACK(Function, type, ReturnType, ApiReturnType) \
-  Handle<ReturnType> PropertyCallbackArguments::CallIndexed##Function(     \
-      Handle<InterceptorInfo> interceptor, uint32_t index) {               \
-    DCHECK(!interceptor->is_named());                                      \
-    Isolate* isolate = this->isolate();                                    \
-    RuntimeCallTimerScope timer(                                           \
-        isolate, RuntimeCallCounterId::kIndexed##Function##Callback);      \
-    IndexedProperty##Function##Callback f =                                \
-        ToCData<IndexedProperty##Function##Callback>(interceptor->type()); \
-    PREPARE_CALLBACK_INFO(isolate, f, Handle<ReturnType>, ApiReturnType);  \
-    LOG(isolate, ApiIndexedPropertyAccess("interceptor-indexed-" #type,    \
-                                          holder(), index));               \
-    f(index, callback_info);                                               \
-    return GetReturnValue<ReturnType>(isolate);                            \
+#define CREATE_INDEXED_CALLBACK(FUNCTION, TYPE, RETURN_TYPE, API_RETURN_TYPE, \
+                                INFO_FOR_SIDE_EFFECT)                         \
+  Handle<RETURN_TYPE> PropertyCallbackArguments::CallIndexed##FUNCTION(       \
+      Handle<InterceptorInfo> interceptor, uint32_t index) {                  \
+    DCHECK(!interceptor->is_named());                                         \
+    Isolate* isolate = this->isolate();                                       \
+    RuntimeCallTimerScope timer(                                              \
+        isolate, RuntimeCallCounterId::kIndexed##FUNCTION##Callback);         \
+    IndexedProperty##FUNCTION##Callback f =                                   \
+        ToCData<IndexedProperty##FUNCTION##Callback>(interceptor->TYPE());    \
+    PREPARE_CALLBACK_INFO(isolate, f, Handle<RETURN_TYPE>, API_RETURN_TYPE,   \
+                          INFO_FOR_SIDE_EFFECT);                              \
+    LOG(isolate, ApiIndexedPropertyAccess("interceptor-indexed-" #TYPE,       \
+                                          holder(), index));                  \
+    f(index, callback_info);                                                  \
+    return GetReturnValue<RETURN_TYPE>(isolate);                              \
   }
 
 FOR_EACH_CALLBACK(CREATE_INDEXED_CALLBACK)
@@ -72,9 +79,7 @@ FOR_EACH_CALLBACK(CREATE_INDEXED_CALLBACK)
 
 Handle<Object> PropertyCallbackArguments::CallNamedGetter(
     Handle<InterceptorInfo> interceptor, Handle<Name> name) {
-  DCHECK(interceptor->is_named());
-  DCHECK_IMPLIES(name->IsSymbol(), interceptor->can_intercept_symbols());
-  DCHECK(!name->IsPrivate());
+  DCHECK_NAME_COMPATIBLE(interceptor, name);
   Isolate* isolate = this->isolate();
   RuntimeCallTimerScope timer(isolate,
                               RuntimeCallCounterId::kNamedGetterCallback);
@@ -82,13 +87,12 @@ Handle<Object> PropertyCallbackArguments::CallNamedGetter(
       ApiNamedPropertyAccess("interceptor-named-getter", holder(), *name));
   GenericNamedPropertyGetterCallback f =
       ToCData<GenericNamedPropertyGetterCallback>(interceptor->getter());
-  return BasicCallNamedGetterCallback(f, name);
+  return BasicCallNamedGetterCallback(f, name, interceptor);
 }
 
 Handle<Object> PropertyCallbackArguments::CallNamedDescriptor(
     Handle<InterceptorInfo> interceptor, Handle<Name> name) {
-  DCHECK(interceptor->is_named());
-  DCHECK_IMPLIES(name->IsSymbol(), interceptor->can_intercept_symbols());
+  DCHECK_NAME_COMPATIBLE(interceptor, name);
   Isolate* isolate = this->isolate();
   RuntimeCallTimerScope timer(isolate,
                               RuntimeCallCounterId::kNamedDescriptorCallback);
@@ -97,14 +101,15 @@ Handle<Object> PropertyCallbackArguments::CallNamedDescriptor(
   GenericNamedPropertyDescriptorCallback f =
       ToCData<GenericNamedPropertyDescriptorCallback>(
           interceptor->descriptor());
-  return BasicCallNamedGetterCallback(f, name);
+  return BasicCallNamedGetterCallback(f, name, interceptor);
 }
 
 Handle<Object> PropertyCallbackArguments::BasicCallNamedGetterCallback(
-    GenericNamedPropertyGetterCallback f, Handle<Name> name) {
+    GenericNamedPropertyGetterCallback f, Handle<Name> name,
+    Handle<Object> info) {
   DCHECK(!name->IsPrivate());
   Isolate* isolate = this->isolate();
-  PREPARE_CALLBACK_INFO(isolate, f, Handle<Object>, v8::Value);
+  PREPARE_CALLBACK_INFO(isolate, f, Handle<Object>, v8::Value, info);
   f(v8::Utils::ToLocal(name), callback_info);
   return GetReturnValue<Object>(isolate);
 }
@@ -112,20 +117,16 @@ Handle<Object> PropertyCallbackArguments::BasicCallNamedGetterCallback(
 Handle<Object> PropertyCallbackArguments::CallNamedSetter(
     Handle<InterceptorInfo> interceptor, Handle<Name> name,
     Handle<Object> value) {
-  DCHECK_IMPLIES(name->IsSymbol(), interceptor->can_intercept_symbols());
+  DCHECK_NAME_COMPATIBLE(interceptor, name);
   GenericNamedPropertySetterCallback f =
       ToCData<GenericNamedPropertySetterCallback>(interceptor->setter());
-  return CallNamedSetterCallback(f, name, value);
-}
-
-Handle<Object> PropertyCallbackArguments::CallNamedSetterCallback(
-    GenericNamedPropertySetterCallback f, Handle<Name> name,
-    Handle<Object> value) {
-  DCHECK(!name->IsPrivate());
   Isolate* isolate = this->isolate();
   RuntimeCallTimerScope timer(isolate,
                               RuntimeCallCounterId::kNamedSetterCallback);
-  PREPARE_CALLBACK_INFO(isolate, f, Handle<Object>, v8::Value);
+  DCHECK(!isolate->needs_side_effect_check());
+  Handle<Object> side_effect_check_not_supported;
+  PREPARE_CALLBACK_INFO(isolate, f, Handle<Object>, v8::Value,
+                        side_effect_check_not_supported);
   LOG(isolate,
       ApiNamedPropertyAccess("interceptor-named-set", holder(), *name));
   f(v8::Utils::ToLocal(name), v8::Utils::ToLocal(value), callback_info);
@@ -135,15 +136,17 @@ Handle<Object> PropertyCallbackArguments::CallNamedSetterCallback(
 Handle<Object> PropertyCallbackArguments::CallNamedDefiner(
     Handle<InterceptorInfo> interceptor, Handle<Name> name,
     const v8::PropertyDescriptor& desc) {
-  DCHECK(interceptor->is_named());
-  DCHECK(!name->IsPrivate());
-  DCHECK_IMPLIES(name->IsSymbol(), interceptor->can_intercept_symbols());
+  DCHECK_NAME_COMPATIBLE(interceptor, name);
   Isolate* isolate = this->isolate();
   RuntimeCallTimerScope timer(isolate,
                               RuntimeCallCounterId::kNamedDefinerCallback);
   GenericNamedPropertyDefinerCallback f =
       ToCData<GenericNamedPropertyDefinerCallback>(interceptor->definer());
-  PREPARE_CALLBACK_INFO(isolate, f, Handle<Object>, v8::Value);
+  // We should not have come this far when side effect checks are enabled.
+  DCHECK(!isolate->needs_side_effect_check());
+  Handle<Object> side_effect_check_not_supported;
+  PREPARE_CALLBACK_INFO(isolate, f, Handle<Object>, v8::Value,
+                        side_effect_check_not_supported);
   LOG(isolate,
       ApiNamedPropertyAccess("interceptor-named-define", holder(), *name));
   f(v8::Utils::ToLocal(name), desc, callback_info);
@@ -158,7 +161,11 @@ Handle<Object> PropertyCallbackArguments::CallIndexedSetter(
                               RuntimeCallCounterId::kIndexedSetterCallback);
   IndexedPropertySetterCallback f =
       ToCData<IndexedPropertySetterCallback>(interceptor->setter());
-  PREPARE_CALLBACK_INFO(isolate, f, Handle<Object>, v8::Value);
+  // We should not have come this far when side effect checks are enabled.
+  DCHECK(!isolate->needs_side_effect_check());
+  Handle<Object> side_effect_check_not_supported;
+  PREPARE_CALLBACK_INFO(isolate, f, Handle<Object>, v8::Value,
+                        side_effect_check_not_supported);
   LOG(isolate,
       ApiIndexedPropertyAccess("interceptor-indexed-set", holder(), index));
   f(index, v8::Utils::ToLocal(value), callback_info);
@@ -174,7 +181,11 @@ Handle<Object> PropertyCallbackArguments::CallIndexedDefiner(
                               RuntimeCallCounterId::kIndexedDefinerCallback);
   IndexedPropertyDefinerCallback f =
       ToCData<IndexedPropertyDefinerCallback>(interceptor->definer());
-  PREPARE_CALLBACK_INFO(isolate, f, Handle<Object>, v8::Value);
+  // We should not have come this far when side effect checks are enabled.
+  DCHECK(!isolate->needs_side_effect_check());
+  Handle<Object> side_effect_check_not_supported;
+  PREPARE_CALLBACK_INFO(isolate, f, Handle<Object>, v8::Value,
+                        side_effect_check_not_supported);
   LOG(isolate,
       ApiIndexedPropertyAccess("interceptor-indexed-define", holder(), index));
   f(index, desc, callback_info);
@@ -191,7 +202,7 @@ Handle<Object> PropertyCallbackArguments::CallIndexedGetter(
       ApiIndexedPropertyAccess("interceptor-indexed-getter", holder(), index));
   IndexedPropertyGetterCallback f =
       ToCData<IndexedPropertyGetterCallback>(interceptor->getter());
-  return BasicCallIndexedGetterCallback(f, index);
+  return BasicCallIndexedGetterCallback(f, index, interceptor);
 }
 
 Handle<Object> PropertyCallbackArguments::CallIndexedDescriptor(
@@ -204,13 +215,13 @@ Handle<Object> PropertyCallbackArguments::CallIndexedDescriptor(
                                         holder(), index));
   IndexedPropertyDescriptorCallback f =
       ToCData<IndexedPropertyDescriptorCallback>(interceptor->descriptor());
-  return BasicCallIndexedGetterCallback(f, index);
+  return BasicCallIndexedGetterCallback(f, index, interceptor);
 }
 
 Handle<Object> PropertyCallbackArguments::BasicCallIndexedGetterCallback(
-    IndexedPropertyGetterCallback f, uint32_t index) {
+    IndexedPropertyGetterCallback f, uint32_t index, Handle<Object> info) {
   Isolate* isolate = this->isolate();
-  PREPARE_CALLBACK_INFO(isolate, f, Handle<Object>, v8::Value);
+  PREPARE_CALLBACK_INFO(isolate, f, Handle<Object>, v8::Value, info);
   f(index, callback_info);
   return GetReturnValue<Object>(isolate);
 }
@@ -222,7 +233,7 @@ Handle<JSObject> PropertyCallbackArguments::CallPropertyEnumerator(
       v8::ToCData<IndexedPropertyEnumeratorCallback>(interceptor->enumerator());
   // TODO(cbruni): assert same type for indexed and named callback.
   Isolate* isolate = this->isolate();
-  PREPARE_CALLBACK_INFO(isolate, f, Handle<JSObject>, v8::Array);
+  PREPARE_CALLBACK_INFO(isolate, f, Handle<JSObject>, v8::Array, interceptor);
   f(callback_info);
   return GetReturnValue<JSObject>(isolate);
 }
@@ -238,10 +249,10 @@ Handle<Object> PropertyCallbackArguments::CallAccessorGetter(
   LOG(isolate, ApiNamedPropertyAccess("accessor-getter", holder(), *name));
   AccessorNameGetterCallback f =
       ToCData<AccessorNameGetterCallback>(info->getter());
-  return BasicCallNamedGetterCallback(f, name);
+  return BasicCallNamedGetterCallback(f, name, info);
 }
 
-void PropertyCallbackArguments::CallAccessorSetter(
+Handle<Object> PropertyCallbackArguments::CallAccessorSetter(
     Handle<AccessorInfo> accessor_info, Handle<Name> name,
     Handle<Object> value) {
   Isolate* isolate = this->isolate();
@@ -249,9 +260,14 @@ void PropertyCallbackArguments::CallAccessorSetter(
                               RuntimeCallCounterId::kAccessorSetterCallback);
   AccessorNameSetterCallback f =
       ToCData<AccessorNameSetterCallback>(accessor_info->setter());
-  PREPARE_CALLBACK_INFO(isolate, f, void, void);
+  // We should not have come this far when side effect checks are enabled.
+  DCHECK(!isolate->needs_side_effect_check());
+  Handle<Object> side_effect_check_not_supported;
+  PREPARE_CALLBACK_INFO(isolate, f, Handle<Object>, void,
+                        side_effect_check_not_supported);
   LOG(isolate, ApiNamedPropertyAccess("accessor-setter", holder(), *name));
   f(v8::Utils::ToLocal(name), v8::Utils::ToLocal(value), callback_info);
+  return GetReturnValue<Object>(isolate);
 }
 
 #undef PREPARE_CALLBACK_INFO
diff --git a/deps/v8/src/api-arguments.cc b/deps/v8/src/api-arguments.cc
index 1302e32b665..4dd2ff9d8f9 100644
--- a/deps/v8/src/api-arguments.cc
+++ b/deps/v8/src/api-arguments.cc
@@ -13,13 +13,16 @@
 namespace v8 {
 namespace internal {
 
-Handle<Object> FunctionCallbackArguments::Call(FunctionCallback f) {
+Handle<Object> FunctionCallbackArguments::Call(CallHandlerInfo* handler) {
   Isolate* isolate = this->isolate();
+  LOG(isolate, ApiObjectAccess("call", holder()));
+  RuntimeCallTimerScope timer(isolate, RuntimeCallCounterId::kFunctionCallback);
+  v8::FunctionCallback f =
+      v8::ToCData<v8::FunctionCallback>(handler->callback());
   if (isolate->needs_side_effect_check() &&
-      !isolate->debug()->PerformSideEffectCheckForCallback(FUNCTION_ADDR(f))) {
+      !isolate->debug()->PerformSideEffectCheckForCallback(handler)) {
     return Handle<Object>();
   }
-  RuntimeCallTimerScope timer(isolate, RuntimeCallCounterId::kFunctionCallback);
   VMState<EXTERNAL> state(isolate);
   ExternalCallbackScope call_scope(isolate, FUNCTION_ADDR(f));
   FunctionCallbackInfo<v8::Value> info(begin(), argv_, argc_);
@@ -45,9 +48,11 @@ Handle<JSObject> PropertyCallbackArguments::CallIndexedEnumerator(
   return CallPropertyEnumerator(interceptor);
 }
 
-bool PropertyCallbackArguments::PerformSideEffectCheck(Isolate* isolate,
-                                                       Address function) {
-  return isolate->debug()->PerformSideEffectCheckForCallback(function);
+bool PropertyCallbackArguments::PerformSideEffectCheck(
+    Isolate* isolate, Handle<Object> callback_info) {
+  // TODO(7515): always pass a valid callback info object.
+  if (callback_info.is_null()) return false;
+  return isolate->debug()->PerformSideEffectCheckForCallback(*callback_info);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/api-arguments.h b/deps/v8/src/api-arguments.h
index 42d58b88a81..d69849bf5c3 100644
--- a/deps/v8/src/api-arguments.h
+++ b/deps/v8/src/api-arguments.h
@@ -19,7 +19,8 @@ template <int kArrayLength>
 class CustomArgumentsBase : public Relocatable {
  public:
   virtual inline void IterateInstance(RootVisitor* v) {
-    v->VisitRootPointers(Root::kRelocatable, values_, values_ + kArrayLength);
+    v->VisitRootPointers(Root::kRelocatable, nullptr, values_,
+                         values_ + kArrayLength);
   }
 
  protected:
@@ -102,8 +103,9 @@ class PropertyCallbackArguments
   // -------------------------------------------------------------------------
   // Accessor Callbacks
   // Also used for AccessorSetterCallback.
-  inline void CallAccessorSetter(Handle<AccessorInfo> info, Handle<Name> name,
-                                 Handle<Object> value);
+  inline Handle<Object> CallAccessorSetter(Handle<AccessorInfo> info,
+                                           Handle<Name> name,
+                                           Handle<Object> value);
   // Also used for AccessorGetterCallback, AccessorNameGetterCallback.
   inline Handle<Object> CallAccessorGetter(Handle<AccessorInfo> info,
                                            Handle<Name> name);
@@ -117,9 +119,6 @@ class PropertyCallbackArguments
   inline Handle<Object> CallNamedSetter(Handle<InterceptorInfo> interceptor,
                                         Handle<Name> name,
                                         Handle<Object> value);
-  inline Handle<Object> CallNamedSetterCallback(
-      GenericNamedPropertySetterCallback callback, Handle<Name> name,
-      Handle<Object> value);
   inline Handle<Object> CallNamedDefiner(Handle<InterceptorInfo> interceptor,
                                          Handle<Name> name,
                                          const v8::PropertyDescriptor& desc);
@@ -159,15 +158,16 @@ class PropertyCallbackArguments
       Handle<InterceptorInfo> interceptor);
 
   inline Handle<Object> BasicCallIndexedGetterCallback(
-      IndexedPropertyGetterCallback f, uint32_t index);
+      IndexedPropertyGetterCallback f, uint32_t index, Handle<Object> info);
   inline Handle<Object> BasicCallNamedGetterCallback(
-      GenericNamedPropertyGetterCallback f, Handle<Name> name);
+      GenericNamedPropertyGetterCallback f, Handle<Name> name,
+      Handle<Object> info);
 
   inline JSObject* holder() {
     return JSObject::cast(this->begin()[T::kHolderIndex]);
   }
 
-  bool PerformSideEffectCheck(Isolate* isolate, Address function);
+  bool PerformSideEffectCheck(Isolate* isolate, Handle<Object> callback_info);
 
   // Don't copy PropertyCallbackArguments, because they would both have the
   // same prev_ pointer.
@@ -215,9 +215,13 @@ class FunctionCallbackArguments
    * and used if it's been set to anything inside the callback.
    * New style callbacks always use the return value.
    */
-  Handle<Object> Call(FunctionCallback f);
+  Handle<Object> Call(CallHandlerInfo* handler);
 
  private:
+  inline JSObject* holder() {
+    return JSObject::cast(this->begin()[T::kHolderIndex]);
+  }
+
   internal::Object** argv_;
   int argc_;
 };
diff --git a/deps/v8/src/api-natives.cc b/deps/v8/src/api-natives.cc
index b8f03a89a80..981f592f5a0 100644
--- a/deps/v8/src/api-natives.cc
+++ b/deps/v8/src/api-natives.cc
@@ -285,10 +285,10 @@ MaybeHandle<JSObject> ProbeInstantiationsCache(Isolate* isolate,
   } else if (caching_mode == CachingMode::kUnlimited ||
              (serial_number <=
               TemplateInfo::kSlowTemplateInstantiationsCacheSize)) {
-    Handle<NumberDictionary> slow_cache =
+    Handle<SimpleNumberDictionary> slow_cache =
         isolate->slow_template_instantiations_cache();
     int entry = slow_cache->FindEntry(serial_number);
-    if (entry == NumberDictionary::kNotFound) {
+    if (entry == SimpleNumberDictionary::kNotFound) {
       return MaybeHandle<JSObject>();
     }
     return handle(JSObject::cast(slow_cache->ValueAt(entry)), isolate);
@@ -313,9 +313,9 @@ void CacheTemplateInstantiation(Isolate* isolate, int serial_number,
   } else if (caching_mode == CachingMode::kUnlimited ||
              (serial_number <=
               TemplateInfo::kSlowTemplateInstantiationsCacheSize)) {
-    Handle<NumberDictionary> cache =
+    Handle<SimpleNumberDictionary> cache =
         isolate->slow_template_instantiations_cache();
-    auto new_cache = NumberDictionary::Set(cache, serial_number, object);
+    auto new_cache = SimpleNumberDictionary::Set(cache, serial_number, object);
     if (*new_cache != *cache) {
       isolate->native_context()->set_slow_template_instantiations_cache(
           *new_cache);
@@ -334,11 +334,11 @@ void UncacheTemplateInstantiation(Isolate* isolate, int serial_number,
   } else if (caching_mode == CachingMode::kUnlimited ||
              (serial_number <=
               TemplateInfo::kSlowTemplateInstantiationsCacheSize)) {
-    Handle<NumberDictionary> cache =
+    Handle<SimpleNumberDictionary> cache =
         isolate->slow_template_instantiations_cache();
     int entry = cache->FindEntry(serial_number);
-    DCHECK_NE(NumberDictionary::kNotFound, entry);
-    cache = NumberDictionary::DeleteEntry(cache, entry);
+    DCHECK_NE(SimpleNumberDictionary::kNotFound, entry);
+    cache = SimpleNumberDictionary::DeleteEntry(cache, entry);
     isolate->native_context()->set_slow_template_instantiations_cache(*cache);
   }
 }
@@ -626,7 +626,7 @@ Handle<JSFunction> ApiNatives::CreateApiFunction(
       FunctionTemplateInfo::GetOrCreateSharedFunctionInfo(isolate, obj,
                                                           maybe_name);
   // To simplify things, API functions always have shared name.
-  DCHECK(shared->has_shared_name());
+  DCHECK(shared->HasSharedName());
 
   Handle<JSFunction> result =
       isolate->factory()->NewFunctionFromSharedFunctionInfo(
@@ -726,7 +726,6 @@ Handle<JSFunction> ApiNatives::CreateApiFunction(
   // Mark instance as callable in the map.
   if (!obj->instance_call_handler()->IsUndefined(isolate)) {
     map->set_is_callable(true);
-    map->set_is_constructor(true);
   }
 
   if (immutable_proto) map->set_is_immutable_proto(true);
diff --git a/deps/v8/src/api-natives.h b/deps/v8/src/api-natives.h
index 455be0dd06b..b920e65e8b5 100644
--- a/deps/v8/src/api-natives.h
+++ b/deps/v8/src/api-natives.h
@@ -5,6 +5,8 @@
 #ifndef V8_API_NATIVES_H_
 #define V8_API_NATIVES_H_
 
+#include "include/v8.h"
+#include "src/base/macros.h"
 #include "src/handles.h"
 #include "src/property-details.h"
 
@@ -39,7 +41,7 @@ class ApiNatives {
   static Handle<JSFunction> CreateApiFunction(
       Isolate* isolate, Handle<FunctionTemplateInfo> obj,
       Handle<Object> prototype, ApiInstanceType instance_type,
-      MaybeHandle<Name> maybe_name = MaybeHandle<Name>());
+      MaybeHandle<Name> name = MaybeHandle<Name>());
 
   static void AddDataProperty(Isolate* isolate, Handle<TemplateInfo> info,
                               Handle<Name> name, Handle<Object> value,
@@ -62,4 +64,4 @@ class ApiNatives {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_API_NATIVES_H_
diff --git a/deps/v8/src/api.cc b/deps/v8/src/api.cc
index d258c878532..4dfbfec1071 100644
--- a/deps/v8/src/api.cc
+++ b/deps/v8/src/api.cc
@@ -11,7 +11,6 @@
 #include <cmath>  // For isnan.
 #include <limits>
 #include <vector>
-#include "include/v8-debug.h"
 #include "include/v8-profiler.h"
 #include "include/v8-testing.h"
 #include "include/v8-util.h"
@@ -34,6 +33,7 @@
 #include "src/conversions-inl.h"
 #include "src/counters.h"
 #include "src/debug/debug-coverage.h"
+#include "src/debug/debug-evaluate.h"
 #include "src/debug/debug-type-profile.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
@@ -49,7 +49,6 @@
 #include "src/json-stringifier.h"
 #include "src/messages.h"
 #include "src/objects-inl.h"
-#include "src/parsing/background-parsing-task.h"
 #include "src/parsing/parser.h"
 #include "src/parsing/scanner-character-streams.h"
 #include "src/pending-compilation-error-handler.h"
@@ -70,6 +69,7 @@
 #include "src/snapshot/natives.h"
 #include "src/snapshot/snapshot.h"
 #include "src/startup-data-util.h"
+#include "src/string-hasher.h"
 #include "src/tracing/trace-event.h"
 #include "src/trap-handler/trap-handler.h"
 #include "src/unicode-cache-inl.h"
@@ -308,19 +308,22 @@ static ScriptOrigin GetScriptOriginForScript(i::Isolate* isolate,
 
 // --- E x c e p t i o n   B e h a v i o r ---
 
-
-void i::FatalProcessOutOfMemory(const char* location) {
-  i::V8::FatalProcessOutOfMemory(location, false);
+void i::FatalProcessOutOfMemory(i::Isolate* isolate, const char* location) {
+  i::V8::FatalProcessOutOfMemory(isolate, location, false);
 }
 
 // When V8 cannot allocate memory FatalProcessOutOfMemory is called. The default
 // OOM error handler is called and execution is stopped.
-void i::V8::FatalProcessOutOfMemory(const char* location, bool is_heap_oom) {
-  i::Isolate* isolate = i::Isolate::Current();
+void i::V8::FatalProcessOutOfMemory(i::Isolate* isolate, const char* location,
+                                    bool is_heap_oom) {
   char last_few_messages[Heap::kTraceRingBufferSize + 1];
   char js_stacktrace[Heap::kStacktraceBufferSize + 1];
   i::HeapStats heap_stats;
 
+  if (isolate == nullptr) {
+    isolate = Isolate::Current();
+  }
+
   if (isolate == nullptr) {
     // On a background thread -> we cannot retrieve memory information from the
     // Isolate. Write easy-to-recognize values on the stack.
@@ -330,7 +333,7 @@ void i::V8::FatalProcessOutOfMemory(const char* location, bool is_heap_oom) {
     // Note that the embedder's oom handler won't be called in this case. We
     // just crash.
     FATAL("API fatal error handler returned after process out of memory");
-    return;
+    UNREACHABLE();
   }
 
   memset(last_few_messages, 0, Heap::kTraceRingBufferSize + 1);
@@ -394,7 +397,7 @@ void i::V8::FatalProcessOutOfMemory(const char* location, bool is_heap_oom) {
     PrintF("\n<--- Last few GCs --->\n%s\n", first_newline);
     PrintF("\n<--- JS stacktrace --->\n%s\n", js_stacktrace);
   }
-  Utils::ReportOOMFailure(location, is_heap_oom);
+  Utils::ReportOOMFailure(isolate, location, is_heap_oom);
   // If the fatal error handler returns, we stop execution.
   FATAL("API fatal error handler returned after process out of memory");
 }
@@ -416,8 +419,8 @@ void Utils::ReportApiFailure(const char* location, const char* message) {
   isolate->SignalFatalError();
 }
 
-void Utils::ReportOOMFailure(const char* location, bool is_heap_oom) {
-  i::Isolate* isolate = i::Isolate::Current();
+void Utils::ReportOOMFailure(i::Isolate* isolate, const char* location,
+                             bool is_heap_oom) {
   OOMErrorCallback oom_callback = isolate->oom_behavior();
   if (oom_callback == nullptr) {
     // TODO(wfh): Remove this fallback once Blink is setting OOM handler. See
@@ -457,33 +460,11 @@ void V8::SetSnapshotDataBlob(StartupData* snapshot_blob) {
   i::V8::SetSnapshotBlob(snapshot_blob);
 }
 
-void* v8::ArrayBuffer::Allocator::Reserve(size_t length) { UNIMPLEMENTED(); }
-
-void v8::ArrayBuffer::Allocator::Free(void* data, size_t length,
-                                      AllocationMode mode) {
-  switch (mode) {
-    case AllocationMode::kNormal: {
-      Free(data, length);
-      return;
-    }
-    case AllocationMode::kReservation: {
-      UNIMPLEMENTED();
-      return;
-    }
-  }
-}
-
-void v8::ArrayBuffer::Allocator::SetProtection(
-    void* data, size_t length,
-    v8::ArrayBuffer::Allocator::Protection protection) {
-  UNIMPLEMENTED();
-}
-
 namespace {
 
 class ArrayBufferAllocator : public v8::ArrayBuffer::Allocator {
  public:
-  virtual void* Allocate(size_t length) {
+  void* Allocate(size_t length) override {
 #if V8_OS_AIX && _LINUX_SOURCE_COMPAT
     // Work around for GCC bug on AIX
     // See: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79839
@@ -494,7 +475,7 @@ class ArrayBufferAllocator : public v8::ArrayBuffer::Allocator {
     return data;
   }
 
-  virtual void* AllocateUninitialized(size_t length) {
+  void* AllocateUninitialized(size_t length) override {
 #if V8_OS_AIX && _LINUX_SOURCE_COMPAT
     // Work around for GCC bug on AIX
     // See: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79839
@@ -505,42 +486,7 @@ class ArrayBufferAllocator : public v8::ArrayBuffer::Allocator {
     return data;
   }
 
-  virtual void Free(void* data, size_t) { free(data); }
-
-  virtual void* Reserve(size_t length) {
-    size_t page_size = i::AllocatePageSize();
-    size_t allocated = RoundUp(length, page_size);
-    void* address = i::AllocatePages(i::GetRandomMmapAddr(), allocated,
-                                     page_size, PageAllocator::kNoAccess);
-    return address;
-  }
-
-  virtual void Free(void* data, size_t length,
-                    v8::ArrayBuffer::Allocator::AllocationMode mode) {
-    switch (mode) {
-      case v8::ArrayBuffer::Allocator::AllocationMode::kNormal: {
-        return Free(data, length);
-      }
-      case v8::ArrayBuffer::Allocator::AllocationMode::kReservation: {
-        size_t page_size = i::AllocatePageSize();
-        size_t allocated = RoundUp(length, page_size);
-        CHECK(i::FreePages(data, allocated));
-        return;
-      }
-    }
-  }
-
-  virtual void SetProtection(
-      void* data, size_t length,
-      v8::ArrayBuffer::Allocator::Protection protection) {
-    DCHECK(protection == v8::ArrayBuffer::Allocator::Protection::kNoAccess ||
-           protection == v8::ArrayBuffer::Allocator::Protection::kReadWrite);
-    PageAllocator::Permission permission =
-        (protection == v8::ArrayBuffer::Allocator::Protection::kReadWrite)
-            ? PageAllocator::kReadWrite
-            : PageAllocator::kNoAccess;
-    CHECK(i::SetPermissions(data, length, permission));
-  }
+  void Free(void* data, size_t) override { free(data); }
 };
 
 bool RunExtraCode(Isolate* isolate, Local<Context> context,
@@ -762,7 +708,7 @@ StartupData SnapshotCreator::CreateBlob(
   // context even after we have disposed of the context.
   isolate->heap()->CollectAllAvailableGarbage(
       i::GarbageCollectionReason::kSnapshotCreator);
-  isolate->heap()->CompactWeakFixedArrays();
+  isolate->heap()->CompactFixedArraysOfWeakCells();
 
   i::DisallowHeapAllocation no_gc_from_here_on;
 
@@ -786,15 +732,33 @@ StartupData SnapshotCreator::CreateBlob(
   i::SerializedHandleChecker handle_checker(isolate, &contexts);
   CHECK(handle_checker.CheckGlobalAndEternalHandles());
 
-  // Complete in-object slack tracking for all functions.
   i::HeapIterator heap_iterator(isolate->heap());
   while (i::HeapObject* current_obj = heap_iterator.next()) {
-    if (!current_obj->IsJSFunction()) continue;
-    i::JSFunction* fun = i::JSFunction::cast(current_obj);
-    fun->CompleteInobjectSlackTrackingIfActive();
+    // Complete in-object slack tracking for all functions.
+    if (current_obj->IsJSFunction()) {
+      i::JSFunction* fun = i::JSFunction::cast(current_obj);
+      fun->CompleteInobjectSlackTrackingIfActive();
+    }
+
+    // Clear out re-compilable data from all shared function infos. Any
+    // JSFunctions using these SFIs will have their code pointers reset by the
+    // partial serializer.
+    if (current_obj->IsSharedFunctionInfo() &&
+        function_code_handling == FunctionCodeHandling::kClear) {
+      i::SharedFunctionInfo* shared = i::SharedFunctionInfo::cast(current_obj);
+      if (shared->HasBytecodeArray()) {
+        shared->ClearBytecodeArray();
+      } else if (shared->HasAsmWasmData()) {
+        shared->ClearAsmWasmData();
+      } else if (shared->HasPreParsedScopeData()) {
+        shared->ClearPreParsedScopeData();
+      }
+      DCHECK(shared->HasCodeObject() || shared->HasBuiltinId() ||
+             shared->IsApiFunction());
+    }
   }
 
-  i::StartupSerializer startup_serializer(isolate, function_code_handling);
+  i::StartupSerializer startup_serializer(isolate);
   startup_serializer.SerializeStrongReferences();
 
   // Serialize each context with a new partial serializer.
@@ -1069,6 +1033,10 @@ void* V8::ClearWeak(i::Object** location) {
   return i::GlobalHandles::ClearWeakness(location);
 }
 
+void V8::AnnotateStrongRetainer(i::Object** location, const char* label) {
+  i::GlobalHandles::AnnotateStrongRetainer(location, label);
+}
+
 void V8::DisposeGlobal(i::Object** location) {
   i::GlobalHandles::Destroy(location);
 }
@@ -1275,13 +1243,18 @@ static i::Handle<i::FixedArray> EmbedderDataFor(Context* context,
   if (!Utils::ApiCheck(can_grow, location, "Index too large")) {
     return i::Handle<i::FixedArray>();
   }
-  int new_size = i::Max(index, data->length() << 1) + 1;
+  int new_size = index + 1;
   int grow_by = new_size - data->length();
   data = isolate->factory()->CopyFixedArrayAndGrow(data, grow_by);
   env->set_embedder_data(*data);
   return data;
 }
 
+uint32_t Context::GetNumberOfEmbedderDataFields() {
+  i::Handle<i::Context> context = Utils::OpenHandle(this);
+  CHECK(context->IsNativeContext());
+  return static_cast<uint32_t>(context->embedder_data()->length());
+}
 
 v8::Local<v8::Value> Context::SlowGetEmbedderData(int index) {
   const char* location = "v8::Context::GetEmbedderData()";
@@ -2069,11 +2042,9 @@ bool ScriptCompiler::ExternalSourceStream::SetBookmark() { return false; }
 
 void ScriptCompiler::ExternalSourceStream::ResetToBookmark() { UNREACHABLE(); }
 
-
 ScriptCompiler::StreamedSource::StreamedSource(ExternalSourceStream* stream,
                                                Encoding encoding)
-    : impl_(new i::StreamedSource(stream, encoding)) {}
-
+    : impl_(new i::ScriptStreamingData(stream, encoding)) {}
 
 ScriptCompiler::StreamedSource::~StreamedSource() { delete impl_; }
 
@@ -2358,6 +2329,37 @@ MaybeLocal<Value> Module::Evaluate(Local<Context> context) {
   RETURN_ESCAPED(result);
 }
 
+namespace {
+
+i::Compiler::ScriptDetails GetScriptDetails(
+    i::Isolate* isolate, Local<Value> resource_name,
+    Local<Integer> resource_line_offset, Local<Integer> resource_column_offset,
+    Local<Value> source_map_url, Local<PrimitiveArray> host_defined_options) {
+  i::Compiler::ScriptDetails script_details;
+  if (!resource_name.IsEmpty()) {
+    script_details.name_obj = Utils::OpenHandle(*(resource_name));
+  }
+  if (!resource_line_offset.IsEmpty()) {
+    script_details.line_offset =
+        static_cast<int>(resource_line_offset->Value());
+  }
+  if (!resource_column_offset.IsEmpty()) {
+    script_details.column_offset =
+        static_cast<int>(resource_column_offset->Value());
+  }
+  script_details.host_defined_options = isolate->factory()->empty_fixed_array();
+  if (!host_defined_options.IsEmpty()) {
+    script_details.host_defined_options =
+        Utils::OpenHandle(*(host_defined_options));
+  }
+  if (!source_map_url.IsEmpty()) {
+    script_details.source_map_url = Utils::OpenHandle(*(source_map_url));
+  }
+  return script_details;
+}
+
+}  // namespace
+
 MaybeLocal<UnboundScript> ScriptCompiler::CompileUnboundInternal(
     Isolate* v8_isolate, Source* source, CompileOptions options,
     NoCacheReason no_cache_reason) {
@@ -2366,17 +2368,21 @@ MaybeLocal<UnboundScript> ScriptCompiler::CompileUnboundInternal(
   ENTER_V8_NO_SCRIPT(isolate, v8_isolate->GetCurrentContext(), ScriptCompiler,
                      CompileUnbound, MaybeLocal<UnboundScript>(),
                      InternalEscapableScope);
-  bool produce_cache = options == kProduceParserCache ||
-                       options == kProduceCodeCache ||
-                       options == kProduceFullCodeCache;
-
-  // Don't try to produce any kind of cache when the debugger is loaded.
-  if (isolate->debug()->is_loaded() && produce_cache) {
+  // ProduceParserCache, ProduceCodeCache, ProduceFullCodeCache and
+  // ConsumeParserCache are not supported. They are present only for
+  // backward compatability. All these options behave as kNoCompileOptions.
+  if (options == kConsumeParserCache) {
+    // We do not support parser caches anymore. Just set cached_data to
+    // rejected to signal an error.
+    options = kNoCompileOptions;
+    source->cached_data->rejected = true;
+  } else if (options == kProduceParserCache || options == kProduceCodeCache ||
+             options == kProduceFullCodeCache) {
     options = kNoCompileOptions;
   }
 
   i::ScriptData* script_data = nullptr;
-  if (options == kConsumeParserCache || options == kConsumeCodeCache) {
+  if (options == kConsumeCodeCache) {
     DCHECK(source->cached_data);
     // ScriptData takes care of pointer-aligning the data.
     script_data = new i::ScriptData(source->cached_data->data,
@@ -2386,52 +2392,20 @@ MaybeLocal<UnboundScript> ScriptCompiler::CompileUnboundInternal(
   i::Handle<i::String> str = Utils::OpenHandle(*(source->source_string));
   i::Handle<i::SharedFunctionInfo> result;
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"), "V8.CompileScript");
-  i::MaybeHandle<i::Object> name_obj;
-  i::MaybeHandle<i::Object> source_map_url;
-  i::MaybeHandle<i::FixedArray> host_defined_options =
-      isolate->factory()->empty_fixed_array();
-  int line_offset = 0;
-  int column_offset = 0;
-  if (!source->resource_name.IsEmpty()) {
-    name_obj = Utils::OpenHandle(*(source->resource_name));
-  }
-  if (!source->host_defined_options.IsEmpty()) {
-    host_defined_options = Utils::OpenHandle(*(source->host_defined_options));
-  }
-  if (!source->resource_line_offset.IsEmpty()) {
-    line_offset = static_cast<int>(source->resource_line_offset->Value());
-  }
-  if (!source->resource_column_offset.IsEmpty()) {
-    column_offset = static_cast<int>(source->resource_column_offset->Value());
-  }
-  if (!source->source_map_url.IsEmpty()) {
-    source_map_url = Utils::OpenHandle(*(source->source_map_url));
-  }
+  i::Compiler::ScriptDetails script_details = GetScriptDetails(
+      isolate, source->resource_name, source->resource_line_offset,
+      source->resource_column_offset, source->source_map_url,
+      source->host_defined_options);
   i::MaybeHandle<i::SharedFunctionInfo> maybe_function_info =
       i::Compiler::GetSharedFunctionInfoForScript(
-          str, name_obj, line_offset, column_offset, source->resource_options,
-          source_map_url, isolate->native_context(), nullptr, &script_data,
-          options, no_cache_reason, i::NOT_NATIVES_CODE, host_defined_options);
-  has_pending_exception = !maybe_function_info.ToHandle(&result);
-  if (has_pending_exception && script_data != nullptr) {
-    // This case won't happen during normal operation; we have compiled
-    // successfully and produced cached data, and but the second compilation
-    // of the same source code fails.
-    delete script_data;
-    script_data = nullptr;
-  }
-  RETURN_ON_FAILED_EXECUTION(UnboundScript);
-
-  if (produce_cache && script_data != nullptr) {
-    // script_data now contains the data that was generated. source will
-    // take the ownership.
-    source->cached_data = new CachedData(
-        script_data->data(), script_data->length(), CachedData::BufferOwned);
-    script_data->ReleaseDataOwnership();
-  } else if (options == kConsumeParserCache || options == kConsumeCodeCache) {
+          str, script_details, source->resource_options, nullptr, script_data,
+          options, no_cache_reason, i::NOT_NATIVES_CODE);
+  if (options == kConsumeCodeCache) {
     source->cached_data->rejected = script_data->rejected();
   }
   delete script_data;
+  has_pending_exception = !maybe_function_info.ToHandle(&result);
+  RETURN_ON_FAILED_EXECUTION(UnboundScript);
   RETURN_ESCAPED(ToApiHandle<UnboundScript>(result));
 }
 
@@ -2516,15 +2490,19 @@ class IsIdentifierHelper {
   DISALLOW_COPY_AND_ASSIGN(IsIdentifierHelper);
 };
 
-
 MaybeLocal<Function> ScriptCompiler::CompileFunctionInContext(
     Local<Context> v8_context, Source* source, size_t arguments_count,
     Local<String> arguments[], size_t context_extension_count,
-    Local<Object> context_extensions[]) {
+    Local<Object> context_extensions[], CompileOptions options,
+    NoCacheReason no_cache_reason) {
   PREPARE_FOR_EXECUTION(v8_context, ScriptCompiler, CompileFunctionInContext,
                         Function);
   TRACE_EVENT_CALL_STATS_SCOPED(isolate, "v8", "V8.ScriptCompiler");
 
+  DCHECK(options == CompileOptions::kConsumeCodeCache ||
+         options == CompileOptions::kEagerCompile ||
+         options == CompileOptions::kNoCompileOptions);
+
   i::Handle<i::Context> context = Utils::OpenHandle(*v8_context);
   i::Handle<i::SharedFunctionInfo> outer_info(context->closure()->shared(),
                                               isolate);
@@ -2553,25 +2531,30 @@ MaybeLocal<Function> ScriptCompiler::CompileFunctionInContext(
         extension);
   }
 
-  i::Handle<i::Object> name_obj;
-  int line_offset = 0;
-  int column_offset = 0;
-  if (!source->resource_name.IsEmpty()) {
-    name_obj = Utils::OpenHandle(*(source->resource_name));
-  }
-  if (!source->resource_line_offset.IsEmpty()) {
-    line_offset = static_cast<int>(source->resource_line_offset->Value());
-  }
-  if (!source->resource_column_offset.IsEmpty()) {
-    column_offset = static_cast<int>(source->resource_column_offset->Value());
+  i::Compiler::ScriptDetails script_details = GetScriptDetails(
+      isolate, source->resource_name, source->resource_line_offset,
+      source->resource_column_offset, source->source_map_url,
+      source->host_defined_options);
+
+  i::ScriptData* script_data = nullptr;
+  if (options == kConsumeCodeCache) {
+    DCHECK(source->cached_data);
+    // ScriptData takes care of pointer-aligning the data.
+    script_data = new i::ScriptData(source->cached_data->data,
+                                    source->cached_data->length);
   }
 
   i::Handle<i::JSFunction> result;
   has_pending_exception =
       !i::Compiler::GetWrappedFunction(
            Utils::OpenHandle(*source->source_string), arguments_list, context,
-           line_offset, column_offset, name_obj, source->resource_options)
+           script_details, source->resource_options, script_data, options,
+           no_cache_reason)
            .ToHandle(&result);
+  if (options == kConsumeCodeCache) {
+    source->cached_data->rejected = script_data->rejected();
+  }
+  delete script_data;
   RETURN_ON_FAILED_EXECUTION(Function);
   RETURN_ESCAPED(Utils::CallableToLocal(result));
 }
@@ -2593,9 +2576,11 @@ ScriptCompiler::ScriptStreamingTask* ScriptCompiler::StartStreamingScript(
   if (!i::FLAG_script_streaming) {
     return nullptr;
   }
+  // We don't support other compile options on streaming background compiles.
+  // TODO(rmcilroy): remove CompileOptions from the API.
+  CHECK(options == ScriptCompiler::kNoCompileOptions);
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
-  return new i::BackgroundParsingTask(source->impl(), options,
-                                      i::FLAG_stack_size, isolate);
+  return i::Compiler::NewBackgroundCompileTask(source->impl(), isolate);
 }
 
 
@@ -2605,59 +2590,24 @@ MaybeLocal<Script> ScriptCompiler::Compile(Local<Context> context,
                                            const ScriptOrigin& origin) {
   PREPARE_FOR_EXECUTION(context, ScriptCompiler, Compile, Script);
   TRACE_EVENT_CALL_STATS_SCOPED(isolate, "v8", "V8.ScriptCompiler");
-  i::StreamedSource* source = v8_source->impl();
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
+               "V8.CompileStreamedScript");
+
   i::Handle<i::String> str = Utils::OpenHandle(*(full_source_string));
-  i::Handle<i::Script> script = isolate->factory()->NewScript(str);
-  if (isolate->NeedsSourcePositionsForProfiling()) {
-    i::Script::InitLineEnds(script);
-  }
-  if (!origin.ResourceName().IsEmpty()) {
-    script->set_name(*Utils::OpenHandle(*(origin.ResourceName())));
-  }
-  if (!origin.HostDefinedOptions().IsEmpty()) {
-    script->set_host_defined_options(
-        *Utils::OpenHandle(*(origin.HostDefinedOptions())));
-  }
-  if (!origin.ResourceLineOffset().IsEmpty()) {
-    script->set_line_offset(
-        static_cast<int>(origin.ResourceLineOffset()->Value()));
-  }
-  if (!origin.ResourceColumnOffset().IsEmpty()) {
-    script->set_column_offset(
-        static_cast<int>(origin.ResourceColumnOffset()->Value()));
-  }
-  script->set_origin_options(origin.Options());
-  if (!origin.SourceMapUrl().IsEmpty()) {
-    script->set_source_mapping_url(
-        *Utils::OpenHandle(*(origin.SourceMapUrl())));
-  }
+  i::Compiler::ScriptDetails script_details = GetScriptDetails(
+      isolate, origin.ResourceName(), origin.ResourceLineOffset(),
+      origin.ResourceColumnOffset(), origin.SourceMapUrl(),
+      origin.HostDefinedOptions());
+  i::ScriptStreamingData* streaming_data = v8_source->impl();
 
-  source->info->set_script(script);
-  source->parser->UpdateStatistics(isolate, script);
-  source->info->UpdateBackgroundParseStatisticsOnMainThread(isolate);
-  source->parser->HandleSourceURLComments(isolate, script);
+  i::MaybeHandle<i::SharedFunctionInfo> maybe_function_info =
+      i::Compiler::GetSharedFunctionInfoForStreamedScript(
+          str, script_details, origin.Options(), streaming_data);
 
   i::Handle<i::SharedFunctionInfo> result;
-  if (source->info->literal() == nullptr) {
-    // Parsing has failed - report error messages.
-    source->info->pending_error_handler()->ReportErrors(
-        isolate, script, source->info->ast_value_factory());
-  } else {
-    // Parsing has succeeded - finalize compile.
-    if (i::FLAG_background_compile) {
-      result = i::Compiler::GetSharedFunctionInfoForBackgroundCompile(
-          script, source->info.get(), str->length(),
-          source->outer_function_job.get(), &source->inner_function_jobs);
-    } else {
-      result = i::Compiler::GetSharedFunctionInfoForStreamedScript(
-          script, source->info.get(), str->length());
-    }
-  }
-  has_pending_exception = result.is_null();
+  has_pending_exception = !maybe_function_info.ToHandle(&result);
   if (has_pending_exception) isolate->ReportPendingMessages();
 
-  source->Release();
-
   RETURN_ON_FAILED_EXECUTION(Script);
 
   Local<UnboundScript> generic = ToApiHandle<UnboundScript>(result);
@@ -2678,37 +2628,18 @@ ScriptCompiler::CachedData* ScriptCompiler::CreateCodeCache(
   i::Handle<i::SharedFunctionInfo> shared =
       i::Handle<i::SharedFunctionInfo>::cast(
           Utils::OpenHandle(*unbound_script));
-  i::Isolate* isolate = shared->GetIsolate();
-  TRACE_EVENT_CALL_STATS_SCOPED(isolate, "v8", "V8.Execute");
-  base::ElapsedTimer timer;
-  if (i::FLAG_profile_deserialization) {
-    timer.Start();
-  }
-  i::HistogramTimerScope histogram_timer(
-      isolate->counters()->compile_serialize());
-  i::RuntimeCallTimerScope runtimeTimer(
-      isolate, i::RuntimeCallCounterId::kCompileSerialize);
-  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"), "V8.CompileSerialize");
-
+  i::Handle<i::String> source_str = Utils::OpenHandle(*source);
   DCHECK(shared->is_toplevel());
-  i::Handle<i::Script> script(i::Script::cast(shared->script()));
-  // TODO(7110): Enable serialization of Asm modules once the AsmWasmData is
-  // context independent.
-  if (script->ContainsAsmModule()) return nullptr;
-  if (isolate->debug()->is_loaded()) return nullptr;
-
-  i::ScriptData* script_data =
-      i::CodeSerializer::Serialize(isolate, shared, Utils::OpenHandle(*source));
-  CachedData* result = new CachedData(
-      script_data->data(), script_data->length(), CachedData::BufferOwned);
-  script_data->ReleaseDataOwnership();
-  delete script_data;
+  return i::CodeSerializer::Serialize(shared, source_str);
+}
 
-  if (i::FLAG_profile_deserialization) {
-    i::PrintF("[Serializing took %0.3f ms]\n",
-              timer.Elapsed().InMillisecondsF());
-  }
-  return result;
+ScriptCompiler::CachedData* ScriptCompiler::CreateCodeCacheForFunction(
+    Local<Function> function, Local<String> source) {
+  i::Handle<i::SharedFunctionInfo> shared(
+      i::Handle<i::JSFunction>::cast(Utils::OpenHandle(*function))->shared());
+  i::Handle<i::String> source_str = Utils::OpenHandle(*source);
+  CHECK(shared->is_wrapped());
+  return i::CodeSerializer::Serialize(shared, source_str);
 }
 
 MaybeLocal<Script> Script::Compile(Local<Context> context, Local<String> source,
@@ -2964,34 +2895,34 @@ int Message::ErrorLevel() const {
   return self->error_level();
 }
 
-Maybe<int> Message::GetStartColumn(Local<Context> context) const {
+int Message::GetStartColumn() const {
   auto self = Utils::OpenHandle(this);
   i::Isolate* isolate = self->GetIsolate();
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   EscapableHandleScope handle_scope(reinterpret_cast<Isolate*>(isolate));
   auto msg = i::Handle<i::JSMessageObject>::cast(self);
-  return Just(msg->GetColumnNumber());
+  return msg->GetColumnNumber();
 }
 
-
-int Message::GetStartColumn() const {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
-  const int default_value = kNoColumnInfo;
-  return GetStartColumn(context).FromMaybe(default_value);
+Maybe<int> Message::GetStartColumn(Local<Context> context) const {
+  return Just(GetStartColumn());
 }
 
-
-Maybe<int> Message::GetEndColumn(Local<Context> context) const {
+int Message::GetEndColumn() const {
   auto self = Utils::OpenHandle(this);
   i::Isolate* isolate = self->GetIsolate();
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   EscapableHandleScope handle_scope(reinterpret_cast<Isolate*>(isolate));
   auto msg = i::Handle<i::JSMessageObject>::cast(self);
   const int column_number = msg->GetColumnNumber();
-  if (column_number == -1) return Just(-1);
+  if (column_number == -1) return -1;
   const int start = self->start_position();
   const int end = self->end_position();
-  return Just(column_number + (end - start));
+  return column_number + (end - start);
+}
+
+Maybe<int> Message::GetEndColumn(Local<Context> context) const {
+  return Just(GetEndColumn());
 }
 
 
@@ -3304,6 +3235,16 @@ MaybeLocal<WasmCompiledModule> ValueDeserializer::Delegate::GetWasmModuleFromId(
   return MaybeLocal<WasmCompiledModule>();
 }
 
+MaybeLocal<SharedArrayBuffer>
+ValueDeserializer::Delegate::GetSharedArrayBufferFromId(Isolate* v8_isolate,
+                                                        uint32_t id) {
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
+  isolate->ScheduleThrow(*isolate->factory()->NewError(
+      isolate->error_function(),
+      i::MessageTemplate::kDataCloneDeserializationError));
+  return MaybeLocal<SharedArrayBuffer>();
+}
+
 struct ValueDeserializer::PrivateData {
   PrivateData(i::Isolate* i, i::Vector<const uint8_t> data, Delegate* delegate)
       : isolate(i), deserializer(i, data, delegate) {}
@@ -3533,6 +3474,7 @@ bool Value::IsNumber() const {
   return Utils::OpenHandle(this)->IsNumber();
 }
 
+bool Value::IsBigInt() const { return Utils::OpenHandle(this)->IsBigInt(); }
 
 bool Value::IsProxy() const { return Utils::OpenHandle(this)->IsJSProxy(); }
 
@@ -3544,24 +3486,23 @@ bool Value::IsWebAssemblyCompiledModule() const {
          js_obj->map()->GetConstructor();
 }
 
-#define VALUE_IS_SPECIFIC_TYPE(Type, Class)                            \
-  bool Value::Is##Type() const {                                       \
-    i::Handle<i::Object> obj = Utils::OpenHandle(this);                \
-    if (!obj->IsHeapObject()) return false;                            \
-    i::Isolate* isolate = i::HeapObject::cast(*obj)->GetIsolate();     \
-    return obj->HasSpecificClassOf(isolate->heap()->Class##_string()); \
+#define VALUE_IS_SPECIFIC_TYPE(Type, Check)             \
+  bool Value::Is##Type() const {                        \
+    i::Handle<i::Object> obj = Utils::OpenHandle(this); \
+    return obj->Is##Check();                            \
   }
 
-VALUE_IS_SPECIFIC_TYPE(ArgumentsObject, Arguments)
-VALUE_IS_SPECIFIC_TYPE(BooleanObject, Boolean)
-VALUE_IS_SPECIFIC_TYPE(NumberObject, Number)
-VALUE_IS_SPECIFIC_TYPE(StringObject, String)
-VALUE_IS_SPECIFIC_TYPE(SymbolObject, Symbol)
-VALUE_IS_SPECIFIC_TYPE(Date, Date)
-VALUE_IS_SPECIFIC_TYPE(Map, Map)
-VALUE_IS_SPECIFIC_TYPE(Set, Set)
-VALUE_IS_SPECIFIC_TYPE(WeakMap, WeakMap)
-VALUE_IS_SPECIFIC_TYPE(WeakSet, WeakSet)
+VALUE_IS_SPECIFIC_TYPE(ArgumentsObject, JSArgumentsObject)
+VALUE_IS_SPECIFIC_TYPE(BigIntObject, BigIntWrapper)
+VALUE_IS_SPECIFIC_TYPE(BooleanObject, BooleanWrapper)
+VALUE_IS_SPECIFIC_TYPE(NumberObject, NumberWrapper)
+VALUE_IS_SPECIFIC_TYPE(StringObject, StringWrapper)
+VALUE_IS_SPECIFIC_TYPE(SymbolObject, SymbolWrapper)
+VALUE_IS_SPECIFIC_TYPE(Date, JSDate)
+VALUE_IS_SPECIFIC_TYPE(Map, JSMap)
+VALUE_IS_SPECIFIC_TYPE(Set, JSSet)
+VALUE_IS_SPECIFIC_TYPE(WeakMap, JSWeakMap)
+VALUE_IS_SPECIFIC_TYPE(WeakSet, JSWeakSet)
 
 #undef VALUE_IS_SPECIFIC_TYPE
 
@@ -3685,6 +3626,16 @@ Local<v8::Object> Value::ToObject(Isolate* isolate) const {
   RETURN_TO_LOCAL_UNCHECKED(ToObject(isolate->GetCurrentContext()), Object);
 }
 
+MaybeLocal<BigInt> Value::ToBigInt(Local<Context> context) const {
+  i::Handle<i::Object> obj = Utils::OpenHandle(this);
+  if (obj->IsBigInt()) return ToApiHandle<BigInt>(obj);
+  PREPARE_FOR_EXECUTION(context, Object, ToBigInt, BigInt);
+  Local<BigInt> result;
+  has_pending_exception =
+      !ToLocal<BigInt>(i::BigInt::FromObject(isolate, obj), &result);
+  RETURN_ON_FAILED_EXECUTION(BigInt);
+  RETURN_ESCAPED(result);
+}
 
 MaybeLocal<Boolean> Value::ToBoolean(Local<Context> context) const {
   auto obj = Utils::OpenHandle(this);
@@ -3852,6 +3803,10 @@ void v8::Uint32::CheckCast(v8::Value* that) {
                   "Could not convert to 32-bit unsigned integer");
 }
 
+void v8::BigInt::CheckCast(v8::Value* that) {
+  Utils::ApiCheck(that->IsBigInt(), "v8::BigInt::Cast",
+                  "Could not convert to BigInt");
+}
 
 void v8::Array::CheckCast(Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
@@ -3953,55 +3908,41 @@ void v8::SharedArrayBuffer::CheckCast(Value* that) {
 
 void v8::Date::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
-  i::Isolate* isolate = nullptr;
-  if (obj->IsHeapObject()) isolate = i::HeapObject::cast(*obj)->GetIsolate();
-  Utils::ApiCheck(isolate != nullptr &&
-                      obj->HasSpecificClassOf(isolate->heap()->Date_string()),
-                  "v8::Date::Cast()", "Could not convert to date");
+  Utils::ApiCheck(obj->IsJSDate(), "v8::Date::Cast()",
+                  "Could not convert to date");
 }
 
 
 void v8::StringObject::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
-  i::Isolate* isolate = nullptr;
-  if (obj->IsHeapObject()) isolate = i::HeapObject::cast(*obj)->GetIsolate();
-  Utils::ApiCheck(isolate != nullptr &&
-                      obj->HasSpecificClassOf(isolate->heap()->String_string()),
-                  "v8::StringObject::Cast()",
+  Utils::ApiCheck(obj->IsStringWrapper(), "v8::StringObject::Cast()",
                   "Could not convert to StringObject");
 }
 
 
 void v8::SymbolObject::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
-  i::Isolate* isolate = nullptr;
-  if (obj->IsHeapObject()) isolate = i::HeapObject::cast(*obj)->GetIsolate();
-  Utils::ApiCheck(isolate != nullptr &&
-                      obj->HasSpecificClassOf(isolate->heap()->Symbol_string()),
-                  "v8::SymbolObject::Cast()",
+  Utils::ApiCheck(obj->IsSymbolWrapper(), "v8::SymbolObject::Cast()",
                   "Could not convert to SymbolObject");
 }
 
 
 void v8::NumberObject::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
-  i::Isolate* isolate = nullptr;
-  if (obj->IsHeapObject()) isolate = i::HeapObject::cast(*obj)->GetIsolate();
-  Utils::ApiCheck(isolate != nullptr &&
-                      obj->HasSpecificClassOf(isolate->heap()->Number_string()),
-                  "v8::NumberObject::Cast()",
+  Utils::ApiCheck(obj->IsNumberWrapper(), "v8::NumberObject::Cast()",
                   "Could not convert to NumberObject");
 }
 
+void v8::BigIntObject::CheckCast(v8::Value* that) {
+  i::Handle<i::Object> obj = Utils::OpenHandle(that);
+  Utils::ApiCheck(obj->IsBigIntWrapper(), "v8::BigIntObject::Cast()",
+                  "Could not convert to BigIntObject");
+}
 
 void v8::BooleanObject::CheckCast(v8::Value* that) {
   i::Handle<i::Object> obj = Utils::OpenHandle(that);
-  i::Isolate* isolate = nullptr;
-  if (obj->IsHeapObject()) isolate = i::HeapObject::cast(*obj)->GetIsolate();
-  Utils::ApiCheck(
-      isolate != nullptr &&
-          obj->HasSpecificClassOf(isolate->heap()->Boolean_string()),
-      "v8::BooleanObject::Cast()", "Could not convert to BooleanObject");
+  Utils::ApiCheck(obj->IsBooleanWrapper(), "v8::BooleanObject::Cast()",
+                  "Could not convert to BooleanObject");
 }
 
 
@@ -4432,7 +4373,7 @@ Maybe<bool> v8::Object::SetPrivate(Local<Context> context, Local<Private> key,
     desc.set_enumerable(false);
     desc.set_configurable(true);
     desc.set_value(value_obj);
-    return i::JSProxy::SetPrivateProperty(
+    return i::JSProxy::SetPrivateSymbol(
         isolate, i::Handle<i::JSProxy>::cast(self),
         i::Handle<i::Symbol>::cast(key_obj), &desc, i::kDontThrow);
   }
@@ -4577,10 +4518,10 @@ MaybeLocal<Array> v8::Object::GetPropertyNames(Local<Context> context) {
       v8::IndexFilter::kIncludeIndices);
 }
 
-MaybeLocal<Array> v8::Object::GetPropertyNames(Local<Context> context,
-                                               KeyCollectionMode mode,
-                                               PropertyFilter property_filter,
-                                               IndexFilter index_filter) {
+MaybeLocal<Array> v8::Object::GetPropertyNames(
+    Local<Context> context, KeyCollectionMode mode,
+    PropertyFilter property_filter, IndexFilter index_filter,
+    KeyConversionMode key_conversion) {
   PREPARE_FOR_EXECUTION(context, Object, GetPropertyNames, Array);
   auto self = Utils::OpenHandle(this);
   i::Handle<i::FixedArray> value;
@@ -4590,7 +4531,8 @@ MaybeLocal<Array> v8::Object::GetPropertyNames(Local<Context> context,
   accumulator.set_skip_indices(index_filter == IndexFilter::kSkipIndices);
   has_pending_exception = accumulator.CollectKeys(self, self).IsNothing();
   RETURN_ON_FAILED_EXECUTION(Array);
-  value = accumulator.GetKeys(i::GetKeysConversion::kKeepNumbers);
+  value =
+      accumulator.GetKeys(static_cast<i::GetKeysConversion>(key_conversion));
   DCHECK(self->map()->EnumLength() == i::kInvalidEnumCacheSentinel ||
          self->map()->EnumLength() == 0 ||
          self->map()->instance_descriptors()->GetEnumCache()->keys() != *value);
@@ -4614,10 +4556,11 @@ Local<Array> v8::Object::GetOwnPropertyNames() {
   RETURN_TO_LOCAL_UNCHECKED(GetOwnPropertyNames(context), Array);
 }
 
-MaybeLocal<Array> v8::Object::GetOwnPropertyNames(Local<Context> context,
-                                                  PropertyFilter filter) {
+MaybeLocal<Array> v8::Object::GetOwnPropertyNames(
+    Local<Context> context, PropertyFilter filter,
+    KeyConversionMode key_conversion) {
   return GetPropertyNames(context, KeyCollectionMode::kOwnOnly, filter,
-                          v8::IndexFilter::kIncludeIndices);
+                          v8::IndexFilter::kIncludeIndices, key_conversion);
 }
 
 MaybeLocal<String> v8::Object::ObjectProtoToString(Local<Context> context) {
@@ -4754,14 +4697,14 @@ Maybe<bool> v8::Object::Has(Local<Context> context, uint32_t index) {
   return maybe;
 }
 
-
 template <typename Getter, typename Setter, typename Data>
 static Maybe<bool> ObjectSetAccessor(Local<Context> context, Object* self,
                                      Local<Name> name, Getter getter,
                                      Setter setter, Data data,
                                      AccessControl settings,
                                      PropertyAttribute attributes,
-                                     bool is_special_data_property) {
+                                     bool is_special_data_property,
+                                     bool replace_on_access) {
   auto isolate = reinterpret_cast<i::Isolate*>(context->GetIsolate());
   ENTER_V8_NO_SCRIPT(isolate, context, Object, SetAccessor, Nothing<bool>(),
                      i::HandleScope);
@@ -4771,7 +4714,7 @@ static Maybe<bool> ObjectSetAccessor(Local<Context> context, Object* self,
   v8::Local<AccessorSignature> signature;
   i::Handle<i::AccessorInfo> info =
       MakeAccessorInfo(isolate, name, getter, setter, data, settings, signature,
-                       is_special_data_property, false);
+                       is_special_data_property, replace_on_access);
   if (info.is_null()) return Nothing<bool>();
   bool fast = obj->HasFastProperties();
   i::Handle<i::Object> result;
@@ -4797,7 +4740,7 @@ Maybe<bool> Object::SetAccessor(Local<Context> context, Local<Name> name,
                                 PropertyAttribute attribute) {
   return ObjectSetAccessor(context, this, name, getter, setter,
                            data.FromMaybe(Local<Value>()), settings, attribute,
-                           i::FLAG_disable_old_api_accessors);
+                           i::FLAG_disable_old_api_accessors, false);
 }
 
 
@@ -4827,7 +4770,17 @@ Maybe<bool> Object::SetNativeDataProperty(v8::Local<v8::Context> context,
                                           v8::Local<Value> data,
                                           PropertyAttribute attributes) {
   return ObjectSetAccessor(context, this, name, getter, setter, data, DEFAULT,
-                           attributes, true);
+                           attributes, true, false);
+}
+
+Maybe<bool> Object::SetLazyDataProperty(v8::Local<v8::Context> context,
+                                        v8::Local<Name> name,
+                                        AccessorNameGetterCallback getter,
+                                        v8::Local<Value> data,
+                                        PropertyAttribute attributes) {
+  return ObjectSetAccessor(context, this, name, getter,
+                           static_cast<AccessorNameSetterCallback>(nullptr),
+                           data, DEFAULT, attributes, true, true);
 }
 
 Maybe<bool> v8::Object::HasOwnProperty(Local<Context> context,
@@ -5163,7 +5116,7 @@ void Function::SetName(v8::Local<v8::String> name) {
   auto self = Utils::OpenHandle(this);
   if (!self->IsJSFunction()) return;
   auto func = i::Handle<i::JSFunction>::cast(self);
-  func->shared()->set_name(*Utils::OpenHandle(*name));
+  func->shared()->SetName(*Utils::OpenHandle(*name));
 }
 
 
@@ -5180,7 +5133,7 @@ Local<Value> Function::GetName() const {
   }
   if (self->IsJSFunction()) {
     auto func = i::Handle<i::JSFunction>::cast(self);
-    return Utils::ToLocal(handle(func->shared()->name(), isolate));
+    return Utils::ToLocal(handle(func->shared()->Name(), isolate));
   }
   return ToApiHandle<Primitive>(isolate->factory()->undefined_value());
 }
@@ -5255,7 +5208,7 @@ int Function::GetScriptLineNumber() const {
   auto func = i::Handle<i::JSFunction>::cast(self);
   if (func->shared()->script()->IsScript()) {
     i::Handle<i::Script> script(i::Script::cast(func->shared()->script()));
-    return i::Script::GetLineNumber(script, func->shared()->start_position());
+    return i::Script::GetLineNumber(script, func->shared()->StartPosition());
   }
   return kLineOffsetNotFound;
 }
@@ -5269,7 +5222,7 @@ int Function::GetScriptColumnNumber() const {
   auto func = i::Handle<i::JSFunction>::cast(self);
   if (func->shared()->script()->IsScript()) {
     i::Handle<i::Script> script(i::Script::cast(func->shared()->script()));
-    return i::Script::GetColumnNumber(script, func->shared()->start_position());
+    return i::Script::GetColumnNumber(script, func->shared()->StartPosition());
   }
   return kLineOffsetNotFound;
 }
@@ -5628,6 +5581,7 @@ static int Utf8Length(i::String* str, i::Isolate* isolate) {
 
 int String::Utf8Length() const {
   i::Handle<i::String> str = Utils::OpenHandle(this);
+  str = i::String::Flatten(str);
   i::Isolate* isolate = str->GetIsolate();
   return v8::Utf8Length(*str, isolate);
 }
@@ -5841,9 +5795,7 @@ int String::WriteUtf8(char* buffer,
   i::Isolate* isolate = str->GetIsolate();
   LOG_API(isolate, String, WriteUtf8);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
-  if (options & HINT_MANY_WRITES_EXPECTED) {
-    str = i::String::Flatten(str);  // Flatten the string for efficiency.
-  }
+  str = i::String::Flatten(str);  // Flatten the string for efficiency.
   const int string_length = str->length();
   bool write_null = !(options & NO_NULL_TERMINATION);
   bool replace_invalid_utf8 = (options & REPLACE_INVALID_UTF8);
@@ -5895,11 +5847,7 @@ static inline int WriteHelper(const String* string,
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   DCHECK(start >= 0 && length >= -1);
   i::Handle<i::String> str = Utils::OpenHandle(string);
-  if (options & String::HINT_MANY_WRITES_EXPECTED) {
-    // Flatten the string for efficiency.  This applies whether we are
-    // using StringCharacterStream or Get(i) to access the characters.
-    str = i::String::Flatten(str);
-  }
+  str = i::String::Flatten(str);
   int end = start + length;
   if ((length == -1) || (length > str->length() - start) )
     end = str->length();
@@ -6160,6 +6108,10 @@ bool V8::RegisterDefaultSignalHandler() {
   return v8::internal::trap_handler::RegisterDefaultSignalHandler();
 }
 
+bool V8::EnableWebAssemblyTrapHandler(bool use_v8_signal_handler) {
+  return v8::internal::trap_handler::EnableTrapHandler(use_v8_signal_handler);
+}
+
 void v8::V8::SetEntropySource(EntropySource entropy_source) {
   base::RandomNumberGenerator::SetEntropySource(entropy_source);
 }
@@ -6208,6 +6160,10 @@ HeapObjectStatistics::HeapObjectStatistics()
 HeapCodeStatistics::HeapCodeStatistics()
     : code_and_metadata_size_(0), bytecode_and_metadata_size_(0) {}
 
+bool v8::V8::InitializeICU(const char* icu_data_file) {
+  return i::InitializeICU(icu_data_file);
+}
+
 bool v8::V8::InitializeICUDefaultLocation(const char* exec_path,
                                           const char* icu_data_file) {
   return i::InitializeICUDefaultLocation(exec_path, icu_data_file);
@@ -6939,6 +6895,25 @@ double v8::NumberObject::ValueOf() const {
   return jsvalue->value()->Number();
 }
 
+Local<v8::Value> v8::BigIntObject::New(Isolate* isolate, int64_t value) {
+  CHECK(i::FLAG_harmony_bigint);
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  LOG_API(i_isolate, BigIntObject, New);
+  ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
+  i::Handle<i::Object> bigint = i::BigInt::FromInt64(i_isolate, value);
+  i::Handle<i::Object> obj =
+      i::Object::ToObject(i_isolate, bigint).ToHandleChecked();
+  return Utils::ToLocal(obj);
+}
+
+Local<v8::BigInt> v8::BigIntObject::ValueOf() const {
+  i::Handle<i::Object> obj = Utils::OpenHandle(this);
+  i::Handle<i::JSValue> jsvalue = i::Handle<i::JSValue>::cast(obj);
+  i::Isolate* isolate = jsvalue->GetIsolate();
+  LOG_API(isolate, BigIntObject, BigIntValue);
+  return Utils::ToLocal(
+      i::Handle<i::BigInt>(i::BigInt::cast(jsvalue->value())));
+}
 
 Local<v8::Value> v8::BooleanObject::New(Isolate* isolate, bool value) {
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
@@ -7352,13 +7327,11 @@ Local<Array> Set::AsArray() const {
 
 MaybeLocal<Promise::Resolver> Promise::Resolver::New(Local<Context> context) {
   PREPARE_FOR_EXECUTION(context, Promise_Resolver, New, Resolver);
-  i::Handle<i::Object> result;
+  Local<Promise::Resolver> result;
   has_pending_exception =
-      !i::Execution::Call(isolate, isolate->promise_internal_constructor(),
-                          isolate->factory()->undefined_value(), 0, nullptr)
-           .ToHandle(&result);
+      !ToLocal<Promise::Resolver>(isolate->factory()->NewJSPromise(), &result);
   RETURN_ON_FAILED_EXECUTION(Promise::Resolver);
-  RETURN_ESCAPED(Local<Promise::Resolver>::Cast(Utils::ToLocal(result)));
+  RETURN_ESCAPED(result);
 }
 
 
@@ -7380,12 +7353,14 @@ Maybe<bool> Promise::Resolver::Resolve(Local<Context> context,
   ENTER_V8(isolate, context, Promise_Resolver, Resolve, Nothing<bool>(),
            i::HandleScope);
   auto self = Utils::OpenHandle(this);
-  i::Handle<i::Object> argv[] = {self, Utils::OpenHandle(*value)};
+  auto promise = i::Handle<i::JSPromise>::cast(self);
+
+  if (promise->status() != Promise::kPending) {
+    return Just(true);
+  }
+
   has_pending_exception =
-      i::Execution::Call(isolate, isolate->promise_resolve(),
-                         isolate->factory()->undefined_value(), arraysize(argv),
-                         argv)
-          .is_null();
+      i::JSPromise::Resolve(promise, Utils::OpenHandle(*value)).is_null();
   RETURN_ON_FAILED_EXECUTION_PRIMITIVE(bool);
   return Just(true);
 }
@@ -7403,15 +7378,14 @@ Maybe<bool> Promise::Resolver::Reject(Local<Context> context,
   ENTER_V8(isolate, context, Promise_Resolver, Reject, Nothing<bool>(),
            i::HandleScope);
   auto self = Utils::OpenHandle(this);
+  auto promise = i::Handle<i::JSPromise>::cast(self);
+
+  if (promise->status() != Promise::kPending) {
+    return Just(true);
+  }
 
-  // We pass true to trigger the debugger's on exception handler.
-  i::Handle<i::Object> argv[] = {self, Utils::OpenHandle(*value),
-                                 isolate->factory()->ToBoolean(true)};
   has_pending_exception =
-      i::Execution::Call(isolate, isolate->promise_internal_reject(),
-                         isolate->factory()->undefined_value(), arraysize(argv),
-                         argv)
-          .is_null();
+      i::JSPromise::Reject(promise, Utils::OpenHandle(*value)).is_null();
   RETURN_ON_FAILED_EXECUTION_PRIMITIVE(bool);
   return Just(true);
 }
@@ -7605,8 +7579,9 @@ MaybeLocal<WasmCompiledModule> WasmCompiledModule::Compile(Isolate* isolate,
   if (!i::wasm::IsWasmCodegenAllowed(i_isolate, i_isolate->native_context())) {
     return MaybeLocal<WasmCompiledModule>();
   }
-  i::MaybeHandle<i::JSObject> maybe_compiled = i::wasm::SyncCompile(
-      i_isolate, &thrower, i::wasm::ModuleWireBytes(start, start + length));
+  i::MaybeHandle<i::JSObject> maybe_compiled =
+      i_isolate->wasm_engine()->SyncCompile(
+          i_isolate, &thrower, i::wasm::ModuleWireBytes(start, start + length));
   if (maybe_compiled.is_null()) return MaybeLocal<WasmCompiledModule>();
   return Local<WasmCompiledModule>::Cast(
       Utils::ToLocal(maybe_compiled.ToHandleChecked()));
@@ -7665,30 +7640,29 @@ void WasmModuleObjectBuilderStreaming::Finish() {
   }
   // AsyncCompile makes its own copy of the wire bytes. This inefficiency
   // will be resolved when we move to true streaming compilation.
-  i::wasm::AsyncCompile(reinterpret_cast<i::Isolate*>(isolate_),
-                        Utils::OpenHandle(*promise_.Get(isolate_)),
-                        {wire_bytes.get(), wire_bytes.get() + total_size_},
-                        false);
+  auto i_isolate = reinterpret_cast<i::Isolate*>(isolate_);
+  i_isolate->wasm_engine()->AsyncCompile(
+      i_isolate, Utils::OpenHandle(*promise_.Get(isolate_)),
+      {wire_bytes.get(), wire_bytes.get() + total_size_}, false);
 }
 
-void WasmModuleObjectBuilderStreaming::Abort(Local<Value> exception) {
+void WasmModuleObjectBuilderStreaming::Abort(MaybeLocal<Value> exception) {
   Local<Promise> promise = GetPromise();
   // The promise has already been resolved, e.g. because of a compilation
   // error.
   if (promise->State() != v8::Promise::kPending) return;
   if (i::FLAG_wasm_stream_compilation) streaming_decoder_->Abort();
 
-  // If there is no exception, then we do not reject the promise. The reason is
-  // that 'no exception' indicates that we are in a ScriptForbiddenScope, which
-  // means that it is not allowed to reject the promise at the moment, or
-  // execute any other JavaScript code.
+  // If no exception value is provided, we do not reject the promise. This can
+  // happen when streaming compilation gets aborted when no script execution is
+  // allowed anymore, e.g. when a browser tab gets refreshed.
   if (exception.IsEmpty()) return;
 
   Local<Promise::Resolver> resolver = promise.As<Promise::Resolver>();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate_);
   i::HandleScope scope(i_isolate);
   Local<Context> context = Utils::ToLocal(handle(i_isolate->context()));
-  auto maybe = resolver->Reject(context, exception);
+  auto maybe = resolver->Reject(context, exception.ToLocalChecked());
   CHECK_IMPLIES(!maybe.FromMaybe(false), i_isolate->has_scheduled_exception());
 }
 
@@ -7696,29 +7670,6 @@ WasmModuleObjectBuilderStreaming::~WasmModuleObjectBuilderStreaming() {
   promise_.Reset();
 }
 
-void WasmModuleObjectBuilder::OnBytesReceived(const uint8_t* bytes,
-                                              size_t size) {
-  std::unique_ptr<uint8_t[]> cloned_bytes(new uint8_t[size]);
-  memcpy(cloned_bytes.get(), bytes, size);
-  received_buffers_.push_back(
-      Buffer(std::unique_ptr<const uint8_t[]>(
-                 const_cast<const uint8_t*>(cloned_bytes.release())),
-             size));
-  total_size_ += size;
-}
-
-MaybeLocal<WasmCompiledModule> WasmModuleObjectBuilder::Finish() {
-  std::unique_ptr<uint8_t[]> wire_bytes(new uint8_t[total_size_]);
-  uint8_t* insert_at = wire_bytes.get();
-
-  for (size_t i = 0; i < received_buffers_.size(); ++i) {
-    const Buffer& buff = received_buffers_[i];
-    memcpy(insert_at, buff.first.get(), buff.second);
-    insert_at += buff.second;
-  }
-  return WasmCompiledModule::Compile(isolate_, wire_bytes.get(), total_size_);
-}
-
 // static
 v8::ArrayBuffer::Allocator* v8::ArrayBuffer::Allocator::NewDefaultAllocator() {
   return new ArrayBufferAllocator();
@@ -7740,17 +7691,23 @@ v8::ArrayBuffer::Contents v8::ArrayBuffer::Externalize() {
   Utils::ApiCheck(!self->is_external(), "v8_ArrayBuffer_Externalize",
                   "ArrayBuffer already externalized");
   self->set_is_external(true);
-  if (self->has_guard_region()) {
+
+  // We need to capture the contents before releasing the allocation from the
+  // Wasm tracker, because otherwise we will not correctly capture the
+  // allocation data.
+  const v8::ArrayBuffer::Contents contents = GetContents();
+  if (self->is_wasm_memory()) {
     // Since this is being externalized, the Wasm Allocation Tracker can no
     // longer track it.
     //
     // TODO(eholk): Find a way to track this across externalization
-    isolate->wasm_engine()->allocation_tracker()->ReleaseAddressSpace(
-        self->allocation_length());
+    isolate->wasm_engine()->memory_tracker()->ReleaseAllocation(
+        self->backing_store());
   }
   isolate->heap()->UnregisterArrayBuffer(*self);
 
-  return GetContents();
+  // A regular copy is good enough. No move semantics needed.
+  return contents;
 }
 
 
@@ -7760,7 +7717,7 @@ v8::ArrayBuffer::Contents v8::ArrayBuffer::GetContents() {
   Contents contents;
   contents.allocation_base_ = self->allocation_base();
   contents.allocation_length_ = self->allocation_length();
-  contents.allocation_mode_ = self->has_guard_region()
+  contents.allocation_mode_ = self->is_wasm_memory()
                                   ? Allocator::AllocationMode::kReservation
                                   : Allocator::AllocationMode::kNormal;
   contents.data_ = self->backing_store();
@@ -7798,7 +7755,7 @@ Local<ArrayBuffer> v8::ArrayBuffer::New(Isolate* isolate, size_t byte_length) {
   // TODO(jbroman): It may be useful in the future to provide a MaybeLocal
   // version that throws an exception or otherwise does not crash.
   if (!i::JSArrayBuffer::SetupAllocatingData(obj, i_isolate, byte_length)) {
-    i::FatalProcessOutOfMemory("v8::ArrayBuffer::New");
+    i::FatalProcessOutOfMemory(i_isolate, "v8::ArrayBuffer::New");
   }
   return Utils::ToLocal(obj);
 }
@@ -7963,16 +7920,23 @@ v8::SharedArrayBuffer::Contents v8::SharedArrayBuffer::Externalize() {
   Utils::ApiCheck(!self->is_external(), "v8_SharedArrayBuffer_Externalize",
                   "SharedArrayBuffer already externalized");
   self->set_is_external(true);
-  if (self->has_guard_region()) {
+
+  // We need to capture the contents before releasing the allocation from the
+  // Wasm tracker, because otherwise we will not correctly capture the
+  // allocation data.
+  const v8::SharedArrayBuffer::Contents contents = GetContents();
+  if (self->is_wasm_memory()) {
     // Since this is being externalized, the Wasm Allocation Tracker can no
     // longer track it.
     //
     // TODO(eholk): Find a way to track this across externalization
-    isolate->wasm_engine()->allocation_tracker()->ReleaseAddressSpace(
-        self->allocation_length());
+    isolate->wasm_engine()->memory_tracker()->ReleaseAllocation(
+        self->backing_store());
   }
   isolate->heap()->UnregisterArrayBuffer(*self);
-  return GetContents();
+
+  // A regular copy is good enough. No move semantics needed.
+  return contents;
 }
 
 
@@ -7983,7 +7947,7 @@ v8::SharedArrayBuffer::Contents v8::SharedArrayBuffer::GetContents() {
   contents.allocation_base_ = self->allocation_base();
   contents.allocation_length_ = self->allocation_length();
   contents.allocation_mode_ =
-      self->has_guard_region()
+      self->is_wasm_memory()
           ? ArrayBufferAllocator::Allocator::AllocationMode::kReservation
           : ArrayBufferAllocator::Allocator::AllocationMode::kNormal;
   contents.data_ = self->backing_store();
@@ -8010,7 +7974,7 @@ Local<SharedArrayBuffer> v8::SharedArrayBuffer::New(Isolate* isolate,
   // version that throws an exception or otherwise does not crash.
   if (!i::JSArrayBuffer::SetupAllocatingData(obj, i_isolate, byte_length, true,
                                              i::SharedFlag::kShared)) {
-    i::FatalProcessOutOfMemory("v8::SharedArrayBuffer::New");
+    i::FatalProcessOutOfMemory(i_isolate, "v8::SharedArrayBuffer::New");
   }
   return Utils::ToLocalShared(obj);
 }
@@ -8137,6 +8101,13 @@ Local<Integer> v8::Integer::NewFromUnsigned(Isolate* isolate, uint32_t value) {
   return Utils::IntegerToLocal(result);
 }
 
+Local<BigInt> v8::BigInt::New(Isolate* isolate, int64_t value) {
+  CHECK(i::FLAG_harmony_bigint);
+  i::Isolate* internal_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  ENTER_V8_NO_SCRIPT_NO_EXCEPTION(internal_isolate);
+  i::Handle<i::BigInt> result = i::BigInt::FromInt64(internal_isolate, value);
+  return Utils::ToLocal(result);
+}
 
 void Isolate::ReportExternalAllocationLimitReached() {
   i::Heap* heap = reinterpret_cast<i::Isolate*>(this)->heap();
@@ -8163,6 +8134,10 @@ CpuProfiler* Isolate::GetCpuProfiler() {
   return reinterpret_cast<CpuProfiler*>(cpu_profiler);
 }
 
+void Isolate::SetIdle(bool is_idle) {
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
+  isolate->SetIdle(is_idle);
+}
 
 bool Isolate::InContext() {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
@@ -8690,24 +8665,20 @@ void Isolate::RunMicrotasks() {
   reinterpret_cast<i::Isolate*>(this)->RunMicrotasks();
 }
 
-
-void Isolate::EnqueueMicrotask(Local<Function> microtask) {
+void Isolate::EnqueueMicrotask(Local<Function> function) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
-  isolate->EnqueueMicrotask(Utils::OpenHandle(*microtask));
+  i::Handle<i::CallableTask> microtask = isolate->factory()->NewCallableTask(
+      Utils::OpenHandle(*function), isolate->native_context());
+  isolate->EnqueueMicrotask(microtask);
 }
 
-
-void Isolate::EnqueueMicrotask(MicrotaskCallback microtask, void* data) {
+void Isolate::EnqueueMicrotask(MicrotaskCallback callback, void* data) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
   i::HandleScope scope(isolate);
-  i::Handle<i::CallHandlerInfo> callback_info =
-      i::Handle<i::CallHandlerInfo>::cast(
-          isolate->factory()->NewStruct(i::TUPLE3_TYPE, i::NOT_TENURED));
-  SET_FIELD_WRAPPED(callback_info, set_callback, microtask);
-  SET_FIELD_WRAPPED(callback_info, set_js_callback,
-                    callback_info->redirected_callback());
-  SET_FIELD_WRAPPED(callback_info, set_data, data);
-  isolate->EnqueueMicrotask(callback_info);
+  i::Handle<i::CallbackTask> microtask = isolate->factory()->NewCallbackTask(
+      isolate->factory()->NewForeign(reinterpret_cast<i::Address>(callback)),
+      isolate->factory()->NewForeign(reinterpret_cast<i::Address>(data)));
+  isolate->EnqueueMicrotask(microtask);
 }
 
 
@@ -8806,6 +8777,12 @@ void Isolate::LowMemoryNotification() {
 
 int Isolate::ContextDisposedNotification(bool dependant_context) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
+  if (!dependant_context) {
+    // We left the current context, we can abort all running WebAssembly
+    // compilations.
+    isolate->wasm_engine()->compilation_manager()->AbortAllJobs();
+  }
+  // TODO(ahaas): move other non-heap activity out of the heap call.
   return isolate->heap()->NotifyContextDisposed(dependant_context);
 }
 
@@ -8839,19 +8816,14 @@ void Isolate::SetRAILMode(RAILMode rail_mode) {
 }
 
 void Isolate::IncreaseHeapLimitForDebugging() {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
-  isolate->heap()->IncreaseHeapLimitForDebugging();
+  // No-op.
 }
 
 void Isolate::RestoreOriginalHeapLimit() {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
-  isolate->heap()->RestoreOriginalHeapLimit();
+  // No-op.
 }
 
-bool Isolate::IsHeapLimitIncreasedForDebugging() {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
-  return isolate->heap()->IsHeapLimitIncreasedForDebugging();
-}
+bool Isolate::IsHeapLimitIncreasedForDebugging() { return false; }
 
 void Isolate::SetJitCodeEventHandler(JitCodeEventOptions options,
                                      JitCodeEventHandler event_handler) {
@@ -8900,6 +8872,18 @@ CALLBACK_SETTER(WasmInstanceCallback, ExtensionCallback, wasm_instance_callback)
 CALLBACK_SETTER(WasmCompileStreamingCallback, ApiImplementationCallback,
                 wasm_compile_streaming_callback)
 
+void Isolate::AddNearHeapLimitCallback(v8::NearHeapLimitCallback callback,
+                                       void* data) {
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
+  isolate->heap()->AddNearHeapLimitCallback(callback, data);
+}
+
+void Isolate::RemoveNearHeapLimitCallback(v8::NearHeapLimitCallback callback,
+                                          size_t heap_limit) {
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
+  isolate->heap()->RemoveNearHeapLimitCallback(callback, heap_limit);
+}
+
 bool Isolate::IsDead() {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
   return isolate->IsDead();
@@ -9139,78 +9123,6 @@ Local<StackTrace> Exception::GetStackTrace(Local<Value> exception) {
 
 // --- D e b u g   S u p p o r t ---
 
-bool Debug::SetDebugEventListener(Isolate* isolate, EventCallback that,
-                                  Local<Value> data) {
-  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  if (that == nullptr) {
-    ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
-    i::HandleScope scope(i_isolate);
-    i_isolate->debug()->SetDebugDelegate(nullptr, false);
-  } else {
-    // Might create the Debug context.
-    ENTER_V8_FOR_NEW_CONTEXT(i_isolate);
-    i::HandleScope scope(i_isolate);
-    i::Handle<i::Object> i_data = i_isolate->factory()->undefined_value();
-    if (!data.IsEmpty()) i_data = Utils::OpenHandle(*data);
-    i::NativeDebugDelegate* delegate =
-        new i::NativeDebugDelegate(i_isolate, that, i_data);
-    i_isolate->debug()->SetDebugDelegate(delegate, true);
-  }
-  return true;
-}
-
-void Debug::DebugBreak(Isolate* isolate) { debug::DebugBreak(isolate); }
-
-void Debug::CancelDebugBreak(Isolate* isolate) {
-  debug::CancelDebugBreak(isolate);
-}
-
-bool Debug::CheckDebugBreak(Isolate* isolate) {
-  i::Isolate* internal_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  return internal_isolate->stack_guard()->CheckDebugBreak();
-}
-
-void Debug::SetMessageHandler(Isolate* isolate,
-                              v8::Debug::MessageHandler handler) {}
-
-void Debug::SendCommand(Isolate* isolate, const uint16_t* command, int length,
-                        ClientData* client_data) {}
-
-MaybeLocal<Value> Debug::Call(Local<Context> context,
-                              v8::Local<v8::Function> fun,
-                              v8::Local<v8::Value> data) {
-  return debug::Call(context, fun, data);
-}
-
-void Debug::ProcessDebugMessages(Isolate* isolate) {}
-
-Local<Context> Debug::GetDebugContext(Isolate* isolate) {
-  return debug::GetDebugContext(isolate);
-}
-
-MaybeLocal<Context> Debug::GetDebuggedContext(Isolate* isolate) {
-  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
-  if (!i_isolate->debug()->in_debug_scope()) return MaybeLocal<Context>();
-  i::Handle<i::Object> calling = i_isolate->GetCallingNativeContext();
-  if (calling.is_null()) return MaybeLocal<Context>();
-  return Utils::ToLocal(i::Handle<i::Context>::cast(calling));
-}
-
-void Debug::SetLiveEditEnabled(Isolate* isolate, bool enable) {
-  debug::SetLiveEditEnabled(isolate, enable);
-}
-
-bool Debug::IsTailCallEliminationEnabled(Isolate* isolate) { return false; }
-
-void Debug::SetTailCallEliminationEnabled(Isolate* isolate, bool enabled) {
-}
-
-MaybeLocal<Array> Debug::GetInternalProperties(Isolate* v8_isolate,
-                                               Local<Value> value) {
-  return debug::GetInternalProperties(v8_isolate, value);
-}
-
 void debug::SetContextId(Local<Context> context, int id) {
   Utils::OpenHandle(*context)->set_debug_context_id(i::Smi::FromInt(id));
 }
@@ -9220,6 +9132,16 @@ int debug::GetContextId(Local<Context> context) {
   return (value->IsSmi()) ? i::Smi::ToInt(value) : 0;
 }
 
+void debug::SetInspector(Isolate* isolate,
+                         v8_inspector::V8Inspector* inspector) {
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  i_isolate->set_inspector(inspector);
+}
+
+v8_inspector::V8Inspector* debug::GetInspector(Isolate* isolate) {
+  return reinterpret_cast<i::Isolate*>(isolate)->inspector();
+}
+
 Local<Context> debug::GetDebugContext(Isolate* isolate) {
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
@@ -9284,9 +9206,7 @@ void debug::SetBreakPointsActive(Isolate* v8_isolate, bool is_active) {
 
 void debug::SetOutOfMemoryCallback(Isolate* isolate,
                                    OutOfMemoryCallback callback, void* data) {
-  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
-  i_isolate->heap()->SetOutOfMemoryCallback(callback, data);
+  // No-op.
 }
 
 void debug::PrepareStep(Isolate* v8_isolate, StepAction action) {
@@ -9533,8 +9453,8 @@ bool debug::Script::SetBreakpoint(v8::Local<v8::String> condition,
   i::Handle<i::Script> script = Utils::OpenHandle(this);
   i::Isolate* isolate = script->GetIsolate();
   int offset = GetSourceOffset(*location);
-  if (!isolate->debug()->SetBreakpoint(script, Utils::OpenHandle(*condition),
-                                       &offset, id)) {
+  if (!isolate->debug()->SetBreakPointForScript(
+          script, Utils::OpenHandle(*condition), &offset, id)) {
     return false;
   }
   *location = GetSourceLocation(offset);
@@ -9591,6 +9511,25 @@ std::pair<int, int> debug::WasmScript::GetFunctionRange(
                         static_cast<int>(func.code.end_offset()));
 }
 
+uint32_t debug::WasmScript::GetFunctionHash(int function_index) {
+  i::DisallowHeapAllocation no_gc;
+  i::Handle<i::Script> script = Utils::OpenHandle(this);
+  DCHECK_EQ(i::Script::TYPE_WASM, script->type());
+  i::WasmCompiledModule* compiled_module =
+      i::WasmCompiledModule::cast(script->wasm_compiled_module());
+  i::wasm::WasmModule* module = compiled_module->shared()->module();
+  DCHECK_LE(0, function_index);
+  DCHECK_GT(module->functions.size(), function_index);
+  i::wasm::WasmFunction& func = module->functions[function_index];
+  i::SeqOneByteString* module_bytes = compiled_module->shared()->module_bytes();
+  i::wasm::ModuleWireBytes wire_bytes(
+      module_bytes->GetFlatContent().ToOneByteVector());
+  i::Vector<const i::byte> function_bytes = wire_bytes.GetFunctionBytes(&func);
+  // TODO(herhut): Maybe also take module, name and signature into account.
+  return i::StringHasher::HashSequentialString(function_bytes.start(),
+                                               function_bytes.length(), 0);
+}
+
 debug::WasmDisassembly debug::WasmScript::DisassembleFunction(
     int function_index) const {
   i::DisallowHeapAllocation no_gc;
@@ -9646,20 +9585,18 @@ MaybeLocal<UnboundScript> debug::CompileInspectorScript(Isolate* v8_isolate,
                                                         Local<String> source) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
   PREPARE_FOR_DEBUG_INTERFACE_EXECUTION_WITH_ISOLATE(isolate, UnboundScript);
-  i::ScriptData* script_data = nullptr;
   i::Handle<i::String> str = Utils::OpenHandle(*source);
   i::Handle<i::SharedFunctionInfo> result;
   {
     ScriptOriginOptions origin_options;
+    i::ScriptData* script_data = nullptr;
     i::MaybeHandle<i::SharedFunctionInfo> maybe_function_info =
         i::Compiler::GetSharedFunctionInfoForScript(
-            str, i::MaybeHandle<i::Object>(), 0, 0, origin_options,
-            i::MaybeHandle<i::Object>(), isolate->native_context(), nullptr,
-            &script_data, ScriptCompiler::kNoCompileOptions,
+            str, i::Compiler::ScriptDetails(), origin_options, nullptr,
+            script_data, ScriptCompiler::kNoCompileOptions,
             ScriptCompiler::kNoCacheBecauseInspector,
             i::FLAG_expose_inspector_scripts ? i::NOT_NATIVES_CODE
-                                             : i::INSPECTOR_CODE,
-            i::MaybeHandle<i::FixedArray>());
+                                             : i::INSPECTOR_CODE);
     has_pending_exception = !maybe_function_info.ToHandle(&result);
     RETURN_ON_FAILED_EXECUTION(UnboundScript);
   }
@@ -9760,9 +9697,8 @@ Local<Function> debug::GetBuiltin(Isolate* v8_isolate, Builtin builtin) {
   }
 
   i::Handle<i::String> name = isolate->factory()->empty_string();
-  i::Handle<i::Code> code(isolate->builtins()->builtin(builtin_id));
   i::NewFunctionArgs args = i::NewFunctionArgs::ForBuiltinWithoutPrototype(
-      name, code, builtin_id, i::LanguageMode::kSloppy);
+      name, builtin_id, i::LanguageMode::kSloppy);
   i::Handle<i::JSFunction> fun = isolate->factory()->NewFunction(args);
 
   fun->shared()->DontAdaptArguments();
@@ -9836,6 +9772,20 @@ v8::Local<debug::GeneratorObject> debug::GeneratorObject::Cast(
   return ToApiHandle<debug::GeneratorObject>(Utils::OpenHandle(*value));
 }
 
+MaybeLocal<v8::Value> debug::EvaluateGlobal(v8::Isolate* isolate,
+                                            v8::Local<v8::String> source,
+                                            bool throw_on_side_effect) {
+  i::Isolate* internal_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  PREPARE_FOR_DEBUG_INTERFACE_EXECUTION_WITH_ISOLATE(internal_isolate, Value);
+  Local<Value> result;
+  has_pending_exception = !ToLocal<Value>(
+      i::DebugEvaluate::Global(internal_isolate, Utils::OpenHandle(*source),
+                               throw_on_side_effect),
+      &result);
+  RETURN_ON_FAILED_EXECUTION(Value);
+  RETURN_ESCAPED(result);
+}
+
 void debug::QueryObjects(v8::Local<v8::Context> v8_context,
                          QueryObjectPredicate* predicate,
                          PersistentValueVector<v8::Object>* objects) {
@@ -9912,6 +9862,35 @@ int64_t debug::GetNextRandomInt64(v8::Isolate* v8_isolate) {
       ->NextInt64();
 }
 
+int debug::GetDebuggingId(v8::Local<v8::Function> function) {
+  i::JSReceiver* callable = *v8::Utils::OpenHandle(*function);
+  if (!callable->IsJSFunction()) return i::SharedFunctionInfo::kNoDebuggingId;
+  i::JSFunction* fun = i::JSFunction::cast(callable);
+  i::SharedFunctionInfo* shared = fun->shared();
+  int id = shared->debugging_id();
+  if (id == i::SharedFunctionInfo::kNoDebuggingId) {
+    id = shared->GetHeap()->NextDebuggingId();
+    shared->set_debugging_id(id);
+  }
+  DCHECK_NE(i::SharedFunctionInfo::kNoDebuggingId, id);
+  return id;
+}
+
+bool debug::SetFunctionBreakpoint(v8::Local<v8::Function> function,
+                                  v8::Local<v8::String> condition,
+                                  BreakpointId* id) {
+  i::Handle<i::JSReceiver> callable = Utils::OpenHandle(*function);
+  if (!callable->IsJSFunction()) return false;
+  i::Handle<i::JSFunction> jsfunction =
+      i::Handle<i::JSFunction>::cast(callable);
+  i::Isolate* isolate = jsfunction->GetIsolate();
+  i::Handle<i::String> condition_string =
+      condition.IsEmpty() ? isolate->factory()->empty_string()
+                          : Utils::OpenHandle(*condition);
+  return isolate->debug()->SetBreakpointForFunction(jsfunction,
+                                                    condition_string, id);
+}
+
 Local<String> CpuProfileNode::GetFunctionName() const {
   const i::ProfileNode* node = reinterpret_cast<const i::ProfileNode*>(this);
   i::Isolate* isolate = node->isolate();
@@ -10218,15 +10197,7 @@ CpuProfile* CpuProfiler::StopProfiling(Local<String> title) {
 void CpuProfiler::SetIdle(bool is_idle) {
   i::CpuProfiler* profiler = reinterpret_cast<i::CpuProfiler*>(this);
   i::Isolate* isolate = profiler->isolate();
-  if (!isolate->is_profiling()) return;
-  v8::StateTag state = isolate->current_vm_state();
-  DCHECK(state == v8::EXTERNAL || state == v8::IDLE);
-  if (isolate->js_entry_sp() != nullptr) return;
-  if (is_idle) {
-    isolate->set_current_vm_state(v8::IDLE);
-  } else if (state == v8::IDLE) {
-    isolate->set_current_vm_state(v8::EXTERNAL);
-  }
+  isolate->SetIdle(is_idle);
 }
 
 
@@ -10464,6 +10435,12 @@ void HeapProfiler::SetGetRetainerInfosCallback(
       callback);
 }
 
+void HeapProfiler::SetBuildEmbedderGraphCallback(
+    BuildEmbedderGraphCallback callback) {
+  reinterpret_cast<i::HeapProfiler*>(this)->SetBuildEmbedderGraphCallback(
+      callback);
+}
+
 v8::Testing::StressType internal::Testing::stress_type_ =
     v8::Testing::kStressTypeOpt;
 
@@ -10527,7 +10504,7 @@ void Testing::PrepareStressRun(int run) {
 void Testing::DeoptimizeAll(Isolate* isolate) {
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   i::HandleScope scope(i_isolate);
-  internal::Deoptimizer::DeoptimizeAll(i_isolate);
+  i::Deoptimizer::DeoptimizeAll(i_isolate);
 }
 
 
@@ -10571,14 +10548,15 @@ void HandleScopeImplementer::IterateThis(RootVisitor* v) {
     if (last_handle_before_deferred_block_ != nullptr &&
         (last_handle_before_deferred_block_ <= &block[kHandleBlockSize]) &&
         (last_handle_before_deferred_block_ >= block)) {
-      v->VisitRootPointers(Root::kHandleScope, block,
+      v->VisitRootPointers(Root::kHandleScope, nullptr, block,
                            last_handle_before_deferred_block_);
       DCHECK(!found_block_before_deferred);
 #ifdef DEBUG
       found_block_before_deferred = true;
 #endif
     } else {
-      v->VisitRootPointers(Root::kHandleScope, block, &block[kHandleBlockSize]);
+      v->VisitRootPointers(Root::kHandleScope, nullptr, block,
+                           &block[kHandleBlockSize]);
     }
   }
 
@@ -10587,7 +10565,7 @@ void HandleScopeImplementer::IterateThis(RootVisitor* v) {
 
   // Iterate over live handles in the last block (if any).
   if (!blocks()->empty()) {
-    v->VisitRootPointers(Root::kHandleScope, blocks()->back(),
+    v->VisitRootPointers(Root::kHandleScope, nullptr, blocks()->back(),
                          handle_scope_data_.next);
   }
 
@@ -10596,11 +10574,11 @@ void HandleScopeImplementer::IterateThis(RootVisitor* v) {
   for (unsigned i = 0; i < arraysize(context_lists); i++) {
     if (context_lists[i]->empty()) continue;
     Object** start = reinterpret_cast<Object**>(&context_lists[i]->front());
-    v->VisitRootPointers(Root::kHandleScope, start,
+    v->VisitRootPointers(Root::kHandleScope, nullptr, start,
                          start + context_lists[i]->size());
   }
   if (microtask_context_) {
-    v->VisitRootPointer(Root::kHandleScope,
+    v->VisitRootPointer(Root::kHandleScope, nullptr,
                         reinterpret_cast<Object**>(&microtask_context_));
   }
 }
@@ -10670,10 +10648,11 @@ void DeferredHandles::Iterate(RootVisitor* v) {
   DCHECK((first_block_limit_ >= blocks_.front()) &&
          (first_block_limit_ <= &(blocks_.front())[kHandleBlockSize]));
 
-  v->VisitRootPointers(Root::kHandleScope, blocks_.front(), first_block_limit_);
+  v->VisitRootPointers(Root::kHandleScope, nullptr, blocks_.front(),
+                       first_block_limit_);
 
   for (size_t i = 1; i < blocks_.size(); i++) {
-    v->VisitRootPointers(Root::kHandleScope, blocks_[i],
+    v->VisitRootPointers(Root::kHandleScope, nullptr, blocks_[i],
                          &blocks_[i][kHandleBlockSize]);
   }
 }
diff --git a/deps/v8/src/api.h b/deps/v8/src/api.h
index 7bd03c37dab..b9e174125e8 100644
--- a/deps/v8/src/api.h
+++ b/deps/v8/src/api.h
@@ -124,7 +124,8 @@ class Utils {
     if (!condition) Utils::ReportApiFailure(location, message);
     return condition;
   }
-  static void ReportOOMFailure(const char* location, bool is_heap_oom);
+  static void ReportOOMFailure(v8::internal::Isolate* isolate,
+                               const char* location, bool is_heap_oom);
 
   static inline Local<Context> ToLocal(
       v8::internal::Handle<v8::internal::Context> obj);
@@ -180,6 +181,10 @@ class Utils {
       v8::internal::Handle<v8::internal::JSTypedArray> obj);
   static inline Local<Float64Array> ToLocalFloat64Array(
       v8::internal::Handle<v8::internal::JSTypedArray> obj);
+  static inline Local<BigInt64Array> ToLocalBigInt64Array(
+      v8::internal::Handle<v8::internal::JSTypedArray> obj);
+  static inline Local<BigUint64Array> ToLocalBigUint64Array(
+      v8::internal::Handle<v8::internal::JSTypedArray> obj);
 
   static inline Local<SharedArrayBuffer> ToLocalShared(
       v8::internal::Handle<v8::internal::JSArrayBuffer> obj);
@@ -198,6 +203,8 @@ class Utils {
       v8::internal::Handle<v8::internal::Object> obj);
   static inline Local<Uint32> Uint32ToLocal(
       v8::internal::Handle<v8::internal::Object> obj);
+  static inline Local<BigInt> ToLocal(
+      v8::internal::Handle<v8::internal::BigInt> obj);
   static inline Local<FunctionTemplate> ToLocal(
       v8::internal::Handle<v8::internal::FunctionTemplateInfo> obj);
   static inline Local<ObjectTemplate> ToLocal(
@@ -329,6 +336,7 @@ MAKE_TO_LOCAL(StackFrameToLocal, StackFrameInfo, StackFrame)
 MAKE_TO_LOCAL(NumberToLocal, Object, Number)
 MAKE_TO_LOCAL(IntegerToLocal, Object, Integer)
 MAKE_TO_LOCAL(Uint32ToLocal, Object, Uint32)
+MAKE_TO_LOCAL(ToLocal, BigInt, BigInt);
 MAKE_TO_LOCAL(ExternalToLocal, JSObject, External)
 MAKE_TO_LOCAL(CallableToLocal, JSReceiver, Function)
 MAKE_TO_LOCAL(ToLocalPrimitive, Object, Primitive)
@@ -626,7 +634,6 @@ void HandleScopeImplementer::EnterMicrotaskContext(Handle<Context> context) {
 }
 
 void HandleScopeImplementer::LeaveMicrotaskContext() {
-  DCHECK(microtask_context_);
   microtask_context_ = nullptr;
   entered_context_count_during_microtasks_ = 0;
 }
diff --git a/deps/v8/src/arm/assembler-arm-inl.h b/deps/v8/src/arm/assembler-arm-inl.h
index f420f2e5cb1..6bb58e4089a 100644
--- a/deps/v8/src/arm/assembler-arm-inl.h
+++ b/deps/v8/src/arm/assembler-arm-inl.h
@@ -46,7 +46,7 @@
 namespace v8 {
 namespace internal {
 
-bool CpuFeatures::SupportsCrankshaft() { return true; }
+bool CpuFeatures::SupportsOptimizer() { return true; }
 
 bool CpuFeatures::SupportsWasmSimd128() { return IsSupported(NEON); }
 
@@ -73,7 +73,8 @@ Address RelocInfo::target_address() {
 
 Address RelocInfo::target_address_address() {
   DCHECK(IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_) || IsWasmCall(rmode_) ||
-         rmode_ == EMBEDDED_OBJECT || rmode_ == EXTERNAL_REFERENCE);
+         IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
+         IsOffHeapTarget(rmode_));
   if (Assembler::IsMovW(Memory::int32_at(pc_))) {
     return reinterpret_cast<Address>(pc_);
   } else {
@@ -109,7 +110,7 @@ void RelocInfo::set_target_object(HeapObject* target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
-  Assembler::set_target_address_at(target->GetIsolate(), pc_, constant_pool_,
+  Assembler::set_target_address_at(pc_, constant_pool_,
                                    reinterpret_cast<Address>(target),
                                    icache_flush_mode);
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr) {
@@ -143,27 +144,32 @@ Address RelocInfo::target_runtime_entry(Assembler* origin) {
   return target_address();
 }
 
-void RelocInfo::set_target_runtime_entry(Isolate* isolate, Address target,
+void RelocInfo::set_target_runtime_entry(Address target,
                                          WriteBarrierMode write_barrier_mode,
                                          ICacheFlushMode icache_flush_mode) {
   DCHECK(IsRuntimeEntry(rmode_));
   if (target_address() != target)
-    set_target_address(isolate, target, write_barrier_mode, icache_flush_mode);
+    set_target_address(target, write_barrier_mode, icache_flush_mode);
 }
 
-void RelocInfo::WipeOut(Isolate* isolate) {
+Address RelocInfo::target_off_heap_target() {
+  DCHECK(IsOffHeapTarget(rmode_));
+  return Assembler::target_address_at(pc_, constant_pool_);
+}
+
+void RelocInfo::WipeOut() {
   DCHECK(IsEmbeddedObject(rmode_) || IsCodeTarget(rmode_) ||
          IsRuntimeEntry(rmode_) || IsExternalReference(rmode_) ||
          IsInternalReference(rmode_));
   if (IsInternalReference(rmode_)) {
     Memory::Address_at(pc_) = nullptr;
   } else {
-    Assembler::set_target_address_at(isolate, pc_, constant_pool_, nullptr);
+    Assembler::set_target_address_at(pc_, constant_pool_, nullptr);
   }
 }
 
 template <typename ObjectVisitor>
-void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
+void RelocInfo::Visit(ObjectVisitor* visitor) {
   RelocInfo::Mode mode = rmode();
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
@@ -175,6 +181,8 @@ void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
     visitor->VisitInternalReference(host(), this);
   } else if (RelocInfo::IsRuntimeEntry(mode)) {
     visitor->VisitRuntimeEntry(host(), this);
+  } else if (RelocInfo::IsOffHeapTarget(mode)) {
+    visitor->VisitOffHeapTarget(host(), this);
   }
 }
 
@@ -189,7 +197,7 @@ Operand::Operand(const ExternalReference& f)
   value_.immediate = reinterpret_cast<int32_t>(f.address());
 }
 
-Operand::Operand(Smi* value) : rmode_(RelocInfo::NONE32) {
+Operand::Operand(Smi* value) : rmode_(RelocInfo::NONE) {
   value_.immediate = reinterpret_cast<intptr_t>(value);
 }
 
@@ -273,15 +281,13 @@ Address Assembler::return_address_from_call_start(Address pc) {
   }
 }
 
-
 void Assembler::deserialization_set_special_target_at(
-    Isolate* isolate, Address constant_pool_entry, Code* code, Address target) {
+    Address constant_pool_entry, Code* code, Address target) {
   Memory::Address_at(constant_pool_entry) = target;
 }
 
-
 void Assembler::deserialization_set_target_internal_reference_at(
-    Isolate* isolate, Address pc, Address target, RelocInfo::Mode mode) {
+    Address pc, Address target, RelocInfo::Mode mode) {
   Memory::Address_at(pc) = target;
 }
 
@@ -329,17 +335,15 @@ Address Assembler::target_address_at(Address pc, Address constant_pool) {
   }
 }
 
-
-void Assembler::set_target_address_at(Isolate* isolate, Address pc,
-                                      Address constant_pool, Address target,
+void Assembler::set_target_address_at(Address pc, Address constant_pool,
+                                      Address target,
                                       ICacheFlushMode icache_flush_mode) {
-  DCHECK_IMPLIES(isolate == nullptr, icache_flush_mode == SKIP_ICACHE_FLUSH);
   if (is_constant_pool_load(pc)) {
     // This is a constant pool lookup. Update the entry in the constant pool.
     Memory::Address_at(constant_pool_entry_address(pc, constant_pool)) = target;
     // Intuitively, we would think it is necessary to always flush the
     // instruction cache after patching a target address in the code as follows:
-    //   Assembler::FlushICache(isolate, pc, sizeof(target));
+    //   Assembler::FlushICache(pc, sizeof(target));
     // However, on ARM, no instruction is actually patched in the case
     // of embedded constants of the form:
     // ldr   ip, [pp, #...]
@@ -357,7 +361,7 @@ void Assembler::set_target_address_at(Isolate* isolate, Address pc,
     DCHECK(IsMovW(Memory::int32_at(pc)));
     DCHECK(IsMovT(Memory::int32_at(pc + kInstrSize)));
     if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-      Assembler::FlushICache(isolate, pc, 2 * kInstrSize);
+      Assembler::FlushICache(pc, 2 * kInstrSize);
     }
   } else {
     // This is an mov / orr immediate load. Patch the immediate embedded in
@@ -377,13 +381,42 @@ void Assembler::set_target_address_at(Isolate* isolate, Address pc,
            IsOrrImmed(Memory::int32_at(pc + 2 * kInstrSize)) &&
            IsOrrImmed(Memory::int32_at(pc + 3 * kInstrSize)));
     if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-      Assembler::FlushICache(isolate, pc, 4 * kInstrSize);
+      Assembler::FlushICache(pc, 4 * kInstrSize);
     }
   }
 }
 
 EnsureSpace::EnsureSpace(Assembler* assembler) { assembler->CheckBuffer(); }
 
+template <typename T>
+bool UseScratchRegisterScope::CanAcquireVfp() const {
+  VfpRegList* available = assembler_->GetScratchVfpRegisterList();
+  DCHECK_NOT_NULL(available);
+  for (int index = 0; index < T::kNumRegisters; index++) {
+    T reg = T::from_code(index);
+    uint64_t mask = reg.ToVfpRegList();
+    if ((*available & mask) == mask) {
+      return true;
+    }
+  }
+  return false;
+}
+
+template <typename T>
+T UseScratchRegisterScope::AcquireVfp() {
+  VfpRegList* available = assembler_->GetScratchVfpRegisterList();
+  DCHECK_NOT_NULL(available);
+  for (int index = 0; index < T::kNumRegisters; index++) {
+    T reg = T::from_code(index);
+    uint64_t mask = reg.ToVfpRegList();
+    if ((*available & mask) == mask) {
+      *available &= ~mask;
+      return reg;
+    }
+  }
+  UNREACHABLE();
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/arm/assembler-arm.cc b/deps/v8/src/arm/assembler-arm.cc
index a615d674967..d1b2e240ff5 100644
--- a/deps/v8/src/arm/assembler-arm.cc
+++ b/deps/v8/src/arm/assembler-arm.cc
@@ -347,22 +347,20 @@ uint32_t RelocInfo::embedded_size() const {
       Assembler::target_address_at(pc_, constant_pool_));
 }
 
-void RelocInfo::set_embedded_address(Isolate* isolate, Address address,
+void RelocInfo::set_embedded_address(Address address,
                                      ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(isolate, pc_, constant_pool_, address,
-                                   flush_mode);
+  Assembler::set_target_address_at(pc_, constant_pool_, address, flush_mode);
 }
 
-void RelocInfo::set_embedded_size(Isolate* isolate, uint32_t size,
-                                  ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(isolate, pc_, constant_pool_,
+void RelocInfo::set_embedded_size(uint32_t size, ICacheFlushMode flush_mode) {
+  Assembler::set_target_address_at(pc_, constant_pool_,
                                    reinterpret_cast<Address>(size), flush_mode);
 }
 
-void RelocInfo::set_js_to_wasm_address(Isolate* isolate, Address address,
+void RelocInfo::set_js_to_wasm_address(Address address,
                                        ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  set_embedded_address(isolate, address, icache_flush_mode);
+  set_embedded_address(address, icache_flush_mode);
 }
 
 Address RelocInfo::js_to_wasm_address() const {
@@ -566,10 +564,16 @@ Assembler::Assembler(IsolateData isolate_data, void* buffer, int buffer_size)
     // it's awkward to use CpuFeatures::VFP32DREGS with CpuFeatureScope. To make
     // its use consistent with other features, we always enable it if we can.
     EnableCpuFeature(VFP32DREGS);
+    // Make sure we pick two D registers which alias a Q register. This way, we
+    // can use a Q as a scratch if NEON is supported.
+    scratch_vfp_register_list_ = d14.ToVfpRegList() | d15.ToVfpRegList();
+  } else {
+    // When VFP32DREGS is not supported, d15 become allocatable. Therefore we
+    // cannot use it as a scratch.
+    scratch_vfp_register_list_ = d14.ToVfpRegList();
   }
 }
 
-
 Assembler::~Assembler() {
   DCHECK_EQ(const_pool_blocked_nesting_, 0);
   DCHECK_EQ(code_target_sharing_blocked_nesting_, 0);
@@ -1214,6 +1218,7 @@ void Assembler::AddrMode1(Instr instr, Register rd, Register rn,
     DCHECK(x.IsImmediate());
     // Upon failure to encode, the opcode should not have changed.
     DCHECK(opcode == (instr & kOpCodeMask));
+    UseScratchRegisterScope temps(this);
     Condition cond = Instruction::ConditionField(instr);
     if ((opcode == MOV) && !set_flags) {
       // Generate a sequence of mov instructions or a load from the constant
@@ -1221,7 +1226,7 @@ void Assembler::AddrMode1(Instr instr, Register rd, Register rn,
       DCHECK(!rn.is_valid());
       Move32BitImmediate(rd, x, cond);
     } else if ((opcode == ADD) && !set_flags && (rd == rn) &&
-               (scratch_register_list_ == 0)) {
+               !temps.CanAcquire()) {
       // Split the operation into a sequence of additions if we cannot use a
       // scratch register. In this case, we cannot re-use rn and the assembler
       // does not have any scratch registers to spare.
@@ -1244,7 +1249,6 @@ void Assembler::AddrMode1(Instr instr, Register rd, Register rn,
       // The immediate operand cannot be encoded as a shifter operand, so load
       // it first to a scratch register and change the original instruction to
       // use it.
-      UseScratchRegisterScope temps(this);
       // Re-use the destination register if possible.
       Register scratch =
           (rd.is_valid() && rd != rn && rd != pc) ? rd : temps.Acquire();
@@ -1501,6 +1505,10 @@ void Assembler::and_(Register dst, Register src1, const Operand& src2,
   AddrMode1(cond | AND | s, dst, src1, src2);
 }
 
+void Assembler::and_(Register dst, Register src1, Register src2, SBit s,
+                     Condition cond) {
+  and_(dst, src1, Operand(src2), s, cond);
+}
 
 void Assembler::eor(Register dst, Register src1, const Operand& src2,
                     SBit s, Condition cond) {
@@ -2367,6 +2375,11 @@ void Assembler::isb(BarrierOption option) {
   }
 }
 
+void Assembler::csdb() {
+  // Details available in Arm Cache Speculation Side-channels white paper,
+  // version 1.1, page 4.
+  emit(0xE320F014);
+}
 
 // Coprocessor instructions.
 void Assembler::cdp(Coprocessor coproc,
@@ -5068,7 +5081,7 @@ void Assembler::GrowBuffer() {
   // Some internal data structures overflow for very large buffers,
   // they must ensure that kMaximalBufferSize is not too large.
   if (desc.buffer_size > kMaximalBufferSize) {
-    V8::FatalProcessOutOfMemory("Assembler::GrowBuffer");
+    V8::FatalProcessOutOfMemory(nullptr, "Assembler::GrowBuffer");
   }
 
   // Set up new buffer.
@@ -5153,8 +5166,7 @@ void Assembler::RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data) {
 
 void Assembler::ConstantPoolAddEntry(int position, RelocInfo::Mode rmode,
                                      intptr_t value) {
-  DCHECK(rmode != RelocInfo::COMMENT && rmode != RelocInfo::CONST_POOL &&
-         rmode != RelocInfo::NONE64);
+  DCHECK(rmode != RelocInfo::COMMENT && rmode != RelocInfo::CONST_POOL);
   bool sharing_ok = RelocInfo::IsNone(rmode) ||
                     (rmode >= RelocInfo::FIRST_SHAREABLE_RELOC_MODE);
   DCHECK_LT(pending_32_bit_constants_.size(), kMaxNumPending32Constants);
@@ -5163,7 +5175,8 @@ void Assembler::ConstantPoolAddEntry(int position, RelocInfo::Mode rmode,
   }
   ConstantPoolEntry entry(position, value,
                           sharing_ok || (rmode == RelocInfo::CODE_TARGET &&
-                                         IsCodeTargetSharingAllowed()));
+                                         IsCodeTargetSharingAllowed()),
+                          rmode);
 
   bool shared = false;
   if (sharing_ok) {
@@ -5171,7 +5184,8 @@ void Assembler::ConstantPoolAddEntry(int position, RelocInfo::Mode rmode,
     for (size_t i = 0; i < pending_32_bit_constants_.size(); i++) {
       ConstantPoolEntry& current_entry = pending_32_bit_constants_[i];
       if (!current_entry.sharing_ok()) continue;
-      if (entry.value() == current_entry.value()) {
+      if (entry.value() == current_entry.value() &&
+          entry.rmode() == current_entry.rmode()) {
         entry.set_merged_index(i);
         shared = true;
         break;
@@ -5474,24 +5488,24 @@ void PatchingAssembler::Emit(Address addr) {
   emit(reinterpret_cast<Instr>(addr));
 }
 
-void PatchingAssembler::FlushICache(Isolate* isolate) {
-  Assembler::FlushICache(isolate, buffer_, buffer_size_ - kGap);
-}
-
 UseScratchRegisterScope::UseScratchRegisterScope(Assembler* assembler)
-    : available_(assembler->GetScratchRegisterList()),
-      old_available_(*available_) {}
+    : assembler_(assembler),
+      old_available_(*assembler->GetScratchRegisterList()),
+      old_available_vfp_(*assembler->GetScratchVfpRegisterList()) {}
 
 UseScratchRegisterScope::~UseScratchRegisterScope() {
-  *available_ = old_available_;
+  *assembler_->GetScratchRegisterList() = old_available_;
+  *assembler_->GetScratchVfpRegisterList() = old_available_vfp_;
 }
 
 Register UseScratchRegisterScope::Acquire() {
-  DCHECK_NOT_NULL(available_);
-  DCHECK_NE(*available_, 0);
-  int index = static_cast<int>(base::bits::CountTrailingZeros32(*available_));
-  *available_ &= ~(1UL << index);
-  return Register::from_code(index);
+  RegList* available = assembler_->GetScratchRegisterList();
+  DCHECK_NOT_NULL(available);
+  DCHECK_NE(*available, 0);
+  int index = static_cast<int>(base::bits::CountTrailingZeros32(*available));
+  Register reg = Register::from_code(index);
+  *available &= ~reg.bit();
+  return reg;
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/arm/assembler-arm.h b/deps/v8/src/arm/assembler-arm.h
index 8b95aad886a..a0348ae5484 100644
--- a/deps/v8/src/arm/assembler-arm.h
+++ b/deps/v8/src/arm/assembler-arm.h
@@ -56,8 +56,9 @@ namespace internal {
   V(r0)  V(r1)  V(r2)  V(r3)  V(r4)  V(r5)  V(r6)  V(r7)  \
   V(r8)  V(r9)  V(r10) V(fp)  V(ip)  V(sp)  V(lr)  V(pc)
 
-#define ALLOCATABLE_GENERAL_REGISTERS(V) \
-  V(r0)  V(r1)  V(r2)  V(r3)  V(r4)  V(r5)  V(r6)  V(r7)  V(r8)
+#define ALLOCATABLE_GENERAL_REGISTERS(V)                  \
+  V(r0)  V(r1)  V(r2)  V(r3)  V(r4)  V(r5)  V(r6)  V(r7)  \
+  V(r8)  V(r9)
 
 #define FLOAT_REGISTERS(V)                                \
   V(s0)  V(s1)  V(s2)  V(s3)  V(s4)  V(s5)  V(s6)  V(s7)  \
@@ -161,8 +162,8 @@ class Register : public RegisterBase<Register, kRegAfterLast> {
   explicit constexpr Register(int code) : RegisterBase(code) {}
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(Register) &&
-                  sizeof(Register) == sizeof(int),
+ASSERT_TRIVIALLY_COPYABLE(Register);
+static_assert(sizeof(Register) == sizeof(int),
               "Register can efficiently be passed by value");
 
 // r7: context register
@@ -184,6 +185,17 @@ enum SwVfpRegisterCode {
       kSwVfpAfterLast
 };
 
+// Representation of a list of non-overlapping VFP registers. This list
+// represents the data layout of VFP registers as a bitfield:
+//   S registers cover 1 bit
+//   D registers cover 2 bits
+//   Q registers cover 4 bits
+//
+// This way, we make sure no registers in the list ever overlap. However, a list
+// may represent multiple different sets of registers,
+// e.g. [d0 s2 s3] <=> [s0 s1 d1].
+typedef uint64_t VfpRegList;
+
 // Single word VFP register.
 class SwVfpRegister : public RegisterBase<SwVfpRegister, kSwVfpAfterLast> {
  public:
@@ -195,14 +207,19 @@ class SwVfpRegister : public RegisterBase<SwVfpRegister, kSwVfpAfterLast> {
     *vm = reg_code >> 1;
   }
   void split_code(int* vm, int* m) const { split_code(code(), vm, m); }
+  VfpRegList ToVfpRegList() const {
+    DCHECK(is_valid());
+    // Each bit in the list corresponds to a S register.
+    return uint64_t{0x1} << code();
+  }
 
  private:
   friend class RegisterBase;
   explicit constexpr SwVfpRegister(int code) : RegisterBase(code) {}
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(SwVfpRegister) &&
-                  sizeof(SwVfpRegister) == sizeof(int),
+ASSERT_TRIVIALLY_COPYABLE(SwVfpRegister);
+static_assert(sizeof(SwVfpRegister) == sizeof(int),
               "SwVfpRegister can efficiently be passed by value");
 
 typedef SwVfpRegister FloatRegister;
@@ -217,10 +234,6 @@ enum DoubleRegisterCode {
 // Double word VFP register.
 class DwVfpRegister : public RegisterBase<DwVfpRegister, kDoubleAfterLast> {
  public:
-  // A few double registers are reserved: one as a scratch register and one to
-  // hold 0.0, that does not fit in the immediate field of vmov instructions.
-  //  d14: 0.0
-  //  d15: scratch register.
   static constexpr int kSizeInBytes = 8;
 
   inline static int NumRegisters();
@@ -231,6 +244,11 @@ class DwVfpRegister : public RegisterBase<DwVfpRegister, kDoubleAfterLast> {
     *vm = reg_code & 0x0F;
   }
   void split_code(int* vm, int* m) const { split_code(code(), vm, m); }
+  VfpRegList ToVfpRegList() const {
+    DCHECK(is_valid());
+    // A D register overlaps two S registers.
+    return uint64_t{0x3} << (code() * 2);
+  }
 
  private:
   friend class RegisterBase;
@@ -238,8 +256,8 @@ class DwVfpRegister : public RegisterBase<DwVfpRegister, kDoubleAfterLast> {
   explicit constexpr DwVfpRegister(int code) : RegisterBase(code) {}
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(DwVfpRegister) &&
-                  sizeof(DwVfpRegister) == sizeof(int),
+ASSERT_TRIVIALLY_COPYABLE(DwVfpRegister);
+static_assert(sizeof(DwVfpRegister) == sizeof(int),
               "DwVfpRegister can efficiently be passed by value");
 
 typedef DwVfpRegister DoubleRegister;
@@ -255,6 +273,11 @@ class LowDwVfpRegister
   SwVfpRegister high() const {
     return SwVfpRegister::from_code(code() * 2 + 1);
   }
+  VfpRegList ToVfpRegList() const {
+    DCHECK(is_valid());
+    // A D register overlaps two S registers.
+    return uint64_t{0x3} << (code() * 2);
+  }
 
  private:
   friend class RegisterBase;
@@ -282,6 +305,11 @@ class QwNeonRegister : public RegisterBase<QwNeonRegister, kSimd128AfterLast> {
   DwVfpRegister high() const {
     return DwVfpRegister::from_code(code() * 2 + 1);
   }
+  VfpRegList ToVfpRegList() const {
+    DCHECK(is_valid());
+    // A Q register overlaps four S registers.
+    return uint64_t{0xf} << (code() * 4);
+  }
 
  private:
   friend class RegisterBase;
@@ -334,12 +362,6 @@ SIMD128_REGISTERS(DECLARE_SIMD128_REGISTER)
 constexpr LowDwVfpRegister kFirstCalleeSavedDoubleReg = d8;
 constexpr LowDwVfpRegister kLastCalleeSavedDoubleReg = d15;
 constexpr LowDwVfpRegister kDoubleRegZero  = d13;
-constexpr LowDwVfpRegister kScratchDoubleReg = d14;
-// This scratch q-register aliases d14 (kScratchDoubleReg) and d15, but is only
-// used if NEON is supported, which implies VFP32DREGS. When there are only 16
-// d-registers, d15 is still allocatable.
-constexpr QwNeonRegister kScratchQuadReg = q7;
-constexpr LowDwVfpRegister kScratchDoubleReg2 = d15;
 
 constexpr CRegister no_creg = CRegister::no_reg();
 
@@ -376,7 +398,7 @@ class Operand BASE_EMBEDDED {
  public:
   // immediate
   INLINE(explicit Operand(int32_t immediate,
-         RelocInfo::Mode rmode = RelocInfo::NONE32));
+                          RelocInfo::Mode rmode = RelocInfo::NONE));
   INLINE(static Operand Zero());
   INLINE(explicit Operand(const ExternalReference& f));
   explicit Operand(Handle<HeapObject> handle);
@@ -651,7 +673,7 @@ class Assembler : public AssemblerBase {
   // The isolate argument is unused (and may be nullptr) when skipping flushing.
   INLINE(static Address target_address_at(Address pc, Address constant_pool));
   INLINE(static void set_target_address_at(
-      Isolate* isolate, Address pc, Address constant_pool, Address target,
+      Address pc, Address constant_pool, Address target,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED));
 
   // Return the code target address at a call site from the return address
@@ -665,12 +687,11 @@ class Assembler : public AssemblerBase {
   // This sets the branch destination (which is in the constant pool on ARM).
   // This is for calls and branches within generated code.
   inline static void deserialization_set_special_target_at(
-      Isolate* isolate, Address constant_pool_entry, Code* code,
-      Address target);
+      Address constant_pool_entry, Code* code, Address target);
 
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
-      Isolate* isolate, Address pc, Address target,
+      Address pc, Address target,
       RelocInfo::Mode mode = RelocInfo::INTERNAL_REFERENCE);
 
   // Here we are patching the address in the constant pool, not the actual call
@@ -685,6 +706,9 @@ class Assembler : public AssemblerBase {
   // register.
   static constexpr int kPcLoadDelta = 8;
   RegList* GetScratchRegisterList() { return &scratch_register_list_; }
+  VfpRegList* GetScratchVfpRegisterList() {
+    return &scratch_vfp_register_list_;
+  }
 
   // ---------------------------------------------------------------------------
   // Code generation
@@ -717,6 +741,8 @@ class Assembler : public AssemblerBase {
 
   void and_(Register dst, Register src1, const Operand& src2,
             SBit s = LeaveCC, Condition cond = al);
+  void and_(Register dst, Register src1, Register src2, SBit s = LeaveCC,
+            Condition cond = al);
 
   void eor(Register dst, Register src1, const Operand& src2,
            SBit s = LeaveCC, Condition cond = al);
@@ -936,6 +962,9 @@ class Assembler : public AssemblerBase {
   void dsb(BarrierOption option);
   void isb(BarrierOption option);
 
+  // Conditional speculation barrier.
+  void csdb();
+
   // Coprocessor instructions
 
   void cdp(Coprocessor coproc, int opcode_1,
@@ -1655,6 +1684,7 @@ class Assembler : public AssemblerBase {
 
   // Scratch registers available for use by the Assembler.
   RegList scratch_register_list_;
+  VfpRegList scratch_vfp_register_list_;
 
  private:
   // Avoid overflows for displacements etc.
@@ -1732,6 +1762,7 @@ class Assembler : public AssemblerBase {
   friend class BlockConstPoolScope;
   friend class BlockCodeTargetSharingScope;
   friend class EnsureSpace;
+  friend class UseScratchRegisterScope;
 
   // The following functions help with avoiding allocations of embedded heap
   // objects during the code assembly phase. {RequestHeapObject} records the
@@ -1747,8 +1778,6 @@ class Assembler : public AssemblerBase {
   std::forward_list<HeapObjectRequest> heap_object_requests_;
 };
 
-constexpr int kNoCodeAgeSequenceLength = 3 * Assembler::kInstrSize;
-
 class EnsureSpace BASE_EMBEDDED {
  public:
   INLINE(explicit EnsureSpace(Assembler* assembler));
@@ -1760,7 +1789,6 @@ class PatchingAssembler : public Assembler {
   ~PatchingAssembler();
 
   void Emit(Address addr);
-  void FlushICache(Isolate* isolate);
 };
 
 // This scope utility allows scratch registers to be managed safely. The
@@ -1779,12 +1807,37 @@ class UseScratchRegisterScope {
 
   // Take a register from the list and return it.
   Register Acquire();
+  SwVfpRegister AcquireS() { return AcquireVfp<SwVfpRegister>(); }
+  LowDwVfpRegister AcquireLowD() { return AcquireVfp<LowDwVfpRegister>(); }
+  DwVfpRegister AcquireD() {
+    DwVfpRegister reg = AcquireVfp<DwVfpRegister>();
+    DCHECK(assembler_->VfpRegisterIsAvailable(reg));
+    return reg;
+  }
+  QwNeonRegister AcquireQ() {
+    QwNeonRegister reg = AcquireVfp<QwNeonRegister>();
+    DCHECK(assembler_->VfpRegisterIsAvailable(reg));
+    return reg;
+  }
+
+  // Check if we have registers available to acquire.
+  bool CanAcquire() const { return *assembler_->GetScratchRegisterList() != 0; }
+  bool CanAcquireD() const { return CanAcquireVfp<DwVfpRegister>(); }
 
  private:
-  // Currently available scratch registers.
-  RegList* available_;
+  friend class Assembler;
+  friend class TurboAssembler;
+
+  template <typename T>
+  bool CanAcquireVfp() const;
+
+  template <typename T>
+  T AcquireVfp();
+
+  Assembler* assembler_;
   // Available scratch registers at the start of this scope.
   RegList old_available_;
+  VfpRegList old_available_vfp_;
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/arm/code-stubs-arm.cc b/deps/v8/src/arm/code-stubs-arm.cc
index ee706c7656e..2695bafc1b6 100644
--- a/deps/v8/src/arm/code-stubs-arm.cc
+++ b/deps/v8/src/arm/code-stubs-arm.cc
@@ -46,7 +46,7 @@ void DoubleToIStub::Generate(MacroAssembler* masm) {
   UseScratchRegisterScope temps(masm);
   Register double_low = GetRegisterThatIsNotOneOf(result_reg);
   Register double_high = GetRegisterThatIsNotOneOf(result_reg, double_low);
-  LowDwVfpRegister double_scratch = kScratchDoubleReg;
+  LowDwVfpRegister double_scratch = temps.AcquireLowD();
 
   // Save the old values from these temporary registers on the stack.
   __ Push(double_high, double_low);
@@ -385,6 +385,12 @@ void CEntryStub::Generate(MacroAssembler* masm) {
   __ cmp(cp, Operand(0));
   __ str(cp, MemOperand(fp, StandardFrameConstants::kContextOffset), ne);
 
+  // Reset the masking register. This is done independent of the underlying
+  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
+  // both configurations. It is safe to always do this, because the underlying
+  // register is caller-saved and can be arbitrarily clobbered.
+  __ ResetSpeculationPoisonRegister();
+
   // Compute the handler entry address and jump to it.
   ConstantPoolUnavailableScope constant_pool_unavailable(masm);
   __ mov(r1, Operand(pending_handler_entrypoint_address));
@@ -572,8 +578,8 @@ void ProfileEntryHookStub::MaybeCallEntryHookDelayed(TurboAssembler* tasm,
                                                      Zone* zone) {
   if (tasm->isolate()->function_entry_hook() != nullptr) {
     tasm->MaybeCheckConstPool();
-    PredictableCodeSizeScope predictable(tasm);
-    predictable.ExpectSize(tasm->CallStubSize() + 2 * Assembler::kInstrSize);
+    PredictableCodeSizeScope predictable(
+        tasm, tasm->CallStubSize() + 2 * Assembler::kInstrSize);
     tasm->push(lr);
     tasm->CallStubDelayed(new (zone) ProfileEntryHookStub(nullptr));
     tasm->pop(lr);
@@ -584,8 +590,8 @@ void ProfileEntryHookStub::MaybeCallEntryHook(MacroAssembler* masm) {
   if (masm->isolate()->function_entry_hook() != nullptr) {
     ProfileEntryHookStub stub(masm->isolate());
     masm->MaybeCheckConstPool();
-    PredictableCodeSizeScope predictable(masm);
-    predictable.ExpectSize(masm->CallStubSize() + 2 * Assembler::kInstrSize);
+    PredictableCodeSizeScope predictable(
+        masm, masm->CallStubSize() + 2 * Assembler::kInstrSize);
     __ push(lr);
     __ CallStub(&stub);
     __ pop(lr);
diff --git a/deps/v8/src/arm/codegen-arm.cc b/deps/v8/src/arm/codegen-arm.cc
index 9fb2eb4e8db..ff439f82595 100644
--- a/deps/v8/src/arm/codegen-arm.cc
+++ b/deps/v8/src/arm/codegen-arm.cc
@@ -9,6 +9,7 @@
 #include "src/arm/assembler-arm-inl.h"
 #include "src/arm/simulator-arm.h"
 #include "src/codegen.h"
+#include "src/isolate.h"
 #include "src/macro-assembler.h"
 
 namespace v8 {
@@ -166,9 +167,9 @@ MemCopyUint8Function CreateMemCopyUint8Function(Isolate* isolate,
 
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
-  DCHECK(!RelocInfo::RequiresRelocation(isolate, desc));
+  DCHECK(!RelocInfo::RequiresRelocation(desc));
 
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   CHECK(SetPermissions(buffer, allocated, PageAllocator::kReadExecute));
   return FUNCTION_CAST<MemCopyUint8Function>(buffer);
 #endif
@@ -257,7 +258,7 @@ MemCopyUint16Uint8Function CreateMemCopyUint16Uint8Function(
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
 
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   CHECK(SetPermissions(buffer, allocated, PageAllocator::kReadExecute));
   return FUNCTION_CAST<MemCopyUint16Uint8Function>(buffer);
 #endif
@@ -282,9 +283,9 @@ UnaryMathFunctionWithIsolate CreateSqrtFunction(Isolate* isolate) {
 
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
-  DCHECK(!RelocInfo::RequiresRelocation(isolate, desc));
+  DCHECK(!RelocInfo::RequiresRelocation(desc));
 
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   CHECK(SetPermissions(buffer, allocated, PageAllocator::kReadExecute));
   return FUNCTION_CAST<UnaryMathFunctionWithIsolate>(buffer);
 #endif
diff --git a/deps/v8/src/arm/constants-arm.h b/deps/v8/src/arm/constants-arm.h
index 1c865afb093..4e52a917383 100644
--- a/deps/v8/src/arm/constants-arm.h
+++ b/deps/v8/src/arm/constants-arm.h
@@ -641,8 +641,8 @@ class Instruction {
                                            && (Bit(20) == 0)
                                            && ((Bit(7) == 0)); }
 
-  // Test for a nop instruction, which falls under type 1.
-  inline bool IsNopType1() const { return Bits(24, 0) == 0x0120F000; }
+  // Test for nop-like instructions which fall under type 1.
+  inline bool IsNopLikeType1() const { return Bits(24, 8) == 0x120F0; }
 
   // Test for a stop instruction.
   inline bool IsStop() const {
diff --git a/deps/v8/src/arm/deoptimizer-arm.cc b/deps/v8/src/arm/deoptimizer-arm.cc
index 9a21ef862c3..a4a540512d9 100644
--- a/deps/v8/src/arm/deoptimizer-arm.cc
+++ b/deps/v8/src/arm/deoptimizer-arm.cc
@@ -30,9 +30,6 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   const int kFloatRegsSize = kFloatSize * SwVfpRegister::kNumRegisters;
 
   // Save all allocatable VFP registers before messing with them.
-  DCHECK_EQ(kDoubleRegZero.code(), 13);
-  DCHECK_EQ(kScratchDoubleReg.code(), 14);
-
   {
     // We use a run-time check for VFP32DREGS.
     CpuFeatureScope scope(masm(), VFP32DREGS,
diff --git a/deps/v8/src/arm/disasm-arm.cc b/deps/v8/src/arm/disasm-arm.cc
index 99511365619..9459a7e60de 100644
--- a/deps/v8/src/arm/disasm-arm.cc
+++ b/deps/v8/src/arm/disasm-arm.cc
@@ -937,8 +937,14 @@ void Decoder::DecodeType01(Instruction* instr) {
     } else {
       Unknown(instr);  // not used by V8
     }
-  } else if ((type == 1) && instr->IsNopType1()) {
-    Format(instr, "nop'cond");
+  } else if ((type == 1) && instr->IsNopLikeType1()) {
+    if (instr->BitField(7, 0) == 0) {
+      Format(instr, "nop'cond");
+    } else if (instr->BitField(7, 0) == 20) {
+      Format(instr, "csdb");
+    } else {
+      Unknown(instr);  // Not used in V8.
+    }
   } else {
     switch (instr->OpcodeField()) {
       case AND: {
diff --git a/deps/v8/src/arm/frame-constants-arm.h b/deps/v8/src/arm/frame-constants-arm.h
index 9307cc22de3..1230a269562 100644
--- a/deps/v8/src/arm/frame-constants-arm.h
+++ b/deps/v8/src/arm/frame-constants-arm.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_ARM_FRAMES_ARM_H_
-#define V8_ARM_FRAMES_ARM_H_
+#ifndef V8_ARM_FRAME_CONSTANTS_ARM_H_
+#define V8_ARM_FRAME_CONSTANTS_ARM_H_
 
 namespace v8 {
 namespace internal {
@@ -45,4 +45,4 @@ class JavaScriptFrameConstants : public AllStatic {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_ARM_FRAMES_ARM_H_
+#endif  // V8_ARM_FRAME_CONSTANTS_ARM_H_
diff --git a/deps/v8/src/arm/interface-descriptors-arm.cc b/deps/v8/src/arm/interface-descriptors-arm.cc
index 6b7498fde52..20ecef6c1cc 100644
--- a/deps/v8/src/arm/interface-descriptors-arm.cc
+++ b/deps/v8/src/arm/interface-descriptors-arm.cc
@@ -70,12 +70,6 @@ const Register GrowArrayElementsDescriptor::ObjectRegister() { return r0; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return r3; }
 
 
-void FastNewClosureDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {r1, r2, r3};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
 // static
 const Register TypeConversionDescriptor::ArgumentRegister() { return r0; }
 
diff --git a/deps/v8/src/arm/macro-assembler-arm.cc b/deps/v8/src/arm/macro-assembler-arm.cc
index 30190d3f34d..e363e0ecfe9 100644
--- a/deps/v8/src/arm/macro-assembler-arm.cc
+++ b/deps/v8/src/arm/macro-assembler-arm.cc
@@ -18,6 +18,7 @@
 #include "src/double.h"
 #include "src/external-reference-table.h"
 #include "src/frames-inl.h"
+#include "src/instruction-stream.h"
 #include "src/objects-inl.h"
 #include "src/register-configuration.h"
 #include "src/runtime/runtime.h"
@@ -241,22 +242,6 @@ void TurboAssembler::Ret(int drop, Condition cond) {
   Ret(cond);
 }
 
-
-void MacroAssembler::Swap(Register reg1,
-                          Register reg2,
-                          Register scratch,
-                          Condition cond) {
-  if (scratch == no_reg) {
-    eor(reg1, reg1, Operand(reg2), LeaveCC, cond);
-    eor(reg2, reg2, Operand(reg1), LeaveCC, cond);
-    eor(reg1, reg1, Operand(reg2), LeaveCC, cond);
-  } else {
-    mov(scratch, reg1, LeaveCC, cond);
-    mov(reg1, reg2, LeaveCC, cond);
-    mov(reg2, scratch, LeaveCC, cond);
-  }
-}
-
 void TurboAssembler::Call(Label* target) { bl(target); }
 
 void TurboAssembler::Push(Handle<HeapObject> handle) {
@@ -305,27 +290,34 @@ void TurboAssembler::Move(QwNeonRegister dst, QwNeonRegister src) {
   }
 }
 
-void TurboAssembler::Swap(DwVfpRegister srcdst0, DwVfpRegister srcdst1) {
-  if (srcdst0 == srcdst1) return;  // Swapping aliased registers emits nothing.
+void TurboAssembler::Swap(Register srcdst0, Register srcdst1) {
+  DCHECK(srcdst0 != srcdst1);
+  UseScratchRegisterScope temps(this);
+  Register scratch = temps.Acquire();
+  mov(scratch, srcdst0);
+  mov(srcdst0, srcdst1);
+  mov(srcdst1, scratch);
+}
 
+void TurboAssembler::Swap(DwVfpRegister srcdst0, DwVfpRegister srcdst1) {
+  DCHECK(srcdst0 != srcdst1);
   DCHECK(VfpRegisterIsAvailable(srcdst0));
   DCHECK(VfpRegisterIsAvailable(srcdst1));
 
   if (CpuFeatures::IsSupported(NEON)) {
     vswp(srcdst0, srcdst1);
   } else {
-    DCHECK_NE(srcdst0, kScratchDoubleReg);
-    DCHECK_NE(srcdst1, kScratchDoubleReg);
-    vmov(kScratchDoubleReg, srcdst0);
+    UseScratchRegisterScope temps(this);
+    DwVfpRegister scratch = temps.AcquireD();
+    vmov(scratch, srcdst0);
     vmov(srcdst0, srcdst1);
-    vmov(srcdst1, kScratchDoubleReg);
+    vmov(srcdst1, scratch);
   }
 }
 
 void TurboAssembler::Swap(QwNeonRegister srcdst0, QwNeonRegister srcdst1) {
-  if (srcdst0 != srcdst1) {
-    vswp(srcdst0, srcdst1);
-  }
+  DCHECK(srcdst0 != srcdst1);
+  vswp(srcdst0, srcdst1);
 }
 
 void MacroAssembler::Mls(Register dst, Register src1, Register src2,
@@ -817,11 +809,14 @@ void TurboAssembler::VmovExtended(int dst_code, int src_code) {
   int dst_offset = dst_code & 1;
   int src_offset = src_code & 1;
   if (CpuFeatures::IsSupported(NEON)) {
+    UseScratchRegisterScope temps(this);
+    DwVfpRegister scratch = temps.AcquireD();
     // On Neon we can shift and insert from d-registers.
     if (src_offset == dst_offset) {
       // Offsets are the same, use vdup to copy the source to the opposite lane.
-      vdup(Neon32, kScratchDoubleReg, src_d_reg, src_offset);
-      src_d_reg = kScratchDoubleReg;
+      vdup(Neon32, scratch, src_d_reg, src_offset);
+      // Here we are extending the lifetime of scratch.
+      src_d_reg = scratch;
       src_offset = dst_offset ^ 1;
     }
     if (dst_offset) {
@@ -842,27 +837,30 @@ void TurboAssembler::VmovExtended(int dst_code, int src_code) {
 
   // Without Neon, use the scratch registers to move src and/or dst into
   // s-registers.
-  int scratchSCode = kScratchDoubleReg.low().code();
-  int scratchSCode2 = kScratchDoubleReg2.low().code();
+  UseScratchRegisterScope temps(this);
+  LowDwVfpRegister d_scratch = temps.AcquireLowD();
+  LowDwVfpRegister d_scratch2 = temps.AcquireLowD();
+  int s_scratch_code = d_scratch.low().code();
+  int s_scratch_code2 = d_scratch2.low().code();
   if (src_code < SwVfpRegister::kNumRegisters) {
     // src is an s-register, dst is not.
-    vmov(kScratchDoubleReg, dst_d_reg);
-    vmov(SwVfpRegister::from_code(scratchSCode + dst_offset),
+    vmov(d_scratch, dst_d_reg);
+    vmov(SwVfpRegister::from_code(s_scratch_code + dst_offset),
          SwVfpRegister::from_code(src_code));
-    vmov(dst_d_reg, kScratchDoubleReg);
+    vmov(dst_d_reg, d_scratch);
   } else if (dst_code < SwVfpRegister::kNumRegisters) {
     // dst is an s-register, src is not.
-    vmov(kScratchDoubleReg, src_d_reg);
+    vmov(d_scratch, src_d_reg);
     vmov(SwVfpRegister::from_code(dst_code),
-         SwVfpRegister::from_code(scratchSCode + src_offset));
+         SwVfpRegister::from_code(s_scratch_code + src_offset));
   } else {
     // Neither src or dst are s-registers. Both scratch double registers are
     // available when there are 32 VFP registers.
-    vmov(kScratchDoubleReg, src_d_reg);
-    vmov(kScratchDoubleReg2, dst_d_reg);
-    vmov(SwVfpRegister::from_code(scratchSCode + dst_offset),
-         SwVfpRegister::from_code(scratchSCode2 + src_offset));
-    vmov(dst_d_reg, kScratchQuadReg.high());
+    vmov(d_scratch, src_d_reg);
+    vmov(d_scratch2, dst_d_reg);
+    vmov(SwVfpRegister::from_code(s_scratch_code + dst_offset),
+         SwVfpRegister::from_code(s_scratch_code2 + src_offset));
+    vmov(dst_d_reg, d_scratch2);
   }
 }
 
@@ -870,11 +868,13 @@ void TurboAssembler::VmovExtended(int dst_code, const MemOperand& src) {
   if (dst_code < SwVfpRegister::kNumRegisters) {
     vldr(SwVfpRegister::from_code(dst_code), src);
   } else {
+    UseScratchRegisterScope temps(this);
+    LowDwVfpRegister scratch = temps.AcquireLowD();
     // TODO(bbudge) If Neon supported, use load single lane form of vld1.
-    int dst_s_code = kScratchDoubleReg.low().code() + (dst_code & 1);
-    vmov(kScratchDoubleReg, DwVfpRegister::from_code(dst_code / 2));
+    int dst_s_code = scratch.low().code() + (dst_code & 1);
+    vmov(scratch, DwVfpRegister::from_code(dst_code / 2));
     vldr(SwVfpRegister::from_code(dst_s_code), src);
-    vmov(DwVfpRegister::from_code(dst_code / 2), kScratchDoubleReg);
+    vmov(DwVfpRegister::from_code(dst_code / 2), scratch);
   }
 }
 
@@ -883,8 +883,10 @@ void TurboAssembler::VmovExtended(const MemOperand& dst, int src_code) {
     vstr(SwVfpRegister::from_code(src_code), dst);
   } else {
     // TODO(bbudge) If Neon supported, use store single lane form of vst1.
-    int src_s_code = kScratchDoubleReg.low().code() + (src_code & 1);
-    vmov(kScratchDoubleReg, DwVfpRegister::from_code(src_code / 2));
+    UseScratchRegisterScope temps(this);
+    LowDwVfpRegister scratch = temps.AcquireLowD();
+    int src_s_code = scratch.low().code() + (src_code & 1);
+    vmov(scratch, DwVfpRegister::from_code(src_code / 2));
     vstr(SwVfpRegister::from_code(src_s_code), dst);
   }
 }
@@ -938,9 +940,11 @@ void TurboAssembler::ReplaceLane(QwNeonRegister dst, QwNeonRegister src,
 
 void TurboAssembler::LslPair(Register dst_low, Register dst_high,
                              Register src_low, Register src_high,
-                             Register scratch, Register shift) {
+                             Register shift) {
   DCHECK(!AreAliased(dst_high, src_low));
   DCHECK(!AreAliased(dst_high, shift));
+  UseScratchRegisterScope temps(this);
+  Register scratch = temps.Acquire();
 
   Label less_than_32;
   Label done;
@@ -984,9 +988,11 @@ void TurboAssembler::LslPair(Register dst_low, Register dst_high,
 
 void TurboAssembler::LsrPair(Register dst_low, Register dst_high,
                              Register src_low, Register src_high,
-                             Register scratch, Register shift) {
+                             Register shift) {
   DCHECK(!AreAliased(dst_low, src_high));
   DCHECK(!AreAliased(dst_low, shift));
+  UseScratchRegisterScope temps(this);
+  Register scratch = temps.Acquire();
 
   Label less_than_32;
   Label done;
@@ -1031,9 +1037,11 @@ void TurboAssembler::LsrPair(Register dst_low, Register dst_high,
 
 void TurboAssembler::AsrPair(Register dst_low, Register dst_high,
                              Register src_low, Register src_high,
-                             Register scratch, Register shift) {
+                             Register shift) {
   DCHECK(!AreAliased(dst_low, src_high));
   DCHECK(!AreAliased(dst_low, shift));
+  UseScratchRegisterScope temps(this);
+  Register scratch = temps.Acquire();
 
   Label less_than_32;
   Label done;
@@ -1363,12 +1371,14 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
                                     const ParameterCount& expected,
                                     const ParameterCount& actual) {
   Label skip_hook;
+
   ExternalReference debug_hook_avtive =
       ExternalReference::debug_hook_on_function_call_address(isolate());
   mov(r4, Operand(debug_hook_avtive));
   ldrsb(r4, MemOperand(r4));
   cmp(r4, Operand(0));
   b(eq, &skip_hook);
+
   {
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
@@ -1426,7 +1436,7 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
     // We call indirectly through the code field in the function to
     // allow recompilation to take effect without changing any of the
     // call sites.
-    Register code = r4;
+    Register code = kJavaScriptCallCodeStartRegister;
     ldr(code, FieldMemOperand(function, JSFunction::kCodeOffset));
     add(code, code, Operand(Code::kHeaderSize - kHeapObjectTag));
     if (flag == CALL_FUNCTION) {
@@ -1480,14 +1490,6 @@ void MacroAssembler::InvokeFunction(Register function,
   InvokeFunctionCode(r1, no_reg, expected, actual, flag);
 }
 
-void MacroAssembler::InvokeFunction(Handle<JSFunction> function,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual,
-                                    InvokeFlag flag) {
-  Move(r1, function);
-  InvokeFunction(r1, expected, actual, flag);
-}
-
 void MacroAssembler::MaybeDropFrames() {
   // Check whether we need to drop frames to restart a function on the stack.
   ExternalReference restart_fp =
@@ -1615,13 +1617,22 @@ void MacroAssembler::TryDoubleToInt32Exact(Register result,
 void TurboAssembler::TryInlineTruncateDoubleToI(Register result,
                                                 DwVfpRegister double_input,
                                                 Label* done) {
-  LowDwVfpRegister double_scratch = kScratchDoubleReg;
-  vcvt_s32_f64(double_scratch.low(), double_input);
-  vmov(result, double_scratch.low());
-
   UseScratchRegisterScope temps(this);
-  Register scratch = temps.Acquire();
+  SwVfpRegister single_scratch = SwVfpRegister::no_reg();
+  if (temps.CanAcquireVfp<SwVfpRegister>()) {
+    single_scratch = temps.AcquireS();
+  } else {
+    // Re-use the input as a scratch register. However, we can only do this if
+    // the input register is d0-d15 as there are no s32+ registers.
+    DCHECK_LT(double_input.code(), LowDwVfpRegister::kNumRegisters);
+    LowDwVfpRegister double_scratch =
+        LowDwVfpRegister::from_code(double_input.code());
+    single_scratch = double_scratch.low();
+  }
+  vcvt_s32_f64(single_scratch, double_input);
+  vmov(result, single_scratch);
 
+  Register scratch = temps.Acquire();
   // If result is not saturated (0x7FFFFFFF or 0x80000000), we are done.
   sub(scratch, result, Operand(1));
   cmp(scratch, Operand(0x7FFFFFFE));
@@ -1704,6 +1715,20 @@ void MacroAssembler::JumpToExternalReference(const ExternalReference& builtin,
   Jump(stub.GetCode(), RelocInfo::CODE_TARGET);
 }
 
+void MacroAssembler::JumpToInstructionStream(Address entry) {
+  mov(kOffHeapTrampolineRegister,
+      Operand(reinterpret_cast<int32_t>(entry), RelocInfo::OFF_HEAP_TARGET));
+  Jump(kOffHeapTrampolineRegister);
+}
+
+void MacroAssembler::LoadWeakValue(Register out, Register in,
+                                   Label* target_if_cleared) {
+  cmp(in, Operand(kClearedWeakHeapObject));
+  b(eq, target_if_cleared);
+
+  and_(out, in, Operand(~kWeakHeapObjectMask));
+}
+
 void MacroAssembler::IncrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK_GT(value, 0);
@@ -1860,6 +1885,20 @@ void MacroAssembler::AssertFixedArray(Register object) {
   }
 }
 
+void MacroAssembler::AssertConstructor(Register object) {
+  if (emit_debug_code()) {
+    STATIC_ASSERT(kSmiTag == 0);
+    tst(object, Operand(kSmiTagMask));
+    Check(ne, AbortReason::kOperandIsASmiAndNotAConstructor);
+    push(object);
+    ldr(object, FieldMemOperand(object, HeapObject::kMapOffset));
+    ldrb(object, FieldMemOperand(object, Map::kBitFieldOffset));
+    tst(object, Operand(Map::IsConstructorBit::kMask));
+    pop(object);
+    Check(ne, AbortReason::kOperandIsNotAConstructor);
+  }
+}
+
 void MacroAssembler::AssertFunction(Register object) {
   if (emit_debug_code()) {
     STATIC_ASSERT(kSmiTag == 0);
@@ -1926,7 +1965,7 @@ void MacroAssembler::AssertUndefinedOrAllocationSite(Register object,
 
 
 void TurboAssembler::CheckFor32DRegs(Register scratch) {
-  mov(scratch, Operand(ExternalReference::cpu_features()));
+  mov(scratch, Operand(ExternalReference::cpu_features(isolate())));
   ldr(scratch, MemOperand(scratch));
   tst(scratch, Operand(1u << VFP32DREGS));
 }
@@ -2275,6 +2314,15 @@ bool AreAliased(Register reg1,
 }
 #endif
 
+void TurboAssembler::ComputeCodeStartAddress(Register dst) {
+  // We can use the register pc - 8 for the address of the current instruction.
+  sub(dst, pc, Operand(pc_offset() + TurboAssembler::kPcLoadDelta));
+}
+
+void TurboAssembler::ResetSpeculationPoisonRegister() {
+  mov(kSpeculationPoisonRegister, Operand(-1));
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/arm/macro-assembler-arm.h b/deps/v8/src/arm/macro-assembler-arm.h
index cf731cbedbf..af8b449de6d 100644
--- a/deps/v8/src/arm/macro-assembler-arm.h
+++ b/deps/v8/src/arm/macro-assembler-arm.h
@@ -20,12 +20,15 @@ constexpr Register kReturnRegister2 = r2;
 constexpr Register kJSFunctionRegister = r1;
 constexpr Register kContextRegister = r7;
 constexpr Register kAllocateSizeRegister = r1;
+constexpr Register kSpeculationPoisonRegister = r9;
 constexpr Register kInterpreterAccumulatorRegister = r0;
 constexpr Register kInterpreterBytecodeOffsetRegister = r5;
 constexpr Register kInterpreterBytecodeArrayRegister = r6;
 constexpr Register kInterpreterDispatchTableRegister = r8;
 constexpr Register kJavaScriptCallArgCountRegister = r0;
+constexpr Register kJavaScriptCallCodeStartRegister = r2;
 constexpr Register kJavaScriptCallNewTargetRegister = r3;
+constexpr Register kOffHeapTrampolineRegister = r6;
 constexpr Register kRuntimeCallFunctionRegister = r1;
 constexpr Register kRuntimeCallArgCountRegister = r0;
 
@@ -305,15 +308,15 @@ class TurboAssembler : public Assembler {
   inline bool AllowThisStubCall(CodeStub* stub);
 
   void LslPair(Register dst_low, Register dst_high, Register src_low,
-               Register src_high, Register scratch, Register shift);
+               Register src_high, Register shift);
   void LslPair(Register dst_low, Register dst_high, Register src_low,
                Register src_high, uint32_t shift);
   void LsrPair(Register dst_low, Register dst_high, Register src_low,
-               Register src_high, Register scratch, Register shift);
+               Register src_high, Register shift);
   void LsrPair(Register dst_low, Register dst_high, Register src_low,
                Register src_high, uint32_t shift);
   void AsrPair(Register dst_low, Register dst_high, Register src_low,
-               Register src_high, Register scratch, Register shift);
+               Register src_high, Register shift);
   void AsrPair(Register dst_low, Register dst_high, Register src_low,
                Register src_high, uint32_t shift);
 
@@ -481,7 +484,8 @@ class TurboAssembler : public Assembler {
   void VmovExtended(int dst_code, const MemOperand& src);
   void VmovExtended(const MemOperand& dst, int src_code);
 
-  // Register swap.
+  // Register swap. Note that the register operands should be distinct.
+  void Swap(Register srcdst0, Register srcdst1);
   void Swap(DwVfpRegister srcdst0, DwVfpRegister srcdst1);
   void Swap(QwNeonRegister srcdst0, QwNeonRegister srcdst1);
 
@@ -530,6 +534,12 @@ class TurboAssembler : public Assembler {
 #endif
   }
 
+  // Compute the start of the generated instruction stream from the current PC.
+  // This is an alternative to embedding the {CodeObject} handle as a reference.
+  void ComputeCodeStartAddress(Register dst);
+
+  void ResetSpeculationPoisonRegister();
+
  private:
   bool has_frame_ = false;
   Isolate* const isolate_;
@@ -579,11 +589,6 @@ class MacroAssembler : public TurboAssembler {
   MacroAssembler(Isolate* isolate, void* buffer, int size,
                  CodeObjectRequired create_code_object);
 
-  // Swap two registers.  If the scratch register is omitted then a slightly
-  // less efficient form using xor instead of mov is emitted.
-  void Swap(Register reg1, Register reg2, Register scratch = no_reg,
-            Condition cond = al);
-
   void Mls(Register dst, Register src1, Register src2, Register srcA,
            Condition cond = al);
   void And(Register dst, Register src1, const Operand& src2,
@@ -694,10 +699,6 @@ class MacroAssembler : public TurboAssembler {
   void InvokeFunction(Register function, const ParameterCount& expected,
                       const ParameterCount& actual, InvokeFlag flag);
 
-  void InvokeFunction(Handle<JSFunction> function,
-                      const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
-
   // Frame restart support
   void MaybeDropFrames();
 
@@ -797,6 +798,13 @@ class MacroAssembler : public TurboAssembler {
   void JumpToExternalReference(const ExternalReference& builtin,
                                bool builtin_exit_frame = false);
 
+  // Generates a trampoline to jump to the off-heap instruction stream.
+  void JumpToInstructionStream(Address entry);
+
+  // ---------------------------------------------------------------------------
+  // In-place weak references.
+  void LoadWeakValue(Register out, Register in, Label* target_if_cleared);
+
   // ---------------------------------------------------------------------------
   // StatsCounter support
 
@@ -829,6 +837,9 @@ class MacroAssembler : public TurboAssembler {
   // Abort execution if argument is not a FixedArray, enabled via --debug-code.
   void AssertFixedArray(Register object);
 
+  // Abort execution if argument is not a Constructor, enabled via --debug-code.
+  void AssertConstructor(Register object);
+
   // Abort execution if argument is not a JSFunction, enabled via --debug-code.
   void AssertFunction(Register object);
 
diff --git a/deps/v8/src/arm/simulator-arm.cc b/deps/v8/src/arm/simulator-arm.cc
index 52fe9022375..6a735fcef6f 100644
--- a/deps/v8/src/arm/simulator-arm.cc
+++ b/deps/v8/src/arm/simulator-arm.cc
@@ -547,8 +547,7 @@ void ArmDebugger::Debug() {
 #undef XSTR
 }
 
-
-static bool ICacheMatch(void* one, void* two) {
+bool Simulator::ICacheMatch(void* one, void* two) {
   DCHECK_EQ(reinterpret_cast<intptr_t>(one) & CachePage::kPageMask, 0);
   DCHECK_EQ(reinterpret_cast<intptr_t>(two) & CachePage::kPageMask, 0);
   return one == two;
@@ -645,11 +644,6 @@ void Simulator::CheckICache(base::CustomMatcherHashMap* i_cache,
 
 
 Simulator::Simulator(Isolate* isolate) : isolate_(isolate) {
-  i_cache_ = isolate_->simulator_i_cache();
-  if (i_cache_ == nullptr) {
-    i_cache_ = new base::CustomMatcherHashMap(&ICacheMatch);
-    isolate_->set_simulator_i_cache(i_cache_);
-  }
   // Set up simulator support first. Some of this information is needed to
   // setup the architecture state.
   size_t stack_size = 1 * 1024*1024;  // allocate 1MB for stack
@@ -2314,8 +2308,15 @@ void Simulator::DecodeType01(Instruction* instr) {
       PrintF("%08x\n", instr->InstructionBits());
       UNIMPLEMENTED();
     }
-  } else if ((type == 1) && instr->IsNopType1()) {
-    // NOP.
+  } else if ((type == 1) && instr->IsNopLikeType1()) {
+    if (instr->BitField(7, 0) == 0) {
+      // NOP.
+    } else if (instr->BitField(7, 0) == 20) {
+      // CSDB.
+    } else {
+      PrintF("%08x\n", instr->InstructionBits());
+      UNIMPLEMENTED();
+    }
   } else {
     int rd = instr->RdValue();
     int rn = instr->RnValue();
@@ -5640,7 +5641,7 @@ void Simulator::DecodeSpecialCondition(Instruction* instr) {
 // Executes the current instruction.
 void Simulator::InstructionDecode(Instruction* instr) {
   if (v8::internal::FLAG_check_icache) {
-    CheckICache(isolate_->simulator_i_cache(), instr);
+    CheckICache(i_cache(), instr);
   }
   pc_modified_ = false;
   if (::v8::internal::FLAG_trace_sim) {
@@ -5822,7 +5823,7 @@ intptr_t Simulator::CallImpl(byte* entry, int argument_count,
   return get_register(r0);
 }
 
-int32_t Simulator::CallFPImpl(byte* entry, double d0, double d1) {
+intptr_t Simulator::CallFPImpl(byte* entry, double d0, double d1) {
   if (use_eabi_hardfloat()) {
     set_d_register_from_double(0, d0);
     set_d_register_from_double(1, d1);
diff --git a/deps/v8/src/arm/simulator-arm.h b/deps/v8/src/arm/simulator-arm.h
index 1cb11ffd96e..46a84ff4b44 100644
--- a/deps/v8/src/arm/simulator-arm.h
+++ b/deps/v8/src/arm/simulator-arm.h
@@ -183,6 +183,7 @@ class Simulator : public SimulatorBase {
   static void SetRedirectInstruction(Instruction* instruction);
 
   // ICache checking.
+  static bool ICacheMatch(void* one, void* two);
   static void FlushICache(base::CustomMatcherHashMap* i_cache, void* start,
                           size_t size);
 
@@ -381,9 +382,6 @@ class Simulator : public SimulatorBase {
   // Debugger input.
   char* last_debugger_input_;
 
-  // Icache simulation
-  base::CustomMatcherHashMap* i_cache_;
-
   // Registered breakpoints.
   Instruction* break_pc_;
   Instr break_instr_;
diff --git a/deps/v8/src/arm64/assembler-arm64-inl.h b/deps/v8/src/arm64/assembler-arm64-inl.h
index 11c4bbf33f9..15688e798f1 100644
--- a/deps/v8/src/arm64/assembler-arm64-inl.h
+++ b/deps/v8/src/arm64/assembler-arm64-inl.h
@@ -13,8 +13,7 @@
 namespace v8 {
 namespace internal {
 
-
-bool CpuFeatures::SupportsCrankshaft() { return true; }
+bool CpuFeatures::SupportsOptimizer() { return true; }
 
 bool CpuFeatures::SupportsWasmSimd128() { return true; }
 
@@ -95,7 +94,7 @@ inline void CPURegList::Remove(int code) {
 
 inline Register Register::XRegFromCode(unsigned code) {
   if (code == kSPRegInternalCode) {
-    return csp;
+    return sp;
   } else {
     DCHECK_LT(code, static_cast<unsigned>(kNumberOfRegisters));
     return Register::Create(code, kXRegSizeInBits);
@@ -105,7 +104,7 @@ inline Register Register::XRegFromCode(unsigned code) {
 
 inline Register Register::WRegFromCode(unsigned code) {
   if (code == kSPRegInternalCode) {
-    return wcsp;
+    return wsp;
   } else {
     DCHECK_LT(code, static_cast<unsigned>(kNumberOfRegisters));
     return Register::Create(code, kWRegSizeInBits);
@@ -198,9 +197,7 @@ inline VRegister CPURegister::Q() const {
 template<typename T>
 struct ImmediateInitializer {
   static const bool kIsIntType = true;
-  static inline RelocInfo::Mode rmode_for(T) {
-    return sizeof(T) == 8 ? RelocInfo::NONE64 : RelocInfo::NONE32;
-  }
+  static inline RelocInfo::Mode rmode_for(T) { return RelocInfo::NONE; }
   static inline int64_t immediate_for(T t) {
     STATIC_ASSERT(sizeof(T) <= 8);
     return t;
@@ -211,9 +208,7 @@ struct ImmediateInitializer {
 template<>
 struct ImmediateInitializer<Smi*> {
   static const bool kIsIntType = false;
-  static inline RelocInfo::Mode rmode_for(Smi* t) {
-    return RelocInfo::NONE64;
-  }
+  static inline RelocInfo::Mode rmode_for(Smi* t) { return RelocInfo::NONE; }
   static inline int64_t immediate_for(Smi* t) {;
     return reinterpret_cast<int64_t>(t);
   }
@@ -581,26 +576,23 @@ Address Assembler::return_address_from_call_start(Address pc) {
   }
 }
 
-
 void Assembler::deserialization_set_special_target_at(
-    Isolate* isolate, Address constant_pool_entry, Code* code, Address target) {
+    Address constant_pool_entry, Code* code, Address target) {
   Memory::Address_at(constant_pool_entry) = target;
 }
 
-
 void Assembler::deserialization_set_target_internal_reference_at(
-    Isolate* isolate, Address pc, Address target, RelocInfo::Mode mode) {
+    Address pc, Address target, RelocInfo::Mode mode) {
   Memory::Address_at(pc) = target;
 }
 
-
-void Assembler::set_target_address_at(Isolate* isolate, Address pc,
-                                      Address constant_pool, Address target,
+void Assembler::set_target_address_at(Address pc, Address constant_pool,
+                                      Address target,
                                       ICacheFlushMode icache_flush_mode) {
   Memory::Address_at(target_pointer_address_at(pc)) = target;
   // Intuitively, we would think it is necessary to always flush the
   // instruction cache after patching a target address in the code as follows:
-  //   Assembler::FlushICache(isolate(), pc, sizeof(target));
+  //   Assembler::FlushICache(pc, sizeof(target));
   // However, on ARM, an instruction is actually patched in the case of
   // embedded constants of the form:
   // ldr   ip, [pc, #...]
@@ -621,7 +613,8 @@ Address RelocInfo::target_address() {
 
 Address RelocInfo::target_address_address() {
   DCHECK(IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_) || IsWasmCall(rmode_) ||
-         rmode_ == EMBEDDED_OBJECT || rmode_ == EXTERNAL_REFERENCE);
+         IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
+         IsOffHeapTarget(rmode_));
   return Assembler::target_pointer_address_at(pc_);
 }
 
@@ -647,7 +640,7 @@ void RelocInfo::set_target_object(HeapObject* target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
-  Assembler::set_target_address_at(target->GetIsolate(), pc_, constant_pool_,
+  Assembler::set_target_address_at(pc_, constant_pool_,
                                    reinterpret_cast<Address>(target),
                                    icache_flush_mode);
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr) {
@@ -681,28 +674,33 @@ Address RelocInfo::target_runtime_entry(Assembler* origin) {
   return target_address();
 }
 
-void RelocInfo::set_target_runtime_entry(Isolate* isolate, Address target,
+void RelocInfo::set_target_runtime_entry(Address target,
                                          WriteBarrierMode write_barrier_mode,
                                          ICacheFlushMode icache_flush_mode) {
   DCHECK(IsRuntimeEntry(rmode_));
   if (target_address() != target) {
-    set_target_address(isolate, target, write_barrier_mode, icache_flush_mode);
+    set_target_address(target, write_barrier_mode, icache_flush_mode);
   }
 }
 
-void RelocInfo::WipeOut(Isolate* isolate) {
+Address RelocInfo::target_off_heap_target() {
+  DCHECK(IsOffHeapTarget(rmode_));
+  return Assembler::target_address_at(pc_, constant_pool_);
+}
+
+void RelocInfo::WipeOut() {
   DCHECK(IsEmbeddedObject(rmode_) || IsCodeTarget(rmode_) ||
          IsRuntimeEntry(rmode_) || IsExternalReference(rmode_) ||
          IsInternalReference(rmode_));
   if (IsInternalReference(rmode_)) {
     Memory::Address_at(pc_) = nullptr;
   } else {
-    Assembler::set_target_address_at(isolate, pc_, constant_pool_, nullptr);
+    Assembler::set_target_address_at(pc_, constant_pool_, nullptr);
   }
 }
 
 template <typename ObjectVisitor>
-void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
+void RelocInfo::Visit(ObjectVisitor* visitor) {
   RelocInfo::Mode mode = rmode();
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
@@ -714,6 +712,8 @@ void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
     visitor->VisitInternalReference(host(), this);
   } else if (RelocInfo::IsRuntimeEntry(mode)) {
     visitor->VisitRuntimeEntry(host(), this);
+  } else if (RelocInfo::IsOffHeapTarget(mode)) {
+    visitor->VisitOffHeapTarget(host(), this);
   }
 }
 
diff --git a/deps/v8/src/arm64/assembler-arm64.cc b/deps/v8/src/arm64/assembler-arm64.cc
index a031884e1f7..8a34f2b0016 100644
--- a/deps/v8/src/arm64/assembler-arm64.cc
+++ b/deps/v8/src/arm64/assembler-arm64.cc
@@ -181,22 +181,20 @@ uint32_t RelocInfo::embedded_size() const {
   return Memory::uint32_at(Assembler::target_pointer_address_at(pc_));
 }
 
-void RelocInfo::set_embedded_address(Isolate* isolate, Address address,
+void RelocInfo::set_embedded_address(Address address,
                                      ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(isolate, pc_, constant_pool_, address,
-                                   flush_mode);
+  Assembler::set_target_address_at(pc_, constant_pool_, address, flush_mode);
 }
 
-void RelocInfo::set_embedded_size(Isolate* isolate, uint32_t size,
-                                  ICacheFlushMode flush_mode) {
+void RelocInfo::set_embedded_size(uint32_t size, ICacheFlushMode flush_mode) {
   Memory::uint32_at(Assembler::target_pointer_address_at(pc_)) = size;
   // No icache flushing needed, see comment in set_target_address_at.
 }
 
-void RelocInfo::set_js_to_wasm_address(Isolate* isolate, Address address,
+void RelocInfo::set_js_to_wasm_address(Address address,
                                        ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  set_embedded_address(isolate, address, icache_flush_mode);
+  set_embedded_address(address, icache_flush_mode);
 }
 
 Address RelocInfo::js_to_wasm_address() const {
@@ -467,9 +465,6 @@ void ConstPool::Clear() {
 
 
 bool ConstPool::CanBeShared(RelocInfo::Mode mode) {
-  // Constant pool currently does not support 32-bit entries.
-  DCHECK(mode != RelocInfo::NONE32);
-
   return RelocInfo::IsNone(mode) ||
          (mode >= RelocInfo::FIRST_SHAREABLE_RELOC_MODE);
 }
@@ -2994,6 +2989,8 @@ void Assembler::isb() {
   Emit(ISB | ImmBarrierDomain(FullSystem) | ImmBarrierType(BarrierAll));
 }
 
+void Assembler::csdb() { hint(CSDB); }
+
 void Assembler::fmov(const VRegister& vd, double imm) {
   if (vd.IsScalar()) {
     DCHECK(vd.Is1D());
@@ -4701,7 +4698,7 @@ void Assembler::GrowBuffer() {
   // Some internal data structures overflow for very large buffers,
   // they must ensure that kMaximalBufferSize is not too large.
   if (desc.buffer_size > kMaximalBufferSize) {
-    V8::FatalProcessOutOfMemory("Assembler::GrowBuffer");
+    V8::FatalProcessOutOfMemory(nullptr, "Assembler::GrowBuffer");
   }
 
   byte* buffer = reinterpret_cast<byte*>(buffer_);
@@ -4745,6 +4742,9 @@ void Assembler::GrowBuffer() {
 
 
 void Assembler::RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data) {
+  // Non-relocatable constants should not end up in the literal pool.
+  DCHECK(!RelocInfo::IsNone(rmode));
+
   // We do not try to reuse pool constants.
   RelocInfo rinfo(reinterpret_cast<byte*>(pc_), rmode, data, nullptr);
   bool write_reloc_info = true;
diff --git a/deps/v8/src/arm64/assembler-arm64.h b/deps/v8/src/arm64/assembler-arm64.h
index 2deae8aaa46..94122e39391 100644
--- a/deps/v8/src/arm64/assembler-arm64.h
+++ b/deps/v8/src/arm64/assembler-arm64.h
@@ -39,8 +39,8 @@ namespace internal {
 #define ALLOCATABLE_GENERAL_REGISTERS(R)                  \
   R(x0)  R(x1)  R(x2)  R(x3)  R(x4)  R(x5)  R(x6)  R(x7)  \
   R(x8)  R(x9)  R(x10) R(x11) R(x12) R(x13) R(x14) R(x15) \
-  R(x18) R(x19) R(x20) R(x21) R(x22) R(x23) R(x24) R(x27) \
-  R(x28)
+  R(x18) R(x19) R(x20) R(x21) R(x22) R(x23) R(x24) R(x25) \
+  R(x27) R(x28)
 
 #define FLOAT_REGISTERS(V)                                \
   V(s0)  V(s1)  V(s2)  V(s3)  V(s4)  V(s5)  V(s6)  V(s7)  \
@@ -60,6 +60,8 @@ namespace internal {
   V(q16) V(q17) V(q18) V(q19) V(q20) V(q21) V(q22) V(q23) \
   V(q24) V(q25) V(q26) V(q27) V(q28) V(q29) V(q30) V(q31)
 
+// Register d29 could be allocated, but we keep an even length list here, in
+// order to make stack alignment easier for save and restore.
 #define ALLOCATABLE_DOUBLE_REGISTERS(R)                   \
   R(d0)  R(d1)  R(d2)  R(d3)  R(d4)  R(d5)  R(d6)  R(d7)  \
   R(d8)  R(d9)  R(d10) R(d11) R(d12) R(d13) R(d14) R(d16) \
@@ -68,7 +70,6 @@ namespace internal {
 // clang-format on
 
 constexpr int kRegListSizeInBits = sizeof(RegList) * kBitsPerByte;
-static const int kNoCodeAgeSequenceLength = 5 * kInstructionSize;
 
 const int kNumRegs = kNumberOfRegisters;
 // Registers x0-x17 are caller-saved.
@@ -203,7 +204,6 @@ class CPURegister : public RegisterBase<CPURegister, kRegAfterLast> {
 
   bool IsSameSizeAndType(const CPURegister& other) const;
 
-  // V8 compatibility.
   bool is(const CPURegister& other) const { return Is(other); }
   bool is_valid() const { return IsValid(); }
 
@@ -238,8 +238,7 @@ class CPURegister : public RegisterBase<CPURegister, kRegAfterLast> {
   }
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(CPURegister),
-              "CPURegister can efficiently be passed by value");
+ASSERT_TRIVIALLY_COPYABLE(CPURegister);
 
 class Register : public CPURegister {
  public:
@@ -257,25 +256,6 @@ class Register : public CPURegister {
   static Register XRegFromCode(unsigned code);
   static Register WRegFromCode(unsigned code);
 
-  // Start of V8 compatibility section ---------------------
-  // These memebers are necessary for compilation.
-  // A few of them may be unused for now.
-
-  // We allow crankshaft to use the following registers:
-  //   - x0 to x15
-  //   - x18 to x24
-  //   - x27 (also context)
-  //
-  // TODO(all): Register x25 is currently free and could be available for
-  // crankshaft, but we don't use it as we might use it as a per function
-  // literal pool pointer in the future.
-  //
-  // TODO(all): Consider storing cp in x25 to have only two ranges.
-  // We split allocatable registers in three ranges called
-  //   - "low range"
-  //   - "high range"
-  //   - "context"
-
   static Register from_code(int code) {
     // Always return an X register.
     return Register::Create(code, kXRegSizeInBits);
@@ -287,14 +267,11 @@ class Register : public CPURegister {
     return Register::Create<code, kXRegSizeInBits>();
   }
 
-  // End of V8 compatibility section -----------------------
-  //
  private:
   constexpr explicit Register(const CPURegister& r) : CPURegister(r) {}
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(Register),
-              "Register can efficiently be passed by value");
+ASSERT_TRIVIALLY_COPYABLE(Register);
 
 constexpr bool kPadArguments = true;
 constexpr bool kSimpleFPAliasing = true;
@@ -406,19 +383,13 @@ class VRegister : public CPURegister {
 
   unsigned LaneSizeInBits() const { return LaneSizeInBytes() * 8; }
 
-  // Start of V8 compatibility section ---------------------
   static constexpr int kMaxNumRegisters = kNumberOfVRegisters;
   STATIC_ASSERT(kMaxNumRegisters == kDoubleAfterLast);
 
-  // Crankshaft can use all the V registers except:
-  //   - d15 which is used to keep the 0 double value
-  //   - d30 which is used in crankshaft as a double scratch register
-  //   - d31 which is used in the MacroAssembler as a double scratch register
   static VRegister from_code(int code) {
     // Always return a D register.
     return VRegister::Create(code, kDRegSizeInBits);
   }
-  // End of V8 compatibility section -----------------------
 
  private:
   int lane_count_;
@@ -431,8 +402,7 @@ class VRegister : public CPURegister {
   }
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(VRegister),
-              "VRegister can efficiently be passed by value");
+ASSERT_TRIVIALLY_COPYABLE(VRegister);
 
 // No*Reg is used to indicate an unused argument, or an error case. Note that
 // these all compare equal (using the Is() method). The Register and VRegister
@@ -440,8 +410,6 @@ static_assert(IS_TRIVIALLY_COPYABLE(VRegister),
 constexpr Register NoReg = Register::no_reg();
 constexpr VRegister NoVReg = VRegister::no_reg();
 constexpr CPURegister NoCPUReg = CPURegister::no_reg();
-
-// v8 compatibility.
 constexpr Register no_reg = NoReg;
 
 #define DEFINE_REGISTER(register_class, name, ...) \
@@ -455,8 +423,8 @@ constexpr Register no_reg = NoReg;
 GENERAL_REGISTER_CODE_LIST(DEFINE_REGISTERS)
 #undef DEFINE_REGISTERS
 
-DEFINE_REGISTER(Register, wcsp, kSPRegInternalCode, kWRegSizeInBits);
-DEFINE_REGISTER(Register, csp, kSPRegInternalCode, kXRegSizeInBits);
+DEFINE_REGISTER(Register, wsp, kSPRegInternalCode, kWRegSizeInBits);
+DEFINE_REGISTER(Register, sp, kSPRegInternalCode, kXRegSizeInBits);
 
 #define DEFINE_VREGISTERS(N)                            \
   DEFINE_REGISTER(VRegister, b##N, N, kBRegSizeInBits); \
@@ -492,11 +460,9 @@ ALIAS_REGISTER(Register, padreg, x31);
 // Keeps the 0 double value.
 ALIAS_REGISTER(VRegister, fp_zero, d15);
 // MacroAssembler fixed V Registers.
-ALIAS_REGISTER(VRegister, fp_fixed1, d27);
-ALIAS_REGISTER(VRegister, fp_fixed2, d28);
-ALIAS_REGISTER(VRegister, fp_fixed3, d29);  // same as Crankshaft scratch.
-// Crankshaft double scratch register.
-ALIAS_REGISTER(VRegister, crankshaft_fp_scratch, d29);
+ALIAS_REGISTER(VRegister, fp_fixed1, d28);
+ALIAS_REGISTER(VRegister, fp_fixed2, d29);
+
 // MacroAssembler scratch V registers.
 ALIAS_REGISTER(VRegister, fp_scratch, d30);
 ALIAS_REGISTER(VRegister, fp_scratch1, d30);
@@ -994,7 +960,7 @@ class Assembler : public AssemblerBase {
   // The isolate argument is unused (and may be nullptr) when skipping flushing.
   inline static Address target_address_at(Address pc, Address constant_pool);
   inline static void set_target_address_at(
-      Isolate* isolate, Address pc, Address constant_pool, Address target,
+      Address pc, Address constant_pool, Address target,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
   // Return the code target address at a call site from the return address of
@@ -1008,12 +974,11 @@ class Assembler : public AssemblerBase {
   // This sets the branch destination (which is in the constant pool on ARM).
   // This is for calls and branches within generated code.
   inline static void deserialization_set_special_target_at(
-      Isolate* isolate, Address constant_pool_entry, Code* code,
-      Address target);
+      Address constant_pool_entry, Code* code, Address target);
 
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
-      Isolate* isolate, Address pc, Address target,
+      Address pc, Address target,
       RelocInfo::Mode mode = RelocInfo::INTERNAL_REFERENCE);
 
   // All addresses in the constant pool are the same size as pointers.
@@ -1754,6 +1719,9 @@ class Assembler : public AssemblerBase {
   // Instruction synchronization barrier
   void isb();
 
+  // Conditional speculation barrier.
+  void csdb();
+
   // Alias for system instructions.
   void nop() { hint(NOP); }
 
@@ -3677,18 +3645,9 @@ class PatchingAssembler : public Assembler {
   // If more or fewer instructions than expected are generated or if some
   // relocation information takes space in the buffer, the PatchingAssembler
   // will crash trying to grow the buffer.
-
-  // This version will flush at destruction.
-  PatchingAssembler(Isolate* isolate, byte* start, unsigned count)
-      : PatchingAssembler(IsolateData(isolate), start, count) {
-    CHECK_NOT_NULL(isolate);
-    isolate_ = isolate;
-  }
-
-  // This version will not flush.
+  // Note that the instruction cache will not be flushed.
   PatchingAssembler(IsolateData isolate_data, byte* start, unsigned count)
-      : Assembler(isolate_data, start, count * kInstructionSize + kGap),
-        isolate_(nullptr) {
+      : Assembler(isolate_data, start, count * kInstructionSize + kGap) {
     // Block constant pool emission.
     StartBlockPools();
   }
@@ -3701,18 +3660,12 @@ class PatchingAssembler : public Assembler {
     DCHECK((pc_offset() + kGap) == buffer_size_);
     // Verify no relocation information has been emitted.
     DCHECK(IsConstPoolEmpty());
-    // Flush the Instruction cache.
-    size_t length = buffer_size_ - kGap;
-    if (isolate_ != nullptr) Assembler::FlushICache(isolate_, buffer_, length);
   }
 
   // See definition of PatchAdrFar() for details.
   static constexpr int kAdrFarPatchableNNops = 2;
   static constexpr int kAdrFarPatchableNInstrs = kAdrFarPatchableNNops + 2;
   void PatchAdrFar(int64_t target_offset);
-
- private:
-  Isolate* isolate_;
 };
 
 
diff --git a/deps/v8/src/arm64/code-stubs-arm64.cc b/deps/v8/src/arm64/code-stubs-arm64.cc
index 52f92b6af9a..07d020880dc 100644
--- a/deps/v8/src/arm64/code-stubs-arm64.cc
+++ b/deps/v8/src/arm64/code-stubs-arm64.cc
@@ -30,7 +30,7 @@ namespace internal {
 
 void ArrayNArgumentsConstructorStub::Generate(MacroAssembler* masm) {
   __ Mov(x5, Operand(x0, LSL, kPointerSizeLog2));
-  __ Str(x1, MemOperand(__ StackPointer(), x5));
+  __ Poke(x1, Operand(x5));
   __ Push(x1, x2);
   __ Add(x0, x0, Operand(3));
   __ TailCallRuntime(Runtime::kNewArray);
@@ -314,7 +314,6 @@ void CEntryStub::Generate(MacroAssembler* masm) {
   __ EnterExitFrame(
       save_doubles(), x10, extra_stack_space,
       is_builtin_exit() ? StackFrame::BUILTIN_EXIT : StackFrame::EXIT);
-  DCHECK(csp.Is(__ StackPointer()));
 
   // Poke callee-saved registers into reserved space.
   __ Poke(argv, 1 * kPointerSize);
@@ -349,12 +348,12 @@ void CEntryStub::Generate(MacroAssembler* masm) {
   //   fp -> fp[0]:    CallerFP (old fp)
   //         fp[-8]:   Space reserved for SPOffset.
   //         fp[-16]:  CodeObject()
-  //         csp[...]: Saved doubles, if saved_doubles is true.
-  //         csp[32]:  Alignment padding, if necessary.
-  //         csp[24]:  Preserved x23 (used for target).
-  //         csp[16]:  Preserved x22 (used for argc).
-  //         csp[8]:   Preserved x21 (used for argv).
-  //  csp -> csp[0]:   Space reserved for the return address.
+  //         sp[...]:  Saved doubles, if saved_doubles is true.
+  //         sp[32]:   Alignment padding, if necessary.
+  //         sp[24]:   Preserved x23 (used for target).
+  //         sp[16]:   Preserved x22 (used for argc).
+  //         sp[8]:    Preserved x21 (used for argv).
+  //   sp -> sp[0]:    Space reserved for the return address.
   //
   // After a successful call, the exit frame, preserved registers (x21-x23) and
   // the arguments (including the receiver) are dropped or popped as
@@ -364,8 +363,6 @@ void CEntryStub::Generate(MacroAssembler* masm) {
   // untouched, and the stub either throws an exception by jumping to one of
   // the exception_returned label.
 
-  DCHECK(csp.Is(__ StackPointer()));
-
   // Prepare AAPCS64 arguments to pass to the builtin.
   __ Mov(x0, argc);
   __ Mov(x1, argv);
@@ -437,7 +434,6 @@ void CEntryStub::Generate(MacroAssembler* masm) {
   // contain the current pending exception, don't clobber it.
   ExternalReference find_handler(Runtime::kUnwindAndFindExceptionHandler,
                                  isolate());
-  DCHECK(csp.Is(masm->StackPointer()));
   {
     FrameScope scope(masm, StackFrame::MANUAL);
     __ Mov(x0, 0);  // argc.
@@ -454,7 +450,7 @@ void CEntryStub::Generate(MacroAssembler* masm) {
     Register scratch = temps.AcquireX();
     __ Mov(scratch, Operand(pending_handler_sp_address));
     __ Ldr(scratch, MemOperand(scratch));
-    __ Mov(csp, scratch);
+    __ Mov(sp, scratch);
   }
   __ Mov(fp, Operand(pending_handler_fp_address));
   __ Ldr(fp, MemOperand(fp));
@@ -466,6 +462,12 @@ void CEntryStub::Generate(MacroAssembler* masm) {
   __ Str(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
   __ Bind(&not_js_frame);
 
+  // Reset the masking register. This is done independent of the underlying
+  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
+  // both configurations. It is safe to always do this, because the underlying
+  // register is caller-saved and can be arbitrarily clobbered.
+  __ ResetSpeculationPoisonRegister();
+
   // Compute the handler entry address and jump to it.
   __ Mov(x10, Operand(pending_handler_entrypoint_address));
   __ Ldr(x10, MemOperand(x10));
@@ -511,7 +513,7 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
 
   __ Push(x13, x12, xzr, x10);
   // Set up fp.
-  __ Sub(fp, __ StackPointer(), EntryFrameConstants::kCallerFPOffset);
+  __ Sub(fp, sp, EntryFrameConstants::kCallerFPOffset);
 
   // Push the JS entry frame marker. Also set js_entry_sp if this is the
   // outermost JS call.
@@ -582,7 +584,7 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   {
     UseScratchRegisterScope temps(masm);
     Register scratch = temps.AcquireX();
-    __ Mov(scratch, __ StackPointer());
+    __ Mov(scratch, sp);
     __ Str(scratch, MemOperand(x11));
   }
 
@@ -740,10 +742,6 @@ void DirectCEntryStub::Generate(MacroAssembler* masm) {
 
 void DirectCEntryStub::GenerateCall(MacroAssembler* masm,
                                     Register target) {
-  // Make sure the caller configured the stack pointer (see comment in
-  // DirectCEntryStub::Generate).
-  DCHECK(csp.Is(__ StackPointer()));
-
   intptr_t code =
       reinterpret_cast<intptr_t>(GetCode().location());
   __ Mov(lr, Operand(code, RelocInfo::CODE_TARGET));
@@ -1260,7 +1258,7 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
 
   // Prepare arguments.
   Register args = x6;
-  __ Mov(args, masm->StackPointer());
+  __ Mov(args, sp);
 
   // Allocate the v8::Arguments structure in the arguments' space, since it's
   // not controlled by GC.
@@ -1344,7 +1342,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
                 "slots must be a multiple of 2 for stack pointer alignment");
 
   // Load address of v8::PropertyAccessorInfo::args_ array and name handle.
-  __ Mov(x0, masm->StackPointer());  // x0 = Handle<Name>
+  __ Mov(x0, sp);                    // x0 = Handle<Name>
   __ Add(x1, x0, 1 * kPointerSize);  // x1 = v8::PCI::args_
 
   const int kApiStackSpace = 1;
diff --git a/deps/v8/src/arm64/codegen-arm64.cc b/deps/v8/src/arm64/codegen-arm64.cc
index 1016e3707ac..ad770332800 100644
--- a/deps/v8/src/arm64/codegen-arm64.cc
+++ b/deps/v8/src/arm64/codegen-arm64.cc
@@ -8,6 +8,7 @@
 #include "src/arm64/macro-assembler-arm64-inl.h"
 #include "src/arm64/simulator-arm64.h"
 #include "src/codegen.h"
+#include "src/isolate.h"
 #include "src/macro-assembler.h"
 
 namespace v8 {
diff --git a/deps/v8/src/arm64/constants-arm64.h b/deps/v8/src/arm64/constants-arm64.h
index b02dd5d2d79..406b139a504 100644
--- a/deps/v8/src/arm64/constants-arm64.h
+++ b/deps/v8/src/arm64/constants-arm64.h
@@ -407,12 +407,13 @@ enum Extend {
 };
 
 enum SystemHint {
-  NOP   = 0,
+  NOP = 0,
   YIELD = 1,
-  WFE   = 2,
-  WFI   = 3,
-  SEV   = 4,
-  SEVL  = 5
+  WFE = 2,
+  WFI = 3,
+  SEV = 4,
+  SEVL = 5,
+  CSDB = 20
 };
 
 enum BarrierDomain {
diff --git a/deps/v8/src/arm64/decoder-arm64-inl.h b/deps/v8/src/arm64/decoder-arm64-inl.h
index 55a09dc1c56..201dfaa4231 100644
--- a/deps/v8/src/arm64/decoder-arm64-inl.h
+++ b/deps/v8/src/arm64/decoder-arm64-inl.h
@@ -168,11 +168,6 @@ void Decoder<V>::DecodeBranchSystemException(Instruction* instr) {
                 (instr->Mask(0x0039E000) == 0x00002000) ||
                 (instr->Mask(0x003AE000) == 0x00002000) ||
                 (instr->Mask(0x003CE000) == 0x00042000) ||
-                (instr->Mask(0x003FFFC0) == 0x000320C0) ||
-                (instr->Mask(0x003FF100) == 0x00032100) ||
-                (instr->Mask(0x003FF200) == 0x00032200) ||
-                (instr->Mask(0x003FF400) == 0x00032400) ||
-                (instr->Mask(0x003FF800) == 0x00032800) ||
                 (instr->Mask(0x0038F000) == 0x00005000) ||
                 (instr->Mask(0x0038E000) == 0x00006000)) {
               V::VisitUnallocated(instr);
@@ -467,6 +462,7 @@ void Decoder<V>::DecodeDataProcessing(Instruction* instr) {
             }
             break;
           }
+          V8_FALLTHROUGH;
         }
         case 1:
         case 3:
diff --git a/deps/v8/src/arm64/deoptimizer-arm64.cc b/deps/v8/src/arm64/deoptimizer-arm64.cc
index 8269e8e50a3..a81621b6a9a 100644
--- a/deps/v8/src/arm64/deoptimizer-arm64.cc
+++ b/deps/v8/src/arm64/deoptimizer-arm64.cc
@@ -33,7 +33,7 @@ void CopyRegListToFrame(MacroAssembler* masm, const Register& dst,
   // up a temp with an offset for accesses out of the range of the addressing
   // mode.
   Register src = temps.AcquireX();
-  masm->Add(src, masm->StackPointer(), src_offset);
+  masm->Add(src, sp, src_offset);
   masm->Add(dst, dst, dst_offset);
 
   // Write reg_list into the frame pointed to by dst.
@@ -140,8 +140,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   __ Mov(code_object, lr);
   // Compute the fp-to-sp delta, adding two words for alignment padding and
   // bailout id.
-  __ Add(fp_to_sp, __ StackPointer(),
-         kSavedRegistersAreaSize + (2 * kPointerSize));
+  __ Add(fp_to_sp, sp, kSavedRegistersAreaSize + (2 * kPointerSize));
   __ Sub(fp_to_sp, fp, fp_to_sp);
 
   // Allocate a new deoptimizer object.
@@ -222,7 +221,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
     UseScratchRegisterScope temps(masm());
     Register scratch = temps.AcquireX();
     __ Ldr(scratch, MemOperand(x4, Deoptimizer::caller_frame_top_offset()));
-    __ Mov(__ StackPointer(), scratch);
+    __ Mov(sp, scratch);
   }
 
   // Replace the current (input) frame with the output frames.
diff --git a/deps/v8/src/arm64/disasm-arm64.cc b/deps/v8/src/arm64/disasm-arm64.cc
index 41c654b214d..d344903d59d 100644
--- a/deps/v8/src/arm64/disasm-arm64.cc
+++ b/deps/v8/src/arm64/disasm-arm64.cc
@@ -968,7 +968,7 @@ void DisassemblingDecoder::VisitFPCompare(Instruction* instr) {
 
   switch (instr->Mask(FPCompareMask)) {
     case FCMP_s_zero:
-    case FCMP_d_zero: form = form_zero;  // Fall through.
+    case FCMP_d_zero: form = form_zero; V8_FALLTHROUGH;
     case FCMP_s:
     case FCMP_d: mnemonic = "fcmp"; break;
     default: form = "(FPCompare)";
@@ -1246,6 +1246,11 @@ void DisassemblingDecoder::VisitSystem(Instruction* instr) {
         form = nullptr;
         break;
       }
+      case CSDB: {
+        mnemonic = "csdb";
+        form = nullptr;
+        break;
+      }
     }
   } else if (instr->Mask(MemBarrierFMask) == MemBarrierFixed) {
     switch (instr->Mask(MemBarrierMask)) {
@@ -3327,7 +3332,7 @@ void DisassemblingDecoder::AppendRegisterNameToOutput(const CPURegister& reg) {
     }
   }
 
-  if (reg.IsVRegister() || !(reg.Aliases(csp) || reg.Aliases(xzr))) {
+  if (reg.IsVRegister() || !(reg.Aliases(sp) || reg.Aliases(xzr))) {
     // Filter special registers
     if (reg.IsX() && (reg.code() == 27)) {
       AppendToOutput("cp");
@@ -3339,9 +3344,9 @@ void DisassemblingDecoder::AppendRegisterNameToOutput(const CPURegister& reg) {
       // A core or scalar/vector register: [wx]0 - 30, [bhsdq]0 - 31.
       AppendToOutput("%c%d", reg_char, reg.code());
     }
-  } else if (reg.Aliases(csp)) {
-    // Disassemble w31/x31 as stack pointer wcsp/csp.
-    AppendToOutput("%s", reg.Is64Bits() ? "csp" : "wcsp");
+  } else if (reg.Aliases(sp)) {
+    // Disassemble w31/x31 as stack pointer wsp/sp.
+    AppendToOutput("%s", reg.Is64Bits() ? "sp" : "wsp");
   } else {
     // Disassemble w31/x31 as zero register wzr/xzr.
     AppendToOutput("%czr", reg_char);
@@ -3713,6 +3718,8 @@ int DisassemblingDecoder::SubstituteImmediateField(Instruction* instr,
             }
             return 0;
           }
+          UNIMPLEMENTED();
+          return 0;
         }
         case 'L': {  // IVLSLane[0123] - suffix indicates access size shift.
           AppendToOutput("%d", instr->NEONLSIndex(format[8] - '0'));
@@ -3836,7 +3843,8 @@ int DisassemblingDecoder::SubstituteShiftField(Instruction* instr,
   switch (format[1]) {
     case 'D': {  // NDP.
       DCHECK(instr->ShiftDP() != ROR);
-    }  // Fall through.
+      V8_FALLTHROUGH;
+    }
     case 'L': {  // NLo.
       if (instr->ImmDPShift() != 0) {
         const char* shift_type[] = {"lsl", "lsr", "asr", "ror"};
diff --git a/deps/v8/src/arm64/disasm-arm64.h b/deps/v8/src/arm64/disasm-arm64.h
index c12d53b7e60..0edb2ea5834 100644
--- a/deps/v8/src/arm64/disasm-arm64.h
+++ b/deps/v8/src/arm64/disasm-arm64.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_ARM64_DISASM_ARM64_H
-#define V8_ARM64_DISASM_ARM64_H
+#ifndef V8_ARM64_DISASM_ARM64_H_
+#define V8_ARM64_DISASM_ARM64_H_
 
 #include "src/arm64/assembler-arm64.h"
 #include "src/arm64/decoder-arm64.h"
@@ -96,4 +96,4 @@ class PrintDisassembler : public DisassemblingDecoder {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_ARM64_DISASM_ARM64_H
+#endif  // V8_ARM64_DISASM_ARM64_H_
diff --git a/deps/v8/src/arm64/eh-frame-arm64.cc b/deps/v8/src/arm64/eh-frame-arm64.cc
index 48909d5b2d8..79d8510f9b7 100644
--- a/deps/v8/src/arm64/eh-frame-arm64.cc
+++ b/deps/v8/src/arm64/eh-frame-arm64.cc
@@ -11,7 +11,7 @@ namespace internal {
 static const int kX0DwarfCode = 0;
 static const int kFpDwarfCode = 29;
 static const int kLrDwarfCode = 30;
-static const int kCSpDwarfCode = 31;
+static const int kSpDwarfCode = 31;
 
 const int EhFrameConstants::kCodeAlignmentFactor = 4;
 const int EhFrameConstants::kDataAlignmentFactor = -8;
@@ -33,7 +33,7 @@ int EhFrameWriter::RegisterToDwarfCode(Register name) {
     case kRegCode_x30:
       return kLrDwarfCode;
     case kSPRegInternalCode:
-      return kCSpDwarfCode;
+      return kSpDwarfCode;
     case kRegCode_x0:
       return kX0DwarfCode;
     default:
@@ -51,8 +51,8 @@ const char* EhFrameDisassembler::DwarfRegisterCodeToString(int code) {
       return "fp";
     case kLrDwarfCode:
       return "lr";
-    case kCSpDwarfCode:
-      return "csp";  // This could be zr as well
+    case kSpDwarfCode:
+      return "sp";  // This could be zr as well
     default:
       UNIMPLEMENTED();
       return nullptr;
diff --git a/deps/v8/src/arm64/frame-constants-arm64.h b/deps/v8/src/arm64/frame-constants-arm64.h
index a3370797868..00ac99d1be8 100644
--- a/deps/v8/src/arm64/frame-constants-arm64.h
+++ b/deps/v8/src/arm64/frame-constants-arm64.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_ARM64_FRAMES_ARM64_H_
-#define V8_ARM64_FRAMES_ARM64_H_
+#ifndef V8_ARM64_FRAME_CONSTANTS_ARM64_H_
+#define V8_ARM64_FRAME_CONSTANTS_ARM64_H_
 
 namespace v8 {
 namespace internal {
@@ -61,4 +61,4 @@ class JavaScriptFrameConstants : public AllStatic {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_ARM64_FRAMES_ARM64_H_
+#endif  // V8_ARM64_FRAME_CONSTANTS_ARM64_H_
diff --git a/deps/v8/src/arm64/instructions-arm64.h b/deps/v8/src/arm64/instructions-arm64.h
index 0cc3e803d07..499023ebb2b 100644
--- a/deps/v8/src/arm64/instructions-arm64.h
+++ b/deps/v8/src/arm64/instructions-arm64.h
@@ -258,7 +258,7 @@ class Instruction {
   // Indicate whether Rd can be the stack pointer or the zero register. This
   // does not check that the instruction actually has an Rd field.
   Reg31Mode RdMode() const {
-    // The following instructions use csp or wsp as Rd:
+    // The following instructions use sp or wsp as Rd:
     //  Add/sub (immediate) when not setting the flags.
     //  Add/sub (extended) when not setting the flags.
     //  Logical (immediate) when not setting the flags.
@@ -272,7 +272,7 @@ class Instruction {
     }
     if (IsLogicalImmediate()) {
       // Of the logical (immediate) instructions, only ANDS (and its aliases)
-      // can set the flags. The others can all write into csp.
+      // can set the flags. The others can all write into sp.
       // Note that some logical operations are not available to
       // immediate-operand instructions, so we have to combine two masks here.
       if (Mask(LogicalImmediateMask & LogicalOpMask) == ANDS) {
@@ -287,7 +287,7 @@ class Instruction {
   // Indicate whether Rn can be the stack pointer or the zero register. This
   // does not check that the instruction actually has an Rn field.
   Reg31Mode RnMode() const {
-    // The following instructions use csp or wsp as Rn:
+    // The following instructions use sp or wsp as Rn:
     //  All loads and stores.
     //  Add/sub (immediate).
     //  Add/sub (extended).
diff --git a/deps/v8/src/arm64/instrument-arm64.cc b/deps/v8/src/arm64/instrument-arm64.cc
index 8e9cce71973..f9550782c13 100644
--- a/deps/v8/src/arm64/instrument-arm64.cc
+++ b/deps/v8/src/arm64/instrument-arm64.cc
@@ -91,7 +91,6 @@ static const CounterDescriptor kCounterList[] = {
 
     {"PC Addressing", Gauge},
     {"Other", Gauge},
-    {"SP Adjust", Gauge},
 };
 
 Instrument::Instrument(const char* datafile, uint64_t sample_period)
@@ -238,16 +237,8 @@ void Instrument::VisitPCRelAddressing(Instruction* instr) {
 
 void Instrument::VisitAddSubImmediate(Instruction* instr) {
   Update();
-  static Counter* sp_counter = GetCounter("SP Adjust");
-  static Counter* add_sub_counter = GetCounter("Add/Sub DP");
-  if (((instr->Mask(AddSubOpMask) == SUB) ||
-       (instr->Mask(AddSubOpMask) == ADD)) &&
-      (instr->Rd() == 31) && (instr->Rn() == 31)) {
-    // Count adjustments to the C stack pointer caused by V8 needing two SPs.
-    sp_counter->Increment();
-  } else {
-    add_sub_counter->Increment();
-  }
+  static Counter* counter = GetCounter("Add/Sub DP");
+  counter->Increment();
 }
 
 
@@ -470,16 +461,8 @@ void Instrument::VisitAddSubShifted(Instruction* instr) {
 
 void Instrument::VisitAddSubExtended(Instruction* instr) {
   Update();
-  static Counter* sp_counter = GetCounter("SP Adjust");
-  static Counter* add_sub_counter = GetCounter("Add/Sub DP");
-  if (((instr->Mask(AddSubOpMask) == SUB) ||
-       (instr->Mask(AddSubOpMask) == ADD)) &&
-      (instr->Rd() == 31) && (instr->Rn() == 31)) {
-    // Count adjustments to the C stack pointer caused by V8 needing two SPs.
-    sp_counter->Increment();
-  } else {
-    add_sub_counter->Increment();
-  }
+  static Counter* counter = GetCounter("Add/Sub DP");
+  counter->Increment();
 }
 
 
diff --git a/deps/v8/src/arm64/interface-descriptors-arm64.cc b/deps/v8/src/arm64/interface-descriptors-arm64.cc
index 17b058bd013..bcbe5d97dce 100644
--- a/deps/v8/src/arm64/interface-descriptors-arm64.cc
+++ b/deps/v8/src/arm64/interface-descriptors-arm64.cc
@@ -69,15 +69,6 @@ const Register GrowArrayElementsDescriptor::ObjectRegister() { return x0; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return x3; }
 
 
-void FastNewClosureDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // x1: function info
-  // x2: feedback vector
-  // x3: slot
-  Register registers[] = {x1, x2, x3};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
 // static
 const Register TypeConversionDescriptor::ArgumentRegister() { return x0; }
 
diff --git a/deps/v8/src/arm64/macro-assembler-arm64-inl.h b/deps/v8/src/arm64/macro-assembler-arm64-inl.h
index 0861551d897..f96d4b20b82 100644
--- a/deps/v8/src/arm64/macro-assembler-arm64-inl.h
+++ b/deps/v8/src/arm64/macro-assembler-arm64-inl.h
@@ -404,8 +404,7 @@ void MacroAssembler::CzeroX(const Register& rd,
 
 // Conditionally move a value into the destination register. Only X registers
 // are supported due to the truncation side-effect when used on W registers.
-void MacroAssembler::CmovX(const Register& rd,
-                           const Register& rn,
+void TurboAssembler::CmovX(const Register& rd, const Register& rn,
                            Condition cond) {
   DCHECK(allow_macro_instructions());
   DCHECK(!rd.IsSP());
@@ -416,6 +415,11 @@ void MacroAssembler::CmovX(const Register& rd,
   }
 }
 
+void TurboAssembler::Csdb() {
+  DCHECK(allow_macro_instructions());
+  csdb();
+}
+
 void TurboAssembler::Cset(const Register& rd, Condition cond) {
   DCHECK(allow_macro_instructions());
   DCHECK(!rd.IsZero());
@@ -423,8 +427,7 @@ void TurboAssembler::Cset(const Register& rd, Condition cond) {
   cset(rd, cond);
 }
 
-
-void MacroAssembler::Csetm(const Register& rd, Condition cond) {
+void TurboAssembler::Csetm(const Register& rd, Condition cond) {
   DCHECK(allow_macro_instructions());
   DCHECK(!rd.IsZero());
   DCHECK((cond != al) && (cond != nv));
@@ -461,14 +464,12 @@ void MacroAssembler::Csneg(const Register& rd,
   csneg(rd, rn, rm, cond);
 }
 
-
-void MacroAssembler::Dmb(BarrierDomain domain, BarrierType type) {
+void TurboAssembler::Dmb(BarrierDomain domain, BarrierType type) {
   DCHECK(allow_macro_instructions());
   dmb(domain, type);
 }
 
-
-void MacroAssembler::Dsb(BarrierDomain domain, BarrierType type) {
+void TurboAssembler::Dsb(BarrierDomain domain, BarrierType type) {
   DCHECK(allow_macro_instructions());
   dsb(domain, type);
 }
@@ -651,10 +652,12 @@ void TurboAssembler::Fmov(VRegister vd, double imm) {
       if (bits == 0) {
         fmov(vd, xzr);
       } else {
-        Ldr(vd, imm);
+        UseScratchRegisterScope temps(this);
+        Register tmp = temps.AcquireX();
+        Mov(tmp, bits);
+        fmov(vd, tmp);
       }
     } else {
-      // TODO(all): consider NEON support for load literal.
       Movi(vd, bits);
     }
   }
@@ -678,12 +681,10 @@ void TurboAssembler::Fmov(VRegister vd, float imm) {
       } else {
         UseScratchRegisterScope temps(this);
         Register tmp = temps.AcquireW();
-        // TODO(all): Use Assembler::ldr(const VRegister& ft, float imm).
         Mov(tmp, bit_cast<uint32_t>(imm));
         Fmov(vd, tmp);
       }
     } else {
-      // TODO(all): consider NEON support for load literal.
       Movi(vd, bits);
     }
   }
@@ -737,8 +738,7 @@ void MacroAssembler::Hlt(int code) {
   hlt(code);
 }
 
-
-void MacroAssembler::Isb() {
+void TurboAssembler::Isb() {
   DCHECK(allow_macro_instructions());
   isb();
 }
@@ -748,12 +748,6 @@ void TurboAssembler::Ldr(const CPURegister& rt, const Operand& operand) {
   ldr(rt, operand);
 }
 
-void TurboAssembler::Ldr(const CPURegister& rt, double imm) {
-  DCHECK(allow_macro_instructions());
-  DCHECK(rt.Is64Bits());
-  ldr(rt, Immediate(bit_cast<uint64_t>(imm)));
-}
-
 void TurboAssembler::Lsl(const Register& rd, const Register& rn,
                          unsigned shift) {
   DCHECK(allow_macro_instructions());
@@ -1042,58 +1036,6 @@ void TurboAssembler::Uxtw(const Register& rd, const Register& rn) {
   uxtw(rd, rn);
 }
 
-void MacroAssembler::AlignAndSetCSPForFrame() {
-  int sp_alignment = ActivationFrameAlignment();
-  // AAPCS64 mandates at least 16-byte alignment.
-  DCHECK_GE(sp_alignment, 16);
-  DCHECK(base::bits::IsPowerOfTwo(sp_alignment));
-  Bic(csp, StackPointer(), sp_alignment - 1);
-}
-
-void TurboAssembler::BumpSystemStackPointer(const Operand& space) {
-  DCHECK(!csp.Is(StackPointer()));
-  if (!TmpList()->IsEmpty()) {
-    Sub(csp, StackPointer(), space);
-  } else {
-    // TODO(jbramley): Several callers rely on this not using scratch
-    // registers, so we use the assembler directly here. However, this means
-    // that large immediate values of 'space' cannot be handled cleanly. (Only
-    // 24-bits immediates or values of 'space' that can be encoded in one
-    // instruction are accepted.) Once we implement our flexible scratch
-    // register idea, we could greatly simplify this function.
-    InstructionAccurateScope scope(this);
-    DCHECK(space.IsImmediate());
-    // Align to 16 bytes.
-    uint64_t imm = RoundUp(space.ImmediateValue(), 0x10);
-    DCHECK(is_uint24(imm));
-
-    Register source = StackPointer();
-    if (CpuFeatures::IsSupported(ALWAYS_ALIGN_CSP)) {
-      bic(csp, source, 0xf);
-      source = csp;
-    }
-    if (!is_uint12(imm)) {
-      int64_t imm_top_12_bits = imm >> 12;
-      sub(csp, source, imm_top_12_bits << 12);
-      source = csp;
-      imm -= imm_top_12_bits << 12;
-    }
-    if (imm > 0) {
-      sub(csp, source, imm);
-    }
-  }
-  AssertStackConsistency();
-}
-
-void TurboAssembler::SyncSystemStackPointer() {
-  DCHECK(emit_debug_code());
-  DCHECK(!csp.Is(StackPointer()));
-  { InstructionAccurateScope scope(this);
-    mov(csp, StackPointer());
-  }
-  AssertStackConsistency();
-}
-
 void TurboAssembler::InitializeRootRegister() {
   ExternalReference roots_array_start =
       ExternalReference::roots_array_start(isolate());
@@ -1249,14 +1191,9 @@ void TurboAssembler::Claim(int64_t count, uint64_t unit_size) {
   if (size == 0) {
     return;
   }
+  DCHECK_EQ(size % 16, 0);
 
-  if (csp.Is(StackPointer())) {
-    DCHECK_EQ(size % 16, 0);
-  } else {
-    BumpSystemStackPointer(size);
-  }
-
-  Sub(StackPointer(), StackPointer(), size);
+  Sub(sp, sp, size);
 }
 
 void TurboAssembler::Claim(const Register& count, uint64_t unit_size) {
@@ -1269,13 +1206,9 @@ void TurboAssembler::Claim(const Register& count, uint64_t unit_size) {
   if (size.IsZero()) {
     return;
   }
-
   AssertPositiveOrZero(count);
-  if (!csp.Is(StackPointer())) {
-    BumpSystemStackPointer(size);
-  }
 
-  Sub(StackPointer(), StackPointer(), size);
+  Sub(sp, sp, size);
 }
 
 
@@ -1290,11 +1223,7 @@ void MacroAssembler::ClaimBySMI(const Register& count_smi, uint64_t unit_size) {
     return;
   }
 
-  if (!csp.Is(StackPointer())) {
-    BumpSystemStackPointer(size);
-  }
-
-  Sub(StackPointer(), StackPointer(), size);
+  Sub(sp, sp, size);
 }
 
 void TurboAssembler::Drop(int64_t count, uint64_t unit_size) {
@@ -1305,16 +1234,8 @@ void TurboAssembler::Drop(int64_t count, uint64_t unit_size) {
     return;
   }
 
-  Add(StackPointer(), StackPointer(), size);
-
-  if (csp.Is(StackPointer())) {
-    DCHECK_EQ(size % 16, 0);
-  } else if (emit_debug_code()) {
-    // It is safe to leave csp where it is when unwinding the JavaScript stack,
-    // but if we keep it matching StackPointer, the simulator can detect memory
-    // accesses in the now-free part of the stack.
-    SyncSystemStackPointer();
-  }
+  Add(sp, sp, size);
+  DCHECK_EQ(size % 16, 0);
 }
 
 void TurboAssembler::Drop(const Register& count, uint64_t unit_size) {
@@ -1329,14 +1250,7 @@ void TurboAssembler::Drop(const Register& count, uint64_t unit_size) {
   }
 
   AssertPositiveOrZero(count);
-  Add(StackPointer(), StackPointer(), size);
-
-  if (!csp.Is(StackPointer()) && emit_debug_code()) {
-    // It is safe to leave csp where it is when unwinding the JavaScript stack,
-    // but if we keep it matching StackPointer, the simulator can detect memory
-    // accesses in the now-free part of the stack.
-    SyncSystemStackPointer();
-  }
+  Add(sp, sp, size);
 }
 
 void TurboAssembler::DropArguments(const Register& count,
@@ -1378,14 +1292,7 @@ void MacroAssembler::DropBySMI(const Register& count_smi, uint64_t unit_size) {
     return;
   }
 
-  Add(StackPointer(), StackPointer(), size);
-
-  if (!csp.Is(StackPointer()) && emit_debug_code()) {
-    // It is safe to leave csp where it is when unwinding the JavaScript stack,
-    // but if we keep it matching StackPointer, the simulator can detect memory
-    // accesses in the now-free part of the stack.
-    SyncSystemStackPointer();
-  }
+  Add(sp, sp, size);
 }
 
 
diff --git a/deps/v8/src/arm64/macro-assembler-arm64.cc b/deps/v8/src/arm64/macro-assembler-arm64.cc
index 3869046f749..5bbf71e28cf 100644
--- a/deps/v8/src/arm64/macro-assembler-arm64.cc
+++ b/deps/v8/src/arm64/macro-assembler-arm64.cc
@@ -15,6 +15,7 @@
 #include "src/frame-constants.h"
 #include "src/frames-inl.h"
 #include "src/heap/heap-inl.h"
+#include "src/instruction-stream.h"
 #include "src/register-configuration.h"
 #include "src/runtime/runtime.h"
 
@@ -188,15 +189,14 @@ void TurboAssembler::LogicalMacro(const Register& rd, const Register& rn,
 
       // If the left-hand input is the stack pointer, we can't pre-shift the
       // immediate, as the encoding won't allow the subsequent post shift.
-      PreShiftImmMode mode = rn.Is(csp) ? kNoShift : kAnyShift;
+      PreShiftImmMode mode = rn.Is(sp) ? kNoShift : kAnyShift;
       Operand imm_operand = MoveImmediateForShiftedOp(temp, immediate, mode);
 
-      if (rd.Is(csp)) {
+      if (rd.IsSP()) {
         // If rd is the stack pointer we cannot use it as the destination
         // register so we use the temp register as an intermediate again.
         Logical(temp, rn, imm_operand, op);
-        Mov(csp, temp);
-        AssertStackConsistency();
+        Mov(sp, temp);
       } else {
         Logical(rd, rn, imm_operand, op);
       }
@@ -294,7 +294,6 @@ void TurboAssembler::Mov(const Register& rd, uint64_t imm) {
     // pointer.
     if (rd.IsSP()) {
       mov(rd, temp);
-      AssertStackConsistency();
     }
   }
 }
@@ -337,7 +336,7 @@ void TurboAssembler::Mov(const Register& rd, const Operand& operand,
     // registers is not required to clear the top word of the X register. In
     // this case, the instruction is discarded.
     //
-    // If csp is an operand, add #0 is emitted, otherwise, orr #0.
+    // If sp is an operand, add #0 is emitted, otherwise, orr #0.
     if (!rd.Is(operand.reg()) || (rd.Is32Bits() &&
                                   (discard_mode == kDontDiscardForSameWReg))) {
       Assembler::mov(rd, operand.reg());
@@ -596,11 +595,8 @@ void TurboAssembler::ConditionalCompareMacro(const Register& rn,
   }
 }
 
-
-void MacroAssembler::Csel(const Register& rd,
-                          const Register& rn,
-                          const Operand& operand,
-                          Condition cond) {
+void TurboAssembler::Csel(const Register& rd, const Register& rn,
+                          const Operand& operand, Condition cond) {
   DCHECK(allow_macro_instructions());
   DCHECK(!rd.IsZero());
   DCHECK((cond != al) && (cond != nv));
@@ -724,11 +720,11 @@ void TurboAssembler::AddSubMacro(const Register& rd, const Register& rn,
       // If the destination or source register is the stack pointer, we can
       // only pre-shift the immediate right by values supported in the add/sub
       // extend encoding.
-      if (rd.Is(csp)) {
+      if (rd.Is(sp)) {
         // If the destination is SP and flags will be set, we can't pre-shift
         // the immediate at all.
         mode = (S == SetFlags) ? kNoShift : kLimitShiftForSP;
-      } else if (rn.Is(csp)) {
+      } else if (rn.Is(sp)) {
         mode = kLimitShiftForSP;
       }
 
@@ -1105,9 +1101,9 @@ void TurboAssembler::Push(const Register& src0, const VRegister& src1) {
 
   PushPreamble(size);
   // Reserve room for src0 and push src1.
-  str(src1, MemOperand(StackPointer(), -size, PreIndex));
+  str(src1, MemOperand(sp, -size, PreIndex));
   // Fill the gap with src0.
-  str(src0, MemOperand(StackPointer(), src1.SizeInBytes()));
+  str(src0, MemOperand(sp, src1.SizeInBytes()));
 }
 
 
@@ -1166,9 +1162,7 @@ void TurboAssembler::PushCPURegList(CPURegList registers) {
   int size = registers.RegisterSizeInBytes();
 
   PushPreamble(registers.Count(), size);
-  // Push up to four registers at a time because if the current stack pointer is
-  // csp and reg_size is 32, registers must be pushed in blocks of four in order
-  // to maintain the 16-byte alignment for csp.
+  // Push up to four registers at a time.
   while (!registers.IsEmpty()) {
     int count_before = registers.Count();
     const CPURegister& src0 = registers.PopHighestIndex();
@@ -1183,9 +1177,7 @@ void TurboAssembler::PushCPURegList(CPURegList registers) {
 void TurboAssembler::PopCPURegList(CPURegList registers) {
   int size = registers.RegisterSizeInBytes();
 
-  // Pop up to four registers at a time because if the current stack pointer is
-  // csp and reg_size is 32, registers must be pushed in blocks of four in
-  // order to maintain the 16-byte alignment for csp.
+  // Pop up to four registers at a time.
   while (!registers.IsEmpty()) {
     int count_before = registers.Count();
     const CPURegister& dst0 = registers.PopLowestIndex();
@@ -1258,23 +1250,23 @@ void TurboAssembler::PushHelper(int count, int size, const CPURegister& src0,
   switch (count) {
     case 1:
       DCHECK(src1.IsNone() && src2.IsNone() && src3.IsNone());
-      str(src0, MemOperand(StackPointer(), -1 * size, PreIndex));
+      str(src0, MemOperand(sp, -1 * size, PreIndex));
       break;
     case 2:
       DCHECK(src2.IsNone() && src3.IsNone());
-      stp(src1, src0, MemOperand(StackPointer(), -2 * size, PreIndex));
+      stp(src1, src0, MemOperand(sp, -2 * size, PreIndex));
       break;
     case 3:
       DCHECK(src3.IsNone());
-      stp(src2, src1, MemOperand(StackPointer(), -3 * size, PreIndex));
-      str(src0, MemOperand(StackPointer(), 2 * size));
+      stp(src2, src1, MemOperand(sp, -3 * size, PreIndex));
+      str(src0, MemOperand(sp, 2 * size));
       break;
     case 4:
       // Skip over 4 * size, then fill in the gap. This allows four W registers
-      // to be pushed using csp, whilst maintaining 16-byte alignment for csp
+      // to be pushed using sp, whilst maintaining 16-byte alignment for sp
       // at all times.
-      stp(src3, src2, MemOperand(StackPointer(), -4 * size, PreIndex));
-      stp(src1, src0, MemOperand(StackPointer(), 2 * size));
+      stp(src3, src2, MemOperand(sp, -4 * size, PreIndex));
+      stp(src1, src0, MemOperand(sp, 2 * size));
       break;
     default:
       UNREACHABLE();
@@ -1295,24 +1287,24 @@ void TurboAssembler::PopHelper(int count, int size, const CPURegister& dst0,
   switch (count) {
     case 1:
       DCHECK(dst1.IsNone() && dst2.IsNone() && dst3.IsNone());
-      ldr(dst0, MemOperand(StackPointer(), 1 * size, PostIndex));
+      ldr(dst0, MemOperand(sp, 1 * size, PostIndex));
       break;
     case 2:
       DCHECK(dst2.IsNone() && dst3.IsNone());
-      ldp(dst0, dst1, MemOperand(StackPointer(), 2 * size, PostIndex));
+      ldp(dst0, dst1, MemOperand(sp, 2 * size, PostIndex));
       break;
     case 3:
       DCHECK(dst3.IsNone());
-      ldr(dst2, MemOperand(StackPointer(), 2 * size));
-      ldp(dst0, dst1, MemOperand(StackPointer(), 3 * size, PostIndex));
+      ldr(dst2, MemOperand(sp, 2 * size));
+      ldp(dst0, dst1, MemOperand(sp, 3 * size, PostIndex));
       break;
     case 4:
       // Load the higher addresses first, then load the lower addresses and
       // skip the whole block in the second instruction. This allows four W
-      // registers to be popped using csp, whilst maintaining 16-byte alignment
-      // for csp at all times.
-      ldp(dst2, dst3, MemOperand(StackPointer(), 2 * size));
-      ldp(dst0, dst1, MemOperand(StackPointer(), 4 * size, PostIndex));
+      // registers to be popped using sp, whilst maintaining 16-byte alignment
+      // for sp at all times.
+      ldp(dst2, dst3, MemOperand(sp, 2 * size));
+      ldp(dst0, dst1, MemOperand(sp, 4 * size, PostIndex));
       break;
     default:
       UNREACHABLE();
@@ -1322,43 +1314,27 @@ void TurboAssembler::PopHelper(int count, int size, const CPURegister& dst0,
 void TurboAssembler::PushPreamble(Operand total_size) {
   if (total_size.IsZero()) return;
 
-  if (csp.Is(StackPointer())) {
-    // If the current stack pointer is csp, then it must be aligned to 16 bytes
-    // on entry and the total size of the specified registers must also be a
-    // multiple of 16 bytes.
-    if (total_size.IsImmediate()) {
-      DCHECK_EQ(total_size.ImmediateValue() % 16, 0);
-    }
-
-    // Don't check access size for non-immediate sizes. It's difficult to do
-    // well, and it will be caught by hardware (or the simulator) anyway.
-  } else {
-    // Even if the current stack pointer is not the system stack pointer (csp),
-    // the system stack pointer will still be modified in order to comply with
-    // ABI rules about accessing memory below the system stack pointer.
-    BumpSystemStackPointer(total_size);
+  // The stack pointer must be aligned to 16 bytes on entry, and the total
+  // size of the specified registers must also be a multiple of 16 bytes.
+  if (total_size.IsImmediate()) {
+    DCHECK_EQ(total_size.ImmediateValue() % 16, 0);
   }
+
+  // Don't check access size for non-immediate sizes. It's difficult to do
+  // well, and it will be caught by hardware (or the simulator) anyway.
 }
 
 void TurboAssembler::PopPostamble(Operand total_size) {
   if (total_size.IsZero()) return;
 
-  if (csp.Is(StackPointer())) {
-    // If the current stack pointer is csp, then it must be aligned to 16 bytes
-    // on entry and the total size of the specified registers must also be a
-    // multiple of 16 bytes.
-    if (total_size.IsImmediate()) {
-      DCHECK_EQ(total_size.ImmediateValue() % 16, 0);
-    }
-
-    // Don't check access size for non-immediate sizes. It's difficult to do
-    // well, and it will be caught by hardware (or the simulator) anyway.
-  } else if (emit_debug_code()) {
-    // It is safe to leave csp where it is when unwinding the JavaScript stack,
-    // but if we keep it matching StackPointer, the simulator can detect memory
-    // accesses in the now-free part of the stack.
-    SyncSystemStackPointer();
+  // The stack pointer must be aligned to 16 bytes on entry, and the total
+  // size of the specified registers must also be a multiple of 16 bytes.
+  if (total_size.IsImmediate()) {
+    DCHECK_EQ(total_size.ImmediateValue() % 16, 0);
   }
+
+  // Don't check access size for non-immediate sizes. It's difficult to do
+  // well, and it will be caught by hardware (or the simulator) anyway.
 }
 
 void TurboAssembler::PushPreamble(int count, int size) {
@@ -1376,7 +1352,7 @@ void TurboAssembler::Poke(const CPURegister& src, const Operand& offset) {
     Check(le, AbortReason::kStackAccessBelowStackPointer);
   }
 
-  Str(src, MemOperand(StackPointer(), offset));
+  Str(src, MemOperand(sp, offset));
 }
 
 
@@ -1388,14 +1364,14 @@ void MacroAssembler::Peek(const CPURegister& dst, const Operand& offset) {
     Check(le, AbortReason::kStackAccessBelowStackPointer);
   }
 
-  Ldr(dst, MemOperand(StackPointer(), offset));
+  Ldr(dst, MemOperand(sp, offset));
 }
 
 void TurboAssembler::PokePair(const CPURegister& src1, const CPURegister& src2,
                               int offset) {
   DCHECK(AreSameSizeAndType(src1, src2));
   DCHECK((offset >= 0) && ((offset % src1.SizeInBytes()) == 0));
-  Stp(src1, src2, MemOperand(StackPointer(), offset));
+  Stp(src1, src2, MemOperand(sp, offset));
 }
 
 
@@ -1404,7 +1380,7 @@ void MacroAssembler::PeekPair(const CPURegister& dst1,
                               int offset) {
   DCHECK(AreSameSizeAndType(dst1, dst2));
   DCHECK((offset >= 0) && ((offset % dst1.SizeInBytes()) == 0));
-  Ldp(dst1, dst2, MemOperand(StackPointer(), offset));
+  Ldp(dst1, dst2, MemOperand(sp, offset));
 }
 
 
@@ -1412,11 +1388,7 @@ void MacroAssembler::PushCalleeSavedRegisters() {
   // Ensure that the macro-assembler doesn't use any scratch registers.
   InstructionAccurateScope scope(this);
 
-  // This method must not be called unless the current stack pointer is the
-  // system stack pointer (csp).
-  DCHECK(csp.Is(StackPointer()));
-
-  MemOperand tos(csp, -2 * static_cast<int>(kXRegSize), PreIndex);
+  MemOperand tos(sp, -2 * static_cast<int>(kXRegSize), PreIndex);
 
   stp(d14, d15, tos);
   stp(d12, d13, tos);
@@ -1436,11 +1408,7 @@ void MacroAssembler::PopCalleeSavedRegisters() {
   // Ensure that the macro-assembler doesn't use any scratch registers.
   InstructionAccurateScope scope(this);
 
-  // This method must not be called unless the current stack pointer is the
-  // system stack pointer (csp).
-  DCHECK(csp.Is(StackPointer()));
-
-  MemOperand tos(csp, 2 * kXRegSize, PostIndex);
+  MemOperand tos(sp, 2 * kXRegSize, PostIndex);
 
   ldp(x19, x20, tos);
   ldp(x21, x22, tos);
@@ -1455,44 +1423,15 @@ void MacroAssembler::PopCalleeSavedRegisters() {
   ldp(d14, d15, tos);
 }
 
-void TurboAssembler::AssertStackConsistency() {
-  // Avoid emitting code when !use_real_abort() since non-real aborts cause too
-  // much code to be generated.
+void TurboAssembler::AssertSpAligned() {
   if (emit_debug_code() && use_real_aborts()) {
-    if (csp.Is(StackPointer())) {
-      // Always check the alignment of csp if ALWAYS_ALIGN_CSP is true.  We
-      // can't check the alignment of csp without using a scratch register (or
-      // clobbering the flags), but the processor (or simulator) will abort if
-      // it is not properly aligned during a load.
-      ldr(xzr, MemOperand(csp, 0));
-    }
-    if (FLAG_enable_slow_asserts && !csp.Is(StackPointer())) {
-      Label ok;
-      // Check that csp <= StackPointer(), preserving all registers and NZCV.
-      sub(StackPointer(), csp, StackPointer());
-      cbz(StackPointer(), &ok);                 // Ok if csp == StackPointer().
-      tbnz(StackPointer(), kXSignBit, &ok);     // Ok if csp < StackPointer().
-
-      // Avoid generating AssertStackConsistency checks for the Push in Abort.
-      { DontEmitDebugCodeScope dont_emit_debug_code_scope(this);
-        // Restore StackPointer().
-        sub(StackPointer(), csp, StackPointer());
-        Abort(AbortReason::kTheCurrentStackPointerIsBelowCsp);
-      }
-
-      bind(&ok);
-      // Restore StackPointer().
-      sub(StackPointer(), csp, StackPointer());
-    }
-  }
-}
-
-void TurboAssembler::AssertCspAligned() {
-  if (emit_debug_code() && use_real_aborts()) {
-    // TODO(titzer): use a real assert for alignment check?
+    // Arm64 requires the stack pointer to be 16-byte aligned prior to address
+    // calculation.
     UseScratchRegisterScope scope(this);
     Register temp = scope.AcquireX();
-    ldr(temp, MemOperand(csp));
+    Mov(temp, sp);
+    Tst(temp, 15);
+    Check(eq, AbortReason::kUnexpectedStackPointer);
   }
 }
 
@@ -1568,11 +1507,11 @@ void TurboAssembler::CopyDoubleWords(Register dst, Register src, Register count,
 }
 
 void TurboAssembler::SlotAddress(Register dst, int slot_offset) {
-  Add(dst, StackPointer(), slot_offset << kPointerSizeLog2);
+  Add(dst, sp, slot_offset << kPointerSizeLog2);
 }
 
 void TurboAssembler::SlotAddress(Register dst, Register slot_offset) {
-  Add(dst, StackPointer(), Operand(slot_offset, LSL, kPointerSizeLog2));
+  Add(dst, sp, Operand(slot_offset, LSL, kPointerSizeLog2));
 }
 
 void TurboAssembler::AssertFPCRState(Register fpcr) {
@@ -1630,6 +1569,34 @@ void TurboAssembler::Move(Register dst, Register src) { Mov(dst, src); }
 void TurboAssembler::Move(Register dst, Handle<HeapObject> x) { Mov(dst, x); }
 void TurboAssembler::Move(Register dst, Smi* src) { Mov(dst, src); }
 
+void TurboAssembler::Swap(Register lhs, Register rhs) {
+  DCHECK(lhs.IsSameSizeAndType(rhs));
+  DCHECK(!lhs.Is(rhs));
+  UseScratchRegisterScope temps(this);
+  Register temp = temps.AcquireX();
+  Mov(temp, rhs);
+  Mov(rhs, lhs);
+  Mov(lhs, temp);
+}
+
+void TurboAssembler::Swap(VRegister lhs, VRegister rhs) {
+  DCHECK(lhs.IsSameSizeAndType(rhs));
+  DCHECK(!lhs.Is(rhs));
+  UseScratchRegisterScope temps(this);
+  VRegister temp = VRegister::no_reg();
+  if (lhs.IsS()) {
+    temp = temps.AcquireS();
+  } else if (lhs.IsD()) {
+    temp = temps.AcquireD();
+  } else {
+    DCHECK(lhs.IsQ());
+    temp = temps.AcquireQ();
+  }
+  Mov(temp, rhs);
+  Mov(rhs, lhs);
+  Mov(lhs, temp);
+}
+
 void TurboAssembler::AssertSmi(Register object, AbortReason reason) {
   if (emit_debug_code()) {
     STATIC_ASSERT(kSmiTag == 0);
@@ -1658,6 +1625,21 @@ void MacroAssembler::AssertFixedArray(Register object) {
   }
 }
 
+void MacroAssembler::AssertConstructor(Register object) {
+  if (emit_debug_code()) {
+    AssertNotSmi(object, AbortReason::kOperandIsASmiAndNotAConstructor);
+
+    UseScratchRegisterScope temps(this);
+    Register temp = temps.AcquireX();
+
+    Ldr(temp, FieldMemOperand(object, HeapObject::kMapOffset));
+    Ldrb(temp, FieldMemOperand(temp, Map::kBitFieldOffset));
+    Tst(temp, Operand(Map::IsConstructorBit::kMask));
+
+    Check(ne, AbortReason::kOperandIsNotAConstructor);
+  }
+}
+
 void MacroAssembler::AssertFunction(Register object) {
   if (emit_debug_code()) {
     AssertNotSmi(object, AbortReason::kOperandIsASmiAndNotAFunction);
@@ -1792,6 +1774,12 @@ void MacroAssembler::JumpToExternalReference(const ExternalReference& builtin,
   Jump(stub.GetCode(), RelocInfo::CODE_TARGET);
 }
 
+void MacroAssembler::JumpToInstructionStream(Address entry) {
+  Mov(kOffHeapTrampolineRegister,
+      Operand(reinterpret_cast<uint64_t>(entry), RelocInfo::OFF_HEAP_TARGET));
+  Br(kOffHeapTrampolineRegister);
+}
+
 void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
   const Runtime::Function* function = Runtime::FunctionForId(fid);
   DCHECK_EQ(1, function->result_size);
@@ -1927,13 +1915,10 @@ void TurboAssembler::Call(Address target, RelocInfo::Mode rmode) {
   Bind(&start_call);
 #endif
 
-  // Addresses always have 64 bits, so we shouldn't encounter NONE32.
-  DCHECK(rmode != RelocInfo::NONE32);
-
   UseScratchRegisterScope temps(this);
   Register temp = temps.AcquireX();
 
-  if (rmode == RelocInfo::NONE64) {
+  if (RelocInfo::IsNone(rmode)) {
     // Addresses are 48 bits so we never need to load the upper 16 bits.
     uint64_t imm = reinterpret_cast<uint64_t>(target);
     // If we don't use ARM tagged addresses, the 16 higher bits must be 0.
@@ -2009,62 +1994,15 @@ int TurboAssembler::CallSize(Label* target) {
 int TurboAssembler::CallSize(Address target, RelocInfo::Mode rmode) {
   USE(target);
 
-  // Addresses always have 64 bits, so we shouldn't encounter NONE32.
-  DCHECK(rmode != RelocInfo::NONE32);
-
-  if (rmode == RelocInfo::NONE64) {
-    return kCallSizeWithoutRelocation;
-  } else {
-    return kCallSizeWithRelocation;
-  }
+  return RelocInfo::IsNone(rmode) ? kCallSizeWithoutRelocation
+                                  : kCallSizeWithRelocation;
 }
 
 int TurboAssembler::CallSize(Handle<Code> code, RelocInfo::Mode rmode) {
   USE(code);
 
-  // Addresses always have 64 bits, so we shouldn't encounter NONE32.
-  DCHECK(rmode != RelocInfo::NONE32);
-
-  if (rmode == RelocInfo::NONE64) {
-    return kCallSizeWithoutRelocation;
-  } else {
-    return kCallSizeWithRelocation;
-  }
-}
-
-
-void MacroAssembler::JumpIfHeapNumber(Register object, Label* on_heap_number,
-                                      SmiCheckType smi_check_type) {
-  Label on_not_heap_number;
-
-  if (smi_check_type == DO_SMI_CHECK) {
-    JumpIfSmi(object, &on_not_heap_number);
-  }
-
-  AssertNotSmi(object);
-
-  UseScratchRegisterScope temps(this);
-  Register temp = temps.AcquireX();
-  Ldr(temp, FieldMemOperand(object, HeapObject::kMapOffset));
-  JumpIfRoot(temp, Heap::kHeapNumberMapRootIndex, on_heap_number);
-
-  Bind(&on_not_heap_number);
-}
-
-
-void MacroAssembler::JumpIfNotHeapNumber(Register object,
-                                         Label* on_not_heap_number,
-                                         SmiCheckType smi_check_type) {
-  if (smi_check_type == DO_SMI_CHECK) {
-    JumpIfSmi(object, on_not_heap_number);
-  }
-
-  AssertNotSmi(object);
-
-  UseScratchRegisterScope temps(this);
-  Register temp = temps.AcquireX();
-  Ldr(temp, FieldMemOperand(object, HeapObject::kMapOffset));
-  JumpIfNotRoot(temp, Heap::kHeapNumberMapRootIndex, on_not_heap_number);
+  return RelocInfo::IsNone(rmode) ? kCallSizeWithoutRelocation
+                                  : kCallSizeWithRelocation;
 }
 
 void MacroAssembler::TryRepresentDoubleAsInt(Register as_int, VRegister value,
@@ -2110,12 +2048,10 @@ void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
   Register src_reg = caller_args_count_reg;
   // Calculate the end of source area. +kPointerSize is for the receiver.
   if (callee_args_count.is_reg()) {
-    Add(src_reg, StackPointer(),
-        Operand(callee_args_count.reg(), LSL, kPointerSizeLog2));
+    Add(src_reg, sp, Operand(callee_args_count.reg(), LSL, kPointerSizeLog2));
     Add(src_reg, src_reg, kPointerSize);
   } else {
-    Add(src_reg, StackPointer(),
-        (callee_args_count.immediate() + 1) * kPointerSize);
+    Add(src_reg, sp, (callee_args_count.immediate() + 1) * kPointerSize);
   }
 
   // Round src_reg up to a multiple of 16 bytes, so we include any potential
@@ -2145,12 +2081,11 @@ void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
   Ldr(tmp_reg, MemOperand(src_reg, -kPointerSize, PreIndex));
   Str(tmp_reg, MemOperand(dst_reg, -kPointerSize, PreIndex));
   bind(&entry);
-  Cmp(StackPointer(), src_reg);
+  Cmp(sp, src_reg);
   B(ne, &loop);
 
   // Leave current frame.
-  Mov(StackPointer(), dst_reg);
-  AssertStackConsistency();
+  Mov(sp, dst_reg);
 }
 
 void MacroAssembler::InvokePrologue(const ParameterCount& expected,
@@ -2225,11 +2160,13 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
                                     const ParameterCount& expected,
                                     const ParameterCount& actual) {
   Label skip_hook;
+
   ExternalReference debug_hook_active =
       ExternalReference::debug_hook_on_function_call_address(isolate());
   Mov(x4, Operand(debug_hook_active));
   Ldrsb(x4, MemOperand(x4));
   Cbz(x4, &skip_hook);
+
   {
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
@@ -2284,7 +2221,7 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
     // We call indirectly through the code field in the function to
     // allow recompilation to take effect without changing any of the
     // call sites.
-    Register code = x4;
+    Register code = kJavaScriptCallCodeStartRegister;
     Ldr(code, FieldMemOperand(function, JSFunction::kCodeOffset));
     Add(code, code, Operand(Code::kHeaderSize - kHeapObjectTag));
     if (flag == CALL_FUNCTION) {
@@ -2343,16 +2280,6 @@ void MacroAssembler::InvokeFunction(Register function,
   InvokeFunctionCode(function, no_reg, expected, actual, flag);
 }
 
-void MacroAssembler::InvokeFunction(Handle<JSFunction> function,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual,
-                                    InvokeFlag flag) {
-  // Contract with called JS functions requires that function is passed in x1.
-  // (See FullCodeGenerator::Generate().)
-  LoadObject(x1, function);
-  InvokeFunction(x1, expected, actual, flag);
-}
-
 void TurboAssembler::TryConvertDoubleToInt64(Register result,
                                              DoubleRegister double_input,
                                              Label* done) {
@@ -2402,7 +2329,7 @@ void TurboAssembler::TruncateDoubleToIDelayed(Zone* zone, Register result,
 
 void TurboAssembler::Prologue() {
   Push(lr, fp, cp, x1);
-  Add(fp, StackPointer(), StandardFrameConstants::kFixedFrameSizeFromFp);
+  Add(fp, sp, StandardFrameConstants::kFixedFrameSizeFromFp);
 }
 
 void TurboAssembler::EnterFrame(StackFrame::Type type) {
@@ -2414,21 +2341,20 @@ void TurboAssembler::EnterFrame(StackFrame::Type type) {
     Mov(type_reg, StackFrame::TypeToMarker(type));
     Mov(code_reg, Operand(CodeObject()));
     Push(lr, fp, type_reg, code_reg);
-    Add(fp, StackPointer(), InternalFrameConstants::kFixedFrameSizeFromFp);
+    Add(fp, sp, InternalFrameConstants::kFixedFrameSizeFromFp);
     // sp[4] : lr
     // sp[3] : fp
     // sp[1] : type
     // sp[0] : [code object]
   } else if (type == StackFrame::WASM_COMPILED) {
-    DCHECK(csp.Is(StackPointer()));
     Mov(type_reg, StackFrame::TypeToMarker(type));
     Push(lr, fp);
-    Mov(fp, csp);
+    Mov(fp, sp);
     Push(type_reg, padreg);
-    // csp[3] : lr
-    // csp[2] : fp
-    // csp[1] : type
-    // csp[0] : for alignment
+    // sp[3] : lr
+    // sp[2] : fp
+    // sp[1] : type
+    // sp[0] : for alignment
   } else {
     DCHECK_EQ(type, StackFrame::CONSTRUCT);
     Mov(type_reg, StackFrame::TypeToMarker(type));
@@ -2439,8 +2365,7 @@ void TurboAssembler::EnterFrame(StackFrame::Type type) {
 
     // The context pointer isn't part of the fixed frame, so add an extra slot
     // to account for it.
-    Add(fp, StackPointer(),
-        TypedFrameConstants::kFixedFrameSizeFromFp + kPointerSize);
+    Add(fp, sp, TypedFrameConstants::kFixedFrameSizeFromFp + kPointerSize);
     // sp[3] : lr
     // sp[2] : fp
     // sp[1] : type
@@ -2450,15 +2375,12 @@ void TurboAssembler::EnterFrame(StackFrame::Type type) {
 
 void TurboAssembler::LeaveFrame(StackFrame::Type type) {
   if (type == StackFrame::WASM_COMPILED) {
-    DCHECK(csp.Is(StackPointer()));
-    Mov(csp, fp);
-    AssertStackConsistency();
+    Mov(sp, fp);
     Pop(fp, lr);
   } else {
     // Drop the execution stack down to the frame pointer and restore
     // the caller frame pointer and return address.
-    Mov(StackPointer(), fp);
-    AssertStackConsistency();
+    Mov(sp, fp);
     Pop(fp, lr);
   }
 }
@@ -2493,7 +2415,7 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, const Register& scratch,
 
   // Set up the new stack frame.
   Push(lr, fp);
-  Mov(fp, StackPointer());
+  Mov(fp, sp);
   Mov(scratch, StackFrame::TypeToMarker(frame_type));
   Push(scratch, xzr);
   Mov(scratch, Operand(CodeObject()));
@@ -2540,13 +2462,11 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, const Register& scratch,
   //         sp[8]: Extra space reserved for caller (if extra_space != 0).
   //   sp -> sp[0]: Space reserved for the return address.
 
-  DCHECK(csp.Is(StackPointer()));
-
   // ExitFrame::GetStateForFramePointer expects to find the return address at
   // the memory address immediately below the pointer stored in SPOffset.
   // It is not safe to derive much else from SPOffset, because the size of the
   // padding can vary.
-  Add(scratch, csp, kXRegSize);
+  Add(scratch, sp, kXRegSize);
   Str(scratch, MemOperand(fp, ExitFrameConstants::kSPOffset));
 }
 
@@ -2555,8 +2475,6 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, const Register& scratch,
 void MacroAssembler::LeaveExitFrame(bool restore_doubles,
                                     const Register& scratch,
                                     const Register& scratch2) {
-  DCHECK(csp.Is(StackPointer()));
-
   if (restore_doubles) {
     ExitFrameRestoreFPRegs();
   }
@@ -2582,11 +2500,16 @@ void MacroAssembler::LeaveExitFrame(bool restore_doubles,
   //         fp[8]: CallerPC (lr)
   //   fp -> fp[0]: CallerFP (old fp)
   //         fp[...]: The rest of the frame.
-  Mov(csp, fp);
-  AssertStackConsistency();
+  Mov(sp, fp);
   Pop(fp, lr);
 }
 
+void MacroAssembler::LoadWeakValue(Register out, Register in,
+                                   Label* target_if_cleared) {
+  CompareAndBranch(in, Operand(kClearedWeakHeapObject), eq, target_if_cleared);
+
+  and_(out, in, Operand(~kWeakHeapObjectMask));
+}
 
 void MacroAssembler::IncrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
@@ -2752,7 +2675,7 @@ int MacroAssembler::SafepointRegisterStackIndex(int reg_code) {
   // registers are saved. The following registers are excluded:
   //  - x16 and x17 (ip0 and ip1) because they shouldn't be preserved outside of
   //    the macro assembler.
-  //  - x31 (csp) because the system stack pointer doesn't need to be included
+  //  - x31 (sp) because the system stack pointer doesn't need to be included
   //    in safepoint registers.
   //
   // This function implements the mapping of register code to index into the
@@ -3052,7 +2975,7 @@ void MacroAssembler::PrintfNoPreserve(const char * format,
                                       const CPURegister& arg3) {
   // We cannot handle a caller-saved stack pointer. It doesn't make much sense
   // in most cases anyway, so this restriction shouldn't be too serious.
-  DCHECK(!kCallerSaved.IncludesAliasOf(StackPointer()));
+  DCHECK(!kCallerSaved.IncludesAliasOf(sp));
 
   // The provided arguments, and their proper procedure-call standard registers.
   CPURegister args[kPrintfMaxArgCount] = {arg0, arg1, arg2, arg3};
@@ -3164,12 +3087,6 @@ void MacroAssembler::PrintfNoPreserve(const char * format,
     Bind(&after_data);
   }
 
-  // We don't pass any arguments on the stack, but we still need to align the C
-  // stack pointer to a 16-byte boundary for PCS compliance.
-  if (!csp.Is(StackPointer())) {
-    Bic(csp, StackPointer(), 0xF);
-  }
-
   CallPrintf(arg_count, pcs);
 }
 
@@ -3208,14 +3125,6 @@ void MacroAssembler::Printf(const char * format,
                             CPURegister arg1,
                             CPURegister arg2,
                             CPURegister arg3) {
-  // We can only print sp if it is the current stack pointer.
-  if (!csp.Is(StackPointer())) {
-    DCHECK(!csp.Aliases(arg0));
-    DCHECK(!csp.Aliases(arg1));
-    DCHECK(!csp.Aliases(arg2));
-    DCHECK(!csp.Aliases(arg3));
-  }
-
   // Printf is expected to preserve all registers, so make sure that none are
   // available as scratch registers until we've preserved them.
   RegList old_tmp_list = TmpList()->list();
@@ -3224,8 +3133,8 @@ void MacroAssembler::Printf(const char * format,
   FPTmpList()->set_list(0);
 
   // Preserve all caller-saved registers as well as NZCV.
-  // If csp is the stack pointer, PushCPURegList asserts that the size of each
-  // list is a multiple of 16 bytes.
+  // PushCPURegList asserts that the size of each list is a multiple of 16
+  // bytes.
   PushCPURegList(kCallerSaved);
   PushCPURegList(kCallerSavedV);
 
@@ -3241,15 +3150,15 @@ void MacroAssembler::Printf(const char * format,
     // If any of the arguments are the current stack pointer, allocate a new
     // register for them, and adjust the value to compensate for pushing the
     // caller-saved registers.
-    bool arg0_sp = StackPointer().Aliases(arg0);
-    bool arg1_sp = StackPointer().Aliases(arg1);
-    bool arg2_sp = StackPointer().Aliases(arg2);
-    bool arg3_sp = StackPointer().Aliases(arg3);
+    bool arg0_sp = sp.Aliases(arg0);
+    bool arg1_sp = sp.Aliases(arg1);
+    bool arg2_sp = sp.Aliases(arg2);
+    bool arg3_sp = sp.Aliases(arg3);
     if (arg0_sp || arg1_sp || arg2_sp || arg3_sp) {
       // Allocate a register to hold the original stack pointer value, to pass
       // to PrintfNoPreserve as an argument.
       Register arg_sp = temps.AcquireX();
-      Add(arg_sp, StackPointer(),
+      Add(arg_sp, sp,
           kCallerSaved.TotalSizeInBytes() + kCallerSavedV.TotalSizeInBytes());
       if (arg0_sp) arg0 = Register::Create(arg_sp.code(), arg0.SizeInBits());
       if (arg1_sp) arg1 = Register::Create(arg_sp.code(), arg1.SizeInBits());
@@ -3302,7 +3211,7 @@ CPURegister UseScratchRegisterScope::AcquireNextAvailable(
     CPURegList* available) {
   CHECK(!available->IsEmpty());
   CPURegister result = available->PopLowestIndex();
-  DCHECK(!AreAliased(result, xzr, csp));
+  DCHECK(!AreAliased(result, xzr, sp));
   return result;
 }
 
@@ -3359,6 +3268,14 @@ InlineSmiCheckInfo::InlineSmiCheckInfo(Address info)
   }
 }
 
+void TurboAssembler::ComputeCodeStartAddress(const Register& rd) {
+  // We can use adr to load a pc relative location.
+  adr(rd, -pc_offset());
+}
+
+void TurboAssembler::ResetSpeculationPoisonRegister() {
+  Mov(kSpeculationPoisonRegister, -1);
+}
 
 #undef __
 
diff --git a/deps/v8/src/arm64/macro-assembler-arm64.h b/deps/v8/src/arm64/macro-assembler-arm64.h
index 47c08f26226..6b1b8957cb5 100644
--- a/deps/v8/src/arm64/macro-assembler-arm64.h
+++ b/deps/v8/src/arm64/macro-assembler-arm64.h
@@ -47,12 +47,15 @@ namespace internal {
 #define kJSFunctionRegister x1
 #define kContextRegister cp
 #define kAllocateSizeRegister x1
+#define kSpeculationPoisonRegister x18
 #define kInterpreterAccumulatorRegister x0
 #define kInterpreterBytecodeOffsetRegister x19
 #define kInterpreterBytecodeArrayRegister x20
 #define kInterpreterDispatchTableRegister x21
 #define kJavaScriptCallArgCountRegister x0
+#define kJavaScriptCallCodeStartRegister x2
 #define kJavaScriptCallNewTargetRegister x3
+#define kOffHeapTrampolineRegister ip0
 #define kRuntimeCallFunctionRegister x1
 #define kRuntimeCallArgCountRegister x0
 
@@ -254,6 +257,10 @@ class TurboAssembler : public Assembler {
   void Move(Register dst, Handle<HeapObject> x);
   void Move(Register dst, Smi* src);
 
+  // Register swap. Note that the register operands should be distinct.
+  void Swap(Register lhs, Register rhs);
+  void Swap(VRegister lhs, VRegister rhs);
+
 // NEON by element instructions.
 #define NEON_BYELEMENT_MACRO_LIST(V) \
   V(fmla, Fmla)                      \
@@ -549,6 +556,11 @@ class TurboAssembler : public Assembler {
   void Cbnz(const Register& rt, Label* label);
   void Cbz(const Register& rt, Label* label);
 
+  inline void Dmb(BarrierDomain domain, BarrierType type);
+  inline void Dsb(BarrierDomain domain, BarrierType type);
+  inline void Isb();
+  inline void Csdb();
+
   bool AllowThisStubCall(CodeStub* stub);
   void CallStubDelayed(CodeStub* stub);
   void CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
@@ -581,20 +593,6 @@ class TurboAssembler : public Assembler {
   // Print a message to stderr and abort execution.
   void Abort(AbortReason reason);
 
-  // If emit_debug_code() is true, emit a run-time check to ensure that
-  // StackPointer() does not point below the system stack pointer.
-  //
-  // Whilst it is architecturally legal for StackPointer() to point below csp,
-  // it can be evidence of a potential bug because the ABI forbids accesses
-  // below csp.
-  //
-  // If StackPointer() is the system stack pointer (csp), then csp will be
-  // dereferenced to cause the processor (or simulator) to abort if it is not
-  // properly aligned.
-  //
-  // If emit_debug_code() is false, this emits no code.
-  void AssertStackConsistency();
-
   // Remaining instructions are simple pass-through calls to the assembler.
   inline void Asr(const Register& rd, const Register& rn, unsigned shift);
   inline void Asr(const Register& rd, const Register& rn, const Register& rm);
@@ -614,9 +612,6 @@ class TurboAssembler : public Assembler {
   static CPURegList DefaultTmpList();
   static CPURegList DefaultFPTmpList();
 
-  // Return the stack pointer.
-  inline const Register& StackPointer() const { return csp; }
-
   // Move macros.
   inline void Mvn(const Register& rd, uint64_t imm);
   void Mvn(const Register& rd, const Operand& operand);
@@ -650,9 +645,11 @@ class TurboAssembler : public Assembler {
   inline void Cmp(const Register& rn, const Operand& operand);
   inline void Subs(const Register& rd, const Register& rn,
                    const Operand& operand);
+  void Csel(const Register& rd, const Register& rn, const Operand& operand,
+            Condition cond);
 
-  // Emits a runtime assert that the CSP is aligned.
-  void AssertCspAligned();
+  // Emits a runtime assert that the stack pointer is aligned.
+  void AssertSpAligned();
 
   // Copy slot_count stack slots from the stack offset specified by src to
   // the stack offset specified by dst. The offsets and count are expressed in
@@ -687,17 +684,14 @@ class TurboAssembler : public Assembler {
 
   // Load a literal from the inline constant pool.
   inline void Ldr(const CPURegister& rt, const Operand& imm);
-  // Helper function for double immediate.
-  inline void Ldr(const CPURegister& rt, double imm);
 
   // Claim or drop stack space without actually accessing memory.
   //
   // In debug mode, both of these will write invalid data into the claimed or
   // dropped space.
   //
-  // If the current stack pointer (according to StackPointer()) is csp, then it
-  // must be aligned to 16 bytes and the size claimed or dropped must be a
-  // multiple of 16 bytes.
+  // The stack pointer must be aligned to 16 bytes and the size claimed or
+  // dropped must be a multiple of 16 bytes.
   //
   // Note that unit_size must be specified in bytes. For variants which take a
   // Register count, the unit size must be a power of two.
@@ -724,26 +718,6 @@ class TurboAssembler : public Assembler {
   // Push a single argument, with padding, to the stack.
   inline void PushArgument(const Register& arg);
 
-  // Re-synchronizes the system stack pointer (csp) with the current stack
-  // pointer (according to StackPointer()).
-  //
-  // This method asserts that StackPointer() is not csp, since the call does
-  // not make sense in that context.
-  inline void SyncSystemStackPointer();
-
-  // Push the system stack pointer (csp) down to allow the same to be done to
-  // the current stack pointer (according to StackPointer()). This must be
-  // called _before_ accessing the memory.
-  //
-  // This is necessary when pushing or otherwise adding things to the stack, to
-  // satisfy the AAPCS64 constraint that the memory below the system stack
-  // pointer is not accessed.  The amount pushed will be increased as necessary
-  // to ensure csp remains aligned to 16 bytes.
-  //
-  // This method asserts that StackPointer() is not csp, since the call does
-  // not make sense in that context.
-  inline void BumpSystemStackPointer(const Operand& space);
-
   // Add and sub macros.
   inline void Add(const Register& rd, const Register& rn,
                   const Operand& operand);
@@ -778,11 +752,6 @@ class TurboAssembler : public Assembler {
   // The stack pointer must be aligned to 16 bytes on entry and the total size
   // of the specified registers must also be a multiple of 16 bytes.
   //
-  // Even if the current stack pointer is not the system stack pointer (csp),
-  // Push (and derived methods) will still modify the system stack pointer in
-  // order to comply with ABI rules about accessing memory below the system
-  // stack pointer.
-  //
   // Other than the registers passed into Pop, the stack pointer and (possibly)
   // the system stack pointer, these methods do not modify any other registers.
   void Push(const CPURegister& src0, const CPURegister& src1 = NoReg,
@@ -1011,17 +980,13 @@ class TurboAssembler : public Assembler {
 
   inline void Clz(const Register& rd, const Register& rn);
 
-  // Poke 'src' onto the stack. The offset is in bytes.
-  //
-  // If the current stack pointer (according to StackPointer()) is csp, then
-  // csp must be aligned to 16 bytes.
+  // Poke 'src' onto the stack. The offset is in bytes. The stack pointer must
+  // be 16 byte aligned.
   void Poke(const CPURegister& src, const Operand& offset);
 
   // Poke 'src1' and 'src2' onto the stack. The values written will be adjacent
-  // with 'src2' at a higher address than 'src1'. The offset is in bytes.
-  //
-  // If the current stack pointer (according to StackPointer()) is csp, then
-  // csp must be aligned to 16 bytes.
+  // with 'src2' at a higher address than 'src1'. The offset is in bytes. The
+  // stack pointer must be 16 byte aligned.
   void PokePair(const CPURegister& src1, const CPURegister& src2, int offset);
 
   inline void Sbfx(const Register& rd, const Register& rn, unsigned lsb,
@@ -1047,7 +1012,9 @@ class TurboAssembler : public Assembler {
   void CanonicalizeNaN(const VRegister& dst, const VRegister& src);
   void CanonicalizeNaN(const VRegister& reg) { CanonicalizeNaN(reg, reg); }
 
+  inline void CmovX(const Register& rd, const Register& rn, Condition cond);
   inline void Cset(const Register& rd, Condition cond);
+  inline void Csetm(const Register& rd, Condition cond);
   inline void Fccmp(const VRegister& fn, const VRegister& fm, StatusFlags nzcv,
                     Condition cond);
   inline void Csinc(const Register& rd, const Register& rn, const Register& rm,
@@ -1233,6 +1200,12 @@ class TurboAssembler : public Assembler {
   inline void Fcvtas(const Register& rd, const VRegister& fn);
   inline void Fcvtau(const Register& rd, const VRegister& fn);
 
+  // Compute the start of the generated instruction stream from the current PC.
+  // This is an alternative to embedding the {CodeObject} handle as a reference.
+  void ComputeCodeStartAddress(const Register& rd);
+
+  void ResetSpeculationPoisonRegister();
+
  protected:
   // The actual Push and Pop implementations. These don't generate any code
   // other than that required for the push or pop. This allows
@@ -1257,8 +1230,8 @@ class TurboAssembler : public Assembler {
 
   // Call Printf. On a native build, a simple call will be generated, but if the
   // simulator is being used then a suitable pseudo-instruction is used. The
-  // arguments and stack (csp) must be prepared by the caller as for a normal
-  // AAPCS64 call to 'printf'.
+  // arguments and stack must be prepared by the caller as for a normal AAPCS64
+  // call to 'printf'.
   //
   // The 'args' argument should point to an array of variable arguments in their
   // proper PCS registers (and in calling order). The argument registers can
@@ -1326,8 +1299,6 @@ class MacroAssembler : public TurboAssembler {
 
   inline void Ccmn(const Register& rn, const Operand& operand, StatusFlags nzcv,
                    Condition cond);
-  void Csel(const Register& rd, const Register& rn, const Operand& operand,
-            Condition cond);
 
 #define DECLARE_FUNCTION(FN, OP) \
   inline void FN(const Register& rs, const Register& rt, const Register& rn);
@@ -1344,14 +1315,10 @@ class MacroAssembler : public TurboAssembler {
   inline void Cinc(const Register& rd, const Register& rn, Condition cond);
   inline void Cinv(const Register& rd, const Register& rn, Condition cond);
   inline void CzeroX(const Register& rd, Condition cond);
-  inline void CmovX(const Register& rd, const Register& rn, Condition cond);
-  inline void Csetm(const Register& rd, Condition cond);
   inline void Csinv(const Register& rd, const Register& rn, const Register& rm,
                     Condition cond);
   inline void Csneg(const Register& rd, const Register& rn, const Register& rm,
                     Condition cond);
-  inline void Dmb(BarrierDomain domain, BarrierType type);
-  inline void Dsb(BarrierDomain domain, BarrierType type);
   inline void Extr(const Register& rd, const Register& rn, const Register& rm,
                    unsigned lsb);
   inline void Fcsel(const VRegister& fd, const VRegister& fn,
@@ -1394,7 +1361,6 @@ class MacroAssembler : public TurboAssembler {
                      const VRegister& fm, const VRegister& fa);
   inline void Hint(SystemHint code);
   inline void Hlt(int code);
-  inline void Isb();
   inline void Ldnp(const CPURegister& rt, const CPURegister& rt2,
                    const MemOperand& src);
   inline void Movk(const Register& rd, uint64_t imm, int shift = -1);
@@ -1641,17 +1607,13 @@ class MacroAssembler : public TurboAssembler {
   };
 
   // Peek at a value on the stack, and put it in 'dst'. The offset is in bytes.
-  //
-  // If the current stack pointer (according to StackPointer()) is csp, then
-  // csp must be aligned to 16 bytes.
+  // The stack pointer must be aligned to 16 bytes.
   void Peek(const CPURegister& dst, const Operand& offset);
 
   // Peek at two values on the stack, and put them in 'dst1' and 'dst2'. The
   // values peeked will be adjacent, with the value in 'dst2' being from a
-  // higher address than 'dst1'. The offset is in bytes.
-  //
-  // If the current stack pointer (according to StackPointer()) is csp, then
-  // csp must be aligned to 16 bytes.
+  // higher address than 'dst1'. The offset is in bytes. The stack pointer must
+  // be aligned to 16 bytes.
   void PeekPair(const CPURegister& dst1, const CPURegister& dst2, int offset);
 
   // Variants of Claim and Drop, where the 'count' parameter is a SMI held in a
@@ -1704,10 +1666,6 @@ class MacroAssembler : public TurboAssembler {
   // thus come from higher addresses.
   void PopCalleeSavedRegisters();
 
-  // Align csp for a frame, as per ActivationFrameAlignment, and make it the
-  // current stack pointer.
-  inline void AlignAndSetCSPForFrame();
-
   // Helpers ------------------------------------------------------------------
 
   static int SafepointRegisterStackIndex(int reg_code);
@@ -1755,6 +1713,9 @@ class MacroAssembler : public TurboAssembler {
   // Abort execution if argument is not a FixedArray, enabled via --debug-code.
   void AssertFixedArray(Register object);
 
+  // Abort execution if argument is not a Constructor, enabled via --debug-code.
+  void AssertConstructor(Register object);
+
   // Abort execution if argument is not a JSFunction, enabled via --debug-code.
   void AssertFunction(Register object);
 
@@ -1770,11 +1731,6 @@ class MacroAssembler : public TurboAssembler {
   // via --debug-code.
   void AssertUndefinedOrAllocationSite(Register object);
 
-  void JumpIfHeapNumber(Register object, Label* on_heap_number,
-                        SmiCheckType smi_check_type = DONT_DO_SMI_CHECK);
-  void JumpIfNotHeapNumber(Register object, Label* on_not_heap_number,
-                           SmiCheckType smi_check_type = DONT_DO_SMI_CHECK);
-
   // Try to represent a double as a signed 64-bit int.
   // This succeeds if the result compares equal to the input, so inputs of -0.0
   // are represented as 0 and handled as a success.
@@ -1817,6 +1773,9 @@ class MacroAssembler : public TurboAssembler {
   void JumpToExternalReference(const ExternalReference& builtin,
                                bool builtin_exit_frame = false);
 
+  // Generates a trampoline to jump to the off-heap instruction stream.
+  void JumpToInstructionStream(Address entry);
+
   // Registers used through the invocation chain are hard-coded.
   // We force passing the parameters to ensure the contracts are correctly
   // honoured by the caller.
@@ -1841,9 +1800,6 @@ class MacroAssembler : public TurboAssembler {
                       const ParameterCount& actual, InvokeFlag flag);
   void InvokeFunction(Register function, const ParameterCount& expected,
                       const ParameterCount& actual, InvokeFlag flag);
-  void InvokeFunction(Handle<JSFunction> function,
-                      const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
 
   // ---- Code generation helpers ----
 
@@ -1940,12 +1896,12 @@ class MacroAssembler : public TurboAssembler {
   // Set up a stack frame and registers as follows:
   //         fp[8]: CallerPC (lr)
   //   fp -> fp[0]: CallerFP (old fp)
-  //         fp[-8]: SPOffset (new csp)
+  //         fp[-8]: SPOffset (new sp)
   //         fp[-16]: CodeObject()
   //         fp[-16 - fp-size]: Saved doubles, if saved_doubles is true.
-  //         csp[8]: Memory reserved for the caller if extra_space != 0.
+  //         sp[8]: Memory reserved for the caller if extra_space != 0.
   //                 Alignment padding, if necessary.
-  //  csp -> csp[0]: Space reserved for the return address.
+  //   sp -> sp[0]: Space reserved for the return address.
   //
   // This function also stores the new frame information in the top frame, so
   // that the new frame becomes the current frame.
@@ -1960,8 +1916,6 @@ class MacroAssembler : public TurboAssembler {
   //  * Preserved doubles are restored (if restore_doubles is true).
   //  * The frame information is removed from the top frame.
   //  * The exit frame is dropped.
-  //
-  // The stack pointer must be csp on entry.
   void LeaveExitFrame(bool save_doubles, const Register& scratch,
                       const Register& scratch2);
 
@@ -1970,6 +1924,10 @@ class MacroAssembler : public TurboAssembler {
     LoadNativeContextSlot(Context::GLOBAL_PROXY_INDEX, dst);
   }
 
+  // ---------------------------------------------------------------------------
+  // In-place weak references.
+  void LoadWeakValue(Register out, Register in, Label* target_if_cleared);
+
   // ---------------------------------------------------------------------------
   // StatsCounter support
 
@@ -2030,11 +1988,6 @@ class MacroAssembler : public TurboAssembler {
   // (such as %e, %f or %g) are VRegisters, and that arguments for integer
   // placeholders are Registers.
   //
-  // At the moment it is only possible to print the value of csp if it is the
-  // current stack pointer. Otherwise, the MacroAssembler will automatically
-  // update csp on every push (using BumpSystemStackPointer), so determining its
-  // value is difficult.
-  //
   // Format placeholders that refer to more than one argument, or to a specific
   // argument, are not supported. This includes formats like "%1$d" or "%.*d".
   //
@@ -2169,6 +2122,7 @@ class UseScratchRegisterScope {
   Register AcquireX() { return AcquireNextAvailable(available_).X(); }
   VRegister AcquireS() { return AcquireNextAvailable(availablefp_).S(); }
   VRegister AcquireD() { return AcquireNextAvailable(availablefp_).D(); }
+  VRegister AcquireQ() { return AcquireNextAvailable(availablefp_).Q(); }
   VRegister AcquireV(VectorFormat format) {
     return VRegister::Create(AcquireNextAvailable(availablefp_).code(), format);
   }
@@ -2210,7 +2164,7 @@ class InlineSmiCheckInfo {
 
   // Use MacroAssembler::InlineData to emit information about patchable inline
   // SMI checks. The caller may specify 'reg' as NoReg and an unbound 'site' to
-  // indicate that there is no inline SMI check. Note that 'reg' cannot be csp.
+  // indicate that there is no inline SMI check. Note that 'reg' cannot be sp.
   //
   // The generated patch information can be read using the InlineSMICheckInfo
   // class.
@@ -2230,8 +2184,8 @@ class InlineSmiCheckInfo {
 
   // Fields in the data encoded by InlineData.
 
-  // A width of 5 (Rd_width) for the SMI register preclues the use of csp,
-  // since kSPRegInternalCode is 63. However, csp should never hold a SMI or be
+  // A width of 5 (Rd_width) for the SMI register precludes the use of sp,
+  // since kSPRegInternalCode is 63. However, sp should never hold a SMI or be
   // used in a patchable check. The Emit() method checks this.
   //
   // Note that the total size of the fields is restricted by the underlying
diff --git a/deps/v8/src/arm64/simulator-arm64.cc b/deps/v8/src/arm64/simulator-arm64.cc
index d0c464dfbe4..5c72cf1c908 100644
--- a/deps/v8/src/arm64/simulator-arm64.cc
+++ b/deps/v8/src/arm64/simulator-arm64.cc
@@ -626,16 +626,15 @@ void Simulator::DoRuntimeCall(Instruction* instr) {
 }
 
 const char* Simulator::xreg_names[] = {
-    "x0",  "x1",  "x2",  "x3",  "x4",  "x5",  "x6",  "x7",  "x8",
-    "x9",  "x10", "x11", "x12", "x13", "x14", "x15", "ip0", "ip1",
-    "x18", "x19", "x20", "x21", "x22", "x23", "x24", "x25", "x26",
-    "cp",  "x28", "fp",  "lr",  "xzr", "csp"};
+    "x0",  "x1",  "x2",  "x3",  "x4",  "x5",  "x6",  "x7",  "x8",  "x9",  "x10",
+    "x11", "x12", "x13", "x14", "x15", "ip0", "ip1", "x18", "x19", "x20", "x21",
+    "x22", "x23", "x24", "x25", "x26", "cp",  "x28", "fp",  "lr",  "xzr", "sp"};
 
 const char* Simulator::wreg_names[] = {
     "w0",  "w1",  "w2",  "w3",  "w4",  "w5",  "w6",  "w7",  "w8",
     "w9",  "w10", "w11", "w12", "w13", "w14", "w15", "w16", "w17",
     "w18", "w19", "w20", "w21", "w22", "w23", "w24", "w25", "w26",
-    "wcp", "w28", "wfp", "wlr", "wzr", "wcsp"};
+    "wcp", "w28", "wfp", "wlr", "wzr", "wsp"};
 
 const char* Simulator::sreg_names[] = {
 "s0",  "s1",  "s2",  "s3",  "s4",  "s5",  "s6",  "s7",
@@ -768,7 +767,7 @@ int Simulator::CodeFromName(const char* name) {
       return i;
     }
   }
-  if ((strcmp("csp", name) == 0) || (strcmp("wcsp", name) == 0)) {
+  if ((strcmp("sp", name) == 0) || (strcmp("wsp", name) == 0)) {
     return kSPRegInternalCode;
   }
   return -1;
@@ -1450,7 +1449,7 @@ void Simulator::VisitUnconditionalBranch(Instruction* instr) {
   switch (instr->Mask(UnconditionalBranchMask)) {
     case BL:
       set_lr(instr->following());
-      // Fall through.
+      V8_FALLTHROUGH;
     case B:
       set_pc(instr->ImmPCOffsetTarget());
       break;
@@ -1478,7 +1477,7 @@ void Simulator::VisitUnconditionalBranchToRegister(Instruction* instr) {
         // this, but if we do trap to allow debugging.
         Debug();
       }
-      // Fall through.
+      V8_FALLTHROUGH;
     }
     case BR:
     case RET: set_pc(target); break;
@@ -1630,7 +1629,7 @@ void Simulator::LogicalHelper(Instruction* instr, T op2) {
   // Switch on the logical operation, stripping out the NOT bit, as it has a
   // different meaning for logical immediate instructions.
   switch (instr->Mask(LogicalOpMask & ~NOT)) {
-    case ANDS: update_flags = true;  // Fall through.
+    case ANDS: update_flags = true; V8_FALLTHROUGH;
     case AND: result = op1 & op2; break;
     case ORR: result = op1 | op2; break;
     case EOR: result = op1 ^ op2; break;
@@ -2956,7 +2955,9 @@ void Simulator::VisitSystem(Instruction* instr) {
   } else if (instr->Mask(SystemHintFMask) == SystemHintFixed) {
     DCHECK(instr->Mask(SystemHintMask) == HINT);
     switch (instr->ImmHint()) {
-      case NOP: break;
+      case NOP:
+      case CSDB:
+        break;
       default: UNIMPLEMENTED();
     }
   } else if (instr->Mask(MemBarrierFMask) == MemBarrierFixed) {
@@ -2996,15 +2997,15 @@ bool Simulator::GetValue(const char* desc, int64_t* value) {
 
 
 bool Simulator::PrintValue(const char* desc) {
-  if (strcmp(desc, "csp") == 0) {
+  if (strcmp(desc, "sp") == 0) {
     DCHECK(CodeFromName(desc) == static_cast<int>(kSPRegInternalCode));
-    PrintF(stream_, "%s csp:%s 0x%016" PRIx64 "%s\n",
-        clr_reg_name, clr_reg_value, xreg(31, Reg31IsStackPointer), clr_normal);
+    PrintF(stream_, "%s sp:%s 0x%016" PRIx64 "%s\n", clr_reg_name,
+           clr_reg_value, xreg(31, Reg31IsStackPointer), clr_normal);
     return true;
-  } else if (strcmp(desc, "wcsp") == 0) {
+  } else if (strcmp(desc, "wsp") == 0) {
     DCHECK(CodeFromName(desc) == static_cast<int>(kSPRegInternalCode));
-    PrintF(stream_, "%s wcsp:%s 0x%08" PRIx32 "%s\n",
-        clr_reg_name, clr_reg_value, wreg(31, Reg31IsStackPointer), clr_normal);
+    PrintF(stream_, "%s wsp:%s 0x%08" PRIx32 "%s\n", clr_reg_name,
+           clr_reg_value, wreg(31, Reg31IsStackPointer), clr_normal);
     return true;
   }
 
@@ -4396,15 +4397,18 @@ void Simulator::NEONLoadStoreMultiStructHelper(const Instruction* instr,
     case NEON_LD1_4v:
     case NEON_LD1_4v_post:
       ld1(vf, vreg(reg[3]), addr[3]);
-      count++;  // Fall through.
+      count++;
+      V8_FALLTHROUGH;
     case NEON_LD1_3v:
     case NEON_LD1_3v_post:
       ld1(vf, vreg(reg[2]), addr[2]);
-      count++;  // Fall through.
+      count++;
+      V8_FALLTHROUGH;
     case NEON_LD1_2v:
     case NEON_LD1_2v_post:
       ld1(vf, vreg(reg[1]), addr[1]);
-      count++;  // Fall through.
+      count++;
+      V8_FALLTHROUGH;
     case NEON_LD1_1v:
     case NEON_LD1_1v_post:
       ld1(vf, vreg(reg[0]), addr[0]);
@@ -4412,15 +4416,18 @@ void Simulator::NEONLoadStoreMultiStructHelper(const Instruction* instr,
     case NEON_ST1_4v:
     case NEON_ST1_4v_post:
       st1(vf, vreg(reg[3]), addr[3]);
-      count++;  // Fall through.
+      count++;
+      V8_FALLTHROUGH;
     case NEON_ST1_3v:
     case NEON_ST1_3v_post:
       st1(vf, vreg(reg[2]), addr[2]);
-      count++;  // Fall through.
+      count++;
+      V8_FALLTHROUGH;
     case NEON_ST1_2v:
     case NEON_ST1_2v_post:
       st1(vf, vreg(reg[1]), addr[1]);
-      count++;  // Fall through.
+      count++;
+      V8_FALLTHROUGH;
     case NEON_ST1_1v:
     case NEON_ST1_1v_post:
       st1(vf, vreg(reg[0]), addr[0]);
@@ -4533,7 +4540,8 @@ void Simulator::NEONLoadStoreSingleStructHelper(const Instruction* instr,
     case NEON_LD3_b_post:
     case NEON_LD4_b:
     case NEON_LD4_b_post:
-      do_load = true;  // Fall through.
+      do_load = true;
+      V8_FALLTHROUGH;
     case NEON_ST1_b:
     case NEON_ST1_b_post:
     case NEON_ST2_b:
@@ -4552,7 +4560,8 @@ void Simulator::NEONLoadStoreSingleStructHelper(const Instruction* instr,
     case NEON_LD3_h_post:
     case NEON_LD4_h:
     case NEON_LD4_h_post:
-      do_load = true;  // Fall through.
+      do_load = true;
+      V8_FALLTHROUGH;
     case NEON_ST1_h:
     case NEON_ST1_h_post:
     case NEON_ST2_h:
@@ -4572,7 +4581,8 @@ void Simulator::NEONLoadStoreSingleStructHelper(const Instruction* instr,
     case NEON_LD3_s_post:
     case NEON_LD4_s:
     case NEON_LD4_s_post:
-      do_load = true;  // Fall through.
+      do_load = true;
+      V8_FALLTHROUGH;
     case NEON_ST1_s:
     case NEON_ST1_s_post:
     case NEON_ST2_s:
diff --git a/deps/v8/src/arm64/simulator-arm64.h b/deps/v8/src/arm64/simulator-arm64.h
index a8f229d764e..18fa4d44ece 100644
--- a/deps/v8/src/arm64/simulator-arm64.h
+++ b/deps/v8/src/arm64/simulator-arm64.h
@@ -646,6 +646,7 @@ class LogicVRegister {
 class Simulator : public DecoderVisitor, public SimulatorBase {
  public:
   static void SetRedirectInstruction(Instruction* instruction);
+  static bool ICacheMatch(void* one, void* two) { return false; }
   static void FlushICache(base::CustomMatcherHashMap* i_cache, void* start,
                           size_t size) {
     USE(i_cache);
diff --git a/deps/v8/src/asmjs/OWNERS b/deps/v8/src/asmjs/OWNERS
index 8cca6813f21..e8a7f1683b8 100644
--- a/deps/v8/src/asmjs/OWNERS
+++ b/deps/v8/src/asmjs/OWNERS
@@ -3,9 +3,7 @@ set noparent
 ahaas@chromium.org
 bradnelson@chromium.org
 clemensh@chromium.org
-mtrofin@chromium.org
 mstarzinger@chromium.org
-rossberg@chromium.org
 titzer@chromium.org
 
 # COMPONENT: Blink>JavaScript>WebAssembly
diff --git a/deps/v8/src/asmjs/asm-js.cc b/deps/v8/src/asmjs/asm-js.cc
index 5e3d0d0c2a6..4862924badb 100644
--- a/deps/v8/src/asmjs/asm-js.cc
+++ b/deps/v8/src/asmjs/asm-js.cc
@@ -21,8 +21,7 @@
 #include "src/parsing/scanner-character-streams.h"
 #include "src/parsing/scanner.h"
 
-#include "src/wasm/module-compiler.h"
-#include "src/wasm/module-decoder.h"
+#include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-js.h"
 #include "src/wasm/wasm-module-builder.h"
 #include "src/wasm/wasm-objects-inl.h"
@@ -66,18 +65,20 @@ bool AreStdlibMembersValid(Isolate* isolate, Handle<JSReceiver> stdlib,
     Handle<Object> value = JSReceiver::GetDataProperty(stdlib, name);
     if (!value->IsNaN()) return false;
   }
-#define STDLIB_MATH_FUNC(fname, FName, ignore1, ignore2)                   \
-  if (members.Contains(wasm::AsmJsParser::StandardMember::kMath##FName)) { \
-    members.Remove(wasm::AsmJsParser::StandardMember::kMath##FName);       \
-    Handle<Name> name(isolate->factory()->InternalizeOneByteString(        \
-        STATIC_CHAR_VECTOR(#fname)));                                      \
-    Handle<Object> value = StdlibMathMember(isolate, stdlib, name);        \
-    if (!value->IsJSFunction()) return false;                              \
-    Handle<JSFunction> func = Handle<JSFunction>::cast(value);             \
-    if (func->shared()->code() !=                                          \
-        isolate->builtins()->builtin(Builtins::kMath##FName)) {            \
-      return false;                                                        \
-    }                                                                      \
+#define STDLIB_MATH_FUNC(fname, FName, ignore1, ignore2)                    \
+  if (members.Contains(wasm::AsmJsParser::StandardMember::kMath##FName)) {  \
+    members.Remove(wasm::AsmJsParser::StandardMember::kMath##FName);        \
+    Handle<Name> name(isolate->factory()->InternalizeOneByteString(         \
+        STATIC_CHAR_VECTOR(#fname)));                                       \
+    Handle<Object> value = StdlibMathMember(isolate, stdlib, name);         \
+    if (!value->IsJSFunction()) return false;                               \
+    SharedFunctionInfo* shared = Handle<JSFunction>::cast(value)->shared(); \
+    if (!shared->HasBuiltinId() ||                                          \
+        shared->builtin_id() != Builtins::kMath##FName) {                   \
+      return false;                                                         \
+    }                                                                       \
+    DCHECK_EQ(shared->GetCode(),                                            \
+              isolate->builtins()->builtin(Builtins::kMath##FName));        \
   }
   STDLIB_MATH_FUNCTION_LIST(STDLIB_MATH_FUNC)
 #undef STDLIB_MATH_FUNC
@@ -284,11 +285,12 @@ CompilationJob::Status AsmJsCompilationJob::FinalizeJobImpl(Isolate* isolate) {
 
   wasm::ErrorThrower thrower(isolate, "AsmJs::Compile");
   Handle<WasmModuleObject> compiled =
-      SyncCompileTranslatedAsmJs(
-          isolate, &thrower,
-          wasm::ModuleWireBytes(module_->begin(), module_->end()),
-          parse_info()->script(),
-          Vector<const byte>(asm_offsets_->begin(), asm_offsets_->size()))
+      isolate->wasm_engine()
+          ->SyncCompileTranslatedAsmJs(
+              isolate, &thrower,
+              wasm::ModuleWireBytes(module_->begin(), module_->end()),
+              parse_info()->script(),
+              Vector<const byte>(asm_offsets_->begin(), asm_offsets_->size()))
           .ToHandleChecked();
   DCHECK(!thrower.error());
   compile_time_ = compile_timer.Elapsed().InMillisecondsF();
@@ -299,7 +301,6 @@ CompilationJob::Status AsmJsCompilationJob::FinalizeJobImpl(Isolate* isolate) {
   result->set(kWasmDataCompiledModule, *compiled);
   result->set(kWasmDataUsesBitSet, *uses_bitset);
   compilation_info()->SetAsmWasmData(result);
-  compilation_info()->SetCode(BUILTIN_CODE(isolate, InstantiateAsmJs));
 
   RecordHistograms(isolate);
   ReportCompilationSuccess(parse_info()->script(),
@@ -347,7 +348,7 @@ MaybeHandle<Object> AsmJs::InstantiateAsmWasm(Isolate* isolate,
   Handle<Script> script(Script::cast(shared->script()));
   // TODO(mstarzinger): The position currently points to the module definition
   // but should instead point to the instantiation site (more intuitive).
-  int position = shared->start_position();
+  int position = shared->StartPosition();
 
   // Check that all used stdlib members are valid.
   bool stdlib_use_of_typed_array_present = false;
@@ -389,7 +390,8 @@ MaybeHandle<Object> AsmJs::InstantiateAsmWasm(Isolate* isolate,
 
   wasm::ErrorThrower thrower(isolate, "AsmJs::Instantiate");
   MaybeHandle<Object> maybe_module_object =
-      wasm::SyncInstantiate(isolate, &thrower, module, foreign, memory);
+      isolate->wasm_engine()->SyncInstantiate(isolate, &thrower, module,
+                                              foreign, memory);
   if (maybe_module_object.is_null()) {
     // An exception caused by the module start function will be set as pending
     // and bypass the {ErrorThrower}, this happens in case of a stack overflow.
diff --git a/deps/v8/src/asmjs/asm-parser.cc b/deps/v8/src/asmjs/asm-parser.cc
index 6be80bf7afb..f210b42a62e 100644
--- a/deps/v8/src/asmjs/asm-parser.cc
+++ b/deps/v8/src/asmjs/asm-parser.cc
@@ -745,6 +745,12 @@ void AsmJsParser::ValidateFunction() {
 
   CachedVector<AsmType*> params(cached_asm_type_p_vectors_);
   ValidateFunctionParams(&params);
+
+  // Check against limit on number of parameters.
+  if (params.size() >= kV8MaxWasmFunctionParams) {
+    FAIL("Number of parameters exceeds internal limit");
+  }
+
   CachedVector<ValueType> locals(cached_valuetype_vectors_);
   ValidateFunctionLocals(params.size(), &locals);
 
diff --git a/deps/v8/src/asmjs/switch-logic.h b/deps/v8/src/asmjs/switch-logic.h
index 3ef34d94610..f770ddc33d4 100644
--- a/deps/v8/src/asmjs/switch-logic.h
+++ b/deps/v8/src/asmjs/switch-logic.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_ASMJS_SWITCH_LOGIC_H
-#define V8_ASMJS_SWITCH_LOGIC_H
+#ifndef V8_ASMJS_SWITCH_LOGIC_H_
+#define V8_ASMJS_SWITCH_LOGIC_H_
 
 #include "src/globals.h"
 #include "src/zone/zone-containers.h"
@@ -30,4 +30,4 @@ V8_EXPORT_PRIVATE CaseNode* OrderCases(ZoneVector<int>* cases, Zone* zone);
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_ASMJS_SWITCH_LOGIC_H
+#endif  // V8_ASMJS_SWITCH_LOGIC_H_
diff --git a/deps/v8/src/assembler.cc b/deps/v8/src/assembler.cc
index 1b83735bc97..e9542013f5c 100644
--- a/deps/v8/src/assembler.cc
+++ b/deps/v8/src/assembler.cc
@@ -34,112 +34,19 @@
 
 #include "src/assembler.h"
 
-#include <math.h>
-#include <string.h>
-#include <cmath>
-
-#include "src/api.h"
 #include "src/assembler-inl.h"
-#include "src/base/cpu.h"
-#include "src/base/functional.h"
-#include "src/base/ieee754.h"
-#include "src/base/lazy-instance.h"
-#include "src/base/platform/platform.h"
-#include "src/base/utils/random-number-generator.h"
-#include "src/codegen.h"
-#include "src/compiler/code-assembler.h"
-#include "src/counters.h"
-#include "src/debug/debug.h"
+#include "src/code-stubs.h"
 #include "src/deoptimizer.h"
 #include "src/disassembler.h"
-#include "src/elements.h"
-#include "src/execution.h"
-#include "src/ic/ic.h"
-#include "src/ic/stub-cache.h"
-#include "src/interpreter/bytecodes.h"
-#include "src/interpreter/interpreter.h"
+#include "src/instruction-stream.h"
 #include "src/isolate.h"
 #include "src/ostreams.h"
-#include "src/regexp/jsregexp.h"
-#include "src/regexp/regexp-macro-assembler.h"
-#include "src/regexp/regexp-stack.h"
-#include "src/register-configuration.h"
-#include "src/runtime/runtime.h"
 #include "src/simulator.h"  // For flushing instruction cache.
 #include "src/snapshot/serializer-common.h"
-#include "src/string-search.h"
-#include "src/wasm/wasm-external-refs.h"
-
-// Include native regexp-macro-assembler.
-#ifndef V8_INTERPRETED_REGEXP
-#if V8_TARGET_ARCH_IA32
-#include "src/regexp/ia32/regexp-macro-assembler-ia32.h"  // NOLINT
-#elif V8_TARGET_ARCH_X64
-#include "src/regexp/x64/regexp-macro-assembler-x64.h"  // NOLINT
-#elif V8_TARGET_ARCH_ARM64
-#include "src/regexp/arm64/regexp-macro-assembler-arm64.h"  // NOLINT
-#elif V8_TARGET_ARCH_ARM
-#include "src/regexp/arm/regexp-macro-assembler-arm.h"  // NOLINT
-#elif V8_TARGET_ARCH_PPC
-#include "src/regexp/ppc/regexp-macro-assembler-ppc.h"  // NOLINT
-#elif V8_TARGET_ARCH_MIPS
-#include "src/regexp/mips/regexp-macro-assembler-mips.h"  // NOLINT
-#elif V8_TARGET_ARCH_MIPS64
-#include "src/regexp/mips64/regexp-macro-assembler-mips64.h"  // NOLINT
-#elif V8_TARGET_ARCH_S390
-#include "src/regexp/s390/regexp-macro-assembler-s390.h"  // NOLINT
-#else  // Unknown architecture.
-#error "Unknown architecture."
-#endif  // Target architecture.
-#endif  // V8_INTERPRETED_REGEXP
-
-#ifdef V8_INTL_SUPPORT
-#include "src/intl.h"
-#endif  // V8_INTL_SUPPORT
 
 namespace v8 {
 namespace internal {
 
-// -----------------------------------------------------------------------------
-// Common double constants.
-
-struct DoubleConstant BASE_EMBEDDED {
-double min_int;
-double one_half;
-double minus_one_half;
-double negative_infinity;
-uint64_t the_hole_nan;
-double uint32_bias;
-};
-
-static DoubleConstant double_constants;
-
-static struct V8_ALIGNED(16) {
-  uint32_t a;
-  uint32_t b;
-  uint32_t c;
-  uint32_t d;
-} float_absolute_constant = {0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF};
-
-static struct V8_ALIGNED(16) {
-  uint32_t a;
-  uint32_t b;
-  uint32_t c;
-  uint32_t d;
-} float_negate_constant = {0x80000000, 0x80000000, 0x80000000, 0x80000000};
-
-static struct V8_ALIGNED(16) {
-  uint64_t a;
-  uint64_t b;
-} double_absolute_constant = {uint64_t{0x7FFFFFFFFFFFFFFF},
-                              uint64_t{0x7FFFFFFFFFFFFFFF}};
-
-static struct V8_ALIGNED(16) {
-  uint64_t a;
-  uint64_t b;
-} double_negate_constant = {uint64_t{0x8000000000000000},
-                            uint64_t{0x8000000000000000}};
-
 const char* const RelocInfo::kFillerCommentString = "DEOPTIMIZATION PADDING";
 
 // -----------------------------------------------------------------------------
@@ -176,12 +83,12 @@ AssemblerBase::~AssemblerBase() {
   if (own_buffer_) DeleteArray(buffer_);
 }
 
-void AssemblerBase::FlushICache(Isolate* isolate, void* start, size_t size) {
+void AssemblerBase::FlushICache(void* start, size_t size) {
   if (size == 0) return;
 
 #if defined(USE_SIMULATOR)
-  base::LockGuard<base::Mutex> lock_guard(isolate->simulator_i_cache_mutex());
-  Simulator::FlushICache(isolate->simulator_i_cache(), start, size);
+  base::LockGuard<base::Mutex> lock_guard(Simulator::i_cache_mutex());
+  Simulator::FlushICache(Simulator::i_cache(), start, size);
 #else
   CpuFeatures::FlushICache(start, size);
 #endif  // USE_SIMULATOR
@@ -195,9 +102,6 @@ void AssemblerBase::Print(Isolate* isolate) {
 // -----------------------------------------------------------------------------
 // Implementation of PredictableCodeSizeScope
 
-PredictableCodeSizeScope::PredictableCodeSizeScope(AssemblerBase* assembler)
-    : PredictableCodeSizeScope(assembler, -1) {}
-
 PredictableCodeSizeScope::PredictableCodeSizeScope(AssemblerBase* assembler,
                                                    int expected_size)
     : assembler_(assembler),
@@ -208,10 +112,7 @@ PredictableCodeSizeScope::PredictableCodeSizeScope(AssemblerBase* assembler,
 }
 
 PredictableCodeSizeScope::~PredictableCodeSizeScope() {
-  // TODO(svenpanne) Remove the 'if' when everything works.
-  if (expected_size_ >= 0) {
-    CHECK_EQ(expected_size_, assembler_->pc_offset() - start_offset_);
-  }
+  CHECK_EQ(expected_size_, assembler_->pc_offset() - start_offset_);
   assembler_->set_predictable_code_size(old_value_);
 }
 
@@ -301,16 +202,27 @@ const int kLastChunkTagBits = 1;
 const int kLastChunkTagMask = 1;
 const int kLastChunkTag = 1;
 
-void RelocInfo::set_wasm_context_reference(Isolate* isolate, Address address,
+// static
+bool RelocInfo::OffHeapTargetIsCodedSpecially() {
+#if defined(V8_TARGET_ARCH_ARM) || defined(V8_TARGET_ARCH_ARM64) || \
+    defined(V8_TARGET_ARCH_X64) || defined(V8_TARGET_ARCH_IA32)
+  return false;
+#elif defined(V8_TARGET_ARCH_MIPS) || defined(V8_TARGET_ARCH_MIPS64) || \
+    defined(V8_TARGET_ARCH_PPC) || defined(V8_TARGET_ARCH_S390)
+  return true;
+#endif
+}
+
+void RelocInfo::set_wasm_context_reference(Address address,
                                            ICacheFlushMode icache_flush_mode) {
   DCHECK(IsWasmContextReference(rmode_));
-  set_embedded_address(isolate, address, icache_flush_mode);
+  set_embedded_address(address, icache_flush_mode);
 }
 
-void RelocInfo::set_global_handle(Isolate* isolate, Address address,
+void RelocInfo::set_global_handle(Address address,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, WASM_GLOBAL_HANDLE);
-  set_embedded_address(isolate, address, icache_flush_mode);
+  set_embedded_address(address, icache_flush_mode);
 }
 
 Address RelocInfo::wasm_call_address() const {
@@ -318,10 +230,10 @@ Address RelocInfo::wasm_call_address() const {
   return Assembler::target_address_at(pc_, constant_pool_);
 }
 
-void RelocInfo::set_wasm_call_address(Isolate* isolate, Address address,
+void RelocInfo::set_wasm_call_address(Address address,
                                       ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, WASM_CALL);
-  Assembler::set_target_address_at(isolate, pc_, constant_pool_, address,
+  Assembler::set_target_address_at(pc_, constant_pool_, address,
                                    icache_flush_mode);
 }
 
@@ -330,28 +242,16 @@ Address RelocInfo::global_handle() const {
   return embedded_address();
 }
 
-uint32_t RelocInfo::wasm_function_table_size_reference() const {
-  DCHECK(IsWasmFunctionTableSizeReference(rmode_));
-  return embedded_size();
-}
-
 Address RelocInfo::wasm_context_reference() const {
   DCHECK(IsWasmContextReference(rmode_));
   return embedded_address();
 }
 
-void RelocInfo::update_wasm_function_table_size_reference(
-    Isolate* isolate, uint32_t old_size, uint32_t new_size,
-    ICacheFlushMode icache_flush_mode) {
-  DCHECK(IsWasmFunctionTableSizeReference(rmode_));
-  set_embedded_size(isolate, new_size, icache_flush_mode);
-}
-
-void RelocInfo::set_target_address(Isolate* isolate, Address target,
+void RelocInfo::set_target_address(Address target,
                                    WriteBarrierMode write_barrier_mode,
                                    ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_) || IsWasmCall(rmode_));
-  Assembler::set_target_address_at(isolate, pc_, constant_pool_, target,
+  Assembler::set_target_address_at(pc_, constant_pool_, target,
                                    icache_flush_mode);
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr &&
       IsCodeTarget(rmode_)) {
@@ -449,7 +349,6 @@ void RelocInfoWriter::Write(const RelocInfo* rinfo) {
     }
   }
   last_pc_ = rinfo->pc();
-  last_mode_ = rmode;
 #ifdef DEBUG
   DCHECK_LE(begin_pos - pos_, kMaxSize);
 #endif
@@ -561,7 +460,8 @@ void RelocIterator::next() {
   done_ = true;
 }
 
-RelocIterator::RelocIterator(Code* code, int mode_mask) {
+RelocIterator::RelocIterator(Code* code, int mode_mask)
+    : mode_mask_(mode_mask) {
   rinfo_.host_ = code;
   rinfo_.pc_ = code->instruction_start();
   rinfo_.data_ = 0;
@@ -569,35 +469,30 @@ RelocIterator::RelocIterator(Code* code, int mode_mask) {
   // Relocation info is read backwards.
   pos_ = code->relocation_start() + code->relocation_size();
   end_ = code->relocation_start();
-  done_ = false;
-  mode_mask_ = mode_mask;
   if (mode_mask_ == 0) pos_ = end_;
   next();
 }
 
-RelocIterator::RelocIterator(const CodeDesc& desc, int mode_mask) {
+RelocIterator::RelocIterator(const CodeDesc& desc, int mode_mask)
+    : mode_mask_(mode_mask) {
   rinfo_.pc_ = desc.buffer;
-  rinfo_.data_ = 0;
   // Relocation info is read backwards.
   pos_ = desc.buffer + desc.buffer_size;
   end_ = pos_ - desc.reloc_size;
-  done_ = false;
-  mode_mask_ = mode_mask;
   if (mode_mask_ == 0) pos_ = end_;
   next();
 }
 
 RelocIterator::RelocIterator(Vector<byte> instructions,
                              Vector<const byte> reloc_info, Address const_pool,
-                             int mode_mask) {
+                             int mode_mask)
+    : mode_mask_(mode_mask) {
   rinfo_.pc_ = instructions.start();
-  rinfo_.data_ = 0;
   rinfo_.constant_pool_ = const_pool;
+  rinfo_.flags_ = RelocInfo::kInNativeWasmCode;
   // Relocation info is read backwards.
   pos_ = reloc_info.start() + reloc_info.size();
   end_ = reloc_info.start();
-  done_ = false;
-  mode_mask_ = mode_mask;
   if (mode_mask_ == 0) pos_ = end_;
   next();
 }
@@ -606,7 +501,7 @@ RelocIterator::RelocIterator(Vector<byte> instructions,
 // Implementation of RelocInfo
 
 #ifdef DEBUG
-bool RelocInfo::RequiresRelocation(Isolate* isolate, const CodeDesc& desc) {
+bool RelocInfo::RequiresRelocation(const CodeDesc& desc) {
   // Ensure there are no code targets or embedded objects present in the
   // deoptimization entries, they would require relocation after code
   // generation.
@@ -621,10 +516,8 @@ bool RelocInfo::RequiresRelocation(Isolate* isolate, const CodeDesc& desc) {
 #ifdef ENABLE_DISASSEMBLER
 const char* RelocInfo::RelocModeName(RelocInfo::Mode rmode) {
   switch (rmode) {
-    case NONE32:
-      return "no reloc 32";
-    case NONE64:
-      return "no reloc 64";
+    case NONE:
+      return "no reloc";
     case EMBEDDED_OBJECT:
       return "embedded object";
     case CODE_TARGET:
@@ -639,6 +532,8 @@ const char* RelocInfo::RelocModeName(RelocInfo::Mode rmode) {
       return "internal reference";
     case INTERNAL_REFERENCE_ENCODED:
       return "encoded internal reference";
+    case OFF_HEAP_TARGET:
+      return "off heap target";
     case DEOPT_SCRIPT_OFFSET:
       return "deopt script offset";
     case DEOPT_INLINING_ID:
@@ -653,8 +548,6 @@ const char* RelocInfo::RelocModeName(RelocInfo::Mode rmode) {
       return "veneer pool";
     case WASM_CONTEXT_REFERENCE:
       return "wasm context reference";
-    case WASM_FUNCTION_TABLE_SIZE_REFERENCE:
-      return "wasm function table size reference";
     case WASM_GLOBAL_HANDLE:
       return "global handle";
     case WASM_CALL:
@@ -686,9 +579,21 @@ void RelocInfo::Print(Isolate* isolate, std::ostream& os) {  // NOLINT
        << ")  (" << static_cast<const void*>(target_external_reference())
        << ")";
   } else if (IsCodeTarget(rmode_)) {
-    Code* code = Code::GetCodeFromTargetAddress(target_address());
-    os << " (" << Code::Kind2String(code->kind()) << ")  ("
-       << static_cast<const void*>(target_address()) << ")";
+    const Address code_target = target_address();
+    if (flags_ & kInNativeWasmCode) {
+      os << " (wasm trampoline) ";
+    } else {
+      Code* code = Code::GetCodeFromTargetAddress(code_target);
+      DCHECK(code->IsCode());
+      os << " (" << Code::Kind2String(code->kind());
+      if (Builtins::IsBuiltin(code)) {
+        os << " " << Builtins::name(code->builtin_index());
+      } else if (code->kind() == Code::STUB) {
+        os << " " << CodeStub::MajorName(CodeStub::GetMajorKey(code));
+      }
+      os << ") ";
+    }
+    os << " (" << static_cast<const void*>(target_address()) << ")";
   } else if (IsRuntimeEntry(rmode_) && isolate->deoptimizer_data() != nullptr) {
     // Depotimization bailouts are stored as runtime entries.
     int id = Deoptimizer::GetDeoptimizationId(
@@ -730,6 +635,12 @@ void RelocInfo::Verify(Isolate* isolate) {
       CHECK(target <= code->instruction_end());
       break;
     }
+    case OFF_HEAP_TARGET: {
+      Address addr = target_off_heap_target();
+      CHECK_NOT_NULL(addr);
+      CHECK_NOT_NULL(InstructionStream::TryLookupCode(isolate, addr));
+      break;
+    }
     case RUNTIME_ENTRY:
     case COMMENT:
     case EXTERNAL_REFERENCE:
@@ -740,12 +651,10 @@ void RelocInfo::Verify(Isolate* isolate) {
     case CONST_POOL:
     case VENEER_POOL:
     case WASM_CONTEXT_REFERENCE:
-    case WASM_FUNCTION_TABLE_SIZE_REFERENCE:
     case WASM_GLOBAL_HANDLE:
     case WASM_CALL:
     case JS_TO_WASM_CALL:
-    case NONE32:
-    case NONE64:
+    case NONE:
       break;
     case NUMBER_OF_MODES:
     case PC_JUMP:
@@ -755,890 +664,6 @@ void RelocInfo::Verify(Isolate* isolate) {
 }
 #endif  // VERIFY_HEAP
 
-// Implementation of ExternalReference
-
-static ExternalReference::Type BuiltinCallTypeForResultSize(int result_size) {
-  switch (result_size) {
-    case 1:
-      return ExternalReference::BUILTIN_CALL;
-    case 2:
-      return ExternalReference::BUILTIN_CALL_PAIR;
-  }
-  UNREACHABLE();
-}
-
-void ExternalReference::SetUp() {
-  double_constants.min_int = kMinInt;
-  double_constants.one_half = 0.5;
-  double_constants.minus_one_half = -0.5;
-  double_constants.the_hole_nan = kHoleNanInt64;
-  double_constants.negative_infinity = -V8_INFINITY;
-  double_constants.uint32_bias =
-    static_cast<double>(static_cast<uint32_t>(0xFFFFFFFF)) + 1;
-}
-
-ExternalReference::ExternalReference(Address address, Isolate* isolate)
-    : address_(Redirect(isolate, address)) {}
-
-ExternalReference::ExternalReference(
-    ApiFunction* fun, Type type = ExternalReference::BUILTIN_CALL,
-    Isolate* isolate = nullptr)
-    : address_(Redirect(isolate, fun->address(), type)) {}
-
-ExternalReference::ExternalReference(Runtime::FunctionId id, Isolate* isolate)
-    : ExternalReference(Runtime::FunctionForId(id), isolate) {}
-
-ExternalReference::ExternalReference(const Runtime::Function* f,
-                                     Isolate* isolate)
-    : address_(Redirect(isolate, f->entry,
-                        BuiltinCallTypeForResultSize(f->result_size))) {}
-
-ExternalReference ExternalReference::isolate_address(Isolate* isolate) {
-  return ExternalReference(isolate);
-}
-
-ExternalReference ExternalReference::builtins_address(Isolate* isolate) {
-  return ExternalReference(isolate->builtins()->builtins_table_address());
-}
-
-ExternalReference ExternalReference::handle_scope_implementer_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->handle_scope_implementer_address());
-}
-
-ExternalReference ExternalReference::pending_microtask_count_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->pending_microtask_count_address());
-}
-
-ExternalReference ExternalReference::interpreter_dispatch_table_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->interpreter()->dispatch_table_address());
-}
-
-ExternalReference ExternalReference::interpreter_dispatch_counters(
-    Isolate* isolate) {
-  return ExternalReference(
-      isolate->interpreter()->bytecode_dispatch_counters_table());
-}
-
-ExternalReference ExternalReference::bytecode_size_table_address(
-    Isolate* isolate) {
-  return ExternalReference(
-      interpreter::Bytecodes::bytecode_size_table_address());
-}
-
-ExternalReference::ExternalReference(StatsCounter* counter)
-  : address_(reinterpret_cast<Address>(counter->GetInternalPointer())) {}
-
-ExternalReference::ExternalReference(IsolateAddressId id, Isolate* isolate)
-    : address_(isolate->get_address_from_id(id)) {}
-
-ExternalReference::ExternalReference(const SCTableReference& table_ref)
-  : address_(table_ref.address()) {}
-
-ExternalReference ExternalReference::
-    incremental_marking_record_write_function(Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate,
-      FUNCTION_ADDR(IncrementalMarking::RecordWriteFromCode)));
-}
-
-ExternalReference ExternalReference::store_buffer_overflow_function(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate,
-      FUNCTION_ADDR(StoreBuffer::StoreBufferOverflow)));
-}
-
-ExternalReference ExternalReference::delete_handle_scope_extensions(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate,
-      FUNCTION_ADDR(HandleScope::DeleteExtensions)));
-}
-
-ExternalReference ExternalReference::get_date_field_function(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(JSDate::GetField)));
-}
-
-ExternalReference ExternalReference::date_cache_stamp(Isolate* isolate) {
-  return ExternalReference(isolate->date_cache()->stamp_address());
-}
-
-void ExternalReference::set_redirector(
-    Isolate* isolate, ExternalReferenceRedirector* redirector) {
-  // We can't stack them.
-  DCHECK_NULL(isolate->external_reference_redirector());
-  isolate->set_external_reference_redirector(
-      reinterpret_cast<ExternalReferenceRedirectorPointer*>(redirector));
-}
-
-ExternalReference ExternalReference::stress_deopt_count(Isolate* isolate) {
-  return ExternalReference(isolate->stress_deopt_count_address());
-}
-
-ExternalReference ExternalReference::force_slow_path(Isolate* isolate) {
-  return ExternalReference(isolate->force_slow_path_address());
-}
-
-ExternalReference ExternalReference::new_deoptimizer_function(
-    Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(Deoptimizer::New)));
-}
-
-ExternalReference ExternalReference::compute_output_frames_function(
-    Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(Deoptimizer::ComputeOutputFrames)));
-}
-
-ExternalReference ExternalReference::wasm_f32_trunc(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f32_trunc_wrapper)));
-}
-ExternalReference ExternalReference::wasm_f32_floor(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f32_floor_wrapper)));
-}
-ExternalReference ExternalReference::wasm_f32_ceil(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f32_ceil_wrapper)));
-}
-ExternalReference ExternalReference::wasm_f32_nearest_int(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f32_nearest_int_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_f64_trunc(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f64_trunc_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_f64_floor(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f64_floor_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_f64_ceil(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f64_ceil_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_f64_nearest_int(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f64_nearest_int_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_int64_to_float32(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::int64_to_float32_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_uint64_to_float32(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::uint64_to_float32_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_int64_to_float64(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::int64_to_float64_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_uint64_to_float64(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::uint64_to_float64_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_float32_to_int64(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::float32_to_int64_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_float32_to_uint64(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::float32_to_uint64_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_float64_to_int64(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::float64_to_int64_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_float64_to_uint64(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::float64_to_uint64_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_int64_div(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::int64_div_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_int64_mod(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::int64_mod_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_uint64_div(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::uint64_div_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_uint64_mod(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::uint64_mod_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_word32_ctz(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::word32_ctz_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_word64_ctz(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::word64_ctz_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_word32_popcnt(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::word32_popcnt_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_word64_popcnt(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::word64_popcnt_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_word32_rol(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::word32_rol_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_word32_ror(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::word32_ror_wrapper)));
-}
-
-static void f64_acos_wrapper(double* param) {
-  WriteDoubleValue(param, base::ieee754::acos(ReadDoubleValue(param)));
-}
-
-ExternalReference ExternalReference::f64_acos_wrapper_function(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f64_acos_wrapper)));
-}
-
-static void f64_asin_wrapper(double* param) {
-  WriteDoubleValue(param, base::ieee754::asin(ReadDoubleValue(param)));
-}
-
-ExternalReference ExternalReference::f64_asin_wrapper_function(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f64_asin_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_float64_pow(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::float64_pow_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_set_thread_in_wasm_flag(
-    Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::set_thread_in_wasm_flag)));
-}
-
-ExternalReference ExternalReference::wasm_clear_thread_in_wasm_flag(
-    Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::clear_thread_in_wasm_flag)));
-}
-
-static void f64_mod_wrapper(double* param0, double* param1) {
-  WriteDoubleValue(param0,
-                   Modulo(ReadDoubleValue(param0), ReadDoubleValue(param1)));
-}
-
-ExternalReference ExternalReference::f64_mod_wrapper_function(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f64_mod_wrapper)));
-}
-
-ExternalReference ExternalReference::wasm_call_trap_callback_for_testing(
-    Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::call_trap_callback_for_testing)));
-}
-
-ExternalReference ExternalReference::log_enter_external_function(
-    Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(Logger::EnterExternal)));
-}
-
-ExternalReference ExternalReference::log_leave_external_function(
-    Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(Logger::LeaveExternal)));
-}
-
-ExternalReference ExternalReference::roots_array_start(Isolate* isolate) {
-  return ExternalReference(isolate->heap()->roots_array_start());
-}
-
-ExternalReference ExternalReference::allocation_sites_list_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->heap()->allocation_sites_list_address());
-}
-
-ExternalReference ExternalReference::address_of_stack_limit(Isolate* isolate) {
-  return ExternalReference(isolate->stack_guard()->address_of_jslimit());
-}
-
-ExternalReference ExternalReference::address_of_real_stack_limit(
-    Isolate* isolate) {
-  return ExternalReference(isolate->stack_guard()->address_of_real_jslimit());
-}
-
-ExternalReference ExternalReference::address_of_regexp_stack_limit(
-    Isolate* isolate) {
-  return ExternalReference(isolate->regexp_stack()->limit_address());
-}
-
-ExternalReference ExternalReference::store_buffer_top(Isolate* isolate) {
-  return ExternalReference(isolate->heap()->store_buffer_top_address());
-}
-
-ExternalReference ExternalReference::heap_is_marking_flag_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->heap()->IsMarkingFlagAddress());
-}
-
-ExternalReference ExternalReference::new_space_allocation_top_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->heap()->NewSpaceAllocationTopAddress());
-}
-
-ExternalReference ExternalReference::new_space_allocation_limit_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->heap()->NewSpaceAllocationLimitAddress());
-}
-
-ExternalReference ExternalReference::old_space_allocation_top_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->heap()->OldSpaceAllocationTopAddress());
-}
-
-ExternalReference ExternalReference::old_space_allocation_limit_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->heap()->OldSpaceAllocationLimitAddress());
-}
-
-ExternalReference ExternalReference::handle_scope_level_address(
-    Isolate* isolate) {
-  return ExternalReference(HandleScope::current_level_address(isolate));
-}
-
-ExternalReference ExternalReference::handle_scope_next_address(
-    Isolate* isolate) {
-  return ExternalReference(HandleScope::current_next_address(isolate));
-}
-
-ExternalReference ExternalReference::handle_scope_limit_address(
-    Isolate* isolate) {
-  return ExternalReference(HandleScope::current_limit_address(isolate));
-}
-
-ExternalReference ExternalReference::scheduled_exception_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->scheduled_exception_address());
-}
-
-ExternalReference ExternalReference::address_of_pending_message_obj(
-    Isolate* isolate) {
-  return ExternalReference(isolate->pending_message_obj_address());
-}
-
-ExternalReference ExternalReference::address_of_min_int() {
-  return ExternalReference(reinterpret_cast<void*>(&double_constants.min_int));
-}
-
-ExternalReference ExternalReference::address_of_one_half() {
-  return ExternalReference(reinterpret_cast<void*>(&double_constants.one_half));
-}
-
-ExternalReference ExternalReference::address_of_minus_one_half() {
-  return ExternalReference(
-      reinterpret_cast<void*>(&double_constants.minus_one_half));
-}
-
-ExternalReference ExternalReference::address_of_negative_infinity() {
-  return ExternalReference(
-      reinterpret_cast<void*>(&double_constants.negative_infinity));
-}
-
-ExternalReference ExternalReference::address_of_the_hole_nan() {
-  return ExternalReference(
-      reinterpret_cast<void*>(&double_constants.the_hole_nan));
-}
-
-ExternalReference ExternalReference::address_of_uint32_bias() {
-  return ExternalReference(
-      reinterpret_cast<void*>(&double_constants.uint32_bias));
-}
-
-ExternalReference ExternalReference::address_of_float_abs_constant() {
-  return ExternalReference(reinterpret_cast<void*>(&float_absolute_constant));
-}
-
-ExternalReference ExternalReference::address_of_float_neg_constant() {
-  return ExternalReference(reinterpret_cast<void*>(&float_negate_constant));
-}
-
-ExternalReference ExternalReference::address_of_double_abs_constant() {
-  return ExternalReference(reinterpret_cast<void*>(&double_absolute_constant));
-}
-
-ExternalReference ExternalReference::address_of_double_neg_constant() {
-  return ExternalReference(reinterpret_cast<void*>(&double_negate_constant));
-}
-
-ExternalReference ExternalReference::is_profiling_address(Isolate* isolate) {
-  return ExternalReference(isolate->is_profiling_address());
-}
-
-ExternalReference ExternalReference::invoke_function_callback(
-    Isolate* isolate) {
-  Address thunk_address = FUNCTION_ADDR(&InvokeFunctionCallback);
-  ExternalReference::Type thunk_type = ExternalReference::PROFILING_API_CALL;
-  ApiFunction thunk_fun(thunk_address);
-  return ExternalReference(&thunk_fun, thunk_type, isolate);
-}
-
-ExternalReference ExternalReference::invoke_accessor_getter_callback(
-    Isolate* isolate) {
-  Address thunk_address = FUNCTION_ADDR(&InvokeAccessorGetterCallback);
-  ExternalReference::Type thunk_type =
-      ExternalReference::PROFILING_GETTER_CALL;
-  ApiFunction thunk_fun(thunk_address);
-  return ExternalReference(&thunk_fun, thunk_type, isolate);
-}
-
-#ifndef V8_INTERPRETED_REGEXP
-
-ExternalReference ExternalReference::re_check_stack_guard_state(
-    Isolate* isolate) {
-  Address function;
-#if V8_TARGET_ARCH_X64
-  function = FUNCTION_ADDR(RegExpMacroAssemblerX64::CheckStackGuardState);
-#elif V8_TARGET_ARCH_IA32
-  function = FUNCTION_ADDR(RegExpMacroAssemblerIA32::CheckStackGuardState);
-#elif V8_TARGET_ARCH_ARM64
-  function = FUNCTION_ADDR(RegExpMacroAssemblerARM64::CheckStackGuardState);
-#elif V8_TARGET_ARCH_ARM
-  function = FUNCTION_ADDR(RegExpMacroAssemblerARM::CheckStackGuardState);
-#elif V8_TARGET_ARCH_PPC
-  function = FUNCTION_ADDR(RegExpMacroAssemblerPPC::CheckStackGuardState);
-#elif V8_TARGET_ARCH_MIPS
-  function = FUNCTION_ADDR(RegExpMacroAssemblerMIPS::CheckStackGuardState);
-#elif V8_TARGET_ARCH_MIPS64
-  function = FUNCTION_ADDR(RegExpMacroAssemblerMIPS::CheckStackGuardState);
-#elif V8_TARGET_ARCH_S390
-  function = FUNCTION_ADDR(RegExpMacroAssemblerS390::CheckStackGuardState);
-#else
-  UNREACHABLE();
-#endif
-  return ExternalReference(Redirect(isolate, function));
-}
-
-ExternalReference ExternalReference::re_grow_stack(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(NativeRegExpMacroAssembler::GrowStack)));
-}
-
-ExternalReference ExternalReference::re_case_insensitive_compare_uc16(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate,
-      FUNCTION_ADDR(NativeRegExpMacroAssembler::CaseInsensitiveCompareUC16)));
-}
-
-ExternalReference ExternalReference::re_word_character_map() {
-  return ExternalReference(
-      NativeRegExpMacroAssembler::word_character_map_address());
-}
-
-ExternalReference ExternalReference::address_of_static_offsets_vector(
-    Isolate* isolate) {
-  return ExternalReference(
-      reinterpret_cast<Address>(isolate->jsregexp_static_offsets_vector()));
-}
-
-ExternalReference ExternalReference::address_of_regexp_stack_memory_address(
-    Isolate* isolate) {
-  return ExternalReference(
-      isolate->regexp_stack()->memory_address());
-}
-
-ExternalReference ExternalReference::address_of_regexp_stack_memory_size(
-    Isolate* isolate) {
-  return ExternalReference(isolate->regexp_stack()->memory_size_address());
-}
-
-#endif  // V8_INTERPRETED_REGEXP
-
-ExternalReference ExternalReference::ieee754_acos_function(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::acos), BUILTIN_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_acosh_function(Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(base::ieee754::acosh), BUILTIN_FP_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_asin_function(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::asin), BUILTIN_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_asinh_function(Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(base::ieee754::asinh), BUILTIN_FP_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_atan_function(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::atan), BUILTIN_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_atanh_function(Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(base::ieee754::atanh), BUILTIN_FP_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_atan2_function(Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(base::ieee754::atan2), BUILTIN_FP_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_cbrt_function(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(base::ieee754::cbrt),
-                                    BUILTIN_FP_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_cos_function(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::cos), BUILTIN_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_cosh_function(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::cosh), BUILTIN_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_exp_function(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::exp), BUILTIN_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_expm1_function(Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(base::ieee754::expm1), BUILTIN_FP_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_log_function(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::log), BUILTIN_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_log1p_function(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::log1p), BUILTIN_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_log10_function(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::log10), BUILTIN_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_log2_function(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::log2), BUILTIN_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_sin_function(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::sin), BUILTIN_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_sinh_function(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::sinh), BUILTIN_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_tan_function(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::tan), BUILTIN_FP_CALL));
-}
-
-ExternalReference ExternalReference::ieee754_tanh_function(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::tanh), BUILTIN_FP_CALL));
-}
-
-void* libc_memchr(void* string, int character, size_t search_length) {
-  return memchr(string, character, search_length);
-}
-
-ExternalReference ExternalReference::libc_memchr_function(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(libc_memchr)));
-}
-
-void* libc_memcpy(void* dest, const void* src, size_t n) {
-  return memcpy(dest, src, n);
-}
-
-ExternalReference ExternalReference::libc_memcpy_function(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(libc_memcpy)));
-}
-
-void* libc_memmove(void* dest, const void* src, size_t n) {
-  return memmove(dest, src, n);
-}
-
-ExternalReference ExternalReference::libc_memmove_function(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(libc_memmove)));
-}
-
-void* libc_memset(void* dest, int byte, size_t n) {
-  DCHECK_EQ(static_cast<char>(byte), byte);
-  return memset(dest, byte, n);
-}
-
-ExternalReference ExternalReference::libc_memset_function(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(libc_memset)));
-}
-
-ExternalReference ExternalReference::printf_function(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(std::printf)));
-}
-
-template <typename SubjectChar, typename PatternChar>
-ExternalReference ExternalReference::search_string_raw(Isolate* isolate) {
-  auto f = SearchStringRaw<SubjectChar, PatternChar>;
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f)));
-}
-
-ExternalReference ExternalReference::orderedhashmap_gethash_raw(
-    Isolate* isolate) {
-  auto f = OrderedHashMap::GetHash;
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f)));
-}
-
-ExternalReference ExternalReference::get_or_create_hash_raw(Isolate* isolate) {
-  typedef Smi* (*GetOrCreateHash)(Isolate * isolate, Object * key);
-  GetOrCreateHash f = Object::GetOrCreateHash;
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f)));
-}
-
-ExternalReference ExternalReference::jsreceiver_create_identity_hash(
-    Isolate* isolate) {
-  typedef Smi* (*CreateIdentityHash)(Isolate * isolate, JSReceiver * key);
-  CreateIdentityHash f = JSReceiver::CreateIdentityHash;
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f)));
-}
-
-ExternalReference
-ExternalReference::copy_fast_number_jsarray_elements_to_typed_array(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(CopyFastNumberJSArrayElementsToTypedArray)));
-}
-
-ExternalReference ExternalReference::copy_typed_array_elements_to_typed_array(
-    Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(CopyTypedArrayElementsToTypedArray)));
-}
-
-ExternalReference ExternalReference::try_internalize_string_function(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(StringTable::LookupStringIfExists_NoAllocate)));
-}
-
-ExternalReference ExternalReference::check_object_type(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(CheckObjectType)));
-}
-
-#ifdef V8_INTL_SUPPORT
-ExternalReference ExternalReference::intl_convert_one_byte_to_lower(
-    Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(ConvertOneByteToLower)));
-}
-
-ExternalReference ExternalReference::intl_to_latin1_lower_table(
-    Isolate* isolate) {
-  uint8_t* ptr = const_cast<uint8_t*>(ToLatin1LowerTable());
-  return ExternalReference(reinterpret_cast<Address>(ptr));
-}
-#endif  // V8_INTL_SUPPORT
-
-// Explicit instantiations for all combinations of 1- and 2-byte strings.
-template ExternalReference
-ExternalReference::search_string_raw<const uint8_t, const uint8_t>(Isolate*);
-template ExternalReference
-ExternalReference::search_string_raw<const uint8_t, const uc16>(Isolate*);
-template ExternalReference
-ExternalReference::search_string_raw<const uc16, const uint8_t>(Isolate*);
-template ExternalReference
-ExternalReference::search_string_raw<const uc16, const uc16>(Isolate*);
-
-ExternalReference ExternalReference::page_flags(Page* page) {
-  return ExternalReference(reinterpret_cast<Address>(page) +
-                           MemoryChunk::kFlagsOffset);
-}
-
-ExternalReference ExternalReference::ForDeoptEntry(Address entry) {
-  return ExternalReference(entry);
-}
-
-ExternalReference ExternalReference::cpu_features() {
-  DCHECK(CpuFeatures::initialized_);
-  return ExternalReference(&CpuFeatures::supported_);
-}
-
-ExternalReference ExternalReference::promise_hook_or_debug_is_active_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->promise_hook_or_debug_is_active_address());
-}
-
-ExternalReference ExternalReference::debug_is_active_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->debug()->is_active_address());
-}
-
-ExternalReference ExternalReference::debug_hook_on_function_call_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->debug()->hook_on_function_call_address());
-}
-
-ExternalReference ExternalReference::runtime_function_table_address(
-    Isolate* isolate) {
-  return ExternalReference(
-      const_cast<Runtime::Function*>(Runtime::RuntimeFunctionTable(isolate)));
-}
-
-ExternalReference ExternalReference::invalidate_prototype_chains_function(
-    Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(JSObject::InvalidatePrototypeChains)));
-}
-
-double power_helper(Isolate* isolate, double x, double y) {
-  int y_int = static_cast<int>(y);
-  if (y == y_int) {
-    return power_double_int(x, y_int);  // Returns 1 if exponent is 0.
-  }
-  if (y == 0.5) {
-    lazily_initialize_fast_sqrt(isolate);
-    return (std::isinf(x)) ? V8_INFINITY
-                           : fast_sqrt(x + 0.0, isolate);  // Convert -0 to +0.
-  }
-  if (y == -0.5) {
-    lazily_initialize_fast_sqrt(isolate);
-    return (std::isinf(x)) ? 0 : 1.0 / fast_sqrt(x + 0.0,
-                                                 isolate);  // Convert -0 to +0.
-  }
-  return power_double_double(x, y);
-}
-
-// Helper function to compute x^y, where y is known to be an
-// integer. Uses binary decomposition to limit the number of
-// multiplications; see the discussion in "Hacker's Delight" by Henry
-// S. Warren, Jr., figure 11-6, page 213.
-double power_double_int(double x, int y) {
-  double m = (y < 0) ? 1 / x : x;
-  unsigned n = (y < 0) ? -y : y;
-  double p = 1;
-  while (n != 0) {
-    if ((n & 1) != 0) p *= m;
-    m *= m;
-    if ((n & 2) != 0) p *= m;
-    m *= m;
-    n >>= 2;
-  }
-  return p;
-}
-
-double power_double_double(double x, double y) {
-  // The checks for special cases can be dropped in ia32 because it has already
-  // been done in generated code before bailing out here.
-  if (std::isnan(y) || ((x == 1 || x == -1) && std::isinf(y))) {
-    return std::numeric_limits<double>::quiet_NaN();
-  }
-  return Pow(x, y);
-}
-
-double modulo_double_double(double x, double y) { return Modulo(x, y); }
-
-ExternalReference ExternalReference::power_double_double_function(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(isolate,
-                                    FUNCTION_ADDR(power_double_double),
-                                    BUILTIN_FP_FP_CALL));
-}
-
-ExternalReference ExternalReference::mod_two_doubles_operation(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(modulo_double_double), BUILTIN_FP_FP_CALL));
-}
-
-ExternalReference ExternalReference::debug_last_step_action_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->debug()->last_step_action_address());
-}
-
-ExternalReference ExternalReference::debug_suspended_generator_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->debug()->suspended_generator_address());
-}
-
-ExternalReference ExternalReference::debug_restart_fp_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->debug()->restart_fp_address());
-}
-
-ExternalReference ExternalReference::fixed_typed_array_base_data_offset() {
-  return ExternalReference(reinterpret_cast<void*>(
-      FixedTypedArrayBase::kDataOffset - kHeapObjectTag));
-}
-
-bool operator==(ExternalReference lhs, ExternalReference rhs) {
-  return lhs.address() == rhs.address();
-}
-
-bool operator!=(ExternalReference lhs, ExternalReference rhs) {
-  return !(lhs == rhs);
-}
-
-size_t hash_value(ExternalReference reference) {
-  return base::hash<Address>()(reference.address());
-}
-
-std::ostream& operator<<(std::ostream& os, ExternalReference reference) {
-  os << static_cast<const void*>(reference.address());
-  const Runtime::Function* fn = Runtime::FunctionForEntry(reference.address());
-  if (fn) os << "<" << fn->name << ".entry>";
-  return os;
-}
-
 ConstantPoolBuilder::ConstantPoolBuilder(int ptr_reach_bits,
                                          int double_reach_bits) {
   info_[ConstantPoolEntry::INTPTR].entries.reserve(64);
@@ -1877,22 +902,5 @@ void Assembler::RequestHeapObject(HeapObjectRequest request) {
   heap_object_requests_.push_front(request);
 }
 
-namespace {
-int caller_saved_codes[kNumJSCallerSaved];
-}
-
-void SetUpJSCallerSavedCodeData() {
-  int i = 0;
-  for (int r = 0; r < kNumRegs; r++)
-    if ((kJSCallerSaved & (1 << r)) != 0) caller_saved_codes[i++] = r;
-
-  DCHECK_EQ(i, kNumJSCallerSaved);
-}
-
-int JSCallerSavedCode(int n) {
-  DCHECK(0 <= n && n < kNumJSCallerSaved);
-  return caller_saved_codes[n];
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/assembler.h b/deps/v8/src/assembler.h
index 0cebdbc2d70..29f20e3d932 100644
--- a/deps/v8/src/assembler.h
+++ b/deps/v8/src/assembler.h
@@ -37,17 +37,19 @@
 
 #include <forward_list>
 #include <iosfwd>
+#include <map>
 
 #include "src/allocation.h"
-#include "src/builtins/builtins.h"
+#include "src/contexts.h"
 #include "src/deoptimize-reason.h"
 #include "src/double.h"
+#include "src/external-reference.h"
+#include "src/flags.h"
 #include "src/globals.h"
 #include "src/label.h"
-#include "src/log.h"
+#include "src/objects.h"
 #include "src/register-configuration.h"
 #include "src/reglist.h"
-#include "src/runtime/runtime.h"
 
 namespace v8 {
 
@@ -57,15 +59,12 @@ class ApiFunction;
 namespace internal {
 
 // Forward declarations.
+class InstructionStream;
 class Isolate;
+class SCTableReference;
 class SourcePosition;
 class StatsCounter;
 
-void SetUpJSCallerSavedCodeData();
-
-// Return the code of the n-th saved register available to JavaScript.
-int JSCallerSavedCode(int n);
-
 // -----------------------------------------------------------------------------
 // Optimization for far-jmp like instructions that can be replaced by shorter.
 
@@ -162,7 +161,7 @@ class AssemblerBase: public Malloced {
 
   static const int kMinimalBufferSize = 4*KB;
 
-  static void FlushICache(Isolate* isolate, void* start, size_t size);
+  static void FlushICache(void* start, size_t size);
 
  protected:
   // The buffer into which code and relocation info are generated. It could
@@ -220,16 +219,14 @@ class DontEmitDebugCodeScope BASE_EMBEDDED {
 // snapshot and the running VM.
 class PredictableCodeSizeScope {
  public:
-  explicit PredictableCodeSizeScope(AssemblerBase* assembler);
   PredictableCodeSizeScope(AssemblerBase* assembler, int expected_size);
   ~PredictableCodeSizeScope();
-  void ExpectSize(int expected_size) { expected_size_ = expected_size; }
 
  private:
-  AssemblerBase* assembler_;
-  int expected_size_;
-  int start_offset_;
-  bool old_value_;
+  AssemblerBase* const assembler_;
+  int const expected_size_;
+  int const start_offset_;
+  bool const old_value_;
 };
 
 
@@ -252,6 +249,8 @@ class CpuFeatureScope BASE_EMBEDDED {
 #else
   CpuFeatureScope(AssemblerBase* assembler, CpuFeature f,
                   CheckPolicy check = kCheckSupported) {}
+  // Define a destructor to avoid unused variable warnings.
+  ~CpuFeatureScope() {}
 #endif
 };
 
@@ -283,7 +282,7 @@ class CpuFeatures : public AllStatic {
     return (supported_ & (1u << f)) != 0;
   }
 
-  static inline bool SupportsCrankshaft();
+  static inline bool SupportsOptimizer();
 
   static inline bool SupportsWasmSimd128();
 
@@ -341,6 +340,12 @@ enum ICacheFlushMode { FLUSH_ICACHE_IF_NEEDED, SKIP_ICACHE_FLUSH };
 
 class RelocInfo {
  public:
+  enum Flag : uint8_t {
+    kNoFlags = 0,
+    kInNativeWasmCode = 1u << 0,  // Reloc info belongs to native wasm code.
+  };
+  typedef base::Flags<Flag> Flags;
+
   // This string is used to add padding comments to the reloc info in cases
   // where we are not sure to have enough space for patching in during
   // lazy deoptimization. This is the case if we have indirect calls for which
@@ -357,7 +362,7 @@ class RelocInfo {
   // The maximum pc delta that will use the short encoding.
   static const int kMaxSmallPCDelta;
 
-  enum Mode {
+  enum Mode : int8_t {
     // Please note the order is important (see IsCodeTarget, IsGCRelocMode).
     CODE_TARGET,
     EMBEDDED_OBJECT,
@@ -365,7 +370,6 @@ class RelocInfo {
     // wasm code. Everything after WASM_CONTEXT_REFERENCE (inclusive) is not
     // GC'ed.
     WASM_CONTEXT_REFERENCE,
-    WASM_FUNCTION_TABLE_SIZE_REFERENCE,
     WASM_GLOBAL_HANDLE,
     WASM_CALL,
     JS_TO_WASM_CALL,
@@ -379,6 +383,9 @@ class RelocInfo {
     // Encoded internal reference, used only on MIPS, MIPS64 and PPC.
     INTERNAL_REFERENCE_ENCODED,
 
+    // An off-heap instruction stream target. See http://goo.gl/Z2HUiM.
+    OFF_HEAP_TARGET,
+
     // Marks constant and veneer pools. Only used on ARM and ARM64.
     // They use a custom noncompact encoding.
     CONST_POOL,
@@ -395,8 +402,7 @@ class RelocInfo {
 
     // Pseudo-types
     NUMBER_OF_MODES,
-    NONE32,  // never recorded 32-bit value
-    NONE64,  // never recorded 64-bit value
+    NONE,  // never recorded value
 
     FIRST_REAL_RELOC_MODE = CODE_TARGET,
     LAST_REAL_RELOC_MODE = VENEER_POOL,
@@ -456,27 +462,22 @@ class RelocInfo {
   static inline bool IsInternalReferenceEncoded(Mode mode) {
     return mode == INTERNAL_REFERENCE_ENCODED;
   }
-  static inline bool IsNone(Mode mode) {
-    return mode == NONE32 || mode == NONE64;
+  static inline bool IsOffHeapTarget(Mode mode) {
+    return mode == OFF_HEAP_TARGET;
   }
+  static inline bool IsNone(Mode mode) { return mode == NONE; }
   static inline bool IsWasmContextReference(Mode mode) {
     return mode == WASM_CONTEXT_REFERENCE;
   }
-  static inline bool IsWasmFunctionTableSizeReference(Mode mode) {
-    return mode == WASM_FUNCTION_TABLE_SIZE_REFERENCE;
-  }
   static inline bool IsWasmReference(Mode mode) {
-    return IsWasmPtrReference(mode) || IsWasmSizeReference(mode);
-  }
-  static inline bool IsWasmSizeReference(Mode mode) {
-    return IsWasmFunctionTableSizeReference(mode);
+    return IsWasmPtrReference(mode);
   }
   static inline bool IsWasmPtrReference(Mode mode) {
     return mode == WASM_CONTEXT_REFERENCE || mode == WASM_GLOBAL_HANDLE ||
            mode == WASM_CALL || mode == JS_TO_WASM_CALL;
   }
 
-  static inline int ModeMask(Mode mode) { return 1 << mode; }
+  static constexpr int ModeMask(Mode mode) { return 1 << mode; }
 
   // Accessors
   byte* pc() const { return pc_; }
@@ -485,6 +486,9 @@ class RelocInfo {
   intptr_t data() const { return data_; }
   Code* host() const { return host_; }
   Address constant_pool() const { return constant_pool_; }
+  void set_constant_pool(Address constant_pool) {
+    constant_pool_ = constant_pool;
+  }
 
   // Apply a relocation by delta bytes. When the code object is moved, PC
   // relative addresses have to be updated as well as absolute addresses
@@ -497,36 +501,33 @@ class RelocInfo {
   // instructions).
   bool IsCodedSpecially();
 
+  // The static pendant to IsCodedSpecially, just for off-heap targets. Used
+  // during deserialization, when we don't actually have a RelocInfo handy.
+  static bool OffHeapTargetIsCodedSpecially();
+
   // If true, the pointer this relocation info refers to is an entry in the
   // constant pool, otherwise the pointer is embedded in the instruction stream.
   bool IsInConstantPool();
 
   Address wasm_context_reference() const;
-  uint32_t wasm_function_table_size_reference() const;
   Address global_handle() const;
   Address js_to_wasm_address() const;
   Address wasm_call_address() const;
 
   void set_wasm_context_reference(
-      Isolate* isolate, Address address,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
-  void update_wasm_function_table_size_reference(
-      Isolate* isolate, uint32_t old_base, uint32_t new_base,
+      Address address,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
   void set_target_address(
-      Isolate* isolate, Address target,
+      Address target,
       WriteBarrierMode write_barrier_mode = UPDATE_WRITE_BARRIER,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
-  void set_global_handle(
-      Isolate* isolate, Address address,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
+  void set_global_handle(Address address, ICacheFlushMode icache_flush_mode =
+                                              FLUSH_ICACHE_IF_NEEDED);
   void set_wasm_call_address(
-      Isolate*, Address,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
+      Address, ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
   void set_js_to_wasm_address(
-      Isolate*, Address,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
+      Address, ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
   // this relocation applies to;
   // can only be called if IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_)
@@ -539,9 +540,10 @@ class RelocInfo {
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED));
   INLINE(Address target_runtime_entry(Assembler* origin));
   INLINE(void set_target_runtime_entry(
-      Isolate* isolate, Address target,
+      Address target,
       WriteBarrierMode write_barrier_mode = UPDATE_WRITE_BARRIER,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED));
+  INLINE(Address target_off_heap_target());
   INLINE(Cell* target_cell());
   INLINE(Handle<Cell> target_cell_handle());
   INLINE(void set_target_cell(
@@ -585,15 +587,15 @@ class RelocInfo {
 
   // Wipe out a relocation to a fixed value, used for making snapshots
   // reproducible.
-  INLINE(void WipeOut(Isolate* isolate));
+  INLINE(void WipeOut());
 
   template <typename ObjectVisitor>
-  inline void Visit(Isolate* isolate, ObjectVisitor* v);
+  inline void Visit(ObjectVisitor* v);
 
 #ifdef DEBUG
   // Check whether the given code contains relocation information that
   // either is position-relative or movable by the garbage collector.
-  static bool RequiresRelocation(Isolate* isolate, const CodeDesc& desc);
+  static bool RequiresRelocation(const CodeDesc& desc);
 #endif
 
 #ifdef ENABLE_DISASSEMBLER
@@ -609,10 +611,8 @@ class RelocInfo {
   static const int kApplyMask;  // Modes affected by apply.  Depends on arch.
 
  private:
-  void set_embedded_address(Isolate* isolate, Address address,
-                            ICacheFlushMode flush_mode);
-  void set_embedded_size(Isolate* isolate, uint32_t size,
-                         ICacheFlushMode flush_mode);
+  void set_embedded_address(Address address, ICacheFlushMode flush_mode);
+  void set_embedded_size(uint32_t size, ICacheFlushMode flush_mode);
 
   uint32_t embedded_size() const;
   Address embedded_address() const;
@@ -623,9 +623,10 @@ class RelocInfo {
   // comment).
   byte* pc_;
   Mode rmode_;
-  intptr_t data_;
+  intptr_t data_ = 0;
   Code* host_;
   Address constant_pool_ = nullptr;
+  Flags flags_;
   friend class RelocIterator;
 };
 
@@ -635,7 +636,6 @@ class RelocInfo {
 class RelocInfoWriter BASE_EMBEDDED {
  public:
   RelocInfoWriter() : pos_(nullptr), last_pc_(nullptr) {}
-  RelocInfoWriter(byte* pos, byte* pc) : pos_(pos), last_pc_(pc) {}
 
   byte* pos() const { return pos_; }
   byte* last_pc() const { return last_pc_; }
@@ -651,10 +651,7 @@ class RelocInfoWriter BASE_EMBEDDED {
 
   // Max size (bytes) of a written RelocInfo. Longest encoding is
   // ExtraTag, VariableLengthPCJump, ExtraTag, pc_delta, data_delta.
-  // On ia32 and arm this is 1 + 4 + 1 + 1 + 4 = 11.
-  // On x64 this is 1 + 4 + 1 + 1 + 8 == 15;
-  // Here we use the maximum of the two.
-  static const int kMaxSize = 15;
+  static constexpr int kMaxSize = 1 + 4 + 1 + 1 + kPointerSize;
 
  private:
   inline uint32_t WriteLongPCJump(uint32_t pc_delta);
@@ -669,7 +666,6 @@ class RelocInfoWriter BASE_EMBEDDED {
 
   byte* pos_;
   byte* last_pc_;
-  RelocInfo::Mode last_mode_;
 
   DISALLOW_COPY_AND_ASSIGN(RelocInfoWriter);
 };
@@ -733,362 +729,12 @@ class RelocIterator: public Malloced {
   const byte* pos_;
   const byte* end_;
   RelocInfo rinfo_;
-  bool done_;
-  int mode_mask_;
-  DISALLOW_COPY_AND_ASSIGN(RelocIterator);
-};
-
-
-//------------------------------------------------------------------------------
-// External function
-
-//----------------------------------------------------------------------------
-class SCTableReference;
-class Debug_Address;
-
-
-// An ExternalReference represents a C++ address used in the generated
-// code. All references to C++ functions and variables must be encapsulated in
-// an ExternalReference instance. This is done in order to track the origin of
-// all external references in the code so that they can be bound to the correct
-// addresses when deserializing a heap.
-class ExternalReference BASE_EMBEDDED {
- public:
-  // Used in the simulator to support different native api calls.
-  enum Type {
-    // Builtin call.
-    // Object* f(v8::internal::Arguments).
-    BUILTIN_CALL,  // default
-
-    // Builtin call returning object pair.
-    // ObjectPair f(v8::internal::Arguments).
-    BUILTIN_CALL_PAIR,
-
-    // Builtin that takes float arguments and returns an int.
-    // int f(double, double).
-    BUILTIN_COMPARE_CALL,
-
-    // Builtin call that returns floating point.
-    // double f(double, double).
-    BUILTIN_FP_FP_CALL,
-
-    // Builtin call that returns floating point.
-    // double f(double).
-    BUILTIN_FP_CALL,
-
-    // Builtin call that returns floating point.
-    // double f(double, int).
-    BUILTIN_FP_INT_CALL,
-
-    // Direct call to API function callback.
-    // void f(v8::FunctionCallbackInfo&)
-    DIRECT_API_CALL,
-
-    // Call to function callback via InvokeFunctionCallback.
-    // void f(v8::FunctionCallbackInfo&, v8::FunctionCallback)
-    PROFILING_API_CALL,
-
-    // Direct call to accessor getter callback.
-    // void f(Local<Name> property, PropertyCallbackInfo& info)
-    DIRECT_GETTER_CALL,
-
-    // Call to accessor getter callback via InvokeAccessorGetterCallback.
-    // void f(Local<Name> property, PropertyCallbackInfo& info,
-    //     AccessorNameGetterCallback callback)
-    PROFILING_GETTER_CALL
-  };
-
-  static void SetUp();
-
-  // These functions must use the isolate in a thread-safe way.
-  typedef void* ExternalReferenceRedirector(Isolate* isolate, void* original,
-                                            Type type);
-
-  ExternalReference() : address_(nullptr) {}
-
-  ExternalReference(Address address, Isolate* isolate);
-
-  ExternalReference(ApiFunction* ptr, Type type, Isolate* isolate);
-
-  ExternalReference(Runtime::FunctionId id, Isolate* isolate);
-
-  ExternalReference(const Runtime::Function* f, Isolate* isolate);
-
-  explicit ExternalReference(StatsCounter* counter);
-
-  ExternalReference(IsolateAddressId id, Isolate* isolate);
-
-  explicit ExternalReference(const SCTableReference& table_ref);
-
-  // Isolate as an external reference.
-  static ExternalReference isolate_address(Isolate* isolate);
-
-  // The builtins table as an external reference, used by lazy deserialization.
-  static ExternalReference builtins_address(Isolate* isolate);
-
-  static ExternalReference handle_scope_implementer_address(Isolate* isolate);
-  static ExternalReference pending_microtask_count_address(Isolate* isolate);
-
-  // One-of-a-kind references. These references are not part of a general
-  // pattern. This means that they have to be added to the
-  // ExternalReferenceTable in serialize.cc manually.
-
-  static ExternalReference interpreter_dispatch_table_address(Isolate* isolate);
-  static ExternalReference interpreter_dispatch_counters(Isolate* isolate);
-  static ExternalReference bytecode_size_table_address(Isolate* isolate);
-
-  static ExternalReference incremental_marking_record_write_function(
-      Isolate* isolate);
-  static ExternalReference store_buffer_overflow_function(
-      Isolate* isolate);
-  static ExternalReference delete_handle_scope_extensions(Isolate* isolate);
-
-  static ExternalReference get_date_field_function(Isolate* isolate);
-  static ExternalReference date_cache_stamp(Isolate* isolate);
-
-  // Deoptimization support.
-  static ExternalReference new_deoptimizer_function(Isolate* isolate);
-  static ExternalReference compute_output_frames_function(Isolate* isolate);
-
-  static ExternalReference wasm_f32_trunc(Isolate* isolate);
-  static ExternalReference wasm_f32_floor(Isolate* isolate);
-  static ExternalReference wasm_f32_ceil(Isolate* isolate);
-  static ExternalReference wasm_f32_nearest_int(Isolate* isolate);
-  static ExternalReference wasm_f64_trunc(Isolate* isolate);
-  static ExternalReference wasm_f64_floor(Isolate* isolate);
-  static ExternalReference wasm_f64_ceil(Isolate* isolate);
-  static ExternalReference wasm_f64_nearest_int(Isolate* isolate);
-  static ExternalReference wasm_int64_to_float32(Isolate* isolate);
-  static ExternalReference wasm_uint64_to_float32(Isolate* isolate);
-  static ExternalReference wasm_int64_to_float64(Isolate* isolate);
-  static ExternalReference wasm_uint64_to_float64(Isolate* isolate);
-  static ExternalReference wasm_float32_to_int64(Isolate* isolate);
-  static ExternalReference wasm_float32_to_uint64(Isolate* isolate);
-  static ExternalReference wasm_float64_to_int64(Isolate* isolate);
-  static ExternalReference wasm_float64_to_uint64(Isolate* isolate);
-  static ExternalReference wasm_int64_div(Isolate* isolate);
-  static ExternalReference wasm_int64_mod(Isolate* isolate);
-  static ExternalReference wasm_uint64_div(Isolate* isolate);
-  static ExternalReference wasm_uint64_mod(Isolate* isolate);
-  static ExternalReference wasm_word32_ctz(Isolate* isolate);
-  static ExternalReference wasm_word64_ctz(Isolate* isolate);
-  static ExternalReference wasm_word32_popcnt(Isolate* isolate);
-  static ExternalReference wasm_word64_popcnt(Isolate* isolate);
-  static ExternalReference wasm_word32_rol(Isolate* isolate);
-  static ExternalReference wasm_word32_ror(Isolate* isolate);
-  static ExternalReference wasm_float64_pow(Isolate* isolate);
-  static ExternalReference wasm_set_thread_in_wasm_flag(Isolate* isolate);
-  static ExternalReference wasm_clear_thread_in_wasm_flag(Isolate* isolate);
-
-  static ExternalReference f64_acos_wrapper_function(Isolate* isolate);
-  static ExternalReference f64_asin_wrapper_function(Isolate* isolate);
-  static ExternalReference f64_mod_wrapper_function(Isolate* isolate);
-
-  // Trap callback function for cctest/wasm/wasm-run-utils.h
-  static ExternalReference wasm_call_trap_callback_for_testing(
-      Isolate* isolate);
-
-  // Log support.
-  static ExternalReference log_enter_external_function(Isolate* isolate);
-  static ExternalReference log_leave_external_function(Isolate* isolate);
-
-  // Static variable Heap::roots_array_start()
-  static ExternalReference roots_array_start(Isolate* isolate);
-
-  // Static variable Heap::allocation_sites_list_address()
-  static ExternalReference allocation_sites_list_address(Isolate* isolate);
-
-  // Static variable StackGuard::address_of_jslimit()
-  V8_EXPORT_PRIVATE static ExternalReference address_of_stack_limit(
-      Isolate* isolate);
-
-  // Static variable StackGuard::address_of_real_jslimit()
-  static ExternalReference address_of_real_stack_limit(Isolate* isolate);
-
-  // Static variable RegExpStack::limit_address()
-  static ExternalReference address_of_regexp_stack_limit(Isolate* isolate);
-
-  // Static variables for RegExp.
-  static ExternalReference address_of_static_offsets_vector(Isolate* isolate);
-  static ExternalReference address_of_regexp_stack_memory_address(
-      Isolate* isolate);
-  static ExternalReference address_of_regexp_stack_memory_size(
-      Isolate* isolate);
-
-  // Write barrier.
-  static ExternalReference store_buffer_top(Isolate* isolate);
-  static ExternalReference heap_is_marking_flag_address(Isolate* isolate);
-
-  // Used for fast allocation in generated code.
-  static ExternalReference new_space_allocation_top_address(Isolate* isolate);
-  static ExternalReference new_space_allocation_limit_address(Isolate* isolate);
-  static ExternalReference old_space_allocation_top_address(Isolate* isolate);
-  static ExternalReference old_space_allocation_limit_address(Isolate* isolate);
-
-  static ExternalReference mod_two_doubles_operation(Isolate* isolate);
-  static ExternalReference power_double_double_function(Isolate* isolate);
-
-  static ExternalReference handle_scope_next_address(Isolate* isolate);
-  static ExternalReference handle_scope_limit_address(Isolate* isolate);
-  static ExternalReference handle_scope_level_address(Isolate* isolate);
-
-  static ExternalReference scheduled_exception_address(Isolate* isolate);
-  static ExternalReference address_of_pending_message_obj(Isolate* isolate);
-
-  // Static variables containing common double constants.
-  static ExternalReference address_of_min_int();
-  static ExternalReference address_of_one_half();
-  static ExternalReference address_of_minus_one_half();
-  static ExternalReference address_of_negative_infinity();
-  static ExternalReference address_of_the_hole_nan();
-  static ExternalReference address_of_uint32_bias();
-
-  // Static variables containing simd constants.
-  static ExternalReference address_of_float_abs_constant();
-  static ExternalReference address_of_float_neg_constant();
-  static ExternalReference address_of_double_abs_constant();
-  static ExternalReference address_of_double_neg_constant();
-
-  // IEEE 754 functions.
-  static ExternalReference ieee754_acos_function(Isolate* isolate);
-  static ExternalReference ieee754_acosh_function(Isolate* isolate);
-  static ExternalReference ieee754_asin_function(Isolate* isolate);
-  static ExternalReference ieee754_asinh_function(Isolate* isolate);
-  static ExternalReference ieee754_atan_function(Isolate* isolate);
-  static ExternalReference ieee754_atanh_function(Isolate* isolate);
-  static ExternalReference ieee754_atan2_function(Isolate* isolate);
-  static ExternalReference ieee754_cbrt_function(Isolate* isolate);
-  static ExternalReference ieee754_cos_function(Isolate* isolate);
-  static ExternalReference ieee754_cosh_function(Isolate* isolate);
-  static ExternalReference ieee754_exp_function(Isolate* isolate);
-  static ExternalReference ieee754_expm1_function(Isolate* isolate);
-  static ExternalReference ieee754_log_function(Isolate* isolate);
-  static ExternalReference ieee754_log1p_function(Isolate* isolate);
-  static ExternalReference ieee754_log10_function(Isolate* isolate);
-  static ExternalReference ieee754_log2_function(Isolate* isolate);
-  static ExternalReference ieee754_sin_function(Isolate* isolate);
-  static ExternalReference ieee754_sinh_function(Isolate* isolate);
-  static ExternalReference ieee754_tan_function(Isolate* isolate);
-  static ExternalReference ieee754_tanh_function(Isolate* isolate);
-
-  static ExternalReference libc_memchr_function(Isolate* isolate);
-  static ExternalReference libc_memcpy_function(Isolate* isolate);
-  static ExternalReference libc_memmove_function(Isolate* isolate);
-  static ExternalReference libc_memset_function(Isolate* isolate);
-
-  static ExternalReference printf_function(Isolate* isolate);
+  bool done_ = false;
+  const int mode_mask_;
 
-  static ExternalReference try_internalize_string_function(Isolate* isolate);
-
-  static ExternalReference check_object_type(Isolate* isolate);
-
-#ifdef V8_INTL_SUPPORT
-  static ExternalReference intl_convert_one_byte_to_lower(Isolate* isolate);
-  static ExternalReference intl_to_latin1_lower_table(Isolate* isolate);
-#endif  // V8_INTL_SUPPORT
-
-  template <typename SubjectChar, typename PatternChar>
-  static ExternalReference search_string_raw(Isolate* isolate);
-
-  static ExternalReference orderedhashmap_gethash_raw(Isolate* isolate);
-
-  static ExternalReference get_or_create_hash_raw(Isolate* isolate);
-  static ExternalReference jsreceiver_create_identity_hash(Isolate* isolate);
-
-  static ExternalReference copy_fast_number_jsarray_elements_to_typed_array(
-      Isolate* isolate);
-  static ExternalReference copy_typed_array_elements_to_typed_array(
-      Isolate* isolate);
-
-  static ExternalReference page_flags(Page* page);
-
-  static ExternalReference ForDeoptEntry(Address entry);
-
-  static ExternalReference cpu_features();
-
-  static ExternalReference debug_is_active_address(Isolate* isolate);
-  static ExternalReference debug_hook_on_function_call_address(
-      Isolate* isolate);
-
-  static ExternalReference is_profiling_address(Isolate* isolate);
-  static ExternalReference invoke_function_callback(Isolate* isolate);
-  static ExternalReference invoke_accessor_getter_callback(Isolate* isolate);
-
-  static ExternalReference promise_hook_or_debug_is_active_address(
-      Isolate* isolate);
-
-  V8_EXPORT_PRIVATE static ExternalReference runtime_function_table_address(
-      Isolate* isolate);
-
-  static ExternalReference invalidate_prototype_chains_function(
-      Isolate* isolate);
-
-  Address address() const { return reinterpret_cast<Address>(address_); }
-
-  // Used to read out the last step action of the debugger.
-  static ExternalReference debug_last_step_action_address(Isolate* isolate);
-
-  // Used to check for suspended generator, used for stepping across await call.
-  static ExternalReference debug_suspended_generator_address(Isolate* isolate);
-
-  // Used to store the frame pointer to drop to when restarting a frame.
-  static ExternalReference debug_restart_fp_address(Isolate* isolate);
-
-#ifndef V8_INTERPRETED_REGEXP
-  // C functions called from RegExp generated code.
-
-  // Function NativeRegExpMacroAssembler::CaseInsensitiveCompareUC16()
-  static ExternalReference re_case_insensitive_compare_uc16(Isolate* isolate);
-
-  // Function RegExpMacroAssembler*::CheckStackGuardState()
-  static ExternalReference re_check_stack_guard_state(Isolate* isolate);
-
-  // Function NativeRegExpMacroAssembler::GrowStack()
-  static ExternalReference re_grow_stack(Isolate* isolate);
-
-  // byte NativeRegExpMacroAssembler::word_character_bitmap
-  static ExternalReference re_word_character_map();
-
-#endif
-
-  // This lets you register a function that rewrites all external references.
-  // Used by the ARM simulator to catch calls to external references.
-  static void set_redirector(Isolate* isolate,
-                             ExternalReferenceRedirector* redirector);
-
-  static ExternalReference stress_deopt_count(Isolate* isolate);
-
-  static ExternalReference force_slow_path(Isolate* isolate);
-
-  static ExternalReference fixed_typed_array_base_data_offset();
-
- private:
-  explicit ExternalReference(void* address)
-      : address_(address) {}
-
-  static void* Redirect(Isolate* isolate,
-                        Address address_arg,
-                        Type type = ExternalReference::BUILTIN_CALL) {
-    ExternalReferenceRedirector* redirector =
-        reinterpret_cast<ExternalReferenceRedirector*>(
-            isolate->external_reference_redirector());
-    void* address = reinterpret_cast<void*>(address_arg);
-    void* answer = (redirector == nullptr)
-                       ? address
-                       : (*redirector)(isolate, address, type);
-    return answer;
-  }
-
-  void* address_;
+  DISALLOW_COPY_AND_ASSIGN(RelocIterator);
 };
 
-V8_EXPORT_PRIVATE bool operator==(ExternalReference, ExternalReference);
-bool operator!=(ExternalReference, ExternalReference);
-
-size_t hash_value(ExternalReference);
-
-V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, ExternalReference);
-
 // -----------------------------------------------------------------------------
 // Utility functions
 
@@ -1104,14 +750,18 @@ double power_double_double(double x, double y);
 class ConstantPoolEntry {
  public:
   ConstantPoolEntry() {}
-  ConstantPoolEntry(int position, intptr_t value, bool sharing_ok)
+  ConstantPoolEntry(int position, intptr_t value, bool sharing_ok,
+                    RelocInfo::Mode rmode = RelocInfo::NONE)
       : position_(position),
         merged_index_(sharing_ok ? SHARING_ALLOWED : SHARING_PROHIBITED),
-        value_(value) {}
-  ConstantPoolEntry(int position, Double value)
+        value_(value),
+        rmode_(rmode) {}
+  ConstantPoolEntry(int position, Double value,
+                    RelocInfo::Mode rmode = RelocInfo::NONE)
       : position_(position),
         merged_index_(SHARING_ALLOWED),
-        value64_(value.AsUint64()) {}
+        value64_(value.AsUint64()),
+        rmode_(rmode) {}
 
   int position() const { return position_; }
   bool sharing_ok() const { return merged_index_ != SHARING_PROHIBITED; }
@@ -1135,6 +785,7 @@ class ConstantPoolEntry {
   }
   intptr_t value() const { return value_; }
   uint64_t value64() const { return value64_; }
+  RelocInfo::Mode rmode() const { return rmode_; }
 
   enum Type { INTPTR, DOUBLE, NUMBER_OF_TYPES };
 
@@ -1151,6 +802,9 @@ class ConstantPoolEntry {
     intptr_t value_;
     uint64_t value64_;
   };
+  // TODO(leszeks): The way we use this, it could probably be packed into
+  // merged_index_ if size is a concern.
+  RelocInfo::Mode rmode_;
   enum { SHARING_PROHIBITED = -2, SHARING_ALLOWED = -1 };
 };
 
diff --git a/deps/v8/src/ast/OWNERS b/deps/v8/src/ast/OWNERS
index ece6b5048a5..32362199aee 100644
--- a/deps/v8/src/ast/OWNERS
+++ b/deps/v8/src/ast/OWNERS
@@ -6,7 +6,6 @@ littledan@chromium.org
 marja@chromium.org
 mstarzinger@chromium.org
 neis@chromium.org
-rossberg@chromium.org
 verwaest@chromium.org
 
 # COMPONENT: Blink>JavaScript>Language
diff --git a/deps/v8/src/ast/ast-function-literal-id-reindexer.h b/deps/v8/src/ast/ast-function-literal-id-reindexer.h
index 837595f41be..400196da689 100644
--- a/deps/v8/src/ast/ast-function-literal-id-reindexer.h
+++ b/deps/v8/src/ast/ast-function-literal-id-reindexer.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_AST_AST_FUNCTION_LITERAL_ID_REINDEXER
-#define V8_AST_AST_FUNCTION_LITERAL_ID_REINDEXER
+#ifndef V8_AST_AST_FUNCTION_LITERAL_ID_REINDEXER_H_
+#define V8_AST_AST_FUNCTION_LITERAL_ID_REINDEXER_H_
 
 #include "src/ast/ast-traversal-visitor.h"
 #include "src/base/macros.h"
@@ -33,4 +33,4 @@ class AstFunctionLiteralIdReindexer final
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_AST_AST_FUNCTION_LITERAL_ID_REINDEXER
+#endif  // V8_AST_AST_FUNCTION_LITERAL_ID_REINDEXER_H_
diff --git a/deps/v8/src/ast/ast-numbering.cc b/deps/v8/src/ast/ast-numbering.cc
deleted file mode 100644
index ade1a85349e..00000000000
--- a/deps/v8/src/ast/ast-numbering.cc
+++ /dev/null
@@ -1,410 +0,0 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/ast/ast-numbering.h"
-
-#include "src/ast/ast.h"
-#include "src/ast/scopes.h"
-#include "src/compiler.h"
-#include "src/objects-inl.h"
-
-namespace v8 {
-namespace internal {
-
-class AstNumberingVisitor final : public AstVisitor<AstNumberingVisitor> {
- public:
-  AstNumberingVisitor(uintptr_t stack_limit, Zone* zone,
-                      Compiler::EagerInnerFunctionLiterals* eager_literals)
-      : zone_(zone), eager_literals_(eager_literals), suspend_count_(0) {
-    InitializeAstVisitor(stack_limit);
-  }
-
-  bool Renumber(FunctionLiteral* node);
-
- private:
-// AST node visitor interface.
-#define DEFINE_VISIT(type) void Visit##type(type* node);
-  AST_NODE_LIST(DEFINE_VISIT)
-#undef DEFINE_VISIT
-
-  void VisitSuspend(Suspend* node);
-
-  void VisitStatementsAndDeclarations(Block* node);
-  void VisitStatements(ZoneList<Statement*>* statements);
-  void VisitDeclarations(Declaration::List* declarations);
-  void VisitArguments(ZoneList<Expression*>* arguments);
-  void VisitLiteralProperty(LiteralProperty* property);
-
-  Zone* zone() const { return zone_; }
-
-  Zone* zone_;
-  Compiler::EagerInnerFunctionLiterals* eager_literals_;
-  int suspend_count_;
-  FunctionKind function_kind_;
-
-  DEFINE_AST_VISITOR_SUBCLASS_MEMBERS();
-  DISALLOW_COPY_AND_ASSIGN(AstNumberingVisitor);
-};
-
-void AstNumberingVisitor::VisitVariableDeclaration(VariableDeclaration* node) {
-  VisitVariableProxy(node->proxy());
-}
-
-void AstNumberingVisitor::VisitEmptyStatement(EmptyStatement* node) {
-}
-
-void AstNumberingVisitor::VisitSloppyBlockFunctionStatement(
-    SloppyBlockFunctionStatement* node) {
-  Visit(node->statement());
-}
-
-void AstNumberingVisitor::VisitContinueStatement(ContinueStatement* node) {
-}
-
-void AstNumberingVisitor::VisitBreakStatement(BreakStatement* node) {
-}
-
-void AstNumberingVisitor::VisitDebuggerStatement(DebuggerStatement* node) {
-}
-
-void AstNumberingVisitor::VisitNativeFunctionLiteral(
-    NativeFunctionLiteral* node) {
-}
-
-void AstNumberingVisitor::VisitDoExpression(DoExpression* node) {
-  Visit(node->block());
-  Visit(node->result());
-}
-
-void AstNumberingVisitor::VisitLiteral(Literal* node) {
-}
-
-void AstNumberingVisitor::VisitRegExpLiteral(RegExpLiteral* node) {
-}
-
-void AstNumberingVisitor::VisitVariableProxy(VariableProxy* node) {
-}
-
-void AstNumberingVisitor::VisitThisFunction(ThisFunction* node) {
-}
-
-void AstNumberingVisitor::VisitSuperPropertyReference(
-    SuperPropertyReference* node) {
-  Visit(node->this_var());
-  Visit(node->home_object());
-}
-
-void AstNumberingVisitor::VisitSuperCallReference(SuperCallReference* node) {
-  Visit(node->this_var());
-  Visit(node->new_target_var());
-  Visit(node->this_function_var());
-}
-
-void AstNumberingVisitor::VisitExpressionStatement(ExpressionStatement* node) {
-  Visit(node->expression());
-}
-
-void AstNumberingVisitor::VisitReturnStatement(ReturnStatement* node) {
-  Visit(node->expression());
-}
-
-void AstNumberingVisitor::VisitSuspend(Suspend* node) {
-  node->set_suspend_id(suspend_count_);
-  suspend_count_++;
-  Visit(node->expression());
-}
-
-void AstNumberingVisitor::VisitYield(Yield* node) { VisitSuspend(node); }
-
-void AstNumberingVisitor::VisitYieldStar(YieldStar* node) {
-  node->set_suspend_id(suspend_count_++);
-  if (IsAsyncGeneratorFunction(function_kind_)) {
-    node->set_await_iterator_close_suspend_id(suspend_count_++);
-    node->set_await_delegated_iterator_output_suspend_id(suspend_count_++);
-  }
-  Visit(node->expression());
-}
-
-void AstNumberingVisitor::VisitAwait(Await* node) { VisitSuspend(node); }
-
-void AstNumberingVisitor::VisitThrow(Throw* node) {
-  Visit(node->exception());
-}
-
-void AstNumberingVisitor::VisitUnaryOperation(UnaryOperation* node) {
-  Visit(node->expression());
-}
-
-void AstNumberingVisitor::VisitCountOperation(CountOperation* node) {
-  Visit(node->expression());
-}
-
-void AstNumberingVisitor::VisitBlock(Block* node) {
-  VisitStatementsAndDeclarations(node);
-}
-
-void AstNumberingVisitor::VisitStatementsAndDeclarations(Block* node) {
-  Scope* scope = node->scope();
-  DCHECK(scope == nullptr || !scope->HasBeenRemoved());
-  if (scope) VisitDeclarations(scope->declarations());
-  VisitStatements(node->statements());
-}
-
-void AstNumberingVisitor::VisitFunctionDeclaration(FunctionDeclaration* node) {
-  VisitVariableProxy(node->proxy());
-  VisitFunctionLiteral(node->fun());
-}
-
-void AstNumberingVisitor::VisitCallRuntime(CallRuntime* node) {
-  VisitArguments(node->arguments());
-}
-
-void AstNumberingVisitor::VisitWithStatement(WithStatement* node) {
-  Visit(node->expression());
-  Visit(node->statement());
-}
-
-void AstNumberingVisitor::VisitDoWhileStatement(DoWhileStatement* node) {
-  node->set_first_suspend_id(suspend_count_);
-  Visit(node->body());
-  Visit(node->cond());
-  node->set_suspend_count(suspend_count_ - node->first_suspend_id());
-}
-
-void AstNumberingVisitor::VisitWhileStatement(WhileStatement* node) {
-  node->set_first_suspend_id(suspend_count_);
-  Visit(node->cond());
-  Visit(node->body());
-  node->set_suspend_count(suspend_count_ - node->first_suspend_id());
-}
-
-void AstNumberingVisitor::VisitTryCatchStatement(TryCatchStatement* node) {
-  DCHECK(node->scope() == nullptr || !node->scope()->HasBeenRemoved());
-  Visit(node->try_block());
-  Visit(node->catch_block());
-}
-
-void AstNumberingVisitor::VisitTryFinallyStatement(TryFinallyStatement* node) {
-  Visit(node->try_block());
-  Visit(node->finally_block());
-}
-
-void AstNumberingVisitor::VisitProperty(Property* node) {
-  Visit(node->key());
-  Visit(node->obj());
-}
-
-void AstNumberingVisitor::VisitResolvedProperty(ResolvedProperty* node) {
-  Visit(node->object());
-  Visit(node->property());
-}
-
-void AstNumberingVisitor::VisitAssignment(Assignment* node) {
-  Visit(node->target());
-  Visit(node->value());
-}
-
-void AstNumberingVisitor::VisitCompoundAssignment(CompoundAssignment* node) {
-  VisitBinaryOperation(node->binary_operation());
-  VisitAssignment(node);
-}
-
-void AstNumberingVisitor::VisitBinaryOperation(BinaryOperation* node) {
-  Visit(node->left());
-  Visit(node->right());
-}
-
-void AstNumberingVisitor::VisitNaryOperation(NaryOperation* node) {
-  Visit(node->first());
-  for (size_t i = 0; i < node->subsequent_length(); ++i) {
-    Visit(node->subsequent(i));
-  }
-}
-
-void AstNumberingVisitor::VisitCompareOperation(CompareOperation* node) {
-  Visit(node->left());
-  Visit(node->right());
-}
-
-void AstNumberingVisitor::VisitSpread(Spread* node) {
-  Visit(node->expression());
-}
-
-void AstNumberingVisitor::VisitEmptyParentheses(EmptyParentheses* node) {
-  UNREACHABLE();
-}
-
-void AstNumberingVisitor::VisitGetIterator(GetIterator* node) {
-  Visit(node->iterable());
-}
-
-void AstNumberingVisitor::VisitGetTemplateObject(GetTemplateObject* node) {}
-
-void AstNumberingVisitor::VisitImportCallExpression(
-    ImportCallExpression* node) {
-  Visit(node->argument());
-}
-
-void AstNumberingVisitor::VisitForInStatement(ForInStatement* node) {
-  Visit(node->enumerable());  // Not part of loop.
-  node->set_first_suspend_id(suspend_count_);
-  Visit(node->each());
-  Visit(node->body());
-  node->set_suspend_count(suspend_count_ - node->first_suspend_id());
-}
-
-void AstNumberingVisitor::VisitForOfStatement(ForOfStatement* node) {
-  Visit(node->assign_iterator());  // Not part of loop.
-  Visit(node->assign_next());
-  node->set_first_suspend_id(suspend_count_);
-  Visit(node->next_result());
-  Visit(node->result_done());
-  Visit(node->assign_each());
-  Visit(node->body());
-  node->set_suspend_count(suspend_count_ - node->first_suspend_id());
-}
-
-void AstNumberingVisitor::VisitConditional(Conditional* node) {
-  Visit(node->condition());
-  Visit(node->then_expression());
-  Visit(node->else_expression());
-}
-
-void AstNumberingVisitor::VisitIfStatement(IfStatement* node) {
-  Visit(node->condition());
-  Visit(node->then_statement());
-  if (node->HasElseStatement()) {
-    Visit(node->else_statement());
-  }
-}
-
-void AstNumberingVisitor::VisitSwitchStatement(SwitchStatement* node) {
-  Visit(node->tag());
-  for (CaseClause* clause : *node->cases()) {
-    if (!clause->is_default()) Visit(clause->label());
-    VisitStatements(clause->statements());
-  }
-}
-
-void AstNumberingVisitor::VisitForStatement(ForStatement* node) {
-  if (node->init() != nullptr) Visit(node->init());  // Not part of loop.
-  node->set_first_suspend_id(suspend_count_);
-  if (node->cond() != nullptr) Visit(node->cond());
-  if (node->next() != nullptr) Visit(node->next());
-  Visit(node->body());
-  node->set_suspend_count(suspend_count_ - node->first_suspend_id());
-}
-
-void AstNumberingVisitor::VisitClassLiteral(ClassLiteral* node) {
-  if (node->extends()) Visit(node->extends());
-  if (node->constructor()) Visit(node->constructor());
-  if (node->static_fields_initializer() != nullptr) {
-    Visit(node->static_fields_initializer());
-  }
-  if (node->instance_fields_initializer_function() != nullptr) {
-    Visit(node->instance_fields_initializer_function());
-  }
-  for (int i = 0; i < node->properties()->length(); i++) {
-    VisitLiteralProperty(node->properties()->at(i));
-  }
-}
-
-void AstNumberingVisitor::VisitInitializeClassFieldsStatement(
-    InitializeClassFieldsStatement* node) {
-  for (int i = 0; i < node->fields()->length(); i++) {
-    VisitLiteralProperty(node->fields()->at(i));
-  }
-}
-
-void AstNumberingVisitor::VisitObjectLiteral(ObjectLiteral* node) {
-  for (int i = 0; i < node->properties()->length(); i++) {
-    VisitLiteralProperty(node->properties()->at(i));
-  }
-}
-
-void AstNumberingVisitor::VisitLiteralProperty(LiteralProperty* node) {
-  Visit(node->key());
-  Visit(node->value());
-}
-
-void AstNumberingVisitor::VisitArrayLiteral(ArrayLiteral* node) {
-  for (int i = 0; i < node->values()->length(); i++) {
-    Visit(node->values()->at(i));
-  }
-}
-
-void AstNumberingVisitor::VisitCall(Call* node) {
-  Visit(node->expression());
-  VisitArguments(node->arguments());
-}
-
-void AstNumberingVisitor::VisitCallNew(CallNew* node) {
-  Visit(node->expression());
-  VisitArguments(node->arguments());
-}
-
-void AstNumberingVisitor::VisitStatements(ZoneList<Statement*>* statements) {
-  if (statements == nullptr) return;
-  for (int i = 0; i < statements->length(); i++) {
-    Visit(statements->at(i));
-    if (statements->at(i)->IsJump()) break;
-  }
-}
-
-void AstNumberingVisitor::VisitDeclarations(Declaration::List* decls) {
-  for (Declaration* decl : *decls) Visit(decl);
-}
-
-void AstNumberingVisitor::VisitArguments(ZoneList<Expression*>* arguments) {
-  for (int i = 0; i < arguments->length(); i++) {
-    Visit(arguments->at(i));
-  }
-}
-
-void AstNumberingVisitor::VisitFunctionLiteral(FunctionLiteral* node) {
-  if (node->ShouldEagerCompile()) {
-    if (eager_literals_) {
-      eager_literals_->Add(new (zone())
-                               ThreadedListZoneEntry<FunctionLiteral*>(node));
-    }
-
-    // If the function literal is being eagerly compiled, recurse into the
-    // declarations and body of the function literal.
-    if (!AstNumbering::Renumber(stack_limit_, zone_, node, eager_literals_)) {
-      SetStackOverflow();
-      return;
-    }
-  }
-}
-
-void AstNumberingVisitor::VisitRewritableExpression(
-    RewritableExpression* node) {
-  Visit(node->expression());
-}
-
-bool AstNumberingVisitor::Renumber(FunctionLiteral* node) {
-  DeclarationScope* scope = node->scope();
-  DCHECK(!scope->HasBeenRemoved());
-  function_kind_ = node->kind();
-
-  VisitDeclarations(scope->declarations());
-  VisitStatements(node->body());
-
-  node->set_suspend_count(suspend_count_);
-
-  return !HasStackOverflow();
-}
-
-bool AstNumbering::Renumber(
-    uintptr_t stack_limit, Zone* zone, FunctionLiteral* function,
-    Compiler::EagerInnerFunctionLiterals* eager_literals) {
-  DisallowHeapAllocation no_allocation;
-  DisallowHandleAllocation no_handles;
-  DisallowHandleDereference no_deref;
-
-  AstNumberingVisitor visitor(stack_limit, zone, eager_literals);
-  return visitor.Renumber(function);
-}
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/ast/ast-numbering.h b/deps/v8/src/ast/ast-numbering.h
deleted file mode 100644
index 11122803b80..00000000000
--- a/deps/v8/src/ast/ast-numbering.h
+++ /dev/null
@@ -1,55 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_AST_AST_NUMBERING_H_
-#define V8_AST_AST_NUMBERING_H_
-
-#include <stdint.h>
-
-namespace v8 {
-namespace internal {
-
-// Forward declarations.
-class FunctionLiteral;
-class Isolate;
-class Zone;
-template <typename T>
-class ThreadedList;
-template <typename T>
-class ThreadedListZoneEntry;
-template <typename T>
-class ZoneVector;
-
-namespace AstNumbering {
-// Assign bailout IDs, and generator suspend IDs to an AST node tree; perform
-// catch prediction for TryStatements. If |eager_literals| is non-null, adds any
-// eager inner literal functions into it.
-bool Renumber(
-    uintptr_t stack_limit, Zone* zone, FunctionLiteral* function,
-    ThreadedList<ThreadedListZoneEntry<FunctionLiteral*>>* eager_literals);
-}
-
-// Some details on suspend IDs
-// -------------------------
-//
-// In order to assist Ignition in generating bytecode for a generator function,
-// we assign a unique number (the suspend ID) to each Suspend node in its AST.
-// We also annotate loops with the number of suspends they contain
-// (loop.suspend_count) and the smallest ID of those (loop.first_suspend_id),
-// and we annotate the function itself with the number of suspends it contains
-// (function.suspend_count).
-//
-// The way in which we choose the IDs is simply by enumerating the Suspend
-// nodes.
-// Ignition relies on the following properties:
-// - For each loop l and each suspend y of l:
-//     l.first_suspend_id  <=
-//         s.suspend_id  < l.first_suspend_id + l.suspend_count
-// - For the generator function f itself and each suspend s of f:
-//                    0  <=  s.suspend_id  <  f.suspend_count
-
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_AST_AST_NUMBERING_H_
diff --git a/deps/v8/src/ast/ast-traversal-visitor.h b/deps/v8/src/ast/ast-traversal-visitor.h
index 3679ec762ae..35432fa6476 100644
--- a/deps/v8/src/ast/ast-traversal-visitor.h
+++ b/deps/v8/src/ast/ast-traversal-visitor.h
@@ -517,6 +517,15 @@ void AstTraversalVisitor<Subclass>::VisitSpread(Spread* expr) {
   RECURSE_EXPRESSION(Visit(expr->expression()));
 }
 
+template <class Subclass>
+void AstTraversalVisitor<Subclass>::VisitStoreInArrayLiteral(
+    StoreInArrayLiteral* expr) {
+  PROCESS_EXPRESSION(expr);
+  RECURSE_EXPRESSION(Visit(expr->array()));
+  RECURSE_EXPRESSION(Visit(expr->index()));
+  RECURSE_EXPRESSION(Visit(expr->value()));
+}
+
 template <class Subclass>
 void AstTraversalVisitor<Subclass>::VisitEmptyParentheses(
     EmptyParentheses* expr) {
@@ -535,6 +544,15 @@ void AstTraversalVisitor<Subclass>::VisitGetTemplateObject(
   PROCESS_EXPRESSION(expr);
 }
 
+template <class Subclass>
+void AstTraversalVisitor<Subclass>::VisitTemplateLiteral(
+    TemplateLiteral* expr) {
+  PROCESS_EXPRESSION(expr);
+  for (Expression* sub : *expr->substitutions()) {
+    RECURSE_EXPRESSION(Visit(sub));
+  }
+}
+
 template <class Subclass>
 void AstTraversalVisitor<Subclass>::VisitImportCallExpression(
     ImportCallExpression* expr) {
diff --git a/deps/v8/src/ast/ast.cc b/deps/v8/src/ast/ast.cc
index da14d874759..2856abb40c4 100644
--- a/deps/v8/src/ast/ast.cc
+++ b/deps/v8/src/ast/ast.cc
@@ -311,7 +311,7 @@ ClassLiteralProperty::ClassLiteralProperty(Expression* key, Expression* value,
     : LiteralProperty(key, value, is_computed_name),
       kind_(kind),
       is_static_(is_static),
-      computed_name_var_(nullptr) {}
+      private_or_computed_name_var_(nullptr) {}
 
 bool ObjectLiteral::Property::IsCompileTimeValue() const {
   return kind_ == CONSTANT ||
@@ -683,8 +683,8 @@ Handle<TemplateObjectDescription> GetTemplateObject::GetOrBuildDescription(
       }
     }
   }
-  return isolate->factory()->NewTemplateObjectDescription(
-      this->hash(), raw_strings, cooked_strings);
+  return isolate->factory()->NewTemplateObjectDescription(raw_strings,
+                                                          cooked_strings);
 }
 
 static bool IsCommutativeOperationWithSmiLiteral(Token::Value op) {
diff --git a/deps/v8/src/ast/ast.h b/deps/v8/src/ast/ast.h
index f608621d3b1..41431eadb01 100644
--- a/deps/v8/src/ast/ast.h
+++ b/deps/v8/src/ast/ast.h
@@ -97,8 +97,10 @@ namespace internal {
   V(ResolvedProperty)           \
   V(RewritableExpression)       \
   V(Spread)                     \
+  V(StoreInArrayLiteral)        \
   V(SuperCallReference)         \
   V(SuperPropertyReference)     \
+  V(TemplateLiteral)            \
   V(ThisFunction)               \
   V(Throw)                      \
   V(UnaryOperation)             \
@@ -437,21 +439,12 @@ class IterationStatement : public BreakableStatement {
 
   ZoneList<const AstRawString*>* labels() const { return labels_; }
 
-  int suspend_count() const { return suspend_count_; }
-  int first_suspend_id() const { return first_suspend_id_; }
-  void set_suspend_count(int suspend_count) { suspend_count_ = suspend_count; }
-  void set_first_suspend_id(int first_suspend_id) {
-    first_suspend_id_ = first_suspend_id;
-  }
-
  protected:
   IterationStatement(ZoneList<const AstRawString*>* labels, int pos,
                      NodeType type)
       : BreakableStatement(TARGET_FOR_ANONYMOUS, pos, type),
         labels_(labels),
-        body_(nullptr),
-        suspend_count_(0),
-        first_suspend_id_(0) {}
+        body_(nullptr) {}
   void Initialize(Statement* body) { body_ = body; }
 
   static const uint8_t kNextBitFieldIndex =
@@ -460,8 +453,6 @@ class IterationStatement : public BreakableStatement {
  private:
   ZoneList<const AstRawString*>* labels_;
   Statement* body_;
-  int suspend_count_;
-  int first_suspend_id_;
 };
 
 
@@ -1486,6 +1477,7 @@ class ArrayLiteral final : public AggregateLiteral {
   ZoneList<Expression*>* values_;
 };
 
+enum class HoleCheckMode { kRequired, kElided };
 
 class VariableProxy final : public Expression {
  public:
@@ -1540,6 +1532,11 @@ class VariableProxy final : public Expression {
         HoleCheckModeField::update(bit_field_, HoleCheckMode::kRequired);
   }
 
+  bool is_private_field() const { return IsPrivateField::decode(bit_field_); }
+  void set_is_private_field() {
+    bit_field_ = IsPrivateField::update(bit_field_, true);
+  }
+
   // Bind this proxy to the variable var.
   void BindTo(Variable* var);
 
@@ -1559,7 +1556,8 @@ class VariableProxy final : public Expression {
     bit_field_ |= IsThisField::encode(variable_kind == THIS_VARIABLE) |
                   IsAssignedField::encode(false) |
                   IsResolvedField::encode(false) |
-                  HoleCheckModeField::encode(HoleCheckMode::kElided);
+                  HoleCheckModeField::encode(HoleCheckMode::kElided) |
+                  IsPrivateField::encode(false);
   }
 
   explicit VariableProxy(const VariableProxy* copy_from);
@@ -1571,6 +1569,7 @@ class VariableProxy final : public Expression {
   class IsNewTargetField : public BitField<bool, IsResolvedField::kNext, 1> {};
   class HoleCheckModeField
       : public BitField<HoleCheckMode, IsNewTargetField::kNext, 1> {};
+  class IsPrivateField : public BitField<bool, HoleCheckModeField::kNext, 1> {};
 
   union {
     const AstRawString* raw_name_;  // if !is_resolved_
@@ -1590,7 +1589,6 @@ enum LhsKind {
   KEYED_SUPER_PROPERTY
 };
 
-
 class Property final : public Expression {
  public:
   bool IsValidReferenceExpression() const { return true; }
@@ -1950,6 +1948,29 @@ class Spread final : public Expression {
   Expression* expression_;
 };
 
+// The StoreInArrayLiteral node corresponds to the StaInArrayLiteral bytecode.
+// It is used in the rewriting of destructuring assignments that contain an
+// array rest pattern.
+class StoreInArrayLiteral final : public Expression {
+ public:
+  Expression* array() const { return array_; }
+  Expression* index() const { return index_; }
+  Expression* value() const { return value_; }
+
+ private:
+  friend class AstNodeFactory;
+
+  StoreInArrayLiteral(Expression* array, Expression* index, Expression* value,
+                      int position)
+      : Expression(position, kStoreInArrayLiteral),
+        array_(array),
+        index_(index),
+        value_(value) {}
+
+  Expression* array_;
+  Expression* index_;
+  Expression* value_;
+};
 
 class Conditional final : public Expression {
  public:
@@ -2096,11 +2117,6 @@ class Suspend : public Expression {
     return OnAbruptResumeField::decode(bit_field_);
   }
 
-  int suspend_id() const { return suspend_id_; }
-  void set_suspend_id(int id) { suspend_id_ = id; }
-
-  inline bool IsInitialYield() const { return suspend_id_ == 0 && IsYield(); }
-
  private:
   friend class AstNodeFactory;
   friend class Yield;
@@ -2109,11 +2125,10 @@ class Suspend : public Expression {
 
   Suspend(NodeType node_type, Expression* expression, int pos,
           OnAbruptResume on_abrupt_resume)
-      : Expression(pos, node_type), suspend_id_(-1), expression_(expression) {
+      : Expression(pos, node_type), expression_(expression) {
     bit_field_ |= OnAbruptResumeField::encode(on_abrupt_resume);
   }
 
-  int suspend_id_;
   Expression* expression_;
 
   class OnAbruptResumeField
@@ -2128,47 +2143,11 @@ class Yield final : public Suspend {
 };
 
 class YieldStar final : public Suspend {
- public:
-  // In addition to the normal suspend for yield*, a yield* in an async
-  // generator has 2 additional suspends:
-  //   - One for awaiting the iterator result of closing the generator when
-  //     resumed with a "throw" completion, and a throw method is not present
-  //     on the delegated iterator (await_iterator_close_suspend_id)
-  //   - One for awaiting the iterator result yielded by the delegated iterator
-  //     (await_delegated_iterator_output_suspend_id)
-  int await_iterator_close_suspend_id() const {
-    return await_iterator_close_suspend_id_;
-  }
-  void set_await_iterator_close_suspend_id(int id) {
-    await_iterator_close_suspend_id_ = id;
-  }
-
-  int await_delegated_iterator_output_suspend_id() const {
-    return await_delegated_iterator_output_suspend_id_;
-  }
-  void set_await_delegated_iterator_output_suspend_id(int id) {
-    await_delegated_iterator_output_suspend_id_ = id;
-  }
-
-  inline int suspend_count() const {
-    if (await_iterator_close_suspend_id_ != -1) {
-      DCHECK_NE(-1, await_delegated_iterator_output_suspend_id_);
-      return 3;
-    }
-    return 1;
-  }
-
  private:
   friend class AstNodeFactory;
-
   YieldStar(Expression* expression, int pos)
       : Suspend(kYieldStar, expression, pos,
-                Suspend::OnAbruptResume::kNoControl),
-        await_iterator_close_suspend_id_(-1),
-        await_delegated_iterator_output_suspend_id_(-1) {}
-
-  int await_iterator_close_suspend_id_;
-  int await_delegated_iterator_output_suspend_id_;
+                Suspend::OnAbruptResume::kNoControl) {}
 };
 
 class Await final : public Suspend {
@@ -2325,7 +2304,9 @@ class FunctionLiteral final : public Expression {
   void set_suspend_count(int suspend_count) { suspend_count_ = suspend_count; }
 
   int return_position() {
-    return std::max(start_position(), end_position() - (has_braces_ ? 1 : 0));
+    return std::max(
+        start_position(),
+        end_position() - (HasBracesField::decode(bit_field_) ? 1 : 0));
   }
 
   int function_literal_id() const { return function_literal_id_; }
@@ -2361,19 +2342,19 @@ class FunctionLiteral final : public Expression {
         function_length_(function_length),
         function_token_position_(kNoSourcePosition),
         suspend_count_(0),
-        has_braces_(has_braces),
+        function_literal_id_(function_literal_id),
         raw_name_(name ? ast_value_factory->NewConsString(name) : nullptr),
         scope_(scope),
         body_(body),
         raw_inferred_name_(ast_value_factory->empty_cons_string()),
-        function_literal_id_(function_literal_id),
         produced_preparsed_scope_data_(produced_preparsed_scope_data) {
     bit_field_ |= FunctionTypeBits::encode(function_type) |
                   Pretenure::encode(false) |
                   HasDuplicateParameters::encode(has_duplicate_parameters ==
                                                  kHasDuplicateParameters) |
                   DontOptimizeReasonField::encode(BailoutReason::kNoReason) |
-                  RequiresInstanceFieldsInitializer::encode(false);
+                  RequiresInstanceFieldsInitializer::encode(false) |
+                  HasBracesField::encode(has_braces);
     if (eager_compile_hint == kShouldEagerCompile) SetShouldEagerCompile();
     DCHECK_EQ(body == nullptr, expected_property_count < 0);
   }
@@ -2386,20 +2367,21 @@ class FunctionLiteral final : public Expression {
       : public BitField<BailoutReason, HasDuplicateParameters::kNext, 8> {};
   class RequiresInstanceFieldsInitializer
       : public BitField<bool, DontOptimizeReasonField::kNext, 1> {};
+  class HasBracesField
+      : public BitField<bool, RequiresInstanceFieldsInitializer::kNext, 1> {};
 
   int expected_property_count_;
   int parameter_count_;
   int function_length_;
   int function_token_position_;
   int suspend_count_;
-  bool has_braces_;
+  int function_literal_id_;
 
   const AstConsString* raw_name_;
   DeclarationScope* scope_;
   ZoneList<Statement*>* body_;
   const AstConsString* raw_inferred_name_;
   Handle<String> inferred_name_;
-  int function_literal_id_;
   ProducedPreParsedScopeData* produced_preparsed_scope_data_;
 };
 
@@ -2407,14 +2389,29 @@ class FunctionLiteral final : public Expression {
 // about a class literal's properties from the parser to the code generator.
 class ClassLiteralProperty final : public LiteralProperty {
  public:
-  enum Kind : uint8_t { METHOD, GETTER, SETTER, FIELD };
+  enum Kind : uint8_t { METHOD, GETTER, SETTER, PUBLIC_FIELD, PRIVATE_FIELD };
 
   Kind kind() const { return kind_; }
 
   bool is_static() const { return is_static_; }
 
-  void set_computed_name_var(Variable* var) { computed_name_var_ = var; }
-  Variable* computed_name_var() const { return computed_name_var_; }
+  void set_computed_name_var(Variable* var) {
+    DCHECK_EQ(PUBLIC_FIELD, kind());
+    private_or_computed_name_var_ = var;
+  }
+  Variable* computed_name_var() const {
+    DCHECK_EQ(PUBLIC_FIELD, kind());
+    return private_or_computed_name_var_;
+  }
+
+  void set_private_field_name_var(Variable* var) {
+    DCHECK_EQ(PRIVATE_FIELD, kind());
+    private_or_computed_name_var_ = var;
+  }
+  Variable* private_field_name_var() const {
+    DCHECK_EQ(PRIVATE_FIELD, kind());
+    return private_or_computed_name_var_;
+  }
 
  private:
   friend class AstNodeFactory;
@@ -2424,7 +2421,7 @@ class ClassLiteralProperty final : public LiteralProperty {
 
   Kind kind_;
   bool is_static_;
-  Variable* computed_name_var_;
+  Variable* private_or_computed_name_var_;
 };
 
 class InitializeClassFieldsStatement final : public Statement {
@@ -2665,7 +2662,6 @@ class GetTemplateObject final : public Expression {
   const ZoneList<const AstRawString*>* raw_strings() const {
     return raw_strings_;
   }
-  int hash() const { return hash_; }
 
   Handle<TemplateObjectDescription> GetOrBuildDescription(Isolate* isolate);
 
@@ -2673,16 +2669,33 @@ class GetTemplateObject final : public Expression {
   friend class AstNodeFactory;
 
   GetTemplateObject(const ZoneList<const AstRawString*>* cooked_strings,
-                    const ZoneList<const AstRawString*>* raw_strings, int hash,
-                    int pos)
+                    const ZoneList<const AstRawString*>* raw_strings, int pos)
       : Expression(pos, kGetTemplateObject),
         cooked_strings_(cooked_strings),
-        raw_strings_(raw_strings),
-        hash_(hash) {}
+        raw_strings_(raw_strings) {}
 
   const ZoneList<const AstRawString*>* cooked_strings_;
   const ZoneList<const AstRawString*>* raw_strings_;
-  int hash_;
+};
+
+class TemplateLiteral final : public Expression {
+ public:
+  using StringList = ZoneList<const AstRawString*>;
+  using ExpressionList = ZoneList<Expression*>;
+
+  const StringList* string_parts() const { return string_parts_; }
+  const ExpressionList* substitutions() const { return substitutions_; }
+
+ private:
+  friend class AstNodeFactory;
+  TemplateLiteral(const StringList* parts, const ExpressionList* substitutions,
+                  int pos)
+      : Expression(pos, kTemplateLiteral),
+        string_parts_(parts),
+        substitutions_(substitutions) {}
+
+  const StringList* string_parts_;
+  const ExpressionList* substitutions_;
 };
 
 // ----------------------------------------------------------------------------
@@ -3102,6 +3115,12 @@ class AstNodeFactory final BASE_EMBEDDED {
     return new (zone_) Spread(expression, pos, expr_pos);
   }
 
+  StoreInArrayLiteral* NewStoreInArrayLiteral(Expression* array,
+                                              Expression* index,
+                                              Expression* value, int pos) {
+    return new (zone_) StoreInArrayLiteral(array, index, value, pos);
+  }
+
   Conditional* NewConditional(Expression* condition,
                               Expression* then_expression,
                               Expression* else_expression,
@@ -3257,9 +3276,14 @@ class AstNodeFactory final BASE_EMBEDDED {
 
   GetTemplateObject* NewGetTemplateObject(
       const ZoneList<const AstRawString*>* cooked_strings,
-      const ZoneList<const AstRawString*>* raw_strings, int hash, int pos) {
-    return new (zone_)
-        GetTemplateObject(cooked_strings, raw_strings, hash, pos);
+      const ZoneList<const AstRawString*>* raw_strings, int pos) {
+    return new (zone_) GetTemplateObject(cooked_strings, raw_strings, pos);
+  }
+
+  TemplateLiteral* NewTemplateLiteral(
+      const ZoneList<const AstRawString*>* string_parts,
+      const ZoneList<Expression*>* substitutions, int pos) {
+    return new (zone_) TemplateLiteral(string_parts, substitutions, pos);
   }
 
   ImportCallExpression* NewImportCallExpression(Expression* args, int pos) {
diff --git a/deps/v8/src/ast/compile-time-value.h b/deps/v8/src/ast/compile-time-value.h
index e8ded431227..874bc1b32f8 100644
--- a/deps/v8/src/ast/compile-time-value.h
+++ b/deps/v8/src/ast/compile-time-value.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_AST_COMPILE_TIME_VALUE
-#define V8_AST_COMPILE_TIME_VALUE
+#ifndef V8_AST_COMPILE_TIME_VALUE_H_
+#define V8_AST_COMPILE_TIME_VALUE_H_
 
 #include "src/allocation.h"
 #include "src/globals.h"
@@ -43,4 +43,4 @@ class CompileTimeValue : public AllStatic {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_AST_COMPILE_TIME_VALUE
+#endif  // V8_AST_COMPILE_TIME_VALUE_H_
diff --git a/deps/v8/src/ast/prettyprinter.cc b/deps/v8/src/ast/prettyprinter.cc
index 374c8482898..2ca75e3c31e 100644
--- a/deps/v8/src/ast/prettyprinter.cc
+++ b/deps/v8/src/ast/prettyprinter.cc
@@ -442,6 +442,11 @@ void CallPrinter::VisitSpread(Spread* node) {
   Print(")");
 }
 
+void CallPrinter::VisitStoreInArrayLiteral(StoreInArrayLiteral* node) {
+  Find(node->array());
+  Find(node->index());
+  Find(node->value());
+}
 
 void CallPrinter::VisitEmptyParentheses(EmptyParentheses* node) {
   UNREACHABLE();
@@ -466,6 +471,12 @@ void CallPrinter::VisitGetIterator(GetIterator* node) {
 
 void CallPrinter::VisitGetTemplateObject(GetTemplateObject* node) {}
 
+void CallPrinter::VisitTemplateLiteral(TemplateLiteral* node) {
+  for (Expression* substitution : *node->substitutions()) {
+    Find(substitution, true);
+  }
+}
+
 void CallPrinter::VisitImportCallExpression(ImportCallExpression* node) {
   Print("ImportCall(");
   Find(node->argument(), true);
@@ -909,8 +920,6 @@ void AstPrinter::VisitSwitchStatement(SwitchStatement* node) {
 
 void AstPrinter::VisitDoWhileStatement(DoWhileStatement* node) {
   IndentedScope indent(this, "DO", node->position());
-  PrintIndented("SUSPEND COUNT");
-  Print(" %d\n", node->suspend_count());
   PrintLabelsIndented(node->labels());
   PrintIndentedVisit("BODY", node->body());
   PrintIndentedVisit("COND", node->cond());
@@ -919,8 +928,6 @@ void AstPrinter::VisitDoWhileStatement(DoWhileStatement* node) {
 
 void AstPrinter::VisitWhileStatement(WhileStatement* node) {
   IndentedScope indent(this, "WHILE", node->position());
-  PrintIndented("SUSPEND COUNT");
-  Print(" %d\n", node->suspend_count());
   PrintLabelsIndented(node->labels());
   PrintIndentedVisit("COND", node->cond());
   PrintIndentedVisit("BODY", node->body());
@@ -929,8 +936,6 @@ void AstPrinter::VisitWhileStatement(WhileStatement* node) {
 
 void AstPrinter::VisitForStatement(ForStatement* node) {
   IndentedScope indent(this, "FOR", node->position());
-  PrintIndented("SUSPEND COUNT");
-  Print(" %d\n", node->suspend_count());
   PrintLabelsIndented(node->labels());
   if (node->init()) PrintIndentedVisit("INIT", node->init());
   if (node->cond()) PrintIndentedVisit("COND", node->cond());
@@ -941,8 +946,6 @@ void AstPrinter::VisitForStatement(ForStatement* node) {
 
 void AstPrinter::VisitForInStatement(ForInStatement* node) {
   IndentedScope indent(this, "FOR IN", node->position());
-  PrintIndented("SUSPEND COUNT");
-  Print(" %d\n", node->suspend_count());
   PrintIndentedVisit("FOR", node->each());
   PrintIndentedVisit("IN", node->enumerable());
   PrintIndentedVisit("BODY", node->body());
@@ -951,8 +954,6 @@ void AstPrinter::VisitForInStatement(ForInStatement* node) {
 
 void AstPrinter::VisitForOfStatement(ForOfStatement* node) {
   IndentedScope indent(this, "FOR OF", node->position());
-  PrintIndented("SUSPEND COUNT");
-  Print(" %d\n", node->suspend_count());
   PrintIndentedVisit("INIT", node->assign_iterator());
   PrintIndentedVisit("NEXT", node->next_result());
   PrintIndentedVisit("DONE", node->result_done());
@@ -1053,8 +1054,11 @@ void AstPrinter::PrintClassProperties(
       case ClassLiteral::Property::SETTER:
         prop_kind = "SETTER";
         break;
-      case ClassLiteral::Property::FIELD:
-        prop_kind = "FIELD";
+      case ClassLiteral::Property::PUBLIC_FIELD:
+        prop_kind = "PUBLIC FIELD";
+        break;
+      case ClassLiteral::Property::PRIVATE_FIELD:
+        prop_kind = "PRIVATE FIELD";
         break;
     }
     EmbeddedVector<char, 128> buf;
@@ -1208,21 +1212,21 @@ void AstPrinter::VisitCompoundAssignment(CompoundAssignment* node) {
 
 void AstPrinter::VisitYield(Yield* node) {
   EmbeddedVector<char, 128> buf;
-  SNPrintF(buf, "YIELD id %d", node->suspend_id());
+  SNPrintF(buf, "YIELD");
   IndentedScope indent(this, buf.start(), node->position());
   Visit(node->expression());
 }
 
 void AstPrinter::VisitYieldStar(YieldStar* node) {
   EmbeddedVector<char, 128> buf;
-  SNPrintF(buf, "YIELD_STAR id %d", node->suspend_id());
+  SNPrintF(buf, "YIELD_STAR");
   IndentedScope indent(this, buf.start(), node->position());
   Visit(node->expression());
 }
 
 void AstPrinter::VisitAwait(Await* node) {
   EmbeddedVector<char, 128> buf;
-  SNPrintF(buf, "AWAIT id %d", node->suspend_id());
+  SNPrintF(buf, "AWAIT");
   IndentedScope indent(this, buf.start(), node->position());
   Visit(node->expression());
 }
@@ -1232,7 +1236,6 @@ void AstPrinter::VisitThrow(Throw* node) {
   Visit(node->exception());
 }
 
-
 void AstPrinter::VisitProperty(Property* node) {
   EmbeddedVector<char, 128> buf;
   SNPrintF(buf, "PROPERTY");
@@ -1326,6 +1329,12 @@ void AstPrinter::VisitSpread(Spread* node) {
   Visit(node->expression());
 }
 
+void AstPrinter::VisitStoreInArrayLiteral(StoreInArrayLiteral* node) {
+  IndentedScope indent(this, "STORE IN ARRAY LITERAL", node->position());
+  PrintIndentedVisit("ARRAY", node->array());
+  PrintIndentedVisit("INDEX", node->index());
+  PrintIndentedVisit("VALUE", node->value());
+}
 
 void AstPrinter::VisitEmptyParentheses(EmptyParentheses* node) {
   IndentedScope indent(this, "()", node->position());
@@ -1340,6 +1349,19 @@ void AstPrinter::VisitGetTemplateObject(GetTemplateObject* node) {
   IndentedScope indent(this, "GET-TEMPLATE-OBJECT", node->position());
 }
 
+void AstPrinter::VisitTemplateLiteral(TemplateLiteral* node) {
+  IndentedScope indent(this, "TEMPLATE-LITERAL", node->position());
+  const AstRawString* string = node->string_parts()->first();
+  if (!string->IsEmpty()) PrintLiteralIndented("SPAN", string, true);
+  for (int i = 0; i < node->substitutions()->length();) {
+    PrintIndentedVisit("EXPR", node->substitutions()->at(i++));
+    if (i < node->string_parts()->length()) {
+      string = node->string_parts()->at(i);
+      if (!string->IsEmpty()) PrintLiteralIndented("SPAN", string, true);
+    }
+  }
+}
+
 void AstPrinter::VisitImportCallExpression(ImportCallExpression* node) {
   IndentedScope indent(this, "IMPORT-CALL", node->position());
   Visit(node->argument());
diff --git a/deps/v8/src/ast/scopes.cc b/deps/v8/src/ast/scopes.cc
index 8f2f85080cb..2c1355ead14 100644
--- a/deps/v8/src/ast/scopes.cc
+++ b/deps/v8/src/ast/scopes.cc
@@ -643,7 +643,7 @@ void DeclarationScope::AttachOuterScopeInfo(ParseInfo* info, Isolate* isolate) {
   }
 }
 
-void DeclarationScope::Analyze(ParseInfo* info) {
+bool DeclarationScope::Analyze(ParseInfo* info) {
   RuntimeCallTimerScope runtimeTimer(
       info->runtime_call_stats(),
       info->on_background_thread()
@@ -681,7 +681,7 @@ void DeclarationScope::Analyze(ParseInfo* info) {
     info->consumed_preparsed_scope_data()->RestoreScopeAllocationData(scope);
   }
 
-  scope->AllocateVariables(info);
+  if (!scope->AllocateVariables(info)) return false;
 
 #ifdef DEBUG
   if (info->is_native() ? FLAG_print_builtin_scopes : FLAG_print_scopes) {
@@ -691,6 +691,8 @@ void DeclarationScope::Analyze(ParseInfo* info) {
   scope->CheckScopePositions();
   scope->CheckZones();
 #endif
+
+  return true;
 }
 
 void DeclarationScope::DeclareThis(AstValueFactory* ast_value_factory) {
@@ -1342,13 +1344,18 @@ Declaration* Scope::CheckLexDeclarationsConflictingWith(
   return nullptr;
 }
 
-void DeclarationScope::AllocateVariables(ParseInfo* info) {
+bool DeclarationScope::AllocateVariables(ParseInfo* info) {
   // Module variables must be allocated before variable resolution
   // to ensure that UpdateNeedsHoleCheck() can detect import variables.
   if (is_module_scope()) AsModuleScope()->AllocateModuleVariables();
 
-  ResolveVariablesRecursively(info);
+  if (!ResolveVariablesRecursively(info)) {
+    DCHECK(info->pending_error_handler()->has_pending_error());
+    return false;
+  }
   AllocateVariablesRecursively();
+
+  return true;
 }
 
 bool Scope::AllowsLazyParsingWithoutUnresolvedVariables(
@@ -1485,6 +1492,7 @@ void DeclarationScope::ResetAfterPreparsing(AstValueFactory* ast_value_factory,
   unresolved_ = nullptr;
   sloppy_block_function_map_ = nullptr;
   rare_data_ = nullptr;
+  has_rest_ = false;
 
   if (aborted) {
     // Prepare scope for use in the outer zone.
@@ -1811,7 +1819,8 @@ Variable* Scope::NonLocal(const AstRawString* name, VariableMode mode) {
   return var;
 }
 
-Variable* Scope::LookupRecursive(VariableProxy* proxy, Scope* outer_scope_end) {
+Variable* Scope::LookupRecursive(ParseInfo* info, VariableProxy* proxy,
+                                 Scope* outer_scope_end) {
   DCHECK_NE(outer_scope_end, this);
   // Short-cut: whenever we find a debug-evaluate scope, just look everything up
   // dynamically. Debug-evaluate doesn't properly create scope info for the
@@ -1834,6 +1843,15 @@ Variable* Scope::LookupRecursive(VariableProxy* proxy, Scope* outer_scope_end) {
     // We may just be trying to find all free variables. In that case, don't
     // declare them in the outer scope.
     if (!is_script_scope()) return nullptr;
+
+    if (proxy->is_private_field()) {
+      info->pending_error_handler()->ReportMessageAt(
+          proxy->position(), proxy->position() + 1,
+          MessageTemplate::kInvalidPrivateFieldAccess, proxy->raw_name(),
+          kSyntaxError);
+      return nullptr;
+    }
+
     // No binding has been found. Declare a variable on the global object.
     return AsDeclarationScope()->DeclareDynamicGlobal(proxy->raw_name(),
                                                       NORMAL_VARIABLE);
@@ -1841,7 +1859,7 @@ Variable* Scope::LookupRecursive(VariableProxy* proxy, Scope* outer_scope_end) {
 
   DCHECK(!is_script_scope());
 
-  var = outer_scope_->LookupRecursive(proxy, outer_scope_end);
+  var = outer_scope_->LookupRecursive(info, proxy, outer_scope_end);
 
   // The variable could not be resolved statically.
   if (var == nullptr) return var;
@@ -1899,11 +1917,16 @@ Variable* Scope::LookupRecursive(VariableProxy* proxy, Scope* outer_scope_end) {
   return var;
 }
 
-void Scope::ResolveVariable(ParseInfo* info, VariableProxy* proxy) {
+bool Scope::ResolveVariable(ParseInfo* info, VariableProxy* proxy) {
   DCHECK(info->script_scope()->is_script_scope());
   DCHECK(!proxy->is_resolved());
-  Variable* var = LookupRecursive(proxy, nullptr);
+  Variable* var = LookupRecursive(info, proxy, nullptr);
+  if (var == nullptr) {
+    DCHECK(proxy->is_private_field());
+    return false;
+  }
   ResolveTo(info, proxy, var);
+  return true;
 }
 
 namespace {
@@ -1983,8 +2006,8 @@ void Scope::ResolveTo(ParseInfo* info, VariableProxy* proxy, Variable* var) {
       // The following variable name may be minified. If so, disable
       // minification in js2c.py for better output.
       Handle<String> name = proxy->raw_name()->string();
-      V8_Fatal(__FILE__, __LINE__, "Unbound variable: '%s' in native script.",
-               name->ToCString().get());
+      FATAL("Unbound variable: '%s' in native script.",
+            name->ToCString().get());
     }
     VariableLocation location = var->location();
     DCHECK(location == VariableLocation::LOCAL ||
@@ -1999,7 +2022,7 @@ void Scope::ResolveTo(ParseInfo* info, VariableProxy* proxy, Variable* var) {
   proxy->BindTo(var);
 }
 
-void Scope::ResolveVariablesRecursively(ParseInfo* info) {
+bool Scope::ResolveVariablesRecursively(ParseInfo* info) {
   DCHECK(info->script_scope()->is_script_scope());
   // Lazy parsed declaration scopes are already partially analyzed. If there are
   // unresolved references remaining, they just need to be resolved in outer
@@ -2008,7 +2031,11 @@ void Scope::ResolveVariablesRecursively(ParseInfo* info) {
     DCHECK_EQ(variables_.occupancy(), 0);
     for (VariableProxy* proxy = unresolved_; proxy != nullptr;
          proxy = proxy->next_unresolved()) {
-      Variable* var = outer_scope()->LookupRecursive(proxy, nullptr);
+      Variable* var = outer_scope()->LookupRecursive(info, proxy, nullptr);
+      if (var == nullptr) {
+        DCHECK(proxy->is_private_field());
+        return false;
+      }
       if (!var->is_dynamic()) {
         var->set_is_used();
         var->ForceContextAllocation();
@@ -2019,15 +2046,16 @@ void Scope::ResolveVariablesRecursively(ParseInfo* info) {
     // Resolve unresolved variables for this scope.
     for (VariableProxy* proxy = unresolved_; proxy != nullptr;
          proxy = proxy->next_unresolved()) {
-      ResolveVariable(info, proxy);
+      if (!ResolveVariable(info, proxy)) return false;
     }
 
     // Resolve unresolved variables for inner scopes.
     for (Scope* scope = inner_scope_; scope != nullptr;
          scope = scope->sibling_) {
-      scope->ResolveVariablesRecursively(info);
+      if (!scope->ResolveVariablesRecursively(info)) return false;
     }
   }
+  return true;
 }
 
 VariableProxy* Scope::FetchFreeVariables(DeclarationScope* max_outer_scope,
@@ -2050,7 +2078,7 @@ VariableProxy* Scope::FetchFreeVariables(DeclarationScope* max_outer_scope,
     next = proxy->next_unresolved();
     DCHECK(!proxy->is_resolved());
     Variable* var =
-        lookup->LookupRecursive(proxy, max_outer_scope->outer_scope());
+        lookup->LookupRecursive(info, proxy, max_outer_scope->outer_scope());
     if (var == nullptr) {
       proxy->set_next_unresolved(stack);
       stack = proxy;
diff --git a/deps/v8/src/ast/scopes.h b/deps/v8/src/ast/scopes.h
index d2e88863199..2ffaaf67528 100644
--- a/deps/v8/src/ast/scopes.h
+++ b/deps/v8/src/ast/scopes.h
@@ -587,10 +587,11 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
   // scope, and stopping when reaching the outer_scope_end scope. If the code is
   // executed because of a call to 'eval', the context parameter should be set
   // to the calling context of 'eval'.
-  Variable* LookupRecursive(VariableProxy* proxy, Scope* outer_scope_end);
+  Variable* LookupRecursive(ParseInfo* info, VariableProxy* proxy,
+                            Scope* outer_scope_end);
   void ResolveTo(ParseInfo* info, VariableProxy* proxy, Variable* var);
-  void ResolveVariable(ParseInfo* info, VariableProxy* proxy);
-  void ResolveVariablesRecursively(ParseInfo* info);
+  MUST_USE_RESULT bool ResolveVariable(ParseInfo* info, VariableProxy* proxy);
+  MUST_USE_RESULT bool ResolveVariablesRecursively(ParseInfo* info);
 
   // Finds free variables of this scope. This mutates the unresolved variables
   // list along the way, so full resolution cannot be done afterwards.
@@ -849,7 +850,12 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
   // Compute top scope and allocate variables. For lazy compilation the top
   // scope only contains the single lazily compiled function, so this
   // doesn't re-allocate variables repeatedly.
-  static void Analyze(ParseInfo* info);
+  //
+  // Returns false if private fields can not be resolved and
+  // ParseInfo's pending_error_handler will be populated with an
+  // error. Otherwise, returns true.
+  MUST_USE_RESULT
+  static bool Analyze(ParseInfo* info);
 
   // To be called during parsing. Do just enough scope analysis that we can
   // discard the Scope contents for lazily compiled functions. In particular,
@@ -920,7 +926,9 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
   // In the case of code compiled and run using 'eval', the context
   // parameter is the context in which eval was called.  In all other
   // cases the context parameter is an empty handle.
-  void AllocateVariables(ParseInfo* info);
+  //
+  // Returns false if private fields can not be resolved.
+  bool AllocateVariables(ParseInfo* info);
 
   void SetDefaults();
 
diff --git a/deps/v8/src/bailout-reason.h b/deps/v8/src/bailout-reason.h
index c8e81c69d42..d29693e3f8a 100644
--- a/deps/v8/src/bailout-reason.h
+++ b/deps/v8/src/bailout-reason.h
@@ -26,11 +26,13 @@ namespace internal {
     "The function_data field should be a BytecodeArray on interpreter entry")  \
   V(kInputStringTooLong, "Input string too long")                              \
   V(kInvalidBytecode, "Invalid bytecode")                                      \
+  V(kInvalidBytecodeAdvance, "Cannot advance current bytecode, ")              \
   V(kInvalidElementsKindForInternalArrayOrInternalPackedArray,                 \
     "Invalid ElementsKind for InternalArray or InternalPackedArray")           \
   V(kInvalidHandleScopeLevel, "Invalid HandleScope level")                     \
   V(kInvalidJumpTableIndex, "Invalid jump table index")                        \
   V(kInvalidRegisterFileInGenerator, "invalid register file in generator")     \
+  V(kInvalidSharedFunctionInfoData, "Invalid SharedFunctionInfo data")         \
   V(kMissingBytecodeArray, "Missing bytecode array from function")             \
   V(kObjectNotTagged, "The object is not tagged")                              \
   V(kObjectTagged, "The object is tagged")                                     \
@@ -38,11 +40,14 @@ namespace internal {
   V(kOperandIsASmi, "Operand is a smi")                                        \
   V(kOperandIsASmiAndNotABoundFunction,                                        \
     "Operand is a smi and not a bound function")                               \
+  V(kOperandIsASmiAndNotAConstructor,                                          \
+    "Operand is a smi and not a constructor")                                  \
   V(kOperandIsASmiAndNotAFixedArray, "Operand is a smi and not a fixed array") \
   V(kOperandIsASmiAndNotAFunction, "Operand is a smi and not a function")      \
   V(kOperandIsASmiAndNotAGeneratorObject,                                      \
     "Operand is a smi and not a generator object")                             \
   V(kOperandIsNotABoundFunction, "Operand is not a bound function")            \
+  V(kOperandIsNotAConstructor, "Operand is not a constructor")                 \
   V(kOperandIsNotAFixedArray, "Operand is not a fixed array")                  \
   V(kOperandIsNotAFunction, "Operand is not a function")                       \
   V(kOperandIsNotAGeneratorObject, "Operand is not a generator object")        \
@@ -55,8 +60,6 @@ namespace internal {
     "Should not directly enter OSR-compiled function")                         \
   V(kStackAccessBelowStackPointer, "Stack access below stack pointer")         \
   V(kStackFrameTypesMustMatch, "Stack frame types must match")                 \
-  V(kTheCurrentStackPointerIsBelowCsp,                                         \
-    "The current stack pointer is below csp")                                  \
   V(kTheStackWasCorruptedByMacroAssemblerCall,                                 \
     "The stack was corrupted by MacroAssembler::Call()")                       \
   V(kUnalignedCellInWriteBarrier, "Unaligned cell in write barrier")           \
@@ -89,6 +92,7 @@ namespace internal {
     "Wrong address or value passed to RecordWrite")                            \
   V(kWrongArgumentCountForInvokeIntrinsic,                                     \
     "Wrong number of arguments for intrinsic")                                 \
+  V(kWrongFunctionCodeStart, "Wrong value in code start register passed")      \
   V(kWrongFunctionContext, "Wrong context passed to function")
 
 #define BAILOUT_MESSAGES_LIST(V)                                            \
@@ -100,6 +104,7 @@ namespace internal {
     "Cyclic object state detected by escape analysis")                      \
   V(kFunctionBeingDebugged, "Function is being debugged")                   \
   V(kGraphBuildingFailed, "Optimized graph construction failed")            \
+  V(kFunctionTooBig, "Function is too big to be optimized")                 \
   V(kLiveEdit, "LiveEdit")                                                  \
   V(kNativeFunctionLiteral, "Native function literal")                      \
   V(kNotEnoughVirtualRegistersRegalloc,                                     \
diff --git a/deps/v8/src/base.isolate b/deps/v8/src/base.isolate
deleted file mode 100644
index d482d75cfb8..00000000000
--- a/deps/v8/src/base.isolate
+++ /dev/null
@@ -1,39 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'includes': [
-    '../third_party/icu/icu.isolate',
-
-    # MSVS runtime libraries.
-    '../gypfiles/win/msvs_dependencies.isolate',
-  ],
-  'conditions': [
-    ['v8_use_snapshot=="true" and v8_use_external_startup_data==1', {
-      'variables': {
-        'files': [
-          '<(PRODUCT_DIR)/natives_blob.bin',
-          '<(PRODUCT_DIR)/snapshot_blob.bin',
-        ],
-      },
-    }],
-    ['tsan==1', {
-      'variables': {
-        'files': [
-          '../tools/sanitizers/tsan_suppressions.txt',
-        ],
-      },
-    }],
-    ['asan==1 or cfi_vptr==1 or msan==1 or tsan==1 or ubsan_vptr==1', {
-      'variables': {
-        'files': [
-          '../third_party/llvm-build/Release+Asserts/bin/llvm-symbolizer<(EXECUTABLE_SUFFIX)',
-        ],
-      },
-    }],
-    # Workaround for https://code.google.com/p/swarming/issues/detail?id=211
-    ['asan==0 or cfi_vptr==0 or msan==0 or tsan==0 or ubsan_vptr==0 ', {
-      'variables': {},
-    }],
-  ],
-}
diff --git a/deps/v8/src/base/atomic-utils.h b/deps/v8/src/base/atomic-utils.h
index 854d846cc05..5ba1ad42460 100644
--- a/deps/v8/src/base/atomic-utils.h
+++ b/deps/v8/src/base/atomic-utils.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_ATOMIC_UTILS_H_
-#define V8_ATOMIC_UTILS_H_
+#ifndef V8_BASE_ATOMIC_UTILS_H_
+#define V8_BASE_ATOMIC_UTILS_H_
 
 #include <limits.h>
 #include <type_traits>
@@ -419,4 +419,4 @@ class AtomicElement {
 }  // namespace base
 }  // namespace v8
 
-#endif  // #define V8_ATOMIC_UTILS_H_
+#endif  // V8_BASE_ATOMIC_UTILS_H_
diff --git a/deps/v8/src/base/atomicops_internals_portable.h b/deps/v8/src/base/atomicops_internals_portable.h
index 0779bfbd255..bd79558313f 100644
--- a/deps/v8/src/base/atomicops_internals_portable.h
+++ b/deps/v8/src/base/atomicops_internals_portable.h
@@ -26,8 +26,8 @@
 //    needs to increment twice (which the compiler should be able to detect and
 //    optimize).
 
-#ifndef BASE_ATOMICOPS_INTERNALS_PORTABLE_H_
-#define BASE_ATOMICOPS_INTERNALS_PORTABLE_H_
+#ifndef V8_BASE_ATOMICOPS_INTERNALS_PORTABLE_H_
+#define V8_BASE_ATOMICOPS_INTERNALS_PORTABLE_H_
 
 #include <atomic>
 
diff --git a/deps/v8/src/base/atomicops_internals_std.h b/deps/v8/src/base/atomicops_internals_std.h
index f47152aa8ce..4ce7b461e07 100644
--- a/deps/v8/src/base/atomicops_internals_std.h
+++ b/deps/v8/src/base/atomicops_internals_std.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef BASE_ATOMICOPS_INTERNALS_STD_H_
-#define BASE_ATOMICOPS_INTERNALS_STD_H_
+#ifndef V8_BASE_ATOMICOPS_INTERNALS_STD_H_
+#define V8_BASE_ATOMICOPS_INTERNALS_STD_H_
 
 #include <atomic>
 
diff --git a/deps/v8/src/base/cpu.cc b/deps/v8/src/base/cpu.cc
index 22e0511dc7d..6ab0ffee29e 100644
--- a/deps/v8/src/base/cpu.cc
+++ b/deps/v8/src/base/cpu.cc
@@ -335,7 +335,8 @@ CPU::CPU()
       has_vfp3_(false),
       has_vfp3_d32_(false),
       is_fp64_mode_(false),
-      has_non_stop_time_stamp_counter_(false) {
+      has_non_stop_time_stamp_counter_(false),
+      has_msa_(false) {
   memcpy(vendor_, "Unknown", 8);
 #if V8_HOST_ARCH_IA32 || V8_HOST_ARCH_X64
   int cpu_info[4];
diff --git a/deps/v8/src/base/debug/stack_trace_posix.cc b/deps/v8/src/base/debug/stack_trace_posix.cc
index ec3add1682b..51b821bdd13 100644
--- a/deps/v8/src/base/debug/stack_trace_posix.cc
+++ b/deps/v8/src/base/debug/stack_trace_posix.cc
@@ -72,6 +72,7 @@ const char kMangledSymbolPrefix[] = "_Z";
 const char kSymbolCharacters[] =
     "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_";
 
+#if HAVE_EXECINFO_H
 // Demangles C++ symbols in the given text. Example:
 //
 // "out/Debug/base_unittests(_ZN10StackTraceC1Ev+0x20) [0x817778c]"
@@ -81,7 +82,6 @@ void DemangleSymbols(std::string* text) {
   // Note: code in this function is NOT async-signal safe (std::string uses
   // malloc internally).
 
-#if HAVE_EXECINFO_H
 
   std::string::size_type search_from = 0;
   while (search_from < text->size()) {
@@ -117,9 +117,8 @@ void DemangleSymbols(std::string* text) {
       search_from = mangled_start + 2;
     }
   }
-
-#endif  // HAVE_EXECINFO_H
 }
+#endif  // HAVE_EXECINFO_H
 
 class BacktraceOutputHandler {
  public:
@@ -129,6 +128,7 @@ class BacktraceOutputHandler {
   virtual ~BacktraceOutputHandler() {}
 };
 
+#if HAVE_EXECINFO_H
 void OutputPointer(void* pointer, BacktraceOutputHandler* handler) {
   // This should be more than enough to store a 64-bit number in hex:
   // 16 hex digits + 1 for null-terminator.
@@ -139,7 +139,6 @@ void OutputPointer(void* pointer, BacktraceOutputHandler* handler) {
   handler->HandleOutput(buf);
 }
 
-#if HAVE_EXECINFO_H
 void ProcessBacktrace(void* const* trace, size_t size,
                       BacktraceOutputHandler* handler) {
   // NOTE: This code MUST be async-signal safe (it's used by in-process
diff --git a/deps/v8/src/base/file-utils.h b/deps/v8/src/base/file-utils.h
index 271f0ffb054..afd9a1fc253 100644
--- a/deps/v8/src/base/file-utils.h
+++ b/deps/v8/src/base/file-utils.h
@@ -18,4 +18,4 @@ V8_BASE_EXPORT char* RelativePath(char** buffer, const char* exec_path,
 }  // namespace base
 }  // namespace v8
 
-#endif  // V8_FILE_UTILS_H_
+#endif  // V8_BASE_FILE_UTILS_H_
diff --git a/deps/v8/src/base/format-macros.h b/deps/v8/src/base/format-macros.h
index 5f5fe5df24c..e2234684a8e 100644
--- a/deps/v8/src/base/format-macros.h
+++ b/deps/v8/src/base/format-macros.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef BASE_FORMAT_MACROS_H_
-#define BASE_FORMAT_MACROS_H_
+#ifndef V8_BASE_FORMAT_MACROS_H_
+#define V8_BASE_FORMAT_MACROS_H_
 
 // This file defines the format macros for some integer types.
 
@@ -94,4 +94,4 @@
 
 #endif
 
-#endif  // BASE_FORMAT_MACROS_H_
+#endif  // V8_BASE_FORMAT_MACROS_H_
diff --git a/deps/v8/src/base/logging.cc b/deps/v8/src/base/logging.cc
index ad5349ac7eb..e58fdba09f5 100644
--- a/deps/v8/src/base/logging.cc
+++ b/deps/v8/src/base/logging.cc
@@ -119,16 +119,50 @@ DEFINE_CHECK_OP_IMPL(GT)
 }  // namespace base
 }  // namespace v8
 
+namespace {
+
+// FailureMessage is a stack allocated object which has a special marker field
+// at the start and at the end. This makes it possible to retrieve the embedded
+// message from the stack.
+//
+class FailureMessage {
+ public:
+  explicit FailureMessage(const char* format, va_list arguments) {
+    memset(&message_, 0, arraysize(message_));
+    v8::base::OS::VSNPrintF(&message_[0], arraysize(message_), format,
+                            arguments);
+  }
+
+  static const uintptr_t kStartMarker = 0xdecade10;
+  static const uintptr_t kEndMarker = 0xdecade11;
+  static const int kMessageBufferSize = 1024;
+
+  uintptr_t start_marker_ = kStartMarker;
+  char message_[kMessageBufferSize];
+  uintptr_t end_marker_ = kEndMarker;
+};
+
+}  // namespace
+
 void V8_Fatal(const char* file, int line, const char* format, ...) {
+  va_list arguments;
+  va_start(arguments, format);
+  // Format the error message into a stack object for later retrieveal by the
+  // crash processor.
+  FailureMessage message(format, arguments);
+  va_end(arguments);
+
   fflush(stdout);
   fflush(stderr);
   v8::base::OS::PrintError("\n\n#\n# Fatal error in %s, line %d\n# ", file,
                            line);
-  va_list arguments;
+
+  // Print the error message.
   va_start(arguments, format);
   v8::base::OS::VPrintError(format, arguments);
   va_end(arguments);
-  v8::base::OS::PrintError("\n#\n");
+  // Print the message object's address to force stack allocation.
+  v8::base::OS::PrintError("\n#\n#\n#\n#FailureMessage Object: %p", &message);
 
   if (v8::base::g_print_stack_trace) v8::base::g_print_stack_trace();
 
diff --git a/deps/v8/src/base/logging.h b/deps/v8/src/base/logging.h
index 5275fdc6a6e..baf6b12ccbb 100644
--- a/deps/v8/src/base/logging.h
+++ b/deps/v8/src/base/logging.h
@@ -44,11 +44,11 @@ V8_BASE_EXPORT void SetDcheckFunction(void (*dcheck_Function)(const char*, int,
 //
 // We make sure CHECK et al. always evaluates their arguments, as
 // doing CHECK(FunctionWithSideEffect()) is a common idiom.
-#define CHECK_WITH_MSG(condition, message)                        \
-  do {                                                            \
-    if (V8_UNLIKELY(!(condition))) {                              \
-      V8_Fatal(__FILE__, __LINE__, "Check failed: %s.", message); \
-    }                                                             \
+#define CHECK_WITH_MSG(condition, message) \
+  do {                                     \
+    if (V8_UNLIKELY(!(condition))) {       \
+      FATAL("Check failed: %s.", message); \
+    }                                      \
   } while (0)
 #define CHECK(condition) CHECK_WITH_MSG(condition, #condition)
 
@@ -70,7 +70,7 @@ V8_BASE_EXPORT void SetDcheckFunction(void (*dcheck_Function)(const char*, int,
             typename ::v8::base::pass_value_or_ref<decltype(lhs)>::type,  \
             typename ::v8::base::pass_value_or_ref<decltype(rhs)>::type>( \
             (lhs), (rhs), #lhs " " #op " " #rhs)) {                       \
-      V8_Fatal(__FILE__, __LINE__, "Check failed: %s.", _msg->c_str());   \
+      FATAL("Check failed: %s.", _msg->c_str());                          \
       delete _msg;                                                        \
     }                                                                     \
   } while (0)
@@ -106,11 +106,25 @@ V8_BASE_EXPORT void SetDcheckFunction(void (*dcheck_Function)(const char*, int,
 
 // Define PrintCheckOperand<T> for each T which defines operator<< for ostream.
 template <typename T>
-typename std::enable_if<has_output_operator<T>::value>::type PrintCheckOperand(
-    std::ostream& os, T val) {
+typename std::enable_if<
+    !std::is_function<typename std::remove_pointer<T>::type>::value &&
+    has_output_operator<T>::value>::type
+PrintCheckOperand(std::ostream& os, T val) {
   os << std::forward<T>(val);
 }
 
+// Provide an overload for functions and function pointers. Function pointers
+// don't implicitly convert to void* but do implicitly convert to bool, so
+// without this function pointers are always printed as 1 or 0. (MSVC isn't
+// standards-conforming here and converts function pointers to regular
+// pointers, so this is a no-op for MSVC.)
+template <typename T>
+typename std::enable_if<
+    std::is_function<typename std::remove_pointer<T>::type>::value>::type
+PrintCheckOperand(std::ostream& os, T val) {
+  os << reinterpret_cast<const void*>(val);
+}
+
 // Define PrintCheckOperand<T> for enums which have no operator<<.
 template <typename T>
 typename std::enable_if<std::is_enum<T>::value &&
diff --git a/deps/v8/src/base/macros.h b/deps/v8/src/base/macros.h
index a265408d910..1311e68ec1a 100644
--- a/deps/v8/src/base/macros.h
+++ b/deps/v8/src/base/macros.h
@@ -196,12 +196,68 @@ V8_INLINE Dest bit_cast(Source const& source) {
 // TODO(all) Replace all uses of this macro with static_assert, remove macro.
 #define STATIC_ASSERT(test) static_assert(test, #test)
 
-// TODO(rongjie) Remove this workaround once we require gcc >= 5.0
-#if __GNUG__ && __GNUC__ < 5
-#define IS_TRIVIALLY_COPYABLE(T) \
-  (__has_trivial_copy(T) && __has_trivial_destructor(T))
+namespace v8 {
+namespace base {
+
+// Note that some implementations of std::is_trivially_copyable mandate that at
+// least one of the copy constructor, move constructor, copy assignment or move
+// assignment is non-deleted, while others do not. Be aware that also
+// base::is_trivially_copyable will differ for these cases.
+template <typename T>
+struct is_trivially_copyable {
+#if V8_CC_MSVC
+  // Unfortunately, MSVC 2015 is broken in that std::is_trivially_copyable can
+  // be false even though it should be true according to the standard.
+  // (status at 2018-02-26, observed on the msvc waterfall bot).
+  // Interestingly, the lower-level primitives used below are working as
+  // intended, so we reimplement this according to the standard.
+  // See also https://developercommunity.visualstudio.com/content/problem/
+  //          170883/msvc-type-traits-stdis-trivial-is-bugged.html.
+  static constexpr bool value =
+      // Copy constructor is trivial or deleted.
+      (std::is_trivially_copy_constructible<T>::value ||
+       !std::is_copy_constructible<T>::value) &&
+      // Copy assignment operator is trivial or deleted.
+      (std::is_trivially_copy_assignable<T>::value ||
+       !std::is_copy_assignable<T>::value) &&
+      // Move constructor is trivial or deleted.
+      (std::is_trivially_move_constructible<T>::value ||
+       !std::is_move_constructible<T>::value) &&
+      // Move assignment operator is trivial or deleted.
+      (std::is_trivially_move_assignable<T>::value ||
+       !std::is_move_assignable<T>::value) &&
+      // (Some implementations mandate that one of the above is non-deleted, but
+      // the standard does not, so let's skip this check.)
+      // Trivial non-deleted destructor.
+      std::is_trivially_destructible<T>::value;
+
+#elif defined(__GNUC__) && __GNUC__ < 5
+  // WARNING:
+  // On older libstdc++ versions, there is no way to correctly implement
+  // is_trivially_copyable. The workaround below is an approximation (neither
+  // over- nor underapproximation). E.g. it wrongly returns true if the move
+  // constructor is non-trivial, and it wrongly returns false if the copy
+  // constructor is deleted, but copy assignment is trivial.
+  // TODO(rongjie) Remove this workaround once we require gcc >= 5.0
+  static constexpr bool value =
+      __has_trivial_copy(T) && __has_trivial_destructor(T);
+
 #else
-#define IS_TRIVIALLY_COPYABLE(T) std::is_trivially_copyable<T>::value
+  static constexpr bool value = std::is_trivially_copyable<T>::value;
+#endif
+};
+#if defined(__GNUC__) && __GNUC__ < 5
+// On older libstdc++ versions, base::is_trivially_copyable<T>::value is only an
+// approximation (see above), so make ASSERT_{NOT_,}TRIVIALLY_COPYABLE a noop.
+#define ASSERT_TRIVIALLY_COPYABLE(T) static_assert(true, "check disabled")
+#define ASSERT_NOT_TRIVIALLY_COPYABLE(T) static_assert(true, "check disabled")
+#else
+#define ASSERT_TRIVIALLY_COPYABLE(T)                         \
+  static_assert(::v8::base::is_trivially_copyable<T>::value, \
+                #T " should be trivially copyable")
+#define ASSERT_NOT_TRIVIALLY_COPYABLE(T)                      \
+  static_assert(!::v8::base::is_trivially_copyable<T>::value, \
+                #T " should not be trivially copyable")
 #endif
 
 // The USE(x, ...) template is used to silence C++ compiler warnings
@@ -211,12 +267,15 @@ struct Use {
   template <typename T>
   Use(T&&) {}  // NOLINT(runtime/explicit)
 };
-#define USE(...)                                         \
-  do {                                                   \
-    ::Use unused_tmp_array_for_use_macro[]{__VA_ARGS__}; \
-    (void)unused_tmp_array_for_use_macro;                \
+#define USE(...)                                                   \
+  do {                                                             \
+    ::v8::base::Use unused_tmp_array_for_use_macro[]{__VA_ARGS__}; \
+    (void)unused_tmp_array_for_use_macro;                          \
   } while (false)
 
+}  // namespace base
+}  // namespace v8
+
 // Define our own macros for writing 64-bit constants.  This is less fragile
 // than defining __STDC_CONSTANT_MACROS before including <stdint.h>, and it
 // works on compilers that don't have it (like MSVC).
@@ -338,4 +397,4 @@ bool is_inbounds(float_t v) {
          (kUpperBoundIsMax ? (v <= kUpperBound) : (v < kUpperBound));
 }
 
-#endif   // V8_BASE_MACROS_H_
+#endif  // V8_BASE_MACROS_H_
diff --git a/deps/v8/src/base/optional.h b/deps/v8/src/base/optional.h
index a229745f841..ea32c403acb 100644
--- a/deps/v8/src/base/optional.h
+++ b/deps/v8/src/base/optional.h
@@ -125,7 +125,7 @@ class Optional {
 
   constexpr Optional() {}
 
-  explicit constexpr Optional(base::nullopt_t) {}
+  constexpr Optional(base::nullopt_t) {}  // NOLINT(runtime/explicit)
 
   Optional(const Optional& other) {
     if (!other.storage_.is_null_) Init(other.value());
@@ -135,10 +135,12 @@ class Optional {
     if (!other.storage_.is_null_) Init(std::move(other.value()));
   }
 
-  explicit constexpr Optional(const T& value) : storage_(value) {}
+  constexpr Optional(const T& value)  // NOLINT(runtime/explicit)
+      : storage_(value) {}
 
   // TODO(alshabalin): Can't use 'constexpr' with std::move until C++14.
-  explicit Optional(T&& value) : storage_(std::move(value)) {}
+  Optional(T&& value)  // NOLINT(runtime/explicit)
+      : storage_(std::move(value)) {}
 
   // TODO(alshabalin): Can't use 'constexpr' with std::forward until C++14.
   template <class... Args>
diff --git a/deps/v8/src/base/platform/platform-cygwin.cc b/deps/v8/src/base/platform/platform-cygwin.cc
index eabd53570f5..0d4ec9a10d2 100644
--- a/deps/v8/src/base/platform/platform-cygwin.cc
+++ b/deps/v8/src/base/platform/platform-cygwin.cc
@@ -139,7 +139,7 @@ void* OS::Allocate(void* address, size_t size, size_t alignment,
     // base will be nullptr.
     if (base != nullptr) break;
   }
-  DCHECK_EQ(base, aligned_base);
+  DCHECK_IMPLIES(base, base == aligned_base);
   return reinterpret_cast<void*>(base);
 }
 
diff --git a/deps/v8/src/base/platform/platform-fuchsia.cc b/deps/v8/src/base/platform/platform-fuchsia.cc
index 38a7070e853..bba3f1baba9 100644
--- a/deps/v8/src/base/platform/platform-fuchsia.cc
+++ b/deps/v8/src/base/platform/platform-fuchsia.cc
@@ -131,5 +131,21 @@ void OS::SignalCodeMovingGC() {
   UNREACHABLE();  // TODO(scottmg): Port, https://crbug.com/731217.
 }
 
+int OS::GetUserTime(uint32_t* secs, uint32_t* usecs) {
+  const auto kNanosPerMicrosecond = 1000ULL;
+  const auto kMicrosPerSecond = 1000000ULL;
+  const zx_time_t nanos_since_thread_started = zx_clock_get(ZX_CLOCK_THREAD);
+
+  // First convert to microseconds, rounding up.
+  const uint64_t micros_since_thread_started =
+      (nanos_since_thread_started + kNanosPerMicrosecond - 1ULL) /
+      kNanosPerMicrosecond;
+
+  *secs = static_cast<uint32_t>(micros_since_thread_started / kMicrosPerSecond);
+  *usecs =
+      static_cast<uint32_t>(micros_since_thread_started % kMicrosPerSecond);
+  return 0;
+}
+
 }  // namespace base
 }  // namespace v8
diff --git a/deps/v8/src/base/platform/platform-posix.cc b/deps/v8/src/base/platform/platform-posix.cc
index 5edbd7648b5..fee67589b6b 100644
--- a/deps/v8/src/base/platform/platform-posix.cc
+++ b/deps/v8/src/base/platform/platform-posix.cc
@@ -18,7 +18,6 @@
 #include <unistd.h>
 
 #include <sys/mman.h>
-#include <sys/resource.h>
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <sys/types.h>
@@ -55,6 +54,12 @@
 #include <sys/prctl.h>  // NOLINT, for prctl
 #endif
 
+#if defined(V8_OS_FUCHSIA)
+#include <zircon/process.h>
+#else
+#include <sys/resource.h>
+#endif
+
 #if !defined(_AIX) && !defined(V8_OS_FUCHSIA)
 #include <sys/syscall.h>
 #endif
@@ -245,6 +250,10 @@ void* OS::GetRandomMmapAddr() {
   // Little-endian Linux: 48 bits of virtual addressing.
   raw_addr &= uint64_t{0x3FFFFFFFF000};
 #endif
+#elif V8_TARGET_ARCH_MIPS64
+  // We allocate code in 256 MB aligned segments because of optimizations using
+  // J instruction that require that all code is within a single 256 MB segment
+  raw_addr &= uint64_t{0x3FFFE0000000};
 #elif V8_TARGET_ARCH_S390X
   // Linux on Z uses bits 22-32 for Region Indexing, which translates to 42 bits
   // of virtual addressing.  Truncate to 40 bits to allow kernel chance to
@@ -474,7 +483,7 @@ int OS::GetCurrentThreadId() {
 #elif V8_OS_AIX
   return static_cast<int>(thread_self());
 #elif V8_OS_FUCHSIA
-  return static_cast<int>(pthread_self());
+  return static_cast<int>(zx_thread_self());
 #elif V8_OS_SOLARIS
   return static_cast<int>(pthread_self());
 #else
@@ -482,11 +491,19 @@ int OS::GetCurrentThreadId() {
 #endif
 }
 
+void OS::ExitProcess(int exit_code) {
+  // Use _exit instead of exit to avoid races between isolate
+  // threads and static destructors.
+  fflush(stdout);
+  fflush(stderr);
+  _exit(exit_code);
+}
 
 // ----------------------------------------------------------------------------
 // POSIX date/time support.
 //
 
+#if !defined(V8_OS_FUCHSIA)
 int OS::GetUserTime(uint32_t* secs, uint32_t* usecs) {
   struct rusage usage;
 
@@ -495,7 +512,7 @@ int OS::GetUserTime(uint32_t* secs, uint32_t* usecs) {
   *usecs = static_cast<uint32_t>(usage.ru_utime.tv_usec);
   return 0;
 }
-
+#endif
 
 double OS::TimeCurrentMillis() {
   return Time::Now().ToJsTime();
@@ -788,7 +805,7 @@ static void InitializeTlsBaseOffset() {
   size_t buffer_size = kBufferSize;
   int ctl_name[] = { CTL_KERN , KERN_OSRELEASE };
   if (sysctl(ctl_name, 2, buffer, &buffer_size, nullptr, 0) != 0) {
-    V8_Fatal(__FILE__, __LINE__, "V8 failed to get kernel version");
+    FATAL("V8 failed to get kernel version");
   }
   // The buffer now contains a string of the form XX.YY.ZZ, where
   // XX is the major kernel version component.
@@ -822,8 +839,7 @@ static void CheckFastTls(Thread::LocalStorageKey key) {
   Thread::SetThreadLocal(key, expected);
   void* actual = Thread::GetExistingThreadLocal(key);
   if (expected != actual) {
-    V8_Fatal(__FILE__, __LINE__,
-             "V8 failed to initialize fast TLS on current kernel");
+    FATAL("V8 failed to initialize fast TLS on current kernel");
   }
   Thread::SetThreadLocal(key, nullptr);
 }
diff --git a/deps/v8/src/base/platform/platform-win32.cc b/deps/v8/src/base/platform/platform-win32.cc
index 22580cc407f..8b10f6f4570 100644
--- a/deps/v8/src/base/platform/platform-win32.cc
+++ b/deps/v8/src/base/platform/platform-win32.cc
@@ -27,6 +27,10 @@
 #include "src/base/timezone-cache.h"
 #include "src/base/utils/random-number-generator.h"
 
+#if defined(_MSC_VER)
+#include <crtdbg.h>  // NOLINT
+#endif               // defined(_MSC_VER)
+
 // Extra functions for MinGW. Most of these are the _s functions which are in
 // the Microsoft Visual Studio C++ CRT.
 #ifdef __MINGW32__
@@ -493,6 +497,13 @@ int OS::GetCurrentThreadId() {
   return static_cast<int>(::GetCurrentThreadId());
 }
 
+void OS::ExitProcess(int exit_code) {
+  // Use TerminateProcess avoid races between isolate threads and
+  // static destructors.
+  fflush(stdout);
+  fflush(stderr);
+  TerminateProcess(GetCurrentProcess(), exit_code);
+}
 
 // ----------------------------------------------------------------------------
 // Win32 console output.
@@ -829,15 +840,14 @@ void* OS::Allocate(void* address, size_t size, size_t alignment,
     // base will be nullptr.
     if (base != nullptr) break;
   }
-  DCHECK_EQ(base, aligned_base);
+  DCHECK_IMPLIES(base, base == aligned_base);
   return reinterpret_cast<void*>(base);
 }
 
 // static
 bool OS::Free(void* address, const size_t size) {
   DCHECK_EQ(0, reinterpret_cast<uintptr_t>(address) % AllocatePageSize());
-  // TODO(bbudge) Add DCHECK_EQ(0, size % AllocatePageSize()) when callers
-  // pass the correct size on Windows.
+  DCHECK_EQ(0, size % AllocatePageSize());
   USE(size);
   return VirtualFree(address, 0, MEM_RELEASE) != 0;
 }
@@ -872,6 +882,10 @@ void OS::Sleep(TimeDelta interval) {
 
 
 void OS::Abort() {
+  // Before aborting, make sure to flush output buffers.
+  fflush(stdout);
+  fflush(stderr);
+
   if (g_hard_abort) {
     V8_IMMEDIATE_CRASH();
   }
@@ -1236,6 +1250,24 @@ int OS::ActivationFrameAlignment() {
 #endif
 }
 
+#if (defined(_WIN32) || defined(_WIN64))
+void EnsureConsoleOutputWin32() {
+  UINT new_flags =
+      SEM_FAILCRITICALERRORS | SEM_NOGPFAULTERRORBOX | SEM_NOOPENFILEERRORBOX;
+  UINT existing_flags = SetErrorMode(new_flags);
+  SetErrorMode(existing_flags | new_flags);
+#if defined(_MSC_VER)
+  _CrtSetReportMode(_CRT_WARN, _CRTDBG_MODE_DEBUG | _CRTDBG_MODE_FILE);
+  _CrtSetReportFile(_CRT_WARN, _CRTDBG_FILE_STDERR);
+  _CrtSetReportMode(_CRT_ASSERT, _CRTDBG_MODE_DEBUG | _CRTDBG_MODE_FILE);
+  _CrtSetReportFile(_CRT_ASSERT, _CRTDBG_FILE_STDERR);
+  _CrtSetReportMode(_CRT_ERROR, _CRTDBG_MODE_DEBUG | _CRTDBG_MODE_FILE);
+  _CrtSetReportFile(_CRT_ERROR, _CRTDBG_FILE_STDERR);
+  _set_error_mode(_OUT_TO_STDERR);
+#endif  // defined(_MSC_VER)
+}
+#endif  // (defined(_WIN32) || defined(_WIN64))
+
 // ----------------------------------------------------------------------------
 // Win32 thread support.
 
diff --git a/deps/v8/src/base/platform/platform.h b/deps/v8/src/base/platform/platform.h
index 8a4545c607f..4fbc87c4aaa 100644
--- a/deps/v8/src/base/platform/platform.h
+++ b/deps/v8/src/base/platform/platform.h
@@ -245,6 +245,8 @@ class V8_BASE_EXPORT OS {
 
   static int GetCurrentThreadId();
 
+  static void ExitProcess(int exit_code);
+
  private:
   // These classes use the private memory management API below.
   friend class MemoryMappedFile;
@@ -279,6 +281,18 @@ class V8_BASE_EXPORT OS {
   DISALLOW_IMPLICIT_CONSTRUCTORS(OS);
 };
 
+#if (defined(_WIN32) || defined(_WIN64))
+V8_BASE_EXPORT void EnsureConsoleOutputWin32();
+#endif  // (defined(_WIN32) || defined(_WIN64))
+
+inline void EnsureConsoleOutput() {
+#if (defined(_WIN32) || defined(_WIN64))
+  // Windows requires extra calls to send assert output to the console
+  // rather than a dialog box.
+  EnsureConsoleOutputWin32();
+#endif  // (defined(_WIN32) || defined(_WIN64))
+}
+
 // ----------------------------------------------------------------------------
 // Thread
 //
diff --git a/deps/v8/src/base/platform/time.cc b/deps/v8/src/base/platform/time.cc
index 1fcd7aeccea..99f453c83a7 100644
--- a/deps/v8/src/base/platform/time.cc
+++ b/deps/v8/src/base/platform/time.cc
@@ -143,41 +143,83 @@ TimeDelta TimeDelta::FromNanoseconds(int64_t nanoseconds) {
 
 
 int TimeDelta::InDays() const {
+  if (IsMax()) {
+    // Preserve max to prevent overflow.
+    return std::numeric_limits<int>::max();
+  }
   return static_cast<int>(delta_ / Time::kMicrosecondsPerDay);
 }
 
-
 int TimeDelta::InHours() const {
+  if (IsMax()) {
+    // Preserve max to prevent overflow.
+    return std::numeric_limits<int>::max();
+  }
   return static_cast<int>(delta_ / Time::kMicrosecondsPerHour);
 }
 
-
 int TimeDelta::InMinutes() const {
+  if (IsMax()) {
+    // Preserve max to prevent overflow.
+    return std::numeric_limits<int>::max();
+  }
   return static_cast<int>(delta_ / Time::kMicrosecondsPerMinute);
 }
 
-
 double TimeDelta::InSecondsF() const {
+  if (IsMax()) {
+    // Preserve max to prevent overflow.
+    return std::numeric_limits<double>::infinity();
+  }
   return static_cast<double>(delta_) / Time::kMicrosecondsPerSecond;
 }
 
-
 int64_t TimeDelta::InSeconds() const {
+  if (IsMax()) {
+    // Preserve max to prevent overflow.
+    return std::numeric_limits<int64_t>::max();
+  }
   return delta_ / Time::kMicrosecondsPerSecond;
 }
 
-
 double TimeDelta::InMillisecondsF() const {
+  if (IsMax()) {
+    // Preserve max to prevent overflow.
+    return std::numeric_limits<double>::infinity();
+  }
   return static_cast<double>(delta_) / Time::kMicrosecondsPerMillisecond;
 }
 
-
 int64_t TimeDelta::InMilliseconds() const {
+  if (IsMax()) {
+    // Preserve max to prevent overflow.
+    return std::numeric_limits<int64_t>::max();
+  }
   return delta_ / Time::kMicrosecondsPerMillisecond;
 }
 
+int64_t TimeDelta::InMillisecondsRoundedUp() const {
+  if (IsMax()) {
+    // Preserve max to prevent overflow.
+    return std::numeric_limits<int64_t>::max();
+  }
+  return (delta_ + Time::kMicrosecondsPerMillisecond - 1) /
+         Time::kMicrosecondsPerMillisecond;
+}
+
+int64_t TimeDelta::InMicroseconds() const {
+  if (IsMax()) {
+    // Preserve max to prevent overflow.
+    return std::numeric_limits<int64_t>::max();
+  }
+  return delta_;
+}
 
 int64_t TimeDelta::InNanoseconds() const {
+  if (IsMax()) {
+    // Preserve max to prevent overflow.
+    return std::numeric_limits<int64_t>::max();
+  }
   return delta_ * Time::kNanosecondsPerMicrosecond;
 }
 
@@ -415,6 +457,20 @@ struct timeval Time::ToTimeval() const {
 
 #endif  // V8_OS_WIN
 
+// static
+TimeTicks TimeTicks::HighResolutionNow() {
+  static bool verified_high_resolution_available = false;
+  if (!verified_high_resolution_available) {
+    if (!TimeTicks::IsHighResolution()) {
+      OS::PrintError(
+          "\n\n"
+          "WARNING: High-resolution TimeTicks are not available on this system."
+          "\n\n");
+    }
+    verified_high_resolution_available = true;
+  }
+  return TimeTicks::Now();
+}
 
 Time Time::FromJsTime(double ms_since_epoch) {
   // The epoch is a valid time, so this constructor doesn't interpret
@@ -447,165 +503,221 @@ std::ostream& operator<<(std::ostream& os, const Time& time) {
 
 #if V8_OS_WIN
 
-class TickClock {
- public:
-  virtual ~TickClock() {}
-  virtual int64_t Now() = 0;
-  virtual bool IsHighResolution() = 0;
+namespace {
+
+// We define a wrapper to adapt between the __stdcall and __cdecl call of the
+// mock function, and to avoid a static constructor.  Assigning an import to a
+// function pointer directly would require setup code to fetch from the IAT.
+DWORD timeGetTimeWrapper() { return timeGetTime(); }
+
+DWORD (*g_tick_function)(void) = &timeGetTimeWrapper;
+
+// A structure holding the most significant bits of "last seen" and a
+// "rollover" counter.
+union LastTimeAndRolloversState {
+  // The state as a single 32-bit opaque value.
+  base::Atomic32 as_opaque_32;
+
+  // The state as usable values.
+  struct {
+    // The top 8-bits of the "last" time. This is enough to check for rollovers
+    // and the small bit-size means fewer CompareAndSwap operations to store
+    // changes in state, which in turn makes for fewer retries.
+    uint8_t last_8;
+    // A count of the number of detected rollovers. Using this as bits 47-32
+    // of the upper half of a 64-bit value results in a 48-bit tick counter.
+    // This extends the total rollover period from about 49 days to about 8800
+    // years while still allowing it to be stored with last_8 in a single
+    // 32-bit value.
+    uint16_t rollovers;
+  } as_values;
 };
+base::Atomic32 g_last_time_and_rollovers = 0;
+static_assert(sizeof(LastTimeAndRolloversState) <=
+                  sizeof(g_last_time_and_rollovers),
+              "LastTimeAndRolloversState does not fit in a single atomic word");
+
+// We use timeGetTime() to implement TimeTicks::Now().  This can be problematic
+// because it returns the number of milliseconds since Windows has started,
+// which will roll over the 32-bit value every ~49 days.  We try to track
+// rollover ourselves, which works if TimeTicks::Now() is called at least every
+// 48.8 days (not 49 days because only changes in the top 8 bits get noticed).
+TimeTicks RolloverProtectedNow() {
+  LastTimeAndRolloversState state;
+  DWORD now;  // DWORD is always unsigned 32 bits.
+
+  while (true) {
+    // Fetch the "now" and "last" tick values, updating "last" with "now" and
+    // incrementing the "rollovers" counter if the tick-value has wrapped back
+    // around. Atomic operations ensure that both "last" and "rollovers" are
+    // always updated together.
+    int32_t original = base::Acquire_Load(&g_last_time_and_rollovers);
+    state.as_opaque_32 = original;
+    now = g_tick_function();
+    uint8_t now_8 = static_cast<uint8_t>(now >> 24);
+    if (now_8 < state.as_values.last_8) ++state.as_values.rollovers;
+    state.as_values.last_8 = now_8;
+
+    // If the state hasn't changed, exit the loop.
+    if (state.as_opaque_32 == original) break;
+
+    // Save the changed state. If the existing value is unchanged from the
+    // original, exit the loop.
+    int32_t check = base::Release_CompareAndSwap(&g_last_time_and_rollovers,
+                                                 original, state.as_opaque_32);
+    if (check == original) break;
+
+    // Another thread has done something in between so retry from the top.
+  }
 
+  return TimeTicks() +
+         TimeDelta::FromMilliseconds(
+             now + (static_cast<uint64_t>(state.as_values.rollovers) << 32));
+}
 
-// Overview of time counters:
+// Discussion of tick counter options on Windows:
+//
 // (1) CPU cycle counter. (Retrieved via RDTSC)
 // The CPU counter provides the highest resolution time stamp and is the least
-// expensive to retrieve. However, the CPU counter is unreliable and should not
-// be used in production. Its biggest issue is that it is per processor and it
-// is not synchronized between processors. Also, on some computers, the counters
-// will change frequency due to thermal and power changes, and stop in some
-// states.
+// expensive to retrieve. However, on older CPUs, two issues can affect its
+// reliability: First it is maintained per processor and not synchronized
+// between processors. Also, the counters will change frequency due to thermal
+// and power changes, and stop in some states.
 //
 // (2) QueryPerformanceCounter (QPC). The QPC counter provides a high-
-// resolution (100 nanoseconds) time stamp but is comparatively more expensive
-// to retrieve. What QueryPerformanceCounter actually does is up to the HAL.
-// (with some help from ACPI).
-// According to http://blogs.msdn.com/oldnewthing/archive/2005/09/02/459952.aspx
-// in the worst case, it gets the counter from the rollover interrupt on the
+// resolution (<1 microsecond) time stamp. On most hardware running today, it
+// auto-detects and uses the constant-rate RDTSC counter to provide extremely
+// efficient and reliable time stamps.
+//
+// On older CPUs where RDTSC is unreliable, it falls back to using more
+// expensive (20X to 40X more costly) alternate clocks, such as HPET or the ACPI
+// PM timer, and can involve system calls; and all this is up to the HAL (with
+// some help from ACPI). According to
+// http://blogs.msdn.com/oldnewthing/archive/2005/09/02/459952.aspx, in the
+// worst case, it gets the counter from the rollover interrupt on the
 // programmable interrupt timer. In best cases, the HAL may conclude that the
 // RDTSC counter runs at a constant frequency, then it uses that instead. On
 // multiprocessor machines, it will try to verify the values returned from
 // RDTSC on each processor are consistent with each other, and apply a handful
 // of workarounds for known buggy hardware. In other words, QPC is supposed to
-// give consistent result on a multiprocessor computer, but it is unreliable in
-// reality due to bugs in BIOS or HAL on some, especially old computers.
-// With recent updates on HAL and newer BIOS, QPC is getting more reliable but
-// it should be used with caution.
+// give consistent results on a multiprocessor computer, but for older CPUs it
+// can be unreliable due bugs in BIOS or HAL.
 //
-// (3) System time. The system time provides a low-resolution (typically 10ms
-// to 55 milliseconds) time stamp but is comparatively less expensive to
-// retrieve and more reliable.
-class HighResolutionTickClock final : public TickClock {
- public:
-  explicit HighResolutionTickClock(int64_t ticks_per_second)
-      : ticks_per_second_(ticks_per_second) {
-    DCHECK_LT(0, ticks_per_second);
+// (3) System time. The system time provides a low-resolution (from ~1 to ~15.6
+// milliseconds) time stamp but is comparatively less expensive to retrieve and
+// more reliable. Time::EnableHighResolutionTimer() and
+// Time::ActivateHighResolutionTimer() can be called to alter the resolution of
+// this timer; and also other Windows applications can alter it, affecting this
+// one.
+
+TimeTicks InitialTimeTicksNowFunction();
+
+// See "threading notes" in InitializeNowFunctionPointer() for details on how
+// concurrent reads/writes to these globals has been made safe.
+using TimeTicksNowFunction = decltype(&TimeTicks::Now);
+TimeTicksNowFunction g_time_ticks_now_function = &InitialTimeTicksNowFunction;
+int64_t g_qpc_ticks_per_second = 0;
+
+// As of January 2015, use of <atomic> is forbidden in Chromium code. This is
+// what std::atomic_thread_fence does on Windows on all Intel architectures when
+// the memory_order argument is anything but std::memory_order_seq_cst:
+#define ATOMIC_THREAD_FENCE(memory_order) _ReadWriteBarrier();
+
+TimeDelta QPCValueToTimeDelta(LONGLONG qpc_value) {
+  // Ensure that the assignment to |g_qpc_ticks_per_second|, made in
+  // InitializeNowFunctionPointer(), has happened by this point.
+  ATOMIC_THREAD_FENCE(memory_order_acquire);
+
+  DCHECK_GT(g_qpc_ticks_per_second, 0);
+
+  // If the QPC Value is below the overflow threshold, we proceed with
+  // simple multiply and divide.
+  if (qpc_value < TimeTicks::kQPCOverflowThreshold) {
+    return TimeDelta::FromMicroseconds(
+        qpc_value * TimeTicks::kMicrosecondsPerSecond / g_qpc_ticks_per_second);
   }
-  virtual ~HighResolutionTickClock() {}
-
-  int64_t Now() override {
-    uint64_t now = QPCNowRaw();
-
-    // Intentionally calculate microseconds in a round about manner to avoid
-    // overflow and precision issues. Think twice before simplifying!
-    int64_t whole_seconds = now / ticks_per_second_;
-    int64_t leftover_ticks = now % ticks_per_second_;
-    int64_t ticks = (whole_seconds * Time::kMicrosecondsPerSecond) +
-        ((leftover_ticks * Time::kMicrosecondsPerSecond) / ticks_per_second_);
-
-    // Make sure we never return 0 here, so that TimeTicks::HighResolutionNow()
-    // will never return 0.
-    return ticks + 1;
-  }
-
-  bool IsHighResolution() override { return true; }
+  // Otherwise, calculate microseconds in a round about manner to avoid
+  // overflow and precision issues.
+  int64_t whole_seconds = qpc_value / g_qpc_ticks_per_second;
+  int64_t leftover_ticks = qpc_value - (whole_seconds * g_qpc_ticks_per_second);
+  return TimeDelta::FromMicroseconds(
+      (whole_seconds * TimeTicks::kMicrosecondsPerSecond) +
+      ((leftover_ticks * TimeTicks::kMicrosecondsPerSecond) /
+       g_qpc_ticks_per_second));
+}
 
- private:
-  int64_t ticks_per_second_;
-};
+TimeTicks QPCNow() { return TimeTicks() + QPCValueToTimeDelta(QPCNowRaw()); }
 
+bool IsBuggyAthlon(const CPU& cpu) {
+  // On Athlon X2 CPUs (e.g. model 15) QueryPerformanceCounter is unreliable.
+  return strcmp(cpu.vendor(), "AuthenticAMD") == 0 && cpu.family() == 15;
+}
 
-class RolloverProtectedTickClock final : public TickClock {
- public:
-  RolloverProtectedTickClock() : rollover_(0) {}
-  virtual ~RolloverProtectedTickClock() {}
-
-  int64_t Now() override {
-    // We use timeGetTime() to implement TimeTicks::Now(), which rolls over
-    // every ~49.7 days. We try to track rollover ourselves, which works if
-    // TimeTicks::Now() is called at least every 24 days.
-    // Note that we do not use GetTickCount() here, since timeGetTime() gives
-    // more predictable delta values, as described here:
-    // http://blogs.msdn.com/b/larryosterman/archive/2009/09/02/what-s-the-difference-between-gettickcount-and-timegettime.aspx
-    // timeGetTime() provides 1ms granularity when combined with
-    // timeBeginPeriod(). If the host application for V8 wants fast timers, it
-    // can use timeBeginPeriod() to increase the resolution.
-    // We use a lock-free version because the sampler thread calls it
-    // while having the rest of the world stopped, that could cause a deadlock.
-    base::Atomic32 rollover = base::Acquire_Load(&rollover_);
-    uint32_t now = static_cast<uint32_t>(timeGetTime());
-    if ((now >> 31) != static_cast<uint32_t>(rollover & 1)) {
-      base::Release_CompareAndSwap(&rollover_, rollover, rollover + 1);
-      ++rollover;
-    }
-    uint64_t ms = (static_cast<uint64_t>(rollover) << 31) | now;
-    return static_cast<int64_t>(ms * Time::kMicrosecondsPerMillisecond);
+void InitializeTimeTicksNowFunctionPointer() {
+  LARGE_INTEGER ticks_per_sec = {};
+  if (!QueryPerformanceFrequency(&ticks_per_sec)) ticks_per_sec.QuadPart = 0;
+
+  // If Windows cannot provide a QPC implementation, TimeTicks::Now() must use
+  // the low-resolution clock.
+  //
+  // If the QPC implementation is expensive and/or unreliable, TimeTicks::Now()
+  // will still use the low-resolution clock. A CPU lacking a non-stop time
+  // counter will cause Windows to provide an alternate QPC implementation that
+  // works, but is expensive to use. Certain Athlon CPUs are known to make the
+  // QPC implementation unreliable.
+  //
+  // Otherwise, Now uses the high-resolution QPC clock. As of 21 August 2015,
+  // ~72% of users fall within this category.
+  TimeTicksNowFunction now_function;
+  CPU cpu;
+  if (ticks_per_sec.QuadPart <= 0 || !cpu.has_non_stop_time_stamp_counter() ||
+      IsBuggyAthlon(cpu)) {
+    now_function = &RolloverProtectedNow;
+  } else {
+    now_function = &QPCNow;
   }
 
-  bool IsHighResolution() override { return false; }
-
- private:
-  base::Atomic32 rollover_;
-};
-
-
-static LazyStaticInstance<RolloverProtectedTickClock,
-                          DefaultConstructTrait<RolloverProtectedTickClock>,
-                          ThreadSafeInitOnceTrait>::type tick_clock =
-    LAZY_STATIC_INSTANCE_INITIALIZER;
-
-
-struct CreateHighResTickClockTrait {
-  static TickClock* Create() {
-    // Check if the installed hardware supports a high-resolution performance
-    // counter, and if not fallback to the low-resolution tick clock.
-    LARGE_INTEGER ticks_per_second;
-    if (!QueryPerformanceFrequency(&ticks_per_second)) {
-      return tick_clock.Pointer();
-    }
-
-    // If QPC not reliable, fallback to low-resolution tick clock.
-    if (IsQPCReliable()) {
-      return tick_clock.Pointer();
-    }
+  // Threading note 1: In an unlikely race condition, it's possible for two or
+  // more threads to enter InitializeNowFunctionPointer() in parallel. This is
+  // not a problem since all threads should end up writing out the same values
+  // to the global variables.
+  //
+  // Threading note 2: A release fence is placed here to ensure, from the
+  // perspective of other threads using the function pointers, that the
+  // assignment to |g_qpc_ticks_per_second| happens before the function pointers
+  // are changed.
+  g_qpc_ticks_per_second = ticks_per_sec.QuadPart;
+  ATOMIC_THREAD_FENCE(memory_order_release);
+  g_time_ticks_now_function = now_function;
+}
 
-    return new HighResolutionTickClock(ticks_per_second.QuadPart);
-  }
-};
+TimeTicks InitialTimeTicksNowFunction() {
+  InitializeTimeTicksNowFunctionPointer();
+  return g_time_ticks_now_function();
+}
 
+#undef ATOMIC_THREAD_FENCE
 
-static LazyDynamicInstance<TickClock, CreateHighResTickClockTrait,
-                           ThreadSafeInitOnceTrait>::type high_res_tick_clock =
-    LAZY_DYNAMIC_INSTANCE_INITIALIZER;
+}  // namespace
 
 // static
 TimeTicks TimeTicks::Now() {
   // Make sure we never return 0 here.
-  TimeTicks ticks(tick_clock.Pointer()->Now());
+  TimeTicks ticks(g_time_ticks_now_function());
   DCHECK(!ticks.IsNull());
   return ticks;
 }
 
 // static
-TimeTicks TimeTicks::HighResolutionNow() {
-  // Make sure we never return 0 here.
-  TimeTicks ticks(high_res_tick_clock.Pointer()->Now());
-  DCHECK(!ticks.IsNull());
-  return ticks;
-}
-
-
-// static
-bool TimeTicks::IsHighResolutionClockWorking() {
-  return high_res_tick_clock.Pointer()->IsHighResolution();
+bool TimeTicks::IsHighResolution() {
+  if (g_time_ticks_now_function == &InitialTimeTicksNowFunction)
+    InitializeTimeTicksNowFunctionPointer();
+  return g_time_ticks_now_function == &QPCNow;
 }
 
 #else  // V8_OS_WIN
 
 TimeTicks TimeTicks::Now() {
-  return HighResolutionNow();
-}
-
-
-TimeTicks TimeTicks::HighResolutionNow() {
   int64_t ticks;
 #if V8_OS_MACOSX
   static struct mach_timebase_info info;
@@ -627,11 +739,8 @@ TimeTicks TimeTicks::HighResolutionNow() {
   return TimeTicks(ticks + 1);
 }
 
-
 // static
-bool TimeTicks::IsHighResolutionClockWorking() {
-  return true;
-}
+bool TimeTicks::IsHighResolution() { return true; }
 
 #endif  // V8_OS_WIN
 
diff --git a/deps/v8/src/base/platform/time.h b/deps/v8/src/base/platform/time.h
index 25dee1c4199..161092ad8bd 100644
--- a/deps/v8/src/base/platform/time.h
+++ b/deps/v8/src/base/platform/time.h
@@ -5,6 +5,8 @@
 #ifndef V8_BASE_PLATFORM_TIME_H_
 #define V8_BASE_PLATFORM_TIME_H_
 
+#include <stdint.h>
+
 #include <ctime>
 #include <iosfwd>
 #include <limits>
@@ -45,7 +47,7 @@ class TimeBase;
 
 class V8_BASE_EXPORT TimeDelta final {
  public:
-  TimeDelta() : delta_(0) {}
+  constexpr TimeDelta() : delta_(0) {}
 
   // Converts units of time to TimeDeltas.
   static TimeDelta FromDays(int days);
@@ -58,6 +60,27 @@ class V8_BASE_EXPORT TimeDelta final {
   }
   static TimeDelta FromNanoseconds(int64_t nanoseconds);
 
+  // Returns the maximum time delta, which should be greater than any reasonable
+  // time delta we might compare it to. Adding or subtracting the maximum time
+  // delta to a time or another time delta has an undefined result.
+  static constexpr TimeDelta Max();
+
+  // Returns the minimum time delta, which should be less than than any
+  // reasonable time delta we might compare it to. Adding or subtracting the
+  // minimum time delta to a time or another time delta has an undefined result.
+  static constexpr TimeDelta Min();
+
+  // Returns true if the time delta is zero.
+  constexpr bool IsZero() const { return delta_ == 0; }
+
+  // Returns true if the time delta is the maximum/minimum time delta.
+  constexpr bool IsMax() const {
+    return delta_ == std::numeric_limits<int64_t>::max();
+  }
+  constexpr bool IsMin() const {
+    return delta_ == std::numeric_limits<int64_t>::min();
+  }
+
   // Returns the time delta in some unit. The F versions return a floating
   // point value, the "regular" versions return a rounded-down value.
   //
@@ -71,7 +94,7 @@ class V8_BASE_EXPORT TimeDelta final {
   double InMillisecondsF() const;
   int64_t InMilliseconds() const;
   int64_t InMillisecondsRoundedUp() const;
-  int64_t InMicroseconds() const { return delta_; }
+  int64_t InMicroseconds() const;
   int64_t InNanoseconds() const;
 
   // Converts to/from Mach time specs.
@@ -103,9 +126,7 @@ class V8_BASE_EXPORT TimeDelta final {
     delta_ -= other.delta_;
     return *this;
   }
-  TimeDelta operator-() const {
-    return TimeDelta(-delta_);
-  }
+  constexpr TimeDelta operator-() const { return TimeDelta(-delta_); }
 
   double TimesOf(const TimeDelta& other) const {
     return static_cast<double>(delta_) / static_cast<double>(other.delta_);
@@ -135,22 +156,22 @@ class V8_BASE_EXPORT TimeDelta final {
   }
 
   // Comparison operators.
-  bool operator==(const TimeDelta& other) const {
+  constexpr bool operator==(const TimeDelta& other) const {
     return delta_ == other.delta_;
   }
-  bool operator!=(const TimeDelta& other) const {
+  constexpr bool operator!=(const TimeDelta& other) const {
     return delta_ != other.delta_;
   }
-  bool operator<(const TimeDelta& other) const {
+  constexpr bool operator<(const TimeDelta& other) const {
     return delta_ < other.delta_;
   }
-  bool operator<=(const TimeDelta& other) const {
+  constexpr bool operator<=(const TimeDelta& other) const {
     return delta_ <= other.delta_;
   }
-  bool operator>(const TimeDelta& other) const {
+  constexpr bool operator>(const TimeDelta& other) const {
     return delta_ > other.delta_;
   }
-  bool operator>=(const TimeDelta& other) const {
+  constexpr bool operator>=(const TimeDelta& other) const {
     return delta_ >= other.delta_;
   }
 
@@ -159,12 +180,21 @@ class V8_BASE_EXPORT TimeDelta final {
   // Constructs a delta given the duration in microseconds. This is private
   // to avoid confusion by callers with an integer constructor. Use
   // FromSeconds, FromMilliseconds, etc. instead.
-  explicit TimeDelta(int64_t delta) : delta_(delta) {}
+  explicit constexpr TimeDelta(int64_t delta) : delta_(delta) {}
 
   // Delta in microseconds.
   int64_t delta_;
 };
 
+// static
+constexpr TimeDelta TimeDelta::Max() {
+  return TimeDelta(std::numeric_limits<int64_t>::max());
+}
+
+// static
+constexpr TimeDelta TimeDelta::Min() {
+  return TimeDelta(std::numeric_limits<int64_t>::min());
+}
 
 namespace time_internal {
 
@@ -177,33 +207,52 @@ namespace time_internal {
 template<class TimeClass>
 class TimeBase {
  public:
-  static const int64_t kHoursPerDay = 24;
-  static const int64_t kMillisecondsPerSecond = 1000;
-  static const int64_t kMillisecondsPerDay =
+  static constexpr int64_t kHoursPerDay = 24;
+  static constexpr int64_t kMillisecondsPerSecond = 1000;
+  static constexpr int64_t kMillisecondsPerDay =
       kMillisecondsPerSecond * 60 * 60 * kHoursPerDay;
-  static const int64_t kMicrosecondsPerMillisecond = 1000;
-  static const int64_t kMicrosecondsPerSecond =
+  static constexpr int64_t kMicrosecondsPerMillisecond = 1000;
+  static constexpr int64_t kMicrosecondsPerSecond =
       kMicrosecondsPerMillisecond * kMillisecondsPerSecond;
-  static const int64_t kMicrosecondsPerMinute = kMicrosecondsPerSecond * 60;
-  static const int64_t kMicrosecondsPerHour = kMicrosecondsPerMinute * 60;
-  static const int64_t kMicrosecondsPerDay =
+  static constexpr int64_t kMicrosecondsPerMinute = kMicrosecondsPerSecond * 60;
+  static constexpr int64_t kMicrosecondsPerHour = kMicrosecondsPerMinute * 60;
+  static constexpr int64_t kMicrosecondsPerDay =
       kMicrosecondsPerHour * kHoursPerDay;
-  static const int64_t kMicrosecondsPerWeek = kMicrosecondsPerDay * 7;
-  static const int64_t kNanosecondsPerMicrosecond = 1000;
-  static const int64_t kNanosecondsPerSecond =
+  static constexpr int64_t kMicrosecondsPerWeek = kMicrosecondsPerDay * 7;
+  static constexpr int64_t kNanosecondsPerMicrosecond = 1000;
+  static constexpr int64_t kNanosecondsPerSecond =
       kNanosecondsPerMicrosecond * kMicrosecondsPerSecond;
 
+#if V8_OS_WIN
+  // To avoid overflow in QPC to Microseconds calculations, since we multiply
+  // by kMicrosecondsPerSecond, then the QPC value should not exceed
+  // (2^63 - 1) / 1E6. If it exceeds that threshold, we divide then multiply.
+  static constexpr int64_t kQPCOverflowThreshold = INT64_C(0x8637BD05AF7);
+#endif
+
   // Returns true if this object has not been initialized.
   //
   // Warning: Be careful when writing code that performs math on time values,
   // since it's possible to produce a valid "zero" result that should not be
   // interpreted as a "null" value.
-  bool IsNull() const {
-    return us_ == 0;
+  constexpr bool IsNull() const { return us_ == 0; }
+
+  // Returns the maximum/minimum times, which should be greater/less than any
+  // reasonable time with which we might compare it.
+  static TimeClass Max() {
+    return TimeClass(std::numeric_limits<int64_t>::max());
+  }
+  static TimeClass Min() {
+    return TimeClass(std::numeric_limits<int64_t>::min());
   }
 
-  // Returns true if this object represents the maximum time.
-  bool IsMax() const { return us_ == std::numeric_limits<int64_t>::max(); }
+  // Returns true if this object represents the maximum/minimum time.
+  constexpr bool IsMax() const {
+    return us_ == std::numeric_limits<int64_t>::max();
+  }
+  constexpr bool IsMin() const {
+    return us_ == std::numeric_limits<int64_t>::min();
+  }
 
   // For serializing only. Use FromInternalValue() to reconstitute. Please don't
   // use this and do arithmetic on it, as it is more error prone than using the
@@ -263,7 +312,7 @@ class TimeBase {
   static TimeClass FromInternalValue(int64_t us) { return TimeClass(us); }
 
  protected:
-  explicit TimeBase(int64_t us) : us_(us) {}
+  explicit constexpr TimeBase(int64_t us) : us_(us) {}
 
   // Time value in a microsecond timebase.
   int64_t us_;
@@ -281,7 +330,7 @@ class TimeBase {
 class V8_BASE_EXPORT Time final : public time_internal::TimeBase<Time> {
  public:
   // Contains the nullptr time. Use Time::Now() to get the current time.
-  Time() : TimeBase(0) {}
+  constexpr Time() : TimeBase(0) {}
 
   // Returns the current time. Watch out, the system might adjust its clock
   // in which case time will actually go backwards. We don't guarantee that
@@ -297,10 +346,6 @@ class V8_BASE_EXPORT Time final : public time_internal::TimeBase<Time> {
   // Returns the time for epoch in Unix-like system (Jan 1, 1970).
   static Time UnixEpoch() { return Time(0); }
 
-  // Returns the maximum time, which should be greater than any reasonable time
-  // with which we might compare it.
-  static Time Max() { return Time(std::numeric_limits<int64_t>::max()); }
-
   // Converts to/from POSIX time specs.
   static Time FromTimespec(struct timespec ts);
   struct timespec ToTimespec() const;
@@ -320,7 +365,7 @@ class V8_BASE_EXPORT Time final : public time_internal::TimeBase<Time> {
 
  private:
   friend class time_internal::TimeBase<Time>;
-  explicit Time(int64_t us) : TimeBase(us) {}
+  explicit constexpr Time(int64_t us) : TimeBase(us) {}
 };
 
 V8_BASE_EXPORT std::ostream& operator<<(std::ostream&, const Time&);
@@ -343,30 +388,29 @@ inline Time operator+(const TimeDelta& delta, const Time& time) {
 class V8_BASE_EXPORT TimeTicks final
     : public time_internal::TimeBase<TimeTicks> {
  public:
-  TimeTicks() : TimeBase(0) {}
+  constexpr TimeTicks() : TimeBase(0) {}
 
-  // Platform-dependent tick count representing "right now."
-  // The resolution of this clock is ~1-15ms.  Resolution varies depending
-  // on hardware/operating system configuration.
+  // Platform-dependent tick count representing "right now." When
+  // IsHighResolution() returns false, the resolution of the clock could be as
+  // coarse as ~15.6ms. Otherwise, the resolution should be no worse than one
+  // microsecond.
   // This method never returns a null TimeTicks.
   static TimeTicks Now();
 
-  // Returns a platform-dependent high-resolution tick count. Implementation
-  // is hardware dependent and may or may not return sub-millisecond
-  // resolution.  THIS CALL IS GENERALLY MUCH MORE EXPENSIVE THAN Now() AND
-  // SHOULD ONLY BE USED WHEN IT IS REALLY NEEDED.
-  // This method never returns a null TimeTicks.
+  // This is equivalent to Now() but DCHECKs that IsHighResolution(). Useful for
+  // test frameworks that rely on high resolution clocks (in practice all
+  // platforms but low-end Windows devices have high resolution clocks).
   static TimeTicks HighResolutionNow();
 
   // Returns true if the high-resolution clock is working on this system.
-  static bool IsHighResolutionClockWorking();
+  static bool IsHighResolution();
 
  private:
   friend class time_internal::TimeBase<TimeTicks>;
 
   // Please use Now() to create a new object. This is for internal use
   // and testing. Ticks are in microseconds.
-  explicit TimeTicks(int64_t ticks) : TimeBase(ticks) {}
+  explicit constexpr TimeTicks(int64_t ticks) : TimeBase(ticks) {}
 };
 
 inline TimeTicks operator+(const TimeDelta& delta, const TimeTicks& ticks) {
@@ -381,7 +425,7 @@ inline TimeTicks operator+(const TimeDelta& delta, const TimeTicks& ticks) {
 class V8_BASE_EXPORT ThreadTicks final
     : public time_internal::TimeBase<ThreadTicks> {
  public:
-  ThreadTicks() : TimeBase(0) {}
+  constexpr ThreadTicks() : TimeBase(0) {}
 
   // Returns true if ThreadTicks::Now() is supported on this system.
   static bool IsSupported();
@@ -416,7 +460,7 @@ class V8_BASE_EXPORT ThreadTicks final
 
   // Please use Now() or GetForThread() to create a new object. This is for
   // internal use and testing. Ticks are in microseconds.
-  explicit ThreadTicks(int64_t ticks) : TimeBase(ticks) {}
+  explicit constexpr ThreadTicks(int64_t ticks) : TimeBase(ticks) {}
 
 #if V8_OS_WIN
   // Returns the frequency of the TSC in ticks per second, or 0 if it hasn't
diff --git a/deps/v8/src/base/qnx-math.h b/deps/v8/src/base/qnx-math.h
index 6ff18f8d123..1503c164fae 100644
--- a/deps/v8/src/base/qnx-math.h
+++ b/deps/v8/src/base/qnx-math.h
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 #ifndef V8_BASE_QNX_MATH_H_
-#define V8_QBASE_NX_MATH_H_
+#define V8_BASE_QNX_MATH_H_
 
 #include <cmath>
 
diff --git a/deps/v8/src/base/sys-info.cc b/deps/v8/src/base/sys-info.cc
index 28ff780dd3d..3d47ebe8f78 100644
--- a/deps/v8/src/base/sys-info.cc
+++ b/deps/v8/src/base/sys-info.cc
@@ -5,11 +5,13 @@
 #include "src/base/sys-info.h"
 
 #if V8_OS_POSIX
-#include <sys/resource.h>
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <unistd.h>
+#if !V8_OS_FUCHSIA
+#include <sys/resource.h>
+#endif
 #endif
 
 #if V8_OS_BSD
@@ -101,7 +103,7 @@ int64_t SysInfo::AmountOfPhysicalMemory() {
 
 // static
 int64_t SysInfo::AmountOfVirtualMemory() {
-#if V8_OS_WIN
+#if V8_OS_WIN || V8_OS_FUCHSIA
   return 0;
 #elif V8_OS_POSIX
   struct rlimit rlim;
diff --git a/deps/v8/src/base/template-utils.h b/deps/v8/src/base/template-utils.h
index 18850695cb5..07356346ec8 100644
--- a/deps/v8/src/base/template-utils.h
+++ b/deps/v8/src/base/template-utils.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_BASE_TEMPLATE_UTILS_H
-#define V8_BASE_TEMPLATE_UTILS_H
+#ifndef V8_BASE_TEMPLATE_UTILS_H_
+#define V8_BASE_TEMPLATE_UTILS_H_
 
 #include <array>
 #include <memory>
@@ -79,20 +79,13 @@ struct pass_value_or_ref {
                                          decay_t, const decay_t&>::type;
 };
 
+// Uses expression SFINAE to detect whether using operator<< would work.
+template <typename T, typename = void>
+struct has_output_operator : std::false_type {};
 template <typename T>
-struct has_output_operator {
-  // This template is only instantiable if U provides operator<< with ostream.
-  // Its return type is uint8_t.
-  template <typename U>
-  static auto __check_operator(U u)
-      -> decltype(*(std::ostream*)nullptr << *u, uint8_t{0});
-  // This is a fallback implementation, returning uint16_t. If the template
-  // above is instantiable, is has precedence over this varargs function.
-  static uint16_t __check_operator(...);
-
-  using ptr_t = typename std::add_pointer<T>::type;
-  static constexpr bool value = sizeof(__check_operator(ptr_t{nullptr})) == 1;
-};
+struct has_output_operator<T, decltype(void(std::declval<std::ostream&>()
+                                            << std::declval<T>()))>
+    : std::true_type {};
 
 namespace detail {
 
@@ -131,4 +124,4 @@ constexpr auto fold(Func func, Ts&&... more) ->
 }  // namespace base
 }  // namespace v8
 
-#endif  // V8_BASE_TEMPLATE_UTILS_H
+#endif  // V8_BASE_TEMPLATE_UTILS_H_
diff --git a/deps/v8/src/base/v8-fallthrough.h b/deps/v8/src/base/v8-fallthrough.h
new file mode 100644
index 00000000000..f61238de060
--- /dev/null
+++ b/deps/v8/src/base/v8-fallthrough.h
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_BASE_V8_FALLTHROUGH_H_
+#define V8_BASE_V8_FALLTHROUGH_H_
+
+// When clang suggests inserting [[clang::fallthrough]], it first checks if
+// it knows of a macro expanding to it, and if so suggests inserting the
+// macro.  This means that this macro must be used only in code internal
+// to v8, so that v8's user code doesn't end up getting suggestions
+// for V8_FALLTHROUGH instead of the user-specific fallthrough macro.
+// So do not include this header in any of v8's public headers -- only
+// use it in src/, not in include/.
+#if defined(__clang__)
+#define V8_FALLTHROUGH [[clang::fallthrough]]  // NOLINT(whitespace/braces)
+#else
+#define V8_FALLTHROUGH
+#endif
+
+#endif  // V8_BASE_V8_FALLTHROUGH_H_
diff --git a/deps/v8/src/bit-vector.h b/deps/v8/src/bit-vector.h
index 71d69b20c2d..ef876007537 100644
--- a/deps/v8/src/bit-vector.h
+++ b/deps/v8/src/bit-vector.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_DATAFLOW_H_
-#define V8_DATAFLOW_H_
+#ifndef V8_BIT_VECTOR_H_
+#define V8_BIT_VECTOR_H_
 
 #include "src/allocation.h"
 #include "src/zone/zone.h"
@@ -370,4 +370,4 @@ class GrowableBitVector BASE_EMBEDDED {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_DATAFLOW_H_
+#endif  // V8_BIT_VECTOR_H_
diff --git a/deps/v8/src/bootstrapper.cc b/deps/v8/src/bootstrapper.cc
index 2bc833fe296..626251202d3 100644
--- a/deps/v8/src/bootstrapper.cc
+++ b/deps/v8/src/bootstrapper.cc
@@ -356,28 +356,22 @@ void Bootstrapper::DetachGlobal(Handle<Context> env) {
 
 namespace {
 
-// Non-construct case.
 V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateSharedFunctionInfo(
     Isolate* isolate, Builtins::Name builtin_id, Handle<String> name, int len) {
-  Handle<Code> code = isolate->builtins()->builtin_handle(builtin_id);
-  const bool kNotConstructor = false;
-  Handle<SharedFunctionInfo> shared = isolate->factory()->NewSharedFunctionInfo(
-      name, code, kNotConstructor, kNormalFunction, builtin_id);
+  Handle<SharedFunctionInfo> shared =
+      isolate->factory()->NewSharedFunctionInfoForBuiltin(name, builtin_id,
+                                                          kNormalFunction);
   shared->set_internal_formal_parameter_count(len);
   shared->set_length(len);
   return shared;
 }
 
-// Construct case.
-V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateSharedFunctionInfo(
-    Isolate* isolate, Builtins::Name builtin_id, Handle<String> name,
-    Handle<String> instance_class_name, int len) {
-  Handle<Code> code = isolate->builtins()->builtin_handle(builtin_id);
-  const bool kIsConstructor = true;
-  Handle<SharedFunctionInfo> shared = isolate->factory()->NewSharedFunctionInfo(
-      name, code, kIsConstructor, kNormalFunction, builtin_id);
+V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateBuiltinSharedFunctionInfo(
+    Isolate* isolate, Builtins::Name builtin_id, Handle<String> name, int len) {
+  Handle<SharedFunctionInfo> shared =
+      isolate->factory()->NewSharedFunctionInfoForBuiltin(name, builtin_id,
+                                                          kNormalFunction);
   shared->SetConstructStub(*BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
-  shared->set_instance_class_name(*instance_class_name);
   shared->set_internal_formal_parameter_count(len);
   shared->set_length(len);
   return shared;
@@ -389,9 +383,6 @@ V8_NOINLINE void InstallFunction(Handle<JSObject> target,
                                  Handle<String> function_name,
                                  PropertyAttributes attributes = DONT_ENUM) {
   JSObject::AddProperty(target, property_name, function, attributes);
-  if (target->IsJSGlobalObject()) {
-    function->shared()->set_instance_class_name(*function_name);
-  }
 }
 
 V8_NOINLINE void InstallFunction(Handle<JSObject> target,
@@ -405,14 +396,13 @@ V8_NOINLINE Handle<JSFunction> CreateFunction(
     Isolate* isolate, Handle<String> name, InstanceType type, int instance_size,
     int inobject_properties, MaybeHandle<Object> maybe_prototype,
     Builtins::Name builtin_id) {
-  Handle<Code> code(isolate->builtins()->builtin(builtin_id));
   Handle<Object> prototype;
   Handle<JSFunction> result;
 
   if (maybe_prototype.ToHandle(&prototype)) {
     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
-        name, code, prototype, type, instance_size, inobject_properties,
-        builtin_id, IMMUTABLE);
+        name, prototype, type, instance_size, inobject_properties, builtin_id,
+        IMMUTABLE);
 
     result = isolate->factory()->NewFunction(args);
     // Make the JSFunction's prototype object fast.
@@ -420,7 +410,7 @@ V8_NOINLINE Handle<JSFunction> CreateFunction(
                                  kStartAtReceiver, isolate);
   } else {
     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
-        name, code, builtin_id, LanguageMode::kStrict);
+        name, builtin_id, LanguageMode::kStrict);
     result = isolate->factory()->NewFunction(args);
   }
 
@@ -611,20 +601,18 @@ Handle<JSFunction> Genesis::CreateEmptyFunction(Isolate* isolate) {
 
   // Allocate the empty function as the prototype for function according to
   // ES#sec-properties-of-the-function-prototype-object
-  Handle<Code> code(BUILTIN_CODE(isolate, EmptyFunction));
-  NewFunctionArgs args =
-      NewFunctionArgs::ForBuiltin(factory->empty_string(), code,
-                                  empty_function_map, Builtins::kEmptyFunction);
+  NewFunctionArgs args = NewFunctionArgs::ForBuiltin(
+      factory->empty_string(), empty_function_map, Builtins::kEmptyFunction);
   Handle<JSFunction> empty_function = factory->NewFunction(args);
 
   // --- E m p t y ---
   Handle<String> source = factory->NewStringFromStaticChars("() {}");
   Handle<Script> script = factory->NewScript(source);
   script->set_type(Script::TYPE_NATIVE);
-  Handle<FixedArray> infos = factory->NewFixedArray(2);
+  Handle<WeakFixedArray> infos = factory->NewWeakFixedArray(2);
   script->set_shared_function_infos(*infos);
-  empty_function->shared()->set_start_position(0);
-  empty_function->shared()->set_end_position(source->length());
+  empty_function->shared()->set_raw_start_position(0);
+  empty_function->shared()->set_raw_end_position(source->length());
   empty_function->shared()->set_function_literal_id(1);
   empty_function->shared()->DontAdaptArguments();
   SharedFunctionInfo::SetScript(handle(empty_function->shared()), script);
@@ -666,9 +654,8 @@ Handle<JSFunction> Genesis::GetThrowTypeErrorIntrinsic() {
     return restricted_properties_thrower_;
   }
   Handle<String> name(factory()->empty_string());
-  Handle<Code> code = BUILTIN_CODE(isolate(), StrictPoisonPillThrower);
   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
-      name, code, Builtins::kStrictPoisonPillThrower, i::LanguageMode::kStrict);
+      name, Builtins::kStrictPoisonPillThrower, i::LanguageMode::kStrict);
   Handle<JSFunction> function = factory()->NewFunction(args);
   function->shared()->DontAdaptArguments();
 
@@ -765,7 +752,7 @@ void Genesis::CreateObjectFunction(Handle<JSFunction> empty_function) {
   object_fun->shared()->set_length(1);
   object_fun->shared()->DontAdaptArguments();
   object_fun->shared()->SetConstructStub(
-      *BUILTIN_CODE(isolate_, ObjectConstructor_ConstructStub));
+      *BUILTIN_CODE(isolate_, JSBuiltinsConstructStub));
   native_context()->set_object_function(*object_fun);
 
   {
@@ -1231,11 +1218,10 @@ Handle<JSGlobalObject> Genesis::CreateNewGlobals(
 
   if (js_global_object_template.is_null()) {
     Handle<String> name(factory()->empty_string());
-    Handle<Code> code = BUILTIN_CODE(isolate(), Illegal);
     Handle<JSObject> prototype =
         factory()->NewFunctionPrototype(isolate()->object_function());
     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
-        name, code, prototype, JS_GLOBAL_OBJECT_TYPE, JSGlobalObject::kSize, 0,
+        name, prototype, JS_GLOBAL_OBJECT_TYPE, JSGlobalObject::kSize, 0,
         Builtins::kIllegal, MUTABLE);
     js_global_object_function = factory()->NewFunction(args);
 #ifdef DEBUG
@@ -1264,9 +1250,8 @@ Handle<JSGlobalObject> Genesis::CreateNewGlobals(
   Handle<JSFunction> global_proxy_function;
   if (global_proxy_template.IsEmpty()) {
     Handle<String> name(factory()->empty_string());
-    Handle<Code> code = BUILTIN_CODE(isolate(), Illegal);
     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
-        name, code, factory()->the_hole_value(), JS_GLOBAL_PROXY_TYPE,
+        name, factory()->the_hole_value(), JS_GLOBAL_PROXY_TYPE,
         JSGlobalProxy::SizeWithEmbedderFields(0), 0, Builtins::kIllegal,
         MUTABLE);
     global_proxy_function = factory()->NewFunction(args);
@@ -1279,8 +1264,6 @@ Handle<JSGlobalObject> Genesis::CreateNewGlobals(
         isolate(), global_constructor, factory()->the_hole_value(),
         ApiNatives::GlobalProxyType);
   }
-  Handle<String> global_name = factory()->global_string();
-  global_proxy_function->shared()->set_instance_class_name(*global_name);
   global_proxy_function->initial_map()->set_is_access_check_needed(true);
   global_proxy_function->initial_map()->set_has_hidden_prototype(true);
   global_proxy_function->initial_map()->set_may_have_interesting_symbols(true);
@@ -1347,10 +1330,9 @@ static void InstallError(Isolate* isolate, Handle<JSObject> global,
   Handle<JSFunction> error_fun = InstallFunction(
       global, name, JS_ERROR_TYPE, JSObject::kHeaderSize, 0,
       factory->the_hole_value(), Builtins::kErrorConstructor, DONT_ENUM);
-  error_fun->shared()->set_instance_class_name(*factory->Error_string());
   error_fun->shared()->DontAdaptArguments();
   error_fun->shared()->SetConstructStub(
-      *BUILTIN_CODE(isolate, ErrorConstructor));
+      *BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
   error_fun->shared()->set_length(1);
 
   if (context_index == Context::ERROR_FUNCTION_INDEX) {
@@ -1405,11 +1387,9 @@ static void InstallError(Isolate* isolate, Handle<JSObject> global,
 namespace {
 
 void InstallMakeError(Isolate* isolate, int builtin_id, int context_index) {
-  Handle<Code> code(isolate->builtins()->builtin(builtin_id));
   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
-      isolate->factory()->empty_string(), code,
-      isolate->factory()->the_hole_value(), JS_OBJECT_TYPE,
-      JSObject::kHeaderSize, 0, builtin_id, MUTABLE);
+      isolate->factory()->empty_string(), isolate->factory()->the_hole_value(),
+      JS_OBJECT_TYPE, JSObject::kHeaderSize, 0, builtin_id, MUTABLE);
 
   Handle<JSFunction> function = isolate->factory()->NewFunction(args);
   function->shared()->DontAdaptArguments();
@@ -1508,9 +1488,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
         object_function, "keys", Builtins::kObjectKeys, 1, true);
     native_context()->set_object_keys(*object_keys);
     SimpleInstallFunction(object_function, factory->entries_string(),
-                          Builtins::kObjectEntries, 1, false);
+                          Builtins::kObjectEntries, 1, true);
     SimpleInstallFunction(object_function, factory->values_string(),
-                          Builtins::kObjectValues, 1, false);
+                          Builtins::kObjectValues, 1, true);
 
     SimpleInstallFunction(isolate->initial_object_prototype(),
                           "__defineGetter__", Builtins::kObjectDefineGetter, 2,
@@ -1560,7 +1540,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     function_fun->set_prototype_or_initial_map(*isolate->sloppy_function_map());
     function_fun->shared()->DontAdaptArguments();
     function_fun->shared()->SetConstructStub(
-        *BUILTIN_CODE(isolate, FunctionConstructor));
+        *BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
     function_fun->shared()->set_length(1);
     InstallWithIntrinsicDefaultProto(isolate, function_fun,
                                      Context::FUNCTION_FUNCTION_INDEX);
@@ -1611,50 +1591,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     native_context()->set_async_iterator_value_unwrap_shared_fun(*info);
   }
 
-  {  // --- A s y n c G e n e r a t o r ---
-    Handle<JSFunction> await_caught =
-        SimpleCreateFunction(isolate, factory->empty_string(),
-                             Builtins::kAsyncGeneratorAwaitCaught, 1, false);
-    native_context()->set_async_generator_await_caught(*await_caught);
-
-    Handle<JSFunction> await_uncaught =
-        SimpleCreateFunction(isolate, factory->empty_string(),
-                             Builtins::kAsyncGeneratorAwaitUncaught, 1, false);
-    native_context()->set_async_generator_await_uncaught(*await_uncaught);
-
-    Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-        isolate, Builtins::kAsyncGeneratorAwaitResolveClosure,
-        factory->empty_string(), 1);
-    native_context()->set_async_generator_await_resolve_shared_fun(*info);
-
-    info = SimpleCreateSharedFunctionInfo(
-        isolate, Builtins::kAsyncGeneratorAwaitRejectClosure,
-        factory->empty_string(), 1);
-    native_context()->set_async_generator_await_reject_shared_fun(*info);
-
-    info = SimpleCreateSharedFunctionInfo(
-        isolate, Builtins::kAsyncGeneratorYieldResolveClosure,
-        factory->empty_string(), 1);
-    native_context()->set_async_generator_yield_resolve_shared_fun(*info);
-
-    info = SimpleCreateSharedFunctionInfo(
-        isolate, Builtins::kAsyncGeneratorReturnResolveClosure,
-        factory->empty_string(), 1);
-    native_context()->set_async_generator_return_resolve_shared_fun(*info);
-
-    info = SimpleCreateSharedFunctionInfo(
-        isolate, Builtins::kAsyncGeneratorReturnClosedResolveClosure,
-        factory->empty_string(), 1);
-    native_context()->set_async_generator_return_closed_resolve_shared_fun(
-        *info);
-
-    info = SimpleCreateSharedFunctionInfo(
-        isolate, Builtins::kAsyncGeneratorReturnClosedRejectClosure,
-        factory->empty_string(), 1);
-    native_context()->set_async_generator_return_closed_reject_shared_fun(
-        *info);
-  }
-
   {  // --- A r r a y ---
     Handle<JSFunction> array_function = InstallFunction(
         global, "Array", JS_ARRAY_TYPE, JSArray::kSize, 0,
@@ -1688,9 +1624,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     // Cache the array maps, needed by ArrayConstructorStub
     CacheInitialJSArrayMaps(native_context(), initial_map);
-    ArrayConstructorStub array_constructor_stub(isolate);
-    Handle<Code> code = array_constructor_stub.GetCode();
-    array_function->shared()->SetConstructStub(*code);
+    array_function->shared()->SetConstructStub(
+        *BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
 
     // Set up %ArrayPrototype%.
     // The %ArrayPrototype% has TERMINAL_FAST_ELEMENTS_KIND in order to ensure
@@ -1705,6 +1640,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
         array_function, "isArray", Builtins::kArrayIsArray, 1, true);
     native_context()->set_is_arraylike(*is_arraylike);
 
+    SimpleInstallFunction(array_function, "from", Builtins::kArrayFrom, 1,
+                          false);
+    SimpleInstallFunction(array_function, "of", Builtins::kArrayOf, 0, false);
+
     JSObject::AddProperty(proto, factory->constructor_string(), array_function,
                           DONT_ENUM);
 
@@ -1719,12 +1658,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     SimpleInstallFunction(proto, "shift", Builtins::kArrayPrototypeShift, 0,
                           false);
     SimpleInstallFunction(proto, "unshift", Builtins::kArrayUnshift, 1, false);
-    if (FLAG_enable_experimental_builtins) {
-      SimpleInstallFunction(proto, "slice", Builtins::kArrayPrototypeSlice, 2,
-                            false);
-    } else {
-      SimpleInstallFunction(proto, "slice", Builtins::kArraySlice, 2, false);
-    }
+    SimpleInstallFunction(proto, "slice", Builtins::kArrayPrototypeSlice, 2,
+                          false);
     SimpleInstallFunction(proto, "splice", Builtins::kArraySplice, 2, false);
     SimpleInstallFunction(proto, "includes", Builtins::kArrayIncludes, 1,
                           false);
@@ -1763,71 +1698,16 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
                           Builtins::kArrayIteratorPrototypeNext, 0, true,
                           kArrayIteratorNext);
 
-    Handle<JSFunction> array_iterator_function = CreateFunction(
-        isolate, factory->ArrayIterator_string(),
-        JS_FAST_ARRAY_VALUE_ITERATOR_TYPE, JSArrayIterator::kSize, 0,
-        array_iterator_prototype, Builtins::kIllegal);
+    Handle<JSFunction> array_iterator_function =
+        CreateFunction(isolate, factory->ArrayIterator_string(),
+                       JS_ARRAY_ITERATOR_TYPE, JSArrayIterator::kSize, 0,
+                       array_iterator_prototype, Builtins::kIllegal);
     array_iterator_function->shared()->set_native(false);
-    array_iterator_function->shared()->set_instance_class_name(
-        isolate->heap()->ArrayIterator_string());
 
+    native_context()->set_initial_array_iterator_map(
+        array_iterator_function->initial_map());
     native_context()->set_initial_array_iterator_prototype(
         *array_iterator_prototype);
-    native_context()->set_initial_array_iterator_prototype_map(
-        array_iterator_prototype->map());
-
-    Handle<Map> initial_map(array_iterator_function->initial_map(), isolate);
-
-#define ARRAY_ITERATOR_LIST(V)                                              \
-  V(TYPED_ARRAY, KEY, typed_array, key)                                     \
-  V(FAST_ARRAY, KEY, fast_array, key)                                       \
-  V(GENERIC_ARRAY, KEY, array, key)                                         \
-  V(UINT8_ARRAY, KEY_VALUE, uint8_array, key_value)                         \
-  V(INT8_ARRAY, KEY_VALUE, int8_array, key_value)                           \
-  V(UINT16_ARRAY, KEY_VALUE, uint16_array, key_value)                       \
-  V(INT16_ARRAY, KEY_VALUE, int16_array, key_value)                         \
-  V(UINT32_ARRAY, KEY_VALUE, uint32_array, key_value)                       \
-  V(INT32_ARRAY, KEY_VALUE, int32_array, key_value)                         \
-  V(FLOAT32_ARRAY, KEY_VALUE, float32_array, key_value)                     \
-  V(FLOAT64_ARRAY, KEY_VALUE, float64_array, key_value)                     \
-  V(UINT8_CLAMPED_ARRAY, KEY_VALUE, uint8_clamped_array, key_value)         \
-  V(FAST_SMI_ARRAY, KEY_VALUE, fast_smi_array, key_value)                   \
-  V(FAST_HOLEY_SMI_ARRAY, KEY_VALUE, fast_holey_smi_array, key_value)       \
-  V(FAST_ARRAY, KEY_VALUE, fast_array, key_value)                           \
-  V(FAST_HOLEY_ARRAY, KEY_VALUE, fast_holey_array, key_value)               \
-  V(FAST_DOUBLE_ARRAY, KEY_VALUE, fast_double_array, key_value)             \
-  V(FAST_HOLEY_DOUBLE_ARRAY, KEY_VALUE, fast_holey_double_array, key_value) \
-  V(GENERIC_ARRAY, KEY_VALUE, array, key_value)                             \
-  V(UINT8_ARRAY, VALUE, uint8_array, value)                                 \
-  V(INT8_ARRAY, VALUE, int8_array, value)                                   \
-  V(UINT16_ARRAY, VALUE, uint16_array, value)                               \
-  V(INT16_ARRAY, VALUE, int16_array, value)                                 \
-  V(UINT32_ARRAY, VALUE, uint32_array, value)                               \
-  V(INT32_ARRAY, VALUE, int32_array, value)                                 \
-  V(FLOAT32_ARRAY, VALUE, float32_array, value)                             \
-  V(FLOAT64_ARRAY, VALUE, float64_array, value)                             \
-  V(UINT8_CLAMPED_ARRAY, VALUE, uint8_clamped_array, value)                 \
-  V(FAST_SMI_ARRAY, VALUE, fast_smi_array, value)                           \
-  V(FAST_HOLEY_SMI_ARRAY, VALUE, fast_holey_smi_array, value)               \
-  V(FAST_ARRAY, VALUE, fast_array, value)                                   \
-  V(FAST_HOLEY_ARRAY, VALUE, fast_holey_array, value)                       \
-  V(FAST_DOUBLE_ARRAY, VALUE, fast_double_array, value)                     \
-  V(FAST_HOLEY_DOUBLE_ARRAY, VALUE, fast_holey_double_array, value)         \
-  V(GENERIC_ARRAY, VALUE, array, value)
-
-#define CREATE_ARRAY_ITERATOR_MAP(PREFIX, SUFFIX, prefix, suffix)           \
-  do {                                                                      \
-    const InstanceType type = JS_##PREFIX##_##SUFFIX##_ITERATOR_TYPE;       \
-    Handle<Map> map =                                                       \
-        Map::Copy(initial_map, "JS_" #PREFIX "_" #SUFFIX "_ITERATOR_TYPE"); \
-    map->set_instance_type(type);                                           \
-    native_context()->set_##prefix##_##suffix##_iterator_map(*map);         \
-  } while (0);
-
-    ARRAY_ITERATOR_LIST(CREATE_ARRAY_ITERATOR_MAP)
-
-#undef CREATE_ARRAY_ITERATOR_MAP
-#undef ARRAY_ITERATOR_LIST
   }
 
   {  // --- N u m b e r ---
@@ -1837,7 +1717,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     number_fun->shared()->set_builtin_function_id(kNumberConstructor);
     number_fun->shared()->DontAdaptArguments();
     number_fun->shared()->SetConstructStub(
-        *BUILTIN_CODE(isolate, NumberConstructor_ConstructStub));
+        *BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
     number_fun->shared()->set_length(1);
     InstallWithIntrinsicDefaultProto(isolate, number_fun,
                                      Context::NUMBER_FUNCTION_INDEX);
@@ -1953,7 +1833,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
         isolate->initial_object_prototype(), Builtins::kBooleanConstructor);
     boolean_fun->shared()->DontAdaptArguments();
     boolean_fun->shared()->SetConstructStub(
-        *BUILTIN_CODE(isolate, BooleanConstructor_ConstructStub));
+        *BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
     boolean_fun->shared()->set_length(1);
     InstallWithIntrinsicDefaultProto(isolate, boolean_fun,
                                      Context::BOOLEAN_FUNCTION_INDEX);
@@ -1981,7 +1861,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
         isolate->initial_object_prototype(), Builtins::kStringConstructor);
     string_fun->shared()->set_builtin_function_id(kStringConstructor);
     string_fun->shared()->SetConstructStub(
-        *BUILTIN_CODE(isolate, StringConstructor_ConstructStub));
+        *BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
     string_fun->shared()->DontAdaptArguments();
     string_fun->shared()->set_length(1);
     InstallWithIntrinsicDefaultProto(isolate, string_fun,
@@ -2102,9 +1982,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     SimpleInstallFunction(prototype, "trim", Builtins::kStringPrototypeTrim, 0,
                           false);
     SimpleInstallFunction(prototype, "trimLeft",
-                          Builtins::kStringPrototypeTrimLeft, 0, false);
+                          Builtins::kStringPrototypeTrimStart, 0, false);
     SimpleInstallFunction(prototype, "trimRight",
-                          Builtins::kStringPrototypeTrimRight, 0, false);
+                          Builtins::kStringPrototypeTrimEnd, 0, false);
 #ifdef V8_INTL_SUPPORT
     SimpleInstallFunction(prototype, "toLowerCase",
                           Builtins::kStringPrototypeToLowerCaseIntl, 0, true);
@@ -2163,7 +2043,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
         factory->the_hole_value(), Builtins::kSymbolConstructor);
     symbol_fun->shared()->set_builtin_function_id(kSymbolConstructor);
     symbol_fun->shared()->SetConstructStub(
-        *BUILTIN_CODE(isolate, SymbolConstructor_ConstructStub));
+        *BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
     symbol_fun->shared()->set_length(0);
     symbol_fun->shared()->DontAdaptArguments();
     native_context()->set_symbol_function(*symbol_fun);
@@ -2231,7 +2111,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     InstallWithIntrinsicDefaultProto(isolate, date_fun,
                                      Context::DATE_FUNCTION_INDEX);
     date_fun->shared()->SetConstructStub(
-        *BUILTIN_CODE(isolate, DateConstructor_ConstructStub));
+        *BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
     date_fun->shared()->set_length(7);
     date_fun->shared()->DontAdaptArguments();
 
@@ -2355,16 +2235,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {
-    Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
+    Handle<SharedFunctionInfo> info = SimpleCreateBuiltinSharedFunctionInfo(
         isolate, Builtins::kPromiseGetCapabilitiesExecutor,
-        factory->empty_string(), factory->Object_string(), 2);
+        factory->empty_string(), 2);
     native_context()->set_promise_get_capabilities_executor_shared_fun(*info);
-
-    // %new_promise_capability(C, debugEvent)
-    Handle<JSFunction> new_promise_capability =
-        SimpleCreateFunction(isolate, factory->empty_string(),
-                             Builtins::kNewPromiseCapability, 2, false);
-    native_context()->set_new_promise_capability(*new_promise_capability);
   }
 
   {  // -- P r o m i s e
@@ -2376,7 +2250,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     Handle<SharedFunctionInfo> shared(promise_fun->shared(), isolate);
     shared->SetConstructStub(*BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
-    shared->set_instance_class_name(isolate->heap()->Object_string());
     shared->set_internal_formal_parameter_count(1);
     shared->set_length(1);
 
@@ -2387,7 +2260,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     SimpleInstallFunction(promise_fun, "race", Builtins::kPromiseRace, 1, true);
 
     SimpleInstallFunction(promise_fun, "resolve",
-                          Builtins::kPromiseResolveWrapper, 1, true);
+                          Builtins::kPromiseResolveTrampoline, 1, true);
 
     SimpleInstallFunction(promise_fun, "reject", Builtins::kPromiseReject, 1,
                           true);
@@ -2395,6 +2268,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     // Setup %PromisePrototype%.
     Handle<JSObject> prototype(
         JSObject::cast(promise_fun->instance_prototype()));
+    native_context()->set_promise_prototype(*prototype);
 
     // Install the @@toStringTag property on the {prototype}.
     JSObject::AddProperty(
@@ -2423,64 +2297,25 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     Handle<Map> prototype_map(prototype->map());
     Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate);
 
-    // Store the initial Promise.prototype map. This is used in fast-path
-    // checks. Do not alter the prototype after this point.
-    native_context()->set_promise_prototype_map(*prototype_map);
-
-    {  // Internal: PromiseInternalConstructor
-       // Also exposed as extrasUtils.createPromise.
-      Handle<JSFunction> function =
-          SimpleCreateFunction(isolate, factory->empty_string(),
-                               Builtins::kPromiseInternalConstructor, 1, true);
-      function->shared()->set_native(false);
-      native_context()->set_promise_internal_constructor(*function);
-    }
-
     {  // Internal: IsPromise
       Handle<JSFunction> function = SimpleCreateFunction(
           isolate, factory->empty_string(), Builtins::kIsPromise, 1, false);
       native_context()->set_is_promise(*function);
     }
 
-    {  // Internal: ResolvePromise
-       // Also exposed as extrasUtils.resolvePromise.
-      Handle<JSFunction> function = SimpleCreateFunction(
-          isolate, factory->empty_string(), Builtins::kResolvePromise, 2, true);
-      function->shared()->set_native(false);
-      native_context()->set_promise_resolve(*function);
-    }
-
-    {  // Internal: PromiseHandle
-      Handle<JSFunction> function =
-          SimpleCreateFunction(isolate, factory->empty_string(),
-                               Builtins::kPromiseHandleJS, 5, false);
-      native_context()->set_promise_handle(*function);
-    }
-
-    {  // Internal: PromiseHandleReject
-      Handle<JSFunction> function =
-          SimpleCreateFunction(isolate, factory->empty_string(),
-                               Builtins::kPromiseHandleReject, 3, false);
-      native_context()->set_promise_handle_reject(*function);
-    }
-
-    {  // Internal: InternalPromiseReject
-      Handle<JSFunction> function =
-          SimpleCreateFunction(isolate, factory->empty_string(),
-                               Builtins::kInternalPromiseReject, 3, true);
-      function->shared()->set_native(false);
-      native_context()->set_promise_internal_reject(*function);
-    }
-
     {
       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate, Builtins::kPromiseResolveClosure, factory->empty_string(),
-          1);
-      native_context()->set_promise_resolve_shared_fun(*info);
+          isolate, Builtins::kPromiseCapabilityDefaultResolve,
+          factory->empty_string(), 1);
+      info->set_native(true);
+      native_context()->set_promise_capability_default_resolve_shared_fun(
+          *info);
 
       info = SimpleCreateSharedFunctionInfo(
-          isolate, Builtins::kPromiseRejectClosure, factory->empty_string(), 1);
-      native_context()->set_promise_reject_shared_fun(*info);
+          isolate, Builtins::kPromiseCapabilityDefaultReject,
+          factory->empty_string(), 1);
+      info->set_native(true);
+      native_context()->set_promise_capability_default_reject_shared_fun(*info);
     }
 
     {
@@ -2512,7 +2347,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     Handle<SharedFunctionInfo> shared(regexp_fun->shared(), isolate);
     shared->SetConstructStub(*BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
-    shared->set_instance_class_name(isolate->heap()->RegExp_string());
     shared->set_internal_formal_parameter_count(2);
     shared->set_length(2);
 
@@ -2739,8 +2573,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   // Initialize the embedder data slot.
-  Handle<FixedArray> embedder_data = factory->NewFixedArray(3);
-  native_context()->set_embedder_data(*embedder_data);
+  native_context()->set_embedder_data(*factory->empty_fixed_array());
 
   {  // -- J S O N
     Handle<String> name = factory->InternalizeUtf8String("JSON");
@@ -2962,7 +2795,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 #endif  // V8_INTL_SUPPORT
 
   {  // -- A r r a y B u f f e r
-    Handle<String> name = factory->InternalizeUtf8String("ArrayBuffer");
+    Handle<String> name = factory->ArrayBuffer_string();
     Handle<JSFunction> array_buffer_fun = CreateArrayBuffer(name, ARRAY_BUFFER);
     JSObject::AddProperty(global, name, array_buffer_fun, DONT_ENUM);
     InstallWithIntrinsicDefaultProto(isolate, array_buffer_fun,
@@ -2978,7 +2811,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // -- S h a r e d A r r a y B u f f e r
-    Handle<String> name = factory->InternalizeUtf8String("SharedArrayBuffer");
+    Handle<String> name = factory->SharedArrayBuffer_string();
     Handle<JSFunction> shared_array_buffer_fun =
         CreateArrayBuffer(name, SHARED_ARRAY_BUFFER);
     InstallWithIntrinsicDefaultProto(isolate, shared_array_buffer_fun,
@@ -3025,6 +2858,11 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     InstallSpeciesGetter(typed_array_fun);
     native_context()->set_typed_array_function(*typed_array_fun);
 
+    SimpleInstallFunction(typed_array_fun, "of", Builtins::kTypedArrayOf, 0,
+                          false);
+    SimpleInstallFunction(typed_array_fun, "from", Builtins::kTypedArrayFrom, 1,
+                          false);
+
     // Setup %TypedArrayPrototype%.
     Handle<JSObject> prototype(
         JSObject::cast(typed_array_fun->instance_prototype()));
@@ -3068,6 +2906,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
                           Builtins::kTypedArrayPrototypeEvery, 1, false);
     SimpleInstallFunction(prototype, "fill",
                           Builtins::kTypedArrayPrototypeFill, 1, false);
+    SimpleInstallFunction(prototype, "filter",
+                          Builtins::kTypedArrayPrototypeFilter, 1, false);
     SimpleInstallFunction(prototype, "find", Builtins::kTypedArrayPrototypeFind,
                           1, false);
     SimpleInstallFunction(prototype, "findIndex",
@@ -3094,6 +2934,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
                           Builtins::kTypedArrayPrototypeSlice, 2, false);
     SimpleInstallFunction(prototype, "some", Builtins::kTypedArrayPrototypeSome,
                           1, false);
+    SimpleInstallFunction(prototype, "subarray",
+                          Builtins::kTypedArrayPrototypeSubArray, 2, false);
   }
 
   {  // -- T y p e d A r r a y s
@@ -3106,29 +2948,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
     TYPED_ARRAYS(INSTALL_TYPED_ARRAY)
 #undef INSTALL_TYPED_ARRAY
-
-    // %typed_array_construct_by_length
-    Handle<JSFunction> construct_by_length = SimpleCreateFunction(
-        isolate,
-        factory->NewStringFromAsciiChecked("typedArrayConstructByLength"),
-        Builtins::kTypedArrayConstructByLength, 3, false);
-    native_context()->set_typed_array_construct_by_length(*construct_by_length);
-
-    // %typed_array_construct_by_array_buffer
-    Handle<JSFunction> construct_by_buffer = SimpleCreateFunction(
-        isolate,
-        factory->NewStringFromAsciiChecked("typedArrayConstructByArrayBuffer"),
-        Builtins::kTypedArrayConstructByArrayBuffer, 5, false);
-    native_context()->set_typed_array_construct_by_array_buffer(
-        *construct_by_buffer);
-
-    // %typed_array_construct_by_array_like
-    Handle<JSFunction> construct_by_array_like = SimpleCreateFunction(
-        isolate,
-        factory->NewStringFromAsciiChecked("typedArrayConstructByArrayLike"),
-        Builtins::kTypedArrayConstructByArrayLike, 4, false);
-    native_context()->set_typed_array_construct_by_array_like(
-        *construct_by_array_like);
   }
 
   {  // -- D a t a V i e w
@@ -3139,7 +2958,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     InstallWithIntrinsicDefaultProto(isolate, data_view_fun,
                                      Context::DATA_VIEW_FUN_INDEX);
     data_view_fun->shared()->SetConstructStub(
-        *BUILTIN_CODE(isolate, DataViewConstructor_ConstructStub));
+        *BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
     data_view_fun->shared()->set_length(3);
     data_view_fun->shared()->DontAdaptArguments();
 
@@ -3219,7 +3038,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     Handle<SharedFunctionInfo> shared(js_map_fun->shared(), isolate);
     shared->SetConstructStub(*BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
-    shared->set_instance_class_name(isolate->heap()->Map_string());
     shared->DontAdaptArguments();
     shared->set_length(0);
 
@@ -3263,6 +3081,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
                         BuiltinFunctionId::kMapSize);
     SimpleInstallFunction(prototype, "values", Builtins::kMapPrototypeValues, 0,
                           true);
+
+    native_context()->set_initial_map_prototype_map(prototype->map());
+
     InstallSpeciesGetter(js_map_fun);
   }
 
@@ -3275,7 +3096,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     Handle<SharedFunctionInfo> shared(js_set_fun->shared(), isolate);
     shared->SetConstructStub(*BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
-    shared->set_instance_class_name(isolate->heap()->Set_string());
     shared->DontAdaptArguments();
     shared->set_length(0);
 
@@ -3314,6 +3134,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     JSObject::AddProperty(prototype, factory->keys_string(), values, DONT_ENUM);
     JSObject::AddProperty(prototype, factory->iterator_symbol(), values,
                           DONT_ENUM);
+
+    native_context()->set_initial_set_prototype_map(prototype->map());
+
     InstallSpeciesGetter(js_set_fun);
   }
 
@@ -3369,7 +3192,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     Handle<SharedFunctionInfo> shared(cons->shared(), isolate);
     shared->SetConstructStub(*BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
-    shared->set_instance_class_name(isolate->heap()->WeakMap_string());
     shared->DontAdaptArguments();
     shared->set_length(0);
 
@@ -3380,13 +3202,16 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
                           Builtins::kWeakMapPrototypeDelete, 1, true);
     SimpleInstallFunction(prototype, "get", Builtins::kWeakMapGet, 1, true);
     SimpleInstallFunction(prototype, "has", Builtins::kWeakMapHas, 1, true);
-    SimpleInstallFunction(prototype, "set", Builtins::kWeakMapPrototypeSet, 2,
-                          true);
+    Handle<JSFunction> weakmap_set = SimpleInstallFunction(
+        prototype, "set", Builtins::kWeakMapPrototypeSet, 2, true);
+    native_context()->set_weakmap_set(*weakmap_set);
 
     JSObject::AddProperty(
         prototype, factory->to_string_tag_symbol(),
         factory->NewStringFromAsciiChecked("WeakMap"),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+
+    native_context()->set_initial_weakmap_prototype_map(prototype->map());
   }
 
   {  // -- W e a k S e t
@@ -3398,7 +3223,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     Handle<SharedFunctionInfo> shared(cons->shared(), isolate);
     shared->SetConstructStub(*BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
-    shared->set_instance_class_name(isolate->heap()->WeakSet_string());
     shared->DontAdaptArguments();
     shared->set_length(0);
 
@@ -3408,13 +3232,16 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     SimpleInstallFunction(prototype, "delete",
                           Builtins::kWeakSetPrototypeDelete, 1, true);
     SimpleInstallFunction(prototype, "has", Builtins::kWeakSetHas, 1, true);
-    SimpleInstallFunction(prototype, "add", Builtins::kWeakSetPrototypeAdd, 1,
-                          true);
+    Handle<JSFunction> weakset_add = SimpleInstallFunction(
+        prototype, "add", Builtins::kWeakSetPrototypeAdd, 1, true);
+    native_context()->set_weakset_add(*weakset_add);
 
     JSObject::AddProperty(
         prototype, factory->to_string_tag_symbol(),
         factory->NewStringFromAsciiChecked("WeakSet"),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+
+    native_context()->set_initial_weakset_prototype_map(prototype->map());
   }
 
   {  // -- P r o x y
@@ -3436,17 +3263,16 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     proxy_function_map->SetInObjectUnusedPropertyFields(unused_property_fields);
 
     Handle<String> name = factory->Proxy_string();
-    Handle<Code> code(BUILTIN_CODE(isolate, ProxyConstructor));
 
     NewFunctionArgs args = NewFunctionArgs::ForBuiltin(
-        name, code, proxy_function_map, Builtins::kProxyConstructor);
+        name, proxy_function_map, Builtins::kProxyConstructor);
     Handle<JSFunction> proxy_function = factory->NewFunction(args);
 
     JSFunction::SetInitialMap(proxy_function, isolate->proxy_map(),
                               factory->null_value());
 
     proxy_function->shared()->SetConstructStub(
-        *BUILTIN_CODE(isolate, ProxyConstructor_ConstructStub));
+        *BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
     proxy_function->shared()->set_internal_formal_parameter_count(2);
     proxy_function->shared()->set_length(2);
 
@@ -3541,16 +3367,12 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // --- sloppy arguments map
-    // Make sure we can recognize argument objects at runtime.
-    // This is done by introducing an anonymous function with
-    // class_name equals 'Arguments'.
     Handle<String> arguments_string = factory->Arguments_string();
     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
-        arguments_string, BUILTIN_CODE(isolate, Illegal),
-        isolate->initial_object_prototype(), JS_ARGUMENTS_TYPE,
-        JSSloppyArgumentsObject::kSize, 2, Builtins::kIllegal, MUTABLE);
+        arguments_string, isolate->initial_object_prototype(),
+        JS_ARGUMENTS_TYPE, JSSloppyArgumentsObject::kSize, 2,
+        Builtins::kIllegal, MUTABLE);
     Handle<JSFunction> function = factory->NewFunction(args);
-    function->shared()->set_instance_class_name(*arguments_string);
     Handle<Map> map(function->initial_map());
 
     // Create the descriptor array for the arguments object.
@@ -3641,8 +3463,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
         CreateFunction(isolate, factory->empty_string(),
                        JS_CONTEXT_EXTENSION_OBJECT_TYPE, JSObject::kHeaderSize,
                        0, factory->the_hole_value(), Builtins::kIllegal);
-    Handle<String> name = factory->InternalizeUtf8String("context_extension");
-    context_extension_fun->shared()->set_instance_class_name(*name);
     native_context()->set_context_extension_function(*context_extension_fun);
   }
 
@@ -3674,9 +3494,14 @@ Handle<JSFunction> Genesis::InstallTypedArray(const char* name,
 
   Handle<JSFunction> result = InstallFunction(
       global, name, JS_TYPED_ARRAY_TYPE, JSTypedArray::kSizeWithEmbedderFields,
-      0, factory()->the_hole_value(), Builtins::kIllegal);
+      0, factory()->the_hole_value(), Builtins::kTypedArrayConstructor);
   result->initial_map()->set_elements_kind(elements_kind);
 
+  result->shared()->DontAdaptArguments();
+  result->shared()->set_length(3);
+  result->shared()->SetConstructStub(
+      *BUILTIN_CODE(isolate_, JSBuiltinsConstructStub));
+
   CHECK(JSObject::SetPrototype(result, typed_array_function, false, kDontThrow)
             .FromJust());
 
@@ -3757,25 +3582,15 @@ bool Bootstrapper::CompileNative(Isolate* isolate, Vector<const char> name,
                                  Handle<Object> argv[],
                                  NativesFlag natives_flag) {
   SuppressDebug compiling_natives(isolate->debug());
-  // During genesis, the boilerplate for stack overflow won't work until the
-  // environment has been at least partially initialized. Add a stack check
-  // before entering JS code to catch overflow early.
-  StackLimitCheck check(isolate);
-  if (check.JsHasOverflowed(kStackSpaceRequiredForCompilation * KB)) {
-    isolate->StackOverflow();
-    return false;
-  }
 
   Handle<Context> context(isolate->context());
-
   Handle<String> script_name =
       isolate->factory()->NewStringFromUtf8(name).ToHandleChecked();
   MaybeHandle<SharedFunctionInfo> maybe_function_info =
       Compiler::GetSharedFunctionInfoForScript(
-          source, script_name, 0, 0, ScriptOriginOptions(),
-          MaybeHandle<Object>(), context, nullptr, nullptr,
-          ScriptCompiler::kNoCompileOptions, ScriptCompiler::kNoCacheNoReason,
-          natives_flag, MaybeHandle<FixedArray>());
+          source, Compiler::ScriptDetails(script_name), ScriptOriginOptions(),
+          nullptr, nullptr, ScriptCompiler::kNoCompileOptions,
+          ScriptCompiler::kNoCacheNoReason, natives_flag);
   Handle<SharedFunctionInfo> function_info;
   if (!maybe_function_info.ToHandle(&function_info)) return false;
 
@@ -3838,11 +3653,9 @@ bool Genesis::CompileExtension(Isolate* isolate, v8::Extension* extension) {
         factory->NewStringFromUtf8(name).ToHandleChecked();
     MaybeHandle<SharedFunctionInfo> maybe_function_info =
         Compiler::GetSharedFunctionInfoForScript(
-            source, script_name, 0, 0, ScriptOriginOptions(),
-            MaybeHandle<Object>(), context, extension, nullptr,
-            ScriptCompiler::kNoCompileOptions,
-            ScriptCompiler::kNoCacheBecauseV8Extension, EXTENSION_CODE,
-            MaybeHandle<FixedArray>());
+            source, Compiler::ScriptDetails(script_name), ScriptOriginOptions(),
+            extension, nullptr, ScriptCompiler::kNoCompileOptions,
+            ScriptCompiler::kNoCacheBecauseV8Extension, EXTENSION_CODE);
     if (!maybe_function_info.ToHandle(&function_info)) return false;
     cache->Add(name, function_info);
   }
@@ -3963,7 +3776,7 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
         native_context->generator_function_map());
     generator_function_function->shared()->DontAdaptArguments();
     generator_function_function->shared()->SetConstructStub(
-        *BUILTIN_CODE(isolate, GeneratorFunctionConstructor));
+        *BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
     generator_function_function->shared()->set_length(1);
     InstallWithIntrinsicDefaultProto(
         isolate, generator_function_function,
@@ -3993,7 +3806,7 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
         native_context->async_generator_function_map());
     async_generator_function_function->shared()->DontAdaptArguments();
     async_generator_function_function->shared()->SetConstructStub(
-        *BUILTIN_CODE(isolate, AsyncGeneratorFunctionConstructor));
+        *BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
     async_generator_function_function->shared()->set_length(1);
     InstallWithIntrinsicDefaultProto(
         isolate, async_generator_function_function,
@@ -4012,7 +3825,7 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
   }
 
   {  // -- S e t I t e r a t o r
-    Handle<String> name = factory->InternalizeUtf8String("Set Iterator");
+    Handle<String> name = factory->SetIterator_string();
 
     // Setup %SetIteratorPrototype%.
     Handle<JSObject> prototype =
@@ -4034,7 +3847,6 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
         InstallFunction(container, "SetIterator", JS_SET_VALUE_ITERATOR_TYPE,
                         JSSetIterator::kSize, 0, prototype, Builtins::kIllegal);
     set_iterator_function->shared()->set_native(false);
-    set_iterator_function->shared()->set_instance_class_name(*name);
 
     Handle<Map> set_value_iterator_map(set_iterator_function->initial_map(),
                                        isolate);
@@ -4048,7 +3860,7 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
   }
 
   {  // -- M a p I t e r a t o r
-    Handle<String> name = factory->InternalizeUtf8String("Map Iterator");
+    Handle<String> name = factory->MapIterator_string();
 
     // Setup %MapIteratorPrototype%.
     Handle<JSObject> prototype =
@@ -4070,7 +3882,6 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
         InstallFunction(container, "MapIterator", JS_MAP_KEY_ITERATOR_TYPE,
                         JSMapIterator::kSize, 0, prototype, Builtins::kIllegal);
     map_iterator_function->shared()->set_native(false);
-    map_iterator_function->shared()->set_instance_class_name(*name);
 
     Handle<Map> map_key_iterator_map(map_iterator_function->initial_map(),
                                      isolate);
@@ -4089,11 +3900,10 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
   }
 
   {  // -- S c r i p t
-    Handle<String> name = factory->InternalizeUtf8String("Script");
+    Handle<String> name = factory->Script_string();
     Handle<JSFunction> script_fun = InstallFunction(
         container, name, JS_VALUE_TYPE, JSValue::kSize, 0,
         factory->the_hole_value(), Builtins::kUnsupportedThrower, DONT_ENUM);
-    script_fun->shared()->set_instance_class_name(*name);
     native_context->set_script_function(*script_fun);
 
     Handle<Map> script_map = Handle<Map>(script_fun->initial_map());
@@ -4209,7 +4019,7 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
         native_context->async_function_map());
     async_function_constructor->shared()->DontAdaptArguments();
     async_function_constructor->shared()->SetConstructStub(
-        *BUILTIN_CODE(isolate, AsyncFunctionConstructor));
+        *BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
     async_function_constructor->shared()->set_length(1);
     native_context->set_async_function_constructor(*async_function_constructor);
     JSObject::ForceSetPrototype(async_function_constructor,
@@ -4223,34 +4033,6 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
     JSFunction::SetPrototype(async_function_constructor,
                              async_function_prototype);
 
-    {
-      Handle<JSFunction> function =
-          SimpleCreateFunction(isolate, factory->empty_string(),
-                               Builtins::kAsyncFunctionAwaitCaught, 2, false);
-      native_context->set_async_function_await_caught(*function);
-    }
-
-    {
-      Handle<JSFunction> function =
-          SimpleCreateFunction(isolate, factory->empty_string(),
-                               Builtins::kAsyncFunctionAwaitUncaught, 2, false);
-      native_context->set_async_function_await_uncaught(*function);
-    }
-
-    {
-      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate, Builtins::kAsyncFunctionAwaitRejectClosure,
-          factory->empty_string(), 1);
-      native_context->set_async_function_await_reject_shared_fun(*info);
-    }
-
-    {
-      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate, Builtins::kAsyncFunctionAwaitResolveClosure,
-          factory->empty_string(), 1);
-      native_context->set_async_function_await_resolve_shared_fun(*info);
-    }
-
     {
       Handle<JSFunction> function =
           SimpleCreateFunction(isolate, factory->empty_string(),
@@ -4344,7 +4126,6 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_do_expressions)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_named_captures)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_property)
-EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_function_sent)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_function_tostring)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_public_fields)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_private_fields)
@@ -4354,6 +4135,10 @@ EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_dynamic_import)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_import_meta)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_restrict_constructor_return)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_optional_catch_binding)
+EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_subsume_json)
+EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_numeric_separator)
+
+#undef EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE
 
 void InstallPublicSymbol(Factory* factory, Handle<Context> native_context,
                          const char* name, Handle<Symbol> value) {
@@ -4390,6 +4175,41 @@ void Genesis::InitializeGlobal_harmony_sharedarraybuffer() {
   }
 }
 
+void Genesis::InitializeGlobal_harmony_string_trimming() {
+  if (!FLAG_harmony_string_trimming) return;
+
+  Handle<JSGlobalObject> global(native_context()->global_object());
+  Isolate* isolate = global->GetIsolate();
+  Factory* factory = isolate->factory();
+
+  Handle<JSObject> string_prototype(
+      native_context()->initial_string_prototype());
+
+  {
+    Handle<String> trim_left_name = factory->InternalizeUtf8String("trimLeft");
+    Handle<String> trim_start_name =
+        factory->InternalizeUtf8String("trimStart");
+    Handle<JSFunction> trim_left_fun = Handle<JSFunction>::cast(
+        JSObject::GetProperty(string_prototype, trim_left_name)
+            .ToHandleChecked());
+    JSObject::AddProperty(string_prototype, trim_start_name, trim_left_fun,
+                          DONT_ENUM);
+    trim_left_fun->shared()->SetName(*trim_start_name);
+  }
+
+  {
+    Handle<String> trim_right_name =
+        factory->InternalizeUtf8String("trimRight");
+    Handle<String> trim_end_name = factory->InternalizeUtf8String("trimEnd");
+    Handle<JSFunction> trim_right_fun = Handle<JSFunction>::cast(
+        JSObject::GetProperty(string_prototype, trim_right_name)
+            .ToHandleChecked());
+    JSObject::AddProperty(string_prototype, trim_end_name, trim_right_fun,
+                          DONT_ENUM);
+    trim_right_fun->shared()->SetName(*trim_end_name);
+  }
+}
+
 void Genesis::InitializeGlobal_harmony_array_prototype_values() {
   if (!FLAG_harmony_array_prototype_values) return;
   Handle<JSFunction> array_constructor(native_context()->array_function());
@@ -4411,6 +4231,17 @@ void Genesis::InitializeGlobal_harmony_array_prototype_values() {
                         NONE);
 }
 
+void Genesis::InitializeGlobal_harmony_array_flatten() {
+  if (!FLAG_harmony_array_flatten) return;
+  Handle<JSFunction> array_constructor(native_context()->array_function());
+  Handle<JSObject> array_prototype(
+      JSObject::cast(array_constructor->instance_prototype()));
+  SimpleInstallFunction(array_prototype, "flatten",
+                        Builtins::kArrayPrototypeFlatten, 0, false, DONT_ENUM);
+  SimpleInstallFunction(array_prototype, "flatMap",
+                        Builtins::kArrayPrototypeFlatMap, 1, false, DONT_ENUM);
+}
+
 void Genesis::InitializeGlobal_harmony_promise_finally() {
   if (!FLAG_harmony_promise_finally) return;
 
@@ -4423,7 +4254,6 @@ void Genesis::InitializeGlobal_harmony_promise_finally() {
   // to prototype, so we update the saved map.
   Handle<Map> prototype_map(prototype->map());
   Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate());
-  native_context()->set_promise_prototype_map(*prototype_map);
 
   {
     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
@@ -4456,17 +4286,26 @@ void Genesis::InitializeGlobal_harmony_promise_finally() {
 }
 
 void Genesis::InitializeGlobal_harmony_bigint() {
-  if (!FLAG_harmony_bigint) return;
-
   Factory* factory = isolate()->factory();
   Handle<JSGlobalObject> global(native_context()->global_object());
+  if (!FLAG_harmony_bigint) {
+    // Typed arrays are installed by default; remove them if the flag is off.
+    CHECK(JSObject::DeleteProperty(
+              global, factory->InternalizeUtf8String("BigInt64Array"))
+              .ToChecked());
+    CHECK(JSObject::DeleteProperty(
+              global, factory->InternalizeUtf8String("BigUint64Array"))
+              .ToChecked());
+    return;
+  }
+
   Handle<JSFunction> bigint_fun =
       InstallFunction(global, "BigInt", JS_VALUE_TYPE, JSValue::kSize, 0,
                       factory->the_hole_value(), Builtins::kBigIntConstructor);
   bigint_fun->shared()->set_builtin_function_id(kBigIntConstructor);
   bigint_fun->shared()->DontAdaptArguments();
   bigint_fun->shared()->SetConstructStub(
-      *BUILTIN_CODE(isolate(), BigIntConstructor_ConstructStub));
+      *BUILTIN_CODE(isolate(), JSBuiltinsConstructStub));
   bigint_fun->shared()->set_length(1);
   InstallWithIntrinsicDefaultProto(isolate(), bigint_fun,
                                    Context::BIGINT_FUNCTION_INDEX);
@@ -4474,9 +4313,6 @@ void Genesis::InitializeGlobal_harmony_bigint() {
       Context::BIGINT_FUNCTION_INDEX);
 
   // Install the properties of the BigInt constructor.
-  // parseInt(string, radix)
-  SimpleInstallFunction(bigint_fun, "parseInt", Builtins::kBigIntParseInt, 2,
-                        false);
   // asUintN(bits, bigint)
   SimpleInstallFunction(bigint_fun, "asUintN", Builtins::kBigIntAsUintN, 2,
                         false);
@@ -4503,6 +4339,20 @@ void Genesis::InitializeGlobal_harmony_bigint() {
   JSObject::AddProperty(prototype, factory->to_string_tag_symbol(),
                         factory->BigInt_string(),
                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+
+  // Install 64-bit DataView accessors.
+  // TODO(jkummerow): Move these to the "DataView" section when dropping the
+  // FLAG_harmony_bigint.
+  Handle<JSObject> dataview_prototype(
+      JSObject::cast(native_context()->data_view_fun()->instance_prototype()));
+  SimpleInstallFunction(dataview_prototype, "getBigInt64",
+                        Builtins::kDataViewPrototypeGetBigInt64, 1, false);
+  SimpleInstallFunction(dataview_prototype, "setBigInt64",
+                        Builtins::kDataViewPrototypeSetBigInt64, 2, false);
+  SimpleInstallFunction(dataview_prototype, "getBigUint64",
+                        Builtins::kDataViewPrototypeGetBigUint64, 1, false);
+  SimpleInstallFunction(dataview_prototype, "setBigUint64",
+                        Builtins::kDataViewPrototypeSetBigUint64, 2, false);
 }
 
 #ifdef V8_INTL_SUPPORT
@@ -4549,12 +4399,10 @@ Handle<JSFunction> Genesis::CreateArrayBuffer(
       CreateFunction(isolate(), name, JS_ARRAY_BUFFER_TYPE,
                      JSArrayBuffer::kSizeWithEmbedderFields, 0, prototype,
                      Builtins::kArrayBufferConstructor);
-  Handle<Code> code =
-      BUILTIN_CODE(isolate(), ArrayBufferConstructor_ConstructStub);
-  array_buffer_fun->shared()->SetConstructStub(*code);
+  array_buffer_fun->shared()->SetConstructStub(
+      *BUILTIN_CODE(isolate(), JSBuiltinsConstructStub));
   array_buffer_fun->shared()->DontAdaptArguments();
   array_buffer_fun->shared()->set_length(1);
-  array_buffer_fun->shared()->set_instance_class_name(*name);
 
   // Install the "constructor" property on the {prototype}.
   JSObject::AddProperty(prototype, factory()->constructor_string(),
@@ -4607,9 +4455,8 @@ Handle<JSFunction> Genesis::InstallInternalArray(Handle<JSObject> target,
       InstallFunction(target, name, JS_ARRAY_TYPE, JSArray::kSize, 0, prototype,
                       Builtins::kInternalArrayConstructor);
 
-  InternalArrayConstructorStub internal_array_constructor_stub(isolate());
-  Handle<Code> code = internal_array_constructor_stub.GetCode();
-  array_function->shared()->SetConstructStub(*code);
+  array_function->shared()->SetConstructStub(
+      *BUILTIN_CODE(isolate_, JSBuiltinsConstructStub));
   array_function->shared()->DontAdaptArguments();
 
   Handle<Map> original_map(array_function->initial_map());
@@ -4650,10 +4497,30 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
 
   InstallInternalArray(extras_utils, "InternalPackedArray", PACKED_ELEMENTS);
 
-  InstallFunction(extras_utils, isolate()->promise_internal_constructor(),
+  // v8.createPromise(parent)
+  Handle<JSFunction> promise_internal_constructor =
+      SimpleCreateFunction(isolate(), factory()->empty_string(),
+                           Builtins::kPromiseInternalConstructor, 1, true);
+  promise_internal_constructor->shared()->set_native(false);
+  InstallFunction(extras_utils, promise_internal_constructor,
                   factory()->NewStringFromAsciiChecked("createPromise"));
-  InstallFunction(extras_utils, isolate()->promise_resolve(),
+
+  // v8.rejectPromise(promise, reason)
+  Handle<JSFunction> promise_internal_reject =
+      SimpleCreateFunction(isolate(), factory()->empty_string(),
+                           Builtins::kPromiseInternalReject, 2, true);
+  promise_internal_reject->shared()->set_native(false);
+  InstallFunction(extras_utils, promise_internal_reject,
+                  factory()->NewStringFromAsciiChecked("rejectPromise"));
+
+  // v8.resolvePromise(promise, resolution)
+  Handle<JSFunction> promise_internal_resolve =
+      SimpleCreateFunction(isolate(), factory()->empty_string(),
+                           Builtins::kPromiseInternalResolve, 2, true);
+  promise_internal_resolve->shared()->set_native(false);
+  InstallFunction(extras_utils, promise_internal_resolve,
                   factory()->NewStringFromAsciiChecked("resolvePromise"));
+
   InstallFunction(extras_utils, isolate()->is_promise(),
                   factory()->NewStringFromAsciiChecked("isPromise"));
 
@@ -4699,8 +4566,8 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
   native_context()->set_fast_template_instantiations_cache(
       *fast_template_instantiations_cache);
 
-  auto slow_template_instantiations_cache =
-      NumberDictionary::New(isolate(), ApiNatives::kInitialFunctionCacheSize);
+  auto slow_template_instantiations_cache = SimpleNumberDictionary::New(
+      isolate(), ApiNatives::kInitialFunctionCacheSize);
   native_context()->set_slow_template_instantiations_cache(
       *slow_template_instantiations_cache);
 
@@ -5272,6 +5139,11 @@ bool Genesis::ConfigureGlobalObjects(
   native_context()->set_js_map_map(js_map_fun->initial_map());
   native_context()->set_js_set_map(js_set_fun->initial_map());
 
+  Handle<JSFunction> js_array_constructor(native_context()->array_function());
+  Handle<JSObject> js_array_prototype(
+      JSObject::cast(js_array_constructor->instance_prototype()));
+  native_context()->set_initial_array_prototype_map(js_array_prototype->map());
+
   return true;
 }
 
@@ -5434,15 +5306,6 @@ Genesis::Genesis(
   // on all function exits.
   SaveContext saved_context(isolate);
 
-  // During genesis, the boilerplate for stack overflow won't work until the
-  // environment has been at least partially initialized. Add a stack check
-  // before entering JS code to catch overflow early.
-  StackLimitCheck check(isolate);
-  if (check.HasOverflowed()) {
-    isolate->StackOverflow();
-    return;
-  }
-
   // The deserializer needs to hook up references to the global proxy.
   // Create an uninitialized global proxy now if we don't have one
   // and initialize it later in CreateNewGlobals.
@@ -5556,6 +5419,11 @@ Genesis::Genesis(
 
   ConfigureUtilsObject(context_type);
 
+  // We created new functions, which may require debug instrumentation.
+  if (isolate->debug()->is_active()) {
+    isolate->debug()->InstallDebugBreakTrampoline();
+  }
+
   native_context()->ResetErrorsThrown();
   result_ = native_context();
 }
@@ -5571,15 +5439,6 @@ Genesis::Genesis(Isolate* isolate,
   // on all function exits.
   SaveContext saved_context(isolate);
 
-  // During genesis, the boilerplate for stack overflow won't work until the
-  // environment has been at least partially initialized. Add a stack check
-  // before entering JS code to catch overflow early.
-  StackLimitCheck check(isolate);
-  if (check.HasOverflowed()) {
-    isolate->StackOverflow();
-    return;
-  }
-
   const int proxy_size = JSGlobalProxy::SizeWithEmbedderFields(
       global_proxy_template->InternalFieldCount());
 
diff --git a/deps/v8/src/bootstrapper.h b/deps/v8/src/bootstrapper.h
index 8afd0a0601e..a554496dfdb 100644
--- a/deps/v8/src/bootstrapper.h
+++ b/deps/v8/src/bootstrapper.h
@@ -25,7 +25,7 @@ class SourceCodeCache final BASE_EMBEDDED {
   void Initialize(Isolate* isolate, bool create_heap_objects);
 
   void Iterate(RootVisitor* v) {
-    v->VisitRootPointer(Root::kExtensions,
+    v->VisitRootPointer(Root::kExtensions, nullptr,
                         bit_cast<Object**, FixedArray**>(&cache_));
   }
 
diff --git a/deps/v8/src/boxed-float.h b/deps/v8/src/boxed-float.h
index 18ee98a9c0a..cdcc8fdad77 100644
--- a/deps/v8/src/boxed-float.h
+++ b/deps/v8/src/boxed-float.h
@@ -51,8 +51,7 @@ class Float32 {
       : bit_pattern_(bit_pattern) {}
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(Float32),
-              "Float32 should be trivially copyable");
+ASSERT_TRIVIALLY_COPYABLE(Float32);
 
 // Safety wrapper for a 64-bit floating-point value to make sure we don't lose
 // the exact bit pattern during deoptimization when passing this value.
@@ -91,8 +90,7 @@ class Float64 {
       : bit_pattern_(bit_pattern) {}
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(Float64),
-              "Float64 should be trivially copyable");
+ASSERT_TRIVIALLY_COPYABLE(Float64);
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/arm/builtins-arm.cc b/deps/v8/src/builtins/arm/builtins-arm.cc
index 2b2b9c2b340..be0b4500c75 100644
--- a/deps/v8/src/builtins/arm/builtins-arm.cc
+++ b/deps/v8/src/builtins/arm/builtins-arm.cc
@@ -88,19 +88,6 @@ void Builtins::Generate_AdaptorWithBuiltinExitFrame(MacroAssembler* masm) {
   AdaptorWithExitFrameType(masm, BUILTIN_EXIT);
 }
 
-// Load the built-in InternalArray function from the current context.
-static void GenerateLoadInternalArrayFunction(MacroAssembler* masm,
-                                              Register result) {
-  // Load the InternalArray function from the current native context.
-  __ LoadNativeContextSlot(Context::INTERNAL_ARRAY_FUNCTION_INDEX, result);
-}
-
-// Load the built-in Array function from the current context.
-static void GenerateLoadArrayFunction(MacroAssembler* masm, Register result) {
-  // Load the Array function from the current native context.
-  __ LoadNativeContextSlot(Context::ARRAY_FUNCTION_INDEX, result);
-}
-
 void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r0     : number of arguments
@@ -109,9 +96,6 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // -----------------------------------
   Label generic_array_code, one_or_more_arguments, two_or_more_arguments;
 
-  // Get the InternalArray function.
-  GenerateLoadInternalArrayFunction(masm, r1);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin InternalArray functions should be maps.
     __ ldr(r2, FieldMemOperand(r1, JSFunction::kPrototypeOrInitialMapOffset));
@@ -124,6 +108,7 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // Run the native code for the InternalArray function called as a normal
   // function.
   // tail call a stub
+  __ LoadRoot(r2, Heap::kUndefinedValueRootIndex);
   InternalArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
@@ -131,38 +116,34 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
 void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r0     : number of arguments
+  //  -- r1     : array function
   //  -- lr     : return address
   //  -- sp[...]: constructor arguments
   // -----------------------------------
   Label generic_array_code, one_or_more_arguments, two_or_more_arguments;
 
-  // Get the Array function.
-  GenerateLoadArrayFunction(masm, r1);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin Array functions should be maps.
-    __ ldr(r2, FieldMemOperand(r1, JSFunction::kPrototypeOrInitialMapOffset));
-    __ SmiTst(r2);
+    __ ldr(r7, FieldMemOperand(r1, JSFunction::kPrototypeOrInitialMapOffset));
+    __ SmiTst(r7);
     __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ CompareObjectType(r2, r3, r4, MAP_TYPE);
+    __ CompareObjectType(r7, r8, r9, MAP_TYPE);
     __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
   }
 
-  __ mov(r3, r1);
+  // r2 is the AllocationSite - here undefined.
+  __ LoadRoot(r2, Heap::kUndefinedValueRootIndex);
+  // If r3 (new target) is undefined, then this is the 'Call' case, so move
+  // r1 (the constructor) to r3.
+  __ cmp(r3, r2);
+  __ mov(r3, r1, LeaveCC, eq);
+
   // Run the native code for the Array function called as a normal function.
   // tail call a stub
-  __ LoadRoot(r2, Heap::kUndefinedValueRootIndex);
   ArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
 
-static void GenerateTailCallToSharedCode(MacroAssembler* masm) {
-  __ ldr(r2, FieldMemOperand(r1, JSFunction::kSharedFunctionInfoOffset));
-  __ ldr(r2, FieldMemOperand(r2, SharedFunctionInfo::kCodeOffset));
-  __ add(r2, r2, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(r2);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -190,6 +171,7 @@ static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
     __ pop(r0);
     __ SmiUntag(r0, r0);
   }
+  static_assert(kJavaScriptCallCodeStartRegister == r2, "ABI mismatch");
   __ add(r2, r2, Operand(Code::kHeaderSize - kHeapObjectTag));
   __ Jump(r2);
 }
@@ -296,8 +278,8 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // -----------------------------------
 
     __ ldr(r4, FieldMemOperand(r1, JSFunction::kSharedFunctionInfoOffset));
-    __ ldr(r4, FieldMemOperand(r4, SharedFunctionInfo::kCompilerHintsOffset));
-    __ tst(r4, Operand(SharedFunctionInfo::kDerivedConstructorMask));
+    __ ldr(r4, FieldMemOperand(r4, SharedFunctionInfo::kFlagsOffset));
+    __ tst(r4, Operand(SharedFunctionInfo::IsDerivedConstructorBit::kMask));
     __ b(ne, &not_create_implicit_receiver);
 
     // If not derived class constructor: Allocate the new receiver object.
@@ -416,8 +398,8 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     __ bind(&other_result);
     __ ldr(r4, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
     __ ldr(r4, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
-    __ ldr(r4, FieldMemOperand(r4, SharedFunctionInfo::kCompilerHintsOffset));
-    __ tst(r4, Operand(SharedFunctionInfo::kClassConstructorMask));
+    __ ldr(r4, FieldMemOperand(r4, SharedFunctionInfo::kFlagsOffset));
+    __ tst(r4, Operand(SharedFunctionInfo::IsClassConstructorBit::kMask));
 
     if (restrict_constructor_return) {
       // Throw if constructor function is a class constructor
@@ -559,9 +541,10 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
     // undefined because generator functions are non-constructable.
     __ Move(r3, r1);
     __ Move(r1, r4);
-    __ ldr(scratch, FieldMemOperand(r1, JSFunction::kCodeOffset));
-    __ add(scratch, scratch, Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ Jump(scratch);
+    static_assert(kJavaScriptCallCodeStartRegister == r2, "ABI mismatch");
+    __ ldr(r2, FieldMemOperand(r1, JSFunction::kCodeOffset));
+    __ add(r2, r2, Operand(Code::kHeaderSize - kHeapObjectTag));
+    __ Jump(r2);
   }
 
   __ bind(&prepare_step_in_if_stepping);
@@ -757,7 +740,7 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   DCHECK(
       !AreAliased(feedback_vector, r0, r1, r3, scratch1, scratch2, scratch3));
 
-  Label optimized_code_slot_is_cell, fallthrough;
+  Label optimized_code_slot_is_weak_ref, fallthrough;
 
   Register closure = r1;
   Register optimized_code_entry = scratch1;
@@ -767,9 +750,9 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
       FieldMemOperand(feedback_vector, FeedbackVector::kOptimizedCodeOffset));
 
   // Check if the code entry is a Smi. If yes, we interpret it as an
-  // optimisation marker. Otherwise, interpret is as a weak cell to a code
+  // optimisation marker. Otherwise, interpret it as a weak reference to a code
   // object.
-  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_cell);
+  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_weak_ref);
 
   {
     // Optimized code slot is a Smi optimization marker.
@@ -804,12 +787,10 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   }
 
   {
-    // Optimized code slot is a WeakCell.
-    __ bind(&optimized_code_slot_is_cell);
+    // Optimized code slot is a weak reference.
+    __ bind(&optimized_code_slot_is_weak_ref);
 
-    __ ldr(optimized_code_entry,
-           FieldMemOperand(optimized_code_entry, WeakCell::kValueOffset));
-    __ JumpIfSmi(optimized_code_entry, &fallthrough);
+    __ LoadWeakValue(optimized_code_entry, optimized_code_entry, &fallthrough);
 
     // Check if the optimized code is marked for deopt. If it is, call the
     // runtime to clear it.
@@ -828,9 +809,10 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
     // register.
     ReplaceClosureCodeWithOptimizedCode(masm, optimized_code_entry, closure,
                                         scratch2, scratch3, feedback_vector);
-    __ add(optimized_code_entry, optimized_code_entry,
+    static_assert(kJavaScriptCallCodeStartRegister == r2, "ABI mismatch");
+    __ add(r2, optimized_code_entry,
            Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ Jump(optimized_code_entry);
+    __ Jump(r2);
 
     // Optimized code slot contains deoptimized code, evict it and re-enter the
     // closure's code.
@@ -844,10 +826,13 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
 }
 
 // Advance the current bytecode offset. This simulates what all bytecode
-// handlers do upon completion of the underlying operation.
-static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
-                                  Register bytecode_offset, Register bytecode,
-                                  Register scratch1) {
+// handlers do upon completion of the underlying operation. Will bail out to a
+// label if the bytecode (without prefix) is a return bytecode.
+static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
+                                          Register bytecode_array,
+                                          Register bytecode_offset,
+                                          Register bytecode, Register scratch1,
+                                          Label* if_return) {
   Register bytecode_size_table = scratch1;
   DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
                      bytecode));
@@ -857,11 +842,11 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
       Operand(ExternalReference::bytecode_size_table_address(masm->isolate())));
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
-  Label load_size, extra_wide;
+  Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
   __ cmp(bytecode, Operand(0x1));
-  __ b(hi, &load_size);
+  __ b(hi, &process_bytecode);
   __ b(eq, &extra_wide);
 
   // Load the next bytecode and update table to the wide scaled table.
@@ -869,7 +854,7 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
   __ ldrb(bytecode, MemOperand(bytecode_array, bytecode_offset));
   __ add(bytecode_size_table, bytecode_size_table,
          Operand(kIntSize * interpreter::Bytecodes::kBytecodeCount));
-  __ jmp(&load_size);
+  __ jmp(&process_bytecode);
 
   __ bind(&extra_wide);
   // Load the next bytecode and update table to the extra wide scaled table.
@@ -878,8 +863,16 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
   __ add(bytecode_size_table, bytecode_size_table,
          Operand(2 * kIntSize * interpreter::Bytecodes::kBytecodeCount));
 
-  // Load the size of the current bytecode.
-  __ bind(&load_size);
+  __ bind(&process_bytecode);
+
+// Bailout to the return label if this is a return bytecode.
+#define JUMP_IF_EQUAL(NAME)                                                    \
+  __ cmp(bytecode, Operand(static_cast<int>(interpreter::Bytecode::k##NAME))); \
+  __ b(if_return, eq);
+  RETURN_BYTECODE_LIST(JUMP_IF_EQUAL)
+#undef JUMP_IF_EQUAL
+
+  // Otherwise, load the size of the current bytecode and advance the offset.
   __ ldr(scratch1, MemOperand(bytecode_size_table, bytecode, LSL, 2));
   __ add(bytecode_offset, bytecode_offset, scratch1);
 }
@@ -907,7 +900,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
 
   // Load the feedback vector from the closure.
   __ ldr(feedback_vector,
-         FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
+         FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
   __ ldr(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
   // Read off the optimized code slot in the feedback vector, and if there
   // is optimized code or an optimization marker, call that instead.
@@ -1008,11 +1001,12 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   __ mov(kInterpreterDispatchTableRegister,
          Operand(ExternalReference::interpreter_dispatch_table_address(
              masm->isolate())));
-  __ ldrb(r1, MemOperand(kInterpreterBytecodeArrayRegister,
+  __ ldrb(r4, MemOperand(kInterpreterBytecodeArrayRegister,
                          kInterpreterBytecodeOffsetRegister));
-  __ ldr(r4, MemOperand(kInterpreterDispatchTableRegister, r1, LSL,
-                        kPointerSizeLog2));
-  __ Call(r4);
+  __ ldr(
+      kJavaScriptCallCodeStartRegister,
+      MemOperand(kInterpreterDispatchTableRegister, r4, LSL, kPointerSizeLog2));
+  __ Call(kJavaScriptCallCodeStartRegister);
   masm->isolate()->heap()->SetInterpreterEntryReturnPCOffset(masm->pc_offset());
 
   // Any returns to the entry trampoline are either due to the return bytecode
@@ -1025,16 +1019,13 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
          MemOperand(fp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
   __ SmiUntag(kInterpreterBytecodeOffsetRegister);
 
-  // Check if we should return.
+  // Either return, or advance to the next bytecode and dispatch.
   Label do_return;
   __ ldrb(r1, MemOperand(kInterpreterBytecodeArrayRegister,
                          kInterpreterBytecodeOffsetRegister));
-  __ cmp(r1, Operand(static_cast<int>(interpreter::Bytecode::kReturn)));
-  __ b(&do_return, eq);
-
-  // Advance to the next bytecode and dispatch.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, r1, r2);
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, r1, r2,
+                                &do_return);
   __ jmp(&do_dispatch);
 
   __ bind(&do_return);
@@ -1076,6 +1067,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
 void Builtins::Generate_InterpreterPushArgsThenCallImpl(
     MacroAssembler* masm, ConvertReceiverMode receiver_mode,
     InterpreterPushArgsMode mode) {
+  DCHECK(mode != InterpreterPushArgsMode::kArrayFunction);
   // ----------- S t a t e -------------
   //  -- r0 : the number of arguments (not including the receiver)
   //  -- r2 : the address of the first argument to be pushed. Subsequent
@@ -1104,11 +1096,7 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
   }
 
   // Call the target.
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
-    __ Jump(
-        masm->isolate()->builtins()->CallFunction(ConvertReceiverMode::kAny),
-        RelocInfo::CODE_TARGET);
-  } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     __ Jump(BUILTIN_CODE(masm->isolate(), CallWithSpread),
             RelocInfo::CODE_TARGET);
   } else {
@@ -1152,15 +1140,13 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
     __ AssertUndefinedOrAllocationSite(r2, r5);
   }
 
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
+  if (mode == InterpreterPushArgsMode::kArrayFunction) {
     __ AssertFunction(r1);
 
-    // Tail call to the function-specific construct stub (still in the caller
+    // Tail call to the array construct stub (still in the caller
     // context at this point).
-    __ ldr(r4, FieldMemOperand(r1, JSFunction::kSharedFunctionInfoOffset));
-    __ ldr(r4, FieldMemOperand(r4, SharedFunctionInfo::kConstructStubOffset));
-    // Jump to the construct function.
-    __ add(pc, r4, Operand(Code::kHeaderSize - kHeapObjectTag));
+    ArrayConstructorStub array_constructor_stub(masm->isolate());
+    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor with r0, r1, and r3 unmodified.
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1215,13 +1201,14 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   __ SmiUntag(kInterpreterBytecodeOffsetRegister);
 
   // Dispatch to the target bytecode.
-  __ ldrb(r1, MemOperand(kInterpreterBytecodeArrayRegister,
-                         kInterpreterBytecodeOffsetRegister));
   UseScratchRegisterScope temps(masm);
   Register scratch = temps.Acquire();
-  __ ldr(scratch, MemOperand(kInterpreterDispatchTableRegister, r1, LSL,
-                             kPointerSizeLog2));
-  __ Jump(scratch);
+  __ ldrb(scratch, MemOperand(kInterpreterBytecodeArrayRegister,
+                              kInterpreterBytecodeOffsetRegister));
+  __ ldr(kJavaScriptCallCodeStartRegister,
+         MemOperand(kInterpreterDispatchTableRegister, scratch, LSL,
+                    kPointerSizeLog2));
+  __ Jump(kJavaScriptCallCodeStartRegister);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
@@ -1237,52 +1224,29 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
                          kInterpreterBytecodeOffsetRegister));
 
   // Advance to the next bytecode.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, r1, r2);
+  Label if_return;
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, r1, r2,
+                                &if_return);
 
   // Convert new bytecode offset to a Smi and save in the stackframe.
   __ SmiTag(r2, kInterpreterBytecodeOffsetRegister);
   __ str(r2, MemOperand(fp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
 
   Generate_InterpreterEnterBytecode(masm);
+
+  // We should never take the if_return path.
+  __ bind(&if_return);
+  __ Abort(AbortReason::kInvalidBytecodeAdvance);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CheckOptimizationMarker(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r0 : argument count (preserved for callee)
-  //  -- r3 : new target (preserved for callee)
-  //  -- r1 : target function (preserved for callee)
-  // -----------------------------------
-  Register closure = r1;
-
-  // Get the feedback vector.
-  Register feedback_vector = r2;
-  __ ldr(feedback_vector,
-         FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
-  __ ldr(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
-
-  // The feedback vector must be defined.
-  if (FLAG_debug_code) {
-    __ CompareRoot(feedback_vector, Heap::kUndefinedValueRootIndex);
-    __ Assert(ne, AbortReason::kExpectedFeedbackVector);
-  }
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, r4, r6, r5);
-
-  // Otherwise, tail call the SFI code.
-  GenerateTailCallToSharedCode(masm);
-}
-
 void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to the trampoline to the
-  // interpreter entry.
-  __ ldr(r2, FieldMemOperand(r1, JSFunction::kSharedFunctionInfoOffset));
-  __ ldr(r2, FieldMemOperand(r2, SharedFunctionInfo::kCodeOffset));
+  // Set the code slot inside the JSFunction to CompileLazy.
+  __ Move(r2, BUILTIN_CODE(masm->isolate(), CompileLazy));
   __ str(r2, FieldMemOperand(r1, JSFunction::kCodeOffset));
   __ RecordWriteField(r1, JSFunction::kCodeOffset, r2, r4, kLRHasNotBeenSaved,
                       kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
@@ -1290,6 +1254,66 @@ void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
   Generate_CompileLazy(masm);
 }
 
+static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
+                                      Register scratch1) {
+  // Figure out the SFI's code object.
+  Label done;
+  Label check_is_bytecode_array;
+  Label check_is_code;
+  Label check_is_fixed_array;
+  Label check_is_pre_parsed_scope_data;
+  Label check_is_function_template_info;
+
+  Register data_type = scratch1;
+
+  // IsSmi: Is builtin
+  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
+  __ Move(scratch1,
+          Operand(ExternalReference::builtins_address(masm->isolate())));
+  __ ldr(sfi_data, MemOperand::PointerAddressFromSmiKey(scratch1, sfi_data));
+  __ b(&done);
+
+  // Get map for subsequent checks.
+  __ bind(&check_is_bytecode_array);
+  __ ldr(data_type, FieldMemOperand(sfi_data, HeapObject::kMapOffset));
+  __ ldrh(data_type, FieldMemOperand(data_type, Map::kInstanceTypeOffset));
+
+  // IsBytecodeArray: Interpret bytecode
+  __ cmp(data_type, Operand(BYTECODE_ARRAY_TYPE));
+  __ b(ne, &check_is_code);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
+  __ b(&done);
+
+  // IsCode: Run code
+  __ bind(&check_is_code);
+  __ cmp(data_type, Operand(CODE_TYPE));
+  __ b(eq, &done);
+
+  // IsFixedArray: Instantiate using AsmWasmData,
+  __ bind(&check_is_fixed_array);
+  __ cmp(data_type, Operand(FIXED_ARRAY_TYPE));
+  __ b(ne, &check_is_pre_parsed_scope_data);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
+  __ b(&done);
+
+  // IsPreParsedScopeData: Compile lazy
+  __ bind(&check_is_pre_parsed_scope_data);
+  __ cmp(data_type, Operand(TUPLE2_TYPE));
+  __ b(ne, &check_is_function_template_info);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
+  __ b(&done);
+
+  // IsFunctionTemplateInfo: API call
+  __ bind(&check_is_function_template_info);
+  if (FLAG_debug_code) {
+    __ cmp(data_type, Operand(FUNCTION_TEMPLATE_INFO_TYPE));
+    __ Assert(eq, AbortReason::kInvalidSharedFunctionInfoData);
+  }
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
+
+  __ bind(&done);
+}
+
 void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r0 : argument count (preserved for callee)
@@ -1304,7 +1328,7 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
 
   // Do we have a valid feedback vector?
   __ ldr(feedback_vector,
-         FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
+         FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
   __ ldr(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
   __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
                 &gotta_call_runtime);
@@ -1312,13 +1336,15 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // Is there an optimization marker or optimized code in the feedback vector?
   MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, r4, r6, r5);
 
-  // We found no optimized code.
+  // We found no optimized code. Infer the code object needed for the SFI.
   Register entry = r4;
   __ ldr(entry,
          FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
+  __ ldr(entry,
+         FieldMemOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
+  GetSharedFunctionInfoCode(masm, entry, r5);
 
-  // If SFI points to anything other than CompileLazy, install that.
-  __ ldr(entry, FieldMemOperand(entry, SharedFunctionInfo::kCodeOffset));
+  // If code entry points to anything other than CompileLazy, install that.
   __ Move(r5, masm->CodeObject());
   __ cmp(entry, r5);
   __ b(eq, &gotta_call_runtime);
@@ -1388,25 +1414,9 @@ void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
 
   {
     // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over. First to the shared function info.
+    // we simply need to copy it over to the target function.
 
     Register target_builtin = scratch1;
-    Register shared = scratch0;
-
-    __ ldr(shared,
-           FieldMemOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-    CHECK(r5 != target && r5 != scratch0 && r5 != scratch1);
-    CHECK(r9 != target && r9 != scratch0 && r9 != scratch1);
-
-    __ str(target_builtin,
-           FieldMemOperand(shared, SharedFunctionInfo::kCodeOffset));
-    __ mov(r9, target_builtin);  // Write barrier clobbers r9 below.
-    __ RecordWriteField(shared, SharedFunctionInfo::kCodeOffset, r9, r5,
-                        kLRHasNotBeenSaved, kDontSaveFPRegs,
-                        OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-
-    // And second to the target function.
 
     __ str(target_builtin, FieldMemOperand(target, JSFunction::kCodeOffset));
     __ mov(r9, target_builtin);  // Write barrier clobbers r9 below.
@@ -1491,9 +1501,10 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   }
   // On failure, tail call back to regular js by re-calling the function
   // which has be reset to the compile lazy builtin.
-  __ ldr(r4, FieldMemOperand(r1, JSFunction::kCodeOffset));
-  __ add(r4, r4, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(r4);
+  static_assert(kJavaScriptCallCodeStartRegister == r2, "ABI mismatch");
+  __ ldr(r2, FieldMemOperand(r1, JSFunction::kCodeOffset));
+  __ add(r2, r2, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ Jump(r2);
 }
 
 namespace {
@@ -1977,8 +1988,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   // Check that the function is not a "classConstructor".
   Label class_constructor;
   __ ldr(r2, FieldMemOperand(r1, JSFunction::kSharedFunctionInfoOffset));
-  __ ldr(r3, FieldMemOperand(r2, SharedFunctionInfo::kCompilerHintsOffset));
-  __ tst(r3, Operand(SharedFunctionInfo::kClassConstructorMask));
+  __ ldr(r3, FieldMemOperand(r2, SharedFunctionInfo::kFlagsOffset));
+  __ tst(r3, Operand(SharedFunctionInfo::IsClassConstructorBit::kMask));
   __ b(ne, &class_constructor);
 
   // Enter the context of the function; ToObject has to run in the function
@@ -1987,7 +1998,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   __ ldr(cp, FieldMemOperand(r1, JSFunction::kContextOffset));
   // We need to convert the receiver for non-native sloppy mode functions.
   Label done_convert;
-  __ ldr(r3, FieldMemOperand(r2, SharedFunctionInfo::kCompilerHintsOffset));
+  __ ldr(r3, FieldMemOperand(r2, SharedFunctionInfo::kFlagsOffset));
   __ tst(r3, Operand(SharedFunctionInfo::IsNativeBit::kMask |
                      SharedFunctionInfo::IsStrictBit::kMask));
   __ b(ne, &done_convert);
@@ -2222,6 +2233,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
   //  -- r1 : the constructor to call (checked to be a JSFunction)
   //  -- r3 : the new target (checked to be a constructor)
   // -----------------------------------
+  __ AssertConstructor(r1);
   __ AssertFunction(r1);
 
   // Calling convention for function specific ConstructStubs require
@@ -2242,6 +2254,7 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
   //  -- r1 : the function to call (checked to be a JSBoundFunction)
   //  -- r3 : the new target (checked to be a constructor)
   // -----------------------------------
+  __ AssertConstructor(r1);
   __ AssertBoundFunction(r1);
 
   // Push the [[BoundArguments]] onto the stack.
@@ -2270,16 +2283,17 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   Label non_constructor, non_proxy;
   __ JumpIfSmi(r1, &non_constructor);
 
-  // Dispatch based on instance type.
-  __ CompareObjectType(r1, r4, r5, JS_FUNCTION_TYPE);
-  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructFunction),
-          RelocInfo::CODE_TARGET, eq);
-
   // Check if target has a [[Construct]] internal method.
+  __ ldr(r4, FieldMemOperand(r1, HeapObject::kMapOffset));
   __ ldrb(r2, FieldMemOperand(r4, Map::kBitFieldOffset));
   __ tst(r2, Operand(Map::IsConstructorBit::kMask));
   __ b(eq, &non_constructor);
 
+  // Dispatch based on instance type.
+  __ CompareInstanceType(r4, r5, JS_FUNCTION_TYPE);
+  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructFunction),
+          RelocInfo::CODE_TARGET, eq);
+
   // Only dispatch to bound functions after checking whether they are
   // constructors.
   __ cmp(r5, Operand(JS_BOUND_FUNCTION_TYPE));
@@ -2449,9 +2463,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // r0 : expected number of arguments
   // r1 : function (passed through to callee)
   // r3 : new target (passed through to callee)
-  __ ldr(r4, FieldMemOperand(r1, JSFunction::kCodeOffset));
-  __ add(r4, r4, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Call(r4);
+  static_assert(kJavaScriptCallCodeStartRegister == r2, "ABI mismatch");
+  __ ldr(r2, FieldMemOperand(r1, JSFunction::kCodeOffset));
+  __ add(r2, r2, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ Call(r2);
 
   // Store offset of return address for deoptimizer.
   masm->isolate()->heap()->SetArgumentsAdaptorDeoptPCOffset(masm->pc_offset());
@@ -2464,9 +2479,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // Dont adapt arguments.
   // -------------------------------------------
   __ bind(&dont_adapt_arguments);
-  __ ldr(r4, FieldMemOperand(r1, JSFunction::kCodeOffset));
-  __ add(r4, r4, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(r4);
+  static_assert(kJavaScriptCallCodeStartRegister == r2, "ABI mismatch");
+  __ ldr(r2, FieldMemOperand(r1, JSFunction::kCodeOffset));
+  __ add(r2, r2, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ Jump(r2);
 
   __ bind(&stack_overflow);
   {
diff --git a/deps/v8/src/builtins/arm64/builtins-arm64.cc b/deps/v8/src/builtins/arm64/builtins-arm64.cc
index dd92af89bb0..8a7cb46d37d 100644
--- a/deps/v8/src/builtins/arm64/builtins-arm64.cc
+++ b/deps/v8/src/builtins/arm64/builtins-arm64.cc
@@ -19,19 +19,6 @@ namespace internal {
 
 #define __ ACCESS_MASM(masm)
 
-// Load the built-in Array function from the current context.
-static void GenerateLoadArrayFunction(MacroAssembler* masm, Register result) {
-  // Load the InternalArray function from the native context.
-  __ LoadNativeContextSlot(Context::ARRAY_FUNCTION_INDEX, result);
-}
-
-// Load the built-in InternalArray function from the current context.
-static void GenerateLoadInternalArrayFunction(MacroAssembler* masm,
-                                              Register result) {
-  // Load the InternalArray function from the native context.
-  __ LoadNativeContextSlot(Context::INTERNAL_ARRAY_FUNCTION_INDEX, result);
-}
-
 void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
                                 ExitFrameType exit_frame_type) {
   __ Mov(x5, ExternalReference(address, masm->isolate()));
@@ -104,9 +91,6 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   ASM_LOCATION("Builtins::Generate_InternalArrayConstructor");
   Label generic_array_code;
 
-  // Get the InternalArray function.
-  GenerateLoadInternalArrayFunction(masm, x1);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin InternalArray functions should be maps.
     __ Ldr(x10, FieldMemOperand(x1, JSFunction::kPrototypeOrInitialMapOffset));
@@ -118,6 +102,7 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
 
   // Run the native code for the InternalArray function called as a normal
   // function.
+  __ LoadRoot(x2, Heap::kUndefinedValueRootIndex);
   InternalArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
@@ -125,15 +110,13 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
 void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- x0     : number of arguments
+  //  -- x1     : array function
   //  -- lr     : return address
   //  -- sp[...]: constructor arguments
   // -----------------------------------
   ASM_LOCATION("Builtins::Generate_ArrayConstructor");
   Label generic_array_code, one_or_more_arguments, two_or_more_arguments;
 
-  // Get the Array function.
-  GenerateLoadArrayFunction(masm, x1);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin Array functions should be maps.
     __ Ldr(x10, FieldMemOperand(x1, JSFunction::kPrototypeOrInitialMapOffset));
@@ -143,20 +126,18 @@ void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
     __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
   }
 
-  // Run the native code for the Array function called as a normal function.
+  // x2 is the AllocationSite - here undefined.
   __ LoadRoot(x2, Heap::kUndefinedValueRootIndex);
-  __ Mov(x3, x1);
+  // If x3 (new target) is undefined, then this is the 'Call' case, so move
+  // x1 (the constructor) to x3.
+  __ Cmp(x3, x2);
+  __ CmovX(x3, x1, eq);
+
+  // Run the native code for the Array function called as a normal function.
   ArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
 
-static void GenerateTailCallToSharedCode(MacroAssembler* masm) {
-  __ Ldr(x2, FieldMemOperand(x1, JSFunction::kSharedFunctionInfoOffset));
-  __ Ldr(x2, FieldMemOperand(x2, SharedFunctionInfo::kCodeOffset));
-  __ Add(x2, x2, Code::kHeaderSize - kHeapObjectTag);
-  __ Br(x2);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -180,6 +161,7 @@ static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
     __ SmiUntag(x0);
   }
 
+  static_assert(kJavaScriptCallCodeStartRegister == x2, "ABI mismatch");
   __ Add(x2, x2, Code::kHeaderSize - kHeapObjectTag);
   __ Br(x2);
 }
@@ -331,8 +313,9 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // -----------------------------------
 
     __ Ldr(x4, FieldMemOperand(x1, JSFunction::kSharedFunctionInfoOffset));
-    __ Ldr(w4, FieldMemOperand(x4, SharedFunctionInfo::kCompilerHintsOffset));
-    __ TestAndBranchIfAnySet(w4, SharedFunctionInfo::kDerivedConstructorMask,
+    __ Ldr(w4, FieldMemOperand(x4, SharedFunctionInfo::kFlagsOffset));
+    __ TestAndBranchIfAnySet(w4,
+                             SharedFunctionInfo::IsDerivedConstructorBit::kMask,
                              &not_create_implicit_receiver);
 
     // If not derived class constructor: Allocate the new receiver object.
@@ -456,15 +439,15 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     __ Bind(&other_result);
     __ Ldr(x4, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
     __ Ldr(x4, FieldMemOperand(x4, JSFunction::kSharedFunctionInfoOffset));
-    __ Ldr(w4, FieldMemOperand(x4, SharedFunctionInfo::kCompilerHintsOffset));
+    __ Ldr(w4, FieldMemOperand(x4, SharedFunctionInfo::kFlagsOffset));
 
     if (restrict_constructor_return) {
       // Throw if constructor function is a class constructor
-      __ TestAndBranchIfAllClear(w4, SharedFunctionInfo::kClassConstructorMask,
-                                 &use_receiver);
+      __ TestAndBranchIfAllClear(
+          w4, SharedFunctionInfo::IsClassConstructorBit::kMask, &use_receiver);
     } else {
-      __ TestAndBranchIfAnySet(w4, SharedFunctionInfo::kClassConstructorMask,
-                               &use_receiver);
+      __ TestAndBranchIfAnySet(
+          w4, SharedFunctionInfo::IsClassConstructorBit::kMask, &use_receiver);
       __ CallRuntime(
           Runtime::kIncrementUseCounterConstructorReturnNonUndefinedPrimitive);
       __ B(&use_receiver);
@@ -552,7 +535,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   // Check the stack for overflow. We are not trying to catch interruptions
   // (i.e. debug break and preemption) here, so check the "real stack limit".
   Label stack_overflow;
-  __ CompareRoot(__ StackPointer(), Heap::kRealStackLimitRootIndex);
+  __ CompareRoot(sp, Heap::kRealStackLimitRootIndex);
   __ B(lo, &stack_overflow);
 
   // Get number of arguments for generator function.
@@ -617,9 +600,10 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
     // undefined because generator functions are non-constructable.
     __ Move(x3, x1);
     __ Move(x1, x4);
-    __ Ldr(x5, FieldMemOperand(x1, JSFunction::kCodeOffset));
-    __ Add(x5, x5, Code::kHeaderSize - kHeapObjectTag);
-    __ Jump(x5);
+    static_assert(kJavaScriptCallCodeStartRegister == x2, "ABI mismatch");
+    __ Ldr(x2, FieldMemOperand(x1, JSFunction::kCodeOffset));
+    __ Add(x2, x2, Code::kHeaderSize - kHeapObjectTag);
+    __ Jump(x2);
   }
 
   __ Bind(&prepare_step_in_if_stepping);
@@ -663,7 +647,7 @@ static void Generate_StackOverflowCheck(MacroAssembler* masm, Register num_args,
   __ LoadRoot(scratch, Heap::kRealStackLimitRootIndex);
   // Make scratch the space we have left. The stack might already be overflowed
   // here which will cause scratch to become negative.
-  __ Sub(scratch, masm->StackPointer(), scratch);
+  __ Sub(scratch, sp, scratch);
   // Check if the arguments will overflow the stack.
   __ Cmp(scratch, Operand(num_args, LSL, kPointerSizeLog2));
   __ B(le, stack_overflow);
@@ -745,7 +729,7 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     // Poke the result into the stack.
     __ Str(x11, MemOperand(scratch, -kPointerSize, PreIndex));
     // Loop if we've not reached the end of copy marker.
-    __ Cmp(__ StackPointer(), scratch);
+    __ Cmp(sp, scratch);
     __ B(lt, &loop);
 
     __ Bind(&done);
@@ -849,7 +833,7 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   DCHECK(
       !AreAliased(feedback_vector, x0, x1, x3, scratch1, scratch2, scratch3));
 
-  Label optimized_code_slot_is_cell, fallthrough;
+  Label optimized_code_slot_is_weak_ref, fallthrough;
 
   Register closure = x1;
   Register optimized_code_entry = scratch1;
@@ -859,9 +843,9 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
       FieldMemOperand(feedback_vector, FeedbackVector::kOptimizedCodeOffset));
 
   // Check if the code entry is a Smi. If yes, we interpret it as an
-  // optimisation marker. Otherwise, interpret is as a weak cell to a code
+  // optimisation marker. Otherwise, interpret is at a weak reference to a code
   // object.
-  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_cell);
+  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_weak_ref);
 
   {
     // Optimized code slot is a Smi optimization marker.
@@ -896,12 +880,10 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   }
 
   {
-    // Optimized code slot is a WeakCell.
-    __ bind(&optimized_code_slot_is_cell);
+    // Optimized code slot is a weak reference.
+    __ bind(&optimized_code_slot_is_weak_ref);
 
-    __ Ldr(optimized_code_entry,
-           FieldMemOperand(optimized_code_entry, WeakCell::kValueOffset));
-    __ JumpIfSmi(optimized_code_entry, &fallthrough);
+    __ LoadWeakValue(optimized_code_entry, optimized_code_entry, &fallthrough);
 
     // Check if the optimized code is marked for deopt. If it is, call the
     // runtime to clear it.
@@ -920,9 +902,10 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
     // register.
     ReplaceClosureCodeWithOptimizedCode(masm, optimized_code_entry, closure,
                                         scratch2, scratch3, feedback_vector);
-    __ Add(optimized_code_entry, optimized_code_entry,
+    static_assert(kJavaScriptCallCodeStartRegister == x2, "ABI mismatch");
+    __ Add(x2, optimized_code_entry,
            Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ Jump(optimized_code_entry);
+    __ Jump(x2);
 
     // Optimized code slot contains deoptimized code, evict it and re-enter the
     // closure's code.
@@ -936,10 +919,13 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
 }
 
 // Advance the current bytecode offset. This simulates what all bytecode
-// handlers do upon completion of the underlying operation.
-static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
-                                  Register bytecode_offset, Register bytecode,
-                                  Register scratch1) {
+// handlers do upon completion of the underlying operation. Will bail out to a
+// label if the bytecode (without prefix) is a return bytecode.
+static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
+                                          Register bytecode_array,
+                                          Register bytecode_offset,
+                                          Register bytecode, Register scratch1,
+                                          Label* if_return) {
   Register bytecode_size_table = scratch1;
   DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
                      bytecode));
@@ -949,11 +935,11 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
       Operand(ExternalReference::bytecode_size_table_address(masm->isolate())));
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
-  Label load_size, extra_wide;
+  Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
   __ Cmp(bytecode, Operand(0x1));
-  __ B(hi, &load_size);
+  __ B(hi, &process_bytecode);
   __ B(eq, &extra_wide);
 
   // Load the next bytecode and update table to the wide scaled table.
@@ -961,7 +947,7 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
   __ Ldrb(bytecode, MemOperand(bytecode_array, bytecode_offset));
   __ Add(bytecode_size_table, bytecode_size_table,
          Operand(kIntSize * interpreter::Bytecodes::kBytecodeCount));
-  __ B(&load_size);
+  __ B(&process_bytecode);
 
   __ Bind(&extra_wide);
   // Load the next bytecode and update table to the extra wide scaled table.
@@ -970,8 +956,16 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
   __ Add(bytecode_size_table, bytecode_size_table,
          Operand(2 * kIntSize * interpreter::Bytecodes::kBytecodeCount));
 
-  // Load the size of the current bytecode.
-  __ Bind(&load_size);
+  __ Bind(&process_bytecode);
+
+// Bailout to the return label if this is a return bytecode.
+#define JUMP_IF_EQUAL(NAME)                                              \
+  __ Cmp(x1, Operand(static_cast<int>(interpreter::Bytecode::k##NAME))); \
+  __ B(if_return, eq);
+  RETURN_BYTECODE_LIST(JUMP_IF_EQUAL)
+#undef JUMP_IF_EQUAL
+
+  // Otherwise, load the size of the current bytecode and advance the offset.
   __ Ldr(scratch1.W(), MemOperand(bytecode_size_table, bytecode, LSL, 2));
   __ Add(bytecode_offset, bytecode_offset, scratch1);
 }
@@ -998,7 +992,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
 
   // Load the feedback vector from the closure.
   __ Ldr(feedback_vector,
-         FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
+         FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
   __ Ldr(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
   // Read off the optimized code slot in the feedback vector, and if there
   // is optimized code or an optimization marker, call that instead.
@@ -1009,7 +1003,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   // the frame (that is done below).
   FrameScope frame_scope(masm, StackFrame::MANUAL);
   __ Push(lr, fp, cp, closure);
-  __ Add(fp, __ StackPointer(), StandardFrameConstants::kFixedFrameSizeFromFp);
+  __ Add(fp, sp, StandardFrameConstants::kFixedFrameSizeFromFp);
 
   // Get the bytecode array from the function object (or from the DebugInfo if
   // it is present) and load it into kInterpreterBytecodeArrayRegister.
@@ -1022,7 +1016,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   __ Bind(&bytecode_array_loaded);
 
   // Increment invocation count for the function.
-  __ Ldr(x11, FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
+  __ Ldr(x11, FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
   __ Ldr(x11, FieldMemOperand(x11, Cell::kValueOffset));
   __ Ldr(w10, FieldMemOperand(x11, FeedbackVector::kInvocationCountOffset));
   __ Add(w10, w10, Operand(1));
@@ -1060,7 +1054,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
 
     // Do a stack check to ensure we don't go over the limit.
     Label ok;
-    __ Sub(x10, __ StackPointer(), Operand(x11));
+    __ Sub(x10, sp, Operand(x11));
     __ CompareRoot(x10, Heap::kRealStackLimitRootIndex);
     __ B(hs, &ok);
     __ CallRuntime(Runtime::kThrowStackOverflow);
@@ -1101,11 +1095,12 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   __ Mov(kInterpreterDispatchTableRegister,
          Operand(ExternalReference::interpreter_dispatch_table_address(
              masm->isolate())));
-  __ Ldrb(x1, MemOperand(kInterpreterBytecodeArrayRegister,
-                         kInterpreterBytecodeOffsetRegister));
-  __ Mov(x1, Operand(x1, LSL, kPointerSizeLog2));
-  __ Ldr(ip0, MemOperand(kInterpreterDispatchTableRegister, x1));
-  __ Call(ip0);
+  __ Ldrb(x18, MemOperand(kInterpreterBytecodeArrayRegister,
+                          kInterpreterBytecodeOffsetRegister));
+  __ Mov(x1, Operand(x18, LSL, kPointerSizeLog2));
+  __ Ldr(kJavaScriptCallCodeStartRegister,
+         MemOperand(kInterpreterDispatchTableRegister, x1));
+  __ Call(kJavaScriptCallCodeStartRegister);
   masm->isolate()->heap()->SetInterpreterEntryReturnPCOffset(masm->pc_offset());
 
   // Any returns to the entry trampoline are either due to the return bytecode
@@ -1118,16 +1113,13 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
          MemOperand(fp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
   __ SmiUntag(kInterpreterBytecodeOffsetRegister);
 
-  // Check if we should return.
+  // Either return, or advance to the next bytecode and dispatch.
   Label do_return;
   __ Ldrb(x1, MemOperand(kInterpreterBytecodeArrayRegister,
                          kInterpreterBytecodeOffsetRegister));
-  __ Cmp(x1, Operand(static_cast<int>(interpreter::Bytecode::kReturn)));
-  __ B(&do_return, eq);
-
-  // Advance to the next bytecode and dispatch.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, x1, x2);
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, x1, x2,
+                                &do_return);
   __ B(&do_dispatch);
 
   __ bind(&do_return);
@@ -1226,6 +1218,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
 void Builtins::Generate_InterpreterPushArgsThenCallImpl(
     MacroAssembler* masm, ConvertReceiverMode receiver_mode,
     InterpreterPushArgsMode mode) {
+  DCHECK(mode != InterpreterPushArgsMode::kArrayFunction);
   // ----------- S t a t e -------------
   //  -- x0 : the number of arguments (not including the receiver)
   //  -- x2 : the address of the first argument to be pushed. Subsequent
@@ -1245,11 +1238,7 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
                                receiver_mode, mode);
 
   // Call the target.
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
-    __ Jump(
-        masm->isolate()->builtins()->CallFunction(ConvertReceiverMode::kAny),
-        RelocInfo::CODE_TARGET);
-  } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     __ Jump(BUILTIN_CODE(masm->isolate(), CallWithSpread),
             RelocInfo::CODE_TARGET);
   } else {
@@ -1280,15 +1269,13 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
   Generate_InterpreterPushArgs(masm, num_args, first_arg_index, spread_arg_out,
                                ConvertReceiverMode::kNullOrUndefined, mode);
 
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
+  if (mode == InterpreterPushArgsMode::kArrayFunction) {
     __ AssertFunction(x1);
 
-    // Tail call to the function-specific construct stub (still in the caller
+    // Tail call to the array construct stub (still in the caller
     // context at this point).
-    __ Ldr(x4, FieldMemOperand(x1, JSFunction::kSharedFunctionInfoOffset));
-    __ Ldr(x4, FieldMemOperand(x4, SharedFunctionInfo::kConstructStubOffset));
-    __ Add(x4, x4, Code::kHeaderSize - kHeapObjectTag);
-    __ Br(x4);
+    ArrayConstructorStub array_constructor_stub(masm->isolate());
+    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor with x0, x1, and x3 unmodified.
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1336,11 +1323,12 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   __ SmiUntag(kInterpreterBytecodeOffsetRegister);
 
   // Dispatch to the target bytecode.
-  __ Ldrb(x1, MemOperand(kInterpreterBytecodeArrayRegister,
-                         kInterpreterBytecodeOffsetRegister));
-  __ Mov(x1, Operand(x1, LSL, kPointerSizeLog2));
-  __ Ldr(ip0, MemOperand(kInterpreterDispatchTableRegister, x1));
-  __ Jump(ip0);
+  __ Ldrb(x18, MemOperand(kInterpreterBytecodeArrayRegister,
+                          kInterpreterBytecodeOffsetRegister));
+  __ Mov(x1, Operand(x18, LSL, kPointerSizeLog2));
+  __ Ldr(kJavaScriptCallCodeStartRegister,
+         MemOperand(kInterpreterDispatchTableRegister, x1));
+  __ Jump(kJavaScriptCallCodeStartRegister);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
@@ -1356,52 +1344,29 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
                          kInterpreterBytecodeOffsetRegister));
 
   // Advance to the next bytecode.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, x1, x2);
+  Label if_return;
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, x1, x2,
+                                &if_return);
 
   // Convert new bytecode offset to a Smi and save in the stackframe.
   __ SmiTag(x2, kInterpreterBytecodeOffsetRegister);
   __ Str(x2, MemOperand(fp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
 
   Generate_InterpreterEnterBytecode(masm);
+
+  // We should never take the if_return path.
+  __ bind(&if_return);
+  __ Abort(AbortReason::kInvalidBytecodeAdvance);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CheckOptimizationMarker(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- x0 : argument count (preserved for callee)
-  //  -- x3 : new target (preserved for callee)
-  //  -- x1 : target function (preserved for callee)
-  // -----------------------------------
-  Register closure = x1;
-
-  // Get the feedback vector.
-  Register feedback_vector = x2;
-  __ Ldr(feedback_vector,
-         FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
-  __ Ldr(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
-
-  // The feedback vector must be defined.
-  if (FLAG_debug_code) {
-    __ CompareRoot(feedback_vector, Heap::kUndefinedValueRootIndex);
-    __ Assert(ne, AbortReason::kExpectedFeedbackVector);
-  }
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, x7, x4, x5);
-
-  // Otherwise, tail call the SFI code.
-  GenerateTailCallToSharedCode(masm);
-}
-
 void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to the trampoline to the
-  // interpreter entry.
-  __ Ldr(x2, FieldMemOperand(x1, JSFunction::kSharedFunctionInfoOffset));
-  __ Ldr(x2, FieldMemOperand(x2, SharedFunctionInfo::kCodeOffset));
+  // Set the code slot inside the JSFunction to CompileLazy.
+  __ Mov(x2, BUILTIN_CODE(masm->isolate(), CompileLazy));
   __ Str(x2, FieldMemOperand(x1, JSFunction::kCodeOffset));
   __ RecordWriteField(x1, JSFunction::kCodeOffset, x2, x5, kLRHasNotBeenSaved,
                       kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
@@ -1409,6 +1374,66 @@ void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
   Generate_CompileLazy(masm);
 }
 
+static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
+                                      Register scratch1) {
+  // Figure out the SFI's code object.
+  Label done;
+  Label check_is_bytecode_array;
+  Label check_is_code;
+  Label check_is_fixed_array;
+  Label check_is_pre_parsed_scope_data;
+  Label check_is_function_template_info;
+
+  Register data_type = scratch1;
+
+  // IsSmi: Is builtin
+  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
+  __ Mov(scratch1, ExternalReference::builtins_address(masm->isolate()));
+  __ Mov(sfi_data, Operand::UntagSmiAndScale(sfi_data, kPointerSizeLog2));
+  __ Ldr(sfi_data, MemOperand(scratch1, sfi_data));
+  __ B(&done);
+
+  // Get map for subsequent checks.
+  __ Bind(&check_is_bytecode_array);
+  __ Ldr(data_type, FieldMemOperand(sfi_data, HeapObject::kMapOffset));
+  __ Ldrh(data_type, FieldMemOperand(data_type, Map::kInstanceTypeOffset));
+
+  // IsBytecodeArray: Interpret bytecode
+  __ Cmp(data_type, Operand(BYTECODE_ARRAY_TYPE));
+  __ B(ne, &check_is_code);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
+  __ B(&done);
+
+  // IsCode: Run code
+  __ Bind(&check_is_code);
+  __ Cmp(data_type, Operand(CODE_TYPE));
+  __ B(eq, &done);
+
+  // IsFixedArray: Instantiate using AsmWasmData,
+  __ Bind(&check_is_fixed_array);
+  __ Cmp(data_type, Operand(FIXED_ARRAY_TYPE));
+  __ B(ne, &check_is_pre_parsed_scope_data);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
+  __ B(&done);
+
+  // IsPreParsedScopeData: Compile lazy
+  __ Bind(&check_is_pre_parsed_scope_data);
+  __ Cmp(data_type, Operand(TUPLE2_TYPE));
+  __ B(ne, &check_is_function_template_info);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
+  __ B(&done);
+
+  // IsFunctionTemplateInfo: API call
+  __ Bind(&check_is_function_template_info);
+  if (FLAG_debug_code) {
+    __ Cmp(data_type, Operand(FUNCTION_TEMPLATE_INFO_TYPE));
+    __ Assert(eq, AbortReason::kInvalidSharedFunctionInfoData);
+  }
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
+
+  __ Bind(&done);
+}
+
 void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- x0 : argument count (preserved for callee)
@@ -1423,7 +1448,7 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
 
   // Do we have a valid feedback vector?
   __ Ldr(feedback_vector,
-         FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
+         FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
   __ Ldr(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
   __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
                 &gotta_call_runtime);
@@ -1431,13 +1456,15 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // Is there an optimization marker or optimized code in the feedback vector?
   MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, x7, x4, x5);
 
-  // We found no optimized code.
+  // We found no optimized code. Infer the code object needed for the SFI.
   Register entry = x7;
   __ Ldr(entry,
          FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
+  __ Ldr(entry,
+         FieldMemOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
+  GetSharedFunctionInfoCode(masm, entry, x5);
 
-  // If SFI points to anything other than CompileLazy, install that.
-  __ Ldr(entry, FieldMemOperand(entry, SharedFunctionInfo::kCodeOffset));
+  // If code entry points to anything other than CompileLazy, install that.
   __ Move(x5, masm->CodeObject());
   __ Cmp(entry, x5);
   __ B(eq, &gotta_call_runtime);
@@ -1506,25 +1533,9 @@ void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
 
   {
     // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over. First to the shared function info.
+    // we simply need to copy it over to the target function.
 
     Register target_builtin = scratch1;
-    Register shared = scratch0;
-
-    __ Ldr(shared,
-           FieldMemOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-    CHECK(!x5.is(target) && !x5.is(scratch0) && !x5.is(scratch1));
-    CHECK(!x9.is(target) && !x9.is(scratch0) && !x9.is(scratch1));
-
-    __ Str(target_builtin,
-           FieldMemOperand(shared, SharedFunctionInfo::kCodeOffset));
-    __ Mov(x9, target_builtin);  // Write barrier clobbers x9 below.
-    __ RecordWriteField(shared, SharedFunctionInfo::kCodeOffset, x9, x5,
-                        kLRHasNotBeenSaved, kDontSaveFPRegs,
-                        OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-
-    // And second to the target function.
 
     __ Str(target_builtin, FieldMemOperand(target, JSFunction::kCodeOffset));
     __ Mov(x9, target_builtin);  // Write barrier clobbers x9 below.
@@ -1613,7 +1624,7 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
     __ JumpIfSmi(x0, &failed);
 
     // Peek the argument count from the stack, untagging at the same time.
-    __ Ldr(w4, UntagSmiMemOperand(__ StackPointer(), 3 * kPointerSize));
+    __ Ldr(w4, UntagSmiMemOperand(sp, 3 * kPointerSize));
     __ Drop(4);
     scope.GenerateLeaveFrame();
 
@@ -1646,7 +1657,7 @@ void Generate_ContinueToBuiltinHelper(MacroAssembler* masm,
                        kPointerSize;
 
   // Set up frame pointer.
-  __ Add(fp, __ StackPointer(), frame_size);
+  __ Add(fp, sp, frame_size);
 
   if (with_result) {
     // Overwrite the hole inserted by the deoptimizer with the return value from
@@ -1682,7 +1693,7 @@ void Generate_ContinueToBuiltinHelper(MacroAssembler* masm,
          MemOperand(fp, BuiltinContinuationFrameConstants::kBuiltinOffset));
 
   // Restore fp, lr.
-  __ Mov(__ StackPointer(), fp);
+  __ Mov(sp, fp);
   __ Pop(fp, lr);
 
   // Call builtin.
@@ -2090,8 +2101,7 @@ void EnterArgumentsAdaptorFrame(MacroAssembler* masm) {
   __ Push(x11, x1);  // x1: function
   __ SmiTag(x11, x0);  // x0: number of arguments.
   __ Push(x11, padreg);
-  __ Add(fp, __ StackPointer(),
-         ArgumentsAdaptorFrameConstants::kFixedFrameSizeFromFp);
+  __ Add(fp, sp, ArgumentsAdaptorFrameConstants::kFixedFrameSizeFromFp);
 }
 
 void LeaveArgumentsAdaptorFrame(MacroAssembler* masm) {
@@ -2101,7 +2111,7 @@ void LeaveArgumentsAdaptorFrame(MacroAssembler* masm) {
   // Get the number of arguments passed (as a smi), tear down the frame and
   // then drop the parameters and the receiver.
   __ Ldr(x10, MemOperand(fp, ArgumentsAdaptorFrameConstants::kLengthOffset));
-  __ Mov(__ StackPointer(), fp);
+  __ Mov(sp, fp);
   __ Pop(fp, lr);
 
   // Drop actual parameters and receiver.
@@ -2194,7 +2204,7 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
     __ LoadRoot(x10, Heap::kRealStackLimitRootIndex);
     // Make x10 the space we have left. The stack might already be overflowed
     // here which will cause x10 to become negative.
-    __ Sub(x10, masm->StackPointer(), x10);
+    __ Sub(x10, sp, x10);
     // Check if the arguments will overflow the stack.
     __ Cmp(x10, Operand(len, LSL, kPointerSizeLog2));
     __ B(gt, &done);  // Signed comparison.
@@ -2340,8 +2350,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   // Check that function is not a "classConstructor".
   Label class_constructor;
   __ Ldr(x2, FieldMemOperand(x1, JSFunction::kSharedFunctionInfoOffset));
-  __ Ldr(w3, FieldMemOperand(x2, SharedFunctionInfo::kCompilerHintsOffset));
-  __ TestAndBranchIfAnySet(w3, SharedFunctionInfo::kClassConstructorMask,
+  __ Ldr(w3, FieldMemOperand(x2, SharedFunctionInfo::kFlagsOffset));
+  __ TestAndBranchIfAnySet(w3, SharedFunctionInfo::IsClassConstructorBit::kMask,
                            &class_constructor);
 
   // Enter the context of the function; ToObject has to run in the function
@@ -2467,7 +2477,7 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
       __ LoadRoot(x10, Heap::kRealStackLimitRootIndex);
       // Make x10 the space we have left. The stack might already be overflowed
       // here which will cause x10 to become negative.
-      __ Sub(x10, masm->StackPointer(), x10);
+      __ Sub(x10, sp, x10);
       // Check if the arguments will overflow the stack.
       __ Cmp(x10, Operand(bound_argc, LSL, kPointerSizeLog2));
       __ B(gt, &done);  // Signed comparison.
@@ -2539,8 +2549,7 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
         Register scratch = x10;
         __ Tbz(bound_argc, 0, &done);
         // Store receiver.
-        __ Add(scratch, __ StackPointer(),
-               Operand(total_argc, LSL, kPointerSizeLog2));
+        __ Add(scratch, sp, Operand(total_argc, LSL, kPointerSizeLog2));
         __ Str(receiver, MemOperand(scratch, kPointerSize, PostIndex));
         __ Tbnz(total_argc, 0, &done);
         // Store padding.
@@ -2628,6 +2637,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
   //  -- x1 : the constructor to call (checked to be a JSFunction)
   //  -- x3 : the new target (checked to be a constructor)
   // -----------------------------------
+  __ AssertConstructor(x1);
   __ AssertFunction(x1);
 
   // Calling convention for function specific ConstructStubs require
@@ -2649,6 +2659,7 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
   //  -- x1 : the function to call (checked to be a JSBoundFunction)
   //  -- x3 : the new target (checked to be a constructor)
   // -----------------------------------
+  __ AssertConstructor(x1);
   __ AssertBoundFunction(x1);
 
   // Push the [[BoundArguments]] onto the stack.
@@ -2682,16 +2693,17 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   Label non_constructor, non_proxy;
   __ JumpIfSmi(x1, &non_constructor);
 
-  // Dispatch based on instance type.
-  __ CompareObjectType(x1, x4, x5, JS_FUNCTION_TYPE);
-  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructFunction),
-          RelocInfo::CODE_TARGET, eq);
-
   // Check if target has a [[Construct]] internal method.
+  __ Ldr(x4, FieldMemOperand(x1, HeapObject::kMapOffset));
   __ Ldrb(x2, FieldMemOperand(x4, Map::kBitFieldOffset));
   __ TestAndBranchIfAllClear(x2, Map::IsConstructorBit::kMask,
                              &non_constructor);
 
+  // Dispatch based on instance type.
+  __ CompareInstanceType(x4, x5, JS_FUNCTION_TYPE);
+  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructFunction),
+          RelocInfo::CODE_TARGET, eq);
+
   // Only dispatch to bound functions after checking whether they are
   // constructors.
   __ Cmp(x5, JS_BOUND_FUNCTION_TYPE);
@@ -2825,7 +2837,6 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   Register argc_actual = x0;    // Excluding the receiver.
   Register argc_expected = x2;  // Excluding the receiver.
   Register function = x1;
-  Register code_entry = x10;
 
   Label dont_adapt_arguments, stack_overflow;
 
@@ -2854,7 +2865,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   __ Bic(scratch1, scratch1, 1);
   __ Claim(scratch1, kPointerSize);
 
-  __ Mov(copy_to, __ StackPointer());
+  __ Mov(copy_to, sp);
 
   // Preparing the expected arguments is done in four steps, the order of
   // which is chosen so we can use LDP/STP and avoid conditional branches as
@@ -2918,8 +2929,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   __ RecordComment("-- Store receiver --");
   __ Add(copy_from, fp, 2 * kPointerSize);
   __ Ldr(scratch1, MemOperand(copy_from, argc_actual, LSL, kPointerSizeLog2));
-  __ Str(scratch1,
-         MemOperand(__ StackPointer(), argc_expected, LSL, kPointerSizeLog2));
+  __ Str(scratch1, MemOperand(sp, argc_expected, LSL, kPointerSizeLog2));
 
   // Arguments have been adapted. Now call the entry point.
   __ RecordComment("-- Call entry point --");
@@ -2927,9 +2937,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // x0 : expected number of arguments
   // x1 : function (passed through to callee)
   // x3 : new target (passed through to callee)
-  __ Ldr(code_entry, FieldMemOperand(function, JSFunction::kCodeOffset));
-  __ Add(code_entry, code_entry, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Call(code_entry);
+  static_assert(kJavaScriptCallCodeStartRegister == x2, "ABI mismatch");
+  __ Ldr(x2, FieldMemOperand(function, JSFunction::kCodeOffset));
+  __ Add(x2, x2, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ Call(x2);
 
   // Store offset of return address for deoptimizer.
   masm->isolate()->heap()->SetArgumentsAdaptorDeoptPCOffset(masm->pc_offset());
@@ -2941,9 +2952,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // Call the entry point without adapting the arguments.
   __ RecordComment("-- Call without adapting args --");
   __ Bind(&dont_adapt_arguments);
-  __ Ldr(code_entry, FieldMemOperand(function, JSFunction::kCodeOffset));
-  __ Add(code_entry, code_entry, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(code_entry);
+  static_assert(kJavaScriptCallCodeStartRegister == x2, "ABI mismatch");
+  __ Ldr(x2, FieldMemOperand(function, JSFunction::kCodeOffset));
+  __ Add(x2, x2, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ Jump(x2);
 
   __ Bind(&stack_overflow);
   __ RecordComment("-- Stack overflow --");
diff --git a/deps/v8/src/builtins/builtins-api.cc b/deps/v8/src/builtins/builtins-api.cc
index d50e045069b..c616b019b92 100644
--- a/deps/v8/src/builtins/builtins-api.cc
+++ b/deps/v8/src/builtins/builtins-api.cc
@@ -98,18 +98,13 @@ MUST_USE_RESULT MaybeHandle<Object> HandleApiCallHelper(
   if (!raw_call_data->IsUndefined(isolate)) {
     DCHECK(raw_call_data->IsCallHandlerInfo());
     CallHandlerInfo* call_data = CallHandlerInfo::cast(raw_call_data);
-    Object* callback_obj = call_data->callback();
-    v8::FunctionCallback callback =
-        v8::ToCData<v8::FunctionCallback>(callback_obj);
     Object* data_obj = call_data->data();
 
-    LOG(isolate, ApiObjectAccess("call", JSObject::cast(*js_receiver)));
 
     FunctionCallbackArguments custom(isolate, data_obj, *function, raw_holder,
                                      *new_target, &args[0] - 1,
                                      args.length() - 1);
-
-    Handle<Object> result = custom.Call(callback);
+    Handle<Object> result = custom.Call(call_data);
 
     RETURN_EXCEPTION_IF_SCHEDULED_EXCEPTION(isolate, Object);
     if (result.is_null()) {
@@ -154,7 +149,7 @@ class RelocatableArguments : public BuiltinArguments, public Relocatable {
 
   virtual inline void IterateInstance(RootVisitor* v) {
     if (length() == 0) return;
-    v->VisitRootPointers(Root::kRelocatable, lowest_address(),
+    v->VisitRootPointers(Root::kRelocatable, nullptr, lowest_address(),
                          highest_address() + 1);
   }
 
@@ -184,6 +179,25 @@ MaybeHandle<Object> Builtins::InvokeApiFunction(Isolate* isolate,
     }
   }
 
+  if (function->IsFunctionTemplateInfo()) {
+    Handle<FunctionTemplateInfo> info =
+        Handle<FunctionTemplateInfo>::cast(function);
+    // If we need to break at function entry, go the long way. Instantiate the
+    // function, use the DebugBreakTrampoline, and call it through JS.
+    if (info->BreakAtEntry()) {
+      DCHECK(!is_construct);
+      DCHECK(new_target->IsUndefined(isolate));
+      Handle<JSFunction> function;
+      ASSIGN_RETURN_ON_EXCEPTION(isolate, function,
+                                 ApiNatives::InstantiateFunction(
+                                     info, MaybeHandle<v8::internal::Name>()),
+                                 Object);
+      Handle<Code> trampoline = BUILTIN_CODE(isolate, DebugBreakTrampoline);
+      function->set_code(*trampoline);
+      return Execution::Call(isolate, function, receiver, argc, args);
+    }
+  }
+
   Handle<FunctionTemplateInfo> fun_data =
       function->IsFunctionTemplateInfo()
           ? Handle<FunctionTemplateInfo>::cast(function)
@@ -256,12 +270,7 @@ MUST_USE_RESULT static Object* HandleApiCallAsFunctionOrConstructor(
   Object* handler =
       constructor->shared()->get_api_func_data()->instance_call_handler();
   DCHECK(!handler->IsUndefined(isolate));
-  // TODO(ishell): remove this debugging code.
-  CHECK(handler->IsCallHandlerInfo());
   CallHandlerInfo* call_data = CallHandlerInfo::cast(handler);
-  Object* callback_obj = call_data->callback();
-  v8::FunctionCallback callback =
-      v8::ToCData<v8::FunctionCallback>(callback_obj);
 
   // Get the data for the call and perform the callback.
   Object* result;
@@ -272,7 +281,7 @@ MUST_USE_RESULT static Object* HandleApiCallAsFunctionOrConstructor(
     FunctionCallbackArguments custom(isolate, call_data->data(), constructor,
                                      obj, new_target, &args[0] - 1,
                                      args.length() - 1);
-    Handle<Object> result_handle = custom.Call(callback);
+    Handle<Object> result_handle = custom.Call(call_data);
     if (result_handle.is_null()) {
       result = isolate->heap()->undefined_value();
     } else {
diff --git a/deps/v8/src/builtins/builtins-arguments-gen.cc b/deps/v8/src/builtins/builtins-arguments-gen.cc
index 7db8b971d7e..2bf5e1c343c 100644
--- a/deps/v8/src/builtins/builtins-arguments-gen.cc
+++ b/deps/v8/src/builtins/builtins-arguments-gen.cc
@@ -44,7 +44,7 @@ ArgumentsBuiltinsAssembler::GetArgumentsFrameAndCount(Node* function,
   Node* formal_parameter_count =
       LoadObjectField(shared, SharedFunctionInfo::kFormalParameterCountOffset,
                       MachineType::Int32());
-  formal_parameter_count = Word32ToParameter(formal_parameter_count, mode);
+  formal_parameter_count = Int32ToParameter(formal_parameter_count, mode);
 
   argument_count.Bind(formal_parameter_count);
   Node* marker_or_function = LoadBufferObject(
diff --git a/deps/v8/src/builtins/builtins-array-gen.cc b/deps/v8/src/builtins/builtins-array-gen.cc
index 027baa28739..c86395af2dd 100644
--- a/deps/v8/src/builtins/builtins-array-gen.cc
+++ b/deps/v8/src/builtins/builtins-array-gen.cc
@@ -2,53 +2,50 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/builtins/builtins-iterator-gen.h"
 #include "src/builtins/builtins-string-gen.h"
+#include "src/builtins/builtins-typedarray-gen.h"
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/code-stub-assembler.h"
 #include "src/factory-inl.h"
 #include "src/frame-constants.h"
 
+#include "src/builtins/builtins-array-gen.h"
+
 namespace v8 {
 namespace internal {
 
-class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
- public:
-  explicit ArrayBuiltinCodeStubAssembler(compiler::CodeAssemblerState* state)
-      : CodeStubAssembler(state),
-        k_(this, MachineRepresentation::kTagged),
-        a_(this, MachineRepresentation::kTagged),
-        to_(this, MachineRepresentation::kTagged, SmiConstant(0)),
-        fully_spec_compliant_(this, {&k_, &a_, &to_}) {}
-
-  typedef std::function<void(ArrayBuiltinCodeStubAssembler* masm)>
-      BuiltinResultGenerator;
-
-  typedef std::function<Node*(ArrayBuiltinCodeStubAssembler* masm,
-                              Node* k_value, Node* k)>
-      CallResultProcessor;
+using Node = compiler::Node;
 
-  typedef std::function<void(ArrayBuiltinCodeStubAssembler* masm)>
-      PostLoopAction;
+ArrayBuiltinsAssembler::ArrayBuiltinsAssembler(
+    compiler::CodeAssemblerState* state)
+    : CodeStubAssembler(state),
+      k_(this, MachineRepresentation::kTagged),
+      a_(this, MachineRepresentation::kTagged),
+      to_(this, MachineRepresentation::kTagged, SmiConstant(0)),
+      fully_spec_compliant_(this, {&k_, &a_, &to_}) {}
 
-  enum class MissingPropertyMode { kSkip, kUseUndefined };
-
-  void FindResultGenerator() { a_.Bind(UndefinedConstant()); }
+void ArrayBuiltinsAssembler::FindResultGenerator() {
+  a_.Bind(UndefinedConstant());
+}
 
-  Node* FindProcessor(Node* k_value, Node* k) {
-    Node* value = CallJS(CodeFactory::Call(isolate()), context(), callbackfn(),
-                         this_arg(), k_value, k, o());
-    Label false_continue(this), return_true(this);
-    BranchIfToBooleanIsTrue(value, &return_true, &false_continue);
-    BIND(&return_true);
-    ReturnFromBuiltin(k_value);
-    BIND(&false_continue);
-    return a();
+Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
+  Node* value = CallJS(CodeFactory::Call(isolate()), context(), callbackfn(),
+                       this_arg(), k_value, k, o());
+  Label false_continue(this), return_true(this);
+  BranchIfToBooleanIsTrue(value, &return_true, &false_continue);
+  BIND(&return_true);
+  ReturnFromBuiltin(k_value);
+  BIND(&false_continue);
+  return a();
   }
 
-  void FindIndexResultGenerator() { a_.Bind(SmiConstant(-1)); }
+  void ArrayBuiltinsAssembler::FindIndexResultGenerator() {
+    a_.Bind(SmiConstant(-1));
+  }
 
-  Node* FindIndexProcessor(Node* k_value, Node* k) {
+  Node* ArrayBuiltinsAssembler::FindIndexProcessor(Node* k_value, Node* k) {
     Node* value = CallJS(CodeFactory::Call(isolate()), context(), callbackfn(),
                          this_arg(), k_value, k, o());
     Label false_continue(this), return_true(this);
@@ -59,17 +56,21 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     return a();
   }
 
-  void ForEachResultGenerator() { a_.Bind(UndefinedConstant()); }
+  void ArrayBuiltinsAssembler::ForEachResultGenerator() {
+    a_.Bind(UndefinedConstant());
+  }
 
-  Node* ForEachProcessor(Node* k_value, Node* k) {
+  Node* ArrayBuiltinsAssembler::ForEachProcessor(Node* k_value, Node* k) {
     CallJS(CodeFactory::Call(isolate()), context(), callbackfn(), this_arg(),
            k_value, k, o());
     return a();
   }
 
-  void SomeResultGenerator() { a_.Bind(FalseConstant()); }
+  void ArrayBuiltinsAssembler::SomeResultGenerator() {
+    a_.Bind(FalseConstant());
+  }
 
-  Node* SomeProcessor(Node* k_value, Node* k) {
+  Node* ArrayBuiltinsAssembler::SomeProcessor(Node* k_value, Node* k) {
     Node* value = CallJS(CodeFactory::Call(isolate()), context(), callbackfn(),
                          this_arg(), k_value, k, o());
     Label false_continue(this), return_true(this);
@@ -80,9 +81,11 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     return a();
   }
 
-  void EveryResultGenerator() { a_.Bind(TrueConstant()); }
+  void ArrayBuiltinsAssembler::EveryResultGenerator() {
+    a_.Bind(TrueConstant());
+  }
 
-  Node* EveryProcessor(Node* k_value, Node* k) {
+  Node* ArrayBuiltinsAssembler::EveryProcessor(Node* k_value, Node* k) {
     Node* value = CallJS(CodeFactory::Call(isolate()), context(), callbackfn(),
                          this_arg(), k_value, k, o());
     Label true_continue(this), return_false(this);
@@ -93,9 +96,11 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     return a();
   }
 
-  void ReduceResultGenerator() { return a_.Bind(this_arg()); }
+  void ArrayBuiltinsAssembler::ReduceResultGenerator() {
+    return a_.Bind(this_arg());
+  }
 
-  Node* ReduceProcessor(Node* k_value, Node* k) {
+  Node* ArrayBuiltinsAssembler::ReduceProcessor(Node* k_value, Node* k) {
     VARIABLE(result, MachineRepresentation::kTagged);
     Label done(this, {&result}), initial(this);
     GotoIf(WordEqual(a(), TheHoleConstant()), &initial);
@@ -111,21 +116,21 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     return result.value();
   }
 
-  void ReducePostLoopAction() {
+  void ArrayBuiltinsAssembler::ReducePostLoopAction() {
     Label ok(this);
     GotoIf(WordNotEqual(a(), TheHoleConstant()), &ok);
     ThrowTypeError(context(), MessageTemplate::kReduceNoInitial);
     BIND(&ok);
   }
 
-  void FilterResultGenerator() {
+  void ArrayBuiltinsAssembler::FilterResultGenerator() {
     // 7. Let A be ArraySpeciesCreate(O, 0).
     // This version of ArraySpeciesCreate will create with the correct
     // ElementsKind in the fast case.
-    ArraySpeciesCreate();
+    GenerateArraySpeciesCreate();
   }
 
-  Node* FilterProcessor(Node* k_value, Node* k) {
+  Node* ArrayBuiltinsAssembler::FilterProcessor(Node* k_value, Node* k) {
     // ii. Let selected be ToBoolean(? Call(callbackfn, T, kValue, k, O)).
     Node* selected = CallJS(CodeFactory::Call(isolate()), context(),
                             callbackfn(), this_arg(), k_value, k, o());
@@ -146,7 +151,7 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
       BIND(&fast);
       {
         GotoIf(SmiNotEqual(LoadJSArrayLength(a()), to_.value()), &runtime);
-        kind = EnsureArrayPushable(a(), &runtime);
+        kind = EnsureArrayPushable(LoadMap(a()), &runtime);
         GotoIf(IsElementsKindGreaterThan(kind, HOLEY_SMI_ELEMENTS),
                &object_push_pre);
 
@@ -191,22 +196,32 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     return a();
   }
 
-  void MapResultGenerator() { ArraySpeciesCreate(len_); }
+  void ArrayBuiltinsAssembler::MapResultGenerator() {
+    GenerateArraySpeciesCreate(len_);
+  }
 
-  void TypedArrayMapResultGenerator() {
+  void ArrayBuiltinsAssembler::TypedArrayMapResultGenerator() {
     // 6. Let A be ? TypedArraySpeciesCreate(O, len).
-    Node* a = TypedArraySpeciesCreateByLength(context(), o(), len_);
+    TNode<JSTypedArray> original_array = CAST(o());
+    TNode<Smi> length = CAST(len_);
+    const char* method_name = "%TypedArray%.prototype.map";
+
+    TypedArrayBuiltinsAssembler typedarray_asm(state());
+    TNode<JSTypedArray> a = typedarray_asm.SpeciesCreateByLength(
+        context(), original_array, length, method_name);
     // In the Spec and our current implementation, the length check is already
     // performed in TypedArraySpeciesCreate.
     CSA_ASSERT(this,
                SmiLessThanOrEqual(
                    len_, LoadObjectField(a, JSTypedArray::kLengthOffset)));
-    fast_typed_array_target_ = Word32Equal(LoadInstanceType(LoadElements(o_)),
-                                           LoadInstanceType(LoadElements(a)));
+    fast_typed_array_target_ =
+        Word32Equal(LoadInstanceType(LoadElements(original_array)),
+                    LoadInstanceType(LoadElements(a)));
     a_.Bind(a);
   }
 
-  Node* SpecCompliantMapProcessor(Node* k_value, Node* k) {
+  Node* ArrayBuiltinsAssembler::SpecCompliantMapProcessor(Node* k_value,
+                                                          Node* k) {
     //  i. Let kValue be ? Get(O, Pk). Performed by the caller of
     //  SpecCompliantMapProcessor.
     // ii. Let mapped_value be ? Call(callbackfn, T, kValue, k, O).
@@ -218,7 +233,7 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     return a();
   }
 
-  Node* FastMapProcessor(Node* k_value, Node* k) {
+  Node* ArrayBuiltinsAssembler::FastMapProcessor(Node* k_value, Node* k) {
     //  i. Let kValue be ? Get(O, Pk). Performed by the caller of
     //  FastMapProcessor.
     // ii. Let mapped_value be ? Call(callbackfn, T, kValue, k, O).
@@ -312,7 +327,7 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
   }
 
   // See tc39.github.io/ecma262/#sec-%typedarray%.prototype.map.
-  Node* TypedArrayMapProcessor(Node* k_value, Node* k) {
+  Node* ArrayBuiltinsAssembler::TypedArrayMapProcessor(Node* k_value, Node* k) {
     // 8. c. Let mapped_value be ? Call(callbackfn, T, « kValue, k, O »).
     Node* mapped_value = CallJS(CodeFactory::Call(isolate()), context(),
                                 callbackfn(), this_arg(), k_value, k, o());
@@ -325,11 +340,21 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     Branch(fast_typed_array_target_, &fast, &slow);
 
     BIND(&fast);
-    // #sec-integerindexedelementset 3. Let numValue be ? ToNumber(value).
-    Node* num_value = ToNumber(context(), mapped_value);
+    // #sec-integerindexedelementset
+    // 5. If arrayTypeName is "BigUint64Array" or "BigInt64Array", let
+    // numValue be ? ToBigInt(v).
+    // 6. Otherwise, let numValue be ? ToNumber(value).
+    Node* num_value;
+    if (source_elements_kind_ == BIGINT64_ELEMENTS ||
+        source_elements_kind_ == BIGUINT64_ELEMENTS) {
+      num_value = ToBigInt(context(), mapped_value);
+    } else {
+      num_value = ToNumber_Inline(context(), mapped_value);
+    }
     // The only way how this can bailout is because of a detached buffer.
     EmitElementStore(a(), k, num_value, false, source_elements_kind_,
-                     KeyedAccessStoreMode::STANDARD_STORE, &detached);
+                     KeyedAccessStoreMode::STANDARD_STORE, &detached,
+                     context());
     Goto(&done);
 
     BIND(&slow);
@@ -339,28 +364,16 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
 
     BIND(&detached);
     // tc39.github.io/ecma262/#sec-integerindexedelementset
-    // 5. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+    // 8. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
     ThrowTypeError(context_, MessageTemplate::kDetachedOperation, name_);
 
     BIND(&done);
     return a();
   }
 
-  void NullPostLoopAction() {}
+  void ArrayBuiltinsAssembler::NullPostLoopAction() {}
 
- protected:
-  Node* context() { return context_; }
-  Node* receiver() { return receiver_; }
-  Node* new_target() { return new_target_; }
-  Node* argc() { return argc_; }
-  Node* o() { return o_; }
-  Node* len() { return len_; }
-  Node* callbackfn() { return callbackfn_; }
-  Node* this_arg() { return this_arg_; }
-  Node* k() { return k_.value(); }
-  Node* a() { return a_.value(); }
-
-  void ReturnFromBuiltin(Node* value) {
+  void ArrayBuiltinsAssembler::ReturnFromBuiltin(Node* value) {
     if (argc_ == nullptr) {
       Return(value);
     } else {
@@ -370,9 +383,9 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     }
   }
 
-  void InitIteratingArrayBuiltinBody(Node* context, Node* receiver,
-                                     Node* callbackfn, Node* this_arg,
-                                     Node* new_target, Node* argc) {
+  void ArrayBuiltinsAssembler::InitIteratingArrayBuiltinBody(
+      TNode<Context> context, TNode<Object> receiver, Node* callbackfn,
+      Node* this_arg, Node* new_target, TNode<IntPtrT> argc) {
     context_ = context;
     receiver_ = receiver;
     new_target_ = new_target;
@@ -381,12 +394,11 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     argc_ = argc;
   }
 
-  void GenerateIteratingArrayBuiltinBody(
+  void ArrayBuiltinsAssembler::GenerateIteratingArrayBuiltinBody(
       const char* name, const BuiltinResultGenerator& generator,
       const CallResultProcessor& processor, const PostLoopAction& action,
       const Callable& slow_case_continuation,
-      MissingPropertyMode missing_property_mode,
-      ForEachDirection direction = ForEachDirection::kForward) {
+      MissingPropertyMode missing_property_mode, ForEachDirection direction) {
     Label non_array(this), array_changes(this, {&k_, &a_, &to_});
 
     // TODO(danno): Seriously? Do we really need to throw the exact error
@@ -398,19 +410,19 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
 
     // 1. Let O be ToObject(this value).
     // 2. ReturnIfAbrupt(O)
-    o_ = CallBuiltin(Builtins::kToObject, context(), receiver());
+    o_ = ToObject(context(), receiver());
 
     // 3. Let len be ToLength(Get(O, "length")).
     // 4. ReturnIfAbrupt(len).
-    VARIABLE(merged_length, MachineRepresentation::kTagged);
+    TVARIABLE(Number, merged_length);
     Label has_length(this, &merged_length), not_js_array(this);
     GotoIf(DoesntHaveInstanceType(o(), JS_ARRAY_TYPE), &not_js_array);
-    merged_length.Bind(LoadJSArrayLength(o()));
+    merged_length = LoadJSArrayLength(CAST(o()));
     Goto(&has_length);
     BIND(&not_js_array);
     Node* len_property =
         GetProperty(context(), o(), isolate()->factory()->length_string());
-    merged_length.Bind(ToLength_Inline(context(), len_property));
+    merged_length = ToLength_Inline(context(), len_property);
     Goto(&has_length);
     BIND(&has_length);
     len_ = merged_length.value();
@@ -453,15 +465,13 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     ReturnFromBuiltin(result);
   }
 
-  void InitIteratingArrayBuiltinLoopContinuation(Node* context, Node* receiver,
-                                                 Node* callbackfn,
-                                                 Node* this_arg, Node* a,
-                                                 Node* o, Node* initial_k,
-                                                 Node* len, Node* to) {
+  void ArrayBuiltinsAssembler::InitIteratingArrayBuiltinLoopContinuation(
+      TNode<Context> context, TNode<Object> receiver, Node* callbackfn,
+      Node* this_arg, Node* a, TNode<JSReceiver> o, Node* initial_k,
+      TNode<Number> len, Node* to) {
     context_ = context;
     this_arg_ = this_arg;
     callbackfn_ = callbackfn;
-    argc_ = nullptr;
     a_.Bind(a);
     k_.Bind(initial_k);
     o_ = o;
@@ -469,10 +479,10 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     to_.Bind(to);
   }
 
-  void GenerateIteratingTypedArrayBuiltinBody(
+  void ArrayBuiltinsAssembler::GenerateIteratingTypedArrayBuiltinBody(
       const char* name, const BuiltinResultGenerator& generator,
       const CallResultProcessor& processor, const PostLoopAction& action,
-      ForEachDirection direction = ForEachDirection::kForward) {
+      ForEachDirection direction) {
     name_ = name;
 
     // ValidateTypedArray: tc39.github.io/ecma262/#sec-validatetypedarray
@@ -481,14 +491,17 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
         throw_detached(this, Label::kDeferred);
 
     GotoIf(TaggedIsSmi(receiver_), &throw_not_typed_array);
-    GotoIfNot(HasInstanceType(receiver_, JS_TYPED_ARRAY_TYPE),
+    GotoIfNot(HasInstanceType(CAST(receiver_), JS_TYPED_ARRAY_TYPE),
               &throw_not_typed_array);
 
-    o_ = receiver_;
-    Node* array_buffer = LoadObjectField(o_, JSTypedArray::kBufferOffset);
+    TNode<JSTypedArray> typed_array = CAST(receiver_);
+    o_ = typed_array;
+
+    Node* array_buffer =
+        LoadObjectField(typed_array, JSTypedArray::kBufferOffset);
     GotoIf(IsDetachedBuffer(array_buffer), &throw_detached);
 
-    len_ = LoadObjectField(o_, JSTypedArray::kLengthOffset);
+    len_ = LoadObjectField<Smi>(typed_array, JSTypedArray::kLengthOffset);
 
     Label throw_not_callable(this, Label::kDeferred);
     Label distinguish_types(this);
@@ -525,12 +538,14 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
 
     BIND(&distinguish_types);
 
+    generator(this);
+
     if (direction == ForEachDirection::kForward) {
       k_.Bind(SmiConstant(0));
     } else {
       k_.Bind(NumberDec(len()));
     }
-    Node* instance_type = LoadInstanceType(LoadElements(o_));
+    Node* instance_type = LoadInstanceType(LoadElements(typed_array));
     Switch(instance_type, &unexpected_instance_type, instance_types.data(),
            label_ptrs.data(), labels.size());
 
@@ -539,11 +554,11 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
       Label done(this);
       source_elements_kind_ = ElementsKindForInstanceType(
           static_cast<InstanceType>(instance_types[i]));
-      generator(this);
       // TODO(tebbi): Silently cancelling the loop on buffer detachment is a
       // spec violation. Should go to &throw_detached and throw a TypeError
       // instead.
-      VisitAllTypedArrayElements(array_buffer, processor, &done, direction);
+      VisitAllTypedArrayElements(array_buffer, processor, &done, direction,
+                                 typed_array);
       Goto(&done);
       // No exception, return success
       BIND(&done);
@@ -552,10 +567,9 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     }
   }
 
-  void GenerateIteratingArrayBuiltinLoopContinuation(
+  void ArrayBuiltinsAssembler::GenerateIteratingArrayBuiltinLoopContinuation(
       const CallResultProcessor& processor, const PostLoopAction& action,
-      MissingPropertyMode missing_property_mode,
-      ForEachDirection direction = ForEachDirection::kForward) {
+      MissingPropertyMode missing_property_mode, ForEachDirection direction) {
     Label loop(this, {&k_, &a_, &to_});
     Label after_loop(this);
     Goto(&loop);
@@ -613,8 +627,8 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     Return(a_.value());
   }
 
- private:
-  static ElementsKind ElementsKindForInstanceType(InstanceType type) {
+  ElementsKind ArrayBuiltinsAssembler::ElementsKindForInstanceType(
+      InstanceType type) {
     switch (type) {
 #define INSTANCE_TYPE_TO_ELEMENTS_KIND(Type, type, TYPE, ctype, size) \
   case FIXED_##TYPE##_ARRAY_TYPE:                                     \
@@ -628,14 +642,14 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     }
   }
 
-  void VisitAllTypedArrayElements(Node* array_buffer,
-                                  const CallResultProcessor& processor,
-                                  Label* detached, ForEachDirection direction) {
+  void ArrayBuiltinsAssembler::VisitAllTypedArrayElements(
+      Node* array_buffer, const CallResultProcessor& processor, Label* detached,
+      ForEachDirection direction, TNode<JSTypedArray> typed_array) {
     VariableList list({&a_, &k_, &to_}, zone());
 
     FastLoopBody body = [&](Node* index) {
       GotoIf(IsDetachedBuffer(array_buffer), detached);
-      Node* elements = LoadElements(o_);
+      Node* elements = LoadElements(typed_array);
       Node* base_ptr =
           LoadObjectField(elements, FixedTypedArrayBase::kBasePointerOffset);
       Node* external_ptr =
@@ -660,17 +674,16 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
                   advance_mode);
   }
 
-  void VisitAllFastElementsOneKind(ElementsKind kind,
-                                   const CallResultProcessor& processor,
-                                   Label* array_changed, ParameterMode mode,
-                                   ForEachDirection direction,
-                                   MissingPropertyMode missing_property_mode) {
+  void ArrayBuiltinsAssembler::VisitAllFastElementsOneKind(
+      ElementsKind kind, const CallResultProcessor& processor,
+      Label* array_changed, ParameterMode mode, ForEachDirection direction,
+      MissingPropertyMode missing_property_mode, TNode<Smi> length) {
     Comment("begin VisitAllFastElementsOneKind");
     VARIABLE(original_map, MachineRepresentation::kTagged);
     original_map.Bind(LoadMap(o()));
     VariableList list({&original_map, &a_, &k_, &to_}, zone());
     Node* start = IntPtrOrSmiConstant(0, mode);
-    Node* end = TaggedToParameter(len(), mode);
+    Node* end = TaggedToParameter(length, mode);
     IndexAdvanceMode advance_mode = direction == ForEachDirection::kReverse
                                         ? IndexAdvanceMode::kPre
                                         : IndexAdvanceMode::kPost;
@@ -688,13 +701,14 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
           Node* o_map = LoadMap(o());
           GotoIf(WordNotEqual(o_map, original_map.value()), array_changed);
 
+          TNode<JSArray> o_array = CAST(o());
           // Check if o's length has changed during the callback and if the
           // index is now out of range of the new length.
-          GotoIf(SmiGreaterThanOrEqual(k_.value(), LoadJSArrayLength(o())),
+          GotoIf(SmiGreaterThanOrEqual(k_.value(), LoadJSArrayLength(o_array)),
                  array_changed);
 
           // Re-load the elements array. If may have been resized.
-          Node* elements = LoadElements(o());
+          Node* elements = LoadElements(o_array);
 
           // Fast case: load the element directly from the elements FixedArray
           // and call the callback if the element is not the hole.
@@ -735,10 +749,10 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     Comment("end VisitAllFastElementsOneKind");
   }
 
-  void HandleFastElements(const CallResultProcessor& processor,
-                          const PostLoopAction& action, Label* slow,
-                          ForEachDirection direction,
-                          MissingPropertyMode missing_property_mode) {
+  void ArrayBuiltinsAssembler::HandleFastElements(
+      const CallResultProcessor& processor, const PostLoopAction& action,
+      Label* slow, ForEachDirection direction,
+      MissingPropertyMode missing_property_mode) {
     Label switch_on_elements_kind(this), fast_elements(this),
         maybe_double_elements(this), fast_double_elements(this);
 
@@ -750,6 +764,7 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
                         &switch_on_elements_kind, slow);
 
     BIND(&switch_on_elements_kind);
+    TNode<Smi> smi_len = CAST(len());
     // Select by ElementsKind
     Node* o_map = LoadMap(o());
     Node* bit_field2 = LoadMapBitField2(o_map);
@@ -761,7 +776,7 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     BIND(&fast_elements);
     {
       VisitAllFastElementsOneKind(PACKED_ELEMENTS, processor, slow, mode,
-                                  direction, missing_property_mode);
+                                  direction, missing_property_mode, smi_len);
 
       action(this);
 
@@ -776,7 +791,7 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     BIND(&fast_double_elements);
     {
       VisitAllFastElementsOneKind(PACKED_DOUBLE_ELEMENTS, processor, slow, mode,
-                                  direction, missing_property_mode);
+                                  direction, missing_property_mode, smi_len);
 
       action(this);
 
@@ -788,7 +803,7 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
   // Perform ArraySpeciesCreate (ES6 #sec-arrayspeciescreate).
   // This version is specialized to create a zero length array
   // of the elements kind of the input array.
-  void ArraySpeciesCreate() {
+  void ArrayBuiltinsAssembler::GenerateArraySpeciesCreate() {
     Label runtime(this, Label::kDeferred), done(this);
 
     TNode<Smi> len = SmiConstant(0);
@@ -810,9 +825,9 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     // Respect the ElementsKind of the input array.
     TNode<Int32T> elements_kind = LoadMapElementsKind(original_map);
     GotoIfNot(IsFastElementsKind(elements_kind), &runtime);
-    TNode<Context> native_context = CAST(LoadNativeContext(context()));
+    TNode<Context> native_context = LoadNativeContext(context());
     TNode<Map> array_map =
-        CAST(LoadJSArrayElementsMap(elements_kind, native_context));
+        LoadJSArrayElementsMap(elements_kind, native_context);
     TNode<JSArray> array =
         CAST(AllocateJSArray(GetInitialFastElementsKind(), array_map, len, len,
                              nullptr, CodeStubAssembler::SMI_PARAMETERS));
@@ -834,7 +849,7 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
   }
 
   // Perform ArraySpeciesCreate (ES6 #sec-arrayspeciescreate).
-  void ArraySpeciesCreate(SloppyTNode<Smi> len) {
+  void ArrayBuiltinsAssembler::GenerateArraySpeciesCreate(TNode<Number> len) {
     Label runtime(this, Label::kDeferred), done(this);
 
     Node* const original_map = LoadMap(o());
@@ -860,9 +875,9 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     // element in the input array (maybe the callback deletes an element).
     const ElementsKind elements_kind =
         GetHoleyElementsKind(GetInitialFastElementsKind());
-    TNode<Context> native_context = CAST(LoadNativeContext(context()));
+    TNode<Context> native_context = LoadNativeContext(context());
     TNode<Map> array_map =
-        CAST(LoadJSArrayElementsMap(elements_kind, native_context));
+        LoadJSArrayElementsMap(elements_kind, native_context);
     a_.Bind(AllocateJSArray(PACKED_SMI_ELEMENTS, array_map, len, len, nullptr,
                             CodeStubAssembler::SMI_PARAMETERS));
 
@@ -881,30 +896,14 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     BIND(&done);
   }
 
-  Node* callbackfn_ = nullptr;
-  Node* o_ = nullptr;
-  Node* this_arg_ = nullptr;
-  Node* len_ = nullptr;
-  Node* context_ = nullptr;
-  Node* receiver_ = nullptr;
-  Node* new_target_ = nullptr;
-  Node* argc_ = nullptr;
-  Node* fast_typed_array_target_ = nullptr;
-  const char* name_ = nullptr;
-  Variable k_;
-  Variable a_;
-  Variable to_;
-  Label fully_spec_compliant_;
-  ElementsKind source_elements_kind_ = ElementsKind::NO_ELEMENTS;
-};
-
 TF_BUILTIN(ArrayPrototypePop, CodeStubAssembler) {
-  Node* argc = Parameter(BuiltinDescriptor::kArgumentsCount);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount));
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   CSA_ASSERT(this, IsUndefined(Parameter(BuiltinDescriptor::kNewTarget)));
 
   CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
 
   Label runtime(this, Label::kDeferred);
   Label fast(this);
@@ -920,16 +919,18 @@ TF_BUILTIN(ArrayPrototypePop, CodeStubAssembler) {
 
   BIND(&fast);
   {
-    CSA_ASSERT(this, TaggedIsPositiveSmi(LoadJSArrayLength(receiver)));
-    Node* length = LoadAndUntagObjectField(receiver, JSArray::kLengthOffset);
+    TNode<JSArray> array_receiver = CAST(receiver);
+    CSA_ASSERT(this, TaggedIsPositiveSmi(LoadJSArrayLength(array_receiver)));
+    Node* length =
+        LoadAndUntagObjectField(array_receiver, JSArray::kLengthOffset);
     Label return_undefined(this), fast_elements(this);
     GotoIf(IntPtrEqual(length, IntPtrConstant(0)), &return_undefined);
 
     // 2) Ensure that the length is writable.
-    EnsureArrayLengthWritable(LoadMap(receiver), &runtime);
+    EnsureArrayLengthWritable(LoadMap(array_receiver), &runtime);
 
     // 3) Check that the elements backing store isn't copy-on-write.
-    Node* elements = LoadElements(receiver);
+    Node* elements = LoadElements(array_receiver);
     GotoIf(WordEqual(LoadMap(elements),
                      LoadRoot(Heap::kFixedCOWArrayMapRootIndex)),
            &runtime);
@@ -945,10 +946,10 @@ TF_BUILTIN(ArrayPrototypePop, CodeStubAssembler) {
                capacity),
            &runtime);
 
-    StoreObjectFieldNoWriteBarrier(receiver, JSArray::kLengthOffset,
+    StoreObjectFieldNoWriteBarrier(array_receiver, JSArray::kLengthOffset,
                                    SmiTag(new_length));
 
-    Node* elements_kind = LoadMapElementsKind(LoadMap(receiver));
+    Node* elements_kind = LoadMapElementsKind(LoadMap(array_receiver));
     GotoIf(Int32LessThanOrEqual(elements_kind,
                                 Int32Constant(TERMINAL_FAST_ELEMENTS_KIND)),
            &fast_elements);
@@ -1008,12 +1009,14 @@ TF_BUILTIN(ArrayPrototypePush, CodeStubAssembler) {
 
   // TODO(ishell): use constants from Descriptor once the JSFunction linkage
   // arguments are reordered.
-  Node* argc = Parameter(BuiltinDescriptor::kArgumentsCount);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount));
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   CSA_ASSERT(this, IsUndefined(Parameter(BuiltinDescriptor::kNewTarget)));
 
   CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
+  TNode<JSArray> array_receiver;
   Node* kind = nullptr;
 
   Label fast(this);
@@ -1021,13 +1024,14 @@ TF_BUILTIN(ArrayPrototypePush, CodeStubAssembler) {
 
   BIND(&fast);
   {
+    array_receiver = CAST(receiver);
     arg_index = IntPtrConstant(0);
-    kind = EnsureArrayPushable(receiver, &runtime);
+    kind = EnsureArrayPushable(LoadMap(array_receiver), &runtime);
     GotoIf(IsElementsKindGreaterThan(kind, HOLEY_SMI_ELEMENTS),
            &object_push_pre);
 
-    Node* new_length = BuildAppendJSArray(PACKED_SMI_ELEMENTS, receiver, &args,
-                                          &arg_index, &smi_transition);
+    Node* new_length = BuildAppendJSArray(PACKED_SMI_ELEMENTS, array_receiver,
+                                          &args, &arg_index, &smi_transition);
     args.PopAndReturn(new_length);
   }
 
@@ -1037,17 +1041,17 @@ TF_BUILTIN(ArrayPrototypePush, CodeStubAssembler) {
   // the most generic implementation for the rest of the array.
   BIND(&smi_transition);
   {
-    Node* arg = args.AtIndex(arg_index);
+    Node* arg = args.AtIndex(arg_index.value());
     GotoIf(TaggedIsSmi(arg), &default_label);
-    Node* length = LoadJSArrayLength(receiver);
+    Node* length = LoadJSArrayLength(array_receiver);
     // TODO(danno): Use the KeyedStoreGeneric stub here when possible,
     // calling into the runtime to do the elements transition is overkill.
-    CallRuntime(Runtime::kSetProperty, context, receiver, length, arg,
+    CallRuntime(Runtime::kSetProperty, context, array_receiver, length, arg,
                 SmiConstant(LanguageMode::kStrict));
     Increment(&arg_index);
     // The runtime SetProperty call could have converted the array to dictionary
     // mode, which must be detected to abort the fast-path.
-    Node* map = LoadMap(receiver);
+    Node* map = LoadMap(array_receiver);
     Node* bit_field2 = LoadMapBitField2(map);
     Node* kind = DecodeWord32<Map::ElementsKindBits>(bit_field2);
     GotoIf(Word32Equal(kind, Int32Constant(DICTIONARY_ELEMENTS)),
@@ -1065,16 +1069,16 @@ TF_BUILTIN(ArrayPrototypePush, CodeStubAssembler) {
 
   BIND(&object_push);
   {
-    Node* new_length = BuildAppendJSArray(PACKED_ELEMENTS, receiver, &args,
-                                          &arg_index, &default_label);
+    Node* new_length = BuildAppendJSArray(PACKED_ELEMENTS, array_receiver,
+                                          &args, &arg_index, &default_label);
     args.PopAndReturn(new_length);
   }
 
   BIND(&double_push);
   {
     Node* new_length =
-        BuildAppendJSArray(PACKED_DOUBLE_ELEMENTS, receiver, &args, &arg_index,
-                           &double_transition);
+        BuildAppendJSArray(PACKED_DOUBLE_ELEMENTS, array_receiver, &args,
+                           &arg_index, &double_transition);
     args.PopAndReturn(new_length);
   }
 
@@ -1084,17 +1088,17 @@ TF_BUILTIN(ArrayPrototypePush, CodeStubAssembler) {
   // on the most generic implementation for the rest of the array.
   BIND(&double_transition);
   {
-    Node* arg = args.AtIndex(arg_index);
+    Node* arg = args.AtIndex(arg_index.value());
     GotoIfNumber(arg, &default_label);
-    Node* length = LoadJSArrayLength(receiver);
+    Node* length = LoadJSArrayLength(array_receiver);
     // TODO(danno): Use the KeyedStoreGeneric stub here when possible,
     // calling into the runtime to do the elements transition is overkill.
-    CallRuntime(Runtime::kSetProperty, context, receiver, length, arg,
+    CallRuntime(Runtime::kSetProperty, context, array_receiver, length, arg,
                 SmiConstant(LanguageMode::kStrict));
     Increment(&arg_index);
     // The runtime SetProperty call could have converted the array to dictionary
     // mode, which must be detected to abort the fast-path.
-    Node* map = LoadMap(receiver);
+    Node* map = LoadMap(array_receiver);
     Node* bit_field2 = LoadMapBitField2(map);
     Node* kind = DecodeWord32<Map::ElementsKindBits>(bit_field2);
     GotoIf(Word32Equal(kind, Int32Constant(DICTIONARY_ELEMENTS)),
@@ -1107,13 +1111,13 @@ TF_BUILTIN(ArrayPrototypePush, CodeStubAssembler) {
   BIND(&default_label);
   {
     args.ForEach(
-        [this, receiver, context](Node* arg) {
-          Node* length = LoadJSArrayLength(receiver);
-          CallRuntime(Runtime::kSetProperty, context, receiver, length, arg,
-                      SmiConstant(LanguageMode::kStrict));
+        [this, array_receiver, context](Node* arg) {
+          Node* length = LoadJSArrayLength(array_receiver);
+          CallRuntime(Runtime::kSetProperty, context, array_receiver, length,
+                      arg, SmiConstant(LanguageMode::kStrict));
         },
-        arg_index);
-    args.PopAndReturn(LoadJSArrayLength(receiver));
+        arg_index.value());
+    args.PopAndReturn(LoadJSArrayLength(array_receiver));
   }
 
   BIND(&runtime);
@@ -1131,8 +1135,8 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
       compiler::CodeAssemblerState* state)
       : CodeStubAssembler(state) {}
 
-  Node* HandleFastSlice(Node* context, Node* array, Node* from, Node* count,
-                        Label* slow) {
+  Node* HandleFastSlice(TNode<Context> context, Node* array, Node* from,
+                        Node* count, Label* slow) {
     VARIABLE(result, MachineRepresentation::kTagged);
     Label done(this);
 
@@ -1262,7 +1266,8 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
     return result.value();
   }
 
-  void CopyOneElement(Node* context, Node* o, Node* a, Node* p_k, Variable& n) {
+  void CopyOneElement(TNode<Context> context, Node* o, Node* a, Node* p_k,
+                      Variable& n) {
     // b. Let kPresent be HasProperty(O, Pk).
     // c. ReturnIfAbrupt(kPresent).
     TNode<Oddball> k_present = HasProperty(o, p_k, context, kHasProperty);
@@ -1291,9 +1296,9 @@ TF_BUILTIN(ArrayPrototypeSlice, ArrayPrototypeSliceCodeStubAssembler) {
   Label slow(this, Label::kDeferred), fast_elements_kind(this);
 
   CodeStubArguments args(this, argc);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
 
-  VARIABLE(o, MachineRepresentation::kTagged);
+  TVARIABLE(JSReceiver, o);
   VARIABLE(len, MachineRepresentation::kTagged);
   Label length_done(this), generic_length(this), check_arguments_length(this),
       load_arguments_length(this);
@@ -1301,8 +1306,9 @@ TF_BUILTIN(ArrayPrototypeSlice, ArrayPrototypeSliceCodeStubAssembler) {
   GotoIf(TaggedIsSmi(receiver), &generic_length);
   GotoIfNot(IsJSArray(receiver), &check_arguments_length);
 
-  o.Bind(receiver);
-  len.Bind(LoadJSArrayLength(receiver));
+  TNode<JSArray> array_receiver = CAST(receiver);
+  o = array_receiver;
+  len.Bind(LoadJSArrayLength(array_receiver));
 
   // Check for the array clone case. There can be no arguments to slice, the
   // array prototype chain must be intact and have no elements, the array has to
@@ -1318,7 +1324,7 @@ TF_BUILTIN(ArrayPrototypeSlice, ArrayPrototypeSliceCodeStubAssembler) {
 
   BIND(&check_arguments_length);
 
-  Node* map = LoadMap(receiver);
+  Node* map = LoadMap(array_receiver);
   Node* native_context = LoadNativeContext(context);
   GotoIfContextElementEqual(map, native_context,
                             Context::FAST_ALIASED_ARGUMENTS_MAP_INDEX,
@@ -1337,16 +1343,16 @@ TF_BUILTIN(ArrayPrototypeSlice, ArrayPrototypeSliceCodeStubAssembler) {
 
   BIND(&load_arguments_length);
   Node* arguments_length =
-      LoadObjectField(receiver, JSArgumentsObject::kLengthOffset);
+      LoadObjectField(array_receiver, JSArgumentsObject::kLengthOffset);
   GotoIf(TaggedIsNotSmi(arguments_length), &generic_length);
-  o.Bind(receiver);
+  o = CAST(receiver);
   len.Bind(arguments_length);
   Goto(&length_done);
 
   BIND(&generic_length);
   // 1. Let O be ToObject(this value).
   // 2. ReturnIfAbrupt(O).
-  o.Bind(CallBuiltin(Builtins::kToObject, context, receiver));
+  o = ToObject(context, receiver);
 
   // 3. Let len be ToLength(Get(O, "length")).
   // 4. ReturnIfAbrupt(len).
@@ -1359,7 +1365,7 @@ TF_BUILTIN(ArrayPrototypeSlice, ArrayPrototypeSliceCodeStubAssembler) {
 
   // 5. Let relativeStart be ToInteger(start).
   // 6. ReturnIfAbrupt(relativeStart).
-  TNode<Object> arg0 = CAST(args.GetOptionalArgumentValue(0, SmiConstant(0)));
+  TNode<Object> arg0 = args.GetOptionalArgumentValue(0, SmiConstant(0));
   Node* relative_start = ToInteger_Inline(context, arg0);
 
   // 7. If relativeStart < 0, let k be max((len + relativeStart),0);
@@ -1378,8 +1384,7 @@ TF_BUILTIN(ArrayPrototypeSlice, ArrayPrototypeSliceCodeStubAssembler) {
   // 8. If end is undefined, let relativeEnd be len;
   //    else let relativeEnd be ToInteger(end).
   // 9. ReturnIfAbrupt(relativeEnd).
-  TNode<Object> end =
-      CAST(args.GetOptionalArgumentValue(1, UndefinedConstant()));
+  TNode<Object> end = args.GetOptionalArgumentValue(1, UndefinedConstant());
   Label end_undefined(this), end_done(this);
   VARIABLE(relative_end, MachineRepresentation::kTagged);
   GotoIf(WordEqual(end, UndefinedConstant()), &end_undefined);
@@ -1460,12 +1465,13 @@ TF_BUILTIN(ArrayPrototypeSlice, ArrayPrototypeSliceCodeStubAssembler) {
 }
 
 TF_BUILTIN(ArrayPrototypeShift, CodeStubAssembler) {
-  Node* argc = Parameter(BuiltinDescriptor::kArgumentsCount);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount));
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   CSA_ASSERT(this, IsUndefined(Parameter(BuiltinDescriptor::kNewTarget)));
 
   CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
 
   Label runtime(this, Label::kDeferred);
   Label fast(this);
@@ -1482,17 +1488,19 @@ TF_BUILTIN(ArrayPrototypeShift, CodeStubAssembler) {
 
   BIND(&fast);
   {
-    CSA_ASSERT(this, TaggedIsPositiveSmi(LoadJSArrayLength(receiver)));
-    Node* length = LoadAndUntagObjectField(receiver, JSArray::kLengthOffset);
+    TNode<JSArray> array_receiver = CAST(receiver);
+    CSA_ASSERT(this, TaggedIsPositiveSmi(LoadJSArrayLength(array_receiver)));
+    Node* length =
+        LoadAndUntagObjectField(array_receiver, JSArray::kLengthOffset);
     Label return_undefined(this), fast_elements_tagged(this),
         fast_elements_smi(this);
     GotoIf(IntPtrEqual(length, IntPtrConstant(0)), &return_undefined);
 
     // 2) Ensure that the length is writable.
-    EnsureArrayLengthWritable(LoadMap(receiver), &runtime);
+    EnsureArrayLengthWritable(LoadMap(array_receiver), &runtime);
 
     // 3) Check that the elements backing store isn't copy-on-write.
-    Node* elements = LoadElements(receiver);
+    Node* elements = LoadElements(array_receiver);
     GotoIf(WordEqual(LoadMap(elements),
                      LoadRoot(Heap::kFixedCOWArrayMapRootIndex)),
            &runtime);
@@ -1514,10 +1522,10 @@ TF_BUILTIN(ArrayPrototypeShift, CodeStubAssembler) {
                              IntPtrConstant(JSArray::kMaxCopyElements)),
            &runtime);
 
-    StoreObjectFieldNoWriteBarrier(receiver, JSArray::kLengthOffset,
+    StoreObjectFieldNoWriteBarrier(array_receiver, JSArray::kLengthOffset,
                                    SmiTag(new_length));
 
-    Node* elements_kind = LoadMapElementsKind(LoadMap(receiver));
+    Node* elements_kind = LoadMapElementsKind(LoadMap(array_receiver));
     GotoIf(
         Int32LessThanOrEqual(elements_kind, Int32Constant(HOLEY_SMI_ELEMENTS)),
         &fast_elements_smi);
@@ -1616,9 +1624,9 @@ TF_BUILTIN(ArrayPrototypeShift, CodeStubAssembler) {
   }
 }
 
-TF_BUILTIN(ExtractFastJSArray, ArrayBuiltinCodeStubAssembler) {
+TF_BUILTIN(ExtractFastJSArray, ArrayBuiltinsAssembler) {
   ParameterMode mode = OptimalParameterMode();
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   Node* array = Parameter(Descriptor::kSource);
   Node* begin = TaggedToParameter(Parameter(Descriptor::kBegin), mode);
   Node* count = TaggedToParameter(Parameter(Descriptor::kCount), mode);
@@ -1629,8 +1637,8 @@ TF_BUILTIN(ExtractFastJSArray, ArrayBuiltinCodeStubAssembler) {
   Return(ExtractFastJSArray(context, array, begin, count, mode));
 }
 
-TF_BUILTIN(CloneFastJSArray, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
+TF_BUILTIN(CloneFastJSArray, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   Node* array = Parameter(Descriptor::kSource);
 
   CSA_ASSERT(this, IsJSArray(array));
@@ -1640,15 +1648,15 @@ TF_BUILTIN(CloneFastJSArray, ArrayBuiltinCodeStubAssembler) {
   Return(CloneFastJSArray(context, array, mode));
 }
 
-TF_BUILTIN(ArrayFindLoopContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayFindLoopContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
-  Node* object = Parameter(Descriptor::kObject);
+  TNode<JSReceiver> object = CAST(Parameter(Descriptor::kObject));
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* to = Parameter(Descriptor::kTo);
 
   InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
@@ -1656,20 +1664,20 @@ TF_BUILTIN(ArrayFindLoopContinuation, ArrayBuiltinCodeStubAssembler) {
                                             len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::FindProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction,
+      &ArrayBuiltinsAssembler::FindProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction,
       MissingPropertyMode::kUseUndefined, ForEachDirection::kForward);
 }
 
 // Continuation that is called after an eager deoptimization from TF (ex. the
 // array changes during iteration).
-TF_BUILTIN(ArrayFindLoopEagerDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayFindLoopEagerDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
 
   Return(CallBuiltin(Builtins::kArrayFindLoopContinuation, context, receiver,
                      callbackfn, this_arg, UndefinedConstant(), receiver,
@@ -1678,13 +1686,13 @@ TF_BUILTIN(ArrayFindLoopEagerDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
 
 // Continuation that is called after a lazy deoptimization from TF (ex. the
 // callback function is no longer callable).
-TF_BUILTIN(ArrayFindLoopLazyDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayFindLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
 
   Return(CallBuiltin(Builtins::kArrayFindLoopContinuation, context, receiver,
                      callbackfn, this_arg, UndefinedConstant(), receiver,
@@ -1695,13 +1703,13 @@ TF_BUILTIN(ArrayFindLoopLazyDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
 // right after the callback and it's returned value must be handled before
 // iteration continues.
 TF_BUILTIN(ArrayFindLoopAfterCallbackLazyDeoptContinuation,
-           ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+           ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* found_value = Parameter(Descriptor::kFoundValue);
   Node* is_found = Parameter(Descriptor::kIsFound);
 
@@ -1720,13 +1728,13 @@ TF_BUILTIN(ArrayFindLoopAfterCallbackLazyDeoptContinuation,
 }
 
 // ES #sec-get-%typedarray%.prototype.find
-TF_BUILTIN(ArrayPrototypeFind, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(ArrayPrototypeFind, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
@@ -1734,23 +1742,22 @@ TF_BUILTIN(ArrayPrototypeFind, ArrayBuiltinCodeStubAssembler) {
                                 new_target, argc);
 
   GenerateIteratingArrayBuiltinBody(
-      "Array.prototype.find",
-      &ArrayBuiltinCodeStubAssembler::FindResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::FindProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction,
+      "Array.prototype.find", &ArrayBuiltinsAssembler::FindResultGenerator,
+      &ArrayBuiltinsAssembler::FindProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction,
       Builtins::CallableFor(isolate(), Builtins::kArrayFindLoopContinuation),
       MissingPropertyMode::kUseUndefined, ForEachDirection::kForward);
 }
 
-TF_BUILTIN(ArrayFindIndexLoopContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayFindIndexLoopContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
-  Node* object = Parameter(Descriptor::kObject);
+  TNode<JSReceiver> object = CAST(Parameter(Descriptor::kObject));
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* to = Parameter(Descriptor::kTo);
 
   InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
@@ -1758,33 +1765,31 @@ TF_BUILTIN(ArrayFindIndexLoopContinuation, ArrayBuiltinCodeStubAssembler) {
                                             len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::FindIndexProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction,
+      &ArrayBuiltinsAssembler::FindIndexProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction,
       MissingPropertyMode::kUseUndefined, ForEachDirection::kForward);
 }
 
-TF_BUILTIN(ArrayFindIndexLoopEagerDeoptContinuation,
-           ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayFindIndexLoopEagerDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
 
   Return(CallBuiltin(Builtins::kArrayFindIndexLoopContinuation, context,
                      receiver, callbackfn, this_arg, SmiConstant(-1), receiver,
                      initial_k, len, UndefinedConstant()));
 }
 
-TF_BUILTIN(ArrayFindIndexLoopLazyDeoptContinuation,
-           ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayFindIndexLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
 
   Return(CallBuiltin(Builtins::kArrayFindIndexLoopContinuation, context,
                      receiver, callbackfn, this_arg, SmiConstant(-1), receiver,
@@ -1792,13 +1797,13 @@ TF_BUILTIN(ArrayFindIndexLoopLazyDeoptContinuation,
 }
 
 TF_BUILTIN(ArrayFindIndexLoopAfterCallbackLazyDeoptContinuation,
-           ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+           ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* found_value = Parameter(Descriptor::kFoundValue);
   Node* is_found = Parameter(Descriptor::kIsFound);
 
@@ -1817,13 +1822,13 @@ TF_BUILTIN(ArrayFindIndexLoopAfterCallbackLazyDeoptContinuation,
 }
 
 // ES #sec-get-%typedarray%.prototype.findIndex
-TF_BUILTIN(ArrayPrototypeFindIndex, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(ArrayPrototypeFindIndex, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
@@ -1832,22 +1837,378 @@ TF_BUILTIN(ArrayPrototypeFindIndex, ArrayBuiltinCodeStubAssembler) {
 
   GenerateIteratingArrayBuiltinBody(
       "Array.prototype.findIndex",
-      &ArrayBuiltinCodeStubAssembler::FindIndexResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::FindIndexProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction,
+      &ArrayBuiltinsAssembler::FindIndexResultGenerator,
+      &ArrayBuiltinsAssembler::FindIndexProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction,
       Builtins::CallableFor(isolate(),
                             Builtins::kArrayFindIndexLoopContinuation),
       MissingPropertyMode::kUseUndefined, ForEachDirection::kForward);
 }
 
+class ArrayPopulatorAssembler : public CodeStubAssembler {
+ public:
+  explicit ArrayPopulatorAssembler(compiler::CodeAssemblerState* state)
+      : CodeStubAssembler(state) {}
+
+  TNode<Object> ConstructArrayLike(TNode<Context> context,
+                                   TNode<Object> receiver) {
+    TVARIABLE(Object, array);
+    Label is_constructor(this), is_not_constructor(this), done(this);
+    GotoIf(TaggedIsSmi(receiver), &is_not_constructor);
+    Branch(IsConstructor(receiver), &is_constructor, &is_not_constructor);
+
+    BIND(&is_constructor);
+    {
+      array = CAST(
+          ConstructJS(CodeFactory::Construct(isolate()), context, receiver));
+      Goto(&done);
+    }
+
+    BIND(&is_not_constructor);
+    {
+      Label allocate_js_array(this);
+
+      TNode<Map> array_map = CAST(LoadContextElement(
+          context, Context::JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX));
+
+      array = CAST(AllocateJSArray(PACKED_SMI_ELEMENTS, array_map,
+                                   SmiConstant(0), SmiConstant(0), nullptr,
+                                   ParameterMode::SMI_PARAMETERS));
+      Goto(&done);
+    }
+
+    BIND(&done);
+    return array.value();
+  }
+
+  TNode<Object> ConstructArrayLike(TNode<Context> context,
+                                   TNode<Object> receiver,
+                                   TNode<Number> length) {
+    TVARIABLE(Object, array);
+    Label is_constructor(this), is_not_constructor(this), done(this);
+    CSA_ASSERT(this, IsNumberNormalized(length));
+    GotoIf(TaggedIsSmi(receiver), &is_not_constructor);
+    Branch(IsConstructor(receiver), &is_constructor, &is_not_constructor);
+
+    BIND(&is_constructor);
+    {
+      array = CAST(ConstructJS(CodeFactory::Construct(isolate()), context,
+                               receiver, length));
+      Goto(&done);
+    }
+
+    BIND(&is_not_constructor);
+    {
+      Label allocate_js_array(this);
+
+      Label next(this), runtime(this, Label::kDeferred);
+      TNode<Smi> limit = SmiConstant(JSArray::kInitialMaxFastElementArray);
+      CSA_ASSERT_BRANCH(this, [=](Label* ok, Label* not_ok) {
+        BranchIfNumberRelationalComparison(Operation::kGreaterThanOrEqual,
+                                           length, SmiConstant(0), ok, not_ok);
+      });
+      // This check also transitively covers the case where length is too big
+      // to be representable by a SMI and so is not usable with
+      // AllocateJSArray.
+      BranchIfNumberRelationalComparison(Operation::kGreaterThanOrEqual, length,
+                                         limit, &runtime, &next);
+
+      BIND(&runtime);
+      {
+        TNode<Context> native_context = LoadNativeContext(context);
+        TNode<JSFunction> array_function = CAST(
+            LoadContextElement(native_context, Context::ARRAY_FUNCTION_INDEX));
+        array = CallRuntime(Runtime::kNewArray, context, array_function, length,
+                            array_function, UndefinedConstant());
+        Goto(&done);
+      }
+
+      BIND(&next);
+      CSA_ASSERT(this, TaggedIsSmi(length));
+
+      TNode<Map> array_map = CAST(LoadContextElement(
+          context, Context::JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX));
+
+      // TODO(delphick): Consider using
+      // AllocateUninitializedJSArrayWithElements to avoid initializing an
+      // array and then writing over it.
+      array = CAST(AllocateJSArray(PACKED_SMI_ELEMENTS, array_map, length,
+                                   SmiConstant(0), nullptr,
+                                   ParameterMode::SMI_PARAMETERS));
+      Goto(&done);
+    }
+
+    BIND(&done);
+    return array.value();
+  }
+
+  void GenerateSetLength(TNode<Context> context, TNode<Object> array,
+                         TNode<Number> length) {
+    Label fast(this), runtime(this), done(this);
+    // There's no need to set the length, if
+    // 1) the array is a fast JS array and
+    // 2) the new length is equal to the old length.
+    // as the set is not observable. Otherwise fall back to the run-time.
+
+    // 1) Check that the array has fast elements.
+    // TODO(delphick): Consider changing this since it does an an unnecessary
+    // check for SMIs.
+    // TODO(delphick): Also we could hoist this to after the array construction
+    // and copy the args into array in the same way as the Array constructor.
+    BranchIfFastJSArray(array, context, &fast, &runtime);
+
+    BIND(&fast);
+    {
+      TNode<JSArray> fast_array = CAST(array);
+
+      TNode<Smi> length_smi = CAST(length);
+      TNode<Smi> old_length = LoadFastJSArrayLength(fast_array);
+      CSA_ASSERT(this, TaggedIsPositiveSmi(old_length));
+
+      // 2) If the created array's length matches the required length, then
+      //    there's nothing else to do. Otherwise use the runtime to set the
+      //    property as that will insert holes into excess elements or shrink
+      //    the backing store as appropriate.
+      Branch(SmiNotEqual(length_smi, old_length), &runtime, &done);
+    }
+
+    BIND(&runtime);
+    {
+      CallRuntime(Runtime::kSetProperty, context, static_cast<Node*>(array),
+                  CodeStubAssembler::LengthStringConstant(), length,
+                  SmiConstant(LanguageMode::kStrict));
+      Goto(&done);
+    }
+
+    BIND(&done);
+  }
+};
+
+// ES #sec-array.from
+TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount));
+
+  CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
+
+  TNode<Object> map_function = args.GetOptionalArgumentValue(1);
+
+  // If map_function is not undefined, then ensure it's callable else throw.
+  {
+    Label no_error(this), error(this);
+    GotoIf(IsUndefined(map_function), &no_error);
+    GotoIf(TaggedIsSmi(map_function), &error);
+    Branch(IsCallable(map_function), &no_error, &error);
+
+    BIND(&error);
+    ThrowTypeError(context, MessageTemplate::kCalledNonCallable, map_function);
+
+    BIND(&no_error);
+  }
+
+  Label iterable(this), not_iterable(this), finished(this), if_exception(this);
+
+  TNode<Object> this_arg = args.GetOptionalArgumentValue(2);
+  TNode<Object> items = args.GetOptionalArgumentValue(0);
+  // The spec doesn't require ToObject to be called directly on the iterable
+  // branch, but it's part of GetMethod that is in the spec.
+  TNode<JSReceiver> array_like = ToObject(context, items);
+
+  TVARIABLE(Object, array);
+  TVARIABLE(Number, length);
+
+  // Determine whether items[Symbol.iterator] is defined:
+  IteratorBuiltinsAssembler iterator_assembler(state());
+  Node* iterator_method =
+      iterator_assembler.GetIteratorMethod(context, array_like);
+  Branch(IsNullOrUndefined(iterator_method), &not_iterable, &iterable);
+
+  BIND(&iterable);
+  {
+    TVARIABLE(Number, index, SmiConstant(0));
+    TVARIABLE(Object, var_exception);
+    Label loop(this, &index), loop_done(this),
+        on_exception(this, Label::kDeferred),
+        index_overflow(this, Label::kDeferred);
+
+    // Check that the method is callable.
+    {
+      Label get_method_not_callable(this, Label::kDeferred), next(this);
+      GotoIf(TaggedIsSmi(iterator_method), &get_method_not_callable);
+      GotoIfNot(IsCallable(iterator_method), &get_method_not_callable);
+      Goto(&next);
+
+      BIND(&get_method_not_callable);
+      ThrowTypeError(context, MessageTemplate::kCalledNonCallable,
+                     iterator_method);
+
+      BIND(&next);
+    }
+
+    // Construct the output array with empty length.
+    array = ConstructArrayLike(context, args.GetReceiver());
+
+    // Actually get the iterator and throw if the iterator method does not yield
+    // one.
+    IteratorRecord iterator_record =
+        iterator_assembler.GetIterator(context, items, iterator_method);
+
+    TNode<Context> native_context = LoadNativeContext(context);
+    TNode<Object> fast_iterator_result_map =
+        LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX);
+
+    Goto(&loop);
+
+    BIND(&loop);
+    {
+      // Loop while iterator is not done.
+      TNode<Object> next = CAST(iterator_assembler.IteratorStep(
+          context, iterator_record, &loop_done, fast_iterator_result_map));
+      TVARIABLE(Object, value,
+                CAST(iterator_assembler.IteratorValue(
+                    context, next, fast_iterator_result_map)));
+
+      // If a map_function is supplied then call it (using this_arg as
+      // receiver), on the value returned from the iterator. Exceptions are
+      // caught so the iterator can be closed.
+      {
+        Label next(this);
+        GotoIf(IsUndefined(map_function), &next);
+
+        CSA_ASSERT(this, IsCallable(map_function));
+        Node* v = CallJS(CodeFactory::Call(isolate()), context, map_function,
+                         this_arg, value.value(), index.value());
+        GotoIfException(v, &on_exception, &var_exception);
+        value = CAST(v);
+        Goto(&next);
+        BIND(&next);
+      }
+
+      // Store the result in the output object (catching any exceptions so the
+      // iterator can be closed).
+      Node* define_status =
+          CallRuntime(Runtime::kCreateDataProperty, context, array.value(),
+                      index.value(), value.value());
+      GotoIfException(define_status, &on_exception, &var_exception);
+
+      index = NumberInc(index.value());
+
+      // The spec requires that we throw an exception if index reaches 2^53-1,
+      // but an empty loop would take >100 days to do this many iterations. To
+      // actually run for that long would require an iterator that never set
+      // done to true and a target array which somehow never ran out of memory,
+      // e.g. a proxy that discarded the values. Ignoring this case just means
+      // we would repeatedly call CreateDataProperty with index = 2^53.
+      CSA_ASSERT_BRANCH(this, [&](Label* ok, Label* not_ok) {
+        BranchIfNumberRelationalComparison(Operation::kLessThan, index.value(),
+                                           NumberConstant(kMaxSafeInteger), ok,
+                                           not_ok);
+      });
+      Goto(&loop);
+    }
+
+    BIND(&loop_done);
+    {
+      length = index;
+      Goto(&finished);
+    }
+
+    BIND(&on_exception);
+    {
+      // Close the iterator, rethrowing either the passed exception or
+      // exceptions thrown during the close.
+      iterator_assembler.IteratorCloseOnException(context, iterator_record,
+                                                  &var_exception);
+    }
+  }
+
+  BIND(&not_iterable);
+  {
+    // Treat array_like as an array and try to get its length.
+    length = ToLength_Inline(
+        context, GetProperty(context, array_like, factory()->length_string()));
+
+    // Construct an array using the receiver as constructor with the same length
+    // as the input array.
+    array = ConstructArrayLike(context, args.GetReceiver(), length.value());
+
+    TVARIABLE(Number, index, SmiConstant(0));
+
+    GotoIf(SmiEqual(length.value(), SmiConstant(0)), &finished);
+
+    // Loop from 0 to length-1.
+    {
+      Label loop(this, &index);
+      Goto(&loop);
+      BIND(&loop);
+      TVARIABLE(Object, value);
+
+      value = GetProperty(context, array_like, index.value());
+
+      // If a map_function is supplied then call it (using this_arg as
+      // receiver), on the value retrieved from the array.
+      {
+        Label next(this);
+        GotoIf(IsUndefined(map_function), &next);
+
+        CSA_ASSERT(this, IsCallable(map_function));
+        value = CAST(CallJS(CodeFactory::Call(isolate()), context, map_function,
+                            this_arg, value.value(), index.value()));
+        Goto(&next);
+        BIND(&next);
+      }
+
+      // Store the result in the output object.
+      CallRuntime(Runtime::kCreateDataProperty, context, array.value(),
+                  index.value(), value.value());
+      index = NumberInc(index.value());
+      BranchIfNumberRelationalComparison(Operation::kLessThan, index.value(),
+                                         length.value(), &loop, &finished);
+    }
+  }
+
+  BIND(&finished);
+
+  // Finally set the length on the output and return it.
+  GenerateSetLength(context, array.value(), length.value());
+  args.PopAndReturn(array.value());
+}
+
+// ES #sec-array.of
+TF_BUILTIN(ArrayOf, ArrayPopulatorAssembler) {
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount));
+  TNode<Smi> length = SmiFromInt32(argc);
+
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+
+  CodeStubArguments args(this, length, nullptr, ParameterMode::SMI_PARAMETERS);
+
+  TNode<Object> array = ConstructArrayLike(context, args.GetReceiver(), length);
+
+  // TODO(delphick): Avoid using CreateDataProperty on the fast path.
+  BuildFastLoop(SmiConstant(0), length,
+                [=](Node* index) {
+                  CallRuntime(
+                      Runtime::kCreateDataProperty, context,
+                      static_cast<Node*>(array), index,
+                      args.AtIndex(index, ParameterMode::SMI_PARAMETERS));
+                },
+                1, ParameterMode::SMI_PARAMETERS, IndexAdvanceMode::kPost);
+
+  GenerateSetLength(context, array, length);
+  args.PopAndReturn(array);
+}
+
 // ES #sec-get-%typedarray%.prototype.find
-TF_BUILTIN(TypedArrayPrototypeFind, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(TypedArrayPrototypeFind, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
@@ -1856,19 +2217,19 @@ TF_BUILTIN(TypedArrayPrototypeFind, ArrayBuiltinCodeStubAssembler) {
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.find",
-      &ArrayBuiltinCodeStubAssembler::FindResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::FindProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction);
+      &ArrayBuiltinsAssembler::FindResultGenerator,
+      &ArrayBuiltinsAssembler::FindProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction);
 }
 
 // ES #sec-get-%typedarray%.prototype.findIndex
-TF_BUILTIN(TypedArrayPrototypeFindIndex, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(TypedArrayPrototypeFindIndex, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
@@ -1877,20 +2238,20 @@ TF_BUILTIN(TypedArrayPrototypeFindIndex, ArrayBuiltinCodeStubAssembler) {
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.findIndex",
-      &ArrayBuiltinCodeStubAssembler::FindIndexResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::FindIndexProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction);
+      &ArrayBuiltinsAssembler::FindIndexResultGenerator,
+      &ArrayBuiltinsAssembler::FindIndexProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction);
 }
 
-TF_BUILTIN(ArrayForEachLoopContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayForEachLoopContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
-  Node* object = Parameter(Descriptor::kObject);
+  TNode<JSReceiver> object = CAST(Parameter(Descriptor::kObject));
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* to = Parameter(Descriptor::kTo);
 
   InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
@@ -1898,46 +2259,43 @@ TF_BUILTIN(ArrayForEachLoopContinuation, ArrayBuiltinCodeStubAssembler) {
                                             len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::ForEachProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction,
-      MissingPropertyMode::kSkip);
+      &ArrayBuiltinsAssembler::ForEachProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction, MissingPropertyMode::kSkip);
 }
 
-TF_BUILTIN(ArrayForEachLoopEagerDeoptContinuation,
-           ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayForEachLoopEagerDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
 
   Return(CallBuiltin(Builtins::kArrayForEachLoopContinuation, context, receiver,
                      callbackfn, this_arg, UndefinedConstant(), receiver,
                      initial_k, len, UndefinedConstant()));
 }
 
-TF_BUILTIN(ArrayForEachLoopLazyDeoptContinuation,
-           ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayForEachLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
 
   Return(CallBuiltin(Builtins::kArrayForEachLoopContinuation, context, receiver,
                      callbackfn, this_arg, UndefinedConstant(), receiver,
                      initial_k, len, UndefinedConstant()));
 }
 
-TF_BUILTIN(ArrayForEach, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(ArrayForEach, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
@@ -1946,20 +2304,20 @@ TF_BUILTIN(ArrayForEach, ArrayBuiltinCodeStubAssembler) {
 
   GenerateIteratingArrayBuiltinBody(
       "Array.prototype.forEach",
-      &ArrayBuiltinCodeStubAssembler::ForEachResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::ForEachProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction,
+      &ArrayBuiltinsAssembler::ForEachResultGenerator,
+      &ArrayBuiltinsAssembler::ForEachProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction,
       Builtins::CallableFor(isolate(), Builtins::kArrayForEachLoopContinuation),
       MissingPropertyMode::kSkip);
 }
 
-TF_BUILTIN(TypedArrayPrototypeForEach, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(TypedArrayPrototypeForEach, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
@@ -1968,18 +2326,18 @@ TF_BUILTIN(TypedArrayPrototypeForEach, ArrayBuiltinCodeStubAssembler) {
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.forEach",
-      &ArrayBuiltinCodeStubAssembler::ForEachResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::ForEachProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction);
+      &ArrayBuiltinsAssembler::ForEachResultGenerator,
+      &ArrayBuiltinsAssembler::ForEachProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction);
 }
 
-TF_BUILTIN(ArraySomeLoopLazyDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArraySomeLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* result = Parameter(Descriptor::kResult);
 
   // This custom lazy deopt point is right after the callback. every() needs
@@ -2002,28 +2360,28 @@ TF_BUILTIN(ArraySomeLoopLazyDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
   }
 }
 
-TF_BUILTIN(ArraySomeLoopEagerDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArraySomeLoopEagerDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
 
   Return(CallBuiltin(Builtins::kArraySomeLoopContinuation, context, receiver,
                      callbackfn, this_arg, FalseConstant(), receiver, initial_k,
                      len, UndefinedConstant()));
 }
 
-TF_BUILTIN(ArraySomeLoopContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArraySomeLoopContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
-  Node* object = Parameter(Descriptor::kObject);
+  TNode<JSReceiver> object = CAST(Parameter(Descriptor::kObject));
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* to = Parameter(Descriptor::kTo);
 
   InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
@@ -2031,18 +2389,17 @@ TF_BUILTIN(ArraySomeLoopContinuation, ArrayBuiltinCodeStubAssembler) {
                                             len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::SomeProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction,
-      MissingPropertyMode::kSkip);
+      &ArrayBuiltinsAssembler::SomeProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction, MissingPropertyMode::kSkip);
 }
 
-TF_BUILTIN(ArraySome, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(ArraySome, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
@@ -2050,21 +2407,20 @@ TF_BUILTIN(ArraySome, ArrayBuiltinCodeStubAssembler) {
                                 new_target, argc);
 
   GenerateIteratingArrayBuiltinBody(
-      "Array.prototype.some",
-      &ArrayBuiltinCodeStubAssembler::SomeResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::SomeProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction,
+      "Array.prototype.some", &ArrayBuiltinsAssembler::SomeResultGenerator,
+      &ArrayBuiltinsAssembler::SomeProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction,
       Builtins::CallableFor(isolate(), Builtins::kArraySomeLoopContinuation),
       MissingPropertyMode::kSkip);
 }
 
-TF_BUILTIN(TypedArrayPrototypeSome, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(TypedArrayPrototypeSome, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
@@ -2073,18 +2429,18 @@ TF_BUILTIN(TypedArrayPrototypeSome, ArrayBuiltinCodeStubAssembler) {
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.some",
-      &ArrayBuiltinCodeStubAssembler::SomeResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::SomeProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction);
+      &ArrayBuiltinsAssembler::SomeResultGenerator,
+      &ArrayBuiltinsAssembler::SomeProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction);
 }
 
-TF_BUILTIN(ArrayEveryLoopLazyDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayEveryLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* result = Parameter(Descriptor::kResult);
 
   // This custom lazy deopt point is right after the callback. every() needs
@@ -2107,29 +2463,28 @@ TF_BUILTIN(ArrayEveryLoopLazyDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
   { Return(FalseConstant()); }
 }
 
-TF_BUILTIN(ArrayEveryLoopEagerDeoptContinuation,
-           ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayEveryLoopEagerDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
 
   Return(CallBuiltin(Builtins::kArrayEveryLoopContinuation, context, receiver,
                      callbackfn, this_arg, TrueConstant(), receiver, initial_k,
                      len, UndefinedConstant()));
 }
 
-TF_BUILTIN(ArrayEveryLoopContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayEveryLoopContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
-  Node* object = Parameter(Descriptor::kObject);
+  TNode<JSReceiver> object = CAST(Parameter(Descriptor::kObject));
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* to = Parameter(Descriptor::kTo);
 
   InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
@@ -2137,18 +2492,17 @@ TF_BUILTIN(ArrayEveryLoopContinuation, ArrayBuiltinCodeStubAssembler) {
                                             len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::EveryProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction,
-      MissingPropertyMode::kSkip);
+      &ArrayBuiltinsAssembler::EveryProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction, MissingPropertyMode::kSkip);
 }
 
-TF_BUILTIN(ArrayEvery, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(ArrayEvery, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
@@ -2156,21 +2510,20 @@ TF_BUILTIN(ArrayEvery, ArrayBuiltinCodeStubAssembler) {
                                 new_target, argc);
 
   GenerateIteratingArrayBuiltinBody(
-      "Array.prototype.every",
-      &ArrayBuiltinCodeStubAssembler::EveryResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::EveryProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction,
+      "Array.prototype.every", &ArrayBuiltinsAssembler::EveryResultGenerator,
+      &ArrayBuiltinsAssembler::EveryProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction,
       Builtins::CallableFor(isolate(), Builtins::kArrayEveryLoopContinuation),
       MissingPropertyMode::kSkip);
 }
 
-TF_BUILTIN(TypedArrayPrototypeEvery, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(TypedArrayPrototypeEvery, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
@@ -2179,20 +2532,20 @@ TF_BUILTIN(TypedArrayPrototypeEvery, ArrayBuiltinCodeStubAssembler) {
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.every",
-      &ArrayBuiltinCodeStubAssembler::EveryResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::EveryProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction);
+      &ArrayBuiltinsAssembler::EveryResultGenerator,
+      &ArrayBuiltinsAssembler::EveryProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction);
 }
 
-TF_BUILTIN(ArrayReduceLoopContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayReduceLoopContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* accumulator = Parameter(Descriptor::kAccumulator);
-  Node* object = Parameter(Descriptor::kObject);
+  TNode<JSReceiver> object = CAST(Parameter(Descriptor::kObject));
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* to = Parameter(Descriptor::kTo);
 
   InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
@@ -2200,48 +2553,58 @@ TF_BUILTIN(ArrayReduceLoopContinuation, ArrayBuiltinCodeStubAssembler) {
                                             initial_k, len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::ReduceProcessor,
-      &ArrayBuiltinCodeStubAssembler::ReducePostLoopAction,
+      &ArrayBuiltinsAssembler::ReduceProcessor,
+      &ArrayBuiltinsAssembler::ReducePostLoopAction,
       MissingPropertyMode::kSkip);
 }
 
-TF_BUILTIN(ArrayReduceLoopEagerDeoptContinuation,
-           ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayReducePreLoopEagerDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
+  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
+
+  // Simulate starting the loop at 0, but ensuring that the accumulator is
+  // the hole. The continuation stub will search for the initial non-hole
+  // element, rightly throwing an exception if not found.
+  Return(CallBuiltin(Builtins::kArrayReduceLoopContinuation, context, receiver,
+                     callbackfn, UndefinedConstant(), TheHoleConstant(),
+                     receiver, SmiConstant(0), len, UndefinedConstant()));
+}
+
+TF_BUILTIN(ArrayReduceLoopEagerDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* accumulator = Parameter(Descriptor::kAccumulator);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
 
-  Callable stub(
-      Builtins::CallableFor(isolate(), Builtins::kArrayReduceLoopContinuation));
-  Return(CallStub(stub, context, receiver, callbackfn, UndefinedConstant(),
-                  accumulator, receiver, initial_k, len, UndefinedConstant()));
+  Return(CallBuiltin(Builtins::kArrayReduceLoopContinuation, context, receiver,
+                     callbackfn, UndefinedConstant(), accumulator, receiver,
+                     initial_k, len, UndefinedConstant()));
 }
 
-TF_BUILTIN(ArrayReduceLoopLazyDeoptContinuation,
-           ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayReduceLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* result = Parameter(Descriptor::kResult);
 
-  Callable stub(
-      Builtins::CallableFor(isolate(), Builtins::kArrayReduceLoopContinuation));
-  Return(CallStub(stub, context, receiver, callbackfn, UndefinedConstant(),
-                  result, receiver, initial_k, len, UndefinedConstant()));
+  Return(CallBuiltin(Builtins::kArrayReduceLoopContinuation, context, receiver,
+                     callbackfn, UndefinedConstant(), result, receiver,
+                     initial_k, len, UndefinedConstant()));
 }
 
-TF_BUILTIN(ArrayReduce, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(ArrayReduce, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* initial_value = args.GetOptionalArgumentValue(1, TheHoleConstant());
 
@@ -2249,21 +2612,20 @@ TF_BUILTIN(ArrayReduce, ArrayBuiltinCodeStubAssembler) {
                                 new_target, argc);
 
   GenerateIteratingArrayBuiltinBody(
-      "Array.prototype.reduce",
-      &ArrayBuiltinCodeStubAssembler::ReduceResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::ReduceProcessor,
-      &ArrayBuiltinCodeStubAssembler::ReducePostLoopAction,
+      "Array.prototype.reduce", &ArrayBuiltinsAssembler::ReduceResultGenerator,
+      &ArrayBuiltinsAssembler::ReduceProcessor,
+      &ArrayBuiltinsAssembler::ReducePostLoopAction,
       Builtins::CallableFor(isolate(), Builtins::kArrayReduceLoopContinuation),
       MissingPropertyMode::kSkip);
 }
 
-TF_BUILTIN(TypedArrayPrototypeReduce, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(TypedArrayPrototypeReduce, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* initial_value = args.GetOptionalArgumentValue(1, TheHoleConstant());
 
@@ -2272,20 +2634,20 @@ TF_BUILTIN(TypedArrayPrototypeReduce, ArrayBuiltinCodeStubAssembler) {
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.reduce",
-      &ArrayBuiltinCodeStubAssembler::ReduceResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::ReduceProcessor,
-      &ArrayBuiltinCodeStubAssembler::ReducePostLoopAction);
+      &ArrayBuiltinsAssembler::ReduceResultGenerator,
+      &ArrayBuiltinsAssembler::ReduceProcessor,
+      &ArrayBuiltinsAssembler::ReducePostLoopAction);
 }
 
-TF_BUILTIN(ArrayReduceRightLoopContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayReduceRightLoopContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* accumulator = Parameter(Descriptor::kAccumulator);
-  Node* object = Parameter(Descriptor::kObject);
+  TNode<JSReceiver> object = CAST(Parameter(Descriptor::kObject));
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* to = Parameter(Descriptor::kTo);
 
   InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
@@ -2293,48 +2655,60 @@ TF_BUILTIN(ArrayReduceRightLoopContinuation, ArrayBuiltinCodeStubAssembler) {
                                             initial_k, len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::ReduceProcessor,
-      &ArrayBuiltinCodeStubAssembler::ReducePostLoopAction,
-      MissingPropertyMode::kSkip, ForEachDirection::kReverse);
+      &ArrayBuiltinsAssembler::ReduceProcessor,
+      &ArrayBuiltinsAssembler::ReducePostLoopAction, MissingPropertyMode::kSkip,
+      ForEachDirection::kReverse);
 }
 
-TF_BUILTIN(ArrayReduceRightLoopEagerDeoptContinuation,
-           ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayReduceRightPreLoopEagerDeoptContinuation,
+           ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
-  Node* accumulator = Parameter(Descriptor::kAccumulator);
-  Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Smi> len = CAST(Parameter(Descriptor::kLength));
+
+  // Simulate starting the loop at 0, but ensuring that the accumulator is
+  // the hole. The continuation stub will search for the initial non-hole
+  // element, rightly throwing an exception if not found.
+  Return(CallBuiltin(Builtins::kArrayReduceRightLoopContinuation, context,
+                     receiver, callbackfn, UndefinedConstant(),
+                     TheHoleConstant(), receiver, SmiSub(len, SmiConstant(1)),
+                     len, UndefinedConstant()));
+}
+
+TF_BUILTIN(ArrayReduceRightLoopEagerDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
+  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
+  Node* accumulator = Parameter(Descriptor::kAccumulator);
+  Node* initial_k = Parameter(Descriptor::kInitialK);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
 
-  Callable stub(Builtins::CallableFor(
-      isolate(), Builtins::kArrayReduceRightLoopContinuation));
-  Return(CallStub(stub, context, receiver, callbackfn, UndefinedConstant(),
-                  accumulator, receiver, initial_k, len, UndefinedConstant()));
+  Return(CallBuiltin(Builtins::kArrayReduceRightLoopContinuation, context,
+                     receiver, callbackfn, UndefinedConstant(), accumulator,
+                     receiver, initial_k, len, UndefinedConstant()));
 }
 
-TF_BUILTIN(ArrayReduceRightLoopLazyDeoptContinuation,
-           ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayReduceRightLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* result = Parameter(Descriptor::kResult);
 
-  Callable stub(Builtins::CallableFor(
-      isolate(), Builtins::kArrayReduceRightLoopContinuation));
-  Return(CallStub(stub, context, receiver, callbackfn, UndefinedConstant(),
-                  result, receiver, initial_k, len, UndefinedConstant()));
+  Return(CallBuiltin(Builtins::kArrayReduceRightLoopContinuation, context,
+                     receiver, callbackfn, UndefinedConstant(), result,
+                     receiver, initial_k, len, UndefinedConstant()));
 }
 
-TF_BUILTIN(ArrayReduceRight, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(ArrayReduceRight, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* initial_value = args.GetOptionalArgumentValue(1, TheHoleConstant());
 
@@ -2343,21 +2717,21 @@ TF_BUILTIN(ArrayReduceRight, ArrayBuiltinCodeStubAssembler) {
 
   GenerateIteratingArrayBuiltinBody(
       "Array.prototype.reduceRight",
-      &ArrayBuiltinCodeStubAssembler::ReduceResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::ReduceProcessor,
-      &ArrayBuiltinCodeStubAssembler::ReducePostLoopAction,
+      &ArrayBuiltinsAssembler::ReduceResultGenerator,
+      &ArrayBuiltinsAssembler::ReduceProcessor,
+      &ArrayBuiltinsAssembler::ReducePostLoopAction,
       Builtins::CallableFor(isolate(),
                             Builtins::kArrayReduceRightLoopContinuation),
       MissingPropertyMode::kSkip, ForEachDirection::kReverse);
 }
 
-TF_BUILTIN(TypedArrayPrototypeReduceRight, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(TypedArrayPrototypeReduceRight, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* initial_value = args.GetOptionalArgumentValue(1, TheHoleConstant());
 
@@ -2366,21 +2740,21 @@ TF_BUILTIN(TypedArrayPrototypeReduceRight, ArrayBuiltinCodeStubAssembler) {
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.reduceRight",
-      &ArrayBuiltinCodeStubAssembler::ReduceResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::ReduceProcessor,
-      &ArrayBuiltinCodeStubAssembler::ReducePostLoopAction,
+      &ArrayBuiltinsAssembler::ReduceResultGenerator,
+      &ArrayBuiltinsAssembler::ReduceProcessor,
+      &ArrayBuiltinsAssembler::ReducePostLoopAction,
       ForEachDirection::kReverse);
 }
 
-TF_BUILTIN(ArrayFilterLoopContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayFilterLoopContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
-  Node* object = Parameter(Descriptor::kObject);
+  TNode<JSReceiver> object = CAST(Parameter(Descriptor::kObject));
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* to = Parameter(Descriptor::kTo);
 
   InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
@@ -2388,20 +2762,18 @@ TF_BUILTIN(ArrayFilterLoopContinuation, ArrayBuiltinCodeStubAssembler) {
                                             len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::FilterProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction,
-      MissingPropertyMode::kSkip);
+      &ArrayBuiltinsAssembler::FilterProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction, MissingPropertyMode::kSkip);
 }
 
-TF_BUILTIN(ArrayFilterLoopEagerDeoptContinuation,
-           ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayFilterLoopEagerDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* to = Parameter(Descriptor::kTo);
 
   Return(CallBuiltin(Builtins::kArrayFilterLoopContinuation, context, receiver,
@@ -2409,15 +2781,14 @@ TF_BUILTIN(ArrayFilterLoopEagerDeoptContinuation,
                      to));
 }
 
-TF_BUILTIN(ArrayFilterLoopLazyDeoptContinuation,
-           ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayFilterLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* value_k = Parameter(Descriptor::kValueK);
   Node* result = Parameter(Descriptor::kResult);
 
@@ -2451,13 +2822,13 @@ TF_BUILTIN(ArrayFilterLoopLazyDeoptContinuation,
                      to.value()));
 }
 
-TF_BUILTIN(ArrayFilter, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(ArrayFilter, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
@@ -2465,23 +2836,22 @@ TF_BUILTIN(ArrayFilter, ArrayBuiltinCodeStubAssembler) {
                                 new_target, argc);
 
   GenerateIteratingArrayBuiltinBody(
-      "Array.prototype.filter",
-      &ArrayBuiltinCodeStubAssembler::FilterResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::FilterProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction,
+      "Array.prototype.filter", &ArrayBuiltinsAssembler::FilterResultGenerator,
+      &ArrayBuiltinsAssembler::FilterProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction,
       Builtins::CallableFor(isolate(), Builtins::kArrayFilterLoopContinuation),
       MissingPropertyMode::kSkip);
 }
 
-TF_BUILTIN(ArrayMapLoopContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayMapLoopContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
-  Node* object = Parameter(Descriptor::kObject);
+  TNode<JSReceiver> object = CAST(Parameter(Descriptor::kObject));
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* to = Parameter(Descriptor::kTo);
 
   InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
@@ -2489,33 +2859,32 @@ TF_BUILTIN(ArrayMapLoopContinuation, ArrayBuiltinCodeStubAssembler) {
                                             len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::SpecCompliantMapProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction,
-      MissingPropertyMode::kSkip);
+      &ArrayBuiltinsAssembler::SpecCompliantMapProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction, MissingPropertyMode::kSkip);
 }
 
-TF_BUILTIN(ArrayMapLoopEagerDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayMapLoopEagerDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
 
   Return(CallBuiltin(Builtins::kArrayMapLoopContinuation, context, receiver,
                      callbackfn, this_arg, array, receiver, initial_k, len,
                      UndefinedConstant()));
 }
 
-TF_BUILTIN(ArrayMapLoopLazyDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+TF_BUILTIN(ArrayMapLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   Node* callbackfn = Parameter(Descriptor::kCallbackFn);
   Node* this_arg = Parameter(Descriptor::kThisArg);
   Node* array = Parameter(Descriptor::kArray);
   Node* initial_k = Parameter(Descriptor::kInitialK);
-  Node* len = Parameter(Descriptor::kLength);
+  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
   Node* result = Parameter(Descriptor::kResult);
 
   // This custom lazy deopt point is right after the callback. map() needs
@@ -2533,13 +2902,13 @@ TF_BUILTIN(ArrayMapLoopLazyDeoptContinuation, ArrayBuiltinCodeStubAssembler) {
                      UndefinedConstant()));
 }
 
-TF_BUILTIN(ArrayMap, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(ArrayMap, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
@@ -2547,20 +2916,20 @@ TF_BUILTIN(ArrayMap, ArrayBuiltinCodeStubAssembler) {
                                 new_target, argc);
 
   GenerateIteratingArrayBuiltinBody(
-      "Array.prototype.map", &ArrayBuiltinCodeStubAssembler::MapResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::FastMapProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction,
+      "Array.prototype.map", &ArrayBuiltinsAssembler::MapResultGenerator,
+      &ArrayBuiltinsAssembler::FastMapProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction,
       Builtins::CallableFor(isolate(), Builtins::kArrayMapLoopContinuation),
       MissingPropertyMode::kSkip);
 }
 
-TF_BUILTIN(TypedArrayPrototypeMap, ArrayBuiltinCodeStubAssembler) {
-  Node* argc =
+TF_BUILTIN(TypedArrayPrototypeMap, ArrayBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* receiver = args.GetReceiver();
+  TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
@@ -2569,9 +2938,9 @@ TF_BUILTIN(TypedArrayPrototypeMap, ArrayBuiltinCodeStubAssembler) {
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.map",
-      &ArrayBuiltinCodeStubAssembler::TypedArrayMapResultGenerator,
-      &ArrayBuiltinCodeStubAssembler::TypedArrayMapProcessor,
-      &ArrayBuiltinCodeStubAssembler::NullPostLoopAction);
+      &ArrayBuiltinsAssembler::TypedArrayMapResultGenerator,
+      &ArrayBuiltinsAssembler::TypedArrayMapProcessor,
+      &ArrayBuiltinsAssembler::NullPostLoopAction);
 }
 
 TF_BUILTIN(ArrayIsArray, CodeStubAssembler) {
@@ -2581,7 +2950,7 @@ TF_BUILTIN(ArrayIsArray, CodeStubAssembler) {
   Label call_runtime(this), return_true(this), return_false(this);
 
   GotoIf(TaggedIsSmi(object), &return_false);
-  TNode<Word32T> instance_type = LoadInstanceType(CAST(object));
+  TNode<Int32T> instance_type = LoadInstanceType(CAST(object));
 
   GotoIf(InstanceTypeEqual(instance_type, JS_ARRAY_TYPE), &return_true);
 
@@ -2607,6 +2976,15 @@ class ArrayIncludesIndexofAssembler : public CodeStubAssembler {
   enum SearchVariant { kIncludes, kIndexOf };
 
   void Generate(SearchVariant variant);
+  void GenerateSmiOrObject(SearchVariant variant, Node* context, Node* elements,
+                           Node* search_element, Node* array_length,
+                           Node* from_index);
+  void GeneratePackedDoubles(SearchVariant variant, Node* elements,
+                             Node* search_element, Node* array_length,
+                             Node* from_index);
+  void GenerateHoleyDoubles(SearchVariant variant, Node* elements,
+                            Node* search_element, Node* array_length,
+                            Node* from_index);
 };
 
 void ArrayIncludesIndexofAssembler::Generate(SearchVariant variant) {
@@ -2620,12 +2998,11 @@ void ArrayIncludesIndexofAssembler::Generate(SearchVariant variant) {
   TNode<Object> receiver = args.GetReceiver();
   TNode<Object> search_element =
       args.GetOptionalArgumentValue(kSearchElementArg);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
 
   Node* intptr_zero = IntPtrConstant(0);
 
-  Label init_index(this), return_found(this), return_not_found(this),
-      call_runtime(this);
+  Label init_index(this), return_not_found(this), call_runtime(this);
 
   // Take slow path if not a JSArray, if retrieving elements requires
   // traversing prototype, or if access checks are required.
@@ -2637,7 +3014,8 @@ void ArrayIncludesIndexofAssembler::Generate(SearchVariant variant) {
 
   // JSArray length is always a positive Smi for fast arrays.
   CSA_ASSERT(this, TaggedIsPositiveSmi(LoadJSArrayLength(array)));
-  Node* array_length = SmiUntag(LoadFastJSArrayLength(array));
+  Node* array_length = LoadFastJSArrayLength(array);
+  Node* array_length_untagged = SmiUntag(array_length);
 
   {
     // Initialize fromIndex.
@@ -2665,7 +3043,7 @@ void ArrayIncludesIndexofAssembler::Generate(SearchVariant variant) {
 
       GotoIf(IntPtrGreaterThanOrEqual(index_var.value(), intptr_zero), &done);
       // The fromIndex is negative: add it to the array's length.
-      index_var.Bind(IntPtrAdd(array_length, index_var.value()));
+      index_var.Bind(IntPtrAdd(array_length_untagged, index_var.value()));
       // Clamp negative results at zero.
       GotoIf(IntPtrGreaterThanOrEqual(index_var.value(), intptr_zero), &done);
       index_var.Bind(intptr_zero);
@@ -2675,7 +3053,7 @@ void ArrayIncludesIndexofAssembler::Generate(SearchVariant variant) {
   }
 
   // Fail early if startIndex >= array.length.
-  GotoIf(IntPtrGreaterThanOrEqual(index_var.value(), array_length),
+  GotoIf(IntPtrGreaterThanOrEqual(index_var.value(), array_length_untagged),
          &return_not_found);
 
   Label if_smiorobjects(this), if_packed_doubles(this), if_holey_doubles(this);
@@ -2696,179 +3074,139 @@ void ArrayIncludesIndexofAssembler::Generate(SearchVariant variant) {
 
   BIND(&if_smiorobjects);
   {
-    VARIABLE(search_num, MachineRepresentation::kFloat64);
-    Label ident_loop(this, &index_var), heap_num_loop(this, &search_num),
-        string_loop(this), bigint_loop(this, &index_var),
-        undef_loop(this, &index_var), not_smi(this), not_heap_num(this);
-
-    GotoIfNot(TaggedIsSmi(search_element), &not_smi);
-    search_num.Bind(SmiToFloat64(CAST(search_element)));
-    Goto(&heap_num_loop);
-
-    BIND(&not_smi);
-    if (variant == kIncludes) {
-      GotoIf(IsUndefined(search_element), &undef_loop);
-    }
-    Node* map = LoadMap(CAST(search_element));
-    GotoIfNot(IsHeapNumberMap(map), &not_heap_num);
-    search_num.Bind(LoadHeapNumberValue(CAST(search_element)));
-    Goto(&heap_num_loop);
-
-    BIND(&not_heap_num);
-    Node* search_type = LoadMapInstanceType(map);
-    GotoIf(IsStringInstanceType(search_type), &string_loop);
-    GotoIf(IsBigIntInstanceType(search_type), &bigint_loop);
-    Goto(&ident_loop);
-
-    BIND(&ident_loop);
-    {
-      GotoIfNot(UintPtrLessThan(index_var.value(), array_length),
-                &return_not_found);
-      Node* element_k = LoadFixedArrayElement(elements, index_var.value());
-      GotoIf(WordEqual(element_k, search_element), &return_found);
+    Callable callable =
+        (variant == kIncludes)
+            ? Builtins::CallableFor(isolate(),
+                                    Builtins::kArrayIncludesSmiOrObject)
+            : Builtins::CallableFor(isolate(),
+                                    Builtins::kArrayIndexOfSmiOrObject);
+    Node* result = CallStub(callable, context, elements, search_element,
+                            array_length, SmiTag(index_var.value()));
+    args.PopAndReturn(result);
+  }
 
-      Increment(&index_var);
-      Goto(&ident_loop);
-    }
+  BIND(&if_packed_doubles);
+  {
+    Callable callable =
+        (variant == kIncludes)
+            ? Builtins::CallableFor(isolate(),
+                                    Builtins::kArrayIncludesPackedDoubles)
+            : Builtins::CallableFor(isolate(),
+                                    Builtins::kArrayIndexOfPackedDoubles);
+    Node* result = CallStub(callable, context, elements, search_element,
+                            array_length, SmiTag(index_var.value()));
+    args.PopAndReturn(result);
+  }
 
-    if (variant == kIncludes) {
-      BIND(&undef_loop);
+  BIND(&if_holey_doubles);
+  {
+    Callable callable =
+        (variant == kIncludes)
+            ? Builtins::CallableFor(isolate(),
+                                    Builtins::kArrayIncludesHoleyDoubles)
+            : Builtins::CallableFor(isolate(),
+                                    Builtins::kArrayIndexOfHoleyDoubles);
+    Node* result = CallStub(callable, context, elements, search_element,
+                            array_length, SmiTag(index_var.value()));
+    args.PopAndReturn(result);
+  }
 
-      GotoIfNot(UintPtrLessThan(index_var.value(), array_length),
-                &return_not_found);
-      Node* element_k = LoadFixedArrayElement(elements, index_var.value());
-      GotoIf(IsUndefined(element_k), &return_found);
-      GotoIf(IsTheHole(element_k), &return_found);
+  BIND(&return_not_found);
+  if (variant == kIncludes) {
+    args.PopAndReturn(FalseConstant());
+  } else {
+    args.PopAndReturn(NumberConstant(-1));
+  }
 
-      Increment(&index_var);
-      Goto(&undef_loop);
-    }
+  BIND(&call_runtime);
+  {
+    Node* start_from =
+        args.GetOptionalArgumentValue(kFromIndexArg, UndefinedConstant());
+    Runtime::FunctionId function = variant == kIncludes
+                                       ? Runtime::kArrayIncludes_Slow
+                                       : Runtime::kArrayIndexOf;
+    args.PopAndReturn(
+        CallRuntime(function, context, array, search_element, start_from));
+  }
+}
 
-    BIND(&heap_num_loop);
-    {
-      Label nan_loop(this, &index_var), not_nan_loop(this, &index_var);
-      Label* nan_handling =
-          variant == kIncludes ? &nan_loop : &return_not_found;
-      BranchIfFloat64IsNaN(search_num.value(), nan_handling, &not_nan_loop);
+void ArrayIncludesIndexofAssembler::GenerateSmiOrObject(
+    SearchVariant variant, Node* context, Node* elements, Node* search_element,
+    Node* array_length, Node* from_index) {
+  VARIABLE(index_var, MachineType::PointerRepresentation(),
+           SmiUntag(from_index));
+  VARIABLE(search_num, MachineRepresentation::kFloat64);
+  Node* array_length_untagged = SmiUntag(array_length);
 
-      BIND(&not_nan_loop);
-      {
-        Label continue_loop(this), not_smi(this);
-        GotoIfNot(UintPtrLessThan(index_var.value(), array_length),
-                  &return_not_found);
-        Node* element_k = LoadFixedArrayElement(elements, index_var.value());
-        GotoIfNot(TaggedIsSmi(element_k), &not_smi);
-        Branch(Float64Equal(search_num.value(), SmiToFloat64(element_k)),
-               &return_found, &continue_loop);
-
-        BIND(&not_smi);
-        GotoIfNot(IsHeapNumber(element_k), &continue_loop);
-        Branch(Float64Equal(search_num.value(), LoadHeapNumberValue(element_k)),
-               &return_found, &continue_loop);
-
-        BIND(&continue_loop);
-        Increment(&index_var);
-        Goto(&not_nan_loop);
-      }
+  Label ident_loop(this, &index_var), heap_num_loop(this, &search_num),
+      string_loop(this), bigint_loop(this, &index_var),
+      undef_loop(this, &index_var), not_smi(this), not_heap_num(this),
+      return_found(this), return_not_found(this);
 
-      // Array.p.includes uses SameValueZero comparisons, where NaN == NaN.
-      if (variant == kIncludes) {
-        BIND(&nan_loop);
-        Label continue_loop(this);
-        GotoIfNot(UintPtrLessThan(index_var.value(), array_length),
-                  &return_not_found);
-        Node* element_k = LoadFixedArrayElement(elements, index_var.value());
-        GotoIf(TaggedIsSmi(element_k), &continue_loop);
-        GotoIfNot(IsHeapNumber(element_k), &continue_loop);
-        BranchIfFloat64IsNaN(LoadHeapNumberValue(element_k), &return_found,
-                             &continue_loop);
-
-        BIND(&continue_loop);
-        Increment(&index_var);
-        Goto(&nan_loop);
-      }
-    }
+  GotoIfNot(TaggedIsSmi(search_element), &not_smi);
+  search_num.Bind(SmiToFloat64(search_element));
+  Goto(&heap_num_loop);
 
-    BIND(&string_loop);
-    {
-      TNode<String> search_element_string = CAST(search_element);
-      Label continue_loop(this), next_iteration(this, &index_var),
-          slow_compare(this), runtime(this, Label::kDeferred);
-      TNode<IntPtrT> search_length =
-          LoadStringLengthAsWord(search_element_string);
-      Goto(&next_iteration);
-      BIND(&next_iteration);
-      GotoIfNot(UintPtrLessThan(index_var.value(), array_length),
-                &return_not_found);
-      Node* element_k = LoadFixedArrayElement(elements, index_var.value());
-      GotoIf(TaggedIsSmi(element_k), &continue_loop);
-      GotoIf(WordEqual(search_element_string, element_k), &return_found);
-      Node* element_k_type = LoadInstanceType(element_k);
-      GotoIfNot(IsStringInstanceType(element_k_type), &continue_loop);
-      Branch(WordEqual(search_length, LoadStringLengthAsWord(element_k)),
-             &slow_compare, &continue_loop);
-
-      BIND(&slow_compare);
-      StringBuiltinsAssembler string_asm(state());
-      string_asm.StringEqual_Core(context, search_element_string, search_type,
-                                  element_k, element_k_type, search_length,
-                                  &return_found, &continue_loop, &runtime);
-      BIND(&runtime);
-      TNode<Object> result = CallRuntime(Runtime::kStringEqual, context,
-                                         search_element_string, element_k);
-      Branch(WordEqual(result, TrueConstant()), &return_found, &continue_loop);
+  BIND(&not_smi);
+  if (variant == kIncludes) {
+    GotoIf(IsUndefined(search_element), &undef_loop);
+  }
+  Node* map = LoadMap(search_element);
+  GotoIfNot(IsHeapNumberMap(map), &not_heap_num);
+  search_num.Bind(LoadHeapNumberValue(search_element));
+  Goto(&heap_num_loop);
+
+  BIND(&not_heap_num);
+  Node* search_type = LoadMapInstanceType(map);
+  GotoIf(IsStringInstanceType(search_type), &string_loop);
+  GotoIf(IsBigIntInstanceType(search_type), &bigint_loop);
+  Goto(&ident_loop);
+
+  BIND(&ident_loop);
+  {
+    GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
+              &return_not_found);
+    Node* element_k = LoadFixedArrayElement(elements, index_var.value());
+    GotoIf(WordEqual(element_k, search_element), &return_found);
 
-      BIND(&continue_loop);
-      Increment(&index_var);
-      Goto(&next_iteration);
-    }
+    Increment(&index_var);
+    Goto(&ident_loop);
+  }
 
-    BIND(&bigint_loop);
-    {
-      GotoIfNot(UintPtrLessThan(index_var.value(), array_length),
-                &return_not_found);
+  if (variant == kIncludes) {
+    BIND(&undef_loop);
 
-      Node* element_k = LoadFixedArrayElement(elements, index_var.value());
-      Label continue_loop(this);
-      GotoIf(TaggedIsSmi(element_k), &continue_loop);
-      GotoIfNot(IsBigInt(element_k), &continue_loop);
-      TNode<Object> result = CallRuntime(Runtime::kBigIntEqualToBigInt, context,
-                                         search_element, element_k);
-      Branch(WordEqual(result, TrueConstant()), &return_found, &continue_loop);
+    GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
+              &return_not_found);
+    Node* element_k = LoadFixedArrayElement(elements, index_var.value());
+    GotoIf(IsUndefined(element_k), &return_found);
+    GotoIf(IsTheHole(element_k), &return_found);
 
-      BIND(&continue_loop);
-      Increment(&index_var);
-      Goto(&bigint_loop);
-    }
+    Increment(&index_var);
+    Goto(&undef_loop);
   }
 
-  BIND(&if_packed_doubles);
+  BIND(&heap_num_loop);
   {
-    Label nan_loop(this, &index_var), not_nan_loop(this, &index_var),
-        hole_loop(this, &index_var), search_notnan(this);
-    VARIABLE(search_num, MachineRepresentation::kFloat64);
-
-    GotoIfNot(TaggedIsSmi(search_element), &search_notnan);
-    search_num.Bind(SmiToFloat64(CAST(search_element)));
-    Goto(&not_nan_loop);
-
-    BIND(&search_notnan);
-    GotoIfNot(IsHeapNumber(search_element), &return_not_found);
-
-    search_num.Bind(LoadHeapNumberValue(CAST(search_element)));
-
+    Label nan_loop(this, &index_var), not_nan_loop(this, &index_var);
     Label* nan_handling = variant == kIncludes ? &nan_loop : &return_not_found;
     BranchIfFloat64IsNaN(search_num.value(), nan_handling, &not_nan_loop);
 
     BIND(&not_nan_loop);
     {
-      Label continue_loop(this);
-      GotoIfNot(UintPtrLessThan(index_var.value(), array_length),
+      Label continue_loop(this), not_smi(this);
+      GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
                 &return_not_found);
-      Node* element_k = LoadFixedDoubleArrayElement(elements, index_var.value(),
-                                                    MachineType::Float64());
-      Branch(Float64Equal(element_k, search_num.value()), &return_found,
-             &continue_loop);
+      Node* element_k = LoadFixedArrayElement(elements, index_var.value());
+      GotoIfNot(TaggedIsSmi(element_k), &not_smi);
+      Branch(Float64Equal(search_num.value(), SmiToFloat64(element_k)),
+             &return_found, &continue_loop);
+
+      BIND(&not_smi);
+      GotoIfNot(IsHeapNumber(element_k), &continue_loop);
+      Branch(Float64Equal(search_num.value(), LoadHeapNumberValue(element_k)),
+             &return_found, &continue_loop);
+
       BIND(&continue_loop);
       Increment(&index_var);
       Goto(&not_nan_loop);
@@ -2878,112 +3216,249 @@ void ArrayIncludesIndexofAssembler::Generate(SearchVariant variant) {
     if (variant == kIncludes) {
       BIND(&nan_loop);
       Label continue_loop(this);
-      GotoIfNot(UintPtrLessThan(index_var.value(), array_length),
+      GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
                 &return_not_found);
-      Node* element_k = LoadFixedDoubleArrayElement(elements, index_var.value(),
-                                                    MachineType::Float64());
-      BranchIfFloat64IsNaN(element_k, &return_found, &continue_loop);
+      Node* element_k = LoadFixedArrayElement(elements, index_var.value());
+      GotoIf(TaggedIsSmi(element_k), &continue_loop);
+      GotoIfNot(IsHeapNumber(element_k), &continue_loop);
+      BranchIfFloat64IsNaN(LoadHeapNumberValue(element_k), &return_found,
+                           &continue_loop);
+
       BIND(&continue_loop);
       Increment(&index_var);
       Goto(&nan_loop);
     }
   }
 
-  BIND(&if_holey_doubles);
+  BIND(&string_loop);
   {
-    Label nan_loop(this, &index_var), not_nan_loop(this, &index_var),
-        hole_loop(this, &index_var), search_notnan(this);
-    VARIABLE(search_num, MachineRepresentation::kFloat64);
+    TNode<String> search_element_string = CAST(search_element);
+    Label continue_loop(this), next_iteration(this, &index_var),
+        slow_compare(this), runtime(this, Label::kDeferred);
+    TNode<IntPtrT> search_length =
+        LoadStringLengthAsWord(search_element_string);
+    Goto(&next_iteration);
+    BIND(&next_iteration);
+    GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
+              &return_not_found);
+    Node* element_k = LoadFixedArrayElement(elements, index_var.value());
+    GotoIf(TaggedIsSmi(element_k), &continue_loop);
+    GotoIf(WordEqual(search_element_string, element_k), &return_found);
+    Node* element_k_type = LoadInstanceType(element_k);
+    GotoIfNot(IsStringInstanceType(element_k_type), &continue_loop);
+    Branch(WordEqual(search_length, LoadStringLengthAsWord(element_k)),
+           &slow_compare, &continue_loop);
+
+    BIND(&slow_compare);
+    StringBuiltinsAssembler string_asm(state());
+    string_asm.StringEqual_Core(context, search_element_string, search_type,
+                                element_k, element_k_type, search_length,
+                                &return_found, &continue_loop, &runtime);
+    BIND(&runtime);
+    TNode<Object> result = CallRuntime(Runtime::kStringEqual, context,
+                                       search_element_string, element_k);
+    Branch(WordEqual(result, TrueConstant()), &return_found, &continue_loop);
 
-    GotoIfNot(TaggedIsSmi(search_element), &search_notnan);
-    search_num.Bind(SmiToFloat64(CAST(search_element)));
-    Goto(&not_nan_loop);
+    BIND(&continue_loop);
+    Increment(&index_var);
+    Goto(&next_iteration);
+  }
 
-    BIND(&search_notnan);
-    if (variant == kIncludes) {
-      GotoIf(IsUndefined(search_element), &hole_loop);
-    }
-    GotoIfNot(IsHeapNumber(search_element), &return_not_found);
+  BIND(&bigint_loop);
+  {
+    GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
+              &return_not_found);
+
+    Node* element_k = LoadFixedArrayElement(elements, index_var.value());
+    Label continue_loop(this);
+    GotoIf(TaggedIsSmi(element_k), &continue_loop);
+    GotoIfNot(IsBigInt(element_k), &continue_loop);
+    TNode<Object> result = CallRuntime(Runtime::kBigIntEqualToBigInt, context,
+                                       search_element, element_k);
+    Branch(WordEqual(result, TrueConstant()), &return_found, &continue_loop);
+
+    BIND(&continue_loop);
+    Increment(&index_var);
+    Goto(&bigint_loop);
+  }
+  BIND(&return_found);
+  if (variant == kIncludes) {
+    Return(TrueConstant());
+  } else {
+    Return(SmiTag(index_var.value()));
+  }
 
-    search_num.Bind(LoadHeapNumberValue(CAST(search_element)));
+  BIND(&return_not_found);
+  if (variant == kIncludes) {
+    Return(FalseConstant());
+  } else {
+    Return(NumberConstant(-1));
+  }
+}
 
-    Label* nan_handling = variant == kIncludes ? &nan_loop : &return_not_found;
-    BranchIfFloat64IsNaN(search_num.value(), nan_handling, &not_nan_loop);
+void ArrayIncludesIndexofAssembler::GeneratePackedDoubles(SearchVariant variant,
+                                                          Node* elements,
+                                                          Node* search_element,
+                                                          Node* array_length,
+                                                          Node* from_index) {
+  VARIABLE(index_var, MachineType::PointerRepresentation(),
+           SmiUntag(from_index));
+  Node* array_length_untagged = SmiUntag(array_length);
 
-    BIND(&not_nan_loop);
-    {
-      Label continue_loop(this);
-      GotoIfNot(UintPtrLessThan(index_var.value(), array_length),
-                &return_not_found);
+  Label nan_loop(this, &index_var), not_nan_loop(this, &index_var),
+      hole_loop(this, &index_var), search_notnan(this), return_found(this),
+      return_not_found(this);
+  VARIABLE(search_num, MachineRepresentation::kFloat64);
+  search_num.Bind(Float64Constant(0));
 
-      // No need for hole checking here; the following Float64Equal will
-      // return 'not equal' for holes anyway.
-      Node* element_k = LoadFixedDoubleArrayElement(elements, index_var.value(),
-                                                    MachineType::Float64());
+  GotoIfNot(TaggedIsSmi(search_element), &search_notnan);
+  search_num.Bind(SmiToFloat64(search_element));
+  Goto(&not_nan_loop);
 
-      Branch(Float64Equal(element_k, search_num.value()), &return_found,
-             &continue_loop);
-      BIND(&continue_loop);
-      Increment(&index_var);
-      Goto(&not_nan_loop);
-    }
-
-    // Array.p.includes uses SameValueZero comparisons, where NaN == NaN.
-    if (variant == kIncludes) {
-      BIND(&nan_loop);
-      Label continue_loop(this);
-      GotoIfNot(UintPtrLessThan(index_var.value(), array_length),
-                &return_not_found);
-
-      // Load double value or continue if it's the hole NaN.
-      Node* element_k = LoadFixedDoubleArrayElement(
-          elements, index_var.value(), MachineType::Float64(), 0,
-          INTPTR_PARAMETERS, &continue_loop);
+  BIND(&search_notnan);
+  GotoIfNot(IsHeapNumber(search_element), &return_not_found);
 
-      BranchIfFloat64IsNaN(element_k, &return_found, &continue_loop);
-      BIND(&continue_loop);
-      Increment(&index_var);
-      Goto(&nan_loop);
-    }
+  search_num.Bind(LoadHeapNumberValue(search_element));
 
-    // Array.p.includes treats the hole as undefined.
-    if (variant == kIncludes) {
-      BIND(&hole_loop);
-      GotoIfNot(UintPtrLessThan(index_var.value(), array_length),
-                &return_not_found);
+  Label* nan_handling = variant == kIncludes ? &nan_loop : &return_not_found;
+  BranchIfFloat64IsNaN(search_num.value(), nan_handling, &not_nan_loop);
 
-      // Check if the element is a double hole, but don't load it.
-      LoadFixedDoubleArrayElement(elements, index_var.value(),
-                                  MachineType::None(), 0, INTPTR_PARAMETERS,
-                                  &return_found);
+  BIND(&not_nan_loop);
+  {
+    Label continue_loop(this);
+    GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
+              &return_not_found);
+    Node* element_k = LoadFixedDoubleArrayElement(elements, index_var.value(),
+                                                  MachineType::Float64());
+    Branch(Float64Equal(element_k, search_num.value()), &return_found,
+           &continue_loop);
+    BIND(&continue_loop);
+    Increment(&index_var);
+    Goto(&not_nan_loop);
+  }
 
-      Increment(&index_var);
-      Goto(&hole_loop);
-    }
+  // Array.p.includes uses SameValueZero comparisons, where NaN == NaN.
+  if (variant == kIncludes) {
+    BIND(&nan_loop);
+    Label continue_loop(this);
+    GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
+              &return_not_found);
+    Node* element_k = LoadFixedDoubleArrayElement(elements, index_var.value(),
+                                                  MachineType::Float64());
+    BranchIfFloat64IsNaN(element_k, &return_found, &continue_loop);
+    BIND(&continue_loop);
+    Increment(&index_var);
+    Goto(&nan_loop);
   }
 
   BIND(&return_found);
   if (variant == kIncludes) {
-    args.PopAndReturn(TrueConstant());
+    Return(TrueConstant());
   } else {
-    args.PopAndReturn(SmiTag(index_var.value()));
+    Return(SmiTag(index_var.value()));
   }
 
   BIND(&return_not_found);
   if (variant == kIncludes) {
-    args.PopAndReturn(FalseConstant());
+    Return(FalseConstant());
   } else {
-    args.PopAndReturn(NumberConstant(-1));
+    Return(NumberConstant(-1));
   }
+}
 
-  BIND(&call_runtime);
+void ArrayIncludesIndexofAssembler::GenerateHoleyDoubles(SearchVariant variant,
+                                                         Node* elements,
+                                                         Node* search_element,
+                                                         Node* array_length,
+                                                         Node* from_index) {
+  VARIABLE(index_var, MachineType::PointerRepresentation(),
+           SmiUntag(from_index));
+  Node* array_length_untagged = SmiUntag(array_length);
+
+  Label nan_loop(this, &index_var), not_nan_loop(this, &index_var),
+      hole_loop(this, &index_var), search_notnan(this), return_found(this),
+      return_not_found(this);
+  VARIABLE(search_num, MachineRepresentation::kFloat64);
+  search_num.Bind(Float64Constant(0));
+
+  GotoIfNot(TaggedIsSmi(search_element), &search_notnan);
+  search_num.Bind(SmiToFloat64(search_element));
+  Goto(&not_nan_loop);
+
+  BIND(&search_notnan);
+  if (variant == kIncludes) {
+    GotoIf(IsUndefined(search_element), &hole_loop);
+  }
+  GotoIfNot(IsHeapNumber(search_element), &return_not_found);
+
+  search_num.Bind(LoadHeapNumberValue(search_element));
+
+  Label* nan_handling = variant == kIncludes ? &nan_loop : &return_not_found;
+  BranchIfFloat64IsNaN(search_num.value(), nan_handling, &not_nan_loop);
+
+  BIND(&not_nan_loop);
   {
-    Node* start_from = args.GetOptionalArgumentValue(kFromIndexArg);
-    Runtime::FunctionId function = variant == kIncludes
-                                       ? Runtime::kArrayIncludes_Slow
-                                       : Runtime::kArrayIndexOf;
-    args.PopAndReturn(
-        CallRuntime(function, context, array, search_element, start_from));
+    Label continue_loop(this);
+    GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
+              &return_not_found);
+
+    // No need for hole checking here; the following Float64Equal will
+    // return 'not equal' for holes anyway.
+    Node* element_k = LoadFixedDoubleArrayElement(elements, index_var.value(),
+                                                  MachineType::Float64());
+
+    Branch(Float64Equal(element_k, search_num.value()), &return_found,
+           &continue_loop);
+    BIND(&continue_loop);
+    Increment(&index_var);
+    Goto(&not_nan_loop);
+  }
+
+  // Array.p.includes uses SameValueZero comparisons, where NaN == NaN.
+  if (variant == kIncludes) {
+    BIND(&nan_loop);
+    Label continue_loop(this);
+    GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
+              &return_not_found);
+
+    // Load double value or continue if it's the hole NaN.
+    Node* element_k = LoadFixedDoubleArrayElement(
+        elements, index_var.value(), MachineType::Float64(), 0,
+        INTPTR_PARAMETERS, &continue_loop);
+
+    BranchIfFloat64IsNaN(element_k, &return_found, &continue_loop);
+    BIND(&continue_loop);
+    Increment(&index_var);
+    Goto(&nan_loop);
+  }
+
+  // Array.p.includes treats the hole as undefined.
+  if (variant == kIncludes) {
+    BIND(&hole_loop);
+    GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
+              &return_not_found);
+
+    // Check if the element is a double hole, but don't load it.
+    LoadFixedDoubleArrayElement(elements, index_var.value(),
+                                MachineType::None(), 0, INTPTR_PARAMETERS,
+                                &return_found);
+
+    Increment(&index_var);
+    Goto(&hole_loop);
+  }
+
+  BIND(&return_found);
+  if (variant == kIncludes) {
+    Return(TrueConstant());
+  } else {
+    Return(SmiTag(index_var.value()));
+  }
+
+  BIND(&return_not_found);
+  if (variant == kIncludes) {
+    Return(FalseConstant());
+  } else {
+    Return(NumberConstant(-1));
   }
 }
 
@@ -2991,71 +3466,99 @@ TF_BUILTIN(ArrayIncludes, ArrayIncludesIndexofAssembler) {
   Generate(kIncludes);
 }
 
-TF_BUILTIN(ArrayIndexOf, ArrayIncludesIndexofAssembler) { Generate(kIndexOf); }
+TF_BUILTIN(ArrayIncludesSmiOrObject, ArrayIncludesIndexofAssembler) {
+  Node* context = Parameter(Descriptor::kContext);
+  Node* elements = Parameter(Descriptor::kElements);
+  Node* search_element = Parameter(Descriptor::kSearchElement);
+  Node* array_length = Parameter(Descriptor::kLength);
+  Node* from_index = Parameter(Descriptor::kFromIndex);
 
-class ArrayPrototypeIterationAssembler : public CodeStubAssembler {
- public:
-  explicit ArrayPrototypeIterationAssembler(compiler::CodeAssemblerState* state)
-      : CodeStubAssembler(state) {}
+  GenerateSmiOrObject(kIncludes, context, elements, search_element,
+                      array_length, from_index);
+}
 
- protected:
-  void Generate_ArrayPrototypeIterationMethod(Node* context, Node* receiver,
-                                              IterationKind iteration_kind) {
-    VARIABLE(var_array, MachineRepresentation::kTagged);
-    VARIABLE(var_map, MachineRepresentation::kTagged);
-    VARIABLE(var_type, MachineRepresentation::kWord32);
+TF_BUILTIN(ArrayIncludesPackedDoubles, ArrayIncludesIndexofAssembler) {
+  Node* elements = Parameter(Descriptor::kElements);
+  Node* search_element = Parameter(Descriptor::kSearchElement);
+  Node* array_length = Parameter(Descriptor::kLength);
+  Node* from_index = Parameter(Descriptor::kFromIndex);
 
-    Label if_isnotobject(this, Label::kDeferred);
-    Label create_array_iterator(this);
+  GeneratePackedDoubles(kIncludes, elements, search_element, array_length,
+                        from_index);
+}
 
-    GotoIf(TaggedIsSmi(receiver), &if_isnotobject);
-    var_array.Bind(receiver);
-    var_map.Bind(LoadMap(receiver));
-    var_type.Bind(LoadMapInstanceType(var_map.value()));
-    Branch(IsJSReceiverInstanceType(var_type.value()), &create_array_iterator,
-           &if_isnotobject);
+TF_BUILTIN(ArrayIncludesHoleyDoubles, ArrayIncludesIndexofAssembler) {
+  Node* elements = Parameter(Descriptor::kElements);
+  Node* search_element = Parameter(Descriptor::kSearchElement);
+  Node* array_length = Parameter(Descriptor::kLength);
+  Node* from_index = Parameter(Descriptor::kFromIndex);
 
-    BIND(&if_isnotobject);
-    {
-      Node* result = CallBuiltin(Builtins::kToObject, context, receiver);
-      var_array.Bind(result);
-      var_map.Bind(LoadMap(result));
-      var_type.Bind(LoadMapInstanceType(var_map.value()));
-      Goto(&create_array_iterator);
-    }
+  GenerateHoleyDoubles(kIncludes, elements, search_element, array_length,
+                       from_index);
+}
 
-    BIND(&create_array_iterator);
-    Return(CreateArrayIterator(var_array.value(), var_map.value(),
-                               var_type.value(), context, iteration_kind));
-  }
-};
+TF_BUILTIN(ArrayIndexOf, ArrayIncludesIndexofAssembler) { Generate(kIndexOf); }
 
-TF_BUILTIN(ArrayPrototypeValues, ArrayPrototypeIterationAssembler) {
+TF_BUILTIN(ArrayIndexOfSmiOrObject, ArrayIncludesIndexofAssembler) {
   Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Generate_ArrayPrototypeIterationMethod(context, receiver,
-                                         IterationKind::kValues);
+  Node* elements = Parameter(Descriptor::kElements);
+  Node* search_element = Parameter(Descriptor::kSearchElement);
+  Node* array_length = Parameter(Descriptor::kLength);
+  Node* from_index = Parameter(Descriptor::kFromIndex);
+
+  GenerateSmiOrObject(kIndexOf, context, elements, search_element, array_length,
+                      from_index);
 }
 
-TF_BUILTIN(ArrayPrototypeEntries, ArrayPrototypeIterationAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Generate_ArrayPrototypeIterationMethod(context, receiver,
-                                         IterationKind::kEntries);
+TF_BUILTIN(ArrayIndexOfPackedDoubles, ArrayIncludesIndexofAssembler) {
+  Node* elements = Parameter(Descriptor::kElements);
+  Node* search_element = Parameter(Descriptor::kSearchElement);
+  Node* array_length = Parameter(Descriptor::kLength);
+  Node* from_index = Parameter(Descriptor::kFromIndex);
+
+  GeneratePackedDoubles(kIndexOf, elements, search_element, array_length,
+                        from_index);
 }
 
-TF_BUILTIN(ArrayPrototypeKeys, ArrayPrototypeIterationAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Generate_ArrayPrototypeIterationMethod(context, receiver,
-                                         IterationKind::kKeys);
+TF_BUILTIN(ArrayIndexOfHoleyDoubles, ArrayIncludesIndexofAssembler) {
+  Node* elements = Parameter(Descriptor::kElements);
+  Node* search_element = Parameter(Descriptor::kSearchElement);
+  Node* array_length = Parameter(Descriptor::kLength);
+  Node* from_index = Parameter(Descriptor::kFromIndex);
+
+  GenerateHoleyDoubles(kIndexOf, elements, search_element, array_length,
+                       from_index);
+}
+
+// ES #sec-array.prototype.values
+TF_BUILTIN(ArrayPrototypeValues, CodeStubAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
+  Return(CreateArrayIterator(context, ToObject(context, receiver),
+                             IterationKind::kValues));
+}
+
+// ES #sec-array.prototype.entries
+TF_BUILTIN(ArrayPrototypeEntries, CodeStubAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
+  Return(CreateArrayIterator(context, ToObject(context, receiver),
+                             IterationKind::kEntries));
+}
+
+// ES #sec-array.prototype.keys
+TF_BUILTIN(ArrayPrototypeKeys, CodeStubAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
+  Return(CreateArrayIterator(context, ToObject(context, receiver),
+                             IterationKind::kKeys));
 }
 
+// ES #sec-%arrayiteratorprototype%.next
 TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
-  Handle<String> operation = factory()->NewStringFromAsciiChecked(
-      "Array Iterator.prototype.next", TENURED);
+  const char* method_name = "Array Iterator.prototype.next";
 
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   Node* iterator = Parameter(Descriptor::kReceiver);
 
   VARIABLE(var_value, MachineRepresentation::kTagged);
@@ -3068,16 +3571,13 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
 
   Label throw_bad_receiver(this, Label::kDeferred);
   Label set_done(this);
-  Label allocate_key_result(this);
   Label allocate_entry_if_needed(this);
   Label allocate_iterator_result(this);
-  Label generic_values(this);
 
   // If O does not have all of the internal slots of an Array Iterator Instance
   // (22.1.5.3), throw a TypeError exception
   GotoIf(TaggedIsSmi(iterator), &throw_bad_receiver);
-  TNode<Int32T> instance_type = LoadInstanceType(iterator);
-  GotoIf(IsArrayIteratorInstanceType(instance_type), &throw_bad_receiver);
+  GotoIfNot(IsJSArrayIterator(iterator), &throw_bad_receiver);
 
   // Let a be O.[[IteratedObject]].
   Node* array =
@@ -3085,19 +3585,23 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
 
   // Let index be O.[[ArrayIteratorNextIndex]].
   Node* index = LoadObjectField(iterator, JSArrayIterator::kNextIndexOffset);
-  Node* orig_map =
-      LoadObjectField(iterator, JSArrayIterator::kIteratedObjectMapOffset);
   Node* array_map = LoadMap(array);
 
-  Label if_isfastarray(this), if_isnotfastarray(this),
-      if_isdetached(this, Label::kDeferred);
+  Label if_detached(this, Label::kDeferred);
+
+  Label if_typedarray(this), if_other(this, Label::kDeferred), if_array(this),
+      if_generic(this, Label::kDeferred);
 
-  Branch(WordEqual(orig_map, array_map), &if_isfastarray, &if_isnotfastarray);
+  Node* array_type = LoadInstanceType(array);
+  GotoIf(InstanceTypeEqual(array_type, JS_ARRAY_TYPE), &if_array);
+  Branch(InstanceTypeEqual(array_type, JS_TYPED_ARRAY_TYPE), &if_typedarray,
+         &if_other);
 
-  BIND(&if_isfastarray);
+  BIND(&if_array);
   {
-    CSA_ASSERT(
-        this, InstanceTypeEqual(LoadMapInstanceType(array_map), JS_ARRAY_TYPE));
+    // We can only handle fast elements here.
+    Node* elements_kind = LoadMapElementsKind(array_map);
+    GotoIfNot(IsFastElementsKind(elements_kind), &if_other);
 
     Node* length = LoadJSArrayLength(array);
 
@@ -3106,286 +3610,178 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
 
     GotoIfNot(SmiBelow(index, length), &set_done);
 
+    var_value.Bind(index);
     Node* one = SmiConstant(1);
     StoreObjectFieldNoWriteBarrier(iterator, JSArrayIterator::kNextIndexOffset,
                                    SmiAdd(index, one));
-
     var_done.Bind(FalseConstant());
-    Node* elements = LoadElements(array);
-
-    static int32_t kInstanceType[] = {
-        JS_FAST_ARRAY_KEY_ITERATOR_TYPE,
-        JS_FAST_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-        JS_FAST_HOLEY_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-        JS_FAST_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-        JS_FAST_HOLEY_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-        JS_FAST_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-        JS_FAST_HOLEY_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-        JS_FAST_SMI_ARRAY_VALUE_ITERATOR_TYPE,
-        JS_FAST_HOLEY_SMI_ARRAY_VALUE_ITERATOR_TYPE,
-        JS_FAST_ARRAY_VALUE_ITERATOR_TYPE,
-        JS_FAST_HOLEY_ARRAY_VALUE_ITERATOR_TYPE,
-        JS_FAST_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE,
-        JS_FAST_HOLEY_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE,
-    };
-
-    Label packed_object_values(this), holey_object_values(this),
-        packed_double_values(this), holey_double_values(this);
-    Label* kInstanceTypeHandlers[] = {
-        &allocate_key_result,  &packed_object_values, &holey_object_values,
-        &packed_object_values, &holey_object_values,  &packed_double_values,
-        &holey_double_values,  &packed_object_values, &holey_object_values,
-        &packed_object_values, &holey_object_values,  &packed_double_values,
-        &holey_double_values};
 
-    Switch(instance_type, &throw_bad_receiver, kInstanceType,
-           kInstanceTypeHandlers, arraysize(kInstanceType));
+    GotoIf(Word32Equal(LoadAndUntagToWord32ObjectField(
+                           iterator, JSArrayIterator::kKindOffset),
+                       Int32Constant(static_cast<int>(IterationKind::kKeys))),
+           &allocate_iterator_result);
 
-    BIND(&packed_object_values);
+    Node* elements = LoadElements(array);
+    Label if_packed(this), if_holey(this), if_packed_double(this),
+        if_holey_double(this), if_unknown_kind(this, Label::kDeferred);
+    int32_t kinds[] = {// Handled by if_packed.
+                       PACKED_SMI_ELEMENTS, PACKED_ELEMENTS,
+                       // Handled by if_holey.
+                       HOLEY_SMI_ELEMENTS, HOLEY_ELEMENTS,
+                       // Handled by if_packed_double.
+                       PACKED_DOUBLE_ELEMENTS,
+                       // Handled by if_holey_double.
+                       HOLEY_DOUBLE_ELEMENTS};
+    Label* labels[] = {// PACKED_{SMI,}_ELEMENTS
+                       &if_packed, &if_packed,
+                       // HOLEY_{SMI,}_ELEMENTS
+                       &if_holey, &if_holey,
+                       // PACKED_DOUBLE_ELEMENTS
+                       &if_packed_double,
+                       // HOLEY_DOUBLE_ELEMENTS
+                       &if_holey_double};
+    Switch(elements_kind, &if_unknown_kind, kinds, labels, arraysize(kinds));
+
+    BIND(&if_packed);
     {
       var_value.Bind(LoadFixedArrayElement(elements, index, 0, SMI_PARAMETERS));
       Goto(&allocate_entry_if_needed);
     }
 
-    BIND(&packed_double_values);
+    BIND(&if_holey);
     {
-      Node* value = LoadFixedDoubleArrayElement(
-          elements, index, MachineType::Float64(), 0, SMI_PARAMETERS);
-      var_value.Bind(AllocateHeapNumberWithValue(value));
+      Node* element = LoadFixedArrayElement(elements, index, 0, SMI_PARAMETERS);
+      var_value.Bind(element);
+      GotoIfNot(WordEqual(element, TheHoleConstant()),
+                &allocate_entry_if_needed);
+      GotoIf(IsNoElementsProtectorCellInvalid(), &if_generic);
+      var_value.Bind(UndefinedConstant());
       Goto(&allocate_entry_if_needed);
     }
 
-    BIND(&holey_object_values);
+    BIND(&if_packed_double);
     {
-      // Check the no_elements_protector cell, and take the slow path if it's
-      // invalid.
-      GotoIf(IsNoElementsProtectorCellInvalid(), &generic_values);
-
-      var_value.Bind(UndefinedConstant());
-      Node* value = LoadFixedArrayElement(elements, index, 0, SMI_PARAMETERS);
-      GotoIf(WordEqual(value, TheHoleConstant()), &allocate_entry_if_needed);
-      var_value.Bind(value);
+      Node* value = LoadFixedDoubleArrayElement(
+          elements, index, MachineType::Float64(), 0, SMI_PARAMETERS);
+      var_value.Bind(AllocateHeapNumberWithValue(value));
       Goto(&allocate_entry_if_needed);
     }
 
-    BIND(&holey_double_values);
+    BIND(&if_holey_double);
     {
-      // Check the no_elements_protector cell, and take the slow path if it's
-      // invalid.
-      GotoIf(IsNoElementsProtectorCellInvalid(), &generic_values);
-
-      var_value.Bind(UndefinedConstant());
+      Label if_hole(this, Label::kDeferred);
       Node* value = LoadFixedDoubleArrayElement(
-          elements, index, MachineType::Float64(), 0, SMI_PARAMETERS,
-          &allocate_entry_if_needed);
+          elements, index, MachineType::Float64(), 0, SMI_PARAMETERS, &if_hole);
       var_value.Bind(AllocateHeapNumberWithValue(value));
       Goto(&allocate_entry_if_needed);
+      BIND(&if_hole);
+      GotoIf(IsNoElementsProtectorCellInvalid(), &if_generic);
+      var_value.Bind(UndefinedConstant());
+      Goto(&allocate_entry_if_needed);
     }
+
+    BIND(&if_unknown_kind);
+    Unreachable();
   }
 
-  BIND(&if_isnotfastarray);
+  BIND(&if_other);
   {
-    Label if_istypedarray(this), if_isgeneric(this);
-
     // If a is undefined, return CreateIterResultObject(undefined, true)
     GotoIf(IsUndefined(array), &allocate_iterator_result);
 
-    Node* array_type = LoadInstanceType(array);
-    Branch(InstanceTypeEqual(array_type, JS_TYPED_ARRAY_TYPE), &if_istypedarray,
-           &if_isgeneric);
-
-    BIND(&if_isgeneric);
-    {
-      Label if_wasfastarray(this);
+    Node* length =
+        CallBuiltin(Builtins::kToLength, context,
+                    GetProperty(context, array, factory()->length_string()));
 
-      Node* length = nullptr;
-      {
-        VARIABLE(var_length, MachineRepresentation::kTagged);
-        Label if_isarray(this), if_isnotarray(this), done(this);
-        Branch(InstanceTypeEqual(array_type, JS_ARRAY_TYPE), &if_isarray,
-               &if_isnotarray);
+    GotoIfNumberGreaterThanOrEqual(index, length, &set_done);
 
-        BIND(&if_isarray);
-        {
-          var_length.Bind(LoadJSArrayLength(array));
+    var_value.Bind(index);
+    StoreObjectField(iterator, JSArrayIterator::kNextIndexOffset,
+                     NumberInc(index));
+    var_done.Bind(FalseConstant());
 
-          // Invalidate protector cell if needed
-          Branch(WordNotEqual(orig_map, UndefinedConstant()), &if_wasfastarray,
-                 &done);
+    GotoIf(Word32Equal(LoadAndUntagToWord32ObjectField(
+                           iterator, JSArrayIterator::kKindOffset),
+                       Int32Constant(static_cast<int>(IterationKind::kKeys))),
+           &allocate_iterator_result);
+    Goto(&if_generic);
+  }
 
-          BIND(&if_wasfastarray);
-          {
-            Label if_invalid(this, Label::kDeferred);
-            // A fast array iterator transitioned to a slow iterator during
-            // iteration. Invalidate fast_array_iteration_protector cell to
-            // prevent potential deopt loops.
-            StoreObjectFieldNoWriteBarrier(
-                iterator, JSArrayIterator::kIteratedObjectMapOffset,
-                UndefinedConstant());
-            GotoIf(Uint32LessThanOrEqual(
-                       instance_type,
-                       Int32Constant(JS_GENERIC_ARRAY_KEY_ITERATOR_TYPE)),
-                   &done);
-
-            Node* invalid = SmiConstant(Isolate::kProtectorInvalid);
-            Node* cell = LoadRoot(Heap::kFastArrayIterationProtectorRootIndex);
-            StoreObjectFieldNoWriteBarrier(cell, Cell::kValueOffset, invalid);
-            Goto(&done);
-          }
-        }
+  BIND(&if_generic);
+  {
+    var_value.Bind(GetProperty(context, array, index));
+    Goto(&allocate_entry_if_needed);
+  }
 
-        BIND(&if_isnotarray);
-        {
-          Node* length =
-              GetProperty(context, array, factory()->length_string());
-          var_length.Bind(ToLength_Inline(context, length));
-          Goto(&done);
-        }
+  BIND(&if_typedarray);
+  {
+    Node* buffer = LoadObjectField(array, JSTypedArray::kBufferOffset);
+    GotoIf(IsDetachedBuffer(buffer), &if_detached);
 
-        BIND(&done);
-        length = var_length.value();
-      }
+    Node* length = LoadObjectField(array, JSTypedArray::kLengthOffset);
 
-      GotoIfNumberGreaterThanOrEqual(index, length, &set_done);
+    CSA_ASSERT(this, TaggedIsSmi(length));
+    CSA_ASSERT(this, TaggedIsSmi(index));
 
-      StoreObjectField(iterator, JSArrayIterator::kNextIndexOffset,
-                       NumberInc(index));
-      var_done.Bind(FalseConstant());
+    GotoIfNot(SmiBelow(index, length), &set_done);
 
-      Branch(
-          Uint32LessThanOrEqual(
-              instance_type, Int32Constant(JS_GENERIC_ARRAY_KEY_ITERATOR_TYPE)),
-          &allocate_key_result, &generic_values);
+    var_value.Bind(index);
+    Node* one = SmiConstant(1);
+    StoreObjectFieldNoWriteBarrier(iterator, JSArrayIterator::kNextIndexOffset,
+                                   SmiAdd(index, one));
+    var_done.Bind(FalseConstant());
 
-      BIND(&generic_values);
-      {
-        var_value.Bind(GetProperty(context, array, index));
-        Goto(&allocate_entry_if_needed);
-      }
-    }
+    GotoIf(Word32Equal(LoadAndUntagToWord32ObjectField(
+                           iterator, JSArrayIterator::kKindOffset),
+                       Int32Constant(static_cast<int>(IterationKind::kKeys))),
+           &allocate_iterator_result);
 
-    BIND(&if_istypedarray);
-    {
-      Node* buffer = LoadObjectField(array, JSTypedArray::kBufferOffset);
-      GotoIf(IsDetachedBuffer(buffer), &if_isdetached);
+    Node* elements_kind = LoadMapElementsKind(array_map);
+    Node* elements = LoadElements(array);
+    Node* base_ptr =
+        LoadObjectField(elements, FixedTypedArrayBase::kBasePointerOffset);
+    Node* external_ptr =
+        LoadObjectField(elements, FixedTypedArrayBase::kExternalPointerOffset,
+                        MachineType::Pointer());
+    Node* data_ptr = IntPtrAdd(BitcastTaggedToWord(base_ptr), external_ptr);
+
+    Label if_unknown_type(this, Label::kDeferred);
+    int32_t elements_kinds[] = {
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) TYPE##_ELEMENTS,
+        TYPED_ARRAYS(TYPED_ARRAY_CASE)
+#undef TYPED_ARRAY_CASE
+    };
 
-      Node* length = LoadObjectField(array, JSTypedArray::kLengthOffset);
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
+  Label if_##type##array(this);
+    TYPED_ARRAYS(TYPED_ARRAY_CASE)
+#undef TYPED_ARRAY_CASE
 
-      CSA_ASSERT(this, TaggedIsSmi(length));
-      CSA_ASSERT(this, TaggedIsSmi(index));
+    Label* elements_kind_labels[] = {
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) &if_##type##array,
+        TYPED_ARRAYS(TYPED_ARRAY_CASE)
+#undef TYPED_ARRAY_CASE
+    };
+    STATIC_ASSERT(arraysize(elements_kinds) == arraysize(elements_kind_labels));
 
-      GotoIfNot(SmiBelow(index, length), &set_done);
+    Switch(elements_kind, &if_unknown_type, elements_kinds,
+           elements_kind_labels, arraysize(elements_kinds));
 
-      Node* one = SmiConstant(1);
-      StoreObjectFieldNoWriteBarrier(
-          iterator, JSArrayIterator::kNextIndexOffset, SmiAdd(index, one));
-      var_done.Bind(FalseConstant());
+    BIND(&if_unknown_type);
+    Unreachable();
 
-      Node* elements = LoadElements(array);
-      Node* base_ptr =
-          LoadObjectField(elements, FixedTypedArrayBase::kBasePointerOffset);
-      Node* external_ptr =
-          LoadObjectField(elements, FixedTypedArrayBase::kExternalPointerOffset,
-                          MachineType::Pointer());
-      Node* data_ptr = IntPtrAdd(BitcastTaggedToWord(base_ptr), external_ptr);
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)     \
+  BIND(&if_##type##array);                                  \
+  {                                                         \
+    var_value.Bind(LoadFixedTypedArrayElementAsTagged(      \
+        data_ptr, index, TYPE##_ELEMENTS, SMI_PARAMETERS)); \
+    Goto(&allocate_entry_if_needed);                        \
+  }
+    TYPED_ARRAYS(TYPED_ARRAY_CASE)
+#undef TYPED_ARRAY_CASE
 
-      static int32_t kInstanceType[] = {
-          JS_TYPED_ARRAY_KEY_ITERATOR_TYPE,
-          JS_UINT8_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-          JS_UINT8_CLAMPED_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-          JS_INT8_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-          JS_UINT16_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-          JS_INT16_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-          JS_UINT32_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-          JS_INT32_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-          JS_FLOAT32_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-          JS_FLOAT64_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-          JS_UINT8_ARRAY_VALUE_ITERATOR_TYPE,
-          JS_UINT8_CLAMPED_ARRAY_VALUE_ITERATOR_TYPE,
-          JS_INT8_ARRAY_VALUE_ITERATOR_TYPE,
-          JS_UINT16_ARRAY_VALUE_ITERATOR_TYPE,
-          JS_INT16_ARRAY_VALUE_ITERATOR_TYPE,
-          JS_UINT32_ARRAY_VALUE_ITERATOR_TYPE,
-          JS_INT32_ARRAY_VALUE_ITERATOR_TYPE,
-          JS_FLOAT32_ARRAY_VALUE_ITERATOR_TYPE,
-          JS_FLOAT64_ARRAY_VALUE_ITERATOR_TYPE,
-      };
-
-      Label uint8_values(this), int8_values(this), uint16_values(this),
-          int16_values(this), uint32_values(this), int32_values(this),
-          float32_values(this), float64_values(this);
-      Label* kInstanceTypeHandlers[] = {
-          &allocate_key_result, &uint8_values,  &uint8_values,
-          &int8_values,         &uint16_values, &int16_values,
-          &uint32_values,       &int32_values,  &float32_values,
-          &float64_values,      &uint8_values,  &uint8_values,
-          &int8_values,         &uint16_values, &int16_values,
-          &uint32_values,       &int32_values,  &float32_values,
-          &float64_values,
-      };
-
-      var_done.Bind(FalseConstant());
-      Switch(instance_type, &throw_bad_receiver, kInstanceType,
-             kInstanceTypeHandlers, arraysize(kInstanceType));
-
-      BIND(&uint8_values);
-      {
-        Node* value_uint8 = LoadFixedTypedArrayElement(
-            data_ptr, index, UINT8_ELEMENTS, SMI_PARAMETERS);
-        var_value.Bind(SmiFromWord32(value_uint8));
-        Goto(&allocate_entry_if_needed);
-      }
-      BIND(&int8_values);
-      {
-        Node* value_int8 = LoadFixedTypedArrayElement(
-            data_ptr, index, INT8_ELEMENTS, SMI_PARAMETERS);
-        var_value.Bind(SmiFromWord32(value_int8));
-        Goto(&allocate_entry_if_needed);
-      }
-      BIND(&uint16_values);
-      {
-        Node* value_uint16 = LoadFixedTypedArrayElement(
-            data_ptr, index, UINT16_ELEMENTS, SMI_PARAMETERS);
-        var_value.Bind(SmiFromWord32(value_uint16));
-        Goto(&allocate_entry_if_needed);
-      }
-      BIND(&int16_values);
-      {
-        Node* value_int16 = LoadFixedTypedArrayElement(
-            data_ptr, index, INT16_ELEMENTS, SMI_PARAMETERS);
-        var_value.Bind(SmiFromWord32(value_int16));
-        Goto(&allocate_entry_if_needed);
-      }
-      BIND(&uint32_values);
-      {
-        Node* value_uint32 = LoadFixedTypedArrayElement(
-            data_ptr, index, UINT32_ELEMENTS, SMI_PARAMETERS);
-        var_value.Bind(ChangeUint32ToTagged(value_uint32));
-        Goto(&allocate_entry_if_needed);
-      }
-      BIND(&int32_values);
-      {
-        Node* value_int32 = LoadFixedTypedArrayElement(
-            data_ptr, index, INT32_ELEMENTS, SMI_PARAMETERS);
-        var_value.Bind(ChangeInt32ToTagged(value_int32));
-        Goto(&allocate_entry_if_needed);
-      }
-      BIND(&float32_values);
-      {
-        Node* value_float32 = LoadFixedTypedArrayElement(
-            data_ptr, index, FLOAT32_ELEMENTS, SMI_PARAMETERS);
-        var_value.Bind(
-            AllocateHeapNumberWithValue(ChangeFloat32ToFloat64(value_float32)));
-        Goto(&allocate_entry_if_needed);
-      }
-      BIND(&float64_values);
-      {
-        Node* value_float64 = LoadFixedTypedArrayElement(
-            data_ptr, index, FLOAT64_ELEMENTS, SMI_PARAMETERS);
-        var_value.Bind(AllocateHeapNumberWithValue(value_float64));
-        Goto(&allocate_entry_if_needed);
-      }
-    }
+    BIND(&if_detached);
+    ThrowTypeError(context, MessageTemplate::kDetachedOperation, method_name);
   }
 
   BIND(&set_done);
@@ -3395,17 +3791,11 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
     Goto(&allocate_iterator_result);
   }
 
-  BIND(&allocate_key_result);
-  {
-    var_value.Bind(index);
-    var_done.Bind(FalseConstant());
-    Goto(&allocate_iterator_result);
-  }
-
   BIND(&allocate_entry_if_needed);
   {
-    GotoIf(Uint32LessThan(Int32Constant(LAST_ARRAY_KEY_VALUE_ITERATOR_TYPE),
-                          instance_type),
+    GotoIf(Word32Equal(LoadAndUntagToWord32ObjectField(
+                           iterator, JSArrayIterator::kKindOffset),
+                       Int32Constant(static_cast<int>(IterationKind::kValues))),
            &allocate_iterator_result);
 
     Node* elements = AllocateFixedArray(PACKED_ELEMENTS, IntPtrConstant(2));
@@ -3447,14 +3837,264 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
   BIND(&throw_bad_receiver);
   {
     // The {receiver} is not a valid JSArrayIterator.
-    CallRuntime(Runtime::kThrowIncompatibleMethodReceiver, context,
-                HeapConstant(operation), iterator);
-    Unreachable();
+    ThrowTypeError(context, MessageTemplate::kIncompatibleMethodReceiver,
+                   StringConstant(method_name), iterator);
   }
+}
+
+namespace {
+
+class ArrayFlattenAssembler : public CodeStubAssembler {
+ public:
+  explicit ArrayFlattenAssembler(compiler::CodeAssemblerState* state)
+      : CodeStubAssembler(state) {}
+
+  // https://tc39.github.io/proposal-flatMap/#sec-FlattenIntoArray
+  Node* FlattenIntoArray(Node* context, Node* target, Node* source,
+                         Node* source_length, Node* start, Node* depth,
+                         Node* mapper_function = nullptr,
+                         Node* this_arg = nullptr) {
+    CSA_ASSERT(this, IsJSReceiver(target));
+    CSA_ASSERT(this, IsJSReceiver(source));
+    CSA_ASSERT(this, IsNumberPositive(source_length));
+    CSA_ASSERT(this, IsNumberPositive(start));
+    CSA_ASSERT(this, IsNumber(depth));
+
+    // 1. Let targetIndex be start.
+    VARIABLE(var_target_index, MachineRepresentation::kTagged, start);
+
+    // 2. Let sourceIndex be 0.
+    VARIABLE(var_source_index, MachineRepresentation::kTagged, SmiConstant(0));
+
+    // 3. Repeat...
+    Label loop(this, {&var_target_index, &var_source_index}), done_loop(this);
+    Goto(&loop);
+    BIND(&loop);
+    {
+      Node* const source_index = var_source_index.value();
+      Node* const target_index = var_target_index.value();
+
+      // ...while sourceIndex < sourceLen
+      GotoIfNumberGreaterThanOrEqual(source_index, source_length, &done_loop);
+
+      // a. Let P be ! ToString(sourceIndex).
+      // b. Let exists be ? HasProperty(source, P).
+      CSA_ASSERT(this, SmiGreaterThanOrEqual(source_index, SmiConstant(0)));
+      Node* const exists =
+          HasProperty(source, source_index, context, kHasProperty);
+
+      // c. If exists is true, then
+      Label next(this);
+      GotoIfNot(IsTrue(exists), &next);
+      {
+        // i. Let element be ? Get(source, P).
+        Node* element = GetProperty(context, source, source_index);
+
+        // ii. If mapperFunction is present, then
+        if (mapper_function != nullptr) {
+          CSA_ASSERT(this, Word32Or(IsUndefined(mapper_function),
+                                    IsCallable(mapper_function)));
+          DCHECK_NOT_NULL(this_arg);
+
+          // 1. Set element to ? Call(mapperFunction, thisArg , « element,
+          //                          sourceIndex, source »).
+          element =
+              CallJS(CodeFactory::Call(isolate()), context, mapper_function,
+                     this_arg, element, source_index, source);
+        }
+
+        // iii. Let shouldFlatten be false.
+        Label if_flatten_array(this), if_flatten_proxy(this, Label::kDeferred),
+            if_noflatten(this);
+        // iv. If depth > 0, then
+        GotoIfNumberGreaterThanOrEqual(SmiConstant(0), depth, &if_noflatten);
+        // 1. Set shouldFlatten to ? IsArray(element).
+        GotoIf(TaggedIsSmi(element), &if_noflatten);
+        GotoIf(IsJSArray(element), &if_flatten_array);
+        GotoIfNot(IsJSProxy(element), &if_noflatten);
+        Branch(IsTrue(CallRuntime(Runtime::kArrayIsArray, context, element)),
+               &if_flatten_proxy, &if_noflatten);
+
+        BIND(&if_flatten_array);
+        {
+          CSA_ASSERT(this, IsJSArray(element));
+
+          // 1. Let elementLen be ? ToLength(? Get(element, "length")).
+          Node* const element_length =
+              LoadObjectField(element, JSArray::kLengthOffset);
+
+          // 2. Set targetIndex to ? FlattenIntoArray(target, element,
+          //                                          elementLen, targetIndex,
+          //                                          depth - 1).
+          var_target_index.Bind(
+              CallBuiltin(Builtins::kFlattenIntoArray, context, target, element,
+                          element_length, target_index, NumberDec(depth)));
+          Goto(&next);
+        }
+
+        BIND(&if_flatten_proxy);
+        {
+          CSA_ASSERT(this, IsJSProxy(element));
+
+          // 1. Let elementLen be ? ToLength(? Get(element, "length")).
+          Node* const element_length = ToLength_Inline(
+              context, GetProperty(context, element, LengthStringConstant()));
+
+          // 2. Set targetIndex to ? FlattenIntoArray(target, element,
+          //                                          elementLen, targetIndex,
+          //                                          depth - 1).
+          var_target_index.Bind(
+              CallBuiltin(Builtins::kFlattenIntoArray, context, target, element,
+                          element_length, target_index, NumberDec(depth)));
+          Goto(&next);
+        }
+
+        BIND(&if_noflatten);
+        {
+          // 1. If targetIndex >= 2^53-1, throw a TypeError exception.
+          Label throw_error(this, Label::kDeferred);
+          GotoIfNumberGreaterThanOrEqual(
+              target_index, NumberConstant(kMaxSafeInteger), &throw_error);
+
+          // 2. Perform ? CreateDataPropertyOrThrow(target,
+          //                                        ! ToString(targetIndex),
+          //                                        element).
+          CallRuntime(Runtime::kCreateDataProperty, context, target,
+                      target_index, element);
+
+          // 3. Increase targetIndex by 1.
+          var_target_index.Bind(NumberInc(target_index));
+          Goto(&next);
+
+          BIND(&throw_error);
+          ThrowTypeError(context, MessageTemplate::kFlattenPastSafeLength,
+                         source_length, target_index);
+        }
+      }
+      BIND(&next);
+
+      // d. Increase sourceIndex by 1.
+      var_source_index.Bind(NumberInc(source_index));
+      Goto(&loop);
+    }
+
+    BIND(&done_loop);
+    return var_target_index.value();
+  }
+};
+
+}  // namespace
+
+// https://tc39.github.io/proposal-flatMap/#sec-FlattenIntoArray
+TF_BUILTIN(FlattenIntoArray, ArrayFlattenAssembler) {
+  Node* const context = Parameter(Descriptor::kContext);
+  Node* const target = Parameter(Descriptor::kTarget);
+  Node* const source = Parameter(Descriptor::kSource);
+  Node* const source_length = Parameter(Descriptor::kSourceLength);
+  Node* const start = Parameter(Descriptor::kStart);
+  Node* const depth = Parameter(Descriptor::kDepth);
+
+  Return(
+      FlattenIntoArray(context, target, source, source_length, start, depth));
+}
+
+// https://tc39.github.io/proposal-flatMap/#sec-FlattenIntoArray
+TF_BUILTIN(FlatMapIntoArray, ArrayFlattenAssembler) {
+  Node* const context = Parameter(Descriptor::kContext);
+  Node* const target = Parameter(Descriptor::kTarget);
+  Node* const source = Parameter(Descriptor::kSource);
+  Node* const source_length = Parameter(Descriptor::kSourceLength);
+  Node* const start = Parameter(Descriptor::kStart);
+  Node* const depth = Parameter(Descriptor::kDepth);
+  Node* const mapper_function = Parameter(Descriptor::kMapperFunction);
+  Node* const this_arg = Parameter(Descriptor::kThisArg);
+
+  Return(FlattenIntoArray(context, target, source, source_length, start, depth,
+                          mapper_function, this_arg));
+}
+
+// https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatten
+TF_BUILTIN(ArrayPrototypeFlatten, CodeStubAssembler) {
+  Node* const argc =
+      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+  CodeStubArguments args(this, argc);
+  Node* const context = Parameter(BuiltinDescriptor::kContext);
+  Node* const receiver = args.GetReceiver();
+  Node* const depth = args.GetOptionalArgumentValue(0);
+
+  // 1. Let O be ? ToObject(this value).
+  Node* const o = ToObject(context, receiver);
+
+  // 2. Let sourceLen be ? ToLength(? Get(O, "length")).
+  Node* const source_length =
+      ToLength_Inline(context, GetProperty(context, o, LengthStringConstant()));
+
+  // 3. Let depthNum be 1.
+  VARIABLE(var_depth_num, MachineRepresentation::kTagged, SmiConstant(1));
+
+  // 4. If depth is not undefined, then
+  Label done(this);
+  GotoIf(IsUndefined(depth), &done);
+  {
+    // a. Set depthNum to ? ToInteger(depth).
+    var_depth_num.Bind(ToInteger_Inline(context, depth));
+    Goto(&done);
+  }
+  BIND(&done);
+
+  // 5. Let A be ? ArraySpeciesCreate(O, 0).
+  Node* const constructor =
+      CallRuntime(Runtime::kArraySpeciesConstructor, context, o);
+  Node* const a = ConstructJS(CodeFactory::Construct(isolate()), context,
+                              constructor, SmiConstant(0));
+
+  // 6. Perform ? FlattenIntoArray(A, O, sourceLen, 0, depthNum).
+  CallBuiltin(Builtins::kFlattenIntoArray, context, a, o, source_length,
+              SmiConstant(0), var_depth_num.value());
+
+  // 7. Return A.
+  args.PopAndReturn(a);
+}
+
+// https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatMap
+TF_BUILTIN(ArrayPrototypeFlatMap, CodeStubAssembler) {
+  Node* const argc =
+      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+  CodeStubArguments args(this, argc);
+  Node* const context = Parameter(BuiltinDescriptor::kContext);
+  Node* const receiver = args.GetReceiver();
+  Node* const mapper_function = args.GetOptionalArgumentValue(0);
+
+  // 1. Let O be ? ToObject(this value).
+  Node* const o = ToObject(context, receiver);
+
+  // 2. Let sourceLen be ? ToLength(? Get(O, "length")).
+  Node* const source_length =
+      ToLength_Inline(context, GetProperty(context, o, LengthStringConstant()));
+
+  // 3. If IsCallable(mapperFunction) is false, throw a TypeError exception.
+  Label if_not_callable(this, Label::kDeferred);
+  GotoIf(TaggedIsSmi(mapper_function), &if_not_callable);
+  GotoIfNot(IsCallable(mapper_function), &if_not_callable);
+
+  // 4. If thisArg is present, let T be thisArg; else let T be undefined.
+  Node* const t = args.GetOptionalArgumentValue(1);
+
+  // 5. Let A be ? ArraySpeciesCreate(O, 0).
+  Node* const constructor =
+      CallRuntime(Runtime::kArraySpeciesConstructor, context, o);
+  Node* const a = ConstructJS(CodeFactory::Construct(isolate()), context,
+                              constructor, SmiConstant(0));
+
+  // 6. Perform ? FlattenIntoArray(A, O, sourceLen, 0, 1, mapperFunction, T).
+  CallBuiltin(Builtins::kFlatMapIntoArray, context, a, o, source_length,
+              SmiConstant(0), SmiConstant(1), mapper_function, t);
+
+  // 7. Return A.
+  args.PopAndReturn(a);
 
-  BIND(&if_isdetached);
-  ThrowTypeError(context, MessageTemplate::kDetachedOperation,
-                 HeapConstant(operation));
+  BIND(&if_not_callable);
+  { ThrowTypeError(context, MessageTemplate::kMapperFunctionNonCallable); }
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-array-gen.h b/deps/v8/src/builtins/builtins-array-gen.h
new file mode 100644
index 00000000000..aabd4bab6ea
--- /dev/null
+++ b/deps/v8/src/builtins/builtins-array-gen.h
@@ -0,0 +1,159 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_BUILTINS_BUILTINS_ARRAY_GEN_H_
+#define V8_BUILTINS_BUILTINS_ARRAY_GEN_H_
+
+#include "src/code-stub-assembler.h"
+
+namespace v8 {
+namespace internal {
+
+class ArrayBuiltinsAssembler : public CodeStubAssembler {
+ public:
+  explicit ArrayBuiltinsAssembler(compiler::CodeAssemblerState* state);
+
+  typedef std::function<void(ArrayBuiltinsAssembler* masm)>
+      BuiltinResultGenerator;
+
+  typedef std::function<Node*(ArrayBuiltinsAssembler* masm, Node* k_value,
+                              Node* k)>
+      CallResultProcessor;
+
+  typedef std::function<void(ArrayBuiltinsAssembler* masm)> PostLoopAction;
+
+  enum class MissingPropertyMode { kSkip, kUseUndefined };
+
+  void FindResultGenerator();
+
+  Node* FindProcessor(Node* k_value, Node* k);
+
+  void FindIndexResultGenerator();
+
+  Node* FindIndexProcessor(Node* k_value, Node* k);
+
+  void ForEachResultGenerator();
+
+  Node* ForEachProcessor(Node* k_value, Node* k);
+
+  void SomeResultGenerator();
+
+  Node* SomeProcessor(Node* k_value, Node* k);
+
+  void EveryResultGenerator();
+
+  Node* EveryProcessor(Node* k_value, Node* k);
+
+  void ReduceResultGenerator();
+
+  Node* ReduceProcessor(Node* k_value, Node* k);
+
+  void ReducePostLoopAction();
+
+  void FilterResultGenerator();
+
+  Node* FilterProcessor(Node* k_value, Node* k);
+
+  void MapResultGenerator();
+
+  void TypedArrayMapResultGenerator();
+
+  Node* SpecCompliantMapProcessor(Node* k_value, Node* k);
+
+  Node* FastMapProcessor(Node* k_value, Node* k);
+
+  // See tc39.github.io/ecma262/#sec-%typedarray%.prototype.map.
+  Node* TypedArrayMapProcessor(Node* k_value, Node* k);
+
+  void NullPostLoopAction();
+
+ protected:
+  TNode<Context> context() { return context_; }
+  TNode<Object> receiver() { return receiver_; }
+  Node* new_target() { return new_target_; }
+  TNode<IntPtrT> argc() { return argc_; }
+  TNode<JSReceiver> o() { return o_; }
+  TNode<Number> len() { return len_; }
+  Node* callbackfn() { return callbackfn_; }
+  Node* this_arg() { return this_arg_; }
+  Node* k() { return k_.value(); }
+  Node* a() { return a_.value(); }
+
+  void ReturnFromBuiltin(Node* value);
+
+  void InitIteratingArrayBuiltinBody(TNode<Context> context,
+                                     TNode<Object> receiver, Node* callbackfn,
+                                     Node* this_arg, Node* new_target,
+                                     TNode<IntPtrT> argc);
+
+  void GenerateIteratingArrayBuiltinBody(
+      const char* name, const BuiltinResultGenerator& generator,
+      const CallResultProcessor& processor, const PostLoopAction& action,
+      const Callable& slow_case_continuation,
+      MissingPropertyMode missing_property_mode,
+      ForEachDirection direction = ForEachDirection::kForward);
+  void InitIteratingArrayBuiltinLoopContinuation(
+      TNode<Context> context, TNode<Object> receiver, Node* callbackfn,
+      Node* this_arg, Node* a, TNode<JSReceiver> o, Node* initial_k,
+      TNode<Number> len, Node* to);
+
+  void GenerateIteratingTypedArrayBuiltinBody(
+      const char* name, const BuiltinResultGenerator& generator,
+      const CallResultProcessor& processor, const PostLoopAction& action,
+      ForEachDirection direction = ForEachDirection::kForward);
+
+  void GenerateIteratingArrayBuiltinLoopContinuation(
+      const CallResultProcessor& processor, const PostLoopAction& action,
+      MissingPropertyMode missing_property_mode,
+      ForEachDirection direction = ForEachDirection::kForward);
+
+ private:
+  static ElementsKind ElementsKindForInstanceType(InstanceType type);
+
+  void VisitAllTypedArrayElements(Node* array_buffer,
+                                  const CallResultProcessor& processor,
+                                  Label* detached, ForEachDirection direction,
+                                  TNode<JSTypedArray> typed_array);
+
+  void VisitAllFastElementsOneKind(ElementsKind kind,
+                                   const CallResultProcessor& processor,
+                                   Label* array_changed, ParameterMode mode,
+                                   ForEachDirection direction,
+                                   MissingPropertyMode missing_property_mode,
+                                   TNode<Smi> length);
+
+  void HandleFastElements(const CallResultProcessor& processor,
+                          const PostLoopAction& action, Label* slow,
+                          ForEachDirection direction,
+                          MissingPropertyMode missing_property_mode);
+
+  // Perform ArraySpeciesCreate (ES6 #sec-arrayspeciescreate).
+  // This version is specialized to create a zero length array
+  // of the elements kind of the input array.
+  void GenerateArraySpeciesCreate();
+
+  // Perform ArraySpeciesCreate (ES6 #sec-arrayspeciescreate).
+  void GenerateArraySpeciesCreate(TNode<Number> len);
+
+  Node* callbackfn_ = nullptr;
+  TNode<JSReceiver> o_;
+  Node* this_arg_ = nullptr;
+  TNode<Number> len_;
+  TNode<Context> context_;
+  TNode<Object> receiver_;
+  Node* new_target_ = nullptr;
+  TNode<IntPtrT> argc_;
+  Node* fast_typed_array_target_ = nullptr;
+  const char* name_ = nullptr;
+  Variable k_;
+  Variable a_;
+  Variable to_;
+  Label fully_spec_compliant_;
+  ElementsKind source_elements_kind_ = ElementsKind::NO_ELEMENTS;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_BUILTINS_BUILTINS_ARRAY_GEN_H_
diff --git a/deps/v8/src/builtins/builtins-array.cc b/deps/v8/src/builtins/builtins-array.cc
index 70ee2326f59..7e3f948cbe5 100644
--- a/deps/v8/src/builtins/builtins-array.cc
+++ b/deps/v8/src/builtins/builtins-array.cc
@@ -10,6 +10,7 @@
 #include "src/contexts.h"
 #include "src/counters.h"
 #include "src/elements.h"
+#include "src/global-handles.h"
 #include "src/isolate.h"
 #include "src/lookup.h"
 #include "src/objects-inl.h"
@@ -239,75 +240,6 @@ BUILTIN(ArrayUnshift) {
   return Smi::FromInt(new_length);
 }
 
-BUILTIN(ArraySlice) {
-  HandleScope scope(isolate);
-  Handle<Object> receiver = args.receiver();
-  int len = -1;
-  int relative_start = 0;
-  int relative_end = 0;
-
-  if (receiver->IsJSArray()) {
-    DisallowHeapAllocation no_gc;
-    JSArray* array = JSArray::cast(*receiver);
-    if (V8_UNLIKELY(!array->HasFastElements() ||
-                    !IsJSArrayFastElementMovingAllowed(isolate, array) ||
-                    !isolate->IsArraySpeciesLookupChainIntact() ||
-                    // If this is a subclass of Array, then call out to JS
-                    !array->HasArrayPrototype(isolate))) {
-      AllowHeapAllocation allow_allocation;
-      return CallJsIntrinsic(isolate, isolate->array_slice(), args);
-    }
-    len = Smi::ToInt(array->length());
-  } else if (receiver->IsJSObject() &&
-             JSSloppyArgumentsObject::GetSloppyArgumentsLength(
-                 isolate, Handle<JSObject>::cast(receiver), &len)) {
-    // Array.prototype.slice.call(arguments, ...) is quite a common idiom
-    // (notably more than 50% of invocations in Web apps).
-    // Treat it in C++ as well.
-    DCHECK(JSObject::cast(*receiver)->HasFastElements() ||
-           JSObject::cast(*receiver)->HasFastArgumentsElements());
-  } else {
-    AllowHeapAllocation allow_allocation;
-    return CallJsIntrinsic(isolate, isolate->array_slice(), args);
-  }
-  DCHECK_LE(0, len);
-  int argument_count = args.length() - 1;
-  // Note carefully chosen defaults---if argument is missing,
-  // it's undefined which gets converted to 0 for relative_start
-  // and to len for relative_end.
-  relative_start = 0;
-  relative_end = len;
-  if (argument_count > 0) {
-    DisallowHeapAllocation no_gc;
-    if (!ClampedToInteger(isolate, args[1], &relative_start)) {
-      AllowHeapAllocation allow_allocation;
-      return CallJsIntrinsic(isolate, isolate->array_slice(), args);
-    }
-    if (argument_count > 1) {
-      Object* end_arg = args[2];
-      // slice handles the end_arg specially
-      if (end_arg->IsUndefined(isolate)) {
-        relative_end = len;
-      } else if (!ClampedToInteger(isolate, end_arg, &relative_end)) {
-        AllowHeapAllocation allow_allocation;
-        return CallJsIntrinsic(isolate, isolate->array_slice(), args);
-      }
-    }
-  }
-
-  // ECMAScript 232, 3rd Edition, Section 15.4.4.10, step 6.
-  uint32_t actual_start = (relative_start < 0) ? Max(len + relative_start, 0)
-                                               : Min(relative_start, len);
-
-  // ECMAScript 232, 3rd Edition, Section 15.4.4.10, step 8.
-  uint32_t actual_end =
-      (relative_end < 0) ? Max(len + relative_end, 0) : Min(relative_end, len);
-
-  Handle<JSObject> object = Handle<JSObject>::cast(receiver);
-  ElementsAccessor* accessor = object->GetElementsAccessor();
-  return *accessor->Slice(object, actual_start, actual_end);
-}
-
 BUILTIN(ArraySplice) {
   HandleScope scope(isolate);
   Handle<Object> receiver = args.receiver();
@@ -316,7 +248,7 @@ BUILTIN(ArraySplice) {
           // If this is a subclass of Array, then call out to JS.
           !Handle<JSArray>::cast(receiver)->HasArrayPrototype(isolate) ||
           // If anything with @@species has been messed with, call out to JS.
-          !isolate->IsArraySpeciesLookupChainIntact())) {
+          !isolate->IsSpeciesLookupChainIntact())) {
     return CallJsIntrinsic(isolate, isolate->array_splice(), args);
   }
   Handle<JSArray> array = Handle<JSArray>::cast(receiver);
@@ -1186,7 +1118,7 @@ BUILTIN(ArrayConcat) {
   // Avoid a real species read to avoid extra lookups to the array constructor
   if (V8_LIKELY(receiver->IsJSArray() &&
                 Handle<JSArray>::cast(receiver)->HasArrayPrototype(isolate) &&
-                isolate->IsArraySpeciesLookupChainIntact())) {
+                isolate->IsSpeciesLookupChainIntact())) {
     if (Fast_ArrayConcat(isolate, &args).ToHandle(&result_array)) {
       return *result_array;
     }
diff --git a/deps/v8/src/builtins/builtins-arraybuffer.cc b/deps/v8/src/builtins/builtins-arraybuffer.cc
index 4f9078b4b69..9c77a0047d7 100644
--- a/deps/v8/src/builtins/builtins-arraybuffer.cc
+++ b/deps/v8/src/builtins/builtins-arraybuffer.cc
@@ -23,17 +23,6 @@ namespace internal {
 // -----------------------------------------------------------------------------
 // ES6 section 21.1 ArrayBuffer Objects
 
-// ES6 section 24.1.2.1 ArrayBuffer ( length ) for the [[Call]] case.
-BUILTIN(ArrayBufferConstructor) {
-  HandleScope scope(isolate);
-  Handle<JSFunction> target = args.target();
-  DCHECK(*target == target->native_context()->array_buffer_fun() ||
-         *target == target->native_context()->shared_array_buffer_fun());
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate, NewTypeError(MessageTemplate::kConstructorNotFunction,
-                            handle(target->shared()->name(), isolate)));
-}
-
 namespace {
 
 Object* ConstructBuffer(Isolate* isolate, Handle<JSFunction> target,
@@ -62,24 +51,30 @@ Object* ConstructBuffer(Isolate* isolate, Handle<JSFunction> target,
 
 }  // namespace
 
-// ES6 section 24.1.2.1 ArrayBuffer ( length ) for the [[Construct]] case.
-BUILTIN(ArrayBufferConstructor_ConstructStub) {
+// ES #sec-arraybuffer-constructor
+BUILTIN(ArrayBufferConstructor) {
   HandleScope scope(isolate);
   Handle<JSFunction> target = args.target();
-  Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
-  Handle<Object> length = args.atOrUndefined(isolate, 1);
   DCHECK(*target == target->native_context()->array_buffer_fun() ||
          *target == target->native_context()->shared_array_buffer_fun());
-
-  Handle<Object> number_length;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, number_length,
-                                     Object::ToInteger(isolate, length));
-  if (number_length->Number() < 0.0) {
+  if (args.new_target()->IsUndefined(isolate)) {  // [[Call]]
     THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate, NewRangeError(MessageTemplate::kInvalidArrayBufferLength));
+        isolate, NewTypeError(MessageTemplate::kConstructorNotFunction,
+                              handle(target->shared()->Name(), isolate)));
+  } else {  // [[Construct]]
+    Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
+    Handle<Object> length = args.atOrUndefined(isolate, 1);
+
+    Handle<Object> number_length;
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, number_length,
+                                       Object::ToInteger(isolate, length));
+    if (number_length->Number() < 0.0) {
+      THROW_NEW_ERROR_RETURN_FAILURE(
+          isolate, NewRangeError(MessageTemplate::kInvalidArrayBufferLength));
+    }
+
+    return ConstructBuffer(isolate, target, new_target, number_length, true);
   }
-
-  return ConstructBuffer(isolate, target, new_target, number_length, true);
 }
 
 // This is a helper to construct an ArrayBuffer with uinitialized memory.
diff --git a/deps/v8/src/builtins/builtins-async-function-gen.cc b/deps/v8/src/builtins/builtins-async-function-gen.cc
index 0d0e34ee0da..0db53c687e6 100644
--- a/deps/v8/src/builtins/builtins-async-function-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-function-gen.cc
@@ -21,37 +21,18 @@ class AsyncFunctionBuiltinsAssembler : public AsyncBuiltinsAssembler {
                           Node* const awaited, Node* const outer_promise,
                           const bool is_predicted_as_caught);
 
-  void AsyncFunctionAwaitResumeClosure(
-      Node* const context, Node* const sent_value,
-      JSGeneratorObject::ResumeMode resume_mode);
+  void AsyncFunctionAwaitResume(Node* const context, Node* const argument,
+                                Node* const generator,
+                                JSGeneratorObject::ResumeMode resume_mode);
 };
 
-namespace {
-
-// Describe fields of Context associated with AsyncFunctionAwait resume
-// closures.
-// TODO(jgruber): Refactor to reuse code for upcoming async-generators.
-class AwaitContext {
- public:
-  enum Fields { kGeneratorSlot = Context::MIN_CONTEXT_SLOTS, kLength };
-};
-
-}  // anonymous namespace
-
-void AsyncFunctionBuiltinsAssembler::AsyncFunctionAwaitResumeClosure(
-    Node* context, Node* sent_value,
+void AsyncFunctionBuiltinsAssembler::AsyncFunctionAwaitResume(
+    Node* const context, Node* const argument, Node* const generator,
     JSGeneratorObject::ResumeMode resume_mode) {
+  CSA_ASSERT(this, IsJSGeneratorObject(generator));
   DCHECK(resume_mode == JSGeneratorObject::kNext ||
          resume_mode == JSGeneratorObject::kThrow);
 
-  Node* const generator =
-      LoadContextElement(context, AwaitContext::kGeneratorSlot);
-  CSA_SLOW_ASSERT(this, HasInstanceType(generator, JS_GENERATOR_OBJECT_TYPE));
-
-  // Inline version of GeneratorPrototypeNext / GeneratorPrototypeReturn with
-  // unnecessary runtime checks removed.
-  // TODO(jgruber): Refactor to reuse code from builtins-generator.cc.
-
   // Ensure that the generator is neither closed nor running.
   CSA_SLOW_ASSERT(
       this,
@@ -66,31 +47,23 @@ void AsyncFunctionBuiltinsAssembler::AsyncFunctionAwaitResumeClosure(
 
   // Resume the {receiver} using our trampoline.
   Callable callable = CodeFactory::ResumeGenerator(isolate());
-  CallStub(callable, context, sent_value, generator);
-
-  // The resulting Promise is a throwaway, so it doesn't matter what it
-  // resolves to. What is important is that we don't end up keeping the
-  // whole chain of intermediate Promises alive by returning the return value
-  // of ResumeGenerator, as that would create a memory leak.
+  TailCallStub(callable, context, argument, generator);
 }
 
-TF_BUILTIN(AsyncFunctionAwaitRejectClosure, AsyncFunctionBuiltinsAssembler) {
-  CSA_ASSERT_JS_ARGC_EQ(this, 1);
-  Node* const sentError = Parameter(Descriptor::kSentError);
+TF_BUILTIN(AsyncFunctionAwaitFulfill, AsyncFunctionBuiltinsAssembler) {
+  Node* const argument = Parameter(Descriptor::kArgument);
+  Node* const generator = Parameter(Descriptor::kGenerator);
   Node* const context = Parameter(Descriptor::kContext);
-
-  AsyncFunctionAwaitResumeClosure(context, sentError,
-                                  JSGeneratorObject::kThrow);
-  Return(UndefinedConstant());
+  AsyncFunctionAwaitResume(context, argument, generator,
+                           JSGeneratorObject::kNext);
 }
 
-TF_BUILTIN(AsyncFunctionAwaitResolveClosure, AsyncFunctionBuiltinsAssembler) {
-  CSA_ASSERT_JS_ARGC_EQ(this, 1);
-  Node* const sentValue = Parameter(Descriptor::kSentValue);
+TF_BUILTIN(AsyncFunctionAwaitReject, AsyncFunctionBuiltinsAssembler) {
+  Node* const argument = Parameter(Descriptor::kArgument);
+  Node* const generator = Parameter(Descriptor::kGenerator);
   Node* const context = Parameter(Descriptor::kContext);
-
-  AsyncFunctionAwaitResumeClosure(context, sentValue, JSGeneratorObject::kNext);
-  Return(UndefinedConstant());
+  AsyncFunctionAwaitResume(context, argument, generator,
+                           JSGeneratorObject::kThrow);
 }
 
 // ES#abstract-ops-async-function-await
@@ -105,25 +78,12 @@ TF_BUILTIN(AsyncFunctionAwaitResolveClosure, AsyncFunctionBuiltinsAssembler) {
 void AsyncFunctionBuiltinsAssembler::AsyncFunctionAwait(
     Node* const context, Node* const generator, Node* const awaited,
     Node* const outer_promise, const bool is_predicted_as_caught) {
-  CSA_SLOW_ASSERT(this, HasInstanceType(generator, JS_GENERATOR_OBJECT_TYPE));
-  CSA_SLOW_ASSERT(this, HasInstanceType(outer_promise, JS_PROMISE_TYPE));
-
-  ContextInitializer init_closure_context = [&](Node* context) {
-    StoreContextElementNoWriteBarrier(context, AwaitContext::kGeneratorSlot,
-                                      generator);
-  };
-
-  // TODO(jgruber): AsyncBuiltinsAssembler::Await currently does not reuse
-  // the awaited promise if it is already a promise. Reuse is non-spec compliant
-  // but part of our old behavior gives us a couple of percent
-  // performance boost.
-  // TODO(jgruber): Use a faster specialized version of
-  // InternalPerformPromiseThen.
-
-  Await(context, generator, awaited, outer_promise, AwaitContext::kLength,
-        init_closure_context, Context::ASYNC_FUNCTION_AWAIT_RESOLVE_SHARED_FUN,
-        Context::ASYNC_FUNCTION_AWAIT_REJECT_SHARED_FUN,
-        is_predicted_as_caught);
+  CSA_SLOW_ASSERT(this, IsJSGeneratorObject(generator));
+  CSA_SLOW_ASSERT(this, IsJSPromise(outer_promise));
+
+  Await(context, generator, awaited, outer_promise,
+        Builtins::kAsyncFunctionAwaitFulfill,
+        Builtins::kAsyncFunctionAwaitReject, is_predicted_as_caught);
 
   // Return outer promise to avoid adding an load of the outer promise before
   // suspending in BytecodeGenerator.
@@ -133,30 +93,28 @@ void AsyncFunctionBuiltinsAssembler::AsyncFunctionAwait(
 // Called by the parser from the desugaring of 'await' when catch
 // prediction indicates that there is a locally surrounding catch block.
 TF_BUILTIN(AsyncFunctionAwaitCaught, AsyncFunctionBuiltinsAssembler) {
-  CSA_ASSERT_JS_ARGC_EQ(this, 3);
   Node* const generator = Parameter(Descriptor::kGenerator);
-  Node* const awaited = Parameter(Descriptor::kAwaited);
+  Node* const value = Parameter(Descriptor::kValue);
   Node* const outer_promise = Parameter(Descriptor::kOuterPromise);
   Node* const context = Parameter(Descriptor::kContext);
 
   static const bool kIsPredictedAsCaught = true;
 
-  AsyncFunctionAwait(context, generator, awaited, outer_promise,
+  AsyncFunctionAwait(context, generator, value, outer_promise,
                      kIsPredictedAsCaught);
 }
 
 // Called by the parser from the desugaring of 'await' when catch
 // prediction indicates no locally surrounding catch block.
 TF_BUILTIN(AsyncFunctionAwaitUncaught, AsyncFunctionBuiltinsAssembler) {
-  CSA_ASSERT_JS_ARGC_EQ(this, 3);
   Node* const generator = Parameter(Descriptor::kGenerator);
-  Node* const awaited = Parameter(Descriptor::kAwaited);
+  Node* const value = Parameter(Descriptor::kValue);
   Node* const outer_promise = Parameter(Descriptor::kOuterPromise);
   Node* const context = Parameter(Descriptor::kContext);
 
   static const bool kIsPredictedAsCaught = false;
 
-  AsyncFunctionAwait(context, generator, awaited, outer_promise,
+  AsyncFunctionAwait(context, generator, value, outer_promise,
                      kIsPredictedAsCaught);
 }
 
diff --git a/deps/v8/src/builtins/builtins-async-gen.cc b/deps/v8/src/builtins/builtins-async-gen.cc
index 0cdcb57a3f9..7958afba007 100644
--- a/deps/v8/src/builtins/builtins-async-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-gen.cc
@@ -13,6 +13,58 @@ namespace internal {
 
 using compiler::Node;
 
+void AsyncBuiltinsAssembler::Await(Node* context, Node* generator, Node* value,
+                                   Node* outer_promise,
+                                   Builtins::Name fulfill_builtin,
+                                   Builtins::Name reject_builtin,
+                                   Node* is_predicted_as_caught) {
+  CSA_SLOW_ASSERT(this, Word32Or(IsJSAsyncGeneratorObject(generator),
+                                 IsJSGeneratorObject(generator)));
+  CSA_SLOW_ASSERT(this, IsJSPromise(outer_promise));
+  CSA_SLOW_ASSERT(this, IsBoolean(is_predicted_as_caught));
+
+  Node* const native_context = LoadNativeContext(context);
+
+  // TODO(bmeurer): This could be optimized and folded into a single allocation.
+  Node* const promise = AllocateAndInitJSPromise(native_context);
+  Node* const promise_reactions =
+      LoadObjectField(promise, JSPromise::kReactionsOrResultOffset);
+  Node* const fulfill_handler =
+      HeapConstant(Builtins::CallableFor(isolate(), fulfill_builtin).code());
+  Node* const reject_handler =
+      HeapConstant(Builtins::CallableFor(isolate(), reject_builtin).code());
+  Node* const reaction = AllocatePromiseReaction(
+      promise_reactions, generator, fulfill_handler, reject_handler);
+  StoreObjectField(promise, JSPromise::kReactionsOrResultOffset, reaction);
+  PromiseSetHasHandler(promise);
+
+  // Perform ! Call(promiseCapability.[[Resolve]], undefined, « value »).
+  CallBuiltin(Builtins::kResolvePromise, native_context, promise, value);
+
+  // When debugging, we need to link from the {generator} to the
+  // {outer_promise} of the async function/generator.
+  Label done(this);
+  GotoIfNot(IsDebugActive(), &done);
+  CallRuntime(Runtime::kSetProperty, native_context, generator,
+              LoadRoot(Heap::kgenerator_outer_promise_symbolRootIndex),
+              outer_promise, SmiConstant(LanguageMode::kStrict));
+  GotoIf(IsFalse(is_predicted_as_caught), &done);
+  GotoIf(TaggedIsSmi(value), &done);
+  GotoIfNot(IsJSPromise(value), &done);
+  PromiseSetHandledHint(value);
+  Goto(&done);
+  BIND(&done);
+}
+
+void AsyncBuiltinsAssembler::Await(Node* context, Node* generator, Node* value,
+                                   Node* outer_promise,
+                                   Builtins::Name fulfill_builtin,
+                                   Builtins::Name reject_builtin,
+                                   bool is_predicted_as_caught) {
+  return Await(context, generator, value, outer_promise, fulfill_builtin,
+               reject_builtin, BooleanConstant(is_predicted_as_caught));
+}
+
 namespace {
 // Describe fields of Context associated with the AsyncIterator unwrap closure.
 class ValueUnwrapContext {
@@ -22,165 +74,6 @@ class ValueUnwrapContext {
 
 }  // namespace
 
-Node* AsyncBuiltinsAssembler::Await(
-    Node* context, Node* generator, Node* value, Node* outer_promise,
-    int context_length, const ContextInitializer& init_closure_context,
-    Node* on_resolve_context_index, Node* on_reject_context_index,
-    Node* is_predicted_as_caught) {
-  DCHECK_GE(context_length, Context::MIN_CONTEXT_SLOTS);
-
-  Node* const native_context = LoadNativeContext(context);
-
-  static const int kWrappedPromiseOffset = FixedArray::SizeFor(context_length);
-  static const int kThrowawayPromiseOffset =
-      kWrappedPromiseOffset + JSPromise::kSizeWithEmbedderFields;
-  static const int kResolveClosureOffset =
-      kThrowawayPromiseOffset + JSPromise::kSizeWithEmbedderFields;
-  static const int kRejectClosureOffset =
-      kResolveClosureOffset + JSFunction::kSizeWithoutPrototype;
-  static const int kTotalSize =
-      kRejectClosureOffset + JSFunction::kSizeWithoutPrototype;
-
-  Node* const base = AllocateInNewSpace(kTotalSize);
-  Node* const closure_context = base;
-  {
-    // Initialize closure context
-    InitializeFunctionContext(native_context, closure_context, context_length);
-    init_closure_context(closure_context);
-  }
-
-  // Let promiseCapability be ! NewPromiseCapability(%Promise%).
-  Node* const promise_fun =
-      LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
-  CSA_ASSERT(this, IsFunctionWithPrototypeSlotMap(LoadMap(promise_fun)));
-  Node* const promise_map =
-      LoadObjectField(promise_fun, JSFunction::kPrototypeOrInitialMapOffset);
-  // Assert that the JSPromise map has an instance size is
-  // JSPromise::kSizeWithEmbedderFields.
-  CSA_ASSERT(this, WordEqual(LoadMapInstanceSizeInWords(promise_map),
-                             IntPtrConstant(JSPromise::kSizeWithEmbedderFields /
-                                            kPointerSize)));
-  Node* const wrapped_value = InnerAllocate(base, kWrappedPromiseOffset);
-  {
-    // Initialize Promise
-    StoreMapNoWriteBarrier(wrapped_value, promise_map);
-    InitializeJSObjectFromMap(
-        wrapped_value, promise_map,
-        IntPtrConstant(JSPromise::kSizeWithEmbedderFields));
-    PromiseInit(wrapped_value);
-  }
-
-  Node* const throwaway = InnerAllocate(base, kThrowawayPromiseOffset);
-  {
-    // Initialize throwawayPromise
-    StoreMapNoWriteBarrier(throwaway, promise_map);
-    InitializeJSObjectFromMap(
-        throwaway, promise_map,
-        IntPtrConstant(JSPromise::kSizeWithEmbedderFields));
-    PromiseInit(throwaway);
-  }
-
-  Node* const on_resolve = InnerAllocate(base, kResolveClosureOffset);
-  {
-    // Initialize resolve handler
-    InitializeNativeClosure(closure_context, native_context, on_resolve,
-                            on_resolve_context_index);
-  }
-
-  Node* const on_reject = InnerAllocate(base, kRejectClosureOffset);
-  {
-    // Initialize reject handler
-    InitializeNativeClosure(closure_context, native_context, on_reject,
-                            on_reject_context_index);
-  }
-
-  {
-    // Add PromiseHooks if needed
-    Label next(this);
-    GotoIfNot(IsPromiseHookEnabledOrDebugIsActive(), &next);
-    CallRuntime(Runtime::kPromiseHookInit, context, wrapped_value,
-                outer_promise);
-    CallRuntime(Runtime::kPromiseHookInit, context, throwaway, wrapped_value);
-    Goto(&next);
-    BIND(&next);
-  }
-
-  // Perform ! Call(promiseCapability.[[Resolve]], undefined, « promise »).
-  CallBuiltin(Builtins::kResolveNativePromise, context, wrapped_value, value);
-
-  // The Promise will be thrown away and not handled, but it shouldn't trigger
-  // unhandled reject events as its work is done
-  PromiseSetHasHandler(throwaway);
-
-  Label do_perform_promise_then(this);
-  GotoIfNot(IsDebugActive(), &do_perform_promise_then);
-  {
-    Label common(this);
-    GotoIf(TaggedIsSmi(value), &common);
-    GotoIfNot(HasInstanceType(value, JS_PROMISE_TYPE), &common);
-    {
-      // Mark the reject handler callback to be a forwarding edge, rather
-      // than a meaningful catch handler
-      Node* const key =
-          HeapConstant(factory()->promise_forwarding_handler_symbol());
-      CallRuntime(Runtime::kSetProperty, context, on_reject, key,
-                  TrueConstant(), SmiConstant(LanguageMode::kStrict));
-
-      GotoIf(IsFalse(is_predicted_as_caught), &common);
-      PromiseSetHandledHint(value);
-    }
-
-    Goto(&common);
-    BIND(&common);
-    // Mark the dependency to outer Promise in case the throwaway Promise is
-    // found on the Promise stack
-    CSA_SLOW_ASSERT(this, HasInstanceType(outer_promise, JS_PROMISE_TYPE));
-
-    Node* const key = HeapConstant(factory()->promise_handled_by_symbol());
-    CallRuntime(Runtime::kSetProperty, context, throwaway, key, outer_promise,
-                SmiConstant(LanguageMode::kStrict));
-  }
-
-  Goto(&do_perform_promise_then);
-  BIND(&do_perform_promise_then);
-
-  CallBuiltin(Builtins::kPerformNativePromiseThen, context, wrapped_value,
-              on_resolve, on_reject, throwaway);
-
-  return wrapped_value;
-}
-
-void AsyncBuiltinsAssembler::InitializeNativeClosure(Node* context,
-                                                     Node* native_context,
-                                                     Node* function,
-                                                     Node* context_index) {
-  Node* const function_map = LoadContextElement(
-      native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
-  // Ensure that we don't have to initialize prototype_or_initial_map field of
-  // JSFunction.
-  CSA_ASSERT(this, WordEqual(LoadMapInstanceSizeInWords(function_map),
-                             IntPtrConstant(JSFunction::kSizeWithoutPrototype /
-                                            kPointerSize)));
-  STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kPointerSize);
-  StoreMapNoWriteBarrier(function, function_map);
-  StoreObjectFieldRoot(function, JSObject::kPropertiesOrHashOffset,
-                       Heap::kEmptyFixedArrayRootIndex);
-  StoreObjectFieldRoot(function, JSObject::kElementsOffset,
-                       Heap::kEmptyFixedArrayRootIndex);
-  StoreObjectFieldRoot(function, JSFunction::kFeedbackVectorOffset,
-                       Heap::kUndefinedCellRootIndex);
-
-  Node* shared_info = LoadContextElement(native_context, context_index);
-  CSA_ASSERT(this, IsSharedFunctionInfo(shared_info));
-  StoreObjectFieldNoWriteBarrier(
-      function, JSFunction::kSharedFunctionInfoOffset, shared_info);
-  StoreObjectFieldNoWriteBarrier(function, JSFunction::kContextOffset, context);
-
-  Node* const code =
-      LoadObjectField(shared_info, SharedFunctionInfo::kCodeOffset);
-  StoreObjectFieldNoWriteBarrier(function, JSFunction::kCodeOffset, code);
-}
-
 Node* AsyncBuiltinsAssembler::CreateUnwrapClosure(Node* native_context,
                                                   Node* done) {
   Node* const map = LoadContextElement(
diff --git a/deps/v8/src/builtins/builtins-async-gen.h b/deps/v8/src/builtins/builtins-async-gen.h
index 212b0b618b5..70f68a498b7 100644
--- a/deps/v8/src/builtins/builtins-async-gen.h
+++ b/deps/v8/src/builtins/builtins-async-gen.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_BUILTINS_BUILTINS_ASYNC_H_
-#define V8_BUILTINS_BUILTINS_ASYNC_H_
+#ifndef V8_BUILTINS_BUILTINS_ASYNC_GEN_H_
+#define V8_BUILTINS_BUILTINS_ASYNC_GEN_H_
 
 #include "src/builtins/builtins-promise-gen.h"
 
@@ -16,51 +16,26 @@ class AsyncBuiltinsAssembler : public PromiseBuiltinsAssembler {
       : PromiseBuiltinsAssembler(state) {}
 
  protected:
-  typedef std::function<void(Node*)> ContextInitializer;
-
-  // Perform steps to resume generator after `value` is resolved.
-  // `on_reject_context_index` is an index into the Native Context, which should
-  // point to a SharedFunctioninfo instance used to create the closure. The
-  // value following the reject index should be a similar value for the resolve
-  // closure. Returns the Promise-wrapped `value`.
-  Node* Await(Node* context, Node* generator, Node* value, Node* outer_promise,
-              int context_length,
-              const ContextInitializer& init_closure_context,
-              Node* on_resolve_context_index, Node* on_reject_context_index,
-              Node* is_predicted_as_caught);
-  Node* Await(Node* context, Node* generator, Node* value, Node* outer_promise,
-              int context_length,
-              const ContextInitializer& init_closure_context,
-              int on_resolve_context_index, int on_reject_context_index,
-              Node* is_predicted_as_caught) {
-    return Await(context, generator, value, outer_promise, context_length,
-                 init_closure_context, IntPtrConstant(on_resolve_context_index),
-                 IntPtrConstant(on_reject_context_index),
-                 is_predicted_as_caught);
-  }
-  Node* Await(Node* context, Node* generator, Node* value, Node* outer_promise,
-              int context_length,
-              const ContextInitializer& init_closure_context,
-              int on_resolve_context_index, int on_reject_context_index,
-              bool is_predicted_as_caught) {
-    return Await(context, generator, value, outer_promise, context_length,
-                 init_closure_context, on_resolve_context_index,
-                 on_reject_context_index,
-                 BooleanConstant(is_predicted_as_caught));
-  }
+  void Await(Node* context, Node* generator, Node* value, Node* outer_promise,
+             Builtins::Name fulfill_builtin, Builtins::Name reject_builtin,
+             Node* is_predicted_as_caught);
+  void Await(Node* context, Node* generator, Node* value, Node* outer_promise,
+             Builtins::Name fulfill_builtin, Builtins::Name reject_builtin,
+             bool is_predicted_as_caught);
 
   // Return a new built-in function object as defined in
   // Async Iterator Value Unwrap Functions
   Node* CreateUnwrapClosure(Node* const native_context, Node* const done);
 
  private:
-  void InitializeNativeClosure(Node* context, Node* native_context,
-                               Node* function, Node* context_index);
   Node* AllocateAsyncIteratorValueUnwrapContext(Node* native_context,
                                                 Node* done);
+  Node* AllocateAwaitPromiseJobTask(Node* generator, Node* fulfill_handler,
+                                    Node* reject_handler, Node* promise,
+                                    Node* context);
 };
 
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_BUILTINS_BUILTINS_ASYNC_H_
+#endif  // V8_BUILTINS_BUILTINS_ASYNC_GEN_H_
diff --git a/deps/v8/src/builtins/builtins-async-generator-gen.cc b/deps/v8/src/builtins/builtins-async-generator-gen.cc
index 70726a5f9d8..290252da624 100644
--- a/deps/v8/src/builtins/builtins-async-generator-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-generator-gen.cc
@@ -29,13 +29,13 @@ class AsyncGeneratorBuiltinsAssembler : public AsyncBuiltinsAssembler {
       : AsyncBuiltinsAssembler(state) {}
 
   inline Node* TaggedIsAsyncGenerator(Node* tagged_object) {
-    Node* if_notsmi = TaggedIsNotSmi(tagged_object);
-    return Select(if_notsmi,
-                  [=]() {
-                    return HasInstanceType(tagged_object,
-                                           JS_ASYNC_GENERATOR_OBJECT_TYPE);
-                  },
-                  [=]() { return if_notsmi; }, MachineRepresentation::kBit);
+    TNode<BoolT> if_notsmi = TaggedIsNotSmi(tagged_object);
+    return Select<BoolT>(if_notsmi,
+                         [=] {
+                           return HasInstanceType(
+                               tagged_object, JS_ASYNC_GENERATOR_OBJECT_TYPE);
+                         },
+                         [=] { return if_notsmi; });
   }
   inline Node* LoadGeneratorState(Node* const generator) {
     return LoadObjectField(generator, JSGeneratorObject::kContinuationOffset);
@@ -68,24 +68,24 @@ class AsyncGeneratorBuiltinsAssembler : public AsyncBuiltinsAssembler {
     return IsGeneratorStateNotExecuting(LoadGeneratorState(generator));
   }
 
-  inline Node* LoadGeneratorAwaitedPromise(Node* const generator) {
-    return LoadObjectField(generator,
-                           JSAsyncGeneratorObject::kAwaitedPromiseOffset);
+  inline Node* IsGeneratorAwaiting(Node* const generator) {
+    Node* is_generator_awaiting =
+        LoadObjectField(generator, JSAsyncGeneratorObject::kIsAwaitingOffset);
+    return SmiEqual(is_generator_awaiting, SmiConstant(1));
   }
 
-  inline Node* IsGeneratorNotSuspendedForAwait(Node* const generator) {
-    return IsUndefined(LoadGeneratorAwaitedPromise(generator));
-  }
-
-  inline Node* IsGeneratorSuspendedForAwait(Node* const generator) {
-    return HasInstanceType(LoadGeneratorAwaitedPromise(generator),
-                           JS_PROMISE_TYPE);
+  inline void SetGeneratorAwaiting(Node* const generator) {
+    CSA_ASSERT(this, Word32BinaryNot(IsGeneratorAwaiting(generator)));
+    StoreObjectFieldNoWriteBarrier(
+        generator, JSAsyncGeneratorObject::kIsAwaitingOffset, SmiConstant(1));
+    CSA_ASSERT(this, IsGeneratorAwaiting(generator));
   }
 
-  inline void ClearAwaitedPromise(Node* const generator) {
-    StoreObjectFieldRoot(generator,
-                         JSAsyncGeneratorObject::kAwaitedPromiseOffset,
-                         Heap::kUndefinedValueRootIndex);
+  inline void SetGeneratorNotAwaiting(Node* const generator) {
+    CSA_ASSERT(this, IsGeneratorAwaiting(generator));
+    StoreObjectFieldNoWriteBarrier(
+        generator, JSAsyncGeneratorObject::kIsAwaitingOffset, SmiConstant(0));
+    CSA_ASSERT(this, Word32BinaryNot(IsGeneratorAwaiting(generator)));
   }
 
   inline void CloseGenerator(Node* const generator) {
@@ -140,8 +140,8 @@ class AsyncGeneratorBuiltinsAssembler : public AsyncBuiltinsAssembler {
   // for AsyncGenerators.
   template <typename Descriptor>
   void AsyncGeneratorAwait(bool is_catchable);
-  void AsyncGeneratorAwaitResumeClosure(
-      Node* context, Node* value,
+  void AsyncGeneratorAwaitResume(
+      Node* context, Node* generator, Node* argument,
       JSAsyncGeneratorObject::ResumeMode resume_mode);
 };
 
@@ -193,7 +193,7 @@ void AsyncGeneratorBuiltinsAssembler::AsyncGeneratorEnqueue(
         MakeTypeError(MessageTemplate::kIncompatibleMethodReceiver, context,
                       StringConstant(method_name), generator);
 
-    CallBuiltin(Builtins::kRejectNativePromise, context, promise, error,
+    CallBuiltin(Builtins::kRejectPromise, context, promise, error,
                 TrueConstant());
     args->PopAndReturn(promise);
   }
@@ -219,21 +219,12 @@ Node* AsyncGeneratorBuiltinsAssembler::AllocateAsyncGeneratorRequest(
   return request;
 }
 
-void AsyncGeneratorBuiltinsAssembler::AsyncGeneratorAwaitResumeClosure(
-    Node* context, Node* value,
+void AsyncGeneratorBuiltinsAssembler::AsyncGeneratorAwaitResume(
+    Node* context, Node* generator, Node* argument,
     JSAsyncGeneratorObject::ResumeMode resume_mode) {
-  Node* const generator =
-      LoadContextElement(context, AwaitContext::kGeneratorSlot);
   CSA_SLOW_ASSERT(this, TaggedIsAsyncGenerator(generator));
 
-#if defined(DEBUG) && defined(ENABLE_SLOW_DCHECKS)
-  Node* const awaited_promise = LoadGeneratorAwaitedPromise(generator);
-  CSA_SLOW_ASSERT(this, HasInstanceType(awaited_promise, JS_PROMISE_TYPE));
-  CSA_SLOW_ASSERT(this, Word32NotEqual(PromiseStatus(awaited_promise),
-                                       Int32Constant(v8::Promise::kPending)));
-#endif
-
-  ClearAwaitedPromise(generator);
+  SetGeneratorNotAwaiting(generator);
 
   CSA_SLOW_ASSERT(this, IsGeneratorSuspended(generator));
 
@@ -242,40 +233,30 @@ void AsyncGeneratorBuiltinsAssembler::AsyncGeneratorAwaitResumeClosure(
                                  JSGeneratorObject::kResumeModeOffset,
                                  SmiConstant(resume_mode));
 
-  CallStub(CodeFactory::ResumeGenerator(isolate()), context, value, generator);
+  CallStub(CodeFactory::ResumeGenerator(isolate()), context, argument,
+           generator);
 
   TailCallBuiltin(Builtins::kAsyncGeneratorResumeNext, context, generator);
 }
 
 template <typename Descriptor>
 void AsyncGeneratorBuiltinsAssembler::AsyncGeneratorAwait(bool is_catchable) {
-  Node* generator = Parameter(Descriptor::kGenerator);
-  Node* value = Parameter(Descriptor::kAwaited);
-  Node* context = Parameter(Descriptor::kContext);
+  Node* const generator = Parameter(Descriptor::kGenerator);
+  Node* const value = Parameter(Descriptor::kValue);
+  Node* const context = Parameter(Descriptor::kContext);
 
   CSA_SLOW_ASSERT(this, TaggedIsAsyncGenerator(generator));
 
   Node* const request = LoadFirstAsyncGeneratorRequestFromQueue(generator);
   CSA_ASSERT(this, IsNotUndefined(request));
 
-  ContextInitializer init_closure_context = [&](Node* context) {
-    StoreContextElementNoWriteBarrier(context, AwaitContext::kGeneratorSlot,
-                                      generator);
-  };
-
   Node* outer_promise =
       LoadObjectField(request, AsyncGeneratorRequest::kPromiseOffset);
 
-  const int resolve_index = Context::ASYNC_GENERATOR_AWAIT_RESOLVE_SHARED_FUN;
-  const int reject_index = Context::ASYNC_GENERATOR_AWAIT_REJECT_SHARED_FUN;
-
-  Node* promise =
-      Await(context, generator, value, outer_promise, AwaitContext::kLength,
-            init_closure_context, resolve_index, reject_index, is_catchable);
-
-  CSA_SLOW_ASSERT(this, IsGeneratorNotSuspendedForAwait(generator));
-  StoreObjectField(generator, JSAsyncGeneratorObject::kAwaitedPromiseOffset,
-                   promise);
+  SetGeneratorAwaiting(generator);
+  Await(context, generator, value, outer_promise,
+        Builtins::kAsyncGeneratorAwaitFulfill,
+        Builtins::kAsyncGeneratorAwaitReject, is_catchable);
   Return(UndefinedConstant());
 }
 
@@ -386,18 +367,20 @@ TF_BUILTIN(AsyncGeneratorPrototypeThrow, AsyncGeneratorBuiltinsAssembler) {
                         "[AsyncGenerator].prototype.throw");
 }
 
-TF_BUILTIN(AsyncGeneratorAwaitResolveClosure, AsyncGeneratorBuiltinsAssembler) {
-  Node* value = Parameter(Descriptor::kValue);
-  Node* context = Parameter(Descriptor::kContext);
-  AsyncGeneratorAwaitResumeClosure(context, value,
-                                   JSAsyncGeneratorObject::kNext);
+TF_BUILTIN(AsyncGeneratorAwaitFulfill, AsyncGeneratorBuiltinsAssembler) {
+  Node* const generator = Parameter(Descriptor::kGenerator);
+  Node* const argument = Parameter(Descriptor::kArgument);
+  Node* const context = Parameter(Descriptor::kContext);
+  AsyncGeneratorAwaitResume(context, generator, argument,
+                            JSAsyncGeneratorObject::kNext);
 }
 
-TF_BUILTIN(AsyncGeneratorAwaitRejectClosure, AsyncGeneratorBuiltinsAssembler) {
-  Node* value = Parameter(Descriptor::kValue);
-  Node* context = Parameter(Descriptor::kContext);
-  AsyncGeneratorAwaitResumeClosure(context, value,
-                                   JSAsyncGeneratorObject::kThrow);
+TF_BUILTIN(AsyncGeneratorAwaitReject, AsyncGeneratorBuiltinsAssembler) {
+  Node* const generator = Parameter(Descriptor::kGenerator);
+  Node* const argument = Parameter(Descriptor::kArgument);
+  Node* const context = Parameter(Descriptor::kContext);
+  AsyncGeneratorAwaitResume(context, generator, argument,
+                            JSAsyncGeneratorObject::kThrow);
 }
 
 TF_BUILTIN(AsyncGeneratorAwaitUncaught, AsyncGeneratorBuiltinsAssembler) {
@@ -435,7 +418,7 @@ TF_BUILTIN(AsyncGeneratorResumeNext, AsyncGeneratorBuiltinsAssembler) {
   CSA_ASSERT(this, IsGeneratorNotExecuting(generator));
 
   // Stop resuming if suspended for Await.
-  ReturnIf(IsGeneratorSuspendedForAwait(generator), UndefinedConstant());
+  ReturnIf(IsGeneratorAwaiting(generator), UndefinedConstant());
 
   // Stop resuming if request queue is empty.
   ReturnIf(IsUndefined(var_next.value()), UndefinedConstant());
@@ -452,10 +435,9 @@ TF_BUILTIN(AsyncGeneratorResumeNext, AsyncGeneratorBuiltinsAssembler) {
               &settle_promise);
     CloseGenerator(generator);
     var_state.Bind(SmiConstant(JSGeneratorObject::kGeneratorClosed));
-
     Goto(&settle_promise);
-    BIND(&settle_promise);
 
+    BIND(&settle_promise);
     Node* next_value = LoadValueFromAsyncGeneratorRequest(next);
     Branch(SmiEqual(resume_type, SmiConstant(JSGeneratorObject::kReturn)),
            &if_return, &if_throw);
@@ -511,7 +493,7 @@ TF_BUILTIN(AsyncGeneratorResolve, AsyncGeneratorBuiltinsAssembler) {
   Node* const context = Parameter(Descriptor::kContext);
 
   CSA_SLOW_ASSERT(this, TaggedIsAsyncGenerator(generator));
-  CSA_ASSERT(this, IsGeneratorNotSuspendedForAwait(generator));
+  CSA_ASSERT(this, Word32BinaryNot(IsGeneratorAwaiting(generator)));
 
   // If this assertion fails, the `value` component was not Awaited as it should
   // have been, per https://github.com/tc39/proposal-async-iteration/pull/102/.
@@ -536,11 +518,34 @@ TF_BUILTIN(AsyncGeneratorResolve, AsyncGeneratorBuiltinsAssembler) {
                                    done);
   }
 
-  // Perform Call(promiseCapability.[[Resolve]], undefined, «iteratorResult»).
-  CallBuiltin(Builtins::kResolveNativePromise, context, promise, iter_result);
+  // We know that {iter_result} itself doesn't have any "then" property and
+  // we also know that the [[Prototype]] of {iter_result} is the intrinsic
+  // %ObjectPrototype%. So we can skip the [[Resolve]] logic here completely
+  // and directly call into the FulfillPromise operation if we can prove
+  // that the %ObjectPrototype% also doesn't have any "then" property. This
+  // is guarded by the Promise#then protector.
+  Label if_fast(this), if_slow(this, Label::kDeferred), return_promise(this);
+  GotoIfForceSlowPath(&if_slow);
+  Branch(IsPromiseThenProtectorCellInvalid(), &if_slow, &if_fast);
+
+  BIND(&if_fast);
+  {
+    // Skip the "then" on {iter_result} and directly fulfill the {promise}
+    // with the {iter_result}.
+    CallBuiltin(Builtins::kFulfillPromise, context, promise, iter_result);
+    Goto(&return_promise);
+  }
+
+  BIND(&if_slow);
+  {
+    // Perform Call(promiseCapability.[[Resolve]], undefined, «iteratorResult»).
+    CallBuiltin(Builtins::kResolvePromise, context, promise, iter_result);
+    Goto(&return_promise);
+  }
 
   // Per spec, AsyncGeneratorResolve() returns undefined. However, for the
   // benefit of %TraceExit(), return the Promise.
+  BIND(&return_promise);
   Return(promise);
 }
 
@@ -553,7 +558,7 @@ TF_BUILTIN(AsyncGeneratorReject, AsyncGeneratorBuiltinsAssembler) {
   Node* const next = TakeFirstAsyncGeneratorRequestFromQueue(generator);
   Node* const promise = LoadPromiseFromAsyncGeneratorRequest(next);
 
-  Return(CallBuiltin(Builtins::kRejectNativePromise, context, promise, value,
+  Return(CallBuiltin(Builtins::kRejectPromise, context, promise, value,
                      TrueConstant()));
 }
 
@@ -566,34 +571,54 @@ TF_BUILTIN(AsyncGeneratorYield, AsyncGeneratorBuiltinsAssembler) {
   Node* const request = LoadFirstAsyncGeneratorRequestFromQueue(generator);
   Node* const outer_promise = LoadPromiseFromAsyncGeneratorRequest(request);
 
-  ContextInitializer init_closure_context = [&](Node* context) {
-    StoreContextElementNoWriteBarrier(context, AwaitContext::kGeneratorSlot,
-                                      generator);
-  };
-
-  const int on_resolve = Context::ASYNC_GENERATOR_YIELD_RESOLVE_SHARED_FUN;
-  const int on_reject = Context::ASYNC_GENERATOR_AWAIT_REJECT_SHARED_FUN;
+  // Mark the generator as "awaiting".
+  SetGeneratorAwaiting(generator);
+
+  // We can skip the creation of a temporary promise and the whole
+  // [[Resolve]] logic if we already know that the {value} that's
+  // being yielded is a primitive, as in that case we would immediately
+  // fulfill the temporary promise anyways and schedule a fulfill
+  // reaction job. This gives a nice performance boost for async
+  // generators that yield only primitives, e.g. numbers or strings.
+  Label if_primitive(this), if_generic(this);
+  GotoIfForceSlowPath(&if_generic);
+  GotoIf(IsPromiseHookEnabledOrDebugIsActive(), &if_generic);
+  GotoIf(TaggedIsSmi(value), &if_primitive);
+  Branch(IsJSReceiver(value), &if_generic, &if_primitive);
+
+  BIND(&if_generic);
+  {
+    Await(context, generator, value, outer_promise,
+          Builtins::kAsyncGeneratorYieldFulfill,
+          Builtins::kAsyncGeneratorAwaitReject, is_caught);
+    Return(UndefinedConstant());
+  }
 
-  Node* const promise =
-      Await(context, generator, value, outer_promise, AwaitContext::kLength,
-            init_closure_context, on_resolve, on_reject, is_caught);
-  StoreObjectField(generator, JSAsyncGeneratorObject::kAwaitedPromiseOffset,
-                   promise);
-  Return(UndefinedConstant());
+  BIND(&if_primitive);
+  {
+    // For primitive {value}s we can skip the allocation of the temporary
+    // promise and the resolution of that, and directly allocate the fulfill
+    // reaction job.
+    Node* const microtask = AllocatePromiseReactionJobTask(
+        Heap::kPromiseFulfillReactionJobTaskMapRootIndex, context, value,
+        HeapConstant(Builtins::CallableFor(
+                         isolate(), Builtins::kAsyncGeneratorYieldFulfill)
+                         .code()),
+        generator);
+    TailCallBuiltin(Builtins::kEnqueueMicrotask, context, microtask);
+  }
 }
 
-TF_BUILTIN(AsyncGeneratorYieldResolveClosure, AsyncGeneratorBuiltinsAssembler) {
+TF_BUILTIN(AsyncGeneratorYieldFulfill, AsyncGeneratorBuiltinsAssembler) {
   Node* const context = Parameter(Descriptor::kContext);
-  Node* const value = Parameter(Descriptor::kValue);
-  Node* const generator =
-      LoadContextElement(context, AwaitContext::kGeneratorSlot);
+  Node* const generator = Parameter(Descriptor::kGenerator);
+  Node* const argument = Parameter(Descriptor::kArgument);
 
-  CSA_SLOW_ASSERT(this, IsGeneratorSuspendedForAwait(generator));
-  ClearAwaitedPromise(generator);
+  SetGeneratorNotAwaiting(generator);
 
   // Per proposal-async-iteration/#sec-asyncgeneratoryield step 9
   // Return ! AsyncGeneratorResolve(_F_.[[Generator]], _value_, *false*).
-  CallBuiltin(Builtins::kAsyncGeneratorResolve, context, generator, value,
+  CallBuiltin(Builtins::kAsyncGeneratorResolve, context, generator, argument,
               FalseConstant());
 
   TailCallBuiltin(Builtins::kAsyncGeneratorResumeNext, context, generator);
@@ -619,42 +644,33 @@ TF_BUILTIN(AsyncGeneratorReturn, AsyncGeneratorBuiltinsAssembler) {
   Node* const generator = Parameter(Descriptor::kGenerator);
   Node* const value = Parameter(Descriptor::kValue);
   Node* const is_caught = Parameter(Descriptor::kIsCaught);
+  Node* const context = Parameter(Descriptor::kContext);
   Node* const req = LoadFirstAsyncGeneratorRequestFromQueue(generator);
+  Node* const outer_promise = LoadPromiseFromAsyncGeneratorRequest(req);
   CSA_ASSERT(this, IsNotUndefined(req));
 
-  Label perform_await(this);
-  VARIABLE(var_on_resolve, MachineType::PointerRepresentation(),
-           IntPtrConstant(
-               Context::ASYNC_GENERATOR_RETURN_CLOSED_RESOLVE_SHARED_FUN));
-  VARIABLE(
-      var_on_reject, MachineType::PointerRepresentation(),
-      IntPtrConstant(Context::ASYNC_GENERATOR_RETURN_CLOSED_REJECT_SHARED_FUN));
-
+  Label if_closed(this, Label::kDeferred), if_not_closed(this), done(this);
   Node* const state = LoadGeneratorState(generator);
-  GotoIf(IsGeneratorStateClosed(state), &perform_await);
-  var_on_resolve.Bind(
-      IntPtrConstant(Context::ASYNC_GENERATOR_RETURN_RESOLVE_SHARED_FUN));
-  var_on_reject.Bind(
-      IntPtrConstant(Context::ASYNC_GENERATOR_AWAIT_REJECT_SHARED_FUN));
-  Goto(&perform_await);
+  SetGeneratorAwaiting(generator);
+  Branch(IsGeneratorStateClosed(state), &if_closed, &if_not_closed);
 
-  BIND(&perform_await);
+  BIND(&if_closed);
+  {
+    Await(context, generator, value, outer_promise,
+          Builtins::kAsyncGeneratorReturnClosedFulfill,
+          Builtins::kAsyncGeneratorReturnClosedReject, is_caught);
+    Goto(&done);
+  }
 
-  ContextInitializer init_closure_context = [&](Node* context) {
-    StoreContextElementNoWriteBarrier(context, AwaitContext::kGeneratorSlot,
-                                      generator);
-  };
+  BIND(&if_not_closed);
+  {
+    Await(context, generator, value, outer_promise,
+          Builtins::kAsyncGeneratorReturnFulfill,
+          Builtins::kAsyncGeneratorAwaitReject, is_caught);
+    Goto(&done);
+  }
 
-  Node* const context = Parameter(Descriptor::kContext);
-  Node* const outer_promise = LoadPromiseFromAsyncGeneratorRequest(req);
-  Node* const promise =
-      Await(context, generator, value, outer_promise, AwaitContext::kLength,
-            init_closure_context, var_on_resolve.value(), var_on_reject.value(),
-            is_caught);
-
-  CSA_SLOW_ASSERT(this, IsGeneratorNotSuspendedForAwait(generator));
-  StoreObjectField(generator, JSAsyncGeneratorObject::kAwaitedPromiseOffset,
-                   promise);
+  BIND(&done);
   Return(UndefinedConstant());
 }
 
@@ -662,49 +678,44 @@ TF_BUILTIN(AsyncGeneratorReturn, AsyncGeneratorBuiltinsAssembler) {
 // Resume the generator with "return" resume_mode, and finally perform
 // AsyncGeneratorResumeNext. Per
 // proposal-async-iteration/#sec-asyncgeneratoryield step 8.e
-TF_BUILTIN(AsyncGeneratorReturnResolveClosure,
-           AsyncGeneratorBuiltinsAssembler) {
+TF_BUILTIN(AsyncGeneratorReturnFulfill, AsyncGeneratorBuiltinsAssembler) {
+  Node* const generator = Parameter(Descriptor::kGenerator);
+  Node* const argument = Parameter(Descriptor::kArgument);
   Node* const context = Parameter(Descriptor::kContext);
-  Node* const value = Parameter(Descriptor::kValue);
-  AsyncGeneratorAwaitResumeClosure(context, value, JSGeneratorObject::kReturn);
+  AsyncGeneratorAwaitResume(context, generator, argument,
+                            JSGeneratorObject::kReturn);
 }
 
 // On-resolve closure for Await in AsyncGeneratorReturn
 // Perform AsyncGeneratorResolve({awaited_value}, true) and finally perform
 // AsyncGeneratorResumeNext.
-TF_BUILTIN(AsyncGeneratorReturnClosedResolveClosure,
-           AsyncGeneratorBuiltinsAssembler) {
+TF_BUILTIN(AsyncGeneratorReturnClosedFulfill, AsyncGeneratorBuiltinsAssembler) {
+  Node* const generator = Parameter(Descriptor::kGenerator);
+  Node* const argument = Parameter(Descriptor::kArgument);
   Node* const context = Parameter(Descriptor::kContext);
-  Node* const value = Parameter(Descriptor::kValue);
-  Node* const generator =
-      LoadContextElement(context, AwaitContext::kGeneratorSlot);
 
-  CSA_SLOW_ASSERT(this, IsGeneratorSuspendedForAwait(generator));
-  ClearAwaitedPromise(generator);
+  SetGeneratorNotAwaiting(generator);
 
   // https://tc39.github.io/proposal-async-iteration/
   //    #async-generator-resume-next-return-processor-fulfilled step 2:
   //  Return ! AsyncGeneratorResolve(_F_.[[Generator]], _value_, *true*).
-  CallBuiltin(Builtins::kAsyncGeneratorResolve, context, generator, value,
+  CallBuiltin(Builtins::kAsyncGeneratorResolve, context, generator, argument,
               TrueConstant());
 
   TailCallBuiltin(Builtins::kAsyncGeneratorResumeNext, context, generator);
 }
 
-TF_BUILTIN(AsyncGeneratorReturnClosedRejectClosure,
-           AsyncGeneratorBuiltinsAssembler) {
+TF_BUILTIN(AsyncGeneratorReturnClosedReject, AsyncGeneratorBuiltinsAssembler) {
+  Node* const generator = Parameter(Descriptor::kGenerator);
+  Node* const argument = Parameter(Descriptor::kArgument);
   Node* const context = Parameter(Descriptor::kContext);
-  Node* const value = Parameter(Descriptor::kValue);
-  Node* const generator =
-      LoadContextElement(context, AwaitContext::kGeneratorSlot);
 
-  CSA_SLOW_ASSERT(this, IsGeneratorSuspendedForAwait(generator));
-  ClearAwaitedPromise(generator);
+  SetGeneratorNotAwaiting(generator);
 
   // https://tc39.github.io/proposal-async-iteration/
   //    #async-generator-resume-next-return-processor-rejected step 2:
   // Return ! AsyncGeneratorReject(_F_.[[Generator]], _reason_).
-  CallBuiltin(Builtins::kAsyncGeneratorReject, context, generator, value);
+  CallBuiltin(Builtins::kAsyncGeneratorReject, context, generator, argument);
 
   TailCallBuiltin(Builtins::kAsyncGeneratorResumeNext, context, generator);
 }
diff --git a/deps/v8/src/builtins/builtins-async-iterator-gen.cc b/deps/v8/src/builtins/builtins-async-iterator-gen.cc
index f232b32700f..58691bd00e6 100644
--- a/deps/v8/src/builtins/builtins-async-iterator-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-iterator-gen.cc
@@ -28,13 +28,29 @@ class AsyncFromSyncBuiltinsAssembler : public AsyncBuiltinsAssembler {
   typedef std::function<void(Node* const context, Node* const promise,
                              Label* if_exception)>
       UndefinedMethodHandler;
+  typedef std::function<Node*(Node*)> SyncIteratorNodeGenerator;
   void Generate_AsyncFromSyncIteratorMethod(
       Node* const context, Node* const iterator, Node* const sent_value,
-      Handle<Name> method_name, UndefinedMethodHandler&& if_method_undefined,
+      const SyncIteratorNodeGenerator& get_method,
+      const UndefinedMethodHandler& if_method_undefined,
       const char* operation_name,
       Label::Type reject_label_type = Label::kDeferred,
       Node* const initial_exception_value = nullptr);
 
+  void Generate_AsyncFromSyncIteratorMethod(
+      Node* const context, Node* const iterator, Node* const sent_value,
+      Handle<String> name, const UndefinedMethodHandler& if_method_undefined,
+      const char* operation_name,
+      Label::Type reject_label_type = Label::kDeferred,
+      Node* const initial_exception_value = nullptr) {
+    auto get_method = [=](Node* const sync_iterator) {
+      return GetProperty(context, sync_iterator, name);
+    };
+    return Generate_AsyncFromSyncIteratorMethod(
+        context, iterator, sent_value, get_method, if_method_undefined,
+        operation_name, reject_label_type, initial_exception_value);
+  }
+
   // Load "value" and "done" from an iterator result object. If an exception
   // is thrown at any point, jumps to te `if_exception` label with exception
   // stored in `var_exception`.
@@ -79,7 +95,8 @@ void AsyncFromSyncBuiltinsAssembler::ThrowIfNotAsyncFromSyncIterator(
 
 void AsyncFromSyncBuiltinsAssembler::Generate_AsyncFromSyncIteratorMethod(
     Node* const context, Node* const iterator, Node* const sent_value,
-    Handle<Name> method_name, UndefinedMethodHandler&& if_method_undefined,
+    const SyncIteratorNodeGenerator& get_method,
+    const UndefinedMethodHandler& if_method_undefined,
     const char* operation_name, Label::Type reject_label_type,
     Node* const initial_exception_value) {
   Node* const native_context = LoadNativeContext(context);
@@ -96,7 +113,7 @@ void AsyncFromSyncBuiltinsAssembler::Generate_AsyncFromSyncIteratorMethod(
   Node* const sync_iterator =
       LoadObjectField(iterator, JSAsyncFromSyncIterator::kSyncIteratorOffset);
 
-  Node* const method = GetProperty(context, sync_iterator, method_name);
+  Node* const method = get_method(sync_iterator);
 
   if (if_method_undefined) {
     Label if_isnotundefined(this);
@@ -119,7 +136,7 @@ void AsyncFromSyncBuiltinsAssembler::Generate_AsyncFromSyncIteratorMethod(
 
   // Perform ! Call(valueWrapperCapability.[[Resolve]], undefined, «
   // throwValue »).
-  CallBuiltin(Builtins::kResolveNativePromise, context, wrapper, value);
+  CallBuiltin(Builtins::kResolvePromise, context, wrapper, value);
 
   // Let onFulfilled be a new built-in function object as defined in
   // Async Iterator Value Unwrap Functions.
@@ -128,13 +145,13 @@ void AsyncFromSyncBuiltinsAssembler::Generate_AsyncFromSyncIteratorMethod(
 
   // Perform ! PerformPromiseThen(valueWrapperCapability.[[Promise]],
   //     onFulfilled, undefined, promiseCapability).
-  Return(CallBuiltin(Builtins::kPerformNativePromiseThen, context, wrapper,
+  Return(CallBuiltin(Builtins::kPerformPromiseThen, context, wrapper,
                      on_fulfilled, UndefinedConstant(), promise));
 
   BIND(&reject_promise);
   {
     Node* const exception = var_exception.value();
-    CallBuiltin(Builtins::kRejectNativePromise, context, promise, exception,
+    CallBuiltin(Builtins::kRejectPromise, context, promise, exception,
                 TrueConstant());
     Return(promise);
   }
@@ -211,6 +228,7 @@ std::pair<Node*, Node*> AsyncFromSyncBuiltinsAssembler::LoadIteratorResult(
   BIND(&done);
   return std::make_pair(var_value.value(), var_done.value());
 }
+
 }  // namespace
 
 // https://tc39.github.io/proposal-async-iteration/
@@ -220,9 +238,12 @@ TF_BUILTIN(AsyncFromSyncIteratorPrototypeNext, AsyncFromSyncBuiltinsAssembler) {
   Node* const value = Parameter(Descriptor::kValue);
   Node* const context = Parameter(Descriptor::kContext);
 
+  auto get_method = [=](Node* const unused) {
+    return LoadObjectField(iterator, JSAsyncFromSyncIterator::kNextOffset);
+  };
   Generate_AsyncFromSyncIteratorMethod(
-      context, iterator, value, factory()->next_string(),
-      UndefinedMethodHandler(), "[Async-from-Sync Iterator].prototype.next");
+      context, iterator, value, get_method, UndefinedMethodHandler(),
+      "[Async-from-Sync Iterator].prototype.next");
 }
 
 // https://tc39.github.io/proposal-async-iteration/
@@ -243,7 +264,7 @@ TF_BUILTIN(AsyncFromSyncIteratorPrototypeReturn,
     // Perform ! Call(promiseCapability.[[Resolve]], undefined, « iterResult »).
     // IfAbruptRejectPromise(nextDone, promiseCapability).
     // Return promiseCapability.[[Promise]].
-    PromiseFulfill(context, promise, iter_result, v8::Promise::kFulfilled);
+    CallBuiltin(Builtins::kResolvePromise, context, promise, iter_result);
     Return(promise);
   };
 
diff --git a/deps/v8/src/builtins/builtins-bigint.cc b/deps/v8/src/builtins/builtins-bigint.cc
index 6d9bb6e7977..6c04c9dcb71 100644
--- a/deps/v8/src/builtins/builtins-bigint.cc
+++ b/deps/v8/src/builtins/builtins-bigint.cc
@@ -13,54 +13,26 @@ namespace internal {
 
 BUILTIN(BigIntConstructor) {
   HandleScope scope(isolate);
-  Handle<Object> value = args.atOrUndefined(isolate, 1);
-
-  if (value->IsJSReceiver()) {
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, value,
-        JSReceiver::ToPrimitive(Handle<JSReceiver>::cast(value),
-                                ToPrimitiveHint::kNumber));
-  }
-
-  if (value->IsNumber()) {
-    RETURN_RESULT_OR_FAILURE(isolate, BigInt::FromNumber(isolate, value));
-  } else {
-    RETURN_RESULT_OR_FAILURE(isolate, BigInt::FromObject(isolate, value));
-  }
-}
-
-BUILTIN(BigIntConstructor_ConstructStub) {
-  HandleScope scope(isolate);
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate, NewTypeError(MessageTemplate::kNotConstructor,
-                            isolate->factory()->BigInt_string()));
-}
-
-BUILTIN(BigIntParseInt) {
-  HandleScope scope(isolate);
-  Handle<Object> string = args.atOrUndefined(isolate, 1);
-  Handle<Object> radix = args.atOrUndefined(isolate, 2);
-
-  // Convert {string} to a String and flatten it.
-  // Fast path: avoid back-and-forth conversion for Smi inputs.
-  if (string->IsSmi() && radix->IsUndefined(isolate)) {
-    RETURN_RESULT_OR_FAILURE(isolate, BigInt::FromNumber(isolate, string));
-  }
-  Handle<String> subject;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, subject,
-                                     Object::ToString(isolate, string));
-  subject = String::Flatten(subject);
-
-  // Convert {radix} to Int32.
-  if (!radix->IsNumber()) {
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, radix, Object::ToNumber(radix));
-  }
-  int radix32 = DoubleToInt32(radix->Number());
-  if (radix32 != 0 && (radix32 < 2 || radix32 > 36)) {
+  if (args.new_target()->IsUndefined(isolate)) {  // [[Call]]
+    Handle<Object> value = args.atOrUndefined(isolate, 1);
+
+    if (value->IsJSReceiver()) {
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+          isolate, value,
+          JSReceiver::ToPrimitive(Handle<JSReceiver>::cast(value),
+                                  ToPrimitiveHint::kNumber));
+    }
+
+    if (value->IsNumber()) {
+      RETURN_RESULT_OR_FAILURE(isolate, BigInt::FromNumber(isolate, value));
+    } else {
+      RETURN_RESULT_OR_FAILURE(isolate, BigInt::FromObject(isolate, value));
+    }
+  } else {  // [[Construct]]
     THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate, NewSyntaxError(MessageTemplate::kToRadixFormatRange));
+        isolate, NewTypeError(MessageTemplate::kNotConstructor,
+                              isolate->factory()->BigInt_string()));
   }
-  RETURN_RESULT_OR_FAILURE(isolate, BigIntParseInt(isolate, subject, radix32));
 }
 
 BUILTIN(BigIntAsUintN) {
@@ -97,14 +69,6 @@ BUILTIN(BigIntAsIntN) {
   return *BigInt::AsIntN(bits->Number(), bigint);
 }
 
-BUILTIN(BigIntPrototypeToLocaleString) {
-  HandleScope scope(isolate);
-
-  // TODO(jkummerow): Implement.
-
-  UNIMPLEMENTED();
-}
-
 namespace {
 
 MaybeHandle<BigInt> ThisBigIntValue(Isolate* isolate, Handle<Object> value,
@@ -127,18 +91,14 @@ MaybeHandle<BigInt> ThisBigIntValue(Isolate* isolate, Handle<Object> value,
       BigInt);
 }
 
-}  // namespace
-
-BUILTIN(BigIntPrototypeToString) {
-  HandleScope scope(isolate);
+Object* BigIntToStringImpl(Handle<Object> receiver, Handle<Object> radix,
+                           Isolate* isolate, const char* builtin_name) {
   // 1. Let x be ? thisBigIntValue(this value).
   Handle<BigInt> x;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, x,
-      ThisBigIntValue(isolate, args.receiver(), "BigInt.prototype.toString"));
+      isolate, x, ThisBigIntValue(isolate, receiver, builtin_name));
   // 2. If radix is not present, let radixNumber be 10.
   // 3. Else if radix is undefined, let radixNumber be 10.
-  Handle<Object> radix = args.atOrUndefined(isolate, 1);
   int radix_number;
   if (radix->IsUndefined(isolate)) {
     radix_number = 10;
@@ -158,6 +118,22 @@ BUILTIN(BigIntPrototypeToString) {
   RETURN_RESULT_OR_FAILURE(isolate, BigInt::ToString(x, radix_number));
 }
 
+}  // namespace
+
+BUILTIN(BigIntPrototypeToLocaleString) {
+  HandleScope scope(isolate);
+  Handle<Object> radix = isolate->factory()->undefined_value();
+  return BigIntToStringImpl(args.receiver(), radix, isolate,
+                            "BigInt.prototype.toLocaleString");
+}
+
+BUILTIN(BigIntPrototypeToString) {
+  HandleScope scope(isolate);
+  Handle<Object> radix = args.atOrUndefined(isolate, 1);
+  return BigIntToStringImpl(args.receiver(), radix, isolate,
+                            "BigInt.prototype.toString");
+}
+
 BUILTIN(BigIntPrototypeValueOf) {
   HandleScope scope(isolate);
   RETURN_RESULT_OR_FAILURE(
diff --git a/deps/v8/src/builtins/builtins-boolean.cc b/deps/v8/src/builtins/builtins-boolean.cc
index dabd803dc18..5dc42d506f3 100644
--- a/deps/v8/src/builtins/builtins-boolean.cc
+++ b/deps/v8/src/builtins/builtins-boolean.cc
@@ -11,28 +11,27 @@ namespace v8 {
 namespace internal {
 
 // -----------------------------------------------------------------------------
-// ES6 section 19.3 Boolean Objects
+// ES #sec-boolean-objects
 
-// ES6 section 19.3.1.1 Boolean ( value ) for the [[Call]] case.
+// ES #sec-boolean-constructor
 BUILTIN(BooleanConstructor) {
   HandleScope scope(isolate);
-  Handle<Object> value = args.atOrUndefined(isolate, 1);
-  return isolate->heap()->ToBoolean(value->BooleanValue());
-}
-
-// ES6 section 19.3.1.1 Boolean ( value ) for the [[Construct]] case.
-BUILTIN(BooleanConstructor_ConstructStub) {
-  HandleScope scope(isolate);
-  Handle<Object> value = args.atOrUndefined(isolate, 1);
-  Handle<JSFunction> target = args.target();
-  Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
-  DCHECK(*target == target->native_context()->boolean_function());
-  Handle<JSObject> result;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
-                                     JSObject::New(target, new_target));
-  Handle<JSValue>::cast(result)->set_value(
-      isolate->heap()->ToBoolean(value->BooleanValue()));
-  return *result;
+  if (args.new_target()->IsUndefined(isolate)) {  // [[Call]]
+    Handle<Object> value = args.atOrUndefined(isolate, 1);
+    return isolate->heap()->ToBoolean(value->BooleanValue());
+  } else {  // [[Construct]]
+    HandleScope scope(isolate);
+    Handle<Object> value = args.atOrUndefined(isolate, 1);
+    Handle<JSFunction> target = args.target();
+    Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
+    DCHECK(*target == target->native_context()->boolean_function());
+    Handle<JSObject> result;
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
+                                       JSObject::New(target, new_target));
+    Handle<JSValue>::cast(result)->set_value(
+        isolate->heap()->ToBoolean(value->BooleanValue()));
+    return *result;
+  }
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-call-gen.cc b/deps/v8/src/builtins/builtins-call-gen.cc
index d4a7153d744..34c88670f46 100644
--- a/deps/v8/src/builtins/builtins-call-gen.cc
+++ b/deps/v8/src/builtins/builtins-call-gen.cc
@@ -168,7 +168,7 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
     Node* elements_length = LoadFixedArrayBaseLength(elements);
     GotoIfNot(WordEqual(length, elements_length), &if_runtime);
     var_elements.Bind(elements);
-    var_length.Bind(SmiToWord32(length));
+    var_length.Bind(SmiToInt32(length));
     Goto(&if_done);
   }
 
@@ -268,95 +268,88 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructDoubleVarargs(
 void CallOrConstructBuiltinsAssembler::CallOrConstructWithSpread(
     Node* target, Node* new_target, Node* spread, Node* args_count,
     Node* context) {
-  Label if_done(this), if_holey(this), if_runtime(this, Label::kDeferred);
+  Label if_smiorobject(this), if_double(this),
+      if_generic(this, Label::kDeferred);
 
-  VARIABLE(spread_result, MachineRepresentation::kTagged, spread);
+  VARIABLE(var_length, MachineRepresentation::kWord32);
+  VARIABLE(var_elements, MachineRepresentation::kTagged);
+  VARIABLE(var_elements_kind, MachineRepresentation::kWord32);
 
-  GotoIf(TaggedIsSmi(spread), &if_runtime);
+  GotoIf(TaggedIsSmi(spread), &if_generic);
   Node* spread_map = LoadMap(spread);
-  GotoIfNot(IsJSArrayMap(spread_map), &if_runtime);
+  GotoIfNot(IsJSArrayMap(spread_map), &if_generic);
 
-  // Check that we have the original ArrayPrototype.
-  GotoIfNot(IsPrototypeInitialArrayPrototype(context, spread_map), &if_runtime);
+  // Check that we have the original Array.prototype.
+  GotoIfNot(IsPrototypeInitialArrayPrototype(context, spread_map), &if_generic);
 
-  // Check that the ArrayPrototype hasn't been modified in a way that would
+  // Check that there are no elements on the Array.prototype chain.
+  GotoIf(IsNoElementsProtectorCellInvalid(), &if_generic);
+
+  // Check that the Array.prototype hasn't been modified in a way that would
   // affect iteration.
   Node* protector_cell = LoadRoot(Heap::kArrayIteratorProtectorRootIndex);
   DCHECK(isolate()->heap()->array_iterator_protector()->IsPropertyCell());
-  GotoIfNot(
-      WordEqual(LoadObjectField(protector_cell, PropertyCell::kValueOffset),
-                SmiConstant(Isolate::kProtectorValid)),
-      &if_runtime);
-
-  // Check that the map of the initial array iterator hasn't changed.
-  Node* native_context = LoadNativeContext(context);
-  Node* arr_it_proto_map = LoadMap(CAST(LoadContextElement(
-      native_context, Context::INITIAL_ARRAY_ITERATOR_PROTOTYPE_INDEX)));
-  Node* initial_map = LoadContextElement(
-      native_context, Context::INITIAL_ARRAY_ITERATOR_PROTOTYPE_MAP_INDEX);
-  GotoIfNot(WordEqual(arr_it_proto_map, initial_map), &if_runtime);
-
-  Node* kind = LoadMapElementsKind(spread_map);
-
-  STATIC_ASSERT(PACKED_SMI_ELEMENTS == 0);
-  STATIC_ASSERT(HOLEY_SMI_ELEMENTS == 1);
-  STATIC_ASSERT(PACKED_ELEMENTS == 2);
-  STATIC_ASSERT(HOLEY_ELEMENTS == 3);
-  STATIC_ASSERT(PACKED_DOUBLE_ELEMENTS == 4);
-  STATIC_ASSERT(HOLEY_DOUBLE_ELEMENTS == 5);
-  STATIC_ASSERT(LAST_FAST_ELEMENTS_KIND == HOLEY_DOUBLE_ELEMENTS);
-
-  GotoIf(Int32GreaterThan(kind, Int32Constant(LAST_FAST_ELEMENTS_KIND)),
-         &if_runtime);
-  Branch(Word32And(kind, Int32Constant(1)), &if_holey, &if_done);
-
-  // Check the NoElementsProtector cell for holey arrays.
-  BIND(&if_holey);
-  { Branch(IsNoElementsProtectorCellInvalid(), &if_runtime, &if_done); }
-
-  BIND(&if_runtime);
+  GotoIf(WordEqual(LoadObjectField(protector_cell, PropertyCell::kValueOffset),
+                   SmiConstant(Isolate::kProtectorInvalid)),
+         &if_generic);
+
+  // The fast-path accesses the {spread} elements directly.
+  Node* spread_kind = LoadMapElementsKind(spread_map);
+  var_elements_kind.Bind(spread_kind);
+  var_length.Bind(
+      LoadAndUntagToWord32ObjectField(spread, JSArray::kLengthOffset));
+  var_elements.Bind(LoadObjectField(spread, JSArray::kElementsOffset));
+
+  // Check elements kind of {spread}.
+  GotoIf(Int32LessThan(spread_kind, Int32Constant(PACKED_DOUBLE_ELEMENTS)),
+         &if_smiorobject);
+  Branch(Int32GreaterThan(spread_kind, Int32Constant(LAST_FAST_ELEMENTS_KIND)),
+         &if_generic, &if_double);
+
+  BIND(&if_generic);
   {
-    Node* spread_iterable = LoadContextElement(LoadNativeContext(context),
-                                               Context::SPREAD_ITERABLE_INDEX);
-    spread_result.Bind(CallJS(CodeFactory::Call(isolate()), context,
-                              spread_iterable, UndefinedConstant(), spread));
-    CSA_ASSERT(this, IsJSArray(spread_result.value()));
-    Goto(&if_done);
+    Label if_iterator_fn_not_callable(this, Label::kDeferred);
+    Node* iterator_fn = GetProperty(context, spread, IteratorSymbolConstant());
+    GotoIf(TaggedIsSmi(iterator_fn), &if_iterator_fn_not_callable);
+    GotoIfNot(IsCallable(iterator_fn), &if_iterator_fn_not_callable);
+    Node* list =
+        CallBuiltin(Builtins::kIterableToList, context, spread, iterator_fn);
+    CSA_ASSERT(this, IsJSArray(list));
+    Node* list_kind = LoadMapElementsKind(LoadMap(list));
+    var_length.Bind(
+        LoadAndUntagToWord32ObjectField(list, JSArray::kLengthOffset));
+    var_elements.Bind(LoadObjectField(list, JSArray::kElementsOffset));
+    var_elements_kind.Bind(list_kind);
+    Branch(Int32LessThan(list_kind, Int32Constant(PACKED_DOUBLE_ELEMENTS)),
+           &if_smiorobject, &if_double);
+
+    BIND(&if_iterator_fn_not_callable);
+    ThrowTypeError(context, MessageTemplate::kIteratorSymbolNonCallable);
   }
 
-  BIND(&if_done);
+  BIND(&if_smiorobject);
   {
-    // The result from if_runtime can be an array of doubles.
-    Label if_not_double(this), if_double(this);
-    Node* elements =
-        LoadObjectField(spread_result.value(), JSArray::kElementsOffset);
-    Node* length = LoadAndUntagToWord32ObjectField(spread_result.value(),
-                                                   JSArray::kLengthOffset);
+    Node* const elements = var_elements.value();
+    Node* const length = var_length.value();
 
-    Node* kind = LoadMapElementsKind(LoadMap(elements));
-    CSA_ASSERT(this, Int32LessThanOrEqual(
-                         kind, Int32Constant(LAST_FAST_ELEMENTS_KIND)));
-
-    Branch(Int32GreaterThan(kind, Int32Constant(HOLEY_ELEMENTS)), &if_double,
-           &if_not_double);
-
-    BIND(&if_not_double);
-    {
-      if (new_target == nullptr) {
-        Callable callable = CodeFactory::CallVarargs(isolate());
-        TailCallStub(callable, context, target, args_count, elements, length);
-      } else {
-        Callable callable = CodeFactory::ConstructVarargs(isolate());
-        TailCallStub(callable, context, target, new_target, args_count,
-                     elements, length);
-      }
+    if (new_target == nullptr) {
+      Callable callable = CodeFactory::CallVarargs(isolate());
+      TailCallStub(callable, context, target, args_count, elements, length);
+    } else {
+      Callable callable = CodeFactory::ConstructVarargs(isolate());
+      TailCallStub(callable, context, target, new_target, args_count, elements,
+                   length);
     }
+  }
 
-    BIND(&if_double);
-    {
-      CallOrConstructDoubleVarargs(target, new_target, elements, length,
-                                   args_count, context, kind);
-    }
+  BIND(&if_double);
+  {
+    Node* const elements_kind = var_elements_kind.value();
+    Node* const elements = var_elements.value();
+    Node* const length = var_length.value();
+
+    CallOrConstructDoubleVarargs(target, new_target, elements, length,
+                                 args_count, context, elements_kind);
   }
 }
 
diff --git a/deps/v8/src/builtins/builtins-collections-gen.cc b/deps/v8/src/builtins/builtins-collections-gen.cc
index 392040c9955..a7f7eae542d 100644
--- a/deps/v8/src/builtins/builtins-collections-gen.cc
+++ b/deps/v8/src/builtins/builtins-collections-gen.cc
@@ -26,31 +26,32 @@ class BaseCollectionsAssembler : public CodeStubAssembler {
   virtual ~BaseCollectionsAssembler() {}
 
  protected:
-  enum Variant { kMap, kSet };
+  enum Variant { kMap, kSet, kWeakMap, kWeakSet };
 
   // Adds an entry to a collection.  For Maps, properly handles extracting the
   // key and value from the entry (see LoadKeyValue()).
-  TNode<Object> AddConstructorEntry(Variant variant, TNode<Context> context,
-                                    TNode<Object> collection,
-                                    TNode<Object> add_function,
-                                    TNode<Object> key_value,
-                                    Label* if_exception = nullptr,
-                                    TVariable<Object>* var_exception = nullptr);
+  void AddConstructorEntry(Variant variant, TNode<Context> context,
+                           TNode<Object> collection, TNode<Object> add_function,
+                           TNode<Object> key_value,
+                           Label* if_may_have_side_effects = nullptr,
+                           Label* if_exception = nullptr,
+                           TVariable<Object>* var_exception = nullptr);
 
   // Adds constructor entries to a collection.  Choosing a fast path when
   // possible.
   void AddConstructorEntries(Variant variant, TNode<Context> context,
                              TNode<Context> native_context,
                              TNode<Object> collection,
-                             TNode<Object> initial_entries,
-                             TNode<BoolT> is_fast_jsarray);
+                             TNode<Object> initial_entries);
 
   // Fast path for adding constructor entries.  Assumes the entries are a fast
   // JS array (see CodeStubAssembler::BranchIfFastJSArray()).
   void AddConstructorEntriesFromFastJSArray(Variant variant,
                                             TNode<Context> context,
+                                            TNode<Context> native_context,
                                             TNode<Object> collection,
-                                            TNode<JSArray> fast_jsarray);
+                                            TNode<JSArray> fast_jsarray,
+                                            Label* if_may_have_side_effects);
 
   // Adds constructor entries to a collection using the iterator protocol.
   void AddConstructorEntriesFromIterable(Variant variant,
@@ -61,8 +62,7 @@ class BaseCollectionsAssembler : public CodeStubAssembler {
 
   // Constructs a collection instance. Choosing a fast path when possible.
   TNode<Object> AllocateJSCollection(TNode<Context> context,
-                                     TNode<Context> native_context,
-                                     int constructor_function_index,
+                                     TNode<JSFunction> constructor,
                                      TNode<Object> new_target);
 
   // Fast path for constructing a collection instance if the constructor
@@ -72,7 +72,7 @@ class BaseCollectionsAssembler : public CodeStubAssembler {
   // Fallback for constructing a collection instance if the constructor function
   // has been modified.
   TNode<Object> AllocateJSCollectionSlow(TNode<Context> context,
-                                         TNode<HeapObject> constructor,
+                                         TNode<JSFunction> constructor,
                                          TNode<Object> new_target);
 
   // Allocates the backing store for a collection.
@@ -81,15 +81,26 @@ class BaseCollectionsAssembler : public CodeStubAssembler {
 
   // Main entry point for a collection constructor builtin.
   void GenerateConstructor(Variant variant,
-                           const int constructor_function_index,
-                           Handle<String> constructor_function_name,
-                           int collection_tableoffset);
+                           Handle<String> constructor_function_name);
 
   // Retrieves the collection function that adds an entry. `set` for Maps and
   // `add` for Sets.
   TNode<Object> GetAddFunction(Variant variant, TNode<Context> context,
                                TNode<Object> collection);
 
+  // Retrieves the collection constructor function.
+  TNode<JSFunction> GetConstructor(Variant variant,
+                                   TNode<Context> native_context);
+
+  // Retrieves the initial collection function that adds an entry. Should only
+  // be called when it is certain that a collection prototype's map hasn't been
+  // changed.
+  TNode<JSFunction> GetInitialAddFunction(Variant variant,
+                                          TNode<Context> native_context);
+
+  // Retrieves the offset to access the backing table from the collection.
+  int GetTableOffset(Variant variant);
+
   // Estimates the number of entries the collection will have after adding the
   // entries passed in the constructor. AllocateTable() can use this to avoid
   // the time of growing/rehashing when adding the constructor entries.
@@ -98,6 +109,11 @@ class BaseCollectionsAssembler : public CodeStubAssembler {
 
   void GotoIfNotJSReceiver(Node* const obj, Label* if_not_receiver);
 
+  // Determines whether the collection's prototype has been modified.
+  TNode<BoolT> HasInitialCollectionPrototype(Variant variant,
+                                             TNode<Context> native_context,
+                                             TNode<Object> collection);
+
   // Loads an element from a fixed array.  If the element is the hole, returns
   // `undefined`.
   TNode<Object> LoadAndNormalizeFixedArrayElement(TNode<Object> elements,
@@ -112,59 +128,85 @@ class BaseCollectionsAssembler : public CodeStubAssembler {
   // array.  If the array lacks 2 elements, undefined is used.
   void LoadKeyValue(TNode<Context> context, TNode<Object> maybe_array,
                     TVariable<Object>* key, TVariable<Object>* value,
+                    Label* if_may_have_side_effects = nullptr,
                     Label* if_exception = nullptr,
                     TVariable<Object>* var_exception = nullptr);
 };
 
-TNode<Object> BaseCollectionsAssembler::AddConstructorEntry(
+void BaseCollectionsAssembler::AddConstructorEntry(
     Variant variant, TNode<Context> context, TNode<Object> collection,
-    TNode<Object> add_function, TNode<Object> key_value, Label* if_exception,
+    TNode<Object> add_function, TNode<Object> key_value,
+    Label* if_may_have_side_effects, Label* if_exception,
     TVariable<Object>* var_exception) {
   CSA_ASSERT(this, Word32BinaryNot(IsTheHole(key_value)));
-  if (variant == kMap) {
-    Label exit(this), if_notobject(this, Label::kDeferred);
-    GotoIfNotJSReceiver(key_value, &if_notobject);
-
+  if (variant == kMap || variant == kWeakMap) {
     TVARIABLE(Object, key);
     TVARIABLE(Object, value);
-    LoadKeyValue(context, key_value, &key, &value, if_exception, var_exception);
-    Node* key_n = key;
-    Node* value_n = value;
-    TNode<Object> add_call =
-        UncheckedCast<Object>(CallJS(CodeFactory::Call(isolate()), context,
-                                     add_function, collection, key_n, value_n));
-    Goto(&exit);
-
-    BIND(&if_notobject);
-    {
-      Node* ret = CallRuntime(
-          Runtime::kThrowTypeError, context,
-          SmiConstant(MessageTemplate::kIteratorValueNotAnObject), key_value);
-      if (if_exception != nullptr) {
-        DCHECK(var_exception != nullptr);
-        GotoIfException(ret, if_exception, var_exception);
-      }
-      Unreachable();
-    }
-    BIND(&exit);
-    return add_call;
-
-  } else {  // variant == kSet
-    DCHECK(variant == kSet);
-    return UncheckedCast<Object>(CallJS(CodeFactory::Call(isolate()), context,
-                                        add_function, collection, key_value));
+    LoadKeyValue(context, key_value, &key, &value, if_may_have_side_effects,
+                 if_exception, var_exception);
+    Node* key_n = key.value();
+    Node* value_n = value.value();
+    Node* ret = CallJS(CodeFactory::Call(isolate()), context, add_function,
+                       collection, key_n, value_n);
+    GotoIfException(ret, if_exception, var_exception);
+  } else {
+    DCHECK(variant == kSet || variant == kWeakSet);
+    Node* ret = CallJS(CodeFactory::Call(isolate()), context, add_function,
+                       collection, key_value);
+    GotoIfException(ret, if_exception, var_exception);
   }
 }
 
 void BaseCollectionsAssembler::AddConstructorEntries(
     Variant variant, TNode<Context> context, TNode<Context> native_context,
-    TNode<Object> collection, TNode<Object> initial_entries,
-    TNode<BoolT> is_fast_jsarray) {
-  Label exit(this), slow_loop(this, Label::kDeferred);
-  GotoIf(IsNullOrUndefined(initial_entries), &exit);
+    TNode<Object> collection, TNode<Object> initial_entries) {
+  TVARIABLE(BoolT, use_fast_loop,
+            IsFastJSArrayWithNoCustomIteration(initial_entries, context,
+                                               native_context));
+  TNode<IntPtrT> at_least_space_for =
+      EstimatedInitialSize(initial_entries, use_fast_loop.value());
+  Label allocate_table(this, &use_fast_loop), exit(this), fast_loop(this),
+      slow_loop(this, Label::kDeferred);
+  Goto(&allocate_table);
+  BIND(&allocate_table);
+  {
+    TNode<Object> table = AllocateTable(variant, context, at_least_space_for);
+    StoreObjectField(collection, GetTableOffset(variant), table);
+    GotoIf(IsNullOrUndefined(initial_entries), &exit);
+    GotoIfNot(
+        HasInitialCollectionPrototype(variant, native_context, collection),
+        &slow_loop);
+    Branch(use_fast_loop.value(), &fast_loop, &slow_loop);
+  }
+  BIND(&fast_loop);
+  {
+    TNode<JSArray> initial_entries_jsarray =
+        UncheckedCast<JSArray>(initial_entries);
+#if DEBUG
+    CSA_ASSERT(this, IsFastJSArrayWithNoCustomIteration(
+                         initial_entries_jsarray, context, native_context));
+    TNode<Map> original_initial_entries_map = LoadMap(initial_entries_jsarray);
+#endif
+
+    Label if_may_have_side_effects(this, Label::kDeferred);
+    AddConstructorEntriesFromFastJSArray(variant, context, native_context,
+                                         collection, initial_entries_jsarray,
+                                         &if_may_have_side_effects);
+    Goto(&exit);
 
-  // TODO(mvstanton): Re-enable the fast path when a fix is found for
-  // crbug.com/798026.
+    if (variant == kMap || variant == kWeakMap) {
+      BIND(&if_may_have_side_effects);
+#if DEBUG
+      CSA_ASSERT(this, HasInitialCollectionPrototype(variant, native_context,
+                                                     collection));
+      CSA_ASSERT(this, WordEqual(original_initial_entries_map,
+                                 LoadMap(initial_entries_jsarray)));
+#endif
+      use_fast_loop = Int32FalseConstant();
+      Goto(&allocate_table);
+    }
+  }
+  BIND(&slow_loop);
   {
     AddConstructorEntriesFromIterable(variant, context, native_context,
                                       collection, initial_entries);
@@ -174,17 +216,26 @@ void BaseCollectionsAssembler::AddConstructorEntries(
 }
 
 void BaseCollectionsAssembler::AddConstructorEntriesFromFastJSArray(
-    Variant variant, TNode<Context> context, TNode<Object> collection,
-    TNode<JSArray> fast_jsarray) {
+    Variant variant, TNode<Context> context, TNode<Context> native_context,
+    TNode<Object> collection, TNode<JSArray> fast_jsarray,
+    Label* if_may_have_side_effects) {
   TNode<FixedArrayBase> elements = LoadElements(fast_jsarray);
   TNode<Int32T> elements_kind = LoadMapElementsKind(LoadMap(fast_jsarray));
+  TNode<JSFunction> add_func = GetInitialAddFunction(variant, native_context);
+  CSA_ASSERT(
+      this,
+      WordEqual(GetAddFunction(variant, native_context, collection), add_func));
+  CSA_ASSERT(this, IsFastJSArrayWithNoCustomIteration(fast_jsarray, context,
+                                                      native_context));
   TNode<IntPtrT> length = SmiUntag(LoadFastJSArrayLength(fast_jsarray));
-  TNode<Object> add_func = GetAddFunction(variant, context, collection);
-
-  CSA_ASSERT(this, IsFastJSArray(fast_jsarray, context));
-  CSA_ASSERT(this, IsFastElementsKind(elements_kind));
   CSA_ASSERT(this, IntPtrGreaterThanOrEqual(length, IntPtrConstant(0)));
+  CSA_ASSERT(
+      this, HasInitialCollectionPrototype(variant, native_context, collection));
 
+#if DEBUG
+  TNode<Map> original_collection_map = LoadMap(CAST(collection));
+  TNode<Map> original_fast_js_array_map = LoadMap(fast_jsarray);
+#endif
   Label exit(this), if_doubles(this), if_smiorobjects(this);
   Branch(IsFastSmiOrTaggedElementsKind(elements_kind), &if_smiorobjects,
          &if_doubles);
@@ -193,8 +244,14 @@ void BaseCollectionsAssembler::AddConstructorEntriesFromFastJSArray(
     auto set_entry = [&](Node* index) {
       TNode<Object> element = LoadAndNormalizeFixedArrayElement(
           elements, UncheckedCast<IntPtrT>(index));
-      AddConstructorEntry(variant, context, collection, add_func, element);
+      AddConstructorEntry(variant, context, collection, add_func, element,
+                          if_may_have_side_effects);
     };
+
+    // Instead of using the slower iteration protocol to iterate over the
+    // elements, a fast loop is used.  This assumes that adding an element
+    // to the collection does not call user code that could mutate the elements
+    // or collection.
     BuildFastLoop(IntPtrConstant(0), length, set_entry, 1,
                   ParameterMode::INTPTR_PARAMETERS, IndexAdvanceMode::kPost);
     Goto(&exit);
@@ -203,7 +260,7 @@ void BaseCollectionsAssembler::AddConstructorEntriesFromFastJSArray(
   {
     // A Map constructor requires entries to be arrays (ex. [key, value]),
     // so a FixedDoubleArray can never succeed.
-    if (variant == kMap) {
+    if (variant == kMap || variant == kWeakMap) {
       TNode<Float64T> element =
           UncheckedCast<Float64T>(LoadFixedDoubleArrayElement(
               elements, IntPtrConstant(0), MachineType::Float64(), 0,
@@ -211,10 +268,11 @@ void BaseCollectionsAssembler::AddConstructorEntriesFromFastJSArray(
       ThrowTypeError(context, MessageTemplate::kIteratorValueNotAnObject,
                      AllocateHeapNumberWithValue(element));
     } else {
+      DCHECK(variant == kSet || variant == kWeakSet);
       auto set_entry = [&](Node* index) {
         TNode<Object> entry = LoadAndNormalizeFixedDoubleArrayElement(
             elements, UncheckedCast<IntPtrT>(index));
-        AddConstructorEntry(kSet, context, collection, add_func, entry);
+        AddConstructorEntry(variant, context, collection, add_func, entry);
       };
       BuildFastLoop(IntPtrConstant(0), length, set_entry, 1,
                     ParameterMode::INTPTR_PARAMETERS, IndexAdvanceMode::kPost);
@@ -222,6 +280,12 @@ void BaseCollectionsAssembler::AddConstructorEntriesFromFastJSArray(
     }
   }
   BIND(&exit);
+#if DEBUG
+  CSA_ASSERT(this,
+             WordEqual(original_collection_map, LoadMap(CAST(collection))));
+  CSA_ASSERT(this,
+             WordEqual(original_fast_js_array_map, LoadMap(fast_jsarray)));
+#endif
 }
 
 void BaseCollectionsAssembler::AddConstructorEntriesFromIterable(
@@ -247,10 +311,8 @@ void BaseCollectionsAssembler::AddConstructorEntriesFromIterable(
         context, iterator, &exit, fast_iterator_result_map));
     TNode<Object> next_value = CAST(iterator_assembler.IteratorValue(
         context, next, fast_iterator_result_map));
-    TNode<Object> add_result =
-        AddConstructorEntry(variant, context, collection, add_func, next_value,
-                            &if_exception, &var_exception);
-    GotoIfException(add_result, &if_exception, &var_exception);
+    AddConstructorEntry(variant, context, collection, add_func, next_value,
+                        nullptr, &if_exception, &var_exception);
     Goto(&loop);
   }
   BIND(&if_exception);
@@ -262,10 +324,8 @@ void BaseCollectionsAssembler::AddConstructorEntriesFromIterable(
 }
 
 TNode<Object> BaseCollectionsAssembler::AllocateJSCollection(
-    TNode<Context> context, TNode<Context> native_context,
-    int constructor_function_index, TNode<Object> new_target) {
-  TNode<HeapObject> constructor =
-      CAST(LoadContextElement(native_context, constructor_function_index));
+    TNode<Context> context, TNode<JSFunction> constructor,
+    TNode<Object> new_target) {
   TNode<BoolT> is_target_unmodified = WordEqual(constructor, new_target);
 
   return Select<Object>(is_target_unmodified,
@@ -273,8 +333,7 @@ TNode<Object> BaseCollectionsAssembler::AllocateJSCollection(
                         [=] {
                           return AllocateJSCollectionSlow(context, constructor,
                                                           new_target);
-                        },
-                        MachineRepresentation::kTagged);
+                        });
 }
 
 TNode<Object> BaseCollectionsAssembler::AllocateJSCollectionFast(
@@ -286,7 +345,7 @@ TNode<Object> BaseCollectionsAssembler::AllocateJSCollectionFast(
 }
 
 TNode<Object> BaseCollectionsAssembler::AllocateJSCollectionSlow(
-    TNode<Context> context, TNode<HeapObject> constructor,
+    TNode<Context> context, TNode<JSFunction> constructor,
     TNode<Object> new_target) {
   ConstructorBuiltinsAssembler constructor_assembler(this->state());
   return CAST(constructor_assembler.EmitFastNewObject(context, constructor,
@@ -294,8 +353,7 @@ TNode<Object> BaseCollectionsAssembler::AllocateJSCollectionSlow(
 }
 
 void BaseCollectionsAssembler::GenerateConstructor(
-    Variant variant, const int constructor_function_index,
-    Handle<String> constructor_function_name, int collection_tableoffset) {
+    Variant variant, Handle<String> constructor_function_name) {
   const int kIterableArg = 0;
   CodeStubArguments args(
       this, ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount)));
@@ -306,17 +364,11 @@ void BaseCollectionsAssembler::GenerateConstructor(
   Label if_undefined(this, Label::kDeferred);
   GotoIf(IsUndefined(new_target), &if_undefined);
 
-  TNode<BoolT> is_fast_jsarray = IsFastJSArray(iterable, context);
-  TNode<IntPtrT> at_least_space_for =
-      EstimatedInitialSize(iterable, is_fast_jsarray);
   TNode<Context> native_context = LoadNativeContext(context);
   TNode<Object> collection = AllocateJSCollection(
-      context, native_context, constructor_function_index, new_target);
-  TNode<Object> table = AllocateTable(variant, context, at_least_space_for);
+      context, GetConstructor(variant, native_context), new_target);
 
-  StoreObjectField(collection, collection_tableoffset, table);
-  AddConstructorEntries(variant, context, native_context, collection, iterable,
-                        is_fast_jsarray);
+  AddConstructorEntries(variant, context, native_context, collection, iterable);
   Return(collection);
 
   BIND(&if_undefined);
@@ -326,14 +378,10 @@ void BaseCollectionsAssembler::GenerateConstructor(
 
 TNode<Object> BaseCollectionsAssembler::GetAddFunction(
     Variant variant, TNode<Context> context, TNode<Object> collection) {
-  // TODO(pwong): Consider calling the builtin directly when the prototype is
-  // unmodified.  This will require tracking WeakMap/WeakSet prototypes on the
-  // native context.
-  Handle<String> add_func_name = variant == kMap
+  Handle<String> add_func_name = (variant == kMap || variant == kWeakMap)
                                      ? isolate()->factory()->set_string()
                                      : isolate()->factory()->add_string();
-  TNode<Object> add_func =
-      CAST(GetProperty(context, collection, add_func_name));
+  TNode<Object> add_func = GetProperty(context, collection, add_func_name);
 
   Label exit(this), if_notcallable(this, Label::kDeferred);
   GotoIf(TaggedIsSmi(add_func), &if_notcallable);
@@ -348,12 +396,66 @@ TNode<Object> BaseCollectionsAssembler::GetAddFunction(
   return add_func;
 }
 
+TNode<JSFunction> BaseCollectionsAssembler::GetConstructor(
+    Variant variant, TNode<Context> native_context) {
+  int index;
+  switch (variant) {
+    case kMap:
+      index = Context::JS_MAP_FUN_INDEX;
+      break;
+    case kSet:
+      index = Context::JS_SET_FUN_INDEX;
+      break;
+    case kWeakMap:
+      index = Context::JS_WEAK_MAP_FUN_INDEX;
+      break;
+    case kWeakSet:
+      index = Context::JS_WEAK_SET_FUN_INDEX;
+      break;
+  }
+  return CAST(LoadContextElement(native_context, index));
+}
+
+TNode<JSFunction> BaseCollectionsAssembler::GetInitialAddFunction(
+    Variant variant, TNode<Context> native_context) {
+  int index;
+  switch (variant) {
+    case kMap:
+      index = Context::MAP_SET_INDEX;
+      break;
+    case kSet:
+      index = Context::SET_ADD_INDEX;
+      break;
+    case kWeakMap:
+      index = Context::WEAKMAP_SET_INDEX;
+      break;
+    case kWeakSet:
+      index = Context::WEAKSET_ADD_INDEX;
+      break;
+  }
+  return CAST(LoadContextElement(native_context, index));
+}
+
+int BaseCollectionsAssembler::GetTableOffset(Variant variant) {
+  switch (variant) {
+    case kMap:
+      return JSMap::kTableOffset;
+    case kSet:
+      return JSSet::kTableOffset;
+    case kWeakMap:
+      return JSWeakMap::kTableOffset;
+    case kWeakSet:
+      return JSWeakSet::kTableOffset;
+  }
+  UNREACHABLE();
+}
+
 TNode<IntPtrT> BaseCollectionsAssembler::EstimatedInitialSize(
     TNode<Object> initial_entries, TNode<BoolT> is_fast_jsarray) {
   return Select<IntPtrT>(
       is_fast_jsarray,
       [=] { return SmiUntag(LoadFastJSArrayLength(CAST(initial_entries))); },
-      [=] { return IntPtrConstant(0); }, MachineType::PointerRepresentation());
+      [=] { return IntPtrConstant(0); });
 }
 
 void BaseCollectionsAssembler::GotoIfNotJSReceiver(Node* const obj,
@@ -362,12 +464,36 @@ void BaseCollectionsAssembler::GotoIfNotJSReceiver(Node* const obj,
   GotoIfNot(IsJSReceiver(obj), if_not_receiver);
 }
 
+TNode<BoolT> BaseCollectionsAssembler::HasInitialCollectionPrototype(
+    Variant variant, TNode<Context> native_context, TNode<Object> collection) {
+  int initial_prototype_index;
+  switch (variant) {
+    case kMap:
+      initial_prototype_index = Context::INITIAL_MAP_PROTOTYPE_MAP_INDEX;
+      break;
+    case kSet:
+      initial_prototype_index = Context::INITIAL_SET_PROTOTYPE_MAP_INDEX;
+      break;
+    case kWeakMap:
+      initial_prototype_index = Context::INITIAL_WEAKMAP_PROTOTYPE_MAP_INDEX;
+      break;
+    case kWeakSet:
+      initial_prototype_index = Context::INITIAL_WEAKSET_PROTOTYPE_MAP_INDEX;
+      break;
+  }
+  TNode<Map> initial_prototype_map =
+      CAST(LoadContextElement(native_context, initial_prototype_index));
+  TNode<Map> collection_proto_map =
+      LoadMap(CAST(LoadMapPrototype(LoadMap(CAST(collection)))));
+
+  return WordEqual(collection_proto_map, initial_prototype_map);
+}
+
 TNode<Object> BaseCollectionsAssembler::LoadAndNormalizeFixedArrayElement(
     TNode<Object> elements, TNode<IntPtrT> index) {
-  TNode<Object> element = CAST(LoadFixedArrayElement(elements, index));
+  TNode<Object> element = LoadFixedArrayElement(elements, index);
   return Select<Object>(IsTheHole(element), [=] { return UndefinedConstant(); },
-                        [=] { return element; },
-                        MachineRepresentation::kTagged);
+                        [=] { return element; });
 }
 
 TNode<Object> BaseCollectionsAssembler::LoadAndNormalizeFixedDoubleArrayElement(
@@ -386,15 +512,13 @@ TNode<Object> BaseCollectionsAssembler::LoadAndNormalizeFixedDoubleArrayElement(
     Goto(&next);
   }
   BIND(&next);
-  return entry;
+  return entry.value();
 }
 
-void BaseCollectionsAssembler::LoadKeyValue(TNode<Context> context,
-                                            TNode<Object> maybe_array,
-                                            TVariable<Object>* key,
-                                            TVariable<Object>* value,
-                                            Label* if_exception,
-                                            TVariable<Object>* var_exception) {
+void BaseCollectionsAssembler::LoadKeyValue(
+    TNode<Context> context, TNode<Object> maybe_array, TVariable<Object>* key,
+    TVariable<Object>* value, Label* if_may_have_side_effects,
+    Label* if_exception, TVariable<Object>* var_exception) {
   CSA_ASSERT(this, Word32BinaryNot(IsTheHole(maybe_array)));
 
   Label exit(this), if_fast(this), if_slow(this, Label::kDeferred);
@@ -461,20 +585,31 @@ void BaseCollectionsAssembler::LoadKeyValue(TNode<Context> context,
   }
   BIND(&if_slow);
   {
-    *key = UncheckedCast<Object>(
-        GetProperty(context, maybe_array, isolate()->factory()->zero_string()));
-    if (if_exception != nullptr) {
-      DCHECK(var_exception != nullptr);
-      GotoIfException(*key, if_exception, var_exception);
-    }
+    Label if_notobject(this, Label::kDeferred);
+    GotoIfNotJSReceiver(maybe_array, &if_notobject);
+    if (if_may_have_side_effects != nullptr) {
+      // If the element is not a fast array, we cannot guarantee accessing the
+      // key and value won't execute user code that will break fast path
+      // assumptions.
+      Goto(if_may_have_side_effects);
+    } else {
+      *key = UncheckedCast<Object>(GetProperty(
+          context, maybe_array, isolate()->factory()->zero_string()));
+      GotoIfException(key->value(), if_exception, var_exception);
 
-    *value = UncheckedCast<Object>(
-        GetProperty(context, maybe_array, isolate()->factory()->one_string()));
-    if (if_exception != nullptr) {
-      DCHECK(var_exception != nullptr);
-      GotoIfException(*value, if_exception, var_exception);
+      *value = UncheckedCast<Object>(GetProperty(
+          context, maybe_array, isolate()->factory()->one_string()));
+      GotoIfException(value->value(), if_exception, var_exception);
+      Goto(&exit);
+    }
+    BIND(&if_notobject);
+    {
+      Node* ret = CallRuntime(
+          Runtime::kThrowTypeError, context,
+          SmiConstant(MessageTemplate::kIteratorValueNotAnObject), maybe_array);
+      GotoIfException(ret, if_exception, var_exception);
+      Unreachable();
     }
-    Goto(&exit);
   }
   BIND(&exit);
 }
@@ -672,18 +807,17 @@ Node* CollectionsBuiltinsAssembler::AllocateJSCollectionIterator(
 TNode<Object> CollectionsBuiltinsAssembler::AllocateTable(
     Variant variant, TNode<Context> context,
     TNode<IntPtrT> at_least_space_for) {
-  return CAST(variant == kMap ? AllocateOrderedHashTable<OrderedHashMap>()
-                              : AllocateOrderedHashTable<OrderedHashSet>());
+  return CAST((variant == kMap || variant == kWeakMap)
+                  ? AllocateOrderedHashTable<OrderedHashMap>()
+                  : AllocateOrderedHashTable<OrderedHashSet>());
 }
 
 TF_BUILTIN(MapConstructor, CollectionsBuiltinsAssembler) {
-  GenerateConstructor(kMap, Context::JS_MAP_FUN_INDEX,
-                      isolate()->factory()->Map_string(), JSMap::kTableOffset);
+  GenerateConstructor(kMap, isolate()->factory()->Map_string());
 }
 
 TF_BUILTIN(SetConstructor, CollectionsBuiltinsAssembler) {
-  GenerateConstructor(kSet, Context::JS_SET_FUN_INDEX,
-                      isolate()->factory()->Set_string(), JSSet::kTableOffset);
+  GenerateConstructor(kSet, isolate()->factory()->Set_string());
 }
 
 Node* CollectionsBuiltinsAssembler::CallGetOrCreateHashRaw(Node* const key) {
@@ -924,12 +1058,12 @@ void CollectionsBuiltinsAssembler::FindOrderedHashTableEntry(
     std::function<void(Node*, Label*, Label*)> key_compare,
     Variable* entry_start_position, Label* entry_found, Label* not_found) {
   // Get the index of the bucket.
-  Node* const number_of_buckets = SmiUntag(
-      LoadFixedArrayElement(table, CollectionType::kNumberOfBucketsIndex));
+  Node* const number_of_buckets = SmiUntag(CAST(
+      LoadFixedArrayElement(table, CollectionType::kNumberOfBucketsIndex)));
   Node* const bucket =
       WordAnd(hash, IntPtrSub(number_of_buckets, IntPtrConstant(1)));
-  Node* const first_entry = SmiUntag(LoadFixedArrayElement(
-      table, bucket, CollectionType::kHashTableStartIndex * kPointerSize));
+  Node* const first_entry = SmiUntag(CAST(LoadFixedArrayElement(
+      table, bucket, CollectionType::kHashTableStartIndex * kPointerSize)));
 
   // Walk the bucket chain.
   Node* entry_start;
@@ -952,10 +1086,10 @@ void CollectionsBuiltinsAssembler::FindOrderedHashTableEntry(
         UintPtrLessThan(
             var_entry.value(),
             SmiUntag(SmiAdd(
-                LoadFixedArrayElement(table,
-                                      CollectionType::kNumberOfElementsIndex),
-                LoadFixedArrayElement(
-                    table, CollectionType::kNumberOfDeletedElementsIndex)))));
+                CAST(LoadFixedArrayElement(
+                    table, CollectionType::kNumberOfElementsIndex)),
+                CAST(LoadFixedArrayElement(
+                    table, CollectionType::kNumberOfDeletedElementsIndex))))));
 
     // Compute the index of the entry relative to kHashTableStartIndex.
     entry_start =
@@ -972,10 +1106,10 @@ void CollectionsBuiltinsAssembler::FindOrderedHashTableEntry(
 
     BIND(&continue_next_entry);
     // Load the index of the next entry in the bucket chain.
-    var_entry.Bind(SmiUntag(LoadFixedArrayElement(
+    var_entry.Bind(SmiUntag(CAST(LoadFixedArrayElement(
         table, entry_start,
         (CollectionType::kHashTableStartIndex + CollectionType::kChainOffset) *
-            kPointerSize)));
+            kPointerSize))));
 
     Goto(&loop);
   }
@@ -1049,9 +1183,9 @@ std::tuple<Node*, Node*> CollectionsBuiltinsAssembler::Transition(
       GotoIf(TaggedIsSmi(next_table), &done_loop);
 
       var_table.Bind(next_table);
-      var_index.Bind(
-          SmiUntag(CallBuiltin(Builtins::kOrderedHashTableHealIndex,
-                               NoContextConstant(), table, SmiTag(index))));
+      var_index.Bind(SmiUntag(
+          CAST(CallBuiltin(Builtins::kOrderedHashTableHealIndex,
+                           NoContextConstant(), table, SmiTag(index)))));
       Goto(&loop);
     }
     BIND(&done_loop);
@@ -1226,8 +1360,8 @@ TF_BUILTIN(MapPrototypeSet, CollectionsBuiltinsAssembler) {
   VARIABLE(table_var, MachineRepresentation::kTaggedPointer, table);
   {
     // Check we have enough space for the entry.
-    number_of_buckets.Bind(SmiUntag(
-        LoadFixedArrayElement(table, OrderedHashMap::kNumberOfBucketsIndex)));
+    number_of_buckets.Bind(SmiUntag(CAST(
+        LoadFixedArrayElement(table, OrderedHashMap::kNumberOfBucketsIndex))));
 
     STATIC_ASSERT(OrderedHashMap::kLoadFactor == 2);
     Node* const capacity = WordShl(number_of_buckets.value(), 1);
@@ -1242,8 +1376,8 @@ TF_BUILTIN(MapPrototypeSet, CollectionsBuiltinsAssembler) {
     // fields.
     CallRuntime(Runtime::kMapGrow, context, receiver);
     table_var.Bind(LoadObjectField(receiver, JSMap::kTableOffset));
-    number_of_buckets.Bind(SmiUntag(LoadFixedArrayElement(
-        table_var.value(), OrderedHashMap::kNumberOfBucketsIndex)));
+    number_of_buckets.Bind(SmiUntag(CAST(LoadFixedArrayElement(
+        table_var.value(), OrderedHashMap::kNumberOfBucketsIndex))));
     Node* const new_number_of_elements = SmiUntag(CAST(LoadObjectField(
         table_var.value(), OrderedHashMap::kNumberOfElementsOffset)));
     Node* const new_number_of_deleted = SmiUntag(CAST(LoadObjectField(
@@ -1382,7 +1516,7 @@ TF_BUILTIN(SetPrototypeAdd, CollectionsBuiltinsAssembler) {
            &add_entry);
 
     // Otherwise, go to runtime to compute the hash code.
-    entry_start_position_or_hash.Bind(SmiUntag((CallGetOrCreateHashRaw(key))));
+    entry_start_position_or_hash.Bind(SmiUntag(CallGetOrCreateHashRaw(key)));
     Goto(&add_entry);
   }
 
@@ -1392,8 +1526,8 @@ TF_BUILTIN(SetPrototypeAdd, CollectionsBuiltinsAssembler) {
   VARIABLE(table_var, MachineRepresentation::kTaggedPointer, table);
   {
     // Check we have enough space for the entry.
-    number_of_buckets.Bind(SmiUntag(
-        LoadFixedArrayElement(table, OrderedHashSet::kNumberOfBucketsIndex)));
+    number_of_buckets.Bind(SmiUntag(CAST(
+        LoadFixedArrayElement(table, OrderedHashSet::kNumberOfBucketsIndex))));
 
     STATIC_ASSERT(OrderedHashSet::kLoadFactor == 2);
     Node* const capacity = WordShl(number_of_buckets.value(), 1);
@@ -1408,8 +1542,8 @@ TF_BUILTIN(SetPrototypeAdd, CollectionsBuiltinsAssembler) {
     // fields.
     CallRuntime(Runtime::kSetGrow, context, receiver);
     table_var.Bind(LoadObjectField(receiver, JSMap::kTableOffset));
-    number_of_buckets.Bind(SmiUntag(LoadFixedArrayElement(
-        table_var.value(), OrderedHashSet::kNumberOfBucketsIndex)));
+    number_of_buckets.Bind(SmiUntag(CAST(LoadFixedArrayElement(
+        table_var.value(), OrderedHashSet::kNumberOfBucketsIndex))));
     Node* const new_number_of_elements = SmiUntag(CAST(LoadObjectField(
         table_var.value(), OrderedHashSet::kNumberOfElementsOffset)));
     Node* const new_number_of_deleted = SmiUntag(CAST(LoadObjectField(
@@ -1624,7 +1758,8 @@ TF_BUILTIN(MapIteratorPrototypeNext, CollectionsBuiltinsAssembler) {
   Branch(InstanceTypeEqual(receiver_instance_type, JS_MAP_VALUE_ITERATOR_TYPE),
          &if_receiver_valid, &if_receiver_invalid);
   BIND(&if_receiver_invalid);
-  ThrowIncompatibleMethodReceiver(context, kMethodName, receiver);
+  ThrowTypeError(context, MessageTemplate::kIncompatibleMethodReceiver,
+                 StringConstant(kMethodName), receiver);
   BIND(&if_receiver_valid);
 
   // Check if the {receiver} is exhausted.
@@ -1837,7 +1972,8 @@ TF_BUILTIN(SetIteratorPrototypeNext, CollectionsBuiltinsAssembler) {
       InstanceTypeEqual(receiver_instance_type, JS_SET_KEY_VALUE_ITERATOR_TYPE),
       &if_receiver_valid, &if_receiver_invalid);
   BIND(&if_receiver_invalid);
-  ThrowIncompatibleMethodReceiver(context, kMethodName, receiver);
+  ThrowTypeError(context, MessageTemplate::kIncompatibleMethodReceiver,
+                 StringConstant(kMethodName), receiver);
   BIND(&if_receiver_valid);
 
   // Check if the {receiver} is exhausted.
@@ -2019,7 +2155,7 @@ void WeakCollectionsBuiltinsAssembler::AddEntry(
 
   // See HashTableBase::ElementAdded().
   StoreFixedArrayElement(table, ObjectHashTable::kNumberOfElementsIndex,
-                         SmiFromWord(number_of_elements), SKIP_WRITE_BARRIER);
+                         SmiFromIntPtr(number_of_elements), SKIP_WRITE_BARRIER);
 }
 
 TNode<Object> WeakCollectionsBuiltinsAssembler::AllocateTable(
@@ -2043,7 +2179,7 @@ TNode<Object> WeakCollectionsBuiltinsAssembler::AllocateTable(
   StoreFixedArrayElement(table, ObjectHashTable::kNumberOfDeletedElementsIndex,
                          SmiConstant(0), SKIP_WRITE_BARRIER);
   StoreFixedArrayElement(table, ObjectHashTable::kCapacityIndex,
-                         SmiFromWord(capacity), SKIP_WRITE_BARRIER);
+                         SmiFromIntPtr(capacity), SKIP_WRITE_BARRIER);
 
   TNode<IntPtrT> start = KeyIndexFromEntry(IntPtrConstant(0));
   FillFixedArrayWithValue(HOLEY_ELEMENTS, table, start, length,
@@ -2083,16 +2219,15 @@ TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::FindKeyIndex(
   BIND(&loop);
   TNode<IntPtrT> key_index;
   {
-    key_index = KeyIndexFromEntry(var_entry);
-    TNode<Object> entry_key = CAST(LoadFixedArrayElement(table, key_index));
+    key_index = KeyIndexFromEntry(var_entry.value());
+    TNode<Object> entry_key = LoadFixedArrayElement(table, key_index);
 
     key_compare(entry_key, &if_found);
 
     // See HashTable::NextProbe().
     Increment(&var_count);
-    var_entry = WordAnd(IntPtrAdd(UncheckedCast<IntPtrT>(var_entry),
-                                  UncheckedCast<IntPtrT>(var_count)),
-                        entry_mask);
+    var_entry =
+        WordAnd(IntPtrAdd(var_entry.value(), var_count.value()), entry_mask);
     Goto(&loop);
   }
 
@@ -2134,15 +2269,15 @@ TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::KeyIndexFromEntry(
 
 TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::LoadNumberOfElements(
     TNode<Object> table, int offset) {
-  TNode<IntPtrT> number_of_elements = SmiUntag(
-      LoadFixedArrayElement(table, ObjectHashTable::kNumberOfElementsIndex));
+  TNode<IntPtrT> number_of_elements = SmiUntag(CAST(
+      LoadFixedArrayElement(table, ObjectHashTable::kNumberOfElementsIndex)));
   return IntPtrAdd(number_of_elements, IntPtrConstant(offset));
 }
 
 TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::LoadNumberOfDeleted(
     TNode<Object> table, int offset) {
-  TNode<IntPtrT> number_of_deleted = SmiUntag(LoadFixedArrayElement(
-      table, ObjectHashTable::kNumberOfDeletedElementsIndex));
+  TNode<IntPtrT> number_of_deleted = SmiUntag(CAST(LoadFixedArrayElement(
+      table, ObjectHashTable::kNumberOfDeletedElementsIndex)));
   return IntPtrAdd(number_of_deleted, IntPtrConstant(offset));
 }
 
@@ -2154,7 +2289,7 @@ TNode<Object> WeakCollectionsBuiltinsAssembler::LoadTable(
 TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::LoadTableCapacity(
     TNode<Object> table) {
   return SmiUntag(
-      LoadFixedArrayElement(table, ObjectHashTable::kCapacityIndex));
+      CAST(LoadFixedArrayElement(table, ObjectHashTable::kCapacityIndex)));
 }
 
 TNode<Word32T> WeakCollectionsBuiltinsAssembler::InsufficientCapacityToAdd(
@@ -2186,9 +2321,9 @@ void WeakCollectionsBuiltinsAssembler::RemoveEntry(
   // See HashTableBase::ElementRemoved().
   TNode<IntPtrT> number_of_deleted = LoadNumberOfDeleted(table, 1);
   StoreFixedArrayElement(table, ObjectHashTable::kNumberOfElementsIndex,
-                         SmiFromWord(number_of_elements), SKIP_WRITE_BARRIER);
+                         SmiFromIntPtr(number_of_elements), SKIP_WRITE_BARRIER);
   StoreFixedArrayElement(table, ObjectHashTable::kNumberOfDeletedElementsIndex,
-                         SmiFromWord(number_of_deleted), SKIP_WRITE_BARRIER);
+                         SmiFromIntPtr(number_of_deleted), SKIP_WRITE_BARRIER);
 }
 
 TNode<BoolT> WeakCollectionsBuiltinsAssembler::ShouldRehash(
@@ -2222,15 +2357,11 @@ TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::ValueIndexFromKeyIndex(
 }
 
 TF_BUILTIN(WeakMapConstructor, WeakCollectionsBuiltinsAssembler) {
-  GenerateConstructor(kMap, Context::JS_WEAK_MAP_FUN_INDEX,
-                      isolate()->factory()->WeakMap_string(),
-                      JSWeakMap::kTableOffset);
+  GenerateConstructor(kWeakMap, isolate()->factory()->WeakMap_string());
 }
 
 TF_BUILTIN(WeakSetConstructor, WeakCollectionsBuiltinsAssembler) {
-  GenerateConstructor(kSet, Context::JS_WEAK_SET_FUN_INDEX,
-                      isolate()->factory()->WeakSet_string(),
-                      JSWeakSet::kTableOffset);
+  GenerateConstructor(kWeakSet, isolate()->factory()->WeakSet_string());
 }
 
 TF_BUILTIN(WeakMapLookupHashIndex, WeakCollectionsBuiltinsAssembler) {
@@ -2342,8 +2473,8 @@ TF_BUILTIN(WeakCollectionSet, WeakCollectionsBuiltinsAssembler) {
   TNode<IntPtrT> entry_mask = EntryMask(capacity);
 
   TVARIABLE(IntPtrT, var_hash, LoadJSReceiverIdentityHash(key, &if_no_hash));
-  TNode<IntPtrT> key_index =
-      FindKeyIndexForKey(table, key, var_hash, entry_mask, &if_not_found);
+  TNode<IntPtrT> key_index = FindKeyIndexForKey(table, key, var_hash.value(),
+                                                entry_mask, &if_not_found);
 
   StoreFixedArrayElement(table, ValueIndexFromKeyIndex(key_index), value);
   Return(collection);
@@ -2365,14 +2496,14 @@ TF_BUILTIN(WeakCollectionSet, WeakCollectionsBuiltinsAssembler) {
            &call_runtime);
 
     TNode<IntPtrT> insertion_key_index =
-        FindKeyIndexForInsertion(table, var_hash, entry_mask);
+        FindKeyIndexForInsertion(table, var_hash.value(), entry_mask);
     AddEntry(table, insertion_key_index, key, value, number_of_elements);
     Return(collection);
   }
   BIND(&call_runtime);
   {
     CallRuntime(Runtime::kWeakCollectionSet, context, collection, key, value,
-                SmiTag(var_hash));
+                SmiTag(var_hash.value()));
     Return(collection);
   }
 }
diff --git a/deps/v8/src/builtins/builtins-console.cc b/deps/v8/src/builtins/builtins-console.cc
index 75ad302d3dc..138db2a422b 100644
--- a/deps/v8/src/builtins/builtins-console.cc
+++ b/deps/v8/src/builtins/builtins-console.cc
@@ -112,13 +112,11 @@ void InstallContextFunction(Handle<JSObject> target, const char* name,
                             Handle<Object> context_name) {
   Factory* const factory = target->GetIsolate()->factory();
 
-  Handle<Code> code(target->GetIsolate()->builtins()->builtin(builtin_id));
-
   Handle<String> name_string =
       Name::ToFunctionName(factory->InternalizeUtf8String(name))
           .ToHandleChecked();
   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
-      name_string, code, builtin_id, i::LanguageMode::kSloppy);
+      name_string, builtin_id, i::LanguageMode::kSloppy);
   Handle<JSFunction> fun = factory->NewFunction(args);
 
   fun->shared()->set_native(true);
diff --git a/deps/v8/src/builtins/builtins-constructor-gen.cc b/deps/v8/src/builtins/builtins-constructor-gen.cc
index 5c3883a870e..e16945ba26d 100644
--- a/deps/v8/src/builtins/builtins-constructor-gen.cc
+++ b/deps/v8/src/builtins/builtins-constructor-gen.cc
@@ -55,48 +55,80 @@ TF_BUILTIN(ConstructWithSpread, CallOrConstructBuiltinsAssembler) {
 
 typedef compiler::Node Node;
 
-Node* ConstructorBuiltinsAssembler::EmitFastNewClosure(Node* shared_info,
-                                                       Node* feedback_vector,
-                                                       Node* slot,
-                                                       Node* context) {
-  Isolate* isolate = this->isolate();
-  Factory* factory = isolate->factory();
-  IncrementCounter(isolate->counters()->fast_new_closure_total(), 1);
-
-  Node* compiler_hints =
-      LoadObjectField(shared_info, SharedFunctionInfo::kCompilerHintsOffset,
-                      MachineType::Uint32());
+Node* ConstructorBuiltinsAssembler::NotHasBoilerplate(Node* literal_site) {
+  return TaggedIsSmi(literal_site);
+}
+
+Node* ConstructorBuiltinsAssembler::LoadAllocationSiteBoilerplate(Node* site) {
+  CSA_ASSERT(this, IsAllocationSite(site));
+  return LoadObjectField(site,
+                         AllocationSite::kTransitionInfoOrBoilerplateOffset);
+}
+
+TF_BUILTIN(FastNewClosure, ConstructorBuiltinsAssembler) {
+  Node* shared_function_info = Parameter(Descriptor::kSharedFunctionInfo);
+  Node* feedback_cell = Parameter(Descriptor::kFeedbackCell);
+  Node* context = Parameter(Descriptor::kContext);
+
+  CSA_ASSERT(this, IsFeedbackCell(feedback_cell));
+  CSA_ASSERT(this, IsSharedFunctionInfo(shared_function_info));
+
+  IncrementCounter(isolate()->counters()->fast_new_closure_total(), 1);
+
+  // Bump the closure counter encoded the {feedback_cell}s map.
+  {
+    Node* const feedback_cell_map = LoadMap(feedback_cell);
+    Label no_closures(this), one_closure(this), cell_done(this);
+
+    GotoIf(IsNoClosuresCellMap(feedback_cell_map), &no_closures);
+    GotoIf(IsOneClosureCellMap(feedback_cell_map), &one_closure);
+    CSA_ASSERT(this, IsManyClosuresCellMap(feedback_cell_map),
+               feedback_cell_map, feedback_cell);
+    Goto(&cell_done);
+
+    BIND(&no_closures);
+    StoreMapNoWriteBarrier(feedback_cell, Heap::kOneClosureCellMapRootIndex);
+    Goto(&cell_done);
+
+    BIND(&one_closure);
+    StoreMapNoWriteBarrier(feedback_cell, Heap::kManyClosuresCellMapRootIndex);
+    Goto(&cell_done);
+
+    BIND(&cell_done);
+  }
 
   // The calculation of |function_map_index| must be in sync with
   // SharedFunctionInfo::function_map_index().
-  Node* function_map_index =
-      IntPtrAdd(DecodeWordFromWord32<SharedFunctionInfo::FunctionMapIndexBits>(
-                    compiler_hints),
-                IntPtrConstant(Context::FIRST_FUNCTION_MAP_INDEX));
+  Node* const flags =
+      LoadObjectField(shared_function_info, SharedFunctionInfo::kFlagsOffset,
+                      MachineType::Uint32());
+  Node* const function_map_index = IntPtrAdd(
+      DecodeWordFromWord32<SharedFunctionInfo::FunctionMapIndexBits>(flags),
+      IntPtrConstant(Context::FIRST_FUNCTION_MAP_INDEX));
   CSA_ASSERT(this, UintPtrLessThanOrEqual(
                        function_map_index,
                        IntPtrConstant(Context::LAST_FUNCTION_MAP_INDEX)));
 
   // Get the function map in the current native context and set that
   // as the map of the allocated object.
-  Node* native_context = LoadNativeContext(context);
-  Node* function_map = LoadContextElement(native_context, function_map_index);
+  Node* const native_context = LoadNativeContext(context);
+  Node* const function_map =
+      LoadContextElement(native_context, function_map_index);
 
   // Create a new closure from the given function info in new space
   Node* instance_size_in_bytes =
       TimesPointerSize(LoadMapInstanceSizeInWords(function_map));
-  Node* result = Allocate(instance_size_in_bytes);
+  Node* const result = Allocate(instance_size_in_bytes);
   StoreMapNoWriteBarrier(result, function_map);
   InitializeJSObjectBodyNoSlackTracking(result, function_map,
                                         instance_size_in_bytes,
                                         JSFunction::kSizeWithoutPrototype);
 
   // Initialize the rest of the function.
-  Node* empty_fixed_array = HeapConstant(factory->empty_fixed_array());
-  StoreObjectFieldNoWriteBarrier(result, JSObject::kPropertiesOrHashOffset,
-                                 empty_fixed_array);
-  StoreObjectFieldNoWriteBarrier(result, JSObject::kElementsOffset,
-                                 empty_fixed_array);
+  StoreObjectFieldRoot(result, JSObject::kPropertiesOrHashOffset,
+                       Heap::kEmptyFixedArrayRootIndex);
+  StoreObjectFieldRoot(result, JSObject::kElementsOffset,
+                       Heap::kEmptyFixedArrayRootIndex);
   {
     // Set function prototype if necessary.
     Label done(this), init_prototype(this);
@@ -104,65 +136,23 @@ Node* ConstructorBuiltinsAssembler::EmitFastNewClosure(Node* shared_info,
            &done);
 
     BIND(&init_prototype);
-    StoreObjectFieldNoWriteBarrier(
-        result, JSFunction::kPrototypeOrInitialMapOffset, TheHoleConstant());
+    StoreObjectFieldRoot(result, JSFunction::kPrototypeOrInitialMapOffset,
+                         Heap::kTheHoleValueRootIndex);
     Goto(&done);
-
     BIND(&done);
   }
 
-  Node* literals_cell = LoadFeedbackVectorSlot(
-      feedback_vector, slot, 0, CodeStubAssembler::SMI_PARAMETERS);
-  {
-    // Bump the closure counter encoded in the cell's map.
-    Node* cell_map = LoadMap(literals_cell);
-    Label no_closures(this), one_closure(this), cell_done(this);
-
-    GotoIf(IsNoClosuresCellMap(cell_map), &no_closures);
-    GotoIf(IsOneClosureCellMap(cell_map), &one_closure);
-    CSA_ASSERT(this, IsManyClosuresCellMap(cell_map), cell_map, literals_cell,
-               feedback_vector, slot);
-    Goto(&cell_done);
-
-    BIND(&no_closures);
-    StoreMapNoWriteBarrier(literals_cell, Heap::kOneClosureCellMapRootIndex);
-    Goto(&cell_done);
-
-    BIND(&one_closure);
-    StoreMapNoWriteBarrier(literals_cell, Heap::kManyClosuresCellMapRootIndex);
-    Goto(&cell_done);
-
-    BIND(&cell_done);
-  }
   STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kPointerSize);
-  StoreObjectFieldNoWriteBarrier(result, JSFunction::kFeedbackVectorOffset,
-                                 literals_cell);
+  StoreObjectFieldNoWriteBarrier(result, JSFunction::kFeedbackCellOffset,
+                                 feedback_cell);
   StoreObjectFieldNoWriteBarrier(result, JSFunction::kSharedFunctionInfoOffset,
-                                 shared_info);
+                                 shared_function_info);
   StoreObjectFieldNoWriteBarrier(result, JSFunction::kContextOffset, context);
   Handle<Code> lazy_builtin_handle(
-      isolate->builtins()->builtin(Builtins::kCompileLazy));
+      isolate()->builtins()->builtin(Builtins::kCompileLazy));
   Node* lazy_builtin = HeapConstant(lazy_builtin_handle);
   StoreObjectFieldNoWriteBarrier(result, JSFunction::kCodeOffset, lazy_builtin);
-  return result;
-}
-
-Node* ConstructorBuiltinsAssembler::NotHasBoilerplate(Node* literal_site) {
-  return TaggedIsSmi(literal_site);
-}
-
-Node* ConstructorBuiltinsAssembler::LoadAllocationSiteBoilerplate(Node* site) {
-  CSA_ASSERT(this, IsAllocationSite(site));
-  return LoadObjectField(site,
-                         AllocationSite::kTransitionInfoOrBoilerplateOffset);
-}
-
-TF_BUILTIN(FastNewClosure, ConstructorBuiltinsAssembler) {
-  Node* shared = Parameter(FastNewClosureDescriptor::kSharedFunctionInfo);
-  Node* context = Parameter(FastNewClosureDescriptor::kContext);
-  Node* vector = Parameter(FastNewClosureDescriptor::kVector);
-  Node* slot = Parameter(FastNewClosureDescriptor::kSlot);
-  Return(EmitFastNewClosure(shared, vector, slot, context));
+  Return(result);
 }
 
 TF_BUILTIN(FastNewObject, ConstructorBuiltinsAssembler) {
@@ -418,7 +408,7 @@ Node* ConstructorBuiltinsAssembler::EmitCreateEmptyArrayLiteral(
 
   BIND(&create_empty_array);
   CSA_ASSERT(this, IsAllocationSite(allocation_site.value()));
-  Node* kind = SmiToWord32(CAST(
+  Node* kind = SmiToInt32(CAST(
       LoadObjectField(allocation_site.value(),
                       AllocationSite::kTransitionInfoOrBoilerplateOffset)));
   CSA_ASSERT(this, IsFastElementsKind(kind));
@@ -645,166 +635,163 @@ Node* ConstructorBuiltinsAssembler::EmitCreateEmptyObjectLiteral(
   return result;
 }
 
+// ES #sec-object-constructor
 TF_BUILTIN(ObjectConstructor, ConstructorBuiltinsAssembler) {
   int const kValueArg = 0;
   Node* argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* value = args.GetOptionalArgumentValue(kValueArg);
   Node* context = Parameter(BuiltinDescriptor::kContext);
+  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
 
-  CSA_ASSERT(this, IsUndefined(Parameter(BuiltinDescriptor::kNewTarget)));
-
-  Label return_to_object(this);
-
-  GotoIf(Word32And(IsNotUndefined(value), IsNotNull(value)), &return_to_object);
-
-  args.PopAndReturn(EmitCreateEmptyObjectLiteral(context));
-
-  BIND(&return_to_object);
-  args.PopAndReturn(CallBuiltin(Builtins::kToObject, context, value));
-}
-
-TF_BUILTIN(ObjectConstructor_ConstructStub, ConstructorBuiltinsAssembler) {
-  int const kValueArg = 0;
-  Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
-  CodeStubArguments args(this, argc);
-  Node* value = args.GetOptionalArgumentValue(kValueArg);
-
+  VARIABLE(var_result, MachineRepresentation::kTagged);
+  Label if_subclass(this, Label::kDeferred), if_notsubclass(this),
+      return_result(this);
+  GotoIf(IsUndefined(new_target), &if_notsubclass);
   Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
                                MachineType::TaggedPointer());
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  Branch(WordEqual(new_target, target), &if_notsubclass, &if_subclass);
+
+  BIND(&if_subclass);
+  {
+    Node* result =
+        CallBuiltin(Builtins::kFastNewObject, context, target, new_target);
+    var_result.Bind(result);
+    Goto(&return_result);
+  }
+
+  BIND(&if_notsubclass);
+  {
+    Label if_newobject(this, Label::kDeferred), if_toobject(this);
 
-  CSA_ASSERT(this, IsNotUndefined(new_target));
+    Node* value_index = IntPtrConstant(kValueArg);
+    GotoIf(UintPtrGreaterThanOrEqual(value_index, argc), &if_newobject);
+    Node* value = args.AtIndex(value_index);
+    GotoIf(IsNull(value), &if_newobject);
+    Branch(IsUndefined(value), &if_newobject, &if_toobject);
 
-  Label return_to_object(this);
+    BIND(&if_newobject);
+    {
+      Node* result = EmitCreateEmptyObjectLiteral(context);
+      var_result.Bind(result);
+      Goto(&return_result);
+    }
 
-  GotoIf(Word32And(WordEqual(target, new_target),
-                   Word32And(IsNotUndefined(value), IsNotNull(value))),
-         &return_to_object);
-  args.PopAndReturn(EmitFastNewObject(context, target, new_target));
+    BIND(&if_toobject);
+    {
+      Node* result = CallBuiltin(Builtins::kToObject, context, value);
+      var_result.Bind(result);
+      Goto(&return_result);
+    }
+  }
 
-  BIND(&return_to_object);
-  args.PopAndReturn(CallBuiltin(Builtins::kToObject, context, value));
+  BIND(&return_result);
+  args.PopAndReturn(var_result.value());
 }
 
+// ES #sec-number-constructor
 TF_BUILTIN(NumberConstructor, ConstructorBuiltinsAssembler) {
+  Node* context = Parameter(BuiltinDescriptor::kContext);
   Node* argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
 
-  Label return_zero(this);
+  // 1. If no arguments were passed to this function invocation, let n be +0.
+  VARIABLE(var_n, MachineRepresentation::kTagged, SmiConstant(0));
+  Label if_nloaded(this, &var_n);
+  GotoIf(WordEqual(argc, IntPtrConstant(0)), &if_nloaded);
 
-  GotoIf(IntPtrEqual(IntPtrConstant(0), argc), &return_zero);
+  // 2. Else,
+  //    a. Let prim be ? ToNumeric(value).
+  //    b. If Type(prim) is BigInt, let n be the Number value for prim.
+  //    c. Otherwise, let n be prim.
+  Node* value = args.AtIndex(0);
+  var_n.Bind(ToNumber(context, value, BigIntHandling::kConvertToNumber));
+  Goto(&if_nloaded);
 
-  Node* context = Parameter(BuiltinDescriptor::kContext);
-  args.PopAndReturn(
-      ToNumber(context, args.AtIndex(0), BigIntHandling::kConvertToNumber));
+  BIND(&if_nloaded);
+  {
+    // 3. If NewTarget is undefined, return n.
+    Node* n_value = var_n.value();
+    Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+    Label return_n(this), constructnumber(this, Label::kDeferred);
+    Branch(IsUndefined(new_target), &return_n, &constructnumber);
 
-  BIND(&return_zero);
-  args.PopAndReturn(SmiConstant(0));
+    BIND(&return_n);
+    { args.PopAndReturn(n_value); }
+
+    BIND(&constructnumber);
+    {
+      // 4. Let O be ? OrdinaryCreateFromConstructor(NewTarget,
+      //    "%NumberPrototype%", « [[NumberData]] »).
+      // 5. Set O.[[NumberData]] to n.
+      // 6. Return O.
+      Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
+                                   MachineType::TaggedPointer());
+      Node* result =
+          CallBuiltin(Builtins::kFastNewObject, context, target, new_target);
+      StoreObjectField(result, JSValue::kValueOffset, n_value);
+      args.PopAndReturn(result);
+    }
+  }
 }
 
-TF_BUILTIN(NumberConstructor_ConstructStub, ConstructorBuiltinsAssembler) {
-  Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
-                               MachineType::TaggedPointer());
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+// https://tc39.github.io/ecma262/#sec-string-constructor
+TF_BUILTIN(StringConstructor, ConstructorBuiltinsAssembler) {
   Node* context = Parameter(BuiltinDescriptor::kContext);
-
   Node* argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
 
-  Label wrap(this);
-
-  VARIABLE(var_result, MachineRepresentation::kTagged, SmiConstant(0));
-
-  GotoIf(IntPtrEqual(IntPtrConstant(0), argc), &wrap);
-  var_result.Bind(
-      ToNumber(context, args.AtIndex(0), BigIntHandling::kConvertToNumber));
-  Goto(&wrap);
-
-  BIND(&wrap);
-  Node* result = EmitFastNewObject(context, target, new_target);
-  StoreObjectField(result, JSValue::kValueOffset, var_result.value());
-  args.PopAndReturn(result);
-}
-
-Node* ConstructorBuiltinsAssembler::EmitConstructString(Node* argc,
-                                                        CodeStubArguments& args,
-                                                        Node* context,
-                                                        bool convert_symbol) {
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-
-  Label return_empty_string(this), to_string(this),
-      check_symbol(this, Label::kDeferred), done(this);
-
-  GotoIf(IntPtrEqual(IntPtrConstant(0), argc), &return_empty_string);
-
-  Node* argument = args.AtIndex(0);
+  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
+                               MachineType::TaggedPointer());
 
-  GotoIf(TaggedIsSmi(argument), &to_string);
+  // 1. If no arguments were passed to this function invocation, let s be "".
+  VARIABLE(var_s, MachineRepresentation::kTagged, EmptyStringConstant());
+  Label if_sloaded(this, &var_s);
+  GotoIf(WordEqual(argc, IntPtrConstant(0)), &if_sloaded);
 
-  Node* instance_type = LoadInstanceType(argument);
+  // 2. Else,
+  //    a. If NewTarget is undefined [...]
+  Node* value = args.AtIndex(0);
+  Label if_tostring(this, &var_s);
+  GotoIfNot(IsUndefined(new_target), &if_tostring);
 
-  Label* non_string = convert_symbol ? &check_symbol : &to_string;
-  GotoIfNot(IsStringInstanceType(instance_type), non_string);
+  // 2a. [...] and Type(value) is Symbol, return SymbolDescriptiveString(value).
+  GotoIf(TaggedIsSmi(value), &if_tostring);
+  GotoIfNot(IsSymbol(value), &if_tostring);
   {
-    var_result.Bind(argument);
-    Goto(&done);
-  }
-
-  if (convert_symbol) {
-    BIND(&check_symbol);
-    GotoIfNot(IsSymbolInstanceType(instance_type), &to_string);
-    {
-      var_result.Bind(
-          CallRuntime(Runtime::kSymbolDescriptiveString, context, argument));
-      Goto(&done);
-    }
+    Node* result =
+        CallRuntime(Runtime::kSymbolDescriptiveString, context, value);
+    args.PopAndReturn(result);
   }
 
-  BIND(&to_string);
+  // 2b. Let s be ? ToString(value).
+  BIND(&if_tostring);
   {
-    var_result.Bind(ToString(context, argument));
-    Goto(&done);
+    var_s.Bind(CallBuiltin(Builtins::kToString, context, value));
+    Goto(&if_sloaded);
   }
 
-  BIND(&return_empty_string);
+  // 3. If NewTarget is undefined, return s.
+  BIND(&if_sloaded);
   {
-    var_result.Bind(EmptyStringConstant());
-    Goto(&done);
-  }
+    Node* s_value = var_s.value();
+    Label return_s(this), constructstring(this, Label::kDeferred);
+    Branch(IsUndefined(new_target), &return_s, &constructstring);
 
-  BIND(&done);
-  return var_result.value();
-}
+    BIND(&return_s);
+    { args.PopAndReturn(s_value); }
 
-TF_BUILTIN(StringConstructor, ConstructorBuiltinsAssembler) {
-  Node* context = Parameter(BuiltinDescriptor::kContext);
-  Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
-  CodeStubArguments args(this, argc);
-
-  args.PopAndReturn(EmitConstructString(argc, args, context, true));
-}
-
-TF_BUILTIN(StringConstructor_ConstructStub, ConstructorBuiltinsAssembler) {
-  Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
-                               MachineType::TaggedPointer());
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
-
-  Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
-  CodeStubArguments args(this, argc);
-
-  Node* string = EmitConstructString(argc, args, context, false);
-  Node* result = EmitFastNewObject(context, target, new_target);
-  StoreObjectField(result, JSValue::kValueOffset, string);
-  args.PopAndReturn(result);
+    BIND(&constructstring);
+    {
+      Node* result =
+          CallBuiltin(Builtins::kFastNewObject, context, target, new_target);
+      StoreObjectField(result, JSValue::kValueOffset, s_value);
+      args.PopAndReturn(result);
+    }
+  }
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-constructor-gen.h b/deps/v8/src/builtins/builtins-constructor-gen.h
index ac13dcbb6df..820970961bb 100644
--- a/deps/v8/src/builtins/builtins-constructor-gen.h
+++ b/deps/v8/src/builtins/builtins-constructor-gen.h
@@ -15,8 +15,6 @@ class ConstructorBuiltinsAssembler : public CodeStubAssembler {
   explicit ConstructorBuiltinsAssembler(compiler::CodeAssemblerState* state)
       : CodeStubAssembler(state) {}
 
-  Node* EmitFastNewClosure(Node* shared_info, Node* feedback_vector, Node* slot,
-                           Node* context);
   Node* EmitFastNewFunctionContext(Node* closure, Node* slots, Node* context,
                                    ScopeType scope_type);
 
@@ -38,9 +36,6 @@ class ConstructorBuiltinsAssembler : public CodeStubAssembler {
   Node* EmitFastNewObject(Node* context, Node* target, Node* new_target,
                           Label* call_runtime);
 
-  Node* EmitConstructString(Node* argc, CodeStubArguments& args, Node* context,
-                            bool convert_symbol);
-
  private:
   Node* NotHasBoilerplate(Node* literal_site);
   Node* LoadAllocationSiteBoilerplate(Node* allocation_site);
diff --git a/deps/v8/src/builtins/builtins-conversion-gen.cc b/deps/v8/src/builtins/builtins-conversion-gen.cc
index 98e0f2c8b2b..63a6dc0a913 100644
--- a/deps/v8/src/builtins/builtins-conversion-gen.cc
+++ b/deps/v8/src/builtins/builtins-conversion-gen.cc
@@ -62,7 +62,7 @@ void ConversionBuiltinsAssembler::Generate_NonPrimitiveToPrimitive(
     BIND(&if_resultisnotprimitive);
     {
       // Somehow the @@toPrimitive method on {input} didn't yield a primitive.
-      TailCallRuntime(Runtime::kThrowCannotConvertToPrimitive, context);
+      ThrowTypeError(context, MessageTemplate::kCannotConvertToPrimitive);
     }
   }
 
@@ -99,7 +99,7 @@ TF_BUILTIN(NonPrimitiveToPrimitive_String, ConversionBuiltinsAssembler) {
 }
 
 TF_BUILTIN(StringToNumber, CodeStubAssembler) {
-  Node* input = Parameter(Descriptor::kArgument);
+  TNode<String> input = CAST(Parameter(Descriptor::kArgument));
 
   Return(StringToNumber(input));
 }
@@ -126,12 +126,12 @@ TF_BUILTIN(NonNumberToNumeric, CodeStubAssembler) {
 }
 
 TF_BUILTIN(ToNumeric, CodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* input = Parameter(Descriptor::kArgument);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> input = CAST(Parameter(Descriptor::kArgument));
 
-  Return(Select(IsNumber(input), [=] { return input; },
-                [=] { return NonNumberToNumeric(context, input); },
-                MachineRepresentation::kTagged));
+  Return(Select<Numeric>(
+      IsNumber(input), [=] { return CAST(input); },
+      [=] { return NonNumberToNumeric(context, CAST(input)); }));
 }
 
 // ES6 section 7.1.3 ToNumber ( argument )
@@ -144,7 +144,7 @@ TF_BUILTIN(ToNumber, CodeStubAssembler) {
 
 // ES section #sec-tostring-applied-to-the-number-type
 TF_BUILTIN(NumberToString, CodeStubAssembler) {
-  Node* input = Parameter(Descriptor::kArgument);
+  TNode<Number> input = CAST(Parameter(Descriptor::kArgument));
 
   Return(NumberToString(input));
 }
@@ -208,7 +208,7 @@ void ConversionBuiltinsAssembler::Generate_OrdinaryToPrimitive(
     BIND(&if_methodisnotcallable);
   }
 
-  TailCallRuntime(Runtime::kThrowCannotConvertToPrimitive, context);
+  ThrowTypeError(context, MessageTemplate::kCannotConvertToPrimitive);
 
   BIND(&return_result);
   Return(var_result.value());
@@ -383,20 +383,13 @@ TF_BUILTIN(ToObject, CodeStubAssembler) {
   Return(js_value);
 
   BIND(&if_noconstructor);
-  TailCallRuntime(Runtime::kThrowUndefinedOrNullToObject, context,
-                  StringConstant("ToObject"));
+  ThrowTypeError(context, MessageTemplate::kUndefinedOrNullToObject,
+                 "ToObject");
 
   BIND(&if_jsreceiver);
   Return(object);
 }
 
-// Deprecated ES5 [[Class]] internal property (used to implement %_ClassOf).
-TF_BUILTIN(ClassOf, CodeStubAssembler) {
-  Node* object = Parameter(TypeofDescriptor::kObject);
-
-  Return(ClassOf(object));
-}
-
 // ES6 section 12.5.5 typeof operator
 TF_BUILTIN(Typeof, CodeStubAssembler) {
   Node* object = Parameter(TypeofDescriptor::kObject);
diff --git a/deps/v8/src/builtins/builtins-dataview.cc b/deps/v8/src/builtins/builtins-dataview.cc
index df7058d3774..065ed1641d5 100644
--- a/deps/v8/src/builtins/builtins-dataview.cc
+++ b/deps/v8/src/builtins/builtins-dataview.cc
@@ -14,97 +14,94 @@ namespace v8 {
 namespace internal {
 
 // -----------------------------------------------------------------------------
-// ES6 section 24.2 DataView Objects
+// ES #sec-dataview-objects
 
-// ES6 section 24.2.2 The DataView Constructor for the [[Call]] case.
+// ES #sec-dataview-constructor
 BUILTIN(DataViewConstructor) {
   HandleScope scope(isolate);
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate,
-      NewTypeError(MessageTemplate::kConstructorNotFunction,
-                   isolate->factory()->NewStringFromAsciiChecked("DataView")));
-}
-
-// ES6 section 24.2.2 The DataView Constructor for the [[Construct]] case.
-BUILTIN(DataViewConstructor_ConstructStub) {
-  HandleScope scope(isolate);
-  Handle<JSFunction> target = args.target();
-  Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
-  Handle<Object> buffer = args.atOrUndefined(isolate, 1);
-  Handle<Object> byte_offset = args.atOrUndefined(isolate, 2);
-  Handle<Object> byte_length = args.atOrUndefined(isolate, 3);
-
-  // 2. If Type(buffer) is not Object, throw a TypeError exception.
-  // 3. If buffer does not have an [[ArrayBufferData]] internal slot, throw a
-  //    TypeError exception.
-  if (!buffer->IsJSArrayBuffer()) {
+  if (args.new_target()->IsUndefined(isolate)) {  // [[Call]]
     THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate, NewTypeError(MessageTemplate::kDataViewNotArrayBuffer));
-  }
-  Handle<JSArrayBuffer> array_buffer = Handle<JSArrayBuffer>::cast(buffer);
-
-  // 4. Let offset be ToIndex(byteOffset).
-  Handle<Object> offset;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, offset,
-      Object::ToIndex(isolate, byte_offset, MessageTemplate::kInvalidOffset));
+        isolate, NewTypeError(MessageTemplate::kConstructorNotFunction,
+                              isolate->factory()->NewStringFromAsciiChecked(
+                                  "DataView")));
+  } else {  // [[Construct]]
+    Handle<JSFunction> target = args.target();
+    Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
+    Handle<Object> buffer = args.atOrUndefined(isolate, 1);
+    Handle<Object> byte_offset = args.atOrUndefined(isolate, 2);
+    Handle<Object> byte_length = args.atOrUndefined(isolate, 3);
+
+    // 2. If Type(buffer) is not Object, throw a TypeError exception.
+    // 3. If buffer does not have an [[ArrayBufferData]] internal slot, throw a
+    //    TypeError exception.
+    if (!buffer->IsJSArrayBuffer()) {
+      THROW_NEW_ERROR_RETURN_FAILURE(
+          isolate, NewTypeError(MessageTemplate::kDataViewNotArrayBuffer));
+    }
+    Handle<JSArrayBuffer> array_buffer = Handle<JSArrayBuffer>::cast(buffer);
 
-  // 5. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
-  // We currently violate the specification at this point.
+    // 4. Let offset be ? ToIndex(byteOffset).
+    Handle<Object> offset;
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, offset,
+        Object::ToIndex(isolate, byte_offset, MessageTemplate::kInvalidOffset));
 
-  // 6. Let bufferByteLength be the value of buffer's [[ArrayBufferByteLength]]
-  // internal slot.
-  double const buffer_byte_length = array_buffer->byte_length()->Number();
+    // 5. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+    //    We currently violate the specification at this point. TODO: Fix that.
 
-  // 7. If offset > bufferByteLength, throw a RangeError exception
-  if (offset->Number() > buffer_byte_length) {
-    THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate, NewRangeError(MessageTemplate::kInvalidOffset, offset));
-  }
+    // 6. Let bufferByteLength be the value of buffer's
+    // [[ArrayBufferByteLength]] internal slot.
+    double const buffer_byte_length = array_buffer->byte_length()->Number();
 
-  Handle<Object> view_byte_length;
-  if (byte_length->IsUndefined(isolate)) {
-    // 8. If byteLength is undefined, then
-    //       a. Let viewByteLength be bufferByteLength - offset.
-    view_byte_length =
-        isolate->factory()->NewNumber(buffer_byte_length - offset->Number());
-  } else {
-    // 9. Else,
-    //       a. Let viewByteLength be ? ToIndex(byteLength).
-    //       b. If offset+viewByteLength > bufferByteLength, throw a RangeError
-    //          exception
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, view_byte_length,
-        Object::ToIndex(isolate, byte_length,
-                        MessageTemplate::kInvalidDataViewLength));
-    if (offset->Number() + view_byte_length->Number() > buffer_byte_length) {
+    // 7. If offset > bufferByteLength, throw a RangeError exception.
+    if (offset->Number() > buffer_byte_length) {
       THROW_NEW_ERROR_RETURN_FAILURE(
-          isolate, NewRangeError(MessageTemplate::kInvalidDataViewLength));
+          isolate, NewRangeError(MessageTemplate::kInvalidOffset, offset));
     }
-  }
 
-  // 10. Let O be ? OrdinaryCreateFromConstructor(NewTarget,
-  //     "%DataViewPrototype%", «[[DataView]], [[ViewedArrayBuffer]],
-  //     [[ByteLength]], [[ByteOffset]]»).
-  // 11. Set O's [[DataView]] internal slot to true.
-  Handle<JSObject> result;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
-                                     JSObject::New(target, new_target));
-  for (int i = 0; i < ArrayBufferView::kEmbedderFieldCount; ++i) {
-    Handle<JSDataView>::cast(result)->SetEmbedderField(i, Smi::kZero);
-  }
+    Handle<Object> view_byte_length;
+    if (byte_length->IsUndefined(isolate)) {
+      // 8. If byteLength is either not present or undefined, then
+      //       a. Let viewByteLength be bufferByteLength - offset.
+      view_byte_length =
+          isolate->factory()->NewNumber(buffer_byte_length - offset->Number());
+    } else {
+      // 9. Else,
+      //       a. Let viewByteLength be ? ToIndex(byteLength).
+      //       b. If offset+viewByteLength > bufferByteLength, throw a
+      //          RangeError exception.
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+          isolate, view_byte_length,
+          Object::ToIndex(isolate, byte_length,
+                          MessageTemplate::kInvalidDataViewLength));
+      if (offset->Number() + view_byte_length->Number() > buffer_byte_length) {
+        THROW_NEW_ERROR_RETURN_FAILURE(
+            isolate, NewRangeError(MessageTemplate::kInvalidDataViewLength));
+      }
+    }
 
-  // 12. Set O's [[ViewedArrayBuffer]] internal slot to buffer.
-  Handle<JSDataView>::cast(result)->set_buffer(*array_buffer);
+    // 10. Let O be ? OrdinaryCreateFromConstructor(NewTarget,
+    //     "%DataViewPrototype%", «[[DataView]], [[ViewedArrayBuffer]],
+    //     [[ByteLength]], [[ByteOffset]]»).
+    Handle<JSObject> result;
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
+                                       JSObject::New(target, new_target));
+    for (int i = 0; i < ArrayBufferView::kEmbedderFieldCount; ++i) {
+      Handle<JSDataView>::cast(result)->SetEmbedderField(i, Smi::kZero);
+    }
+
+    // 11. Set O's [[ViewedArrayBuffer]] internal slot to buffer.
+    Handle<JSDataView>::cast(result)->set_buffer(*array_buffer);
 
-  // 13. Set O's [[ByteLength]] internal slot to viewByteLength.
-  Handle<JSDataView>::cast(result)->set_byte_length(*view_byte_length);
+    // 12. Set O's [[ByteLength]] internal slot to viewByteLength.
+    Handle<JSDataView>::cast(result)->set_byte_length(*view_byte_length);
 
-  // 14. Set O's [[ByteOffset]] internal slot to offset.
-  Handle<JSDataView>::cast(result)->set_byte_offset(*offset);
+    // 13. Set O's [[ByteOffset]] internal slot to offset.
+    Handle<JSDataView>::cast(result)->set_byte_offset(*offset);
 
-  // 15. Return O.
-  return *result;
+    // 14. Return O.
+    return *result;
+  }
 }
 
 // ES6 section 24.2.4.1 get DataView.prototype.buffer
@@ -157,11 +154,26 @@ void FlipBytes(uint8_t* target, uint8_t const* source) {
   }
 }
 
+template <typename T>
+MaybeHandle<Object> AllocateResult(Isolate* isolate, T value) {
+  return isolate->factory()->NewNumber(value);
+}
+
+template <>
+MaybeHandle<Object> AllocateResult(Isolate* isolate, int64_t value) {
+  return BigInt::FromInt64(isolate, value);
+}
+
+template <>
+MaybeHandle<Object> AllocateResult(Isolate* isolate, uint64_t value) {
+  return BigInt::FromUint64(isolate, value);
+}
+
 // ES6 section 24.2.1.1 GetViewValue (view, requestIndex, isLittleEndian, type)
 template <typename T>
 MaybeHandle<Object> GetViewValue(Isolate* isolate, Handle<JSDataView> data_view,
                                  Handle<Object> request_index,
-                                 bool is_little_endian) {
+                                 bool is_little_endian, const char* method) {
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, request_index,
       Object::ToIndex(isolate, request_index,
@@ -175,6 +187,13 @@ MaybeHandle<Object> GetViewValue(Isolate* isolate, Handle<JSDataView> data_view,
   }
   Handle<JSArrayBuffer> buffer(JSArrayBuffer::cast(data_view->buffer()),
                                isolate);
+  if (buffer->was_neutered()) {
+    Handle<String> operation =
+        isolate->factory()->NewStringFromAsciiChecked(method);
+    THROW_NEW_ERROR(
+        isolate, NewTypeError(MessageTemplate::kDetachedOperation, operation),
+        Object);
+  }
   size_t const data_view_byte_offset = NumberToSize(data_view->byte_offset());
   size_t const data_view_byte_length = NumberToSize(data_view->byte_length());
   if (get_index + sizeof(T) > data_view_byte_length ||
@@ -196,50 +215,78 @@ MaybeHandle<Object> GetViewValue(Isolate* isolate, Handle<JSDataView> data_view,
   } else {
     CopyBytes<sizeof(T)>(v.bytes, source);
   }
-  return isolate->factory()->NewNumber(v.data);
+  return AllocateResult<T>(isolate, v.data);
+}
+
+template <typename T>
+MaybeHandle<Object> DataViewConvertInput(Isolate* isolate,
+                                         Handle<Object> input) {
+  return Object::ToNumber(input);
+}
+
+template <>
+MaybeHandle<Object> DataViewConvertInput<int64_t>(Isolate* isolate,
+                                                  Handle<Object> input) {
+  return BigInt::FromObject(isolate, input);
+}
+
+template <>
+MaybeHandle<Object> DataViewConvertInput<uint64_t>(Isolate* isolate,
+                                                   Handle<Object> input) {
+  return BigInt::FromObject(isolate, input);
 }
 
 template <typename T>
-T DataViewConvertValue(double value);
+T DataViewConvertValue(Handle<Object> value);
+
+template <>
+int8_t DataViewConvertValue<int8_t>(Handle<Object> value) {
+  return static_cast<int8_t>(DoubleToInt32(value->Number()));
+}
 
 template <>
-int8_t DataViewConvertValue<int8_t>(double value) {
-  return static_cast<int8_t>(DoubleToInt32(value));
+int16_t DataViewConvertValue<int16_t>(Handle<Object> value) {
+  return static_cast<int16_t>(DoubleToInt32(value->Number()));
 }
 
 template <>
-int16_t DataViewConvertValue<int16_t>(double value) {
-  return static_cast<int16_t>(DoubleToInt32(value));
+int32_t DataViewConvertValue<int32_t>(Handle<Object> value) {
+  return DoubleToInt32(value->Number());
 }
 
 template <>
-int32_t DataViewConvertValue<int32_t>(double value) {
-  return DoubleToInt32(value);
+uint8_t DataViewConvertValue<uint8_t>(Handle<Object> value) {
+  return static_cast<uint8_t>(DoubleToUint32(value->Number()));
 }
 
 template <>
-uint8_t DataViewConvertValue<uint8_t>(double value) {
-  return static_cast<uint8_t>(DoubleToUint32(value));
+uint16_t DataViewConvertValue<uint16_t>(Handle<Object> value) {
+  return static_cast<uint16_t>(DoubleToUint32(value->Number()));
 }
 
 template <>
-uint16_t DataViewConvertValue<uint16_t>(double value) {
-  return static_cast<uint16_t>(DoubleToUint32(value));
+uint32_t DataViewConvertValue<uint32_t>(Handle<Object> value) {
+  return DoubleToUint32(value->Number());
 }
 
 template <>
-uint32_t DataViewConvertValue<uint32_t>(double value) {
-  return DoubleToUint32(value);
+float DataViewConvertValue<float>(Handle<Object> value) {
+  return static_cast<float>(value->Number());
 }
 
 template <>
-float DataViewConvertValue<float>(double value) {
-  return static_cast<float>(value);
+double DataViewConvertValue<double>(Handle<Object> value) {
+  return value->Number();
 }
 
 template <>
-double DataViewConvertValue<double>(double value) {
-  return value;
+int64_t DataViewConvertValue<int64_t>(Handle<Object> value) {
+  return BigInt::cast(*value)->AsInt64();
+}
+
+template <>
+uint64_t DataViewConvertValue<uint64_t>(Handle<Object> value) {
+  return BigInt::cast(*value)->AsUint64();
 }
 
 // ES6 section 24.2.1.2 SetViewValue (view, requestIndex, isLittleEndian, type,
@@ -247,13 +294,15 @@ double DataViewConvertValue<double>(double value) {
 template <typename T>
 MaybeHandle<Object> SetViewValue(Isolate* isolate, Handle<JSDataView> data_view,
                                  Handle<Object> request_index,
-                                 bool is_little_endian, Handle<Object> value) {
+                                 bool is_little_endian, Handle<Object> value,
+                                 const char* method) {
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, request_index,
       Object::ToIndex(isolate, request_index,
                       MessageTemplate::kInvalidDataViewAccessorOffset),
       Object);
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, value, Object::ToNumber(value), Object);
+  ASSIGN_RETURN_ON_EXCEPTION(isolate, value,
+                             DataViewConvertInput<T>(isolate, value), Object);
   size_t get_index = 0;
   if (!TryNumberToSize(*request_index, &get_index)) {
     THROW_NEW_ERROR(
@@ -262,6 +311,13 @@ MaybeHandle<Object> SetViewValue(Isolate* isolate, Handle<JSDataView> data_view,
   }
   Handle<JSArrayBuffer> buffer(JSArrayBuffer::cast(data_view->buffer()),
                                isolate);
+  if (buffer->was_neutered()) {
+    Handle<String> operation =
+        isolate->factory()->NewStringFromAsciiChecked(method);
+    THROW_NEW_ERROR(
+        isolate, NewTypeError(MessageTemplate::kDetachedOperation, operation),
+        Object);
+  }
   size_t const data_view_byte_offset = NumberToSize(data_view->byte_offset());
   size_t const data_view_byte_length = NumberToSize(data_view->byte_length());
   if (get_index + sizeof(T) > data_view_byte_length ||
@@ -274,7 +330,7 @@ MaybeHandle<Object> SetViewValue(Isolate* isolate, Handle<JSDataView> data_view,
     T data;
     uint8_t bytes[sizeof(T)];
   } v;
-  v.data = DataViewConvertValue<T>(value->Number());
+  v.data = DataViewConvertValue<T>(value);
   size_t const buffer_offset = data_view_byte_offset + get_index;
   DCHECK(NumberToSize(buffer->byte_length()) >= buffer_offset + sizeof(T));
   uint8_t* const target =
@@ -299,7 +355,8 @@ MaybeHandle<Object> SetViewValue(Isolate* isolate, Handle<JSDataView> data_view,
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(                                    \
         isolate, result,                                                   \
         GetViewValue<type>(isolate, data_view, byte_offset,                \
-                           is_little_endian->BooleanValue()));             \
+                           is_little_endian->BooleanValue(),               \
+                           "DataView.prototype.get" #Type));               \
     return *result;                                                        \
   }
 DATA_VIEW_PROTOTYPE_GET(Int8, int8_t)
@@ -310,6 +367,8 @@ DATA_VIEW_PROTOTYPE_GET(Int32, int32_t)
 DATA_VIEW_PROTOTYPE_GET(Uint32, uint32_t)
 DATA_VIEW_PROTOTYPE_GET(Float32, float)
 DATA_VIEW_PROTOTYPE_GET(Float64, double)
+DATA_VIEW_PROTOTYPE_GET(BigInt64, int64_t)
+DATA_VIEW_PROTOTYPE_GET(BigUint64, uint64_t)
 #undef DATA_VIEW_PROTOTYPE_GET
 
 #define DATA_VIEW_PROTOTYPE_SET(Type, type)                                \
@@ -323,7 +382,8 @@ DATA_VIEW_PROTOTYPE_GET(Float64, double)
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(                                    \
         isolate, result,                                                   \
         SetViewValue<type>(isolate, data_view, byte_offset,                \
-                           is_little_endian->BooleanValue(), value));      \
+                           is_little_endian->BooleanValue(), value,        \
+                           "DataView.prototype.get" #Type));               \
     return *result;                                                        \
   }
 DATA_VIEW_PROTOTYPE_SET(Int8, int8_t)
@@ -334,6 +394,8 @@ DATA_VIEW_PROTOTYPE_SET(Int32, int32_t)
 DATA_VIEW_PROTOTYPE_SET(Uint32, uint32_t)
 DATA_VIEW_PROTOTYPE_SET(Float32, float)
 DATA_VIEW_PROTOTYPE_SET(Float64, double)
+DATA_VIEW_PROTOTYPE_SET(BigInt64, int64_t)
+DATA_VIEW_PROTOTYPE_SET(BigUint64, uint64_t)
 #undef DATA_VIEW_PROTOTYPE_SET
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-date-gen.cc b/deps/v8/src/builtins/builtins-date-gen.cc
index f6f3563d551..8b58c1ec800 100644
--- a/deps/v8/src/builtins/builtins-date-gen.cc
+++ b/deps/v8/src/builtins/builtins-date-gen.cc
@@ -61,10 +61,7 @@ void DateBuiltinsAssembler::Generate_DatePrototype_GetField(Node* context,
 
   // Raise a TypeError if the receiver is not a date.
   BIND(&receiver_not_date);
-  {
-    CallRuntime(Runtime::kThrowNotDateError, context);
-    Unreachable();
-  }
+  { ThrowTypeError(context, MessageTemplate::kNotDateObject); }
 }
 
 TF_BUILTIN(DatePrototypeGetDate, DateBuiltinsAssembler) {
@@ -240,17 +237,14 @@ TF_BUILTIN(DatePrototypeToPrimitive, CodeStubAssembler) {
 
   // Raise a TypeError if the {hint} is invalid.
   BIND(&hint_is_invalid);
-  {
-    CallRuntime(Runtime::kThrowInvalidHint, context, hint);
-    Unreachable();
-  }
+  { ThrowTypeError(context, MessageTemplate::kInvalidHint, hint); }
 
   // Raise a TypeError if the {receiver} is not a JSReceiver instance.
   BIND(&receiver_is_invalid);
   {
-    CallRuntime(Runtime::kThrowIncompatibleMethodReceiver, context,
-                StringConstant("Date.prototype [ @@toPrimitive ]"), receiver);
-    Unreachable();
+    ThrowTypeError(context, MessageTemplate::kIncompatibleMethodReceiver,
+                   StringConstant("Date.prototype [ @@toPrimitive ]"),
+                   receiver);
   }
 }
 
diff --git a/deps/v8/src/builtins/builtins-date.cc b/deps/v8/src/builtins/builtins-date.cc
index 5f9f31e10ba..c60275d94ea 100644
--- a/deps/v8/src/builtins/builtins-date.cc
+++ b/deps/v8/src/builtins/builtins-date.cc
@@ -193,95 +193,94 @@ Object* SetLocalDateValue(Handle<JSDate> date, double time_val) {
 
 }  // namespace
 
-// ES6 section 20.3.2 The Date Constructor for the [[Call]] case.
+// ES #sec-date-constructor
 BUILTIN(DateConstructor) {
   HandleScope scope(isolate);
-  double const time_val = JSDate::CurrentTimeValue(isolate);
-  char buffer[128];
-  ToDateString(time_val, ArrayVector(buffer), isolate->date_cache());
-  RETURN_RESULT_OR_FAILURE(
-      isolate, isolate->factory()->NewStringFromUtf8(CStrVector(buffer)));
-}
-
-// ES6 section 20.3.2 The Date Constructor for the [[Construct]] case.
-BUILTIN(DateConstructor_ConstructStub) {
-  HandleScope scope(isolate);
-  int const argc = args.length() - 1;
-  Handle<JSFunction> target = args.target();
-  Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
-  double time_val;
-  if (argc == 0) {
-    time_val = JSDate::CurrentTimeValue(isolate);
-  } else if (argc == 1) {
-    Handle<Object> value = args.at(1);
-    if (value->IsJSDate()) {
-      time_val = Handle<JSDate>::cast(value)->value()->Number();
-    } else {
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value,
-                                         Object::ToPrimitive(value));
-      if (value->IsString()) {
-        time_val = ParseDateTimeString(Handle<String>::cast(value));
+  if (args.new_target()->IsUndefined(isolate)) {
+    double const time_val = JSDate::CurrentTimeValue(isolate);
+    char buffer[128];
+    ToDateString(time_val, ArrayVector(buffer), isolate->date_cache());
+    RETURN_RESULT_OR_FAILURE(
+        isolate, isolate->factory()->NewStringFromUtf8(CStrVector(buffer)));
+  } else {
+    int const argc = args.length() - 1;
+    Handle<JSFunction> target = args.target();
+    Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
+    double time_val;
+    if (argc == 0) {
+      time_val = JSDate::CurrentTimeValue(isolate);
+    } else if (argc == 1) {
+      Handle<Object> value = args.at(1);
+      if (value->IsJSDate()) {
+        time_val = Handle<JSDate>::cast(value)->value()->Number();
       } else {
         ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value,
-                                           Object::ToNumber(value));
-        time_val = value->Number();
+                                           Object::ToPrimitive(value));
+        if (value->IsString()) {
+          time_val = ParseDateTimeString(Handle<String>::cast(value));
+        } else {
+          ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value,
+                                             Object::ToNumber(value));
+          time_val = value->Number();
+        }
       }
-    }
-  } else {
-    Handle<Object> year_object;
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, year_object,
-                                       Object::ToNumber(args.at(1)));
-    Handle<Object> month_object;
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, month_object,
-                                       Object::ToNumber(args.at(2)));
-    double year = year_object->Number();
-    double month = month_object->Number();
-    double date = 1.0, hours = 0.0, minutes = 0.0, seconds = 0.0, ms = 0.0;
-    if (argc >= 3) {
-      Handle<Object> date_object;
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, date_object,
-                                         Object::ToNumber(args.at(3)));
-      date = date_object->Number();
-      if (argc >= 4) {
-        Handle<Object> hours_object;
-        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, hours_object,
-                                           Object::ToNumber(args.at(4)));
-        hours = hours_object->Number();
-        if (argc >= 5) {
-          Handle<Object> minutes_object;
-          ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, minutes_object,
-                                             Object::ToNumber(args.at(5)));
-          minutes = minutes_object->Number();
-          if (argc >= 6) {
-            Handle<Object> seconds_object;
-            ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, seconds_object,
-                                               Object::ToNumber(args.at(6)));
-            seconds = seconds_object->Number();
-            if (argc >= 7) {
-              Handle<Object> ms_object;
-              ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms_object,
-                                                 Object::ToNumber(args.at(7)));
-              ms = ms_object->Number();
+    } else {
+      Handle<Object> year_object;
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, year_object,
+                                         Object::ToNumber(args.at(1)));
+      Handle<Object> month_object;
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, month_object,
+                                         Object::ToNumber(args.at(2)));
+      double year = year_object->Number();
+      double month = month_object->Number();
+      double date = 1.0, hours = 0.0, minutes = 0.0, seconds = 0.0, ms = 0.0;
+      if (argc >= 3) {
+        Handle<Object> date_object;
+        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, date_object,
+                                           Object::ToNumber(args.at(3)));
+        date = date_object->Number();
+        if (argc >= 4) {
+          Handle<Object> hours_object;
+          ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, hours_object,
+                                             Object::ToNumber(args.at(4)));
+          hours = hours_object->Number();
+          if (argc >= 5) {
+            Handle<Object> minutes_object;
+            ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, minutes_object,
+                                               Object::ToNumber(args.at(5)));
+            minutes = minutes_object->Number();
+            if (argc >= 6) {
+              Handle<Object> seconds_object;
+              ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, seconds_object,
+                                                 Object::ToNumber(args.at(6)));
+              seconds = seconds_object->Number();
+              if (argc >= 7) {
+                Handle<Object> ms_object;
+                ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+                    isolate, ms_object, Object::ToNumber(args.at(7)));
+                ms = ms_object->Number();
+              }
             }
           }
         }
       }
+      if (!std::isnan(year)) {
+        double const y = DoubleToInteger(year);
+        if (0.0 <= y && y <= 99) year = 1900 + y;
+      }
+      double const day = MakeDay(year, month, date);
+      double const time = MakeTime(hours, minutes, seconds, ms);
+      time_val = MakeDate(day, time);
+      if (time_val >= -DateCache::kMaxTimeBeforeUTCInMs &&
+          time_val <= DateCache::kMaxTimeBeforeUTCInMs) {
+        time_val = isolate->date_cache()->ToUTC(static_cast<int64_t>(time_val));
+      } else {
+        time_val = std::numeric_limits<double>::quiet_NaN();
+      }
     }
-    if (!std::isnan(year)) {
-      double const y = DoubleToInteger(year);
-      if (0.0 <= y && y <= 99) year = 1900 + y;
-    }
-    double const day = MakeDay(year, month, date);
-    double const time = MakeTime(hours, minutes, seconds, ms);
-    time_val = MakeDate(day, time);
-    if (time_val >= -DateCache::kMaxTimeBeforeUTCInMs &&
-        time_val <= DateCache::kMaxTimeBeforeUTCInMs) {
-      time_val = isolate->date_cache()->ToUTC(static_cast<int64_t>(time_val));
-    } else {
-      time_val = std::numeric_limits<double>::quiet_NaN();
-    }
+    RETURN_RESULT_OR_FAILURE(isolate,
+                             JSDate::New(target, new_target, time_val));
   }
-  RETURN_RESULT_OR_FAILURE(isolate, JSDate::New(target, new_target, time_val));
 }
 
 // ES6 section 20.3.3.1 Date.now ( )
diff --git a/deps/v8/src/builtins/builtins-definitions.h b/deps/v8/src/builtins/builtins-definitions.h
index a4a0bb9e2cb..5d2b160f788 100644
--- a/deps/v8/src/builtins/builtins-definitions.h
+++ b/deps/v8/src/builtins/builtins-definitions.h
@@ -70,7 +70,7 @@ namespace internal {
   ASM(JSConstructStubGenericUnrestrictedReturn)                                \
   ASM(JSBuiltinsConstructStub)                                                 \
   TFC(FastNewObject, FastNewObject, 1)                                         \
-  TFC(FastNewClosure, FastNewClosure, 1)                                       \
+  TFS(FastNewClosure, kSharedFunctionInfo, kFeedbackCell)                      \
   TFC(FastNewFunctionContextEval, FastNewFunctionContext, 1)                   \
   TFC(FastNewFunctionContextFunction, FastNewFunctionContext, 1)               \
   TFS(CreateRegExpLiteral, kFeedbackVector, kSlot, kPattern, kFlags)           \
@@ -92,8 +92,8 @@ namespace internal {
                                                                                \
   /* String helpers */                                                         \
   TFC(StringCharAt, StringAt, 1)                                               \
-  TFC(StringCharCodeAt, StringAt, 1)                                           \
-  TFC(StringCodePointAt, StringAt, 1)                                          \
+  TFC(StringCodePointAtUTF16, StringAt, 1)                                     \
+  TFC(StringCodePointAtUTF32, StringAt, 1)                                     \
   TFC(StringEqual, Compare, 1)                                                 \
   TFC(StringGreaterThan, Compare, 1)                                           \
   TFC(StringGreaterThanOrEqual, Compare, 1)                                    \
@@ -101,7 +101,7 @@ namespace internal {
   TFC(StringLessThan, Compare, 1)                                              \
   TFC(StringLessThanOrEqual, Compare, 1)                                       \
   TFS(StringRepeat, kString, kCount)                                           \
-  TFS(SubString, kString, kFrom, kTo)                                          \
+  TFC(StringSubstring, StringSubstring, 1)                                     \
                                                                                \
   /* OrderedHashTable helpers */                                               \
   TFS(OrderedHashTableHealIndex, kTable, kIndex)                               \
@@ -110,11 +110,9 @@ namespace internal {
   ASM(InterpreterEntryTrampoline)                                              \
   ASM(InterpreterPushArgsThenCall)                                             \
   ASM(InterpreterPushUndefinedAndArgsThenCall)                                 \
-  ASM(InterpreterPushArgsThenCallFunction)                                     \
-  ASM(InterpreterPushUndefinedAndArgsThenCallFunction)                         \
   ASM(InterpreterPushArgsThenCallWithFinalSpread)                              \
   ASM(InterpreterPushArgsThenConstruct)                                        \
-  ASM(InterpreterPushArgsThenConstructFunction)                                \
+  ASM(InterpreterPushArgsThenConstructArrayFunction)                           \
   ASM(InterpreterPushArgsThenConstructWithFinalSpread)                         \
   ASM(InterpreterEnterBytecodeAdvance)                                         \
   ASM(InterpreterEnterBytecodeDispatch)                                        \
@@ -123,7 +121,6 @@ namespace internal {
   /* Code life-cycle */                                                        \
   ASM(CompileLazy)                                                             \
   ASM(CompileLazyDeoptimizedCode)                                              \
-  ASM(CheckOptimizationMarker)                                                 \
   ASM(DeserializeLazy)                                                         \
   ASM(InstantiateAsmJs)                                                        \
   ASM(NotifyDeoptimized)                                                       \
@@ -171,6 +168,7 @@ namespace internal {
   TFC(NewArgumentsElements, NewArgumentsElements, 1)                           \
                                                                                \
   /* Debugger */                                                               \
+  TFJ(DebugBreakTrampoline, SharedFunctionInfo::kDontAdaptArgumentsSentinel)   \
   ASM(FrameDropperTrampoline)                                                  \
   ASM(HandleDebuggerStatement)                                                 \
                                                                                \
@@ -193,7 +191,6 @@ namespace internal {
   TFC(ToInteger, TypeConversion, 1)                                            \
   TFC(ToInteger_TruncateMinusZero, TypeConversion, 1)                          \
   TFC(ToLength, TypeConversion, 1)                                             \
-  TFC(ClassOf, Typeof, 1)                                                      \
   TFC(Typeof, Typeof, 1)                                                       \
   TFC(GetSuperConstructor, Typeof, 1)                                          \
                                                                                \
@@ -215,15 +212,11 @@ namespace internal {
   TFH(LoadIC_Uninitialized, LoadWithVector)                                    \
   TFH(StoreGlobalIC_Slow, StoreWithVector)                                     \
   TFH(StoreIC_Uninitialized, StoreWithVector)                                  \
+  TFH(StoreInArrayLiteralIC_Slow, StoreWithVector)                             \
                                                                                \
-  /* Promise helpers */                                                        \
-  TFS(ResolveNativePromise, kPromise, kValue)                                  \
-  TFS(RejectNativePromise, kPromise, kValue, kDebugEvent)                      \
-  TFS(PerformNativePromiseThen, kPromise, kResolveReaction, kRejectReaction,   \
-      kResultPromise)                                                          \
+  /* Microtask helpers */                                                      \
   TFS(EnqueueMicrotask, kMicrotask)                                            \
   TFC(RunMicrotasks, RunMicrotasks, 1)                                         \
-  TFS(PromiseResolveThenableJob, kMicrotask)                                   \
                                                                                \
   /* Object property helpers */                                                \
   TFS(HasProperty, kKey, kObject)                                              \
@@ -247,9 +240,24 @@ namespace internal {
   CPP(ArrayConcat)                                                             \
   /* ES6 #sec-array.isarray */                                                 \
   TFJ(ArrayIsArray, 1, kArg)                                                   \
+  /* ES6 #sec-array.from */                                                    \
+  TFJ(ArrayFrom, SharedFunctionInfo::kDontAdaptArgumentsSentinel)              \
+  /* ES6 #sec-array.of */                                                      \
+  TFJ(ArrayOf, SharedFunctionInfo::kDontAdaptArgumentsSentinel)                \
   /* ES7 #sec-array.prototype.includes */                                      \
+  TFS(ArrayIncludesSmiOrObject, kElements, kSearchElement, kLength,            \
+      kFromIndex)                                                              \
+  TFS(ArrayIncludesPackedDoubles, kElements, kSearchElement, kLength,          \
+      kFromIndex)                                                              \
+  TFS(ArrayIncludesHoleyDoubles, kElements, kSearchElement, kLength,           \
+      kFromIndex)                                                              \
   TFJ(ArrayIncludes, SharedFunctionInfo::kDontAdaptArgumentsSentinel)          \
   /* ES6 #sec-array.prototype.indexof */                                       \
+  TFS(ArrayIndexOfSmiOrObject, kElements, kSearchElement, kLength, kFromIndex) \
+  TFS(ArrayIndexOfPackedDoubles, kElements, kSearchElement, kLength,           \
+      kFromIndex)                                                              \
+  TFS(ArrayIndexOfHoleyDoubles, kElements, kSearchElement, kLength,            \
+      kFromIndex)                                                              \
   TFJ(ArrayIndexOf, SharedFunctionInfo::kDontAdaptArgumentsSentinel)           \
   /* ES6 #sec-array.prototype.pop */                                           \
   CPP(ArrayPop)                                                                \
@@ -261,7 +269,6 @@ namespace internal {
   CPP(ArrayShift)                                                              \
   TFJ(ArrayPrototypeShift, SharedFunctionInfo::kDontAdaptArgumentsSentinel)    \
   /* ES6 #sec-array.prototype.slice */                                         \
-  CPP(ArraySlice)                                                              \
   TFJ(ArrayPrototypeSlice, SharedFunctionInfo::kDontAdaptArgumentsSentinel)    \
   /* ES6 #sec-array.prototype.splice */                                        \
   CPP(ArraySplice)                                                             \
@@ -313,6 +320,7 @@ namespace internal {
   /* ES6 #sec-array.prototype.reduce */                                        \
   TFS(ArrayReduceLoopContinuation, kReceiver, kCallbackFn, kThisArg,           \
       kAccumulator, kObject, kInitialK, kLength, kTo)                          \
+  TFJ(ArrayReducePreLoopEagerDeoptContinuation, 2, kCallbackFn, kLength)       \
   TFJ(ArrayReduceLoopEagerDeoptContinuation, 4, kCallbackFn, kInitialK,        \
       kLength, kAccumulator)                                                   \
   TFJ(ArrayReduceLoopLazyDeoptContinuation, 4, kCallbackFn, kInitialK,         \
@@ -321,6 +329,7 @@ namespace internal {
   /* ES6 #sec-array.prototype.reduceRight */                                   \
   TFS(ArrayReduceRightLoopContinuation, kReceiver, kCallbackFn, kThisArg,      \
       kAccumulator, kObject, kInitialK, kLength, kTo)                          \
+  TFJ(ArrayReduceRightPreLoopEagerDeoptContinuation, 2, kCallbackFn, kLength)  \
   TFJ(ArrayReduceRightLoopEagerDeoptContinuation, 4, kCallbackFn, kInitialK,   \
       kLength, kAccumulator)                                                   \
   TFJ(ArrayReduceRightLoopLazyDeoptContinuation, 4, kCallbackFn, kInitialK,    \
@@ -355,27 +364,33 @@ namespace internal {
   TFJ(ArrayPrototypeValues, 0)                                                 \
   /* ES6 #sec-%arrayiteratorprototype%.next */                                 \
   TFJ(ArrayIteratorPrototypeNext, 0)                                           \
+  /* https://tc39.github.io/proposal-flatMap/#sec-FlattenIntoArray */          \
+  TFS(FlattenIntoArray, kTarget, kSource, kSourceLength, kStart, kDepth)       \
+  TFS(FlatMapIntoArray, kTarget, kSource, kSourceLength, kStart, kDepth,       \
+      kMapperFunction, kThisArg)                                               \
+  /* https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatten */   \
+  TFJ(ArrayPrototypeFlatten, SharedFunctionInfo::kDontAdaptArgumentsSentinel)  \
+  /* https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatMap */   \
+  TFJ(ArrayPrototypeFlatMap, SharedFunctionInfo::kDontAdaptArgumentsSentinel)  \
                                                                                \
   /* ArrayBuffer */                                                            \
+  /* ES #sec-arraybuffer-constructor */                                        \
   CPP(ArrayBufferConstructor)                                                  \
-  CPP(ArrayBufferConstructor_ConstructStub)                                    \
   CPP(ArrayBufferConstructor_DoNotInitialize)                                  \
   CPP(ArrayBufferPrototypeGetByteLength)                                       \
   CPP(ArrayBufferIsView)                                                       \
   CPP(ArrayBufferPrototypeSlice)                                               \
                                                                                \
   /* AsyncFunction */                                                          \
-  TFJ(AsyncFunctionAwaitCaught, 3, kGenerator, kAwaited, kOuterPromise)        \
-  TFJ(AsyncFunctionAwaitUncaught, 3, kGenerator, kAwaited, kOuterPromise)      \
-  TFJ(AsyncFunctionAwaitRejectClosure, 1, kSentError)                          \
-  TFJ(AsyncFunctionAwaitResolveClosure, 1, kSentValue)                         \
+  TFC(AsyncFunctionAwaitFulfill, PromiseReactionHandler, 1)                    \
+  TFC(AsyncFunctionAwaitReject, PromiseReactionHandler, 1)                     \
+  TFS(AsyncFunctionAwaitCaught, kGenerator, kValue, kOuterPromise)             \
+  TFS(AsyncFunctionAwaitUncaught, kGenerator, kValue, kOuterPromise)           \
   TFJ(AsyncFunctionPromiseCreate, 0)                                           \
   TFJ(AsyncFunctionPromiseRelease, 1, kPromise)                                \
                                                                                \
   /* BigInt */                                                                 \
   CPP(BigIntConstructor)                                                       \
-  CPP(BigIntConstructor_ConstructStub)                                         \
-  CPP(BigIntParseInt)                                                          \
   CPP(BigIntAsUintN)                                                           \
   CPP(BigIntAsIntN)                                                            \
   CPP(BigIntPrototypeToLocaleString)                                           \
@@ -383,8 +398,8 @@ namespace internal {
   CPP(BigIntPrototypeValueOf)                                                  \
                                                                                \
   /* Boolean */                                                                \
+  /* ES #sec-boolean-constructor */                                            \
   CPP(BooleanConstructor)                                                      \
-  CPP(BooleanConstructor_ConstructStub)                                        \
   /* ES6 #sec-boolean.prototype.tostring */                                    \
   TFJ(BooleanPrototypeToString, 0)                                             \
   /* ES6 #sec-boolean.prototype.valueof */                                     \
@@ -436,8 +451,8 @@ namespace internal {
   CPP(ConsoleContext)                                                          \
                                                                                \
   /* DataView */                                                               \
+  /* ES #sec-dataview-constructor */                                           \
   CPP(DataViewConstructor)                                                     \
-  CPP(DataViewConstructor_ConstructStub)                                       \
   CPP(DataViewPrototypeGetBuffer)                                              \
   CPP(DataViewPrototypeGetByteLength)                                          \
   CPP(DataViewPrototypeGetByteOffset)                                          \
@@ -457,10 +472,14 @@ namespace internal {
   CPP(DataViewPrototypeSetFloat32)                                             \
   CPP(DataViewPrototypeGetFloat64)                                             \
   CPP(DataViewPrototypeSetFloat64)                                             \
+  CPP(DataViewPrototypeGetBigInt64)                                            \
+  CPP(DataViewPrototypeSetBigInt64)                                            \
+  CPP(DataViewPrototypeGetBigUint64)                                           \
+  CPP(DataViewPrototypeSetBigUint64)                                           \
                                                                                \
   /* Date */                                                                   \
+  /* ES #sec-date-constructor */                                               \
   CPP(DateConstructor)                                                         \
-  CPP(DateConstructor_ConstructStub)                                           \
   /* ES6 #sec-date.prototype.getdate */                                        \
   TFJ(DatePrototypeGetDate, 0)                                                 \
   /* ES6 #sec-date.prototype.getday */                                         \
@@ -596,6 +615,7 @@ namespace internal {
   TFH(StoreICTrampoline, Store)                                                \
   TFH(KeyedStoreIC, StoreWithVector)                                           \
   TFH(KeyedStoreICTrampoline, Store)                                           \
+  TFH(StoreInArrayLiteralIC, StoreWithVector)                                  \
   TFH(LoadGlobalIC, LoadGlobalWithVector)                                      \
   TFH(LoadGlobalICInsideTypeof, LoadGlobalWithVector)                          \
   TFH(LoadGlobalICTrampoline, LoadGlobal)                                      \
@@ -696,11 +716,8 @@ namespace internal {
                                                                                \
   /* Number */                                                                 \
   TFC(AllocateHeapNumber, AllocateHeapNumber, 1)                               \
-  /* ES6 section 20.1.1.1 Number ( [ value ] ) for the [[Call]] case */        \
+  /* ES #sec-number-constructor */                                             \
   TFJ(NumberConstructor, SharedFunctionInfo::kDontAdaptArgumentsSentinel)      \
-  /* ES6 section 20.1.1.1 Number ( [ value ] ) for the [[Construct]] case */   \
-  TFJ(NumberConstructor_ConstructStub,                                         \
-      SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
   /* ES6 #sec-number.isfinite */                                               \
   TFJ(NumberIsFinite, 1, kNumber)                                              \
   /* ES6 #sec-number.isinteger */                                              \
@@ -745,9 +762,8 @@ namespace internal {
   TFS(Negate, kValue)                                                          \
                                                                                \
   /* Object */                                                                 \
+  /* ES #sec-object-constructor */                                             \
   TFJ(ObjectConstructor, SharedFunctionInfo::kDontAdaptArgumentsSentinel)      \
-  TFJ(ObjectConstructor_ConstructStub,                                         \
-      SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
   CPP(ObjectAssign)                                                            \
   /* ES #sec-object.create */                                                  \
   TFJ(ObjectCreate, SharedFunctionInfo::kDontAdaptArgumentsSentinel)           \
@@ -755,7 +771,7 @@ namespace internal {
   CPP(ObjectDefineProperties)                                                  \
   CPP(ObjectDefineProperty)                                                    \
   CPP(ObjectDefineSetter)                                                      \
-  CPP(ObjectEntries)                                                           \
+  TFJ(ObjectEntries, 1, kObject)                                               \
   CPP(ObjectFreeze)                                                            \
   TFJ(ObjectGetOwnPropertyDescriptor,                                          \
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
@@ -785,7 +801,7 @@ namespace internal {
   /* ES #sec-object.prototype.tolocalestring */                                \
   TFJ(ObjectPrototypeToLocaleString, 0)                                        \
   CPP(ObjectSeal)                                                              \
-  CPP(ObjectValues)                                                            \
+  TFJ(ObjectValues, 1, kObject)                                                \
                                                                                \
   /* instanceof */                                                             \
   TFC(OrdinaryHasInstance, Compare, 1)                                         \
@@ -796,36 +812,42 @@ namespace internal {
   TFS(ForInFilter, kKey, kObject)                                              \
                                                                                \
   /* Promise */                                                                \
+  /* ES #sec-fulfillpromise */                                                 \
+  TFS(FulfillPromise, kPromise, kValue)                                        \
+  /* ES #sec-rejectpromise */                                                  \
+  TFS(RejectPromise, kPromise, kReason, kDebugEvent)                           \
+  /* ES #sec-promise-resolve-functions */                                      \
+  /* Starting at step 6 of "Promise Resolve Functions" */                      \
+  TFS(ResolvePromise, kPromise, kResolution)                                   \
+  /* ES #sec-promise-reject-functions */                                       \
+  TFJ(PromiseCapabilityDefaultReject, 1, kReason)                              \
+  /* ES #sec-promise-resolve-functions */                                      \
+  TFJ(PromiseCapabilityDefaultResolve, 1, kResolution)                         \
   /* ES6 #sec-getcapabilitiesexecutor-functions */                             \
   TFJ(PromiseGetCapabilitiesExecutor, 2, kResolve, kReject)                    \
   /* ES6 #sec-newpromisecapability */                                          \
-  TFJ(NewPromiseCapability, 2, kConstructor, kDebugEvent)                      \
+  TFS(NewPromiseCapability, kConstructor, kDebugEvent)                         \
+  TFJ(PromiseConstructorLazyDeoptContinuation, 2, kPromise, kResult)           \
   /* ES6 #sec-promise-executor */                                              \
   TFJ(PromiseConstructor, 1, kExecutor)                                        \
-  TFJ(PromiseInternalConstructor, 1, kParent)                                  \
   CPP(IsPromise)                                                               \
-  /* ES #sec-promise-resolve-functions */                                      \
-  TFJ(PromiseResolveClosure, 1, kValue)                                        \
-  /* ES #sec-promise-reject-functions */                                       \
-  TFJ(PromiseRejectClosure, 1, kValue)                                         \
-  TFJ(PromiseAllResolveElementClosure, 1, kValue)                              \
   /* ES #sec-promise.prototype.then */                                         \
-  TFJ(PromisePrototypeThen, 2, kOnFullfilled, kOnRejected)                     \
+  TFJ(PromisePrototypeThen, 2, kOnFulfilled, kOnRejected)                      \
+  /* ES #sec-performpromisethen */                                             \
+  TFS(PerformPromiseThen, kPromise, kOnFulfilled, kOnRejected, kResultPromise) \
   /* ES #sec-promise.prototype.catch */                                        \
   TFJ(PromisePrototypeCatch, 1, kOnRejected)                                   \
-  /* ES #sec-fulfillpromise */                                                 \
-  TFJ(ResolvePromise, 2, kPromise, kValue)                                     \
-  TFS(PromiseHandleReject, kPromise, kOnReject, kException)                    \
-  TFS(PromiseHandle, kValue, kHandler, kDeferredPromise, kDeferredOnResolve,   \
-      kDeferredOnReject)                                                       \
-  TFJ(PromiseHandleJS, 5, kValue, kHandler, kDeferredPromise,                  \
-      kDeferredOnResolve, kDeferredOnReject)                                   \
+  /* ES #sec-promisereactionjob */                                             \
+  TFS(PromiseRejectReactionJob, kReason, kHandler, kPayload)                   \
+  TFS(PromiseFulfillReactionJob, kValue, kHandler, kPayload)                   \
+  /* ES #sec-promiseresolvethenablejob */                                      \
+  TFS(PromiseResolveThenableJob, kPromiseToResolve, kThenable, kThen)          \
   /* ES #sec-promise.resolve */                                                \
-  TFJ(PromiseResolveWrapper, 1, kValue)                                        \
+  TFJ(PromiseResolveTrampoline, 1, kValue)                                     \
+  /* ES #sec-promise-resolve */                                                \
   TFS(PromiseResolve, kConstructor, kValue)                                    \
   /* ES #sec-promise.reject */                                                 \
   TFJ(PromiseReject, 1, kReason)                                               \
-  TFJ(InternalPromiseReject, 3, kPromise, kReason, kDebugEvent)                \
   TFJ(PromisePrototypeFinally, 1, kOnFinally)                                  \
   TFJ(PromiseThenFinally, 1, kValue)                                           \
   TFJ(PromiseCatchFinally, 1, kReason)                                         \
@@ -833,13 +855,18 @@ namespace internal {
   TFJ(PromiseThrowerFinally, 0)                                                \
   /* ES #sec-promise.all */                                                    \
   TFJ(PromiseAll, 1, kIterable)                                                \
+  TFJ(PromiseAllResolveElementClosure, 1, kValue)                              \
   /* ES #sec-promise.race */                                                   \
   TFJ(PromiseRace, 1, kIterable)                                               \
+  /* V8 Extras: v8.createPromise(parent) */                                    \
+  TFJ(PromiseInternalConstructor, 1, kParent)                                  \
+  /* V8 Extras: v8.rejectPromise(promise, reason) */                           \
+  TFJ(PromiseInternalReject, 2, kPromise, kReason)                             \
+  /* V8 Extras: v8.resolvePromise(promise, resolution) */                      \
+  TFJ(PromiseInternalResolve, 2, kPromise, kResolution)                        \
                                                                                \
   /* Proxy */                                                                  \
-  TFJ(ProxyConstructor, 0)                                                     \
-  TFJ(ProxyConstructor_ConstructStub,                                          \
-      SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
+  TFJ(ProxyConstructor, 2, kTarget, kHandler)                                  \
   TFJ(ProxyRevocable, 2, kTarget, kHandler)                                    \
   TFJ(ProxyRevoke, 0)                                                          \
   TFS(ProxyGetProperty, kProxy, kName, kReceiverValue)                         \
@@ -954,9 +981,9 @@ namespace internal {
   CPP(AtomicsWake)                                                             \
                                                                                \
   /* String */                                                                 \
+  /* ES #sec-string-constructor */                                             \
   TFJ(StringConstructor, SharedFunctionInfo::kDontAdaptArgumentsSentinel)      \
-  TFJ(StringConstructor_ConstructStub,                                         \
-      SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
+  /* ES #sec-string.fromcodepoint */                                           \
   CPP(StringFromCodePoint)                                                     \
   /* ES6 #sec-string.fromcharcode */                                           \
   TFJ(StringFromCharCode, SharedFunctionInfo::kDontAdaptArgumentsSentinel)     \
@@ -1032,9 +1059,8 @@ namespace internal {
   /* ES6 #sec-string.prototype.tostring */                                     \
   TFJ(StringPrototypeToString, 0)                                              \
   TFJ(StringPrototypeTrim, SharedFunctionInfo::kDontAdaptArgumentsSentinel)    \
-  TFJ(StringPrototypeTrimLeft,                                                 \
-      SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
-  TFJ(StringPrototypeTrimRight,                                                \
+  TFJ(StringPrototypeTrimEnd, SharedFunctionInfo::kDontAdaptArgumentsSentinel) \
+  TFJ(StringPrototypeTrimStart,                                                \
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
   /* ES6 #sec-string.prototype.valueof */                                      \
   TFJ(StringPrototypeValueOf, 0)                                               \
@@ -1048,8 +1074,8 @@ namespace internal {
   TFJ(StringIteratorPrototypeNext, 0)                                          \
                                                                                \
   /* Symbol */                                                                 \
+  /* ES #sec-symbol-constructor */                                             \
   CPP(SymbolConstructor)                                                       \
-  CPP(SymbolConstructor_ConstructStub)                                         \
   /* ES6 #sec-symbol.for */                                                    \
   CPP(SymbolFor)                                                               \
   /* ES6 #sec-symbol.keyfor */                                                 \
@@ -1062,16 +1088,14 @@ namespace internal {
   TFJ(SymbolPrototypeValueOf, 0)                                               \
                                                                                \
   /* TypedArray */                                                             \
+  TFS(IterableToList, kIterable, kIteratorFn)                                  \
   TFS(TypedArrayInitialize, kHolder, kLength, kElementSize, kInitialize)       \
   TFS(TypedArrayInitializeWithBuffer, kHolder, kLength, kBuffer, kElementSize, \
       kByteOffset)                                                             \
-  /* ES6 #sec-typedarray-buffer-byteoffset-length */                           \
-  TFJ(TypedArrayConstructByArrayBuffer, 5, kHolder, kBuffer, kByteOffset,      \
-      kLength, kElementSize)                                                   \
-  TFJ(TypedArrayConstructByArrayLike, 4, kHolder, kArrayLike, kLength,         \
-      kElementSize)                                                            \
-  /* ES6 #sec-typedarray-length */                                             \
-  TFJ(TypedArrayConstructByLength, 3, kHolder, kLength, kElementSize)          \
+  /* ES #sec-typedarray-constructors */                                        \
+  TFS(CreateTypedArray, kTarget, kNewTarget, kArg1, kArg2, kArg3)              \
+  TFJ(TypedArrayConstructorLazyDeoptContinuation, 1, kResult)                  \
+  TFJ(TypedArrayConstructor, SharedFunctionInfo::kDontAdaptArgumentsSentinel)  \
   CPP(TypedArrayPrototypeBuffer)                                               \
   /* ES6 #sec-get-%typedarray%.prototype.bytelength */                         \
   TFJ(TypedArrayPrototypeByteLength, 0)                                        \
@@ -1089,6 +1113,9 @@ namespace internal {
   CPP(TypedArrayPrototypeCopyWithin)                                           \
   /* ES6 #sec-%typedarray%.prototype.fill */                                   \
   CPP(TypedArrayPrototypeFill)                                                 \
+  /* ES6 #sec-%typedarray%.prototype.filter */                                 \
+  TFJ(TypedArrayPrototypeFilter,                                               \
+      SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
   /* ES6 %TypedArray%.prototype.find */                                        \
   TFJ(TypedArrayPrototypeFind,                                                 \
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
@@ -1106,7 +1133,11 @@ namespace internal {
   /* ES6 %TypedArray%.prototype.set */                                         \
   TFJ(TypedArrayPrototypeSet, SharedFunctionInfo::kDontAdaptArgumentsSentinel) \
   /* ES6 #sec-%typedarray%.prototype.slice */                                  \
-  CPP(TypedArrayPrototypeSlice)                                                \
+  TFJ(TypedArrayPrototypeSlice,                                                \
+      SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
+  /* ES6 %TypedArray%.prototype.subarray */                                    \
+  TFJ(TypedArrayPrototypeSubArray,                                             \
+      SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
   /* ES6 #sec-get-%typedarray%.prototype-@@tostringtag */                      \
   TFJ(TypedArrayPrototypeToStringTag, 0)                                       \
   /* ES6 %TypedArray%.prototype.every */                                       \
@@ -1126,6 +1157,10 @@ namespace internal {
   /* ES6 %TypedArray%.prototype.forEach */                                     \
   TFJ(TypedArrayPrototypeForEach,                                              \
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
+  /* ES6 %TypedArray%.of */                                                    \
+  TFJ(TypedArrayOf, SharedFunctionInfo::kDontAdaptArgumentsSentinel)           \
+  /* ES6 %TypedArray%.from */                                                  \
+  TFJ(TypedArrayFrom, SharedFunctionInfo::kDontAdaptArgumentsSentinel)         \
                                                                                \
   /* Wasm */                                                                   \
   ASM(WasmCompileLazy)                                                         \
@@ -1159,6 +1194,17 @@ namespace internal {
                                                                                \
   /* AsyncGenerator */                                                         \
                                                                                \
+  /* Await (proposal-async-iteration/#await), with resume behaviour */         \
+  /* specific to Async Generators. Internal / Not exposed to JS code. */       \
+  TFS(AsyncGeneratorAwaitCaught, kGenerator, kValue)                           \
+  TFS(AsyncGeneratorAwaitUncaught, kGenerator, kValue)                         \
+  TFC(AsyncGeneratorAwaitFulfill, PromiseReactionHandler, 1)                   \
+  TFC(AsyncGeneratorAwaitReject, PromiseReactionHandler, 1)                    \
+  TFC(AsyncGeneratorYieldFulfill, PromiseReactionHandler, 1)                   \
+  TFC(AsyncGeneratorReturnClosedFulfill, PromiseReactionHandler, 1)            \
+  TFC(AsyncGeneratorReturnClosedReject, PromiseReactionHandler, 1)             \
+  TFC(AsyncGeneratorReturnFulfill, PromiseReactionHandler, 1)                  \
+                                                                               \
   TFS(AsyncGeneratorResolve, kGenerator, kValue, kDone)                        \
   TFS(AsyncGeneratorReject, kGenerator, kValue)                                \
   TFS(AsyncGeneratorYield, kGenerator, kValue, kIsCaught)                      \
@@ -1181,17 +1227,6 @@ namespace internal {
   TFJ(AsyncGeneratorPrototypeThrow,                                            \
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
                                                                                \
-  /* Await (proposal-async-iteration/#await), with resume behaviour */         \
-  /* specific to Async Generators. Internal / Not exposed to JS code. */       \
-  TFJ(AsyncGeneratorAwaitCaught, 2, kGenerator, kAwaited)                      \
-  TFJ(AsyncGeneratorAwaitUncaught, 2, kGenerator, kAwaited)                    \
-  TFJ(AsyncGeneratorAwaitResolveClosure, 1, kValue)                            \
-  TFJ(AsyncGeneratorAwaitRejectClosure, 1, kValue)                             \
-  TFJ(AsyncGeneratorYieldResolveClosure, 1, kValue)                            \
-  TFJ(AsyncGeneratorReturnClosedResolveClosure, 1, kValue)                     \
-  TFJ(AsyncGeneratorReturnClosedRejectClosure, 1, kValue)                      \
-  TFJ(AsyncGeneratorReturnResolveClosure, 1, kValue)                           \
-                                                                               \
   /* Async-from-Sync Iterator */                                               \
                                                                                \
   /* %AsyncFromSyncIteratorPrototype% */                                       \
@@ -1240,25 +1275,16 @@ namespace internal {
   V(AsyncFromSyncIteratorPrototypeNext)              \
   V(AsyncFromSyncIteratorPrototypeReturn)            \
   V(AsyncFromSyncIteratorPrototypeThrow)             \
-  V(AsyncFunctionAwaitCaught)                        \
-  V(AsyncFunctionAwaitUncaught)                      \
   V(AsyncGeneratorResolve)                           \
-  V(AsyncGeneratorAwaitCaught)                       \
-  V(AsyncGeneratorAwaitUncaught)                     \
-  V(PerformNativePromiseThen)                        \
   V(PromiseAll)                                      \
   V(PromiseConstructor)                              \
-  V(PromiseHandle)                                   \
+  V(PromiseFulfillReactionJob)                       \
   V(PromiseRace)                                     \
-  V(PromiseResolve)                                  \
-  V(PromiseResolveClosure)                           \
-  V(RejectNativePromise)                             \
-  V(ResolveNativePromise)                            \
   V(ResolvePromise)
 
 // The exception thrown in the following builtins are caught internally and will
 // not be propagated further or re-thrown
-#define BUILTIN_EXCEPTION_CAUGHT_PREDICTION_LIST(V) V(PromiseHandleReject)
+#define BUILTIN_EXCEPTION_CAUGHT_PREDICTION_LIST(V) V(PromiseRejectReactionJob)
 
 #define IGNORE_BUILTIN(...)
 
diff --git a/deps/v8/src/builtins/builtins-function-gen.cc b/deps/v8/src/builtins/builtins-function-gen.cc
index 7c1db5093db..1a6e046ae92 100644
--- a/deps/v8/src/builtins/builtins-function-gen.cc
+++ b/deps/v8/src/builtins/builtins-function-gen.cc
@@ -6,6 +6,7 @@
 #include "src/builtins/builtins.h"
 #include "src/code-stub-assembler.h"
 #include "src/frame-constants.h"
+#include "src/objects/descriptor-array.h"
 
 namespace v8 {
 namespace internal {
@@ -43,7 +44,7 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
   // AccessorInfo objects. In that case, their value can be recomputed even if
   // the actual value on the object changes.
   Comment("Check descriptor array length");
-  Node* descriptors = LoadMapDescriptors(receiver_map);
+  TNode<DescriptorArray> descriptors = LoadMapDescriptors(receiver_map);
   Node* descriptors_length = LoadFixedArrayBaseLength(descriptors);
   GotoIf(SmiLessThanOrEqual(descriptors_length, SmiConstant(1)), &slow);
 
@@ -53,15 +54,15 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
   Comment("Check name and length properties");
   {
     const int length_index = JSFunction::kLengthDescriptorIndex;
-    Node* maybe_length = LoadFixedArrayElement(
-        descriptors, DescriptorArray::ToKeyIndex(length_index));
+    TNode<Name> maybe_length = CAST(LoadFixedArrayElement(
+        descriptors, DescriptorArray::ToKeyIndex(length_index)));
     GotoIf(WordNotEqual(maybe_length, LoadRoot(Heap::klength_stringRootIndex)),
            &slow);
 
-    Node* maybe_length_accessor = LoadFixedArrayElement(
+    TNode<Object> maybe_length_accessor = LoadFixedArrayElement(
         descriptors, DescriptorArray::ToValueIndex(length_index));
     GotoIf(TaggedIsSmi(maybe_length_accessor), &slow);
-    Node* length_value_map = LoadMap(maybe_length_accessor);
+    Node* length_value_map = LoadMap(CAST(maybe_length_accessor));
     GotoIfNot(IsAccessorInfoMap(length_value_map), &slow);
 
     const int name_index = JSFunction::kNameDescriptorIndex;
diff --git a/deps/v8/src/builtins/builtins-function.cc b/deps/v8/src/builtins/builtins-function.cc
index 771c7243acf..cc6d237af68 100644
--- a/deps/v8/src/builtins/builtins-function.cc
+++ b/deps/v8/src/builtins/builtins-function.cc
@@ -288,26 +288,22 @@ Object* DoFunctionBind(Isolate* isolate, BuiltinArguments args) {
 // ES6 section 19.2.3.2 Function.prototype.bind ( thisArg, ...args )
 BUILTIN(FunctionPrototypeBind) { return DoFunctionBind(isolate, args); }
 
-// TODO(verwaest): This is a temporary helper until the FastFunctionBind stub
-// can tailcall to the builtin directly.
-RUNTIME_FUNCTION(Runtime_FunctionBind) {
-  DCHECK_EQ(2, args.length());
-  Arguments* incoming = reinterpret_cast<Arguments*>(args[0]);
-  // Rewrap the arguments as builtins arguments.
-  int argc = incoming->length() + BuiltinArguments::kNumExtraArgsWithReceiver;
-  BuiltinArguments caller_args(argc, incoming->arguments() + 1);
-  return DoFunctionBind(isolate, caller_args);
-}
-
 // ES6 section 19.2.3.5 Function.prototype.toString ( )
 BUILTIN(FunctionPrototypeToString) {
   HandleScope scope(isolate);
   Handle<Object> receiver = args.receiver();
   if (receiver->IsJSBoundFunction()) {
     return *JSBoundFunction::ToString(Handle<JSBoundFunction>::cast(receiver));
-  } else if (receiver->IsJSFunction()) {
+  }
+  if (receiver->IsJSFunction()) {
     return *JSFunction::ToString(Handle<JSFunction>::cast(receiver));
   }
+  // With the revised toString behavior, all callable objects are valid
+  // receivers for this method.
+  if (FLAG_harmony_function_tostring && receiver->IsJSReceiver() &&
+      JSReceiver::cast(*receiver)->map()->is_callable()) {
+    return isolate->heap()->function_native_code_string();
+  }
   THROW_NEW_ERROR_RETURN_FAILURE(
       isolate, NewTypeError(MessageTemplate::kNotGeneric,
                             isolate->factory()->NewStringFromAsciiChecked(
diff --git a/deps/v8/src/builtins/builtins-generator-gen.cc b/deps/v8/src/builtins/builtins-generator-gen.cc
index b063b314b5e..07a56c86eda 100644
--- a/deps/v8/src/builtins/builtins-generator-gen.cc
+++ b/deps/v8/src/builtins/builtins-generator-gen.cc
@@ -84,9 +84,8 @@ void GeneratorBuiltinsAssembler::GeneratorPrototypeResume(
   BIND(&if_receiverisincompatible);
   {
     // The {receiver} is not a valid JSGeneratorObject.
-    CallRuntime(Runtime::kThrowIncompatibleMethodReceiver, context,
-                StringConstant(method_name), receiver);
-    Unreachable();
+    ThrowTypeError(context, MessageTemplate::kIncompatibleMethodReceiver,
+                   StringConstant(method_name), receiver);
   }
 
   BIND(&if_receiverisclosed);
@@ -110,10 +109,7 @@ void GeneratorBuiltinsAssembler::GeneratorPrototypeResume(
   }
 
   BIND(&if_receiverisrunning);
-  {
-    CallRuntime(Runtime::kThrowGeneratorRunning, context);
-    Unreachable();
-  }
+  { ThrowTypeError(context, MessageTemplate::kGeneratorRunning); }
 
   BIND(&if_exception);
   {
diff --git a/deps/v8/src/builtins/builtins-handler-gen.cc b/deps/v8/src/builtins/builtins-handler-gen.cc
index 48c28ab7307..29422ab72c2 100644
--- a/deps/v8/src/builtins/builtins-handler-gen.cc
+++ b/deps/v8/src/builtins/builtins-handler-gen.cc
@@ -55,6 +55,15 @@ TF_BUILTIN(KeyedStoreIC_Slow, CodeStubAssembler) {
                   receiver, name);
 }
 
+TF_BUILTIN(StoreInArrayLiteralIC_Slow, CodeStubAssembler) {
+  Node* array = Parameter(Descriptor::kReceiver);
+  Node* index = Parameter(Descriptor::kName);
+  Node* value = Parameter(Descriptor::kValue);
+  Node* context = Parameter(Descriptor::kContext);
+  TailCallRuntime(Runtime::kStoreInArrayLiteralIC_Slow, context, value, array,
+                  index);
+}
+
 TF_BUILTIN(LoadGlobalIC_Slow, CodeStubAssembler) {
   Node* name = Parameter(Descriptor::kName);
   Node* slot = Parameter(Descriptor::kSlot);
diff --git a/deps/v8/src/builtins/builtins-ic-gen.cc b/deps/v8/src/builtins/builtins-ic-gen.cc
index 94613a6a32c..2439cd9d7bd 100644
--- a/deps/v8/src/builtins/builtins-ic-gen.cc
+++ b/deps/v8/src/builtins/builtins-ic-gen.cc
@@ -35,6 +35,7 @@ IC_BUILTIN(StoreIC)
 IC_BUILTIN(StoreICTrampoline)
 IC_BUILTIN(KeyedStoreIC)
 IC_BUILTIN(KeyedStoreICTrampoline)
+IC_BUILTIN(StoreInArrayLiteralIC)
 
 IC_BUILTIN_PARAM(LoadGlobalIC, LoadGlobalIC, NOT_INSIDE_TYPEOF)
 IC_BUILTIN_PARAM(LoadGlobalICInsideTypeof, LoadGlobalIC, INSIDE_TYPEOF)
diff --git a/deps/v8/src/builtins/builtins-internal-gen.cc b/deps/v8/src/builtins/builtins-internal-gen.cc
index bb4b66e3a46..e1f4aea4052 100644
--- a/deps/v8/src/builtins/builtins-internal-gen.cc
+++ b/deps/v8/src/builtins/builtins-internal-gen.cc
@@ -7,7 +7,9 @@
 #include "src/builtins/builtins.h"
 #include "src/code-stub-assembler.h"
 #include "src/heap/heap-inl.h"
+#include "src/ic/accessor-assembler.h"
 #include "src/macro-assembler.h"
+#include "src/objects/debug-objects.h"
 #include "src/objects/shared-function-info.h"
 #include "src/runtime/runtime.h"
 
@@ -73,8 +75,9 @@ TF_BUILTIN(GrowFastSmiOrObjectElements, CodeStubAssembler) {
 
 TF_BUILTIN(NewArgumentsElements, CodeStubAssembler) {
   Node* frame = Parameter(Descriptor::kFrame);
-  Node* length = SmiToWord(Parameter(Descriptor::kLength));
-  Node* mapped_count = SmiToWord(Parameter(Descriptor::kMappedCount));
+  TNode<IntPtrT> length = SmiToIntPtr(Parameter(Descriptor::kLength));
+  TNode<IntPtrT> mapped_count =
+      SmiToIntPtr(Parameter(Descriptor::kMappedCount));
 
   // Check if we can allocate in new space.
   ElementsKind kind = PACKED_ELEMENTS;
@@ -102,9 +105,7 @@ TF_BUILTIN(NewArgumentsElements, CodeStubAssembler) {
       // The elements might be used to back mapped arguments. In that case fill
       // the mapped elements (i.e. the first {mapped_count}) with the hole, but
       // make sure not to overshoot the {length} if some arguments are missing.
-      Node* number_of_holes =
-          SelectConstant(IntPtrLessThan(mapped_count, length), mapped_count,
-                         length, MachineType::PointerRepresentation());
+      TNode<IntPtrT> number_of_holes = IntPtrMin(mapped_count, length);
       Node* the_hole = TheHoleConstant();
 
       // Fill the first elements up to {number_of_holes} with the hole.
@@ -164,8 +165,8 @@ TF_BUILTIN(NewArgumentsElements, CodeStubAssembler) {
   {
     // Allocate in old space (or large object space).
     TailCallRuntime(Runtime::kNewArgumentsElements, NoContextConstant(),
-                    BitcastWordToTagged(frame), SmiFromWord(length),
-                    SmiFromWord(mapped_count));
+                    BitcastWordToTagged(frame), SmiFromIntPtr(length),
+                    SmiFromIntPtr(mapped_count));
   }
 }
 
@@ -173,6 +174,43 @@ TF_BUILTIN(ReturnReceiver, CodeStubAssembler) {
   Return(Parameter(Descriptor::kReceiver));
 }
 
+TF_BUILTIN(DebugBreakTrampoline, CodeStubAssembler) {
+  Label tailcall_to_shared(this);
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  TNode<Object> new_target = CAST(Parameter(BuiltinDescriptor::kNewTarget));
+  TNode<Int32T> arg_count =
+      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount));
+  TNode<JSFunction> function = CAST(LoadFromFrame(
+      StandardFrameConstants::kFunctionOffset, MachineType::TaggedPointer()));
+
+  // Check break-at-entry flag on the debug info.
+  TNode<SharedFunctionInfo> shared =
+      CAST(LoadObjectField(function, JSFunction::kSharedFunctionInfoOffset));
+  TNode<Object> maybe_debug_info =
+      LoadObjectField(shared, SharedFunctionInfo::kDebugInfoOffset);
+  GotoIf(TaggedIsSmi(maybe_debug_info), &tailcall_to_shared);
+
+  {
+    TNode<DebugInfo> debug_info = CAST(maybe_debug_info);
+    TNode<Smi> flags =
+        CAST(LoadObjectField(debug_info, DebugInfo::kFlagsOffset));
+    GotoIfNot(SmiToInt32(SmiAnd(flags, SmiConstant(DebugInfo::kBreakAtEntry))),
+              &tailcall_to_shared);
+
+    CallRuntime(Runtime::kDebugBreakAtEntry, context, function);
+    Goto(&tailcall_to_shared);
+  }
+
+  BIND(&tailcall_to_shared);
+  // Tail call into code object on the SharedFunctionInfo.
+  TNode<Code> code = GetSharedFunctionInfoCode(shared);
+  // Use the ConstructTrampolineDescriptor because it passes new.target too in
+  // case this is called during construct.
+  CSA_ASSERT(this, IsCode(code));
+  ConstructTrampolineDescriptor descriptor(isolate());
+  TailCallStub(descriptor, code, context, function, new_target, arg_count);
+}
+
 class RecordWriteCodeStubAssembler : public CodeStubAssembler {
  public:
   explicit RecordWriteCodeStubAssembler(compiler::CodeAssemblerState* state)
@@ -202,7 +240,7 @@ class RecordWriteCodeStubAssembler : public CodeStubAssembler {
     Node* mask;
 
     GetMarkBit(object, &cell, &mask);
-    mask = TruncateWordToWord32(mask);
+    mask = TruncateIntPtrToInt32(mask);
 
     Node* bits = Load(MachineType::Int32(), cell);
     Node* bit_0 = Word32And(bits, mask);
@@ -239,7 +277,7 @@ class RecordWriteCodeStubAssembler : public CodeStubAssembler {
     Node* cell;
     Node* mask;
     GetMarkBit(object, &cell, &mask);
-    mask = TruncateWordToWord32(mask);
+    mask = TruncateIntPtrToInt32(mask);
     // Non-white has 1 for the first bit, so we only need to check for the first
     // bit.
     return Word32Equal(Word32And(Load(MachineType::Int32(), cell), mask),
@@ -442,10 +480,10 @@ TF_BUILTIN(RecordWrite, RecordWriteCodeStubAssembler) {
   Return(TrueConstant());
 }
 
-class DeletePropertyBaseAssembler : public CodeStubAssembler {
+class DeletePropertyBaseAssembler : public AccessorAssembler {
  public:
   explicit DeletePropertyBaseAssembler(compiler::CodeAssemblerState* state)
-      : CodeStubAssembler(state) {}
+      : AccessorAssembler(state) {}
 
   void DeleteDictionaryProperty(Node* receiver, Node* properties, Node* name,
                                 Node* context, Label* dont_delete,
@@ -532,6 +570,8 @@ TF_BUILTIN(DeleteProperty, DeletePropertyBaseAssembler) {
 
     BIND(&dictionary);
     {
+      InvalidateValidityCellIfPrototype(receiver_map);
+
       Node* properties = LoadSlowProperties(receiver);
       DeleteDictionaryProperty(receiver, properties, unique, context,
                                &dont_delete, &if_notfound);
@@ -628,6 +668,9 @@ class InternalBuiltinsAssembler : public CodeStubAssembler {
   void EnterMicrotaskContext(TNode<Context> context);
   void LeaveMicrotaskContext();
 
+  void RunPromiseHook(Runtime::FunctionId id, TNode<Context> context,
+                      SloppyTNode<HeapObject> payload);
+
   TNode<Object> GetPendingException() {
     auto ref = ExternalReference(kPendingExceptionAddress, isolate());
     return TNode<Object>::UncheckedCast(
@@ -745,6 +788,19 @@ void InternalBuiltinsAssembler::LeaveMicrotaskContext() {
   }
 }
 
+void InternalBuiltinsAssembler::RunPromiseHook(
+    Runtime::FunctionId id, TNode<Context> context,
+    SloppyTNode<HeapObject> payload) {
+  Label hook(this, Label::kDeferred), done_hook(this);
+  Branch(IsPromiseHookEnabledOrDebugIsActive(), &hook, &done_hook);
+  BIND(&hook);
+  {
+    CallRuntime(id, context, payload);
+    Goto(&done_hook);
+  }
+  BIND(&done_hook);
+}
+
 TF_BUILTIN(EnqueueMicrotask, InternalBuiltinsAssembler) {
   Node* microtask = Parameter(Descriptor::kMicrotask);
 
@@ -812,13 +868,15 @@ TF_BUILTIN(EnqueueMicrotask, InternalBuiltinsAssembler) {
 }
 
 TF_BUILTIN(RunMicrotasks, InternalBuiltinsAssembler) {
-  Label init_queue_loop(this);
+  // Load the current context from the isolate.
+  TNode<Context> current_context = GetCurrentContext();
 
+  Label init_queue_loop(this);
   Goto(&init_queue_loop);
   BIND(&init_queue_loop);
   {
     TVARIABLE(IntPtrT, index, IntPtrConstant(0));
-    Label loop(this, &index);
+    Label loop(this, &index), loop_next(this);
 
     TNode<IntPtrT> num_tasks = GetPendingMicrotaskCount();
     ReturnIf(IntPtrEqual(num_tasks, IntPtrConstant(0)), UndefinedConstant());
@@ -830,222 +888,195 @@ TF_BUILTIN(RunMicrotasks, InternalBuiltinsAssembler) {
     CSA_ASSERT(this, IntPtrGreaterThan(num_tasks, IntPtrConstant(0)));
 
     SetPendingMicrotaskCount(IntPtrConstant(0));
-    SetMicrotaskQueue(
-        TNode<FixedArray>::UncheckedCast(EmptyFixedArrayConstant()));
+    SetMicrotaskQueue(EmptyFixedArrayConstant());
 
     Goto(&loop);
     BIND(&loop);
     {
       TNode<HeapObject> microtask =
-          TNode<HeapObject>::UncheckedCast(LoadFixedArrayElement(queue, index));
-      index = IntPtrAdd(index, IntPtrConstant(1));
+          CAST(LoadFixedArrayElement(queue, index.value()));
+      index = IntPtrAdd(index.value(), IntPtrConstant(1));
 
       CSA_ASSERT(this, TaggedIsNotSmi(microtask));
 
       TNode<Map> microtask_map = LoadMap(microtask);
       TNode<Int32T> microtask_type = LoadMapInstanceType(microtask_map);
 
-      Label is_call_handler_info(this);
-      Label is_function(this);
-      Label is_promise_resolve_thenable_job(this);
-      Label is_promise_reaction_job(this);
-      Label is_unreachable(this);
-
-      int32_t case_values[] = {TUPLE3_TYPE,  // CallHandlerInfo
-                               JS_FUNCTION_TYPE,
-                               PROMISE_RESOLVE_THENABLE_JOB_INFO_TYPE,
-                               PROMISE_REACTION_JOB_INFO_TYPE};
-
-      Label* case_labels[] = {&is_call_handler_info, &is_function,
-                              &is_promise_resolve_thenable_job,
-                              &is_promise_reaction_job};
-
+      VARIABLE(var_exception, MachineRepresentation::kTagged,
+               TheHoleConstant());
+      Label if_exception(this, Label::kDeferred);
+      Label is_callable(this), is_callback(this),
+          is_promise_fulfill_reaction_job(this),
+          is_promise_reject_reaction_job(this),
+          is_promise_resolve_thenable_job(this),
+          is_unreachable(this, Label::kDeferred);
+
+      int32_t case_values[] = {CALLABLE_TASK_TYPE, CALLBACK_TASK_TYPE,
+                               PROMISE_FULFILL_REACTION_JOB_TASK_TYPE,
+                               PROMISE_REJECT_REACTION_JOB_TASK_TYPE,
+                               PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE};
+      Label* case_labels[] = {
+          &is_callable, &is_callback, &is_promise_fulfill_reaction_job,
+          &is_promise_reject_reaction_job, &is_promise_resolve_thenable_job};
       static_assert(arraysize(case_values) == arraysize(case_labels), "");
       Switch(microtask_type, &is_unreachable, case_values, case_labels,
              arraysize(case_labels));
 
-      BIND(&is_call_handler_info);
+      BIND(&is_callable);
       {
-        // Bailout to C++ slow path for the remainder of the loop.
-        auto index_ref =
-            ExternalReference(kMicrotaskQueueBailoutIndexAddress, isolate());
-        auto count_ref =
-            ExternalReference(kMicrotaskQueueBailoutCountAddress, isolate());
-        auto rep = kIntSize == 4 ? MachineRepresentation::kWord32
-                                 : MachineRepresentation::kWord64;
-
-        // index was pre-incremented, decrement for bailout to C++.
-        Node* value = IntPtrSub(index, IntPtrConstant(1));
-
-        if (kPointerSize == 4) {
-          DCHECK_EQ(kIntSize, 4);
-          StoreNoWriteBarrier(rep, ExternalConstant(index_ref), value);
-          StoreNoWriteBarrier(rep, ExternalConstant(count_ref), num_tasks);
-        } else {
-          Node* count = num_tasks;
-          if (kIntSize == 4) {
-            value = TruncateInt64ToInt32(value);
-            count = TruncateInt64ToInt32(count);
-          }
-          StoreNoWriteBarrier(rep, ExternalConstant(index_ref), value);
-          StoreNoWriteBarrier(rep, ExternalConstant(count_ref), count);
-        }
-
-        Return(queue);
-      }
+        // Enter the context of the {microtask}.
+        TNode<Context> microtask_context =
+            LoadObjectField<Context>(microtask, CallableTask::kContextOffset);
+        TNode<Context> native_context = LoadNativeContext(microtask_context);
 
-      BIND(&is_function);
-      {
-        Label cont(this);
-        VARIABLE(exception, MachineRepresentation::kTagged, TheHoleConstant());
-        TNode<Context> old_context = GetCurrentContext();
-        TNode<Context> fn_context = TNode<Context>::UncheckedCast(
-            LoadObjectField(microtask, JSFunction::kContextOffset));
-        TNode<Context> native_context =
-            TNode<Context>::UncheckedCast(LoadNativeContext(fn_context));
+        CSA_ASSERT(this, IsNativeContext(native_context));
+        EnterMicrotaskContext(microtask_context);
         SetCurrentContext(native_context);
-        EnterMicrotaskContext(fn_context);
-        Node* const call = CallJS(CodeFactory::Call(isolate()), native_context,
-                                  microtask, UndefinedConstant());
-        GotoIfException(call, &cont);
-        Goto(&cont);
-        BIND(&cont);
+
+        TNode<JSReceiver> callable = LoadObjectField<JSReceiver>(
+            microtask, CallableTask::kCallableOffset);
+        Node* const result = CallJS(
+            CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
+            microtask_context, callable, UndefinedConstant());
+        GotoIfException(result, &if_exception, &var_exception);
         LeaveMicrotaskContext();
-        SetCurrentContext(old_context);
-        Branch(IntPtrLessThan(index, num_tasks), &loop, &init_queue_loop);
+        SetCurrentContext(current_context);
+        Goto(&loop_next);
+      }
+
+      BIND(&is_callback);
+      {
+        Node* const microtask_callback =
+            LoadObjectField(microtask, CallbackTask::kCallbackOffset);
+        Node* const microtask_data =
+            LoadObjectField(microtask, CallbackTask::kDataOffset);
+
+        // If this turns out to become a bottleneck because of the calls
+        // to C++ via CEntryStub, we can choose to speed them up using a
+        // similar mechanism that we use for the CallApiFunction stub,
+        // except that calling the MicrotaskCallback is even easier, since
+        // it doesn't accept any tagged parameters, doesn't return a value
+        // and ignores exceptions.
+        //
+        // But from our current measurements it doesn't seem to be a
+        // serious performance problem, even if the microtask is full
+        // of CallHandlerTasks (which is not a realistic use case anyways).
+        Node* const result =
+            CallRuntime(Runtime::kRunMicrotaskCallback, current_context,
+                        microtask_callback, microtask_data);
+        GotoIfException(result, &if_exception, &var_exception);
+        Goto(&loop_next);
       }
 
       BIND(&is_promise_resolve_thenable_job);
       {
-        VARIABLE(exception, MachineRepresentation::kTagged, TheHoleConstant());
-        TNode<Context> old_context = GetCurrentContext();
-        TNode<Context> microtask_context =
-            TNode<Context>::UncheckedCast(LoadObjectField(
-                microtask, PromiseResolveThenableJobInfo::kContextOffset));
-        TNode<Context> native_context =
-            TNode<Context>::UncheckedCast(LoadNativeContext(microtask_context));
+        // Enter the context of the {microtask}.
+        TNode<Context> microtask_context = LoadObjectField<Context>(
+            microtask, PromiseResolveThenableJobTask::kContextOffset);
+        TNode<Context> native_context = LoadNativeContext(microtask_context);
+        CSA_ASSERT(this, IsNativeContext(native_context));
+        EnterMicrotaskContext(microtask_context);
         SetCurrentContext(native_context);
+
+        Node* const promise_to_resolve = LoadObjectField(
+            microtask, PromiseResolveThenableJobTask::kPromiseToResolveOffset);
+        Node* const then = LoadObjectField(
+            microtask, PromiseResolveThenableJobTask::kThenOffset);
+        Node* const thenable = LoadObjectField(
+            microtask, PromiseResolveThenableJobTask::kThenableOffset);
+
+        Node* const result =
+            CallBuiltin(Builtins::kPromiseResolveThenableJob, native_context,
+                        promise_to_resolve, thenable, then);
+        GotoIfException(result, &if_exception, &var_exception);
+        LeaveMicrotaskContext();
+        SetCurrentContext(current_context);
+        Goto(&loop_next);
+      }
+
+      BIND(&is_promise_fulfill_reaction_job);
+      {
+        // Enter the context of the {microtask}.
+        TNode<Context> microtask_context = LoadObjectField<Context>(
+            microtask, PromiseReactionJobTask::kContextOffset);
+        TNode<Context> native_context = LoadNativeContext(microtask_context);
+        CSA_ASSERT(this, IsNativeContext(native_context));
         EnterMicrotaskContext(microtask_context);
+        SetCurrentContext(native_context);
 
-        Label if_unhandled_exception(this), done(this);
-        Node* const ret = CallBuiltin(Builtins::kPromiseResolveThenableJob,
-                                      native_context, microtask);
-        GotoIfException(ret, &if_unhandled_exception, &exception);
-        Goto(&done);
+        Node* const argument =
+            LoadObjectField(microtask, PromiseReactionJobTask::kArgumentOffset);
+        Node* const handler =
+            LoadObjectField(microtask, PromiseReactionJobTask::kHandlerOffset);
+        Node* const payload =
+            LoadObjectField(microtask, PromiseReactionJobTask::kPayloadOffset);
 
-        BIND(&if_unhandled_exception);
-        CallRuntime(Runtime::kReportMessage, native_context, exception.value());
-        Goto(&done);
+        // Run the promise before/debug hook if enabled.
+        RunPromiseHook(Runtime::kPromiseHookBefore, microtask_context, payload);
 
-        BIND(&done);
-        LeaveMicrotaskContext();
-        SetCurrentContext(old_context);
+        Node* const result =
+            CallBuiltin(Builtins::kPromiseFulfillReactionJob, microtask_context,
+                        argument, handler, payload);
+        GotoIfException(result, &if_exception, &var_exception);
+
+        // Run the promise after/debug hook if enabled.
+        RunPromiseHook(Runtime::kPromiseHookAfter, microtask_context, payload);
 
-        Branch(IntPtrLessThan(index, num_tasks), &loop, &init_queue_loop);
+        LeaveMicrotaskContext();
+        SetCurrentContext(current_context);
+        Goto(&loop_next);
       }
 
-      BIND(&is_promise_reaction_job);
+      BIND(&is_promise_reject_reaction_job);
       {
-        Label if_multiple(this);
-        Label if_single(this);
-
-        Node* const value =
-            LoadObjectField(microtask, PromiseReactionJobInfo::kValueOffset);
-        Node* const tasks =
-            LoadObjectField(microtask, PromiseReactionJobInfo::kTasksOffset);
-        Node* const deferred_promises = LoadObjectField(
-            microtask, PromiseReactionJobInfo::kDeferredPromiseOffset);
-        Node* const deferred_on_resolves = LoadObjectField(
-            microtask, PromiseReactionJobInfo::kDeferredOnResolveOffset);
-        Node* const deferred_on_rejects = LoadObjectField(
-            microtask, PromiseReactionJobInfo::kDeferredOnRejectOffset);
-
-        TNode<Context> old_context = GetCurrentContext();
-        TNode<Context> microtask_context = TNode<Context>::UncheckedCast(
-            LoadObjectField(microtask, PromiseReactionJobInfo::kContextOffset));
-        TNode<Context> native_context =
-            TNode<Context>::UncheckedCast(LoadNativeContext(microtask_context));
-        SetCurrentContext(native_context);
+        // Enter the context of the {microtask}.
+        TNode<Context> microtask_context = LoadObjectField<Context>(
+            microtask, PromiseReactionJobTask::kContextOffset);
+        TNode<Context> native_context = LoadNativeContext(microtask_context);
+        CSA_ASSERT(this, IsNativeContext(native_context));
         EnterMicrotaskContext(microtask_context);
+        SetCurrentContext(native_context);
+
+        Node* const argument =
+            LoadObjectField(microtask, PromiseReactionJobTask::kArgumentOffset);
+        Node* const handler =
+            LoadObjectField(microtask, PromiseReactionJobTask::kHandlerOffset);
+        Node* const payload =
+            LoadObjectField(microtask, PromiseReactionJobTask::kPayloadOffset);
+
+        // Run the promise before/debug hook if enabled.
+        RunPromiseHook(Runtime::kPromiseHookBefore, microtask_context, payload);
 
-        Branch(IsFixedArray(deferred_promises), &if_multiple, &if_single);
-
-        BIND(&if_single);
-        {
-          CallBuiltin(Builtins::kPromiseHandle, native_context, value, tasks,
-                      deferred_promises, deferred_on_resolves,
-                      deferred_on_rejects);
-          LeaveMicrotaskContext();
-          SetCurrentContext(old_context);
-          Branch(IntPtrLessThan(index, num_tasks), &loop, &init_queue_loop);
-        }
-
-        BIND(&if_multiple);
-        {
-          TVARIABLE(IntPtrT, inner_index, IntPtrConstant(0));
-          TNode<IntPtrT> inner_length =
-              LoadAndUntagFixedArrayBaseLength(deferred_promises);
-          Label inner_loop(this, &inner_index), done(this);
-
-          CSA_ASSERT(this, IntPtrGreaterThan(inner_length, IntPtrConstant(0)));
-          Goto(&inner_loop);
-          BIND(&inner_loop);
-          {
-            Node* const task = LoadFixedArrayElement(tasks, inner_index);
-            Node* const deferred_promise =
-                LoadFixedArrayElement(deferred_promises, inner_index);
-            Node* const deferred_on_resolve =
-                LoadFixedArrayElement(deferred_on_resolves, inner_index);
-            Node* const deferred_on_reject =
-                LoadFixedArrayElement(deferred_on_rejects, inner_index);
-            CallBuiltin(Builtins::kPromiseHandle, native_context, value, task,
-                        deferred_promise, deferred_on_resolve,
-                        deferred_on_reject);
-            inner_index = IntPtrAdd(inner_index, IntPtrConstant(1));
-            Branch(IntPtrLessThan(inner_index, inner_length), &inner_loop,
-                   &done);
-          }
-          BIND(&done);
-
-          LeaveMicrotaskContext();
-          SetCurrentContext(old_context);
-
-          Branch(IntPtrLessThan(index, num_tasks), &loop, &init_queue_loop);
-        }
+        Node* const result =
+            CallBuiltin(Builtins::kPromiseRejectReactionJob, microtask_context,
+                        argument, handler, payload);
+        GotoIfException(result, &if_exception, &var_exception);
+
+        // Run the promise after/debug hook if enabled.
+        RunPromiseHook(Runtime::kPromiseHookAfter, microtask_context, payload);
+
+        LeaveMicrotaskContext();
+        SetCurrentContext(current_context);
+        Goto(&loop_next);
       }
 
       BIND(&is_unreachable);
       Unreachable();
-    }
-  }
-}
 
-TF_BUILTIN(PromiseResolveThenableJob, InternalBuiltinsAssembler) {
-  VARIABLE(exception, MachineRepresentation::kTagged, TheHoleConstant());
-  Callable call = CodeFactory::Call(isolate());
-  Label reject_promise(this, Label::kDeferred);
-  TNode<PromiseResolveThenableJobInfo> microtask =
-      TNode<PromiseResolveThenableJobInfo>::UncheckedCast(
-          Parameter(Descriptor::kMicrotask));
-  TNode<Context> context =
-      TNode<Context>::UncheckedCast(Parameter(Descriptor::kContext));
-
-  TNode<JSReceiver> thenable = TNode<JSReceiver>::UncheckedCast(LoadObjectField(
-      microtask, PromiseResolveThenableJobInfo::kThenableOffset));
-  TNode<JSReceiver> then = TNode<JSReceiver>::UncheckedCast(
-      LoadObjectField(microtask, PromiseResolveThenableJobInfo::kThenOffset));
-  TNode<JSFunction> resolve = TNode<JSFunction>::UncheckedCast(LoadObjectField(
-      microtask, PromiseResolveThenableJobInfo::kResolveOffset));
-  TNode<JSFunction> reject = TNode<JSFunction>::UncheckedCast(
-      LoadObjectField(microtask, PromiseResolveThenableJobInfo::kRejectOffset));
-
-  Node* const result = CallJS(call, context, then, thenable, resolve, reject);
-  GotoIfException(result, &reject_promise, &exception);
-  Return(UndefinedConstant());
+      BIND(&if_exception);
+      {
+        // Report unhandled exceptions from microtasks.
+        CallRuntime(Runtime::kReportMessage, current_context,
+                    var_exception.value());
+        LeaveMicrotaskContext();
+        SetCurrentContext(current_context);
+        Goto(&loop_next);
+      }
 
-  BIND(&reject_promise);
-  CallJS(call, context, reject, UndefinedConstant(), exception.value());
-  Return(UndefinedConstant());
+      BIND(&loop_next);
+      Branch(IntPtrLessThan(index.value(), num_tasks), &loop, &init_queue_loop);
+    }
+  }
 }
 
 TF_BUILTIN(AbortJS, CodeStubAssembler) {
diff --git a/deps/v8/src/builtins/builtins-interpreter-gen.cc b/deps/v8/src/builtins/builtins-interpreter-gen.cc
index a8552338c81..f0d5160330e 100644
--- a/deps/v8/src/builtins/builtins-interpreter-gen.cc
+++ b/deps/v8/src/builtins/builtins-interpreter-gen.cc
@@ -14,12 +14,6 @@ void Builtins::Generate_InterpreterPushArgsThenCall(MacroAssembler* masm) {
       masm, ConvertReceiverMode::kAny, InterpreterPushArgsMode::kOther);
 }
 
-void Builtins::Generate_InterpreterPushArgsThenCallFunction(
-    MacroAssembler* masm) {
-  return Generate_InterpreterPushArgsThenCallImpl(
-      masm, ConvertReceiverMode::kAny, InterpreterPushArgsMode::kJSFunction);
-}
-
 void Builtins::Generate_InterpreterPushUndefinedAndArgsThenCall(
     MacroAssembler* masm) {
   return Generate_InterpreterPushArgsThenCallImpl(
@@ -27,13 +21,6 @@ void Builtins::Generate_InterpreterPushUndefinedAndArgsThenCall(
       InterpreterPushArgsMode::kOther);
 }
 
-void Builtins::Generate_InterpreterPushUndefinedAndArgsThenCallFunction(
-    MacroAssembler* masm) {
-  return Generate_InterpreterPushArgsThenCallImpl(
-      masm, ConvertReceiverMode::kNullOrUndefined,
-      InterpreterPushArgsMode::kJSFunction);
-}
-
 void Builtins::Generate_InterpreterPushArgsThenCallWithFinalSpread(
     MacroAssembler* masm) {
   return Generate_InterpreterPushArgsThenCallImpl(
@@ -52,10 +39,10 @@ void Builtins::Generate_InterpreterPushArgsThenConstructWithFinalSpread(
       masm, InterpreterPushArgsMode::kWithFinalSpread);
 }
 
-void Builtins::Generate_InterpreterPushArgsThenConstructFunction(
+void Builtins::Generate_InterpreterPushArgsThenConstructArrayFunction(
     MacroAssembler* masm) {
   return Generate_InterpreterPushArgsThenConstructImpl(
-      masm, InterpreterPushArgsMode::kJSFunction);
+      masm, InterpreterPushArgsMode::kArrayFunction);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-interpreter.cc b/deps/v8/src/builtins/builtins-interpreter.cc
index 64c43ee4aca..d05a8656dbc 100644
--- a/deps/v8/src/builtins/builtins-interpreter.cc
+++ b/deps/v8/src/builtins/builtins-interpreter.cc
@@ -14,15 +14,10 @@ namespace internal {
 Handle<Code> Builtins::InterpreterPushArgsThenCall(
     ConvertReceiverMode receiver_mode, InterpreterPushArgsMode mode) {
   switch (mode) {
-    case InterpreterPushArgsMode::kJSFunction:
-      switch (receiver_mode) {
-        case ConvertReceiverMode::kNullOrUndefined:
-          return builtin_handle(
-              kInterpreterPushUndefinedAndArgsThenCallFunction);
-        case ConvertReceiverMode::kNotNullOrUndefined:
-        case ConvertReceiverMode::kAny:
-          return builtin_handle(kInterpreterPushArgsThenCallFunction);
-      }
+    case InterpreterPushArgsMode::kArrayFunction:
+      // There is no special-case handling of calls to Array. They will all go
+      // through the kOther case below.
+      UNREACHABLE();
     case InterpreterPushArgsMode::kWithFinalSpread:
       return builtin_handle(kInterpreterPushArgsThenCallWithFinalSpread);
     case InterpreterPushArgsMode::kOther:
@@ -40,8 +35,8 @@ Handle<Code> Builtins::InterpreterPushArgsThenCall(
 Handle<Code> Builtins::InterpreterPushArgsThenConstruct(
     InterpreterPushArgsMode mode) {
   switch (mode) {
-    case InterpreterPushArgsMode::kJSFunction:
-      return builtin_handle(kInterpreterPushArgsThenConstructFunction);
+    case InterpreterPushArgsMode::kArrayFunction:
+      return builtin_handle(kInterpreterPushArgsThenConstructArrayFunction);
     case InterpreterPushArgsMode::kWithFinalSpread:
       return builtin_handle(kInterpreterPushArgsThenConstructWithFinalSpread);
     case InterpreterPushArgsMode::kOther:
diff --git a/deps/v8/src/builtins/builtins-intl.h b/deps/v8/src/builtins/builtins-intl.h
index 8dda0c08986..419ff14db10 100644
--- a/deps/v8/src/builtins/builtins-intl.h
+++ b/deps/v8/src/builtins/builtins-intl.h
@@ -27,4 +27,4 @@ std::vector<NumberFormatSpan> FlattenRegionsToParts(
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_BUILTINS_BUILTINS_H_
+#endif  // V8_BUILTINS_BUILTINS_INTL_H_
diff --git a/deps/v8/src/builtins/builtins-iterator-gen.cc b/deps/v8/src/builtins/builtins-iterator-gen.cc
index f6a6d858808..f2de364e2c2 100644
--- a/deps/v8/src/builtins/builtins-iterator-gen.cc
+++ b/deps/v8/src/builtins/builtins-iterator-gen.cc
@@ -11,36 +11,62 @@ namespace internal {
 
 using compiler::Node;
 
+Node* IteratorBuiltinsAssembler::GetIteratorMethod(Node* context,
+                                                   Node* object) {
+  return GetProperty(context, object, factory()->iterator_symbol());
+}
+
 IteratorRecord IteratorBuiltinsAssembler::GetIterator(Node* context,
                                                       Node* object,
                                                       Label* if_exception,
                                                       Variable* exception) {
-  Node* method = GetProperty(context, object, factory()->iterator_symbol());
-  GotoIfException(method, if_exception, exception);
+  Node* method = GetIteratorMethod(context, object);
+  return GetIterator(context, object, method, if_exception, exception);
+}
 
-  Callable callable = CodeFactory::Call(isolate());
-  Node* iterator = CallJS(callable, context, method, object);
-  GotoIfException(iterator, if_exception, exception);
+IteratorRecord IteratorBuiltinsAssembler::GetIterator(Node* context,
+                                                      Node* object,
+                                                      Node* method,
+                                                      Label* if_exception,
+                                                      Variable* exception) {
+  GotoIfException(method, if_exception, exception);
 
-  Label get_next(this), if_notobject(this, Label::kDeferred);
-  GotoIf(TaggedIsSmi(iterator), &if_notobject);
-  Branch(IsJSReceiver(iterator), &get_next, &if_notobject);
+  Label if_not_callable(this, Label::kDeferred), if_callable(this);
+  GotoIf(TaggedIsSmi(method), &if_not_callable);
+  Branch(IsCallable(method), &if_callable, &if_not_callable);
 
-  BIND(&if_notobject);
+  BIND(&if_not_callable);
   {
-    Node* ret =
-        CallRuntime(Runtime::kThrowTypeError, context,
-                    SmiConstant(MessageTemplate::kNotAnIterator), iterator);
+    Node* ret = CallRuntime(Runtime::kThrowTypeError, context,
+                            SmiConstant(MessageTemplate::kNotIterable), object);
     GotoIfException(ret, if_exception, exception);
     Unreachable();
   }
 
-  BIND(&get_next);
-  Node* const next = GetProperty(context, iterator, factory()->next_string());
-  GotoIfException(next, if_exception, exception);
-
-  return IteratorRecord{TNode<JSReceiver>::UncheckedCast(iterator),
-                        TNode<Object>::UncheckedCast(next)};
+  BIND(&if_callable);
+  {
+    Callable callable = CodeFactory::Call(isolate());
+    Node* iterator = CallJS(callable, context, method, object);
+    GotoIfException(iterator, if_exception, exception);
+
+    Label get_next(this), if_notobject(this, Label::kDeferred);
+    GotoIf(TaggedIsSmi(iterator), &if_notobject);
+    Branch(IsJSReceiver(iterator), &get_next, &if_notobject);
+
+    BIND(&if_notobject);
+    {
+      Node* ret = CallRuntime(Runtime::kThrowSymbolIteratorInvalid, context);
+      GotoIfException(ret, if_exception, exception);
+      Unreachable();
+    }
+
+    BIND(&get_next);
+    Node* const next = GetProperty(context, iterator, factory()->next_string());
+    GotoIfException(next, if_exception, exception);
+
+    return IteratorRecord{TNode<JSReceiver>::UncheckedCast(iterator),
+                          TNode<Object>::UncheckedCast(next)};
+  }
 }
 
 Node* IteratorBuiltinsAssembler::IteratorStep(
diff --git a/deps/v8/src/builtins/builtins-iterator-gen.h b/deps/v8/src/builtins/builtins-iterator-gen.h
index 42627b8437f..13464516d6a 100644
--- a/deps/v8/src/builtins/builtins-iterator-gen.h
+++ b/deps/v8/src/builtins/builtins-iterator-gen.h
@@ -17,11 +17,17 @@ class IteratorBuiltinsAssembler : public CodeStubAssembler {
   explicit IteratorBuiltinsAssembler(compiler::CodeAssemblerState* state)
       : CodeStubAssembler(state) {}
 
+  // Returns object[Symbol.iterator].
+  Node* GetIteratorMethod(Node* context, Node* object);
+
   // https://tc39.github.io/ecma262/#sec-getiterator --- never used for
   // @@asyncIterator.
   IteratorRecord GetIterator(Node* context, Node* object,
                              Label* if_exception = nullptr,
                              Variable* exception = nullptr);
+  IteratorRecord GetIterator(Node* context, Node* object, Node* method,
+                             Label* if_exception = nullptr,
+                             Variable* exception = nullptr);
 
   // https://tc39.github.io/ecma262/#sec-iteratorstep
   // Returns `false` if the iterator is done, otherwise returns an
diff --git a/deps/v8/src/builtins/builtins-math-gen.cc b/deps/v8/src/builtins/builtins-math-gen.cc
index d588113cdd1..be58e8210ea 100644
--- a/deps/v8/src/builtins/builtins-math-gen.cc
+++ b/deps/v8/src/builtins/builtins-math-gen.cc
@@ -268,7 +268,7 @@ TF_BUILTIN(MathClz32, CodeStubAssembler) {
 
     BIND(&if_xissmi);
     {
-      var_clz32_x.Bind(SmiToWord32(x));
+      var_clz32_x.Bind(SmiToInt32(x));
       Goto(&do_clz32);
     }
 
diff --git a/deps/v8/src/builtins/builtins-number-gen.cc b/deps/v8/src/builtins/builtins-number-gen.cc
index 821dac9cc06..1340c33eb1d 100644
--- a/deps/v8/src/builtins/builtins-number-gen.cc
+++ b/deps/v8/src/builtins/builtins-number-gen.cc
@@ -319,12 +319,14 @@ TF_BUILTIN(NumberParseInt, CodeStubAssembler) {
       GotoIf(Float64Equal(input_value, ChangeInt32ToFloat64(input_value32)),
              &if_inputissigned32);
 
-      // Check if the absolute {input} value is in the ]0.01,1e9[ range.
+      // Check if the absolute {input} value is in the [1,1<<31[ range.
+      // Take the generic path for the range [0,1[ because the result
+      // could be -0.
       Node* input_value_abs = Float64Abs(input_value);
 
-      GotoIfNot(Float64LessThan(input_value_abs, Float64Constant(1e9)),
+      GotoIfNot(Float64LessThan(input_value_abs, Float64Constant(1u << 31)),
                 &if_generic);
-      Branch(Float64LessThan(Float64Constant(0.01), input_value_abs),
+      Branch(Float64LessThanOrEqual(Float64Constant(1), input_value_abs),
              &if_inputissigned32, &if_generic);
 
       // Return the truncated int32 value, and return the tagged result.
@@ -904,8 +906,8 @@ TF_BUILTIN(Divide, NumberBuiltinsAssembler) {
     }
     BIND(&dividend_is_not_zero);
 
-    Node* untagged_divisor = SmiToWord32(divisor);
-    Node* untagged_dividend = SmiToWord32(dividend);
+    Node* untagged_divisor = SmiToInt32(divisor);
+    Node* untagged_dividend = SmiToInt32(dividend);
 
     // Do floating point division if {dividend} is kMinInt (or kMinInt - 1
     // if the Smi size is 31) and {divisor} is -1.
@@ -929,7 +931,7 @@ TF_BUILTIN(Divide, NumberBuiltinsAssembler) {
     Node* truncated = Int32Mul(untagged_result, untagged_divisor);
     // Do floating point division if the remainder is not 0.
     GotoIf(Word32NotEqual(untagged_dividend, truncated), &bailout);
-    Return(SmiFromWord32(untagged_result));
+    Return(SmiFromInt32(untagged_result));
 
     // Bailout: convert {dividend} and {divisor} to double and do double
     // division.
diff --git a/deps/v8/src/builtins/builtins-object-gen.cc b/deps/v8/src/builtins/builtins-object-gen.cc
index 4cd012e6f01..18875945f10 100644
--- a/deps/v8/src/builtins/builtins-object-gen.cc
+++ b/deps/v8/src/builtins/builtins-object-gen.cc
@@ -16,6 +16,8 @@ namespace internal {
 // ES6 section 19.1 Object Objects
 
 typedef compiler::Node Node;
+template <class T>
+using TNode = CodeStubAssembler::TNode<T>;
 
 class ObjectBuiltinsAssembler : public CodeStubAssembler {
  public:
@@ -34,6 +36,46 @@ class ObjectBuiltinsAssembler : public CodeStubAssembler {
   Node* ConstructDataDescriptor(Node* context, Node* value, Node* writable,
                                 Node* enumerable, Node* configurable);
   Node* GetAccessorOrUndefined(Node* accessor, Label* if_bailout);
+
+  Node* IsSpecialReceiverMap(SloppyTNode<Map> map);
+};
+
+class ObjectEntriesValuesBuiltinsAssembler : public ObjectBuiltinsAssembler {
+ public:
+  explicit ObjectEntriesValuesBuiltinsAssembler(
+      compiler::CodeAssemblerState* state)
+      : ObjectBuiltinsAssembler(state) {}
+
+ protected:
+  enum CollectType { kEntries, kValues };
+
+  TNode<Word32T> IsStringWrapperElementsKind(TNode<Map> map);
+
+  TNode<BoolT> IsPropertyEnumerable(TNode<Uint32T> details);
+
+  TNode<BoolT> IsPropertyKindAccessor(TNode<Uint32T> kind);
+
+  TNode<BoolT> IsPropertyKindData(TNode<Uint32T> kind);
+
+  TNode<Uint32T> HasHiddenPrototype(TNode<Map> map);
+
+  TNode<Uint32T> LoadPropertyKind(TNode<Uint32T> details) {
+    return DecodeWord32<PropertyDetails::KindField>(details);
+  }
+
+  void GetOwnValuesOrEntries(TNode<Context> context, TNode<Object> maybe_object,
+                             CollectType collect_type);
+
+  void GotoIfMapHasSlowProperties(TNode<Map> map, Label* if_slow);
+
+  TNode<JSArray> FastGetOwnValuesOrEntries(
+      TNode<Context> context, TNode<JSObject> object,
+      Label* if_call_runtime_with_fast_path, Label* if_no_properties,
+      CollectType collect_type);
+
+  TNode<JSArray> FinalizeValuesOrEntriesJSArray(
+      TNode<Context> context, TNode<FixedArray> values_or_entries,
+      TNode<IntPtrT> size, TNode<Map> array_map, Label* if_empty);
 };
 
 void ObjectBuiltinsAssembler::ReturnToStringFormat(Node* context,
@@ -97,6 +139,254 @@ Node* ObjectBuiltinsAssembler::ConstructDataDescriptor(Node* context,
   return js_desc;
 }
 
+Node* ObjectBuiltinsAssembler::IsSpecialReceiverMap(SloppyTNode<Map> map) {
+  CSA_SLOW_ASSERT(this, IsMap(map));
+  TNode<BoolT> is_special =
+      IsSpecialReceiverInstanceType(LoadMapInstanceType(map));
+  uint32_t mask =
+      Map::HasNamedInterceptorBit::kMask | Map::IsAccessCheckNeededBit::kMask;
+  USE(mask);
+  // Interceptors or access checks imply special receiver.
+  CSA_ASSERT(this,
+             SelectConstant<BoolT>(IsSetWord32(LoadMapBitField(map), mask),
+                                   is_special, Int32TrueConstant()));
+  return is_special;
+}
+
+TNode<Word32T>
+ObjectEntriesValuesBuiltinsAssembler::IsStringWrapperElementsKind(
+    TNode<Map> map) {
+  Node* kind = LoadMapElementsKind(map);
+  return Word32Or(
+      Word32Equal(kind, Int32Constant(FAST_STRING_WRAPPER_ELEMENTS)),
+      Word32Equal(kind, Int32Constant(SLOW_STRING_WRAPPER_ELEMENTS)));
+}
+
+TNode<BoolT> ObjectEntriesValuesBuiltinsAssembler::IsPropertyEnumerable(
+    TNode<Uint32T> details) {
+  TNode<Uint32T> attributes =
+      DecodeWord32<PropertyDetails::AttributesField>(details);
+  return IsNotSetWord32(attributes, PropertyAttributes::DONT_ENUM);
+}
+
+TNode<BoolT> ObjectEntriesValuesBuiltinsAssembler::IsPropertyKindAccessor(
+    TNode<Uint32T> kind) {
+  return Word32Equal(kind, Int32Constant(PropertyKind::kAccessor));
+}
+
+TNode<BoolT> ObjectEntriesValuesBuiltinsAssembler::IsPropertyKindData(
+    TNode<Uint32T> kind) {
+  return Word32Equal(kind, Int32Constant(PropertyKind::kData));
+}
+
+TNode<Uint32T> ObjectEntriesValuesBuiltinsAssembler::HasHiddenPrototype(
+    TNode<Map> map) {
+  TNode<Uint32T> bit_field3 = LoadMapBitField3(map);
+  return DecodeWord32<Map::HasHiddenPrototypeBit>(bit_field3);
+}
+
+void ObjectEntriesValuesBuiltinsAssembler::GetOwnValuesOrEntries(
+    TNode<Context> context, TNode<Object> maybe_object,
+    CollectType collect_type) {
+  TNode<JSReceiver> receiver = ToObject(context, maybe_object);
+
+  Label if_call_runtime_with_fast_path(this, Label::kDeferred),
+      if_call_runtime(this, Label::kDeferred),
+      if_no_properties(this, Label::kDeferred);
+
+  TNode<Map> map = LoadMap(receiver);
+  GotoIfNot(IsJSObjectMap(map), &if_call_runtime);
+  GotoIfMapHasSlowProperties(map, &if_call_runtime);
+
+  TNode<JSObject> object = CAST(receiver);
+  TNode<FixedArrayBase> elements = LoadElements(object);
+  // If the object has elements, we treat it as slow case.
+  // So, we go to runtime call.
+  GotoIfNot(IsEmptyFixedArray(elements), &if_call_runtime_with_fast_path);
+
+  TNode<JSArray> result = FastGetOwnValuesOrEntries(
+      context, object, &if_call_runtime_with_fast_path, &if_no_properties,
+      collect_type);
+  Return(result);
+
+  BIND(&if_no_properties);
+  {
+    Node* native_context = LoadNativeContext(context);
+    Node* array_map = LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
+    Node* empty_array = AllocateJSArray(PACKED_ELEMENTS, array_map,
+                                        IntPtrConstant(0), SmiConstant(0));
+    Return(empty_array);
+  }
+
+  BIND(&if_call_runtime_with_fast_path);
+  {
+    // In slow case, we simply call runtime.
+    if (collect_type == CollectType::kEntries) {
+      Return(CallRuntime(Runtime::kObjectEntries, context, object));
+    } else {
+      DCHECK(collect_type == CollectType::kValues);
+      Return(CallRuntime(Runtime::kObjectValues, context, object));
+    }
+  }
+
+  BIND(&if_call_runtime);
+  {
+    // In slow case, we simply call runtime.
+    if (collect_type == CollectType::kEntries) {
+      Return(
+          CallRuntime(Runtime::kObjectEntriesSkipFastPath, context, receiver));
+    } else {
+      DCHECK(collect_type == CollectType::kValues);
+      Return(
+          CallRuntime(Runtime::kObjectValuesSkipFastPath, context, receiver));
+    }
+  }
+}
+
+void ObjectEntriesValuesBuiltinsAssembler::GotoIfMapHasSlowProperties(
+    TNode<Map> map, Label* if_slow) {
+  GotoIf(IsStringWrapperElementsKind(map), if_slow);
+  GotoIf(IsSpecialReceiverMap(map), if_slow);
+  GotoIf(HasHiddenPrototype(map), if_slow);
+  GotoIf(IsDictionaryMap(map), if_slow);
+}
+
+TNode<JSArray> ObjectEntriesValuesBuiltinsAssembler::FastGetOwnValuesOrEntries(
+    TNode<Context> context, TNode<JSObject> object,
+    Label* if_call_runtime_with_fast_path, Label* if_no_properties,
+    CollectType collect_type) {
+  Node* native_context = LoadNativeContext(context);
+  TNode<Map> array_map =
+      LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
+  TNode<Map> map = LoadMap(object);
+  TNode<Uint32T> bit_field3 = LoadMapBitField3(map);
+
+  Label if_has_enum_cache(this), if_not_has_enum_cache(this),
+      collect_entries(this);
+  Node* object_enum_length =
+      DecodeWordFromWord32<Map::EnumLengthBits>(bit_field3);
+  Node* has_enum_cache = WordNotEqual(
+      object_enum_length, IntPtrConstant(kInvalidEnumCacheSentinel));
+
+  // In case, we found enum_cache in object,
+  // we use it as array_length becuase it has same size for
+  // Object.(entries/values) result array object length.
+  // So object_enum_length use less memory space than
+  // NumberOfOwnDescriptorsBits value.
+  // And in case, if enum_cache_not_found,
+  // we call runtime and initialize enum_cache for subsequent call of
+  // CSA fast path.
+  Branch(has_enum_cache, &if_has_enum_cache, if_call_runtime_with_fast_path);
+
+  BIND(&if_has_enum_cache);
+  {
+    GotoIf(WordEqual(object_enum_length, IntPtrConstant(0)), if_no_properties);
+    TNode<FixedArray> values_or_entries = TNode<FixedArray>::UncheckedCast(
+        AllocateFixedArray(PACKED_ELEMENTS, object_enum_length,
+                           INTPTR_PARAMETERS, kAllowLargeObjectAllocation));
+
+    // If in case we have enum_cache,
+    // we can't detect accessor of object until loop through descritpros.
+    // So if object might have accessor,
+    // we will remain invalid addresses of FixedArray.
+    // Because in that case, we need to jump to runtime call.
+    // So the array filled by the-hole even if enum_cache exists.
+    FillFixedArrayWithValue(PACKED_ELEMENTS, values_or_entries,
+                            IntPtrConstant(0), object_enum_length,
+                            Heap::kTheHoleValueRootIndex);
+
+    TVARIABLE(IntPtrT, var_result_index, IntPtrConstant(0));
+    TVARIABLE(IntPtrT, var_descriptor_number, IntPtrConstant(0));
+    Variable* vars[] = {&var_descriptor_number, &var_result_index};
+    // Let desc be ? O.[[GetOwnProperty]](key).
+    TNode<DescriptorArray> descriptors = LoadMapDescriptors(map);
+    Label loop(this, 2, vars), after_loop(this), loop_condition(this);
+    Branch(IntPtrEqual(var_descriptor_number.value(), object_enum_length),
+           &after_loop, &loop);
+
+    // We dont use BuildFastLoop.
+    // Instead, we use hand-written loop
+    // because of we need to use 'continue' functionality.
+    BIND(&loop);
+    {
+      // Currently, we will not invoke getters,
+      // so, map will not be changed.
+      CSA_ASSERT(this, WordEqual(map, LoadMap(object)));
+      TNode<Uint32T> descriptor_index = TNode<Uint32T>::UncheckedCast(
+          TruncateIntPtrToInt32(var_descriptor_number.value()));
+      Node* next_key = GetKey(descriptors, descriptor_index);
+
+      // Skip Symbols.
+      GotoIf(IsSymbol(next_key), &loop_condition);
+
+      TNode<Uint32T> details = TNode<Uint32T>::UncheckedCast(
+          DescriptorArrayGetDetails(descriptors, descriptor_index));
+      TNode<Uint32T> kind = LoadPropertyKind(details);
+
+      // If property is accessor, we escape fast path and call runtime.
+      GotoIf(IsPropertyKindAccessor(kind), if_call_runtime_with_fast_path);
+      CSA_ASSERT(this, IsPropertyKindData(kind));
+
+      // If desc is not undefined and desc.[[Enumerable]] is true, then
+      GotoIfNot(IsPropertyEnumerable(details), &loop_condition);
+
+      VARIABLE(var_property_value, MachineRepresentation::kTagged,
+               UndefinedConstant());
+      TNode<IntPtrT> descriptor_name_index = ToKeyIndex<DescriptorArray>(
+          Unsigned(TruncateIntPtrToInt32(var_descriptor_number.value())));
+
+      // Let value be ? Get(O, key).
+      LoadPropertyFromFastObject(object, map, descriptors,
+                                 descriptor_name_index, details,
+                                 &var_property_value);
+
+      // If kind is "value", append value to properties.
+      Node* value = var_property_value.value();
+
+      if (collect_type == CollectType::kEntries) {
+        // Let entry be CreateArrayFromList(« key, value »).
+        Node* array = nullptr;
+        Node* elements = nullptr;
+        std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
+            PACKED_ELEMENTS, array_map, SmiConstant(2), nullptr,
+            IntPtrConstant(2));
+        StoreFixedArrayElement(elements, 0, next_key, SKIP_WRITE_BARRIER);
+        StoreFixedArrayElement(elements, 1, value, SKIP_WRITE_BARRIER);
+        value = array;
+      }
+
+      StoreFixedArrayElement(values_or_entries, var_result_index.value(),
+                             value);
+      Increment(&var_result_index, 1);
+      Goto(&loop_condition);
+
+      BIND(&loop_condition);
+      {
+        Increment(&var_descriptor_number, 1);
+        Branch(IntPtrEqual(var_descriptor_number.value(), object_enum_length),
+               &after_loop, &loop);
+      }
+    }
+    BIND(&after_loop);
+    return FinalizeValuesOrEntriesJSArray(context, values_or_entries,
+                                          var_result_index.value(), array_map,
+                                          if_no_properties);
+  }
+}
+
+TNode<JSArray>
+ObjectEntriesValuesBuiltinsAssembler::FinalizeValuesOrEntriesJSArray(
+    TNode<Context> context, TNode<FixedArray> result, TNode<IntPtrT> size,
+    TNode<Map> array_map, Label* if_empty) {
+  CSA_ASSERT(this, IsJSArrayMap(array_map));
+
+  GotoIf(IntPtrEqual(size, IntPtrConstant(0)), if_empty);
+  Node* array = AllocateUninitializedJSArrayWithoutElements(
+      array_map, SmiTag(size), nullptr);
+  StoreObjectField(array, JSArray::kElementsOffset, result);
+  return TNode<JSArray>::UncheckedCast(array);
+}
+
 TF_BUILTIN(ObjectPrototypeToLocaleString, CodeStubAssembler) {
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
@@ -105,7 +395,7 @@ TF_BUILTIN(ObjectPrototypeToLocaleString, CodeStubAssembler) {
   GotoIf(IsNullOrUndefined(receiver), &if_null_or_undefined);
 
   TNode<Object> method =
-      CAST(GetProperty(context, receiver, factory()->toString_string()));
+      GetProperty(context, receiver, factory()->toString_string());
   Return(CallJS(CodeFactory::Call(isolate()), context, method, receiver));
 
   BIND(&if_null_or_undefined);
@@ -266,6 +556,22 @@ TF_BUILTIN(ObjectKeys, ObjectBuiltinsAssembler) {
   }
 }
 
+TF_BUILTIN(ObjectValues, ObjectEntriesValuesBuiltinsAssembler) {
+  TNode<JSObject> object =
+      TNode<JSObject>::UncheckedCast(Parameter(Descriptor::kObject));
+  TNode<Context> context =
+      TNode<Context>::UncheckedCast(Parameter(Descriptor::kContext));
+  GetOwnValuesOrEntries(context, object, CollectType::kValues);
+}
+
+TF_BUILTIN(ObjectEntries, ObjectEntriesValuesBuiltinsAssembler) {
+  TNode<JSObject> object =
+      TNode<JSObject>::UncheckedCast(Parameter(Descriptor::kObject));
+  TNode<Context> context =
+      TNode<Context>::UncheckedCast(Parameter(Descriptor::kContext));
+  GetOwnValuesOrEntries(context, object, CollectType::kEntries);
+}
+
 // ES #sec-object.prototype.isprototypeof
 TF_BUILTIN(ObjectPrototypeIsPrototypeOf, ObjectBuiltinsAssembler) {
   Node* receiver = Parameter(Descriptor::kReceiver);
@@ -304,7 +610,7 @@ TF_BUILTIN(ObjectPrototypeIsPrototypeOf, ObjectBuiltinsAssembler) {
     GotoIfNot(IsJSReceiver(value), &if_valueisnotreceiver);
 
     // Simulate the ToObject invocation on {receiver}.
-    CallBuiltin(Builtins::kToObject, context, receiver);
+    ToObject(context, receiver);
     Unreachable();
   }
 
@@ -367,9 +673,7 @@ TF_BUILTIN(ObjectPrototypeToString, ObjectBuiltinsAssembler) {
     Branch(IsString(var_tag.value()), &if_tagisstring, &if_tagisnotstring);
     BIND(&if_tagisnotstring);
     {
-      var_tag.Bind(
-          CallStub(Builtins::CallableFor(isolate(), Builtins::kClassOf),
-                   context, receiver));
+      var_tag.Bind(CallRuntime(Runtime::kClassOf, context, receiver));
       Goto(&if_tagisstring);
     }
     BIND(&if_tagisstring);
@@ -574,9 +878,8 @@ TF_BUILTIN(ObjectPrototypeToString, ObjectBuiltinsAssembler) {
 
     BIND(&return_generic);
     {
-      Node* tag = GetProperty(
-          context, CallBuiltin(Builtins::kToObject, context, receiver),
-          LoadRoot(Heap::kto_string_tag_symbolRootIndex));
+      Node* tag = GetProperty(context, ToObject(context, receiver),
+                              LoadRoot(Heap::kto_string_tag_symbolRootIndex));
       GotoIf(TaggedIsSmi(tag), &return_default);
       GotoIfNot(IsString(tag), &return_default);
       ReturnToStringFormat(context, tag);
@@ -592,7 +895,7 @@ TF_BUILTIN(ObjectPrototypeValueOf, CodeStubAssembler) {
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* context = Parameter(Descriptor::kContext);
 
-  Return(CallBuiltin(Builtins::kToObject, context, receiver));
+  Return(ToObject(context, receiver));
 }
 
 // ES #sec-object.create
@@ -760,7 +1063,7 @@ TF_BUILTIN(CreateGeneratorObject, ObjectBuiltinsAssembler) {
 
   // Get the initial map from the function, jumping to the runtime if we don't
   // have one.
-  Label runtime(this);
+  Label done(this), runtime(this);
   GotoIfNot(IsFunctionWithPrototypeSlotMap(LoadMap(closure)), &runtime);
   Node* maybe_map =
       LoadObjectField(closure, JSFunction::kPrototypeOrInitialMapOffset);
@@ -790,7 +1093,13 @@ TF_BUILTIN(CreateGeneratorObject, ObjectBuiltinsAssembler) {
   Node* executing = SmiConstant(JSGeneratorObject::kGeneratorExecuting);
   StoreObjectFieldNoWriteBarrier(result, JSGeneratorObject::kContinuationOffset,
                                  executing);
-  Return(result);
+  GotoIfNot(HasInstanceType(maybe_map, JS_ASYNC_GENERATOR_OBJECT_TYPE), &done);
+  StoreObjectFieldNoWriteBarrier(
+      result, JSAsyncGeneratorObject::kIsAwaitingOffset, SmiConstant(0));
+  Goto(&done);
+
+  BIND(&done);
+  { Return(result); }
 
   BIND(&runtime);
   {
@@ -810,7 +1119,7 @@ TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
   Node* key = args.GetOptionalArgumentValue(1);
 
   // 1. Let obj be ? ToObject(O).
-  object = CallBuiltin(Builtins::kToObject, context, object);
+  object = ToObject(context, object);
 
   // 2. Let key be ? ToPropertyKey(P).
   key = ToName(context, key);
@@ -821,9 +1130,7 @@ TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
       return_undefined(this, Label::kDeferred), if_notunique_name(this);
   Node* map = LoadMap(object);
   Node* instance_type = LoadMapInstanceType(map);
-  GotoIf(Int32LessThanOrEqual(instance_type,
-                              Int32Constant(LAST_SPECIAL_RECEIVER_TYPE)),
-         &call_runtime);
+  GotoIf(IsSpecialReceiverInstanceType(instance_type), &call_runtime);
   {
     VARIABLE(var_index, MachineType::PointerRepresentation(),
              IntPtrConstant(0));
diff --git a/deps/v8/src/builtins/builtins-object.cc b/deps/v8/src/builtins/builtins-object.cc
index 36f7ebfc0a8..4e353b92600 100644
--- a/deps/v8/src/builtins/builtins-object.cc
+++ b/deps/v8/src/builtins/builtins-object.cc
@@ -395,31 +395,6 @@ BUILTIN(ObjectIsSealed) {
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
-BUILTIN(ObjectValues) {
-  HandleScope scope(isolate);
-  Handle<Object> object = args.atOrUndefined(isolate, 1);
-  Handle<JSReceiver> receiver;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, receiver,
-                                     Object::ToObject(isolate, object));
-  Handle<FixedArray> values;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, values, JSReceiver::GetOwnValues(receiver, ENUMERABLE_STRINGS));
-  return *isolate->factory()->NewJSArrayWithElements(values);
-}
-
-BUILTIN(ObjectEntries) {
-  HandleScope scope(isolate);
-  Handle<Object> object = args.atOrUndefined(isolate, 1);
-  Handle<JSReceiver> receiver;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, receiver,
-                                     Object::ToObject(isolate, object));
-  Handle<FixedArray> entries;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, entries,
-      JSReceiver::GetOwnEntries(receiver, ENUMERABLE_STRINGS));
-  return *isolate->factory()->NewJSArrayWithElements(entries);
-}
-
 BUILTIN(ObjectGetOwnPropertyDescriptors) {
   HandleScope scope(isolate);
   Handle<Object> object = args.atOrUndefined(isolate, 1);
diff --git a/deps/v8/src/builtins/builtins-promise-gen.cc b/deps/v8/src/builtins/builtins-promise-gen.cc
index 1a3ebcd8923..711df98f1fe 100644
--- a/deps/v8/src/builtins/builtins-promise-gen.cc
+++ b/deps/v8/src/builtins/builtins-promise-gen.cc
@@ -22,19 +22,26 @@ Node* PromiseBuiltinsAssembler::AllocateJSPromise(Node* context) {
   Node* const promise_fun =
       LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
   CSA_ASSERT(this, IsFunctionWithPrototypeSlotMap(LoadMap(promise_fun)));
-  Node* const initial_map =
+  Node* const promise_map =
       LoadObjectField(promise_fun, JSFunction::kPrototypeOrInitialMapOffset);
-  Node* const instance = AllocateJSObjectFromMap(initial_map);
-  return instance;
+  Node* const promise = Allocate(JSPromise::kSizeWithEmbedderFields);
+  StoreMapNoWriteBarrier(promise, promise_map);
+  StoreObjectFieldRoot(promise, JSPromise::kPropertiesOrHashOffset,
+                       Heap::kEmptyFixedArrayRootIndex);
+  StoreObjectFieldRoot(promise, JSPromise::kElementsOffset,
+                       Heap::kEmptyFixedArrayRootIndex);
+  return promise;
 }
 
 void PromiseBuiltinsAssembler::PromiseInit(Node* promise) {
   STATIC_ASSERT(v8::Promise::kPending == 0);
+  StoreObjectFieldNoWriteBarrier(promise, JSPromise::kReactionsOrResultOffset,
+                                 SmiConstant(Smi::kZero));
   StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset,
-                                 SmiConstant(0));
+                                 SmiConstant(Smi::kZero));
   for (int i = 0; i < v8::Promise::kEmbedderFieldCount; i++) {
     int offset = JSPromise::kSize + i * kPointerSize;
-    StoreObjectFieldNoWriteBarrier(promise, offset, SmiConstant(0));
+    StoreObjectFieldNoWriteBarrier(promise, offset, SmiConstant(Smi::kZero));
   }
 }
 
@@ -58,9 +65,11 @@ Node* PromiseBuiltinsAssembler::AllocateAndInitJSPromise(Node* context,
 
 Node* PromiseBuiltinsAssembler::AllocateAndSetJSPromise(
     Node* context, v8::Promise::PromiseState status, Node* result) {
-  Node* const instance = AllocateJSPromise(context);
+  DCHECK_NE(Promise::kPending, status);
 
-  StoreObjectFieldNoWriteBarrier(instance, JSPromise::kResultOffset, result);
+  Node* const instance = AllocateJSPromise(context);
+  StoreObjectFieldNoWriteBarrier(instance, JSPromise::kReactionsOrResultOffset,
+                                 result);
   STATIC_ASSERT(JSPromise::kStatusShift == 0);
   StoreObjectFieldNoWriteBarrier(instance, JSPromise::kFlagsOffset,
                                  SmiConstant(status));
@@ -86,66 +95,68 @@ PromiseBuiltinsAssembler::CreatePromiseResolvingFunctions(
       promise, debug_event, native_context);
   Node* const map = LoadContextElement(
       native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
-  Node* const resolve_info =
-      LoadContextElement(native_context, Context::PROMISE_RESOLVE_SHARED_FUN);
+  Node* const resolve_info = LoadContextElement(
+      native_context,
+      Context::PROMISE_CAPABILITY_DEFAULT_RESOLVE_SHARED_FUN_INDEX);
   Node* const resolve =
       AllocateFunctionWithMapAndContext(map, resolve_info, promise_context);
-  Node* const reject_info =
-      LoadContextElement(native_context, Context::PROMISE_REJECT_SHARED_FUN);
+  Node* const reject_info = LoadContextElement(
+      native_context,
+      Context::PROMISE_CAPABILITY_DEFAULT_REJECT_SHARED_FUN_INDEX);
   Node* const reject =
       AllocateFunctionWithMapAndContext(map, reject_info, promise_context);
   return std::make_pair(resolve, reject);
 }
 
-Node* PromiseBuiltinsAssembler::NewPromiseCapability(Node* context,
-                                                     Node* constructor,
-                                                     Node* debug_event) {
-  if (debug_event == nullptr) {
-    debug_event = TrueConstant();
-  }
+// ES #sec-newpromisecapability
+TF_BUILTIN(NewPromiseCapability, PromiseBuiltinsAssembler) {
+  Node* const context = Parameter(Descriptor::kContext);
+  Node* const constructor = Parameter(Descriptor::kConstructor);
+  Node* const debug_event = Parameter(Descriptor::kDebugEvent);
+  Node* const native_context = LoadNativeContext(context);
 
-  Label if_not_constructor(this, Label::kDeferred);
+  Label if_not_constructor(this, Label::kDeferred),
+      if_notcallable(this, Label::kDeferred), if_fast_promise_capability(this),
+      if_slow_promise_capability(this, Label::kDeferred);
   GotoIf(TaggedIsSmi(constructor), &if_not_constructor);
   GotoIfNot(IsConstructorMap(LoadMap(constructor)), &if_not_constructor);
-
-  Node* native_context = LoadNativeContext(context);
-
-  Node* map = LoadRoot(Heap::kTuple3MapRootIndex);
-  Node* capability = AllocateStruct(map);
-
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-  var_result.Bind(capability);
-
-  Label if_builtin_promise(this), if_custom_promise(this, Label::kDeferred),
-      out(this);
   Branch(WordEqual(constructor,
                    LoadContextElement(native_context,
                                       Context::PROMISE_FUNCTION_INDEX)),
-         &if_builtin_promise, &if_custom_promise);
+         &if_fast_promise_capability, &if_slow_promise_capability);
 
-  BIND(&if_builtin_promise);
+  BIND(&if_fast_promise_capability);
   {
-    Node* promise = AllocateJSPromise(context);
-    PromiseInit(promise);
-    StoreObjectField(capability, PromiseCapability::kPromiseOffset, promise);
+    Node* promise =
+        AllocateAndInitJSPromise(native_context, UndefinedConstant());
 
     Node* resolve = nullptr;
     Node* reject = nullptr;
-
     std::tie(resolve, reject) =
         CreatePromiseResolvingFunctions(promise, debug_event, native_context);
-    StoreObjectField(capability, PromiseCapability::kResolveOffset, resolve);
-    StoreObjectField(capability, PromiseCapability::kRejectOffset, reject);
 
-    GotoIfNot(IsPromiseHookEnabledOrDebugIsActive(), &out);
-    CallRuntime(Runtime::kPromiseHookInit, context, promise,
-                UndefinedConstant());
-    Goto(&out);
+    Node* capability = Allocate(PromiseCapability::kSize);
+    StoreMapNoWriteBarrier(capability, Heap::kPromiseCapabilityMapRootIndex);
+    StoreObjectFieldNoWriteBarrier(capability,
+                                   PromiseCapability::kPromiseOffset, promise);
+    StoreObjectFieldNoWriteBarrier(capability,
+                                   PromiseCapability::kResolveOffset, resolve);
+    StoreObjectFieldNoWriteBarrier(capability, PromiseCapability::kRejectOffset,
+                                   reject);
+    Return(capability);
   }
 
-  BIND(&if_custom_promise);
+  BIND(&if_slow_promise_capability);
   {
-    Label if_notcallable(this, Label::kDeferred);
+    Node* capability = Allocate(PromiseCapability::kSize);
+    StoreMapNoWriteBarrier(capability, Heap::kPromiseCapabilityMapRootIndex);
+    StoreObjectFieldRoot(capability, PromiseCapability::kPromiseOffset,
+                         Heap::kUndefinedValueRootIndex);
+    StoreObjectFieldRoot(capability, PromiseCapability::kResolveOffset,
+                         Heap::kUndefinedValueRootIndex);
+    StoreObjectFieldRoot(capability, PromiseCapability::kRejectOffset,
+                         Heap::kUndefinedValueRootIndex);
+
     Node* executor_context =
         CreatePromiseGetCapabilitiesExecutorContext(capability, native_context);
     Node* executor_info = LoadContextElement(
@@ -155,8 +166,9 @@ Node* PromiseBuiltinsAssembler::NewPromiseCapability(Node* context,
     Node* executor = AllocateFunctionWithMapAndContext(
         function_map, executor_info, executor_context);
 
-    Node* promise = ConstructJS(CodeFactory::Construct(isolate()), context,
-                                constructor, executor);
+    Node* promise = ConstructJS(CodeFactory::Construct(isolate()),
+                                native_context, constructor, executor);
+    StoreObjectField(capability, PromiseCapability::kPromiseOffset, promise);
 
     Node* resolve =
         LoadObjectField(capability, PromiseCapability::kResolveOffset);
@@ -167,26 +179,14 @@ Node* PromiseBuiltinsAssembler::NewPromiseCapability(Node* context,
         LoadObjectField(capability, PromiseCapability::kRejectOffset);
     GotoIf(TaggedIsSmi(reject), &if_notcallable);
     GotoIfNot(IsCallable(reject), &if_notcallable);
-
-    StoreObjectField(capability, PromiseCapability::kPromiseOffset, promise);
-
-    Goto(&out);
-
-    BIND(&if_notcallable);
-    StoreObjectField(capability, PromiseCapability::kPromiseOffset,
-                     UndefinedConstant());
-    StoreObjectField(capability, PromiseCapability::kResolveOffset,
-                     UndefinedConstant());
-    StoreObjectField(capability, PromiseCapability::kRejectOffset,
-                     UndefinedConstant());
-    ThrowTypeError(context, MessageTemplate::kPromiseNonCallable);
+    Return(capability);
   }
 
   BIND(&if_not_constructor);
   ThrowTypeError(context, MessageTemplate::kNotConstructor, constructor);
 
-  BIND(&out);
-  return var_result.value();
+  BIND(&if_notcallable);
+  ThrowTypeError(context, MessageTemplate::kPromiseNonCallable);
 }
 
 Node* PromiseBuiltinsAssembler::CreatePromiseContext(Node* native_context,
@@ -198,6 +198,50 @@ Node* PromiseBuiltinsAssembler::CreatePromiseContext(Node* native_context,
   return context;
 }
 
+Node* PromiseBuiltinsAssembler::CreatePromiseAllResolveElementContext(
+    Node* promise_capability, Node* native_context) {
+  CSA_ASSERT(this, IsNativeContext(native_context));
+
+  // TODO(bmeurer): Manually fold this into a single allocation.
+  Node* const array_map = LoadContextElement(
+      native_context, Context::JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX);
+  Node* const values_array = AllocateJSArray(PACKED_ELEMENTS, array_map,
+                                             IntPtrConstant(0), SmiConstant(0));
+
+  Node* const context =
+      CreatePromiseContext(native_context, kPromiseAllResolveElementLength);
+  StoreContextElementNoWriteBarrier(
+      context, kPromiseAllResolveElementRemainingSlot, SmiConstant(1));
+  StoreContextElementNoWriteBarrier(
+      context, kPromiseAllResolveElementCapabilitySlot, promise_capability);
+  StoreContextElementNoWriteBarrier(
+      context, kPromiseAllResolveElementValuesArraySlot, values_array);
+
+  return context;
+}
+
+Node* PromiseBuiltinsAssembler::CreatePromiseAllResolveElementFunction(
+    Node* context, Node* index, Node* native_context) {
+  CSA_ASSERT(this, TaggedIsSmi(index));
+  CSA_ASSERT(this, SmiGreaterThan(index, SmiConstant(0)));
+  CSA_ASSERT(this, SmiLessThanOrEqual(
+                       index, SmiConstant(PropertyArray::HashField::kMax)));
+  CSA_ASSERT(this, IsNativeContext(native_context));
+
+  Node* const map = LoadContextElement(
+      native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
+  Node* const resolve_info = LoadContextElement(
+      native_context, Context::PROMISE_ALL_RESOLVE_ELEMENT_SHARED_FUN);
+  Node* const resolve =
+      AllocateFunctionWithMapAndContext(map, resolve_info, context);
+
+  STATIC_ASSERT(PropertyArray::kNoHashSentinel == 0);
+  StoreObjectFieldNoWriteBarrier(resolve, JSFunction::kPropertiesOrHashOffset,
+                                 index);
+
+  return resolve;
+}
+
 Node* PromiseBuiltinsAssembler::CreatePromiseResolvingFunctionsContext(
     Node* promise, Node* debug_event, Node* native_context) {
   Node* const context =
@@ -236,7 +280,7 @@ Node* PromiseBuiltinsAssembler::IsPromiseStatus(
 Node* PromiseBuiltinsAssembler::PromiseStatus(Node* promise) {
   STATIC_ASSERT(JSPromise::kStatusShift == 0);
   Node* const flags = LoadObjectField(promise, JSPromise::kFlagsOffset);
-  return Word32And(SmiToWord32(flags), Int32Constant(JSPromise::kStatusMask));
+  return Word32And(SmiToInt32(flags), Int32Constant(JSPromise::kStatusMask));
 }
 
 void PromiseBuiltinsAssembler::PromiseSetStatus(
@@ -258,579 +302,354 @@ void PromiseBuiltinsAssembler::PromiseSetHandledHint(Node* promise) {
   StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset, new_flags);
 }
 
-Node* PromiseBuiltinsAssembler::SpeciesConstructor(Node* context, Node* object,
-                                                   Node* default_constructor) {
-  Isolate* isolate = this->isolate();
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-  var_result.Bind(default_constructor);
-
-  // 2. Let C be ? Get(O, "constructor").
-  Node* const constructor =
-      GetProperty(context, object, isolate->factory()->constructor_string());
-
-  // 3. If C is undefined, return defaultConstructor.
-  Label out(this);
-  GotoIf(IsUndefined(constructor), &out);
-
-  // 4. If Type(C) is not Object, throw a TypeError exception.
-  ThrowIfNotJSReceiver(context, constructor,
-                       MessageTemplate::kConstructorNotReceiver);
-
-  // 5. Let S be ? Get(C, @@species).
-  Node* const species =
-      GetProperty(context, constructor, isolate->factory()->species_symbol());
-
-  // 6. If S is either undefined or null, return defaultConstructor.
-  GotoIf(IsNullOrUndefined(species), &out);
-
-  // 7. If IsConstructor(S) is true, return S.
-  Label throw_error(this);
-  GotoIf(TaggedIsSmi(species), &throw_error);
-  GotoIfNot(IsConstructorMap(LoadMap(species)), &throw_error);
-  var_result.Bind(species);
-  Goto(&out);
-
-  // 8. Throw a TypeError exception.
-  BIND(&throw_error);
-  ThrowTypeError(context, MessageTemplate::kSpeciesNotConstructor);
-
-  BIND(&out);
-  return var_result.value();
-}
-
-void PromiseBuiltinsAssembler::AppendPromiseCallback(int offset, Node* promise,
-                                                     Node* value) {
-  Node* elements = LoadObjectField(promise, offset);
-  Node* length = LoadFixedArrayBaseLength(elements);
-  CodeStubAssembler::ParameterMode mode = OptimalParameterMode();
-  length = TaggedToParameter(length, mode);
-
-  Node* delta = IntPtrOrSmiConstant(1, mode);
-  Node* new_capacity = IntPtrOrSmiAdd(length, delta, mode);
-
-  const WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER;
-  int additional_offset = 0;
-
-  ExtractFixedArrayFlags flags;
-  flags |= ExtractFixedArrayFlag::kFixedArrays;
-  Node* new_elements =
-      ExtractFixedArray(elements, nullptr, length, new_capacity, flags, mode);
-
-  StoreFixedArrayElement(new_elements, length, value, barrier_mode,
-                         additional_offset, mode);
-
-  StoreObjectField(promise, offset, new_elements);
-}
-
-Node* PromiseBuiltinsAssembler::InternalPromiseThen(Node* context,
-                                                    Node* promise,
-                                                    Node* on_resolve,
-                                                    Node* on_reject) {
-  Isolate* isolate = this->isolate();
-
-  // 2. If IsPromise(promise) is false, throw a TypeError exception.
-  ThrowIfNotInstanceType(context, promise, JS_PROMISE_TYPE,
-                         "Promise.prototype.then");
-
-  Node* const native_context = LoadNativeContext(context);
-  Node* const promise_fun =
-      LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
-
-  // 3. Let C be ? SpeciesConstructor(promise, %Promise%).
-  Node* constructor = SpeciesConstructor(context, promise, promise_fun);
-
-  // 4. Let resultCapability be ? NewPromiseCapability(C).
-  Callable call_callable = CodeFactory::Call(isolate);
-  Label fast_promise_capability(this), promise_capability(this),
-      perform_promise_then(this);
-  VARIABLE(var_deferred_promise, MachineRepresentation::kTagged);
-  VARIABLE(var_deferred_on_resolve, MachineRepresentation::kTagged);
-  VARIABLE(var_deferred_on_reject, MachineRepresentation::kTagged);
-
-  Branch(WordEqual(promise_fun, constructor), &fast_promise_capability,
-         &promise_capability);
-
-  BIND(&fast_promise_capability);
-  {
-    Node* const deferred_promise = AllocateAndInitJSPromise(context, promise);
-    var_deferred_promise.Bind(deferred_promise);
-    var_deferred_on_resolve.Bind(UndefinedConstant());
-    var_deferred_on_reject.Bind(UndefinedConstant());
-    Goto(&perform_promise_then);
-  }
-
-  BIND(&promise_capability);
-  {
-    Node* const capability = NewPromiseCapability(context, constructor);
-    var_deferred_promise.Bind(
-        LoadObjectField(capability, PromiseCapability::kPromiseOffset));
-    var_deferred_on_resolve.Bind(
-        LoadObjectField(capability, PromiseCapability::kResolveOffset));
-    var_deferred_on_reject.Bind(
-        LoadObjectField(capability, PromiseCapability::kRejectOffset));
-    Goto(&perform_promise_then);
-  }
-
-  // 5. Return PerformPromiseThen(promise, onFulfilled, onRejected,
-  //    resultCapability).
-  BIND(&perform_promise_then);
-  Node* const result = InternalPerformPromiseThen(
-      context, promise, on_resolve, on_reject, var_deferred_promise.value(),
-      var_deferred_on_resolve.value(), var_deferred_on_reject.value());
-  return result;
-}
-
-Node* PromiseBuiltinsAssembler::InternalPerformPromiseThen(
-    Node* context, Node* promise, Node* on_resolve, Node* on_reject,
-    Node* deferred_promise, Node* deferred_on_resolve,
-    Node* deferred_on_reject) {
-  VARIABLE(var_on_resolve, MachineRepresentation::kTagged);
-  VARIABLE(var_on_reject, MachineRepresentation::kTagged);
-
-  var_on_resolve.Bind(on_resolve);
-  var_on_reject.Bind(on_reject);
-
-  Label out(this), if_onresolvenotcallable(this), onrejectcheck(this),
-      append_callbacks(this);
-  GotoIf(TaggedIsSmi(on_resolve), &if_onresolvenotcallable);
-
-  Branch(IsCallable(on_resolve), &onrejectcheck, &if_onresolvenotcallable);
-
-  BIND(&if_onresolvenotcallable);
-  {
-    var_on_resolve.Bind(PromiseDefaultResolveHandlerSymbolConstant());
-    Goto(&onrejectcheck);
-  }
-
-  BIND(&onrejectcheck);
+// ES #sec-performpromisethen
+void PromiseBuiltinsAssembler::PerformPromiseThen(
+    Node* context, Node* promise, Node* on_fulfilled, Node* on_rejected,
+    Node* result_promise_or_capability) {
+  CSA_ASSERT(this, TaggedIsNotSmi(promise));
+  CSA_ASSERT(this, IsJSPromise(promise));
+  CSA_ASSERT(this,
+             Word32Or(IsCallable(on_fulfilled), IsUndefined(on_fulfilled)));
+  CSA_ASSERT(this, Word32Or(IsCallable(on_rejected), IsUndefined(on_rejected)));
+  CSA_ASSERT(this, TaggedIsNotSmi(result_promise_or_capability));
+  CSA_ASSERT(this, Word32Or(IsJSPromise(result_promise_or_capability),
+                            IsPromiseCapability(result_promise_or_capability)));
+
+  Label if_pending(this), if_notpending(this), done(this);
+  Node* const status = PromiseStatus(promise);
+  Branch(IsPromiseStatus(status, v8::Promise::kPending), &if_pending,
+         &if_notpending);
+
+  BIND(&if_pending);
   {
-    Label if_onrejectnotcallable(this);
-    GotoIf(TaggedIsSmi(on_reject), &if_onrejectnotcallable);
-
-    Branch(IsCallable(on_reject), &append_callbacks, &if_onrejectnotcallable);
-
-    BIND(&if_onrejectnotcallable);
-    {
-      var_on_reject.Bind(PromiseDefaultRejectHandlerSymbolConstant());
-      Goto(&append_callbacks);
-    }
+    // The {promise} is still in "Pending" state, so we just record a new
+    // PromiseReaction holding both the onFulfilled and onRejected callbacks.
+    // Once the {promise} is resolved we decide on the concrete handler to
+    // push onto the microtask queue.
+    Node* const promise_reactions =
+        LoadObjectField(promise, JSPromise::kReactionsOrResultOffset);
+    Node* const reaction =
+        AllocatePromiseReaction(promise_reactions, result_promise_or_capability,
+                                on_fulfilled, on_rejected);
+    StoreObjectField(promise, JSPromise::kReactionsOrResultOffset, reaction);
+    Goto(&done);
   }
 
-  BIND(&append_callbacks);
+  BIND(&if_notpending);
   {
-    Label fulfilled_check(this);
-    Node* const status = PromiseStatus(promise);
-    GotoIfNot(IsPromiseStatus(status, v8::Promise::kPending), &fulfilled_check);
-
-    Node* const existing_deferred_promise =
-        LoadObjectField(promise, JSPromise::kDeferredPromiseOffset);
-
-    Label if_noexistingcallbacks(this), if_existingcallbacks(this);
-    Branch(IsUndefined(existing_deferred_promise), &if_noexistingcallbacks,
-           &if_existingcallbacks);
-
-    BIND(&if_noexistingcallbacks);
+    VARIABLE(var_map, MachineRepresentation::kTagged);
+    VARIABLE(var_handler, MachineRepresentation::kTagged);
+    Label if_fulfilled(this), if_rejected(this, Label::kDeferred),
+        enqueue(this);
+    Branch(IsPromiseStatus(status, v8::Promise::kFulfilled), &if_fulfilled,
+           &if_rejected);
+
+    BIND(&if_fulfilled);
     {
-      // Store callbacks directly in the slots.
-      StoreObjectField(promise, JSPromise::kDeferredPromiseOffset,
-                       deferred_promise);
-      StoreObjectField(promise, JSPromise::kDeferredOnResolveOffset,
-                       deferred_on_resolve);
-      StoreObjectField(promise, JSPromise::kDeferredOnRejectOffset,
-                       deferred_on_reject);
-      StoreObjectField(promise, JSPromise::kFulfillReactionsOffset,
-                       var_on_resolve.value());
-      StoreObjectField(promise, JSPromise::kRejectReactionsOffset,
-                       var_on_reject.value());
-      Goto(&out);
+      var_map.Bind(LoadRoot(Heap::kPromiseFulfillReactionJobTaskMapRootIndex));
+      var_handler.Bind(on_fulfilled);
+      Goto(&enqueue);
     }
 
-    BIND(&if_existingcallbacks);
+    BIND(&if_rejected);
     {
-      Label if_singlecallback(this), if_multiplecallbacks(this);
-      BranchIfJSObject(existing_deferred_promise, &if_singlecallback,
-                       &if_multiplecallbacks);
-
-      BIND(&if_singlecallback);
-      {
-        // Create new FixedArrays to store callbacks, and migrate
-        // existing callbacks.
-        Node* const deferred_promise_arr =
-            AllocateFixedArray(PACKED_ELEMENTS, IntPtrConstant(2));
-        StoreFixedArrayElement(deferred_promise_arr, 0,
-                               existing_deferred_promise);
-        StoreFixedArrayElement(deferred_promise_arr, 1, deferred_promise);
-
-        Node* const deferred_on_resolve_arr =
-            AllocateFixedArray(PACKED_ELEMENTS, IntPtrConstant(2));
-        StoreFixedArrayElement(
-            deferred_on_resolve_arr, 0,
-            LoadObjectField(promise, JSPromise::kDeferredOnResolveOffset));
-        StoreFixedArrayElement(deferred_on_resolve_arr, 1, deferred_on_resolve);
-
-        Node* const deferred_on_reject_arr =
-            AllocateFixedArray(PACKED_ELEMENTS, IntPtrConstant(2));
-        StoreFixedArrayElement(
-            deferred_on_reject_arr, 0,
-            LoadObjectField(promise, JSPromise::kDeferredOnRejectOffset));
-        StoreFixedArrayElement(deferred_on_reject_arr, 1, deferred_on_reject);
-
-        Node* const fulfill_reactions =
-            AllocateFixedArray(PACKED_ELEMENTS, IntPtrConstant(2));
-        StoreFixedArrayElement(
-            fulfill_reactions, 0,
-            LoadObjectField(promise, JSPromise::kFulfillReactionsOffset));
-        StoreFixedArrayElement(fulfill_reactions, 1, var_on_resolve.value());
-
-        Node* const reject_reactions =
-            AllocateFixedArray(PACKED_ELEMENTS, IntPtrConstant(2));
-        StoreFixedArrayElement(
-            reject_reactions, 0,
-            LoadObjectField(promise, JSPromise::kRejectReactionsOffset));
-        StoreFixedArrayElement(reject_reactions, 1, var_on_reject.value());
-
-        // Store new FixedArrays in promise.
-        StoreObjectField(promise, JSPromise::kDeferredPromiseOffset,
-                         deferred_promise_arr);
-        StoreObjectField(promise, JSPromise::kDeferredOnResolveOffset,
-                         deferred_on_resolve_arr);
-        StoreObjectField(promise, JSPromise::kDeferredOnRejectOffset,
-                         deferred_on_reject_arr);
-        StoreObjectField(promise, JSPromise::kFulfillReactionsOffset,
-                         fulfill_reactions);
-        StoreObjectField(promise, JSPromise::kRejectReactionsOffset,
-                         reject_reactions);
-        Goto(&out);
-      }
-
-      BIND(&if_multiplecallbacks);
-      {
-        AppendPromiseCallback(JSPromise::kDeferredPromiseOffset, promise,
-                              deferred_promise);
-        AppendPromiseCallback(JSPromise::kDeferredOnResolveOffset, promise,
-                              deferred_on_resolve);
-        AppendPromiseCallback(JSPromise::kDeferredOnRejectOffset, promise,
-                              deferred_on_reject);
-        AppendPromiseCallback(JSPromise::kFulfillReactionsOffset, promise,
-                              var_on_resolve.value());
-        AppendPromiseCallback(JSPromise::kRejectReactionsOffset, promise,
-                              var_on_reject.value());
-        Goto(&out);
-      }
+      CSA_ASSERT(this, IsPromiseStatus(status, v8::Promise::kRejected));
+      var_map.Bind(LoadRoot(Heap::kPromiseRejectReactionJobTaskMapRootIndex));
+      var_handler.Bind(on_rejected);
+      GotoIf(PromiseHasHandler(promise), &enqueue);
+      CallRuntime(Runtime::kPromiseRevokeReject, context, promise);
+      Goto(&enqueue);
     }
 
-    BIND(&fulfilled_check);
-    {
-      Label reject(this);
-      Node* const result = LoadObjectField(promise, JSPromise::kResultOffset);
-      GotoIfNot(IsPromiseStatus(status, v8::Promise::kFulfilled), &reject);
-
-      Node* info = AllocatePromiseReactionJobInfo(
-          result, var_on_resolve.value(), deferred_promise, deferred_on_resolve,
-          deferred_on_reject, context);
-      CallBuiltin(Builtins::kEnqueueMicrotask, NoContextConstant(), info);
-      Goto(&out);
-
-      BIND(&reject);
-      {
-        CSA_ASSERT(this, IsPromiseStatus(status, v8::Promise::kRejected));
-        Node* const has_handler = PromiseHasHandler(promise);
-        Label enqueue(this);
-
-        // TODO(gsathya): Fold these runtime calls and move to TF.
-        GotoIf(has_handler, &enqueue);
-        CallRuntime(Runtime::kPromiseRevokeReject, context, promise);
-        Goto(&enqueue);
-
-        BIND(&enqueue);
-        {
-          Node* info = AllocatePromiseReactionJobInfo(
-              result, var_on_reject.value(), deferred_promise,
-              deferred_on_resolve, deferred_on_reject, context);
-          CallBuiltin(Builtins::kEnqueueMicrotask, NoContextConstant(), info);
-          Goto(&out);
-        }
-      }
-    }
+    BIND(&enqueue);
+    Node* argument =
+        LoadObjectField(promise, JSPromise::kReactionsOrResultOffset);
+    Node* microtask = AllocatePromiseReactionJobTask(
+        var_map.value(), context, argument, var_handler.value(),
+        result_promise_or_capability);
+    CallBuiltin(Builtins::kEnqueueMicrotask, NoContextConstant(), microtask);
+    Goto(&done);
   }
 
-  BIND(&out);
+  BIND(&done);
   PromiseSetHasHandler(promise);
-  return deferred_promise;
 }
 
-// Promise fast path implementations rely on unmodified JSPromise instances.
-// We use a fairly coarse granularity for this and simply check whether both
-// the promise itself is unmodified (i.e. its map has not changed) and its
-// prototype is unmodified.
-// TODO(gsathya): Refactor this out to prevent code dupe with builtins-regexp
-void PromiseBuiltinsAssembler::BranchIfFastPath(Node* context, Node* promise,
-                                                Label* if_isunmodified,
-                                                Label* if_ismodified) {
-  Node* const native_context = LoadNativeContext(context);
-  Node* const promise_fun =
-      LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
-  BranchIfFastPath(native_context, promise_fun, promise, if_isunmodified,
-                   if_ismodified);
-}
-
-void PromiseBuiltinsAssembler::BranchIfFastPath(Node* native_context,
-                                                Node* promise_fun,
-                                                Node* promise,
-                                                Label* if_isunmodified,
-                                                Label* if_ismodified) {
-  CSA_ASSERT(this, IsNativeContext(native_context));
-  CSA_ASSERT(this,
-             WordEqual(promise_fun,
-                       LoadContextElement(native_context,
-                                          Context::PROMISE_FUNCTION_INDEX)));
-
-  GotoIfForceSlowPath(if_ismodified);
-
-  Node* const map = LoadMap(promise);
-  Node* const initial_map =
-      LoadObjectField(promise_fun, JSFunction::kPrototypeOrInitialMapOffset);
-  Node* const has_initialmap = WordEqual(map, initial_map);
-
-  GotoIfNot(has_initialmap, if_ismodified);
+// ES #sec-performpromisethen
+TF_BUILTIN(PerformPromiseThen, PromiseBuiltinsAssembler) {
+  Node* const context = Parameter(Descriptor::kContext);
+  Node* const promise = Parameter(Descriptor::kPromise);
+  Node* const on_fulfilled = Parameter(Descriptor::kOnFulfilled);
+  Node* const on_rejected = Parameter(Descriptor::kOnRejected);
+  Node* const result_promise = Parameter(Descriptor::kResultPromise);
 
-  Node* const initial_proto_initial_map =
-      LoadContextElement(native_context, Context::PROMISE_PROTOTYPE_MAP_INDEX);
-  Node* const proto_map = LoadMap(CAST(LoadMapPrototype(map)));
-  Node* const proto_has_initialmap =
-      WordEqual(proto_map, initial_proto_initial_map);
+  CSA_ASSERT(this, TaggedIsNotSmi(result_promise));
+  CSA_ASSERT(this, IsJSPromise(result_promise));
 
-  Branch(proto_has_initialmap, if_isunmodified, if_ismodified);
+  PerformPromiseThen(context, promise, on_fulfilled, on_rejected,
+                     result_promise);
+  Return(result_promise);
 }
 
-Node* PromiseBuiltinsAssembler::AllocatePromiseResolveThenableJobInfo(
-    Node* thenable, Node* then, Node* resolve, Node* reject, Node* context) {
-  Node* const info = Allocate(PromiseResolveThenableJobInfo::kSize);
-  StoreMapNoWriteBarrier(info,
-                         Heap::kPromiseResolveThenableJobInfoMapRootIndex);
+Node* PromiseBuiltinsAssembler::AllocatePromiseReaction(Node* next,
+                                                        Node* payload,
+                                                        Node* fulfill_handler,
+                                                        Node* reject_handler) {
+  Node* const reaction = Allocate(PromiseReaction::kSize);
+  StoreMapNoWriteBarrier(reaction, Heap::kPromiseReactionMapRootIndex);
+  StoreObjectFieldNoWriteBarrier(reaction, PromiseReaction::kNextOffset, next);
+  StoreObjectFieldNoWriteBarrier(reaction, PromiseReaction::kPayloadOffset,
+                                 payload);
   StoreObjectFieldNoWriteBarrier(
-      info, PromiseResolveThenableJobInfo::kThenableOffset, thenable);
+      reaction, PromiseReaction::kFulfillHandlerOffset, fulfill_handler);
   StoreObjectFieldNoWriteBarrier(
-      info, PromiseResolveThenableJobInfo::kThenOffset, then);
+      reaction, PromiseReaction::kRejectHandlerOffset, reject_handler);
+  return reaction;
+}
+
+Node* PromiseBuiltinsAssembler::AllocatePromiseReactionJobTask(
+    Node* map, Node* context, Node* argument, Node* handler, Node* payload) {
+  Node* const microtask = Allocate(PromiseReactionJobTask::kSize);
+  StoreMapNoWriteBarrier(microtask, map);
+  StoreObjectFieldNoWriteBarrier(
+      microtask, PromiseReactionJobTask::kArgumentOffset, argument);
   StoreObjectFieldNoWriteBarrier(
-      info, PromiseResolveThenableJobInfo::kResolveOffset, resolve);
+      microtask, PromiseReactionJobTask::kContextOffset, context);
   StoreObjectFieldNoWriteBarrier(
-      info, PromiseResolveThenableJobInfo::kRejectOffset, reject);
+      microtask, PromiseReactionJobTask::kHandlerOffset, handler);
   StoreObjectFieldNoWriteBarrier(
-      info, PromiseResolveThenableJobInfo::kContextOffset, context);
-  return info;
+      microtask, PromiseReactionJobTask::kPayloadOffset, payload);
+  return microtask;
 }
 
-void PromiseBuiltinsAssembler::InternalResolvePromise(Node* context,
-                                                      Node* promise,
-                                                      Node* result) {
-  Isolate* isolate = this->isolate();
-
-  VARIABLE(var_reason, MachineRepresentation::kTagged);
-  VARIABLE(var_then, MachineRepresentation::kTagged);
-
-  Label do_enqueue(this), fulfill(this), if_nocycle(this),
-      if_cycle(this, Label::kDeferred),
-      if_rejectpromise(this, Label::kDeferred), out(this);
-
-  Label cycle_check(this);
-  GotoIfNot(IsPromiseHookEnabledOrDebugIsActive(), &cycle_check);
-  CallRuntime(Runtime::kPromiseHookResolve, context, promise);
-  Goto(&cycle_check);
-
-  BIND(&cycle_check);
-  // 6. If SameValue(resolution, promise) is true, then
-  BranchIfSameValue(promise, result, &if_cycle, &if_nocycle);
-  BIND(&if_nocycle);
-
-  // 7. If Type(resolution) is not Object, then
-  GotoIf(TaggedIsSmi(result), &fulfill);
-  GotoIfNot(IsJSReceiver(result), &fulfill);
+Node* PromiseBuiltinsAssembler::AllocatePromiseReactionJobTask(
+    Heap::RootListIndex map_root_index, Node* context, Node* argument,
+    Node* handler, Node* payload) {
+  DCHECK(map_root_index == Heap::kPromiseFulfillReactionJobTaskMapRootIndex ||
+         map_root_index == Heap::kPromiseRejectReactionJobTaskMapRootIndex);
+  Node* const map = LoadRoot(map_root_index);
+  return AllocatePromiseReactionJobTask(map, context, argument, handler,
+                                        payload);
+}
 
-  Label if_nativepromise(this), if_notnativepromise(this, Label::kDeferred);
-  Node* const native_context = LoadNativeContext(context);
-  Node* const promise_fun =
-      LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
-  BranchIfFastPath(native_context, promise_fun, result, &if_nativepromise,
-                   &if_notnativepromise);
+Node* PromiseBuiltinsAssembler::AllocatePromiseResolveThenableJobTask(
+    Node* promise_to_resolve, Node* then, Node* thenable, Node* context) {
+  Node* const microtask = Allocate(PromiseResolveThenableJobTask::kSize);
+  StoreMapNoWriteBarrier(microtask,
+                         Heap::kPromiseResolveThenableJobTaskMapRootIndex);
+  StoreObjectFieldNoWriteBarrier(
+      microtask, PromiseResolveThenableJobTask::kContextOffset, context);
+  StoreObjectFieldNoWriteBarrier(
+      microtask, PromiseResolveThenableJobTask::kPromiseToResolveOffset,
+      promise_to_resolve);
+  StoreObjectFieldNoWriteBarrier(
+      microtask, PromiseResolveThenableJobTask::kThenOffset, then);
+  StoreObjectFieldNoWriteBarrier(
+      microtask, PromiseResolveThenableJobTask::kThenableOffset, thenable);
+  return microtask;
+}
 
-  // Resolution is a native promise and if it's already resolved or
-  // rejected, shortcircuit the resolution procedure by directly
-  // reusing the value from the promise.
-  BIND(&if_nativepromise);
+// ES #sec-triggerpromisereactions
+Node* PromiseBuiltinsAssembler::TriggerPromiseReactions(
+    Node* context, Node* reactions, Node* argument,
+    PromiseReaction::Type type) {
+  // We need to reverse the {reactions} here, since we record them on the
+  // JSPromise in the reverse order.
   {
-    Node* const thenable_status = PromiseStatus(result);
-    Node* const thenable_value =
-        LoadObjectField(result, JSPromise::kResultOffset);
+    VARIABLE(var_current, MachineRepresentation::kTagged, reactions);
+    VARIABLE(var_reversed, MachineRepresentation::kTagged,
+             SmiConstant(Smi::kZero));
 
-    Label if_isnotpending(this);
-    GotoIfNot(IsPromiseStatus(thenable_status, v8::Promise::kPending),
-              &if_isnotpending);
+    Label loop(this, {&var_current, &var_reversed}), done_loop(this);
+    Goto(&loop);
+    BIND(&loop);
+    {
+      Node* current = var_current.value();
+      GotoIf(TaggedIsSmi(current), &done_loop);
+      var_current.Bind(LoadObjectField(current, PromiseReaction::kNextOffset));
+      StoreObjectField(current, PromiseReaction::kNextOffset,
+                       var_reversed.value());
+      var_reversed.Bind(current);
+      Goto(&loop);
+    }
+    BIND(&done_loop);
+    reactions = var_reversed.value();
+  }
 
-    // TODO(gsathya): Use a marker here instead of the actual then
-    // callback, and check for the marker in PromiseResolveThenableJob
-    // and perform PromiseThen.
-    Node* const then =
-        LoadContextElement(native_context, Context::PROMISE_THEN_INDEX);
-    var_then.Bind(then);
-    Goto(&do_enqueue);
+  // Morph the {reactions} into PromiseReactionJobTasks and push them
+  // onto the microtask queue.
+  {
+    VARIABLE(var_current, MachineRepresentation::kTagged, reactions);
 
-    BIND(&if_isnotpending);
+    Label loop(this, {&var_current}), done_loop(this);
+    Goto(&loop);
+    BIND(&loop);
     {
-      Label if_fulfilled(this), if_rejected(this);
-      Branch(IsPromiseStatus(thenable_status, v8::Promise::kFulfilled),
-             &if_fulfilled, &if_rejected);
-
-      BIND(&if_fulfilled);
-      {
-        PromiseFulfill(context, promise, thenable_value,
-                       v8::Promise::kFulfilled);
-        PromiseSetHasHandler(promise);
-        Goto(&out);
-      }
-
-      BIND(&if_rejected);
-      {
-        Label reject(this);
-        Node* const has_handler = PromiseHasHandler(result);
-
-        // Promise has already been rejected, but had no handler.
-        // Revoke previously triggered reject event.
-        GotoIf(has_handler, &reject);
-        CallRuntime(Runtime::kPromiseRevokeReject, context, result);
-        Goto(&reject);
-
-        BIND(&reject);
-        // Don't cause a debug event as this case is forwarding a rejection.
-        InternalPromiseReject(context, promise, thenable_value, false);
-        PromiseSetHasHandler(result);
-        Goto(&out);
+      Node* current = var_current.value();
+      GotoIf(TaggedIsSmi(current), &done_loop);
+      var_current.Bind(LoadObjectField(current, PromiseReaction::kNextOffset));
+
+      // Morph {current} from a PromiseReaction into a PromiseReactionJobTask
+      // and schedule that on the microtask queue. We try to minimize the number
+      // of stores here to avoid screwing up the store buffer.
+      STATIC_ASSERT(PromiseReaction::kSize == PromiseReactionJobTask::kSize);
+      if (type == PromiseReaction::kFulfill) {
+        StoreMapNoWriteBarrier(
+            current, Heap::kPromiseFulfillReactionJobTaskMapRootIndex);
+        StoreObjectField(current, PromiseReactionJobTask::kArgumentOffset,
+                         argument);
+        StoreObjectField(current, PromiseReactionJobTask::kContextOffset,
+                         context);
+        STATIC_ASSERT(PromiseReaction::kFulfillHandlerOffset ==
+                      PromiseReactionJobTask::kHandlerOffset);
+        STATIC_ASSERT(PromiseReaction::kPayloadOffset ==
+                      PromiseReactionJobTask::kPayloadOffset);
+      } else {
+        Node* handler =
+            LoadObjectField(current, PromiseReaction::kRejectHandlerOffset);
+        StoreMapNoWriteBarrier(current,
+                               Heap::kPromiseRejectReactionJobTaskMapRootIndex);
+        StoreObjectField(current, PromiseReactionJobTask::kArgumentOffset,
+                         argument);
+        StoreObjectField(current, PromiseReactionJobTask::kContextOffset,
+                         context);
+        StoreObjectField(current, PromiseReactionJobTask::kHandlerOffset,
+                         handler);
+        STATIC_ASSERT(PromiseReaction::kPayloadOffset ==
+                      PromiseReactionJobTask::kPayloadOffset);
       }
+      CallBuiltin(Builtins::kEnqueueMicrotask, NoContextConstant(), current);
+      Goto(&loop);
     }
+    BIND(&done_loop);
   }
 
-  BIND(&if_notnativepromise);
-  {
-    // 8. Let then be Get(resolution, "then").
-    Node* const then =
-        GetProperty(context, result, isolate->factory()->then_string());
+  return UndefinedConstant();
+}
 
-    // 9. If then is an abrupt completion, then
-    GotoIfException(then, &if_rejectpromise, &var_reason);
+template <typename... TArgs>
+Node* PromiseBuiltinsAssembler::InvokeThen(Node* native_context, Node* receiver,
+                                           TArgs... args) {
+  CSA_ASSERT(this, IsNativeContext(native_context));
 
-    // 11. If IsCallable(thenAction) is false, then
-    GotoIf(TaggedIsSmi(then), &fulfill);
-    Node* const then_map = LoadMap(then);
-    GotoIfNot(IsCallableMap(then_map), &fulfill);
-    var_then.Bind(then);
-    Goto(&do_enqueue);
+  VARIABLE(var_result, MachineRepresentation::kTagged);
+  Label if_fast(this), if_slow(this, Label::kDeferred), done(this, &var_result);
+  GotoIf(TaggedIsSmi(receiver), &if_slow);
+  Node* const receiver_map = LoadMap(receiver);
+  // We can skip the "then" lookup on {receiver} if it's [[Prototype]]
+  // is the (initial) Promise.prototype and the Promise#then protector
+  // is intact, as that guards the lookup path for the "then" property
+  // on JSPromise instances which have the (initial) %PromisePrototype%.
+  BranchIfPromiseThenLookupChainIntact(native_context, receiver_map, &if_fast,
+                                       &if_slow);
+
+  BIND(&if_fast);
+  {
+    Node* const then =
+        LoadContextElement(native_context, Context::PROMISE_THEN_INDEX);
+    Node* const result =
+        CallJS(CodeFactory::CallFunction(
+                   isolate(), ConvertReceiverMode::kNotNullOrUndefined),
+               native_context, then, receiver, args...);
+    var_result.Bind(result);
+    Goto(&done);
   }
 
-  BIND(&do_enqueue);
+  BIND(&if_slow);
   {
-    // TODO(gsathya): Add fast path for native promises with unmodified
-    // PromiseThen (which don't need these resolving functions, but
-    // instead can just call resolve/reject directly).
-    Node* resolve = nullptr;
-    Node* reject = nullptr;
-    std::tie(resolve, reject) = CreatePromiseResolvingFunctions(
-        promise, FalseConstant(), native_context);
-
-    Node* const info = AllocatePromiseResolveThenableJobInfo(
-        result, var_then.value(), resolve, reject, context);
+    Node* const then = GetProperty(native_context, receiver,
+                                   isolate()->factory()->then_string());
+    Node* const result = CallJS(
+        CodeFactory::Call(isolate(), ConvertReceiverMode::kNotNullOrUndefined),
+        native_context, then, receiver, args...);
+    var_result.Bind(result);
+    Goto(&done);
+  }
 
-    Label enqueue(this);
-    GotoIfNot(IsDebugActive(), &enqueue);
+  BIND(&done);
+  return var_result.value();
+}
 
-    GotoIf(TaggedIsSmi(result), &enqueue);
-    GotoIfNot(HasInstanceType(result, JS_PROMISE_TYPE), &enqueue);
+Node* PromiseBuiltinsAssembler::InvokeResolve(Node* native_context,
+                                              Node* constructor, Node* value,
+                                              Label* if_exception,
+                                              Variable* var_exception) {
+  CSA_ASSERT(this, IsNativeContext(native_context));
 
-    // Mark the dependency of the new promise on the resolution
-    Node* const key =
-        HeapConstant(isolate->factory()->promise_handled_by_symbol());
-    CallRuntime(Runtime::kSetProperty, context, result, key, promise,
-                SmiConstant(LanguageMode::kStrict));
-    Goto(&enqueue);
+  VARIABLE(var_result, MachineRepresentation::kTagged);
+  Label if_fast(this), if_slow(this, Label::kDeferred), done(this, &var_result);
+  // We can skip the "resolve" lookup on {constructor} if it's the
+  // Promise constructor and the Promise.resolve protector is intact,
+  // as that guards the lookup path for the "resolve" property on the
+  // Promise constructor.
+  BranchIfPromiseResolveLookupChainIntact(native_context, constructor, &if_fast,
+                                          &if_slow);
+
+  BIND(&if_fast);
+  {
+    Node* const result = CallBuiltin(Builtins::kPromiseResolve, native_context,
+                                     constructor, value);
+    GotoIfException(result, if_exception, var_exception);
 
-    // 12. Perform EnqueueJob("PromiseJobs",
-    // PromiseResolveThenableJob, « promise, resolution, thenAction»).
-    BIND(&enqueue);
-    CallBuiltin(Builtins::kEnqueueMicrotask, NoContextConstant(), info);
-    Goto(&out);
+    var_result.Bind(result);
+    Goto(&done);
   }
 
-  // 7.b Return FulfillPromise(promise, resolution).
-  BIND(&fulfill);
+  BIND(&if_slow);
   {
-    PromiseFulfill(context, promise, result, v8::Promise::kFulfilled);
-    Goto(&out);
-  }
+    Node* const resolve =
+        GetProperty(native_context, constructor, factory()->resolve_string());
+    GotoIfException(resolve, if_exception, var_exception);
 
-  BIND(&if_cycle);
-  {
-    // 6.a Let selfResolutionError be a newly created TypeError object.
-    Node* const message_id = SmiConstant(MessageTemplate::kPromiseCyclic);
-    Node* const error =
-        CallRuntime(Runtime::kNewTypeError, context, message_id, result);
-    var_reason.Bind(error);
-
-    // 6.b Return RejectPromise(promise, selfResolutionError).
-    Goto(&if_rejectpromise);
-  }
+    Node* const result = CallJS(
+        CodeFactory::Call(isolate(), ConvertReceiverMode::kNotNullOrUndefined),
+        native_context, resolve, constructor, value);
+    GotoIfException(result, if_exception, var_exception);
 
-  // 9.a Return RejectPromise(promise, then.[[Value]]).
-  BIND(&if_rejectpromise);
-  {
-    // Don't cause a debug event as this case is forwarding a rejection.
-    InternalPromiseReject(context, promise, var_reason.value(), false);
-    Goto(&out);
+    var_result.Bind(result);
+    Goto(&done);
   }
 
-  BIND(&out);
+  BIND(&done);
+  return var_result.value();
 }
 
-void PromiseBuiltinsAssembler::PromiseFulfill(
-    Node* context, Node* promise, Node* result,
-    v8::Promise::PromiseState status) {
-  Label do_promisereset(this);
-
-  Node* const deferred_promise =
-      LoadObjectField(promise, JSPromise::kDeferredPromiseOffset);
-
-  GotoIf(IsUndefined(deferred_promise), &do_promisereset);
+void PromiseBuiltinsAssembler::BranchIfPromiseResolveLookupChainIntact(
+    Node* native_context, Node* constructor, Label* if_fast, Label* if_slow) {
+  CSA_ASSERT(this, IsNativeContext(native_context));
 
-  Node* const tasks =
-      status == v8::Promise::kFulfilled
-          ? LoadObjectField(promise, JSPromise::kFulfillReactionsOffset)
-          : LoadObjectField(promise, JSPromise::kRejectReactionsOffset);
+  GotoIfForceSlowPath(if_slow);
+  Node* const promise_fun =
+      LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
+  GotoIfNot(WordEqual(promise_fun, constructor), if_slow);
+  Branch(IsPromiseResolveProtectorCellInvalid(), if_slow, if_fast);
+}
 
-  Node* const deferred_on_resolve =
-      LoadObjectField(promise, JSPromise::kDeferredOnResolveOffset);
-  Node* const deferred_on_reject =
-      LoadObjectField(promise, JSPromise::kDeferredOnRejectOffset);
+void PromiseBuiltinsAssembler::BranchIfPromiseSpeciesLookupChainIntact(
+    Node* native_context, Node* promise_map, Label* if_fast, Label* if_slow) {
+  CSA_ASSERT(this, IsNativeContext(native_context));
+  CSA_ASSERT(this, IsJSPromiseMap(promise_map));
 
-  Node* const info = AllocatePromiseReactionJobInfo(
-      result, tasks, deferred_promise, deferred_on_resolve, deferred_on_reject,
-      context);
+  Node* const promise_prototype =
+      LoadContextElement(native_context, Context::PROMISE_PROTOTYPE_INDEX);
+  GotoIfForceSlowPath(if_slow);
+  GotoIfNot(WordEqual(LoadMapPrototype(promise_map), promise_prototype),
+            if_slow);
+  Branch(IsSpeciesProtectorCellInvalid(), if_slow, if_fast);
+}
 
-  CallBuiltin(Builtins::kEnqueueMicrotask, NoContextConstant(), info);
-  Goto(&do_promisereset);
+void PromiseBuiltinsAssembler::BranchIfPromiseThenLookupChainIntact(
+    Node* native_context, Node* receiver_map, Label* if_fast, Label* if_slow) {
+  CSA_ASSERT(this, IsMap(receiver_map));
+  CSA_ASSERT(this, IsNativeContext(native_context));
 
-  BIND(&do_promisereset);
-  {
-    PromiseSetStatus(promise, status);
-    StoreObjectField(promise, JSPromise::kResultOffset, result);
-    StoreObjectFieldRoot(promise, JSPromise::kDeferredPromiseOffset,
-                         Heap::kUndefinedValueRootIndex);
-    StoreObjectFieldRoot(promise, JSPromise::kDeferredOnResolveOffset,
-                         Heap::kUndefinedValueRootIndex);
-    StoreObjectFieldRoot(promise, JSPromise::kDeferredOnRejectOffset,
-                         Heap::kUndefinedValueRootIndex);
-    StoreObjectFieldRoot(promise, JSPromise::kFulfillReactionsOffset,
-                         Heap::kUndefinedValueRootIndex);
-    StoreObjectFieldRoot(promise, JSPromise::kRejectReactionsOffset,
-                         Heap::kUndefinedValueRootIndex);
-  }
+  GotoIfForceSlowPath(if_slow);
+  GotoIfNot(IsJSPromiseMap(receiver_map), if_slow);
+  Node* const promise_prototype =
+      LoadContextElement(native_context, Context::PROMISE_PROTOTYPE_INDEX);
+  GotoIfNot(WordEqual(LoadMapPrototype(receiver_map), promise_prototype),
+            if_slow);
+  Branch(IsPromiseThenProtectorCellInvalid(), if_slow, if_fast);
 }
 
 void PromiseBuiltinsAssembler::BranchIfAccessCheckFailed(
@@ -878,43 +697,6 @@ void PromiseBuiltinsAssembler::BranchIfAccessCheckFailed(
   BIND(&has_access);
 }
 
-void PromiseBuiltinsAssembler::InternalPromiseReject(Node* context,
-                                                     Node* promise, Node* value,
-                                                     Node* debug_event) {
-  Label out(this);
-  GotoIfNot(IsDebugActive(), &out);
-  GotoIfNot(WordEqual(TrueConstant(), debug_event), &out);
-  CallRuntime(Runtime::kDebugPromiseReject, context, promise, value);
-  Goto(&out);
-
-  BIND(&out);
-  InternalPromiseReject(context, promise, value, false);
-}
-
-// This duplicates a lot of logic from PromiseRejectEvent in
-// runtime-promise.cc
-void PromiseBuiltinsAssembler::InternalPromiseReject(Node* context,
-                                                     Node* promise, Node* value,
-                                                     bool debug_event) {
-  Label fulfill(this), exit(this);
-
-  GotoIfNot(IsPromiseHookEnabledOrDebugIsActive(), &fulfill);
-  if (debug_event) {
-    CallRuntime(Runtime::kDebugPromiseReject, context, promise, value);
-  }
-  CallRuntime(Runtime::kPromiseHookResolve, context, promise);
-  Goto(&fulfill);
-
-  BIND(&fulfill);
-  PromiseFulfill(context, promise, value, v8::Promise::kRejected);
-
-  GotoIf(PromiseHasHandler(promise), &exit);
-  CallRuntime(Runtime::kReportPromiseReject, context, promise, value);
-  Goto(&exit);
-
-  BIND(&exit);
-}
-
 void PromiseBuiltinsAssembler::SetForwardingHandlerIfTrue(
     Node* context, Node* condition, const NodeGenerator& object) {
   Label done(this);
@@ -940,40 +722,52 @@ void PromiseBuiltinsAssembler::SetPromiseHandledByIfTrue(
   BIND(&done);
 }
 
-void PromiseBuiltinsAssembler::PerformFulfillClosure(Node* context, Node* value,
-                                                     bool should_resolve) {
-  Label out(this);
+// ES #sec-promise-reject-functions
+TF_BUILTIN(PromiseCapabilityDefaultReject, PromiseBuiltinsAssembler) {
+  Node* const reason = Parameter(Descriptor::kReason);
+  Node* const context = Parameter(Descriptor::kContext);
 
   // 2. Let promise be F.[[Promise]].
-  Node* const promise_slot = IntPtrConstant(kPromiseSlot);
-  Node* const promise = LoadContextElement(context, promise_slot);
+  Node* const promise = LoadContextElement(context, kPromiseSlot);
 
-  // We use `undefined` as a marker to know that this callback was
-  // already called.
-  GotoIf(IsUndefined(promise), &out);
+  // 3. Let alreadyResolved be F.[[AlreadyResolved]].
+  // 4. If alreadyResolved.[[Value]] is true, return undefined.
+  // We use undefined as a marker for the [[AlreadyResolved]] state.
+  ReturnIf(IsUndefined(promise), UndefinedConstant());
 
-  if (should_resolve) {
-    InternalResolvePromise(context, promise, value);
-  } else {
-    Node* const debug_event =
-        LoadContextElement(context, IntPtrConstant(kDebugEventSlot));
-    InternalPromiseReject(context, promise, value, debug_event);
-  }
+  // 5. Set alreadyResolved.[[Value]] to true.
+  StoreContextElementNoWriteBarrier(context, kPromiseSlot, UndefinedConstant());
 
-  StoreContextElement(context, promise_slot, UndefinedConstant());
-  Goto(&out);
-
-  BIND(&out);
+  // 6. Return RejectPromise(promise, reason).
+  Node* const debug_event = LoadContextElement(context, kDebugEventSlot);
+  Return(CallBuiltin(Builtins::kRejectPromise, context, promise, reason,
+                     debug_event));
 }
 
-// ES#sec-promise-reject-functions
-// Promise Reject Functions
-TF_BUILTIN(PromiseRejectClosure, PromiseBuiltinsAssembler) {
-  Node* const value = Parameter(Descriptor::kValue);
+// ES #sec-promise-resolve-functions
+TF_BUILTIN(PromiseCapabilityDefaultResolve, PromiseBuiltinsAssembler) {
+  Node* const resolution = Parameter(Descriptor::kResolution);
   Node* const context = Parameter(Descriptor::kContext);
 
-  PerformFulfillClosure(context, value, false);
-  Return(UndefinedConstant());
+  // 2. Let promise be F.[[Promise]].
+  Node* const promise = LoadContextElement(context, kPromiseSlot);
+
+  // 3. Let alreadyResolved be F.[[AlreadyResolved]].
+  // 4. If alreadyResolved.[[Value]] is true, return undefined.
+  // We use undefined as a marker for the [[AlreadyResolved]] state.
+  ReturnIf(IsUndefined(promise), UndefinedConstant());
+
+  // 5. Set alreadyResolved.[[Value]] to true.
+  StoreContextElementNoWriteBarrier(context, kPromiseSlot, UndefinedConstant());
+
+  // The rest of the logic (and the catch prediction) is
+  // encapsulated in the dedicated ResolvePromise builtin.
+  Return(CallBuiltin(Builtins::kResolvePromise, context, promise, resolution));
+}
+
+TF_BUILTIN(PromiseConstructorLazyDeoptContinuation, PromiseBuiltinsAssembler) {
+  Node* promise = Parameter(Descriptor::kPromise);
+  Return(promise);
 }
 
 // ES6 #sec-promise-executor
@@ -1089,231 +883,357 @@ TF_BUILTIN(PromiseConstructor, PromiseBuiltinsAssembler) {
   }
 }
 
+// V8 Extras: v8.createPromise(parent)
 TF_BUILTIN(PromiseInternalConstructor, PromiseBuiltinsAssembler) {
   Node* const parent = Parameter(Descriptor::kParent);
   Node* const context = Parameter(Descriptor::kContext);
   Return(AllocateAndInitJSPromise(context, parent));
 }
 
+// V8 Extras: v8.rejectPromise(promise, reason)
+TF_BUILTIN(PromiseInternalReject, PromiseBuiltinsAssembler) {
+  Node* const promise = Parameter(Descriptor::kPromise);
+  Node* const reason = Parameter(Descriptor::kReason);
+  Node* const context = Parameter(Descriptor::kContext);
+  // We pass true to trigger the debugger's on exception handler.
+  Return(CallBuiltin(Builtins::kRejectPromise, context, promise, reason,
+                     TrueConstant()));
+}
+
+// V8 Extras: v8.resolvePromise(promise, resolution)
+TF_BUILTIN(PromiseInternalResolve, PromiseBuiltinsAssembler) {
+  Node* const promise = Parameter(Descriptor::kPromise);
+  Node* const resolution = Parameter(Descriptor::kResolution);
+  Node* const context = Parameter(Descriptor::kContext);
+  Return(CallBuiltin(Builtins::kResolvePromise, context, promise, resolution));
+}
+
 // ES#sec-promise.prototype.then
 // Promise.prototype.then ( onFulfilled, onRejected )
 TF_BUILTIN(PromisePrototypeThen, PromiseBuiltinsAssembler) {
   // 1. Let promise be the this value.
   Node* const promise = Parameter(Descriptor::kReceiver);
-  Node* const on_resolve = Parameter(Descriptor::kOnFullfilled);
-  Node* const on_reject = Parameter(Descriptor::kOnRejected);
+  Node* const on_fulfilled = Parameter(Descriptor::kOnFulfilled);
+  Node* const on_rejected = Parameter(Descriptor::kOnRejected);
   Node* const context = Parameter(Descriptor::kContext);
 
-  Node* const result =
-      InternalPromiseThen(context, promise, on_resolve, on_reject);
-  Return(result);
-}
+  // 2. If IsPromise(promise) is false, throw a TypeError exception.
+  ThrowIfNotInstanceType(context, promise, JS_PROMISE_TYPE,
+                         "Promise.prototype.then");
 
-// ES#sec-promise-resolve-functions
-// Promise Resolve Functions
-TF_BUILTIN(PromiseResolveClosure, PromiseBuiltinsAssembler) {
-  Node* const value = Parameter(Descriptor::kValue);
-  Node* const context = Parameter(Descriptor::kContext);
+  // 3. Let C be ? SpeciesConstructor(promise, %Promise%).
+  Label fast_promise_capability(this), slow_constructor(this, Label::kDeferred),
+      slow_promise_capability(this, Label::kDeferred);
+  Node* const native_context = LoadNativeContext(context);
+  Node* const promise_fun =
+      LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
+  Node* const promise_map = LoadMap(promise);
+  BranchIfPromiseSpeciesLookupChainIntact(
+      native_context, promise_map, &fast_promise_capability, &slow_constructor);
 
-  PerformFulfillClosure(context, value, true);
-  Return(UndefinedConstant());
+  BIND(&slow_constructor);
+  Node* const constructor =
+      SpeciesConstructor(native_context, promise, promise_fun);
+  Branch(WordEqual(constructor, promise_fun), &fast_promise_capability,
+         &slow_promise_capability);
+
+  // 4. Let resultCapability be ? NewPromiseCapability(C).
+  Label perform_promise_then(this);
+  VARIABLE(var_result_promise, MachineRepresentation::kTagged);
+  VARIABLE(var_result_promise_or_capability, MachineRepresentation::kTagged);
+
+  BIND(&fast_promise_capability);
+  {
+    Node* const result_promise = AllocateAndInitJSPromise(context, promise);
+    var_result_promise_or_capability.Bind(result_promise);
+    var_result_promise.Bind(result_promise);
+    Goto(&perform_promise_then);
+  }
+
+  BIND(&slow_promise_capability);
+  {
+    Node* const debug_event = TrueConstant();
+    Node* const capability = CallBuiltin(Builtins::kNewPromiseCapability,
+                                         context, constructor, debug_event);
+    var_result_promise.Bind(
+        LoadObjectField(capability, PromiseCapability::kPromiseOffset));
+    var_result_promise_or_capability.Bind(capability);
+    Goto(&perform_promise_then);
+  }
+
+  // 5. Return PerformPromiseThen(promise, onFulfilled, onRejected,
+  //    resultCapability).
+  BIND(&perform_promise_then);
+  {
+    // We do some work of the PerformPromiseThen operation here, in that
+    // we check the handlers and turn non-callable handlers into undefined.
+    // This is because this is the one and only callsite of PerformPromiseThen
+    // that has to do this.
+
+    // 3. If IsCallable(onFulfilled) is false, then
+    //    a. Set onFulfilled to undefined.
+    VARIABLE(var_on_fulfilled, MachineRepresentation::kTagged, on_fulfilled);
+    Label if_fulfilled_done(this), if_fulfilled_notcallable(this);
+    GotoIf(TaggedIsSmi(on_fulfilled), &if_fulfilled_notcallable);
+    Branch(IsCallable(on_fulfilled), &if_fulfilled_done,
+           &if_fulfilled_notcallable);
+    BIND(&if_fulfilled_notcallable);
+    var_on_fulfilled.Bind(UndefinedConstant());
+    Goto(&if_fulfilled_done);
+    BIND(&if_fulfilled_done);
+
+    // 4. If IsCallable(onRejected) is false, then
+    //    a. Set onRejected to undefined.
+    VARIABLE(var_on_rejected, MachineRepresentation::kTagged, on_rejected);
+    Label if_rejected_done(this), if_rejected_notcallable(this);
+    GotoIf(TaggedIsSmi(on_rejected), &if_rejected_notcallable);
+    Branch(IsCallable(on_rejected), &if_rejected_done,
+           &if_rejected_notcallable);
+    BIND(&if_rejected_notcallable);
+    var_on_rejected.Bind(UndefinedConstant());
+    Goto(&if_rejected_done);
+    BIND(&if_rejected_done);
+
+    PerformPromiseThen(context, promise, var_on_fulfilled.value(),
+                       var_on_rejected.value(),
+                       var_result_promise_or_capability.value());
+    Return(var_result_promise.value());
+  }
 }
 
-// ES #sec-fulfillpromise
-TF_BUILTIN(ResolvePromise, PromiseBuiltinsAssembler) {
-  Node* const promise = Parameter(Descriptor::kPromise);
-  Node* const result = Parameter(Descriptor::kValue);
+// ES#sec-promise.prototype.catch
+// Promise.prototype.catch ( onRejected )
+TF_BUILTIN(PromisePrototypeCatch, PromiseBuiltinsAssembler) {
+  // 1. Let promise be the this value.
+  Node* const receiver = Parameter(Descriptor::kReceiver);
+  Node* const on_fulfilled = UndefinedConstant();
+  Node* const on_rejected = Parameter(Descriptor::kOnRejected);
   Node* const context = Parameter(Descriptor::kContext);
 
-  InternalResolvePromise(context, promise, result);
-  Return(UndefinedConstant());
+  // 2. Return ? Invoke(promise, "then", « undefined, onRejected »).
+  Node* const native_context = LoadNativeContext(context);
+  Return(InvokeThen(native_context, receiver, on_fulfilled, on_rejected));
 }
 
-TF_BUILTIN(PromiseHandleReject, PromiseBuiltinsAssembler) {
-  Node* const promise = Parameter(Descriptor::kPromise);
-  Node* const on_reject = Parameter(Descriptor::kOnReject);
-  Node* const exception = Parameter(Descriptor::kException);
-  Node* const context = Parameter(Descriptor::kContext);
-
-  VARIABLE(var_unused, MachineRepresentation::kTagged);
+// ES #sec-promiseresolvethenablejob
+TF_BUILTIN(PromiseResolveThenableJob, PromiseBuiltinsAssembler) {
+  Node* const native_context = Parameter(Descriptor::kContext);
+  Node* const promise_to_resolve = Parameter(Descriptor::kPromiseToResolve);
+  Node* const thenable = Parameter(Descriptor::kThenable);
+  Node* const then = Parameter(Descriptor::kThen);
 
-  Label if_internalhandler(this), if_customhandler(this, Label::kDeferred);
-  Branch(IsUndefined(on_reject), &if_internalhandler, &if_customhandler);
+  CSA_ASSERT(this, TaggedIsNotSmi(thenable));
+  CSA_ASSERT(this, IsJSReceiver(thenable));
+  CSA_ASSERT(this, IsJSPromise(promise_to_resolve));
+  CSA_ASSERT(this, IsNativeContext(native_context));
 
-  BIND(&if_internalhandler);
+  // We can use a simple optimization here if we know that {then} is the initial
+  // Promise.prototype.then method, and {thenable} is a JSPromise whose
+  // @@species lookup chain is intact: We can connect {thenable} and
+  // {promise_to_resolve} directly in that case and avoid the allocation of a
+  // temporary JSPromise and the closures plus context.
+  //
+  // We take the generic (slow-)path if a PromiseHook is enabled or the debugger
+  // is active, to make sure we expose spec compliant behavior.
+  Label if_fast(this), if_slow(this, Label::kDeferred);
+  Node* const promise_then =
+      LoadContextElement(native_context, Context::PROMISE_THEN_INDEX);
+  GotoIfNot(WordEqual(then, promise_then), &if_slow);
+  Node* const thenable_map = LoadMap(thenable);
+  GotoIfNot(IsJSPromiseMap(thenable_map), &if_slow);
+  GotoIf(IsPromiseHookEnabledOrDebugIsActive(), &if_slow);
+  BranchIfPromiseSpeciesLookupChainIntact(native_context, thenable_map,
+                                          &if_fast, &if_slow);
+
+  BIND(&if_fast);
   {
-    InternalPromiseReject(context, promise, exception, false);
-    Return(UndefinedConstant());
+    // We know that the {thenable} is a JSPromise, which doesn't require
+    // any special treatment and that {then} corresponds to the initial
+    // Promise.prototype.then method. So instead of allocating a temporary
+    // JSPromise to connect the {thenable} with the {promise_to_resolve},
+    // we can directly schedule the {promise_to_resolve} with default
+    // handlers onto the {thenable} promise. This does not only save the
+    // JSPromise allocation, but also avoids the allocation of the two
+    // resolving closures and the shared context.
+    //
+    // What happens normally in this case is
+    //
+    //   resolve, reject = CreateResolvingFunctions(promise_to_resolve)
+    //   result_capability = NewPromiseCapability(%Promise%)
+    //   PerformPromiseThen(thenable, resolve, reject, result_capability)
+    //
+    // which means that PerformPromiseThen will either schedule a new
+    // PromiseReaction with resolve and reject or a PromiseReactionJob
+    // with resolve or reject based on the state of {thenable}. And
+    // resolve or reject will just invoke the default [[Resolve]] or
+    // [[Reject]] functions on the {promise_to_resolve}.
+    //
+    // This is the same as just doing
+    //
+    //   PerformPromiseThen(thenable, undefined, undefined, promise_to_resolve)
+    //
+    // which performs exactly the same (observable) steps.
+    TailCallBuiltin(Builtins::kPerformPromiseThen, native_context, thenable,
+                    UndefinedConstant(), UndefinedConstant(),
+                    promise_to_resolve);
   }
 
-  BIND(&if_customhandler);
+  BIND(&if_slow);
   {
+    Node* resolve = nullptr;
+    Node* reject = nullptr;
+    std::tie(resolve, reject) = CreatePromiseResolvingFunctions(
+        promise_to_resolve, FalseConstant(), native_context);
+
+    Label if_exception(this, Label::kDeferred);
     VARIABLE(var_exception, MachineRepresentation::kTagged, TheHoleConstant());
-    Label if_exception(this);
-    Node* const ret = CallJS(
-        CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-        context, on_reject, UndefinedConstant(), exception);
-    GotoIfException(ret, &if_exception, &var_exception);
-    Return(UndefinedConstant());
+    Node* const result = CallJS(
+        CodeFactory::Call(isolate(), ConvertReceiverMode::kNotNullOrUndefined),
+        native_context, then, thenable, resolve, reject);
+    GotoIfException(result, &if_exception, &var_exception);
+    Return(result);
+
     BIND(&if_exception);
-    CallRuntime(Runtime::kReportMessage, context, var_exception.value());
-    Return(UndefinedConstant());
+    {
+      // We need to reject the {thenable}.
+      Node* const result = CallJS(
+          CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
+          native_context, UndefinedConstant(), var_exception.value());
+      Return(result);
+    }
   }
 }
 
-TF_BUILTIN(PromiseHandle, PromiseBuiltinsAssembler) {
-  Node* const value = Parameter(Descriptor::kValue);
-  Node* const handler = Parameter(Descriptor::kHandler);
-  Node* const deferred_promise = Parameter(Descriptor::kDeferredPromise);
-  Node* const deferred_on_resolve = Parameter(Descriptor::kDeferredOnResolve);
-  Node* const deferred_on_reject = Parameter(Descriptor::kDeferredOnReject);
-  Node* const context = Parameter(Descriptor::kContext);
-  Isolate* isolate = this->isolate();
-
-  VARIABLE(var_reason, MachineRepresentation::kTagged);
+// ES #sec-promisereactionjob
+void PromiseBuiltinsAssembler::PromiseReactionJob(Node* context, Node* argument,
+                                                  Node* handler, Node* payload,
+                                                  PromiseReaction::Type type) {
+  CSA_ASSERT(this, TaggedIsNotSmi(handler));
+  CSA_ASSERT(this, Word32Or(IsCallable(handler),
+                            Word32Or(IsCode(handler), IsUndefined(handler))));
+  CSA_ASSERT(this, TaggedIsNotSmi(payload));
 
-  Node* const is_debug_active = IsDebugActive();
-  Label run_handler(this), if_rejectpromise(this), promisehook_before(this),
-      promisehook_after(this), debug_pop(this);
+  VARIABLE(var_handler_result, MachineRepresentation::kTagged, argument);
+  Label if_handler_callable(this), if_fulfill(this), if_reject(this),
+      if_code_handler(this);
 
-  GotoIfNot(is_debug_active, &promisehook_before);
-  CallRuntime(Runtime::kDebugPushPromise, context, deferred_promise);
-  Goto(&promisehook_before);
+  GotoIf(IsUndefined(handler),
+         type == PromiseReaction::kFulfill ? &if_fulfill : &if_reject);
+  Branch(IsCode(handler), &if_code_handler, &if_handler_callable);
 
-  BIND(&promisehook_before);
+  BIND(&if_code_handler);
   {
-    GotoIfNot(IsPromiseHookEnabledOrDebugIsActive(), &run_handler);
-    CallRuntime(Runtime::kPromiseHookBefore, context, deferred_promise);
-    Goto(&run_handler);
+    // The {handler} is a Code object that knows how to deal with
+    // the {payload} and the {argument}.
+    PromiseReactionHandlerDescriptor descriptor(isolate());
+    TailCallStub(descriptor, handler, context, argument, payload);
   }
 
-  BIND(&run_handler);
+  BIND(&if_handler_callable);
   {
-    Label if_defaulthandler(this), if_callablehandler(this),
-        if_internalhandler(this), if_customhandler(this, Label::kDeferred);
-    VARIABLE(var_result, MachineRepresentation::kTagged);
+    Node* const result = CallJS(
+        CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
+        context, handler, UndefinedConstant(), argument);
+    GotoIfException(result, &if_reject, &var_handler_result);
+    var_handler_result.Bind(result);
+    Goto(&if_fulfill);
+  }
 
-    Branch(IsSymbol(handler), &if_defaulthandler, &if_callablehandler);
+  BIND(&if_fulfill);
+  {
+    Label if_promise(this), if_promise_capability(this, Label::kDeferred);
+    Node* const value = var_handler_result.value();
+    Branch(IsPromiseCapability(payload), &if_promise_capability, &if_promise);
 
-    BIND(&if_defaulthandler);
+    BIND(&if_promise);
     {
-      Label if_resolve(this), if_reject(this);
-      Branch(IsPromiseDefaultResolveHandlerSymbol(handler), &if_resolve,
-             &if_reject);
-
-      BIND(&if_resolve);
-      {
-        var_result.Bind(value);
-        Branch(IsUndefined(deferred_on_resolve), &if_internalhandler,
-               &if_customhandler);
-      }
-
-      BIND(&if_reject);
-      {
-        var_reason.Bind(value);
-        Goto(&if_rejectpromise);
-      }
+      // For fast native promises we can skip the indirection
+      // via the promiseCapability.[[Resolve]] function and
+      // run the resolve logic directly from here.
+      TailCallBuiltin(Builtins::kResolvePromise, context, payload, value);
     }
 
-    BIND(&if_callablehandler);
+    BIND(&if_promise_capability);
     {
+      // In the general case we need to call the (user provided)
+      // promiseCapability.[[Resolve]] function.
+      Node* const resolve =
+          LoadObjectField(payload, PromiseCapability::kResolveOffset);
       Node* const result = CallJS(
-          CodeFactory::Call(isolate, ConvertReceiverMode::kNullOrUndefined),
-          context, handler, UndefinedConstant(), value);
-      var_result.Bind(result);
-      GotoIfException(result, &if_rejectpromise, &var_reason);
-      Branch(IsUndefined(deferred_on_resolve), &if_internalhandler,
-             &if_customhandler);
+          CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
+          context, resolve, UndefinedConstant(), value);
+      GotoIfException(result, &if_reject, &var_handler_result);
+      Return(result);
     }
+  }
 
-    BIND(&if_internalhandler);
-    InternalResolvePromise(context, deferred_promise, var_result.value());
-    Goto(&promisehook_after);
+  BIND(&if_reject);
+  if (type == PromiseReaction::kReject) {
+    Label if_promise(this), if_promise_capability(this, Label::kDeferred);
+    Node* const reason = var_handler_result.value();
+    Branch(IsPromiseCapability(payload), &if_promise_capability, &if_promise);
 
-    BIND(&if_customhandler);
+    BIND(&if_promise);
     {
-      Node* const maybe_exception = CallJS(
-          CodeFactory::Call(isolate, ConvertReceiverMode::kNullOrUndefined),
-          context, deferred_on_resolve, UndefinedConstant(),
-          var_result.value());
-      GotoIfException(maybe_exception, &if_rejectpromise, &var_reason);
-      Goto(&promisehook_after);
+      // For fast native promises we can skip the indirection
+      // via the promiseCapability.[[Reject]] function and
+      // run the resolve logic directly from here.
+      TailCallBuiltin(Builtins::kRejectPromise, context, payload, reason,
+                      FalseConstant());
     }
-  }
-
-  BIND(&if_rejectpromise);
-  {
-    CallBuiltin(Builtins::kPromiseHandleReject, context, deferred_promise,
-                deferred_on_reject, var_reason.value());
-    Goto(&promisehook_after);
-  }
 
-  BIND(&promisehook_after);
-  {
-    GotoIfNot(IsPromiseHookEnabledOrDebugIsActive(), &debug_pop);
-    CallRuntime(Runtime::kPromiseHookAfter, context, deferred_promise);
-    Goto(&debug_pop);
-  }
-
-  BIND(&debug_pop);
-  {
-    Label out(this);
-
-    GotoIfNot(is_debug_active, &out);
-    CallRuntime(Runtime::kDebugPopPromise, context);
-    Goto(&out);
+    BIND(&if_promise_capability);
+    {
+      // In the general case we need to call the (user provided)
+      // promiseCapability.[[Reject]] function.
+      Label if_exception(this, Label::kDeferred);
+      VARIABLE(var_exception, MachineRepresentation::kTagged,
+               TheHoleConstant());
+      Node* const reject =
+          LoadObjectField(payload, PromiseCapability::kRejectOffset);
+      Node* const result = CallJS(
+          CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
+          context, reject, UndefinedConstant(), reason);
+      GotoIfException(result, &if_exception, &var_exception);
+      Return(result);
 
-    BIND(&out);
-    Return(UndefinedConstant());
+      // Swallow the exception here.
+      BIND(&if_exception);
+      TailCallRuntime(Runtime::kReportMessage, context, var_exception.value());
+    }
+  } else {
+    // We have to call out to the dedicated PromiseRejectReactionJob builtin
+    // here, instead of just doing the work inline, as otherwise the catch
+    // predictions in the debugger will be wrong, which just walks the stack
+    // and checks for certain builtins.
+    TailCallBuiltin(Builtins::kPromiseRejectReactionJob, context,
+                    var_handler_result.value(), UndefinedConstant(), payload);
   }
 }
 
-TF_BUILTIN(PromiseHandleJS, PromiseBuiltinsAssembler) {
+// ES #sec-promisereactionjob
+TF_BUILTIN(PromiseFulfillReactionJob, PromiseBuiltinsAssembler) {
+  Node* const context = Parameter(Descriptor::kContext);
   Node* const value = Parameter(Descriptor::kValue);
   Node* const handler = Parameter(Descriptor::kHandler);
-  Node* const deferred_promise = Parameter(Descriptor::kDeferredPromise);
-  Node* const deferred_on_resolve = Parameter(Descriptor::kDeferredOnResolve);
-  Node* const deferred_on_reject = Parameter(Descriptor::kDeferredOnReject);
-  Node* const context = Parameter(Descriptor::kContext);
+  Node* const payload = Parameter(Descriptor::kPayload);
 
-  Node* const result =
-      CallBuiltin(Builtins::kPromiseHandle, context, value, handler,
-                  deferred_promise, deferred_on_resolve, deferred_on_reject);
-  Return(result);
+  PromiseReactionJob(context, value, handler, payload,
+                     PromiseReaction::kFulfill);
 }
 
-// ES#sec-promise.prototype.catch
-// Promise.prototype.catch ( onRejected )
-TF_BUILTIN(PromisePrototypeCatch, PromiseBuiltinsAssembler) {
-  // 1. Let promise be the this value.
-  Node* const promise = Parameter(Descriptor::kReceiver);
-  Node* const on_resolve = UndefinedConstant();
-  Node* const on_reject = Parameter(Descriptor::kOnRejected);
+// ES #sec-promisereactionjob
+TF_BUILTIN(PromiseRejectReactionJob, PromiseBuiltinsAssembler) {
   Node* const context = Parameter(Descriptor::kContext);
+  Node* const reason = Parameter(Descriptor::kReason);
+  Node* const handler = Parameter(Descriptor::kHandler);
+  Node* const payload = Parameter(Descriptor::kPayload);
 
-  Label if_internalthen(this), if_customthen(this, Label::kDeferred);
-  GotoIf(TaggedIsSmi(promise), &if_customthen);
-  BranchIfFastPath(context, promise, &if_internalthen, &if_customthen);
-
-  BIND(&if_internalthen);
-  {
-    Node* const result =
-        InternalPromiseThen(context, promise, on_resolve, on_reject);
-    Return(result);
-  }
-
-  BIND(&if_customthen);
-  {
-    Node* const then =
-        GetProperty(context, promise, isolate()->factory()->then_string());
-    Node* const result = CallJS(
-        CodeFactory::Call(isolate(), ConvertReceiverMode::kNotNullOrUndefined),
-        context, then, promise, on_resolve, on_reject);
-    Return(result);
-  }
+  PromiseReactionJob(context, reason, handler, payload,
+                     PromiseReaction::kReject);
 }
 
-TF_BUILTIN(PromiseResolveWrapper, PromiseBuiltinsAssembler) {
+TF_BUILTIN(PromiseResolveTrampoline, PromiseBuiltinsAssembler) {
   //  1. Let C be the this value.
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* value = Parameter(Descriptor::kValue);
@@ -1331,51 +1251,49 @@ TF_BUILTIN(PromiseResolve, PromiseBuiltinsAssembler) {
   Node* constructor = Parameter(Descriptor::kConstructor);
   Node* value = Parameter(Descriptor::kValue);
   Node* context = Parameter(Descriptor::kContext);
-  Isolate* isolate = this->isolate();
+
+  CSA_ASSERT(this, IsJSReceiver(constructor));
 
   Node* const native_context = LoadNativeContext(context);
   Node* const promise_fun =
       LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
 
-  Label if_value_is_native_promise(this),
-      if_value_or_constructor_are_not_native_promise(this),
-      if_need_to_allocate(this);
+  Label if_slow_constructor(this, Label::kDeferred), if_need_to_allocate(this);
 
+  // Check if {value} is a JSPromise.
   GotoIf(TaggedIsSmi(value), &if_need_to_allocate);
-
-  // This shortcircuits the constructor lookups.
-  GotoIfNot(HasInstanceType(value, JS_PROMISE_TYPE), &if_need_to_allocate);
-
-  // This adds a fast path as non-subclassed native promises don't have
-  // an observable constructor lookup.
-  BranchIfFastPath(native_context, promise_fun, value,
-                   &if_value_is_native_promise,
-                   &if_value_or_constructor_are_not_native_promise);
-
-  BIND(&if_value_is_native_promise);
-  {
-    GotoIfNot(WordEqual(promise_fun, constructor),
-              &if_value_or_constructor_are_not_native_promise);
-    Return(value);
-  }
+  Node* const value_map = LoadMap(value);
+  GotoIfNot(IsJSPromiseMap(value_map), &if_need_to_allocate);
+
+  // We can skip the "constructor" lookup on {value} if it's [[Prototype]]
+  // is the (initial) Promise.prototype and the @@species protector is
+  // intact, as that guards the lookup path for "constructor" on
+  // JSPromise instances which have the (initial) Promise.prototype.
+  Node* const promise_prototype =
+      LoadContextElement(native_context, Context::PROMISE_PROTOTYPE_INDEX);
+  GotoIfNot(WordEqual(LoadMapPrototype(value_map), promise_prototype),
+            &if_slow_constructor);
+  GotoIf(IsSpeciesProtectorCellInvalid(), &if_slow_constructor);
+
+  // If the {constructor} is the Promise function, we just immediately
+  // return the {value} here and don't bother wrapping it into a
+  // native Promise.
+  GotoIfNot(WordEqual(promise_fun, constructor), &if_slow_constructor);
+  Return(value);
 
   // At this point, value or/and constructor are not native promises, but
   // they could be of the same subclass.
-  BIND(&if_value_or_constructor_are_not_native_promise);
+  BIND(&if_slow_constructor);
   {
-    Label if_return(this);
-    Node* const xConstructor =
-        GetProperty(context, value, isolate->factory()->constructor_string());
-    BranchIfSameValue(xConstructor, constructor, &if_return,
-                      &if_need_to_allocate);
-
-    BIND(&if_return);
+    Node* const value_constructor =
+        GetProperty(context, value, isolate()->factory()->constructor_string());
+    GotoIfNot(WordEqual(value_constructor, constructor), &if_need_to_allocate);
     Return(value);
   }
 
   BIND(&if_need_to_allocate);
   {
-    Label if_nativepromise(this), if_notnativepromise(this);
+    Label if_nativepromise(this), if_notnativepromise(this, Label::kDeferred);
     Branch(WordEqual(promise_fun, constructor), &if_nativepromise,
            &if_notnativepromise);
 
@@ -1384,18 +1302,21 @@ TF_BUILTIN(PromiseResolve, PromiseBuiltinsAssembler) {
     BIND(&if_nativepromise);
     {
       Node* const result = AllocateAndInitJSPromise(context);
-      InternalResolvePromise(context, result, value);
+      CallBuiltin(Builtins::kResolvePromise, context, result, value);
       Return(result);
     }
 
     BIND(&if_notnativepromise);
     {
-      Node* const capability = NewPromiseCapability(context, constructor);
+      Node* const debug_event = TrueConstant();
+      Node* const capability = CallBuiltin(Builtins::kNewPromiseCapability,
+                                           context, constructor, debug_event);
 
       Node* const resolve =
           LoadObjectField(capability, PromiseCapability::kResolveOffset);
-      CallJS(CodeFactory::Call(isolate, ConvertReceiverMode::kNullOrUndefined),
-             context, resolve, UndefinedConstant(), value);
+      CallJS(
+          CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
+          context, resolve, UndefinedConstant(), value);
 
       Node* const result =
           LoadObjectField(capability, PromiseCapability::kPromiseOffset);
@@ -1429,17 +1350,6 @@ TF_BUILTIN(PromiseGetCapabilitiesExecutor, PromiseBuiltinsAssembler) {
   ThrowTypeError(context, MessageTemplate::kPromiseExecutorAlreadyInvoked);
 }
 
-// ES6 #sec-newpromisecapability
-TF_BUILTIN(NewPromiseCapability, PromiseBuiltinsAssembler) {
-  Node* constructor = Parameter(Descriptor::kConstructor);
-  Node* debug_event = Parameter(Descriptor::kDebugEvent);
-  Node* context = Parameter(Descriptor::kContext);
-
-  CSA_ASSERT_JS_ARGC_EQ(this, 2);
-
-  Return(NewPromiseCapability(context, constructor, debug_event));
-}
-
 TF_BUILTIN(PromiseReject, PromiseBuiltinsAssembler) {
   // 1. Let C be the this value.
   Node* const receiver = Parameter(Descriptor::kReceiver);
@@ -1470,7 +1380,9 @@ TF_BUILTIN(PromiseReject, PromiseBuiltinsAssembler) {
   BIND(&if_custompromise);
   {
     // 3. Let promiseCapability be ? NewPromiseCapability(C).
-    Node* const capability = NewPromiseCapability(context, receiver);
+    Node* const debug_event = TrueConstant();
+    Node* const capability = CallBuiltin(Builtins::kNewPromiseCapability,
+                                         context, receiver, debug_event);
 
     // 4. Perform ? Call(promiseCapability.[[Reject]], undefined, « r »).
     Node* const reject =
@@ -1485,16 +1397,6 @@ TF_BUILTIN(PromiseReject, PromiseBuiltinsAssembler) {
   }
 }
 
-TF_BUILTIN(InternalPromiseReject, PromiseBuiltinsAssembler) {
-  Node* const promise = Parameter(Descriptor::kPromise);
-  Node* const reason = Parameter(Descriptor::kReason);
-  Node* const debug_event = Parameter(Descriptor::kDebugEvent);
-  Node* const context = Parameter(Descriptor::kContext);
-
-  InternalPromiseReject(context, promise, reason, debug_event);
-  Return(UndefinedConstant());
-}
-
 std::pair<Node*, Node*> PromiseBuiltinsAssembler::CreatePromiseFinallyFunctions(
     Node* on_finally, Node* constructor, Node* native_context) {
   Node* const promise_context =
@@ -1565,16 +1467,11 @@ TF_BUILTIN(PromiseThenFinally, PromiseBuiltinsAssembler) {
     CallBuiltin(Builtins::kPromiseResolve, context, constructor, result);
 
   // 7. Let valueThunk be equivalent to a function that returns value.
-  Node* native_context = LoadNativeContext(context);
+  Node* const native_context = LoadNativeContext(context);
   Node* const value_thunk = CreateValueThunkFunction(value, native_context);
 
   // 8. Return ? Invoke(promise, "then", « valueThunk »).
-  Node* const promise_then =
-    GetProperty(context, promise, factory()->then_string());
-  Node* const result_promise = CallJS(
-      CodeFactory::Call(isolate(), ConvertReceiverMode::kNotNullOrUndefined),
-      context, promise_then, promise, value_thunk);
-  Return(result_promise);
+  Return(InvokeThen(native_context, promise, value_thunk));
 }
 
 TF_BUILTIN(PromiseThrowerFinally, PromiseBuiltinsAssembler) {
@@ -1627,35 +1524,44 @@ TF_BUILTIN(PromiseCatchFinally, PromiseBuiltinsAssembler) {
     CallBuiltin(Builtins::kPromiseResolve, context, constructor, result);
 
   // 7. Let thrower be equivalent to a function that throws reason.
-  Node* native_context = LoadNativeContext(context);
+  Node* const native_context = LoadNativeContext(context);
   Node* const thrower = CreateThrowerFunction(reason, native_context);
 
   // 8. Return ? Invoke(promise, "then", « thrower »).
-  Node* const promise_then =
-    GetProperty(context, promise, factory()->then_string());
-  Node* const result_promise = CallJS(
-      CodeFactory::Call(isolate(), ConvertReceiverMode::kNotNullOrUndefined),
-      context, promise_then, promise, thrower);
-  Return(result_promise);
+  Return(InvokeThen(native_context, promise, thrower));
 }
 
 TF_BUILTIN(PromisePrototypeFinally, PromiseBuiltinsAssembler) {
   CSA_ASSERT_JS_ARGC_EQ(this, 1);
 
   // 1.  Let promise be the this value.
-  Node* const promise = Parameter(Descriptor::kReceiver);
+  Node* const receiver = Parameter(Descriptor::kReceiver);
   Node* const on_finally = Parameter(Descriptor::kOnFinally);
   Node* const context = Parameter(Descriptor::kContext);
 
   // 2. If Type(promise) is not Object, throw a TypeError exception.
-  ThrowIfNotJSReceiver(context, promise, MessageTemplate::kCalledOnNonObject,
+  ThrowIfNotJSReceiver(context, receiver, MessageTemplate::kCalledOnNonObject,
                        "Promise.prototype.finally");
 
   // 3. Let C be ? SpeciesConstructor(promise, %Promise%).
   Node* const native_context = LoadNativeContext(context);
   Node* const promise_fun =
       LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
-  Node* const constructor = SpeciesConstructor(context, promise, promise_fun);
+  VARIABLE(var_constructor, MachineRepresentation::kTagged, promise_fun);
+  Label slow_constructor(this, Label::kDeferred), done_constructor(this);
+  Node* const receiver_map = LoadMap(receiver);
+  GotoIfNot(IsJSPromiseMap(receiver_map), &slow_constructor);
+  BranchIfPromiseSpeciesLookupChainIntact(native_context, receiver_map,
+                                          &done_constructor, &slow_constructor);
+  BIND(&slow_constructor);
+  {
+    Node* const constructor =
+        SpeciesConstructor(context, receiver, promise_fun);
+    var_constructor.Bind(constructor);
+    Goto(&done_constructor);
+  }
+  BIND(&done_constructor);
+  Node* const constructor = var_constructor.value();
 
   // 4. Assert: IsConstructor(C) is true.
   CSA_ASSERT(this, IsConstructor(constructor));
@@ -1697,50 +1603,189 @@ TF_BUILTIN(PromisePrototypeFinally, PromiseBuiltinsAssembler) {
 
   // 7. Return ? Invoke(promise, "then", « thenFinally, catchFinally »).
   BIND(&perform_finally);
-  Node* const promise_then =
-    GetProperty(context, promise, factory()->then_string());
-  Node* const result_promise = CallJS(
-      CodeFactory::Call(isolate(), ConvertReceiverMode::kNotNullOrUndefined),
-      context, promise_then, promise, var_then_finally.value(),
-      var_catch_finally.value());
-  Return(result_promise);
+  Return(InvokeThen(native_context, receiver, var_then_finally.value(),
+                    var_catch_finally.value()));
 }
 
-TF_BUILTIN(ResolveNativePromise, PromiseBuiltinsAssembler) {
+// ES #sec-fulfillpromise
+TF_BUILTIN(FulfillPromise, PromiseBuiltinsAssembler) {
   Node* const promise = Parameter(Descriptor::kPromise);
   Node* const value = Parameter(Descriptor::kValue);
   Node* const context = Parameter(Descriptor::kContext);
 
-  CSA_ASSERT(this, HasInstanceType(promise, JS_PROMISE_TYPE));
-  InternalResolvePromise(context, promise, value);
-  Return(UndefinedConstant());
+  CSA_ASSERT(this, TaggedIsNotSmi(promise));
+  CSA_ASSERT(this, IsJSPromise(promise));
+
+  // 2. Let reactions be promise.[[PromiseFulfillReactions]].
+  Node* const reactions =
+      LoadObjectField(promise, JSPromise::kReactionsOrResultOffset);
+
+  // 3. Set promise.[[PromiseResult]] to value.
+  // 4. Set promise.[[PromiseFulfillReactions]] to undefined.
+  // 5. Set promise.[[PromiseRejectReactions]] to undefined.
+  StoreObjectField(promise, JSPromise::kReactionsOrResultOffset, value);
+
+  // 6. Set promise.[[PromiseState]] to "fulfilled".
+  PromiseSetStatus(promise, Promise::kFulfilled);
+
+  // 7. Return TriggerPromiseReactions(reactions, value).
+  Return(TriggerPromiseReactions(context, reactions, value,
+                                 PromiseReaction::kFulfill));
 }
 
-TF_BUILTIN(RejectNativePromise, PromiseBuiltinsAssembler) {
+// ES #sec-rejectpromise
+TF_BUILTIN(RejectPromise, PromiseBuiltinsAssembler) {
   Node* const promise = Parameter(Descriptor::kPromise);
-  Node* const value = Parameter(Descriptor::kValue);
+  Node* const reason = Parameter(Descriptor::kReason);
   Node* const debug_event = Parameter(Descriptor::kDebugEvent);
   Node* const context = Parameter(Descriptor::kContext);
 
-  CSA_ASSERT(this, HasInstanceType(promise, JS_PROMISE_TYPE));
+  CSA_ASSERT(this, TaggedIsNotSmi(promise));
+  CSA_ASSERT(this, IsJSPromise(promise));
   CSA_ASSERT(this, IsBoolean(debug_event));
-  InternalPromiseReject(context, promise, value, debug_event);
-  Return(UndefinedConstant());
+  Label if_runtime(this, Label::kDeferred);
+
+  // If promise hook is enabled or the debugger is active, let
+  // the runtime handle this operation, which greatly reduces
+  // the complexity here and also avoids a couple of back and
+  // forth between JavaScript and C++ land.
+  GotoIf(IsPromiseHookEnabledOrDebugIsActive(), &if_runtime);
+
+  // 7. If promise.[[PromiseIsHandled]] is false, perform
+  //    HostPromiseRejectionTracker(promise, "reject").
+  // We don't try to handle rejecting {promise} without handler
+  // here, but we let the C++ code take care of this completely.
+  GotoIfNot(PromiseHasHandler(promise), &if_runtime);
+
+  // 2. Let reactions be promise.[[PromiseRejectReactions]].
+  Node* reactions =
+      LoadObjectField(promise, JSPromise::kReactionsOrResultOffset);
+
+  // 3. Set promise.[[PromiseResult]] to reason.
+  // 4. Set promise.[[PromiseFulfillReactions]] to undefined.
+  // 5. Set promise.[[PromiseRejectReactions]] to undefined.
+  StoreObjectField(promise, JSPromise::kReactionsOrResultOffset, reason);
+
+  // 6. Set promise.[[PromiseState]] to "rejected".
+  PromiseSetStatus(promise, Promise::kRejected);
+
+  // 7. Return TriggerPromiseReactions(reactions, reason).
+  Return(TriggerPromiseReactions(context, reactions, reason,
+                                 PromiseReaction::kReject));
+
+  BIND(&if_runtime);
+  TailCallRuntime(Runtime::kRejectPromise, context, promise, reason,
+                  debug_event);
 }
 
-TF_BUILTIN(PerformNativePromiseThen, PromiseBuiltinsAssembler) {
+// ES #sec-promise-resolve-functions
+TF_BUILTIN(ResolvePromise, PromiseBuiltinsAssembler) {
   Node* const promise = Parameter(Descriptor::kPromise);
-  Node* const resolve_reaction = Parameter(Descriptor::kResolveReaction);
-  Node* const reject_reaction = Parameter(Descriptor::kRejectReaction);
-  Node* const result_promise = Parameter(Descriptor::kResultPromise);
+  Node* const resolution = Parameter(Descriptor::kResolution);
   Node* const context = Parameter(Descriptor::kContext);
 
-  CSA_ASSERT(this, HasInstanceType(result_promise, JS_PROMISE_TYPE));
+  CSA_ASSERT(this, TaggedIsNotSmi(promise));
+  CSA_ASSERT(this, IsJSPromise(promise));
 
-  InternalPerformPromiseThen(context, promise, resolve_reaction,
-                             reject_reaction, result_promise,
-                             UndefinedConstant(), UndefinedConstant());
-  Return(result_promise);
+  Label do_enqueue(this), if_fulfill(this), if_reject(this, Label::kDeferred),
+      if_runtime(this, Label::kDeferred);
+  VARIABLE(var_reason, MachineRepresentation::kTagged);
+  VARIABLE(var_then, MachineRepresentation::kTagged);
+
+  // If promise hook is enabled or the debugger is active, let
+  // the runtime handle this operation, which greatly reduces
+  // the complexity here and also avoids a couple of back and
+  // forth between JavaScript and C++ land.
+  GotoIf(IsPromiseHookEnabledOrDebugIsActive(), &if_runtime);
+
+  // 6. If SameValue(resolution, promise) is true, then
+  // We can use pointer comparison here, since the {promise} is guaranteed
+  // to be a JSPromise inside this function and thus is reference comparable.
+  GotoIf(WordEqual(promise, resolution), &if_runtime);
+
+  // 7. If Type(resolution) is not Object, then
+  GotoIf(TaggedIsSmi(resolution), &if_fulfill);
+  Node* const resolution_map = LoadMap(resolution);
+  GotoIfNot(IsJSReceiverMap(resolution_map), &if_fulfill);
+
+  // We can skip the "then" lookup on {resolution} if its [[Prototype]]
+  // is the (initial) Promise.prototype and the Promise#then protector
+  // is intact, as that guards the lookup path for the "then" property
+  // on JSPromise instances which have the (initial) %PromisePrototype%.
+  Label if_fast(this), if_generic(this), if_slow(this, Label::kDeferred);
+  Node* const native_context = LoadNativeContext(context);
+  GotoIfForceSlowPath(&if_slow);
+  GotoIf(IsPromiseThenProtectorCellInvalid(), &if_slow);
+  GotoIfNot(IsJSPromiseMap(resolution_map), &if_generic);
+  Node* const promise_prototype =
+      LoadContextElement(native_context, Context::PROMISE_PROTOTYPE_INDEX);
+  Branch(WordEqual(LoadMapPrototype(resolution_map), promise_prototype),
+         &if_fast, &if_slow);
+
+  BIND(&if_fast);
+  {
+    Node* const then =
+        LoadContextElement(native_context, Context::PROMISE_THEN_INDEX);
+    var_then.Bind(then);
+    Goto(&do_enqueue);
+  }
+
+  BIND(&if_generic);
+  {
+    // We can skip the lookup of "then" if the {resolution} is a (newly
+    // created) IterResultObject, as the Promise#then protector also
+    // ensures that the intrinsic %ObjectPrototype% doesn't contain any
+    // "then" property. This helps to avoid negative lookups on iterator
+    // results from async generators.
+    CSA_ASSERT(this, IsJSReceiverMap(resolution_map));
+    CSA_ASSERT(this, Word32BinaryNot(IsPromiseThenProtectorCellInvalid()));
+    Node* const iterator_result_map =
+        LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX);
+    Branch(WordEqual(resolution_map, iterator_result_map), &if_fulfill,
+           &if_slow);
+  }
+
+  BIND(&if_slow);
+  {
+    // 8. Let then be Get(resolution, "then").
+    Node* const then =
+        GetProperty(context, resolution, isolate()->factory()->then_string());
+
+    // 9. If then is an abrupt completion, then
+    GotoIfException(then, &if_reject, &var_reason);
+
+    // 11. If IsCallable(thenAction) is false, then
+    GotoIf(TaggedIsSmi(then), &if_fulfill);
+    Node* const then_map = LoadMap(then);
+    GotoIfNot(IsCallableMap(then_map), &if_fulfill);
+    var_then.Bind(then);
+    Goto(&do_enqueue);
+  }
+
+  BIND(&do_enqueue);
+  {
+    // 12. Perform EnqueueJob("PromiseJobs", PromiseResolveThenableJob,
+    //                        «promise, resolution, thenAction»).
+    Node* const task = AllocatePromiseResolveThenableJobTask(
+        promise, var_then.value(), resolution, native_context);
+    TailCallBuiltin(Builtins::kEnqueueMicrotask, native_context, task);
+  }
+
+  BIND(&if_fulfill);
+  {
+    // 7.b Return FulfillPromise(promise, resolution).
+    TailCallBuiltin(Builtins::kFulfillPromise, context, promise, resolution);
+  }
+
+  BIND(&if_runtime);
+  Return(CallRuntime(Runtime::kResolvePromise, context, promise, resolution));
+
+  BIND(&if_reject);
+  {
+    // 9.a Return RejectPromise(promise, then.[[Value]]).
+    TailCallBuiltin(Builtins::kRejectPromise, context, promise,
+                    var_reason.value(), FalseConstant());
+  }
 }
 
 Node* PromiseBuiltinsAssembler::PerformPromiseAll(
@@ -1748,26 +1793,23 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
     const IteratorRecord& iterator, Label* if_exception,
     Variable* var_exception) {
   IteratorBuiltinsAssembler iter_assembler(state());
-  Label close_iterator(this);
 
   Node* const instrumenting = IsDebugActive();
+  Node* const native_context = LoadNativeContext(context);
 
   // For catch prediction, don't treat the .then calls as handling it;
   // instead, recurse outwards.
   SetForwardingHandlerIfTrue(
-      context, instrumenting,
+      native_context, instrumenting,
       LoadObjectField(capability, PromiseCapability::kRejectOffset));
 
-  Node* const native_context = LoadNativeContext(context);
-  Node* const array_map = LoadContextElement(
-      native_context, Context::JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX);
-  Node* const values_array = AllocateJSArray(PACKED_ELEMENTS, array_map,
-                                             IntPtrConstant(0), SmiConstant(0));
-  Node* const remaining_elements = AllocateSmiCell(1);
-
-  VARIABLE(var_index, MachineRepresentation::kTagged, SmiConstant(0));
+  Node* const resolve_element_context =
+      CreatePromiseAllResolveElementContext(capability, native_context);
 
-  Label loop(this, &var_index), break_loop(this);
+  VARIABLE(var_index, MachineRepresentation::kTagged, SmiConstant(1));
+  Label loop(this, &var_index), done_loop(this),
+      too_many_elements(this, Label::kDeferred),
+      close_iterator(this, Label::kDeferred);
   Goto(&loop);
   BIND(&loop);
   {
@@ -1777,122 +1819,147 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
     Node* const fast_iterator_result_map =
         LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX);
     Node* const next = iter_assembler.IteratorStep(
-        context, iterator, &break_loop, fast_iterator_result_map, if_exception,
-        var_exception);
+        native_context, iterator, &done_loop, fast_iterator_result_map,
+        if_exception, var_exception);
 
     // Let nextValue be IteratorValue(next).
     // If nextValue is an abrupt completion, set iteratorRecord.[[Done]] to
     //     true.
     // ReturnIfAbrupt(nextValue).
     Node* const next_value = iter_assembler.IteratorValue(
-        context, next, fast_iterator_result_map, if_exception, var_exception);
+        native_context, next, fast_iterator_result_map, if_exception,
+        var_exception);
 
     // Let nextPromise be ? Invoke(constructor, "resolve", « nextValue »).
-    Node* const promise_resolve =
-        GetProperty(context, constructor, factory()->resolve_string());
-    GotoIfException(promise_resolve, &close_iterator, var_exception);
-
-    Node* const next_promise = CallJS(
-        CodeFactory::Call(isolate(), ConvertReceiverMode::kNotNullOrUndefined),
-        context, promise_resolve, constructor, next_value);
-    GotoIfException(next_promise, &close_iterator, var_exception);
+    Node* const next_promise =
+        InvokeResolve(native_context, constructor, next_value, &close_iterator,
+                      var_exception);
 
-    // Let resolveElement be a new built-in function object as defined in
-    // Promise.all Resolve Element Functions.
-    Node* const resolve_context =
-        CreatePromiseContext(native_context, kPromiseAllResolveElementLength);
-    StoreContextElementNoWriteBarrier(
-        resolve_context, kPromiseAllResolveElementAlreadyVisitedSlot,
-        SmiConstant(0));
-    StoreContextElementNoWriteBarrier(
-        resolve_context, kPromiseAllResolveElementIndexSlot, var_index.value());
-    StoreContextElementNoWriteBarrier(
-        resolve_context, kPromiseAllResolveElementRemainingElementsSlot,
-        remaining_elements);
-    StoreContextElementNoWriteBarrier(
-        resolve_context, kPromiseAllResolveElementCapabilitySlot, capability);
-    StoreContextElementNoWriteBarrier(resolve_context,
-                                      kPromiseAllResolveElementValuesArraySlot,
-                                      values_array);
-
-    Node* const map = LoadContextElement(
-        native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
-    Node* const resolve_info = LoadContextElement(
-        native_context, Context::PROMISE_ALL_RESOLVE_ELEMENT_SHARED_FUN);
-    Node* const resolve =
-        AllocateFunctionWithMapAndContext(map, resolve_info, resolve_context);
+    // Check if we reached the limit.
+    Node* const index = var_index.value();
+    GotoIf(SmiEqual(index, SmiConstant(PropertyArray::HashField::kMax)),
+           &too_many_elements);
 
     // Set remainingElementsCount.[[Value]] to
     //     remainingElementsCount.[[Value]] + 1.
-    {
-      Label if_outofrange(this, Label::kDeferred), done(this);
-      IncrementSmiCell(remaining_elements, &if_outofrange);
-      Goto(&done);
-
-      BIND(&if_outofrange);
-      {
-        // If the incremented value is out of Smi range, crash.
-        Abort(AbortReason::kOffsetOutOfRange);
-      }
-
-      BIND(&done);
-    }
+    Node* const remaining_elements_count = LoadContextElement(
+        resolve_element_context, kPromiseAllResolveElementRemainingSlot);
+    StoreContextElementNoWriteBarrier(
+        resolve_element_context, kPromiseAllResolveElementRemainingSlot,
+        SmiAdd(remaining_elements_count, SmiConstant(1)));
+
+    // Let resolveElement be CreateBuiltinFunction(steps,
+    //                                             « [[AlreadyCalled]],
+    //                                               [[Index]],
+    //                                               [[Values]],
+    //                                               [[Capability]],
+    //                                               [[RemainingElements]] »).
+    // Set resolveElement.[[AlreadyCalled]] to a Record { [[Value]]: false }.
+    // Set resolveElement.[[Index]] to index.
+    // Set resolveElement.[[Values]] to values.
+    // Set resolveElement.[[Capability]] to resultCapability.
+    // Set resolveElement.[[RemainingElements]] to remainingElementsCount.
+    Node* const resolve_element_fun = CreatePromiseAllResolveElementFunction(
+        resolve_element_context, index, native_context);
 
     // Perform ? Invoke(nextPromise, "then", « resolveElement,
     //                  resultCapability.[[Reject]] »).
     Node* const then =
-        GetProperty(context, next_promise, factory()->then_string());
+        GetProperty(native_context, next_promise, factory()->then_string());
     GotoIfException(then, &close_iterator, var_exception);
 
     Node* const then_call = CallJS(
         CodeFactory::Call(isolate(), ConvertReceiverMode::kNotNullOrUndefined),
-        context, then, next_promise, resolve,
+        native_context, then, next_promise, resolve_element_fun,
         LoadObjectField(capability, PromiseCapability::kRejectOffset));
     GotoIfException(then_call, &close_iterator, var_exception);
 
     // For catch prediction, mark that rejections here are semantically
     // handled by the combined Promise.
-    SetPromiseHandledByIfTrue(context, instrumenting, then_call, [=]() {
+    SetPromiseHandledByIfTrue(native_context, instrumenting, then_call, [=]() {
       // Load promiseCapability.[[Promise]]
       return LoadObjectField(capability, PromiseCapability::kPromiseOffset);
     });
 
-    // Set index to index + 1
-    var_index.Bind(NumberInc(var_index.value()));
+    // Set index to index + 1.
+    var_index.Bind(SmiAdd(index, SmiConstant(1)));
     Goto(&loop);
   }
 
+  BIND(&too_many_elements);
+  {
+    // If there are too many elements (currently more than 2**21-1), raise a
+    // RangeError here (which is caught directly and turned into a rejection)
+    // of the resulting promise. We could gracefully handle this case as well
+    // and support more than this number of elements by going to a separate
+    // function and pass the larger indices via a separate context, but it
+    // doesn't seem likely that we need this, and it's unclear how the rest
+    // of the system deals with 2**21 live Promises anyways.
+    Node* const result =
+        CallRuntime(Runtime::kThrowRangeError, native_context,
+                    SmiConstant(MessageTemplate::kTooManyElementsInPromiseAll));
+    GotoIfException(result, &close_iterator, var_exception);
+    Unreachable();
+  }
+
   BIND(&close_iterator);
   {
     // Exception must be bound to a JS value.
     CSA_ASSERT(this, IsNotTheHole(var_exception->value()));
-    iter_assembler.IteratorCloseOnException(context, iterator, if_exception,
-                                            var_exception);
+    iter_assembler.IteratorCloseOnException(native_context, iterator,
+                                            if_exception, var_exception);
   }
 
-  BIND(&break_loop);
+  BIND(&done_loop);
   {
-    Label resolve_promise(this), return_promise(this);
+    Label resolve_promise(this, Label::kDeferred), return_promise(this);
     // Set iteratorRecord.[[Done]] to true.
     // Set remainingElementsCount.[[Value]] to
     //    remainingElementsCount.[[Value]] - 1.
-    Node* const remaining = DecrementSmiCell(remaining_elements);
-    Branch(SmiEqual(remaining, SmiConstant(0)), &resolve_promise,
-           &return_promise);
+    Node* remaining_elements_count = LoadContextElement(
+        resolve_element_context, kPromiseAllResolveElementRemainingSlot);
+    remaining_elements_count = SmiSub(remaining_elements_count, SmiConstant(1));
+    StoreContextElementNoWriteBarrier(resolve_element_context,
+                                      kPromiseAllResolveElementRemainingSlot,
+                                      remaining_elements_count);
+    GotoIf(SmiEqual(remaining_elements_count, SmiConstant(0)),
+           &resolve_promise);
+
+    // Pre-allocate the backing store for the {values_array} to the desired
+    // capacity here. We may already have elements here in case of some
+    // fancy Thenable that calls the resolve callback immediately, so we need
+    // to handle that correctly here.
+    Node* const values_array = LoadContextElement(
+        resolve_element_context, kPromiseAllResolveElementValuesArraySlot);
+    Node* const old_elements = LoadElements(values_array);
+    Node* const old_capacity = LoadFixedArrayBaseLength(old_elements);
+    Node* const new_capacity = var_index.value();
+    GotoIf(SmiGreaterThanOrEqual(old_capacity, new_capacity), &return_promise);
+    Node* const new_elements =
+        AllocateFixedArray(PACKED_ELEMENTS, new_capacity, SMI_PARAMETERS,
+                           AllocationFlag::kAllowLargeObjectAllocation);
+    CopyFixedArrayElements(PACKED_ELEMENTS, old_elements, PACKED_ELEMENTS,
+                           new_elements, SmiConstant(0), old_capacity,
+                           new_capacity, UPDATE_WRITE_BARRIER, SMI_PARAMETERS);
+    StoreObjectField(values_array, JSArray::kElementsOffset, new_elements);
+    Goto(&return_promise);
 
     // If remainingElementsCount.[[Value]] is 0, then
     //     Let valuesArray be CreateArrayFromList(values).
     //     Perform ? Call(resultCapability.[[Resolve]], undefined,
     //                    « valuesArray »).
     BIND(&resolve_promise);
-
-    Node* const resolve =
-        LoadObjectField(capability, PromiseCapability::kResolveOffset);
-    Node* const resolve_call = CallJS(
-        CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-        context, resolve, UndefinedConstant(), values_array);
-    GotoIfException(resolve_call, if_exception, var_exception);
-    Goto(&return_promise);
+    {
+      Node* const resolve =
+          LoadObjectField(capability, PromiseCapability::kResolveOffset);
+      Node* const values_array = LoadContextElement(
+          resolve_element_context, kPromiseAllResolveElementValuesArraySlot);
+      Node* const resolve_call = CallJS(
+          CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
+          native_context, resolve, UndefinedConstant(), values_array);
+      GotoIfException(resolve_call, if_exception, var_exception);
+      Goto(&return_promise);
+    }
 
     // Return resultCapability.[[Promise]].
     BIND(&return_promise);
@@ -1903,31 +1970,6 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
   return promise;
 }
 
-Node* PromiseBuiltinsAssembler::IncrementSmiCell(Node* cell,
-                                                 Label* if_overflow) {
-  CSA_SLOW_ASSERT(this, HasInstanceType(cell, CELL_TYPE));
-  Node* value = LoadCellValue(cell);
-  CSA_SLOW_ASSERT(this, TaggedIsSmi(value));
-
-  if (if_overflow != nullptr) {
-    GotoIf(SmiEqual(value, SmiConstant(Smi::kMaxValue)), if_overflow);
-  }
-
-  Node* result = SmiAdd(value, SmiConstant(1));
-  StoreCellValue(cell, result, SKIP_WRITE_BARRIER);
-  return result;
-}
-
-Node* PromiseBuiltinsAssembler::DecrementSmiCell(Node* cell) {
-  CSA_SLOW_ASSERT(this, HasInstanceType(cell, CELL_TYPE));
-  Node* value = LoadCellValue(cell);
-  CSA_SLOW_ASSERT(this, TaggedIsSmi(value));
-
-  Node* result = SmiSub(value, SmiConstant(1));
-  StoreCellValue(cell, result, SKIP_WRITE_BARRIER);
-  return result;
-}
-
 // ES#sec-promise.all
 // Promise.all ( iterable )
 TF_BUILTIN(PromiseAll, PromiseBuiltinsAssembler) {
@@ -1944,7 +1986,8 @@ TF_BUILTIN(PromiseAll, PromiseBuiltinsAssembler) {
   // Don't fire debugEvent so that forwarding the rejection through all does not
   // trigger redundant ExceptionEvents
   Node* const debug_event = FalseConstant();
-  Node* const capability = NewPromiseCapability(context, receiver, debug_event);
+  Node* const capability = CallBuiltin(Builtins::kNewPromiseCapability, context,
+                                       receiver, debug_event);
 
   VARIABLE(var_exception, MachineRepresentation::kTagged, TheHoleConstant());
   Label reject_promise(this, &var_exception, Label::kDeferred);
@@ -1983,63 +2026,96 @@ TF_BUILTIN(PromiseAll, PromiseBuiltinsAssembler) {
 TF_BUILTIN(PromiseAllResolveElementClosure, PromiseBuiltinsAssembler) {
   Node* const value = Parameter(Descriptor::kValue);
   Node* const context = Parameter(Descriptor::kContext);
+  Node* const function = LoadFromFrame(StandardFrameConstants::kFunctionOffset);
 
+  Label already_called(this, Label::kDeferred), resolve_promise(this);
+
+  // We use the {function}s context as the marker to remember whether this
+  // resolve element closure was already called. It points to the resolve
+  // element context (which is a FunctionContext) until it was called the
+  // first time, in which case we make it point to the native context here
+  // to mark this resolve element closure as done.
+  GotoIf(IsNativeContext(context), &already_called);
   CSA_ASSERT(this, SmiEqual(LoadFixedArrayBaseLength(context),
                             SmiConstant(kPromiseAllResolveElementLength)));
+  Node* const native_context = LoadNativeContext(context);
+  StoreObjectField(function, JSFunction::kContextOffset, native_context);
 
-  Label already_called(this), resolve_promise(this);
-  GotoIf(SmiEqual(LoadContextElement(
-                      context, kPromiseAllResolveElementAlreadyVisitedSlot),
-                  SmiConstant(1)),
-         &already_called);
-  StoreContextElementNoWriteBarrier(
-      context, kPromiseAllResolveElementAlreadyVisitedSlot, SmiConstant(1));
+  // Determine the index from the {function}.
+  Label unreachable(this, Label::kDeferred);
+  STATIC_ASSERT(PropertyArray::kNoHashSentinel == 0);
+  Node* const identity_hash =
+      LoadJSReceiverIdentityHash(function, &unreachable);
+  CSA_ASSERT(this, IntPtrGreaterThan(identity_hash, IntPtrConstant(0)));
+  Node* const index = IntPtrSub(identity_hash, IntPtrConstant(1));
 
-  Node* const index =
-      LoadContextElement(context, kPromiseAllResolveElementIndexSlot);
+  // Check if we need to grow the [[ValuesArray]] to store {value} at {index}.
   Node* const values_array =
       LoadContextElement(context, kPromiseAllResolveElementValuesArraySlot);
+  Node* const elements = LoadElements(values_array);
+  Node* const values_length =
+      LoadAndUntagObjectField(values_array, JSArray::kLengthOffset);
+  Label if_inbounds(this), if_outofbounds(this), done(this);
+  Branch(IntPtrLessThan(index, values_length), &if_inbounds, &if_outofbounds);
+
+  BIND(&if_outofbounds);
+  {
+    // Check if we need to grow the backing store.
+    Node* const new_length = IntPtrAdd(index, IntPtrConstant(1));
+    Node* const elements_length =
+        LoadAndUntagObjectField(elements, FixedArray::kLengthOffset);
+    Label if_grow(this, Label::kDeferred), if_nogrow(this);
+    Branch(IntPtrLessThan(index, elements_length), &if_nogrow, &if_grow);
+
+    BIND(&if_grow);
+    {
+      // We need to grow the backing store to fit the {index} as well.
+      Node* const new_elements_length =
+          IntPtrMin(CalculateNewElementsCapacity(new_length),
+                    IntPtrConstant(PropertyArray::HashField::kMax + 1));
+      CSA_ASSERT(this, IntPtrLessThan(index, new_elements_length));
+      CSA_ASSERT(this, IntPtrLessThan(elements_length, new_elements_length));
+      Node* const new_elements = AllocateFixedArray(
+          PACKED_ELEMENTS, new_elements_length, INTPTR_PARAMETERS,
+          AllocationFlag::kAllowLargeObjectAllocation);
+      CopyFixedArrayElements(PACKED_ELEMENTS, elements, PACKED_ELEMENTS,
+                             new_elements, elements_length,
+                             new_elements_length);
+      StoreFixedArrayElement(new_elements, index, value);
+
+      // Update backing store and "length" on {values_array}.
+      StoreObjectField(values_array, JSArray::kElementsOffset, new_elements);
+      StoreObjectFieldNoWriteBarrier(values_array, JSArray::kLengthOffset,
+                                     SmiTag(new_length));
+      Goto(&done);
+    }
+
+    BIND(&if_nogrow);
+    {
+      // The {index} is within bounds of the {elements} backing store, so
+      // just store the {value} and update the "length" of the {values_array}.
+      StoreObjectFieldNoWriteBarrier(values_array, JSArray::kLengthOffset,
+                                     SmiTag(new_length));
+      StoreFixedArrayElement(elements, index, value);
+      Goto(&done);
+    }
+  }
 
-  // Set element in FixedArray
-  Label runtime_set_element(this), did_set_element(this);
-  GotoIfNot(TaggedIsPositiveSmi(index), &runtime_set_element);
+  BIND(&if_inbounds);
   {
-    VARIABLE(var_elements, MachineRepresentation::kTagged,
-             LoadElements(values_array));
-    PossiblyGrowElementsCapacity(SMI_PARAMETERS, PACKED_ELEMENTS, values_array,
-                                 index, &var_elements, SmiConstant(1),
-                                 &runtime_set_element);
-    StoreFixedArrayElement(var_elements.value(), index, value,
-                           UPDATE_WRITE_BARRIER, 0, SMI_PARAMETERS);
-
-    // Update array length
-    Label did_set_length(this);
-    Node* const length = LoadJSArrayLength(values_array);
-    GotoIfNot(TaggedIsPositiveSmi(length), &did_set_length);
-    Node* const new_length = SmiAdd(index, SmiConstant(1));
-    GotoIfNot(SmiLessThan(length, new_length), &did_set_length);
-    StoreObjectFieldNoWriteBarrier(values_array, JSArray::kLengthOffset,
-                                   new_length);
-    // Assert that valuesArray.[[Length]] is less than or equal to the
-    // elements backing-store length.e
-    CSA_SLOW_ASSERT(
-        this, SmiAboveOrEqual(LoadFixedArrayBaseLength(var_elements.value()),
-                              new_length));
-    Goto(&did_set_length);
-    BIND(&did_set_length);
+    // The {index} is in bounds of the {values_array},
+    // just store the {value} and continue.
+    StoreFixedArrayElement(elements, index, value);
+    Goto(&done);
   }
-  Goto(&did_set_element);
-  BIND(&runtime_set_element);
-  // New-space filled up or index too large, set element via runtime
-  CallRuntime(Runtime::kCreateDataProperty, context, values_array, index,
-              value);
-  Goto(&did_set_element);
-  BIND(&did_set_element);
-
-  Node* const remaining_elements = LoadContextElement(
-      context, kPromiseAllResolveElementRemainingElementsSlot);
-  Node* const result = DecrementSmiCell(remaining_elements);
-  GotoIf(SmiEqual(result, SmiConstant(0)), &resolve_promise);
+
+  BIND(&done);
+  Node* remaining_elements_count =
+      LoadContextElement(context, kPromiseAllResolveElementRemainingSlot);
+  remaining_elements_count = SmiSub(remaining_elements_count, SmiConstant(1));
+  StoreContextElement(context, kPromiseAllResolveElementRemainingSlot,
+                      remaining_elements_count);
+  GotoIf(SmiEqual(remaining_elements_count, SmiConstant(0)), &resolve_promise);
   Return(UndefinedConstant());
 
   BIND(&resolve_promise);
@@ -2053,6 +2129,9 @@ TF_BUILTIN(PromiseAllResolveElementClosure, PromiseBuiltinsAssembler) {
 
   BIND(&already_called);
   Return(UndefinedConstant());
+
+  BIND(&unreachable);
+  Unreachable();
 }
 
 // ES#sec-promise.race
@@ -2070,7 +2149,8 @@ TF_BUILTIN(PromiseRace, PromiseBuiltinsAssembler) {
   // Don't fire debugEvent so that forwarding the rejection through all does not
   // trigger redundant ExceptionEvents
   Node* const debug_event = FalseConstant();
-  Node* const capability = NewPromiseCapability(context, receiver, debug_event);
+  Node* const capability = CallBuiltin(Builtins::kNewPromiseCapability, context,
+                                       receiver, debug_event);
 
   Node* const resolve =
       LoadObjectField(capability, PromiseCapability::kResolveOffset);
@@ -2118,15 +2198,9 @@ TF_BUILTIN(PromiseRace, PromiseBuiltinsAssembler) {
                                        &reject_promise, &var_exception);
 
       // Let nextPromise be ? Invoke(constructor, "resolve", « nextValue »).
-      Node* const promise_resolve =
-          GetProperty(context, receiver, factory()->resolve_string());
-      GotoIfException(promise_resolve, &close_iterator, &var_exception);
-
       Node* const next_promise =
-          CallJS(CodeFactory::Call(isolate(),
-                                   ConvertReceiverMode::kNotNullOrUndefined),
-                 context, promise_resolve, receiver, next_value);
-      GotoIfException(next_promise, &close_iterator, &var_exception);
+          InvokeResolve(native_context, receiver, next_value, &close_iterator,
+                        &var_exception);
 
       // Perform ? Invoke(nextPromise, "then", « resolveElement,
       //                  resultCapability.[[Reject]] »).
diff --git a/deps/v8/src/builtins/builtins-promise-gen.h b/deps/v8/src/builtins/builtins-promise-gen.h
index 366c7c22cdc..f21d86a141a 100644
--- a/deps/v8/src/builtins/builtins-promise-gen.h
+++ b/deps/v8/src/builtins/builtins-promise-gen.h
@@ -2,11 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_BUILTINS_BUILTINS_PROMISE_H_
-#define V8_BUILTINS_BUILTINS_PROMISE_H_
+#ifndef V8_BUILTINS_BUILTINS_PROMISE_GEN_H_
+#define V8_BUILTINS_BUILTINS_PROMISE_GEN_H_
 
 #include "src/code-stub-assembler.h"
 #include "src/contexts.h"
+#include "src/objects/promise.h"
 
 namespace v8 {
 namespace internal {
@@ -29,14 +30,8 @@ class PromiseBuiltinsAssembler : public CodeStubAssembler {
 
  protected:
   enum PromiseAllResolveElementContextSlots {
-    // Whether the resolve callback was already called.
-    kPromiseAllResolveElementAlreadyVisitedSlot = Context::MIN_CONTEXT_SLOTS,
-
-    // Index into the values array
-    kPromiseAllResolveElementIndexSlot,
-
-    // Remaining elements count (mutable HeapNumber)
-    kPromiseAllResolveElementRemainingElementsSlot,
+    // Remaining elements count
+    kPromiseAllResolveElementRemainingSlot = Context::MIN_CONTEXT_SLOTS,
 
     // Promise capability from Promise.all
     kPromiseAllResolveElementCapabilitySlot,
@@ -90,8 +85,16 @@ class PromiseBuiltinsAssembler : public CodeStubAssembler {
   Node* AllocateAndSetJSPromise(Node* context, v8::Promise::PromiseState status,
                                 Node* result);
 
-  Node* AllocatePromiseResolveThenableJobInfo(Node* result, Node* then,
-                                              Node* resolve, Node* reject,
+  Node* AllocatePromiseReaction(Node* next, Node* payload,
+                                Node* fulfill_handler, Node* reject_handler);
+
+  Node* AllocatePromiseReactionJobTask(Heap::RootListIndex map_root_index,
+                                       Node* context, Node* argument,
+                                       Node* handler, Node* payload);
+  Node* AllocatePromiseReactionJobTask(Node* map, Node* context, Node* argument,
+                                       Node* handler, Node* payload);
+  Node* AllocatePromiseResolveThenableJobTask(Node* promise_to_resolve,
+                                              Node* then, Node* thenable,
                                               Node* context);
 
   std::pair<Node*, Node*> CreatePromiseResolvingFunctions(
@@ -99,56 +102,72 @@ class PromiseBuiltinsAssembler : public CodeStubAssembler {
 
   Node* PromiseHasHandler(Node* promise);
 
+  // Creates the context used by all Promise.all resolve element closures,
+  // together with the values array. Since all closures for a single Promise.all
+  // call use the same context, we need to store the indices for the individual
+  // closures somewhere else (we put them into the identity hash field of the
+  // closures), and we also need to have a separate marker for when the closure
+  // was called already (we slap the native context onto the closure in that
+  // case to mark it's done).
+  Node* CreatePromiseAllResolveElementContext(Node* promise_capability,
+                                              Node* native_context);
+  Node* CreatePromiseAllResolveElementFunction(Node* context, Node* index,
+                                               Node* native_context);
+
   Node* CreatePromiseResolvingFunctionsContext(Node* promise, Node* debug_event,
                                                Node* native_context);
 
   Node* CreatePromiseGetCapabilitiesExecutorContext(Node* native_context,
                                                     Node* promise_capability);
 
-  Node* NewPromiseCapability(Node* context, Node* constructor,
-                             Node* debug_event = nullptr);
-
  protected:
   void PromiseInit(Node* promise);
 
-  Node* SpeciesConstructor(Node* context, Node* object,
-                           Node* default_constructor);
-
   void PromiseSetHasHandler(Node* promise);
   void PromiseSetHandledHint(Node* promise);
 
-  void AppendPromiseCallback(int offset, compiler::Node* promise,
-                             compiler::Node* value);
-
-  Node* InternalPromiseThen(Node* context, Node* promise, Node* on_resolve,
-                            Node* on_reject);
-
-  Node* InternalPerformPromiseThen(Node* context, Node* promise,
-                                   Node* on_resolve, Node* on_reject,
-                                   Node* deferred_promise,
-                                   Node* deferred_on_resolve,
-                                   Node* deferred_on_reject);
-
-  void InternalResolvePromise(Node* context, Node* promise, Node* result);
-
-  void BranchIfFastPath(Node* context, Node* promise, Label* if_isunmodified,
-                        Label* if_ismodified);
-
-  void BranchIfFastPath(Node* native_context, Node* promise_fun, Node* promise,
-                        Label* if_isunmodified, Label* if_ismodified);
+  void PerformPromiseThen(Node* context, Node* promise, Node* on_fulfilled,
+                          Node* on_rejected,
+                          Node* result_promise_or_capability);
 
   Node* CreatePromiseContext(Node* native_context, int slots);
-  void PromiseFulfill(Node* context, Node* promise, Node* result,
-                      v8::Promise::PromiseState status);
+
+  Node* TriggerPromiseReactions(Node* context, Node* promise, Node* result,
+                                PromiseReaction::Type type);
+
+  // We can skip the "resolve" lookup on {constructor} if it's the (initial)
+  // Promise constructor and the Promise.resolve() protector is intact, as
+  // that guards the lookup path for the "resolve" property on the %Promise%
+  // intrinsic object.
+  void BranchIfPromiseResolveLookupChainIntact(Node* native_context,
+                                               Node* constructor,
+                                               Label* if_fast, Label* if_slow);
+
+  // We can shortcut the SpeciesConstructor on {promise_map} if it's
+  // [[Prototype]] is the (initial)  Promise.prototype and the @@species
+  // protector is intact, as that guards the lookup path for the "constructor"
+  // property on JSPromise instances which have the %PromisePrototype%.
+  void BranchIfPromiseSpeciesLookupChainIntact(Node* native_context,
+                                               Node* promise_map,
+                                               Label* if_fast, Label* if_slow);
+
+  // We can skip the "then" lookup on {receiver_map} if it's [[Prototype]]
+  // is the (initial) Promise.prototype and the Promise#then() protector
+  // is intact, as that guards the lookup path for the "then" property
+  // on JSPromise instances which have the (initial) %PromisePrototype%.
+  void BranchIfPromiseThenLookupChainIntact(Node* native_context,
+                                            Node* receiver_map, Label* if_fast,
+                                            Label* if_slow);
+
+  Node* InvokeResolve(Node* native_context, Node* constructor, Node* value,
+                      Label* if_exception, Variable* var_exception);
+  template <typename... TArgs>
+  Node* InvokeThen(Node* native_context, Node* receiver, TArgs... args);
 
   void BranchIfAccessCheckFailed(Node* context, Node* native_context,
                                  Node* promise_constructor, Node* executor,
                                  Label* if_noaccess);
 
-  void InternalPromiseReject(Node* context, Node* promise, Node* value,
-                             bool debug_event);
-  void InternalPromiseReject(Node* context, Node* promise, Node* value,
-                             Node* debug_event);
   std::pair<Node*, Node*> CreatePromiseFinallyFunctions(Node* on_finally,
                                                         Node* constructor,
                                                         Node* native_context);
@@ -160,9 +179,6 @@ class PromiseBuiltinsAssembler : public CodeStubAssembler {
                           const IteratorRecord& record, Label* if_exception,
                           Variable* var_exception);
 
-  Node* IncrementSmiCell(Node* cell, Label* if_overflow = nullptr);
-  Node* DecrementSmiCell(Node* cell);
-
   void SetForwardingHandlerIfTrue(Node* context, Node* condition,
                                   const NodeGenerator& object);
   inline void SetForwardingHandlerIfTrue(Node* context, Node* condition,
@@ -174,9 +190,10 @@ class PromiseBuiltinsAssembler : public CodeStubAssembler {
                                  const NodeGenerator& handled_by);
 
   Node* PromiseStatus(Node* promise);
-  void PerformFulfillClosure(Node* context, Node* value, bool should_resolve);
 
- private:
+  void PromiseReactionJob(Node* context, Node* argument, Node* handler,
+                          Node* payload, PromiseReaction::Type type);
+
   Node* IsPromiseStatus(Node* actual, v8::Promise::PromiseState expected);
   void PromiseSetStatus(Node* promise, v8::Promise::PromiseState status);
 
@@ -186,4 +203,4 @@ class PromiseBuiltinsAssembler : public CodeStubAssembler {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_BUILTINS_BUILTINS_PROMISE_H_
+#endif  // V8_BUILTINS_BUILTINS_PROMISE_GEN_H_
diff --git a/deps/v8/src/builtins/builtins-proxy-gen.cc b/deps/v8/src/builtins/builtins-proxy-gen.cc
index 64e838d53ac..a4c208ac4e6 100644
--- a/deps/v8/src/builtins/builtins-proxy-gen.cc
+++ b/deps/v8/src/builtins/builtins-proxy-gen.cc
@@ -13,12 +13,6 @@
 namespace v8 {
 namespace internal {
 
-// ES6 section 26.2.1.1 Proxy ( target, handler ) for the [[Call]] case.
-TF_BUILTIN(ProxyConstructor, CodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  ThrowTypeError(context, MessageTemplate::kConstructorNotFunction, "Proxy");
-}
-
 void ProxiesCodeStubAssembler::GotoIfRevokedProxy(Node* object,
                                                   Label* if_proxy_revoked) {
   Label proxy_not_revoked(this);
@@ -73,57 +67,58 @@ Node* ProxiesCodeStubAssembler::AllocateProxy(Node* target, Node* handler,
 
 Node* ProxiesCodeStubAssembler::AllocateJSArrayForCodeStubArguments(
     Node* context, CodeStubArguments& args, Node* argc, ParameterMode mode) {
-  Node* native_context = LoadNativeContext(context);
-  Node* array_map = LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
-  Node* argc_smi = ParameterToTagged(argc, mode);
-
-  Node* array = AllocateJSArray(PACKED_ELEMENTS, array_map, argc, argc_smi,
-                                nullptr, mode);
-  Node* elements = LoadElements(array);
-
-  VARIABLE(index, MachineType::PointerRepresentation(),
-           IntPtrConstant(FixedArrayBase::kHeaderSize - kHeapObjectTag));
-  VariableList list({&index}, zone());
-  args.ForEach(list, [=, &index](Node* arg) {
-    StoreNoWriteBarrier(MachineRepresentation::kTagged, elements, index.value(),
-                        arg);
-    Increment(&index, kPointerSize);
-  });
-  return array;
-}
-
-// ES6 section 26.2.1.1 Proxy ( target, handler ) for the [[Construct]] case.
-TF_BUILTIN(ProxyConstructor_ConstructStub, ProxiesCodeStubAssembler) {
-  int const kTargetArg = 0;
-  int const kHandlerArg = 1;
-
-  Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
-  CodeStubArguments args(this, argc);
-
-  Node* target = args.GetOptionalArgumentValue(kTargetArg);
-  Node* handler = args.GetOptionalArgumentValue(kHandlerArg);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
-
-  Label throw_proxy_non_object(this, Label::kDeferred),
-      throw_proxy_handler_or_target_revoked(this, Label::kDeferred),
-      return_create_proxy(this);
+  Comment("AllocateJSArrayForCodeStubArguments");
 
-  GotoIf(TaggedIsSmi(target), &throw_proxy_non_object);
-  GotoIfNot(IsJSReceiver(target), &throw_proxy_non_object);
-  GotoIfRevokedProxy(target, &throw_proxy_handler_or_target_revoked);
+  Label if_empty_array(this), allocate_js_array(this);
+  // Do not use AllocateJSArray since {elements} might end up in LOS.
+  VARIABLE(elements, MachineRepresentation::kTagged);
 
-  GotoIf(TaggedIsSmi(handler), &throw_proxy_non_object);
-  GotoIfNot(IsJSReceiver(handler), &throw_proxy_non_object);
-  GotoIfRevokedProxy(handler, &throw_proxy_handler_or_target_revoked);
+  TNode<Smi> length = ParameterToTagged(argc, mode);
+  GotoIf(SmiEqual(length, SmiConstant(0)), &if_empty_array);
+  {
+    Label if_large_object(this, Label::kDeferred);
+    Node* allocated_elements = AllocateFixedArray(PACKED_ELEMENTS, argc, mode,
+                                                  kAllowLargeObjectAllocation);
+    elements.Bind(allocated_elements);
+
+    VARIABLE(index, MachineType::PointerRepresentation(),
+             IntPtrConstant(FixedArrayBase::kHeaderSize - kHeapObjectTag));
+    VariableList list({&index}, zone());
+
+    GotoIf(SmiGreaterThan(length, SmiConstant(FixedArray::kMaxRegularLength)),
+           &if_large_object);
+    args.ForEach(list, [=, &index](Node* arg) {
+      StoreNoWriteBarrier(MachineRepresentation::kTagged, allocated_elements,
+                          index.value(), arg);
+      Increment(&index, kPointerSize);
+    });
+    Goto(&allocate_js_array);
+
+    BIND(&if_large_object);
+    {
+      args.ForEach(list, [=, &index](Node* arg) {
+        Store(allocated_elements, index.value(), arg);
+        Increment(&index, kPointerSize);
+      });
+      Goto(&allocate_js_array);
+    }
+  }
 
-  args.PopAndReturn(AllocateProxy(target, handler, context));
+  BIND(&if_empty_array);
+  {
+    elements.Bind(EmptyFixedArrayConstant());
+    Goto(&allocate_js_array);
+  }
 
-  BIND(&throw_proxy_non_object);
-  ThrowTypeError(context, MessageTemplate::kProxyNonObject);
+  BIND(&allocate_js_array);
+  // Allocate the result JSArray.
+  Node* native_context = LoadNativeContext(context);
+  Node* array_map = LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
+  Node* array = AllocateUninitializedJSArrayWithoutElements(array_map, length);
+  StoreObjectFieldNoWriteBarrier(array, JSObject::kElementsOffset,
+                                 elements.value());
 
-  BIND(&throw_proxy_handler_or_target_revoked);
-  ThrowTypeError(context, MessageTemplate::kProxyHandlerOrTargetRevoked);
+  return array;
 }
 
 Node* ProxiesCodeStubAssembler::CreateProxyRevokeFunctionContext(
@@ -150,6 +145,65 @@ Node* ProxiesCodeStubAssembler::AllocateProxyRevokeFunction(Node* proxy,
                                            proxy_context);
 }
 
+// ES #sec-proxy-constructor
+TF_BUILTIN(ProxyConstructor, ProxiesCodeStubAssembler) {
+  Node* context = Parameter(Descriptor::kContext);
+
+  // 1. If NewTarget is undefined, throw a TypeError exception.
+  Node* new_target = Parameter(Descriptor::kNewTarget);
+  Label throwtypeerror(this, Label::kDeferred), createproxy(this);
+  Branch(IsUndefined(new_target), &throwtypeerror, &createproxy);
+
+  BIND(&throwtypeerror);
+  {
+    ThrowTypeError(context, MessageTemplate::kConstructorNotFunction, "Proxy");
+  }
+
+  // 2. Return ? ProxyCreate(target, handler).
+  BIND(&createproxy);
+  {
+    // https://tc39.github.io/ecma262/#sec-proxycreate
+    Node* target = Parameter(Descriptor::kTarget);
+    Node* handler = Parameter(Descriptor::kHandler);
+
+    // 1. If Type(target) is not Object, throw a TypeError exception.
+    // 2. If target is a Proxy exotic object and target.[[ProxyHandler]] is
+    //    null, throw a TypeError exception.
+    // 3. If Type(handler) is not Object, throw a TypeError exception.
+    // 4. If handler is a Proxy exotic object and handler.[[ProxyHandler]]
+    //    is null, throw a TypeError exception.
+    Label throw_proxy_non_object(this, Label::kDeferred),
+        throw_proxy_handler_or_target_revoked(this, Label::kDeferred),
+        return_create_proxy(this);
+
+    GotoIf(TaggedIsSmi(target), &throw_proxy_non_object);
+    GotoIfNot(IsJSReceiver(target), &throw_proxy_non_object);
+    GotoIfRevokedProxy(target, &throw_proxy_handler_or_target_revoked);
+
+    GotoIf(TaggedIsSmi(handler), &throw_proxy_non_object);
+    GotoIfNot(IsJSReceiver(handler), &throw_proxy_non_object);
+    GotoIfRevokedProxy(handler, &throw_proxy_handler_or_target_revoked);
+
+    // 5. Let P be a newly created object.
+    // 6. Set P's essential internal methods (except for [[Call]] and
+    //    [[Construct]]) to the definitions specified in 9.5.
+    // 7. If IsCallable(target) is true, then
+    //    a. Set P.[[Call]] as specified in 9.5.12.
+    //    b. If IsConstructor(target) is true, then
+    //       1. Set P.[[Construct]] as specified in 9.5.13.
+    // 8. Set P.[[ProxyTarget]] to target.
+    // 9. Set P.[[ProxyHandler]] to handler.
+    // 10. Return P.
+    Return(AllocateProxy(target, handler, context));
+
+    BIND(&throw_proxy_non_object);
+    ThrowTypeError(context, MessageTemplate::kProxyNonObject);
+
+    BIND(&throw_proxy_handler_or_target_revoked);
+    ThrowTypeError(context, MessageTemplate::kProxyHandlerOrTargetRevoked);
+  }
+}
+
 TF_BUILTIN(ProxyRevocable, ProxiesCodeStubAssembler) {
   Node* const target = Parameter(Descriptor::kTarget);
   Node* const handler = Parameter(Descriptor::kHandler);
@@ -404,8 +458,7 @@ TF_BUILTIN(ProxyHasProperty, ProxiesCodeStubAssembler) {
   BIND(&trap_undefined);
   {
     // 7.a. Return ? target.[[HasProperty]](P).
-    TailCallStub(Builtins::CallableFor(isolate(), Builtins::kHasProperty),
-                 context, name, target);
+    TailCallBuiltin(Builtins::kHasProperty, context, name, target);
   }
 
   BIND(&return_false);
diff --git a/deps/v8/src/builtins/builtins-regexp-gen.cc b/deps/v8/src/builtins/builtins-regexp-gen.cc
index 4227c628d1c..bb3a78239b1 100644
--- a/deps/v8/src/builtins/builtins-regexp-gen.cc
+++ b/deps/v8/src/builtins/builtins-regexp-gen.cc
@@ -7,6 +7,7 @@
 #include "src/builtins/builtins-constructor-gen.h"
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
+#include "src/builtins/growable-fixed-array-gen.h"
 #include "src/code-factory.h"
 #include "src/code-stub-assembler.h"
 #include "src/counters.h"
@@ -25,7 +26,7 @@ using compiler::Node;
 
 Node* RegExpBuiltinsAssembler::AllocateRegExpResult(Node* context, Node* length,
                                                     Node* index, Node* input) {
-  CSA_ASSERT(this, IsFixedArray(context));
+  CSA_ASSERT(this, IsContext(context));
   CSA_ASSERT(this, TaggedIsSmi(index));
   CSA_ASSERT(this, TaggedIsSmi(length));
   CSA_ASSERT(this, IsString(input));
@@ -135,15 +136,14 @@ void RegExpBuiltinsAssembler::StoreLastIndex(Node* context, Node* regexp,
 
 Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
     Node* const context, Node* const regexp, Node* const match_info,
-    Node* const string) {
+    TNode<String> const string) {
   CSA_ASSERT(this, IsFixedArrayMap(LoadMap(match_info)));
   CSA_ASSERT(this, IsJSRegExp(regexp));
-  CSA_ASSERT(this, IsString(string));
 
   Label named_captures(this), out(this);
 
-  TNode<IntPtrT> num_indices = SmiUntag(LoadFixedArrayElement(
-      match_info, RegExpMatchInfo::kNumberOfCapturesIndex));
+  TNode<IntPtrT> num_indices = SmiUntag(CAST(LoadFixedArrayElement(
+      match_info, RegExpMatchInfo::kNumberOfCapturesIndex)));
   Node* const num_results = SmiTag(WordShr(num_indices, 1));
   Node* const start =
       LoadFixedArrayElement(match_info, RegExpMatchInfo::kFirstCaptureIndex);
@@ -152,7 +152,8 @@ Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
 
   // Calculate the substring of the first match before creating the result array
   // to avoid an unnecessary write barrier storing the first result.
-  Node* const first = SubString(context, string, start, end);
+
+  TNode<String> const first = SubString(string, SmiUntag(start), SmiUntag(end));
 
   Node* const result =
       AllocateRegExpResult(context, num_results, start, string);
@@ -188,7 +189,8 @@ Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
     Node* const from_cursor_plus1 = IntPtrAdd(from_cursor, IntPtrConstant(1));
     Node* const end = LoadFixedArrayElement(match_info, from_cursor_plus1);
 
-    Node* const capture = SubString(context, string, start, end);
+    TNode<String> const capture =
+        SubString(string, SmiUntag(start), SmiUntag(end));
     StoreFixedArrayElement(result_elements, to_cursor, capture);
     Goto(&next_iter);
 
@@ -441,18 +443,11 @@ Node* RegExpBuiltinsAssembler::RegExpExecInternal(Node* const context,
   // contains the uninitialized sentinel as a smi.
 
   Node* const code = var_code.value();
-#ifdef DEBUG
-  {
-    Label next(this);
-    GotoIfNot(TaggedIsSmi(code), &next);
-
-    CSA_ASSERT(this,
-               SmiEqual(code, SmiConstant(JSRegExp::kUninitializedValue)));
-    Goto(&next);
-
-    BIND(&next);
-  }
-#endif
+  CSA_ASSERT_BRANCH(this, [=](Label* ok, Label* not_ok) {
+    GotoIfNot(TaggedIsSmi(code), ok);
+    Branch(SmiEqual(code, SmiConstant(JSRegExp::kUninitializedValue)), ok,
+           not_ok);
+  });
   GotoIf(TaggedIsSmi(code), &runtime);
   CSA_ASSERT(this, HasInstanceType(code, CODE_TYPE));
 
@@ -475,7 +470,7 @@ Node* RegExpBuiltinsAssembler::RegExpExecInternal(Node* const context,
 
     // Argument 1: Previous index.
     MachineType arg1_type = type_int32;
-    Node* const arg1 = TruncateWordToWord32(int_last_index);
+    Node* const arg1 = TruncateIntPtrToInt32(int_last_index);
 
     // Argument 2: Start of string data.
     MachineType arg2_type = type_ptr;
@@ -582,7 +577,7 @@ Node* RegExpBuiltinsAssembler::RegExpExecInternal(Node* const context,
           [=, &var_to_offset](Node* offset) {
             Node* const value = Load(MachineType::Int32(),
                                      static_offsets_vector_address, offset);
-            Node* const smi_value = SmiFromWord32(value);
+            Node* const smi_value = SmiFromInt32(value);
             StoreNoWriteBarrier(MachineRepresentation::kTagged, match_info,
                                 var_to_offset.value(), smi_value);
             Increment(&var_to_offset, kPointerSize);
@@ -766,10 +761,9 @@ Node* RegExpBuiltinsAssembler::RegExpPrototypeExecBodyWithoutResult(
 
 // ES#sec-regexp.prototype.exec
 // RegExp.prototype.exec ( string )
-Node* RegExpBuiltinsAssembler::RegExpPrototypeExecBody(Node* const context,
-                                                       Node* const regexp,
-                                                       Node* const string,
-                                                       const bool is_fastpath) {
+Node* RegExpBuiltinsAssembler::RegExpPrototypeExecBody(
+    Node* const context, Node* const regexp, TNode<String> const string,
+    const bool is_fastpath) {
   VARIABLE(var_result, MachineRepresentation::kTagged);
 
   Label if_didnotmatch(this), out(this);
@@ -944,7 +938,7 @@ void RegExpBuiltinsAssembler::BranchIfFastRegExpResult(Node* const context,
 // Slow path stub for RegExpPrototypeExec to decrease code size.
 TF_BUILTIN(RegExpPrototypeExecSlow, RegExpBuiltinsAssembler) {
   Node* const regexp = Parameter(Descriptor::kReceiver);
-  Node* const string = Parameter(Descriptor::kString);
+  TNode<String> const string = CAST(Parameter(Descriptor::kString));
   Node* const context = Parameter(Descriptor::kContext);
 
   Return(RegExpPrototypeExecBody(context, regexp, string, false));
@@ -1030,7 +1024,7 @@ TF_BUILTIN(RegExpPrototypeExec, RegExpBuiltinsAssembler) {
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
-  Node* const string = ToString_Inline(context, maybe_string);
+  TNode<String> const string = ToString_Inline(context, maybe_string);
 
   Label if_isfastpath(this), if_isslowpath(this);
   Branch(IsFastRegExpNoPrototype(context, receiver), &if_isfastpath,
@@ -1069,13 +1063,13 @@ Node* RegExpBuiltinsAssembler::FlagsGetter(Node* const context,
     Node* const flags_smi = LoadObjectField(regexp, JSRegExp::kFlagsOffset);
     var_flags = SmiUntag(flags_smi);
 
-#define CASE_FOR_FLAG(FLAG)                          \
-  do {                                               \
-    Label next(this);                                \
-    GotoIfNot(IsSetWord(var_flags, FLAG), &next);    \
-    var_length = SmiAdd(var_length, SmiConstant(1)); \
-    Goto(&next);                                     \
-    BIND(&next);                                     \
+#define CASE_FOR_FLAG(FLAG)                                  \
+  do {                                                       \
+    Label next(this);                                        \
+    GotoIfNot(IsSetWord(var_flags.value(), FLAG), &next);    \
+    var_length = SmiAdd(var_length.value(), SmiConstant(1)); \
+    Goto(&next);                                             \
+    BIND(&next);                                             \
   } while (false)
 
     CASE_FOR_FLAG(JSRegExp::kGlobal);
@@ -1099,8 +1093,8 @@ Node* RegExpBuiltinsAssembler::FlagsGetter(Node* const context,
     Label if_isflagset(this);                                              \
     BranchIfToBooleanIsTrue(flag, &if_isflagset, &next);                   \
     BIND(&if_isflagset);                                                   \
-    var_length = SmiAdd(var_length, SmiConstant(1));                       \
-    var_flags = Signed(WordOr(var_flags, IntPtrConstant(FLAG)));           \
+    var_length = SmiAdd(var_length.value(), SmiConstant(1));               \
+    var_flags = Signed(WordOr(var_flags.value(), IntPtrConstant(FLAG)));   \
     Goto(&next);                                                           \
     BIND(&next);                                                           \
   } while (false)
@@ -1118,7 +1112,7 @@ Node* RegExpBuiltinsAssembler::FlagsGetter(Node* const context,
   // char for each set flag.
 
   {
-    Node* const result = AllocateSeqOneByteString(context, var_length);
+    Node* const result = AllocateSeqOneByteString(context, var_length.value());
 
     VARIABLE(var_offset, MachineType::PointerRepresentation(),
              IntPtrConstant(SeqOneByteString::kHeaderSize - kHeapObjectTag));
@@ -1126,7 +1120,7 @@ Node* RegExpBuiltinsAssembler::FlagsGetter(Node* const context,
 #define CASE_FOR_FLAG(FLAG, CHAR)                              \
   do {                                                         \
     Label next(this);                                          \
-    GotoIfNot(IsSetWord(var_flags, FLAG), &next);              \
+    GotoIfNot(IsSetWord(var_flags.value(), FLAG), &next);      \
     Node* const value = Int32Constant(CHAR);                   \
     StoreNoWriteBarrier(MachineRepresentation::kWord8, result, \
                         var_offset.value(), value);            \
@@ -1191,16 +1185,14 @@ Node* RegExpBuiltinsAssembler::RegExpInitialize(Node* const context,
   CSA_ASSERT(this, IsJSRegExp(regexp));
 
   // Normalize pattern.
-  Node* const pattern = Select<Object>(
+  TNode<Object> const pattern = Select<Object>(
       IsUndefined(maybe_pattern), [=] { return EmptyStringConstant(); },
-      [=] { return ToString_Inline(context, maybe_pattern); },
-      MachineRepresentation::kTagged);
+      [=] { return ToString_Inline(context, maybe_pattern); });
 
   // Normalize flags.
-  Node* const flags = Select<Object>(
+  TNode<Object> const flags = Select<Object>(
       IsUndefined(maybe_flags), [=] { return EmptyStringConstant(); },
-      [=] { return ToString_Inline(context, maybe_flags); },
-      MachineRepresentation::kTagged);
+      [=] { return ToString_Inline(context, maybe_flags); });
 
   // Initialize.
 
@@ -1384,8 +1376,7 @@ TF_BUILTIN(RegExpPrototypeCompile, RegExpBuiltinsAssembler) {
       Label next(this);
       GotoIf(IsUndefined(maybe_flags), &next);
 
-      Node* const message_id = SmiConstant(MessageTemplate::kRegExpFlags);
-      TailCallRuntime(Runtime::kThrowTypeError, context, message_id);
+      ThrowTypeError(context, MessageTemplate::kRegExpFlags);
 
       BIND(&next);
     }
@@ -1450,12 +1441,8 @@ TF_BUILTIN(RegExpPrototypeSourceGetter, RegExpBuiltinsAssembler) {
 
     BIND(&if_isnotprototype);
     {
-      Node* const message_id = SmiConstant(MessageTemplate::kRegExpNonRegExp);
-      Node* const method_name_str =
-          HeapConstant(isolate->factory()->NewStringFromAsciiChecked(
-              "RegExp.prototype.source"));
-      TailCallRuntime(Runtime::kThrowTypeError, context, message_id,
-                      method_name_str);
+      ThrowTypeError(context, MessageTemplate::kRegExpNonRegExp,
+                     "RegExp.prototype.source");
     }
   }
 }
@@ -1465,7 +1452,7 @@ Node* RegExpBuiltinsAssembler::FastFlagGetter(Node* const regexp,
                                               JSRegExp::Flag flag) {
   Node* const flags = LoadObjectField(regexp, JSRegExp::kFlagsOffset);
   Node* const mask = SmiConstant(flag);
-  return SmiToWord32(SmiAnd(flags, mask));
+  return SmiToInt32(SmiAnd(flags, mask));
 }
 
 // Load through the GetProperty stub.
@@ -1533,8 +1520,6 @@ Node* RegExpBuiltinsAssembler::FlagGetter(Node* const context,
 void RegExpBuiltinsAssembler::FlagGetter(Node* context, Node* receiver,
                                          JSRegExp::Flag flag, int counter,
                                          const char* method_name) {
-  Isolate* isolate = this->isolate();
-
   // Check whether we have an unmodified regexp instance.
   Label if_isunmodifiedjsregexp(this),
       if_isnotunmodifiedjsregexp(this, Label::kDeferred);
@@ -1573,14 +1558,7 @@ void RegExpBuiltinsAssembler::FlagGetter(Node* context, Node* receiver,
     }
 
     BIND(&if_isnotprototype);
-    {
-      Node* const message_id = SmiConstant(MessageTemplate::kRegExpNonRegExp);
-      Node* const method_name_str = HeapConstant(
-          isolate->factory()->NewStringFromAsciiChecked(method_name));
-      CallRuntime(Runtime::kThrowTypeError, context, message_id,
-                  method_name_str);
-      Unreachable();
-    }
+    { ThrowTypeError(context, MessageTemplate::kRegExpNonRegExp, method_name); }
   }
 }
 
@@ -1707,7 +1685,7 @@ TF_BUILTIN(RegExpPrototypeTest, RegExpBuiltinsAssembler) {
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
-  Node* const string = ToString_Inline(context, maybe_string);
+  TNode<String> const string = ToString_Inline(context, maybe_string);
 
   Label fast_path(this), slow_path(this);
   BranchIfFastRegExp(context, receiver, &fast_path, &slow_path);
@@ -1795,163 +1773,14 @@ Node* RegExpBuiltinsAssembler::AdvanceStringIndex(Node* const string,
   return var_result.value();
 }
 
-namespace {
-
-// Utility class implementing a growable fixed array through CSA.
-class GrowableFixedArray {
-  typedef CodeStubAssembler::Label Label;
-  typedef CodeStubAssembler::Variable Variable;
-
- public:
-  explicit GrowableFixedArray(CodeStubAssembler* a)
-      : assembler_(a),
-        var_array_(a, MachineRepresentation::kTagged),
-        var_length_(a, MachineType::PointerRepresentation()),
-        var_capacity_(a, MachineType::PointerRepresentation()) {
-    Initialize();
-  }
-
-  Node* length() const { return var_length_.value(); }
-
-  Variable* var_array() { return &var_array_; }
-  Variable* var_length() { return &var_length_; }
-  Variable* var_capacity() { return &var_capacity_; }
-
-  void Push(Node* const value) {
-    CodeStubAssembler* a = assembler_;
-
-    Node* const length = var_length_.value();
-    Node* const capacity = var_capacity_.value();
-
-    Label grow(a), store(a);
-    a->Branch(a->IntPtrEqual(capacity, length), &grow, &store);
-
-    a->BIND(&grow);
-    {
-      Node* const new_capacity = NewCapacity(a, capacity);
-      Node* const new_array = ResizeFixedArray(length, new_capacity);
-
-      var_capacity_.Bind(new_capacity);
-      var_array_.Bind(new_array);
-      a->Goto(&store);
-    }
-
-    a->BIND(&store);
-    {
-      Node* const array = var_array_.value();
-      a->StoreFixedArrayElement(array, length, value);
-
-      Node* const new_length = a->IntPtrAdd(length, a->IntPtrConstant(1));
-      var_length_.Bind(new_length);
-    }
-  }
-
-  Node* ToJSArray(Node* const context) {
-    CodeStubAssembler* a = assembler_;
-
-    const ElementsKind kind = PACKED_ELEMENTS;
-
-    Node* const native_context = a->LoadNativeContext(context);
-    Node* const array_map = a->LoadJSArrayElementsMap(kind, native_context);
-
-    // Shrink to fit if necessary.
-    {
-      Label next(a);
-
-      Node* const length = var_length_.value();
-      Node* const capacity = var_capacity_.value();
-
-      a->GotoIf(a->WordEqual(length, capacity), &next);
-
-      Node* const array = ResizeFixedArray(length, length);
-      var_array_.Bind(array);
-      var_capacity_.Bind(length);
-      a->Goto(&next);
-
-      a->BIND(&next);
-    }
-
-    Node* const result_length = a->SmiTag(length());
-    Node* const result = a->AllocateUninitializedJSArrayWithoutElements(
-        array_map, result_length, nullptr);
-
-    // Note: We do not currently shrink the fixed array.
-
-    a->StoreObjectField(result, JSObject::kElementsOffset, var_array_.value());
-
-    return result;
-  }
-
- private:
-  void Initialize() {
-    CodeStubAssembler* a = assembler_;
-
-    const ElementsKind kind = PACKED_ELEMENTS;
-
-    static const int kInitialArraySize = 8;
-    Node* const capacity = a->IntPtrConstant(kInitialArraySize);
-    Node* const array = a->AllocateFixedArray(kind, capacity);
-
-    a->FillFixedArrayWithValue(kind, array, a->IntPtrConstant(0), capacity,
-                               Heap::kTheHoleValueRootIndex);
-
-    var_array_.Bind(array);
-    var_capacity_.Bind(capacity);
-    var_length_.Bind(a->IntPtrConstant(0));
-  }
-
-  Node* NewCapacity(CodeStubAssembler* a,
-                    compiler::SloppyTNode<IntPtrT> current_capacity) {
-    CSA_ASSERT(a, a->IntPtrGreaterThan(current_capacity, a->IntPtrConstant(0)));
-
-    // Growth rate is analog to JSObject::NewElementsCapacity:
-    // new_capacity = (current_capacity + (current_capacity >> 1)) + 16.
-
-    Node* const new_capacity = a->IntPtrAdd(
-        a->IntPtrAdd(current_capacity, a->WordShr(current_capacity, 1)),
-        a->IntPtrConstant(16));
-
-    return new_capacity;
-  }
-
-  // Creates a new array with {new_capacity} and copies the first
-  // {element_count} elements from the current array.
-  Node* ResizeFixedArray(Node* const element_count, Node* const new_capacity) {
-    CodeStubAssembler* a = assembler_;
-
-    CSA_ASSERT(a, a->IntPtrGreaterThan(element_count, a->IntPtrConstant(0)));
-    CSA_ASSERT(a, a->IntPtrGreaterThan(new_capacity, a->IntPtrConstant(0)));
-    CSA_ASSERT(a, a->IntPtrGreaterThanOrEqual(new_capacity, element_count));
-
-    Node* const from_array = var_array_.value();
-
-    CodeStubAssembler::ExtractFixedArrayFlags flags;
-    flags |= CodeStubAssembler::ExtractFixedArrayFlag::kFixedArrays;
-    Node* to_array = a->ExtractFixedArray(from_array, nullptr, element_count,
-                                          new_capacity, flags);
-
-    return to_array;
-  }
-
- private:
-  CodeStubAssembler* const assembler_;
-  Variable var_array_;
-  Variable var_length_;
-  Variable var_capacity_;
-};
-
-}  // namespace
-
 void RegExpBuiltinsAssembler::RegExpPrototypeMatchBody(Node* const context,
                                                        Node* const regexp,
-                                                       Node* const string,
+                                                       TNode<String> string,
                                                        const bool is_fastpath) {
-  CSA_ASSERT(this, IsString(string));
   if (is_fastpath) CSA_ASSERT(this, IsFastRegExp(context, regexp));
 
   Node* const int_zero = IntPtrConstant(0);
   Node* const smi_zero = SmiConstant(0);
-
   Node* const is_global =
       FlagGetter(context, regexp, JSRegExp::kGlobal, is_fastpath);
 
@@ -1975,7 +1804,7 @@ void RegExpBuiltinsAssembler::RegExpPrototypeMatchBody(Node* const context,
 
     // Allocate an array to store the resulting match strings.
 
-    GrowableFixedArray array(this);
+    GrowableFixedArray array(state());
 
     // Loop preparations. Within the loop, collect results from RegExpExec
     // and store match strings in the array.
@@ -2001,9 +1830,8 @@ void RegExpBuiltinsAssembler::RegExpPrototypeMatchBody(Node* const context,
         Node* const match_to = LoadFixedArrayElement(
             match_indices, RegExpMatchInfo::kFirstCaptureIndex + 1);
 
-        Node* match = SubString(context, string, match_from, match_to);
-        var_match.Bind(match);
-
+        var_match.Bind(
+            SubString(string, SmiUntag(match_from), SmiUntag(match_to)));
         Goto(&if_didmatch);
       } else {
         DCHECK(!is_fastpath);
@@ -2052,7 +1880,7 @@ void RegExpBuiltinsAssembler::RegExpPrototypeMatchBody(Node* const context,
 
         // Store the match, growing the fixed array if needed.
 
-        array.Push(match);
+        array.Push(CAST(match));
 
         // Advance last index if the match is the empty string.
 
@@ -2087,7 +1915,7 @@ void RegExpBuiltinsAssembler::RegExpPrototypeMatchBody(Node* const context,
     {
       // Wrap the match in a JSArray.
 
-      Node* const result = array.ToJSArray(context);
+      Node* const result = array.ToJSArray(CAST(context));
       Return(result);
     }
   }
@@ -2107,7 +1935,7 @@ TF_BUILTIN(RegExpPrototypeMatch, RegExpBuiltinsAssembler) {
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
-  Node* const string = ToString_Inline(context, maybe_string);
+  TNode<String> const string = ToString_Inline(context, maybe_string);
 
   Label fast_path(this), slow_path(this);
   BranchIfFastRegExp(context, receiver, &fast_path, &slow_path);
@@ -2126,7 +1954,7 @@ TF_BUILTIN(RegExpPrototypeMatch, RegExpBuiltinsAssembler) {
 // 2) pattern is a string
 TF_BUILTIN(RegExpMatchFast, RegExpBuiltinsAssembler) {
   Node* const receiver = Parameter(Descriptor::kReceiver);
-  Node* const string = Parameter(Descriptor::kPattern);
+  TNode<String> const string = CAST(Parameter(Descriptor::kPattern));
   Node* const context = Parameter(Descriptor::kContext);
 
   RegExpPrototypeMatchBody(context, receiver, string, true);
@@ -2248,7 +2076,7 @@ TF_BUILTIN(RegExpPrototypeSearch, RegExpBuiltinsAssembler) {
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
-  Node* const string = ToString_Inline(context, maybe_string);
+  TNode<String> const string = ToString_Inline(context, maybe_string);
 
   Label fast_path(this), slow_path(this);
   BranchIfFastRegExp(context, receiver, &fast_path, &slow_path);
@@ -2277,12 +2105,11 @@ TF_BUILTIN(RegExpSearchFast, RegExpBuiltinsAssembler) {
 // JSRegExp, {string} is a String, and {limit} is a Smi.
 void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
                                                        Node* const regexp,
-                                                       Node* const string,
+                                                       TNode<String> string,
                                                        Node* const limit) {
   CSA_ASSERT(this, IsFastRegExp(context, regexp));
   CSA_ASSERT(this, Word32BinaryNot(FastFlagGetter(regexp, JSRegExp::kSticky)));
   CSA_ASSERT(this, TaggedIsSmi(limit));
-  CSA_ASSERT(this, IsString(string));
 
   TNode<Smi> const smi_zero = SmiConstant(0);
   TNode<IntPtrT> const int_zero = IntPtrConstant(0);
@@ -2343,7 +2170,7 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
 
   // Loop preparations.
 
-  GrowableFixedArray array(this);
+  GrowableFixedArray array(state());
 
   VARIABLE(var_last_matched_until, MachineRepresentation::kTagged);
   VARIABLE(var_next_search_from, MachineRepresentation::kTagged);
@@ -2422,10 +2249,7 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
     {
       Node* const from = last_matched_until;
       Node* const to = match_from;
-
-      Node* const substr = SubString(context, string, from, to);
-      array.Push(substr);
-
+      array.Push(SubString(string, SmiUntag(from), SmiUntag(to)));
       GotoIf(WordEqual(array.length(), int_limit), &out);
     }
 
@@ -2462,21 +2286,19 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
 
         BIND(&select_capture);
         {
-          Node* const substr = SubString(context, string, from, to);
-          var_value.Bind(substr);
+          var_value.Bind(SubString(string, SmiUntag(from), SmiUntag(to)));
           Goto(&store_value);
         }
 
         BIND(&select_undefined);
         {
-          Node* const undefined = UndefinedConstant();
-          var_value.Bind(undefined);
+          var_value.Bind(UndefinedConstant());
           Goto(&store_value);
         }
 
         BIND(&store_value);
         {
-          array.Push(var_value.value());
+          array.Push(CAST(var_value.value()));
           GotoIf(WordEqual(array.length(), int_limit), &out);
 
           Node* const new_reg = IntPtrAdd(reg, IntPtrConstant(2));
@@ -2499,16 +2321,13 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
   {
     Node* const from = var_last_matched_until.value();
     Node* const to = string_length;
-
-    Node* const substr = SubString(context, string, from, to);
-    array.Push(substr);
-
+    array.Push(SubString(string, SmiUntag(from), SmiUntag(to)));
     Goto(&out);
   }
 
   BIND(&out);
   {
-    Node* const result = array.ToJSArray(context);
+    Node* const result = array.ToJSArray(CAST(context));
     Return(result);
   }
 
@@ -2525,12 +2344,11 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
 // Helper that skips a few initial checks.
 TF_BUILTIN(RegExpSplit, RegExpBuiltinsAssembler) {
   Node* const regexp = Parameter(Descriptor::kRegExp);
-  Node* const string = Parameter(Descriptor::kString);
+  TNode<String> const string = CAST(Parameter(Descriptor::kString));
   Node* const maybe_limit = Parameter(Descriptor::kLimit);
   Node* const context = Parameter(Descriptor::kContext);
 
   CSA_ASSERT(this, IsFastRegExp(context, regexp));
-  CSA_ASSERT(this, IsString(string));
 
   // TODO(jgruber): Even if map checks send us to the fast path, we still need
   // to verify the constructor property and jump to the slow path if it has
@@ -2600,7 +2418,7 @@ TF_BUILTIN(RegExpPrototypeSplit, RegExpBuiltinsAssembler) {
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
-  Node* const string = ToString_Inline(context, maybe_string);
+  TNode<String> const string = ToString_Inline(context, maybe_string);
 
   Label stub(this), runtime(this, Label::kDeferred);
   BranchIfFastRegExp(context, receiver, &stub, &runtime);
@@ -2700,9 +2518,9 @@ Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
     Goto(&loop);
     BIND(&loop);
     {
-      GotoIfNot(IntPtrLessThan(var_i, end), &create_result);
+      GotoIfNot(IntPtrLessThan(var_i.value(), end), &create_result);
 
-      Node* const elem = LoadFixedArrayElement(res_elems, var_i);
+      Node* const elem = LoadFixedArrayElement(res_elems, var_i.value());
 
       Label if_issmi(this), if_isstring(this), loop_epilogue(this);
       Branch(TaggedIsSmi(elem), &if_issmi, &if_isstring);
@@ -2726,9 +2544,10 @@ Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
 
         BIND(&if_isnegativeorzero);
         {
-          var_i = IntPtrAdd(var_i, int_one);
+          var_i = IntPtrAdd(var_i.value(), int_one);
 
-          Node* const next_elem = LoadFixedArrayElement(res_elems, var_i);
+          Node* const next_elem =
+              LoadFixedArrayElement(res_elems, var_i.value());
 
           var_match_start = SmiSub(next_elem, elem);
           Goto(&loop_epilogue);
@@ -2740,13 +2559,14 @@ Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
         CSA_ASSERT(this, IsString(elem));
 
         Callable call_callable = CodeFactory::Call(isolate);
-        TNode<Smi> match_start = var_match_start;
+        TNode<Smi> match_start = var_match_start.value();
         Node* const replacement_obj =
             CallJS(call_callable, context, replace_callable, undefined, elem,
                    match_start, string);
 
-        Node* const replacement_str = ToString_Inline(context, replacement_obj);
-        StoreFixedArrayElement(res_elems, var_i, replacement_str);
+        TNode<String> const replacement_str =
+            ToString_Inline(context, replacement_obj);
+        StoreFixedArrayElement(res_elems, var_i.value(), replacement_str);
 
         TNode<Smi> const elem_length = LoadStringLengthAsSmi(elem);
         var_match_start = SmiAdd(match_start, elem_length);
@@ -2756,7 +2576,7 @@ Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
 
       BIND(&loop_epilogue);
       {
-        var_i = IntPtrAdd(var_i, int_one);
+        var_i = IntPtrAdd(var_i.value(), int_one);
         Goto(&loop);
       }
     }
@@ -2795,7 +2615,7 @@ Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
                     // Overwrite the i'th element in the results with the string
                     // we got back from the callback function.
 
-                    Node* const replacement_str =
+                    TNode<String> const replacement_str =
                         ToString_Inline(context, replacement_obj);
                     StoreFixedArrayElement(res_elems, index, replacement_str);
 
@@ -2821,20 +2641,19 @@ Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
 }
 
 Node* RegExpBuiltinsAssembler::ReplaceSimpleStringFastPath(
-    Node* context, Node* regexp, Node* string, Node* replace_string) {
+    Node* context, Node* regexp, TNode<String> string,
+    TNode<String> replace_string) {
   // The fast path is reached only if {receiver} is an unmodified
   // JSRegExp instance, {replace_value} is non-callable, and
   // ToString({replace_value}) does not contain '$', i.e. we're doing a simple
   // string replacement.
 
+  CSA_ASSERT(this, IsFastRegExp(context, regexp));
+
   Node* const smi_zero = SmiConstant(0);
   const bool kIsFastPath = true;
 
-  CSA_ASSERT(this, IsFastRegExp(context, regexp));
-  CSA_ASSERT(this, IsString(replace_string));
-  CSA_ASSERT(this, IsString(string));
-
-  VARIABLE(var_result, MachineRepresentation::kTagged, EmptyStringConstant());
+  TVARIABLE(String, var_result, EmptyStringConstant());
   VARIABLE(var_match_indices, MachineRepresentation::kTagged);
   VARIABLE(var_last_match_end, MachineRepresentation::kTagged, smi_zero);
   VARIABLE(var_is_unicode, MachineRepresentation::kWord32, Int32Constant(0));
@@ -2871,22 +2690,21 @@ Node* RegExpBuiltinsAssembler::ReplaceSimpleStringFastPath(
       {
         // TODO(jgruber): We could skip many of the checks that using SubString
         // here entails.
-        Node* const first_part =
-            SubString(context, string, var_last_match_end.value(), match_start);
-
-        Node* const result = StringAdd(context, var_result.value(), first_part);
-        var_result.Bind(result);
+        TNode<String> const first_part =
+            SubString(string, SmiUntag(var_last_match_end.value()),
+                      SmiUntag(match_start));
+        var_result = StringAdd(context, var_result.value(), first_part);
         Goto(&loop_end);
       }
 
       BIND(&if_replaceisnotempty);
       {
-        Node* const first_part =
-            SubString(context, string, var_last_match_end.value(), match_start);
-
-        Node* result = StringAdd(context, var_result.value(), first_part);
-        result = StringAdd(context, result, replace_string);
-        var_result.Bind(result);
+        TNode<String> const first_part =
+            SubString(string, SmiUntag(var_last_match_end.value()),
+                      SmiUntag(match_start));
+        TNode<String> result =
+            StringAdd(context, var_result.value(), first_part);
+        var_result = StringAdd(context, result, replace_string);
         Goto(&loop_end);
       }
 
@@ -2910,10 +2728,9 @@ Node* RegExpBuiltinsAssembler::ReplaceSimpleStringFastPath(
   BIND(&if_nofurthermatches);
   {
     TNode<Smi> const string_length = LoadStringLengthAsSmi(string);
-    Node* const last_part =
-        SubString(context, string, var_last_match_end.value(), string_length);
-    Node* const result = StringAdd(context, var_result.value(), last_part);
-    var_result.Bind(result);
+    TNode<String> const last_part = SubString(
+        string, SmiUntag(var_last_match_end.value()), SmiUntag(string_length));
+    var_result = StringAdd(context, var_result.value(), last_part);
     Goto(&out);
   }
 
@@ -2924,12 +2741,11 @@ Node* RegExpBuiltinsAssembler::ReplaceSimpleStringFastPath(
 // Helper that skips a few initial checks.
 TF_BUILTIN(RegExpReplace, RegExpBuiltinsAssembler) {
   Node* const regexp = Parameter(Descriptor::kRegExp);
-  Node* const string = Parameter(Descriptor::kString);
+  TNode<String> const string = CAST(Parameter(Descriptor::kString));
   Node* const replace_value = Parameter(Descriptor::kReplaceValue);
   Node* const context = Parameter(Descriptor::kContext);
 
   CSA_ASSERT(this, IsFastRegExp(context, regexp));
-  CSA_ASSERT(this, IsString(string));
 
   Label checkreplacestring(this), if_iscallable(this),
       runtime(this, Label::kDeferred);
@@ -2942,7 +2758,8 @@ TF_BUILTIN(RegExpReplace, RegExpBuiltinsAssembler) {
   // 3. Does ToString({replace_value}) contain '$'?
   BIND(&checkreplacestring);
   {
-    Node* const replace_string = ToString_Inline(context, replace_value);
+    TNode<String> const replace_string =
+        ToString_Inline(context, replace_value);
 
     // ToString(replaceValue) could potentially change the shape of the RegExp
     // object. Recheck that we are still on the fast path and bail to runtime
@@ -3028,7 +2845,7 @@ TF_BUILTIN(RegExpPrototypeReplace, RegExpBuiltinsAssembler) {
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
-  Node* const string = ToString_Inline(context, maybe_string);
+  TNode<String> const string = ToString_Inline(context, maybe_string);
 
   // Fast-path checks: 1. Is the {receiver} an unmodified JSRegExp instance?
   Label stub(this), runtime(this, Label::kDeferred);
@@ -3046,27 +2863,19 @@ TF_BUILTIN(RegExpPrototypeReplace, RegExpBuiltinsAssembler) {
 // Simple string matching functionality for internal use which does not modify
 // the last match info.
 TF_BUILTIN(RegExpInternalMatch, RegExpBuiltinsAssembler) {
-  Node* const regexp = Parameter(Descriptor::kRegExp);
-  Node* const string = Parameter(Descriptor::kString);
+  TNode<JSRegExp> const regexp = CAST(Parameter(Descriptor::kRegExp));
+  TNode<String> const string = CAST(Parameter(Descriptor::kString));
   Node* const context = Parameter(Descriptor::kContext);
 
   Node* const smi_zero = SmiConstant(0);
-
-  CSA_ASSERT(this, IsJSRegExp(regexp));
-  CSA_ASSERT(this, IsString(string));
-
   Node* const native_context = LoadNativeContext(context);
   Node* const internal_match_info = LoadContextElement(
       native_context, Context::REGEXP_INTERNAL_MATCH_INFO_INDEX);
-
   Node* const match_indices = RegExpExecInternal(context, regexp, string,
                                                  smi_zero, internal_match_info);
-
   Node* const null = NullConstant();
-  Label if_matched(this), if_didnotmatch(this);
-  Branch(WordEqual(match_indices, null), &if_didnotmatch, &if_matched);
-
-  BIND(&if_didnotmatch);
+  Label if_matched(this);
+  GotoIfNot(WordEqual(match_indices, null), &if_matched);
   Return(null);
 
   BIND(&if_matched);
diff --git a/deps/v8/src/builtins/builtins-regexp-gen.h b/deps/v8/src/builtins/builtins-regexp-gen.h
index c8a94b7293c..b57b90acf96 100644
--- a/deps/v8/src/builtins/builtins-regexp-gen.h
+++ b/deps/v8/src/builtins/builtins-regexp-gen.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_BUILTINS_BUILTINS_REGEXP_H_
-#define V8_BUILTINS_BUILTINS_REGEXP_H_
+#ifndef V8_BUILTINS_BUILTINS_REGEXP_GEN_H_
+#define V8_BUILTINS_BUILTINS_REGEXP_GEN_H_
 
 #include "src/code-stub-assembler.h"
 
@@ -50,7 +50,7 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
 
   Node* ConstructNewResultFromMatchInfo(Node* const context, Node* const regexp,
                                         Node* const match_info,
-                                        Node* const string);
+                                        TNode<String> const string);
 
   Node* RegExpPrototypeExecBodyWithoutResult(Node* const context,
                                              Node* const regexp,
@@ -58,7 +58,7 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
                                              Label* if_didnotmatch,
                                              const bool is_fastpath);
   Node* RegExpPrototypeExecBody(Node* const context, Node* const regexp,
-                                Node* const string, const bool is_fastpath);
+                                TNode<String> string, const bool is_fastpath);
 
   Node* ThrowIfNotJSReceiver(Node* context, Node* maybe_receiver,
                              MessageTemplate::Template msg_template,
@@ -100,7 +100,8 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
                            Node* const is_unicode, bool is_fastpath);
 
   void RegExpPrototypeMatchBody(Node* const context, Node* const regexp,
-                                Node* const string, const bool is_fastpath);
+                                TNode<String> const string,
+                                const bool is_fastpath);
 
   void RegExpPrototypeSearchBodyFast(Node* const context, Node* const regexp,
                                      Node* const string);
@@ -108,15 +109,16 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
                                      Node* const string);
 
   void RegExpPrototypeSplitBody(Node* const context, Node* const regexp,
-                                Node* const string, Node* const limit);
+                                TNode<String> const string, Node* const limit);
 
   Node* ReplaceGlobalCallableFastPath(Node* context, Node* regexp, Node* string,
                                       Node* replace_callable);
-  Node* ReplaceSimpleStringFastPath(Node* context, Node* regexp, Node* string,
-                                    Node* replace_string);
+  Node* ReplaceSimpleStringFastPath(Node* context, Node* regexp,
+                                    TNode<String> string,
+                                    TNode<String> replace_string);
 };
 
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_BUILTINS_BUILTINS_REGEXP_H_
+#endif  // V8_BUILTINS_BUILTINS_REGEXP_GEN_H_
diff --git a/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc b/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc
index 278a48c68e9..2c9f0791dad 100644
--- a/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc
+++ b/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc
@@ -69,9 +69,8 @@ void SharedArrayBufferBuiltinsAssembler::ValidateSharedTypedArray(
 
   BIND(&invalid);
   {
-    CallRuntime(Runtime::kThrowNotIntegerSharedTypedArrayError, context,
-                tagged);
-    Unreachable();
+    ThrowTypeError(context, MessageTemplate::kNotIntegerSharedTypedArray,
+                   tagged);
   }
 
   BIND(&not_float_or_clamped);
@@ -96,15 +95,12 @@ Node* SharedArrayBufferBuiltinsAssembler::ConvertTaggedAtomicIndexToWord32(
   // The |number_index| output parameter is used only for architectures that
   // don't currently have a TF implementation and forward to runtime functions
   // instead; they expect the value has already been coerced to an integer.
-  *number_index = ToSmiIndex(tagged, context, &range_error);
-  var_result.Bind(SmiToWord32(*number_index));
+  *number_index = ToSmiIndex(CAST(tagged), CAST(context), &range_error);
+  var_result.Bind(SmiToInt32(*number_index));
   Goto(&done);
 
   BIND(&range_error);
-  {
-    CallRuntime(Runtime::kThrowInvalidAtomicAccessIndexError, context);
-    Unreachable();
-  }
+  { ThrowRangeError(context, MessageTemplate::kInvalidAtomicAccessIndex); }
 
   BIND(&done);
   return var_result.value();
@@ -119,8 +115,7 @@ void SharedArrayBufferBuiltinsAssembler::ValidateAtomicIndex(Node* array,
       context, LoadObjectField(array, JSTypedArray::kLengthOffset));
   GotoIf(Uint32LessThan(index_word, array_length_word32), &check_passed);
 
-  CallRuntime(Runtime::kThrowInvalidAtomicAccessIndexError, context);
-  Unreachable();
+  ThrowRangeError(context, MessageTemplate::kInvalidAtomicAccessIndex);
 
   BIND(&check_passed);
 }
@@ -169,20 +164,20 @@ TF_BUILTIN(AtomicsLoad, SharedArrayBufferBuiltinsAssembler) {
          arraysize(case_labels));
 
   BIND(&i8);
-  Return(SmiFromWord32(
-      AtomicLoad(MachineType::Int8(), backing_store, index_word)));
+  Return(
+      SmiFromInt32(AtomicLoad(MachineType::Int8(), backing_store, index_word)));
 
   BIND(&u8);
-  Return(SmiFromWord32(
+  Return(SmiFromInt32(
       AtomicLoad(MachineType::Uint8(), backing_store, index_word)));
 
   BIND(&i16);
-  Return(SmiFromWord32(
+  Return(SmiFromInt32(
       AtomicLoad(MachineType::Int16(), backing_store, WordShl(index_word, 1))));
 
   BIND(&u16);
-  Return(SmiFromWord32(AtomicLoad(MachineType::Uint16(), backing_store,
-                                  WordShl(index_word, 1))));
+  Return(SmiFromInt32(AtomicLoad(MachineType::Uint16(), backing_store,
+                                 WordShl(index_word, 1))));
 
   BIND(&i32);
   Return(ChangeInt32ToTagged(
@@ -293,20 +288,20 @@ TF_BUILTIN(AtomicsExchange, SharedArrayBufferBuiltinsAssembler) {
          arraysize(case_labels));
 
   BIND(&i8);
-  Return(SmiFromWord32(AtomicExchange(MachineType::Int8(), backing_store,
-                                      index_word, value_word32)));
+  Return(SmiFromInt32(AtomicExchange(MachineType::Int8(), backing_store,
+                                     index_word, value_word32)));
 
   BIND(&u8);
-  Return(SmiFromWord32(AtomicExchange(MachineType::Uint8(), backing_store,
-                                      index_word, value_word32)));
+  Return(SmiFromInt32(AtomicExchange(MachineType::Uint8(), backing_store,
+                                     index_word, value_word32)));
 
   BIND(&i16);
-  Return(SmiFromWord32(AtomicExchange(MachineType::Int16(), backing_store,
-                                      WordShl(index_word, 1), value_word32)));
+  Return(SmiFromInt32(AtomicExchange(MachineType::Int16(), backing_store,
+                                     WordShl(index_word, 1), value_word32)));
 
   BIND(&u16);
-  Return(SmiFromWord32(AtomicExchange(MachineType::Uint16(), backing_store,
-                                      WordShl(index_word, 1), value_word32)));
+  Return(SmiFromInt32(AtomicExchange(MachineType::Uint16(), backing_store,
+                                     WordShl(index_word, 1), value_word32)));
 
   BIND(&i32);
   Return(ChangeInt32ToTagged(AtomicExchange(MachineType::Int32(), backing_store,
@@ -371,22 +366,22 @@ TF_BUILTIN(AtomicsCompareExchange, SharedArrayBufferBuiltinsAssembler) {
          arraysize(case_labels));
 
   BIND(&i8);
-  Return(SmiFromWord32(AtomicCompareExchange(MachineType::Int8(), backing_store,
-                                             index_word, old_value_word32,
-                                             new_value_word32)));
+  Return(SmiFromInt32(AtomicCompareExchange(MachineType::Int8(), backing_store,
+                                            index_word, old_value_word32,
+                                            new_value_word32)));
 
   BIND(&u8);
-  Return(SmiFromWord32(
-      AtomicCompareExchange(MachineType::Uint8(), backing_store, index_word,
-                            old_value_word32, new_value_word32)));
+  Return(SmiFromInt32(AtomicCompareExchange(MachineType::Uint8(), backing_store,
+                                            index_word, old_value_word32,
+                                            new_value_word32)));
 
   BIND(&i16);
-  Return(SmiFromWord32(AtomicCompareExchange(
+  Return(SmiFromInt32(AtomicCompareExchange(
       MachineType::Int16(), backing_store, WordShl(index_word, 1),
       old_value_word32, new_value_word32)));
 
   BIND(&u16);
-  Return(SmiFromWord32(AtomicCompareExchange(
+  Return(SmiFromInt32(AtomicCompareExchange(
       MachineType::Uint16(), backing_store, WordShl(index_word, 1),
       old_value_word32, new_value_word32)));
 
@@ -468,22 +463,20 @@ void SharedArrayBufferBuiltinsAssembler::AtomicBinopBuiltinCommon(
          arraysize(case_labels));
 
   BIND(&i8);
-  Return(SmiFromWord32((this->*function)(MachineType::Int8(), backing_store,
-                                         index_word, value_word32)));
+  Return(SmiFromInt32((this->*function)(MachineType::Int8(), backing_store,
+                                        index_word, value_word32)));
 
   BIND(&u8);
-  Return(SmiFromWord32((this->*function)(MachineType::Uint8(), backing_store,
-                                         index_word, value_word32)));
+  Return(SmiFromInt32((this->*function)(MachineType::Uint8(), backing_store,
+                                        index_word, value_word32)));
 
   BIND(&i16);
-  Return(
-      SmiFromWord32((this->*function)(MachineType::Int16(), backing_store,
-                                      WordShl(index_word, 1), value_word32)));
+  Return(SmiFromInt32((this->*function)(MachineType::Int16(), backing_store,
+                                        WordShl(index_word, 1), value_word32)));
 
   BIND(&u16);
-  Return(
-      SmiFromWord32((this->*function)(MachineType::Uint16(), backing_store,
-                                      WordShl(index_word, 1), value_word32)));
+  Return(SmiFromInt32((this->*function)(MachineType::Uint16(), backing_store,
+                                        WordShl(index_word, 1), value_word32)));
 
   BIND(&i32);
   Return(ChangeInt32ToTagged(
diff --git a/deps/v8/src/builtins/builtins-string-gen.cc b/deps/v8/src/builtins/builtins-string-gen.cc
index 195572de8ed..7c9a265b5d2 100644
--- a/deps/v8/src/builtins/builtins-string-gen.cc
+++ b/deps/v8/src/builtins/builtins-string-gen.cc
@@ -124,42 +124,6 @@ Node* StringBuiltinsAssembler::PointerToStringDataAtIndex(
   return IntPtrAdd(string_data, offset_in_bytes);
 }
 
-void StringBuiltinsAssembler::ConvertAndBoundsCheckStartArgument(
-    Node* context, Variable* var_start, Node* start, Node* string_length) {
-  TNode<Object> const start_int = ToInteger_Inline(
-      CAST(context), CAST(start), CodeStubAssembler::kTruncateMinusZero);
-  TNode<Smi> const zero = SmiConstant(0);
-
-  Label done(this);
-  Label if_issmi(this), if_isheapnumber(this, Label::kDeferred);
-  Branch(TaggedIsSmi(start_int), &if_issmi, &if_isheapnumber);
-
-  BIND(&if_issmi);
-  {
-    TNode<Smi> const start_int_smi = CAST(start_int);
-    var_start->Bind(Select(
-        SmiLessThan(start_int_smi, zero),
-        [&] { return SmiMax(SmiAdd(string_length, start_int_smi), zero); },
-        [&] { return start_int_smi; }, MachineRepresentation::kTagged));
-    Goto(&done);
-  }
-
-  BIND(&if_isheapnumber);
-  {
-    // If {start} is a heap number, it is definitely out of bounds. If it is
-    // negative, {start} = max({string_length} + {start}),0) = 0'. If it is
-    // positive, set {start} to {string_length} which ultimately results in
-    // returning an empty string.
-    TNode<HeapNumber> const start_int_hn = CAST(start_int);
-    TNode<Float64T> const float_zero = Float64Constant(0.);
-    TNode<Float64T> const start_float = LoadHeapNumberValue(start_int_hn);
-    var_start->Bind(SelectTaggedConstant<Smi>(
-        Float64LessThan(start_float, float_zero), zero, string_length));
-    Goto(&done);
-  }
-  BIND(&done);
-}
-
 void StringBuiltinsAssembler::GenerateStringEqual(Node* context, Node* left,
                                                   Node* right) {
   VARIABLE(var_left, MachineRepresentation::kTagged, left);
@@ -300,21 +264,23 @@ void StringBuiltinsAssembler::StringEqual_Loop(
   {
     // If {offset} equals {end}, no difference was found, so the
     // strings are equal.
-    GotoIf(WordEqual(var_offset, length), if_equal);
+    GotoIf(WordEqual(var_offset.value(), length), if_equal);
 
     // Load the next characters from {lhs} and {rhs}.
     Node* lhs_value =
         Load(lhs_type, lhs_data,
-             WordShl(var_offset, ElementSizeLog2Of(lhs_type.representation())));
+             WordShl(var_offset.value(),
+                     ElementSizeLog2Of(lhs_type.representation())));
     Node* rhs_value =
         Load(rhs_type, rhs_data,
-             WordShl(var_offset, ElementSizeLog2Of(rhs_type.representation())));
+             WordShl(var_offset.value(),
+                     ElementSizeLog2Of(rhs_type.representation())));
 
     // Check if the characters match.
     GotoIf(Word32NotEqual(lhs_value, rhs_value), if_not_equal);
 
     // Advance to next character.
-    var_offset = IntPtrAdd(var_offset, IntPtrConstant(1));
+    var_offset = IntPtrAdd(var_offset.value(), IntPtrConstant(1));
     Goto(&loop);
   }
 }
@@ -408,13 +374,13 @@ void StringBuiltinsAssembler::GenerateStringRelationalComparison(Node* context,
     {
       // Check if {offset} equals {end}.
       Label if_done(this), if_notdone(this);
-      Branch(WordEqual(var_offset, end), &if_done, &if_notdone);
+      Branch(WordEqual(var_offset.value(), end), &if_done, &if_notdone);
 
       BIND(&if_notdone);
       {
         // Load the next characters from {lhs} and {rhs}.
-        Node* lhs_value = Load(MachineType::Uint8(), lhs, var_offset);
-        Node* rhs_value = Load(MachineType::Uint8(), rhs, var_offset);
+        Node* lhs_value = Load(MachineType::Uint8(), lhs, var_offset.value());
+        Node* rhs_value = Load(MachineType::Uint8(), rhs, var_offset.value());
 
         // Check if the characters match.
         Label if_valueissame(this), if_valueisnotsame(this);
@@ -424,7 +390,7 @@ void StringBuiltinsAssembler::GenerateStringRelationalComparison(Node* context,
         BIND(&if_valueissame);
         {
           // Advance to next character.
-          var_offset = IntPtrAdd(var_offset, IntPtrConstant(1));
+          var_offset = IntPtrAdd(var_offset.value(), IntPtrConstant(1));
         }
         Goto(&loop);
 
@@ -559,24 +525,25 @@ TF_BUILTIN(StringCharAt, StringBuiltinsAssembler) {
   TNode<Int32T> code = StringCharCodeAt(receiver, position);
 
   // And return the single character string with only that {code}
-  TNode<String> result = StringFromCharCode(code);
+  TNode<String> result = StringFromSingleCharCode(code);
   Return(result);
 }
 
-TF_BUILTIN(StringCharCodeAt, StringBuiltinsAssembler) {
+TF_BUILTIN(StringCodePointAtUTF16, StringBuiltinsAssembler) {
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* position = Parameter(Descriptor::kPosition);
-
+  // TODO(sigurds) Figure out if passing length as argument pays off.
+  TNode<IntPtrT> length = LoadStringLengthAsWord(receiver);
   // Load the character code at the {position} from the {receiver}.
-  TNode<Int32T> code = StringCharCodeAt(receiver, position);
-
+  TNode<Int32T> code =
+      LoadSurrogatePairAt(receiver, length, position, UnicodeEncoding::UTF16);
   // And return it as TaggedSigned value.
   // TODO(turbofan): Allow builtins to return values untagged.
-  TNode<Smi> result = SmiFromWord32(code);
+  TNode<Smi> result = SmiFromInt32(code);
   Return(result);
 }
 
-TF_BUILTIN(StringCodePointAt, StringBuiltinsAssembler) {
+TF_BUILTIN(StringCodePointAtUTF32, StringBuiltinsAssembler) {
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* position = Parameter(Descriptor::kPosition);
 
@@ -587,7 +554,7 @@ TF_BUILTIN(StringCodePointAt, StringBuiltinsAssembler) {
       LoadSurrogatePairAt(receiver, length, position, UnicodeEncoding::UTF32);
   // And return it as TaggedSigned value.
   // TODO(turbofan): Allow builtins to return values untagged.
-  TNode<Smi> result = SmiFromWord32(code);
+  TNode<Smi> result = SmiFromInt32(code);
   Return(result);
 }
 
@@ -619,7 +586,7 @@ TF_BUILTIN(StringFromCharCode, CodeStubAssembler) {
     Node* code32 = TruncateTaggedToWord32(context, code);
     TNode<Int32T> code16 =
         Signed(Word32And(code32, Int32Constant(String::kMaxUtf16CodeUnit)));
-    Node* result = StringFromCharCode(code16);
+    Node* result = StringFromSingleCharCode(code16);
     arguments.PopAndReturn(result);
   }
 
@@ -648,11 +615,12 @@ TF_BUILTIN(StringFromCharCode, CodeStubAssembler) {
 
       // The {code16} fits into the SeqOneByteString {one_byte_result}.
       Node* offset = ElementOffsetFromIndex(
-          var_max_index, UINT8_ELEMENTS, CodeStubAssembler::INTPTR_PARAMETERS,
+          var_max_index.value(), UINT8_ELEMENTS,
+          CodeStubAssembler::INTPTR_PARAMETERS,
           SeqOneByteString::kHeaderSize - kHeapObjectTag);
       StoreNoWriteBarrier(MachineRepresentation::kWord8, one_byte_result,
                           offset, code16);
-      var_max_index = IntPtrAdd(var_max_index, IntPtrConstant(1));
+      var_max_index = IntPtrAdd(var_max_index.value(), IntPtrConstant(1));
     });
     arguments.PopAndReturn(one_byte_result);
 
@@ -667,16 +635,17 @@ TF_BUILTIN(StringFromCharCode, CodeStubAssembler) {
     // their corresponding positions in the new 16-bit string.
     TNode<IntPtrT> zero = IntPtrConstant(0);
     CopyStringCharacters(one_byte_result, two_byte_result, zero, zero,
-                         var_max_index, String::ONE_BYTE_ENCODING,
+                         var_max_index.value(), String::ONE_BYTE_ENCODING,
                          String::TWO_BYTE_ENCODING);
 
     // Write the character that caused the 8-bit to 16-bit fault.
-    Node* max_index_offset = ElementOffsetFromIndex(
-        var_max_index, UINT16_ELEMENTS, CodeStubAssembler::INTPTR_PARAMETERS,
-        SeqTwoByteString::kHeaderSize - kHeapObjectTag);
+    Node* max_index_offset =
+        ElementOffsetFromIndex(var_max_index.value(), UINT16_ELEMENTS,
+                               CodeStubAssembler::INTPTR_PARAMETERS,
+                               SeqTwoByteString::kHeaderSize - kHeapObjectTag);
     StoreNoWriteBarrier(MachineRepresentation::kWord16, two_byte_result,
                         max_index_offset, code16);
-    var_max_index = IntPtrAdd(var_max_index, IntPtrConstant(1));
+    var_max_index = IntPtrAdd(var_max_index.value(), IntPtrConstant(1));
 
     // Resume copying the passed-in arguments from the same place where the
     // 8-bit copy stopped, but this time copying over all of the characters
@@ -689,14 +658,14 @@ TF_BUILTIN(StringFromCharCode, CodeStubAssembler) {
               Word32And(code32, Int32Constant(String::kMaxUtf16CodeUnit));
 
           Node* offset = ElementOffsetFromIndex(
-              var_max_index, UINT16_ELEMENTS,
+              var_max_index.value(), UINT16_ELEMENTS,
               CodeStubAssembler::INTPTR_PARAMETERS,
               SeqTwoByteString::kHeaderSize - kHeapObjectTag);
           StoreNoWriteBarrier(MachineRepresentation::kWord16, two_byte_result,
                               offset, code16);
-          var_max_index = IntPtrAdd(var_max_index, IntPtrConstant(1));
+          var_max_index = IntPtrAdd(var_max_index.value(), IntPtrConstant(1));
         },
-        var_max_index);
+        var_max_index.value());
 
     arguments.PopAndReturn(two_byte_result);
   }
@@ -713,7 +682,7 @@ TF_BUILTIN(StringPrototypeCharAt, StringBuiltinsAssembler) {
                    [this](TNode<String> string, TNode<IntPtrT> length,
                           TNode<IntPtrT> index) {
                      TNode<Int32T> code = StringCharCodeAt(string, index);
-                     return StringFromCharCode(code);
+                     return StringFromSingleCharCode(code);
                    });
 }
 
@@ -728,7 +697,7 @@ TF_BUILTIN(StringPrototypeCharCodeAt, StringBuiltinsAssembler) {
                    [this](TNode<String> receiver, TNode<IntPtrT> length,
                           TNode<IntPtrT> index) {
                      Node* value = StringCharCodeAt(receiver, index);
-                     return SmiFromWord32(value);
+                     return SmiFromInt32(value);
                    });
 }
 
@@ -742,9 +711,11 @@ TF_BUILTIN(StringPrototypeCodePointAt, StringBuiltinsAssembler) {
                    maybe_position, UndefinedConstant(),
                    [this](TNode<String> receiver, TNode<IntPtrT> length,
                           TNode<IntPtrT> index) {
+                     // This is always a call to a builtin from Javascript,
+                     // so we need to produce UTF32.
                      Node* value = LoadSurrogatePairAt(receiver, length, index,
                                                        UnicodeEncoding::UTF32);
-                     return SmiFromWord32(value);
+                     return SmiFromInt32(value);
                    });
 }
 
@@ -1044,8 +1015,8 @@ void StringBuiltinsAssembler::RequireObjectCoercible(Node* const context,
   Branch(IsNullOrUndefined(value), &throw_exception, &out);
 
   BIND(&throw_exception);
-  TailCallRuntime(Runtime::kThrowCalledOnNullOrUndefined, context,
-                  StringConstant(method_name));
+  ThrowTypeError(context, MessageTemplate::kCalledOnNullOrUndefined,
+                 method_name);
 
   BIND(&out);
 }
@@ -1173,8 +1144,8 @@ compiler::Node* StringBuiltinsAssembler::GetSubstitution(
     CSA_ASSERT(this, TaggedIsPositiveSmi(dollar_index));
 
     Node* const matched =
-        CallBuiltin(Builtins::kSubString, context, subject_string,
-                    match_start_index, match_end_index);
+        CallBuiltin(Builtins::kStringSubstring, context, subject_string,
+                    SmiUntag(match_start_index), SmiUntag(match_end_index));
     Node* const replacement_string =
         CallRuntime(Runtime::kGetSubstitution, context, matched, subject_string,
                     match_start_index, replace_string, dollar_index);
@@ -1242,11 +1213,10 @@ TF_BUILTIN(StringPrototypeRepeat, StringBuiltinsAssembler) {
 
   BIND(&invalid_count);
   {
-    CallRuntime(Runtime::kThrowRangeError, context,
-                SmiConstant(MessageTemplate::kInvalidCountValue),
-                var_count.value());
-    Unreachable();
+    ThrowRangeError(context, MessageTemplate::kInvalidCountValue,
+                    var_count.value());
   }
+
   BIND(&invalid_string_length);
   {
     CallRuntime(Runtime::kThrowInvalidStringLength, context);
@@ -1288,7 +1258,7 @@ TF_BUILTIN(StringRepeat, StringBuiltinsAssembler) {
   {
     {
       Label next(this);
-      GotoIfNot(SmiToWord32(SmiAnd(var_count.value(), SmiConstant(1))), &next);
+      GotoIfNot(SmiToInt32(SmiAnd(var_count.value(), SmiConstant(1))), &next);
       var_result.Bind(CallStub(stringadd_callable, context, var_result.value(),
                                var_temp.value()));
       Goto(&next);
@@ -1412,8 +1382,8 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
 
     GotoIf(SmiEqual(match_start_index, smi_zero), &next);
     Node* const prefix =
-        CallBuiltin(Builtins::kSubString, context, subject_string, smi_zero,
-                    match_start_index);
+        CallBuiltin(Builtins::kStringSubstring, context, subject_string,
+                    IntPtrConstant(0), SmiUntag(match_start_index));
     var_result.Bind(prefix);
 
     Goto(&next);
@@ -1453,8 +1423,8 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
   BIND(&out);
   {
     Node* const suffix =
-        CallBuiltin(Builtins::kSubString, context, subject_string,
-                    match_end_index, subject_length);
+        CallBuiltin(Builtins::kStringSubstring, context, subject_string,
+                    SmiUntag(match_end_index), SmiUntag(subject_length));
     Node* const result =
         CallStub(stringadd_callable, context, var_result.value(), suffix);
     Return(result);
@@ -1498,10 +1468,9 @@ class StringMatchSearchAssembler : public StringBuiltinsAssembler {
       RegExpBuiltinsAssembler regexp_asm(state());
 
       Node* const receiver_string = ToString_Inline(context, receiver);
-      Node* const pattern = Select(
+      TNode<Object> const pattern = Select<Object>(
           IsUndefined(maybe_regexp), [=] { return EmptyStringConstant(); },
-          [=] { return ToString_Inline(context, maybe_regexp); },
-          MachineRepresentation::kTagged);
+          [=] { return ToString_Inline(context, maybe_regexp); });
 
       // Create RegExp
       // TODO(pwong): This could be factored out as a helper (RegExpCreate) that
@@ -1587,14 +1556,15 @@ class StringPadAssembler : public StringBuiltinsAssembler {
       GotoIf(IsUndefined(fill), &pad);
 
       var_fill_string = ToString_Inline(context, fill);
-      var_fill_length = LoadStringLengthAsWord(var_fill_string);
+      var_fill_length = LoadStringLengthAsWord(var_fill_string.value());
 
-      Branch(IntPtrGreaterThan(var_fill_length, IntPtrConstant(0)), &pad,
-             &dont_pad);
+      Branch(IntPtrGreaterThan(var_fill_length.value(), IntPtrConstant(0)),
+             &pad, &dont_pad);
     }
     BIND(&pad);
     {
-      CSA_ASSERT(this, IntPtrGreaterThan(var_fill_length, IntPtrConstant(0)));
+      CSA_ASSERT(this,
+                 IntPtrGreaterThan(var_fill_length.value(), IntPtrConstant(0)));
       CSA_ASSERT(this, SmiGreaterThan(max_length, string_length));
 
       Callable stringadd_callable =
@@ -1604,38 +1574,37 @@ class StringPadAssembler : public StringBuiltinsAssembler {
       VARIABLE(var_pad, MachineRepresentation::kTagged);
 
       Label single_char_fill(this), multi_char_fill(this), return_result(this);
-      Branch(IntPtrEqual(var_fill_length, IntPtrConstant(1)), &single_char_fill,
-             &multi_char_fill);
+      Branch(IntPtrEqual(var_fill_length.value(), IntPtrConstant(1)),
+             &single_char_fill, &multi_char_fill);
 
       // Fast path for a single character fill.  No need to calculate number of
       // repetitions or remainder.
       BIND(&single_char_fill);
       {
         var_pad.Bind(CallBuiltin(Builtins::kStringRepeat, context,
-                                 static_cast<Node*>(var_fill_string),
+                                 static_cast<Node*>(var_fill_string.value()),
                                  pad_length));
         Goto(&return_result);
       }
       BIND(&multi_char_fill);
       {
         TNode<Int32T> const fill_length_word32 =
-            TruncateWordToWord32(var_fill_length);
-        TNode<Int32T> const pad_length_word32 = SmiToWord32(pad_length);
+            TruncateIntPtrToInt32(var_fill_length.value());
+        TNode<Int32T> const pad_length_word32 = SmiToInt32(pad_length);
         TNode<Int32T> const repetitions_word32 =
             Int32Div(pad_length_word32, fill_length_word32);
         TNode<Int32T> const remaining_word32 =
             Int32Mod(pad_length_word32, fill_length_word32);
 
         var_pad.Bind(CallBuiltin(Builtins::kStringRepeat, context,
-                                 static_cast<Node*>(var_fill_string),
-                                 SmiFromWord32(repetitions_word32)));
+                                 var_fill_string.value(),
+                                 SmiFromInt32(repetitions_word32)));
 
         GotoIfNot(remaining_word32, &return_result);
         {
-          Node* const remainder_string =
-              CallBuiltin(Builtins::kSubString, context,
-                          static_cast<Node*>(var_fill_string), SmiConstant(0),
-                          SmiFromWord32(remaining_word32));
+          Node* const remainder_string = CallBuiltin(
+              Builtins::kStringSubstring, context, var_fill_string.value(),
+              IntPtrConstant(0), ChangeInt32ToIntPtr(remaining_word32));
           var_pad.Bind(CallStub(stringadd_callable, context, var_pad.value(),
                                 remainder_string));
           Goto(&return_result);
@@ -1679,8 +1648,8 @@ TF_BUILTIN(StringPrototypeSearch, StringMatchSearchAssembler) {
 // ES6 section 21.1.3.18 String.prototype.slice ( start, end )
 TF_BUILTIN(StringPrototypeSlice, StringBuiltinsAssembler) {
   Label out(this);
-  VARIABLE(var_start, MachineRepresentation::kTagged);
-  VARIABLE(var_end, MachineRepresentation::kTagged);
+  TVARIABLE(IntPtrT, var_start);
+  TVARIABLE(IntPtrT, var_end);
 
   const int kStart = 0;
   const int kEnd = 1;
@@ -1688,69 +1657,38 @@ TF_BUILTIN(StringPrototypeSlice, StringBuiltinsAssembler) {
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
   Node* const receiver = args.GetReceiver();
-  Node* const start = args.GetOptionalArgumentValue(kStart);
-  TNode<Object> end = CAST(args.GetOptionalArgumentValue(kEnd));
+  TNode<Object> start = args.GetOptionalArgumentValue(kStart);
+  TNode<Object> end = args.GetOptionalArgumentValue(kEnd);
   TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
 
-  TNode<Smi> const smi_zero = SmiConstant(0);
-
   // 1. Let O be ? RequireObjectCoercible(this value).
   RequireObjectCoercible(context, receiver, "String.prototype.slice");
 
   // 2. Let S be ? ToString(O).
-  Node* const subject_string =
-      CallBuiltin(Builtins::kToString, context, receiver);
+  TNode<String> const subject_string =
+      CAST(CallBuiltin(Builtins::kToString, context, receiver));
 
   // 3. Let len be the number of elements in S.
-  TNode<Smi> const length = LoadStringLengthAsSmi(subject_string);
+  TNode<IntPtrT> const length = LoadStringLengthAsWord(subject_string);
 
-  // Conversions and bounds-checks for {start}.
-  ConvertAndBoundsCheckStartArgument(context, &var_start, start, length);
+  // Convert {start} to a relative index.
+  var_start = ConvertToRelativeIndex(context, start, length);
 
   // 5. If end is undefined, let intEnd be len;
-  var_end.Bind(length);
+  var_end = length;
   GotoIf(IsUndefined(end), &out);
 
-  // else let intEnd be ? ToInteger(end).
-  Node* const end_int =
-      ToInteger_Inline(context, end, CodeStubAssembler::kTruncateMinusZero);
-
-  // 7. If intEnd < 0, let to be max(len + intEnd, 0);
-  //    otherwise let to be min(intEnd, len).
-  Label if_issmi(this), if_isheapnumber(this, Label::kDeferred);
-  Branch(TaggedIsSmi(end_int), &if_issmi, &if_isheapnumber);
-
-  BIND(&if_issmi);
-  {
-    Node* const length_plus_end = SmiAdd(length, end_int);
-    var_end.Bind(Select(SmiLessThan(end_int, smi_zero),
-                        [&] { return SmiMax(length_plus_end, smi_zero); },
-                        [&] { return SmiMin(length, end_int); },
-                        MachineRepresentation::kTagged));
-    Goto(&out);
-  }
-
-  BIND(&if_isheapnumber);
-  {
-    // If {end} is a heap number, it is definitely out of bounds. If it is
-    // negative, {int_end} = max({length} + {int_end}),0) = 0'. If it is
-    // positive, set {int_end} to {length} which ultimately results in
-    // returning an empty string.
-    Node* const float_zero = Float64Constant(0.);
-    Node* const end_float = LoadHeapNumberValue(end_int);
-    var_end.Bind(SelectTaggedConstant<Smi>(
-        Float64LessThan(end_float, float_zero), smi_zero, length));
-    Goto(&out);
-  }
+  // Convert {end} to a relative index.
+  var_end = ConvertToRelativeIndex(context, end, length);
+  Goto(&out);
 
   Label return_emptystring(this);
   BIND(&out);
   {
-    GotoIf(SmiLessThanOrEqual(var_end.value(), var_start.value()),
+    GotoIf(IntPtrLessThanOrEqual(var_end.value(), var_start.value()),
            &return_emptystring);
-    Node* const result =
-        SubString(context, subject_string, var_start.value(), var_end.value(),
-                  SubStringFlags::FROM_TO_ARE_BOUNDED);
+    TNode<String> const result =
+        SubString(subject_string, var_start.value(), var_end.value());
     args.PopAndReturn(result);
   }
 
@@ -1793,10 +1731,9 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
   // String and integer conversions.
 
   Node* const subject_string = ToString_Inline(context, receiver);
-  Node* const limit_number =
-      Select(IsUndefined(limit), [=]() { return NumberConstant(kMaxUInt32); },
-             [=]() { return ToUint32(context, limit); },
-             MachineRepresentation::kTagged);
+  TNode<Number> const limit_number = Select<Number>(
+      IsUndefined(limit), [=] { return NumberConstant(kMaxUInt32); },
+      [=] { return ToUint32(context, limit); });
   Node* const separator_string = ToString_Inline(context, separator);
 
   // Shortcut for {limit} == 0.
@@ -1868,25 +1805,25 @@ TF_BUILTIN(StringPrototypeSubstr, StringBuiltinsAssembler) {
   CodeStubArguments args(this, argc);
 
   Node* const receiver = args.GetReceiver();
-  Node* const start = args.GetOptionalArgumentValue(kStartArg);
-  TNode<Object> length = CAST(args.GetOptionalArgumentValue(kLengthArg));
+  TNode<Object> start = args.GetOptionalArgumentValue(kStartArg);
+  TNode<Object> length = args.GetOptionalArgumentValue(kLengthArg);
   TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
 
   Label out(this);
 
-  TVARIABLE(Smi, var_start);
+  TVARIABLE(IntPtrT, var_start);
   TVARIABLE(Number, var_length);
 
-  TNode<Smi> const zero = SmiConstant(0);
+  TNode<IntPtrT> const zero = IntPtrConstant(0);
 
   // Check that {receiver} is coercible to Object and convert it to a String.
-  Node* const string =
+  TNode<String> const string =
       ToThisString(context, receiver, "String.prototype.substr");
 
-  TNode<Smi> const string_length = LoadStringLengthAsSmi(string);
+  TNode<IntPtrT> const string_length = LoadStringLengthAsWord(string);
 
-  // Conversions and bounds-checks for {start}.
-  ConvertAndBoundsCheckStartArgument(context, &var_start, start, string_length);
+  // Convert {start} to a relative index.
+  var_start = ConvertToRelativeIndex(context, start, string_length);
 
   // Conversions and bounds-checks for {length}.
   Label if_issmi(this), if_isheapnumber(this, Label::kDeferred);
@@ -1897,7 +1834,7 @@ TF_BUILTIN(StringPrototypeSubstr, StringBuiltinsAssembler) {
     Branch(IsUndefined(length), &if_isundefined, &if_isnotundefined);
 
     BIND(&if_isundefined);
-    var_length = string_length;
+    var_length = SmiTag(string_length);
     Goto(&if_issmi);
 
     BIND(&if_isnotundefined);
@@ -1905,18 +1842,20 @@ TF_BUILTIN(StringPrototypeSubstr, StringBuiltinsAssembler) {
                                   CodeStubAssembler::kTruncateMinusZero);
   }
 
-  TVARIABLE(Smi, var_result_length);
+  TVARIABLE(IntPtrT, var_result_length);
 
-  Branch(TaggedIsSmi(var_length), &if_issmi, &if_isheapnumber);
+  Branch(TaggedIsSmi(var_length.value()), &if_issmi, &if_isheapnumber);
 
   // Set {length} to min(max({length}, 0), {string_length} - {start}
   BIND(&if_issmi);
   {
-    TNode<Smi> const positive_length = SmiMax(CAST(var_length), zero);
-    TNode<Smi> const minimal_length = SmiSub(string_length, var_start);
-    var_result_length = SmiMin(positive_length, minimal_length);
+    TNode<IntPtrT> const positive_length =
+        IntPtrMax(SmiUntag(CAST(var_length.value())), zero);
+    TNode<IntPtrT> const minimal_length =
+        IntPtrSub(string_length, var_start.value());
+    var_result_length = IntPtrMin(positive_length, minimal_length);
 
-    GotoIfNot(SmiLessThanOrEqual(var_result_length, zero), &out);
+    GotoIfNot(IntPtrLessThanOrEqual(var_result_length.value(), zero), &out);
     args.PopAndReturn(EmptyStringConstant());
   }
 
@@ -1926,11 +1865,12 @@ TF_BUILTIN(StringPrototypeSubstr, StringBuiltinsAssembler) {
     // two cases according to the spec: if it is negative, "" is returned; if
     // it is positive, then length is set to {string_length} - {start}.
 
-    CSA_ASSERT(this, IsHeapNumber(var_length));
+    CSA_ASSERT(this, IsHeapNumber(var_length.value()));
 
     Label if_isnegative(this), if_ispositive(this);
     TNode<Float64T> const float_zero = Float64Constant(0.);
-    TNode<Float64T> const length_float = LoadHeapNumberValue(CAST(var_length));
+    TNode<Float64T> const length_float =
+        LoadHeapNumberValue(CAST(var_length.value()));
     Branch(Float64LessThan(length_float, float_zero), &if_isnegative,
            &if_ispositive);
 
@@ -1939,17 +1879,17 @@ TF_BUILTIN(StringPrototypeSubstr, StringBuiltinsAssembler) {
 
     BIND(&if_ispositive);
     {
-      var_result_length = SmiSub(string_length, var_start);
-      GotoIfNot(SmiLessThanOrEqual(var_result_length, zero), &out);
+      var_result_length = IntPtrSub(string_length, var_start.value());
+      GotoIfNot(IntPtrLessThanOrEqual(var_result_length.value(), zero), &out);
       args.PopAndReturn(EmptyStringConstant());
     }
   }
 
   BIND(&out);
   {
-    TNode<Smi> const end = SmiAdd(var_start, var_result_length);
-    Node* const result = SubString(context, string, var_start, end);
-    args.PopAndReturn(result);
+    TNode<IntPtrT> const end =
+        IntPtrAdd(var_start.value(), var_result_length.value());
+    args.PopAndReturn(SubString(string, var_start.value(), end));
   }
 }
 
@@ -1959,7 +1899,7 @@ TNode<Smi> StringBuiltinsAssembler::ToSmiBetweenZeroAnd(
   Label out(this);
   TVARIABLE(Smi, var_result);
 
-  TNode<Object> const value_int =
+  TNode<Number> const value_int =
       ToInteger_Inline(context, value, CodeStubAssembler::kTruncateMinusZero);
 
   Label if_issmi(this), if_isnotsmi(this, Label::kDeferred);
@@ -1967,8 +1907,9 @@ TNode<Smi> StringBuiltinsAssembler::ToSmiBetweenZeroAnd(
 
   BIND(&if_issmi);
   {
+    TNode<Smi> value_smi = CAST(value_int);
     Label if_isinbounds(this), if_isoutofbounds(this, Label::kDeferred);
-    Branch(SmiAbove(value_int, limit), &if_isoutofbounds, &if_isinbounds);
+    Branch(SmiAbove(value_smi, limit), &if_isoutofbounds, &if_isinbounds);
 
     BIND(&if_isinbounds);
     {
@@ -1980,7 +1921,7 @@ TNode<Smi> StringBuiltinsAssembler::ToSmiBetweenZeroAnd(
     {
       TNode<Smi> const zero = SmiConstant(0);
       var_result =
-          SelectTaggedConstant(SmiLessThan(value_int, zero), zero, limit);
+          SelectTaggedConstant(SmiLessThan(value_smi, zero), zero, limit);
       Goto(&out);
     }
   }
@@ -1999,16 +1940,15 @@ TNode<Smi> StringBuiltinsAssembler::ToSmiBetweenZeroAnd(
   }
 
   BIND(&out);
-  return var_result;
+  return var_result.value();
 }
 
-TF_BUILTIN(SubString, CodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* string = Parameter(Descriptor::kString);
-  Node* from = Parameter(Descriptor::kFrom);
-  Node* to = Parameter(Descriptor::kTo);
+TF_BUILTIN(StringSubstring, CodeStubAssembler) {
+  TNode<String> string = CAST(Parameter(Descriptor::kString));
+  TNode<IntPtrT> from = UncheckedCast<IntPtrT>(Parameter(Descriptor::kFrom));
+  TNode<IntPtrT> to = UncheckedCast<IntPtrT>(Parameter(Descriptor::kTo));
 
-  Return(SubString(context, string, from, to));
+  Return(SubString(string, from, to));
 }
 
 // ES6 #sec-string.prototype.substring
@@ -2031,7 +1971,7 @@ TF_BUILTIN(StringPrototypeSubstring, StringBuiltinsAssembler) {
   VARIABLE(var_end, MachineRepresentation::kTagged);
 
   // Check that {receiver} is coercible to Object and convert it to a String.
-  Node* const string =
+  TNode<String> const string =
       ToThisString(context, receiver, "String.prototype.substring");
 
   Node* const length = LoadStringLengthAsSmi(string);
@@ -2061,9 +2001,8 @@ TF_BUILTIN(StringPrototypeSubstring, StringBuiltinsAssembler) {
 
   BIND(&out);
   {
-    Node* result =
-        SubString(context, string, var_start.value(), var_end.value());
-    args.PopAndReturn(result);
+    args.PopAndReturn(SubString(string, SmiUntag(var_start.value()),
+                                SmiUntag(var_end.value())));
   }
 }
 
@@ -2072,14 +2011,14 @@ TF_BUILTIN(StringPrototypeTrim, StringTrimAssembler) {
   Generate(String::kTrim, "String.prototype.trim");
 }
 
-// Non-standard WebKit extension
-TF_BUILTIN(StringPrototypeTrimLeft, StringTrimAssembler) {
-  Generate(String::kTrimLeft, "String.prototype.trimLeft");
+// https://github.com/tc39/proposal-string-left-right-trim
+TF_BUILTIN(StringPrototypeTrimStart, StringTrimAssembler) {
+  Generate(String::kTrimStart, "String.prototype.trimLeft");
 }
 
-// Non-standard WebKit extension
-TF_BUILTIN(StringPrototypeTrimRight, StringTrimAssembler) {
-  Generate(String::kTrimRight, "String.prototype.trimRight");
+// https://github.com/tc39/proposal-string-left-right-trim
+TF_BUILTIN(StringPrototypeTrimEnd, StringTrimAssembler) {
+  Generate(String::kTrimEnd, "String.prototype.trimRight");
 }
 
 void StringTrimAssembler::Generate(String::TrimMode mode,
@@ -2092,7 +2031,7 @@ void StringTrimAssembler::Generate(String::TrimMode mode,
   Node* const receiver = arguments.GetReceiver();
 
   // Check that {receiver} is coercible to Object and convert it to a String.
-  Node* const string = ToThisString(context, receiver, method_name);
+  TNode<String> const string = ToThisString(context, receiver, method_name);
   TNode<IntPtrT> const string_length = LoadStringLengthAsWord(string);
 
   ToDirectStringAssembler to_direct(state(), string);
@@ -2105,20 +2044,20 @@ void StringTrimAssembler::Generate(String::TrimMode mode,
   TVARIABLE(IntPtrT, var_start, IntPtrConstant(0));
   TVARIABLE(IntPtrT, var_end, IntPtrSub(string_length, IntPtrConstant(1)));
 
-  if (mode == String::kTrimLeft || mode == String::kTrim) {
+  if (mode == String::kTrimStart || mode == String::kTrim) {
     ScanForNonWhiteSpaceOrLineTerminator(string_data, string_data_offset,
                                          is_stringonebyte, &var_start,
                                          string_length, 1, &return_emptystring);
   }
-  if (mode == String::kTrimRight || mode == String::kTrim) {
+  if (mode == String::kTrimEnd || mode == String::kTrim) {
     ScanForNonWhiteSpaceOrLineTerminator(
         string_data, string_data_offset, is_stringonebyte, &var_end,
         IntPtrConstant(-1), -1, &return_emptystring);
   }
 
-  arguments.PopAndReturn(SubString(context, string, SmiTag(var_start),
-                                   SmiAdd(SmiTag(var_end), SmiConstant(1)),
-                                   SubStringFlags::FROM_TO_ARE_BOUNDED));
+  arguments.PopAndReturn(
+      SubString(string, var_start.value(),
+                IntPtrAdd(var_end.value(), IntPtrConstant(1))));
 
   BIND(&if_runtime);
   arguments.PopAndReturn(
@@ -2281,21 +2220,21 @@ TNode<Int32T> StringBuiltinsAssembler::LoadSurrogatePairAt(
   var_result = StringCharCodeAt(string, index);
   var_trail = Int32Constant(0);
 
-  GotoIf(Word32NotEqual(Word32And(var_result, Int32Constant(0xFC00)),
+  GotoIf(Word32NotEqual(Word32And(var_result.value(), Int32Constant(0xFC00)),
                         Int32Constant(0xD800)),
          &return_result);
   TNode<IntPtrT> next_index = IntPtrAdd(index, IntPtrConstant(1));
 
   GotoIfNot(IntPtrLessThan(next_index, length), &return_result);
   var_trail = StringCharCodeAt(string, next_index);
-  Branch(Word32Equal(Word32And(var_trail, Int32Constant(0xFC00)),
+  Branch(Word32Equal(Word32And(var_trail.value(), Int32Constant(0xFC00)),
                      Int32Constant(0xDC00)),
          &handle_surrogate_pair, &return_result);
 
   BIND(&handle_surrogate_pair);
   {
-    TNode<Int32T> lead = var_result;
-    TNode<Int32T> trail = var_trail;
+    TNode<Int32T> lead = var_result.value();
+    TNode<Int32T> trail = var_trail.value();
 
     // Check that this path is only taken if a surrogate pair is found
     CSA_SLOW_ASSERT(this,
@@ -2332,7 +2271,7 @@ TNode<Int32T> StringBuiltinsAssembler::LoadSurrogatePairAt(
   }
 
   BIND(&return_result);
-  return var_result;
+  return var_result.value();
 }
 
 // ES6 #sec-%stringiteratorprototype%.next
@@ -2364,7 +2303,7 @@ TF_BUILTIN(StringIteratorPrototypeNext, StringBuiltinsAssembler) {
   {
     UnicodeEncoding encoding = UnicodeEncoding::UTF16;
     TNode<Int32T> ch = LoadSurrogatePairAt(string, length, position, encoding);
-    TNode<String> value = StringFromCodePoint(ch, encoding);
+    TNode<String> value = StringFromSingleCodePoint(ch, encoding);
     var_value.Bind(value);
     TNode<IntPtrT> length = LoadStringLengthAsWord(value);
     StoreObjectFieldNoWriteBarrier(iterator, JSStringIterator::kNextIndexOffset,
@@ -2383,9 +2322,8 @@ TF_BUILTIN(StringIteratorPrototypeNext, StringBuiltinsAssembler) {
   BIND(&throw_bad_receiver);
   {
     // The {receiver} is not a valid JSGeneratorObject.
-    CallRuntime(Runtime::kThrowIncompatibleMethodReceiver, context,
-                StringConstant("String Iterator.prototype.next"), iterator);
-    Unreachable();
+    ThrowTypeError(context, MessageTemplate::kIncompatibleMethodReceiver,
+                   StringConstant("String Iterator.prototype.next"), iterator);
   }
 }
 
diff --git a/deps/v8/src/builtins/builtins-symbol.cc b/deps/v8/src/builtins/builtins-symbol.cc
index 77bb09d0f76..1343a293bd8 100644
--- a/deps/v8/src/builtins/builtins-symbol.cc
+++ b/deps/v8/src/builtins/builtins-symbol.cc
@@ -11,27 +11,25 @@ namespace v8 {
 namespace internal {
 
 // -----------------------------------------------------------------------------
-// ES6 section 19.4 Symbol Objects
+// ES #sec-symbol-objects
 
-// ES6 section 19.4.1.1 Symbol ( [ description ] ) for the [[Call]] case.
+// ES #sec-symbol-constructor
 BUILTIN(SymbolConstructor) {
   HandleScope scope(isolate);
-  Handle<Symbol> result = isolate->factory()->NewSymbol();
-  Handle<Object> description = args.atOrUndefined(isolate, 1);
-  if (!description->IsUndefined(isolate)) {
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, description,
-                                       Object::ToString(isolate, description));
-    result->set_name(*description);
+  if (args.new_target()->IsUndefined(isolate)) {  // [[Call]]
+    Handle<Symbol> result = isolate->factory()->NewSymbol();
+    Handle<Object> description = args.atOrUndefined(isolate, 1);
+    if (!description->IsUndefined(isolate)) {
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+          isolate, description, Object::ToString(isolate, description));
+      result->set_name(*description);
+    }
+    return *result;
+  } else {  // [[Construct]]
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kNotConstructor,
+                              isolate->factory()->Symbol_string()));
   }
-  return *result;
-}
-
-// ES6 section 19.4.1.1 Symbol ( [ description ] ) for the [[Construct]] case.
-BUILTIN(SymbolConstructor_ConstructStub) {
-  HandleScope scope(isolate);
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate, NewTypeError(MessageTemplate::kNotConstructor,
-                            isolate->factory()->Symbol_string()));
 }
 
 // ES6 section 19.4.2.1 Symbol.for.
diff --git a/deps/v8/src/builtins/builtins-typedarray-gen.cc b/deps/v8/src/builtins/builtins-typedarray-gen.cc
index b830a8597d0..87c333c0418 100644
--- a/deps/v8/src/builtins/builtins-typedarray-gen.cc
+++ b/deps/v8/src/builtins/builtins-typedarray-gen.cc
@@ -2,9 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/builtins/builtins-typedarray-gen.h"
+
+#include "src/builtins/builtins-constructor-gen.h"
+#include "src/builtins/builtins-iterator-gen.h"
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
-#include "src/code-stub-assembler.h"
+#include "src/builtins/growable-fixed-array-gen.h"
 #include "src/handles-inl.h"
 
 namespace v8 {
@@ -23,106 +27,22 @@ using TNode = compiler::TNode<T>;
 // -----------------------------------------------------------------------------
 // ES6 section 22.2 TypedArray Objects
 
-class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
- public:
-  explicit TypedArrayBuiltinsAssembler(compiler::CodeAssemblerState* state)
-      : CodeStubAssembler(state) {}
-
- protected:
-  void GenerateTypedArrayPrototypeGetter(Node* context, Node* receiver,
-                                         const char* method_name,
-                                         int object_offset);
-  void GenerateTypedArrayPrototypeIterationMethod(Node* context, Node* receiver,
-                                                  const char* method_name,
-                                                  IterationKind iteration_kind);
-
-  void SetupTypedArray(TNode<JSTypedArray> holder, TNode<Smi> length,
-                       TNode<Number> byte_offset, TNode<Number> byte_length);
-  void AttachBuffer(TNode<JSTypedArray> holder, TNode<JSArrayBuffer> buffer,
-                    TNode<Map> map, TNode<Smi> length,
-                    TNode<Number> byte_offset);
-
-  TNode<Map> LoadMapForType(TNode<JSTypedArray> array);
-  TNode<UintPtrT> CalculateExternalPointer(TNode<UintPtrT> backing_store,
-                                           TNode<Number> byte_offset);
-  Node* LoadDataPtr(Node* typed_array);
-  TNode<BoolT> ByteLengthIsValid(TNode<Number> byte_length);
-
-  // Returns true if kind is either UINT8_ELEMENTS or UINT8_CLAMPED_ELEMENTS.
-  TNode<Word32T> IsUint8ElementsKind(TNode<Word32T> kind);
-
-  // Loads the element kind of TypedArray instance.
-  TNode<Word32T> LoadElementsKind(TNode<Object> typed_array);
-
-  // Returns the byte size of an element for a TypedArray elements kind.
-  TNode<IntPtrT> GetTypedArrayElementSize(TNode<Word32T> elements_kind);
-
-  // Fast path for setting a TypedArray (source) onto another TypedArray
-  // (target) at an element offset.
-  void SetTypedArraySource(TNode<Context> context, TNode<JSTypedArray> source,
-                           TNode<JSTypedArray> target, TNode<IntPtrT> offset,
-                           Label* call_runtime, Label* if_source_too_large);
-
-  void SetJSArraySource(TNode<Context> context, TNode<JSArray> source,
-                        TNode<JSTypedArray> target, TNode<IntPtrT> offset,
-                        Label* call_runtime, Label* if_source_too_large);
-
-  void CallCMemmove(TNode<IntPtrT> dest_ptr, TNode<IntPtrT> src_ptr,
-                    TNode<IntPtrT> byte_length);
-
-  void CallCCopyFastNumberJSArrayElementsToTypedArray(
-      TNode<Context> context, TNode<JSArray> source, TNode<JSTypedArray> dest,
-      TNode<IntPtrT> source_length, TNode<IntPtrT> offset);
-
-  void CallCCopyTypedArrayElementsToTypedArray(TNode<JSTypedArray> source,
-                                               TNode<JSTypedArray> dest,
-                                               TNode<IntPtrT> source_length,
-                                               TNode<IntPtrT> offset);
-};
-
 TNode<Map> TypedArrayBuiltinsAssembler::LoadMapForType(
     TNode<JSTypedArray> array) {
-  Label unreachable(this), done(this);
-  Label uint8_elements(this), uint8_clamped_elements(this), int8_elements(this),
-      uint16_elements(this), int16_elements(this), uint32_elements(this),
-      int32_elements(this), float32_elements(this), float64_elements(this);
-  Label* elements_kind_labels[] = {
-      &uint8_elements,  &uint8_clamped_elements, &int8_elements,
-      &uint16_elements, &int16_elements,         &uint32_elements,
-      &int32_elements,  &float32_elements,       &float64_elements};
-  int32_t elements_kinds[] = {
-      UINT8_ELEMENTS,  UINT8_CLAMPED_ELEMENTS, INT8_ELEMENTS,
-      UINT16_ELEMENTS, INT16_ELEMENTS,         UINT32_ELEMENTS,
-      INT32_ELEMENTS,  FLOAT32_ELEMENTS,       FLOAT64_ELEMENTS};
-  const size_t kTypedElementsKindCount = LAST_FIXED_TYPED_ARRAY_ELEMENTS_KIND -
-                                         FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND +
-                                         1;
-  DCHECK_EQ(kTypedElementsKindCount, arraysize(elements_kinds));
-  DCHECK_EQ(kTypedElementsKindCount, arraysize(elements_kind_labels));
-
   TVARIABLE(Map, var_typed_map);
-
   TNode<Map> array_map = LoadMap(array);
   TNode<Int32T> elements_kind = LoadMapElementsKind(array_map);
-  Switch(elements_kind, &unreachable, elements_kinds, elements_kind_labels,
-         kTypedElementsKindCount);
 
-  for (int i = 0; i < static_cast<int>(kTypedElementsKindCount); i++) {
-    BIND(elements_kind_labels[i]);
-    {
-      ElementsKind kind = static_cast<ElementsKind>(elements_kinds[i]);
-      ExternalArrayType type =
-          isolate()->factory()->GetArrayTypeFromElementsKind(kind);
-      Handle<Map> map(isolate()->heap()->MapForFixedTypedArray(type));
-      var_typed_map = HeapConstant(map);
-      Goto(&done);
-    }
-  }
+  DispatchTypedArrayByElementsKind(
+      elements_kind,
+      [&](ElementsKind kind, int size, int typed_array_fun_index) {
+        ExternalArrayType type =
+            isolate()->factory()->GetArrayTypeFromElementsKind(kind);
+        Handle<Map> map(isolate()->heap()->MapForFixedTypedArray(type));
+        var_typed_map = HeapConstant(map);
+      });
 
-  BIND(&unreachable);
-  { Unreachable(); }
-  BIND(&done);
-  return var_typed_map;
+  return var_typed_map.value();
 }
 
 // The byte_offset can be higher than Smi range, in which case to perform the
@@ -218,7 +138,7 @@ TF_BUILTIN(TypedArrayInitialize, TypedArrayBuiltinsAssembler) {
   Label setup_holder(this), allocate_on_heap(this), aligned(this),
       allocate_elements(this), allocate_off_heap(this),
       allocate_off_heap_no_init(this), attach_buffer(this), done(this);
-  VARIABLE(var_total_size, MachineType::PointerRepresentation());
+  TVARIABLE(IntPtrT, var_total_size);
 
   // SmiMul returns a heap number in case of Smi overflow.
   TNode<Number> byte_length = SmiMul(length, element_size);
@@ -227,10 +147,12 @@ TF_BUILTIN(TypedArrayInitialize, TypedArrayBuiltinsAssembler) {
 
   TNode<Map> fixed_typed_map = LoadMapForType(holder);
   GotoIf(TaggedIsNotSmi(byte_length), &allocate_off_heap);
-  GotoIf(
-      SmiGreaterThan(byte_length, SmiConstant(V8_TYPED_ARRAY_MAX_SIZE_IN_HEAP)),
-      &allocate_off_heap);
-  TNode<IntPtrT> word_byte_length = SmiToWord(CAST(byte_length));
+  // The goto above ensures that byte_length is a Smi.
+  TNode<Smi> smi_byte_length = CAST(byte_length);
+  GotoIf(SmiGreaterThan(smi_byte_length,
+                        SmiConstant(V8_TYPED_ARRAY_MAX_SIZE_IN_HEAP)),
+         &allocate_off_heap);
+  TNode<IntPtrT> word_byte_length = SmiToIntPtr(smi_byte_length);
   Goto(&allocate_on_heap);
 
   BIND(&allocate_on_heap);
@@ -281,17 +203,18 @@ TF_BUILTIN(TypedArrayInitialize, TypedArrayBuiltinsAssembler) {
 
     // Fix alignment if needed.
     DCHECK_EQ(0, FixedTypedArrayBase::kHeaderSize & kObjectAlignmentMask);
-    Node* aligned_header_size =
+    TNode<IntPtrT> aligned_header_size =
         IntPtrConstant(FixedTypedArrayBase::kHeaderSize + kObjectAlignmentMask);
-    Node* size = IntPtrAdd(word_byte_length, aligned_header_size);
-    var_total_size.Bind(WordAnd(size, IntPtrConstant(~kObjectAlignmentMask)));
+    TNode<IntPtrT> size = IntPtrAdd(word_byte_length, aligned_header_size);
+    var_total_size = WordAnd(size, IntPtrConstant(~kObjectAlignmentMask));
     Goto(&allocate_elements);
   }
 
   BIND(&aligned);
   {
-    Node* header_size = IntPtrConstant(FixedTypedArrayBase::kHeaderSize);
-    var_total_size.Bind(IntPtrAdd(word_byte_length, header_size));
+    TNode<IntPtrT> header_size =
+        IntPtrConstant(FixedTypedArrayBase::kHeaderSize);
+    var_total_size = IntPtrAdd(word_byte_length, header_size);
     Goto(&allocate_elements);
   }
 
@@ -359,7 +282,8 @@ TF_BUILTIN(TypedArrayInitialize, TypedArrayBuiltinsAssembler) {
 
   BIND(&attach_buffer);
   {
-    AttachBuffer(holder, var_buffer, fixed_typed_map, length, byte_offset);
+    AttachBuffer(holder, var_buffer.value(), fixed_typed_map, length,
+                 byte_offset);
     Goto(&done);
   }
 
@@ -368,49 +292,44 @@ TF_BUILTIN(TypedArrayInitialize, TypedArrayBuiltinsAssembler) {
 }
 
 // ES6 #sec-typedarray-length
-TF_BUILTIN(TypedArrayConstructByLength, TypedArrayBuiltinsAssembler) {
-  Node* holder = Parameter(Descriptor::kHolder);
-  TNode<Object> maybe_length = CAST(Parameter(Descriptor::kLength));
-  TNode<Object> element_size = CAST(Parameter(Descriptor::kElementSize));
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  CSA_ASSERT(this, IsJSTypedArray(holder));
+void TypedArrayBuiltinsAssembler::ConstructByLength(TNode<Context> context,
+                                                    TNode<JSTypedArray> holder,
+                                                    TNode<Object> length,
+                                                    TNode<Smi> element_size) {
   CSA_ASSERT(this, TaggedIsPositiveSmi(element_size));
 
-  Label invalid_length(this);
+  Label invalid_length(this, Label::kDeferred), done(this);
 
-  TNode<Number> length = ToInteger_Inline(
-      context, maybe_length, CodeStubAssembler::kTruncateMinusZero);
+  TNode<Number> converted_length =
+      ToInteger_Inline(context, length, CodeStubAssembler::kTruncateMinusZero);
 
   // The maximum length of a TypedArray is MaxSmi().
   // Note: this is not per spec, but rather a constraint of our current
-  // representation (which uses smi's).
-  GotoIf(TaggedIsNotSmi(length), &invalid_length);
-  GotoIf(SmiLessThan(length, SmiConstant(0)), &invalid_length);
-
-  CallBuiltin(Builtins::kTypedArrayInitialize, context, holder, length,
-              element_size, TrueConstant());
-  Return(UndefinedConstant());
+  // representation (which uses Smis).
+  GotoIf(TaggedIsNotSmi(converted_length), &invalid_length);
+  // The goto above ensures that byte_length is a Smi.
+  TNode<Smi> smi_converted_length = CAST(converted_length);
+  GotoIf(SmiLessThan(smi_converted_length, SmiConstant(0)), &invalid_length);
+
+  Node* initialize = TrueConstant();
+  CallBuiltin(Builtins::kTypedArrayInitialize, context, holder,
+              converted_length, element_size, initialize);
+  Goto(&done);
 
   BIND(&invalid_length);
   {
-    CallRuntime(Runtime::kThrowRangeError, context,
-                SmiConstant(MessageTemplate::kInvalidTypedArrayLength), length);
-    Unreachable();
+    ThrowRangeError(context, MessageTemplate::kInvalidTypedArrayLength,
+                    converted_length);
   }
+
+  BIND(&done);
 }
 
 // ES6 #sec-typedarray-buffer-byteoffset-length
-TF_BUILTIN(TypedArrayConstructByArrayBuffer, TypedArrayBuiltinsAssembler) {
-  Node* holder = Parameter(Descriptor::kHolder);
-  Node* buffer = Parameter(Descriptor::kBuffer);
-  TNode<Object> byte_offset = CAST(Parameter(Descriptor::kByteOffset));
-  Node* length = Parameter(Descriptor::kLength);
-  Node* element_size = Parameter(Descriptor::kElementSize);
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-
-  CSA_ASSERT(this, IsJSTypedArray(holder));
-  CSA_ASSERT(this, IsJSArrayBuffer(buffer));
+void TypedArrayBuiltinsAssembler::ConstructByArrayBuffer(
+    TNode<Context> context, TNode<JSTypedArray> holder,
+    TNode<JSArrayBuffer> buffer, TNode<Object> byte_offset,
+    TNode<Object> length, TNode<Smi> element_size) {
   CSA_ASSERT(this, TaggedIsPositiveSmi(element_size));
 
   VARIABLE(new_byte_length, MachineRepresentation::kTagged, SmiConstant(0));
@@ -421,7 +340,8 @@ TF_BUILTIN(TypedArrayConstructByArrayBuffer, TypedArrayBuiltinsAssembler) {
       invalid_offset_error(this, Label::kDeferred);
   Label offset_is_smi(this), offset_not_smi(this, Label::kDeferred),
       check_length(this), call_init(this), invalid_length(this),
-      length_undefined(this), length_defined(this), detached_error(this);
+      length_undefined(this), length_defined(this), detached_error(this),
+      done(this);
 
   GotoIf(IsUndefined(byte_offset), &check_length);
 
@@ -477,7 +397,7 @@ TF_BUILTIN(TypedArrayConstructByArrayBuffer, TypedArrayBuiltinsAssembler) {
 
   BIND(&length_defined);
   {
-    Node* new_length = ToSmiIndex(length, context, &invalid_length);
+    TNode<Smi> new_length = ToSmiIndex(length, context, &invalid_length);
     GotoIf(IsDetachedBuffer(buffer), &detached_error);
     new_byte_length.Bind(SmiMul(new_length, element_size));
     // Reading the byte length must come after the ToIndex operation, which
@@ -495,22 +415,18 @@ TF_BUILTIN(TypedArrayConstructByArrayBuffer, TypedArrayBuiltinsAssembler) {
 
   BIND(&call_init);
   {
-    Node* new_length = CallBuiltin(Builtins::kDivide, context,
-                                   new_byte_length.value(), element_size);
+    TNode<Object> raw_length = CallBuiltin(
+        Builtins::kDivide, context, new_byte_length.value(), element_size);
     // Force the result into a Smi, or throw a range error if it doesn't fit.
-    new_length = ToSmiIndex(new_length, context, &invalid_length);
+    TNode<Smi> new_length = ToSmiIndex(raw_length, context, &invalid_length);
 
     CallBuiltin(Builtins::kTypedArrayInitializeWithBuffer, context, holder,
                 new_length, buffer, element_size, offset.value());
-    Return(UndefinedConstant());
+    Goto(&done);
   }
 
   BIND(&invalid_offset_error);
-  {
-    CallRuntime(Runtime::kThrowRangeError, context,
-                SmiConstant(MessageTemplate::kInvalidOffset), byte_offset);
-    Unreachable();
-  }
+  { ThrowRangeError(context, MessageTemplate::kInvalidOffset, byte_offset); }
 
   BIND(&start_offset_error);
   {
@@ -534,24 +450,84 @@ TF_BUILTIN(TypedArrayConstructByArrayBuffer, TypedArrayBuiltinsAssembler) {
 
   BIND(&invalid_length);
   {
-    CallRuntime(Runtime::kThrowRangeError, context,
-                SmiConstant(MessageTemplate::kInvalidTypedArrayLength), length);
-    Unreachable();
+    ThrowRangeError(context, MessageTemplate::kInvalidTypedArrayLength, length);
   }
 
   BIND(&detached_error);
   { ThrowTypeError(context, MessageTemplate::kDetachedOperation, "Construct"); }
+
+  BIND(&done);
+}
+
+void TypedArrayBuiltinsAssembler::ConstructByTypedArray(
+    TNode<Context> context, TNode<JSTypedArray> holder,
+    TNode<JSTypedArray> typed_array, TNode<Smi> element_size) {
+  CSA_ASSERT(this, TaggedIsPositiveSmi(element_size));
+
+  TNode<JSFunction> const default_constructor = CAST(LoadContextElement(
+      LoadNativeContext(context), Context::ARRAY_BUFFER_FUN_INDEX));
+
+  Label construct(this), if_detached(this), if_notdetached(this),
+      check_for_sab(this), if_buffernotshared(this), check_prototype(this),
+      done(this);
+  TVARIABLE(JSReceiver, buffer_constructor, default_constructor);
+
+  TNode<JSArrayBuffer> source_buffer = LoadObjectField<JSArrayBuffer>(
+      typed_array, JSArrayBufferView::kBufferOffset);
+  Branch(IsDetachedBuffer(source_buffer), &if_detached, &if_notdetached);
+
+  // TODO(petermarshall): Throw on detached typedArray.
+  TVARIABLE(Smi, source_length);
+  BIND(&if_detached);
+  source_length = SmiConstant(0);
+  Goto(&check_for_sab);
+
+  BIND(&if_notdetached);
+  source_length =
+      CAST(LoadObjectField(typed_array, JSTypedArray::kLengthOffset));
+  Goto(&check_for_sab);
+
+  // The spec requires that constructing a typed array using a SAB-backed typed
+  // array use the ArrayBuffer constructor, not the species constructor. See
+  // https://tc39.github.io/ecma262/#sec-typedarray-typedarray.
+  BIND(&check_for_sab);
+  TNode<Uint32T> bitfield =
+      LoadObjectField<Uint32T>(source_buffer, JSArrayBuffer::kBitFieldOffset);
+  Branch(IsSetWord32<JSArrayBuffer::IsShared>(bitfield), &construct,
+         &if_buffernotshared);
+
+  BIND(&if_buffernotshared);
+  {
+    buffer_constructor =
+        CAST(SpeciesConstructor(context, source_buffer, default_constructor));
+    // TODO(petermarshall): Throw on detached typedArray.
+    GotoIfNot(IsDetachedBuffer(source_buffer), &construct);
+    source_length = SmiConstant(0);
+    Goto(&construct);
+  }
+
+  BIND(&construct);
+  {
+    ConstructByArrayLike(context, holder, typed_array, source_length.value(),
+                         element_size);
+    TNode<Object> proto = GetProperty(context, buffer_constructor.value(),
+                                      PrototypeStringConstant());
+    // TODO(petermarshall): Correct for realm as per 9.1.14 step 4.
+    TNode<JSArrayBuffer> buffer = LoadObjectField<JSArrayBuffer>(
+        holder, JSArrayBufferView::kBufferOffset);
+    CallRuntime(Runtime::kInternalSetPrototype, context, buffer, proto);
+
+    Goto(&done);
+  }
+
+  BIND(&done);
 }
 
 Node* TypedArrayBuiltinsAssembler::LoadDataPtr(Node* typed_array) {
   CSA_ASSERT(this, IsJSTypedArray(typed_array));
   Node* elements = LoadElements(typed_array);
   CSA_ASSERT(this, IsFixedTypedArray(elements));
-  Node* base_pointer = BitcastTaggedToWord(
-      LoadObjectField(elements, FixedTypedArrayBase::kBasePointerOffset));
-  Node* external_pointer = BitcastTaggedToWord(
-      LoadObjectField(elements, FixedTypedArrayBase::kExternalPointerOffset));
-  return IntPtrAdd(base_pointer, external_pointer);
+  return LoadFixedTypedArrayBackingStore(CAST(elements));
 }
 
 TNode<BoolT> TypedArrayBuiltinsAssembler::ByteLengthIsValid(
@@ -574,28 +550,24 @@ TNode<BoolT> TypedArrayBuiltinsAssembler::ByteLengthIsValid(
   Goto(&done);
 
   BIND(&done);
-  return is_valid;
+  return is_valid.value();
 }
 
-TF_BUILTIN(TypedArrayConstructByArrayLike, TypedArrayBuiltinsAssembler) {
-  Node* holder = Parameter(Descriptor::kHolder);
-  Node* array_like = Parameter(Descriptor::kArrayLike);
-  Node* initial_length = Parameter(Descriptor::kLength);
-  Node* element_size = Parameter(Descriptor::kElementSize);
-  CSA_ASSERT(this, TaggedIsSmi(element_size));
-  Node* context = Parameter(Descriptor::kContext);
-
+void TypedArrayBuiltinsAssembler::ConstructByArrayLike(
+    TNode<Context> context, TNode<JSTypedArray> holder,
+    TNode<HeapObject> array_like, TNode<Object> initial_length,
+    TNode<Smi> element_size) {
   Node* initialize = FalseConstant();
 
-  Label invalid_length(this), fill(this), fast_copy(this);
+  Label invalid_length(this), fill(this), fast_copy(this), done(this);
 
   // The caller has looked up length on array_like, which is observable.
-  Node* length = ToSmiLength(initial_length, context, &invalid_length);
+  TNode<Smi> length = ToSmiLength(initial_length, context, &invalid_length);
 
   CallBuiltin(Builtins::kTypedArrayInitialize, context, holder, length,
               element_size, initialize);
   GotoIf(SmiNotEqual(length, SmiConstant(0)), &fill);
-  Return(UndefinedConstant());
+  Goto(&done);
 
   BIND(&fill);
   TNode<Int32T> holder_kind = LoadMapElementsKind(LoadMap(holder));
@@ -605,7 +577,7 @@ TF_BUILTIN(TypedArrayConstructByArrayLike, TypedArrayBuiltinsAssembler) {
   // Copy using the elements accessor.
   CallRuntime(Runtime::kTypedArrayCopyElements, context, holder, array_like,
               length);
-  Return(UndefinedConstant());
+  Goto(&done);
 
   BIND(&fast_copy);
   {
@@ -632,15 +604,150 @@ TF_BUILTIN(TypedArrayConstructByArrayLike, TypedArrayBuiltinsAssembler) {
     CallCFunction3(MachineType::AnyTagged(), MachineType::Pointer(),
                    MachineType::Pointer(), MachineType::UintPtr(), memcpy,
                    holder_data_ptr, source_data_ptr, byte_length_intptr);
-    Return(UndefinedConstant());
+    Goto(&done);
   }
 
   BIND(&invalid_length);
   {
-    CallRuntime(Runtime::kThrowRangeError, context,
-                SmiConstant(MessageTemplate::kInvalidTypedArrayLength),
-                initial_length);
-    Unreachable();
+    ThrowRangeError(context, MessageTemplate::kInvalidTypedArrayLength,
+                    initial_length);
+  }
+
+  BIND(&done);
+}
+
+void TypedArrayBuiltinsAssembler::ConstructByIterable(
+    TNode<Context> context, TNode<JSTypedArray> holder,
+    TNode<JSReceiver> iterable, TNode<Object> iterator_fn,
+    TNode<Smi> element_size) {
+  CSA_ASSERT(this, IsCallable(iterator_fn));
+  Label fast_path(this), slow_path(this), done(this);
+
+  TNode<JSArray> array_like = CAST(
+      CallBuiltin(Builtins::kIterableToList, context, iterable, iterator_fn));
+  TNode<Object> initial_length = LoadJSArrayLength(array_like);
+  ConstructByArrayLike(context, holder, array_like, initial_length,
+                       element_size);
+}
+
+// ES #sec-typedarray-constructors
+TF_BUILTIN(CreateTypedArray, TypedArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<JSFunction> target = CAST(Parameter(Descriptor::kTarget));
+  TNode<JSReceiver> new_target = CAST(Parameter(Descriptor::kNewTarget));
+  TNode<Object> arg1 = CAST(Parameter(Descriptor::kArg1));
+  TNode<Object> arg2 = CAST(Parameter(Descriptor::kArg2));
+  TNode<Object> arg3 = CAST(Parameter(Descriptor::kArg3));
+
+  CSA_ASSERT(this, IsConstructor(target));
+  CSA_ASSERT(this, IsJSReceiver(new_target));
+
+  Label if_arg1isbuffer(this), if_arg1istypedarray(this),
+      if_arg1isreceiver(this), if_arg1isnumber(this), return_result(this);
+
+  ConstructorBuiltinsAssembler constructor_assembler(this->state());
+  TNode<JSTypedArray> result = CAST(
+      constructor_assembler.EmitFastNewObject(context, target, new_target));
+
+  TNode<Smi> element_size =
+      SmiTag(GetTypedArrayElementSize(LoadElementsKind(result)));
+
+  GotoIf(TaggedIsSmi(arg1), &if_arg1isnumber);
+  GotoIf(IsJSArrayBuffer(arg1), &if_arg1isbuffer);
+  GotoIf(IsJSTypedArray(arg1), &if_arg1istypedarray);
+  GotoIf(IsJSReceiver(arg1), &if_arg1isreceiver);
+  Goto(&if_arg1isnumber);
+
+  // https://tc39.github.io/ecma262/#sec-typedarray-buffer-byteoffset-length
+  BIND(&if_arg1isbuffer);
+  {
+    ConstructByArrayBuffer(context, result, CAST(arg1), arg2, arg3,
+                           element_size);
+    Goto(&return_result);
+  }
+
+  // https://tc39.github.io/ecma262/#sec-typedarray-typedarray
+  BIND(&if_arg1istypedarray);
+  {
+    TNode<JSTypedArray> typed_array = CAST(arg1);
+    ConstructByTypedArray(context, result, typed_array, element_size);
+    Goto(&return_result);
+  }
+
+  // https://tc39.github.io/ecma262/#sec-typedarray-object
+  BIND(&if_arg1isreceiver);
+  {
+    Label if_iteratorundefined(this), if_iteratornotcallable(this);
+    // Get iterator symbol
+    TNode<Object> iteratorFn =
+        CAST(GetMethod(context, arg1, isolate()->factory()->iterator_symbol(),
+                       &if_iteratorundefined));
+    GotoIf(TaggedIsSmi(iteratorFn), &if_iteratornotcallable);
+    GotoIfNot(IsCallable(iteratorFn), &if_iteratornotcallable);
+
+    ConstructByIterable(context, result, CAST(arg1), iteratorFn, element_size);
+    Goto(&return_result);
+
+    BIND(&if_iteratorundefined);
+    {
+      TNode<HeapObject> array_like = CAST(arg1);
+      TNode<Object> initial_length =
+          GetProperty(context, arg1, LengthStringConstant());
+
+      ConstructByArrayLike(context, result, array_like, initial_length,
+                           element_size);
+      Goto(&return_result);
+    }
+
+    BIND(&if_iteratornotcallable);
+    { ThrowTypeError(context, MessageTemplate::kIteratorSymbolNonCallable); }
+  }
+
+  // The first argument was a number or fell through and is treated as
+  // a number. https://tc39.github.io/ecma262/#sec-typedarray-length
+  BIND(&if_arg1isnumber);
+  {
+    ConstructByLength(context, result, arg1, element_size);
+    Goto(&return_result);
+  }
+
+  BIND(&return_result);
+  Return(result);
+}
+
+TF_BUILTIN(TypedArrayConstructorLazyDeoptContinuation,
+           TypedArrayBuiltinsAssembler) {
+  Node* result = Parameter(Descriptor::kResult);
+  Return(result);
+}
+
+// ES #sec-typedarray-constructors
+TF_BUILTIN(TypedArrayConstructor, TypedArrayBuiltinsAssembler) {
+  Node* context = Parameter(BuiltinDescriptor::kContext);
+  Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
+                               MachineType::TaggedPointer());
+  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  Node* argc =
+      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+  CodeStubArguments args(this, argc);
+  Node* arg1 = args.GetOptionalArgumentValue(0);
+  Node* arg2 = args.GetOptionalArgumentValue(1);
+  Node* arg3 = args.GetOptionalArgumentValue(2);
+
+  // If NewTarget is undefined, throw a TypeError exception.
+  // All the TypedArray constructors have this as the first step:
+  // https://tc39.github.io/ecma262/#sec-typedarray-constructors
+  Label throwtypeerror(this, Label::kDeferred);
+  GotoIf(IsUndefined(new_target), &throwtypeerror);
+
+  Node* result = CallBuiltin(Builtins::kCreateTypedArray, context, target,
+                             new_target, arg1, arg2, arg3);
+  args.PopAndReturn(result);
+
+  BIND(&throwtypeerror);
+  {
+    Node* name = CallRuntime(Runtime::kGetFunctionName, context, target);
+    ThrowTypeError(context, MessageTemplate::kConstructorNotFunction, name);
   }
 }
 
@@ -668,9 +775,8 @@ void TypedArrayBuiltinsAssembler::GenerateTypedArrayPrototypeGetter(
   BIND(&receiver_is_incompatible);
   {
     // The {receiver} is not a valid JSTypedArray.
-    CallRuntime(Runtime::kThrowIncompatibleMethodReceiver, context,
-                StringConstant(method_name), receiver);
-    Unreachable();
+    ThrowTypeError(context, MessageTemplate::kIncompatibleMethodReceiver,
+                   StringConstant(method_name), receiver);
   }
 }
 
@@ -707,57 +813,156 @@ TNode<Word32T> TypedArrayBuiltinsAssembler::IsUint8ElementsKind(
                   Word32Equal(kind, Int32Constant(UINT8_CLAMPED_ELEMENTS)));
 }
 
+TNode<Word32T> TypedArrayBuiltinsAssembler::IsBigInt64ElementsKind(
+    TNode<Word32T> kind) {
+  return Word32Or(Word32Equal(kind, Int32Constant(BIGINT64_ELEMENTS)),
+                  Word32Equal(kind, Int32Constant(BIGUINT64_ELEMENTS)));
+}
+
 TNode<Word32T> TypedArrayBuiltinsAssembler::LoadElementsKind(
-    TNode<Object> typed_array) {
-  CSA_ASSERT(this, IsJSTypedArray(typed_array));
-  return LoadMapElementsKind(LoadMap(CAST(typed_array)));
+    TNode<JSTypedArray> typed_array) {
+  return LoadMapElementsKind(LoadMap(typed_array));
 }
 
 TNode<IntPtrT> TypedArrayBuiltinsAssembler::GetTypedArrayElementSize(
     TNode<Word32T> elements_kind) {
   TVARIABLE(IntPtrT, element_size);
-  Label next(this), if_unknown_type(this, Label::kDeferred);
 
-  size_t const kTypedElementsKindCount = LAST_FIXED_TYPED_ARRAY_ELEMENTS_KIND -
-                                         FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND +
-                                         1;
+  DispatchTypedArrayByElementsKind(
+      elements_kind,
+      [&](ElementsKind el_kind, int size, int typed_array_fun_index) {
+        element_size = IntPtrConstant(size);
+      });
 
-  int32_t elements_kinds[kTypedElementsKindCount] = {
-#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) TYPE##_ELEMENTS,
-      TYPED_ARRAYS(TYPED_ARRAY_CASE)
-#undef TYPED_ARRAY_CASE
-  };
+  return element_size.value();
+}
 
-#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
-  Label if_##type##array(this);
-  TYPED_ARRAYS(TYPED_ARRAY_CASE)
-#undef TYPED_ARRAY_CASE
+TNode<Object> TypedArrayBuiltinsAssembler::GetDefaultConstructor(
+    TNode<Context> context, TNode<JSTypedArray> exemplar) {
+  TVARIABLE(IntPtrT, context_slot);
+  TNode<Word32T> elements_kind = LoadElementsKind(exemplar);
 
-  Label* elements_kind_labels[kTypedElementsKindCount] = {
-#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) &if_##type##array,
-      TYPED_ARRAYS(TYPED_ARRAY_CASE)
-#undef TYPED_ARRAY_CASE
-  };
+  DispatchTypedArrayByElementsKind(
+      elements_kind,
+      [&](ElementsKind el_kind, int size, int typed_array_function_index) {
+        context_slot = IntPtrConstant(typed_array_function_index);
+      });
 
-  Switch(elements_kind, &if_unknown_type, elements_kinds, elements_kind_labels,
-         kTypedElementsKindCount);
+  return LoadContextElement(LoadNativeContext(context), context_slot.value());
+}
 
-#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
-  BIND(&if_##type##array);                              \
-  {                                                     \
-    element_size = IntPtrConstant(size);                \
-    Goto(&next);                                        \
-  }
-  TYPED_ARRAYS(TYPED_ARRAY_CASE)
-#undef TYPED_ARRAY_CASE
+TNode<Object> TypedArrayBuiltinsAssembler::TypedArraySpeciesConstructor(
+    TNode<Context> context, TNode<JSTypedArray> exemplar) {
+  TVARIABLE(Object, var_constructor);
+  Label slow(this), done(this);
 
-  BIND(&if_unknown_type);
+  // Let defaultConstructor be the intrinsic object listed in column one of
+  // Table 52 for exemplar.[[TypedArrayName]].
+  TNode<Object> default_constructor = GetDefaultConstructor(context, exemplar);
+
+  var_constructor = default_constructor;
+  Node* map = LoadMap(exemplar);
+  GotoIfNot(IsPrototypeTypedArrayPrototype(context, map), &slow);
+  Branch(IsSpeciesProtectorCellInvalid(), &slow, &done);
+
+  BIND(&slow);
+  var_constructor =
+      CAST(SpeciesConstructor(context, exemplar, default_constructor));
+  Goto(&done);
+
+  BIND(&done);
+  return var_constructor.value();
+}
+
+TNode<JSTypedArray> TypedArrayBuiltinsAssembler::SpeciesCreateByArrayBuffer(
+    TNode<Context> context, TNode<JSTypedArray> exemplar,
+    TNode<JSArrayBuffer> buffer, TNode<Number> byte_offset, TNode<Smi> len,
+    const char* method_name) {
+  // Let constructor be ? SpeciesConstructor(exemplar, defaultConstructor).
+  TNode<Object> constructor = TypedArraySpeciesConstructor(context, exemplar);
+
+  // Let newTypedArray be ? Construct(constructor, argumentList).
+  TNode<Object> new_object =
+      CAST(ConstructJS(CodeFactory::Construct(isolate()), context, constructor,
+                       buffer, byte_offset, len));
+
+  // Perform ? ValidateTypedArray(newTypedArray).
+  return ValidateTypedArray(context, new_object, method_name);
+}
+
+TNode<JSTypedArray> TypedArrayBuiltinsAssembler::SpeciesCreateByLength(
+    TNode<Context> context, TNode<JSTypedArray> exemplar, TNode<Smi> len,
+    const char* method_name) {
+  CSA_ASSERT(this, TaggedIsPositiveSmi(len));
+
+  // Let constructor be ? SpeciesConstructor(exemplar, defaultConstructor).
+  TNode<Object> constructor = TypedArraySpeciesConstructor(context, exemplar);
+  CSA_ASSERT(this, IsJSFunction(constructor));
+
+  return CreateByLength(context, constructor, len, method_name);
+}
+
+TNode<JSTypedArray> TypedArrayBuiltinsAssembler::CreateByLength(
+    TNode<Context> context, TNode<Object> constructor, TNode<Smi> len,
+    const char* method_name) {
+  // Let newTypedArray be ? Construct(constructor, argumentList).
+  TNode<Object> new_object = CAST(ConstructJS(CodeFactory::Construct(isolate()),
+                                              context, constructor, len));
+
+  // Perform ? ValidateTypedArray(newTypedArray).
+  TNode<JSTypedArray> new_typed_array =
+      ValidateTypedArray(context, new_object, method_name);
+
+  // If newTypedArray.[[ArrayLength]] < argumentList[0], throw a TypeError
+  // exception.
+  Label if_length_is_not_short(this);
+  TNode<Smi> new_length =
+      LoadObjectField<Smi>(new_typed_array, JSTypedArray::kLengthOffset);
+  GotoIfNot(SmiLessThan(new_length, len), &if_length_is_not_short);
+  ThrowTypeError(context, MessageTemplate::kTypedArrayTooShort);
+
+  BIND(&if_length_is_not_short);
+  return new_typed_array;
+}
+
+TNode<JSArrayBuffer> TypedArrayBuiltinsAssembler::GetBuffer(
+    TNode<Context> context, TNode<JSTypedArray> array) {
+  Label call_runtime(this), done(this);
+  TVARIABLE(Object, var_result);
+
+  TNode<Object> buffer = LoadObjectField(array, JSTypedArray::kBufferOffset);
+  GotoIf(IsDetachedBuffer(buffer), &call_runtime);
+  TNode<UintPtrT> backing_store = LoadObjectField<UintPtrT>(
+      CAST(buffer), JSArrayBuffer::kBackingStoreOffset);
+  GotoIf(WordEqual(backing_store, IntPtrConstant(0)), &call_runtime);
+  var_result = buffer;
+  Goto(&done);
+
+  BIND(&call_runtime);
   {
-    element_size = IntPtrConstant(0);
-    Goto(&next);
+    var_result = CallRuntime(Runtime::kTypedArrayGetBuffer, context, array);
+    Goto(&done);
   }
-  BIND(&next);
-  return element_size;
+
+  BIND(&done);
+  return CAST(var_result.value());
+}
+
+TNode<JSTypedArray> TypedArrayBuiltinsAssembler::ValidateTypedArray(
+    TNode<Context> context, TNode<Object> obj, const char* method_name) {
+  Label validation_done(this);
+
+  // If it is not a typed array, throw
+  ThrowIfNotInstanceType(context, obj, JS_TYPED_ARRAY_TYPE, method_name);
+
+  // If the typed array's buffer is detached, throw
+  TNode<Object> buffer =
+      LoadObjectField(CAST(obj), JSTypedArray::kBufferOffset);
+  GotoIfNot(IsDetachedBuffer(buffer), &validation_done);
+  ThrowTypeError(context, MessageTemplate::kDetachedOperation, method_name);
+
+  BIND(&validation_done);
+  return CAST(obj);
 }
 
 void TypedArrayBuiltinsAssembler::SetTypedArraySource(
@@ -801,7 +1006,7 @@ void TypedArrayBuiltinsAssembler::SetTypedArraySource(
   CSA_ASSERT(this,
              UintPtrGreaterThanOrEqual(source_byte_length, IntPtrConstant(0)));
 
-  Label call_memmove(this), fast_c_call(this), out(this);
+  Label call_memmove(this), fast_c_call(this), out(this), exception(this);
 
   // A fast memmove call can be used when the source and target types are are
   // the same or either Uint8 or Uint8Clamped.
@@ -823,6 +1028,10 @@ void TypedArrayBuiltinsAssembler::SetTypedArraySource(
         this, UintPtrGreaterThanOrEqual(
                   IntPtrMul(target_length, target_el_size), IntPtrConstant(0)));
 
+    GotoIf(Word32NotEqual(IsBigInt64ElementsKind(source_el_kind),
+                          IsBigInt64ElementsKind(target_el_kind)),
+           &exception);
+
     TNode<IntPtrT> source_length =
         LoadAndUntagObjectField(source, JSTypedArray::kLengthOffset);
     CallCCopyTypedArrayElementsToTypedArray(source, target, source_length,
@@ -830,6 +1039,9 @@ void TypedArrayBuiltinsAssembler::SetTypedArraySource(
     Goto(&out);
   }
 
+  BIND(&exception);
+  ThrowTypeError(context, MessageTemplate::kBigIntMixedTypes);
+
   BIND(&out);
 }
 
@@ -871,6 +1083,7 @@ void TypedArrayBuiltinsAssembler::SetJSArraySource(
   }
 
   BIND(&fast_c_call);
+  GotoIf(IsBigInt64ElementsKind(LoadElementsKind(target)), call_runtime);
   CallCCopyFastNumberJSArrayElementsToTypedArray(context, source, target,
                                                  source_length, offset);
   Goto(&out);
@@ -893,6 +1106,7 @@ void TypedArrayBuiltinsAssembler::
                                                    TNode<JSTypedArray> dest,
                                                    TNode<IntPtrT> source_length,
                                                    TNode<IntPtrT> offset) {
+  CSA_ASSERT(this, Word32Not(IsBigInt64ElementsKind(LoadElementsKind(dest))));
   TNode<ExternalReference> f = ExternalConstant(
       ExternalReference::copy_fast_number_jsarray_elements_to_typed_array(
           isolate()));
@@ -913,6 +1127,56 @@ void TypedArrayBuiltinsAssembler::CallCCopyTypedArrayElementsToTypedArray(
                  offset);
 }
 
+void TypedArrayBuiltinsAssembler::CallCCopyTypedArrayElementsSlice(
+    TNode<JSTypedArray> source, TNode<JSTypedArray> dest, TNode<IntPtrT> start,
+    TNode<IntPtrT> end) {
+  TNode<ExternalReference> f = ExternalConstant(
+      ExternalReference::copy_typed_array_elements_slice(isolate()));
+  CallCFunction4(MachineType::AnyTagged(), MachineType::AnyTagged(),
+                 MachineType::AnyTagged(), MachineType::UintPtr(),
+                 MachineType::UintPtr(), f, source, dest, start, end);
+}
+
+void TypedArrayBuiltinsAssembler::DispatchTypedArrayByElementsKind(
+    TNode<Word32T> elements_kind, const TypedArraySwitchCase& case_function) {
+  Label next(this), if_unknown_type(this, Label::kDeferred);
+
+  int32_t elements_kinds[] = {
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) TYPE##_ELEMENTS,
+      TYPED_ARRAYS(TYPED_ARRAY_CASE)
+#undef TYPED_ARRAY_CASE
+  };
+
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
+  Label if_##type##array(this);
+  TYPED_ARRAYS(TYPED_ARRAY_CASE)
+#undef TYPED_ARRAY_CASE
+
+  Label* elements_kind_labels[] = {
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) &if_##type##array,
+      TYPED_ARRAYS(TYPED_ARRAY_CASE)
+#undef TYPED_ARRAY_CASE
+  };
+  STATIC_ASSERT(arraysize(elements_kinds) == arraysize(elements_kind_labels));
+
+  Switch(elements_kind, &if_unknown_type, elements_kinds, elements_kind_labels,
+         arraysize(elements_kinds));
+
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                    \
+  BIND(&if_##type##array);                                                 \
+  {                                                                        \
+    case_function(TYPE##_ELEMENTS, size, Context::TYPE##_ARRAY_FUN_INDEX); \
+    Goto(&next);                                                           \
+  }
+  TYPED_ARRAYS(TYPED_ARRAY_CASE)
+#undef TYPED_ARRAY_CASE
+
+  BIND(&if_unknown_type);
+  Unreachable();
+
+  BIND(&next);
+}
+
 // ES #sec-get-%typedarray%.prototype.set
 TF_BUILTIN(TypedArrayPrototypeSet, TypedArrayBuiltinsAssembler) {
   TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
@@ -998,6 +1262,192 @@ TF_BUILTIN(TypedArrayPrototypeSet, TypedArrayBuiltinsAssembler) {
   ThrowTypeError(context, MessageTemplate::kNotTypedArray);
 }
 
+// ES %TypedArray%.prototype.slice
+TF_BUILTIN(TypedArrayPrototypeSlice, TypedArrayBuiltinsAssembler) {
+  const char* method_name = "%TypedArray%.prototype.slice";
+  Label call_c(this), call_memmove(this), if_count_is_not_zero(this),
+      if_typed_array_is_neutered(this, Label::kDeferred),
+      if_bigint_mixed_types(this, Label::kDeferred);
+
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  CodeStubArguments args(
+      this, ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount)));
+
+  TNode<Object> receiver = args.GetReceiver();
+  TNode<JSTypedArray> source =
+      ValidateTypedArray(context, receiver, method_name);
+
+  TNode<Smi> source_length =
+      LoadObjectField<Smi>(source, JSTypedArray::kLengthOffset);
+
+  // Convert start offset argument to integer, and calculate relative offset.
+  TNode<Object> start = args.GetOptionalArgumentValue(0, SmiConstant(0));
+  TNode<Smi> start_index =
+      SmiTag(ConvertToRelativeIndex(context, start, SmiUntag(source_length)));
+
+  // Convert end offset argument to integer, and calculate relative offset.
+  // If end offset is not given or undefined is given, set source_length to
+  // "end_index".
+  TNode<Object> end = args.GetOptionalArgumentValue(1, UndefinedConstant());
+  TNode<Smi> end_index =
+      Select<Smi>(IsUndefined(end), [=] { return source_length; },
+                  [=] {
+                    return SmiTag(ConvertToRelativeIndex(
+                        context, end, SmiUntag(source_length)));
+                  });
+
+  // Create a result array by invoking TypedArraySpeciesCreate.
+  TNode<Smi> count = SmiMax(SmiSub(end_index, start_index), SmiConstant(0));
+  TNode<JSTypedArray> result_array =
+      SpeciesCreateByLength(context, source, count, method_name);
+
+  // If count is zero, return early.
+  GotoIf(SmiGreaterThan(count, SmiConstant(0)), &if_count_is_not_zero);
+  args.PopAndReturn(result_array);
+
+  BIND(&if_count_is_not_zero);
+  // Check the source array is neutered or not. We don't need to check if the
+  // result array is neutered or not since TypedArraySpeciesCreate checked it.
+  CSA_ASSERT(this, Word32BinaryNot(IsDetachedBuffer(LoadObjectField(
+                       result_array, JSTypedArray::kBufferOffset))));
+  TNode<Object> receiver_buffer =
+      LoadObjectField(CAST(receiver), JSTypedArray::kBufferOffset);
+  GotoIf(IsDetachedBuffer(receiver_buffer), &if_typed_array_is_neutered);
+
+  // result_array could be a different type from source or share the same
+  // buffer with the source because of custom species constructor.
+  // If the types of source and result array are the same and they are not
+  // sharing the same buffer, use memmove.
+  TNode<Word32T> source_el_kind = LoadElementsKind(source);
+  TNode<Word32T> target_el_kind = LoadElementsKind(result_array);
+  GotoIfNot(Word32Equal(source_el_kind, target_el_kind), &call_c);
+
+  TNode<Object> target_buffer =
+      LoadObjectField(result_array, JSTypedArray::kBufferOffset);
+  Branch(WordEqual(receiver_buffer, target_buffer), &call_c, &call_memmove);
+
+  BIND(&call_memmove);
+  {
+    GotoIfForceSlowPath(&call_c);
+
+    TNode<IntPtrT> target_data_ptr =
+        UncheckedCast<IntPtrT>(LoadDataPtr(result_array));
+    TNode<IntPtrT> source_data_ptr =
+        UncheckedCast<IntPtrT>(LoadDataPtr(source));
+
+    TNode<IntPtrT> source_el_size = GetTypedArrayElementSize(source_el_kind);
+    TNode<IntPtrT> source_start_bytes =
+        IntPtrMul(SmiToIntPtr(start_index), source_el_size);
+    TNode<IntPtrT> source_start =
+        IntPtrAdd(source_data_ptr, source_start_bytes);
+
+    TNode<IntPtrT> count_bytes = IntPtrMul(SmiToIntPtr(count), source_el_size);
+
+#ifdef DEBUG
+    TNode<IntPtrT> target_byte_length =
+        LoadAndUntagObjectField(result_array, JSTypedArray::kByteLengthOffset);
+    CSA_ASSERT(this, IntPtrLessThanOrEqual(count_bytes, target_byte_length));
+
+    TNode<IntPtrT> source_byte_length =
+        LoadAndUntagObjectField(source, JSTypedArray::kByteLengthOffset);
+    TNode<IntPtrT> source_size_in_bytes =
+        IntPtrSub(source_byte_length, source_start_bytes);
+    CSA_ASSERT(this, IntPtrLessThanOrEqual(count_bytes, source_size_in_bytes));
+#endif  // DEBUG
+
+    CallCMemmove(target_data_ptr, source_start, count_bytes);
+    args.PopAndReturn(result_array);
+  }
+
+  BIND(&call_c);
+  {
+    GotoIf(Word32NotEqual(IsBigInt64ElementsKind(source_el_kind),
+                          IsBigInt64ElementsKind(target_el_kind)),
+           &if_bigint_mixed_types);
+
+    CallCCopyTypedArrayElementsSlice(
+        source, result_array, SmiToIntPtr(start_index), SmiToIntPtr(end_index));
+    args.PopAndReturn(result_array);
+  }
+
+  BIND(&if_typed_array_is_neutered);
+  ThrowTypeError(context, MessageTemplate::kDetachedOperation, method_name);
+
+  BIND(&if_bigint_mixed_types);
+  ThrowTypeError(context, MessageTemplate::kBigIntMixedTypes);
+}
+
+// ES %TypedArray%.prototype.subarray
+TF_BUILTIN(TypedArrayPrototypeSubArray, TypedArrayBuiltinsAssembler) {
+  const char* method_name = "%TypedArray%.prototype.subarray";
+  Label offset_done(this);
+
+  TVARIABLE(Smi, var_begin);
+  TVARIABLE(Smi, var_end);
+
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  CodeStubArguments args(
+      this, ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount)));
+
+  // 1. Let O be the this value.
+  // 3. If O does not have a [[TypedArrayName]] internal slot, throw a TypeError
+  // exception.
+  TNode<Object> receiver = args.GetReceiver();
+  ThrowIfNotInstanceType(context, receiver, JS_TYPED_ARRAY_TYPE, method_name);
+
+  TNode<JSTypedArray> source = CAST(receiver);
+
+  // 5. Let buffer be O.[[ViewedArrayBuffer]].
+  TNode<JSArrayBuffer> buffer = GetBuffer(context, source);
+  // 6. Let srcLength be O.[[ArrayLength]].
+  TNode<Smi> source_length =
+      LoadObjectField<Smi>(source, JSTypedArray::kLengthOffset);
+
+  // 7. Let relativeBegin be ? ToInteger(begin).
+  // 8. If relativeBegin < 0, let beginIndex be max((srcLength + relativeBegin),
+  // 0); else let beginIndex be min(relativeBegin, srcLength).
+  TNode<Object> begin = args.GetOptionalArgumentValue(0, SmiConstant(0));
+  var_begin =
+      SmiTag(ConvertToRelativeIndex(context, begin, SmiUntag(source_length)));
+
+  TNode<Object> end = args.GetOptionalArgumentValue(1, UndefinedConstant());
+  // 9. If end is undefined, let relativeEnd be srcLength;
+  var_end = source_length;
+  GotoIf(IsUndefined(end), &offset_done);
+
+  // else, let relativeEnd be ? ToInteger(end).
+  // 10. If relativeEnd < 0, let endIndex be max((srcLength + relativeEnd), 0);
+  // else let endIndex be min(relativeEnd, srcLength).
+  var_end =
+      SmiTag(ConvertToRelativeIndex(context, end, SmiUntag(source_length)));
+  Goto(&offset_done);
+
+  BIND(&offset_done);
+
+  // 11. Let newLength be max(endIndex - beginIndex, 0).
+  TNode<Smi> new_length =
+      SmiMax(SmiSub(var_end.value(), var_begin.value()), SmiConstant(0));
+
+  // 12. Let constructorName be the String value of O.[[TypedArrayName]].
+  // 13. Let elementSize be the Number value of the Element Size value specified
+  // in Table 52 for constructorName.
+  TNode<Word32T> element_kind = LoadElementsKind(source);
+  TNode<IntPtrT> element_size = GetTypedArrayElementSize(element_kind);
+
+  // 14. Let srcByteOffset be O.[[ByteOffset]].
+  TNode<Number> source_byte_offset =
+      LoadObjectField<Number>(source, JSTypedArray::kByteOffsetOffset);
+
+  // 15. Let beginByteOffset be srcByteOffset + beginIndex × elementSize.
+  TNode<Number> offset = SmiMul(var_begin.value(), SmiFromIntPtr(element_size));
+  TNode<Number> begin_byte_offset = NumberAdd(source_byte_offset, offset);
+
+  // 16. Let argumentsList be « buffer, beginByteOffset, newLength ».
+  // 17. Return ? TypedArraySpeciesCreate(O, argumentsList).
+  args.PopAndReturn(SpeciesCreateByArrayBuffer(
+      context, source, buffer, begin_byte_offset, new_length, method_name));
+}
+
 // ES #sec-get-%typedarray%.prototype-@@tostringtag
 TF_BUILTIN(TypedArrayPrototypeToStringTag, TypedArrayBuiltinsAssembler) {
   Node* receiver = Parameter(Descriptor::kReceiver);
@@ -1043,16 +1493,11 @@ TF_BUILTIN(TypedArrayPrototypeToStringTag, TypedArrayBuiltinsAssembler) {
 
 void TypedArrayBuiltinsAssembler::GenerateTypedArrayPrototypeIterationMethod(
     Node* context, Node* receiver, const char* method_name,
-    IterationKind iteration_kind) {
+    IterationKind kind) {
   Label throw_bad_receiver(this, Label::kDeferred);
-  Label throw_typeerror(this, Label::kDeferred);
 
   GotoIf(TaggedIsSmi(receiver), &throw_bad_receiver);
-
-  Node* map = LoadMap(receiver);
-  Node* instance_type = LoadMapInstanceType(map);
-  GotoIfNot(InstanceTypeEqual(instance_type, JS_TYPED_ARRAY_TYPE),
-            &throw_bad_receiver);
+  GotoIfNot(IsJSTypedArray(receiver), &throw_bad_receiver);
 
   // Check if the {receiver}'s JSArrayBuffer was neutered.
   Node* receiver_buffer =
@@ -1060,28 +1505,16 @@ void TypedArrayBuiltinsAssembler::GenerateTypedArrayPrototypeIterationMethod(
   Label if_receiverisneutered(this, Label::kDeferred);
   GotoIf(IsDetachedBuffer(receiver_buffer), &if_receiverisneutered);
 
-  Return(CreateArrayIterator(receiver, map, instance_type, context,
-                             iteration_kind));
+  Return(CreateArrayIterator(context, receiver, kind));
 
-  VARIABLE(var_message, MachineRepresentation::kTagged);
   BIND(&throw_bad_receiver);
-  var_message.Bind(SmiConstant(MessageTemplate::kNotTypedArray));
-  Goto(&throw_typeerror);
+  ThrowTypeError(context, MessageTemplate::kNotTypedArray, method_name);
 
   BIND(&if_receiverisneutered);
-  var_message.Bind(SmiConstant(MessageTemplate::kDetachedOperation));
-  Goto(&throw_typeerror);
-
-  BIND(&throw_typeerror);
-  {
-    Node* method_arg = StringConstant(method_name);
-    Node* result = CallRuntime(Runtime::kThrowTypeError, context,
-                               var_message.value(), method_arg);
-    Return(result);
-  }
+  ThrowTypeError(context, MessageTemplate::kDetachedOperation, method_name);
 }
 
-// ES6 #sec-%typedarray%.prototype.values
+// ES #sec-%typedarray%.prototype.values
 TF_BUILTIN(TypedArrayPrototypeValues, TypedArrayBuiltinsAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);
@@ -1090,7 +1523,7 @@ TF_BUILTIN(TypedArrayPrototypeValues, TypedArrayBuiltinsAssembler) {
                                              IterationKind::kValues);
 }
 
-// ES6 #sec-%typedarray%.prototype.entries
+// ES #sec-%typedarray%.prototype.entries
 TF_BUILTIN(TypedArrayPrototypeEntries, TypedArrayBuiltinsAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);
@@ -1099,7 +1532,7 @@ TF_BUILTIN(TypedArrayPrototypeEntries, TypedArrayBuiltinsAssembler) {
                                              IterationKind::kEntries);
 }
 
-// ES6 #sec-%typedarray%.prototype.keys
+// ES #sec-%typedarray%.prototype.keys
 TF_BUILTIN(TypedArrayPrototypeKeys, TypedArrayBuiltinsAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* receiver = Parameter(Descriptor::kReceiver);
@@ -1107,6 +1540,427 @@ TF_BUILTIN(TypedArrayPrototypeKeys, TypedArrayBuiltinsAssembler) {
       context, receiver, "%TypedArray%.prototype.keys()", IterationKind::kKeys);
 }
 
+// ES6 #sec-%typedarray%.of
+TF_BUILTIN(TypedArrayOf, TypedArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+
+  // 1. Let len be the actual number of arguments passed to this function.
+  TNode<IntPtrT> length = ChangeInt32ToIntPtr(
+      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount)));
+  // 2. Let items be the List of arguments passed to this function.
+  CodeStubArguments args(this, length, nullptr, INTPTR_PARAMETERS,
+                         CodeStubArguments::ReceiverMode::kHasReceiver);
+
+  Label if_not_constructor(this, Label::kDeferred),
+      if_neutered(this, Label::kDeferred);
+
+  // 3. Let C be the this value.
+  // 4. If IsConstructor(C) is false, throw a TypeError exception.
+  TNode<Object> receiver = args.GetReceiver();
+  GotoIf(TaggedIsSmi(receiver), &if_not_constructor);
+  GotoIfNot(IsConstructor(receiver), &if_not_constructor);
+
+  // 5. Let newObj be ? TypedArrayCreate(C, len).
+  TNode<JSTypedArray> new_typed_array =
+      CreateByLength(context, receiver, SmiTag(length), "%TypedArray%.of");
+
+  TNode<Word32T> elements_kind = LoadElementsKind(new_typed_array);
+
+  // 6. Let k be 0.
+  // 7. Repeat, while k < len
+  //  a. Let kValue be items[k].
+  //  b. Let Pk be ! ToString(k).
+  //  c. Perform ? Set(newObj, Pk, kValue, true).
+  //  d. Increase k by 1.
+  DispatchTypedArrayByElementsKind(
+      elements_kind,
+      [&](ElementsKind kind, int size, int typed_array_fun_index) {
+        TNode<FixedTypedArrayBase> elements =
+            CAST(LoadElements(new_typed_array));
+        BuildFastLoop(
+            IntPtrConstant(0), length,
+            [&](Node* index) {
+              TNode<Object> item = args.AtIndex(index, INTPTR_PARAMETERS);
+              TNode<IntPtrT> intptr_index = UncheckedCast<IntPtrT>(index);
+              if (kind == BIGINT64_ELEMENTS || kind == BIGUINT64_ELEMENTS) {
+                EmitBigTypedArrayElementStore(new_typed_array, elements,
+                                              intptr_index, item, context,
+                                              &if_neutered);
+              } else {
+                Node* value =
+                    PrepareValueForWriteToTypedArray(item, kind, context);
+
+                // ToNumber may execute JavaScript code, which could neuter
+                // the array's buffer.
+                Node* buffer = LoadObjectField(new_typed_array,
+                                               JSTypedArray::kBufferOffset);
+                GotoIf(IsDetachedBuffer(buffer), &if_neutered);
+
+                // GC may move backing store in ToNumber, thus load backing
+                // store everytime in this loop.
+                TNode<RawPtrT> backing_store =
+                    LoadFixedTypedArrayBackingStore(elements);
+                StoreElement(backing_store, kind, index, value,
+                             INTPTR_PARAMETERS);
+              }
+            },
+            1, ParameterMode::INTPTR_PARAMETERS, IndexAdvanceMode::kPost);
+      });
+
+  // 8. Return newObj.
+  args.PopAndReturn(new_typed_array);
+
+  BIND(&if_not_constructor);
+  ThrowTypeError(context, MessageTemplate::kNotConstructor, receiver);
+
+  BIND(&if_neutered);
+  ThrowTypeError(context, MessageTemplate::kDetachedOperation,
+                 "%TypedArray%.of");
+}
+
+TF_BUILTIN(IterableToList, TypedArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> iterable = CAST(Parameter(Descriptor::kIterable));
+  TNode<Object> iterator_fn = CAST(Parameter(Descriptor::kIteratorFn));
+
+  Label fast_path(this), slow_path(this), done(this);
+
+  TVARIABLE(JSArray, created_list);
+
+  // This is a fast-path for ignoring the iterator.
+  // TODO(petermarshall): Port to CSA.
+  Node* elided =
+      CallRuntime(Runtime::kIterableToListCanBeElided, context, iterable);
+  CSA_ASSERT(this, IsBoolean(elided));
+  Branch(IsTrue(elided), &fast_path, &slow_path);
+
+  BIND(&fast_path);
+  {
+    created_list = CAST(iterable);
+    Goto(&done);
+  }
+
+  BIND(&slow_path);
+  {
+    IteratorBuiltinsAssembler iterator_assembler(state());
+
+    // 1. Let iteratorRecord be ? GetIterator(items, method).
+    IteratorRecord iterator_record =
+        iterator_assembler.GetIterator(context, iterable, iterator_fn);
+
+    // 2. Let values be a new empty List.
+    GrowableFixedArray values(state());
+
+    Variable* vars[] = {values.var_array(), values.var_length(),
+                        values.var_capacity()};
+    Label loop_start(this, 3, vars), loop_end(this);
+    Goto(&loop_start);
+    // 3. Let next be true.
+    // 4. Repeat, while next is not false
+    BIND(&loop_start);
+    {
+      //  a. Set next to ? IteratorStep(iteratorRecord).
+      TNode<Object> next = CAST(
+          iterator_assembler.IteratorStep(context, iterator_record, &loop_end));
+      //  b. If next is not false, then
+      //   i. Let nextValue be ? IteratorValue(next).
+      TNode<Object> next_value =
+          CAST(iterator_assembler.IteratorValue(context, next));
+      //   ii. Append nextValue to the end of the List values.
+      values.Push(next_value);
+      Goto(&loop_start);
+    }
+    BIND(&loop_end);
+
+    // 5. Return values.
+    TNode<JSArray> js_array_values = values.ToJSArray(context);
+    created_list = js_array_values;
+    Goto(&done);
+  }
+
+  BIND(&done);
+  Return(created_list.value());
+}
+
+// ES6 #sec-%typedarray%.from
+TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+
+  Label check_iterator(this), from_array_like(this), fast_path(this),
+      slow_path(this), create_typed_array(this),
+      if_not_constructor(this, Label::kDeferred),
+      if_map_fn_not_callable(this, Label::kDeferred),
+      if_iterator_fn_not_callable(this, Label::kDeferred),
+      if_neutered(this, Label::kDeferred);
+
+  CodeStubArguments args(
+      this, ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount)));
+  TNode<Object> source = args.GetOptionalArgumentValue(0);
+
+  // 5. If thisArg is present, let T be thisArg; else let T be undefined.
+  TNode<Object> this_arg = args.GetOptionalArgumentValue(2);
+
+  // 1. Let C be the this value.
+  // 2. If IsConstructor(C) is false, throw a TypeError exception.
+  TNode<Object> receiver = args.GetReceiver();
+  GotoIf(TaggedIsSmi(receiver), &if_not_constructor);
+  GotoIfNot(IsConstructor(receiver), &if_not_constructor);
+
+  // 3. If mapfn is present and mapfn is not undefined, then
+  TNode<Object> map_fn = args.GetOptionalArgumentValue(1);
+  TVARIABLE(BoolT, mapping, Int32FalseConstant());
+  GotoIf(IsUndefined(map_fn), &check_iterator);
+
+  //  a. If IsCallable(mapfn) is false, throw a TypeError exception.
+  //  b. Let mapping be true.
+  // 4. Else, let mapping be false.
+  GotoIf(TaggedIsSmi(map_fn), &if_map_fn_not_callable);
+  GotoIfNot(IsCallable(map_fn), &if_map_fn_not_callable);
+  mapping = Int32TrueConstant();
+  Goto(&check_iterator);
+
+  TVARIABLE(Object, final_source);
+  TVARIABLE(Smi, final_length);
+
+  // We split up this builtin differently to the way it is written in the spec.
+  // We already have great code in the elements accessor for copying from a
+  // JSArray into a TypedArray, so we use that when possible. We only avoid
+  // calling into the elements accessor when we have a mapping function, because
+  // we can't handle that. Here, presence of a mapping function is the slow
+  // path. We also combine the two different loops in the specification
+  // (starting at 7.e and 13) because they are essentially identical. We also
+  // save on code-size this way.
+
+  BIND(&check_iterator);
+  {
+    // 6. Let usingIterator be ? GetMethod(source, @@iterator).
+    TNode<Object> iterator_fn =
+        CAST(GetMethod(context, source, isolate()->factory()->iterator_symbol(),
+                       &from_array_like));
+    GotoIf(TaggedIsSmi(iterator_fn), &if_iterator_fn_not_callable);
+    GotoIfNot(IsCallable(iterator_fn), &if_iterator_fn_not_callable);
+
+    // We are using the iterator.
+    Label if_length_not_smi(this, Label::kDeferred);
+    // 7. If usingIterator is not undefined, then
+    //  a. Let values be ? IterableToList(source, usingIterator).
+    //  b. Let len be the number of elements in values.
+    TNode<JSArray> values = CAST(
+        CallBuiltin(Builtins::kIterableToList, context, source, iterator_fn));
+
+    // This is not a spec'd limit, so it doesn't particularly matter when we
+    // throw the range error for typed array length > MaxSmi.
+    TNode<Object> raw_length = LoadJSArrayLength(values);
+    GotoIfNot(TaggedIsSmi(raw_length), &if_length_not_smi);
+
+    final_length = CAST(raw_length);
+    final_source = values;
+    Goto(&create_typed_array);
+
+    BIND(&if_length_not_smi);
+    ThrowRangeError(context, MessageTemplate::kInvalidTypedArrayLength,
+                    raw_length);
+  }
+
+  BIND(&from_array_like);
+  {
+    Label if_length_not_smi(this, Label::kDeferred);
+    final_source = source;
+
+    // 10. Let len be ? ToLength(? Get(arrayLike, "length")).
+    TNode<Object> raw_length =
+        GetProperty(context, final_source.value(), LengthStringConstant());
+    final_length = ToSmiLength(raw_length, context, &if_length_not_smi);
+    Goto(&create_typed_array);
+
+    BIND(&if_length_not_smi);
+    ThrowRangeError(context, MessageTemplate::kInvalidTypedArrayLength,
+                    raw_length);
+  }
+
+  TVARIABLE(JSTypedArray, target_obj);
+
+  BIND(&create_typed_array);
+  {
+    // 7c/11. Let targetObj be ? TypedArrayCreate(C, «len»).
+    target_obj = CreateByLength(context, receiver, final_length.value(),
+                                "%TypedArray%.from");
+
+    Branch(mapping.value(), &slow_path, &fast_path);
+  }
+
+  BIND(&fast_path);
+  {
+    Label done(this);
+    GotoIf(SmiEqual(final_length.value(), SmiConstant(0)), &done);
+
+    CallRuntime(Runtime::kTypedArrayCopyElements, context, target_obj.value(),
+                final_source.value(), final_length.value());
+    Goto(&done);
+
+    BIND(&done);
+    args.PopAndReturn(target_obj.value());
+  }
+
+  BIND(&slow_path);
+  TNode<Word32T> elements_kind = LoadElementsKind(target_obj.value());
+
+  // 7e/13 : Copy the elements
+  TNode<FixedTypedArrayBase> elements = CAST(LoadElements(target_obj.value()));
+  BuildFastLoop(
+      SmiConstant(0), final_length.value(),
+      [&](Node* index) {
+        TNode<Object> const k_value =
+            GetProperty(context, final_source.value(), index);
+
+        TNode<Object> const mapped_value =
+            CAST(CallJS(CodeFactory::Call(isolate()), context, map_fn, this_arg,
+                        k_value, index));
+
+        TNode<IntPtrT> intptr_index = SmiUntag(index);
+        DispatchTypedArrayByElementsKind(
+            elements_kind,
+            [&](ElementsKind kind, int size, int typed_array_fun_index) {
+              if (kind == BIGINT64_ELEMENTS || kind == BIGUINT64_ELEMENTS) {
+                EmitBigTypedArrayElementStore(target_obj.value(), elements,
+                                              intptr_index, mapped_value,
+                                              context, &if_neutered);
+              } else {
+                Node* const final_value = PrepareValueForWriteToTypedArray(
+                    mapped_value, kind, context);
+
+                // ToNumber may execute JavaScript code, which could neuter
+                // the array's buffer.
+                Node* buffer = LoadObjectField(target_obj.value(),
+                                               JSTypedArray::kBufferOffset);
+                GotoIf(IsDetachedBuffer(buffer), &if_neutered);
+
+                // GC may move backing store in map_fn, thus load backing
+                // store in each iteration of this loop.
+                TNode<RawPtrT> backing_store =
+                    LoadFixedTypedArrayBackingStore(elements);
+                StoreElement(backing_store, kind, index, final_value,
+                             SMI_PARAMETERS);
+              }
+            });
+      },
+      1, ParameterMode::SMI_PARAMETERS, IndexAdvanceMode::kPost);
+
+  args.PopAndReturn(target_obj.value());
+
+  BIND(&if_not_constructor);
+  ThrowTypeError(context, MessageTemplate::kNotConstructor, receiver);
+
+  BIND(&if_map_fn_not_callable);
+  ThrowTypeError(context, MessageTemplate::kCalledNonCallable, map_fn);
+
+  BIND(&if_iterator_fn_not_callable);
+  ThrowTypeError(context, MessageTemplate::kIteratorSymbolNonCallable);
+
+  BIND(&if_neutered);
+  ThrowTypeError(context, MessageTemplate::kDetachedOperation,
+                 "%TypedArray%.from");
+}
+
+// ES %TypedArray%.prototype.filter
+TF_BUILTIN(TypedArrayPrototypeFilter, TypedArrayBuiltinsAssembler) {
+  const char* method_name = "%TypedArray%.prototype.filter";
+
+  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  CodeStubArguments args(
+      this, ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount)));
+
+  Label if_callback_not_callable(this, Label::kDeferred),
+      detached(this, Label::kDeferred);
+
+  // 1. Let O be the this value.
+  // 2. Perform ? ValidateTypedArray(O).
+  TNode<Object> receiver = args.GetReceiver();
+  TNode<JSTypedArray> source =
+      ValidateTypedArray(context, receiver, method_name);
+
+  // 3. Let len be O.[[ArrayLength]].
+  TNode<Smi> length = LoadObjectField<Smi>(source, JSTypedArray::kLengthOffset);
+
+  // 4. If IsCallable(callbackfn) is false, throw a TypeError exception.
+  TNode<Object> callbackfn = args.GetOptionalArgumentValue(0);
+  GotoIf(TaggedIsSmi(callbackfn), &if_callback_not_callable);
+  GotoIfNot(IsCallable(callbackfn), &if_callback_not_callable);
+
+  // 5. If thisArg is present, let T be thisArg; else let T be undefined.
+  TNode<Object> this_arg = args.GetOptionalArgumentValue(1);
+
+  TNode<JSArrayBuffer> source_buffer =
+      LoadObjectField<JSArrayBuffer>(source, JSArrayBufferView::kBufferOffset);
+  TNode<Word32T> elements_kind = LoadElementsKind(source);
+  GrowableFixedArray values(state());
+  VariableList vars(
+      {values.var_array(), values.var_length(), values.var_capacity()}, zone());
+
+  // 6. Let kept be a new empty List.
+  // 7. Let k be 0.
+  // 8. Let captured be 0.
+  // 9. Repeat, while k < len
+  BuildFastLoop(
+      vars, SmiConstant(0), length,
+      [&](Node* index) {
+        GotoIf(IsDetachedBuffer(source_buffer), &detached);
+
+        TVARIABLE(Numeric, value);
+        // a. Let Pk be ! ToString(k).
+        // b. Let kValue be ? Get(O, Pk).
+        DispatchTypedArrayByElementsKind(
+            elements_kind,
+            [&](ElementsKind kind, int size, int typed_array_fun_index) {
+              TNode<IntPtrT> backing_store =
+                  UncheckedCast<IntPtrT>(LoadDataPtr(source));
+              value = CAST(LoadFixedTypedArrayElementAsTagged(
+                  backing_store, index, kind, ParameterMode::SMI_PARAMETERS));
+            });
+
+        // c. Let selected be ToBoolean(Call(callbackfn, T, kValue, k, O))
+        Node* selected =
+            CallJS(CodeFactory::Call(isolate()), context, callbackfn, this_arg,
+                   value.value(), index, source);
+
+        Label true_continue(this), false_continue(this);
+        BranchIfToBooleanIsTrue(selected, &true_continue, &false_continue);
+
+        BIND(&true_continue);
+        // d. If selected is true, then
+        //   i. Append kValue to the end of kept.
+        //   ii. Increase captured by 1.
+        values.Push(value.value());
+        Goto(&false_continue);
+
+        BIND(&false_continue);
+      },
+      1, ParameterMode::SMI_PARAMETERS, IndexAdvanceMode::kPost);
+
+  TNode<JSArray> values_array = values.ToJSArray(context);
+  TNode<Smi> captured = LoadFastJSArrayLength(values_array);
+
+  // 10. Let A be ? TypedArraySpeciesCreate(O, captured).
+  TNode<JSTypedArray> result_array =
+      SpeciesCreateByLength(context, source, captured, method_name);
+
+  // 11. Let n be 0.
+  // 12. For each element e of kept, do
+  //   a. Perform ! Set(A, ! ToString(n), e, true).
+  //   b. Increment n by 1.
+  CallRuntime(Runtime::kTypedArrayCopyElements, context, result_array,
+              values_array, captured);
+
+  // 13. Return A.
+  args.PopAndReturn(result_array);
+
+  BIND(&if_callback_not_callable);
+  ThrowTypeError(context, MessageTemplate::kCalledNonCallable, callbackfn);
+
+  BIND(&detached);
+  ThrowTypeError(context, MessageTemplate::kDetachedOperation, method_name);
+}
+
 #undef V8_TYPED_ARRAY_MAX_SIZE_IN_HEAP
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-typedarray-gen.h b/deps/v8/src/builtins/builtins-typedarray-gen.h
new file mode 100644
index 00000000000..37f923dea6a
--- /dev/null
+++ b/deps/v8/src/builtins/builtins-typedarray-gen.h
@@ -0,0 +1,133 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_BUILTINS_BUILTINS_TYPEDARRAY_GEN_H_
+#define V8_BUILTINS_BUILTINS_TYPEDARRAY_GEN_H_
+
+#include "src/code-stub-assembler.h"
+
+namespace v8 {
+namespace internal {
+
+class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
+ public:
+  explicit TypedArrayBuiltinsAssembler(compiler::CodeAssemblerState* state)
+      : CodeStubAssembler(state) {}
+
+  TNode<JSTypedArray> SpeciesCreateByLength(TNode<Context> context,
+                                            TNode<JSTypedArray> exemplar,
+                                            TNode<Smi> len,
+                                            const char* method_name);
+
+ protected:
+  void GenerateTypedArrayPrototypeGetter(Node* context, Node* receiver,
+                                         const char* method_name,
+                                         int object_offset);
+  void GenerateTypedArrayPrototypeIterationMethod(Node* context, Node* receiver,
+                                                  const char* method_name,
+                                                  IterationKind iteration_kind);
+
+  void ConstructByLength(TNode<Context> context, TNode<JSTypedArray> holder,
+                         TNode<Object> length, TNode<Smi> element_size);
+  void ConstructByArrayBuffer(TNode<Context> context,
+                              TNode<JSTypedArray> holder,
+                              TNode<JSArrayBuffer> buffer,
+                              TNode<Object> byte_offset, TNode<Object> length,
+                              TNode<Smi> element_size);
+  void ConstructByTypedArray(TNode<Context> context, TNode<JSTypedArray> holder,
+                             TNode<JSTypedArray> typed_array,
+                             TNode<Smi> element_size);
+  void ConstructByArrayLike(TNode<Context> context, TNode<JSTypedArray> holder,
+                            TNode<HeapObject> array_like,
+                            TNode<Object> initial_length,
+                            TNode<Smi> element_size);
+  void ConstructByIterable(TNode<Context> context, TNode<JSTypedArray> holder,
+                           TNode<JSReceiver> iterable,
+                           TNode<Object> iterator_fn, TNode<Smi> element_size);
+
+  void SetupTypedArray(TNode<JSTypedArray> holder, TNode<Smi> length,
+                       TNode<Number> byte_offset, TNode<Number> byte_length);
+  void AttachBuffer(TNode<JSTypedArray> holder, TNode<JSArrayBuffer> buffer,
+                    TNode<Map> map, TNode<Smi> length,
+                    TNode<Number> byte_offset);
+
+  TNode<Map> LoadMapForType(TNode<JSTypedArray> array);
+  TNode<UintPtrT> CalculateExternalPointer(TNode<UintPtrT> backing_store,
+                                           TNode<Number> byte_offset);
+  Node* LoadDataPtr(Node* typed_array);
+  TNode<BoolT> ByteLengthIsValid(TNode<Number> byte_length);
+
+  // Returns true if kind is either UINT8_ELEMENTS or UINT8_CLAMPED_ELEMENTS.
+  TNode<Word32T> IsUint8ElementsKind(TNode<Word32T> kind);
+
+  // Returns true if kind is either BIGINT64_ELEMENTS or BIGUINT64_ELEMENTS.
+  TNode<Word32T> IsBigInt64ElementsKind(TNode<Word32T> kind);
+
+  // Loads the element kind of TypedArray instance.
+  TNode<Word32T> LoadElementsKind(TNode<JSTypedArray> typed_array);
+
+  // Returns the byte size of an element for a TypedArray elements kind.
+  TNode<IntPtrT> GetTypedArrayElementSize(TNode<Word32T> elements_kind);
+
+  TNode<Object> GetDefaultConstructor(TNode<Context> context,
+                                      TNode<JSTypedArray> exemplar);
+
+  TNode<Object> TypedArraySpeciesConstructor(TNode<Context> context,
+                                             TNode<JSTypedArray> exemplar);
+
+  TNode<JSTypedArray> SpeciesCreateByArrayBuffer(TNode<Context> context,
+                                                 TNode<JSTypedArray> exemplar,
+                                                 TNode<JSArrayBuffer> buffer,
+                                                 TNode<Number> byte_offset,
+                                                 TNode<Smi> len,
+                                                 const char* method_name);
+
+  TNode<JSTypedArray> CreateByLength(TNode<Context> context,
+                                     TNode<Object> constructor, TNode<Smi> len,
+                                     const char* method_name);
+
+  TNode<JSArrayBuffer> GetBuffer(TNode<Context> context,
+                                 TNode<JSTypedArray> array);
+
+  TNode<JSTypedArray> ValidateTypedArray(TNode<Context> context,
+                                         TNode<Object> obj,
+                                         const char* method_name);
+
+  // Fast path for setting a TypedArray (source) onto another TypedArray
+  // (target) at an element offset.
+  void SetTypedArraySource(TNode<Context> context, TNode<JSTypedArray> source,
+                           TNode<JSTypedArray> target, TNode<IntPtrT> offset,
+                           Label* call_runtime, Label* if_source_too_large);
+
+  void SetJSArraySource(TNode<Context> context, TNode<JSArray> source,
+                        TNode<JSTypedArray> target, TNode<IntPtrT> offset,
+                        Label* call_runtime, Label* if_source_too_large);
+
+  void CallCMemmove(TNode<IntPtrT> dest_ptr, TNode<IntPtrT> src_ptr,
+                    TNode<IntPtrT> byte_length);
+
+  void CallCCopyFastNumberJSArrayElementsToTypedArray(
+      TNode<Context> context, TNode<JSArray> source, TNode<JSTypedArray> dest,
+      TNode<IntPtrT> source_length, TNode<IntPtrT> offset);
+
+  void CallCCopyTypedArrayElementsToTypedArray(TNode<JSTypedArray> source,
+                                               TNode<JSTypedArray> dest,
+                                               TNode<IntPtrT> source_length,
+                                               TNode<IntPtrT> offset);
+
+  void CallCCopyTypedArrayElementsSlice(TNode<JSTypedArray> source,
+                                        TNode<JSTypedArray> dest,
+                                        TNode<IntPtrT> start,
+                                        TNode<IntPtrT> end);
+
+  typedef std::function<void(ElementsKind, int, int)> TypedArraySwitchCase;
+
+  void DispatchTypedArrayByElementsKind(
+      TNode<Word32T> elements_kind, const TypedArraySwitchCase& case_function);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_BUILTINS_BUILTINS_TYPEDARRAY_GEN_H_
diff --git a/deps/v8/src/builtins/builtins-typedarray.cc b/deps/v8/src/builtins/builtins-typedarray.cc
index 18625c8d909..6fcc279c663 100644
--- a/deps/v8/src/builtins/builtins-typedarray.cc
+++ b/deps/v8/src/builtins/builtins-typedarray.cc
@@ -42,16 +42,6 @@ int64_t CapRelativeIndex(Handle<Object> num, int64_t minimum, int64_t maximum) {
                       : std::min<int64_t>(relative, maximum);
 }
 
-MaybeHandle<JSTypedArray> TypedArraySpeciesCreateByLength(
-    Isolate* isolate, Handle<JSTypedArray> exemplar, const char* method_name,
-    int64_t length) {
-  const int argc = 1;
-  ScopedVector<Handle<Object>> argv(argc);
-  argv[0] = isolate->factory()->NewNumberFromInt64(length);
-  return JSTypedArray::SpeciesCreate(isolate, exemplar, argc, argv.start(),
-                                     method_name);
-}
-
 }  // namespace
 
 BUILTIN(TypedArrayPrototypeCopyWithin) {
@@ -124,10 +114,16 @@ BUILTIN(TypedArrayPrototypeFill) {
   const char* method = "%TypedArray%.prototype.fill";
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, array, JSTypedArray::Validate(isolate, args.receiver(), method));
+  ElementsKind kind = array->GetElementsKind();
 
   Handle<Object> obj_value = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, obj_value, Object::ToNumber(obj_value));
+  if (kind == BIGINT64_ELEMENTS || kind == BIGUINT64_ELEMENTS) {
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, obj_value,
+                                       BigInt::FromObject(isolate, obj_value));
+  } else {
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, obj_value,
+                                       Object::ToNumber(obj_value));
+  }
 
   int64_t len = array->length_value();
   int64_t start = 0;
@@ -161,9 +157,9 @@ BUILTIN(TypedArrayPrototypeFill) {
   DCHECK_LE(end, len);
   DCHECK_LE(count, len);
 
-  return array->GetElementsAccessor()->Fill(isolate, array, obj_value,
-                                            static_cast<uint32_t>(start),
-                                            static_cast<uint32_t>(end));
+  return ElementsAccessor::ForKind(kind)->Fill(isolate, array, obj_value,
+                                               static_cast<uint32_t>(start),
+                                               static_cast<uint32_t>(end));
 }
 
 BUILTIN(TypedArrayPrototypeIncludes) {
@@ -277,49 +273,5 @@ BUILTIN(TypedArrayPrototypeReverse) {
   return *array;
 }
 
-BUILTIN(TypedArrayPrototypeSlice) {
-  HandleScope scope(isolate);
-
-  Handle<JSTypedArray> array;
-  const char* method = "%TypedArray%.prototype.slice";
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, array, JSTypedArray::Validate(isolate, args.receiver(), method));
-
-  int64_t len = array->length_value();
-  int64_t start = 0;
-  int64_t end = len;
-  {
-    Handle<Object> num = args.atOrUndefined(isolate, 1);
-    if (!num->IsUndefined(isolate)) {
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, num,
-                                         Object::ToInteger(isolate, num));
-      start = CapRelativeIndex(num, 0, len);
-
-      num = args.atOrUndefined(isolate, 2);
-      if (!num->IsUndefined(isolate)) {
-        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, num,
-                                           Object::ToInteger(isolate, num));
-        end = CapRelativeIndex(num, 0, len);
-      }
-    }
-  }
-
-  int64_t count = std::max<int64_t>(end - start, 0);
-
-  Handle<JSTypedArray> result_array;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, result_array,
-      TypedArraySpeciesCreateByLength(isolate, array, method, count));
-
-  // TODO(cwhan.tunz): should throw.
-  if (V8_UNLIKELY(array->WasNeutered())) return *result_array;
-
-  if (count == 0) return *result_array;
-
-  ElementsAccessor* accessor = array->GetElementsAccessor();
-  return *accessor->Slice(array, static_cast<uint32_t>(start),
-                          static_cast<uint32_t>(end), result_array);
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins.cc b/deps/v8/src/builtins/builtins.cc
index dc175e50b70..fc5fda639c7 100644
--- a/deps/v8/src/builtins/builtins.cc
+++ b/deps/v8/src/builtins/builtins.cc
@@ -86,8 +86,9 @@ Builtins::Name Builtins::GetBuiltinFromBailoutId(BailoutId id) {
 void Builtins::TearDown() { initialized_ = false; }
 
 void Builtins::IterateBuiltins(RootVisitor* v) {
-  v->VisitRootPointers(Root::kBuiltins, &builtins_[0],
-                       &builtins_[0] + builtin_count);
+  for (int i = 0; i < builtin_count; i++) {
+    v->VisitRootPointer(Root::kBuiltins, name(i), &builtins_[i]);
+  }
 }
 
 const char* Builtins::Lookup(byte* pc) {
@@ -170,30 +171,11 @@ Callable Builtins::CallableFor(Isolate* isolate, Name name) {
     BUILTIN_LIST(IGNORE_BUILTIN, IGNORE_BUILTIN, IGNORE_BUILTIN, CASE_OTHER,
                  CASE_OTHER, CASE_OTHER, IGNORE_BUILTIN)
 #undef CASE_OTHER
-    case kArrayFilterLoopEagerDeoptContinuation:
-    case kArrayFilterLoopLazyDeoptContinuation:
-    case kArrayEveryLoopEagerDeoptContinuation:
-    case kArrayEveryLoopLazyDeoptContinuation:
-    case kArrayFindIndexLoopAfterCallbackLazyDeoptContinuation:
-    case kArrayFindIndexLoopEagerDeoptContinuation:
-    case kArrayFindIndexLoopLazyDeoptContinuation:
-    case kArrayFindLoopAfterCallbackLazyDeoptContinuation:
-    case kArrayFindLoopEagerDeoptContinuation:
-    case kArrayFindLoopLazyDeoptContinuation:
-    case kArrayForEach:
-    case kArrayForEachLoopEagerDeoptContinuation:
-    case kArrayForEachLoopLazyDeoptContinuation:
-    case kArrayMapLoopEagerDeoptContinuation:
-    case kArrayMapLoopLazyDeoptContinuation:
-    case kArrayReduceLoopEagerDeoptContinuation:
-    case kArrayReduceLoopLazyDeoptContinuation:
-    case kArrayReduceRightLoopEagerDeoptContinuation:
-    case kArrayReduceRightLoopLazyDeoptContinuation:
-    case kArraySomeLoopEagerDeoptContinuation:
-    case kArraySomeLoopLazyDeoptContinuation:
-    case kConsoleAssert:
-      return Callable(code, BuiltinDescriptor(isolate));
     default:
+      Builtins::Kind kind = Builtins::KindOf(name);
+      if (kind == TFJ || kind == CPP) {
+        return Callable(code, BuiltinDescriptor(isolate));
+      }
       UNREACHABLE();
   }
   CallInterfaceDescriptor descriptor(isolate, key);
@@ -212,9 +194,30 @@ Address Builtins::CppEntryOf(int index) {
   return builtin_metadata[index].kind_specific_data.cpp_entry;
 }
 
+// static
+bool Builtins::IsBuiltin(const Code* code) {
+  return Builtins::IsBuiltinId(code->builtin_index());
+}
+
+// static
+bool Builtins::IsOffHeapBuiltin(const Code* code) {
+#ifdef V8_EMBEDDED_BUILTINS
+  return Builtins::IsBuiltinId(code->builtin_index()) &&
+         Builtins::IsOffHeapSafe(code->builtin_index());
+#else
+  return false;
+#endif
+}
+
 // static
 bool Builtins::IsLazy(int index) {
   DCHECK(IsBuiltinId(index));
+
+#ifdef V8_EMBEDDED_BUILTINS
+  // We don't want to lazy-deserialize off-heap builtins.
+  if (Builtins::IsOffHeapSafe(index)) return false;
+#endif
+
   // There are a couple of reasons that builtins can require eager-loading,
   // i.e. deserialization at isolate creation instead of on-demand. For
   // instance:
@@ -227,44 +230,41 @@ bool Builtins::IsLazy(int index) {
   // TODO(wasm): Remove wasm builtins once immovability is no longer required.
   switch (index) {
     case kAbort:  // Required by wasm.
-    case kArrayFindLoopEagerDeoptContinuation:  // https://crbug.com/v8/6786.
-    case kArrayFindLoopLazyDeoptContinuation:   // https://crbug.com/v8/6786.
-    // https://crbug.com/v8/6786.
-    case kArrayFindLoopAfterCallbackLazyDeoptContinuation:
-    // https://crbug.com/v8/6786.
+    case kArrayEveryLoopEagerDeoptContinuation:
+    case kArrayEveryLoopLazyDeoptContinuation:
+    case kArrayFilterLoopEagerDeoptContinuation:
+    case kArrayFilterLoopLazyDeoptContinuation:
+    case kArrayFindIndexLoopAfterCallbackLazyDeoptContinuation:
     case kArrayFindIndexLoopEagerDeoptContinuation:
-    // https://crbug.com/v8/6786.
     case kArrayFindIndexLoopLazyDeoptContinuation:
-    // https://crbug.com/v8/6786.
-    case kArrayFindIndexLoopAfterCallbackLazyDeoptContinuation:
-    case kArrayForEachLoopEagerDeoptContinuation:  // https://crbug.com/v8/6786.
-    case kArrayForEachLoopLazyDeoptContinuation:   // https://crbug.com/v8/6786.
-    case kArrayMapLoopEagerDeoptContinuation:      // https://crbug.com/v8/6786.
-    case kArrayMapLoopLazyDeoptContinuation:       // https://crbug.com/v8/6786.
-    case kArrayEveryLoopEagerDeoptContinuation:    // https://crbug.com/v8/6786.
-    case kArrayEveryLoopLazyDeoptContinuation:     // https://crbug.com/v8/6786.
-    case kArrayFilterLoopEagerDeoptContinuation:   // https://crbug.com/v8/6786.
-    case kArrayFilterLoopLazyDeoptContinuation:    // https://crbug.com/v8/6786.
-    case kArrayReduceLoopEagerDeoptContinuation:   // https://crbug.com/v8/6786.
-    case kArrayReduceLoopLazyDeoptContinuation:    // https://crbug.com/v8/6786.
+    case kArrayFindLoopAfterCallbackLazyDeoptContinuation:
+    case kArrayFindLoopEagerDeoptContinuation:
+    case kArrayFindLoopLazyDeoptContinuation:
+    case kArrayForEachLoopEagerDeoptContinuation:
+    case kArrayForEachLoopLazyDeoptContinuation:
+    case kArrayMapLoopEagerDeoptContinuation:
+    case kArrayMapLoopLazyDeoptContinuation:
+    case kArrayReduceLoopEagerDeoptContinuation:
+    case kArrayReduceLoopLazyDeoptContinuation:
+    case kArrayReducePreLoopEagerDeoptContinuation:
     case kArrayReduceRightLoopEagerDeoptContinuation:
     case kArrayReduceRightLoopLazyDeoptContinuation:
-    case kArraySomeLoopEagerDeoptContinuation:  // https://crbug.com/v8/6786.
-    case kArraySomeLoopLazyDeoptContinuation:   // https://crbug.com/v8/6786.
-    case kCheckOptimizationMarker:
+    case kArrayReduceRightPreLoopEagerDeoptContinuation:
+    case kArraySomeLoopEagerDeoptContinuation:
+    case kArraySomeLoopLazyDeoptContinuation:
+    case kAsyncGeneratorAwaitCaught:            // https://crbug.com/v8/6786.
+    case kAsyncGeneratorAwaitUncaught:          // https://crbug.com/v8/6786.
     case kCompileLazy:
+    case kDebugBreakTrampoline:
     case kDeserializeLazy:
     case kFunctionPrototypeHasInstance:  // https://crbug.com/v8/6786.
     case kHandleApiCall:
     case kIllegal:
+    case kInstantiateAsmJs:
     case kInterpreterEnterBytecodeAdvance:
     case kInterpreterEnterBytecodeDispatch:
     case kInterpreterEntryTrampoline:
-    case kObjectConstructor_ConstructStub:    // https://crbug.com/v8/6787.
-    case kProxyConstructor_ConstructStub:     // https://crbug.com/v8/6787.
-    case kNumberConstructor_ConstructStub:    // https://crbug.com/v8/6787.
-    case kStringConstructor_ConstructStub:    // https://crbug.com/v8/6787.
-    case kProxyConstructor:                   // https://crbug.com/v8/6787.
+    case kPromiseConstructorLazyDeoptContinuation:
     case kRecordWrite:  // https://crbug.com/chromium/765301.
     case kThrowWasmTrapDivByZero:             // Required by wasm.
     case kThrowWasmTrapDivUnrepresentable:    // Required by wasm.
@@ -274,7 +274,9 @@ bool Builtins::IsLazy(int index) {
     case kThrowWasmTrapMemOutOfBounds:        // Required by wasm.
     case kThrowWasmTrapRemByZero:             // Required by wasm.
     case kThrowWasmTrapUnreachable:           // Required by wasm.
+    case kToBooleanLazyDeoptContinuation:
     case kToNumber:                           // Required by wasm.
+    case kTypedArrayConstructorLazyDeoptContinuation:
     case kWasmCompileLazy:                    // Required by wasm.
     case kWasmStackGuard:                     // Required by wasm.
       return false;
@@ -285,6 +287,411 @@ bool Builtins::IsLazy(int index) {
   UNREACHABLE();
 }
 
+// static
+bool Builtins::IsIsolateIndependent(int index) {
+  DCHECK(IsBuiltinId(index));
+  switch (index) {
+#ifdef DEBUG
+    case kAbortJS:
+    case kContinueToCodeStubBuiltin:
+    case kContinueToCodeStubBuiltinWithResult:
+    case kContinueToJavaScriptBuiltin:
+    case kContinueToJavaScriptBuiltinWithResult:
+    case kKeyedLoadIC_Slow:
+    case kKeyedStoreIC_Slow:
+    case kLoadGlobalIC_Slow:
+    case kLoadIC_Slow:
+    case kStoreGlobalIC_Slow:
+    case kWasmStackGuard:
+    case kThrowWasmTrapUnreachable:
+    case kThrowWasmTrapMemOutOfBounds:
+    case kThrowWasmTrapDivByZero:
+    case kThrowWasmTrapDivUnrepresentable:
+    case kThrowWasmTrapRemByZero:
+    case kThrowWasmTrapFloatUnrepresentable:
+    case kThrowWasmTrapFuncInvalid:
+    case kThrowWasmTrapFuncSigMismatch:
+#else
+    case kAbortJS:
+    case kAdd:
+    case kAllocateHeapNumber:
+    case kArrayEvery:
+    case kArrayEveryLoopContinuation:
+    case kArrayEveryLoopEagerDeoptContinuation:
+    case kArrayEveryLoopLazyDeoptContinuation:
+    case kArrayFilterLoopEagerDeoptContinuation:
+    case kArrayFilterLoopLazyDeoptContinuation:
+    case kArrayFindIndexLoopAfterCallbackLazyDeoptContinuation:
+    case kArrayFindIndexLoopContinuation:
+    case kArrayFindIndexLoopEagerDeoptContinuation:
+    case kArrayFindIndexLoopLazyDeoptContinuation:
+    case kArrayFindLoopAfterCallbackLazyDeoptContinuation:
+    case kArrayFindLoopContinuation:
+    case kArrayFindLoopEagerDeoptContinuation:
+    case kArrayFindLoopLazyDeoptContinuation:
+    case kArrayForEach:
+    case kArrayForEachLoopContinuation:
+    case kArrayForEachLoopEagerDeoptContinuation:
+    case kArrayForEachLoopLazyDeoptContinuation:
+    case kArrayFrom:
+    case kArrayIncludes:
+    case kArrayIndexOf:
+    case kArrayIsArray:
+    case kArrayMapLoopContinuation:
+    case kArrayMapLoopEagerDeoptContinuation:
+    case kArrayMapLoopLazyDeoptContinuation:
+    case kArrayOf:
+    case kArrayPrototypeEntries:
+    case kArrayPrototypeFind:
+    case kArrayPrototypeFindIndex:
+    case kArrayPrototypeKeys:
+    case kArrayPrototypeSlice:
+    case kArrayPrototypeValues:
+    case kArrayReduce:
+    case kArrayReduceLoopContinuation:
+    case kArrayReduceLoopEagerDeoptContinuation:
+    case kArrayReduceLoopLazyDeoptContinuation:
+    case kArrayReducePreLoopEagerDeoptContinuation:
+    case kArrayReduceRight:
+    case kArrayReduceRightLoopContinuation:
+    case kArrayReduceRightLoopEagerDeoptContinuation:
+    case kArrayReduceRightLoopLazyDeoptContinuation:
+    case kArrayReduceRightPreLoopEagerDeoptContinuation:
+    case kArraySome:
+    case kArraySomeLoopContinuation:
+    case kArraySomeLoopEagerDeoptContinuation:
+    case kArraySomeLoopLazyDeoptContinuation:
+    case kAsyncFromSyncIteratorPrototypeNext:
+    case kAsyncFromSyncIteratorPrototypeReturn:
+    case kAsyncFromSyncIteratorPrototypeThrow:
+    case kAsyncFunctionAwaitFulfill:
+    case kAsyncFunctionAwaitReject:
+    case kAsyncFunctionPromiseCreate:
+    case kAsyncFunctionPromiseRelease:
+    case kAsyncGeneratorAwaitFulfill:
+    case kAsyncGeneratorAwaitReject:
+    case kAsyncGeneratorResumeNext:
+    case kAsyncGeneratorReturnClosedFulfill:
+    case kAsyncGeneratorReturnClosedReject:
+    case kAsyncGeneratorReturnFulfill:
+    case kAsyncGeneratorYieldFulfill:
+    case kAsyncIteratorValueUnwrap:
+    case kBitwiseNot:
+    case kBooleanPrototypeToString:
+    case kBooleanPrototypeValueOf:
+    case kConstructFunction:
+    case kContinueToCodeStubBuiltin:
+    case kContinueToCodeStubBuiltinWithResult:
+    case kContinueToJavaScriptBuiltin:
+    case kContinueToJavaScriptBuiltinWithResult:
+    case kCreateGeneratorObject:
+    case kCreateIterResultObject:
+    case kCreateRegExpLiteral:
+    case kDatePrototypeGetDate:
+    case kDatePrototypeGetDay:
+    case kDatePrototypeGetFullYear:
+    case kDatePrototypeGetHours:
+    case kDatePrototypeGetMilliseconds:
+    case kDatePrototypeGetMinutes:
+    case kDatePrototypeGetMonth:
+    case kDatePrototypeGetSeconds:
+    case kDatePrototypeGetTime:
+    case kDatePrototypeGetTimezoneOffset:
+    case kDatePrototypeGetUTCDate:
+    case kDatePrototypeGetUTCDay:
+    case kDatePrototypeGetUTCFullYear:
+    case kDatePrototypeGetUTCHours:
+    case kDatePrototypeGetUTCMilliseconds:
+    case kDatePrototypeGetUTCMinutes:
+    case kDatePrototypeGetUTCMonth:
+    case kDatePrototypeGetUTCSeconds:
+    case kDatePrototypeToPrimitive:
+    case kDatePrototypeValueOf:
+    case kDecrement:
+    case kDeleteProperty:
+    case kDivide:
+    case kEqual:
+    case kFastConsoleAssert:
+    case kFastNewClosure:
+    case kFastNewFunctionContextEval:
+    case kFastNewFunctionContextFunction:
+    case kFastNewObject:
+    case kFindOrderedHashMapEntry:
+    case kForInEnumerate:
+    case kForInFilter:
+    case kFunctionPrototypeHasInstance:
+    case kGeneratorPrototypeNext:
+    case kGeneratorPrototypeReturn:
+    case kGeneratorPrototypeThrow:
+    case kGetSuperConstructor:
+    case kGlobalIsFinite:
+    case kGlobalIsNaN:
+    case kGreaterThan:
+    case kGreaterThanOrEqual:
+    case kHasProperty:
+    case kIncrement:
+    case kInstanceOf:
+    case kKeyedLoadIC_Megamorphic:
+    case kKeyedLoadIC_PolymorphicName:
+    case kKeyedLoadIC_Slow:
+    case kKeyedLoadICTrampoline:
+    case kKeyedStoreIC_Slow:
+    case kKeyedStoreICTrampoline:
+    case kLessThan:
+    case kLessThanOrEqual:
+    case kLoadField:
+    case kLoadGlobalIC:
+    case kLoadGlobalICInsideTypeof:
+    case kLoadGlobalICInsideTypeofTrampoline:
+    case kLoadGlobalIC_Slow:
+    case kLoadGlobalICTrampoline:
+    case kLoadIC:
+    case kLoadIC_FunctionPrototype:
+    case kLoadIC_Noninlined:
+    case kLoadIC_Slow:
+    case kLoadIC_StringLength:
+    case kLoadIC_StringWrapperLength:
+    case kLoadICTrampoline:
+    case kLoadIC_Uninitialized:
+    case kMapPrototypeEntries:
+    case kMapPrototypeForEach:
+    case kMapPrototypeGet:
+    case kMapPrototypeGetSize:
+    case kMapPrototypeHas:
+    case kMapPrototypeKeys:
+    case kMapPrototypeValues:
+    case kMathCeil:
+    case kMathFloor:
+    case kMathFround:
+    case kMathMax:
+    case kMathMin:
+    case kMathRound:
+    case kMathSign:
+    case kMathSqrt:
+    case kMathTrunc:
+    case kMultiply:
+    case kNegate:
+    case kNewArgumentsElements:
+    case kNonNumberToNumber:
+    case kNonNumberToNumeric:
+    case kNonPrimitiveToPrimitive_Default:
+    case kNonPrimitiveToPrimitive_Number:
+    case kNonPrimitiveToPrimitive_String:
+    case kNumberIsFinite:
+    case kNumberIsInteger:
+    case kNumberIsNaN:
+    case kNumberIsSafeInteger:
+    case kNumberParseFloat:
+    case kNumberPrototypeValueOf:
+    case kNumberToString:
+    case kObjectConstructor:
+    case kObjectCreate:
+    case kObjectIs:
+    case kObjectKeys:
+    case kObjectPrototypeHasOwnProperty:
+    case kObjectPrototypeIsPrototypeOf:
+    case kObjectPrototypeToLocaleString:
+    case kObjectPrototypeToString:
+    case kObjectPrototypeValueOf:
+    case kOrderedHashTableHealIndex:
+    case kOrdinaryHasInstance:
+    case kOrdinaryToPrimitive_Number:
+    case kOrdinaryToPrimitive_String:
+    case kPromiseCapabilityDefaultReject:
+    case kPromiseCapabilityDefaultResolve:
+    case kPromiseCatchFinally:
+    case kPromiseConstructor:
+    case kPromiseConstructorLazyDeoptContinuation:
+    case kPromiseFulfillReactionJob:
+    case kPromiseInternalConstructor:
+    case kPromiseInternalReject:
+    case kPromiseInternalResolve:
+    case kPromisePrototypeCatch:
+    case kPromisePrototypeFinally:
+    case kPromiseRace:
+    case kPromiseReject:
+    case kPromiseRejectReactionJob:
+    case kPromiseResolve:
+    case kPromiseResolveThenableJob:
+    case kPromiseResolveTrampoline:
+    case kPromiseThenFinally:
+    case kPromiseThrowerFinally:
+    case kPromiseValueThunkFinally:
+    case kProxyGetProperty:
+    case kProxyHasProperty:
+    case kProxySetProperty:
+    case kReflectHas:
+    case kRegExpConstructor:
+    case kRegExpPrototypeCompile:
+    case kRegExpPrototypeDotAllGetter:
+    case kRegExpPrototypeFlagsGetter:
+    case kRegExpPrototypeGlobalGetter:
+    case kRegExpPrototypeIgnoreCaseGetter:
+    case kRegExpPrototypeMultilineGetter:
+    case kRegExpPrototypeReplace:
+    case kRegExpPrototypeSearch:
+    case kRegExpPrototypeSourceGetter:
+    case kRegExpPrototypeSplit:
+    case kRegExpPrototypeStickyGetter:
+    case kRegExpPrototypeUnicodeGetter:
+    case kResolvePromise:
+    case kReturnReceiver:
+    case kRunMicrotasks:
+    case kSameValue:
+    case kSetPrototypeEntries:
+    case kSetPrototypeForEach:
+    case kSetPrototypeGetSize:
+    case kSetPrototypeHas:
+    case kSetPrototypeValues:
+    case kStoreGlobalIC_Slow:
+    case kStoreGlobalICTrampoline:
+    case kStoreICTrampoline:
+    case kStrictEqual:
+    case kStringCodePointAtUTF16:
+    case kStringCodePointAtUTF32:
+    case kStringEqual:
+    case kStringGreaterThan:
+    case kStringGreaterThanOrEqual:
+    case kStringIndexOf:
+    case kStringLessThan:
+    case kStringLessThanOrEqual:
+    case kStringPrototypeAnchor:
+    case kStringPrototypeBig:
+    case kStringPrototypeBlink:
+    case kStringPrototypeBold:
+    case kStringPrototypeCharCodeAt:
+    case kStringPrototypeCodePointAt:
+    case kStringPrototypeConcat:
+    case kStringPrototypeFixed:
+    case kStringPrototypeFontcolor:
+    case kStringPrototypeFontsize:
+    case kStringPrototypeIncludes:
+    case kStringPrototypeIndexOf:
+    case kStringPrototypeItalics:
+    case kStringPrototypeIterator:
+    case kStringPrototypeLink:
+    case kStringPrototypeMatch:
+    case kStringPrototypePadEnd:
+    case kStringPrototypePadStart:
+    case kStringPrototypeRepeat:
+    case kStringPrototypeReplace:
+    case kStringPrototypeSearch:
+    case kStringPrototypeSmall:
+    case kStringPrototypeStrike:
+    case kStringPrototypeSub:
+    case kStringPrototypeSup:
+#ifdef V8_INTL_SUPPORT
+    case kStringPrototypeToLowerCaseIntl:
+    case kStringToLowerCaseIntl:
+#endif
+    case kStringPrototypeToString:
+    case kStringPrototypeValueOf:
+    case kStringRepeat:
+    case kStringToNumber:
+    case kSubtract:
+    case kSymbolPrototypeToPrimitive:
+    case kSymbolPrototypeToString:
+    case kSymbolPrototypeValueOf:
+    case kThrowWasmTrapDivByZero:
+    case kThrowWasmTrapDivUnrepresentable:
+    case kThrowWasmTrapFloatUnrepresentable:
+    case kThrowWasmTrapFuncInvalid:
+    case kThrowWasmTrapFuncSigMismatch:
+    case kThrowWasmTrapMemOutOfBounds:
+    case kThrowWasmTrapRemByZero:
+    case kThrowWasmTrapUnreachable:
+    case kToBoolean:
+    case kToBooleanLazyDeoptContinuation:
+    case kToInteger:
+    case kToInteger_TruncateMinusZero:
+    case kToName:
+    case kToNumber:
+    case kToNumeric:
+    case kToString:
+    case kTypedArrayConstructor:
+    case kTypedArrayPrototypeByteLength:
+    case kTypedArrayPrototypeByteOffset:
+    case kTypedArrayPrototypeEntries:
+    case kTypedArrayPrototypeEvery:
+    case kTypedArrayPrototypeFind:
+    case kTypedArrayPrototypeFindIndex:
+    case kTypedArrayPrototypeForEach:
+    case kTypedArrayPrototypeKeys:
+    case kTypedArrayPrototypeLength:
+    case kTypedArrayPrototypeReduce:
+    case kTypedArrayPrototypeReduceRight:
+    case kTypedArrayPrototypeSet:
+    case kTypedArrayPrototypeSlice:
+    case kTypedArrayPrototypeSome:
+    case kTypedArrayPrototypeSubArray:
+    case kTypedArrayPrototypeToStringTag:
+    case kTypedArrayPrototypeValues:
+    case kTypeof:
+    case kWasmStackGuard:
+    case kWeakMapGet:
+    case kWeakMapHas:
+    case kWeakMapLookupHashIndex:
+    case kWeakMapPrototypeDelete:
+    case kWeakMapPrototypeSet:
+    case kWeakSetHas:
+    case kWeakSetPrototypeAdd:
+    case kWeakSetPrototypeDelete:
+#endif  // !DEBUG
+      return true;
+    default:
+      return false;
+  }
+  UNREACHABLE();
+}
+
+// static
+bool Builtins::IsOffHeapSafe(int index) {
+#if !defined(V8_EMBEDDED_BUILTINS) || !defined(V8_USE_SNAPSHOT)
+  return false;
+#else
+  DCHECK(IsBuiltinId(index));
+  if (IsTooShortForOffHeapTrampoline(index)) return false;
+  return IsIsolateIndependent(index);
+#endif  // V8_EMBEDDED_BUILTINS
+}
+
+// static
+bool Builtins::IsTooShortForOffHeapTrampoline(int index) {
+  switch (index) {
+    case kLoadIC_StringLength:
+    case kLoadIC_StringWrapperLength:
+      return true;
+    default:
+      return false;
+  }
+}
+
+#ifdef V8_EMBEDDED_BUILTINS
+// static
+Handle<Code> Builtins::GenerateOffHeapTrampolineFor(Isolate* isolate,
+                                                    Address off_heap_entry) {
+  DCHECK(isolate->serializer_enabled());
+  DCHECK_NOT_NULL(isolate->embedded_blob());
+  DCHECK_NE(0, isolate->embedded_blob_size());
+
+  constexpr size_t buffer_size = 256;  // Enough to fit the single jmp.
+  byte buffer[buffer_size];            // NOLINT(runtime/arrays)
+
+  // Generate replacement code that simply tail-calls the off-heap code.
+  MacroAssembler masm(isolate, buffer, buffer_size, CodeObjectRequired::kYes);
+  DCHECK(!masm.has_frame());
+  {
+    FrameScope scope(&masm, StackFrame::NONE);
+    masm.JumpToInstructionStream(off_heap_entry);
+  }
+
+  CodeDesc desc;
+  masm.GetCode(isolate, &desc);
+
+  return isolate->factory()->NewCode(desc, Code::BUILTIN, masm.CodeObject());
+}
+#endif  // V8_EMBEDDED_BUILTINS
+
 // static
 Builtins::Kind Builtins::KindOf(int index) {
   DCHECK(IsBuiltinId(index));
diff --git a/deps/v8/src/builtins/builtins.h b/deps/v8/src/builtins/builtins.h
index d9090dc67e4..75ec8a8fff3 100644
--- a/deps/v8/src/builtins/builtins.h
+++ b/deps/v8/src/builtins/builtins.h
@@ -72,7 +72,7 @@ class Builtins {
   Handle<Code> NewFunctionContext(ScopeType scope_type);
   Handle<Code> JSConstructStubGeneric();
 
-  // Used by BuiltinDeserializer.
+  // Used by BuiltinDeserializer and CreateOffHeapTrampolines in isolate.cc.
   void set_builtin(int index, HeapObject* builtin);
 
   Code* builtin(int index) {
@@ -109,11 +109,33 @@ class Builtins {
   static bool IsCpp(int index);
   static bool HasCppImplementation(int index);
 
+  // True, iff the given code object is a builtin. Note that this does not
+  // necessarily mean that its kind is Code::BUILTIN.
+  static bool IsBuiltin(const Code* code);
+
+  // True, iff the given code object is a builtin with off-heap code.
+  static bool IsOffHeapBuiltin(const Code* code);
+
   // Returns true iff the given builtin can be lazy-loaded from the snapshot.
   // This is true in general for most builtins with the exception of a few
   // special cases such as CompileLazy and DeserializeLazy.
   static bool IsLazy(int index);
 
+  // Helper methods used for testing isolate-independent builtins.
+  // TODO(jgruber,v8:6666): Remove once all builtins have been migrated.
+  static bool IsIsolateIndependent(int index);
+
+  // This is the condition we currently use to determine whether a builtin is
+  // copied off-heap when --stress-off-heap-code is passed. Such builtins do not
+  // need to be isolate-independent, e.g. they can contain external references
+  // that point to one specific isolate. A further restrictions is that there
+  // must be enough space for the trampoline.
+  static bool IsOffHeapSafe(int index);
+
+  // The off-heap trampoline is short but requires a certain minimal instruction
+  // size. This function states whether a given builtin is too short.
+  static bool IsTooShortForOffHeapTrampoline(int index);
+
   bool is_initialized() const { return initialized_; }
 
   // Used by SetupIsolateDelegate and Deserializer.
@@ -138,6 +160,14 @@ class Builtins {
  private:
   Builtins();
 
+#ifdef V8_EMBEDDED_BUILTINS
+  // Creates a trampoline code object that jumps to the given off-heap entry.
+  // The result should not be used directly, but only from the related Factory
+  // function.
+  static Handle<Code> GenerateOffHeapTrampolineFor(Isolate* isolate,
+                                                   Address off_heap_entry);
+#endif
+
   static void Generate_CallFunction(MacroAssembler* masm,
                                     ConvertReceiverMode mode);
 
@@ -176,6 +206,7 @@ class Builtins {
   Object* builtins_[builtin_count];
   bool initialized_;
 
+  friend class Factory;  // For GenerateOffHeapTrampolineFor.
   friend class Isolate;
   friend class SetupIsolateDelegate;
 
diff --git a/deps/v8/src/builtins/constants-table-builder.cc b/deps/v8/src/builtins/constants-table-builder.cc
new file mode 100644
index 00000000000..c044a348da2
--- /dev/null
+++ b/deps/v8/src/builtins/constants-table-builder.cc
@@ -0,0 +1,86 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/builtins/constants-table-builder.h"
+
+#include "src/heap/heap-inl.h"
+
+namespace v8 {
+namespace internal {
+
+BuiltinsConstantsTableBuilder::BuiltinsConstantsTableBuilder(Isolate* isolate)
+    : isolate_(isolate), map_(isolate->heap()) {
+  // Ensure this is only called once per Isolate.
+  DCHECK_EQ(isolate_->heap()->empty_fixed_array(),
+            isolate_->heap()->builtins_constants_table());
+
+  // And that the initial value of the builtins constants table can be treated
+  // as a constant, which means that codegen will load it using the root
+  // register.
+  DCHECK(isolate_->heap()->RootCanBeTreatedAsConstant(
+      Heap::kEmptyFixedArrayRootIndex));
+}
+
+uint32_t BuiltinsConstantsTableBuilder::AddObject(Handle<Object> object) {
+#ifdef DEBUG
+  // Roots must not be inserted into the constants table as they are already
+  // accessibly from the root list.
+  Heap::RootListIndex root_list_index;
+  DCHECK(!isolate_->heap()->IsRootHandle(object, &root_list_index));
+
+  // Not yet finalized.
+  DCHECK_EQ(isolate_->heap()->empty_fixed_array(),
+            isolate_->heap()->builtins_constants_table());
+
+  DCHECK(isolate_->serializer_enabled());
+#endif
+
+  uint32_t* maybe_key = map_.Find(object);
+  if (maybe_key == nullptr) {
+    uint32_t index = map_.size();
+    map_.Set(object, index);
+    return index;
+  } else {
+    return *maybe_key;
+  }
+}
+
+void BuiltinsConstantsTableBuilder::Finalize() {
+  HandleScope handle_scope(isolate_);
+
+  DCHECK_EQ(isolate_->heap()->empty_fixed_array(),
+            isolate_->heap()->builtins_constants_table());
+  DCHECK(isolate_->serializer_enabled());
+
+  DCHECK_LT(0, map_.size());
+  Handle<FixedArray> table =
+      isolate_->factory()->NewFixedArray(map_.size(), TENURED);
+
+  Builtins* builtins = isolate_->builtins();
+  ConstantsMap::IteratableScope it_scope(&map_);
+  for (auto it = it_scope.begin(); it != it_scope.end(); ++it) {
+    uint32_t index = *it.entry();
+    Object* value = it.key();
+    if (value->IsCode() && Code::cast(value)->kind() == Code::BUILTIN) {
+      // Replace placeholder code objects with the real builtin.
+      // See also: SetupIsolateDelegate::PopulateWithPlaceholders.
+      // TODO(jgruber): Deduplicate placeholders and their corresponding
+      // builtin.
+      value = builtins->builtin(Code::cast(value)->builtin_index());
+    }
+    table->set(index, value);
+  }
+
+#ifdef DEBUG
+  for (int i = 0; i < map_.size(); i++) {
+    DCHECK(table->get(i)->IsHeapObject());
+    DCHECK_NE(isolate_->heap()->undefined_value(), table->get(i));
+  }
+#endif
+
+  isolate_->heap()->SetBuiltinsConstantsTable(*table);
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/builtins/constants-table-builder.h b/deps/v8/src/builtins/constants-table-builder.h
new file mode 100644
index 00000000000..aefad8c3bb8
--- /dev/null
+++ b/deps/v8/src/builtins/constants-table-builder.h
@@ -0,0 +1,48 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_BUILTINS_CONSTANTS_TABLE_BUILDER_H_
+#define V8_BUILTINS_CONSTANTS_TABLE_BUILDER_H_
+
+#include "src/allocation.h"
+#include "src/base/macros.h"
+#include "src/handles.h"
+#include "src/identity-map.h"
+
+namespace v8 {
+namespace internal {
+
+class Isolate;
+class Object;
+
+// Utility class to build the builtins constants table and store it on the root
+// list. The constants table contains constants used by builtins, and is there
+// to avoid directly embedding them into code objects, which would not be
+// possible for off-heap (and thus immutable) code objects.
+class BuiltinsConstantsTableBuilder final {
+ public:
+  explicit BuiltinsConstantsTableBuilder(Isolate* isolate);
+
+  // Returns the index within the builtins constants table for the given
+  // object, possibly adding the object to the table. Objects are deduplicated.
+  uint32_t AddObject(Handle<Object> object);
+
+  // Should be called after all affected code (e.g. builtins and bytecode
+  // handlers) has been generated.
+  void Finalize();
+
+ private:
+  Isolate* isolate_;
+
+  // Maps objects to corresponding indices within the constants list.
+  typedef IdentityMap<uint32_t, FreeStoreAllocationPolicy> ConstantsMap;
+  ConstantsMap map_;
+
+  DISALLOW_COPY_AND_ASSIGN(BuiltinsConstantsTableBuilder)
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_BUILTINS_CONSTANTS_TABLE_BUILDER_H_
diff --git a/deps/v8/src/builtins/growable-fixed-array-gen.cc b/deps/v8/src/builtins/growable-fixed-array-gen.cc
new file mode 100644
index 00000000000..3a155e26f9a
--- /dev/null
+++ b/deps/v8/src/builtins/growable-fixed-array-gen.cc
@@ -0,0 +1,100 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/builtins/growable-fixed-array-gen.h"
+
+#include "src/compiler/code-assembler.h"
+
+namespace v8 {
+namespace internal {
+
+void GrowableFixedArray::Push(TNode<Object> const value) {
+  TNode<IntPtrT> const length = var_length_.value();
+  TNode<IntPtrT> const capacity = var_capacity_.value();
+
+  Label grow(this), store(this);
+  Branch(IntPtrEqual(capacity, length), &grow, &store);
+
+  BIND(&grow);
+  {
+    var_capacity_ = NewCapacity(capacity);
+    var_array_ = ResizeFixedArray(length, var_capacity_.value());
+
+    Goto(&store);
+  }
+
+  BIND(&store);
+  {
+    TNode<FixedArray> const array = var_array_.value();
+    StoreFixedArrayElement(array, length, value);
+
+    var_length_ = IntPtrAdd(length, IntPtrConstant(1));
+  }
+}
+
+TNode<JSArray> GrowableFixedArray::ToJSArray(TNode<Context> const context) {
+  const ElementsKind kind = PACKED_ELEMENTS;
+
+  TNode<Context> const native_context = LoadNativeContext(context);
+  TNode<Map> const array_map = LoadJSArrayElementsMap(kind, native_context);
+
+  // Shrink to fit if necessary.
+  {
+    Label next(this);
+
+    TNode<IntPtrT> const length = var_length_.value();
+    TNode<IntPtrT> const capacity = var_capacity_.value();
+
+    GotoIf(WordEqual(length, capacity), &next);
+
+    var_array_ = ResizeFixedArray(length, length);
+    var_capacity_ = length;
+    Goto(&next);
+
+    BIND(&next);
+  }
+
+  TNode<Smi> const result_length = SmiTag(length());
+  TNode<JSArray> const result =
+      CAST(AllocateUninitializedJSArrayWithoutElements(array_map, result_length,
+                                                       nullptr));
+
+  StoreObjectField(result, JSObject::kElementsOffset, var_array_.value());
+
+  return result;
+}
+
+TNode<IntPtrT> GrowableFixedArray::NewCapacity(
+    TNode<IntPtrT> current_capacity) {
+  CSA_ASSERT(this,
+             IntPtrGreaterThanOrEqual(current_capacity, IntPtrConstant(0)));
+
+  // Growth rate is analog to JSObject::NewElementsCapacity:
+  // new_capacity = (current_capacity + (current_capacity >> 1)) + 16.
+
+  TNode<IntPtrT> const new_capacity =
+      IntPtrAdd(IntPtrAdd(current_capacity, WordShr(current_capacity, 1)),
+                IntPtrConstant(16));
+
+  return new_capacity;
+}
+
+TNode<FixedArray> GrowableFixedArray::ResizeFixedArray(
+    TNode<IntPtrT> const element_count, TNode<IntPtrT> const new_capacity) {
+  CSA_ASSERT(this, IntPtrGreaterThanOrEqual(element_count, IntPtrConstant(0)));
+  CSA_ASSERT(this, IntPtrGreaterThanOrEqual(new_capacity, IntPtrConstant(0)));
+  CSA_ASSERT(this, IntPtrGreaterThanOrEqual(new_capacity, element_count));
+
+  TNode<FixedArray> const from_array = var_array_.value();
+
+  CodeStubAssembler::ExtractFixedArrayFlags flags;
+  flags |= CodeStubAssembler::ExtractFixedArrayFlag::kFixedArrays;
+  TNode<FixedArray> to_array = CAST(ExtractFixedArray(
+      from_array, nullptr, element_count, new_capacity, flags));
+
+  return to_array;
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/builtins/growable-fixed-array-gen.h b/deps/v8/src/builtins/growable-fixed-array-gen.h
new file mode 100644
index 00000000000..f720659dee1
--- /dev/null
+++ b/deps/v8/src/builtins/growable-fixed-array-gen.h
@@ -0,0 +1,56 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_BUILTINS_GROWABLE_FIXED_ARRAY_GEN_H_
+#define V8_BUILTINS_GROWABLE_FIXED_ARRAY_GEN_H_
+
+#include "src/code-stub-assembler.h"
+
+namespace v8 {
+namespace internal {
+
+template <class T>
+using TNode = compiler::TNode<T>;
+
+// Utility class implementing a growable fixed array through CSA.
+class GrowableFixedArray : public CodeStubAssembler {
+ public:
+  explicit GrowableFixedArray(compiler::CodeAssemblerState* state)
+      : CodeStubAssembler(state),
+        var_array_(this),
+        var_length_(this),
+        var_capacity_(this) {
+    var_array_ = EmptyFixedArrayConstant();
+    var_capacity_ = IntPtrConstant(0);
+    var_length_ = IntPtrConstant(0);
+  }
+
+  TNode<IntPtrT> length() const { return var_length_.value(); }
+
+  TVariable<FixedArray>* var_array() { return &var_array_; }
+  TVariable<IntPtrT>* var_length() { return &var_length_; }
+  TVariable<IntPtrT>* var_capacity() { return &var_capacity_; }
+
+  void Push(TNode<Object> const value);
+
+  TNode<JSArray> ToJSArray(TNode<Context> const context);
+
+ private:
+  TNode<IntPtrT> NewCapacity(TNode<IntPtrT> current_capacity);
+
+  // Creates a new array with {new_capacity} and copies the first
+  // {element_count} elements from the current array.
+  TNode<FixedArray> ResizeFixedArray(TNode<IntPtrT> const element_count,
+                                     TNode<IntPtrT> const new_capacity);
+
+ private:
+  TVariable<FixedArray> var_array_;
+  TVariable<IntPtrT> var_length_;
+  TVariable<IntPtrT> var_capacity_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_BUILTINS_GROWABLE_FIXED_ARRAY_GEN_H_
diff --git a/deps/v8/src/builtins/ia32/builtins-ia32.cc b/deps/v8/src/builtins/ia32/builtins-ia32.cc
index 368e6670c10..5c9d66d2b93 100644
--- a/deps/v8/src/builtins/ia32/builtins-ia32.cc
+++ b/deps/v8/src/builtins/ia32/builtins-ia32.cc
@@ -101,7 +101,7 @@ static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
     __ push(edi);
 
     __ CallRuntime(function_id, 1);
-    __ mov(ebx, eax);
+    __ mov(ecx, eax);
 
     // Restore target function and new target.
     __ pop(edx);
@@ -110,15 +110,9 @@ static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
     __ SmiUntag(eax);
   }
 
-  __ lea(ebx, FieldOperand(ebx, Code::kHeaderSize));
-  __ jmp(ebx);
-}
-
-static void GenerateTailCallToSharedCode(MacroAssembler* masm) {
-  __ mov(ebx, FieldOperand(edi, JSFunction::kSharedFunctionInfoOffset));
-  __ mov(ebx, FieldOperand(ebx, SharedFunctionInfo::kCodeOffset));
-  __ lea(ebx, FieldOperand(ebx, Code::kHeaderSize));
-  __ jmp(ebx);
+  static_assert(kJavaScriptCallCodeStartRegister == ecx, "ABI mismatch");
+  __ lea(ecx, FieldOperand(ecx, Code::kHeaderSize));
+  __ jmp(ecx);
 }
 
 namespace {
@@ -223,8 +217,8 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // -----------------------------------
 
     __ mov(ebx, FieldOperand(edi, JSFunction::kSharedFunctionInfoOffset));
-    __ test(FieldOperand(ebx, SharedFunctionInfo::kCompilerHintsOffset),
-            Immediate(SharedFunctionInfo::kDerivedConstructorMask));
+    __ test(FieldOperand(ebx, SharedFunctionInfo::kFlagsOffset),
+            Immediate(SharedFunctionInfo::IsDerivedConstructorBit::kMask));
     __ j(not_zero, &not_create_implicit_receiver);
 
     // If not derived class constructor: Allocate the new receiver object.
@@ -344,8 +338,8 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     __ bind(&other_result);
     __ mov(ebx, Operand(ebp, ConstructFrameConstants::kConstructorOffset));
     __ mov(ebx, FieldOperand(ebx, JSFunction::kSharedFunctionInfoOffset));
-    __ test(FieldOperand(ebx, SharedFunctionInfo::kCompilerHintsOffset),
-            Immediate(SharedFunctionInfo::kClassConstructorMask));
+    __ test(FieldOperand(ebx, SharedFunctionInfo::kFlagsOffset),
+            Immediate(SharedFunctionInfo::IsClassConstructorBit::kMask));
 
     if (restrict_constructor_return) {
       // Throw if constructor function is a class constructor
@@ -590,6 +584,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
     // We abuse new.target both to indicate that this is a resume call and to
     // pass in the generator object.  In ordinary calls, new.target is always
     // undefined because generator functions are non-constructable.
+    static_assert(kJavaScriptCallCodeStartRegister == ecx, "ABI mismatch");
     __ mov(ecx, FieldOperand(edi, JSFunction::kCodeOffset));
     __ add(ecx, Immediate(Code::kHeaderSize - kHeapObjectTag));
     __ jmp(ecx);
@@ -678,7 +673,7 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   // -----------------------------------
   DCHECK(!AreAliased(feedback_vector, eax, edx, edi, scratch));
 
-  Label optimized_code_slot_is_cell, fallthrough;
+  Label optimized_code_slot_is_weak_ref, fallthrough;
 
   Register closure = edi;
   Register optimized_code_entry = scratch;
@@ -687,9 +682,9 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
          FieldOperand(feedback_vector, FeedbackVector::kOptimizedCodeOffset));
 
   // Check if the code entry is a Smi. If yes, we interpret it as an
-  // optimisation marker. Otherwise, interpret is as a weak cell to a code
+  // optimisation marker. Otherwise, interpret it as a weak reference to a code
   // object.
-  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_cell);
+  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_weak_ref);
 
   {
     // Optimized code slot is an optimization marker.
@@ -724,12 +719,11 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   }
 
   {
-    // Optimized code slot is a WeakCell.
-    __ bind(&optimized_code_slot_is_cell);
+    // Optimized code slot is a weak reference.
+    __ bind(&optimized_code_slot_is_weak_ref);
+
+    __ LoadWeakValue(optimized_code_entry, &fallthrough);
 
-    __ mov(optimized_code_entry,
-           FieldOperand(optimized_code_entry, WeakCell::kValueOffset));
-    __ JumpIfSmi(optimized_code_entry, &fallthrough);
     __ push(eax);
     __ push(edx);
 
@@ -748,10 +742,12 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
     // register.
     ReplaceClosureCodeWithOptimizedCode(masm, optimized_code_entry, closure,
                                         edx, eax, feedback_vector);
-    __ add(optimized_code_entry, Immediate(Code::kHeaderSize - kHeapObjectTag));
+    static_assert(kJavaScriptCallCodeStartRegister == ecx, "ABI mismatch");
+    __ Move(ecx, optimized_code_entry);
+    __ add(ecx, Immediate(Code::kHeaderSize - kHeapObjectTag));
     __ pop(edx);
     __ pop(eax);
-    __ jmp(optimized_code_entry);
+    __ jmp(ecx);
 
     // Optimized code slot contains deoptimized code, evict it and re-enter the
     // closure's code.
@@ -767,10 +763,13 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
 }
 
 // Advance the current bytecode offset. This simulates what all bytecode
-// handlers do upon completion of the underlying operation.
-static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
-                                  Register bytecode_offset, Register bytecode,
-                                  Register scratch1) {
+// handlers do upon completion of the underlying operation. Will bail out to a
+// label if the bytecode (without prefix) is a return bytecode.
+static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
+                                          Register bytecode_array,
+                                          Register bytecode_offset,
+                                          Register bytecode, Register scratch1,
+                                          Label* if_return) {
   Register bytecode_size_table = scratch1;
   DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
                      bytecode));
@@ -780,11 +779,11 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
               ExternalReference::bytecode_size_table_address(masm->isolate())));
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
-  Label load_size, extra_wide;
+  Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
   __ cmpb(bytecode, Immediate(0x1));
-  __ j(above, &load_size, Label::kNear);
+  __ j(above, &process_bytecode, Label::kNear);
   __ j(equal, &extra_wide, Label::kNear);
 
   // Load the next bytecode and update table to the wide scaled table.
@@ -792,7 +791,7 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
   __ movzx_b(bytecode, Operand(bytecode_array, bytecode_offset, times_1, 0));
   __ add(bytecode_size_table,
          Immediate(kIntSize * interpreter::Bytecodes::kBytecodeCount));
-  __ jmp(&load_size, Label::kNear);
+  __ jmp(&process_bytecode, Label::kNear);
 
   __ bind(&extra_wide);
   // Load the next bytecode and update table to the extra wide scaled table.
@@ -801,8 +800,17 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
   __ add(bytecode_size_table,
          Immediate(2 * kIntSize * interpreter::Bytecodes::kBytecodeCount));
 
-  // Load the size of the current bytecode.
-  __ bind(&load_size);
+  __ bind(&process_bytecode);
+
+// Bailout to the return label if this is a return bytecode.
+#define JUMP_IF_EQUAL(NAME)                                             \
+  __ cmpb(bytecode,                                                     \
+          Immediate(static_cast<int>(interpreter::Bytecode::k##NAME))); \
+  __ j(equal, if_return, Label::kNear);
+  RETURN_BYTECODE_LIST(JUMP_IF_EQUAL)
+#undef JUMP_IF_EQUAL
+
+  // Otherwise, load the size of the current bytecode and advance the offset.
   __ add(bytecode_offset, Operand(bytecode_size_table, bytecode, times_4, 0));
 }
 
@@ -828,7 +836,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
 
   // Load the feedback vector from the closure.
   __ mov(feedback_vector,
-         FieldOperand(closure, JSFunction::kFeedbackVectorOffset));
+         FieldOperand(closure, JSFunction::kFeedbackCellOffset));
   __ mov(feedback_vector, FieldOperand(feedback_vector, Cell::kValueOffset));
   // Read off the optimized code slot in the feedback vector, and if there
   // is optimized code or an optimization marker, call that instead.
@@ -931,9 +939,10 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
              masm->isolate())));
   __ movzx_b(ebx, Operand(kInterpreterBytecodeArrayRegister,
                           kInterpreterBytecodeOffsetRegister, times_1, 0));
-  __ mov(ebx, Operand(kInterpreterDispatchTableRegister, ebx,
-                      times_pointer_size, 0));
-  __ call(ebx);
+  __ mov(
+      kJavaScriptCallCodeStartRegister,
+      Operand(kInterpreterDispatchTableRegister, ebx, times_pointer_size, 0));
+  __ call(kJavaScriptCallCodeStartRegister);
   masm->isolate()->heap()->SetInterpreterEntryReturnPCOffset(masm->pc_offset());
 
   // Any returns to the entry trampoline are either due to the return bytecode
@@ -946,16 +955,13 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
          Operand(ebp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
   __ SmiUntag(kInterpreterBytecodeOffsetRegister);
 
-  // Check if we should return.
+  // Either return, or advance to the next bytecode and dispatch.
   Label do_return;
   __ movzx_b(ebx, Operand(kInterpreterBytecodeArrayRegister,
                           kInterpreterBytecodeOffsetRegister, times_1, 0));
-  __ cmpb(ebx, Immediate(static_cast<int>(interpreter::Bytecode::kReturn)));
-  __ j(equal, &do_return, Label::kNear);
-
-  // Advance to the next bytecode and dispatch.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, ebx, edx);
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, ebx, ecx,
+                                &do_return);
   __ jmp(&do_dispatch);
 
   __ bind(&do_return);
@@ -1002,6 +1008,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
 void Builtins::Generate_InterpreterPushArgsThenCallImpl(
     MacroAssembler* masm, ConvertReceiverMode receiver_mode,
     InterpreterPushArgsMode mode) {
+  DCHECK(mode != InterpreterPushArgsMode::kArrayFunction);
   // ----------- S t a t e -------------
   //  -- eax : the number of arguments (not including the receiver)
   //  -- ebx : the address of the first argument to be pushed. Subsequent
@@ -1044,11 +1051,7 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
   // Call the target.
   __ Push(edx);  // Re-push return address.
 
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
-    __ Jump(
-        masm->isolate()->builtins()->CallFunction(ConvertReceiverMode::kAny),
-        RelocInfo::CODE_TARGET);
-  } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     __ Jump(BUILTIN_CODE(masm->isolate(), CallWithSpread),
             RelocInfo::CODE_TARGET);
   } else {
@@ -1192,15 +1195,12 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
     __ AssertUndefinedOrAllocationSite(ebx);
   }
 
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
-    // Tail call to the function-specific construct stub (still in the caller
+  if (mode == InterpreterPushArgsMode::kArrayFunction) {
+    // Tail call to the array construct stub (still in the caller
     // context at this point).
     __ AssertFunction(edi);
-
-    __ mov(ecx, FieldOperand(edi, JSFunction::kSharedFunctionInfoOffset));
-    __ mov(ecx, FieldOperand(ecx, SharedFunctionInfo::kConstructStubOffset));
-    __ lea(ecx, FieldOperand(ecx, Code::kHeaderSize));
-    __ jmp(ecx);
+    ArrayConstructorStub array_constructor_stub(masm->isolate());
+    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor with unmodified eax, edi, edx values.
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1262,9 +1262,10 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   // Dispatch to the target bytecode.
   __ movzx_b(ebx, Operand(kInterpreterBytecodeArrayRegister,
                           kInterpreterBytecodeOffsetRegister, times_1, 0));
-  __ mov(ebx, Operand(kInterpreterDispatchTableRegister, ebx,
-                      times_pointer_size, 0));
-  __ jmp(ebx);
+  __ mov(
+      kJavaScriptCallCodeStartRegister,
+      Operand(kInterpreterDispatchTableRegister, ebx, times_pointer_size, 0));
+  __ jmp(kJavaScriptCallCodeStartRegister);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
@@ -1280,8 +1281,10 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
                           kInterpreterBytecodeOffsetRegister, times_1, 0));
 
   // Advance to the next bytecode.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, ebx, edx);
+  Label if_return;
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, ebx, ecx,
+                                &if_return);
 
   // Convert new bytecode offset to a Smi and save in the stackframe.
   __ mov(ebx, kInterpreterBytecodeOffsetRegister);
@@ -1289,44 +1292,19 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
   __ mov(Operand(ebp, InterpreterFrameConstants::kBytecodeOffsetFromFp), ebx);
 
   Generate_InterpreterEnterBytecode(masm);
+
+  // We should never take the if_return path.
+  __ bind(&if_return);
+  __ Abort(AbortReason::kInvalidBytecodeAdvance);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CheckOptimizationMarker(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- rax : argument count (preserved for callee)
-  //  -- rdx : new target (preserved for callee)
-  //  -- rdi : target function (preserved for callee)
-  // -----------------------------------
-  Register closure = edi;
-
-  // Get the feedback vector.
-  Register feedback_vector = ebx;
-  __ mov(feedback_vector,
-         FieldOperand(closure, JSFunction::kFeedbackVectorOffset));
-  __ mov(feedback_vector, FieldOperand(feedback_vector, Cell::kValueOffset));
-
-  // The feedback vector must be defined.
-  if (FLAG_debug_code) {
-    __ CompareRoot(feedback_vector, Heap::kUndefinedValueRootIndex);
-    __ Assert(not_equal, AbortReason::kExpectedFeedbackVector);
-  }
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, ecx);
-
-  // Otherwise, tail call the SFI code.
-  GenerateTailCallToSharedCode(masm);
-}
-
 void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to the trampoline to the
-  // interpreter entry.
-  __ mov(ecx, FieldOperand(edi, JSFunction::kSharedFunctionInfoOffset));
-  __ mov(ecx, FieldOperand(ecx, SharedFunctionInfo::kCodeOffset));
+  // Set the code slot inside the JSFunction to CompileLazy.
+  __ Move(ecx, BUILTIN_CODE(masm->isolate(), CompileLazy));
   __ mov(FieldOperand(edi, JSFunction::kCodeOffset), ecx);
   __ RecordWriteField(edi, JSFunction::kCodeOffset, ecx, ebx, kDontSaveFPRegs,
                       OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
@@ -1334,6 +1312,68 @@ void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
   Generate_CompileLazy(masm);
 }
 
+static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
+                                      Register scratch1) {
+  // Figure out the SFI's code object.
+  Label done;
+  Label check_is_bytecode_array;
+  Label check_is_code;
+  Label check_is_fixed_array;
+  Label check_is_pre_parsed_scope_data;
+  Label check_is_function_template_info;
+
+  Register data_type = scratch1;
+
+  // IsSmi: Is builtin
+  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
+  __ mov(scratch1,
+         Immediate(ExternalReference::builtins_address(masm->isolate())));
+  // Avoid untagging the Smi unnecessarily.
+  STATIC_ASSERT(times_2 == times_pointer_size - kSmiTagSize);
+  __ mov(sfi_data, Operand(scratch1, sfi_data, times_2, 0));
+  __ jmp(&done);
+
+  // Get map for subsequent checks.
+  __ bind(&check_is_bytecode_array);
+  __ mov(data_type, FieldOperand(sfi_data, HeapObject::kMapOffset));
+  __ mov(data_type, FieldOperand(data_type, Map::kInstanceTypeOffset));
+
+  // IsBytecodeArray: Interpret bytecode
+  __ cmpw(data_type, Immediate(BYTECODE_ARRAY_TYPE));
+  __ j(not_equal, &check_is_code);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
+  __ jmp(&done);
+
+  // IsCode: Run code
+  __ bind(&check_is_code);
+  __ cmpw(data_type, Immediate(CODE_TYPE));
+  __ j(equal, &done);
+
+  // IsFixedArray: Instantiate using AsmWasmData,
+  __ bind(&check_is_fixed_array);
+  __ cmpw(data_type, Immediate(FIXED_ARRAY_TYPE));
+  __ j(not_equal, &check_is_pre_parsed_scope_data);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
+  __ jmp(&done);
+
+  // IsPreParsedScopeData: Compile lazy
+  __ bind(&check_is_pre_parsed_scope_data);
+  __ cmpw(data_type, Immediate(TUPLE2_TYPE));
+  __ j(not_equal, &check_is_function_template_info);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
+  __ jmp(&done);
+
+  // IsFunctionTemplateInfo: API call
+  __ bind(&check_is_function_template_info);
+  if (FLAG_debug_code) {
+    __ cmpw(data_type, Immediate(FUNCTION_TEMPLATE_INFO_TYPE));
+    __ Check(equal, AbortReason::kInvalidSharedFunctionInfoData);
+  }
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
+
+  __ bind(&done);
+}
+
 void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- eax : argument count (preserved for callee)
@@ -1348,7 +1388,7 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
 
   // Do we have a valid feedback vector?
   __ mov(feedback_vector,
-         FieldOperand(closure, JSFunction::kFeedbackVectorOffset));
+         FieldOperand(closure, JSFunction::kFeedbackCellOffset));
   __ mov(feedback_vector, FieldOperand(feedback_vector, Cell::kValueOffset));
   __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
                 &gotta_call_runtime);
@@ -1356,12 +1396,13 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // Is there an optimization marker or optimized code in the feedback vector?
   MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, ecx);
 
-  // We found no optimized code.
+  // We found no optimized code. Infer the code object needed for the SFI.
   Register entry = ecx;
   __ mov(entry, FieldOperand(closure, JSFunction::kSharedFunctionInfoOffset));
+  __ mov(entry, FieldOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
+  GetSharedFunctionInfoCode(masm, entry, ebx);
 
-  // If SFI points to anything other than CompileLazy, install that.
-  __ mov(entry, FieldOperand(entry, SharedFunctionInfo::kCodeOffset));
+  // If code entry points to anything other than CompileLazy, install that.
   __ Move(ebx, masm->CodeObject());
   __ cmp(entry, ebx);
   __ j(equal, &gotta_call_runtime);
@@ -1429,26 +1470,13 @@ void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
 
   {
     // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over. First to the shared function info.
+    // we simply need to copy it over to the target function.
 
     Register target_builtin = scratch1;
-    Register shared = scratch0;
-
-    __ mov(shared, FieldOperand(target, JSFunction::kSharedFunctionInfoOffset));
 
-    __ mov(FieldOperand(shared, SharedFunctionInfo::kCodeOffset),
-           target_builtin);
+    __ mov(FieldOperand(target, JSFunction::kCodeOffset), target_builtin);
     __ push(eax);  // Write barrier clobbers these below.
     __ push(target_builtin);
-    __ RecordWriteField(shared, SharedFunctionInfo::kCodeOffset, target_builtin,
-                        eax, kDontSaveFPRegs, OMIT_REMEMBERED_SET,
-                        OMIT_SMI_CHECK);
-    __ pop(target_builtin);  // eax is popped later, shared is now available.
-
-    // And second to the target function.
-
-    __ mov(FieldOperand(target, JSFunction::kCodeOffset), target_builtin);
-    __ push(target_builtin);  // Write barrier clobbers these below.
     __ RecordWriteField(target, JSFunction::kCodeOffset, target_builtin, eax,
                         kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
     __ pop(target_builtin);
@@ -1531,6 +1559,7 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   }
   // On failure, tail call back to regular js by re-calling the function
   // which has be reset to the compile lazy builtin.
+  static_assert(kJavaScriptCallCodeStartRegister == ecx, "ABI mismatch");
   __ mov(ecx, FieldOperand(edi, JSFunction::kCodeOffset));
   __ add(ecx, Immediate(Code::kHeaderSize - kHeapObjectTag));
   __ jmp(ecx);
@@ -1822,9 +1851,6 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // -----------------------------------
   Label generic_array_code;
 
-  // Get the InternalArray function.
-  __ LoadGlobalFunction(Context::INTERNAL_ARRAY_FUNCTION_INDEX, edi);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin InternalArray function should be a map.
     __ mov(ebx, FieldOperand(edi, JSFunction::kPrototypeOrInitialMapOffset));
@@ -1840,6 +1866,7 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // Run the native code for the InternalArray function called as a normal
   // function.
   // tail call a stub
+  __ mov(ebx, masm->isolate()->factory()->undefined_value());
   InternalArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
@@ -1847,15 +1874,12 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
 void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- eax : argc
+  //  -- edi    : array function
   //  -- esp[0] : return address
   //  -- esp[4] : last argument
   // -----------------------------------
   Label generic_array_code;
 
-  // Get the Array function.
-  __ LoadGlobalFunction(Context::ARRAY_FUNCTION_INDEX, edi);
-  __ mov(edx, edi);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin Array function should be a map.
     __ mov(ebx, FieldOperand(edi, JSFunction::kPrototypeOrInitialMapOffset));
@@ -1866,9 +1890,17 @@ void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
     __ Assert(equal, AbortReason::kUnexpectedInitialMapForArrayFunction);
   }
 
-  // Run the native code for the Array function called as a normal function.
-  // tail call a stub
+  // ebx is the AllocationSite - here undefined.
   __ mov(ebx, masm->isolate()->factory()->undefined_value());
+  // If edx (new target) is undefined, then this is the 'Call' case, so move
+  // edi (the constructor) to rdx.
+  Label call;
+  __ cmp(edx, ebx);
+  __ j(not_equal, &call);
+  __ mov(edx, edi);
+
+  // Run the native code for the Array function called as a normal function.
+  __ bind(&call);
   ArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
@@ -2092,8 +2124,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   // Check that the function is not a "classConstructor".
   Label class_constructor;
   __ mov(edx, FieldOperand(edi, JSFunction::kSharedFunctionInfoOffset));
-  __ test(FieldOperand(edx, SharedFunctionInfo::kCompilerHintsOffset),
-          Immediate(SharedFunctionInfo::kClassConstructorMask));
+  __ test(FieldOperand(edx, SharedFunctionInfo::kFlagsOffset),
+          Immediate(SharedFunctionInfo::IsClassConstructorBit::kMask));
   __ j(not_zero, &class_constructor);
 
   // Enter the context of the function; ToObject has to run in the function
@@ -2102,7 +2134,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   __ mov(esi, FieldOperand(edi, JSFunction::kContextOffset));
   // We need to convert the receiver for non-native sloppy mode functions.
   Label done_convert;
-  __ test(FieldOperand(edx, SharedFunctionInfo::kCompilerHintsOffset),
+  __ test(FieldOperand(edx, SharedFunctionInfo::kFlagsOffset),
           Immediate(SharedFunctionInfo::IsNativeBit::kMask |
                     SharedFunctionInfo::IsStrictBit::kMask));
   __ j(not_zero, &done_convert);
@@ -2345,6 +2377,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
   //  -- edx : the new target (checked to be a constructor)
   //  -- edi : the constructor to call (checked to be a JSFunction)
   // -----------------------------------
+  __ AssertConstructor(edi);
   __ AssertFunction(edi);
 
   // Calling convention for function specific ConstructStubs require
@@ -2366,6 +2399,7 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
   //  -- edx : the new target (checked to be a constructor)
   //  -- edi : the constructor to call (checked to be a JSBoundFunction)
   // -----------------------------------
+  __ AssertConstructor(edi);
   __ AssertBoundFunction(edi);
 
   // Push the [[BoundArguments]] onto the stack.
@@ -2398,16 +2432,17 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   Label non_constructor, non_proxy;
   __ JumpIfSmi(edi, &non_constructor, Label::kNear);
 
-  // Dispatch based on instance type.
-  __ CmpObjectType(edi, JS_FUNCTION_TYPE, ecx);
-  __ j(equal, BUILTIN_CODE(masm->isolate(), ConstructFunction),
-       RelocInfo::CODE_TARGET);
-
   // Check if target has a [[Construct]] internal method.
+  __ mov(ecx, FieldOperand(edi, HeapObject::kMapOffset));
   __ test_b(FieldOperand(ecx, Map::kBitFieldOffset),
             Immediate(Map::IsConstructorBit::kMask));
   __ j(zero, &non_constructor, Label::kNear);
 
+  // Dispatch based on instance type.
+  __ CmpInstanceType(ecx, JS_FUNCTION_TYPE);
+  __ j(equal, BUILTIN_CODE(masm->isolate(), ConstructFunction),
+       RelocInfo::CODE_TARGET);
+
   // Only dispatch to bound functions after checking whether they are
   // constructors.
   __ CmpInstanceType(ecx, JS_BOUND_FUNCTION_TYPE);
@@ -2566,6 +2601,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // eax : expected number of arguments
   // edx : new target (passed through to callee)
   // edi : function (passed through to callee)
+  static_assert(kJavaScriptCallCodeStartRegister == ecx, "ABI mismatch");
   __ mov(ecx, FieldOperand(edi, JSFunction::kCodeOffset));
   __ add(ecx, Immediate(Code::kHeaderSize - kHeapObjectTag));
   __ call(ecx);
@@ -2581,6 +2617,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // Dont adapt arguments.
   // -------------------------------------------
   __ bind(&dont_adapt_arguments);
+  static_assert(kJavaScriptCallCodeStartRegister == ecx, "ABI mismatch");
   __ mov(ecx, FieldOperand(edi, JSFunction::kCodeOffset));
   __ add(ecx, Immediate(Code::kHeaderSize - kHeapObjectTag));
   __ jmp(ecx);
diff --git a/deps/v8/src/builtins/mips/OWNERS b/deps/v8/src/builtins/mips/OWNERS
index 978563cab5e..cf2df277c96 100644
--- a/deps/v8/src/builtins/mips/OWNERS
+++ b/deps/v8/src/builtins/mips/OWNERS
@@ -1,2 +1,3 @@
 ivica.bogosavljevic@mips.com
 Miran.Karic@mips.com
+sreten.kovacevic@mips.com
diff --git a/deps/v8/src/builtins/mips/builtins-mips.cc b/deps/v8/src/builtins/mips/builtins-mips.cc
index 7af02bb32e0..e2355685bff 100644
--- a/deps/v8/src/builtins/mips/builtins-mips.cc
+++ b/deps/v8/src/builtins/mips/builtins-mips.cc
@@ -82,19 +82,6 @@ void Builtins::Generate_AdaptorWithBuiltinExitFrame(MacroAssembler* masm) {
   AdaptorWithExitFrameType(masm, BUILTIN_EXIT);
 }
 
-// Load the built-in InternalArray function from the current context.
-static void GenerateLoadInternalArrayFunction(MacroAssembler* masm,
-                                              Register result) {
-  // Load the InternalArray function from the native context.
-  __ LoadNativeContextSlot(Context::INTERNAL_ARRAY_FUNCTION_INDEX, result);
-}
-
-// Load the built-in Array function from the current context.
-static void GenerateLoadArrayFunction(MacroAssembler* masm, Register result) {
-  // Load the Array function from the native context.
-  __ LoadNativeContextSlot(Context::ARRAY_FUNCTION_INDEX, result);
-}
-
 void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- a0     : number of arguments
@@ -103,9 +90,6 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // -----------------------------------
   Label generic_array_code, one_or_more_arguments, two_or_more_arguments;
 
-  // Get the InternalArray function.
-  GenerateLoadInternalArrayFunction(masm, a1);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin InternalArray functions should be maps.
     __ lw(a2, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
@@ -120,6 +104,7 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // Run the native code for the InternalArray function called as a normal
   // function.
   // Tail call a stub.
+  __ LoadRoot(a2, Heap::kUndefinedValueRootIndex);
   InternalArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
@@ -127,39 +112,37 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
 void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- a0     : number of arguments
+  //  -- a1     : array function
   //  -- ra     : return address
   //  -- sp[...]: constructor arguments
   // -----------------------------------
   Label generic_array_code;
 
-  // Get the Array function.
-  GenerateLoadArrayFunction(masm, a1);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin Array functions should be maps.
     __ lw(a2, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
     __ SmiTst(a2, t0);
     __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction1, t0,
               Operand(zero_reg));
-    __ GetObjectType(a2, a3, t0);
+    __ GetObjectType(a2, t1, t0);
     __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction2, t0,
               Operand(MAP_TYPE));
   }
 
-  // Run the native code for the Array function called as a normal function.
-  // Tail call a stub.
-  __ mov(a3, a1);
+  // a2 is the AllocationSite - here undefined.
   __ LoadRoot(a2, Heap::kUndefinedValueRootIndex);
+  // If a3 (new target) is undefined, then this is the 'Call' case, so move
+  // a1 (the constructor) to a3.
+  Label call;
+  __ Branch(&call, ne, a3, Operand(a2));
+  __ mov(a3, a1);
+
+  // Run the native code for the Array function called as a normal function.
+  __ bind(&call);
   ArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
 
-static void GenerateTailCallToSharedCode(MacroAssembler* masm) {
-  __ lw(a2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-  __ lw(a2, FieldMemOperand(a2, SharedFunctionInfo::kCodeOffset));
-  __ Jump(at, a2, Code::kHeaderSize - kHeapObjectTag);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -181,7 +164,9 @@ static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
     __ SmiUntag(a0);
   }
 
-  __ Jump(at, v0, Code::kHeaderSize - kHeapObjectTag);
+  static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
+  __ Addu(a2, v0, Code::kHeaderSize - kHeapObjectTag);
+  __ Jump(a2);
 }
 
 namespace {
@@ -284,8 +269,8 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // -----------------------------------
 
     __ lw(t2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-    __ lw(t2, FieldMemOperand(t2, SharedFunctionInfo::kCompilerHintsOffset));
-    __ And(t2, t2, Operand(SharedFunctionInfo::kDerivedConstructorMask));
+    __ lw(t2, FieldMemOperand(t2, SharedFunctionInfo::kFlagsOffset));
+    __ And(t2, t2, Operand(SharedFunctionInfo::IsDerivedConstructorBit::kMask));
     __ Branch(&not_create_implicit_receiver, ne, t2, Operand(zero_reg));
 
     // If not derived class constructor: Allocate the new receiver object.
@@ -405,8 +390,8 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     __ bind(&other_result);
     __ lw(a1, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
     __ lw(t2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-    __ lw(t2, FieldMemOperand(t2, SharedFunctionInfo::kCompilerHintsOffset));
-    __ And(t2, t2, Operand(SharedFunctionInfo::kClassConstructorMask));
+    __ lw(t2, FieldMemOperand(t2, SharedFunctionInfo::kFlagsOffset));
+    __ And(t2, t2, Operand(SharedFunctionInfo::IsClassConstructorBit::kMask));
 
     if (restrict_constructor_return) {
       // Throw if constructor function is a class constructor
@@ -656,8 +641,10 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
     // undefined because generator functions are non-constructable.
     __ Move(a3, a1);
     __ Move(a1, t0);
+    static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
     __ lw(a2, FieldMemOperand(a1, JSFunction::kCodeOffset));
-    __ Jump(a2, Code::kHeaderSize - kHeapObjectTag);
+    __ Addu(a2, a2, Code::kHeaderSize - kHeapObjectTag);
+    __ Jump(a2);
   }
 
   __ bind(&prepare_step_in_if_stepping);
@@ -739,7 +726,7 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   DCHECK(
       !AreAliased(feedback_vector, a0, a1, a3, scratch1, scratch2, scratch3));
 
-  Label optimized_code_slot_is_cell, fallthrough;
+  Label optimized_code_slot_is_weak_ref, fallthrough;
 
   Register closure = a1;
   Register optimized_code_entry = scratch1;
@@ -748,9 +735,9 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
         FieldMemOperand(feedback_vector, FeedbackVector::kOptimizedCodeOffset));
 
   // Check if the code entry is a Smi. If yes, we interpret it as an
-  // optimisation marker. Otherwise, interpret is as a weak cell to a code
+  // optimisation marker. Otherwise, interpret it as a weak cell to a code
   // object.
-  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_cell);
+  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_weak_ref);
 
   {
     // Optimized code slot is a Smi optimization marker.
@@ -784,12 +771,10 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   }
 
   {
-    // Optimized code slot is a WeakCell.
-    __ bind(&optimized_code_slot_is_cell);
+    // Optimized code slot is a weak reference.
+    __ bind(&optimized_code_slot_is_weak_ref);
 
-    __ lw(optimized_code_entry,
-          FieldMemOperand(optimized_code_entry, WeakCell::kValueOffset));
-    __ JumpIfSmi(optimized_code_entry, &fallthrough);
+    __ LoadWeakValue(optimized_code_entry, optimized_code_entry, &fallthrough);
 
     // Check if the optimized code is marked for deopt. If it is, call the
     // runtime to clear it.
@@ -807,7 +792,9 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
     // register.
     ReplaceClosureCodeWithOptimizedCode(masm, optimized_code_entry, closure,
                                         scratch2, scratch3, feedback_vector);
-    __ Jump(optimized_code_entry, Code::kHeaderSize - kHeapObjectTag);
+    static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
+    __ Addu(a2, optimized_code_entry, Code::kHeaderSize - kHeapObjectTag);
+    __ Jump(a2);
 
     // Optimized code slot contains deoptimized code, evict it and re-enter the
     // losure's code.
@@ -821,10 +808,13 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
 }
 
 // Advance the current bytecode offset. This simulates what all bytecode
-// handlers do upon completion of the underlying operation.
-static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
-                                  Register bytecode_offset, Register bytecode,
-                                  Register scratch1, Register scratch2) {
+// handlers do upon completion of the underlying operation. Will bail out to a
+// label if the bytecode (without prefix) is a return bytecode.
+static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
+                                          Register bytecode_array,
+                                          Register bytecode_offset,
+                                          Register bytecode, Register scratch1,
+                                          Register scratch2, Label* if_return) {
   Register bytecode_size_table = scratch1;
   DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
                      bytecode));
@@ -834,10 +824,10 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
       Operand(ExternalReference::bytecode_size_table_address(masm->isolate())));
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
-  Label load_size, extra_wide;
+  Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
-  __ Branch(&load_size, hi, bytecode, Operand(1));
+  __ Branch(&process_bytecode, hi, bytecode, Operand(1));
   __ Branch(&extra_wide, eq, bytecode, Operand(1));
 
   // Load the next bytecode and update table to the wide scaled table.
@@ -846,7 +836,7 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
   __ lbu(bytecode, MemOperand(scratch2));
   __ Addu(bytecode_size_table, bytecode_size_table,
           Operand(kIntSize * interpreter::Bytecodes::kBytecodeCount));
-  __ jmp(&load_size);
+  __ jmp(&process_bytecode);
 
   __ bind(&extra_wide);
   // Load the next bytecode and update table to the extra wide scaled table.
@@ -856,8 +846,16 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
   __ Addu(bytecode_size_table, bytecode_size_table,
           Operand(2 * kIntSize * interpreter::Bytecodes::kBytecodeCount));
 
-  // Load the size of the current bytecode.
-  __ bind(&load_size);
+  __ bind(&process_bytecode);
+
+// Bailout to the return label if this is a return bytecode.
+#define JUMP_IF_EQUAL(NAME)          \
+  __ Branch(if_return, eq, bytecode, \
+            Operand(static_cast<int>(interpreter::Bytecode::k##NAME)));
+  RETURN_BYTECODE_LIST(JUMP_IF_EQUAL)
+#undef JUMP_IF_EQUAL
+
+  // Otherwise, load the size of the current bytecode and advance the offset.
   __ Lsa(scratch2, bytecode_size_table, bytecode, 2);
   __ lw(scratch2, MemOperand(scratch2));
   __ Addu(bytecode_offset, bytecode_offset, scratch2);
@@ -886,7 +884,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
 
   // Load the feedback vector from the closure.
   __ lw(feedback_vector,
-        FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
+        FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
   __ lw(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
   // Read off the optimized code slot in the feedback vector, and if there
   // is optimized code or an optimization marker, call that instead.
@@ -992,10 +990,10 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
             masm->isolate())));
   __ Addu(a0, kInterpreterBytecodeArrayRegister,
           kInterpreterBytecodeOffsetRegister);
-  __ lbu(a0, MemOperand(a0));
-  __ Lsa(at, kInterpreterDispatchTableRegister, a0, kPointerSizeLog2);
-  __ lw(at, MemOperand(at));
-  __ Call(at);
+  __ lbu(t3, MemOperand(a0));
+  __ Lsa(at, kInterpreterDispatchTableRegister, t3, kPointerSizeLog2);
+  __ lw(kJavaScriptCallCodeStartRegister, MemOperand(at));
+  __ Call(kJavaScriptCallCodeStartRegister);
   masm->isolate()->heap()->SetInterpreterEntryReturnPCOffset(masm->pc_offset());
 
   // Any returns to the entry trampoline are either due to the return bytecode
@@ -1007,18 +1005,14 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   __ lw(kInterpreterBytecodeOffsetRegister,
         MemOperand(fp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
   __ SmiUntag(kInterpreterBytecodeOffsetRegister);
-
-  // Check if we should return.
+  // Either return, or advance to the next bytecode and dispatch.
   Label do_return;
   __ Addu(a1, kInterpreterBytecodeArrayRegister,
           kInterpreterBytecodeOffsetRegister);
   __ lbu(a1, MemOperand(a1));
-  __ Branch(&do_return, eq, a1,
-            Operand(static_cast<int>(interpreter::Bytecode::kReturn)));
-
-  // Advance to the next bytecode and dispatch.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, a1, a2, a3);
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, a1, a2, a3,
+                                &do_return);
   __ jmp(&do_dispatch);
 
   __ bind(&do_return);
@@ -1079,6 +1073,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
 void Builtins::Generate_InterpreterPushArgsThenCallImpl(
     MacroAssembler* masm, ConvertReceiverMode receiver_mode,
     InterpreterPushArgsMode mode) {
+  DCHECK(mode != InterpreterPushArgsMode::kArrayFunction);
   // ----------- S t a t e -------------
   //  -- a0 : the number of arguments (not including the receiver)
   //  -- a2 : the address of the first argument to be pushed. Subsequent
@@ -1107,11 +1102,7 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
   }
 
   // Call the target.
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
-    __ Jump(
-        masm->isolate()->builtins()->CallFunction(ConvertReceiverMode::kAny),
-        RelocInfo::CODE_TARGET);
-  } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     __ Jump(BUILTIN_CODE(masm->isolate(), CallWithSpread),
             RelocInfo::CODE_TARGET);
   } else {
@@ -1154,14 +1145,13 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
     __ AssertUndefinedOrAllocationSite(a2, t0);
   }
 
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
+  if (mode == InterpreterPushArgsMode::kArrayFunction) {
     __ AssertFunction(a1);
 
-    // Tail call to the function-specific construct stub (still in the caller
+    // Tail call to the array construct stub (still in the caller
     // context at this point).
-    __ lw(t0, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-    __ lw(t0, FieldMemOperand(t0, SharedFunctionInfo::kConstructStubOffset));
-    __ Jump(at, t0, Code::kHeaderSize - kHeapObjectTag);
+    ArrayConstructorStub array_constructor_stub(masm->isolate());
+    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor with a0, a1, and a3 unmodified.
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1219,10 +1209,10 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   // Dispatch to the target bytecode.
   __ Addu(a1, kInterpreterBytecodeArrayRegister,
           kInterpreterBytecodeOffsetRegister);
-  __ lbu(a1, MemOperand(a1));
-  __ Lsa(a1, kInterpreterDispatchTableRegister, a1, kPointerSizeLog2);
-  __ lw(a1, MemOperand(a1));
-  __ Jump(a1);
+  __ lbu(t3, MemOperand(a1));
+  __ Lsa(a1, kInterpreterDispatchTableRegister, t3, kPointerSizeLog2);
+  __ lw(kJavaScriptCallCodeStartRegister, MemOperand(a1));
+  __ Jump(kJavaScriptCallCodeStartRegister);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
@@ -1241,53 +1231,29 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
   __ lbu(a1, MemOperand(a1));
 
   // Advance to the next bytecode.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, a1, a2, a3);
+  Label if_return;
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, a1, a2, a3,
+                                &if_return);
 
   // Convert new bytecode offset to a Smi and save in the stackframe.
   __ SmiTag(a2, kInterpreterBytecodeOffsetRegister);
   __ sw(a2, MemOperand(fp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
 
   Generate_InterpreterEnterBytecode(masm);
+
+  // We should never take the if_return path.
+  __ bind(&if_return);
+  __ Abort(AbortReason::kInvalidBytecodeAdvance);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CheckOptimizationMarker(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : argument count (preserved for callee)
-  //  -- a3 : new target (preserved for callee)
-  //  -- a1 : target function (preserved for callee)
-  // -----------------------------------
-  Register closure = a1;
-
-  // Get the feedback vector.
-  Register feedback_vector = a2;
-  __ lw(feedback_vector,
-        FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
-  __ lw(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
-
-  // The feedback vector must be defined.
-  if (FLAG_debug_code) {
-    __ LoadRoot(at, Heap::kUndefinedValueRootIndex);
-    __ Assert(ne, AbortReason::kExpectedFeedbackVector, feedback_vector,
-              Operand(at));
-  }
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, t0, t3, t1);
-
-  // Otherwise, tail call the SFI code.
-  GenerateTailCallToSharedCode(masm);
-}
-
 void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to the trampoline to the
-  // interpreter entry.
-  __ lw(a2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-  __ lw(a2, FieldMemOperand(a2, SharedFunctionInfo::kCodeOffset));
+  // Set the code slot inside the JSFunction to CompileLazy.
+  __ Move(a2, BUILTIN_CODE(masm->isolate(), CompileLazy));
   __ sw(a2, FieldMemOperand(a1, JSFunction::kCodeOffset));
   __ RecordWriteField(a1, JSFunction::kCodeOffset, a2, t0, kRAHasNotBeenSaved,
                       kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
@@ -1295,6 +1261,68 @@ void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
   Generate_CompileLazy(masm);
 }
 
+static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
+                                      Register scratch1) {
+  // Figure out the SFI's code object.
+  Label done;
+  Label check_is_bytecode_array;
+  Label check_is_code;
+  Label check_is_fixed_array;
+  Label check_is_pre_parsed_scope_data;
+  Label check_is_function_template_info;
+
+  Register data_type = scratch1;
+
+  // IsSmi: Is builtin
+  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
+  __ li(scratch1,
+        Operand(ExternalReference::builtins_address(masm->isolate())));
+  // Avoid untagging the Smi.
+  STATIC_ASSERT(kPointerSizeLog2 > kSmiTagSize);
+  STATIC_ASSERT(kSmiShiftSize == 0);
+  __ Lsa(scratch1, scratch1, sfi_data, kPointerSizeLog2 - kSmiTagSize);
+  __ lw(sfi_data, MemOperand(scratch1));
+  __ Branch(&done);
+
+  // Get map for subsequent checks.
+  __ bind(&check_is_bytecode_array);
+  __ lw(data_type, FieldMemOperand(sfi_data, HeapObject::kMapOffset));
+  __ lhu(data_type, FieldMemOperand(data_type, Map::kInstanceTypeOffset));
+
+  // IsBytecodeArray: Interpret bytecode
+  __ Branch(&check_is_code, ne, data_type, Operand(BYTECODE_ARRAY_TYPE));
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
+  __ Branch(&done);
+
+  // IsCode: Run code
+  __ bind(&check_is_code);
+  __ Branch(&done, eq, data_type, Operand(CODE_TYPE));
+
+  // IsFixedArray: Instantiate using AsmWasmData,
+  __ bind(&check_is_fixed_array);
+  __ Branch(&check_is_pre_parsed_scope_data, ne, data_type,
+            Operand(FIXED_ARRAY_TYPE));
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
+  __ Branch(&done);
+
+  // IsPreParsedScopeData: Compile lazy
+  __ bind(&check_is_pre_parsed_scope_data);
+  __ Branch(&check_is_function_template_info, ne, data_type,
+            Operand(TUPLE2_TYPE));
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
+  __ Branch(&done);
+
+  // IsFunctionTemplateInfo: API call
+  __ bind(&check_is_function_template_info);
+  if (FLAG_debug_code) {
+    __ Assert(eq, AbortReason::kInvalidSharedFunctionInfoData, data_type,
+              Operand(FUNCTION_TEMPLATE_INFO_TYPE));
+  }
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
+
+  __ bind(&done);
+}
+
 void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- a0 : argument count (preserved for callee)
@@ -1309,7 +1337,7 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
 
   // Do we have a valid feedback vector?
   __ lw(feedback_vector,
-        FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
+        FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
   __ lw(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
   __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
                 &gotta_call_runtime);
@@ -1317,12 +1345,13 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // Is there an optimization marker or optimized code in the feedback vector?
   MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, t0, t3, t1);
 
-  // We found no optimized code.
+  // We found no optimized code. Infer the code object needed for the SFI.
   Register entry = t0;
   __ lw(entry, FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
+  __ lw(entry, FieldMemOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
+  GetSharedFunctionInfoCode(masm, entry, t1);
 
-  // If SFI points to anything other than CompileLazy, install that.
-  __ lw(entry, FieldMemOperand(entry, SharedFunctionInfo::kCodeOffset));
+  // If code entry points to anything other than CompileLazy, install that.
   __ Move(t1, masm->CodeObject());
   __ Branch(&gotta_call_runtime, eq, entry, Operand(t1));
 
@@ -1390,25 +1419,9 @@ void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
 
   {
     // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over. First to the shared function info.
+    // we simply need to copy it over to the target function.
 
     Register target_builtin = scratch1;
-    Register shared = scratch0;
-
-    __ lw(shared,
-          FieldMemOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-    CHECK(t1 != target && t1 != scratch0 && t1 != scratch1);
-    CHECK(t3 != target && t3 != scratch0 && t3 != scratch1);
-
-    __ sw(target_builtin,
-          FieldMemOperand(shared, SharedFunctionInfo::kCodeOffset));
-    __ mov(t3, target_builtin);  // Write barrier clobbers t3 below.
-    __ RecordWriteField(shared, SharedFunctionInfo::kCodeOffset, t3, t1,
-                        kRAHasNotBeenSaved, kDontSaveFPRegs,
-                        OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-
-    // And second to the target function.
 
     __ sw(target_builtin, FieldMemOperand(target, JSFunction::kCodeOffset));
     __ mov(t3, target_builtin);  // Write barrier clobbers t3 below.
@@ -1484,8 +1497,10 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   }
   // On failure, tail call back to regular js by re-calling the function
   // which has be reset to the compile lazy builtin.
-  __ lw(t0, FieldMemOperand(a1, JSFunction::kCodeOffset));
-  __ Jump(t0, Code::kHeaderSize - kHeapObjectTag);
+  static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
+  __ lw(a2, FieldMemOperand(a1, JSFunction::kCodeOffset));
+  __ Addu(a2, a2, Code::kHeaderSize - kHeapObjectTag);
+  __ Jump(a2);
 }
 
 namespace {
@@ -1983,8 +1998,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   // Check that the function is not a "classConstructor".
   Label class_constructor;
   __ lw(a2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-  __ lw(a3, FieldMemOperand(a2, SharedFunctionInfo::kCompilerHintsOffset));
-  __ And(at, a3, Operand(SharedFunctionInfo::kClassConstructorMask));
+  __ lw(a3, FieldMemOperand(a2, SharedFunctionInfo::kFlagsOffset));
+  __ And(at, a3, Operand(SharedFunctionInfo::IsClassConstructorBit::kMask));
   __ Branch(&class_constructor, ne, at, Operand(zero_reg));
 
   // Enter the context of the function; ToObject has to run in the function
@@ -1993,7 +2008,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   __ lw(cp, FieldMemOperand(a1, JSFunction::kContextOffset));
   // We need to convert the receiver for non-native sloppy mode functions.
   Label done_convert;
-  __ lw(a3, FieldMemOperand(a2, SharedFunctionInfo::kCompilerHintsOffset));
+  __ lw(a3, FieldMemOperand(a2, SharedFunctionInfo::kFlagsOffset));
   __ And(at, a3,
          Operand(SharedFunctionInfo::IsNativeBit::kMask |
                  SharedFunctionInfo::IsStrictBit::kMask));
@@ -2215,6 +2230,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
   //  -- a1 : the constructor to call (checked to be a JSFunction)
   //  -- a3 : the new target (checked to be a constructor)
   // -----------------------------------
+  __ AssertConstructor(a1);
   __ AssertFunction(a1);
 
   // Calling convention for function specific ConstructStubs require
@@ -2235,6 +2251,7 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
   //  -- a1 : the function to call (checked to be a JSBoundFunction)
   //  -- a3 : the new target (checked to be a constructor)
   // -----------------------------------
+  __ AssertConstructor(a1);
   __ AssertBoundFunction(a1);
 
   // Load [[BoundArguments]] into a2 and length of that into t0.
@@ -2329,16 +2346,17 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   Label non_constructor, non_proxy;
   __ JumpIfSmi(a1, &non_constructor);
 
-  // Dispatch based on instance type.
-  __ GetObjectType(a1, t1, t2);
-  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructFunction),
-          RelocInfo::CODE_TARGET, eq, t2, Operand(JS_FUNCTION_TYPE));
-
   // Check if target has a [[Construct]] internal method.
+  __ lw(t1, FieldMemOperand(a1, HeapObject::kMapOffset));
   __ lbu(t3, FieldMemOperand(t1, Map::kBitFieldOffset));
   __ And(t3, t3, Operand(Map::IsConstructorBit::kMask));
   __ Branch(&non_constructor, eq, t3, Operand(zero_reg));
 
+  // Dispatch based on instance type.
+  __ lhu(t2, FieldMemOperand(t1, Map::kInstanceTypeOffset));
+  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructFunction),
+          RelocInfo::CODE_TARGET, eq, t2, Operand(JS_FUNCTION_TYPE));
+
   // Only dispatch to bound functions after checking whether they are
   // constructors.
   __ Jump(BUILTIN_CODE(masm->isolate(), ConstructBoundFunction),
@@ -2510,8 +2528,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // a0 : expected number of arguments
   // a1 : function (passed through to callee)
   // a3 : new target (passed through to callee)
-  __ lw(t0, FieldMemOperand(a1, JSFunction::kCodeOffset));
-  __ Call(t0, Code::kHeaderSize - kHeapObjectTag);
+  static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
+  __ lw(a2, FieldMemOperand(a1, JSFunction::kCodeOffset));
+  __ Addu(a2, a2, Code::kHeaderSize - kHeapObjectTag);
+  __ Call(a2);
 
   // Store offset of return address for deoptimizer.
   masm->isolate()->heap()->SetArgumentsAdaptorDeoptPCOffset(masm->pc_offset());
@@ -2524,8 +2544,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // Don't adapt arguments.
   // -------------------------------------------
   __ bind(&dont_adapt_arguments);
-  __ lw(t0, FieldMemOperand(a1, JSFunction::kCodeOffset));
-  __ Jump(t0, Code::kHeaderSize - kHeapObjectTag);
+  static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
+  __ lw(a2, FieldMemOperand(a1, JSFunction::kCodeOffset));
+  __ Addu(a2, a2, Code::kHeaderSize - kHeapObjectTag);
+  __ Jump(a2);
 
   __ bind(&stack_overflow);
   {
diff --git a/deps/v8/src/builtins/mips64/OWNERS b/deps/v8/src/builtins/mips64/OWNERS
index 978563cab5e..4ce9d7f91da 100644
--- a/deps/v8/src/builtins/mips64/OWNERS
+++ b/deps/v8/src/builtins/mips64/OWNERS
@@ -1,2 +1,3 @@
 ivica.bogosavljevic@mips.com
 Miran.Karic@mips.com
+sreten.kovacevic@mips.com
\ No newline at end of file
diff --git a/deps/v8/src/builtins/mips64/builtins-mips64.cc b/deps/v8/src/builtins/mips64/builtins-mips64.cc
index 266393070c7..04fa89a14d2 100644
--- a/deps/v8/src/builtins/mips64/builtins-mips64.cc
+++ b/deps/v8/src/builtins/mips64/builtins-mips64.cc
@@ -82,19 +82,6 @@ void Builtins::Generate_AdaptorWithBuiltinExitFrame(MacroAssembler* masm) {
   AdaptorWithExitFrameType(masm, BUILTIN_EXIT);
 }
 
-// Load the built-in InternalArray function from the current context.
-static void GenerateLoadInternalArrayFunction(MacroAssembler* masm,
-                                              Register result) {
-  // Load the InternalArray function from the native context.
-  __ LoadNativeContextSlot(Context::INTERNAL_ARRAY_FUNCTION_INDEX, result);
-}
-
-// Load the built-in Array function from the current context.
-static void GenerateLoadArrayFunction(MacroAssembler* masm, Register result) {
-  // Load the Array function from the native context.
-  __ LoadNativeContextSlot(Context::ARRAY_FUNCTION_INDEX, result);
-}
-
 void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- a0     : number of arguments
@@ -103,9 +90,6 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // -----------------------------------
   Label generic_array_code, one_or_more_arguments, two_or_more_arguments;
 
-  // Get the InternalArray function.
-  GenerateLoadInternalArrayFunction(masm, a1);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin InternalArray functions should be maps.
     __ Ld(a2, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
@@ -120,6 +104,7 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // Run the native code for the InternalArray function called as a normal
   // function.
   // Tail call a stub.
+  __ LoadRoot(a2, Heap::kUndefinedValueRootIndex);
   InternalArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
@@ -127,40 +112,37 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
 void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- a0     : number of arguments
+  //  -- a1     : array function
   //  -- ra     : return address
   //  -- sp[...]: constructor arguments
   // -----------------------------------
   Label generic_array_code;
 
-  // Get the Array function.
-  GenerateLoadArrayFunction(masm, a1);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin Array functions should be maps.
     __ Ld(a2, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
     __ SmiTst(a2, a4);
     __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction1, a4,
               Operand(zero_reg));
-    __ GetObjectType(a2, a3, a4);
+    __ GetObjectType(a2, t0, a4);
     __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction2, a4,
               Operand(MAP_TYPE));
   }
 
-  // Run the native code for the Array function called as a normal function.
-  // Tail call a stub.
-  __ mov(a3, a1);
+  // a2 is the AllocationSite - here undefined.
   __ LoadRoot(a2, Heap::kUndefinedValueRootIndex);
+  // If a3 (new target) is undefined, then this is the 'Call' case, so move
+  // a1 (the constructor) to a3.
+  Label call;
+  __ Branch(&call, ne, a3, Operand(a2));
+  __ mov(a3, a1);
+
+  // Run the native code for the Array function called as a normal function.
+  __ bind(&call);
   ArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
 
-static void GenerateTailCallToSharedCode(MacroAssembler* masm) {
-  __ Ld(a2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-  __ Ld(a2, FieldMemOperand(a2, SharedFunctionInfo::kCodeOffset));
-  __ Daddu(at, a2, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(at);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -181,8 +163,9 @@ static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
     __ SmiUntag(a0);
   }
 
-  __ Daddu(at, v0, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(at);
+  static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
+  __ Daddu(a2, v0, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ Jump(a2);
 }
 
 namespace {
@@ -286,8 +269,8 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // -----------------------------------
 
     __ Ld(t2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-    __ lwu(t2, FieldMemOperand(t2, SharedFunctionInfo::kCompilerHintsOffset));
-    __ And(t2, t2, Operand(SharedFunctionInfo::kDerivedConstructorMask));
+    __ lwu(t2, FieldMemOperand(t2, SharedFunctionInfo::kFlagsOffset));
+    __ And(t2, t2, Operand(SharedFunctionInfo::IsDerivedConstructorBit::kMask));
     __ Branch(&not_create_implicit_receiver, ne, t2, Operand(zero_reg));
 
     // If not derived class constructor: Allocate the new receiver object.
@@ -407,8 +390,8 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     __ bind(&other_result);
     __ Ld(a1, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
     __ Ld(t2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-    __ lwu(t2, FieldMemOperand(t2, SharedFunctionInfo::kCompilerHintsOffset));
-    __ And(t2, t2, Operand(SharedFunctionInfo::kClassConstructorMask));
+    __ lwu(t2, FieldMemOperand(t2, SharedFunctionInfo::kFlagsOffset));
+    __ And(t2, t2, Operand(SharedFunctionInfo::IsClassConstructorBit::kMask));
 
     if (restrict_constructor_return) {
       // Throw if constructor function is a class constructor
@@ -547,6 +530,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
     // undefined because generator functions are non-constructable.
     __ Move(a3, a1);
     __ Move(a1, a4);
+    static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
     __ Ld(a2, FieldMemOperand(a1, JSFunction::kCodeOffset));
     __ Daddu(a2, a2, Operand(Code::kHeaderSize - kHeapObjectTag));
     __ Jump(a2);
@@ -739,7 +723,7 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   DCHECK(
       !AreAliased(feedback_vector, a0, a1, a3, scratch1, scratch2, scratch3));
 
-  Label optimized_code_slot_is_cell, fallthrough;
+  Label optimized_code_slot_is_weak_ref, fallthrough;
 
   Register closure = a1;
   Register optimized_code_entry = scratch1;
@@ -748,9 +732,9 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
         FieldMemOperand(feedback_vector, FeedbackVector::kOptimizedCodeOffset));
 
   // Check if the code entry is a Smi. If yes, we interpret it as an
-  // optimisation marker. Otherwise, interpret is as a weak cell to a code
+  // optimisation marker. Otherwise, interpret it as a weak reference to a code
   // object.
-  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_cell);
+  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_weak_ref);
 
   {
     // Optimized code slot is a Smi optimization marker.
@@ -784,12 +768,10 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   }
 
   {
-    // Optimized code slot is a WeakCell.
-    __ bind(&optimized_code_slot_is_cell);
+    // Optimized code slot is a weak reference.
+    __ bind(&optimized_code_slot_is_weak_ref);
 
-    __ Ld(optimized_code_entry,
-          FieldMemOperand(optimized_code_entry, WeakCell::kValueOffset));
-    __ JumpIfSmi(optimized_code_entry, &fallthrough);
+    __ LoadWeakValue(optimized_code_entry, optimized_code_entry, &fallthrough);
 
     // Check if the optimized code is marked for deopt. If it is, call the
     // runtime to clear it.
@@ -806,9 +788,11 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
     // register.
     ReplaceClosureCodeWithOptimizedCode(masm, optimized_code_entry, closure,
                                         scratch2, scratch3, feedback_vector);
-    __ Daddu(optimized_code_entry, optimized_code_entry,
+
+    static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
+    __ Daddu(a2, optimized_code_entry,
              Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ Jump(optimized_code_entry);
+    __ Jump(a2);
 
     // Optimized code slot contains deoptimized code, evict it and re-enter the
     // losure's code.
@@ -822,10 +806,13 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
 }
 
 // Advance the current bytecode offset. This simulates what all bytecode
-// handlers do upon completion of the underlying operation.
-static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
-                                  Register bytecode_offset, Register bytecode,
-                                  Register scratch1, Register scratch2) {
+// handlers do upon completion of the underlying operation. Will bail out to a
+// label if the bytecode (without prefix) is a return bytecode.
+static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
+                                          Register bytecode_array,
+                                          Register bytecode_offset,
+                                          Register bytecode, Register scratch1,
+                                          Register scratch2, Label* if_return) {
   Register bytecode_size_table = scratch1;
   DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
                      bytecode));
@@ -834,10 +821,10 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
       Operand(ExternalReference::bytecode_size_table_address(masm->isolate())));
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
-  Label load_size, extra_wide;
+  Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
-  __ Branch(&load_size, hi, bytecode, Operand(1));
+  __ Branch(&process_bytecode, hi, bytecode, Operand(1));
   __ Branch(&extra_wide, eq, bytecode, Operand(1));
 
   // Load the next bytecode and update table to the wide scaled table.
@@ -846,7 +833,7 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
   __ Lbu(bytecode, MemOperand(scratch2));
   __ Daddu(bytecode_size_table, bytecode_size_table,
            Operand(kIntSize * interpreter::Bytecodes::kBytecodeCount));
-  __ jmp(&load_size);
+  __ jmp(&process_bytecode);
 
   __ bind(&extra_wide);
   // Load the next bytecode and update table to the extra wide scaled table.
@@ -856,8 +843,16 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
   __ Daddu(bytecode_size_table, bytecode_size_table,
            Operand(2 * kIntSize * interpreter::Bytecodes::kBytecodeCount));
 
-  // Load the size of the current bytecode.
-  __ bind(&load_size);
+  __ bind(&process_bytecode);
+
+// Bailout to the return label if this is a return bytecode.
+#define JUMP_IF_EQUAL(NAME)          \
+  __ Branch(if_return, eq, bytecode, \
+            Operand(static_cast<int>(interpreter::Bytecode::k##NAME)));
+  RETURN_BYTECODE_LIST(JUMP_IF_EQUAL)
+#undef JUMP_IF_EQUAL
+
+  // Otherwise, load the size of the current bytecode and advance the offset.
   __ Dlsa(scratch2, bytecode_size_table, bytecode, 2);
   __ Lw(scratch2, MemOperand(scratch2));
   __ Daddu(bytecode_offset, bytecode_offset, scratch2);
@@ -886,7 +881,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
 
   // Load the feedback vector from the closure.
   __ Ld(feedback_vector,
-        FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
+        FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
   __ Ld(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
   // Read off the optimized code slot in the feedback vector, and if there
   // is optimized code or an optimization marker, call that instead.
@@ -992,10 +987,10 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
             masm->isolate())));
   __ Daddu(a0, kInterpreterBytecodeArrayRegister,
            kInterpreterBytecodeOffsetRegister);
-  __ Lbu(a0, MemOperand(a0));
-  __ Dlsa(at, kInterpreterDispatchTableRegister, a0, kPointerSizeLog2);
-  __ Ld(at, MemOperand(at));
-  __ Call(at);
+  __ Lbu(a7, MemOperand(a0));
+  __ Dlsa(at, kInterpreterDispatchTableRegister, a7, kPointerSizeLog2);
+  __ Ld(kJavaScriptCallCodeStartRegister, MemOperand(at));
+  __ Call(kJavaScriptCallCodeStartRegister);
   masm->isolate()->heap()->SetInterpreterEntryReturnPCOffset(masm->pc_offset());
 
   // Any returns to the entry trampoline are either due to the return bytecode
@@ -1008,17 +1003,14 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
         MemOperand(fp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
   __ SmiUntag(kInterpreterBytecodeOffsetRegister);
 
-  // Check if we should return.
+  // Either return, or advance to the next bytecode and dispatch.
   Label do_return;
   __ Daddu(a1, kInterpreterBytecodeArrayRegister,
            kInterpreterBytecodeOffsetRegister);
   __ Lbu(a1, MemOperand(a1));
-  __ Branch(&do_return, eq, a1,
-            Operand(static_cast<int>(interpreter::Bytecode::kReturn)));
-
-  // Advance to the next bytecode and dispatch.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, a1, a2, a3);
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, a1, a2, a3,
+                                &do_return);
   __ jmp(&do_dispatch);
 
   __ bind(&do_return);
@@ -1078,6 +1070,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
 void Builtins::Generate_InterpreterPushArgsThenCallImpl(
     MacroAssembler* masm, ConvertReceiverMode receiver_mode,
     InterpreterPushArgsMode mode) {
+  DCHECK(mode != InterpreterPushArgsMode::kArrayFunction);
   // ----------- S t a t e -------------
   //  -- a0 : the number of arguments (not including the receiver)
   //  -- a2 : the address of the first argument to be pushed. Subsequent
@@ -1106,11 +1099,7 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
   }
 
   // Call the target.
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
-    __ Jump(
-        masm->isolate()->builtins()->CallFunction(ConvertReceiverMode::kAny),
-        RelocInfo::CODE_TARGET);
-  } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     __ Jump(BUILTIN_CODE(masm->isolate(), CallWithSpread),
             RelocInfo::CODE_TARGET);
   } else {
@@ -1153,15 +1142,13 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
     __ AssertUndefinedOrAllocationSite(a2, t0);
   }
 
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
+  if (mode == InterpreterPushArgsMode::kArrayFunction) {
     __ AssertFunction(a1);
 
     // Tail call to the function-specific construct stub (still in the caller
     // context at this point).
-    __ Ld(a4, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-    __ Ld(a4, FieldMemOperand(a4, SharedFunctionInfo::kConstructStubOffset));
-    __ Daddu(at, a4, Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ Jump(at);
+    ArrayConstructorStub array_constructor_stub(masm->isolate());
+    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor with a0, a1, and a3 unmodified.
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1219,10 +1206,10 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   // Dispatch to the target bytecode.
   __ Daddu(a1, kInterpreterBytecodeArrayRegister,
            kInterpreterBytecodeOffsetRegister);
-  __ Lbu(a1, MemOperand(a1));
-  __ Dlsa(a1, kInterpreterDispatchTableRegister, a1, kPointerSizeLog2);
-  __ Ld(a1, MemOperand(a1));
-  __ Jump(a1);
+  __ Lbu(a7, MemOperand(a1));
+  __ Dlsa(a1, kInterpreterDispatchTableRegister, a7, kPointerSizeLog2);
+  __ Ld(kJavaScriptCallCodeStartRegister, MemOperand(a1));
+  __ Jump(kJavaScriptCallCodeStartRegister);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
@@ -1241,53 +1228,29 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
   __ Lbu(a1, MemOperand(a1));
 
   // Advance to the next bytecode.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, a1, a2, a3);
+  Label if_return;
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, a1, a2, a3,
+                                &if_return);
 
   // Convert new bytecode offset to a Smi and save in the stackframe.
   __ SmiTag(a2, kInterpreterBytecodeOffsetRegister);
   __ Sd(a2, MemOperand(fp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
 
   Generate_InterpreterEnterBytecode(masm);
+
+  // We should never take the if_return path.
+  __ bind(&if_return);
+  __ Abort(AbortReason::kInvalidBytecodeAdvance);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CheckOptimizationMarker(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : argument count (preserved for callee)
-  //  -- a3 : new target (preserved for callee)
-  //  -- a1 : target function (preserved for callee)
-  // -----------------------------------
-  Register closure = a1;
-
-  // Get the feedback vector.
-  Register feedback_vector = a2;
-  __ Ld(feedback_vector,
-        FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
-  __ Ld(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
-
-  // The feedback vector must be defined.
-  if (FLAG_debug_code) {
-    __ LoadRoot(at, Heap::kUndefinedValueRootIndex);
-    __ Assert(ne, AbortReason::kExpectedFeedbackVector, feedback_vector,
-              Operand(at));
-  }
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, a4, t3, a5);
-
-  // Otherwise, tail call the SFI code.
-  GenerateTailCallToSharedCode(masm);
-}
-
 void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to the trampoline to the
-  // interpreter entry.
-  __ Ld(a2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-  __ Ld(a2, FieldMemOperand(a2, SharedFunctionInfo::kCodeOffset));
+  // Set the code slot inside the JSFunction to CompileLazy.
+  __ Move(a2, BUILTIN_CODE(masm->isolate(), CompileLazy));
   __ Sd(a2, FieldMemOperand(a1, JSFunction::kCodeOffset));
   __ RecordWriteField(a1, JSFunction::kCodeOffset, a2, a4, kRAHasNotBeenSaved,
                       kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
@@ -1295,6 +1258,68 @@ void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
   Generate_CompileLazy(masm);
 }
 
+static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
+                                      Register scratch1) {
+  // Figure out the SFI's code object.
+  Label done;
+  Label check_is_bytecode_array;
+  Label check_is_code;
+  Label check_is_fixed_array;
+  Label check_is_pre_parsed_scope_data;
+  Label check_is_function_template_info;
+
+  Register data_type = scratch1;
+
+  // IsSmi: Is builtin
+  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
+  __ li(scratch1,
+        Operand(ExternalReference::builtins_address(masm->isolate())));
+  // Avoid untagging the Smi by merging the shift
+  STATIC_ASSERT(kPointerSizeLog2 < kSmiShift);
+  __ dsrl(sfi_data, sfi_data, kSmiShift - kPointerSizeLog2);
+  __ Daddu(scratch1, scratch1, sfi_data);
+  __ Ld(sfi_data, MemOperand(scratch1));
+  __ Branch(&done);
+
+  // Get map for subsequent checks.
+  __ bind(&check_is_bytecode_array);
+  __ Ld(data_type, FieldMemOperand(sfi_data, HeapObject::kMapOffset));
+  __ Lhu(data_type, FieldMemOperand(data_type, Map::kInstanceTypeOffset));
+
+  // IsBytecodeArray: Interpret bytecode
+  __ Branch(&check_is_code, ne, data_type, Operand(BYTECODE_ARRAY_TYPE));
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
+  __ Branch(&done);
+
+  // IsCode: Run code
+  __ bind(&check_is_code);
+  __ Branch(&done, eq, data_type, Operand(CODE_TYPE));
+
+  // IsFixedArray: Instantiate using AsmWasmData,
+  __ bind(&check_is_fixed_array);
+  __ Branch(&check_is_pre_parsed_scope_data, ne, data_type,
+            Operand(FIXED_ARRAY_TYPE));
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
+  __ Branch(&done);
+
+  // IsPreParsedScopeData: Compile lazy
+  __ bind(&check_is_pre_parsed_scope_data);
+  __ Branch(&check_is_function_template_info, ne, data_type,
+            Operand(TUPLE2_TYPE));
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
+  __ Branch(&done);
+
+  // IsFunctionTemplateInfo: API call
+  __ bind(&check_is_function_template_info);
+  if (FLAG_debug_code) {
+    __ Assert(eq, AbortReason::kInvalidSharedFunctionInfoData, data_type,
+              Operand(FUNCTION_TEMPLATE_INFO_TYPE));
+  }
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
+
+  __ bind(&done);
+}
+
 void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- a0 : argument count (preserved for callee)
@@ -1309,7 +1334,7 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
 
   // Do we have a valid feedback vector?
   __ Ld(feedback_vector,
-        FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
+        FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
   __ Ld(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
   __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
                 &gotta_call_runtime);
@@ -1317,12 +1342,12 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // Is there an optimization marker or optimized code in the feedback vector?
   MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, a4, t3, a5);
 
-  // We found no optimized code.
+  // We found no optimized code. Infer the code object needed for the SFI.
   Register entry = a4;
   __ Ld(entry, FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
+  __ Ld(entry, FieldMemOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
+  GetSharedFunctionInfoCode(masm, entry, t1);
 
-  // If SFI points to anything other than CompileLazy, install that.
-  __ Ld(entry, FieldMemOperand(entry, SharedFunctionInfo::kCodeOffset));
   __ Move(t1, masm->CodeObject());
   __ Branch(&gotta_call_runtime, eq, entry, Operand(t1));
 
@@ -1391,25 +1416,9 @@ void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
 
   {
     // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over. First to the shared function info.
+    // we simply need to copy it over to the target function.
 
     Register target_builtin = scratch1;
-    Register shared = scratch0;
-
-    __ Ld(shared,
-          FieldMemOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-    CHECK(t1 != target && t1 != scratch0 && t1 != scratch1);
-    CHECK(t3 != target && t3 != scratch0 && t3 != scratch1);
-
-    __ Sd(target_builtin,
-          FieldMemOperand(shared, SharedFunctionInfo::kCodeOffset));
-    __ mov(t3, target_builtin);  // Write barrier clobbers t3 below.
-    __ RecordWriteField(shared, SharedFunctionInfo::kCodeOffset, t3, t1,
-                        kRAHasNotBeenSaved, kDontSaveFPRegs,
-                        OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-
-    // And second to the target function.
 
     __ Sd(target_builtin, FieldMemOperand(target, JSFunction::kCodeOffset));
     __ mov(t3, target_builtin);  // Write barrier clobbers t3 below.
@@ -1486,9 +1495,10 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   }
   // On failure, tail call back to regular js by re-calling the function
   // which has be reset to the compile lazy builtin.
-  __ Ld(t0, FieldMemOperand(a1, JSFunction::kCodeOffset));
-  __ Daddu(t0, t0, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(t0);
+  static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
+  __ Ld(a2, FieldMemOperand(a1, JSFunction::kCodeOffset));
+  __ Daddu(a2, a2, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ Jump(a2);
 }
 
 namespace {
@@ -1624,6 +1634,7 @@ void Builtins::Generate_FunctionPrototypeApply(MacroAssembler* masm) {
   Register scratch = a4;
 
   __ LoadRoot(undefined_value, Heap::kUndefinedValueRootIndex);
+
   // 1. Load receiver into a1, argArray into a2 (if present), remove all
   // arguments from the stack (including the receiver), and push thisArg (if
   // present) instead.
@@ -1732,6 +1743,7 @@ void Builtins::Generate_ReflectApply(MacroAssembler* masm) {
   Register scratch = a4;
 
   __ LoadRoot(undefined_value, Heap::kUndefinedValueRootIndex);
+
   // 1. Load target into a1 (if present), argumentsList into a2 (if present),
   // remove all arguments from the stack (including the receiver), and push
   // thisArgument (if present) instead.
@@ -1786,6 +1798,8 @@ void Builtins::Generate_ReflectConstruct(MacroAssembler* masm) {
   Register undefined_value = a4;
   Register scratch = a5;
 
+  __ LoadRoot(undefined_value, Heap::kUndefinedValueRootIndex);
+
   // 1. Load target into a1 (if present), argumentsList into a2 (if present),
   // new.target into a3 (if present, otherwise use target), remove all
   // arguments from the stack (including the receiver), and push thisArgument
@@ -2007,8 +2021,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   // Check that function is not a "classConstructor".
   Label class_constructor;
   __ Ld(a2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-  __ Lwu(a3, FieldMemOperand(a2, SharedFunctionInfo::kCompilerHintsOffset));
-  __ And(at, a3, Operand(SharedFunctionInfo::kClassConstructorMask));
+  __ Lwu(a3, FieldMemOperand(a2, SharedFunctionInfo::kFlagsOffset));
+  __ And(at, a3, Operand(SharedFunctionInfo::IsClassConstructorBit::kMask));
   __ Branch(&class_constructor, ne, at, Operand(zero_reg));
 
   // Enter the context of the function; ToObject has to run in the function
@@ -2017,7 +2031,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   __ Ld(cp, FieldMemOperand(a1, JSFunction::kContextOffset));
   // We need to convert the receiver for non-native sloppy mode functions.
   Label done_convert;
-  __ Lwu(a3, FieldMemOperand(a2, SharedFunctionInfo::kCompilerHintsOffset));
+  __ Lwu(a3, FieldMemOperand(a2, SharedFunctionInfo::kFlagsOffset));
   __ And(at, a3,
          Operand(SharedFunctionInfo::IsNativeBit::kMask |
                  SharedFunctionInfo::IsStrictBit::kMask));
@@ -2235,6 +2249,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
   //  -- a1 : the constructor to call (checked to be a JSFunction)
   //  -- a3 : the new target (checked to be a constructor)
   // -----------------------------------
+  __ AssertConstructor(a1);
   __ AssertFunction(a1);
 
   // Calling convention for function specific ConstructStubs require
@@ -2256,6 +2271,7 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
   //  -- a1 : the function to call (checked to be a JSBoundFunction)
   //  -- a3 : the new target (checked to be a constructor)
   // -----------------------------------
+  __ AssertConstructor(a1);
   __ AssertBoundFunction(a1);
 
   // Load [[BoundArguments]] into a2 and length of that into a4.
@@ -2348,16 +2364,17 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   Label non_constructor, non_proxy;
   __ JumpIfSmi(a1, &non_constructor);
 
-  // Dispatch based on instance type.
-  __ GetObjectType(a1, t1, t2);
-  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructFunction),
-          RelocInfo::CODE_TARGET, eq, t2, Operand(JS_FUNCTION_TYPE));
-
   // Check if target has a [[Construct]] internal method.
+  __ ld(t1, FieldMemOperand(a1, HeapObject::kMapOffset));
   __ Lbu(t3, FieldMemOperand(t1, Map::kBitFieldOffset));
   __ And(t3, t3, Operand(Map::IsConstructorBit::kMask));
   __ Branch(&non_constructor, eq, t3, Operand(zero_reg));
 
+  // Dispatch based on instance type.
+  __ Lhu(t2, FieldMemOperand(t1, Map::kInstanceTypeOffset));
+  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructFunction),
+          RelocInfo::CODE_TARGET, eq, t2, Operand(JS_FUNCTION_TYPE));
+
   // Only dispatch to bound functions after checking whether they are
   // constructors.
   __ Jump(BUILTIN_CODE(masm->isolate(), ConstructBoundFunction),
@@ -2531,9 +2548,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // a0 : expected number of arguments
   // a1 : function (passed through to callee)
   // a3: new target (passed through to callee)
-  __ Ld(a4, FieldMemOperand(a1, JSFunction::kCodeOffset));
-  __ Daddu(a4, a4, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Call(a4);
+  static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
+  __ Ld(a2, FieldMemOperand(a1, JSFunction::kCodeOffset));
+  __ Daddu(a2, a2, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ Call(a2);
 
   // Store offset of return address for deoptimizer.
   masm->isolate()->heap()->SetArgumentsAdaptorDeoptPCOffset(masm->pc_offset());
@@ -2546,9 +2564,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // Don't adapt arguments.
   // -------------------------------------------
   __ bind(&dont_adapt_arguments);
-  __ Ld(a4, FieldMemOperand(a1, JSFunction::kCodeOffset));
-  __ Daddu(a4, a4, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(a4);
+  static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
+  __ Ld(a2, FieldMemOperand(a1, JSFunction::kCodeOffset));
+  __ Daddu(a2, a2, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ Jump(a2);
 
   __ bind(&stack_overflow);
   {
diff --git a/deps/v8/src/builtins/ppc/builtins-ppc.cc b/deps/v8/src/builtins/ppc/builtins-ppc.cc
index 34da70ff0f3..f9834e45769 100644
--- a/deps/v8/src/builtins/ppc/builtins-ppc.cc
+++ b/deps/v8/src/builtins/ppc/builtins-ppc.cc
@@ -81,19 +81,6 @@ void Builtins::Generate_AdaptorWithBuiltinExitFrame(MacroAssembler* masm) {
   AdaptorWithExitFrameType(masm, BUILTIN_EXIT);
 }
 
-// Load the built-in InternalArray function from the current context.
-static void GenerateLoadInternalArrayFunction(MacroAssembler* masm,
-                                              Register result) {
-  // Load the InternalArray function from the current native context.
-  __ LoadNativeContextSlot(Context::INTERNAL_ARRAY_FUNCTION_INDEX, result);
-}
-
-// Load the built-in Array function from the current context.
-static void GenerateLoadArrayFunction(MacroAssembler* masm, Register result) {
-  // Load the Array function from the current native context.
-  __ LoadNativeContextSlot(Context::ARRAY_FUNCTION_INDEX, result);
-}
-
 void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r3     : number of arguments
@@ -102,9 +89,6 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // -----------------------------------
   Label generic_array_code, one_or_more_arguments, two_or_more_arguments;
 
-  // Get the InternalArray function.
-  GenerateLoadInternalArrayFunction(masm, r4);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin InternalArray functions should be maps.
     __ LoadP(r5, FieldMemOperand(r4, JSFunction::kPrototypeOrInitialMapOffset));
@@ -118,6 +102,7 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // Run the native code for the InternalArray function called as a normal
   // function.
   // tail call a stub
+  __ LoadRoot(r5, Heap::kUndefinedValueRootIndex);
   InternalArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
@@ -125,38 +110,36 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
 void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r3     : number of arguments
+  //  -- r4     : array function
   //  -- lr     : return address
   //  -- sp[...]: constructor arguments
   // -----------------------------------
   Label generic_array_code, one_or_more_arguments, two_or_more_arguments;
 
-  // Get the Array function.
-  GenerateLoadArrayFunction(masm, r4);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin Array functions should be maps.
     __ LoadP(r5, FieldMemOperand(r4, JSFunction::kPrototypeOrInitialMapOffset));
     __ TestIfSmi(r5, r0);
     __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, cr0);
-    __ CompareObjectType(r5, r6, r7, MAP_TYPE);
+    __ CompareObjectType(r5, r7, r8, MAP_TYPE);
     __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
   }
 
+  // r5 is the AllocationSite - here undefined.
+  __ LoadRoot(r5, Heap::kUndefinedValueRootIndex);
+  // If r6 (new target) is undefined, then this is the 'Call' case, so move
+  // r4 (the constructor) to r6.
+  Label call;
+  __ cmp(r6, r5);
+  __ bne(&call);
   __ mr(r6, r4);
+
   // Run the native code for the Array function called as a normal function.
-  // tail call a stub
-  __ LoadRoot(r5, Heap::kUndefinedValueRootIndex);
+  __ bind(&call);
   ArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
 
-static void GenerateTailCallToSharedCode(MacroAssembler* masm) {
-  __ LoadP(ip, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
-  __ LoadP(ip, FieldMemOperand(ip, SharedFunctionInfo::kCodeOffset));
-  __ addi(ip, ip, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ JumpToJSEntry(ip);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -179,8 +162,9 @@ static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
     __ Pop(r3, r4, r6);
     __ SmiUntag(r3);
   }
-  __ addi(ip, r5, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ JumpToJSEntry(ip);
+  static_assert(kJavaScriptCallCodeStartRegister == r5, "ABI mismatch");
+  __ addi(r5, r5, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ JumpToJSEntry(r5);
 }
 
 namespace {
@@ -292,8 +276,8 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // -----------------------------------
 
     __ LoadP(r7, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
-    __ lwz(r7, FieldMemOperand(r7, SharedFunctionInfo::kCompilerHintsOffset));
-    __ TestBitMask(r7, SharedFunctionInfo::kDerivedConstructorMask, r0);
+    __ lwz(r7, FieldMemOperand(r7, SharedFunctionInfo::kFlagsOffset));
+    __ TestBitMask(r7, SharedFunctionInfo::IsDerivedConstructorBit::kMask, r0);
     __ bne(&not_create_implicit_receiver, cr0);
 
     // If not derived class constructor: Allocate the new receiver object.
@@ -419,8 +403,8 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
       // Throw if constructor function is a class constructor
       __ LoadP(r7, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
       __ LoadP(r7, FieldMemOperand(r7, JSFunction::kSharedFunctionInfoOffset));
-      __ lwz(r7, FieldMemOperand(r7, SharedFunctionInfo::kCompilerHintsOffset));
-      __ TestBitMask(r7, SharedFunctionInfo::kClassConstructorMask, r0);
+      __ lwz(r7, FieldMemOperand(r7, SharedFunctionInfo::kFlagsOffset));
+      __ TestBitMask(r7, SharedFunctionInfo::IsClassConstructorBit::kMask, r0);
       __ beq(&use_receiver, cr0);
 
     } else {
@@ -563,9 +547,10 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
     // undefined because generator functions are non-constructable.
     __ mr(r6, r4);
     __ mr(r4, r7);
-    __ LoadP(ip, FieldMemOperand(r4, JSFunction::kCodeOffset));
-    __ addi(ip, ip, Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ JumpToJSEntry(ip);
+    static_assert(kJavaScriptCallCodeStartRegister == r5, "ABI mismatch");
+    __ LoadP(r5, FieldMemOperand(r4, JSFunction::kCodeOffset));
+    __ addi(r5, r5, Operand(Code::kHeaderSize - kHeapObjectTag));
+    __ JumpToJSEntry(r5);
   }
 
   __ bind(&prepare_step_in_if_stepping);
@@ -756,7 +741,7 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   DCHECK(
       !AreAliased(feedback_vector, r3, r4, r6, scratch1, scratch2, scratch3));
 
-  Label optimized_code_slot_is_cell, fallthrough;
+  Label optimized_code_slot_is_weak_ref, fallthrough;
 
   Register closure = r4;
   Register optimized_code_entry = scratch1;
@@ -766,9 +751,9 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
       FieldMemOperand(feedback_vector, FeedbackVector::kOptimizedCodeOffset));
 
   // Check if the code entry is a Smi. If yes, we interpret it as an
-  // optimisation marker. Otherwise, interpret is as a weak cell to a code
+  // optimisation marker. Otherwise, interpret it as a weak reference to a code
   // object.
-  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_cell);
+  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_weak_ref);
 
   {
     // Optimized code slot is a Smi optimization marker.
@@ -803,12 +788,10 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   }
 
   {
-    // Optimized code slot is a WeakCell.
-    __ bind(&optimized_code_slot_is_cell);
+    // Optimized code slot is a weak reference.
+    __ bind(&optimized_code_slot_is_weak_ref);
 
-    __ LoadP(optimized_code_entry,
-             FieldMemOperand(optimized_code_entry, WeakCell::kValueOffset));
-    __ JumpIfSmi(optimized_code_entry, &fallthrough);
+    __ LoadWeakValue(optimized_code_entry, optimized_code_entry, &fallthrough);
 
     // Check if the optimized code is marked for deopt. If it is, call the
     // runtime to clear it.
@@ -827,10 +810,10 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
     // register.
     ReplaceClosureCodeWithOptimizedCode(masm, optimized_code_entry, closure,
                                         scratch2, scratch3, feedback_vector);
-    __ addi(optimized_code_entry, optimized_code_entry,
+    static_assert(kJavaScriptCallCodeStartRegister == r5, "ABI mismatch");
+    __ addi(r5, optimized_code_entry,
             Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ mr(ip, optimized_code_entry);
-    __ Jump(optimized_code_entry);
+    __ Jump(r5);
 
     // Optimized code slot contains deoptimized code, evict it and re-enter the
     // closure's code.
@@ -844,10 +827,13 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
 }
 
 // Advance the current bytecode offset. This simulates what all bytecode
-// handlers do upon completion of the underlying operation.
-static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
-                                  Register bytecode_offset, Register bytecode,
-                                  Register scratch1) {
+// handlers do upon completion of the underlying operation. Will bail out to a
+// label if the bytecode (without prefix) is a return bytecode.
+static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
+                                          Register bytecode_array,
+                                          Register bytecode_offset,
+                                          Register bytecode, Register scratch1,
+                                          Label* if_return) {
   Register bytecode_size_table = scratch1;
   Register scratch2 = bytecode;
   DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
@@ -857,11 +843,11 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
       Operand(ExternalReference::bytecode_size_table_address(masm->isolate())));
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
-  Label load_size, extra_wide;
+  Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
   __ cmpi(bytecode, Operand(0x1));
-  __ bgt(&load_size);
+  __ bgt(&process_bytecode);
   __ beq(&extra_wide);
 
   // Load the next bytecode and update table to the wide scaled table.
@@ -869,7 +855,7 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
   __ lbzx(bytecode, MemOperand(bytecode_array, bytecode_offset));
   __ addi(bytecode_size_table, bytecode_size_table,
           Operand(kIntSize * interpreter::Bytecodes::kBytecodeCount));
-  __ b(&load_size);
+  __ b(&process_bytecode);
 
   __ bind(&extra_wide);
   // Load the next bytecode and update table to the extra wide scaled table.
@@ -879,7 +865,17 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
           Operand(2 * kIntSize * interpreter::Bytecodes::kBytecodeCount));
 
   // Load the size of the current bytecode.
-  __ bind(&load_size);
+  __ bind(&process_bytecode);
+
+// Bailout to the return label if this is a return bytecode.
+#define JUMP_IF_EQUAL(NAME)                                           \
+  __ cmpi(bytecode,                                                   \
+          Operand(static_cast<int>(interpreter::Bytecode::k##NAME))); \
+  __ beq(if_return);
+  RETURN_BYTECODE_LIST(JUMP_IF_EQUAL)
+#undef JUMP_IF_EQUAL
+
+  // Otherwise, load the size of the current bytecode and advance the offset.
   __ ShiftLeftImm(scratch2, bytecode, Operand(2));
   __ lwzx(scratch2, MemOperand(bytecode_size_table, scratch2));
   __ add(bytecode_offset, bytecode_offset, scratch2);
@@ -908,7 +904,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
 
   // Load the feedback vector from the closure.
   __ LoadP(feedback_vector,
-           FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
+           FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
   __ LoadP(feedback_vector,
            FieldMemOperand(feedback_vector, Cell::kValueOffset));
   // Read off the optimized code slot in the feedback vector, and if there
@@ -1021,11 +1017,12 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   __ mov(kInterpreterDispatchTableRegister,
          Operand(ExternalReference::interpreter_dispatch_table_address(
              masm->isolate())));
-  __ lbzx(r4, MemOperand(kInterpreterBytecodeArrayRegister,
+  __ lbzx(r6, MemOperand(kInterpreterBytecodeArrayRegister,
                          kInterpreterBytecodeOffsetRegister));
-  __ ShiftLeftImm(ip, r4, Operand(kPointerSizeLog2));
-  __ LoadPX(ip, MemOperand(kInterpreterDispatchTableRegister, ip));
-  __ Call(ip);
+  __ ShiftLeftImm(r6, r6, Operand(kPointerSizeLog2));
+  __ LoadPX(kJavaScriptCallCodeStartRegister,
+            MemOperand(kInterpreterDispatchTableRegister, r6));
+  __ Call(kJavaScriptCallCodeStartRegister);
 
   masm->isolate()->heap()->SetInterpreterEntryReturnPCOffset(masm->pc_offset());
 
@@ -1039,16 +1036,13 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
            MemOperand(fp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
   __ SmiUntag(kInterpreterBytecodeOffsetRegister);
 
-  // Check if we should return.
+  // Either return, or advance to the next bytecode and dispatch.
   Label do_return;
   __ lbzx(r4, MemOperand(kInterpreterBytecodeArrayRegister,
                          kInterpreterBytecodeOffsetRegister));
-  __ cmpi(r4, Operand(static_cast<int>(interpreter::Bytecode::kReturn)));
-  __ beq(&do_return);
-
-  // Advance to the next bytecode and dispatch.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, r4, r5);
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, r4, r5,
+                                &do_return);
   __ b(&do_dispatch);
 
   __ bind(&do_return);
@@ -1106,6 +1100,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
 void Builtins::Generate_InterpreterPushArgsThenCallImpl(
     MacroAssembler* masm, ConvertReceiverMode receiver_mode,
     InterpreterPushArgsMode mode) {
+  DCHECK(mode != InterpreterPushArgsMode::kArrayFunction);
   // ----------- S t a t e -------------
   //  -- r3 : the number of arguments (not including the receiver)
   //  -- r5 : the address of the first argument to be pushed. Subsequent
@@ -1135,11 +1130,7 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
   }
 
   // Call the target.
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
-    __ Jump(
-        masm->isolate()->builtins()->CallFunction(ConvertReceiverMode::kAny),
-        RelocInfo::CODE_TARGET);
-  } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     __ Jump(BUILTIN_CODE(masm->isolate(), CallWithSpread),
             RelocInfo::CODE_TARGET);
   } else {
@@ -1185,16 +1176,13 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
   } else {
     __ AssertUndefinedOrAllocationSite(r5, r8);
   }
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
+  if (mode == InterpreterPushArgsMode::kArrayFunction) {
     __ AssertFunction(r4);
 
-    // Tail call to the function-specific construct stub (still in the caller
+    // Tail call to the array construct stub (still in the caller
     // context at this point).
-    __ LoadP(r7, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
-    __ LoadP(r7, FieldMemOperand(r7, SharedFunctionInfo::kConstructStubOffset));
-    // Jump to the construct function.
-    __ addi(ip, r7, Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ Jump(ip);
+    ArrayConstructorStub array_constructor_stub(masm->isolate());
+    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor with r3, r4, and r6 unmodified.
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1251,11 +1239,12 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   __ SmiUntag(kInterpreterBytecodeOffsetRegister);
 
   // Dispatch to the target bytecode.
-  __ lbzx(r4, MemOperand(kInterpreterBytecodeArrayRegister,
+  __ lbzx(ip, MemOperand(kInterpreterBytecodeArrayRegister,
                          kInterpreterBytecodeOffsetRegister));
-  __ ShiftLeftImm(ip, r4, Operand(kPointerSizeLog2));
-  __ LoadPX(ip, MemOperand(kInterpreterDispatchTableRegister, ip));
-  __ Jump(ip);
+  __ ShiftLeftImm(ip, ip, Operand(kPointerSizeLog2));
+  __ LoadPX(kJavaScriptCallCodeStartRegister,
+            MemOperand(kInterpreterDispatchTableRegister, ip));
+  __ Jump(kJavaScriptCallCodeStartRegister);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
@@ -1271,8 +1260,10 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
                          kInterpreterBytecodeOffsetRegister));
 
   // Advance to the next bytecode.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, r4, r5);
+  Label if_return;
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, r4, r5,
+                                &if_return);
 
   // Convert new bytecode offset to a Smi and save in the stackframe.
   __ SmiTag(r5, kInterpreterBytecodeOffsetRegister);
@@ -1280,45 +1271,19 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
             MemOperand(fp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
 
   Generate_InterpreterEnterBytecode(masm);
+
+  // We should never take the if_return path.
+  __ bind(&if_return);
+  __ Abort(AbortReason::kInvalidBytecodeAdvance);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CheckOptimizationMarker(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r3 : argument count (preserved for callee)
-  //  -- r6 : new target (preserved for callee)
-  //  -- r4 : target function (preserved for callee)
-  // -----------------------------------
-  Register closure = r4;
-
-  // Get the feedback vector.
-  Register feedback_vector = r5;
-  __ LoadP(feedback_vector,
-           FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
-  __ LoadP(feedback_vector,
-           FieldMemOperand(feedback_vector, Cell::kValueOffset));
-
-  // The feedback vector must be defined.
-  if (FLAG_debug_code) {
-    __ CompareRoot(feedback_vector, Heap::kUndefinedValueRootIndex);
-    __ Assert(ne, AbortReason::kExpectedFeedbackVector);
-  }
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, r7, r9, r8);
-
-  // Otherwise, tail call the SFI code.
-  GenerateTailCallToSharedCode(masm);
-}
-
 void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to the trampoline to the
-  // interpreter entry.
-  __ LoadP(r5, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
-  __ LoadP(r5, FieldMemOperand(r5, SharedFunctionInfo::kCodeOffset));
+  // Set the code slot inside the JSFunction to CompileLazy.
+  __ Move(r5, BUILTIN_CODE(masm->isolate(), CompileLazy));
   __ StoreP(r5, FieldMemOperand(r4, JSFunction::kCodeOffset), r0);
   __ RecordWriteField(r4, JSFunction::kCodeOffset, r5, r7, kLRHasNotBeenSaved,
                       kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
@@ -1326,6 +1291,68 @@ void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
   Generate_CompileLazy(masm);
 }
 
+static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
+                                      Register scratch1) {
+  // Figure out the SFI's code object.
+  Label done;
+  Label check_is_bytecode_array;
+  Label check_is_code;
+  Label check_is_fixed_array;
+  Label check_is_pre_parsed_scope_data;
+  Label check_is_function_template_info;
+
+  Register data_type = scratch1;
+
+  // IsSmi: Is builtin
+  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
+  __ mov(scratch1,
+         Operand(ExternalReference::builtins_address(masm->isolate())));
+  __ SmiUntag(sfi_data, LeaveRC, kPointerSizeLog2);
+  __ LoadPX(sfi_data, MemOperand(scratch1, sfi_data));
+  __ b(&done);
+
+  // Get map for subsequent checks.
+  __ bind(&check_is_bytecode_array);
+  __ LoadP(data_type, FieldMemOperand(sfi_data, HeapObject::kMapOffset));
+  __ LoadHalfWord(data_type,
+                  FieldMemOperand(data_type, Map::kInstanceTypeOffset), r0);
+
+  // IsBytecodeArray: Interpret bytecode
+  __ cmpi(data_type, Operand(BYTECODE_ARRAY_TYPE));
+  __ bne(&check_is_code);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
+  __ b(&done);
+
+  // IsCode: Run code
+  __ bind(&check_is_code);
+  __ cmpi(data_type, Operand(CODE_TYPE));
+  __ beq(&done);
+
+  // IsFixedArray: Instantiate using AsmWasmData,
+  __ bind(&check_is_fixed_array);
+  __ cmpi(data_type, Operand(FIXED_ARRAY_TYPE));
+  __ bne(&check_is_pre_parsed_scope_data);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
+  __ b(&done);
+
+  // IsPreParsedScopeData: Compile lazy
+  __ bind(&check_is_pre_parsed_scope_data);
+  __ cmpi(data_type, Operand(TUPLE2_TYPE));
+  __ bne(&check_is_function_template_info);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
+  __ b(&done);
+
+  // IsFunctionTemplateInfo: API call
+  __ bind(&check_is_function_template_info);
+  if (FLAG_debug_code) {
+    __ cmpi(data_type, Operand(FUNCTION_TEMPLATE_INFO_TYPE));
+    __ Assert(eq, AbortReason::kInvalidSharedFunctionInfoData);
+  }
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
+
+  __ bind(&done);
+}
+
 void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r3 : argument count (preserved for callee)
@@ -1340,7 +1367,7 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
 
   // Do we have a valid feedback vector?
   __ LoadP(feedback_vector,
-           FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
+           FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
   __ LoadP(feedback_vector,
            FieldMemOperand(feedback_vector, Cell::kValueOffset));
   __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
@@ -1349,13 +1376,15 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // Is there an optimization marker or optimized code in the feedback vector?
   MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, r7, r9, r8);
 
-  // We found no optimized code.
+  // We found no optimized code. Infer the code object needed for the SFI.
   Register entry = r7;
   __ LoadP(entry,
            FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
+  __ LoadP(entry,
+           FieldMemOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
+  GetSharedFunctionInfoCode(masm, entry, r8);
 
-  // If SFI points to anything other than CompileLazy, install that.
-  __ LoadP(entry, FieldMemOperand(entry, SharedFunctionInfo::kCodeOffset));
+  // If code entry points to anything other than CompileLazy, install that.
   __ mov(r8, Operand(masm->CodeObject()));
   __ cmp(entry, r8);
   __ beq(&gotta_call_runtime);
@@ -1425,25 +1454,9 @@ void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
   }
   {
     // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over. First to the shared function info.
+    // we simply need to copy it over to the target function.
 
     Register target_builtin = scratch1;
-    Register shared = scratch0;
-
-    __ LoadP(shared,
-             FieldMemOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-    CHECK(r8 != target && r8 != scratch0 && r8 != scratch1);
-    CHECK(r9 != target && r9 != scratch0 && r9 != scratch1);
-
-    __ StoreP(target_builtin,
-              FieldMemOperand(shared, SharedFunctionInfo::kCodeOffset), r0);
-    __ mr(r9, target_builtin);  // Write barrier clobbers r9 below.
-    __ RecordWriteField(shared, SharedFunctionInfo::kCodeOffset, r9, r8,
-                        kLRHasNotBeenSaved, kDontSaveFPRegs,
-                        OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-
-    // And second to the target function.
 
     __ StoreP(target_builtin, FieldMemOperand(target, JSFunction::kCodeOffset),
               r0);
@@ -1524,9 +1537,10 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   }
   // On failure, tail call back to regular js by re-calling the function
   // which has be reset to the compile lazy builtin.
-  __ LoadP(ip, FieldMemOperand(r4, JSFunction::kCodeOffset));
-  __ addi(ip, ip, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ JumpToJSEntry(ip);
+  static_assert(kJavaScriptCallCodeStartRegister == r5, "ABI mismatch");
+  __ LoadP(r5, FieldMemOperand(r4, JSFunction::kCodeOffset));
+  __ addi(r5, r5, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ JumpToJSEntry(r5);
 }
 
 namespace {
@@ -2050,8 +2064,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   // Check that the function is not a "classConstructor".
   Label class_constructor;
   __ LoadP(r5, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
-  __ lwz(r6, FieldMemOperand(r5, SharedFunctionInfo::kCompilerHintsOffset));
-  __ TestBitMask(r6, SharedFunctionInfo::kClassConstructorMask, r0);
+  __ lwz(r6, FieldMemOperand(r5, SharedFunctionInfo::kFlagsOffset));
+  __ TestBitMask(r6, SharedFunctionInfo::IsClassConstructorBit::kMask, r0);
   __ bne(&class_constructor, cr0);
 
   // Enter the context of the function; ToObject has to run in the function
@@ -2302,6 +2316,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
   //  -- r4 : the constructor to call (checked to be a JSFunction)
   //  -- r6 : the new target (checked to be a constructor)
   // -----------------------------------
+  __ AssertConstructor(r4);
   __ AssertFunction(r4);
 
   // Calling convention for function specific ConstructStubs require
@@ -2323,6 +2338,7 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
   //  -- r4 : the function to call (checked to be a JSBoundFunction)
   //  -- r6 : the new target (checked to be a constructor)
   // -----------------------------------
+  __ AssertConstructor(r4);
   __ AssertBoundFunction(r4);
 
   // Push the [[BoundArguments]] onto the stack.
@@ -2355,16 +2371,17 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   Label non_constructor, non_proxy;
   __ JumpIfSmi(r4, &non_constructor);
 
-  // Dispatch based on instance type.
-  __ CompareObjectType(r4, r7, r8, JS_FUNCTION_TYPE);
-  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructFunction),
-          RelocInfo::CODE_TARGET, eq);
-
   // Check if target has a [[Construct]] internal method.
+  __ LoadP(r7, FieldMemOperand(r4, HeapObject::kMapOffset));
   __ lbz(r5, FieldMemOperand(r7, Map::kBitFieldOffset));
   __ TestBit(r5, Map::IsConstructorBit::kShift, r0);
   __ beq(&non_constructor, cr0);
 
+  // Dispatch based on instance type.
+  __ CompareInstanceType(r7, r8, JS_FUNCTION_TYPE);
+  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructFunction),
+          RelocInfo::CODE_TARGET, eq);
+
   // Only dispatch to bound functions after checking whether they are
   // constructors.
   __ cmpi(r8, Operand(JS_BOUND_FUNCTION_TYPE));
@@ -2443,8 +2460,6 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   Label invoke, dont_adapt_arguments, stack_overflow;
 
   Label enough, too_few;
-  __ LoadP(ip, FieldMemOperand(r4, JSFunction::kCodeOffset));
-  __ addi(ip, ip, Operand(Code::kHeaderSize - kHeapObjectTag));
   __ cmp(r3, r5);
   __ blt(&too_few);
   __ cmpi(r5, Operand(SharedFunctionInfo::kDontAdaptArgumentsSentinel));
@@ -2460,7 +2475,6 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     // r4: function
     // r5: expected number of arguments
     // r6: new target (passed through to callee)
-    // ip: code entry to call
     __ SmiToPtrArrayOffset(r3, r3);
     __ add(r3, r3, fp);
     // adjust for return address and receiver
@@ -2474,7 +2488,6 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     // r5: expected number of arguments
     // r6: new target (passed through to callee)
     // r7: copy end address
-    // ip: code entry to call
 
     Label copy;
     __ bind(&copy);
@@ -2498,7 +2511,6 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     // r4: function
     // r5: expected number of arguments
     // r6: new target (passed through to callee)
-    // ip: code entry to call
     __ SmiToPtrArrayOffset(r3, r3);
     __ add(r3, r3, fp);
 
@@ -2507,7 +2519,6 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     // r4: function
     // r5: expected number of arguments
     // r6: new target (passed through to callee)
-    // ip: code entry to call
     Label copy;
     __ bind(&copy);
     // Adjust load for return address and receiver.
@@ -2521,7 +2532,6 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     // r4: function
     // r5: expected number of arguments
     // r6: new target (passed through to callee)
-    // ip: code entry to call
     __ LoadRoot(r0, Heap::kUndefinedValueRootIndex);
     __ ShiftLeftImm(r7, r5, Operand(kPointerSizeLog2));
     __ sub(r7, fp, r7);
@@ -2543,7 +2553,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // r3 : expected number of arguments
   // r4 : function (passed through to callee)
   // r6 : new target (passed through to callee)
-  __ CallJSEntry(ip);
+  static_assert(kJavaScriptCallCodeStartRegister == r5, "ABI mismatch");
+  __ LoadP(r5, FieldMemOperand(r4, JSFunction::kCodeOffset));
+  __ addi(r5, r5, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ CallJSEntry(r5);
 
   // Store offset of return address for deoptimizer.
   masm->isolate()->heap()->SetArgumentsAdaptorDeoptPCOffset(masm->pc_offset());
@@ -2556,7 +2569,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // Dont adapt arguments.
   // -------------------------------------------
   __ bind(&dont_adapt_arguments);
-  __ JumpToJSEntry(ip);
+  static_assert(kJavaScriptCallCodeStartRegister == r5, "ABI mismatch");
+  __ LoadP(r5, FieldMemOperand(r4, JSFunction::kCodeOffset));
+  __ addi(r5, r5, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ JumpToJSEntry(r5);
 
   __ bind(&stack_overflow);
   {
diff --git a/deps/v8/src/builtins/s390/builtins-s390.cc b/deps/v8/src/builtins/s390/builtins-s390.cc
index 020b04b91d6..e374b7aa430 100644
--- a/deps/v8/src/builtins/s390/builtins-s390.cc
+++ b/deps/v8/src/builtins/s390/builtins-s390.cc
@@ -81,13 +81,6 @@ void Builtins::Generate_AdaptorWithBuiltinExitFrame(MacroAssembler* masm) {
   AdaptorWithExitFrameType(masm, BUILTIN_EXIT);
 }
 
-// Load the built-in InternalArray function from the current context.
-static void GenerateLoadInternalArrayFunction(MacroAssembler* masm,
-                                              Register result) {
-  // Load the InternalArray function from the current native context.
-  __ LoadNativeContextSlot(Context::INTERNAL_ARRAY_FUNCTION_INDEX, result);
-}
-
 // Load the built-in Array function from the current context.
 static void GenerateLoadArrayFunction(MacroAssembler* masm, Register result) {
   // Load the Array function from the current native context.
@@ -102,9 +95,6 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // -----------------------------------
   Label generic_array_code, one_or_more_arguments, two_or_more_arguments;
 
-  // Get the InternalArray function.
-  GenerateLoadInternalArrayFunction(masm, r3);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin InternalArray functions should be maps.
     __ LoadP(r4, FieldMemOperand(r3, JSFunction::kPrototypeOrInitialMapOffset));
@@ -118,6 +108,7 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // Run the native code for the InternalArray function called as a normal
   // function.
   // tail call a stub
+  __ LoadRoot(r4, Heap::kUndefinedValueRootIndex);
   InternalArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
@@ -125,6 +116,7 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
 void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r2     : number of arguments
+  //  -- r3     : array function
   //  -- lr     : return address
   //  -- sp[...]: constructor arguments
   // -----------------------------------
@@ -138,25 +130,25 @@ void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
     __ LoadP(r4, FieldMemOperand(r3, JSFunction::kPrototypeOrInitialMapOffset));
     __ TestIfSmi(r4);
     __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, cr0);
-    __ CompareObjectType(r4, r5, r6, MAP_TYPE);
+    __ CompareObjectType(r4, r6, r7, MAP_TYPE);
     __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
   }
 
+  // r4 is the AllocationSite - here undefined.
+  __ LoadRoot(r4, Heap::kUndefinedValueRootIndex);
+  // If r5 (new target) is undefined, then this is the 'Call' case, so move
+  // r3 (the constructor) to r5.
+  Label call;
+  __ CmpP(r5, r4);
+  __ bne(&call);
   __ LoadRR(r5, r3);
+
   // Run the native code for the Array function called as a normal function.
-  // tail call a stub
-  __ LoadRoot(r4, Heap::kUndefinedValueRootIndex);
+  __ bind(&call);
   ArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
 
-static void GenerateTailCallToSharedCode(MacroAssembler* masm) {
-  __ LoadP(ip, FieldMemOperand(r3, JSFunction::kSharedFunctionInfoOffset));
-  __ LoadP(ip, FieldMemOperand(ip, SharedFunctionInfo::kCodeOffset));
-  __ AddP(ip, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ JumpToJSEntry(ip);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -179,8 +171,9 @@ static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
     __ Pop(r2, r3, r5);
     __ SmiUntag(r2);
   }
-  __ AddP(ip, r4, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ JumpToJSEntry(ip);
+  static_assert(kJavaScriptCallCodeStartRegister == r4, "ABI mismatch");
+  __ AddP(r4, r4, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ JumpToJSEntry(r4);
 }
 
 namespace {
@@ -286,9 +279,8 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // -----------------------------------
 
     __ LoadP(r6, FieldMemOperand(r3, JSFunction::kSharedFunctionInfoOffset));
-    __ LoadlW(r6,
-              FieldMemOperand(r6, SharedFunctionInfo::kCompilerHintsOffset));
-    __ TestBitMask(r6, SharedFunctionInfo::kDerivedConstructorMask, r0);
+    __ LoadlW(r6, FieldMemOperand(r6, SharedFunctionInfo::kFlagsOffset));
+    __ TestBitMask(r6, SharedFunctionInfo::IsDerivedConstructorBit::kMask, r0);
     __ bne(&not_create_implicit_receiver);
 
     // If not derived class constructor: Allocate the new receiver object.
@@ -412,9 +404,8 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
       // Throw if constructor function is a class constructor
       __ LoadP(r6, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
       __ LoadP(r6, FieldMemOperand(r6, JSFunction::kSharedFunctionInfoOffset));
-      __ LoadlW(r6,
-                FieldMemOperand(r6, SharedFunctionInfo::kCompilerHintsOffset));
-      __ TestBitMask(r6, SharedFunctionInfo::kClassConstructorMask, r0);
+      __ LoadlW(r6, FieldMemOperand(r6, SharedFunctionInfo::kFlagsOffset));
+      __ TestBitMask(r6, SharedFunctionInfo::IsClassConstructorBit::kMask, r0);
       __ beq(&use_receiver);
     } else {
       __ b(&use_receiver);
@@ -558,9 +549,10 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
     // undefined because generator functions are non-constructable.
     __ LoadRR(r5, r3);
     __ LoadRR(r3, r6);
-    __ LoadP(ip, FieldMemOperand(r3, JSFunction::kCodeOffset));
-    __ AddP(ip, ip, Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ JumpToJSEntry(ip);
+    static_assert(kJavaScriptCallCodeStartRegister == r4, "ABI mismatch");
+    __ LoadP(r4, FieldMemOperand(r3, JSFunction::kCodeOffset));
+    __ AddP(r4, r4, Operand(Code::kHeaderSize - kHeapObjectTag));
+    __ JumpToJSEntry(r4);
   }
 
   __ bind(&prepare_step_in_if_stepping);
@@ -759,7 +751,7 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   DCHECK(
       !AreAliased(feedback_vector, r2, r3, r5, scratch1, scratch2, scratch3));
 
-  Label optimized_code_slot_is_cell, fallthrough;
+  Label optimized_code_slot_is_weak_ref, fallthrough;
 
   Register closure = r3;
   Register optimized_code_entry = scratch1;
@@ -769,9 +761,9 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
       FieldMemOperand(feedback_vector, FeedbackVector::kOptimizedCodeOffset));
 
   // Check if the code entry is a Smi. If yes, we interpret it as an
-  // optimisation marker. Otherwise, interpret is as a weak cell to a code
+  // optimisation marker. Otherwise, interpret it as a weak reference to a code
   // object.
-  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_cell);
+  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_weak_ref);
 
   {
     // Optimized code slot is a Smi optimization marker.
@@ -806,12 +798,10 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   }
 
   {
-    // Optimized code slot is a WeakCell.
-    __ bind(&optimized_code_slot_is_cell);
+    // Optimized code slot is a weak reference.
+    __ bind(&optimized_code_slot_is_weak_ref);
 
-    __ LoadP(optimized_code_entry,
-             FieldMemOperand(optimized_code_entry, WeakCell::kValueOffset));
-    __ JumpIfSmi(optimized_code_entry, &fallthrough);
+    __ LoadWeakValue(optimized_code_entry, optimized_code_entry, &fallthrough);
 
     // Check if the optimized code is marked for deopt. If it is, call the
     // runtime to clear it.
@@ -830,9 +820,10 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
     // register.
     ReplaceClosureCodeWithOptimizedCode(masm, optimized_code_entry, closure,
                                         scratch2, scratch3, feedback_vector);
-    __ AddP(optimized_code_entry, optimized_code_entry,
+    static_assert(kJavaScriptCallCodeStartRegister == r4, "ABI mismatch");
+    __ AddP(r4, optimized_code_entry,
             Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ Jump(optimized_code_entry);
+    __ Jump(r4);
 
     // Optimized code slot contains deoptimized code, evict it and re-enter the
     // closure's code.
@@ -846,10 +837,13 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
 }
 
 // Advance the current bytecode offset. This simulates what all bytecode
-// handlers do upon completion of the underlying operation.
-static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
-                                  Register bytecode_offset, Register bytecode,
-                                  Register scratch1) {
+// handlers do upon completion of the underlying operation. Will bail out to a
+// label if the bytecode (without prefix) is a return bytecode.
+static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
+                                          Register bytecode_array,
+                                          Register bytecode_offset,
+                                          Register bytecode, Register scratch1,
+                                          Label* if_return) {
   Register bytecode_size_table = scratch1;
   Register scratch2 = bytecode;
   DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
@@ -859,11 +853,11 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
       Operand(ExternalReference::bytecode_size_table_address(masm->isolate())));
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
-  Label load_size, extra_wide;
+  Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
   __ CmpP(bytecode, Operand(0x1));
-  __ bgt(&load_size);
+  __ bgt(&process_bytecode);
   __ beq(&extra_wide);
 
   // Load the next bytecode and update table to the wide scaled table.
@@ -871,7 +865,7 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
   __ LoadlB(bytecode, MemOperand(bytecode_array, bytecode_offset));
   __ AddP(bytecode_size_table, bytecode_size_table,
           Operand(kIntSize * interpreter::Bytecodes::kBytecodeCount));
-  __ b(&load_size);
+  __ b(&process_bytecode);
 
   __ bind(&extra_wide);
   // Load the next bytecode and update table to the extra wide scaled table.
@@ -881,7 +875,17 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
           Operand(2 * kIntSize * interpreter::Bytecodes::kBytecodeCount));
 
   // Load the size of the current bytecode.
-  __ bind(&load_size);
+  __ bind(&process_bytecode);
+
+// Bailout to the return label if this is a return bytecode.
+#define JUMP_IF_EQUAL(NAME)                                           \
+  __ CmpP(bytecode,                                                   \
+          Operand(static_cast<int>(interpreter::Bytecode::k##NAME))); \
+  __ beq(if_return);
+  RETURN_BYTECODE_LIST(JUMP_IF_EQUAL)
+#undef JUMP_IF_EQUAL
+
+  // Otherwise, load the size of the current bytecode and advance the offset.
   __ ShiftLeftP(scratch2, bytecode, Operand(2));
   __ LoadlW(scratch2, MemOperand(bytecode_size_table, scratch2));
   __ AddP(bytecode_offset, bytecode_offset, scratch2);
@@ -911,7 +915,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
 
   // Load the feedback vector from the closure.
   __ LoadP(feedback_vector,
-           FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
+           FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
   __ LoadP(feedback_vector,
            FieldMemOperand(feedback_vector, Cell::kValueOffset));
   // Read off the optimized code slot in the feedback vector, and if there
@@ -1020,11 +1024,12 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
          Operand(ExternalReference::interpreter_dispatch_table_address(
              masm->isolate())));
 
-  __ LoadlB(r3, MemOperand(kInterpreterBytecodeArrayRegister,
+  __ LoadlB(r5, MemOperand(kInterpreterBytecodeArrayRegister,
                            kInterpreterBytecodeOffsetRegister));
-  __ ShiftLeftP(ip, r3, Operand(kPointerSizeLog2));
-  __ LoadP(ip, MemOperand(kInterpreterDispatchTableRegister, ip));
-  __ Call(ip);
+  __ ShiftLeftP(r5, r5, Operand(kPointerSizeLog2));
+  __ LoadP(kJavaScriptCallCodeStartRegister,
+           MemOperand(kInterpreterDispatchTableRegister, r5));
+  __ Call(kJavaScriptCallCodeStartRegister);
 
   masm->isolate()->heap()->SetInterpreterEntryReturnPCOffset(masm->pc_offset());
 
@@ -1038,16 +1043,13 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
            MemOperand(fp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
   __ SmiUntag(kInterpreterBytecodeOffsetRegister);
 
-  // Check if we should return.
+  // Either return, or advance to the next bytecode and dispatch.
   Label do_return;
   __ LoadlB(r3, MemOperand(kInterpreterBytecodeArrayRegister,
                            kInterpreterBytecodeOffsetRegister));
-  __ CmpP(r3, Operand(static_cast<int>(interpreter::Bytecode::kReturn)));
-  __ beq(&do_return);
-
-  // Advance to the next bytecode and dispatch.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, r3, r4);
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, r3, r4,
+                                &do_return);
   __ b(&do_dispatch);
 
   __ bind(&do_return);
@@ -1107,6 +1109,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
 void Builtins::Generate_InterpreterPushArgsThenCallImpl(
     MacroAssembler* masm, ConvertReceiverMode receiver_mode,
     InterpreterPushArgsMode mode) {
+  DCHECK(mode != InterpreterPushArgsMode::kArrayFunction);
   // ----------- S t a t e -------------
   //  -- r2 : the number of arguments (not including the receiver)
   //  -- r4 : the address of the first argument to be pushed. Subsequent
@@ -1134,11 +1137,7 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
   }
 
   // Call the target.
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
-    __ Jump(
-        masm->isolate()->builtins()->CallFunction(ConvertReceiverMode::kAny),
-        RelocInfo::CODE_TARGET);
-  } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     __ Jump(BUILTIN_CODE(masm->isolate(), CallWithSpread),
             RelocInfo::CODE_TARGET);
   } else {
@@ -1184,16 +1183,13 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
   } else {
     __ AssertUndefinedOrAllocationSite(r4, r7);
   }
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
+  if (mode == InterpreterPushArgsMode::kArrayFunction) {
     __ AssertFunction(r3);
 
-    // Tail call to the function-specific construct stub (still in the caller
+    // Tail call to the array construct stub (still in the caller
     // context at this point).
-    __ LoadP(r6, FieldMemOperand(r3, JSFunction::kSharedFunctionInfoOffset));
-    __ LoadP(r6, FieldMemOperand(r6, SharedFunctionInfo::kConstructStubOffset));
-    // Jump to the construct function.
-    __ AddP(ip, r6, Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ Jump(ip);
+    ArrayConstructorStub array_constructor_stub(masm->isolate());
+    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor with r2, r3, and r5 unmodified.
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1248,11 +1244,12 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   __ SmiUntag(kInterpreterBytecodeOffsetRegister);
 
   // Dispatch to the target bytecode.
-  __ LoadlB(r3, MemOperand(kInterpreterBytecodeArrayRegister,
+  __ LoadlB(ip, MemOperand(kInterpreterBytecodeArrayRegister,
                            kInterpreterBytecodeOffsetRegister));
-  __ ShiftLeftP(ip, r3, Operand(kPointerSizeLog2));
-  __ LoadP(ip, MemOperand(kInterpreterDispatchTableRegister, ip));
-  __ Jump(ip);
+  __ ShiftLeftP(ip, ip, Operand(kPointerSizeLog2));
+  __ LoadP(kJavaScriptCallCodeStartRegister,
+           MemOperand(kInterpreterDispatchTableRegister, ip));
+  __ Jump(kJavaScriptCallCodeStartRegister);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
@@ -1268,8 +1265,10 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
                            kInterpreterBytecodeOffsetRegister));
 
   // Advance to the next bytecode.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, r3, r4);
+  Label if_return;
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, r3, r4,
+                                &if_return);
 
   // Convert new bytecode offset to a Smi and save in the stackframe.
   __ SmiTag(r4, kInterpreterBytecodeOffsetRegister);
@@ -1277,45 +1276,19 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
             MemOperand(fp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
 
   Generate_InterpreterEnterBytecode(masm);
+
+  // We should never take the if_return path.
+  __ bind(&if_return);
+  __ Abort(AbortReason::kInvalidBytecodeAdvance);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CheckOptimizationMarker(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r3 : argument count (preserved for callee)
-  //  -- r6 : new target (preserved for callee)
-  //  -- r4 : target function (preserved for callee)
-  // -----------------------------------
-  Register closure = r3;
-
-  // Get the feedback vector.
-  Register feedback_vector = r4;
-  __ LoadP(feedback_vector,
-           FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
-  __ LoadP(feedback_vector,
-           FieldMemOperand(feedback_vector, Cell::kValueOffset));
-
-  // The feedback vector must be defined.
-  if (FLAG_debug_code) {
-    __ CompareRoot(feedback_vector, Heap::kUndefinedValueRootIndex);
-    __ Assert(ne, AbortReason::kExpectedFeedbackVector);
-  }
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, r6, r8, r7);
-
-  // Otherwise, tail call the SFI code.
-  GenerateTailCallToSharedCode(masm);
-}
-
 void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to the trampoline to the
-  // interpreter entry.
-  __ LoadP(r4, FieldMemOperand(r3, JSFunction::kSharedFunctionInfoOffset));
-  __ LoadP(r4, FieldMemOperand(r4, SharedFunctionInfo::kCodeOffset));
+  // Set the code slot inside the JSFunction to CompileLazy.
+  __ Move(r4, BUILTIN_CODE(masm->isolate(), CompileLazy));
   __ StoreP(r4, FieldMemOperand(r3, JSFunction::kCodeOffset));
   __ RecordWriteField(r3, JSFunction::kCodeOffset, r4, r6, kLRHasNotBeenSaved,
                       kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
@@ -1323,6 +1296,68 @@ void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
   Generate_CompileLazy(masm);
 }
 
+static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
+                                      Register scratch1) {
+  // Figure out the SFI's code object.
+  Label done;
+  Label check_is_bytecode_array;
+  Label check_is_code;
+  Label check_is_fixed_array;
+  Label check_is_pre_parsed_scope_data;
+  Label check_is_function_template_info;
+
+  Register data_type = scratch1;
+
+  // IsSmi: Is builtin
+  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
+  __ mov(scratch1,
+         Operand(ExternalReference::builtins_address(masm->isolate())));
+  __ SmiUntag(sfi_data, kPointerSizeLog2);
+  __ LoadP(sfi_data, MemOperand(scratch1, sfi_data));
+  __ b(&done);
+
+  // Get map for subsequent checks.
+  __ bind(&check_is_bytecode_array);
+  __ LoadP(data_type, FieldMemOperand(sfi_data, HeapObject::kMapOffset));
+  __ LoadHalfWordP(data_type,
+                   FieldMemOperand(data_type, Map::kInstanceTypeOffset));
+
+  // IsBytecodeArray: Interpret bytecode
+  __ CmpP(data_type, Operand(BYTECODE_ARRAY_TYPE));
+  __ bne(&check_is_code);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
+  __ b(&done);
+
+  // IsCode: Run code
+  __ bind(&check_is_code);
+  __ CmpP(data_type, Operand(CODE_TYPE));
+  __ beq(&done);
+
+  // IsFixedArray: Instantiate using AsmWasmData,
+  __ bind(&check_is_fixed_array);
+  __ CmpP(data_type, Operand(FIXED_ARRAY_TYPE));
+  __ bne(&check_is_pre_parsed_scope_data);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
+  __ b(&done);
+
+  // IsPreParsedScopeData: Compile lazy
+  __ bind(&check_is_pre_parsed_scope_data);
+  __ CmpP(data_type, Operand(TUPLE2_TYPE));
+  __ bne(&check_is_function_template_info);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
+  __ b(&done);
+
+  // IsFunctionTemplateInfo: API call
+  __ bind(&check_is_function_template_info);
+  if (FLAG_debug_code) {
+    __ CmpP(data_type, Operand(FUNCTION_TEMPLATE_INFO_TYPE));
+    __ Assert(eq, AbortReason::kInvalidSharedFunctionInfoData);
+  }
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
+
+  __ bind(&done);
+}
+
 void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r2 : argument count (preserved for callee)
@@ -1337,7 +1372,7 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
 
   // Do we have a valid feedback vector?
   __ LoadP(feedback_vector,
-           FieldMemOperand(closure, JSFunction::kFeedbackVectorOffset));
+           FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
   __ LoadP(feedback_vector,
            FieldMemOperand(feedback_vector, Cell::kValueOffset));
   __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
@@ -1346,13 +1381,15 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // Is there an optimization marker or optimized code in the feedback vector?
   MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, r6, r8, r7);
 
-  // We found no optimized code.
+  // We found no optimized code. Infer the code object needed for the SFI.
   Register entry = r6;
   __ LoadP(entry,
            FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
+  __ LoadP(entry,
+           FieldMemOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
+  GetSharedFunctionInfoCode(masm, entry, r7);
 
-  // If SFI points to anything other than CompileLazy, install that.
-  __ LoadP(entry, FieldMemOperand(entry, SharedFunctionInfo::kCodeOffset));
+  // If code entry points to anything other than CompileLazy, install that.
   __ mov(r7, Operand(masm->CodeObject()));
   __ CmpP(entry, r7);
   __ beq(&gotta_call_runtime);
@@ -1422,25 +1459,9 @@ void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
   }
   {
     // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over. First to the shared function info.
+    // we simply need to copy it over to the target function.
 
     Register target_builtin = scratch1;
-    Register shared = scratch0;
-
-    __ LoadP(shared,
-             FieldMemOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-    CHECK(r7 != target && r7 != scratch0 && r7 != scratch1);
-    CHECK(r8 != target && r8 != scratch0 && r8 != scratch1);
-
-    __ StoreP(target_builtin,
-              FieldMemOperand(shared, SharedFunctionInfo::kCodeOffset));
-    __ LoadRR(r8, target_builtin);  // Write barrier clobbers r9 below.
-    __ RecordWriteField(shared, SharedFunctionInfo::kCodeOffset, r8, r7,
-                        kLRHasNotBeenSaved, kDontSaveFPRegs,
-                        OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-
-    // And second to the target function.
 
     __ StoreP(target_builtin, FieldMemOperand(target, JSFunction::kCodeOffset));
     __ LoadRR(r8, target_builtin);  // Write barrier clobbers r9 below.
@@ -1520,9 +1541,10 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   }
   // On failure, tail call back to regular js by re-calling the function
   // which has be reset to the compile lazy builtin.
-  __ LoadP(ip, FieldMemOperand(r3, JSFunction::kCodeOffset));
-  __ AddP(ip, ip, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ JumpToJSEntry(ip);
+  static_assert(kJavaScriptCallCodeStartRegister == r4, "ABI mismatch");
+  __ LoadP(r4, FieldMemOperand(r3, JSFunction::kCodeOffset));
+  __ AddP(r4, r4, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ JumpToJSEntry(r4);
 }
 
 namespace {
@@ -2047,8 +2069,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   // Check that the function is not a "classConstructor".
   Label class_constructor;
   __ LoadP(r4, FieldMemOperand(r3, JSFunction::kSharedFunctionInfoOffset));
-  __ LoadlW(r5, FieldMemOperand(r4, SharedFunctionInfo::kCompilerHintsOffset));
-  __ TestBitMask(r5, SharedFunctionInfo::kClassConstructorMask, r0);
+  __ LoadlW(r5, FieldMemOperand(r4, SharedFunctionInfo::kFlagsOffset));
+  __ TestBitMask(r5, SharedFunctionInfo::IsClassConstructorBit::kMask, r0);
   __ bne(&class_constructor);
 
   // Enter the context of the function; ToObject has to run in the function
@@ -2301,6 +2323,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
   //  -- r3 : the constructor to call (checked to be a JSFunction)
   //  -- r5 : the new target (checked to be a constructor)
   // -----------------------------------
+  __ AssertConstructor(r3, r1);
   __ AssertFunction(r3);
 
   // Calling convention for function specific ConstructStubs require
@@ -2322,6 +2345,7 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
   //  -- r3 : the function to call (checked to be a JSBoundFunction)
   //  -- r5 : the new target (checked to be a constructor)
   // -----------------------------------
+  __ AssertConstructor(r3, r1);
   __ AssertBoundFunction(r3);
 
   // Push the [[BoundArguments]] onto the stack.
@@ -2354,16 +2378,17 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   Label non_constructor, non_proxy;
   __ JumpIfSmi(r3, &non_constructor);
 
-  // Dispatch based on instance type.
-  __ CompareObjectType(r3, r6, r7, JS_FUNCTION_TYPE);
-  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructFunction),
-          RelocInfo::CODE_TARGET, eq);
-
   // Check if target has a [[Construct]] internal method.
+  __ LoadP(r6, FieldMemOperand(r3, HeapObject::kMapOffset));
   __ LoadlB(r4, FieldMemOperand(r6, Map::kBitFieldOffset));
   __ TestBit(r4, Map::IsConstructorBit::kShift);
   __ beq(&non_constructor);
 
+  // Dispatch based on instance type.
+  __ CompareInstanceType(r6, r7, JS_FUNCTION_TYPE);
+  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructFunction),
+          RelocInfo::CODE_TARGET, eq);
+
   // Only dispatch to bound functions after checking whether they are
   // constructors.
   __ CmpP(r7, Operand(JS_BOUND_FUNCTION_TYPE));
@@ -2442,8 +2467,6 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   Label invoke, dont_adapt_arguments, stack_overflow;
 
   Label enough, too_few;
-  __ LoadP(ip, FieldMemOperand(r3, JSFunction::kCodeOffset));
-  __ AddP(ip, ip, Operand(Code::kHeaderSize - kHeapObjectTag));
   __ CmpP(r2, r4);
   __ blt(&too_few);
   __ CmpP(r4, Operand(SharedFunctionInfo::kDontAdaptArgumentsSentinel));
@@ -2459,7 +2482,6 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     // r3: function
     // r4: expected number of arguments
     // r5: new target (passed through to callee)
-    // ip: code entry to call
     __ SmiToPtrArrayOffset(r2, r2);
     __ AddP(r2, fp);
     // adjust for return address and receiver
@@ -2473,7 +2495,6 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     // r4: expected number of arguments
     // r5: new target (passed through to callee)
     // r6: copy end address
-    // ip: code entry to call
 
     Label copy;
     __ bind(&copy);
@@ -2497,7 +2518,6 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     // r3: function
     // r4: expected number of arguments
     // r5: new target (passed through to callee)
-    // ip: code entry to call
     __ SmiToPtrArrayOffset(r2, r2);
     __ lay(r2, MemOperand(r2, fp));
 
@@ -2506,7 +2526,6 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     // r3: function
     // r4: expected number of arguments
     // r5: new target (passed through to callee)
-    // ip: code entry to call
     Label copy;
     __ bind(&copy);
     // Adjust load for return address and receiver.
@@ -2519,7 +2538,6 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     // Fill the remaining expected arguments with undefined.
     // r3: function
     // r4: expected number of argumentus
-    // ip: code entry to call
     __ LoadRoot(r0, Heap::kUndefinedValueRootIndex);
     __ ShiftLeftP(r6, r4, Operand(kPointerSizeLog2));
     __ SubP(r6, fp, r6);
@@ -2541,7 +2559,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // r2 : expected number of arguments
   // r3 : function (passed through to callee)
   // r5 : new target (passed through to callee)
-  __ CallJSEntry(ip);
+  static_assert(kJavaScriptCallCodeStartRegister == r4, "ABI mismatch");
+  __ LoadP(r4, FieldMemOperand(r3, JSFunction::kCodeOffset));
+  __ AddP(r4, r4, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ CallJSEntry(r4);
 
   // Store offset of return address for deoptimizer.
   masm->isolate()->heap()->SetArgumentsAdaptorDeoptPCOffset(masm->pc_offset());
@@ -2554,7 +2575,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // Dont adapt arguments.
   // -------------------------------------------
   __ bind(&dont_adapt_arguments);
-  __ JumpToJSEntry(ip);
+  static_assert(kJavaScriptCallCodeStartRegister == r4, "ABI mismatch");
+  __ LoadP(r4, FieldMemOperand(r3, JSFunction::kCodeOffset));
+  __ AddP(r4, r4, Operand(Code::kHeaderSize - kHeapObjectTag));
+  __ JumpToJSEntry(r4);
 
   __ bind(&stack_overflow);
   {
diff --git a/deps/v8/src/builtins/setup-builtins-internal.cc b/deps/v8/src/builtins/setup-builtins-internal.cc
index 5a09658867f..2740888a21f 100644
--- a/deps/v8/src/builtins/setup-builtins-internal.cc
+++ b/deps/v8/src/builtins/setup-builtins-internal.cc
@@ -114,8 +114,9 @@ Code* BuildWithCodeStubAssemblerJS(Isolate* isolate, int32_t builtin_index,
   Zone zone(isolate->allocator(), ZONE_NAME, segment_size);
   const int argc_with_recv =
       (argc == SharedFunctionInfo::kDontAdaptArgumentsSentinel) ? 0 : argc + 1;
-  compiler::CodeAssemblerState state(isolate, &zone, argc_with_recv,
-                                     Code::BUILTIN, name, builtin_index);
+  compiler::CodeAssemblerState state(
+      isolate, &zone, argc_with_recv, Code::BUILTIN, name,
+      PoisoningMitigationLevel::kOff, builtin_index);
   generator(&state);
   Handle<Code> code = compiler::CodeAssembler::GenerateCode(&state);
   PostBuildProfileAndTracing(isolate, *code, name);
@@ -141,7 +142,8 @@ Code* BuildWithCodeStubAssemblerCS(Isolate* isolate, int32_t builtin_index,
   // Ensure descriptor is already initialized.
   DCHECK_LE(0, descriptor.GetRegisterParameterCount());
   compiler::CodeAssemblerState state(isolate, &zone, descriptor, Code::BUILTIN,
-                                     name, result_size, 0, builtin_index);
+                                     name, PoisoningMitigationLevel::kOff,
+                                     result_size, 0, builtin_index);
   generator(&state);
   Handle<Code> code = compiler::CodeAssembler::GenerateCode(&state);
   PostBuildProfileAndTracing(isolate, *code, name);
@@ -186,7 +188,7 @@ void SetupIsolateDelegate::ReplacePlaceholders(Isolate* isolate) {
         if (!target->is_builtin()) continue;
         Code* new_target =
             Code::cast(builtins->builtins_[target->builtin_index()]);
-        rinfo->set_target_address(isolate, new_target->instruction_start(),
+        rinfo->set_target_address(new_target->instruction_start(),
                                   UPDATE_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
       } else {
         DCHECK(RelocInfo::IsEmbeddedObject(rinfo->rmode()));
@@ -202,7 +204,7 @@ void SetupIsolateDelegate::ReplacePlaceholders(Isolate* isolate) {
       flush_icache = true;
     }
     if (flush_icache) {
-      Assembler::FlushICache(isolate, code->instruction_start(),
+      Assembler::FlushICache(code->instruction_start(),
                              code->instruction_size());
     }
   }
diff --git a/deps/v8/src/builtins/x64/builtins-x64.cc b/deps/v8/src/builtins/x64/builtins-x64.cc
index cd35abb3625..e142b0c0f3d 100644
--- a/deps/v8/src/builtins/x64/builtins-x64.cc
+++ b/deps/v8/src/builtins/x64/builtins-x64.cc
@@ -87,15 +87,6 @@ void Builtins::Generate_AdaptorWithBuiltinExitFrame(MacroAssembler* masm) {
   AdaptorWithExitFrameType(masm, BUILTIN_EXIT);
 }
 
-static void GenerateTailCallToSharedCode(MacroAssembler* masm) {
-  __ movp(kScratchRegister,
-          FieldOperand(rdi, JSFunction::kSharedFunctionInfoOffset));
-  __ movp(kScratchRegister,
-          FieldOperand(kScratchRegister, SharedFunctionInfo::kCodeOffset));
-  __ leap(kScratchRegister, FieldOperand(kScratchRegister, Code::kHeaderSize));
-  __ jmp(kScratchRegister);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -115,7 +106,7 @@ static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
     __ Push(rdi);
 
     __ CallRuntime(function_id, 1);
-    __ movp(rbx, rax);
+    __ movp(rcx, rax);
 
     // Restore target function and new target.
     __ Pop(rdx);
@@ -123,8 +114,9 @@ static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
     __ Pop(rax);
     __ SmiToInteger32(rax, rax);
   }
-  __ leap(rbx, FieldOperand(rbx, Code::kHeaderSize));
-  __ jmp(rbx);
+  static_assert(kJavaScriptCallCodeStartRegister == rcx, "ABI mismatch");
+  __ leap(rcx, FieldOperand(rcx, Code::kHeaderSize));
+  __ jmp(rcx);
 }
 
 namespace {
@@ -229,8 +221,8 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // -----------------------------------
 
     __ movp(rbx, FieldOperand(rdi, JSFunction::kSharedFunctionInfoOffset));
-    __ testl(FieldOperand(rbx, SharedFunctionInfo::kCompilerHintsOffset),
-             Immediate(SharedFunctionInfo::kDerivedConstructorMask));
+    __ testl(FieldOperand(rbx, SharedFunctionInfo::kFlagsOffset),
+             Immediate(SharedFunctionInfo::IsDerivedConstructorBit::kMask));
     __ j(not_zero, &not_create_implicit_receiver, Label::kNear);
 
     // If not derived class constructor: Allocate the new receiver object.
@@ -349,8 +341,8 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     __ bind(&other_result);
     __ movp(rbx, Operand(rbp, ConstructFrameConstants::kConstructorOffset));
     __ movp(rbx, FieldOperand(rbx, JSFunction::kSharedFunctionInfoOffset));
-    __ testl(FieldOperand(rbx, SharedFunctionInfo::kCompilerHintsOffset),
-             Immediate(SharedFunctionInfo::kClassConstructorMask));
+    __ testl(FieldOperand(rbx, SharedFunctionInfo::kFlagsOffset),
+             Immediate(SharedFunctionInfo::IsClassConstructorBit::kMask));
 
     if (restrict_constructor_return) {
       // Throw if constructor function is a class constructor
@@ -660,6 +652,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
     // We abuse new.target both to indicate that this is a resume call and to
     // pass in the generator object.  In ordinary calls, new.target is always
     // undefined because generator functions are non-constructable.
+    static_assert(kJavaScriptCallCodeStartRegister == rcx, "ABI mismatch");
     __ movp(rcx, FieldOperand(rdi, JSFunction::kCodeOffset));
     __ addp(rcx, Immediate(Code::kHeaderSize - kHeapObjectTag));
     __ jmp(rcx);
@@ -752,7 +745,7 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   DCHECK(!AreAliased(feedback_vector, rax, rdx, rdi, scratch1, scratch2,
                      scratch3));
 
-  Label optimized_code_slot_is_cell, fallthrough;
+  Label optimized_code_slot_is_weak_ref, fallthrough;
 
   Register closure = rdi;
   Register optimized_code_entry = scratch1;
@@ -761,9 +754,9 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
           FieldOperand(feedback_vector, FeedbackVector::kOptimizedCodeOffset));
 
   // Check if the code entry is a Smi. If yes, we interpret it as an
-  // optimisation marker. Otherwise, interpret is as a weak cell to a code
+  // optimisation marker. Otherwise, interpret it as a weak reference to a code
   // object.
-  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_cell);
+  __ JumpIfNotSmi(optimized_code_entry, &optimized_code_slot_is_weak_ref);
 
   {
     // Optimized code slot is a Smi optimization marker.
@@ -797,12 +790,10 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
   }
 
   {
-    // Optimized code slot is a WeakCell.
-    __ bind(&optimized_code_slot_is_cell);
+    // Optimized code slot is a weak reference.
+    __ bind(&optimized_code_slot_is_weak_ref);
 
-    __ movp(optimized_code_entry,
-            FieldOperand(optimized_code_entry, WeakCell::kValueOffset));
-    __ JumpIfSmi(optimized_code_entry, &fallthrough);
+    __ LoadWeakValue(optimized_code_entry, &fallthrough);
 
     // Check if the optimized code is marked for deopt. If it is, call the
     // runtime to clear it.
@@ -820,9 +811,10 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
     // register.
     ReplaceClosureCodeWithOptimizedCode(masm, optimized_code_entry, closure,
                                         scratch2, scratch3, feedback_vector);
-    __ addp(optimized_code_entry,
-            Immediate(Code::kHeaderSize - kHeapObjectTag));
-    __ jmp(optimized_code_entry);
+    static_assert(kJavaScriptCallCodeStartRegister == rcx, "ABI mismatch");
+    __ Move(rcx, optimized_code_entry);
+    __ addp(rcx, Immediate(Code::kHeaderSize - kHeapObjectTag));
+    __ jmp(rcx);
 
     // Optimized code slot contains deoptimized code, evict it and re-enter the
     // closure's code.
@@ -836,10 +828,13 @@ static void MaybeTailCallOptimizedCodeSlot(MacroAssembler* masm,
 }
 
 // Advance the current bytecode offset. This simulates what all bytecode
-// handlers do upon completion of the underlying operation.
-static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
-                                  Register bytecode_offset, Register bytecode,
-                                  Register scratch1) {
+// handlers do upon completion of the underlying operation. Will bail out to a
+// label if the bytecode (without prefix) is a return bytecode.
+static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
+                                          Register bytecode_array,
+                                          Register bytecode_offset,
+                                          Register bytecode, Register scratch1,
+                                          Label* if_return) {
   Register bytecode_size_table = scratch1;
   DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
                      bytecode));
@@ -848,11 +843,11 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
           ExternalReference::bytecode_size_table_address(masm->isolate()));
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
-  Label load_size, extra_wide;
+  Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
   __ cmpb(bytecode, Immediate(0x1));
-  __ j(above, &load_size, Label::kNear);
+  __ j(above, &process_bytecode, Label::kNear);
   __ j(equal, &extra_wide, Label::kNear);
 
   // Load the next bytecode and update table to the wide scaled table.
@@ -860,7 +855,7 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
   __ movzxbp(bytecode, Operand(bytecode_array, bytecode_offset, times_1, 0));
   __ addp(bytecode_size_table,
           Immediate(kIntSize * interpreter::Bytecodes::kBytecodeCount));
-  __ jmp(&load_size, Label::kNear);
+  __ jmp(&process_bytecode, Label::kNear);
 
   __ bind(&extra_wide);
   // Load the next bytecode and update table to the extra wide scaled table.
@@ -869,8 +864,17 @@ static void AdvanceBytecodeOffset(MacroAssembler* masm, Register bytecode_array,
   __ addp(bytecode_size_table,
           Immediate(2 * kIntSize * interpreter::Bytecodes::kBytecodeCount));
 
-  // Load the size of the current bytecode.
-  __ bind(&load_size);
+  __ bind(&process_bytecode);
+
+// Bailout to the return label if this is a return bytecode.
+#define JUMP_IF_EQUAL(NAME)                                             \
+  __ cmpb(bytecode,                                                     \
+          Immediate(static_cast<int>(interpreter::Bytecode::k##NAME))); \
+  __ j(equal, if_return, Label::kNear);
+  RETURN_BYTECODE_LIST(JUMP_IF_EQUAL)
+#undef JUMP_IF_EQUAL
+
+  // Otherwise, load the size of the current bytecode and advance the offset.
   __ addl(bytecode_offset, Operand(bytecode_size_table, bytecode, times_4, 0));
 }
 
@@ -896,7 +900,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
 
   // Load the feedback vector from the closure.
   __ movp(feedback_vector,
-          FieldOperand(closure, JSFunction::kFeedbackVectorOffset));
+          FieldOperand(closure, JSFunction::kFeedbackCellOffset));
   __ movp(feedback_vector, FieldOperand(feedback_vector, Cell::kValueOffset));
   // Read off the optimized code slot in the feedback vector, and if there
   // is optimized code or an optimization marker, call that instead.
@@ -1000,11 +1004,12 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   __ Move(
       kInterpreterDispatchTableRegister,
       ExternalReference::interpreter_dispatch_table_address(masm->isolate()));
-  __ movzxbp(rbx, Operand(kInterpreterBytecodeArrayRegister,
+  __ movzxbp(r11, Operand(kInterpreterBytecodeArrayRegister,
                           kInterpreterBytecodeOffsetRegister, times_1, 0));
-  __ movp(rbx, Operand(kInterpreterDispatchTableRegister, rbx,
-                       times_pointer_size, 0));
-  __ call(rbx);
+  __ movp(
+      kJavaScriptCallCodeStartRegister,
+      Operand(kInterpreterDispatchTableRegister, r11, times_pointer_size, 0));
+  __ call(kJavaScriptCallCodeStartRegister);
   masm->isolate()->heap()->SetInterpreterEntryReturnPCOffset(masm->pc_offset());
 
   // Any returns to the entry trampoline are either due to the return bytecode
@@ -1018,16 +1023,13 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   __ SmiToInteger32(kInterpreterBytecodeOffsetRegister,
                     kInterpreterBytecodeOffsetRegister);
 
-  // Check if we should return.
+  // Either return, or advance to the next bytecode and dispatch.
   Label do_return;
   __ movzxbp(rbx, Operand(kInterpreterBytecodeArrayRegister,
                           kInterpreterBytecodeOffsetRegister, times_1, 0));
-  __ cmpb(rbx, Immediate(static_cast<int>(interpreter::Bytecode::kReturn)));
-  __ j(equal, &do_return, Label::kNear);
-
-  // Advance to the next bytecode and dispatch.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, rbx, rcx);
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, rbx, rcx,
+                                &do_return);
   __ jmp(&do_dispatch);
 
   __ bind(&do_return);
@@ -1074,6 +1076,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
 void Builtins::Generate_InterpreterPushArgsThenCallImpl(
     MacroAssembler* masm, ConvertReceiverMode receiver_mode,
     InterpreterPushArgsMode mode) {
+  DCHECK(mode != InterpreterPushArgsMode::kArrayFunction);
   // ----------- S t a t e -------------
   //  -- rax : the number of arguments (not including the receiver)
   //  -- rbx : the address of the first argument to be pushed. Subsequent
@@ -1110,10 +1113,7 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
   // Call the target.
   __ PushReturnAddressFrom(kScratchRegister);  // Re-push return address.
 
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
-    __ Jump(masm->isolate()->builtins()->CallFunction(receiver_mode),
-            RelocInfo::CODE_TARGET);
-  } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
+  if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     __ Jump(BUILTIN_CODE(masm->isolate(), CallWithSpread),
             RelocInfo::CODE_TARGET);
   } else {
@@ -1168,16 +1168,13 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
     __ AssertUndefinedOrAllocationSite(rbx);
   }
 
-  if (mode == InterpreterPushArgsMode::kJSFunction) {
-    // Tail call to the function-specific construct stub (still in the caller
+  if (mode == InterpreterPushArgsMode::kArrayFunction) {
+    // Tail call to the array construct stub (still in the caller
     // context at this point).
     __ AssertFunction(rdi);
-
-    __ movp(rcx, FieldOperand(rdi, JSFunction::kSharedFunctionInfoOffset));
-    __ movp(rcx, FieldOperand(rcx, SharedFunctionInfo::kConstructStubOffset));
-    __ leap(rcx, FieldOperand(rcx, Code::kHeaderSize));
     // Jump to the constructor function (rax, rbx, rdx passed on).
-    __ jmp(rcx);
+    ArrayConstructorStub array_constructor_stub(masm->isolate());
+    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor (rax, rdx, rdi passed on).
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1200,6 +1197,8 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
 static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   // Set the return address to the correct point in the interpreter entry
   // trampoline.
+  // TODO(jgruber,v8:6666): Update logic once builtin is off-heap-safe.
+  DCHECK(!Builtins::IsOffHeapSafe(Builtins::kInterpreterEntryTrampoline));
   Smi* interpreter_entry_return_pc_offset(
       masm->isolate()->heap()->interpreter_entry_return_pc_offset());
   DCHECK_NE(interpreter_entry_return_pc_offset, Smi::kZero);
@@ -1234,11 +1233,12 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
                     kInterpreterBytecodeOffsetRegister);
 
   // Dispatch to the target bytecode.
-  __ movzxbp(rbx, Operand(kInterpreterBytecodeArrayRegister,
+  __ movzxbp(r11, Operand(kInterpreterBytecodeArrayRegister,
                           kInterpreterBytecodeOffsetRegister, times_1, 0));
-  __ movp(rbx, Operand(kInterpreterDispatchTableRegister, rbx,
-                       times_pointer_size, 0));
-  __ jmp(rbx);
+  __ movp(
+      kJavaScriptCallCodeStartRegister,
+      Operand(kInterpreterDispatchTableRegister, r11, times_pointer_size, 0));
+  __ jmp(kJavaScriptCallCodeStartRegister);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
@@ -1255,62 +1255,99 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
                           kInterpreterBytecodeOffsetRegister, times_1, 0));
 
   // Advance to the next bytecode.
-  AdvanceBytecodeOffset(masm, kInterpreterBytecodeArrayRegister,
-                        kInterpreterBytecodeOffsetRegister, rbx, rcx);
+  Label if_return;
+  AdvanceBytecodeOffsetOrReturn(masm, kInterpreterBytecodeArrayRegister,
+                                kInterpreterBytecodeOffsetRegister, rbx, rcx,
+                                &if_return);
 
   // Convert new bytecode offset to a Smi and save in the stackframe.
   __ Integer32ToSmi(rbx, kInterpreterBytecodeOffsetRegister);
   __ movp(Operand(rbp, InterpreterFrameConstants::kBytecodeOffsetFromFp), rbx);
 
   Generate_InterpreterEnterBytecode(masm);
+
+  // We should never take the if_return path.
+  __ bind(&if_return);
+  __ Abort(AbortReason::kInvalidBytecodeAdvance);
 }
 
 void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CheckOptimizationMarker(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- rax : argument count (preserved for callee)
-  //  -- rdx : new target (preserved for callee)
-  //  -- rdi : target function (preserved for callee)
-  // -----------------------------------
-  Register closure = rdi;
-
-  // Get the feedback vector.
-  Register feedback_vector = rbx;
-  __ movp(feedback_vector,
-          FieldOperand(closure, JSFunction::kFeedbackVectorOffset));
-  __ movp(feedback_vector, FieldOperand(feedback_vector, Cell::kValueOffset));
-
-  // The feedback vector must be defined.
-  if (FLAG_debug_code) {
-    __ CompareRoot(feedback_vector, Heap::kUndefinedValueRootIndex);
-    __ Assert(not_equal, AbortReason::kExpectedFeedbackVector);
-  }
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, rcx, r14, r15);
-
-  // Otherwise, tail call the SFI code.
-  GenerateTailCallToSharedCode(masm);
-}
-
 // TODO(jupvfranco): investigate whether there is any case where the CompileLazy
 // builtin does not set the code field in the JS function. If there isn't then
 // we do not need this builtin and can jump directly to CompileLazy.
 void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to the trampoline to the
-  // interpreter entry.
-  __ movq(rcx, FieldOperand(rdi, JSFunction::kSharedFunctionInfoOffset));
-  __ movq(rcx, FieldOperand(rcx, SharedFunctionInfo::kCodeOffset));
-  __ movq(FieldOperand(rdi, JSFunction::kCodeOffset), rcx);
+  // Set the code slot inside the JSFunction to CompileLazy.
+  __ Move(rcx, BUILTIN_CODE(masm->isolate(), CompileLazy));
+  __ movp(FieldOperand(rdi, JSFunction::kCodeOffset), rcx);
   __ RecordWriteField(rdi, JSFunction::kCodeOffset, rcx, r15, kDontSaveFPRegs,
                       OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
   // Jump to compile lazy.
   Generate_CompileLazy(masm);
 }
 
+static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
+                                      Register scratch1) {
+  // Figure out the SFI's code object.
+  Label done;
+  Label check_is_bytecode_array;
+  Label check_is_code;
+  Label check_is_fixed_array;
+  Label check_is_pre_parsed_scope_data;
+  Label check_is_function_template_info;
+
+  Register data_type = scratch1;
+
+  // IsSmi: Is builtin
+  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
+  __ Move(scratch1, ExternalReference::builtins_address(masm->isolate()));
+  SmiIndex index = masm->SmiToIndex(sfi_data, sfi_data, kPointerSizeLog2);
+  __ movp(sfi_data, Operand(scratch1, index.reg, index.scale, 0));
+  __ j(always, &done);
+
+  // Get map for subsequent checks.
+  __ bind(&check_is_bytecode_array);
+  __ movp(data_type, FieldOperand(sfi_data, HeapObject::kMapOffset));
+  __ movw(data_type, FieldOperand(data_type, Map::kInstanceTypeOffset));
+
+  // IsBytecodeArray: Interpret bytecode
+  __ cmpw(data_type, Immediate(BYTECODE_ARRAY_TYPE));
+  __ j(not_equal, &check_is_code);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
+  __ j(always, &done);
+
+  // IsCode: Run code
+  __ bind(&check_is_code);
+  __ cmpw(data_type, Immediate(CODE_TYPE));
+  __ j(equal, &done);
+
+  // IsFixedArray: Instantiate using AsmWasmData,
+  __ bind(&check_is_fixed_array);
+  __ cmpw(data_type, Immediate(FIXED_ARRAY_TYPE));
+  __ j(not_equal, &check_is_pre_parsed_scope_data);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
+  __ j(always, &done);
+
+  // IsPreParsedScopeData: Compile lazy
+  __ bind(&check_is_pre_parsed_scope_data);
+  __ cmpw(data_type, Immediate(TUPLE2_TYPE));
+  __ j(not_equal, &check_is_function_template_info);
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
+  __ j(always, &done);
+
+  // IsFunctionTemplateInfo: API call
+  __ bind(&check_is_function_template_info);
+  if (FLAG_debug_code) {
+    __ cmpw(data_type, Immediate(FUNCTION_TEMPLATE_INFO_TYPE));
+    __ Check(equal, AbortReason::kInvalidSharedFunctionInfoData);
+  }
+  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
+
+  __ bind(&done);
+}
+
 void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- rax : argument count (preserved for callee)
@@ -1325,7 +1362,7 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
 
   // Do we have a valid feedback vector?
   __ movp(feedback_vector,
-          FieldOperand(closure, JSFunction::kFeedbackVectorOffset));
+          FieldOperand(closure, JSFunction::kFeedbackCellOffset));
   __ movp(feedback_vector, FieldOperand(feedback_vector, Cell::kValueOffset));
   __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
                 &gotta_call_runtime);
@@ -1333,12 +1370,13 @@ void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
   // Is there an optimization marker or optimized code in the feedback vector?
   MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, rcx, r14, r15);
 
-  // We found no optimized code.
+  // We found no optimized code. Infer the code object needed for the SFI.
   Register entry = rcx;
   __ movp(entry, FieldOperand(closure, JSFunction::kSharedFunctionInfoOffset));
+  __ movp(entry, FieldOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
+  GetSharedFunctionInfoCode(masm, entry, rbx);
 
-  // If SFI points to anything other than CompileLazy, install that.
-  __ movp(entry, FieldOperand(entry, SharedFunctionInfo::kCodeOffset));
+  // If code entry points to anything other than CompileLazy, install that.
   __ Move(rbx, masm->CodeObject());
   __ cmpp(entry, rbx);
   __ j(equal, &gotta_call_runtime);
@@ -1406,24 +1444,9 @@ void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
 
   {
     // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over. First to the shared function info.
+    // we simply need to copy it over to the target function.
 
     Register target_builtin = scratch1;
-    Register shared = scratch0;
-
-    __ movp(shared,
-            FieldOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-    CHECK(r14 != target && r14 != scratch0 && r14 != scratch1);
-    CHECK(r15 != target && r15 != scratch0 && r15 != scratch1);
-
-    __ movp(FieldOperand(shared, SharedFunctionInfo::kCodeOffset),
-            target_builtin);
-    __ movp(r14, target_builtin);  // Write barrier clobbers r14 below.
-    __ RecordWriteField(shared, SharedFunctionInfo::kCodeOffset, r14, r15,
-                        kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-
-    // And second to the target function.
 
     __ movp(FieldOperand(target, JSFunction::kCodeOffset), target_builtin);
     __ movp(r14, target_builtin);  // Write barrier clobbers r14 below.
@@ -1809,9 +1832,6 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // -----------------------------------
   Label generic_array_code;
 
-  // Get the InternalArray function.
-  __ LoadNativeContextSlot(Context::INTERNAL_ARRAY_FUNCTION_INDEX, rdi);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin InternalArray functions should be maps.
     __ movp(rbx, FieldOperand(rdi, JSFunction::kPrototypeOrInitialMapOffset));
@@ -1827,6 +1847,7 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // Run the native code for the InternalArray function called as a normal
   // function.
   // tail call a stub
+  __ LoadRoot(rbx, Heap::kUndefinedValueRootIndex);
   InternalArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
@@ -1834,14 +1855,12 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
 void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- rax    : argc
+  //  -- rdi    : array function
   //  -- rsp[0] : return address
   //  -- rsp[8] : last argument
   // -----------------------------------
   Label generic_array_code;
 
-  // Get the Array function.
-  __ LoadNativeContextSlot(Context::ARRAY_FUNCTION_INDEX, rdi);
-
   if (FLAG_debug_code) {
     // Initial map for the builtin Array functions should be maps.
     __ movp(rbx, FieldOperand(rdi, JSFunction::kPrototypeOrInitialMapOffset));
@@ -1853,10 +1872,17 @@ void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
     __ Check(equal, AbortReason::kUnexpectedInitialMapForArrayFunction);
   }
 
+  // rbx is the AllocationSite - here undefined.
+  __ LoadRoot(rbx, Heap::kUndefinedValueRootIndex);
+  // If rdx (new target) is undefined, then this is the 'Call' case, so move
+  // rdi (the constructor) to rdx.
+  Label call;
+  __ cmpp(rdx, rbx);
+  __ j(not_equal, &call);
   __ movp(rdx, rdi);
+
   // Run the native code for the Array function called as a normal function.
-  // tail call a stub
-  __ LoadRoot(rbx, Heap::kUndefinedValueRootIndex);
+  __ bind(&call);
   ArrayConstructorStub stub(masm->isolate());
   __ TailCallStub(&stub);
 }
@@ -2015,6 +2041,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // rax : expected number of arguments
   // rdx : new target (passed through to callee)
   // rdi : function (passed through to callee)
+  static_assert(kJavaScriptCallCodeStartRegister == rcx, "ABI mismatch");
   __ movp(rcx, FieldOperand(rdi, JSFunction::kCodeOffset));
   __ addp(rcx, Immediate(Code::kHeaderSize - kHeapObjectTag));
   __ call(rcx);
@@ -2030,6 +2057,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // Dont adapt arguments.
   // -------------------------------------------
   __ bind(&dont_adapt_arguments);
+  static_assert(kJavaScriptCallCodeStartRegister == rcx, "ABI mismatch");
   __ movp(rcx, FieldOperand(rdi, JSFunction::kCodeOffset));
   __ addp(rcx, Immediate(Code::kHeaderSize - kHeapObjectTag));
   __ jmp(rcx);
@@ -2195,8 +2223,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   // Check that the function is not a "classConstructor".
   Label class_constructor;
   __ movp(rdx, FieldOperand(rdi, JSFunction::kSharedFunctionInfoOffset));
-  __ testl(FieldOperand(rdx, SharedFunctionInfo::kCompilerHintsOffset),
-           Immediate(SharedFunctionInfo::kClassConstructorMask));
+  __ testl(FieldOperand(rdx, SharedFunctionInfo::kFlagsOffset),
+           Immediate(SharedFunctionInfo::IsClassConstructorBit::kMask));
   __ j(not_zero, &class_constructor);
 
   // ----------- S t a t e -------------
@@ -2211,7 +2239,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   __ movp(rsi, FieldOperand(rdi, JSFunction::kContextOffset));
   // We need to convert the receiver for non-native sloppy mode functions.
   Label done_convert;
-  __ testl(FieldOperand(rdx, SharedFunctionInfo::kCompilerHintsOffset),
+  __ testl(FieldOperand(rdx, SharedFunctionInfo::kFlagsOffset),
            Immediate(SharedFunctionInfo::IsNativeBit::kMask |
                      SharedFunctionInfo::IsStrictBit::kMask));
   __ j(not_zero, &done_convert);
@@ -2456,6 +2484,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
   //  -- rdx : the new target (checked to be a constructor)
   //  -- rdi : the constructor to call (checked to be a JSFunction)
   // -----------------------------------
+  __ AssertConstructor(rdi);
   __ AssertFunction(rdi);
 
   // Calling convention for function specific ConstructStubs require
@@ -2477,6 +2506,7 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
   //  -- rdx : the new target (checked to be a constructor)
   //  -- rdi : the constructor to call (checked to be a JSBoundFunction)
   // -----------------------------------
+  __ AssertConstructor(rdi);
   __ AssertBoundFunction(rdi);
 
   // Push the [[BoundArguments]] onto the stack.
@@ -2511,16 +2541,17 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   Label non_constructor, non_proxy;
   __ JumpIfSmi(rdi, &non_constructor, Label::kNear);
 
-  // Dispatch based on instance type.
-  __ CmpObjectType(rdi, JS_FUNCTION_TYPE, rcx);
-  __ j(equal, BUILTIN_CODE(masm->isolate(), ConstructFunction),
-       RelocInfo::CODE_TARGET);
-
   // Check if target has a [[Construct]] internal method.
+  __ movq(rcx, FieldOperand(rdi, HeapObject::kMapOffset));
   __ testb(FieldOperand(rcx, Map::kBitFieldOffset),
            Immediate(Map::IsConstructorBit::kMask));
   __ j(zero, &non_constructor, Label::kNear);
 
+  // Dispatch based on instance type.
+  __ CmpInstanceType(rcx, JS_FUNCTION_TYPE);
+  __ j(equal, BUILTIN_CODE(masm->isolate(), ConstructFunction),
+       RelocInfo::CODE_TARGET);
+
   // Only dispatch to bound functions after checking whether they are
   // constructors.
   __ CmpInstanceType(rcx, JS_BOUND_FUNCTION_TYPE);
diff --git a/deps/v8/src/cancelable-task.cc b/deps/v8/src/cancelable-task.cc
index 7c9cc9cb938..1876773e7a9 100644
--- a/deps/v8/src/cancelable-task.cc
+++ b/deps/v8/src/cancelable-task.cc
@@ -65,7 +65,6 @@ CancelableTaskManager::TryAbortResult CancelableTaskManager::TryAbort(
   return kTaskRemoved;
 }
 
-
 void CancelableTaskManager::CancelAndWait() {
   // Clean up all cancelable fore- and background tasks. Tasks are canceled on
   // the way if possible, i.e., if they have not started yet.  After each round
diff --git a/deps/v8/src/char-predicates-inl.h b/deps/v8/src/char-predicates-inl.h
index ab5caa75573..7e198d58089 100644
--- a/deps/v8/src/char-predicates-inl.h
+++ b/deps/v8/src/char-predicates-inl.h
@@ -48,25 +48,21 @@ inline bool IsDecimalDigit(uc32 c) {
   return IsInRange(c, '0', '9');
 }
 
-
 inline bool IsHexDigit(uc32 c) {
   // ECMA-262, 3rd, 7.6 (p 15)
   return IsDecimalDigit(c) || IsInRange(AsciiAlphaToLower(c), 'a', 'f');
 }
 
-
 inline bool IsOctalDigit(uc32 c) {
   // ECMA-262, 6th, 7.8.3
   return IsInRange(c, '0', '7');
 }
 
-
 inline bool IsBinaryDigit(uc32 c) {
   // ECMA-262, 6th, 7.8.3
   return c == '0' || c == '1';
 }
 
-
 inline bool IsRegExpWord(uc16 c) {
   return IsInRange(AsciiAlphaToLower(c), 'a', 'z')
       || IsDecimalDigit(c)
diff --git a/deps/v8/src/code-events.h b/deps/v8/src/code-events.h
index 4199ec3bbee..067b9ad8ea3 100644
--- a/deps/v8/src/code-events.h
+++ b/deps/v8/src/code-events.h
@@ -9,6 +9,7 @@
 
 #include "src/base/platform/mutex.h"
 #include "src/globals.h"
+#include "src/vector.h"
 
 namespace v8 {
 namespace internal {
@@ -18,6 +19,11 @@ class Name;
 class SharedFunctionInfo;
 class String;
 
+namespace wasm {
+class WasmCode;
+using WasmName = Vector<const char>;
+}  // namespace wasm
+
 #define LOG_EVENTS_AND_TAGS_LIST(V)                                      \
   V(CODE_CREATION_EVENT, "code-creation")                                \
   V(CODE_DISABLE_OPT_EVENT, "code-disable-optimization")                 \
@@ -64,6 +70,8 @@ class CodeEventListener {
   virtual void CodeCreateEvent(LogEventsAndTags tag, AbstractCode* code,
                                SharedFunctionInfo* shared, Name* source,
                                int line, int column) = 0;
+  virtual void CodeCreateEvent(LogEventsAndTags tag, const wasm::WasmCode* code,
+                               wasm::WasmName name) = 0;
   virtual void CallbackEvent(Name* name, Address entry_point) = 0;
   virtual void GetterCallbackEvent(Name* name, Address entry_point) = 0;
   virtual void SetterCallbackEvent(Name* name, Address entry_point) = 0;
@@ -114,6 +122,10 @@ class CodeEventDispatcher {
     CODE_EVENT_DISPATCH(
         CodeCreateEvent(tag, code, shared, source, line, column));
   }
+  void CodeCreateEvent(LogEventsAndTags tag, const wasm::WasmCode* code,
+                       wasm::WasmName name) {
+    CODE_EVENT_DISPATCH(CodeCreateEvent(tag, code, name));
+  }
   void CallbackEvent(Name* name, Address entry_point) {
     CODE_EVENT_DISPATCH(CallbackEvent(name, entry_point));
   }
diff --git a/deps/v8/src/code-stub-assembler.cc b/deps/v8/src/code-stub-assembler.cc
index 2027d208abc..8e709e9f5f6 100644
--- a/deps/v8/src/code-stub-assembler.cc
+++ b/deps/v8/src/code-stub-assembler.cc
@@ -1,7 +1,9 @@
 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+
 #include "src/code-stub-assembler.h"
+
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
@@ -45,6 +47,23 @@ void CodeStubAssembler::HandleBreakOnNode() {
   BreakOnNode(node_id);
 }
 
+void CodeStubAssembler::Assert(const BranchGenerator& branch,
+                               const char* message, const char* file, int line,
+                               Node* extra_node1, const char* extra_node1_name,
+                               Node* extra_node2, const char* extra_node2_name,
+                               Node* extra_node3, const char* extra_node3_name,
+                               Node* extra_node4, const char* extra_node4_name,
+                               Node* extra_node5,
+                               const char* extra_node5_name) {
+#if defined(DEBUG)
+  if (FLAG_debug_code) {
+    Check(branch, message, file, line, extra_node1, extra_node1_name,
+          extra_node2, extra_node2_name, extra_node3, extra_node3_name,
+          extra_node4, extra_node4_name, extra_node5, extra_node5_name);
+  }
+#endif
+}
+
 void CodeStubAssembler::Assert(const NodeGenerator& condition_body,
                                const char* message, const char* file, int line,
                                Node* extra_node1, const char* extra_node1_name,
@@ -74,7 +93,7 @@ void MaybePrintNodeWithName(CodeStubAssembler* csa, Node* node,
 }  // namespace
 #endif
 
-void CodeStubAssembler::Check(const NodeGenerator& condition_body,
+void CodeStubAssembler::Check(const BranchGenerator& branch,
                               const char* message, const char* file, int line,
                               Node* extra_node1, const char* extra_node1_name,
                               Node* extra_node2, const char* extra_node2_name,
@@ -88,9 +107,7 @@ void CodeStubAssembler::Check(const NodeGenerator& condition_body,
   } else {
     Comment("[ Assert");
   }
-  Node* condition = condition_body();
-  DCHECK_NOT_NULL(condition);
-  Branch(condition, &ok, &not_ok);
+  branch(&ok, &not_ok);
 
   BIND(&not_ok);
   DCHECK_NOT_NULL(message);
@@ -119,10 +136,28 @@ void CodeStubAssembler::Check(const NodeGenerator& condition_body,
   Comment("] Assert");
 }
 
-Node* CodeStubAssembler::Select(SloppyTNode<BoolT> condition,
-                                const NodeGenerator& true_body,
-                                const NodeGenerator& false_body,
-                                MachineRepresentation rep) {
+void CodeStubAssembler::Check(const NodeGenerator& condition_body,
+                              const char* message, const char* file, int line,
+                              Node* extra_node1, const char* extra_node1_name,
+                              Node* extra_node2, const char* extra_node2_name,
+                              Node* extra_node3, const char* extra_node3_name,
+                              Node* extra_node4, const char* extra_node4_name,
+                              Node* extra_node5, const char* extra_node5_name) {
+  BranchGenerator branch = [=](Label* ok, Label* not_ok) {
+    Node* condition = condition_body();
+    DCHECK_NOT_NULL(condition);
+    Branch(condition, ok, not_ok);
+  };
+
+  Check(branch, message, file, line, extra_node1, extra_node1_name, extra_node2,
+        extra_node2_name, extra_node3, extra_node3_name, extra_node4,
+        extra_node4_name, extra_node5, extra_node5_name);
+}
+
+Node* CodeStubAssembler::SelectImpl(TNode<BoolT> condition,
+                                    const NodeGenerator& true_body,
+                                    const NodeGenerator& false_body,
+                                    MachineRepresentation rep) {
   VARIABLE(value, rep);
   Label vtrue(this), vfalse(this), end(this);
   Branch(condition, &vtrue, &vfalse);
@@ -142,37 +177,28 @@ Node* CodeStubAssembler::Select(SloppyTNode<BoolT> condition,
   return value.value();
 }
 
-Node* CodeStubAssembler::SelectConstant(Node* condition, Node* true_value,
-                                        Node* false_value,
-                                        MachineRepresentation rep) {
-  return Select(condition, [=] { return true_value; },
-                [=] { return false_value; }, rep);
+TNode<Int32T> CodeStubAssembler::SelectInt32Constant(
+    SloppyTNode<BoolT> condition, int true_value, int false_value) {
+  return SelectConstant<Int32T>(condition, Int32Constant(true_value),
+                                Int32Constant(false_value));
 }
 
-Node* CodeStubAssembler::SelectInt32Constant(Node* condition, int true_value,
-                                             int false_value) {
-  return SelectConstant(condition, Int32Constant(true_value),
-                        Int32Constant(false_value),
-                        MachineRepresentation::kWord32);
+TNode<IntPtrT> CodeStubAssembler::SelectIntPtrConstant(
+    SloppyTNode<BoolT> condition, int true_value, int false_value) {
+  return SelectConstant<IntPtrT>(condition, IntPtrConstant(true_value),
+                                 IntPtrConstant(false_value));
 }
 
-Node* CodeStubAssembler::SelectIntPtrConstant(Node* condition, int true_value,
-                                              int false_value) {
-  return SelectConstant(condition, IntPtrConstant(true_value),
-                        IntPtrConstant(false_value),
-                        MachineType::PointerRepresentation());
+TNode<Oddball> CodeStubAssembler::SelectBooleanConstant(
+    SloppyTNode<BoolT> condition) {
+  return SelectConstant<Oddball>(condition, TrueConstant(), FalseConstant());
 }
 
-Node* CodeStubAssembler::SelectBooleanConstant(Node* condition) {
-  return SelectConstant(condition, TrueConstant(), FalseConstant(),
-                        MachineRepresentation::kTagged);
-}
-
-Node* CodeStubAssembler::SelectSmiConstant(Node* condition, Smi* true_value,
-                                           Smi* false_value) {
-  return SelectConstant(condition, SmiConstant(true_value),
-                        SmiConstant(false_value),
-                        MachineRepresentation::kTaggedSigned);
+TNode<Smi> CodeStubAssembler::SelectSmiConstant(SloppyTNode<BoolT> condition,
+                                                Smi* true_value,
+                                                Smi* false_value) {
+  return SelectConstant<Smi>(condition, SmiConstant(true_value),
+                             SmiConstant(false_value));
 }
 
 Node* CodeStubAssembler::NoContextConstant() {
@@ -277,11 +303,10 @@ Node* CodeStubAssembler::MatchesParameterMode(Node* value, ParameterMode mode) {
 TNode<BoolT> CodeStubAssembler::WordIsPowerOfTwo(SloppyTNode<IntPtrT> value) {
   // value && !(value & (value - 1))
   return WordEqual(
-      Select(
+      Select<IntPtrT>(
           WordEqual(value, IntPtrConstant(0)),
           [=] { return IntPtrConstant(1); },
-          [=] { return WordAnd(value, IntPtrSub(value, IntPtrConstant(1))); },
-          MachineType::PointerRepresentation()),
+          [=] { return WordAnd(value, IntPtrSub(value, IntPtrConstant(1))); }),
       IntPtrConstant(0));
 }
 
@@ -503,7 +528,7 @@ Node* CodeStubAssembler::SmiShiftBitsConstant() {
   return IntPtrConstant(kSmiShiftSize + kSmiTagSize);
 }
 
-TNode<Smi> CodeStubAssembler::SmiFromWord32(SloppyTNode<Int32T> value) {
+TNode<Smi> CodeStubAssembler::SmiFromInt32(SloppyTNode<Int32T> value) {
   TNode<IntPtrT> value_intptr = ChangeInt32ToIntPtr(value);
   return BitcastWordToTaggedSigned(
       WordShl(value_intptr, SmiShiftBitsConstant()));
@@ -526,13 +551,13 @@ TNode<IntPtrT> CodeStubAssembler::SmiUntag(SloppyTNode<Smi> value) {
       WordSar(BitcastTaggedToWord(value), SmiShiftBitsConstant()));
 }
 
-TNode<Int32T> CodeStubAssembler::SmiToWord32(SloppyTNode<Smi> value) {
+TNode<Int32T> CodeStubAssembler::SmiToInt32(SloppyTNode<Smi> value) {
   TNode<IntPtrT> result = SmiUntag(value);
-  return TruncateWordToWord32(result);
+  return TruncateIntPtrToInt32(result);
 }
 
 TNode<Float64T> CodeStubAssembler::SmiToFloat64(SloppyTNode<Smi> value) {
-  return ChangeInt32ToFloat64(SmiToWord32(value));
+  return ChangeInt32ToFloat64(SmiToInt32(value));
 }
 
 TNode<Smi> CodeStubAssembler::SmiMax(SloppyTNode<Smi> a, SloppyTNode<Smi> b) {
@@ -581,29 +606,68 @@ TNode<Object> CodeStubAssembler::NumberMin(SloppyTNode<Object> a,
   return TNode<Object>::UncheckedCast(result.value());
 }
 
-Node* CodeStubAssembler::SmiMod(Node* a, Node* b) {
-  VARIABLE(var_result, MachineRepresentation::kTagged);
+TNode<IntPtrT> CodeStubAssembler::ConvertToRelativeIndex(
+    TNode<Context> context, TNode<Object> index, TNode<IntPtrT> length) {
+  TVARIABLE(IntPtrT, result);
+
+  TNode<Number> const index_int =
+      ToInteger_Inline(context, index, CodeStubAssembler::kTruncateMinusZero);
+  TNode<IntPtrT> zero = IntPtrConstant(0);
+
+  Label done(this);
+  Label if_issmi(this), if_isheapnumber(this, Label::kDeferred);
+  Branch(TaggedIsSmi(index_int), &if_issmi, &if_isheapnumber);
+
+  BIND(&if_issmi);
+  {
+    TNode<Smi> const index_smi = CAST(index_int);
+    result = Select<IntPtrT>(
+        IntPtrLessThan(SmiUntag(index_smi), zero),
+        [=] { return IntPtrMax(IntPtrAdd(length, SmiUntag(index_smi)), zero); },
+        [=] { return IntPtrMin(SmiUntag(index_smi), length); });
+    Goto(&done);
+  }
+
+  BIND(&if_isheapnumber);
+  {
+    // If {index} is a heap number, it is definitely out of bounds. If it is
+    // negative, {index} = max({length} + {index}),0) = 0'. If it is positive,
+    // set {index} to {length}.
+    TNode<HeapNumber> const index_hn = CAST(index_int);
+    TNode<Float64T> const float_zero = Float64Constant(0.);
+    TNode<Float64T> const index_float = LoadHeapNumberValue(index_hn);
+    result = SelectConstant<IntPtrT>(Float64LessThan(index_float, float_zero),
+                                     zero, length);
+    Goto(&done);
+  }
+  BIND(&done);
+  return result.value();
+}
+
+TNode<Number> CodeStubAssembler::SmiMod(SloppyTNode<Smi> a,
+                                        SloppyTNode<Smi> b) {
+  TVARIABLE(Number, var_result);
   Label return_result(this, &var_result),
       return_minuszero(this, Label::kDeferred),
       return_nan(this, Label::kDeferred);
 
   // Untag {a} and {b}.
-  a = SmiToWord32(a);
-  b = SmiToWord32(b);
+  TNode<Int32T> int_a = SmiToInt32(a);
+  TNode<Int32T> int_b = SmiToInt32(b);
 
   // Return NaN if {b} is zero.
-  GotoIf(Word32Equal(b, Int32Constant(0)), &return_nan);
+  GotoIf(Word32Equal(int_b, Int32Constant(0)), &return_nan);
 
   // Check if {a} is non-negative.
   Label if_aisnotnegative(this), if_aisnegative(this, Label::kDeferred);
-  Branch(Int32LessThanOrEqual(Int32Constant(0), a), &if_aisnotnegative,
+  Branch(Int32LessThanOrEqual(Int32Constant(0), int_a), &if_aisnotnegative,
          &if_aisnegative);
 
   BIND(&if_aisnotnegative);
   {
     // Fast case, don't need to check any other edge cases.
-    Node* r = Int32Mod(a, b);
-    var_result.Bind(SmiFromWord32(r));
+    TNode<Int32T> r = Int32Mod(int_a, int_b);
+    var_result = SmiFromInt32(r);
     Goto(&return_result);
   }
 
@@ -613,35 +677,35 @@ Node* CodeStubAssembler::SmiMod(Node* a, Node* b) {
       // Check if {a} is kMinInt and {b} is -1 (only relevant if the
       // kMinInt is actually representable as a Smi).
       Label join(this);
-      GotoIfNot(Word32Equal(a, Int32Constant(kMinInt)), &join);
-      GotoIf(Word32Equal(b, Int32Constant(-1)), &return_minuszero);
+      GotoIfNot(Word32Equal(int_a, Int32Constant(kMinInt)), &join);
+      GotoIf(Word32Equal(int_b, Int32Constant(-1)), &return_minuszero);
       Goto(&join);
       BIND(&join);
     }
 
     // Perform the integer modulus operation.
-    Node* r = Int32Mod(a, b);
+    TNode<Int32T> r = Int32Mod(int_a, int_b);
 
     // Check if {r} is zero, and if so return -0, because we have to
     // take the sign of the left hand side {a}, which is negative.
     GotoIf(Word32Equal(r, Int32Constant(0)), &return_minuszero);
 
     // The remainder {r} can be outside the valid Smi range on 32bit
-    // architectures, so we cannot just say SmiFromWord32(r) here.
-    var_result.Bind(ChangeInt32ToTagged(r));
+    // architectures, so we cannot just say SmiFromInt32(r) here.
+    var_result = ChangeInt32ToTagged(r);
     Goto(&return_result);
   }
 
   BIND(&return_minuszero);
-  var_result.Bind(MinusZeroConstant());
+  var_result = MinusZeroConstant();
   Goto(&return_result);
 
   BIND(&return_nan);
-  var_result.Bind(NanConstant());
+  var_result = NanConstant();
   Goto(&return_result);
 
   BIND(&return_result);
-  return TNode<Object>::UncheckedCast(var_result.value());
+  return var_result.value();
 }
 
 TNode<Number> CodeStubAssembler::SmiMul(SloppyTNode<Smi> a,
@@ -652,8 +716,8 @@ TNode<Number> CodeStubAssembler::SmiMul(SloppyTNode<Smi> a,
   Label return_result(this, &var_result);
 
   // Both {a} and {b} are Smis. Convert them to integers and multiply.
-  Node* lhs32 = SmiToWord32(a);
-  Node* rhs32 = SmiToWord32(b);
+  Node* lhs32 = SmiToInt32(a);
+  Node* rhs32 = SmiToInt32(b);
   Node* pair = Int32MulWithOverflow(lhs32, rhs32);
 
   Node* overflow = Projection(1, pair);
@@ -702,7 +766,7 @@ TNode<Number> CodeStubAssembler::SmiMul(SloppyTNode<Smi> a,
   }
 
   BIND(&return_result);
-  return var_result;
+  return var_result.value();
 }
 
 Node* CodeStubAssembler::TrySmiDiv(Node* dividend, Node* divisor,
@@ -724,8 +788,8 @@ Node* CodeStubAssembler::TrySmiDiv(Node* dividend, Node* divisor,
   }
   BIND(&dividend_is_not_zero);
 
-  Node* untagged_divisor = SmiToWord32(divisor);
-  Node* untagged_dividend = SmiToWord32(dividend);
+  Node* untagged_divisor = SmiToInt32(divisor);
+  Node* untagged_dividend = SmiToInt32(dividend);
 
   // Do floating point division if {dividend} is kMinInt (or kMinInt - 1
   // if the Smi size is 31) and {divisor} is -1.
@@ -749,10 +813,10 @@ Node* CodeStubAssembler::TrySmiDiv(Node* dividend, Node* divisor,
   // Do floating point division if the remainder is not 0.
   GotoIf(Word32NotEqual(untagged_dividend, truncated), bailout);
 
-  return SmiFromWord32(untagged_result);
+  return SmiFromInt32(untagged_result);
 }
 
-TNode<Int32T> CodeStubAssembler::TruncateWordToWord32(
+TNode<Int32T> CodeStubAssembler::TruncateIntPtrToInt32(
     SloppyTNode<IntPtrT> value) {
   if (Is64()) {
     return TruncateInt64ToInt32(ReinterpretCast<Int64T>(value));
@@ -860,16 +924,43 @@ TNode<BoolT> CodeStubAssembler::IsFastJSArray(SloppyTNode<Object> object,
   TVARIABLE(BoolT, var_result);
   BIND(&if_true);
   {
-    var_result = ReinterpretCast<BoolT>(Int32Constant(1));
+    var_result = Int32TrueConstant();
+    Goto(&exit);
+  }
+  BIND(&if_false);
+  {
+    var_result = Int32FalseConstant();
+    Goto(&exit);
+  }
+  BIND(&exit);
+  return var_result.value();
+}
+
+TNode<BoolT> CodeStubAssembler::IsFastJSArrayWithNoCustomIteration(
+    TNode<Object> object, TNode<Context> context,
+    TNode<Context> native_context) {
+  Label if_false(this, Label::kDeferred), if_fast(this), exit(this);
+  TVARIABLE(BoolT, var_result);
+  GotoIfForceSlowPath(&if_false);
+  BranchIfFastJSArray(object, context, &if_fast, &if_false);
+  BIND(&if_fast);
+  {
+    // Check that the Array.prototype hasn't been modified in a way that would
+    // affect iteration.
+    Node* protector_cell = LoadRoot(Heap::kArrayIteratorProtectorRootIndex);
+    DCHECK(isolate()->heap()->array_iterator_protector()->IsPropertyCell());
+    var_result =
+        WordEqual(LoadObjectField(protector_cell, PropertyCell::kValueOffset),
+                  SmiConstant(Isolate::kProtectorValid));
     Goto(&exit);
   }
   BIND(&if_false);
   {
-    var_result = ReinterpretCast<BoolT>(Int32Constant(0));
+    var_result = Int32FalseConstant();
     Goto(&exit);
   }
   BIND(&exit);
-  return var_result;
+  return var_result.value();
 }
 
 void CodeStubAssembler::BranchIfFastJSArray(Node* object, Node* context,
@@ -1162,12 +1253,14 @@ Node* CodeStubAssembler::LoadBufferObject(Node* buffer, int offset,
 
 Node* CodeStubAssembler::LoadObjectField(SloppyTNode<HeapObject> object,
                                          int offset, MachineType rep) {
+  AssertIsStrongHeapObject(object);
   return Load(rep, object, IntPtrConstant(offset - kHeapObjectTag));
 }
 
 Node* CodeStubAssembler::LoadObjectField(SloppyTNode<HeapObject> object,
                                          SloppyTNode<IntPtrT> offset,
                                          MachineType rep) {
+  AssertIsStrongHeapObject(object);
   return Load(rep, object, IntPtrSub(offset, IntPtrConstant(kHeapObjectTag)));
 }
 
@@ -1180,7 +1273,8 @@ TNode<IntPtrT> CodeStubAssembler::LoadAndUntagObjectField(
     return ChangeInt32ToIntPtr(
         LoadObjectField(object, offset, MachineType::Int32()));
   } else {
-    return SmiToWord(LoadObjectField(object, offset, MachineType::AnyTagged()));
+    return SmiToIntPtr(
+        LoadObjectField(object, offset, MachineType::AnyTagged()));
   }
 }
 
@@ -1193,7 +1287,7 @@ TNode<Int32T> CodeStubAssembler::LoadAndUntagToWord32ObjectField(Node* object,
     return UncheckedCast<Int32T>(
         LoadObjectField(object, offset, MachineType::Int32()));
   } else {
-    return SmiToWord32(
+    return SmiToInt32(
         LoadObjectField(object, offset, MachineType::AnyTagged()));
   }
 }
@@ -1206,7 +1300,7 @@ TNode<IntPtrT> CodeStubAssembler::LoadAndUntagSmi(Node* base, int index) {
     return ChangeInt32ToIntPtr(
         Load(MachineType::Int32(), base, IntPtrConstant(index)));
   } else {
-    return SmiToWord(
+    return SmiToIntPtr(
         Load(MachineType::AnyTagged(), base, IntPtrConstant(index)));
   }
 }
@@ -1222,8 +1316,8 @@ Node* CodeStubAssembler::LoadAndUntagToWord32Root(
 #endif
     return Load(MachineType::Int32(), roots_array_start, IntPtrConstant(index));
   } else {
-    return SmiToWord32(Load(MachineType::AnyTagged(), roots_array_start,
-                            IntPtrConstant(index)));
+    return SmiToInt32(Load(MachineType::AnyTagged(), roots_array_start,
+                           IntPtrConstant(index)));
   }
 }
 
@@ -1260,23 +1354,44 @@ TNode<Int32T> CodeStubAssembler::LoadInstanceType(
   return LoadMapInstanceType(LoadMap(object));
 }
 
-Node* CodeStubAssembler::HasInstanceType(Node* object,
-                                         InstanceType instance_type) {
+TNode<BoolT> CodeStubAssembler::HasInstanceType(SloppyTNode<HeapObject> object,
+                                                InstanceType instance_type) {
   return InstanceTypeEqual(LoadInstanceType(object), instance_type);
 }
 
-Node* CodeStubAssembler::DoesntHaveInstanceType(Node* object,
-                                                InstanceType instance_type) {
+TNode<BoolT>
+CodeStubAssembler::InitialArrayPrototypeHasInitialArrayPrototypeMap(
+    TNode<Context> native_context) {
+  CSA_ASSERT(this, IsNativeContext(native_context));
+  TNode<Map> proto_map = LoadMap(CAST(LoadContextElement(
+      native_context, Context::INITIAL_ARRAY_PROTOTYPE_INDEX)));
+  TNode<Map> initial_map = CAST(LoadContextElement(
+      native_context, Context::INITIAL_ARRAY_PROTOTYPE_MAP_INDEX));
+  return WordEqual(proto_map, initial_map);
+}
+
+TNode<BoolT> CodeStubAssembler::HasInitialFastElementsKindMap(
+    TNode<Context> native_context, TNode<JSArray> jsarray) {
+  CSA_ASSERT(this, IsNativeContext(native_context));
+  TNode<Map> map = LoadMap(jsarray);
+  TNode<Int32T> elements_kind = LoadMapElementsKind(map);
+  TNode<Map> initial_jsarray_element_map =
+      LoadJSArrayElementsMap(elements_kind, native_context);
+  return WordEqual(initial_jsarray_element_map, map);
+}
+
+TNode<BoolT> CodeStubAssembler::DoesntHaveInstanceType(
+    SloppyTNode<HeapObject> object, InstanceType instance_type) {
   return Word32NotEqual(LoadInstanceType(object), Int32Constant(instance_type));
 }
 
-Node* CodeStubAssembler::TaggedDoesntHaveInstanceType(Node* any_tagged,
-                                                      InstanceType type) {
+TNode<BoolT> CodeStubAssembler::TaggedDoesntHaveInstanceType(
+    SloppyTNode<HeapObject> any_tagged, InstanceType type) {
   /* return Phi <TaggedIsSmi(val), DoesntHaveInstanceType(val, type)> */
-  Node* tagged_is_smi = TaggedIsSmi(any_tagged);
-  return Select(tagged_is_smi, [=]() { return tagged_is_smi; },
-                [=]() { return DoesntHaveInstanceType(any_tagged, type); },
-                MachineRepresentation::kBit);
+  TNode<BoolT> tagged_is_smi = TaggedIsSmi(any_tagged);
+  return Select<BoolT>(
+      tagged_is_smi, [=]() { return tagged_is_smi; },
+      [=]() { return DoesntHaveInstanceType(any_tagged, type); });
 }
 
 TNode<HeapObject> CodeStubAssembler::LoadFastProperties(
@@ -1290,9 +1405,11 @@ TNode<HeapObject> CodeStubAssembler::LoadFastProperties(
 TNode<HeapObject> CodeStubAssembler::LoadSlowProperties(
     SloppyTNode<JSObject> object) {
   CSA_SLOW_ASSERT(this, IsDictionaryMap(LoadMap(object)));
-  Node* properties = LoadObjectField(object, JSObject::kPropertiesOrHashOffset);
-  return SelectTaggedConstant<HeapObject>(
-      TaggedIsSmi(properties), EmptyPropertyDictionaryConstant(), properties);
+  TNode<Object> properties =
+      LoadObjectField(object, JSObject::kPropertiesOrHashOffset);
+  return SelectTaggedConstant<HeapObject>(TaggedIsSmi(properties),
+                                          EmptyPropertyDictionaryConstant(),
+                                          CAST(properties));
 }
 
 TNode<FixedArrayBase> CodeStubAssembler::LoadElements(
@@ -1300,7 +1417,7 @@ TNode<FixedArrayBase> CodeStubAssembler::LoadElements(
   return CAST(LoadObjectField(object, JSObject::kElementsOffset));
 }
 
-TNode<Object> CodeStubAssembler::LoadJSArrayLength(SloppyTNode<JSArray> array) {
+TNode<Number> CodeStubAssembler::LoadJSArrayLength(SloppyTNode<JSArray> array) {
   CSA_ASSERT(this, IsJSArray(array));
   return CAST(LoadObjectField(array, JSArray::kLengthOffset));
 }
@@ -1361,7 +1478,7 @@ TNode<DescriptorArray> CodeStubAssembler::LoadMapDescriptors(
 
 TNode<Object> CodeStubAssembler::LoadMapPrototype(SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
-  return CAST(LoadObjectField(map, Map::kPrototypeOffset));
+  return LoadObjectField(map, Map::kPrototypeOffset);
 }
 
 TNode<PrototypeInfo> CodeStubAssembler::LoadMapPrototypeInfo(
@@ -1412,16 +1529,16 @@ TNode<Object> CodeStubAssembler::LoadMapConstructor(SloppyTNode<Map> map) {
   Goto(&loop);
   BIND(&loop);
   {
-    GotoIf(TaggedIsSmi(result), &done);
+    GotoIf(TaggedIsSmi(result.value()), &done);
     Node* is_map_type =
-        InstanceTypeEqual(LoadInstanceType(CAST(result)), MAP_TYPE);
+        InstanceTypeEqual(LoadInstanceType(CAST(result.value())), MAP_TYPE);
     GotoIfNot(is_map_type, &done);
-    result =
-        LoadObjectField(CAST(result), Map::kConstructorOrBackPointerOffset);
+    result = LoadObjectField(CAST(result.value()),
+                             Map::kConstructorOrBackPointerOffset);
     Goto(&loop);
   }
   BIND(&done);
-  return result;
+  return result.value();
 }
 
 Node* CodeStubAssembler::LoadMapEnumLength(SloppyTNode<Map> map) {
@@ -1430,11 +1547,11 @@ Node* CodeStubAssembler::LoadMapEnumLength(SloppyTNode<Map> map) {
   return DecodeWordFromWord32<Map::EnumLengthBits>(bit_field3);
 }
 
-Node* CodeStubAssembler::LoadMapBackPointer(SloppyTNode<Map> map) {
-  Node* object = LoadObjectField(map, Map::kConstructorOrBackPointerOffset);
-  return Select(IsMap(object), [=] { return object; },
-                [=] { return UndefinedConstant(); },
-                MachineRepresentation::kTagged);
+TNode<Object> CodeStubAssembler::LoadMapBackPointer(SloppyTNode<Map> map) {
+  TNode<Object> object =
+      LoadObjectField(map, Map::kConstructorOrBackPointerOffset);
+  return Select<Object>(IsMap(object), [=] { return object; },
+                        [=] { return UndefinedConstant(); });
 }
 
 TNode<IntPtrT> CodeStubAssembler::LoadJSReceiverIdentityHash(
@@ -1480,18 +1597,18 @@ TNode<IntPtrT> CodeStubAssembler::LoadJSReceiverIdentityHash(
 
   BIND(&if_property_dictionary);
   {
-    var_hash = SmiUntag(
-        LoadFixedArrayElement(properties, NameDictionary::kObjectHashIndex));
+    var_hash = SmiUntag(CAST(
+        LoadFixedArrayElement(properties, NameDictionary::kObjectHashIndex)));
     Goto(&done);
   }
 
   BIND(&done);
   if (if_no_hash != nullptr) {
-    GotoIf(
-        IntPtrEqual(var_hash, IntPtrConstant(PropertyArray::kNoHashSentinel)),
-        if_no_hash);
+    GotoIf(IntPtrEqual(var_hash.value(),
+                       IntPtrConstant(PropertyArray::kNoHashSentinel)),
+           if_no_hash);
   }
-  return var_hash;
+  return var_hash.value();
 }
 
 TNode<Uint32T> CodeStubAssembler::LoadNameHashField(SloppyTNode<Name> name) {
@@ -1551,77 +1668,208 @@ TNode<Object> CodeStubAssembler::LoadWeakCellValue(
   return value;
 }
 
-Node* CodeStubAssembler::LoadFixedArrayElement(Node* object, Node* index_node,
-                                               int additional_offset,
-                                               ParameterMode parameter_mode) {
+TNode<Object> CodeStubAssembler::LoadFixedArrayElement(
+    SloppyTNode<Object> object, Node* index_node, int additional_offset,
+    ParameterMode parameter_mode, LoadSensitivity needs_poisoning) {
   CSA_SLOW_ASSERT(this, IntPtrGreaterThanOrEqual(
-                            ParameterToWord(index_node, parameter_mode),
+                            ParameterToIntPtr(index_node, parameter_mode),
                             IntPtrConstant(0)));
   int32_t header_size =
       FixedArray::kHeaderSize + additional_offset - kHeapObjectTag;
-  Node* offset = ElementOffsetFromIndex(index_node, HOLEY_ELEMENTS,
-                                        parameter_mode, header_size);
-  return Load(MachineType::AnyTagged(), object, offset);
+  TNode<IntPtrT> offset = ElementOffsetFromIndex(index_node, HOLEY_ELEMENTS,
+                                                 parameter_mode, header_size);
+  return UncheckedCast<Object>(
+      Load(MachineType::AnyTagged(), object, offset, needs_poisoning));
+}
+
+TNode<RawPtrT> CodeStubAssembler::LoadFixedTypedArrayBackingStore(
+    TNode<FixedTypedArrayBase> typed_array) {
+  // Backing store = external_pointer + base_pointer.
+  Node* external_pointer =
+      LoadObjectField(typed_array, FixedTypedArrayBase::kExternalPointerOffset,
+                      MachineType::Pointer());
+  Node* base_pointer =
+      LoadObjectField(typed_array, FixedTypedArrayBase::kBasePointerOffset);
+  return UncheckedCast<RawPtrT>(
+      IntPtrAdd(external_pointer, BitcastTaggedToWord(base_pointer)));
 }
 
-Node* CodeStubAssembler::LoadFixedTypedArrayElement(
+Node* CodeStubAssembler::LoadFixedBigInt64ArrayElementAsTagged(
+    Node* data_pointer, Node* offset) {
+  TVARIABLE(BigInt, var_result);
+  Label done(this), if_zero(this);
+  if (Is64()) {
+    TNode<IntPtrT> value = UncheckedCast<IntPtrT>(
+        Load(MachineType::IntPtr(), data_pointer, offset));
+    Label if_positive(this), if_negative(this);
+    GotoIf(IntPtrEqual(value, IntPtrConstant(0)), &if_zero);
+    var_result = AllocateRawBigInt(IntPtrConstant(1));
+    Branch(IntPtrGreaterThan(value, IntPtrConstant(0)), &if_positive,
+           &if_negative);
+
+    BIND(&if_positive);
+    {
+      StoreBigIntBitfield(var_result.value(),
+                          IntPtrConstant(BigInt::SignBits::encode(false) |
+                                         BigInt::LengthBits::encode(1)));
+      StoreBigIntDigit(var_result.value(), 0, Unsigned(value));
+      Goto(&done);
+    }
+
+    BIND(&if_negative);
+    {
+      StoreBigIntBitfield(var_result.value(),
+                          IntPtrConstant(BigInt::SignBits::encode(true) |
+                                         BigInt::LengthBits::encode(1)));
+      StoreBigIntDigit(var_result.value(), 0,
+                       Unsigned(IntPtrSub(IntPtrConstant(0), value)));
+      Goto(&done);
+    }
+  } else {
+    DCHECK(!Is64());
+    TVARIABLE(WordT, var_sign, IntPtrConstant(BigInt::SignBits::encode(false)));
+    TVARIABLE(IntPtrT, var_low);
+    TVARIABLE(IntPtrT, var_high);
+    var_low = UncheckedCast<IntPtrT>(
+        Load(MachineType::UintPtr(), data_pointer, offset));
+    var_high = UncheckedCast<IntPtrT>(
+        Load(MachineType::UintPtr(), data_pointer,
+             Int32Add(offset, Int32Constant(kPointerSize))));
+
+    Label high_zero(this), negative(this), allocate_one_digit(this),
+        allocate_two_digits(this);
+
+    GotoIf(WordEqual(var_high.value(), IntPtrConstant(0)), &high_zero);
+    Branch(IntPtrLessThan(var_high.value(), IntPtrConstant(0)), &negative,
+           &allocate_two_digits);
+
+    BIND(&high_zero);
+    Branch(WordEqual(var_low.value(), IntPtrConstant(0)), &if_zero,
+           &allocate_one_digit);
+
+    BIND(&negative);
+    {
+      var_sign = IntPtrConstant(BigInt::SignBits::encode(true));
+      // We must negate the value by computing "0 - (high|low)", performing
+      // both parts of the subtraction separately and manually taking care
+      // of the carry bit (which is 1 iff low != 0).
+      var_high = IntPtrSub(IntPtrConstant(0), var_high.value());
+      Label carry(this), no_carry(this);
+      Branch(WordEqual(var_low.value(), IntPtrConstant(0)), &no_carry, &carry);
+      BIND(&carry);
+      var_high = IntPtrSub(var_high.value(), IntPtrConstant(1));
+      Goto(&no_carry);
+      BIND(&no_carry);
+      var_low = IntPtrSub(IntPtrConstant(0), var_low.value());
+      // var_high was non-zero going into this block, but subtracting the
+      // carry bit from it could bring us back onto the "one digit" path.
+      Branch(WordEqual(var_high.value(), IntPtrConstant(0)),
+             &allocate_one_digit, &allocate_two_digits);
+    }
+
+    BIND(&allocate_one_digit);
+    {
+      var_result = AllocateRawBigInt(IntPtrConstant(1));
+      StoreBigIntBitfield(
+          var_result.value(),
+          WordOr(var_sign.value(),
+                 IntPtrConstant(BigInt::LengthBits::encode(1))));
+      StoreBigIntDigit(var_result.value(), 0, Unsigned(var_low.value()));
+      Goto(&done);
+    }
+
+    BIND(&allocate_two_digits);
+    {
+      var_result = AllocateRawBigInt(IntPtrConstant(2));
+      StoreBigIntBitfield(
+          var_result.value(),
+          WordOr(var_sign.value(),
+                 IntPtrConstant(BigInt::LengthBits::encode(2))));
+      StoreBigIntDigit(var_result.value(), 0, Unsigned(var_low.value()));
+      StoreBigIntDigit(var_result.value(), 1, Unsigned(var_high.value()));
+      Goto(&done);
+    }
+  }
+  BIND(&if_zero);
+  var_result = AllocateBigInt(IntPtrConstant(0));
+  Goto(&done);
+
+  BIND(&done);
+  return var_result.value();
+}
+
+Node* CodeStubAssembler::LoadFixedBigUint64ArrayElementAsTagged(
+    Node* data_pointer, Node* offset) {
+  TVARIABLE(BigInt, var_result);
+  Label if_zero(this), done(this);
+  if (Is64()) {
+    TNode<UintPtrT> value = UncheckedCast<UintPtrT>(
+        Load(MachineType::UintPtr(), data_pointer, offset));
+    GotoIf(IntPtrEqual(value, IntPtrConstant(0)), &if_zero);
+    var_result = AllocateBigInt(IntPtrConstant(1));
+    StoreBigIntDigit(var_result.value(), 0, value);
+    Goto(&done);
+  } else {
+    DCHECK(!Is64());
+    Label high_zero(this);
+
+    TNode<UintPtrT> low = UncheckedCast<UintPtrT>(
+        Load(MachineType::UintPtr(), data_pointer, offset));
+    TNode<UintPtrT> high = UncheckedCast<UintPtrT>(
+        Load(MachineType::UintPtr(), data_pointer,
+             Int32Add(offset, Int32Constant(kPointerSize))));
+
+    GotoIf(WordEqual(high, IntPtrConstant(0)), &high_zero);
+    var_result = AllocateBigInt(IntPtrConstant(2));
+    StoreBigIntDigit(var_result.value(), 0, low);
+    StoreBigIntDigit(var_result.value(), 1, high);
+    Goto(&done);
+
+    BIND(&high_zero);
+    GotoIf(WordEqual(low, IntPtrConstant(0)), &if_zero);
+    var_result = AllocateBigInt(IntPtrConstant(1));
+    StoreBigIntDigit(var_result.value(), 0, low);
+    Goto(&done);
+  }
+  BIND(&if_zero);
+  var_result = AllocateBigInt(IntPtrConstant(0));
+  Goto(&done);
+
+  BIND(&done);
+  return var_result.value();
+}
+
+Node* CodeStubAssembler::LoadFixedTypedArrayElementAsTagged(
     Node* data_pointer, Node* index_node, ElementsKind elements_kind,
     ParameterMode parameter_mode) {
   Node* offset =
       ElementOffsetFromIndex(index_node, elements_kind, parameter_mode, 0);
-  MachineType type;
   switch (elements_kind) {
     case UINT8_ELEMENTS: /* fall through */
     case UINT8_CLAMPED_ELEMENTS:
-      type = MachineType::Uint8();
-      break;
+      return SmiFromInt32(Load(MachineType::Uint8(), data_pointer, offset));
     case INT8_ELEMENTS:
-      type = MachineType::Int8();
-      break;
+      return SmiFromInt32(Load(MachineType::Int8(), data_pointer, offset));
     case UINT16_ELEMENTS:
-      type = MachineType::Uint16();
-      break;
+      return SmiFromInt32(Load(MachineType::Uint16(), data_pointer, offset));
     case INT16_ELEMENTS:
-      type = MachineType::Int16();
-      break;
+      return SmiFromInt32(Load(MachineType::Int16(), data_pointer, offset));
     case UINT32_ELEMENTS:
-      type = MachineType::Uint32();
-      break;
+      return ChangeUint32ToTagged(
+          Load(MachineType::Uint32(), data_pointer, offset));
     case INT32_ELEMENTS:
-      type = MachineType::Int32();
-      break;
+      return ChangeInt32ToTagged(
+          Load(MachineType::Int32(), data_pointer, offset));
     case FLOAT32_ELEMENTS:
-      type = MachineType::Float32();
-      break;
+      return AllocateHeapNumberWithValue(ChangeFloat32ToFloat64(
+          Load(MachineType::Float32(), data_pointer, offset)));
     case FLOAT64_ELEMENTS:
-      type = MachineType::Float64();
-      break;
-    default:
-      UNREACHABLE();
-  }
-  return Load(type, data_pointer, offset);
-}
-
-Node* CodeStubAssembler::LoadFixedTypedArrayElementAsTagged(
-    Node* data_pointer, Node* index_node, ElementsKind elements_kind,
-    ParameterMode parameter_mode) {
-  Node* value = LoadFixedTypedArrayElement(data_pointer, index_node,
-                                           elements_kind, parameter_mode);
-  switch (elements_kind) {
-    case ElementsKind::INT8_ELEMENTS:
-    case ElementsKind::UINT8_CLAMPED_ELEMENTS:
-    case ElementsKind::UINT8_ELEMENTS:
-    case ElementsKind::INT16_ELEMENTS:
-    case ElementsKind::UINT16_ELEMENTS:
-      return SmiFromWord32(value);
-    case ElementsKind::INT32_ELEMENTS:
-      return ChangeInt32ToTagged(value);
-    case ElementsKind::UINT32_ELEMENTS:
-      return ChangeUint32ToTagged(value);
-    case ElementsKind::FLOAT32_ELEMENTS:
-      return AllocateHeapNumberWithValue(ChangeFloat32ToFloat64(value));
-    case ElementsKind::FLOAT64_ELEMENTS:
-      return AllocateHeapNumberWithValue(value);
+      return AllocateHeapNumberWithValue(
+          Load(MachineType::Float64(), data_pointer, offset));
+    case BIGINT64_ELEMENTS:
+      return LoadFixedBigInt64ArrayElementAsTagged(data_pointer, offset);
+    case BIGUINT64_ELEMENTS:
+      return LoadFixedBigUint64ArrayElementAsTagged(data_pointer, offset);
     default:
       UNREACHABLE();
   }
@@ -1639,8 +1887,8 @@ TNode<Object> CodeStubAssembler::LoadFeedbackVectorSlot(
   return UncheckedCast<Object>(Load(MachineType::AnyTagged(), object, offset));
 }
 
-Node* CodeStubAssembler::LoadAndUntagToWord32FixedArrayElement(
-    Node* object, Node* index_node, int additional_offset,
+TNode<Int32T> CodeStubAssembler::LoadAndUntagToWord32FixedArrayElement(
+    SloppyTNode<Object> object, Node* index_node, int additional_offset,
     ParameterMode parameter_mode) {
   CSA_SLOW_ASSERT(this, IsFixedArraySubclass(object));
   CSA_SLOW_ASSERT(this, MatchesParameterMode(index_node, parameter_mode));
@@ -1654,9 +1902,9 @@ Node* CodeStubAssembler::LoadAndUntagToWord32FixedArrayElement(
   Node* offset = ElementOffsetFromIndex(index_node, HOLEY_ELEMENTS,
                                         parameter_mode, header_size);
   if (Is64()) {
-    return Load(MachineType::Int32(), object, offset);
+    return UncheckedCast<Int32T>(Load(MachineType::Int32(), object, offset));
   } else {
-    return SmiToWord32(Load(MachineType::AnyTagged(), object, offset));
+    return SmiToInt32(Load(MachineType::AnyTagged(), object, offset));
   }
 }
 
@@ -1878,8 +2126,10 @@ Node* CodeStubAssembler::StoreFixedArrayElement(Node* object, Node* index_node,
                                                 int additional_offset,
                                                 ParameterMode parameter_mode) {
   CSA_SLOW_ASSERT(
-      this, Word32Or(IsHashTable(object),
-                     Word32Or(IsFixedArray(object), IsPropertyArray(object))));
+      this,
+      Word32Or(IsHashTable(object),
+               Word32Or(IsFixedArray(object),
+                        Word32Or(IsPropertyArray(object), IsContext(object)))));
   CSA_SLOW_ASSERT(this, MatchesParameterMode(index_node, parameter_mode));
   DCHECK(barrier_mode == SKIP_WRITE_BARRIER ||
          barrier_mode == UPDATE_WRITE_BARRIER);
@@ -1939,11 +2189,11 @@ void CodeStubAssembler::EnsureArrayLengthWritable(Node* map, Label* bailout) {
   GotoIf(IsSetSmi(details, PropertyDetails::kAttributesReadOnlyMask), bailout);
 }
 
-Node* CodeStubAssembler::EnsureArrayPushable(Node* receiver, Label* bailout) {
+TNode<Int32T> CodeStubAssembler::EnsureArrayPushable(TNode<Map> map,
+                                                     Label* bailout) {
   // Disallow pushing onto prototypes. It might be the JSArray prototype.
   // Disallow pushing onto non-extensible objects.
   Comment("Disallow pushing onto prototypes");
-  Node* map = LoadMap(receiver);
   Node* bit_field2 = LoadMapBitField2(map);
   int mask = Map::IsPrototypeMapBit::kMask | Map::IsExtensibleBit::kMask;
   Node* test = Word32And(bit_field2, Int32Constant(mask));
@@ -1957,8 +2207,8 @@ Node* CodeStubAssembler::EnsureArrayPushable(Node* receiver, Label* bailout) {
 
   EnsureArrayLengthWritable(map, bailout);
 
-  Node* kind = DecodeWord32<Map::ElementsKindBits>(bit_field2);
-  return kind;
+  TNode<Uint32T> kind = DecodeWord32<Map::ElementsKindBits>(bit_field2);
+  return Signed(kind);
 }
 
 void CodeStubAssembler::PossiblyGrowElementsCapacity(
@@ -1995,8 +2245,8 @@ TNode<Smi> CodeStubAssembler::BuildAppendJSArray(ElementsKind kind,
   VARIABLE(var_elements, MachineRepresentation::kTagged, LoadElements(array));
 
   // Resize the capacity of the fixed array if it doesn't fit.
-  TNode<IntPtrT> first = *arg_index;
-  Node* growth = WordToParameter(
+  TNode<IntPtrT> first = arg_index->value();
+  Node* growth = IntPtrToParameter(
       IntPtrSub(UncheckedCast<IntPtrT>(args->GetLength(INTPTR_PARAMETERS)),
                 first),
       mode);
@@ -2028,12 +2278,12 @@ TNode<Smi> CodeStubAssembler::BuildAppendJSArray(ElementsKind kind,
     var_tagged_length = length;
     Node* diff = SmiSub(length, LoadFastJSArrayLength(array));
     StoreObjectFieldNoWriteBarrier(array, JSArray::kLengthOffset, length);
-    *arg_index = IntPtrAdd(*arg_index, SmiUntag(diff));
+    *arg_index = IntPtrAdd(arg_index->value(), SmiUntag(diff));
     Goto(bailout);
   }
 
   BIND(&success);
-  return var_tagged_length;
+  return var_tagged_length.value();
 }
 
 void CodeStubAssembler::TryStoreArrayElement(ElementsKind kind,
@@ -2121,11 +2371,54 @@ TNode<HeapNumber> CodeStubAssembler::AllocateHeapNumberWithValue(
   return result;
 }
 
-Node* CodeStubAssembler::AllocateSeqOneByteString(int length,
-                                                  AllocationFlags flags) {
+TNode<BigInt> CodeStubAssembler::AllocateBigInt(TNode<IntPtrT> length) {
+  TNode<BigInt> result = AllocateRawBigInt(length);
+  StoreBigIntBitfield(result, WordShl(length, BigInt::LengthBits::kShift));
+  return result;
+}
+
+TNode<BigInt> CodeStubAssembler::AllocateRawBigInt(TNode<IntPtrT> length) {
+  // This is currently used only for 64-bit wide BigInts. If more general
+  // applicability is required, a large-object check must be added.
+  CSA_ASSERT(this, UintPtrLessThan(length, IntPtrConstant(3)));
+
+  TNode<IntPtrT> size = IntPtrAdd(IntPtrConstant(BigInt::kHeaderSize),
+                                  Signed(WordShl(length, kPointerSizeLog2)));
+  Node* raw_result = Allocate(size, kNone);
+  StoreMapNoWriteBarrier(raw_result, Heap::kBigIntMapRootIndex);
+  return UncheckedCast<BigInt>(raw_result);
+}
+
+void CodeStubAssembler::StoreBigIntBitfield(TNode<BigInt> bigint,
+                                            TNode<WordT> bitfield) {
+  StoreObjectFieldNoWriteBarrier(bigint, BigInt::kBitfieldOffset, bitfield,
+                                 MachineType::PointerRepresentation());
+}
+
+void CodeStubAssembler::StoreBigIntDigit(TNode<BigInt> bigint, int digit_index,
+                                         TNode<UintPtrT> digit) {
+  StoreObjectFieldNoWriteBarrier(
+      bigint, BigInt::kDigitsOffset + digit_index * kPointerSize, digit,
+      UintPtrT::kMachineRepresentation);
+}
+
+TNode<WordT> CodeStubAssembler::LoadBigIntBitfield(TNode<BigInt> bigint) {
+  return UncheckedCast<WordT>(
+      LoadObjectField(bigint, BigInt::kBitfieldOffset, MachineType::UintPtr()));
+}
+
+TNode<UintPtrT> CodeStubAssembler::LoadBigIntDigit(TNode<BigInt> bigint,
+                                                   int digit_index) {
+  return UncheckedCast<UintPtrT>(LoadObjectField(
+      bigint, BigInt::kDigitsOffset + digit_index * kPointerSize,
+      MachineType::UintPtr()));
+}
+
+TNode<String> CodeStubAssembler::AllocateSeqOneByteString(
+    int length, AllocationFlags flags) {
   Comment("AllocateSeqOneByteString");
   if (length == 0) {
-    return LoadRoot(Heap::kempty_stringRootIndex);
+    return CAST(LoadRoot(Heap::kempty_stringRootIndex));
   }
   Node* result = Allocate(SeqOneByteString::SizeFor(length), flags);
   DCHECK(Heap::RootIsImmortalImmovable(Heap::kOneByteStringMapRootIndex));
@@ -2136,15 +2429,15 @@ Node* CodeStubAssembler::AllocateSeqOneByteString(int length,
   StoreObjectFieldNoWriteBarrier(result, SeqOneByteString::kHashFieldSlot,
                                  IntPtrConstant(String::kEmptyHashField),
                                  MachineType::PointerRepresentation());
-  return result;
+  return CAST(result);
 }
 
-Node* CodeStubAssembler::IsZeroOrFixedArray(Node* object) {
+Node* CodeStubAssembler::IsZeroOrContext(Node* object) {
   Label out(this);
   VARIABLE(var_result, MachineRepresentation::kWord32, Int32Constant(1));
 
   GotoIf(WordEqual(object, SmiConstant(0)), &out);
-  GotoIf(IsFixedArray(object), &out);
+  GotoIf(IsContext(object), &out);
 
   var_result.Bind(Int32Constant(0));
   Goto(&out);
@@ -2153,11 +2446,10 @@ Node* CodeStubAssembler::IsZeroOrFixedArray(Node* object) {
   return var_result.value();
 }
 
-Node* CodeStubAssembler::AllocateSeqOneByteString(Node* context,
-                                                  TNode<Smi> length,
-                                                  AllocationFlags flags) {
+TNode<String> CodeStubAssembler::AllocateSeqOneByteString(
+    Node* context, TNode<Smi> length, AllocationFlags flags) {
   Comment("AllocateSeqOneByteString");
-  CSA_SLOW_ASSERT(this, IsZeroOrFixedArray(context));
+  CSA_SLOW_ASSERT(this, IsZeroOrContext(context));
   VARIABLE(var_result, MachineRepresentation::kTagged);
 
   // Compute the SeqOneByteString size and check if it fits into new space.
@@ -2203,14 +2495,14 @@ Node* CodeStubAssembler::AllocateSeqOneByteString(Node* context,
   }
 
   BIND(&if_join);
-  return var_result.value();
+  return CAST(var_result.value());
 }
 
-Node* CodeStubAssembler::AllocateSeqTwoByteString(int length,
-                                                  AllocationFlags flags) {
+TNode<String> CodeStubAssembler::AllocateSeqTwoByteString(
+    int length, AllocationFlags flags) {
   Comment("AllocateSeqTwoByteString");
   if (length == 0) {
-    return LoadRoot(Heap::kempty_stringRootIndex);
+    return CAST(LoadRoot(Heap::kempty_stringRootIndex));
   }
   Node* result = Allocate(SeqTwoByteString::SizeFor(length), flags);
   DCHECK(Heap::RootIsImmortalImmovable(Heap::kStringMapRootIndex));
@@ -2221,13 +2513,12 @@ Node* CodeStubAssembler::AllocateSeqTwoByteString(int length,
   StoreObjectFieldNoWriteBarrier(result, SeqTwoByteString::kHashFieldSlot,
                                  IntPtrConstant(String::kEmptyHashField),
                                  MachineType::PointerRepresentation());
-  return result;
+  return CAST(result);
 }
 
-Node* CodeStubAssembler::AllocateSeqTwoByteString(Node* context,
-                                                  TNode<Smi> length,
-                                                  AllocationFlags flags) {
-  CSA_SLOW_ASSERT(this, IsFixedArray(context));
+TNode<String> CodeStubAssembler::AllocateSeqTwoByteString(
+    Node* context, TNode<Smi> length, AllocationFlags flags) {
+  CSA_SLOW_ASSERT(this, IsZeroOrContext(context));
   Comment("AllocateSeqTwoByteString");
   VARIABLE(var_result, MachineRepresentation::kTagged);
 
@@ -2274,14 +2565,14 @@ Node* CodeStubAssembler::AllocateSeqTwoByteString(Node* context,
   }
 
   BIND(&if_join);
-  return var_result.value();
+  return CAST(var_result.value());
 }
 
-Node* CodeStubAssembler::AllocateSlicedString(
-    Heap::RootListIndex map_root_index, TNode<Smi> length, Node* parent,
-    Node* offset) {
-  CSA_ASSERT(this, IsString(parent));
-  CSA_ASSERT(this, TaggedIsSmi(offset));
+TNode<String> CodeStubAssembler::AllocateSlicedString(
+    Heap::RootListIndex map_root_index, TNode<Smi> length, TNode<String> parent,
+    TNode<Smi> offset) {
+  DCHECK(map_root_index == Heap::kSlicedOneByteStringMapRootIndex ||
+         map_root_index == Heap::kSlicedStringMapRootIndex);
   Node* result = Allocate(SlicedString::kSize);
   DCHECK(Heap::RootIsImmortalImmovable(map_root_index));
   StoreMapNoWriteBarrier(result, map_root_index);
@@ -2294,29 +2585,26 @@ Node* CodeStubAssembler::AllocateSlicedString(
                                  MachineRepresentation::kTagged);
   StoreObjectFieldNoWriteBarrier(result, SlicedString::kOffsetOffset, offset,
                                  MachineRepresentation::kTagged);
-  return result;
+  return CAST(result);
 }
 
-Node* CodeStubAssembler::AllocateSlicedOneByteString(TNode<Smi> length,
-                                                     Node* parent,
-                                                     Node* offset) {
+TNode<String> CodeStubAssembler::AllocateSlicedOneByteString(
+    TNode<Smi> length, TNode<String> parent, TNode<Smi> offset) {
   return AllocateSlicedString(Heap::kSlicedOneByteStringMapRootIndex, length,
                               parent, offset);
 }
 
-Node* CodeStubAssembler::AllocateSlicedTwoByteString(TNode<Smi> length,
-                                                     Node* parent,
-                                                     Node* offset) {
+TNode<String> CodeStubAssembler::AllocateSlicedTwoByteString(
+    TNode<Smi> length, TNode<String> parent, TNode<Smi> offset) {
   return AllocateSlicedString(Heap::kSlicedStringMapRootIndex, length, parent,
                               offset);
 }
 
-Node* CodeStubAssembler::AllocateConsString(Heap::RootListIndex map_root_index,
-                                            TNode<Smi> length, Node* first,
-                                            Node* second,
-                                            AllocationFlags flags) {
-  CSA_ASSERT(this, IsString(first));
-  CSA_ASSERT(this, IsString(second));
+TNode<String> CodeStubAssembler::AllocateConsString(
+    Heap::RootListIndex map_root_index, TNode<Smi> length, TNode<String> first,
+    TNode<String> second, AllocationFlags flags) {
+  DCHECK(map_root_index == Heap::kConsOneByteStringMapRootIndex ||
+         map_root_index == Heap::kConsStringMapRootIndex);
   Node* result = Allocate(ConsString::kSize, flags);
   DCHECK(Heap::RootIsImmortalImmovable(map_root_index));
   StoreMapNoWriteBarrier(result, map_root_index);
@@ -2335,29 +2623,28 @@ Node* CodeStubAssembler::AllocateConsString(Heap::RootListIndex map_root_index,
     StoreObjectField(result, ConsString::kFirstOffset, first);
     StoreObjectField(result, ConsString::kSecondOffset, second);
   }
-  return result;
+  return CAST(result);
 }
 
-Node* CodeStubAssembler::AllocateOneByteConsString(TNode<Smi> length,
-                                                   Node* first, Node* second,
-                                                   AllocationFlags flags) {
+TNode<String> CodeStubAssembler::AllocateOneByteConsString(
+    TNode<Smi> length, TNode<String> first, TNode<String> second,
+    AllocationFlags flags) {
   return AllocateConsString(Heap::kConsOneByteStringMapRootIndex, length, first,
                             second, flags);
 }
 
-Node* CodeStubAssembler::AllocateTwoByteConsString(TNode<Smi> length,
-                                                   Node* first, Node* second,
-                                                   AllocationFlags flags) {
+TNode<String> CodeStubAssembler::AllocateTwoByteConsString(
+    TNode<Smi> length, TNode<String> first, TNode<String> second,
+    AllocationFlags flags) {
   return AllocateConsString(Heap::kConsStringMapRootIndex, length, first,
                             second, flags);
 }
 
-Node* CodeStubAssembler::NewConsString(Node* context, TNode<Smi> length,
-                                       Node* left, Node* right,
-                                       AllocationFlags flags) {
-  CSA_ASSERT(this, IsFixedArray(context));
-  CSA_ASSERT(this, IsString(left));
-  CSA_ASSERT(this, IsString(right));
+TNode<String> CodeStubAssembler::NewConsString(Node* context, TNode<Smi> length,
+                                               TNode<String> left,
+                                               TNode<String> right,
+                                               AllocationFlags flags) {
+  CSA_ASSERT(this, IsContext(context));
   // Added string can be a cons string.
   Comment("Allocating ConsString");
   Node* left_instance_type = LoadInstanceType(left);
@@ -2382,7 +2669,7 @@ Node* CodeStubAssembler::NewConsString(Node* context, TNode<Smi> length,
   STATIC_ASSERT(kOneByteDataHintTag != 0);
   Label one_byte_map(this);
   Label two_byte_map(this);
-  VARIABLE(result, MachineRepresentation::kTagged);
+  TVARIABLE(String, result);
   Label done(this, &result);
   GotoIf(IsSetWord32(anded_instance_types,
                      kStringEncodingMask | kOneByteDataHintTag),
@@ -2395,12 +2682,12 @@ Node* CodeStubAssembler::NewConsString(Node* context, TNode<Smi> length,
 
   BIND(&one_byte_map);
   Comment("One-byte ConsString");
-  result.Bind(AllocateOneByteConsString(length, left, right, flags));
+  result = AllocateOneByteConsString(length, left, right, flags);
   Goto(&done);
 
   BIND(&two_byte_map);
   Comment("Two-byte ConsString");
-  result.Bind(AllocateTwoByteConsString(length, left, right, flags));
+  result = AllocateTwoByteConsString(length, left, right, flags);
   Goto(&done);
 
   BIND(&done);
@@ -2433,7 +2720,7 @@ Node* CodeStubAssembler::AllocateNameDictionaryWithCapacity(Node* capacity) {
   DCHECK(Heap::RootIsImmortalImmovable(Heap::kNameDictionaryMapRootIndex));
   StoreMapNoWriteBarrier(result, Heap::kNameDictionaryMapRootIndex);
   StoreObjectFieldNoWriteBarrier(result, FixedArray::kLengthOffset,
-                                 SmiFromWord(length));
+                                 SmiFromIntPtr(length));
   // Initialized HashTable fields.
   Node* zero = SmiConstant(0);
   StoreFixedArrayElement(result, NameDictionary::kNumberOfElementsIndex, zero,
@@ -2825,6 +3112,7 @@ Node* CodeStubAssembler::AllocateFixedArray(ElementsKind kind,
                                             ParameterMode mode,
                                             AllocationFlags flags,
                                             Node* fixed_array_map) {
+  Comment("AllocateFixedArray");
   CSA_SLOW_ASSERT(this, MatchesParameterMode(capacity_node, mode));
   CSA_ASSERT(this, IntPtrOrSmiGreaterThan(capacity_node,
                                           IntPtrOrSmiConstant(0, mode), mode));
@@ -2891,7 +3179,7 @@ Node* CodeStubAssembler::ExtractFixedArray(Node* fixed_array, Node* first,
   Label if_fixed_double_array(this), empty(this), cow(this),
       done(this, {&var_result, &var_fixed_array_map});
   var_fixed_array_map.Bind(LoadMap(fixed_array));
-  GotoIf(WordEqual(IntPtrOrSmiConstant(0, parameter_mode), count), &empty);
+  GotoIf(WordEqual(IntPtrOrSmiConstant(0, parameter_mode), capacity), &empty);
 
   if (extract_flags & ExtractFixedArrayFlag::kFixedDoubleArrays) {
     if (extract_flags & ExtractFixedArrayFlag::kFixedArrays) {
@@ -3568,7 +3856,7 @@ void CodeStubAssembler::TaggedToWord32OrBigIntImpl(
     GotoIf(TaggedIsNotSmi(value), &not_smi);
 
     // {value} is a Smi.
-    var_word32->Bind(SmiToWord32(value));
+    var_word32->Bind(SmiToInt32(value));
     CombineFeedback(var_feedback, BinaryOperationFeedback::kSignedSmall);
     Goto(if_number);
 
@@ -3671,7 +3959,7 @@ TNode<Number> CodeStubAssembler::ChangeFloat64ToTagged(
     Goto(&if_join);
   }
   BIND(&if_join);
-  return var_result;
+  return var_result.value();
 }
 
 TNode<Number> CodeStubAssembler::ChangeInt32ToTagged(
@@ -3700,7 +3988,7 @@ TNode<Number> CodeStubAssembler::ChangeInt32ToTagged(
   }
   Goto(&if_join);
   BIND(&if_join);
-  return var_result;
+  return var_result.value();
 }
 
 TNode<Number> CodeStubAssembler::ChangeUint32ToTagged(
@@ -3741,7 +4029,7 @@ TNode<Number> CodeStubAssembler::ChangeUint32ToTagged(
   Goto(&if_join);
 
   BIND(&if_join);
-  return var_result;
+  return var_result.value();
 }
 
 TNode<String> CodeStubAssembler::ToThisString(Node* context, Node* value,
@@ -3773,9 +4061,8 @@ TNode<String> CodeStubAssembler::ToThisString(Node* context, Node* value,
       BIND(&if_valueisnullorundefined);
       {
         // The {value} is either null or undefined.
-        CallRuntime(Runtime::kThrowCalledOnNullOrUndefined, context,
-                    StringConstant(method_name));
-        Unreachable();
+        ThrowTypeError(context, MessageTemplate::kCalledOnNullOrUndefined,
+                       method_name);
       }
     }
   }
@@ -3807,7 +4094,7 @@ TNode<Float64T> CodeStubAssembler::ChangeNumberToFloat64(
   }
 
   BIND(&done);
-  return result;
+  return result.value();
 }
 
 TNode<UintPtrT> CodeStubAssembler::ChangeNonnegativeNumberToUintPtr(
@@ -3823,11 +4110,11 @@ TNode<UintPtrT> CodeStubAssembler::ChangeNonnegativeNumberToUintPtr(
   BIND(&smi);
   TNode<Smi> value_smi = CAST(value);
   CSA_SLOW_ASSERT(this, SmiLessThan(SmiConstant(-1), value_smi));
-  result = UncheckedCast<UintPtrT>(SmiToWord(value_smi));
+  result = UncheckedCast<UintPtrT>(SmiToIntPtr(value_smi));
   Goto(&done);
 
   BIND(&done);
-  return result;
+  return result.value();
 }
 
 Node* CodeStubAssembler::TimesPointerSize(Node* value) {
@@ -3918,14 +4205,6 @@ Node* CodeStubAssembler::ToThisValue(Node* context, Node* value,
   return var_value.value();
 }
 
-void CodeStubAssembler::ThrowIncompatibleMethodReceiver(Node* context,
-                                                        const char* method_name,
-                                                        Node* receiver) {
-  CallRuntime(Runtime::kThrowIncompatibleMethodReceiver, context,
-              StringConstant(method_name), receiver);
-  Unreachable();
-}
-
 Node* CodeStubAssembler::ThrowIfNotInstanceType(Node* context, Node* value,
                                                 InstanceType instance_type,
                                                 char const* method_name) {
@@ -3943,7 +4222,8 @@ Node* CodeStubAssembler::ThrowIfNotInstanceType(Node* context, Node* value,
 
   // The {value} is not a compatible receiver for this method.
   BIND(&throw_exception);
-  ThrowIncompatibleMethodReceiver(context, method_name, value);
+  ThrowTypeError(context, MessageTemplate::kIncompatibleMethodReceiver,
+                 StringConstant(method_name), value);
 
   BIND(&out);
   return var_value_map.value();
@@ -4015,23 +4295,11 @@ void CodeStubAssembler::ThrowTypeError(Node* context,
   Unreachable();
 }
 
-Node* CodeStubAssembler::InstanceTypeEqual(Node* instance_type, int type) {
+TNode<BoolT> CodeStubAssembler::InstanceTypeEqual(
+    SloppyTNode<Int32T> instance_type, int type) {
   return Word32Equal(instance_type, Int32Constant(type));
 }
 
-Node* CodeStubAssembler::IsSpecialReceiverMap(Node* map) {
-  CSA_SLOW_ASSERT(this, IsMap(map));
-  Node* is_special = IsSpecialReceiverInstanceType(LoadMapInstanceType(map));
-  uint32_t mask =
-      Map::HasNamedInterceptorBit::kMask | Map::IsAccessCheckNeededBit::kMask;
-  USE(mask);
-  // Interceptors or access checks imply special receiver.
-  CSA_ASSERT(this,
-             SelectConstant(IsSetWord32(LoadMapBitField(map), mask), is_special,
-                            Int32Constant(1), MachineRepresentation::kWord32));
-  return is_special;
-}
-
 TNode<BoolT> CodeStubAssembler::IsDictionaryMap(SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
   Node* bit_field3 = LoadMapBitField3(map);
@@ -4065,6 +4333,20 @@ Node* CodeStubAssembler::IsNoElementsProtectorCellInvalid() {
   return WordEqual(cell_value, invalid);
 }
 
+Node* CodeStubAssembler::IsPromiseResolveProtectorCellInvalid() {
+  Node* invalid = SmiConstant(Isolate::kProtectorInvalid);
+  Node* cell = LoadRoot(Heap::kPromiseResolveProtectorRootIndex);
+  Node* cell_value = LoadObjectField(cell, Cell::kValueOffset);
+  return WordEqual(cell_value, invalid);
+}
+
+Node* CodeStubAssembler::IsPromiseThenProtectorCellInvalid() {
+  Node* invalid = SmiConstant(Isolate::kProtectorInvalid);
+  Node* cell = LoadRoot(Heap::kPromiseThenProtectorRootIndex);
+  Node* cell_value = LoadObjectField(cell, PropertyCell::kValueOffset);
+  return WordEqual(cell_value, invalid);
+}
+
 Node* CodeStubAssembler::IsSpeciesProtectorCellInvalid() {
   Node* invalid = SmiConstant(Isolate::kProtectorInvalid);
   Node* cell = LoadRoot(Heap::kSpeciesProtectorRootIndex);
@@ -4081,6 +4363,18 @@ Node* CodeStubAssembler::IsPrototypeInitialArrayPrototype(Node* context,
   return WordEqual(proto, initial_array_prototype);
 }
 
+TNode<BoolT> CodeStubAssembler::IsPrototypeTypedArrayPrototype(
+    SloppyTNode<Context> context, SloppyTNode<Map> map) {
+  TNode<Context> const native_context = LoadNativeContext(context);
+  TNode<Object> const typed_array_prototype =
+      LoadContextElement(native_context, Context::TYPED_ARRAY_PROTOTYPE_INDEX);
+  TNode<Object> proto = LoadMapPrototype(map);
+  TNode<Object> proto_of_proto = Select<Object>(
+      IsJSObject(proto), [=] { return LoadMapPrototype(LoadMap(CAST(proto))); },
+      [=] { return NullConstant(); });
+  return WordEqual(proto_of_proto, typed_array_prototype);
+}
+
 Node* CodeStubAssembler::IsCallable(Node* object) {
   return IsCallableMap(LoadMap(object));
 }
@@ -4089,6 +4383,10 @@ Node* CodeStubAssembler::IsCell(Node* object) {
   return WordEqual(LoadMap(object), LoadRoot(Heap::kCellMapRootIndex));
 }
 
+Node* CodeStubAssembler::IsCode(Node* object) {
+  return HasInstanceType(object, CODE_TYPE);
+}
+
 Node* CodeStubAssembler::IsConstructorMap(Node* map) {
   CSA_ASSERT(this, IsMap(map));
   return IsSetWord32<Map::IsConstructorBit>(LoadMapBitField(map));
@@ -4103,7 +4401,8 @@ Node* CodeStubAssembler::IsFunctionWithPrototypeSlotMap(Node* map) {
   return IsSetWord32<Map::HasPrototypeSlotBit>(LoadMapBitField(map));
 }
 
-Node* CodeStubAssembler::IsSpecialReceiverInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsSpecialReceiverInstanceType(
+    Node* instance_type) {
   STATIC_ASSERT(JS_GLOBAL_OBJECT_TYPE <= LAST_SPECIAL_RECEIVER_TYPE);
   return Int32LessThanOrEqual(instance_type,
                               Int32Constant(LAST_SPECIAL_RECEIVER_TYPE));
@@ -4162,12 +4461,6 @@ Node* CodeStubAssembler::IsJSReceiverInstanceType(Node* instance_type) {
                                  Int32Constant(FIRST_JS_RECEIVER_TYPE));
 }
 
-Node* CodeStubAssembler::IsArrayIteratorInstanceType(Node* instance_type) {
-  return Uint32LessThan(
-      Int32Constant(LAST_ARRAY_ITERATOR_TYPE - FIRST_ARRAY_ITERATOR_TYPE),
-      Int32Sub(instance_type, Int32Constant(FIRST_ARRAY_ITERATOR_TYPE)));
-}
-
 Node* CodeStubAssembler::IsJSReceiverMap(Node* map) {
   return IsJSReceiverInstanceType(LoadMapInstanceType(map));
 }
@@ -4203,6 +4496,15 @@ Node* CodeStubAssembler::IsJSObject(Node* object) {
   return IsJSObjectMap(LoadMap(object));
 }
 
+Node* CodeStubAssembler::IsJSPromiseMap(Node* map) {
+  CSA_ASSERT(this, IsMap(map));
+  return InstanceTypeEqual(LoadMapInstanceType(map), JS_PROMISE_TYPE);
+}
+
+Node* CodeStubAssembler::IsJSPromise(Node* object) {
+  return IsJSPromiseMap(LoadMap(object));
+}
+
 Node* CodeStubAssembler::IsJSProxy(Node* object) {
   return HasInstanceType(object, JS_PROXY_TYPE);
 }
@@ -4237,6 +4539,21 @@ Node* CodeStubAssembler::IsJSArrayMap(Node* map) {
   return IsJSArrayInstanceType(LoadMapInstanceType(map));
 }
 
+Node* CodeStubAssembler::IsJSArrayIterator(Node* object) {
+  return HasInstanceType(object, JS_ARRAY_ITERATOR_TYPE);
+}
+
+Node* CodeStubAssembler::IsJSAsyncGeneratorObject(Node* object) {
+  return HasInstanceType(object, JS_ASYNC_GENERATOR_OBJECT_TYPE);
+}
+
+Node* CodeStubAssembler::IsContext(Node* object) {
+  Node* instance_type = LoadInstanceType(object);
+  return Word32And(
+      Int32GreaterThanOrEqual(instance_type, Int32Constant(FIRST_CONTEXT_TYPE)),
+      Int32LessThanOrEqual(instance_type, Int32Constant(LAST_CONTEXT_TYPE)));
+}
+
 Node* CodeStubAssembler::IsFixedArray(Node* object) {
   return HasInstanceType(object, FIXED_ARRAY_TYPE);
 }
@@ -4249,6 +4566,10 @@ Node* CodeStubAssembler::IsFixedArraySubclass(Node* object) {
                                         Int32Constant(LAST_FIXED_ARRAY_TYPE)));
 }
 
+Node* CodeStubAssembler::IsPromiseCapability(Node* object) {
+  return HasInstanceType(object, PROMISE_CAPABILITY_TYPE);
+}
+
 Node* CodeStubAssembler::IsPropertyArray(Node* object) {
   return HasInstanceType(object, PROPERTY_ARRAY_TYPE);
 }
@@ -4316,7 +4637,7 @@ Node* CodeStubAssembler::IsAnyHeapNumber(Node* object) {
   return Word32Or(IsMutableHeapNumber(object), IsHeapNumber(object));
 }
 
-Node* CodeStubAssembler::IsHeapNumber(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsHeapNumber(Node* object) {
   return IsHeapNumberMap(LoadMap(object));
 }
 
@@ -4324,6 +4645,10 @@ Node* CodeStubAssembler::IsMutableHeapNumber(Node* object) {
   return IsMutableHeapNumberMap(LoadMap(object));
 }
 
+Node* CodeStubAssembler::IsFeedbackCell(Node* object) {
+  return HasInstanceType(object, FEEDBACK_CELL_TYPE);
+}
+
 Node* CodeStubAssembler::IsFeedbackVector(Node* object) {
   return IsFeedbackVectorMap(LoadMap(object));
 }
@@ -4358,16 +4683,16 @@ Node* CodeStubAssembler::IsPrimitiveInstanceType(Node* instance_type) {
                               Int32Constant(LAST_PRIMITIVE_TYPE));
 }
 
-Node* CodeStubAssembler::IsPrivateSymbol(Node* object) {
-  return Select(
+TNode<BoolT> CodeStubAssembler::IsPrivateSymbol(Node* object) {
+  return Select<BoolT>(
       IsSymbol(object),
       [=] {
         TNode<Symbol> symbol = CAST(object);
         TNode<Int32T> flags =
-            SmiToWord32(LoadObjectField<Smi>(symbol, Symbol::kFlagsOffset));
+            SmiToInt32(LoadObjectField<Smi>(symbol, Symbol::kFlagsOffset));
         return IsSetWord32(flags, 1 << Symbol::kPrivateBit);
       },
-      [=] { return Int32Constant(0); }, MachineRepresentation::kWord32);
+      [=] { return Int32FalseConstant(); });
 }
 
 Node* CodeStubAssembler::IsNativeContext(Node* object) {
@@ -4391,6 +4716,10 @@ Node* CodeStubAssembler::IsNumberDictionary(Node* object) {
                    LoadRoot(Heap::kNumberDictionaryMapRootIndex));
 }
 
+Node* CodeStubAssembler::IsJSGeneratorObject(Node* object) {
+  return HasInstanceType(object, JS_GENERATOR_OBJECT_TYPE);
+}
+
 Node* CodeStubAssembler::IsJSFunctionInstanceType(Node* instance_type) {
   return InstanceTypeEqual(instance_type, JS_FUNCTION_TYPE);
 }
@@ -4424,65 +4753,54 @@ Node* CodeStubAssembler::IsJSRegExp(Node* object) {
   return HasInstanceType(object, JS_REGEXP_TYPE);
 }
 
-Node* CodeStubAssembler::IsNumeric(Node* object) {
-  return Select(
-      TaggedIsSmi(object), [=] { return Int32Constant(1); },
-      [=] { return Word32Or(IsHeapNumber(object), IsBigInt(object)); },
-      MachineRepresentation::kWord32);
+TNode<BoolT> CodeStubAssembler::IsNumber(SloppyTNode<Object> object) {
+  return Select<BoolT>(TaggedIsSmi(object), [=] { return Int32TrueConstant(); },
+                       [=] { return IsHeapNumber(object); });
 }
 
-Node* CodeStubAssembler::IsNumber(Node* object) {
-  return Select(TaggedIsSmi(object), [=] { return Int32Constant(1); },
-                [=] { return IsHeapNumber(object); },
-                MachineRepresentation::kWord32);
-}
-
-Node* CodeStubAssembler::FixedArraySizeDoesntFitInNewSpace(Node* element_count,
-                                                           int base_size,
-                                                           ParameterMode mode) {
-  int max_newspace_elements =
-      (kMaxRegularHeapObjectSize - base_size) / kPointerSize;
-  return IntPtrOrSmiGreaterThan(
-      element_count, IntPtrOrSmiConstant(max_newspace_elements, mode), mode);
+TNode<BoolT> CodeStubAssembler::IsNumeric(SloppyTNode<Object> object) {
+  return Select<BoolT>(TaggedIsSmi(object), [=] { return Int32TrueConstant(); },
+                       [=] {
+                         return UncheckedCast<BoolT>(
+                             Word32Or(IsHeapNumber(object), IsBigInt(object)));
+                       });
 }
 
-Node* CodeStubAssembler::IsNumberNormalized(Node* number) {
-  CSA_ASSERT(this, IsNumber(number));
-
-  VARIABLE(var_result, MachineRepresentation::kWord32, Int32Constant(1));
+TNode<BoolT> CodeStubAssembler::IsNumberNormalized(SloppyTNode<Number> number) {
+  TVARIABLE(BoolT, var_result, Int32TrueConstant());
   Label out(this);
 
   GotoIf(TaggedIsSmi(number), &out);
 
-  Node* const value = LoadHeapNumberValue(number);
-  Node* const smi_min = Float64Constant(static_cast<double>(Smi::kMinValue));
-  Node* const smi_max = Float64Constant(static_cast<double>(Smi::kMaxValue));
+  TNode<Float64T> value = LoadHeapNumberValue(CAST(number));
+  TNode<Float64T> smi_min =
+      Float64Constant(static_cast<double>(Smi::kMinValue));
+  TNode<Float64T> smi_max =
+      Float64Constant(static_cast<double>(Smi::kMaxValue));
 
   GotoIf(Float64LessThan(value, smi_min), &out);
   GotoIf(Float64GreaterThan(value, smi_max), &out);
   GotoIfNot(Float64Equal(value, value), &out);  // NaN.
 
-  var_result.Bind(Int32Constant(0));
+  var_result = Int32FalseConstant();
   Goto(&out);
 
   BIND(&out);
   return var_result.value();
 }
 
-Node* CodeStubAssembler::IsNumberPositive(Node* number) {
-  CSA_ASSERT(this, IsNumber(number));
-  Node* const float_zero = Float64Constant(0.);
-  return Select(TaggedIsSmi(number),
-                [=] { return TaggedIsPositiveSmi(number); },
-                [=] {
-                  Node* v = LoadHeapNumberValue(number);
-                  return Float64GreaterThanOrEqual(v, float_zero);
-                },
-                MachineRepresentation::kWord32);
+TNode<BoolT> CodeStubAssembler::IsNumberPositive(SloppyTNode<Number> number) {
+  TNode<Float64T> float_zero = Float64Constant(0.);
+  return Select<BoolT>(TaggedIsSmi(number),
+                       [=] { return TaggedIsPositiveSmi(number); },
+                       [=] {
+                         TNode<Float64T> v = LoadHeapNumberValue(CAST(number));
+                         return Float64GreaterThanOrEqual(v, float_zero);
+                       });
 }
 
-Node* CodeStubAssembler::IsNumberArrayIndex(Node* number) {
-  VARIABLE(var_result, MachineRepresentation::kWord32, Int32Constant(1));
+TNode<BoolT> CodeStubAssembler::IsNumberArrayIndex(SloppyTNode<Number> number) {
+  TVARIABLE(BoolT, var_result, Int32TrueConstant());
 
   Label check_upper_bound(this), check_is_integer(this), out(this),
       return_false(this);
@@ -4498,19 +4816,28 @@ Node* CodeStubAssembler::IsNumberArrayIndex(Node* number) {
   BIND(&check_is_integer);
   GotoIf(TaggedIsSmi(number), &out);
   // Check that the HeapNumber is a valid uint32
-  Node* value = LoadHeapNumberValue(number);
-  Node* int_value = ChangeFloat64ToUint32(value);
+  TNode<Float64T> value = LoadHeapNumberValue(CAST(number));
+  TNode<Uint32T> int_value = ChangeFloat64ToUint32(value);
   GotoIf(Float64Equal(value, ChangeUint32ToFloat64(int_value)), &out);
   Goto(&return_false);
 
   BIND(&return_false);
-  var_result.Bind(Int32Constant(0));
+  var_result = Int32FalseConstant();
   Goto(&out);
 
   BIND(&out);
   return var_result.value();
 }
 
+Node* CodeStubAssembler::FixedArraySizeDoesntFitInNewSpace(Node* element_count,
+                                                           int base_size,
+                                                           ParameterMode mode) {
+  int max_newspace_elements =
+      (kMaxRegularHeapObjectSize - base_size) / kPointerSize;
+  return IntPtrOrSmiGreaterThan(
+      element_count, IntPtrOrSmiConstant(max_newspace_elements, mode), mode);
+}
+
 TNode<Int32T> CodeStubAssembler::StringCharCodeAt(SloppyTNode<String> string,
                                                   SloppyTNode<IntPtrT> index) {
   CSA_ASSERT(this, IsString(string));
@@ -4553,15 +4880,15 @@ TNode<Int32T> CodeStubAssembler::StringCharCodeAt(SloppyTNode<String> string,
   {
     Node* result = CallRuntime(Runtime::kStringCharCodeAt, NoContextConstant(),
                                string, SmiTag(index));
-    var_result = SmiToWord32(result);
+    var_result = SmiToInt32(result);
     Goto(&return_result);
   }
 
   BIND(&return_result);
-  return var_result;
+  return var_result.value();
 }
 
-TNode<String> CodeStubAssembler::StringFromCharCode(TNode<Int32T> code) {
+TNode<String> CodeStubAssembler::StringFromSingleCharCode(TNode<Int32T> code) {
   VARIABLE(var_result, MachineRepresentation::kTagged);
 
   // Check if the {code} is a one-byte char code.
@@ -4623,11 +4950,11 @@ TNode<String> CodeStubAssembler::StringFromCharCode(TNode<Int32T> code) {
 // given character range using CopyStringCharacters.
 // |from_string| must be a sequential string.
 // 0 <= |from_index| <= |from_index| + |character_count| < from_string.length.
-Node* CodeStubAssembler::AllocAndCopyStringCharacters(
-    Node* context, Node* from, Node* from_instance_type,
-    TNode<IntPtrT> from_index, TNode<Smi> character_count) {
+TNode<String> CodeStubAssembler::AllocAndCopyStringCharacters(
+    Node* from, Node* from_instance_type, TNode<IntPtrT> from_index,
+    TNode<Smi> character_count) {
   Label end(this), one_byte_sequential(this), two_byte_sequential(this);
-  Variable var_result(this, MachineRepresentation::kTagged);
+  TVARIABLE(String, var_result);
 
   Branch(IsOneByteStringInstanceType(from_instance_type), &one_byte_sequential,
          &two_byte_sequential);
@@ -4635,24 +4962,24 @@ Node* CodeStubAssembler::AllocAndCopyStringCharacters(
   // The subject string is a sequential one-byte string.
   BIND(&one_byte_sequential);
   {
-    Node* result = AllocateSeqOneByteString(context, character_count);
+    TNode<String> result =
+        AllocateSeqOneByteString(NoContextConstant(), character_count);
     CopyStringCharacters(from, result, from_index, IntPtrConstant(0),
                          SmiUntag(character_count), String::ONE_BYTE_ENCODING,
                          String::ONE_BYTE_ENCODING);
-    var_result.Bind(result);
-
+    var_result = result;
     Goto(&end);
   }
 
   // The subject string is a sequential two-byte string.
   BIND(&two_byte_sequential);
   {
-    Node* result = AllocateSeqTwoByteString(context, character_count);
+    TNode<String> result =
+        AllocateSeqTwoByteString(NoContextConstant(), character_count);
     CopyStringCharacters(from, result, from_index, IntPtrConstant(0),
                          SmiUntag(character_count), String::TWO_BYTE_ENCODING,
                          String::TWO_BYTE_ENCODING);
-    var_result.Bind(result);
-
+    var_result = result;
     Goto(&end);
   }
 
@@ -4660,50 +4987,34 @@ Node* CodeStubAssembler::AllocAndCopyStringCharacters(
   return var_result.value();
 }
 
-
-Node* CodeStubAssembler::SubString(Node* context, Node* string, Node* from,
-                                   Node* to, SubStringFlags flags) {
-  DCHECK(flags == SubStringFlags::NONE ||
-         flags == SubStringFlags::FROM_TO_ARE_BOUNDED);
-  VARIABLE(var_result, MachineRepresentation::kTagged);
+TNode<String> CodeStubAssembler::SubString(TNode<String> string,
+                                           TNode<IntPtrT> from,
+                                           TNode<IntPtrT> to) {
+  TVARIABLE(String, var_result);
   ToDirectStringAssembler to_direct(state(), string);
   Label end(this), runtime(this);
 
-  // Make sure first argument is a string.
-  CSA_ASSERT(this, TaggedIsNotSmi(string));
-  CSA_ASSERT(this, IsString(string));
-
-  // Make sure that both from and to are non-negative smis.
-
-  if (flags == SubStringFlags::NONE) {
-    GotoIfNot(TaggedIsPositiveSmi(from), &runtime);
-    GotoIfNot(TaggedIsPositiveSmi(to), &runtime);
-  } else {
-    CSA_ASSERT(this, TaggedIsPositiveSmi(from));
-    CSA_ASSERT(this, TaggedIsPositiveSmi(to));
-  }
-
-  TNode<Smi> const substr_length = SmiSub(to, from);
-  TNode<Smi> const string_length = LoadStringLengthAsSmi(string);
+  TNode<IntPtrT> const substr_length = IntPtrSub(to, from);
+  TNode<IntPtrT> const string_length = LoadStringLengthAsWord(string);
 
   // Begin dispatching based on substring length.
 
   Label original_string_or_invalid_length(this);
-  GotoIf(SmiAboveOrEqual(substr_length, string_length),
+  GotoIf(UintPtrGreaterThanOrEqual(substr_length, string_length),
          &original_string_or_invalid_length);
 
   // A real substring (substr_length < string_length).
 
   Label single_char(this);
-  GotoIf(SmiEqual(substr_length, SmiConstant(1)), &single_char);
+  GotoIf(IntPtrEqual(substr_length, IntPtrConstant(1)), &single_char);
 
   // TODO(jgruber): Add an additional case for substring of length == 0?
 
   // Deal with different string types: update the index if necessary
   // and extract the underlying string.
 
-  Node* const direct_string = to_direct.TryToDirect(&runtime);
-  Node* const offset = SmiAdd(from, SmiTag(to_direct.offset()));
+  TNode<String> direct_string = to_direct.TryToDirect(&runtime);
+  TNode<IntPtrT> offset = IntPtrAdd(from, to_direct.offset());
   Node* const instance_type = to_direct.instance_type();
 
   // The subject string can only be external or sequential string of either
@@ -4714,7 +5025,8 @@ Node* CodeStubAssembler::SubString(Node* context, Node* string, Node* from,
       Label next(this);
 
       // Short slice.  Copy instead of slicing.
-      GotoIf(SmiLessThan(substr_length, SmiConstant(SlicedString::kMinLength)),
+      GotoIf(IntPtrLessThan(substr_length,
+                            IntPtrConstant(SlicedString::kMinLength)),
              &next);
 
       // Allocate new sliced string.
@@ -4728,15 +5040,15 @@ Node* CodeStubAssembler::SubString(Node* context, Node* string, Node* from,
 
       BIND(&one_byte_slice);
       {
-        var_result.Bind(
-            AllocateSlicedOneByteString(substr_length, direct_string, offset));
+        var_result = AllocateSlicedOneByteString(SmiTag(substr_length),
+                                                 direct_string, SmiTag(offset));
         Goto(&end);
       }
 
       BIND(&two_byte_slice);
       {
-        var_result.Bind(
-            AllocateSlicedTwoByteString(substr_length, direct_string, offset));
+        var_result = AllocateSlicedTwoByteString(SmiTag(substr_length),
+                                                 direct_string, SmiTag(offset));
         Goto(&end);
       }
 
@@ -4747,9 +5059,8 @@ Node* CodeStubAssembler::SubString(Node* context, Node* string, Node* from,
     // encoding at this point.
     GotoIf(to_direct.is_external(), &external_string);
 
-    var_result.Bind(
-        AllocAndCopyStringCharacters(context, direct_string, instance_type,
-                                     SmiUntag(offset), substr_length));
+    var_result = AllocAndCopyStringCharacters(direct_string, instance_type,
+                                              offset, SmiTag(substr_length));
 
     Counters* counters = isolate()->counters();
     IncrementCounter(counters->sub_string_native(), 1);
@@ -4762,9 +5073,8 @@ Node* CodeStubAssembler::SubString(Node* context, Node* string, Node* from,
   {
     Node* const fake_sequential_string = to_direct.PointerToString(&runtime);
 
-    var_result.Bind(AllocAndCopyStringCharacters(
-        context, fake_sequential_string, instance_type, SmiUntag(offset),
-        substr_length));
+    var_result = AllocAndCopyStringCharacters(
+        fake_sequential_string, instance_type, offset, SmiTag(substr_length));
 
     Counters* counters = isolate()->counters();
     IncrementCounter(counters->sub_string_native(), 1);
@@ -4775,44 +5085,37 @@ Node* CodeStubAssembler::SubString(Node* context, Node* string, Node* from,
   // Substrings of length 1 are generated through CharCodeAt and FromCharCode.
   BIND(&single_char);
   {
-    TNode<Int32T> char_code = StringCharCodeAt(string, SmiUntag(from));
-    var_result.Bind(StringFromCharCode(char_code));
+    TNode<Int32T> char_code = StringCharCodeAt(string, from);
+    var_result = StringFromSingleCharCode(char_code);
     Goto(&end);
   }
 
   BIND(&original_string_or_invalid_length);
   {
-    if (flags == SubStringFlags::NONE) {
-      // Longer than original string's length or negative: unsafe arguments.
-      GotoIf(SmiAbove(substr_length, string_length), &runtime);
-    } else {
-      // with flag SubStringFlags::FROM_TO_ARE_BOUNDED, the only way we can
-      // get here is if substr_length is equal to string_length.
-      CSA_ASSERT(this, SmiEqual(substr_length, string_length));
-    }
+    CSA_ASSERT(this, IntPtrEqual(substr_length, string_length));
 
     // Equal length - check if {from, to} == {0, str.length}.
-    GotoIf(SmiAbove(from, SmiConstant(0)), &runtime);
+    GotoIf(UintPtrGreaterThan(from, IntPtrConstant(0)), &runtime);
 
     // Return the original string (substr_length == string_length).
 
     Counters* counters = isolate()->counters();
     IncrementCounter(counters->sub_string_native(), 1);
 
-    var_result.Bind(string);
+    var_result = string;
     Goto(&end);
   }
 
   // Fall back to a runtime call.
   BIND(&runtime);
   {
-    var_result.Bind(
-        CallRuntime(Runtime::kSubString, context, string, from, to));
+    var_result =
+        CAST(CallRuntime(Runtime::kStringSubstring, NoContextConstant(), string,
+                         SmiTag(from), SmiTag(to)));
     Goto(&end);
   }
 
   BIND(&end);
-  CSA_ASSERT(this, IsString(var_result.value()));
   return var_result.value();
 }
 
@@ -4833,7 +5136,7 @@ ToDirectStringAssembler::ToDirectStringAssembler(
   var_is_external_.Bind(Int32Constant(0));
 }
 
-Node* ToDirectStringAssembler::TryToDirect(Label* if_bailout) {
+TNode<String> ToDirectStringAssembler::TryToDirect(Label* if_bailout) {
   VariableList vars({&var_string_, &var_offset_, &var_instance_type_}, zone());
   Label dispatch(this, vars);
   Label if_iscons(this);
@@ -4916,7 +5219,7 @@ Node* ToDirectStringAssembler::TryToDirect(Label* if_bailout) {
   Goto(&out);
 
   BIND(&out);
-  return var_string_.value();
+  return CAST(var_string_.value());
 }
 
 Node* ToDirectStringAssembler::TryToSequential(StringPointerKind ptr_kind,
@@ -5034,22 +5337,23 @@ void CodeStubAssembler::MaybeDerefIndirectStrings(Variable* var_left,
   // Fall through if neither string was an indirect string.
 }
 
-Node* CodeStubAssembler::StringAdd(Node* context, Node* left, Node* right,
-                                   AllocationFlags flags) {
-  VARIABLE(result, MachineRepresentation::kTagged);
+TNode<String> CodeStubAssembler::StringAdd(Node* context, TNode<String> left,
+                                           TNode<String> right,
+                                           AllocationFlags flags) {
+  TVARIABLE(String, result);
   Label check_right(this), runtime(this, Label::kDeferred), cons(this),
       done(this, &result), done_native(this, &result);
   Counters* counters = isolate()->counters();
 
   TNode<Smi> left_length = LoadStringLengthAsSmi(left);
   GotoIf(SmiNotEqual(SmiConstant(0), left_length), &check_right);
-  result.Bind(right);
+  result = right;
   Goto(&done_native);
 
   BIND(&check_right);
   TNode<Smi> right_length = LoadStringLengthAsSmi(right);
   GotoIf(SmiNotEqual(SmiConstant(0), right_length), &cons);
-  result.Bind(left);
+  result = left;
   Goto(&done_native);
 
   BIND(&cons);
@@ -5062,16 +5366,16 @@ Node* CodeStubAssembler::StringAdd(Node* context, Node* left, Node* right,
     GotoIf(SmiGreaterThan(new_length, SmiConstant(String::kMaxLength)),
            &runtime);
 
-    VARIABLE(var_left, MachineRepresentation::kTagged, left);
-    VARIABLE(var_right, MachineRepresentation::kTagged, right);
+    TVARIABLE(String, var_left, left);
+    TVARIABLE(String, var_right, right);
     Variable* input_vars[2] = {&var_left, &var_right};
     Label non_cons(this, 2, input_vars);
     Label slow(this, Label::kDeferred);
     GotoIf(SmiLessThan(new_length, SmiConstant(ConsString::kMinLength)),
            &non_cons);
 
-    result.Bind(NewConsString(context, new_length, var_left.value(),
-                              var_right.value(), flags));
+    result = NewConsString(context, new_length, var_left.value(),
+                           var_right.value(), flags);
     Goto(&done_native);
 
     BIND(&non_cons);
@@ -5099,29 +5403,27 @@ Node* CodeStubAssembler::StringAdd(Node* context, Node* left, Node* right,
                        Int32Constant(kTwoByteStringTag)),
            &two_byte);
     // One-byte sequential string case
-    Node* new_string = AllocateSeqOneByteString(context, new_length);
-    CopyStringCharacters(var_left.value(), new_string, IntPtrConstant(0),
+    result = AllocateSeqOneByteString(context, new_length);
+    CopyStringCharacters(var_left.value(), result.value(), IntPtrConstant(0),
                          IntPtrConstant(0), word_left_length,
                          String::ONE_BYTE_ENCODING, String::ONE_BYTE_ENCODING);
-    CopyStringCharacters(var_right.value(), new_string, IntPtrConstant(0),
+    CopyStringCharacters(var_right.value(), result.value(), IntPtrConstant(0),
                          word_left_length, word_right_length,
                          String::ONE_BYTE_ENCODING, String::ONE_BYTE_ENCODING);
-    result.Bind(new_string);
     Goto(&done_native);
 
     BIND(&two_byte);
     {
       // Two-byte sequential string case
-      new_string = AllocateSeqTwoByteString(context, new_length);
-      CopyStringCharacters(var_left.value(), new_string, IntPtrConstant(0),
+      result = AllocateSeqTwoByteString(context, new_length);
+      CopyStringCharacters(var_left.value(), result.value(), IntPtrConstant(0),
                            IntPtrConstant(0), word_left_length,
                            String::TWO_BYTE_ENCODING,
                            String::TWO_BYTE_ENCODING);
-      CopyStringCharacters(var_right.value(), new_string, IntPtrConstant(0),
+      CopyStringCharacters(var_right.value(), result.value(), IntPtrConstant(0),
                            word_left_length, word_right_length,
                            String::TWO_BYTE_ENCODING,
                            String::TWO_BYTE_ENCODING);
-      result.Bind(new_string);
       Goto(&done_native);
     }
 
@@ -5135,7 +5437,7 @@ Node* CodeStubAssembler::StringAdd(Node* context, Node* left, Node* right,
   }
   BIND(&runtime);
   {
-    result.Bind(CallRuntime(Runtime::kStringAdd, context, left, right));
+    result = CAST(CallRuntime(Runtime::kStringAdd, context, left, right));
     Goto(&done);
   }
 
@@ -5149,8 +5451,8 @@ Node* CodeStubAssembler::StringAdd(Node* context, Node* left, Node* right,
   return result.value();
 }
 
-TNode<String> CodeStubAssembler::StringFromCodePoint(TNode<Int32T> codepoint,
-                                                     UnicodeEncoding encoding) {
+TNode<String> CodeStubAssembler::StringFromSingleCodePoint(
+    TNode<Int32T> codepoint, UnicodeEncoding encoding) {
   VARIABLE(var_result, MachineRepresentation::kTagged, EmptyStringConstant());
 
   Label if_isword16(this), if_isword32(this), return_result(this);
@@ -5160,7 +5462,7 @@ TNode<String> CodeStubAssembler::StringFromCodePoint(TNode<Int32T> codepoint,
 
   BIND(&if_isword16);
   {
-    var_result.Bind(StringFromCharCode(codepoint));
+    var_result.Bind(StringFromSingleCharCode(codepoint));
     Goto(&return_result);
   }
 
@@ -5200,8 +5502,7 @@ TNode<String> CodeStubAssembler::StringFromCodePoint(TNode<Int32T> codepoint,
   return CAST(var_result.value());
 }
 
-TNode<Number> CodeStubAssembler::StringToNumber(SloppyTNode<String> input) {
-  CSA_SLOW_ASSERT(this, IsString(input));
+TNode<Number> CodeStubAssembler::StringToNumber(TNode<String> input) {
   Label runtime(this, Label::kDeferred);
   Label end(this);
 
@@ -5224,11 +5525,11 @@ TNode<Number> CodeStubAssembler::StringToNumber(SloppyTNode<String> input) {
   }
 
   BIND(&end);
-  return var_result;
+  return var_result.value();
 }
 
-Node* CodeStubAssembler::NumberToString(Node* argument) {
-  VARIABLE(result, MachineRepresentation::kTagged);
+TNode<String> CodeStubAssembler::NumberToString(TNode<Number> input) {
+  TVARIABLE(String, result);
   Label runtime(this, Label::kDeferred), smi(this), done(this, &result);
 
   // Load the number string cache.
@@ -5239,23 +5540,22 @@ Node* CodeStubAssembler::NumberToString(Node* argument) {
   // TODO(ishell): cleanup mask handling.
   Node* mask =
       BitcastTaggedToWord(LoadFixedArrayBaseLength(number_string_cache));
-  Node* one = IntPtrConstant(1);
+  TNode<IntPtrT> one = IntPtrConstant(1);
   mask = IntPtrSub(mask, one);
 
-  GotoIf(TaggedIsSmi(argument), &smi);
+  GotoIf(TaggedIsSmi(input), &smi);
 
-  // Argument isn't smi, check to see if it's a heap-number.
-  GotoIfNot(IsHeapNumber(argument), &runtime);
+  TNode<HeapNumber> heap_number_input = CAST(input);
 
   // Make a hash from the two 32-bit values of the double.
-  Node* low =
-      LoadObjectField(argument, HeapNumber::kValueOffset, MachineType::Int32());
-  Node* high = LoadObjectField(argument, HeapNumber::kValueOffset + kIntSize,
-                               MachineType::Int32());
-  Node* hash = Word32Xor(low, high);
-  hash = ChangeInt32ToIntPtr(hash);
-  hash = WordShl(hash, one);
-  Node* index = WordAnd(hash, WordSar(mask, SmiShiftBitsConstant()));
+  TNode<Int32T> low =
+      LoadObjectField<Int32T>(heap_number_input, HeapNumber::kValueOffset);
+  TNode<Int32T> high = LoadObjectField<Int32T>(
+      heap_number_input, HeapNumber::kValueOffset + kIntSize);
+  TNode<Word32T> hash = Word32Xor(low, high);
+  TNode<WordT> word_hash = WordShl(ChangeInt32ToIntPtr(hash), one);
+  TNode<WordT> index =
+      WordAnd(word_hash, WordSar(mask, SmiShiftBitsConstant()));
 
   // Cache entry's key must be a heap number
   Node* number_key = LoadFixedArrayElement(number_string_cache, index);
@@ -5272,14 +5572,15 @@ Node* CodeStubAssembler::NumberToString(Node* argument) {
 
   // Heap number match, return value from cache entry.
   IncrementCounter(isolate()->counters()->number_to_string_native(), 1);
-  result.Bind(LoadFixedArrayElement(number_string_cache, index, kPointerSize));
+  result =
+      CAST(LoadFixedArrayElement(number_string_cache, index, kPointerSize));
   Goto(&done);
 
   BIND(&runtime);
   {
     // No cache entry, go to the runtime.
-    result.Bind(CallRuntime(Runtime::kNumberToStringSkipCache,
-                            NoContextConstant(), argument));
+    result = CAST(CallRuntime(Runtime::kNumberToStringSkipCache,
+                              NoContextConstant(), input));
   }
   Goto(&done);
 
@@ -5287,42 +5588,42 @@ Node* CodeStubAssembler::NumberToString(Node* argument) {
   {
     // Load the smi key, make sure it matches the smi we're looking for.
     Node* smi_index = BitcastWordToTagged(
-        WordAnd(WordShl(BitcastTaggedToWord(argument), one), mask));
+        WordAnd(WordShl(BitcastTaggedToWord(input), one), mask));
     Node* smi_key = LoadFixedArrayElement(number_string_cache, smi_index, 0,
                                           SMI_PARAMETERS);
-    GotoIf(WordNotEqual(smi_key, argument), &runtime);
+    GotoIf(WordNotEqual(smi_key, input), &runtime);
 
     // Smi match, return value from cache entry.
     IncrementCounter(isolate()->counters()->number_to_string_native(), 1);
-    result.Bind(LoadFixedArrayElement(number_string_cache, smi_index,
-                                      kPointerSize, SMI_PARAMETERS));
+    result = CAST(LoadFixedArrayElement(number_string_cache, smi_index,
+                                        kPointerSize, SMI_PARAMETERS));
     Goto(&done);
   }
 
   BIND(&done);
-  CSA_ASSERT(this, IsString(result.value()));
   return result.value();
 }
 
-Node* CodeStubAssembler::ToName(Node* context, Node* value) {
+TNode<Name> CodeStubAssembler::ToName(SloppyTNode<Context> context,
+                                      SloppyTNode<Object> value) {
   Label end(this);
-  VARIABLE(var_result, MachineRepresentation::kTagged);
+  TVARIABLE(Name, var_result);
 
   Label is_number(this);
   GotoIf(TaggedIsSmi(value), &is_number);
 
   Label not_name(this);
-  Node* value_instance_type = LoadInstanceType(value);
+  TNode<Int32T> value_instance_type = LoadInstanceType(CAST(value));
   STATIC_ASSERT(FIRST_NAME_TYPE == FIRST_TYPE);
   GotoIf(Int32GreaterThan(value_instance_type, Int32Constant(LAST_NAME_TYPE)),
          &not_name);
 
-  var_result.Bind(value);
+  var_result = CAST(value);
   Goto(&end);
 
   BIND(&is_number);
   {
-    var_result.Bind(CallBuiltin(Builtins::kNumberToString, context, value));
+    var_result = CAST(CallBuiltin(Builtins::kNumberToString, context, value));
     Goto(&end);
   }
 
@@ -5335,18 +5636,17 @@ Node* CodeStubAssembler::ToName(Node* context, Node* value) {
     GotoIfNot(InstanceTypeEqual(value_instance_type, ODDBALL_TYPE),
               &not_oddball);
 
-    var_result.Bind(LoadObjectField(value, Oddball::kToStringOffset));
+    var_result = LoadObjectField<String>(CAST(value), Oddball::kToStringOffset);
     Goto(&end);
 
     BIND(&not_oddball);
     {
-      var_result.Bind(CallRuntime(Runtime::kToName, context, value));
+      var_result = CAST(CallRuntime(Runtime::kToName, context, value));
       Goto(&end);
     }
   }
 
   BIND(&end);
-  CSA_ASSERT(this, IsName(var_result.value()));
   return var_result.value();
 }
 
@@ -5382,7 +5682,8 @@ Node* CodeStubAssembler::NonNumberToNumberOrNumeric(
     BIND(&if_inputisstring);
     {
       // The {input} is a String, use the fast stub to convert it to a Number.
-      var_result.Bind(StringToNumber(input));
+      TNode<String> string_input = CAST(input);
+      var_result.Bind(StringToNumber(string_input));
       Goto(&end);
     }
 
@@ -5479,6 +5780,30 @@ TNode<Numeric> CodeStubAssembler::NonNumberToNumeric(
   return UncheckedCast<Numeric>(result);
 }
 
+TNode<Number> CodeStubAssembler::ToNumber_Inline(SloppyTNode<Context> context,
+                                                 SloppyTNode<Object> input) {
+  TVARIABLE(Number, var_result);
+  Label end(this), not_smi(this, Label::kDeferred);
+
+  GotoIfNot(TaggedIsSmi(input), &not_smi);
+  var_result = CAST(input);
+  Goto(&end);
+
+  BIND(&not_smi);
+  {
+    var_result =
+        Select<Number>(IsHeapNumber(input), [=] { return CAST(input); },
+                       [=] {
+                         return CAST(CallBuiltin(Builtins::kNonNumberToNumber,
+                                                 context, input));
+                       });
+    Goto(&end);
+  }
+
+  BIND(&end);
+  return var_result.value();
+}
+
 TNode<Number> CodeStubAssembler::ToNumber(SloppyTNode<Context> context,
                                           SloppyTNode<Object> input,
                                           BigIntHandling bigint_handling) {
@@ -5501,15 +5826,36 @@ TNode<Number> CodeStubAssembler::ToNumber(SloppyTNode<Context> context,
     var_result = input_hn;
     Goto(&end);
 
-    BIND(&not_heap_number);
-    {
-      var_result = NonNumberToNumber(context, input_ho, bigint_handling);
-      Goto(&end);
-    }
-  }
+    BIND(&not_heap_number);
+    {
+      var_result = NonNumberToNumber(context, input_ho, bigint_handling);
+      Goto(&end);
+    }
+  }
+
+  BIND(&end);
+  return var_result.value();
+}
+
+TNode<BigInt> CodeStubAssembler::ToBigInt(SloppyTNode<Context> context,
+                                          SloppyTNode<Object> input) {
+  TVARIABLE(BigInt, var_result);
+  Label if_bigint(this), done(this), if_throw(this);
+
+  GotoIf(TaggedIsSmi(input), &if_throw);
+  GotoIf(IsBigInt(input), &if_bigint);
+  var_result = CAST(CallRuntime(Runtime::kToBigInt, context, input));
+  Goto(&done);
+
+  BIND(&if_bigint);
+  var_result = CAST(input);
+  Goto(&done);
+
+  BIND(&if_throw);
+  ThrowTypeError(context, MessageTemplate::kBigIntFromObject, input);
 
-  BIND(&end);
-  return var_result;
+  BIND(&done);
+  return var_result.value();
 }
 
 void CodeStubAssembler::TaggedToNumeric(Node* context, Node* value, Label* done,
@@ -5594,7 +5940,7 @@ TNode<Number> CodeStubAssembler::ToUint32(SloppyTNode<Context> context,
 
   BIND(&if_isnegativesmi);
   {
-    Node* const uint32_value = SmiToWord32(number);
+    Node* const uint32_value = SmiToInt32(number);
     Node* float64_value = ChangeUint32ToFloat64(uint32_value);
     var_result.Bind(AllocateHeapNumberWithValue(float64_value));
     Goto(&out);
@@ -5680,7 +6026,8 @@ TNode<String> CodeStubAssembler::ToString(SloppyTNode<Context> context,
   Branch(IsHeapNumberMap(input_map), &is_number, &not_heap_number);
 
   BIND(&is_number);
-  result.Bind(NumberToString(input));
+  TNode<Number> number_input = CAST(input);
+  result.Bind(NumberToString(number_input));
   Goto(&done);
 
   BIND(&not_heap_number);
@@ -5741,79 +6088,98 @@ Node* CodeStubAssembler::JSReceiverToPrimitive(Node* context, Node* input) {
   return result.value();
 }
 
-Node* CodeStubAssembler::ToSmiIndex(Node* const input, Node* const context,
-                                    Label* range_error) {
-  VARIABLE(result, MachineRepresentation::kTagged, input);
+TNode<JSReceiver> CodeStubAssembler::ToObject(SloppyTNode<Context> context,
+                                              SloppyTNode<Object> input) {
+  return CAST(CallBuiltin(Builtins::kToObject, context, input));
+}
+
+TNode<Smi> CodeStubAssembler::ToSmiIndex(TNode<Object> input,
+                                         TNode<Context> context,
+                                         Label* range_error) {
+  TVARIABLE(Smi, result);
   Label check_undefined(this), return_zero(this), defined(this),
       negative_check(this), done(this);
-  Branch(TaggedIsSmi(result.value()), &negative_check, &check_undefined);
+
+  GotoIfNot(TaggedIsSmi(input), &check_undefined);
+  result = CAST(input);
+  Goto(&negative_check);
 
   BIND(&check_undefined);
-  Branch(IsUndefined(result.value()), &return_zero, &defined);
+  Branch(IsUndefined(input), &return_zero, &defined);
 
   BIND(&defined);
-  result.Bind(ToInteger_Inline(CAST(context), CAST(result.value()),
-                               CodeStubAssembler::kTruncateMinusZero));
-  GotoIfNot(TaggedIsSmi(result.value()), range_error);
-  CSA_ASSERT(this, TaggedIsSmi(result.value()));
+  TNode<Number> integer_input =
+      CAST(CallBuiltin(Builtins::kToInteger_TruncateMinusZero, context, input));
+  GotoIfNot(TaggedIsSmi(integer_input), range_error);
+  result = CAST(integer_input);
   Goto(&negative_check);
 
   BIND(&negative_check);
   Branch(SmiLessThan(result.value(), SmiConstant(0)), range_error, &done);
 
   BIND(&return_zero);
-  result.Bind(SmiConstant(0));
+  result = SmiConstant(0);
   Goto(&done);
 
   BIND(&done);
-  CSA_SLOW_ASSERT(this, TaggedIsSmi(result.value()));
   return result.value();
 }
 
-Node* CodeStubAssembler::ToSmiLength(Node* input, Node* const context,
-                                     Label* range_error) {
-  VARIABLE(result, MachineRepresentation::kTagged, input);
-  Label to_integer(this), negative_check(this), return_zero(this), done(this);
-  Branch(TaggedIsSmi(result.value()), &negative_check, &to_integer);
+TNode<Smi> CodeStubAssembler::ToSmiLength(TNode<Object> input,
+                                          TNode<Context> context,
+                                          Label* range_error) {
+  TVARIABLE(Smi, result);
+  Label to_integer(this), negative_check(this),
+      heap_number_negative_check(this), return_zero(this), done(this);
+
+  GotoIfNot(TaggedIsSmi(input), &to_integer);
+  result = CAST(input);
+  Goto(&negative_check);
 
   BIND(&to_integer);
-  result.Bind(ToInteger_Inline(CAST(context), CAST(result.value()),
-                               CodeStubAssembler::kTruncateMinusZero));
-  GotoIf(TaggedIsSmi(result.value()), &negative_check);
-  // result.value() can still be a negative HeapNumber here.
-  Branch(IsTrue(CallBuiltin(Builtins::kLessThan, context, result.value(),
-                            SmiConstant(0))),
-         &return_zero, range_error);
+  {
+    TNode<Number> integer_input = CAST(
+        CallBuiltin(Builtins::kToInteger_TruncateMinusZero, context, input));
+    GotoIfNot(TaggedIsSmi(integer_input), &heap_number_negative_check);
+    result = CAST(integer_input);
+    Goto(&negative_check);
+
+    // integer_input can still be a negative HeapNumber here.
+    BIND(&heap_number_negative_check);
+    TNode<HeapNumber> heap_number_input = CAST(integer_input);
+    Branch(IsTrue(CallBuiltin(Builtins::kLessThan, context, heap_number_input,
+                              SmiConstant(0))),
+           &return_zero, range_error);
+  }
 
   BIND(&negative_check);
   Branch(SmiLessThan(result.value(), SmiConstant(0)), &return_zero, &done);
 
   BIND(&return_zero);
-  result.Bind(SmiConstant(0));
+  result = SmiConstant(0);
   Goto(&done);
 
   BIND(&done);
-  CSA_SLOW_ASSERT(this, TaggedIsSmi(result.value()));
   return result.value();
 }
 
-Node* CodeStubAssembler::ToLength_Inline(Node* const context,
-                                         Node* const input) {
-  Node* const smi_zero = SmiConstant(0);
-  return Select(
-      TaggedIsSmi(input), [=] { return SmiMax(input, smi_zero); },
-      [=] { return CallBuiltin(Builtins::kToLength, context, input); },
-      MachineRepresentation::kTagged);
+TNode<Number> CodeStubAssembler::ToLength_Inline(SloppyTNode<Context> context,
+                                                 SloppyTNode<Object> input) {
+  TNode<Smi> smi_zero = SmiConstant(0);
+  return Select<Number>(
+      TaggedIsSmi(input), [=] { return SmiMax(CAST(input), smi_zero); },
+      [=] { return CAST(CallBuiltin(Builtins::kToLength, context, input)); });
 }
 
 TNode<Number> CodeStubAssembler::ToInteger_Inline(
-    TNode<Context> context, TNode<Object> input, ToIntegerTruncationMode mode) {
+    SloppyTNode<Context> context, SloppyTNode<Object> input,
+    ToIntegerTruncationMode mode) {
   Builtins::Name builtin = (mode == kNoTruncation)
                                ? Builtins::kToInteger
                                : Builtins::kToInteger_TruncateMinusZero;
-  return CAST(Select(TaggedIsSmi(input), [=] { return input; },
-                     [=] { return CallBuiltin(builtin, context, input); },
-                     MachineRepresentation::kTagged));
+  return Select<Number>(
+      TaggedIsSmi(input), [=] { return CAST(input); },
+      [=] { return CAST(CallBuiltin(builtin, context, input)); });
 }
 
 TNode<Number> CodeStubAssembler::ToInteger(SloppyTNode<Context> context,
@@ -5829,7 +6195,7 @@ TNode<Number> CodeStubAssembler::ToInteger(SloppyTNode<Context> context,
     Label return_zero(this, Label::kDeferred);
 
     // Load the current {arg} value.
-    TNode<Object> arg = var_arg;
+    TNode<Object> arg = var_arg.value();
 
     // Check if {arg} is a Smi.
     GotoIf(TaggedIsSmi(arg), &out);
@@ -5874,8 +6240,10 @@ TNode<Number> CodeStubAssembler::ToInteger(SloppyTNode<Context> context,
   }
 
   BIND(&out);
-  if (mode == kTruncateMinusZero) CSA_ASSERT(this, IsNumberNormalized(var_arg));
-  return CAST(var_arg);
+  if (mode == kTruncateMinusZero) {
+    CSA_ASSERT(this, IsNumberNormalized(CAST(var_arg.value())));
+  }
+  return CAST(var_arg.value());
 }
 
 TNode<Uint32T> CodeStubAssembler::DecodeWord32(SloppyTNode<Word32T> word32,
@@ -6051,8 +6419,8 @@ TNode<IntPtrT> CodeStubAssembler::IntPtrMax(SloppyTNode<IntPtrT> left,
       ToIntPtrConstant(right, right_constant)) {
     return IntPtrConstant(std::max(left_constant, right_constant));
   }
-  return SelectConstant(IntPtrGreaterThanOrEqual(left, right), left, right,
-                        MachineType::PointerRepresentation());
+  return SelectConstant<IntPtrT>(IntPtrGreaterThanOrEqual(left, right), left,
+                                 right);
 }
 
 TNode<IntPtrT> CodeStubAssembler::IntPtrMin(SloppyTNode<IntPtrT> left,
@@ -6063,8 +6431,8 @@ TNode<IntPtrT> CodeStubAssembler::IntPtrMin(SloppyTNode<IntPtrT> left,
       ToIntPtrConstant(right, right_constant)) {
     return IntPtrConstant(std::min(left_constant, right_constant));
   }
-  return SelectConstant(IntPtrLessThanOrEqual(left, right), left, right,
-                        MachineType::PointerRepresentation());
+  return SelectConstant<IntPtrT>(IntPtrLessThanOrEqual(left, right), left,
+                                 right);
 }
 
 template <class Dictionary>
@@ -6176,7 +6544,7 @@ Node* CodeStubAssembler::ComputeIntegerHash(Node* key) {
 
 Node* CodeStubAssembler::ComputeIntegerHash(Node* key, Node* seed) {
   // See v8::internal::ComputeIntegerHash()
-  Node* hash = TruncateWordToWord32(key);
+  Node* hash = TruncateIntPtrToInt32(key);
   hash = Word32Xor(hash, seed);
   hash = Int32Add(Word32Xor(hash, Int32Constant(0xFFFFFFFF)),
                   Word32Shl(hash, Int32Constant(15)));
@@ -6354,107 +6722,130 @@ void CodeStubAssembler::Add(Node* dictionary, Node* key, Node* value,
 template void CodeStubAssembler::Add<NameDictionary>(Node*, Node*, Node*,
                                                      Label*);
 
-void CodeStubAssembler::DescriptorLookupLinear(Node* unique_name,
-                                               Node* descriptors, Node* nof,
-                                               Label* if_found,
-                                               Variable* var_name_index,
-                                               Label* if_not_found) {
-  Comment("DescriptorLookupLinear");
-  Node* first_inclusive = IntPtrConstant(DescriptorArray::ToKeyIndex(0));
-  Node* factor = IntPtrConstant(DescriptorArray::kEntrySize);
-  Node* last_exclusive = IntPtrAdd(first_inclusive, IntPtrMul(nof, factor));
+template <typename Array>
+void CodeStubAssembler::LookupLinear(TNode<Name> unique_name,
+                                     TNode<Array> array,
+                                     TNode<Uint32T> number_of_valid_entries,
+                                     Label* if_found,
+                                     TVariable<IntPtrT>* var_name_index,
+                                     Label* if_not_found) {
+  Comment("LookupLinear");
+  TNode<IntPtrT> first_inclusive = IntPtrConstant(Array::ToKeyIndex(0));
+  TNode<IntPtrT> factor = IntPtrConstant(Array::kEntrySize);
+  TNode<IntPtrT> last_exclusive = IntPtrAdd(
+      first_inclusive,
+      IntPtrMul(ChangeInt32ToIntPtr(number_of_valid_entries), factor));
 
   BuildFastLoop(last_exclusive, first_inclusive,
-                [this, descriptors, unique_name, if_found,
-                 var_name_index](Node* name_index) {
-                  Node* candidate_name =
-                      LoadFixedArrayElement(descriptors, name_index);
-                  var_name_index->Bind(name_index);
+                [=](SloppyTNode<IntPtrT> name_index) {
+                  TNode<Name> candidate_name =
+                      CAST(LoadFixedArrayElement(array, name_index));
+                  *var_name_index = name_index;
                   GotoIf(WordEqual(candidate_name, unique_name), if_found);
                 },
-                -DescriptorArray::kEntrySize, INTPTR_PARAMETERS,
-                IndexAdvanceMode::kPre);
+                -Array::kEntrySize, INTPTR_PARAMETERS, IndexAdvanceMode::kPre);
   Goto(if_not_found);
 }
 
-Node* CodeStubAssembler::DescriptorArrayNumberOfEntries(Node* descriptors) {
-  return LoadAndUntagToWord32FixedArrayElement(
-      descriptors, IntPtrConstant(DescriptorArray::kDescriptorLengthIndex));
+template <>
+TNode<Uint32T> CodeStubAssembler::NumberOfEntries<DescriptorArray>(
+    TNode<DescriptorArray> descriptors) {
+  return Unsigned(LoadAndUntagToWord32FixedArrayElement(
+      descriptors, IntPtrConstant(DescriptorArray::kDescriptorLengthIndex)));
 }
 
-namespace {
+template <typename Array>
+TNode<IntPtrT> CodeStubAssembler::EntryIndexToIndex(
+    TNode<Uint32T> entry_index) {
+  TNode<Int32T> descriptor_size = Int32Constant(Array::kEntrySize);
+  TNode<Word32T> index = Int32Mul(entry_index, descriptor_size);
+  return ChangeInt32ToIntPtr(index);
+}
 
-Node* DescriptorNumberToIndex(CodeStubAssembler* a, Node* descriptor_number) {
-  Node* descriptor_size = a->Int32Constant(DescriptorArray::kEntrySize);
-  Node* index = a->Int32Mul(descriptor_number, descriptor_size);
-  return a->ChangeInt32ToIntPtr(index);
+template <typename Array>
+TNode<IntPtrT> CodeStubAssembler::ToKeyIndex(TNode<Uint32T> entry_index) {
+  return IntPtrAdd(IntPtrConstant(Array::ToKeyIndex(0)),
+                   EntryIndexToIndex<Array>(entry_index));
 }
 
-}  // namespace
+template TNode<IntPtrT> CodeStubAssembler::ToKeyIndex<DescriptorArray>(
+    TNode<Uint32T>);
 
-Node* CodeStubAssembler::DescriptorArrayToKeyIndex(Node* descriptor_number) {
-  return IntPtrAdd(IntPtrConstant(DescriptorArray::ToKeyIndex(0)),
-                   DescriptorNumberToIndex(this, descriptor_number));
+template <>
+TNode<Uint32T> CodeStubAssembler::GetSortedKeyIndex<DescriptorArray>(
+    TNode<DescriptorArray> descriptors, TNode<Uint32T> descriptor_number) {
+  TNode<Uint32T> details =
+      DescriptorArrayGetDetails(descriptors, descriptor_number);
+  return DecodeWord32<PropertyDetails::DescriptorPointer>(details);
 }
 
-Node* CodeStubAssembler::DescriptorArrayGetSortedKeyIndex(
-    Node* descriptors, Node* descriptor_number) {
-  const int details_offset = DescriptorArray::ToDetailsIndex(0) * kPointerSize;
-  Node* details = LoadAndUntagToWord32FixedArrayElement(
-      descriptors, DescriptorNumberToIndex(this, descriptor_number),
-      details_offset);
-  return DecodeWord32<PropertyDetails::DescriptorPointer>(details);
+template <>
+TNode<Uint32T> CodeStubAssembler::GetSortedKeyIndex<TransitionArray>(
+    TNode<TransitionArray> transitions, TNode<Uint32T> transition_number) {
+  return transition_number;
 }
 
-Node* CodeStubAssembler::DescriptorArrayGetKey(Node* descriptors,
-                                               Node* descriptor_number) {
+template <typename Array>
+TNode<Name> CodeStubAssembler::GetKey(TNode<Array> array,
+                                      TNode<Uint32T> entry_index) {
   const int key_offset = DescriptorArray::ToKeyIndex(0) * kPointerSize;
-  return LoadFixedArrayElement(descriptors,
-                               DescriptorNumberToIndex(this, descriptor_number),
-                               key_offset);
+  return CAST(LoadFixedArrayElement(
+      array, EntryIndexToIndex<Array>(entry_index), key_offset));
 }
 
-void CodeStubAssembler::DescriptorLookupBinary(Node* unique_name,
-                                               Node* descriptors, Node* nof,
-                                               Label* if_found,
-                                               Variable* var_name_index,
-                                               Label* if_not_found) {
-  Comment("DescriptorLookupBinary");
-  VARIABLE(var_low, MachineRepresentation::kWord32, Int32Constant(0));
-  Node* limit =
-      Int32Sub(DescriptorArrayNumberOfEntries(descriptors), Int32Constant(1));
-  VARIABLE(var_high, MachineRepresentation::kWord32, limit);
-  Node* hash = LoadNameHashField(unique_name);
+template TNode<Name> CodeStubAssembler::GetKey<DescriptorArray>(
+    TNode<DescriptorArray>, TNode<Uint32T>);
+
+TNode<Uint32T> CodeStubAssembler::DescriptorArrayGetDetails(
+    TNode<DescriptorArray> descriptors, TNode<Uint32T> descriptor_number) {
+  const int details_offset = DescriptorArray::ToDetailsIndex(0) * kPointerSize;
+  return Unsigned(LoadAndUntagToWord32FixedArrayElement(
+      descriptors, EntryIndexToIndex<DescriptorArray>(descriptor_number),
+      details_offset));
+}
+
+template <typename Array>
+void CodeStubAssembler::LookupBinary(TNode<Name> unique_name,
+                                     TNode<Array> array,
+                                     TNode<Uint32T> number_of_valid_entries,
+                                     Label* if_found,
+                                     TVariable<IntPtrT>* var_name_index,
+                                     Label* if_not_found) {
+  Comment("LookupBinary");
+  TVARIABLE(Uint32T, var_low, Unsigned(Int32Constant(0)));
+  TNode<Uint32T> limit =
+      Unsigned(Int32Sub(NumberOfEntries<Array>(array), Int32Constant(1)));
+  TVARIABLE(Uint32T, var_high, limit);
+  TNode<Uint32T> hash = LoadNameHashField(unique_name);
   CSA_ASSERT(this, Word32NotEqual(hash, Int32Constant(0)));
 
   // Assume non-empty array.
   CSA_ASSERT(this, Uint32LessThanOrEqual(var_low.value(), var_high.value()));
 
-  Variable* loop_vars[] = {&var_high, &var_low};
-  Label binary_loop(this, 2, loop_vars);
+  Label binary_loop(this, {&var_high, &var_low});
   Goto(&binary_loop);
   BIND(&binary_loop);
   {
     // mid = low + (high - low) / 2 (to avoid overflow in "(low + high) / 2").
-    Node* mid =
+    TNode<Uint32T> mid = Unsigned(
         Int32Add(var_low.value(),
-                 Word32Shr(Int32Sub(var_high.value(), var_low.value()), 1));
-    // mid_name = descriptors->GetSortedKey(mid).
-    Node* sorted_key_index = DescriptorArrayGetSortedKeyIndex(descriptors, mid);
-    Node* mid_name = DescriptorArrayGetKey(descriptors, sorted_key_index);
+                 Word32Shr(Int32Sub(var_high.value(), var_low.value()), 1)));
+    // mid_name = array->GetSortedKey(mid).
+    TNode<Uint32T> sorted_key_index = GetSortedKeyIndex<Array>(array, mid);
+    TNode<Name> mid_name = GetKey<Array>(array, sorted_key_index);
 
-    Node* mid_hash = LoadNameHashField(mid_name);
+    TNode<Uint32T> mid_hash = LoadNameHashField(mid_name);
 
     Label mid_greater(this), mid_less(this), merge(this);
     Branch(Uint32GreaterThanOrEqual(mid_hash, hash), &mid_greater, &mid_less);
     BIND(&mid_greater);
     {
-      var_high.Bind(mid);
+      var_high = mid;
       Goto(&merge);
     }
     BIND(&mid_less);
     {
-      var_low.Bind(Int32Add(mid, Int32Constant(1)));
+      var_low = Unsigned(Int32Add(mid, Int32Constant(1)));
       Goto(&merge);
     }
     BIND(&merge);
@@ -6467,59 +6858,69 @@ void CodeStubAssembler::DescriptorLookupBinary(Node* unique_name,
   {
     GotoIf(Int32GreaterThan(var_low.value(), limit), if_not_found);
 
-    Node* sort_index =
-        DescriptorArrayGetSortedKeyIndex(descriptors, var_low.value());
-    Node* current_name = DescriptorArrayGetKey(descriptors, sort_index);
-    Node* current_hash = LoadNameHashField(current_name);
+    TNode<Uint32T> sort_index =
+        GetSortedKeyIndex<Array>(array, var_low.value());
+    TNode<Name> current_name = GetKey<Array>(array, sort_index);
+    TNode<Uint32T> current_hash = LoadNameHashField(current_name);
     GotoIf(Word32NotEqual(current_hash, hash), if_not_found);
     Label next(this);
     GotoIf(WordNotEqual(current_name, unique_name), &next);
-    GotoIf(Int32GreaterThanOrEqual(sort_index, nof), if_not_found);
-    var_name_index->Bind(DescriptorArrayToKeyIndex(sort_index));
+    GotoIf(Uint32GreaterThanOrEqual(sort_index, number_of_valid_entries),
+           if_not_found);
+    *var_name_index = ToKeyIndex<Array>(sort_index);
     Goto(if_found);
 
     BIND(&next);
-    var_low.Bind(Int32Add(var_low.value(), Int32Constant(1)));
+    var_low = Unsigned(Int32Add(var_low.value(), Int32Constant(1)));
     Goto(&scan_loop);
   }
 }
 
-void CodeStubAssembler::DescriptorLookup(Node* unique_name, Node* descriptors,
-                                         Node* bitfield3, Label* if_found,
-                                         Variable* var_name_index,
-                                         Label* if_not_found) {
+void CodeStubAssembler::DescriptorLookup(
+    SloppyTNode<Name> unique_name, SloppyTNode<DescriptorArray> descriptors,
+    SloppyTNode<Uint32T> bitfield3, Label* if_found,
+    TVariable<IntPtrT>* var_name_index, Label* if_not_found) {
   Comment("DescriptorArrayLookup");
-  Node* nof = DecodeWord32<Map::NumberOfOwnDescriptorsBits>(bitfield3);
-  GotoIf(Word32Equal(nof, Int32Constant(0)), if_not_found);
+  TNode<Uint32T> nof = DecodeWord32<Map::NumberOfOwnDescriptorsBits>(bitfield3);
+  Lookup<DescriptorArray>(unique_name, descriptors, nof, if_found,
+                          var_name_index, if_not_found);
+}
+
+template <typename Array>
+void CodeStubAssembler::Lookup(TNode<Name> unique_name, TNode<Array> array,
+                               TNode<Uint32T> number_of_valid_entries,
+                               Label* if_found,
+                               TVariable<IntPtrT>* var_name_index,
+                               Label* if_not_found) {
+  Comment("ArrayLookup");
+  if (!number_of_valid_entries) {
+    number_of_valid_entries = NumberOfEntries(array);
+  }
+  GotoIf(Word32Equal(number_of_valid_entries, Int32Constant(0)), if_not_found);
   Label linear_search(this), binary_search(this);
   const int kMaxElementsForLinearSearch = 32;
-  Branch(Int32LessThanOrEqual(nof, Int32Constant(kMaxElementsForLinearSearch)),
+  Branch(Uint32LessThanOrEqual(number_of_valid_entries,
+                               Int32Constant(kMaxElementsForLinearSearch)),
          &linear_search, &binary_search);
   BIND(&linear_search);
   {
-    DescriptorLookupLinear(unique_name, descriptors, ChangeInt32ToIntPtr(nof),
-                           if_found, var_name_index, if_not_found);
+    LookupLinear<Array>(unique_name, array, number_of_valid_entries, if_found,
+                        var_name_index, if_not_found);
   }
   BIND(&binary_search);
   {
-    DescriptorLookupBinary(unique_name, descriptors, nof, if_found,
-                           var_name_index, if_not_found);
+    LookupBinary<Array>(unique_name, array, number_of_valid_entries, if_found,
+                        var_name_index, if_not_found);
   }
 }
 
 void CodeStubAssembler::TryLookupProperty(
     Node* object, Node* map, Node* instance_type, Node* unique_name,
     Label* if_found_fast, Label* if_found_dict, Label* if_found_global,
-    Variable* var_meta_storage, Variable* var_name_index, Label* if_not_found,
-    Label* if_bailout) {
-  DCHECK_EQ(MachineRepresentation::kTagged, var_meta_storage->rep());
-  DCHECK_EQ(MachineType::PointerRepresentation(), var_name_index->rep());
-
+    TVariable<HeapObject>* var_meta_storage, TVariable<IntPtrT>* var_name_index,
+    Label* if_not_found, Label* if_bailout) {
   Label if_objectisspecial(this);
-  STATIC_ASSERT(JS_GLOBAL_OBJECT_TYPE <= LAST_SPECIAL_RECEIVER_TYPE);
-  GotoIf(Int32LessThanOrEqual(instance_type,
-                              Int32Constant(LAST_SPECIAL_RECEIVER_TYPE)),
-         &if_objectisspecial);
+  GotoIf(IsSpecialReceiverInstanceType(instance_type), &if_objectisspecial);
 
   uint32_t mask =
       Map::HasNamedInterceptorBit::kMask | Map::IsAccessCheckNeededBit::kMask;
@@ -6532,16 +6933,16 @@ void CodeStubAssembler::TryLookupProperty(
          &if_isfastmap);
   BIND(&if_isfastmap);
   {
-    Node* descriptors = LoadMapDescriptors(map);
-    var_meta_storage->Bind(descriptors);
+    TNode<DescriptorArray> descriptors = LoadMapDescriptors(map);
+    *var_meta_storage = descriptors;
 
     DescriptorLookup(unique_name, descriptors, bit_field3, if_found_fast,
                      var_name_index, if_not_found);
   }
   BIND(&if_isslowmap);
   {
-    Node* dictionary = LoadSlowProperties(object);
-    var_meta_storage->Bind(dictionary);
+    TNode<NameDictionary> dictionary = CAST(LoadSlowProperties(object));
+    *var_meta_storage = dictionary;
 
     NameDictionaryLookup<NameDictionary>(dictionary, unique_name, if_found_dict,
                                          var_name_index, if_not_found);
@@ -6558,8 +6959,8 @@ void CodeStubAssembler::TryLookupProperty(
         Map::HasNamedInterceptorBit::kMask | Map::IsAccessCheckNeededBit::kMask;
     GotoIf(IsSetWord32(bit_field, mask), if_bailout);
 
-    Node* dictionary = LoadSlowProperties(object);
-    var_meta_storage->Bind(dictionary);
+    TNode<GlobalDictionary> dictionary = CAST(LoadSlowProperties(object));
+    *var_meta_storage = dictionary;
 
     NameDictionaryLookup<GlobalDictionary>(
         dictionary, unique_name, if_found_global, var_name_index, if_not_found);
@@ -6572,8 +6973,8 @@ void CodeStubAssembler::TryHasOwnProperty(Node* object, Node* map,
                                           Label* if_not_found,
                                           Label* if_bailout) {
   Comment("TryHasOwnProperty");
-  VARIABLE(var_meta_storage, MachineRepresentation::kTagged);
-  VARIABLE(var_name_index, MachineType::PointerRepresentation());
+  TVARIABLE(HeapObject, var_meta_storage);
+  TVARIABLE(IntPtrT, var_name_index);
 
   Label if_found_global(this);
   TryLookupProperty(object, map, instance_type, unique_name, if_found, if_found,
@@ -6610,12 +7011,22 @@ void CodeStubAssembler::LoadPropertyFromFastObject(Node* object, Node* map,
                                                    Variable* var_value) {
   DCHECK_EQ(MachineRepresentation::kWord32, var_details->rep());
   DCHECK_EQ(MachineRepresentation::kTagged, var_value->rep());
-  Comment("[ LoadPropertyFromFastObject");
 
   Node* details =
       LoadDetailsByKeyIndex<DescriptorArray>(descriptors, name_index);
   var_details->Bind(details);
 
+  LoadPropertyFromFastObject(object, map, descriptors, name_index, details,
+                             var_value);
+}
+
+void CodeStubAssembler::LoadPropertyFromFastObject(Node* object, Node* map,
+                                                   Node* descriptors,
+                                                   Node* name_index,
+                                                   Node* details,
+                                                   Variable* var_value) {
+  Comment("[ LoadPropertyFromFastObject");
+
   Node* location = DecodeWord32<PropertyDetails::LocationField>(details);
 
   Label if_in_field(this), if_in_descriptor(this), done(this);
@@ -6865,8 +7276,8 @@ void CodeStubAssembler::TryGetOwnProperty(
   DCHECK_EQ(MachineRepresentation::kTagged, var_value->rep());
   Comment("TryGetOwnProperty");
 
-  VARIABLE(var_meta_storage, MachineRepresentation::kTagged);
-  VARIABLE(var_entry, MachineType::PointerRepresentation());
+  TVARIABLE(HeapObject, var_meta_storage);
+  TVARIABLE(IntPtrT, var_entry);
 
   Label if_found_fast(this), if_found_dict(this), if_found_global(this);
 
@@ -6874,8 +7285,7 @@ void CodeStubAssembler::TryGetOwnProperty(
   if (!var_details) {
     var_details = &local_var_details;
   }
-  Variable* vars[] = {var_value, var_details};
-  Label if_found(this, 2, vars);
+  Label if_found(this, {var_value, var_details});
 
   TryLookupProperty(object, map, instance_type, unique_name, &if_found_fast,
                     &if_found_dict, &if_found_global, &var_meta_storage,
@@ -6925,9 +7335,7 @@ void CodeStubAssembler::TryLookupElement(Node* object, Node* map,
                                          Label* if_absent, Label* if_not_found,
                                          Label* if_bailout) {
   // Handle special objects in runtime.
-  GotoIf(Int32LessThanOrEqual(instance_type,
-                              Int32Constant(LAST_SPECIAL_RECEIVER_TYPE)),
-         if_bailout);
+  GotoIf(IsSpecialReceiverInstanceType(instance_type), if_bailout);
 
   Node* elements_kind = LoadMapElementsKind(map);
 
@@ -6960,6 +7368,8 @@ void CodeStubAssembler::TryLookupElement(Node* object, Node* map,
       FLOAT32_ELEMENTS,
       FLOAT64_ELEMENTS,
       UINT8_CLAMPED_ELEMENTS,
+      BIGUINT64_ELEMENTS,
+      BIGINT64_ELEMENTS,
   };
   Label* labels[] = {
       &if_isobjectorsmi, &if_isobjectorsmi, &if_isobjectorsmi,
@@ -6978,6 +7388,8 @@ void CodeStubAssembler::TryLookupElement(Node* object, Node* map,
       &if_typedarray,
       &if_typedarray,
       &if_typedarray,
+      &if_typedarray,
+      &if_typedarray,
   };
   // clang-format on
   STATIC_ASSERT(arraysize(values) == arraysize(labels));
@@ -7325,10 +7737,10 @@ Node* CodeStubAssembler::OrdinaryHasInstance(Node* context, Node* callable,
   return var_result.value();
 }
 
-Node* CodeStubAssembler::ElementOffsetFromIndex(Node* index_node,
-                                                ElementsKind kind,
-                                                ParameterMode mode,
-                                                int base_size) {
+TNode<IntPtrT> CodeStubAssembler::ElementOffsetFromIndex(Node* index_node,
+                                                         ElementsKind kind,
+                                                         ParameterMode mode,
+                                                         int base_size) {
   int element_size_shift = ElementsKindToShiftSize(kind);
   int element_size = 1 << element_size_shift;
   int const kSmiShiftBits = kSmiShiftSize + kSmiTagSize;
@@ -7348,18 +7760,20 @@ Node* CodeStubAssembler::ElementOffsetFromIndex(Node* index_node,
     return IntPtrConstant(base_size + element_size * index);
   }
 
-  Node* shifted_index =
+  TNode<WordT> shifted_index =
       (element_size_shift == 0)
-          ? index_node
+          ? UncheckedCast<WordT>(index_node)
           : ((element_size_shift > 0)
                  ? WordShl(index_node, IntPtrConstant(element_size_shift))
                  : WordSar(index_node, IntPtrConstant(-element_size_shift)));
-  return IntPtrAdd(IntPtrConstant(base_size), shifted_index);
+  return IntPtrAdd(IntPtrConstant(base_size), Signed(shifted_index));
 }
 
 Node* CodeStubAssembler::LoadFeedbackVector(Node* closure) {
-  Node* cell = LoadObjectField(closure, JSFunction::kFeedbackVectorOffset);
-  return LoadObjectField(cell, Cell::kValueOffset);
+  Node* feedback_cell =
+      LoadObjectField(closure, JSFunction::kFeedbackCellOffset);
+  CSA_ASSERT(this, IsFeedbackCell(feedback_cell));
+  return LoadObjectField(feedback_cell, FeedbackCell::kValueOffset);
 }
 
 Node* CodeStubAssembler::LoadFeedbackVectorForStub() {
@@ -7431,37 +7845,41 @@ void CodeStubAssembler::CheckForAssociatedProtector(Node* name,
          if_protector);
   GotoIf(WordEqual(name, LoadRoot(Heap::kiterator_symbolRootIndex)),
          if_protector);
+  GotoIf(WordEqual(name, LoadRoot(Heap::knext_stringRootIndex)), if_protector);
   GotoIf(WordEqual(name, LoadRoot(Heap::kspecies_symbolRootIndex)),
          if_protector);
   GotoIf(WordEqual(name, LoadRoot(Heap::kis_concat_spreadable_symbolRootIndex)),
          if_protector);
+  GotoIf(WordEqual(name, LoadRoot(Heap::kresolve_stringRootIndex)),
+         if_protector);
+  GotoIf(WordEqual(name, LoadRoot(Heap::kthen_stringRootIndex)), if_protector);
   // Fall through if no case matched.
 }
 
-Node* CodeStubAssembler::LoadReceiverMap(Node* receiver) {
-  return Select(TaggedIsSmi(receiver),
-                [=] { return LoadRoot(Heap::kHeapNumberMapRootIndex); },
-                [=] { return LoadMap(receiver); },
-                MachineRepresentation::kTagged);
+TNode<Map> CodeStubAssembler::LoadReceiverMap(SloppyTNode<Object> receiver) {
+  return Select<Map>(
+      TaggedIsSmi(receiver),
+      [=] { return CAST(LoadRoot(Heap::kHeapNumberMapRootIndex)); },
+      [=] { return LoadMap(UncheckedCast<HeapObject>(receiver)); });
 }
 
-Node* CodeStubAssembler::TryToIntptr(Node* key, Label* miss) {
-  VARIABLE(var_intptr_key, MachineType::PointerRepresentation());
+TNode<IntPtrT> CodeStubAssembler::TryToIntptr(Node* key, Label* miss) {
+  TVARIABLE(IntPtrT, var_intptr_key);
   Label done(this, &var_intptr_key), key_is_smi(this);
   GotoIf(TaggedIsSmi(key), &key_is_smi);
   // Try to convert a heap number to a Smi.
   GotoIfNot(IsHeapNumber(key), miss);
   {
-    Node* value = LoadHeapNumberValue(key);
-    Node* int_value = RoundFloat64ToInt32(value);
+    TNode<Float64T> value = LoadHeapNumberValue(key);
+    TNode<Int32T> int_value = RoundFloat64ToInt32(value);
     GotoIfNot(Float64Equal(value, ChangeInt32ToFloat64(int_value)), miss);
-    var_intptr_key.Bind(ChangeInt32ToIntPtr(int_value));
+    var_intptr_key = ChangeInt32ToIntPtr(int_value);
     Goto(&done);
   }
 
   BIND(&key_is_smi);
   {
-    var_intptr_key.Bind(SmiUntag(key));
+    var_intptr_key = SmiUntag(key);
     Goto(&done);
   }
 
@@ -7571,10 +7989,10 @@ TNode<Context> CodeStubAssembler::LoadScriptContext(
   TNode<ScriptContextTable> script_context_table = CAST(
       LoadContextElement(native_context, Context::SCRIPT_CONTEXT_TABLE_INDEX));
 
-  Node* script_context = LoadFixedArrayElement(
+  TNode<Context> script_context = CAST(LoadFixedArrayElement(
       script_context_table, context_index,
-      ScriptContextTable::kFirstContextSlotIndex * kPointerSize);
-  return CAST(script_context);
+      ScriptContextTable::kFirstContextSlotIndex * kPointerSize));
+  return script_context;
 }
 
 namespace {
@@ -7658,7 +8076,7 @@ Node* CodeStubAssembler::Float64ToUint8Clamped(Node* float64_value) {
 }
 
 Node* CodeStubAssembler::PrepareValueForWriteToTypedArray(
-    Node* input, ElementsKind elements_kind, Label* bailout) {
+    TNode<Object> input, ElementsKind elements_kind, TNode<Context> context) {
   DCHECK(IsFixedTypedArrayElementsKind(elements_kind));
 
   MachineRepresentation rep;
@@ -7683,17 +8101,24 @@ Node* CodeStubAssembler::PrepareValueForWriteToTypedArray(
   }
 
   VARIABLE(var_result, rep);
-  Label done(this, &var_result), if_smi(this), if_heapnumber(this);
-  GotoIf(TaggedIsSmi(input), &if_smi);
+  VARIABLE(var_input, MachineRepresentation::kTagged, input);
+  Label done(this, &var_result), if_smi(this), if_heapnumber_or_oddball(this),
+      convert(this), loop(this, &var_input);
+  Goto(&loop);
+  BIND(&loop);
+  GotoIf(TaggedIsSmi(var_input.value()), &if_smi);
   // We can handle both HeapNumber and Oddball here, since Oddball has the
   // same layout as the HeapNumber for the HeapNumber::value field. This
   // way we can also properly optimize stores of oddballs to typed arrays.
-  GotoIf(IsHeapNumber(input), &if_heapnumber);
-  Branch(HasInstanceType(input, ODDBALL_TYPE), &if_heapnumber, bailout);
+  GotoIf(IsHeapNumber(var_input.value()), &if_heapnumber_or_oddball);
+  STATIC_ASSERT(HeapNumber::kValueOffset == Oddball::kToNumberRawOffset);
+  Branch(HasInstanceType(var_input.value(), ODDBALL_TYPE),
+         &if_heapnumber_or_oddball, &convert);
 
-  BIND(&if_heapnumber);
+  BIND(&if_heapnumber_or_oddball);
   {
-    Node* value = LoadHeapNumberValue(input);
+    Node* value = UncheckedCast<Float64T>(LoadObjectField(
+        var_input.value(), HeapNumber::kValueOffset, MachineType::Float64()));
     if (rep == MachineRepresentation::kWord32) {
       if (elements_kind == UINT8_CLAMPED_ELEMENTS) {
         value = Float64ToUint8Clamped(value);
@@ -7711,7 +8136,7 @@ Node* CodeStubAssembler::PrepareValueForWriteToTypedArray(
 
   BIND(&if_smi);
   {
-    Node* value = SmiToWord32(input);
+    Node* value = SmiToInt32(var_input.value());
     if (rep == MachineRepresentation::kFloat32) {
       value = RoundInt32ToFloat32(value);
     } else if (rep == MachineRepresentation::kFloat64) {
@@ -7726,67 +8151,125 @@ Node* CodeStubAssembler::PrepareValueForWriteToTypedArray(
     Goto(&done);
   }
 
+  BIND(&convert);
+  {
+    var_input.Bind(CallBuiltin(Builtins::kNonNumberToNumber, context, input));
+    Goto(&loop);
+  }
+
   BIND(&done);
   return var_result.value();
 }
 
+void CodeStubAssembler::EmitBigTypedArrayElementStore(
+    TNode<JSTypedArray> object, TNode<FixedTypedArrayBase> elements,
+    TNode<IntPtrT> intptr_key, TNode<Object> value, TNode<Context> context,
+    Label* opt_if_neutered) {
+  TNode<BigInt> bigint_value = ToBigInt(context, value);
+  TNode<WordT> bitfield = LoadBigIntBitfield(bigint_value);
+  TNode<UintPtrT> length = DecodeWord<BigIntBase::LengthBits>(bitfield);
+  TNode<UintPtrT> sign = DecodeWord<BigIntBase::SignBits>(bitfield);
+  TVARIABLE(UintPtrT, var_low, Unsigned(IntPtrConstant(0)));
+  // Only used on 32-bit platforms.
+  TVARIABLE(UintPtrT, var_high, Unsigned(IntPtrConstant(0)));
+  Label do_store(this);
+  GotoIf(WordEqual(length, IntPtrConstant(0)), &do_store);
+  var_low = LoadBigIntDigit(bigint_value, 0);
+  if (!Is64()) {
+    Label load_done(this);
+    GotoIf(WordEqual(length, IntPtrConstant(1)), &load_done);
+    var_high = LoadBigIntDigit(bigint_value, 1);
+    Goto(&load_done);
+    BIND(&load_done);
+  }
+  GotoIf(WordEqual(sign, IntPtrConstant(0)), &do_store);
+  // Negative value. Simulate two's complement.
+  if (!Is64()) {
+    var_high = Unsigned(IntPtrSub(IntPtrConstant(0), var_high.value()));
+    Label no_carry(this);
+    GotoIf(WordEqual(var_low.value(), IntPtrConstant(0)), &no_carry);
+    var_high = Unsigned(IntPtrSub(var_high.value(), IntPtrConstant(1)));
+    Goto(&no_carry);
+    BIND(&no_carry);
+  }
+  var_low = Unsigned(IntPtrSub(IntPtrConstant(0), var_low.value()));
+  Goto(&do_store);
+
+  BIND(&do_store);
+  if (opt_if_neutered != nullptr) {
+    // Check if buffer has been neutered.
+    Node* buffer = LoadObjectField(object, JSArrayBufferView::kBufferOffset);
+    GotoIf(IsDetachedBuffer(buffer), opt_if_neutered);
+  }
+
+  Node* backing_store = LoadFixedTypedArrayBackingStore(elements);
+  Node* offset = ElementOffsetFromIndex(intptr_key, BIGINT64_ELEMENTS,
+                                        INTPTR_PARAMETERS, 0);
+  MachineRepresentation rep = WordT::kMachineRepresentation;
+  StoreNoWriteBarrier(rep, backing_store, offset, var_low.value());
+  if (!Is64()) {
+    StoreNoWriteBarrier(rep, backing_store,
+                        IntPtrAdd(offset, IntPtrConstant(kPointerSize)),
+                        var_high.value());
+  }
+}
+
 void CodeStubAssembler::EmitElementStore(Node* object, Node* key, Node* value,
                                          bool is_jsarray,
                                          ElementsKind elements_kind,
                                          KeyedAccessStoreMode store_mode,
-                                         Label* bailout) {
+                                         Label* bailout, Node* context) {
   CSA_ASSERT(this, Word32BinaryNot(IsJSProxy(object)));
+
   Node* elements = LoadElements(object);
-  if (IsSmiOrObjectElementsKind(elements_kind) &&
-      store_mode != STORE_NO_TRANSITION_HANDLE_COW) {
-    // Bailout in case of COW elements.
-    GotoIf(WordNotEqual(LoadMap(elements),
-                        LoadRoot(Heap::kFixedArrayMapRootIndex)),
-           bailout);
+  if (!IsSmiOrObjectElementsKind(elements_kind)) {
+    CSA_ASSERT(this, Word32BinaryNot(IsFixedCOWArrayMap(LoadMap(elements))));
+  } else if (!IsCOWHandlingStoreMode(store_mode)) {
+    GotoIf(IsFixedCOWArrayMap(LoadMap(elements)), bailout);
   }
+
   // TODO(ishell): introduce TryToIntPtrOrSmi() and use OptimalParameterMode().
   ParameterMode parameter_mode = INTPTR_PARAMETERS;
-  key = TryToIntptr(key, bailout);
+  TNode<IntPtrT> intptr_key = TryToIntptr(key, bailout);
 
   if (IsFixedTypedArrayElementsKind(elements_kind)) {
     Label done(this);
-    // TODO(ishell): call ToNumber() on value and don't bailout but be careful
-    // to call it only once if we decide to bailout because of bounds checks.
-
-    value = PrepareValueForWriteToTypedArray(value, elements_kind, bailout);
-
-    // There must be no allocations between the buffer load and
-    // and the actual store to backing store, because GC may decide that
-    // the buffer is not alive or move the elements.
-    // TODO(ishell): introduce DisallowHeapAllocationCode scope here.
-
-    // Check if buffer has been neutered.
-    Node* buffer = LoadObjectField(object, JSArrayBufferView::kBufferOffset);
-    GotoIf(IsDetachedBuffer(buffer), bailout);
-
     // Bounds check.
     Node* length = TaggedToParameter(
         CAST(LoadObjectField(object, JSTypedArray::kLengthOffset)),
         parameter_mode);
 
     if (store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
-      // Skip the store if we write beyond the length.
-      GotoIfNot(IntPtrLessThan(key, length), &done);
-      // ... but bailout if the key is negative.
+      // Skip the store if we write beyond the length or
+      // to a property with a negative integer index.
+      GotoIfNot(UintPtrLessThan(intptr_key, length), &done);
     } else {
       DCHECK_EQ(STANDARD_STORE, store_mode);
+      GotoIfNot(UintPtrLessThan(intptr_key, length), bailout);
     }
-    GotoIfNot(UintPtrLessThan(key, length), bailout);
 
-    // Backing store = external_pointer + base_pointer.
-    Node* external_pointer =
-        LoadObjectField(elements, FixedTypedArrayBase::kExternalPointerOffset,
-                        MachineType::Pointer());
-    Node* base_pointer =
-        LoadObjectField(elements, FixedTypedArrayBase::kBasePointerOffset);
-    Node* backing_store =
-        IntPtrAdd(external_pointer, BitcastTaggedToWord(base_pointer));
-    StoreElement(backing_store, elements_kind, key, value, parameter_mode);
+    TNode<Object> value_obj = UncheckedCast<Object>(value);
+    if (elements_kind == BIGINT64_ELEMENTS ||
+        elements_kind == BIGUINT64_ELEMENTS) {
+      EmitBigTypedArrayElementStore(CAST(object), CAST(elements), intptr_key,
+                                    value_obj, CAST(context), bailout);
+    } else {
+      value = PrepareValueForWriteToTypedArray(value_obj, elements_kind,
+                                               CAST(context));
+
+      // There must be no allocations between the buffer load and
+      // and the actual store to backing store, because GC may decide that
+      // the buffer is not alive or move the elements.
+      // TODO(ishell): introduce DisallowHeapAllocationCode scope here.
+
+      // Check if buffer has been neutered.
+      Node* buffer = LoadObjectField(object, JSArrayBufferView::kBufferOffset);
+      GotoIf(IsDetachedBuffer(buffer), bailout);
+
+      Node* backing_store = LoadFixedTypedArrayBackingStore(CAST(elements));
+      StoreElement(backing_store, elements_kind, intptr_key, value,
+                   parameter_mode);
+    }
     Goto(&done);
 
     BIND(&done);
@@ -7809,32 +8292,39 @@ void CodeStubAssembler::EmitElementStore(Node* object, Node* key, Node* value,
   }
 
   if (IsGrowStoreMode(store_mode)) {
-    elements = CheckForCapacityGrow(object, elements, elements_kind, length,
-                                    key, parameter_mode, is_jsarray, bailout);
+    elements = CheckForCapacityGrow(object, elements, elements_kind, store_mode,
+                                    length, intptr_key, parameter_mode,
+                                    is_jsarray, bailout);
   } else {
-    GotoIfNot(UintPtrLessThan(key, length), bailout);
+    GotoIfNot(UintPtrLessThan(intptr_key, length), bailout);
+  }
 
-    if ((store_mode == STORE_NO_TRANSITION_HANDLE_COW) &&
-        IsSmiOrObjectElementsKind(elements_kind)) {
-      elements = CopyElementsOnWrite(object, elements, elements_kind, length,
-                                     parameter_mode, bailout);
-    }
+  // If we didn't grow {elements}, it might still be COW, in which case we
+  // copy it now.
+  if (!IsSmiOrObjectElementsKind(elements_kind)) {
+    CSA_ASSERT(this, Word32BinaryNot(IsFixedCOWArrayMap(LoadMap(elements))));
+  } else if (IsCOWHandlingStoreMode(store_mode)) {
+    elements = CopyElementsOnWrite(object, elements, elements_kind, length,
+                                   parameter_mode, bailout);
   }
-  StoreElement(elements, elements_kind, key, value, parameter_mode);
+
+  CSA_ASSERT(this, Word32BinaryNot(IsFixedCOWArrayMap(LoadMap(elements))));
+  StoreElement(elements, elements_kind, intptr_key, value, parameter_mode);
 }
 
-Node* CodeStubAssembler::CheckForCapacityGrow(Node* object, Node* elements,
-                                              ElementsKind kind, Node* length,
-                                              Node* key, ParameterMode mode,
-                                              bool is_js_array,
-                                              Label* bailout) {
+Node* CodeStubAssembler::CheckForCapacityGrow(
+    Node* object, Node* elements, ElementsKind kind,
+    KeyedAccessStoreMode store_mode, Node* length, Node* key,
+    ParameterMode mode, bool is_js_array, Label* bailout) {
   VARIABLE(checked_elements, MachineRepresentation::kTagged);
-  Label grow_case(this), no_grow_case(this), done(this);
+  Label grow_case(this), no_grow_case(this), done(this),
+      grow_bailout(this, Label::kDeferred);
 
   Node* condition;
   if (IsHoleyOrDictionaryElementsKind(kind)) {
     condition = UintPtrGreaterThanOrEqual(key, length);
   } else {
+    // We don't support growing here unless the value is being appended.
     condition = WordEqual(key, length);
   }
   Branch(condition, &grow_case, &no_grow_case);
@@ -7843,20 +8333,32 @@ Node* CodeStubAssembler::CheckForCapacityGrow(Node* object, Node* elements,
   {
     Node* current_capacity =
         TaggedToParameter(LoadFixedArrayBaseLength(elements), mode);
-
     checked_elements.Bind(elements);
-
     Label fits_capacity(this);
+    // If key is negative, we will notice in Runtime::kGrowArrayElements.
     GotoIf(UintPtrLessThan(key, current_capacity), &fits_capacity);
+
     {
       Node* new_elements = TryGrowElementsCapacity(
-          object, elements, kind, key, current_capacity, mode, bailout);
-
+          object, elements, kind, key, current_capacity, mode, &grow_bailout);
       checked_elements.Bind(new_elements);
       Goto(&fits_capacity);
     }
-    BIND(&fits_capacity);
 
+    BIND(&grow_bailout);
+    {
+      Node* tagged_key = mode == SMI_PARAMETERS
+                             ? key
+                             : ChangeInt32ToTagged(TruncateIntPtrToInt32(key));
+      Node* maybe_elements = CallRuntime(
+          Runtime::kGrowArrayElements, NoContextConstant(), object, tagged_key);
+      GotoIf(TaggedIsSmi(maybe_elements), bailout);
+      CSA_ASSERT(this, IsFixedArrayWithKind(maybe_elements, kind));
+      checked_elements.Bind(maybe_elements);
+      Goto(&fits_capacity);
+    }
+
+    BIND(&fits_capacity);
     if (is_js_array) {
       Node* new_length = IntPtrAdd(key, IntPtrOrSmiConstant(1, mode));
       StoreObjectFieldNoWriteBarrier(object, JSArray::kLengthOffset,
@@ -7883,15 +8385,12 @@ Node* CodeStubAssembler::CopyElementsOnWrite(Node* object, Node* elements,
   VARIABLE(new_elements_var, MachineRepresentation::kTagged, elements);
   Label done(this);
 
-  GotoIfNot(
-      WordEqual(LoadMap(elements), LoadRoot(Heap::kFixedCOWArrayMapRootIndex)),
-      &done);
+  GotoIfNot(IsFixedCOWArrayMap(LoadMap(elements)), &done);
   {
     Node* capacity =
         TaggedToParameter(LoadFixedArrayBaseLength(elements), mode);
     Node* new_elements = GrowElementsCapacity(object, elements, kind, kind,
                                               length, capacity, mode, bailout);
-
     new_elements_var.Bind(new_elements);
     Goto(&done);
   }
@@ -8243,19 +8742,22 @@ void CodeStubAssembler::BranchIfNumberRelationalComparison(
   {
     switch (op) {
       case Operation::kLessThan:
-        Branch(Float64LessThan(var_left_float, var_right_float), if_true,
-               if_false);
+        Branch(Float64LessThan(var_left_float.value(), var_right_float.value()),
+               if_true, if_false);
         break;
       case Operation::kLessThanOrEqual:
-        Branch(Float64LessThanOrEqual(var_left_float, var_right_float), if_true,
-               if_false);
+        Branch(Float64LessThanOrEqual(var_left_float.value(),
+                                      var_right_float.value()),
+               if_true, if_false);
         break;
       case Operation::kGreaterThan:
-        Branch(Float64GreaterThan(var_left_float, var_right_float), if_true,
-               if_false);
+        Branch(
+            Float64GreaterThan(var_left_float.value(), var_right_float.value()),
+            if_true, if_false);
         break;
       case Operation::kGreaterThanOrEqual:
-        Branch(Float64GreaterThanOrEqual(var_left_float, var_right_float),
+        Branch(Float64GreaterThanOrEqual(var_left_float.value(),
+                                         var_right_float.value()),
                if_true, if_false);
         break;
       default:
@@ -8649,19 +9151,22 @@ Node* CodeStubAssembler::RelationalComparison(Operation op, Node* left,
   {
     switch (op) {
       case Operation::kLessThan:
-        Branch(Float64LessThan(var_left_float, var_right_float), &return_true,
-               &return_false);
+        Branch(Float64LessThan(var_left_float.value(), var_right_float.value()),
+               &return_true, &return_false);
         break;
       case Operation::kLessThanOrEqual:
-        Branch(Float64LessThanOrEqual(var_left_float, var_right_float),
+        Branch(Float64LessThanOrEqual(var_left_float.value(),
+                                      var_right_float.value()),
                &return_true, &return_false);
         break;
       case Operation::kGreaterThan:
-        Branch(Float64GreaterThan(var_left_float, var_right_float),
-               &return_true, &return_false);
+        Branch(
+            Float64GreaterThan(var_left_float.value(), var_right_float.value()),
+            &return_true, &return_false);
         break;
       case Operation::kGreaterThanOrEqual:
-        Branch(Float64GreaterThanOrEqual(var_left_float, var_right_float),
+        Branch(Float64GreaterThanOrEqual(var_left_float.value(),
+                                         var_right_float.value()),
                &return_true, &return_false);
         break;
       default:
@@ -8682,7 +9187,7 @@ Node* CodeStubAssembler::RelationalComparison(Operation op, Node* left,
   }
 
   BIND(&end);
-  return var_result;
+  return var_result.value();
 }
 
 Node* CodeStubAssembler::CollectFeedbackForString(Node* instance_type) {
@@ -9090,8 +9595,8 @@ Node* CodeStubAssembler::Equal(Node* left, Node* right, Node* context,
 
   BIND(&do_float_comparison);
   {
-    Branch(Float64Equal(var_left_float, var_right_float), &if_equal,
-           &if_notequal);
+    Branch(Float64Equal(var_left_float.value(), var_right_float.value()),
+           &if_equal, &if_notequal);
   }
 
   BIND(&if_equal);
@@ -9545,7 +10050,7 @@ void CodeStubAssembler::BranchIfSameValue(Node* lhs, Node* rhs, Label* if_true,
 }
 
 TNode<Oddball> CodeStubAssembler::HasProperty(SloppyTNode<HeapObject> object,
-                                              SloppyTNode<Name> key,
+                                              SloppyTNode<Object> key,
                                               SloppyTNode<Context> context,
                                               HasPropertyLookupMode mode) {
   Label call_runtime(this, Label::kDeferred), return_true(this),
@@ -9576,7 +10081,7 @@ TNode<Oddball> CodeStubAssembler::HasProperty(SloppyTNode<HeapObject> object,
 
   BIND(&if_proxy);
   {
-    TNode<Name> name = CAST(ToName(context, key));
+    TNode<Name> name = ToName(context, key);
     switch (mode) {
       case kHasProperty:
         GotoIf(IsPrivateSymbol(name), &return_false);
@@ -9621,73 +10126,8 @@ TNode<Oddball> CodeStubAssembler::HasProperty(SloppyTNode<HeapObject> object,
   }
 
   BIND(&end);
-  CSA_ASSERT(this, IsBoolean(result));
-  return result;
-}
-
-Node* CodeStubAssembler::ClassOf(Node* value) {
-  VARIABLE(var_result, MachineRepresentation::kTaggedPointer);
-  Label if_function_template_info(this, Label::kDeferred),
-      if_no_class_name(this, Label::kDeferred),
-      if_function(this, Label::kDeferred), if_object(this, Label::kDeferred),
-      if_primitive(this, Label::kDeferred), return_result(this);
-
-  // Check if {value} is a Smi.
-  GotoIf(TaggedIsSmi(value), &if_primitive);
-
-  Node* value_map = LoadMap(value);
-  Node* value_instance_type = LoadMapInstanceType(value_map);
-
-  // Check if {value} is a JSFunction or JSBoundFunction.
-  STATIC_ASSERT(LAST_TYPE == LAST_FUNCTION_TYPE);
-  GotoIf(Uint32LessThanOrEqual(Int32Constant(FIRST_FUNCTION_TYPE),
-                               value_instance_type),
-         &if_function);
-
-  // Check if {value} is a primitive HeapObject.
-  STATIC_ASSERT(LAST_TYPE == LAST_JS_RECEIVER_TYPE);
-  GotoIfNot(IsJSReceiverInstanceType(value_instance_type), &if_primitive);
-
-  // Load the {value}s constructor, and check that it's a JSFunction.
-  Node* constructor = LoadMapConstructor(value_map);
-  GotoIf(HasInstanceType(constructor, FUNCTION_TEMPLATE_INFO_TYPE),
-         &if_function_template_info);
-  GotoIfNot(IsJSFunction(constructor), &if_object);
-
-  // Return the instance class name for the {constructor}.
-  Node* shared_info =
-      LoadObjectField(constructor, JSFunction::kSharedFunctionInfoOffset);
-  Node* instance_class_name = LoadObjectField(
-      shared_info, SharedFunctionInfo::kInstanceClassNameOffset);
-  var_result.Bind(instance_class_name);
-  Goto(&return_result);
-
-  // For remote objects the constructor might be given as FTI.
-  BIND(&if_function_template_info);
-  Node* class_name =
-      LoadObjectField(constructor, FunctionTemplateInfo::kClassNameOffset);
-  GotoIf(IsUndefined(class_name), &if_no_class_name);
-  var_result.Bind(class_name);
-  Goto(&return_result);
-
-  BIND(&if_no_class_name);
-  var_result.Bind(LoadRoot(Heap::kempty_stringRootIndex));
-  Goto(&return_result);
-
-  BIND(&if_function);
-  var_result.Bind(LoadRoot(Heap::kFunction_stringRootIndex));
-  Goto(&return_result);
-
-  BIND(&if_object);
-  var_result.Bind(LoadRoot(Heap::kObject_stringRootIndex));
-  Goto(&return_result);
-
-  BIND(&if_primitive);
-  var_result.Bind(NullConstant());
-  Goto(&return_result);
-
-  BIND(&return_result);
-  return var_result.value();
+  CSA_ASSERT(this, IsBoolean(result.value()));
+  return result.value();
 }
 
 Node* CodeStubAssembler::Typeof(Node* value) {
@@ -9801,6 +10241,46 @@ Node* CodeStubAssembler::GetSuperConstructor(Node* active_function,
   return result.value();
 }
 
+Node* CodeStubAssembler::SpeciesConstructor(Node* context, Node* object,
+                                            Node* default_constructor) {
+  Isolate* isolate = this->isolate();
+  VARIABLE(var_result, MachineRepresentation::kTagged);
+  var_result.Bind(default_constructor);
+
+  // 2. Let C be ? Get(O, "constructor").
+  Node* const constructor =
+      GetProperty(context, object, isolate->factory()->constructor_string());
+
+  // 3. If C is undefined, return defaultConstructor.
+  Label out(this);
+  GotoIf(IsUndefined(constructor), &out);
+
+  // 4. If Type(C) is not Object, throw a TypeError exception.
+  ThrowIfNotJSReceiver(context, constructor,
+                       MessageTemplate::kConstructorNotReceiver);
+
+  // 5. Let S be ? Get(C, @@species).
+  Node* const species =
+      GetProperty(context, constructor, isolate->factory()->species_symbol());
+
+  // 6. If S is either undefined or null, return defaultConstructor.
+  GotoIf(IsNullOrUndefined(species), &out);
+
+  // 7. If IsConstructor(S) is true, return S.
+  Label throw_error(this);
+  GotoIf(TaggedIsSmi(species), &throw_error);
+  GotoIfNot(IsConstructorMap(LoadMap(species)), &throw_error);
+  var_result.Bind(species);
+  Goto(&out);
+
+  // 8. Throw a TypeError exception.
+  BIND(&throw_error);
+  ThrowTypeError(context, MessageTemplate::kSpeciesNotConstructor);
+
+  BIND(&out);
+  return var_result.value();
+}
+
 Node* CodeStubAssembler::InstanceOf(Node* object, Node* callable,
                                     Node* context) {
   VARIABLE(var_result, MachineRepresentation::kTagged);
@@ -9871,16 +10351,10 @@ Node* CodeStubAssembler::InstanceOf(Node* object, Node* callable,
   }
 
   BIND(&if_notcallable);
-  {
-    CallRuntime(Runtime::kThrowNonCallableInInstanceOfCheck, context);
-    Unreachable();
-  }
+  { ThrowTypeError(context, MessageTemplate::kNonCallableInInstanceOfCheck); }
 
   BIND(&if_notreceiver);
-  {
-    CallRuntime(Runtime::kThrowNonObjectInInstanceOfCheck, context);
-    Unreachable();
-  }
+  { ThrowTypeError(context, MessageTemplate::kNonObjectInInstanceOfCheck); }
 
   BIND(&return_true);
   var_result.Bind(TrueConstant());
@@ -9894,50 +10368,51 @@ Node* CodeStubAssembler::InstanceOf(Node* object, Node* callable,
   return var_result.value();
 }
 
-Node* CodeStubAssembler::NumberInc(Node* value) {
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-  VARIABLE(var_finc_value, MachineRepresentation::kFloat64);
+TNode<Number> CodeStubAssembler::NumberInc(SloppyTNode<Number> value) {
+  TVARIABLE(Number, var_result);
+  TVARIABLE(Float64T, var_finc_value);
   Label if_issmi(this), if_isnotsmi(this), do_finc(this), end(this);
   Branch(TaggedIsSmi(value), &if_issmi, &if_isnotsmi);
 
   BIND(&if_issmi);
   {
     // Try fast Smi addition first.
-    Node* one = SmiConstant(1);
-    Node* pair = IntPtrAddWithOverflow(BitcastTaggedToWord(value),
-                                       BitcastTaggedToWord(one));
-    Node* overflow = Projection(1, pair);
+    TNode<Smi> one = SmiConstant(1);
+    TNode<PairT<IntPtrT, BoolT>> pair = IntPtrAddWithOverflow(
+        BitcastTaggedToWord(value), BitcastTaggedToWord(one));
+    TNode<BoolT> overflow = Projection<1>(pair);
 
     // Check if the Smi addition overflowed.
     Label if_overflow(this), if_notoverflow(this);
     Branch(overflow, &if_overflow, &if_notoverflow);
 
     BIND(&if_notoverflow);
-    var_result.Bind(BitcastWordToTaggedSigned(Projection(0, pair)));
+    var_result = BitcastWordToTaggedSigned(Projection<0>(pair));
     Goto(&end);
 
     BIND(&if_overflow);
     {
-      var_finc_value.Bind(SmiToFloat64(value));
+      TNode<Smi> smi_value = CAST(value);
+      var_finc_value = SmiToFloat64(smi_value);
       Goto(&do_finc);
     }
   }
 
   BIND(&if_isnotsmi);
   {
-    CSA_ASSERT(this, IsHeapNumber(value));
+    TNode<HeapNumber> heap_number_value = CAST(value);
 
     // Load the HeapNumber value.
-    var_finc_value.Bind(LoadHeapNumberValue(value));
+    var_finc_value = LoadHeapNumberValue(heap_number_value);
     Goto(&do_finc);
   }
 
   BIND(&do_finc);
   {
-    Node* finc_value = var_finc_value.value();
-    Node* one = Float64Constant(1.0);
-    Node* finc_result = Float64Add(finc_value, one);
-    var_result.Bind(AllocateHeapNumberWithValue(finc_result));
+    TNode<Float64T> finc_value = var_finc_value.value();
+    TNode<Float64T> one = Float64Constant(1.0);
+    TNode<Float64T> finc_result = Float64Add(finc_value, one);
+    var_result = AllocateHeapNumberWithValue(finc_result);
     Goto(&end);
   }
 
@@ -9945,50 +10420,51 @@ Node* CodeStubAssembler::NumberInc(Node* value) {
   return var_result.value();
 }
 
-Node* CodeStubAssembler::NumberDec(Node* value) {
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-  VARIABLE(var_fdec_value, MachineRepresentation::kFloat64);
+TNode<Number> CodeStubAssembler::NumberDec(SloppyTNode<Number> value) {
+  TVARIABLE(Number, var_result);
+  TVARIABLE(Float64T, var_fdec_value);
   Label if_issmi(this), if_isnotsmi(this), do_fdec(this), end(this);
   Branch(TaggedIsSmi(value), &if_issmi, &if_isnotsmi);
 
   BIND(&if_issmi);
   {
-    // Try fast Smi addition first.
-    Node* one = SmiConstant(1);
-    Node* pair = IntPtrSubWithOverflow(BitcastTaggedToWord(value),
-                                       BitcastTaggedToWord(one));
-    Node* overflow = Projection(1, pair);
+    // Try fast Smi subtraction first.
+    TNode<Smi> one = SmiConstant(1);
+    TNode<PairT<IntPtrT, BoolT>> pair = IntPtrSubWithOverflow(
+        BitcastTaggedToWord(value), BitcastTaggedToWord(one));
+    TNode<BoolT> overflow = Projection<1>(pair);
 
-    // Check if the Smi addition overflowed.
+    // Check if the Smi subtraction overflowed.
     Label if_overflow(this), if_notoverflow(this);
     Branch(overflow, &if_overflow, &if_notoverflow);
 
     BIND(&if_notoverflow);
-    var_result.Bind(BitcastWordToTaggedSigned(Projection(0, pair)));
+    var_result = BitcastWordToTaggedSigned(Projection<0>(pair));
     Goto(&end);
 
     BIND(&if_overflow);
     {
-      var_fdec_value.Bind(SmiToFloat64(value));
+      TNode<Smi> smi_value = CAST(value);
+      var_fdec_value = SmiToFloat64(smi_value);
       Goto(&do_fdec);
     }
   }
 
   BIND(&if_isnotsmi);
   {
-    CSA_ASSERT(this, IsHeapNumber(value));
+    TNode<HeapNumber> heap_number_value = CAST(value);
 
     // Load the HeapNumber value.
-    var_fdec_value.Bind(LoadHeapNumberValue(value));
+    var_fdec_value = LoadHeapNumberValue(heap_number_value);
     Goto(&do_fdec);
   }
 
   BIND(&do_fdec);
   {
-    Node* fdec_value = var_fdec_value.value();
-    Node* minus_one = Float64Constant(-1.0);
-    Node* fdec_result = Float64Add(fdec_value, minus_one);
-    var_result.Bind(AllocateHeapNumberWithValue(fdec_result));
+    TNode<Float64T> fdec_value = var_fdec_value.value();
+    TNode<Float64T> minus_one = Float64Constant(-1.0);
+    TNode<Float64T> fdec_result = Float64Add(fdec_value, minus_one);
+    var_result = AllocateHeapNumberWithValue(fdec_result);
     Goto(&end);
   }
 
@@ -9996,29 +10472,29 @@ Node* CodeStubAssembler::NumberDec(Node* value) {
   return var_result.value();
 }
 
-Node* CodeStubAssembler::NumberAdd(Node* a, Node* b) {
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-  VARIABLE(var_fadd_value, MachineRepresentation::kFloat64);
+TNode<Number> CodeStubAssembler::NumberAdd(SloppyTNode<Number> a,
+                                           SloppyTNode<Number> b) {
+  TVARIABLE(Number, var_result);
   Label float_add(this, Label::kDeferred), end(this);
   GotoIf(TaggedIsNotSmi(a), &float_add);
   GotoIf(TaggedIsNotSmi(b), &float_add);
 
   // Try fast Smi addition first.
-  Node* pair =
+  TNode<PairT<IntPtrT, BoolT>> pair =
       IntPtrAddWithOverflow(BitcastTaggedToWord(a), BitcastTaggedToWord(b));
-  Node* overflow = Projection(1, pair);
+  TNode<BoolT> overflow = Projection<1>(pair);
 
   // Check if the Smi addition overflowed.
   Label if_overflow(this), if_notoverflow(this);
   GotoIf(overflow, &float_add);
 
-  var_result.Bind(BitcastWordToTaggedSigned(Projection(0, pair)));
+  var_result = BitcastWordToTaggedSigned(Projection<0>(pair));
   Goto(&end);
 
   BIND(&float_add);
   {
-    var_result.Bind(ChangeFloat64ToTagged(
-        Float64Add(ChangeNumberToFloat64(a), ChangeNumberToFloat64(b))));
+    var_result = ChangeFloat64ToTagged(
+        Float64Add(ChangeNumberToFloat64(a), ChangeNumberToFloat64(b)));
     Goto(&end);
   }
 
@@ -10026,29 +10502,29 @@ Node* CodeStubAssembler::NumberAdd(Node* a, Node* b) {
   return var_result.value();
 }
 
-Node* CodeStubAssembler::NumberSub(Node* a, Node* b) {
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-  VARIABLE(var_fsub_value, MachineRepresentation::kFloat64);
+TNode<Number> CodeStubAssembler::NumberSub(SloppyTNode<Number> a,
+                                           SloppyTNode<Number> b) {
+  TVARIABLE(Number, var_result);
   Label float_sub(this, Label::kDeferred), end(this);
   GotoIf(TaggedIsNotSmi(a), &float_sub);
   GotoIf(TaggedIsNotSmi(b), &float_sub);
 
   // Try fast Smi subtraction first.
-  Node* pair =
+  TNode<PairT<IntPtrT, BoolT>> pair =
       IntPtrSubWithOverflow(BitcastTaggedToWord(a), BitcastTaggedToWord(b));
-  Node* overflow = Projection(1, pair);
+  TNode<BoolT> overflow = Projection<1>(pair);
 
   // Check if the Smi subtraction overflowed.
   Label if_overflow(this), if_notoverflow(this);
   GotoIf(overflow, &float_sub);
 
-  var_result.Bind(BitcastWordToTaggedSigned(Projection(0, pair)));
+  var_result = BitcastWordToTaggedSigned(Projection<0>(pair));
   Goto(&end);
 
   BIND(&float_sub);
   {
-    var_result.Bind(ChangeFloat64ToTagged(
-        Float64Sub(ChangeNumberToFloat64(a), ChangeNumberToFloat64(b))));
+    var_result = ChangeFloat64ToTagged(
+        Float64Sub(ChangeNumberToFloat64(a), ChangeNumberToFloat64(b)));
     Goto(&end);
   }
 
@@ -10098,201 +10574,25 @@ Node* CodeStubAssembler::BitwiseOp(Node* left32, Node* right32,
   UNREACHABLE();
 }
 
-Node* CodeStubAssembler::CreateArrayIterator(Node* array, Node* array_map,
-                                             Node* array_type, Node* context,
-                                             IterationKind mode) {
-  int kBaseMapIndex = 0;
-  switch (mode) {
-    case IterationKind::kKeys:
-      kBaseMapIndex = Context::TYPED_ARRAY_KEY_ITERATOR_MAP_INDEX;
-      break;
-    case IterationKind::kValues:
-      kBaseMapIndex = Context::UINT8_ARRAY_VALUE_ITERATOR_MAP_INDEX;
-      break;
-    case IterationKind::kEntries:
-      kBaseMapIndex = Context::UINT8_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX;
-      break;
-  }
-
-  // Fast Array iterator map index:
-  // (kBaseIndex + kFastIteratorOffset) + ElementsKind (for JSArrays)
-  // kBaseIndex + (ElementsKind - UINT8_ELEMENTS) (for JSTypedArrays)
-  const int kFastIteratorOffset =
-      Context::FAST_SMI_ARRAY_VALUE_ITERATOR_MAP_INDEX -
-      Context::UINT8_ARRAY_VALUE_ITERATOR_MAP_INDEX;
-  STATIC_ASSERT(kFastIteratorOffset ==
-                (Context::FAST_SMI_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX -
-                 Context::UINT8_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX));
-
-  // Slow Array iterator map index: (kBaseIndex + kSlowIteratorOffset)
-  const int kSlowIteratorOffset =
-      Context::GENERIC_ARRAY_VALUE_ITERATOR_MAP_INDEX -
-      Context::UINT8_ARRAY_VALUE_ITERATOR_MAP_INDEX;
-  STATIC_ASSERT(kSlowIteratorOffset ==
-                (Context::GENERIC_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX -
-                 Context::UINT8_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX));
-
-  // Assert: Type(array) is Object
-  CSA_ASSERT(this, IsJSReceiverInstanceType(array_type));
-
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-  VARIABLE(var_map_index, MachineType::PointerRepresentation());
-  VARIABLE(var_array_map, MachineRepresentation::kTagged);
-
-  Label return_result(this);
-  Label allocate_iterator(this);
-
-  if (mode == IterationKind::kKeys) {
-    // There are only two key iterator maps, branch depending on whether or not
-    // the receiver is a TypedArray or not.
-
-    Label if_istypedarray(this), if_isgeneric(this);
-
-    Branch(InstanceTypeEqual(array_type, JS_TYPED_ARRAY_TYPE), &if_istypedarray,
-           &if_isgeneric);
-
-    BIND(&if_isgeneric);
-    {
-      Label if_isfast(this), if_isslow(this);
-      BranchIfFastJSArray(array, context, &if_isfast, &if_isslow);
-
-      BIND(&if_isfast);
-      {
-        var_map_index.Bind(
-            IntPtrConstant(Context::FAST_ARRAY_KEY_ITERATOR_MAP_INDEX));
-        var_array_map.Bind(array_map);
-        Goto(&allocate_iterator);
-      }
-
-      BIND(&if_isslow);
-      {
-        var_map_index.Bind(
-            IntPtrConstant(Context::GENERIC_ARRAY_KEY_ITERATOR_MAP_INDEX));
-        var_array_map.Bind(UndefinedConstant());
-        Goto(&allocate_iterator);
-      }
-    }
-
-    BIND(&if_istypedarray);
-    {
-      var_map_index.Bind(
-          IntPtrConstant(Context::TYPED_ARRAY_KEY_ITERATOR_MAP_INDEX));
-      var_array_map.Bind(UndefinedConstant());
-      Goto(&allocate_iterator);
-    }
-  } else {
-    Label if_istypedarray(this), if_isgeneric(this);
-    Branch(InstanceTypeEqual(array_type, JS_TYPED_ARRAY_TYPE), &if_istypedarray,
-           &if_isgeneric);
-
-    BIND(&if_isgeneric);
-    {
-      Label if_isfast(this), if_isslow(this);
-      BranchIfFastJSArray(array, context, &if_isfast, &if_isslow);
-
-      BIND(&if_isfast);
-      {
-        Label if_ispacked(this), if_isholey(this);
-        Node* elements_kind = LoadMapElementsKind(array_map);
-        Branch(IsHoleyFastElementsKind(elements_kind), &if_isholey,
-               &if_ispacked);
-
-        BIND(&if_isholey);
-        {
-          // Fast holey JSArrays can treat the hole as undefined if the
-          // protector cell is valid, and the prototype chain is unchanged from
-          // its initial state (because the protector cell is only tracked for
-          // initial the Array and Object prototypes). Check these conditions
-          // here, and take the slow path if any fail.
-          GotoIf(IsNoElementsProtectorCellInvalid(), &if_isslow);
-
-          Node* native_context = LoadNativeContext(context);
-
-          Node* prototype = LoadMapPrototype(array_map);
-          Node* array_prototype = LoadContextElement(
-              native_context, Context::INITIAL_ARRAY_PROTOTYPE_INDEX);
-          GotoIfNot(WordEqual(prototype, array_prototype), &if_isslow);
-
-          Node* map = LoadMap(prototype);
-          prototype = LoadMapPrototype(map);
-          Node* object_prototype = LoadContextElement(
-              native_context, Context::INITIAL_OBJECT_PROTOTYPE_INDEX);
-          GotoIfNot(WordEqual(prototype, object_prototype), &if_isslow);
-
-          map = LoadMap(prototype);
-          prototype = LoadMapPrototype(map);
-          Branch(IsNull(prototype), &if_ispacked, &if_isslow);
-        }
-        BIND(&if_ispacked);
-        {
-          Node* map_index =
-              IntPtrAdd(IntPtrConstant(kBaseMapIndex + kFastIteratorOffset),
-                        ChangeUint32ToWord(LoadMapElementsKind(array_map)));
-          CSA_ASSERT(this, IntPtrGreaterThanOrEqual(
-                               map_index, IntPtrConstant(kBaseMapIndex +
-                                                         kFastIteratorOffset)));
-          CSA_ASSERT(this, IntPtrLessThan(map_index,
-                                          IntPtrConstant(kBaseMapIndex +
-                                                         kSlowIteratorOffset)));
-
-          var_map_index.Bind(map_index);
-          var_array_map.Bind(array_map);
-          Goto(&allocate_iterator);
-        }
-      }
-
-      BIND(&if_isslow);
-      {
-        Node* map_index = IntPtrAdd(IntPtrConstant(kBaseMapIndex),
-                                    IntPtrConstant(kSlowIteratorOffset));
-        var_map_index.Bind(map_index);
-        var_array_map.Bind(UndefinedConstant());
-        Goto(&allocate_iterator);
-      }
-    }
-
-    BIND(&if_istypedarray);
-    {
-      Node* map_index =
-          IntPtrAdd(IntPtrConstant(kBaseMapIndex - UINT8_ELEMENTS),
-                    ChangeUint32ToWord(LoadMapElementsKind(array_map)));
-      CSA_ASSERT(
-          this, IntPtrLessThan(map_index, IntPtrConstant(kBaseMapIndex +
-                                                         kFastIteratorOffset)));
-      CSA_ASSERT(this, IntPtrGreaterThanOrEqual(map_index,
-                                                IntPtrConstant(kBaseMapIndex)));
-      var_map_index.Bind(map_index);
-      var_array_map.Bind(UndefinedConstant());
-      Goto(&allocate_iterator);
-    }
-  }
-
-  BIND(&allocate_iterator);
-  {
-    Node* map = LoadFixedArrayElement(LoadNativeContext(context),
-                                      var_map_index.value());
-    var_result.Bind(AllocateJSArrayIterator(array, var_array_map.value(), map));
-    Goto(&return_result);
-  }
-
-  BIND(&return_result);
-  return var_result.value();
-}
-
-Node* CodeStubAssembler::AllocateJSArrayIterator(Node* array, Node* array_map,
-                                                 Node* map) {
+// ES #sec-createarrayiterator
+Node* CodeStubAssembler::CreateArrayIterator(Node* context, Node* object,
+                                             IterationKind kind) {
+  Node* native_context = LoadNativeContext(context);
+  Node* iterator_map = LoadContextElement(
+      native_context, Context::INITIAL_ARRAY_ITERATOR_MAP_INDEX);
   Node* iterator = Allocate(JSArrayIterator::kSize);
-  StoreMapNoWriteBarrier(iterator, map);
+  StoreMapNoWriteBarrier(iterator, iterator_map);
   StoreObjectFieldRoot(iterator, JSArrayIterator::kPropertiesOrHashOffset,
                        Heap::kEmptyFixedArrayRootIndex);
   StoreObjectFieldRoot(iterator, JSArrayIterator::kElementsOffset,
                        Heap::kEmptyFixedArrayRootIndex);
-  StoreObjectFieldNoWriteBarrier(iterator,
-                                 JSArrayIterator::kIteratedObjectOffset, array);
+  StoreObjectFieldNoWriteBarrier(
+      iterator, JSArrayIterator::kIteratedObjectOffset, object);
   StoreObjectFieldNoWriteBarrier(iterator, JSArrayIterator::kNextIndexOffset,
                                  SmiConstant(0));
   StoreObjectFieldNoWriteBarrier(
-      iterator, JSArrayIterator::kIteratedObjectMapOffset, array_map);
+      iterator, JSArrayIterator::kKindOffset,
+      SmiConstant(Smi::FromInt(static_cast<int>(kind))));
   return iterator;
 }
 
@@ -10348,15 +10648,6 @@ Node* CodeStubAssembler::AllocateJSIteratorResultForEntry(Node* context,
   return result;
 }
 
-Node* CodeStubAssembler::TypedArraySpeciesCreateByLength(Node* context,
-                                                         Node* originalArray,
-                                                         Node* len) {
-  // TODO(tebbi): Install a fast path as well, which avoids the runtime
-  // call.
-  return CallRuntime(Runtime::kTypedArraySpeciesCreateByLength, context,
-                     originalArray, len);
-}
-
 Node* CodeStubAssembler::IsDetachedBuffer(Node* buffer) {
   CSA_ASSERT(this, HasInstanceType(buffer, JS_ARRAY_BUFFER_TYPE));
 
@@ -10430,7 +10721,7 @@ TNode<Object> CodeStubArguments::GetOptionalArgumentValue(
   assembler_->Goto(&argument_done);
 
   assembler_->BIND(&argument_done);
-  return result;
+  return result.value();
 }
 
 void CodeStubArguments::ForEach(
@@ -10470,7 +10761,7 @@ void CodeStubArguments::PopAndReturn(Node* value) {
     pop_count = argc_;
   }
 
-  assembler_->PopAndReturn(assembler_->ParameterToWord(pop_count, argc_mode_),
+  assembler_->PopAndReturn(assembler_->ParameterToIntPtr(pop_count, argc_mode_),
                            value);
 }
 
@@ -10514,13 +10805,98 @@ Node* CodeStubAssembler::IsPromiseHookEnabledOrDebugIsActive() {
   return Word32NotEqual(promise_hook_or_debug_is_active, Int32Constant(0));
 }
 
+TNode<Code> CodeStubAssembler::LoadBuiltin(TNode<Smi> builtin_id) {
+  CSA_ASSERT(this, SmiGreaterThanOrEqual(builtin_id, SmiConstant(0)));
+  CSA_ASSERT(this,
+             SmiLessThan(builtin_id, SmiConstant(Builtins::builtin_count)));
+
+  int const kSmiShiftBits = kSmiShiftSize + kSmiTagSize;
+  int index_shift = kPointerSizeLog2 - kSmiShiftBits;
+  TNode<WordT> table_index =
+      index_shift >= 0 ? WordShl(BitcastTaggedToWord(builtin_id), index_shift)
+                       : WordSar(BitcastTaggedToWord(builtin_id), -index_shift);
+
+  return CAST(
+      Load(MachineType::TaggedPointer(),
+           ExternalConstant(ExternalReference::builtins_address(isolate())),
+           table_index));
+}
+
+TNode<Code> CodeStubAssembler::GetSharedFunctionInfoCode(
+    SloppyTNode<SharedFunctionInfo> shared_info) {
+  TNode<Object> sfi_data =
+      LoadObjectField(shared_info, SharedFunctionInfo::kFunctionDataOffset);
+
+  TYPED_VARIABLE_DEF(Code, sfi_code, this);
+
+  Label done(this);
+  Label check_instance_type(this);
+
+  // IsSmi: Is builtin
+  GotoIf(TaggedIsNotSmi(sfi_data), &check_instance_type);
+  sfi_code = LoadBuiltin(CAST(sfi_data));
+  Goto(&done);
+
+  // Switch on data's instance type.
+  BIND(&check_instance_type);
+  TNode<Int32T> data_type = LoadInstanceType(CAST(sfi_data));
+
+  int32_t case_values[] = {BYTECODE_ARRAY_TYPE, CODE_TYPE, FIXED_ARRAY_TYPE,
+                           TUPLE2_TYPE};
+  Label check_is_bytecode_array(this);
+  Label check_is_code(this);
+  Label check_is_fixed_array(this);
+  Label check_is_pre_parsed_scope_data(this);
+  Label check_is_function_template_info(this);
+  Label* case_labels[] = {&check_is_bytecode_array, &check_is_code,
+                          &check_is_fixed_array,
+                          &check_is_pre_parsed_scope_data};
+  STATIC_ASSERT(arraysize(case_values) == arraysize(case_labels));
+  Switch(data_type, &check_is_function_template_info, case_values, case_labels,
+         arraysize(case_labels));
+
+  // IsBytecodeArray: Interpret bytecode
+  BIND(&check_is_bytecode_array);
+  DCHECK(!Builtins::IsLazy(Builtins::kInterpreterEntryTrampoline));
+  sfi_code = HeapConstant(BUILTIN_CODE(isolate(), InterpreterEntryTrampoline));
+  Goto(&done);
+
+  // IsCode: Run code
+  BIND(&check_is_code);
+  sfi_code = CAST(sfi_data);
+  Goto(&done);
+
+  // IsFixedArray: Instantiate using AsmWasmData,
+  BIND(&check_is_fixed_array);
+  DCHECK(!Builtins::IsLazy(Builtins::kInstantiateAsmJs));
+  sfi_code = HeapConstant(BUILTIN_CODE(isolate(), InstantiateAsmJs));
+  Goto(&done);
+
+  // IsPreParsedScopeData: Compile lazy
+  BIND(&check_is_pre_parsed_scope_data);
+  DCHECK(!Builtins::IsLazy(Builtins::kCompileLazy));
+  sfi_code = HeapConstant(BUILTIN_CODE(isolate(), CompileLazy));
+  Goto(&done);
+
+  // IsFunctionTemplateInfo: API call
+  BIND(&check_is_function_template_info);
+  // This is the default branch, so assert that we have the expected data type.
+  CSA_ASSERT(
+      this, Word32Equal(data_type, Int32Constant(FUNCTION_TEMPLATE_INFO_TYPE)));
+  DCHECK(!Builtins::IsLazy(Builtins::kHandleApiCall));
+  sfi_code = HeapConstant(BUILTIN_CODE(isolate(), HandleApiCall));
+  Goto(&done);
+
+  BIND(&done);
+  return sfi_code.value();
+}
+
 Node* CodeStubAssembler::AllocateFunctionWithMapAndContext(Node* map,
                                                            Node* shared_info,
                                                            Node* context) {
   CSA_SLOW_ASSERT(this, IsMap(map));
 
-  Node* const code =
-      LoadObjectField(shared_info, SharedFunctionInfo::kCodeOffset);
+  Node* const code = GetSharedFunctionInfoCode(shared_info);
 
   // TODO(ishell): All the callers of this function pass map loaded from
   // Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX. So we can remove
@@ -10534,8 +10910,8 @@ Node* CodeStubAssembler::AllocateFunctionWithMapAndContext(Node* map,
                        Heap::kEmptyFixedArrayRootIndex);
   StoreObjectFieldRoot(fun, JSObject::kElementsOffset,
                        Heap::kEmptyFixedArrayRootIndex);
-  StoreObjectFieldRoot(fun, JSFunction::kFeedbackVectorOffset,
-                       Heap::kUndefinedCellRootIndex);
+  StoreObjectFieldRoot(fun, JSFunction::kFeedbackCellOffset,
+                       Heap::kManyClosuresCellRootIndex);
   StoreObjectFieldNoWriteBarrier(fun, JSFunction::kSharedFunctionInfoOffset,
                                  shared_info);
   StoreObjectFieldNoWriteBarrier(fun, JSFunction::kContextOffset, context);
@@ -10543,28 +10919,6 @@ Node* CodeStubAssembler::AllocateFunctionWithMapAndContext(Node* map,
   return fun;
 }
 
-Node* CodeStubAssembler::AllocatePromiseReactionJobInfo(
-    Node* value, Node* tasks, Node* deferred_promise, Node* deferred_on_resolve,
-    Node* deferred_on_reject, Node* context) {
-  Node* const result = Allocate(PromiseReactionJobInfo::kSize);
-  StoreMapNoWriteBarrier(result, Heap::kPromiseReactionJobInfoMapRootIndex);
-  StoreObjectFieldNoWriteBarrier(result, PromiseReactionJobInfo::kValueOffset,
-                                 value);
-  StoreObjectFieldNoWriteBarrier(result, PromiseReactionJobInfo::kTasksOffset,
-                                 tasks);
-  StoreObjectFieldNoWriteBarrier(
-      result, PromiseReactionJobInfo::kDeferredPromiseOffset, deferred_promise);
-  StoreObjectFieldNoWriteBarrier(
-      result, PromiseReactionJobInfo::kDeferredOnResolveOffset,
-      deferred_on_resolve);
-  StoreObjectFieldNoWriteBarrier(
-      result, PromiseReactionJobInfo::kDeferredOnRejectOffset,
-      deferred_on_reject);
-  StoreObjectFieldNoWriteBarrier(result, PromiseReactionJobInfo::kContextOffset,
-                                 context);
-  return result;
-}
-
 Node* CodeStubAssembler::MarkerIsFrameType(Node* marker_or_function,
                                            StackFrame::Type frame_type) {
   return WordEqual(marker_or_function,
@@ -10713,5 +11067,12 @@ void CodeStubAssembler::InitializeFunctionContext(Node* native_context,
                                     native_context);
 }
 
+void CodeStubAssembler::AssertIsStrongHeapObject(
+    SloppyTNode<HeapObject> object) {
+  CSA_SLOW_ASSERT(this, WordEqual(WordAnd(BitcastTaggedToWord(object),
+                                          IntPtrConstant(kHeapObjectTagMask)),
+                                  IntPtrConstant(kHeapObjectTag)));
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/code-stub-assembler.h b/deps/v8/src/code-stub-assembler.h
index 0dd7a35c4a0..b0a60f4a766 100644
--- a/deps/v8/src/code-stub-assembler.h
+++ b/deps/v8/src/code-stub-assembler.h
@@ -22,54 +22,50 @@ class StubCache;
 
 enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
 
-#define HEAP_CONSTANT_LIST(V)                                                 \
-  V(AccessorInfoMap, accessor_info_map, AccessorInfoMap)                      \
-  V(AccessorPairMap, accessor_pair_map, AccessorPairMap)                      \
-  V(AllocationSiteMap, allocation_site_map, AllocationSiteMap)                \
-  V(BooleanMap, boolean_map, BooleanMap)                                      \
-  V(CodeMap, code_map, CodeMap)                                               \
-  V(EmptyPropertyDictionary, empty_property_dictionary,                       \
-    EmptyPropertyDictionary)                                                  \
-  V(EmptyFixedArray, empty_fixed_array, EmptyFixedArray)                      \
-  V(EmptySlowElementDictionary, empty_slow_element_dictionary,                \
-    EmptySlowElementDictionary)                                               \
-  V(empty_string, empty_string, EmptyString)                                  \
-  V(EmptyWeakCell, empty_weak_cell, EmptyWeakCell)                            \
-  V(FalseValue, false_value, False)                                           \
-  V(FeedbackVectorMap, feedback_vector_map, FeedbackVectorMap)                \
-  V(FixedArrayMap, fixed_array_map, FixedArrayMap)                            \
-  V(FixedCOWArrayMap, fixed_cow_array_map, FixedCOWArrayMap)                  \
-  V(FixedDoubleArrayMap, fixed_double_array_map, FixedDoubleArrayMap)         \
-  V(FunctionTemplateInfoMap, function_template_info_map,                      \
-    FunctionTemplateInfoMap)                                                  \
-  V(GlobalPropertyCellMap, global_property_cell_map, PropertyCellMap)         \
-  V(has_instance_symbol, has_instance_symbol, HasInstanceSymbol)              \
-  V(HeapNumberMap, heap_number_map, HeapNumberMap)                            \
-  V(length_string, length_string, LengthString)                               \
-  V(ManyClosuresCellMap, many_closures_cell_map, ManyClosuresCellMap)         \
-  V(MetaMap, meta_map, MetaMap)                                               \
-  V(MinusZeroValue, minus_zero_value, MinusZero)                              \
-  V(MutableHeapNumberMap, mutable_heap_number_map, MutableHeapNumberMap)      \
-  V(NanValue, nan_value, Nan)                                                 \
-  V(NoClosuresCellMap, no_closures_cell_map, NoClosuresCellMap)               \
-  V(NullValue, null_value, Null)                                              \
-  V(OneClosureCellMap, one_closure_cell_map, OneClosureCellMap)               \
-  V(prototype_string, prototype_string, PrototypeString)                      \
-  V(SpeciesProtector, species_protector, SpeciesProtector)                    \
-  V(StoreHandler0Map, store_handler0_map, StoreHandler0Map)                   \
-  V(SymbolMap, symbol_map, SymbolMap)                                         \
-  V(TheHoleValue, the_hole_value, TheHole)                                    \
-  V(TrueValue, true_value, True)                                              \
-  V(Tuple2Map, tuple2_map, Tuple2Map)                                         \
-  V(Tuple3Map, tuple3_map, Tuple3Map)                                         \
-  V(UndefinedValue, undefined_value, Undefined)                               \
-  V(WeakCellMap, weak_cell_map, WeakCellMap)                                  \
-  V(SharedFunctionInfoMap, shared_function_info_map, SharedFunctionInfoMap)   \
-  V(promise_default_reject_handler_symbol,                                    \
-    promise_default_reject_handler_symbol, PromiseDefaultRejectHandlerSymbol) \
-  V(promise_default_resolve_handler_symbol,                                   \
-    promise_default_resolve_handler_symbol,                                   \
-    PromiseDefaultResolveHandlerSymbol)
+#define HEAP_CONSTANT_LIST(V)                                            \
+  V(AccessorInfoMap, accessor_info_map, AccessorInfoMap)                 \
+  V(AccessorPairMap, accessor_pair_map, AccessorPairMap)                 \
+  V(AllocationSiteMap, allocation_site_map, AllocationSiteMap)           \
+  V(BooleanMap, boolean_map, BooleanMap)                                 \
+  V(CodeMap, code_map, CodeMap)                                          \
+  V(EmptyPropertyDictionary, empty_property_dictionary,                  \
+    EmptyPropertyDictionary)                                             \
+  V(EmptyFixedArray, empty_fixed_array, EmptyFixedArray)                 \
+  V(EmptySlowElementDictionary, empty_slow_element_dictionary,           \
+    EmptySlowElementDictionary)                                          \
+  V(empty_string, empty_string, EmptyString)                             \
+  V(EmptyWeakCell, empty_weak_cell, EmptyWeakCell)                       \
+  V(FalseValue, false_value, False)                                      \
+  V(FeedbackVectorMap, feedback_vector_map, FeedbackVectorMap)           \
+  V(FixedArrayMap, fixed_array_map, FixedArrayMap)                       \
+  V(FixedCOWArrayMap, fixed_cow_array_map, FixedCOWArrayMap)             \
+  V(FixedDoubleArrayMap, fixed_double_array_map, FixedDoubleArrayMap)    \
+  V(FunctionTemplateInfoMap, function_template_info_map,                 \
+    FunctionTemplateInfoMap)                                             \
+  V(GlobalPropertyCellMap, global_property_cell_map, PropertyCellMap)    \
+  V(has_instance_symbol, has_instance_symbol, HasInstanceSymbol)         \
+  V(HeapNumberMap, heap_number_map, HeapNumberMap)                       \
+  V(iterator_symbol, iterator_symbol, IteratorSymbol)                    \
+  V(length_string, length_string, LengthString)                          \
+  V(ManyClosuresCellMap, many_closures_cell_map, ManyClosuresCellMap)    \
+  V(MetaMap, meta_map, MetaMap)                                          \
+  V(MinusZeroValue, minus_zero_value, MinusZero)                         \
+  V(MutableHeapNumberMap, mutable_heap_number_map, MutableHeapNumberMap) \
+  V(NanValue, nan_value, Nan)                                            \
+  V(NoClosuresCellMap, no_closures_cell_map, NoClosuresCellMap)          \
+  V(NullValue, null_value, Null)                                         \
+  V(OneClosureCellMap, one_closure_cell_map, OneClosureCellMap)          \
+  V(prototype_string, prototype_string, PrototypeString)                 \
+  V(SpeciesProtector, species_protector, SpeciesProtector)               \
+  V(StoreHandler0Map, store_handler0_map, StoreHandler0Map)              \
+  V(SymbolMap, symbol_map, SymbolMap)                                    \
+  V(TheHoleValue, the_hole_value, TheHole)                               \
+  V(TrueValue, true_value, True)                                         \
+  V(Tuple2Map, tuple2_map, Tuple2Map)                                    \
+  V(Tuple3Map, tuple3_map, Tuple3Map)                                    \
+  V(UndefinedValue, undefined_value, Undefined)                          \
+  V(WeakCellMap, weak_cell_map, WeakCellMap)                             \
+  V(SharedFunctionInfoMap, shared_function_info_map, SharedFunctionInfoMap)
 
 // Returned from IteratorBuiltinsAssembler::GetIterator(). Struct is declared
 // here to simplify use in other generated builtins.
@@ -131,18 +127,18 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
     return ParameterRepresentation(OptimalParameterMode());
   }
 
-  Node* ParameterToWord(Node* value, ParameterMode mode) {
+  TNode<IntPtrT> ParameterToIntPtr(Node* value, ParameterMode mode) {
     if (mode == SMI_PARAMETERS) value = SmiUntag(value);
-    return value;
+    return UncheckedCast<IntPtrT>(value);
   }
 
-  Node* WordToParameter(SloppyTNode<IntPtrT> value, ParameterMode mode) {
+  Node* IntPtrToParameter(SloppyTNode<IntPtrT> value, ParameterMode mode) {
     if (mode == SMI_PARAMETERS) return SmiTag(value);
     return value;
   }
 
-  Node* Word32ToParameter(SloppyTNode<Int32T> value, ParameterMode mode) {
-    return WordToParameter(ChangeInt32ToIntPtr(value), mode);
+  Node* Int32ToParameter(SloppyTNode<Int32T> value, ParameterMode mode) {
+    return IntPtrToParameter(ChangeInt32ToIntPtr(value), mode);
   }
 
   TNode<Smi> ParameterToTagged(Node* value, ParameterMode mode) {
@@ -223,17 +219,23 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Select the minimum of the two provided Number values.
   TNode<Object> NumberMin(SloppyTNode<Object> left, SloppyTNode<Object> right);
 
-  // Tag a Word as a Smi value.
+  // After converting an index to an integer, calculate a relative index: if
+  // index < 0, max(length + index, 0); else min(index, length)
+  TNode<IntPtrT> ConvertToRelativeIndex(TNode<Context> context,
+                                        TNode<Object> index,
+                                        TNode<IntPtrT> length);
+
+  // Tag an IntPtr as a Smi value.
   TNode<Smi> SmiTag(SloppyTNode<IntPtrT> value);
-  // Untag a Smi value as a Word.
+  // Untag a Smi value as an IntPtr.
   TNode<IntPtrT> SmiUntag(SloppyTNode<Smi> value);
 
   // Smi conversions.
   TNode<Float64T> SmiToFloat64(SloppyTNode<Smi> value);
-  TNode<Smi> SmiFromWord(SloppyTNode<IntPtrT> value) { return SmiTag(value); }
-  TNode<Smi> SmiFromWord32(SloppyTNode<Int32T> value);
-  TNode<IntPtrT> SmiToWord(SloppyTNode<Smi> value) { return SmiUntag(value); }
-  TNode<Int32T> SmiToWord32(SloppyTNode<Smi> value);
+  TNode<Smi> SmiFromIntPtr(SloppyTNode<IntPtrT> value) { return SmiTag(value); }
+  TNode<Smi> SmiFromInt32(SloppyTNode<Int32T> value);
+  TNode<IntPtrT> SmiToIntPtr(SloppyTNode<Smi> value) { return SmiUntag(value); }
+  TNode<Int32T> SmiToInt32(SloppyTNode<Smi> value);
 
   // Smi operations.
 #define SMI_ARITHMETIC_BINOP(SmiOpName, IntPtrOpName)                  \
@@ -292,7 +294,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   TNode<Smi> SmiMax(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
   TNode<Smi> SmiMin(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
   // Computes a % b for Smi inputs a and b; result is not necessarily a Smi.
-  Node* SmiMod(Node* a, Node* b);
+  TNode<Number> SmiMod(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
   // Computes a * b for Smi inputs a and b; result is not necessarily a Smi.
   TNode<Number> SmiMul(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
   // Tries to computes dividend / divisor for Smi inputs; branching to bailout
@@ -300,10 +302,10 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* TrySmiDiv(Node* dividend, Node* divisor, Label* bailout);
 
   // Smi | HeapNumber operations.
-  Node* NumberInc(Node* value);
-  Node* NumberDec(Node* value);
-  Node* NumberAdd(Node* a, Node* b);
-  Node* NumberSub(Node* a, Node* b);
+  TNode<Number> NumberInc(SloppyTNode<Number> value);
+  TNode<Number> NumberDec(SloppyTNode<Number> value);
+  TNode<Number> NumberAdd(SloppyTNode<Number> a, SloppyTNode<Number> b);
+  TNode<Number> NumberSub(SloppyTNode<Number> a, SloppyTNode<Number> b);
   void GotoIfNotNumber(Node* value, Label* is_not_number);
   void GotoIfNumber(Node* value, Label* is_number);
 
@@ -318,8 +320,16 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* InnerAllocate(Node* previous, Node* offset);
   Node* IsRegularHeapObjectSize(Node* size);
 
+  typedef std::function<void(Label*, Label*)> BranchGenerator;
   typedef std::function<Node*()> NodeGenerator;
 
+  void Assert(const BranchGenerator& branch, const char* message = nullptr,
+              const char* file = nullptr, int line = 0,
+              Node* extra_node1 = nullptr, const char* extra_node1_name = "",
+              Node* extra_node2 = nullptr, const char* extra_node2_name = "",
+              Node* extra_node3 = nullptr, const char* extra_node3_name = "",
+              Node* extra_node4 = nullptr, const char* extra_node4_name = "",
+              Node* extra_node5 = nullptr, const char* extra_node5_name = "");
   void Assert(const NodeGenerator& condition_body,
               const char* message = nullptr, const char* file = nullptr,
               int line = 0, Node* extra_node1 = nullptr,
@@ -328,6 +338,13 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
               const char* extra_node3_name = "", Node* extra_node4 = nullptr,
               const char* extra_node4_name = "", Node* extra_node5 = nullptr,
               const char* extra_node5_name = "");
+  void Check(const BranchGenerator& branch, const char* message = nullptr,
+             const char* file = nullptr, int line = 0,
+             Node* extra_node1 = nullptr, const char* extra_node1_name = "",
+             Node* extra_node2 = nullptr, const char* extra_node2_name = "",
+             Node* extra_node3 = nullptr, const char* extra_node3_name = "",
+             Node* extra_node4 = nullptr, const char* extra_node4_name = "",
+             Node* extra_node5 = nullptr, const char* extra_node5_name = "");
   void Check(const NodeGenerator& condition_body, const char* message = nullptr,
              const char* file = nullptr, int line = 0,
              Node* extra_node1 = nullptr, const char* extra_node1_name = "",
@@ -336,56 +353,52 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
              Node* extra_node4 = nullptr, const char* extra_node4_name = "",
              Node* extra_node5 = nullptr, const char* extra_node5_name = "");
 
-  Node* Select(SloppyTNode<BoolT> condition, const NodeGenerator& true_body,
-               const NodeGenerator& false_body, MachineRepresentation rep);
   template <class A, class F, class G>
   TNode<A> Select(SloppyTNode<BoolT> condition, const F& true_body,
-                  const G& false_body, MachineRepresentation rep) {
-    return UncheckedCast<A>(
-        Select(condition,
-               [&]() -> Node* {
-                 return base::implicit_cast<SloppyTNode<A>>(true_body());
-               },
-               [&]() -> Node* {
-                 return base::implicit_cast<SloppyTNode<A>>(false_body());
-               },
-               rep));
-  }
-
-  Node* SelectConstant(Node* condition, Node* true_value, Node* false_value,
-                       MachineRepresentation rep);
+                  const G& false_body) {
+    return UncheckedCast<A>(SelectImpl(
+        condition,
+        [&]() -> Node* { return base::implicit_cast<TNode<A>>(true_body()); },
+        [&]() -> Node* { return base::implicit_cast<TNode<A>>(false_body()); },
+        MachineRepresentationOf<A>::value));
+  }
+
   template <class A>
   TNode<A> SelectConstant(TNode<BoolT> condition, TNode<A> true_value,
-                          TNode<A> false_value, MachineRepresentation rep) {
-    return UncheckedCast<A>(
-        SelectConstant(condition, static_cast<Node*>(true_value),
-                       static_cast<Node*>(false_value), rep));
+                          TNode<A> false_value) {
+    return Select<A>(condition, [=] { return true_value; },
+                     [=] { return false_value; });
   }
 
-  Node* SelectInt32Constant(Node* condition, int true_value, int false_value);
-  Node* SelectIntPtrConstant(Node* condition, int true_value, int false_value);
-  Node* SelectBooleanConstant(Node* condition);
+  TNode<Int32T> SelectInt32Constant(SloppyTNode<BoolT> condition,
+                                    int true_value, int false_value);
+  TNode<IntPtrT> SelectIntPtrConstant(SloppyTNode<BoolT> condition,
+                                      int true_value, int false_value);
+  TNode<Oddball> SelectBooleanConstant(SloppyTNode<BoolT> condition);
   template <class A>
   TNode<A> SelectTaggedConstant(SloppyTNode<BoolT> condition,
                                 TNode<A> true_value,
                                 SloppyTNode<A> false_value) {
     static_assert(std::is_base_of<Object, A>::value, "not a tagged type");
-    return SelectConstant(condition, true_value, false_value,
-                          MachineRepresentation::kTagged);
+    return SelectConstant<A>(condition, true_value, false_value);
   }
-  Node* SelectSmiConstant(Node* condition, Smi* true_value, Smi* false_value);
-  Node* SelectSmiConstant(Node* condition, int true_value, Smi* false_value) {
+  TNode<Smi> SelectSmiConstant(SloppyTNode<BoolT> condition, Smi* true_value,
+                               Smi* false_value);
+  TNode<Smi> SelectSmiConstant(SloppyTNode<BoolT> condition, int true_value,
+                               Smi* false_value) {
     return SelectSmiConstant(condition, Smi::FromInt(true_value), false_value);
   }
-  Node* SelectSmiConstant(Node* condition, Smi* true_value, int false_value) {
+  TNode<Smi> SelectSmiConstant(SloppyTNode<BoolT> condition, Smi* true_value,
+                               int false_value) {
     return SelectSmiConstant(condition, true_value, Smi::FromInt(false_value));
   }
-  Node* SelectSmiConstant(Node* condition, int true_value, int false_value) {
+  TNode<Smi> SelectSmiConstant(SloppyTNode<BoolT> condition, int true_value,
+                               int false_value) {
     return SelectSmiConstant(condition, Smi::FromInt(true_value),
                              Smi::FromInt(false_value));
   }
 
-  TNode<Int32T> TruncateWordToWord32(SloppyTNode<IntPtrT> value);
+  TNode<Int32T> TruncateIntPtrToInt32(SloppyTNode<IntPtrT> value);
 
   // Check a value for smi-ness
   TNode<BoolT> TaggedIsSmi(SloppyTNode<Object> a);
@@ -496,16 +509,25 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Load the instance type of an HeapObject.
   TNode<Int32T> LoadInstanceType(SloppyTNode<HeapObject> object);
   // Compare the instance the type of the object against the provided one.
-  Node* HasInstanceType(Node* object, InstanceType type);
-  Node* DoesntHaveInstanceType(Node* object, InstanceType type);
-  Node* TaggedDoesntHaveInstanceType(Node* any_tagged, InstanceType type);
+  TNode<BoolT> HasInstanceType(SloppyTNode<HeapObject> object,
+                               InstanceType type);
+  // Determines whether Array's prototype has changed.
+  TNode<BoolT> InitialArrayPrototypeHasInitialArrayPrototypeMap(
+      TNode<Context> native_context);
+  // Determines whether an array's elements map has changed.
+  TNode<BoolT> HasInitialFastElementsKindMap(TNode<Context> native_context,
+                                             TNode<JSArray> jsarray);
+  TNode<BoolT> DoesntHaveInstanceType(SloppyTNode<HeapObject> object,
+                                      InstanceType type);
+  TNode<BoolT> TaggedDoesntHaveInstanceType(SloppyTNode<HeapObject> any_tagged,
+                                            InstanceType type);
   // Load the properties backing store of a JSObject.
   TNode<HeapObject> LoadSlowProperties(SloppyTNode<JSObject> object);
   TNode<HeapObject> LoadFastProperties(SloppyTNode<JSObject> object);
   // Load the elements backing store of a JSObject.
   TNode<FixedArrayBase> LoadElements(SloppyTNode<JSObject> object);
   // Load the length of a JSArray instance.
-  TNode<Object> LoadJSArrayLength(SloppyTNode<JSArray> array);
+  TNode<Number> LoadJSArrayLength(SloppyTNode<JSArray> array);
   // Load the length of a fast JSArray instance. Returns a positive Smi.
   TNode<Smi> LoadFastJSArrayLength(SloppyTNode<JSArray> array);
   // Load the length of a fixed array base instance.
@@ -542,7 +564,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Load the EnumLength of a Map.
   Node* LoadMapEnumLength(SloppyTNode<Map> map);
   // Load the back-pointer of a Map.
-  Node* LoadMapBackPointer(SloppyTNode<Map> map);
+  TNode<Object> LoadMapBackPointer(SloppyTNode<Map> map);
   // Load the identity hash of a JSRececiver.
   TNode<IntPtrT> LoadJSReceiverIdentityHash(SloppyTNode<Object> receiver,
                                             Label* if_no_hash = nullptr);
@@ -577,18 +599,44 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                                   Label* if_cleared = nullptr);
 
   // Load an array element from a FixedArray.
-  Node* LoadFixedArrayElement(Node* object, Node* index,
-                              int additional_offset = 0,
-                              ParameterMode parameter_mode = INTPTR_PARAMETERS);
-  Node* LoadFixedArrayElement(Node* object, int index,
-                              int additional_offset = 0) {
+  TNode<Object> LoadFixedArrayElement(
+      SloppyTNode<Object> object, Node* index, int additional_offset = 0,
+      ParameterMode parameter_mode = INTPTR_PARAMETERS,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);
+
+  TNode<Object> LoadFixedArrayElement(SloppyTNode<Object> object,
+                                      TNode<IntPtrT> index,
+                                      LoadSensitivity needs_poisoning) {
+    return LoadFixedArrayElement(object, index, 0, INTPTR_PARAMETERS,
+                                 needs_poisoning);
+  }
+
+  TNode<Object> LoadFixedArrayElement(
+      SloppyTNode<Object> object, TNode<IntPtrT> index,
+      int additional_offset = 0,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
+    return LoadFixedArrayElement(object, index, additional_offset,
+                                 INTPTR_PARAMETERS, needs_poisoning);
+  }
+
+  TNode<Object> LoadFixedArrayElement(
+      SloppyTNode<Object> object, int index, int additional_offset = 0,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
     return LoadFixedArrayElement(object, IntPtrConstant(index),
-                                 additional_offset);
+                                 additional_offset, INTPTR_PARAMETERS,
+                                 needs_poisoning);
   }
   // Load an array element from a FixedArray, untag it and return it as Word32.
-  Node* LoadAndUntagToWord32FixedArrayElement(
-      Node* object, Node* index, int additional_offset = 0,
+  TNode<Int32T> LoadAndUntagToWord32FixedArrayElement(
+      SloppyTNode<Object> object, Node* index, int additional_offset = 0,
       ParameterMode parameter_mode = INTPTR_PARAMETERS);
+
+  TNode<Int32T> LoadAndUntagToWord32FixedArrayElement(
+      SloppyTNode<Object> object, int index, int additional_offset = 0) {
+    return LoadAndUntagToWord32FixedArrayElement(
+        object, IntPtrConstant(index), additional_offset, INTPTR_PARAMETERS);
+  }
+
   // Load an array element from a FixedDoubleArray.
   Node* LoadFixedDoubleArrayElement(
       Node* object, Node* index, MachineType machine_type,
@@ -607,12 +655,15 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* LoadDoubleWithHoleCheck(
       Node* base, Node* offset, Label* if_hole,
       MachineType machine_type = MachineType::Float64());
-  Node* LoadFixedTypedArrayElement(
-      Node* data_pointer, Node* index_node, ElementsKind elements_kind,
-      ParameterMode parameter_mode = INTPTR_PARAMETERS);
+  TNode<RawPtrT> LoadFixedTypedArrayBackingStore(
+      TNode<FixedTypedArrayBase> typed_array);
   Node* LoadFixedTypedArrayElementAsTagged(
       Node* data_pointer, Node* index_node, ElementsKind elements_kind,
       ParameterMode parameter_mode = INTPTR_PARAMETERS);
+  // Parts of the above, factored out for readability:
+  Node* LoadFixedBigInt64ArrayElementAsTagged(Node* data_pointer, Node* offset);
+  Node* LoadFixedBigUint64ArrayElementAsTagged(Node* data_pointer,
+                                               Node* offset);
 
   // Context manipulation
   TNode<Object> LoadContextElement(SloppyTNode<Context> context,
@@ -690,12 +741,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   void EnsureArrayLengthWritable(Node* map, Label* bailout);
 
-  // EnsureArrayPushable verifies that receiver is:
+  // EnsureArrayPushable verifies that receiver with this map is:
   //   1. Is not a prototype.
   //   2. Is not a dictionary.
   //   3. Has a writeable length property.
   // It returns ElementsKind as a node for further division into cases.
-  Node* EnsureArrayPushable(Node* receiver, Label* bailout);
+  TNode<Int32T> EnsureArrayPushable(TNode<Map> map, Label* bailout);
 
   void TryStoreArrayElement(ElementsKind kind, ParameterMode mode,
                             Label* bailout, Node* elements, Node* index,
@@ -727,39 +778,59 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Allocate a HeapNumber with a specific value.
   TNode<HeapNumber> AllocateHeapNumberWithValue(SloppyTNode<Float64T> value,
                                                 MutableMode mode = IMMUTABLE);
+  // Allocate a BigInt with {length} digits. Sets the sign bit to {false}.
+  // Does not initialize the digits.
+  TNode<BigInt> AllocateBigInt(TNode<IntPtrT> length);
+  // Like above, but allowing custom bitfield initialization.
+  TNode<BigInt> AllocateRawBigInt(TNode<IntPtrT> length);
+  void StoreBigIntBitfield(TNode<BigInt> bigint, TNode<WordT> bitfield);
+  void StoreBigIntDigit(TNode<BigInt> bigint, int digit_index,
+                        TNode<UintPtrT> digit);
+  TNode<WordT> LoadBigIntBitfield(TNode<BigInt> bigint);
+  TNode<UintPtrT> LoadBigIntDigit(TNode<BigInt> bigint, int digit_index);
   // Allocate a SeqOneByteString with the given length.
-  Node* AllocateSeqOneByteString(int length, AllocationFlags flags = kNone);
-  Node* AllocateSeqOneByteString(Node* context, TNode<Smi> length,
-                                 AllocationFlags flags = kNone);
+  TNode<String> AllocateSeqOneByteString(int length,
+                                         AllocationFlags flags = kNone);
+  TNode<String> AllocateSeqOneByteString(Node* context, TNode<Smi> length,
+                                         AllocationFlags flags = kNone);
   // Allocate a SeqTwoByteString with the given length.
-  Node* AllocateSeqTwoByteString(int length, AllocationFlags flags = kNone);
-  Node* AllocateSeqTwoByteString(Node* context, TNode<Smi> length,
-                                 AllocationFlags flags = kNone);
+  TNode<String> AllocateSeqTwoByteString(int length,
+                                         AllocationFlags flags = kNone);
+  TNode<String> AllocateSeqTwoByteString(Node* context, TNode<Smi> length,
+                                         AllocationFlags flags = kNone);
 
   // Allocate a SlicedOneByteString with the given length, parent and offset.
   // |length| and |offset| are expected to be tagged.
-  Node* AllocateSlicedOneByteString(TNode<Smi> length, Node* parent,
-                                    Node* offset);
+
+  TNode<String> AllocateSlicedOneByteString(TNode<Smi> length,
+                                            TNode<String> parent,
+                                            TNode<Smi> offset);
   // Allocate a SlicedTwoByteString with the given length, parent and offset.
   // |length| and |offset| are expected to be tagged.
-  Node* AllocateSlicedTwoByteString(TNode<Smi> length, Node* parent,
-                                    Node* offset);
+  TNode<String> AllocateSlicedTwoByteString(TNode<Smi> length,
+                                            TNode<String> parent,
+                                            TNode<Smi> offset);
 
   // Allocate a one-byte ConsString with the given length, first and second
   // parts. |length| is expected to be tagged, and |first| and |second| are
   // expected to be one-byte strings.
-  Node* AllocateOneByteConsString(TNode<Smi> length, Node* first, Node* second,
-                                  AllocationFlags flags = kNone);
+  TNode<String> AllocateOneByteConsString(TNode<Smi> length,
+                                          TNode<String> first,
+                                          TNode<String> second,
+                                          AllocationFlags flags = kNone);
   // Allocate a two-byte ConsString with the given length, first and second
   // parts. |length| is expected to be tagged, and |first| and |second| are
   // expected to be two-byte strings.
-  Node* AllocateTwoByteConsString(TNode<Smi> length, Node* first, Node* second,
-                                  AllocationFlags flags = kNone);
+  TNode<String> AllocateTwoByteConsString(TNode<Smi> length,
+                                          TNode<String> first,
+                                          TNode<String> second,
+                                          AllocationFlags flags = kNone);
 
   // Allocate an appropriate one- or two-byte ConsString with the first and
   // second parts specified by |left| and |right|.
-  Node* NewConsString(Node* context, TNode<Smi> length, Node* left, Node* right,
-                      AllocationFlags flags = kNone);
+  TNode<String> NewConsString(Node* context, TNode<Smi> length,
+                              TNode<String> left, TNode<String> right,
+                              AllocationFlags flags = kNone);
 
   Node* AllocateNameDictionary(int at_least_space_for);
   Node* AllocateNameDictionary(Node* at_least_space_for);
@@ -787,9 +858,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
       int start_offset = JSObject::kHeaderSize);
 
   // Allocate a JSArray without elements and initialize the header fields.
-  Node* AllocateUninitializedJSArrayWithoutElements(Node* array_map,
-                                                    Node* length,
-                                                    Node* allocation_site);
+  Node* AllocateUninitializedJSArrayWithoutElements(
+      Node* array_map, Node* length, Node* allocation_site = nullptr);
   // Allocate and return a JSArray with initialized header fields and its
   // uninitialized elements.
   // The ParameterMode argument is only used for the capacity parameter.
@@ -819,17 +889,13 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* AllocatePropertyArray(Node* capacity,
                               ParameterMode mode = INTPTR_PARAMETERS,
                               AllocationFlags flags = kNone);
-  // Perform CreateArrayIterator (ES6 #sec-createarrayiterator).
-  Node* CreateArrayIterator(Node* array, Node* array_map, Node* array_type,
-                            Node* context, IterationKind mode);
 
-  Node* AllocateJSArrayIterator(Node* array, Node* array_map, Node* map);
+  // Perform CreateArrayIterator (ES #sec-createarrayiterator).
+  Node* CreateArrayIterator(Node* context, Node* object, IterationKind mode);
+
   Node* AllocateJSIteratorResult(Node* context, Node* value, Node* done);
   Node* AllocateJSIteratorResultForEntry(Node* context, Node* key, Node* value);
 
-  Node* TypedArraySpeciesCreateByLength(Node* context, Node* originalArray,
-                                        Node* len);
-
   void FillFixedArrayWithValue(ElementsKind kind, Node* array, Node* from_index,
                                Node* to_index,
                                Heap::RootListIndex value_root_index,
@@ -1029,10 +1095,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* ToThisValue(Node* context, Node* value, PrimitiveType primitive_type,
                     char const* method_name);
 
-  // Throws a TypeError for {method_name}. Terminates the current block.
-  void ThrowIncompatibleMethodReceiver(Node* context, char const* method_name,
-                                       Node* receiver);
-
   // Throws a TypeError for {method_name} if {value} is not of the given
   // instance type. Returns {value}'s map.
   Node* ThrowIfNotInstanceType(Node* context, Node* value,
@@ -1055,12 +1117,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Type checks.
   // Check whether the map is for an object with special properties, such as a
   // JSProxy or an object with interceptors.
-  Node* InstanceTypeEqual(Node* instance_type, int type);
+  TNode<BoolT> InstanceTypeEqual(SloppyTNode<Int32T> instance_type, int type);
   Node* IsAccessorInfo(Node* object);
   Node* IsAccessorPair(Node* object);
   Node* IsAllocationSite(Node* object);
   Node* IsAnyHeapNumber(Node* object);
-  Node* IsArrayIteratorInstanceType(Node* instance_type);
   Node* IsNoElementsProtectorCellInvalid();
   Node* IsBigIntInstanceType(Node* instance_type);
   Node* IsBigInt(Node* object);
@@ -1068,6 +1129,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* IsCallableMap(Node* map);
   Node* IsCallable(Node* object);
   Node* IsCell(Node* object);
+  Node* IsCode(Node* object);
   Node* IsConsStringInstanceType(Node* instance_type);
   Node* IsConstructorMap(Node* map);
   Node* IsConstructor(Node* object);
@@ -1077,7 +1139,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* IsExternalStringInstanceType(Node* instance_type);
   TNode<BoolT> IsFastJSArray(SloppyTNode<Object> object,
                              SloppyTNode<Context> context);
+  TNode<BoolT> IsFastJSArrayWithNoCustomIteration(
+      TNode<Object> object, TNode<Context> context,
+      TNode<Context> native_context);
+  Node* IsFeedbackCell(Node* object);
   Node* IsFeedbackVector(Node* object);
+  Node* IsContext(Node* object);
   Node* IsFixedArray(Node* object);
   Node* IsFixedArraySubclass(Node* object);
   Node* IsFixedArrayWithKind(Node* object, ElementsKind kind);
@@ -1086,20 +1153,25 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* IsFixedTypedArray(Node* object);
   Node* IsFunctionWithPrototypeSlotMap(Node* map);
   Node* IsHashTable(Node* object);
-  Node* IsHeapNumber(Node* object);
+  TNode<BoolT> IsHeapNumber(Node* object);
   Node* IsIndirectStringInstanceType(Node* instance_type);
   Node* IsJSArrayBuffer(Node* object);
   Node* IsJSArrayInstanceType(Node* instance_type);
   Node* IsJSArrayMap(Node* object);
   Node* IsJSArray(Node* object);
+  Node* IsJSArrayIterator(Node* object);
+  Node* IsJSAsyncGeneratorObject(Node* object);
   Node* IsJSFunctionInstanceType(Node* instance_type);
   Node* IsJSFunctionMap(Node* object);
   Node* IsJSFunction(Node* object);
+  Node* IsJSGeneratorObject(Node* object);
   Node* IsJSGlobalProxyInstanceType(Node* instance_type);
   Node* IsJSGlobalProxy(Node* object);
   Node* IsJSObjectInstanceType(Node* instance_type);
   Node* IsJSObjectMap(Node* map);
   Node* IsJSObject(Node* object);
+  Node* IsJSPromiseMap(Node* map);
+  Node* IsJSPromise(Node* object);
   Node* IsJSProxy(Node* object);
   Node* IsJSReceiverInstanceType(Node* instance_type);
   Node* IsJSReceiverMap(Node* map);
@@ -1118,39 +1190,49 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* IsNumberDictionary(Node* object);
   Node* IsOneByteStringInstanceType(Node* instance_type);
   Node* IsPrimitiveInstanceType(Node* instance_type);
-  Node* IsPrivateSymbol(Node* object);
+  TNode<BoolT> IsPrivateSymbol(Node* object);
+  Node* IsPromiseCapability(Node* object);
   Node* IsPropertyArray(Node* object);
   Node* IsPropertyCell(Node* object);
   Node* IsPrototypeInitialArrayPrototype(Node* context, Node* map);
+  TNode<BoolT> IsPrototypeTypedArrayPrototype(SloppyTNode<Context> context,
+                                              SloppyTNode<Map> map);
   Node* IsSequentialStringInstanceType(Node* instance_type);
   Node* IsShortExternalStringInstanceType(Node* instance_type);
-  Node* IsSpecialReceiverInstanceType(Node* instance_type);
+  TNode<BoolT> IsSpecialReceiverInstanceType(Node* instance_type);
   Node* IsSpecialReceiverMap(Node* map);
-  Node* IsSpeciesProtectorCellInvalid();
   Node* IsStringInstanceType(Node* instance_type);
   Node* IsString(Node* object);
   Node* IsSymbolInstanceType(Node* instance_type);
   Node* IsSymbol(Node* object);
   Node* IsUndetectableMap(Node* map);
   Node* IsWeakCell(Node* object);
-  Node* IsZeroOrFixedArray(Node* object);
+  Node* IsZeroOrContext(Node* object);
 
   inline Node* IsSharedFunctionInfo(Node* object) {
     return IsSharedFunctionInfoMap(LoadMap(object));
   }
 
+  Node* IsPromiseResolveProtectorCellInvalid();
+  Node* IsPromiseThenProtectorCellInvalid();
+  Node* IsSpeciesProtectorCellInvalid();
+
   // True iff |object| is a Smi or a HeapNumber.
-  Node* IsNumber(Node* object);
+  TNode<BoolT> IsNumber(SloppyTNode<Object> object);
   // True iff |object| is a Smi or a HeapNumber or a BigInt.
-  Node* IsNumeric(Node* object);
+  TNode<BoolT> IsNumeric(SloppyTNode<Object> object);
 
   // True iff |number| is either a Smi, or a HeapNumber whose value is not
   // within Smi range.
-  Node* IsNumberNormalized(Node* number);
-  Node* IsNumberPositive(Node* number);
+  TNode<BoolT> IsNumberNormalized(SloppyTNode<Number> number);
+  TNode<BoolT> IsNumberPositive(SloppyTNode<Number> number);
   // True iff {number} is a positive number and a valid array index in the range
   // [0, 2^32-1).
-  Node* IsNumberArrayIndex(Node* number);
+  TNode<BoolT> IsNumberArrayIndex(SloppyTNode<Number> number);
+
+  Node* FixedArraySizeDoesntFitInNewSpace(
+      Node* element_count, int base_size = FixedArray::kHeaderSize,
+      ParameterMode mode = INTPTR_PARAMETERS);
 
   // ElementsKind helpers:
   Node* IsFastElementsKind(Node* elements_kind);
@@ -1159,29 +1241,21 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* IsElementsKindGreaterThan(Node* target_kind,
                                   ElementsKind reference_kind);
 
-  Node* FixedArraySizeDoesntFitInNewSpace(
-      Node* element_count, int base_size = FixedArray::kHeaderSize,
-      ParameterMode mode = INTPTR_PARAMETERS);
-
   // String helpers.
   // Load a character from a String (might flatten a ConsString).
   TNode<Int32T> StringCharCodeAt(SloppyTNode<String> string,
                                  SloppyTNode<IntPtrT> index);
   // Return the single character string with only {code}.
-  TNode<String> StringFromCharCode(TNode<Int32T> code);
-
-  enum class SubStringFlags { NONE, FROM_TO_ARE_BOUNDED };
+  TNode<String> StringFromSingleCharCode(TNode<Int32T> code);
 
   // Return a new string object which holds a substring containing the range
   // [from,to[ of string.  |from| and |to| are expected to be tagged.
-  // If flags has the value FROM_TO_ARE_BOUNDED then from and to are in
-  // the range [0, string-length)
-  Node* SubString(Node* context, Node* string, Node* from, Node* to,
-                  SubStringFlags flags = SubStringFlags::NONE);
+  TNode<String> SubString(TNode<String> string, TNode<IntPtrT> from,
+                          TNode<IntPtrT> to);
 
   // Return a new string object produced by concatenating |first| with |second|.
-  Node* StringAdd(Node* context, Node* first, Node* second,
-                  AllocationFlags flags = kNone);
+  TNode<String> StringAdd(Node* context, TNode<String> first,
+                          TNode<String> second, AllocationFlags flags = kNone);
 
   // Check if |string| is an indirect (thin or flat cons) string type that can
   // be dereferenced by DerefIndirectString.
@@ -1199,17 +1273,17 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                                  Variable* var_right, Node* right_instance_type,
                                  Label* did_something);
 
-  TNode<String> StringFromCodePoint(TNode<Int32T> codepoint,
-                                    UnicodeEncoding encoding);
+  TNode<String> StringFromSingleCodePoint(TNode<Int32T> codepoint,
+                                          UnicodeEncoding encoding);
 
   // Type conversion helpers.
   enum class BigIntHandling { kConvertToNumber, kThrow };
   // Convert a String to a Number.
-  TNode<Number> StringToNumber(SloppyTNode<String> input);
+  TNode<Number> StringToNumber(TNode<String> input);
   // Convert a Number to a String.
-  Node* NumberToString(Node* input);
+  TNode<String> NumberToString(TNode<Number> input);
   // Convert an object to a name.
-  Node* ToName(Node* context, Node* input);
+  TNode<Name> ToName(SloppyTNode<Context> context, SloppyTNode<Object> value);
   // Convert a Non-Number object to a Number.
   TNode<Number> NonNumberToNumber(
       SloppyTNode<Context> context, SloppyTNode<HeapObject> input,
@@ -1224,6 +1298,13 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   TNode<Number> ToNumber(
       SloppyTNode<Context> context, SloppyTNode<Object> input,
       BigIntHandling bigint_handling = BigIntHandling::kThrow);
+  TNode<Number> ToNumber_Inline(SloppyTNode<Context> context,
+                                SloppyTNode<Object> input);
+
+  // Try to convert an object to a BigInt. Throws on failure (e.g. for Numbers).
+  // https://tc39.github.io/proposal-bigint/#sec-to-bigint
+  TNode<BigInt> ToBigInt(SloppyTNode<Context> context,
+                         SloppyTNode<Object> input);
 
   // Converts |input| to one of 2^32 integer values in the range 0 through
   // 2^32-1, inclusive.
@@ -1240,22 +1321,29 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Convert any object to a Primitive.
   Node* JSReceiverToPrimitive(Node* context, Node* input);
 
+  TNode<JSReceiver> ToObject(SloppyTNode<Context> context,
+                             SloppyTNode<Object> input);
+
   enum ToIntegerTruncationMode {
     kNoTruncation,
     kTruncateMinusZero,
   };
 
   // ES6 7.1.17 ToIndex, but jumps to range_error if the result is not a Smi.
-  Node* ToSmiIndex(Node* const input, Node* const context, Label* range_error);
+  TNode<Smi> ToSmiIndex(TNode<Object> input, TNode<Context> context,
+                        Label* range_error);
 
   // ES6 7.1.15 ToLength, but jumps to range_error if the result is not a Smi.
-  Node* ToSmiLength(Node* input, Node* const context, Label* range_error);
+  TNode<Smi> ToSmiLength(TNode<Object> input, TNode<Context> context,
+                         Label* range_error);
 
   // ES6 7.1.15 ToLength, but with inlined fast path.
-  Node* ToLength_Inline(Node* const context, Node* const input);
+  TNode<Number> ToLength_Inline(SloppyTNode<Context> context,
+                                SloppyTNode<Object> input);
 
   // ES6 7.1.4 ToInteger ( argument )
-  TNode<Number> ToInteger_Inline(TNode<Context> context, TNode<Object> input,
+  TNode<Number> ToInteger_Inline(SloppyTNode<Context> context,
+                                 SloppyTNode<Object> input,
                                  ToIntegerTruncationMode mode = kNoTruncation);
   TNode<Number> ToInteger(SloppyTNode<Context> context,
                           SloppyTNode<Object> input,
@@ -1287,7 +1375,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   template <typename BitField>
   TNode<Uint32T> DecodeWord32FromWord(SloppyTNode<WordT> word) {
     return UncheckedCast<Uint32T>(
-        TruncateWordToWord32(Signed(DecodeWord<BitField>(word))));
+        TruncateIntPtrToInt32(Signed(DecodeWord<BitField>(word))));
   }
 
   // Decodes an unsigned (!) value from |word32| to an uint32 node.
@@ -1417,18 +1505,18 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Loads the details for the entry with the given key_index.
   // Returns an untagged int32.
   template <class ContainerType>
-  Node* LoadDetailsByKeyIndex(Node* container, Node* key_index) {
+  TNode<Uint32T> LoadDetailsByKeyIndex(Node* container, Node* key_index) {
     const int kKeyToDetailsOffset =
         (ContainerType::kEntryDetailsIndex - ContainerType::kEntryKeyIndex) *
         kPointerSize;
-    return LoadAndUntagToWord32FixedArrayElement(container, key_index,
-                                                 kKeyToDetailsOffset);
+    return Unsigned(LoadAndUntagToWord32FixedArrayElement(container, key_index,
+                                                          kKeyToDetailsOffset));
   }
 
   // Loads the value for the entry with the given key_index.
   // Returns a tagged value.
   template <class ContainerType>
-  Node* LoadValueByKeyIndex(Node* container, Node* key_index) {
+  TNode<Object> LoadValueByKeyIndex(Node* container, Node* key_index) {
     const int kKeyToValueOffset =
         (ContainerType::kEntryValueIndex - ContainerType::kEntryKeyIndex) *
         kPointerSize;
@@ -1554,36 +1642,47 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                          Label* if_not_found, Label* if_bailout,
                          GetOwnPropertyMode mode);
 
-  Node* GetProperty(Node* context, Node* receiver, Handle<Name> name) {
+  TNode<Object> GetProperty(SloppyTNode<Context> context,
+                            SloppyTNode<Object> receiver, Handle<Name> name) {
     return GetProperty(context, receiver, HeapConstant(name));
   }
 
-  Node* GetProperty(Node* context, Node* receiver, Node* const name) {
-    return CallStub(CodeFactory::GetProperty(isolate()), context, receiver,
-                    name);
+  TNode<Object> GetProperty(SloppyTNode<Context> context,
+                            SloppyTNode<Object> receiver,
+                            SloppyTNode<Object> name) {
+    return UncheckedCast<Object>(
+        CallStub(CodeFactory::GetProperty(isolate()), context, receiver, name));
   }
 
   Node* GetMethod(Node* context, Node* object, Handle<Name> name,
                   Label* if_null_or_undefined);
 
   template <class... TArgs>
-  Node* CallBuiltin(Builtins::Name id, Node* context, TArgs... args) {
+  TNode<Object> CallBuiltin(Builtins::Name id, SloppyTNode<Context> context,
+                            TArgs... args) {
     DCHECK_IMPLIES(Builtins::KindOf(id) == Builtins::TFJ,
                    !Builtins::IsLazy(id));
-    return CallStub(Builtins::CallableFor(isolate(), id), context, args...);
+    return UncheckedCast<Object>(
+        CallStub(Builtins::CallableFor(isolate(), id), context, args...));
   }
 
   template <class... TArgs>
-  Node* TailCallBuiltin(Builtins::Name id, Node* context, TArgs... args) {
+  TNode<Object> TailCallBuiltin(Builtins::Name id, SloppyTNode<Context> context,
+                                TArgs... args) {
     DCHECK_IMPLIES(Builtins::KindOf(id) == Builtins::TFJ,
                    !Builtins::IsLazy(id));
-    return TailCallStub(Builtins::CallableFor(isolate(), id), context, args...);
+    return UncheckedCast<Object>(
+        TailCallStub(Builtins::CallableFor(isolate(), id), context, args...));
   }
 
   void LoadPropertyFromFastObject(Node* object, Node* map, Node* descriptors,
                                   Node* name_index, Variable* var_details,
                                   Variable* var_value);
 
+  void LoadPropertyFromFastObject(Node* object, Node* map, Node* descriptors,
+                                  Node* name_index, Node* details,
+                                  Variable* var_value);
+
   void LoadPropertyFromNameDictionary(Node* dictionary, Node* entry,
                                       Variable* var_details,
                                       Variable* var_value);
@@ -1607,7 +1706,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   void TryLookupProperty(Node* object, Node* map, Node* instance_type,
                          Node* unique_name, Label* if_found_fast,
                          Label* if_found_dict, Label* if_found_global,
-                         Variable* var_meta_storage, Variable* var_name_index,
+                         TVariable<HeapObject>* var_meta_storage,
+                         TVariable<IntPtrT>* var_name_index,
                          Label* if_not_found, Label* if_bailout);
 
   // This method jumps to if_found if the element is known to exist. To
@@ -1682,7 +1782,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // used for a property store or deletion.
   void CheckForAssociatedProtector(Node* name, Label* if_protector);
 
-  Node* LoadReceiverMap(Node* receiver);
+  TNode<Map> LoadReceiverMap(SloppyTNode<Object> receiver);
 
   // Emits keyed sloppy arguments load. Returns either the loaded value.
   Node* LoadKeyedSloppyArguments(Node* receiver, Node* key, Label* bailout) {
@@ -1703,20 +1803,30 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* Int32ToUint8Clamped(Node* int32_value);
   Node* Float64ToUint8Clamped(Node* float64_value);
 
-  Node* PrepareValueForWriteToTypedArray(Node* key, ElementsKind elements_kind,
-                                         Label* bailout);
+  Node* PrepareValueForWriteToTypedArray(TNode<Object> input,
+                                         ElementsKind elements_kind,
+                                         TNode<Context> context);
 
   // Store value to an elements array with given elements kind.
   void StoreElement(Node* elements, ElementsKind kind, Node* index, Node* value,
                     ParameterMode mode);
 
+  void EmitBigTypedArrayElementStore(TNode<JSTypedArray> object,
+                                     TNode<FixedTypedArrayBase> elements,
+                                     TNode<IntPtrT> intptr_key,
+                                     TNode<Object> value,
+                                     TNode<Context> context,
+                                     Label* opt_if_neutered);
+
   void EmitElementStore(Node* object, Node* key, Node* value, bool is_jsarray,
                         ElementsKind elements_kind,
-                        KeyedAccessStoreMode store_mode, Label* bailout);
+                        KeyedAccessStoreMode store_mode, Label* bailout,
+                        Node* context);
 
   Node* CheckForCapacityGrow(Node* object, Node* elements, ElementsKind kind,
-                             Node* length, Node* key, ParameterMode mode,
-                             bool is_js_array, Label* bailout);
+                             KeyedAccessStoreMode store_mode, Node* length,
+                             Node* key, ParameterMode mode, bool is_js_array,
+                             Label* bailout);
 
   Node* CopyElementsOnWrite(Node* object, Node* elements, ElementsKind kind,
                             Node* length, ParameterMode mode, Label* bailout);
@@ -1776,19 +1886,20 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                                last_element_exclusive, body, mode, direction);
   }
 
-  Node* GetArrayAllocationSize(Node* element_count, ElementsKind kind,
-                               ParameterMode mode, int header_size) {
+  TNode<IntPtrT> GetArrayAllocationSize(Node* element_count, ElementsKind kind,
+                                        ParameterMode mode, int header_size) {
     return ElementOffsetFromIndex(element_count, kind, mode, header_size);
   }
 
-  Node* GetFixedArrayAllocationSize(Node* element_count, ElementsKind kind,
-                                    ParameterMode mode) {
+  TNode<IntPtrT> GetFixedArrayAllocationSize(Node* element_count,
+                                             ElementsKind kind,
+                                             ParameterMode mode) {
     return GetArrayAllocationSize(element_count, kind, mode,
                                   FixedArray::kHeaderSize);
   }
 
-  Node* GetPropertyArrayAllocationSize(Node* element_count,
-                                       ParameterMode mode) {
+  TNode<IntPtrT> GetPropertyArrayAllocationSize(Node* element_count,
+                                                ParameterMode mode) {
     return GetArrayAllocationSize(element_count, PACKED_ELEMENTS, mode,
                                   PropertyArray::kHeaderSize);
   }
@@ -1829,16 +1940,17 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   enum HasPropertyLookupMode { kHasProperty, kForInHasProperty };
 
   TNode<Oddball> HasProperty(SloppyTNode<HeapObject> object,
-                             SloppyTNode<Name> key,
+                             SloppyTNode<Object> key,
                              SloppyTNode<Context> context,
                              HasPropertyLookupMode mode);
 
-  Node* ClassOf(Node* object);
-
   Node* Typeof(Node* value);
 
   Node* GetSuperConstructor(Node* value, Node* context);
 
+  Node* SpeciesConstructor(Node* context, Node* object,
+                           Node* default_constructor);
+
   Node* InstanceOf(Node* object, Node* callable, Node* context);
 
   // Debug helpers
@@ -1847,8 +1959,15 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // TypedArray/ArrayBuffer helpers
   Node* IsDetachedBuffer(Node* buffer);
 
-  Node* ElementOffsetFromIndex(Node* index, ElementsKind kind,
-                               ParameterMode mode, int base_size = 0);
+  TNode<IntPtrT> ElementOffsetFromIndex(Node* index, ElementsKind kind,
+                                        ParameterMode mode, int base_size = 0);
+
+  // Load a builtin's code from the builtin array in the isolate.
+  TNode<Code> LoadBuiltin(TNode<Smi> builtin_id);
+
+  // Figure out the SFI's code object using its data field.
+  TNode<Code> GetSharedFunctionInfoCode(
+      SloppyTNode<SharedFunctionInfo> shared_info);
 
   Node* AllocateFunctionWithMapAndContext(Node* map, Node* shared_info,
                                           Node* context);
@@ -1856,11 +1975,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Promise helpers
   Node* IsPromiseHookEnabledOrDebugIsActive();
 
-  Node* AllocatePromiseReactionJobInfo(Node* value, Node* tasks,
-                                       Node* deferred_promise,
-                                       Node* deferred_on_resolve,
-                                       Node* deferred_on_reject, Node* context);
-
   // Helpers for StackFrame markers.
   Node* MarkerIsFrameType(Node* marker_or_function,
                           StackFrame::Type frame_type);
@@ -1897,26 +2011,52 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   void PerformStackCheck(Node* context);
 
  protected:
-  void DescriptorLookup(Node* unique_name, Node* descriptors, Node* bitfield3,
-                        Label* if_found, Variable* var_name_index,
+  // Implements DescriptorArray::Search().
+  void DescriptorLookup(SloppyTNode<Name> unique_name,
+                        SloppyTNode<DescriptorArray> descriptors,
+                        SloppyTNode<Uint32T> bitfield3, Label* if_found,
+                        TVariable<IntPtrT>* var_name_index,
                         Label* if_not_found);
-  void DescriptorLookupLinear(Node* unique_name, Node* descriptors, Node* nof,
-                              Label* if_found, Variable* var_name_index,
-                              Label* if_not_found);
-  void DescriptorLookupBinary(Node* unique_name, Node* descriptors, Node* nof,
-                              Label* if_found, Variable* var_name_index,
-                              Label* if_not_found);
-  // Implements DescriptorArray::ToKeyIndex.
-  // Returns an untagged IntPtr.
-  Node* DescriptorArrayToKeyIndex(Node* descriptor_number);
-  // Implements DescriptorArray::GetKey.
-  Node* DescriptorArrayGetKey(Node* descriptors, Node* descriptor_number);
+
+  // Implements generic search procedure like i::Search<Array>().
+  template <typename Array>
+  void Lookup(TNode<Name> unique_name, TNode<Array> array,
+              TNode<Uint32T> number_of_valid_entries, Label* if_found,
+              TVariable<IntPtrT>* var_name_index, Label* if_not_found);
+
+  // Implements generic linear search procedure like i::LinearSearch<Array>().
+  template <typename Array>
+  void LookupLinear(TNode<Name> unique_name, TNode<Array> array,
+                    TNode<Uint32T> number_of_valid_entries, Label* if_found,
+                    TVariable<IntPtrT>* var_name_index, Label* if_not_found);
+
+  // Implements generic binary search procedure like i::BinarySearch<Array>().
+  template <typename Array>
+  void LookupBinary(TNode<Name> unique_name, TNode<Array> array,
+                    TNode<Uint32T> number_of_valid_entries, Label* if_found,
+                    TVariable<IntPtrT>* var_name_index, Label* if_not_found);
+
+  // Converts [Descriptor/Transition]Array entry number to a fixed array index.
+  template <typename Array>
+  TNode<IntPtrT> EntryIndexToIndex(TNode<Uint32T> entry_index);
+
+  // Implements [Descriptor/Transition]Array::ToKeyIndex.
+  template <typename Array>
+  TNode<IntPtrT> ToKeyIndex(TNode<Uint32T> entry_index);
+
+  // Implements [Descriptor/Transition]Array::GetKey.
+  template <typename Array>
+  TNode<Name> GetKey(TNode<Array> array, TNode<Uint32T> entry_index);
+
+  // Implements DescriptorArray::GetDetails.
+  TNode<Uint32T> DescriptorArrayGetDetails(TNode<DescriptorArray> descriptors,
+                                           TNode<Uint32T> descriptor_number);
 
   Node* CallGetterIfAccessor(Node* value, Node* details, Node* context,
                              Node* receiver, Label* if_bailout,
                              GetOwnPropertyMode mode = kCallJSGetter);
 
-  Node* TryToIntptr(Node* key, Label* miss);
+  TNode<IntPtrT> TryToIntptr(Node* key, Label* miss);
 
   void BranchIfPrototypesHaveNoElements(Node* receiver_map,
                                         Label* definitely_no_elements,
@@ -1925,6 +2065,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   void InitializeFunctionContext(Node* native_context, Node* context,
                                  int slots);
 
+  void AssertIsStrongHeapObject(SloppyTNode<HeapObject> object);
+
  private:
   friend class CodeStubArguments;
 
@@ -1949,28 +2091,33 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* EmitKeyedSloppyArguments(Node* receiver, Node* key, Node* value,
                                  Label* bailout);
 
-  Node* AllocateSlicedString(Heap::RootListIndex map_root_index,
-                             TNode<Smi> length, Node* parent, Node* offset);
+  TNode<String> AllocateSlicedString(Heap::RootListIndex map_root_index,
+                                     TNode<Smi> length, TNode<String> parent,
+                                     TNode<Smi> offset);
 
-  Node* AllocateConsString(Heap::RootListIndex map_root_index,
-                           TNode<Smi> length, Node* first, Node* second,
-                           AllocationFlags flags);
+  TNode<String> AllocateConsString(Heap::RootListIndex map_root_index,
+                                   TNode<Smi> length, TNode<String> first,
+                                   TNode<String> second, AllocationFlags flags);
 
-  // Implements DescriptorArray::number_of_entries.
-  // Returns an untagged int32.
-  Node* DescriptorArrayNumberOfEntries(Node* descriptors);
-  // Implements DescriptorArray::GetSortedKeyIndex.
-  // Returns an untagged int32.
-  Node* DescriptorArrayGetSortedKeyIndex(Node* descriptors,
-                                         Node* descriptor_number);
+  Node* SelectImpl(TNode<BoolT> condition, const NodeGenerator& true_body,
+                   const NodeGenerator& false_body, MachineRepresentation rep);
+
+  // Implements [Descriptor/Transition]Array::number_of_entries.
+  template <typename Array>
+  TNode<Uint32T> NumberOfEntries(TNode<Array> array);
+
+  // Implements [Descriptor/Transition]Array::GetSortedKeyIndex.
+  template <typename Array>
+  TNode<Uint32T> GetSortedKeyIndex(TNode<Array> descriptors,
+                                   TNode<Uint32T> entry_index);
 
   Node* CollectFeedbackForString(Node* instance_type);
   void GenerateEqual_Same(Node* value, Label* if_equal, Label* if_notequal,
                           Variable* var_type_feedback = nullptr);
-  Node* AllocAndCopyStringCharacters(Node* context, Node* from,
-                                     Node* from_instance_type,
-                                     TNode<IntPtrT> from_index,
-                                     TNode<Smi> character_count);
+  TNode<String> AllocAndCopyStringCharacters(Node* from,
+                                             Node* from_instance_type,
+                                             TNode<IntPtrT> from_index,
+                                             TNode<Smi> character_count);
 
   static const int kElementLoopUnrollThreshold = 8;
 
@@ -2084,7 +2231,7 @@ class ToDirectStringAssembler : public CodeStubAssembler {
   // string. The result can be either a sequential or external string.
   // Jumps to if_bailout if the string if the string is indirect and cannot
   // be unpacked.
-  Node* TryToDirect(Label* if_bailout);
+  TNode<String> TryToDirect(Label* if_bailout);
 
   // Returns a pointer to the beginning of the string data.
   // Jumps to if_bailout if the external string cannot be unpacked.
@@ -2100,7 +2247,9 @@ class ToDirectStringAssembler : public CodeStubAssembler {
 
   Node* string() { return var_string_.value(); }
   Node* instance_type() { return var_instance_type_.value(); }
-  Node* offset() { return var_offset_.value(); }
+  TNode<IntPtrT> offset() {
+    return UncheckedCast<IntPtrT>(var_offset_.value());
+  }
   Node* is_external() { return var_is_external_.value(); }
 
  private:
@@ -2141,31 +2290,39 @@ class ToDirectStringAssembler : public CodeStubAssembler {
   CSA_ASSERT_STRINGIFY_EXTRA_VALUES_5(__VA_ARGS__, nullptr, nullptr, nullptr, \
                                       nullptr, nullptr)
 
-#define CSA_ASSERT_GET_CONDITION(x, ...) (x)
-#define CSA_ASSERT_GET_CONDITION_STR(x, ...) #x
+#define CSA_ASSERT_GET_FIRST(x, ...) (x)
+#define CSA_ASSERT_GET_FIRST_STR(x, ...) #x
 
 // CSA_ASSERT(csa, <condition>, <extra values to print...>)
 
 // We have to jump through some hoops to allow <extra values to print...> to be
 // empty.
-#define CSA_ASSERT(csa, ...)                                                 \
-  (csa)->Assert(                                                             \
-      [&]() -> compiler::Node* {                                             \
-        return base::implicit_cast<compiler::SloppyTNode<Word32T>>(          \
-            EXPAND(CSA_ASSERT_GET_CONDITION(__VA_ARGS__)));                  \
-      },                                                                     \
-      EXPAND(CSA_ASSERT_GET_CONDITION_STR(__VA_ARGS__)), __FILE__, __LINE__, \
+#define CSA_ASSERT(csa, ...)                                             \
+  (csa)->Assert(                                                         \
+      [&]() -> compiler::Node* {                                         \
+        return base::implicit_cast<compiler::SloppyTNode<Word32T>>(      \
+            EXPAND(CSA_ASSERT_GET_FIRST(__VA_ARGS__)));                  \
+      },                                                                 \
+      EXPAND(CSA_ASSERT_GET_FIRST_STR(__VA_ARGS__)), __FILE__, __LINE__, \
       CSA_ASSERT_STRINGIFY_EXTRA_VALUES(__VA_ARGS__))
 
-#define CSA_ASSERT_JS_ARGC_OP(csa, Op, op, expected)                      \
-  (csa)->Assert(                                                          \
-      [&]() -> compiler::Node* {                                          \
-        compiler::Node* const argc =                                      \
-            (csa)->Parameter(Descriptor::kActualArgumentsCount);          \
-        return (csa)->Op(argc, (csa)->Int32Constant(expected));           \
-      },                                                                  \
-      "argc " #op " " #expected, __FILE__, __LINE__,                      \
-      SmiFromWord32((csa)->Parameter(Descriptor::kActualArgumentsCount)), \
+// CSA_ASSERT_BRANCH(csa, [](Label* ok, Label* not_ok) {...},
+//     <extra values to print...>)
+
+#define CSA_ASSERT_BRANCH(csa, ...)                                      \
+  (csa)->Assert(EXPAND(CSA_ASSERT_GET_FIRST(__VA_ARGS__)),               \
+                EXPAND(CSA_ASSERT_GET_FIRST_STR(__VA_ARGS__)), __FILE__, \
+                __LINE__, CSA_ASSERT_STRINGIFY_EXTRA_VALUES(__VA_ARGS__))
+
+#define CSA_ASSERT_JS_ARGC_OP(csa, Op, op, expected)                     \
+  (csa)->Assert(                                                         \
+      [&]() -> compiler::Node* {                                         \
+        compiler::Node* const argc =                                     \
+            (csa)->Parameter(Descriptor::kActualArgumentsCount);         \
+        return (csa)->Op(argc, (csa)->Int32Constant(expected));          \
+      },                                                                 \
+      "argc " #op " " #expected, __FILE__, __LINE__,                     \
+      SmiFromInt32((csa)->Parameter(Descriptor::kActualArgumentsCount)), \
       "argc")
 
 #define CSA_ASSERT_JS_ARGC_EQ(csa, expected) \
@@ -2182,6 +2339,7 @@ class ToDirectStringAssembler : public CodeStubAssembler {
   TVariable<type> name(CSA_DEBUG_INFO(name), __VA_ARGS__)
 #else  // DEBUG
 #define CSA_ASSERT(csa, ...) ((void)0)
+#define CSA_ASSERT_BRANCH(csa, ...) ((void)0)
 #define CSA_ASSERT_JS_ARGC_EQ(csa, expected) ((void)0)
 #define BIND(label) Bind(label)
 #define VARIABLE(name, ...) Variable name(this, __VA_ARGS__)
diff --git a/deps/v8/src/code-stubs.cc b/deps/v8/src/code-stubs.cc
index 2b98a5bfc78..c18cce36ce3 100644
--- a/deps/v8/src/code-stubs.cc
+++ b/deps/v8/src/code-stubs.cc
@@ -71,9 +71,9 @@ void CodeStubDescriptor::Initialize(Register stack_parameter_count,
 
 
 bool CodeStub::FindCodeInCache(Code** code_out) {
-  NumberDictionary* stubs = isolate()->heap()->code_stubs();
+  SimpleNumberDictionary* stubs = isolate()->heap()->code_stubs();
   int index = stubs->FindEntry(isolate(), GetKey());
-  if (index != NumberDictionary::kNotFound) {
+  if (index != SimpleNumberDictionary::kNotFound) {
     *code_out = Code::cast(stubs->ValueAt(index));
     return true;
   }
@@ -97,10 +97,10 @@ void CodeStub::RecordCodeGeneration(Handle<Code> code) {
 
 void CodeStub::DeleteStubFromCacheForTesting() {
   Heap* heap = isolate_->heap();
-  Handle<NumberDictionary> dict(heap->code_stubs());
+  Handle<SimpleNumberDictionary> dict(heap->code_stubs());
   int entry = dict->FindEntry(GetKey());
-  DCHECK_NE(NumberDictionary::kNotFound, entry);
-  dict = NumberDictionary::DeleteEntry(dict, entry);
+  DCHECK_NE(SimpleNumberDictionary::kNotFound, entry);
+  dict = SimpleNumberDictionary::DeleteEntry(dict, entry);
   heap->SetRootCodeStubs(*dict);
 }
 
@@ -121,17 +121,17 @@ Handle<Code> PlatformCodeStub::GenerateCode() {
     Generate(&masm);
   }
 
-  // Allocate the handler table.
-  Handle<HandlerTable> table = GenerateHandlerTable();
+  // Generate the handler table.
+  int handler_table_offset = GenerateHandlerTable(&masm);
 
   // Create the code object.
   CodeDesc desc;
   masm.GetCode(isolate(), &desc);
   // Copy the generated code into a heap object.
   Handle<Code> new_object = factory->NewCode(
-      desc, Code::STUB, masm.CodeObject(), Builtins::kNoBuiltinId, table,
+      desc, Code::STUB, masm.CodeObject(), Builtins::kNoBuiltinId,
       MaybeHandle<ByteArray>(), DeoptimizationData::Empty(isolate()),
-      NeedsImmovableCode(), GetKey());
+      NeedsImmovableCode(), GetKey(), false, 0, 0, handler_table_offset);
   return new_object;
 }
 
@@ -166,8 +166,8 @@ Handle<Code> CodeStub::GetCode() {
 #endif
 
     // Update the dictionary and the root in Heap.
-    Handle<NumberDictionary> dict =
-        NumberDictionary::Set(handle(heap->code_stubs()), GetKey(), new_object);
+    Handle<SimpleNumberDictionary> dict = SimpleNumberDictionary::Set(
+        handle(heap->code_stubs()), GetKey(), new_object);
     heap->SetRootCodeStubs(*dict);
     code = *new_object;
   }
@@ -225,9 +225,7 @@ void CodeStub::Dispatch(Isolate* isolate, uint32_t key, void** value_out,
   }
 }
 
-Handle<HandlerTable> PlatformCodeStub::GenerateHandlerTable() {
-  return HandlerTable::Empty(isolate());
-}
+int PlatformCodeStub::GenerateHandlerTable(MacroAssembler* masm) { return 0; }
 
 static void InitializeDescriptorDispatchedCall(CodeStub* stub,
                                                void** value_out) {
@@ -289,7 +287,7 @@ TF_STUB(StringAddStub, CodeStubAssembler) {
     CodeStubAssembler::AllocationFlag allocation_flags =
         (pretenure_flag == TENURED) ? CodeStubAssembler::kPretenured
                                     : CodeStubAssembler::kNone;
-    Return(StringAdd(context, left, right, allocation_flags));
+    Return(StringAdd(context, CAST(left), CAST(right), allocation_flags));
   } else {
     Callable callable = CodeFactory::StringAdd(isolate(), STRING_ADD_CHECK_NONE,
                                                pretenure_flag);
@@ -302,7 +300,8 @@ Handle<Code> TurboFanCodeStub::GenerateCode() {
   Zone zone(isolate()->allocator(), ZONE_NAME);
   CallInterfaceDescriptor descriptor(GetCallInterfaceDescriptor());
   compiler::CodeAssemblerState state(isolate(), &zone, descriptor, Code::STUB,
-                                     name, 1, GetKey());
+                                     name, PoisoningMitigationLevel::kOff, 1,
+                                     GetKey());
   GenerateAssembly(&state);
   return compiler::CodeAssembler::GenerateCode(&state);
 }
@@ -332,7 +331,7 @@ TF_STUB(ElementsTransitionAndStoreStub, CodeStubAssembler) {
     TransitionElementsKind(receiver, map, stub->from_kind(), stub->to_kind(),
                            stub->is_jsarray(), &miss);
     EmitElementStore(receiver, key, value, stub->is_jsarray(), stub->to_kind(),
-                     stub->store_mode(), &miss);
+                     stub->store_mode(), &miss, context);
     Return(value);
   }
 
@@ -434,11 +433,10 @@ TF_STUB(LoadIndexedInterceptorStub, CodeStubAssembler) {
                   vector);
 }
 
-Handle<HandlerTable> JSEntryStub::GenerateHandlerTable() {
-  Handle<FixedArray> handler_table =
-      isolate()->factory()->NewFixedArray(1, TENURED);
-  handler_table->set(0, Smi::FromInt(handler_offset_));
-  return Handle<HandlerTable>::cast(handler_table);
+int JSEntryStub::GenerateHandlerTable(MacroAssembler* masm) {
+  int handler_table_offset = HandlerTable::EmitReturnTableStart(masm, 1);
+  HandlerTable::EmitReturnEntry(masm, 0, handler_offset_);
+  return handler_table_offset;
 }
 
 
@@ -509,6 +507,15 @@ TF_STUB(StoreSlowElementStub, CodeStubAssembler) {
                   receiver, name);
 }
 
+TF_STUB(StoreInArrayLiteralSlowStub, CodeStubAssembler) {
+  Node* array = Parameter(Descriptor::kReceiver);
+  Node* index = Parameter(Descriptor::kName);
+  Node* value = Parameter(Descriptor::kValue);
+  Node* context = Parameter(Descriptor::kContext);
+  TailCallRuntime(Runtime::kStoreInArrayLiteralIC_Slow, context, value, array,
+                  index);
+}
+
 TF_STUB(StoreFastElementStub, CodeStubAssembler) {
   Comment("StoreFastElementStub: js_array=%d, elements_kind=%s, store_mode=%d",
           stub->is_js_array(), ElementsKindToString(stub->elements_kind()),
@@ -524,7 +531,7 @@ TF_STUB(StoreFastElementStub, CodeStubAssembler) {
   Label miss(this);
 
   EmitElementStore(receiver, key, value, stub->is_js_array(),
-                   stub->elements_kind(), stub->store_mode(), &miss);
+                   stub->elements_kind(), stub->store_mode(), &miss, context);
   Return(value);
 
   BIND(&miss);
@@ -541,12 +548,13 @@ void StoreFastElementStub::GenerateAheadOfTime(Isolate* isolate) {
   StoreFastElementStub(isolate, false, HOLEY_ELEMENTS, STANDARD_STORE)
       .GetCode();
   StoreFastElementStub(isolate, false, HOLEY_ELEMENTS,
-                       STORE_AND_GROW_NO_TRANSITION)
+                       STORE_AND_GROW_NO_TRANSITION_HANDLE_COW)
       .GetCode();
   for (int i = FIRST_FAST_ELEMENTS_KIND; i <= LAST_FAST_ELEMENTS_KIND; i++) {
     ElementsKind kind = static_cast<ElementsKind>(i);
     StoreFastElementStub(isolate, true, kind, STANDARD_STORE).GetCode();
-    StoreFastElementStub(isolate, true, kind, STORE_AND_GROW_NO_TRANSITION)
+    StoreFastElementStub(isolate, true, kind,
+                         STORE_AND_GROW_NO_TRANSITION_HANDLE_COW)
         .GetCode();
   }
 }
diff --git a/deps/v8/src/code-stubs.h b/deps/v8/src/code-stubs.h
index 751a89fdbdf..a1faabd7cd7 100644
--- a/deps/v8/src/code-stubs.h
+++ b/deps/v8/src/code-stubs.h
@@ -37,8 +37,9 @@ class Node;
   V(JSEntry)                                \
   V(MathPow)                                \
   V(ProfileEntryHook)                       \
-  V(StoreSlowElement)                       \
   /* --- TurboFanCodeStubs --- */           \
+  V(StoreSlowElement)                       \
+  V(StoreInArrayLiteralSlow)                \
   V(ArrayNoArgumentConstructor)             \
   V(ArraySingleArgumentConstructor)         \
   V(ArrayNArgumentsConstructor)             \
@@ -288,7 +289,7 @@ class PlatformCodeStub : public CodeStub {
   virtual void Generate(MacroAssembler* masm) = 0;
 
   // Generates the exception handler table for the stub.
-  virtual Handle<HandlerTable> GenerateHandlerTable();
+  virtual int GenerateHandlerTable(MacroAssembler* masm);
 
   DEFINE_CODE_STUB_BASE(PlatformCodeStub, CodeStub);
 };
@@ -692,7 +693,7 @@ class JSEntryStub : public PlatformCodeStub {
   }
 
  private:
-  Handle<HandlerTable> GenerateHandlerTable() override;
+  int GenerateHandlerTable(MacroAssembler* masm) override;
 
   void PrintName(std::ostream& os) const override {  // NOLINT
     os << (type() == StackFrame::ENTRY ? "JSEntryStub"
@@ -929,6 +930,18 @@ class StoreSlowElementStub : public TurboFanCodeStub {
   DEFINE_TURBOFAN_CODE_STUB(StoreSlowElement, TurboFanCodeStub);
 };
 
+class StoreInArrayLiteralSlowStub : public TurboFanCodeStub {
+ public:
+  StoreInArrayLiteralSlowStub(Isolate* isolate, KeyedAccessStoreMode mode)
+      : TurboFanCodeStub(isolate) {
+    minor_key_ = CommonStoreModeBits::encode(mode);
+  }
+
+ private:
+  DEFINE_CALL_INTERFACE_DESCRIPTOR(StoreWithVector);
+  DEFINE_TURBOFAN_CODE_STUB(StoreInArrayLiteralSlow, TurboFanCodeStub);
+};
+
 class ElementsTransitionAndStoreStub : public TurboFanCodeStub {
  public:
   ElementsTransitionAndStoreStub(Isolate* isolate, ElementsKind from_kind,
diff --git a/deps/v8/src/compilation-cache.cc b/deps/v8/src/compilation-cache.cc
index 927e09a9403..046f692c076 100644
--- a/deps/v8/src/compilation-cache.cc
+++ b/deps/v8/src/compilation-cache.cc
@@ -69,7 +69,7 @@ void CompilationSubCache::Age() {
 }
 
 void CompilationSubCache::Iterate(RootVisitor* v) {
-  v->VisitRootPointers(Root::kCompilationCache, &tables_[0],
+  v->VisitRootPointers(Root::kCompilationCache, nullptr, &tables_[0],
                        &tables_[generations_]);
 }
 
@@ -123,11 +123,11 @@ bool CompilationCacheScript::HasOrigin(Handle<SharedFunctionInfo> function_info,
 // be cached in the same script generation. Currently the first use
 // will be cached, but subsequent code from different source / line
 // won't.
-InfoVectorPair CompilationCacheScript::Lookup(
+MaybeHandle<SharedFunctionInfo> CompilationCacheScript::Lookup(
     Handle<String> source, MaybeHandle<Object> name, int line_offset,
     int column_offset, ScriptOriginOptions resource_options,
     Handle<Context> context, LanguageMode language_mode) {
-  InfoVectorPair result;
+  MaybeHandle<SharedFunctionInfo> result;
 
   // Probe the script generation tables. Make sure not to leak handles
   // into the caller's handle scope.
@@ -135,19 +135,15 @@ InfoVectorPair CompilationCacheScript::Lookup(
     const int generation = 0;
     DCHECK_EQ(generations(), 1);
     Handle<CompilationCacheTable> table = GetTable(generation);
-    InfoVectorPair probe = table->LookupScript(source, context, language_mode);
-    if (probe.has_shared()) {
-      Handle<SharedFunctionInfo> function_info(probe.shared(), isolate());
-      Handle<Cell> vector_handle;
-      if (probe.has_vector()) {
-        vector_handle = Handle<Cell>(probe.vector(), isolate());
-      }
+    MaybeHandle<SharedFunctionInfo> probe =
+        table->LookupScript(source, context, language_mode);
+    Handle<SharedFunctionInfo> function_info;
+    if (probe.ToHandle(&function_info)) {
       // Break when we've found a suitable shared function info that
       // matches the origin.
       if (HasOrigin(function_info, name, line_offset, column_offset,
                     resource_options)) {
-        result = InfoVectorPair(*function_info,
-                                probe.has_vector() ? *vector_handle : nullptr);
+        result = scope.CloseAndEscape(function_info);
       }
     }
   }
@@ -155,19 +151,13 @@ InfoVectorPair CompilationCacheScript::Lookup(
   // Once outside the manacles of the handle scope, we need to recheck
   // to see if we actually found a cached script. If so, we return a
   // handle created in the caller's handle scope.
-  if (result.has_shared()) {
+  Handle<SharedFunctionInfo> function_info;
+  if (result.ToHandle(&function_info)) {
 #ifdef DEBUG
     // Since HasOrigin can allocate, we need to protect the SharedFunctionInfo
-    // and the FeedbackVector with handles during the call.
-    Handle<SharedFunctionInfo> shared(result.shared(), isolate());
-    Handle<Cell> vector_handle;
-    if (result.has_vector()) {
-      vector_handle = Handle<Cell>(result.vector(), isolate());
-    }
-    DCHECK(
-        HasOrigin(shared, name, line_offset, column_offset, resource_options));
-    result =
-        InfoVectorPair(*shared, result.has_vector() ? *vector_handle : nullptr);
+    // with handles during the call.
+    DCHECK(HasOrigin(function_info, name, line_offset, column_offset,
+                     resource_options));
 #endif
     isolate()->counters()->compilation_cache_hits()->Increment();
   } else {
@@ -178,22 +168,23 @@ InfoVectorPair CompilationCacheScript::Lookup(
 
 void CompilationCacheScript::Put(Handle<String> source, Handle<Context> context,
                                  LanguageMode language_mode,
-                                 Handle<SharedFunctionInfo> function_info,
-                                 Handle<Cell> literals) {
+                                 Handle<SharedFunctionInfo> function_info) {
   HandleScope scope(isolate());
   Handle<CompilationCacheTable> table = GetFirstTable();
-  SetFirstTable(CompilationCacheTable::PutScript(
-      table, source, context, language_mode, function_info, literals));
+  SetFirstTable(CompilationCacheTable::PutScript(table, source, context,
+                                                 language_mode, function_info));
 }
 
-InfoVectorPair CompilationCacheEval::Lookup(
-    Handle<String> source, Handle<SharedFunctionInfo> outer_info,
-    Handle<Context> native_context, LanguageMode language_mode, int position) {
+InfoCellPair CompilationCacheEval::Lookup(Handle<String> source,
+                                          Handle<SharedFunctionInfo> outer_info,
+                                          Handle<Context> native_context,
+                                          LanguageMode language_mode,
+                                          int position) {
   HandleScope scope(isolate());
   // Make sure not to leak the table into the surrounding handle
   // scope. Otherwise, we risk keeping old tables around even after
   // having cleared the cache.
-  InfoVectorPair result;
+  InfoCellPair result;
   const int generation = 0;
   DCHECK_EQ(generations(), 1);
   Handle<CompilationCacheTable> table = GetTable(generation);
@@ -211,12 +202,13 @@ void CompilationCacheEval::Put(Handle<String> source,
                                Handle<SharedFunctionInfo> outer_info,
                                Handle<SharedFunctionInfo> function_info,
                                Handle<Context> native_context,
-                               Handle<Cell> literals, int position) {
+                               Handle<FeedbackCell> feedback_cell,
+                               int position) {
   HandleScope scope(isolate());
   Handle<CompilationCacheTable> table = GetFirstTable();
   table =
       CompilationCacheTable::PutEval(table, source, outer_info, function_info,
-                                     native_context, literals, position);
+                                     native_context, feedback_cell, position);
   SetFirstTable(table);
 }
 
@@ -263,21 +255,22 @@ void CompilationCache::Remove(Handle<SharedFunctionInfo> function_info) {
   script_.Remove(function_info);
 }
 
-InfoVectorPair CompilationCache::LookupScript(
+MaybeHandle<SharedFunctionInfo> CompilationCache::LookupScript(
     Handle<String> source, MaybeHandle<Object> name, int line_offset,
     int column_offset, ScriptOriginOptions resource_options,
     Handle<Context> context, LanguageMode language_mode) {
-  InfoVectorPair empty_result;
-  if (!IsEnabled()) return empty_result;
+  if (!IsEnabled()) return MaybeHandle<SharedFunctionInfo>();
 
   return script_.Lookup(source, name, line_offset, column_offset,
                         resource_options, context, language_mode);
 }
 
-InfoVectorPair CompilationCache::LookupEval(
-    Handle<String> source, Handle<SharedFunctionInfo> outer_info,
-    Handle<Context> context, LanguageMode language_mode, int position) {
-  InfoVectorPair result;
+InfoCellPair CompilationCache::LookupEval(Handle<String> source,
+                                          Handle<SharedFunctionInfo> outer_info,
+                                          Handle<Context> context,
+                                          LanguageMode language_mode,
+                                          int position) {
+  InfoCellPair result;
   if (!IsEnabled()) return result;
 
   if (context->IsNativeContext()) {
@@ -302,29 +295,29 @@ MaybeHandle<FixedArray> CompilationCache::LookupRegExp(Handle<String> source,
 
 void CompilationCache::PutScript(Handle<String> source, Handle<Context> context,
                                  LanguageMode language_mode,
-                                 Handle<SharedFunctionInfo> function_info,
-                                 Handle<Cell> literals) {
+                                 Handle<SharedFunctionInfo> function_info) {
   if (!IsEnabled()) return;
 
-  script_.Put(source, context, language_mode, function_info, literals);
+  script_.Put(source, context, language_mode, function_info);
 }
 
 void CompilationCache::PutEval(Handle<String> source,
                                Handle<SharedFunctionInfo> outer_info,
                                Handle<Context> context,
                                Handle<SharedFunctionInfo> function_info,
-                               Handle<Cell> literals, int position) {
+                               Handle<FeedbackCell> feedback_cell,
+                               int position) {
   if (!IsEnabled()) return;
 
   HandleScope scope(isolate());
   if (context->IsNativeContext()) {
-    eval_global_.Put(source, outer_info, function_info, context, literals,
+    eval_global_.Put(source, outer_info, function_info, context, feedback_cell,
                      position);
   } else {
     DCHECK_NE(position, kNoSourcePosition);
     Handle<Context> native_context(context->native_context(), isolate());
     eval_contextual_.Put(source, outer_info, function_info, native_context,
-                         literals, position);
+                         feedback_cell, position);
   }
 }
 
diff --git a/deps/v8/src/compilation-cache.h b/deps/v8/src/compilation-cache.h
index 3c9751ac2fe..0072d3b487a 100644
--- a/deps/v8/src/compilation-cache.h
+++ b/deps/v8/src/compilation-cache.h
@@ -79,14 +79,16 @@ class CompilationCacheScript : public CompilationSubCache {
  public:
   explicit CompilationCacheScript(Isolate* isolate);
 
-  InfoVectorPair Lookup(Handle<String> source, MaybeHandle<Object> name,
-                        int line_offset, int column_offset,
-                        ScriptOriginOptions resource_options,
-                        Handle<Context> context, LanguageMode language_mode);
+  MaybeHandle<SharedFunctionInfo> Lookup(Handle<String> source,
+                                         MaybeHandle<Object> name,
+                                         int line_offset, int column_offset,
+                                         ScriptOriginOptions resource_options,
+                                         Handle<Context> context,
+                                         LanguageMode language_mode);
 
   void Put(Handle<String> source, Handle<Context> context,
-           LanguageMode language_mode, Handle<SharedFunctionInfo> function_info,
-           Handle<Cell> literals);
+           LanguageMode language_mode,
+           Handle<SharedFunctionInfo> function_info);
 
  private:
   bool HasOrigin(Handle<SharedFunctionInfo> function_info,
@@ -114,14 +116,15 @@ class CompilationCacheEval: public CompilationSubCache {
   explicit CompilationCacheEval(Isolate* isolate)
       : CompilationSubCache(isolate, 1) {}
 
-  InfoVectorPair Lookup(Handle<String> source,
-                        Handle<SharedFunctionInfo> outer_info,
-                        Handle<Context> native_context,
-                        LanguageMode language_mode, int position);
+  InfoCellPair Lookup(Handle<String> source,
+                      Handle<SharedFunctionInfo> outer_info,
+                      Handle<Context> native_context,
+                      LanguageMode language_mode, int position);
 
   void Put(Handle<String> source, Handle<SharedFunctionInfo> outer_info,
            Handle<SharedFunctionInfo> function_info,
-           Handle<Context> native_context, Handle<Cell> literals, int position);
+           Handle<Context> native_context, Handle<FeedbackCell> feedback_cell,
+           int position);
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(CompilationCacheEval);
@@ -152,19 +155,18 @@ class CompilationCache {
   // Finds the script shared function info for a source
   // string. Returns an empty handle if the cache doesn't contain a
   // script for the given source string with the right origin.
-  InfoVectorPair LookupScript(Handle<String> source, MaybeHandle<Object> name,
-                              int line_offset, int column_offset,
-                              ScriptOriginOptions resource_options,
-                              Handle<Context> context,
-                              LanguageMode language_mode);
+  MaybeHandle<SharedFunctionInfo> LookupScript(
+      Handle<String> source, MaybeHandle<Object> name, int line_offset,
+      int column_offset, ScriptOriginOptions resource_options,
+      Handle<Context> context, LanguageMode language_mode);
 
   // Finds the shared function info for a source string for eval in a
   // given context.  Returns an empty handle if the cache doesn't
   // contain a script for the given source string.
-  InfoVectorPair LookupEval(Handle<String> source,
-                            Handle<SharedFunctionInfo> outer_info,
-                            Handle<Context> context, LanguageMode language_mode,
-                            int position);
+  InfoCellPair LookupEval(Handle<String> source,
+                          Handle<SharedFunctionInfo> outer_info,
+                          Handle<Context> context, LanguageMode language_mode,
+                          int position);
 
   // Returns the regexp data associated with the given regexp if it
   // is in cache, otherwise an empty handle.
@@ -175,15 +177,14 @@ class CompilationCache {
   // info. This may overwrite an existing mapping.
   void PutScript(Handle<String> source, Handle<Context> context,
                  LanguageMode language_mode,
-                 Handle<SharedFunctionInfo> function_info,
-                 Handle<Cell> literals);
+                 Handle<SharedFunctionInfo> function_info);
 
   // Associate the (source, context->closure()->shared(), kind) triple
   // with the shared function info. This may overwrite an existing mapping.
   void PutEval(Handle<String> source, Handle<SharedFunctionInfo> outer_info,
                Handle<Context> context,
-               Handle<SharedFunctionInfo> function_info, Handle<Cell> literals,
-               int position);
+               Handle<SharedFunctionInfo> function_info,
+               Handle<FeedbackCell> feedback_cell, int position);
 
   // Associate the (source, flags) pair to the given regexp data.
   // This may overwrite an existing mapping.
diff --git a/deps/v8/src/compilation-dependencies.h b/deps/v8/src/compilation-dependencies.h
index 990d536e385..fa26e67b1a0 100644
--- a/deps/v8/src/compilation-dependencies.h
+++ b/deps/v8/src/compilation-dependencies.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_DEPENDENCIES_H_
-#define V8_DEPENDENCIES_H_
+#ifndef V8_COMPILATION_DEPENDENCIES_H_
+#define V8_COMPILATION_DEPENDENCIES_H_
 
 #include "src/handles.h"
 #include "src/objects.h"
@@ -71,4 +71,4 @@ class CompilationDependencies {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_DEPENDENCIES_H_
+#endif  // V8_COMPILATION_DEPENDENCIES_H_
diff --git a/deps/v8/src/compilation-info.cc b/deps/v8/src/compilation-info.cc
index 27e6dbb9dab..0470fa92338 100644
--- a/deps/v8/src/compilation-info.cc
+++ b/deps/v8/src/compilation-info.cc
@@ -16,12 +16,9 @@
 namespace v8 {
 namespace internal {
 
-// TODO(mvstanton): the Code::OPTIMIZED_FUNCTION constant below is
-// bogus, it's just that I've eliminated Code::FUNCTION and there isn't
-// a "better" value to put in this place.
 CompilationInfo::CompilationInfo(Zone* zone, ParseInfo* parse_info,
                                  FunctionLiteral* literal)
-    : CompilationInfo({}, Code::OPTIMIZED_FUNCTION, BASE, zone) {
+    : CompilationInfo({}, AbstractCode::INTERPRETED_FUNCTION, zone) {
   // NOTE: The parse_info passed here represents the global information gathered
   // during parsing, but does not represent specific details of the actual
   // function literal being compiled for this CompilationInfo. As such,
@@ -39,14 +36,22 @@ CompilationInfo::CompilationInfo(Zone* zone, ParseInfo* parse_info,
 CompilationInfo::CompilationInfo(Zone* zone, Isolate* isolate,
                                  Handle<SharedFunctionInfo> shared,
                                  Handle<JSFunction> closure)
-    : CompilationInfo({}, Code::OPTIMIZED_FUNCTION, OPTIMIZE, zone) {
+    : CompilationInfo({}, AbstractCode::OPTIMIZED_FUNCTION, zone) {
   shared_info_ = shared;
   closure_ = closure;
   optimization_id_ = isolate->NextOptimizationId();
   dependencies_.reset(new CompilationDependencies(isolate, zone));
 
+  SetFlag(kCalledWithCodeStartRegister);
   if (FLAG_function_context_specialization) MarkAsFunctionContextSpecializing();
   if (FLAG_turbo_splitting) MarkAsSplittingEnabled();
+  if (!FLAG_turbo_disable_switch_jump_table) SetFlag(kSwitchJumpTableEnabled);
+  if (FLAG_untrusted_code_mitigations) MarkAsPoisoningRegisterArguments();
+
+  // TODO(yangguo): Disable this in case of debugging for crbug.com/826613
+  if (FLAG_analyze_environment_liveness) {
+    MarkAsAnalyzeEnvironmentLiveness();
+  }
 
   // Collect source positions for optimized code when profiling or if debugger
   // is active, to be able to get more precise source positions at the price of
@@ -58,24 +63,34 @@ CompilationInfo::CompilationInfo(Zone* zone, Isolate* isolate,
 
 CompilationInfo::CompilationInfo(Vector<const char> debug_name, Zone* zone,
                                  Code::Kind code_kind)
-    : CompilationInfo(debug_name, code_kind, STUB, zone) {}
+    : CompilationInfo(debug_name, static_cast<AbstractCode::Kind>(code_kind),
+                      zone) {
+  if (code_kind == Code::BYTECODE_HANDLER) {
+    SetFlag(CompilationInfo::kCalledWithCodeStartRegister);
+  }
+#if ENABLE_GDB_JIT_INTERFACE
+#if DEBUG
+  if (code_kind == Code::BUILTIN || code_kind == Code::STUB) {
+    MarkAsSourcePositionsEnabled();
+  }
+#endif
+#endif
+}
 
 CompilationInfo::CompilationInfo(Vector<const char> debug_name,
-                                 Code::Kind code_kind, Mode mode, Zone* zone)
+                                 AbstractCode::Kind code_kind, Zone* zone)
     : literal_(nullptr),
       source_range_map_(nullptr),
       flags_(FLAG_untrusted_code_mitigations ? kUntrustedCodeMitigations : 0),
       code_kind_(code_kind),
       stub_key_(0),
       builtin_index_(Builtins::kNoBuiltinId),
-      mode_(mode),
       osr_offset_(BailoutId::None()),
       feedback_vector_spec_(zone),
       zone_(zone),
       deferred_handles_(nullptr),
       dependencies_(nullptr),
       bailout_reason_(BailoutReason::kNoReason),
-      parameter_count_(0),
       optimization_id_(-1),
       debug_name_(debug_name) {}
 
@@ -94,15 +109,15 @@ DeclarationScope* CompilationInfo::scope() const {
 }
 
 int CompilationInfo::num_parameters() const {
-  return !IsStub() ? scope()->num_parameters() : parameter_count_;
+  DCHECK(!IsStub());
+  return scope()->num_parameters();
 }
 
 int CompilationInfo::num_parameters_including_this() const {
-  return num_parameters() + (is_this_defined() ? 1 : 0);
+  DCHECK(!IsStub());
+  return scope()->num_parameters() + 1;
 }
 
-bool CompilationInfo::is_this_defined() const { return !IsStub(); }
-
 void CompilationInfo::set_deferred_handles(
     std::shared_ptr<DeferredHandles> deferred_handles) {
   DCHECK_NULL(deferred_handles_);
diff --git a/deps/v8/src/compilation-info.h b/deps/v8/src/compilation-info.h
index bb5812002ee..1c078de9087 100644
--- a/deps/v8/src/compilation-info.h
+++ b/deps/v8/src/compilation-info.h
@@ -45,12 +45,18 @@ class V8_EXPORT_PRIVATE CompilationInfo final {
     kAccessorInliningEnabled = 1 << 3,
     kFunctionContextSpecializing = 1 << 4,
     kInliningEnabled = 1 << 5,
-    kDisableFutureOptimization = 1 << 6,
-    kSplittingEnabled = 1 << 7,
-    kSourcePositionsEnabled = 1 << 8,
-    kBailoutOnUninitialized = 1 << 9,
-    kLoopPeelingEnabled = 1 << 10,
-    kUntrustedCodeMitigations = 1 << 11,
+    kPoisonLoads = 1 << 6,
+    kDisableFutureOptimization = 1 << 7,
+    kSplittingEnabled = 1 << 8,
+    kSourcePositionsEnabled = 1 << 9,
+    kBailoutOnUninitialized = 1 << 10,
+    kLoopPeelingEnabled = 1 << 11,
+    kUntrustedCodeMitigations = 1 << 12,
+    kSwitchJumpTableEnabled = 1 << 13,
+    kCalledWithCodeStartRegister = 1 << 14,
+    kPoisonRegisterArguments = 1 << 15,
+    kAllocationFoldingEnabled = 1 << 16,
+    kAnalyzeEnvironmentLiveness = 1 << 17,
   };
 
   // TODO(mtrofin): investigate if this might be generalized outside wasm, with
@@ -60,9 +66,9 @@ class V8_EXPORT_PRIVATE CompilationInfo final {
   struct WasmCodeDesc {
     CodeDesc code_desc;
     size_t safepoint_table_offset = 0;
+    size_t handler_table_offset = 0;
     uint32_t frame_slot_count = 0;
     Handle<ByteArray> source_positions_table;
-    MaybeHandle<HandlerTable> handler_table;
   };
 
   // Construct a compilation info for unoptimized compilation.
@@ -99,7 +105,11 @@ class V8_EXPORT_PRIVATE CompilationInfo final {
   bool has_shared_info() const { return !shared_info().is_null(); }
   Handle<JSFunction> closure() const { return closure_; }
   Handle<Code> code() const { return code_; }
-  Code::Kind code_kind() const { return code_kind_; }
+  AbstractCode::Kind abstract_code_kind() const { return code_kind_; }
+  Code::Kind code_kind() const {
+    DCHECK(code_kind_ < static_cast<AbstractCode::Kind>(Code::NUMBER_OF_KINDS));
+    return static_cast<Code::Kind>(code_kind_);
+  }
   uint32_t stub_key() const { return stub_key_; }
   void set_stub_key(uint32_t stub_key) { stub_key_ = stub_key; }
   int32_t builtin_index() const { return builtin_index_; }
@@ -108,12 +118,6 @@ class V8_EXPORT_PRIVATE CompilationInfo final {
   JavaScriptFrame* osr_frame() const { return osr_frame_; }
   int num_parameters() const;
   int num_parameters_including_this() const;
-  bool is_this_defined() const;
-
-  void set_parameter_count(int parameter_count) {
-    DCHECK(IsStub());
-    parameter_count_ = parameter_count;
-  }
 
   bool has_bytecode_array() const { return !bytecode_array_.is_null(); }
   Handle<BytecodeArray> bytecode_array() const { return bytecode_array_; }
@@ -154,6 +158,9 @@ class V8_EXPORT_PRIVATE CompilationInfo final {
   void MarkAsInliningEnabled() { SetFlag(kInliningEnabled); }
   bool is_inlining_enabled() const { return GetFlag(kInliningEnabled); }
 
+  void MarkAsPoisonLoads() { SetFlag(kPoisonLoads); }
+  bool is_poison_loads() const { return GetFlag(kPoisonLoads); }
+
   void MarkAsSplittingEnabled() { SetFlag(kSplittingEnabled); }
   bool is_splitting_enabled() const { return GetFlag(kSplittingEnabled); }
 
@@ -169,6 +176,38 @@ class V8_EXPORT_PRIVATE CompilationInfo final {
     return GetFlag(kUntrustedCodeMitigations);
   }
 
+  bool switch_jump_table_enabled() const {
+    return GetFlag(kSwitchJumpTableEnabled);
+  }
+
+  bool called_with_code_start_register() const {
+    bool enabled = GetFlag(kCalledWithCodeStartRegister);
+    return enabled;
+  }
+
+  void MarkAsPoisoningRegisterArguments() {
+    DCHECK(has_untrusted_code_mitigations());
+    SetFlag(kPoisonRegisterArguments);
+  }
+  bool is_poisoning_register_arguments() const {
+    bool enabled = GetFlag(kPoisonRegisterArguments);
+    DCHECK_IMPLIES(enabled, has_untrusted_code_mitigations());
+    DCHECK_IMPLIES(enabled, called_with_code_start_register());
+    return enabled;
+  }
+
+  void MarkAsAllocationFoldingEnabled() { SetFlag(kAllocationFoldingEnabled); }
+  bool is_allocation_folding_enabled() const {
+    return GetFlag(kAllocationFoldingEnabled);
+  }
+
+  void MarkAsAnalyzeEnvironmentLiveness() {
+    SetFlag(kAnalyzeEnvironmentLiveness);
+  }
+  bool is_analyze_environment_liveness() const {
+    return GetFlag(kAnalyzeEnvironmentLiveness);
+  }
+
   // Code getters and setters.
 
   void SetCode(Handle<Code> code) { code_ = code; }
@@ -193,9 +232,17 @@ class V8_EXPORT_PRIVATE CompilationInfo final {
   JSGlobalObject* global_object() const;
 
   // Accessors for the different compilation modes.
-  bool IsOptimizing() const { return mode_ == OPTIMIZE; }
-  bool IsStub() const { return mode_ == STUB; }
-  bool IsWasm() const { return code_kind() == Code::WASM_FUNCTION; }
+  bool IsOptimizing() const {
+    return abstract_code_kind() == AbstractCode::OPTIMIZED_FUNCTION;
+  }
+  bool IsWasm() const {
+    return abstract_code_kind() == AbstractCode::WASM_FUNCTION;
+  }
+  bool IsStub() const {
+    return abstract_code_kind() != AbstractCode::OPTIMIZED_FUNCTION &&
+           abstract_code_kind() != AbstractCode::WASM_FUNCTION &&
+           abstract_code_kind() != AbstractCode::INTERPRETED_FUNCTION;
+  }
   void SetOptimizingForOsr(BailoutId osr_offset, JavaScriptFrame* osr_frame) {
     DCHECK(IsOptimizing());
     osr_offset_ = osr_offset;
@@ -275,15 +322,8 @@ class V8_EXPORT_PRIVATE CompilationInfo final {
   WasmCodeDesc* wasm_code_desc() { return &wasm_code_desc_; }
 
  private:
-  // Compilation mode.
-  // BASE is generated by the full codegen, optionally prepared for bailouts.
-  // OPTIMIZE is optimized code generated by the Hydrogen-based backend.
-  enum Mode { BASE, OPTIMIZE, STUB };
-
-  CompilationInfo(Vector<const char> debug_name, Code::Kind code_kind,
-                  Mode mode, Zone* zone);
-
-  void SetMode(Mode mode) { mode_ = mode; }
+  CompilationInfo(Vector<const char> debug_name, AbstractCode::Kind code_kind,
+                  Zone* zone);
 
   void SetFlag(Flag flag) { flags_ |= flag; }
 
@@ -298,7 +338,7 @@ class V8_EXPORT_PRIVATE CompilationInfo final {
 
   unsigned flags_;
 
-  Code::Kind code_kind_;
+  AbstractCode::Kind code_kind_;
   uint32_t stub_key_;
   int32_t builtin_index_;
 
@@ -310,8 +350,7 @@ class V8_EXPORT_PRIVATE CompilationInfo final {
   Handle<Code> code_;
   WasmCodeDesc wasm_code_desc_;
 
-  // Compilation mode flag and whether deoptimization is allowed.
-  Mode mode_;
+  // Entry point when compiling for OSR, {BailoutId::None} otherwise.
   BailoutId osr_offset_;
 
   // Holds the bytecode array generated by the interpreter.
@@ -338,9 +377,6 @@ class V8_EXPORT_PRIVATE CompilationInfo final {
 
   InlinedFunctionList inlined_functions_;
 
-  // Number of parameters used for compilation of stubs that require arguments.
-  int parameter_count_;
-
   int optimization_id_;
 
   // The current OSR frame for specialization or {nullptr}.
diff --git a/deps/v8/src/compilation-statistics.h b/deps/v8/src/compilation-statistics.h
index 388117b10ed..1f70336fcc3 100644
--- a/deps/v8/src/compilation-statistics.h
+++ b/deps/v8/src/compilation-statistics.h
@@ -90,4 +90,4 @@ std::ostream& operator<<(std::ostream& os, const AsPrintableStatistics& s);
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_COMPILATION_STATISTICS_H_
diff --git a/deps/v8/src/compiler-dispatcher/compiler-dispatcher.cc b/deps/v8/src/compiler-dispatcher/compiler-dispatcher.cc
index 1adfd090cd8..24817aea0e2 100644
--- a/deps/v8/src/compiler-dispatcher/compiler-dispatcher.cc
+++ b/deps/v8/src/compiler-dispatcher/compiler-dispatcher.cc
@@ -7,6 +7,7 @@
 #include "include/v8-platform.h"
 #include "include/v8.h"
 #include "src/base/platform/time.h"
+#include "src/base/template-utils.h"
 #include "src/cancelable-task.h"
 #include "src/compilation-info.h"
 #include "src/compiler-dispatcher/compiler-dispatcher-job.h"
@@ -92,7 +93,7 @@ MemoryPressureTask::MemoryPressureTask(Isolate* isolate,
 MemoryPressureTask::~MemoryPressureTask() {}
 
 void MemoryPressureTask::RunInternal() {
-  dispatcher_->AbortAll(CompilerDispatcher::BlockingBehavior::kDontBlock);
+  dispatcher_->AbortAll(BlockingBehavior::kDontBlock);
 }
 
 }  // namespace
@@ -123,11 +124,11 @@ void CompilerDispatcher::AbortTask::RunInternal() {
   dispatcher_->AbortInactiveJobs();
 }
 
-class CompilerDispatcher::BackgroundTask : public CancelableTask {
+class CompilerDispatcher::WorkerTask : public CancelableTask {
  public:
-  BackgroundTask(Isolate* isolate, CancelableTaskManager* task_manager,
-                 CompilerDispatcher* dispatcher);
-  ~BackgroundTask() override;
+  WorkerTask(Isolate* isolate, CancelableTaskManager* task_manager,
+             CompilerDispatcher* dispatcher);
+  ~WorkerTask() override;
 
   // CancelableTask implementation.
   void RunInternal() override;
@@ -135,17 +136,17 @@ class CompilerDispatcher::BackgroundTask : public CancelableTask {
  private:
   CompilerDispatcher* dispatcher_;
 
-  DISALLOW_COPY_AND_ASSIGN(BackgroundTask);
+  DISALLOW_COPY_AND_ASSIGN(WorkerTask);
 };
 
-CompilerDispatcher::BackgroundTask::BackgroundTask(
-    Isolate* isolate, CancelableTaskManager* task_manager,
-    CompilerDispatcher* dispatcher)
+CompilerDispatcher::WorkerTask::WorkerTask(Isolate* isolate,
+                                           CancelableTaskManager* task_manager,
+                                           CompilerDispatcher* dispatcher)
     : CancelableTask(task_manager), dispatcher_(dispatcher) {}
 
-CompilerDispatcher::BackgroundTask::~BackgroundTask() {}
+CompilerDispatcher::WorkerTask::~WorkerTask() {}
 
-void CompilerDispatcher::BackgroundTask::RunInternal() {
+void CompilerDispatcher::WorkerTask::RunInternal() {
   dispatcher_->DoBackgroundWork();
 }
 
@@ -188,7 +189,7 @@ CompilerDispatcher::CompilerDispatcher(Isolate* isolate, Platform* platform,
       memory_pressure_level_(MemoryPressureLevel::kNone),
       abort_(false),
       idle_task_scheduled_(false),
-      num_background_tasks_(0),
+      num_worker_tasks_(0),
       main_thread_blocking_on_job_(nullptr),
       block_for_testing_(false),
       semaphore_for_testing_(0) {
@@ -434,7 +435,7 @@ void CompilerDispatcher::AbortInactiveJobs() {
   }
   if (jobs_.empty()) {
     base::LockGuard<base::Mutex> lock(&mutex_);
-    if (num_background_tasks_ == 0) abort_ = false;
+    if (num_worker_tasks_ == 0) abort_ = false;
   }
 }
 
@@ -511,24 +512,22 @@ void CompilerDispatcher::ConsiderJobForBackgroundProcessing(
     base::LockGuard<base::Mutex> lock(&mutex_);
     pending_background_jobs_.insert(job);
   }
-  ScheduleMoreBackgroundTasksIfNeeded();
+  ScheduleMoreWorkerTasksIfNeeded();
 }
 
-void CompilerDispatcher::ScheduleMoreBackgroundTasksIfNeeded() {
+void CompilerDispatcher::ScheduleMoreWorkerTasksIfNeeded() {
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-               "V8.CompilerDispatcherScheduleMoreBackgroundTasksIfNeeded");
+               "V8.CompilerDispatcherScheduleMoreWorkerTasksIfNeeded");
   {
     base::LockGuard<base::Mutex> lock(&mutex_);
     if (pending_background_jobs_.empty()) return;
-    if (platform_->NumberOfAvailableBackgroundThreads() <=
-        num_background_tasks_) {
+    if (platform_->NumberOfWorkerThreads() <= num_worker_tasks_) {
       return;
     }
-    ++num_background_tasks_;
+    ++num_worker_tasks_;
   }
-  platform_->CallOnBackgroundThread(
-      new BackgroundTask(isolate_, task_manager_.get(), this),
-      v8::Platform::kShortRunningTask);
+  platform_->CallOnWorkerThread(
+      base::make_unique<WorkerTask>(isolate_, task_manager_.get(), this));
 }
 
 void CompilerDispatcher::DoBackgroundWork() {
@@ -572,7 +571,7 @@ void CompilerDispatcher::DoBackgroundWork() {
 
   {
     base::LockGuard<base::Mutex> lock(&mutex_);
-    --num_background_tasks_;
+    --num_worker_tasks_;
 
     if (running_background_jobs_.empty() && abort_) {
       // This is the last background job that finished. The abort task
@@ -720,7 +719,7 @@ CompilerDispatcher::JobMap::const_iterator CompilerDispatcher::RemoveJob(
   it = jobs_.erase(it);
   if (jobs_.empty()) {
     base::LockGuard<base::Mutex> lock(&mutex_);
-    if (num_background_tasks_ == 0) abort_ = false;
+    if (num_worker_tasks_ == 0) abort_ = false;
   }
   return it;
 }
diff --git a/deps/v8/src/compiler-dispatcher/compiler-dispatcher.h b/deps/v8/src/compiler-dispatcher/compiler-dispatcher.h
index ee20e8d02eb..d7b2dc802ff 100644
--- a/deps/v8/src/compiler-dispatcher/compiler-dispatcher.h
+++ b/deps/v8/src/compiler-dispatcher/compiler-dispatcher.h
@@ -72,8 +72,6 @@ class V8_EXPORT_PRIVATE CompilerDispatcher {
  public:
   typedef uintptr_t JobId;
 
-  enum class BlockingBehavior { kBlock, kDontBlock };
-
   CompilerDispatcher(Isolate* isolate, Platform* platform,
                      size_t max_stack_size);
   ~CompilerDispatcher();
@@ -119,16 +117,16 @@ class V8_EXPORT_PRIVATE CompilerDispatcher {
   FRIEND_TEST(CompilerDispatcherTest, EnqueueAndStepParsed);
   FRIEND_TEST(CompilerDispatcherTest, IdleTaskSmallIdleTime);
   FRIEND_TEST(CompilerDispatcherTest, CompileOnBackgroundThread);
-  FRIEND_TEST(CompilerDispatcherTest, FinishNowWithBackgroundTask);
-  FRIEND_TEST(CompilerDispatcherTest, AsyncAbortAllPendingBackgroundTask);
-  FRIEND_TEST(CompilerDispatcherTest, AsyncAbortAllRunningBackgroundTask);
+  FRIEND_TEST(CompilerDispatcherTest, FinishNowWithWorkerTask);
+  FRIEND_TEST(CompilerDispatcherTest, AsyncAbortAllPendingWorkerTask);
+  FRIEND_TEST(CompilerDispatcherTest, AsyncAbortAllRunningWorkerTask);
   FRIEND_TEST(CompilerDispatcherTest, FinishNowDuringAbortAll);
   FRIEND_TEST(CompilerDispatcherTest, CompileMultipleOnBackgroundThread);
 
   typedef std::map<JobId, std::unique_ptr<CompilerDispatcherJob>> JobMap;
   typedef IdentityMap<JobId, FreeStoreAllocationPolicy> SharedToJobIdMap;
   class AbortTask;
-  class BackgroundTask;
+  class WorkerTask;
   class IdleTask;
 
   void WaitForJobIfRunningOnBackground(CompilerDispatcherJob* job);
@@ -137,7 +135,7 @@ class V8_EXPORT_PRIVATE CompilerDispatcher {
   bool CanEnqueue(Handle<SharedFunctionInfo> function);
   JobMap::const_iterator GetJobFor(Handle<SharedFunctionInfo> shared) const;
   void ConsiderJobForBackgroundProcessing(CompilerDispatcherJob* job);
-  void ScheduleMoreBackgroundTasksIfNeeded();
+  void ScheduleMoreWorkerTasksIfNeeded();
   void ScheduleIdleTaskFromAnyThread();
   void ScheduleIdleTaskIfNeeded();
   void ScheduleAbortTask();
@@ -185,8 +183,8 @@ class V8_EXPORT_PRIVATE CompilerDispatcher {
 
   bool idle_task_scheduled_;
 
-  // Number of scheduled or running BackgroundTask objects.
-  size_t num_background_tasks_;
+  // Number of scheduled or running WorkerTask objects.
+  int num_worker_tasks_;
 
   // The set of CompilerDispatcherJobs that can be advanced on any thread.
   std::unordered_set<CompilerDispatcherJob*> pending_background_jobs_;
diff --git a/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc b/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc
index 59872b2535b..36b063ff554 100644
--- a/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc
+++ b/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc
@@ -5,6 +5,7 @@
 #include "src/compiler-dispatcher/optimizing-compile-dispatcher.h"
 
 #include "src/base/atomicops.h"
+#include "src/base/template-utils.h"
 #include "src/cancelable-task.h"
 #include "src/compilation-info.h"
 #include "src/compiler.h"
@@ -21,14 +22,14 @@ namespace {
 void DisposeCompilationJob(CompilationJob* job, bool restore_function_code) {
   if (restore_function_code) {
     Handle<JSFunction> function = job->compilation_info()->closure();
-    function->set_code(function->shared()->code());
+    function->set_code(function->shared()->GetCode());
     if (function->IsInOptimizationQueue()) {
       function->ClearOptimizationMarker();
     }
-    // TODO(mvstanton): We can't call EnsureLiterals here due to allocation,
-    // but we probably shouldn't call set_code either, as this
+    // TODO(mvstanton): We can't call EnsureFeedbackVector here due to
+    // allocation, but we probably shouldn't call set_code either, as this
     // sometimes runs on the worker thread!
-    // JSFunction::EnsureLiterals(function);
+    // JSFunction::EnsureFeedbackVector(function);
   }
   delete job;
 }
@@ -224,15 +225,15 @@ void OptimizingCompileDispatcher::QueueForOptimization(CompilationJob* job) {
   if (FLAG_block_concurrent_recompilation) {
     blocked_jobs_++;
   } else {
-    V8::GetCurrentPlatform()->CallOnBackgroundThread(
-        new CompileTask(isolate_, this), v8::Platform::kShortRunningTask);
+    V8::GetCurrentPlatform()->CallOnWorkerThread(
+        base::make_unique<CompileTask>(isolate_, this));
   }
 }
 
 void OptimizingCompileDispatcher::Unblock() {
   while (blocked_jobs_ > 0) {
-    V8::GetCurrentPlatform()->CallOnBackgroundThread(
-        new CompileTask(isolate_, this), v8::Platform::kShortRunningTask);
+    V8::GetCurrentPlatform()->CallOnWorkerThread(
+        base::make_unique<CompileTask>(isolate_, this));
     blocked_jobs_--;
   }
 }
diff --git a/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.h b/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.h
index d1d295f0630..551b7c35634 100644
--- a/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.h
+++ b/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.h
@@ -23,8 +23,6 @@ class SharedFunctionInfo;
 
 class V8_EXPORT_PRIVATE OptimizingCompileDispatcher {
  public:
-  enum class BlockingBehavior { kBlock, kDontBlock };
-
   explicit OptimizingCompileDispatcher(Isolate* isolate)
       : isolate_(isolate),
         input_queue_capacity_(FLAG_concurrent_recompilation_queue_length),
diff --git a/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.cc b/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.cc
index 74b2352bd83..bb27676c08a 100644
--- a/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.cc
+++ b/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.cc
@@ -127,7 +127,7 @@ void UnoptimizedCompileJob::PrepareOnMainThread(Isolate* isolate) {
   parse_info_->InitFromIsolate(isolate);
   if (source->IsExternalTwoByteString() || source->IsExternalOneByteString()) {
     std::unique_ptr<Utf16CharacterStream> stream(ScannerStream::For(
-        source, shared_->start_position(), shared_->end_position()));
+        source, shared_->StartPosition(), shared_->EndPosition()));
     parse_info_->set_character_stream(std::move(stream));
   } else {
     source = String::Flatten(source);
@@ -151,8 +151,8 @@ void UnoptimizedCompileJob::PrepareOnMainThread(Isolate* isolate) {
     } else {
       // Otherwise, create a copy of the part of the string we'll parse in the
       // zone.
-      length = (shared_->end_position() - shared_->start_position());
-      offset = shared_->start_position();
+      length = (shared_->EndPosition() - shared_->StartPosition());
+      offset = shared_->StartPosition();
 
       int byte_len = length * (source->IsOneByteRepresentation() ? 1 : 2);
       data = parse_info_->zone()->New(byte_len);
@@ -162,12 +162,11 @@ void UnoptimizedCompileJob::PrepareOnMainThread(Isolate* isolate) {
       DCHECK(content.IsFlat());
       if (content.IsOneByte()) {
         MemCopy(const_cast<void*>(data),
-                &content.ToOneByteVector().at(shared_->start_position()),
+                &content.ToOneByteVector().at(shared_->StartPosition()),
                 byte_len);
       } else {
         MemCopy(const_cast<void*>(data),
-                &content.ToUC16Vector().at(shared_->start_position()),
-                byte_len);
+                &content.ToUC16Vector().at(shared_->StartPosition()), byte_len);
       }
     }
     Handle<String> wrapper;
@@ -188,15 +187,15 @@ void UnoptimizedCompileJob::PrepareOnMainThread(Isolate* isolate) {
     }
     wrapper_ = isolate->global_handles()->Create(*wrapper);
     std::unique_ptr<Utf16CharacterStream> stream(
-        ScannerStream::For(wrapper_, shared_->start_position() - offset,
-                           shared_->end_position() - offset));
+        ScannerStream::For(wrapper_, shared_->StartPosition() - offset,
+                           shared_->EndPosition() - offset));
     parse_info_->set_character_stream(std::move(stream));
   }
   parse_info_->set_hash_seed(isolate->heap()->HashSeed());
   parse_info_->set_is_named_expression(shared_->is_named_expression());
-  parse_info_->set_compiler_hints(shared_->compiler_hints());
-  parse_info_->set_start_position(shared_->start_position());
-  parse_info_->set_end_position(shared_->end_position());
+  parse_info_->set_function_flags(shared_->flags());
+  parse_info_->set_start_position(shared_->StartPosition());
+  parse_info_->set_end_position(shared_->EndPosition());
   parse_info_->set_unicode_cache(unicode_cache_.get());
   parse_info_->set_language_mode(shared_->language_mode());
   parse_info_->set_function_literal_id(shared_->function_literal_id());
@@ -213,7 +212,7 @@ void UnoptimizedCompileJob::PrepareOnMainThread(Isolate* isolate) {
   }
   parser_->DeserializeScopeChain(parse_info_.get(), outer_scope_info);
 
-  Handle<String> name(shared_->name());
+  Handle<String> name(shared_->Name());
   parse_info_->set_function_name(
       parse_info_->ast_value_factory()->GetString(name));
   set_status(Status::kPrepared);
@@ -251,7 +250,7 @@ void UnoptimizedCompileJob::Compile(bool on_background_thread) {
   }
 
   compilation_job_.reset(interpreter::Interpreter::NewCompilationJob(
-      parse_info_.get(), parse_info_->literal(), allocator_));
+      parse_info_.get(), parse_info_->literal(), allocator_, nullptr));
 
   if (!compilation_job_.get()) {
     parse_info_->pending_error_handler()->set_stack_overflow();
diff --git a/deps/v8/src/compiler.cc b/deps/v8/src/compiler.cc
index e2f8ee0f394..b31d0b0f293 100644
--- a/deps/v8/src/compiler.cc
+++ b/deps/v8/src/compiler.cc
@@ -10,7 +10,6 @@
 #include "src/api.h"
 #include "src/asmjs/asm-js.h"
 #include "src/assembler-inl.h"
-#include "src/ast/ast-numbering.h"
 #include "src/ast/prettyprinter.h"
 #include "src/ast/scopes.h"
 #include "src/base/optional.h"
@@ -31,11 +30,13 @@
 #include "src/messages.h"
 #include "src/objects/map.h"
 #include "src/parsing/parse-info.h"
+#include "src/parsing/parser.h"
 #include "src/parsing/parsing.h"
 #include "src/parsing/rewriter.h"
 #include "src/parsing/scanner-character-streams.h"
 #include "src/runtime-profiler.h"
 #include "src/snapshot/code-serializer.h"
+#include "src/unicode-cache.h"
 #include "src/vm-state-inl.h"
 
 namespace v8 {
@@ -142,7 +143,8 @@ void CompilationJob::RecordUnoptimizedCompilationStats(Isolate* isolate) const {
   if (compilation_info()->has_bytecode_array()) {
     code_size = compilation_info()->bytecode_array()->SizeIncludingMetadata();
   } else {
-    code_size = compilation_info()->code()->SizeIncludingMetadata();
+    DCHECK(compilation_info()->has_asm_wasm_data());
+    code_size = compilation_info()->asm_wasm_data()->Size();
   }
 
   Counters* counters = isolate->counters();
@@ -191,18 +193,24 @@ void CompilationJob::RecordFunctionCompilation(
 
   Handle<SharedFunctionInfo> shared = compilation_info->shared_info();
   Handle<Script> script = parse_info()->script();
-  Handle<AbstractCode> abstract_code =
-      compilation_info->has_bytecode_array()
-          ? Handle<AbstractCode>::cast(compilation_info->bytecode_array())
-          : Handle<AbstractCode>::cast(compilation_info->code());
+  Handle<AbstractCode> abstract_code;
+  if (compilation_info->has_bytecode_array()) {
+    abstract_code =
+        Handle<AbstractCode>::cast(compilation_info->bytecode_array());
+  } else if (compilation_info->has_asm_wasm_data()) {
+    abstract_code =
+        Handle<AbstractCode>::cast(BUILTIN_CODE(isolate, InstantiateAsmJs));
+  } else {
+    DCHECK(!compilation_info->code().is_null());
+    abstract_code = Handle<AbstractCode>::cast(compilation_info->code());
+  }
 
   if (abstract_code.is_identical_to(BUILTIN_CODE(isolate, CompileLazy))) {
     return;
   }
 
-  int line_num = Script::GetLineNumber(script, shared->start_position()) + 1;
-  int column_num =
-      Script::GetColumnNumber(script, shared->start_position()) + 1;
+  int line_num = Script::GetLineNumber(script, shared->StartPosition()) + 1;
+  int column_num = Script::GetColumnNumber(script, shared->StartPosition()) + 1;
   String* script_name = script->name()->IsString()
                             ? String::cast(script->name())
                             : isolate->heap()->empty_string();
@@ -235,7 +243,7 @@ void CompilationJob::RecordFunctionCompilation(
   }
 
   LOG(isolate, FunctionEvent(name.c_str(), nullptr, script->id(), ms,
-                             shared->start_position(), shared->end_position(),
+                             shared->StartPosition(), shared->EndPosition(),
                              shared->DebugName()));
 }
 
@@ -253,8 +261,7 @@ void EnsureFeedbackMetadata(CompilationInfo* compilation_info,
   // vectors for a different configuration, hence we also recreate a new vector
   // when the function is not compiled (i.e. no code was serialized).
 
-  // TODO(mvstanton): reintroduce is_empty() predicate to feedback_metadata().
-  if (compilation_info->shared_info()->feedback_metadata()->length() == 0 ||
+  if (compilation_info->shared_info()->feedback_metadata()->is_empty() ||
       !compilation_info->shared_info()->is_compiled()) {
     Handle<FeedbackMetadata> feedback_metadata = FeedbackMetadata::New(
         isolate, compilation_info->feedback_vector_spec());
@@ -295,17 +302,16 @@ void InstallUnoptimizedCode(CompilationInfo* compilation_info,
   Handle<ScopeInfo> scope_info = compilation_info->scope()->scope_info();
   shared->set_scope_info(*scope_info);
   Scope* outer_scope = compilation_info->scope()->GetOuterScopeWithContext();
-  if (outer_scope) {
-    shared->set_outer_scope_info(*outer_scope->scope_info());
-  }
+  if (outer_scope) shared->set_outer_scope_info(*outer_scope->scope_info());
 
-  DCHECK(!compilation_info->code().is_null());
-  shared->set_code(*compilation_info->code());
+  // We shouldn't have a code object, just bytecode or asm-wasm data.
+  DCHECK(compilation_info->code().is_null());
   if (compilation_info->has_bytecode_array()) {
     DCHECK(!shared->HasBytecodeArray());  // Only compiled once.
     DCHECK(!compilation_info->has_asm_wasm_data());
     shared->set_bytecode_array(*compilation_info->bytecode_array());
-  } else if (compilation_info->has_asm_wasm_data()) {
+  } else {
+    DCHECK(compilation_info->has_asm_wasm_data());
     shared->set_asm_wasm_data(*compilation_info->asm_wasm_data());
   }
 
@@ -326,7 +332,7 @@ void EnsureSharedFunctionInfosArrayOnScript(ParseInfo* parse_info,
               parse_info->max_function_literal_id() + 1);
     return;
   }
-  Handle<FixedArray> infos(isolate->factory()->NewFixedArray(
+  Handle<WeakFixedArray> infos(isolate->factory()->NewWeakFixedArray(
       parse_info->max_function_literal_id() + 1));
   parse_info->script()->set_shared_function_infos(*infos);
 }
@@ -370,20 +376,9 @@ CompilationJob::Status FinalizeUnoptimizedCompilationJob(CompilationJob* job,
   return status;
 }
 
-bool Renumber(ParseInfo* parse_info,
-              Compiler::EagerInnerFunctionLiterals* eager_literals) {
-  RuntimeCallTimerScope runtimeTimer(
-      parse_info->runtime_call_stats(),
-      parse_info->on_background_thread()
-          ? RuntimeCallCounterId::kCompileBackgroundRenumber
-          : RuntimeCallCounterId::kCompileRenumber);
-  return AstNumbering::Renumber(parse_info->stack_limit(), parse_info->zone(),
-                                parse_info->literal(), eager_literals);
-}
-
-std::unique_ptr<CompilationJob> PrepareAndExecuteUnoptimizedCompileJob(
+std::unique_ptr<CompilationJob> PrepareAndExecuteUnoptimizedCompileJobs(
     ParseInfo* parse_info, FunctionLiteral* literal,
-    AccountingAllocator* allocator) {
+    AccountingAllocator* allocator, CompilationJobList* inner_function_jobs) {
   if (UseAsmWasm(literal, parse_info->is_asm_wasm_broken())) {
     std::unique_ptr<CompilationJob> asm_job(
         AsmJs::NewCompilationJob(parse_info, literal, allocator));
@@ -396,14 +391,27 @@ std::unique_ptr<CompilationJob> PrepareAndExecuteUnoptimizedCompileJob(
     // with a validation error or another error that could be solve by falling
     // through to standard unoptimized compile.
   }
+  ZoneVector<FunctionLiteral*> eager_inner_literals(0, parse_info->zone());
   std::unique_ptr<CompilationJob> job(
-      interpreter::Interpreter::NewCompilationJob(parse_info, literal,
-                                                  allocator));
+      interpreter::Interpreter::NewCompilationJob(
+          parse_info, literal, allocator, &eager_inner_literals));
 
-  if (job->ExecuteJob() == CompilationJob::SUCCEEDED) {
-    return job;
+  if (job->ExecuteJob() != CompilationJob::SUCCEEDED) {
+    // Compilation failed, return null.
+    return std::unique_ptr<CompilationJob>();
   }
-  return std::unique_ptr<CompilationJob>();  // Compilation failed, return null.
+
+  // Recursively compile eager inner literals.
+  for (FunctionLiteral* inner_literal : eager_inner_literals) {
+    std::unique_ptr<CompilationJob> inner_job(
+        PrepareAndExecuteUnoptimizedCompileJobs(
+            parse_info, inner_literal, allocator, inner_function_jobs));
+    // Compilation failed, return null.
+    if (!inner_job) return std::unique_ptr<CompilationJob>();
+    inner_function_jobs->emplace_front(std::move(inner_job));
+  }
+
+  return job;
 }
 
 std::unique_ptr<CompilationJob> GenerateUnoptimizedCode(
@@ -414,27 +422,16 @@ std::unique_ptr<CompilationJob> GenerateUnoptimizedCode(
   DisallowHandleDereference no_deref;
   DCHECK(inner_function_jobs->empty());
 
-  Compiler::EagerInnerFunctionLiterals inner_literals;
-  if (!Compiler::Analyze(parse_info, &inner_literals)) {
+  if (!Compiler::Analyze(parse_info)) {
     return std::unique_ptr<CompilationJob>();
   }
 
   // Prepare and execute compilation of the outer-most function.
   std::unique_ptr<CompilationJob> outer_function_job(
-      PrepareAndExecuteUnoptimizedCompileJob(parse_info, parse_info->literal(),
-                                             allocator));
+      PrepareAndExecuteUnoptimizedCompileJobs(parse_info, parse_info->literal(),
+                                              allocator, inner_function_jobs));
   if (!outer_function_job) return std::unique_ptr<CompilationJob>();
 
-  // Prepare and execute compilation jobs for eager inner functions.
-  for (auto it : inner_literals) {
-    FunctionLiteral* inner_literal = it->value();
-    std::unique_ptr<CompilationJob> inner_job(
-        PrepareAndExecuteUnoptimizedCompileJob(parse_info, inner_literal,
-                                               allocator));
-    if (!inner_job) return std::unique_ptr<CompilationJob>();
-    inner_function_jobs->emplace_front(std::move(inner_job));
-  }
-
   // Character stream shouldn't be used again.
   parse_info->ResetCharacterStream();
 
@@ -491,7 +488,7 @@ MUST_USE_RESULT MaybeHandle<Code> GetCodeFromOptimizedCodeCache(
   Handle<SharedFunctionInfo> shared(function->shared());
   DisallowHeapAllocation no_gc;
   if (osr_offset.IsNone()) {
-    if (function->feedback_vector_cell()->value()->IsFeedbackVector()) {
+    if (function->feedback_cell()->value()->IsFeedbackVector()) {
       FeedbackVector* feedback_vector = function->feedback_vector();
       feedback_vector->EvictOptimizedCodeMarkedForDeoptimization(
           function->shared(), "GetCodeFromOptimizedCodeCache");
@@ -619,6 +616,11 @@ MaybeHandle<Code> GetOptimizedCode(Handle<JSFunction> function,
     function->ClearOptimizationMarker();
   }
 
+  if (isolate->debug()->needs_check_on_function_call()) {
+    // Do not optimize when debugger needs to hook into every call.
+    return MaybeHandle<Code>();
+  }
+
   Handle<Code> cached_code;
   if (GetCodeFromOptimizedCodeCache(function, osr_offset)
           .ToHandle(&cached_code)) {
@@ -699,11 +701,10 @@ MaybeHandle<Code> GetOptimizedCode(Handle<JSFunction> function,
 
       // Set the optimization marker and return a code object which checks it.
       function->SetOptimizationMarker(OptimizationMarker::kInOptimizationQueue);
-      if (function->IsInterpreted()) {
-        return BUILTIN_CODE(isolate, InterpreterEntryTrampoline);
-      } else {
-        return BUILTIN_CODE(isolate, CheckOptimizationMarker);
-      }
+      DCHECK(function->IsInterpreted() ||
+             (!function->is_compiled() && function->shared()->IsInterpreted()));
+      DCHECK(function->shared()->HasBytecodeArray());
+      return BUILTIN_CODE(isolate, InterpreterEntryTrampoline);
     }
   } else {
     if (GetOptimizedCodeNow(job.get(), isolate))
@@ -763,7 +764,7 @@ CompilationJob::Status FinalizeOptimizedCompilationJob(CompilationJob* job,
     PrintF(" because: %s]\n",
            GetBailoutReason(compilation_info->bailout_reason()));
   }
-  compilation_info->closure()->set_code(shared->code());
+  compilation_info->closure()->set_code(shared->GetCode());
   // Clear the InOptimizationQueue marker, if it exists.
   if (compilation_info->closure()->IsInOptimizationQueue()) {
     compilation_info->closure()->ClearOptimizationMarker();
@@ -771,6 +772,21 @@ CompilationJob::Status FinalizeOptimizedCompilationJob(CompilationJob* job,
   return CompilationJob::FAILED;
 }
 
+bool FailWithPendingException(Isolate* isolate, ParseInfo* parse_info,
+                              Compiler::ClearExceptionFlag flag) {
+  if (flag == Compiler::CLEAR_EXCEPTION) {
+    isolate->clear_pending_exception();
+  } else if (!isolate->has_pending_exception()) {
+    if (parse_info->pending_error_handler()->has_pending_error()) {
+      parse_info->pending_error_handler()->ReportErrors(
+          isolate, parse_info->script(), parse_info->ast_value_factory());
+    } else {
+      isolate->StackOverflow();
+    }
+  }
+  return false;
+}
+
 MaybeHandle<SharedFunctionInfo> FinalizeTopLevel(
     ParseInfo* parse_info, Isolate* isolate, CompilationJob* outer_function_job,
     CompilationJobList* inner_function_jobs) {
@@ -792,7 +808,8 @@ MaybeHandle<SharedFunctionInfo> FinalizeTopLevel(
   // Finalize compilation of the unoptimized bytecode or asm-js data.
   if (!FinalizeUnoptimizedCode(parse_info, isolate, shared_info,
                                outer_function_job, inner_function_jobs)) {
-    if (!isolate->has_pending_exception()) isolate->StackOverflow();
+    FailWithPendingException(isolate, parse_info,
+                             Compiler::ClearExceptionFlag::KEEP_EXCEPTION);
     return MaybeHandle<SharedFunctionInfo>();
   }
 
@@ -834,7 +851,8 @@ MaybeHandle<SharedFunctionInfo> CompileToplevel(ParseInfo* parse_info,
   std::unique_ptr<CompilationJob> outer_function_job(GenerateUnoptimizedCode(
       parse_info, isolate->allocator(), &inner_function_jobs));
   if (!outer_function_job) {
-    if (!isolate->has_pending_exception()) isolate->StackOverflow();
+    FailWithPendingException(isolate, parse_info,
+                             Compiler::ClearExceptionFlag::KEEP_EXCEPTION);
     return MaybeHandle<SharedFunctionInfo>();
   }
 
@@ -842,14 +860,113 @@ MaybeHandle<SharedFunctionInfo> CompileToplevel(ParseInfo* parse_info,
                           &inner_function_jobs);
 }
 
-bool FailWithPendingException(Isolate* isolate,
-                              Compiler::ClearExceptionFlag flag) {
-  if (flag == Compiler::CLEAR_EXCEPTION) {
-    isolate->clear_pending_exception();
-  } else if (!isolate->has_pending_exception()) {
-    isolate->StackOverflow();
+std::unique_ptr<CompilationJob> CompileTopLevelOnBackgroundThread(
+    ParseInfo* parse_info, AccountingAllocator* allocator,
+    CompilationJobList* inner_function_jobs) {
+  DisallowHeapAllocation no_allocation;
+  DisallowHandleAllocation no_handles;
+  DisallowHandleDereference no_deref;
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
+               "V8.CompileCodeBackground");
+  RuntimeCallTimerScope runtimeTimer(
+      parse_info->runtime_call_stats(),
+      parse_info->is_eval() ? RuntimeCallCounterId::kCompileBackgroundEval
+                            : RuntimeCallCounterId::kCompileBackgroundScript);
+
+  LanguageMode language_mode = construct_language_mode(FLAG_use_strict);
+  parse_info->set_language_mode(
+      stricter_language_mode(parse_info->language_mode(), language_mode));
+
+  // Can't access scope info data off-main-thread.
+  DCHECK(!parse_info->consumed_preparsed_scope_data()->HasData());
+
+  // Generate the unoptimized bytecode or asm-js data.
+  std::unique_ptr<CompilationJob> outer_function_job(
+      GenerateUnoptimizedCode(parse_info, allocator, inner_function_jobs));
+  return outer_function_job;
+}
+
+class BackgroundCompileTask : public ScriptCompiler::ScriptStreamingTask {
+ public:
+  BackgroundCompileTask(ScriptStreamingData* source, Isolate* isolate);
+
+  virtual void Run();
+
+ private:
+  ScriptStreamingData* source_;  // Not owned.
+  int stack_size_;
+  AccountingAllocator* allocator_;
+  TimedHistogram* timer_;
+
+  DISALLOW_COPY_AND_ASSIGN(BackgroundCompileTask);
+};
+
+BackgroundCompileTask::BackgroundCompileTask(ScriptStreamingData* source,
+                                             Isolate* isolate)
+    : source_(source),
+      stack_size_(i::FLAG_stack_size),
+      timer_(isolate->counters()->compile_script_on_background()) {
+  VMState<PARSER> state(isolate);
+
+  // Prepare the data for the internalization phase and compilation phase, which
+  // will happen in the main thread after parsing.
+  ParseInfo* info = new ParseInfo(isolate->allocator());
+  info->InitFromIsolate(isolate);
+  if (V8_UNLIKELY(FLAG_runtime_stats)) {
+    info->set_runtime_call_stats(new (info->zone()) RuntimeCallStats());
+  } else {
+    info->set_runtime_call_stats(nullptr);
+  }
+  info->set_toplevel();
+  std::unique_ptr<Utf16CharacterStream> stream(
+      ScannerStream::For(source->source_stream.get(), source->encoding,
+                         info->runtime_call_stats()));
+  info->set_character_stream(std::move(stream));
+  info->set_unicode_cache(&source_->unicode_cache);
+  info->set_allow_lazy_parsing();
+  if (V8_UNLIKELY(info->block_coverage_enabled())) {
+    info->AllocateSourceRangeMap();
   }
-  return false;
+  LanguageMode language_mode = construct_language_mode(FLAG_use_strict);
+  info->set_language_mode(
+      stricter_language_mode(info->language_mode(), language_mode));
+
+  source->info.reset(info);
+  allocator_ = isolate->allocator();
+
+  // Parser needs to stay alive for finalizing the parsing on the main
+  // thread.
+  source_->parser.reset(new Parser(source_->info.get()));
+  source_->parser->DeserializeScopeChain(source_->info.get(),
+                                         MaybeHandle<ScopeInfo>());
+}
+
+void BackgroundCompileTask::Run() {
+  TimedHistogramScope timer(timer_);
+  DisallowHeapAllocation no_allocation;
+  DisallowHandleAllocation no_handles;
+  DisallowHandleDereference no_deref;
+
+  source_->info->set_on_background_thread(true);
+
+  // Reset the stack limit of the parser to reflect correctly that we're on a
+  // background thread.
+  uintptr_t old_stack_limit = source_->info->stack_limit();
+  uintptr_t stack_limit = GetCurrentStackPosition() - stack_size_ * KB;
+  source_->info->set_stack_limit(stack_limit);
+  source_->parser->set_stack_limit(stack_limit);
+
+  source_->parser->ParseOnBackground(source_->info.get());
+  if (source_->info->literal() != nullptr) {
+    // Parsing has succeeded, compile.
+    source_->outer_function_job = CompileTopLevelOnBackgroundThread(
+        source_->info.get(), allocator_, &source_->inner_function_jobs);
+  }
+
+  source_->info->EmitBackgroundParseStatisticsOnBackgroundThread();
+
+  source_->info->set_on_background_thread(false);
+  source_->info->set_stack_limit(old_stack_limit);
 }
 
 }  // namespace
@@ -857,8 +974,7 @@ bool FailWithPendingException(Isolate* isolate,
 // ----------------------------------------------------------------------------
 // Implementation of Compiler
 
-bool Compiler::Analyze(ParseInfo* parse_info,
-                       EagerInnerFunctionLiterals* eager_literals) {
+bool Compiler::Analyze(ParseInfo* parse_info) {
   DCHECK_NOT_NULL(parse_info->literal());
   RuntimeCallTimerScope runtimeTimer(
       parse_info->runtime_call_stats(),
@@ -866,8 +982,7 @@ bool Compiler::Analyze(ParseInfo* parse_info,
           ? RuntimeCallCounterId::kCompileBackgroundAnalyse
           : RuntimeCallCounterId::kCompileAnalyse);
   if (!Rewriter::Rewrite(parse_info)) return false;
-  DeclarationScope::Analyze(parse_info);
-  if (!Renumber(parse_info, eager_literals)) return false;
+  if (!DeclarationScope::Analyze(parse_info)) return false;
   return true;
 }
 
@@ -886,6 +1001,7 @@ bool Compiler::Compile(Handle<SharedFunctionInfo> shared_info,
   DCHECK(!shared_info->is_compiled());
 
   Isolate* isolate = shared_info->GetIsolate();
+  DCHECK(AllowCompilation::IsAllowed(isolate));
   DCHECK(ThreadId::Current().Equals(isolate->thread_id()));
   DCHECK(!isolate->has_pending_exception());
   DCHECK(!shared_info->HasBytecodeArray());
@@ -897,18 +1013,19 @@ bool Compiler::Compile(Handle<SharedFunctionInfo> shared_info,
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"), "V8.CompileCode");
   AggregatedHistogramTimerScope timer(isolate->counters()->compile_lazy());
 
+  // Set up parse info.
+  ParseInfo parse_info(shared_info);
+  parse_info.set_lazy_compile();
+
   // Check if the compiler dispatcher has shared_info enqueued for compile.
   CompilerDispatcher* dispatcher = isolate->compiler_dispatcher();
   if (dispatcher->IsEnqueued(shared_info)) {
     if (!dispatcher->FinishNow(shared_info)) {
-      return FailWithPendingException(isolate, flag);
+      return FailWithPendingException(isolate, &parse_info, flag);
     }
     return true;
   }
 
-  // Set up parse info.
-  ParseInfo parse_info(shared_info);
-  parse_info.set_lazy_compile();
   if (FLAG_preparser_scope_analysis) {
     if (shared_info->HasPreParsedScopeData()) {
       Handle<PreParsedScopeData> data(
@@ -922,7 +1039,7 @@ bool Compiler::Compile(Handle<SharedFunctionInfo> shared_info,
 
   // Parse and update ParseInfo with the results.
   if (!parsing::ParseFunction(&parse_info, shared_info, isolate)) {
-    return FailWithPendingException(isolate, flag);
+    return FailWithPendingException(isolate, &parse_info, flag);
   }
 
   // Generate the unoptimized bytecode or asm-js data.
@@ -930,7 +1047,7 @@ bool Compiler::Compile(Handle<SharedFunctionInfo> shared_info,
   std::unique_ptr<CompilationJob> outer_function_job(GenerateUnoptimizedCode(
       &parse_info, isolate->allocator(), &inner_function_jobs));
   if (!outer_function_job) {
-    return FailWithPendingException(isolate, flag);
+    return FailWithPendingException(isolate, &parse_info, flag);
   }
 
   // Internalize ast values onto the heap.
@@ -940,7 +1057,7 @@ bool Compiler::Compile(Handle<SharedFunctionInfo> shared_info,
   if (!FinalizeUnoptimizedCode(&parse_info, isolate, shared_info,
                                outer_function_job.get(),
                                &inner_function_jobs)) {
-    return FailWithPendingException(isolate, flag);
+    return FailWithPendingException(isolate, &parse_info, flag);
   }
 
   DCHECK(!isolate->has_pending_exception());
@@ -956,14 +1073,13 @@ bool Compiler::Compile(Handle<JSFunction> function, ClearExceptionFlag flag) {
 
   Isolate* isolate = function->GetIsolate();
   Handle<SharedFunctionInfo> shared_info = handle(function->shared());
-  DCHECK(AllowCompilation::IsAllowed(isolate));
 
   // Ensure shared function info is compiled.
   if (!shared_info->is_compiled() && !Compile(shared_info, flag)) return false;
-  Handle<Code> code = handle(shared_info->code(), isolate);
+  Handle<Code> code = handle(shared_info->GetCode(), isolate);
 
-  // Allocate literals for the JSFunction.
-  JSFunction::EnsureLiterals(function);
+  // Allocate FeedbackVector for the JSFunction.
+  JSFunction::EnsureFeedbackVector(function);
 
   // Optimize now if --always-opt is enabled.
   if (FLAG_always_opt && !function->shared()->HasAsmWasmData()) {
@@ -1002,7 +1118,8 @@ bool Compiler::CompileOptimized(Handle<JSFunction> function,
     // already if we are optimizing.
     DCHECK(!isolate->has_pending_exception());
     DCHECK(function->shared()->is_compiled());
-    code = handle(function->shared()->code(), isolate);
+    DCHECK(function->shared()->IsInterpreted());
+    code = BUILTIN_CODE(isolate, InterpreterEntryTrampoline);
   }
 
   // Install code on closure.
@@ -1028,9 +1145,9 @@ MaybeHandle<JSArray> Compiler::CompileForLiveEdit(Handle<Script> script) {
   // In order to ensure that live edit function info collection finds the newly
   // generated shared function infos, clear the script's list temporarily
   // and restore it at the end of this method.
-  Handle<FixedArray> old_function_infos(script->shared_function_infos(),
-                                        isolate);
-  script->set_shared_function_infos(isolate->heap()->empty_fixed_array());
+  Handle<WeakFixedArray> old_function_infos(script->shared_function_infos(),
+                                            isolate);
+  script->set_shared_function_infos(isolate->heap()->empty_weak_fixed_array());
 
   // Start a compilation.
   ParseInfo parse_info(script);
@@ -1075,27 +1192,28 @@ MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
   // is unused (just 0), which means it's an available field to use to indicate
   // this separation. But to make sure we're not causing other false hits, we
   // negate the scope position.
-  int position = eval_scope_position;
   if (FLAG_harmony_function_tostring &&
       restriction == ONLY_SINGLE_FUNCTION_LITERAL &&
       parameters_end_pos != kNoSourcePosition) {
     // use the parameters_end_pos as the eval_scope_position in the eval cache.
     DCHECK_EQ(eval_scope_position, 0);
-    position = -parameters_end_pos;
+    eval_scope_position = -parameters_end_pos;
   }
   CompilationCache* compilation_cache = isolate->compilation_cache();
-  InfoVectorPair eval_result = compilation_cache->LookupEval(
-      source, outer_info, context, language_mode, position);
-  Handle<Cell> vector;
-  if (eval_result.has_vector()) {
-    vector = Handle<Cell>(eval_result.vector(), isolate);
+  InfoCellPair eval_result = compilation_cache->LookupEval(
+      source, outer_info, context, language_mode, eval_scope_position);
+  Handle<FeedbackCell> feedback_cell;
+  if (eval_result.has_feedback_cell()) {
+    feedback_cell = handle(eval_result.feedback_cell(), isolate);
   }
 
   Handle<SharedFunctionInfo> shared_info;
   Handle<Script> script;
+  bool allow_eval_cache;
   if (eval_result.has_shared()) {
     shared_info = Handle<SharedFunctionInfo>(eval_result.shared(), isolate);
     script = Handle<Script>(Script::cast(shared_info->script()), isolate);
+    allow_eval_cache = true;
   } else {
     script = isolate->factory()->NewScript(source);
     if (isolate->NeedsSourcePositionsForProfiling()) {
@@ -1139,6 +1257,7 @@ MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
     if (!CompileToplevel(&parse_info, isolate).ToHandle(&shared_info)) {
       return MaybeHandle<JSFunction>();
     }
+    allow_eval_cache = parse_info.allow_eval_cache();
   }
 
   // If caller is strict mode, the result must be in strict mode as well.
@@ -1146,27 +1265,32 @@ MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
 
   Handle<JSFunction> result;
   if (eval_result.has_shared()) {
-    if (eval_result.has_vector()) {
+    if (eval_result.has_feedback_cell()) {
       result = isolate->factory()->NewFunctionFromSharedFunctionInfo(
-          shared_info, context, vector, NOT_TENURED);
+          shared_info, context, feedback_cell, NOT_TENURED);
     } else {
       result = isolate->factory()->NewFunctionFromSharedFunctionInfo(
           shared_info, context, NOT_TENURED);
-      JSFunction::EnsureLiterals(result);
-      // Make sure to cache this result.
-      Handle<Cell> new_vector(result->feedback_vector_cell(), isolate);
-      compilation_cache->PutEval(source, outer_info, context, shared_info,
-                                 new_vector, eval_scope_position);
+      JSFunction::EnsureFeedbackVector(result);
+      if (allow_eval_cache) {
+        // Make sure to cache this result.
+        Handle<FeedbackCell> new_feedback_cell(result->feedback_cell(),
+                                               isolate);
+        compilation_cache->PutEval(source, outer_info, context, shared_info,
+                                   new_feedback_cell, eval_scope_position);
+      }
     }
   } else {
     result = isolate->factory()->NewFunctionFromSharedFunctionInfo(
         shared_info, context, NOT_TENURED);
-    JSFunction::EnsureLiterals(result);
-    // Add the SharedFunctionInfo and the LiteralsArray to the eval cache if
-    // we didn't retrieve from there.
-    Handle<Cell> vector(result->feedback_vector_cell(), isolate);
-    compilation_cache->PutEval(source, outer_info, context, shared_info, vector,
-                               eval_scope_position);
+    JSFunction::EnsureFeedbackVector(result);
+    if (allow_eval_cache) {
+      // Add the SharedFunctionInfo and the LiteralsArray to the eval cache if
+      // we didn't retrieve from there.
+      Handle<FeedbackCell> new_feedback_cell(result->feedback_cell(), isolate);
+      compilation_cache->PutEval(source, outer_info, context, shared_info,
+                                 new_feedback_cell, eval_scope_position);
+    }
   }
 
   // OnAfterCompile has to be called after we create the JSFunction, which we
@@ -1177,65 +1301,6 @@ MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
   return result;
 }
 
-MaybeHandle<JSFunction> Compiler::GetWrappedFunction(
-    Handle<String> source, Handle<FixedArray> arguments,
-    Handle<Context> context, int line_offset, int column_offset,
-    Handle<Object> script_name, ScriptOriginOptions options) {
-  Isolate* isolate = source->GetIsolate();
-  int source_length = source->length();
-  isolate->counters()->total_compile_size()->Increment(source_length);
-
-  Handle<Script> script = isolate->factory()->NewScript(source);
-  if (isolate->NeedsSourcePositionsForProfiling()) {
-    Script::InitLineEnds(script);
-  }
-  if (!script_name.is_null()) {
-    script->set_name(*script_name);
-    script->set_line_offset(line_offset);
-    script->set_column_offset(column_offset);
-  }
-  script->set_wrapped_arguments(*arguments);
-  script->set_origin_options(options);
-
-  ParseInfo parse_info(script);
-  parse_info.set_eval();  // Use an eval scope as declaration scope.
-  parse_info.set_wrapped_as_function();
-  if (!context->IsNativeContext()) {
-    parse_info.set_outer_scope_info(handle(context->scope_info()));
-  }
-
-  Handle<SharedFunctionInfo> top_level;
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, top_level,
-                             CompileToplevel(&parse_info, isolate), JSFunction);
-
-  Handle<JSFunction> top_level_fun =
-      isolate->factory()->NewFunctionFromSharedFunctionInfo(top_level, context,
-                                                            NOT_TENURED);
-
-  // TODO(yangguo): consider not having to call the top-level function, and
-  //                instead instantiate the wrapper function directly.
-  Handle<Object> result;
-  ASSIGN_RETURN_ON_EXCEPTION(
-      isolate, result,
-      Execution::Call(isolate, top_level_fun, isolate->global_proxy(), 0,
-                      nullptr),
-      JSFunction);
-
-  // OnAfterCompile has to be called after we create the JSFunction, which we
-  // may require to recompile the eval for debugging, if we find a function
-  // that contains break points in the eval script.
-  isolate->debug()->OnAfterCompile(script);
-  return Handle<JSFunction>::cast(result);
-}
-
-namespace {
-
-bool ShouldProduceCodeCache(ScriptCompiler::CompileOptions options) {
-  return options == ScriptCompiler::kProduceCodeCache ||
-         options == ScriptCompiler::kProduceFullCodeCache;
-}
-
-}  // namespace
 
 bool Compiler::CodeGenerationFromStringsAllowed(Isolate* isolate,
                                                 Handle<Context> context,
@@ -1477,31 +1542,56 @@ struct ScriptCompileTimerScope {
   }
 };
 
+Handle<Script> NewScript(Isolate* isolate, Handle<String> source,
+                         Compiler::ScriptDetails script_details,
+                         ScriptOriginOptions origin_options,
+                         NativesFlag natives) {
+  // Create a script object describing the script to be compiled.
+  Handle<Script> script = isolate->factory()->NewScript(source);
+  if (isolate->NeedsSourcePositionsForProfiling()) {
+    Script::InitLineEnds(script);
+  }
+  if (natives == NATIVES_CODE) {
+    script->set_type(Script::TYPE_NATIVE);
+  } else if (natives == EXTENSION_CODE) {
+    script->set_type(Script::TYPE_EXTENSION);
+  } else if (natives == INSPECTOR_CODE) {
+    script->set_type(Script::TYPE_INSPECTOR);
+  }
+  Handle<Object> script_name;
+  if (script_details.name_obj.ToHandle(&script_name)) {
+    script->set_name(*script_name);
+    script->set_line_offset(script_details.line_offset);
+    script->set_column_offset(script_details.column_offset);
+  }
+  script->set_origin_options(origin_options);
+  Handle<Object> source_map_url;
+  if (script_details.source_map_url.ToHandle(&source_map_url)) {
+    script->set_source_mapping_url(*source_map_url);
+  }
+  Handle<FixedArray> host_defined_options;
+  if (script_details.host_defined_options.ToHandle(&host_defined_options)) {
+    script->set_host_defined_options(*host_defined_options);
+  }
+  return script;
+}
+
 }  // namespace
 
 MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
-    Handle<String> source, MaybeHandle<Object> maybe_script_name,
-    int line_offset, int column_offset, ScriptOriginOptions resource_options,
-    MaybeHandle<Object> maybe_source_map_url, Handle<Context> context,
-    v8::Extension* extension, ScriptData** cached_data,
-    ScriptCompiler::CompileOptions compile_options,
-    ScriptCompiler::NoCacheReason no_cache_reason, NativesFlag natives,
-    MaybeHandle<FixedArray> maybe_host_defined_options) {
+    Handle<String> source, const Compiler::ScriptDetails& script_details,
+    ScriptOriginOptions origin_options, v8::Extension* extension,
+    ScriptData* cached_data, ScriptCompiler::CompileOptions compile_options,
+    ScriptCompiler::NoCacheReason no_cache_reason, NativesFlag natives) {
   Isolate* isolate = source->GetIsolate();
   ScriptCompileTimerScope compile_timer(isolate, no_cache_reason);
 
   if (compile_options == ScriptCompiler::kNoCompileOptions ||
       compile_options == ScriptCompiler::kEagerCompile) {
-    cached_data = nullptr;
-  } else if (compile_options == ScriptCompiler::kProduceParserCache ||
-             ShouldProduceCodeCache(compile_options)) {
-    DCHECK(cached_data && !*cached_data);
-    DCHECK_NULL(extension);
-    DCHECK(!isolate->debug()->is_loaded());
+    DCHECK_NULL(cached_data);
   } else {
-    DCHECK(compile_options == ScriptCompiler::kConsumeParserCache ||
-           compile_options == ScriptCompiler::kConsumeCodeCache);
-    DCHECK(cached_data && *cached_data);
+    DCHECK(compile_options == ScriptCompiler::kConsumeCodeCache);
+    DCHECK(cached_data);
     DCHECK_NULL(extension);
   }
   int source_length = source->length();
@@ -1513,7 +1603,6 @@ MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
 
   // Do a lookup in the compilation cache but not for extensions.
   MaybeHandle<SharedFunctionInfo> maybe_result;
-  Handle<Cell> vector;
   if (extension == nullptr) {
     bool can_consume_code_cache =
         compile_options == ScriptCompiler::kConsumeCodeCache &&
@@ -1523,10 +1612,13 @@ MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
     }
 
     // First check per-isolate compilation cache.
-    InfoVectorPair pair = compilation_cache->LookupScript(
-        source, maybe_script_name, line_offset, column_offset, resource_options,
-        context, language_mode);
-    if (can_consume_code_cache && !pair.has_shared()) {
+    maybe_result = compilation_cache->LookupScript(
+        source, script_details.name_obj, script_details.line_offset,
+        script_details.column_offset, origin_options, isolate->native_context(),
+        language_mode);
+    if (!maybe_result.is_null()) {
+      compile_timer.set_hit_isolate_cache();
+    } else if (can_consume_code_cache) {
       compile_timer.set_consuming_code_cache();
       // Then check cached code provided by embedder.
       HistogramTimerScope timer(isolate->counters()->compile_deserialize());
@@ -1535,200 +1627,216 @@ MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
       TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
                    "V8.CompileDeserialize");
       Handle<SharedFunctionInfo> inner_result;
-      if (CodeSerializer::Deserialize(isolate, *cached_data, source)
+      if (CodeSerializer::Deserialize(isolate, cached_data, source)
               .ToHandle(&inner_result)) {
         // Promote to per-isolate compilation cache.
         DCHECK(inner_result->is_compiled());
-        Handle<FeedbackVector> feedback_vector =
-            FeedbackVector::New(isolate, inner_result);
-        vector = isolate->factory()->NewCell(feedback_vector);
-        compilation_cache->PutScript(source, context, language_mode,
-                                     inner_result, vector);
+        compilation_cache->PutScript(source, isolate->native_context(),
+                                     language_mode, inner_result);
         Handle<Script> script(Script::cast(inner_result->script()), isolate);
-        isolate->debug()->OnAfterCompile(script);
-        if (isolate->NeedsSourcePositionsForProfiling()) {
-          Script::InitLineEnds(script);
-        }
-        return inner_result;
-      }
-      // Deserializer failed. Fall through to compile.
-      compile_timer.set_consuming_code_cache_failed();
-    } else {
-      if (pair.has_shared()) {
-        maybe_result = MaybeHandle<SharedFunctionInfo>(pair.shared(), isolate);
-        compile_timer.set_hit_isolate_cache();
-      }
-      if (pair.has_vector()) {
-        vector = Handle<Cell>(pair.vector(), isolate);
+        maybe_result = inner_result;
+      } else {
+        // Deserializer failed. Fall through to compile.
+        compile_timer.set_consuming_code_cache_failed();
       }
     }
   }
 
-  base::ElapsedTimer timer;
-  if (FLAG_profile_deserialization && ShouldProduceCodeCache(compile_options)) {
-    timer.Start();
-  }
+  if (maybe_result.is_null()) {
+    // No cache entry found compile the script.
+    Handle<Script> script =
+        NewScript(isolate, source, script_details, origin_options, natives);
 
-  if (maybe_result.is_null() || ShouldProduceCodeCache(compile_options)) {
-    // No cache entry found, or embedder wants a code cache. Compile the script.
-
-    // Create a script object describing the script to be compiled.
-    Handle<Script> script = isolate->factory()->NewScript(source);
-    if (isolate->NeedsSourcePositionsForProfiling()) {
-      Script::InitLineEnds(script);
-    }
-    if (natives == NATIVES_CODE) {
-      script->set_type(Script::TYPE_NATIVE);
-    } else if (natives == EXTENSION_CODE) {
-      script->set_type(Script::TYPE_EXTENSION);
-    } else if (natives == INSPECTOR_CODE) {
-      script->set_type(Script::TYPE_INSPECTOR);
-    }
-    Handle<Object> script_name;
-    if (maybe_script_name.ToHandle(&script_name)) {
-      script->set_name(*script_name);
-      script->set_line_offset(line_offset);
-      script->set_column_offset(column_offset);
-    }
-    script->set_origin_options(resource_options);
-    Handle<Object> source_map_url;
-    if (maybe_source_map_url.ToHandle(&source_map_url)) {
-      script->set_source_mapping_url(*source_map_url);
-    }
-    Handle<FixedArray> host_defined_options;
-    if (maybe_host_defined_options.ToHandle(&host_defined_options)) {
-      script->set_host_defined_options(*host_defined_options);
-    }
-
-    // Compile the function and add it to the cache.
+    // Compile the function and add it to the isolate cache.
     ParseInfo parse_info(script);
     Zone compile_zone(isolate->allocator(), ZONE_NAME);
-    if (resource_options.IsModule()) parse_info.set_module();
-    if (compile_options != ScriptCompiler::kNoCompileOptions) {
-      parse_info.set_cached_data(cached_data);
-    }
-    parse_info.set_compile_options(compile_options);
+    if (origin_options.IsModule()) parse_info.set_module();
     parse_info.set_extension(extension);
-    if (!context->IsNativeContext()) {
-      parse_info.set_outer_scope_info(handle(context->scope_info()));
-    }
-    parse_info.set_eager(
-        (compile_options == ScriptCompiler::kProduceFullCodeCache) ||
-        (compile_options == ScriptCompiler::kEagerCompile));
+    parse_info.set_eager(compile_options == ScriptCompiler::kEagerCompile);
 
     parse_info.set_language_mode(
         stricter_language_mode(parse_info.language_mode(), language_mode));
     maybe_result = CompileToplevel(&parse_info, isolate);
     Handle<SharedFunctionInfo> result;
     if (extension == nullptr && maybe_result.ToHandle(&result)) {
-      // We need a feedback vector.
       DCHECK(result->is_compiled());
-      Handle<FeedbackVector> feedback_vector =
-          FeedbackVector::New(isolate, result);
-      vector = isolate->factory()->NewCell(feedback_vector);
-      compilation_cache->PutScript(source, context, language_mode, result,
-                                   vector);
-      if (ShouldProduceCodeCache(compile_options) &&
-          !script->ContainsAsmModule()) {
-        compile_timer.set_producing_code_cache();
-
-        HistogramTimerScope histogram_timer(
-            isolate->counters()->compile_serialize());
-        RuntimeCallTimerScope runtimeTimer(
-            isolate, RuntimeCallCounterId::kCompileSerialize);
-        TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-                     "V8.CompileSerialize");
-        *cached_data = CodeSerializer::Serialize(isolate, result, source);
-        if (FLAG_profile_deserialization) {
-          PrintF("[Compiling and serializing took %0.3f ms]\n",
-                 timer.Elapsed().InMillisecondsF());
-        }
-      }
+      compilation_cache->PutScript(source, isolate->native_context(),
+                                   language_mode, result);
+    } else if (maybe_result.is_null() && natives != EXTENSION_CODE &&
+               natives != NATIVES_CODE) {
+      isolate->ReportPendingMessages();
     }
+  }
 
-    if (maybe_result.is_null()) {
-      if (natives != EXTENSION_CODE && natives != NATIVES_CODE) {
-        isolate->ReportPendingMessages();
-      }
-    } else {
-      isolate->debug()->OnAfterCompile(script);
-    }
+  // On success, report script compilation to debugger.
+  Handle<SharedFunctionInfo> result;
+  if (maybe_result.ToHandle(&result)) {
+    isolate->debug()->OnAfterCompile(handle(Script::cast(result->script())));
   }
+
   return maybe_result;
 }
 
-std::unique_ptr<CompilationJob> Compiler::CompileTopLevelOnBackgroundThread(
-    ParseInfo* parse_info, AccountingAllocator* allocator,
-    CompilationJobList* inner_function_jobs) {
-  DisallowHeapAllocation no_allocation;
-  DisallowHandleAllocation no_handles;
-  DisallowHandleDereference no_deref;
-  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
-               "V8.CompileCodeBackground");
-  RuntimeCallTimerScope runtimeTimer(
-      parse_info->runtime_call_stats(),
-      parse_info->is_eval() ? RuntimeCallCounterId::kCompileBackgroundEval
-                            : RuntimeCallCounterId::kCompileBackgroundScript);
+MaybeHandle<JSFunction> Compiler::GetWrappedFunction(
+    Handle<String> source, Handle<FixedArray> arguments,
+    Handle<Context> context, const Compiler::ScriptDetails& script_details,
+    ScriptOriginOptions origin_options, ScriptData* cached_data,
+    v8::ScriptCompiler::CompileOptions compile_options,
+    v8::ScriptCompiler::NoCacheReason no_cache_reason) {
+  Isolate* isolate = source->GetIsolate();
+  ScriptCompileTimerScope compile_timer(isolate, no_cache_reason);
 
-  LanguageMode language_mode = construct_language_mode(FLAG_use_strict);
-  parse_info->set_language_mode(
-      stricter_language_mode(parse_info->language_mode(), language_mode));
+  if (compile_options == ScriptCompiler::kNoCompileOptions ||
+      compile_options == ScriptCompiler::kEagerCompile) {
+    DCHECK_NULL(cached_data);
+  } else {
+    DCHECK(compile_options == ScriptCompiler::kConsumeCodeCache);
+    DCHECK(cached_data);
+  }
 
-  // Can't access scope info data off-main-thread.
-  DCHECK(!parse_info->consumed_preparsed_scope_data()->HasData());
+  int source_length = source->length();
+  isolate->counters()->total_compile_size()->Increment(source_length);
 
-  // Generate the unoptimized bytecode or asm-js data.
-  std::unique_ptr<CompilationJob> outer_function_job(
-      GenerateUnoptimizedCode(parse_info, allocator, inner_function_jobs));
-  return outer_function_job;
-}
+  LanguageMode language_mode = construct_language_mode(FLAG_use_strict);
 
-Handle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForBackgroundCompile(
-    Handle<Script> script, ParseInfo* parse_info, int source_length,
-    CompilationJob* outer_function_job,
-    CompilationJobList* inner_function_jobs) {
-  Isolate* isolate = script->GetIsolate();
-  ScriptCompileTimerScope compile_timer(
-      isolate, ScriptCompiler::kNoCacheBecauseStreamingSource);
-  PostponeInterruptsScope postpone(isolate);
+  MaybeHandle<SharedFunctionInfo> maybe_result;
+  bool can_consume_code_cache =
+      compile_options == ScriptCompiler::kConsumeCodeCache &&
+      !isolate->debug()->is_loaded();
+  if (can_consume_code_cache) {
+    compile_timer.set_consuming_code_cache();
+    // Then check cached code provided by embedder.
+    HistogramTimerScope timer(isolate->counters()->compile_deserialize());
+    RuntimeCallTimerScope runtimeTimer(
+        isolate, RuntimeCallCounterId::kCompileDeserialize);
+    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
+                 "V8.CompileDeserialize");
+    maybe_result = CodeSerializer::Deserialize(isolate, cached_data, source);
+    if (maybe_result.is_null()) {
+      // Deserializer failed. Fall through to compile.
+      compile_timer.set_consuming_code_cache_failed();
+    }
+  }
 
-  // TODO(titzer): increment the counters in caller.
-  isolate->counters()->total_load_size()->Increment(source_length);
-  isolate->counters()->total_compile_size()->Increment(source_length);
+  Handle<SharedFunctionInfo> wrapped;
+  Handle<Script> script;
+  if (!maybe_result.ToHandle(&wrapped)) {
+    script = NewScript(isolate, source, script_details, origin_options,
+                       NOT_NATIVES_CODE);
+    script->set_wrapped_arguments(*arguments);
 
-  if (outer_function_job == nullptr) {
-    // Compilation failed on background thread - throw an exception.
-    if (!isolate->has_pending_exception()) isolate->StackOverflow();
-    return Handle<SharedFunctionInfo>();
-  }
+    ParseInfo parse_info(script);
+    parse_info.set_eval();  // Use an eval scope as declaration scope.
+    parse_info.set_wrapped_as_function();
+    // parse_info.set_eager(compile_options == ScriptCompiler::kEagerCompile);
+    if (!context->IsNativeContext()) {
+      parse_info.set_outer_scope_info(handle(context->scope_info()));
+    }
+    parse_info.set_language_mode(
+        stricter_language_mode(parse_info.language_mode(), language_mode));
 
-  Handle<SharedFunctionInfo> result;
-  if (FinalizeTopLevel(parse_info, isolate, outer_function_job,
-                       inner_function_jobs)
-          .ToHandle(&result)) {
-    isolate->debug()->OnAfterCompile(script);
+    Handle<SharedFunctionInfo> top_level;
+    maybe_result = CompileToplevel(&parse_info, isolate);
+    if (maybe_result.is_null()) isolate->ReportPendingMessages();
+    ASSIGN_RETURN_ON_EXCEPTION(isolate, top_level, maybe_result, JSFunction);
+
+    SharedFunctionInfo::ScriptIterator infos(script);
+    while (SharedFunctionInfo* info = infos.Next()) {
+      if (info->is_wrapped()) {
+        wrapped = Handle<SharedFunctionInfo>(info, isolate);
+        break;
+      }
+    }
+    DCHECK(!wrapped.is_null());
+  } else {
+    script = Handle<Script>(Script::cast(wrapped->script()), isolate);
   }
-  return result;
+
+  Handle<JSFunction> function =
+      isolate->factory()->NewFunctionFromSharedFunctionInfo(wrapped, context,
+                                                            NOT_TENURED);
+  // OnAfterCompile has to be called after we create the JSFunction, which we
+  // may require to recompile the eval for debugging, if we find a function
+  // that contains break points in the eval script.
+  isolate->debug()->OnAfterCompile(script);
+  return function;
 }
 
-Handle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForStreamedScript(
-    Handle<Script> script, ParseInfo* parse_info, int source_length) {
-  Isolate* isolate = script->GetIsolate();
+ScriptCompiler::ScriptStreamingTask* Compiler::NewBackgroundCompileTask(
+    ScriptStreamingData* source, Isolate* isolate) {
+  return new BackgroundCompileTask(source, isolate);
+}
+
+MaybeHandle<SharedFunctionInfo>
+Compiler::GetSharedFunctionInfoForStreamedScript(
+    Handle<String> source, const ScriptDetails& script_details,
+    ScriptOriginOptions origin_options, ScriptStreamingData* streaming_data) {
+  Isolate* isolate = source->GetIsolate();
   ScriptCompileTimerScope compile_timer(
       isolate, ScriptCompiler::kNoCacheBecauseStreamingSource);
-  // TODO(titzer): increment the counters in caller.
+  PostponeInterruptsScope postpone(isolate);
+
+  int source_length = source->length();
   isolate->counters()->total_load_size()->Increment(source_length);
   isolate->counters()->total_compile_size()->Increment(source_length);
 
-  LanguageMode language_mode = construct_language_mode(FLAG_use_strict);
-  parse_info->set_language_mode(
-      stricter_language_mode(parse_info->language_mode(), language_mode));
+  ParseInfo* parse_info = streaming_data->info.get();
+  parse_info->UpdateBackgroundParseStatisticsOnMainThread(isolate);
+
+  // Check if compile cache already holds the SFI, if so no need to finalize
+  // the code compiled on the background thread.
+  CompilationCache* compilation_cache = isolate->compilation_cache();
+  MaybeHandle<SharedFunctionInfo> maybe_result =
+      compilation_cache->LookupScript(
+          source, script_details.name_obj, script_details.line_offset,
+          script_details.column_offset, origin_options,
+          isolate->native_context(), parse_info->language_mode());
+  if (!maybe_result.is_null()) {
+    compile_timer.set_hit_isolate_cache();
+  }
+
+  if (maybe_result.is_null()) {
+    // No cache entry found, finalize compilation of the script and add it to
+    // the isolate cache.
+    Handle<Script> script = NewScript(isolate, source, script_details,
+                                      origin_options, NOT_NATIVES_CODE);
+    parse_info->set_script(script);
+    streaming_data->parser->UpdateStatistics(isolate, script);
+    streaming_data->parser->HandleSourceURLComments(isolate, script);
+
+    if (parse_info->literal() == nullptr) {
+      // Parsing has failed - report error messages.
+      parse_info->pending_error_handler()->ReportErrors(
+          isolate, script, parse_info->ast_value_factory());
+    } else {
+      // Parsing has succeeded - finalize compilation.
+      if (streaming_data->outer_function_job) {
+        maybe_result = FinalizeTopLevel(
+            parse_info, isolate, streaming_data->outer_function_job.get(),
+            &streaming_data->inner_function_jobs);
+      } else {
+        // Compilation failed on background thread - throw an exception.
+        FailWithPendingException(isolate, parse_info,
+                                 Compiler::ClearExceptionFlag::KEEP_EXCEPTION);
+      }
+    }
 
+    // Add compiled code to the isolate cache.
+    Handle<SharedFunctionInfo> result;
+    if (maybe_result.ToHandle(&result)) {
+      compilation_cache->PutScript(source, isolate->native_context(),
+                                   parse_info->language_mode(), result);
+    }
+  }
+
+  // On success, report script compilation to debugger.
   Handle<SharedFunctionInfo> result;
-  if (CompileToplevel(parse_info, isolate).ToHandle(&result)) {
-    isolate->debug()->OnAfterCompile(script);
+  if (maybe_result.ToHandle(&result)) {
+    isolate->debug()->OnAfterCompile(handle(Script::cast(result->script())));
   }
-  return result;
+
+  streaming_data->Release();
+  return maybe_result;
 }
 
 Handle<SharedFunctionInfo> Compiler::GetSharedFunctionInfo(
@@ -1789,8 +1897,7 @@ void Compiler::PostInstantiation(Handle<JSFunction> function,
   if (FLAG_always_opt && shared->allows_lazy_compilation() &&
       !shared->optimization_disabled() && !shared->HasAsmWasmData() &&
       shared->is_compiled()) {
-    // TODO(mvstanton): pass pretenure flag to EnsureLiterals.
-    JSFunction::EnsureLiterals(function);
+    JSFunction::EnsureFeedbackVector(function);
 
     if (!function->IsOptimized()) {
       // Only mark for optimization if we don't already have optimized code.
@@ -1801,8 +1908,7 @@ void Compiler::PostInstantiation(Handle<JSFunction> function,
   }
 
   if (shared->is_compiled() && !shared->HasAsmWasmData()) {
-    // TODO(mvstanton): pass pretenure flag to EnsureLiterals.
-    JSFunction::EnsureLiterals(function);
+    JSFunction::EnsureFeedbackVector(function);
 
     Code* code = function->feedback_vector()->optimized_code();
     if (code != nullptr) {
@@ -1814,5 +1920,22 @@ void Compiler::PostInstantiation(Handle<JSFunction> function,
   }
 }
 
+// ----------------------------------------------------------------------------
+// Implementation of ScriptStreamingData
+
+ScriptStreamingData::ScriptStreamingData(
+    ScriptCompiler::ExternalSourceStream* source_stream,
+    ScriptCompiler::StreamedSource::Encoding encoding)
+    : source_stream(source_stream), encoding(encoding) {}
+
+ScriptStreamingData::~ScriptStreamingData() {}
+
+void ScriptStreamingData::Release() {
+  parser.reset();
+  info.reset();
+  outer_function_job.reset();
+  inner_function_jobs.clear();
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler.h b/deps/v8/src/compiler.h
index b84134c14ee..4e550e99c45 100644
--- a/deps/v8/src/compiler.h
+++ b/deps/v8/src/compiler.h
@@ -13,6 +13,7 @@
 #include "src/code-events.h"
 #include "src/contexts.h"
 #include "src/isolate.h"
+#include "src/unicode-cache.h"
 #include "src/zone/zone.h"
 
 namespace v8 {
@@ -23,11 +24,9 @@ class CompilationInfo;
 class CompilationJob;
 class JavaScriptFrame;
 class ParseInfo;
+class Parser;
 class ScriptData;
-template <typename T>
-class ThreadedList;
-template <typename T>
-class ThreadedListZoneEntry;
+struct ScriptStreamingData;
 
 typedef std::forward_list<std::unique_ptr<CompilationJob>> CompilationJobList;
 
@@ -57,11 +56,12 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
   static bool CompileOptimized(Handle<JSFunction> function, ConcurrencyMode);
   static MaybeHandle<JSArray> CompileForLiveEdit(Handle<Script> script);
 
-  // Compile top level code on a background thread. Should be finalized by
-  // GetSharedFunctionInfoForBackgroundCompile.
-  static std::unique_ptr<CompilationJob> CompileTopLevelOnBackgroundThread(
-      ParseInfo* parse_info, AccountingAllocator* allocator,
-      CompilationJobList* inner_function_jobs);
+  // Creates a new task that when run will parse and compile the streamed
+  // script associated with |streaming_data| and can be finalized with
+  // Compiler::GetSharedFunctionInfoForStreamedScript.
+  // Note: does not take ownership of streaming_data.
+  static ScriptCompiler::ScriptStreamingTask* NewBackgroundCompileTask(
+      ScriptStreamingData* streaming_data, Isolate* isolate);
 
   // Generate and install code from previously queued compilation job.
   static bool FinalizeCompilationJob(CompilationJob* job, Isolate* isolate);
@@ -71,17 +71,12 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
   // offer this chance, optimized closure instantiation will not call this.
   static void PostInstantiation(Handle<JSFunction> function, PretenureFlag);
 
-  typedef ThreadedList<ThreadedListZoneEntry<FunctionLiteral*>>
-      EagerInnerFunctionLiterals;
-
   // Parser::Parse, then Compiler::Analyze.
   static bool ParseAndAnalyze(ParseInfo* parse_info,
                               Handle<SharedFunctionInfo> shared_info,
                               Isolate* isolate);
-  // Rewrite, analyze scopes, and renumber. If |eager_literals| is non-null, it
-  // is appended with inner function literals which should be eagerly compiled.
-  static bool Analyze(ParseInfo* parse_info,
-                      EagerInnerFunctionLiterals* eager_literals = nullptr);
+  // Rewrite and analyze scopes.
+  static bool Analyze(ParseInfo* parse_info);
 
   // ===========================================================================
   // The following family of methods instantiates new functions for scripts or
@@ -101,13 +96,26 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
       int column_offset = 0, Handle<Object> script_name = Handle<Object>(),
       ScriptOriginOptions options = ScriptOriginOptions());
 
+  struct ScriptDetails {
+    ScriptDetails() : line_offset(0), column_offset(0) {}
+    explicit ScriptDetails(Handle<Object> script_name)
+        : line_offset(0), column_offset(0), name_obj(script_name) {}
+
+    int line_offset;
+    int column_offset;
+    i::MaybeHandle<i::Object> name_obj;
+    i::MaybeHandle<i::Object> source_map_url;
+    i::MaybeHandle<i::FixedArray> host_defined_options;
+  };
+
   // Create a function that results from wrapping |source| in a function,
   // with |arguments| being a list of parameters for that function.
   MUST_USE_RESULT static MaybeHandle<JSFunction> GetWrappedFunction(
       Handle<String> source, Handle<FixedArray> arguments,
-      Handle<Context> context, int line_offset = 0, int column_offset = 0,
-      Handle<Object> script_name = Handle<Object>(),
-      ScriptOriginOptions options = ScriptOriginOptions());
+      Handle<Context> context, const ScriptDetails& script_details,
+      ScriptOriginOptions origin_options, ScriptData* cached_data,
+      v8::ScriptCompiler::CompileOptions compile_options,
+      v8::ScriptCompiler::NoCacheReason no_cache_reason);
 
   // Returns true if the embedder permits compiling the given source string in
   // the given context.
@@ -120,28 +128,23 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
       Handle<Context> context, Handle<String> source,
       ParseRestriction restriction, int parameters_end_pos);
 
-  // Create a shared function info object for a String source within a context.
+
+  // Create a shared function info object for a String source.
   static MaybeHandle<SharedFunctionInfo> GetSharedFunctionInfoForScript(
-      Handle<String> source, MaybeHandle<Object> maybe_script_name,
-      int line_offset, int column_offset, ScriptOriginOptions resource_options,
-      MaybeHandle<Object> maybe_source_map_url, Handle<Context> context,
-      v8::Extension* extension, ScriptData** cached_data,
-      ScriptCompiler::CompileOptions compile_options,
+      Handle<String> source, const ScriptDetails& script_details,
+      ScriptOriginOptions origin_options, v8::Extension* extension,
+      ScriptData* cached_data, ScriptCompiler::CompileOptions compile_options,
       ScriptCompiler::NoCacheReason no_cache_reason,
-      NativesFlag is_natives_code,
-      MaybeHandle<FixedArray> maybe_host_defined_options);
-
-  // Create a shared function info object for a Script that has already been
-  // parsed while the script was being loaded from a streamed source.
-  static Handle<SharedFunctionInfo> GetSharedFunctionInfoForStreamedScript(
-      Handle<Script> script, ParseInfo* info, int source_length);
+      NativesFlag is_natives_code);
 
-  // Create a shared function info object for a Script that has already been
-  // compiled on a background thread.
-  static Handle<SharedFunctionInfo> GetSharedFunctionInfoForBackgroundCompile(
-      Handle<Script> script, ParseInfo* parse_info, int source_length,
-      CompilationJob* outer_function_job,
-      CompilationJobList* inner_function_jobs);
+  // Create a shared function info object for a Script source that has already
+  // been parsed and possibly compiled on a background thread while being loaded
+  // from a streamed source. On return, the data held by |streaming_data| will
+  // have been released, however the object itself isn't freed and is still
+  // owned by the caller.
+  static MaybeHandle<SharedFunctionInfo> GetSharedFunctionInfoForStreamedScript(
+      Handle<String> source, const ScriptDetails& script_details,
+      ScriptOriginOptions origin_options, ScriptStreamingData* streaming_data);
 
   // Create a shared function info object for the given function literal
   // node (the code may be lazily compiled).
@@ -246,6 +249,34 @@ class V8_EXPORT_PRIVATE CompilationJob {
   }
 };
 
+// Contains all data which needs to be transmitted between threads for
+// background parsing and compiling and finalizing it on the main thread.
+struct ScriptStreamingData {
+  ScriptStreamingData(ScriptCompiler::ExternalSourceStream* source_stream,
+                      ScriptCompiler::StreamedSource::Encoding encoding);
+  ~ScriptStreamingData();
+
+  void Release();
+
+  // Internal implementation of v8::ScriptCompiler::StreamedSource.
+  std::unique_ptr<ScriptCompiler::ExternalSourceStream> source_stream;
+  ScriptCompiler::StreamedSource::Encoding encoding;
+  std::unique_ptr<ScriptCompiler::CachedData> cached_data;
+
+  // Data needed for parsing, and data needed to to be passed between thread
+  // between parsing and compilation. These need to be initialized before the
+  // compilation starts.
+  UnicodeCache unicode_cache;
+  std::unique_ptr<ParseInfo> info;
+  std::unique_ptr<Parser> parser;
+
+  // Data needed for finalizing compilation after background compilation.
+  std::unique_ptr<CompilationJob> outer_function_job;
+  CompilationJobList inner_function_jobs;
+
+  DISALLOW_COPY_AND_ASSIGN(ScriptStreamingData);
+};
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/compiler/OWNERS b/deps/v8/src/compiler/OWNERS
index 2e9052e0c38..e7c4b7542f0 100644
--- a/deps/v8/src/compiler/OWNERS
+++ b/deps/v8/src/compiler/OWNERS
@@ -5,18 +5,20 @@ jarin@chromium.org
 mstarzinger@chromium.org
 titzer@chromium.org
 danno@chromium.org
+sigurds@chromium.org
 tebbi@chromium.org
 neis@chromium.org
 mvstanton@chromium.org
 
 # For backend
 bbudge@chromium.org
-mtrofin@chromium.org
+gdeepti@chromium.org
 
 per-file wasm-*=ahaas@chromium.org
-per-file wasm-*=bbudge@chromium.org
+per-file wasm-*=binji@chromium.org
 per-file wasm-*=bradnelson@chromium.org
 per-file wasm-*=clemensh@chromium.org
+per-file wasm-*=kschimpf@chromium.org
 
 per-file int64-lowering.*=ahaas@chromium.org
 
diff --git a/deps/v8/src/compiler/access-builder.cc b/deps/v8/src/compiler/access-builder.cc
index 13d6801c323..bbef35570c5 100644
--- a/deps/v8/src/compiler/access-builder.cc
+++ b/deps/v8/src/compiler/access-builder.cc
@@ -164,8 +164,8 @@ FieldAccess AccessBuilder::ForJSFunctionSharedFunctionInfo() {
 }
 
 // static
-FieldAccess AccessBuilder::ForJSFunctionFeedbackVector() {
-  FieldAccess access = {kTaggedBase,         JSFunction::kFeedbackVectorOffset,
+FieldAccess AccessBuilder::ForJSFunctionFeedbackCell() {
+  FieldAccess access = {kTaggedBase,         JSFunction::kFeedbackCellOffset,
                         Handle<Name>(),      MaybeHandle<Map>(),
                         Type::Internal(),    MachineType::TaggedPointer(),
                         kPointerWriteBarrier};
@@ -289,12 +289,12 @@ FieldAccess AccessBuilder::ForJSAsyncGeneratorObjectQueue() {
 }
 
 // static
-FieldAccess AccessBuilder::ForJSAsyncGeneratorObjectAwaitedPromise() {
+FieldAccess AccessBuilder::ForJSAsyncGeneratorObjectIsAwaiting() {
   FieldAccess access = {
-      kTaggedBase,         JSAsyncGeneratorObject::kAwaitedPromiseOffset,
+      kTaggedBase,         JSAsyncGeneratorObject::kIsAwaitingOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::AnyTagged(),
-      kFullWriteBarrier};
+      Type::SignedSmall(), MachineType::TaggedSigned(),
+      kNoWriteBarrier};
   return access;
 }
 
@@ -729,7 +729,7 @@ FieldAccess AccessBuilder::ForJSGlobalProxyNativeContext() {
 }
 
 // static
-FieldAccess AccessBuilder::ForJSArrayIteratorObject() {
+FieldAccess AccessBuilder::ForJSArrayIteratorIteratedObject() {
   FieldAccess access = {kTaggedBase,
                         JSArrayIterator::kIteratedObjectOffset,
                         Handle<Name>(),
@@ -741,8 +741,7 @@ FieldAccess AccessBuilder::ForJSArrayIteratorObject() {
 }
 
 // static
-FieldAccess AccessBuilder::ForJSArrayIteratorIndex(InstanceType instance_type,
-                                                   ElementsKind elements_kind) {
+FieldAccess AccessBuilder::ForJSArrayIteratorNextIndex() {
   // In generic case, cap to 2^53-1 (per ToLength() in spec) via
   // kPositiveSafeInteger
   FieldAccess access = {kTaggedBase,
@@ -752,33 +751,18 @@ FieldAccess AccessBuilder::ForJSArrayIteratorIndex(InstanceType instance_type,
                         TypeCache::Get().kPositiveSafeInteger,
                         MachineType::AnyTagged(),
                         kFullWriteBarrier};
-  if (instance_type == JS_ARRAY_TYPE) {
-    if (IsDoubleElementsKind(elements_kind)) {
-      access.type = TypeCache::Get().kFixedDoubleArrayLengthType;
-      access.machine_type = MachineType::TaggedSigned();
-      access.write_barrier_kind = kNoWriteBarrier;
-    } else if (IsFastElementsKind(elements_kind)) {
-      access.type = TypeCache::Get().kFixedArrayLengthType;
-      access.machine_type = MachineType::TaggedSigned();
-      access.write_barrier_kind = kNoWriteBarrier;
-    } else {
-      access.type = TypeCache::Get().kJSArrayLengthType;
-    }
-  } else if (instance_type == JS_TYPED_ARRAY_TYPE) {
-    access.type = TypeCache::Get().kJSTypedArrayLengthType;
-    access.machine_type = MachineType::TaggedSigned();
-    access.write_barrier_kind = kNoWriteBarrier;
-  }
   return access;
 }
 
 // static
-FieldAccess AccessBuilder::ForJSArrayIteratorObjectMap() {
-  FieldAccess access = {
-      kTaggedBase,           JSArrayIterator::kIteratedObjectMapOffset,
-      Handle<Name>(),        MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::TaggedPointer(),
-      kPointerWriteBarrier};
+FieldAccess AccessBuilder::ForJSArrayIteratorKind() {
+  FieldAccess access = {kTaggedBase,
+                        JSArrayIterator::kKindOffset,
+                        Handle<Name>(),
+                        MaybeHandle<Map>(),
+                        TypeCache::Get().kJSArrayIteratorKindType,
+                        MachineType::TaggedSigned(),
+                        kNoWriteBarrier};
   return access;
 }
 
@@ -1001,6 +985,10 @@ ElementAccess AccessBuilder::ForTypedArrayElement(ExternalArrayType type,
                               MachineType::Float64(), kNoWriteBarrier};
       return access;
     }
+    case kExternalBigInt64Array:
+    case kExternalBigUint64Array:
+      // TODO(neis/jkummerow): Define appropriate types.
+      UNIMPLEMENTED();
   }
   UNREACHABLE();
 }
diff --git a/deps/v8/src/compiler/access-builder.h b/deps/v8/src/compiler/access-builder.h
index a2ce1f800b0..44298c2188e 100644
--- a/deps/v8/src/compiler/access-builder.h
+++ b/deps/v8/src/compiler/access-builder.h
@@ -70,8 +70,8 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   // Provides access to JSFunction::shared() field.
   static FieldAccess ForJSFunctionSharedFunctionInfo();
 
-  // Provides access to JSFunction::feedback_vector() field.
-  static FieldAccess ForJSFunctionFeedbackVector();
+  // Provides access to JSFunction::feedback_cell() field.
+  static FieldAccess ForJSFunctionFeedbackCell();
 
   // Provides access to JSFunction::code() field.
   static FieldAccess ForJSFunctionCode();
@@ -109,8 +109,8 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   // Provides access to JSAsyncGeneratorObject::queue() field.
   static FieldAccess ForJSAsyncGeneratorObjectQueue();
 
-  // Provides access to JSAsyncGeneratorObject::awaited_promise() field.
-  static FieldAccess ForJSAsyncGeneratorObjectAwaitedPromise();
+  // Provides access to JSAsyncGeneratorObject::is_awaiting() field.
+  static FieldAccess ForJSAsyncGeneratorObjectIsAwaiting();
 
   // Provides access to JSArray::length() field.
   static FieldAccess ForJSArrayLength(ElementsKind elements_kind);
@@ -241,15 +241,14 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   // Provides access to JSGlobalProxy::native_context() field.
   static FieldAccess ForJSGlobalProxyNativeContext();
 
-  // Provides access to JSArrayIterator::object() field.
-  static FieldAccess ForJSArrayIteratorObject();
+  // Provides access to JSArrayIterator::iterated_object() field.
+  static FieldAccess ForJSArrayIteratorIteratedObject();
 
-  // Provides access to JSArrayIterator::index() field.
-  static FieldAccess ForJSArrayIteratorIndex(InstanceType type = JS_OBJECT_TYPE,
-                                             ElementsKind kind = NO_ELEMENTS);
+  // Provides access to JSArrayIterator::next_index() field.
+  static FieldAccess ForJSArrayIteratorNextIndex();
 
-  // Provides access to JSArrayIterator::object_map() field.
-  static FieldAccess ForJSArrayIteratorObjectMap();
+  // Provides access to JSArrayIterator::kind() field.
+  static FieldAccess ForJSArrayIteratorKind();
 
   // Provides access to JSStringIterator::string() field.
   static FieldAccess ForJSStringIteratorString();
diff --git a/deps/v8/src/compiler/access-info.cc b/deps/v8/src/compiler/access-info.cc
index 9b0c4b41b1f..c1254e4cdbb 100644
--- a/deps/v8/src/compiler/access-info.cc
+++ b/deps/v8/src/compiler/access-info.cc
@@ -25,7 +25,11 @@ bool CanInlineElementAccess(Handle<Map> map) {
   if (map->has_indexed_interceptor()) return false;
   ElementsKind const elements_kind = map->elements_kind();
   if (IsFastElementsKind(elements_kind)) return true;
-  if (IsFixedTypedArrayElementsKind(elements_kind)) return true;
+  if (IsFixedTypedArrayElementsKind(elements_kind) &&
+      elements_kind != BIGUINT64_ELEMENTS &&
+      elements_kind != BIGINT64_ELEMENTS) {
+    return true;
+  }
   return false;
 }
 
@@ -533,6 +537,18 @@ bool AccessInfoFactory::ComputePropertyAccessInfo(
   return false;
 }
 
+bool AccessInfoFactory::ComputePropertyAccessInfo(
+    MapHandles const& maps, Handle<Name> name, AccessMode access_mode,
+    PropertyAccessInfo* access_info) {
+  ZoneVector<PropertyAccessInfo> access_infos(zone());
+  if (ComputePropertyAccessInfos(maps, name, access_mode, &access_infos) &&
+      access_infos.size() == 1) {
+    *access_info = access_infos.front();
+    return true;
+  }
+  return false;
+}
+
 bool AccessInfoFactory::ComputePropertyAccessInfos(
     MapHandles const& maps, Handle<Name> name, AccessMode access_mode,
     ZoneVector<PropertyAccessInfo>* access_infos) {
diff --git a/deps/v8/src/compiler/access-info.h b/deps/v8/src/compiler/access-info.h
index dcdb0f35f04..54d402738ba 100644
--- a/deps/v8/src/compiler/access-info.h
+++ b/deps/v8/src/compiler/access-info.h
@@ -149,6 +149,9 @@ class AccessInfoFactory final {
   bool ComputePropertyAccessInfo(Handle<Map> map, Handle<Name> name,
                                  AccessMode access_mode,
                                  PropertyAccessInfo* access_info);
+  bool ComputePropertyAccessInfo(MapHandles const& maps, Handle<Name> name,
+                                 AccessMode access_mode,
+                                 PropertyAccessInfo* access_info);
   bool ComputePropertyAccessInfos(MapHandles const& maps, Handle<Name> name,
                                   AccessMode access_mode,
                                   ZoneVector<PropertyAccessInfo>* access_infos);
diff --git a/deps/v8/src/compiler/allocation-builder.h b/deps/v8/src/compiler/allocation-builder.h
index a0ba02cd337..86fea330900 100644
--- a/deps/v8/src/compiler/allocation-builder.h
+++ b/deps/v8/src/compiler/allocation-builder.h
@@ -48,6 +48,16 @@ class AllocationBuilder final {
                                index, value, effect_, control_);
   }
 
+  // Compound allocation of a context.
+  void AllocateContext(int length, Handle<Map> map) {
+    DCHECK(map->instance_type() >= BLOCK_CONTEXT_TYPE &&
+           map->instance_type() <= WITH_CONTEXT_TYPE);
+    int size = FixedArray::SizeFor(length);
+    Allocate(size, NOT_TENURED, Type::OtherInternal());
+    Store(AccessBuilder::ForMap(), map);
+    Store(AccessBuilder::ForFixedArrayLength(), jsgraph()->Constant(length));
+  }
+
   // Compound allocation of a FixedArray.
   void AllocateArray(int length, Handle<Map> map,
                      PretenureFlag pretenure = NOT_TENURED) {
diff --git a/deps/v8/src/compiler/arm/code-generator-arm.cc b/deps/v8/src/compiler/arm/code-generator-arm.cc
index a238cf29d46..bb417015b87 100644
--- a/deps/v8/src/compiler/arm/code-generator-arm.cc
+++ b/deps/v8/src/compiler/arm/code-generator-arm.cc
@@ -21,9 +21,6 @@ namespace compiler {
 
 #define __ tasm()->
 
-#define kScratchReg r9
-
-
 // Adds Arm-specific methods to convert InstructionOperands.
 class ArmOperandConverter final : public InstructionOperandConverter {
  public:
@@ -33,7 +30,9 @@ class ArmOperandConverter final : public InstructionOperandConverter {
   SBit OutputSBit() const {
     switch (instr_->flags_mode()) {
       case kFlags_branch:
+      case kFlags_branch_and_poison:
       case kFlags_deoptimize:
+      case kFlags_deoptimize_and_poison:
       case kFlags_set:
       case kFlags_trap:
         return SetCC;
@@ -44,21 +43,7 @@ class ArmOperandConverter final : public InstructionOperandConverter {
   }
 
   Operand InputImmediate(size_t index) {
-    Constant constant = ToConstant(instr_->InputAt(index));
-    switch (constant.type()) {
-      case Constant::kInt32:
-        return Operand(constant.ToInt32());
-      case Constant::kFloat32:
-        return Operand::EmbeddedNumber(constant.ToFloat32());
-      case Constant::kFloat64:
-        return Operand::EmbeddedNumber(constant.ToFloat64().value());
-      case Constant::kInt64:
-      case Constant::kExternalReference:
-      case Constant::kHeapObject:
-      case Constant::kRpoNumber:
-        break;
-    }
-    UNREACHABLE();
+    return ToImmediate(instr_->InputAt(index));
   }
 
   Operand InputOperand2(size_t first_index) {
@@ -124,6 +109,30 @@ class ArmOperandConverter final : public InstructionOperandConverter {
     return InputOffset(&first_index);
   }
 
+  Operand ToImmediate(InstructionOperand* operand) {
+    Constant constant = ToConstant(operand);
+    switch (constant.type()) {
+      case Constant::kInt32:
+        if (RelocInfo::IsWasmReference(constant.rmode())) {
+          return Operand(constant.ToInt32(), constant.rmode());
+        } else {
+          return Operand(constant.ToInt32());
+        }
+      case Constant::kFloat32:
+        return Operand::EmbeddedNumber(constant.ToFloat32());
+      case Constant::kFloat64:
+        return Operand::EmbeddedNumber(constant.ToFloat64().value());
+      case Constant::kExternalReference:
+        return Operand(constant.ToExternalReference());
+      case Constant::kInt64:
+      case Constant::kHeapObject:
+      // TODO(dcarney): loading RPO constants on arm.
+      case Constant::kRpoNumber:
+        break;
+    }
+    UNREACHABLE();
+  }
+
   MemOperand ToMemOperand(InstructionOperand* op) const {
     DCHECK_NOT_NULL(op);
     DCHECK(op->IsStackSlot() || op->IsFPStackSlot());
@@ -314,6 +323,36 @@ Condition FlagsConditionToCondition(FlagsCondition condition) {
   UNREACHABLE();
 }
 
+void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
+                                   InstructionCode opcode,
+                                   ArmOperandConverter& i) {
+  const MemoryAccessMode access_mode =
+      static_cast<MemoryAccessMode>(MiscField::decode(opcode));
+  if (access_mode == kMemoryAccessPoisoned) {
+    Register value = i.OutputRegister();
+    codegen->tasm()->and_(value, value, Operand(kSpeculationPoisonRegister));
+  }
+}
+
+void ComputePoisonedAddressForLoad(CodeGenerator* codegen,
+                                   InstructionCode opcode,
+                                   ArmOperandConverter& i, Register address) {
+  DCHECK_EQ(kMemoryAccessPoisoned,
+            static_cast<MemoryAccessMode>(MiscField::decode(opcode)));
+  switch (AddressingModeField::decode(opcode)) {
+    case kMode_Offset_RI:
+      codegen->tasm()->mov(address, i.InputImmediate(1));
+      codegen->tasm()->add(address, address, i.InputRegister(0));
+      break;
+    case kMode_Offset_RR:
+      codegen->tasm()->add(address, i.InputRegister(0), i.InputRegister(1));
+      break;
+    default:
+      UNREACHABLE();
+  }
+  codegen->tasm()->and_(address, address, Operand(kSpeculationPoisonRegister));
+}
+
 }  // namespace
 
 #define ASSEMBLE_ATOMIC_LOAD_INTEGER(asm_instr)                       \
@@ -571,28 +610,54 @@ void CodeGenerator::AssembleTailCallAfterGap(Instruction* instr,
                                 first_unused_stack_slot);
 }
 
+// Check that {kJavaScriptCallCodeStartRegister} is correct.
+void CodeGenerator::AssembleCodeStartRegisterCheck() {
+  UseScratchRegisterScope temps(tasm());
+  Register scratch = temps.Acquire();
+  __ ComputeCodeStartAddress(scratch);
+  __ cmp(scratch, kJavaScriptCallCodeStartRegister);
+  __ Assert(eq, AbortReason::kWrongFunctionCodeStart);
+}
+
 // Check if the code object is marked for deoptimization. If it is, then it
 // jumps to the CompileLazyDeoptimizedCode builtin. In order to do this we need
 // to:
-//    1. compute the offset of the {CodeDataContainer} from our current location
-//       and load it.
-//    2. read from memory the word that contains that bit, which can be found in
+//    1. read from memory the word that contains that bit, which can be found in
 //       the flags in the referenced {CodeDataContainer} object;
-//    3. test kMarkedForDeoptimizationBit in those flags; and
-//    4. if it is not zero then it jumps to the builtin.
+//    2. test kMarkedForDeoptimizationBit in those flags; and
+//    3. if it is not zero then it jumps to the builtin.
 void CodeGenerator::BailoutIfDeoptimized() {
-  int pc_offset = __ pc_offset();
-  int offset = Code::kCodeDataContainerOffset -
-               (Code::kHeaderSize + pc_offset + TurboAssembler::kPcLoadDelta);
-  // We can use the register pc - 8 for the address of the current instruction.
-  __ ldr_pcrel(ip, offset);
-  __ ldr(ip, FieldMemOperand(ip, CodeDataContainer::kKindSpecificFlagsOffset));
-  __ tst(ip, Operand(1 << Code::kMarkedForDeoptimizationBit));
+  UseScratchRegisterScope temps(tasm());
+  Register scratch = temps.Acquire();
+  int offset = Code::kCodeDataContainerOffset - Code::kHeaderSize;
+  __ ldr(scratch, MemOperand(kJavaScriptCallCodeStartRegister, offset));
+  __ ldr(scratch,
+         FieldMemOperand(scratch, CodeDataContainer::kKindSpecificFlagsOffset));
+  __ tst(scratch, Operand(1 << Code::kMarkedForDeoptimizationBit));
   Handle<Code> code = isolate()->builtins()->builtin_handle(
       Builtins::kCompileLazyDeoptimizedCode);
   __ Jump(code, RelocInfo::CODE_TARGET, ne);
 }
 
+void CodeGenerator::GenerateSpeculationPoisonFromCodeStartRegister() {
+  UseScratchRegisterScope temps(tasm());
+  Register scratch = temps.Acquire();
+
+  // Set a mask which has all bits set in the normal case, but has all
+  // bits cleared if we are speculatively executing the wrong PC.
+  __ ComputeCodeStartAddress(scratch);
+  __ cmp(kJavaScriptCallCodeStartRegister, scratch);
+  __ mov(kSpeculationPoisonRegister, Operand(-1), SBit::LeaveCC, eq);
+  __ mov(kSpeculationPoisonRegister, Operand(0), SBit::LeaveCC, ne);
+  __ csdb();
+}
+
+void CodeGenerator::AssembleRegisterArgumentPoisoning() {
+  __ and_(kJSFunctionRegister, kJSFunctionRegister, kSpeculationPoisonRegister);
+  __ and_(kContextRegister, kContextRegister, kSpeculationPoisonRegister);
+  __ and_(sp, sp, kSpeculationPoisonRegister);
+}
+
 // Assembles an instruction after register allocation, producing machine code.
 CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     Instruction* instr) {
@@ -611,9 +676,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       if (instr->InputAt(0)->IsImmediate()) {
         __ Call(i.InputCode(0), RelocInfo::CODE_TARGET);
       } else {
-        __ add(ip, i.InputRegister(0),
+        UseScratchRegisterScope temps(tasm());
+        Register scratch = temps.Acquire();
+        __ add(scratch, i.InputRegister(0),
                Operand(Code::kHeaderSize - kHeapObjectTag));
-        __ Call(ip);
+        __ Call(scratch);
       }
       RecordCallPosition(instr);
       DCHECK_EQ(LeaveCC, i.OutputSBit());
@@ -657,9 +724,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       if (instr->InputAt(0)->IsImmediate()) {
         __ Jump(i.InputCode(0), RelocInfo::CODE_TARGET);
       } else {
-        __ add(ip, i.InputRegister(0),
+        UseScratchRegisterScope temps(tasm());
+        Register scratch = temps.Acquire();
+        __ add(scratch, i.InputRegister(0),
                Operand(Code::kHeaderSize - kHeapObjectTag));
-        __ Jump(ip);
+        __ Jump(scratch);
       }
       DCHECK_EQ(LeaveCC, i.OutputSBit());
       unwinding_info_writer_.MarkBlockWillExit();
@@ -701,14 +770,17 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchCallJSFunction: {
       Register func = i.InputRegister(0);
       if (FLAG_debug_code) {
+        UseScratchRegisterScope temps(tasm());
+        Register scratch = temps.Acquire();
         // Check the function's context matches the context argument.
-        __ ldr(kScratchReg, FieldMemOperand(func, JSFunction::kContextOffset));
-        __ cmp(cp, kScratchReg);
+        __ ldr(scratch, FieldMemOperand(func, JSFunction::kContextOffset));
+        __ cmp(cp, scratch);
         __ Assert(eq, AbortReason::kWrongFunctionContext);
       }
-      __ ldr(ip, FieldMemOperand(func, JSFunction::kCodeOffset));
-      __ add(ip, ip, Operand(Code::kHeaderSize - kHeapObjectTag));
-      __ Call(ip);
+      static_assert(kJavaScriptCallCodeStartRegister == r2, "ABI mismatch");
+      __ ldr(r2, FieldMemOperand(func, JSFunction::kCodeOffset));
+      __ add(r2, r2, Operand(Code::kHeaderSize - kHeapObjectTag));
+      __ Call(r2);
       RecordCallPosition(instr);
       DCHECK_EQ(LeaveCC, i.OutputSBit());
       frame_access_state()->ClearSPDelta();
@@ -843,6 +915,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), fp);
       }
       break;
+    case kArchRootsPointer:
+      __ mov(i.OutputRegister(), kRootRegister);
+      DCHECK_EQ(LeaveCC, i.OutputSBit());
+      break;
     case kArchTruncateDoubleToI:
       __ TruncateDoubleToIDelayed(zone(), i.OutputRegister(),
                                   i.InputDoubleRegister(0));
@@ -1154,7 +1230,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                    i.InputRegister(1), i.InputInt32(2));
       } else {
         __ LslPair(i.OutputRegister(0), second_output, i.InputRegister(0),
-                   i.InputRegister(1), kScratchReg, i.InputRegister(2));
+                   i.InputRegister(1), i.InputRegister(2));
       }
       break;
     }
@@ -1166,7 +1242,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                    i.InputRegister(1), i.InputInt32(2));
       } else {
         __ LsrPair(i.OutputRegister(0), second_output, i.InputRegister(0),
-                   i.InputRegister(1), kScratchReg, i.InputRegister(2));
+                   i.InputRegister(1), i.InputRegister(2));
       }
       break;
     }
@@ -1178,7 +1254,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                    i.InputRegister(1), i.InputInt32(2));
       } else {
         __ AsrPair(i.OutputRegister(0), second_output, i.InputRegister(0),
-                   i.InputRegister(1), kScratchReg, i.InputRegister(2));
+                   i.InputRegister(1), i.InputRegister(2));
       }
       break;
     }
@@ -1354,35 +1430,40 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kArmVcvtF32S32: {
-      SwVfpRegister scratch = kScratchDoubleReg.low();
+      UseScratchRegisterScope temps(tasm());
+      SwVfpRegister scratch = temps.AcquireS();
       __ vmov(scratch, i.InputRegister(0));
       __ vcvt_f32_s32(i.OutputFloatRegister(), scratch);
       DCHECK_EQ(LeaveCC, i.OutputSBit());
       break;
     }
     case kArmVcvtF32U32: {
-      SwVfpRegister scratch = kScratchDoubleReg.low();
+      UseScratchRegisterScope temps(tasm());
+      SwVfpRegister scratch = temps.AcquireS();
       __ vmov(scratch, i.InputRegister(0));
       __ vcvt_f32_u32(i.OutputFloatRegister(), scratch);
       DCHECK_EQ(LeaveCC, i.OutputSBit());
       break;
     }
     case kArmVcvtF64S32: {
-      SwVfpRegister scratch = kScratchDoubleReg.low();
+      UseScratchRegisterScope temps(tasm());
+      SwVfpRegister scratch = temps.AcquireS();
       __ vmov(scratch, i.InputRegister(0));
       __ vcvt_f64_s32(i.OutputDoubleRegister(), scratch);
       DCHECK_EQ(LeaveCC, i.OutputSBit());
       break;
     }
     case kArmVcvtF64U32: {
-      SwVfpRegister scratch = kScratchDoubleReg.low();
+      UseScratchRegisterScope temps(tasm());
+      SwVfpRegister scratch = temps.AcquireS();
       __ vmov(scratch, i.InputRegister(0));
       __ vcvt_f64_u32(i.OutputDoubleRegister(), scratch);
       DCHECK_EQ(LeaveCC, i.OutputSBit());
       break;
     }
     case kArmVcvtS32F32: {
-      SwVfpRegister scratch = kScratchDoubleReg.low();
+      UseScratchRegisterScope temps(tasm());
+      SwVfpRegister scratch = temps.AcquireS();
       __ vcvt_s32_f32(scratch, i.InputFloatRegister(0));
       __ vmov(i.OutputRegister(), scratch);
       // Avoid INT32_MAX as an overflow indicator and use INT32_MIN instead,
@@ -1393,7 +1474,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kArmVcvtU32F32: {
-      SwVfpRegister scratch = kScratchDoubleReg.low();
+      UseScratchRegisterScope temps(tasm());
+      SwVfpRegister scratch = temps.AcquireS();
       __ vcvt_u32_f32(scratch, i.InputFloatRegister(0));
       __ vmov(i.OutputRegister(), scratch);
       // Avoid UINT32_MAX as an overflow indicator and use 0 instead,
@@ -1404,14 +1486,16 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kArmVcvtS32F64: {
-      SwVfpRegister scratch = kScratchDoubleReg.low();
+      UseScratchRegisterScope temps(tasm());
+      SwVfpRegister scratch = temps.AcquireS();
       __ vcvt_s32_f64(scratch, i.InputDoubleRegister(0));
       __ vmov(i.OutputRegister(), scratch);
       DCHECK_EQ(LeaveCC, i.OutputSBit());
       break;
     }
     case kArmVcvtU32F64: {
-      SwVfpRegister scratch = kScratchDoubleReg.low();
+      UseScratchRegisterScope temps(tasm());
+      SwVfpRegister scratch = temps.AcquireS();
       __ vcvt_u32_f64(scratch, i.InputDoubleRegister(0));
       __ vmov(i.OutputRegister(), scratch);
       DCHECK_EQ(LeaveCC, i.OutputSBit());
@@ -1453,10 +1537,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArmLdrb:
       __ ldrb(i.OutputRegister(), i.InputOffset());
       DCHECK_EQ(LeaveCC, i.OutputSBit());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, i);
       break;
     case kArmLdrsb:
       __ ldrsb(i.OutputRegister(), i.InputOffset());
       DCHECK_EQ(LeaveCC, i.OutputSBit());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, i);
       break;
     case kArmStrb:
       __ strb(i.InputRegister(0), i.InputOffset(1));
@@ -1464,9 +1550,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     case kArmLdrh:
       __ ldrh(i.OutputRegister(), i.InputOffset());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, i);
       break;
     case kArmLdrsh:
       __ ldrsh(i.OutputRegister(), i.InputOffset());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, i);
       break;
     case kArmStrh:
       __ strh(i.InputRegister(0), i.InputOffset(1));
@@ -1474,13 +1562,23 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     case kArmLdr:
       __ ldr(i.OutputRegister(), i.InputOffset());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, i);
       break;
     case kArmStr:
       __ str(i.InputRegister(0), i.InputOffset(1));
       DCHECK_EQ(LeaveCC, i.OutputSBit());
       break;
     case kArmVldrF32: {
-      __ vldr(i.OutputFloatRegister(), i.InputOffset());
+      const MemoryAccessMode access_mode =
+          static_cast<MemoryAccessMode>(MiscField::decode(opcode));
+      if (access_mode == kMemoryAccessPoisoned) {
+        UseScratchRegisterScope temps(tasm());
+        Register address = temps.Acquire();
+        ComputePoisonedAddressForLoad(this, opcode, i, address);
+        __ vldr(i.OutputFloatRegister(), address, 0);
+      } else {
+        __ vldr(i.OutputFloatRegister(), i.InputOffset());
+      }
       DCHECK_EQ(LeaveCC, i.OutputSBit());
       break;
     }
@@ -1508,10 +1606,20 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
               i.NeonInputOperand(1));
       break;
     }
-    case kArmVldrF64:
-      __ vldr(i.OutputDoubleRegister(), i.InputOffset());
+    case kArmVldrF64: {
+      const MemoryAccessMode access_mode =
+          static_cast<MemoryAccessMode>(MiscField::decode(opcode));
+      if (access_mode == kMemoryAccessPoisoned) {
+        UseScratchRegisterScope temps(tasm());
+        Register address = temps.Acquire();
+        ComputePoisonedAddressForLoad(this, opcode, i, address);
+        __ vldr(i.OutputDoubleRegister(), address, 0);
+      } else {
+        __ vldr(i.OutputDoubleRegister(), i.InputOffset());
+      }
       DCHECK_EQ(LeaveCC, i.OutputSBit());
       break;
+    }
     case kArmVstrF64:
       __ vstr(i.InputDoubleRegister(0), i.InputOffset(1));
       DCHECK_EQ(LeaveCC, i.OutputSBit());
@@ -1629,6 +1737,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     }
+    case kArmDsbIsb: {
+      __ dsb(SY);
+      __ isb(SY);
+      break;
+    }
+    case kArchPoisonOnSpeculationWord:
+      __ and_(i.OutputRegister(0), i.InputRegister(0),
+              Operand(kSpeculationPoisonRegister));
+      break;
     case kArmF32x4Splat: {
       int src_code = i.InputFloatRegister(0).code();
       __ vdup(Neon32, i.OutputSimd128Register(),
@@ -2202,41 +2319,50 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       Simd128Register dst = i.OutputSimd128Register(),
                       src1 = i.InputSimd128Register(1);
       DCHECK(dst == i.InputSimd128Register(0));
+      UseScratchRegisterScope temps(tasm());
+      Simd128Register scratch = temps.AcquireQ();
       // src0 = [0, 1, 2, 3], src1 = [4, 5, 6, 7]
-      __ vmov(kScratchQuadReg, src1);
-      __ vuzp(Neon32, dst, kScratchQuadReg);  // dst = [0, 2, 4, 6]
+      __ vmov(scratch, src1);
+      __ vuzp(Neon32, dst, scratch);  // dst = [0, 2, 4, 6]
       break;
     }
     case kArmS32x4UnzipRight: {
       Simd128Register dst = i.OutputSimd128Register(),
                       src1 = i.InputSimd128Register(1);
       DCHECK(dst == i.InputSimd128Register(0));
+      UseScratchRegisterScope temps(tasm());
+      Simd128Register scratch = temps.AcquireQ();
       // src0 = [4, 5, 6, 7], src1 = [0, 1, 2, 3] (flipped from UnzipLeft).
-      __ vmov(kScratchQuadReg, src1);
-      __ vuzp(Neon32, kScratchQuadReg, dst);  // dst = [1, 3, 5, 7]
+      __ vmov(scratch, src1);
+      __ vuzp(Neon32, scratch, dst);  // dst = [1, 3, 5, 7]
       break;
     }
     case kArmS32x4TransposeLeft: {
       Simd128Register dst = i.OutputSimd128Register(),
                       src1 = i.InputSimd128Register(1);
       DCHECK(dst == i.InputSimd128Register(0));
+      UseScratchRegisterScope temps(tasm());
+      Simd128Register scratch = temps.AcquireQ();
       // src0 = [0, 1, 2, 3], src1 = [4, 5, 6, 7]
-      __ vmov(kScratchQuadReg, src1);
-      __ vtrn(Neon32, dst, kScratchQuadReg);  // dst = [0, 4, 2, 6]
+      __ vmov(scratch, src1);
+      __ vtrn(Neon32, dst, scratch);  // dst = [0, 4, 2, 6]
       break;
     }
     case kArmS32x4Shuffle: {
       Simd128Register dst = i.OutputSimd128Register(),
                       src0 = i.InputSimd128Register(0),
                       src1 = i.InputSimd128Register(1);
+      UseScratchRegisterScope temps(tasm());
       // Check for in-place shuffles.
       // If dst == src0 == src1, then the shuffle is unary and we only use src0.
       if (dst == src0) {
-        __ vmov(kScratchQuadReg, src0);
-        src0 = kScratchQuadReg;
+        Simd128Register scratch = temps.AcquireQ();
+        __ vmov(scratch, src0);
+        src0 = scratch;
       } else if (dst == src1) {
-        __ vmov(kScratchQuadReg, src1);
-        src1 = kScratchQuadReg;
+        Simd128Register scratch = temps.AcquireQ();
+        __ vmov(scratch, src1);
+        src1 = scratch;
       }
       // Perform shuffle as a vmov per lane.
       int dst_code = dst.code() * 4;
@@ -2258,10 +2384,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArmS32x4TransposeRight: {
       Simd128Register dst = i.OutputSimd128Register(),
                       src1 = i.InputSimd128Register(1);
+      UseScratchRegisterScope temps(tasm());
+      Simd128Register scratch = temps.AcquireQ();
       DCHECK(dst == i.InputSimd128Register(0));
       // src0 = [4, 5, 6, 7], src1 = [0, 1, 2, 3] (flipped from TransposeLeft).
-      __ vmov(kScratchQuadReg, src1);
-      __ vtrn(Neon32, kScratchQuadReg, dst);  // dst = [1, 5, 3, 7]
+      __ vmov(scratch, src1);
+      __ vtrn(Neon32, scratch, dst);  // dst = [1, 5, 3, 7]
       break;
     }
     case kArmS16x8ZipLeft: {
@@ -2285,37 +2413,45 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArmS16x8UnzipLeft: {
       Simd128Register dst = i.OutputSimd128Register(),
                       src1 = i.InputSimd128Register(1);
+      UseScratchRegisterScope temps(tasm());
+      Simd128Register scratch = temps.AcquireQ();
       DCHECK(dst == i.InputSimd128Register(0));
       // src0 = [0, 1, 2, 3, ... 7], src1 = [8, 9, 10, 11, ... 15]
-      __ vmov(kScratchQuadReg, src1);
-      __ vuzp(Neon16, dst, kScratchQuadReg);  // dst = [0, 2, 4, 6, ... 14]
+      __ vmov(scratch, src1);
+      __ vuzp(Neon16, dst, scratch);  // dst = [0, 2, 4, 6, ... 14]
       break;
     }
     case kArmS16x8UnzipRight: {
       Simd128Register dst = i.OutputSimd128Register(),
                       src1 = i.InputSimd128Register(1);
+      UseScratchRegisterScope temps(tasm());
+      Simd128Register scratch = temps.AcquireQ();
       DCHECK(dst == i.InputSimd128Register(0));
       // src0 = [8, 9, 10, 11, ... 15], src1 = [0, 1, 2, 3, ... 7] (flipped).
-      __ vmov(kScratchQuadReg, src1);
-      __ vuzp(Neon16, kScratchQuadReg, dst);  // dst = [1, 3, 5, 7, ... 15]
+      __ vmov(scratch, src1);
+      __ vuzp(Neon16, scratch, dst);  // dst = [1, 3, 5, 7, ... 15]
       break;
     }
     case kArmS16x8TransposeLeft: {
       Simd128Register dst = i.OutputSimd128Register(),
                       src1 = i.InputSimd128Register(1);
+      UseScratchRegisterScope temps(tasm());
+      Simd128Register scratch = temps.AcquireQ();
       DCHECK(dst == i.InputSimd128Register(0));
       // src0 = [0, 1, 2, 3, ... 7], src1 = [8, 9, 10, 11, ... 15]
-      __ vmov(kScratchQuadReg, src1);
-      __ vtrn(Neon16, dst, kScratchQuadReg);  // dst = [0, 8, 2, 10, ... 14]
+      __ vmov(scratch, src1);
+      __ vtrn(Neon16, dst, scratch);  // dst = [0, 8, 2, 10, ... 14]
       break;
     }
     case kArmS16x8TransposeRight: {
       Simd128Register dst = i.OutputSimd128Register(),
                       src1 = i.InputSimd128Register(1);
+      UseScratchRegisterScope temps(tasm());
+      Simd128Register scratch = temps.AcquireQ();
       DCHECK(dst == i.InputSimd128Register(0));
       // src0 = [8, 9, 10, 11, ... 15], src1 = [0, 1, 2, 3, ... 7] (flipped).
-      __ vmov(kScratchQuadReg, src1);
-      __ vtrn(Neon16, kScratchQuadReg, dst);  // dst = [1, 9, 3, 11, ... 15]
+      __ vmov(scratch, src1);
+      __ vtrn(Neon16, scratch, dst);  // dst = [1, 9, 3, 11, ... 15]
       break;
     }
     case kArmS8x16ZipLeft: {
@@ -2339,37 +2475,45 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArmS8x16UnzipLeft: {
       Simd128Register dst = i.OutputSimd128Register(),
                       src1 = i.InputSimd128Register(1);
+      UseScratchRegisterScope temps(tasm());
+      Simd128Register scratch = temps.AcquireQ();
       DCHECK(dst == i.InputSimd128Register(0));
       // src0 = [0, 1, 2, 3, ... 15], src1 = [16, 17, 18, 19, ... 31]
-      __ vmov(kScratchQuadReg, src1);
-      __ vuzp(Neon8, dst, kScratchQuadReg);  // dst = [0, 2, 4, 6, ... 30]
+      __ vmov(scratch, src1);
+      __ vuzp(Neon8, dst, scratch);  // dst = [0, 2, 4, 6, ... 30]
       break;
     }
     case kArmS8x16UnzipRight: {
       Simd128Register dst = i.OutputSimd128Register(),
                       src1 = i.InputSimd128Register(1);
+      UseScratchRegisterScope temps(tasm());
+      Simd128Register scratch = temps.AcquireQ();
       DCHECK(dst == i.InputSimd128Register(0));
       // src0 = [16, 17, 18, 19, ... 31], src1 = [0, 1, 2, 3, ... 15] (flipped).
-      __ vmov(kScratchQuadReg, src1);
-      __ vuzp(Neon8, kScratchQuadReg, dst);  // dst = [1, 3, 5, 7, ... 31]
+      __ vmov(scratch, src1);
+      __ vuzp(Neon8, scratch, dst);  // dst = [1, 3, 5, 7, ... 31]
       break;
     }
     case kArmS8x16TransposeLeft: {
       Simd128Register dst = i.OutputSimd128Register(),
                       src1 = i.InputSimd128Register(1);
+      UseScratchRegisterScope temps(tasm());
+      Simd128Register scratch = temps.AcquireQ();
       DCHECK(dst == i.InputSimd128Register(0));
       // src0 = [0, 1, 2, 3, ... 15], src1 = [16, 17, 18, 19, ... 31]
-      __ vmov(kScratchQuadReg, src1);
-      __ vtrn(Neon8, dst, kScratchQuadReg);  // dst = [0, 16, 2, 18, ... 30]
+      __ vmov(scratch, src1);
+      __ vtrn(Neon8, dst, scratch);  // dst = [0, 16, 2, 18, ... 30]
       break;
     }
     case kArmS8x16TransposeRight: {
       Simd128Register dst = i.OutputSimd128Register(),
                       src1 = i.InputSimd128Register(1);
+      UseScratchRegisterScope temps(tasm());
+      Simd128Register scratch = temps.AcquireQ();
       DCHECK(dst == i.InputSimd128Register(0));
       // src0 = [16, 17, 18, 19, ... 31], src1 = [0, 1, 2, 3, ... 15] (flipped).
-      __ vmov(kScratchQuadReg, src1);
-      __ vtrn(Neon8, kScratchQuadReg, dst);  // dst = [1, 17, 3, 19, ... 31]
+      __ vmov(scratch, src1);
+      __ vtrn(Neon8, scratch, dst);  // dst = [1, 17, 3, 19, ... 31]
       break;
     }
     case kArmS8x16Concat: {
@@ -2382,12 +2526,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                       src0 = i.InputSimd128Register(0),
                       src1 = i.InputSimd128Register(1);
       DwVfpRegister table_base = src0.low();
+      UseScratchRegisterScope temps(tasm());
+      Simd128Register scratch = temps.AcquireQ();
       // If unary shuffle, table is src0 (2 d-registers), otherwise src0 and
       // src1. They must be consecutive.
       int table_size = src0 == src1 ? 2 : 4;
       DCHECK_IMPLIES(src0 != src1, src0.code() + 1 == src1.code());
-      // The shuffle lane mask is a byte mask, materialize in kScratchQuadReg.
-      int scratch_s_base = kScratchQuadReg.code() * 4;
+      // The shuffle lane mask is a byte mask, materialize in scratch.
+      int scratch_s_base = scratch.code() * 4;
       for (int j = 0; j < 4; j++) {
         uint32_t four_lanes = i.InputUint32(2 + j);
         // Ensure byte indices are in [0, 31] so masks are never NaNs.
@@ -2397,12 +2543,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       NeonListOperand table(table_base, table_size);
       if (dst != src0 && dst != src1) {
-        __ vtbl(dst.low(), table, kScratchQuadReg.low());
-        __ vtbl(dst.high(), table, kScratchQuadReg.high());
+        __ vtbl(dst.low(), table, scratch.low());
+        __ vtbl(dst.high(), table, scratch.high());
       } else {
-        __ vtbl(kScratchQuadReg.low(), table, kScratchQuadReg.low());
-        __ vtbl(kScratchQuadReg.high(), table, kScratchQuadReg.high());
-        __ vmov(dst, kScratchQuadReg);
+        __ vtbl(scratch.low(), table, scratch.low());
+        __ vtbl(scratch.high(), table, scratch.high());
+        __ vmov(dst, scratch);
       }
       break;
     }
@@ -2432,149 +2578,156 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArmS1x4AnyTrue: {
       const QwNeonRegister& src = i.InputSimd128Register(0);
-      __ vpmax(NeonU32, kScratchDoubleReg, src.low(), src.high());
-      __ vpmax(NeonU32, kScratchDoubleReg, kScratchDoubleReg,
-               kScratchDoubleReg);
-      __ ExtractLane(i.OutputRegister(), kScratchDoubleReg, NeonS32, 0);
+      UseScratchRegisterScope temps(tasm());
+      DwVfpRegister scratch = temps.AcquireD();
+      __ vpmax(NeonU32, scratch, src.low(), src.high());
+      __ vpmax(NeonU32, scratch, scratch, scratch);
+      __ ExtractLane(i.OutputRegister(), scratch, NeonS32, 0);
       break;
     }
     case kArmS1x4AllTrue: {
       const QwNeonRegister& src = i.InputSimd128Register(0);
-      __ vpmin(NeonU32, kScratchDoubleReg, src.low(), src.high());
-      __ vpmin(NeonU32, kScratchDoubleReg, kScratchDoubleReg,
-               kScratchDoubleReg);
-      __ ExtractLane(i.OutputRegister(), kScratchDoubleReg, NeonS32, 0);
+      UseScratchRegisterScope temps(tasm());
+      DwVfpRegister scratch = temps.AcquireD();
+      __ vpmin(NeonU32, scratch, src.low(), src.high());
+      __ vpmin(NeonU32, scratch, scratch, scratch);
+      __ ExtractLane(i.OutputRegister(), scratch, NeonS32, 0);
       break;
     }
     case kArmS1x8AnyTrue: {
       const QwNeonRegister& src = i.InputSimd128Register(0);
-      __ vpmax(NeonU16, kScratchDoubleReg, src.low(), src.high());
-      __ vpmax(NeonU16, kScratchDoubleReg, kScratchDoubleReg,
-               kScratchDoubleReg);
-      __ vpmax(NeonU16, kScratchDoubleReg, kScratchDoubleReg,
-               kScratchDoubleReg);
-      __ ExtractLane(i.OutputRegister(), kScratchDoubleReg, NeonS16, 0);
+      UseScratchRegisterScope temps(tasm());
+      DwVfpRegister scratch = temps.AcquireD();
+      __ vpmax(NeonU16, scratch, src.low(), src.high());
+      __ vpmax(NeonU16, scratch, scratch, scratch);
+      __ vpmax(NeonU16, scratch, scratch, scratch);
+      __ ExtractLane(i.OutputRegister(), scratch, NeonS16, 0);
       break;
     }
     case kArmS1x8AllTrue: {
       const QwNeonRegister& src = i.InputSimd128Register(0);
-      __ vpmin(NeonU16, kScratchDoubleReg, src.low(), src.high());
-      __ vpmin(NeonU16, kScratchDoubleReg, kScratchDoubleReg,
-               kScratchDoubleReg);
-      __ vpmin(NeonU16, kScratchDoubleReg, kScratchDoubleReg,
-               kScratchDoubleReg);
-      __ ExtractLane(i.OutputRegister(), kScratchDoubleReg, NeonS16, 0);
+      UseScratchRegisterScope temps(tasm());
+      DwVfpRegister scratch = temps.AcquireD();
+      __ vpmin(NeonU16, scratch, src.low(), src.high());
+      __ vpmin(NeonU16, scratch, scratch, scratch);
+      __ vpmin(NeonU16, scratch, scratch, scratch);
+      __ ExtractLane(i.OutputRegister(), scratch, NeonS16, 0);
       break;
     }
     case kArmS1x16AnyTrue: {
       const QwNeonRegister& src = i.InputSimd128Register(0);
-      __ vpmax(NeonU8, kScratchDoubleReg, src.low(), src.high());
-      __ vpmax(NeonU8, kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
-      // vtst to detect any bits in the bottom 32 bits of kScratchDoubleReg.
+      UseScratchRegisterScope temps(tasm());
+      QwNeonRegister q_scratch = temps.AcquireQ();
+      DwVfpRegister d_scratch = q_scratch.low();
+      __ vpmax(NeonU8, d_scratch, src.low(), src.high());
+      __ vpmax(NeonU8, d_scratch, d_scratch, d_scratch);
+      // vtst to detect any bits in the bottom 32 bits of d_scratch.
       // This saves an instruction vs. the naive sequence of vpmax.
       // kDoubleRegZero is not changed, since it is 0.
-      __ vtst(Neon32, kScratchQuadReg, kScratchQuadReg, kScratchQuadReg);
-      __ ExtractLane(i.OutputRegister(), kScratchDoubleReg, NeonS32, 0);
+      __ vtst(Neon32, q_scratch, q_scratch, q_scratch);
+      __ ExtractLane(i.OutputRegister(), d_scratch, NeonS32, 0);
       break;
     }
     case kArmS1x16AllTrue: {
       const QwNeonRegister& src = i.InputSimd128Register(0);
-      __ vpmin(NeonU8, kScratchDoubleReg, src.low(), src.high());
-      __ vpmin(NeonU8, kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
-      __ vpmin(NeonU8, kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
-      __ vpmin(NeonU8, kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
-      __ ExtractLane(i.OutputRegister(), kScratchDoubleReg, NeonS8, 0);
+      UseScratchRegisterScope temps(tasm());
+      DwVfpRegister scratch = temps.AcquireD();
+      __ vpmin(NeonU8, scratch, src.low(), src.high());
+      __ vpmin(NeonU8, scratch, scratch, scratch);
+      __ vpmin(NeonU8, scratch, scratch, scratch);
+      __ vpmin(NeonU8, scratch, scratch, scratch);
+      __ ExtractLane(i.OutputRegister(), scratch, NeonS8, 0);
       break;
     }
-    case kAtomicLoadInt8:
+    case kWord32AtomicLoadInt8:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(ldrsb);
       break;
-    case kAtomicLoadUint8:
+    case kWord32AtomicLoadUint8:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(ldrb);
       break;
-    case kAtomicLoadInt16:
+    case kWord32AtomicLoadInt16:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(ldrsh);
       break;
-    case kAtomicLoadUint16:
+    case kWord32AtomicLoadUint16:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(ldrh);
       break;
-    case kAtomicLoadWord32:
+    case kWord32AtomicLoadWord32:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(ldr);
       break;
 
-    case kAtomicStoreWord8:
+    case kWord32AtomicStoreWord8:
       ASSEMBLE_ATOMIC_STORE_INTEGER(strb);
       break;
-    case kAtomicStoreWord16:
+    case kWord32AtomicStoreWord16:
       ASSEMBLE_ATOMIC_STORE_INTEGER(strh);
       break;
-    case kAtomicStoreWord32:
+    case kWord32AtomicStoreWord32:
       ASSEMBLE_ATOMIC_STORE_INTEGER(str);
       break;
-    case kAtomicExchangeInt8:
+    case kWord32AtomicExchangeInt8:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldrexb, strexb);
       __ sxtb(i.OutputRegister(0), i.OutputRegister(0));
       break;
-    case kAtomicExchangeUint8:
+    case kWord32AtomicExchangeUint8:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldrexb, strexb);
       break;
-    case kAtomicExchangeInt16:
+    case kWord32AtomicExchangeInt16:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldrexh, strexh);
       __ sxth(i.OutputRegister(0), i.OutputRegister(0));
       break;
-    case kAtomicExchangeUint16:
+    case kWord32AtomicExchangeUint16:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldrexh, strexh);
       break;
-    case kAtomicExchangeWord32:
+    case kWord32AtomicExchangeWord32:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldrex, strex);
       break;
-    case kAtomicCompareExchangeInt8:
+    case kWord32AtomicCompareExchangeInt8:
       __ add(i.TempRegister(1), i.InputRegister(0), i.InputRegister(1));
       __ uxtb(i.TempRegister(2), i.InputRegister(2));
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldrexb, strexb,
                                                i.TempRegister(2));
       __ sxtb(i.OutputRegister(0), i.OutputRegister(0));
       break;
-    case kAtomicCompareExchangeUint8:
+    case kWord32AtomicCompareExchangeUint8:
       __ add(i.TempRegister(1), i.InputRegister(0), i.InputRegister(1));
       __ uxtb(i.TempRegister(2), i.InputRegister(2));
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldrexb, strexb,
                                                i.TempRegister(2));
       break;
-    case kAtomicCompareExchangeInt16:
+    case kWord32AtomicCompareExchangeInt16:
       __ add(i.TempRegister(1), i.InputRegister(0), i.InputRegister(1));
       __ uxth(i.TempRegister(2), i.InputRegister(2));
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldrexh, strexh,
                                                i.TempRegister(2));
       __ sxth(i.OutputRegister(0), i.OutputRegister(0));
       break;
-    case kAtomicCompareExchangeUint16:
+    case kWord32AtomicCompareExchangeUint16:
       __ add(i.TempRegister(1), i.InputRegister(0), i.InputRegister(1));
       __ uxth(i.TempRegister(2), i.InputRegister(2));
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldrexh, strexh,
                                                i.TempRegister(2));
       break;
-    case kAtomicCompareExchangeWord32:
+    case kWord32AtomicCompareExchangeWord32:
       __ add(i.TempRegister(1), i.InputRegister(0), i.InputRegister(1));
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldrex, strex,
                                                i.InputRegister(2));
       break;
 #define ATOMIC_BINOP_CASE(op, inst)                    \
-  case kAtomic##op##Int8:                              \
+  case kWord32Atomic##op##Int8:                        \
     ASSEMBLE_ATOMIC_BINOP(ldrexb, strexb, inst);       \
     __ sxtb(i.OutputRegister(0), i.OutputRegister(0)); \
     break;                                             \
-  case kAtomic##op##Uint8:                             \
+  case kWord32Atomic##op##Uint8:                       \
     ASSEMBLE_ATOMIC_BINOP(ldrexb, strexb, inst);       \
     break;                                             \
-  case kAtomic##op##Int16:                             \
+  case kWord32Atomic##op##Int16:                       \
     ASSEMBLE_ATOMIC_BINOP(ldrexh, strexh, inst);       \
     __ sxth(i.OutputRegister(0), i.OutputRegister(0)); \
     break;                                             \
-  case kAtomic##op##Uint16:                            \
+  case kWord32Atomic##op##Uint16:                      \
     ASSEMBLE_ATOMIC_BINOP(ldrexh, strexh, inst);       \
     break;                                             \
-  case kAtomic##op##Word32:                            \
+  case kWord32Atomic##op##Word32:                      \
     ASSEMBLE_ATOMIC_BINOP(ldrex, strex, inst);         \
     break;
       ATOMIC_BINOP_CASE(Add, add)
@@ -2607,6 +2760,20 @@ void CodeGenerator::AssembleArchBranch(Instruction* instr, BranchInfo* branch) {
   if (!branch->fallthru) __ b(flabel);  // no fallthru to flabel.
 }
 
+void CodeGenerator::AssembleBranchPoisoning(FlagsCondition condition,
+                                            Instruction* instr) {
+  // TODO(jarin) Handle float comparisons (kUnordered[Not]Equal).
+  if (condition == kUnorderedEqual || condition == kUnorderedNotEqual) {
+    return;
+  }
+
+  condition = NegateFlagsCondition(condition);
+  __ eor(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
+         Operand(kSpeculationPoisonRegister), SBit::LeaveCC,
+         FlagsConditionToCondition(condition));
+  __ csdb();
+}
+
 void CodeGenerator::AssembleArchDeoptBranch(Instruction* instr,
                                             BranchInfo* branch) {
   AssembleArchBranch(instr, branch);
@@ -2654,8 +2821,9 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                              __ isolate()),
                          0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
-        CallDescriptor* descriptor = gen_->linkage()->GetIncomingDescriptor();
-        int pop_count = static_cast<int>(descriptor->StackParameterCount());
+        auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
+        int pop_count =
+            static_cast<int>(call_descriptor->StackParameterCount());
         __ Drop(pop_count);
         __ Ret();
       } else {
@@ -2725,9 +2893,9 @@ void CodeGenerator::AssembleArchTableSwitch(Instruction* instr) {
 }
 
 void CodeGenerator::FinishFrame(Frame* frame) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
 
-  const RegList saves_fp = descriptor->CalleeSavedFPRegisters();
+  const RegList saves_fp = call_descriptor->CalleeSavedFPRegisters();
   if (saves_fp != 0) {
     frame->AlignSavedCalleeRegisterSlots();
   }
@@ -2741,7 +2909,7 @@ void CodeGenerator::FinishFrame(Frame* frame) {
     frame->AllocateSavedCalleeRegisterSlots((last - first + 1) *
                                             (kDoubleSize / kPointerSize));
   }
-  const RegList saves = descriptor->CalleeSavedRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     // Save callee-saved registers.
     frame->AllocateSavedCalleeRegisterSlots(base::bits::CountPopulation(saves));
@@ -2749,14 +2917,14 @@ void CodeGenerator::FinishFrame(Frame* frame) {
 }
 
 void CodeGenerator::AssembleConstructFrame() {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
   if (frame_access_state()->has_frame()) {
-    if (descriptor->IsCFunctionCall()) {
+    if (call_descriptor->IsCFunctionCall()) {
       __ Push(lr, fp);
       __ mov(fp, sp);
-    } else if (descriptor->IsJSFunctionCall()) {
+    } else if (call_descriptor->IsJSFunctionCall()) {
       __ Prologue();
-      if (descriptor->PushArgumentCount()) {
+      if (call_descriptor->PushArgumentCount()) {
         __ Push(kJavaScriptCallArgCountRegister);
       }
     } else {
@@ -2766,8 +2934,8 @@ void CodeGenerator::AssembleConstructFrame() {
     unwinding_info_writer_.MarkFrameConstructed(__ pc_offset());
   }
 
-  int shrink_slots =
-      frame()->GetTotalFrameSlotCount() - descriptor->CalculateFixedFrameSize();
+  int shrink_slots = frame()->GetTotalFrameSlotCount() -
+                     call_descriptor->CalculateFixedFrameSize();
 
   if (info()->is_osr()) {
     // TurboFan OSR-compiled functions cannot be entered directly.
@@ -2780,10 +2948,11 @@ void CodeGenerator::AssembleConstructFrame() {
     if (FLAG_code_comments) __ RecordComment("-- OSR entrypoint --");
     osr_pc_offset_ = __ pc_offset();
     shrink_slots -= osr_helper()->UnoptimizedFrameSlots();
+    ResetSpeculationPoison();
   }
 
-  const RegList saves = descriptor->CalleeSavedRegisters();
-  const RegList saves_fp = descriptor->CalleeSavedFPRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
+  const RegList saves_fp = call_descriptor->CalleeSavedFPRegisters();
 
   if (shrink_slots > 0) {
     if (info()->IsWasm()) {
@@ -2861,8 +3030,8 @@ void CodeGenerator::AssembleConstructFrame() {
 }
 
 void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
-  int pop_count = static_cast<int>(descriptor->StackParameterCount());
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
+  int pop_count = static_cast<int>(call_descriptor->StackParameterCount());
 
   const int returns = frame()->GetReturnSlotCount();
   if (returns != 0) {
@@ -2871,13 +3040,13 @@ void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
   }
 
   // Restore registers.
-  const RegList saves = descriptor->CalleeSavedRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     __ ldm(ia_w, sp, saves);
   }
 
   // Restore FP registers.
-  const RegList saves_fp = descriptor->CalleeSavedFPRegisters();
+  const RegList saves_fp = call_descriptor->CalleeSavedFPRegisters();
   if (saves_fp != 0) {
     STATIC_ASSERT(DwVfpRegister::kNumRegisters == 32);
     uint32_t last = base::bits::CountLeadingZeros32(saves_fp) - 1;
@@ -2889,7 +3058,7 @@ void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
   unwinding_info_writer_.MarkBlockWillExit();
 
   ArmOperandConverter g(this, nullptr);
-  if (descriptor->IsCFunctionCall()) {
+  if (call_descriptor->IsCFunctionCall()) {
     AssembleDeconstructFrame();
   } else if (frame_access_state()->has_frame()) {
     // Canonicalize JSFunction return sites for now unless they have an variable
@@ -2922,281 +3091,273 @@ void CodeGenerator::FinishCode() { __ CheckConstPool(true, false); }
 void CodeGenerator::AssembleMove(InstructionOperand* source,
                                  InstructionOperand* destination) {
   ArmOperandConverter g(this, nullptr);
-  // Dispatch on the source and destination operand kinds.  Not all
-  // combinations are possible.
-  if (source->IsRegister()) {
-    DCHECK(destination->IsRegister() || destination->IsStackSlot());
-    Register src = g.ToRegister(source);
-    if (destination->IsRegister()) {
-      __ mov(g.ToRegister(destination), src);
-    } else {
-      __ str(src, g.ToMemOperand(destination));
-    }
-  } else if (source->IsStackSlot()) {
-    DCHECK(destination->IsRegister() || destination->IsStackSlot());
-    MemOperand src = g.ToMemOperand(source);
-    if (destination->IsRegister()) {
-      __ ldr(g.ToRegister(destination), src);
-    } else {
-      Register temp = kScratchReg;
-      __ ldr(temp, src);
-      __ str(temp, g.ToMemOperand(destination));
-    }
-  } else if (source->IsConstant()) {
-    Constant src = g.ToConstant(source);
-    if (destination->IsRegister() || destination->IsStackSlot()) {
-      Register dst =
-          destination->IsRegister() ? g.ToRegister(destination) : kScratchReg;
-      switch (src.type()) {
-        case Constant::kInt32:
-          if (RelocInfo::IsWasmReference(src.rmode())) {
-            __ mov(dst, Operand(src.ToInt32(), src.rmode()));
-          } else {
-            __ mov(dst, Operand(src.ToInt32()));
-          }
-          break;
-        case Constant::kInt64:
-          UNREACHABLE();
-          break;
-        case Constant::kFloat32:
-          __ mov(dst, Operand::EmbeddedNumber(src.ToFloat32()));
-          break;
-        case Constant::kFloat64:
-          __ mov(dst, Operand::EmbeddedNumber(src.ToFloat64().value()));
-          break;
-        case Constant::kExternalReference:
-          __ mov(dst, Operand(src.ToExternalReference()));
-          break;
-        case Constant::kHeapObject: {
-          Handle<HeapObject> src_object = src.ToHeapObject();
-          Heap::RootListIndex index;
-          if (IsMaterializableFromRoot(src_object, &index)) {
-            __ LoadRoot(dst, index);
-          } else {
-            __ Move(dst, src_object);
-          }
-          break;
-        }
-        case Constant::kRpoNumber:
-          UNREACHABLE();  // TODO(dcarney): loading RPO constants on arm.
-          break;
-      }
-      if (destination->IsStackSlot()) __ str(dst, g.ToMemOperand(destination));
-    } else if (src.type() == Constant::kFloat32) {
-      if (destination->IsFloatStackSlot()) {
-        MemOperand dst = g.ToMemOperand(destination);
-        Register temp = kScratchReg;
-        __ mov(temp, Operand(bit_cast<int32_t>(src.ToFloat32())));
-        __ str(temp, dst);
+  // Helper function to write the given constant to the dst register.
+  auto MoveConstantToRegister = [&](Register dst, Constant src) {
+    if (src.type() == Constant::kHeapObject) {
+      Handle<HeapObject> src_object = src.ToHeapObject();
+      Heap::RootListIndex index;
+      if (IsMaterializableFromRoot(src_object, &index)) {
+        __ LoadRoot(dst, index);
       } else {
-        SwVfpRegister dst = g.ToFloatRegister(destination);
-        __ vmov(dst, Float32::FromBits(src.ToFloat32AsInt()));
+        __ Move(dst, src_object);
       }
     } else {
-      DCHECK_EQ(Constant::kFloat64, src.type());
-      DwVfpRegister dst = destination->IsFPRegister()
-                              ? g.ToDoubleRegister(destination)
-                              : kScratchDoubleReg;
-      __ vmov(dst, src.ToFloat64(), kScratchReg);
-      if (destination->IsDoubleStackSlot()) {
-        __ vstr(dst, g.ToMemOperand(destination));
-      }
+      __ mov(dst, g.ToImmediate(source));
     }
-  } else if (source->IsFPRegister()) {
-    MachineRepresentation rep = LocationOperand::cast(source)->representation();
-    if (rep == MachineRepresentation::kFloat64) {
-      DwVfpRegister src = g.ToDoubleRegister(source);
-      if (destination->IsDoubleRegister()) {
-        DwVfpRegister dst = g.ToDoubleRegister(destination);
-        __ Move(dst, src);
-      } else {
-        DCHECK(destination->IsDoubleStackSlot());
-        __ vstr(src, g.ToMemOperand(destination));
-      }
-    } else if (rep == MachineRepresentation::kFloat32) {
-      // GapResolver may give us reg codes that don't map to actual s-registers.
-      // Generate code to work around those cases.
-      int src_code = LocationOperand::cast(source)->register_code();
-      if (destination->IsFloatRegister()) {
+  };
+  switch (MoveType::InferMove(source, destination)) {
+    case MoveType::kRegisterToRegister:
+      if (source->IsRegister()) {
+        __ mov(g.ToRegister(destination), g.ToRegister(source));
+      } else if (source->IsFloatRegister()) {
+        DCHECK(destination->IsFloatRegister());
+        // GapResolver may give us reg codes that don't map to actual
+        // s-registers. Generate code to work around those cases.
+        int src_code = LocationOperand::cast(source)->register_code();
         int dst_code = LocationOperand::cast(destination)->register_code();
         __ VmovExtended(dst_code, src_code);
+      } else if (source->IsDoubleRegister()) {
+        __ Move(g.ToDoubleRegister(destination), g.ToDoubleRegister(source));
       } else {
-        DCHECK(destination->IsFloatStackSlot());
-        __ VmovExtended(g.ToMemOperand(destination), src_code);
+        __ Move(g.ToSimd128Register(destination), g.ToSimd128Register(source));
       }
-    } else {
-      DCHECK_EQ(MachineRepresentation::kSimd128, rep);
-      QwNeonRegister src = g.ToSimd128Register(source);
-      if (destination->IsSimd128Register()) {
-        QwNeonRegister dst = g.ToSimd128Register(destination);
-        __ Move(dst, src);
+      return;
+    case MoveType::kRegisterToStack: {
+      MemOperand dst = g.ToMemOperand(destination);
+      if (source->IsRegister()) {
+        __ str(g.ToRegister(source), dst);
+      } else if (source->IsFloatRegister()) {
+        // GapResolver may give us reg codes that don't map to actual
+        // s-registers. Generate code to work around those cases.
+        int src_code = LocationOperand::cast(source)->register_code();
+        __ VmovExtended(dst, src_code);
+      } else if (source->IsDoubleRegister()) {
+        __ vstr(g.ToDoubleRegister(source), dst);
       } else {
-        DCHECK(destination->IsSimd128StackSlot());
-        MemOperand dst = g.ToMemOperand(destination);
-        __ add(kScratchReg, dst.rn(), Operand(dst.offset()));
-        __ vst1(Neon8, NeonListOperand(src.low(), 2),
-                NeonMemOperand(kScratchReg));
+        UseScratchRegisterScope temps(tasm());
+        Register temp = temps.Acquire();
+        QwNeonRegister src = g.ToSimd128Register(source);
+        __ add(temp, dst.rn(), Operand(dst.offset()));
+        __ vst1(Neon8, NeonListOperand(src.low(), 2), NeonMemOperand(temp));
       }
-    }
-  } else if (source->IsFPStackSlot()) {
-    MemOperand src = g.ToMemOperand(source);
-    MachineRepresentation rep =
-        LocationOperand::cast(destination)->representation();
-    if (destination->IsFPRegister()) {
-      if (rep == MachineRepresentation::kFloat64) {
-        __ vldr(g.ToDoubleRegister(destination), src);
-      } else if (rep == MachineRepresentation::kFloat32) {
+      return;
+    }
+    case MoveType::kStackToRegister: {
+      MemOperand src = g.ToMemOperand(source);
+      if (source->IsStackSlot()) {
+        __ ldr(g.ToRegister(destination), src);
+      } else if (source->IsFloatStackSlot()) {
+        DCHECK(destination->IsFloatRegister());
         // GapResolver may give us reg codes that don't map to actual
         // s-registers. Generate code to work around those cases.
         int dst_code = LocationOperand::cast(destination)->register_code();
         __ VmovExtended(dst_code, src);
+      } else if (source->IsDoubleStackSlot()) {
+        __ vldr(g.ToDoubleRegister(destination), src);
       } else {
-        DCHECK_EQ(MachineRepresentation::kSimd128, rep);
+        UseScratchRegisterScope temps(tasm());
+        Register temp = temps.Acquire();
         QwNeonRegister dst = g.ToSimd128Register(destination);
-        __ add(kScratchReg, src.rn(), Operand(src.offset()));
-        __ vld1(Neon8, NeonListOperand(dst.low(), 2),
-                NeonMemOperand(kScratchReg));
+        __ add(temp, src.rn(), Operand(src.offset()));
+        __ vld1(Neon8, NeonListOperand(dst.low(), 2), NeonMemOperand(temp));
       }
-    } else {
-      DCHECK(destination->IsFPStackSlot());
-      if (rep == MachineRepresentation::kFloat64) {
-        DwVfpRegister temp = kScratchDoubleReg;
+      return;
+    }
+    case MoveType::kStackToStack: {
+      MemOperand src = g.ToMemOperand(source);
+      MemOperand dst = g.ToMemOperand(destination);
+      UseScratchRegisterScope temps(tasm());
+      if (source->IsStackSlot() || source->IsFloatStackSlot()) {
+        SwVfpRegister temp = temps.AcquireS();
         __ vldr(temp, src);
-        __ vstr(temp, g.ToMemOperand(destination));
-      } else if (rep == MachineRepresentation::kFloat32) {
-        SwVfpRegister temp = kScratchDoubleReg.low();
+        __ vstr(temp, dst);
+      } else if (source->IsDoubleStackSlot()) {
+        DwVfpRegister temp = temps.AcquireD();
         __ vldr(temp, src);
-        __ vstr(temp, g.ToMemOperand(destination));
+        __ vstr(temp, dst);
+      } else {
+        DCHECK(source->IsSimd128StackSlot());
+        Register temp = temps.Acquire();
+        QwNeonRegister temp_q = temps.AcquireQ();
+        __ add(temp, src.rn(), Operand(src.offset()));
+        __ vld1(Neon8, NeonListOperand(temp_q.low(), 2), NeonMemOperand(temp));
+        __ add(temp, dst.rn(), Operand(dst.offset()));
+        __ vst1(Neon8, NeonListOperand(temp_q.low(), 2), NeonMemOperand(temp));
+      }
+      return;
+    }
+    case MoveType::kConstantToRegister: {
+      Constant src = g.ToConstant(source);
+      if (destination->IsRegister()) {
+        MoveConstantToRegister(g.ToRegister(destination), src);
+      } else if (destination->IsFloatRegister()) {
+        __ vmov(g.ToFloatRegister(destination),
+                Float32::FromBits(src.ToFloat32AsInt()));
       } else {
-        DCHECK_EQ(MachineRepresentation::kSimd128, rep);
-        MemOperand dst = g.ToMemOperand(destination);
-        __ add(kScratchReg, src.rn(), Operand(src.offset()));
-        __ vld1(Neon8, NeonListOperand(kScratchQuadReg.low(), 2),
-                NeonMemOperand(kScratchReg));
-        __ add(kScratchReg, dst.rn(), Operand(dst.offset()));
-        __ vst1(Neon8, NeonListOperand(kScratchQuadReg.low(), 2),
-                NeonMemOperand(kScratchReg));
+        // TODO(arm): Look into optimizing this further if possible. Supporting
+        // the NEON version of VMOV may help.
+        __ vmov(g.ToDoubleRegister(destination), src.ToFloat64());
       }
+      return;
+    }
+    case MoveType::kConstantToStack: {
+      Constant src = g.ToConstant(source);
+      MemOperand dst = g.ToMemOperand(destination);
+      if (destination->IsStackSlot()) {
+        UseScratchRegisterScope temps(tasm());
+        // Acquire a S register instead of a general purpose register in case
+        // `vstr` needs one to compute the address of `dst`.
+        SwVfpRegister s_temp = temps.AcquireS();
+        {
+          // TODO(arm): This sequence could be optimized further if necessary by
+          // writing the constant directly into `s_temp`.
+          UseScratchRegisterScope temps(tasm());
+          Register temp = temps.Acquire();
+          MoveConstantToRegister(temp, src);
+          __ vmov(s_temp, temp);
+        }
+        __ vstr(s_temp, dst);
+      } else if (destination->IsFloatStackSlot()) {
+        UseScratchRegisterScope temps(tasm());
+        SwVfpRegister temp = temps.AcquireS();
+        __ vmov(temp, Float32::FromBits(src.ToFloat32AsInt()));
+        __ vstr(temp, dst);
+      } else {
+        DCHECK(destination->IsDoubleStackSlot());
+        UseScratchRegisterScope temps(tasm());
+        DwVfpRegister temp = temps.AcquireD();
+        // TODO(arm): Look into optimizing this further if possible. Supporting
+        // the NEON version of VMOV may help.
+        __ vmov(temp, src.ToFloat64());
+        __ vstr(temp, g.ToMemOperand(destination));
+      }
+      return;
     }
-  } else {
-    UNREACHABLE();
   }
+  UNREACHABLE();
 }
 
 void CodeGenerator::AssembleSwap(InstructionOperand* source,
                                  InstructionOperand* destination) {
   ArmOperandConverter g(this, nullptr);
-  // Dispatch on the source and destination operand kinds.  Not all
-  // combinations are possible.
-  if (source->IsRegister()) {
-    // Register-register.
-    Register temp = kScratchReg;
-    Register src = g.ToRegister(source);
-    if (destination->IsRegister()) {
-      Register dst = g.ToRegister(destination);
-      __ Move(temp, src);
-      __ Move(src, dst);
-      __ Move(dst, temp);
-    } else {
-      DCHECK(destination->IsStackSlot());
-      MemOperand dst = g.ToMemOperand(destination);
-      __ mov(temp, src);
-      __ ldr(src, dst);
-      __ str(temp, dst);
-    }
-  } else if (source->IsStackSlot()) {
-    DCHECK(destination->IsStackSlot());
-    Register temp_0 = kScratchReg;
-    SwVfpRegister temp_1 = kScratchDoubleReg.low();
-    MemOperand src = g.ToMemOperand(source);
-    MemOperand dst = g.ToMemOperand(destination);
-    __ ldr(temp_0, src);
-    __ vldr(temp_1, dst);
-    __ str(temp_0, dst);
-    __ vstr(temp_1, src);
-  } else if (source->IsFPRegister()) {
-    MachineRepresentation rep = LocationOperand::cast(source)->representation();
-    LowDwVfpRegister temp = kScratchDoubleReg;
-    if (rep == MachineRepresentation::kFloat64) {
-      DwVfpRegister src = g.ToDoubleRegister(source);
-      if (destination->IsFPRegister()) {
-        DwVfpRegister dst = g.ToDoubleRegister(destination);
-        __ Swap(src, dst);
-      } else {
-        DCHECK(destination->IsFPStackSlot());
-        MemOperand dst = g.ToMemOperand(destination);
-        __ Move(temp, src);
-        __ vldr(src, dst);
-        __ vstr(temp, dst);
-      }
-    } else if (rep == MachineRepresentation::kFloat32) {
-      int src_code = LocationOperand::cast(source)->register_code();
-      if (destination->IsFPRegister()) {
+  switch (MoveType::InferSwap(source, destination)) {
+    case MoveType::kRegisterToRegister:
+      if (source->IsRegister()) {
+        __ Swap(g.ToRegister(source), g.ToRegister(destination));
+      } else if (source->IsFloatRegister()) {
+        DCHECK(destination->IsFloatRegister());
+        // GapResolver may give us reg codes that don't map to actual
+        // s-registers. Generate code to work around those cases.
+        UseScratchRegisterScope temps(tasm());
+        LowDwVfpRegister temp = temps.AcquireLowD();
+        int src_code = LocationOperand::cast(source)->register_code();
         int dst_code = LocationOperand::cast(destination)->register_code();
         __ VmovExtended(temp.low().code(), src_code);
         __ VmovExtended(src_code, dst_code);
         __ VmovExtended(dst_code, temp.low().code());
+      } else if (source->IsDoubleRegister()) {
+        __ Swap(g.ToDoubleRegister(source), g.ToDoubleRegister(destination));
       } else {
-        DCHECK(destination->IsFPStackSlot());
-        MemOperand dst = g.ToMemOperand(destination);
+        __ Swap(g.ToSimd128Register(source), g.ToSimd128Register(destination));
+      }
+      return;
+    case MoveType::kRegisterToStack: {
+      MemOperand dst = g.ToMemOperand(destination);
+      if (source->IsRegister()) {
+        Register src = g.ToRegister(source);
+        UseScratchRegisterScope temps(tasm());
+        SwVfpRegister temp = temps.AcquireS();
+        __ vmov(temp, src);
+        __ ldr(src, dst);
+        __ vstr(temp, dst);
+      } else if (source->IsFloatRegister()) {
+        int src_code = LocationOperand::cast(source)->register_code();
+        UseScratchRegisterScope temps(tasm());
+        LowDwVfpRegister temp = temps.AcquireLowD();
         __ VmovExtended(temp.low().code(), src_code);
         __ VmovExtended(src_code, dst);
         __ vstr(temp.low(), dst);
-      }
-    } else {
-      DCHECK_EQ(MachineRepresentation::kSimd128, rep);
-      QwNeonRegister src = g.ToSimd128Register(source);
-      if (destination->IsFPRegister()) {
-        QwNeonRegister dst = g.ToSimd128Register(destination);
-        __ Swap(src, dst);
+      } else if (source->IsDoubleRegister()) {
+        UseScratchRegisterScope temps(tasm());
+        DwVfpRegister temp = temps.AcquireD();
+        DwVfpRegister src = g.ToDoubleRegister(source);
+        __ Move(temp, src);
+        __ vldr(src, dst);
+        __ vstr(temp, dst);
       } else {
-        DCHECK(destination->IsFPStackSlot());
-        MemOperand dst = g.ToMemOperand(destination);
-        __ Move(kScratchQuadReg, src);
-        __ add(kScratchReg, dst.rn(), Operand(dst.offset()));
-        __ vld1(Neon8, NeonListOperand(src.low(), 2),
-                NeonMemOperand(kScratchReg));
-        __ vst1(Neon8, NeonListOperand(kScratchQuadReg.low(), 2),
-                NeonMemOperand(kScratchReg));
+        QwNeonRegister src = g.ToSimd128Register(source);
+        UseScratchRegisterScope temps(tasm());
+        Register temp = temps.Acquire();
+        QwNeonRegister temp_q = temps.AcquireQ();
+        __ Move(temp_q, src);
+        __ add(temp, dst.rn(), Operand(dst.offset()));
+        __ vld1(Neon8, NeonListOperand(src.low(), 2), NeonMemOperand(temp));
+        __ vst1(Neon8, NeonListOperand(temp_q.low(), 2), NeonMemOperand(temp));
       }
+      return;
     }
-  } else if (source->IsFPStackSlot()) {
-    DCHECK(destination->IsFPStackSlot());
-    Register temp_0 = kScratchReg;
-    LowDwVfpRegister temp_1 = kScratchDoubleReg;
-    MemOperand src0 = g.ToMemOperand(source);
-    MemOperand dst0 = g.ToMemOperand(destination);
-    MachineRepresentation rep = LocationOperand::cast(source)->representation();
-    if (rep == MachineRepresentation::kFloat64) {
-      MemOperand src1(src0.rn(), src0.offset() + kPointerSize);
-      MemOperand dst1(dst0.rn(), dst0.offset() + kPointerSize);
-      __ vldr(temp_1, dst0);  // Save destination in temp_1.
-      __ ldr(temp_0, src0);   // Then use temp_0 to copy source to destination.
-      __ str(temp_0, dst0);
-      __ ldr(temp_0, src1);
-      __ str(temp_0, dst1);
-      __ vstr(temp_1, src0);
-    } else if (rep == MachineRepresentation::kFloat32) {
-      __ vldr(temp_1.low(), dst0);  // Save destination in temp_1.
-      __ ldr(temp_0, src0);  // Then use temp_0 to copy source to destination.
-      __ str(temp_0, dst0);
-      __ vstr(temp_1.low(), src0);
-    } else {
-      DCHECK_EQ(MachineRepresentation::kSimd128, rep);
-      MemOperand src1(src0.rn(), src0.offset() + kDoubleSize);
-      MemOperand dst1(dst0.rn(), dst0.offset() + kDoubleSize);
-      __ vldr(kScratchQuadReg.low(), dst0);
-      __ vldr(kScratchQuadReg.high(), src0);
-      __ vstr(kScratchQuadReg.low(), src0);
-      __ vstr(kScratchQuadReg.high(), dst0);
-      __ vldr(kScratchQuadReg.low(), dst1);
-      __ vldr(kScratchQuadReg.high(), src1);
-      __ vstr(kScratchQuadReg.low(), src1);
-      __ vstr(kScratchQuadReg.high(), dst1);
+    case MoveType::kStackToStack: {
+      MemOperand src = g.ToMemOperand(source);
+      MemOperand dst = g.ToMemOperand(destination);
+      if (source->IsStackSlot() || source->IsFloatStackSlot()) {
+        UseScratchRegisterScope temps(tasm());
+        SwVfpRegister temp_0 = temps.AcquireS();
+        SwVfpRegister temp_1 = temps.AcquireS();
+        __ vldr(temp_0, dst);
+        __ vldr(temp_1, src);
+        __ vstr(temp_0, src);
+        __ vstr(temp_1, dst);
+      } else if (source->IsDoubleStackSlot()) {
+        UseScratchRegisterScope temps(tasm());
+        LowDwVfpRegister temp = temps.AcquireLowD();
+        if (temps.CanAcquireD()) {
+          DwVfpRegister temp_0 = temp;
+          DwVfpRegister temp_1 = temps.AcquireD();
+          __ vldr(temp_0, dst);
+          __ vldr(temp_1, src);
+          __ vstr(temp_0, src);
+          __ vstr(temp_1, dst);
+        } else {
+          // We only have a single D register available. However, we can split
+          // it into 2 S registers and swap the slots 32 bits at a time.
+          MemOperand src0 = src;
+          MemOperand dst0 = dst;
+          MemOperand src1(src.rn(), src.offset() + kFloatSize);
+          MemOperand dst1(dst.rn(), dst.offset() + kFloatSize);
+          SwVfpRegister temp_0 = temp.low();
+          SwVfpRegister temp_1 = temp.high();
+          __ vldr(temp_0, dst0);
+          __ vldr(temp_1, src0);
+          __ vstr(temp_0, src0);
+          __ vstr(temp_1, dst0);
+          __ vldr(temp_0, dst1);
+          __ vldr(temp_1, src1);
+          __ vstr(temp_0, src1);
+          __ vstr(temp_1, dst1);
+        }
+      } else {
+        DCHECK(source->IsSimd128StackSlot());
+        MemOperand src0 = src;
+        MemOperand dst0 = dst;
+        MemOperand src1(src.rn(), src.offset() + kDoubleSize);
+        MemOperand dst1(dst.rn(), dst.offset() + kDoubleSize);
+        UseScratchRegisterScope temps(tasm());
+        DwVfpRegister temp_0 = temps.AcquireD();
+        DwVfpRegister temp_1 = temps.AcquireD();
+        __ vldr(temp_0, dst0);
+        __ vldr(temp_1, src0);
+        __ vstr(temp_0, src0);
+        __ vstr(temp_1, dst0);
+        __ vldr(temp_0, dst1);
+        __ vldr(temp_1, src1);
+        __ vstr(temp_0, src1);
+        __ vstr(temp_1, dst1);
+      }
+      return;
     }
-  } else {
-    // No other combinations are possible.
-    UNREACHABLE();
+    default:
+      UNREACHABLE();
+      break;
   }
 }
 
@@ -3206,7 +3367,6 @@ void CodeGenerator::AssembleJumpTable(Label** targets, size_t target_count) {
 }
 
 #undef __
-#undef kScratchReg
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/arm/instruction-codes-arm.h b/deps/v8/src/compiler/arm/instruction-codes-arm.h
index a7cf80450ae..a9f9be38efc 100644
--- a/deps/v8/src/compiler/arm/instruction-codes-arm.h
+++ b/deps/v8/src/compiler/arm/instruction-codes-arm.h
@@ -125,6 +125,7 @@ namespace compiler {
   V(ArmPush)                       \
   V(ArmPoke)                       \
   V(ArmPeek)                       \
+  V(ArmDsbIsb)                     \
   V(ArmF32x4Splat)                 \
   V(ArmF32x4ExtractLane)           \
   V(ArmF32x4ReplaceLane)           \
diff --git a/deps/v8/src/compiler/arm/instruction-scheduler-arm.cc b/deps/v8/src/compiler/arm/instruction-scheduler-arm.cc
index a592515179e..e538020f693 100644
--- a/deps/v8/src/compiler/arm/instruction-scheduler-arm.cc
+++ b/deps/v8/src/compiler/arm/instruction-scheduler-arm.cc
@@ -274,6 +274,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArmStr:
     case kArmPush:
     case kArmPoke:
+    case kArmDsbIsb:
       return kHasSideEffect;
 
 #define CASE(Name) case k##Name:
diff --git a/deps/v8/src/compiler/arm/instruction-selector-arm.cc b/deps/v8/src/compiler/arm/instruction-selector-arm.cc
index f94d114d07e..b2f6fd6e719 100644
--- a/deps/v8/src/compiler/arm/instruction-selector-arm.cc
+++ b/deps/v8/src/compiler/arm/instruction-selector-arm.cc
@@ -114,14 +114,14 @@ void VisitRRRShuffle(InstructionSelector* selector, ArchOpcode opcode,
 
 void VisitRRI(InstructionSelector* selector, ArchOpcode opcode, Node* node) {
   ArmOperandGenerator g(selector);
-  int32_t imm = OpParameter<int32_t>(node);
+  int32_t imm = OpParameter<int32_t>(node->op());
   selector->Emit(opcode, g.DefineAsRegister(node),
                  g.UseRegister(node->InputAt(0)), g.UseImmediate(imm));
 }
 
 void VisitRRIR(InstructionSelector* selector, ArchOpcode opcode, Node* node) {
   ArmOperandGenerator g(selector);
-  int32_t imm = OpParameter<int32_t>(node);
+  int32_t imm = OpParameter<int32_t>(node->op());
   selector->Emit(opcode, g.DefineAsRegister(node),
                  g.UseRegister(node->InputAt(0)), g.UseImmediate(imm),
                  g.UseRegister(node->InputAt(1)));
@@ -248,9 +248,9 @@ void VisitBinop(InstructionSelector* selector, Node* node,
                 FlagsContinuation* cont) {
   ArmOperandGenerator g(selector);
   Int32BinopMatcher m(node);
-  InstructionOperand inputs[5];
+  InstructionOperand inputs[3];
   size_t input_count = 0;
-  InstructionOperand outputs[2];
+  InstructionOperand outputs[1];
   size_t output_count = 0;
 
   if (m.left().node() == m.right().node()) {
@@ -281,33 +281,16 @@ void VisitBinop(InstructionSelector* selector, Node* node,
     inputs[input_count++] = g.UseRegister(m.right().node());
   }
 
-  if (cont->IsBranch()) {
-    inputs[input_count++] = g.Label(cont->true_block());
-    inputs[input_count++] = g.Label(cont->false_block());
-  }
-
   outputs[output_count++] = g.DefineAsRegister(node);
-  if (cont->IsSet()) {
-    outputs[output_count++] = g.DefineAsRegister(cont->result());
-  }
 
   DCHECK_NE(0u, input_count);
-  DCHECK_NE(0u, output_count);
+  DCHECK_EQ(1u, output_count);
   DCHECK_GE(arraysize(inputs), input_count);
   DCHECK_GE(arraysize(outputs), output_count);
   DCHECK_NE(kMode_None, AddressingModeField::decode(opcode));
 
-  opcode = cont->Encode(opcode);
-  if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, output_count, outputs, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsTrap()) {
-    inputs[input_count++] = g.UseImmediate(cont->trap_id());
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  } else {
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, output_count, outputs, input_count,
+                                 inputs, cont);
 }
 
 
@@ -460,11 +443,17 @@ void InstructionSelector::VisitLoad(Node* node) {
       UNREACHABLE();
       return;
   }
+  if (node->opcode() == IrOpcode::kPoisonedLoad) {
+    CHECK_EQ(poisoning_enabled_, PoisoningMitigationLevel::kOn);
+    opcode |= MiscField::encode(kMemoryAccessPoisoned);
+  }
 
   InstructionOperand output = g.DefineAsRegister(node);
   EmitLoad(this, opcode, &output, base, index);
 }
 
+void InstructionSelector::VisitPoisonedLoad(Node* node) { VisitLoad(node); }
+
 void InstructionSelector::VisitProtectedLoad(Node* node) {
   // TODO(eholk)
   UNIMPLEMENTED();
@@ -563,7 +552,7 @@ void InstructionSelector::VisitProtectedStore(Node* node) {
 
 void InstructionSelector::VisitUnalignedLoad(Node* node) {
   MachineRepresentation load_rep =
-      UnalignedLoadRepresentationOf(node->op()).representation();
+      LoadRepresentationOf(node->op()).representation();
   ArmOperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -883,22 +872,14 @@ void VisitShift(InstructionSelector* selector, Node* node,
                 TryMatchShift try_match_shift, FlagsContinuation* cont) {
   ArmOperandGenerator g(selector);
   InstructionCode opcode = kArmMov;
-  InstructionOperand inputs[4];
+  InstructionOperand inputs[2];
   size_t input_count = 2;
-  InstructionOperand outputs[2];
+  InstructionOperand outputs[1];
   size_t output_count = 0;
 
   CHECK(try_match_shift(selector, &opcode, node, &inputs[0], &inputs[1]));
 
-  if (cont->IsBranch()) {
-    inputs[input_count++] = g.Label(cont->true_block());
-    inputs[input_count++] = g.Label(cont->false_block());
-  }
-
   outputs[output_count++] = g.DefineAsRegister(node);
-  if (cont->IsSet()) {
-    outputs[output_count++] = g.DefineAsRegister(cont->result());
-  }
 
   DCHECK_NE(0u, input_count);
   DCHECK_NE(0u, output_count);
@@ -906,17 +887,8 @@ void VisitShift(InstructionSelector* selector, Node* node,
   DCHECK_GE(arraysize(outputs), output_count);
   DCHECK_NE(kMode_None, AddressingModeField::decode(opcode));
 
-  opcode = cont->Encode(opcode);
-  if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, output_count, outputs, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsTrap()) {
-    inputs[input_count++] = g.UseImmediate(cont->trap_id());
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  } else {
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, output_count, outputs, input_count,
+                                 inputs, cont);
 }
 
 
@@ -1121,7 +1093,10 @@ void InstructionSelector::VisitWord32ReverseBytes(Node* node) { UNREACHABLE(); }
 
 void InstructionSelector::VisitWord32Popcnt(Node* node) { UNREACHABLE(); }
 
-void InstructionSelector::VisitSpeculationFence(Node* node) { UNREACHABLE(); }
+void InstructionSelector::VisitSpeculationFence(Node* node) {
+  ArmOperandGenerator g(this);
+  Emit(kArmDsbIsb, g.NoOutput());
+}
 
 void InstructionSelector::VisitInt32Add(Node* node) {
   ArmOperandGenerator g(this);
@@ -1157,6 +1132,7 @@ void InstructionSelector::VisitInt32Add(Node* node) {
                g.UseRegister(mleft.left().node()), g.TempImmediate(0));
           return;
         }
+        break;
       }
       case IrOpcode::kWord32Sar: {
         Int32BinopMatcher mleft(m.left().node());
@@ -1175,6 +1151,7 @@ void InstructionSelector::VisitInt32Add(Node* node) {
             return;
           }
         }
+        break;
       }
       default:
         break;
@@ -1211,6 +1188,7 @@ void InstructionSelector::VisitInt32Add(Node* node) {
                g.UseRegister(mright.left().node()), g.TempImmediate(0));
           return;
         }
+        break;
       }
       case IrOpcode::kWord32Sar: {
         Int32BinopMatcher mright(m.right().node());
@@ -1229,6 +1207,7 @@ void InstructionSelector::VisitInt32Add(Node* node) {
             return;
           }
         }
+        break;
       }
       default:
         break;
@@ -1266,25 +1245,10 @@ void EmitInt32MulWithOverflow(InstructionSelector* selector, Node* node,
 
   // result operand needs shift operator.
   InstructionOperand shift_31 = g.UseImmediate(31);
-  InstructionCode opcode = cont->Encode(kArmCmp) |
-                           AddressingModeField::encode(kMode_Operand2_R_ASR_I);
-  if (cont->IsBranch()) {
-    selector->Emit(opcode, g.NoOutput(), temp_operand, result_operand, shift_31,
-                   g.Label(cont->true_block()), g.Label(cont->false_block()));
-  } else if (cont->IsDeoptimize()) {
-    InstructionOperand in[] = {temp_operand, result_operand, shift_31};
-    selector->EmitDeoptimize(opcode, 0, nullptr, 3, in, cont->kind(),
-                             cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsSet()) {
-    selector->Emit(opcode, g.DefineAsRegister(cont->result()), temp_operand,
-                   result_operand, shift_31);
-  } else {
-    DCHECK(cont->IsTrap());
-    InstructionOperand in[] = {temp_operand, result_operand, shift_31,
-                               g.UseImmediate(cont->trap_id())};
-    selector->Emit(opcode, 0, nullptr, 4, in);
-  }
+  InstructionCode opcode =
+      kArmCmp | AddressingModeField::encode(kMode_Operand2_R_ASR_I);
+  selector->EmitWithContinuation(opcode, temp_operand, result_operand, shift_31,
+                                 cont);
 }
 
 }  // namespace
@@ -1395,6 +1359,7 @@ void InstructionSelector::VisitUint32Mod(Node* node) {
   }
 RR_OP_LIST(RR_VISITOR)
 #undef RR_VISITOR
+#undef RR_OP_LIST
 
 #define RR_VISITOR_V8(Name, opcode)                   \
   void InstructionSelector::Visit##Name(Node* node) { \
@@ -1403,6 +1368,7 @@ RR_OP_LIST(RR_VISITOR)
   }
 RR_OP_LIST_V8(RR_VISITOR_V8)
 #undef RR_VISITOR_V8
+#undef RR_OP_LIST_V8
 
 #define RRR_VISITOR(Name, opcode)                     \
   void InstructionSelector::Visit##Name(Node* node) { \
@@ -1410,6 +1376,7 @@ RR_OP_LIST_V8(RR_VISITOR_V8)
   }
 RRR_OP_LIST(RRR_VISITOR)
 #undef RRR_VISITOR
+#undef RRR_OP_LIST
 
 void InstructionSelector::VisitFloat32Add(Node* node) {
   ArmOperandGenerator g(this);
@@ -1500,14 +1467,14 @@ void InstructionSelector::VisitFloat64Ieee754Unop(Node* node,
 }
 
 void InstructionSelector::EmitPrepareArguments(
-    ZoneVector<PushParameter>* arguments, const CallDescriptor* descriptor,
+    ZoneVector<PushParameter>* arguments, const CallDescriptor* call_descriptor,
     Node* node) {
   ArmOperandGenerator g(this);
 
   // Prepare for C function call.
-  if (descriptor->IsCFunctionCall()) {
-    Emit(kArchPrepareCallCFunction |
-             MiscField::encode(static_cast<int>(descriptor->ParameterCount())),
+  if (call_descriptor->IsCFunctionCall()) {
+    Emit(kArchPrepareCallCFunction | MiscField::encode(static_cast<int>(
+                                         call_descriptor->ParameterCount())),
          0, nullptr, 0, nullptr);
 
     // Poke any stack arguments.
@@ -1529,9 +1496,9 @@ void InstructionSelector::EmitPrepareArguments(
   }
 }
 
-void InstructionSelector::EmitPrepareResults(ZoneVector<PushParameter>* results,
-                                             const CallDescriptor* descriptor,
-                                             Node* node) {
+void InstructionSelector::EmitPrepareResults(
+    ZoneVector<PushParameter>* results, const CallDescriptor* call_descriptor,
+    Node* node) {
   ArmOperandGenerator g(this);
 
   int reverse_slot = 0;
@@ -1539,7 +1506,7 @@ void InstructionSelector::EmitPrepareResults(ZoneVector<PushParameter>* results,
     if (!output.location.IsCallerFrameSlot()) continue;
     // Skip any alignment holes in nodes.
     if (output.node != nullptr) {
-      DCHECK(!descriptor->IsCFunctionCall());
+      DCHECK(!call_descriptor->IsCFunctionCall());
       if (output.location.GetType() == MachineType::Float32()) {
         MarkAsFloat32(output.node);
       } else if (output.location.GetType() == MachineType::Float64()) {
@@ -1562,22 +1529,7 @@ namespace {
 void VisitCompare(InstructionSelector* selector, InstructionCode opcode,
                   InstructionOperand left, InstructionOperand right,
                   FlagsContinuation* cont) {
-  ArmOperandGenerator g(selector);
-  opcode = cont->Encode(opcode);
-  if (cont->IsBranch()) {
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.Label(cont->true_block()), g.Label(cont->false_block()));
-  } else if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, g.NoOutput(), left, right, cont->kind(),
-                             cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsSet()) {
-    selector->Emit(opcode, g.DefineAsRegister(cont->result()), left, right);
-  } else {
-    DCHECK(cont->IsTrap());
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.UseImmediate(cont->trap_id()));
-  }
+  selector->EmitWithContinuation(opcode, left, right, cont);
 }
 
 
@@ -1718,7 +1670,7 @@ void VisitWordCompare(InstructionSelector* selector, Node* node,
                       InstructionCode opcode, FlagsContinuation* cont) {
   ArmOperandGenerator g(selector);
   Int32BinopMatcher m(node);
-  InstructionOperand inputs[5];
+  InstructionOperand inputs[3];
   size_t input_count = 0;
   InstructionOperand outputs[2];
   size_t output_count = 0;
@@ -1751,28 +1703,12 @@ void VisitWordCompare(InstructionSelector* selector, Node* node,
     }
   }
 
-  if (cont->IsBranch()) {
-    inputs[input_count++] = g.Label(cont->true_block());
-    inputs[input_count++] = g.Label(cont->false_block());
-  } else if (cont->IsSet()) {
-    outputs[output_count++] = g.DefineAsRegister(cont->result());
-  }
-
   DCHECK_NE(0u, input_count);
   DCHECK_GE(arraysize(inputs), input_count);
   DCHECK_GE(arraysize(outputs), output_count);
 
-  opcode = cont->Encode(opcode);
-  if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, output_count, outputs, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsTrap()) {
-    inputs[input_count++] = g.UseImmediate(cont->trap_id());
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  } else {
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, output_count, outputs, input_count,
+                                 inputs, cont);
 }
 
 
@@ -1806,13 +1742,13 @@ void VisitWordCompare(InstructionSelector* selector, Node* node,
   VisitWordCompare(selector, node, opcode, cont);
 }
 
+}  // namespace
 
 // Shared routine for word comparisons against zero.
-void VisitWordCompareZero(InstructionSelector* selector, Node* user,
-                          Node* value, FlagsContinuation* cont) {
+void InstructionSelector::VisitWordCompareZero(Node* user, Node* value,
+                                               FlagsContinuation* cont) {
   // Try to combine with comparisons against 0 by simply inverting the branch.
-  while (value->opcode() == IrOpcode::kWord32Equal &&
-         selector->CanCover(user, value)) {
+  while (value->opcode() == IrOpcode::kWord32Equal && CanCover(user, value)) {
     Int32BinopMatcher m(value);
     if (!m.right().Is(0)) break;
 
@@ -1821,41 +1757,41 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
     cont->Negate();
   }
 
-  if (selector->CanCover(user, value)) {
+  if (CanCover(user, value)) {
     switch (value->opcode()) {
       case IrOpcode::kWord32Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kInt32LessThan:
         cont->OverwriteAndNegateIfEqual(kSignedLessThan);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kInt32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kSignedLessThanOrEqual);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kUint32LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kUint32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kFloat32Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThan:
         cont->OverwriteAndNegateIfEqual(kFloatLessThan);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kFloatLessThanOrEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat64Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThan:
         cont->OverwriteAndNegateIfEqual(kFloatLessThan);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kFloatLessThanOrEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kProjection:
         // Check if this is the overflow output projection of an
         // <Operation>WithOverflow node.
@@ -1867,21 +1803,21 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
           // *AFTER* this branch).
           Node* const node = value->InputAt(0);
           Node* const result = NodeProperties::FindProjection(node, 0);
-          if (!result || selector->IsDefined(result)) {
+          if (!result || IsDefined(result)) {
             switch (node->opcode()) {
               case IrOpcode::kInt32AddWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kArmAdd, kArmAdd, cont);
+                return VisitBinop(this, node, kArmAdd, kArmAdd, cont);
               case IrOpcode::kInt32SubWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kArmSub, kArmRsb, cont);
+                return VisitBinop(this, node, kArmSub, kArmRsb, cont);
               case IrOpcode::kInt32MulWithOverflow:
                 // ARM doesn't set the overflow flag for multiplication, so we
                 // need to test on kNotEqual. Here is the code sequence used:
                 //   smull resultlow, resulthigh, left, right
                 //   cmp resulthigh, Operand(resultlow, ASR, 31)
                 cont->OverwriteAndNegateIfEqual(kNotEqual);
-                return EmitInt32MulWithOverflow(selector, node, cont);
+                return EmitInt32MulWithOverflow(this, node, cont);
               default:
                 break;
             }
@@ -1889,87 +1825,38 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
         }
         break;
       case IrOpcode::kInt32Add:
-        return VisitWordCompare(selector, value, kArmCmn, cont);
+        return VisitWordCompare(this, value, kArmCmn, cont);
       case IrOpcode::kInt32Sub:
-        return VisitWordCompare(selector, value, kArmCmp, cont);
+        return VisitWordCompare(this, value, kArmCmp, cont);
       case IrOpcode::kWord32And:
-        return VisitWordCompare(selector, value, kArmTst, cont);
+        return VisitWordCompare(this, value, kArmTst, cont);
       case IrOpcode::kWord32Or:
-        return VisitBinop(selector, value, kArmOrr, kArmOrr, cont);
+        return VisitBinop(this, value, kArmOrr, kArmOrr, cont);
       case IrOpcode::kWord32Xor:
-        return VisitWordCompare(selector, value, kArmTeq, cont);
+        return VisitWordCompare(this, value, kArmTeq, cont);
       case IrOpcode::kWord32Sar:
-        return VisitShift(selector, value, TryMatchASR, cont);
+        return VisitShift(this, value, TryMatchASR, cont);
       case IrOpcode::kWord32Shl:
-        return VisitShift(selector, value, TryMatchLSL, cont);
+        return VisitShift(this, value, TryMatchLSL, cont);
       case IrOpcode::kWord32Shr:
-        return VisitShift(selector, value, TryMatchLSR, cont);
+        return VisitShift(this, value, TryMatchLSR, cont);
       case IrOpcode::kWord32Ror:
-        return VisitShift(selector, value, TryMatchROR, cont);
+        return VisitShift(this, value, TryMatchROR, cont);
       default:
         break;
     }
   }
 
   if (user->opcode() == IrOpcode::kWord32Equal) {
-    return VisitWordCompare(selector, user, cont);
+    return VisitWordCompare(this, user, cont);
   }
 
   // Continuation could not be combined with a compare, emit compare against 0.
-  ArmOperandGenerator g(selector);
+  ArmOperandGenerator g(this);
   InstructionCode const opcode =
-      cont->Encode(kArmTst) | AddressingModeField::encode(kMode_Operand2_R);
+      kArmTst | AddressingModeField::encode(kMode_Operand2_R);
   InstructionOperand const value_operand = g.UseRegister(value);
-  if (cont->IsBranch()) {
-    selector->Emit(opcode, g.NoOutput(), value_operand, value_operand,
-                   g.Label(cont->true_block()), g.Label(cont->false_block()));
-  } else if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, g.NoOutput(), value_operand, value_operand,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsSet()) {
-    selector->Emit(opcode, g.DefineAsRegister(cont->result()), value_operand,
-                   value_operand);
-  } else {
-    DCHECK(cont->IsTrap());
-    selector->Emit(opcode, g.NoOutput(), value_operand, value_operand,
-                   g.UseImmediate(cont->trap_id()));
-  }
-}
-
-}  // namespace
-
-void InstructionSelector::VisitBranch(Node* branch, BasicBlock* tbranch,
-                                      BasicBlock* fbranch) {
-  FlagsContinuation cont(kNotEqual, tbranch, fbranch);
-  VisitWordCompareZero(this, branch, branch->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeIf(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kNotEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeUnless(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapIf(Node* node, Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kNotEqual, func_id, node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapUnless(Node* node,
-                                          Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kEqual, func_id, node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
+  EmitWithContinuation(opcode, value_operand, value_operand, cont);
 }
 
 void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
@@ -1977,24 +1864,26 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
   InstructionOperand value_operand = g.UseRegister(node->InputAt(0));
 
   // Emit either ArchTableSwitch or ArchLookupSwitch.
-  static const size_t kMaxTableSwitchValueRange = 2 << 16;
-  size_t table_space_cost = 4 + sw.value_range;
-  size_t table_time_cost = 3;
-  size_t lookup_space_cost = 3 + 2 * sw.case_count;
-  size_t lookup_time_cost = sw.case_count;
-  if (sw.case_count > 0 &&
-      table_space_cost + 3 * table_time_cost <=
-          lookup_space_cost + 3 * lookup_time_cost &&
-      sw.min_value > std::numeric_limits<int32_t>::min() &&
-      sw.value_range <= kMaxTableSwitchValueRange) {
-    InstructionOperand index_operand = value_operand;
-    if (sw.min_value) {
-      index_operand = g.TempRegister();
-      Emit(kArmSub | AddressingModeField::encode(kMode_Operand2_I),
-           index_operand, value_operand, g.TempImmediate(sw.min_value));
+  if (enable_switch_jump_table_ == kEnableSwitchJumpTable) {
+    static const size_t kMaxTableSwitchValueRange = 2 << 16;
+    size_t table_space_cost = 4 + sw.value_range();
+    size_t table_time_cost = 3;
+    size_t lookup_space_cost = 3 + 2 * sw.case_count();
+    size_t lookup_time_cost = sw.case_count();
+    if (sw.case_count() > 0 &&
+        table_space_cost + 3 * table_time_cost <=
+            lookup_space_cost + 3 * lookup_time_cost &&
+        sw.min_value() > std::numeric_limits<int32_t>::min() &&
+        sw.value_range() <= kMaxTableSwitchValueRange) {
+      InstructionOperand index_operand = value_operand;
+      if (sw.min_value()) {
+        index_operand = g.TempRegister();
+        Emit(kArmSub | AddressingModeField::encode(kMode_Operand2_I),
+             index_operand, value_operand, g.TempImmediate(sw.min_value()));
+      }
+      // Generate a table lookup.
+      return EmitTableSwitch(sw, index_operand);
     }
-    // Generate a table lookup.
-    return EmitTableSwitch(sw, index_operand);
   }
 
   // Generate a sequence of conditional jumps.
@@ -2006,7 +1895,7 @@ void InstructionSelector::VisitWord32Equal(Node* const node) {
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
   Int32BinopMatcher m(node);
   if (m.right().Is(0)) {
-    return VisitWordCompareZero(this, m.node(), m.left().node(), &cont);
+    return VisitWordCompareZero(m.node(), m.left().node(), &cont);
   }
   VisitWordCompare(this, node, &cont);
 }
@@ -2137,7 +2026,7 @@ void InstructionSelector::VisitFloat64InsertHighWord32(Node* node) {
        g.UseRegister(right));
 }
 
-void InstructionSelector::VisitAtomicLoad(Node* node) {
+void InstructionSelector::VisitWord32AtomicLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
   ArmOperandGenerator g(this);
   Node* base = node->InputAt(0);
@@ -2145,13 +2034,15 @@ void InstructionSelector::VisitAtomicLoad(Node* node) {
   ArchOpcode opcode = kArchNop;
   switch (load_rep.representation()) {
     case MachineRepresentation::kWord8:
-      opcode = load_rep.IsSigned() ? kAtomicLoadInt8 : kAtomicLoadUint8;
+      opcode =
+          load_rep.IsSigned() ? kWord32AtomicLoadInt8 : kWord32AtomicLoadUint8;
       break;
     case MachineRepresentation::kWord16:
-      opcode = load_rep.IsSigned() ? kAtomicLoadInt16 : kAtomicLoadUint16;
+      opcode = load_rep.IsSigned() ? kWord32AtomicLoadInt16
+                                   : kWord32AtomicLoadUint16;
       break;
     case MachineRepresentation::kWord32:
-      opcode = kAtomicLoadWord32;
+      opcode = kWord32AtomicLoadWord32;
       break;
     default:
       UNREACHABLE();
@@ -2161,7 +2052,7 @@ void InstructionSelector::VisitAtomicLoad(Node* node) {
        g.DefineAsRegister(node), g.UseRegister(base), g.UseRegister(index));
 }
 
-void InstructionSelector::VisitAtomicStore(Node* node) {
+void InstructionSelector::VisitWord32AtomicStore(Node* node) {
   MachineRepresentation rep = AtomicStoreRepresentationOf(node->op());
   ArmOperandGenerator g(this);
   Node* base = node->InputAt(0);
@@ -2170,13 +2061,13 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
   ArchOpcode opcode = kArchNop;
   switch (rep) {
     case MachineRepresentation::kWord8:
-      opcode = kAtomicStoreWord8;
+      opcode = kWord32AtomicStoreWord8;
       break;
     case MachineRepresentation::kWord16:
-      opcode = kAtomicStoreWord16;
+      opcode = kWord32AtomicStoreWord16;
       break;
     case MachineRepresentation::kWord32:
-      opcode = kAtomicStoreWord32;
+      opcode = kWord32AtomicStoreWord32;
       break;
     default:
       UNREACHABLE();
@@ -2193,7 +2084,7 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
   Emit(code, 0, nullptr, input_count, inputs);
 }
 
-void InstructionSelector::VisitAtomicExchange(Node* node) {
+void InstructionSelector::VisitWord32AtomicExchange(Node* node) {
   ArmOperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -2201,15 +2092,15 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   ArchOpcode opcode = kArchNop;
   MachineType type = AtomicOpRepresentationOf(node->op());
   if (type == MachineType::Int8()) {
-    opcode = kAtomicExchangeInt8;
+    opcode = kWord32AtomicExchangeInt8;
   } else if (type == MachineType::Uint8()) {
-    opcode = kAtomicExchangeUint8;
+    opcode = kWord32AtomicExchangeUint8;
   } else if (type == MachineType::Int16()) {
-    opcode = kAtomicExchangeInt16;
+    opcode = kWord32AtomicExchangeInt16;
   } else if (type == MachineType::Uint16()) {
-    opcode = kAtomicExchangeUint16;
+    opcode = kWord32AtomicExchangeUint16;
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
-    opcode = kAtomicExchangeWord32;
+    opcode = kWord32AtomicExchangeWord32;
   } else {
     UNREACHABLE();
     return;
@@ -2228,7 +2119,7 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   Emit(code, 1, outputs, input_count, inputs, arraysize(temps), temps);
 }
 
-void InstructionSelector::VisitAtomicCompareExchange(Node* node) {
+void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
   ArmOperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -2237,15 +2128,15 @@ void InstructionSelector::VisitAtomicCompareExchange(Node* node) {
   ArchOpcode opcode = kArchNop;
   MachineType type = AtomicOpRepresentationOf(node->op());
   if (type == MachineType::Int8()) {
-    opcode = kAtomicCompareExchangeInt8;
+    opcode = kWord32AtomicCompareExchangeInt8;
   } else if (type == MachineType::Uint8()) {
-    opcode = kAtomicCompareExchangeUint8;
+    opcode = kWord32AtomicCompareExchangeUint8;
   } else if (type == MachineType::Int16()) {
-    opcode = kAtomicCompareExchangeInt16;
+    opcode = kWord32AtomicCompareExchangeInt16;
   } else if (type == MachineType::Uint16()) {
-    opcode = kAtomicCompareExchangeUint16;
+    opcode = kWord32AtomicCompareExchangeUint16;
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
-    opcode = kAtomicCompareExchangeWord32;
+    opcode = kWord32AtomicCompareExchangeWord32;
   } else {
     UNREACHABLE();
     return;
@@ -2304,11 +2195,12 @@ void InstructionSelector::VisitAtomicBinaryOperation(
   Emit(code, 1, outputs, input_count, inputs, arraysize(temps), temps);
 }
 
-#define VISIT_ATOMIC_BINOP(op)                                              \
-  void InstructionSelector::VisitAtomic##op(Node* node) {                   \
-    VisitAtomicBinaryOperation(node, kAtomic##op##Int8, kAtomic##op##Uint8, \
-                               kAtomic##op##Int16, kAtomic##op##Uint16,     \
-                               kAtomic##op##Word32);                        \
+#define VISIT_ATOMIC_BINOP(op)                                   \
+  void InstructionSelector::VisitWord32Atomic##op(Node* node) {  \
+    VisitAtomicBinaryOperation(                                  \
+        node, kWord32Atomic##op##Int8, kWord32Atomic##op##Uint8, \
+        kWord32Atomic##op##Int16, kWord32Atomic##op##Uint16,     \
+        kWord32Atomic##op##Word32);                              \
   }
 VISIT_ATOMIC_BINOP(Add)
 VISIT_ATOMIC_BINOP(Sub)
@@ -2323,11 +2215,6 @@ VISIT_ATOMIC_BINOP(Xor)
   V(I16x8)                \
   V(I8x16)
 
-#define SIMD_FORMAT_LIST(V) \
-  V(32x4, 4)                \
-  V(16x8, 8)                \
-  V(8x16, 16)
-
 #define SIMD_UNOP_LIST(V)                               \
   V(F32x4SConvertI32x4, kArmF32x4SConvertI32x4)         \
   V(F32x4UConvertI32x4, kArmF32x4UConvertI32x4)         \
@@ -2460,6 +2347,7 @@ SIMD_TYPE_LIST(SIMD_VISIT_EXTRACT_LANE)
   }
 SIMD_TYPE_LIST(SIMD_VISIT_REPLACE_LANE)
 #undef SIMD_VISIT_REPLACE_LANE
+#undef SIMD_TYPE_LIST
 
 #define SIMD_VISIT_UNOP(Name, instruction)            \
   void InstructionSelector::Visit##Name(Node* node) { \
@@ -2467,6 +2355,7 @@ SIMD_TYPE_LIST(SIMD_VISIT_REPLACE_LANE)
   }
 SIMD_UNOP_LIST(SIMD_VISIT_UNOP)
 #undef SIMD_VISIT_UNOP
+#undef SIMD_UNOP_LIST
 
 #define SIMD_VISIT_SHIFT_OP(Name)                     \
   void InstructionSelector::Visit##Name(Node* node) { \
@@ -2474,6 +2363,7 @@ SIMD_UNOP_LIST(SIMD_VISIT_UNOP)
   }
 SIMD_SHIFT_OP_LIST(SIMD_VISIT_SHIFT_OP)
 #undef SIMD_VISIT_SHIFT_OP
+#undef SIMD_SHIFT_OP_LIST
 
 #define SIMD_VISIT_BINOP(Name, instruction)           \
   void InstructionSelector::Visit##Name(Node* node) { \
@@ -2481,6 +2371,7 @@ SIMD_SHIFT_OP_LIST(SIMD_VISIT_SHIFT_OP)
   }
 SIMD_BINOP_LIST(SIMD_VISIT_BINOP)
 #undef SIMD_VISIT_BINOP
+#undef SIMD_BINOP_LIST
 
 void InstructionSelector::VisitS128Select(Node* node) {
   ArmOperandGenerator g(this);
@@ -2575,7 +2466,7 @@ void ArrangeShuffleTable(ArmOperandGenerator* g, Node* input0, Node* input1,
 }  // namespace
 
 void InstructionSelector::VisitS8x16Shuffle(Node* node) {
-  const uint8_t* shuffle = OpParameter<uint8_t*>(node);
+  const uint8_t* shuffle = OpParameter<uint8_t*>(node->op());
   uint8_t mask = CanonicalizeShuffle(node);
   uint8_t shuffle32x4[4];
   ArmOperandGenerator g(this);
@@ -2631,6 +2522,18 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
        g.UseImmediate(Pack4Lanes(shuffle + 12, mask)));
 }
 
+void InstructionSelector::VisitSignExtendWord8ToInt32(Node* node) {
+  ArmOperandGenerator g(this);
+  Emit(kArmSxtb, g.DefineAsRegister(node), g.UseRegister(node->InputAt(0)),
+       g.TempImmediate(0));
+}
+
+void InstructionSelector::VisitSignExtendWord16ToInt32(Node* node) {
+  ArmOperandGenerator g(this);
+  Emit(kArmSxth, g.DefineAsRegister(node), g.UseRegister(node->InputAt(0)),
+       g.TempImmediate(0));
+}
+
 void InstructionSelector::VisitInt32AbsWithOverflow(Node* node) {
   UNREACHABLE();
 }
@@ -2642,7 +2545,8 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
 // static
 MachineOperatorBuilder::Flags
 InstructionSelector::SupportedMachineOperatorFlags() {
-  MachineOperatorBuilder::Flags flags;
+  MachineOperatorBuilder::Flags flags =
+      MachineOperatorBuilder::kSpeculationFence;
   if (CpuFeatures::IsSupported(SUDIV)) {
     // The sdiv and udiv instructions correctly return 0 if the divisor is 0,
     // but the fall-back implementation does not.
diff --git a/deps/v8/src/compiler/arm/unwinding-info-writer-arm.h b/deps/v8/src/compiler/arm/unwinding-info-writer-arm.h
index d47ca083ae0..a741121e324 100644
--- a/deps/v8/src/compiler/arm/unwinding-info-writer-arm.h
+++ b/deps/v8/src/compiler/arm/unwinding-info-writer-arm.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_COMPILER_ARM_UNWINDING_INFO_WRITER_H_
-#define V8_COMPILER_ARM_UNWINDING_INFO_WRITER_H_
+#ifndef V8_COMPILER_ARM_UNWINDING_INFO_WRITER_ARM_H_
+#define V8_COMPILER_ARM_UNWINDING_INFO_WRITER_ARM_H_
 
 #include "src/eh-frame.h"
 
@@ -69,4 +69,4 @@ class UnwindingInfoWriter {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_COMPILER_ARM_UNWINDING_INFO_WRITER_ARM_H_
diff --git a/deps/v8/src/compiler/arm64/code-generator-arm64.cc b/deps/v8/src/compiler/arm64/code-generator-arm64.cc
index 147d85a171c..7b2fce2136a 100644
--- a/deps/v8/src/compiler/arm64/code-generator-arm64.cc
+++ b/deps/v8/src/compiler/arm64/code-generator-arm64.cc
@@ -213,16 +213,11 @@ class Arm64OperandConverter final : public InstructionOperandConverter {
     Constant constant = ToConstant(operand);
     switch (constant.type()) {
       case Constant::kInt32:
-        if (RelocInfo::IsWasmSizeReference(constant.rmode())) {
-          return Operand(constant.ToInt32(), constant.rmode());
-        } else {
-          return Operand(constant.ToInt32());
-        }
+        return Operand(constant.ToInt32());
       case Constant::kInt64:
         if (RelocInfo::IsWasmPtrReference(constant.rmode())) {
           return Operand(constant.ToInt64(), constant.rmode());
         } else {
-          DCHECK(!RelocInfo::IsWasmSizeReference(constant.rmode()));
           return Operand(constant.ToInt64());
         }
       case Constant::kFloat32:
@@ -256,8 +251,7 @@ class Arm64OperandConverter final : public InstructionOperandConverter {
         offset = FrameOffset::FromStackPointer(from_sp);
       }
     }
-    return MemOperand(offset.from_stack_pointer() ? tasm->StackPointer() : fp,
-                      offset.offset());
+    return MemOperand(offset.from_stack_pointer() ? sp : fp, offset.offset());
   }
 };
 
@@ -297,8 +291,7 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
     if (must_save_lr_) {
       // We need to save and restore lr if the frame was elided.
       __ Push(lr, padreg);
-      unwinding_info_writer_->MarkLinkRegisterOnTopOfStack(__ pc_offset(),
-                                                           __ StackPointer());
+      unwinding_info_writer_->MarkLinkRegisterOnTopOfStack(__ pc_offset(), sp);
     }
     __ CallRecordWriteStub(object_, scratch1_, remembered_set_action,
                            save_fp_mode);
@@ -374,6 +367,19 @@ Condition FlagsConditionToCondition(FlagsCondition condition) {
   UNREACHABLE();
 }
 
+void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
+                                   InstructionCode opcode, Instruction* instr,
+                                   Arm64OperandConverter& i) {
+  const MemoryAccessMode access_mode =
+      static_cast<MemoryAccessMode>(MiscField::decode(opcode));
+  if (access_mode == kMemoryAccessPoisoned) {
+    Register value = i.OutputRegister();
+    Register poison = value.Is64Bits() ? kSpeculationPoisonRegister
+                                       : kSpeculationPoisonRegister.W();
+    codegen->tasm()->And(value, value, Operand(poison));
+  }
+}
+
 }  // namespace
 
 #define ASSEMBLE_SHIFT(asm_instr, width)                                    \
@@ -455,7 +461,7 @@ Condition FlagsConditionToCondition(FlagsCondition condition) {
   } while (0)
 
 void CodeGenerator::AssembleDeconstructFrame() {
-  __ Mov(csp, fp);
+  __ Mov(sp, fp);
   __ Pop(fp, lr);
 
   unwinding_info_writer_.MarkFrameDeconstructed(__ pc_offset());
@@ -535,29 +541,27 @@ void CodeGenerator::AssembleTailCallAfterGap(Instruction* instr,
   }
 }
 
+// Check that {kJavaScriptCallCodeStartRegister} is correct.
+void CodeGenerator::AssembleCodeStartRegisterCheck() {
+  UseScratchRegisterScope temps(tasm());
+  Register scratch = temps.AcquireX();
+  __ ComputeCodeStartAddress(scratch);
+  __ cmp(scratch, kJavaScriptCallCodeStartRegister);
+  __ Assert(eq, AbortReason::kWrongFunctionCodeStart);
+}
+
 // Check if the code object is marked for deoptimization. If it is, then it
 // jumps to the CompileLazyDeoptimizedCode builtin. In order to do this we need
 // to:
-//    1. compute the offset of the {CodeDataContainer} from our current location
-//       and load it.
-//    2. read from memory the word that contains that bit, which can be found in
+//    1. read from memory the word that contains that bit, which can be found in
 //       the flags in the referenced {CodeDataContainer} object;
-//    3. test kMarkedForDeoptimizationBit in those flags; and
-//    4. if it is not zero then it jumps to the builtin.
+//    2. test kMarkedForDeoptimizationBit in those flags; and
+//    3. if it is not zero then it jumps to the builtin.
 void CodeGenerator::BailoutIfDeoptimized() {
   UseScratchRegisterScope temps(tasm());
   Register scratch = temps.AcquireX();
-  {
-    // Since we always emit a bailout check at the very beginning we can be
-    // certain that the distance between here and the {CodeDataContainer} is
-    // fixed and always in range of a load.
-    int data_container_offset =
-        (Code::kCodeDataContainerOffset - Code::kHeaderSize) - __ pc_offset();
-    DCHECK_GE(0, data_container_offset);
-    DCHECK_EQ(0, data_container_offset % 4);
-    InstructionAccurateScope scope(tasm());
-    __ ldr_pcrel(scratch, data_container_offset >> 2);
-  }
+  int offset = Code::kCodeDataContainerOffset - Code::kHeaderSize;
+  __ Ldr(scratch, MemOperand(kJavaScriptCallCodeStartRegister, offset));
   __ Ldr(scratch,
          FieldMemOperand(scratch, CodeDataContainer::kKindSpecificFlagsOffset));
   Label not_deoptimized;
@@ -568,6 +572,29 @@ void CodeGenerator::BailoutIfDeoptimized() {
   __ Bind(&not_deoptimized);
 }
 
+void CodeGenerator::GenerateSpeculationPoisonFromCodeStartRegister() {
+  UseScratchRegisterScope temps(tasm());
+  Register scratch = temps.AcquireX();
+
+  // Set a mask which has all bits set in the normal case, but has all
+  // bits cleared if we are speculatively executing the wrong PC.
+  __ ComputeCodeStartAddress(scratch);
+  __ Cmp(kJavaScriptCallCodeStartRegister, scratch);
+  __ Csetm(kSpeculationPoisonRegister, eq);
+  __ Csdb();
+}
+
+void CodeGenerator::AssembleRegisterArgumentPoisoning() {
+  UseScratchRegisterScope temps(tasm());
+  Register scratch = temps.AcquireX();
+
+  __ Mov(scratch, sp);
+  __ And(kJSFunctionRegister, kJSFunctionRegister, kSpeculationPoisonRegister);
+  __ And(kContextRegister, kContextRegister, kSpeculationPoisonRegister);
+  __ And(scratch, scratch, kSpeculationPoisonRegister);
+  __ Mov(sp, scratch);
+}
+
 // Assembles an instruction after register allocation, producing machine code.
 CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     Instruction* instr) {
@@ -680,9 +707,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ cmp(cp, temp);
         __ Assert(eq, AbortReason::kWrongFunctionContext);
       }
-      __ Ldr(x10, FieldMemOperand(func, JSFunction::kCodeOffset));
-      __ Add(x10, x10, Operand(Code::kHeaderSize - kHeapObjectTag));
-      __ Call(x10);
+      static_assert(kJavaScriptCallCodeStartRegister == x2, "ABI mismatch");
+      __ Ldr(x2, FieldMemOperand(func, JSFunction::kCodeOffset));
+      __ Add(x2, x2, Operand(Code::kHeaderSize - kHeapObjectTag));
+      __ Call(x2);
       RecordCallPosition(instr);
       frame_access_state()->ClearSPDelta();
       break;
@@ -799,7 +827,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       AssembleReturn(instr->InputAt(0));
       break;
     case kArchStackPointer:
-      __ mov(i.OutputRegister(), tasm()->StackPointer());
+      __ mov(i.OutputRegister(), sp);
       break;
     case kArchFramePointer:
       __ mov(i.OutputRegister(), fp);
@@ -811,6 +839,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), fp);
       }
       break;
+    case kArchRootsPointer:
+      __ mov(i.OutputRegister(), root);
+      break;
     case kArchTruncateDoubleToI:
       __ TruncateDoubleToIDelayed(zone(), i.OutputRegister(),
                                   i.InputDoubleRegister(0));
@@ -844,7 +875,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchStackSlot: {
       FrameOffset offset =
           frame_access_state()->GetFrameOffset(i.InputInt32(0));
-      Register base = offset.from_stack_pointer() ? __ StackPointer() : fp;
+      Register base = offset.from_stack_pointer() ? sp : fp;
       __ Add(i.OutputRegister(0), base, Operand(offset.offset()));
       break;
     }
@@ -1161,6 +1192,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArm64Sxth32:
       __ Sxth(i.OutputRegister32(), i.InputRegister32(0));
       break;
+    case kArm64Sxtb:
+      __ Sxtb(i.OutputRegister(), i.InputRegister32(0));
+      break;
+    case kArm64Sxth:
+      __ Sxth(i.OutputRegister(), i.InputRegister32(0));
+      break;
     case kArm64Sxtw:
       __ Sxtw(i.OutputRegister(), i.InputRegister32(0));
       break;
@@ -1190,12 +1227,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     case kArm64CompareAndBranch32:
     case kArm64CompareAndBranch:
-      // Pseudo instruction turned into cbz/cbnz in AssembleArchBranch.
+      // Pseudo instruction handled in AssembleArchBranch.
       break;
     case kArm64Claim: {
       int count = i.InputInt32(0);
       DCHECK_EQ(count % 2, 0);
-      __ AssertCspAligned();
+      __ AssertSpAligned();
       if (count > 0) {
         __ Claim(count);
         frame_access_state()->IncreaseSPDelta(count);
@@ -1493,33 +1530,40 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     case kArm64Ldrb:
       __ Ldrb(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kArm64Ldrsb:
       __ Ldrsb(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kArm64Strb:
       __ Strb(i.InputOrZeroRegister64(0), i.MemoryOperand(1));
       break;
     case kArm64Ldrh:
       __ Ldrh(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kArm64Ldrsh:
       __ Ldrsh(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kArm64Strh:
       __ Strh(i.InputOrZeroRegister64(0), i.MemoryOperand(1));
       break;
     case kArm64Ldrsw:
       __ Ldrsw(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kArm64LdrW:
       __ Ldr(i.OutputRegister32(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kArm64StrW:
       __ Str(i.InputOrZeroRegister32(0), i.MemoryOperand(1));
       break;
     case kArm64Ldr:
       __ Ldr(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kArm64Str:
       __ Str(i.InputOrZeroRegister64(0), i.MemoryOperand(1));
@@ -1542,82 +1586,90 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArm64StrQ:
       __ Str(i.InputSimd128Register(0), i.MemoryOperand(1));
       break;
-    case kAtomicLoadInt8:
+    case kArm64DsbIsb:
+      __ Dsb(FullSystem, BarrierAll);
+      __ Isb();
+      break;
+    case kArchPoisonOnSpeculationWord:
+      __ And(i.OutputRegister(0), i.InputRegister(0),
+             Operand(kSpeculationPoisonRegister));
+      break;
+    case kWord32AtomicLoadInt8:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldarb);
       __ Sxtb(i.OutputRegister(0), i.OutputRegister(0));
       break;
-    case kAtomicLoadUint8:
+    case kWord32AtomicLoadUint8:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldarb);
       break;
-    case kAtomicLoadInt16:
+    case kWord32AtomicLoadInt16:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldarh);
       __ Sxth(i.OutputRegister(0), i.OutputRegister(0));
       break;
-    case kAtomicLoadUint16:
+    case kWord32AtomicLoadUint16:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldarh);
       break;
-    case kAtomicLoadWord32:
+    case kWord32AtomicLoadWord32:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldar);
       break;
-    case kAtomicStoreWord8:
+    case kWord32AtomicStoreWord8:
       ASSEMBLE_ATOMIC_STORE_INTEGER(Stlrb);
       break;
-    case kAtomicStoreWord16:
+    case kWord32AtomicStoreWord16:
       ASSEMBLE_ATOMIC_STORE_INTEGER(Stlrh);
       break;
-    case kAtomicStoreWord32:
+    case kWord32AtomicStoreWord32:
       ASSEMBLE_ATOMIC_STORE_INTEGER(Stlr);
       break;
-    case kAtomicExchangeInt8:
+    case kWord32AtomicExchangeInt8:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxrb, stlxrb);
       __ Sxtb(i.OutputRegister(0), i.OutputRegister(0));
       break;
-    case kAtomicExchangeUint8:
+    case kWord32AtomicExchangeUint8:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxrb, stlxrb);
       break;
-    case kAtomicExchangeInt16:
+    case kWord32AtomicExchangeInt16:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxrh, stlxrh);
       __ Sxth(i.OutputRegister(0), i.OutputRegister(0));
       break;
-    case kAtomicExchangeUint16:
+    case kWord32AtomicExchangeUint16:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxrh, stlxrh);
       break;
-    case kAtomicExchangeWord32:
+    case kWord32AtomicExchangeWord32:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxr, stlxr);
       break;
-    case kAtomicCompareExchangeInt8:
+    case kWord32AtomicCompareExchangeInt8:
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxrb, stlxrb, UXTB);
       __ Sxtb(i.OutputRegister(0), i.OutputRegister(0));
       break;
-    case kAtomicCompareExchangeUint8:
+    case kWord32AtomicCompareExchangeUint8:
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxrb, stlxrb, UXTB);
       break;
-    case kAtomicCompareExchangeInt16:
+    case kWord32AtomicCompareExchangeInt16:
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxrh, stlxrh, UXTH);
       __ Sxth(i.OutputRegister(0), i.OutputRegister(0));
       break;
-    case kAtomicCompareExchangeUint16:
+    case kWord32AtomicCompareExchangeUint16:
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxrh, stlxrh, UXTH);
       break;
-    case kAtomicCompareExchangeWord32:
+    case kWord32AtomicCompareExchangeWord32:
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxr, stlxr, UXTW);
       break;
 #define ATOMIC_BINOP_CASE(op, inst)                    \
-  case kAtomic##op##Int8:                              \
+  case kWord32Atomic##op##Int8:                        \
     ASSEMBLE_ATOMIC_BINOP(ldaxrb, stlxrb, inst);       \
     __ Sxtb(i.OutputRegister(0), i.OutputRegister(0)); \
     break;                                             \
-  case kAtomic##op##Uint8:                             \
+  case kWord32Atomic##op##Uint8:                       \
     ASSEMBLE_ATOMIC_BINOP(ldaxrb, stlxrb, inst);       \
     break;                                             \
-  case kAtomic##op##Int16:                             \
+  case kWord32Atomic##op##Int16:                       \
     ASSEMBLE_ATOMIC_BINOP(ldaxrh, stlxrh, inst);       \
     __ Sxth(i.OutputRegister(0), i.OutputRegister(0)); \
     break;                                             \
-  case kAtomic##op##Uint16:                            \
+  case kWord32Atomic##op##Uint16:                      \
     ASSEMBLE_ATOMIC_BINOP(ldaxrh, stlxrh, inst);       \
     break;                                             \
-  case kAtomic##op##Word32:                            \
+  case kWord32Atomic##op##Word32:                      \
     ASSEMBLE_ATOMIC_BINOP(ldaxr, stlxr, inst);         \
     break;
       ATOMIC_BINOP_CASE(Add, Add)
@@ -2097,6 +2149,7 @@ void CodeGenerator::AssembleArchBranch(Instruction* instr, BranchInfo* branch) {
   ArchOpcode opcode = instr->arch_opcode();
 
   if (opcode == kArm64CompareAndBranch32) {
+    DCHECK(FlagsModeField::decode(instr->opcode()) != kFlags_branch_and_poison);
     switch (condition) {
       case kEqual:
         __ Cbz(i.InputRegister32(0), tlabel);
@@ -2108,6 +2161,7 @@ void CodeGenerator::AssembleArchBranch(Instruction* instr, BranchInfo* branch) {
         UNREACHABLE();
     }
   } else if (opcode == kArm64CompareAndBranch) {
+    DCHECK(FlagsModeField::decode(instr->opcode()) != kFlags_branch_and_poison);
     switch (condition) {
       case kEqual:
         __ Cbz(i.InputRegister64(0), tlabel);
@@ -2119,6 +2173,7 @@ void CodeGenerator::AssembleArchBranch(Instruction* instr, BranchInfo* branch) {
         UNREACHABLE();
     }
   } else if (opcode == kArm64TestAndBranch32) {
+    DCHECK(FlagsModeField::decode(instr->opcode()) != kFlags_branch_and_poison);
     switch (condition) {
       case kEqual:
         __ Tbz(i.InputRegister32(0), i.InputInt5(1), tlabel);
@@ -2130,6 +2185,7 @@ void CodeGenerator::AssembleArchBranch(Instruction* instr, BranchInfo* branch) {
         UNREACHABLE();
     }
   } else if (opcode == kArm64TestAndBranch) {
+    DCHECK(FlagsModeField::decode(instr->opcode()) != kFlags_branch_and_poison);
     switch (condition) {
       case kEqual:
         __ Tbz(i.InputRegister64(0), i.InputInt6(1), tlabel);
@@ -2147,6 +2203,19 @@ void CodeGenerator::AssembleArchBranch(Instruction* instr, BranchInfo* branch) {
   if (!branch->fallthru) __ B(flabel);  // no fallthru to flabel.
 }
 
+void CodeGenerator::AssembleBranchPoisoning(FlagsCondition condition,
+                                            Instruction* instr) {
+  // TODO(jarin) Handle float comparisons (kUnordered[Not]Equal).
+  if (condition == kUnorderedEqual || condition == kUnorderedNotEqual) {
+    return;
+  }
+
+  condition = NegateFlagsCondition(condition);
+  __ CmovX(kSpeculationPoisonRegister, xzr,
+           FlagsConditionToCondition(condition));
+  __ Csdb();
+}
+
 void CodeGenerator::AssembleArchDeoptBranch(Instruction* instr,
                                             BranchInfo* branch) {
   AssembleArchBranch(instr, branch);
@@ -2189,13 +2258,13 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                              __ isolate()),
                          0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
-        CallDescriptor* descriptor = gen_->linkage()->GetIncomingDescriptor();
-        int pop_count = static_cast<int>(descriptor->StackParameterCount());
+        auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
+        int pop_count =
+            static_cast<int>(call_descriptor->StackParameterCount());
         pop_count += (pop_count & 1);  // align
         __ Drop(pop_count);
         __ Ret();
       } else {
-        DCHECK(csp.Is(__ StackPointer()));
         gen_->AssembleSourcePosition(instr_);
         __ Call(__ isolate()->builtins()->builtin_handle(trap_id),
                 RelocInfo::CODE_TARGET);
@@ -2267,11 +2336,11 @@ void CodeGenerator::AssembleArchTableSwitch(Instruction* instr) {
 
 void CodeGenerator::FinishFrame(Frame* frame) {
   frame->AlignFrame(16);
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
 
   // Save FP registers.
   CPURegList saves_fp = CPURegList(CPURegister::kVRegister, kDRegSizeInBits,
-                                   descriptor->CalleeSavedFPRegisters());
+                                   call_descriptor->CalleeSavedFPRegisters());
   int saved_count = saves_fp.Count();
   if (saved_count != 0) {
     DCHECK(saves_fp.list() == CPURegList::GetCalleeSavedV().list());
@@ -2281,7 +2350,7 @@ void CodeGenerator::FinishFrame(Frame* frame) {
   }
 
   CPURegList saves = CPURegList(CPURegister::kRegister, kXRegSizeInBits,
-                                descriptor->CalleeSavedRegisters());
+                                call_descriptor->CalleeSavedRegisters());
   saved_count = saves.Count();
   if (saved_count != 0) {
     DCHECK_EQ(saved_count % 2, 0);
@@ -2290,29 +2359,29 @@ void CodeGenerator::FinishFrame(Frame* frame) {
 }
 
 void CodeGenerator::AssembleConstructFrame() {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
-  __ AssertCspAligned();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
+  __ AssertSpAligned();
 
   // The frame has been previously padded in CodeGenerator::FinishFrame().
   DCHECK_EQ(frame()->GetTotalFrameSlotCount() % 2, 0);
-  int shrink_slots =
-      frame()->GetTotalFrameSlotCount() - descriptor->CalculateFixedFrameSize();
+  int shrink_slots = frame()->GetTotalFrameSlotCount() -
+                     call_descriptor->CalculateFixedFrameSize();
 
   CPURegList saves = CPURegList(CPURegister::kRegister, kXRegSizeInBits,
-                                descriptor->CalleeSavedRegisters());
+                                call_descriptor->CalleeSavedRegisters());
   CPURegList saves_fp = CPURegList(CPURegister::kVRegister, kDRegSizeInBits,
-                                   descriptor->CalleeSavedFPRegisters());
+                                   call_descriptor->CalleeSavedFPRegisters());
   // The number of slots for returns has to be even to ensure the correct stack
   // alignment.
   const int returns = RoundUp(frame()->GetReturnSlotCount(), 2);
 
   if (frame_access_state()->has_frame()) {
     // Link the frame
-    if (descriptor->IsJSFunctionCall()) {
+    if (call_descriptor->IsJSFunctionCall()) {
       __ Prologue();
     } else {
       __ Push(lr, fp);
-      __ Mov(fp, __ StackPointer());
+      __ Mov(fp, sp);
     }
     unwinding_info_writer_.MarkFrameConstructed(__ pc_offset());
 
@@ -2328,6 +2397,7 @@ void CodeGenerator::AssembleConstructFrame() {
       if (FLAG_code_comments) __ RecordComment("-- OSR entrypoint --");
       osr_pc_offset_ = __ pc_offset();
       shrink_slots -= osr_helper()->UnoptimizedFrameSlots();
+      ResetSpeculationPoison();
     }
 
     if (info()->IsWasm() && shrink_slots > 128) {
@@ -2346,7 +2416,7 @@ void CodeGenerator::AssembleConstructFrame() {
                             __ isolate())));
         __ Ldr(scratch, MemOperand(scratch));
         __ Add(scratch, scratch, shrink_slots * kPointerSize);
-        __ Cmp(__ StackPointer(), scratch);
+        __ Cmp(sp, scratch);
         __ B(hs, &done);
       }
 
@@ -2356,8 +2426,6 @@ void CodeGenerator::AssembleConstructFrame() {
         // runtime call.
         __ EnterFrame(StackFrame::WASM_COMPILED);
       }
-      DCHECK(__ StackPointer().Is(csp));
-      __ AssertStackConsistency();
       __ Mov(cp, Smi::kZero);
       __ CallRuntimeDelayed(zone(), Runtime::kThrowWasmStackOverflow);
       // We come from WebAssembly, there are no references for the GC.
@@ -2367,7 +2435,6 @@ void CodeGenerator::AssembleConstructFrame() {
       if (FLAG_debug_code) {
         __ Brk(0);
       }
-      __ AssertStackConsistency();
       __ Bind(&done);
     }
 
@@ -2380,9 +2447,9 @@ void CodeGenerator::AssembleConstructFrame() {
     // frame-specific header information, i.e. claiming the extra slot that
     // other platforms explicitly push for STUB (code object) frames and frames
     // recording their argument count.
-    switch (descriptor->kind()) {
+    switch (call_descriptor->kind()) {
       case CallDescriptor::kCallJSFunction:
-        if (descriptor->PushArgumentCount()) {
+        if (call_descriptor->PushArgumentCount()) {
           __ Claim(shrink_slots + 1);  // Claim extra slot for argc.
           __ Str(kJavaScriptCallArgCountRegister,
                  MemOperand(fp, OptimizedBuiltinFrameConstants::kArgCOffset));
@@ -2424,7 +2491,7 @@ void CodeGenerator::AssembleConstructFrame() {
 }
 
 void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
 
   const int returns = RoundUp(frame()->GetReturnSlotCount(), 2);
 
@@ -2434,19 +2501,19 @@ void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
 
   // Restore registers.
   CPURegList saves = CPURegList(CPURegister::kRegister, kXRegSizeInBits,
-                                descriptor->CalleeSavedRegisters());
+                                call_descriptor->CalleeSavedRegisters());
   __ PopCPURegList(saves);
 
   // Restore fp registers.
   CPURegList saves_fp = CPURegList(CPURegister::kVRegister, kDRegSizeInBits,
-                                   descriptor->CalleeSavedFPRegisters());
+                                   call_descriptor->CalleeSavedFPRegisters());
   __ PopCPURegList(saves_fp);
 
   unwinding_info_writer_.MarkBlockWillExit();
 
   Arm64OperandConverter g(this, nullptr);
-  int pop_count = static_cast<int>(descriptor->StackParameterCount());
-  if (descriptor->IsCFunctionCall()) {
+  int pop_count = static_cast<int>(call_descriptor->StackParameterCount());
+  if (call_descriptor->IsCFunctionCall()) {
     AssembleDeconstructFrame();
   } else if (frame_access_state()->has_frame()) {
     // Canonicalize JSFunction return sites for now unless they have an variable
@@ -2473,7 +2540,7 @@ void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
     __ DropArguments(pop_reg);
   }
 
-  __ AssertCspAligned();
+  __ AssertSpAligned();
   __ Ret();
 }
 
@@ -2482,195 +2549,195 @@ void CodeGenerator::FinishCode() { __ CheckConstPool(true, false); }
 void CodeGenerator::AssembleMove(InstructionOperand* source,
                                  InstructionOperand* destination) {
   Arm64OperandConverter g(this, nullptr);
-  // Dispatch on the source and destination operand kinds.  Not all
-  // combinations are possible.
-  if (source->IsRegister()) {
-    DCHECK(destination->IsRegister() || destination->IsStackSlot());
-    Register src = g.ToRegister(source);
-    if (destination->IsRegister()) {
-      __ Mov(g.ToRegister(destination), src);
-    } else {
-      __ Str(src, g.ToMemOperand(destination, tasm()));
-    }
-  } else if (source->IsStackSlot()) {
-    MemOperand src = g.ToMemOperand(source, tasm());
-    DCHECK(destination->IsRegister() || destination->IsStackSlot());
-    if (destination->IsRegister()) {
-      __ Ldr(g.ToRegister(destination), src);
+  // Helper function to write the given constant to the dst register.
+  auto MoveConstantToRegister = [&](Register dst, Constant src) {
+    if (src.type() == Constant::kHeapObject) {
+      Handle<HeapObject> src_object = src.ToHeapObject();
+      Heap::RootListIndex index;
+      if (IsMaterializableFromRoot(src_object, &index)) {
+        __ LoadRoot(dst, index);
+      } else {
+        __ Mov(dst, src_object);
+      }
     } else {
-      UseScratchRegisterScope scope(tasm());
-      Register temp = scope.AcquireX();
-      __ Ldr(temp, src);
-      __ Str(temp, g.ToMemOperand(destination, tasm()));
+      __ Mov(dst, g.ToImmediate(source));
     }
-  } else if (source->IsConstant()) {
-    Constant src = g.ToConstant(ConstantOperand::cast(source));
-    if (destination->IsRegister() || destination->IsStackSlot()) {
-      UseScratchRegisterScope scope(tasm());
-      Register dst = destination->IsRegister() ? g.ToRegister(destination)
-                                               : scope.AcquireX();
-      if (src.type() == Constant::kHeapObject) {
-        Handle<HeapObject> src_object = src.ToHeapObject();
-        Heap::RootListIndex index;
-        if (IsMaterializableFromRoot(src_object, &index)) {
-          __ LoadRoot(dst, index);
-        } else {
-          __ Mov(dst, src_object);
-        }
+  };
+  switch (MoveType::InferMove(source, destination)) {
+    case MoveType::kRegisterToRegister:
+      if (source->IsRegister()) {
+        __ Mov(g.ToRegister(destination), g.ToRegister(source));
+      } else if (source->IsFloatRegister() || source->IsDoubleRegister()) {
+        __ Mov(g.ToDoubleRegister(destination), g.ToDoubleRegister(source));
       } else {
-        __ Mov(dst, g.ToImmediate(source));
-      }
-      if (destination->IsStackSlot()) {
-        __ Str(dst, g.ToMemOperand(destination, tasm()));
+        DCHECK(source->IsSimd128Register());
+        __ Mov(g.ToDoubleRegister(destination).Q(),
+               g.ToDoubleRegister(source).Q());
       }
-    } else if (src.type() == Constant::kFloat32) {
-      if (destination->IsFPRegister()) {
-        VRegister dst = g.ToDoubleRegister(destination).S();
-        __ Fmov(dst, src.ToFloat32());
+      return;
+    case MoveType::kRegisterToStack: {
+      MemOperand dst = g.ToMemOperand(destination, tasm());
+      if (source->IsRegister()) {
+        __ Str(g.ToRegister(source), dst);
       } else {
-        DCHECK(destination->IsFPStackSlot());
-        if (bit_cast<int32_t>(src.ToFloat32()) == 0) {
-          __ Str(wzr, g.ToMemOperand(destination, tasm()));
+        VRegister src = g.ToDoubleRegister(source);
+        if (source->IsFloatRegister() || source->IsDoubleRegister()) {
+          __ Str(src, dst);
         } else {
-          UseScratchRegisterScope scope(tasm());
-          VRegister temp = scope.AcquireS();
-          __ Fmov(temp, src.ToFloat32());
-          __ Str(temp, g.ToMemOperand(destination, tasm()));
+          DCHECK(source->IsSimd128Register());
+          __ Str(src.Q(), dst);
         }
       }
-    } else {
-      DCHECK_EQ(Constant::kFloat64, src.type());
-      if (destination->IsFPRegister()) {
-        VRegister dst = g.ToDoubleRegister(destination);
-        __ Fmov(dst, src.ToFloat64().value());
+      return;
+    }
+    case MoveType::kStackToRegister: {
+      MemOperand src = g.ToMemOperand(source, tasm());
+      if (destination->IsRegister()) {
+        __ Ldr(g.ToRegister(destination), src);
       } else {
-        DCHECK(destination->IsFPStackSlot());
-        if (src.ToFloat64().AsUint64() == 0) {
-          __ Str(xzr, g.ToMemOperand(destination, tasm()));
+        VRegister dst = g.ToDoubleRegister(destination);
+        if (destination->IsFloatRegister() || destination->IsDoubleRegister()) {
+          __ Ldr(dst, src);
         } else {
-          UseScratchRegisterScope scope(tasm());
-          VRegister temp = scope.AcquireD();
-          __ Fmov(temp, src.ToFloat64().value());
-          __ Str(temp, g.ToMemOperand(destination, tasm()));
+          DCHECK(destination->IsSimd128Register());
+          __ Ldr(dst.Q(), src);
         }
       }
+      return;
     }
-  } else if (source->IsFPRegister()) {
-    VRegister src = g.ToDoubleRegister(source);
-    if (destination->IsFPRegister()) {
-      VRegister dst = g.ToDoubleRegister(destination);
-      if (destination->IsSimd128Register()) {
-        __ Mov(dst.Q(), src.Q());
-      } else {
-        __ Mov(dst, src);
-      }
-    } else {
-      DCHECK(destination->IsFPStackSlot());
+    case MoveType::kStackToStack: {
+      MemOperand src = g.ToMemOperand(source, tasm());
       MemOperand dst = g.ToMemOperand(destination, tasm());
-      if (destination->IsSimd128StackSlot()) {
-        __ Str(src.Q(), dst);
+      if (source->IsSimd128StackSlot()) {
+        UseScratchRegisterScope scope(tasm());
+        VRegister temp = scope.AcquireQ();
+        __ Ldr(temp, src);
+        __ Str(temp, dst);
       } else {
-        __ Str(src, dst);
+        UseScratchRegisterScope scope(tasm());
+        Register temp = scope.AcquireX();
+        __ Ldr(temp, src);
+        __ Str(temp, dst);
       }
+      return;
     }
-  } else if (source->IsFPStackSlot()) {
-    DCHECK(destination->IsFPRegister() || destination->IsFPStackSlot());
-    MemOperand src = g.ToMemOperand(source, tasm());
-    if (destination->IsFPRegister()) {
-      VRegister dst = g.ToDoubleRegister(destination);
-      if (destination->IsSimd128Register()) {
-        __ Ldr(dst.Q(), src);
+    case MoveType::kConstantToRegister: {
+      Constant src = g.ToConstant(source);
+      if (destination->IsRegister()) {
+        MoveConstantToRegister(g.ToRegister(destination), src);
       } else {
-        __ Ldr(dst, src);
+        VRegister dst = g.ToDoubleRegister(destination);
+        if (destination->IsFloatRegister()) {
+          __ Fmov(dst.S(), src.ToFloat32());
+        } else {
+          DCHECK(destination->IsDoubleRegister());
+          __ Fmov(dst, src.ToFloat64().value());
+        }
       }
-    } else {
-      UseScratchRegisterScope scope(tasm());
-      VRegister temp = scope.AcquireD();
+      return;
+    }
+    case MoveType::kConstantToStack: {
+      Constant src = g.ToConstant(source);
       MemOperand dst = g.ToMemOperand(destination, tasm());
-      if (destination->IsSimd128StackSlot()) {
-        __ Ldr(temp.Q(), src);
-        __ Str(temp.Q(), dst);
-      } else {
-        __ Ldr(temp, src);
+      if (destination->IsStackSlot()) {
+        UseScratchRegisterScope scope(tasm());
+        Register temp = scope.AcquireX();
+        MoveConstantToRegister(temp, src);
         __ Str(temp, dst);
+      } else if (destination->IsFloatStackSlot()) {
+        if (bit_cast<int32_t>(src.ToFloat32()) == 0) {
+          __ Str(wzr, dst);
+        } else {
+          UseScratchRegisterScope scope(tasm());
+          VRegister temp = scope.AcquireS();
+          __ Fmov(temp, src.ToFloat32());
+          __ Str(temp, dst);
+        }
+      } else {
+        DCHECK(destination->IsDoubleStackSlot());
+        if (src.ToFloat64().AsUint64() == 0) {
+          __ Str(xzr, dst);
+        } else {
+          UseScratchRegisterScope scope(tasm());
+          VRegister temp = scope.AcquireD();
+          __ Fmov(temp, src.ToFloat64().value());
+          __ Str(temp, dst);
+        }
       }
+      return;
     }
-  } else {
-    UNREACHABLE();
   }
+  UNREACHABLE();
 }
 
 
 void CodeGenerator::AssembleSwap(InstructionOperand* source,
                                  InstructionOperand* destination) {
   Arm64OperandConverter g(this, nullptr);
-  // Dispatch on the source and destination operand kinds.  Not all
-  // combinations are possible.
-  if (source->IsRegister()) {
-    // Register-register.
-    UseScratchRegisterScope scope(tasm());
-    Register temp = scope.AcquireX();
-    Register src = g.ToRegister(source);
-    if (destination->IsRegister()) {
-      Register dst = g.ToRegister(destination);
-      __ Mov(temp, src);
-      __ Mov(src, dst);
-      __ Mov(dst, temp);
-    } else {
-      DCHECK(destination->IsStackSlot());
-      MemOperand dst = g.ToMemOperand(destination, tasm());
-      __ Mov(temp, src);
-      __ Ldr(src, dst);
-      __ Str(temp, dst);
-    }
-  } else if (source->IsStackSlot() || source->IsFPStackSlot()) {
-    UseScratchRegisterScope scope(tasm());
-    VRegister temp_0 = scope.AcquireD();
-    VRegister temp_1 = scope.AcquireD();
-    MemOperand src = g.ToMemOperand(source, tasm());
-    MemOperand dst = g.ToMemOperand(destination, tasm());
-    if (source->IsSimd128StackSlot()) {
-      __ Ldr(temp_0.Q(), src);
-      __ Ldr(temp_1.Q(), dst);
-      __ Str(temp_0.Q(), dst);
-      __ Str(temp_1.Q(), src);
-    } else {
-      __ Ldr(temp_0, src);
-      __ Ldr(temp_1, dst);
-      __ Str(temp_0, dst);
-      __ Str(temp_1, src);
-    }
-  } else if (source->IsFPRegister()) {
-    UseScratchRegisterScope scope(tasm());
-    VRegister temp = scope.AcquireD();
-    VRegister src = g.ToDoubleRegister(source);
-    if (destination->IsFPRegister()) {
-      VRegister dst = g.ToDoubleRegister(destination);
-      if (source->IsSimd128Register()) {
-        __ Mov(temp.Q(), src.Q());
-        __ Mov(src.Q(), dst.Q());
-        __ Mov(dst.Q(), temp.Q());
+  switch (MoveType::InferSwap(source, destination)) {
+    case MoveType::kRegisterToRegister:
+      if (source->IsRegister()) {
+        __ Swap(g.ToRegister(source), g.ToRegister(destination));
       } else {
-        __ Mov(temp, src);
-        __ Mov(src, dst);
-        __ Mov(dst, temp);
+        VRegister src = g.ToDoubleRegister(source);
+        VRegister dst = g.ToDoubleRegister(destination);
+        if (source->IsFloatRegister() || source->IsDoubleRegister()) {
+          __ Swap(src, dst);
+        } else {
+          DCHECK(source->IsSimd128Register());
+          __ Swap(src.Q(), dst.Q());
+        }
       }
-    } else {
-      DCHECK(destination->IsFPStackSlot());
+      return;
+    case MoveType::kRegisterToStack: {
+      UseScratchRegisterScope scope(tasm());
       MemOperand dst = g.ToMemOperand(destination, tasm());
-      if (source->IsSimd128Register()) {
-        __ Mov(temp.Q(), src.Q());
-        __ Ldr(src.Q(), dst);
-        __ Str(temp.Q(), dst);
-      } else {
+      if (source->IsRegister()) {
+        Register temp = scope.AcquireX();
+        Register src = g.ToRegister(source);
         __ Mov(temp, src);
         __ Ldr(src, dst);
         __ Str(temp, dst);
+      } else {
+        UseScratchRegisterScope scope(tasm());
+        VRegister src = g.ToDoubleRegister(source);
+        if (source->IsFloatRegister() || source->IsDoubleRegister()) {
+          VRegister temp = scope.AcquireD();
+          __ Mov(temp, src);
+          __ Ldr(src, dst);
+          __ Str(temp, dst);
+        } else {
+          DCHECK(source->IsSimd128Register());
+          VRegister temp = scope.AcquireQ();
+          __ Mov(temp, src.Q());
+          __ Ldr(src.Q(), dst);
+          __ Str(temp, dst);
+        }
       }
+      return;
     }
-  } else {
-    // No other combinations are possible.
-    UNREACHABLE();
+    case MoveType::kStackToStack: {
+      UseScratchRegisterScope scope(tasm());
+      MemOperand src = g.ToMemOperand(source, tasm());
+      MemOperand dst = g.ToMemOperand(destination, tasm());
+      VRegister temp_0 = scope.AcquireD();
+      VRegister temp_1 = scope.AcquireD();
+      if (source->IsSimd128StackSlot()) {
+        __ Ldr(temp_0.Q(), src);
+        __ Ldr(temp_1.Q(), dst);
+        __ Str(temp_0.Q(), dst);
+        __ Str(temp_1.Q(), src);
+      } else {
+        __ Ldr(temp_0, src);
+        __ Ldr(temp_1, dst);
+        __ Str(temp_0, dst);
+        __ Str(temp_1, src);
+      }
+      return;
+    }
+    default:
+      UNREACHABLE();
+      break;
   }
 }
 
@@ -2680,7 +2747,6 @@ void CodeGenerator::AssembleJumpTable(Label** targets, size_t target_count) {
   UNREACHABLE();
 }
 
-
 #undef __
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/arm64/instruction-codes-arm64.h b/deps/v8/src/compiler/arm64/instruction-codes-arm64.h
index 820b55a99d0..72218ce8fd7 100644
--- a/deps/v8/src/compiler/arm64/instruction-codes-arm64.h
+++ b/deps/v8/src/compiler/arm64/instruction-codes-arm64.h
@@ -67,6 +67,8 @@ namespace compiler {
   V(Arm64Mov32)                    \
   V(Arm64Sxtb32)                   \
   V(Arm64Sxth32)                   \
+  V(Arm64Sxtb)                     \
+  V(Arm64Sxth)                     \
   V(Arm64Sxtw)                     \
   V(Arm64Sbfx32)                   \
   V(Arm64Ubfx)                     \
@@ -155,6 +157,7 @@ namespace compiler {
   V(Arm64StrW)                     \
   V(Arm64Ldr)                      \
   V(Arm64Str)                      \
+  V(Arm64DsbIsb)                   \
   V(Arm64F32x4Splat)               \
   V(Arm64F32x4ExtractLane)         \
   V(Arm64F32x4ReplaceLane)         \
diff --git a/deps/v8/src/compiler/arm64/instruction-scheduler-arm64.cc b/deps/v8/src/compiler/arm64/instruction-scheduler-arm64.cc
index c2b0a4e386a..2e5f974feeb 100644
--- a/deps/v8/src/compiler/arm64/instruction-scheduler-arm64.cc
+++ b/deps/v8/src/compiler/arm64/instruction-scheduler-arm64.cc
@@ -67,7 +67,9 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64Ror:
     case kArm64Ror32:
     case kArm64Mov32:
+    case kArm64Sxtb:
     case kArm64Sxtb32:
+    case kArm64Sxth:
     case kArm64Sxth32:
     case kArm64Sxtw:
     case kArm64Sbfx32:
@@ -275,13 +277,11 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64S1x8AllTrue:
     case kArm64S1x16AnyTrue:
     case kArm64S1x16AllTrue:
-      return kNoOpcodeFlags;
-
     case kArm64TestAndBranch32:
     case kArm64TestAndBranch:
     case kArm64CompareAndBranch32:
     case kArm64CompareAndBranch:
-      return kIsBlockTerminator;
+      return kNoOpcodeFlags;
 
     case kArm64LdrS:
     case kArm64LdrD:
@@ -306,6 +306,7 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64Strh:
     case kArm64StrW:
     case kArm64Str:
+    case kArm64DsbIsb:
       return kHasSideEffect;
 
 #define CASE(Name) case k##Name:
diff --git a/deps/v8/src/compiler/arm64/instruction-selector-arm64.cc b/deps/v8/src/compiler/arm64/instruction-selector-arm64.cc
index d6082c9f0a1..a8f962c74c8 100644
--- a/deps/v8/src/compiler/arm64/instruction-selector-arm64.cc
+++ b/deps/v8/src/compiler/arm64/instruction-selector-arm64.cc
@@ -65,10 +65,10 @@ class Arm64OperandGenerator final : public OperandGenerator {
 
   int64_t GetIntegerConstantValue(Node* node) {
     if (node->opcode() == IrOpcode::kInt32Constant) {
-      return OpParameter<int32_t>(node);
+      return OpParameter<int32_t>(node->op());
     }
     DCHECK_EQ(IrOpcode::kInt64Constant, node->opcode());
-    return OpParameter<int64_t>(node);
+    return OpParameter<int64_t>(node->op());
   }
 
   bool IsFloatConstant(Node* node) {
@@ -78,10 +78,10 @@ class Arm64OperandGenerator final : public OperandGenerator {
 
   double GetFloatConstantValue(Node* node) {
     if (node->opcode() == IrOpcode::kFloat32Constant) {
-      return OpParameter<float>(node);
+      return OpParameter<float>(node->op());
     }
     DCHECK_EQ(IrOpcode::kFloat64Constant, node->opcode());
-    return OpParameter<double>(node);
+    return OpParameter<double>(node->op());
   }
 
   bool CanBeImmediate(Node* node, ImmediateMode mode) {
@@ -155,7 +155,7 @@ void VisitRRR(InstructionSelector* selector, ArchOpcode opcode, Node* node) {
 
 void VisitRRI(InstructionSelector* selector, ArchOpcode opcode, Node* node) {
   Arm64OperandGenerator g(selector);
-  int32_t imm = OpParameter<int32_t>(node);
+  int32_t imm = OpParameter<int32_t>(node->op());
   selector->Emit(opcode, g.DefineAsRegister(node),
                  g.UseRegister(node->InputAt(0)), g.UseImmediate(imm));
 }
@@ -170,7 +170,7 @@ void VisitRRO(InstructionSelector* selector, ArchOpcode opcode, Node* node,
 
 void VisitRRIR(InstructionSelector* selector, ArchOpcode opcode, Node* node) {
   Arm64OperandGenerator g(selector);
-  int32_t imm = OpParameter<int32_t>(node);
+  int32_t imm = OpParameter<int32_t>(node->op());
   selector->Emit(opcode, g.DefineAsRegister(node),
                  g.UseRegister(node->InputAt(0)), g.UseImmediate(imm),
                  g.UseRegister(node->InputAt(1)));
@@ -416,9 +416,9 @@ void VisitBinop(InstructionSelector* selector, Node* node,
                 InstructionCode opcode, ImmediateMode operand_mode,
                 FlagsContinuation* cont) {
   Arm64OperandGenerator g(selector);
-  InstructionOperand inputs[5];
+  InstructionOperand inputs[3];
   size_t input_count = 0;
-  InstructionOperand outputs[2];
+  InstructionOperand outputs[1];
   size_t output_count = 0;
 
   Node* left_node = node->InputAt(0);
@@ -467,35 +467,17 @@ void VisitBinop(InstructionSelector* selector, Node* node,
     inputs[input_count++] = g.UseRegister(right_node);
   }
 
-  if (cont->IsBranch()) {
-    inputs[input_count++] = g.Label(cont->true_block());
-    inputs[input_count++] = g.Label(cont->false_block());
-  }
-
   if (!IsComparisonField::decode(properties)) {
     outputs[output_count++] = g.DefineAsRegister(node);
   }
 
-  if (cont->IsSet()) {
-    outputs[output_count++] = g.DefineAsRegister(cont->result());
-  }
-
   DCHECK_NE(0u, input_count);
   DCHECK((output_count != 0) || IsComparisonField::decode(properties));
   DCHECK_GE(arraysize(inputs), input_count);
   DCHECK_GE(arraysize(outputs), output_count);
 
-  opcode = cont->Encode(opcode);
-  if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, output_count, outputs, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsTrap()) {
-    inputs[input_count++] = g.UseImmediate(cont->trap_id());
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  } else {
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, output_count, outputs, input_count,
+                                 inputs, cont);
 }
 
 
@@ -629,9 +611,16 @@ void InstructionSelector::VisitLoad(Node* node) {
       UNREACHABLE();
       return;
   }
+  if (node->opcode() == IrOpcode::kPoisonedLoad) {
+    CHECK_EQ(poisoning_enabled_, PoisoningMitigationLevel::kOn);
+    opcode |= MiscField::encode(kMemoryAccessPoisoned);
+  }
+
   EmitLoad(this, node, opcode, immediate_mode, rep);
 }
 
+void InstructionSelector::VisitPoisonedLoad(Node* node) { VisitLoad(node); }
+
 void InstructionSelector::VisitProtectedLoad(Node* node) {
   // TODO(eholk)
   UNIMPLEMENTED();
@@ -1238,6 +1227,7 @@ void InstructionSelector::VisitWord64Ror(Node* node) {
   }
 RR_OP_LIST(RR_VISITOR)
 #undef RR_VISITOR
+#undef RR_OP_LIST
 
 #define RRR_VISITOR(Name, opcode)                     \
   void InstructionSelector::Visit##Name(Node* node) { \
@@ -1245,6 +1235,7 @@ RR_OP_LIST(RR_VISITOR)
   }
 RRR_OP_LIST(RRR_VISITOR)
 #undef RRR_VISITOR
+#undef RRR_OP_LIST
 
 void InstructionSelector::VisitWord32Ctz(Node* node) { UNREACHABLE(); }
 
@@ -1258,7 +1249,10 @@ void InstructionSelector::VisitWord32Popcnt(Node* node) { UNREACHABLE(); }
 
 void InstructionSelector::VisitWord64Popcnt(Node* node) { UNREACHABLE(); }
 
-void InstructionSelector::VisitSpeculationFence(Node* node) { UNREACHABLE(); }
+void InstructionSelector::VisitSpeculationFence(Node* node) {
+  Arm64OperandGenerator g(this);
+  Emit(kArm64DsbIsb, g.NoOutput());
+}
 
 void InstructionSelector::VisitInt32Add(Node* node) {
   Arm64OperandGenerator g(this);
@@ -1374,23 +1368,9 @@ void EmitInt32MulWithOverflow(InstructionSelector* selector, Node* node,
   InstructionOperand right = g.UseRegister(m.right().node());
   selector->Emit(kArm64Smull, result, left, right);
 
-  InstructionCode opcode = cont->Encode(kArm64Cmp) |
-                           AddressingModeField::encode(kMode_Operand2_R_SXTW);
-  if (cont->IsBranch()) {
-    selector->Emit(opcode, g.NoOutput(), result, result,
-                   g.Label(cont->true_block()), g.Label(cont->false_block()));
-  } else if (cont->IsDeoptimize()) {
-    InstructionOperand in[] = {result, result};
-    selector->EmitDeoptimize(opcode, 0, nullptr, 2, in, cont->kind(),
-                             cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsSet()) {
-    selector->Emit(opcode, g.DefineAsRegister(cont->result()), result, result);
-  } else {
-    DCHECK(cont->IsTrap());
-    selector->Emit(opcode, g.NoOutput(), result, result,
-                   g.UseImmediate(cont->trap_id()));
-  }
+  InstructionCode opcode =
+      kArm64Cmp | AddressingModeField::encode(kMode_Operand2_R_SXTW);
+  selector->EmitWithContinuation(opcode, result, result, cont);
 }
 
 }  // namespace
@@ -1642,6 +1622,7 @@ void InstructionSelector::VisitChangeUint32ToUint64(Node* node) {
         default:
           break;
       }
+      break;
     }
     default:
       break;
@@ -1680,7 +1661,7 @@ void InstructionSelector::VisitFloat64Ieee754Unop(Node* node,
 }
 
 void InstructionSelector::EmitPrepareArguments(
-    ZoneVector<PushParameter>* arguments, const CallDescriptor* descriptor,
+    ZoneVector<PushParameter>* arguments, const CallDescriptor* call_descriptor,
     Node* node) {
   Arm64OperandGenerator g(this);
 
@@ -1692,7 +1673,7 @@ void InstructionSelector::EmitPrepareArguments(
   // Bump the stack pointer(s).
   if (claim_count > 0) {
     // TODO(titzer): claim and poke probably take small immediates.
-    // TODO(titzer): it would be better to bump the csp here only
+    // TODO(titzer): it would be better to bump the sp here only
     //               and emit paired stores with increment for non c frames.
     Emit(kArm64Claim, g.NoOutput(), g.TempImmediate(claim_count));
   }
@@ -1720,9 +1701,9 @@ void InstructionSelector::EmitPrepareArguments(
   }
 }
 
-void InstructionSelector::EmitPrepareResults(ZoneVector<PushParameter>* results,
-                                             const CallDescriptor* descriptor,
-                                             Node* node) {
+void InstructionSelector::EmitPrepareResults(
+    ZoneVector<PushParameter>* results, const CallDescriptor* call_descriptor,
+    Node* node) {
   Arm64OperandGenerator g(this);
 
   int reverse_slot = 0;
@@ -1731,7 +1712,7 @@ void InstructionSelector::EmitPrepareResults(ZoneVector<PushParameter>* results,
     reverse_slot += output.location.GetSizeInPointers();
     // Skip any alignment holes in nodes.
     if (output.node == nullptr) continue;
-    DCHECK(!descriptor->IsCFunctionCall());
+    DCHECK(!call_descriptor->IsCFunctionCall());
 
     if (output.location.GetType() == MachineType::Float32()) {
       MarkAsFloat32(output.node);
@@ -1754,22 +1735,7 @@ namespace {
 void VisitCompare(InstructionSelector* selector, InstructionCode opcode,
                   InstructionOperand left, InstructionOperand right,
                   FlagsContinuation* cont) {
-  Arm64OperandGenerator g(selector);
-  opcode = cont->Encode(opcode);
-  if (cont->IsBranch()) {
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.Label(cont->true_block()), g.Label(cont->false_block()));
-  } else if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, g.NoOutput(), left, right, cont->kind(),
-                             cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsSet()) {
-    selector->Emit(opcode, g.DefineAsRegister(cont->result()), left, right);
-  } else {
-    DCHECK(cont->IsTrap());
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.UseImmediate(cont->trap_id()));
-  }
+  selector->EmitWithContinuation(opcode, left, right, cont);
 }
 
 
@@ -1923,22 +1889,17 @@ FlagsCondition MapForCbz(FlagsCondition cond) {
 void EmitBranchOrDeoptimize(InstructionSelector* selector,
                             InstructionCode opcode, InstructionOperand value,
                             FlagsContinuation* cont) {
-  Arm64OperandGenerator g(selector);
-  if (cont->IsBranch()) {
-    selector->Emit(cont->Encode(opcode), g.NoOutput(), value,
-                   g.Label(cont->true_block()), g.Label(cont->false_block()));
-  } else {
-    DCHECK(cont->IsDeoptimize());
-    selector->EmitDeoptimize(cont->Encode(opcode), g.NoOutput(), value,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  }
+  DCHECK(cont->IsBranch() || cont->IsDeoptimize());
+  selector->EmitWithContinuation(opcode, value, cont);
 }
 
 // Try to emit TBZ, TBNZ, CBZ or CBNZ for certain comparisons of {node}
 // against {value}, depending on the condition.
 bool TryEmitCbzOrTbz(InstructionSelector* selector, Node* node, uint32_t value,
                      Node* user, FlagsCondition cond, FlagsContinuation* cont) {
+  // Branch poisoning requires flags to be set, so when it's enabled for
+  // a particular branch, we shouldn't be applying the cbz/tbz optimization.
+  DCHECK(!cont->IsPoisoned());
   // Only handle branches and deoptimisations.
   if (!cont->IsBranch() && !cont->IsDeoptimize()) return false;
 
@@ -1961,14 +1922,12 @@ bool TryEmitCbzOrTbz(InstructionSelector* selector, Node* node, uint32_t value,
         InstructionOperand temp = g.TempRegister();
         selector->Emit(kArm64U64MoveFloat64, temp,
                        g.UseRegister(node->InputAt(0)));
-        selector->Emit(cont->Encode(kArm64TestAndBranch), g.NoOutput(), temp,
-                       g.TempImmediate(63), g.Label(cont->true_block()),
-                       g.Label(cont->false_block()));
+        selector->EmitWithContinuation(kArm64TestAndBranch, temp,
+                                       g.TempImmediate(63), cont);
         return true;
       }
-      selector->Emit(cont->Encode(kArm64TestAndBranch32), g.NoOutput(),
-                     g.UseRegister(node), g.TempImmediate(31),
-                     g.Label(cont->true_block()), g.Label(cont->false_block()));
+      selector->EmitWithContinuation(kArm64TestAndBranch32, g.UseRegister(node),
+                                     g.TempImmediate(31), cont);
       return true;
     }
     case kEqual:
@@ -1983,15 +1942,14 @@ bool TryEmitCbzOrTbz(InstructionSelector* selector, Node* node, uint32_t value,
           // In the code generator, Equal refers to a bit being cleared. We want
           // the opposite here so negate the condition.
           cont->Negate();
-          selector->Emit(cont->Encode(kArm64TestAndBranch32), g.NoOutput(),
-                         g.UseRegister(m_and.left().node()),
-                         g.TempImmediate(base::bits::CountTrailingZeros(value)),
-                         g.Label(cont->true_block()),
-                         g.Label(cont->false_block()));
+          selector->EmitWithContinuation(
+              kArm64TestAndBranch32, g.UseRegister(m_and.left().node()),
+              g.TempImmediate(base::bits::CountTrailingZeros(value)), cont);
           return true;
         }
       }
-    }  // Fall through.
+      V8_FALLTHROUGH;
+    }
     case kUnsignedLessThanOrEqual:
     case kUnsignedGreaterThan: {
       if (value != 0) return false;
@@ -2010,16 +1968,18 @@ void VisitWord32Compare(InstructionSelector* selector, Node* node,
                         FlagsContinuation* cont) {
   Int32BinopMatcher m(node);
   FlagsCondition cond = cont->condition();
-  if (m.right().HasValue()) {
-    if (TryEmitCbzOrTbz(selector, m.left().node(), m.right().Value(), node,
-                        cond, cont)) {
-      return;
-    }
-  } else if (m.left().HasValue()) {
-    FlagsCondition commuted_cond = CommuteFlagsCondition(cond);
-    if (TryEmitCbzOrTbz(selector, m.right().node(), m.left().Value(), node,
-                        commuted_cond, cont)) {
-      return;
+  if (!cont->IsPoisoned()) {
+    if (m.right().HasValue()) {
+      if (TryEmitCbzOrTbz(selector, m.left().node(), m.right().Value(), node,
+                          cond, cont)) {
+        return;
+      }
+    } else if (m.left().HasValue()) {
+      FlagsCondition commuted_cond = CommuteFlagsCondition(cond);
+      if (TryEmitCbzOrTbz(selector, m.right().node(), m.left().Value(), node,
+                          commuted_cond, cont)) {
+        return;
+      }
     }
   }
   ArchOpcode opcode = kArm64Cmp32;
@@ -2092,14 +2052,14 @@ bool TryEmitTestAndBranch(InstructionSelector* selector, Node* node,
                           FlagsContinuation* cont) {
   Arm64OperandGenerator g(selector);
   Matcher m(node);
-  if (cont->IsBranch() && m.right().HasValue() &&
+  if (cont->IsBranch() && !cont->IsPoisoned() && m.right().HasValue() &&
       base::bits::IsPowerOfTwo(m.right().Value())) {
     // If the mask has only one bit set, we can use tbz/tbnz.
     DCHECK((cont->condition() == kEqual) || (cont->condition() == kNotEqual));
-    selector->Emit(
-        cont->Encode(kOpcode), g.NoOutput(), g.UseRegister(m.left().node()),
+    selector->EmitWithContinuation(
+        kOpcode, g.UseRegister(m.left().node()),
         g.TempImmediate(base::bits::CountTrailingZeros(m.right().Value())),
-        g.Label(cont->true_block()), g.Label(cont->false_block()));
+        cont);
     return true;
   }
   return false;
@@ -2142,12 +2102,13 @@ void VisitFloat64Compare(InstructionSelector* selector, Node* node,
   }
 }
 
-void VisitWordCompareZero(InstructionSelector* selector, Node* user,
-                          Node* value, FlagsContinuation* cont) {
-  Arm64OperandGenerator g(selector);
+}  // namespace
+
+void InstructionSelector::VisitWordCompareZero(Node* user, Node* value,
+                                               FlagsContinuation* cont) {
+  Arm64OperandGenerator g(this);
   // Try to combine with comparisons against 0 by simply inverting the branch.
-  while (value->opcode() == IrOpcode::kWord32Equal &&
-         selector->CanCover(user, value)) {
+  while (value->opcode() == IrOpcode::kWord32Equal && CanCover(user, value)) {
     Int32BinopMatcher m(value);
     if (!m.right().Is(0)) break;
 
@@ -2156,84 +2117,83 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
     cont->Negate();
   }
 
-  if (selector->CanCover(user, value)) {
+  if (CanCover(user, value)) {
     switch (value->opcode()) {
       case IrOpcode::kWord32Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kInt32LessThan:
         cont->OverwriteAndNegateIfEqual(kSignedLessThan);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kInt32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kSignedLessThanOrEqual);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kUint32LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kUint32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kWord64Equal: {
         cont->OverwriteAndNegateIfEqual(kEqual);
         Int64BinopMatcher m(value);
         if (m.right().Is(0)) {
           Node* const left = m.left().node();
-          if (selector->CanCover(value, left) &&
-              left->opcode() == IrOpcode::kWord64And) {
+          if (CanCover(value, left) && left->opcode() == IrOpcode::kWord64And) {
             // Attempt to merge the Word64Equal(Word64And(x, y), 0) comparison
             // into a tbz/tbnz instruction.
             if (TryEmitTestAndBranch<Uint64BinopMatcher, kArm64TestAndBranch>(
-                    selector, left, cont)) {
+                    this, left, cont)) {
               return;
             }
-            return VisitWordCompare(selector, left, kArm64Tst, cont, true,
+            return VisitWordCompare(this, left, kArm64Tst, cont, true,
                                     kLogical64Imm);
           }
           // Merge the Word64Equal(x, 0) comparison into a cbz instruction.
-          if (cont->IsBranch() || cont->IsDeoptimize()) {
-            EmitBranchOrDeoptimize(selector,
-                                   cont->Encode(kArm64CompareAndBranch),
+          if ((cont->IsBranch() || cont->IsDeoptimize()) &&
+              !cont->IsPoisoned()) {
+            EmitBranchOrDeoptimize(this, kArm64CompareAndBranch,
                                    g.UseRegister(left), cont);
             return;
           }
         }
-        return VisitWordCompare(selector, value, kArm64Cmp, cont, false,
+        return VisitWordCompare(this, value, kArm64Cmp, cont, false,
                                 kArithmeticImm);
       }
       case IrOpcode::kInt64LessThan:
         cont->OverwriteAndNegateIfEqual(kSignedLessThan);
-        return VisitWordCompare(selector, value, kArm64Cmp, cont, false,
+        return VisitWordCompare(this, value, kArm64Cmp, cont, false,
                                 kArithmeticImm);
       case IrOpcode::kInt64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kSignedLessThanOrEqual);
-        return VisitWordCompare(selector, value, kArm64Cmp, cont, false,
+        return VisitWordCompare(this, value, kArm64Cmp, cont, false,
                                 kArithmeticImm);
       case IrOpcode::kUint64LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitWordCompare(selector, value, kArm64Cmp, cont, false,
+        return VisitWordCompare(this, value, kArm64Cmp, cont, false,
                                 kArithmeticImm);
       case IrOpcode::kUint64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitWordCompare(selector, value, kArm64Cmp, cont, false,
+        return VisitWordCompare(this, value, kArm64Cmp, cont, false,
                                 kArithmeticImm);
       case IrOpcode::kFloat32Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThan:
         cont->OverwriteAndNegateIfEqual(kFloatLessThan);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kFloatLessThanOrEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat64Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThan:
         cont->OverwriteAndNegateIfEqual(kFloatLessThan);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kFloatLessThanOrEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kProjection:
         // Check if this is the overflow output projection of an
         // <Operation>WithOverflow node.
@@ -2245,30 +2205,30 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
           // *AFTER* this branch).
           Node* const node = value->InputAt(0);
           Node* const result = NodeProperties::FindProjection(node, 0);
-          if (result == nullptr || selector->IsDefined(result)) {
+          if (result == nullptr || IsDefined(result)) {
             switch (node->opcode()) {
               case IrOpcode::kInt32AddWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop<Int32BinopMatcher>(
-                    selector, node, kArm64Add32, kArithmeticImm, cont);
+                return VisitBinop<Int32BinopMatcher>(this, node, kArm64Add32,
+                                                     kArithmeticImm, cont);
               case IrOpcode::kInt32SubWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop<Int32BinopMatcher>(
-                    selector, node, kArm64Sub32, kArithmeticImm, cont);
+                return VisitBinop<Int32BinopMatcher>(this, node, kArm64Sub32,
+                                                     kArithmeticImm, cont);
               case IrOpcode::kInt32MulWithOverflow:
                 // ARM64 doesn't set the overflow flag for multiplication, so we
                 // need to test on kNotEqual. Here is the code sequence used:
                 //   smull result, left, right
                 //   cmp result.X(), Operand(result, SXTW)
                 cont->OverwriteAndNegateIfEqual(kNotEqual);
-                return EmitInt32MulWithOverflow(selector, node, cont);
+                return EmitInt32MulWithOverflow(this, node, cont);
               case IrOpcode::kInt64AddWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop<Int64BinopMatcher>(selector, node, kArm64Add,
+                return VisitBinop<Int64BinopMatcher>(this, node, kArm64Add,
                                                      kArithmeticImm, cont);
               case IrOpcode::kInt64SubWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop<Int64BinopMatcher>(selector, node, kArm64Sub,
+                return VisitBinop<Int64BinopMatcher>(this, node, kArm64Sub,
                                                      kArithmeticImm, cont);
               default:
                 break;
@@ -2277,23 +2237,23 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
         }
         break;
       case IrOpcode::kInt32Add:
-        return VisitWordCompare(selector, value, kArm64Cmn32, cont, true,
+        return VisitWordCompare(this, value, kArm64Cmn32, cont, true,
                                 kArithmeticImm);
       case IrOpcode::kInt32Sub:
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kWord32And:
         if (TryEmitTestAndBranch<Uint32BinopMatcher, kArm64TestAndBranch32>(
-                selector, value, cont)) {
+                this, value, cont)) {
           return;
         }
-        return VisitWordCompare(selector, value, kArm64Tst32, cont, true,
+        return VisitWordCompare(this, value, kArm64Tst32, cont, true,
                                 kLogical32Imm);
       case IrOpcode::kWord64And:
         if (TryEmitTestAndBranch<Uint64BinopMatcher, kArm64TestAndBranch>(
-                selector, value, cont)) {
+                this, value, cont)) {
           return;
         }
-        return VisitWordCompare(selector, value, kArm64Tst, cont, true,
+        return VisitWordCompare(this, value, kArm64Tst, cont, true,
                                 kLogical64Imm);
       default:
         break;
@@ -2301,81 +2261,41 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
   }
 
   // Branch could not be combined with a compare, compare against 0 and branch.
-  if (cont->IsBranch()) {
-    selector->Emit(cont->Encode(kArm64CompareAndBranch32), g.NoOutput(),
-                   g.UseRegister(value), g.Label(cont->true_block()),
-                   g.Label(cont->false_block()));
-  } else if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(cont->Encode(kArm64Tst32), g.NoOutput(),
-                             g.UseRegister(value), g.UseRegister(value),
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
+  if (!cont->IsPoisoned() && cont->IsBranch()) {
+    Emit(cont->Encode(kArm64CompareAndBranch32), g.NoOutput(),
+         g.UseRegister(value), g.Label(cont->true_block()),
+         g.Label(cont->false_block()));
   } else {
-    DCHECK(cont->IsTrap());
-    selector->Emit(cont->Encode(kArm64Tst32), g.NoOutput(),
-                   g.UseRegister(value), g.UseRegister(value),
-                   g.UseImmediate(cont->trap_id()));
+    EmitWithContinuation(cont->Encode(kArm64Tst32), g.UseRegister(value),
+                         g.UseRegister(value), cont);
   }
 }
 
-}  // namespace
-
-void InstructionSelector::VisitBranch(Node* branch, BasicBlock* tbranch,
-                                      BasicBlock* fbranch) {
-  FlagsContinuation cont(kNotEqual, tbranch, fbranch);
-  VisitWordCompareZero(this, branch, branch->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeIf(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kNotEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeUnless(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapIf(Node* node, Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kNotEqual, func_id, node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapUnless(Node* node,
-                                          Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kEqual, func_id, node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
 void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
   Arm64OperandGenerator g(this);
   InstructionOperand value_operand = g.UseRegister(node->InputAt(0));
 
   // Emit either ArchTableSwitch or ArchLookupSwitch.
-  static const size_t kMaxTableSwitchValueRange = 2 << 16;
-  size_t table_space_cost = 4 + sw.value_range;
-  size_t table_time_cost = 3;
-  size_t lookup_space_cost = 3 + 2 * sw.case_count;
-  size_t lookup_time_cost = sw.case_count;
-  if (sw.case_count > 0 &&
-      table_space_cost + 3 * table_time_cost <=
-          lookup_space_cost + 3 * lookup_time_cost &&
-      sw.min_value > std::numeric_limits<int32_t>::min() &&
-      sw.value_range <= kMaxTableSwitchValueRange) {
-    InstructionOperand index_operand = value_operand;
-    if (sw.min_value) {
-      index_operand = g.TempRegister();
-      Emit(kArm64Sub32, index_operand, value_operand,
-           g.TempImmediate(sw.min_value));
+  if (enable_switch_jump_table_ == kEnableSwitchJumpTable) {
+    static const size_t kMaxTableSwitchValueRange = 2 << 16;
+    size_t table_space_cost = 4 + sw.value_range();
+    size_t table_time_cost = 3;
+    size_t lookup_space_cost = 3 + 2 * sw.case_count();
+    size_t lookup_time_cost = sw.case_count();
+    if (sw.case_count() > 0 &&
+        table_space_cost + 3 * table_time_cost <=
+            lookup_space_cost + 3 * lookup_time_cost &&
+        sw.min_value() > std::numeric_limits<int32_t>::min() &&
+        sw.value_range() <= kMaxTableSwitchValueRange) {
+      InstructionOperand index_operand = value_operand;
+      if (sw.min_value()) {
+        index_operand = g.TempRegister();
+        Emit(kArm64Sub32, index_operand, value_operand,
+             g.TempImmediate(sw.min_value()));
+      }
+      // Generate a table lookup.
+      return EmitTableSwitch(sw, index_operand);
     }
-    // Generate a table lookup.
-    return EmitTableSwitch(sw, index_operand);
   }
 
   // Generate a sequence of conditional jumps.
@@ -2622,7 +2542,7 @@ void InstructionSelector::VisitFloat64InsertHighWord32(Node* node) {
        g.UseRegister(left), g.UseRegister(right));
 }
 
-void InstructionSelector::VisitAtomicLoad(Node* node) {
+void InstructionSelector::VisitWord32AtomicLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
   Arm64OperandGenerator g(this);
   Node* base = node->InputAt(0);
@@ -2630,13 +2550,15 @@ void InstructionSelector::VisitAtomicLoad(Node* node) {
   ArchOpcode opcode = kArchNop;
   switch (load_rep.representation()) {
     case MachineRepresentation::kWord8:
-      opcode = load_rep.IsSigned() ? kAtomicLoadInt8 : kAtomicLoadUint8;
+      opcode =
+          load_rep.IsSigned() ? kWord32AtomicLoadInt8 : kWord32AtomicLoadUint8;
       break;
     case MachineRepresentation::kWord16:
-      opcode = load_rep.IsSigned() ? kAtomicLoadInt16 : kAtomicLoadUint16;
+      opcode = load_rep.IsSigned() ? kWord32AtomicLoadInt16
+                                   : kWord32AtomicLoadUint16;
       break;
     case MachineRepresentation::kWord32:
-      opcode = kAtomicLoadWord32;
+      opcode = kWord32AtomicLoadWord32;
       break;
     default:
       UNREACHABLE();
@@ -2650,7 +2572,7 @@ void InstructionSelector::VisitAtomicLoad(Node* node) {
        arraysize(temps), temps);
 }
 
-void InstructionSelector::VisitAtomicStore(Node* node) {
+void InstructionSelector::VisitWord32AtomicStore(Node* node) {
   MachineRepresentation rep = AtomicStoreRepresentationOf(node->op());
   Arm64OperandGenerator g(this);
   Node* base = node->InputAt(0);
@@ -2659,13 +2581,13 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
   ArchOpcode opcode = kArchNop;
   switch (rep) {
     case MachineRepresentation::kWord8:
-      opcode = kAtomicStoreWord8;
+      opcode = kWord32AtomicStoreWord8;
       break;
     case MachineRepresentation::kWord16:
-      opcode = kAtomicStoreWord16;
+      opcode = kWord32AtomicStoreWord16;
       break;
     case MachineRepresentation::kWord32:
-      opcode = kAtomicStoreWord32;
+      opcode = kWord32AtomicStoreWord32;
       break;
     default:
       UNREACHABLE();
@@ -2683,7 +2605,7 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
   Emit(code, 0, nullptr, input_count, inputs, arraysize(temps), temps);
 }
 
-void InstructionSelector::VisitAtomicExchange(Node* node) {
+void InstructionSelector::VisitWord32AtomicExchange(Node* node) {
   Arm64OperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -2691,15 +2613,15 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   ArchOpcode opcode = kArchNop;
   MachineType type = AtomicOpRepresentationOf(node->op());
   if (type == MachineType::Int8()) {
-    opcode = kAtomicExchangeInt8;
+    opcode = kWord32AtomicExchangeInt8;
   } else if (type == MachineType::Uint8()) {
-    opcode = kAtomicExchangeUint8;
+    opcode = kWord32AtomicExchangeUint8;
   } else if (type == MachineType::Int16()) {
-    opcode = kAtomicExchangeInt16;
+    opcode = kWord32AtomicExchangeInt16;
   } else if (type == MachineType::Uint16()) {
-    opcode = kAtomicExchangeUint16;
+    opcode = kWord32AtomicExchangeUint16;
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
-    opcode = kAtomicExchangeWord32;
+    opcode = kWord32AtomicExchangeWord32;
   } else {
     UNREACHABLE();
     return;
@@ -2718,7 +2640,7 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   Emit(code, 1, outputs, input_count, inputs, arraysize(temps), temps);
 }
 
-void InstructionSelector::VisitAtomicCompareExchange(Node* node) {
+void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
   Arm64OperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -2727,15 +2649,15 @@ void InstructionSelector::VisitAtomicCompareExchange(Node* node) {
   ArchOpcode opcode = kArchNop;
   MachineType type = AtomicOpRepresentationOf(node->op());
   if (type == MachineType::Int8()) {
-    opcode = kAtomicCompareExchangeInt8;
+    opcode = kWord32AtomicCompareExchangeInt8;
   } else if (type == MachineType::Uint8()) {
-    opcode = kAtomicCompareExchangeUint8;
+    opcode = kWord32AtomicCompareExchangeUint8;
   } else if (type == MachineType::Int16()) {
-    opcode = kAtomicCompareExchangeInt16;
+    opcode = kWord32AtomicCompareExchangeInt16;
   } else if (type == MachineType::Uint16()) {
-    opcode = kAtomicCompareExchangeUint16;
+    opcode = kWord32AtomicCompareExchangeUint16;
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
-    opcode = kAtomicCompareExchangeWord32;
+    opcode = kWord32AtomicCompareExchangeWord32;
   } else {
     UNREACHABLE();
     return;
@@ -2793,11 +2715,12 @@ void InstructionSelector::VisitAtomicBinaryOperation(
   Emit(code, 1, outputs, input_count, inputs, arraysize(temps), temps);
 }
 
-#define VISIT_ATOMIC_BINOP(op)                                              \
-  void InstructionSelector::VisitAtomic##op(Node* node) {                   \
-    VisitAtomicBinaryOperation(node, kAtomic##op##Int8, kAtomic##op##Uint8, \
-                               kAtomic##op##Int16, kAtomic##op##Uint16,     \
-                               kAtomic##op##Word32);                        \
+#define VISIT_ATOMIC_BINOP(op)                                   \
+  void InstructionSelector::VisitWord32Atomic##op(Node* node) {  \
+    VisitAtomicBinaryOperation(                                  \
+        node, kWord32Atomic##op##Int8, kWord32Atomic##op##Uint8, \
+        kWord32Atomic##op##Int16, kWord32Atomic##op##Uint16,     \
+        kWord32Atomic##op##Word32);                              \
   }
 VISIT_ATOMIC_BINOP(Add)
 VISIT_ATOMIC_BINOP(Sub)
@@ -2820,11 +2743,6 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   V(I16x8)                \
   V(I8x16)
 
-#define SIMD_FORMAT_LIST(V) \
-  V(32x4, 4)                \
-  V(16x8, 8)                \
-  V(8x16, 16)
-
 #define SIMD_UNOP_LIST(V)                                 \
   V(F32x4SConvertI32x4, kArm64F32x4SConvertI32x4)         \
   V(F32x4UConvertI32x4, kArm64F32x4UConvertI32x4)         \
@@ -2957,6 +2875,7 @@ SIMD_TYPE_LIST(SIMD_VISIT_EXTRACT_LANE)
   }
 SIMD_TYPE_LIST(SIMD_VISIT_REPLACE_LANE)
 #undef SIMD_VISIT_REPLACE_LANE
+#undef SIMD_TYPE_LIST
 
 #define SIMD_VISIT_UNOP(Name, instruction)            \
   void InstructionSelector::Visit##Name(Node* node) { \
@@ -2964,6 +2883,7 @@ SIMD_TYPE_LIST(SIMD_VISIT_REPLACE_LANE)
   }
 SIMD_UNOP_LIST(SIMD_VISIT_UNOP)
 #undef SIMD_VISIT_UNOP
+#undef SIMD_UNOP_LIST
 
 #define SIMD_VISIT_SHIFT_OP(Name)                     \
   void InstructionSelector::Visit##Name(Node* node) { \
@@ -2971,6 +2891,7 @@ SIMD_UNOP_LIST(SIMD_VISIT_UNOP)
   }
 SIMD_SHIFT_OP_LIST(SIMD_VISIT_SHIFT_OP)
 #undef SIMD_VISIT_SHIFT_OP
+#undef SIMD_SHIFT_OP_LIST
 
 #define SIMD_VISIT_BINOP(Name, instruction)           \
   void InstructionSelector::Visit##Name(Node* node) { \
@@ -2978,6 +2899,7 @@ SIMD_SHIFT_OP_LIST(SIMD_VISIT_SHIFT_OP)
   }
 SIMD_BINOP_LIST(SIMD_VISIT_BINOP)
 #undef SIMD_VISIT_BINOP
+#undef SIMD_BINOP_LIST
 
 void InstructionSelector::VisitS128Select(Node* node) {
   Arm64OperandGenerator g(this);
@@ -3068,15 +2990,15 @@ void ArrangeShuffleTable(Arm64OperandGenerator* g, Node* input0, Node* input1,
     *src0 = *src1 = g->UseRegister(input0);
   } else {
     // Binary, table registers must be consecutive.
-    *src0 = g->UseFixed(input0, fp_fixed2);
-    *src1 = g->UseFixed(input1, fp_fixed3);
+    *src0 = g->UseFixed(input0, fp_fixed1);
+    *src1 = g->UseFixed(input1, fp_fixed2);
   }
 }
 
 }  // namespace
 
 void InstructionSelector::VisitS8x16Shuffle(Node* node) {
-  const uint8_t* shuffle = OpParameter<uint8_t*>(node);
+  const uint8_t* shuffle = OpParameter<uint8_t*>(node->op());
   uint8_t mask = CanonicalizeShuffle(node);
   uint8_t shuffle32x4[4];
   Arm64OperandGenerator g(this);
@@ -3132,6 +3054,26 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
        g.UseImmediate(Pack4Lanes(shuffle + 12, mask)));
 }
 
+void InstructionSelector::VisitSignExtendWord8ToInt32(Node* node) {
+  VisitRR(this, kArm64Sxtb32, node);
+}
+
+void InstructionSelector::VisitSignExtendWord16ToInt32(Node* node) {
+  VisitRR(this, kArm64Sxth32, node);
+}
+
+void InstructionSelector::VisitSignExtendWord8ToInt64(Node* node) {
+  VisitRR(this, kArm64Sxtb, node);
+}
+
+void InstructionSelector::VisitSignExtendWord16ToInt64(Node* node) {
+  VisitRR(this, kArm64Sxth, node);
+}
+
+void InstructionSelector::VisitSignExtendWord32ToInt64(Node* node) {
+  VisitRR(this, kArm64Sxtw, node);
+}
+
 // static
 MachineOperatorBuilder::Flags
 InstructionSelector::SupportedMachineOperatorFlags() {
@@ -3148,7 +3090,8 @@ InstructionSelector::SupportedMachineOperatorFlags() {
          MachineOperatorBuilder::kInt32DivIsSafe |
          MachineOperatorBuilder::kUint32DivIsSafe |
          MachineOperatorBuilder::kWord32ReverseBits |
-         MachineOperatorBuilder::kWord64ReverseBits;
+         MachineOperatorBuilder::kWord64ReverseBits |
+         MachineOperatorBuilder::kSpeculationFence;
 }
 
 // static
diff --git a/deps/v8/src/compiler/arm64/unwinding-info-writer-arm64.h b/deps/v8/src/compiler/arm64/unwinding-info-writer-arm64.h
index a532851d842..25c4fcf77f0 100644
--- a/deps/v8/src/compiler/arm64/unwinding-info-writer-arm64.h
+++ b/deps/v8/src/compiler/arm64/unwinding-info-writer-arm64.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_COMPILER_ARM64_UNWINDING_INFO_WRITER_H_
-#define V8_COMPILER_ARM64_UNWINDING_INFO_WRITER_H_
+#ifndef V8_COMPILER_ARM64_UNWINDING_INFO_WRITER_ARM64_H_
+#define V8_COMPILER_ARM64_UNWINDING_INFO_WRITER_ARM64_H_
 
 #include "src/eh-frame.h"
 
@@ -69,4 +69,4 @@ class UnwindingInfoWriter {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_COMPILER_ARM64_UNWINDING_INFO_WRITER_ARM64_H_
diff --git a/deps/v8/src/compiler/basic-block-instrumentor.cc b/deps/v8/src/compiler/basic-block-instrumentor.cc
index bb2229b2f86..b92967327c6 100644
--- a/deps/v8/src/compiler/basic-block-instrumentor.cc
+++ b/deps/v8/src/compiler/basic-block-instrumentor.cc
@@ -57,7 +57,7 @@ BasicBlockProfiler::Data* BasicBlockInstrumentor::Instrument(
   // Set the function name.
   if (info->has_shared_info()) {
     std::ostringstream os;
-    info->shared_info()->name()->PrintUC16(os);
+    info->shared_info()->Name()->PrintUC16(os);
     data->SetFunctionName(&os);
   }
   // Capture the schedule string before instrumentation.
diff --git a/deps/v8/src/compiler/basic-block-instrumentor.h b/deps/v8/src/compiler/basic-block-instrumentor.h
index 074f19b308b..3a5b7299668 100644
--- a/deps/v8/src/compiler/basic-block-instrumentor.h
+++ b/deps/v8/src/compiler/basic-block-instrumentor.h
@@ -29,4 +29,4 @@ class BasicBlockInstrumentor : public AllStatic {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_COMPILER_BASIC_BLOCK_INSTRUMENTOR_H_
diff --git a/deps/v8/src/compiler/branch-elimination.cc b/deps/v8/src/compiler/branch-elimination.cc
index 53c3435b554..3d71e98a120 100644
--- a/deps/v8/src/compiler/branch-elimination.cc
+++ b/deps/v8/src/compiler/branch-elimination.cc
@@ -16,7 +16,8 @@ BranchElimination::BranchElimination(Editor* editor, JSGraph* js_graph,
                                      Zone* zone)
     : AdvancedReducer(editor),
       jsgraph_(js_graph),
-      node_conditions_(zone, js_graph->graph()->NodeCount()),
+      node_conditions_(js_graph->graph()->NodeCount(), zone),
+      reduced_(js_graph->graph()->NodeCount(), zone),
       zone_(zone),
       dead_(js_graph->Dead()) {}
 
@@ -55,26 +56,32 @@ Reduction BranchElimination::Reduce(Node* node) {
 Reduction BranchElimination::ReduceBranch(Node* node) {
   Node* condition = node->InputAt(0);
   Node* control_input = NodeProperties::GetControlInput(node, 0);
-  const ControlPathConditions* from_input = node_conditions_.Get(control_input);
-  if (from_input != nullptr) {
-    Maybe<bool> condition_value = from_input->LookupCondition(condition);
-    // If we know the condition we can discard the branch.
-    if (condition_value.IsJust()) {
-      bool known_value = condition_value.FromJust();
-      for (Node* const use : node->uses()) {
-        switch (use->opcode()) {
-          case IrOpcode::kIfTrue:
-            Replace(use, known_value ? control_input : dead());
-            break;
-          case IrOpcode::kIfFalse:
-            Replace(use, known_value ? dead() : control_input);
-            break;
-          default:
-            UNREACHABLE();
-        }
+  ControlPathConditions from_input = node_conditions_.Get(control_input);
+  Node* branch;
+  bool condition_value;
+  // If we know the condition we can discard the branch.
+  if (from_input.LookupCondition(condition, &branch, &condition_value)) {
+    // Mark the branch as a safety check.
+    // Check if {branch} is dead because we might have a stale side-table entry.
+    if (IsSafetyCheckOf(node->op()) == IsSafetyCheck::kSafetyCheck &&
+        !branch->IsDead()) {
+      NodeProperties::ChangeOp(branch,
+                               common()->MarkAsSafetyCheck(branch->op()));
+    }
+
+    for (Node* const use : node->uses()) {
+      switch (use->opcode()) {
+        case IrOpcode::kIfTrue:
+          Replace(use, condition_value ? control_input : dead());
+          break;
+        case IrOpcode::kIfFalse:
+          Replace(use, condition_value ? dead() : control_input);
+          break;
+        default:
+          UNREACHABLE();
       }
-      return Replace(dead());
     }
+    return Replace(dead());
   }
   return TakeConditionsFromFirstControl(node);
 }
@@ -88,45 +95,53 @@ Reduction BranchElimination::ReduceDeoptimizeConditional(Node* node) {
   Node* frame_state = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  ControlPathConditions const* conditions = node_conditions_.Get(control);
   // If we do not know anything about the predecessor, do not propagate just
   // yet because we will have to recompute anyway once we compute the
   // predecessor.
-  if (conditions == nullptr) {
-    return UpdateConditions(node, conditions);
-  }
-  Maybe<bool> condition_value = conditions->LookupCondition(condition);
-  if (condition_value.IsJust()) {
+  if (!reduced_.Get(control)) {
+    return NoChange();
+  }
+
+  ControlPathConditions conditions = node_conditions_.Get(control);
+  bool condition_value;
+  Node* branch;
+  if (conditions.LookupCondition(condition, &branch, &condition_value)) {
+    // Mark the branch as a safety check.
+    if (p.is_safety_check() == IsSafetyCheck::kSafetyCheck) {
+      NodeProperties::ChangeOp(branch,
+                               common()->MarkAsSafetyCheck(branch->op()));
+    }
+
     // If we know the condition we can discard the branch.
-    if (condition_is_true == condition_value.FromJust()) {
+    if (condition_is_true == condition_value) {
       // We don't update the conditions here, because we're replacing {node}
       // with the {control} node that already contains the right information.
       ReplaceWithValue(node, dead(), effect, control);
     } else {
       control = graph()->NewNode(
-          common()->Deoptimize(p.kind(), p.reason(), VectorSlotPair()),
-          frame_state, effect, control);
+          common()->Deoptimize(p.kind(), p.reason(), p.feedback()), frame_state,
+          effect, control);
       // TODO(bmeurer): This should be on the AdvancedReducer somehow.
       NodeProperties::MergeControlToEnd(graph(), common(), control);
       Revisit(graph()->end());
     }
     return Replace(dead());
   }
-  return UpdateConditions(node, conditions, condition, condition_is_true);
+  return UpdateConditions(node, conditions, condition, node, condition_is_true);
 }
 
 Reduction BranchElimination::ReduceIf(Node* node, bool is_true_branch) {
   // Add the condition to the list arriving from the input branch.
   Node* branch = NodeProperties::GetControlInput(node, 0);
-  const ControlPathConditions* from_branch = node_conditions_.Get(branch);
+  ControlPathConditions from_branch = node_conditions_.Get(branch);
   // If we do not know anything about the predecessor, do not propagate just
   // yet because we will have to recompute anyway once we compute the
   // predecessor.
-  if (from_branch == nullptr) {
-    return UpdateConditions(node, nullptr);
+  if (!reduced_.Get(branch)) {
+    return NoChange();
   }
   Node* condition = branch->InputAt(0);
-  return UpdateConditions(node, from_branch, condition, is_true_branch);
+  return UpdateConditions(node, from_branch, condition, branch, is_true_branch);
 }
 
 
@@ -143,8 +158,8 @@ Reduction BranchElimination::ReduceMerge(Node* node) {
   // input.
   Node::Inputs inputs = node->inputs();
   for (Node* input : inputs) {
-    if (node_conditions_.Get(input) == nullptr) {
-      return UpdateConditions(node, nullptr);
+    if (!reduced_.Get(input)) {
+      return NoChange();
     }
   }
 
@@ -152,42 +167,23 @@ Reduction BranchElimination::ReduceMerge(Node* node) {
 
   DCHECK_GT(inputs.count(), 0);
 
-  const ControlPathConditions* first = node_conditions_.Get(*input_it);
+  ControlPathConditions conditions = node_conditions_.Get(*input_it);
   ++input_it;
-  // Make a copy of the first input's conditions and merge with the conditions
-  // from other inputs.
-  ControlPathConditions* conditions =
-      new (zone_->New(sizeof(ControlPathConditions)))
-          ControlPathConditions(*first);
+  // Merge the first input's conditions with the conditions from the other
+  // inputs.
   auto input_end = inputs.end();
   for (; input_it != input_end; ++input_it) {
-    conditions->Merge(*(node_conditions_.Get(*input_it)));
+    // Change the current condition list to a longest common tail
+    // of this condition list and the other list. (The common tail
+    // should correspond to the list from the common dominator.)
+    conditions.ResetToCommonAncestor(node_conditions_.Get(*input_it));
   }
-
   return UpdateConditions(node, conditions);
 }
 
 
 Reduction BranchElimination::ReduceStart(Node* node) {
-  return UpdateConditions(node, ControlPathConditions::Empty(zone_));
-}
-
-const BranchElimination::ControlPathConditions*
-BranchElimination::PathConditionsForControlNodes::Get(Node* node) const {
-  if (static_cast<size_t>(node->id()) < info_for_node_.size()) {
-    return info_for_node_[node->id()];
-  }
-  return nullptr;
-}
-
-
-void BranchElimination::PathConditionsForControlNodes::Set(
-    Node* node, const ControlPathConditions* conditions) {
-  size_t index = static_cast<size_t>(node->id());
-  if (index >= info_for_node_.size()) {
-    info_for_node_.resize(index + 1, nullptr);
-  }
-  info_for_node_[index] = conditions;
+  return UpdateConditions(node, {});
 }
 
 
@@ -200,157 +196,58 @@ Reduction BranchElimination::ReduceOtherControl(Node* node) {
 Reduction BranchElimination::TakeConditionsFromFirstControl(Node* node) {
   // We just propagate the information from the control input (ideally,
   // we would only revisit control uses if there is change).
-  const ControlPathConditions* from_input =
-      node_conditions_.Get(NodeProperties::GetControlInput(node, 0));
-  return UpdateConditions(node, from_input);
+  Node* input = NodeProperties::GetControlInput(node, 0);
+  if (!reduced_.Get(input)) return NoChange();
+  return UpdateConditions(node, node_conditions_.Get(input));
 }
 
-
 Reduction BranchElimination::UpdateConditions(
-    Node* node, const ControlPathConditions* conditions) {
-  const ControlPathConditions* original = node_conditions_.Get(node);
+    Node* node, ControlPathConditions conditions) {
   // Only signal that the node has Changed if the condition information has
   // changed.
-  if (conditions != original) {
-    if (conditions == nullptr || original == nullptr ||
-        *conditions != *original) {
-      node_conditions_.Set(node, conditions);
-      return Changed(node);
-    }
+  if (reduced_.Set(node, true) | node_conditions_.Set(node, conditions)) {
+    return Changed(node);
   }
   return NoChange();
 }
 
 Reduction BranchElimination::UpdateConditions(
-    Node* node, const ControlPathConditions* prev_conditions,
-    Node* current_condition, bool is_true_branch) {
-  const ControlPathConditions* original = node_conditions_.Get(node);
-  DCHECK(prev_conditions != nullptr && current_condition != nullptr);
+    Node* node, ControlPathConditions prev_conditions, Node* current_condition,
+    Node* current_branch, bool is_true_branch) {
+  ControlPathConditions original = node_conditions_.Get(node);
   // The control path for the node is the path obtained by appending the
-  // current_condition to the prev_conditions. Check if this new control path
-  // would be the same as the already recorded path (original).
-  if (original == nullptr || !prev_conditions->EqualsAfterAddingCondition(
-                                 original, current_condition, is_true_branch)) {
-    // If this is the first visit or if the control path is different from the
-    // recorded path create the new control path and record it.
-    const ControlPathConditions* new_condition =
-        prev_conditions->AddCondition(zone_, current_condition, is_true_branch);
-    node_conditions_.Set(node, new_condition);
-    return Changed(node);
-  }
-  return NoChange();
-}
-
-// static
-const BranchElimination::ControlPathConditions*
-BranchElimination::ControlPathConditions::Empty(Zone* zone) {
-  return new (zone->New(sizeof(ControlPathConditions)))
-      ControlPathConditions(nullptr, 0);
-}
-
-
-void BranchElimination::ControlPathConditions::Merge(
-    const ControlPathConditions& other) {
-  // Change the current condition list to a longest common tail
-  // of this condition list and the other list. (The common tail
-  // should correspond to the list from the common dominator.)
-
-  // First, we throw away the prefix of the longer list, so that
-  // we have lists of the same length.
-  size_t other_size = other.condition_count_;
-  BranchCondition* other_condition = other.head_;
-  while (other_size > condition_count_) {
-    other_condition = other_condition->next;
-    other_size--;
-  }
-  while (condition_count_ > other_size) {
-    head_ = head_->next;
-    condition_count_--;
-  }
-
-  // Then we go through both lists in lock-step until we find
-  // the common tail.
-  while (head_ != other_condition) {
-    DCHECK_LT(0, condition_count_);
-    condition_count_--;
-    other_condition = other_condition->next;
-    head_ = head_->next;
-  }
-}
-
-
-const BranchElimination::ControlPathConditions*
-BranchElimination::ControlPathConditions::AddCondition(Zone* zone,
-                                                       Node* condition,
-                                                       bool is_true) const {
-  DCHECK(LookupCondition(condition).IsNothing());
-
-  BranchCondition* new_head = new (zone->New(sizeof(BranchCondition)))
-      BranchCondition(condition, is_true, head_);
-
-  ControlPathConditions* conditions =
-      new (zone->New(sizeof(ControlPathConditions)))
-          ControlPathConditions(new_head, condition_count_ + 1);
-  return conditions;
-}
-
-
-Maybe<bool> BranchElimination::ControlPathConditions::LookupCondition(
-    Node* condition) const {
-  for (BranchCondition* current = head_; current != nullptr;
-       current = current->next) {
-    if (current->condition == condition) {
-      return Just<bool>(current->is_true);
+  // current_condition to the prev_conditions. Use the original control path as
+  // a hint to avoid allocations.
+  prev_conditions.AddCondition(zone_, current_condition, current_branch,
+                               is_true_branch, original);
+  return UpdateConditions(node, prev_conditions);
+}
+
+void BranchElimination::ControlPathConditions::AddCondition(
+    Zone* zone, Node* condition, Node* branch, bool is_true,
+    ControlPathConditions hint) {
+  DCHECK_EQ(false, LookupCondition(condition, nullptr, nullptr));
+  PushFront({condition, branch, is_true}, zone, hint);
+}
+
+bool BranchElimination::ControlPathConditions::LookupCondition(
+    Node* condition, Node** branch, bool* is_true) const {
+  for (BranchCondition element : *this) {
+    if (element.condition == condition) {
+      *is_true = element.is_true;
+      *branch = element.branch;
+      return true;
     }
   }
-  return Nothing<bool>();
-}
-
-bool BranchElimination::ControlPathConditions::IsSamePath(
-    BranchCondition* this_condition, BranchCondition* other_condition) const {
-  while (true) {
-    if (this_condition == other_condition) return true;
-    if (this_condition->condition != other_condition->condition ||
-        this_condition->is_true != other_condition->is_true) {
-      return false;
-    }
-    this_condition = this_condition->next;
-    other_condition = other_condition->next;
+  return false;
   }
-  UNREACHABLE();
-}
 
-bool BranchElimination::ControlPathConditions::operator==(
-    const ControlPathConditions& other) const {
-  if (condition_count_ != other.condition_count_) return false;
-  return IsSamePath(head_, other.head_);
-}
+  Graph* BranchElimination::graph() const { return jsgraph()->graph(); }
 
-bool BranchElimination::ControlPathConditions::EqualsAfterAddingCondition(
-    const ControlPathConditions* other, const Node* new_condition,
-    bool new_branch_direction) const {
-  // When an extra condition is added to the current chain, the count of
-  // the resulting chain would increase by 1. Quick check to see if counts
-  // match.
-  if (other->condition_count_ != condition_count_ + 1) return false;
-
-  // Check if the head of the other chain is same as the new condition that
-  // would be added.
-  if (other->head_->condition != new_condition ||
-      other->head_->is_true != new_branch_direction) {
-    return false;
+  CommonOperatorBuilder* BranchElimination::common() const {
+    return jsgraph()->common();
   }
 
-  // Check if the rest of the path is the same as the prev_condition.
-  return IsSamePath(other->head_->next, head_);
-}
-
-Graph* BranchElimination::graph() const { return jsgraph()->graph(); }
-
-CommonOperatorBuilder* BranchElimination::common() const {
-  return jsgraph()->common();
-}
-
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/branch-elimination.h b/deps/v8/src/compiler/branch-elimination.h
index d78933e7340..de3b9e5b2ea 100644
--- a/deps/v8/src/compiler/branch-elimination.h
+++ b/deps/v8/src/compiler/branch-elimination.h
@@ -2,11 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_COMPILER_BRANCH_CONDITION_ELIMINATION_H_
-#define V8_COMPILER_BRANCH_CONDITION_ELIMINATION_H_
+#ifndef V8_COMPILER_BRANCH_ELIMINATION_H_
+#define V8_COMPILER_BRANCH_ELIMINATION_H_
 
 #include "src/base/compiler-specific.h"
+#include "src/compiler/functional-list.h"
 #include "src/compiler/graph-reducer.h"
+#include "src/compiler/node-aux-data.h"
 #include "src/globals.h"
 
 namespace v8 {
@@ -30,56 +32,27 @@ class V8_EXPORT_PRIVATE BranchElimination final
  private:
   struct BranchCondition {
     Node* condition;
+    Node* branch;
     bool is_true;
-    BranchCondition* next;
 
-    BranchCondition(Node* condition, bool is_true, BranchCondition* next)
-        : condition(condition), is_true(is_true), next(next) {}
+    bool operator==(BranchCondition other) const {
+      return condition == other.condition && branch == other.branch &&
+             is_true == other.is_true;
+    }
+    bool operator!=(BranchCondition other) const { return !(*this == other); }
   };
 
   // Class for tracking information about branch conditions.
   // At the moment it is a linked list of conditions and their values
   // (true or false).
-  class ControlPathConditions {
+  class ControlPathConditions : public FunctionalList<BranchCondition> {
    public:
-    Maybe<bool> LookupCondition(Node* condition) const;
-
-    const ControlPathConditions* AddCondition(Zone* zone, Node* condition,
-                                              bool is_true) const;
-    static const ControlPathConditions* Empty(Zone* zone);
-    void Merge(const ControlPathConditions& other);
-
-    bool IsSamePath(BranchCondition* first, BranchCondition* second) const;
-    bool EqualsAfterAddingCondition(const ControlPathConditions* other,
-                                    const Node* new_condition,
-                                    bool new_branch_condition) const;
-    bool operator==(const ControlPathConditions& other) const;
-    bool operator!=(const ControlPathConditions& other) const {
-      return !(*this == other);
-    }
+    bool LookupCondition(Node* condition, Node** branch, bool* is_true) const;
+    void AddCondition(Zone* zone, Node* condition, Node* branch, bool is_true,
+                      ControlPathConditions hint);
 
    private:
-    ControlPathConditions(BranchCondition* head, size_t condition_count)
-        : head_(head), condition_count_(condition_count) {}
-
-    BranchCondition* head_;
-    // We keep track of the list length so that we can find the longest
-    // common tail easily.
-    size_t condition_count_;
-  };
-
-  // Maps each control node to the condition information known about the node.
-  // If the information is nullptr, then we have not calculated the information
-  // yet.
-  class PathConditionsForControlNodes {
-   public:
-    PathConditionsForControlNodes(Zone* zone, size_t size_hint)
-        : info_for_node_(size_hint, nullptr, zone) {}
-    const ControlPathConditions* Get(Node* node) const;
-    void Set(Node* node, const ControlPathConditions* conditions);
-
-   private:
-    ZoneVector<const ControlPathConditions*> info_for_node_;
+    using FunctionalList<BranchCondition>::PushFront;
   };
 
   Reduction ReduceBranch(Node* node);
@@ -91,11 +64,10 @@ class V8_EXPORT_PRIVATE BranchElimination final
   Reduction ReduceOtherControl(Node* node);
 
   Reduction TakeConditionsFromFirstControl(Node* node);
-  Reduction UpdateConditions(Node* node,
-                             const ControlPathConditions* conditions);
-  Reduction UpdateConditions(Node* node,
-                             const ControlPathConditions* prev_conditions,
-                             Node* current_condition, bool is_true_branch);
+  Reduction UpdateConditions(Node* node, ControlPathConditions conditions);
+  Reduction UpdateConditions(Node* node, ControlPathConditions prev_conditions,
+                             Node* current_condition, Node* current_branch,
+                             bool is_true_branch);
 
   Node* dead() const { return dead_; }
   Graph* graph() const;
@@ -103,7 +75,12 @@ class V8_EXPORT_PRIVATE BranchElimination final
   CommonOperatorBuilder* common() const;
 
   JSGraph* const jsgraph_;
-  PathConditionsForControlNodes node_conditions_;
+
+  // Maps each control node to the condition information known about the node.
+  // If the information is nullptr, then we have not calculated the information
+  // yet.
+  NodeAuxData<ControlPathConditions> node_conditions_;
+  NodeAuxData<bool> reduced_;
   Zone* zone_;
   Node* dead_;
 };
@@ -112,4 +89,4 @@ class V8_EXPORT_PRIVATE BranchElimination final
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_COMPILER_BRANCH_CONDITION_ELIMINATION_H_
+#endif  // V8_COMPILER_BRANCH_ELIMINATION_H_
diff --git a/deps/v8/src/compiler/bytecode-analysis.cc b/deps/v8/src/compiler/bytecode-analysis.cc
index 4ee30bcdf2b..980869ccd35 100644
--- a/deps/v8/src/compiler/bytecode-analysis.cc
+++ b/deps/v8/src/compiler/bytecode-analysis.cc
@@ -61,6 +61,22 @@ bool BytecodeLoopAssignments::ContainsLocal(int index) const {
   return bit_vector_->Contains(parameter_count_ + index);
 }
 
+ResumeJumpTarget::ResumeJumpTarget(int suspend_id, int target_offset,
+                                   int final_target_offset)
+    : suspend_id_(suspend_id),
+      target_offset_(target_offset),
+      final_target_offset_(final_target_offset) {}
+
+ResumeJumpTarget ResumeJumpTarget::Leaf(int suspend_id, int target_offset) {
+  return ResumeJumpTarget(suspend_id, target_offset, target_offset);
+}
+
+ResumeJumpTarget ResumeJumpTarget::AtLoopHeader(int loop_header_offset,
+                                                const ResumeJumpTarget& next) {
+  return ResumeJumpTarget(next.suspend_id(), loop_header_offset,
+                          next.target_offset());
+}
+
 BytecodeAnalysis::BytecodeAnalysis(Handle<BytecodeArray> bytecode_array,
                                    Zone* zone, bool do_liveness_analysis)
     : bytecode_array_(bytecode_array),
@@ -68,6 +84,7 @@ BytecodeAnalysis::BytecodeAnalysis(Handle<BytecodeArray> bytecode_array,
       zone_(zone),
       loop_stack_(zone),
       loop_end_index_queue_(zone),
+      resume_jump_targets_(zone),
       end_to_header_(zone),
       header_to_info_(zone),
       osr_entry_point_(-1),
@@ -80,6 +97,21 @@ void UpdateInLiveness(Bytecode bytecode, BytecodeLivenessState& in_liveness,
   int num_operands = Bytecodes::NumberOfOperands(bytecode);
   const OperandType* operand_types = Bytecodes::GetOperandTypes(bytecode);
 
+  // Special case Suspend and Resume to just pass through liveness.
+  if (bytecode == Bytecode::kSuspendGenerator) {
+    // The generator object has to be live.
+    in_liveness.MarkRegisterLive(accessor.GetRegisterOperand(0).index());
+    // Suspend additionally reads and returns the accumulator
+    DCHECK(Bytecodes::ReadsAccumulator(bytecode));
+    in_liveness.MarkAccumulatorLive();
+    return;
+  }
+  if (bytecode == Bytecode::kResumeGenerator) {
+    // The generator object has to be live.
+    in_liveness.MarkRegisterLive(accessor.GetRegisterOperand(0).index());
+    return;
+  }
+
   if (Bytecodes::WritesAccumulator(bytecode)) {
     in_liveness.MarkAccumulatorDead();
   }
@@ -175,6 +207,13 @@ void UpdateOutLiveness(Bytecode bytecode, BytecodeLivenessState& out_liveness,
   int current_offset = accessor.current_offset();
   const Handle<BytecodeArray>& bytecode_array = accessor.bytecode_array();
 
+  // Special case Suspend and Resume to just pass through liveness.
+  if (bytecode == Bytecode::kSuspendGenerator ||
+      bytecode == Bytecode::kResumeGenerator) {
+    out_liveness.Union(*next_bytecode_in_liveness);
+    return;
+  }
+
   // Update from jump target (if any). Skip loops, we update these manually in
   // the liveness iterations.
   if (Bytecodes::IsForwardJump(bytecode)) {
@@ -197,9 +236,9 @@ void UpdateOutLiveness(Bytecode bytecode, BytecodeLivenessState& out_liveness,
   if (!interpreter::Bytecodes::IsWithoutExternalSideEffects(bytecode)) {
     int handler_context;
     // TODO(leszeks): We should look up this range only once per entry.
-    HandlerTable* table = HandlerTable::cast(bytecode_array->handler_table());
+    HandlerTable table(*bytecode_array);
     int handler_offset =
-        table->LookupRange(current_offset, &handler_context, nullptr);
+        table.LookupRange(current_offset, &handler_context, nullptr);
 
     if (handler_offset != -1) {
       bool was_accumulator_live = out_liveness.AccumulatorIsLive();
@@ -221,6 +260,18 @@ void UpdateOutLiveness(Bytecode bytecode, BytecodeLivenessState& out_liveness,
   }
 }
 
+void UpdateLiveness(Bytecode bytecode, BytecodeLiveness& liveness,
+                    BytecodeLivenessState** next_bytecode_in_liveness,
+                    const interpreter::BytecodeArrayAccessor& accessor,
+                    const BytecodeLivenessMap& liveness_map) {
+  UpdateOutLiveness(bytecode, *liveness.out, *next_bytecode_in_liveness,
+                    accessor, liveness_map);
+  liveness.in->CopyFrom(*liveness.out);
+  UpdateInLiveness(bytecode, *liveness.in, accessor);
+
+  *next_bytecode_in_liveness = liveness.in;
+}
+
 void UpdateAssignments(Bytecode bytecode, BytecodeLoopAssignments& assignments,
                        const interpreter::BytecodeArrayAccessor& accessor) {
   int num_operands = Bytecodes::NumberOfOperands(bytecode);
@@ -260,14 +311,21 @@ void BytecodeAnalysis::Analyze(BailoutId osr_bailout_id) {
 
   BytecodeLivenessState* next_bytecode_in_liveness = nullptr;
 
-  int osr_loop_end_offset =
-      osr_bailout_id.IsNone() ? -1 : osr_bailout_id.ToInt();
+  bool is_osr = !osr_bailout_id.IsNone();
+  int osr_loop_end_offset = is_osr ? osr_bailout_id.ToInt() : -1;
+
+  int generator_switch_index = -1;
 
   interpreter::BytecodeArrayRandomIterator iterator(bytecode_array(), zone());
   for (iterator.GoToEnd(); iterator.IsValid(); --iterator) {
     Bytecode bytecode = iterator.current_bytecode();
     int current_offset = iterator.current_offset();
 
+    if (bytecode == Bytecode::kSwitchOnGeneratorState) {
+      DCHECK_EQ(generator_switch_index, -1);
+      generator_switch_index = iterator.current_index();
+    }
+
     if (bytecode == Bytecode::kJumpLoop) {
       // Every byte up to and including the last byte within the backwards jump
       // instruction is considered part of the loop, set loop end accordingly.
@@ -298,32 +356,84 @@ void BytecodeAnalysis::Analyze(BailoutId osr_bailout_id) {
       // information we currently have.
       UpdateAssignments(bytecode, current_loop_info->assignments(), iterator);
 
+      // Update suspend counts for this loop, though only if not OSR.
+      if (!is_osr && bytecode == Bytecode::kSuspendGenerator) {
+        int suspend_id = iterator.GetUnsignedImmediateOperand(3);
+        int resume_offset = current_offset + iterator.current_bytecode_size();
+        current_loop_info->AddResumeTarget(
+            ResumeJumpTarget::Leaf(suspend_id, resume_offset));
+      }
+
+      // If we've reached the header of the loop, pop it off the stack.
       if (current_offset == current_loop.header_offset) {
         loop_stack_.pop();
         if (loop_stack_.size() > 1) {
-          // Propagate inner loop assignments to outer loop.
-          loop_stack_.top().loop_info->assignments().Union(
+          // If there is still an outer loop, propagate inner loop assignments.
+          LoopInfo* parent_loop_info = loop_stack_.top().loop_info;
+
+          parent_loop_info->assignments().Union(
               current_loop_info->assignments());
+
+          // Also, propagate resume targets. Instead of jumping to the target
+          // itself, the outer loop will jump to this loop header for any
+          // targets that are inside the current loop, so that this loop stays
+          // reducible. Hence, a nested loop of the form:
+          //
+          //                switch (#1 -> suspend1, #2 -> suspend2)
+          //                loop {
+          //     suspend1:    suspend #1
+          //                  loop {
+          //     suspend2:      suspend #2
+          //                  }
+          //                }
+          //
+          // becomes:
+          //
+          //                switch (#1 -> loop1, #2 -> loop1)
+          //     loop1:     loop {
+          //                  switch (#1 -> suspend1, #2 -> loop2)
+          //     suspend1:    suspend #1
+          //     loop2:       loop {
+          //                    switch (#2 -> suspend2)
+          //     suspend2:      suspend #2
+          //                  }
+          //                }
+          for (const auto& target : current_loop_info->resume_jump_targets()) {
+            parent_loop_info->AddResumeTarget(
+                ResumeJumpTarget::AtLoopHeader(current_offset, target));
+          }
+
+        } else {
+          // Otherwise, just propagate inner loop suspends to top-level.
+          for (const auto& target : current_loop_info->resume_jump_targets()) {
+            resume_jump_targets_.push_back(
+                ResumeJumpTarget::AtLoopHeader(current_offset, target));
+          }
         }
       }
+    } else if (!is_osr && bytecode == Bytecode::kSuspendGenerator) {
+      // If we're not in a loop, we still need to look for suspends.
+      // TODO(leszeks): It would be nice to de-duplicate this with the in-loop
+      // case
+      int suspend_id = iterator.GetUnsignedImmediateOperand(3);
+      int resume_offset = current_offset + iterator.current_bytecode_size();
+      resume_jump_targets_.push_back(
+          ResumeJumpTarget::Leaf(suspend_id, resume_offset));
     }
 
     if (do_liveness_analysis_) {
       BytecodeLiveness& liveness = liveness_map_.InitializeLiveness(
           current_offset, bytecode_array()->register_count(), zone());
-
-      UpdateOutLiveness(bytecode, *liveness.out, next_bytecode_in_liveness,
-                        iterator, liveness_map_);
-      liveness.in->CopyFrom(*liveness.out);
-      UpdateInLiveness(bytecode, *liveness.in, iterator);
-
-      next_bytecode_in_liveness = liveness.in;
+      UpdateLiveness(bytecode, liveness, &next_bytecode_in_liveness, iterator,
+                     liveness_map_);
     }
   }
 
   DCHECK_EQ(loop_stack_.size(), 1u);
   DCHECK_EQ(loop_stack_.top().header_offset, -1);
 
+  DCHECK(ResumeJumpTargetsAreValid());
+
   if (!do_liveness_analysis_) return;
 
   // At this point, every bytecode has a valid in and out liveness, except for
@@ -374,16 +484,11 @@ void BytecodeAnalysis::Analyze(BailoutId osr_bailout_id) {
     --iterator;
     for (; iterator.current_offset() > header_offset; --iterator) {
       Bytecode bytecode = iterator.current_bytecode();
-
       int current_offset = iterator.current_offset();
       BytecodeLiveness& liveness = liveness_map_.GetLiveness(current_offset);
 
-      UpdateOutLiveness(bytecode, *liveness.out, next_bytecode_in_liveness,
-                        iterator, liveness_map_);
-      liveness.in->CopyFrom(*liveness.out);
-      UpdateInLiveness(bytecode, *liveness.in, iterator);
-
-      next_bytecode_in_liveness = liveness.in;
+      UpdateLiveness(bytecode, liveness, &next_bytecode_in_liveness, iterator,
+                     liveness_map_);
     }
     // Now we are at the loop header. Since the in-liveness of the header
     // can't change, we need only to update the out-liveness.
@@ -391,6 +496,47 @@ void BytecodeAnalysis::Analyze(BailoutId osr_bailout_id) {
                       next_bytecode_in_liveness, iterator, liveness_map_);
   }
 
+  // Process the generator switch statement separately, once the loops are done.
+  // This has to be a separate pass because the generator switch can jump into
+  // the middle of loops (and is the only kind of jump that can jump across a
+  // loop header).
+  if (generator_switch_index != -1) {
+    iterator.GoToIndex(generator_switch_index);
+    DCHECK_EQ(iterator.current_bytecode(), Bytecode::kSwitchOnGeneratorState);
+
+    int current_offset = iterator.current_offset();
+    BytecodeLiveness& switch_liveness =
+        liveness_map_.GetLiveness(current_offset);
+
+    bool any_changed = false;
+    for (const auto& entry : iterator.GetJumpTableTargetOffsets()) {
+      if (switch_liveness.out->UnionIsChanged(
+              *liveness_map_.GetInLiveness(entry.target_offset))) {
+        any_changed = true;
+      }
+    }
+
+    // If the switch liveness changed, we have to propagate it up the remaining
+    // bytecodes before it.
+    if (any_changed) {
+      switch_liveness.in->CopyFrom(*switch_liveness.out);
+      UpdateInLiveness(Bytecode::kSwitchOnGeneratorState, *switch_liveness.in,
+                       iterator);
+      next_bytecode_in_liveness = switch_liveness.in;
+      for (--iterator; iterator.IsValid(); --iterator) {
+        Bytecode bytecode = iterator.current_bytecode();
+        int current_offset = iterator.current_offset();
+        BytecodeLiveness& liveness = liveness_map_.GetLiveness(current_offset);
+
+        // There shouldn't be any more loops.
+        DCHECK_NE(bytecode, Bytecode::kJumpLoop);
+
+        UpdateLiveness(bytecode, liveness, &next_bytecode_in_liveness, iterator,
+                       liveness_map_);
+      }
+    }
+  }
+
   DCHECK(LivenessIsValid());
 }
 
@@ -497,6 +643,154 @@ std::ostream& BytecodeAnalysis::PrintLivenessTo(std::ostream& os) const {
 }
 
 #if DEBUG
+bool BytecodeAnalysis::ResumeJumpTargetsAreValid() {
+  bool valid = true;
+
+  // Find the generator switch.
+  interpreter::BytecodeArrayRandomIterator iterator(bytecode_array(), zone());
+  for (iterator.GoToStart(); iterator.IsValid(); ++iterator) {
+    if (iterator.current_bytecode() == Bytecode::kSwitchOnGeneratorState) {
+      break;
+    }
+  }
+
+  // If the iterator is invalid, we've reached the end without finding the
+  // generator switch. Similarly, if we are OSR-ing, we're not resuming, so we
+  // need no jump targets. So, ensure there are no jump targets and exit.
+  if (!iterator.IsValid() || HasOsrEntryPoint()) {
+    // Check top-level.
+    if (!resume_jump_targets().empty()) {
+      PrintF(stderr,
+             "Found %zu top-level resume targets but no resume switch\n",
+             resume_jump_targets().size());
+      valid = false;
+    }
+    // Check loops.
+    for (const std::pair<int, LoopInfo>& loop_info : header_to_info_) {
+      if (!loop_info.second.resume_jump_targets().empty()) {
+        PrintF(stderr,
+               "Found %zu resume targets at loop at offset %d, but no resume "
+               "switch\n",
+               loop_info.second.resume_jump_targets().size(), loop_info.first);
+        valid = false;
+      }
+    }
+
+    return valid;
+  }
+
+  // Otherwise, we've found the resume switch. Check that the top level jumps
+  // only to leaves and loop headers, then check that each loop header handles
+  // all the unresolved jumps, also jumping only to leaves and inner loop
+  // headers.
+
+  // First collect all required suspend ids.
+  std::map<int, int> unresolved_suspend_ids;
+  for (const interpreter::JumpTableTargetOffset& offset :
+       iterator.GetJumpTableTargetOffsets()) {
+    int suspend_id = offset.case_value;
+    int resume_offset = offset.target_offset;
+
+    unresolved_suspend_ids[suspend_id] = resume_offset;
+  }
+
+  // Check top-level.
+  if (!ResumeJumpTargetLeavesResolveSuspendIds(-1, resume_jump_targets(),
+                                               &unresolved_suspend_ids)) {
+    valid = false;
+  }
+  // Check loops.
+  for (const std::pair<int, LoopInfo>& loop_info : header_to_info_) {
+    if (!ResumeJumpTargetLeavesResolveSuspendIds(
+            loop_info.first, loop_info.second.resume_jump_targets(),
+            &unresolved_suspend_ids)) {
+      valid = false;
+    }
+  }
+
+  // Check that everything is resolved.
+  if (!unresolved_suspend_ids.empty()) {
+    PrintF(stderr,
+           "Found suspend ids that are not resolved by a final leaf resume "
+           "jump:\n");
+
+    for (const std::pair<int, int>& target : unresolved_suspend_ids) {
+      PrintF(stderr, "  %d -> %d\n", target.first, target.second);
+    }
+    valid = false;
+  }
+
+  return valid;
+}
+
+bool BytecodeAnalysis::ResumeJumpTargetLeavesResolveSuspendIds(
+    int parent_offset, const ZoneVector<ResumeJumpTarget>& resume_jump_targets,
+    std::map<int, int>* unresolved_suspend_ids) {
+  bool valid = true;
+  for (const ResumeJumpTarget& target : resume_jump_targets) {
+    std::map<int, int>::iterator it =
+        unresolved_suspend_ids->find(target.suspend_id());
+    if (it == unresolved_suspend_ids->end()) {
+      PrintF(
+          stderr,
+          "No unresolved suspend found for resume target with suspend id %d\n",
+          target.suspend_id());
+      valid = false;
+      continue;
+    }
+    int expected_target = it->second;
+
+    if (target.is_leaf()) {
+      // Leaves should have the expected target as their target.
+      if (target.target_offset() != expected_target) {
+        PrintF(
+            stderr,
+            "Expected leaf resume target for id %d to have target offset %d, "
+            "but had %d\n",
+            target.suspend_id(), expected_target, target.target_offset());
+        valid = false;
+      } else {
+        // Make sure we're resuming to a Resume bytecode
+        interpreter::BytecodeArrayAccessor assessor(bytecode_array(),
+                                                    target.target_offset());
+        if (assessor.current_bytecode() != Bytecode::kResumeGenerator) {
+          PrintF(stderr,
+                 "Expected resume target for id %d, offset %d, to be "
+                 "ResumeGenerator, but found %s\n",
+                 target.suspend_id(), target.target_offset(),
+                 Bytecodes::ToString(assessor.current_bytecode()));
+
+          valid = false;
+        }
+      }
+      // We've resolved this suspend id, so erase it to make sure we don't
+      // resolve it twice.
+      unresolved_suspend_ids->erase(it);
+    } else {
+      // Non-leaves should have a direct inner loop header as their target.
+      if (!IsLoopHeader(target.target_offset())) {
+        PrintF(stderr,
+               "Expected non-leaf resume target for id %d to have a loop "
+               "header at target offset %d\n",
+               target.suspend_id(), target.target_offset());
+        valid = false;
+      } else {
+        LoopInfo loop_info = GetLoopInfoFor(target.target_offset());
+        if (loop_info.parent_offset() != parent_offset) {
+          PrintF(stderr,
+                 "Expected non-leaf resume target for id %d to have a direct "
+                 "inner loop at target offset %d\n",
+                 target.suspend_id(), target.target_offset());
+          valid = false;
+        }
+        // If the target loop is a valid inner loop, we'll check its validity
+        // when we analyze its resume targets.
+      }
+    }
+  }
+  return valid;
+}
+
 bool BytecodeAnalysis::LivenessIsValid() {
   interpreter::BytecodeArrayRandomIterator iterator(bytecode_array(), zone());
 
diff --git a/deps/v8/src/compiler/bytecode-analysis.h b/deps/v8/src/compiler/bytecode-analysis.h
index f6cd6e3cab3..6ff9ed021a8 100644
--- a/deps/v8/src/compiler/bytecode-analysis.h
+++ b/deps/v8/src/compiler/bytecode-analysis.h
@@ -39,15 +39,49 @@ class V8_EXPORT_PRIVATE BytecodeLoopAssignments {
   BitVector* bit_vector_;
 };
 
+// Jump targets for resuming a suspended generator.
+class V8_EXPORT_PRIVATE ResumeJumpTarget {
+ public:
+  // Create a resume jump target representing an actual resume.
+  static ResumeJumpTarget Leaf(int suspend_id, int target_offset);
+
+  // Create a resume jump target at a loop header, which will have another
+  // resume jump after the loop header is crossed.
+  static ResumeJumpTarget AtLoopHeader(int loop_header_offset,
+                                       const ResumeJumpTarget& next);
+
+  int suspend_id() const { return suspend_id_; }
+  int target_offset() const { return target_offset_; }
+  bool is_leaf() const { return target_offset_ == final_target_offset_; }
+
+ private:
+  // The suspend id of the resume.
+  int suspend_id_;
+  // The target offset of this resume jump.
+  int target_offset_;
+  // The final offset of this resume, which may be across multiple jumps.
+  int final_target_offset_;
+
+  ResumeJumpTarget(int suspend_id, int target_offset, int final_target_offset);
+};
+
 struct V8_EXPORT_PRIVATE LoopInfo {
  public:
   LoopInfo(int parent_offset, int parameter_count, int register_count,
            Zone* zone)
       : parent_offset_(parent_offset),
-        assignments_(parameter_count, register_count, zone) {}
+        assignments_(parameter_count, register_count, zone),
+        resume_jump_targets_(zone) {}
 
   int parent_offset() const { return parent_offset_; }
 
+  const ZoneVector<ResumeJumpTarget>& resume_jump_targets() const {
+    return resume_jump_targets_;
+  }
+  void AddResumeTarget(const ResumeJumpTarget& target) {
+    resume_jump_targets_.push_back(target);
+  }
+
   BytecodeLoopAssignments& assignments() { return assignments_; }
   const BytecodeLoopAssignments& assignments() const { return assignments_; }
 
@@ -55,6 +89,7 @@ struct V8_EXPORT_PRIVATE LoopInfo {
   // The offset to the parent loop, or -1 if there is no parent.
   int parent_offset_;
   BytecodeLoopAssignments assignments_;
+  ZoneVector<ResumeJumpTarget> resume_jump_targets_;
 };
 
 class V8_EXPORT_PRIVATE BytecodeAnalysis BASE_EMBEDDED {
@@ -78,10 +113,16 @@ class V8_EXPORT_PRIVATE BytecodeAnalysis BASE_EMBEDDED {
   // Get the loop info of the loop header at {header_offset}.
   const LoopInfo& GetLoopInfoFor(int header_offset) const;
 
+  // Get the top-level resume jump targets.
+  const ZoneVector<ResumeJumpTarget>& resume_jump_targets() const {
+    return resume_jump_targets_;
+  }
+
   // True if the current analysis has an OSR entry point.
   bool HasOsrEntryPoint() const { return osr_entry_point_ != -1; }
 
   int osr_entry_point() const { return osr_entry_point_; }
+
   // Gets the in-liveness for the bytecode at {offset}.
   const BytecodeLivenessState* GetInLivenessFor(int offset) const;
 
@@ -99,6 +140,12 @@ class V8_EXPORT_PRIVATE BytecodeAnalysis BASE_EMBEDDED {
   void PushLoop(int loop_header, int loop_end);
 
 #if DEBUG
+  bool ResumeJumpTargetsAreValid();
+  bool ResumeJumpTargetLeavesResolveSuspendIds(
+      int parent_offset,
+      const ZoneVector<ResumeJumpTarget>& resume_jump_targets,
+      std::map<int, int>* unresolved_suspend_ids);
+
   bool LivenessIsValid();
 #endif
 
@@ -112,6 +159,7 @@ class V8_EXPORT_PRIVATE BytecodeAnalysis BASE_EMBEDDED {
 
   ZoneStack<LoopStackEntry> loop_stack_;
   ZoneVector<int> loop_end_index_queue_;
+  ZoneVector<ResumeJumpTarget> resume_jump_targets_;
 
   ZoneMap<int, int> end_to_header_;
   ZoneMap<int, LoopInfo> header_to_info_;
diff --git a/deps/v8/src/compiler/bytecode-graph-builder.cc b/deps/v8/src/compiler/bytecode-graph-builder.cc
index 54a924fce4b..defe14baddd 100644
--- a/deps/v8/src/compiler/bytecode-graph-builder.cc
+++ b/deps/v8/src/compiler/bytecode-graph-builder.cc
@@ -9,6 +9,7 @@
 #include "src/compiler/access-builder.h"
 #include "src/compiler/compiler-source-position-table.h"
 #include "src/compiler/linkage.h"
+#include "src/compiler/node-matchers.h"
 #include "src/compiler/operator-properties.h"
 #include "src/compiler/simplified-operator.h"
 #include "src/interpreter/bytecodes.h"
@@ -40,6 +41,7 @@ class BytecodeGraphBuilder::Environment : public ZoneObject {
 
   Node* LookupAccumulator() const;
   Node* LookupRegister(interpreter::Register the_register) const;
+  Node* LookupGeneratorState() const;
 
   void BindAccumulator(Node* node,
                        FrameStateAttachmentMode mode = kDontAttachFrameState);
@@ -48,6 +50,7 @@ class BytecodeGraphBuilder::Environment : public ZoneObject {
   void BindRegistersToProjections(
       interpreter::Register first_reg, Node* node,
       FrameStateAttachmentMode mode = kDontAttachFrameState);
+  void BindGeneratorState(Node* node);
   void RecordAfterState(Node* node,
                         FrameStateAttachmentMode mode = kDontAttachFrameState);
 
@@ -108,6 +111,7 @@ class BytecodeGraphBuilder::Environment : public ZoneObject {
   Node* effect_dependency_;
   NodeVector values_;
   Node* parameters_state_values_;
+  Node* generator_state_;
   int register_base_;
   int accumulator_base_;
 };
@@ -138,7 +142,8 @@ BytecodeGraphBuilder::Environment::Environment(
       control_dependency_(control_dependency),
       effect_dependency_(control_dependency),
       values_(builder->local_zone()),
-      parameters_state_values_(nullptr) {
+      parameters_state_values_(nullptr),
+      generator_state_(nullptr) {
   // The layout of values_ is:
   //
   // [receiver] [parameters] [registers] [accumulator]
@@ -191,6 +196,7 @@ BytecodeGraphBuilder::Environment::Environment(
       effect_dependency_(other->effect_dependency_),
       values_(other->zone()),
       parameters_state_values_(other->parameters_state_values_),
+      generator_state_(other->generator_state_),
       register_base_(other->register_base_),
       accumulator_base_(other->accumulator_base_) {
   values_ = other->values_;
@@ -210,6 +216,10 @@ Node* BytecodeGraphBuilder::Environment::LookupAccumulator() const {
   return values()->at(accumulator_base_);
 }
 
+Node* BytecodeGraphBuilder::Environment::LookupGeneratorState() const {
+  DCHECK_NOT_NULL(generator_state_);
+  return generator_state_;
+}
 
 Node* BytecodeGraphBuilder::Environment::LookupRegister(
     interpreter::Register the_register) const {
@@ -231,6 +241,10 @@ void BytecodeGraphBuilder::Environment::BindAccumulator(
   values()->at(accumulator_base_) = node;
 }
 
+void BytecodeGraphBuilder::Environment::BindGeneratorState(Node* node) {
+  generator_state_ = node;
+}
+
 void BytecodeGraphBuilder::Environment::BindRegister(
     interpreter::Register the_register, Node* node,
     FrameStateAttachmentMode mode) {
@@ -291,9 +305,18 @@ void BytecodeGraphBuilder::Environment::Merge(
   for (int i = 0; i < register_count(); i++) {
     int index = register_base() + i;
     if (liveness == nullptr || liveness->RegisterIsLive(i)) {
-      DCHECK_NE(values_[index], builder()->jsgraph()->OptimizedOutConstant());
-      DCHECK_NE(other->values_[index],
-                builder()->jsgraph()->OptimizedOutConstant());
+#if DEBUG
+      // We only do these DCHECKs when we are not in the resume path of a
+      // generator -- this is, when either there is no generator state at all,
+      // or the generator state is not the constant "executing" value.
+      if (generator_state_ == nullptr ||
+          NumberMatcher(generator_state_)
+              .Is(JSGeneratorObject::kGeneratorExecuting)) {
+        DCHECK_NE(values_[index], builder()->jsgraph()->OptimizedOutConstant());
+        DCHECK_NE(other->values_[index],
+                  builder()->jsgraph()->OptimizedOutConstant());
+      }
+#endif
 
       values_[index] =
           builder()->MergeValue(values_[index], other->values_[index], control);
@@ -315,6 +338,12 @@ void BytecodeGraphBuilder::Environment::Merge(
   } else {
     values_[accumulator_base()] = builder()->jsgraph()->OptimizedOutConstant();
   }
+
+  if (generator_state_ != nullptr) {
+    DCHECK_NOT_NULL(other->generator_state_);
+    generator_state_ = builder()->MergeValue(generator_state_,
+                                             other->generator_state_, control);
+  }
 }
 
 void BytecodeGraphBuilder::Environment::PrepareForLoop(
@@ -345,6 +374,10 @@ void BytecodeGraphBuilder::Environment::PrepareForLoop(
   // The accumulator should not be live on entry.
   DCHECK_IMPLIES(liveness != nullptr, !liveness->AccumulatorIsLive());
 
+  if (generator_state_ != nullptr) {
+    generator_state_ = builder()->NewPhi(1, generator_state_, control);
+  }
+
   // Connect to the loop end.
   Node* terminate = builder()->graph()->NewNode(
       builder()->common()->Terminate(), effect, control);
@@ -423,6 +456,11 @@ void BytecodeGraphBuilder::Environment::PrepareForLoopExit(
                                     values_[accumulator_base()], loop_exit);
     values_[accumulator_base()] = rename;
   }
+
+  if (generator_state_ != nullptr) {
+    generator_state_ = graph()->NewNode(common()->LoopExitValue(),
+                                        generator_state_, loop_exit);
+  }
 }
 
 void BytecodeGraphBuilder::Environment::UpdateStateValues(Node** state_values,
@@ -478,13 +516,12 @@ BytecodeGraphBuilder::BytecodeGraphBuilder(
     Handle<FeedbackVector> feedback_vector, BailoutId osr_offset,
     JSGraph* jsgraph, CallFrequency invocation_frequency,
     SourcePositionTable* source_positions, Handle<Context> native_context,
-    int inlining_id, JSTypeHintLowering::Flags flags, bool stack_check)
+    int inlining_id, JSTypeHintLowering::Flags flags, bool stack_check,
+    bool analyze_environment_liveness)
     : local_zone_(local_zone),
       jsgraph_(jsgraph),
       invocation_frequency_(invocation_frequency),
       bytecode_array_(handle(shared_info->bytecode_array())),
-      exception_handler_table_(
-          handle(HandlerTable::cast(bytecode_array()->handler_table()))),
       feedback_vector_(feedback_vector),
       type_hint_lowering_(jsgraph, feedback_vector, flags),
       frame_state_function_info_(common()->CreateFrameStateFunctionInfo(
@@ -497,7 +534,9 @@ BytecodeGraphBuilder::BytecodeGraphBuilder(
       osr_offset_(osr_offset),
       currently_peeled_loop_offset_(-1),
       stack_check_(stack_check),
+      analyze_environment_liveness_(analyze_environment_liveness),
       merge_environments_(local_zone),
+      generator_merge_environments_(local_zone),
       exception_handlers_(local_zone),
       current_exception_handler_(0),
       input_buffer_size_(0),
@@ -506,7 +545,7 @@ BytecodeGraphBuilder::BytecodeGraphBuilder(
       exit_controls_(local_zone),
       state_values_cache_(jsgraph),
       source_positions_(source_positions),
-      start_position_(shared_info->start_position(), inlining_id),
+      start_position_(shared_info->StartPosition(), inlining_id),
       native_context_(native_context) {}
 
 Node* BytecodeGraphBuilder::GetFunctionClosure() {
@@ -529,7 +568,7 @@ Node* BytecodeGraphBuilder::BuildLoadNativeContextField(int index) {
 }
 
 VectorSlotPair BytecodeGraphBuilder::CreateVectorSlotPair(int slot_id) {
-  return VectorSlotPair(feedback_vector(), feedback_vector()->ToSlot(slot_id));
+  return VectorSlotPair(feedback_vector(), FeedbackVector::ToSlot(slot_id));
 }
 
 void BytecodeGraphBuilder::CreateGraph() {
@@ -832,7 +871,7 @@ void BytecodeGraphBuilder::VisitSingleBytecode(
 
 void BytecodeGraphBuilder::VisitBytecodes() {
   BytecodeAnalysis bytecode_analysis(bytecode_array(), local_zone(),
-                                     FLAG_analyze_environment_liveness);
+                                     analyze_environment_liveness());
   bytecode_analysis.Analyze(osr_offset_);
   set_bytecode_analysis(&bytecode_analysis);
 
@@ -841,12 +880,17 @@ void BytecodeGraphBuilder::VisitBytecodes() {
   SourcePositionTableIterator source_position_iterator(
       handle(bytecode_array()->SourcePositionTable()));
 
-  if (FLAG_trace_environment_liveness) {
+  if (analyze_environment_liveness() && FLAG_trace_environment_liveness) {
     OFStream of(stdout);
 
     bytecode_analysis.PrintLivenessTo(of);
   }
 
+  if (!bytecode_analysis.resume_jump_targets().empty()) {
+    environment()->BindGeneratorState(
+        jsgraph()->SmiConstant(JSGeneratorObject::kGeneratorExecuting));
+  }
+
   if (bytecode_analysis.HasOsrEntryPoint()) {
     // We peel the OSR loop and any outer loop containing it except that we
     // leave the nodes corresponding to the whole outermost loop (including
@@ -965,6 +1009,32 @@ void BytecodeGraphBuilder::VisitStaGlobal() {
   environment()->RecordAfterState(node, Environment::kAttachFrameState);
 }
 
+void BytecodeGraphBuilder::VisitStaInArrayLiteral() {
+  PrepareEagerCheckpoint();
+  Node* value = environment()->LookupAccumulator();
+  Node* array =
+      environment()->LookupRegister(bytecode_iterator().GetRegisterOperand(0));
+  Node* index =
+      environment()->LookupRegister(bytecode_iterator().GetRegisterOperand(1));
+  VectorSlotPair feedback =
+      CreateVectorSlotPair(bytecode_iterator().GetIndexOperand(2));
+  const Operator* op = javascript()->StoreInArrayLiteral(feedback);
+
+  JSTypeHintLowering::LoweringResult lowering =
+      TryBuildSimplifiedStoreKeyed(op, array, index, value, feedback.slot());
+  if (lowering.IsExit()) return;
+
+  Node* node = nullptr;
+  if (lowering.IsSideEffectFree()) {
+    node = lowering.value();
+  } else {
+    DCHECK(!lowering.Changed());
+    node = NewNode(op, array, index, value);
+  }
+
+  environment()->RecordAfterState(node, Environment::kAttachFrameState);
+}
+
 void BytecodeGraphBuilder::VisitStaDataPropertyInLiteral() {
   PrepareEagerCheckpoint();
 
@@ -1393,14 +1463,17 @@ void BytecodeGraphBuilder::VisitPopContext() {
 void BytecodeGraphBuilder::VisitCreateClosure() {
   Handle<SharedFunctionInfo> shared_info = Handle<SharedFunctionInfo>::cast(
       bytecode_iterator().GetConstantForIndexOperand(0));
-  int const slot_id = bytecode_iterator().GetIndexOperand(1);
-  VectorSlotPair pair = CreateVectorSlotPair(slot_id);
+  FeedbackSlot slot = bytecode_iterator().GetSlotOperand(1);
+  FeedbackNexus nexus(feedback_vector(), slot);
   PretenureFlag tenured =
       interpreter::CreateClosureFlags::PretenuredBit::decode(
           bytecode_iterator().GetFlagOperand(2))
           ? TENURED
           : NOT_TENURED;
-  const Operator* op = javascript()->CreateClosure(shared_info, pair, tenured);
+  const Operator* op = javascript()->CreateClosure(
+      shared_info, nexus.GetFeedbackCell(),
+      handle(jsgraph()->isolate()->builtins()->builtin(Builtins::kCompileLazy)),
+      tenured);
   Node* closure = NewNode(op);
   environment()->BindAccumulator(closure);
 }
@@ -1540,12 +1613,21 @@ void BytecodeGraphBuilder::VisitGetTemplateObject() {
   Handle<TemplateObjectDescription> description =
       Handle<TemplateObjectDescription>::cast(
           bytecode_iterator().GetConstantForIndexOperand(0));
-  // It's not observable when the template object is created, so we
-  // can just create it eagerly during graph building and bake in
-  // the JSArray constant here.
-  Node* template_object =
-      jsgraph()->HeapConstant(TemplateObjectDescription::GetTemplateObject(
-          description, native_context()));
+  FeedbackSlot slot = bytecode_iterator().GetSlotOperand(1);
+  FeedbackNexus nexus(feedback_vector(), slot);
+
+  Handle<JSArray> cached_value;
+  if (nexus.GetFeedback() == Smi::kZero) {
+    // It's not observable when the template object is created, so we
+    // can just create it eagerly during graph building and bake in
+    // the JSArray constant here.
+    cached_value = TemplateObjectDescription::CreateTemplateObject(description);
+    nexus.vector()->Set(slot, *cached_value);
+  } else {
+    cached_value = handle(JSArray::cast(nexus.GetFeedback()));
+  }
+
+  Node* template_object = jsgraph()->HeapConstant(cached_value);
   environment()->BindAccumulator(template_object);
 }
 
@@ -1808,14 +1890,21 @@ Node* BytecodeGraphBuilder::ProcessCallRuntimeArguments(
 
 void BytecodeGraphBuilder::VisitCallRuntime() {
   PrepareEagerCheckpoint();
-  Runtime::FunctionId functionId = bytecode_iterator().GetRuntimeIdOperand(0);
+  Runtime::FunctionId function_id = bytecode_iterator().GetRuntimeIdOperand(0);
   interpreter::Register receiver = bytecode_iterator().GetRegisterOperand(1);
   size_t reg_count = bytecode_iterator().GetRegisterCountOperand(2);
 
   // Create node to perform the runtime call.
-  const Operator* call = javascript()->CallRuntime(functionId, reg_count);
+  const Operator* call = javascript()->CallRuntime(function_id, reg_count);
   Node* value = ProcessCallRuntimeArguments(call, receiver, reg_count);
   environment()->BindAccumulator(value, Environment::kAttachFrameState);
+
+  // Connect to the end if {function_id} is non-returning.
+  if (Runtime::IsNonReturning(function_id)) {
+    // TODO(7099): Investigate if we need LoopExit node here.
+    Node* control = NewNode(common()->Throw());
+    MergeControlToLeaveFunction(control);
+  }
 }
 
 void BytecodeGraphBuilder::VisitCallRuntimeForPair() {
@@ -1967,6 +2056,8 @@ void BytecodeGraphBuilder::BuildHoleCheckAndThrow(
     SubEnvironment sub_environment(this);
 
     NewIfTrue();
+    BuildLoopExitsForFunctionExit(bytecode_analysis()->GetInLivenessFor(
+        bytecode_iterator().current_offset()));
     Node* node;
     const Operator* op = javascript()->CallRuntime(runtime_id);
     if (runtime_id == Runtime::kThrowReferenceError) {
@@ -2015,8 +2106,8 @@ void BytecodeGraphBuilder::BuildUnaryOp(const Operator* op) {
   PrepareEagerCheckpoint();
   Node* operand = environment()->LookupAccumulator();
 
-  FeedbackSlot slot = feedback_vector()->ToSlot(
-      bytecode_iterator().GetIndexOperand(kUnaryOperationHintIndex));
+  FeedbackSlot slot =
+      bytecode_iterator().GetSlotOperand(kUnaryOperationHintIndex);
   JSTypeHintLowering::LoweringResult lowering =
       TryBuildSimplifiedUnaryOp(op, operand, slot);
   if (lowering.IsExit()) return;
@@ -2038,8 +2129,8 @@ void BytecodeGraphBuilder::BuildBinaryOp(const Operator* op) {
       environment()->LookupRegister(bytecode_iterator().GetRegisterOperand(0));
   Node* right = environment()->LookupAccumulator();
 
-  FeedbackSlot slot = feedback_vector()->ToSlot(
-      bytecode_iterator().GetIndexOperand(kBinaryOperationHintIndex));
+  FeedbackSlot slot =
+      bytecode_iterator().GetSlotOperand(kBinaryOperationHintIndex);
   JSTypeHintLowering::LoweringResult lowering =
       TryBuildSimplifiedBinaryOp(op, left, right, slot);
   if (lowering.IsExit()) return;
@@ -2059,28 +2150,23 @@ void BytecodeGraphBuilder::BuildBinaryOp(const Operator* op) {
 // feedback.
 BinaryOperationHint BytecodeGraphBuilder::GetBinaryOperationHint(
     int operand_index) {
-  FeedbackSlot slot = feedback_vector()->ToSlot(
-      bytecode_iterator().GetIndexOperand(operand_index));
-  DCHECK_EQ(FeedbackSlotKind::kBinaryOp, feedback_vector()->GetKind(slot));
-  BinaryOpICNexus nexus(feedback_vector(), slot);
+  FeedbackSlot slot = bytecode_iterator().GetSlotOperand(operand_index);
+  FeedbackNexus nexus(feedback_vector(), slot);
   return nexus.GetBinaryOperationFeedback();
 }
 
 // Helper function to create compare operation hint from the recorded type
 // feedback.
 CompareOperationHint BytecodeGraphBuilder::GetCompareOperationHint() {
-  int slot_index = bytecode_iterator().GetIndexOperand(1);
-  FeedbackSlot slot = feedback_vector()->ToSlot(slot_index);
-  DCHECK_EQ(FeedbackSlotKind::kCompareOp, feedback_vector()->GetKind(slot));
-  CompareICNexus nexus(feedback_vector(), slot);
+  FeedbackSlot slot = bytecode_iterator().GetSlotOperand(1);
+  FeedbackNexus nexus(feedback_vector(), slot);
   return nexus.GetCompareOperationFeedback();
 }
 
 // Helper function to create for-in mode from the recorded type feedback.
 ForInMode BytecodeGraphBuilder::GetForInMode(int operand_index) {
-  FeedbackSlot slot = feedback_vector()->ToSlot(
-      bytecode_iterator().GetIndexOperand(operand_index));
-  ForInICNexus nexus(feedback_vector(), slot);
+  FeedbackSlot slot = bytecode_iterator().GetSlotOperand(operand_index);
+  FeedbackNexus nexus(feedback_vector(), slot);
   switch (nexus.GetForInFeedback()) {
     case ForInHint::kNone:
     case ForInHint::kEnumCacheKeysAndIndices:
@@ -2095,13 +2181,13 @@ ForInMode BytecodeGraphBuilder::GetForInMode(int operand_index) {
 
 CallFrequency BytecodeGraphBuilder::ComputeCallFrequency(int slot_id) const {
   if (invocation_frequency_.IsUnknown()) return CallFrequency();
-  CallICNexus nexus(feedback_vector(), feedback_vector()->ToSlot(slot_id));
+  FeedbackNexus nexus(feedback_vector(), FeedbackVector::ToSlot(slot_id));
   return CallFrequency(nexus.ComputeCallFrequency() *
                        invocation_frequency_.value());
 }
 
 SpeculationMode BytecodeGraphBuilder::GetSpeculationMode(int slot_id) const {
-  CallICNexus nexus(feedback_vector(), feedback_vector()->ToSlot(slot_id));
+  FeedbackNexus nexus(feedback_vector(), FeedbackVector::ToSlot(slot_id));
   return nexus.GetSpeculationMode();
 }
 
@@ -2173,8 +2259,8 @@ void BytecodeGraphBuilder::BuildBinaryOpWithImmediate(const Operator* op) {
   Node* left = environment()->LookupAccumulator();
   Node* right = jsgraph()->Constant(bytecode_iterator().GetImmediateOperand(0));
 
-  FeedbackSlot slot = feedback_vector()->ToSlot(
-      bytecode_iterator().GetIndexOperand(kBinaryOperationSmiHintIndex));
+  FeedbackSlot slot =
+      bytecode_iterator().GetSlotOperand(kBinaryOperationSmiHintIndex);
   JSTypeHintLowering::LoweringResult lowering =
       TryBuildSimplifiedBinaryOp(op, left, right, slot);
   if (lowering.IsExit()) return;
@@ -2288,8 +2374,7 @@ void BytecodeGraphBuilder::BuildCompareOp(const Operator* op) {
       environment()->LookupRegister(bytecode_iterator().GetRegisterOperand(0));
   Node* right = environment()->LookupAccumulator();
 
-  int slot_index = bytecode_iterator().GetIndexOperand(1);
-  FeedbackSlot slot = feedback_vector()->ToSlot(slot_index);
+  FeedbackSlot slot = bytecode_iterator().GetSlotOperand(1);
   JSTypeHintLowering::LoweringResult lowering =
       TryBuildSimplifiedBinaryOp(op, left, right, slot);
   if (lowering.IsExit()) return;
@@ -2448,12 +2533,17 @@ void BytecodeGraphBuilder::VisitToObject() {
   BuildCastOperator(javascript()->ToObject());
 }
 
+void BytecodeGraphBuilder::VisitToString() {
+  Node* value =
+      NewNode(javascript()->ToString(), environment()->LookupAccumulator());
+  environment()->BindAccumulator(value, Environment::kAttachFrameState);
+}
+
 void BytecodeGraphBuilder::VisitToNumber() {
   PrepareEagerCheckpoint();
   Node* object = environment()->LookupAccumulator();
 
-  FeedbackSlot slot =
-      feedback_vector()->ToSlot(bytecode_iterator().GetIndexOperand(0));
+  FeedbackSlot slot = bytecode_iterator().GetSlotOperand(0);
   JSTypeHintLowering::LoweringResult lowering =
       TryBuildSimplifiedToNumber(object, slot);
 
@@ -2474,8 +2564,7 @@ void BytecodeGraphBuilder::VisitToNumeric() {
 
   // If we have some kind of Number feedback, we do the same lowering as for
   // ToNumber.
-  FeedbackSlot slot =
-      feedback_vector()->ToSlot(bytecode_iterator().GetIndexOperand(0));
+  FeedbackSlot slot = bytecode_iterator().GetSlotOperand(0);
   JSTypeHintLowering::LoweringResult lowering =
       TryBuildSimplifiedToNumber(object, slot);
 
@@ -2591,15 +2680,19 @@ void BytecodeGraphBuilder::VisitSetPendingMessage() {
   environment()->BindAccumulator(previous_message);
 }
 
-void BytecodeGraphBuilder::VisitReturn() {
-  BuildLoopExitsForFunctionExit(bytecode_analysis()->GetInLivenessFor(
-      bytecode_iterator().current_offset()));
+void BytecodeGraphBuilder::BuildReturn(const BytecodeLivenessState* liveness) {
+  BuildLoopExitsForFunctionExit(liveness);
   Node* pop_node = jsgraph()->ZeroConstant();
   Node* control =
       NewNode(common()->Return(), pop_node, environment()->LookupAccumulator());
   MergeControlToLeaveFunction(control);
 }
 
+void BytecodeGraphBuilder::VisitReturn() {
+  BuildReturn(bytecode_analysis()->GetInLivenessFor(
+      bytecode_iterator().current_offset()));
+}
+
 void BytecodeGraphBuilder::VisitDebugger() {
   PrepareEagerCheckpoint();
   Node* call = NewNode(javascript()->Debugger());
@@ -2633,8 +2726,7 @@ void BytecodeGraphBuilder::VisitForInPrepare() {
   PrepareEagerCheckpoint();
   Node* enumerator = environment()->LookupAccumulator();
 
-  FeedbackSlot slot =
-      feedback_vector()->ToSlot(bytecode_iterator().GetIndexOperand(1));
+  FeedbackSlot slot = bytecode_iterator().GetSlotOperand(1);
   JSTypeHintLowering::LoweringResult lowering =
       TryBuildSimplifiedForInPrepare(enumerator, slot);
   if (lowering.IsExit()) return;
@@ -2675,8 +2767,7 @@ void BytecodeGraphBuilder::VisitForInNext() {
                            environment()->GetControlDependency());
   environment()->UpdateEffectDependency(index);
 
-  FeedbackSlot slot =
-      feedback_vector()->ToSlot(bytecode_iterator().GetIndexOperand(3));
+  FeedbackSlot slot = bytecode_iterator().GetSlotOperand(3);
   JSTypeHintLowering::LoweringResult lowering = TryBuildSimplifiedForInNext(
       receiver, cache_array, cache_type, index, slot);
   if (lowering.IsExit()) return;
@@ -2714,54 +2805,136 @@ void BytecodeGraphBuilder::VisitSuspendGenerator() {
       jsgraph()->Constant(bytecode_iterator().current_offset() +
                           (BytecodeArray::kHeaderSize - kHeapObjectTag));
 
+  const BytecodeLivenessState* liveness = bytecode_analysis()->GetInLivenessFor(
+      bytecode_iterator().current_offset());
+
+  // Maybe overallocate the value list since we don't know how many registers
+  // are live.
+  // TODO(leszeks): We could get this count from liveness rather than the
+  // register list.
   int value_input_count = 3 + register_count;
 
   Node** value_inputs = local_zone()->NewArray<Node*>(value_input_count);
   value_inputs[0] = generator;
   value_inputs[1] = suspend_id;
   value_inputs[2] = offset;
+
+  int count_written = 0;
   for (int i = 0; i < register_count; ++i) {
-    value_inputs[3 + i] =
-        environment()->LookupRegister(interpreter::Register(i));
+    if (liveness == nullptr || liveness->RegisterIsLive(i)) {
+      while (count_written < i) {
+        value_inputs[3 + count_written++] = jsgraph()->OptimizedOutConstant();
+      }
+      value_inputs[3 + count_written++] =
+          environment()->LookupRegister(interpreter::Register(i));
+      DCHECK_EQ(count_written, i + 1);
+    }
   }
 
-  MakeNode(javascript()->GeneratorStore(register_count), value_input_count,
+  // Use the actual written count rather than the register count to create the
+  // node.
+  MakeNode(javascript()->GeneratorStore(count_written), 3 + count_written,
            value_inputs, false);
+
+  // TODO(leszeks): This over-approximates the liveness at exit, only the
+  // accumulator should be live by this point.
+  BuildReturn(bytecode_analysis()->GetInLivenessFor(
+      bytecode_iterator().current_offset()));
 }
 
-void BytecodeGraphBuilder::VisitRestoreGeneratorState() {
-  Node* generator = environment()->LookupRegister(
-      bytecode_iterator().GetRegisterOperand(0));
+void BytecodeGraphBuilder::BuildSwitchOnGeneratorState(
+    const ZoneVector<ResumeJumpTarget>& resume_jump_targets,
+    bool allow_fallthrough_on_executing) {
+  Node* generator_state = environment()->LookupGeneratorState();
+
+  int extra_cases = allow_fallthrough_on_executing ? 2 : 1;
+  NewSwitch(generator_state,
+            static_cast<int>(resume_jump_targets.size() + extra_cases));
+  for (const ResumeJumpTarget& target : resume_jump_targets) {
+    SubEnvironment sub_environment(this);
+    NewIfValue(target.suspend_id());
+    if (target.is_leaf()) {
+      // Mark that we are resuming executing.
+      environment()->BindGeneratorState(
+          jsgraph()->SmiConstant(JSGeneratorObject::kGeneratorExecuting));
+    }
+    // Jump to the target offset, whether it's a loop header or the resume.
+    MergeIntoSuccessorEnvironment(target.target_offset());
+  }
+
+  {
+    SubEnvironment sub_environment(this);
+    // We should never hit the default case (assuming generator state cannot be
+    // corrupted), so abort if we do.
+    // TODO(leszeks): Maybe only check this in debug mode, and otherwise use
+    // the default to represent one of the cases above/fallthrough below?
+    NewIfDefault();
+    NewNode(simplified()->RuntimeAbort(AbortReason::kInvalidJumpTableIndex));
+    // TODO(7099): Investigate if we need LoopExit here.
+    Node* control = NewNode(common()->Throw());
+    MergeControlToLeaveFunction(control);
+  }
 
-  Node* state =
-      NewNode(javascript()->GeneratorRestoreContinuation(), generator);
+  if (allow_fallthrough_on_executing) {
+    // If we are executing (rather than resuming), and we allow it, just fall
+    // through to the actual loop body.
+    NewIfValue(JSGeneratorObject::kGeneratorExecuting);
+  } else {
+    // Otherwise, this environment is dead.
+    set_environment(nullptr);
+  }
+}
+
+void BytecodeGraphBuilder::VisitSwitchOnGeneratorState() {
+  Node* generator =
+      environment()->LookupRegister(bytecode_iterator().GetRegisterOperand(0));
+
+  Node* generator_is_undefined =
+      NewNode(simplified()->ReferenceEqual(), generator,
+              jsgraph()->UndefinedConstant());
+
+  NewBranch(generator_is_undefined);
+  {
+    SubEnvironment resume_env(this);
+    NewIfFalse();
+
+    Node* generator_state =
+        NewNode(javascript()->GeneratorRestoreContinuation(), generator);
+    environment()->BindGeneratorState(generator_state);
+
+    Node* generator_context =
+        NewNode(javascript()->GeneratorRestoreContext(), generator);
+    environment()->SetContext(generator_context);
+
+    BuildSwitchOnGeneratorState(bytecode_analysis()->resume_jump_targets(),
+                                false);
+  }
 
-  environment()->BindAccumulator(state, Environment::kAttachFrameState);
+  // Fallthrough for the first-call case.
+  NewIfTrue();
 }
 
 void BytecodeGraphBuilder::VisitResumeGenerator() {
   Node* generator =
       environment()->LookupRegister(bytecode_iterator().GetRegisterOperand(0));
-  interpreter::Register generator_state_reg =
-      bytecode_iterator().GetRegisterOperand(1);
-  interpreter::Register first_reg = bytecode_iterator().GetRegisterOperand(2);
+  interpreter::Register first_reg = bytecode_iterator().GetRegisterOperand(1);
   // We assume we are restoring registers starting fromm index 0.
   CHECK_EQ(0, first_reg.index());
-  int register_count =
-      static_cast<int>(bytecode_iterator().GetRegisterCountOperand(3));
+
+  const BytecodeLivenessState* liveness =
+      bytecode_analysis()->GetOutLivenessFor(
+          bytecode_iterator().current_offset());
 
   // Bijection between registers and array indices must match that used in
   // InterpreterAssembler::ExportRegisterFile.
-  for (int i = 0; i < register_count; ++i) {
-    Node* value = NewNode(javascript()->GeneratorRestoreRegister(i), generator);
-    environment()->BindRegister(interpreter::Register(i), value);
+  for (int i = 0; i < environment()->register_count(); ++i) {
+    if (liveness == nullptr || liveness->RegisterIsLive(i)) {
+      Node* value =
+          NewNode(javascript()->GeneratorRestoreRegister(i), generator);
+      environment()->BindRegister(interpreter::Register(i), value);
+    }
   }
 
-  // We're no longer resuming, so update the state register.
-  environment()->BindRegister(
-      generator_state_reg,
-      jsgraph()->SmiConstant(JSGeneratorObject::kGeneratorExecuting));
-
   // Update the accumulator with the generator's input_or_debug_pos.
   Node* input_or_debug_pos =
       NewNode(javascript()->GeneratorRestoreInputOrDebugPos(), generator);
@@ -2803,12 +2976,29 @@ void BytecodeGraphBuilder::BuildLoopHeaderEnvironment(int current_offset) {
     const BytecodeLivenessState* liveness =
         bytecode_analysis()->GetInLivenessFor(current_offset);
 
+    const auto& resume_jump_targets = loop_info.resume_jump_targets();
+    bool generate_suspend_switch = !resume_jump_targets.empty();
+
     // Add loop header.
     environment()->PrepareForLoop(loop_info.assignments(), liveness);
 
     // Store a copy of the environment so we can connect merged back edge inputs
     // to the loop header.
     merge_environments_[current_offset] = environment()->Copy();
+
+    // If this loop contains resumes, create a new switch just after the loop
+    // for those resumes.
+    if (generate_suspend_switch) {
+      BuildSwitchOnGeneratorState(loop_info.resume_jump_targets(), true);
+
+      // TODO(leszeks): At this point we know we are executing rather than
+      // resuming, so we should be able to prune off the phis in the environment
+      // related to the resume path.
+
+      // Set the generator state to a known constant.
+      environment()->BindGeneratorState(
+          jsgraph()->SmiConstant(JSGeneratorObject::kGeneratorExecuting));
+    }
   }
 }
 
@@ -2874,7 +3064,7 @@ void BytecodeGraphBuilder::BuildJump() {
 }
 
 void BytecodeGraphBuilder::BuildJumpIf(Node* condition) {
-  NewBranch(condition);
+  NewBranch(condition, BranchHint::kNone, IsSafetyCheck::kNoSafetyCheck);
   {
     SubEnvironment sub_environment(this);
     NewIfTrue();
@@ -2884,7 +3074,7 @@ void BytecodeGraphBuilder::BuildJumpIf(Node* condition) {
 }
 
 void BytecodeGraphBuilder::BuildJumpIfNot(Node* condition) {
-  NewBranch(condition);
+  NewBranch(condition, BranchHint::kNone, IsSafetyCheck::kNoSafetyCheck);
   {
     SubEnvironment sub_environment(this);
     NewIfFalse();
@@ -2908,7 +3098,8 @@ void BytecodeGraphBuilder::BuildJumpIfNotEqual(Node* comperand) {
 }
 
 void BytecodeGraphBuilder::BuildJumpIfFalse() {
-  NewBranch(environment()->LookupAccumulator());
+  NewBranch(environment()->LookupAccumulator(), BranchHint::kNone,
+            IsSafetyCheck::kNoSafetyCheck);
   {
     SubEnvironment sub_environment(this);
     NewIfFalse();
@@ -2920,7 +3111,8 @@ void BytecodeGraphBuilder::BuildJumpIfFalse() {
 }
 
 void BytecodeGraphBuilder::BuildJumpIfTrue() {
-  NewBranch(environment()->LookupAccumulator());
+  NewBranch(environment()->LookupAccumulator(), BranchHint::kNone,
+            IsSafetyCheck::kNoSafetyCheck);
   {
     SubEnvironment sub_environment(this);
     NewIfTrue();
@@ -3123,8 +3315,7 @@ Node** BytecodeGraphBuilder::EnsureInputBufferSize(int size) {
 }
 
 void BytecodeGraphBuilder::ExitThenEnterExceptionHandlers(int current_offset) {
-  Handle<HandlerTable> table = exception_handler_table();
-  int num_entries = table->NumberOfRangeEntries();
+  HandlerTable table(*bytecode_array());
 
   // Potentially exit exception handlers.
   while (!exception_handlers_.empty()) {
@@ -3134,12 +3325,13 @@ void BytecodeGraphBuilder::ExitThenEnterExceptionHandlers(int current_offset) {
   }
 
   // Potentially enter exception handlers.
+  int num_entries = table.NumberOfRangeEntries();
   while (current_exception_handler_ < num_entries) {
-    int next_start = table->GetRangeStart(current_exception_handler_);
+    int next_start = table.GetRangeStart(current_exception_handler_);
     if (current_offset < next_start) break;  // Not yet covered by range.
-    int next_end = table->GetRangeEnd(current_exception_handler_);
-    int next_handler = table->GetRangeHandler(current_exception_handler_);
-    int context_register = table->GetRangeData(current_exception_handler_);
+    int next_end = table.GetRangeEnd(current_exception_handler_);
+    int next_handler = table.GetRangeHandler(current_exception_handler_);
+    int context_register = table.GetRangeData(current_exception_handler_);
     exception_handlers_.push(
         {next_start, next_end, next_handler, context_register});
     current_exception_handler_++;
diff --git a/deps/v8/src/compiler/bytecode-graph-builder.h b/deps/v8/src/compiler/bytecode-graph-builder.h
index 91b857298ca..9025d477d57 100644
--- a/deps/v8/src/compiler/bytecode-graph-builder.h
+++ b/deps/v8/src/compiler/bytecode-graph-builder.h
@@ -35,7 +35,7 @@ class BytecodeGraphBuilder {
       SourcePositionTable* source_positions, Handle<Context> native_context,
       int inlining_id = SourcePosition::kNotInlined,
       JSTypeHintLowering::Flags flags = JSTypeHintLowering::kNoFlags,
-      bool stack_check = true);
+      bool stack_check = true, bool analyze_environment_liveness = true);
 
   // Creates a graph by visiting bytecodes.
   void CreateGraph();
@@ -100,8 +100,9 @@ class BytecodeGraphBuilder {
   Node* NewIfDefault() { return NewNode(common()->IfDefault()); }
   Node* NewMerge() { return NewNode(common()->Merge(1), true); }
   Node* NewLoop() { return NewNode(common()->Loop(1), true); }
-  Node* NewBranch(Node* condition, BranchHint hint = BranchHint::kNone) {
-    return NewNode(common()->Branch(hint), condition);
+  Node* NewBranch(Node* condition, BranchHint hint = BranchHint::kNone,
+                  IsSafetyCheck is_safety_check = IsSafetyCheck::kSafetyCheck) {
+    return NewNode(common()->Branch(hint, is_safety_check), condition);
   }
   Node* NewSwitch(Node* condition, int control_output_count) {
     return NewNode(common()->Switch(control_output_count), condition);
@@ -252,6 +253,9 @@ class BytecodeGraphBuilder {
   void BuildJumpIfJSReceiver();
 
   void BuildSwitchOnSmi(Node* condition);
+  void BuildSwitchOnGeneratorState(
+      const ZoneVector<ResumeJumpTarget>& resume_jump_targets,
+      bool allow_fallthrough_on_executing);
 
   // Simulates control flow by forward-propagating environments.
   void MergeIntoSuccessorEnvironment(int target_offset);
@@ -268,6 +272,9 @@ class BytecodeGraphBuilder {
   void BuildLoopExitsUntilLoop(int loop_offset,
                                const BytecodeLivenessState* liveness);
 
+  // Helper for building a return (from an actual return or a suspend).
+  void BuildReturn(const BytecodeLivenessState* liveness);
+
   // Simulates entry and exit of exception handlers.
   void ExitThenEnterExceptionHandlers(int current_offset);
 
@@ -303,9 +310,6 @@ class BytecodeGraphBuilder {
   const Handle<BytecodeArray>& bytecode_array() const {
     return bytecode_array_;
   }
-  const Handle<HandlerTable>& exception_handler_table() const {
-    return exception_handler_table_;
-  }
   const Handle<FeedbackVector>& feedback_vector() const {
     return feedback_vector_;
   }
@@ -345,6 +349,10 @@ class BytecodeGraphBuilder {
 
   void set_stack_check(bool stack_check) { stack_check_ = stack_check; }
 
+  bool analyze_environment_liveness() const {
+    return analyze_environment_liveness_;
+  }
+
   int current_exception_handler() { return current_exception_handler_; }
 
   void set_current_exception_handler(int index) {
@@ -366,7 +374,6 @@ class BytecodeGraphBuilder {
   JSGraph* jsgraph_;
   CallFrequency const invocation_frequency_;
   Handle<BytecodeArray> bytecode_array_;
-  Handle<HandlerTable> exception_handler_table_;
   Handle<FeedbackVector> feedback_vector_;
   const JSTypeHintLowering type_hint_lowering_;
   const FrameStateFunctionInfo* frame_state_function_info_;
@@ -376,12 +383,22 @@ class BytecodeGraphBuilder {
   BailoutId osr_offset_;
   int currently_peeled_loop_offset_;
   bool stack_check_;
+  bool analyze_environment_liveness_;
 
   // Merge environments are snapshots of the environment at points where the
   // control flow merges. This models a forward data flow propagation of all
-  // values from all predecessors of the merge in question.
+  // values from all predecessors of the merge in question. They are indexed by
+  // the bytecode offset
   ZoneMap<int, Environment*> merge_environments_;
 
+  // Generator merge environments are snapshots of the current resume
+  // environment, tracing back through loop headers to the resume switch of a
+  // generator. They allow us to model a single resume jump as several switch
+  // statements across loop headers, keeping those loop headers reducible,
+  // without having to merge the "executing" environments of the generator into
+  // the "resuming" ones. They are indexed by the suspend id of the resume.
+  ZoneMap<int, Environment*> generator_merge_environments_;
+
   // Exception handlers currently entered by the iteration.
   ZoneStack<ExceptionHandler> exception_handlers_;
   int current_exception_handler_;
diff --git a/deps/v8/src/compiler/c-linkage.cc b/deps/v8/src/compiler/c-linkage.cc
index 330b19fac3d..02b6f5fb3d9 100644
--- a/deps/v8/src/compiler/c-linkage.cc
+++ b/deps/v8/src/compiler/c-linkage.cc
@@ -165,8 +165,7 @@ CallDescriptor* Linkage::GetSimplifiedCDescriptor(
 
 #ifdef UNSUPPORTED_C_LINKAGE
   // This method should not be called on unknown architectures.
-  V8_Fatal(__FILE__, __LINE__,
-           "requested C call descriptor on unsupported architecture");
+  FATAL("requested C call descriptor on unsupported architecture");
   return nullptr;
 #endif
 
diff --git a/deps/v8/src/compiler/code-assembler.cc b/deps/v8/src/compiler/code-assembler.cc
index 071f8952db6..01e8d54707c 100644
--- a/deps/v8/src/compiler/code-assembler.cc
+++ b/deps/v8/src/compiler/code-assembler.cc
@@ -6,6 +6,7 @@
 
 #include <ostream>
 
+#include "src/builtins/constants-table-builder.h"
 #include "src/code-factory.h"
 #include "src/compiler/graph.h"
 #include "src/compiler/instruction-selector.h"
@@ -20,6 +21,7 @@
 #include "src/machine-type.h"
 #include "src/macro-assembler.h"
 #include "src/objects-inl.h"
+#include "src/snapshot/serializer-common.h"
 #include "src/utils.h"
 #include "src/zone/zone.h"
 
@@ -56,36 +58,41 @@ static_assert(
 
 CodeAssemblerState::CodeAssemblerState(
     Isolate* isolate, Zone* zone, const CallInterfaceDescriptor& descriptor,
-    Code::Kind kind, const char* name, size_t result_size, uint32_t stub_key,
-    int32_t builtin_index)
+    Code::Kind kind, const char* name,
+    PoisoningMitigationLevel poisoning_enabled, size_t result_size,
+    uint32_t stub_key, int32_t builtin_index)
+    // TODO(rmcilroy): Should we use Linkage::GetBytecodeDispatchDescriptor for
+    // bytecode handlers?
     : CodeAssemblerState(
           isolate, zone,
           Linkage::GetStubCallDescriptor(
               isolate, zone, descriptor, descriptor.GetStackParameterCount(),
               CallDescriptor::kNoFlags, Operator::kNoProperties,
               MachineType::AnyTagged(), result_size),
-          kind, name, stub_key, builtin_index) {}
+          kind, name, poisoning_enabled, stub_key, builtin_index) {}
 
-CodeAssemblerState::CodeAssemblerState(Isolate* isolate, Zone* zone,
-                                       int parameter_count, Code::Kind kind,
-                                       const char* name, int32_t builtin_index)
+CodeAssemblerState::CodeAssemblerState(
+    Isolate* isolate, Zone* zone, int parameter_count, Code::Kind kind,
+    const char* name, PoisoningMitigationLevel poisoning_enabled,
+    int32_t builtin_index)
     : CodeAssemblerState(
           isolate, zone,
           Linkage::GetJSCallDescriptor(zone, false, parameter_count,
                                        kind == Code::BUILTIN
                                            ? CallDescriptor::kPushArgumentCount
                                            : CallDescriptor::kNoFlags),
-          kind, name, 0, builtin_index) {}
+          kind, name, poisoning_enabled, 0, builtin_index) {}
 
-CodeAssemblerState::CodeAssemblerState(Isolate* isolate, Zone* zone,
-                                       CallDescriptor* call_descriptor,
-                                       Code::Kind kind, const char* name,
-                                       uint32_t stub_key, int32_t builtin_index)
+CodeAssemblerState::CodeAssemblerState(
+    Isolate* isolate, Zone* zone, CallDescriptor* call_descriptor,
+    Code::Kind kind, const char* name,
+    PoisoningMitigationLevel poisoning_enabled, uint32_t stub_key,
+    int32_t builtin_index)
     : raw_assembler_(new RawMachineAssembler(
           isolate, new (zone) Graph(zone), call_descriptor,
           MachineType::PointerRepresentation(),
           InstructionSelector::SupportedMachineOperatorFlags(),
-          InstructionSelector::AlignmentRequirements())),
+          InstructionSelector::AlignmentRequirements(), poisoning_enabled)),
       kind_(kind),
       name_(name),
       stub_key_(stub_key),
@@ -171,6 +178,10 @@ bool CodeAssembler::Word32ShiftIsSafe() const {
   return raw_assembler()->machine()->Word32ShiftIsSafe();
 }
 
+PoisoningMitigationLevel CodeAssembler::poisoning_enabled() const {
+  return raw_assembler()->poisoning_enabled();
+}
+
 // static
 Handle<Code> CodeAssembler::GenerateCode(CodeAssemblerState* state) {
   DCHECK(!state->code_generated_);
@@ -185,7 +196,7 @@ Handle<Code> CodeAssembler::GenerateCode(CodeAssemblerState* state) {
   Handle<Code> code = Pipeline::GenerateCodeForCodeStub(
       rasm->isolate(), rasm->call_descriptor(), rasm->graph(), schedule,
       state->kind_, state->name_, state->stub_key_, state->builtin_index_,
-      should_optimize_jumps ? &jump_opt : nullptr);
+      should_optimize_jumps ? &jump_opt : nullptr, rasm->poisoning_enabled());
 
   if (jump_opt.is_optimizable()) {
     jump_opt.set_optimizing();
@@ -194,7 +205,7 @@ Handle<Code> CodeAssembler::GenerateCode(CodeAssemblerState* state) {
     code = Pipeline::GenerateCodeForCodeStub(
         rasm->isolate(), rasm->call_descriptor(), rasm->graph(), schedule,
         state->kind_, state->name_, state->stub_key_, state->builtin_index_,
-        &jump_opt);
+        &jump_opt, rasm->poisoning_enabled());
   }
 
   state->code_generated_ = true;
@@ -232,6 +243,59 @@ bool CodeAssembler::IsIntPtrAbsWithOverflowSupported() const {
                 : IsInt32AbsWithOverflowSupported();
 }
 
+#ifdef V8_EMBEDDED_BUILTINS
+TNode<HeapObject> CodeAssembler::LookupConstant(Handle<HeapObject> object) {
+  DCHECK(isolate()->serializer_enabled());
+
+  // Ensure the given object is in the builtins constants table and fetch its
+  // index.
+  BuiltinsConstantsTableBuilder* builder =
+      isolate()->builtins_constants_table_builder();
+  uint32_t index = builder->AddObject(object);
+
+  // The builtins constants table is loaded through the root register on all
+  // supported platforms. This is checked by the
+  // VerifyBuiltinsIsolateIndependence cctest, which disallows embedded objects
+  // in isolate-independent builtins.
+  DCHECK(isolate()->heap()->RootCanBeTreatedAsConstant(
+      Heap::kBuiltinsConstantsTableRootIndex));
+  TNode<FixedArray> builtins_constants_table = UncheckedCast<FixedArray>(
+      LoadRoot(Heap::kBuiltinsConstantsTableRootIndex));
+
+  // Generate the lookup.
+  const int32_t header_size = FixedArray::kHeaderSize - kHeapObjectTag;
+  TNode<IntPtrT> offset = IntPtrConstant(header_size + kPointerSize * index);
+  return UncheckedCast<HeapObject>(
+      Load(MachineType::AnyTagged(), builtins_constants_table, offset));
+}
+
+// External references are stored in the external reference table.
+TNode<ExternalReference> CodeAssembler::LookupExternalReference(
+    ExternalReference reference) {
+  DCHECK(isolate()->serializer_enabled());
+
+  // Encode as an index into the external reference table stored on the isolate.
+
+  ExternalReferenceEncoder encoder(isolate());
+  ExternalReferenceEncoder::Value v = encoder.Encode(reference.address());
+  CHECK(!v.is_from_api());
+  uint32_t index = v.index();
+
+  // Generate code to load from the external reference table.
+
+  const intptr_t roots_to_external_reference_offset =
+      Heap::roots_to_external_reference_table_offset()
+#ifdef V8_TARGET_ARCH_X64
+      - kRootRegisterBias
+#endif
+      + ExternalReferenceTable::OffsetOfEntry(index);
+
+  return UncheckedCast<ExternalReference>(
+      Load(MachineType::Pointer(), LoadRootsPointer(),
+           IntPtrConstant(roots_to_external_reference_offset)));
+}
+#endif  // V8_EMBEDDED_BUILTINS
+
 TNode<Int32T> CodeAssembler::Int32Constant(int32_t value) {
   return UncheckedCast<Int32T>(raw_assembler()->Int32Constant(value));
 }
@@ -264,12 +328,23 @@ TNode<Smi> CodeAssembler::SmiConstant(int value) {
 
 TNode<HeapObject> CodeAssembler::UntypedHeapConstant(
     Handle<HeapObject> object) {
+#ifdef V8_EMBEDDED_BUILTINS
+  // Root constants are simply loaded from the root list, while non-root
+  // constants must be looked up from the builtins constants table.
+  if (ShouldLoadConstantsFromRootList()) {
+    Heap::RootListIndex root_index;
+    if (!isolate()->heap()->IsRootHandle(object, &root_index)) {
+      return LookupConstant(object);
+    }
+  }
+#endif  // V8_EMBEDDED_BUILTINS
   return UncheckedCast<HeapObject>(raw_assembler()->HeapConstant(object));
 }
 
 TNode<String> CodeAssembler::StringConstant(const char* str) {
-  return UncheckedCast<String>(
-      HeapConstant(factory()->NewStringFromAsciiChecked(str, TENURED)));
+  Handle<String> internalized_string =
+      factory()->InternalizeOneByteString(OneByteVector(str));
+  return UncheckedCast<String>(HeapConstant(internalized_string));
 }
 
 TNode<Oddball> CodeAssembler::BooleanConstant(bool value) {
@@ -278,6 +353,11 @@ TNode<Oddball> CodeAssembler::BooleanConstant(bool value) {
 
 TNode<ExternalReference> CodeAssembler::ExternalConstant(
     ExternalReference address) {
+#ifdef V8_EMBEDDED_BUILTINS
+  if (ShouldLoadConstantsFromRootList()) {
+    return LookupExternalReference(address);
+  }
+#endif  // V8_EMBEDDED_BUILTINS
   return UncheckedCast<ExternalReference>(
       raw_assembler()->ExternalConstant(address));
 }
@@ -338,10 +418,10 @@ Node* CodeAssembler::Parameter(int value) {
 }
 
 TNode<Context> CodeAssembler::GetJSContextParameter() {
-  CallDescriptor* desc = raw_assembler()->call_descriptor();
-  DCHECK(desc->IsJSFunctionCall());
+  auto call_descriptor = raw_assembler()->call_descriptor();
+  DCHECK(call_descriptor->IsJSFunctionCall());
   return CAST(Parameter(Linkage::GetJSCallContextParamIndex(
-      static_cast<int>(desc->JSParameterCount()))));
+      static_cast<int>(call_descriptor->JSParameterCount()))));
 }
 
 void CodeAssembler::Return(SloppyTNode<Object> value) {
@@ -418,10 +498,24 @@ Node* CodeAssembler::LoadParentFramePointer() {
   return raw_assembler()->LoadParentFramePointer();
 }
 
+TNode<IntPtrT> CodeAssembler::LoadRootsPointer() {
+  return UncheckedCast<IntPtrT>(raw_assembler()->LoadRootsPointer());
+}
+
 Node* CodeAssembler::LoadStackPointer() {
   return raw_assembler()->LoadStackPointer();
 }
 
+TNode<Object> CodeAssembler::PoisonOnSpeculationTagged(
+    SloppyTNode<Object> value) {
+  return UncheckedCast<Object>(
+      raw_assembler()->PoisonOnSpeculationTagged(value));
+}
+
+TNode<WordT> CodeAssembler::PoisonOnSpeculationWord(SloppyTNode<WordT> value) {
+  return UncheckedCast<WordT>(raw_assembler()->PoisonOnSpeculationWord(value));
+}
+
 #define DEFINE_CODE_ASSEMBLER_BINARY_OP(name, ResType, Arg1Type, Arg2Type) \
   TNode<ResType> CodeAssembler::name(SloppyTNode<Arg1Type> a,              \
                                      SloppyTNode<Arg2Type> b) {            \
@@ -498,6 +592,10 @@ TNode<WordT> CodeAssembler::WordShr(SloppyTNode<WordT> value, int shift) {
   return (shift != 0) ? WordShr(value, IntPtrConstant(shift)) : value;
 }
 
+TNode<WordT> CodeAssembler::WordSar(SloppyTNode<WordT> value, int shift) {
+  return (shift != 0) ? WordSar(value, IntPtrConstant(shift)) : value;
+}
+
 TNode<Word32T> CodeAssembler::Word32Shr(SloppyTNode<Word32T> value, int shift) {
   return (shift != 0) ? Word32Shr(value, Int32Constant(shift)) : value;
 }
@@ -853,12 +951,14 @@ Node* CodeAssembler::RoundIntPtrToFloat64(Node* value) {
 CODE_ASSEMBLER_UNARY_OP_LIST(DEFINE_CODE_ASSEMBLER_UNARY_OP)
 #undef DEFINE_CODE_ASSEMBLER_UNARY_OP
 
-Node* CodeAssembler::Load(MachineType rep, Node* base) {
-  return raw_assembler()->Load(rep, base);
+Node* CodeAssembler::Load(MachineType rep, Node* base,
+                          LoadSensitivity needs_poisoning) {
+  return raw_assembler()->Load(rep, base, needs_poisoning);
 }
 
-Node* CodeAssembler::Load(MachineType rep, Node* base, Node* offset) {
-  return raw_assembler()->Load(rep, base, offset);
+Node* CodeAssembler::Load(MachineType rep, Node* base, Node* offset,
+                          LoadSensitivity needs_poisoning) {
+  return raw_assembler()->Load(rep, base, offset, needs_poisoning);
 }
 
 Node* CodeAssembler::AtomicLoad(MachineType rep, Node* base, Node* offset) {
@@ -950,13 +1050,13 @@ Node* CodeAssembler::Projection(int index, Node* value) {
 
 void CodeAssembler::GotoIfException(Node* node, Label* if_exception,
                                     Variable* exception_var) {
-  DCHECK(!node->op()->HasProperty(Operator::kNoThrow));
-
   if (if_exception == nullptr) {
     // If no handler is supplied, don't add continuations
     return;
   }
 
+  DCHECK(!node->op()->HasProperty(Operator::kNoThrow));
+
   Label success(this), exception(this, Label::kDeferred);
   success.MergeVariables();
   exception.MergeVariables();
@@ -979,10 +1079,10 @@ TNode<Object> CodeAssembler::CallRuntimeImpl(Runtime::FunctionId function,
                                              SloppyTNode<Object> context,
                                              TArgs... args) {
   int argc = static_cast<int>(sizeof...(args));
-  CallDescriptor* desc = Linkage::GetRuntimeCallDescriptor(
+  auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
       zone(), function, argc, Operator::kNoProperties,
       CallDescriptor::kNoFlags);
-  int return_count = static_cast<int>(desc->ReturnCount());
+  int return_count = static_cast<int>(call_descriptor->ReturnCount());
 
   Node* centry =
       HeapConstant(CodeFactory::RuntimeCEntry(isolate(), return_count));
@@ -992,7 +1092,8 @@ TNode<Object> CodeAssembler::CallRuntimeImpl(Runtime::FunctionId function,
   Node* nodes[] = {centry, args..., ref, arity, context};
 
   CallPrologue();
-  Node* return_value = raw_assembler()->CallN(desc, arraysize(nodes), nodes);
+  Node* return_value =
+      raw_assembler()->CallN(call_descriptor, arraysize(nodes), nodes);
   CallEpilogue();
   return UncheckedCast<Object>(return_value);
 }
@@ -1009,10 +1110,10 @@ TNode<Object> CodeAssembler::TailCallRuntimeImpl(Runtime::FunctionId function,
                                                  SloppyTNode<Object> context,
                                                  TArgs... args) {
   int argc = static_cast<int>(sizeof...(args));
-  CallDescriptor* desc = Linkage::GetRuntimeCallDescriptor(
+  auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
       zone(), function, argc, Operator::kNoProperties,
       CallDescriptor::kNoFlags);
-  int return_count = static_cast<int>(desc->ReturnCount());
+  int return_count = static_cast<int>(call_descriptor->ReturnCount());
 
   Node* centry =
       HeapConstant(CodeFactory::RuntimeCEntry(isolate(), return_count));
@@ -1022,7 +1123,7 @@ TNode<Object> CodeAssembler::TailCallRuntimeImpl(Runtime::FunctionId function,
   Node* nodes[] = {centry, args..., ref, arity, context};
 
   return UncheckedCast<Object>(
-      raw_assembler()->TailCallN(desc, arraysize(nodes), nodes));
+      raw_assembler()->TailCallN(call_descriptor, arraysize(nodes), nodes));
 }
 
 // Instantiate TailCallRuntime() for argument counts used by CSA-generated code
@@ -1061,14 +1162,15 @@ Node* CodeAssembler::CallStubN(const CallInterfaceDescriptor& descriptor,
   // Extra arguments not mentioned in the descriptor are passed on the stack.
   int stack_parameter_count = argc - descriptor.GetRegisterParameterCount();
   DCHECK_LE(descriptor.GetStackParameterCount(), stack_parameter_count);
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), descriptor, stack_parameter_count,
       CallDescriptor::kNoFlags, Operator::kNoProperties,
       MachineType::AnyTagged(), result_size,
       pass_context ? Linkage::kPassContext : Linkage::kNoContext);
 
   CallPrologue();
-  Node* return_value = raw_assembler()->CallN(desc, input_count, inputs);
+  Node* return_value =
+      raw_assembler()->CallN(call_descriptor, input_count, inputs);
   CallEpilogue();
   return return_value;
 }
@@ -1079,14 +1181,14 @@ Node* CodeAssembler::TailCallStubImpl(const CallInterfaceDescriptor& descriptor,
                                       TArgs... args) {
   DCHECK_EQ(descriptor.GetParameterCount(), sizeof...(args));
   size_t result_size = 1;
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), descriptor, descriptor.GetStackParameterCount(),
       CallDescriptor::kNoFlags, Operator::kNoProperties,
       MachineType::AnyTagged(), result_size);
 
   Node* nodes[] = {target, args..., context};
   CHECK_EQ(descriptor.GetParameterCount() + 2, arraysize(nodes));
-  return raw_assembler()->TailCallN(desc, arraysize(nodes), nodes);
+  return raw_assembler()->TailCallN(call_descriptor, arraysize(nodes), nodes);
 }
 
 // Instantiate TailCallStub() for argument counts used by CSA-generated code
@@ -1105,13 +1207,13 @@ Node* CodeAssembler::TailCallStubThenBytecodeDispatch(
   int stack_parameter_count =
       sizeof...(args) - descriptor.GetRegisterParameterCount();
   DCHECK_LE(descriptor.GetStackParameterCount(), stack_parameter_count);
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), descriptor, stack_parameter_count,
       CallDescriptor::kNoFlags, Operator::kNoProperties,
       MachineType::AnyTagged(), 0);
 
   Node* nodes[] = {target, args..., context};
-  return raw_assembler()->TailCallN(desc, arraysize(nodes), nodes);
+  return raw_assembler()->TailCallN(call_descriptor, arraysize(nodes), nodes);
 }
 
 // Instantiate TailCallJSAndBytecodeDispatch() for argument counts used by
@@ -1127,12 +1229,12 @@ template <class... TArgs>
 Node* CodeAssembler::TailCallBytecodeDispatch(
     const CallInterfaceDescriptor& descriptor, Node* target, TArgs... args) {
   DCHECK_EQ(descriptor.GetParameterCount(), sizeof...(args));
-  CallDescriptor* desc = Linkage::GetBytecodeDispatchCallDescriptor(
+  auto call_descriptor = Linkage::GetBytecodeDispatchCallDescriptor(
       isolate(), zone(), descriptor, descriptor.GetStackParameterCount());
 
   Node* nodes[] = {target, args...};
   CHECK_EQ(descriptor.GetParameterCount() + 1, arraysize(nodes));
-  return raw_assembler()->TailCallN(desc, arraysize(nodes), nodes);
+  return raw_assembler()->TailCallN(call_descriptor, arraysize(nodes), nodes);
 }
 
 // Instantiate TailCallBytecodeDispatch() for argument counts used by
@@ -1143,8 +1245,8 @@ template V8_EXPORT_PRIVATE Node* CodeAssembler::TailCallBytecodeDispatch(
 
 Node* CodeAssembler::CallCFunctionN(Signature<MachineType>* signature,
                                     int input_count, Node* const* inputs) {
-  CallDescriptor* desc = Linkage::GetSimplifiedCDescriptor(zone(), signature);
-  return raw_assembler()->CallN(desc, input_count, inputs);
+  auto call_descriptor = Linkage::GetSimplifiedCDescriptor(zone(), signature);
+  return raw_assembler()->CallN(call_descriptor, input_count, inputs);
 }
 
 Node* CodeAssembler::CallCFunction1(MachineType return_type,
@@ -1593,3 +1695,15 @@ Smi* CheckObjectType(Object* value, Smi* type, String* location) {
 
 }  // namespace internal
 }  // namespace v8
+
+#undef REPEAT_1_TO_2
+#undef REPEAT_1_TO_3
+#undef REPEAT_1_TO_4
+#undef REPEAT_1_TO_5
+#undef REPEAT_1_TO_6
+#undef REPEAT_1_TO_7
+#undef REPEAT_1_TO_8
+#undef REPEAT_1_TO_9
+#undef REPEAT_1_TO_10
+#undef REPEAT_1_TO_11
+#undef REPEAT_1_TO_12
diff --git a/deps/v8/src/compiler/code-assembler.h b/deps/v8/src/compiler/code-assembler.h
index 9f0d463dc1a..13ad044303a 100644
--- a/deps/v8/src/compiler/code-assembler.h
+++ b/deps/v8/src/compiler/code-assembler.h
@@ -18,6 +18,7 @@
 #include "src/heap/heap.h"
 #include "src/machine-type.h"
 #include "src/objects/data-handler.h"
+#include "src/objects/map.h"
 #include "src/runtime/runtime.h"
 #include "src/zone/zone-containers.h"
 
@@ -31,6 +32,11 @@ class JSCollection;
 class JSWeakCollection;
 class JSWeakMap;
 class JSWeakSet;
+class PromiseCapability;
+class PromiseFulfillReactionJobTask;
+class PromiseReaction;
+class PromiseReactionJobTask;
+class PromiseRejectReactionJobTask;
 class Factory;
 class Zone;
 
@@ -196,7 +202,9 @@ enum class ObjectType {
 #undef ENUM_STRUCT_ELEMENT
 
 class AccessCheckNeeded;
+class BigIntWrapper;
 class ClassBoilerplate;
+class BooleanWrapper;
 class CompilationCacheTable;
 class Constructor;
 class Filler;
@@ -208,8 +216,11 @@ class JSSloppyArgumentsObject;
 class MapCache;
 class MutableHeapNumber;
 class NativeContext;
+class NumberWrapper;
+class ScriptWrapper;
 class SloppyArgumentsElements;
 class StringWrapper;
+class SymbolWrapper;
 class Undetectable;
 class UniqueName;
 class WasmMemoryObject;
@@ -404,6 +415,7 @@ class SloppyTNode : public TNode<T> {
   V(IntPtrEqual, BoolT, WordT, WordT)                     \
   V(Uint32LessThan, BoolT, Word32T, Word32T)              \
   V(Uint32LessThanOrEqual, BoolT, Word32T, Word32T)       \
+  V(Uint32GreaterThan, BoolT, Word32T, Word32T)           \
   V(Uint32GreaterThanOrEqual, BoolT, Word32T, Word32T)    \
   V(UintPtrLessThan, BoolT, WordT, WordT)                 \
   V(UintPtrLessThanOrEqual, BoolT, WordT, WordT)          \
@@ -491,6 +503,7 @@ TNode<Float64T> Float64Add(TNode<Float64T> a, TNode<Float64T> b);
   V(Float64RoundTruncate, Float64T, Float64T)                  \
   V(Word32Clz, Int32T, Word32T)                                \
   V(Word32Not, Word32T, Word32T)                               \
+  V(WordNot, WordT, WordT)                                     \
   V(Int32AbsWithOverflow, PAIR_TYPE(Int32T, BoolT), Int32T)    \
   V(Int64AbsWithOverflow, PAIR_TYPE(Int64T, BoolT), Int64T)    \
   V(IntPtrAbsWithOverflow, PAIR_TYPE(IntPtrT, BoolT), IntPtrT) \
@@ -543,7 +556,7 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   // Base Assembler
   // ===========================================================================
 
-  template <class PreviousType>
+  template <class PreviousType, bool FromTyped>
   class CheckedNode {
    public:
 #ifdef DEBUG
@@ -561,6 +574,10 @@ class V8_EXPORT_PRIVATE CodeAssembler {
       static_assert(std::is_convertible<TNode<A>, TNode<Object>>::value,
                     "Coercion to untagged values cannot be "
                     "checked.");
+      static_assert(
+          !FromTyped ||
+              !std::is_convertible<TNode<PreviousType>, TNode<A>>::value,
+          "Unnecessary CAST: types are convertible.");
 #ifdef DEBUG
       if (FLAG_debug_code) {
         Node* function = code_assembler_->ExternalConstant(
@@ -610,13 +627,13 @@ class V8_EXPORT_PRIVATE CodeAssembler {
     return TNode<T>::UncheckedCast(value);
   }
 
-  CheckedNode<Object> Cast(Node* value, const char* location) {
-    return CheckedNode<Object>(value, this, location);
+  CheckedNode<Object, false> Cast(Node* value, const char* location) {
+    return {value, this, location};
   }
 
   template <class T>
-  CheckedNode<T> Cast(TNode<T> value, const char* location) {
-    return CheckedNode<T>(value, this, location);
+  CheckedNode<T, true> Cast(TNode<T> value, const char* location) {
+    return {value, this, location};
   }
 
 #ifdef DEBUG
@@ -628,6 +645,18 @@ class V8_EXPORT_PRIVATE CodeAssembler {
 #define CAST(x) Cast(x, "")
 #endif
 
+#ifdef V8_EMBEDDED_BUILTINS
+  // Off-heap builtins cannot embed constants within the code object itself,
+  // and thus need to load them from the root list.
+  bool ShouldLoadConstantsFromRootList() const {
+    return (isolate()->serializer_enabled() &&
+            isolate()->builtins_constants_table_builder() != nullptr);
+  }
+
+  TNode<HeapObject> LookupConstant(Handle<HeapObject> object);
+  TNode<ExternalReference> LookupExternalReference(ExternalReference reference);
+#endif
+
   // Constants.
   TNode<Int32T> Int32Constant(int32_t value);
   TNode<Int64T> Int64Constant(int64_t value);
@@ -651,6 +680,12 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   TNode<ExternalReference> ExternalConstant(ExternalReference address);
   TNode<Float64T> Float64Constant(double value);
   TNode<HeapNumber> NaNConstant();
+  TNode<BoolT> Int32TrueConstant() {
+    return ReinterpretCast<BoolT>(Int32Constant(1));
+  }
+  TNode<BoolT> Int32FalseConstant() {
+    return ReinterpretCast<BoolT>(Int32Constant(0));
+  }
 
   bool ToInt32Constant(Node* node, int32_t& out_value);
   bool ToInt64Constant(Node* node, int64_t& out_value);
@@ -699,18 +734,27 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   Node* LoadFramePointer();
   Node* LoadParentFramePointer();
 
+  // Access to the roots pointer.
+  TNode<IntPtrT> LoadRootsPointer();
+
   // Access to the stack pointer
   Node* LoadStackPointer();
 
+  // Poison |value| on speculative paths.
+  TNode<Object> PoisonOnSpeculationTagged(SloppyTNode<Object> value);
+  TNode<WordT> PoisonOnSpeculationWord(SloppyTNode<WordT> value);
+
   // Load raw memory location.
-  Node* Load(MachineType rep, Node* base);
+  Node* Load(MachineType rep, Node* base,
+             LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);
   template <class Type>
   TNode<Type> Load(MachineType rep, TNode<RawPtr<Type>> base) {
     DCHECK(
         IsSubtype(rep.representation(), MachineRepresentationOf<Type>::value));
     return UncheckedCast<Type>(Load(rep, static_cast<Node*>(base)));
   }
-  Node* Load(MachineType rep, Node* base, Node* offset);
+  Node* Load(MachineType rep, Node* base, Node* offset,
+             LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);
   Node* AtomicLoad(MachineType rep, Node* base, Node* offset);
 
   // Load a value from the root array.
@@ -818,6 +862,7 @@ class V8_EXPORT_PRIVATE CodeAssembler {
 
   TNode<WordT> WordShl(SloppyTNode<WordT> value, int shift);
   TNode<WordT> WordShr(SloppyTNode<WordT> value, int shift);
+  TNode<WordT> WordSar(SloppyTNode<WordT> value, int shift);
   TNode<IntPtrT> WordShr(TNode<IntPtrT> value, int shift) {
     return UncheckedCast<IntPtrT>(WordShr(static_cast<Node*>(value), shift));
   }
@@ -1065,6 +1110,7 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   void UnregisterCallGenerationCallbacks();
 
   bool Word32ShiftIsSafe() const;
+  PoisoningMitigationLevel poisoning_enabled() const;
 
  private:
   // These two don't have definitions and are here only for catching use cases
@@ -1136,23 +1182,17 @@ class TypedCodeAssemblerVariable : public CodeAssemblerVariable {
                               initial_value) {}
 #endif  // DEBUG
 
-  template <class U, class = typename std::enable_if<
-                         std::is_convertible<TNode<T>, TNode<U>>::value>::type>
-  operator TNode<U>() const {
-    return TNode<T>::UncheckedCast(value());
+  TNode<T> value() const {
+    return TNode<T>::UncheckedCast(CodeAssemblerVariable::value());
   }
-  template <class U, class = typename std::enable_if<
-                         std::is_convertible<TNode<T>, TNode<U>>::value>::type>
-  operator SloppyTNode<U>() const {
-    return value();
-  }
-  operator Node*() const { return value(); }
 
   void operator=(TNode<T> value) { Bind(value); }
+  void operator=(const TypedCodeAssemblerVariable<T>& variable) {
+    Bind(variable.value());
+  }
 
  private:
   using CodeAssemblerVariable::Bind;
-  using CodeAssemblerVariable::value;
 };
 
 class CodeAssemblerLabel {
@@ -1215,13 +1255,15 @@ class V8_EXPORT_PRIVATE CodeAssemblerState {
   // TODO(rmcilroy): move result_size to the CallInterfaceDescriptor.
   CodeAssemblerState(Isolate* isolate, Zone* zone,
                      const CallInterfaceDescriptor& descriptor, Code::Kind kind,
-                     const char* name, size_t result_size = 1,
-                     uint32_t stub_key = 0,
+                     const char* name,
+                     PoisoningMitigationLevel poisoning_enabled,
+                     size_t result_size = 1, uint32_t stub_key = 0,
                      int32_t builtin_index = Builtins::kNoBuiltinId);
 
   // Create with JSCall linkage.
   CodeAssemblerState(Isolate* isolate, Zone* zone, int parameter_count,
                      Code::Kind kind, const char* name,
+                     PoisoningMitigationLevel poisoning_enabled,
                      int32_t builtin_index = Builtins::kNoBuiltinId);
 
   ~CodeAssemblerState();
@@ -1243,8 +1285,9 @@ class V8_EXPORT_PRIVATE CodeAssemblerState {
 
   CodeAssemblerState(Isolate* isolate, Zone* zone,
                      CallDescriptor* call_descriptor, Code::Kind kind,
-                     const char* name, uint32_t stub_key,
-                     int32_t builtin_index);
+                     const char* name,
+                     PoisoningMitigationLevel poisoning_enabled,
+                     uint32_t stub_key, int32_t builtin_index);
 
   std::unique_ptr<RawMachineAssembler> raw_assembler_;
   Code::Kind kind_;
diff --git a/deps/v8/src/compiler/code-generator-impl.h b/deps/v8/src/compiler/code-generator-impl.h
index c6d3174d8c6..1298657774c 100644
--- a/deps/v8/src/compiler/code-generator-impl.h
+++ b/deps/v8/src/compiler/code-generator-impl.h
@@ -215,8 +215,13 @@ class OutOfLineCode : public ZoneObject {
   OutOfLineCode* const next_;
 };
 
+inline bool HasCallDescriptorFlag(Instruction* instr,
+                                  CallDescriptor::Flag flag) {
+  return MiscField::decode(instr->opcode()) & flag;
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_COMPILER_CODE_GENERATOR_IMPL_H
+#endif  // V8_COMPILER_CODE_GENERATOR_IMPL_H_
diff --git a/deps/v8/src/compiler/code-generator.cc b/deps/v8/src/compiler/code-generator.cc
index 0fb38e5933c..510576d299f 100644
--- a/deps/v8/src/compiler/code-generator.cc
+++ b/deps/v8/src/compiler/code-generator.cc
@@ -42,7 +42,8 @@ CodeGenerator::CodeGenerator(
     InstructionSequence* code, CompilationInfo* info, Isolate* isolate,
     base::Optional<OsrHelper> osr_helper, int start_source_position,
     JumpOptimizationInfo* jump_opt,
-    std::vector<trap_handler::ProtectedInstructionData>* protected_instructions)
+    std::vector<trap_handler::ProtectedInstructionData>* protected_instructions,
+    PoisoningMitigationLevel poisoning_enabled)
     : zone_(codegen_zone),
       isolate_(isolate),
       frame_access_state_(nullptr),
@@ -63,6 +64,7 @@ CodeGenerator::CodeGenerator(
       deoptimization_literals_(zone()),
       inlined_function_count_(0),
       translations_(zone()),
+      handler_table_offset_(0),
       last_lazy_deopt_pc_(0),
       caller_registers_saved_(false),
       jump_tables_(nullptr),
@@ -72,7 +74,8 @@ CodeGenerator::CodeGenerator(
       optimized_out_literal_id_(-1),
       source_position_table_builder_(info->SourcePositionRecordingMode()),
       protected_instructions_(protected_instructions),
-      result_(kSuccess) {
+      result_(kSuccess),
+      poisoning_enabled_(poisoning_enabled) {
   for (int i = 0; i < code->InstructionBlockCount(); ++i) {
     new (&labels_[i]) Label;
   }
@@ -148,16 +151,25 @@ void CodeGenerator::AssembleCode() {
     ProfileEntryHookStub::MaybeCallEntryHookDelayed(tasm(), zone());
   }
 
-  // TODO(jupvfranco): This should be the first thing in the code,
-  // or otherwise MaybeCallEntryHookDelayed may happen twice (for
-  // optimized and deoptimized code).
-  // We want to bailout only from JS functions, which are the only ones
+  // Check that {kJavaScriptCallCodeStartRegister} has been set correctly.
+  if (FLAG_debug_code & (info->code_kind() == Code::OPTIMIZED_FUNCTION ||
+                         info->code_kind() == Code::BYTECODE_HANDLER)) {
+    tasm()->RecordComment("-- Prologue: check code start register --");
+    AssembleCodeStartRegisterCheck();
+  }
+
+  // TODO(jupvfranco): This should be the first thing in the code, otherwise
+  // MaybeCallEntryHookDelayed may happen twice (for optimized and deoptimized
+  // code). We want to bailout only from JS functions, which are the only ones
   // that are optimized.
   if (info->IsOptimizing()) {
     DCHECK(linkage()->GetIncomingDescriptor()->IsJSFunctionCall());
+    tasm()->RecordComment("-- Prologue: check for deoptimization --");
     BailoutIfDeoptimized();
   }
 
+  InitializeSpeculationPoison();
+
   // Define deoptimization literals for all inlined functions.
   DCHECK_EQ(0u, deoptimization_literals_.size());
   for (CompilationInfo::InlinedFunctionHolder& inlined :
@@ -218,6 +230,9 @@ void CodeGenerator::AssembleCode() {
       frame_access_state()->MarkHasFrame(block->needs_frame());
 
       tasm()->bind(GetLabel(current_block_));
+
+      TryInsertBranchPoisoning(block);
+
       if (block->must_construct_frame()) {
         AssembleConstructFrame();
         // We need to setup the root register after we assemble the prologue, to
@@ -287,26 +302,54 @@ void CodeGenerator::AssembleCode() {
   unwinding_info_writer_.Finish(tasm()->pc_offset());
 
   safepoints()->Emit(tasm(), frame()->GetTotalFrameSlotCount());
-  result_ = kSuccess;
-}
-
-Handle<ByteArray> CodeGenerator::GetSourcePositionTable() {
-  return source_position_table_builder_.ToSourcePositionTable(isolate());
-}
 
-MaybeHandle<HandlerTable> CodeGenerator::GetHandlerTable() const {
+  // Emit the exception handler table.
   if (!handlers_.empty()) {
-    Handle<HandlerTable> table =
-        Handle<HandlerTable>::cast(isolate()->factory()->NewFixedArray(
-            HandlerTable::LengthForReturn(static_cast<int>(handlers_.size())),
-            TENURED));
+    handler_table_offset_ = HandlerTable::EmitReturnTableStart(
+        tasm(), static_cast<int>(handlers_.size()));
     for (size_t i = 0; i < handlers_.size(); ++i) {
-      table->SetReturnOffset(static_cast<int>(i), handlers_[i].pc_offset);
-      table->SetReturnHandler(static_cast<int>(i), handlers_[i].handler->pos());
+      HandlerTable::EmitReturnEntry(tasm(), handlers_[i].pc_offset,
+                                    handlers_[i].handler->pos());
     }
-    return table;
   }
-  return {};
+
+  result_ = kSuccess;
+}
+
+void CodeGenerator::TryInsertBranchPoisoning(const InstructionBlock* block) {
+  // See if our predecessor was a basic block terminated by a branch_and_poison
+  // instruction. If yes, then perform the masking based on the flags.
+  if (block->PredecessorCount() != 1) return;
+  RpoNumber pred_rpo = (block->predecessors())[0];
+  const InstructionBlock* pred = code()->InstructionBlockAt(pred_rpo);
+  if (pred->code_start() == pred->code_end()) return;
+  Instruction* instr = code()->InstructionAt(pred->code_end() - 1);
+  FlagsMode mode = FlagsModeField::decode(instr->opcode());
+  switch (mode) {
+    case kFlags_branch_and_poison: {
+      BranchInfo branch;
+      RpoNumber target = ComputeBranchInfo(&branch, instr);
+      if (!target.IsValid()) {
+        // Non-trivial branch, add the masking code.
+        FlagsCondition condition = branch.condition;
+        if (branch.false_label == GetLabel(block->rpo_number())) {
+          condition = NegateFlagsCondition(condition);
+        }
+        AssembleBranchPoisoning(condition, instr);
+      }
+      break;
+    }
+    case kFlags_deoptimize_and_poison: {
+      UNREACHABLE();
+      break;
+    }
+    default:
+      break;
+  }
+}
+
+Handle<ByteArray> CodeGenerator::GetSourcePositionTable() {
+  return source_position_table_builder_.ToSourcePositionTable(isolate());
 }
 
 Handle<Code> CodeGenerator::FinalizeCode() {
@@ -315,18 +358,6 @@ Handle<Code> CodeGenerator::FinalizeCode() {
     return Handle<Code>();
   }
 
-  // Allocate exception handler table.
-  Handle<HandlerTable> table = HandlerTable::Empty(isolate());
-  if (!handlers_.empty()) {
-    table = Handle<HandlerTable>::cast(isolate()->factory()->NewFixedArray(
-        HandlerTable::LengthForReturn(static_cast<int>(handlers_.size())),
-        TENURED));
-    for (size_t i = 0; i < handlers_.size(); ++i) {
-      table->SetReturnOffset(static_cast<int>(i), handlers_[i].pc_offset);
-      table->SetReturnHandler(static_cast<int>(i), handlers_[i].handler->pos());
-    }
-  }
-
   // Allocate the source position table.
   Handle<ByteArray> source_positions =
       source_position_table_builder_.ToSourcePositionTable(isolate());
@@ -343,8 +374,9 @@ Handle<Code> CodeGenerator::FinalizeCode() {
 
   Handle<Code> result = isolate()->factory()->NewCode(
       desc, info()->code_kind(), Handle<Object>(), info()->builtin_index(),
-      table, source_positions, deopt_data, kMovable, info()->stub_key(), true,
-      frame()->GetTotalFrameSlotCount(), safepoints()->GetCodeOffset());
+      source_positions, deopt_data, kMovable, info()->stub_key(), true,
+      frame()->GetTotalFrameSlotCount(), safepoints()->GetCodeOffset(),
+      handler_table_offset_);
   isolate()->counters()->total_compiled_code_size()->Increment(
       result->instruction_size());
 
@@ -488,6 +520,77 @@ void CodeGenerator::GetPushCompatibleMoves(Instruction* instr,
   pushes->resize(push_count);
 }
 
+CodeGenerator::MoveType::Type CodeGenerator::MoveType::InferMove(
+    InstructionOperand* source, InstructionOperand* destination) {
+  if (source->IsConstant()) {
+    if (destination->IsAnyRegister()) {
+      return MoveType::kConstantToRegister;
+    } else {
+      DCHECK(destination->IsAnyStackSlot());
+      return MoveType::kConstantToStack;
+    }
+  }
+  DCHECK(LocationOperand::cast(source)->IsCompatible(
+      LocationOperand::cast(destination)));
+  if (source->IsAnyRegister()) {
+    if (destination->IsAnyRegister()) {
+      return MoveType::kRegisterToRegister;
+    } else {
+      DCHECK(destination->IsAnyStackSlot());
+      return MoveType::kRegisterToStack;
+    }
+  } else {
+    DCHECK(source->IsAnyStackSlot());
+    if (destination->IsAnyRegister()) {
+      return MoveType::kStackToRegister;
+    } else {
+      DCHECK(destination->IsAnyStackSlot());
+      return MoveType::kStackToStack;
+    }
+  }
+}
+
+CodeGenerator::MoveType::Type CodeGenerator::MoveType::InferSwap(
+    InstructionOperand* source, InstructionOperand* destination) {
+  DCHECK(LocationOperand::cast(source)->IsCompatible(
+      LocationOperand::cast(destination)));
+  if (source->IsAnyRegister()) {
+    if (destination->IsAnyRegister()) {
+      return MoveType::kRegisterToRegister;
+    } else {
+      DCHECK(destination->IsAnyStackSlot());
+      return MoveType::kRegisterToStack;
+    }
+  } else {
+    DCHECK(source->IsAnyStackSlot());
+    DCHECK(destination->IsAnyStackSlot());
+    return MoveType::kStackToStack;
+  }
+}
+
+RpoNumber CodeGenerator::ComputeBranchInfo(BranchInfo* branch,
+                                           Instruction* instr) {
+  // Assemble a branch after this instruction.
+  InstructionOperandConverter i(this, instr);
+  RpoNumber true_rpo = i.InputRpo(instr->InputCount() - 2);
+  RpoNumber false_rpo = i.InputRpo(instr->InputCount() - 1);
+
+  if (true_rpo == false_rpo) {
+    return true_rpo;
+  }
+  FlagsCondition condition = FlagsConditionField::decode(instr->opcode());
+  if (IsNextInAssemblyOrder(true_rpo)) {
+    // true block is next, can fall through if condition negated.
+    std::swap(true_rpo, false_rpo);
+    condition = NegateFlagsCondition(condition);
+  }
+  branch->condition = condition;
+  branch->true_label = GetLabel(true_rpo);
+  branch->false_label = GetLabel(false_rpo);
+  branch->fallthru = IsNextInAssemblyOrder(false_rpo);
+  return RpoNumber::Invalid();
+}
+
 CodeGenerator::CodeGenResult CodeGenerator::AssembleInstruction(
     Instruction* instr, const InstructionBlock* block) {
   int first_unused_stack_slot;
@@ -513,34 +616,23 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleInstruction(
 
   FlagsCondition condition = FlagsConditionField::decode(instr->opcode());
   switch (mode) {
-    case kFlags_branch: {
-      // Assemble a branch after this instruction.
-      InstructionOperandConverter i(this, instr);
-      RpoNumber true_rpo = i.InputRpo(instr->InputCount() - 2);
-      RpoNumber false_rpo = i.InputRpo(instr->InputCount() - 1);
-
-      if (true_rpo == false_rpo) {
+    case kFlags_branch:
+    case kFlags_branch_and_poison: {
+      BranchInfo branch;
+      RpoNumber target = ComputeBranchInfo(&branch, instr);
+      if (target.IsValid()) {
         // redundant branch.
-        if (!IsNextInAssemblyOrder(true_rpo)) {
-          AssembleArchJump(true_rpo);
+        if (!IsNextInAssemblyOrder(target)) {
+          AssembleArchJump(target);
         }
         return kSuccess;
       }
-      if (IsNextInAssemblyOrder(true_rpo)) {
-        // true block is next, can fall through if condition negated.
-        std::swap(true_rpo, false_rpo);
-        condition = NegateFlagsCondition(condition);
-      }
-      BranchInfo branch;
-      branch.condition = condition;
-      branch.true_label = GetLabel(true_rpo);
-      branch.false_label = GetLabel(false_rpo);
-      branch.fallthru = IsNextInAssemblyOrder(false_rpo);
       // Assemble architecture-specific branch.
       AssembleArchBranch(instr, &branch);
       break;
     }
-    case kFlags_deoptimize: {
+    case kFlags_deoptimize:
+    case kFlags_deoptimize_and_poison: {
       // Assemble a conditional eager deoptimization after this instruction.
       InstructionOperandConverter i(this, instr);
       size_t frame_state_offset = MiscField::decode(instr->opcode());
@@ -555,6 +647,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleInstruction(
       // Assemble architecture-specific branch.
       AssembleArchDeoptBranch(instr, &branch);
       tasm()->bind(&continue_label);
+      if (mode == kFlags_deoptimize_and_poison) {
+        AssembleBranchPoisoning(NegateFlagsCondition(branch.condition), instr);
+      }
       break;
     }
     case kFlags_set: {
@@ -570,6 +665,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleInstruction(
       break;
     }
   }
+
+  // TODO(jarin) We should thread the flag through rather than set it.
+  if (instr->IsCall()) {
+    ResetSpeculationPoison();
+  }
+
   return kSuccess;
 }
 
@@ -729,9 +830,9 @@ void CodeGenerator::RecordCallPosition(Instruction* instr) {
 
   if (needs_frame_state) {
     MarkLazyDeoptSite();
-    // If the frame state is present, it starts at argument 1 (just after the
-    // code address).
-    size_t frame_state_offset = 1;
+    // If the frame state is present, it starts at argument 2 - after
+    // the code address and the poison-alias index.
+    size_t frame_state_offset = 2;
     FrameStateDescriptor* descriptor =
         GetDeoptimizationEntry(instr, frame_state_offset).descriptor();
     int pc_offset = tasm()->pc_offset();
@@ -1078,6 +1179,29 @@ DeoptimizationExit* CodeGenerator::AddDeoptimizationExit(
   return exit;
 }
 
+void CodeGenerator::InitializeSpeculationPoison() {
+  if (poisoning_enabled_ == PoisoningMitigationLevel::kOff) return;
+
+  // Initialize {kSpeculationPoisonRegister} either by comparing the expected
+  // with the actual call target, or by unconditionally using {-1} initially.
+  // Masking register arguments with it only makes sense in the first case.
+  if (info()->called_with_code_start_register()) {
+    tasm()->RecordComment("-- Prologue: generate speculation poison --");
+    GenerateSpeculationPoisonFromCodeStartRegister();
+    if (info()->is_poisoning_register_arguments()) {
+      AssembleRegisterArgumentPoisoning();
+    }
+  } else {
+    ResetSpeculationPoison();
+  }
+}
+
+void CodeGenerator::ResetSpeculationPoison() {
+  if (poisoning_enabled_ != PoisoningMitigationLevel::kOff) {
+    tasm()->ResetSpeculationPoisonRegister();
+  }
+}
+
 OutOfLineCode::OutOfLineCode(CodeGenerator* gen)
     : frame_(gen->frame()), tasm_(gen->tasm()), next_(gen->ools_) {
   gen->ools_ = this;
diff --git a/deps/v8/src/compiler/code-generator.h b/deps/v8/src/compiler/code-generator.h
index 425ea2ebf26..46f5a59694f 100644
--- a/deps/v8/src/compiler/code-generator.h
+++ b/deps/v8/src/compiler/code-generator.h
@@ -86,7 +86,8 @@ class CodeGenerator final : public GapResolver::Assembler {
                          int start_source_position,
                          JumpOptimizationInfo* jump_opt,
                          std::vector<trap_handler::ProtectedInstructionData>*
-                             protected_instructions);
+                             protected_instructions,
+                         PoisoningMitigationLevel poisoning_enabled);
 
   // Generate native code. After calling AssembleCode, call FinalizeCode to
   // produce the actual code object. If an error occurs during either phase,
@@ -95,7 +96,6 @@ class CodeGenerator final : public GapResolver::Assembler {
   Handle<Code> FinalizeCode();
 
   Handle<ByteArray> GetSourcePositionTable();
-  MaybeHandle<HandlerTable> GetHandlerTable() const;
 
   InstructionSequence* code() const { return code_; }
   FrameAccessState* frame_access_state() const { return frame_access_state_; }
@@ -122,6 +122,7 @@ class CodeGenerator final : public GapResolver::Assembler {
   Zone* zone() const { return zone_; }
   TurboAssembler* tasm() { return &tasm_; }
   size_t GetSafepointTableOffset() const { return safepoints_.GetCodeOffset(); }
+  size_t GetHandlerTableOffset() const { return handler_table_offset_; }
 
  private:
   GapResolver* resolver() { return &resolver_; }
@@ -150,11 +151,27 @@ class CodeGenerator final : public GapResolver::Assembler {
   // Assemble instructions for the specified block.
   CodeGenResult AssembleBlock(const InstructionBlock* block);
 
+  // Inserts mask update at the beginning of an instruction block if the
+  // predecessor blocks ends with a masking branch.
+  void TryInsertBranchPoisoning(const InstructionBlock* block);
+
+  // Initializes the masking register in the prologue of a function.
+  void InitializeSpeculationPoison();
+  // Reset the masking register during execution of a function.
+  void ResetSpeculationPoison();
+  // Generates a mask from the pc passed in {kJavaScriptCallCodeStartRegister}.
+  void GenerateSpeculationPoisonFromCodeStartRegister();
+
   // Assemble code for the specified instruction.
   CodeGenResult AssembleInstruction(Instruction* instr,
                                     const InstructionBlock* block);
   void AssembleGaps(Instruction* instr);
 
+  // Compute branch info from given instruction. Returns a valid rpo number
+  // if the branch is redundant, the returned rpo number point to the target
+  // basic block.
+  RpoNumber ComputeBranchInfo(BranchInfo* branch, Instruction* instr);
+
   // Returns true if a instruction is a tail call that needs to adjust the stack
   // pointer before execution. The stack slot index to the empty slot above the
   // adjusted stack pointer is returned in |slot|.
@@ -179,12 +196,22 @@ class CodeGenerator final : public GapResolver::Assembler {
   void AssembleArchLookupSwitch(Instruction* instr);
   void AssembleArchTableSwitch(Instruction* instr);
 
+  // Generates code that checks whether the {kJavaScriptCallCodeStartRegister}
+  // contains the expected pointer to the start of the instruction stream.
+  void AssembleCodeStartRegisterCheck();
+
+  void AssembleBranchPoisoning(FlagsCondition condition, Instruction* instr);
+
   // When entering a code that is marked for deoptimization, rather continuing
   // with its execution, we jump to a lazy compiled code. We need to do this
   // because this code has already been deoptimized and needs to be unlinked
   // from the JS functions referring it.
   void BailoutIfDeoptimized();
 
+  // Generates code to poison the stack pointer and implicit register arguments
+  // like the context register and the function register.
+  void AssembleRegisterArgumentPoisoning();
+
   // Generates an architecture-specific, descriptor-specific prologue
   // to set up a stack frame.
   void AssembleConstructFrame();
@@ -224,6 +251,26 @@ class CodeGenerator final : public GapResolver::Assembler {
                                      PushTypeFlags push_type,
                                      ZoneVector<MoveOperands*>* pushes);
 
+  class MoveType {
+   public:
+    enum Type {
+      kRegisterToRegister,
+      kRegisterToStack,
+      kStackToRegister,
+      kStackToStack,
+      kConstantToRegister,
+      kConstantToStack
+    };
+
+    // Detect what type of move or swap needs to be performed. Note that these
+    // functions do not take into account the representation (Tagged, FP,
+    // ...etc).
+
+    static Type InferMove(InstructionOperand* source,
+                          InstructionOperand* destination);
+    static Type InferSwap(InstructionOperand* source,
+                          InstructionOperand* destination);
+  };
   // Called before a tail call |instr|'s gap moves are assembled and allows
   // gap-specific pre-processing, e.g. adjustment of the sp for tail calls that
   // need it before gap moves or conversion of certain gap moves into pushes.
@@ -346,6 +393,7 @@ class CodeGenerator final : public GapResolver::Assembler {
   ZoneDeque<DeoptimizationLiteral> deoptimization_literals_;
   size_t inlined_function_count_;
   TranslationBuffer translations_;
+  int handler_table_offset_;
   int last_lazy_deopt_pc_;
 
   // kArchCallCFunction could be reached either:
@@ -368,10 +416,11 @@ class CodeGenerator final : public GapResolver::Assembler {
   SourcePositionTableBuilder source_position_table_builder_;
   std::vector<trap_handler::ProtectedInstructionData>* protected_instructions_;
   CodeGenResult result_;
+  PoisoningMitigationLevel poisoning_enabled_;
 };
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_COMPILER_CODE_GENERATOR_H
+#endif  // V8_COMPILER_CODE_GENERATOR_H_
diff --git a/deps/v8/src/compiler/common-operator-reducer.cc b/deps/v8/src/compiler/common-operator-reducer.cc
index d9bc5c8173f..388cc66c161 100644
--- a/deps/v8/src/compiler/common-operator-reducer.cc
+++ b/deps/v8/src/compiler/common-operator-reducer.cc
@@ -38,12 +38,14 @@ Decision DecideCondition(Node* const cond) {
 
 CommonOperatorReducer::CommonOperatorReducer(Editor* editor, Graph* graph,
                                              CommonOperatorBuilder* common,
-                                             MachineOperatorBuilder* machine)
+                                             MachineOperatorBuilder* machine,
+                                             Zone* temp_zone)
     : AdvancedReducer(editor),
       graph_(graph),
       common_(common),
       machine_(machine),
-      dead_(graph->NewNode(common->Dead())) {
+      dead_(graph->NewNode(common->Dead())),
+      zone_(temp_zone) {
   NodeProperties::SetType(dead_, Type::None());
 }
 
@@ -64,6 +66,8 @@ Reduction CommonOperatorReducer::Reduce(Node* node) {
       return ReduceReturn(node);
     case IrOpcode::kSelect:
       return ReduceSelect(node);
+    case IrOpcode::kSwitch:
+      return ReduceSwitch(node);
     default:
       break;
   }
@@ -138,10 +142,10 @@ Reduction CommonOperatorReducer::ReduceDeoptimizeConditional(Node* node) {
   if (condition->opcode() == IrOpcode::kBooleanNot) {
     NodeProperties::ReplaceValueInput(node, condition->InputAt(0), 0);
     NodeProperties::ChangeOp(
-        node, condition_is_true ? common()->DeoptimizeIf(p.kind(), p.reason(),
-                                                         VectorSlotPair())
-                                : common()->DeoptimizeUnless(
-                                      p.kind(), p.reason(), VectorSlotPair()));
+        node,
+        condition_is_true
+            ? common()->DeoptimizeIf(p.kind(), p.reason(), p.feedback())
+            : common()->DeoptimizeUnless(p.kind(), p.reason(), p.feedback()));
     return Changed(node);
   }
   Decision const decision = DecideCondition(condition);
@@ -150,8 +154,8 @@ Reduction CommonOperatorReducer::ReduceDeoptimizeConditional(Node* node) {
     ReplaceWithValue(node, dead(), effect, control);
   } else {
     control = graph()->NewNode(
-        common()->Deoptimize(p.kind(), p.reason(), VectorSlotPair()),
-        frame_state, effect, control);
+        common()->Deoptimize(p.kind(), p.reason(), p.feedback()), frame_state,
+        effect, control);
     // TODO(bmeurer): This should be on the AdvancedReducer somehow.
     NodeProperties::MergeControlToEnd(graph(), common(), control);
     Revisit(graph()->end());
@@ -414,6 +418,42 @@ Reduction CommonOperatorReducer::ReduceSelect(Node* node) {
   return NoChange();
 }
 
+Reduction CommonOperatorReducer::ReduceSwitch(Node* node) {
+  DCHECK_EQ(IrOpcode::kSwitch, node->opcode());
+  Node* const switched_value = node->InputAt(0);
+  Node* const control = node->InputAt(1);
+
+  // Attempt to constant match the switched value against the IfValue cases. If
+  // no case matches, then use the IfDefault. We don't bother marking
+  // non-matching cases as dead code (same for an unused IfDefault), because the
+  // Switch itself will be marked as dead code.
+  Int32Matcher mswitched(switched_value);
+  if (mswitched.HasValue()) {
+    bool matched = false;
+
+    size_t const projection_count = node->op()->ControlOutputCount();
+    Node** projections = zone_->NewArray<Node*>(projection_count);
+    NodeProperties::CollectControlProjections(node, projections,
+                                              projection_count);
+    for (size_t i = 0; i < projection_count - 1; i++) {
+      Node* if_value = projections[i];
+      DCHECK_EQ(IrOpcode::kIfValue, if_value->opcode());
+      const IfValueParameters& p = IfValueParametersOf(if_value->op());
+      if (p.value() == mswitched.Value()) {
+        matched = true;
+        Replace(if_value, control);
+        break;
+      }
+    }
+    if (!matched) {
+      Node* if_default = projections[projection_count - 1];
+      DCHECK_EQ(IrOpcode::kIfDefault, if_default->opcode());
+      Replace(if_default, control);
+    }
+    return Replace(dead());
+  }
+  return NoChange();
+}
 
 Reduction CommonOperatorReducer::Change(Node* node, Operator const* op,
                                         Node* a) {
diff --git a/deps/v8/src/compiler/common-operator-reducer.h b/deps/v8/src/compiler/common-operator-reducer.h
index ea3575aa55e..022c4fbe8cd 100644
--- a/deps/v8/src/compiler/common-operator-reducer.h
+++ b/deps/v8/src/compiler/common-operator-reducer.h
@@ -26,7 +26,7 @@ class V8_EXPORT_PRIVATE CommonOperatorReducer final
  public:
   CommonOperatorReducer(Editor* editor, Graph* graph,
                         CommonOperatorBuilder* common,
-                        MachineOperatorBuilder* machine);
+                        MachineOperatorBuilder* machine, Zone* temp_zone);
   ~CommonOperatorReducer() final {}
 
   const char* reducer_name() const override { return "CommonOperatorReducer"; }
@@ -41,6 +41,7 @@ class V8_EXPORT_PRIVATE CommonOperatorReducer final
   Reduction ReducePhi(Node* node);
   Reduction ReduceReturn(Node* node);
   Reduction ReduceSelect(Node* node);
+  Reduction ReduceSwitch(Node* node);
 
   Reduction Change(Node* node, Operator const* op, Node* a);
   Reduction Change(Node* node, Operator const* op, Node* a, Node* b);
@@ -54,6 +55,7 @@ class V8_EXPORT_PRIVATE CommonOperatorReducer final
   CommonOperatorBuilder* const common_;
   MachineOperatorBuilder* const machine_;
   Node* const dead_;
+  Zone* zone_;
 };
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/common-operator.cc b/deps/v8/src/compiler/common-operator.cc
index 54af052d560..7488e363054 100644
--- a/deps/v8/src/compiler/common-operator.cc
+++ b/deps/v8/src/compiler/common-operator.cc
@@ -29,10 +29,27 @@ std::ostream& operator<<(std::ostream& os, BranchHint hint) {
   UNREACHABLE();
 }
 
+std::ostream& operator<<(std::ostream& os, IsSafetyCheck is_safety_check) {
+  switch (is_safety_check) {
+    case IsSafetyCheck::kSafetyCheck:
+      return os << "SafetyCheck";
+    case IsSafetyCheck::kNoSafetyCheck:
+      return os << "NoSafetyCheck";
+  }
+  UNREACHABLE();
+}
 
-BranchHint BranchHintOf(const Operator* const op) {
+std::ostream& operator<<(std::ostream& os, BranchOperatorInfo info) {
+  return os << info.hint << "|" << info.is_safety_check;
+}
+
+const BranchOperatorInfo& BranchOperatorInfoOf(const Operator* const op) {
   DCHECK_EQ(IrOpcode::kBranch, op->opcode());
-  return OpParameter<BranchHint>(op);
+  return OpParameter<BranchOperatorInfo>(op);
+}
+
+BranchHint BranchHintOf(const Operator* const op) {
+  return BranchOperatorInfoOf(op).hint;
 }
 
 int ValueInputCountOfReturn(Operator const* const op) {
@@ -44,7 +61,8 @@ int ValueInputCountOfReturn(Operator const* const op) {
 
 bool operator==(DeoptimizeParameters lhs, DeoptimizeParameters rhs) {
   return lhs.kind() == rhs.kind() && lhs.reason() == rhs.reason() &&
-         lhs.feedback() == rhs.feedback();
+         lhs.feedback() == rhs.feedback() &&
+         lhs.is_safety_check() == rhs.is_safety_check();
 }
 
 bool operator!=(DeoptimizeParameters lhs, DeoptimizeParameters rhs) {
@@ -52,11 +70,12 @@ bool operator!=(DeoptimizeParameters lhs, DeoptimizeParameters rhs) {
 }
 
 size_t hash_value(DeoptimizeParameters p) {
-  return base::hash_combine(p.kind(), p.reason(), p.feedback());
+  return base::hash_combine(p.kind(), p.reason(), p.feedback(),
+                            p.is_safety_check());
 }
 
 std::ostream& operator<<(std::ostream& os, DeoptimizeParameters p) {
-  os << p.kind() << ":" << p.reason();
+  os << p.kind() << ":" << p.reason() << ":" << p.is_safety_check();
   if (p.feedback().IsValid()) {
     os << "; " << p.feedback();
   }
@@ -70,6 +89,32 @@ DeoptimizeParameters const& DeoptimizeParametersOf(Operator const* const op) {
   return OpParameter<DeoptimizeParameters>(op);
 }
 
+IsSafetyCheck IsSafetyCheckOf(const Operator* op) {
+  if (op->opcode() == IrOpcode::kBranch) {
+    return BranchOperatorInfoOf(op).is_safety_check;
+  }
+  return DeoptimizeParametersOf(op).is_safety_check();
+}
+
+const Operator* CommonOperatorBuilder::MarkAsSafetyCheck(const Operator* op) {
+  if (op->opcode() == IrOpcode::kBranch) {
+    BranchOperatorInfo info = BranchOperatorInfoOf(op);
+    if (info.is_safety_check == IsSafetyCheck::kSafetyCheck) return op;
+    return Branch(info.hint, IsSafetyCheck::kSafetyCheck);
+  }
+  DeoptimizeParameters p = DeoptimizeParametersOf(op);
+  if (p.is_safety_check() == IsSafetyCheck::kSafetyCheck) return op;
+  switch (op->opcode()) {
+    case IrOpcode::kDeoptimizeIf:
+      return DeoptimizeIf(p.kind(), p.reason(), p.feedback(),
+                          IsSafetyCheck::kSafetyCheck);
+    case IrOpcode::kDeoptimizeUnless:
+      return DeoptimizeUnless(p.kind(), p.reason(), p.feedback(),
+                              IsSafetyCheck::kSafetyCheck);
+    default:
+      UNREACHABLE();
+  }
+}
 
 bool operator==(SelectParameters const& lhs, SelectParameters const& rhs) {
   return lhs.representation() == rhs.representation() &&
@@ -175,7 +220,7 @@ bool operator!=(RelocatablePtrConstantInfo const& lhs,
 }
 
 size_t hash_value(RelocatablePtrConstantInfo const& p) {
-  return base::hash_combine(p.value(), p.rmode(), p.type());
+  return base::hash_combine(p.value(), int8_t{p.rmode()}, p.type());
 }
 
 std::ostream& operator<<(std::ostream& os,
@@ -346,6 +391,26 @@ ZoneVector<MachineType> const* MachineTypesOf(Operator const* op) {
   return OpParameter<TypedObjectStateInfo>(op).machine_types();
 }
 
+V8_EXPORT_PRIVATE bool operator==(IfValueParameters const& l,
+                                  IfValueParameters const& r) {
+  return l.value() == r.value() && r.comparison_order() == r.comparison_order();
+}
+
+size_t hash_value(IfValueParameters const& p) {
+  return base::hash_combine(p.value(), p.comparison_order());
+}
+
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& out,
+                                           IfValueParameters const& p) {
+  out << p.value() << " (order " << p.comparison_order() << ")";
+  return out;
+}
+
+IfValueParameters const& IfValueParametersOf(const Operator* op) {
+  DCHECK(op->opcode() == IrOpcode::kIfValue);
+  return OpParameter<IfValueParameters>(op);
+}
+
 #define COMMON_CACHED_OP_LIST(V)                                              \
   V(Dead, Operator::kFoldable, 0, 0, 0, 1, 1, 1)                              \
   V(Unreachable, Operator::kFoldable, 0, 1, 1, 1, 1, 0)                       \
@@ -365,6 +430,14 @@ ZoneVector<MachineType> const* MachineTypesOf(Operator const* op) {
   V(FinishRegion, Operator::kKontrol, 1, 1, 0, 1, 1, 0)                       \
   V(Retain, Operator::kKontrol, 1, 1, 0, 0, 1, 0)
 
+#define CACHED_BRANCH_LIST(V) \
+  V(None, SafetyCheck)        \
+  V(True, SafetyCheck)        \
+  V(False, SafetyCheck)       \
+  V(None, NoSafetyCheck)      \
+  V(True, NoSafetyCheck)      \
+  V(False, NoSafetyCheck)
+
 #define CACHED_RETURN_LIST(V) \
   V(1)                        \
   V(2)                        \
@@ -417,22 +490,28 @@ ZoneVector<MachineType> const* MachineTypesOf(Operator const* op) {
   V(Soft, InsufficientTypeFeedbackForGenericKeyedAccess) \
   V(Soft, InsufficientTypeFeedbackForGenericNamedAccess)
 
-#define CACHED_DEOPTIMIZE_IF_LIST(V) \
-  V(Eager, DivisionByZero)           \
-  V(Eager, Hole)                     \
-  V(Eager, MinusZero)                \
-  V(Eager, Overflow)                 \
-  V(Eager, Smi)
-
-#define CACHED_DEOPTIMIZE_UNLESS_LIST(V) \
-  V(Eager, LostPrecision)                \
-  V(Eager, LostPrecisionOrNaN)           \
-  V(Eager, NotAHeapNumber)               \
-  V(Eager, NotANumberOrOddball)          \
-  V(Eager, NotASmi)                      \
-  V(Eager, OutOfBounds)                  \
-  V(Eager, WrongInstanceType)            \
-  V(Eager, WrongMap)
+#define CACHED_DEOPTIMIZE_IF_LIST(V)      \
+  V(Eager, DivisionByZero, NoSafetyCheck) \
+  V(Eager, DivisionByZero, SafetyCheck)   \
+  V(Eager, Hole, NoSafetyCheck)           \
+  V(Eager, Hole, SafetyCheck)             \
+  V(Eager, MinusZero, NoSafetyCheck)      \
+  V(Eager, MinusZero, SafetyCheck)        \
+  V(Eager, Overflow, NoSafetyCheck)       \
+  V(Eager, Overflow, SafetyCheck)         \
+  V(Eager, Smi, SafetyCheck)
+
+#define CACHED_DEOPTIMIZE_UNLESS_LIST(V)      \
+  V(Eager, LostPrecision, NoSafetyCheck)      \
+  V(Eager, LostPrecision, SafetyCheck)        \
+  V(Eager, LostPrecisionOrNaN, NoSafetyCheck) \
+  V(Eager, LostPrecisionOrNaN, SafetyCheck)   \
+  V(Eager, NotAHeapNumber, SafetyCheck)       \
+  V(Eager, NotANumberOrOddball, SafetyCheck)  \
+  V(Eager, NotASmi, SafetyCheck)              \
+  V(Eager, OutOfBounds, SafetyCheck)          \
+  V(Eager, WrongInstanceType, SafetyCheck)    \
+  V(Eager, WrongMap, SafetyCheck)
 
 #define CACHED_TRAP_IF_LIST(V) \
   V(TrapDivUnrepresentable)    \
@@ -534,18 +613,20 @@ struct CommonOperatorGlobalCache final {
   CACHED_RETURN_LIST(CACHED_RETURN)
 #undef CACHED_RETURN
 
-  template <BranchHint kBranchHint>
-  struct BranchOperator final : public Operator1<BranchHint> {
+  template <BranchHint hint, IsSafetyCheck is_safety_check>
+  struct BranchOperator final : public Operator1<BranchOperatorInfo> {
     BranchOperator()
-        : Operator1<BranchHint>(                      // --
-              IrOpcode::kBranch, Operator::kKontrol,  // opcode
-              "Branch",                               // name
-              1, 0, 1, 0, 0, 2,                       // counts
-              kBranchHint) {}                         // parameter
+        : Operator1<BranchOperatorInfo>(                     // --
+              IrOpcode::kBranch, Operator::kKontrol,         // opcode
+              "Branch",                                      // name
+              1, 0, 1, 0, 0, 2,                              // counts
+              BranchOperatorInfo{hint, is_safety_check}) {}  // parameter
   };
-  BranchOperator<BranchHint::kNone> kBranchNoneOperator;
-  BranchOperator<BranchHint::kTrue> kBranchTrueOperator;
-  BranchOperator<BranchHint::kFalse> kBranchFalseOperator;
+#define CACHED_BRANCH(Hint, IsCheck)                             \
+  BranchOperator<BranchHint::k##Hint, IsSafetyCheck::k##IsCheck> \
+      kBranch##Hint##IsCheck##Operator;
+  CACHED_BRANCH_LIST(CACHED_BRANCH)
+#undef CACHED_BRANCH
 
   template <int kEffectInputCount>
   struct EffectPhiOperator final : public Operator {
@@ -608,7 +689,8 @@ struct CommonOperatorGlobalCache final {
               Operator::kFoldable | Operator::kNoThrow,  // properties
               "Deoptimize",                              // name
               1, 1, 1, 0, 0, 1,                          // counts
-              DeoptimizeParameters(kKind, kReason, VectorSlotPair())) {}
+              DeoptimizeParameters(kKind, kReason, VectorSlotPair(),
+                                   IsSafetyCheck::kNoSafetyCheck)) {}
   };
 #define CACHED_DEOPTIMIZE(Kind, Reason)                                    \
   DeoptimizeOperator<DeoptimizeKind::k##Kind, DeoptimizeReason::k##Reason> \
@@ -616,7 +698,8 @@ struct CommonOperatorGlobalCache final {
   CACHED_DEOPTIMIZE_LIST(CACHED_DEOPTIMIZE)
 #undef CACHED_DEOPTIMIZE
 
-  template <DeoptimizeKind kKind, DeoptimizeReason kReason>
+  template <DeoptimizeKind kKind, DeoptimizeReason kReason,
+            IsSafetyCheck is_safety_check>
   struct DeoptimizeIfOperator final : public Operator1<DeoptimizeParameters> {
     DeoptimizeIfOperator()
         : Operator1<DeoptimizeParameters>(               // --
@@ -624,15 +707,18 @@ struct CommonOperatorGlobalCache final {
               Operator::kFoldable | Operator::kNoThrow,  // properties
               "DeoptimizeIf",                            // name
               2, 1, 1, 0, 1, 1,                          // counts
-              DeoptimizeParameters(kKind, kReason, VectorSlotPair())) {}
+              DeoptimizeParameters(kKind, kReason, VectorSlotPair(),
+                                   is_safety_check)) {}
   };
-#define CACHED_DEOPTIMIZE_IF(Kind, Reason)                                   \
-  DeoptimizeIfOperator<DeoptimizeKind::k##Kind, DeoptimizeReason::k##Reason> \
-      kDeoptimizeIf##Kind##Reason##Operator;
+#define CACHED_DEOPTIMIZE_IF(Kind, Reason, IsCheck)                          \
+  DeoptimizeIfOperator<DeoptimizeKind::k##Kind, DeoptimizeReason::k##Reason, \
+                       IsSafetyCheck::k##IsCheck>                            \
+      kDeoptimizeIf##Kind##Reason##IsCheck##Operator;
   CACHED_DEOPTIMIZE_IF_LIST(CACHED_DEOPTIMIZE_IF)
 #undef CACHED_DEOPTIMIZE_IF
 
-  template <DeoptimizeKind kKind, DeoptimizeReason kReason>
+  template <DeoptimizeKind kKind, DeoptimizeReason kReason,
+            IsSafetyCheck is_safety_check>
   struct DeoptimizeUnlessOperator final
       : public Operator1<DeoptimizeParameters> {
     DeoptimizeUnlessOperator()
@@ -641,12 +727,14 @@ struct CommonOperatorGlobalCache final {
               Operator::kFoldable | Operator::kNoThrow,  // properties
               "DeoptimizeUnless",                        // name
               2, 1, 1, 0, 1, 1,                          // counts
-              DeoptimizeParameters(kKind, kReason, VectorSlotPair())) {}
+              DeoptimizeParameters(kKind, kReason, VectorSlotPair(),
+                                   is_safety_check)) {}
   };
-#define CACHED_DEOPTIMIZE_UNLESS(Kind, Reason)          \
+#define CACHED_DEOPTIMIZE_UNLESS(Kind, Reason, IsCheck) \
   DeoptimizeUnlessOperator<DeoptimizeKind::k##Kind,     \
-                           DeoptimizeReason::k##Reason> \
-      kDeoptimizeUnless##Kind##Reason##Operator;
+                           DeoptimizeReason::k##Reason, \
+                           IsSafetyCheck::k##IsCheck>   \
+      kDeoptimizeUnless##Kind##Reason##IsCheck##Operator;
   CACHED_DEOPTIMIZE_UNLESS_LIST(CACHED_DEOPTIMIZE_UNLESS)
 #undef CACHED_DEOPTIMIZE_UNLESS
 
@@ -806,16 +894,15 @@ const Operator* CommonOperatorBuilder::Return(int value_input_count) {
       value_input_count + 1, 1, 1, 0, 0, 1);  // counts
 }
 
-
-const Operator* CommonOperatorBuilder::Branch(BranchHint hint) {
-  switch (hint) {
-    case BranchHint::kNone:
-      return &cache_.kBranchNoneOperator;
-    case BranchHint::kTrue:
-      return &cache_.kBranchTrueOperator;
-    case BranchHint::kFalse:
-      return &cache_.kBranchFalseOperator;
+const Operator* CommonOperatorBuilder::Branch(BranchHint hint,
+                                              IsSafetyCheck is_safety_check) {
+#define CACHED_BRANCH(Hint, IsCheck)                  \
+  if (hint == BranchHint::k##Hint &&                  \
+      is_safety_check == IsSafetyCheck::k##IsCheck) { \
+    return &cache_.kBranch##Hint##IsCheck##Operator;  \
   }
+  CACHED_BRANCH_LIST(CACHED_BRANCH)
+#undef CACHED_BRANCH
   UNREACHABLE();
 }
 
@@ -830,7 +917,8 @@ const Operator* CommonOperatorBuilder::Deoptimize(
   CACHED_DEOPTIMIZE_LIST(CACHED_DEOPTIMIZE)
 #undef CACHED_DEOPTIMIZE
   // Uncached
-  DeoptimizeParameters parameter(kind, reason, feedback);
+  DeoptimizeParameters parameter(kind, reason, feedback,
+                                 IsSafetyCheck::kNoSafetyCheck);
   return new (zone()) Operator1<DeoptimizeParameters>(  // --
       IrOpcode::kDeoptimize,                            // opcodes
       Operator::kFoldable | Operator::kNoThrow,         // properties
@@ -841,16 +929,17 @@ const Operator* CommonOperatorBuilder::Deoptimize(
 
 const Operator* CommonOperatorBuilder::DeoptimizeIf(
     DeoptimizeKind kind, DeoptimizeReason reason,
-    VectorSlotPair const& feedback) {
-#define CACHED_DEOPTIMIZE_IF(Kind, Reason)                            \
-  if (kind == DeoptimizeKind::k##Kind &&                              \
-      reason == DeoptimizeReason::k##Reason && !feedback.IsValid()) { \
-    return &cache_.kDeoptimizeIf##Kind##Reason##Operator;             \
+    VectorSlotPair const& feedback, IsSafetyCheck is_safety_check) {
+#define CACHED_DEOPTIMIZE_IF(Kind, Reason, IsCheck)                          \
+  if (kind == DeoptimizeKind::k##Kind &&                                     \
+      reason == DeoptimizeReason::k##Reason &&                               \
+      is_safety_check == IsSafetyCheck::k##IsCheck && !feedback.IsValid()) { \
+    return &cache_.kDeoptimizeIf##Kind##Reason##IsCheck##Operator;           \
   }
   CACHED_DEOPTIMIZE_IF_LIST(CACHED_DEOPTIMIZE_IF)
 #undef CACHED_DEOPTIMIZE_IF
   // Uncached
-  DeoptimizeParameters parameter(kind, reason, feedback);
+  DeoptimizeParameters parameter(kind, reason, feedback, is_safety_check);
   return new (zone()) Operator1<DeoptimizeParameters>(  // --
       IrOpcode::kDeoptimizeIf,                          // opcode
       Operator::kFoldable | Operator::kNoThrow,         // properties
@@ -861,16 +950,17 @@ const Operator* CommonOperatorBuilder::DeoptimizeIf(
 
 const Operator* CommonOperatorBuilder::DeoptimizeUnless(
     DeoptimizeKind kind, DeoptimizeReason reason,
-    VectorSlotPair const& feedback) {
-#define CACHED_DEOPTIMIZE_UNLESS(Kind, Reason)                        \
-  if (kind == DeoptimizeKind::k##Kind &&                              \
-      reason == DeoptimizeReason::k##Reason && !feedback.IsValid()) { \
-    return &cache_.kDeoptimizeUnless##Kind##Reason##Operator;         \
+    VectorSlotPair const& feedback, IsSafetyCheck is_safety_check) {
+#define CACHED_DEOPTIMIZE_UNLESS(Kind, Reason, IsCheck)                      \
+  if (kind == DeoptimizeKind::k##Kind &&                                     \
+      reason == DeoptimizeReason::k##Reason &&                               \
+      is_safety_check == IsSafetyCheck::k##IsCheck && !feedback.IsValid()) { \
+    return &cache_.kDeoptimizeUnless##Kind##Reason##IsCheck##Operator;       \
   }
   CACHED_DEOPTIMIZE_UNLESS_LIST(CACHED_DEOPTIMIZE_UNLESS)
 #undef CACHED_DEOPTIMIZE_UNLESS
   // Uncached
-  DeoptimizeParameters parameter(kind, reason, feedback);
+  DeoptimizeParameters parameter(kind, reason, feedback, is_safety_check);
   return new (zone()) Operator1<DeoptimizeParameters>(  // --
       IrOpcode::kDeoptimizeUnless,                      // opcode
       Operator::kFoldable | Operator::kNoThrow,         // properties
@@ -924,13 +1014,13 @@ const Operator* CommonOperatorBuilder::Switch(size_t control_output_count) {
       1, 0, 1, 0, 0, control_output_count);   // counts
 }
 
-
-const Operator* CommonOperatorBuilder::IfValue(int32_t index) {
-  return new (zone()) Operator1<int32_t>(      // --
-      IrOpcode::kIfValue, Operator::kKontrol,  // opcode
-      "IfValue",                               // name
-      0, 0, 1, 0, 0, 1,                        // counts
-      index);                                  // parameter
+const Operator* CommonOperatorBuilder::IfValue(int32_t index,
+                                               int32_t comparison_order) {
+  return new (zone()) Operator1<IfValueParameters>(  // --
+      IrOpcode::kIfValue, Operator::kKontrol,        // opcode
+      "IfValue",                                     // name
+      0, 0, 1, 0, 0, 1,                              // counts
+      IfValueParameters(index, comparison_order));   // parameter
 }
 
 
@@ -1078,6 +1168,11 @@ const Operator* CommonOperatorBuilder::HeapConstant(
       value);                                         // parameter
 }
 
+Handle<HeapObject> HeapConstantOf(const Operator* op) {
+  DCHECK_EQ(IrOpcode::kHeapConstant, op->opcode());
+  return OpParameter<Handle<HeapObject>>(op);
+}
+
 const Operator* CommonOperatorBuilder::RelocatableInt32Constant(
     int32_t value, RelocInfo::Mode rmode) {
   return new (zone()) Operator1<RelocatablePtrConstantInfo>(  // --
@@ -1299,65 +1394,70 @@ const Operator* CommonOperatorBuilder::FrameState(
       state_info);                                // parameter
 }
 
-
-const Operator* CommonOperatorBuilder::Call(const CallDescriptor* descriptor) {
+const Operator* CommonOperatorBuilder::Call(
+    const CallDescriptor* call_descriptor) {
   class CallOperator final : public Operator1<const CallDescriptor*> {
    public:
-    explicit CallOperator(const CallDescriptor* descriptor)
+    explicit CallOperator(const CallDescriptor* call_descriptor)
         : Operator1<const CallDescriptor*>(
-              IrOpcode::kCall, descriptor->properties(), "Call",
-              descriptor->InputCount() + descriptor->FrameStateCount(),
-              Operator::ZeroIfPure(descriptor->properties()),
-              Operator::ZeroIfEliminatable(descriptor->properties()),
-              descriptor->ReturnCount(),
-              Operator::ZeroIfPure(descriptor->properties()),
-              Operator::ZeroIfNoThrow(descriptor->properties()), descriptor) {}
+              IrOpcode::kCall, call_descriptor->properties(), "Call",
+              call_descriptor->InputCount() +
+                  call_descriptor->FrameStateCount(),
+              Operator::ZeroIfPure(call_descriptor->properties()),
+              Operator::ZeroIfEliminatable(call_descriptor->properties()),
+              call_descriptor->ReturnCount(),
+              Operator::ZeroIfPure(call_descriptor->properties()),
+              Operator::ZeroIfNoThrow(call_descriptor->properties()),
+              call_descriptor) {}
 
     void PrintParameter(std::ostream& os, PrintVerbosity verbose) const {
       os << "[" << *parameter() << "]";
     }
   };
-  return new (zone()) CallOperator(descriptor);
+  return new (zone()) CallOperator(call_descriptor);
 }
 
 const Operator* CommonOperatorBuilder::CallWithCallerSavedRegisters(
-    const CallDescriptor* descriptor) {
+    const CallDescriptor* call_descriptor) {
   class CallOperator final : public Operator1<const CallDescriptor*> {
    public:
-    explicit CallOperator(const CallDescriptor* descriptor)
+    explicit CallOperator(const CallDescriptor* call_descriptor)
         : Operator1<const CallDescriptor*>(
-              IrOpcode::kCallWithCallerSavedRegisters, descriptor->properties(),
-              "CallWithCallerSavedRegisters",
-              descriptor->InputCount() + descriptor->FrameStateCount(),
-              Operator::ZeroIfPure(descriptor->properties()),
-              Operator::ZeroIfEliminatable(descriptor->properties()),
-              descriptor->ReturnCount(),
-              Operator::ZeroIfPure(descriptor->properties()),
-              Operator::ZeroIfNoThrow(descriptor->properties()), descriptor) {}
+              IrOpcode::kCallWithCallerSavedRegisters,
+              call_descriptor->properties(), "CallWithCallerSavedRegisters",
+              call_descriptor->InputCount() +
+                  call_descriptor->FrameStateCount(),
+              Operator::ZeroIfPure(call_descriptor->properties()),
+              Operator::ZeroIfEliminatable(call_descriptor->properties()),
+              call_descriptor->ReturnCount(),
+              Operator::ZeroIfPure(call_descriptor->properties()),
+              Operator::ZeroIfNoThrow(call_descriptor->properties()),
+              call_descriptor) {}
 
     void PrintParameter(std::ostream& os, PrintVerbosity verbose) const {
       os << "[" << *parameter() << "]";
     }
   };
-  return new (zone()) CallOperator(descriptor);
+  return new (zone()) CallOperator(call_descriptor);
 }
 
 const Operator* CommonOperatorBuilder::TailCall(
-    const CallDescriptor* descriptor) {
+    const CallDescriptor* call_descriptor) {
   class TailCallOperator final : public Operator1<const CallDescriptor*> {
    public:
-    explicit TailCallOperator(const CallDescriptor* descriptor)
+    explicit TailCallOperator(const CallDescriptor* call_descriptor)
         : Operator1<const CallDescriptor*>(
               IrOpcode::kTailCall,
-              descriptor->properties() | Operator::kNoThrow, "TailCall",
-              descriptor->InputCount() + descriptor->FrameStateCount(), 1, 1, 0,
-              0, 1, descriptor) {}
+              call_descriptor->properties() | Operator::kNoThrow, "TailCall",
+              call_descriptor->InputCount() +
+                  call_descriptor->FrameStateCount(),
+              1, 1, 0, 0, 1, call_descriptor) {}
 
     void PrintParameter(std::ostream& os, PrintVerbosity verbose) const {
       os << "[" << *parameter() << "]";
     }
   };
-  return new (zone()) TailCallOperator(descriptor);
+  return new (zone()) TailCallOperator(call_descriptor);
 }
 
 const Operator* CommonOperatorBuilder::Projection(size_t index) {
@@ -1411,7 +1511,13 @@ const Operator* CommonOperatorBuilder::DeadValue(MachineRepresentation rep) {
       rep);                                              // parameter
 }
 
+const FrameStateInfo& FrameStateInfoOf(const Operator* op) {
+  DCHECK_EQ(IrOpcode::kFrameState, op->opcode());
+  return OpParameter<FrameStateInfo>(op);
+}
+
 #undef COMMON_CACHED_OP_LIST
+#undef CACHED_BRANCH_LIST
 #undef CACHED_RETURN_LIST
 #undef CACHED_END_LIST
 #undef CACHED_EFFECT_PHI_LIST
diff --git a/deps/v8/src/compiler/common-operator.h b/deps/v8/src/compiler/common-operator.h
index 0e0614dcedc..b98747f62b4 100644
--- a/deps/v8/src/compiler/common-operator.h
+++ b/deps/v8/src/compiler/common-operator.h
@@ -45,7 +45,33 @@ inline size_t hash_value(BranchHint hint) { return static_cast<size_t>(hint); }
 
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, BranchHint);
 
-V8_EXPORT_PRIVATE BranchHint BranchHintOf(const Operator* const);
+enum class IsSafetyCheck : uint8_t { kSafetyCheck, kNoSafetyCheck };
+
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, IsSafetyCheck);
+inline size_t hash_value(IsSafetyCheck is_safety_check) {
+  return static_cast<size_t>(is_safety_check);
+}
+
+struct BranchOperatorInfo {
+  BranchHint hint;
+  IsSafetyCheck is_safety_check;
+};
+
+inline size_t hash_value(const BranchOperatorInfo& info) {
+  return base::hash_combine(info.hint, info.is_safety_check);
+}
+
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, BranchOperatorInfo);
+
+inline bool operator==(const BranchOperatorInfo& a,
+                       const BranchOperatorInfo& b) {
+  return a.hint == b.hint && a.is_safety_check == b.is_safety_check;
+}
+
+V8_EXPORT_PRIVATE const BranchOperatorInfo& BranchOperatorInfoOf(
+    const Operator* const) WARN_UNUSED_RESULT;
+V8_EXPORT_PRIVATE BranchHint BranchHintOf(const Operator* const)
+    WARN_UNUSED_RESULT;
 
 // Helper function for return nodes, because returns have a hidden value input.
 int ValueInputCountOfReturn(Operator const* const op);
@@ -54,17 +80,23 @@ int ValueInputCountOfReturn(Operator const* const op);
 class DeoptimizeParameters final {
  public:
   DeoptimizeParameters(DeoptimizeKind kind, DeoptimizeReason reason,
-                       VectorSlotPair const& feedback)
-      : kind_(kind), reason_(reason), feedback_(feedback) {}
+                       VectorSlotPair const& feedback,
+                       IsSafetyCheck is_safety_check)
+      : kind_(kind),
+        reason_(reason),
+        feedback_(feedback),
+        is_safety_check_(is_safety_check) {}
 
   DeoptimizeKind kind() const { return kind_; }
   DeoptimizeReason reason() const { return reason_; }
   const VectorSlotPair& feedback() const { return feedback_; }
+  IsSafetyCheck is_safety_check() const { return is_safety_check_; }
 
  private:
   DeoptimizeKind const kind_;
   DeoptimizeReason const reason_;
   VectorSlotPair const feedback_;
+  IsSafetyCheck is_safety_check_;
 };
 
 bool operator==(DeoptimizeParameters, DeoptimizeParameters);
@@ -74,8 +106,10 @@ size_t hast_value(DeoptimizeParameters p);
 
 std::ostream& operator<<(std::ostream&, DeoptimizeParameters p);
 
-DeoptimizeParameters const& DeoptimizeParametersOf(Operator const* const);
+DeoptimizeParameters const& DeoptimizeParametersOf(Operator const* const)
+    WARN_UNUSED_RESULT;
 
+IsSafetyCheck IsSafetyCheckOf(const Operator* op) WARN_UNUSED_RESULT;
 
 class SelectParameters final {
  public:
@@ -99,14 +133,16 @@ size_t hash_value(SelectParameters const& p);
 std::ostream& operator<<(std::ostream&, SelectParameters const& p);
 
 V8_EXPORT_PRIVATE SelectParameters const& SelectParametersOf(
-    const Operator* const);
+    const Operator* const) WARN_UNUSED_RESULT;
 
-V8_EXPORT_PRIVATE CallDescriptor const* CallDescriptorOf(const Operator* const);
+V8_EXPORT_PRIVATE CallDescriptor const* CallDescriptorOf(const Operator* const)
+    WARN_UNUSED_RESULT;
 
-V8_EXPORT_PRIVATE size_t ProjectionIndexOf(const Operator* const);
+V8_EXPORT_PRIVATE size_t ProjectionIndexOf(const Operator* const)
+    WARN_UNUSED_RESULT;
 
 V8_EXPORT_PRIVATE MachineRepresentation
-PhiRepresentationOf(const Operator* const);
+PhiRepresentationOf(const Operator* const) WARN_UNUSED_RESULT;
 
 // The {IrOpcode::kParameter} opcode represents an incoming parameter to the
 // function. This class bundles the index and a debug name for such operators.
@@ -125,8 +161,9 @@ class ParameterInfo final {
 
 std::ostream& operator<<(std::ostream&, ParameterInfo const&);
 
-V8_EXPORT_PRIVATE int ParameterIndexOf(const Operator* const);
-const ParameterInfo& ParameterInfoOf(const Operator* const);
+V8_EXPORT_PRIVATE int ParameterIndexOf(const Operator* const)
+    WARN_UNUSED_RESULT;
+const ParameterInfo& ParameterInfoOf(const Operator* const) WARN_UNUSED_RESULT;
 
 struct ObjectStateInfo final : std::pair<uint32_t, int> {
   ObjectStateInfo(uint32_t object_id, int size)
@@ -310,9 +347,9 @@ std::ostream& operator<<(std::ostream& os,
 
 Type* TypeGuardTypeOf(Operator const*) WARN_UNUSED_RESULT;
 
-int OsrValueIndexOf(Operator const*);
+int OsrValueIndexOf(Operator const*) WARN_UNUSED_RESULT;
 
-SparseInputMask SparseInputMaskOf(Operator const*);
+SparseInputMask SparseInputMaskOf(Operator const*) WARN_UNUSED_RESULT;
 
 ZoneVector<MachineType> const* MachineTypesOf(Operator const*)
     WARN_UNUSED_RESULT;
@@ -342,7 +379,36 @@ ArgumentsStateType ArgumentsStateTypeOf(Operator const*) WARN_UNUSED_RESULT;
 
 uint32_t ObjectIdOf(Operator const*);
 
-MachineRepresentation DeadValueRepresentationOf(Operator const*);
+MachineRepresentation DeadValueRepresentationOf(Operator const*)
+    WARN_UNUSED_RESULT;
+
+class IfValueParameters final {
+ public:
+  IfValueParameters(int32_t value, int32_t comparison_order)
+      : value_(value), comparison_order_(comparison_order) {}
+
+  int32_t value() const { return value_; }
+  int32_t comparison_order() const { return comparison_order_; }
+
+ private:
+  int32_t value_;
+  int32_t comparison_order_;
+};
+
+V8_EXPORT_PRIVATE bool operator==(IfValueParameters const&,
+                                  IfValueParameters const&);
+
+size_t hash_value(IfValueParameters const&);
+
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&,
+                                           IfValueParameters const&);
+
+V8_EXPORT_PRIVATE IfValueParameters const& IfValueParametersOf(
+    const Operator* op) WARN_UNUSED_RESULT;
+
+const FrameStateInfo& FrameStateInfoOf(const Operator* op) WARN_UNUSED_RESULT;
+
+Handle<HeapObject> HeapConstantOf(const Operator* op) WARN_UNUSED_RESULT;
 
 // Interface for building common operators that can be used at any level of IR,
 // including JavaScript, mid-level, and low-level.
@@ -355,21 +421,27 @@ class V8_EXPORT_PRIVATE CommonOperatorBuilder final
   const Operator* DeadValue(MachineRepresentation rep);
   const Operator* Unreachable();
   const Operator* End(size_t control_input_count);
-  const Operator* Branch(BranchHint = BranchHint::kNone);
+  const Operator* Branch(
+      BranchHint = BranchHint::kNone,
+      IsSafetyCheck is_safety_check = IsSafetyCheck::kSafetyCheck);
   const Operator* IfTrue();
   const Operator* IfFalse();
   const Operator* IfSuccess();
   const Operator* IfException();
   const Operator* Switch(size_t control_output_count);
-  const Operator* IfValue(int32_t value);
+  const Operator* IfValue(int32_t value, int32_t order = 0);
   const Operator* IfDefault();
   const Operator* Throw();
   const Operator* Deoptimize(DeoptimizeKind kind, DeoptimizeReason reason,
                              VectorSlotPair const& feedback);
-  const Operator* DeoptimizeIf(DeoptimizeKind kind, DeoptimizeReason reason,
-                               VectorSlotPair const& feedback);
-  const Operator* DeoptimizeUnless(DeoptimizeKind kind, DeoptimizeReason reason,
-                                   VectorSlotPair const& feedback);
+  const Operator* DeoptimizeIf(
+      DeoptimizeKind kind, DeoptimizeReason reason,
+      VectorSlotPair const& feedback,
+      IsSafetyCheck is_safety_check = IsSafetyCheck::kSafetyCheck);
+  const Operator* DeoptimizeUnless(
+      DeoptimizeKind kind, DeoptimizeReason reason,
+      VectorSlotPair const& feedback,
+      IsSafetyCheck is_safety_check = IsSafetyCheck::kSafetyCheck);
   const Operator* TrapIf(int32_t trap_id);
   const Operator* TrapUnless(int32_t trap_id);
   const Operator* Return(int value_input_count = 1);
@@ -421,10 +493,10 @@ class V8_EXPORT_PRIVATE CommonOperatorBuilder final
   const Operator* FrameState(BailoutId bailout_id,
                              OutputFrameStateCombine state_combine,
                              const FrameStateFunctionInfo* function_info);
-  const Operator* Call(const CallDescriptor* descriptor);
+  const Operator* Call(const CallDescriptor* call_descriptor);
   const Operator* CallWithCallerSavedRegisters(
-      const CallDescriptor* descriptor);
-  const Operator* TailCall(const CallDescriptor* descriptor);
+      const CallDescriptor* call_descriptor);
+  const Operator* TailCall(const CallDescriptor* call_descriptor);
   const Operator* Projection(size_t index);
   const Operator* Retain();
   const Operator* TypeGuard(Type* type);
@@ -438,6 +510,8 @@ class V8_EXPORT_PRIVATE CommonOperatorBuilder final
       FrameStateType type, int parameter_count, int local_count,
       Handle<SharedFunctionInfo> shared_info);
 
+  const Operator* MarkAsSafetyCheck(const Operator* op);
+
  private:
   Zone* zone() const { return zone_; }
 
diff --git a/deps/v8/src/compiler/control-flow-optimizer.cc b/deps/v8/src/compiler/control-flow-optimizer.cc
index 6027c8201cf..7177a6069da 100644
--- a/deps/v8/src/compiler/control-flow-optimizer.cc
+++ b/deps/v8/src/compiler/control-flow-optimizer.cc
@@ -83,6 +83,7 @@ bool ControlFlowOptimizer::TryBuildSwitch(Node* node) {
 
   Node* if_false;
   Node* if_true;
+  int32_t order = 1;
   while (true) {
     BranchMatcher matcher(branch);
     DCHECK(matcher.Matched());
@@ -109,7 +110,7 @@ bool ControlFlowOptimizer::TryBuildSwitch(Node* node) {
       branch->NullAllInputs();
       if_true->ReplaceInput(0, node);
     }
-    NodeProperties::ChangeOp(if_true, common()->IfValue(value));
+    NodeProperties::ChangeOp(if_true, common()->IfValue(value, order++));
     if_false->NullAllInputs();
     Enqueue(if_true);
 
@@ -128,7 +129,7 @@ bool ControlFlowOptimizer::TryBuildSwitch(Node* node) {
   node->ReplaceInput(0, index);
   NodeProperties::ChangeOp(node, common()->Switch(values.size() + 1));
   if_true->ReplaceInput(0, node);
-  NodeProperties::ChangeOp(if_true, common()->IfValue(value));
+  NodeProperties::ChangeOp(if_true, common()->IfValue(value, order++));
   Enqueue(if_true);
   if_false->ReplaceInput(0, node);
   NodeProperties::ChangeOp(if_false, common()->IfDefault());
diff --git a/deps/v8/src/compiler/dead-code-elimination.cc b/deps/v8/src/compiler/dead-code-elimination.cc
index 523d37fe29d..6c54f2b0361 100644
--- a/deps/v8/src/compiler/dead-code-elimination.cc
+++ b/deps/v8/src/compiler/dead-code-elimination.cc
@@ -139,18 +139,26 @@ Reduction DeadCodeElimination::ReduceLoopOrMerge(Node* node) {
   if (live_input_count == 0) {
     return Replace(dead());
   } else if (live_input_count == 1) {
+    NodeVector loop_exits(zone_);
     // Due to compaction above, the live input is at offset 0.
     for (Node* const use : node->uses()) {
       if (NodeProperties::IsPhi(use)) {
         Replace(use, use->InputAt(0));
       } else if (use->opcode() == IrOpcode::kLoopExit &&
                  use->InputAt(1) == node) {
-        RemoveLoopExit(use);
+        // Remember the loop exits so that we can mark their loop input dead.
+        // This has to be done after the use list iteration so that we do
+        // not mutate the use list while it is being iterated.
+        loop_exits.push_back(use);
       } else if (use->opcode() == IrOpcode::kTerminate) {
         DCHECK_EQ(IrOpcode::kLoop, node->opcode());
         Replace(use, dead());
       }
     }
+    for (Node* loop_exit : loop_exits) {
+      loop_exit->ReplaceInput(1, dead());
+      Revisit(loop_exit);
+    }
     return Replace(node->InputAt(0));
   }
   DCHECK_LE(2, live_input_count);
diff --git a/deps/v8/src/compiler/effect-control-linearizer.cc b/deps/v8/src/compiler/effect-control-linearizer.cc
index a47941e28dc..64b3716086d 100644
--- a/deps/v8/src/compiler/effect-control-linearizer.cc
+++ b/deps/v8/src/compiler/effect-control-linearizer.cc
@@ -682,9 +682,6 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kCheckString:
       result = LowerCheckString(node, frame_state);
       break;
-    case IrOpcode::kCheckSeqString:
-      result = LowerCheckSeqString(node, frame_state);
-      break;
     case IrOpcode::kCheckInternalizedString:
       result = LowerCheckInternalizedString(node, frame_state);
       break;
@@ -726,9 +723,8 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
       break;
     case IrOpcode::kCheckedTaggedSignedToInt32:
       if (frame_state == nullptr) {
-        V8_Fatal(__FILE__, __LINE__, "No frame state (zapped by #%d: %s)",
-                 frame_state_zapper_->id(),
-                 frame_state_zapper_->op()->mnemonic());
+        FATAL("No frame state (zapped by #%d: %s)", frame_state_zapper_->id(),
+              frame_state_zapper_->op()->mnemonic());
       }
       result = LowerCheckedTaggedSignedToInt32(node, frame_state);
       break;
@@ -807,9 +803,6 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kTypeOf:
       result = LowerTypeOf(node);
       break;
-    case IrOpcode::kClassOf:
-      result = LowerClassOf(node);
-      break;
     case IrOpcode::kNewDoubleElements:
       result = LowerNewDoubleElements(node);
       break;
@@ -830,11 +823,12 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
       break;
     case IrOpcode::kDeadValue:
       result = LowerDeadValue(node);
-    case IrOpcode::kStringFromCharCode:
-      result = LowerStringFromCharCode(node);
       break;
-    case IrOpcode::kStringFromCodePoint:
-      result = LowerStringFromCodePoint(node);
+    case IrOpcode::kStringFromSingleCharCode:
+      result = LowerStringFromSingleCharCode(node);
+      break;
+    case IrOpcode::kStringFromSingleCodePoint:
+      result = LowerStringFromSingleCodePoint(node);
       break;
     case IrOpcode::kStringIndexOf:
       result = LowerStringIndexOf(node);
@@ -845,20 +839,11 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kStringToNumber:
       result = LowerStringToNumber(node);
       break;
-    case IrOpcode::kStringCharAt:
-      result = LowerStringCharAt(node);
-      break;
     case IrOpcode::kStringCharCodeAt:
       result = LowerStringCharCodeAt(node);
       break;
-    case IrOpcode::kSeqStringCharCodeAt:
-      result = LowerSeqStringCharCodeAt(node);
-      break;
     case IrOpcode::kStringCodePointAt:
-      result = LowerStringCodePointAt(node);
-      break;
-    case IrOpcode::kSeqStringCodePointAt:
-      result = LowerSeqStringCharCodeAt(node);
+      result = LowerStringCodePointAt(node, UnicodeEncodingOf(node->op()));
       break;
     case IrOpcode::kStringToLowerCaseIntl:
       result = LowerStringToLowerCaseIntl(node);
@@ -866,6 +851,9 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kStringToUpperCaseIntl:
       result = LowerStringToUpperCaseIntl(node);
       break;
+    case IrOpcode::kStringSubstring:
+      result = LowerStringSubstring(node);
+      break;
     case IrOpcode::kStringEqual:
       result = LowerStringEqual(node);
       break;
@@ -878,6 +866,24 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kNumberIsFloat64Hole:
       result = LowerNumberIsFloat64Hole(node);
       break;
+    case IrOpcode::kNumberIsFinite:
+      result = LowerNumberIsFinite(node);
+      break;
+    case IrOpcode::kObjectIsFiniteNumber:
+      result = LowerObjectIsFiniteNumber(node);
+      break;
+    case IrOpcode::kNumberIsInteger:
+      result = LowerNumberIsInteger(node);
+      break;
+    case IrOpcode::kObjectIsInteger:
+      result = LowerObjectIsInteger(node);
+      break;
+    case IrOpcode::kNumberIsSafeInteger:
+      result = LowerNumberIsSafeInteger(node);
+      break;
+    case IrOpcode::kObjectIsSafeInteger:
+      result = LowerObjectIsSafeInteger(node);
+      break;
     case IrOpcode::kCheckFloat64Hole:
       result = LowerCheckFloat64Hole(node, frame_state);
       break;
@@ -972,10 +978,10 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
   }
 
   if ((result ? 1 : 0) != node->op()->ValueOutputCount()) {
-    V8_Fatal(__FILE__, __LINE__,
-             "Effect control linearizer lowering of '%s':"
-             " value output count does not agree.",
-             node->op()->mnemonic());
+    FATAL(
+        "Effect control linearizer lowering of '%s':"
+        " value output count does not agree.",
+        node->op()->mnemonic());
   }
 
   *effect = gasm()->ExtractCurrentEffect();
@@ -1365,10 +1371,10 @@ void EffectControlLinearizer::LowerCheckMaps(Node* node, Node* frame_state) {
 
       Operator::Properties properties = Operator::kNoDeopt | Operator::kNoThrow;
       Runtime::FunctionId id = Runtime::kTryMigrateInstance;
-      CallDescriptor const* desc = Linkage::GetRuntimeCallDescriptor(
+      auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
           graph()->zone(), id, 1, properties, CallDescriptor::kNoFlags);
       Node* result =
-          __ Call(desc, __ CEntryStubConstant(1), value,
+          __ Call(call_descriptor, __ CEntryStubConstant(1), value,
                   __ ExternalConstant(ExternalReference(id, isolate())),
                   __ Int32Constant(1), __ NoContextConstant());
       Node* check = ObjectIsSmi(result);
@@ -1495,26 +1501,8 @@ Node* EffectControlLinearizer::LowerCheckString(Node* node, Node* frame_state) {
 
   Node* check = __ Uint32LessThan(value_instance_type,
                                   __ Uint32Constant(FIRST_NONSTRING_TYPE));
-  __ DeoptimizeIfNot(DeoptimizeReason::kWrongInstanceType, params.feedback(),
-                     check, frame_state);
-  return value;
-}
-
-Node* EffectControlLinearizer::LowerCheckSeqString(Node* node,
-                                                   Node* frame_state) {
-  Node* value = node->InputAt(0);
-
-  Node* value_map = __ LoadField(AccessBuilder::ForMap(), value);
-  Node* value_instance_type =
-      __ LoadField(AccessBuilder::ForMapInstanceType(), value_map);
-
-  Node* check = __ Word32Equal(
-      __ Word32And(
-          value_instance_type,
-          __ Int32Constant(kStringRepresentationMask | kIsNotStringMask)),
-      __ Int32Constant(kSeqStringTag | kStringTag));
-  __ DeoptimizeIfNot(DeoptimizeReason::kWrongInstanceType, VectorSlotPair(),
-                     check, frame_state);
+  __ DeoptimizeIfNot(DeoptimizeReason::kNotAString, params.feedback(), check,
+                     frame_state);
   return value;
 }
 
@@ -1935,7 +1923,8 @@ Node* EffectControlLinearizer::BuildCheckedHeapNumberOrOddballToFloat64(
 
 Node* EffectControlLinearizer::LowerCheckedTaggedToFloat64(Node* node,
                                                            Node* frame_state) {
-  CheckTaggedInputMode mode = CheckTaggedInputModeOf(node->op());
+  CheckTaggedInputParameters const& p =
+      CheckTaggedInputParametersOf(node->op());
   Node* value = node->InputAt(0);
 
   auto if_smi = __ MakeLabel();
@@ -1947,7 +1936,7 @@ Node* EffectControlLinearizer::LowerCheckedTaggedToFloat64(Node* node,
   // In the Smi case, just convert to int32 and then float64.
   // Otherwise, check heap numberness and load the number.
   Node* number = BuildCheckedHeapNumberOrOddballToFloat64(
-      mode, VectorSlotPair(), value, frame_state);
+      p.mode(), p.feedback(), value, frame_state);
   __ Goto(&done, number);
 
   __ Bind(&if_smi);
@@ -2042,9 +2031,9 @@ Node* EffectControlLinearizer::LowerNumberToString(Node* node) {
       Builtins::CallableFor(isolate(), Builtins::kNumberToString);
   Operator::Properties properties = Operator::kEliminatable;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
-  return __ Call(desc, __ HeapConstant(callable.code()), argument,
+  return __ Call(call_descriptor, __ HeapConstant(callable.code()), argument,
                  __ NoContextConstant());
 }
 
@@ -2178,6 +2167,118 @@ Node* EffectControlLinearizer::LowerNumberIsFloat64Hole(Node* node) {
   return check;
 }
 
+Node* EffectControlLinearizer::LowerNumberIsFinite(Node* node) {
+  Node* number = node->InputAt(0);
+  Node* diff = __ Float64Sub(number, number);
+  Node* check = __ Float64Equal(diff, diff);
+  return check;
+}
+
+Node* EffectControlLinearizer::LowerObjectIsFiniteNumber(Node* node) {
+  Node* object = node->InputAt(0);
+  Node* zero = __ Int32Constant(0);
+  Node* one = __ Int32Constant(1);
+
+  auto done = __ MakeLabel(MachineRepresentation::kBit);
+
+  // Check if {object} is a Smi.
+  __ GotoIf(ObjectIsSmi(object), &done, one);
+
+  // Check if {object} is a HeapNumber.
+  Node* value_map = __ LoadField(AccessBuilder::ForMap(), object);
+  __ GotoIfNot(__ WordEqual(value_map, __ HeapNumberMapConstant()), &done,
+               zero);
+
+  // {object} is a HeapNumber.
+  Node* value = __ LoadField(AccessBuilder::ForHeapNumberValue(), object);
+  Node* diff = __ Float64Sub(value, value);
+  Node* check = __ Float64Equal(diff, diff);
+  __ Goto(&done, check);
+
+  __ Bind(&done);
+  return done.PhiAt(0);
+}
+
+Node* EffectControlLinearizer::LowerNumberIsInteger(Node* node) {
+  Node* number = node->InputAt(0);
+  Node* trunc = BuildFloat64RoundTruncate(number);
+  Node* diff = __ Float64Sub(number, trunc);
+  Node* check = __ Float64Equal(diff, __ Float64Constant(0));
+  return check;
+}
+
+Node* EffectControlLinearizer::LowerObjectIsInteger(Node* node) {
+  Node* object = node->InputAt(0);
+  Node* zero = __ Int32Constant(0);
+  Node* one = __ Int32Constant(1);
+
+  auto done = __ MakeLabel(MachineRepresentation::kBit);
+
+  // Check if {object} is a Smi.
+  __ GotoIf(ObjectIsSmi(object), &done, one);
+
+  // Check if {object} is a HeapNumber.
+  Node* value_map = __ LoadField(AccessBuilder::ForMap(), object);
+  __ GotoIfNot(__ WordEqual(value_map, __ HeapNumberMapConstant()), &done,
+               zero);
+
+  // {object} is a HeapNumber.
+  Node* value = __ LoadField(AccessBuilder::ForHeapNumberValue(), object);
+  Node* trunc = BuildFloat64RoundTruncate(value);
+  Node* diff = __ Float64Sub(value, trunc);
+  Node* check = __ Float64Equal(diff, __ Float64Constant(0));
+  __ Goto(&done, check);
+
+  __ Bind(&done);
+  return done.PhiAt(0);
+}
+
+Node* EffectControlLinearizer::LowerNumberIsSafeInteger(Node* node) {
+  Node* number = node->InputAt(0);
+  Node* zero = __ Int32Constant(0);
+  auto done = __ MakeLabel(MachineRepresentation::kBit);
+
+  Node* trunc = BuildFloat64RoundTruncate(number);
+  Node* diff = __ Float64Sub(number, trunc);
+  Node* check = __ Float64Equal(diff, __ Float64Constant(0));
+  __ GotoIfNot(check, &done, zero);
+  Node* in_range = __ Float64LessThanOrEqual(
+      __ Float64Abs(trunc), __ Float64Constant(kMaxSafeInteger));
+  __ Goto(&done, in_range);
+
+  __ Bind(&done);
+  return done.PhiAt(0);
+}
+
+Node* EffectControlLinearizer::LowerObjectIsSafeInteger(Node* node) {
+  Node* object = node->InputAt(0);
+  Node* zero = __ Int32Constant(0);
+  Node* one = __ Int32Constant(1);
+
+  auto done = __ MakeLabel(MachineRepresentation::kBit);
+
+  // Check if {object} is a Smi.
+  __ GotoIf(ObjectIsSmi(object), &done, one);
+
+  // Check if {object} is a HeapNumber.
+  Node* value_map = __ LoadField(AccessBuilder::ForMap(), object);
+  __ GotoIfNot(__ WordEqual(value_map, __ HeapNumberMapConstant()), &done,
+               zero);
+
+  // {object} is a HeapNumber.
+  Node* value = __ LoadField(AccessBuilder::ForHeapNumberValue(), object);
+  Node* trunc = BuildFloat64RoundTruncate(value);
+  Node* diff = __ Float64Sub(value, trunc);
+  Node* check = __ Float64Equal(diff, __ Float64Constant(0));
+  __ GotoIfNot(check, &done, zero);
+  Node* in_range = __ Float64LessThanOrEqual(
+      __ Float64Abs(trunc), __ Float64Constant(kMaxSafeInteger));
+  __ Goto(&done, in_range);
+
+  __ Bind(&done);
+  return done.PhiAt(0);
+}
+
 Node* EffectControlLinearizer::LowerObjectIsMinusZero(Node* node) {
   Node* value = node->InputAt(0);
   Node* zero = __ Int32Constant(0);
@@ -2379,21 +2480,9 @@ Node* EffectControlLinearizer::LowerTypeOf(Node* node) {
   Callable const callable = Builtins::CallableFor(isolate(), Builtins::kTypeof);
   Operator::Properties const properties = Operator::kEliminatable;
   CallDescriptor::Flags const flags = CallDescriptor::kNoAllocate;
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
-  return __ Call(desc, __ HeapConstant(callable.code()), obj,
-                 __ NoContextConstant());
-}
-
-Node* EffectControlLinearizer::LowerClassOf(Node* node) {
-  Node* obj = node->InputAt(0);
-  Callable const callable =
-      Builtins::CallableFor(isolate(), Builtins::kClassOf);
-  Operator::Properties const properties = Operator::kEliminatable;
-  CallDescriptor::Flags const flags = CallDescriptor::kNoAllocate;
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
-  return __ Call(desc, __ HeapConstant(callable.code()), obj,
+  return __ Call(call_descriptor, __ HeapConstant(callable.code()), obj,
                  __ NoContextConstant());
 }
 
@@ -2403,9 +2492,9 @@ Node* EffectControlLinearizer::LowerToBoolean(Node* node) {
       Builtins::CallableFor(isolate(), Builtins::kToBoolean);
   Operator::Properties const properties = Operator::kEliminatable;
   CallDescriptor::Flags const flags = CallDescriptor::kNoAllocate;
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
-  return __ Call(desc, __ HeapConstant(callable.code()), obj,
+  return __ Call(call_descriptor, __ HeapConstant(callable.code()), obj,
                  __ NoContextConstant());
 }
 
@@ -2577,16 +2666,16 @@ Node* EffectControlLinearizer::LowerNewSmiOrObjectElements(Node* node) {
 Node* EffectControlLinearizer::LowerNewArgumentsElements(Node* node) {
   Node* frame = NodeProperties::GetValueInput(node, 0);
   Node* length = NodeProperties::GetValueInput(node, 1);
-  int mapped_count = OpParameter<int>(node);
+  int mapped_count = NewArgumentsElementsMappedCountOf(node->op());
 
   Callable const callable =
       Builtins::CallableFor(isolate(), Builtins::kNewArgumentsElements);
   Operator::Properties const properties = node->op()->properties();
   CallDescriptor::Flags const flags = CallDescriptor::kNoFlags;
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
-  return __ Call(desc, __ HeapConstant(callable.code()), frame, length,
-                 __ SmiConstant(mapped_count), __ NoContextConstant());
+  return __ Call(call_descriptor, __ HeapConstant(callable.code()), frame,
+                 length, __ SmiConstant(mapped_count), __ NoContextConstant());
 }
 
 Node* EffectControlLinearizer::LowerNewConsString(Node* node) {
@@ -2656,9 +2745,9 @@ Node* EffectControlLinearizer::LowerSameValue(Node* node) {
       Builtins::CallableFor(isolate(), Builtins::kSameValue);
   Operator::Properties properties = Operator::kEliminatable;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
-  return __ Call(desc, __ HeapConstant(callable.code()), lhs, rhs,
+  return __ Call(call_descriptor, __ HeapConstant(callable.code()), lhs, rhs,
                  __ NoContextConstant());
 }
 
@@ -2678,58 +2767,174 @@ Node* EffectControlLinearizer::LowerStringToNumber(Node* node) {
       Builtins::CallableFor(isolate(), Builtins::kStringToNumber);
   Operator::Properties properties = Operator::kEliminatable;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
-  return __ Call(desc, __ HeapConstant(callable.code()), string,
+  return __ Call(call_descriptor, __ HeapConstant(callable.code()), string,
                  __ NoContextConstant());
 }
 
-Node* EffectControlLinearizer::LowerStringCharAt(Node* node) {
+Node* EffectControlLinearizer::LowerStringCharCodeAt(Node* node) {
   Node* receiver = node->InputAt(0);
   Node* position = node->InputAt(1);
 
-  Callable const callable =
-      Builtins::CallableFor(isolate(), Builtins::kStringCharAt);
-  Operator::Properties properties = Operator::kNoThrow | Operator::kNoWrite;
-  CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
-  return __ Call(desc, __ HeapConstant(callable.code()), receiver, position,
-                 __ NoContextConstant());
-}
+  // We need a loop here to properly deal with indirect strings
+  // (SlicedString, ConsString and ThinString).
+  auto loop = __ MakeLoopLabel(MachineRepresentation::kTagged,
+                               MachineRepresentation::kWord32);
+  auto loop_next = __ MakeLabel(MachineRepresentation::kTagged,
+                                MachineRepresentation::kWord32);
+  auto loop_done = __ MakeLabel(MachineRepresentation::kWord32);
+  __ Goto(&loop, receiver, position);
+  __ Bind(&loop);
+  {
+    Node* receiver = loop.PhiAt(0);
+    Node* position = loop.PhiAt(1);
+    Node* receiver_map = __ LoadField(AccessBuilder::ForMap(), receiver);
+    Node* receiver_instance_type =
+        __ LoadField(AccessBuilder::ForMapInstanceType(), receiver_map);
+    Node* receiver_representation = __ Word32And(
+        receiver_instance_type, __ Int32Constant(kStringRepresentationMask));
+
+    // Dispatch on the current {receiver}s string representation.
+    auto if_seqstring = __ MakeLabel();
+    auto if_consstring = __ MakeLabel();
+    auto if_thinstring = __ MakeLabel();
+    auto if_externalstring = __ MakeLabel();
+    auto if_slicedstring = __ MakeLabel();
+    auto if_runtime = __ MakeDeferredLabel();
+    __ GotoIf(__ Word32Equal(receiver_representation,
+                             __ Int32Constant(kSeqStringTag)),
+              &if_seqstring);
+    __ GotoIf(__ Word32Equal(receiver_representation,
+                             __ Int32Constant(kConsStringTag)),
+              &if_consstring);
+    __ GotoIf(__ Word32Equal(receiver_representation,
+                             __ Int32Constant(kThinStringTag)),
+              &if_thinstring);
+    __ GotoIf(__ Word32Equal(receiver_representation,
+                             __ Int32Constant(kExternalStringTag)),
+              &if_externalstring);
+    __ Branch(__ Word32Equal(receiver_representation,
+                             __ Int32Constant(kSlicedStringTag)),
+              &if_slicedstring, &if_runtime);
+
+    __ Bind(&if_seqstring);
+    {
+      Node* receiver_is_onebyte = __ Word32Equal(
+          __ Word32Equal(__ Word32And(receiver_instance_type,
+                                      __ Int32Constant(kStringEncodingMask)),
+                         __ Int32Constant(kTwoByteStringTag)),
+          __ Int32Constant(0));
+      Node* result = LoadFromSeqString(receiver, position, receiver_is_onebyte);
+      __ Goto(&loop_done, result);
+    }
 
-Node* EffectControlLinearizer::LowerStringCharCodeAt(Node* node) {
-  Node* receiver = node->InputAt(0);
-  Node* position = node->InputAt(1);
+    __ Bind(&if_thinstring);
+    {
+      Node* receiver_actual =
+          __ LoadField(AccessBuilder::ForThinStringActual(), receiver);
+      __ Goto(&loop_next, receiver_actual, position);
+    }
 
-  Callable const callable =
-      Builtins::CallableFor(isolate(), Builtins::kStringCharCodeAt);
-  Operator::Properties properties = Operator::kNoThrow | Operator::kNoWrite;
-  CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties,
-      MachineType::TaggedSigned());
-  return __ Call(desc, __ HeapConstant(callable.code()), receiver, position,
-                 __ NoContextConstant());
+    __ Bind(&if_consstring);
+    {
+      Node* receiver_second =
+          __ LoadField(AccessBuilder::ForConsStringSecond(), receiver);
+      __ GotoIfNot(__ WordEqual(receiver_second, __ EmptyStringConstant()),
+                   &if_runtime);
+      Node* receiver_first =
+          __ LoadField(AccessBuilder::ForConsStringFirst(), receiver);
+      __ Goto(&loop_next, receiver_first, position);
+    }
+
+    __ Bind(&if_externalstring);
+    {
+      // We need to bailout to the runtime for short external strings.
+      __ GotoIf(__ Word32Equal(
+                    __ Word32And(receiver_instance_type,
+                                 __ Int32Constant(kShortExternalStringMask)),
+                    __ Int32Constant(kShortExternalStringTag)),
+                &if_runtime);
+
+      Node* receiver_data = __ LoadField(
+          AccessBuilder::ForExternalStringResourceData(), receiver);
+
+      auto if_onebyte = __ MakeLabel();
+      auto if_twobyte = __ MakeLabel();
+      __ Branch(
+          __ Word32Equal(__ Word32And(receiver_instance_type,
+                                      __ Int32Constant(kStringEncodingMask)),
+                         __ Int32Constant(kTwoByteStringTag)),
+          &if_twobyte, &if_onebyte);
+
+      __ Bind(&if_onebyte);
+      {
+        Node* result = __ Load(MachineType::Uint8(), receiver_data,
+                               ChangeInt32ToIntPtr(position));
+        __ Goto(&loop_done, result);
+      }
+
+      __ Bind(&if_twobyte);
+      {
+        Node* result = __ Load(
+            MachineType::Uint16(), receiver_data,
+            __ Word32Shl(ChangeInt32ToIntPtr(position), __ Int32Constant(1)));
+        __ Goto(&loop_done, result);
+      }
+    }
+
+    __ Bind(&if_slicedstring);
+    {
+      Node* receiver_offset =
+          __ LoadField(AccessBuilder::ForSlicedStringOffset(), receiver);
+      Node* receiver_parent =
+          __ LoadField(AccessBuilder::ForSlicedStringParent(), receiver);
+      __ Goto(&loop_next, receiver_parent,
+              __ Int32Add(position, ChangeSmiToInt32(receiver_offset)));
+    }
+
+    __ Bind(&if_runtime);
+    {
+      Operator::Properties properties = Operator::kNoDeopt | Operator::kNoThrow;
+      Runtime::FunctionId id = Runtime::kStringCharCodeAt;
+      auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
+          graph()->zone(), id, 2, properties, CallDescriptor::kNoFlags);
+      Node* result =
+          __ Call(call_descriptor, __ CEntryStubConstant(1), receiver,
+                  ChangeInt32ToSmi(position),
+                  __ ExternalConstant(ExternalReference(id, isolate())),
+                  __ Int32Constant(2), __ NoContextConstant());
+      __ Goto(&loop_done, ChangeSmiToInt32(result));
+    }
+
+    __ Bind(&loop_next);
+    __ Goto(&loop, loop_next.PhiAt(0), loop_next.PhiAt(1));
+  }
+  __ Bind(&loop_done);
+  return loop_done.PhiAt(0);
 }
 
-Node* EffectControlLinearizer::LowerStringCodePointAt(Node* node) {
+Node* EffectControlLinearizer::LowerStringCodePointAt(
+    Node* node, UnicodeEncoding encoding) {
   Node* receiver = node->InputAt(0);
   Node* position = node->InputAt(1);
 
-  Callable const callable =
-      Builtins::CallableFor(isolate(), Builtins::kStringCodePointAt);
+  Builtins::Name builtin = encoding == UnicodeEncoding::UTF16
+                               ? Builtins::kStringCodePointAtUTF16
+                               : Builtins::kStringCodePointAtUTF32;
+
+  Callable const callable = Builtins::CallableFor(isolate(), builtin);
   Operator::Properties properties = Operator::kNoThrow | Operator::kNoWrite;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties,
       MachineType::TaggedSigned());
-  return __ Call(desc, __ HeapConstant(callable.code()), receiver, position,
-                 __ NoContextConstant());
+  return __ Call(call_descriptor, __ HeapConstant(callable.code()), receiver,
+                 position, __ NoContextConstant());
 }
 
-Node* EffectControlLinearizer::LoadFromString(Node* receiver, Node* position,
-                                              Node* is_one_byte) {
+Node* EffectControlLinearizer::LoadFromSeqString(Node* receiver, Node* position,
+                                                 Node* is_one_byte) {
   auto one_byte_load = __ MakeLabel();
   auto done = __ MakeLabel(MachineRepresentation::kWord32);
   __ GotoIf(is_one_byte, &one_byte_load);
@@ -2746,130 +2951,78 @@ Node* EffectControlLinearizer::LoadFromString(Node* receiver, Node* position,
   return done.PhiAt(0);
 }
 
-Node* EffectControlLinearizer::LowerSeqStringCharCodeAt(Node* node) {
-  Node* receiver = node->InputAt(0);
-  Node* position = node->InputAt(1);
-
-  Node* map = __ LoadField(AccessBuilder::ForMap(), receiver);
-  Node* instance_type = __ LoadField(AccessBuilder::ForMapInstanceType(), map);
-  Node* is_one_byte = __ Word32Equal(
-      __ Word32And(instance_type, __ Int32Constant(kStringEncodingMask)),
-      __ Int32Constant(kOneByteStringTag));
-
-  return LoadFromString(receiver, position, is_one_byte);
-}
-
-Node* EffectControlLinearizer::LowerSeqStringCodePointAt(
-    Node* node, UnicodeEncoding encoding) {
-  Node* receiver = node->InputAt(0);
-  Node* position = node->InputAt(1);
-
-  Node* map = __ LoadField(AccessBuilder::ForMap(), receiver);
-  Node* instance_type = __ LoadField(AccessBuilder::ForMapInstanceType(), map);
-  Node* is_one_byte = __ Word32Equal(
-      __ Word32And(instance_type, __ Int32Constant(kStringEncodingMask)),
-      __ Int32Constant(kOneByteStringTag));
-
-  Node* first_char_code = LoadFromString(receiver, position, is_one_byte);
-
-  auto return_result = __ MakeLabel(MachineRepresentation::kWord32);
-
-  // Check if first character code is outside of interval [0xD800, 0xDBFF].
-  Node* first_out =
-      __ Word32Equal(__ Word32And(first_char_code, __ Int32Constant(0xFC00)),
-                     __ Int32Constant(0xD800));
-  // Return first character code.
-  __ GotoIf(first_out, &return_result, first_char_code);
-  // Check if position + 1 is still in range.
-  Node* length = __ LoadField(AccessBuilder::ForStringLength(), receiver);
-  Node* next_position = __ Int32Add(position, __ Int32Constant(1));
-  Node* next_position_in_range = __ Int32LessThan(next_position, length);
-  __ GotoIf(next_position_in_range, &return_result, first_char_code);
-
-  // Load second character code.
-  Node* second_char_code = LoadFromString(receiver, next_position, is_one_byte);
-  // Check if first character code is outside of interval [0xD800, 0xDBFF].
-  Node* second_out =
-      __ Word32Equal(__ Word32And(second_char_code, __ Int32Constant(0xFC00)),
-                     __ Int32Constant(0xDC00));
-  __ GotoIfNot(second_out, &return_result, first_char_code);
-
-  Node* result;
-  switch (encoding) {
-    case UnicodeEncoding::UTF16:
-      result = __ Word32Or(
-// Need to swap the order for big-endian platforms
-#if V8_TARGET_BIG_ENDIAN
-          __ Word32Shl(first_char_code, __ Int32Constant(16)),
-          second_char_code);
-#else
-          __ Word32Shl(second_char_code, __ Int32Constant(16)),
-          first_char_code);
-#endif
-      break;
-    case UnicodeEncoding::UTF32: {
-      // Convert UTF16 surrogate pair into |word32| code point, encoded as
-      // UTF32.
-      Node* surrogate_offset =
-          __ Int32Constant(0x10000 - (0xD800 << 10) - 0xDC00);
-
-      // (lead << 10) + trail + SURROGATE_OFFSET
-      result = __ Int32Add(__ Word32Shl(first_char_code, __ Int32Constant(10)),
-                           __ Int32Add(second_char_code, surrogate_offset));
-      break;
-    }
-  }
-  __ Goto(&return_result, result);
-
-  __ Bind(&return_result);
-  return return_result.PhiAt(0);
-}
-
-Node* EffectControlLinearizer::LowerStringFromCharCode(Node* node) {
+Node* EffectControlLinearizer::LowerStringFromSingleCharCode(Node* node) {
   Node* value = node->InputAt(0);
+  Node* code = __ Word32And(value, __ Uint32Constant(0xFFFF));
 
-  auto runtime_call = __ MakeDeferredLabel();
-  auto if_undefined = __ MakeDeferredLabel();
+  auto if_not_one_byte = __ MakeDeferredLabel();
+  auto cache_miss = __ MakeDeferredLabel();
   auto done = __ MakeLabel(MachineRepresentation::kTagged);
 
-  // Compute the character code.
-  Node* code = __ Word32And(value, __ Int32Constant(String::kMaxUtf16CodeUnit));
+  // Check if the {code} is a one byte character
+  Node* check1 = __ Uint32LessThanOrEqual(
+      code, __ Uint32Constant(String::kMaxOneByteCharCode));
+  __ GotoIfNot(check1, &if_not_one_byte);
+  {
+    // Load the isolate wide single character string cache.
+    Node* cache = __ HeapConstant(factory()->single_character_string_cache());
+
+    // Compute the {cache} index for {code}.
+    Node* index = machine()->Is32() ? code : __ ChangeUint32ToUint64(code);
 
-  // Check if the {code} is a one-byte char code.
-  Node* check0 = __ Int32LessThanOrEqual(
-      code, __ Int32Constant(String::kMaxOneByteCharCode));
-  __ GotoIfNot(check0, &runtime_call);
+    // Check if we have an entry for the {code} in the single character string
+    // cache already.
+    Node* entry =
+        __ LoadElement(AccessBuilder::ForFixedArrayElement(), cache, index);
 
-  // Load the isolate wide single character string cache.
-  Node* cache = __ HeapConstant(factory()->single_character_string_cache());
+    Node* check2 = __ WordEqual(entry, __ UndefinedConstant());
+    __ GotoIf(check2, &cache_miss);
 
-  // Compute the {cache} index for {code}.
-  Node* index = machine()->Is32() ? code : __ ChangeUint32ToUint64(code);
+    // Use the {entry} from the {cache}.
+    __ Goto(&done, entry);
 
-  // Check if we have an entry for the {code} in the single character string
-  // cache already.
-  Node* entry =
-      __ LoadElement(AccessBuilder::ForFixedArrayElement(), cache, index);
+    __ Bind(&cache_miss);
+    {
+      // Allocate a new SeqOneByteString for {code}.
+      Node* vtrue2 = __ Allocate(
+          NOT_TENURED, __ Int32Constant(SeqOneByteString::SizeFor(1)));
+      __ StoreField(AccessBuilder::ForMap(), vtrue2,
+                    __ HeapConstant(factory()->one_byte_string_map()));
+      __ StoreField(AccessBuilder::ForNameHashField(), vtrue2,
+                    __ IntPtrConstant(Name::kEmptyHashField));
+      __ StoreField(AccessBuilder::ForStringLength(), vtrue2,
+                    __ SmiConstant(1));
+      __ Store(
+          StoreRepresentation(MachineRepresentation::kWord8, kNoWriteBarrier),
+          vtrue2,
+          __ IntPtrConstant(SeqOneByteString::kHeaderSize - kHeapObjectTag),
+          code);
 
-  Node* check1 = __ WordEqual(entry, __ UndefinedConstant());
-  __ GotoIf(check1, &runtime_call);
-  __ Goto(&done, entry);
+      // Remember it in the {cache}.
+      __ StoreElement(AccessBuilder::ForFixedArrayElement(), cache, index,
+                      vtrue2);
+      __ Goto(&done, vtrue2);
+    }
+  }
 
-  // Let %StringFromCharCode handle this case.
-  // TODO(turbofan): At some point we may consider adding a stub for this
-  // deferred case, so that we don't need to call to C++ here.
-  __ Bind(&runtime_call);
+  __ Bind(&if_not_one_byte);
   {
-    Operator::Properties properties = Operator::kNoDeopt | Operator::kNoThrow;
-    Runtime::FunctionId id = Runtime::kStringCharFromCode;
-    CallDescriptor const* desc = Linkage::GetRuntimeCallDescriptor(
-        graph()->zone(), id, 1, properties, CallDescriptor::kNoFlags);
-    Node* vtrue1 =
-        __ Call(desc, __ CEntryStubConstant(1), ChangeInt32ToSmi(code),
-                __ ExternalConstant(ExternalReference(id, isolate())),
-                __ Int32Constant(1), __ NoContextConstant());
-    __ Goto(&done, vtrue1);
+    // Allocate a new SeqTwoByteString for {code}.
+    Node* vfalse1 = __ Allocate(NOT_TENURED,
+                                __ Int32Constant(SeqTwoByteString::SizeFor(1)));
+    __ StoreField(AccessBuilder::ForMap(), vfalse1,
+                  __ HeapConstant(factory()->string_map()));
+    __ StoreField(AccessBuilder::ForNameHashField(), vfalse1,
+                  __ IntPtrConstant(Name::kEmptyHashField));
+    __ StoreField(AccessBuilder::ForStringLength(), vfalse1, __ SmiConstant(1));
+    __ Store(
+        StoreRepresentation(MachineRepresentation::kWord16, kNoWriteBarrier),
+        vfalse1,
+        __ IntPtrConstant(SeqTwoByteString::kHeaderSize - kHeapObjectTag),
+        code);
+    __ Goto(&done, vfalse1);
   }
+
   __ Bind(&done);
   return done.PhiAt(0);
 }
@@ -2883,9 +3036,9 @@ Node* EffectControlLinearizer::LowerStringToLowerCaseIntl(Node* node) {
       Builtins::CallableFor(isolate(), Builtins::kStringToLowerCaseIntl);
   Operator::Properties properties = Operator::kNoDeopt | Operator::kNoThrow;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
-  return __ Call(desc, __ HeapConstant(callable.code()), receiver,
+  return __ Call(call_descriptor, __ HeapConstant(callable.code()), receiver,
                  __ NoContextConstant());
 }
 
@@ -2893,9 +3046,9 @@ Node* EffectControlLinearizer::LowerStringToUpperCaseIntl(Node* node) {
   Node* receiver = node->InputAt(0);
   Operator::Properties properties = Operator::kNoDeopt | Operator::kNoThrow;
   Runtime::FunctionId id = Runtime::kStringToUpperCaseIntl;
-  CallDescriptor const* desc = Linkage::GetRuntimeCallDescriptor(
+  auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
       graph()->zone(), id, 1, properties, CallDescriptor::kNoFlags);
-  return __ Call(desc, __ CEntryStubConstant(1), receiver,
+  return __ Call(call_descriptor, __ CEntryStubConstant(1), receiver,
                  __ ExternalConstant(ExternalReference(id, isolate())),
                  __ Int32Constant(1), __ NoContextConstant());
 }
@@ -2914,7 +3067,7 @@ Node* EffectControlLinearizer::LowerStringToUpperCaseIntl(Node* node) {
 
 #endif  // V8_INTL_SUPPORT
 
-Node* EffectControlLinearizer::LowerStringFromCodePoint(Node* node) {
+Node* EffectControlLinearizer::LowerStringFromSingleCodePoint(Node* node) {
   Node* value = node->InputAt(0);
   Node* code = value;
 
@@ -3048,10 +3201,10 @@ Node* EffectControlLinearizer::LowerStringIndexOf(Node* node) {
       Builtins::CallableFor(isolate(), Builtins::kStringIndexOf);
   Operator::Properties properties = Operator::kEliminatable;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
-  return __ Call(desc, __ HeapConstant(callable.code()), subject, search_string,
-                 position, __ NoContextConstant());
+  return __ Call(call_descriptor, __ HeapConstant(callable.code()), subject,
+                 search_string, position, __ NoContextConstant());
 }
 
 Node* EffectControlLinearizer::LowerStringLength(Node* node) {
@@ -3067,12 +3220,27 @@ Node* EffectControlLinearizer::LowerStringComparison(Callable const& callable,
 
   Operator::Properties properties = Operator::kEliminatable;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
-  return __ Call(desc, __ HeapConstant(callable.code()), lhs, rhs,
+  return __ Call(call_descriptor, __ HeapConstant(callable.code()), lhs, rhs,
                  __ NoContextConstant());
 }
 
+Node* EffectControlLinearizer::LowerStringSubstring(Node* node) {
+  Node* receiver = node->InputAt(0);
+  Node* start = ChangeInt32ToIntPtr(node->InputAt(1));
+  Node* end = ChangeInt32ToIntPtr(node->InputAt(2));
+
+  Callable callable =
+      Builtins::CallableFor(isolate(), Builtins::kStringSubstring);
+  Operator::Properties properties = Operator::kEliminatable;
+  CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
+      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
+  return __ Call(call_descriptor, __ HeapConstant(callable.code()), receiver,
+                 start, end, __ NoContextConstant());
+}
+
 Node* EffectControlLinearizer::LowerStringEqual(Node* node) {
   return LowerStringComparison(
       Builtins::CallableFor(isolate(), Builtins::kStringEqual), node);
@@ -3176,10 +3344,10 @@ void EffectControlLinearizer::LowerCheckEqualsInternalizedString(
       builder.AddParam(MachineType::AnyTagged());
       Node* try_internalize_string_function = __ ExternalConstant(
           ExternalReference::try_internalize_string_function(isolate()));
-      CallDescriptor const* const desc =
+      auto call_descriptor =
           Linkage::GetSimplifiedCDescriptor(graph()->zone(), builder.Build());
-      Node* val_internalized =
-          __ Call(common()->Call(desc), try_internalize_string_function, val);
+      Node* val_internalized = __ Call(common()->Call(call_descriptor),
+                                       try_internalize_string_function, val);
 
       // Now see if the results match.
       __ DeoptimizeIfNot(DeoptimizeReason::kWrongName, VectorSlotPair(),
@@ -3218,10 +3386,14 @@ Node* EffectControlLinearizer::AllocateHeapNumberWithValue(Node* value) {
 }
 
 Node* EffectControlLinearizer::ChangeInt32ToSmi(Node* value) {
+  return __ WordShl(ChangeInt32ToIntPtr(value), SmiShiftBitsConstant());
+}
+
+Node* EffectControlLinearizer::ChangeInt32ToIntPtr(Node* value) {
   if (machine()->Is64()) {
     value = __ ChangeInt32ToInt64(value);
   }
-  return __ WordShl(value, SmiShiftBitsConstant());
+  return value;
 }
 
 Node* EffectControlLinearizer::ChangeIntPtrToInt32(Node* value) {
@@ -3350,10 +3522,10 @@ Node* EffectControlLinearizer::LowerEnsureWritableFastElements(Node* node) {
   Callable callable =
       Builtins::CallableFor(isolate(), Builtins::kCopyFastSmiOrObjectElements);
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-  CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
-  Node* result = __ Call(desc, __ HeapConstant(callable.code()), object,
-                         __ NoContextConstant());
+  Node* result = __ Call(call_descriptor, __ HeapConstant(callable.code()),
+                         object, __ NoContextConstant());
   __ Goto(&done, result);
 
   __ Bind(&done);
@@ -3386,11 +3558,12 @@ Node* EffectControlLinearizer::LowerMaybeGrowFastElements(Node* node,
           : Builtins::CallableFor(isolate(),
                                   Builtins::kGrowFastSmiOrObjectElements);
   CallDescriptor::Flags call_flags = CallDescriptor::kNoFlags;
-  CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), callable.descriptor(), 0, call_flags,
       properties);
-  Node* new_elements = __ Call(desc, __ HeapConstant(callable.code()), object,
-                               ChangeInt32ToSmi(index), __ NoContextConstant());
+  Node* new_elements =
+      __ Call(call_descriptor, __ HeapConstant(callable.code()), object,
+              ChangeInt32ToSmi(index), __ NoContextConstant());
 
   // Ensure that we were able to grow the {elements}.
   __ DeoptimizeIf(DeoptimizeReason::kCouldNotGrowElements, params.feedback(),
@@ -3429,9 +3602,9 @@ void EffectControlLinearizer::LowerTransitionElementsKind(Node* node) {
       // Instance migration, call out to the runtime for {object}.
       Operator::Properties properties = Operator::kNoDeopt | Operator::kNoThrow;
       Runtime::FunctionId id = Runtime::kTransitionElementsKind;
-      CallDescriptor const* desc = Linkage::GetRuntimeCallDescriptor(
+      auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
           graph()->zone(), id, 2, properties, CallDescriptor::kNoFlags);
-      __ Call(desc, __ CEntryStubConstant(1), object, target_map,
+      __ Call(call_descriptor, __ CEntryStubConstant(1), object, target_map,
               __ ExternalConstant(ExternalReference(id, isolate())),
               __ Int32Constant(2), __ NoContextConstant());
       break;
@@ -3557,8 +3730,9 @@ Node* EffectControlLinearizer::LowerLoadTypedElement(Node* node) {
   // Compute the effective storage pointer, handling the case where the
   // {external} pointer is the effective storage pointer (i.e. the {base}
   // is Smi zero).
-  Node* storage = NumberMatcher(base).Is(0) ? external : __ UnsafePointerAdd(
-                                                             base, external);
+  Node* storage = IntPtrMatcher(base).Is(0)
+                      ? external
+                      : __ UnsafePointerAdd(base, external);
 
   // Perform the actual typed element access.
   return __ LoadElement(AccessBuilder::ForTypedArrayElement(array_type, true),
@@ -3580,8 +3754,9 @@ void EffectControlLinearizer::LowerStoreTypedElement(Node* node) {
   // Compute the effective storage pointer, handling the case where the
   // {external} pointer is the effective storage pointer (i.e. the {base}
   // is Smi zero).
-  Node* storage = NumberMatcher(base).Is(0) ? external : __ UnsafePointerAdd(
-                                                             base, external);
+  Node* storage = IntPtrMatcher(base).Is(0)
+                      ? external
+                      : __ UnsafePointerAdd(base, external);
 
   // Perform the actual typed element access.
   __ StoreElement(AccessBuilder::ForTypedArrayElement(array_type, true),
@@ -3604,9 +3779,9 @@ void EffectControlLinearizer::TransitionElementsTo(Node* node, Node* array,
     // Instance migration, call out to the runtime for {array}.
     Operator::Properties properties = Operator::kNoDeopt | Operator::kNoThrow;
     Runtime::FunctionId id = Runtime::kTransitionElementsKind;
-    CallDescriptor const* desc = Linkage::GetRuntimeCallDescriptor(
+    auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
         graph()->zone(), id, 2, properties, CallDescriptor::kNoFlags);
-    __ Call(desc, __ CEntryStubConstant(1), array, target_map,
+    __ Call(call_descriptor, __ CEntryStubConstant(1), array, target_map,
             __ ExternalConstant(ExternalReference(id, isolate())),
             __ Int32Constant(2), __ NoContextConstant());
   }
@@ -3951,9 +4126,9 @@ void EffectControlLinearizer::LowerRuntimeAbort(Node* node) {
   AbortReason reason = AbortReasonOf(node->op());
   Operator::Properties properties = Operator::kNoDeopt | Operator::kNoThrow;
   Runtime::FunctionId id = Runtime::kAbort;
-  CallDescriptor const* desc = Linkage::GetRuntimeCallDescriptor(
+  auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
       graph()->zone(), id, 1, properties, CallDescriptor::kNoFlags);
-  __ Call(desc, __ CEntryStubConstant(1),
+  __ Call(call_descriptor, __ CEntryStubConstant(1),
           jsgraph()->SmiConstant(static_cast<int>(reason)),
           __ ExternalConstant(ExternalReference(id, isolate())),
           __ Int32Constant(1), __ NoContextConstant());
@@ -3988,13 +4163,13 @@ Node* EffectControlLinearizer::LowerConvertReceiver(Node* node) {
       Operator::Properties properties = Operator::kEliminatable;
       Callable callable = Builtins::CallableFor(isolate(), Builtins::kToObject);
       CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-      CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
+      auto call_descriptor = Linkage::GetStubCallDescriptor(
           isolate(), graph()->zone(), callable.descriptor(), 0, flags,
           properties);
       Node* native_context = __ LoadField(
           AccessBuilder::ForJSGlobalProxyNativeContext(), global_proxy);
-      Node* result = __ Call(desc, __ HeapConstant(callable.code()), value,
-                             native_context);
+      Node* result = __ Call(call_descriptor, __ HeapConstant(callable.code()),
+                             value, native_context);
       __ Goto(&done_convert, result);
 
       __ Bind(&done_convert);
@@ -4024,13 +4199,13 @@ Node* EffectControlLinearizer::LowerConvertReceiver(Node* node) {
       Operator::Properties properties = Operator::kEliminatable;
       Callable callable = Builtins::CallableFor(isolate(), Builtins::kToObject);
       CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-      CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
+      auto call_descriptor = Linkage::GetStubCallDescriptor(
           isolate(), graph()->zone(), callable.descriptor(), 0, flags,
           properties);
       Node* native_context = __ LoadField(
           AccessBuilder::ForJSGlobalProxyNativeContext(), global_proxy);
-      Node* result = __ Call(desc, __ HeapConstant(callable.code()), value,
-                             native_context);
+      Node* result = __ Call(call_descriptor, __ HeapConstant(callable.code()),
+                             value, native_context);
       __ Goto(&done_convert, result);
 
       // Replace the {value} with the {global_proxy}.
@@ -4135,9 +4310,8 @@ Maybe<Node*> EffectControlLinearizer::LowerFloat64RoundUp(Node* node) {
 }
 
 Node* EffectControlLinearizer::BuildFloat64RoundDown(Node* value) {
-  Node* round_down = __ Float64RoundDown(value);
-  if (round_down != nullptr) {
-    return round_down;
+  if (machine()->Float64RoundDown().IsSupported()) {
+    return __ Float64RoundDown(value);
   }
 
   Node* const input = value;
@@ -4281,14 +4455,10 @@ Maybe<Node*> EffectControlLinearizer::LowerFloat64RoundTiesEven(Node* node) {
   return Just(done.PhiAt(0));
 }
 
-Maybe<Node*> EffectControlLinearizer::LowerFloat64RoundTruncate(Node* node) {
-  // Nothing to be done if a fast hardware instruction is available.
+Node* EffectControlLinearizer::BuildFloat64RoundTruncate(Node* input) {
   if (machine()->Float64RoundTruncate().IsSupported()) {
-    return Nothing<Node*>();
+    return __ Float64RoundTruncate(input);
   }
-
-  Node* const input = node->InputAt(0);
-
   // General case for trunc.
   //
   //   if 0.0 < input then
@@ -4369,7 +4539,17 @@ Maybe<Node*> EffectControlLinearizer::LowerFloat64RoundTruncate(Node* node) {
     __ Goto(&done, input);
   }
   __ Bind(&done);
-  return Just(done.PhiAt(0));
+  return done.PhiAt(0);
+}
+
+Maybe<Node*> EffectControlLinearizer::LowerFloat64RoundTruncate(Node* node) {
+  // Nothing to be done if a fast hardware instruction is available.
+  if (machine()->Float64RoundTruncate().IsSupported()) {
+    return Nothing<Node*>();
+  }
+
+  Node* const input = node->InputAt(0);
+  return Just(BuildFloat64RoundTruncate(input));
 }
 
 Node* EffectControlLinearizer::LowerFindOrderedHashMapEntry(Node* node) {
@@ -4381,11 +4561,11 @@ Node* EffectControlLinearizer::LowerFindOrderedHashMapEntry(Node* node) {
         Builtins::CallableFor(isolate(), Builtins::kFindOrderedHashMapEntry);
     Operator::Properties const properties = node->op()->properties();
     CallDescriptor::Flags const flags = CallDescriptor::kNoFlags;
-    CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
         isolate(), graph()->zone(), callable.descriptor(), 0, flags,
         properties);
-    return __ Call(desc, __ HeapConstant(callable.code()), table, key,
-                   __ NoContextConstant());
+    return __ Call(call_descriptor, __ HeapConstant(callable.code()), table,
+                   key, __ NoContextConstant());
   }
 }
 
diff --git a/deps/v8/src/compiler/effect-control-linearizer.h b/deps/v8/src/compiler/effect-control-linearizer.h
index 47b1586d6d9..4bab19ebcbd 100644
--- a/deps/v8/src/compiler/effect-control-linearizer.h
+++ b/deps/v8/src/compiler/effect-control-linearizer.h
@@ -63,7 +63,6 @@ class V8_EXPORT_PRIVATE EffectControlLinearizer {
   Node* LowerCheckNumber(Node* node, Node* frame_state);
   Node* LowerCheckReceiver(Node* node, Node* frame_state);
   Node* LowerCheckString(Node* node, Node* frame_state);
-  Node* LowerCheckSeqString(Node* node, Node* frame_state);
   Node* LowerCheckSymbol(Node* node, Node* frame_state);
   void LowerCheckIf(Node* node, Node* frame_state);
   Node* LowerCheckedInt32Add(Node* node, Node* frame_state);
@@ -106,6 +105,12 @@ class V8_EXPORT_PRIVATE EffectControlLinearizer {
   Node* LowerObjectIsSymbol(Node* node);
   Node* LowerObjectIsUndetectable(Node* node);
   Node* LowerNumberIsFloat64Hole(Node* node);
+  Node* LowerNumberIsFinite(Node* node);
+  Node* LowerObjectIsFiniteNumber(Node* node);
+  Node* LowerNumberIsInteger(Node* node);
+  Node* LowerObjectIsInteger(Node* node);
+  Node* LowerNumberIsSafeInteger(Node* node);
+  Node* LowerObjectIsSafeInteger(Node* node);
   Node* LowerArgumentsFrame(Node* node);
   Node* LowerArgumentsLength(Node* node);
   Node* LowerNewDoubleElements(Node* node);
@@ -116,16 +121,14 @@ class V8_EXPORT_PRIVATE EffectControlLinearizer {
   Node* LowerSameValue(Node* node);
   Node* LowerDeadValue(Node* node);
   Node* LowerStringToNumber(Node* node);
-  Node* LowerStringCharAt(Node* node);
   Node* LowerStringCharCodeAt(Node* node);
-  Node* LowerSeqStringCharCodeAt(Node* node);
-  Node* LowerStringCodePointAt(Node* node);
-  Node* LowerSeqStringCodePointAt(Node* node, UnicodeEncoding encoding);
+  Node* LowerStringCodePointAt(Node* node, UnicodeEncoding encoding);
   Node* LowerStringToLowerCaseIntl(Node* node);
   Node* LowerStringToUpperCaseIntl(Node* node);
-  Node* LowerStringFromCharCode(Node* node);
-  Node* LowerStringFromCodePoint(Node* node);
+  Node* LowerStringFromSingleCharCode(Node* node);
+  Node* LowerStringFromSingleCodePoint(Node* node);
   Node* LowerStringIndexOf(Node* node);
+  Node* LowerStringSubstring(Node* node);
   Node* LowerStringLength(Node* node);
   Node* LowerStringEqual(Node* node);
   Node* LowerStringLessThan(Node* node);
@@ -136,7 +139,6 @@ class V8_EXPORT_PRIVATE EffectControlLinearizer {
   void LowerCheckEqualsInternalizedString(Node* node, Node* frame_state);
   void LowerCheckEqualsSymbol(Node* node, Node* frame_state);
   Node* LowerTypeOf(Node* node);
-  Node* LowerClassOf(Node* node);
   Node* LowerToBoolean(Node* node);
   Node* LowerPlainPrimitiveToNumber(Node* node);
   Node* LowerPlainPrimitiveToWord32(Node* node);
@@ -171,18 +173,20 @@ class V8_EXPORT_PRIVATE EffectControlLinearizer {
                                                  Node* value,
                                                  Node* frame_state);
   Node* BuildFloat64RoundDown(Node* value);
+  Node* BuildFloat64RoundTruncate(Node* input);
   Node* ComputeIntegerHash(Node* value);
   Node* LowerStringComparison(Callable const& callable, Node* node);
   Node* IsElementsKindGreaterThan(Node* kind, ElementsKind reference_kind);
 
   Node* ChangeInt32ToSmi(Node* value);
+  Node* ChangeInt32ToIntPtr(Node* value);
   Node* ChangeIntPtrToInt32(Node* value);
   Node* ChangeUint32ToUintPtr(Node* value);
   Node* ChangeUint32ToSmi(Node* value);
   Node* ChangeSmiToIntPtr(Node* value);
   Node* ChangeSmiToInt32(Node* value);
   Node* ObjectIsSmi(Node* value);
-  Node* LoadFromString(Node* receiver, Node* position, Node* is_one_byte);
+  Node* LoadFromSeqString(Node* receiver, Node* position, Node* is_one_byte);
 
   Node* SmiMaxValueConstant();
   Node* SmiShiftBitsConstant();
diff --git a/deps/v8/src/compiler/escape-analysis-reducer.cc b/deps/v8/src/compiler/escape-analysis-reducer.cc
index 16a9d78fafa..81da548ca26 100644
--- a/deps/v8/src/compiler/escape-analysis-reducer.cc
+++ b/deps/v8/src/compiler/escape-analysis-reducer.cc
@@ -218,9 +218,8 @@ void EscapeAnalysisReducer::VerifyReplacement() const {
       if (const VirtualObject* vobject =
               analysis_result().GetVirtualObject(node)) {
         if (!vobject->HasEscaped()) {
-          V8_Fatal(__FILE__, __LINE__,
-                   "Escape analysis failed to remove node %s#%d\n",
-                   node->op()->mnemonic(), node->id());
+          FATAL("Escape analysis failed to remove node %s#%d\n",
+                node->op()->mnemonic(), node->id());
         }
       }
     }
@@ -229,8 +228,7 @@ void EscapeAnalysisReducer::VerifyReplacement() const {
 
 void EscapeAnalysisReducer::Finalize() {
   for (Node* node : arguments_elements_) {
-    DCHECK_EQ(IrOpcode::kNewArgumentsElements, node->opcode());
-    int mapped_count = OpParameter<int>(node);
+    int mapped_count = NewArgumentsElementsMappedCountOf(node->op());
 
     Node* arguments_frame = NodeProperties::GetValueInput(node, 0);
     if (arguments_frame->opcode() != IrOpcode::kArgumentsFrame) continue;
diff --git a/deps/v8/src/compiler/frame-states.cc b/deps/v8/src/compiler/frame-states.cc
index 0a0e3ec8689..7d55cc29d30 100644
--- a/deps/v8/src/compiler/frame-states.cc
+++ b/deps/v8/src/compiler/frame-states.cc
@@ -79,12 +79,15 @@ std::ostream& operator<<(std::ostream& os, FrameStateInfo const& info) {
 }
 
 namespace {
+
 Node* CreateBuiltinContinuationFrameStateCommon(
-    JSGraph* js_graph, Builtins::Name name, Node* context, Node** parameters,
-    int parameter_count, Node* outer_frame_state, Handle<JSFunction> function) {
-  Isolate* isolate = js_graph->isolate();
-  Graph* graph = js_graph->graph();
-  CommonOperatorBuilder* common = js_graph->common();
+    JSGraph* jsgraph, FrameStateType frame_type, Builtins::Name name,
+    Node* closure, Node* context, Node** parameters, int parameter_count,
+    Node* outer_frame_state,
+    Handle<SharedFunctionInfo> shared = Handle<SharedFunctionInfo>()) {
+  Isolate* const isolate = jsgraph->isolate();
+  Graph* const graph = jsgraph->graph();
+  CommonOperatorBuilder* const common = jsgraph->common();
 
   BailoutId bailout_id = Builtins::GetContinuationBailoutId(name);
   Callable callable = Builtins::CallableFor(isolate, name);
@@ -93,35 +96,26 @@ Node* CreateBuiltinContinuationFrameStateCommon(
       common->StateValues(parameter_count, SparseInputMask::Dense());
   Node* params_node = graph->NewNode(op_param, parameter_count, parameters);
 
-  FrameStateType frame_type =
-      function.is_null() ? FrameStateType::kBuiltinContinuation
-                         : FrameStateType::kJavaScriptBuiltinContinuation;
   const FrameStateFunctionInfo* state_info =
-      common->CreateFrameStateFunctionInfo(
-          frame_type, parameter_count, 0,
-          function.is_null() ? Handle<SharedFunctionInfo>()
-                             : Handle<SharedFunctionInfo>(function->shared()));
+      common->CreateFrameStateFunctionInfo(frame_type, parameter_count, 0,
+                                           shared);
   const Operator* op = common->FrameState(
       bailout_id, OutputFrameStateCombine::Ignore(), state_info);
 
-  Node* function_node = function.is_null() ? js_graph->UndefinedConstant()
-                                           : js_graph->HeapConstant(function);
-
   Node* frame_state = graph->NewNode(
-      op, params_node, js_graph->EmptyStateValues(),
-      js_graph->EmptyStateValues(), context, function_node, outer_frame_state);
+      op, params_node, jsgraph->EmptyStateValues(), jsgraph->EmptyStateValues(),
+      context, closure, outer_frame_state);
 
   return frame_state;
 }
+
 }  // namespace
 
-Node* CreateStubBuiltinContinuationFrameState(JSGraph* js_graph,
-                                              Builtins::Name name,
-                                              Node* context, Node** parameters,
-                                              int parameter_count,
-                                              Node* outer_frame_state,
-                                              ContinuationFrameStateMode mode) {
-  Isolate* isolate = js_graph->isolate();
+Node* CreateStubBuiltinContinuationFrameState(
+    JSGraph* jsgraph, Builtins::Name name, Node* context,
+    Node* const* parameters, int parameter_count, Node* outer_frame_state,
+    ContinuationFrameStateMode mode) {
+  Isolate* isolate = jsgraph->isolate();
   Callable callable = Builtins::CallableFor(isolate, name);
   CallInterfaceDescriptor descriptor = callable.descriptor();
 
@@ -142,18 +136,18 @@ Node* CreateStubBuiltinContinuationFrameState(JSGraph* js_graph,
   }
 
   return CreateBuiltinContinuationFrameStateCommon(
-      js_graph, name, context, actual_parameters.data(),
-      static_cast<int>(actual_parameters.size()), outer_frame_state,
-      Handle<JSFunction>());
+      jsgraph, FrameStateType::kBuiltinContinuation, name,
+      jsgraph->UndefinedConstant(), context, actual_parameters.data(),
+      static_cast<int>(actual_parameters.size()), outer_frame_state);
 }
 
 Node* CreateJavaScriptBuiltinContinuationFrameState(
-    JSGraph* js_graph, Handle<JSFunction> function, Builtins::Name name,
-    Node* target, Node* context, Node** stack_parameters,
+    JSGraph* jsgraph, Handle<SharedFunctionInfo> shared, Builtins::Name name,
+    Node* target, Node* context, Node* const* stack_parameters,
     int stack_parameter_count, Node* outer_frame_state,
     ContinuationFrameStateMode mode) {
-  Isolate* isolate = js_graph->isolate();
-  Callable callable = Builtins::CallableFor(isolate, name);
+  Isolate* const isolate = jsgraph->isolate();
+  Callable const callable = Builtins::CallableFor(isolate, name);
 
   // Lazy deopt points where the frame state is assocated with a call get an
   // additional parameter for the return result from the call that's added by
@@ -165,8 +159,8 @@ Node* CreateJavaScriptBuiltinContinuationFrameState(
                 (mode == ContinuationFrameStateMode::EAGER ? 0 : 1));
 
   Node* argc =
-      js_graph->Constant(stack_parameter_count -
-                         (mode == ContinuationFrameStateMode::EAGER ? 1 : 0));
+      jsgraph->Constant(stack_parameter_count -
+                        (mode == ContinuationFrameStateMode::EAGER ? 1 : 0));
 
   // Stack parameters first. They must be first because the receiver is expected
   // to be the second value in the translation when creating stack crawls
@@ -179,12 +173,13 @@ Node* CreateJavaScriptBuiltinContinuationFrameState(
   // Register parameters follow stack paraemters. The context will be added by
   // instruction selector during FrameState translation.
   actual_parameters.push_back(target);
-  actual_parameters.push_back(js_graph->UndefinedConstant());
+  actual_parameters.push_back(jsgraph->UndefinedConstant());
   actual_parameters.push_back(argc);
 
   return CreateBuiltinContinuationFrameStateCommon(
-      js_graph, name, context, &actual_parameters[0],
-      static_cast<int>(actual_parameters.size()), outer_frame_state, function);
+      jsgraph, FrameStateType::kJavaScriptBuiltinContinuation, name, target,
+      context, &actual_parameters[0],
+      static_cast<int>(actual_parameters.size()), outer_frame_state, shared);
 }
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/frame-states.h b/deps/v8/src/compiler/frame-states.h
index ac00f8c1294..fb3d42ff412 100644
--- a/deps/v8/src/compiler/frame-states.h
+++ b/deps/v8/src/compiler/frame-states.h
@@ -145,16 +145,14 @@ static const int kFrameStateInputCount = kFrameStateOuterStateInput + 1;
 
 enum class ContinuationFrameStateMode { EAGER, LAZY };
 
-Node* CreateStubBuiltinContinuationFrameState(JSGraph* graph,
-                                              Builtins::Name name,
-                                              Node* context, Node** parameters,
-                                              int parameter_count,
-                                              Node* outer_frame_state,
-                                              ContinuationFrameStateMode mode);
+Node* CreateStubBuiltinContinuationFrameState(
+    JSGraph* graph, Builtins::Name name, Node* context, Node* const* parameters,
+    int parameter_count, Node* outer_frame_state,
+    ContinuationFrameStateMode mode);
 
 Node* CreateJavaScriptBuiltinContinuationFrameState(
-    JSGraph* graph, Handle<JSFunction> function, Builtins::Name name,
-    Node* target, Node* context, Node** stack_parameters,
+    JSGraph* graph, Handle<SharedFunctionInfo> shared, Builtins::Name name,
+    Node* target, Node* context, Node* const* stack_parameters,
     int stack_parameter_count, Node* outer_frame_state,
     ContinuationFrameStateMode mode);
 
diff --git a/deps/v8/src/compiler/functional-list.h b/deps/v8/src/compiler/functional-list.h
new file mode 100644
index 00000000000..2345f1d3605
--- /dev/null
+++ b/deps/v8/src/compiler/functional-list.h
@@ -0,0 +1,122 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_FUNCTIONAL_LIST_H_
+#define V8_COMPILER_FUNCTIONAL_LIST_H_
+
+#include "src/zone/zone.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+// A generic stack implemented as a purely functional singly-linked list, which
+// results in an O(1) copy operation. It is the equivalent of functional lists
+// in ML-like languages, with the only difference that it also caches the length
+// of the list in each node.
+// TODO(tebbi): Use this implementation also for RedundancyElimination.
+template <class A>
+class FunctionalList {
+ private:
+  struct Cons : ZoneObject {
+    Cons(A top, Cons* rest)
+        : top(std::move(top)), rest(rest), size(1 + (rest ? rest->size : 0)) {}
+    A const top;
+    Cons* const rest;
+    size_t const size;
+  };
+
+ public:
+  FunctionalList() : elements_(nullptr) {}
+
+  bool operator==(const FunctionalList<A>& other) const {
+    if (Size() != other.Size()) return false;
+    iterator it = begin();
+    iterator other_it = other.begin();
+    while (true) {
+      if (it == other_it) return true;
+      if (*it != *other_it) return false;
+      ++it;
+      ++other_it;
+    }
+  }
+  bool operator!=(const FunctionalList<A>& other) const {
+    return !(*this == other);
+  }
+
+  const A& Front() const {
+    DCHECK_GT(Size(), 0);
+    return elements_->top;
+  }
+
+  FunctionalList Rest() const {
+    FunctionalList result = *this;
+    result.DropFront();
+    return result;
+  }
+
+  void DropFront() {
+    CHECK_GT(Size(), 0);
+    elements_ = elements_->rest;
+  }
+
+  void PushFront(A a, Zone* zone) {
+    elements_ = new (zone) Cons(std::move(a), elements_);
+  }
+
+  // If {hint} happens to be exactly what we want to allocate, avoid allocation
+  // by reusing {hint}.
+  void PushFront(A a, Zone* zone, FunctionalList hint) {
+    if (hint.Size() == Size() + 1 && hint.Front() == a &&
+        hint.Rest() == *this) {
+      *this = hint;
+    } else {
+      PushFront(a, zone);
+    }
+  }
+
+  // Drop elements until the current stack is equal to the tail shared with
+  // {other}. The shared tail must not only be equal, but also refer to the
+  // same memory.
+  void ResetToCommonAncestor(FunctionalList other) {
+    while (other.Size() > Size()) other.DropFront();
+    while (other.Size() < Size()) DropFront();
+    while (elements_ != other.elements_) {
+      DropFront();
+      other.DropFront();
+    }
+  }
+
+  size_t Size() const { return elements_ ? elements_->size : 0; }
+
+  class iterator {
+   public:
+    explicit iterator(Cons* cur) : current_(cur) {}
+
+    const A& operator*() const { return current_->top; }
+    iterator& operator++() {
+      current_ = current_->rest;
+      return *this;
+    }
+    bool operator==(const iterator& other) const {
+      return this->current_ == other.current_;
+    }
+    bool operator!=(const iterator& other) const { return !(*this == other); }
+
+   private:
+    Cons* current_;
+  };
+
+  iterator begin() const { return iterator(elements_); }
+  iterator end() const { return iterator(nullptr); }
+
+ private:
+  Cons* elements_;
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_FUNCTIONAL_LIST_H_
diff --git a/deps/v8/src/compiler/graph-assembler.cc b/deps/v8/src/compiler/graph-assembler.cc
index a0b2e0ff0a6..37d6c94a724 100644
--- a/deps/v8/src/compiler/graph-assembler.cc
+++ b/deps/v8/src/compiler/graph-assembler.cc
@@ -86,10 +86,13 @@ CHECKED_ASSEMBLER_MACH_BINOP_LIST(CHECKED_BINOP_DEF)
 #undef CHECKED_BINOP_DEF
 
 Node* GraphAssembler::Float64RoundDown(Node* value) {
-  if (machine()->Float64RoundDown().IsSupported()) {
-    return graph()->NewNode(machine()->Float64RoundDown().op(), value);
-  }
-  return nullptr;
+  CHECK(machine()->Float64RoundDown().IsSupported());
+  return graph()->NewNode(machine()->Float64RoundDown().op(), value);
+}
+
+Node* GraphAssembler::Float64RoundTruncate(Node* value) {
+  CHECK(machine()->Float64RoundTruncate().IsSupported());
+  return graph()->NewNode(machine()->Float64RoundTruncate().op(), value);
 }
 
 Node* GraphAssembler::Projection(int index, Node* value) {
@@ -244,10 +247,10 @@ Operator const* GraphAssembler::ToNumberOperator() {
     Callable callable =
         Builtins::CallableFor(jsgraph()->isolate(), Builtins::kToNumber);
     CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-    CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
         jsgraph()->isolate(), graph()->zone(), callable.descriptor(), 0, flags,
         Operator::kEliminatable);
-    to_number_operator_.set(common()->Call(desc));
+    to_number_operator_.set(common()->Call(call_descriptor));
   }
   return to_number_operator_.get();
 }
diff --git a/deps/v8/src/compiler/graph-assembler.h b/deps/v8/src/compiler/graph-assembler.h
index 9ae74d0df57..bc793df1a6a 100644
--- a/deps/v8/src/compiler/graph-assembler.h
+++ b/deps/v8/src/compiler/graph-assembler.h
@@ -196,6 +196,7 @@ class GraphAssembler {
   Node* Unreachable();
 
   Node* Float64RoundDown(Node* value);
+  Node* Float64RoundTruncate(Node* value);
 
   Node* ToNumber(Node* value);
   Node* BitcastWordToTagged(Node* value);
@@ -220,7 +221,7 @@ class GraphAssembler {
   Node* DeoptimizeIfNot(DeoptimizeReason reason, VectorSlotPair const& feedback,
                         Node* condition, Node* frame_state);
   template <typename... Args>
-  Node* Call(const CallDescriptor* desc, Args... args);
+  Node* Call(const CallDescriptor* call_descriptor, Args... args);
   template <typename... Args>
   Node* Call(const Operator* op, Args... args);
 
@@ -406,8 +407,9 @@ void GraphAssembler::GotoIfNot(Node* condition,
 }
 
 template <typename... Args>
-Node* GraphAssembler::Call(const CallDescriptor* desc, Args... args) {
-  const Operator* op = common()->Call(desc);
+Node* GraphAssembler::Call(const CallDescriptor* call_descriptor,
+                           Args... args) {
+  const Operator* op = common()->Call(call_descriptor);
   return Call(op, args...);
 }
 
diff --git a/deps/v8/src/compiler/graph-reducer.h b/deps/v8/src/compiler/graph-reducer.h
index 517f71e955d..adb97ddf4d9 100644
--- a/deps/v8/src/compiler/graph-reducer.h
+++ b/deps/v8/src/compiler/graph-reducer.h
@@ -23,6 +23,8 @@ class Node;
 // out-of-line data associated with each node.
 typedef uint32_t NodeId;
 
+// Possible outcomes for decisions.
+enum class Decision : uint8_t { kUnknown, kTrue, kFalse };
 
 // Represents the result of trying to reduce a node in the graph.
 class Reduction final {
diff --git a/deps/v8/src/compiler/ia32/code-generator-ia32.cc b/deps/v8/src/compiler/ia32/code-generator-ia32.cc
index 47ded6a30ca..f3ff76b61a3 100644
--- a/deps/v8/src/compiler/ia32/code-generator-ia32.cc
+++ b/deps/v8/src/compiler/ia32/code-generator-ia32.cc
@@ -285,6 +285,34 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
   Zone* zone_;
 };
 
+void MoveOperandIfAliasedWithPoisonRegister(Instruction* call_instruction,
+                                            CodeGenerator* gen) {
+  IA32OperandConverter i(gen, call_instruction);
+  int const poison_index = i.InputInt32(1);
+  if (poison_index == -1) {
+    // No aliasing -> nothing to move.
+    return;
+  }
+
+  InstructionOperand* op = call_instruction->InputAt(poison_index);
+  if (op->IsImmediate() || op->IsConstant()) {
+    gen->tasm()->mov(kSpeculationPoisonRegister, i.ToImmediate(op));
+  } else {
+    gen->tasm()->mov(kSpeculationPoisonRegister, i.InputOperand(poison_index));
+  }
+}
+
+void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
+                                   InstructionCode opcode, Instruction* instr,
+                                   IA32OperandConverter& i) {
+  const MemoryAccessMode access_mode =
+      static_cast<MemoryAccessMode>(MiscField::decode(opcode));
+  if (access_mode == kMemoryAccessPoisoned) {
+    Register value = i.OutputRegister();
+    codegen->tasm()->and_(value, kSpeculationPoisonRegister);
+  }
+}
+
 }  // namespace
 
 #define ASSEMBLE_COMPARE(asm_instr)                                   \
@@ -372,6 +400,17 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
     __ j(not_equal, &binop);                                    \
   } while (false)
 
+#define ASSEMBLE_MOVX(mov_instr)                            \
+  do {                                                      \
+    if (instr->addressing_mode() != kMode_None) {           \
+      __ mov_instr(i.OutputRegister(), i.MemoryOperand());  \
+    } else if (instr->InputAt(0)->IsRegister()) {           \
+      __ mov_instr(i.OutputRegister(), i.InputRegister(0)); \
+    } else {                                                \
+      __ mov_instr(i.OutputRegister(), i.InputOperand(0));  \
+    }                                                       \
+  } while (0)
+
 void CodeGenerator::AssembleDeconstructFrame() {
   __ mov(esp, ebp);
   __ pop(ebp);
@@ -484,32 +523,52 @@ void CodeGenerator::AssembleTailCallAfterGap(Instruction* instr,
                                 first_unused_stack_slot);
 }
 
+// Check that {kJavaScriptCallCodeStartRegister} is correct.
+void CodeGenerator::AssembleCodeStartRegisterCheck() {
+  __ push(eax);  // Push eax so we can use it as a scratch register.
+  __ ComputeCodeStartAddress(eax);
+  __ cmp(eax, kJavaScriptCallCodeStartRegister);
+  __ Assert(equal, AbortReason::kWrongFunctionCodeStart);
+  __ pop(eax);  // Restore eax.
+}
+
 // Check if the code object is marked for deoptimization. If it is, then it
 // jumps to the CompileLazyDeoptimizedCode builtin. In order to do this we need
 // to:
-//    1. load the address of the current instruction;
-//    2. read from memory the word that contains that bit, which can be found in
+//    1. read from memory the word that contains that bit, which can be found in
 //       the flags in the referenced {CodeDataContainer} object;
-//    3. test kMarkedForDeoptimizationBit in those flags; and
-//    4. if it is not zero then it jumps to the builtin.
+//    2. test kMarkedForDeoptimizationBit in those flags; and
+//    3. if it is not zero then it jumps to the builtin.
 void CodeGenerator::BailoutIfDeoptimized() {
-  Label current;
-  __ call(&current);
-  int pc = __ pc_offset();
-  __ bind(&current);
-  // In order to get the address of the current instruction, we first need
-  // to use a call and then use a pop, thus pushing the return address to
-  // the stack and then popping it into the register.
-  __ pop(ecx);
-  int offset = Code::kCodeDataContainerOffset - (Code::kHeaderSize + pc);
-  __ mov(ecx, Operand(ecx, offset));
-  __ test(FieldOperand(ecx, CodeDataContainer::kKindSpecificFlagsOffset),
+  int offset = Code::kCodeDataContainerOffset - Code::kHeaderSize;
+  __ mov(ebx, Operand(kJavaScriptCallCodeStartRegister, offset));
+  __ test(FieldOperand(ebx, CodeDataContainer::kKindSpecificFlagsOffset),
           Immediate(1 << Code::kMarkedForDeoptimizationBit));
   Handle<Code> code = isolate()->builtins()->builtin_handle(
       Builtins::kCompileLazyDeoptimizedCode);
   __ j(not_zero, code, RelocInfo::CODE_TARGET);
 }
 
+void CodeGenerator::GenerateSpeculationPoisonFromCodeStartRegister() {
+  __ push(eax);  // Push eax so we can use it as a scratch register.
+
+  // Set a mask which has all bits set in the normal case, but has all
+  // bits cleared if we are speculatively executing the wrong PC.
+  __ ComputeCodeStartAddress(eax);
+  __ mov(kSpeculationPoisonRegister, Immediate(0));
+  __ cmp(kJavaScriptCallCodeStartRegister, eax);
+  __ mov(eax, Immediate(-1));
+  __ cmov(equal, kSpeculationPoisonRegister, eax);
+
+  __ pop(eax);  // Restore eax.
+}
+
+void CodeGenerator::AssembleRegisterArgumentPoisoning() {
+  __ and_(kJSFunctionRegister, kSpeculationPoisonRegister);
+  __ and_(kContextRegister, kSpeculationPoisonRegister);
+  __ and_(esp, kSpeculationPoisonRegister);
+}
+
 // Assembles an instruction after register allocation, producing machine code.
 CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     Instruction* instr) {
@@ -518,30 +577,44 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
   ArchOpcode arch_opcode = ArchOpcodeField::decode(opcode);
   switch (arch_opcode) {
     case kArchCallCodeObject: {
+      MoveOperandIfAliasedWithPoisonRegister(instr, this);
       if (HasImmediateInput(instr, 0)) {
         Handle<Code> code = i.InputCode(0);
         __ call(code, RelocInfo::CODE_TARGET);
       } else {
         Register reg = i.InputRegister(0);
         __ add(reg, Immediate(Code::kHeaderSize - kHeapObjectTag));
-        __ call(reg);
+        if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
+          __ RetpolineCall(reg);
+        } else {
+          __ call(reg);
+        }
       }
       RecordCallPosition(instr);
       frame_access_state()->ClearSPDelta();
       break;
     }
     case kArchCallWasmFunction: {
+      MoveOperandIfAliasedWithPoisonRegister(instr, this);
       if (HasImmediateInput(instr, 0)) {
         Address wasm_code = reinterpret_cast<Address>(
             i.ToConstant(instr->InputAt(0)).ToInt32());
         if (info()->IsWasm()) {
           __ wasm_call(wasm_code, RelocInfo::WASM_CALL);
         } else {
-          __ call(wasm_code, RelocInfo::JS_TO_WASM_CALL);
+          if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
+            __ RetpolineCall(wasm_code, RelocInfo::JS_TO_WASM_CALL);
+          } else {
+            __ call(wasm_code, RelocInfo::JS_TO_WASM_CALL);
+          }
         }
       } else {
         Register reg = i.InputRegister(0);
-        __ call(reg);
+        if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
+          __ RetpolineCall(reg);
+        } else {
+          __ call(reg);
+        }
       }
       RecordCallPosition(instr);
       frame_access_state()->ClearSPDelta();
@@ -549,6 +622,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchTailCallCodeObjectFromJSFunction:
     case kArchTailCallCodeObject: {
+      MoveOperandIfAliasedWithPoisonRegister(instr, this);
       if (arch_opcode == kArchTailCallCodeObjectFromJSFunction) {
         AssemblePopArgumentsAdaptorFrame(kJavaScriptCallArgCountRegister,
                                          no_reg, no_reg, no_reg);
@@ -559,13 +633,18 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       } else {
         Register reg = i.InputRegister(0);
         __ add(reg, Immediate(Code::kHeaderSize - kHeapObjectTag));
-        __ jmp(reg);
+        if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
+          __ RetpolineJump(reg);
+        } else {
+          __ jmp(reg);
+        }
       }
       frame_access_state()->ClearSPDelta();
       frame_access_state()->SetFrameAccessToDefault();
       break;
     }
     case kArchTailCallWasm: {
+      MoveOperandIfAliasedWithPoisonRegister(instr, this);
       if (HasImmediateInput(instr, 0)) {
         Address wasm_code = reinterpret_cast<Address>(
             i.ToConstant(instr->InputAt(0)).ToInt32());
@@ -576,27 +655,38 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         }
       } else {
         Register reg = i.InputRegister(0);
-        __ jmp(reg);
+        if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
+          __ RetpolineJump(reg);
+        } else {
+          __ jmp(reg);
+        }
       }
       frame_access_state()->ClearSPDelta();
       frame_access_state()->SetFrameAccessToDefault();
       break;
     }
     case kArchTailCallAddress: {
+      MoveOperandIfAliasedWithPoisonRegister(instr, this);
       CHECK(!HasImmediateInput(instr, 0));
       Register reg = i.InputRegister(0);
-      __ jmp(reg);
+      if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
+        __ RetpolineJump(reg);
+      } else {
+        __ jmp(reg);
+      }
       frame_access_state()->ClearSPDelta();
       frame_access_state()->SetFrameAccessToDefault();
       break;
     }
     case kArchCallJSFunction: {
+      MoveOperandIfAliasedWithPoisonRegister(instr, this);
       Register func = i.InputRegister(0);
       if (FLAG_debug_code) {
         // Check the function's context matches the context argument.
         __ cmp(esi, FieldOperand(func, JSFunction::kContextOffset));
         __ Assert(equal, AbortReason::kWrongFunctionContext);
       }
+      static_assert(kJavaScriptCallCodeStartRegister == ecx, "ABI mismatch");
       __ mov(ecx, FieldOperand(func, JSFunction::kCodeOffset));
       __ add(ecx, Immediate(Code::kHeaderSize - kHeapObjectTag));
       __ call(ecx);
@@ -640,6 +730,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       AssemblePrepareTailCall();
       break;
     case kArchCallCFunction: {
+      MoveOperandIfAliasedWithPoisonRegister(instr, this);
       int const num_parameters = MiscField::decode(instr->opcode());
       if (HasImmediateInput(instr, 0)) {
         ExternalReference ref = i.InputExternalReference(0);
@@ -726,6 +817,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), ebp);
       }
       break;
+    case kArchRootsPointer:
+      // TODO(jgruber,v8:6666): Implement ia32 support.
+      UNREACHABLE();
     case kArchTruncateDoubleToI: {
       auto result = i.OutputRegister();
       auto input = i.InputDoubleRegister(0);
@@ -1019,6 +1113,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kIA32Popcnt:
       __ Popcnt(i.OutputRegister(), i.InputOperand(0));
       break;
+    case kArchPoisonOnSpeculationWord:
+      DCHECK_EQ(i.OutputRegister(), i.InputRegister(0));
+      __ and_(i.InputRegister(0), kSpeculationPoisonRegister);
+      break;
     case kLFence:
       __ lfence();
       break;
@@ -1403,10 +1501,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ subsd(i.InputDoubleRegister(0), kScratchDoubleReg);
       break;
     case kIA32Movsxbl:
-      __ movsx_b(i.OutputRegister(), i.MemoryOperand());
+      ASSEMBLE_MOVX(movsx_b);
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kIA32Movzxbl:
-      __ movzx_b(i.OutputRegister(), i.MemoryOperand());
+      ASSEMBLE_MOVX(movzx_b);
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kIA32Movb: {
       size_t index = 0;
@@ -1416,13 +1516,16 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       } else {
         __ mov_b(operand, i.InputRegister(index));
       }
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     }
     case kIA32Movsxwl:
-      __ movsx_w(i.OutputRegister(), i.MemoryOperand());
+      ASSEMBLE_MOVX(movsx_w);
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kIA32Movzxwl:
-      __ movzx_w(i.OutputRegister(), i.MemoryOperand());
+      ASSEMBLE_MOVX(movzx_w);
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kIA32Movw: {
       size_t index = 0;
@@ -1432,11 +1535,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       } else {
         __ mov_w(operand, i.InputRegister(index));
       }
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     }
     case kIA32Movl:
       if (instr->HasOutput()) {
         __ mov(i.OutputRegister(), i.MemoryOperand());
+        EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       } else {
         size_t index = 0;
         Operand operand = i.MemoryOperand(&index);
@@ -1663,6 +1768,40 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                    i.InputOperand(2), i.InputInt8(1) << 4);
       break;
     }
+    case kIA32F32x4SConvertI32x4: {
+      __ Cvtdq2ps(i.OutputSimd128Register(), i.InputOperand(0));
+      break;
+    }
+    case kSSEF32x4UConvertI32x4: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+      XMMRegister dst = i.OutputSimd128Register();
+      __ pxor(kScratchDoubleReg, kScratchDoubleReg);      // zeros
+      __ pblendw(kScratchDoubleReg, dst, 0x55);           // get lo 16 bits
+      __ psubd(dst, kScratchDoubleReg);                   // get hi 16 bits
+      __ cvtdq2ps(kScratchDoubleReg, kScratchDoubleReg);  // convert lo exactly
+      __ psrld(dst, 1);                  // divide by 2 to get in unsigned range
+      __ cvtdq2ps(dst, dst);             // convert hi exactly
+      __ addps(dst, dst);                // double hi, exactly
+      __ addps(dst, kScratchDoubleReg);  // add hi and lo, may round.
+      break;
+    }
+    case kAVXF32x4UConvertI32x4: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src = i.InputSimd128Register(0);
+      __ vpxor(kScratchDoubleReg, kScratchDoubleReg,
+               kScratchDoubleReg);  // zeros
+      __ vpblendw(kScratchDoubleReg, kScratchDoubleReg, src,
+                  0x55);                                   // get lo 16 bits
+      __ vpsubd(dst, src, kScratchDoubleReg);              // get hi 16 bits
+      __ vcvtdq2ps(kScratchDoubleReg, kScratchDoubleReg);  // convert lo exactly
+      __ vpsrld(dst, dst, 1);    // divide by 2 to get in unsigned range
+      __ vcvtdq2ps(dst, dst);    // convert hi exactly
+      __ vaddps(dst, dst, dst);  // double hi, exactly
+      __ vaddps(dst, dst, kScratchDoubleReg);  // add hi and lo, may round.
+      break;
+    }
     case kSSEF32x4Abs: {
       XMMRegister dst = i.OutputSimd128Register();
       Operand src = i.InputOperand(0);
@@ -1707,6 +1846,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                 i.InputOperand(0));
       break;
     }
+    case kIA32F32x4RecipApprox: {
+      __ Rcpps(i.OutputSimd128Register(), i.InputOperand(0));
+      break;
+    }
+    case kIA32F32x4RecipSqrtApprox: {
+      __ Rsqrtps(i.OutputSimd128Register(), i.InputOperand(0));
+      break;
+    }
     case kSSEF32x4Add: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       __ addps(i.OutputSimd128Register(), i.InputOperand(1));
@@ -2371,6 +2518,126 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     }
+
+#define I8x16_SPLAT(reg, scratch, v)      \
+  __ Move(reg, static_cast<uint32_t>(v)); \
+  __ Pxor(scratch, scratch);              \
+  __ Pshufb(reg, scratch)
+
+    case kSSEI8x16Shl: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      XMMRegister src = i.InputSimd128Register(0);
+      int8_t shift = i.InputInt8(1) & 0x7;
+      XMMRegister tmp = i.ToSimd128Register(instr->TempAt(0));
+
+      // src = AAaa ... AAaa
+      // tmp = 0F0F ... 0F0F (shift=4)
+      I8x16_SPLAT(tmp, kScratchDoubleReg, 0xFFU >> shift);
+
+      // src = src & tmp
+      //    => 0A0a ... 0A0a
+      __ pand(src, tmp);
+
+      // src = src << shift
+      //    => A0a0 ... A0a0 (shift=4)
+      __ pslld(src, shift);
+      break;
+    }
+    case kAVXI8x16Shl: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src = i.InputSimd128Register(0);
+      int8_t shift = i.InputInt8(1) & 0x7;
+      XMMRegister tmp =
+          dst != src ? dst : i.ToSimd128Register(instr->TempAt(0));
+
+      // src = AAaa ... AAaa
+      // tmp = 0F0F ... 0F0F (shift=4)
+      I8x16_SPLAT(tmp, kScratchDoubleReg, 0xFFU >> shift);
+
+      // dst = src & tmp
+      //    => 0A0a ... 0A0a
+      __ vpand(dst, src, tmp);
+
+      // dst = dst << shift
+      //    => A0a0 ... A0a0 (shift=4)
+      __ vpslld(dst, dst, shift);
+      break;
+    }
+    case kSSEI8x16ShrS: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      XMMRegister src = i.InputSimd128Register(0);
+      int8_t shift = i.InputInt8(1) & 0x7;
+      XMMRegister tmp = i.ToSimd128Register(instr->TempAt(0));
+
+      // I16x8 view of I8x16
+      // src = AAaa AAaa ... AAaa AAaa
+
+      // tmp = aa00 aa00 ... aa00 aa00
+      __ movaps(tmp, src);
+      __ Move(kScratchDoubleReg, static_cast<uint32_t>(0xff00));
+      __ psllw(tmp, 8);
+
+      // src = I16x8ShrS(src, shift)
+      //    => SAAa SAAa ... SAAa SAAa (shift=4)
+      __ pshuflw(kScratchDoubleReg, kScratchDoubleReg, 0x0);
+      __ psraw(src, shift);
+
+      // tmp = I16x8ShrS(tmp, shift)
+      //    => Saa0 Saa0 ... Saa0 Saa0 (shift=4)
+      __ pshufd(kScratchDoubleReg, kScratchDoubleReg, 0x0);
+      __ psraw(tmp, shift);
+
+      // src = I16x8And(src, 0xff00)
+      //    => SA00 SA00 ... SA00 SA00
+      __ pand(src, kScratchDoubleReg);
+
+      // tmp = I16x8ShrU(tmp, 8)
+      //    => 00Sa 00Sa ... 00Sa 00Sa (shift=4)
+      __ psrlw(tmp, 8);
+
+      // src = I16x8Or(src, tmp)
+      //    => SASa SASa ... SASa SASa (shift=4)
+      __ por(src, tmp);
+      break;
+    }
+    case kAVXI8x16ShrS: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src = i.InputSimd128Register(0);
+      int8_t shift = i.InputInt8(1) & 0x7;
+      XMMRegister tmp = i.ToSimd128Register(instr->TempAt(0));
+
+      // I16x8 view of I8x16
+      // src = AAaa AAaa ... AAaa AAaa
+
+      // tmp = aa00 aa00 ... aa00 aa00
+      __ Move(kScratchDoubleReg, static_cast<uint32_t>(0xff00));
+      __ vpsllw(tmp, src, 8);
+
+      // dst = I16x8ShrS(src, shift)
+      //    => SAAa SAAa ... SAAa SAAa (shift=4)
+      __ vpshuflw(kScratchDoubleReg, kScratchDoubleReg, 0x0);
+      __ vpsraw(dst, src, shift);
+
+      // tmp = I16x8ShrS(tmp, shift)
+      //    => Saa0 Saa0 ... Saa0 Saa0 (shift=4)
+      __ vpshufd(kScratchDoubleReg, kScratchDoubleReg, 0x0);
+      __ vpsraw(tmp, tmp, shift);
+
+      // dst = I16x8And(dst, 0xff00)
+      //    => SA00 SA00 ... SA00 SA00
+      __ vpand(dst, dst, kScratchDoubleReg);
+
+      // tmp = I16x8ShrU(tmp, 8)
+      //    => 00Sa 00Sa ... 00Sa 00Sa (shift=4)
+      __ vpsrlw(tmp, tmp, 8);
+
+      // dst = I16x8Or(dst, tmp)
+      //    => SASa SASa ... SASa SASa (shift=4)
+      __ vpor(dst, dst, tmp);
+      break;
+    }
     case kSSEI8x16Add: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       __ paddb(i.OutputSimd128Register(), i.InputOperand(1));
@@ -2415,6 +2682,88 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                  i.InputOperand(1));
       break;
     }
+    case kSSEI8x16Mul: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      XMMRegister left = i.InputSimd128Register(0);
+      XMMRegister right = i.InputSimd128Register(1);
+      XMMRegister t0 = i.ToSimd128Register(instr->TempAt(0));
+      XMMRegister t1 = i.ToSimd128Register(instr->TempAt(1));
+
+      // I16x8 view of I8x16
+      // left = AAaa AAaa ... AAaa AAaa
+      // right= BBbb BBbb ... BBbb BBbb
+
+      // t0 = 00AA 00AA ... 00AA 00AA
+      // t1 = 00BB 00BB ... 00BB 00BB
+      __ movaps(t0, left);
+      __ movaps(t1, right);
+      __ Move(kScratchDoubleReg, static_cast<uint32_t>(0x00ff));
+      __ psrlw(t0, 8);
+      __ psrlw(t1, 8);
+
+      // left = I16x8Mul(left, right)
+      //    => __pp __pp ...  __pp  __pp
+      // t0 = I16x8Mul(t0, t1)
+      //    => __PP __PP ...  __PP  __PP
+      __ pshuflw(kScratchDoubleReg, kScratchDoubleReg, 0x0);
+      __ pmullw(t0, t1);
+      __ pmullw(left, right);
+      __ pshufd(kScratchDoubleReg, kScratchDoubleReg, 0x0);
+
+      // t0 = I16x8Shl(t0, 8)
+      //    => PP00 PP00 ...  PP00  PP00
+      __ psllw(t0, 8);
+
+      // left = I16x8And(left, 0x00ff)
+      //    => 00pp 00pp ...  00pp  00pp
+      __ pand(left, kScratchDoubleReg);
+
+      // left = I16x8Or(left, t0)
+      //    => PPpp PPpp ...  PPpp  PPpp
+      __ por(left, t0);
+      break;
+    }
+    case kAVXI8x16Mul: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister left = i.InputSimd128Register(0);
+      XMMRegister right = i.InputSimd128Register(1);
+      XMMRegister t0 = i.ToSimd128Register(instr->TempAt(0));
+      XMMRegister t1 = i.ToSimd128Register(instr->TempAt(1));
+
+      // I16x8 view of I8x16
+      // left = AAaa AAaa ... AAaa AAaa
+      // right= BBbb BBbb ... BBbb BBbb
+
+      // t0 = 00AA 00AA ... 00AA 00AA
+      // t1 = 00BB 00BB ... 00BB 00BB
+      __ Move(kScratchDoubleReg, static_cast<uint32_t>(0x00ff));
+      __ vpsrlw(t0, left, 8);
+      __ vpsrlw(t1, right, 8);
+
+      // dst = I16x8Mul(left, right)
+      //    => __pp __pp ...  __pp  __pp
+      __ vpshuflw(kScratchDoubleReg, kScratchDoubleReg, 0x0);
+      __ vpmullw(dst, left, right);
+
+      // t0 = I16x8Mul(t0, t1)
+      //    => __PP __PP ...  __PP  __PP
+      __ vpmullw(t0, t0, t1);
+      __ vpshufd(kScratchDoubleReg, kScratchDoubleReg, 0x0);
+
+      // t0 = I16x8Shl(t0, 8)
+      //    => PP00 PP00 ...  PP00  PP00
+      __ vpsllw(t0, t0, 8);
+
+      // dst = I16x8And(dst, 0x00ff)
+      //    => 00pp 00pp ...  00pp  00pp
+      __ vpand(dst, dst, kScratchDoubleReg);
+
+      // dst = I16x8Or(dst, t0)
+      //    => PPpp PPpp ...  PPpp  PPpp
+      __ vpor(dst, dst, t0);
+      break;
+    }
     case kSSEI8x16MinS: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       CpuFeatureScope sse_scope(tasm(), SSE4_1);
@@ -2516,6 +2865,48 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                   i.InputOperand(1));
       break;
     }
+    case kSSEI8x16ShrU: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      XMMRegister src = i.InputSimd128Register(0);
+      int8_t shift = i.InputInt8(1) & 0x7;
+      XMMRegister tmp = i.ToSimd128Register(instr->TempAt(0));
+
+      // src = AAaa ... AAaa
+      // tmp = F0F0 ... F0F0 (shift=4)
+
+      I8x16_SPLAT(tmp, kScratchDoubleReg, 0xFFU << shift);  // needn't byte cast
+
+      // src = src & tmp
+      //    => A0a0 ... A0a0
+      __ pand(src, tmp);
+
+      // src = src >> shift
+      //    => 0A0a ... 0A0a (shift=4)
+      __ psrld(src, shift);
+      break;
+    }
+    case kAVXI8x16ShrU: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src = i.InputSimd128Register(0);
+      int8_t shift = i.InputInt8(1) & 0x7;
+      XMMRegister tmp =
+          dst != src ? dst : i.ToSimd128Register(instr->TempAt(0));
+
+      // src = AAaa ... AAaa
+      // tmp = F0F0 ... F0F0 (shift=4)
+      I8x16_SPLAT(tmp, kScratchDoubleReg, 0xFFU << shift);
+
+      // src = src & tmp
+      //    => A0a0 ... A0a0
+      __ vpand(dst, src, tmp);
+
+      // dst = dst >> shift
+      //    => 0A0a ... 0A0a (shift=4)
+      __ vpsrld(dst, dst, shift);
+      break;
+    }
+#undef I8x16_SPLAT
     case kSSEI8x16MinU: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       __ pminub(i.OutputSimd128Register(), i.InputOperand(1));
@@ -2631,87 +3022,151 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                i.InputOperand(1));
       break;
     }
+    case kSSES128Select: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      // Mask used here is stored in dst.
+      XMMRegister dst = i.OutputSimd128Register();
+      __ movaps(kScratchDoubleReg, i.InputSimd128Register(1));
+      __ xorps(kScratchDoubleReg, i.InputSimd128Register(2));
+      __ andps(dst, kScratchDoubleReg);
+      __ xorps(dst, i.InputSimd128Register(2));
+      break;
+    }
+    case kAVXS128Select: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      __ vxorps(kScratchDoubleReg, i.InputSimd128Register(2),
+                i.InputOperand(1));
+      __ vandps(dst, kScratchDoubleReg, i.InputOperand(0));
+      __ vxorps(dst, dst, i.InputSimd128Register(2));
+      break;
+    }
+    case kIA32S8x16Shuffle: {
+      XMMRegister dst = i.OutputSimd128Register();
+      Register tmp = i.TempRegister(0);
+      // Prepare 16-byte boundary buffer for shuffle control mask
+      __ mov(tmp, esp);
+      __ movups(dst, i.InputOperand(0));
+      __ and_(esp, -16);
+      if (instr->InputCount() == 5) {  // only one input operand
+        for (int j = 4; j > 0; j--) {
+          uint32_t mask = i.InputUint32(j);
+          __ push(Immediate(mask));
+        }
+        __ Pshufb(dst, Operand(esp, 0));
+      } else {  // two input operands
+        DCHECK_EQ(6, instr->InputCount());
+        for (int j = 5; j > 1; j--) {
+          uint32_t lanes = i.InputUint32(j);
+          uint32_t mask = 0;
+          for (int k = 0; k < 32; k += 8) {
+            uint8_t lane = lanes >> k;
+            mask |= (lane < kSimd128Size ? lane : 0x80) << k;
+          }
+          __ push(Immediate(mask));
+        }
+        __ Pshufb(dst, Operand(esp, 0));
+        __ movups(kScratchDoubleReg, i.InputOperand(1));
+        for (int j = 5; j > 1; j--) {
+          uint32_t lanes = i.InputUint32(j);
+          uint32_t mask = 0;
+          for (int k = 0; k < 32; k += 8) {
+            uint8_t lane = lanes >> k;
+            mask |= (lane >= kSimd128Size ? (lane & 0xF) : 0x80) << k;
+          }
+          __ push(Immediate(mask));
+        }
+        __ Pshufb(kScratchDoubleReg, Operand(esp, 0));
+        __ por(dst, kScratchDoubleReg);
+      }
+      __ mov(esp, tmp);
+      break;
+    }
+    case kIA32S32x4Swizzle: {
+      __ Pshufd(i.OutputSimd128Register(), i.InputOperand(0), i.InputInt8(1));
+      break;
+    }
     case kIA32StackCheck: {
       ExternalReference const stack_limit =
           ExternalReference::address_of_stack_limit(__ isolate());
       __ cmp(esp, Operand::StaticVariable(stack_limit));
       break;
     }
-    case kAtomicExchangeInt8: {
+    case kWord32AtomicExchangeInt8: {
       __ xchg_b(i.InputRegister(0), i.MemoryOperand(1));
       __ movsx_b(i.InputRegister(0), i.InputRegister(0));
       break;
     }
-    case kAtomicExchangeUint8: {
+    case kWord32AtomicExchangeUint8: {
       __ xchg_b(i.InputRegister(0), i.MemoryOperand(1));
       __ movzx_b(i.InputRegister(0), i.InputRegister(0));
       break;
     }
-    case kAtomicExchangeInt16: {
+    case kWord32AtomicExchangeInt16: {
       __ xchg_w(i.InputRegister(0), i.MemoryOperand(1));
       __ movsx_w(i.InputRegister(0), i.InputRegister(0));
       break;
     }
-    case kAtomicExchangeUint16: {
+    case kWord32AtomicExchangeUint16: {
       __ xchg_w(i.InputRegister(0), i.MemoryOperand(1));
       __ movzx_w(i.InputRegister(0), i.InputRegister(0));
       break;
     }
-    case kAtomicExchangeWord32: {
+    case kWord32AtomicExchangeWord32: {
       __ xchg(i.InputRegister(0), i.MemoryOperand(1));
       break;
     }
-    case kAtomicCompareExchangeInt8: {
+    case kWord32AtomicCompareExchangeInt8: {
       __ lock();
       __ cmpxchg_b(i.MemoryOperand(2), i.InputRegister(1));
       __ movsx_b(eax, eax);
       break;
     }
-    case kAtomicCompareExchangeUint8: {
+    case kWord32AtomicCompareExchangeUint8: {
       __ lock();
       __ cmpxchg_b(i.MemoryOperand(2), i.InputRegister(1));
       __ movzx_b(eax, eax);
       break;
     }
-    case kAtomicCompareExchangeInt16: {
+    case kWord32AtomicCompareExchangeInt16: {
       __ lock();
       __ cmpxchg_w(i.MemoryOperand(2), i.InputRegister(1));
       __ movsx_w(eax, eax);
       break;
     }
-    case kAtomicCompareExchangeUint16: {
+    case kWord32AtomicCompareExchangeUint16: {
       __ lock();
       __ cmpxchg_w(i.MemoryOperand(2), i.InputRegister(1));
       __ movzx_w(eax, eax);
       break;
     }
-    case kAtomicCompareExchangeWord32: {
+    case kWord32AtomicCompareExchangeWord32: {
       __ lock();
       __ cmpxchg(i.MemoryOperand(2), i.InputRegister(1));
       break;
     }
 #define ATOMIC_BINOP_CASE(op, inst)                \
-  case kAtomic##op##Int8: {                        \
+  case kWord32Atomic##op##Int8: {                  \
     ASSEMBLE_ATOMIC_BINOP(inst, mov_b, cmpxchg_b); \
     __ movsx_b(eax, eax);                          \
     break;                                         \
   }                                                \
-  case kAtomic##op##Uint8: {                       \
+  case kWord32Atomic##op##Uint8: {                 \
     ASSEMBLE_ATOMIC_BINOP(inst, mov_b, cmpxchg_b); \
     __ movzx_b(eax, eax);                          \
     break;                                         \
   }                                                \
-  case kAtomic##op##Int16: {                       \
+  case kWord32Atomic##op##Int16: {                 \
     ASSEMBLE_ATOMIC_BINOP(inst, mov_w, cmpxchg_w); \
     __ movsx_w(eax, eax);                          \
     break;                                         \
   }                                                \
-  case kAtomic##op##Uint16: {                      \
+  case kWord32Atomic##op##Uint16: {                \
     ASSEMBLE_ATOMIC_BINOP(inst, mov_w, cmpxchg_w); \
     __ movzx_w(eax, eax);                          \
     break;                                         \
   }                                                \
-  case kAtomic##op##Word32: {                      \
+  case kWord32Atomic##op##Word32: {                \
     ASSEMBLE_ATOMIC_BINOP(inst, mov, cmpxchg);     \
     break;                                         \
   }
@@ -2721,14 +3176,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       ATOMIC_BINOP_CASE(Or, or_)
       ATOMIC_BINOP_CASE(Xor, xor_)
 #undef ATOMIC_BINOP_CASE
-    case kAtomicLoadInt8:
-    case kAtomicLoadUint8:
-    case kAtomicLoadInt16:
-    case kAtomicLoadUint16:
-    case kAtomicLoadWord32:
-    case kAtomicStoreWord8:
-    case kAtomicStoreWord16:
-    case kAtomicStoreWord32:
+    case kWord32AtomicLoadInt8:
+    case kWord32AtomicLoadUint8:
+    case kWord32AtomicLoadInt16:
+    case kWord32AtomicLoadUint16:
+    case kWord32AtomicLoadWord32:
+    case kWord32AtomicStoreWord8:
+    case kWord32AtomicStoreWord16:
+    case kWord32AtomicStoreWord32:
       UNREACHABLE();  // Won't be generated by instruction selector.
       break;
   }
@@ -2798,6 +3253,19 @@ void CodeGenerator::AssembleArchBranch(Instruction* instr, BranchInfo* branch) {
   if (!branch->fallthru) __ jmp(flabel);
 }
 
+void CodeGenerator::AssembleBranchPoisoning(FlagsCondition condition,
+                                            Instruction* instr) {
+  // TODO(jarin) Handle float comparisons (kUnordered[Not]Equal).
+  if (condition == kUnorderedEqual || condition == kUnorderedNotEqual) {
+    return;
+  }
+
+  condition = NegateFlagsCondition(condition);
+  __ setcc(FlagsConditionToCondition(condition), kSpeculationPoisonRegister);
+  __ add(kSpeculationPoisonRegister, Immediate(255));
+  __ sar(kSpeculationPoisonRegister, 31u);
+}
+
 void CodeGenerator::AssembleArchDeoptBranch(Instruction* instr,
                                             BranchInfo* branch) {
   AssembleArchBranch(instr, branch);
@@ -2843,8 +3311,8 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                              __ isolate()),
                          0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
-        CallDescriptor* descriptor = gen_->linkage()->GetIncomingDescriptor();
-        size_t pop_size = descriptor->StackParameterCount() * kPointerSize;
+        auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
+        size_t pop_size = call_descriptor->StackParameterCount() * kPointerSize;
         // Use ecx as a scratch register, we return anyways immediately.
         __ Ret(static_cast<int>(pop_size), ecx);
       } else {
@@ -3070,8 +3538,8 @@ void CodeGenerator::AssembleArchTableSwitch(Instruction* instr) {
 //                                            ^ esp                        ^ ebp
 
 void CodeGenerator::FinishFrame(Frame* frame) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
-  const RegList saves = descriptor->CalleeSavedRegisters();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {  // Save callee-saved registers.
     DCHECK(!info()->is_osr());
     int pushed = 0;
@@ -3084,14 +3552,14 @@ void CodeGenerator::FinishFrame(Frame* frame) {
 }
 
 void CodeGenerator::AssembleConstructFrame() {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
   if (frame_access_state()->has_frame()) {
-    if (descriptor->IsCFunctionCall()) {
+    if (call_descriptor->IsCFunctionCall()) {
       __ push(ebp);
       __ mov(ebp, esp);
-    } else if (descriptor->IsJSFunctionCall()) {
+    } else if (call_descriptor->IsJSFunctionCall()) {
       __ Prologue();
-      if (descriptor->PushArgumentCount()) {
+      if (call_descriptor->PushArgumentCount()) {
         __ push(kJavaScriptCallArgCountRegister);
       }
     } else {
@@ -3099,8 +3567,8 @@ void CodeGenerator::AssembleConstructFrame() {
     }
   }
 
-  int shrink_slots =
-      frame()->GetTotalFrameSlotCount() - descriptor->CalculateFixedFrameSize();
+  int shrink_slots = frame()->GetTotalFrameSlotCount() -
+                     call_descriptor->CalculateFixedFrameSize();
 
   if (info()->is_osr()) {
     // TurboFan OSR-compiled functions cannot be entered directly.
@@ -3113,9 +3581,10 @@ void CodeGenerator::AssembleConstructFrame() {
     if (FLAG_code_comments) __ RecordComment("-- OSR entrypoint --");
     osr_pc_offset_ = __ pc_offset();
     shrink_slots -= osr_helper()->UnoptimizedFrameSlots();
+    ResetSpeculationPoison();
   }
 
-  const RegList saves = descriptor->CalleeSavedRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (shrink_slots > 0) {
     if (info()->IsWasm() && shrink_slots > 128) {
       // For WebAssembly functions with big frames we have to do the stack
@@ -3174,9 +3643,9 @@ void CodeGenerator::AssembleConstructFrame() {
 }
 
 void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
 
-  const RegList saves = descriptor->CalleeSavedRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
   // Restore registers.
   if (saves != 0) {
     const int returns = frame()->GetReturnSlotCount();
@@ -3191,10 +3660,10 @@ void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
 
   // Might need ecx for scratch if pop_size is too big or if there is a variable
   // pop count.
-  DCHECK_EQ(0u, descriptor->CalleeSavedRegisters() & ecx.bit());
-  size_t pop_size = descriptor->StackParameterCount() * kPointerSize;
+  DCHECK_EQ(0u, call_descriptor->CalleeSavedRegisters() & ecx.bit());
+  size_t pop_size = call_descriptor->StackParameterCount() * kPointerSize;
   IA32OperandConverter g(this, nullptr);
-  if (descriptor->IsCFunctionCall()) {
+  if (call_descriptor->IsCFunctionCall()) {
     AssembleDeconstructFrame();
   } else if (frame_access_state()->has_frame()) {
     // Canonicalize JSFunction return sites for now if they always have the same
@@ -3211,8 +3680,8 @@ void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
       AssembleDeconstructFrame();
     }
   }
-  DCHECK_EQ(0u, descriptor->CalleeSavedRegisters() & edx.bit());
-  DCHECK_EQ(0u, descriptor->CalleeSavedRegisters() & ecx.bit());
+  DCHECK_EQ(0u, call_descriptor->CalleeSavedRegisters() & edx.bit());
+  DCHECK_EQ(0u, call_descriptor->CalleeSavedRegisters() & ecx.bit());
   if (pop->IsImmediate()) {
     DCHECK_EQ(Constant::kInt32, g.ToConstant(pop).type());
     pop_size += g.ToConstant(pop).ToInt32() * kPointerSize;
@@ -3231,119 +3700,129 @@ void CodeGenerator::FinishCode() {}
 void CodeGenerator::AssembleMove(InstructionOperand* source,
                                  InstructionOperand* destination) {
   IA32OperandConverter g(this, nullptr);
-  // Dispatch on the source and destination operand kinds.  Not all
-  // combinations are possible.
-  if (source->IsRegister()) {
-    DCHECK(destination->IsRegister() || destination->IsStackSlot());
-    Register src = g.ToRegister(source);
-    Operand dst = g.ToOperand(destination);
-    __ mov(dst, src);
-  } else if (source->IsStackSlot()) {
-    DCHECK(destination->IsRegister() || destination->IsStackSlot());
-    Operand src = g.ToOperand(source);
-    if (destination->IsRegister()) {
-      Register dst = g.ToRegister(destination);
-      __ mov(dst, src);
-    } else {
-      Operand dst = g.ToOperand(destination);
-      __ push(src);
-      __ pop(dst);
-    }
-  } else if (source->IsConstant()) {
-    Constant src_constant = g.ToConstant(source);
-    if (src_constant.type() == Constant::kHeapObject) {
-      Handle<HeapObject> src = src_constant.ToHeapObject();
-      if (destination->IsRegister()) {
-        Register dst = g.ToRegister(destination);
-        __ Move(dst, src);
+  // Dispatch on the source and destination operand kinds.
+  switch (MoveType::InferMove(source, destination)) {
+    case MoveType::kRegisterToRegister:
+      if (source->IsRegister()) {
+        __ mov(g.ToRegister(destination), g.ToRegister(source));
       } else {
-        DCHECK(destination->IsStackSlot());
-        Operand dst = g.ToOperand(destination);
-        __ mov(dst, src);
+        DCHECK(source->IsFPRegister());
+        __ movaps(g.ToDoubleRegister(destination), g.ToDoubleRegister(source));
       }
-    } else if (destination->IsRegister()) {
-      Register dst = g.ToRegister(destination);
-      __ Move(dst, g.ToImmediate(source));
-    } else if (destination->IsStackSlot()) {
+      return;
+    case MoveType::kRegisterToStack: {
       Operand dst = g.ToOperand(destination);
-      __ Move(dst, g.ToImmediate(source));
-    } else if (src_constant.type() == Constant::kFloat32) {
-      // TODO(turbofan): Can we do better here?
-      uint32_t src = src_constant.ToFloat32AsInt();
-      if (destination->IsFPRegister()) {
-        XMMRegister dst = g.ToDoubleRegister(destination);
-        __ Move(dst, src);
+      if (source->IsRegister()) {
+        __ mov(dst, g.ToRegister(source));
       } else {
-        DCHECK(destination->IsFPStackSlot());
-        Operand dst = g.ToOperand(destination);
-        __ Move(dst, Immediate(src));
+        DCHECK(source->IsFPRegister());
+        XMMRegister src = g.ToDoubleRegister(source);
+        MachineRepresentation rep =
+            LocationOperand::cast(source)->representation();
+        if (rep == MachineRepresentation::kFloat32) {
+          __ movss(dst, src);
+        } else if (rep == MachineRepresentation::kFloat64) {
+          __ movsd(dst, src);
+        } else {
+          DCHECK_EQ(MachineRepresentation::kSimd128, rep);
+          __ movups(dst, src);
+        }
       }
-    } else {
-      DCHECK_EQ(Constant::kFloat64, src_constant.type());
-      uint64_t src = src_constant.ToFloat64().AsUint64();
-      uint32_t lower = static_cast<uint32_t>(src);
-      uint32_t upper = static_cast<uint32_t>(src >> 32);
-      if (destination->IsFPRegister()) {
-        XMMRegister dst = g.ToDoubleRegister(destination);
-        __ Move(dst, src);
+      return;
+    }
+    case MoveType::kStackToRegister: {
+      Operand src = g.ToOperand(source);
+      if (source->IsStackSlot()) {
+        __ mov(g.ToRegister(destination), src);
       } else {
-        DCHECK(destination->IsFPStackSlot());
-        Operand dst0 = g.ToOperand(destination);
-        Operand dst1 = g.ToOperand(destination, kPointerSize);
-        __ Move(dst0, Immediate(lower));
-        __ Move(dst1, Immediate(upper));
+        DCHECK(source->IsFPStackSlot());
+        XMMRegister dst = g.ToDoubleRegister(destination);
+        MachineRepresentation rep =
+            LocationOperand::cast(source)->representation();
+        if (rep == MachineRepresentation::kFloat32) {
+          __ movss(dst, src);
+        } else if (rep == MachineRepresentation::kFloat64) {
+          __ movsd(dst, src);
+        } else {
+          DCHECK_EQ(MachineRepresentation::kSimd128, rep);
+          __ movups(dst, src);
+        }
       }
+      return;
     }
-  } else if (source->IsFPRegister()) {
-    XMMRegister src = g.ToDoubleRegister(source);
-    if (destination->IsFPRegister()) {
-      XMMRegister dst = g.ToDoubleRegister(destination);
-      __ movaps(dst, src);
-    } else {
-      DCHECK(destination->IsFPStackSlot());
+    case MoveType::kStackToStack: {
+      Operand src = g.ToOperand(source);
       Operand dst = g.ToOperand(destination);
-      MachineRepresentation rep =
-          LocationOperand::cast(source)->representation();
-      if (rep == MachineRepresentation::kFloat64) {
-        __ movsd(dst, src);
-      } else if (rep == MachineRepresentation::kFloat32) {
-        __ movss(dst, src);
-      } else {
-        DCHECK_EQ(MachineRepresentation::kSimd128, rep);
-        __ movups(dst, src);
-      }
-    }
-  } else if (source->IsFPStackSlot()) {
-    DCHECK(destination->IsFPRegister() || destination->IsFPStackSlot());
-    Operand src = g.ToOperand(source);
-    MachineRepresentation rep = LocationOperand::cast(source)->representation();
-    if (destination->IsFPRegister()) {
-      XMMRegister dst = g.ToDoubleRegister(destination);
-      if (rep == MachineRepresentation::kFloat64) {
-        __ movsd(dst, src);
-      } else if (rep == MachineRepresentation::kFloat32) {
-        __ movss(dst, src);
-      } else {
-        DCHECK_EQ(MachineRepresentation::kSimd128, rep);
-        __ movups(dst, src);
+      if (source->IsStackSlot()) {
+        __ push(src);
+        __ pop(dst);
+      } else {
+        MachineRepresentation rep =
+            LocationOperand::cast(source)->representation();
+        if (rep == MachineRepresentation::kFloat32) {
+          __ movss(kScratchDoubleReg, src);
+          __ movss(dst, kScratchDoubleReg);
+        } else if (rep == MachineRepresentation::kFloat64) {
+          __ movsd(kScratchDoubleReg, src);
+          __ movsd(dst, kScratchDoubleReg);
+        } else {
+          DCHECK_EQ(MachineRepresentation::kSimd128, rep);
+          __ movups(kScratchDoubleReg, src);
+          __ movups(dst, kScratchDoubleReg);
+        }
       }
-    } else {
+      return;
+    }
+    case MoveType::kConstantToRegister: {
+      Constant src = g.ToConstant(source);
+      if (destination->IsRegister()) {
+        Register dst = g.ToRegister(destination);
+        if (src.type() == Constant::kHeapObject) {
+          __ Move(dst, src.ToHeapObject());
+        } else {
+          __ Move(dst, g.ToImmediate(source));
+        }
+      } else {
+        DCHECK(destination->IsFPRegister());
+        XMMRegister dst = g.ToDoubleRegister(destination);
+        if (src.type() == Constant::kFloat32) {
+          // TODO(turbofan): Can we do better here?
+          __ Move(dst, src.ToFloat32AsInt());
+        } else {
+          DCHECK_EQ(src.type(), Constant::kFloat64);
+          __ Move(dst, src.ToFloat64().AsUint64());
+        }
+      }
+      return;
+    }
+    case MoveType::kConstantToStack: {
+      Constant src = g.ToConstant(source);
       Operand dst = g.ToOperand(destination);
-      if (rep == MachineRepresentation::kFloat64) {
-        __ movsd(kScratchDoubleReg, src);
-        __ movsd(dst, kScratchDoubleReg);
-      } else if (rep == MachineRepresentation::kFloat32) {
-        __ movss(kScratchDoubleReg, src);
-        __ movss(dst, kScratchDoubleReg);
+      if (destination->IsStackSlot()) {
+        if (src.type() == Constant::kHeapObject) {
+          __ mov(dst, src.ToHeapObject());
+        } else {
+          __ Move(dst, g.ToImmediate(source));
+        }
       } else {
-        DCHECK_EQ(MachineRepresentation::kSimd128, rep);
-        __ movups(kScratchDoubleReg, src);
-        __ movups(dst, kScratchDoubleReg);
+        DCHECK(destination->IsFPStackSlot());
+        if (src.type() == Constant::kFloat32) {
+          __ Move(dst, Immediate(src.ToFloat32AsInt()));
+        } else {
+          DCHECK_EQ(src.type(), Constant::kFloat64);
+          uint64_t constant_value = src.ToFloat64().AsUint64();
+          uint32_t lower = static_cast<uint32_t>(constant_value);
+          uint32_t upper = static_cast<uint32_t>(constant_value >> 32);
+          Operand dst0 = dst;
+          Operand dst1 = g.ToOperand(destination, kPointerSize);
+          __ Move(dst0, Immediate(lower));
+          __ Move(dst1, Immediate(upper));
+        }
       }
+      return;
     }
-  } else {
-    UNREACHABLE();
   }
+  UNREACHABLE();
 }
 
 
@@ -3352,94 +3831,106 @@ void CodeGenerator::AssembleSwap(InstructionOperand* source,
   IA32OperandConverter g(this, nullptr);
   // Dispatch on the source and destination operand kinds.  Not all
   // combinations are possible.
-  if (source->IsRegister() && destination->IsRegister()) {
-    // Register-register.
-    Register src = g.ToRegister(source);
-    Register dst = g.ToRegister(destination);
-    __ push(src);
-    __ mov(src, dst);
-    __ pop(dst);
-  } else if (source->IsRegister() && destination->IsStackSlot()) {
-    // Register-memory.
-    Register src = g.ToRegister(source);
-    __ push(src);
-    frame_access_state()->IncreaseSPDelta(1);
-    Operand dst = g.ToOperand(destination);
-    __ mov(src, dst);
-    frame_access_state()->IncreaseSPDelta(-1);
-    dst = g.ToOperand(destination);
-    __ pop(dst);
-  } else if (source->IsStackSlot() && destination->IsStackSlot()) {
-    // Memory-memory.
-    Operand dst1 = g.ToOperand(destination);
-    __ push(dst1);
-    frame_access_state()->IncreaseSPDelta(1);
-    Operand src1 = g.ToOperand(source);
-    __ push(src1);
-    Operand dst2 = g.ToOperand(destination);
-    __ pop(dst2);
-    frame_access_state()->IncreaseSPDelta(-1);
-    Operand src2 = g.ToOperand(source);
-    __ pop(src2);
-  } else if (source->IsFPRegister() && destination->IsFPRegister()) {
-    // XMM register-register swap.
-    XMMRegister src = g.ToDoubleRegister(source);
-    XMMRegister dst = g.ToDoubleRegister(destination);
-    __ movaps(kScratchDoubleReg, src);
-    __ movaps(src, dst);
-    __ movaps(dst, kScratchDoubleReg);
-  } else if (source->IsFPRegister() && destination->IsFPStackSlot()) {
-    // XMM register-memory swap.
-    XMMRegister reg = g.ToDoubleRegister(source);
-    Operand other = g.ToOperand(destination);
-    MachineRepresentation rep = LocationOperand::cast(source)->representation();
-    if (rep == MachineRepresentation::kFloat64) {
-      __ movsd(kScratchDoubleReg, other);
-      __ movsd(other, reg);
-      __ movaps(reg, kScratchDoubleReg);
-    } else if (rep == MachineRepresentation::kFloat32) {
-      __ movss(kScratchDoubleReg, other);
-      __ movss(other, reg);
-      __ movaps(reg, kScratchDoubleReg);
-    } else {
-      DCHECK_EQ(MachineRepresentation::kSimd128, rep);
-      __ movups(kScratchDoubleReg, other);
-      __ movups(other, reg);
-      __ movups(reg, kScratchDoubleReg);
-    }
-  } else if (source->IsFPStackSlot() && destination->IsFPStackSlot()) {
-    // Double-width memory-to-memory.
-    Operand src0 = g.ToOperand(source);
-    Operand dst0 = g.ToOperand(destination);
-    MachineRepresentation rep = LocationOperand::cast(source)->representation();
-    if (rep == MachineRepresentation::kFloat64) {
-      __ movsd(kScratchDoubleReg, dst0);  // Save dst in scratch register.
-      __ push(src0);  // Then use stack to copy src to destination.
-      __ pop(dst0);
-      __ push(g.ToOperand(source, kPointerSize));
-      __ pop(g.ToOperand(destination, kPointerSize));
-      __ movsd(src0, kScratchDoubleReg);
-    } else if (rep == MachineRepresentation::kFloat32) {
-      __ movss(kScratchDoubleReg, dst0);  // Save dst in scratch register.
-      __ push(src0);  // Then use stack to copy src to destination.
-      __ pop(dst0);
-      __ movss(src0, kScratchDoubleReg);
-    } else {
-      DCHECK_EQ(MachineRepresentation::kSimd128, rep);
-      __ movups(kScratchDoubleReg, dst0);  // Save dst in scratch register.
-      __ push(src0);  // Then use stack to copy src to destination.
-      __ pop(dst0);
-      __ push(g.ToOperand(source, kPointerSize));
-      __ pop(g.ToOperand(destination, kPointerSize));
-      __ push(g.ToOperand(source, 2 * kPointerSize));
-      __ pop(g.ToOperand(destination, 2 * kPointerSize));
-      __ push(g.ToOperand(source, 3 * kPointerSize));
-      __ pop(g.ToOperand(destination, 3 * kPointerSize));
-      __ movups(src0, kScratchDoubleReg);
+  switch (MoveType::InferSwap(source, destination)) {
+    case MoveType::kRegisterToRegister: {
+      if (source->IsRegister()) {
+        Register src = g.ToRegister(source);
+        Register dst = g.ToRegister(destination);
+        __ push(src);
+        __ mov(src, dst);
+        __ pop(dst);
+      } else {
+        DCHECK(source->IsFPRegister());
+        XMMRegister src = g.ToDoubleRegister(source);
+        XMMRegister dst = g.ToDoubleRegister(destination);
+        __ movaps(kScratchDoubleReg, src);
+        __ movaps(src, dst);
+        __ movaps(dst, kScratchDoubleReg);
+      }
+      return;
     }
-  } else {
-    // No other combinations are possible.
-    UNREACHABLE();
+    case MoveType::kRegisterToStack: {
+      if (source->IsRegister()) {
+        Register src = g.ToRegister(source);
+        __ push(src);
+        frame_access_state()->IncreaseSPDelta(1);
+        Operand dst = g.ToOperand(destination);
+        __ mov(src, dst);
+        frame_access_state()->IncreaseSPDelta(-1);
+        dst = g.ToOperand(destination);
+        __ pop(dst);
+      } else {
+        DCHECK(source->IsFPRegister());
+        XMMRegister src = g.ToDoubleRegister(source);
+        Operand dst = g.ToOperand(destination);
+        MachineRepresentation rep =
+            LocationOperand::cast(source)->representation();
+        if (rep == MachineRepresentation::kFloat32) {
+          __ movss(kScratchDoubleReg, dst);
+          __ movss(dst, src);
+          __ movaps(src, kScratchDoubleReg);
+        } else if (rep == MachineRepresentation::kFloat64) {
+          __ movsd(kScratchDoubleReg, dst);
+          __ movsd(dst, src);
+          __ movaps(src, kScratchDoubleReg);
+        } else {
+          DCHECK_EQ(MachineRepresentation::kSimd128, rep);
+          __ movups(kScratchDoubleReg, dst);
+          __ movups(dst, src);
+          __ movups(src, kScratchDoubleReg);
+        }
+      }
+      return;
+    }
+    case MoveType::kStackToStack: {
+      if (source->IsStackSlot()) {
+        Operand dst1 = g.ToOperand(destination);
+        __ push(dst1);
+        frame_access_state()->IncreaseSPDelta(1);
+        Operand src1 = g.ToOperand(source);
+        __ push(src1);
+        Operand dst2 = g.ToOperand(destination);
+        __ pop(dst2);
+        frame_access_state()->IncreaseSPDelta(-1);
+        Operand src2 = g.ToOperand(source);
+        __ pop(src2);
+      } else {
+        DCHECK(source->IsFPStackSlot());
+        Operand src0 = g.ToOperand(source);
+        Operand dst0 = g.ToOperand(destination);
+        MachineRepresentation rep =
+            LocationOperand::cast(source)->representation();
+        if (rep == MachineRepresentation::kFloat32) {
+          __ movss(kScratchDoubleReg, dst0);  // Save dst in scratch register.
+          __ push(src0);  // Then use stack to copy src to destination.
+          __ pop(dst0);
+          __ movss(src0, kScratchDoubleReg);
+        } else if (rep == MachineRepresentation::kFloat64) {
+          __ movsd(kScratchDoubleReg, dst0);  // Save dst in scratch register.
+          __ push(src0);  // Then use stack to copy src to destination.
+          __ pop(dst0);
+          __ push(g.ToOperand(source, kPointerSize));
+          __ pop(g.ToOperand(destination, kPointerSize));
+          __ movsd(src0, kScratchDoubleReg);
+        } else {
+          DCHECK_EQ(MachineRepresentation::kSimd128, rep);
+          __ movups(kScratchDoubleReg, dst0);  // Save dst in scratch register.
+          __ push(src0);  // Then use stack to copy src to destination.
+          __ pop(dst0);
+          __ push(g.ToOperand(source, kPointerSize));
+          __ pop(g.ToOperand(destination, kPointerSize));
+          __ push(g.ToOperand(source, 2 * kPointerSize));
+          __ pop(g.ToOperand(destination, 2 * kPointerSize));
+          __ push(g.ToOperand(source, 3 * kPointerSize));
+          __ pop(g.ToOperand(destination, 3 * kPointerSize));
+          __ movups(src0, kScratchDoubleReg);
+        }
+      }
+      return;
+    }
+    default:
+      UNREACHABLE();
+      break;
   }
 }
 
@@ -3451,6 +3942,13 @@ void CodeGenerator::AssembleJumpTable(Label** targets, size_t target_count) {
 }
 
 #undef __
+#undef kScratchDoubleReg
+#undef ASSEMBLE_COMPARE
+#undef ASSEMBLE_IEEE754_BINOP
+#undef ASSEMBLE_IEEE754_UNOP
+#undef ASSEMBLE_BINOP
+#undef ASSEMBLE_ATOMIC_BINOP
+#undef ASSEMBLE_MOVX
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/ia32/instruction-codes-ia32.h b/deps/v8/src/compiler/ia32/instruction-codes-ia32.h
index a17d9f06cea..3716cbd449d 100644
--- a/deps/v8/src/compiler/ia32/instruction-codes-ia32.h
+++ b/deps/v8/src/compiler/ia32/instruction-codes-ia32.h
@@ -121,10 +121,15 @@ namespace compiler {
   V(AVXF32x4ExtractLane)           \
   V(SSEF32x4ReplaceLane)           \
   V(AVXF32x4ReplaceLane)           \
+  V(IA32F32x4SConvertI32x4)        \
+  V(SSEF32x4UConvertI32x4)         \
+  V(AVXF32x4UConvertI32x4)         \
   V(SSEF32x4Abs)                   \
   V(AVXF32x4Abs)                   \
   V(SSEF32x4Neg)                   \
   V(AVXF32x4Neg)                   \
+  V(IA32F32x4RecipApprox)          \
+  V(IA32F32x4RecipSqrtApprox)      \
   V(SSEF32x4Add)                   \
   V(AVXF32x4Add)                   \
   V(SSEF32x4Sub)                   \
@@ -229,6 +234,10 @@ namespace compiler {
   V(IA32I8x16ExtractLane)          \
   V(SSEI8x16ReplaceLane)           \
   V(AVXI8x16ReplaceLane)           \
+  V(SSEI8x16Shl)                   \
+  V(AVXI8x16Shl)                   \
+  V(SSEI8x16ShrS)                  \
+  V(AVXI8x16ShrS)                  \
   V(IA32I8x16Neg)                  \
   V(SSEI8x16Add)                   \
   V(AVXI8x16Add)                   \
@@ -238,6 +247,8 @@ namespace compiler {
   V(AVXI8x16Sub)                   \
   V(SSEI8x16SubSaturateS)          \
   V(AVXI8x16SubSaturateS)          \
+  V(SSEI8x16Mul)                   \
+  V(AVXI8x16Mul)                   \
   V(SSEI8x16MinS)                  \
   V(AVXI8x16MinS)                  \
   V(SSEI8x16MaxS)                  \
@@ -254,6 +265,8 @@ namespace compiler {
   V(AVXI8x16AddSaturateU)          \
   V(SSEI8x16SubSaturateU)          \
   V(AVXI8x16SubSaturateU)          \
+  V(SSEI8x16ShrU)                  \
+  V(AVXI8x16ShrU)                  \
   V(SSEI8x16MinU)                  \
   V(AVXI8x16MinU)                  \
   V(SSEI8x16MaxU)                  \
@@ -270,7 +283,11 @@ namespace compiler {
   V(SSES128Or)                     \
   V(AVXS128Or)                     \
   V(SSES128Xor)                    \
-  V(AVXS128Xor)
+  V(AVXS128Xor)                    \
+  V(SSES128Select)                 \
+  V(AVXS128Select)                 \
+  V(IA32S8x16Shuffle)              \
+  V(IA32S32x4Swizzle)
 
 // Addressing modes represent the "shape" of inputs to an instruction.
 // Many instructions support multiple addressing modes. Addressing modes
diff --git a/deps/v8/src/compiler/ia32/instruction-scheduler-ia32.cc b/deps/v8/src/compiler/ia32/instruction-scheduler-ia32.cc
index db43c1ed1c3..5c9cf366e2c 100644
--- a/deps/v8/src/compiler/ia32/instruction-scheduler-ia32.cc
+++ b/deps/v8/src/compiler/ia32/instruction-scheduler-ia32.cc
@@ -103,10 +103,15 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXF32x4ExtractLane:
     case kSSEF32x4ReplaceLane:
     case kAVXF32x4ReplaceLane:
+    case kIA32F32x4SConvertI32x4:
+    case kSSEF32x4UConvertI32x4:
+    case kAVXF32x4UConvertI32x4:
     case kSSEF32x4Abs:
     case kAVXF32x4Abs:
     case kSSEF32x4Neg:
     case kAVXF32x4Neg:
+    case kIA32F32x4RecipApprox:
+    case kIA32F32x4RecipSqrtApprox:
     case kSSEF32x4Add:
     case kAVXF32x4Add:
     case kSSEF32x4Sub:
@@ -212,6 +217,10 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kSSEI8x16ReplaceLane:
     case kAVXI8x16ReplaceLane:
     case kIA32I8x16Neg:
+    case kSSEI8x16Shl:
+    case kAVXI8x16Shl:
+    case kSSEI8x16ShrS:
+    case kAVXI8x16ShrS:
     case kSSEI8x16Add:
     case kAVXI8x16Add:
     case kSSEI8x16AddSaturateS:
@@ -220,6 +229,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXI8x16Sub:
     case kSSEI8x16SubSaturateS:
     case kAVXI8x16SubSaturateS:
+    case kSSEI8x16Mul:
+    case kAVXI8x16Mul:
     case kSSEI8x16MinS:
     case kAVXI8x16MinS:
     case kSSEI8x16MaxS:
@@ -236,6 +247,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXI8x16AddSaturateU:
     case kSSEI8x16SubSaturateU:
     case kAVXI8x16SubSaturateU:
+    case kSSEI8x16ShrU:
+    case kAVXI8x16ShrU:
     case kSSEI8x16MinU:
     case kAVXI8x16MinU:
     case kSSEI8x16MaxU:
@@ -253,6 +266,10 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXS128Or:
     case kSSES128Xor:
     case kAVXS128Xor:
+    case kSSES128Select:
+    case kAVXS128Select:
+    case kIA32S8x16Shuffle:
+    case kIA32S32x4Swizzle:
       return (instr->addressing_mode() == kMode_None)
           ? kNoOpcodeFlags
           : kIsLoadOperation | kHasSideEffect;
diff --git a/deps/v8/src/compiler/ia32/instruction-selector-ia32.cc b/deps/v8/src/compiler/ia32/instruction-selector-ia32.cc
index d8bf250ec6c..e9ac2a5826a 100644
--- a/deps/v8/src/compiler/ia32/instruction-selector-ia32.cc
+++ b/deps/v8/src/compiler/ia32/instruction-selector-ia32.cc
@@ -74,9 +74,11 @@ class IA32OperandGenerator final : public OperandGenerator {
 #if 0
         // Constants in new space cannot be used as immediates in V8 because
         // the GC does not scan code objects when collecting the new generation.
-        Handle<HeapObject> value = OpParameter<Handle<HeapObject>>(node);
+        Handle<HeapObject> value = HeapConstantOf(node->op());
         Isolate* isolate = value->GetIsolate();
         return !isolate->heap()->InNewSpace(*value);
+#else
+        return false;
 #endif
       }
       default:
@@ -92,13 +94,13 @@ class IA32OperandGenerator final : public OperandGenerator {
     AddressingMode mode = kMode_MRI;
     int32_t displacement = (displacement_node == nullptr)
                                ? 0
-                               : OpParameter<int32_t>(displacement_node);
+                               : OpParameter<int32_t>(displacement_node->op());
     if (displacement_mode == kNegativeDisplacement) {
       displacement = -displacement;
     }
     if (base != nullptr) {
       if (base->opcode() == IrOpcode::kInt32Constant) {
-        displacement += OpParameter<int32_t>(base);
+        displacement += OpParameter<int32_t>(base->op());
         base = nullptr;
       }
     }
@@ -208,6 +210,21 @@ void VisitFloatUnop(InstructionSelector* selector, Node* node, Node* input,
   }
 }
 
+void VisitRRISimd(InstructionSelector* selector, Node* node,
+                  ArchOpcode avx_opcode, ArchOpcode sse_opcode) {
+  IA32OperandGenerator g(selector);
+  InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
+  InstructionOperand operand1 =
+      g.UseImmediate(OpParameter<int32_t>(node->op()));
+  InstructionOperand temps[] = {g.TempSimd128Register()};
+  if (selector->IsSupported(AVX)) {
+    selector->Emit(avx_opcode, g.DefineAsRegister(node), operand0, operand1,
+                   arraysize(temps), temps);
+  } else {
+    selector->Emit(sse_opcode, g.DefineSameAsFirst(node), operand0, operand1,
+                   arraysize(temps), temps);
+  }
+}
 
 }  // namespace
 
@@ -271,9 +288,15 @@ void InstructionSelector::VisitLoad(Node* node) {
   AddressingMode mode =
       g.GetEffectiveAddressMemoryOperand(node, inputs, &input_count);
   InstructionCode code = opcode | AddressingModeField::encode(mode);
+  if (node->opcode() == IrOpcode::kPoisonedLoad) {
+    CHECK_EQ(poisoning_enabled_, PoisoningMitigationLevel::kOn);
+    code |= MiscField::encode(kMemoryAccessPoisoned);
+  }
   Emit(code, 1, outputs, input_count, inputs);
 }
 
+void InstructionSelector::VisitPoisonedLoad(Node* node) { VisitLoad(node); }
+
 void InstructionSelector::VisitProtectedLoad(Node* node) {
   // TODO(eholk)
   UNIMPLEMENTED();
@@ -399,7 +422,7 @@ void VisitBinop(InstructionSelector* selector, Node* node,
   Node* right = m.right().node();
   InstructionOperand inputs[6];
   size_t input_count = 0;
-  InstructionOperand outputs[2];
+  InstructionOperand outputs[1];
   size_t output_count = 0;
 
   // TODO(turbofan): match complex addressing modes.
@@ -440,29 +463,15 @@ void VisitBinop(InstructionSelector* selector, Node* node,
     }
   }
 
-  if (cont->IsBranch()) {
-    inputs[input_count++] = g.Label(cont->true_block());
-    inputs[input_count++] = g.Label(cont->false_block());
-  }
-
   outputs[output_count++] = g.DefineSameAsFirst(node);
-  if (cont->IsSet()) {
-    outputs[output_count++] = g.DefineAsByteRegister(cont->result());
-  }
 
   DCHECK_NE(0u, input_count);
-  DCHECK_NE(0u, output_count);
+  DCHECK_EQ(1u, output_count);
   DCHECK_GE(arraysize(inputs), input_count);
   DCHECK_GE(arraysize(outputs), output_count);
 
-  opcode = cont->Encode(opcode);
-  if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, output_count, outputs, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else {
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, output_count, outputs, input_count,
+                                 inputs, cont);
 }
 
 
@@ -710,27 +719,29 @@ void InstructionSelector::VisitWord32Ror(Node* node) {
   VisitShift(this, node, kIA32Ror);
 }
 
-#define RO_OP_LIST(V)                                     \
-  V(Word32Clz, kIA32Lzcnt)                                \
-  V(Word32Ctz, kIA32Tzcnt)                                \
-  V(Word32Popcnt, kIA32Popcnt)                            \
-  V(ChangeFloat32ToFloat64, kSSEFloat32ToFloat64)         \
-  V(RoundInt32ToFloat32, kSSEInt32ToFloat32)              \
-  V(ChangeInt32ToFloat64, kSSEInt32ToFloat64)             \
-  V(ChangeUint32ToFloat64, kSSEUint32ToFloat64)           \
-  V(TruncateFloat32ToInt32, kSSEFloat32ToInt32)           \
-  V(TruncateFloat32ToUint32, kSSEFloat32ToUint32)         \
-  V(ChangeFloat64ToInt32, kSSEFloat64ToInt32)             \
-  V(ChangeFloat64ToUint32, kSSEFloat64ToUint32)           \
-  V(TruncateFloat64ToUint32, kSSEFloat64ToUint32)         \
-  V(TruncateFloat64ToFloat32, kSSEFloat64ToFloat32)       \
-  V(RoundFloat64ToInt32, kSSEFloat64ToInt32)              \
-  V(BitcastFloat32ToInt32, kIA32BitcastFI)                \
-  V(BitcastInt32ToFloat32, kIA32BitcastIF)                \
-  V(Float32Sqrt, kSSEFloat32Sqrt)                         \
-  V(Float64Sqrt, kSSEFloat64Sqrt)                         \
-  V(Float64ExtractLowWord32, kSSEFloat64ExtractLowWord32) \
-  V(Float64ExtractHighWord32, kSSEFloat64ExtractHighWord32)
+#define RO_OP_LIST(V)                                       \
+  V(Word32Clz, kIA32Lzcnt)                                  \
+  V(Word32Ctz, kIA32Tzcnt)                                  \
+  V(Word32Popcnt, kIA32Popcnt)                              \
+  V(ChangeFloat32ToFloat64, kSSEFloat32ToFloat64)           \
+  V(RoundInt32ToFloat32, kSSEInt32ToFloat32)                \
+  V(ChangeInt32ToFloat64, kSSEInt32ToFloat64)               \
+  V(ChangeUint32ToFloat64, kSSEUint32ToFloat64)             \
+  V(TruncateFloat32ToInt32, kSSEFloat32ToInt32)             \
+  V(TruncateFloat32ToUint32, kSSEFloat32ToUint32)           \
+  V(ChangeFloat64ToInt32, kSSEFloat64ToInt32)               \
+  V(ChangeFloat64ToUint32, kSSEFloat64ToUint32)             \
+  V(TruncateFloat64ToUint32, kSSEFloat64ToUint32)           \
+  V(TruncateFloat64ToFloat32, kSSEFloat64ToFloat32)         \
+  V(RoundFloat64ToInt32, kSSEFloat64ToInt32)                \
+  V(BitcastFloat32ToInt32, kIA32BitcastFI)                  \
+  V(BitcastInt32ToFloat32, kIA32BitcastIF)                  \
+  V(Float32Sqrt, kSSEFloat32Sqrt)                           \
+  V(Float64Sqrt, kSSEFloat64Sqrt)                           \
+  V(Float64ExtractLowWord32, kSSEFloat64ExtractLowWord32)   \
+  V(Float64ExtractHighWord32, kSSEFloat64ExtractHighWord32) \
+  V(SignExtendWord8ToInt32, kIA32Movsxbl)                   \
+  V(SignExtendWord16ToInt32, kIA32Movsxwl)
 
 #define RR_OP_LIST(V)                                                         \
   V(TruncateFloat64ToWord32, kArchTruncateDoubleToI)                          \
@@ -766,6 +777,7 @@ void InstructionSelector::VisitWord32Ror(Node* node) {
   }
 RO_OP_LIST(RO_VISITOR)
 #undef RO_VISITOR
+#undef RO_OP_LIST
 
 #define RR_VISITOR(Name, opcode)                      \
   void InstructionSelector::Visit##Name(Node* node) { \
@@ -773,6 +785,7 @@ RO_OP_LIST(RO_VISITOR)
   }
 RR_OP_LIST(RR_VISITOR)
 #undef RR_VISITOR
+#undef RR_OP_LIST
 
 #define RRO_FLOAT_VISITOR(Name, avx, sse)             \
   void InstructionSelector::Visit##Name(Node* node) { \
@@ -780,6 +793,7 @@ RR_OP_LIST(RR_VISITOR)
   }
 RRO_FLOAT_OP_LIST(RRO_FLOAT_VISITOR)
 #undef RRO_FLOAT_VISITOR
+#undef RRO_FLOAT_OP_LIST
 
 #define FLOAT_UNOP_VISITOR(Name, avx, sse)                  \
   void InstructionSelector::Visit##Name(Node* node) {       \
@@ -787,6 +801,7 @@ RRO_FLOAT_OP_LIST(RRO_FLOAT_VISITOR)
   }
 FLOAT_UNOP_LIST(FLOAT_UNOP_VISITOR)
 #undef FLOAT_UNOP_VISITOR
+#undef FLOAT_UNOP_LIST
 
 void InstructionSelector::VisitWord32ReverseBits(Node* node) { UNREACHABLE(); }
 
@@ -955,16 +970,16 @@ void InstructionSelector::VisitFloat64Ieee754Unop(Node* node,
 }
 
 void InstructionSelector::EmitPrepareArguments(
-    ZoneVector<PushParameter>* arguments, const CallDescriptor* descriptor,
+    ZoneVector<PushParameter>* arguments, const CallDescriptor* call_descriptor,
     Node* node) {
   IA32OperandGenerator g(this);
 
   // Prepare for C function call.
-  if (descriptor->IsCFunctionCall()) {
+  if (call_descriptor->IsCFunctionCall()) {
     InstructionOperand temps[] = {g.TempRegister()};
     size_t const temp_count = arraysize(temps);
-    Emit(kArchPrepareCallCFunction |
-             MiscField::encode(static_cast<int>(descriptor->ParameterCount())),
+    Emit(kArchPrepareCallCFunction | MiscField::encode(static_cast<int>(
+                                         call_descriptor->ParameterCount())),
          0, nullptr, 0, nullptr, temp_count, temps);
 
     // Poke any stack arguments.
@@ -1015,9 +1030,9 @@ void InstructionSelector::EmitPrepareArguments(
   }
 }
 
-void InstructionSelector::EmitPrepareResults(ZoneVector<PushParameter>* results,
-                                             const CallDescriptor* descriptor,
-                                             Node* node) {
+void InstructionSelector::EmitPrepareResults(
+    ZoneVector<PushParameter>* results, const CallDescriptor* call_descriptor,
+    Node* node) {
   IA32OperandGenerator g(this);
 
   int reverse_slot = 0;
@@ -1025,7 +1040,7 @@ void InstructionSelector::EmitPrepareResults(ZoneVector<PushParameter>* results,
     if (!output.location.IsCallerFrameSlot()) continue;
     // Skip any alignment holes in nodes.
     if (output.node != nullptr) {
-      DCHECK(!descriptor->IsCFunctionCall());
+      DCHECK(!call_descriptor->IsCFunctionCall());
       if (output.location.GetType() == MachineType::Float32()) {
         MarkAsFloat32(output.node);
       } else if (output.location.GetType() == MachineType::Float64()) {
@@ -1052,51 +1067,20 @@ void VisitCompareWithMemoryOperand(InstructionSelector* selector,
   DCHECK_EQ(IrOpcode::kLoad, left->opcode());
   IA32OperandGenerator g(selector);
   size_t input_count = 0;
-  InstructionOperand inputs[6];
+  InstructionOperand inputs[4];
   AddressingMode addressing_mode =
       g.GetEffectiveAddressMemoryOperand(left, inputs, &input_count);
   opcode |= AddressingModeField::encode(addressing_mode);
-  opcode = cont->Encode(opcode);
   inputs[input_count++] = right;
 
-  if (cont->IsBranch()) {
-    inputs[input_count++] = g.Label(cont->true_block());
-    inputs[input_count++] = g.Label(cont->false_block());
-    selector->Emit(opcode, 0, nullptr, input_count, inputs);
-  } else if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, 0, nullptr, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsSet()) {
-    InstructionOperand output = g.DefineAsRegister(cont->result());
-    selector->Emit(opcode, 1, &output, input_count, inputs);
-  } else {
-    DCHECK(cont->IsTrap());
-    inputs[input_count++] = g.UseImmediate(cont->trap_id());
-    selector->Emit(opcode, 0, nullptr, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, 0, nullptr, input_count, inputs, cont);
 }
 
 // Shared routine for multiple compare operations.
 void VisitCompare(InstructionSelector* selector, InstructionCode opcode,
                   InstructionOperand left, InstructionOperand right,
                   FlagsContinuation* cont) {
-  IA32OperandGenerator g(selector);
-  opcode = cont->Encode(opcode);
-  if (cont->IsBranch()) {
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.Label(cont->true_block()), g.Label(cont->false_block()));
-  } else if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, g.NoOutput(), left, right, cont->kind(),
-                             cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsSet()) {
-    selector->Emit(opcode, g.DefineAsByteRegister(cont->result()), left, right);
-  } else {
-    DCHECK(cont->IsTrap());
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.UseImmediate(cont->trap_id()));
-  }
+  selector->EmitWithContinuation(opcode, left, right, cont);
 }
 
 
@@ -1117,8 +1101,8 @@ MachineType MachineTypeForNarrow(Node* node, Node* hint_node) {
     if (node->opcode() == IrOpcode::kInt32Constant ||
         node->opcode() == IrOpcode::kInt64Constant) {
       int64_t constant = node->opcode() == IrOpcode::kInt32Constant
-                             ? OpParameter<int32_t>(node)
-                             : OpParameter<int64_t>(node);
+                             ? OpParameter<int32_t>(node->op())
+                             : OpParameter<int64_t>(node->op());
       if (hint == MachineType::Int8()) {
         if (constant >= std::numeric_limits<int8_t>::min() &&
             constant <= std::numeric_limits<int8_t>::max()) {
@@ -1270,30 +1254,21 @@ void VisitWordCompare(InstructionSelector* selector, Node* node,
       // Compare(Load(js_stack_limit), LoadStackPointer)
       if (!node->op()->HasProperty(Operator::kCommutative)) cont->Commute();
       InstructionCode opcode = cont->Encode(kIA32StackCheck);
-      if (cont->IsBranch()) {
-        selector->Emit(opcode, g.NoOutput(), g.Label(cont->true_block()),
-                       g.Label(cont->false_block()));
-      } else if (cont->IsDeoptimize()) {
-        selector->EmitDeoptimize(opcode, 0, nullptr, 0, nullptr, cont->kind(),
-                                 cont->reason(), cont->feedback(),
-                                 cont->frame_state());
-      } else {
-        DCHECK(cont->IsSet());
-        selector->Emit(opcode, g.DefineAsRegister(cont->result()));
-      }
+      CHECK(cont->IsBranch());
+      selector->EmitWithContinuation(opcode, cont);
       return;
     }
   }
   VisitWordCompare(selector, node, kIA32Cmp, cont);
 }
 
+}  // namespace
 
 // Shared routine for word comparison with zero.
-void VisitWordCompareZero(InstructionSelector* selector, Node* user,
-                          Node* value, FlagsContinuation* cont) {
+void InstructionSelector::VisitWordCompareZero(Node* user, Node* value,
+                                               FlagsContinuation* cont) {
   // Try to combine with comparisons against 0 by simply inverting the branch.
-  while (value->opcode() == IrOpcode::kWord32Equal &&
-         selector->CanCover(user, value)) {
+  while (value->opcode() == IrOpcode::kWord32Equal && CanCover(user, value)) {
     Int32BinopMatcher m(value);
     if (!m.right().Is(0)) break;
 
@@ -1302,41 +1277,41 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
     cont->Negate();
   }
 
-  if (selector->CanCover(user, value)) {
+  if (CanCover(user, value)) {
     switch (value->opcode()) {
       case IrOpcode::kWord32Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kInt32LessThan:
         cont->OverwriteAndNegateIfEqual(kSignedLessThan);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kInt32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kSignedLessThanOrEqual);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kUint32LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kUint32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kFloat32Equal:
         cont->OverwriteAndNegateIfEqual(kUnorderedEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedGreaterThan);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedGreaterThanOrEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat64Equal:
         cont->OverwriteAndNegateIfEqual(kUnorderedEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedGreaterThan);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedGreaterThanOrEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kProjection:
         // Check if this is the overflow output projection of an
         // <Operation>WithOverflow node.
@@ -1348,17 +1323,17 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
           // *AFTER* this branch).
           Node* const node = value->InputAt(0);
           Node* const result = NodeProperties::FindProjection(node, 0);
-          if (result == nullptr || selector->IsDefined(result)) {
+          if (result == nullptr || IsDefined(result)) {
             switch (node->opcode()) {
               case IrOpcode::kInt32AddWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kIA32Add, cont);
+                return VisitBinop(this, node, kIA32Add, cont);
               case IrOpcode::kInt32SubWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kIA32Sub, cont);
+                return VisitBinop(this, node, kIA32Sub, cont);
               case IrOpcode::kInt32MulWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kIA32Imul, cont);
+                return VisitBinop(this, node, kIA32Imul, cont);
               default:
                 break;
             }
@@ -1366,52 +1341,17 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
         }
         break;
       case IrOpcode::kInt32Sub:
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kWord32And:
-        return VisitWordCompare(selector, value, kIA32Test, cont);
+        return VisitWordCompare(this, value, kIA32Test, cont);
       default:
         break;
     }
   }
 
   // Continuation could not be combined with a compare, emit compare against 0.
-  IA32OperandGenerator g(selector);
-  VisitCompare(selector, kIA32Cmp, g.Use(value), g.TempImmediate(0), cont);
-}
-
-}  // namespace
-
-void InstructionSelector::VisitBranch(Node* branch, BasicBlock* tbranch,
-                                      BasicBlock* fbranch) {
-  FlagsContinuation cont(kNotEqual, tbranch, fbranch);
-  VisitWordCompareZero(this, branch, branch->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeIf(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kNotEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeUnless(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapIf(Node* node, Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kNotEqual, func_id, node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapUnless(Node* node,
-                                          Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kEqual, func_id, node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
+  IA32OperandGenerator g(this);
+  VisitCompare(this, kIA32Cmp, g.Use(value), g.TempImmediate(0), cont);
 }
 
 void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
@@ -1419,24 +1359,26 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
   InstructionOperand value_operand = g.UseRegister(node->InputAt(0));
 
   // Emit either ArchTableSwitch or ArchLookupSwitch.
-  static const size_t kMaxTableSwitchValueRange = 2 << 16;
-  size_t table_space_cost = 4 + sw.value_range;
-  size_t table_time_cost = 3;
-  size_t lookup_space_cost = 3 + 2 * sw.case_count;
-  size_t lookup_time_cost = sw.case_count;
-  if (sw.case_count > 4 &&
-      table_space_cost + 3 * table_time_cost <=
-          lookup_space_cost + 3 * lookup_time_cost &&
-      sw.min_value > std::numeric_limits<int32_t>::min() &&
-      sw.value_range <= kMaxTableSwitchValueRange) {
-    InstructionOperand index_operand = value_operand;
-    if (sw.min_value) {
-      index_operand = g.TempRegister();
-      Emit(kIA32Lea | AddressingModeField::encode(kMode_MRI), index_operand,
-           value_operand, g.TempImmediate(-sw.min_value));
+  if (enable_switch_jump_table_ == kEnableSwitchJumpTable) {
+    static const size_t kMaxTableSwitchValueRange = 2 << 16;
+    size_t table_space_cost = 4 + sw.value_range();
+    size_t table_time_cost = 3;
+    size_t lookup_space_cost = 3 + 2 * sw.case_count();
+    size_t lookup_time_cost = sw.case_count();
+    if (sw.case_count() > 4 &&
+        table_space_cost + 3 * table_time_cost <=
+            lookup_space_cost + 3 * lookup_time_cost &&
+        sw.min_value() > std::numeric_limits<int32_t>::min() &&
+        sw.value_range() <= kMaxTableSwitchValueRange) {
+      InstructionOperand index_operand = value_operand;
+      if (sw.min_value()) {
+        index_operand = g.TempRegister();
+        Emit(kIA32Lea | AddressingModeField::encode(kMode_MRI), index_operand,
+             value_operand, g.TempImmediate(-sw.min_value()));
+      }
+      // Generate a table lookup.
+      return EmitTableSwitch(sw, index_operand);
     }
-    // Generate a table lookup.
-    return EmitTableSwitch(sw, index_operand);
   }
 
   // Generate a sequence of conditional jumps.
@@ -1448,7 +1390,7 @@ void InstructionSelector::VisitWord32Equal(Node* const node) {
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
   Int32BinopMatcher m(node);
   if (m.right().Is(0)) {
-    return VisitWordCompareZero(this, m.node(), m.left().node(), &cont);
+    return VisitWordCompareZero(m.node(), m.left().node(), &cont);
   }
   VisitWordCompare(this, node, &cont);
 }
@@ -1577,7 +1519,7 @@ void InstructionSelector::VisitFloat64SilenceNaN(Node* node) {
        g.UseRegister(node->InputAt(0)));
 }
 
-void InstructionSelector::VisitAtomicLoad(Node* node) {
+void InstructionSelector::VisitWord32AtomicLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
   DCHECK(load_rep.representation() == MachineRepresentation::kWord8 ||
          load_rep.representation() == MachineRepresentation::kWord16 ||
@@ -1586,7 +1528,7 @@ void InstructionSelector::VisitAtomicLoad(Node* node) {
   VisitLoad(node);
 }
 
-void InstructionSelector::VisitAtomicStore(Node* node) {
+void InstructionSelector::VisitWord32AtomicStore(Node* node) {
   IA32OperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -1596,13 +1538,13 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
   ArchOpcode opcode = kArchNop;
   switch (rep) {
     case MachineRepresentation::kWord8:
-      opcode = kAtomicExchangeInt8;
+      opcode = kWord32AtomicExchangeInt8;
       break;
     case MachineRepresentation::kWord16:
-      opcode = kAtomicExchangeInt16;
+      opcode = kWord32AtomicExchangeInt16;
       break;
     case MachineRepresentation::kWord32:
-      opcode = kAtomicExchangeWord32;
+      opcode = kWord32AtomicExchangeWord32;
       break;
     default:
       UNREACHABLE();
@@ -1628,7 +1570,7 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
   Emit(code, 0, nullptr, input_count, inputs);
 }
 
-void InstructionSelector::VisitAtomicExchange(Node* node) {
+void InstructionSelector::VisitWord32AtomicExchange(Node* node) {
   IA32OperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -1637,15 +1579,15 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   MachineType type = AtomicOpRepresentationOf(node->op());
   ArchOpcode opcode = kArchNop;
   if (type == MachineType::Int8()) {
-    opcode = kAtomicExchangeInt8;
+    opcode = kWord32AtomicExchangeInt8;
   } else if (type == MachineType::Uint8()) {
-    opcode = kAtomicExchangeUint8;
+    opcode = kWord32AtomicExchangeUint8;
   } else if (type == MachineType::Int16()) {
-    opcode = kAtomicExchangeInt16;
+    opcode = kWord32AtomicExchangeInt16;
   } else if (type == MachineType::Uint16()) {
-    opcode = kAtomicExchangeUint16;
+    opcode = kWord32AtomicExchangeUint16;
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
-    opcode = kAtomicExchangeWord32;
+    opcode = kWord32AtomicExchangeWord32;
   } else {
     UNREACHABLE();
     return;
@@ -1677,7 +1619,7 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   Emit(code, 1, outputs, input_count, inputs);
 }
 
-void InstructionSelector::VisitAtomicCompareExchange(Node* node) {
+void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
   IA32OperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -1687,15 +1629,15 @@ void InstructionSelector::VisitAtomicCompareExchange(Node* node) {
   MachineType type = AtomicOpRepresentationOf(node->op());
   ArchOpcode opcode = kArchNop;
   if (type == MachineType::Int8()) {
-    opcode = kAtomicCompareExchangeInt8;
+    opcode = kWord32AtomicCompareExchangeInt8;
   } else if (type == MachineType::Uint8()) {
-    opcode = kAtomicCompareExchangeUint8;
+    opcode = kWord32AtomicCompareExchangeUint8;
   } else if (type == MachineType::Int16()) {
-    opcode = kAtomicCompareExchangeInt16;
+    opcode = kWord32AtomicCompareExchangeInt16;
   } else if (type == MachineType::Uint16()) {
-    opcode = kAtomicCompareExchangeUint16;
+    opcode = kWord32AtomicCompareExchangeUint16;
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
-    opcode = kAtomicCompareExchangeWord32;
+    opcode = kWord32AtomicCompareExchangeWord32;
   } else {
     UNREACHABLE();
     return;
@@ -1771,11 +1713,12 @@ void InstructionSelector::VisitAtomicBinaryOperation(
   Emit(code, 1, outputs, input_count, inputs, 1, temp);
 }
 
-#define VISIT_ATOMIC_BINOP(op)                                              \
-  void InstructionSelector::VisitAtomic##op(Node* node) {                   \
-    VisitAtomicBinaryOperation(node, kAtomic##op##Int8, kAtomic##op##Uint8, \
-                               kAtomic##op##Int16, kAtomic##op##Uint16,     \
-                               kAtomic##op##Word32);                        \
+#define VISIT_ATOMIC_BINOP(op)                                   \
+  void InstructionSelector::VisitWord32Atomic##op(Node* node) {  \
+    VisitAtomicBinaryOperation(                                  \
+        node, kWord32Atomic##op##Int8, kWord32Atomic##op##Uint8, \
+        kWord32Atomic##op##Int16, kWord32Atomic##op##Uint16,     \
+        kWord32Atomic##op##Word32);                              \
   }
 VISIT_ATOMIC_BINOP(Add)
 VISIT_ATOMIC_BINOP(Sub)
@@ -1849,14 +1792,17 @@ VISIT_ATOMIC_BINOP(Xor)
   V(S128Or)                \
   V(S128Xor)
 
-#define SIMD_INT_UNOP_LIST(V) \
-  V(I32x4Neg)                 \
-  V(I16x8Neg)                 \
+#define SIMD_UNOP_LIST(V) \
+  V(F32x4SConvertI32x4)   \
+  V(F32x4RecipApprox)     \
+  V(F32x4RecipSqrtApprox) \
+  V(I32x4Neg)             \
+  V(I16x8Neg)             \
   V(I8x16Neg)
 
-#define SIMD_OTHER_UNOP_LIST(V) \
-  V(F32x4Abs)                   \
-  V(F32x4Neg)                   \
+#define SIMD_UNOP_PREFIX_LIST(V) \
+  V(F32x4Abs)                    \
+  V(F32x4Neg)                    \
   V(S128Not)
 
 #define SIMD_SHIFT_OPCODES(V) \
@@ -1880,7 +1826,8 @@ void InstructionSelector::VisitF32x4Splat(Node* node) {
 void InstructionSelector::VisitF32x4ExtractLane(Node* node) {
   IA32OperandGenerator g(this);
   InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
-  InstructionOperand operand1 = g.UseImmediate(OpParameter<int32_t>(node));
+  InstructionOperand operand1 =
+      g.UseImmediate(OpParameter<int32_t>(node->op()));
   if (IsSupported(AVX)) {
     Emit(kAVXF32x4ExtractLane, g.DefineAsRegister(node), operand0, operand1);
   } else {
@@ -1888,11 +1835,62 @@ void InstructionSelector::VisitF32x4ExtractLane(Node* node) {
   }
 }
 
+void InstructionSelector::VisitF32x4UConvertI32x4(Node* node) {
+  IA32OperandGenerator g(this);
+  InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
+  if (IsSupported(AVX)) {
+    Emit(kAVXF32x4UConvertI32x4, g.DefineAsRegister(node), operand0);
+  } else {
+    Emit(kSSEF32x4UConvertI32x4, g.DefineSameAsFirst(node), operand0);
+  }
+}
+
+#define SIMD_I8X16_SHIFT_OPCODES(V) \
+  V(I8x16Shl)                       \
+  V(I8x16ShrS)                      \
+  V(I8x16ShrU)
+
+#define VISIT_SIMD_I8X16_SHIFT(Op)                  \
+  void InstructionSelector::Visit##Op(Node* node) { \
+    VisitRRISimd(this, node, kAVX##Op, kSSE##Op);   \
+  }
+
+SIMD_I8X16_SHIFT_OPCODES(VISIT_SIMD_I8X16_SHIFT)
+#undef SIMD_I8X16_SHIFT_OPCODES
+#undef VISIT_SIMD_I8X16_SHIFT
+
+void InstructionSelector::VisitI8x16Mul(Node* node) {
+  IA32OperandGenerator g(this);
+  InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
+  InstructionOperand operand1 = g.UseRegister(node->InputAt(1));
+  InstructionOperand temps[] = {g.TempSimd128Register(),
+                                g.TempSimd128Register()};
+  if (IsSupported(AVX)) {
+    Emit(kAVXI8x16Mul, g.DefineAsRegister(node), operand0, operand1,
+         arraysize(temps), temps);
+  } else {
+    Emit(kSSEI8x16Mul, g.DefineSameAsFirst(node), operand0, operand1,
+         arraysize(temps), temps);
+  }
+}
+
 void InstructionSelector::VisitS128Zero(Node* node) {
   IA32OperandGenerator g(this);
   Emit(kIA32S128Zero, g.DefineAsRegister(node));
 }
 
+void InstructionSelector::VisitS128Select(Node* node) {
+  IA32OperandGenerator g(this);
+  InstructionOperand operand2 = g.UseRegister(node->InputAt(2));
+  if (IsSupported(AVX)) {
+    Emit(kAVXS128Select, g.DefineAsRegister(node), g.Use(node->InputAt(0)),
+         g.Use(node->InputAt(1)), operand2);
+  } else {
+    Emit(kSSES128Select, g.DefineSameAsFirst(node),
+         g.UseRegister(node->InputAt(0)), g.UseRegister(node->InputAt(1)),
+         operand2);
+  }
+}
 
 #define VISIT_SIMD_SPLAT(Type)                               \
   void InstructionSelector::Visit##Type##Splat(Node* node) { \
@@ -1904,61 +1902,67 @@ SIMD_INT_TYPES(VISIT_SIMD_SPLAT)
 #define VISIT_SIMD_EXTRACT_LANE(Type)                              \
   void InstructionSelector::Visit##Type##ExtractLane(Node* node) { \
     IA32OperandGenerator g(this);                                  \
-    int32_t lane = OpParameter<int32_t>(node);                     \
+    int32_t lane = OpParameter<int32_t>(node->op());               \
     Emit(kIA32##Type##ExtractLane, g.DefineAsRegister(node),       \
          g.UseRegister(node->InputAt(0)), g.UseImmediate(lane));   \
   }
 SIMD_INT_TYPES(VISIT_SIMD_EXTRACT_LANE)
 #undef VISIT_SIMD_EXTRACT_LANE
 
-#define VISIT_SIMD_REPLACE_LANE(Type)                                         \
-  void InstructionSelector::Visit##Type##ReplaceLane(Node* node) {            \
-    IA32OperandGenerator g(this);                                             \
-    InstructionOperand operand0 = g.UseRegister(node->InputAt(0));            \
-    InstructionOperand operand1 = g.UseImmediate(OpParameter<int32_t>(node)); \
-    InstructionOperand operand2 = g.Use(node->InputAt(1));                    \
-    if (IsSupported(AVX)) {                                                   \
-      Emit(kAVX##Type##ReplaceLane, g.DefineAsRegister(node), operand0,       \
-           operand1, operand2);                                               \
-    } else {                                                                  \
-      Emit(kSSE##Type##ReplaceLane, g.DefineSameAsFirst(node), operand0,      \
-           operand1, operand2);                                               \
-    }                                                                         \
+#define VISIT_SIMD_REPLACE_LANE(Type)                                    \
+  void InstructionSelector::Visit##Type##ReplaceLane(Node* node) {       \
+    IA32OperandGenerator g(this);                                        \
+    InstructionOperand operand0 = g.UseRegister(node->InputAt(0));       \
+    InstructionOperand operand1 =                                        \
+        g.UseImmediate(OpParameter<int32_t>(node->op()));                \
+    InstructionOperand operand2 = g.Use(node->InputAt(1));               \
+    if (IsSupported(AVX)) {                                              \
+      Emit(kAVX##Type##ReplaceLane, g.DefineAsRegister(node), operand0,  \
+           operand1, operand2);                                          \
+    } else {                                                             \
+      Emit(kSSE##Type##ReplaceLane, g.DefineSameAsFirst(node), operand0, \
+           operand1, operand2);                                          \
+    }                                                                    \
   }
 SIMD_INT_TYPES(VISIT_SIMD_REPLACE_LANE)
 VISIT_SIMD_REPLACE_LANE(F32x4)
 #undef VISIT_SIMD_REPLACE_LANE
-
-#define VISIT_SIMD_SHIFT(Opcode)                                              \
-  void InstructionSelector::Visit##Opcode(Node* node) {                       \
-    IA32OperandGenerator g(this);                                             \
-    InstructionOperand operand0 = g.UseRegister(node->InputAt(0));            \
-    InstructionOperand operand1 = g.UseImmediate(OpParameter<int32_t>(node)); \
-    if (IsSupported(AVX)) {                                                   \
-      Emit(kAVX##Opcode, g.DefineAsRegister(node), operand0, operand1);       \
-    } else {                                                                  \
-      Emit(kSSE##Opcode, g.DefineSameAsFirst(node), operand0, operand1);      \
-    }                                                                         \
+#undef SIMD_INT_TYPES
+
+#define VISIT_SIMD_SHIFT(Opcode)                                         \
+  void InstructionSelector::Visit##Opcode(Node* node) {                  \
+    IA32OperandGenerator g(this);                                        \
+    InstructionOperand operand0 = g.UseRegister(node->InputAt(0));       \
+    InstructionOperand operand1 =                                        \
+        g.UseImmediate(OpParameter<int32_t>(node->op()));                \
+    if (IsSupported(AVX)) {                                              \
+      Emit(kAVX##Opcode, g.DefineAsRegister(node), operand0, operand1);  \
+    } else {                                                             \
+      Emit(kSSE##Opcode, g.DefineSameAsFirst(node), operand0, operand1); \
+    }                                                                    \
   }
 SIMD_SHIFT_OPCODES(VISIT_SIMD_SHIFT)
 #undef VISIT_SIMD_SHIFT
+#undef SIMD_SHIFT_OPCODES
 
-#define VISIT_SIMD_INT_UNOP(Opcode)                                         \
+#define VISIT_SIMD_UNOP(Opcode)                                             \
   void InstructionSelector::Visit##Opcode(Node* node) {                     \
     IA32OperandGenerator g(this);                                           \
     Emit(kIA32##Opcode, g.DefineAsRegister(node), g.Use(node->InputAt(0))); \
   }
-SIMD_INT_UNOP_LIST(VISIT_SIMD_INT_UNOP)
-#undef VISIT_SIMD_INT_UNOP
+SIMD_UNOP_LIST(VISIT_SIMD_UNOP)
+#undef VISIT_SIMD_UNOP
+#undef SIMD_UNOP_LIST
 
-#define VISIT_SIMD_OTHER_UNOP(Opcode)                                        \
+#define VISIT_SIMD_UNOP_PREFIX(Opcode)                                       \
   void InstructionSelector::Visit##Opcode(Node* node) {                      \
     IA32OperandGenerator g(this);                                            \
     InstructionCode opcode = IsSupported(AVX) ? kAVX##Opcode : kSSE##Opcode; \
     Emit(opcode, g.DefineAsRegister(node), g.Use(node->InputAt(0)));         \
   }
-SIMD_OTHER_UNOP_LIST(VISIT_SIMD_OTHER_UNOP)
-#undef VISIT_SIMD_OTHER_UNOP
+SIMD_UNOP_PREFIX_LIST(VISIT_SIMD_UNOP_PREFIX)
+#undef VISIT_SIMD_UNOP_PREFIX
+#undef SIMD_UNOP_PREFIX_LIST
 
 #define VISIT_SIMD_BINOP(Opcode)                           \
   void InstructionSelector::Visit##Opcode(Node* node) {    \
@@ -1966,6 +1970,7 @@ SIMD_OTHER_UNOP_LIST(VISIT_SIMD_OTHER_UNOP)
   }
 SIMD_BINOP_LIST(VISIT_SIMD_BINOP)
 #undef VISIT_SIMD_BINOP
+#undef SIMD_BINOP_LIST
 
 void InstructionSelector::VisitInt32AbsWithOverflow(Node* node) {
   UNREACHABLE();
@@ -1975,6 +1980,43 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   UNREACHABLE();
 }
 
+void InstructionSelector::VisitS8x16Shuffle(Node* node) {
+  static const int kMaxSwizzleIndex = 15;
+  static const int kMaxShuffleIndex = 31;
+  const uint8_t* shuffle = OpParameter<uint8_t*>(node->op());
+  uint8_t mask = CanonicalizeShuffle(node);
+  uint8_t shuffle32x4[4];
+  IA32OperandGenerator g(this);
+  InstructionOperand output = g.DefineAsRegister(node);
+  InstructionOperand inputs[6];
+  InstructionOperand temps[1];
+  size_t input_count = 0;
+  Node* input0 = node->InputAt(0);
+  Node* input1 = node->InputAt(1);
+  if (mask == kMaxSwizzleIndex) {
+    if (TryMatch32x4Shuffle(shuffle, shuffle32x4)) {
+      Emit(kIA32S32x4Swizzle, output, g.Use(input0),
+           g.UseImmediate((shuffle32x4[0] & 3) | ((shuffle32x4[1] & 3) << 2) |
+                          ((shuffle32x4[2] & 3) << 4) |
+                          ((shuffle32x4[3] & 3) << 6)));
+      return;
+    }
+    // TODO(ia32): handle non 32x4 swizzles here
+    inputs[input_count++] = g.Use(input0);
+  } else {
+    DCHECK_EQ(kMaxShuffleIndex, mask);
+    USE(kMaxShuffleIndex);
+    inputs[input_count++] = g.Use(input0);
+    inputs[input_count++] = g.Use(input1);
+  }
+  inputs[input_count++] = g.UseImmediate(Pack4Lanes(shuffle, mask));
+  inputs[input_count++] = g.UseImmediate(Pack4Lanes(shuffle + 4, mask));
+  inputs[input_count++] = g.UseImmediate(Pack4Lanes(shuffle + 8, mask));
+  inputs[input_count++] = g.UseImmediate(Pack4Lanes(shuffle + 12, mask));
+  temps[0] = g.TempRegister();
+  Emit(kIA32S8x16Shuffle, 1, &output, input_count, inputs, 1, temps);
+}
+
 // static
 MachineOperatorBuilder::Flags
 InstructionSelector::SupportedMachineOperatorFlags() {
diff --git a/deps/v8/src/compiler/instruction-codes.h b/deps/v8/src/compiler/instruction-codes.h
index df3078d7394..d5820faa5ef 100644
--- a/deps/v8/src/compiler/instruction-codes.h
+++ b/deps/v8/src/compiler/instruction-codes.h
@@ -66,52 +66,54 @@ enum class RecordWriteMode { kValueIsMap, kValueIsPointer, kValueIsAny };
   V(ArchStackPointer)                     \
   V(ArchFramePointer)                     \
   V(ArchParentFramePointer)               \
+  V(ArchRootsPointer)                     \
   V(ArchTruncateDoubleToI)                \
   V(ArchStoreWithWriteBarrier)            \
   V(ArchStackSlot)                        \
-  V(AtomicLoadInt8)                       \
-  V(AtomicLoadUint8)                      \
-  V(AtomicLoadInt16)                      \
-  V(AtomicLoadUint16)                     \
-  V(AtomicLoadWord32)                     \
-  V(AtomicStoreWord8)                     \
-  V(AtomicStoreWord16)                    \
-  V(AtomicStoreWord32)                    \
-  V(AtomicExchangeInt8)                   \
-  V(AtomicExchangeUint8)                  \
-  V(AtomicExchangeInt16)                  \
-  V(AtomicExchangeUint16)                 \
-  V(AtomicExchangeWord32)                 \
-  V(AtomicCompareExchangeInt8)            \
-  V(AtomicCompareExchangeUint8)           \
-  V(AtomicCompareExchangeInt16)           \
-  V(AtomicCompareExchangeUint16)          \
-  V(AtomicCompareExchangeWord32)          \
-  V(AtomicAddInt8)                        \
-  V(AtomicAddUint8)                       \
-  V(AtomicAddInt16)                       \
-  V(AtomicAddUint16)                      \
-  V(AtomicAddWord32)                      \
-  V(AtomicSubInt8)                        \
-  V(AtomicSubUint8)                       \
-  V(AtomicSubInt16)                       \
-  V(AtomicSubUint16)                      \
-  V(AtomicSubWord32)                      \
-  V(AtomicAndInt8)                        \
-  V(AtomicAndUint8)                       \
-  V(AtomicAndInt16)                       \
-  V(AtomicAndUint16)                      \
-  V(AtomicAndWord32)                      \
-  V(AtomicOrInt8)                         \
-  V(AtomicOrUint8)                        \
-  V(AtomicOrInt16)                        \
-  V(AtomicOrUint16)                       \
-  V(AtomicOrWord32)                       \
-  V(AtomicXorInt8)                        \
-  V(AtomicXorUint8)                       \
-  V(AtomicXorInt16)                       \
-  V(AtomicXorUint16)                      \
-  V(AtomicXorWord32)                      \
+  V(ArchPoisonOnSpeculationWord)          \
+  V(Word32AtomicLoadInt8)                 \
+  V(Word32AtomicLoadUint8)                \
+  V(Word32AtomicLoadInt16)                \
+  V(Word32AtomicLoadUint16)               \
+  V(Word32AtomicLoadWord32)               \
+  V(Word32AtomicStoreWord8)               \
+  V(Word32AtomicStoreWord16)              \
+  V(Word32AtomicStoreWord32)              \
+  V(Word32AtomicExchangeInt8)             \
+  V(Word32AtomicExchangeUint8)            \
+  V(Word32AtomicExchangeInt16)            \
+  V(Word32AtomicExchangeUint16)           \
+  V(Word32AtomicExchangeWord32)           \
+  V(Word32AtomicCompareExchangeInt8)      \
+  V(Word32AtomicCompareExchangeUint8)     \
+  V(Word32AtomicCompareExchangeInt16)     \
+  V(Word32AtomicCompareExchangeUint16)    \
+  V(Word32AtomicCompareExchangeWord32)    \
+  V(Word32AtomicAddInt8)                  \
+  V(Word32AtomicAddUint8)                 \
+  V(Word32AtomicAddInt16)                 \
+  V(Word32AtomicAddUint16)                \
+  V(Word32AtomicAddWord32)                \
+  V(Word32AtomicSubInt8)                  \
+  V(Word32AtomicSubUint8)                 \
+  V(Word32AtomicSubInt16)                 \
+  V(Word32AtomicSubUint16)                \
+  V(Word32AtomicSubWord32)                \
+  V(Word32AtomicAndInt8)                  \
+  V(Word32AtomicAndUint8)                 \
+  V(Word32AtomicAndInt16)                 \
+  V(Word32AtomicAndUint16)                \
+  V(Word32AtomicAndWord32)                \
+  V(Word32AtomicOrInt8)                   \
+  V(Word32AtomicOrUint8)                  \
+  V(Word32AtomicOrInt16)                  \
+  V(Word32AtomicOrUint16)                 \
+  V(Word32AtomicOrWord32)                 \
+  V(Word32AtomicXorInt8)                  \
+  V(Word32AtomicXorUint8)                 \
+  V(Word32AtomicXorInt16)                 \
+  V(Word32AtomicXorUint16)                \
+  V(Word32AtomicXorWord32)                \
   V(Ieee754Float64Acos)                   \
   V(Ieee754Float64Acosh)                  \
   V(Ieee754Float64Asin)                   \
@@ -174,9 +176,11 @@ V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
 enum FlagsMode {
   kFlags_none = 0,
   kFlags_branch = 1,
-  kFlags_deoptimize = 2,
-  kFlags_set = 3,
-  kFlags_trap = 4
+  kFlags_branch_and_poison = 2,
+  kFlags_deoptimize = 3,
+  kFlags_deoptimize_and_poison = 4,
+  kFlags_set = 5,
+  kFlags_trap = 6
 };
 
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
@@ -219,6 +223,12 @@ FlagsCondition CommuteFlagsCondition(FlagsCondition condition);
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
                                            const FlagsCondition& fc);
 
+enum MemoryAccessMode {
+  kMemoryAccessDirect = 0,
+  kMemoryAccessProtected = 1,
+  kMemoryAccessPoisoned = 2
+};
+
 // The InstructionCode is an opaque, target-specific integer that encodes
 // what code to emit for an instruction in the code generator. It is not
 // interesting to the register allocator, as the inputs and flags on the
diff --git a/deps/v8/src/compiler/instruction-scheduler.cc b/deps/v8/src/compiler/instruction-scheduler.cc
index f7afaab6976..9219e9a520c 100644
--- a/deps/v8/src/compiler/instruction-scheduler.cc
+++ b/deps/v8/src/compiler/instruction-scheduler.cc
@@ -6,6 +6,7 @@
 
 #include "src/base/adapters.h"
 #include "src/base/utils/random-number-generator.h"
+#include "src/isolate.h"
 
 namespace v8 {
 namespace internal {
@@ -114,17 +115,24 @@ void InstructionScheduler::EndBlock(RpoNumber rpo) {
   operands_map_.clear();
 }
 
+void InstructionScheduler::AddTerminator(Instruction* instr) {
+  ScheduleGraphNode* new_node = new (zone()) ScheduleGraphNode(zone(), instr);
+  // Make sure that basic block terminators are not moved by adding them
+  // as successor of every instruction.
+  for (ScheduleGraphNode* node : graph_) {
+    node->AddSuccessor(new_node);
+  }
+  graph_.push_back(new_node);
+}
 
 void InstructionScheduler::AddInstruction(Instruction* instr) {
   ScheduleGraphNode* new_node = new (zone()) ScheduleGraphNode(zone(), instr);
 
-  if (IsBlockTerminator(instr)) {
-    // Make sure that basic block terminators are not moved by adding them
-    // as successor of every instruction.
-    for (ScheduleGraphNode* node : graph_) {
-      node->AddSuccessor(new_node);
-    }
-  } else if (IsFixedRegisterParameter(instr)) {
+  // We should not have branches in the middle of a block.
+  DCHECK_NE(instr->flags_mode(), kFlags_branch);
+  DCHECK_NE(instr->flags_mode(), kFlags_branch_and_poison);
+
+  if (IsFixedRegisterParameter(instr)) {
     if (last_live_in_reg_marker_ != nullptr) {
       last_live_in_reg_marker_->AddSuccessor(new_node);
     }
@@ -240,10 +248,17 @@ int InstructionScheduler::GetInstructionFlags(const Instruction* instr) const {
     case kArchNop:
     case kArchFramePointer:
     case kArchParentFramePointer:
+    case kArchRootsPointer:
     case kArchStackSlot:  // Despite its name this opcode will produce a
                           // reference to a frame slot, so it is not affected
                           // by the arm64 dual stack issues mentioned below.
     case kArchComment:
+    case kArchDeoptimize:
+    case kArchJmp:
+    case kArchLookupSwitch:
+    case kArchRet:
+    case kArchTableSwitch:
+    case kArchThrowTerminator:
       return kNoOpcodeFlags;
 
     case kArchTruncateDoubleToI:
@@ -275,6 +290,11 @@ int InstructionScheduler::GetInstructionFlags(const Instruction* instr) const {
       // must not be reordered with instruction with side effects.
       return kIsLoadOperation;
 
+    case kArchPoisonOnSpeculationWord:
+      // While poisoning operations have no side effect, they must not be
+      // reordered relative to branches.
+      return kHasSideEffect;
+
     case kArchPrepareCallCFunction:
     case kArchSaveCallerRegisters:
     case kArchRestoreCallerRegisters:
@@ -283,74 +303,64 @@ int InstructionScheduler::GetInstructionFlags(const Instruction* instr) const {
     case kArchCallCodeObject:
     case kArchCallJSFunction:
     case kArchCallWasmFunction:
-      return kHasSideEffect;
-
     case kArchTailCallCodeObjectFromJSFunction:
     case kArchTailCallCodeObject:
     case kArchTailCallAddress:
     case kArchTailCallWasm:
-      return kHasSideEffect | kIsBlockTerminator;
-
-    case kArchDeoptimize:
-    case kArchJmp:
-    case kArchLookupSwitch:
-    case kArchTableSwitch:
-    case kArchRet:
     case kArchDebugAbort:
     case kArchDebugBreak:
-    case kArchThrowTerminator:
-      return kIsBlockTerminator;
+      return kHasSideEffect;
 
     case kArchStoreWithWriteBarrier:
       return kHasSideEffect;
 
-    case kAtomicLoadInt8:
-    case kAtomicLoadUint8:
-    case kAtomicLoadInt16:
-    case kAtomicLoadUint16:
-    case kAtomicLoadWord32:
+    case kWord32AtomicLoadInt8:
+    case kWord32AtomicLoadUint8:
+    case kWord32AtomicLoadInt16:
+    case kWord32AtomicLoadUint16:
+    case kWord32AtomicLoadWord32:
       return kIsLoadOperation;
 
-    case kAtomicStoreWord8:
-    case kAtomicStoreWord16:
-    case kAtomicStoreWord32:
+    case kWord32AtomicStoreWord8:
+    case kWord32AtomicStoreWord16:
+    case kWord32AtomicStoreWord32:
       return kHasSideEffect;
 
-    case kAtomicExchangeInt8:
-    case kAtomicExchangeUint8:
-    case kAtomicExchangeInt16:
-    case kAtomicExchangeUint16:
-    case kAtomicExchangeWord32:
-    case kAtomicCompareExchangeInt8:
-    case kAtomicCompareExchangeUint8:
-    case kAtomicCompareExchangeInt16:
-    case kAtomicCompareExchangeUint16:
-    case kAtomicCompareExchangeWord32:
-    case kAtomicAddInt8:
-    case kAtomicAddUint8:
-    case kAtomicAddInt16:
-    case kAtomicAddUint16:
-    case kAtomicAddWord32:
-    case kAtomicSubInt8:
-    case kAtomicSubUint8:
-    case kAtomicSubInt16:
-    case kAtomicSubUint16:
-    case kAtomicSubWord32:
-    case kAtomicAndInt8:
-    case kAtomicAndUint8:
-    case kAtomicAndInt16:
-    case kAtomicAndUint16:
-    case kAtomicAndWord32:
-    case kAtomicOrInt8:
-    case kAtomicOrUint8:
-    case kAtomicOrInt16:
-    case kAtomicOrUint16:
-    case kAtomicOrWord32:
-    case kAtomicXorInt8:
-    case kAtomicXorUint8:
-    case kAtomicXorInt16:
-    case kAtomicXorUint16:
-    case kAtomicXorWord32:
+    case kWord32AtomicExchangeInt8:
+    case kWord32AtomicExchangeUint8:
+    case kWord32AtomicExchangeInt16:
+    case kWord32AtomicExchangeUint16:
+    case kWord32AtomicExchangeWord32:
+    case kWord32AtomicCompareExchangeInt8:
+    case kWord32AtomicCompareExchangeUint8:
+    case kWord32AtomicCompareExchangeInt16:
+    case kWord32AtomicCompareExchangeUint16:
+    case kWord32AtomicCompareExchangeWord32:
+    case kWord32AtomicAddInt8:
+    case kWord32AtomicAddUint8:
+    case kWord32AtomicAddInt16:
+    case kWord32AtomicAddUint16:
+    case kWord32AtomicAddWord32:
+    case kWord32AtomicSubInt8:
+    case kWord32AtomicSubUint8:
+    case kWord32AtomicSubInt16:
+    case kWord32AtomicSubUint16:
+    case kWord32AtomicSubWord32:
+    case kWord32AtomicAndInt8:
+    case kWord32AtomicAndUint8:
+    case kWord32AtomicAndInt16:
+    case kWord32AtomicAndUint16:
+    case kWord32AtomicAndWord32:
+    case kWord32AtomicOrInt8:
+    case kWord32AtomicOrUint8:
+    case kWord32AtomicOrInt16:
+    case kWord32AtomicOrUint16:
+    case kWord32AtomicOrWord32:
+    case kWord32AtomicXorInt8:
+    case kWord32AtomicXorUint8:
+    case kWord32AtomicXorInt16:
+    case kWord32AtomicXorUint16:
+    case kWord32AtomicXorWord32:
       return kHasSideEffect;
 
 #define CASE(Name) case k##Name:
@@ -362,13 +372,6 @@ int InstructionScheduler::GetInstructionFlags(const Instruction* instr) const {
   UNREACHABLE();
 }
 
-
-bool InstructionScheduler::IsBlockTerminator(const Instruction* instr) const {
-  return ((GetInstructionFlags(instr) & kIsBlockTerminator) ||
-          (instr->flags_mode() == kFlags_branch));
-}
-
-
 void InstructionScheduler::ComputeTotalLatencies() {
   for (ScheduleGraphNode* node : base::Reversed(graph_)) {
     int max_latency = 0;
diff --git a/deps/v8/src/compiler/instruction-scheduler.h b/deps/v8/src/compiler/instruction-scheduler.h
index 3d7b88f8b66..87d41d30d6e 100644
--- a/deps/v8/src/compiler/instruction-scheduler.h
+++ b/deps/v8/src/compiler/instruction-scheduler.h
@@ -16,12 +16,10 @@ namespace compiler {
 // scheduler is aware of dependencies between instructions.
 enum ArchOpcodeFlags {
   kNoOpcodeFlags = 0,
-  kIsBlockTerminator = 1,  // The instruction marks the end of a basic block
-                           // e.g.: jump and return instructions.
-  kHasSideEffect = 2,      // The instruction has some side effects (memory
-                           // store, function call...)
-  kIsLoadOperation = 4,    // The instruction is a memory load.
-  kMayNeedDeoptOrTrapCheck = 8,  // The instruction may be associated with a
+  kHasSideEffect = 1,    // The instruction has some side effects (memory
+                         // store, function call...)
+  kIsLoadOperation = 2,  // The instruction is a memory load.
+  kMayNeedDeoptOrTrapCheck = 4,  // The instruction may be associated with a
                                  // deopt or trap check which must be run before
                                  // instruction e.g. div on Intel platform which
                                  // will raise an exception when the divisor is
@@ -36,6 +34,7 @@ class InstructionScheduler final : public ZoneObject {
   void EndBlock(RpoNumber rpo);
 
   void AddInstruction(Instruction* instr);
+  void AddTerminator(Instruction* instr);
 
   static bool SchedulerSupported();
 
@@ -153,9 +152,6 @@ class InstructionScheduler final : public ZoneObject {
   int GetInstructionFlags(const Instruction* instr) const;
   int GetTargetInstructionFlags(const Instruction* instr) const;
 
-  // Return true if the instruction is a basic block terminator.
-  bool IsBlockTerminator(const Instruction* instr) const;
-
   // Check whether the given instruction has side effects (e.g. function call,
   // memory store).
   bool HasSideEffect(const Instruction* instr) const {
@@ -208,6 +204,8 @@ class InstructionScheduler final : public ZoneObject {
   InstructionSequence* sequence_;
   ZoneVector<ScheduleGraphNode*> graph_;
 
+  friend class InstructionSchedulerTester;
+
   // Last side effect instruction encountered while building the graph.
   ScheduleGraphNode* last_side_effect_instr_;
 
diff --git a/deps/v8/src/compiler/instruction-selector-impl.h b/deps/v8/src/compiler/instruction-selector-impl.h
index 7c7a2708c51..824b6a53763 100644
--- a/deps/v8/src/compiler/instruction-selector-impl.h
+++ b/deps/v8/src/compiler/instruction-selector-impl.h
@@ -15,15 +15,52 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
+struct CaseInfo {
+  int32_t value;  // The case value.
+  int32_t order;  // The order for lowering to comparisons (less means earlier).
+  BasicBlock* branch;  // The basic blocks corresponding to the case value.
+};
+
+inline bool operator<(const CaseInfo& l, const CaseInfo& r) {
+  return l.order < r.order;
+}
+
 // Helper struct containing data about a table or lookup switch.
-struct SwitchInfo {
-  int32_t min_value;           // minimum value of {case_values}
-  int32_t max_value;           // maximum value of {case_values}
-  size_t value_range;          // |max_value - min_value| + 1
-  size_t case_count;           // number of cases
-  int32_t* case_values;        // actual case values, unsorted
-  BasicBlock** case_branches;  // basic blocks corresponding to case values
-  BasicBlock* default_branch;  // default branch target
+class SwitchInfo {
+ public:
+  SwitchInfo(ZoneVector<CaseInfo>& cases, int32_t min_value, int32_t max_value,
+             BasicBlock* default_branch)
+      : cases_(cases),
+        min_value_(min_value),
+        max_value_(min_value),
+        default_branch_(default_branch) {
+    if (cases.size() != 0) {
+      DCHECK_LE(min_value, max_value);
+      // Note that {value_range} can be 0 if {min_value} is -2^31 and
+      // {max_value} is 2^31-1, so don't assume that it's non-zero below.
+      value_range_ =
+          1u + bit_cast<uint32_t>(max_value) - bit_cast<uint32_t>(min_value);
+    } else {
+      value_range_ = 0;
+    }
+  }
+
+  int32_t min_value() const { return min_value_; }
+  int32_t max_value() const { return max_value_; }
+  size_t value_range() const { return value_range_; }
+  size_t case_count() const { return cases_.size(); }
+  const CaseInfo& GetCase(size_t i) const {
+    DCHECK_LT(i, cases_.size());
+    return cases_[i];
+  }
+  BasicBlock* default_branch() const { return default_branch_; }
+
+ private:
+  const ZoneVector<CaseInfo>& cases_;
+  int32_t min_value_;   // minimum value of {cases_}
+  int32_t max_value_;   // maximum value of {cases_}
+  size_t value_range_;  // |max_value - min_value| + 1
+  BasicBlock* default_branch_;
 };
 
 // A helper class for the instruction selector that simplifies construction of
@@ -91,17 +128,23 @@ class OperandGenerator {
   }
 
   InstructionOperand UseAnyAtEnd(Node* node) {
-    return Use(node, UnallocatedOperand(UnallocatedOperand::ANY,
+    return Use(node, UnallocatedOperand(UnallocatedOperand::REGISTER_OR_SLOT,
                                         UnallocatedOperand::USED_AT_END,
                                         GetVReg(node)));
   }
 
   InstructionOperand UseAny(Node* node) {
-    return Use(node, UnallocatedOperand(UnallocatedOperand::ANY,
+    return Use(node, UnallocatedOperand(UnallocatedOperand::REGISTER_OR_SLOT,
                                         UnallocatedOperand::USED_AT_START,
                                         GetVReg(node)));
   }
 
+  InstructionOperand UseRegisterOrSlotOrConstant(Node* node) {
+    return Use(node, UnallocatedOperand(
+                         UnallocatedOperand::REGISTER_OR_SLOT_OR_CONSTANT,
+                         UnallocatedOperand::USED_AT_START, GetVReg(node)));
+  }
+
   InstructionOperand UseRegister(Node* node) {
     return Use(node, UnallocatedOperand(UnallocatedOperand::MUST_HAVE_REGISTER,
                                         UnallocatedOperand::USED_AT_START,
@@ -206,6 +249,15 @@ class OperandGenerator {
     return op;
   }
 
+  InstructionOperand TempSimd128Register() {
+    UnallocatedOperand op = UnallocatedOperand(
+        UnallocatedOperand::MUST_HAVE_REGISTER,
+        UnallocatedOperand::USED_AT_START, sequence()->NextVirtualRegister());
+    sequence()->MarkAsRepresentation(MachineRepresentation::kSimd128,
+                                     op.virtual_register());
+    return op;
+  }
+
   InstructionOperand TempRegister(Register reg) {
     return UnallocatedOperand(UnallocatedOperand::FIXED_REGISTER, reg.code(),
                               InstructionOperand::kInvalidVirtualRegister);
@@ -235,22 +287,22 @@ class OperandGenerator {
   static Constant ToConstant(const Node* node) {
     switch (node->opcode()) {
       case IrOpcode::kInt32Constant:
-        return Constant(OpParameter<int32_t>(node));
+        return Constant(OpParameter<int32_t>(node->op()));
       case IrOpcode::kInt64Constant:
-        return Constant(OpParameter<int64_t>(node));
+        return Constant(OpParameter<int64_t>(node->op()));
       case IrOpcode::kFloat32Constant:
-        return Constant(OpParameter<float>(node));
+        return Constant(OpParameter<float>(node->op()));
       case IrOpcode::kRelocatableInt32Constant:
       case IrOpcode::kRelocatableInt64Constant:
-        return Constant(OpParameter<RelocatablePtrConstantInfo>(node));
+        return Constant(OpParameter<RelocatablePtrConstantInfo>(node->op()));
       case IrOpcode::kFloat64Constant:
       case IrOpcode::kNumberConstant:
-        return Constant(OpParameter<double>(node));
+        return Constant(OpParameter<double>(node->op()));
       case IrOpcode::kExternalConstant:
       case IrOpcode::kComment:
-        return Constant(OpParameter<ExternalReference>(node));
+        return Constant(OpParameter<ExternalReference>(node->op()));
       case IrOpcode::kHeapConstant:
-        return Constant(OpParameter<Handle<HeapObject>>(node));
+        return Constant(HeapConstantOf(node->op()));
       case IrOpcode::kDeadValue: {
         switch (DeadValueRepresentationOf(node->op())) {
           case MachineRepresentation::kBit:
@@ -277,9 +329,9 @@ class OperandGenerator {
   static Constant ToNegatedConstant(const Node* node) {
     switch (node->opcode()) {
       case IrOpcode::kInt32Constant:
-        return Constant(-OpParameter<int32_t>(node));
+        return Constant(-OpParameter<int32_t>(node->op()));
       case IrOpcode::kInt64Constant:
-        return Constant(-OpParameter<int64_t>(node));
+        return Constant(-OpParameter<int64_t>(node->op()));
       default:
         break;
     }
@@ -341,177 +393,6 @@ class OperandGenerator {
   InstructionSelector* selector_;
 };
 
-
-// The flags continuation is a way to combine a branch or a materialization
-// of a boolean value with an instruction that sets the flags register.
-// The whole instruction is treated as a unit by the register allocator, and
-// thus no spills or moves can be introduced between the flags-setting
-// instruction and the branch or set it should be combined with.
-class FlagsContinuation final {
- public:
-  FlagsContinuation() : mode_(kFlags_none) {}
-
-  // Creates a new flags continuation from the given condition and true/false
-  // blocks.
-  FlagsContinuation(FlagsCondition condition, BasicBlock* true_block,
-                    BasicBlock* false_block)
-      : mode_(kFlags_branch),
-        condition_(condition),
-        true_block_(true_block),
-        false_block_(false_block) {
-    DCHECK_NOT_NULL(true_block);
-    DCHECK_NOT_NULL(false_block);
-  }
-
-  // Creates a new flags continuation for an eager deoptimization exit.
-  static FlagsContinuation ForDeoptimize(FlagsCondition condition,
-                                         DeoptimizeKind kind,
-                                         DeoptimizeReason reason,
-                                         VectorSlotPair const& feedback,
-                                         Node* frame_state) {
-    return FlagsContinuation(condition, kind, reason, feedback, frame_state);
-  }
-
-  // Creates a new flags continuation for a boolean value.
-  static FlagsContinuation ForSet(FlagsCondition condition, Node* result) {
-    return FlagsContinuation(condition, result);
-  }
-
-  // Creates a new flags continuation for a wasm trap.
-  static FlagsContinuation ForTrap(FlagsCondition condition,
-                                   Runtime::FunctionId trap_id, Node* result) {
-    return FlagsContinuation(condition, trap_id, result);
-  }
-
-  bool IsNone() const { return mode_ == kFlags_none; }
-  bool IsBranch() const { return mode_ == kFlags_branch; }
-  bool IsDeoptimize() const { return mode_ == kFlags_deoptimize; }
-  bool IsSet() const { return mode_ == kFlags_set; }
-  bool IsTrap() const { return mode_ == kFlags_trap; }
-  FlagsCondition condition() const {
-    DCHECK(!IsNone());
-    return condition_;
-  }
-  DeoptimizeKind kind() const {
-    DCHECK(IsDeoptimize());
-    return kind_;
-  }
-  DeoptimizeReason reason() const {
-    DCHECK(IsDeoptimize());
-    return reason_;
-  }
-  VectorSlotPair const& feedback() const {
-    DCHECK(IsDeoptimize());
-    return feedback_;
-  }
-  Node* frame_state() const {
-    DCHECK(IsDeoptimize());
-    return frame_state_or_result_;
-  }
-  Node* result() const {
-    DCHECK(IsSet());
-    return frame_state_or_result_;
-  }
-  Runtime::FunctionId trap_id() const {
-    DCHECK(IsTrap());
-    return trap_id_;
-  }
-  BasicBlock* true_block() const {
-    DCHECK(IsBranch());
-    return true_block_;
-  }
-  BasicBlock* false_block() const {
-    DCHECK(IsBranch());
-    return false_block_;
-  }
-
-  void Negate() {
-    DCHECK(!IsNone());
-    condition_ = NegateFlagsCondition(condition_);
-  }
-
-  void Commute() {
-    DCHECK(!IsNone());
-    condition_ = CommuteFlagsCondition(condition_);
-  }
-
-  void Overwrite(FlagsCondition condition) { condition_ = condition; }
-
-  void OverwriteAndNegateIfEqual(FlagsCondition condition) {
-    DCHECK(condition_ == kEqual || condition_ == kNotEqual);
-    bool negate = condition_ == kEqual;
-    condition_ = condition;
-    if (negate) Negate();
-  }
-
-  void OverwriteUnsignedIfSigned() {
-    switch (condition_) {
-      case kSignedLessThan:
-        condition_ = kUnsignedLessThan;
-        break;
-      case kSignedLessThanOrEqual:
-        condition_ = kUnsignedLessThanOrEqual;
-        break;
-      case kSignedGreaterThan:
-        condition_ = kUnsignedGreaterThan;
-        break;
-      case kSignedGreaterThanOrEqual:
-        condition_ = kUnsignedGreaterThanOrEqual;
-        break;
-      default:
-        break;
-    }
-  }
-
-  // Encodes this flags continuation into the given opcode.
-  InstructionCode Encode(InstructionCode opcode) {
-    opcode |= FlagsModeField::encode(mode_);
-    if (mode_ != kFlags_none) {
-      opcode |= FlagsConditionField::encode(condition_);
-    }
-    return opcode;
-  }
-
- private:
-  FlagsContinuation(FlagsCondition condition, DeoptimizeKind kind,
-                    DeoptimizeReason reason, VectorSlotPair const& feedback,
-                    Node* frame_state)
-      : mode_(kFlags_deoptimize),
-        condition_(condition),
-        kind_(kind),
-        reason_(reason),
-        feedback_(feedback),
-        frame_state_or_result_(frame_state) {
-    DCHECK_NOT_NULL(frame_state);
-  }
-  FlagsContinuation(FlagsCondition condition, Node* result)
-      : mode_(kFlags_set),
-        condition_(condition),
-        frame_state_or_result_(result) {
-    DCHECK_NOT_NULL(result);
-  }
-
-  FlagsContinuation(FlagsCondition condition, Runtime::FunctionId trap_id,
-                    Node* result)
-      : mode_(kFlags_trap),
-        condition_(condition),
-        frame_state_or_result_(result),
-        trap_id_(trap_id) {
-    DCHECK_NOT_NULL(result);
-  }
-
-  FlagsMode const mode_;
-  FlagsCondition condition_;
-  DeoptimizeKind kind_;          // Only valid if mode_ == kFlags_deoptimize
-  DeoptimizeReason reason_;      // Only valid if mode_ == kFlags_deoptimize
-  VectorSlotPair feedback_;      // Only valid if mode_ == kFlags_deoptimize
-  Node* frame_state_or_result_;  // Only valid if mode_ == kFlags_deoptimize
-                                 // or mode_ == kFlags_set.
-  BasicBlock* true_block_;       // Only valid if mode_ == kFlags_branch.
-  BasicBlock* false_block_;      // Only valid if mode_ == kFlags_branch.
-  Runtime::FunctionId trap_id_;  // Only valid if mode_ == kFlags_trap.
-};
-
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/instruction-selector.cc b/deps/v8/src/compiler/instruction-selector.cc
index c94b42b4583..38eeb925f48 100644
--- a/deps/v8/src/compiler/instruction-selector.cc
+++ b/deps/v8/src/compiler/instruction-selector.cc
@@ -24,9 +24,11 @@ InstructionSelector::InstructionSelector(
     Zone* zone, size_t node_count, Linkage* linkage,
     InstructionSequence* sequence, Schedule* schedule,
     SourcePositionTable* source_positions, Frame* frame,
+    EnableSwitchJumpTable enable_switch_jump_table,
     SourcePositionMode source_position_mode, Features features,
     EnableScheduling enable_scheduling,
-    EnableSerialization enable_serialization)
+    EnableSerialization enable_serialization,
+    PoisoningMitigationLevel poisoning_enabled)
     : zone_(zone),
       linkage_(linkage),
       sequence_(sequence),
@@ -36,6 +38,8 @@ InstructionSelector::InstructionSelector(
       schedule_(schedule),
       current_block_(nullptr),
       instructions_(zone),
+      continuation_inputs_(sequence->zone()),
+      continuation_outputs_(sequence->zone()),
       defined_(node_count, false, zone),
       used_(node_count, false, zone),
       effect_level_(node_count, 0, zone),
@@ -45,9 +49,13 @@ InstructionSelector::InstructionSelector(
       scheduler_(nullptr),
       enable_scheduling_(enable_scheduling),
       enable_serialization_(enable_serialization),
+      enable_switch_jump_table_(enable_switch_jump_table),
+      poisoning_enabled_(poisoning_enabled),
       frame_(frame),
       instruction_selection_failed_(false) {
   instructions_.reserve(node_count);
+  continuation_inputs_.reserve(5);
+  continuation_outputs_.reserve(2);
 }
 
 bool InstructionSelector::SelectInstructions() {
@@ -87,9 +95,13 @@ bool InstructionSelector::SelectInstructions() {
     size_t start = instruction_block->code_start();
     DCHECK_LE(end, start);
     StartBlock(RpoNumber::FromInt(block->rpo_number()));
-    while (start-- > end) {
-      UpdateRenames(instructions_[start]);
-      AddInstruction(instructions_[start]);
+    if (end != start) {
+      while (start-- > end + 1) {
+        UpdateRenames(instructions_[start]);
+        AddInstruction(instructions_[start]);
+      }
+      UpdateRenames(instructions_[end]);
+      AddTerminator(instructions_[end]);
     }
     EndBlock(RpoNumber::FromInt(block->rpo_number()));
   }
@@ -118,6 +130,14 @@ void InstructionSelector::EndBlock(RpoNumber rpo) {
   }
 }
 
+void InstructionSelector::AddTerminator(Instruction* instr) {
+  if (UseInstructionScheduling()) {
+    DCHECK_NOT_NULL(scheduler_);
+    scheduler_->AddTerminator(instr);
+  } else {
+    sequence()->AddInstruction(instr);
+  }
+}
 
 void InstructionSelector::AddInstruction(Instruction* instr) {
   if (UseInstructionScheduling()) {
@@ -443,7 +463,7 @@ InstructionOperand OperandForDeopt(Isolate* isolate, OperandGenerator* g,
         return InstructionOperand();
       }
 
-      Handle<HeapObject> constant = OpParameter<Handle<HeapObject>>(input);
+      Handle<HeapObject> constant = HeapConstantOf(input->op());
       Heap::RootListIndex root_index;
       if (isolate->heap()->IsRootHandle(constant, &root_index) &&
           root_index == Heap::kOptimizedOutRootIndex) {
@@ -646,21 +666,120 @@ size_t InstructionSelector::AddInputsToFrameStateDescriptor(
   return entries;
 }
 
+Instruction* InstructionSelector::EmitWithContinuation(
+    InstructionCode opcode, FlagsContinuation* cont) {
+  return EmitWithContinuation(opcode, 0, nullptr, 0, nullptr, cont);
+}
+
+Instruction* InstructionSelector::EmitWithContinuation(
+    InstructionCode opcode, InstructionOperand a, FlagsContinuation* cont) {
+  return EmitWithContinuation(opcode, 0, nullptr, 1, &a, cont);
+}
+
+Instruction* InstructionSelector::EmitWithContinuation(
+    InstructionCode opcode, InstructionOperand a, InstructionOperand b,
+    FlagsContinuation* cont) {
+  InstructionOperand inputs[] = {a, b};
+  return EmitWithContinuation(opcode, 0, nullptr, arraysize(inputs), inputs,
+                              cont);
+}
+
+Instruction* InstructionSelector::EmitWithContinuation(
+    InstructionCode opcode, InstructionOperand a, InstructionOperand b,
+    InstructionOperand c, FlagsContinuation* cont) {
+  InstructionOperand inputs[] = {a, b, c};
+  return EmitWithContinuation(opcode, 0, nullptr, arraysize(inputs), inputs,
+                              cont);
+}
+
+Instruction* InstructionSelector::EmitWithContinuation(
+    InstructionCode opcode, size_t output_count, InstructionOperand* outputs,
+    size_t input_count, InstructionOperand* inputs, FlagsContinuation* cont) {
+  OperandGenerator g(this);
+
+  opcode = cont->Encode(opcode);
+
+  continuation_inputs_.resize(0);
+  for (size_t i = 0; i < input_count; i++) {
+    continuation_inputs_.push_back(inputs[i]);
+  }
+
+  continuation_outputs_.resize(0);
+  for (size_t i = 0; i < output_count; i++) {
+    continuation_outputs_.push_back(outputs[i]);
+  }
+
+  if (cont->IsBranch()) {
+    continuation_inputs_.push_back(g.Label(cont->true_block()));
+    continuation_inputs_.push_back(g.Label(cont->false_block()));
+  } else if (cont->IsDeoptimize()) {
+    opcode |= MiscField::encode(static_cast<int>(input_count));
+    AppendDeoptimizeArguments(&continuation_inputs_, cont->kind(),
+                              cont->reason(), cont->feedback(),
+                              cont->frame_state());
+  } else if (cont->IsSet()) {
+    continuation_outputs_.push_back(g.DefineAsRegister(cont->result()));
+  } else if (cont->IsTrap()) {
+    continuation_inputs_.push_back(g.UseImmediate(cont->trap_id()));
+  } else {
+    DCHECK(cont->IsNone());
+  }
+
+  size_t const emit_inputs_size = continuation_inputs_.size();
+  auto* emit_inputs =
+      emit_inputs_size ? &continuation_inputs_.front() : nullptr;
+  size_t const emit_outputs_size = continuation_outputs_.size();
+  auto* emit_outputs =
+      emit_outputs_size ? &continuation_outputs_.front() : nullptr;
+  return Emit(opcode, emit_outputs_size, emit_outputs, emit_inputs_size,
+              emit_inputs, 0, nullptr);
+}
+
+void InstructionSelector::AppendDeoptimizeArguments(
+    InstructionOperandVector* args, DeoptimizeKind kind,
+    DeoptimizeReason reason, VectorSlotPair const& feedback,
+    Node* frame_state) {
+  OperandGenerator g(this);
+  FrameStateDescriptor* const descriptor = GetFrameStateDescriptor(frame_state);
+  DCHECK_NE(DeoptimizeKind::kLazy, kind);
+  int const state_id =
+      sequence()->AddDeoptimizationEntry(descriptor, kind, reason, feedback);
+  args->push_back(g.TempImmediate(state_id));
+  StateObjectDeduplicator deduplicator(instruction_zone());
+  AddInputsToFrameStateDescriptor(descriptor, frame_state, &g, &deduplicator,
+                                  args, FrameStateInputKind::kAny,
+                                  instruction_zone());
+}
+
+Instruction* InstructionSelector::EmitDeoptimize(
+    InstructionCode opcode, size_t output_count, InstructionOperand* outputs,
+    size_t input_count, InstructionOperand* inputs, DeoptimizeKind kind,
+    DeoptimizeReason reason, VectorSlotPair const& feedback,
+    Node* frame_state) {
+  InstructionOperandVector args(instruction_zone());
+  for (size_t i = 0; i < input_count; ++i) {
+    args.push_back(inputs[i]);
+  }
+  opcode |= MiscField::encode(static_cast<int>(input_count));
+  AppendDeoptimizeArguments(&args, kind, reason, feedback, frame_state);
+  return Emit(opcode, output_count, outputs, args.size(), &args.front(), 0,
+              nullptr);
+}
 
 // An internal helper class for generating the operands to calls.
 // TODO(bmeurer): Get rid of the CallBuffer business and make
 // InstructionSelector::VisitCall platform independent instead.
 struct CallBuffer {
-  CallBuffer(Zone* zone, const CallDescriptor* descriptor,
+  CallBuffer(Zone* zone, const CallDescriptor* call_descriptor,
              FrameStateDescriptor* frame_state)
-      : descriptor(descriptor),
+      : descriptor(call_descriptor),
         frame_state_descriptor(frame_state),
         output_nodes(zone),
         outputs(zone),
         instruction_args(zone),
         pushed_nodes(zone) {
-    output_nodes.reserve(descriptor->ReturnCount());
-    outputs.reserve(descriptor->ReturnCount());
+    output_nodes.reserve(call_descriptor->ReturnCount());
+    outputs.reserve(call_descriptor->ReturnCount());
     pushed_nodes.reserve(input_count());
     instruction_args.reserve(input_count() + frame_state_value_count());
   }
@@ -758,19 +877,30 @@ void InstructionSelector::InitializeCallBuffer(Node* call, CallBuffer* buffer,
   Node* callee = call->InputAt(0);
   bool call_code_immediate = (flags & kCallCodeImmediate) != 0;
   bool call_address_immediate = (flags & kCallAddressImmediate) != 0;
+  bool call_use_fixed_target_reg = (flags & kCallFixedTargetRegister) != 0;
   switch (buffer->descriptor->kind()) {
     case CallDescriptor::kCallCodeObject:
+      // TODO(jgruber, v8:7449): The below is a hack to support tail-calls from
+      // JS-linkage callers with a register code target. The problem is that the
+      // code target register may be clobbered before the final jmp by
+      // AssemblePopArgumentsAdaptorFrame. As a more permanent fix we could
+      // entirely remove support for tail-calls from JS-linkage callers.
       buffer->instruction_args.push_back(
           (call_code_immediate && callee->opcode() == IrOpcode::kHeapConstant)
               ? g.UseImmediate(callee)
-              : g.UseRegister(callee));
+              : call_use_fixed_target_reg
+                    ? g.UseFixed(callee, kJavaScriptCallCodeStartRegister)
+                    : is_tail_call ? g.UseUniqueRegister(callee)
+                                   : g.UseRegister(callee));
       break;
     case CallDescriptor::kCallAddress:
       buffer->instruction_args.push_back(
           (call_address_immediate &&
            callee->opcode() == IrOpcode::kExternalConstant)
               ? g.UseImmediate(callee)
-              : g.UseRegister(callee));
+              : call_use_fixed_target_reg
+                    ? g.UseFixed(callee, kJavaScriptCallCodeStartRegister)
+                    : g.UseRegister(callee));
       break;
     case CallDescriptor::kCallWasmFunction:
       buffer->instruction_args.push_back(
@@ -778,7 +908,9 @@ void InstructionSelector::InitializeCallBuffer(Node* call, CallBuffer* buffer,
            (callee->opcode() == IrOpcode::kRelocatableInt64Constant ||
             callee->opcode() == IrOpcode::kRelocatableInt32Constant))
               ? g.UseImmediate(callee)
-              : g.UseRegister(callee));
+              : call_use_fixed_target_reg
+                    ? g.UseFixed(callee, kJavaScriptCallCodeStartRegister)
+                    : g.UseRegister(callee));
       break;
     case CallDescriptor::kCallJSFunction:
       buffer->instruction_args.push_back(
@@ -787,10 +919,17 @@ void InstructionSelector::InitializeCallBuffer(Node* call, CallBuffer* buffer,
   }
   DCHECK_EQ(1u, buffer->instruction_args.size());
 
+  // Argument 1 is used for poison-alias index (encoded in a word-sized
+  // immediate. This an index of the operand that aliases with poison register
+  // or -1 if there is no aliasing.
+  buffer->instruction_args.push_back(g.TempImmediate(-1));
+  const size_t poison_alias_index = 1;
+  DCHECK_EQ(buffer->instruction_args.size() - 1, poison_alias_index);
+
   // If the call needs a frame state, we insert the state information as
   // follows (n is the number of value inputs to the frame state):
-  // arg 1               : deoptimization id.
-  // arg 2 - arg (n + 1) : value inputs to the frame state.
+  // arg 2               : deoptimization id.
+  // arg 3 - arg (n + 2) : value inputs to the frame state.
   size_t frame_state_entries = 0;
   USE(frame_state_entries);  // frame_state_entries is only used for debug.
   if (buffer->frame_state_descriptor != nullptr) {
@@ -826,7 +965,7 @@ void InstructionSelector::InitializeCallBuffer(Node* call, CallBuffer* buffer,
                 &buffer->instruction_args, FrameStateInputKind::kStackSlot,
                 instruction_zone());
 
-    DCHECK_EQ(1 + frame_state_entries, buffer->instruction_args.size());
+    DCHECK_EQ(2 + frame_state_entries, buffer->instruction_args.size());
   }
 
   size_t input_count = static_cast<size_t>(buffer->input_count());
@@ -849,8 +988,9 @@ void InstructionSelector::InitializeCallBuffer(Node* call, CallBuffer* buffer,
           location, stack_param_delta);
     }
     InstructionOperand op = g.UseLocation(*iter, location);
-    if (UnallocatedOperand::cast(op).HasFixedSlotPolicy() && !call_tail) {
-      int stack_index = -UnallocatedOperand::cast(op).fixed_slot_index() - 1;
+    UnallocatedOperand unallocated = UnallocatedOperand::cast(op);
+    if (unallocated.HasFixedSlotPolicy() && !call_tail) {
+      int stack_index = -unallocated.fixed_slot_index() - 1;
       if (static_cast<size_t>(stack_index) >= buffer->pushed_nodes.size()) {
         buffer->pushed_nodes.resize(stack_index + 1);
       }
@@ -858,11 +998,23 @@ void InstructionSelector::InitializeCallBuffer(Node* call, CallBuffer* buffer,
       buffer->pushed_nodes[stack_index] = param;
       pushed_count++;
     } else {
+      // If we do load poisoning and the linkage uses the poisoning register,
+      // then we request the input in memory location, and during code
+      // generation, we move the input to the register.
+      if (poisoning_enabled_ != PoisoningMitigationLevel::kOff &&
+          unallocated.HasFixedRegisterPolicy()) {
+        int reg = unallocated.fixed_register_index();
+        if (reg == kSpeculationPoisonRegister.code()) {
+          buffer->instruction_args[poison_alias_index] = g.TempImmediate(
+              static_cast<int32_t>(buffer->instruction_args.size()));
+          op = g.UseRegisterOrSlotOrConstant(*iter);
+        }
+      }
       buffer->instruction_args.push_back(op);
     }
   }
   DCHECK_EQ(input_count, buffer->instruction_args.size() + pushed_count -
-                             frame_state_entries);
+                             frame_state_entries - 1);
   if (V8_TARGET_ARCH_STORES_RETURN_ADDRESS_ON_STACK && call_tail &&
       stack_param_delta != 0) {
     // For tail calls that change the size of their parameter list and keep
@@ -1001,33 +1153,24 @@ void InstructionSelector::VisitControl(BasicBlock* block) {
     }
     case BasicBlock::kSwitch: {
       DCHECK_EQ(IrOpcode::kSwitch, input->opcode());
-      SwitchInfo sw;
-      // Last successor must be Default.
-      sw.default_branch = block->successors().back();
-      DCHECK_EQ(IrOpcode::kIfDefault, sw.default_branch->front()->opcode());
-      // All other successors must be cases.
-      sw.case_count = block->SuccessorCount() - 1;
-      sw.case_branches = &block->successors().front();
-      // Determine case values and their min/max.
-      sw.case_values = zone()->NewArray<int32_t>(sw.case_count);
-      sw.min_value = std::numeric_limits<int32_t>::max();
-      sw.max_value = std::numeric_limits<int32_t>::min();
-      for (size_t index = 0; index < sw.case_count; ++index) {
-        BasicBlock* branch = sw.case_branches[index];
-        int32_t value = OpParameter<int32_t>(branch->front()->op());
-        sw.case_values[index] = value;
-        if (sw.min_value > value) sw.min_value = value;
-        if (sw.max_value < value) sw.max_value = value;
-      }
-      if (sw.case_count != 0) {
-        DCHECK_LE(sw.min_value, sw.max_value);
-        // Note that {value_range} can be 0 if {min_value} is -2^31 and
-        // {max_value} is 2^31-1, so don't assume that it's non-zero below.
-        sw.value_range = 1u + bit_cast<uint32_t>(sw.max_value) -
-                         bit_cast<uint32_t>(sw.min_value);
-      } else {
-        sw.value_range = 0;
+      // Last successor must be {IfDefault}.
+      BasicBlock* default_branch = block->successors().back();
+      DCHECK_EQ(IrOpcode::kIfDefault, default_branch->front()->opcode());
+      // All other successors must be {IfValue}s.
+      int32_t min_value = std::numeric_limits<int32_t>::max();
+      int32_t max_value = std::numeric_limits<int32_t>::min();
+      size_t case_count = block->SuccessorCount() - 1;
+      ZoneVector<CaseInfo> cases(case_count, zone());
+      for (size_t i = 0; i < case_count; ++i) {
+        BasicBlock* branch = block->SuccessorAt(i);
+        const IfValueParameters& p = IfValueParametersOf(branch->front()->op());
+        cases[i] = CaseInfo{p.value(), p.comparison_order(), branch};
+        if (min_value > p.value()) min_value = p.value();
+        if (max_value < p.value()) max_value = p.value();
       }
+      // Ensure that comparison order of if-cascades is preserved.
+      std::stable_sort(cases.begin(), cases.end());
+      SwitchInfo sw(cases, min_value, max_value, default_branch);
       return VisitSwitch(input, sw);
     }
     case BasicBlock::kReturn: {
@@ -1116,7 +1259,7 @@ void InstructionSelector::VisitNode(Node* node) {
     case IrOpcode::kHeapConstant:
       return MarkAsReference(node), VisitConstant(node);
     case IrOpcode::kNumberConstant: {
-      double value = OpParameter<double>(node);
+      double value = OpParameter<double>(node->op());
       if (!IsSmiDouble(value)) MarkAsReference(node);
       return VisitConstant(node);
     }
@@ -1161,6 +1304,11 @@ void InstructionSelector::VisitNode(Node* node) {
       MarkAsRepresentation(type.representation(), node);
       return VisitLoad(node);
     }
+    case IrOpcode::kPoisonedLoad: {
+      LoadRepresentation type = LoadRepresentationOf(node->op());
+      MarkAsRepresentation(type.representation(), node);
+      return VisitPoisonedLoad(node);
+    }
     case IrOpcode::kStore:
       return VisitStore(node);
     case IrOpcode::kProtectedStore:
@@ -1470,6 +1618,11 @@ void InstructionSelector::VisitNode(Node* node) {
       return MarkAsFloat64(node), VisitFloat64InsertLowWord32(node);
     case IrOpcode::kFloat64InsertHighWord32:
       return MarkAsFloat64(node), VisitFloat64InsertHighWord32(node);
+    case IrOpcode::kPoisonOnSpeculationTagged:
+      return MarkAsReference(node), VisitPoisonOnSpeculationTagged(node);
+    case IrOpcode::kPoisonOnSpeculationWord:
+      return MarkAsRepresentation(MachineType::PointerRepresentation(), node),
+             VisitPoisonOnSpeculationWord(node);
     case IrOpcode::kStackSlot:
       return VisitStackSlot(node);
     case IrOpcode::kLoadStackPointer:
@@ -1478,9 +1631,10 @@ void InstructionSelector::VisitNode(Node* node) {
       return VisitLoadFramePointer(node);
     case IrOpcode::kLoadParentFramePointer:
       return VisitLoadParentFramePointer(node);
+    case IrOpcode::kLoadRootsPointer:
+      return VisitLoadRootsPointer(node);
     case IrOpcode::kUnalignedLoad: {
-      UnalignedLoadRepresentation type =
-          UnalignedLoadRepresentationOf(node->op());
+      LoadRepresentation type = LoadRepresentationOf(node->op());
       MarkAsRepresentation(type.representation(), node);
       return VisitUnalignedLoad(node);
     }
@@ -1510,26 +1664,40 @@ void InstructionSelector::VisitNode(Node* node) {
       MarkAsWord32(node);
       MarkPairProjectionsAsWord32(node);
       return VisitWord32PairSar(node);
-    case IrOpcode::kAtomicLoad: {
+    case IrOpcode::kWord32AtomicLoad: {
+      LoadRepresentation type = LoadRepresentationOf(node->op());
+      MarkAsRepresentation(type.representation(), node);
+      return VisitWord32AtomicLoad(node);
+    }
+    case IrOpcode::kWord64AtomicLoad: {
       LoadRepresentation type = LoadRepresentationOf(node->op());
       MarkAsRepresentation(type.representation(), node);
-      return VisitAtomicLoad(node);
+      return VisitWord64AtomicLoad(node);
     }
-    case IrOpcode::kAtomicStore:
-      return VisitAtomicStore(node);
-#define ATOMIC_CASE(name)                                    \
-  case IrOpcode::kAtomic##name: {                            \
+    case IrOpcode::kWord32AtomicStore:
+      return VisitWord32AtomicStore(node);
+    case IrOpcode::kWord64AtomicStore:
+      return VisitWord64AtomicStore(node);
+#define ATOMIC_CASE(name, rep)                               \
+  case IrOpcode::k##rep##Atomic##name: {                     \
     MachineType type = AtomicOpRepresentationOf(node->op()); \
     MarkAsRepresentation(type.representation(), node);       \
-    return VisitAtomic##name(node);                          \
-  }
-      ATOMIC_CASE(Exchange)
-      ATOMIC_CASE(CompareExchange)
-      ATOMIC_CASE(Add)
-      ATOMIC_CASE(Sub)
-      ATOMIC_CASE(And)
-      ATOMIC_CASE(Or)
-      ATOMIC_CASE(Xor)
+    return Visit##rep##Atomic##name(node);                   \
+  }
+      ATOMIC_CASE(Add, Word32)
+      ATOMIC_CASE(Add, Word64)
+      ATOMIC_CASE(Sub, Word32)
+      ATOMIC_CASE(Sub, Word64)
+      ATOMIC_CASE(And, Word32)
+      ATOMIC_CASE(And, Word64)
+      ATOMIC_CASE(Or, Word32)
+      ATOMIC_CASE(Or, Word64)
+      ATOMIC_CASE(Xor, Word32)
+      ATOMIC_CASE(Xor, Word64)
+      ATOMIC_CASE(Exchange, Word32)
+      ATOMIC_CASE(Exchange, Word64)
+      ATOMIC_CASE(CompareExchange, Word32)
+      ATOMIC_CASE(CompareExchange, Word64)
 #undef ATOMIC_CASE
     case IrOpcode::kSpeculationFence:
       return VisitSpeculationFence(node);
@@ -1538,6 +1706,16 @@ void InstructionSelector::VisitNode(Node* node) {
       MarkAsRepresentation(type.representation(), node);
       return VisitProtectedLoad(node);
     }
+    case IrOpcode::kSignExtendWord8ToInt32:
+      return MarkAsWord32(node), VisitSignExtendWord8ToInt32(node);
+    case IrOpcode::kSignExtendWord16ToInt32:
+      return MarkAsWord32(node), VisitSignExtendWord16ToInt32(node);
+    case IrOpcode::kSignExtendWord8ToInt64:
+      return MarkAsWord64(node), VisitSignExtendWord8ToInt64(node);
+    case IrOpcode::kSignExtendWord16ToInt64:
+      return MarkAsWord64(node), VisitSignExtendWord16ToInt64(node);
+    case IrOpcode::kSignExtendWord32ToInt64:
+      return MarkAsWord64(node), VisitSignExtendWord32ToInt64(node);
     case IrOpcode::kUnsafePointerAdd:
       MarkAsRepresentation(MachineType::PointerRepresentation(), node);
       return VisitUnsafePointerAdd(node);
@@ -1774,12 +1952,28 @@ void InstructionSelector::VisitNode(Node* node) {
     case IrOpcode::kS1x16AllTrue:
       return MarkAsWord32(node), VisitS1x16AllTrue(node);
     default:
-      V8_Fatal(__FILE__, __LINE__, "Unexpected operator #%d:%s @ node #%d",
-               node->opcode(), node->op()->mnemonic(), node->id());
+      FATAL("Unexpected operator #%d:%s @ node #%d", node->opcode(),
+            node->op()->mnemonic(), node->id());
       break;
   }
 }
 
+void InstructionSelector::VisitPoisonOnSpeculationWord(Node* node) {
+  if (poisoning_enabled_ != PoisoningMitigationLevel::kOff) {
+    OperandGenerator g(this);
+    Node* input_node = NodeProperties::GetValueInput(node, 0);
+    InstructionOperand input = g.UseRegister(input_node);
+    InstructionOperand output = g.DefineSameAsFirst(node);
+    Emit(kArchPoisonOnSpeculationWord, output, input);
+  } else {
+    EmitIdentity(node);
+  }
+}
+
+void InstructionSelector::VisitPoisonOnSpeculationTagged(Node* node) {
+  VisitPoisonOnSpeculationWord(node);
+}
+
 void InstructionSelector::VisitLoadStackPointer(Node* node) {
   OperandGenerator g(this);
   Emit(kArchStackPointer, g.DefineAsRegister(node));
@@ -1795,6 +1989,11 @@ void InstructionSelector::VisitLoadParentFramePointer(Node* node) {
   Emit(kArchParentFramePointer, g.DefineAsRegister(node));
 }
 
+void InstructionSelector::VisitLoadRootsPointer(Node* node) {
+  OperandGenerator g(this);
+  Emit(kArchRootsPointer, g.DefineAsRegister(node));
+}
+
 void InstructionSelector::VisitFloat64Acos(Node* node) {
   VisitFloat64Ieee754Unop(node, kIeee754Float64Acos);
 }
@@ -1882,18 +2081,18 @@ void InstructionSelector::VisitFloat64Tanh(Node* node) {
 void InstructionSelector::EmitTableSwitch(const SwitchInfo& sw,
                                           InstructionOperand& index_operand) {
   OperandGenerator g(this);
-  size_t input_count = 2 + sw.value_range;
-  DCHECK_LE(sw.value_range, std::numeric_limits<size_t>::max() - 2);
+  size_t input_count = 2 + sw.value_range();
+  DCHECK_LE(sw.value_range(), std::numeric_limits<size_t>::max() - 2);
   auto* inputs = zone()->NewArray<InstructionOperand>(input_count);
   inputs[0] = index_operand;
-  InstructionOperand default_operand = g.Label(sw.default_branch);
+  InstructionOperand default_operand = g.Label(sw.default_branch());
   std::fill(&inputs[1], &inputs[input_count], default_operand);
-  for (size_t index = 0; index < sw.case_count; ++index) {
-    size_t value = sw.case_values[index] - sw.min_value;
-    BasicBlock* branch = sw.case_branches[index];
+  for (size_t index = 0; index < sw.case_count(); ++index) {
+    const CaseInfo& c = sw.GetCase(index);
+    size_t value = c.value - sw.min_value();
     DCHECK_LE(0u, value);
     DCHECK_LT(value + 2, input_count);
-    inputs[value + 2] = g.Label(branch);
+    inputs[value + 2] = g.Label(c.branch);
   }
   Emit(kArchTableSwitch, 0, nullptr, input_count, inputs, 0, nullptr);
 }
@@ -1902,16 +2101,15 @@ void InstructionSelector::EmitTableSwitch(const SwitchInfo& sw,
 void InstructionSelector::EmitLookupSwitch(const SwitchInfo& sw,
                                            InstructionOperand& value_operand) {
   OperandGenerator g(this);
-  size_t input_count = 2 + sw.case_count * 2;
-  DCHECK_LE(sw.case_count, (std::numeric_limits<size_t>::max() - 2) / 2);
+  size_t input_count = 2 + sw.case_count() * 2;
+  DCHECK_LE(sw.case_count(), (std::numeric_limits<size_t>::max() - 2) / 2);
   auto* inputs = zone()->NewArray<InstructionOperand>(input_count);
   inputs[0] = value_operand;
-  inputs[1] = g.Label(sw.default_branch);
-  for (size_t index = 0; index < sw.case_count; ++index) {
-    int32_t value = sw.case_values[index];
-    BasicBlock* branch = sw.case_branches[index];
-    inputs[index * 2 + 2 + 0] = g.TempImmediate(value);
-    inputs[index * 2 + 2 + 1] = g.Label(branch);
+  inputs[1] = g.Label(sw.default_branch());
+  for (size_t index = 0; index < sw.case_count(); ++index) {
+    const CaseInfo& c = sw.GetCase(index);
+    inputs[index * 2 + 2 + 0] = g.TempImmediate(c.value);
+    inputs[index * 2 + 2 + 1] = g.Label(c.branch);
   }
   Emit(kArchLookupSwitch, 0, nullptr, input_count, inputs, 0, nullptr);
 }
@@ -2078,6 +2276,18 @@ void InstructionSelector::VisitBitcastFloat64ToInt64(Node* node) {
 void InstructionSelector::VisitBitcastInt64ToFloat64(Node* node) {
   UNIMPLEMENTED();
 }
+
+void InstructionSelector::VisitSignExtendWord8ToInt64(Node* node) {
+  UNIMPLEMENTED();
+}
+
+void InstructionSelector::VisitSignExtendWord16ToInt64(Node* node) {
+  UNIMPLEMENTED();
+}
+
+void InstructionSelector::VisitSignExtendWord32ToInt64(Node* node) {
+  UNIMPLEMENTED();
+}
 #endif  // V8_TARGET_ARCH_32_BIT
 
 // 64 bit targets do not implement the following instructions.
@@ -2096,7 +2306,7 @@ void InstructionSelector::VisitWord32PairSar(Node* node) { UNIMPLEMENTED(); }
 #endif  // V8_TARGET_ARCH_64_BIT
 
 #if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
-    !V8_TARGET_ARCH_MIPS64
+    !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_IA32
 void InstructionSelector::VisitF32x4SConvertI32x4(Node* node) {
   UNIMPLEMENTED();
 }
@@ -2105,39 +2315,37 @@ void InstructionSelector::VisitF32x4UConvertI32x4(Node* node) {
   UNIMPLEMENTED();
 }
 #endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64
+        // && !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_IA32
 
-#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
-    !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_IA32
-void InstructionSelector::VisitF32x4Abs(Node* node) { UNIMPLEMENTED(); }
+#if !V8_TARGET_ARCH_X64
+void InstructionSelector::VisitWord64AtomicLoad(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitF32x4Neg(Node* node) { UNIMPLEMENTED(); }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_IA32
+void InstructionSelector::VisitWord64AtomicStore(Node* node) {
+  UNIMPLEMENTED();
+}
 
-#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
-    !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_X64
-void InstructionSelector::VisitF32x4RecipSqrtApprox(Node* node) {
+void InstructionSelector::VisitWord64AtomicAdd(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitWord64AtomicSub(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitWord64AtomicAnd(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitWord64AtomicOr(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitWord64AtomicXor(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitWord64AtomicExchange(Node* node) {
   UNIMPLEMENTED();
 }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_X64
 
-#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
-    !V8_TARGET_ARCH_MIPS64
-void InstructionSelector::VisitF32x4AddHoriz(Node* node) { UNIMPLEMENTED(); }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64
+void InstructionSelector::VisitWord64AtomicCompareExchange(Node* node) {
+  UNIMPLEMENTED();
+}
+#endif  // !V8_TARGET_ARCH_X64
 
 #if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
     !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_X64
-void InstructionSelector::VisitF32x4RecipApprox(Node* node) { UNIMPLEMENTED(); }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_X64
-
-#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_X64 && \
-    !V8_TARGET_ARCH_MIPS && !V8_TARGET_ARCH_MIPS64
-void InstructionSelector::VisitI32x4AddHoriz(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitF32x4AddHoriz(Node* node) { UNIMPLEMENTED(); }
 #endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_X64
         // && !V8_TARGET_ARCH_MIPS && !V8_TARGET_ARCH_MIPS64
 
@@ -2153,6 +2361,12 @@ void InstructionSelector::VisitI32x4UConvertF32x4(Node* node) {
 #endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
         // && !V8_TARGET_ARCH_MIPS64
 
+#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
+    !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_X64
+void InstructionSelector::VisitI32x4AddHoriz(Node* node) { UNIMPLEMENTED(); }
+#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
+        // && !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_X64
+
 #if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
     !V8_TARGET_ARCH_MIPS64
 void InstructionSelector::VisitI32x4SConvertI16x8Low(Node* node) {
@@ -2204,52 +2418,30 @@ void InstructionSelector::VisitI16x8UConvertI8x16Low(Node* node) {
 void InstructionSelector::VisitI16x8UConvertI8x16High(Node* node) {
   UNIMPLEMENTED();
 }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64
 
-#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
-    !V8_TARGET_ARCH_MIPS64
-void InstructionSelector::VisitI8x16Shl(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16ShrS(Node* node) { UNIMPLEMENTED(); }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64
-
-#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
-    !V8_TARGET_ARCH_MIPS64
 void InstructionSelector::VisitI8x16SConvertI16x8(Node* node) {
   UNIMPLEMENTED();
 }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64
-
-#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
-    !V8_TARGET_ARCH_MIPS64
-void InstructionSelector::VisitI8x16Mul(Node* node) { UNIMPLEMENTED(); }
-
-void InstructionSelector::VisitI8x16ShrU(Node* node) { UNIMPLEMENTED(); }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64
 
-#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
-    !V8_TARGET_ARCH_MIPS64
 void InstructionSelector::VisitI8x16UConvertI16x8(Node* node) {
   UNIMPLEMENTED();
 }
 #endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
         // && !V8_TARGET_ARCH_MIPS64
 
-#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_X64 && \
-    !V8_TARGET_ARCH_MIPS && !V8_TARGET_ARCH_MIPS64
-void InstructionSelector::VisitS128Select(Node* node) { UNIMPLEMENTED(); }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_X64
-        // && !V8_TARGET_ARCH_MIPS && !V8_TARGET_ARCH_MIPS64
-
 #if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
-    !V8_TARGET_ARCH_MIPS64
+    !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_IA32
+void InstructionSelector::VisitI8x16Shl(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI8x16ShrS(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI8x16ShrU(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitI8x16Mul(Node* node) { UNIMPLEMENTED(); }
+
 void InstructionSelector::VisitS8x16Shuffle(Node* node) { UNIMPLEMENTED(); }
 #endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64
+        // && !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_IA32
 
 #if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
     !V8_TARGET_ARCH_MIPS64
@@ -2365,15 +2557,15 @@ void InstructionSelector::VisitConstant(Node* node) {
 
 void InstructionSelector::VisitCall(Node* node, BasicBlock* handler) {
   OperandGenerator g(this);
-  const CallDescriptor* descriptor = CallDescriptorOf(node->op());
+  auto call_descriptor = CallDescriptorOf(node->op());
 
   FrameStateDescriptor* frame_state_descriptor = nullptr;
-  if (descriptor->NeedsFrameState()) {
+  if (call_descriptor->NeedsFrameState()) {
     frame_state_descriptor = GetFrameStateDescriptor(
-        node->InputAt(static_cast<int>(descriptor->InputCount())));
+        node->InputAt(static_cast<int>(call_descriptor->InputCount())));
   }
 
-  CallBuffer buffer(zone(), descriptor, frame_state_descriptor);
+  CallBuffer buffer(zone(), call_descriptor, frame_state_descriptor);
 
   // Compute InstructionOperands for inputs and outputs.
   // TODO(turbofan): on some architectures it's probably better to use
@@ -2383,10 +2575,10 @@ void InstructionSelector::VisitCall(Node* node, BasicBlock* handler) {
   CallBufferFlags call_buffer_flags(kCallCodeImmediate | kCallAddressImmediate);
   InitializeCallBuffer(node, &buffer, call_buffer_flags, false);
 
-  EmitPrepareArguments(&(buffer.pushed_nodes), descriptor, node);
+  EmitPrepareArguments(&(buffer.pushed_nodes), call_descriptor, node);
 
   // Pass label of exception handler block.
-  CallDescriptor::Flags flags = descriptor->flags();
+  CallDescriptor::Flags flags = call_descriptor->flags();
   if (handler) {
     DCHECK_EQ(IrOpcode::kIfException, handler->front()->opcode());
     flags |= CallDescriptor::kHasExceptionHandler;
@@ -2395,11 +2587,10 @@ void InstructionSelector::VisitCall(Node* node, BasicBlock* handler) {
 
   // Select the appropriate opcode based on the call type.
   InstructionCode opcode = kArchNop;
-  switch (descriptor->kind()) {
+  switch (call_descriptor->kind()) {
     case CallDescriptor::kCallAddress:
-      opcode =
-          kArchCallCFunction |
-          MiscField::encode(static_cast<int>(descriptor->ParameterCount()));
+      opcode = kArchCallCFunction | MiscField::encode(static_cast<int>(
+                                        call_descriptor->ParameterCount()));
       break;
     case CallDescriptor::kCallCodeObject:
       opcode = kArchCallCodeObject | MiscField::encode(flags);
@@ -2421,7 +2612,7 @@ void InstructionSelector::VisitCall(Node* node, BasicBlock* handler) {
   if (instruction_selection_failed()) return;
   call_instr->MarkAsCall();
 
-  EmitPrepareResults(&(buffer.output_nodes), descriptor, node);
+  EmitPrepareResults(&(buffer.output_nodes), call_descriptor, node);
 }
 
 void InstructionSelector::VisitCallWithCallerSavedRegisters(
@@ -2438,26 +2629,29 @@ void InstructionSelector::VisitCallWithCallerSavedRegisters(
 
 void InstructionSelector::VisitTailCall(Node* node) {
   OperandGenerator g(this);
-  CallDescriptor const* descriptor = CallDescriptorOf(node->op());
+  auto call_descriptor = CallDescriptorOf(node->op());
 
   CallDescriptor* caller = linkage()->GetIncomingDescriptor();
   DCHECK(caller->CanTailCall(node));
   const CallDescriptor* callee = CallDescriptorOf(node->op());
   int stack_param_delta = callee->GetStackParameterDelta(caller);
-  CallBuffer buffer(zone(), descriptor, nullptr);
+  CallBuffer buffer(zone(), call_descriptor, nullptr);
 
   // Compute InstructionOperands for inputs and outputs.
   CallBufferFlags flags(kCallCodeImmediate | kCallTail);
   if (IsTailCallAddressImmediate()) {
     flags |= kCallAddressImmediate;
   }
+  if (callee->flags() & CallDescriptor::kFixedTargetRegister) {
+    flags |= kCallFixedTargetRegister;
+  }
   InitializeCallBuffer(node, &buffer, flags, true, stack_param_delta);
 
   // Select the appropriate opcode based on the call type.
   InstructionCode opcode;
   InstructionOperandVector temps(zone());
   if (linkage()->GetIncomingDescriptor()->IsJSFunctionCall()) {
-    switch (descriptor->kind()) {
+    switch (call_descriptor->kind()) {
       case CallDescriptor::kCallCodeObject:
         opcode = kArchTailCallCodeObjectFromJSFunction;
         break;
@@ -2470,7 +2664,7 @@ void InstructionSelector::VisitTailCall(Node* node) {
       temps.push_back(g.TempRegister());
     }
   } else {
-    switch (descriptor->kind()) {
+    switch (call_descriptor->kind()) {
       case CallDescriptor::kCallCodeObject:
         opcode = kArchTailCallCodeObject;
         break;
@@ -2485,7 +2679,7 @@ void InstructionSelector::VisitTailCall(Node* node) {
         return;
     }
   }
-  opcode |= MiscField::encode(descriptor->flags());
+  opcode |= MiscField::encode(call_descriptor->flags());
 
   Emit(kArchPrepareTailCall, g.NoOutput());
 
@@ -2534,51 +2728,47 @@ void InstructionSelector::VisitReturn(Node* ret) {
   Emit(kArchRet, 0, nullptr, input_count, value_locations);
 }
 
-Instruction* InstructionSelector::EmitDeoptimize(
-    InstructionCode opcode, InstructionOperand output, InstructionOperand a,
-    DeoptimizeKind kind, DeoptimizeReason reason,
-    VectorSlotPair const& feedback, Node* frame_state) {
-  size_t output_count = output.IsInvalid() ? 0 : 1;
-  InstructionOperand inputs[] = {a};
-  size_t input_count = arraysize(inputs);
-  return EmitDeoptimize(opcode, output_count, &output, input_count, inputs,
-                        kind, reason, feedback, frame_state);
+void InstructionSelector::VisitBranch(Node* branch, BasicBlock* tbranch,
+                                      BasicBlock* fbranch) {
+  bool update_poison =
+      IsSafetyCheckOf(branch->op()) == IsSafetyCheck::kSafetyCheck &&
+      poisoning_enabled_ == PoisoningMitigationLevel::kOn;
+  FlagsContinuation cont =
+      FlagsContinuation::ForBranch(kNotEqual, tbranch, fbranch, update_poison);
+  VisitWordCompareZero(branch, branch->InputAt(0), &cont);
 }
 
-Instruction* InstructionSelector::EmitDeoptimize(
-    InstructionCode opcode, InstructionOperand output, InstructionOperand a,
-    InstructionOperand b, DeoptimizeKind kind, DeoptimizeReason reason,
-    VectorSlotPair const& feedback, Node* frame_state) {
-  size_t output_count = output.IsInvalid() ? 0 : 1;
-  InstructionOperand inputs[] = {a, b};
-  size_t input_count = arraysize(inputs);
-  return EmitDeoptimize(opcode, output_count, &output, input_count, inputs,
-                        kind, reason, feedback, frame_state);
+void InstructionSelector::VisitDeoptimizeIf(Node* node) {
+  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
+  bool update_poison = p.is_safety_check() == IsSafetyCheck::kSafetyCheck &&
+                       poisoning_enabled_ == PoisoningMitigationLevel::kOn;
+  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
+      kNotEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1),
+      update_poison);
+  VisitWordCompareZero(node, node->InputAt(0), &cont);
 }
 
-Instruction* InstructionSelector::EmitDeoptimize(
-    InstructionCode opcode, size_t output_count, InstructionOperand* outputs,
-    size_t input_count, InstructionOperand* inputs, DeoptimizeKind kind,
-    DeoptimizeReason reason, VectorSlotPair const& feedback,
-    Node* frame_state) {
-  OperandGenerator g(this);
-  FrameStateDescriptor* const descriptor = GetFrameStateDescriptor(frame_state);
-  InstructionOperandVector args(instruction_zone());
-  args.reserve(input_count + 1 + descriptor->GetTotalSize());
-  for (size_t i = 0; i < input_count; ++i) {
-    args.push_back(inputs[i]);
-  }
-  opcode |= MiscField::encode(static_cast<int>(input_count));
-  DCHECK_NE(DeoptimizeKind::kLazy, kind);
-  int const state_id =
-      sequence()->AddDeoptimizationEntry(descriptor, kind, reason, feedback);
-  args.push_back(g.TempImmediate(state_id));
-  StateObjectDeduplicator deduplicator(instruction_zone());
-  AddInputsToFrameStateDescriptor(descriptor, frame_state, &g, &deduplicator,
-                                  &args, FrameStateInputKind::kAny,
-                                  instruction_zone());
-  return Emit(opcode, output_count, outputs, args.size(), &args.front(), 0,
-              nullptr);
+void InstructionSelector::VisitDeoptimizeUnless(Node* node) {
+  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
+  bool update_poison = p.is_safety_check() == IsSafetyCheck::kSafetyCheck &&
+                       poisoning_enabled_ == PoisoningMitigationLevel::kOn;
+  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
+      kEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1),
+      update_poison);
+  VisitWordCompareZero(node, node->InputAt(0), &cont);
+}
+
+void InstructionSelector::VisitTrapIf(Node* node, Runtime::FunctionId func_id) {
+  FlagsContinuation cont =
+      FlagsContinuation::ForTrap(kNotEqual, func_id, node->InputAt(1));
+  VisitWordCompareZero(node, node->InputAt(0), &cont);
+}
+
+void InstructionSelector::VisitTrapUnless(Node* node,
+                                          Runtime::FunctionId func_id) {
+  FlagsContinuation cont =
+      FlagsContinuation::ForTrap(kEqual, func_id, node->InputAt(1));
+  VisitWordCompareZero(node, node->InputAt(0), &cont);
 }
 
 void InstructionSelector::EmitIdentity(Node* node) {
@@ -2649,7 +2839,7 @@ FrameStateDescriptor* InstructionSelector::GetFrameStateDescriptor(
     Node* state) {
   DCHECK_EQ(IrOpcode::kFrameState, state->opcode());
   DCHECK_EQ(kFrameStateInputCount, state->InputCount());
-  FrameStateInfo state_info = OpParameter<FrameStateInfo>(state);
+  FrameStateInfo state_info = FrameStateInfoOf(state->op());
 
   int parameters = static_cast<int>(
       StateValuesAccess(state->InputAt(kFrameStateParametersInput)).size());
@@ -2708,7 +2898,7 @@ uint8_t InstructionSelector::CanonicalizeShuffle(Node* node) {
   static const int kMaxLaneIndex = 15;
   static const int kMaxShuffleIndex = 31;
 
-  const uint8_t* shuffle = OpParameter<uint8_t*>(node);
+  const uint8_t* shuffle = OpParameter<uint8_t*>(node->op());
   uint8_t mask = kMaxShuffleIndex;
   // If shuffle is unary, set 'mask' to ignore the high bit of the indices.
   // Replace any unused source with the other.
diff --git a/deps/v8/src/compiler/instruction-selector.h b/deps/v8/src/compiler/instruction-selector.h
index 75c41c165f1..fc597b5843c 100644
--- a/deps/v8/src/compiler/instruction-selector.h
+++ b/deps/v8/src/compiler/instruction-selector.h
@@ -23,12 +23,208 @@ namespace compiler {
 // Forward declarations.
 class BasicBlock;
 struct CallBuffer;  // TODO(bmeurer): Remove this.
-class FlagsContinuation;
 class Linkage;
 class OperandGenerator;
-struct SwitchInfo;
+class SwitchInfo;
 class StateObjectDeduplicator;
 
+// The flags continuation is a way to combine a branch or a materialization
+// of a boolean value with an instruction that sets the flags register.
+// The whole instruction is treated as a unit by the register allocator, and
+// thus no spills or moves can be introduced between the flags-setting
+// instruction and the branch or set it should be combined with.
+class FlagsContinuation final {
+ public:
+  FlagsContinuation() : mode_(kFlags_none) {}
+
+  // Creates a new flags continuation from the given condition and true/false
+  // blocks.
+  static FlagsContinuation ForBranch(FlagsCondition condition,
+                                     BasicBlock* true_block,
+                                     BasicBlock* false_block,
+                                     bool update_poison) {
+    FlagsMode mode = update_poison ? kFlags_branch_and_poison : kFlags_branch;
+    return FlagsContinuation(mode, condition, true_block, false_block);
+  }
+
+  static FlagsContinuation ForBranchAndPoison(FlagsCondition condition,
+                                              BasicBlock* true_block,
+                                              BasicBlock* false_block) {
+    return FlagsContinuation(kFlags_branch_and_poison, condition, true_block,
+                             false_block);
+  }
+
+  // Creates a new flags continuation for an eager deoptimization exit.
+  static FlagsContinuation ForDeoptimize(
+      FlagsCondition condition, DeoptimizeKind kind, DeoptimizeReason reason,
+      VectorSlotPair const& feedback, Node* frame_state, bool update_poison) {
+    FlagsMode mode =
+        update_poison ? kFlags_deoptimize_and_poison : kFlags_deoptimize;
+    return FlagsContinuation(mode, condition, kind, reason, feedback,
+                             frame_state);
+  }
+
+  // Creates a new flags continuation for a boolean value.
+  static FlagsContinuation ForSet(FlagsCondition condition, Node* result) {
+    return FlagsContinuation(condition, result);
+  }
+
+  // Creates a new flags continuation for a wasm trap.
+  static FlagsContinuation ForTrap(FlagsCondition condition,
+                                   Runtime::FunctionId trap_id, Node* result) {
+    return FlagsContinuation(condition, trap_id, result);
+  }
+
+  bool IsNone() const { return mode_ == kFlags_none; }
+  bool IsBranch() const {
+    return mode_ == kFlags_branch || mode_ == kFlags_branch_and_poison;
+  }
+  bool IsDeoptimize() const {
+    return mode_ == kFlags_deoptimize || mode_ == kFlags_deoptimize_and_poison;
+  }
+  bool IsPoisoned() const {
+    return mode_ == kFlags_branch_and_poison ||
+           mode_ == kFlags_deoptimize_and_poison;
+  }
+  bool IsSet() const { return mode_ == kFlags_set; }
+  bool IsTrap() const { return mode_ == kFlags_trap; }
+  FlagsCondition condition() const {
+    DCHECK(!IsNone());
+    return condition_;
+  }
+  DeoptimizeKind kind() const {
+    DCHECK(IsDeoptimize());
+    return kind_;
+  }
+  DeoptimizeReason reason() const {
+    DCHECK(IsDeoptimize());
+    return reason_;
+  }
+  VectorSlotPair const& feedback() const {
+    DCHECK(IsDeoptimize());
+    return feedback_;
+  }
+  Node* frame_state() const {
+    DCHECK(IsDeoptimize());
+    return frame_state_or_result_;
+  }
+  Node* result() const {
+    DCHECK(IsSet());
+    return frame_state_or_result_;
+  }
+  Runtime::FunctionId trap_id() const {
+    DCHECK(IsTrap());
+    return trap_id_;
+  }
+  BasicBlock* true_block() const {
+    DCHECK(IsBranch());
+    return true_block_;
+  }
+  BasicBlock* false_block() const {
+    DCHECK(IsBranch());
+    return false_block_;
+  }
+
+  void Negate() {
+    DCHECK(!IsNone());
+    condition_ = NegateFlagsCondition(condition_);
+  }
+
+  void Commute() {
+    DCHECK(!IsNone());
+    condition_ = CommuteFlagsCondition(condition_);
+  }
+
+  void Overwrite(FlagsCondition condition) { condition_ = condition; }
+
+  void OverwriteAndNegateIfEqual(FlagsCondition condition) {
+    DCHECK(condition_ == kEqual || condition_ == kNotEqual);
+    bool negate = condition_ == kEqual;
+    condition_ = condition;
+    if (negate) Negate();
+  }
+
+  void OverwriteUnsignedIfSigned() {
+    switch (condition_) {
+      case kSignedLessThan:
+        condition_ = kUnsignedLessThan;
+        break;
+      case kSignedLessThanOrEqual:
+        condition_ = kUnsignedLessThanOrEqual;
+        break;
+      case kSignedGreaterThan:
+        condition_ = kUnsignedGreaterThan;
+        break;
+      case kSignedGreaterThanOrEqual:
+        condition_ = kUnsignedGreaterThanOrEqual;
+        break;
+      default:
+        break;
+    }
+  }
+
+  // Encodes this flags continuation into the given opcode.
+  InstructionCode Encode(InstructionCode opcode) {
+    opcode |= FlagsModeField::encode(mode_);
+    if (mode_ != kFlags_none) {
+      opcode |= FlagsConditionField::encode(condition_);
+    }
+    return opcode;
+  }
+
+ private:
+  FlagsContinuation(FlagsMode mode, FlagsCondition condition,
+                    BasicBlock* true_block, BasicBlock* false_block)
+      : mode_(mode),
+        condition_(condition),
+        true_block_(true_block),
+        false_block_(false_block) {
+    DCHECK(mode == kFlags_branch || mode == kFlags_branch_and_poison);
+    DCHECK_NOT_NULL(true_block);
+    DCHECK_NOT_NULL(false_block);
+  }
+
+  FlagsContinuation(FlagsMode mode, FlagsCondition condition,
+                    DeoptimizeKind kind, DeoptimizeReason reason,
+                    VectorSlotPair const& feedback, Node* frame_state)
+      : mode_(mode),
+        condition_(condition),
+        kind_(kind),
+        reason_(reason),
+        feedback_(feedback),
+        frame_state_or_result_(frame_state) {
+    DCHECK(mode == kFlags_deoptimize || mode == kFlags_deoptimize_and_poison);
+    DCHECK_NOT_NULL(frame_state);
+  }
+
+  FlagsContinuation(FlagsCondition condition, Node* result)
+      : mode_(kFlags_set),
+        condition_(condition),
+        frame_state_or_result_(result) {
+    DCHECK_NOT_NULL(result);
+  }
+
+  FlagsContinuation(FlagsCondition condition, Runtime::FunctionId trap_id,
+                    Node* result)
+      : mode_(kFlags_trap),
+        condition_(condition),
+        frame_state_or_result_(result),
+        trap_id_(trap_id) {
+    DCHECK_NOT_NULL(result);
+  }
+
+  FlagsMode const mode_;
+  FlagsCondition condition_;
+  DeoptimizeKind kind_;          // Only valid if mode_ == kFlags_deoptimize*
+  DeoptimizeReason reason_;      // Only valid if mode_ == kFlags_deoptimize*
+  VectorSlotPair feedback_;      // Only valid if mode_ == kFlags_deoptimize*
+  Node* frame_state_or_result_;  // Only valid if mode_ == kFlags_deoptimize*
+                                 // or mode_ == kFlags_set.
+  BasicBlock* true_block_;       // Only valid if mode_ == kFlags_branch*.
+  BasicBlock* false_block_;      // Only valid if mode_ == kFlags_branch*.
+  Runtime::FunctionId trap_id_;  // Only valid if mode_ == kFlags_trap.
+};
+
 // This struct connects nodes of parameters which are going to be pushed on the
 // call stack with their parameter index in the call descriptor of the callee.
 struct PushParameter {
@@ -51,17 +247,24 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
   enum SourcePositionMode { kCallSourcePositions, kAllSourcePositions };
   enum EnableScheduling { kDisableScheduling, kEnableScheduling };
   enum EnableSerialization { kDisableSerialization, kEnableSerialization };
+  enum EnableSwitchJumpTable {
+    kDisableSwitchJumpTable,
+    kEnableSwitchJumpTable
+  };
 
   InstructionSelector(
       Zone* zone, size_t node_count, Linkage* linkage,
       InstructionSequence* sequence, Schedule* schedule,
       SourcePositionTable* source_positions, Frame* frame,
+      EnableSwitchJumpTable enable_switch_jump_table,
       SourcePositionMode source_position_mode = kCallSourcePositions,
       Features features = SupportedFeatures(),
       EnableScheduling enable_scheduling = FLAG_turbo_instruction_scheduling
                                                ? kEnableScheduling
                                                : kDisableScheduling,
-      EnableSerialization enable_serialization = kDisableSerialization);
+      EnableSerialization enable_serialization = kDisableSerialization,
+      PoisoningMitigationLevel poisoning_enabled =
+          PoisoningMitigationLevel::kOff);
 
   // Visit code for the entire graph with the included schedule.
   bool SelectInstructions();
@@ -69,6 +272,7 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
   void StartBlock(RpoNumber rpo);
   void EndBlock(RpoNumber rpo);
   void AddInstruction(Instruction* instr);
+  void AddTerminator(Instruction* instr);
 
   // ===========================================================================
   // ============= Architecture-independent code emission methods. =============
@@ -106,20 +310,29 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
                     InstructionOperand* temps = nullptr);
   Instruction* Emit(Instruction* instr);
 
+  // [0-3] operand instructions with no output, uses labels for true and false
+  // blocks of the continuation.
+  Instruction* EmitWithContinuation(InstructionCode opcode,
+                                    FlagsContinuation* cont);
+  Instruction* EmitWithContinuation(InstructionCode opcode,
+                                    InstructionOperand a,
+                                    FlagsContinuation* cont);
+  Instruction* EmitWithContinuation(InstructionCode opcode,
+                                    InstructionOperand a, InstructionOperand b,
+                                    FlagsContinuation* cont);
+  Instruction* EmitWithContinuation(InstructionCode opcode,
+                                    InstructionOperand a, InstructionOperand b,
+                                    InstructionOperand c,
+                                    FlagsContinuation* cont);
+  Instruction* EmitWithContinuation(InstructionCode opcode, size_t output_count,
+                                    InstructionOperand* outputs,
+                                    size_t input_count,
+                                    InstructionOperand* inputs,
+                                    FlagsContinuation* cont);
+
   // ===========================================================================
   // ===== Architecture-independent deoptimization exit emission methods. ======
   // ===========================================================================
-
-  Instruction* EmitDeoptimize(InstructionCode opcode, InstructionOperand output,
-                              InstructionOperand a, DeoptimizeKind kind,
-                              DeoptimizeReason reason,
-                              VectorSlotPair const& feedback,
-                              Node* frame_state);
-  Instruction* EmitDeoptimize(InstructionCode opcode, InstructionOperand output,
-                              InstructionOperand a, InstructionOperand b,
-                              DeoptimizeKind kind, DeoptimizeReason reason,
-                              VectorSlotPair const& feedback,
-                              Node* frame_state);
   Instruction* EmitDeoptimize(InstructionCode opcode, size_t output_count,
                               InstructionOperand* outputs, size_t input_count,
                               InstructionOperand* inputs, DeoptimizeKind kind,
@@ -227,6 +440,11 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
            InstructionScheduler::SchedulerSupported();
   }
 
+  void AppendDeoptimizeArguments(InstructionOperandVector* args,
+                                 DeoptimizeKind kind, DeoptimizeReason reason,
+                                 VectorSlotPair const& feedback,
+                                 Node* frame_state);
+
   void EmitTableSwitch(const SwitchInfo& sw, InstructionOperand& index_operand);
   void EmitLookupSwitch(const SwitchInfo& sw,
                         InstructionOperand& value_operand);
@@ -277,7 +495,8 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
   enum CallBufferFlag {
     kCallCodeImmediate = 1u << 0,
     kCallAddressImmediate = 1u << 1,
-    kCallTail = 1u << 2
+    kCallTail = 1u << 2,
+    kCallFixedTargetRegister = 1u << 3,
   };
   typedef base::Flags<CallBufferFlag> CallBufferFlags;
 
@@ -354,10 +573,12 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
   void VisitUnreachable(Node* node);
   void VisitDeadValue(Node* node);
 
+  void VisitWordCompareZero(Node* user, Node* value, FlagsContinuation* cont);
+
   void EmitPrepareArguments(ZoneVector<compiler::PushParameter>* arguments,
-                            const CallDescriptor* descriptor, Node* node);
+                            const CallDescriptor* call_descriptor, Node* node);
   void EmitPrepareResults(ZoneVector<compiler::PushParameter>* results,
-                          const CallDescriptor* descriptor, Node* node);
+                          const CallDescriptor* call_descriptor, Node* node);
 
   void EmitIdentity(Node* node);
   bool CanProduceSignalingNaN(Node* node);
@@ -425,6 +646,10 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
   void VisitAtomicBinaryOperation(Node* node, ArchOpcode int8_op,
                                   ArchOpcode uint8_op, ArchOpcode int16_op,
                                   ArchOpcode uint16_op, ArchOpcode word32_op);
+  void VisitWord64AtomicBinaryOperation(Node* node, ArchOpcode uint8_op,
+                                        ArchOpcode uint16_op,
+                                        ArchOpcode uint32_op,
+                                        ArchOpcode uint64_op);
 
   // ===========================================================================
 
@@ -437,6 +662,8 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
   Schedule* const schedule_;
   BasicBlock* current_block_;
   ZoneVector<Instruction*> instructions_;
+  InstructionOperandVector continuation_inputs_;
+  InstructionOperandVector continuation_outputs_;
   BoolVector defined_;
   BoolVector used_;
   IntVector effect_level_;
@@ -445,6 +672,9 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
   InstructionScheduler* scheduler_;
   EnableScheduling enable_scheduling_;
   EnableSerialization enable_serialization_;
+  EnableSwitchJumpTable enable_switch_jump_table_;
+
+  PoisoningMitigationLevel poisoning_enabled_;
   Frame* frame_;
   bool instruction_selection_failed_;
 };
diff --git a/deps/v8/src/compiler/instruction.cc b/deps/v8/src/compiler/instruction.cc
index f335177b958..68f0ae2a9c0 100644
--- a/deps/v8/src/compiler/instruction.cc
+++ b/deps/v8/src/compiler/instruction.cc
@@ -96,6 +96,26 @@ bool InstructionOperand::InterferesWith(const InstructionOperand& other) const {
   return false;
 }
 
+bool LocationOperand::IsCompatible(LocationOperand* op) {
+  if (IsRegister() || IsStackSlot()) {
+    return op->IsRegister() || op->IsStackSlot();
+  } else if (kSimpleFPAliasing) {
+    // A backend may choose to generate the same instruction sequence regardless
+    // of the FP representation. As a result, we can relax the compatibility and
+    // allow a Double to be moved in a Float for example. However, this is only
+    // allowed if registers do not overlap.
+    return (IsFPRegister() || IsFPStackSlot()) &&
+           (op->IsFPRegister() || op->IsFPStackSlot());
+  } else if (IsFloatRegister() || IsFloatStackSlot()) {
+    return op->IsFloatRegister() || op->IsFloatStackSlot();
+  } else if (IsDoubleRegister() || IsDoubleStackSlot()) {
+    return op->IsDoubleRegister() || op->IsDoubleStackSlot();
+  } else {
+    return (IsSimd128Register() || IsSimd128StackSlot()) &&
+           (op->IsSimd128Register() || op->IsSimd128StackSlot());
+  }
+}
+
 void InstructionOperand::Print(const RegisterConfiguration* config) const {
   OFStream os(stdout);
   PrintableInstructionOperand wrapper;
@@ -136,8 +156,10 @@ std::ostream& operator<<(std::ostream& os,
           return os << "(S)";
         case UnallocatedOperand::SAME_AS_FIRST_INPUT:
           return os << "(1)";
-        case UnallocatedOperand::ANY:
+        case UnallocatedOperand::REGISTER_OR_SLOT:
           return os << "(-)";
+        case UnallocatedOperand::REGISTER_OR_SLOT_OR_CONSTANT:
+          return os << "(*)";
       }
     }
     case InstructionOperand::CONSTANT:
@@ -426,8 +448,12 @@ std::ostream& operator<<(std::ostream& os, const FlagsMode& fm) {
       return os;
     case kFlags_branch:
       return os << "branch";
+    case kFlags_branch_and_poison:
+      return os << "branch_and_poison";
     case kFlags_deoptimize:
       return os << "deoptimize";
+    case kFlags_deoptimize_and_poison:
+      return os << "deoptimize_and_poison";
     case kFlags_set:
       return os << "set";
     case kFlags_trap:
diff --git a/deps/v8/src/compiler/instruction.h b/deps/v8/src/compiler/instruction.h
index 7772f18ad9c..803f3e0c1de 100644
--- a/deps/v8/src/compiler/instruction.h
+++ b/deps/v8/src/compiler/instruction.h
@@ -170,7 +170,8 @@ class UnallocatedOperand final : public InstructionOperand {
 
   enum ExtendedPolicy {
     NONE,
-    ANY,
+    REGISTER_OR_SLOT,
+    REGISTER_OR_SLOT_OR_CONSTANT,
     FIXED_REGISTER,
     FIXED_FP_REGISTER,
     MUST_HAVE_REGISTER,
@@ -236,8 +237,13 @@ class UnallocatedOperand final : public InstructionOperand {
   }
 
   // Predicates for the operand policy.
-  bool HasAnyPolicy() const {
-    return basic_policy() == EXTENDED_POLICY && extended_policy() == ANY;
+  bool HasRegisterOrSlotPolicy() const {
+    return basic_policy() == EXTENDED_POLICY &&
+           extended_policy() == REGISTER_OR_SLOT;
+  }
+  bool HasRegisterOrSlotOrConstantPolicy() const {
+    return basic_policy() == EXTENDED_POLICY &&
+           extended_policy() == REGISTER_OR_SLOT_OR_CONSTANT;
   }
   bool HasFixedPolicy() const {
     return basic_policy() == FIXED_SLOT ||
@@ -491,6 +497,9 @@ class LocationOperand : public InstructionOperand {
     UNREACHABLE();
   }
 
+  // Return true if the locations can be moved to one another.
+  bool IsCompatible(LocationOperand* op);
+
   static LocationOperand* cast(InstructionOperand* op) {
     DCHECK(op->IsAnyLocationOperand());
     return static_cast<LocationOperand*>(op);
@@ -889,7 +898,8 @@ class V8_EXPORT_PRIVATE Instruction final {
 
   bool IsDeoptimizeCall() const {
     return arch_opcode() == ArchOpcode::kArchDeoptimize ||
-           FlagsModeField::decode(opcode()) == kFlags_deoptimize;
+           FlagsModeField::decode(opcode()) == kFlags_deoptimize ||
+           FlagsModeField::decode(opcode()) == kFlags_deoptimize_and_poison;
   }
 
   bool IsTrap() const {
@@ -1093,11 +1103,7 @@ class V8_EXPORT_PRIVATE Constant final {
 
  private:
   Type type_;
-#if V8_TARGET_ARCH_32_BIT
-  RelocInfo::Mode rmode_ = RelocInfo::NONE32;
-#else
-  RelocInfo::Mode rmode_ = RelocInfo::NONE64;
-#endif
+  RelocInfo::Mode rmode_ = RelocInfo::NONE;
   int64_t value_;
 };
 
diff --git a/deps/v8/src/compiler/int64-lowering.cc b/deps/v8/src/compiler/int64-lowering.cc
index 940f0904b37..6d8dc489c4a 100644
--- a/deps/v8/src/compiler/int64-lowering.cc
+++ b/deps/v8/src/compiler/int64-lowering.cc
@@ -75,11 +75,11 @@ void Int64Lowering::LowerGraph() {
 
 namespace {
 
-int GetReturnIndexAfterLowering(
-    CallDescriptor* descriptor, int old_index) {
+int GetReturnIndexAfterLowering(CallDescriptor* call_descriptor,
+                                int old_index) {
   int result = old_index;
   for (int i = 0; i < old_index; i++) {
-    if (descriptor->GetReturnType(i).representation() ==
+    if (call_descriptor->GetReturnType(i).representation() ==
         MachineRepresentation::kWord64) {
       result++;
     }
@@ -87,9 +87,9 @@ int GetReturnIndexAfterLowering(
   return result;
 }
 
-int GetReturnCountAfterLowering(CallDescriptor* descriptor) {
+int GetReturnCountAfterLowering(CallDescriptor* call_descriptor) {
   return GetReturnIndexAfterLowering(
-      descriptor, static_cast<int>(descriptor->ReturnCount()));
+      call_descriptor, static_cast<int>(call_descriptor->ReturnCount()));
 }
 
 int GetParameterIndexAfterLowering(
@@ -149,7 +149,7 @@ void Int64Lowering::GetIndexNodes(Node* index, Node*& index_low,
 void Int64Lowering::LowerNode(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kInt64Constant: {
-      int64_t value = OpParameter<int64_t>(node);
+      int64_t value = OpParameter<int64_t>(node->op());
       Node* low_node = graph()->NewNode(
           common()->Int32Constant(static_cast<int32_t>(value & 0xFFFFFFFF)));
       Node* high_node = graph()->NewNode(
@@ -164,7 +164,7 @@ void Int64Lowering::LowerNode(Node* node) {
         rep = LoadRepresentationOf(node->op()).representation();
       } else {
         DCHECK_EQ(IrOpcode::kUnalignedLoad, node->opcode());
-        rep = UnalignedLoadRepresentationOf(node->op()).representation();
+        rep = LoadRepresentationOf(node->op()).representation();
       }
 
       if (rep == MachineRepresentation::kWord64) {
@@ -314,32 +314,32 @@ void Int64Lowering::LowerNode(Node* node) {
       break;
     }
     case IrOpcode::kTailCall: {
-      CallDescriptor* descriptor =
+      auto call_descriptor =
           const_cast<CallDescriptor*>(CallDescriptorOf(node->op()));
       bool returns_require_lowering =
-          GetReturnCountAfterLowering(descriptor) !=
-          static_cast<int>(descriptor->ReturnCount());
+          GetReturnCountAfterLowering(call_descriptor) !=
+          static_cast<int>(call_descriptor->ReturnCount());
       if (DefaultLowering(node) || returns_require_lowering) {
         // Tail calls do not have return values, so adjusting the call
         // descriptor is enough.
-        auto new_descriptor = GetI32WasmCallDescriptor(zone(), descriptor);
+        auto new_descriptor = GetI32WasmCallDescriptor(zone(), call_descriptor);
         NodeProperties::ChangeOp(node, common()->TailCall(new_descriptor));
       }
       break;
     }
     case IrOpcode::kCall: {
-      CallDescriptor* descriptor =
+      auto call_descriptor =
           const_cast<CallDescriptor*>(CallDescriptorOf(node->op()));
       bool returns_require_lowering =
-          GetReturnCountAfterLowering(descriptor) !=
-              static_cast<int>(descriptor->ReturnCount());
+          GetReturnCountAfterLowering(call_descriptor) !=
+          static_cast<int>(call_descriptor->ReturnCount());
       if (DefaultLowering(node) || returns_require_lowering) {
         // We have to adjust the call descriptor.
-        NodeProperties::ChangeOp(
-            node, common()->Call(GetI32WasmCallDescriptor(zone(), descriptor)));
+        NodeProperties::ChangeOp(node, common()->Call(GetI32WasmCallDescriptor(
+                                           zone(), call_descriptor)));
       }
       if (returns_require_lowering) {
-        size_t return_arity = descriptor->ReturnCount();
+        size_t return_arity = call_descriptor->ReturnCount();
         if (return_arity == 1) {
           // We access the additional return values through projections.
           Node* low_node =
@@ -355,14 +355,14 @@ void Int64Lowering::LowerNode(Node* node) {
                ++old_index, ++new_index) {
             Node* use_node = projections[old_index];
             DCHECK_EQ(ProjectionIndexOf(use_node->op()), old_index);
-            DCHECK_EQ(GetReturnIndexAfterLowering(descriptor,
+            DCHECK_EQ(GetReturnIndexAfterLowering(call_descriptor,
                                                   static_cast<int>(old_index)),
                       static_cast<int>(new_index));
             if (new_index != old_index) {
               NodeProperties::ChangeOp(
                   use_node, common()->Projection(new_index));
             }
-            if (descriptor->GetReturnType(old_index).representation() ==
+            if (call_descriptor->GetReturnType(old_index).representation() ==
                 MachineRepresentation::kWord64) {
               Node* high_node = graph()->NewNode(
                   common()->Projection(new_index + 1), node,
diff --git a/deps/v8/src/compiler/js-builtin-reducer.cc b/deps/v8/src/compiler/js-builtin-reducer.cc
index 7ff2bf6d5ec..ef5ca066337 100644
--- a/deps/v8/src/compiler/js-builtin-reducer.cc
+++ b/deps/v8/src/compiler/js-builtin-reducer.cc
@@ -39,6 +39,14 @@ class JSCallReduction {
     return function->shared()->HasBuiltinFunctionId();
   }
 
+  bool BuiltinCanBeInlined() {
+    DCHECK_EQ(IrOpcode::kJSCall, node_->opcode());
+    HeapObjectMatcher m(NodeProperties::GetValueInput(node_, 0));
+    Handle<JSFunction> function = Handle<JSFunction>::cast(m.Value());
+    // Do not inline if the builtin may have break points.
+    return !function->shared()->HasBreakInfo();
+  }
+
   // Retrieves the BuiltinFunctionId as described above.
   BuiltinFunctionId GetBuiltinFunctionId() {
     DCHECK_EQ(IrOpcode::kJSCall, node_->opcode());
@@ -107,527 +115,6 @@ JSBuiltinReducer::JSBuiltinReducer(Editor* editor, JSGraph* jsgraph,
       native_context_(native_context),
       type_cache_(TypeCache::Get()) {}
 
-namespace {
-
-Maybe<InstanceType> GetInstanceTypeWitness(Node* node) {
-  ZoneHandleSet<Map> maps;
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &maps);
-
-  if (result == NodeProperties::kNoReceiverMaps || maps.size() == 0) {
-    return Nothing<InstanceType>();
-  }
-
-  InstanceType first_type = maps[0]->instance_type();
-  for (const Handle<Map>& map : maps) {
-    if (map->instance_type() != first_type) return Nothing<InstanceType>();
-  }
-  return Just(first_type);
-}
-
-bool CanInlineJSArrayIteration(Handle<Map> receiver_map) {
-  Isolate* const isolate = receiver_map->GetIsolate();
-  // Ensure that the [[Prototype]] is actually an exotic Array
-  if (!receiver_map->prototype()->IsJSArray()) return false;
-
-  // Don't inline JSArrays with slow elements of any kind
-  if (!IsFastElementsKind(receiver_map->elements_kind())) return false;
-
-  // If the receiver map has packed elements, no need to check the prototype.
-  // This requires a MapCheck where this is used.
-  if (!IsHoleyElementsKind(receiver_map->elements_kind())) return true;
-
-  Handle<JSArray> receiver_prototype(JSArray::cast(receiver_map->prototype()),
-                                     isolate);
-  // Ensure all prototypes of the {receiver} are stable.
-  for (PrototypeIterator it(isolate, receiver_prototype, kStartAtReceiver);
-       !it.IsAtEnd(); it.Advance()) {
-    Handle<JSReceiver> current = PrototypeIterator::GetCurrent<JSReceiver>(it);
-    if (!current->map()->is_stable()) return false;
-  }
-
-  // For holey Arrays, ensure that the no_elements_protector cell is valid (must
-  // be a CompilationDependency), and the JSArray prototype has not been
-  // altered.
-  return receiver_map->instance_type() == JS_ARRAY_TYPE &&
-         (!receiver_map->is_dictionary_map() || receiver_map->is_stable()) &&
-         isolate->IsNoElementsProtectorIntact() &&
-         isolate->IsAnyInitialArrayPrototype(receiver_prototype);
-}
-
-}  // namespace
-
-Reduction JSBuiltinReducer::ReduceArrayIterator(Node* node,
-                                                IterationKind kind) {
-  Handle<Map> receiver_map;
-  if (NodeProperties::GetMapWitness(node).ToHandle(&receiver_map)) {
-    return ReduceArrayIterator(receiver_map, node, kind,
-                               ArrayIteratorKind::kArray);
-  }
-  return NoChange();
-}
-
-Reduction JSBuiltinReducer::ReduceTypedArrayIterator(Node* node,
-                                                     IterationKind kind) {
-  Handle<Map> receiver_map;
-  if (NodeProperties::GetMapWitness(node).ToHandle(&receiver_map) &&
-      receiver_map->instance_type() == JS_TYPED_ARRAY_TYPE) {
-    return ReduceArrayIterator(receiver_map, node, kind,
-                               ArrayIteratorKind::kTypedArray);
-  }
-  return NoChange();
-}
-
-Reduction JSBuiltinReducer::ReduceArrayIterator(Handle<Map> receiver_map,
-                                                Node* node, IterationKind kind,
-                                                ArrayIteratorKind iter_kind) {
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-
-  if (iter_kind == ArrayIteratorKind::kTypedArray) {
-    // See if we can skip the neutering check.
-    if (isolate()->IsArrayBufferNeuteringIntact()) {
-      // Add a code dependency so we are deoptimized in case an ArrayBuffer
-      // gets neutered.
-      dependencies()->AssumePropertyCell(
-          factory()->array_buffer_neutering_protector());
-    } else {
-      // For JSTypedArray iterator methods, deopt if the buffer is neutered.
-      // This is potentially a deopt loop, but should be extremely unlikely.
-      DCHECK_EQ(JS_TYPED_ARRAY_TYPE, receiver_map->instance_type());
-      Node* buffer = effect = graph()->NewNode(
-          simplified()->LoadField(AccessBuilder::ForJSArrayBufferViewBuffer()),
-          receiver, effect, control);
-
-      // Deoptimize if the {buffer} has been neutered.
-      Node* check = effect = graph()->NewNode(
-          simplified()->ArrayBufferWasNeutered(), buffer, effect, control);
-      check = graph()->NewNode(simplified()->BooleanNot(), check);
-      effect = graph()->NewNode(
-          simplified()->CheckIf(DeoptimizeReason::kArrayBufferWasNeutered),
-          check, effect, control);
-    }
-  }
-
-  int map_index = -1;
-  Node* object_map = jsgraph()->UndefinedConstant();
-  switch (receiver_map->instance_type()) {
-    case JS_ARRAY_TYPE:
-      if (kind == IterationKind::kKeys) {
-        map_index = Context::FAST_ARRAY_KEY_ITERATOR_MAP_INDEX;
-      } else {
-        map_index = kind == IterationKind::kValues
-                        ? Context::FAST_SMI_ARRAY_VALUE_ITERATOR_MAP_INDEX
-                        : Context::FAST_SMI_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX;
-
-        if (CanInlineJSArrayIteration(receiver_map)) {
-          // Use `generic` elements for holey arrays if there may be elements
-          // on the prototype chain.
-          map_index += static_cast<int>(receiver_map->elements_kind());
-          object_map = jsgraph()->Constant(receiver_map);
-          if (IsHoleyElementsKind(receiver_map->elements_kind())) {
-            Handle<JSObject> initial_array_prototype(
-                native_context()->initial_array_prototype(), isolate());
-            dependencies()->AssumePrototypeMapsStable(receiver_map,
-                                                      initial_array_prototype);
-          }
-        } else {
-          map_index += (Context::GENERIC_ARRAY_VALUE_ITERATOR_MAP_INDEX -
-                        Context::FAST_SMI_ARRAY_VALUE_ITERATOR_MAP_INDEX);
-        }
-      }
-      break;
-    case JS_TYPED_ARRAY_TYPE:
-      if (kind == IterationKind::kKeys) {
-        map_index = Context::TYPED_ARRAY_KEY_ITERATOR_MAP_INDEX;
-      } else {
-        DCHECK_GE(receiver_map->elements_kind(), UINT8_ELEMENTS);
-        DCHECK_LE(receiver_map->elements_kind(), UINT8_CLAMPED_ELEMENTS);
-        map_index = (kind == IterationKind::kValues
-                         ? Context::UINT8_ARRAY_VALUE_ITERATOR_MAP_INDEX
-                         : Context::UINT8_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX) +
-                    (receiver_map->elements_kind() - UINT8_ELEMENTS);
-      }
-      break;
-    default:
-      if (kind == IterationKind::kKeys) {
-        map_index = Context::GENERIC_ARRAY_KEY_ITERATOR_MAP_INDEX;
-      } else if (kind == IterationKind::kValues) {
-        map_index = Context::GENERIC_ARRAY_VALUE_ITERATOR_MAP_INDEX;
-      } else {
-        map_index = Context::GENERIC_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX;
-      }
-      break;
-  }
-
-  DCHECK_GE(map_index, Context::TYPED_ARRAY_KEY_ITERATOR_MAP_INDEX);
-  DCHECK_LE(map_index, Context::GENERIC_ARRAY_VALUE_ITERATOR_MAP_INDEX);
-
-  Handle<Map> map(Map::cast(native_context()->get(map_index)), isolate());
-
-  // Allocate new iterator and attach the iterator to this object.
-  AllocationBuilder a(jsgraph(), effect, control);
-  a.Allocate(JSArrayIterator::kSize, NOT_TENURED, Type::OtherObject());
-  a.Store(AccessBuilder::ForMap(), map);
-  a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
-          jsgraph()->EmptyFixedArrayConstant());
-  a.Store(AccessBuilder::ForJSObjectElements(),
-          jsgraph()->EmptyFixedArrayConstant());
-  a.Store(AccessBuilder::ForJSArrayIteratorObject(), receiver);
-  a.Store(AccessBuilder::ForJSArrayIteratorIndex(), jsgraph()->ZeroConstant());
-  a.Store(AccessBuilder::ForJSArrayIteratorObjectMap(), object_map);
-  Node* value = effect = a.Finish();
-
-  // Replace it.
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
-}
-
-Reduction JSBuiltinReducer::ReduceFastArrayIteratorNext(InstanceType type,
-                                                        Node* node,
-                                                        IterationKind kind) {
-  Node* iterator = NodeProperties::GetValueInput(node, 1);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* context = NodeProperties::GetContextInput(node);
-
-  if (kind != IterationKind::kKeys &&
-      !isolate()->IsFastArrayIterationIntact()) {
-    // Avoid deopt loops for non-key iteration if the
-    // fast_array_iteration_protector cell has been invalidated.
-    return NoChange();
-  }
-
-  ElementsKind elements_kind =
-      JSArrayIterator::ElementsKindForInstanceType(type);
-
-  if (IsHoleyElementsKind(elements_kind)) {
-    if (!isolate()->IsNoElementsProtectorIntact()) {
-      return NoChange();
-    } else {
-      Handle<JSObject> initial_array_prototype(
-          native_context()->initial_array_prototype(), isolate());
-      dependencies()->AssumePropertyCell(factory()->no_elements_protector());
-    }
-  }
-
-  Node* array = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSArrayIteratorObject()),
-      iterator, effect, control);
-  Node* check0 = graph()->NewNode(simplified()->ReferenceEqual(), array,
-                                  jsgraph()->UndefinedConstant());
-  Node* branch0 =
-      graph()->NewNode(common()->Branch(BranchHint::kFalse), check0, control);
-
-  Node* vdone_false0;
-  Node* vfalse0;
-  Node* efalse0 = effect;
-  Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
-  {
-    // iterator.[[IteratedObject]] !== undefined, continue iterating.
-    Node* index = efalse0 = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForJSArrayIteratorIndex(
-            JS_ARRAY_TYPE, elements_kind)),
-        iterator, efalse0, if_false0);
-
-    Node* length = efalse0 = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForJSArrayLength(elements_kind)),
-        array, efalse0, if_false0);
-    Node* check1 =
-        graph()->NewNode(simplified()->NumberLessThan(), index, length);
-    Node* branch1 = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                     check1, if_false0);
-
-    Node* vdone_true1;
-    Node* vtrue1;
-    Node* etrue1 = efalse0;
-    Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
-    {
-      // iterator.[[NextIndex]] < array.length, continue iterating
-      vdone_true1 = jsgraph()->FalseConstant();
-      if (kind == IterationKind::kKeys) {
-        vtrue1 = index;
-      } else {
-        // For value/entry iteration, first step is a mapcheck to ensure
-        // inlining is still valid.
-        Node* array_map = etrue1 =
-            graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
-                             array, etrue1, if_true1);
-        Node* orig_map = etrue1 =
-            graph()->NewNode(simplified()->LoadField(
-                                 AccessBuilder::ForJSArrayIteratorObjectMap()),
-                             iterator, etrue1, if_true1);
-        Node* check_map = graph()->NewNode(simplified()->ReferenceEqual(),
-                                           array_map, orig_map);
-        etrue1 =
-            graph()->NewNode(simplified()->CheckIf(DeoptimizeReason::kWrongMap),
-                             check_map, etrue1, if_true1);
-      }
-
-      if (kind != IterationKind::kKeys) {
-        Node* elements = etrue1 = graph()->NewNode(
-            simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
-            array, etrue1, if_true1);
-        Node* value = etrue1 = graph()->NewNode(
-            simplified()->LoadElement(
-                AccessBuilder::ForFixedArrayElement(elements_kind)),
-            elements, index, etrue1, if_true1);
-
-        // Convert hole to undefined if needed.
-        if (elements_kind == HOLEY_ELEMENTS ||
-            elements_kind == HOLEY_SMI_ELEMENTS) {
-          value = graph()->NewNode(simplified()->ConvertTaggedHoleToUndefined(),
-                                   value);
-        } else if (elements_kind == HOLEY_DOUBLE_ELEMENTS) {
-          // TODO(6587): avoid deopt if not all uses of value are truncated.
-          CheckFloat64HoleMode mode = CheckFloat64HoleMode::kAllowReturnHole;
-          value = etrue1 = graph()->NewNode(
-              simplified()->CheckFloat64Hole(mode), value, etrue1, if_true1);
-        }
-
-        if (kind == IterationKind::kEntries) {
-          // Allocate elements for key/value pair
-          vtrue1 = etrue1 =
-              graph()->NewNode(javascript()->CreateKeyValueArray(), index,
-                               value, context, etrue1);
-        } else {
-          DCHECK_EQ(kind, IterationKind::kValues);
-          vtrue1 = value;
-        }
-      }
-
-      Node* next_index = graph()->NewNode(simplified()->NumberAdd(), index,
-                                          jsgraph()->OneConstant());
-      next_index = graph()->NewNode(simplified()->NumberToUint32(), next_index);
-
-      etrue1 = graph()->NewNode(
-          simplified()->StoreField(AccessBuilder::ForJSArrayIteratorIndex(
-              JS_ARRAY_TYPE, elements_kind)),
-          iterator, next_index, etrue1, if_true1);
-    }
-
-    Node* vdone_false1;
-    Node* vfalse1;
-    Node* efalse1 = efalse0;
-    Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
-    {
-      // iterator.[[NextIndex]] >= array.length, stop iterating.
-      vdone_false1 = jsgraph()->TrueConstant();
-      vfalse1 = jsgraph()->UndefinedConstant();
-      efalse1 = graph()->NewNode(
-          simplified()->StoreField(AccessBuilder::ForJSArrayIteratorObject()),
-          iterator, vfalse1, efalse1, if_false1);
-    }
-
-    if_false0 = graph()->NewNode(common()->Merge(2), if_true1, if_false1);
-    efalse0 =
-        graph()->NewNode(common()->EffectPhi(2), etrue1, efalse1, if_false0);
-    vfalse0 = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                               vtrue1, vfalse1, if_false0);
-    vdone_false0 =
-        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                         vdone_true1, vdone_false1, if_false0);
-  }
-
-  Node* vdone_true0;
-  Node* vtrue0;
-  Node* etrue0 = effect;
-  Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
-  {
-    // iterator.[[IteratedObject]] === undefined, the iterator is done.
-    vdone_true0 = jsgraph()->TrueConstant();
-    vtrue0 = jsgraph()->UndefinedConstant();
-  }
-
-  control = graph()->NewNode(common()->Merge(2), if_false0, if_true0);
-  effect = graph()->NewNode(common()->EffectPhi(2), efalse0, etrue0, control);
-  Node* value =
-      graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                       vfalse0, vtrue0, control);
-  Node* done =
-      graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                       vdone_false0, vdone_true0, control);
-
-  // Create IteratorResult object.
-  value = effect = graph()->NewNode(javascript()->CreateIterResultObject(),
-                                    value, done, context, effect);
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
-}
-
-Reduction JSBuiltinReducer::ReduceTypedArrayIteratorNext(InstanceType type,
-                                                         Node* node,
-                                                         IterationKind kind) {
-  Node* iterator = NodeProperties::GetValueInput(node, 1);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* context = NodeProperties::GetContextInput(node);
-
-  ElementsKind elements_kind =
-      JSArrayIterator::ElementsKindForInstanceType(type);
-
-  Node* array = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSArrayIteratorObject()),
-      iterator, effect, control);
-  Node* check0 = graph()->NewNode(simplified()->ReferenceEqual(), array,
-                                  jsgraph()->UndefinedConstant());
-  Node* branch0 =
-      graph()->NewNode(common()->Branch(BranchHint::kFalse), check0, control);
-
-  Node* vdone_false0;
-  Node* vfalse0;
-  Node* efalse0 = effect;
-  Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
-  {
-    // iterator.[[IteratedObject]] !== undefined, continue iterating.
-    Node* index = efalse0 = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForJSArrayIteratorIndex(
-            JS_TYPED_ARRAY_TYPE, elements_kind)),
-        iterator, efalse0, if_false0);
-
-    // typedarray.[[ViewedArrayBuffer]]
-    Node* buffer = efalse0 = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForJSArrayBufferViewBuffer()),
-        array, efalse0, if_false0);
-
-    // See if we can skip the neutering check.
-    if (isolate()->IsArrayBufferNeuteringIntact()) {
-      // Add a code dependency so we are deoptimized in case an ArrayBuffer
-      // gets neutered.
-      dependencies()->AssumePropertyCell(
-          factory()->array_buffer_neutering_protector());
-    } else {
-      // Deoptimize if the array buffer was neutered.
-      Node* check1 = efalse0 = graph()->NewNode(
-          simplified()->ArrayBufferWasNeutered(), buffer, efalse0, if_false0);
-      check1 = graph()->NewNode(simplified()->BooleanNot(), check1);
-      efalse0 = graph()->NewNode(
-          simplified()->CheckIf(DeoptimizeReason::kArrayBufferWasNeutered),
-          check1, efalse0, if_false0);
-    }
-
-    Node* length = efalse0 = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForJSTypedArrayLength()), array,
-        efalse0, if_false0);
-
-    Node* check2 =
-        graph()->NewNode(simplified()->NumberLessThan(), index, length);
-    Node* branch2 = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                     check2, if_false0);
-
-    Node* vdone_true2;
-    Node* vtrue2;
-    Node* etrue2 = efalse0;
-    Node* if_true2 = graph()->NewNode(common()->IfTrue(), branch2);
-    {
-      // iterator.[[NextIndex]] < array.length, continue iterating
-      vdone_true2 = jsgraph()->FalseConstant();
-      if (kind == IterationKind::kKeys) {
-        vtrue2 = index;
-      }
-
-      Node* next_index = graph()->NewNode(simplified()->NumberAdd(), index,
-                                          jsgraph()->OneConstant());
-      next_index = graph()->NewNode(simplified()->NumberToUint32(), next_index);
-
-      etrue2 = graph()->NewNode(
-          simplified()->StoreField(AccessBuilder::ForJSArrayIteratorIndex(
-              JS_TYPED_ARRAY_TYPE, elements_kind)),
-          iterator, next_index, etrue2, if_true2);
-
-      if (kind != IterationKind::kKeys) {
-        Node* elements = etrue2 = graph()->NewNode(
-            simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
-            array, etrue2, if_true2);
-        Node* base_ptr = etrue2 = graph()->NewNode(
-            simplified()->LoadField(
-                AccessBuilder::ForFixedTypedArrayBaseBasePointer()),
-            elements, etrue2, if_true2);
-        Node* external_ptr = etrue2 = graph()->NewNode(
-            simplified()->LoadField(
-                AccessBuilder::ForFixedTypedArrayBaseExternalPointer()),
-            elements, etrue2, if_true2);
-
-        ExternalArrayType array_type = kExternalInt8Array;
-        switch (elements_kind) {
-#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
-  case TYPE##_ELEMENTS:                                 \
-    array_type = kExternal##Type##Array;                \
-    break;
-          TYPED_ARRAYS(TYPED_ARRAY_CASE)
-          default:
-            UNREACHABLE();
-#undef TYPED_ARRAY_CASE
-        }
-
-        Node* value = etrue2 =
-            graph()->NewNode(simplified()->LoadTypedElement(array_type), buffer,
-                             base_ptr, external_ptr, index, etrue2, if_true2);
-
-        if (kind == IterationKind::kEntries) {
-          // Allocate elements for key/value pair
-          vtrue2 = etrue2 =
-              graph()->NewNode(javascript()->CreateKeyValueArray(), index,
-                               value, context, etrue2);
-        } else {
-          DCHECK_EQ(IterationKind::kValues, kind);
-          vtrue2 = value;
-        }
-      }
-    }
-
-    Node* vdone_false2;
-    Node* vfalse2;
-    Node* efalse2 = efalse0;
-    Node* if_false2 = graph()->NewNode(common()->IfFalse(), branch2);
-    {
-      // iterator.[[NextIndex]] >= array.length, stop iterating.
-      vdone_false2 = jsgraph()->TrueConstant();
-      vfalse2 = jsgraph()->UndefinedConstant();
-      efalse2 = graph()->NewNode(
-          simplified()->StoreField(AccessBuilder::ForJSArrayIteratorObject()),
-          iterator, vfalse2, efalse2, if_false2);
-    }
-
-    if_false0 = graph()->NewNode(common()->Merge(2), if_true2, if_false2);
-    efalse0 =
-        graph()->NewNode(common()->EffectPhi(2), etrue2, efalse2, if_false0);
-    vfalse0 = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                               vtrue2, vfalse2, if_false0);
-    vdone_false0 =
-        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                         vdone_true2, vdone_false2, if_false0);
-  }
-
-  Node* vdone_true0;
-  Node* vtrue0;
-  Node* etrue0 = effect;
-  Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
-  {
-    // iterator.[[IteratedObject]] === undefined, the iterator is done.
-    vdone_true0 = jsgraph()->TrueConstant();
-    vtrue0 = jsgraph()->UndefinedConstant();
-  }
-
-  control = graph()->NewNode(common()->Merge(2), if_false0, if_true0);
-  effect = graph()->NewNode(common()->EffectPhi(2), efalse0, etrue0, control);
-  Node* value =
-      graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                       vfalse0, vtrue0, control);
-  Node* done =
-      graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                       vdone_false0, vdone_true0, control);
-
-  // Create IteratorResult object.
-  value = effect = graph()->NewNode(javascript()->CreateIterResultObject(),
-                                    value, done, context, effect);
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
-}
-
 // ES #sec-get-%typedarray%.prototype-@@tostringtag
 Reduction JSBuiltinReducer::ReduceTypedArrayToStringTag(Node* node) {
   Node* receiver = NodeProperties::GetValueInput(node, 1);
@@ -699,61 +186,6 @@ Reduction JSBuiltinReducer::ReduceTypedArrayToStringTag(Node* node) {
   return Replace(value);
 }
 
-Reduction JSBuiltinReducer::ReduceArrayIteratorNext(Node* node) {
-  Maybe<InstanceType> maybe_type = GetInstanceTypeWitness(node);
-  if (!maybe_type.IsJust()) return NoChange();
-  InstanceType type = maybe_type.FromJust();
-  switch (type) {
-    case JS_TYPED_ARRAY_KEY_ITERATOR_TYPE:
-      return ReduceTypedArrayIteratorNext(type, node, IterationKind::kKeys);
-
-    case JS_FAST_ARRAY_KEY_ITERATOR_TYPE:
-      return ReduceFastArrayIteratorNext(type, node, IterationKind::kKeys);
-
-    case JS_INT8_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-    case JS_UINT8_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-    case JS_INT16_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-    case JS_UINT16_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-    case JS_INT32_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-    case JS_UINT32_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-    case JS_FLOAT32_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-    case JS_FLOAT64_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-    case JS_UINT8_CLAMPED_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-      return ReduceTypedArrayIteratorNext(type, node, IterationKind::kEntries);
-
-    case JS_FAST_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-    case JS_FAST_HOLEY_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-    case JS_FAST_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-    case JS_FAST_HOLEY_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-    case JS_FAST_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-    case JS_FAST_HOLEY_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE:
-      return ReduceFastArrayIteratorNext(type, node, IterationKind::kEntries);
-
-    case JS_INT8_ARRAY_VALUE_ITERATOR_TYPE:
-    case JS_UINT8_ARRAY_VALUE_ITERATOR_TYPE:
-    case JS_INT16_ARRAY_VALUE_ITERATOR_TYPE:
-    case JS_UINT16_ARRAY_VALUE_ITERATOR_TYPE:
-    case JS_INT32_ARRAY_VALUE_ITERATOR_TYPE:
-    case JS_UINT32_ARRAY_VALUE_ITERATOR_TYPE:
-    case JS_FLOAT32_ARRAY_VALUE_ITERATOR_TYPE:
-    case JS_FLOAT64_ARRAY_VALUE_ITERATOR_TYPE:
-    case JS_UINT8_CLAMPED_ARRAY_VALUE_ITERATOR_TYPE:
-      return ReduceTypedArrayIteratorNext(type, node, IterationKind::kValues);
-
-    case JS_FAST_SMI_ARRAY_VALUE_ITERATOR_TYPE:
-    case JS_FAST_HOLEY_SMI_ARRAY_VALUE_ITERATOR_TYPE:
-    case JS_FAST_ARRAY_VALUE_ITERATOR_TYPE:
-    case JS_FAST_HOLEY_ARRAY_VALUE_ITERATOR_TYPE:
-    case JS_FAST_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE:
-    case JS_FAST_HOLEY_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE:
-      return ReduceFastArrayIteratorNext(type, node, IterationKind::kValues);
-
-    default:
-      // Slow array iterators are not reduced
-      return NoChange();
-  }
-}
-
 // ES6 section 22.1.2.2 Array.isArray ( arg )
 Reduction JSBuiltinReducer::ReduceArrayIsArray(Node* node) {
   // We certainly know that undefined is not an array.
@@ -864,30 +296,6 @@ Reduction JSBuiltinReducer::ReduceArrayIsArray(Node* node) {
   return Replace(value);
 }
 
-namespace {
-
-bool HasInstanceTypeWitness(Node* receiver, Node* effect,
-                            InstanceType instance_type) {
-  ZoneHandleSet<Map> receiver_maps;
-  NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
-  switch (result) {
-    case NodeProperties::kUnreliableReceiverMaps:
-    case NodeProperties::kReliableReceiverMaps:
-      DCHECK_NE(0, receiver_maps.size());
-      for (size_t i = 0; i < receiver_maps.size(); ++i) {
-        if (receiver_maps[i]->instance_type() != instance_type) return false;
-      }
-      return true;
-
-    case NodeProperties::kNoReceiverMaps:
-      return false;
-  }
-  UNREACHABLE();
-}
-
-}  // namespace
-
 Reduction JSBuiltinReducer::ReduceCollectionIterator(
     Node* node, InstanceType collection_instance_type,
     int collection_iterator_map_index) {
@@ -895,7 +303,8 @@ Reduction JSBuiltinReducer::ReduceCollectionIterator(
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  if (HasInstanceTypeWitness(receiver, effect, collection_instance_type)) {
+  if (NodeProperties::HasInstanceTypeWitness(receiver, effect,
+                                             collection_instance_type)) {
     // Figure out the proper collection iterator map.
     Handle<Map> collection_iterator_map(
         Map::cast(native_context()->get(collection_iterator_map_index)),
@@ -930,7 +339,8 @@ Reduction JSBuiltinReducer::ReduceCollectionSize(
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  if (HasInstanceTypeWitness(receiver, effect, collection_instance_type)) {
+  if (NodeProperties::HasInstanceTypeWitness(receiver, effect,
+                                             collection_instance_type)) {
     Node* table = effect = graph()->NewNode(
         simplified()->LoadField(AccessBuilder::ForJSCollectionTable()),
         receiver, effect, control);
@@ -1021,12 +431,13 @@ Reduction JSBuiltinReducer::ReduceCollectionIteratorNext(
         receiver, effect, control);
     Callable const callable =
         Builtins::CallableFor(isolate(), Builtins::kOrderedHashTableHealIndex);
-    CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
         isolate(), graph()->zone(), callable.descriptor(), 0,
         CallDescriptor::kNoFlags, Operator::kEliminatable);
-    index = effect = graph()->NewNode(
-        common()->Call(desc), jsgraph()->HeapConstant(callable.code()), table,
-        index, jsgraph()->NoContextConstant(), effect);
+    index = effect =
+        graph()->NewNode(common()->Call(call_descriptor),
+                         jsgraph()->HeapConstant(callable.code()), table, index,
+                         jsgraph()->NoContextConstant(), effect);
     NodeProperties::SetType(index, type_cache_.kFixedArrayLengthType);
 
     // Update the {index} and {table} on the {receiver}.
@@ -1235,7 +646,7 @@ Reduction JSBuiltinReducer::ReduceDateGetTime(Node* node) {
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  if (HasInstanceTypeWitness(receiver, effect, JS_DATE_TYPE)) {
+  if (NodeProperties::HasInstanceTypeWitness(receiver, effect, JS_DATE_TYPE)) {
     Node* value = effect = graph()->NewNode(
         simplified()->LoadField(AccessBuilder::ForJSDateValue()), receiver,
         effect, control);
@@ -1273,584 +684,47 @@ Reduction JSBuiltinReducer::ReduceGlobalIsNaN(Node* node) {
   return NoChange();
 }
 
-Reduction JSBuiltinReducer::ReduceMapGet(Node* node) {
-  // We only optimize if we have target, receiver and key parameters.
-  if (node->op()->ValueInputCount() != 3) return NoChange();
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* key = NodeProperties::GetValueInput(node, 2);
-
-  if (!HasInstanceTypeWitness(receiver, effect, JS_MAP_TYPE)) return NoChange();
-
-  Node* table = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSCollectionTable()), receiver,
-      effect, control);
-
-  Node* entry = effect = graph()->NewNode(
-      simplified()->FindOrderedHashMapEntry(), table, key, effect, control);
-
-  Node* check = graph()->NewNode(simplified()->NumberEqual(), entry,
-                                 jsgraph()->MinusOneConstant());
-
-  Node* branch = graph()->NewNode(common()->Branch(), check, control);
-
-  // Key not found.
-  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-  Node* etrue = effect;
-  Node* vtrue = jsgraph()->UndefinedConstant();
-
-  // Key found.
-  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-  Node* efalse = effect;
-  Node* vfalse = efalse = graph()->NewNode(
-      simplified()->LoadElement(AccessBuilder::ForOrderedHashMapEntryValue()),
-      table, entry, efalse, if_false);
-
-  control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-  Node* value = graph()->NewNode(
-      common()->Phi(MachineRepresentation::kTagged, 2), vtrue, vfalse, control);
-  effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
-
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
-}
-
-Reduction JSBuiltinReducer::ReduceMapHas(Node* node) {
-  // We only optimize if we have target, receiver and key parameters.
-  if (node->op()->ValueInputCount() != 3) return NoChange();
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* key = NodeProperties::GetValueInput(node, 2);
-
-  if (!HasInstanceTypeWitness(receiver, effect, JS_MAP_TYPE)) return NoChange();
-
-  Node* table = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSCollectionTable()), receiver,
-      effect, control);
-
-  Node* index = effect = graph()->NewNode(
-      simplified()->FindOrderedHashMapEntry(), table, key, effect, control);
-
-  Node* value = graph()->NewNode(simplified()->NumberEqual(), index,
-                                 jsgraph()->MinusOneConstant());
-  value = graph()->NewNode(simplified()->BooleanNot(), value);
-
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
-}
-
-// ES6 section 20.2.2.1 Math.abs ( x )
-Reduction JSBuiltinReducer::ReduceMathAbs(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.abs(a:plain-primitive) -> NumberAbs(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberAbs(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.2 Math.acos ( x )
-Reduction JSBuiltinReducer::ReduceMathAcos(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.acos(a:plain-primitive) -> NumberAcos(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberAcos(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.3 Math.acosh ( x )
-Reduction JSBuiltinReducer::ReduceMathAcosh(Node* node) {
+// ES6 section 20.1.2.13 Number.parseInt ( string, radix )
+Reduction JSBuiltinReducer::ReduceNumberParseInt(Node* node) {
   JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.acosh(a:plain-primitive) -> NumberAcosh(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberAcosh(), input);
+  if (r.InputsMatchOne(type_cache_.kSafeInteger) ||
+      r.InputsMatchTwo(type_cache_.kSafeInteger,
+                       type_cache_.kZeroOrUndefined) ||
+      r.InputsMatchTwo(type_cache_.kSafeInteger, type_cache_.kTenOrUndefined)) {
+    // Number.parseInt(a:safe-integer) -> a
+    // Number.parseInt(a:safe-integer,b:#0\/undefined) -> a
+    // Number.parseInt(a:safe-integer,b:#10\/undefined) -> a
+    Node* value = r.GetJSCallInput(0);
     return Replace(value);
   }
   return NoChange();
 }
 
-// ES6 section 20.2.2.4 Math.asin ( x )
-Reduction JSBuiltinReducer::ReduceMathAsin(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.asin(a:plain-primitive) -> NumberAsin(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberAsin(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.5 Math.asinh ( x )
-Reduction JSBuiltinReducer::ReduceMathAsinh(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.asinh(a:plain-primitive) -> NumberAsinh(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberAsinh(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.6 Math.atan ( x )
-Reduction JSBuiltinReducer::ReduceMathAtan(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.atan(a:plain-primitive) -> NumberAtan(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberAtan(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.7 Math.atanh ( x )
-Reduction JSBuiltinReducer::ReduceMathAtanh(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.atanh(a:plain-primitive) -> NumberAtanh(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberAtanh(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.8 Math.atan2 ( y, x )
-Reduction JSBuiltinReducer::ReduceMathAtan2(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchTwo(Type::PlainPrimitive(), Type::PlainPrimitive())) {
-    // Math.atan2(a:plain-primitive,
-    //            b:plain-primitive) -> NumberAtan2(ToNumber(a),
-    //                                              ToNumber(b))
-    Node* left = ToNumber(r.left());
-    Node* right = ToNumber(r.right());
-    Node* value = graph()->NewNode(simplified()->NumberAtan2(), left, right);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.10 Math.ceil ( x )
-Reduction JSBuiltinReducer::ReduceMathCeil(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.ceil(a:plain-primitive) -> NumberCeil(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberCeil(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.11 Math.clz32 ( x )
-Reduction JSBuiltinReducer::ReduceMathClz32(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.clz32(a:plain-primitive) -> NumberClz32(ToUint32(a))
-    Node* input = ToUint32(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberClz32(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.12 Math.cos ( x )
-Reduction JSBuiltinReducer::ReduceMathCos(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.cos(a:plain-primitive) -> NumberCos(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberCos(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.13 Math.cosh ( x )
-Reduction JSBuiltinReducer::ReduceMathCosh(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.cosh(a:plain-primitive) -> NumberCosh(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberCosh(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.14 Math.exp ( x )
-Reduction JSBuiltinReducer::ReduceMathExp(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.exp(a:plain-primitive) -> NumberExp(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberExp(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.15 Math.expm1 ( x )
-Reduction JSBuiltinReducer::ReduceMathExpm1(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::Number())) {
-    // Math.expm1(a:number) -> NumberExpm1(a)
-    Node* value = graph()->NewNode(simplified()->NumberExpm1(), r.left());
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.16 Math.floor ( x )
-Reduction JSBuiltinReducer::ReduceMathFloor(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.floor(a:plain-primitive) -> NumberFloor(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberFloor(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.17 Math.fround ( x )
-Reduction JSBuiltinReducer::ReduceMathFround(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.fround(a:plain-primitive) -> NumberFround(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberFround(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.19 Math.imul ( x, y )
-Reduction JSBuiltinReducer::ReduceMathImul(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchTwo(Type::PlainPrimitive(), Type::PlainPrimitive())) {
-    // Math.imul(a:plain-primitive,
-    //           b:plain-primitive) -> NumberImul(ToUint32(a),
-    //                                            ToUint32(b))
-    Node* left = ToUint32(r.left());
-    Node* right = ToUint32(r.right());
-    Node* value = graph()->NewNode(simplified()->NumberImul(), left, right);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.20 Math.log ( x )
-Reduction JSBuiltinReducer::ReduceMathLog(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.log(a:plain-primitive) -> NumberLog(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberLog(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.21 Math.log1p ( x )
-Reduction JSBuiltinReducer::ReduceMathLog1p(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.log1p(a:plain-primitive) -> NumberLog1p(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberLog1p(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.22 Math.log10 ( x )
-Reduction JSBuiltinReducer::ReduceMathLog10(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::Number())) {
-    // Math.log10(a:number) -> NumberLog10(a)
-    Node* value = graph()->NewNode(simplified()->NumberLog10(), r.left());
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.23 Math.log2 ( x )
-Reduction JSBuiltinReducer::ReduceMathLog2(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::Number())) {
-    // Math.log2(a:number) -> NumberLog(a)
-    Node* value = graph()->NewNode(simplified()->NumberLog2(), r.left());
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.24 Math.max ( value1, value2, ...values )
-Reduction JSBuiltinReducer::ReduceMathMax(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchZero()) {
-    // Math.max() -> -Infinity
-    return Replace(jsgraph()->Constant(-V8_INFINITY));
-  }
-  if (r.InputsMatchAll(Type::PlainPrimitive())) {
-    // Math.max(a:plain-primitive, b:plain-primitive, ...)
-    Node* value = ToNumber(r.GetJSCallInput(0));
-    for (int i = 1; i < r.GetJSCallArity(); i++) {
-      Node* input = ToNumber(r.GetJSCallInput(i));
-      value = graph()->NewNode(simplified()->NumberMax(), value, input);
-    }
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.25 Math.min ( value1, value2, ...values )
-Reduction JSBuiltinReducer::ReduceMathMin(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchZero()) {
-    // Math.min() -> Infinity
-    return Replace(jsgraph()->Constant(V8_INFINITY));
-  }
-  if (r.InputsMatchAll(Type::PlainPrimitive())) {
-    // Math.min(a:plain-primitive, b:plain-primitive, ...)
-    Node* value = ToNumber(r.GetJSCallInput(0));
-    for (int i = 1; i < r.GetJSCallArity(); i++) {
-      Node* input = ToNumber(r.GetJSCallInput(i));
-      value = graph()->NewNode(simplified()->NumberMin(), value, input);
-    }
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.26 Math.pow ( x, y )
-Reduction JSBuiltinReducer::ReduceMathPow(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchTwo(Type::PlainPrimitive(), Type::PlainPrimitive())) {
-    // Math.pow(a:plain-primitive,
-    //          b:plain-primitive) -> NumberPow(ToNumber(a), ToNumber(b))
-    Node* left = ToNumber(r.left());
-    Node* right = ToNumber(r.right());
-    Node* value = graph()->NewNode(simplified()->NumberPow(), left, right);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.28 Math.round ( x )
-Reduction JSBuiltinReducer::ReduceMathRound(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.round(a:plain-primitive) -> NumberRound(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberRound(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.9 Math.cbrt ( x )
-Reduction JSBuiltinReducer::ReduceMathCbrt(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::Number())) {
-    // Math.cbrt(a:number) -> NumberCbrt(a)
-    Node* value = graph()->NewNode(simplified()->NumberCbrt(), r.left());
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.29 Math.sign ( x )
-Reduction JSBuiltinReducer::ReduceMathSign(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.sign(a:plain-primitive) -> NumberSign(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberSign(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.30 Math.sin ( x )
-Reduction JSBuiltinReducer::ReduceMathSin(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.sin(a:plain-primitive) -> NumberSin(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberSin(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.31 Math.sinh ( x )
-Reduction JSBuiltinReducer::ReduceMathSinh(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.sinh(a:plain-primitive) -> NumberSinh(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberSinh(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.32 Math.sqrt ( x )
-Reduction JSBuiltinReducer::ReduceMathSqrt(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.sqrt(a:plain-primitive) -> NumberSqrt(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberSqrt(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.33 Math.tan ( x )
-Reduction JSBuiltinReducer::ReduceMathTan(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.tan(a:plain-primitive) -> NumberTan(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberTan(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.34 Math.tanh ( x )
-Reduction JSBuiltinReducer::ReduceMathTanh(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.tanh(a:plain-primitive) -> NumberTanh(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberTanh(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.2.2.35 Math.trunc ( x )
-Reduction JSBuiltinReducer::ReduceMathTrunc(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // Math.trunc(a:plain-primitive) -> NumberTrunc(ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->NumberTrunc(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.1.2.2 Number.isFinite ( number )
-Reduction JSBuiltinReducer::ReduceNumberIsFinite(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::Number())) {
-    // Number.isFinite(a:number) -> NumberEqual(a', a')
-    // where a' = NumberSubtract(a, a)
-    Node* input = r.GetJSCallInput(0);
-    Node* diff = graph()->NewNode(simplified()->NumberSubtract(), input, input);
-    Node* value = graph()->NewNode(simplified()->NumberEqual(), diff, diff);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.1.2.3 Number.isInteger ( number )
-Reduction JSBuiltinReducer::ReduceNumberIsInteger(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::Number())) {
-    // Number.isInteger(x:number) -> NumberEqual(NumberSubtract(x, x'), #0)
-    // where x' = NumberTrunc(x)
-    Node* input = r.GetJSCallInput(0);
-    Node* trunc = graph()->NewNode(simplified()->NumberTrunc(), input);
-    Node* diff = graph()->NewNode(simplified()->NumberSubtract(), input, trunc);
-    Node* value = graph()->NewNode(simplified()->NumberEqual(), diff,
-                                   jsgraph()->ZeroConstant());
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.1.2.4 Number.isNaN ( number )
-Reduction JSBuiltinReducer::ReduceNumberIsNaN(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchZero()) {
-    // Number.isNaN() -> #false
-    Node* value = jsgraph()->FalseConstant();
-    return Replace(value);
-  }
-  // Number.isNaN(a:number) -> ObjectIsNaN(a)
-  Node* input = r.GetJSCallInput(0);
-  Node* value = graph()->NewNode(simplified()->ObjectIsNaN(), input);
-  return Replace(value);
-}
-
-// ES6 section 20.1.2.5 Number.isSafeInteger ( number )
-Reduction JSBuiltinReducer::ReduceNumberIsSafeInteger(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(type_cache_.kSafeInteger)) {
-    // Number.isInteger(x:safe-integer) -> #true
-    Node* value = jsgraph()->TrueConstant();
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.1.2.13 Number.parseInt ( string, radix )
-Reduction JSBuiltinReducer::ReduceNumberParseInt(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(type_cache_.kSafeInteger) ||
-      r.InputsMatchTwo(type_cache_.kSafeInteger,
-                       type_cache_.kZeroOrUndefined) ||
-      r.InputsMatchTwo(type_cache_.kSafeInteger, type_cache_.kTenOrUndefined)) {
-    // Number.parseInt(a:safe-integer) -> a
-    // Number.parseInt(a:safe-integer,b:#0\/undefined) -> a
-    // Number.parseInt(a:safe-integer,b:#10\/undefined) -> a
-    Node* value = r.GetJSCallInput(0);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section #sec-object.create Object.create(proto, properties)
-Reduction JSBuiltinReducer::ReduceObjectCreate(Node* node) {
-  // We need exactly target, receiver and value parameters.
-  int arg_count = node->op()->ValueInputCount();
-  if (arg_count != 3) return NoChange();
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* prototype = NodeProperties::GetValueInput(node, 2);
-  Type* prototype_type = NodeProperties::GetType(prototype);
-  if (!prototype_type->IsHeapConstant()) return NoChange();
-  Handle<HeapObject> prototype_const =
-      prototype_type->AsHeapConstant()->Value();
-  Handle<Map> instance_map;
-  MaybeHandle<Map> maybe_instance_map =
-      Map::TryGetObjectCreateMap(prototype_const);
-  if (!maybe_instance_map.ToHandle(&instance_map)) return NoChange();
-  Node* properties = jsgraph()->EmptyFixedArrayConstant();
-  if (instance_map->is_dictionary_map()) {
-    // Allocated an empty NameDictionary as backing store for the properties.
-    Handle<Map> map(isolate()->heap()->name_dictionary_map(), isolate());
-    int capacity =
-        NameDictionary::ComputeCapacity(NameDictionary::kInitialCapacity);
-    DCHECK(base::bits::IsPowerOfTwo(capacity));
-    int length = NameDictionary::EntryToIndex(capacity);
-    int size = NameDictionary::SizeFor(length);
+// ES6 section #sec-object.create Object.create(proto, properties)
+Reduction JSBuiltinReducer::ReduceObjectCreate(Node* node) {
+  // We need exactly target, receiver and value parameters.
+  int arg_count = node->op()->ValueInputCount();
+  if (arg_count != 3) return NoChange();
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* prototype = NodeProperties::GetValueInput(node, 2);
+  Type* prototype_type = NodeProperties::GetType(prototype);
+  if (!prototype_type->IsHeapConstant()) return NoChange();
+  Handle<HeapObject> prototype_const =
+      prototype_type->AsHeapConstant()->Value();
+  Handle<Map> instance_map;
+  MaybeHandle<Map> maybe_instance_map =
+      Map::TryGetObjectCreateMap(prototype_const);
+  if (!maybe_instance_map.ToHandle(&instance_map)) return NoChange();
+  Node* properties = jsgraph()->EmptyFixedArrayConstant();
+  if (instance_map->is_dictionary_map()) {
+    // Allocated an empty NameDictionary as backing store for the properties.
+    Handle<Map> map(isolate()->heap()->name_dictionary_map(), isolate());
+    int capacity =
+        NameDictionary::ComputeCapacity(NameDictionary::kInitialCapacity);
+    DCHECK(base::bits::IsPowerOfTwo(capacity));
+    int length = NameDictionary::EntryToIndex(capacity);
+    int size = NameDictionary::SizeFor(length);
 
     AllocationBuilder a(jsgraph(), effect, control);
     a.Allocate(size, NOT_TENURED, Type::Any());
@@ -1908,318 +782,6 @@ Reduction JSBuiltinReducer::ReduceObjectCreate(Node* node) {
   return Replace(value);
 }
 
-// ES6 section 21.1.2.1 String.fromCharCode ( ...codeUnits )
-Reduction JSBuiltinReducer::ReduceStringFromCharCode(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // String.fromCharCode(a:plain-primitive) -> StringFromCharCode(a)
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* value = graph()->NewNode(simplified()->StringFromCharCode(), input);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-namespace {
-
-Node* GetStringWitness(Node* node) {
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Type* receiver_type = NodeProperties::GetType(receiver);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  if (receiver_type->Is(Type::String())) return receiver;
-  // Check if the {node} is dominated by a CheckString renaming for
-  // it's {receiver}, and if so use that renaming as {receiver} for
-  // the lowering below.
-  for (Node* dominator = effect;;) {
-    if ((dominator->opcode() == IrOpcode::kCheckString ||
-         dominator->opcode() == IrOpcode::kCheckInternalizedString ||
-         dominator->opcode() == IrOpcode::kCheckSeqString) &&
-        NodeProperties::IsSame(dominator->InputAt(0), receiver)) {
-      return dominator;
-    }
-    if (dominator->op()->EffectInputCount() != 1) {
-      // Didn't find any appropriate CheckString node.
-      return nullptr;
-    }
-    dominator = NodeProperties::GetEffectInput(dominator);
-  }
-}
-
-}  // namespace
-
-// ES6 String.prototype.concat(...args)
-// #sec-string.prototype.concat
-Reduction JSBuiltinReducer::ReduceStringConcat(Node* node) {
-  if (Node* receiver = GetStringWitness(node)) {
-    JSCallReduction r(node);
-    if (r.InputsMatchOne(Type::PlainPrimitive())) {
-      // String.prototype.concat(lhs:string, rhs:plain-primitive)
-      //   -> Call[StringAddStub](lhs, rhs)
-      StringAddFlags flags = r.InputsMatchOne(Type::String())
-                                 ? STRING_ADD_CHECK_NONE
-                                 : STRING_ADD_CONVERT_RIGHT;
-      // TODO(turbofan): Massage the FrameState of the {node} here once we
-      // have an artificial builtin frame type, so that it looks like the
-      // exception from StringAdd overflow came from String.prototype.concat
-      // builtin instead of the calling function.
-      Callable const callable =
-          CodeFactory::StringAdd(isolate(), flags, NOT_TENURED);
-      CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
-          isolate(), graph()->zone(), callable.descriptor(), 0,
-          CallDescriptor::kNeedsFrameState,
-          Operator::kNoDeopt | Operator::kNoWrite);
-      node->ReplaceInput(0, jsgraph()->HeapConstant(callable.code()));
-      node->ReplaceInput(1, receiver);
-      NodeProperties::ChangeOp(node, common()->Call(desc));
-      return Changed(node);
-    }
-  }
-
-  return NoChange();
-}
-
-Reduction JSBuiltinReducer::ReduceStringIterator(Node* node) {
-  if (Node* receiver = GetStringWitness(node)) {
-    Node* effect = NodeProperties::GetEffectInput(node);
-    Node* control = NodeProperties::GetControlInput(node);
-
-    Node* map = jsgraph()->HeapConstant(
-        handle(native_context()->string_iterator_map(), isolate()));
-
-    // Allocate new iterator and attach the iterator to this string.
-    AllocationBuilder a(jsgraph(), effect, control);
-    a.Allocate(JSStringIterator::kSize, NOT_TENURED, Type::OtherObject());
-    a.Store(AccessBuilder::ForMap(), map);
-    a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
-            jsgraph()->EmptyFixedArrayConstant());
-    a.Store(AccessBuilder::ForJSObjectElements(),
-            jsgraph()->EmptyFixedArrayConstant());
-    a.Store(AccessBuilder::ForJSStringIteratorString(), receiver);
-    a.Store(AccessBuilder::ForJSStringIteratorIndex(),
-            jsgraph()->SmiConstant(0));
-    Node* value = effect = a.Finish();
-
-    // Replace it.
-    ReplaceWithValue(node, value, effect, control);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-Reduction JSBuiltinReducer::ReduceStringIteratorNext(Node* node) {
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* context = NodeProperties::GetContextInput(node);
-  if (HasInstanceTypeWitness(receiver, effect, JS_STRING_ITERATOR_TYPE)) {
-    Node* string = effect = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForJSStringIteratorString()),
-        receiver, effect, control);
-    Node* index = effect = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForJSStringIteratorIndex()),
-        receiver, effect, control);
-    Node* length = graph()->NewNode(simplified()->StringLength(), string);
-
-    // branch0: if (index < length)
-    Node* check0 =
-        graph()->NewNode(simplified()->NumberLessThan(), index, length);
-    Node* branch0 =
-        graph()->NewNode(common()->Branch(BranchHint::kTrue), check0, control);
-
-    Node* etrue0 = effect;
-    Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
-    Node* done_true;
-    Node* vtrue0;
-    {
-      done_true = jsgraph()->FalseConstant();
-      Node* lead = graph()->NewNode(simplified()->StringCharCodeAt(), string,
-                                    index, if_true0);
-
-      // branch1: if ((lead & 0xFC00) === 0xD800)
-      Node* check1 =
-          graph()->NewNode(simplified()->NumberEqual(),
-                           graph()->NewNode(simplified()->NumberBitwiseAnd(),
-                                            lead, jsgraph()->Constant(0xFC00)),
-                           jsgraph()->Constant(0xD800));
-      Node* branch1 = graph()->NewNode(common()->Branch(BranchHint::kFalse),
-                                       check1, if_true0);
-      Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
-      Node* vtrue1;
-      {
-        Node* next_index = graph()->NewNode(simplified()->NumberAdd(), index,
-                                            jsgraph()->OneConstant());
-        // branch2: if ((index + 1) < length)
-        Node* check2 = graph()->NewNode(simplified()->NumberLessThan(),
-                                        next_index, length);
-        Node* branch2 = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                         check2, if_true1);
-        Node* if_true2 = graph()->NewNode(common()->IfTrue(), branch2);
-        Node* vtrue2;
-        {
-          Node* trail = graph()->NewNode(simplified()->StringCharCodeAt(),
-                                         string, next_index, if_true2);
-          // branch3: if ((trail & 0xFC00) === 0xDC00)
-          Node* check3 = graph()->NewNode(
-              simplified()->NumberEqual(),
-              graph()->NewNode(simplified()->NumberBitwiseAnd(), trail,
-                               jsgraph()->Constant(0xFC00)),
-              jsgraph()->Constant(0xDC00));
-          Node* branch3 = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                           check3, if_true2);
-          Node* if_true3 = graph()->NewNode(common()->IfTrue(), branch3);
-          Node* vtrue3;
-          {
-            vtrue3 = graph()->NewNode(
-                simplified()->NumberBitwiseOr(),
-// Need to swap the order for big-endian platforms
-#if V8_TARGET_BIG_ENDIAN
-                graph()->NewNode(simplified()->NumberShiftLeft(), lead,
-                                 jsgraph()->Constant(16)),
-                trail);
-#else
-                graph()->NewNode(simplified()->NumberShiftLeft(), trail,
-                                 jsgraph()->Constant(16)),
-                lead);
-#endif
-          }
-
-          Node* if_false3 = graph()->NewNode(common()->IfFalse(), branch3);
-          Node* vfalse3 = lead;
-          if_true2 = graph()->NewNode(common()->Merge(2), if_true3, if_false3);
-          vtrue2 =
-              graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 2),
-                               vtrue3, vfalse3, if_true2);
-        }
-
-        Node* if_false2 = graph()->NewNode(common()->IfFalse(), branch2);
-        Node* vfalse2 = lead;
-        if_true1 = graph()->NewNode(common()->Merge(2), if_true2, if_false2);
-        vtrue1 =
-            graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 2),
-                             vtrue2, vfalse2, if_true1);
-      }
-
-      Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
-      Node* vfalse1 = lead;
-      if_true0 = graph()->NewNode(common()->Merge(2), if_true1, if_false1);
-      vtrue0 =
-          graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 2),
-                           vtrue1, vfalse1, if_true0);
-      vtrue0 = graph()->NewNode(
-          simplified()->StringFromCodePoint(UnicodeEncoding::UTF16), vtrue0);
-
-      // Update iterator.[[NextIndex]]
-      Node* char_length =
-          graph()->NewNode(simplified()->StringLength(), vtrue0);
-      index = graph()->NewNode(simplified()->NumberAdd(), index, char_length);
-      etrue0 = graph()->NewNode(
-          simplified()->StoreField(AccessBuilder::ForJSStringIteratorIndex()),
-          receiver, index, etrue0, if_true0);
-    }
-
-    Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
-    Node* done_false;
-    Node* vfalse0;
-    {
-      vfalse0 = jsgraph()->UndefinedConstant();
-      done_false = jsgraph()->TrueConstant();
-    }
-
-    control = graph()->NewNode(common()->Merge(2), if_true0, if_false0);
-    effect = graph()->NewNode(common()->EffectPhi(2), etrue0, effect, control);
-    Node* value =
-        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                         vtrue0, vfalse0, control);
-    Node* done =
-        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                         done_true, done_false, control);
-
-    value = effect = graph()->NewNode(javascript()->CreateIterResultObject(),
-                                      value, done, context, effect);
-
-    ReplaceWithValue(node, value, effect, control);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES section #sec-string.prototype.slice
-Reduction JSBuiltinReducer::ReduceStringSlice(Node* node) {
-  if (Node* receiver = GetStringWitness(node)) {
-    Node* start = node->op()->ValueInputCount() >= 3
-                      ? NodeProperties::GetValueInput(node, 2)
-                      : jsgraph()->UndefinedConstant();
-    Type* start_type = NodeProperties::GetType(start);
-    Node* end = node->op()->ValueInputCount() >= 4
-                    ? NodeProperties::GetValueInput(node, 3)
-                    : jsgraph()->UndefinedConstant();
-    Type* end_type = NodeProperties::GetType(end);
-    Node* effect = NodeProperties::GetEffectInput(node);
-    Node* control = NodeProperties::GetControlInput(node);
-
-    if (start_type->Is(type_cache_.kSingletonMinusOne) &&
-        end_type->Is(Type::Undefined())) {
-      Node* receiver_length =
-          graph()->NewNode(simplified()->StringLength(), receiver);
-
-      Node* check =
-          graph()->NewNode(simplified()->NumberEqual(), receiver_length,
-                           jsgraph()->ZeroConstant());
-      Node* branch = graph()->NewNode(common()->Branch(BranchHint::kFalse),
-                                      check, control);
-
-      Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-      Node* vtrue = jsgraph()->EmptyStringConstant();
-
-      Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-      Node* vfalse;
-      {
-        // We need to convince TurboFan that {receiver_length}-1 is a valid
-        // Unsigned32 value, so we just apply NumberToUint32 to the result
-        // of the subtraction, which is a no-op and merely acts as a marker.
-        Node* index =
-            graph()->NewNode(simplified()->NumberSubtract(), receiver_length,
-                             jsgraph()->OneConstant());
-        index = graph()->NewNode(simplified()->NumberToUint32(), index);
-        vfalse = graph()->NewNode(simplified()->StringCharAt(), receiver, index,
-                                  if_false);
-      }
-
-      control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-      Node* value =
-          graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                           vtrue, vfalse, control);
-      ReplaceWithValue(node, value, effect, control);
-      return Replace(value);
-    }
-  }
-  return NoChange();
-}
-
-Reduction JSBuiltinReducer::ReduceStringToLowerCaseIntl(Node* node) {
-  if (Node* receiver = GetStringWitness(node)) {
-    RelaxEffectsAndControls(node);
-    node->ReplaceInput(0, receiver);
-    node->TrimInputCount(1);
-    NodeProperties::ChangeOp(node, simplified()->StringToLowerCaseIntl());
-    NodeProperties::SetType(node, Type::String());
-    return Changed(node);
-  }
-  return NoChange();
-}
-
-Reduction JSBuiltinReducer::ReduceStringToUpperCaseIntl(Node* node) {
-  if (Node* receiver = GetStringWitness(node)) {
-    RelaxEffectsAndControls(node);
-    node->ReplaceInput(0, receiver);
-    node->TrimInputCount(1);
-    NodeProperties::ChangeOp(node, simplified()->StringToUpperCaseIntl());
-    NodeProperties::SetType(node, Type::String());
-    return Changed(node);
-  }
-  return NoChange();
-}
-
 Reduction JSBuiltinReducer::ReduceArrayBufferIsView(Node* node) {
   Node* value = node->op()->ValueInputCount() >= 3
                     ? NodeProperties::GetValueInput(node, 2)
@@ -2236,7 +798,7 @@ Reduction JSBuiltinReducer::ReduceArrayBufferViewAccessor(
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  if (HasInstanceTypeWitness(receiver, effect, instance_type)) {
+  if (NodeProperties::HasInstanceTypeWitness(receiver, effect, instance_type)) {
     // Load the {receiver}s field.
     Node* value = effect = graph()->NewNode(simplified()->LoadField(access),
                                             receiver, effect, control);
@@ -2274,15 +836,8 @@ Reduction JSBuiltinReducer::Reduce(Node* node) {
 
   // Dispatch according to the BuiltinFunctionId if present.
   if (!r.HasBuiltinFunctionId()) return NoChange();
+  if (!r.BuiltinCanBeInlined()) return NoChange();
   switch (r.GetBuiltinFunctionId()) {
-    case kArrayEntries:
-      return ReduceArrayIterator(node, IterationKind::kEntries);
-    case kArrayKeys:
-      return ReduceArrayIterator(node, IterationKind::kKeys);
-    case kArrayValues:
-      return ReduceArrayIterator(node, IterationKind::kValues);
-    case kArrayIteratorNext:
-      return ReduceArrayIteratorNext(node);
     case kArrayIsArray:
       return ReduceArrayIsArray(node);
     case kDateNow:
@@ -2298,12 +853,6 @@ Reduction JSBuiltinReducer::Reduce(Node* node) {
     case kMapEntries:
       return ReduceCollectionIterator(
           node, JS_MAP_TYPE, Context::MAP_KEY_VALUE_ITERATOR_MAP_INDEX);
-    case kMapGet:
-      reduction = ReduceMapGet(node);
-      break;
-    case kMapHas:
-      reduction = ReduceMapHas(node);
-      break;
     case kMapKeys:
       return ReduceCollectionIterator(node, JS_MAP_TYPE,
                                       Context::MAP_KEY_ITERATOR_MAP_INDEX);
@@ -2316,116 +865,6 @@ Reduction JSBuiltinReducer::Reduce(Node* node) {
       return ReduceCollectionIteratorNext(
           node, OrderedHashMap::kEntrySize, factory()->empty_ordered_hash_map(),
           FIRST_MAP_ITERATOR_TYPE, LAST_MAP_ITERATOR_TYPE);
-    case kMathAbs:
-      reduction = ReduceMathAbs(node);
-      break;
-    case kMathAcos:
-      reduction = ReduceMathAcos(node);
-      break;
-    case kMathAcosh:
-      reduction = ReduceMathAcosh(node);
-      break;
-    case kMathAsin:
-      reduction = ReduceMathAsin(node);
-      break;
-    case kMathAsinh:
-      reduction = ReduceMathAsinh(node);
-      break;
-    case kMathAtan:
-      reduction = ReduceMathAtan(node);
-      break;
-    case kMathAtanh:
-      reduction = ReduceMathAtanh(node);
-      break;
-    case kMathAtan2:
-      reduction = ReduceMathAtan2(node);
-      break;
-    case kMathCbrt:
-      reduction = ReduceMathCbrt(node);
-      break;
-    case kMathCeil:
-      reduction = ReduceMathCeil(node);
-      break;
-    case kMathClz32:
-      reduction = ReduceMathClz32(node);
-      break;
-    case kMathCos:
-      reduction = ReduceMathCos(node);
-      break;
-    case kMathCosh:
-      reduction = ReduceMathCosh(node);
-      break;
-    case kMathExp:
-      reduction = ReduceMathExp(node);
-      break;
-    case kMathExpm1:
-      reduction = ReduceMathExpm1(node);
-      break;
-    case kMathFloor:
-      reduction = ReduceMathFloor(node);
-      break;
-    case kMathFround:
-      reduction = ReduceMathFround(node);
-      break;
-    case kMathImul:
-      reduction = ReduceMathImul(node);
-      break;
-    case kMathLog:
-      reduction = ReduceMathLog(node);
-      break;
-    case kMathLog1p:
-      reduction = ReduceMathLog1p(node);
-      break;
-    case kMathLog10:
-      reduction = ReduceMathLog10(node);
-      break;
-    case kMathLog2:
-      reduction = ReduceMathLog2(node);
-      break;
-    case kMathMax:
-      reduction = ReduceMathMax(node);
-      break;
-    case kMathMin:
-      reduction = ReduceMathMin(node);
-      break;
-    case kMathPow:
-      reduction = ReduceMathPow(node);
-      break;
-    case kMathRound:
-      reduction = ReduceMathRound(node);
-      break;
-    case kMathSign:
-      reduction = ReduceMathSign(node);
-      break;
-    case kMathSin:
-      reduction = ReduceMathSin(node);
-      break;
-    case kMathSinh:
-      reduction = ReduceMathSinh(node);
-      break;
-    case kMathSqrt:
-      reduction = ReduceMathSqrt(node);
-      break;
-    case kMathTan:
-      reduction = ReduceMathTan(node);
-      break;
-    case kMathTanh:
-      reduction = ReduceMathTanh(node);
-      break;
-    case kMathTrunc:
-      reduction = ReduceMathTrunc(node);
-      break;
-    case kNumberIsFinite:
-      reduction = ReduceNumberIsFinite(node);
-      break;
-    case kNumberIsInteger:
-      reduction = ReduceNumberIsInteger(node);
-      break;
-    case kNumberIsNaN:
-      reduction = ReduceNumberIsNaN(node);
-      break;
-    case kNumberIsSafeInteger:
-      reduction = ReduceNumberIsSafeInteger(node);
       break;
     case kNumberParseInt:
       reduction = ReduceNumberParseInt(node);
@@ -2445,21 +884,6 @@ Reduction JSBuiltinReducer::Reduce(Node* node) {
       return ReduceCollectionIteratorNext(
           node, OrderedHashSet::kEntrySize, factory()->empty_ordered_hash_set(),
           FIRST_SET_ITERATOR_TYPE, LAST_SET_ITERATOR_TYPE);
-    case kStringFromCharCode:
-      reduction = ReduceStringFromCharCode(node);
-      break;
-    case kStringConcat:
-      return ReduceStringConcat(node);
-    case kStringIterator:
-      return ReduceStringIterator(node);
-    case kStringIteratorNext:
-      return ReduceStringIteratorNext(node);
-    case kStringSlice:
-      return ReduceStringSlice(node);
-    case kStringToLowerCaseIntl:
-      return ReduceStringToLowerCaseIntl(node);
-    case kStringToUpperCaseIntl:
-      return ReduceStringToUpperCaseIntl(node);
     case kArrayBufferIsView:
       return ReduceArrayBufferIsView(node);
     case kDataViewByteLength:
@@ -2481,12 +905,6 @@ Reduction JSBuiltinReducer::Reduce(Node* node) {
     case kTypedArrayLength:
       return ReduceArrayBufferViewAccessor(
           node, JS_TYPED_ARRAY_TYPE, AccessBuilder::ForJSTypedArrayLength());
-    case kTypedArrayEntries:
-      return ReduceTypedArrayIterator(node, IterationKind::kEntries);
-    case kTypedArrayKeys:
-      return ReduceTypedArrayIterator(node, IterationKind::kKeys);
-    case kTypedArrayValues:
-      return ReduceTypedArrayIterator(node, IterationKind::kValues);
     case kTypedArrayToStringTag:
       return ReduceTypedArrayToStringTag(node);
     default:
diff --git a/deps/v8/src/compiler/js-builtin-reducer.h b/deps/v8/src/compiler/js-builtin-reducer.h
index b3c44c7a0fe..67f2f9443e4 100644
--- a/deps/v8/src/compiler/js-builtin-reducer.h
+++ b/deps/v8/src/compiler/js-builtin-reducer.h
@@ -39,18 +39,6 @@ class V8_EXPORT_PRIVATE JSBuiltinReducer final
   Reduction Reduce(Node* node) final;
 
  private:
-  enum class ArrayIteratorKind { kArray, kTypedArray };
-
-  Reduction ReduceArrayIterator(Node* node, IterationKind kind);
-  Reduction ReduceTypedArrayIterator(Node* node, IterationKind kind);
-  Reduction ReduceArrayIterator(Handle<Map> receiver_map, Node* node,
-                                IterationKind kind,
-                                ArrayIteratorKind iter_kind);
-  Reduction ReduceArrayIteratorNext(Node* node);
-  Reduction ReduceFastArrayIteratorNext(InstanceType type, Node* node,
-                                        IterationKind kind);
-  Reduction ReduceTypedArrayIteratorNext(InstanceType type, Node* node,
-                                         IterationKind kind);
   Reduction ReduceTypedArrayToStringTag(Node* node);
   Reduction ReduceArrayIsArray(Node* node);
 
@@ -67,54 +55,8 @@ class V8_EXPORT_PRIVATE JSBuiltinReducer final
   Reduction ReduceDateGetTime(Node* node);
   Reduction ReduceGlobalIsFinite(Node* node);
   Reduction ReduceGlobalIsNaN(Node* node);
-  Reduction ReduceMapHas(Node* node);
-  Reduction ReduceMapGet(Node* node);
-  Reduction ReduceMathAbs(Node* node);
-  Reduction ReduceMathAcos(Node* node);
-  Reduction ReduceMathAcosh(Node* node);
-  Reduction ReduceMathAsin(Node* node);
-  Reduction ReduceMathAsinh(Node* node);
-  Reduction ReduceMathAtan(Node* node);
-  Reduction ReduceMathAtanh(Node* node);
-  Reduction ReduceMathAtan2(Node* node);
-  Reduction ReduceMathCbrt(Node* node);
-  Reduction ReduceMathCeil(Node* node);
-  Reduction ReduceMathClz32(Node* node);
-  Reduction ReduceMathCos(Node* node);
-  Reduction ReduceMathCosh(Node* node);
-  Reduction ReduceMathExp(Node* node);
-  Reduction ReduceMathExpm1(Node* node);
-  Reduction ReduceMathFloor(Node* node);
-  Reduction ReduceMathFround(Node* node);
-  Reduction ReduceMathImul(Node* node);
-  Reduction ReduceMathLog(Node* node);
-  Reduction ReduceMathLog1p(Node* node);
-  Reduction ReduceMathLog10(Node* node);
-  Reduction ReduceMathLog2(Node* node);
-  Reduction ReduceMathMax(Node* node);
-  Reduction ReduceMathMin(Node* node);
-  Reduction ReduceMathPow(Node* node);
-  Reduction ReduceMathRound(Node* node);
-  Reduction ReduceMathSign(Node* node);
-  Reduction ReduceMathSin(Node* node);
-  Reduction ReduceMathSinh(Node* node);
-  Reduction ReduceMathSqrt(Node* node);
-  Reduction ReduceMathTan(Node* node);
-  Reduction ReduceMathTanh(Node* node);
-  Reduction ReduceMathTrunc(Node* node);
-  Reduction ReduceNumberIsFinite(Node* node);
-  Reduction ReduceNumberIsInteger(Node* node);
-  Reduction ReduceNumberIsNaN(Node* node);
-  Reduction ReduceNumberIsSafeInteger(Node* node);
   Reduction ReduceNumberParseInt(Node* node);
   Reduction ReduceObjectCreate(Node* node);
-  Reduction ReduceStringConcat(Node* node);
-  Reduction ReduceStringFromCharCode(Node* node);
-  Reduction ReduceStringIterator(Node* node);
-  Reduction ReduceStringIteratorNext(Node* node);
-  Reduction ReduceStringSlice(Node* node);
-  Reduction ReduceStringToLowerCaseIntl(Node* node);
-  Reduction ReduceStringToUpperCaseIntl(Node* node);
   Reduction ReduceArrayBufferIsView(Node* node);
   Reduction ReduceArrayBufferViewAccessor(Node* node,
                                           InstanceType instance_type,
diff --git a/deps/v8/src/compiler/js-call-reducer.cc b/deps/v8/src/compiler/js-call-reducer.cc
index 1f8e7a2cefe..e6e5667d016 100644
--- a/deps/v8/src/compiler/js-call-reducer.cc
+++ b/deps/v8/src/compiler/js-call-reducer.cc
@@ -5,6 +5,7 @@
 #include "src/compiler/js-call-reducer.h"
 
 #include "src/api.h"
+#include "src/builtins/builtins-promise-gen.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
@@ -15,6 +16,7 @@
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/simplified-operator.h"
+#include "src/compiler/type-cache.h"
 #include "src/feedback-vector-inl.h"
 #include "src/ic/call-optimization.h"
 #include "src/objects-inl.h"
@@ -24,6 +26,149 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
+Reduction JSCallReducer::ReduceMathUnary(Node* node, const Operator* op) {
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->NaNConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* input = NodeProperties::GetValueInput(node, 2);
+
+  input = effect =
+      graph()->NewNode(simplified()->SpeculativeToNumber(
+                           NumberOperationHint::kNumberOrOddball, p.feedback()),
+                       input, effect, control);
+  Node* value = graph()->NewNode(op, input);
+  ReplaceWithValue(node, value, effect);
+  return Replace(value);
+}
+
+Reduction JSCallReducer::ReduceMathBinary(Node* node, const Operator* op) {
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->NaNConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  Node* left = NodeProperties::GetValueInput(node, 2);
+  Node* right = node->op()->ValueInputCount() > 3
+                    ? NodeProperties::GetValueInput(node, 3)
+                    : jsgraph()->NaNConstant();
+  left = effect =
+      graph()->NewNode(simplified()->SpeculativeToNumber(
+                           NumberOperationHint::kNumberOrOddball, p.feedback()),
+                       left, effect, control);
+  right = effect =
+      graph()->NewNode(simplified()->SpeculativeToNumber(
+                           NumberOperationHint::kNumberOrOddball, p.feedback()),
+                       right, effect, control);
+  Node* value = graph()->NewNode(op, left, right);
+  ReplaceWithValue(node, value, effect);
+  return Replace(value);
+}
+
+// ES6 section 20.2.2.19 Math.imul ( x, y )
+Reduction JSCallReducer::ReduceMathImul(Node* node) {
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->ZeroConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+  Node* left = NodeProperties::GetValueInput(node, 2);
+  Node* right = node->op()->ValueInputCount() > 3
+                    ? NodeProperties::GetValueInput(node, 3)
+                    : jsgraph()->ZeroConstant();
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  left = effect =
+      graph()->NewNode(simplified()->SpeculativeToNumber(
+                           NumberOperationHint::kNumberOrOddball, p.feedback()),
+                       left, effect, control);
+  right = effect =
+      graph()->NewNode(simplified()->SpeculativeToNumber(
+                           NumberOperationHint::kNumberOrOddball, p.feedback()),
+                       right, effect, control);
+  left = graph()->NewNode(simplified()->NumberToUint32(), left);
+  right = graph()->NewNode(simplified()->NumberToUint32(), right);
+  Node* value = graph()->NewNode(simplified()->NumberImul(), left, right);
+  ReplaceWithValue(node, value, effect);
+  return Replace(value);
+}
+
+// ES6 section 20.2.2.11 Math.clz32 ( x )
+Reduction JSCallReducer::ReduceMathClz32(Node* node) {
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->Constant(32);
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+  Node* input = NodeProperties::GetValueInput(node, 2);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  input = effect =
+      graph()->NewNode(simplified()->SpeculativeToNumber(
+                           NumberOperationHint::kNumberOrOddball, p.feedback()),
+                       input, effect, control);
+  input = graph()->NewNode(simplified()->NumberToUint32(), input);
+  Node* value = graph()->NewNode(simplified()->NumberClz32(), input);
+  ReplaceWithValue(node, value, effect);
+  return Replace(value);
+}
+
+// ES6 section 20.2.2.24 Math.max ( value1, value2, ...values )
+// ES6 section 20.2.2.25 Math.min ( value1, value2, ...values )
+Reduction JSCallReducer::ReduceMathMinMax(Node* node, const Operator* op,
+                                          Node* empty_value) {
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  if (node->op()->ValueInputCount() <= 2) {
+    ReplaceWithValue(node, empty_value);
+    return Replace(empty_value);
+  }
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  Node* value = effect =
+      graph()->NewNode(simplified()->SpeculativeToNumber(
+                           NumberOperationHint::kNumberOrOddball, p.feedback()),
+                       NodeProperties::GetValueInput(node, 2), effect, control);
+  for (int i = 3; i < node->op()->ValueInputCount(); i++) {
+    Node* input = effect = graph()->NewNode(
+        simplified()->SpeculativeToNumber(NumberOperationHint::kNumberOrOddball,
+                                          p.feedback()),
+        NodeProperties::GetValueInput(node, i), effect, control);
+    value = graph()->NewNode(op, value, input);
+  }
+
+  ReplaceWithValue(node, value, effect);
+  return Replace(value);
+}
+
 Reduction JSCallReducer::Reduce(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kJSConstruct:
@@ -112,7 +257,7 @@ Reduction JSCallReducer::ReduceObjectConstructor(Node* node) {
     }
   } else {
     ReplaceWithValue(node, value);
-    return Replace(node);
+    return Replace(value);
   }
   return NoChange();
 }
@@ -338,12 +483,25 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
 Reduction JSCallReducer::ReduceFunctionPrototypeCall(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  Handle<JSFunction> call = Handle<JSFunction>::cast(
-      HeapObjectMatcher(NodeProperties::GetValueInput(node, 0)).Value());
+  Node* target = NodeProperties::GetValueInput(node, 0);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
   // Change context of {node} to the Function.prototype.call context,
   // to ensure any exception is thrown in the correct context.
-  NodeProperties::ReplaceContextInput(
-      node, jsgraph()->HeapConstant(handle(call->context(), isolate())));
+  Node* context;
+  HeapObjectMatcher m(target);
+  if (m.HasValue()) {
+    Handle<JSFunction> function = Handle<JSFunction>::cast(m.Value());
+    context = jsgraph()->HeapConstant(handle(function->context(), isolate()));
+  } else {
+    context = effect = graph()->NewNode(
+        simplified()->LoadField(AccessBuilder::ForJSFunctionContext()), target,
+        effect, control);
+  }
+  NodeProperties::ReplaceContextInput(node, context);
+  NodeProperties::ReplaceEffectInput(node, effect);
+
   // Remove the target from {node} and use the receiver as target instead, and
   // the thisArg becomes the new target.  If thisArg was not provided, insert
   // undefined instead.
@@ -672,14 +830,14 @@ Reduction JSCallReducer::ReduceReflectGet(Node* node) {
   Node* vtrue;
   {
     Callable callable = CodeFactory::GetProperty(isolate());
-    CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
         isolate(), graph()->zone(), callable.descriptor(), 0,
         CallDescriptor::kNeedsFrameState, Operator::kNoProperties,
         MachineType::AnyTagged(), 1);
     Node* stub_code = jsgraph()->HeapConstant(callable.code());
     vtrue = etrue = if_true =
-        graph()->NewNode(common()->Call(desc), stub_code, target, key, context,
-                         frame_state, etrue, if_true);
+        graph()->NewNode(common()->Call(call_descriptor), stub_code, target,
+                         key, context, frame_state, etrue, if_true);
   }
 
   // Rewire potential exception edges.
@@ -810,8 +968,8 @@ void JSCallReducer::WireInLoopEnd(Node* loop, Node* eloop, Node* vloop, Node* k,
   eloop->ReplaceInput(1, effect);
 }
 
-Reduction JSCallReducer::ReduceArrayForEach(Handle<JSFunction> function,
-                                            Node* node) {
+Reduction JSCallReducer::ReduceArrayForEach(Node* node,
+                                            Handle<SharedFunctionInfo> shared) {
   if (!FLAG_turbo_inline_array_builtins) return NoChange();
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
@@ -884,7 +1042,7 @@ Reduction JSCallReducer::ReduceArrayForEach(Handle<JSFunction> function,
   // Check whether the given callback function is callable. Note that this has
   // to happen outside the loop to make sure we also throw on empty arrays.
   Node* check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), function, Builtins::kArrayForEachLoopLazyDeoptContinuation,
+      jsgraph(), shared, Builtins::kArrayForEachLoopLazyDeoptContinuation,
       node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
       outer_frame_state, ContinuationFrameStateMode::LAZY);
   Node* check_fail = nullptr;
@@ -907,7 +1065,7 @@ Reduction JSCallReducer::ReduceArrayForEach(Handle<JSFunction> function,
   control = if_true;
 
   Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), function, Builtins::kArrayForEachLoopEagerDeoptContinuation,
+      jsgraph(), shared, Builtins::kArrayForEachLoopEagerDeoptContinuation,
       node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
       outer_frame_state, ContinuationFrameStateMode::EAGER);
 
@@ -955,7 +1113,7 @@ Reduction JSCallReducer::ReduceArrayForEach(Handle<JSFunction> function,
   }
 
   frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), function, Builtins::kArrayForEachLoopLazyDeoptContinuation,
+      jsgraph(), shared, Builtins::kArrayForEachLoopLazyDeoptContinuation,
       node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
       outer_frame_state, ContinuationFrameStateMode::LAZY);
 
@@ -998,19 +1156,21 @@ Reduction JSCallReducer::ReduceArrayForEach(Handle<JSFunction> function,
   return Replace(jsgraph()->UndefinedConstant());
 }
 
-Reduction JSCallReducer::ReduceArrayReduce(Handle<JSFunction> function,
-                                           Node* node) {
+Reduction JSCallReducer::ReduceArrayReduce(Node* node,
+                                           ArrayReduceDirection direction,
+                                           Handle<SharedFunctionInfo> shared) {
   if (!FLAG_turbo_inline_array_builtins) return NoChange();
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  bool left = direction == ArrayReduceDirection::kLeft;
 
   Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* context = NodeProperties::GetContextInput(node);
-  CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
 
   // Try to determine the {receiver} map.
   Node* receiver = NodeProperties::GetValueInput(node, 1);
@@ -1023,25 +1183,22 @@ Reduction JSCallReducer::ReduceArrayReduce(Handle<JSFunction> function,
       NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
 
-  ElementsKind kind = IsDoubleElementsKind(receiver_maps[0]->elements_kind())
-                          ? PACKED_DOUBLE_ELEMENTS
-                          : PACKED_ELEMENTS;
+  ElementsKind kind = receiver_maps[0]->elements_kind();
   for (Handle<Map> receiver_map : receiver_maps) {
-    ElementsKind next_kind = receiver_map->elements_kind();
-    if (!CanInlineArrayIteratingBuiltin(receiver_map)) {
-      return NoChange();
-    }
-    if (!IsFastElementsKind(next_kind) || IsHoleyElementsKind(next_kind)) {
-      return NoChange();
-    }
-    if (IsDoubleElementsKind(kind) != IsDoubleElementsKind(next_kind)) {
+    if (!CanInlineArrayIteratingBuiltin(receiver_map)) return NoChange();
+    if (!UnionElementsKindUptoSize(&kind, receiver_map->elements_kind()))
       return NoChange();
-    }
-    if (IsHoleyElementsKind(next_kind)) {
-      kind = HOLEY_ELEMENTS;
-    }
   }
 
+  std::function<Node*(Node*)> hole_check = [this, kind](Node* element) {
+    if (IsDoubleElementsKind(kind)) {
+      return graph()->NewNode(simplified()->NumberIsFloat64Hole(), element);
+    } else {
+      return graph()->NewNode(simplified()->ReferenceEqual(), element,
+                              jsgraph()->TheHoleConstant());
+    }
+  };
+
   // Install code dependencies on the {receiver} prototype maps and the
   // global array protector cell.
   dependencies()->AssumePropertyCell(factory()->no_elements_protector());
@@ -1058,47 +1215,84 @@ Reduction JSCallReducer::ReduceArrayReduce(Handle<JSFunction> function,
       simplified()->LoadField(AccessBuilder::ForJSArrayLength(PACKED_ELEMENTS)),
       receiver, effect, control);
 
-  Node* k = jsgraph()->ZeroConstant();
-
-  std::vector<Node*> checkpoint_params({receiver, fncallback, k,
-                                        original_length,
-                                        jsgraph()->UndefinedConstant()});
-  const int stack_parameters = static_cast<int>(checkpoint_params.size());
+  Node* initial_index =
+      left ? jsgraph()->ZeroConstant()
+           : graph()->NewNode(simplified()->NumberSubtract(), original_length,
+                              jsgraph()->OneConstant());
+  const Operator* next_op =
+      left ? simplified()->NumberAdd() : simplified()->NumberSubtract();
+  Node* k = initial_index;
 
-  // Check whether the given callback function is callable. Note that this has
-  // to happen outside the loop to make sure we also throw on empty arrays.
-  Node* check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), function, Builtins::kArrayReduceLoopLazyDeoptContinuation,
-      node->InputAt(0), context, &checkpoint_params[0], stack_parameters - 1,
-      outer_frame_state, ContinuationFrameStateMode::LAZY);
+  Node* check_frame_state;
+  {
+    Builtins::Name builtin_lazy =
+        left ? Builtins::kArrayReduceLoopLazyDeoptContinuation
+             : Builtins::kArrayReduceRightLoopLazyDeoptContinuation;
+    const std::vector<Node*> checkpoint_params(
+        {receiver, fncallback, k, original_length,
+         jsgraph()->UndefinedConstant()});
+    const int stack_parameters = static_cast<int>(checkpoint_params.size());
+    check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+        jsgraph(), shared, builtin_lazy, node->InputAt(0), context,
+        checkpoint_params.data(), stack_parameters - 1, outer_frame_state,
+        ContinuationFrameStateMode::LAZY);
+  }
   Node* check_fail = nullptr;
   Node* check_throw = nullptr;
+  // Check whether the given callback function is callable. Note that
+  // this has to happen outside the loop to make sure we also throw on
+  // empty arrays.
   WireInCallbackIsCallableCheck(fncallback, context, check_frame_state, effect,
                                 &control, &check_fail, &check_throw);
 
   // Set initial accumulator value
   Node* cur = jsgraph()->TheHoleConstant();
 
-  Node* initial_element_check_fail = nullptr;
-  Node* initial_element_check_throw = nullptr;
   if (node->op()->ValueInputCount() > 3) {
     cur = NodeProperties::GetValueInput(node, 3);
   } else {
-    Node* check =
-        graph()->NewNode(simplified()->NumberEqual(), original_length, k);
-    Node* check_branch =
-        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-    initial_element_check_fail =
-        graph()->NewNode(common()->IfTrue(), check_branch);
-    initial_element_check_throw = graph()->NewNode(
-        javascript()->CallRuntime(Runtime::kThrowTypeError, 2),
-        jsgraph()->Constant(MessageTemplate::kReduceNoInitial), fncallback,
-        context, check_frame_state, effect, initial_element_check_fail);
-    control = graph()->NewNode(common()->IfFalse(), check_branch);
+    // Find first/last non holey element. In case the search fails, we need a
+    // deopt continuation.
+    Builtins::Name builtin_eager =
+        left ? Builtins::kArrayReducePreLoopEagerDeoptContinuation
+             : Builtins::kArrayReduceRightPreLoopEagerDeoptContinuation;
+    const std::vector<Node*> checkpoint_params(
+        {receiver, fncallback, original_length});
+    const int stack_parameters = static_cast<int>(checkpoint_params.size());
+    Node* find_first_element_frame_state =
+        CreateJavaScriptBuiltinContinuationFrameState(
+            jsgraph(), shared, builtin_eager, node->InputAt(0), context,
+            checkpoint_params.data(), stack_parameters, outer_frame_state,
+            ContinuationFrameStateMode::EAGER);
+
+    Node* vloop = k = WireInLoopStart(k, &control, &effect);
+    Node* loop = control;
+    Node* eloop = effect;
+    effect = graph()->NewNode(common()->Checkpoint(),
+                              find_first_element_frame_state, effect, control);
+    Node* continue_test =
+        left ? graph()->NewNode(simplified()->NumberLessThan(), k,
+                                original_length)
+             : graph()->NewNode(simplified()->NumberLessThanOrEqual(),
+                                jsgraph()->ZeroConstant(), k);
+    effect = graph()->NewNode(
+        simplified()->CheckIf(DeoptimizeReason::kNoInitialElement),
+        continue_test, effect, control);
 
     cur = SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
-    k = graph()->NewNode(simplified()->NumberAdd(), k,
-                         jsgraph()->OneConstant());
+    Node* next_k = graph()->NewNode(next_op, k, jsgraph()->OneConstant());
+
+    Node* hole_branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
+                                         hole_check(cur), control);
+    Node* found_el = graph()->NewNode(common()->IfFalse(), hole_branch);
+    control = found_el;
+    Node* is_hole = graph()->NewNode(common()->IfTrue(), hole_branch);
+
+    WireInLoopEnd(loop, eloop, vloop, next_k, is_hole, effect);
+    // We did the hole-check, so exclude hole from the type.
+    cur = effect = graph()->NewNode(common()->TypeGuard(Type::NonInternal()),
+                                    cur, effect, control);
+    k = next_k;
   }
 
   // Start the loop.
@@ -1111,14 +1305,16 @@ Reduction JSCallReducer::ReduceArrayReduce(Handle<JSFunction> function,
       common()->Phi(MachineRepresentation::kTagged, 2), k, k, loop);
   Node* curloop = cur = graph()->NewNode(
       common()->Phi(MachineRepresentation::kTagged, 2), cur, cur, loop);
-  checkpoint_params[2] = k;
-  checkpoint_params[4] = curloop;
 
   control = loop;
   effect = eloop;
 
   Node* continue_test =
-      graph()->NewNode(simplified()->NumberLessThan(), k, original_length);
+      left
+          ? graph()->NewNode(simplified()->NumberLessThan(), k, original_length)
+          : graph()->NewNode(simplified()->NumberLessThanOrEqual(),
+                             jsgraph()->ZeroConstant(), k);
+
   Node* continue_branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
                                            continue_test, control);
 
@@ -1126,13 +1322,20 @@ Reduction JSCallReducer::ReduceArrayReduce(Handle<JSFunction> function,
   Node* if_false = graph()->NewNode(common()->IfFalse(), continue_branch);
   control = if_true;
 
-  Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), function, Builtins::kArrayReduceLoopEagerDeoptContinuation,
-      node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-      outer_frame_state, ContinuationFrameStateMode::EAGER);
-
-  effect =
-      graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
+  {
+    Builtins::Name builtin_eager =
+        left ? Builtins::kArrayReduceLoopEagerDeoptContinuation
+             : Builtins::kArrayReduceRightLoopEagerDeoptContinuation;
+    const std::vector<Node*> checkpoint_params(
+        {receiver, fncallback, k, original_length, curloop});
+    const int stack_parameters = static_cast<int>(checkpoint_params.size());
+    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+        jsgraph(), shared, builtin_eager, node->InputAt(0), context,
+        checkpoint_params.data(), stack_parameters, outer_frame_state,
+        ContinuationFrameStateMode::EAGER);
+    effect =
+        graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
+  }
 
   // Make sure the map hasn't changed during the iteration
   effect = graph()->NewNode(
@@ -1142,9 +1345,7 @@ Reduction JSCallReducer::ReduceArrayReduce(Handle<JSFunction> function,
   Node* element =
       SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
 
-  Node* next_k =
-      graph()->NewNode(simplified()->NumberAdd(), k, jsgraph()->OneConstant());
-  checkpoint_params[2] = next_k;
+  Node* next_k = graph()->NewNode(next_op, k, jsgraph()->OneConstant());
 
   Node* hole_true = nullptr;
   Node* hole_false = nullptr;
@@ -1153,10 +1354,8 @@ Reduction JSCallReducer::ReduceArrayReduce(Handle<JSFunction> function,
   if (IsHoleyElementsKind(kind)) {
     // Holey elements kind require a hole check and skipping of the element in
     // the case of a hole.
-    Node* check = graph()->NewNode(simplified()->ReferenceEqual(), element,
-                                   jsgraph()->TheHoleConstant());
-    Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
+    Node* branch = graph()->NewNode(common()->Branch(BranchHint::kFalse),
+                                    hole_check(element), control);
     hole_true = graph()->NewNode(common()->IfTrue(), branch);
     hole_false = graph()->NewNode(common()->IfFalse(), branch);
     control = hole_false;
@@ -1168,15 +1367,24 @@ Reduction JSCallReducer::ReduceArrayReduce(Handle<JSFunction> function,
         common()->TypeGuard(Type::NonInternal()), element, effect, control);
   }
 
-  frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), function, Builtins::kArrayReduceLoopLazyDeoptContinuation,
-      node->InputAt(0), context, &checkpoint_params[0], stack_parameters - 1,
-      outer_frame_state, ContinuationFrameStateMode::LAZY);
+  Node* next_cur;
+  {
+    Builtins::Name builtin_lazy =
+        left ? Builtins::kArrayReduceLoopLazyDeoptContinuation
+             : Builtins::kArrayReduceRightLoopLazyDeoptContinuation;
+    const std::vector<Node*> checkpoint_params(
+        {receiver, fncallback, next_k, original_length, curloop});
+    const int stack_parameters = static_cast<int>(checkpoint_params.size());
+    Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+        jsgraph(), shared, builtin_lazy, node->InputAt(0), context,
+        checkpoint_params.data(), stack_parameters - 1, outer_frame_state,
+        ContinuationFrameStateMode::LAZY);
 
-  Node* next_cur = control = effect =
-      graph()->NewNode(javascript()->Call(6, p.frequency()), fncallback,
-                       jsgraph()->UndefinedConstant(), cur, element, k,
-                       receiver, context, frame_state, effect, control);
+    next_cur = control = effect =
+        graph()->NewNode(javascript()->Call(6, p.frequency()), fncallback,
+                         jsgraph()->UndefinedConstant(), cur, element, k,
+                         receiver, context, frame_state, effect, control);
+  }
 
   // Rewire potential exception edges.
   Node* on_exception = nullptr;
@@ -1218,68 +1426,59 @@ Reduction JSCallReducer::ReduceArrayReduce(Handle<JSFunction> function,
       graph()->NewNode(common()->Throw(), check_throw, check_fail);
   NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
 
-  if (node->op()->ValueInputCount() <= 3) {
-    // Wire up the branch for the case when an array is empty.
-    // Since {check_throw} is an unconditional throw, it's impossible to
-    // return a successful completion. Therefore, we simply connect the
-    // successful completion to the graph end.
-    Node* throw_node =
-        graph()->NewNode(common()->Throw(), initial_element_check_throw,
-                         initial_element_check_fail);
-    NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
-  }
-
   ReplaceWithValue(node, curloop, effect, control);
   return Replace(curloop);
-}  // namespace compiler
+}
 
-Reduction JSCallReducer::ReduceArrayReduceRight(Handle<JSFunction> function,
-                                                Node* node) {
+Reduction JSCallReducer::ReduceArrayMap(Node* node,
+                                        Handle<SharedFunctionInfo> shared) {
   if (!FLAG_turbo_inline_array_builtins) return NoChange();
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
 
   Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* context = NodeProperties::GetContextInput(node);
-  CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
 
   // Try to determine the {receiver} map.
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* fncallback = node->op()->ValueInputCount() > 2
                          ? NodeProperties::GetValueInput(node, 2)
                          : jsgraph()->UndefinedConstant();
-
+  Node* this_arg = node->op()->ValueInputCount() > 3
+                       ? NodeProperties::GetValueInput(node, 3)
+                       : jsgraph()->UndefinedConstant();
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
       NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
 
-  ElementsKind kind = IsDoubleElementsKind(receiver_maps[0]->elements_kind())
-                          ? PACKED_DOUBLE_ELEMENTS
-                          : PACKED_ELEMENTS;
+  // Ensure that any changes to the Array species constructor cause deopt.
+  if (!isolate()->IsSpeciesLookupChainIntact()) return NoChange();
+
+  const ElementsKind kind = receiver_maps[0]->elements_kind();
+
   for (Handle<Map> receiver_map : receiver_maps) {
-    ElementsKind next_kind = receiver_map->elements_kind();
-    if (!CanInlineArrayIteratingBuiltin(receiver_map)) {
-      return NoChange();
-    }
-    if (!IsFastElementsKind(next_kind) || IsHoleyElementsKind(next_kind)) {
-      return NoChange();
-    }
-    if (IsDoubleElementsKind(kind) != IsDoubleElementsKind(next_kind)) {
-      return NoChange();
-    }
-    if (IsHoleyElementsKind(next_kind)) {
-      kind = HOLEY_ELEMENTS;
-    }
+    if (!CanInlineArrayIteratingBuiltin(receiver_map)) return NoChange();
+    // We can handle different maps, as long as their elements kind are the
+    // same.
+    if (receiver_map->elements_kind() != kind) return NoChange();
   }
 
-  // Install code dependencies on the {receiver} prototype maps and the
-  // global array protector cell.
-  dependencies()->AssumePropertyCell(factory()->no_elements_protector());
+  dependencies()->AssumePropertyCell(factory()->species_protector());
+
+  Handle<JSFunction> handle_constructor(
+      JSFunction::cast(
+          native_context()->GetInitialJSArrayMap(kind)->GetConstructor()),
+      isolate());
+  Node* array_constructor = jsgraph()->HeapConstant(handle_constructor);
+
+
+  Node* k = jsgraph()->ZeroConstant();
 
   // If we have unreliable maps, we need a map check.
   if (result == NodeProperties::kUnreliableReceiverMaps) {
@@ -1290,71 +1489,39 @@ Reduction JSCallReducer::ReduceArrayReduceRight(Handle<JSFunction> function,
   }
 
   Node* original_length = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSArrayLength(PACKED_ELEMENTS)),
-      receiver, effect, control);
+      simplified()->LoadField(AccessBuilder::ForJSArrayLength(kind)), receiver,
+      effect, control);
 
-  Node* k = graph()->NewNode(simplified()->NumberSubtract(), original_length,
-                             jsgraph()->OneConstant());
+  // This array should be HOLEY_SMI_ELEMENTS because of the non-zero length.
+  // Even though {JSCreateArray} is not marked as {kNoThrow}, we can elide the
+  // exceptional projections because it cannot throw with the given parameters.
+  Node* a = control = effect = graph()->NewNode(
+      javascript()->CreateArray(1, Handle<AllocationSite>::null()),
+      array_constructor, array_constructor, original_length, context,
+      outer_frame_state, effect, control);
 
-  std::vector<Node*> checkpoint_params({receiver, fncallback, k,
-                                        original_length,
-                                        jsgraph()->UndefinedConstant()});
+  std::vector<Node*> checkpoint_params(
+      {receiver, fncallback, this_arg, a, k, original_length});
   const int stack_parameters = static_cast<int>(checkpoint_params.size());
 
   // Check whether the given callback function is callable. Note that this has
   // to happen outside the loop to make sure we also throw on empty arrays.
   Node* check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), function, Builtins::kArrayReduceRightLoopLazyDeoptContinuation,
-      node->InputAt(0), context, &checkpoint_params[0], stack_parameters - 1,
+      jsgraph(), shared, Builtins::kArrayMapLoopLazyDeoptContinuation,
+      node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
       outer_frame_state, ContinuationFrameStateMode::LAZY);
   Node* check_fail = nullptr;
   Node* check_throw = nullptr;
   WireInCallbackIsCallableCheck(fncallback, context, check_frame_state, effect,
                                 &control, &check_fail, &check_throw);
 
-  // Set initial accumulator value
-  Node* cur = nullptr;
-
-  Node* initial_element_check_fail = nullptr;
-  Node* initial_element_check_throw = nullptr;
-  if (node->op()->ValueInputCount() > 3) {
-    cur = NodeProperties::GetValueInput(node, 3);
-  } else {
-    Node* check = graph()->NewNode(simplified()->NumberEqual(), original_length,
-                                   jsgraph()->SmiConstant(0));
-    Node* check_branch =
-        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-    initial_element_check_fail =
-        graph()->NewNode(common()->IfTrue(), check_branch);
-    initial_element_check_throw = graph()->NewNode(
-        javascript()->CallRuntime(Runtime::kThrowTypeError, 2),
-        jsgraph()->Constant(MessageTemplate::kReduceNoInitial), fncallback,
-        context, check_frame_state, effect, initial_element_check_fail);
-    control = graph()->NewNode(common()->IfFalse(), check_branch);
-
-    cur = SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
-    k = graph()->NewNode(simplified()->NumberSubtract(), k,
-                         jsgraph()->OneConstant());
-  }
-
   // Start the loop.
-  Node* loop = control = graph()->NewNode(common()->Loop(2), control, control);
-  Node* eloop = effect =
-      graph()->NewNode(common()->EffectPhi(2), effect, effect, loop);
-  Node* terminate = graph()->NewNode(common()->Terminate(), eloop, loop);
-  NodeProperties::MergeControlToEnd(graph(), common(), terminate);
-  Node* kloop = k = graph()->NewNode(
-      common()->Phi(MachineRepresentation::kTagged, 2), k, k, loop);
-  Node* curloop = cur = graph()->NewNode(
-      common()->Phi(MachineRepresentation::kTagged, 2), cur, cur, loop);
-  checkpoint_params[2] = k;
-  checkpoint_params[4] = curloop;
-
-  control = loop;
-  effect = eloop;
+  Node* vloop = k = WireInLoopStart(k, &control, &effect);
+  Node *loop = control, *eloop = effect;
+  checkpoint_params[4] = k;
 
-  Node* continue_test = graph()->NewNode(simplified()->NumberLessThanOrEqual(),
-                                         jsgraph()->ZeroConstant(), k);
+  Node* continue_test =
+      graph()->NewNode(simplified()->NumberLessThan(), k, original_length);
   Node* continue_branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
                                            continue_test, control);
 
@@ -1363,231 +1530,24 @@ Reduction JSCallReducer::ReduceArrayReduceRight(Handle<JSFunction> function,
   control = if_true;
 
   Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), function,
-      Builtins::kArrayReduceRightLoopEagerDeoptContinuation, node->InputAt(0),
-      context, &checkpoint_params[0], stack_parameters, outer_frame_state,
-      ContinuationFrameStateMode::EAGER);
+      jsgraph(), shared, Builtins::kArrayMapLoopEagerDeoptContinuation,
+      node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
+      outer_frame_state, ContinuationFrameStateMode::EAGER);
 
   effect =
       graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
 
   // Make sure the map hasn't changed during the iteration
-  effect = graph()->NewNode(
-      simplified()->CheckMaps(CheckMapsFlag::kNone, receiver_maps), receiver,
-      effect, control);
+  effect =
+      graph()->NewNode(simplified()->CheckMaps(CheckMapsFlag::kNone,
+                                               receiver_maps, p.feedback()),
+                       receiver, effect, control);
 
   Node* element =
       SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
 
-  Node* next_k = graph()->NewNode(simplified()->NumberSubtract(), k,
-                                  jsgraph()->OneConstant());
-  checkpoint_params[2] = next_k;
-
-  Node* hole_true = nullptr;
-  Node* hole_false = nullptr;
-  Node* effect_true = effect;
-
-  if (IsHoleyElementsKind(kind)) {
-    // Holey elements kind require a hole check and skipping of the element in
-    // the case of a hole.
-    Node* check = graph()->NewNode(simplified()->ReferenceEqual(), element,
-                                   jsgraph()->TheHoleConstant());
-    Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-    hole_true = graph()->NewNode(common()->IfTrue(), branch);
-    hole_false = graph()->NewNode(common()->IfFalse(), branch);
-    control = hole_false;
-
-    // The contract is that we don't leak "the hole" into "user JavaScript",
-    // so we must rename the {element} here to explicitly exclude "the hole"
-    // from the type of {element}.
-    element = effect = graph()->NewNode(
-        common()->TypeGuard(Type::NonInternal()), element, effect, control);
-  }
-
-  frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), function, Builtins::kArrayReduceRightLoopLazyDeoptContinuation,
-      node->InputAt(0), context, &checkpoint_params[0], stack_parameters - 1,
-      outer_frame_state, ContinuationFrameStateMode::LAZY);
-
-  Node* next_cur = control = effect =
-      graph()->NewNode(javascript()->Call(6, p.frequency()), fncallback,
-                       jsgraph()->UndefinedConstant(), cur, element, k,
-                       receiver, context, frame_state, effect, control);
-
-  // Rewire potential exception edges.
-  Node* on_exception = nullptr;
-  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
-    RewirePostCallbackExceptionEdges(check_throw, on_exception, effect,
-                                     &check_fail, &control);
-  }
-
-  if (IsHoleyElementsKind(kind)) {
-    Node* after_call_control = control;
-    Node* after_call_effect = effect;
-    control = hole_true;
-    effect = effect_true;
-
-    control = graph()->NewNode(common()->Merge(2), control, after_call_control);
-    effect = graph()->NewNode(common()->EffectPhi(2), effect, after_call_effect,
-                              control);
-    next_cur =
-        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2), cur,
-                         next_cur, control);
-  }
-
-  k = next_k;
-  cur = next_cur;
-
-  loop->ReplaceInput(1, control);
-  kloop->ReplaceInput(1, k);
-  curloop->ReplaceInput(1, cur);
-  eloop->ReplaceInput(1, effect);
-
-  control = if_false;
-  effect = eloop;
-
-  // Wire up the branch for the case when IsCallable fails for the callback.
-  // Since {check_throw} is an unconditional throw, it's impossible to
-  // return a successful completion. Therefore, we simply connect the successful
-  // completion to the graph end.
-  Node* throw_node =
-      graph()->NewNode(common()->Throw(), check_throw, check_fail);
-  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
-
-  if (node->op()->ValueInputCount() <= 3) {
-    // Wire up the branch for the case when an array is empty.
-    // Since {check_throw} is an unconditional throw, it's impossible to
-    // return a successful completion. Therefore, we simply connect the
-    // successful completion to the graph end.
-    Node* throw_node =
-        graph()->NewNode(common()->Throw(), initial_element_check_throw,
-                         initial_element_check_fail);
-    NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
-  }
-
-  ReplaceWithValue(node, curloop, effect, control);
-  return Replace(curloop);
-}  // namespace compiler
-
-Reduction JSCallReducer::ReduceArrayMap(Handle<JSFunction> function,
-                                        Node* node) {
-  if (!FLAG_turbo_inline_array_builtins) return NoChange();
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
-
-  Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* context = NodeProperties::GetContextInput(node);
-
-  // Try to determine the {receiver} map.
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* fncallback = node->op()->ValueInputCount() > 2
-                         ? NodeProperties::GetValueInput(node, 2)
-                         : jsgraph()->UndefinedConstant();
-  Node* this_arg = node->op()->ValueInputCount() > 3
-                       ? NodeProperties::GetValueInput(node, 3)
-                       : jsgraph()->UndefinedConstant();
-  ZoneHandleSet<Map> receiver_maps;
-  NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
-  if (result == NodeProperties::kNoReceiverMaps) return NoChange();
-
-  // Ensure that any changes to the Array species constructor cause deopt.
-  if (!isolate()->IsArraySpeciesLookupChainIntact()) return NoChange();
-
-  const ElementsKind kind = receiver_maps[0]->elements_kind();
-
-  for (Handle<Map> receiver_map : receiver_maps) {
-    if (!CanInlineArrayIteratingBuiltin(receiver_map)) return NoChange();
-    // We can handle different maps, as long as their elements kind are the
-    // same.
-    if (receiver_map->elements_kind() != kind) return NoChange();
-  }
-
-  dependencies()->AssumePropertyCell(factory()->species_protector());
-
-  Handle<JSFunction> handle_constructor(
-      JSFunction::cast(
-          native_context()->GetInitialJSArrayMap(kind)->GetConstructor()),
-      isolate());
-  Node* array_constructor = jsgraph()->HeapConstant(handle_constructor);
-
-
-  Node* k = jsgraph()->ZeroConstant();
-
-  // If we have unreliable maps, we need a map check.
-  if (result == NodeProperties::kUnreliableReceiverMaps) {
-    effect =
-        graph()->NewNode(simplified()->CheckMaps(CheckMapsFlag::kNone,
-                                                 receiver_maps, p.feedback()),
-                         receiver, effect, control);
-  }
-
-  Node* original_length = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSArrayLength(kind)), receiver,
-      effect, control);
-
-  // This array should be HOLEY_SMI_ELEMENTS because of the non-zero length.
-  // Even though {JSCreateArray} is not marked as {kNoThrow}, we can elide the
-  // exceptional projections because it cannot throw with the given parameters.
-  Node* a = control = effect = graph()->NewNode(
-      javascript()->CreateArray(1, Handle<AllocationSite>::null()),
-      array_constructor, array_constructor, original_length, context,
-      outer_frame_state, effect, control);
-
-  std::vector<Node*> checkpoint_params(
-      {receiver, fncallback, this_arg, a, k, original_length});
-  const int stack_parameters = static_cast<int>(checkpoint_params.size());
-
-  // Check whether the given callback function is callable. Note that this has
-  // to happen outside the loop to make sure we also throw on empty arrays.
-  Node* check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), function, Builtins::kArrayMapLoopLazyDeoptContinuation,
-      node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-      outer_frame_state, ContinuationFrameStateMode::LAZY);
-  Node* check_fail = nullptr;
-  Node* check_throw = nullptr;
-  WireInCallbackIsCallableCheck(fncallback, context, check_frame_state, effect,
-                                &control, &check_fail, &check_throw);
-
-  // Start the loop.
-  Node* vloop = k = WireInLoopStart(k, &control, &effect);
-  Node *loop = control, *eloop = effect;
-  checkpoint_params[4] = k;
-
-  Node* continue_test =
-      graph()->NewNode(simplified()->NumberLessThan(), k, original_length);
-  Node* continue_branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                           continue_test, control);
-
-  Node* if_true = graph()->NewNode(common()->IfTrue(), continue_branch);
-  Node* if_false = graph()->NewNode(common()->IfFalse(), continue_branch);
-  control = if_true;
-
-  Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), function, Builtins::kArrayMapLoopEagerDeoptContinuation,
-      node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
-      outer_frame_state, ContinuationFrameStateMode::EAGER);
-
-  effect =
-      graph()->NewNode(common()->Checkpoint(), frame_state, effect, control);
-
-  // Make sure the map hasn't changed during the iteration
-  effect =
-      graph()->NewNode(simplified()->CheckMaps(CheckMapsFlag::kNone,
-                                               receiver_maps, p.feedback()),
-                       receiver, effect, control);
-
-  Node* element =
-      SafeLoadElement(kind, receiver, control, &effect, &k, p.feedback());
-
-  Node* next_k =
-      graph()->NewNode(simplified()->NumberAdd(), k, jsgraph()->OneConstant());
+  Node* next_k =
+      graph()->NewNode(simplified()->NumberAdd(), k, jsgraph()->OneConstant());
 
   Node* hole_true = nullptr;
   Node* hole_false = nullptr;
@@ -1619,7 +1579,7 @@ Reduction JSCallReducer::ReduceArrayMap(Handle<JSFunction> function,
   // This frame state is dealt with by hand in
   // ArrayMapLoopLazyDeoptContinuation.
   frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-      jsgraph(), function, Builtins::kArrayMapLoopLazyDeoptContinuation,
+      jsgraph(), shared, Builtins::kArrayMapLoopLazyDeoptContinuation,
       node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
       outer_frame_state, ContinuationFrameStateMode::LAZY);
 
@@ -1671,8 +1631,8 @@ Reduction JSCallReducer::ReduceArrayMap(Handle<JSFunction> function,
   return Replace(a);
 }
 
-Reduction JSCallReducer::ReduceArrayFilter(Handle<JSFunction> function,
-                                           Node* node) {
+Reduction JSCallReducer::ReduceArrayFilter(Node* node,
+                                           Handle<SharedFunctionInfo> shared) {
   if (!FLAG_turbo_inline_array_builtins) return NoChange();
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
@@ -1698,7 +1658,7 @@ Reduction JSCallReducer::ReduceArrayFilter(Handle<JSFunction> function,
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
 
   // And ensure that any changes to the Array species constructor cause deopt.
-  if (!isolate()->IsArraySpeciesLookupChainIntact()) return NoChange();
+  if (!isolate()->IsSpeciesLookupChainIntact()) return NoChange();
 
   const ElementsKind kind = receiver_maps[0]->elements_kind();
   // The output array is packed (filter doesn't visit holes).
@@ -1766,7 +1726,7 @@ Reduction JSCallReducer::ReduceArrayFilter(Handle<JSFunction> function,
     const int stack_parameters = static_cast<int>(checkpoint_params.size());
 
     Node* check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), function, Builtins::kArrayFilterLoopLazyDeoptContinuation,
+        jsgraph(), shared, Builtins::kArrayFilterLoopLazyDeoptContinuation,
         node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
         outer_frame_state, ContinuationFrameStateMode::LAZY);
     WireInCallbackIsCallableCheck(fncallback, context, check_frame_state,
@@ -1794,7 +1754,7 @@ Reduction JSCallReducer::ReduceArrayFilter(Handle<JSFunction> function,
     const int stack_parameters = static_cast<int>(checkpoint_params.size());
 
     Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), function, Builtins::kArrayFilterLoopEagerDeoptContinuation,
+        jsgraph(), shared, Builtins::kArrayFilterLoopEagerDeoptContinuation,
         node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
         outer_frame_state, ContinuationFrameStateMode::EAGER);
 
@@ -1851,7 +1811,7 @@ Reduction JSCallReducer::ReduceArrayFilter(Handle<JSFunction> function,
     const int stack_parameters = static_cast<int>(checkpoint_params.size());
 
     Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), function, Builtins::kArrayFilterLoopLazyDeoptContinuation,
+        jsgraph(), shared, Builtins::kArrayFilterLoopLazyDeoptContinuation,
         node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
         outer_frame_state, ContinuationFrameStateMode::LAZY);
 
@@ -1880,7 +1840,7 @@ Reduction JSCallReducer::ReduceArrayFilter(Handle<JSFunction> function,
                                           callback_value});
     const int stack_parameters = static_cast<int>(checkpoint_params.size());
     Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), function, Builtins::kArrayFilterLoopLazyDeoptContinuation,
+        jsgraph(), shared, Builtins::kArrayFilterLoopLazyDeoptContinuation,
         node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
         outer_frame_state, ContinuationFrameStateMode::EAGER);
 
@@ -1926,9 +1886,8 @@ Reduction JSCallReducer::ReduceArrayFilter(Handle<JSFunction> function,
   return Replace(a);
 }
 
-Reduction JSCallReducer::ReduceArrayFind(ArrayFindVariant variant,
-                                         Handle<JSFunction> function,
-                                         Node* node) {
+Reduction JSCallReducer::ReduceArrayFind(Node* node, ArrayFindVariant variant,
+                                         Handle<SharedFunctionInfo> shared) {
   if (!FLAG_turbo_inline_array_builtins) return NoChange();
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
@@ -2014,8 +1973,8 @@ Reduction JSCallReducer::ReduceArrayFind(ArrayFindVariant variant,
   Node* check_throw = nullptr;
   {
     Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), function, lazy_continuation_builtin, node->InputAt(0),
-        context, &checkpoint_params[0], stack_parameters, outer_frame_state,
+        jsgraph(), shared, lazy_continuation_builtin, node->InputAt(0), context,
+        &checkpoint_params[0], stack_parameters, outer_frame_state,
         ContinuationFrameStateMode::LAZY);
     WireInCallbackIsCallableCheck(fncallback, context, frame_state, effect,
                                   &control, &check_fail, &check_throw);
@@ -2040,7 +1999,7 @@ Reduction JSCallReducer::ReduceArrayFind(ArrayFindVariant variant,
   // Check the map hasn't changed during the iteration.
   {
     Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), function, eager_continuation_builtin, node->InputAt(0),
+        jsgraph(), shared, eager_continuation_builtin, node->InputAt(0),
         context, &checkpoint_params[0], stack_parameters, outer_frame_state,
         ContinuationFrameStateMode::EAGER);
 
@@ -2083,7 +2042,7 @@ Reduction JSCallReducer::ReduceArrayFind(ArrayFindVariant variant,
         static_cast<int>(call_checkpoint_params.size());
 
     Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), function, after_callback_lazy_continuation_builtin,
+        jsgraph(), shared, after_callback_lazy_continuation_builtin,
         node->InputAt(0), context, &call_checkpoint_params[0],
         call_stack_parameters, outer_frame_state,
         ContinuationFrameStateMode::LAZY);
@@ -2158,10 +2117,11 @@ Node* JSCallReducer::DoFilterPostCallbackWork(ElementsKind kind, Node** control,
         simplified()->LoadField(AccessBuilder::ForJSObjectElements()), a, etrue,
         if_true);
 
-    // We know that {to} is in Unsigned31 range here, being smaller than
-    // {original_length} at all times.
+    DCHECK(TypeCache::Get().kFixedDoubleArrayLengthType->Is(
+        TypeCache::Get().kFixedArrayLengthType));
     Node* checked_to = etrue = graph()->NewNode(
-        common()->TypeGuard(Type::Unsigned31()), to, etrue, if_true);
+        common()->TypeGuard(TypeCache::Get().kFixedArrayLengthType), to, etrue,
+        if_true);
     Node* elements_length = etrue = graph()->NewNode(
         simplified()->LoadField(AccessBuilder::ForFixedArrayLength()), elements,
         etrue, if_true);
@@ -2264,8 +2224,8 @@ Node* JSCallReducer::SafeLoadElement(ElementsKind kind, Node* receiver,
   return element;
 }
 
-Reduction JSCallReducer::ReduceArrayEvery(Handle<JSFunction> function,
-                                          Node* node) {
+Reduction JSCallReducer::ReduceArrayEvery(Node* node,
+                                          Handle<SharedFunctionInfo> shared) {
   if (!FLAG_turbo_inline_array_builtins) return NoChange();
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
@@ -2291,7 +2251,7 @@ Reduction JSCallReducer::ReduceArrayEvery(Handle<JSFunction> function,
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
 
   // And ensure that any changes to the Array species constructor cause deopt.
-  if (!isolate()->IsArraySpeciesLookupChainIntact()) return NoChange();
+  if (!isolate()->IsSpeciesLookupChainIntact()) return NoChange();
 
   const ElementsKind kind = receiver_maps[0]->elements_kind();
 
@@ -2336,7 +2296,7 @@ Reduction JSCallReducer::ReduceArrayEvery(Handle<JSFunction> function,
     const int stack_parameters = static_cast<int>(checkpoint_params.size());
 
     Node* check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), function, Builtins::kArrayEveryLoopLazyDeoptContinuation,
+        jsgraph(), shared, Builtins::kArrayEveryLoopLazyDeoptContinuation,
         node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
         outer_frame_state, ContinuationFrameStateMode::LAZY);
     WireInCallbackIsCallableCheck(fncallback, context, check_frame_state,
@@ -2362,7 +2322,7 @@ Reduction JSCallReducer::ReduceArrayEvery(Handle<JSFunction> function,
     const int stack_parameters = static_cast<int>(checkpoint_params.size());
 
     Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), function, Builtins::kArrayEveryLoopEagerDeoptContinuation,
+        jsgraph(), shared, Builtins::kArrayEveryLoopEagerDeoptContinuation,
         node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
         outer_frame_state, ContinuationFrameStateMode::EAGER);
 
@@ -2418,7 +2378,7 @@ Reduction JSCallReducer::ReduceArrayEvery(Handle<JSFunction> function,
     const int stack_parameters = static_cast<int>(checkpoint_params.size());
 
     Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), function, Builtins::kArrayEveryLoopLazyDeoptContinuation,
+        jsgraph(), shared, Builtins::kArrayEveryLoopLazyDeoptContinuation,
         node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
         outer_frame_state, ContinuationFrameStateMode::LAZY);
 
@@ -2484,8 +2444,111 @@ Reduction JSCallReducer::ReduceArrayEvery(Handle<JSFunction> function,
   return Replace(return_value);
 }
 
-Reduction JSCallReducer::ReduceArraySome(Handle<JSFunction> function,
-                                         Node* node) {
+namespace {
+
+// Returns the correct Callable for Array's indexOf based on the receiver's
+// |elements_kind| and |isolate|. Assumes that |elements_kind| is a fast one.
+Callable GetCallableForArrayIndexOf(ElementsKind elements_kind,
+                                    Isolate* isolate) {
+  switch (elements_kind) {
+    case PACKED_SMI_ELEMENTS:
+    case HOLEY_SMI_ELEMENTS:
+    case PACKED_ELEMENTS:
+    case HOLEY_ELEMENTS:
+      return Builtins::CallableFor(isolate, Builtins::kArrayIndexOfSmiOrObject);
+    case PACKED_DOUBLE_ELEMENTS:
+      return Builtins::CallableFor(isolate,
+                                   Builtins::kArrayIndexOfPackedDoubles);
+    default:
+      DCHECK_EQ(HOLEY_DOUBLE_ELEMENTS, elements_kind);
+      return Builtins::CallableFor(isolate,
+                                   Builtins::kArrayIndexOfHoleyDoubles);
+  }
+}
+
+// Returns the correct Callable for Array's includes based on the receiver's
+// |elements_kind| and |isolate|. Assumes that |elements_kind| is a fast one.
+Callable GetCallableForArrayIncludes(ElementsKind elements_kind,
+                                     Isolate* isolate) {
+  switch (elements_kind) {
+    case PACKED_SMI_ELEMENTS:
+    case HOLEY_SMI_ELEMENTS:
+    case PACKED_ELEMENTS:
+    case HOLEY_ELEMENTS:
+      return Builtins::CallableFor(isolate,
+                                   Builtins::kArrayIncludesSmiOrObject);
+    case PACKED_DOUBLE_ELEMENTS:
+      return Builtins::CallableFor(isolate,
+                                   Builtins::kArrayIncludesPackedDoubles);
+    default:
+      DCHECK_EQ(HOLEY_DOUBLE_ELEMENTS, elements_kind);
+      return Builtins::CallableFor(isolate,
+                                   Builtins::kArrayIncludesHoleyDoubles);
+  }
+}
+
+}  // namespace
+
+// For search_variant == kIndexOf:
+// ES6 Array.prototype.indexOf(searchElement[, fromIndex])
+// #sec-array.prototype.indexof
+// For search_variant == kIncludes:
+// ES7 Array.prototype.inludes(searchElement[, fromIndex])
+// #sec-array.prototype.includes
+Reduction JSCallReducer::ReduceArrayIndexOfIncludes(
+    SearchVariant search_variant, Node* node) {
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+
+  Handle<Map> receiver_map;
+  if (!NodeProperties::GetMapWitness(node).ToHandle(&receiver_map))
+    return NoChange();
+
+  if (!IsFastElementsKind(receiver_map->elements_kind())) return NoChange();
+
+  Callable const callable =
+      search_variant == SearchVariant::kIndexOf
+          ? GetCallableForArrayIndexOf(receiver_map->elements_kind(), isolate())
+          : GetCallableForArrayIncludes(receiver_map->elements_kind(),
+                                        isolate());
+  CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
+      isolate(), graph()->zone(), callable.descriptor(), 0,
+      CallDescriptor::kNoFlags, Operator::kEliminatable);
+  // The stub expects the following arguments: the receiver array, its elements,
+  // the search_element, the array length, and the index to start searching
+  // from.
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* elements = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForJSObjectElements()), receiver,
+      effect, control);
+  Node* search_element = (node->op()->ValueInputCount() >= 3)
+                             ? NodeProperties::GetValueInput(node, 2)
+                             : jsgraph()->UndefinedConstant();
+  Node* length = effect = graph()->NewNode(
+      simplified()->LoadField(
+          AccessBuilder::ForJSArrayLength(receiver_map->elements_kind())),
+      receiver, effect, control);
+  Node* new_from_index = jsgraph()->ZeroConstant();
+  if (node->op()->ValueInputCount() >= 4) {
+    Node* from_index = NodeProperties::GetValueInput(node, 3);
+    new_from_index = effect = graph()->NewNode(
+        simplified()->CheckSmi(p.feedback()), from_index, effect, control);
+  }
+
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* replacement_node = effect = graph()->NewNode(
+      common()->Call(desc), jsgraph()->HeapConstant(callable.code()), elements,
+      search_element, length, new_from_index, context, effect);
+  ReplaceWithValue(node, replacement_node, effect);
+  return Replace(replacement_node);
+}
+
+Reduction JSCallReducer::ReduceArraySome(Node* node,
+                                         Handle<SharedFunctionInfo> shared) {
   if (!FLAG_turbo_inline_array_builtins) return NoChange();
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
@@ -2511,17 +2574,12 @@ Reduction JSCallReducer::ReduceArraySome(Handle<JSFunction> function,
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
 
   // And ensure that any changes to the Array species constructor cause deopt.
-  if (!isolate()->IsArraySpeciesLookupChainIntact()) return NoChange();
+  if (!isolate()->IsSpeciesLookupChainIntact()) return NoChange();
 
   if (receiver_maps.size() == 0) return NoChange();
 
   const ElementsKind kind = receiver_maps[0]->elements_kind();
 
-  // TODO(pwong): Handle holey double elements kinds.
-  if (IsDoubleElementsKind(kind) && IsHoleyElementsKind(kind)) {
-    return NoChange();
-  }
-
   for (Handle<Map> receiver_map : receiver_maps) {
     if (!CanInlineArrayIteratingBuiltin(receiver_map)) return NoChange();
     // We can handle different maps, as long as their elements kind are the
@@ -2563,7 +2621,7 @@ Reduction JSCallReducer::ReduceArraySome(Handle<JSFunction> function,
     const int stack_parameters = static_cast<int>(checkpoint_params.size());
 
     Node* check_frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), function, Builtins::kArraySomeLoopLazyDeoptContinuation,
+        jsgraph(), shared, Builtins::kArraySomeLoopLazyDeoptContinuation,
         node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
         outer_frame_state, ContinuationFrameStateMode::LAZY);
     WireInCallbackIsCallableCheck(fncallback, context, check_frame_state,
@@ -2594,7 +2652,7 @@ Reduction JSCallReducer::ReduceArraySome(Handle<JSFunction> function,
     const int stack_parameters = static_cast<int>(checkpoint_params.size());
 
     Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), function, Builtins::kArraySomeLoopEagerDeoptContinuation,
+        jsgraph(), shared, Builtins::kArraySomeLoopEagerDeoptContinuation,
         node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
         outer_frame_state, ContinuationFrameStateMode::EAGER);
 
@@ -2621,8 +2679,13 @@ Reduction JSCallReducer::ReduceArraySome(Handle<JSFunction> function,
   if (IsHoleyElementsKind(kind)) {
     // Holey elements kind require a hole check and skipping of the element in
     // the case of a hole.
-    Node* check = graph()->NewNode(simplified()->ReferenceEqual(), element,
-                                   jsgraph()->TheHoleConstant());
+    Node* check;
+    if (IsDoubleElementsKind(kind)) {
+      check = graph()->NewNode(simplified()->NumberIsFloat64Hole(), element);
+    } else {
+      check = graph()->NewNode(simplified()->ReferenceEqual(), element,
+                               jsgraph()->TheHoleConstant());
+    }
     Node* branch =
         graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
     hole_true = graph()->NewNode(common()->IfTrue(), branch);
@@ -2645,7 +2708,7 @@ Reduction JSCallReducer::ReduceArraySome(Handle<JSFunction> function,
     const int stack_parameters = static_cast<int>(checkpoint_params.size());
 
     Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
-        jsgraph(), function, Builtins::kArraySomeLoopLazyDeoptContinuation,
+        jsgraph(), shared, Builtins::kArraySomeLoopLazyDeoptContinuation,
         node->InputAt(0), context, &checkpoint_params[0], stack_parameters,
         outer_frame_state, ContinuationFrameStateMode::LAZY);
 
@@ -2713,19 +2776,20 @@ Reduction JSCallReducer::ReduceArraySome(Handle<JSFunction> function,
   return Replace(return_value);
 }
 
-Reduction JSCallReducer::ReduceCallApiFunction(Node* node,
-                                               Handle<JSFunction> function) {
+Reduction JSCallReducer::ReduceCallApiFunction(
+    Node* node, Handle<SharedFunctionInfo> shared) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
   int const argc = static_cast<int>(p.arity()) - 2;
+  Node* target = NodeProperties::GetValueInput(node, 0);
   Node* receiver = (p.convert_mode() == ConvertReceiverMode::kNullOrUndefined)
                        ? jsgraph()->HeapConstant(global_proxy())
                        : NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
 
   Handle<FunctionTemplateInfo> function_template_info(
-      FunctionTemplateInfo::cast(function->shared()->function_data()));
-  Handle<Context> context(function->context());
+      FunctionTemplateInfo::cast(shared->function_data()));
 
   // CallApiCallbackStub expects the target in a register, so we count it out,
   // and counts the receiver as an implicit argument, so we count the receiver
@@ -2774,6 +2838,11 @@ Reduction JSCallReducer::ReduceCallApiFunction(Node* node,
     }
   }
 
+  // Load the {target}s context.
+  Node* context = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForJSFunctionContext()), target,
+      effect, control);
+
   // CallApiCallbackStub's register arguments: code, target, call data, holder,
   // function address.
   // TODO(turbofan): Consider introducing a JSCallApiCallback operator for
@@ -2784,7 +2853,7 @@ Reduction JSCallReducer::ReduceCallApiFunction(Node* node,
   Handle<Object> data(call_handler_info->data(), isolate());
   CallApiCallbackStub stub(isolate(), argc);
   CallInterfaceDescriptor cid = stub.GetCallInterfaceDescriptor();
-  CallDescriptor* call_descriptor = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), cid,
       cid.GetStackParameterCount() + argc + 1 /* implicit receiver */,
       CallDescriptor::kNeedsFrameState, Operator::kNoProperties,
@@ -2797,14 +2866,14 @@ Reduction JSCallReducer::ReduceCallApiFunction(Node* node,
       &api_function, ExternalReference::DIRECT_API_CALL, isolate());
   node->InsertInput(graph()->zone(), 0,
                     jsgraph()->HeapConstant(stub.GetCode()));
-  node->ReplaceInput(1, jsgraph()->Constant(context));
+  node->ReplaceInput(1, context);
   node->InsertInput(graph()->zone(), 2, jsgraph()->Constant(data));
   node->InsertInput(graph()->zone(), 3, holder);
   node->InsertInput(graph()->zone(), 4,
                     jsgraph()->ExternalConstant(function_reference));
   node->ReplaceInput(5, receiver);
-  // Remove context input.
-  node->RemoveInput(6 + argc);
+  node->RemoveInput(6 + argc);           // Remove context input.
+  node->ReplaceInput(7 + argc, effect);  // Update effect input.
   NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
   return Changed(node);
 }
@@ -2838,7 +2907,7 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
   // ensure that it's safe to avoid the actual iteration.
   if ((node->opcode() == IrOpcode::kJSCallWithSpread ||
        node->opcode() == IrOpcode::kJSConstructWithSpread) &&
-      !isolate()->initial_array_iterator_prototype_map()->is_stable()) {
+      !isolate()->IsArrayIteratorLookupChainIntact()) {
     return NoChange();
   }
 
@@ -2910,7 +2979,7 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
   // some other function (and same for the {arguments_list}).
   CreateArgumentsType const type = CreateArgumentsTypeOf(arguments_list->op());
   Node* frame_state = NodeProperties::GetFrameStateInput(arguments_list);
-  FrameStateInfo state_info = OpParameter<FrameStateInfo>(frame_state);
+  FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
   int start_index = 0;
   // Determine the formal parameter count;
   Handle<SharedFunctionInfo> shared;
@@ -2929,24 +2998,14 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
     }
   } else if (type == CreateArgumentsType::kRestParameter) {
     start_index = formal_parameter_count;
-
-    // For spread calls/constructs with rest parameters we need to ensure that
-    // the array iterator protector is intact, which guards that the rest
-    // parameter iteration is not observable.
-    if (node->opcode() == IrOpcode::kJSCallWithSpread ||
-        node->opcode() == IrOpcode::kJSConstructWithSpread) {
-      if (!isolate()->IsArrayIteratorLookupChainIntact()) return NoChange();
-      dependencies()->AssumePropertyCell(factory()->array_iterator_protector());
-    }
   }
 
   // For call/construct with spread, we need to also install a code
-  // dependency on the initial %ArrayIteratorPrototype% map here to
-  // ensure that no one messes with the next method.
+  // dependency on the array iterator lookup protector cell to ensure
+  // that no one messed with the %ArrayIteratorPrototype%.next method.
   if (node->opcode() == IrOpcode::kJSCallWithSpread ||
       node->opcode() == IrOpcode::kJSConstructWithSpread) {
-    dependencies()->AssumeMapStable(
-        isolate()->initial_array_iterator_prototype_map());
+    dependencies()->AssumePropertyCell(factory()->array_iterator_protector());
   }
 
   // Remove the {arguments_list} input from the {node}.
@@ -2966,7 +3025,7 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
   // Get to the actual frame state from which to extract the arguments;
   // we can only optimize this in case the {node} was already inlined into
   // some other function (and same for the {arg_array}).
-  FrameStateInfo outer_info = OpParameter<FrameStateInfo>(outer_state);
+  FrameStateInfo outer_info = FrameStateInfoOf(outer_state->op());
   if (outer_info.type() == FrameStateType::kArgumentsAdaptor) {
     // Need to take the parameters from the arguments adaptor.
     frame_state = outer_state;
@@ -3082,93 +3141,11 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
   if (m.HasValue()) {
     if (m.Value()->IsJSFunction()) {
       Handle<JSFunction> function = Handle<JSFunction>::cast(m.Value());
-      Handle<SharedFunctionInfo> shared(function->shared(), isolate());
-
-      // Raise a TypeError if the {target} is a "classConstructor".
-      if (IsClassConstructor(shared->kind())) {
-        NodeProperties::ReplaceValueInputs(node, target);
-        NodeProperties::ChangeOp(
-            node, javascript()->CallRuntime(
-                      Runtime::kThrowConstructorNonCallableError, 1));
-        return Changed(node);
-      }
 
       // Don't inline cross native context.
       if (function->native_context() != *native_context()) return NoChange();
 
-      // Check for known builtin functions.
-      switch (shared->code()->builtin_index()) {
-        case Builtins::kArrayConstructor:
-          return ReduceArrayConstructor(node);
-        case Builtins::kBooleanConstructor:
-          return ReduceBooleanConstructor(node);
-        case Builtins::kFunctionPrototypeApply:
-          return ReduceFunctionPrototypeApply(node);
-        case Builtins::kFastFunctionPrototypeBind:
-          return ReduceFunctionPrototypeBind(node);
-        case Builtins::kFunctionPrototypeCall:
-          return ReduceFunctionPrototypeCall(node);
-        case Builtins::kFunctionPrototypeHasInstance:
-          return ReduceFunctionPrototypeHasInstance(node);
-        case Builtins::kObjectConstructor:
-          return ReduceObjectConstructor(node);
-        case Builtins::kObjectGetPrototypeOf:
-          return ReduceObjectGetPrototypeOf(node);
-        case Builtins::kObjectIs:
-          return ReduceObjectIs(node);
-        case Builtins::kObjectPrototypeGetProto:
-          return ReduceObjectPrototypeGetProto(node);
-        case Builtins::kObjectPrototypeHasOwnProperty:
-          return ReduceObjectPrototypeHasOwnProperty(node);
-        case Builtins::kObjectPrototypeIsPrototypeOf:
-          return ReduceObjectPrototypeIsPrototypeOf(node);
-        case Builtins::kReflectApply:
-          return ReduceReflectApply(node);
-        case Builtins::kReflectConstruct:
-          return ReduceReflectConstruct(node);
-        case Builtins::kReflectGet:
-          return ReduceReflectGet(node);
-        case Builtins::kReflectGetPrototypeOf:
-          return ReduceReflectGetPrototypeOf(node);
-        case Builtins::kReflectHas:
-          return ReduceReflectHas(node);
-        case Builtins::kArrayForEach:
-          return ReduceArrayForEach(function, node);
-        case Builtins::kArrayMap:
-          return ReduceArrayMap(function, node);
-        case Builtins::kArrayFilter:
-          return ReduceArrayFilter(function, node);
-        case Builtins::kArrayReduce:
-          return ReduceArrayReduce(function, node);
-        case Builtins::kArrayReduceRight:
-          return ReduceArrayReduceRight(function, node);
-        case Builtins::kArrayPrototypeFind:
-          return ReduceArrayFind(ArrayFindVariant::kFind, function, node);
-        case Builtins::kArrayPrototypeFindIndex:
-          return ReduceArrayFind(ArrayFindVariant::kFindIndex, function, node);
-        case Builtins::kArrayEvery:
-          return ReduceArrayEvery(function, node);
-        case Builtins::kArrayPrototypePush:
-          return ReduceArrayPrototypePush(node);
-        case Builtins::kArrayPrototypePop:
-          return ReduceArrayPrototypePop(node);
-        case Builtins::kArrayPrototypeShift:
-          return ReduceArrayPrototypeShift(node);
-        case Builtins::kReturnReceiver:
-          return ReduceReturnReceiver(node);
-        case Builtins::kStringPrototypeIndexOf:
-          return ReduceStringPrototypeIndexOf(function, node);
-        case Builtins::kStringPrototypeCharAt:
-          return ReduceStringPrototypeCharAt(node);
-        case Builtins::kStringPrototypeCharCodeAt:
-          return ReduceStringPrototypeCharCodeAt(node);
-        default:
-          break;
-      }
-
-      if (!FLAG_runtime_stats && shared->IsApiFunction()) {
-        return ReduceCallApiFunction(node, function);
-      }
+      return ReduceJSCall(node, handle(function->shared(), isolate()));
     } else if (m.Value()->IsJSBoundFunction()) {
       Handle<JSBoundFunction> function =
           Handle<JSBoundFunction>::cast(m.Value());
@@ -3206,6 +3183,15 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
     return NoChange();
   }
 
+  // If {target} is the result of a JSCreateClosure operation, we can
+  // just immediately try to inline based on the SharedFunctionInfo,
+  // since TurboFan generally doesn't inline cross-context, and hence
+  // the {target} must have the same native context as the call site.
+  if (target->opcode() == IrOpcode::kJSCreateClosure) {
+    CreateClosureParameters const& p = CreateClosureParametersOf(target->op());
+    return ReduceJSCall(node, p.shared_info());
+  }
+
   // If {target} is the result of a JSCreateBoundFunction operation,
   // we can just fold the construction and call the bound target
   // function directly instead.
@@ -3240,9 +3226,9 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
     return reduction.Changed() ? reduction : Changed(node);
   }
 
-  // Extract feedback from the {node} using the CallICNexus.
+  // Extract feedback from the {node} using the FeedbackNexus.
   if (!p.feedback().IsValid()) return NoChange();
-  CallICNexus nexus(p.feedback().vector(), p.feedback().slot());
+  FeedbackNexus nexus(p.feedback().vector(), p.feedback().slot());
   if (nexus.IsUninitialized()) {
     if (flags() & kBailoutOnUninitialized) {
       // Introduce a SOFT deopt if the call {node} wasn't executed so far.
@@ -3281,17 +3267,259 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
   return NoChange();
 }
 
-Reduction JSCallReducer::ReduceJSCallWithArrayLike(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCallWithArrayLike, node->opcode());
-  CallFrequency frequency = CallFrequencyOf(node->op());
-  VectorSlotPair feedback;
-  return ReduceCallOrConstructWithArrayLikeOrSpread(node, 2, frequency,
-                                                    feedback);
-}
+Reduction JSCallReducer::ReduceJSCall(Node* node,
+                                      Handle<SharedFunctionInfo> shared) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* target = NodeProperties::GetValueInput(node, 0);
 
-Reduction JSCallReducer::ReduceJSCallWithSpread(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCallWithSpread, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
+  // Do not reduce calls to functions with break points.
+  if (shared->HasBreakInfo()) return NoChange();
+
+  // Raise a TypeError if the {target} is a "classConstructor".
+  if (IsClassConstructor(shared->kind())) {
+    NodeProperties::ReplaceValueInputs(node, target);
+    NodeProperties::ChangeOp(
+        node, javascript()->CallRuntime(
+                  Runtime::kThrowConstructorNonCallableError, 1));
+    return Changed(node);
+  }
+
+  // Check for known builtin functions.
+
+  int builtin_id =
+      shared->HasBuiltinId() ? shared->builtin_id() : Builtins::kNoBuiltinId;
+  switch (builtin_id) {
+    case Builtins::kArrayConstructor:
+      return ReduceArrayConstructor(node);
+    case Builtins::kBooleanConstructor:
+      return ReduceBooleanConstructor(node);
+    case Builtins::kFunctionPrototypeApply:
+      return ReduceFunctionPrototypeApply(node);
+    case Builtins::kFastFunctionPrototypeBind:
+      return ReduceFunctionPrototypeBind(node);
+    case Builtins::kFunctionPrototypeCall:
+      return ReduceFunctionPrototypeCall(node);
+    case Builtins::kFunctionPrototypeHasInstance:
+      return ReduceFunctionPrototypeHasInstance(node);
+    case Builtins::kObjectConstructor:
+      return ReduceObjectConstructor(node);
+    case Builtins::kObjectGetPrototypeOf:
+      return ReduceObjectGetPrototypeOf(node);
+    case Builtins::kObjectIs:
+      return ReduceObjectIs(node);
+    case Builtins::kObjectPrototypeGetProto:
+      return ReduceObjectPrototypeGetProto(node);
+    case Builtins::kObjectPrototypeHasOwnProperty:
+      return ReduceObjectPrototypeHasOwnProperty(node);
+    case Builtins::kObjectPrototypeIsPrototypeOf:
+      return ReduceObjectPrototypeIsPrototypeOf(node);
+    case Builtins::kReflectApply:
+      return ReduceReflectApply(node);
+    case Builtins::kReflectConstruct:
+      return ReduceReflectConstruct(node);
+    case Builtins::kReflectGet:
+      return ReduceReflectGet(node);
+    case Builtins::kReflectGetPrototypeOf:
+      return ReduceReflectGetPrototypeOf(node);
+    case Builtins::kReflectHas:
+      return ReduceReflectHas(node);
+    case Builtins::kArrayForEach:
+      return ReduceArrayForEach(node, shared);
+    case Builtins::kArrayMap:
+      return ReduceArrayMap(node, shared);
+    case Builtins::kArrayFilter:
+      return ReduceArrayFilter(node, shared);
+    case Builtins::kArrayReduce:
+      return ReduceArrayReduce(node, ArrayReduceDirection::kLeft, shared);
+    case Builtins::kArrayReduceRight:
+      return ReduceArrayReduce(node, ArrayReduceDirection::kRight, shared);
+    case Builtins::kArrayPrototypeFind:
+      return ReduceArrayFind(node, ArrayFindVariant::kFind, shared);
+    case Builtins::kArrayPrototypeFindIndex:
+      return ReduceArrayFind(node, ArrayFindVariant::kFindIndex, shared);
+    case Builtins::kArrayEvery:
+      return ReduceArrayEvery(node, shared);
+    case Builtins::kArrayIndexOf:
+      return ReduceArrayIndexOfIncludes(SearchVariant::kIndexOf, node);
+    case Builtins::kArrayIncludes:
+      return ReduceArrayIndexOfIncludes(SearchVariant::kIncludes, node);
+    case Builtins::kArraySome:
+      return ReduceArraySome(node, shared);
+    case Builtins::kArrayPrototypePush:
+      return ReduceArrayPrototypePush(node);
+    case Builtins::kArrayPrototypePop:
+      return ReduceArrayPrototypePop(node);
+    case Builtins::kArrayPrototypeShift:
+      return ReduceArrayPrototypeShift(node);
+    case Builtins::kArrayPrototypeEntries:
+      return ReduceArrayIterator(node, IterationKind::kEntries);
+    case Builtins::kArrayPrototypeKeys:
+      return ReduceArrayIterator(node, IterationKind::kKeys);
+    case Builtins::kArrayPrototypeValues:
+      return ReduceArrayIterator(node, IterationKind::kValues);
+    case Builtins::kArrayIteratorPrototypeNext:
+      return ReduceArrayIteratorPrototypeNext(node);
+    case Builtins::kMathAbs:
+      return ReduceMathUnary(node, simplified()->NumberAbs());
+    case Builtins::kMathAcos:
+      return ReduceMathUnary(node, simplified()->NumberAcos());
+    case Builtins::kMathAcosh:
+      return ReduceMathUnary(node, simplified()->NumberAcosh());
+    case Builtins::kMathAsin:
+      return ReduceMathUnary(node, simplified()->NumberAsin());
+    case Builtins::kMathAsinh:
+      return ReduceMathUnary(node, simplified()->NumberAsinh());
+    case Builtins::kMathAtan:
+      return ReduceMathUnary(node, simplified()->NumberAtan());
+    case Builtins::kMathAtanh:
+      return ReduceMathUnary(node, simplified()->NumberAtanh());
+    case Builtins::kMathCbrt:
+      return ReduceMathUnary(node, simplified()->NumberCbrt());
+    case Builtins::kMathCeil:
+      return ReduceMathUnary(node, simplified()->NumberCeil());
+    case Builtins::kMathCos:
+      return ReduceMathUnary(node, simplified()->NumberCos());
+    case Builtins::kMathCosh:
+      return ReduceMathUnary(node, simplified()->NumberCosh());
+    case Builtins::kMathExp:
+      return ReduceMathUnary(node, simplified()->NumberExp());
+    case Builtins::kMathExpm1:
+      return ReduceMathUnary(node, simplified()->NumberExpm1());
+    case Builtins::kMathFloor:
+      return ReduceMathUnary(node, simplified()->NumberFloor());
+    case Builtins::kMathFround:
+      return ReduceMathUnary(node, simplified()->NumberFround());
+    case Builtins::kMathLog:
+      return ReduceMathUnary(node, simplified()->NumberLog());
+    case Builtins::kMathLog1p:
+      return ReduceMathUnary(node, simplified()->NumberLog1p());
+    case Builtins::kMathLog10:
+      return ReduceMathUnary(node, simplified()->NumberLog10());
+    case Builtins::kMathLog2:
+      return ReduceMathUnary(node, simplified()->NumberLog2());
+    case Builtins::kMathRound:
+      return ReduceMathUnary(node, simplified()->NumberRound());
+    case Builtins::kMathSign:
+      return ReduceMathUnary(node, simplified()->NumberSign());
+    case Builtins::kMathSin:
+      return ReduceMathUnary(node, simplified()->NumberSin());
+    case Builtins::kMathSinh:
+      return ReduceMathUnary(node, simplified()->NumberSinh());
+    case Builtins::kMathSqrt:
+      return ReduceMathUnary(node, simplified()->NumberSqrt());
+    case Builtins::kMathTan:
+      return ReduceMathUnary(node, simplified()->NumberTan());
+    case Builtins::kMathTanh:
+      return ReduceMathUnary(node, simplified()->NumberTanh());
+    case Builtins::kMathTrunc:
+      return ReduceMathUnary(node, simplified()->NumberTrunc());
+    case Builtins::kMathAtan2:
+      return ReduceMathBinary(node, simplified()->NumberAtan2());
+    case Builtins::kMathPow:
+      return ReduceMathBinary(node, simplified()->NumberPow());
+    case Builtins::kMathClz32:
+      return ReduceMathClz32(node);
+    case Builtins::kMathImul:
+      return ReduceMathImul(node);
+    case Builtins::kMathMax:
+      return ReduceMathMinMax(node, simplified()->NumberMax(),
+                              jsgraph()->Constant(-V8_INFINITY));
+    case Builtins::kMathMin:
+      return ReduceMathMinMax(node, simplified()->NumberMin(),
+                              jsgraph()->Constant(V8_INFINITY));
+    case Builtins::kNumberIsFinite:
+      return ReduceNumberIsFinite(node);
+    case Builtins::kNumberIsInteger:
+      return ReduceNumberIsInteger(node);
+    case Builtins::kNumberIsSafeInteger:
+      return ReduceNumberIsSafeInteger(node);
+    case Builtins::kNumberIsNaN:
+      return ReduceNumberIsNaN(node);
+    case Builtins::kMapPrototypeGet:
+      return ReduceMapPrototypeGet(node);
+    case Builtins::kMapPrototypeHas:
+      return ReduceMapPrototypeHas(node);
+    case Builtins::kReturnReceiver:
+      return ReduceReturnReceiver(node);
+    case Builtins::kStringPrototypeIndexOf:
+      return ReduceStringPrototypeIndexOf(node);
+    case Builtins::kStringPrototypeCharAt:
+      return ReduceStringPrototypeCharAt(node);
+    case Builtins::kStringPrototypeCharCodeAt:
+      return ReduceStringPrototypeStringAt(simplified()->StringCharCodeAt(),
+                                           node);
+    case Builtins::kStringPrototypeCodePointAt:
+      return ReduceStringPrototypeStringAt(
+          simplified()->StringCodePointAt(UnicodeEncoding::UTF32), node);
+    case Builtins::kStringPrototypeSubstring:
+      return ReduceStringPrototypeSubstring(node);
+    case Builtins::kStringPrototypeSlice:
+      return ReduceStringPrototypeSlice(node);
+    case Builtins::kStringPrototypeSubstr:
+      return ReduceStringPrototypeSubstr(node);
+#ifdef V8_INTL_SUPPORT
+    case Builtins::kStringPrototypeToLowerCaseIntl:
+      return ReduceStringPrototypeToLowerCaseIntl(node);
+    case Builtins::kStringPrototypeToUpperCaseIntl:
+      return ReduceStringPrototypeToUpperCaseIntl(node);
+#endif  // V8_INTL_SUPPORT
+    case Builtins::kStringFromCharCode:
+      return ReduceStringFromCharCode(node);
+    case Builtins::kStringFromCodePoint:
+      return ReduceStringFromCodePoint(node);
+    case Builtins::kStringPrototypeIterator:
+      return ReduceStringPrototypeIterator(node);
+    case Builtins::kStringIteratorPrototypeNext:
+      return ReduceStringIteratorPrototypeNext(node);
+    case Builtins::kStringPrototypeConcat:
+      return ReduceStringPrototypeConcat(node, shared);
+    case Builtins::kTypedArrayPrototypeEntries:
+      return ReduceArrayIterator(node, IterationKind::kEntries);
+    case Builtins::kTypedArrayPrototypeKeys:
+      return ReduceArrayIterator(node, IterationKind::kKeys);
+    case Builtins::kTypedArrayPrototypeValues:
+      return ReduceArrayIterator(node, IterationKind::kValues);
+    case Builtins::kAsyncFunctionPromiseCreate:
+      return ReduceAsyncFunctionPromiseCreate(node);
+    case Builtins::kAsyncFunctionPromiseRelease:
+      return ReduceAsyncFunctionPromiseRelease(node);
+    case Builtins::kPromiseCapabilityDefaultReject:
+      return ReducePromiseCapabilityDefaultReject(node);
+    case Builtins::kPromiseCapabilityDefaultResolve:
+      return ReducePromiseCapabilityDefaultResolve(node);
+    case Builtins::kPromiseInternalConstructor:
+      return ReducePromiseInternalConstructor(node);
+    case Builtins::kPromiseInternalReject:
+      return ReducePromiseInternalReject(node);
+    case Builtins::kPromiseInternalResolve:
+      return ReducePromiseInternalResolve(node);
+    case Builtins::kPromisePrototypeCatch:
+      return ReducePromisePrototypeCatch(node);
+    case Builtins::kPromisePrototypeFinally:
+      return ReducePromisePrototypeFinally(node);
+    case Builtins::kPromisePrototypeThen:
+      return ReducePromisePrototypeThen(node);
+    default:
+      break;
+  }
+
+  if (!FLAG_runtime_stats && shared->IsApiFunction()) {
+    return ReduceCallApiFunction(node, shared);
+  }
+  return NoChange();
+}
+
+Reduction JSCallReducer::ReduceJSCallWithArrayLike(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCallWithArrayLike, node->opcode());
+  CallFrequency frequency = CallFrequencyOf(node->op());
+  VectorSlotPair feedback;
+  return ReduceCallOrConstructWithArrayLikeOrSpread(node, 2, frequency,
+                                                    feedback);
+}
+
+Reduction JSCallReducer::ReduceJSCallWithSpread(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCallWithSpread, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
   DCHECK_LE(3u, p.arity());
   int arity = static_cast<int>(p.arity() - 1);
   CallFrequency frequency = p.frequency();
@@ -3310,9 +3538,9 @@ Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
-  // Extract feedback from the {node} using the CallICNexus.
+  // Extract feedback from the {node} using the FeedbackNexus.
   if (p.feedback().IsValid()) {
-    CallICNexus nexus(p.feedback().vector(), p.feedback().slot());
+    FeedbackNexus nexus(p.feedback().vector(), p.feedback().slot());
     if (nexus.IsUninitialized()) {
       if (flags() & kBailoutOnUninitialized) {
         // Introduce a SOFT deopt if the construct {node} wasn't executed so
@@ -3394,42 +3622,57 @@ Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
     if (m.Value()->IsJSFunction()) {
       Handle<JSFunction> function = Handle<JSFunction>::cast(m.Value());
 
+      // Do not reduce constructors with break points.
+      if (function->shared()->HasBreakInfo()) return NoChange();
+
       // Don't inline cross native context.
       if (function->native_context() != *native_context()) return NoChange();
 
-      // Check for the ArrayConstructor.
-      if (*function == function->native_context()->array_function()) {
-        // TODO(bmeurer): Deal with Array subclasses here.
-        Handle<AllocationSite> site;
-        // Turn the {node} into a {JSCreateArray} call.
-        for (int i = arity; i > 0; --i) {
-          NodeProperties::ReplaceValueInput(
-              node, NodeProperties::GetValueInput(node, i), i + 1);
-        }
-        NodeProperties::ReplaceValueInput(node, new_target, 1);
-        NodeProperties::ChangeOp(node, javascript()->CreateArray(arity, site));
-        return Changed(node);
-      }
-
-      // Check for the ObjectConstructor.
-      if (*function == function->native_context()->object_function()) {
-        // If no value is passed, we can immediately lower to a simple
-        // JSCreate and don't need to do any massaging of the {node}.
-        if (arity == 0) {
-          NodeProperties::ChangeOp(node, javascript()->Create());
+      // Check for known builtin functions.
+      int builtin_id = function->shared()->HasBuiltinId()
+                           ? function->shared()->builtin_id()
+                           : Builtins::kNoBuiltinId;
+      switch (builtin_id) {
+        case Builtins::kArrayConstructor: {
+          // TODO(bmeurer): Deal with Array subclasses here.
+          Handle<AllocationSite> site;
+          // Turn the {node} into a {JSCreateArray} call.
+          for (int i = arity; i > 0; --i) {
+            NodeProperties::ReplaceValueInput(
+                node, NodeProperties::GetValueInput(node, i), i + 1);
+          }
+          NodeProperties::ReplaceValueInput(node, new_target, 1);
+          NodeProperties::ChangeOp(node,
+                                   javascript()->CreateArray(arity, site));
           return Changed(node);
         }
-
-        // Otherwise we can only lower to JSCreate if we know that
-        // the value parameter is ignored, which is only the case if
-        // the {new_target} and {target} are definitely not identical.
-        HeapObjectMatcher mnew_target(new_target);
-        if (mnew_target.HasValue() && *mnew_target.Value() != *function) {
-          // Drop the value inputs.
-          for (int i = arity; i > 0; --i) node->RemoveInput(i);
-          NodeProperties::ChangeOp(node, javascript()->Create());
-          return Changed(node);
+        case Builtins::kObjectConstructor: {
+          // If no value is passed, we can immediately lower to a simple
+          // JSCreate and don't need to do any massaging of the {node}.
+          if (arity == 0) {
+            NodeProperties::ChangeOp(node, javascript()->Create());
+            return Changed(node);
+          }
+
+          // Otherwise we can only lower to JSCreate if we know that
+          // the value parameter is ignored, which is only the case if
+          // the {new_target} and {target} are definitely not identical.
+          HeapObjectMatcher mnew_target(new_target);
+          if (mnew_target.HasValue() && *mnew_target.Value() != *function) {
+            // Drop the value inputs.
+            for (int i = arity; i > 0; --i) node->RemoveInput(i);
+            NodeProperties::ChangeOp(node, javascript()->Create());
+            return Changed(node);
+          }
+          break;
         }
+        case Builtins::kPromiseConstructor:
+          return ReducePromiseConstructor(node);
+        case Builtins::kTypedArrayConstructor:
+          return ReduceTypedArrayConstructor(
+              node, handle(function->shared(), isolate()));
+        default:
+          break;
       }
     } else if (m.Value()->IsJSBoundFunction()) {
       Handle<JSBoundFunction> function =
@@ -3516,10 +3759,8 @@ Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
   return NoChange();
 }
 
-// ES6 String.prototype.indexOf(searchString [, position])
-// #sec-string.prototype.indexof
-Reduction JSCallReducer::ReduceStringPrototypeIndexOf(
-    Handle<JSFunction> function, Node* node) {
+// ES #sec-string.prototype.indexof
+Reduction JSCallReducer::ReduceStringPrototypeIndexOf(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
   if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
@@ -3557,6 +3798,274 @@ Reduction JSCallReducer::ReduceStringPrototypeIndexOf(
   return NoChange();
 }
 
+// ES #sec-string.prototype.substring
+Reduction JSCallReducer::ReduceStringPrototypeSubstring(Node* node) {
+  if (node->op()->ValueInputCount() < 3) return NoChange();
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* start = NodeProperties::GetValueInput(node, 2);
+  Node* end = node->op()->ValueInputCount() > 3
+                  ? NodeProperties::GetValueInput(node, 3)
+                  : jsgraph()->UndefinedConstant();
+
+  receiver = effect = graph()->NewNode(simplified()->CheckString(p.feedback()),
+                                       receiver, effect, control);
+
+  start = effect = graph()->NewNode(simplified()->CheckSmi(p.feedback()), start,
+                                    effect, control);
+
+  Node* length = graph()->NewNode(simplified()->StringLength(), receiver);
+
+  Node* check = graph()->NewNode(simplified()->ReferenceEqual(), end,
+                                 jsgraph()->UndefinedConstant());
+  Node* branch =
+      graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
+
+  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+  Node* etrue = effect;
+  Node* vtrue = length;
+
+  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+  Node* efalse = effect;
+  Node* vfalse = efalse = graph()->NewNode(simplified()->CheckSmi(p.feedback()),
+                                           end, efalse, if_false);
+
+  control = graph()->NewNode(common()->Merge(2), if_true, if_false);
+  effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
+  end = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                         vtrue, vfalse, control);
+  Node* finalStart =
+      graph()->NewNode(simplified()->NumberMin(),
+                       graph()->NewNode(simplified()->NumberMax(), start,
+                                        jsgraph()->ZeroConstant()),
+                       length);
+  Node* finalEnd =
+      graph()->NewNode(simplified()->NumberMin(),
+                       graph()->NewNode(simplified()->NumberMax(), end,
+                                        jsgraph()->ZeroConstant()),
+                       length);
+
+  Node* from =
+      graph()->NewNode(simplified()->NumberMin(), finalStart, finalEnd);
+  Node* to = graph()->NewNode(simplified()->NumberMax(), finalStart, finalEnd);
+
+  Node* value = effect = graph()->NewNode(simplified()->StringSubstring(),
+                                          receiver, from, to, effect, control);
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
+}
+
+// ES #sec-string.prototype.slice
+Reduction JSCallReducer::ReduceStringPrototypeSlice(Node* node) {
+  if (node->op()->ValueInputCount() < 3) return NoChange();
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* start = NodeProperties::GetValueInput(node, 2);
+  Node* end = node->op()->ValueInputCount() > 3
+                  ? NodeProperties::GetValueInput(node, 3)
+                  : jsgraph()->UndefinedConstant();
+
+  receiver = effect = graph()->NewNode(simplified()->CheckString(p.feedback()),
+                                       receiver, effect, control);
+
+  start = effect = graph()->NewNode(simplified()->CheckSmi(p.feedback()), start,
+                                    effect, control);
+
+  Node* length = graph()->NewNode(simplified()->StringLength(), receiver);
+
+  // Replace {end} argument with {length} if it is undefined.
+  {
+    Node* check = graph()->NewNode(simplified()->ReferenceEqual(), end,
+                                   jsgraph()->UndefinedConstant());
+
+    Node* branch =
+        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
+
+    Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+    Node* etrue = effect;
+    Node* vtrue = length;
+
+    Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+    Node* efalse = effect;
+    Node* vfalse = efalse = graph()->NewNode(
+        simplified()->CheckSmi(p.feedback()), end, efalse, if_false);
+
+    control = graph()->NewNode(common()->Merge(2), if_true, if_false);
+    effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
+    end = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                           vtrue, vfalse, control);
+  }
+
+  Node* from = graph()->NewNode(
+      common()->Select(MachineRepresentation::kTagged, BranchHint::kFalse),
+      graph()->NewNode(simplified()->NumberLessThan(), start,
+                       jsgraph()->ZeroConstant()),
+      graph()->NewNode(
+          simplified()->NumberMax(),
+          graph()->NewNode(simplified()->NumberAdd(), length, start),
+          jsgraph()->ZeroConstant()),
+      graph()->NewNode(simplified()->NumberMin(), start, length));
+  // {from} is always in non-negative Smi range, but our typer cannot
+  // figure that out yet.
+  from = effect = graph()->NewNode(common()->TypeGuard(Type::UnsignedSmall()),
+                                   from, effect, control);
+
+  Node* to = graph()->NewNode(
+      common()->Select(MachineRepresentation::kTagged, BranchHint::kFalse),
+      graph()->NewNode(simplified()->NumberLessThan(), end,
+                       jsgraph()->ZeroConstant()),
+      graph()->NewNode(simplified()->NumberMax(),
+                       graph()->NewNode(simplified()->NumberAdd(), length, end),
+                       jsgraph()->ZeroConstant()),
+      graph()->NewNode(simplified()->NumberMin(), end, length));
+  // {to} is always in non-negative Smi range, but our typer cannot
+  // figure that out yet.
+  to = effect = graph()->NewNode(common()->TypeGuard(Type::UnsignedSmall()), to,
+                                 effect, control);
+
+  Node* result_string = nullptr;
+  // Return empty string if {from} is smaller than {to}.
+  {
+    Node* check = graph()->NewNode(simplified()->NumberLessThan(), from, to);
+
+    Node* branch =
+        graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
+
+    Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+    Node* etrue = effect;
+    Node* vtrue = etrue = graph()->NewNode(simplified()->StringSubstring(),
+                                           receiver, from, to, etrue, if_true);
+
+    Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+    Node* efalse = effect;
+    Node* vfalse = jsgraph()->EmptyStringConstant();
+
+    control = graph()->NewNode(common()->Merge(2), if_true, if_false);
+    effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
+    result_string =
+        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                         vtrue, vfalse, control);
+  }
+
+  ReplaceWithValue(node, result_string, effect, control);
+  return Replace(result_string);
+}
+
+// ES #sec-string.prototype.substr
+Reduction JSCallReducer::ReduceStringPrototypeSubstr(Node* node) {
+  if (node->op()->ValueInputCount() < 3) return NoChange();
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* start = NodeProperties::GetValueInput(node, 2);
+  Node* end = node->op()->ValueInputCount() > 3
+                  ? NodeProperties::GetValueInput(node, 3)
+                  : jsgraph()->UndefinedConstant();
+
+  receiver = effect = graph()->NewNode(simplified()->CheckString(p.feedback()),
+                                       receiver, effect, control);
+
+  start = effect = graph()->NewNode(simplified()->CheckSmi(p.feedback()), start,
+                                    effect, control);
+
+  Node* length = graph()->NewNode(simplified()->StringLength(), receiver);
+
+  // Replace {end} argument with {length} if it is undefined.
+  {
+    Node* check = graph()->NewNode(simplified()->ReferenceEqual(), end,
+                                   jsgraph()->UndefinedConstant());
+    Node* branch =
+        graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
+
+    Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+    Node* etrue = effect;
+    Node* vtrue = length;
+
+    Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+    Node* efalse = effect;
+    Node* vfalse = efalse = graph()->NewNode(
+        simplified()->CheckSmi(p.feedback()), end, efalse, if_false);
+
+    control = graph()->NewNode(common()->Merge(2), if_true, if_false);
+    effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
+    end = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                           vtrue, vfalse, control);
+  }
+
+  Node* initStart = graph()->NewNode(
+      common()->Select(MachineRepresentation::kTagged, BranchHint::kFalse),
+      graph()->NewNode(simplified()->NumberLessThan(), start,
+                       jsgraph()->ZeroConstant()),
+      graph()->NewNode(
+          simplified()->NumberMax(),
+          graph()->NewNode(simplified()->NumberAdd(), length, start),
+          jsgraph()->ZeroConstant()),
+      start);
+  // The select above guarantees that initStart is non-negative, but
+  // our typer can't figure that out yet.
+  initStart = effect = graph()->NewNode(
+      common()->TypeGuard(Type::UnsignedSmall()), initStart, effect, control);
+
+  Node* resultLength = graph()->NewNode(
+      simplified()->NumberMin(),
+      graph()->NewNode(simplified()->NumberMax(), end,
+                       jsgraph()->ZeroConstant()),
+      graph()->NewNode(simplified()->NumberSubtract(), length, initStart));
+
+  // The the select below uses {resultLength} only if {resultLength > 0},
+  // but our typer can't figure that out yet.
+  Node* to = effect = graph()->NewNode(
+      common()->TypeGuard(Type::UnsignedSmall()),
+      graph()->NewNode(simplified()->NumberAdd(), initStart, resultLength),
+      effect, control);
+
+  Node* result_string = nullptr;
+  // Return empty string if {from} is smaller than {to}.
+  {
+    Node* check = graph()->NewNode(simplified()->NumberLessThan(),
+                                   jsgraph()->ZeroConstant(), resultLength);
+
+    Node* branch =
+        graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
+
+    Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+    Node* etrue = effect;
+    Node* vtrue = etrue =
+        graph()->NewNode(simplified()->StringSubstring(), receiver, initStart,
+                         to, etrue, if_true);
+
+    Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+    Node* efalse = effect;
+    Node* vfalse = jsgraph()->EmptyStringConstant();
+
+    control = graph()->NewNode(common()->Merge(2), if_true, if_false);
+    effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
+    result_string =
+        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                         vtrue, vfalse, control);
+  }
+
+  ReplaceWithValue(node, result_string, effect, control);
+  return Replace(result_string);
+}
+
 Reduction JSCallReducer::ReduceJSConstructWithArrayLike(Node* node) {
   DCHECK_EQ(IrOpcode::kJSConstructWithArrayLike, node->opcode());
   CallFrequency frequency = CallFrequencyOf(node->op());
@@ -3766,7 +4275,7 @@ Reduction JSCallReducer::ReduceArrayPrototypePop(Node* node) {
     // once we got the hole NaN mess sorted out in TurboFan/V8.
     if (receiver_map->elements_kind() == HOLEY_DOUBLE_ELEMENTS)
       return NoChange();
-    if (!UnionElementsKindUptoPackedness(&kind, receiver_map->elements_kind()))
+    if (!UnionElementsKindUptoSize(&kind, receiver_map->elements_kind()))
       return NoChange();
   }
 
@@ -3882,7 +4391,7 @@ Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
     // once we got the hole NaN mess sorted out in TurboFan/V8.
     if (receiver_map->elements_kind() == HOLEY_DOUBLE_ELEMENTS)
       return NoChange();
-    if (!UnionElementsKindUptoPackedness(&kind, receiver_map->elements_kind()))
+    if (!UnionElementsKindUptoSize(&kind, receiver_map->elements_kind()))
       return NoChange();
   }
 
@@ -4005,7 +4514,7 @@ Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
     {
       // Call the generic C++ implementation.
       const int builtin_index = Builtins::kArrayShift;
-      CallDescriptor const* const desc = Linkage::GetCEntryStubCallDescriptor(
+      auto call_descriptor = Linkage::GetCEntryStubCallDescriptor(
           graph()->zone(), 1, BuiltinArguments::kNumExtraArgsWithReceiver,
           Builtins::name(builtin_index), node->op()->properties(),
           CallDescriptor::kNeedsFrameState);
@@ -4017,7 +4526,7 @@ Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
       Node* argc =
           jsgraph()->Constant(BuiltinArguments::kNumExtraArgsWithReceiver);
       if_false1 = efalse1 = vfalse1 =
-          graph()->NewNode(common()->Call(desc), stub_code, receiver,
+          graph()->NewNode(common()->Call(call_descriptor), stub_code, receiver,
                            jsgraph()->PaddingConstant(), argc, target,
                            jsgraph()->UndefinedConstant(), entry, argc, context,
                            frame_state, efalse1, if_false1);
@@ -4047,66 +4556,301 @@ Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
     return Replace(value);
 }
 
-// ES6 section 21.1.3.1 String.prototype.charAt ( pos )
-Reduction JSCallReducer::ReduceStringPrototypeCharAt(Node* node) {
+Reduction JSCallReducer::ReduceArrayIterator(Node* node, IterationKind kind) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // Check if we know that {receiver} is a valid JSReceiver.
+  ZoneHandleSet<Map> receiver_maps;
+  NodeProperties::InferReceiverMapsResult result =
+      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+  if (result == NodeProperties::kNoReceiverMaps) return NoChange();
+  DCHECK_NE(0, receiver_maps.size());
+  for (Handle<Map> receiver_map : receiver_maps) {
+    if (!receiver_map->IsJSReceiverMap()) return NoChange();
+  }
+
+  // Morph the {node} into a JSCreateArrayIterator with the given {kind}.
+  RelaxControls(node);
+  node->ReplaceInput(0, receiver);
+  node->ReplaceInput(1, context);
+  node->ReplaceInput(2, effect);
+  node->ReplaceInput(3, control);
+  node->TrimInputCount(4);
+  NodeProperties::ChangeOp(node, javascript()->CreateArrayIterator(kind));
+  return Changed(node);
+}
+
+namespace {
+
+bool InferIteratedObjectMaps(Node* iterator,
+                             ZoneHandleSet<Map>* iterated_object_maps) {
+  DCHECK_EQ(IrOpcode::kJSCreateArrayIterator, iterator->opcode());
+  Node* iterated_object = NodeProperties::GetValueInput(iterator, 0);
+  Node* effect = NodeProperties::GetEffectInput(iterator);
+
+  NodeProperties::InferReceiverMapsResult result =
+      NodeProperties::InferReceiverMaps(iterated_object, effect,
+                                        iterated_object_maps);
+  return result != NodeProperties::kNoReceiverMaps;
+}
+
+}  // namespace
+
+// ES #sec-%arrayiteratorprototype%.next
+Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
+  Node* iterator = NodeProperties::GetValueInput(node, 1);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
   if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
     return NoChange();
   }
 
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* index = jsgraph()->ZeroConstant();
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
+  // Check if the {iterator} is a JSCreateArrayIterator.
+  if (iterator->opcode() != IrOpcode::kJSCreateArrayIterator) return NoChange();
+  IterationKind const iteration_kind =
+      CreateArrayIteratorParametersOf(iterator->op()).kind();
 
-  receiver = effect = graph()->NewNode(simplified()->CheckString(p.feedback()),
-                                       receiver, effect, control);
-  if (node->op()->ValueInputCount() >= 3) {
-    index = effect = graph()->NewNode(simplified()->CheckSmi(p.feedback()),
-                                      NodeProperties::GetValueInput(node, 2),
-                                      effect, control);
-    // Map -0 and NaN to 0 (as per ToInteger), and the values in
-    // the [-2^31,-1] range to the [2^31,2^32-1] range, which will
-    // be considered out-of-bounds as well, because of the maximal
-    // String length limit in V8.
-    STATIC_ASSERT(String::kMaxLength <= kMaxInt);
-    index = graph()->NewNode(simplified()->NumberToUint32(), index);
+  // Try to infer the [[IteratedObject]] maps from the {iterator}.
+  ZoneHandleSet<Map> iterated_object_maps;
+  if (!InferIteratedObjectMaps(iterator, &iterated_object_maps)) {
+    return NoChange();
   }
+  DCHECK_NE(0, iterated_object_maps.size());
 
-  // Determine the {receiver} length.
-  Node* receiver_length =
-      graph()->NewNode(simplified()->StringLength(), receiver);
+  // Check that various {iterated_object_maps} have compatible elements kinds.
+  ElementsKind elements_kind = iterated_object_maps[0]->elements_kind();
+  if (IsFixedTypedArrayElementsKind(elements_kind)) {
+    // TurboFan doesn't support loading from BigInt typed arrays yet.
+    if (elements_kind == BIGUINT64_ELEMENTS ||
+        elements_kind == BIGINT64_ELEMENTS) {
+      return NoChange();
+    }
+    for (Handle<Map> iterated_object_map : iterated_object_maps) {
+      if (iterated_object_map->elements_kind() != elements_kind) {
+        return NoChange();
+      }
+    }
+  } else {
+    for (Handle<Map> iterated_object_map : iterated_object_maps) {
+      if (!CanInlineArrayIteratingBuiltin(iterated_object_map)) {
+        return NoChange();
+      }
+      if (!UnionElementsKindUptoSize(&elements_kind,
+                                     iterated_object_map->elements_kind())) {
+        return NoChange();
+      }
+    }
+  }
+
+  // Install code dependency on the array protector for holey arrays.
+  if (IsHoleyElementsKind(elements_kind)) {
+    dependencies()->AssumePropertyCell(factory()->no_elements_protector());
+  }
+
+  // Load the (current) {iterated_object} from the {iterator}; this might be
+  // either undefined or the JSReceiver that was passed to the JSArrayIterator
+  // creation.
+  Node* iterated_object = effect =
+      graph()->NewNode(simplified()->LoadField(
+                           AccessBuilder::ForJSArrayIteratorIteratedObject()),
+                       iterator, effect, control);
+
+  // Ensure that the {iterated_object} map didn't change. This also rules
+  // out the undefined that we put as a termination marker into the
+  // iterator.[[IteratedObject]] field once we reach the end.
+  effect = graph()->NewNode(
+      simplified()->CheckMaps(CheckMapsFlag::kNone, iterated_object_maps,
+                              p.feedback()),
+      iterated_object, effect, control);
+
+  if (IsFixedTypedArrayElementsKind(elements_kind)) {
+    // See if we can skip the neutering check.
+    if (isolate()->IsArrayBufferNeuteringIntact()) {
+      // Add a code dependency so we are deoptimized in case an ArrayBuffer
+      // gets neutered.
+      dependencies()->AssumePropertyCell(
+          factory()->array_buffer_neutering_protector());
+    } else {
+      // Deoptimize if the array buffer was neutered.
+      Node* buffer = effect = graph()->NewNode(
+          simplified()->LoadField(AccessBuilder::ForJSArrayBufferViewBuffer()),
+          iterated_object, effect, control);
+
+      Node* check = effect = graph()->NewNode(
+          simplified()->ArrayBufferWasNeutered(), buffer, effect, control);
+      check = graph()->NewNode(simplified()->BooleanNot(), check);
+      // TODO(bmeurer): Pass p.feedback(), or better introduce
+      // CheckArrayBufferNotNeutered?
+      effect = graph()->NewNode(
+          simplified()->CheckIf(DeoptimizeReason::kArrayBufferWasNeutered),
+          check, effect, control);
+    }
+  }
+
+  // Load the [[NextIndex]] from the {iterator} and leverage the fact
+  // that we definitely know that it's in Unsigned32 range since the
+  // {iterated_object} is either a JSArray or a JSTypedArray. For the
+  // latter case we even know that it's a Smi in UnsignedSmall range.
+  FieldAccess index_access = AccessBuilder::ForJSArrayIteratorNextIndex();
+  if (IsFixedTypedArrayElementsKind(elements_kind)) {
+    index_access.type = TypeCache::Get().kJSTypedArrayLengthType;
+    index_access.machine_type = MachineType::TaggedSigned();
+    index_access.write_barrier_kind = kNoWriteBarrier;
+  } else {
+    index_access.type = TypeCache::Get().kJSArrayLengthType;
+  }
+  Node* index = effect = graph()->NewNode(simplified()->LoadField(index_access),
+                                          iterator, effect, control);
+
+  // Load the length of the {iterated_object}. Due to the map checks we
+  // already know something about the length here, which we can leverage
+  // to generate Word32 operations below without additional checking.
+  FieldAccess length_access =
+      IsFixedTypedArrayElementsKind(elements_kind)
+          ? AccessBuilder::ForJSTypedArrayLength()
+          : AccessBuilder::ForJSArrayLength(elements_kind);
+  Node* length = effect = graph()->NewNode(
+      simplified()->LoadField(length_access), iterated_object, effect, control);
 
-  // Check if {index} is less than {receiver} length.
-  Node* check =
-      graph()->NewNode(simplified()->NumberLessThan(), index, receiver_length);
+  // Check whether {index} is within the valid range for the {iterated_object}.
+  Node* check = graph()->NewNode(simplified()->NumberLessThan(), index, length);
   Node* branch =
       graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
 
-  // Return the character from the {receiver} as single character string.
+  Node* done_true;
+  Node* value_true;
+  Node* etrue = effect;
   Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+  {
+    // We know that the {index} is range of the {length} now.
+    index = etrue = graph()->NewNode(
+        common()->TypeGuard(
+            Type::Range(0.0, length_access.type->Max() - 1.0, graph()->zone())),
+        index, etrue, if_true);
+
+    done_true = jsgraph()->FalseConstant();
+    if (iteration_kind == IterationKind::kKeys) {
+      // Just return the {index}.
+      value_true = index;
+    } else {
+      DCHECK(iteration_kind == IterationKind::kEntries ||
+             iteration_kind == IterationKind::kValues);
 
-  Node* masked_index = graph()->NewNode(simplified()->MaskIndexWithBound(),
-                                        index, receiver_length);
+      Node* elements = etrue = graph()->NewNode(
+          simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
+          iterated_object, etrue, if_true);
+
+      if (IsFixedTypedArrayElementsKind(elements_kind)) {
+        Node* base_ptr = etrue = graph()->NewNode(
+            simplified()->LoadField(
+                AccessBuilder::ForFixedTypedArrayBaseBasePointer()),
+            elements, etrue, if_true);
+        Node* external_ptr = etrue = graph()->NewNode(
+            simplified()->LoadField(
+                AccessBuilder::ForFixedTypedArrayBaseExternalPointer()),
+            elements, etrue, if_true);
+
+        ExternalArrayType array_type = kExternalInt8Array;
+        switch (elements_kind) {
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
+  case TYPE##_ELEMENTS:                                 \
+    array_type = kExternal##Type##Array;                \
+    break;
+          TYPED_ARRAYS(TYPED_ARRAY_CASE)
+          default:
+            UNREACHABLE();
+#undef TYPED_ARRAY_CASE
+        }
+
+        Node* buffer = etrue =
+            graph()->NewNode(simplified()->LoadField(
+                                 AccessBuilder::ForJSArrayBufferViewBuffer()),
+                             iterated_object, etrue, if_true);
+
+        value_true = etrue =
+            graph()->NewNode(simplified()->LoadTypedElement(array_type), buffer,
+                             base_ptr, external_ptr, index, etrue, if_true);
+      } else {
+        value_true = etrue = graph()->NewNode(
+            simplified()->LoadElement(
+                AccessBuilder::ForFixedArrayElement(elements_kind)),
+            elements, index, etrue, if_true);
+
+        // Convert hole to undefined if needed.
+        if (elements_kind == HOLEY_ELEMENTS ||
+            elements_kind == HOLEY_SMI_ELEMENTS) {
+          value_true = graph()->NewNode(
+              simplified()->ConvertTaggedHoleToUndefined(), value_true);
+        } else if (elements_kind == HOLEY_DOUBLE_ELEMENTS) {
+          // TODO(6587): avoid deopt if not all uses of value are truncated.
+          CheckFloat64HoleMode mode = CheckFloat64HoleMode::kAllowReturnHole;
+          value_true = etrue = graph()->NewNode(
+              simplified()->CheckFloat64Hole(mode), value_true, etrue, if_true);
+        }
+      }
 
-  Node* vtrue = graph()->NewNode(simplified()->StringCharAt(), receiver,
-                                 masked_index, if_true);
+      if (iteration_kind == IterationKind::kEntries) {
+        // Allocate elements for key/value pair
+        value_true = etrue =
+            graph()->NewNode(javascript()->CreateKeyValueArray(), index,
+                             value_true, context, etrue);
+      } else {
+        DCHECK_EQ(IterationKind::kValues, iteration_kind);
+      }
+    }
+
+    // Increment the [[NextIndex]] field in the {iterator}. The TypeGuards
+    // above guarantee that the {next_index} is in the UnsignedSmall range.
+    Node* next_index = graph()->NewNode(simplified()->NumberAdd(), index,
+                                        jsgraph()->OneConstant());
+    etrue = graph()->NewNode(simplified()->StoreField(index_access), iterator,
+                             next_index, etrue, if_true);
+  }
 
-  // Return the empty string otherwise.
+  Node* done_false;
+  Node* value_false;
+  Node* efalse = effect;
   Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-  Node* vfalse = jsgraph()->EmptyStringConstant();
+  {
+    // iterator.[[NextIndex]] >= array.length, stop iterating.
+    done_false = jsgraph()->TrueConstant();
+    value_false = jsgraph()->UndefinedConstant();
+    efalse =
+        graph()->NewNode(simplified()->StoreField(
+                             AccessBuilder::ForJSArrayIteratorIteratedObject()),
+                         iterator, value_false, efalse, if_false);
+  }
 
   control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-  Node* value = graph()->NewNode(
-      common()->Phi(MachineRepresentation::kTagged, 2), vtrue, vfalse, control);
+  effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
+  Node* value =
+      graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                       value_true, value_false, control);
+  Node* done =
+      graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                       done_true, done_false, control);
 
+  // Create IteratorResult object.
+  value = effect = graph()->NewNode(javascript()->CreateIterResultObject(),
+                                    value, done, context, effect);
   ReplaceWithValue(node, value, effect, control);
   return Replace(value);
 }
 
 // ES6 section 21.1.3.2 String.prototype.charCodeAt ( pos )
-Reduction JSCallReducer::ReduceStringPrototypeCharCodeAt(Node* node) {
+// ES6 section 21.1.3.3 String.prototype.codePointAt ( pos )
+Reduction JSCallReducer::ReduceStringPrototypeStringAt(
+    const Operator* string_access_operator, Node* node) {
+  DCHECK(string_access_operator->opcode() == IrOpcode::kStringCharCodeAt ||
+         string_access_operator->opcode() == IrOpcode::kStringCodePointAt);
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
   if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
@@ -4114,51 +4858,1193 @@ Reduction JSCallReducer::ReduceStringPrototypeCharCodeAt(Node* node) {
   }
 
   Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* index = jsgraph()->ZeroConstant();
+  Node* index = node->op()->ValueInputCount() >= 3
+                    ? NodeProperties::GetValueInput(node, 2)
+                    : jsgraph()->ZeroConstant();
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
+  // Ensure that the {receiver} is actually a String.
   receiver = effect = graph()->NewNode(simplified()->CheckString(p.feedback()),
                                        receiver, effect, control);
-  if (node->op()->ValueInputCount() >= 3) {
-    index = effect = graph()->NewNode(simplified()->CheckSmi(p.feedback()),
-                                      NodeProperties::GetValueInput(node, 2),
-                                      effect, control);
 
-    // Map -0 and NaN to 0 (as per ToInteger), and the values in
-    // the [-2^31,-1] range to the [2^31,2^32-1] range, which will
-    // be considered out-of-bounds as well, because of the maximal
-    // String length limit in V8.
-    STATIC_ASSERT(String::kMaxLength <= kMaxInt);
-    index = graph()->NewNode(simplified()->NumberToUint32(), index);
+  // Determine the {receiver} length.
+  Node* receiver_length =
+      graph()->NewNode(simplified()->StringLength(), receiver);
+
+  // Check that the {index} is within range.
+  index = effect = graph()->NewNode(simplified()->CheckBounds(p.feedback()),
+                                    index, receiver_length, effect, control);
+
+  // Return the character from the {receiver} as single character string.
+  Node* masked_index = graph()->NewNode(simplified()->MaskIndexWithBound(),
+                                        index, receiver_length);
+  Node* value = effect = graph()->NewNode(string_access_operator, receiver,
+                                          masked_index, effect, control);
+
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
+}
+
+// ES section 21.1.3.1 String.prototype.charAt ( pos )
+Reduction JSCallReducer::ReduceStringPrototypeCharAt(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
   }
 
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* index = node->op()->ValueInputCount() >= 3
+                    ? NodeProperties::GetValueInput(node, 2)
+                    : jsgraph()->ZeroConstant();
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // Ensure that the {receiver} is actually a String.
+  receiver = effect = graph()->NewNode(simplified()->CheckString(p.feedback()),
+                                       receiver, effect, control);
+
   // Determine the {receiver} length.
   Node* receiver_length =
       graph()->NewNode(simplified()->StringLength(), receiver);
 
-  // Check if {index} is less than {receiver} length.
-  Node* check =
-      graph()->NewNode(simplified()->NumberLessThan(), index, receiver_length);
-  Node* branch =
-      graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
-
-  // Load the character from the {receiver}.
-  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+  // Check that the {index} is within range.
+  index = effect = graph()->NewNode(simplified()->CheckBounds(p.feedback()),
+                                    index, receiver_length, effect, control);
 
+  // Return the character from the {receiver} as single character string.
   Node* masked_index = graph()->NewNode(simplified()->MaskIndexWithBound(),
                                         index, receiver_length);
+  Node* value = effect =
+      graph()->NewNode(simplified()->StringCharCodeAt(), receiver, masked_index,
+                       effect, control);
+  value = graph()->NewNode(simplified()->StringFromSingleCharCode(), value);
 
-  Node* vtrue = graph()->NewNode(simplified()->StringCharCodeAt(), receiver,
-                                 masked_index, if_true);
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
+}
 
-  // Return NaN otherwise.
-  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-  Node* vfalse = jsgraph()->NaNConstant();
+#ifdef V8_INTL_SUPPORT
 
-  control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-  Node* value = graph()->NewNode(
-      common()->Phi(MachineRepresentation::kTagged, 2), vtrue, vfalse, control);
+Reduction JSCallReducer::ReduceStringPrototypeToLowerCaseIntl(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  Node* receiver = effect =
+      graph()->NewNode(simplified()->CheckString(p.feedback()),
+                       NodeProperties::GetValueInput(node, 1), effect, control);
+
+  NodeProperties::ReplaceEffectInput(node, effect);
+  RelaxEffectsAndControls(node);
+  node->ReplaceInput(0, receiver);
+  node->TrimInputCount(1);
+  NodeProperties::ChangeOp(node, simplified()->StringToLowerCaseIntl());
+  NodeProperties::SetType(node, Type::String());
+  return Changed(node);
+}
+
+Reduction JSCallReducer::ReduceStringPrototypeToUpperCaseIntl(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  Node* receiver = effect =
+      graph()->NewNode(simplified()->CheckString(p.feedback()),
+                       NodeProperties::GetValueInput(node, 1), effect, control);
+
+  NodeProperties::ReplaceEffectInput(node, effect);
+  RelaxEffectsAndControls(node);
+  node->ReplaceInput(0, receiver);
+  node->TrimInputCount(1);
+  NodeProperties::ChangeOp(node, simplified()->StringToUpperCaseIntl());
+  NodeProperties::SetType(node, Type::String());
+  return Changed(node);
+}
+
+#endif  // V8_INTL_SUPPORT
+
+// ES #sec-string.fromcharcode
+Reduction JSCallReducer::ReduceStringFromCharCode(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  if (node->op()->ValueInputCount() == 3) {
+    Node* effect = NodeProperties::GetEffectInput(node);
+    Node* control = NodeProperties::GetControlInput(node);
+    Node* input = NodeProperties::GetValueInput(node, 2);
+
+    input = effect = graph()->NewNode(
+        simplified()->SpeculativeToNumber(NumberOperationHint::kNumberOrOddball,
+                                          p.feedback()),
+        input, effect, control);
+
+    Node* value =
+        graph()->NewNode(simplified()->StringFromSingleCharCode(), input);
+    ReplaceWithValue(node, value, effect);
+    return Replace(value);
+  }
+  return NoChange();
+}
+
+// ES #sec-string.fromcodepoint
+Reduction JSCallReducer::ReduceStringFromCodePoint(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  if (node->op()->ValueInputCount() == 3) {
+    Node* effect = NodeProperties::GetEffectInput(node);
+    Node* control = NodeProperties::GetControlInput(node);
+    Node* input = NodeProperties::GetValueInput(node, 2);
+
+    input = effect = graph()->NewNode(simplified()->CheckSmi(p.feedback()),
+                                      input, effect, control);
+
+    input = effect =
+        graph()->NewNode(simplified()->CheckBounds(p.feedback()), input,
+                         jsgraph()->Constant(0x10FFFF + 1), effect, control);
+
+    Node* value = graph()->NewNode(
+        simplified()->StringFromSingleCodePoint(UnicodeEncoding::UTF32), input);
+    ReplaceWithValue(node, value, effect);
+    return Replace(value);
+  }
+  return NoChange();
+}
+
+Reduction JSCallReducer::ReduceStringPrototypeIterator(Node* node) {
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* receiver = effect =
+      graph()->NewNode(simplified()->CheckString(p.feedback()),
+                       NodeProperties::GetValueInput(node, 1), effect, control);
+  Node* iterator = effect =
+      graph()->NewNode(javascript()->CreateStringIterator(), receiver,
+                       jsgraph()->NoContextConstant(), effect);
+  ReplaceWithValue(node, iterator, effect, control);
+  return Replace(iterator);
+}
+
+Reduction JSCallReducer::ReduceStringIteratorPrototypeNext(Node* node) {
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* context = NodeProperties::GetContextInput(node);
+  if (NodeProperties::HasInstanceTypeWitness(receiver, effect,
+                                             JS_STRING_ITERATOR_TYPE)) {
+    Node* string = effect = graph()->NewNode(
+        simplified()->LoadField(AccessBuilder::ForJSStringIteratorString()),
+        receiver, effect, control);
+    Node* index = effect = graph()->NewNode(
+        simplified()->LoadField(AccessBuilder::ForJSStringIteratorIndex()),
+        receiver, effect, control);
+    Node* length = graph()->NewNode(simplified()->StringLength(), string);
+
+    // branch0: if (index < length)
+    Node* check0 =
+        graph()->NewNode(simplified()->NumberLessThan(), index, length);
+    Node* branch0 =
+        graph()->NewNode(common()->Branch(BranchHint::kTrue), check0, control);
+
+    Node* etrue0 = effect;
+    Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
+    Node* done_true;
+    Node* vtrue0;
+    {
+      done_true = jsgraph()->FalseConstant();
+      Node* codepoint = etrue0 = graph()->NewNode(
+          simplified()->StringCodePointAt(UnicodeEncoding::UTF16), string,
+          index, etrue0, if_true0);
+      vtrue0 = graph()->NewNode(
+          simplified()->StringFromSingleCodePoint(UnicodeEncoding::UTF16),
+          codepoint);
+
+      // Update iterator.[[NextIndex]]
+      Node* char_length =
+          graph()->NewNode(simplified()->StringLength(), vtrue0);
+      index = graph()->NewNode(simplified()->NumberAdd(), index, char_length);
+      etrue0 = graph()->NewNode(
+          simplified()->StoreField(AccessBuilder::ForJSStringIteratorIndex()),
+          receiver, index, etrue0, if_true0);
+    }
+
+    Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
+    Node* done_false;
+    Node* vfalse0;
+    {
+      vfalse0 = jsgraph()->UndefinedConstant();
+      done_false = jsgraph()->TrueConstant();
+    }
+
+    control = graph()->NewNode(common()->Merge(2), if_true0, if_false0);
+    effect = graph()->NewNode(common()->EffectPhi(2), etrue0, effect, control);
+    Node* value =
+        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                         vtrue0, vfalse0, control);
+    Node* done =
+        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                         done_true, done_false, control);
+
+    value = effect = graph()->NewNode(javascript()->CreateIterResultObject(),
+                                      value, done, context, effect);
+
+    ReplaceWithValue(node, value, effect, control);
+    return Replace(value);
+  }
+  return NoChange();
+}
+
+// ES #sec-string.prototype.concat
+Reduction JSCallReducer::ReduceStringPrototypeConcat(
+    Node* node, Handle<SharedFunctionInfo> shared) {
+  if (node->op()->ValueInputCount() < 2 || node->op()->ValueInputCount() > 3) {
+    return NoChange();
+  }
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* receiver = effect =
+      graph()->NewNode(simplified()->CheckString(p.feedback()),
+                       NodeProperties::GetValueInput(node, 1), effect, control);
+
+  if (node->op()->ValueInputCount() < 3) {
+    ReplaceWithValue(node, receiver, effect, control);
+    return Replace(receiver);
+  }
+  Node* argument = effect =
+      graph()->NewNode(simplified()->CheckString(p.feedback()),
+                       NodeProperties::GetValueInput(node, 2), effect, control);
+
+  Callable const callable =
+      CodeFactory::StringAdd(isolate(), STRING_ADD_CHECK_NONE, NOT_TENURED);
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
+      isolate(), graph()->zone(), callable.descriptor(), 0,
+      CallDescriptor::kNeedsFrameState,
+      Operator::kNoDeopt | Operator::kNoWrite);
+
+  // TODO(turbofan): Massage the FrameState of the {node} here once we
+  // have an artificial builtin frame type, so that it looks like the
+  // exception from StringAdd overflow came from String.prototype.concat
+  // builtin instead of the calling function.
+  Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
+
+  Node* value = effect = control = graph()->NewNode(
+      common()->Call(call_descriptor), jsgraph()->HeapConstant(callable.code()),
+      receiver, argument, context, outer_frame_state, effect, control);
+
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
+}
+
+Reduction JSCallReducer::ReduceAsyncFunctionPromiseCreate(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  if (!isolate()->IsPromiseHookProtectorIntact()) return NoChange();
+
+  // Install a code dependency on the promise hook protector cell.
+  dependencies()->AssumePropertyCell(factory()->promise_hook_protector());
+
+  // Morph this {node} into a JSCreatePromise node.
+  RelaxControls(node);
+  node->ReplaceInput(0, context);
+  node->ReplaceInput(1, effect);
+  node->TrimInputCount(2);
+  NodeProperties::ChangeOp(node, javascript()->CreatePromise());
+  return Changed(node);
+}
+
+Reduction JSCallReducer::ReduceAsyncFunctionPromiseRelease(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  if (!isolate()->IsPromiseHookProtectorIntact()) return NoChange();
+
+  // Install a code dependency on the promise hook protector cell.
+  dependencies()->AssumePropertyCell(factory()->promise_hook_protector());
+
+  // The AsyncFunctionPromiseRelease builtin is a no-op as long as neither
+  // the debugger is active nor any promise hook has been installed (ever).
+  Node* value = jsgraph()->UndefinedConstant();
+  ReplaceWithValue(node, value);
+  return Replace(value);
+}
+
+// ES section #sec-promise-reject-functions
+Reduction JSCallReducer::ReducePromiseCapabilityDefaultReject(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* target = NodeProperties::GetValueInput(node, 0);
+  Node* resolution = node->op()->ValueInputCount() > 2
+                         ? NodeProperties::GetValueInput(node, 2)
+                         : jsgraph()->UndefinedConstant();
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // We need to execute in the {target}s context.
+  Node* context = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForJSFunctionContext()), target,
+      effect, control);
+
+  // Grab the promise closed over by {target}.
+  Node* promise = effect =
+      graph()->NewNode(simplified()->LoadField(AccessBuilder::ForContextSlot(
+                           PromiseBuiltinsAssembler::kPromiseSlot)),
+                       context, effect, control);
+
+  // Check if the {promise} is still pending or already settled.
+  Node* check = graph()->NewNode(simplified()->ReferenceEqual(), promise,
+                                 jsgraph()->UndefinedConstant());
+  Node* branch =
+      graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
+
+  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+  Node* etrue = effect;
+
+  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+  Node* efalse = effect;
+  {
+    // Mark the {promise} as settled.
+    efalse = graph()->NewNode(
+        simplified()->StoreField(AccessBuilder::ForContextSlot(
+            PromiseBuiltinsAssembler::kPromiseSlot)),
+        context, jsgraph()->UndefinedConstant(), efalse, if_false);
+
+    // Check if we should emit a debug event.
+    Node* debug_event = efalse =
+        graph()->NewNode(simplified()->LoadField(AccessBuilder::ForContextSlot(
+                             PromiseBuiltinsAssembler::kDebugEventSlot)),
+                         context, efalse, if_false);
+
+    // Actually reject the {promise}.
+    efalse =
+        graph()->NewNode(javascript()->RejectPromise(), promise, resolution,
+                         debug_event, context, frame_state, efalse, if_false);
+  }
+
+  control = graph()->NewNode(common()->Merge(2), if_true, if_false);
+  effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
+
+  Node* value = jsgraph()->UndefinedConstant();
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
+}
+
+// ES section #sec-promise-resolve-functions
+Reduction JSCallReducer::ReducePromiseCapabilityDefaultResolve(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* target = NodeProperties::GetValueInput(node, 0);
+  Node* resolution = node->op()->ValueInputCount() > 2
+                         ? NodeProperties::GetValueInput(node, 2)
+                         : jsgraph()->UndefinedConstant();
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // We need to execute in the {target}s context.
+  Node* context = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForJSFunctionContext()), target,
+      effect, control);
+
+  // Grab the promise closed over by {target}.
+  Node* promise = effect =
+      graph()->NewNode(simplified()->LoadField(AccessBuilder::ForContextSlot(
+                           PromiseBuiltinsAssembler::kPromiseSlot)),
+                       context, effect, control);
+
+  // Check if the {promise} is still pending or already settled.
+  Node* check = graph()->NewNode(simplified()->ReferenceEqual(), promise,
+                                 jsgraph()->UndefinedConstant());
+  Node* branch =
+      graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
+
+  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+  Node* etrue = effect;
+
+  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+  Node* efalse = effect;
+  {
+    // Mark the {promise} as settled.
+    efalse = graph()->NewNode(
+        simplified()->StoreField(AccessBuilder::ForContextSlot(
+            PromiseBuiltinsAssembler::kPromiseSlot)),
+        context, jsgraph()->UndefinedConstant(), efalse, if_false);
+
+    // Actually resolve the {promise}.
+    efalse =
+        graph()->NewNode(javascript()->ResolvePromise(), promise, resolution,
+                         context, frame_state, efalse, if_false);
+  }
+
+  control = graph()->NewNode(common()->Merge(2), if_true, if_false);
+  effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
+
+  Node* value = jsgraph()->UndefinedConstant();
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
+}
+
+Node* JSCallReducer::CreateArtificialFrameState(
+    Node* node, Node* outer_frame_state, int parameter_count,
+    BailoutId bailout_id, FrameStateType frame_state_type,
+    Handle<SharedFunctionInfo> shared) {
+  const FrameStateFunctionInfo* state_info =
+      common()->CreateFrameStateFunctionInfo(frame_state_type,
+                                             parameter_count + 1, 0, shared);
+
+  const Operator* op = common()->FrameState(
+      bailout_id, OutputFrameStateCombine::Ignore(), state_info);
+  const Operator* op0 = common()->StateValues(0, SparseInputMask::Dense());
+  Node* node0 = graph()->NewNode(op0);
+  std::vector<Node*> params;
+  for (int parameter = 0; parameter < parameter_count + 1; ++parameter) {
+    params.push_back(node->InputAt(1 + parameter));
+  }
+  const Operator* op_param = common()->StateValues(
+      static_cast<int>(params.size()), SparseInputMask::Dense());
+  Node* params_node = graph()->NewNode(
+      op_param, static_cast<int>(params.size()), &params.front());
+  return graph()->NewNode(op, params_node, node0, node0,
+                          jsgraph()->UndefinedConstant(), node->InputAt(0),
+                          outer_frame_state);
+}
+
+Reduction JSCallReducer::ReducePromiseConstructor(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSConstruct, node->opcode());
+  ConstructParameters const& p = ConstructParametersOf(node->op());
+  int arity = static_cast<int>(p.arity() - 2);
+  // We only inline when we have the executor.
+  if (arity < 1) return NoChange();
+  Node* target = NodeProperties::GetValueInput(node, 0);
+  Node* executor = NodeProperties::GetValueInput(node, 1);
+  Node* new_target = NodeProperties::GetValueInput(node, arity + 1);
+
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* outer_frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  if (!FLAG_experimental_inline_promise_constructor) return NoChange();
+
+  // Only handle builtins Promises, not subclasses.
+  if (target != new_target) return NoChange();
+
+  // Add a code dependency on the promise hook protector.
+  dependencies()->AssumePropertyCell(factory()->promise_hook_protector());
+
+  Handle<SharedFunctionInfo> promise_shared(
+      handle(native_context()->promise_function()->shared()));
+
+  // Insert a construct stub frame into the chain of frame states. This will
+  // reconstruct the proper frame when deoptimizing within the constructor.
+  // For the frame state, we only provide the executor parameter, even if more
+  // arugments were passed. This is not observable from JS.
+  DCHECK_EQ(1, promise_shared->internal_formal_parameter_count());
+  Node* constructor_frame_state = CreateArtificialFrameState(
+      node, outer_frame_state, 1, BailoutId::ConstructStubInvoke(),
+      FrameStateType::kConstructStub, promise_shared);
+
+  // This frame state doesn't ever call the deopt continuation, it's only
+  // necessary to specifiy a continuation in order to handle the exceptional
+  // case.
+  Node* checkpoint_params[] = {jsgraph()->UndefinedConstant(),
+                               jsgraph()->UndefinedConstant()};
+  const int stack_parameters = arraysize(checkpoint_params);
+
+  Node* frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+      jsgraph(), promise_shared,
+      Builtins::kPromiseConstructorLazyDeoptContinuation, target, context,
+      &checkpoint_params[0], stack_parameters, constructor_frame_state,
+      ContinuationFrameStateMode::LAZY);
+
+  // Check if executor is callable
+  Node* check_fail = nullptr;
+  Node* check_throw = nullptr;
+  // TODO(petermarshall): The frame state is wrong here.
+  WireInCallbackIsCallableCheck(executor, context, frame_state, effect,
+                                &control, &check_fail, &check_throw);
+
+  // Create the resulting JSPromise.
+  Node* promise = effect =
+      graph()->NewNode(javascript()->CreatePromise(), context, effect);
+
+  // 8. CreatePromiseResolvingFunctions
+  // Allocate a promise context for the closures below.
+  Node* promise_context = effect = graph()->NewNode(
+      javascript()->CreateFunctionContext(
+          PromiseBuiltinsAssembler::kPromiseContextLength, FUNCTION_SCOPE),
+      context, context, effect, control);
+  effect =
+      graph()->NewNode(simplified()->StoreField(AccessBuilder::ForContextSlot(
+                           PromiseBuiltinsAssembler::kPromiseSlot)),
+                       promise_context, promise, effect, control);
+  effect = graph()->NewNode(
+      simplified()->StoreField(AccessBuilder::ForContextSlot(
+          PromiseBuiltinsAssembler::kDebugEventSlot)),
+      promise_context, jsgraph()->TrueConstant(), effect, control);
+
+  // Allocate the closure for the resolve case.
+  Handle<SharedFunctionInfo> resolve_shared(
+      native_context()->promise_capability_default_resolve_shared_fun(),
+      isolate());
+  Node* resolve = effect =
+      graph()->NewNode(javascript()->CreateClosure(
+                           resolve_shared, factory()->many_closures_cell(),
+                           handle(resolve_shared->GetCode(), isolate())),
+                       promise_context, effect, control);
+
+  // Allocate the closure for the reject case.
+  Handle<SharedFunctionInfo> reject_shared(
+      native_context()->promise_capability_default_reject_shared_fun(),
+      isolate());
+  Node* reject = effect =
+      graph()->NewNode(javascript()->CreateClosure(
+                           reject_shared, factory()->many_closures_cell(),
+                           handle(reject_shared->GetCode(), isolate())),
+                       promise_context, effect, control);
+
+  // Re-use the params from above, but actually set the promise parameter now.
+  checkpoint_params[1] = promise;
+
+  // This simple continuation just returns the created promise.
+  // TODO(petermarshall): If the executor function causes lazy deopt, and it
+  // also throws an exception, we should catch the exception and call the reject
+  // function.
+  frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+      jsgraph(), promise_shared,
+      Builtins::kPromiseConstructorLazyDeoptContinuation, target, context,
+      &checkpoint_params[0], stack_parameters, constructor_frame_state,
+      ContinuationFrameStateMode::LAZY);
+
+  // 9. Call executor with both resolving functions
+  effect = control = graph()->NewNode(
+      javascript()->Call(4, p.frequency(), VectorSlotPair(),
+                         ConvertReceiverMode::kNullOrUndefined,
+                         SpeculationMode::kDisallowSpeculation),
+      executor, jsgraph()->UndefinedConstant(), resolve, reject, context,
+      frame_state, effect, control);
+
+  Node* exception_effect = effect;
+  Node* exception_control = control;
+  {
+    Node* reason = exception_effect = exception_control = graph()->NewNode(
+        common()->IfException(), exception_control, exception_effect);
+    // 10a. Call reject if the call to executor threw.
+    exception_effect = exception_control = graph()->NewNode(
+        javascript()->Call(3, p.frequency(), VectorSlotPair(),
+                           ConvertReceiverMode::kNullOrUndefined,
+                           SpeculationMode::kDisallowSpeculation),
+        reject, jsgraph()->UndefinedConstant(), reason, context, frame_state,
+        exception_effect, exception_control);
+
+    // Rewire potential exception edges.
+    Node* on_exception = nullptr;
+    if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
+      RewirePostCallbackExceptionEdges(check_throw, on_exception,
+                                       exception_effect, &check_fail,
+                                       &exception_control);
+    }
+  }
+
+  Node* success_effect = effect;
+  Node* success_control = control;
+  {
+    success_control = graph()->NewNode(common()->IfSuccess(), success_control);
+  }
+
+  control =
+      graph()->NewNode(common()->Merge(2), success_control, exception_control);
+  effect = graph()->NewNode(common()->EffectPhi(2), success_effect,
+                            exception_effect, control);
+
+  // Wire up the branch for the case when IsCallable fails for the executor.
+  // Since {check_throw} is an unconditional throw, it's impossible to
+  // return a successful completion. Therefore, we simply connect the successful
+  // completion to the graph end.
+  Node* throw_node =
+      graph()->NewNode(common()->Throw(), check_throw, check_fail);
+  NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
+
+  ReplaceWithValue(node, promise, effect, control);
+  return Replace(promise);
+}
+
+// V8 Extras: v8.createPromise(parent)
+Reduction JSCallReducer::ReducePromiseInternalConstructor(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+
+  // Check that promises aren't being observed through (debug) hooks.
+  if (!isolate()->IsPromiseHookProtectorIntact()) return NoChange();
+
+  // Install a code dependency on the promise hook protector cell.
+  dependencies()->AssumePropertyCell(factory()->promise_hook_protector());
+
+  // Create a new pending promise.
+  Node* value = effect =
+      graph()->NewNode(javascript()->CreatePromise(), context, effect);
+
+  ReplaceWithValue(node, value, effect);
+  return Replace(value);
+}
+
+// V8 Extras: v8.rejectPromise(promise, reason)
+Reduction JSCallReducer::ReducePromiseInternalReject(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* promise = node->op()->ValueInputCount() >= 2
+                      ? NodeProperties::GetValueInput(node, 2)
+                      : jsgraph()->UndefinedConstant();
+  Node* reason = node->op()->ValueInputCount() >= 3
+                     ? NodeProperties::GetValueInput(node, 3)
+                     : jsgraph()->UndefinedConstant();
+  Node* debug_event = jsgraph()->TrueConstant();
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // Reject the {promise} using the given {reason}, and trigger debug logic.
+  Node* value = effect =
+      graph()->NewNode(javascript()->RejectPromise(), promise, reason,
+                       debug_event, context, frame_state, effect, control);
+
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
+}
+
+// V8 Extras: v8.resolvePromise(promise, resolution)
+Reduction JSCallReducer::ReducePromiseInternalResolve(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* promise = node->op()->ValueInputCount() >= 2
+                      ? NodeProperties::GetValueInput(node, 2)
+                      : jsgraph()->UndefinedConstant();
+  Node* resolution = node->op()->ValueInputCount() >= 3
+                         ? NodeProperties::GetValueInput(node, 3)
+                         : jsgraph()->UndefinedConstant();
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // Resolve the {promise} using the given {resolution}.
+  Node* value = effect =
+      graph()->NewNode(javascript()->ResolvePromise(), promise, resolution,
+                       context, frame_state, effect, control);
+
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
+}
+
+// ES section #sec-promise.prototype.catch
+Reduction JSCallReducer::ReducePromisePrototypeCatch(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  int arity = static_cast<int>(p.arity() - 2);
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // Check that the Promise.then protector is intact. This protector guards
+  // that all JSPromise instances whose [[Prototype]] is the initial
+  // %PromisePrototype% yield the initial %PromisePrototype%.then method
+  // when looking up "then".
+  if (!isolate()->IsPromiseThenLookupChainIntact()) return NoChange();
+
+  // Check if we know something about {receiver} already.
+  ZoneHandleSet<Map> receiver_maps;
+  NodeProperties::InferReceiverMapsResult result =
+      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+  if (result == NodeProperties::kNoReceiverMaps) return NoChange();
+  DCHECK_NE(0, receiver_maps.size());
+
+  // Check whether all {receiver_maps} are JSPromise maps and
+  // have the initial Promise.prototype as their [[Prototype]].
+  for (Handle<Map> receiver_map : receiver_maps) {
+    if (!receiver_map->IsJSPromiseMap()) return NoChange();
+    if (receiver_map->prototype() != native_context()->promise_prototype()) {
+      return NoChange();
+    }
+  }
+
+  // Add a code dependency on the necessary protectors.
+  dependencies()->AssumePropertyCell(factory()->promise_then_protector());
+
+  // If the {receiver_maps} aren't reliable, we need to repeat the
+  // map check here, guarded by the CALL_IC.
+  if (result == NodeProperties::kUnreliableReceiverMaps) {
+    effect =
+        graph()->NewNode(simplified()->CheckMaps(CheckMapsFlag::kNone,
+                                                 receiver_maps, p.feedback()),
+                         receiver, effect, control);
+  }
+
+  // Massage the {node} to call "then" instead by first removing all inputs
+  // following the onRejected parameter, and then filling up the parameters
+  // to two inputs from the left with undefined.
+  Node* target = jsgraph()->Constant(handle(native_context()->promise_then()));
+  NodeProperties::ReplaceValueInput(node, target, 0);
+  NodeProperties::ReplaceEffectInput(node, effect);
+  for (; arity > 1; --arity) node->RemoveInput(3);
+  for (; arity < 2; ++arity) {
+    node->InsertInput(graph()->zone(), 2, jsgraph()->UndefinedConstant());
+  }
+  NodeProperties::ChangeOp(
+      node, javascript()->Call(2 + arity, p.frequency(), p.feedback(),
+                               ConvertReceiverMode::kNotNullOrUndefined,
+                               p.speculation_mode()));
+  Reduction const reduction = ReducePromisePrototypeThen(node);
+  return reduction.Changed() ? reduction : Changed(node);
+}
+
+// ES section #sec-promise.prototype.finally
+Reduction JSCallReducer::ReducePromisePrototypeFinally(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  int arity = static_cast<int>(p.arity() - 2);
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* on_finally = arity >= 1 ? NodeProperties::GetValueInput(node, 2)
+                                : jsgraph()->UndefinedConstant();
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+
+  // Check that promises aren't being observed through (debug) hooks.
+  if (!isolate()->IsPromiseHookProtectorIntact()) return NoChange();
+
+  // Check that the Promise#then protector is intact. This protector guards
+  // that all JSPromise instances whose [[Prototype]] is the initial
+  // %PromisePrototype% yield the initial %PromisePrototype%.then method
+  // when looking up "then".
+  if (!isolate()->IsPromiseThenLookupChainIntact()) return NoChange();
+
+  // Also check that the @@species protector is intact, which guards the
+  // lookup of "constructor" on JSPromise instances, whoch [[Prototype]] is
+  // the initial %PromisePrototype%, and the Symbol.species lookup on the
+  // %PromisePrototype%.
+  if (!isolate()->IsSpeciesLookupChainIntact()) return NoChange();
+
+  // Check if we know something about {receiver} already.
+  ZoneHandleSet<Map> receiver_maps;
+  NodeProperties::InferReceiverMapsResult result =
+      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+  if (result == NodeProperties::kNoReceiverMaps) return NoChange();
+  DCHECK_NE(0, receiver_maps.size());
+
+  // Check whether all {receiver_maps} are JSPromise maps and
+  // have the initial Promise.prototype as their [[Prototype]].
+  for (Handle<Map> receiver_map : receiver_maps) {
+    if (!receiver_map->IsJSPromiseMap()) return NoChange();
+    if (receiver_map->prototype() != native_context()->promise_prototype()) {
+      return NoChange();
+    }
+  }
+
+  // Add a code dependency on the necessary protectors.
+  dependencies()->AssumePropertyCell(factory()->promise_hook_protector());
+  dependencies()->AssumePropertyCell(factory()->promise_then_protector());
+  dependencies()->AssumePropertyCell(factory()->species_protector());
+
+  // If the {receiver_maps} aren't reliable, we need to repeat the
+  // map check here, guarded by the CALL_IC.
+  if (result == NodeProperties::kUnreliableReceiverMaps) {
+    effect =
+        graph()->NewNode(simplified()->CheckMaps(CheckMapsFlag::kNone,
+                                                 receiver_maps, p.feedback()),
+                         receiver, effect, control);
+  }
+
+  // Check if {on_finally} is callable, and if so wrap it into appropriate
+  // closures that perform the finalization.
+  Node* check = graph()->NewNode(simplified()->ObjectIsCallable(), on_finally);
+  Node* branch =
+      graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
+
+  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+  Node* etrue = effect;
+  Node* catch_true;
+  Node* then_true;
+  {
+    Node* context = jsgraph()->HeapConstant(native_context());
+    Node* constructor = jsgraph()->HeapConstant(
+        handle(native_context()->promise_function(), isolate()));
+
+    // Allocate shared context for the closures below.
+    context = etrue = graph()->NewNode(
+        javascript()->CreateFunctionContext(
+            PromiseBuiltinsAssembler::kPromiseFinallyContextLength,
+            FUNCTION_SCOPE),
+        context, context, etrue, if_true);
+    etrue =
+        graph()->NewNode(simplified()->StoreField(AccessBuilder::ForContextSlot(
+                             PromiseBuiltinsAssembler::kOnFinallySlot)),
+                         context, on_finally, etrue, if_true);
+    etrue =
+        graph()->NewNode(simplified()->StoreField(AccessBuilder::ForContextSlot(
+                             PromiseBuiltinsAssembler::kConstructorSlot)),
+                         context, constructor, etrue, if_true);
+
+    // Allocate the closure for the reject case.
+    Handle<SharedFunctionInfo> catch_finally(
+        native_context()->promise_catch_finally_shared_fun(), isolate());
+    catch_true = etrue =
+        graph()->NewNode(javascript()->CreateClosure(
+                             catch_finally, factory()->many_closures_cell(),
+                             handle(catch_finally->GetCode(), isolate())),
+                         context, etrue, if_true);
+
+    // Allocate the closure for the fulfill case.
+    Handle<SharedFunctionInfo> then_finally(
+        native_context()->promise_then_finally_shared_fun(), isolate());
+    then_true = etrue =
+        graph()->NewNode(javascript()->CreateClosure(
+                             then_finally, factory()->many_closures_cell(),
+                             handle(then_finally->GetCode(), isolate())),
+                         context, etrue, if_true);
+  }
+
+  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+  Node* efalse = effect;
+  Node* catch_false = on_finally;
+  Node* then_false = on_finally;
+
+  control = graph()->NewNode(common()->Merge(2), if_true, if_false);
+  effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
+  Node* catch_finally =
+      graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                       catch_true, catch_false, control);
+  Node* then_finally =
+      graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                       then_true, then_false, control);
+
+  // At this point we definitely know that {receiver} has one of the
+  // {receiver_maps}, so insert a MapGuard as a hint for the lowering
+  // of the call to "then" below.
+  effect = graph()->NewNode(simplified()->MapGuard(receiver_maps), receiver,
+                            effect, control);
+
+  // Massage the {node} to call "then" instead by first removing all inputs
+  // following the onFinally parameter, and then replacing the only parameter
+  // input with the {on_finally} value.
+  Node* target = jsgraph()->Constant(handle(native_context()->promise_then()));
+  NodeProperties::ReplaceValueInput(node, target, 0);
+  NodeProperties::ReplaceEffectInput(node, effect);
+  NodeProperties::ReplaceControlInput(node, control);
+  for (; arity > 2; --arity) node->RemoveInput(2);
+  for (; arity < 2; ++arity)
+    node->InsertInput(graph()->zone(), 2, then_finally);
+  node->ReplaceInput(2, then_finally);
+  node->ReplaceInput(3, catch_finally);
+  NodeProperties::ChangeOp(
+      node, javascript()->Call(2 + arity, p.frequency(), p.feedback(),
+                               ConvertReceiverMode::kNotNullOrUndefined,
+                               p.speculation_mode()));
+  Reduction const reduction = ReducePromisePrototypeThen(node);
+  return reduction.Changed() ? reduction : Changed(node);
+}
+
+Reduction JSCallReducer::ReducePromisePrototypeThen(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* on_fulfilled = node->op()->ValueInputCount() > 2
+                           ? NodeProperties::GetValueInput(node, 2)
+                           : jsgraph()->UndefinedConstant();
+  Node* on_rejected = node->op()->ValueInputCount() > 3
+                          ? NodeProperties::GetValueInput(node, 3)
+                          : jsgraph()->UndefinedConstant();
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // Check that promises aren't being observed through (debug) hooks.
+  if (!isolate()->IsPromiseHookProtectorIntact()) return NoChange();
+
+  // Check if the @@species protector is intact. The @@species protector
+  // guards the "constructor" lookup on all JSPromise instances and the
+  // initial Promise.prototype, as well as the  Symbol.species lookup on
+  // the Promise constructor.
+  if (!isolate()->IsSpeciesLookupChainIntact()) return NoChange();
+
+  // Check if we know something about {receiver} already.
+  ZoneHandleSet<Map> receiver_maps;
+  NodeProperties::InferReceiverMapsResult infer_receiver_maps_result =
+      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+  if (infer_receiver_maps_result == NodeProperties::kNoReceiverMaps) {
+    return NoChange();
+  }
+  DCHECK_NE(0, receiver_maps.size());
+
+  // Check whether all {receiver_maps} are JSPromise maps and
+  // have the initial Promise.prototype as their [[Prototype]].
+  for (Handle<Map> receiver_map : receiver_maps) {
+    if (!receiver_map->IsJSPromiseMap()) return NoChange();
+    if (receiver_map->prototype() != native_context()->promise_prototype()) {
+      return NoChange();
+    }
+  }
+
+  // Add a code dependency on the necessary protectors.
+  dependencies()->AssumePropertyCell(factory()->promise_hook_protector());
+  dependencies()->AssumePropertyCell(factory()->species_protector());
+
+  // If the {receiver_maps} aren't reliable, we need to repeat the
+  // map check here, guarded by the CALL_IC.
+  if (infer_receiver_maps_result == NodeProperties::kUnreliableReceiverMaps) {
+    effect =
+        graph()->NewNode(simplified()->CheckMaps(CheckMapsFlag::kNone,
+                                                 receiver_maps, p.feedback()),
+                         receiver, effect, control);
+  }
+
+  // Check that {on_fulfilled} is callable.
+  on_fulfilled = graph()->NewNode(
+      common()->Select(MachineRepresentation::kTagged, BranchHint::kTrue),
+      graph()->NewNode(simplified()->ObjectIsCallable(), on_fulfilled),
+      on_fulfilled, jsgraph()->UndefinedConstant());
+
+  // Check that {on_rejected} is callable.
+  on_rejected = graph()->NewNode(
+      common()->Select(MachineRepresentation::kTagged, BranchHint::kTrue),
+      graph()->NewNode(simplified()->ObjectIsCallable(), on_rejected),
+      on_rejected, jsgraph()->UndefinedConstant());
+
+  // Create the resulting JSPromise.
+  Node* result = effect =
+      graph()->NewNode(javascript()->CreatePromise(), context, effect);
+
+  // Chain {result} onto {receiver}.
+  result = effect = graph()->NewNode(javascript()->PerformPromiseThen(),
+                                     receiver, on_fulfilled, on_rejected,
+                                     result, context, effect, control);
+  ReplaceWithValue(node, result, effect, control);
+  return Replace(result);
+}
+
+// ES section #sec-promise.resolve
+Reduction JSCallReducer::ReducePromiseResolveTrampoline(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* value = node->op()->ValueInputCount() > 2
+                    ? NodeProperties::GetValueInput(node, 2)
+                    : jsgraph()->UndefinedConstant();
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // Check if we know something about {receiver} already.
+  ZoneHandleSet<Map> receiver_maps;
+  NodeProperties::InferReceiverMapsResult infer_receiver_maps_result =
+      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+  if (infer_receiver_maps_result == NodeProperties::kNoReceiverMaps) {
+    return NoChange();
+  }
+  DCHECK_NE(0, receiver_maps.size());
+
+  // Only reduce when all {receiver_maps} are JSReceiver maps.
+  for (Handle<Map> receiver_map : receiver_maps) {
+    if (!receiver_map->IsJSReceiverMap()) return NoChange();
+  }
+
+  // Morph the {node} into a JSPromiseResolve operation.
+  node->ReplaceInput(0, receiver);
+  node->ReplaceInput(1, value);
+  node->ReplaceInput(2, context);
+  node->ReplaceInput(3, frame_state);
+  node->ReplaceInput(4, effect);
+  node->ReplaceInput(5, control);
+  node->TrimInputCount(6);
+  NodeProperties::ChangeOp(node, javascript()->PromiseResolve());
+  return Changed(node);
+}
+
+// ES #sec-typedarray-constructors
+Reduction JSCallReducer::ReduceTypedArrayConstructor(
+    Node* node, Handle<SharedFunctionInfo> shared) {
+  DCHECK_EQ(IrOpcode::kJSConstruct, node->opcode());
+  ConstructParameters const& p = ConstructParametersOf(node->op());
+  int arity = static_cast<int>(p.arity() - 2);
+  Node* target = NodeProperties::GetValueInput(node, 0);
+  Node* arg1 = (arity >= 1) ? NodeProperties::GetValueInput(node, 1)
+                            : jsgraph()->UndefinedConstant();
+  Node* arg2 = (arity >= 2) ? NodeProperties::GetValueInput(node, 2)
+                            : jsgraph()->UndefinedConstant();
+  Node* arg3 = (arity >= 3) ? NodeProperties::GetValueInput(node, 3)
+                            : jsgraph()->UndefinedConstant();
+  Node* new_target = NodeProperties::GetValueInput(node, arity + 1);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // Insert a construct stub frame into the chain of frame states. This will
+  // reconstruct the proper frame when deoptimizing within the constructor.
+  frame_state = CreateArtificialFrameState(
+      node, frame_state, arity, BailoutId::ConstructStubInvoke(),
+      FrameStateType::kConstructStub, shared);
+
+  // This continuation just returns the newly created JSTypedArray. We
+  // pass the_hole as the receiver, just like the builtin construct stub
+  // does in this case.
+  Node* const parameters[] = {jsgraph()->TheHoleConstant()};
+  int const num_parameters = static_cast<int>(arraysize(parameters));
+  frame_state = CreateJavaScriptBuiltinContinuationFrameState(
+      jsgraph(), shared, Builtins::kTypedArrayConstructorLazyDeoptContinuation,
+      target, context, parameters, num_parameters, frame_state,
+      ContinuationFrameStateMode::LAZY);
+
+  Node* result =
+      graph()->NewNode(javascript()->CreateTypedArray(), target, new_target,
+                       arg1, arg2, arg3, context, frame_state, effect, control);
+  return Replace(result);
+}
+
+// ES #sec-number.isfinite
+Reduction JSCallReducer::ReduceNumberIsFinite(Node* node) {
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->FalseConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+  Node* input = NodeProperties::GetValueInput(node, 2);
+  Node* value = graph()->NewNode(simplified()->ObjectIsFiniteNumber(), input);
+  ReplaceWithValue(node, value);
+  return Replace(value);
+}
+
+// ES #sec-number.isfinite
+Reduction JSCallReducer::ReduceNumberIsInteger(Node* node) {
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->FalseConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+  Node* input = NodeProperties::GetValueInput(node, 2);
+  Node* value = graph()->NewNode(simplified()->ObjectIsInteger(), input);
+  ReplaceWithValue(node, value);
+  return Replace(value);
+}
+
+// ES #sec-number.issafeinteger
+Reduction JSCallReducer::ReduceNumberIsSafeInteger(Node* node) {
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->FalseConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+  Node* input = NodeProperties::GetValueInput(node, 2);
+  Node* value = graph()->NewNode(simplified()->ObjectIsSafeInteger(), input);
+  ReplaceWithValue(node, value);
+  return Replace(value);
+}
+
+// ES #sec-number.isnan
+Reduction JSCallReducer::ReduceNumberIsNaN(Node* node) {
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->FalseConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+  Node* input = NodeProperties::GetValueInput(node, 2);
+  Node* value = graph()->NewNode(simplified()->ObjectIsNaN(), input);
+  ReplaceWithValue(node, value);
+  return Replace(value);
+}
+
+Reduction JSCallReducer::ReduceMapPrototypeGet(Node* node) {
+  // We only optimize if we have target, receiver and key parameters.
+  if (node->op()->ValueInputCount() != 3) return NoChange();
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* key = NodeProperties::GetValueInput(node, 2);
+
+  if (!NodeProperties::HasInstanceTypeWitness(receiver, effect, JS_MAP_TYPE))
+    return NoChange();
+
+  Node* table = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForJSCollectionTable()), receiver,
+      effect, control);
+
+  Node* entry = effect = graph()->NewNode(
+      simplified()->FindOrderedHashMapEntry(), table, key, effect, control);
+
+  Node* check = graph()->NewNode(simplified()->NumberEqual(), entry,
+                                 jsgraph()->MinusOneConstant());
+
+  Node* branch = graph()->NewNode(common()->Branch(), check, control);
+
+  // Key not found.
+  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+  Node* etrue = effect;
+  Node* vtrue = jsgraph()->UndefinedConstant();
+
+  // Key found.
+  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+  Node* efalse = effect;
+  Node* vfalse = efalse = graph()->NewNode(
+      simplified()->LoadElement(AccessBuilder::ForOrderedHashMapEntryValue()),
+      table, entry, efalse, if_false);
+
+  control = graph()->NewNode(common()->Merge(2), if_true, if_false);
+  Node* value = graph()->NewNode(
+      common()->Phi(MachineRepresentation::kTagged, 2), vtrue, vfalse, control);
+  effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
+
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
+}
+
+Reduction JSCallReducer::ReduceMapPrototypeHas(Node* node) {
+  // We only optimize if we have target, receiver and key parameters.
+  if (node->op()->ValueInputCount() != 3) return NoChange();
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* key = NodeProperties::GetValueInput(node, 2);
+
+  if (!NodeProperties::HasInstanceTypeWitness(receiver, effect, JS_MAP_TYPE))
+    return NoChange();
+
+  Node* table = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForJSCollectionTable()), receiver,
+      effect, control);
+
+  Node* index = effect = graph()->NewNode(
+      simplified()->FindOrderedHashMapEntry(), table, key, effect, control);
+
+  Node* value = graph()->NewNode(simplified()->NumberEqual(), index,
+                                 jsgraph()->MinusOneConstant());
+  value = graph()->NewNode(simplified()->BooleanNot(), value);
 
   ReplaceWithValue(node, value, effect, control);
   return Replace(value);
diff --git a/deps/v8/src/compiler/js-call-reducer.h b/deps/v8/src/compiler/js-call-reducer.h
index b2656b6be8e..6f401196728 100644
--- a/deps/v8/src/compiler/js-call-reducer.h
+++ b/deps/v8/src/compiler/js-call-reducer.h
@@ -6,6 +6,7 @@
 #define V8_COMPILER_JS_CALL_REDUCER_H_
 
 #include "src/base/flags.h"
+#include "src/compiler/frame-states.h"
 #include "src/compiler/graph-reducer.h"
 #include "src/deoptimize-reason.h"
 
@@ -28,7 +29,7 @@ class SimplifiedOperatorBuilder;
 
 // Performs strength reduction on {JSConstruct} and {JSCall} nodes,
 // which might allow inlining or other optimizations to be performed afterwards.
-class JSCallReducer final : public AdvancedReducer {
+class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
  public:
   // Flags that control the mode of operation.
   enum Flag { kNoFlags = 0u, kBailoutOnUninitialized = 1u << 0 };
@@ -54,7 +55,8 @@ class JSCallReducer final : public AdvancedReducer {
  private:
   Reduction ReduceArrayConstructor(Node* node);
   Reduction ReduceBooleanConstructor(Node* node);
-  Reduction ReduceCallApiFunction(Node* node, Handle<JSFunction> function);
+  Reduction ReduceCallApiFunction(Node* node,
+                                  Handle<SharedFunctionInfo> shared);
   Reduction ReduceFunctionPrototypeApply(Node* node);
   Reduction ReduceFunctionPrototypeBind(Node* node);
   Reduction ReduceFunctionPrototypeCall(Node* node);
@@ -71,19 +73,29 @@ class JSCallReducer final : public AdvancedReducer {
   Reduction ReduceReflectGet(Node* node);
   Reduction ReduceReflectGetPrototypeOf(Node* node);
   Reduction ReduceReflectHas(Node* node);
-  Reduction ReduceArrayForEach(Handle<JSFunction> function, Node* node);
-  Reduction ReduceArrayReduce(Handle<JSFunction> function, Node* node);
-  Reduction ReduceArrayReduceRight(Handle<JSFunction> function, Node* node);
-  Reduction ReduceArrayMap(Handle<JSFunction> function, Node* node);
-  Reduction ReduceArrayFilter(Handle<JSFunction> function, Node* node);
-  enum class ArrayFindVariant : uint8_t { kFind, kFindIndex };
-  Reduction ReduceArrayFind(ArrayFindVariant variant,
-                            Handle<JSFunction> function, Node* node);
-  Reduction ReduceArrayEvery(Handle<JSFunction> function, Node* node);
-  Reduction ReduceArraySome(Handle<JSFunction> function, Node* node);
+  Reduction ReduceArrayForEach(Node* node, Handle<SharedFunctionInfo> shared);
+  enum class ArrayReduceDirection { kLeft, kRight };
+  Reduction ReduceArrayReduce(Node* node, ArrayReduceDirection direction,
+                              Handle<SharedFunctionInfo> shared);
+  Reduction ReduceArrayMap(Node* node, Handle<SharedFunctionInfo> shared);
+  Reduction ReduceArrayFilter(Node* node, Handle<SharedFunctionInfo> shared);
+  enum class ArrayFindVariant { kFind, kFindIndex };
+  Reduction ReduceArrayFind(Node* node, ArrayFindVariant variant,
+                            Handle<SharedFunctionInfo> shared);
+  Reduction ReduceArrayEvery(Node* node, Handle<SharedFunctionInfo> shared);
+  enum class SearchVariant { kIncludes, kIndexOf };
+  Reduction ReduceArrayIndexOfIncludes(SearchVariant search_variant,
+                                       Node* node);
+  Reduction ReduceArraySome(Node* node, Handle<SharedFunctionInfo> shared);
   Reduction ReduceArrayPrototypePush(Node* node);
   Reduction ReduceArrayPrototypePop(Node* node);
   Reduction ReduceArrayPrototypeShift(Node* node);
+  enum class ArrayIteratorKind { kArray, kTypedArray };
+  Reduction ReduceArrayIterator(Node* node, IterationKind kind);
+  Reduction ReduceArrayIteratorPrototypeNext(Node* node);
+  Reduction ReduceFastArrayIteratorNext(InstanceType type, Node* node,
+                                        IterationKind kind);
+
   Reduction ReduceCallOrConstructWithArrayLikeOrSpread(
       Node* node, int arity, CallFrequency const& frequency,
       VectorSlotPair const& feedback);
@@ -91,16 +103,62 @@ class JSCallReducer final : public AdvancedReducer {
   Reduction ReduceJSConstructWithArrayLike(Node* node);
   Reduction ReduceJSConstructWithSpread(Node* node);
   Reduction ReduceJSCall(Node* node);
+  Reduction ReduceJSCall(Node* node, Handle<SharedFunctionInfo> shared);
   Reduction ReduceJSCallWithArrayLike(Node* node);
   Reduction ReduceJSCallWithSpread(Node* node);
   Reduction ReduceReturnReceiver(Node* node);
-  Reduction ReduceStringPrototypeIndexOf(Handle<JSFunction> function,
-                                         Node* node);
+  Reduction ReduceStringPrototypeIndexOf(Node* node);
+  Reduction ReduceStringPrototypeSubstring(Node* node);
+  Reduction ReduceStringPrototypeSlice(Node* node);
+  Reduction ReduceStringPrototypeSubstr(Node* node);
+  Reduction ReduceStringPrototypeStringAt(
+      const Operator* string_access_operator, Node* node);
   Reduction ReduceStringPrototypeCharAt(Node* node);
-  Reduction ReduceStringPrototypeCharCodeAt(Node* node);
+
+#ifdef V8_INTL_SUPPORT
+  Reduction ReduceStringPrototypeToLowerCaseIntl(Node* node);
+  Reduction ReduceStringPrototypeToUpperCaseIntl(Node* node);
+#endif  // V8_INTL_SUPPORT
+
+  Reduction ReduceStringFromCharCode(Node* node);
+  Reduction ReduceStringFromCodePoint(Node* node);
+  Reduction ReduceStringPrototypeIterator(Node* node);
+  Reduction ReduceStringIteratorPrototypeNext(Node* node);
+  Reduction ReduceStringPrototypeConcat(Node* node,
+                                        Handle<SharedFunctionInfo> shared);
+
+  Reduction ReduceAsyncFunctionPromiseCreate(Node* node);
+  Reduction ReduceAsyncFunctionPromiseRelease(Node* node);
+  Reduction ReducePromiseCapabilityDefaultReject(Node* node);
+  Reduction ReducePromiseCapabilityDefaultResolve(Node* node);
+  Reduction ReducePromiseConstructor(Node* node);
+  Reduction ReducePromiseInternalConstructor(Node* node);
+  Reduction ReducePromiseInternalReject(Node* node);
+  Reduction ReducePromiseInternalResolve(Node* node);
+  Reduction ReducePromisePrototypeCatch(Node* node);
+  Reduction ReducePromisePrototypeFinally(Node* node);
+  Reduction ReducePromisePrototypeThen(Node* node);
+  Reduction ReducePromiseResolveTrampoline(Node* node);
+
+  Reduction ReduceTypedArrayConstructor(Node* node,
+                                        Handle<SharedFunctionInfo> shared);
 
   Reduction ReduceSoftDeoptimize(Node* node, DeoptimizeReason reason);
 
+  Reduction ReduceMathUnary(Node* node, const Operator* op);
+  Reduction ReduceMathBinary(Node* node, const Operator* op);
+  Reduction ReduceMathImul(Node* node);
+  Reduction ReduceMathClz32(Node* node);
+  Reduction ReduceMathMinMax(Node* node, const Operator* op, Node* empty_value);
+
+  Reduction ReduceNumberIsFinite(Node* node);
+  Reduction ReduceNumberIsInteger(Node* node);
+  Reduction ReduceNumberIsSafeInteger(Node* node);
+  Reduction ReduceNumberIsNaN(Node* node);
+
+  Reduction ReduceMapPrototypeHas(Node* node);
+  Reduction ReduceMapPrototypeGet(Node* node);
+
   // Returns the updated {to} node, and updates control and effect along the
   // way.
   Node* DoFilterPostCallbackWork(ElementsKind kind, Node** control,
@@ -135,6 +193,11 @@ class JSCallReducer final : public AdvancedReducer {
                         Node** effect, Node** k,
                         const VectorSlotPair& feedback);
 
+  Node* CreateArtificialFrameState(Node* node, Node* outer_frame_state,
+                                   int parameter_count, BailoutId bailout_id,
+                                   FrameStateType frame_state_type,
+                                   Handle<SharedFunctionInfo> shared);
+
   Graph* graph() const;
   JSGraph* jsgraph() const { return jsgraph_; }
   Isolate* isolate() const;
diff --git a/deps/v8/src/compiler/js-context-specialization.cc b/deps/v8/src/compiler/js-context-specialization.cc
index ca7bcdfb665..9f833b60eb4 100644
--- a/deps/v8/src/compiler/js-context-specialization.cc
+++ b/deps/v8/src/compiler/js-context-specialization.cc
@@ -103,7 +103,7 @@ MaybeHandle<Context> GetSpecializationContext(Node* node, size_t* distance,
                                               Maybe<OuterContext> maybe_outer) {
   switch (node->opcode()) {
     case IrOpcode::kHeapConstant: {
-      Handle<Object> object = OpParameter<Handle<HeapObject>>(node);
+      Handle<Object> object = HeapConstantOf(node->op());
       if (object->IsContext()) return Handle<Context>::cast(object);
       break;
     }
diff --git a/deps/v8/src/compiler/js-create-lowering.cc b/deps/v8/src/compiler/js-create-lowering.cc
index d3b9ee4e70a..c794e339433 100644
--- a/deps/v8/src/compiler/js-create-lowering.cc
+++ b/deps/v8/src/compiler/js-create-lowering.cc
@@ -29,7 +29,7 @@ namespace {
 // Retrieves the frame state holding actual argument values.
 Node* GetArgumentsFrameState(Node* frame_state) {
   Node* const outer_state = NodeProperties::GetFrameStateInput(frame_state);
-  FrameStateInfo outer_state_info = OpParameter<FrameStateInfo>(outer_state);
+  FrameStateInfo outer_state_info = FrameStateInfoOf(outer_state->op());
   return outer_state_info.type() == FrameStateType::kArgumentsAdaptor
              ? outer_state
              : frame_state;
@@ -137,14 +137,20 @@ Reduction JSCreateLowering::Reduce(Node* node) {
       return ReduceJSCreateArguments(node);
     case IrOpcode::kJSCreateArray:
       return ReduceJSCreateArray(node);
+    case IrOpcode::kJSCreateArrayIterator:
+      return ReduceJSCreateArrayIterator(node);
     case IrOpcode::kJSCreateBoundFunction:
       return ReduceJSCreateBoundFunction(node);
     case IrOpcode::kJSCreateClosure:
       return ReduceJSCreateClosure(node);
     case IrOpcode::kJSCreateIterResultObject:
       return ReduceJSCreateIterResultObject(node);
+    case IrOpcode::kJSCreateStringIterator:
+      return ReduceJSCreateStringIterator(node);
     case IrOpcode::kJSCreateKeyValueArray:
       return ReduceJSCreateKeyValueArray(node);
+    case IrOpcode::kJSCreatePromise:
+      return ReduceJSCreatePromise(node);
     case IrOpcode::kJSCreateLiteralArray:
     case IrOpcode::kJSCreateLiteralObject:
       return ReduceJSCreateLiteralArrayOrObject(node);
@@ -228,7 +234,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
   Node* const frame_state = NodeProperties::GetFrameStateInput(node);
   Node* const outer_state = frame_state->InputAt(kFrameStateOuterStateInput);
   Node* const control = graph()->start();
-  FrameStateInfo state_info = OpParameter<FrameStateInfo>(frame_state);
+  FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
   Handle<SharedFunctionInfo> shared =
       state_info.shared_info().ToHandleChecked();
 
@@ -346,7 +352,14 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
       // whether there conceptually is an arguments adaptor frame in the call
       // chain.
       Node* const args_state = GetArgumentsFrameState(frame_state);
-      FrameStateInfo args_state_info = OpParameter<FrameStateInfo>(args_state);
+      if (args_state->InputAt(kFrameStateParametersInput)->opcode() ==
+          IrOpcode::kDeadValue) {
+        // This protects against an incompletely propagated DeadValue node.
+        // If the FrameState has a DeadValue input, then this node will be
+        // pruned anyway.
+        return NoChange();
+      }
+      FrameStateInfo args_state_info = FrameStateInfoOf(args_state->op());
       // Prepare element backing store to be used by arguments object.
       bool has_aliased_arguments = false;
       Node* const elements = AllocateAliasedArguments(
@@ -379,7 +392,14 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
       // whether there conceptually is an arguments adaptor frame in the call
       // chain.
       Node* const args_state = GetArgumentsFrameState(frame_state);
-      FrameStateInfo args_state_info = OpParameter<FrameStateInfo>(args_state);
+      if (args_state->InputAt(kFrameStateParametersInput)->opcode() ==
+          IrOpcode::kDeadValue) {
+        // This protects against an incompletely propagated DeadValue node.
+        // If the FrameState has a DeadValue input, then this node will be
+        // pruned anyway.
+        return NoChange();
+      }
+      FrameStateInfo args_state_info = FrameStateInfoOf(args_state->op());
       // Prepare element backing store to be used by arguments object.
       Node* const elements = AllocateArguments(effect, control, args_state);
       effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
@@ -408,7 +428,14 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
       // whether there conceptually is an arguments adaptor frame in the call
       // chain.
       Node* const args_state = GetArgumentsFrameState(frame_state);
-      FrameStateInfo args_state_info = OpParameter<FrameStateInfo>(args_state);
+      if (args_state->InputAt(kFrameStateParametersInput)->opcode() ==
+          IrOpcode::kDeadValue) {
+        // This protects against an incompletely propagated DeadValue node.
+        // If the FrameState has a DeadValue input, then this node will be
+        // pruned anyway.
+        return NoChange();
+      }
+      FrameStateInfo args_state_info = FrameStateInfoOf(args_state->op());
       // Prepare element backing store to be used by the rest array.
       Node* const elements =
           AllocateRestArguments(effect, control, args_state, start_index);
@@ -467,8 +494,13 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
     // Allocate a register file.
     DCHECK(js_function->shared()->HasBytecodeArray());
     int size = js_function->shared()->bytecode_array()->register_count();
-    Node* register_file = effect =
-        AllocateElements(effect, control, HOLEY_ELEMENTS, size, NOT_TENURED);
+    AllocationBuilder ab(jsgraph(), effect, control);
+    ab.AllocateArray(size, factory()->fixed_array_map());
+    for (int i = 0; i < size; ++i) {
+      ab.Store(AccessBuilder::ForFixedArraySlot(i),
+               jsgraph()->UndefinedConstant());
+    }
+    Node* register_file = effect = ab.Finish();
 
     // Emit code to allocate the JS[Async]GeneratorObject instance.
     AllocationBuilder a(jsgraph(), effect, control);
@@ -490,8 +522,8 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
 
     if (initial_map->instance_type() == JS_ASYNC_GENERATOR_OBJECT_TYPE) {
       a.Store(AccessBuilder::ForJSAsyncGeneratorObjectQueue(), undefined);
-      a.Store(AccessBuilder::ForJSAsyncGeneratorObjectAwaitedPromise(),
-              undefined);
+      a.Store(AccessBuilder::ForJSAsyncGeneratorObjectIsAwaiting(),
+              jsgraph()->ZeroConstant());
     }
 
     // Handle in-object properties, too.
@@ -682,37 +714,37 @@ Reduction JSCreateLowering::ReduceNewArrayToStubCall(
   if (arity == 0) {
     ArrayNoArgumentConstructorStub stub(isolate(), elements_kind,
                                         override_mode);
-    CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
         isolate(), graph()->zone(), stub.GetCallInterfaceDescriptor(),
         arity + 1, CallDescriptor::kNeedsFrameState, properties);
     node->ReplaceInput(0, jsgraph()->HeapConstant(stub.GetCode()));
     node->InsertInput(graph()->zone(), 2, type_info);
     node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(arity));
     node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant());
-    NodeProperties::ChangeOp(node, common()->Call(desc));
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
   } else if (arity == 1) {
     // Require elements kind to "go holey".
     ArraySingleArgumentConstructorStub stub(
         isolate(), GetHoleyElementsKind(elements_kind), override_mode);
-    CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
         isolate(), graph()->zone(), stub.GetCallInterfaceDescriptor(),
         arity + 1, CallDescriptor::kNeedsFrameState, properties);
     node->ReplaceInput(0, jsgraph()->HeapConstant(stub.GetCode()));
     node->InsertInput(graph()->zone(), 2, type_info);
     node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(arity));
     node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant());
-    NodeProperties::ChangeOp(node, common()->Call(desc));
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
   } else {
     DCHECK_GT(arity, 1);
     ArrayNArgumentsConstructorStub stub(isolate());
-    CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
         isolate(), graph()->zone(), stub.GetCallInterfaceDescriptor(),
         arity + 1, CallDescriptor::kNeedsFrameState);
     node->ReplaceInput(0, jsgraph()->HeapConstant(stub.GetCode()));
     node->InsertInput(graph()->zone(), 2, type_info);
     node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(arity));
     node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant());
-    NodeProperties::ChangeOp(node, common()->Call(desc));
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
   }
   return Changed(node);
 }
@@ -852,6 +884,33 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
   return ReduceNewArrayToStubCall(node, site);
 }
 
+Reduction JSCreateLowering::ReduceJSCreateArrayIterator(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCreateArrayIterator, node->opcode());
+  CreateArrayIteratorParameters const& p =
+      CreateArrayIteratorParametersOf(node->op());
+  Node* iterated_object = NodeProperties::GetValueInput(node, 0);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // Create the JSArrayIterator result.
+  AllocationBuilder a(jsgraph(), effect, control);
+  a.Allocate(JSArrayIterator::kSize, NOT_TENURED, Type::OtherObject());
+  a.Store(AccessBuilder::ForMap(),
+          handle(native_context()->initial_array_iterator_map(), isolate()));
+  a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
+          jsgraph()->EmptyFixedArrayConstant());
+  a.Store(AccessBuilder::ForJSObjectElements(),
+          jsgraph()->EmptyFixedArrayConstant());
+  a.Store(AccessBuilder::ForJSArrayIteratorIteratedObject(), iterated_object);
+  a.Store(AccessBuilder::ForJSArrayIteratorNextIndex(),
+          jsgraph()->ZeroConstant());
+  a.Store(AccessBuilder::ForJSArrayIteratorKind(),
+          jsgraph()->Constant(static_cast<int>(p.kind())));
+  RelaxControls(node);
+  a.FinishAndChange(node);
+  return Changed(node);
+}
+
 Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateBoundFunction, node->opcode());
   CreateBoundFunctionParameters const& p =
@@ -896,6 +955,8 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateClosure, node->opcode());
   CreateClosureParameters const& p = CreateClosureParametersOf(node->op());
   Handle<SharedFunctionInfo> shared = p.shared_info();
+  Handle<FeedbackCell> feedback_cell = p.feedback_cell();
+  Handle<Code> code = p.code();
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* context = NodeProperties::GetContextInput(node);
@@ -903,45 +964,54 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
   // Use inline allocation of closures only for instantiation sites that have
   // seen more than one instantiation, this simplifies the generated code and
   // also serves as a heuristic of which allocation sites benefit from it.
-  FeedbackSlot slot(FeedbackVector::ToSlot(p.feedback().index()));
-  Handle<Cell> vector_cell(Cell::cast(p.feedback().vector()->Get(slot)));
-  if (vector_cell->map() == isolate()->heap()->many_closures_cell_map()) {
-    Handle<Map> function_map(
-        Map::cast(native_context()->get(shared->function_map_index())));
-    Node* lazy_compile_builtin = jsgraph()->HeapConstant(
-        handle(isolate()->builtins()->builtin(Builtins::kCompileLazy)));
-    DCHECK(!function_map->IsInobjectSlackTrackingInProgress());
-    DCHECK(!function_map->is_dictionary_map());
-
-    // Emit code to allocate the JSFunction instance.
-    STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kPointerSize);
-    AllocationBuilder a(jsgraph(), effect, control);
-    a.Allocate(function_map->instance_size());
-    a.Store(AccessBuilder::ForMap(), function_map);
-    a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
-            jsgraph()->EmptyFixedArrayConstant());
-    a.Store(AccessBuilder::ForJSObjectElements(),
-            jsgraph()->EmptyFixedArrayConstant());
-    a.Store(AccessBuilder::ForJSFunctionSharedFunctionInfo(), shared);
-    a.Store(AccessBuilder::ForJSFunctionContext(), context);
-    a.Store(AccessBuilder::ForJSFunctionFeedbackVector(), vector_cell);
-    a.Store(AccessBuilder::ForJSFunctionCode(), lazy_compile_builtin);
-    STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kPointerSize);
-    if (function_map->has_prototype_slot()) {
-      a.Store(AccessBuilder::ForJSFunctionPrototypeOrInitialMap(),
-              jsgraph()->TheHoleConstant());
-      STATIC_ASSERT(JSFunction::kSizeWithPrototype == 8 * kPointerSize);
-    }
-    for (int i = 0; i < function_map->GetInObjectProperties(); i++) {
-      a.Store(AccessBuilder::ForJSObjectInObjectProperty(function_map, i),
-              jsgraph()->UndefinedConstant());
-    }
-    RelaxControls(node);
-    a.FinishAndChange(node);
-    return Changed(node);
+  if (feedback_cell->map() != isolate()->heap()->many_closures_cell_map()) {
+    // The generic path can only create closures for user functions.
+    DCHECK_EQ(isolate()->builtins()->builtin(Builtins::kCompileLazy), *code);
+    return NoChange();
   }
 
-  return NoChange();
+  Handle<Map> function_map(
+      Map::cast(native_context()->get(shared->function_map_index())));
+  DCHECK(!function_map->IsInobjectSlackTrackingInProgress());
+  DCHECK(!function_map->is_dictionary_map());
+
+  // TODO(turbofan): We should use the pretenure flag from {p} here,
+  // but currently the heuristic in the parser works against us, as
+  // it marks closures like
+  //
+  //   args[l] = function(...) { ... }
+  //
+  // for old-space allocation, which doesn't always make sense. For
+  // example in case of the bluebird-parallel benchmark, where this
+  // is a core part of the *promisify* logic (see crbug.com/810132).
+  PretenureFlag pretenure = NOT_TENURED;
+
+  // Emit code to allocate the JSFunction instance.
+  STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kPointerSize);
+  AllocationBuilder a(jsgraph(), effect, control);
+  a.Allocate(function_map->instance_size(), pretenure, Type::Function());
+  a.Store(AccessBuilder::ForMap(), function_map);
+  a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
+          jsgraph()->EmptyFixedArrayConstant());
+  a.Store(AccessBuilder::ForJSObjectElements(),
+          jsgraph()->EmptyFixedArrayConstant());
+  a.Store(AccessBuilder::ForJSFunctionSharedFunctionInfo(), shared);
+  a.Store(AccessBuilder::ForJSFunctionContext(), context);
+  a.Store(AccessBuilder::ForJSFunctionFeedbackCell(), feedback_cell);
+  a.Store(AccessBuilder::ForJSFunctionCode(), code);
+  STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kPointerSize);
+  if (function_map->has_prototype_slot()) {
+    a.Store(AccessBuilder::ForJSFunctionPrototypeOrInitialMap(),
+            jsgraph()->TheHoleConstant());
+    STATIC_ASSERT(JSFunction::kSizeWithPrototype == 8 * kPointerSize);
+  }
+  for (int i = 0; i < function_map->GetInObjectProperties(); i++) {
+    a.Store(AccessBuilder::ForJSObjectInObjectProperty(function_map, i),
+            jsgraph()->UndefinedConstant());
+  }
+  RelaxControls(node);
+  a.FinishAndChange(node);
+  return Changed(node);
 }
 
 Reduction JSCreateLowering::ReduceJSCreateIterResultObject(Node* node) {
@@ -968,6 +1038,28 @@ Reduction JSCreateLowering::ReduceJSCreateIterResultObject(Node* node) {
   return Changed(node);
 }
 
+Reduction JSCreateLowering::ReduceJSCreateStringIterator(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCreateStringIterator, node->opcode());
+  Node* string = NodeProperties::GetValueInput(node, 0);
+  Node* effect = NodeProperties::GetEffectInput(node);
+
+  Node* map = jsgraph()->HeapConstant(
+      handle(native_context()->string_iterator_map(), isolate()));
+  // Allocate new iterator and attach the iterator to this string.
+  AllocationBuilder a(jsgraph(), effect, graph()->start());
+  a.Allocate(JSStringIterator::kSize, NOT_TENURED, Type::OtherObject());
+  a.Store(AccessBuilder::ForMap(), map);
+  a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
+          jsgraph()->EmptyFixedArrayConstant());
+  a.Store(AccessBuilder::ForJSObjectElements(),
+          jsgraph()->EmptyFixedArrayConstant());
+  a.Store(AccessBuilder::ForJSStringIteratorString(), string);
+  a.Store(AccessBuilder::ForJSStringIteratorIndex(), jsgraph()->SmiConstant(0));
+  STATIC_ASSERT(JSIteratorResult::kSize == 5 * kPointerSize);
+  a.FinishAndChange(node);
+  return Changed(node);
+}
+
 Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateKeyValueArray, node->opcode());
   Node* key = NodeProperties::GetValueInput(node, 0);
@@ -998,6 +1090,34 @@ Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
   return Changed(node);
 }
 
+Reduction JSCreateLowering::ReduceJSCreatePromise(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCreatePromise, node->opcode());
+  Node* effect = NodeProperties::GetEffectInput(node);
+
+  Handle<Map> promise_map(native_context()->promise_function()->initial_map());
+
+  AllocationBuilder a(jsgraph(), effect, graph()->start());
+  a.Allocate(promise_map->instance_size());
+  a.Store(AccessBuilder::ForMap(), promise_map);
+  a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
+          jsgraph()->EmptyFixedArrayConstant());
+  a.Store(AccessBuilder::ForJSObjectElements(),
+          jsgraph()->EmptyFixedArrayConstant());
+  a.Store(AccessBuilder::ForJSObjectOffset(JSPromise::kReactionsOrResultOffset),
+          jsgraph()->ZeroConstant());
+  STATIC_ASSERT(v8::Promise::kPending == 0);
+  a.Store(AccessBuilder::ForJSObjectOffset(JSPromise::kFlagsOffset),
+          jsgraph()->ZeroConstant());
+  STATIC_ASSERT(JSPromise::kSize == 5 * kPointerSize);
+  for (int i = 0; i < v8::Promise::kEmbedderFieldCount; ++i) {
+    a.Store(
+        AccessBuilder::ForJSObjectOffset(JSPromise::kSize + i * kPointerSize),
+        jsgraph()->ZeroConstant());
+  }
+  a.FinishAndChange(node);
+  return Changed(node);
+}
+
 Reduction JSCreateLowering::ReduceJSCreateLiteralArrayOrObject(Node* node) {
   DCHECK(node->opcode() == IrOpcode::kJSCreateLiteralArray ||
          node->opcode() == IrOpcode::kJSCreateLiteralObject);
@@ -1121,7 +1241,7 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
       default:
         UNREACHABLE();
     }
-    a.AllocateArray(context_length, map);
+    a.AllocateContext(context_length, map);
     a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
     a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
     a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
@@ -1140,7 +1260,7 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
 
 Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateWithContext, node->opcode());
-  Handle<ScopeInfo> scope_info = OpParameter<Handle<ScopeInfo>>(node);
+  Handle<ScopeInfo> scope_info = ScopeInfoOf(node->op());
   Node* object = NodeProperties::GetValueInput(node, 0);
   Node* closure = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
@@ -1156,7 +1276,7 @@ Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
 
   AllocationBuilder a(jsgraph(), extension, control);
   STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
-  a.AllocateArray(Context::MIN_CONTEXT_SLOTS, factory()->with_context_map());
+  a.AllocateContext(Context::MIN_CONTEXT_SLOTS, factory()->with_context_map());
   a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
   a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
   a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
@@ -1188,8 +1308,8 @@ Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
 
   AllocationBuilder a(jsgraph(), extension, control);
   STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
-  a.AllocateArray(Context::MIN_CONTEXT_SLOTS + 1,
-                  factory()->catch_context_map());
+  a.AllocateContext(Context::MIN_CONTEXT_SLOTS + 1,
+                    factory()->catch_context_map());
   a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
   a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
   a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
@@ -1204,7 +1324,7 @@ Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
 
 Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateBlockContext, node->opcode());
-  Handle<ScopeInfo> scope_info = OpParameter<Handle<ScopeInfo>>(node);
+  Handle<ScopeInfo> scope_info = ScopeInfoOf(node->op());
   int const context_length = scope_info->ContextLength();
   Node* const closure = NodeProperties::GetValueInput(node, 0);
 
@@ -1218,7 +1338,7 @@ Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
 
     AllocationBuilder a(jsgraph(), effect, control);
     STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
-    a.AllocateArray(context_length, factory()->block_context_map());
+    a.AllocateContext(context_length, factory()->block_context_map());
     a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
     a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
     a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
@@ -1239,7 +1359,7 @@ Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
 // given {frame_state}. Serves as backing store for JSCreateArguments nodes.
 Node* JSCreateLowering::AllocateArguments(Node* effect, Node* control,
                                           Node* frame_state) {
-  FrameStateInfo state_info = OpParameter<FrameStateInfo>(frame_state);
+  FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
   int argument_count = state_info.parameter_count() - 1;  // Minus receiver.
   if (argument_count == 0) return jsgraph()->EmptyFixedArrayConstant();
 
@@ -1263,7 +1383,7 @@ Node* JSCreateLowering::AllocateArguments(Node* effect, Node* control,
 Node* JSCreateLowering::AllocateRestArguments(Node* effect, Node* control,
                                               Node* frame_state,
                                               int start_index) {
-  FrameStateInfo state_info = OpParameter<FrameStateInfo>(frame_state);
+  FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
   int argument_count = state_info.parameter_count() - 1;  // Minus receiver.
   int num_elements = std::max(0, argument_count - start_index);
   if (num_elements == 0) return jsgraph()->EmptyFixedArrayConstant();
@@ -1294,7 +1414,7 @@ Node* JSCreateLowering::AllocateRestArguments(Node* effect, Node* control,
 Node* JSCreateLowering::AllocateAliasedArguments(
     Node* effect, Node* control, Node* frame_state, Node* context,
     Handle<SharedFunctionInfo> shared, bool* has_aliased_arguments) {
-  FrameStateInfo state_info = OpParameter<FrameStateInfo>(frame_state);
+  FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
   int argument_count = state_info.parameter_count() - 1;  // Minus receiver.
   if (argument_count == 0) return jsgraph()->EmptyFixedArrayConstant();
 
diff --git a/deps/v8/src/compiler/js-create-lowering.h b/deps/v8/src/compiler/js-create-lowering.h
index 42b4740dd02..7e3ec22820a 100644
--- a/deps/v8/src/compiler/js-create-lowering.h
+++ b/deps/v8/src/compiler/js-create-lowering.h
@@ -50,10 +50,13 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
   Reduction ReduceJSCreate(Node* node);
   Reduction ReduceJSCreateArguments(Node* node);
   Reduction ReduceJSCreateArray(Node* node);
+  Reduction ReduceJSCreateArrayIterator(Node* node);
   Reduction ReduceJSCreateBoundFunction(Node* node);
   Reduction ReduceJSCreateClosure(Node* node);
   Reduction ReduceJSCreateIterResultObject(Node* node);
+  Reduction ReduceJSCreateStringIterator(Node* node);
   Reduction ReduceJSCreateKeyValueArray(Node* node);
+  Reduction ReduceJSCreatePromise(Node* node);
   Reduction ReduceJSCreateLiteralArrayOrObject(Node* node);
   Reduction ReduceJSCreateEmptyLiteralObject(Node* node);
   Reduction ReduceJSCreateEmptyLiteralArray(Node* node);
diff --git a/deps/v8/src/compiler/js-generic-lowering.cc b/deps/v8/src/compiler/js-generic-lowering.cc
index c09dcbc1b3d..e978c1bb3d1 100644
--- a/deps/v8/src/compiler/js-generic-lowering.cc
+++ b/deps/v8/src/compiler/js-generic-lowering.cc
@@ -14,6 +14,8 @@
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/operator-properties.h"
+#include "src/feedback-vector.h"
+#include "src/objects/scope-info.h"
 
 namespace v8 {
 namespace internal {
@@ -85,6 +87,11 @@ REPLACE_STUB_CALL(ToName)
 REPLACE_STUB_CALL(ToObject)
 REPLACE_STUB_CALL(ToString)
 REPLACE_STUB_CALL(ForInEnumerate)
+REPLACE_STUB_CALL(FulfillPromise)
+REPLACE_STUB_CALL(PerformPromiseThen)
+REPLACE_STUB_CALL(PromiseResolve)
+REPLACE_STUB_CALL(RejectPromise)
+REPLACE_STUB_CALL(ResolvePromise)
 #undef REPLACE_STUB_CALL
 
 void JSGenericLowering::ReplaceWithStubCall(Node* node, Callable callable,
@@ -97,12 +104,12 @@ void JSGenericLowering::ReplaceWithStubCall(Node* node, Callable callable,
                                             Operator::Properties properties,
                                             int result_size) {
   const CallInterfaceDescriptor& descriptor = callable.descriptor();
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), descriptor, descriptor.GetStackParameterCount(), flags,
       properties, MachineType::AnyTagged(), result_size);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   node->InsertInput(zone(), 0, stub_code);
-  NodeProperties::ChangeOp(node, common()->Call(desc));
+  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
 }
 
 
@@ -113,14 +120,14 @@ void JSGenericLowering::ReplaceWithRuntimeCall(Node* node,
   Operator::Properties properties = node->op()->properties();
   const Runtime::Function* fun = Runtime::FunctionForId(f);
   int nargs = (nargs_override < 0) ? fun->nargs : nargs_override;
-  CallDescriptor* desc =
+  auto call_descriptor =
       Linkage::GetRuntimeCallDescriptor(zone(), f, nargs, properties, flags);
   Node* ref = jsgraph()->ExternalConstant(ExternalReference(f, isolate()));
   Node* arity = jsgraph()->Int32Constant(nargs);
   node->InsertInput(zone(), 0, jsgraph()->CEntryStubConstant(fun->result_size));
   node->InsertInput(zone(), nargs + 1, ref);
   node->InsertInput(zone(), nargs + 2, arity);
-  NodeProperties::ChangeOp(node, common()->Call(desc));
+  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
 }
 
 void JSGenericLowering::LowerJSStrictEqual(Node* node) {
@@ -274,6 +281,16 @@ void JSGenericLowering::LowerJSStoreDataPropertyInLiteral(Node* node) {
   ReplaceWithRuntimeCall(node, Runtime::kDefineDataPropertyInLiteral);
 }
 
+void JSGenericLowering::LowerJSStoreInArrayLiteral(Node* node) {
+  Callable callable =
+      Builtins::CallableFor(isolate(), Builtins::kStoreInArrayLiteralIC);
+  CallDescriptor::Flags flags = FrameStateFlagForCall(node);
+  FeedbackParameter const& p = FeedbackParameterOf(node->op());
+  node->InsertInput(zone(), 3, jsgraph()->SmiConstant(p.feedback().index()));
+  node->InsertInput(zone(), 4, jsgraph()->HeapConstant(p.feedback().vector()));
+  ReplaceWithStubCall(node, callable, flags);
+}
+
 void JSGenericLowering::LowerJSDeleteProperty(Node* node) {
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
   Callable callable =
@@ -344,7 +361,7 @@ void JSGenericLowering::LowerJSCreateArray(Node* node) {
   int const arity = static_cast<int>(p.arity());
   Handle<AllocationSite> const site = p.site();
   ArrayConstructorDescriptor descriptor(isolate());
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), descriptor, arity + 1,
       CallDescriptor::kNeedsFrameState, node->op()->properties(),
       MachineType::AnyTagged());
@@ -357,7 +374,11 @@ void JSGenericLowering::LowerJSCreateArray(Node* node) {
   node->InsertInput(zone(), 3, stub_arity);
   node->InsertInput(zone(), 4, type_info);
   node->InsertInput(zone(), 5, receiver);
-  NodeProperties::ChangeOp(node, common()->Call(desc));
+  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+}
+
+void JSGenericLowering::LowerJSCreateArrayIterator(Node* node) {
+  UNREACHABLE();  // Eliminated in typed lowering.
 }
 
 void JSGenericLowering::LowerJSCreateBoundFunction(Node* node) {
@@ -366,26 +387,19 @@ void JSGenericLowering::LowerJSCreateBoundFunction(Node* node) {
 
 void JSGenericLowering::LowerJSCreateClosure(Node* node) {
   CreateClosureParameters const& p = CreateClosureParametersOf(node->op());
-  CallDescriptor::Flags flags = FrameStateFlagForCall(node);
   Handle<SharedFunctionInfo> const shared_info = p.shared_info();
   node->InsertInput(zone(), 0, jsgraph()->HeapConstant(shared_info));
-  node->RemoveInput(3);  // control
+  node->InsertInput(zone(), 1, jsgraph()->HeapConstant(p.feedback_cell()));
+  node->RemoveInput(4);  // control
 
   // Use the FastNewClosure builtin only for functions allocated in new space.
   if (p.pretenure() == NOT_TENURED) {
     Callable callable =
         Builtins::CallableFor(isolate(), Builtins::kFastNewClosure);
-    node->InsertInput(zone(), 1,
-                      jsgraph()->HeapConstant(p.feedback().vector()));
-    node->InsertInput(zone(), 2, jsgraph()->SmiConstant(p.feedback().index()));
+    CallDescriptor::Flags flags = FrameStateFlagForCall(node);
     ReplaceWithStubCall(node, callable, flags);
   } else {
-    node->InsertInput(zone(), 1,
-                      jsgraph()->HeapConstant(p.feedback().vector()));
-    node->InsertInput(zone(), 2, jsgraph()->SmiConstant(p.feedback().index()));
-    ReplaceWithRuntimeCall(node, (p.pretenure() == TENURED)
-                                     ? Runtime::kNewClosure_Tenured
-                                     : Runtime::kNewClosure);
+    ReplaceWithRuntimeCall(node, Runtime::kNewClosure_Tenured);
   }
 }
 
@@ -420,10 +434,25 @@ void JSGenericLowering::LowerJSCreateIterResultObject(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
 
+void JSGenericLowering::LowerJSCreateStringIterator(Node* node) {
+  UNREACHABLE();  // Eliminated in typed lowering.
+}
+
 void JSGenericLowering::LowerJSCreateKeyValueArray(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
 
+void JSGenericLowering::LowerJSCreatePromise(Node* node) {
+  UNREACHABLE();  // Eliminated in typed lowering.
+}
+
+void JSGenericLowering::LowerJSCreateTypedArray(Node* node) {
+  CallDescriptor::Flags flags = FrameStateFlagForCall(node);
+  Callable callable =
+      Builtins::CallableFor(isolate(), Builtins::kCreateTypedArray);
+  ReplaceWithStubCall(node, callable, flags);
+}
+
 void JSGenericLowering::LowerJSCreateLiteralArray(Node* node) {
   CreateLiteralParameters const& p = CreateLiteralParametersOf(node->op());
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
@@ -502,7 +531,7 @@ void JSGenericLowering::LowerJSCreateWithContext(Node* node) {
 }
 
 void JSGenericLowering::LowerJSCreateBlockContext(Node* node) {
-  Handle<ScopeInfo> scope_info = OpParameter<Handle<ScopeInfo>>(node);
+  Handle<ScopeInfo> scope_info = ScopeInfoOf(node->op());
   node->InsertInput(zone(), 0, jsgraph()->HeapConstant(scope_info));
   ReplaceWithRuntimeCall(node, Runtime::kPushBlockContext);
 }
@@ -514,7 +543,7 @@ void JSGenericLowering::LowerJSConstructForwardVarargs(Node* node) {
   int const arg_count = static_cast<int>(p.arity() - 2);
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
   Callable callable = CodeFactory::ConstructForwardVarargs(isolate());
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), callable.descriptor(), arg_count + 1, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   Node* stub_arity = jsgraph()->Int32Constant(arg_count);
@@ -527,7 +556,7 @@ void JSGenericLowering::LowerJSConstructForwardVarargs(Node* node) {
   node->InsertInput(zone(), 3, stub_arity);
   node->InsertInput(zone(), 4, start_index);
   node->InsertInput(zone(), 5, receiver);
-  NodeProperties::ChangeOp(node, common()->Call(desc));
+  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
 }
 
 void JSGenericLowering::LowerJSConstruct(Node* node) {
@@ -535,7 +564,7 @@ void JSGenericLowering::LowerJSConstruct(Node* node) {
   int const arg_count = static_cast<int>(p.arity() - 2);
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
   Callable callable = CodeFactory::Construct(isolate());
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), callable.descriptor(), arg_count + 1, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   Node* stub_arity = jsgraph()->Int32Constant(arg_count);
@@ -546,14 +575,14 @@ void JSGenericLowering::LowerJSConstruct(Node* node) {
   node->InsertInput(zone(), 2, new_target);
   node->InsertInput(zone(), 3, stub_arity);
   node->InsertInput(zone(), 4, receiver);
-  NodeProperties::ChangeOp(node, common()->Call(desc));
+  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
 }
 
 void JSGenericLowering::LowerJSConstructWithArrayLike(Node* node) {
   Callable callable =
       Builtins::CallableFor(isolate(), Builtins::kConstructWithArrayLike);
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), callable.descriptor(), 1, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   Node* receiver = jsgraph()->UndefinedConstant();
@@ -563,7 +592,7 @@ void JSGenericLowering::LowerJSConstructWithArrayLike(Node* node) {
   node->ReplaceInput(2, new_target);
   node->ReplaceInput(3, arguments_list);
   node->InsertInput(zone(), 4, receiver);
-  NodeProperties::ChangeOp(node, common()->Call(desc));
+  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
 }
 
 void JSGenericLowering::LowerJSConstructWithSpread(Node* node) {
@@ -573,7 +602,7 @@ void JSGenericLowering::LowerJSConstructWithSpread(Node* node) {
   int const new_target_index = arg_count + 1;
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
   Callable callable = CodeFactory::ConstructWithSpread(isolate());
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), callable.descriptor(), arg_count, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   Node* stack_arg_count = jsgraph()->Int32Constant(arg_count - 1);
@@ -589,7 +618,7 @@ void JSGenericLowering::LowerJSConstructWithSpread(Node* node) {
   node->InsertInput(zone(), 3, stack_arg_count);
   node->InsertInput(zone(), 4, spread);
   node->InsertInput(zone(), 5, receiver);
-  NodeProperties::ChangeOp(node, common()->Call(desc));
+  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
 }
 
 void JSGenericLowering::LowerJSCallForwardVarargs(Node* node) {
@@ -597,7 +626,7 @@ void JSGenericLowering::LowerJSCallForwardVarargs(Node* node) {
   int const arg_count = static_cast<int>(p.arity() - 2);
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
   Callable callable = CodeFactory::CallForwardVarargs(isolate());
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), callable.descriptor(), arg_count + 1, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   Node* stub_arity = jsgraph()->Int32Constant(arg_count);
@@ -605,7 +634,7 @@ void JSGenericLowering::LowerJSCallForwardVarargs(Node* node) {
   node->InsertInput(zone(), 0, stub_code);
   node->InsertInput(zone(), 2, stub_arity);
   node->InsertInput(zone(), 3, start_index);
-  NodeProperties::ChangeOp(node, common()->Call(desc));
+  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
 }
 
 void JSGenericLowering::LowerJSCall(Node* node) {
@@ -614,19 +643,19 @@ void JSGenericLowering::LowerJSCall(Node* node) {
   ConvertReceiverMode const mode = p.convert_mode();
   Callable callable = CodeFactory::Call(isolate(), mode);
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), callable.descriptor(), arg_count + 1, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   Node* stub_arity = jsgraph()->Int32Constant(arg_count);
   node->InsertInput(zone(), 0, stub_code);
   node->InsertInput(zone(), 2, stub_arity);
-  NodeProperties::ChangeOp(node, common()->Call(desc));
+  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
 }
 
 void JSGenericLowering::LowerJSCallWithArrayLike(Node* node) {
   Callable callable = CodeFactory::CallWithArrayLike(isolate());
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), callable.descriptor(), 1, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   Node* receiver = node->InputAt(1);
@@ -634,7 +663,7 @@ void JSGenericLowering::LowerJSCallWithArrayLike(Node* node) {
   node->InsertInput(zone(), 0, stub_code);
   node->ReplaceInput(3, receiver);
   node->ReplaceInput(2, arguments_list);
-  NodeProperties::ChangeOp(node, common()->Call(desc));
+  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
 }
 
 void JSGenericLowering::LowerJSCallWithSpread(Node* node) {
@@ -643,7 +672,7 @@ void JSGenericLowering::LowerJSCallWithSpread(Node* node) {
   int const spread_index = static_cast<int>(p.arity() + 1);
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
   Callable callable = CodeFactory::CallWithSpread(isolate());
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), callable.descriptor(), arg_count, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   // We pass the spread in a register, not on the stack.
@@ -652,7 +681,7 @@ void JSGenericLowering::LowerJSCallWithSpread(Node* node) {
   node->InsertInput(zone(), 2, stack_arg_count);
   node->InsertInput(zone(), 3, node->InputAt(spread_index));
   node->RemoveInput(spread_index + 1);
-  NodeProperties::ChangeOp(node, common()->Call(desc));
+  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
 }
 
 void JSGenericLowering::LowerJSCallRuntime(Node* node) {
@@ -693,6 +722,10 @@ void JSGenericLowering::LowerJSGeneratorRestoreContinuation(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
 
+void JSGenericLowering::LowerJSGeneratorRestoreContext(Node* node) {
+  UNREACHABLE();  // Eliminated in typed lowering.
+}
+
 void JSGenericLowering::LowerJSGeneratorRestoreInputOrDebugPos(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
diff --git a/deps/v8/src/compiler/js-graph.h b/deps/v8/src/compiler/js-graph.h
index f5b4bdc181c..9bbe2178fb3 100644
--- a/deps/v8/src/compiler/js-graph.h
+++ b/deps/v8/src/compiler/js-graph.h
@@ -217,4 +217,4 @@ class V8_EXPORT_PRIVATE JSGraph : public NON_EXPORTED_BASE(ZoneObject) {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_COMPILER_JS_GRAPH_H_
diff --git a/deps/v8/src/compiler/js-inlining-heuristic.cc b/deps/v8/src/compiler/js-inlining-heuristic.cc
index c9909dcb75f..0829e5b6006 100644
--- a/deps/v8/src/compiler/js-inlining-heuristic.cc
+++ b/deps/v8/src/compiler/js-inlining-heuristic.cc
@@ -107,7 +107,7 @@ Reduction JSInliningHeuristic::Reduce(Node* node) {
   bool can_inline = false, small_inline = true;
   candidate.total_size = 0;
   Node* frame_state = NodeProperties::GetFrameStateInput(node);
-  FrameStateInfo const& frame_info = OpParameter<FrameStateInfo>(frame_state);
+  FrameStateInfo const& frame_info = FrameStateInfoOf(frame_state->op());
   Handle<SharedFunctionInfo> frame_shared_info;
   for (int i = 0; i < candidate.num_functions; ++i) {
     Handle<SharedFunctionInfo> shared =
diff --git a/deps/v8/src/compiler/js-inlining.cc b/deps/v8/src/compiler/js-inlining.cc
index add2b2c478b..57b5c5463d5 100644
--- a/deps/v8/src/compiler/js-inlining.cc
+++ b/deps/v8/src/compiler/js-inlining.cc
@@ -270,13 +270,6 @@ bool NeedsImplicitReceiver(Handle<SharedFunctionInfo> shared_info) {
   }
 }
 
-bool IsNonConstructible(Handle<SharedFunctionInfo> shared_info) {
-  DisallowHeapAllocation no_gc;
-  Isolate* const isolate = shared_info->GetIsolate();
-  Code* const construct_stub = shared_info->construct_stub();
-  return construct_stub == *BUILTIN_CODE(isolate, ConstructedNonConstructable);
-}
-
 }  // namespace
 
 // Determines whether the call target of the given call {node} is statically
@@ -323,8 +316,7 @@ bool JSInliner::DetermineCallTarget(
     // target.
     // TODO(turbofan): We might consider to eagerly create the feedback vector
     // in such a case (in {DetermineCallContext} below) eventually.
-    FeedbackSlot slot = p.feedback().slot();
-    Handle<Cell> cell(Cell::cast(p.feedback().vector()->Get(slot)));
+    Handle<FeedbackCell> cell = p.feedback_cell();
     if (!cell->value()->IsFeedbackVector()) return false;
 
     shared_info_out = p.shared_info();
@@ -348,9 +340,9 @@ void JSInliner::DetermineCallContext(
   if (match.HasValue() && match.Value()->IsJSFunction()) {
     Handle<JSFunction> function = Handle<JSFunction>::cast(match.Value());
 
-    // If the target function was never invoked, its literals array might not
-    // contain a feedback vector. We ensure at this point that it is created.
-    JSFunction::EnsureLiterals(function);
+    // If the target function was never invoked, its feedback cell array might
+    // not contain a feedback vector. We ensure at this point that it's created.
+    JSFunction::EnsureFeedbackVector(function);
 
     // The inlinee specializes to the context from the JSFunction object.
     context_out = jsgraph()->Constant(handle(function->context()));
@@ -363,8 +355,7 @@ void JSInliner::DetermineCallContext(
 
     // Load the feedback vector of the target by looking up its vector cell at
     // the instantiation site (we only decide to inline if it's populated).
-    FeedbackSlot slot = p.feedback().slot();
-    Handle<Cell> cell(Cell::cast(p.feedback().vector()->Get(slot)));
+    Handle<FeedbackCell> cell = p.feedback_cell();
     DCHECK(cell->value()->IsFeedbackVector());
 
     // The inlinee uses the locally provided context at instantiation.
@@ -404,7 +395,7 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
 
   // Constructor must be constructable.
   if (node->opcode() == IrOpcode::kJSConstruct &&
-      IsNonConstructible(shared_info)) {
+      !IsConstructable(shared_info->kind())) {
     TRACE("Not inlining %s into %s because constructor is not constructable.\n",
           shared_info->DebugName()->ToCString().get(),
           info_->shared_info()->DebugName()->ToCString().get());
@@ -498,7 +489,7 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
     BytecodeGraphBuilder graph_builder(
         zone(), shared_info, feedback_vector, BailoutId::None(), jsgraph(),
         call.frequency(), source_positions_, native_context(), inlining_id,
-        flags, false);
+        flags, false, info_->is_analyze_environment_liveness());
     graph_builder.CreateGraph();
 
     // Extract the inlinee start/end nodes.
diff --git a/deps/v8/src/compiler/js-intrinsic-lowering.cc b/deps/v8/src/compiler/js-intrinsic-lowering.cc
index dc1ec521f22..c570a1f8ddc 100644
--- a/deps/v8/src/compiler/js-intrinsic-lowering.cc
+++ b/deps/v8/src/compiler/js-intrinsic-lowering.cc
@@ -41,6 +41,14 @@ Reduction JSIntrinsicLowering::Reduce(Node* node) {
       return ReduceCreateJSGeneratorObject(node);
     case Runtime::kInlineGeneratorGetInputOrDebugPos:
       return ReduceGeneratorGetInputOrDebugPos(node);
+    case Runtime::kInlineAsyncFunctionAwaitCaught:
+      return ReduceAsyncFunctionAwaitCaught(node);
+    case Runtime::kInlineAsyncFunctionAwaitUncaught:
+      return ReduceAsyncFunctionAwaitUncaught(node);
+    case Runtime::kInlineAsyncGeneratorAwaitCaught:
+      return ReduceAsyncGeneratorAwaitCaught(node);
+    case Runtime::kInlineAsyncGeneratorAwaitUncaught:
+      return ReduceAsyncGeneratorAwaitUncaught(node);
     case Runtime::kInlineAsyncGeneratorReject:
       return ReduceAsyncGeneratorReject(node);
     case Runtime::kInlineAsyncGeneratorResolve:
@@ -49,8 +57,6 @@ Reduction JSIntrinsicLowering::Reduce(Node* node) {
       return ReduceAsyncGeneratorYield(node);
     case Runtime::kInlineGeneratorGetResumeMode:
       return ReduceGeneratorGetResumeMode(node);
-    case Runtime::kInlineGeneratorGetContext:
-      return ReduceGeneratorGetContext(node);
     case Runtime::kInlineIsArray:
       return ReduceIsInstanceType(node, JS_ARRAY_TYPE);
     case Runtime::kInlineIsTypedArray:
@@ -69,6 +75,10 @@ Reduction JSIntrinsicLowering::Reduce(Node* node) {
       return ReduceIsJSReceiver(node);
     case Runtime::kInlineIsSmi:
       return ReduceIsSmi(node);
+    case Runtime::kInlineRejectPromise:
+      return ReduceRejectPromise(node);
+    case Runtime::kInlineResolvePromise:
+      return ReduceResolvePromise(node);
     case Runtime::kInlineToInteger:
       return ReduceToInteger(node);
     case Runtime::kInlineToLength:
@@ -83,12 +93,6 @@ Reduction JSIntrinsicLowering::Reduce(Node* node) {
       return ReduceCall(node);
     case Runtime::kInlineGetSuperConstructor:
       return ReduceGetSuperConstructor(node);
-    case Runtime::kInlineArrayBufferViewGetByteLength:
-      return ReduceArrayBufferViewField(
-          node, AccessBuilder::ForJSArrayBufferViewByteLength());
-    case Runtime::kInlineArrayBufferViewGetByteOffset:
-      return ReduceArrayBufferViewField(
-          node, AccessBuilder::ForJSArrayBufferViewByteOffset());
     case Runtime::kInlineArrayBufferViewWasNeutered:
       return ReduceArrayBufferViewWasNeutered(node);
     case Runtime::kInlineMaxSmi:
@@ -98,8 +102,6 @@ Reduction JSIntrinsicLowering::Reduce(Node* node) {
                                         AccessBuilder::ForJSTypedArrayLength());
     case Runtime::kInlineTheHole:
       return ReduceTheHole(node);
-    case Runtime::kInlineClassOf:
-      return ReduceClassOf(node);
     case Runtime::kInlineStringMaxLength:
       return ReduceStringMaxLength(node);
     default:
@@ -183,6 +185,33 @@ Reduction JSIntrinsicLowering::ReduceGeneratorGetInputOrDebugPos(Node* node) {
   return Change(node, op, generator, effect, control);
 }
 
+Reduction JSIntrinsicLowering::ReduceAsyncFunctionAwaitCaught(Node* node) {
+  return Change(
+      node,
+      Builtins::CallableFor(isolate(), Builtins::kAsyncFunctionAwaitCaught), 0);
+}
+
+Reduction JSIntrinsicLowering::ReduceAsyncFunctionAwaitUncaught(Node* node) {
+  return Change(
+      node,
+      Builtins::CallableFor(isolate(), Builtins::kAsyncFunctionAwaitUncaught),
+      0);
+}
+
+Reduction JSIntrinsicLowering::ReduceAsyncGeneratorAwaitCaught(Node* node) {
+  return Change(
+      node,
+      Builtins::CallableFor(isolate(), Builtins::kAsyncGeneratorAwaitCaught),
+      0);
+}
+
+Reduction JSIntrinsicLowering::ReduceAsyncGeneratorAwaitUncaught(Node* node) {
+  return Change(
+      node,
+      Builtins::CallableFor(isolate(), Builtins::kAsyncGeneratorAwaitUncaught),
+      0);
+}
+
 Reduction JSIntrinsicLowering::ReduceAsyncGeneratorReject(Node* node) {
   return Change(
       node, Builtins::CallableFor(isolate(), Builtins::kAsyncGeneratorReject),
@@ -201,16 +230,6 @@ Reduction JSIntrinsicLowering::ReduceAsyncGeneratorYield(Node* node) {
       0);
 }
 
-Reduction JSIntrinsicLowering::ReduceGeneratorGetContext(Node* node) {
-  Node* const generator = NodeProperties::GetValueInput(node, 0);
-  Node* const effect = NodeProperties::GetEffectInput(node);
-  Node* const control = NodeProperties::GetControlInput(node);
-  Operator const* const op =
-      simplified()->LoadField(AccessBuilder::ForJSGeneratorObjectContext());
-
-  return Change(node, op, generator, effect, control);
-}
-
 Reduction JSIntrinsicLowering::ReduceGeneratorGetResumeMode(Node* node) {
   Node* const generator = NodeProperties::GetValueInput(node, 0);
   Node* const effect = NodeProperties::GetEffectInput(node);
@@ -272,6 +291,17 @@ Reduction JSIntrinsicLowering::ReduceIsSmi(Node* node) {
   return Change(node, simplified()->ObjectIsSmi());
 }
 
+Reduction JSIntrinsicLowering::ReduceRejectPromise(Node* node) {
+  RelaxControls(node);
+  NodeProperties::ChangeOp(node, javascript()->RejectPromise());
+  return Changed(node);
+}
+
+Reduction JSIntrinsicLowering::ReduceResolvePromise(Node* node) {
+  RelaxControls(node);
+  NodeProperties::ChangeOp(node, javascript()->ResolvePromise());
+  return Changed(node);
+}
 
 Reduction JSIntrinsicLowering::Change(Node* node, const Operator* op) {
   // Replace all effect uses of {node} with the effect dependency.
@@ -384,16 +414,6 @@ Reduction JSIntrinsicLowering::ReduceTheHole(Node* node) {
   return Replace(value);
 }
 
-Reduction JSIntrinsicLowering::ReduceClassOf(Node* node) {
-  RelaxEffectsAndControls(node);
-  // The ClassOf operator has a single value input and control input.
-  Node* control_input = NodeProperties::GetControlInput(node, 0);
-  node->TrimInputCount(2);
-  node->ReplaceInput(1, control_input);
-  NodeProperties::ChangeOp(node, simplified()->ClassOf());
-  return Changed(node);
-}
-
 Reduction JSIntrinsicLowering::ReduceStringMaxLength(Node* node) {
   Node* value = jsgraph()->Constant(String::kMaxLength);
   ReplaceWithValue(node, value);
@@ -438,12 +458,12 @@ Reduction JSIntrinsicLowering::Change(Node* node, const Operator* op, Node* a,
 
 Reduction JSIntrinsicLowering::Change(Node* node, Callable const& callable,
                                       int stack_parameter_count) {
-  CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), callable.descriptor(), stack_parameter_count,
       CallDescriptor::kNeedsFrameState, node->op()->properties());
   node->InsertInput(graph()->zone(), 0,
                     jsgraph()->HeapConstant(callable.code()));
-  NodeProperties::ChangeOp(node, common()->Call(desc));
+  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
   return Changed(node);
 }
 
diff --git a/deps/v8/src/compiler/js-intrinsic-lowering.h b/deps/v8/src/compiler/js-intrinsic-lowering.h
index 81cf5467d5d..fb745986a60 100644
--- a/deps/v8/src/compiler/js-intrinsic-lowering.h
+++ b/deps/v8/src/compiler/js-intrinsic-lowering.h
@@ -44,8 +44,11 @@ class V8_EXPORT_PRIVATE JSIntrinsicLowering final
   Reduction ReduceDeoptimizeNow(Node* node);
   Reduction ReduceCreateJSGeneratorObject(Node* node);
   Reduction ReduceGeneratorClose(Node* node);
-  Reduction ReduceGeneratorGetContext(Node* node);
   Reduction ReduceGeneratorGetInputOrDebugPos(Node* node);
+  Reduction ReduceAsyncFunctionAwaitCaught(Node* node);
+  Reduction ReduceAsyncFunctionAwaitUncaught(Node* node);
+  Reduction ReduceAsyncGeneratorAwaitCaught(Node* node);
+  Reduction ReduceAsyncGeneratorAwaitUncaught(Node* node);
   Reduction ReduceAsyncGeneratorReject(Node* node);
   Reduction ReduceAsyncGeneratorResolve(Node* node);
   Reduction ReduceAsyncGeneratorYield(Node* node);
@@ -54,6 +57,8 @@ class V8_EXPORT_PRIVATE JSIntrinsicLowering final
   Reduction ReduceIsInstanceType(Node* node, InstanceType instance_type);
   Reduction ReduceIsJSReceiver(Node* node);
   Reduction ReduceIsSmi(Node* node);
+  Reduction ReduceRejectPromise(Node* node);
+  Reduction ReduceResolvePromise(Node* node);
   Reduction ReduceToInteger(Node* node);
   Reduction ReduceToLength(Node* node);
   Reduction ReduceToNumber(Node* node);
@@ -72,9 +77,6 @@ class V8_EXPORT_PRIVATE JSIntrinsicLowering final
   // converted to proper CodeStubAssembler based builtins.
   Reduction ReduceTheHole(Node* node);
 
-  // TODO(turbofan): JavaScript builtins support; drop once all uses of
-  // %_ClassOf in JavaScript builtins are eliminated.
-  Reduction ReduceClassOf(Node* node);
   Reduction ReduceStringMaxLength(Node* node);
 
   Reduction Change(Node* node, const Operator* op);
diff --git a/deps/v8/src/compiler/js-native-context-specialization.cc b/deps/v8/src/compiler/js-native-context-specialization.cc
index b2f8c567e2d..60e47e025ff 100644
--- a/deps/v8/src/compiler/js-native-context-specialization.cc
+++ b/deps/v8/src/compiler/js-native-context-specialization.cc
@@ -26,6 +26,12 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
+// This is needed for gc_mole which will compile this file without the full set
+// of GN defined macros.
+#ifndef V8_TYPED_ARRAY_MAX_SIZE_IN_HEAP
+#define V8_TYPED_ARRAY_MAX_SIZE_IN_HEAP 64
+#endif
+
 namespace {
 
 bool HasNumberMaps(MapHandles const& maps) {
@@ -76,6 +82,10 @@ Reduction JSNativeContextSpecialization::Reduce(Node* node) {
       return ReduceJSHasInPrototypeChain(node);
     case IrOpcode::kJSOrdinaryHasInstance:
       return ReduceJSOrdinaryHasInstance(node);
+    case IrOpcode::kJSPromiseResolve:
+      return ReduceJSPromiseResolve(node);
+    case IrOpcode::kJSResolvePromise:
+      return ReduceJSResolvePromise(node);
     case IrOpcode::kJSLoadContext:
       return ReduceJSLoadContext(node);
     case IrOpcode::kJSLoadGlobal:
@@ -94,6 +104,8 @@ Reduction JSNativeContextSpecialization::Reduce(Node* node) {
       return ReduceJSStoreNamedOwn(node);
     case IrOpcode::kJSStoreDataPropertyInLiteral:
       return ReduceJSStoreDataPropertyInLiteral(node);
+    case IrOpcode::kJSStoreInArrayLiteral:
+      return ReduceJSStoreInArrayLiteral(node);
     default:
       break;
   }
@@ -168,7 +180,7 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
   if (m.HasValue() && m.Value()->IsJSObject()) {
     receiver = Handle<JSObject>::cast(m.Value());
   } else if (p.feedback().IsValid()) {
-    InstanceOfICNexus nexus(p.feedback().vector(), p.feedback().slot());
+    FeedbackNexus nexus(p.feedback().vector(), p.feedback().slot());
     if (!nexus.GetConstructorFeedback().ToHandle(&receiver)) return NoChange();
   } else {
     return NoChange();
@@ -411,6 +423,87 @@ Reduction JSNativeContextSpecialization::ReduceJSOrdinaryHasInstance(
   return NoChange();
 }
 
+// ES section #sec-promise-resolve
+Reduction JSNativeContextSpecialization::ReduceJSPromiseResolve(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSPromiseResolve, node->opcode());
+  Node* constructor = NodeProperties::GetValueInput(node, 0);
+  Node* value = NodeProperties::GetValueInput(node, 1);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // Check if the {constructor} is the %Promise% function.
+  HeapObjectMatcher m(constructor);
+  if (!m.Is(handle(native_context()->promise_function()))) return NoChange();
+
+  // Check if we know something about the {value}.
+  ZoneHandleSet<Map> value_maps;
+  NodeProperties::InferReceiverMapsResult result =
+      NodeProperties::InferReceiverMaps(value, effect, &value_maps);
+  if (result == NodeProperties::kNoReceiverMaps) return NoChange();
+  DCHECK_NE(0, value_maps.size());
+
+  // Check that the {value} cannot be a JSPromise.
+  for (Handle<Map> const value_map : value_maps) {
+    if (value_map->IsJSPromiseMap()) return NoChange();
+  }
+
+  // Create a %Promise% instance and resolve it with {value}.
+  Node* promise = effect =
+      graph()->NewNode(javascript()->CreatePromise(), context, effect);
+  effect = graph()->NewNode(javascript()->ResolvePromise(), promise, value,
+                            context, frame_state, effect, control);
+  ReplaceWithValue(node, promise, effect, control);
+  return Replace(promise);
+}
+
+// ES section #sec-promise-resolve-functions
+Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSResolvePromise, node->opcode());
+  Node* promise = NodeProperties::GetValueInput(node, 0);
+  Node* resolution = NodeProperties::GetValueInput(node, 1);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // Check if we know something about the {resolution}.
+  ZoneHandleSet<Map> resolution_maps;
+  NodeProperties::InferReceiverMapsResult result =
+      NodeProperties::InferReceiverMaps(resolution, effect, &resolution_maps);
+  if (result != NodeProperties::kReliableReceiverMaps) return NoChange();
+  DCHECK_NE(0, resolution_maps.size());
+
+  // Compute property access info for "then" on {resolution}.
+  PropertyAccessInfo access_info;
+  AccessInfoFactory access_info_factory(dependencies(), native_context(),
+                                        graph()->zone());
+  if (!access_info_factory.ComputePropertyAccessInfo(
+          MapHandles(resolution_maps.begin(), resolution_maps.end()),
+          factory()->then_string(), AccessMode::kLoad, &access_info)) {
+    return NoChange();
+  }
+
+  // We can further optimize the case where {resolution}
+  // definitely doesn't have a "then" property.
+  if (!access_info.IsNotFound()) return NoChange();
+  PropertyAccessBuilder access_builder(jsgraph(), dependencies());
+
+  // Add proper dependencies on the {resolution}s [[Prototype]]s.
+  Handle<JSObject> holder;
+  if (access_info.holder().ToHandle(&holder)) {
+    access_builder.AssumePrototypesStable(native_context(),
+                                          access_info.receiver_maps(), holder);
+  }
+
+  // Simply fulfill the {promise} with the {resolution}.
+  Node* value = effect =
+      graph()->NewNode(javascript()->FulfillPromise(), promise, resolution,
+                       context, effect, control);
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
+}
+
 Reduction JSNativeContextSpecialization::ReduceJSLoadContext(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadContext, node->opcode());
   ContextAccess const& access = ContextAccessOf(node->op());
@@ -945,16 +1038,6 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccessFromNexus(
     return ReduceGlobalAccess(node, nullptr, value, name, access_mode);
   }
 
-  // Check if the {nexus} reports type feedback for the IC.
-  if (nexus.IsUninitialized()) {
-    if (flags() & kBailoutOnUninitialized) {
-      return ReduceSoftDeoptimize(
-          node,
-          DeoptimizeReason::kInsufficientTypeFeedbackForGenericNamedAccess);
-    }
-    return NoChange();
-  }
-
   // Extract receiver maps from the IC using the {nexus}.
   MapHandles receiver_maps;
   if (!ExtractReceiverMaps(receiver, effect, nexus, &receiver_maps)) {
@@ -967,6 +1050,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccessFromNexus(
     }
     return NoChange();
   }
+  DCHECK(!nexus.IsUninitialized());
 
   // Try to lower the named access based on the {receiver_maps}.
   return ReduceNamedAccess(node, value, receiver_maps, name, access_mode);
@@ -1007,9 +1091,9 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadNamed(Node* node) {
     }
   }
 
-  // Extract receiver maps from the load IC using the LoadICNexus.
+  // Extract receiver maps from the load IC using the FeedbackNexus.
   if (!p.feedback().IsValid()) return NoChange();
-  LoadICNexus nexus(p.feedback().vector(), p.feedback().slot());
+  FeedbackNexus nexus(p.feedback().vector(), p.feedback().slot());
 
   // Try to lower the named access based on the {receiver_maps}.
   return ReduceNamedAccessFromNexus(node, value, nexus, p.name(),
@@ -1022,9 +1106,9 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreNamed(Node* node) {
   NamedAccess const& p = NamedAccessOf(node->op());
   Node* const value = NodeProperties::GetValueInput(node, 1);
 
-  // Extract receiver maps from the store IC using the StoreICNexus.
+  // Extract receiver maps from the store IC using the FeedbackNexus.
   if (!p.feedback().IsValid()) return NoChange();
-  StoreICNexus nexus(p.feedback().vector(), p.feedback().slot());
+  FeedbackNexus nexus(p.feedback().vector(), p.feedback().slot());
 
   // Try to lower the named access based on the {receiver_maps}.
   return ReduceNamedAccessFromNexus(node, value, nexus, p.name(),
@@ -1036,9 +1120,9 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreNamedOwn(Node* node) {
   StoreNamedOwnParameters const& p = StoreNamedOwnParametersOf(node->op());
   Node* const value = NodeProperties::GetValueInput(node, 1);
 
-  // Extract receiver maps from the IC using the StoreOwnICNexus.
+  // Extract receiver maps from the IC using the FeedbackNexus.
   if (!p.feedback().IsValid()) return NoChange();
-  StoreOwnICNexus nexus(p.feedback().vector(), p.feedback().slot());
+  FeedbackNexus nexus(p.feedback().vector(), p.feedback().slot());
 
   // Try to lower the creation of a named property based on the {receiver_maps}.
   return ReduceNamedAccessFromNexus(node, value, nexus, p.name(),
@@ -1050,7 +1134,8 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
     AccessMode access_mode, KeyedAccessLoadMode load_mode,
     KeyedAccessStoreMode store_mode) {
   DCHECK(node->opcode() == IrOpcode::kJSLoadProperty ||
-         node->opcode() == IrOpcode::kJSStoreProperty);
+         node->opcode() == IrOpcode::kJSStoreProperty ||
+         node->opcode() == IrOpcode::kJSStoreInArrayLiteral);
   Node* receiver = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
@@ -1264,9 +1349,8 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
   return Replace(value);
 }
 
-template <typename KeyedICNexus>
 Reduction JSNativeContextSpecialization::ReduceKeyedAccess(
-    Node* node, Node* index, Node* value, KeyedICNexus const& nexus,
+    Node* node, Node* index, Node* value, FeedbackNexus const& nexus,
     AccessMode access_mode, KeyedAccessLoadMode load_mode,
     KeyedAccessStoreMode store_mode) {
   DCHECK(node->opcode() == IrOpcode::kJSLoadProperty ||
@@ -1354,16 +1438,6 @@ Reduction JSNativeContextSpecialization::ReduceKeyedAccess(
     }
   }
 
-  // Check if the {nexus} reports type feedback for the IC.
-  if (nexus.IsUninitialized()) {
-    if (flags() & kBailoutOnUninitialized) {
-      return ReduceSoftDeoptimize(
-          node,
-          DeoptimizeReason::kInsufficientTypeFeedbackForGenericKeyedAccess);
-    }
-    return NoChange();
-  }
-
   // Extract receiver maps from the {nexus}.
   MapHandles receiver_maps;
   if (!ExtractReceiverMaps(receiver, effect, nexus, &receiver_maps)) {
@@ -1376,6 +1450,7 @@ Reduction JSNativeContextSpecialization::ReduceKeyedAccess(
     }
     return NoChange();
   }
+  DCHECK(!nexus.IsUninitialized());
 
   // Optimize access for constant {index}.
   HeapObjectMatcher mindex(index);
@@ -1543,9 +1618,9 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadProperty(Node* node) {
     }
   }
 
-  // Extract receiver maps from the keyed load IC using the KeyedLoadICNexus.
+  // Extract receiver maps from the keyed load IC using the FeedbackNexus.
   if (!p.feedback().IsValid()) return NoChange();
-  KeyedLoadICNexus nexus(p.feedback().vector(), p.feedback().slot());
+  FeedbackNexus nexus(p.feedback().vector(), p.feedback().slot());
 
   // Extract the keyed access load mode from the keyed load IC.
   KeyedAccessLoadMode load_mode = nexus.GetKeyedAccessLoadMode();
@@ -1561,9 +1636,9 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreProperty(Node* node) {
   Node* const index = NodeProperties::GetValueInput(node, 1);
   Node* const value = NodeProperties::GetValueInput(node, 2);
 
-  // Extract receiver maps from the keyed store IC using the KeyedStoreICNexus.
+  // Extract receiver maps from the keyed store IC using the FeedbackNexus.
   if (!p.feedback().IsValid()) return NoChange();
-  KeyedStoreICNexus nexus(p.feedback().vector(), p.feedback().slot());
+  FeedbackNexus nexus(p.feedback().vector(), p.feedback().slot());
 
   // Extract the keyed access store mode from the keyed store IC.
   KeyedAccessStoreMode store_mode = nexus.GetKeyedAccessStoreMode();
@@ -1578,7 +1653,7 @@ Node* JSNativeContextSpecialization::InlinePropertyGetterCall(
     Node** control, ZoneVector<Node*>* if_exceptions,
     PropertyAccessInfo const& access_info) {
   Node* target = jsgraph()->Constant(access_info.constant());
-  FrameStateInfo const& frame_info = OpParameter<FrameStateInfo>(frame_state);
+  FrameStateInfo const& frame_info = FrameStateInfoOf(frame_state->op());
   Handle<SharedFunctionInfo> shared_info =
       frame_info.shared_info().ToHandleChecked();
   // Introduce the call to the getter function.
@@ -1617,7 +1692,7 @@ void JSNativeContextSpecialization::InlinePropertySetterCall(
     Node** effect, Node** control, ZoneVector<Node*>* if_exceptions,
     PropertyAccessInfo const& access_info) {
   Node* target = jsgraph()->Constant(access_info.constant());
-  FrameStateInfo const& frame_info = OpParameter<FrameStateInfo>(frame_state);
+  FrameStateInfo const& frame_info = FrameStateInfoOf(frame_state->op());
   Handle<SharedFunctionInfo> shared_info =
       frame_info.shared_info().ToHandleChecked();
   // Introduce the call to the setter function.
@@ -1663,7 +1738,7 @@ Node* JSNativeContextSpecialization::InlineApiCall(
   CallApiCallbackStub stub(isolate(), argc);
   CallInterfaceDescriptor call_interface_descriptor =
       stub.GetCallInterfaceDescriptor();
-  CallDescriptor* call_descriptor = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), call_interface_descriptor,
       call_interface_descriptor.GetStackParameterCount() + argc +
           1 /* implicit receiver */,
@@ -1960,8 +2035,7 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreDataPropertyInLiteral(
 
   if (!p.feedback().IsValid()) return NoChange();
 
-  StoreDataPropertyInLiteralICNexus nexus(p.feedback().vector(),
-                                          p.feedback().slot());
+  FeedbackNexus nexus(p.feedback().vector(), p.feedback().slot());
   if (nexus.IsUninitialized()) {
     return NoChange();
   }
@@ -2026,6 +2100,45 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreDataPropertyInLiteral(
   return Replace(value);
 }
 
+Reduction JSNativeContextSpecialization::ReduceJSStoreInArrayLiteral(
+    Node* node) {
+  DCHECK_EQ(IrOpcode::kJSStoreInArrayLiteral, node->opcode());
+  FeedbackParameter const& p = FeedbackParameterOf(node->op());
+  Node* const receiver = NodeProperties::GetValueInput(node, 0);
+  Node* const index = NodeProperties::GetValueInput(node, 1);
+  Node* const value = NodeProperties::GetValueInput(node, 2);
+  Node* const effect = NodeProperties::GetEffectInput(node);
+
+  // Extract receiver maps from the keyed store IC using the FeedbackNexus.
+  if (!p.feedback().IsValid()) return NoChange();
+  FeedbackNexus nexus(p.feedback().vector(), p.feedback().slot());
+
+  // Extract the keyed access store mode from the keyed store IC.
+  KeyedAccessStoreMode store_mode = nexus.GetKeyedAccessStoreMode();
+
+  // Extract receiver maps from the {nexus}.
+  MapHandles receiver_maps;
+  if (!ExtractReceiverMaps(receiver, effect, nexus, &receiver_maps)) {
+    return NoChange();
+  } else if (receiver_maps.empty()) {
+    if (flags() & kBailoutOnUninitialized) {
+      return ReduceSoftDeoptimize(
+          node,
+          DeoptimizeReason::kInsufficientTypeFeedbackForGenericKeyedAccess);
+    }
+    return NoChange();
+  }
+  DCHECK(!nexus.IsUninitialized());
+  DCHECK_EQ(ELEMENT, nexus.GetKeyType());
+
+  if (nexus.ic_state() == MEGAMORPHIC) return NoChange();
+
+  // Try to lower the element access based on the {receiver_maps}.
+  return ReduceElementAccess(node, index, value, receiver_maps,
+                             AccessMode::kStoreInLiteral, STANDARD_LOAD,
+                             store_mode);
+}
+
 namespace {
 
 ExternalArrayType GetArrayTypeFromElementsKind(ElementsKind kind) {
@@ -2048,7 +2161,6 @@ JSNativeContextSpecialization::BuildElementAccess(
     Node* receiver, Node* index, Node* value, Node* effect, Node* control,
     ElementAccessInfo const& access_info, AccessMode access_mode,
     KeyedAccessLoadMode load_mode, KeyedAccessStoreMode store_mode) {
-  DCHECK_NE(AccessMode::kStoreInLiteral, access_mode);
 
   // TODO(bmeurer): We currently specialize based on elements kind. We should
   // also be able to properly support strings and other JSObjects here.
@@ -2096,11 +2208,21 @@ JSNativeContextSpecialization::BuildElementAccess(
           simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
           receiver, effect, control);
 
-      // Load the base and external pointer for the {receiver}s {elements}.
-      base_pointer = effect = graph()->NewNode(
-          simplified()->LoadField(
-              AccessBuilder::ForFixedTypedArrayBaseBasePointer()),
-          elements, effect, control);
+      // Load the base pointer for the {receiver}. This will always be Smi
+      // zero unless we allow on-heap TypedArrays, which is only the case
+      // for Chrome. Node and Electron both set this limit to 0. Setting
+      // the base to Smi zero here allows the EffectControlLinearizer to
+      // optimize away the tricky part of the access later.
+      if (V8_TYPED_ARRAY_MAX_SIZE_IN_HEAP == 0) {
+        base_pointer = jsgraph()->ZeroConstant();
+      } else {
+        base_pointer = effect = graph()->NewNode(
+            simplified()->LoadField(
+                AccessBuilder::ForFixedTypedArrayBaseBasePointer()),
+            elements, effect, control);
+      }
+
+      // Load the external pointer for the {receiver}s {elements}.
       external_pointer = effect = graph()->NewNode(
           simplified()->LoadField(
               AccessBuilder::ForFixedTypedArrayBaseExternalPointer()),
@@ -2124,12 +2246,16 @@ JSNativeContextSpecialization::BuildElementAccess(
 
     if (load_mode == LOAD_IGNORE_OUT_OF_BOUNDS ||
         store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
-      // Check that the {index} is a valid array index, we do the actual
-      // bounds check below and just skip the store below if it's out of
+      // Only check that the {index} is in SignedSmall range. We do the actual
+      // bounds check below and just skip the property access if it's out of
       // bounds for the {receiver}.
       index = effect = graph()->NewNode(
-          simplified()->CheckBounds(VectorSlotPair()), index,
-          jsgraph()->Constant(Smi::kMaxValue), effect, control);
+          simplified()->CheckSmi(VectorSlotPair()), index, effect, control);
+
+      // Cast the {index} to Unsigned32 range, so that the bounds checks
+      // below are performed on unsigned values, which means that all the
+      // Negative32 values are treated as out-of-bounds.
+      index = graph()->NewNode(simplified()->NumberToUint32(), index);
     } else {
       // Check that the {index} is in the valid range for the {receiver}.
       index = effect =
@@ -2193,10 +2319,10 @@ JSNativeContextSpecialization::BuildElementAccess(
       case AccessMode::kStore: {
         // Ensure that the {value} is actually a Number or an Oddball,
         // and truncate it to a Number appropriately.
-        value = effect =
-            graph()->NewNode(simplified()->SpeculativeToNumber(
-                                 NumberOperationHint::kNumberOrOddball),
-                             value, effect, control);
+        value = effect = graph()->NewNode(
+            simplified()->SpeculativeToNumber(
+                NumberOperationHint::kNumberOrOddball, VectorSlotPair()),
+            value, effect, control);
 
         // Introduce the appropriate truncation for {value}. Currently we
         // only need to do this for ClamedUint8Array {receiver}s, as the
@@ -2246,10 +2372,11 @@ JSNativeContextSpecialization::BuildElementAccess(
         simplified()->LoadField(AccessBuilder::ForJSObjectElements()), receiver,
         effect, control);
 
-    // Don't try to store to a copy-on-write backing store.
+    // Don't try to store to a copy-on-write backing store (unless supported by
+    // the store mode).
     if (access_mode == AccessMode::kStore &&
         IsSmiOrObjectElementsKind(elements_kind) &&
-        store_mode != STORE_NO_TRANSITION_HANDLE_COW) {
+        !IsCOWHandlingStoreMode(store_mode)) {
       effect = graph()->NewNode(
           simplified()->CheckMaps(
               CheckMapsFlag::kNone,
@@ -2274,7 +2401,8 @@ JSNativeContextSpecialization::BuildElementAccess(
     // Check if we might need to grow the {elements} backing store.
     if (IsGrowStoreMode(store_mode)) {
       // For growing stores we validate the {index} below.
-      DCHECK_EQ(AccessMode::kStore, access_mode);
+      DCHECK(access_mode == AccessMode::kStore ||
+             access_mode == AccessMode::kStoreInLiteral);
     } else if (load_mode == LOAD_IGNORE_OUT_OF_BOUNDS &&
                CanTreatHoleAsUndefined(receiver_maps)) {
       // Check that the {index} is a valid array index, we do the actual
@@ -2406,7 +2534,8 @@ JSNativeContextSpecialization::BuildElementAccess(
         }
       }
     } else {
-      DCHECK_EQ(AccessMode::kStore, access_mode);
+      DCHECK(access_mode == AccessMode::kStore ||
+             access_mode == AccessMode::kStoreInLiteral);
       if (IsSmiElementsKind(elements_kind)) {
         value = effect = graph()->NewNode(
             simplified()->CheckSmi(VectorSlotPair()), value, effect, control);
@@ -2459,6 +2588,15 @@ JSNativeContextSpecialization::BuildElementAccess(
             simplified()->MaybeGrowFastElements(mode, VectorSlotPair()),
             receiver, elements, index, elements_length, effect, control);
 
+        // If we didn't grow {elements}, it might still be COW, in which case we
+        // copy it now.
+        if (IsSmiOrObjectElementsKind(elements_kind) &&
+            store_mode == STORE_AND_GROW_NO_TRANSITION_HANDLE_COW) {
+          elements = effect =
+              graph()->NewNode(simplified()->EnsureWritableFastElements(),
+                               receiver, elements, effect, control);
+        }
+
         // Also update the "length" property if {receiver} is a JSArray.
         if (receiver_is_jsarray) {
           Node* check =
@@ -2524,13 +2662,18 @@ Node* JSNativeContextSpecialization::BuildIndexedStringLoad(
         graph()->NewNode(simplified()->MaskIndexWithBound(), index, length);
 
     Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-    Node* vtrue = graph()->NewNode(simplified()->StringCharAt(), receiver,
-                                   masked_index, if_true);
+    Node* etrue;
+    Node* vtrue = etrue =
+        graph()->NewNode(simplified()->StringCharCodeAt(), receiver,
+                         masked_index, *effect, if_true);
+    vtrue = graph()->NewNode(simplified()->StringFromSingleCharCode(), vtrue);
 
     Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
     Node* vfalse = jsgraph()->UndefinedConstant();
 
     *control = graph()->NewNode(common()->Merge(2), if_true, if_false);
+    *effect =
+        graph()->NewNode(common()->EffectPhi(2), etrue, *effect, *control);
     return graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
                             vtrue, vfalse, *control);
   } else {
@@ -2543,8 +2686,11 @@ Node* JSNativeContextSpecialization::BuildIndexedStringLoad(
         graph()->NewNode(simplified()->MaskIndexWithBound(), index, length);
 
     // Return the character from the {receiver} as single character string.
-    return graph()->NewNode(simplified()->StringCharAt(), receiver,
-                            masked_index, *control);
+    Node* value = *effect =
+        graph()->NewNode(simplified()->StringCharCodeAt(), receiver,
+                         masked_index, *effect, *control);
+    value = graph()->NewNode(simplified()->StringFromSingleCharCode(), value);
+    return value;
   }
 }
 
@@ -2599,6 +2745,10 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
   }
   Node* new_length_and_hash = graph()->NewNode(
       simplified()->NumberBitwiseOr(), jsgraph()->Constant(new_length), hash);
+  // TDOO(jarin): Fix the typer to infer tighter bound for NumberBitwiseOr.
+  new_length_and_hash = effect =
+      graph()->NewNode(common()->TypeGuard(Type::SignedSmall()),
+                       new_length_and_hash, effect, control);
 
   // Allocate and initialize the new properties.
   AllocationBuilder a(jsgraph(), effect, control);
@@ -2652,11 +2802,21 @@ bool JSNativeContextSpecialization::ExtractReceiverMaps(
     Node* receiver, Node* effect, FeedbackNexus const& nexus,
     MapHandles* receiver_maps) {
   DCHECK_EQ(0, receiver_maps->size());
-  // See if we can infer a concrete type for the {receiver}.
-  if (InferReceiverMaps(receiver, effect, receiver_maps)) {
-    // We can assume that the {receiver} still has the inferred {receiver_maps}.
-    return true;
+  if (nexus.IsUninitialized()) return true;
+
+  // See if we can infer a concrete type for the {receiver}. Solely relying on
+  // the inference is not safe for keyed stores, because we would potentially
+  // miss out on transitions that need to be performed.
+  {
+    FeedbackSlotKind kind = nexus.kind();
+    bool use_inference =
+        !IsKeyedStoreICKind(kind) && !IsStoreInArrayLiteralICKind(kind);
+    if (use_inference && InferReceiverMaps(receiver, effect, receiver_maps)) {
+      // We can assume that {receiver} still has the inferred {receiver_maps}.
+      return true;
+    }
   }
+
   // Try to extract some maps from the {nexus}.
   if (nexus.ExtractMaps(receiver_maps) != 0) {
     // Try to filter impossible candidates based on inferred root map.
@@ -2673,6 +2833,7 @@ bool JSNativeContextSpecialization::ExtractReceiverMaps(
     }
     return true;
   }
+
   return false;
 }
 
@@ -2765,6 +2926,8 @@ SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
+#undef V8_TYPED_ARRAY_MAX_SIZE_IN_HEAP
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/js-native-context-specialization.h b/deps/v8/src/compiler/js-native-context-specialization.h
index 879203c1ddf..5f357a29246 100644
--- a/deps/v8/src/compiler/js-native-context-specialization.h
+++ b/deps/v8/src/compiler/js-native-context-specialization.h
@@ -62,6 +62,8 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
   Reduction ReduceJSInstanceOf(Node* node);
   Reduction ReduceJSHasInPrototypeChain(Node* node);
   Reduction ReduceJSOrdinaryHasInstance(Node* node);
+  Reduction ReduceJSPromiseResolve(Node* node);
+  Reduction ReduceJSResolvePromise(Node* node);
   Reduction ReduceJSLoadContext(Node* node);
   Reduction ReduceJSLoadGlobal(Node* node);
   Reduction ReduceJSStoreGlobal(Node* node);
@@ -71,15 +73,16 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
   Reduction ReduceJSStoreProperty(Node* node);
   Reduction ReduceJSStoreNamedOwn(Node* node);
   Reduction ReduceJSStoreDataPropertyInLiteral(Node* node);
+  Reduction ReduceJSStoreInArrayLiteral(Node* node);
 
   Reduction ReduceElementAccess(Node* node, Node* index, Node* value,
                                 MapHandles const& receiver_maps,
                                 AccessMode access_mode,
                                 KeyedAccessLoadMode load_mode,
                                 KeyedAccessStoreMode store_mode);
-  template <typename KeyedICNexus>
   Reduction ReduceKeyedAccess(Node* node, Node* index, Node* value,
-                              KeyedICNexus const& nexus, AccessMode access_mode,
+                              FeedbackNexus const& nexus,
+                              AccessMode access_mode,
                               KeyedAccessLoadMode load_mode,
                               KeyedAccessStoreMode store_mode);
   Reduction ReduceNamedAccessFromNexus(Node* node, Node* value,
diff --git a/deps/v8/src/compiler/js-operator.cc b/deps/v8/src/compiler/js-operator.cc
index 0ddf859cff0..f81f3418ba8 100644
--- a/deps/v8/src/compiler/js-operator.cc
+++ b/deps/v8/src/compiler/js-operator.cc
@@ -258,7 +258,8 @@ std::ostream& operator<<(std::ostream& os, FeedbackParameter const& p) {
 FeedbackParameter const& FeedbackParameterOf(const Operator* op) {
   DCHECK(op->opcode() == IrOpcode::kJSCreateEmptyLiteralArray ||
          op->opcode() == IrOpcode::kJSInstanceOf ||
-         op->opcode() == IrOpcode::kJSStoreDataPropertyInLiteral);
+         op->opcode() == IrOpcode::kJSStoreDataPropertyInLiteral ||
+         op->opcode() == IrOpcode::kJSStoreInArrayLiteral);
   return OpParameter<FeedbackParameter>(op);
 }
 
@@ -411,12 +412,36 @@ std::ostream& operator<<(std::ostream& os, CreateArrayParameters const& p) {
   return os;
 }
 
-
 const CreateArrayParameters& CreateArrayParametersOf(const Operator* op) {
   DCHECK_EQ(IrOpcode::kJSCreateArray, op->opcode());
   return OpParameter<CreateArrayParameters>(op);
 }
 
+bool operator==(CreateArrayIteratorParameters const& lhs,
+                CreateArrayIteratorParameters const& rhs) {
+  return lhs.kind() == rhs.kind();
+}
+
+bool operator!=(CreateArrayIteratorParameters const& lhs,
+                CreateArrayIteratorParameters const& rhs) {
+  return !(lhs == rhs);
+}
+
+size_t hash_value(CreateArrayIteratorParameters const& p) {
+  return static_cast<size_t>(p.kind());
+}
+
+std::ostream& operator<<(std::ostream& os,
+                         CreateArrayIteratorParameters const& p) {
+  return os << p.kind();
+}
+
+const CreateArrayIteratorParameters& CreateArrayIteratorParametersOf(
+    const Operator* op) {
+  DCHECK_EQ(IrOpcode::kJSCreateArrayIterator, op->opcode());
+  return OpParameter<CreateArrayIteratorParameters>(op);
+}
+
 bool operator==(CreateBoundFunctionParameters const& lhs,
                 CreateBoundFunctionParameters const& rhs) {
   return lhs.arity() == rhs.arity() &&
@@ -448,7 +473,8 @@ const CreateBoundFunctionParameters& CreateBoundFunctionParametersOf(
 bool operator==(CreateClosureParameters const& lhs,
                 CreateClosureParameters const& rhs) {
   return lhs.pretenure() == rhs.pretenure() &&
-         lhs.feedback() == rhs.feedback() &&
+         lhs.code().location() == rhs.code().location() &&
+         lhs.feedback_cell().location() == rhs.feedback_cell().location() &&
          lhs.shared_info().location() == rhs.shared_info().location();
 }
 
@@ -461,12 +487,13 @@ bool operator!=(CreateClosureParameters const& lhs,
 
 size_t hash_value(CreateClosureParameters const& p) {
   return base::hash_combine(p.pretenure(), p.shared_info().location(),
-                            p.feedback());
+                            p.feedback_cell().location());
 }
 
 
 std::ostream& operator<<(std::ostream& os, CreateClosureParameters const& p) {
-  return os << p.pretenure() << ", " << Brief(*p.shared_info());
+  return os << p.pretenure() << ", " << Brief(*p.shared_info()) << ", "
+            << Brief(*p.feedback_cell()) << ", " << Brief(*p.code());
 }
 
 
@@ -543,42 +570,51 @@ CompareOperationHint CompareOperationHintOf(const Operator* op) {
   return OpParameter<CompareOperationHint>(op);
 }
 
-#define CACHED_OP_LIST(V)                                       \
-  V(BitwiseOr, Operator::kNoProperties, 2, 1)                   \
-  V(BitwiseXor, Operator::kNoProperties, 2, 1)                  \
-  V(BitwiseAnd, Operator::kNoProperties, 2, 1)                  \
-  V(ShiftLeft, Operator::kNoProperties, 2, 1)                   \
-  V(ShiftRight, Operator::kNoProperties, 2, 1)                  \
-  V(ShiftRightLogical, Operator::kNoProperties, 2, 1)           \
-  V(Subtract, Operator::kNoProperties, 2, 1)                    \
-  V(Multiply, Operator::kNoProperties, 2, 1)                    \
-  V(Divide, Operator::kNoProperties, 2, 1)                      \
-  V(Modulus, Operator::kNoProperties, 2, 1)                     \
-  V(Exponentiate, Operator::kNoProperties, 2, 1)                \
-  V(BitwiseNot, Operator::kNoProperties, 1, 1)                  \
-  V(Decrement, Operator::kNoProperties, 1, 1)                   \
-  V(Increment, Operator::kNoProperties, 1, 1)                   \
-  V(Negate, Operator::kNoProperties, 1, 1)                      \
-  V(ToInteger, Operator::kNoProperties, 1, 1)                   \
-  V(ToLength, Operator::kNoProperties, 1, 1)                    \
-  V(ToName, Operator::kNoProperties, 1, 1)                      \
-  V(ToNumber, Operator::kNoProperties, 1, 1)                    \
-  V(ToNumeric, Operator::kNoProperties, 1, 1)                   \
-  V(ToObject, Operator::kFoldable, 1, 1)                        \
-  V(ToString, Operator::kNoProperties, 1, 1)                    \
-  V(Create, Operator::kNoProperties, 2, 1)                      \
-  V(CreateIterResultObject, Operator::kEliminatable, 2, 1)      \
-  V(CreateKeyValueArray, Operator::kEliminatable, 2, 1)         \
-  V(HasProperty, Operator::kNoProperties, 2, 1)                 \
-  V(HasInPrototypeChain, Operator::kNoProperties, 2, 1)         \
-  V(OrdinaryHasInstance, Operator::kNoProperties, 2, 1)         \
-  V(ForInEnumerate, Operator::kNoProperties, 1, 1)              \
-  V(LoadMessage, Operator::kNoThrow | Operator::kNoWrite, 0, 1) \
-  V(StoreMessage, Operator::kNoRead | Operator::kNoThrow, 1, 0) \
-  V(GeneratorRestoreContinuation, Operator::kNoThrow, 1, 1)     \
-  V(GeneratorRestoreInputOrDebugPos, Operator::kNoThrow, 1, 1)  \
-  V(StackCheck, Operator::kNoWrite, 0, 0)                       \
-  V(Debugger, Operator::kNoProperties, 0, 0)                    \
+#define CACHED_OP_LIST(V)                                              \
+  V(BitwiseOr, Operator::kNoProperties, 2, 1)                          \
+  V(BitwiseXor, Operator::kNoProperties, 2, 1)                         \
+  V(BitwiseAnd, Operator::kNoProperties, 2, 1)                         \
+  V(ShiftLeft, Operator::kNoProperties, 2, 1)                          \
+  V(ShiftRight, Operator::kNoProperties, 2, 1)                         \
+  V(ShiftRightLogical, Operator::kNoProperties, 2, 1)                  \
+  V(Subtract, Operator::kNoProperties, 2, 1)                           \
+  V(Multiply, Operator::kNoProperties, 2, 1)                           \
+  V(Divide, Operator::kNoProperties, 2, 1)                             \
+  V(Modulus, Operator::kNoProperties, 2, 1)                            \
+  V(Exponentiate, Operator::kNoProperties, 2, 1)                       \
+  V(BitwiseNot, Operator::kNoProperties, 1, 1)                         \
+  V(Decrement, Operator::kNoProperties, 1, 1)                          \
+  V(Increment, Operator::kNoProperties, 1, 1)                          \
+  V(Negate, Operator::kNoProperties, 1, 1)                             \
+  V(ToInteger, Operator::kNoProperties, 1, 1)                          \
+  V(ToLength, Operator::kNoProperties, 1, 1)                           \
+  V(ToName, Operator::kNoProperties, 1, 1)                             \
+  V(ToNumber, Operator::kNoProperties, 1, 1)                           \
+  V(ToNumeric, Operator::kNoProperties, 1, 1)                          \
+  V(ToObject, Operator::kFoldable, 1, 1)                               \
+  V(ToString, Operator::kNoProperties, 1, 1)                           \
+  V(Create, Operator::kNoProperties, 2, 1)                             \
+  V(CreateIterResultObject, Operator::kEliminatable, 2, 1)             \
+  V(CreateStringIterator, Operator::kEliminatable, 1, 1)               \
+  V(CreateKeyValueArray, Operator::kEliminatable, 2, 1)                \
+  V(CreatePromise, Operator::kEliminatable, 0, 1)                      \
+  V(CreateTypedArray, Operator::kNoProperties, 5, 1)                   \
+  V(HasProperty, Operator::kNoProperties, 2, 1)                        \
+  V(HasInPrototypeChain, Operator::kNoProperties, 2, 1)                \
+  V(OrdinaryHasInstance, Operator::kNoProperties, 2, 1)                \
+  V(ForInEnumerate, Operator::kNoProperties, 1, 1)                     \
+  V(LoadMessage, Operator::kNoThrow | Operator::kNoWrite, 0, 1)        \
+  V(StoreMessage, Operator::kNoRead | Operator::kNoThrow, 1, 0)        \
+  V(GeneratorRestoreContinuation, Operator::kNoThrow, 1, 1)            \
+  V(GeneratorRestoreContext, Operator::kNoThrow, 1, 1)                 \
+  V(GeneratorRestoreInputOrDebugPos, Operator::kNoThrow, 1, 1)         \
+  V(StackCheck, Operator::kNoWrite, 0, 0)                              \
+  V(Debugger, Operator::kNoProperties, 0, 0)                           \
+  V(FulfillPromise, Operator::kNoDeopt | Operator::kNoThrow, 2, 1)     \
+  V(PerformPromiseThen, Operator::kNoDeopt | Operator::kNoThrow, 4, 1) \
+  V(PromiseResolve, Operator::kNoProperties, 2, 1)                     \
+  V(RejectPromise, Operator::kNoDeopt | Operator::kNoThrow, 3, 1)      \
+  V(ResolvePromise, Operator::kNoDeopt | Operator::kNoThrow, 2, 1)     \
   V(GetSuperConstructor, Operator::kNoWrite, 1, 1)
 
 #define BINARY_OP_LIST(V) V(Add)
@@ -735,6 +771,17 @@ const Operator* JSOperatorBuilder::StoreDataPropertyInLiteral(
       parameters);                     // parameter
 }
 
+const Operator* JSOperatorBuilder::StoreInArrayLiteral(
+    const VectorSlotPair& feedback) {
+  FeedbackParameter parameters(feedback);
+  return new (zone()) Operator1<FeedbackParameter>(  // --
+      IrOpcode::kJSStoreInArrayLiteral,
+      Operator::kNoThrow,       // opcode
+      "JSStoreInArrayLiteral",  // name
+      3, 1, 1, 0, 1, 0,         // counts
+      parameters);              // parameter
+}
+
 const Operator* JSOperatorBuilder::CallForwardVarargs(size_t arity,
                                                       uint32_t start_index) {
   CallForwardVarargsParameters parameters(arity, start_index);
@@ -749,6 +796,8 @@ const Operator* JSOperatorBuilder::Call(size_t arity, CallFrequency frequency,
                                         VectorSlotPair const& feedback,
                                         ConvertReceiverMode convert_mode,
                                         SpeculationMode speculation_mode) {
+  DCHECK_IMPLIES(speculation_mode == SpeculationMode::kAllowSpeculation,
+                 feedback.IsValid());
   CallParameters parameters(arity, frequency, feedback, convert_mode,
                             speculation_mode);
   return new (zone()) Operator1<CallParameters>(   // --
@@ -769,6 +818,8 @@ const Operator* JSOperatorBuilder::CallWithArrayLike(CallFrequency frequency) {
 const Operator* JSOperatorBuilder::CallWithSpread(
     uint32_t arity, CallFrequency frequency, VectorSlotPair const& feedback,
     SpeculationMode speculation_mode) {
+  DCHECK_IMPLIES(speculation_mode == SpeculationMode::kAllowSpeculation,
+                 feedback.IsValid());
   CallParameters parameters(arity, frequency, feedback,
                             ConvertReceiverMode::kAny, speculation_mode);
   return new (zone()) Operator1<CallParameters>(             // --
@@ -897,6 +948,11 @@ const Operator* JSOperatorBuilder::GeneratorStore(int register_count) {
       register_count);                                  // parameter
 }
 
+int GeneratorStoreRegisterCountOf(const Operator* op) {
+  DCHECK_EQ(IrOpcode::kJSGeneratorStore, op->opcode());
+  return OpParameter<int>(op);
+}
+
 const Operator* JSOperatorBuilder::GeneratorRestoreRegister(int index) {
   return new (zone()) Operator1<int>(                             // --
       IrOpcode::kJSGeneratorRestoreRegister, Operator::kNoThrow,  // opcode
@@ -905,6 +961,11 @@ const Operator* JSOperatorBuilder::GeneratorRestoreRegister(int index) {
       index);                                                     // parameter
 }
 
+int RestoreRegisterIndexOf(const Operator* op) {
+  DCHECK_EQ(IrOpcode::kJSGeneratorRestoreRegister, op->opcode());
+  return OpParameter<int>(op);
+}
+
 const Operator* JSOperatorBuilder::StoreNamed(LanguageMode language_mode,
                                               Handle<Name> name,
                                               VectorSlotPair const& feedback) {
@@ -1035,6 +1096,15 @@ const Operator* JSOperatorBuilder::CreateArray(size_t arity,
       parameters);                                        // parameter
 }
 
+const Operator* JSOperatorBuilder::CreateArrayIterator(IterationKind kind) {
+  CreateArrayIteratorParameters parameters(kind);
+  return new (zone()) Operator1<CreateArrayIteratorParameters>(   // --
+      IrOpcode::kJSCreateArrayIterator, Operator::kEliminatable,  // opcode
+      "JSCreateArrayIterator",                                    // name
+      1, 1, 1, 1, 1, 0,                                           // counts
+      parameters);                                                // parameter
+}
+
 const Operator* JSOperatorBuilder::CreateBoundFunction(size_t arity,
                                                        Handle<Map> map) {
   // bound_target_function, bound_this, arg1, ..., argN
@@ -1048,9 +1118,10 @@ const Operator* JSOperatorBuilder::CreateBoundFunction(size_t arity,
 }
 
 const Operator* JSOperatorBuilder::CreateClosure(
-    Handle<SharedFunctionInfo> shared_info, VectorSlotPair const& feedback,
-    PretenureFlag pretenure) {
-  CreateClosureParameters parameters(shared_info, feedback, pretenure);
+    Handle<SharedFunctionInfo> shared_info, Handle<FeedbackCell> feedback_cell,
+    Handle<Code> code, PretenureFlag pretenure) {
+  CreateClosureParameters parameters(shared_info, feedback_cell, code,
+                                     pretenure);
   return new (zone()) Operator1<CreateClosureParameters>(   // --
       IrOpcode::kJSCreateClosure, Operator::kEliminatable,  // opcode
       "JSCreateClosure",                                    // name
@@ -1155,6 +1226,16 @@ const Operator* JSOperatorBuilder::CreateBlockContext(
       scope_info);                                               // parameter
 }
 
+Handle<ScopeInfo> ScopeInfoOf(const Operator* op) {
+  DCHECK(IrOpcode::kJSCreateBlockContext == op->opcode() ||
+         IrOpcode::kJSCreateWithContext == op->opcode());
+  return OpParameter<Handle<ScopeInfo>>(op);
+}
+
+#undef BINARY_OP_LIST
+#undef CACHED_OP_LIST
+#undef COMPARE_OP_LIST
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/js-operator.h b/deps/v8/src/compiler/js-operator.h
index 3875234d5aa..bd681a92f2e 100644
--- a/deps/v8/src/compiler/js-operator.h
+++ b/deps/v8/src/compiler/js-operator.h
@@ -18,6 +18,7 @@ namespace internal {
 class AllocationSite;
 class BoilerplateDescription;
 class ConstantElementsPair;
+class FeedbackCell;
 class SharedFunctionInfo;
 
 namespace compiler {
@@ -259,7 +260,7 @@ size_t hash_value(ContextAccess const&);
 
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, ContextAccess const&);
 
-ContextAccess const& ContextAccessOf(Operator const*);
+V8_EXPORT_PRIVATE ContextAccess const& ContextAccessOf(Operator const*);
 
 // Defines the name and ScopeInfo for a new catch context. This is used as a
 // parameter by the JSCreateCatchContext operator.
@@ -501,6 +502,30 @@ std::ostream& operator<<(std::ostream&, CreateArrayParameters const&);
 
 const CreateArrayParameters& CreateArrayParametersOf(const Operator* op);
 
+// Defines shared information for the array iterator that should be created.
+// This is used as parameter by JSCreateArrayIterator operators.
+class CreateArrayIteratorParameters final {
+ public:
+  explicit CreateArrayIteratorParameters(IterationKind kind) : kind_(kind) {}
+
+  IterationKind kind() const { return kind_; }
+
+ private:
+  IterationKind const kind_;
+};
+
+bool operator==(CreateArrayIteratorParameters const&,
+                CreateArrayIteratorParameters const&);
+bool operator!=(CreateArrayIteratorParameters const&,
+                CreateArrayIteratorParameters const&);
+
+size_t hash_value(CreateArrayIteratorParameters const&);
+
+std::ostream& operator<<(std::ostream&, CreateArrayIteratorParameters const&);
+
+const CreateArrayIteratorParameters& CreateArrayIteratorParametersOf(
+    const Operator* op);
+
 // Defines shared information for the bound function that should be created.
 // This is used as parameter by JSCreateBoundFunction operators.
 class CreateBoundFunctionParameters final {
@@ -533,18 +558,23 @@ const CreateBoundFunctionParameters& CreateBoundFunctionParametersOf(
 class CreateClosureParameters final {
  public:
   CreateClosureParameters(Handle<SharedFunctionInfo> shared_info,
-                          VectorSlotPair const& feedback,
+                          Handle<FeedbackCell> feedback_cell, Handle<Code> code,
                           PretenureFlag pretenure)
-      : shared_info_(shared_info), feedback_(feedback), pretenure_(pretenure) {}
+      : shared_info_(shared_info),
+        feedback_cell_(feedback_cell),
+        code_(code),
+        pretenure_(pretenure) {}
 
   Handle<SharedFunctionInfo> shared_info() const { return shared_info_; }
-  VectorSlotPair const& feedback() const { return feedback_; }
+  Handle<FeedbackCell> feedback_cell() const { return feedback_cell_; }
+  Handle<Code> code() const { return code_; }
   PretenureFlag pretenure() const { return pretenure_; }
 
  private:
-  const Handle<SharedFunctionInfo> shared_info_;
-  VectorSlotPair const feedback_;
-  const PretenureFlag pretenure_;
+  Handle<SharedFunctionInfo> const shared_info_;
+  Handle<FeedbackCell> const feedback_cell_;
+  Handle<Code> const code_;
+  PretenureFlag const pretenure_;
 };
 
 bool operator==(CreateClosureParameters const&, CreateClosureParameters const&);
@@ -606,6 +636,11 @@ BinaryOperationHint BinaryOperationHintOf(const Operator* op);
 
 CompareOperationHint CompareOperationHintOf(const Operator* op);
 
+int GeneratorStoreRegisterCountOf(const Operator* op) WARN_UNUSED_RESULT;
+int RestoreRegisterIndexOf(const Operator* op) WARN_UNUSED_RESULT;
+
+Handle<ScopeInfo> ScopeInfoOf(const Operator* op) WARN_UNUSED_RESULT;
+
 // Interface for building JavaScript-level operators, e.g. directly from the
 // AST. Most operators have no parameters, thus can be globally shared for all
 // graphs.
@@ -650,12 +685,17 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
   const Operator* Create();
   const Operator* CreateArguments(CreateArgumentsType type);
   const Operator* CreateArray(size_t arity, Handle<AllocationSite> site);
+  const Operator* CreateArrayIterator(IterationKind);
   const Operator* CreateBoundFunction(size_t arity, Handle<Map> map);
   const Operator* CreateClosure(Handle<SharedFunctionInfo> shared_info,
-                                VectorSlotPair const& feedback,
-                                PretenureFlag pretenure);
+                                Handle<FeedbackCell> feedback_cell,
+                                Handle<Code> code,
+                                PretenureFlag pretenure = NOT_TENURED);
   const Operator* CreateIterResultObject();
+  const Operator* CreateStringIterator();
   const Operator* CreateKeyValueArray();
+  const Operator* CreatePromise();
+  const Operator* CreateTypedArray();
   const Operator* CreateLiteralArray(Handle<ConstantElementsPair> constant,
                                      VectorSlotPair const& feedback,
                                      int literal_flags, int number_of_elements);
@@ -675,12 +715,12 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
       size_t arity, CallFrequency frequency = CallFrequency(),
       VectorSlotPair const& feedback = VectorSlotPair(),
       ConvertReceiverMode convert_mode = ConvertReceiverMode::kAny,
-      SpeculationMode speculation_mode = SpeculationMode::kAllowSpeculation);
+      SpeculationMode speculation_mode = SpeculationMode::kDisallowSpeculation);
   const Operator* CallWithArrayLike(CallFrequency frequency);
   const Operator* CallWithSpread(
       uint32_t arity, CallFrequency frequency = CallFrequency(),
       VectorSlotPair const& feedback = VectorSlotPair(),
-      SpeculationMode speculation_mode = SpeculationMode::kAllowSpeculation);
+      SpeculationMode speculation_mode = SpeculationMode::kDisallowSpeculation);
   const Operator* CallRuntime(Runtime::FunctionId id);
   const Operator* CallRuntime(Runtime::FunctionId id, size_t arity);
   const Operator* CallRuntime(const Runtime::Function* function, size_t arity);
@@ -705,6 +745,7 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
   const Operator* StoreNamedOwn(Handle<Name> name,
                                 VectorSlotPair const& feedback);
   const Operator* StoreDataPropertyInLiteral(const VectorSlotPair& feedback);
+  const Operator* StoreInArrayLiteral(const VectorSlotPair& feedback);
 
   const Operator* DeleteProperty();
 
@@ -727,7 +768,6 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
   const Operator* LoadModule(int32_t cell_index);
   const Operator* StoreModule(int32_t cell_index);
 
-  const Operator* ClassOf();
   const Operator* HasInPrototypeChain();
   const Operator* InstanceOf(const VectorSlotPair& feedback);
   const Operator* OrdinaryHasInstance();
@@ -742,8 +782,10 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
   // Used to implement Ignition's SuspendGenerator bytecode.
   const Operator* GeneratorStore(int register_count);
 
-  // Used to implement Ignition's RestoreGeneratorState bytecode.
+  // Used to implement Ignition's SwitchOnGeneratorState bytecode.
   const Operator* GeneratorRestoreContinuation();
+  const Operator* GeneratorRestoreContext();
+
   // Used to implement Ignition's ResumeGenerator bytecode.
   const Operator* GeneratorRestoreRegister(int index);
   const Operator* GeneratorRestoreInputOrDebugPos();
@@ -751,6 +793,12 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
   const Operator* StackCheck();
   const Operator* Debugger();
 
+  const Operator* FulfillPromise();
+  const Operator* PerformPromiseThen();
+  const Operator* PromiseResolve();
+  const Operator* RejectPromise();
+  const Operator* ResolvePromise();
+
   const Operator* CreateFunctionContext(int slot_count, ScopeType scope_type);
   const Operator* CreateCatchContext(const Handle<String>& name,
                                      const Handle<ScopeInfo>& scope_info);
diff --git a/deps/v8/src/compiler/js-type-hint-lowering.cc b/deps/v8/src/compiler/js-type-hint-lowering.cc
index 0ec63600a2d..d97e1dcbc75 100644
--- a/deps/v8/src/compiler/js-type-hint-lowering.cc
+++ b/deps/v8/src/compiler/js-type-hint-lowering.cc
@@ -60,14 +60,12 @@ class JSSpeculativeBinopBuilder final {
         slot_(slot) {}
 
   BinaryOperationHint GetBinaryOperationHint() {
-    DCHECK_EQ(FeedbackSlotKind::kBinaryOp, feedback_vector()->GetKind(slot_));
-    BinaryOpICNexus nexus(feedback_vector(), slot_);
+    FeedbackNexus nexus(feedback_vector(), slot_);
     return nexus.GetBinaryOperationFeedback();
   }
 
   CompareOperationHint GetCompareOperationHint() {
-    DCHECK_EQ(FeedbackSlotKind::kCompareOp, feedback_vector()->GetKind(slot_));
-    CompareICNexus nexus(feedback_vector(), slot_);
+    FeedbackNexus nexus(feedback_vector(), slot_);
     return nexus.GetCompareOperationFeedback();
   }
 
@@ -218,7 +216,7 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceUnaryOperation(
     const Operator* op, Node* operand, Node* effect, Node* control,
     FeedbackSlot slot) const {
   DCHECK(!slot.IsInvalid());
-  BinaryOpICNexus nexus(feedback_vector(), slot);
+  FeedbackNexus nexus(feedback_vector(), slot);
   if (Node* node = TryBuildSoftDeopt(
           nexus, effect, control,
           DeoptimizeReason::kInsufficientTypeFeedbackForUnaryOperation)) {
@@ -282,7 +280,7 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceBinaryOperation(
   switch (op->opcode()) {
     case IrOpcode::kJSStrictEqual: {
       DCHECK(!slot.IsInvalid());
-      CompareICNexus nexus(feedback_vector(), slot);
+      FeedbackNexus nexus(feedback_vector(), slot);
       if (Node* node = TryBuildSoftDeopt(
               nexus, effect, control,
               DeoptimizeReason::kInsufficientTypeFeedbackForCompareOperation)) {
@@ -298,7 +296,7 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceBinaryOperation(
     case IrOpcode::kJSLessThanOrEqual:
     case IrOpcode::kJSGreaterThanOrEqual: {
       DCHECK(!slot.IsInvalid());
-      CompareICNexus nexus(feedback_vector(), slot);
+      FeedbackNexus nexus(feedback_vector(), slot);
       if (Node* node = TryBuildSoftDeopt(
               nexus, effect, control,
               DeoptimizeReason::kInsufficientTypeFeedbackForCompareOperation)) {
@@ -312,7 +310,7 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceBinaryOperation(
     }
     case IrOpcode::kJSInstanceOf: {
       DCHECK(!slot.IsInvalid());
-      InstanceOfICNexus nexus(feedback_vector(), slot);
+      FeedbackNexus nexus(feedback_vector(), slot);
       if (Node* node = TryBuildSoftDeopt(
               nexus, effect, control,
               DeoptimizeReason::kInsufficientTypeFeedbackForCompareOperation)) {
@@ -334,7 +332,7 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceBinaryOperation(
     case IrOpcode::kJSDivide:
     case IrOpcode::kJSModulus: {
       DCHECK(!slot.IsInvalid());
-      BinaryOpICNexus nexus(feedback_vector(), slot);
+      FeedbackNexus nexus(feedback_vector(), slot);
       if (Node* node = TryBuildSoftDeopt(
               nexus, effect, control,
               DeoptimizeReason::kInsufficientTypeFeedbackForBinaryOperation)) {
@@ -361,7 +359,7 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceForInNextOperation(
     Node* receiver, Node* cache_array, Node* cache_type, Node* index,
     Node* effect, Node* control, FeedbackSlot slot) const {
   DCHECK(!slot.IsInvalid());
-  ForInICNexus nexus(feedback_vector(), slot);
+  FeedbackNexus nexus(feedback_vector(), slot);
   if (Node* node = TryBuildSoftDeopt(
           nexus, effect, control,
           DeoptimizeReason::kInsufficientTypeFeedbackForForIn)) {
@@ -375,7 +373,7 @@ JSTypeHintLowering::ReduceForInPrepareOperation(Node* enumerator, Node* effect,
                                                 Node* control,
                                                 FeedbackSlot slot) const {
   DCHECK(!slot.IsInvalid());
-  ForInICNexus nexus(feedback_vector(), slot);
+  FeedbackNexus nexus(feedback_vector(), slot);
   if (Node* node = TryBuildSoftDeopt(
           nexus, effect, control,
           DeoptimizeReason::kInsufficientTypeFeedbackForForIn)) {
@@ -387,13 +385,13 @@ JSTypeHintLowering::ReduceForInPrepareOperation(Node* enumerator, Node* effect,
 JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceToNumberOperation(
     Node* input, Node* effect, Node* control, FeedbackSlot slot) const {
   DCHECK(!slot.IsInvalid());
-  BinaryOpICNexus nexus(feedback_vector(), slot);
+  FeedbackNexus nexus(feedback_vector(), slot);
   NumberOperationHint hint;
   if (BinaryOperationHintToNumberOperationHint(
           nexus.GetBinaryOperationFeedback(), &hint)) {
     Node* node = jsgraph()->graph()->NewNode(
-        jsgraph()->simplified()->SpeculativeToNumber(hint), input, effect,
-        control);
+        jsgraph()->simplified()->SpeculativeToNumber(hint, VectorSlotPair()),
+        input, effect, control);
     return LoweringResult::SideEffectFree(node, node, control);
   }
   return LoweringResult::NoChange();
@@ -405,7 +403,7 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceCallOperation(
   DCHECK(op->opcode() == IrOpcode::kJSCall ||
          op->opcode() == IrOpcode::kJSCallWithSpread);
   DCHECK(!slot.IsInvalid());
-  CallICNexus nexus(feedback_vector(), slot);
+  FeedbackNexus nexus(feedback_vector(), slot);
   if (Node* node = TryBuildSoftDeopt(
           nexus, effect, control,
           DeoptimizeReason::kInsufficientTypeFeedbackForCall)) {
@@ -420,7 +418,7 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceConstructOperation(
   DCHECK(op->opcode() == IrOpcode::kJSConstruct ||
          op->opcode() == IrOpcode::kJSConstructWithSpread);
   DCHECK(!slot.IsInvalid());
-  CallICNexus nexus(feedback_vector(), slot);
+  FeedbackNexus nexus(feedback_vector(), slot);
   if (Node* node = TryBuildSoftDeopt(
           nexus, effect, control,
           DeoptimizeReason::kInsufficientTypeFeedbackForConstruct)) {
@@ -434,7 +432,7 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceLoadNamedOperation(
     FeedbackSlot slot) const {
   DCHECK_EQ(IrOpcode::kJSLoadNamed, op->opcode());
   DCHECK(!slot.IsInvalid());
-  LoadICNexus nexus(feedback_vector(), slot);
+  FeedbackNexus nexus(feedback_vector(), slot);
   if (Node* node = TryBuildSoftDeopt(
           nexus, effect, control,
           DeoptimizeReason::kInsufficientTypeFeedbackForGenericNamedAccess)) {
@@ -448,7 +446,7 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceLoadKeyedOperation(
     FeedbackSlot slot) const {
   DCHECK_EQ(IrOpcode::kJSLoadProperty, op->opcode());
   DCHECK(!slot.IsInvalid());
-  KeyedLoadICNexus nexus(feedback_vector(), slot);
+  FeedbackNexus nexus(feedback_vector(), slot);
   if (Node* node = TryBuildSoftDeopt(
           nexus, effect, control,
           DeoptimizeReason::kInsufficientTypeFeedbackForGenericKeyedAccess)) {
@@ -465,7 +463,7 @@ JSTypeHintLowering::ReduceStoreNamedOperation(const Operator* op, Node* obj,
   DCHECK(op->opcode() == IrOpcode::kJSStoreNamed ||
          op->opcode() == IrOpcode::kJSStoreNamedOwn);
   DCHECK(!slot.IsInvalid());
-  StoreICNexus nexus(feedback_vector(), slot);
+  FeedbackNexus nexus(feedback_vector(), slot);
   if (Node* node = TryBuildSoftDeopt(
           nexus, effect, control,
           DeoptimizeReason::kInsufficientTypeFeedbackForGenericNamedAccess)) {
@@ -479,9 +477,10 @@ JSTypeHintLowering::ReduceStoreKeyedOperation(const Operator* op, Node* obj,
                                               Node* key, Node* val,
                                               Node* effect, Node* control,
                                               FeedbackSlot slot) const {
-  DCHECK_EQ(IrOpcode::kJSStoreProperty, op->opcode());
+  DCHECK(op->opcode() == IrOpcode::kJSStoreProperty ||
+         op->opcode() == IrOpcode::kJSStoreInArrayLiteral);
   DCHECK(!slot.IsInvalid());
-  KeyedStoreICNexus nexus(feedback_vector(), slot);
+  FeedbackNexus nexus(feedback_vector(), slot);
   if (Node* node = TryBuildSoftDeopt(
           nexus, effect, control,
           DeoptimizeReason::kInsufficientTypeFeedbackForGenericKeyedAccess)) {
diff --git a/deps/v8/src/compiler/js-typed-lowering.cc b/deps/v8/src/compiler/js-typed-lowering.cc
index c265caf9f08..133cc5d8ad3 100644
--- a/deps/v8/src/compiler/js-typed-lowering.cc
+++ b/deps/v8/src/compiler/js-typed-lowering.cc
@@ -504,6 +504,13 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
     r.ConvertInputsToNumber();
     return r.ChangeToPureOperator(simplified()->NumberAdd(), Type::Number());
   }
+  if (BinaryOperationHintOf(node->op()) == BinaryOperationHint::kString) {
+    // Always bake in String feedback into the graph.
+    // TODO(bmeurer): Consider adding a SpeculativeStringAdd operator,
+    // and use that in JSTypeHintLowering instead of looking at the
+    // binary operation feedback here.
+    r.CheckInputsToString();
+  }
   if (r.OneInputIs(Type::String())) {
     // We know that (at least) one input is already a String,
     // so try to strength-reduce the non-String input.
@@ -539,7 +546,7 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
       return ReduceCreateConsString(node);
     }
     // Eliminate useless concatenation of empty string.
-    if (BinaryOperationHintOf(node->op()) == BinaryOperationHint::kString) {
+    if (r.BothInputsAre(Type::String())) {
       Node* effect = NodeProperties::GetEffectInput(node);
       Node* control = NodeProperties::GetControlInput(node);
       if (r.LeftInputIs(empty_string_type_)) {
@@ -573,15 +580,17 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
     // JSAdd(x, y:string) => CallStub[StringAdd](x, y)
     Callable const callable =
         CodeFactory::StringAdd(isolate(), flags, NOT_TENURED);
-    CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
         isolate(), graph()->zone(), callable.descriptor(), 0,
         CallDescriptor::kNeedsFrameState, properties);
     DCHECK_EQ(1, OperatorProperties::GetFrameStateInputCount(node->op()));
     node->InsertInput(graph()->zone(), 0,
                       jsgraph()->HeapConstant(callable.code()));
-    NodeProperties::ChangeOp(node, common()->Call(desc));
+    NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
     return Changed(node);
   }
+  // We never get here when we had String feedback.
+  DCHECK_NE(BinaryOperationHint::kString, BinaryOperationHintOf(node->op()));
   return NoChange();
 }
 
@@ -1092,12 +1101,13 @@ Reduction JSTypedLowering::ReduceJSToObject(Node* node) {
   {
     // Convert {receiver} using the ToObjectStub.
     Callable callable = Builtins::CallableFor(isolate(), Builtins::kToObject);
-    CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
         isolate(), graph()->zone(), callable.descriptor(), 0,
         CallDescriptor::kNeedsFrameState, node->op()->properties());
-    rfalse = efalse = if_false = graph()->NewNode(
-        common()->Call(desc), jsgraph()->HeapConstant(callable.code()),
-        receiver, context, frame_state, efalse, if_false);
+    rfalse = efalse = if_false =
+        graph()->NewNode(common()->Call(call_descriptor),
+                         jsgraph()->HeapConstant(callable.code()), receiver,
+                         context, frame_state, efalse, if_false);
   }
 
   // Update potential {IfException} uses of {node} to point to the above
@@ -1360,7 +1370,7 @@ Node* JSTypedLowering::BuildGetModuleCell(Node* node) {
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
-  int32_t cell_index = OpParameter<int32_t>(node);
+  int32_t cell_index = OpParameter<int32_t>(node->op());
   Node* module = NodeProperties::GetValueInput(node, 0);
   Type* module_type = NodeProperties::GetType(module);
 
@@ -1410,8 +1420,9 @@ Reduction JSTypedLowering::ReduceJSStoreModule(Node* node) {
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* value = NodeProperties::GetValueInput(node, 1);
-  DCHECK_EQ(ModuleDescriptor::GetCellIndexKind(OpParameter<int32_t>(node)),
-            ModuleDescriptor::kExport);
+  DCHECK_EQ(
+      ModuleDescriptor::GetCellIndexKind(OpParameter<int32_t>(node->op())),
+      ModuleDescriptor::kExport);
 
   Node* cell = BuildGetModuleCell(node);
   if (cell->op()->EffectOutputCount() > 0) effect = cell;
@@ -1491,10 +1502,10 @@ void ReduceBuiltin(Isolate* isolate, JSGraph* jsgraph, Node* node,
   static const int kReturnCount = 1;
   const char* debug_name = Builtins::name(builtin_index);
   Operator::Properties properties = node->op()->properties();
-  CallDescriptor* desc = Linkage::GetCEntryStubCallDescriptor(
+  auto call_descriptor = Linkage::GetCEntryStubCallDescriptor(
       zone, kReturnCount, argc, debug_name, properties, flags);
 
-  NodeProperties::ChangeOp(node, jsgraph->common()->Call(desc));
+  NodeProperties::ChangeOp(node, jsgraph->common()->Call(call_descriptor));
 }
 
 bool NeedsArgumentAdaptorFrame(Handle<SharedFunctionInfo> shared, int arity) {
@@ -1517,7 +1528,12 @@ Reduction JSTypedLowering::ReduceJSConstructForwardVarargs(Node* node) {
   Node* new_target = NodeProperties::GetValueInput(node, arity + 1);
 
   // Check if {target} is a JSFunction.
-  if (target_type->Is(Type::Function())) {
+  if (target_type->IsHeapConstant() &&
+      target_type->AsHeapConstant()->Value()->IsJSFunction()) {
+    // Only optimize [[Construct]] here if {function} is a Constructor.
+    Handle<JSFunction> function =
+        Handle<JSFunction>::cast(target_type->AsHeapConstant()->Value());
+    if (!function->IsConstructor()) return NoChange();
     // Patch {node} to an indirect call via ConstructFunctionForwardVarargs.
     Callable callable = CodeFactory::ConstructFunctionForwardVarargs(isolate());
     node->RemoveInput(arity + 1);
@@ -1557,6 +1573,9 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
     const int builtin_index = shared->construct_stub()->builtin_index();
     const bool is_builtin = (builtin_index != -1);
 
+    // Only optimize [[Construct]] here if {function} is a Constructor.
+    if (!function->IsConstructor()) return NoChange();
+
     CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
 
     if (is_builtin && Builtins::HasCppImplementation(builtin_index) &&
@@ -1592,23 +1611,6 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
     return Changed(node);
   }
 
-  // Check if {target} is a JSFunction.
-  if (target_type->Is(Type::Function())) {
-    // Patch {node} to an indirect call via the ConstructFunction builtin.
-    Callable callable = CodeFactory::ConstructFunction(isolate());
-    node->RemoveInput(arity + 1);
-    node->InsertInput(graph()->zone(), 0,
-                      jsgraph()->HeapConstant(callable.code()));
-    node->InsertInput(graph()->zone(), 2, new_target);
-    node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(arity));
-    node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant());
-    NodeProperties::ChangeOp(
-        node, common()->Call(Linkage::GetStubCallDescriptor(
-                  isolate(), graph()->zone(), callable.descriptor(), 1 + arity,
-                  CallDescriptor::kNeedsFrameState)));
-    return Changed(node);
-  }
-
   return NoChange();
 }
 
@@ -1666,8 +1668,11 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
     Handle<JSFunction> function =
         Handle<JSFunction>::cast(target_type->AsHeapConstant()->Value());
     Handle<SharedFunctionInfo> shared(function->shared(), isolate());
-    const int builtin_index = shared->code()->builtin_index();
-    const bool is_builtin = (builtin_index != -1);
+
+    if (function->shared()->HasBreakInfo()) {
+      // Do not inline the call if we need to check whether to break at entry.
+      return NoChange();
+    }
 
     // Class constructors are callable, but [[Call]] will raise an exception.
     // See ES6 section 9.2.1 [[Call]] ( thisArgument, argumentsList ).
@@ -1697,6 +1702,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
     CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
     Node* new_target = jsgraph()->UndefinedConstant();
     Node* argument_count = jsgraph()->Constant(arity);
+
     if (NeedsArgumentAdaptorFrame(shared, arity)) {
       // Patch {node} to an indirect call via the ArgumentsAdaptorTrampoline.
       Callable callable = CodeFactory::ArgumentAdaptor(isolate());
@@ -1711,9 +1717,11 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
           node, common()->Call(Linkage::GetStubCallDescriptor(
                     isolate(), graph()->zone(), callable.descriptor(),
                     1 + arity, flags)));
-    } else if (is_builtin && Builtins::HasCppImplementation(builtin_index)) {
+    } else if (shared->HasBuiltinId() &&
+               Builtins::HasCppImplementation(shared->builtin_id())) {
       // Patch {node} to a direct CEntryStub call.
-      ReduceBuiltin(isolate(), jsgraph(), node, builtin_index, arity, flags);
+      ReduceBuiltin(isolate(), jsgraph(), node, shared->builtin_id(), arity,
+                    flags);
     } else {
       // Patch {node} to a direct call.
       node->InsertInput(graph()->zone(), arity + 2, new_target);
@@ -1745,7 +1753,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
   if (p.convert_mode() != convert_mode) {
     NodeProperties::ChangeOp(
         node, javascript()->Call(p.arity(), p.frequency(), p.feedback(),
-                                 convert_mode));
+                                 convert_mode, p.speculation_mode()));
     return Changed(node);
   }
 
@@ -1825,12 +1833,13 @@ Reduction JSTypedLowering::ReduceJSForInNext(Node* node) {
         // {receiver} (does the ToName conversion implicitly).
         Callable const callable =
             Builtins::CallableFor(isolate(), Builtins::kForInFilter);
-        CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
+        auto call_descriptor = Linkage::GetStubCallDescriptor(
             isolate(), graph()->zone(), callable.descriptor(), 0,
             CallDescriptor::kNeedsFrameState);
-        vfalse = efalse = if_false = graph()->NewNode(
-            common()->Call(desc), jsgraph()->HeapConstant(callable.code()), key,
-            receiver, context, frame_state, effect, if_false);
+        vfalse = efalse = if_false =
+            graph()->NewNode(common()->Call(call_descriptor),
+                             jsgraph()->HeapConstant(callable.code()), key,
+                             receiver, context, frame_state, effect, if_false);
 
         // Update potential {IfException} uses of {node} to point to the above
         // ForInFilter stub call node instead.
@@ -2020,7 +2029,7 @@ Reduction JSTypedLowering::ReduceJSGeneratorStore(Node* node) {
   Node* context = NodeProperties::GetContextInput(node);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  int register_count = OpParameter<int>(node);
+  int register_count = GeneratorStoreRegisterCountOf(node->op());
 
   FieldAccess array_field = AccessBuilder::ForJSGeneratorObjectRegisterFile();
   FieldAccess context_field = AccessBuilder::ForJSGeneratorObjectContext();
@@ -2034,9 +2043,11 @@ Reduction JSTypedLowering::ReduceJSGeneratorStore(Node* node) {
 
   for (int i = 0; i < register_count; ++i) {
     Node* value = NodeProperties::GetValueInput(node, 3 + i);
-    effect = graph()->NewNode(
-        simplified()->StoreField(AccessBuilder::ForFixedArraySlot(i)), array,
-        value, effect, control);
+    if (value != jsgraph()->OptimizedOutConstant()) {
+      effect = graph()->NewNode(
+          simplified()->StoreField(AccessBuilder::ForFixedArraySlot(i)), array,
+          value, effect, control);
+    }
   }
 
   effect = graph()->NewNode(simplified()->StoreField(context_field), generator,
@@ -2069,12 +2080,27 @@ Reduction JSTypedLowering::ReduceJSGeneratorRestoreContinuation(Node* node) {
   return Changed(continuation);
 }
 
+Reduction JSTypedLowering::ReduceJSGeneratorRestoreContext(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSGeneratorRestoreContext, node->opcode());
+
+  const Operator* new_op =
+      simplified()->LoadField(AccessBuilder::ForJSGeneratorObjectContext());
+
+  // Mutate the node in-place.
+  DCHECK(OperatorProperties::HasContextInput(node->op()));
+  DCHECK(!OperatorProperties::HasContextInput(new_op));
+  node->RemoveInput(NodeProperties::FirstContextIndex(node));
+
+  NodeProperties::ChangeOp(node, new_op);
+  return Changed(node);
+}
+
 Reduction JSTypedLowering::ReduceJSGeneratorRestoreRegister(Node* node) {
   DCHECK_EQ(IrOpcode::kJSGeneratorRestoreRegister, node->opcode());
   Node* generator = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  int index = OpParameter<int>(node);
+  int index = RestoreRegisterIndexOf(node->op());
 
   FieldAccess array_field = AccessBuilder::ForJSGeneratorObjectRegisterFile();
   FieldAccess element_field = AccessBuilder::ForFixedArraySlot(index);
@@ -2190,6 +2216,8 @@ Reduction JSTypedLowering::Reduce(Node* node) {
       return ReduceJSGeneratorStore(node);
     case IrOpcode::kJSGeneratorRestoreContinuation:
       return ReduceJSGeneratorRestoreContinuation(node);
+    case IrOpcode::kJSGeneratorRestoreContext:
+      return ReduceJSGeneratorRestoreContext(node);
     case IrOpcode::kJSGeneratorRestoreRegister:
       return ReduceJSGeneratorRestoreRegister(node);
     case IrOpcode::kJSGeneratorRestoreInputOrDebugPos:
diff --git a/deps/v8/src/compiler/js-typed-lowering.h b/deps/v8/src/compiler/js-typed-lowering.h
index d72303f4955..72ce4fb8dde 100644
--- a/deps/v8/src/compiler/js-typed-lowering.h
+++ b/deps/v8/src/compiler/js-typed-lowering.h
@@ -25,6 +25,8 @@ class JSOperatorBuilder;
 class SimplifiedOperatorBuilder;
 class TypeCache;
 
+enum Signedness { kSigned, kUnsigned };
+
 // Lowers JS-level operators to simplified operators based on types.
 class V8_EXPORT_PRIVATE JSTypedLowering final
     : public NON_EXPORTED_BASE(AdvancedReducer) {
@@ -72,6 +74,7 @@ class V8_EXPORT_PRIVATE JSTypedLowering final
   Reduction ReduceJSStoreMessage(Node* node);
   Reduction ReduceJSGeneratorStore(Node* node);
   Reduction ReduceJSGeneratorRestoreContinuation(Node* node);
+  Reduction ReduceJSGeneratorRestoreContext(Node* node);
   Reduction ReduceJSGeneratorRestoreRegister(Node* node);
   Reduction ReduceJSGeneratorRestoreInputOrDebugPos(Node* node);
   Reduction ReduceNumberBinop(Node* node);
diff --git a/deps/v8/src/compiler/jump-threading.cc b/deps/v8/src/compiler/jump-threading.cc
index c2a84cc9b52..933ccc0a9cd 100644
--- a/deps/v8/src/compiler/jump-threading.cc
+++ b/deps/v8/src/compiler/jump-threading.cc
@@ -14,6 +14,8 @@ namespace compiler {
     if (FLAG_trace_turbo_jt) PrintF(__VA_ARGS__); \
   } while (false)
 
+namespace {
+
 struct JumpThreadingState {
   bool forwarded;
   ZoneVector<RpoNumber>& result;
@@ -53,6 +55,19 @@ struct JumpThreadingState {
   RpoNumber onstack() { return RpoNumber::FromInt(-2); }
 };
 
+bool IsBlockWithBranchPoisoning(InstructionSequence* code,
+                                InstructionBlock* block) {
+  if (block->PredecessorCount() != 1) return false;
+  RpoNumber pred_rpo = (block->predecessors())[0];
+  const InstructionBlock* pred = code->InstructionBlockAt(pred_rpo);
+  if (pred->code_start() == pred->code_end()) return false;
+  Instruction* instr = code->InstructionAt(pred->code_end() - 1);
+  FlagsMode mode = FlagsModeField::decode(instr->opcode());
+  return mode == kFlags_branch_and_poison;
+}
+
+}  // namespace
+
 bool JumpThreading::ComputeForwarding(Zone* local_zone,
                                       ZoneVector<RpoNumber>& result,
                                       InstructionSequence* code,
@@ -72,46 +87,48 @@ bool JumpThreading::ComputeForwarding(Zone* local_zone,
       // Process the instructions in a block up to a non-empty instruction.
       TRACE("jt [%d] B%d\n", static_cast<int>(stack.size()),
             block->rpo_number().ToInt());
-      bool fallthru = true;
       RpoNumber fw = block->rpo_number();
-      for (int i = block->code_start(); i < block->code_end(); ++i) {
-        Instruction* instr = code->InstructionAt(i);
-        if (!instr->AreMovesRedundant()) {
-          // can't skip instructions with non redundant moves.
-          TRACE("  parallel move\n");
-          fallthru = false;
-        } else if (FlagsModeField::decode(instr->opcode()) != kFlags_none) {
-          // can't skip instructions with flags continuations.
-          TRACE("  flags\n");
-          fallthru = false;
-        } else if (instr->IsNop()) {
-          // skip nops.
-          TRACE("  nop\n");
-          continue;
-        } else if (instr->arch_opcode() == kArchJmp) {
-          // try to forward the jump instruction.
-          TRACE("  jmp\n");
-          // if this block deconstructs the frame, we can't forward it.
-          // TODO(mtrofin): we can still forward if we end up building
-          // the frame at start. So we should move the decision of whether
-          // to build a frame or not in the register allocator, and trickle it
-          // here and to the code generator.
-          if (frame_at_start ||
-              !(block->must_deconstruct_frame() ||
-                block->must_construct_frame())) {
-            fw = code->InputRpo(instr, 0);
+      if (!IsBlockWithBranchPoisoning(code, block)) {
+        bool fallthru = true;
+        for (int i = block->code_start(); i < block->code_end(); ++i) {
+          Instruction* instr = code->InstructionAt(i);
+          if (!instr->AreMovesRedundant()) {
+            // can't skip instructions with non redundant moves.
+            TRACE("  parallel move\n");
+            fallthru = false;
+          } else if (FlagsModeField::decode(instr->opcode()) != kFlags_none) {
+            // can't skip instructions with flags continuations.
+            TRACE("  flags\n");
+            fallthru = false;
+          } else if (instr->IsNop()) {
+            // skip nops.
+            TRACE("  nop\n");
+            continue;
+          } else if (instr->arch_opcode() == kArchJmp) {
+            // try to forward the jump instruction.
+            TRACE("  jmp\n");
+            // if this block deconstructs the frame, we can't forward it.
+            // TODO(mtrofin): we can still forward if we end up building
+            // the frame at start. So we should move the decision of whether
+            // to build a frame or not in the register allocator, and trickle it
+            // here and to the code generator.
+            if (frame_at_start || !(block->must_deconstruct_frame() ||
+                                    block->must_construct_frame())) {
+              fw = code->InputRpo(instr, 0);
+            }
+            fallthru = false;
+          } else {
+            // can't skip other instructions.
+            TRACE("  other\n");
+            fallthru = false;
           }
-          fallthru = false;
-        } else {
-          // can't skip other instructions.
-          TRACE("  other\n");
-          fallthru = false;
+          break;
+        }
+        if (fallthru) {
+          int next = 1 + block->rpo_number().ToInt();
+          if (next < code->InstructionBlockCount())
+            fw = RpoNumber::FromInt(next);
         }
-        break;
-      }
-      if (fallthru) {
-        int next = 1 + block->rpo_number().ToInt();
-        if (next < code->InstructionBlockCount()) fw = RpoNumber::FromInt(next);
       }
       state.Forward(fw);
     }
@@ -155,7 +172,8 @@ void JumpThreading::ApplyForwarding(ZoneVector<RpoNumber>& result,
     bool fallthru = true;
     for (int i = block->code_start(); i < block->code_end(); ++i) {
       Instruction* instr = code->InstructionAt(i);
-      if (FlagsModeField::decode(instr->opcode()) == kFlags_branch) {
+      FlagsMode mode = FlagsModeField::decode(instr->opcode());
+      if (mode == kFlags_branch || mode == kFlags_branch_and_poison) {
         fallthru = false;  // branches don't fall through to the next block.
       } else if (instr->arch_opcode() == kArchJmp) {
         if (skip[block_num]) {
diff --git a/deps/v8/src/compiler/jump-threading.h b/deps/v8/src/compiler/jump-threading.h
index 84520ba3ed2..3a378d0499c 100644
--- a/deps/v8/src/compiler/jump-threading.h
+++ b/deps/v8/src/compiler/jump-threading.h
@@ -30,4 +30,4 @@ class JumpThreading {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_COMPILER_JUMP_THREADING_H
+#endif  // V8_COMPILER_JUMP_THREADING_H_
diff --git a/deps/v8/src/compiler/linkage.cc b/deps/v8/src/compiler/linkage.cc
index 5df50e64f5b..7ccad439d92 100644
--- a/deps/v8/src/compiler/linkage.cc
+++ b/deps/v8/src/compiler/linkage.cc
@@ -179,10 +179,8 @@ bool Linkage::NeedsFrameStateInput(Runtime::FunctionId function) {
       return false;
 
     // Some inline intrinsics are also safe to call without a FrameState.
-    case Runtime::kInlineClassOf:
     case Runtime::kInlineCreateIterResultObject:
     case Runtime::kInlineGeneratorClose:
-    case Runtime::kInlineGeneratorGetContext:
     case Runtime::kInlineGeneratorGetInputOrDebugPos:
     case Runtime::kInlineGeneratorGetResumeMode:
     case Runtime::kInlineCreateJSGeneratorObject:
@@ -462,6 +460,8 @@ CallDescriptor* Linkage::GetBytecodeDispatchCallDescriptor(
   // The target for interpreter dispatches is a code entry address.
   MachineType target_type = MachineType::Pointer();
   LinkageLocation target_loc = LinkageLocation::ForAnyRegister(target_type);
+  const CallDescriptor::Flags kFlags =
+      CallDescriptor::kCanUseRoots | CallDescriptor::kFixedTargetRegister;
   return new (zone) CallDescriptor(  // --
       CallDescriptor::kCallAddress,  // kind
       target_type,                   // target MachineType
@@ -471,7 +471,7 @@ CallDescriptor* Linkage::GetBytecodeDispatchCallDescriptor(
       Operator::kNoProperties,       // properties
       kNoCalleeSaved,                // callee-saved registers
       kNoCalleeSaved,                // callee-saved fp
-      CallDescriptor::kCanUseRoots,  // flags
+      kFlags,                        // flags
       descriptor.DebugName(isolate));
 }
 
diff --git a/deps/v8/src/compiler/linkage.h b/deps/v8/src/compiler/linkage.h
index ade1d6902fb..5b08bc7f7ca 100644
--- a/deps/v8/src/compiler/linkage.h
+++ b/deps/v8/src/compiler/linkage.h
@@ -184,7 +184,10 @@ class V8_EXPORT_PRIVATE CallDescriptor final
     // Push argument count as part of function prologue.
     kPushArgumentCount = 1u << 5,
     // Use retpoline for this call if indirect.
-    kRetpoline = 1u << 6
+    kRetpoline = 1u << 6,
+    // Use the kJavaScriptCallCodeStartRegister (fixed) register for the
+    // indirect target address when calling.
+    kFixedTargetRegister = 1u << 7
   };
   typedef base::Flags<Flag> Flags;
 
diff --git a/deps/v8/src/compiler/live-range-separator.h b/deps/v8/src/compiler/live-range-separator.h
index 6aaf6b69e69..0d48f25e5d7 100644
--- a/deps/v8/src/compiler/live-range-separator.h
+++ b/deps/v8/src/compiler/live-range-separator.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_LIVE_RANGE_SEPARATOR_H_
-#define V8_LIVE_RANGE_SEPARATOR_H_
+#ifndef V8_COMPILER_LIVE_RANGE_SEPARATOR_H_
+#define V8_COMPILER_LIVE_RANGE_SEPARATOR_H_
 
 #include "src/zone/zone.h"
 namespace v8 {
@@ -61,4 +61,4 @@ class LiveRangeMerger final : public ZoneObject {
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
-#endif  // V8_LIVE_RANGE_SEPARATOR_H_
+#endif  // V8_COMPILER_LIVE_RANGE_SEPARATOR_H_
diff --git a/deps/v8/src/compiler/load-elimination.cc b/deps/v8/src/compiler/load-elimination.cc
index 7888f5a21e3..40cc833e75d 100644
--- a/deps/v8/src/compiler/load-elimination.cc
+++ b/deps/v8/src/compiler/load-elimination.cc
@@ -329,6 +329,7 @@ void LoadElimination::AbstractElements::Print() const {
 
 Node* LoadElimination::AbstractField::Lookup(Node* object) const {
   for (auto pair : info_for_node_) {
+    if (pair.first->IsDead()) continue;
     if (MustAlias(object, pair.first)) return pair.second.value;
   }
   return nullptr;
@@ -364,6 +365,7 @@ LoadElimination::AbstractField const* LoadElimination::AbstractField::Kill(
     const AliasStateInfo& alias_info, MaybeHandle<Name> name,
     Zone* zone) const {
   for (auto pair : this->info_for_node_) {
+    if (pair.first->IsDead()) continue;
     if (alias_info.MayAlias(pair.first)) {
       AbstractField* that = new (zone) AbstractField(zone);
       for (auto pair : this->info_for_node_) {
@@ -821,9 +823,11 @@ Reduction LoadElimination::ReduceMaybeGrowFastElements(Node* node) {
     state = state->SetMaps(
         node, ZoneHandleSet<Map>(factory()->fixed_double_array_map()), zone());
   } else {
-    // We know that the resulting elements have the fixed array map.
-    state = state->SetMaps(
-        node, ZoneHandleSet<Map>(factory()->fixed_array_map()), zone());
+    // We know that the resulting elements have the fixed array map or the COW
+    // version thereof (if we didn't grow and it was already COW before).
+    ZoneHandleSet<Map> fixed_array_maps(factory()->fixed_array_map());
+    fixed_array_maps.insert(factory()->fixed_cow_array_map(), zone());
+    state = state->SetMaps(node, fixed_array_maps, zone());
   }
   // Kill the previous elements on {object}.
   state = state->KillField(object, FieldIndexOf(JSObject::kElementsOffset),
@@ -1344,7 +1348,7 @@ int LoadElimination::FieldIndexOf(FieldAccess const& access) {
       if (kDoubleSize != kPointerSize) {
         return -1;  // We currently only track pointer size fields.
       }
-    // Fall through.
+      break;
     case MachineRepresentation::kTaggedSigned:
     case MachineRepresentation::kTaggedPointer:
     case MachineRepresentation::kTagged:
diff --git a/deps/v8/src/compiler/load-elimination.h b/deps/v8/src/compiler/load-elimination.h
index 60ae16f1526..f853c8f953b 100644
--- a/deps/v8/src/compiler/load-elimination.h
+++ b/deps/v8/src/compiler/load-elimination.h
@@ -159,6 +159,7 @@ class V8_EXPORT_PRIVATE LoadElimination final
       for (auto this_it : this->info_for_node_) {
         Node* this_object = this_it.first;
         Field this_second = this_it.second;
+        if (this_object->IsDead()) continue;
         auto that_it = that->info_for_node_.find(this_object);
         if (that_it != that->info_for_node_.end() &&
             that_it->second == this_second) {
diff --git a/deps/v8/src/compiler/loop-variable-optimizer.cc b/deps/v8/src/compiler/loop-variable-optimizer.cc
index 1e93de51248..c1938ca3045 100644
--- a/deps/v8/src/compiler/loop-variable-optimizer.cc
+++ b/deps/v8/src/compiler/loop-variable-optimizer.cc
@@ -29,6 +29,7 @@ LoopVariableOptimizer::LoopVariableOptimizer(Graph* graph,
       common_(common),
       zone_(zone),
       limits_(graph->NodeCount(), zone),
+      reduced_(graph->NodeCount(), zone),
       induction_vars_(zone) {}
 
 void LoopVariableOptimizer::Run() {
@@ -40,13 +41,13 @@ void LoopVariableOptimizer::Run() {
     queue.pop();
     queued.Set(node, false);
 
-    DCHECK_NULL(limits_[node->id()]);
+    DCHECK(!reduced_.Get(node));
     bool all_inputs_visited = true;
     int inputs_end = (node->opcode() == IrOpcode::kLoop)
                          ? kFirstBackedge
                          : node->op()->ControlInputCount();
     for (int i = 0; i < inputs_end; i++) {
-      if (limits_[NodeProperties::GetControlInput(node, i)->id()] == nullptr) {
+      if (!reduced_.Get(NodeProperties::GetControlInput(node, i))) {
         all_inputs_visited = false;
         break;
       }
@@ -54,7 +55,7 @@ void LoopVariableOptimizer::Run() {
     if (!all_inputs_visited) continue;
 
     VisitNode(node);
-    DCHECK_NOT_NULL(limits_[node->id()]);
+    reduced_.Set(node, true);
 
     // Queue control outputs.
     for (Edge edge : node->use_edges()) {
@@ -73,80 +74,6 @@ void LoopVariableOptimizer::Run() {
   }
 }
 
-class LoopVariableOptimizer::Constraint : public ZoneObject {
- public:
-  InductionVariable::ConstraintKind kind() const { return kind_; }
-  Node* left() const { return left_; }
-  Node* right() const { return right_; }
-
-  const Constraint* next() const { return next_; }
-
-  Constraint(Node* left, InductionVariable::ConstraintKind kind, Node* right,
-             const Constraint* next)
-      : left_(left), right_(right), kind_(kind), next_(next) {}
-
- private:
-  Node* left_;
-  Node* right_;
-  InductionVariable::ConstraintKind kind_;
-  const Constraint* next_;
-};
-
-class LoopVariableOptimizer::VariableLimits : public ZoneObject {
- public:
-  static VariableLimits* Empty(Zone* zone) {
-    return new (zone) VariableLimits();
-  }
-
-  VariableLimits* Copy(Zone* zone) const {
-    return new (zone) VariableLimits(this);
-  }
-
-  void Add(Node* left, InductionVariable::ConstraintKind kind, Node* right,
-           Zone* zone) {
-    head_ = new (zone) Constraint(left, kind, right, head_);
-    limit_count_++;
-  }
-
-  void Merge(const VariableLimits* other) {
-    // Change the current condition list to a longest common tail
-    // of this condition list and the other list. (The common tail
-    // should correspond to the list from the common dominator.)
-
-    // First, we throw away the prefix of the longer list, so that
-    // we have lists of the same length.
-    size_t other_size = other->limit_count_;
-    const Constraint* other_limit = other->head_;
-    while (other_size > limit_count_) {
-      other_limit = other_limit->next();
-      other_size--;
-    }
-    while (limit_count_ > other_size) {
-      head_ = head_->next();
-      limit_count_--;
-    }
-
-    // Then we go through both lists in lock-step until we find
-    // the common tail.
-    while (head_ != other_limit) {
-      DCHECK_LT(0, limit_count_);
-      limit_count_--;
-      other_limit = other_limit->next();
-      head_ = head_->next();
-    }
-  }
-
-  const Constraint* head() const { return head_; }
-
- private:
-  VariableLimits() {}
-  explicit VariableLimits(const VariableLimits* other)
-      : head_(other->head_), limit_count_(other->limit_count_) {}
-
-  const Constraint* head_ = nullptr;
-  size_t limit_count_ = 0;
-};
-
 void InductionVariable::AddUpperBound(Node* bound,
                                       InductionVariable::ConstraintKind kind) {
   if (FLAG_trace_turbo_loop) {
@@ -173,21 +100,19 @@ void LoopVariableOptimizer::VisitBackedge(Node* from, Node* loop) {
 
   // Go through the constraints, and update the induction variables in
   // this loop if they are involved in the constraint.
-  const VariableLimits* limits = limits_[from->id()];
-  for (const Constraint* constraint = limits->head(); constraint != nullptr;
-       constraint = constraint->next()) {
-    if (constraint->left()->opcode() == IrOpcode::kPhi &&
-        NodeProperties::GetControlInput(constraint->left()) == loop) {
-      auto var = induction_vars_.find(constraint->left()->id());
+  for (Constraint constraint : limits_.Get(from)) {
+    if (constraint.left->opcode() == IrOpcode::kPhi &&
+        NodeProperties::GetControlInput(constraint.left) == loop) {
+      auto var = induction_vars_.find(constraint.left->id());
       if (var != induction_vars_.end()) {
-        var->second->AddUpperBound(constraint->right(), constraint->kind());
+        var->second->AddUpperBound(constraint.right, constraint.kind);
       }
     }
-    if (constraint->right()->opcode() == IrOpcode::kPhi &&
-        NodeProperties::GetControlInput(constraint->right()) == loop) {
-      auto var = induction_vars_.find(constraint->right()->id());
+    if (constraint.right->opcode() == IrOpcode::kPhi &&
+        NodeProperties::GetControlInput(constraint.right) == loop) {
+      auto var = induction_vars_.find(constraint.right->id());
       if (var != induction_vars_.end()) {
-        var->second->AddLowerBound(constraint->left(), constraint->kind());
+        var->second->AddLowerBound(constraint.left, constraint.kind);
       }
     }
   }
@@ -214,11 +139,11 @@ void LoopVariableOptimizer::VisitNode(Node* node) {
 
 void LoopVariableOptimizer::VisitMerge(Node* node) {
   // Merge the limits of all incoming edges.
-  VariableLimits* merged = limits_[node->InputAt(0)->id()]->Copy(zone());
+  VariableLimits merged = limits_.Get(node->InputAt(0));
   for (int i = 1; i < node->InputCount(); i++) {
-    merged->Merge(limits_[node->InputAt(i)->id()]);
+    merged.ResetToCommonAncestor(limits_.Get(node->InputAt(i)));
   }
-  limits_[node->id()] = merged;
+  limits_.Set(node, merged);
 }
 
 void LoopVariableOptimizer::VisitLoop(Node* node) {
@@ -230,27 +155,27 @@ void LoopVariableOptimizer::VisitLoop(Node* node) {
 void LoopVariableOptimizer::VisitIf(Node* node, bool polarity) {
   Node* branch = node->InputAt(0);
   Node* cond = branch->InputAt(0);
-  VariableLimits* limits = limits_[branch->id()]->Copy(zone());
+  VariableLimits limits = limits_.Get(branch);
   // Normalize to less than comparison.
   switch (cond->opcode()) {
     case IrOpcode::kJSLessThan:
     case IrOpcode::kSpeculativeNumberLessThan:
-      AddCmpToLimits(limits, cond, InductionVariable::kStrict, polarity);
+      AddCmpToLimits(&limits, cond, InductionVariable::kStrict, polarity);
       break;
     case IrOpcode::kJSGreaterThan:
-      AddCmpToLimits(limits, cond, InductionVariable::kNonStrict, !polarity);
+      AddCmpToLimits(&limits, cond, InductionVariable::kNonStrict, !polarity);
       break;
     case IrOpcode::kJSLessThanOrEqual:
     case IrOpcode::kSpeculativeNumberLessThanOrEqual:
-      AddCmpToLimits(limits, cond, InductionVariable::kNonStrict, polarity);
+      AddCmpToLimits(&limits, cond, InductionVariable::kNonStrict, polarity);
       break;
     case IrOpcode::kJSGreaterThanOrEqual:
-      AddCmpToLimits(limits, cond, InductionVariable::kStrict, !polarity);
+      AddCmpToLimits(&limits, cond, InductionVariable::kStrict, !polarity);
       break;
     default:
       break;
   }
-  limits_[node->id()] = limits;
+  limits_.Set(node, limits);
 }
 
 void LoopVariableOptimizer::AddCmpToLimits(
@@ -260,19 +185,17 @@ void LoopVariableOptimizer::AddCmpToLimits(
   Node* right = node->InputAt(1);
   if (FindInductionVariable(left) || FindInductionVariable(right)) {
     if (polarity) {
-      limits->Add(left, kind, right, zone());
+      limits->PushFront(Constraint{left, kind, right}, zone());
     } else {
       kind = (kind == InductionVariable::kStrict)
                  ? InductionVariable::kNonStrict
                  : InductionVariable::kStrict;
-      limits->Add(right, kind, left, zone());
+      limits->PushFront(Constraint{right, kind, left}, zone());
     }
   }
 }
 
-void LoopVariableOptimizer::VisitStart(Node* node) {
-  limits_[node->id()] = VariableLimits::Empty(zone());
-}
+void LoopVariableOptimizer::VisitStart(Node* node) { limits_.Set(node, {}); }
 
 void LoopVariableOptimizer::VisitLoopExit(Node* node) {
   return TakeConditionsFromFirstControl(node);
@@ -284,10 +207,7 @@ void LoopVariableOptimizer::VisitOtherControl(Node* node) {
 }
 
 void LoopVariableOptimizer::TakeConditionsFromFirstControl(Node* node) {
-  const VariableLimits* limits =
-      limits_[NodeProperties::GetControlInput(node, 0)->id()];
-  DCHECK_NOT_NULL(limits);
-  limits_[node->id()] = limits;
+  limits_.Set(node, limits_.Get(NodeProperties::GetControlInput(node, 0)));
 }
 
 const InductionVariable* LoopVariableOptimizer::FindInductionVariable(
@@ -319,7 +239,12 @@ InductionVariable* LoopVariableOptimizer::TryGetInductionVariable(Node* phi) {
   }
 
   // TODO(jarin) Support both sides.
-  if (arith->InputAt(0) != phi) return nullptr;
+  Node* input = arith->InputAt(0);
+  if (input->opcode() == IrOpcode::kSpeculativeToNumber ||
+      input->opcode() == IrOpcode::kJSToNumber) {
+    input = input->InputAt(0);
+  }
+  if (input != phi) return nullptr;
 
   Node* effect_phi = nullptr;
   for (Node* use : loop->uses()) {
diff --git a/deps/v8/src/compiler/loop-variable-optimizer.h b/deps/v8/src/compiler/loop-variable-optimizer.h
index 9eec6140701..8e1d4bfebe5 100644
--- a/deps/v8/src/compiler/loop-variable-optimizer.h
+++ b/deps/v8/src/compiler/loop-variable-optimizer.h
@@ -5,6 +5,8 @@
 #ifndef V8_COMPILER_LOOP_VARIABLE_OPTIMIZER_H_
 #define V8_COMPILER_LOOP_VARIABLE_OPTIMIZER_H_
 
+#include "src/compiler/functional-list.h"
+#include "src/compiler/node-aux-data.h"
 #include "src/zone/zone-containers.h"
 
 namespace v8 {
@@ -82,8 +84,17 @@ class LoopVariableOptimizer {
   const int kAssumedLoopEntryIndex = 0;
   const int kFirstBackedge = 1;
 
-  class Constraint;
-  class VariableLimits;
+  struct Constraint {
+    Node* left;
+    InductionVariable::ConstraintKind kind;
+    Node* right;
+
+    bool operator!=(const Constraint& other) const {
+      return left != other.left || kind != other.kind || right != other.right;
+    }
+  };
+
+  using VariableLimits = FunctionalList<Constraint>;
 
   void VisitBackedge(Node* from, Node* loop);
   void VisitNode(Node* node);
@@ -109,7 +120,9 @@ class LoopVariableOptimizer {
   Graph* graph_;
   CommonOperatorBuilder* common_;
   Zone* zone_;
-  ZoneVector<const VariableLimits*> limits_;
+  NodeAuxData<VariableLimits> limits_;
+  NodeAuxData<bool> reduced_;
+
   ZoneMap<int, InductionVariable*> induction_vars_;
 };
 
diff --git a/deps/v8/src/compiler/machine-graph-verifier.cc b/deps/v8/src/compiler/machine-graph-verifier.cc
index 43f15184618..4418a2813fc 100644
--- a/deps/v8/src/compiler/machine-graph-verifier.cc
+++ b/deps/v8/src/compiler/machine-graph-verifier.cc
@@ -62,8 +62,8 @@ class MachineRepresentationInferrer {
                           : MachineRepresentation::kBit;
       case IrOpcode::kCall:
       case IrOpcode::kCallWithCallerSavedRegisters: {
-        CallDescriptor const* desc = CallDescriptorOf(input->op());
-        return desc->GetReturnType(index).representation();
+        auto call_descriptor = CallDescriptorOf(input->op());
+        return call_descriptor->GetReturnType(index).representation();
       }
       default:
         return MachineRepresentation::kNone;
@@ -110,21 +110,23 @@ class MachineRepresentationInferrer {
           case IrOpcode::kTypedStateValues:
             representation_vector_[node->id()] = MachineRepresentation::kNone;
             break;
-          case IrOpcode::kAtomicLoad:
+          case IrOpcode::kWord32AtomicLoad:
           case IrOpcode::kLoad:
           case IrOpcode::kProtectedLoad:
+          case IrOpcode::kPoisonedLoad:
             representation_vector_[node->id()] = PromoteRepresentation(
                 LoadRepresentationOf(node->op()).representation());
             break;
           case IrOpcode::kLoadStackPointer:
           case IrOpcode::kLoadFramePointer:
           case IrOpcode::kLoadParentFramePointer:
+          case IrOpcode::kLoadRootsPointer:
             representation_vector_[node->id()] =
                 MachineType::PointerRepresentation();
             break;
           case IrOpcode::kUnalignedLoad:
             representation_vector_[node->id()] = PromoteRepresentation(
-                UnalignedLoadRepresentationOf(node->op()).representation());
+                LoadRepresentationOf(node->op()).representation());
             break;
           case IrOpcode::kPhi:
             representation_vector_[node->id()] =
@@ -132,27 +134,27 @@ class MachineRepresentationInferrer {
             break;
           case IrOpcode::kCall:
           case IrOpcode::kCallWithCallerSavedRegisters: {
-            CallDescriptor const* desc = CallDescriptorOf(node->op());
-            if (desc->ReturnCount() > 0) {
+            auto call_descriptor = CallDescriptorOf(node->op());
+            if (call_descriptor->ReturnCount() > 0) {
               representation_vector_[node->id()] =
-                  desc->GetReturnType(0).representation();
+                  call_descriptor->GetReturnType(0).representation();
             } else {
               representation_vector_[node->id()] =
                   MachineRepresentation::kTagged;
             }
             break;
           }
-          case IrOpcode::kAtomicStore:
+          case IrOpcode::kWord32AtomicStore:
             representation_vector_[node->id()] =
                 PromoteRepresentation(AtomicStoreRepresentationOf(node->op()));
             break;
-          case IrOpcode::kAtomicExchange:
-          case IrOpcode::kAtomicCompareExchange:
-          case IrOpcode::kAtomicAdd:
-          case IrOpcode::kAtomicSub:
-          case IrOpcode::kAtomicAnd:
-          case IrOpcode::kAtomicOr:
-          case IrOpcode::kAtomicXor:
+          case IrOpcode::kWord32AtomicExchange:
+          case IrOpcode::kWord32AtomicCompareExchange:
+          case IrOpcode::kWord32AtomicAdd:
+          case IrOpcode::kWord32AtomicSub:
+          case IrOpcode::kWord32AtomicAnd:
+          case IrOpcode::kWord32AtomicOr:
+          case IrOpcode::kWord32AtomicXor:
             representation_vector_[node->id()] = PromoteRepresentation(
                 AtomicOpRepresentationOf(node->op()).representation());
             break;
@@ -173,6 +175,7 @@ class MachineRepresentationInferrer {
           case IrOpcode::kChangeInt32ToTagged:
           case IrOpcode::kChangeUint32ToTagged:
           case IrOpcode::kBitcastWordToTagged:
+          case IrOpcode::kPoisonOnSpeculationTagged:
             representation_vector_[node->id()] = MachineRepresentation::kTagged;
             break;
           case IrOpcode::kExternalConstant:
@@ -180,6 +183,7 @@ class MachineRepresentationInferrer {
                 MachineType::PointerRepresentation();
             break;
           case IrOpcode::kBitcastTaggedToWord:
+          case IrOpcode::kPoisonOnSpeculationWord:
             representation_vector_[node->id()] =
                 MachineType::PointerRepresentation();
             break;
@@ -330,10 +334,12 @@ class MachineRepresentationChecker {
             break;
           case IrOpcode::kBitcastWordToTagged:
           case IrOpcode::kBitcastWordToTaggedSigned:
+          case IrOpcode::kPoisonOnSpeculationWord:
             CheckValueInputRepresentationIs(
                 node, 0, MachineType::PointerRepresentation());
             break;
           case IrOpcode::kBitcastTaggedToWord:
+          case IrOpcode::kPoisonOnSpeculationTagged:
             CheckValueInputIsTagged(node, 0);
             break;
           case IrOpcode::kTruncateFloat64ToWord32:
@@ -459,19 +465,20 @@ class MachineRepresentationChecker {
             CheckValueInputIsTagged(node, 0);
             break;
           case IrOpcode::kLoad:
-          case IrOpcode::kAtomicLoad:
+          case IrOpcode::kWord32AtomicLoad:
+          case IrOpcode::kPoisonedLoad:
             CheckValueInputIsTaggedOrPointer(node, 0);
             CheckValueInputRepresentationIs(
                 node, 1, MachineType::PointerRepresentation());
             break;
           case IrOpcode::kStore:
-          case IrOpcode::kAtomicStore:
-          case IrOpcode::kAtomicExchange:
-          case IrOpcode::kAtomicAdd:
-          case IrOpcode::kAtomicSub:
-          case IrOpcode::kAtomicAnd:
-          case IrOpcode::kAtomicOr:
-          case IrOpcode::kAtomicXor:
+          case IrOpcode::kWord32AtomicStore:
+          case IrOpcode::kWord32AtomicExchange:
+          case IrOpcode::kWord32AtomicAdd:
+          case IrOpcode::kWord32AtomicSub:
+          case IrOpcode::kWord32AtomicAnd:
+          case IrOpcode::kWord32AtomicOr:
+          case IrOpcode::kWord32AtomicXor:
             CheckValueInputIsTaggedOrPointer(node, 0);
             CheckValueInputRepresentationIs(
                 node, 1, MachineType::PointerRepresentation());
@@ -486,7 +493,7 @@ class MachineRepresentationChecker {
                     node, 2, inferrer_->GetRepresentation(node));
             }
             break;
-          case IrOpcode::kAtomicCompareExchange:
+          case IrOpcode::kWord32AtomicCompareExchange:
             CheckValueInputIsTaggedOrPointer(node, 0);
             CheckValueInputRepresentationIs(
                 node, 1, MachineType::PointerRepresentation());
@@ -737,15 +744,15 @@ class MachineRepresentationChecker {
   }
 
   void CheckCallInputs(Node const* node) {
-    CallDescriptor const* desc = CallDescriptorOf(node->op());
+    auto call_descriptor = CallDescriptorOf(node->op());
     std::ostringstream str;
     bool should_log_error = false;
-    for (size_t i = 0; i < desc->InputCount(); ++i) {
+    for (size_t i = 0; i < call_descriptor->InputCount(); ++i) {
       Node const* input = node->InputAt(static_cast<int>(i));
       MachineRepresentation const input_type =
           inferrer_->GetRepresentation(input);
       MachineRepresentation const expected_input_type =
-          desc->GetInputType(i).representation();
+          call_descriptor->GetInputType(i).representation();
       if (!IsCompatible(expected_input_type, input_type)) {
         if (!should_log_error) {
           should_log_error = true;
diff --git a/deps/v8/src/compiler/machine-operator-reducer.cc b/deps/v8/src/compiler/machine-operator-reducer.cc
index 97c83b1b827..1fcfa52e511 100644
--- a/deps/v8/src/compiler/machine-operator-reducer.cc
+++ b/deps/v8/src/compiler/machine-operator-reducer.cc
@@ -352,10 +352,6 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
     }
     case IrOpcode::kFloat64Add: {
       Float64BinopMatcher m(node);
-      if (m.right().IsNaN()) {  // x + NaN => NaN
-        // Do some calculation to make a signalling NaN quiet.
-        return ReplaceFloat64(m.right().Value() - m.right().Value());
-      }
       if (m.IsFoldable()) {  // K + K => K
         return ReplaceFloat64(m.left().Value() + m.right().Value());
       }
diff --git a/deps/v8/src/compiler/machine-operator.cc b/deps/v8/src/compiler/machine-operator.cc
index 66178308be7..f26176fd80e 100644
--- a/deps/v8/src/compiler/machine-operator.cc
+++ b/deps/v8/src/compiler/machine-operator.cc
@@ -37,7 +37,10 @@ std::ostream& operator<<(std::ostream& os, StoreRepresentation rep) {
 LoadRepresentation LoadRepresentationOf(Operator const* op) {
   DCHECK(IrOpcode::kLoad == op->opcode() ||
          IrOpcode::kProtectedLoad == op->opcode() ||
-         IrOpcode::kAtomicLoad == op->opcode());
+         IrOpcode::kWord32AtomicLoad == op->opcode() ||
+         IrOpcode::kWord64AtomicLoad == op->opcode() ||
+         IrOpcode::kPoisonedLoad == op->opcode() ||
+         IrOpcode::kUnalignedLoad == op->opcode());
   return OpParameter<LoadRepresentation>(op);
 }
 
@@ -48,11 +51,6 @@ StoreRepresentation const& StoreRepresentationOf(Operator const* op) {
   return OpParameter<StoreRepresentation>(op);
 }
 
-UnalignedLoadRepresentation UnalignedLoadRepresentationOf(Operator const* op) {
-  DCHECK_EQ(IrOpcode::kUnalignedLoad, op->opcode());
-  return OpParameter<UnalignedLoadRepresentation>(op);
-}
-
 UnalignedStoreRepresentation const& UnalignedStoreRepresentationOf(
     Operator const* op) {
   DCHECK_EQ(IrOpcode::kUnalignedStore, op->opcode());
@@ -81,7 +79,8 @@ StackSlotRepresentation const& StackSlotRepresentationOf(Operator const* op) {
 }
 
 MachineRepresentation AtomicStoreRepresentationOf(Operator const* op) {
-  DCHECK_EQ(IrOpcode::kAtomicStore, op->opcode());
+  DCHECK(IrOpcode::kWord32AtomicStore == op->opcode() ||
+         IrOpcode::kWord64AtomicStore == op->opcode());
   return OpParameter<MachineRepresentation>(op);
 }
 
@@ -169,6 +168,11 @@ MachineType AtomicOpRepresentationOf(Operator const* op) {
   V(BitcastFloat64ToInt64, Operator::kNoProperties, 1, 0, 1)              \
   V(BitcastInt32ToFloat32, Operator::kNoProperties, 1, 0, 1)              \
   V(BitcastInt64ToFloat64, Operator::kNoProperties, 1, 0, 1)              \
+  V(SignExtendWord8ToInt32, Operator::kNoProperties, 1, 0, 1)             \
+  V(SignExtendWord16ToInt32, Operator::kNoProperties, 1, 0, 1)            \
+  V(SignExtendWord8ToInt64, Operator::kNoProperties, 1, 0, 1)             \
+  V(SignExtendWord16ToInt64, Operator::kNoProperties, 1, 0, 1)            \
+  V(SignExtendWord32ToInt64, Operator::kNoProperties, 1, 0, 1)            \
   V(Float32Abs, Operator::kNoProperties, 1, 0, 1)                         \
   V(Float32Add, Operator::kCommutative, 2, 0, 1)                          \
   V(Float32Sub, Operator::kNoProperties, 2, 0, 1)                         \
@@ -222,6 +226,7 @@ MachineType AtomicOpRepresentationOf(Operator const* op) {
   V(LoadStackPointer, Operator::kNoProperties, 0, 0, 1)                   \
   V(LoadFramePointer, Operator::kNoProperties, 0, 0, 1)                   \
   V(LoadParentFramePointer, Operator::kNoProperties, 0, 0, 1)             \
+  V(LoadRootsPointer, Operator::kNoProperties, 0, 0, 1)                   \
   V(Int32PairAdd, Operator::kNoProperties, 4, 0, 2)                       \
   V(Int32PairSub, Operator::kNoProperties, 4, 0, 2)                       \
   V(Int32PairMul, Operator::kNoProperties, 4, 0, 2)                       \
@@ -394,11 +399,21 @@ MachineType AtomicOpRepresentationOf(Operator const* op) {
   V(Int32)                  \
   V(Uint32)
 
+#define ATOMIC64_TYPE_LIST(V) \
+  V(Uint8)                    \
+  V(Uint16)                   \
+  V(Uint32)                   \
+  V(Uint64)
+
 #define ATOMIC_REPRESENTATION_LIST(V) \
   V(kWord8)                           \
   V(kWord16)                          \
   V(kWord32)
 
+#define ATOMIC64_REPRESENTATION_LIST(V) \
+  ATOMIC_REPRESENTATION_LIST(V)         \
+  V(kWord64)
+
 #define SIMD_LANE_OP_LIST(V) \
   V(F32x4, 4)                \
   V(I32x4, 4)                \
@@ -454,10 +469,18 @@ struct MachineOperatorGlobalCache {
               Operator::kNoDeopt | Operator::kNoThrow | Operator::kNoWrite,   \
               "Load", 2, 1, 1, 1, 1, 0, MachineType::Type()) {}               \
   };                                                                          \
+  struct PoisonedLoad##Type##Operator final                                   \
+      : public Operator1<LoadRepresentation> {                                \
+    PoisonedLoad##Type##Operator()                                            \
+        : Operator1<LoadRepresentation>(                                      \
+              IrOpcode::kPoisonedLoad,                                        \
+              Operator::kNoDeopt | Operator::kNoThrow | Operator::kNoWrite,   \
+              "PoisonedLoad", 2, 1, 1, 1, 1, 0, MachineType::Type()) {}       \
+  };                                                                          \
   struct UnalignedLoad##Type##Operator final                                  \
-      : public Operator1<UnalignedLoadRepresentation> {                       \
+      : public Operator1<LoadRepresentation> {                                \
     UnalignedLoad##Type##Operator()                                           \
-        : Operator1<UnalignedLoadRepresentation>(                             \
+        : Operator1<LoadRepresentation>(                                      \
               IrOpcode::kUnalignedLoad,                                       \
               Operator::kNoDeopt | Operator::kNoThrow | Operator::kNoWrite,   \
               "UnalignedLoad", 2, 1, 1, 1, 1, 0, MachineType::Type()) {}      \
@@ -471,6 +494,7 @@ struct MachineOperatorGlobalCache {
               1, 1, 1, 0, MachineType::Type()) {}                             \
   };                                                                          \
   Load##Type##Operator kLoad##Type;                                           \
+  PoisonedLoad##Type##Operator kPoisonedLoad##Type;                           \
   UnalignedLoad##Type##Operator kUnalignedLoad##Type;                         \
   ProtectedLoad##Type##Operator kProtectedLoad##Type;
   MACHINE_TYPE_LIST(LOAD)
@@ -547,30 +571,58 @@ struct MachineOperatorGlobalCache {
 #undef STORE
 
 #define ATOMIC_LOAD(Type)                                                   \
-  struct AtomicLoad##Type##Operator final                                   \
+  struct Word32AtomicLoad##Type##Operator final                             \
       : public Operator1<LoadRepresentation> {                              \
-    AtomicLoad##Type##Operator()                                            \
+    Word32AtomicLoad##Type##Operator()                                      \
         : Operator1<LoadRepresentation>(                                    \
-              IrOpcode::kAtomicLoad,                                        \
+              IrOpcode::kWord32AtomicLoad,                                  \
               Operator::kNoDeopt | Operator::kNoThrow | Operator::kNoWrite, \
-              "AtomicLoad", 2, 1, 1, 1, 1, 0, MachineType::Type()) {}       \
+              "Word32AtomicLoad", 2, 1, 1, 1, 1, 0, MachineType::Type()) {} \
   };                                                                        \
-  AtomicLoad##Type##Operator kAtomicLoad##Type;
+  Word32AtomicLoad##Type##Operator kWord32AtomicLoad##Type;
   ATOMIC_TYPE_LIST(ATOMIC_LOAD)
 #undef ATOMIC_LOAD
 
-#define ATOMIC_STORE(Type)                                                     \
-  struct AtomicStore##Type##Operator                                           \
-      : public Operator1<MachineRepresentation> {                              \
-    AtomicStore##Type##Operator()                                              \
-        : Operator1<MachineRepresentation>(                                    \
-              IrOpcode::kAtomicStore,                                          \
-              Operator::kNoDeopt | Operator::kNoRead | Operator::kNoThrow,     \
-              "AtomicStore", 3, 1, 1, 0, 1, 0, MachineRepresentation::Type) {} \
-  };                                                                           \
-  AtomicStore##Type##Operator kAtomicStore##Type;
+#define ATOMIC_LOAD(Type)                                                   \
+  struct Word64AtomicLoad##Type##Operator final                             \
+      : public Operator1<LoadRepresentation> {                              \
+    Word64AtomicLoad##Type##Operator()                                      \
+        : Operator1<LoadRepresentation>(                                    \
+              IrOpcode::kWord64AtomicLoad,                                  \
+              Operator::kNoDeopt | Operator::kNoThrow | Operator::kNoWrite, \
+              "Word64AtomicLoad", 2, 1, 1, 1, 1, 0, MachineType::Type()) {} \
+  };                                                                        \
+  Word64AtomicLoad##Type##Operator kWord64AtomicLoad##Type;
+  ATOMIC64_TYPE_LIST(ATOMIC_LOAD)
+#undef ATOMIC_LOAD
+
+#define ATOMIC_STORE(Type)                                                 \
+  struct Word32AtomicStore##Type##Operator                                 \
+      : public Operator1<MachineRepresentation> {                          \
+    Word32AtomicStore##Type##Operator()                                    \
+        : Operator1<MachineRepresentation>(                                \
+              IrOpcode::kWord32AtomicStore,                                \
+              Operator::kNoDeopt | Operator::kNoRead | Operator::kNoThrow, \
+              "Word32AtomicStore", 3, 1, 1, 0, 1, 0,                       \
+              MachineRepresentation::Type) {}                              \
+  };                                                                       \
+  Word32AtomicStore##Type##Operator kWord32AtomicStore##Type;
   ATOMIC_REPRESENTATION_LIST(ATOMIC_STORE)
-#undef STORE
+#undef ATOMIC_STORE
+
+#define ATOMIC_STORE(Type)                                                 \
+  struct Word64AtomicStore##Type##Operator                                 \
+      : public Operator1<MachineRepresentation> {                          \
+    Word64AtomicStore##Type##Operator()                                    \
+        : Operator1<MachineRepresentation>(                                \
+              IrOpcode::kWord64AtomicStore,                                \
+              Operator::kNoDeopt | Operator::kNoRead | Operator::kNoThrow, \
+              "Word64AtomicStore", 3, 1, 1, 0, 1, 0,                       \
+              MachineRepresentation::Type) {}                              \
+  };                                                                       \
+  Word64AtomicStore##Type##Operator kWord64AtomicStore##Type;
+  ATOMIC64_REPRESENTATION_LIST(ATOMIC_STORE)
+#undef ATOMIC_STORE
 
 #define ATOMIC_OP(op, type)                                                    \
   struct op##type##Operator : public Operator1<MachineType> {                  \
@@ -580,30 +632,54 @@ struct MachineOperatorGlobalCache {
                                  3, 1, 1, 1, 1, 0, MachineType::type()) {}     \
   };                                                                           \
   op##type##Operator k##op##type;
-#define ATOMIC_OP_LIST(type)      \
-  ATOMIC_OP(AtomicExchange, type) \
-  ATOMIC_OP(AtomicAdd, type)      \
-  ATOMIC_OP(AtomicSub, type)      \
-  ATOMIC_OP(AtomicAnd, type)      \
-  ATOMIC_OP(AtomicOr, type)       \
-  ATOMIC_OP(AtomicXor, type)
+#define ATOMIC_OP_LIST(type)       \
+  ATOMIC_OP(Word32AtomicAdd, type) \
+  ATOMIC_OP(Word32AtomicSub, type) \
+  ATOMIC_OP(Word32AtomicAnd, type) \
+  ATOMIC_OP(Word32AtomicOr, type)  \
+  ATOMIC_OP(Word32AtomicXor, type) \
+  ATOMIC_OP(Word32AtomicExchange, type)
   ATOMIC_TYPE_LIST(ATOMIC_OP_LIST)
 #undef ATOMIC_OP_LIST
+#define ATOMIC64_OP_LIST(type)     \
+  ATOMIC_OP(Word64AtomicAdd, type) \
+  ATOMIC_OP(Word64AtomicSub, type) \
+  ATOMIC_OP(Word64AtomicAnd, type) \
+  ATOMIC_OP(Word64AtomicOr, type)  \
+  ATOMIC_OP(Word64AtomicXor, type) \
+  ATOMIC_OP(Word64AtomicExchange, type)
+  ATOMIC64_TYPE_LIST(ATOMIC64_OP_LIST)
+#undef ATOMIC64_OP_LIST
 #undef ATOMIC_OP
 
-#define ATOMIC_COMPARE_EXCHANGE(Type)                                       \
-  struct AtomicCompareExchange##Type##Operator                              \
-      : public Operator1<MachineType> {                                     \
-    AtomicCompareExchange##Type##Operator()                                 \
-        : Operator1<MachineType>(IrOpcode::kAtomicCompareExchange,          \
-                                 Operator::kNoDeopt | Operator::kNoThrow,   \
-                                 "AtomicCompareExchange", 4, 1, 1, 1, 1, 0, \
-                                 MachineType::Type()) {}                    \
-  };                                                                        \
-  AtomicCompareExchange##Type##Operator kAtomicCompareExchange##Type;
+#define ATOMIC_COMPARE_EXCHANGE(Type)                                          \
+  struct Word32AtomicCompareExchange##Type##Operator                           \
+      : public Operator1<MachineType> {                                        \
+    Word32AtomicCompareExchange##Type##Operator()                              \
+        : Operator1<MachineType>(IrOpcode::kWord32AtomicCompareExchange,       \
+                                 Operator::kNoDeopt | Operator::kNoThrow,      \
+                                 "Word32AtomicCompareExchange", 4, 1, 1, 1, 1, \
+                                 0, MachineType::Type()) {}                    \
+  };                                                                           \
+  Word32AtomicCompareExchange##Type##Operator                                  \
+      kWord32AtomicCompareExchange##Type;
   ATOMIC_TYPE_LIST(ATOMIC_COMPARE_EXCHANGE)
 #undef ATOMIC_COMPARE_EXCHANGE
 
+#define ATOMIC_COMPARE_EXCHANGE(Type)                                          \
+  struct Word64AtomicCompareExchange##Type##Operator                           \
+      : public Operator1<MachineType> {                                        \
+    Word64AtomicCompareExchange##Type##Operator()                              \
+        : Operator1<MachineType>(IrOpcode::kWord64AtomicCompareExchange,       \
+                                 Operator::kNoDeopt | Operator::kNoThrow,      \
+                                 "Word64AtomicCompareExchange", 4, 1, 1, 1, 1, \
+                                 0, MachineType::Type()) {}                    \
+  };                                                                           \
+  Word64AtomicCompareExchange##Type##Operator                                  \
+      kWord64AtomicCompareExchange##Type;
+  ATOMIC64_TYPE_LIST(ATOMIC_COMPARE_EXCHANGE)
+#undef ATOMIC_COMPARE_EXCHANGE
+
   // The {BitcastWordToTagged} operator must not be marked as pure (especially
   // not idempotent), because otherwise the splitting logic in the Scheduler
   // might decide to split these operators, thus potentially creating live
@@ -625,6 +701,22 @@ struct MachineOperatorGlobalCache {
   };
   BitcastTaggedToWordOperator kBitcastTaggedToWord;
 
+  struct PoisonOnSpeculationTagged : public Operator {
+    PoisonOnSpeculationTagged()
+        : Operator(IrOpcode::kPoisonOnSpeculationTagged,
+                   Operator::kEliminatable | Operator::kNoWrite,
+                   "PoisonOnSpeculationTagged", 1, 1, 1, 1, 1, 0) {}
+  };
+  PoisonOnSpeculationTagged kPoisonOnSpeculationTagged;
+
+  struct PoisonOnSpeculationWord : public Operator {
+    PoisonOnSpeculationWord()
+        : Operator(IrOpcode::kPoisonOnSpeculationWord,
+                   Operator::kEliminatable | Operator::kNoWrite,
+                   "PoisonOnSpeculationWord", 1, 1, 1, 1, 1, 0) {}
+  };
+  PoisonOnSpeculationWord kPoisonOnSpeculationWord;
+
   struct SpeculationFenceOperator : public Operator {
     SpeculationFenceOperator()
         : Operator(IrOpcode::kSpeculationFence, Operator::kNoThrow,
@@ -675,8 +767,7 @@ MachineOperatorBuilder::MachineOperatorBuilder(
          word == MachineRepresentation::kWord64);
 }
 
-const Operator* MachineOperatorBuilder::UnalignedLoad(
-    UnalignedLoadRepresentation rep) {
+const Operator* MachineOperatorBuilder::UnalignedLoad(LoadRepresentation rep) {
 #define LOAD(Type)                       \
   if (rep == MachineType::Type()) {      \
     return &cache_.kUnalignedLoad##Type; \
@@ -730,6 +821,16 @@ const Operator* MachineOperatorBuilder::Load(LoadRepresentation rep) {
   UNREACHABLE();
 }
 
+const Operator* MachineOperatorBuilder::PoisonedLoad(LoadRepresentation rep) {
+#define LOAD(Type)                      \
+  if (rep == MachineType::Type()) {     \
+    return &cache_.kPoisonedLoad##Type; \
+  }
+  MACHINE_TYPE_LIST(LOAD)
+#undef LOAD
+  UNREACHABLE();
+}
+
 const Operator* MachineOperatorBuilder::ProtectedLoad(LoadRepresentation rep) {
 #define LOAD(Type)                       \
   if (rep == MachineType::Type()) {      \
@@ -823,96 +924,200 @@ const Operator* MachineOperatorBuilder::Comment(const char* msg) {
   return new (zone_) CommentOperator(msg);
 }
 
-const Operator* MachineOperatorBuilder::AtomicLoad(LoadRepresentation rep) {
-#define LOAD(Type)                    \
-  if (rep == MachineType::Type()) {   \
-    return &cache_.kAtomicLoad##Type; \
+const Operator* MachineOperatorBuilder::Word32AtomicLoad(
+    LoadRepresentation rep) {
+#define LOAD(Type)                          \
+  if (rep == MachineType::Type()) {         \
+    return &cache_.kWord32AtomicLoad##Type; \
   }
   ATOMIC_TYPE_LIST(LOAD)
 #undef LOAD
   UNREACHABLE();
 }
 
-const Operator* MachineOperatorBuilder::AtomicStore(MachineRepresentation rep) {
-#define STORE(kRep)                         \
-  if (rep == MachineRepresentation::kRep) { \
-    return &cache_.kAtomicStore##kRep;      \
+const Operator* MachineOperatorBuilder::Word32AtomicStore(
+    MachineRepresentation rep) {
+#define STORE(kRep)                          \
+  if (rep == MachineRepresentation::kRep) {  \
+    return &cache_.kWord32AtomicStore##kRep; \
   }
   ATOMIC_REPRESENTATION_LIST(STORE)
 #undef STORE
   UNREACHABLE();
 }
 
-const Operator* MachineOperatorBuilder::AtomicExchange(MachineType rep) {
-#define EXCHANGE(kRep)                    \
-  if (rep == MachineType::kRep()) {       \
-    return &cache_.kAtomicExchange##kRep; \
+const Operator* MachineOperatorBuilder::Word32AtomicExchange(MachineType rep) {
+#define EXCHANGE(kRep)                          \
+  if (rep == MachineType::kRep()) {             \
+    return &cache_.kWord32AtomicExchange##kRep; \
   }
   ATOMIC_TYPE_LIST(EXCHANGE)
 #undef EXCHANGE
   UNREACHABLE();
 }
 
-const Operator* MachineOperatorBuilder::AtomicCompareExchange(MachineType rep) {
-#define COMPARE_EXCHANGE(kRep)                   \
-  if (rep == MachineType::kRep()) {              \
-    return &cache_.kAtomicCompareExchange##kRep; \
+const Operator* MachineOperatorBuilder::Word32AtomicCompareExchange(
+    MachineType rep) {
+#define COMPARE_EXCHANGE(kRep)                         \
+  if (rep == MachineType::kRep()) {                    \
+    return &cache_.kWord32AtomicCompareExchange##kRep; \
   }
   ATOMIC_TYPE_LIST(COMPARE_EXCHANGE)
 #undef COMPARE_EXCHANGE
   UNREACHABLE();
 }
 
-const Operator* MachineOperatorBuilder::AtomicAdd(MachineType rep) {
-#define ADD(kRep)                    \
-  if (rep == MachineType::kRep()) {  \
-    return &cache_.kAtomicAdd##kRep; \
+const Operator* MachineOperatorBuilder::Word32AtomicAdd(MachineType rep) {
+#define ADD(kRep)                          \
+  if (rep == MachineType::kRep()) {        \
+    return &cache_.kWord32AtomicAdd##kRep; \
   }
   ATOMIC_TYPE_LIST(ADD)
 #undef ADD
   UNREACHABLE();
 }
 
-const Operator* MachineOperatorBuilder::AtomicSub(MachineType rep) {
-#define SUB(kRep)                    \
-  if (rep == MachineType::kRep()) {  \
-    return &cache_.kAtomicSub##kRep; \
+const Operator* MachineOperatorBuilder::Word32AtomicSub(MachineType rep) {
+#define SUB(kRep)                          \
+  if (rep == MachineType::kRep()) {        \
+    return &cache_.kWord32AtomicSub##kRep; \
   }
   ATOMIC_TYPE_LIST(SUB)
 #undef SUB
   UNREACHABLE();
 }
 
-const Operator* MachineOperatorBuilder::AtomicAnd(MachineType rep) {
-#define AND(kRep)                    \
-  if (rep == MachineType::kRep()) {  \
-    return &cache_.kAtomicAnd##kRep; \
+const Operator* MachineOperatorBuilder::Word32AtomicAnd(MachineType rep) {
+#define AND(kRep)                          \
+  if (rep == MachineType::kRep()) {        \
+    return &cache_.kWord32AtomicAnd##kRep; \
   }
   ATOMIC_TYPE_LIST(AND)
 #undef AND
   UNREACHABLE();
 }
 
-const Operator* MachineOperatorBuilder::AtomicOr(MachineType rep) {
-#define OR(kRep)                    \
-  if (rep == MachineType::kRep()) { \
-    return &cache_.kAtomicOr##kRep; \
+const Operator* MachineOperatorBuilder::Word32AtomicOr(MachineType rep) {
+#define OR(kRep)                          \
+  if (rep == MachineType::kRep()) {       \
+    return &cache_.kWord32AtomicOr##kRep; \
   }
   ATOMIC_TYPE_LIST(OR)
 #undef OR
   UNREACHABLE();
 }
 
-const Operator* MachineOperatorBuilder::AtomicXor(MachineType rep) {
-#define XOR(kRep)                    \
-  if (rep == MachineType::kRep()) {  \
-    return &cache_.kAtomicXor##kRep; \
+const Operator* MachineOperatorBuilder::Word32AtomicXor(MachineType rep) {
+#define XOR(kRep)                          \
+  if (rep == MachineType::kRep()) {        \
+    return &cache_.kWord32AtomicXor##kRep; \
   }
   ATOMIC_TYPE_LIST(XOR)
 #undef XOR
   UNREACHABLE();
 }
 
+const Operator* MachineOperatorBuilder::PoisonOnSpeculationTagged() {
+  return &cache_.kPoisonOnSpeculationTagged;
+}
+
+const Operator* MachineOperatorBuilder::PoisonOnSpeculationWord() {
+  return &cache_.kPoisonOnSpeculationWord;
+}
+
+const Operator* MachineOperatorBuilder::Word64AtomicLoad(
+    LoadRepresentation rep) {
+#define LOAD(Type)                          \
+  if (rep == MachineType::Type()) {         \
+    return &cache_.kWord64AtomicLoad##Type; \
+  }
+  ATOMIC64_TYPE_LIST(LOAD)
+#undef LOAD
+  UNREACHABLE();
+}
+
+const Operator* MachineOperatorBuilder::Word64AtomicStore(
+    MachineRepresentation rep) {
+#define STORE(kRep)                          \
+  if (rep == MachineRepresentation::kRep) {  \
+    return &cache_.kWord64AtomicStore##kRep; \
+  }
+  ATOMIC64_REPRESENTATION_LIST(STORE)
+#undef STORE
+  UNREACHABLE();
+}
+
+const Operator* MachineOperatorBuilder::Word64AtomicAdd(MachineType rep) {
+#define ADD(kRep)                          \
+  if (rep == MachineType::kRep()) {        \
+    return &cache_.kWord64AtomicAdd##kRep; \
+  }
+  ATOMIC64_TYPE_LIST(ADD)
+#undef ADD
+  UNREACHABLE();
+}
+
+const Operator* MachineOperatorBuilder::Word64AtomicSub(MachineType rep) {
+#define SUB(kRep)                          \
+  if (rep == MachineType::kRep()) {        \
+    return &cache_.kWord64AtomicSub##kRep; \
+  }
+  ATOMIC64_TYPE_LIST(SUB)
+#undef SUB
+  UNREACHABLE();
+}
+
+const Operator* MachineOperatorBuilder::Word64AtomicAnd(MachineType rep) {
+#define AND(kRep)                          \
+  if (rep == MachineType::kRep()) {        \
+    return &cache_.kWord64AtomicAnd##kRep; \
+  }
+  ATOMIC64_TYPE_LIST(AND)
+#undef AND
+  UNREACHABLE();
+}
+
+const Operator* MachineOperatorBuilder::Word64AtomicOr(MachineType rep) {
+#define OR(kRep)                          \
+  if (rep == MachineType::kRep()) {       \
+    return &cache_.kWord64AtomicOr##kRep; \
+  }
+  ATOMIC64_TYPE_LIST(OR)
+#undef OR
+  UNREACHABLE();
+}
+
+const Operator* MachineOperatorBuilder::Word64AtomicXor(MachineType rep) {
+#define XOR(kRep)                          \
+  if (rep == MachineType::kRep()) {        \
+    return &cache_.kWord64AtomicXor##kRep; \
+  }
+  ATOMIC64_TYPE_LIST(XOR)
+#undef XOR
+  UNREACHABLE();
+}
+
+const Operator* MachineOperatorBuilder::Word64AtomicExchange(MachineType rep) {
+#define EXCHANGE(kRep)                          \
+  if (rep == MachineType::kRep()) {             \
+    return &cache_.kWord64AtomicExchange##kRep; \
+  }
+  ATOMIC64_TYPE_LIST(EXCHANGE)
+#undef EXCHANGE
+  UNREACHABLE();
+}
+
+const Operator* MachineOperatorBuilder::Word64AtomicCompareExchange(
+    MachineType rep) {
+#define COMPARE_EXCHANGE(kRep)                         \
+  if (rep == MachineType::kRep()) {                    \
+    return &cache_.kWord64AtomicCompareExchange##kRep; \
+  }
+  ATOMIC64_TYPE_LIST(COMPARE_EXCHANGE)
+#undef COMPARE_EXCHANGE
+  UNREACHABLE();
+}
+
 const OptionalOperator MachineOperatorBuilder::SpeculationFence() {
   return OptionalOperator(flags_ & kSpeculationFence,
                           &cache_.kSpeculationFence);
@@ -967,6 +1172,21 @@ const Operator* MachineOperatorBuilder::S8x16Shuffle(
                           2, 0, 0, 1, 0, 0, array);
 }
 
+#undef PURE_BINARY_OP_LIST_32
+#undef PURE_BINARY_OP_LIST_64
+#undef MACHINE_PURE_OP_LIST
+#undef PURE_OPTIONAL_OP_LIST
+#undef OVERFLOW_OP_LIST
+#undef MACHINE_TYPE_LIST
+#undef MACHINE_REPRESENTATION_LIST
+#undef ATOMIC_TYPE_LIST
+#undef ATOMIC64_TYPE_LIST
+#undef ATOMIC_REPRESENTATION_LIST
+#undef ATOMIC64_REPRESENTATION_LIST
+#undef SIMD_LANE_OP_LIST
+#undef SIMD_FORMAT_LIST
+#undef STACK_SLOT_CACHED_SIZES_ALIGNMENTS_LIST
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/machine-operator.h b/deps/v8/src/compiler/machine-operator.h
index 10b4b15701e..a10d4f3893a 100644
--- a/deps/v8/src/compiler/machine-operator.h
+++ b/deps/v8/src/compiler/machine-operator.h
@@ -45,7 +45,8 @@ class OptionalOperator final {
 // A Load needs a MachineType.
 typedef MachineType LoadRepresentation;
 
-LoadRepresentation LoadRepresentationOf(Operator const*);
+V8_EXPORT_PRIVATE LoadRepresentation LoadRepresentationOf(Operator const*)
+    WARN_UNUSED_RESULT;
 
 // A Store needs a MachineType and a WriteBarrierKind in order to emit the
 // correct write barrier.
@@ -71,17 +72,14 @@ size_t hash_value(StoreRepresentation);
 
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, StoreRepresentation);
 
-StoreRepresentation const& StoreRepresentationOf(Operator const*);
-
-typedef MachineType UnalignedLoadRepresentation;
-
-UnalignedLoadRepresentation UnalignedLoadRepresentationOf(Operator const*);
+V8_EXPORT_PRIVATE StoreRepresentation const& StoreRepresentationOf(
+    Operator const*) WARN_UNUSED_RESULT;
 
 // An UnalignedStore needs a MachineType.
 typedef MachineRepresentation UnalignedStoreRepresentation;
 
 UnalignedStoreRepresentation const& UnalignedStoreRepresentationOf(
-    Operator const*);
+    Operator const*) WARN_UNUSED_RESULT;
 
 class StackSlotRepresentation final {
  public:
@@ -105,11 +103,13 @@ size_t hash_value(StackSlotRepresentation);
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&,
                                            StackSlotRepresentation);
 
-StackSlotRepresentation const& StackSlotRepresentationOf(Operator const* op);
+V8_EXPORT_PRIVATE StackSlotRepresentation const& StackSlotRepresentationOf(
+    Operator const* op) WARN_UNUSED_RESULT;
 
-MachineRepresentation AtomicStoreRepresentationOf(Operator const* op);
+MachineRepresentation AtomicStoreRepresentationOf(Operator const* op)
+    WARN_UNUSED_RESULT;
 
-MachineType AtomicOpRepresentationOf(Operator const* op);
+MachineType AtomicOpRepresentationOf(Operator const* op) WARN_UNUSED_RESULT;
 
 // Interface for building machine-level operators. These operators are
 // machine-level but machine-independent and thus define a language suitable
@@ -350,6 +350,13 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* BitcastInt32ToFloat32();
   const Operator* BitcastInt64ToFloat64();
 
+  // These operators sign-extend to Int32/Int64
+  const Operator* SignExtendWord8ToInt32();
+  const Operator* SignExtendWord16ToInt32();
+  const Operator* SignExtendWord8ToInt64();
+  const Operator* SignExtendWord16ToInt64();
+  const Operator* SignExtendWord32ToInt64();
+
   // Floating point operators always operate with IEEE 754 round-to-nearest
   // (single-precision).
   const Operator* Float32Add();
@@ -577,6 +584,7 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
 
   // load [base + index]
   const Operator* Load(LoadRepresentation rep);
+  const Operator* PoisonedLoad(LoadRepresentation rep);
   const Operator* ProtectedLoad(LoadRepresentation rep);
 
   // store [base + index], value
@@ -584,7 +592,7 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* ProtectedStore(MachineRepresentation rep);
 
   // unaligned load [base + index]
-  const Operator* UnalignedLoad(UnalignedLoadRepresentation rep);
+  const Operator* UnalignedLoad(LoadRepresentation rep);
 
   // unaligned store [base + index], value
   const Operator* UnalignedStore(UnalignedStoreRepresentation rep);
@@ -592,29 +600,54 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* StackSlot(int size, int alignment = 0);
   const Operator* StackSlot(MachineRepresentation rep, int alignment = 0);
 
+  // Destroy value by masking when misspeculating.
+  const Operator* PoisonOnSpeculationTagged();
+  const Operator* PoisonOnSpeculationWord();
+
   // Access to the machine stack.
   const Operator* LoadStackPointer();
   const Operator* LoadFramePointer();
   const Operator* LoadParentFramePointer();
 
+  // Access to the root register.
+  const Operator* LoadRootsPointer();
+
+  // atomic-load [base + index]
+  const Operator* Word32AtomicLoad(LoadRepresentation rep);
   // atomic-load [base + index]
-  const Operator* AtomicLoad(LoadRepresentation rep);
+  const Operator* Word64AtomicLoad(LoadRepresentation rep);
+  // atomic-store [base + index], value
+  const Operator* Word32AtomicStore(MachineRepresentation rep);
   // atomic-store [base + index], value
-  const Operator* AtomicStore(MachineRepresentation rep);
+  const Operator* Word64AtomicStore(MachineRepresentation rep);
   // atomic-exchange [base + index], value
-  const Operator* AtomicExchange(MachineType rep);
+  const Operator* Word32AtomicExchange(MachineType rep);
+  // atomic-exchange [base + index], value
+  const Operator* Word64AtomicExchange(MachineType rep);
+  // atomic-compare-exchange [base + index], old_value, new_value
+  const Operator* Word32AtomicCompareExchange(MachineType rep);
   // atomic-compare-exchange [base + index], old_value, new_value
-  const Operator* AtomicCompareExchange(MachineType rep);
+  const Operator* Word64AtomicCompareExchange(MachineType rep);
   // atomic-add [base + index], value
-  const Operator* AtomicAdd(MachineType rep);
+  const Operator* Word32AtomicAdd(MachineType rep);
+  // atomic-sub [base + index], value
+  const Operator* Word32AtomicSub(MachineType rep);
+  // atomic-and [base + index], value
+  const Operator* Word32AtomicAnd(MachineType rep);
+  // atomic-or [base + index], value
+  const Operator* Word32AtomicOr(MachineType rep);
+  // atomic-xor [base + index], value
+  const Operator* Word32AtomicXor(MachineType rep);
+  // atomic-load [base + index]
+  const Operator* Word64AtomicAdd(MachineType rep);
   // atomic-sub [base + index], value
-  const Operator* AtomicSub(MachineType rep);
+  const Operator* Word64AtomicSub(MachineType rep);
   // atomic-and [base + index], value
-  const Operator* AtomicAnd(MachineType rep);
+  const Operator* Word64AtomicAnd(MachineType rep);
   // atomic-or [base + index], value
-  const Operator* AtomicOr(MachineType rep);
+  const Operator* Word64AtomicOr(MachineType rep);
   // atomic-xor [base + index], value
-  const Operator* AtomicXor(MachineType rep);
+  const Operator* Word64AtomicXor(MachineType rep);
 
   const OptionalOperator SpeculationFence();
 
diff --git a/deps/v8/src/compiler/memory-optimizer.cc b/deps/v8/src/compiler/memory-optimizer.cc
index 596204e2145..3cc64ac73dd 100644
--- a/deps/v8/src/compiler/memory-optimizer.cc
+++ b/deps/v8/src/compiler/memory-optimizer.cc
@@ -15,13 +15,17 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-MemoryOptimizer::MemoryOptimizer(JSGraph* jsgraph, Zone* zone)
+MemoryOptimizer::MemoryOptimizer(JSGraph* jsgraph, Zone* zone,
+                                 PoisoningMitigationLevel poisoning_enabled,
+                                 AllocationFolding allocation_folding)
     : jsgraph_(jsgraph),
       empty_state_(AllocationState::Empty(zone)),
       pending_(zone),
       tokens_(zone),
       zone_(zone),
-      graph_assembler_(jsgraph, nullptr, nullptr, zone) {}
+      graph_assembler_(jsgraph, nullptr, nullptr, zone),
+      poisoning_enabled_(poisoning_enabled),
+      allocation_folding_(allocation_folding) {}
 
 void MemoryOptimizer::Optimize() {
   EnqueueUses(graph()->start(), empty_state());
@@ -170,7 +174,8 @@ void MemoryOptimizer::VisitAllocateRaw(Node* node,
   Int32Matcher m(size);
   if (m.HasValue() && m.Value() < kMaxRegularHeapObjectSize) {
     int32_t const object_size = m.Value();
-    if (state->size() <= kMaxRegularHeapObjectSize - object_size &&
+    if (allocation_folding_ == AllocationFolding::kDoAllocationFolding &&
+        state->size() <= kMaxRegularHeapObjectSize - object_size &&
         state->group()->pretenure() == pretenure) {
       // We can fold this Allocate {node} into the allocation {group}
       // represented by the given {state}. Compute the upper bound for
@@ -179,7 +184,7 @@ void MemoryOptimizer::VisitAllocateRaw(Node* node,
 
       // Update the reservation check to the actual maximum upper bound.
       AllocationGroup* const group = state->group();
-      if (OpParameter<int32_t>(group->size()) < state_size) {
+      if (OpParameter<int32_t>(group->size()->op()) < state_size) {
         NodeProperties::ChangeOp(group->size(),
                                  common()->Int32Constant(state_size));
       }
@@ -229,9 +234,9 @@ void MemoryOptimizer::VisitAllocateRaw(Node* node,
                                      : __
                                        AllocateInOldSpaceStubConstant();
         if (!allocate_operator_.is_set()) {
-          CallDescriptor* descriptor =
+          auto call_descriptor =
               Linkage::GetAllocateCallDescriptor(graph()->zone());
-          allocate_operator_.set(common()->Call(descriptor));
+          allocate_operator_.set(common()->Call(call_descriptor));
         }
         Node* vfalse = __ Call(allocate_operator_.get(), target, size);
         vfalse = __ IntSub(vfalse, __ IntPtrConstant(kHeapObjectTag));
@@ -284,9 +289,9 @@ void MemoryOptimizer::VisitAllocateRaw(Node* node,
                                  : __
                                    AllocateInOldSpaceStubConstant();
     if (!allocate_operator_.is_set()) {
-      CallDescriptor* descriptor =
+      auto call_descriptor =
           Linkage::GetAllocateCallDescriptor(graph()->zone());
-      allocate_operator_.set(common()->Call(descriptor));
+      allocate_operator_.set(common()->Call(call_descriptor));
     }
     __ Goto(&done, __ Call(allocate_operator_.get(), target, size));
 
@@ -348,7 +353,14 @@ void MemoryOptimizer::VisitLoadElement(Node* node,
   ElementAccess const& access = ElementAccessOf(node->op());
   Node* index = node->InputAt(1);
   node->ReplaceInput(1, ComputeIndex(access, index));
-  NodeProperties::ChangeOp(node, machine()->Load(access.machine_type));
+  if (poisoning_enabled_ == PoisoningMitigationLevel::kOn &&
+      access.machine_type.representation() !=
+          MachineRepresentation::kTaggedPointer) {
+    NodeProperties::ChangeOp(node,
+                             machine()->PoisonedLoad(access.machine_type));
+  } else {
+    NodeProperties::ChangeOp(node, machine()->Load(access.machine_type));
+  }
   EnqueueUses(node, state);
 }
 
@@ -357,7 +369,14 @@ void MemoryOptimizer::VisitLoadField(Node* node, AllocationState const* state) {
   FieldAccess const& access = FieldAccessOf(node->op());
   Node* offset = jsgraph()->IntPtrConstant(access.offset - access.tag());
   node->InsertInput(graph()->zone(), 1, offset);
-  NodeProperties::ChangeOp(node, machine()->Load(access.machine_type));
+  if (poisoning_enabled_ == PoisoningMitigationLevel::kOn &&
+      access.machine_type.representation() !=
+          MachineRepresentation::kTaggedPointer) {
+    NodeProperties::ChangeOp(node,
+                             machine()->PoisonedLoad(access.machine_type));
+  } else {
+    NodeProperties::ChangeOp(node, machine()->Load(access.machine_type));
+  }
   EnqueueUses(node, state);
 }
 
diff --git a/deps/v8/src/compiler/memory-optimizer.h b/deps/v8/src/compiler/memory-optimizer.h
index e229f2b0be0..28fdb4cc985 100644
--- a/deps/v8/src/compiler/memory-optimizer.h
+++ b/deps/v8/src/compiler/memory-optimizer.h
@@ -31,7 +31,11 @@ typedef uint32_t NodeId;
 // implicitly.
 class MemoryOptimizer final {
  public:
-  MemoryOptimizer(JSGraph* jsgraph, Zone* zone);
+  enum class AllocationFolding { kDoAllocationFolding, kDontAllocationFolding };
+
+  MemoryOptimizer(JSGraph* jsgraph, Zone* zone,
+                  PoisoningMitigationLevel poisoning_enabled,
+                  AllocationFolding allocation_folding);
   ~MemoryOptimizer() {}
 
   void Optimize();
@@ -142,6 +146,8 @@ class MemoryOptimizer final {
   ZoneQueue<Token> tokens_;
   Zone* const zone_;
   GraphAssembler graph_assembler_;
+  PoisoningMitigationLevel poisoning_enabled_;
+  AllocationFolding allocation_folding_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(MemoryOptimizer);
 };
diff --git a/deps/v8/src/compiler/mips/OWNERS b/deps/v8/src/compiler/mips/OWNERS
index 978563cab5e..4ce9d7f91da 100644
--- a/deps/v8/src/compiler/mips/OWNERS
+++ b/deps/v8/src/compiler/mips/OWNERS
@@ -1,2 +1,3 @@
 ivica.bogosavljevic@mips.com
 Miran.Karic@mips.com
+sreten.kovacevic@mips.com
\ No newline at end of file
diff --git a/deps/v8/src/compiler/mips/code-generator-mips.cc b/deps/v8/src/compiler/mips/code-generator-mips.cc
index 3b57081c9ec..fb8b8089cf8 100644
--- a/deps/v8/src/compiler/mips/code-generator-mips.cc
+++ b/deps/v8/src/compiler/mips/code-generator-mips.cc
@@ -349,6 +349,17 @@ FPUCondition FlagsConditionToConditionCmpFPU(bool& predicate,
   UNREACHABLE();
 }
 
+void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
+                                   InstructionCode opcode, Instruction* instr,
+                                   MipsOperandConverter& i) {
+  const MemoryAccessMode access_mode =
+      static_cast<MemoryAccessMode>(MiscField::decode(opcode));
+  if (access_mode == kMemoryAccessPoisoned) {
+    Register value = i.OutputRegister();
+    codegen->tasm()->And(value, value, kSpeculationPoisonRegister);
+  }
+}
+
 }  // namespace
 
 #define ASSEMBLE_ROUND_DOUBLE_TO_DOUBLE(mode)                                  \
@@ -618,33 +629,53 @@ void CodeGenerator::AssembleTailCallAfterGap(Instruction* instr,
                                 first_unused_stack_slot);
 }
 
+// Check that {kJavaScriptCallCodeStartRegister} is correct.
+void CodeGenerator::AssembleCodeStartRegisterCheck() {
+  __ ComputeCodeStartAddress(at);
+  __ Assert(eq, AbortReason::kWrongFunctionCodeStart,
+            kJavaScriptCallCodeStartRegister, Operand(at));
+}
+
 // Check if the code object is marked for deoptimization. If it is, then it
 // jumps to the CompileLazyDeoptimizedCode builtin. In order to do this we need
 // to:
-//    1. load the address of the current instruction;
-//    2. read from memory the word that contains that bit, which can be found in
+//    1. read from memory the word that contains that bit, which can be found in
 //       the flags in the referenced {CodeDataContainer} object;
-//    3. test kMarkedForDeoptimizationBit in those flags; and
-//    4. if it is not zero then it jumps to the builtin.
+//    2. test kMarkedForDeoptimizationBit in those flags; and
+//    3. if it is not zero then it jumps to the builtin.
 void CodeGenerator::BailoutIfDeoptimized() {
-  Label current;
-  // This push on ra and the pop below together ensure that we restore the
-  // register ra, which is needed while computing frames for deoptimization.
-  __ push(ra);
-  // The bal instruction puts the address of the current instruction into
-  // the return address (ra) register, which we can use later on.
-  __ bal(&current);
-  __ nop();
-  int pc = __ pc_offset();
-  __ bind(&current);
-  int offset = Code::kCodeDataContainerOffset - (Code::kHeaderSize + pc);
-  __ lw(a2, MemOperand(ra, offset));
-  __ pop(ra);
-  __ lw(a2, FieldMemOperand(a2, CodeDataContainer::kKindSpecificFlagsOffset));
-  __ And(a2, a2, Operand(1 << Code::kMarkedForDeoptimizationBit));
+  int offset = Code::kCodeDataContainerOffset - Code::kHeaderSize;
+  __ lw(at, MemOperand(kJavaScriptCallCodeStartRegister, offset));
+  __ lw(at, FieldMemOperand(at, CodeDataContainer::kKindSpecificFlagsOffset));
+  __ And(at, at, Operand(1 << Code::kMarkedForDeoptimizationBit));
   Handle<Code> code = isolate()->builtins()->builtin_handle(
       Builtins::kCompileLazyDeoptimizedCode);
-  __ Jump(code, RelocInfo::CODE_TARGET, ne, a2, Operand(zero_reg));
+  __ Jump(code, RelocInfo::CODE_TARGET, ne, at, Operand(zero_reg));
+}
+
+void CodeGenerator::GenerateSpeculationPoisonFromCodeStartRegister() {
+  // Calculate a mask which has all bits set in the normal case, but has all
+  // bits cleared if we are speculatively executing the wrong PC.
+  //    difference = (current - expected) | (expected - current)
+  //    poison = ~(difference >> (kBitsPerPointer - 1))
+  __ ComputeCodeStartAddress(at);
+  __ Move(kSpeculationPoisonRegister, at);
+  __ subu(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
+          kJavaScriptCallCodeStartRegister);
+  __ subu(kJavaScriptCallCodeStartRegister, kJavaScriptCallCodeStartRegister,
+          at);
+  __ or_(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
+         kJavaScriptCallCodeStartRegister);
+  __ sra(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
+         kBitsPerPointer - 1);
+  __ nor(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
+         kSpeculationPoisonRegister);
+}
+
+void CodeGenerator::AssembleRegisterArgumentPoisoning() {
+  __ And(kJSFunctionRegister, kJSFunctionRegister, kSpeculationPoisonRegister);
+  __ And(kContextRegister, kContextRegister, kSpeculationPoisonRegister);
+  __ And(sp, sp, kSpeculationPoisonRegister);
 }
 
 // Assembles an instruction after register allocation, producing machine code.
@@ -721,8 +752,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ Assert(eq, AbortReason::kWrongFunctionContext, cp,
                   Operand(kScratchReg));
       }
-      __ lw(at, FieldMemOperand(func, JSFunction::kCodeOffset));
-      __ Call(at, Code::kHeaderSize - kHeapObjectTag);
+      static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
+      __ lw(a2, FieldMemOperand(func, JSFunction::kCodeOffset));
+      __ Addu(a2, a2, Code::kHeaderSize - kHeapObjectTag);
+      __ Call(a2);
       RecordCallPosition(instr);
       frame_access_state()->ClearSPDelta();
       frame_access_state()->SetFrameAccessToDefault();
@@ -850,6 +883,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), fp);
       }
       break;
+    case kArchRootsPointer:
+      __ mov(i.OutputRegister(), kRootRegister);
+      break;
     case kArchTruncateDoubleToI:
       __ TruncateDoubleToIDelayed(zone(), i.OutputRegister(),
                                   i.InputDoubleRegister(0));
@@ -906,6 +942,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     }
+    case kArchPoisonOnSpeculationWord:
+      __ And(i.OutputRegister(), i.InputRegister(0),
+             kSpeculationPoisonRegister);
+      break;
     case kIeee754Float64Acos:
       ASSEMBLE_IEEE754_UNOP(acos);
       break;
@@ -975,19 +1015,22 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Addu(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMipsAddOvf:
-      // Pseudo-instruction used for overflow/branch. No opcode emitted here.
+      __ AddOverflow(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1),
+                     kScratchReg);
       break;
     case kMipsSub:
       __ Subu(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMipsSubOvf:
-      // Pseudo-instruction used for overflow/branch. No opcode emitted here.
+      __ SubOverflow(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1),
+                     kScratchReg);
       break;
     case kMipsMul:
       __ Mul(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMipsMulOvf:
-      // Pseudo-instruction used for overflow/branch. No opcode emitted here.
+      __ MulOverflow(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1),
+                     kScratchReg);
       break;
     case kMipsMulHigh:
       __ Mulh(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
@@ -1040,73 +1083,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kMipsCtz: {
       Register src = i.InputRegister(0);
       Register dst = i.OutputRegister();
-      if (IsMipsArchVariant(kMips32r6)) {
-        // We don't have an instruction to count the number of trailing zeroes.
-        // Start by flipping the bits end-for-end so we can count the number of
-        // leading zeroes instead.
-        __ Ror(dst, src, 16);
-        __ wsbh(dst, dst);
-        __ bitswap(dst, dst);
-        __ Clz(dst, dst);
-      } else {
-        // Convert trailing zeroes to trailing ones, and bits to their left
-        // to zeroes.
-        __ Addu(kScratchReg, src, -1);
-        __ Xor(dst, kScratchReg, src);
-        __ And(dst, dst, kScratchReg);
-        // Count number of leading zeroes.
-        __ Clz(dst, dst);
-        // Subtract number of leading zeroes from 32 to get number of trailing
-        // ones. Remember that the trailing ones were formerly trailing zeroes.
-        __ li(kScratchReg, 32);
-        __ Subu(dst, kScratchReg, dst);
-      }
+      __ Ctz(dst, src);
     } break;
     case kMipsPopcnt: {
-      // https://graphics.stanford.edu/~seander/bithacks.html#CountBitsSetParallel
-      //
-      // A generalization of the best bit counting method to integers of
-      // bit-widths up to 128 (parameterized by type T) is this:
-      //
-      // v = v - ((v >> 1) & (T)~(T)0/3);                           // temp
-      // v = (v & (T)~(T)0/15*3) + ((v >> 2) & (T)~(T)0/15*3);      // temp
-      // v = (v + (v >> 4)) & (T)~(T)0/255*15;                      // temp
-      // c = (T)(v * ((T)~(T)0/255)) >> (sizeof(T) - 1) * BITS_PER_BYTE; //count
-      //
-      // For comparison, for 32-bit quantities, this algorithm can be executed
-      // using 20 MIPS instructions (the calls to LoadConst32() generate two
-      // machine instructions each for the values being used in this algorithm).
-      // A(n unrolled) loop-based algorithm requires 25 instructions.
-      //
-      // For 64-bit quantities, this algorithm gets executed twice, (once
-      // for in_lo, and again for in_hi), but saves a few instructions
-      // because the mask values only have to be loaded once. Using this
-      // algorithm the count for a 64-bit operand can be performed in 29
-      // instructions compared to a loop-based algorithm which requires 47
-      // instructions.
       Register src = i.InputRegister(0);
       Register dst = i.OutputRegister();
-      uint32_t B0 = 0x55555555;     // (T)~(T)0/3
-      uint32_t B1 = 0x33333333;     // (T)~(T)0/15*3
-      uint32_t B2 = 0x0F0F0F0F;     // (T)~(T)0/255*15
-      uint32_t value = 0x01010101;  // (T)~(T)0/255
-      uint32_t shift = 24;          // (sizeof(T) - 1) * BITS_PER_BYTE
-      __ srl(kScratchReg, src, 1);
-      __ li(kScratchReg2, B0);
-      __ And(kScratchReg, kScratchReg, kScratchReg2);
-      __ Subu(kScratchReg, src, kScratchReg);
-      __ li(kScratchReg2, B1);
-      __ And(dst, kScratchReg, kScratchReg2);
-      __ srl(kScratchReg, kScratchReg, 2);
-      __ And(kScratchReg, kScratchReg, kScratchReg2);
-      __ Addu(kScratchReg, dst, kScratchReg);
-      __ srl(dst, kScratchReg, 4);
-      __ Addu(dst, dst, kScratchReg);
-      __ li(kScratchReg2, B2);
-      __ And(dst, dst, kScratchReg2);
-      __ li(kScratchReg, value);
-      __ Mul(dst, dst, kScratchReg);
-      __ srl(dst, dst, shift);
+      __ Popcnt(dst, src);
     } break;
     case kMipsShl:
       if (instr->InputAt(1)->IsRegister()) {
@@ -1184,7 +1166,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Ror(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMipsTst:
-      // Pseudo-instruction used for tst/branch. No opcode emitted here.
+      __ And(kScratchReg, i.InputRegister(0), i.InputOperand(1));
       break;
     case kMipsCmp:
       // Pseudo-instruction used for cmp/branch. No opcode emitted here.
@@ -1538,24 +1520,30 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     case kMipsLbu:
       __ lbu(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMipsLb:
       __ lb(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMipsSb:
       __ sb(i.InputOrZeroRegister(2), i.MemoryOperand());
       break;
     case kMipsLhu:
       __ lhu(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMipsUlhu:
       __ Ulhu(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMipsLh:
       __ lh(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMipsUlh:
       __ Ulh(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMipsSh:
       __ sh(i.InputOrZeroRegister(2), i.MemoryOperand());
@@ -1565,9 +1553,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     case kMipsLw:
       __ lw(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMipsUlw:
       __ Ulw(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMipsSw:
       __ sw(i.InputOrZeroRegister(2), i.MemoryOperand());
@@ -1650,7 +1640,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     case kMipsPeek: {
-      int reverse_slot = MiscField::decode(instr->opcode());
+      // The incoming value is 0-based, but we need a 1-based value.
+      int reverse_slot = i.InputInt32(0) + 1;
       int offset =
           FrameSlotToFPOffset(frame()->GetTotalFrameSlotCount() - reverse_slot);
       if (instr->OutputAt(0)->IsFPRegister()) {
@@ -1676,9 +1667,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         LocationOperand* op = LocationOperand::cast(instr->InputAt(0));
         if (op->representation() == MachineRepresentation::kFloat64) {
           __ Sdc1(i.InputDoubleRegister(0), MemOperand(sp, i.InputInt32(1)));
-        } else {
-          DCHECK_EQ(MachineRepresentation::kFloat32, op->representation());
+        } else if (op->representation() == MachineRepresentation::kFloat32) {
           __ swc1(i.InputSingleRegister(0), MemOperand(sp, i.InputInt32(1)));
+        } else {
+          DCHECK_EQ(MachineRepresentation::kSimd128, op->representation());
+          CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+          __ st_b(i.InputSimd128Register(0), MemOperand(sp, i.InputInt32(1)));
         }
       } else {
         __ sw(i.InputRegister(0), MemOperand(sp, i.InputInt32(1)));
@@ -1689,74 +1683,74 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ ByteSwapSigned(i.OutputRegister(0), i.InputRegister(0), 4);
       break;
     }
-    case kAtomicLoadInt8:
+    case kWord32AtomicLoadInt8:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(lb);
       break;
-    case kAtomicLoadUint8:
+    case kWord32AtomicLoadUint8:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(lbu);
       break;
-    case kAtomicLoadInt16:
+    case kWord32AtomicLoadInt16:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(lh);
       break;
-    case kAtomicLoadUint16:
+    case kWord32AtomicLoadUint16:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(lhu);
       break;
-    case kAtomicLoadWord32:
+    case kWord32AtomicLoadWord32:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(lw);
       break;
-    case kAtomicStoreWord8:
+    case kWord32AtomicStoreWord8:
       ASSEMBLE_ATOMIC_STORE_INTEGER(sb);
       break;
-    case kAtomicStoreWord16:
+    case kWord32AtomicStoreWord16:
       ASSEMBLE_ATOMIC_STORE_INTEGER(sh);
       break;
-    case kAtomicStoreWord32:
+    case kWord32AtomicStoreWord32:
       ASSEMBLE_ATOMIC_STORE_INTEGER(sw);
       break;
-    case kAtomicExchangeInt8:
+    case kWord32AtomicExchangeInt8:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER_EXT(true, 8);
       break;
-    case kAtomicExchangeUint8:
+    case kWord32AtomicExchangeUint8:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER_EXT(false, 8);
       break;
-    case kAtomicExchangeInt16:
+    case kWord32AtomicExchangeInt16:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER_EXT(true, 16);
       break;
-    case kAtomicExchangeUint16:
+    case kWord32AtomicExchangeUint16:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER_EXT(false, 16);
       break;
-    case kAtomicExchangeWord32:
+    case kWord32AtomicExchangeWord32:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER();
       break;
-    case kAtomicCompareExchangeInt8:
+    case kWord32AtomicCompareExchangeInt8:
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER_EXT(true, 8);
       break;
-    case kAtomicCompareExchangeUint8:
+    case kWord32AtomicCompareExchangeUint8:
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER_EXT(false, 8);
       break;
-    case kAtomicCompareExchangeInt16:
+    case kWord32AtomicCompareExchangeInt16:
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER_EXT(true, 16);
       break;
-    case kAtomicCompareExchangeUint16:
+    case kWord32AtomicCompareExchangeUint16:
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER_EXT(false, 16);
       break;
-    case kAtomicCompareExchangeWord32:
+    case kWord32AtomicCompareExchangeWord32:
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER();
       break;
 #define ATOMIC_BINOP_CASE(op, inst)             \
-  case kAtomic##op##Int8:                       \
+  case kWord32Atomic##op##Int8:                 \
     ASSEMBLE_ATOMIC_BINOP_EXT(true, 8, inst);   \
     break;                                      \
-  case kAtomic##op##Uint8:                      \
+  case kWord32Atomic##op##Uint8:                \
     ASSEMBLE_ATOMIC_BINOP_EXT(false, 8, inst);  \
     break;                                      \
-  case kAtomic##op##Int16:                      \
+  case kWord32Atomic##op##Int16:                \
     ASSEMBLE_ATOMIC_BINOP_EXT(true, 16, inst);  \
     break;                                      \
-  case kAtomic##op##Uint16:                     \
+  case kWord32Atomic##op##Uint16:               \
     ASSEMBLE_ATOMIC_BINOP_EXT(false, 16, inst); \
     break;                                      \
-  case kAtomic##op##Word32:                     \
+  case kWord32Atomic##op##Word32:               \
     ASSEMBLE_ATOMIC_BINOP(inst);                \
     break;
       ATOMIC_BINOP_CASE(Add, Addu)
@@ -2892,45 +2886,29 @@ void AssembleBranchToLabels(CodeGenerator* gen, TurboAssembler* tasm,
   MipsOperandConverter i(gen, instr);
   if (instr->arch_opcode() == kMipsTst) {
     cc = FlagsConditionToConditionTst(condition);
-    __ And(at, i.InputRegister(0), i.InputOperand(1));
-    __ Branch(tlabel, cc, at, Operand(zero_reg));
-  } else if (instr->arch_opcode() == kMipsAddOvf) {
-    switch (condition) {
-      case kOverflow:
-        __ AddBranchOvf(i.OutputRegister(), i.InputRegister(0),
-                        i.InputOperand(1), tlabel, flabel);
-        break;
-      case kNotOverflow:
-        __ AddBranchOvf(i.OutputRegister(), i.InputRegister(0),
-                        i.InputOperand(1), flabel, tlabel);
-        break;
-      default:
-        UNSUPPORTED_COND(kMipsAddOvf, condition);
-        break;
-    }
-  } else if (instr->arch_opcode() == kMipsSubOvf) {
+    __ Branch(tlabel, cc, kScratchReg, Operand(zero_reg));
+  } else if (instr->arch_opcode() == kMipsAddOvf ||
+             instr->arch_opcode() == kMipsSubOvf) {
+    // Overflow occurs if overflow register is negative
     switch (condition) {
       case kOverflow:
-        __ SubBranchOvf(i.OutputRegister(), i.InputRegister(0),
-                        i.InputOperand(1), tlabel, flabel);
+        __ Branch(tlabel, lt, kScratchReg, Operand(zero_reg));
         break;
       case kNotOverflow:
-        __ SubBranchOvf(i.OutputRegister(), i.InputRegister(0),
-                        i.InputOperand(1), flabel, tlabel);
+        __ Branch(tlabel, ge, kScratchReg, Operand(zero_reg));
         break;
       default:
-        UNSUPPORTED_COND(kMipsAddOvf, condition);
+        UNSUPPORTED_COND(instr->arch_opcode(), condition);
         break;
     }
   } else if (instr->arch_opcode() == kMipsMulOvf) {
+    // Overflow occurs if overflow register is not zero
     switch (condition) {
       case kOverflow:
-        __ MulBranchOvf(i.OutputRegister(), i.InputRegister(0),
-                        i.InputOperand(1), tlabel, flabel);
+        __ Branch(tlabel, ne, kScratchReg, Operand(zero_reg));
         break;
       case kNotOverflow:
-        __ MulBranchOvf(i.OutputRegister(), i.InputRegister(0),
-                        i.InputOperand(1), flabel, tlabel);
+        __ Branch(tlabel, eq, kScratchReg, Operand(zero_reg));
         break;
       default:
         UNSUPPORTED_COND(kMipsMulOvf, condition);
@@ -2979,6 +2957,74 @@ void CodeGenerator::AssembleArchBranch(Instruction* instr, BranchInfo* branch) {
                          branch->fallthru);
 }
 
+void CodeGenerator::AssembleBranchPoisoning(FlagsCondition condition,
+                                            Instruction* instr) {
+  // TODO(jarin) Handle float comparisons (kUnordered[Not]Equal).
+  if (condition == kUnorderedEqual || condition == kUnorderedNotEqual) {
+    return;
+  }
+
+  MipsOperandConverter i(this, instr);
+  condition = NegateFlagsCondition(condition);
+
+  switch (instr->arch_opcode()) {
+    case kMipsCmp: {
+      __ LoadZeroOnCondition(kSpeculationPoisonRegister, i.InputRegister(0),
+                             i.InputOperand(1),
+                             FlagsConditionToConditionCmp(condition));
+    }
+      return;
+    case kMipsTst: {
+      switch (condition) {
+        case kEqual:
+          __ LoadZeroIfConditionZero(kSpeculationPoisonRegister, kScratchReg);
+          break;
+        case kNotEqual:
+          __ LoadZeroIfConditionNotZero(kSpeculationPoisonRegister,
+                                        kScratchReg);
+          break;
+        default:
+          UNREACHABLE();
+      }
+    }
+      return;
+    case kMipsAddOvf:
+    case kMipsSubOvf: {
+      // Overflow occurs if overflow register is negative
+      __ Slt(kScratchReg2, kScratchReg, zero_reg);
+      switch (condition) {
+        case kOverflow:
+          __ LoadZeroIfConditionNotZero(kSpeculationPoisonRegister,
+                                        kScratchReg2);
+          break;
+        case kNotOverflow:
+          __ LoadZeroIfConditionZero(kSpeculationPoisonRegister, kScratchReg2);
+          break;
+        default:
+          UNSUPPORTED_COND(instr->arch_opcode(), condition);
+      }
+    }
+      return;
+    case kMipsMulOvf: {
+      // Overflow occurs if overflow register is not zero
+      switch (condition) {
+        case kOverflow:
+          __ LoadZeroIfConditionNotZero(kSpeculationPoisonRegister,
+                                        kScratchReg);
+          break;
+        case kNotOverflow:
+          __ LoadZeroIfConditionZero(kSpeculationPoisonRegister, kScratchReg);
+          break;
+        default:
+          UNSUPPORTED_COND(instr->arch_opcode(), condition);
+      }
+    }
+      return;
+    default:
+      break;
+  }
+}
+
 void CodeGenerator::AssembleArchDeoptBranch(Instruction* instr,
                                             BranchInfo* branch) {
   AssembleArchBranch(instr, branch);
@@ -3026,8 +3072,9 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                              tasm()->isolate()),
                          0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
-        CallDescriptor* descriptor = gen_->linkage()->GetIncomingDescriptor();
-        int pop_count = static_cast<int>(descriptor->StackParameterCount());
+        auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
+        int pop_count =
+            static_cast<int>(call_descriptor->StackParameterCount());
         __ Drop(pop_count);
         __ Ret();
       } else {
@@ -3072,50 +3119,19 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
 
   if (instr->arch_opcode() == kMipsTst) {
     cc = FlagsConditionToConditionTst(condition);
-    if (instr->InputAt(1)->IsImmediate() &&
-        base::bits::IsPowerOfTwo(i.InputOperand(1).immediate())) {
-      uint16_t pos =
-          base::bits::CountTrailingZeros32(i.InputOperand(1).immediate());
-      __ Ext(result, i.InputRegister(0), pos, 1);
-      if (cc == eq) {
-        __ xori(result, result, 1);
-      }
+    if (cc == eq) {
+      __ Sltu(result, kScratchReg, 1);
     } else {
-      __ And(kScratchReg, i.InputRegister(0), i.InputOperand(1));
-      if (cc == eq) {
-        __ Sltu(result, kScratchReg, 1);
-      } else {
-        __ Sltu(result, zero_reg, kScratchReg);
-      }
+      __ Sltu(result, zero_reg, kScratchReg);
     }
     return;
   } else if (instr->arch_opcode() == kMipsAddOvf ||
-             instr->arch_opcode() == kMipsSubOvf ||
-             instr->arch_opcode() == kMipsMulOvf) {
-    Label flabel, tlabel;
-    switch (instr->arch_opcode()) {
-      case kMipsAddOvf:
-        __ AddBranchNoOvf(i.OutputRegister(), i.InputRegister(0),
-                          i.InputOperand(1), &flabel);
-
-        break;
-      case kMipsSubOvf:
-        __ SubBranchNoOvf(i.OutputRegister(), i.InputRegister(0),
-                          i.InputOperand(1), &flabel);
-        break;
-      case kMipsMulOvf:
-        __ MulBranchNoOvf(i.OutputRegister(), i.InputRegister(0),
-                          i.InputOperand(1), &flabel);
-        break;
-      default:
-        UNREACHABLE();
-        break;
-    }
-    __ li(result, 1);
-    __ Branch(&tlabel);
-    __ bind(&flabel);
-    __ li(result, 0);
-    __ bind(&tlabel);
+             instr->arch_opcode() == kMipsSubOvf) {
+    // Overflow occurs if overflow register is negative
+    __ slt(result, kScratchReg, zero_reg);
+  } else if (instr->arch_opcode() == kMipsMulOvf) {
+    // Overflow occurs if overflow register is not zero
+    __ Sgtu(result, kScratchReg, zero_reg);
   } else if (instr->arch_opcode() == kMipsCmp) {
     cc = FlagsConditionToConditionCmp(condition);
     switch (cc) {
@@ -3253,9 +3269,8 @@ void CodeGenerator::AssembleArchLookupSwitch(Instruction* instr) {
   Register input = i.InputRegister(0);
   for (size_t index = 2; index < instr->InputCount(); index += 2) {
     __ li(at, Operand(i.InputInt32(index + 0)));
-    __ beq(input, at, GetLabel(i.InputRpo(index + 1)));
+    __ Branch(GetLabel(i.InputRpo(index + 1)), eq, input, Operand(at));
   }
-  __ nop();  // Branch delay slot of the last beq.
   AssembleArchJump(i.InputRpo(1));
 }
 
@@ -3271,9 +3286,9 @@ void CodeGenerator::AssembleArchTableSwitch(Instruction* instr) {
 }
 
 void CodeGenerator::FinishFrame(Frame* frame) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
 
-  const RegList saves_fpu = descriptor->CalleeSavedFPRegisters();
+  const RegList saves_fpu = call_descriptor->CalleeSavedFPRegisters();
   if (saves_fpu != 0) {
     frame->AlignSavedCalleeRegisterSlots();
   }
@@ -3285,7 +3300,7 @@ void CodeGenerator::FinishFrame(Frame* frame) {
                                             (kDoubleSize / kPointerSize));
   }
 
-  const RegList saves = descriptor->CalleeSavedRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     int count = base::bits::CountPopulation(saves);
     DCHECK_EQ(kNumCalleeSaved, count + 1);
@@ -3294,14 +3309,14 @@ void CodeGenerator::FinishFrame(Frame* frame) {
 }
 
 void CodeGenerator::AssembleConstructFrame() {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
   if (frame_access_state()->has_frame()) {
-    if (descriptor->IsCFunctionCall()) {
+    if (call_descriptor->IsCFunctionCall()) {
       __ Push(ra, fp);
       __ mov(fp, sp);
-    } else if (descriptor->IsJSFunctionCall()) {
+    } else if (call_descriptor->IsJSFunctionCall()) {
       __ Prologue();
-      if (descriptor->PushArgumentCount()) {
+      if (call_descriptor->PushArgumentCount()) {
         __ Push(kJavaScriptCallArgCountRegister);
       }
     } else {
@@ -3309,8 +3324,8 @@ void CodeGenerator::AssembleConstructFrame() {
     }
   }
 
-  int shrink_slots =
-      frame()->GetTotalFrameSlotCount() - descriptor->CalculateFixedFrameSize();
+  int shrink_slots = frame()->GetTotalFrameSlotCount() -
+                     call_descriptor->CalculateFixedFrameSize();
 
   if (info()->is_osr()) {
     // TurboFan OSR-compiled functions cannot be entered directly.
@@ -3323,10 +3338,11 @@ void CodeGenerator::AssembleConstructFrame() {
     if (FLAG_code_comments) __ RecordComment("-- OSR entrypoint --");
     osr_pc_offset_ = __ pc_offset();
     shrink_slots -= osr_helper()->UnoptimizedFrameSlots();
+    ResetSpeculationPoison();
   }
 
-  const RegList saves = descriptor->CalleeSavedRegisters();
-  const RegList saves_fpu = descriptor->CalleeSavedFPRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
+  const RegList saves_fpu = call_descriptor->CalleeSavedFPRegisters();
   const int returns = frame()->GetReturnSlotCount();
 
   // Skip callee-saved and return slots, which are pushed below.
@@ -3355,8 +3371,8 @@ void CodeGenerator::AssembleConstructFrame() {
 }
 
 void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
-  int pop_count = static_cast<int>(descriptor->StackParameterCount());
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
+  int pop_count = static_cast<int>(call_descriptor->StackParameterCount());
 
   const int returns = frame()->GetReturnSlotCount();
   if (returns != 0) {
@@ -3364,19 +3380,19 @@ void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
   }
 
   // Restore GP registers.
-  const RegList saves = descriptor->CalleeSavedRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     __ MultiPop(saves);
   }
 
   // Restore FPU registers.
-  const RegList saves_fpu = descriptor->CalleeSavedFPRegisters();
+  const RegList saves_fpu = call_descriptor->CalleeSavedFPRegisters();
   if (saves_fpu != 0) {
     __ MultiPopFPU(saves_fpu);
   }
 
   MipsOperandConverter g(this, nullptr);
-  if (descriptor->IsCFunctionCall()) {
+  if (call_descriptor->IsCFunctionCall()) {
     AssembleDeconstructFrame();
   } else if (frame_access_state()->has_frame()) {
     // Canonicalize JSFunction return sites for now unless they have an variable
@@ -3498,21 +3514,33 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
       }
     }
   } else if (source->IsFPRegister()) {
-    FPURegister src = g.ToDoubleRegister(source);
-    if (destination->IsFPRegister()) {
-      FPURegister dst = g.ToDoubleRegister(destination);
-      __ Move(dst, src);
+    MachineRepresentation rep = LocationOperand::cast(source)->representation();
+    if (rep == MachineRepresentation::kSimd128) {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      MSARegister src = g.ToSimd128Register(source);
+      if (destination->IsSimd128Register()) {
+        MSARegister dst = g.ToSimd128Register(destination);
+        __ move_v(dst, src);
+      } else {
+        DCHECK(destination->IsSimd128StackSlot());
+        __ st_b(src, g.ToMemOperand(destination));
+      }
     } else {
-      DCHECK(destination->IsFPStackSlot());
-      MachineRepresentation rep =
-          LocationOperand::cast(source)->representation();
-      if (rep == MachineRepresentation::kFloat64) {
-        __ Sdc1(src, g.ToMemOperand(destination));
-      } else if (rep == MachineRepresentation::kFloat32) {
-        __ swc1(src, g.ToMemOperand(destination));
+      FPURegister src = g.ToDoubleRegister(source);
+      if (destination->IsFPRegister()) {
+        FPURegister dst = g.ToDoubleRegister(destination);
+        __ Move(dst, src);
       } else {
-        DCHECK_EQ(MachineRepresentation::kSimd128, rep);
-        UNREACHABLE();
+        DCHECK(destination->IsFPStackSlot());
+        MachineRepresentation rep =
+            LocationOperand::cast(source)->representation();
+        if (rep == MachineRepresentation::kFloat64) {
+          __ Sdc1(src, g.ToMemOperand(destination));
+        } else if (rep == MachineRepresentation::kFloat32) {
+          __ swc1(src, g.ToMemOperand(destination));
+        } else {
+          UNREACHABLE();
+        }
       }
     }
   } else if (source->IsFPStackSlot()) {
@@ -3526,7 +3554,8 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
         __ lwc1(g.ToDoubleRegister(destination), src);
       } else {
         DCHECK_EQ(MachineRepresentation::kSimd128, rep);
-        UNREACHABLE();
+        CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+        __ ld_b(g.ToSimd128Register(destination), src);
       }
     } else {
       FPURegister temp = kScratchDoubleReg;
@@ -3538,7 +3567,10 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
         __ swc1(temp, g.ToMemOperand(destination));
       } else {
         DCHECK_EQ(MachineRepresentation::kSimd128, rep);
-        UNREACHABLE();
+        CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+        MSARegister temp = kSimd128ScratchReg;
+        __ ld_b(temp, src);
+        __ st_b(temp, g.ToMemOperand(destination));
       }
     }
   } else {
@@ -3579,29 +3611,50 @@ void CodeGenerator::AssembleSwap(InstructionOperand* source,
     __ sw(temp_0, dst);
     __ sw(temp_1, src);
   } else if (source->IsFPRegister()) {
-    FPURegister temp = kScratchDoubleReg;
-    FPURegister src = g.ToDoubleRegister(source);
     if (destination->IsFPRegister()) {
-      FPURegister dst = g.ToDoubleRegister(destination);
-      __ Move(temp, src);
-      __ Move(src, dst);
-      __ Move(dst, temp);
+      MachineRepresentation rep =
+          LocationOperand::cast(source)->representation();
+      if (rep == MachineRepresentation::kSimd128) {
+        CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+        MSARegister temp = kSimd128ScratchReg;
+        MSARegister src = g.ToSimd128Register(source);
+        MSARegister dst = g.ToSimd128Register(destination);
+        __ move_v(temp, src);
+        __ move_v(src, dst);
+        __ move_v(dst, temp);
+      } else {
+        FPURegister temp = kScratchDoubleReg;
+        FPURegister src = g.ToDoubleRegister(source);
+        FPURegister dst = g.ToDoubleRegister(destination);
+        __ Move(temp, src);
+        __ Move(src, dst);
+        __ Move(dst, temp);
+      }
     } else {
       DCHECK(destination->IsFPStackSlot());
       MemOperand dst = g.ToMemOperand(destination);
       MachineRepresentation rep =
           LocationOperand::cast(source)->representation();
       if (rep == MachineRepresentation::kFloat64) {
+        FPURegister temp = kScratchDoubleReg;
+        FPURegister src = g.ToDoubleRegister(source);
         __ Move(temp, src);
         __ Ldc1(src, dst);
         __ Sdc1(temp, dst);
       } else if (rep == MachineRepresentation::kFloat32) {
+        FPURegister temp = kScratchDoubleReg;
+        FPURegister src = g.ToFloatRegister(source);
         __ Move(temp, src);
         __ lwc1(src, dst);
         __ swc1(temp, dst);
       } else {
         DCHECK_EQ(MachineRepresentation::kSimd128, rep);
-        UNREACHABLE();
+        CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+        MSARegister temp = kSimd128ScratchReg;
+        MSARegister src = g.ToSimd128Register(source);
+        __ move_v(temp, src);
+        __ ld_b(src, dst);
+        __ st_b(temp, dst);
       }
     }
   } else if (source->IsFPStackSlot()) {
@@ -3627,7 +3680,24 @@ void CodeGenerator::AssembleSwap(InstructionOperand* source,
       __ swc1(temp_1, src0);
     } else {
       DCHECK_EQ(MachineRepresentation::kSimd128, rep);
-      UNREACHABLE();
+      MemOperand src1(src0.rm(), src0.offset() + kIntSize);
+      MemOperand dst1(dst0.rm(), dst0.offset() + kIntSize);
+      MemOperand src2(src0.rm(), src0.offset() + 2 * kIntSize);
+      MemOperand dst2(dst0.rm(), dst0.offset() + 2 * kIntSize);
+      MemOperand src3(src0.rm(), src0.offset() + 3 * kIntSize);
+      MemOperand dst3(dst0.rm(), dst0.offset() + 3 * kIntSize);
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      MSARegister temp_1 = kSimd128ScratchReg;
+      __ ld_b(temp_1, dst0);  // Save destination in temp_1.
+      __ lw(temp_0, src0);    // Then use temp_0 to copy source to destination.
+      __ sw(temp_0, dst0);
+      __ lw(temp_0, src1);
+      __ sw(temp_0, dst1);
+      __ lw(temp_0, src2);
+      __ sw(temp_0, dst2);
+      __ lw(temp_0, src3);
+      __ sw(temp_0, dst3);
+      __ st_b(temp_1, src0);
     }
   } else {
     // No other combinations are possible.
diff --git a/deps/v8/src/compiler/mips/instruction-selector-mips.cc b/deps/v8/src/compiler/mips/instruction-selector-mips.cc
index 35b8a2396d5..f8ca119b83a 100644
--- a/deps/v8/src/compiler/mips/instruction-selector-mips.cc
+++ b/deps/v8/src/compiler/mips/instruction-selector-mips.cc
@@ -48,7 +48,7 @@ class MipsOperandGenerator final : public OperandGenerator {
 
   int64_t GetIntegerConstantValue(Node* node) {
     DCHECK_EQ(IrOpcode::kInt32Constant, node->opcode());
-    return OpParameter<int32_t>(node);
+    return OpParameter<int32_t>(node->op());
   }
 
   bool IsFloatConstant(Node* node) {
@@ -58,10 +58,10 @@ class MipsOperandGenerator final : public OperandGenerator {
 
   double GetFloatConstantValue(Node* node) {
     if (node->opcode() == IrOpcode::kFloat32Constant) {
-      return OpParameter<float>(node);
+      return OpParameter<float>(node->op());
     }
     DCHECK_EQ(IrOpcode::kFloat64Constant, node->opcode());
-    return OpParameter<double>(node);
+    return OpParameter<double>(node->op());
   }
 
   bool CanBeImmediate(Node* node, InstructionCode opcode) {
@@ -133,7 +133,7 @@ static void VisitRR(InstructionSelector* selector, ArchOpcode opcode,
 static void VisitRRI(InstructionSelector* selector, ArchOpcode opcode,
                      Node* node) {
   MipsOperandGenerator g(selector);
-  int32_t imm = OpParameter<int32_t>(node);
+  int32_t imm = OpParameter<int32_t>(node->op());
   selector->Emit(opcode, g.DefineAsRegister(node),
                  g.UseRegister(node->InputAt(0)), g.UseImmediate(imm));
 }
@@ -141,7 +141,7 @@ static void VisitRRI(InstructionSelector* selector, ArchOpcode opcode,
 static void VisitRRIR(InstructionSelector* selector, ArchOpcode opcode,
                       Node* node) {
   MipsOperandGenerator g(selector);
-  int32_t imm = OpParameter<int32_t>(node);
+  int32_t imm = OpParameter<int32_t>(node->op());
   selector->Emit(opcode, g.DefineAsRegister(node),
                  g.UseRegister(node->InputAt(0)), g.UseImmediate(imm),
                  g.UseRegister(node->InputAt(1)));
@@ -174,9 +174,9 @@ static void VisitBinop(InstructionSelector* selector, Node* node,
                        FlagsContinuation* cont) {
   MipsOperandGenerator g(selector);
   Int32BinopMatcher m(node);
-  InstructionOperand inputs[4];
+  InstructionOperand inputs[2];
   size_t input_count = 0;
-  InstructionOperand outputs[2];
+  InstructionOperand outputs[1];
   size_t output_count = 0;
 
   if (TryMatchImmediate(selector, &opcode, m.right().node(), &input_count,
@@ -194,13 +194,6 @@ static void VisitBinop(InstructionSelector* selector, Node* node,
     inputs[input_count++] = g.UseOperand(m.right().node(), opcode);
   }
 
-  if (cont->IsBranch()) {
-    inputs[input_count++] = g.Label(cont->true_block());
-    inputs[input_count++] = g.Label(cont->false_block());
-  } else if (cont->IsTrap()) {
-    inputs[input_count++] = g.TempImmediate(cont->trap_id());
-  }
-
   if (cont->IsDeoptimize()) {
     // If we can deoptimize as a result of the binop, we need to make sure that
     // the deopt inputs are not overwritten by the binop result. One way
@@ -209,23 +202,14 @@ static void VisitBinop(InstructionSelector* selector, Node* node,
   } else {
     outputs[output_count++] = g.DefineAsRegister(node);
   }
-  if (cont->IsSet()) {
-    outputs[output_count++] = g.DefineAsRegister(cont->result());
-  }
 
   DCHECK_NE(0u, input_count);
-  DCHECK_NE(0u, output_count);
+  DCHECK_EQ(1u, output_count);
   DCHECK_GE(arraysize(inputs), input_count);
   DCHECK_GE(arraysize(outputs), output_count);
 
-  opcode = cont->Encode(opcode);
-  if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, output_count, outputs, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else {
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, output_count, outputs, input_count,
+                                 inputs, cont);
 }
 
 static void VisitBinop(InstructionSelector* selector, Node* node,
@@ -267,7 +251,7 @@ void InstructionSelector::VisitLoad(Node* node) {
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
 
-  ArchOpcode opcode = kArchNop;
+  InstructionCode opcode = kArchNop;
   switch (load_rep.representation()) {
     case MachineRepresentation::kFloat32:
       opcode = kMipsLwc1;
@@ -296,6 +280,10 @@ void InstructionSelector::VisitLoad(Node* node) {
       UNREACHABLE();
       return;
   }
+  if (node->opcode() == IrOpcode::kPoisonedLoad) {
+    CHECK_EQ(poisoning_enabled_, PoisoningMitigationLevel::kOn);
+    opcode |= MiscField::encode(kMemoryAccessPoisoned);
+  }
 
   if (g.CanBeImmediate(index, opcode)) {
     Emit(opcode | AddressingModeField::encode(kMode_MRI),
@@ -310,6 +298,8 @@ void InstructionSelector::VisitLoad(Node* node) {
   }
 }
 
+void InstructionSelector::VisitPoisonedLoad(Node* node) { VisitLoad(node); }
+
 void InstructionSelector::VisitProtectedLoad(Node* node) {
   // TODO(eholk)
   UNIMPLEMENTED();
@@ -1157,14 +1147,14 @@ void InstructionSelector::VisitFloat64Ieee754Unop(Node* node,
 }
 
 void InstructionSelector::EmitPrepareArguments(
-    ZoneVector<PushParameter>* arguments, const CallDescriptor* descriptor,
+    ZoneVector<PushParameter>* arguments, const CallDescriptor* call_descriptor,
     Node* node) {
   MipsOperandGenerator g(this);
 
   // Prepare for C function call.
-  if (descriptor->IsCFunctionCall()) {
-    Emit(kArchPrepareCallCFunction |
-             MiscField::encode(static_cast<int>(descriptor->ParameterCount())),
+  if (call_descriptor->IsCFunctionCall()) {
+    Emit(kArchPrepareCallCFunction | MiscField::encode(static_cast<int>(
+                                         call_descriptor->ParameterCount())),
          0, nullptr, 0, nullptr);
 
     // Poke any stack arguments.
@@ -1178,7 +1168,7 @@ void InstructionSelector::EmitPrepareArguments(
     }
   } else {
     // Possibly align stack here for functions.
-    int push_count = static_cast<int>(descriptor->StackParameterCount());
+    int push_count = static_cast<int>(call_descriptor->StackParameterCount());
     if (push_count > 0) {
       // Calculate needed space
       int stack_size = 0;
@@ -1201,30 +1191,26 @@ void InstructionSelector::EmitPrepareArguments(
   }
 }
 
-void InstructionSelector::EmitPrepareResults(ZoneVector<PushParameter>* results,
-                                             const CallDescriptor* descriptor,
-                                             Node* node) {
+void InstructionSelector::EmitPrepareResults(
+    ZoneVector<PushParameter>* results, const CallDescriptor* call_descriptor,
+    Node* node) {
   MipsOperandGenerator g(this);
 
   int reverse_slot = 0;
   for (PushParameter output : *results) {
     if (!output.location.IsCallerFrameSlot()) continue;
-    ++reverse_slot;
     // Skip any alignment holes in nodes.
     if (output.node != nullptr) {
-      DCHECK(!descriptor->IsCFunctionCall());
+      DCHECK(!call_descriptor->IsCFunctionCall());
       if (output.location.GetType() == MachineType::Float32()) {
         MarkAsFloat32(output.node);
       } else if (output.location.GetType() == MachineType::Float64()) {
         MarkAsFloat64(output.node);
       }
-      InstructionOperand result = g.DefineAsRegister(output.node);
-      Emit(kMipsPeek | MiscField::encode(reverse_slot), result);
-    }
-    if (output.location.GetType() == MachineType::Float64()) {
-      // Float64 require an implicit second slot.
-      ++reverse_slot;
+      Emit(kMipsPeek, g.DefineAsRegister(output.node),
+           g.UseImmediate(reverse_slot));
     }
+    reverse_slot += output.location.GetSizeInPointers();
   }
 }
 
@@ -1233,8 +1219,7 @@ bool InstructionSelector::IsTailCallAddressImmediate() { return false; }
 int InstructionSelector::GetTempsCountForTailCallFromJSFunction() { return 3; }
 
 void InstructionSelector::VisitUnalignedLoad(Node* node) {
-  UnalignedLoadRepresentation load_rep =
-      UnalignedLoadRepresentationOf(node->op());
+  LoadRepresentation load_rep = LoadRepresentationOf(node->op());
   MipsOperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -1340,22 +1325,7 @@ namespace {
 static void VisitCompare(InstructionSelector* selector, InstructionCode opcode,
                          InstructionOperand left, InstructionOperand right,
                          FlagsContinuation* cont) {
-  MipsOperandGenerator g(selector);
-  opcode = cont->Encode(opcode);
-  if (cont->IsBranch()) {
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.Label(cont->true_block()), g.Label(cont->false_block()));
-  } else if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, g.NoOutput(), left, right, cont->kind(),
-                             cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsSet()) {
-    selector->Emit(opcode, g.DefineAsRegister(cont->result()), left, right);
-  } else {
-    DCHECK(cont->IsTrap());
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.TempImmediate(cont->trap_id()));
-  }
+  selector->EmitWithContinuation(opcode, left, right, cont);
 }
 
 
@@ -1467,12 +1437,13 @@ void VisitWordCompare(InstructionSelector* selector, Node* node,
   VisitWordCompare(selector, node, kMipsCmp, cont, false);
 }
 
+}  // namespace
+
 // Shared routine for word comparisons against zero.
-void VisitWordCompareZero(InstructionSelector* selector, Node* user,
-                          Node* value, FlagsContinuation* cont) {
+void InstructionSelector::VisitWordCompareZero(Node* user, Node* value,
+                                               FlagsContinuation* cont) {
   // Try to combine with comparisons against 0 by simply inverting the branch.
-  while (value->opcode() == IrOpcode::kWord32Equal &&
-         selector->CanCover(user, value)) {
+  while (value->opcode() == IrOpcode::kWord32Equal && CanCover(user, value)) {
     Int32BinopMatcher m(value);
     if (!m.right().Is(0)) break;
 
@@ -1481,41 +1452,41 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
     cont->Negate();
   }
 
-  if (selector->CanCover(user, value)) {
+  if (CanCover(user, value)) {
     switch (value->opcode()) {
       case IrOpcode::kWord32Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kInt32LessThan:
         cont->OverwriteAndNegateIfEqual(kSignedLessThan);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kInt32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kSignedLessThanOrEqual);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kUint32LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kUint32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitWordCompare(selector, value, cont);
+        return VisitWordCompare(this, value, cont);
       case IrOpcode::kFloat32Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat64Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kProjection:
         // Check if this is the overflow output projection of an
         // <Operation>WithOverflow node.
@@ -1527,17 +1498,17 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
           // *AFTER* this branch).
           Node* const node = value->InputAt(0);
           Node* const result = NodeProperties::FindProjection(node, 0);
-          if (!result || selector->IsDefined(result)) {
+          if (!result || IsDefined(result)) {
             switch (node->opcode()) {
               case IrOpcode::kInt32AddWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kMipsAddOvf, cont);
+                return VisitBinop(this, node, kMipsAddOvf, cont);
               case IrOpcode::kInt32SubWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kMipsSubOvf, cont);
+                return VisitBinop(this, node, kMipsSubOvf, cont);
               case IrOpcode::kInt32MulWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kMipsMulOvf, cont);
+                return VisitBinop(this, node, kMipsMulOvf, cont);
               default:
                 break;
             }
@@ -1545,66 +1516,16 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
         }
         break;
       case IrOpcode::kWord32And:
-        return VisitWordCompare(selector, value, kMipsTst, cont, true);
+        return VisitWordCompare(this, value, kMipsTst, cont, true);
       default:
         break;
     }
   }
 
   // Continuation could not be combined with a compare, emit compare against 0.
-  MipsOperandGenerator g(selector);
-  InstructionCode const opcode = cont->Encode(kMipsCmp);
+  MipsOperandGenerator g(this);
   InstructionOperand const value_operand = g.UseRegister(value);
-  if (cont->IsBranch()) {
-    selector->Emit(opcode, g.NoOutput(), value_operand, g.TempImmediate(0),
-                   g.Label(cont->true_block()), g.Label(cont->false_block()));
-  } else if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, g.NoOutput(), value_operand,
-                             g.TempImmediate(0), cont->kind(), cont->reason(),
-                             cont->feedback(), cont->frame_state());
-  } else if (cont->IsSet()) {
-    selector->Emit(opcode, g.DefineAsRegister(cont->result()), value_operand,
-                   g.TempImmediate(0));
-  } else {
-    DCHECK(cont->IsTrap());
-    selector->Emit(opcode, g.NoOutput(), value_operand, g.TempImmediate(0),
-                   g.TempImmediate(cont->trap_id()));
-  }
-}
-
-}  // namespace
-
-void InstructionSelector::VisitBranch(Node* branch, BasicBlock* tbranch,
-                                      BasicBlock* fbranch) {
-  FlagsContinuation cont(kNotEqual, tbranch, fbranch);
-  VisitWordCompareZero(this, branch, branch->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeIf(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kNotEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeUnless(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapIf(Node* node, Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kNotEqual, func_id, node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapUnless(Node* node,
-                                          Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kEqual, func_id, node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
+  EmitWithContinuation(kMipsCmp, value_operand, g.TempImmediate(0), cont);
 }
 
 void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
@@ -1612,24 +1533,26 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
   InstructionOperand value_operand = g.UseRegister(node->InputAt(0));
 
   // Emit either ArchTableSwitch or ArchLookupSwitch.
-  static const size_t kMaxTableSwitchValueRange = 2 << 16;
-  size_t table_space_cost = 9 + sw.value_range;
-  size_t table_time_cost = 3;
-  size_t lookup_space_cost = 2 + 2 * sw.case_count;
-  size_t lookup_time_cost = sw.case_count;
-  if (sw.case_count > 0 &&
-      table_space_cost + 3 * table_time_cost <=
-          lookup_space_cost + 3 * lookup_time_cost &&
-      sw.min_value > std::numeric_limits<int32_t>::min() &&
-      sw.value_range <= kMaxTableSwitchValueRange) {
-    InstructionOperand index_operand = value_operand;
-    if (sw.min_value) {
-      index_operand = g.TempRegister();
-      Emit(kMipsSub, index_operand, value_operand,
-           g.TempImmediate(sw.min_value));
+  if (enable_switch_jump_table_ == kEnableSwitchJumpTable) {
+    static const size_t kMaxTableSwitchValueRange = 2 << 16;
+    size_t table_space_cost = 9 + sw.value_range();
+    size_t table_time_cost = 3;
+    size_t lookup_space_cost = 2 + 2 * sw.case_count();
+    size_t lookup_time_cost = sw.case_count();
+    if (sw.case_count() > 0 &&
+        table_space_cost + 3 * table_time_cost <=
+            lookup_space_cost + 3 * lookup_time_cost &&
+        sw.min_value() > std::numeric_limits<int32_t>::min() &&
+        sw.value_range() <= kMaxTableSwitchValueRange) {
+      InstructionOperand index_operand = value_operand;
+      if (sw.min_value()) {
+        index_operand = g.TempRegister();
+        Emit(kMipsSub, index_operand, value_operand,
+             g.TempImmediate(sw.min_value()));
+      }
+      // Generate a table lookup.
+      return EmitTableSwitch(sw, index_operand);
     }
-    // Generate a table lookup.
-    return EmitTableSwitch(sw, index_operand);
   }
 
   // Generate a sequence of conditional jumps.
@@ -1641,7 +1564,7 @@ void InstructionSelector::VisitWord32Equal(Node* const node) {
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
   Int32BinopMatcher m(node);
   if (m.right().Is(0)) {
-    return VisitWordCompareZero(this, m.node(), m.left().node(), &cont);
+    return VisitWordCompareZero(m.node(), m.left().node(), &cont);
   }
   VisitWordCompare(this, node, &cont);
 }
@@ -1778,7 +1701,7 @@ void InstructionSelector::VisitFloat64SilenceNaN(Node* node) {
        arraysize(temps), temps);
 }
 
-void InstructionSelector::VisitAtomicLoad(Node* node) {
+void InstructionSelector::VisitWord32AtomicLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
   MipsOperandGenerator g(this);
   Node* base = node->InputAt(0);
@@ -1786,13 +1709,15 @@ void InstructionSelector::VisitAtomicLoad(Node* node) {
   ArchOpcode opcode = kArchNop;
   switch (load_rep.representation()) {
     case MachineRepresentation::kWord8:
-      opcode = load_rep.IsSigned() ? kAtomicLoadInt8 : kAtomicLoadUint8;
+      opcode =
+          load_rep.IsSigned() ? kWord32AtomicLoadInt8 : kWord32AtomicLoadUint8;
       break;
     case MachineRepresentation::kWord16:
-      opcode = load_rep.IsSigned() ? kAtomicLoadInt16 : kAtomicLoadUint16;
+      opcode = load_rep.IsSigned() ? kWord32AtomicLoadInt16
+                                   : kWord32AtomicLoadUint16;
       break;
     case MachineRepresentation::kWord32:
-      opcode = kAtomicLoadWord32;
+      opcode = kWord32AtomicLoadWord32;
       break;
     default:
       UNREACHABLE();
@@ -1812,7 +1737,7 @@ void InstructionSelector::VisitAtomicLoad(Node* node) {
   }
 }
 
-void InstructionSelector::VisitAtomicStore(Node* node) {
+void InstructionSelector::VisitWord32AtomicStore(Node* node) {
   MachineRepresentation rep = AtomicStoreRepresentationOf(node->op());
   MipsOperandGenerator g(this);
   Node* base = node->InputAt(0);
@@ -1821,13 +1746,13 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
   ArchOpcode opcode = kArchNop;
   switch (rep) {
     case MachineRepresentation::kWord8:
-      opcode = kAtomicStoreWord8;
+      opcode = kWord32AtomicStoreWord8;
       break;
     case MachineRepresentation::kWord16:
-      opcode = kAtomicStoreWord16;
+      opcode = kWord32AtomicStoreWord16;
       break;
     case MachineRepresentation::kWord32:
-      opcode = kAtomicStoreWord32;
+      opcode = kWord32AtomicStoreWord32;
       break;
     default:
       UNREACHABLE();
@@ -1848,7 +1773,7 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
   }
 }
 
-void InstructionSelector::VisitAtomicExchange(Node* node) {
+void InstructionSelector::VisitWord32AtomicExchange(Node* node) {
   MipsOperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -1856,15 +1781,15 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   ArchOpcode opcode = kArchNop;
   MachineType type = AtomicOpRepresentationOf(node->op());
   if (type == MachineType::Int8()) {
-    opcode = kAtomicExchangeInt8;
+    opcode = kWord32AtomicExchangeInt8;
   } else if (type == MachineType::Uint8()) {
-    opcode = kAtomicExchangeUint8;
+    opcode = kWord32AtomicExchangeUint8;
   } else if (type == MachineType::Int16()) {
-    opcode = kAtomicExchangeInt16;
+    opcode = kWord32AtomicExchangeInt16;
   } else if (type == MachineType::Uint16()) {
-    opcode = kAtomicExchangeUint16;
+    opcode = kWord32AtomicExchangeUint16;
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
-    opcode = kAtomicExchangeWord32;
+    opcode = kWord32AtomicExchangeWord32;
   } else {
     UNREACHABLE();
     return;
@@ -1886,7 +1811,7 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   Emit(code, 1, outputs, input_count, inputs, 3, temp);
 }
 
-void InstructionSelector::VisitAtomicCompareExchange(Node* node) {
+void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
   MipsOperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -1895,15 +1820,15 @@ void InstructionSelector::VisitAtomicCompareExchange(Node* node) {
   ArchOpcode opcode = kArchNop;
   MachineType type = AtomicOpRepresentationOf(node->op());
   if (type == MachineType::Int8()) {
-    opcode = kAtomicCompareExchangeInt8;
+    opcode = kWord32AtomicCompareExchangeInt8;
   } else if (type == MachineType::Uint8()) {
-    opcode = kAtomicCompareExchangeUint8;
+    opcode = kWord32AtomicCompareExchangeUint8;
   } else if (type == MachineType::Int16()) {
-    opcode = kAtomicCompareExchangeInt16;
+    opcode = kWord32AtomicCompareExchangeInt16;
   } else if (type == MachineType::Uint16()) {
-    opcode = kAtomicCompareExchangeUint16;
+    opcode = kWord32AtomicCompareExchangeUint16;
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
-    opcode = kAtomicCompareExchangeWord32;
+    opcode = kWord32AtomicCompareExchangeWord32;
   } else {
     UNREACHABLE();
     return;
@@ -1967,11 +1892,12 @@ void InstructionSelector::VisitAtomicBinaryOperation(
   Emit(code, 1, outputs, input_count, inputs, 4, temps);
 }
 
-#define VISIT_ATOMIC_BINOP(op)                                              \
-  void InstructionSelector::VisitAtomic##op(Node* node) {                   \
-    VisitAtomicBinaryOperation(node, kAtomic##op##Int8, kAtomic##op##Uint8, \
-                               kAtomic##op##Int16, kAtomic##op##Uint16,     \
-                               kAtomic##op##Word32);                        \
+#define VISIT_ATOMIC_BINOP(op)                                   \
+  void InstructionSelector::VisitWord32Atomic##op(Node* node) {  \
+    VisitAtomicBinaryOperation(                                  \
+        node, kWord32Atomic##op##Int8, kWord32Atomic##op##Uint8, \
+        kWord32Atomic##op##Int16, kWord32Atomic##op##Uint16,     \
+        kWord32Atomic##op##Word32);                              \
   }
 VISIT_ATOMIC_BINOP(Add)
 VISIT_ATOMIC_BINOP(Sub)
@@ -1996,11 +1922,6 @@ void InstructionSelector::VisitSpeculationFence(Node* node) { UNREACHABLE(); }
   V(I16x8)                \
   V(I8x16)
 
-#define SIMD_FORMAT_LIST(V) \
-  V(32x4)                   \
-  V(16x8)                   \
-  V(8x16)
-
 #define SIMD_UNOP_LIST(V)                                \
   V(F32x4SConvertI32x4, kMipsF32x4SConvertI32x4)         \
   V(F32x4UConvertI32x4, kMipsF32x4UConvertI32x4)         \
@@ -2232,7 +2153,7 @@ bool TryMatchArchShuffle(const uint8_t* shuffle, const ShuffleEntry* table,
 }  // namespace
 
 void InstructionSelector::VisitS8x16Shuffle(Node* node) {
-  const uint8_t* shuffle = OpParameter<uint8_t*>(node);
+  const uint8_t* shuffle = OpParameter<uint8_t*>(node->op());
   uint8_t mask = CanonicalizeShuffle(node);
   uint8_t shuffle32x4[4];
   ArchOpcode opcode;
@@ -2263,6 +2184,16 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
        g.UseImmediate(Pack4Lanes(shuffle + 12, mask)));
 }
 
+void InstructionSelector::VisitSignExtendWord8ToInt32(Node* node) {
+  MipsOperandGenerator g(this);
+  Emit(kMipsSeb, g.DefineAsRegister(node), g.UseRegister(node->InputAt(0)));
+}
+
+void InstructionSelector::VisitSignExtendWord16ToInt32(Node* node) {
+  MipsOperandGenerator g(this);
+  Emit(kMipsSeh, g.DefineAsRegister(node), g.UseRegister(node->InputAt(0)));
+}
+
 // static
 MachineOperatorBuilder::Flags
 InstructionSelector::SupportedMachineOperatorFlags() {
@@ -2306,7 +2237,6 @@ InstructionSelector::AlignmentRequirements() {
 #undef SIMD_SHIFT_OP_LIST
 #undef SIMD_UNOP_LIST
 #undef SIMD_TYPE_LIST
-#undef SIMD_FORMAT_LIST
 #undef TRACE_UNIMPL
 #undef TRACE
 
diff --git a/deps/v8/src/compiler/mips64/OWNERS b/deps/v8/src/compiler/mips64/OWNERS
index 3fce7dd6883..4ce9d7f91da 100644
--- a/deps/v8/src/compiler/mips64/OWNERS
+++ b/deps/v8/src/compiler/mips64/OWNERS
@@ -1,2 +1,3 @@
 ivica.bogosavljevic@mips.com
-Miran.Karic@mips.com
\ No newline at end of file
+Miran.Karic@mips.com
+sreten.kovacevic@mips.com
\ No newline at end of file
diff --git a/deps/v8/src/compiler/mips64/code-generator-mips64.cc b/deps/v8/src/compiler/mips64/code-generator-mips64.cc
index d4463008c8f..7ad081e0d9b 100644
--- a/deps/v8/src/compiler/mips64/code-generator-mips64.cc
+++ b/deps/v8/src/compiler/mips64/code-generator-mips64.cc
@@ -362,6 +362,17 @@ FPUCondition FlagsConditionToConditionCmpFPU(bool& predicate,
   UNREACHABLE();
 }
 
+void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
+                                   InstructionCode opcode, Instruction* instr,
+                                   MipsOperandConverter& i) {
+  const MemoryAccessMode access_mode =
+      static_cast<MemoryAccessMode>(MiscField::decode(opcode));
+  if (access_mode == kMemoryAccessPoisoned) {
+    Register value = i.OutputRegister();
+    codegen->tasm()->And(value, value, kSpeculationPoisonRegister);
+  }
+}
+
 }  // namespace
 
 #define ASSEMBLE_ROUND_DOUBLE_TO_DOUBLE(mode)                                  \
@@ -634,33 +645,53 @@ void CodeGenerator::AssembleTailCallAfterGap(Instruction* instr,
                                 first_unused_stack_slot);
 }
 
+// Check that {kJavaScriptCallCodeStartRegister} is correct.
+void CodeGenerator::AssembleCodeStartRegisterCheck() {
+  __ ComputeCodeStartAddress(at);
+  __ Assert(eq, AbortReason::kWrongFunctionCodeStart,
+            kJavaScriptCallCodeStartRegister, Operand(at));
+}
+
 // Check if the code object is marked for deoptimization. If it is, then it
 // jumps to the CompileLazyDeoptimizedCode builtin. In order to do this we need
 // to:
-//    1. load the address of the current instruction;
-//    2. read from memory the word that contains that bit, which can be found in
+//    1. read from memory the word that contains that bit, which can be found in
 //       the flags in the referenced {CodeDataContainer} object;
-//    3. test kMarkedForDeoptimizationBit in those flags; and
-//    4. if it is not zero then it jumps to the builtin.
+//    2. test kMarkedForDeoptimizationBit in those flags; and
+//    3. if it is not zero then it jumps to the builtin.
 void CodeGenerator::BailoutIfDeoptimized() {
-  Label current;
-  // This push on ra and the pop below together ensure that we restore the
-  // register ra, which is needed while computing frames for deoptimization.
-  __ push(ra);
-  // The bal instruction puts the address of the current instruction into
-  // the return address (ra) register, which we can use later on.
-  __ bal(&current);
-  __ nop();
-  int pc = __ pc_offset();
-  __ bind(&current);
-  int offset = Code::kCodeDataContainerOffset - (Code::kHeaderSize + pc);
-  __ Ld(a2, MemOperand(ra, offset));
-  __ pop(ra);
-  __ Lw(a2, FieldMemOperand(a2, CodeDataContainer::kKindSpecificFlagsOffset));
-  __ And(a2, a2, Operand(1 << Code::kMarkedForDeoptimizationBit));
+  int offset = Code::kCodeDataContainerOffset - Code::kHeaderSize;
+  __ Ld(at, MemOperand(kJavaScriptCallCodeStartRegister, offset));
+  __ Lw(at, FieldMemOperand(at, CodeDataContainer::kKindSpecificFlagsOffset));
+  __ And(at, at, Operand(1 << Code::kMarkedForDeoptimizationBit));
   Handle<Code> code = isolate()->builtins()->builtin_handle(
       Builtins::kCompileLazyDeoptimizedCode);
-  __ Jump(code, RelocInfo::CODE_TARGET, ne, a2, Operand(zero_reg));
+  __ Jump(code, RelocInfo::CODE_TARGET, ne, at, Operand(zero_reg));
+}
+
+void CodeGenerator::GenerateSpeculationPoisonFromCodeStartRegister() {
+  // Calculate a mask which has all bits set in the normal case, but has all
+  // bits cleared if we are speculatively executing the wrong PC.
+  //    difference = (current - expected) | (expected - current)
+  //    poison = ~(difference >> (kBitsPerPointer - 1))
+  __ ComputeCodeStartAddress(at);
+  __ Move(kSpeculationPoisonRegister, at);
+  __ subu(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
+          kJavaScriptCallCodeStartRegister);
+  __ subu(kJavaScriptCallCodeStartRegister, kJavaScriptCallCodeStartRegister,
+          at);
+  __ or_(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
+         kJavaScriptCallCodeStartRegister);
+  __ sra(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
+         kBitsPerPointer - 1);
+  __ nor(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
+         kSpeculationPoisonRegister);
+}
+
+void CodeGenerator::AssembleRegisterArgumentPoisoning() {
+  __ And(kJSFunctionRegister, kJSFunctionRegister, kSpeculationPoisonRegister);
+  __ And(kContextRegister, kContextRegister, kSpeculationPoisonRegister);
+  __ And(sp, sp, kSpeculationPoisonRegister);
 }
 
 // Assembles an instruction after register allocation, producing machine code.
@@ -746,9 +777,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ Assert(eq, AbortReason::kWrongFunctionContext, cp,
                   Operand(kScratchReg));
       }
-      __ Ld(at, FieldMemOperand(func, JSFunction::kCodeOffset));
-      __ Daddu(at, at, Operand(Code::kHeaderSize - kHeapObjectTag));
-      __ Call(at);
+      static_assert(kJavaScriptCallCodeStartRegister == a2, "ABI mismatch");
+      __ Ld(a2, FieldMemOperand(func, JSFunction::kCodeOffset));
+      __ Daddu(a2, a2, Operand(Code::kHeaderSize - kHeapObjectTag));
+      __ Call(a2);
       RecordCallPosition(instr);
       frame_access_state()->ClearSPDelta();
       break;
@@ -875,6 +907,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), fp);
       }
       break;
+    case kArchRootsPointer:
+      __ mov(i.OutputRegister(), kRootRegister);
+      break;
     case kArchTruncateDoubleToI:
       __ TruncateDoubleToIDelayed(zone(), i.OutputRegister(),
                                   i.InputDoubleRegister(0));
@@ -931,6 +966,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
 
       break;
     }
+    case kArchPoisonOnSpeculationWord:
+      __ And(i.OutputRegister(), i.InputRegister(0),
+             kSpeculationPoisonRegister);
+      break;
     case kIeee754Float64Acos:
       ASSEMBLE_IEEE754_UNOP(acos);
       break;
@@ -1003,7 +1042,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Daddu(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMips64DaddOvf:
-      // Pseudo-instruction used for overflow/branch. No opcode emitted here.
+      __ DaddOverflow(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1),
+                      kScratchReg);
       break;
     case kMips64Sub:
       __ Subu(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
@@ -1012,13 +1052,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Dsubu(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMips64DsubOvf:
-      // Pseudo-instruction used for overflow/branch. No opcode emitted here.
+      __ DsubOverflow(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1),
+                      kScratchReg);
       break;
     case kMips64Mul:
       __ Mul(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMips64MulOvf:
-      // Pseudo-instruction used for overflow/branch. No opcode emitted here.
+      __ MulOverflow(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1),
+                     kScratchReg);
       break;
     case kMips64MulHigh:
       __ Mulh(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
@@ -1153,124 +1195,22 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kMips64Ctz: {
       Register src = i.InputRegister(0);
       Register dst = i.OutputRegister();
-      if (kArchVariant == kMips64r6) {
-        // We don't have an instruction to count the number of trailing zeroes.
-        // Start by flipping the bits end-for-end so we can count the number of
-        // leading zeroes instead.
-        __ rotr(dst, src, 16);
-        __ wsbh(dst, dst);
-        __ bitswap(dst, dst);
-        __ Clz(dst, dst);
-      } else {
-        // Convert trailing zeroes to trailing ones, and bits to their left
-        // to zeroes.
-        __ Daddu(kScratchReg, src, -1);
-        __ Xor(dst, kScratchReg, src);
-        __ And(dst, dst, kScratchReg);
-        // Count number of leading zeroes.
-        __ Clz(dst, dst);
-        // Subtract number of leading zeroes from 32 to get number of trailing
-        // ones. Remember that the trailing ones were formerly trailing zeroes.
-        __ li(kScratchReg, 32);
-        __ Subu(dst, kScratchReg, dst);
-      }
+      __ Ctz(dst, src);
     } break;
     case kMips64Dctz: {
       Register src = i.InputRegister(0);
       Register dst = i.OutputRegister();
-      if (kArchVariant == kMips64r6) {
-        // We don't have an instruction to count the number of trailing zeroes.
-        // Start by flipping the bits end-for-end so we can count the number of
-        // leading zeroes instead.
-        __ dsbh(dst, src);
-        __ dshd(dst, dst);
-        __ dbitswap(dst, dst);
-        __ dclz(dst, dst);
-      } else {
-        // Convert trailing zeroes to trailing ones, and bits to their left
-        // to zeroes.
-        __ Daddu(kScratchReg, src, -1);
-        __ Xor(dst, kScratchReg, src);
-        __ And(dst, dst, kScratchReg);
-        // Count number of leading zeroes.
-        __ dclz(dst, dst);
-        // Subtract number of leading zeroes from 64 to get number of trailing
-        // ones. Remember that the trailing ones were formerly trailing zeroes.
-        __ li(kScratchReg, 64);
-        __ Dsubu(dst, kScratchReg, dst);
-      }
+      __ Dctz(dst, src);
     } break;
     case kMips64Popcnt: {
-      // https://graphics.stanford.edu/~seander/bithacks.html#CountBitsSetParallel
-      //
-      // A generalization of the best bit counting method to integers of
-      // bit-widths up to 128 (parameterized by type T) is this:
-      //
-      // v = v - ((v >> 1) & (T)~(T)0/3);                           // temp
-      // v = (v & (T)~(T)0/15*3) + ((v >> 2) & (T)~(T)0/15*3);      // temp
-      // v = (v + (v >> 4)) & (T)~(T)0/255*15;                      // temp
-      // c = (T)(v * ((T)~(T)0/255)) >> (sizeof(T) - 1) * BITS_PER_BYTE; //count
-      //
-      // For comparison, for 32-bit quantities, this algorithm can be executed
-      // using 20 MIPS instructions (the calls to LoadConst32() generate two
-      // machine instructions each for the values being used in this algorithm).
-      // A(n unrolled) loop-based algorithm requires 25 instructions.
-      //
-      // For a 64-bit operand this can be performed in 24 instructions compared
-      // to a(n unrolled) loop based algorithm which requires 38 instructions.
-      //
-      // There are algorithms which are faster in the cases where very few
-      // bits are set but the algorithm here attempts to minimize the total
-      // number of instructions executed even when a large number of bits
-      // are set.
       Register src = i.InputRegister(0);
       Register dst = i.OutputRegister();
-      uint32_t B0 = 0x55555555;     // (T)~(T)0/3
-      uint32_t B1 = 0x33333333;     // (T)~(T)0/15*3
-      uint32_t B2 = 0x0F0F0F0F;     // (T)~(T)0/255*15
-      uint32_t value = 0x01010101;  // (T)~(T)0/255
-      uint32_t shift = 24;          // (sizeof(T) - 1) * BITS_PER_BYTE
-      __ srl(kScratchReg, src, 1);
-      __ li(kScratchReg2, B0);
-      __ And(kScratchReg, kScratchReg, kScratchReg2);
-      __ Subu(kScratchReg, src, kScratchReg);
-      __ li(kScratchReg2, B1);
-      __ And(dst, kScratchReg, kScratchReg2);
-      __ srl(kScratchReg, kScratchReg, 2);
-      __ And(kScratchReg, kScratchReg, kScratchReg2);
-      __ Addu(kScratchReg, dst, kScratchReg);
-      __ srl(dst, kScratchReg, 4);
-      __ Addu(dst, dst, kScratchReg);
-      __ li(kScratchReg2, B2);
-      __ And(dst, dst, kScratchReg2);
-      __ li(kScratchReg, value);
-      __ Mul(dst, dst, kScratchReg);
-      __ srl(dst, dst, shift);
+      __ Popcnt(dst, src);
     } break;
     case kMips64Dpopcnt: {
       Register src = i.InputRegister(0);
       Register dst = i.OutputRegister();
-      uint64_t B0 = 0x5555555555555555l;     // (T)~(T)0/3
-      uint64_t B1 = 0x3333333333333333l;     // (T)~(T)0/15*3
-      uint64_t B2 = 0x0F0F0F0F0F0F0F0Fl;     // (T)~(T)0/255*15
-      uint64_t value = 0x0101010101010101l;  // (T)~(T)0/255
-      uint64_t shift = 24;                   // (sizeof(T) - 1) * BITS_PER_BYTE
-      __ dsrl(kScratchReg, src, 1);
-      __ li(kScratchReg2, B0);
-      __ And(kScratchReg, kScratchReg, kScratchReg2);
-      __ Dsubu(kScratchReg, src, kScratchReg);
-      __ li(kScratchReg2, B1);
-      __ And(dst, kScratchReg, kScratchReg2);
-      __ dsrl(kScratchReg, kScratchReg, 2);
-      __ And(kScratchReg, kScratchReg, kScratchReg2);
-      __ Daddu(kScratchReg, dst, kScratchReg);
-      __ dsrl(dst, kScratchReg, 4);
-      __ Daddu(dst, dst, kScratchReg);
-      __ li(kScratchReg2, B2);
-      __ And(dst, dst, kScratchReg2);
-      __ li(kScratchReg, value);
-      __ Dmul(dst, dst, kScratchReg);
-      __ dsrl32(dst, dst, shift);
+      __ Dpopcnt(dst, src);
     } break;
     case kMips64Shl:
       if (instr->InputAt(1)->IsRegister()) {
@@ -1375,6 +1315,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Dror(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMips64Tst:
+      __ And(kScratchReg, i.InputRegister(0), i.InputOperand(1));
       // Pseudo-instruction used for cmp/branch. No opcode emitted here.
       break;
     case kMips64Cmp:
@@ -1784,24 +1725,30 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     case kMips64Lbu:
       __ Lbu(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMips64Lb:
       __ Lb(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMips64Sb:
       __ Sb(i.InputOrZeroRegister(2), i.MemoryOperand());
       break;
     case kMips64Lhu:
       __ Lhu(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMips64Ulhu:
       __ Ulhu(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMips64Lh:
       __ Lh(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMips64Ulh:
       __ Ulh(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMips64Sh:
       __ Sh(i.InputOrZeroRegister(2), i.MemoryOperand());
@@ -1811,21 +1758,27 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     case kMips64Lw:
       __ Lw(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMips64Ulw:
       __ Ulw(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMips64Lwu:
       __ Lwu(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMips64Ulwu:
       __ Ulwu(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMips64Ld:
       __ Ld(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMips64Uld:
       __ Uld(i.OutputRegister(), i.MemoryOperand());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kMips64Sw:
       __ Sw(i.InputOrZeroRegister(2), i.MemoryOperand());
@@ -1901,7 +1854,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     case kMips64Peek: {
       // The incoming value is 0-based, but we need a 1-based value.
-      int reverse_slot = MiscField::decode(instr->opcode()) + 1;
+      int reverse_slot = i.InputInt32(0) + 1;
       int offset =
           FrameSlotToFPOffset(frame()->GetTotalFrameSlotCount() - reverse_slot);
       if (instr->OutputAt(0)->IsFPRegister()) {
@@ -1924,7 +1877,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64StoreToStackSlot: {
       if (instr->InputAt(0)->IsFPRegister()) {
-        __ Sdc1(i.InputDoubleRegister(0), MemOperand(sp, i.InputInt32(1)));
+        if (instr->InputAt(0)->IsSimd128Register()) {
+          CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+          __ st_b(i.InputSimd128Register(0), MemOperand(sp, i.InputInt32(1)));
+        } else {
+          __ Sdc1(i.InputDoubleRegister(0), MemOperand(sp, i.InputInt32(1)));
+        }
       } else {
         __ Sd(i.InputRegister(0), MemOperand(sp, i.InputInt32(1)));
       }
@@ -1939,75 +1897,75 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ dsrl32(i.OutputRegister(0), i.OutputRegister(0), 0);
       break;
     }
-    case kAtomicLoadInt8:
+    case kWord32AtomicLoadInt8:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(Lb);
       break;
-    case kAtomicLoadUint8:
+    case kWord32AtomicLoadUint8:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(Lbu);
       break;
-    case kAtomicLoadInt16:
+    case kWord32AtomicLoadInt16:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(Lh);
       break;
-    case kAtomicLoadUint16:
+    case kWord32AtomicLoadUint16:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(Lhu);
       break;
-    case kAtomicLoadWord32:
+    case kWord32AtomicLoadWord32:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(Lw);
       break;
-    case kAtomicStoreWord8:
+    case kWord32AtomicStoreWord8:
       ASSEMBLE_ATOMIC_STORE_INTEGER(Sb);
       break;
-    case kAtomicStoreWord16:
+    case kWord32AtomicStoreWord16:
       ASSEMBLE_ATOMIC_STORE_INTEGER(Sh);
       break;
-    case kAtomicStoreWord32:
+    case kWord32AtomicStoreWord32:
       ASSEMBLE_ATOMIC_STORE_INTEGER(Sw);
       break;
-    case kAtomicExchangeInt8:
+    case kWord32AtomicExchangeInt8:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER_EXT(true, 8);
       break;
-    case kAtomicExchangeUint8:
+    case kWord32AtomicExchangeUint8:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER_EXT(false, 8);
       break;
-    case kAtomicExchangeInt16:
+    case kWord32AtomicExchangeInt16:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER_EXT(true, 16);
       break;
-    case kAtomicExchangeUint16:
+    case kWord32AtomicExchangeUint16:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER_EXT(false, 16);
       break;
-    case kAtomicExchangeWord32:
+    case kWord32AtomicExchangeWord32:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER();
       break;
-    case kAtomicCompareExchangeInt8:
+    case kWord32AtomicCompareExchangeInt8:
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER_EXT(true, 8);
       break;
-    case kAtomicCompareExchangeUint8:
+    case kWord32AtomicCompareExchangeUint8:
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER_EXT(false, 8);
       break;
-    case kAtomicCompareExchangeInt16:
+    case kWord32AtomicCompareExchangeInt16:
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER_EXT(true, 16);
       break;
-    case kAtomicCompareExchangeUint16:
+    case kWord32AtomicCompareExchangeUint16:
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER_EXT(false, 16);
       break;
-    case kAtomicCompareExchangeWord32:
+    case kWord32AtomicCompareExchangeWord32:
       __ sll(i.InputRegister(2), i.InputRegister(2), 0);
       ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER();
       break;
 #define ATOMIC_BINOP_CASE(op, inst)             \
-  case kAtomic##op##Int8:                       \
+  case kWord32Atomic##op##Int8:                 \
     ASSEMBLE_ATOMIC_BINOP_EXT(true, 8, inst);   \
     break;                                      \
-  case kAtomic##op##Uint8:                      \
+  case kWord32Atomic##op##Uint8:                \
     ASSEMBLE_ATOMIC_BINOP_EXT(false, 8, inst);  \
     break;                                      \
-  case kAtomic##op##Int16:                      \
+  case kWord32Atomic##op##Int16:                \
     ASSEMBLE_ATOMIC_BINOP_EXT(true, 16, inst);  \
     break;                                      \
-  case kAtomic##op##Uint16:                     \
+  case kWord32Atomic##op##Uint16:               \
     ASSEMBLE_ATOMIC_BINOP_EXT(false, 16, inst); \
     break;                                      \
-  case kAtomic##op##Word32:                     \
+  case kWord32Atomic##op##Word32:               \
     ASSEMBLE_ATOMIC_BINOP(inst);                \
     break;
       ATOMIC_BINOP_CASE(Add, Addu)
@@ -3146,54 +3104,38 @@ void AssembleBranchToLabels(CodeGenerator* gen, TurboAssembler* tasm,
 
   if (instr->arch_opcode() == kMips64Tst) {
     cc = FlagsConditionToConditionTst(condition);
-    __ And(at, i.InputRegister(0), i.InputOperand(1));
-    __ Branch(tlabel, cc, at, Operand(zero_reg));
+    __ Branch(tlabel, cc, kScratchReg, Operand(zero_reg));
   } else if (instr->arch_opcode() == kMips64Dadd ||
              instr->arch_opcode() == kMips64Dsub) {
     cc = FlagsConditionToConditionOvf(condition);
     __ dsra32(kScratchReg, i.OutputRegister(), 0);
     __ sra(at, i.OutputRegister(), 31);
     __ Branch(tlabel, cc, at, Operand(kScratchReg));
-  } else if (instr->arch_opcode() == kMips64DaddOvf) {
+  } else if (instr->arch_opcode() == kMips64DaddOvf ||
+             instr->arch_opcode() == kMips64DsubOvf) {
     switch (condition) {
+      // Overflow occurs if overflow register is negative
       case kOverflow:
-        __ DaddBranchOvf(i.OutputRegister(), i.InputRegister(0),
-                         i.InputOperand(1), tlabel, flabel);
+        __ Branch(tlabel, lt, kScratchReg, Operand(zero_reg));
         break;
       case kNotOverflow:
-        __ DaddBranchOvf(i.OutputRegister(), i.InputRegister(0),
-                         i.InputOperand(1), flabel, tlabel);
+        __ Branch(tlabel, ge, kScratchReg, Operand(zero_reg));
         break;
       default:
-        UNSUPPORTED_COND(kMips64DaddOvf, condition);
+        UNSUPPORTED_COND(instr->arch_opcode(), condition);
         break;
     }
-  } else if (instr->arch_opcode() == kMips64DsubOvf) {
+  } else if (instr->arch_opcode() == kMips64MulOvf) {
+    // Overflow occurs if overflow register is not zero
     switch (condition) {
       case kOverflow:
-        __ DsubBranchOvf(i.OutputRegister(), i.InputRegister(0),
-                         i.InputOperand(1), tlabel, flabel);
+        __ Branch(tlabel, ne, kScratchReg, Operand(zero_reg));
         break;
       case kNotOverflow:
-        __ DsubBranchOvf(i.OutputRegister(), i.InputRegister(0),
-                         i.InputOperand(1), flabel, tlabel);
+        __ Branch(tlabel, eq, kScratchReg, Operand(zero_reg));
         break;
       default:
-        UNSUPPORTED_COND(kMips64DsubOvf, condition);
-        break;
-    }
-  } else if (instr->arch_opcode() == kMips64MulOvf) {
-    switch (condition) {
-      case kOverflow: {
-        __ MulBranchOvf(i.OutputRegister(), i.InputRegister(0),
-                        i.InputOperand(1), tlabel, flabel, kScratchReg);
-      } break;
-      case kNotOverflow: {
-        __ MulBranchOvf(i.OutputRegister(), i.InputRegister(0),
-                        i.InputOperand(1), flabel, tlabel, kScratchReg);
-      } break;
-      default:
-        UNSUPPORTED_COND(kMips64MulOvf, condition);
+        UNSUPPORTED_COND(kMipsMulOvf, condition);
         break;
     }
   } else if (instr->arch_opcode() == kMips64Cmp) {
@@ -3240,6 +3182,92 @@ void CodeGenerator::AssembleArchBranch(Instruction* instr, BranchInfo* branch) {
                          branch->fallthru);
 }
 
+void CodeGenerator::AssembleBranchPoisoning(FlagsCondition condition,
+                                            Instruction* instr) {
+  // TODO(jarin) Handle float comparisons (kUnordered[Not]Equal).
+  if (condition == kUnorderedEqual || condition == kUnorderedNotEqual) {
+    return;
+  }
+
+  MipsOperandConverter i(this, instr);
+  condition = NegateFlagsCondition(condition);
+
+  switch (instr->arch_opcode()) {
+    case kMips64Cmp: {
+      __ LoadZeroOnCondition(kSpeculationPoisonRegister, i.InputRegister(0),
+                             i.InputOperand(1),
+                             FlagsConditionToConditionCmp(condition));
+    }
+      return;
+    case kMips64Tst: {
+      switch (condition) {
+        case kEqual:
+          __ LoadZeroIfConditionZero(kSpeculationPoisonRegister, kScratchReg);
+          break;
+        case kNotEqual:
+          __ LoadZeroIfConditionNotZero(kSpeculationPoisonRegister,
+                                        kScratchReg);
+          break;
+        default:
+          UNREACHABLE();
+      }
+    }
+      return;
+    case kMips64Dadd:
+    case kMips64Dsub: {
+      // Check for overflow creates 1 or 0 for result.
+      __ dsrl32(kScratchReg, i.OutputRegister(), 31);
+      __ srl(at, i.OutputRegister(), 31);
+      __ xor_(at, kScratchReg, at);
+      switch (condition) {
+        case kOverflow:
+          __ LoadZeroIfConditionNotZero(kSpeculationPoisonRegister, at);
+          break;
+        case kNotOverflow:
+          __ LoadZeroIfConditionZero(kSpeculationPoisonRegister, at);
+          break;
+        default:
+          UNSUPPORTED_COND(instr->arch_opcode(), condition);
+      }
+    }
+      return;
+    case kMips64DaddOvf:
+    case kMips64DsubOvf: {
+      // Overflow occurs if overflow register is negative
+      __ Slt(kScratchReg2, kScratchReg, zero_reg);
+      switch (condition) {
+        case kOverflow:
+          __ LoadZeroIfConditionNotZero(kSpeculationPoisonRegister,
+                                        kScratchReg2);
+          break;
+        case kNotOverflow:
+          __ LoadZeroIfConditionZero(kSpeculationPoisonRegister, kScratchReg2);
+          break;
+        default:
+          UNSUPPORTED_COND(instr->arch_opcode(), condition);
+      }
+    }
+      return;
+    case kMips64MulOvf: {
+      // Overflow occurs if overflow register is not zero
+      switch (condition) {
+        case kOverflow:
+          __ LoadZeroIfConditionNotZero(kSpeculationPoisonRegister,
+                                        kScratchReg);
+          break;
+        case kNotOverflow:
+          __ LoadZeroIfConditionZero(kSpeculationPoisonRegister, kScratchReg);
+          break;
+        default:
+          UNSUPPORTED_COND(instr->arch_opcode(), condition);
+      }
+    }
+      return;
+    default:
+      break;
+  }
+}
+
 void CodeGenerator::AssembleArchDeoptBranch(Instruction* instr,
                                             BranchInfo* branch) {
   AssembleArchBranch(instr, branch);
@@ -3285,8 +3313,9 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                              tasm()->isolate()),
                          0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
-        CallDescriptor* descriptor = gen_->linkage()->GetIncomingDescriptor();
-        int pop_count = static_cast<int>(descriptor->StackParameterCount());
+        auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
+        int pop_count =
+            static_cast<int>(call_descriptor->StackParameterCount());
         pop_count += (pop_count & 1);  // align
         __ Drop(pop_count);
         __ Ret();
@@ -3331,21 +3360,10 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
 
   if (instr->arch_opcode() == kMips64Tst) {
     cc = FlagsConditionToConditionTst(condition);
-    if (instr->InputAt(1)->IsImmediate() &&
-        base::bits::IsPowerOfTwo(i.InputOperand(1).immediate())) {
-      uint16_t pos =
-          base::bits::CountTrailingZeros64(i.InputOperand(1).immediate());
-      __ Dext(result, i.InputRegister(0), pos, 1);
-      if (cc == eq) {
-        __ xori(result, result, 1);
-      }
+    if (cc == eq) {
+      __ Sltu(result, kScratchReg, 1);
     } else {
-      __ And(kScratchReg, i.InputRegister(0), i.InputOperand(1));
-      if (cc == eq) {
-        __ Sltu(result, kScratchReg, 1);
-      } else {
-        __ Sltu(result, zero_reg, kScratchReg);
-      }
+      __ Sltu(result, zero_reg, kScratchReg);
     }
     return;
   } else if (instr->arch_opcode() == kMips64Dadd ||
@@ -3359,32 +3377,12 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
       __ xori(result, result, 1);
     return;
   } else if (instr->arch_opcode() == kMips64DaddOvf ||
-             instr->arch_opcode() == kMips64DsubOvf ||
-             instr->arch_opcode() == kMips64MulOvf) {
-    Label flabel, tlabel;
-    switch (instr->arch_opcode()) {
-      case kMips64DaddOvf:
-        __ DaddBranchNoOvf(i.OutputRegister(), i.InputRegister(0),
-                           i.InputOperand(1), &flabel);
-
-        break;
-      case kMips64DsubOvf:
-        __ DsubBranchNoOvf(i.OutputRegister(), i.InputRegister(0),
-                           i.InputOperand(1), &flabel);
-        break;
-      case kMips64MulOvf:
-        __ MulBranchNoOvf(i.OutputRegister(), i.InputRegister(0),
-                          i.InputOperand(1), &flabel, kScratchReg);
-        break;
-      default:
-        UNREACHABLE();
-        break;
-    }
-    __ li(result, 1);
-    __ Branch(&tlabel);
-    __ bind(&flabel);
-    __ li(result, 0);
-    __ bind(&tlabel);
+             instr->arch_opcode() == kMips64DsubOvf) {
+    // Overflow occurs if overflow register is negative
+    __ slt(result, kScratchReg, zero_reg);
+  } else if (instr->arch_opcode() == kMips64MulOvf) {
+    // Overflow occurs if overflow register is not zero
+    __ Sgtu(result, kScratchReg, zero_reg);
   } else if (instr->arch_opcode() == kMips64Cmp) {
     cc = FlagsConditionToConditionCmp(condition);
     switch (cc) {
@@ -3523,9 +3521,8 @@ void CodeGenerator::AssembleArchLookupSwitch(Instruction* instr) {
   Register input = i.InputRegister(0);
   for (size_t index = 2; index < instr->InputCount(); index += 2) {
     __ li(at, Operand(i.InputInt32(index + 0)));
-    __ beq(input, at, GetLabel(i.InputRpo(index + 1)));
+    __ Branch(GetLabel(i.InputRpo(index + 1)), eq, input, Operand(at));
   }
-  __ nop();  // Branch delay slot of the last beq.
   AssembleArchJump(i.InputRpo(1));
 }
 
@@ -3541,9 +3538,9 @@ void CodeGenerator::AssembleArchTableSwitch(Instruction* instr) {
 }
 
 void CodeGenerator::FinishFrame(Frame* frame) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
 
-  const RegList saves_fpu = descriptor->CalleeSavedFPRegisters();
+  const RegList saves_fpu = call_descriptor->CalleeSavedFPRegisters();
   if (saves_fpu != 0) {
     int count = base::bits::CountPopulation(saves_fpu);
     DCHECK_EQ(kNumCalleeSavedFPU, count);
@@ -3551,7 +3548,7 @@ void CodeGenerator::FinishFrame(Frame* frame) {
                                             (kDoubleSize / kPointerSize));
   }
 
-  const RegList saves = descriptor->CalleeSavedRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     int count = base::bits::CountPopulation(saves);
     DCHECK_EQ(kNumCalleeSaved, count + 1);
@@ -3560,15 +3557,15 @@ void CodeGenerator::FinishFrame(Frame* frame) {
 }
 
 void CodeGenerator::AssembleConstructFrame() {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
 
   if (frame_access_state()->has_frame()) {
-    if (descriptor->IsCFunctionCall()) {
+    if (call_descriptor->IsCFunctionCall()) {
       __ Push(ra, fp);
       __ mov(fp, sp);
-    } else if (descriptor->IsJSFunctionCall()) {
+    } else if (call_descriptor->IsJSFunctionCall()) {
       __ Prologue();
-      if (descriptor->PushArgumentCount()) {
+      if (call_descriptor->PushArgumentCount()) {
         __ Push(kJavaScriptCallArgCountRegister);
       }
     } else {
@@ -3576,8 +3573,8 @@ void CodeGenerator::AssembleConstructFrame() {
     }
   }
 
-  int shrink_slots =
-      frame()->GetTotalFrameSlotCount() - descriptor->CalculateFixedFrameSize();
+  int shrink_slots = frame()->GetTotalFrameSlotCount() -
+                     call_descriptor->CalculateFixedFrameSize();
 
   if (info()->is_osr()) {
     // TurboFan OSR-compiled functions cannot be entered directly.
@@ -3590,10 +3587,11 @@ void CodeGenerator::AssembleConstructFrame() {
     if (FLAG_code_comments) __ RecordComment("-- OSR entrypoint --");
     osr_pc_offset_ = __ pc_offset();
     shrink_slots -= osr_helper()->UnoptimizedFrameSlots();
+    ResetSpeculationPoison();
   }
 
-  const RegList saves = descriptor->CalleeSavedRegisters();
-  const RegList saves_fpu = descriptor->CalleeSavedFPRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
+  const RegList saves_fpu = call_descriptor->CalleeSavedFPRegisters();
   const int returns = frame()->GetReturnSlotCount();
 
   // Skip callee-saved and return slots, which are pushed below.
@@ -3623,7 +3621,7 @@ void CodeGenerator::AssembleConstructFrame() {
 }
 
 void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
 
   const int returns = frame()->GetReturnSlotCount();
   if (returns != 0) {
@@ -3631,19 +3629,19 @@ void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
   }
 
   // Restore GP registers.
-  const RegList saves = descriptor->CalleeSavedRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     __ MultiPop(saves);
   }
 
   // Restore FPU registers.
-  const RegList saves_fpu = descriptor->CalleeSavedFPRegisters();
+  const RegList saves_fpu = call_descriptor->CalleeSavedFPRegisters();
   if (saves_fpu != 0) {
     __ MultiPopFPU(saves_fpu);
   }
 
   MipsOperandConverter g(this, nullptr);
-  if (descriptor->IsCFunctionCall()) {
+  if (call_descriptor->IsCFunctionCall()) {
     AssembleDeconstructFrame();
   } else if (frame_access_state()->has_frame()) {
     // Canonicalize JSFunction return sites for now unless they have an variable
@@ -3660,7 +3658,7 @@ void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
       AssembleDeconstructFrame();
     }
   }
-  int pop_count = static_cast<int>(descriptor->StackParameterCount());
+  int pop_count = static_cast<int>(call_descriptor->StackParameterCount());
   if (pop->IsImmediate()) {
     pop_count += g.ToConstant(pop).ToInt32();
   } else {
@@ -3707,11 +3705,7 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
           destination->IsRegister() ? g.ToRegister(destination) : kScratchReg;
       switch (src.type()) {
         case Constant::kInt32:
-          if (RelocInfo::IsWasmSizeReference(src.rmode())) {
-            __ li(dst, Operand(src.ToInt32(), src.rmode()));
-          } else {
-            __ li(dst, Operand(src.ToInt32()));
-          }
+          __ li(dst, Operand(src.ToInt32()));
           break;
         case Constant::kFloat32:
           __ li(dst, Operand::EmbeddedNumber(src.ToFloat32()));
@@ -3720,7 +3714,6 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
           if (RelocInfo::IsWasmPtrReference(src.rmode())) {
             __ li(dst, Operand(src.ToInt64(), src.rmode()));
           } else {
-            DCHECK(!RelocInfo::IsWasmSizeReference(src.rmode()));
             __ li(dst, Operand(src.ToInt64()));
           }
           break;
@@ -3770,23 +3763,50 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
       }
     }
   } else if (source->IsFPRegister()) {
-    FPURegister src = g.ToDoubleRegister(source);
-    if (destination->IsFPRegister()) {
-      FPURegister dst = g.ToDoubleRegister(destination);
-      __ Move(dst, src);
+    MachineRepresentation rep = LocationOperand::cast(source)->representation();
+    if (rep == MachineRepresentation::kSimd128) {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      MSARegister src = g.ToSimd128Register(source);
+      if (destination->IsSimd128Register()) {
+        MSARegister dst = g.ToSimd128Register(destination);
+        __ move_v(dst, src);
+      } else {
+        DCHECK(destination->IsSimd128StackSlot());
+        __ st_b(src, g.ToMemOperand(destination));
+      }
     } else {
-      DCHECK(destination->IsFPStackSlot());
-      __ Sdc1(src, g.ToMemOperand(destination));
+      FPURegister src = g.ToDoubleRegister(source);
+      if (destination->IsFPRegister()) {
+        FPURegister dst = g.ToDoubleRegister(destination);
+        __ Move(dst, src);
+      } else {
+        DCHECK(destination->IsFPStackSlot());
+        __ Sdc1(src, g.ToMemOperand(destination));
+      }
     }
   } else if (source->IsFPStackSlot()) {
     DCHECK(destination->IsFPRegister() || destination->IsFPStackSlot());
     MemOperand src = g.ToMemOperand(source);
-    if (destination->IsFPRegister()) {
-      __ Ldc1(g.ToDoubleRegister(destination), src);
+    MachineRepresentation rep = LocationOperand::cast(source)->representation();
+    if (rep == MachineRepresentation::kSimd128) {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      if (destination->IsSimd128Register()) {
+        __ ld_b(g.ToSimd128Register(destination), src);
+      } else {
+        DCHECK(destination->IsSimd128StackSlot());
+        MSARegister temp = kSimd128ScratchReg;
+        __ ld_b(temp, src);
+        __ st_b(temp, g.ToMemOperand(destination));
+      }
     } else {
-      FPURegister temp = kScratchDoubleReg;
-      __ Ldc1(temp, src);
-      __ Sdc1(temp, g.ToMemOperand(destination));
+      if (destination->IsFPRegister()) {
+        __ Ldc1(g.ToDoubleRegister(destination), src);
+      } else {
+        DCHECK(destination->IsFPStackSlot());
+        FPURegister temp = kScratchDoubleReg;
+        __ Ldc1(temp, src);
+        __ Sdc1(temp, g.ToMemOperand(destination));
+      }
     }
   } else {
     UNREACHABLE();
@@ -3826,34 +3846,73 @@ void CodeGenerator::AssembleSwap(InstructionOperand* source,
     __ Sd(temp_0, dst);
     __ Sd(temp_1, src);
   } else if (source->IsFPRegister()) {
-    FPURegister temp = kScratchDoubleReg;
-    FPURegister src = g.ToDoubleRegister(source);
-    if (destination->IsFPRegister()) {
-      FPURegister dst = g.ToDoubleRegister(destination);
-      __ Move(temp, src);
-      __ Move(src, dst);
-      __ Move(dst, temp);
+    MachineRepresentation rep = LocationOperand::cast(source)->representation();
+    if (rep == MachineRepresentation::kSimd128) {
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      MSARegister temp = kSimd128ScratchReg;
+      MSARegister src = g.ToSimd128Register(source);
+      if (destination->IsSimd128Register()) {
+        MSARegister dst = g.ToSimd128Register(destination);
+        __ move_v(temp, src);
+        __ move_v(src, dst);
+        __ move_v(dst, temp);
+      } else {
+        DCHECK(destination->IsSimd128StackSlot());
+        MemOperand dst = g.ToMemOperand(destination);
+        __ move_v(temp, src);
+        __ ld_b(src, dst);
+        __ st_b(temp, dst);
+      }
     } else {
-      DCHECK(destination->IsFPStackSlot());
-      MemOperand dst = g.ToMemOperand(destination);
-      __ Move(temp, src);
-      __ Ldc1(src, dst);
-      __ Sdc1(temp, dst);
+      FPURegister temp = kScratchDoubleReg;
+      FPURegister src = g.ToDoubleRegister(source);
+      if (destination->IsFPRegister()) {
+        FPURegister dst = g.ToDoubleRegister(destination);
+        __ Move(temp, src);
+        __ Move(src, dst);
+        __ Move(dst, temp);
+      } else {
+        DCHECK(destination->IsFPStackSlot());
+        MemOperand dst = g.ToMemOperand(destination);
+        __ Move(temp, src);
+        __ Ldc1(src, dst);
+        __ Sdc1(temp, dst);
+      }
     }
   } else if (source->IsFPStackSlot()) {
     DCHECK(destination->IsFPStackSlot());
     Register temp_0 = kScratchReg;
-    FPURegister temp_1 = kScratchDoubleReg;
     MemOperand src0 = g.ToMemOperand(source);
     MemOperand src1(src0.rm(), src0.offset() + kIntSize);
     MemOperand dst0 = g.ToMemOperand(destination);
     MemOperand dst1(dst0.rm(), dst0.offset() + kIntSize);
-    __ Ldc1(temp_1, dst0);  // Save destination in temp_1.
-    __ Lw(temp_0, src0);    // Then use temp_0 to copy source to destination.
-    __ Sw(temp_0, dst0);
-    __ Lw(temp_0, src1);
-    __ Sw(temp_0, dst1);
-    __ Sdc1(temp_1, src0);
+    MachineRepresentation rep = LocationOperand::cast(source)->representation();
+    if (rep == MachineRepresentation::kSimd128) {
+      MemOperand src2(src0.rm(), src0.offset() + 2 * kIntSize);
+      MemOperand src3(src0.rm(), src0.offset() + 3 * kIntSize);
+      MemOperand dst2(dst0.rm(), dst0.offset() + 2 * kIntSize);
+      MemOperand dst3(dst0.rm(), dst0.offset() + 3 * kIntSize);
+      CpuFeatureScope msa_scope(tasm(), MIPS_SIMD);
+      MSARegister temp_1 = kSimd128ScratchReg;
+      __ ld_b(temp_1, dst0);  // Save destination in temp_1.
+      __ Lw(temp_0, src0);    // Then use temp_0 to copy source to destination.
+      __ Sw(temp_0, dst0);
+      __ Lw(temp_0, src1);
+      __ Sw(temp_0, dst1);
+      __ Lw(temp_0, src2);
+      __ Sw(temp_0, dst2);
+      __ Lw(temp_0, src3);
+      __ Sw(temp_0, dst3);
+      __ st_b(temp_1, src0);
+    } else {
+      FPURegister temp_1 = kScratchDoubleReg;
+      __ Ldc1(temp_1, dst0);  // Save destination in temp_1.
+      __ Lw(temp_0, src0);    // Then use temp_0 to copy source to destination.
+      __ Sw(temp_0, dst0);
+      __ Lw(temp_0, src1);
+      __ Sw(temp_0, dst1);
+      __ Sdc1(temp_1, src0);
+    }
   } else {
     // No other combinations are possible.
     UNREACHABLE();
@@ -3866,7 +3925,6 @@ void CodeGenerator::AssembleJumpTable(Label** targets, size_t target_count) {
   UNREACHABLE();
 }
 
-
 #undef __
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/mips64/instruction-codes-mips64.h b/deps/v8/src/compiler/mips64/instruction-codes-mips64.h
index 3058812bec7..a50d2940131 100644
--- a/deps/v8/src/compiler/mips64/instruction-codes-mips64.h
+++ b/deps/v8/src/compiler/mips64/instruction-codes-mips64.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_COMPILER_MIPS_INSTRUCTION_CODES_MIPS_H_
-#define V8_COMPILER_MIPS_INSTRUCTION_CODES_MIPS_H_
+#ifndef V8_COMPILER_MIPS64_INSTRUCTION_CODES_MIPS64_H_
+#define V8_COMPILER_MIPS64_INSTRUCTION_CODES_MIPS64_H_
 
 namespace v8 {
 namespace internal {
@@ -331,4 +331,4 @@ namespace compiler {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_COMPILER_MIPS_INSTRUCTION_CODES_MIPS_H_
+#endif  // V8_COMPILER_MIPS64_INSTRUCTION_CODES_MIPS64_H_
diff --git a/deps/v8/src/compiler/mips64/instruction-selector-mips64.cc b/deps/v8/src/compiler/mips64/instruction-selector-mips64.cc
index 38f077c4e61..fab7be26258 100644
--- a/deps/v8/src/compiler/mips64/instruction-selector-mips64.cc
+++ b/deps/v8/src/compiler/mips64/instruction-selector-mips64.cc
@@ -49,10 +49,10 @@ class Mips64OperandGenerator final : public OperandGenerator {
 
   int64_t GetIntegerConstantValue(Node* node) {
     if (node->opcode() == IrOpcode::kInt32Constant) {
-      return OpParameter<int32_t>(node);
+      return OpParameter<int32_t>(node->op());
     }
     DCHECK_EQ(IrOpcode::kInt64Constant, node->opcode());
-    return OpParameter<int64_t>(node);
+    return OpParameter<int64_t>(node->op());
   }
 
   bool IsFloatConstant(Node* node) {
@@ -62,10 +62,10 @@ class Mips64OperandGenerator final : public OperandGenerator {
 
   double GetFloatConstantValue(Node* node) {
     if (node->opcode() == IrOpcode::kFloat32Constant) {
-      return OpParameter<float>(node);
+      return OpParameter<float>(node->op());
     }
     DCHECK_EQ(IrOpcode::kFloat64Constant, node->opcode());
-    return OpParameter<double>(node);
+    return OpParameter<double>(node->op());
   }
 
   bool CanBeImmediate(Node* node, InstructionCode mode) {
@@ -130,7 +130,7 @@ static void VisitRR(InstructionSelector* selector, ArchOpcode opcode,
 static void VisitRRI(InstructionSelector* selector, ArchOpcode opcode,
                      Node* node) {
   Mips64OperandGenerator g(selector);
-  int32_t imm = OpParameter<int32_t>(node);
+  int32_t imm = OpParameter<int32_t>(node->op());
   selector->Emit(opcode, g.DefineAsRegister(node),
                  g.UseRegister(node->InputAt(0)), g.UseImmediate(imm));
 }
@@ -138,7 +138,7 @@ static void VisitRRI(InstructionSelector* selector, ArchOpcode opcode,
 static void VisitRRIR(InstructionSelector* selector, ArchOpcode opcode,
                       Node* node) {
   Mips64OperandGenerator g(selector);
-  int32_t imm = OpParameter<int32_t>(node);
+  int32_t imm = OpParameter<int32_t>(node->op());
   selector->Emit(opcode, g.DefineAsRegister(node),
                  g.UseRegister(node->InputAt(0)), g.UseImmediate(imm),
                  g.UseRegister(node->InputAt(1)));
@@ -268,9 +268,9 @@ static void VisitBinop(InstructionSelector* selector, Node* node,
                        FlagsContinuation* cont) {
   Mips64OperandGenerator g(selector);
   Int32BinopMatcher m(node);
-  InstructionOperand inputs[4];
+  InstructionOperand inputs[2];
   size_t input_count = 0;
-  InstructionOperand outputs[2];
+  InstructionOperand outputs[1];
   size_t output_count = 0;
 
   if (TryMatchImmediate(selector, &opcode, m.right().node(), &input_count,
@@ -288,13 +288,6 @@ static void VisitBinop(InstructionSelector* selector, Node* node,
     inputs[input_count++] = g.UseOperand(m.right().node(), opcode);
   }
 
-  if (cont->IsBranch()) {
-    inputs[input_count++] = g.Label(cont->true_block());
-    inputs[input_count++] = g.Label(cont->false_block());
-  } else if (cont->IsTrap()) {
-    inputs[input_count++] = g.TempImmediate(cont->trap_id());
-  }
-
   if (cont->IsDeoptimize()) {
     // If we can deoptimize as a result of the binop, we need to make sure that
     // the deopt inputs are not overwritten by the binop result. One way
@@ -303,23 +296,14 @@ static void VisitBinop(InstructionSelector* selector, Node* node,
   } else {
     outputs[output_count++] = g.DefineAsRegister(node);
   }
-  if (cont->IsSet()) {
-    outputs[output_count++] = g.DefineAsRegister(cont->result());
-  }
 
   DCHECK_NE(0u, input_count);
-  DCHECK_NE(0u, output_count);
+  DCHECK_EQ(1u, output_count);
   DCHECK_GE(arraysize(inputs), input_count);
   DCHECK_GE(arraysize(outputs), output_count);
 
-  opcode = cont->Encode(opcode);
-  if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, output_count, outputs, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else {
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, output_count, outputs, input_count,
+                                 inputs, cont);
 }
 
 static void VisitBinop(InstructionSelector* selector, Node* node,
@@ -379,7 +363,7 @@ void EmitLoad(InstructionSelector* selector, Node* node, InstructionCode opcode,
 void InstructionSelector::VisitLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
 
-  ArchOpcode opcode = kArchNop;
+  InstructionCode opcode = kArchNop;
   switch (load_rep.representation()) {
     case MachineRepresentation::kFloat32:
       opcode = kMips64Lwc1;
@@ -410,10 +394,16 @@ void InstructionSelector::VisitLoad(Node* node) {
       UNREACHABLE();
       return;
   }
+  if (node->opcode() == IrOpcode::kPoisonedLoad) {
+    CHECK_EQ(poisoning_enabled_, PoisoningMitigationLevel::kOn);
+    opcode |= MiscField::encode(kMemoryAccessPoisoned);
+  }
 
   EmitLoad(this, node, opcode);
 }
 
+void InstructionSelector::VisitPoisonedLoad(Node* node) { VisitLoad(node); }
+
 void InstructionSelector::VisitProtectedLoad(Node* node) {
   // TODO(eholk)
   UNIMPLEMENTED();
@@ -1382,6 +1372,7 @@ void InstructionSelector::VisitChangeUint32ToUint64(Node* node) {
             break;
         }
       }
+      break;
     }
     default:
       break;
@@ -1650,14 +1641,14 @@ void InstructionSelector::VisitFloat64Ieee754Unop(Node* node,
 }
 
 void InstructionSelector::EmitPrepareArguments(
-    ZoneVector<PushParameter>* arguments, const CallDescriptor* descriptor,
+    ZoneVector<PushParameter>* arguments, const CallDescriptor* call_descriptor,
     Node* node) {
   Mips64OperandGenerator g(this);
 
   // Prepare for C function call.
-  if (descriptor->IsCFunctionCall()) {
-    Emit(kArchPrepareCallCFunction |
-             MiscField::encode(static_cast<int>(descriptor->ParameterCount())),
+  if (call_descriptor->IsCFunctionCall()) {
+    Emit(kArchPrepareCallCFunction | MiscField::encode(static_cast<int>(
+                                         call_descriptor->ParameterCount())),
          0, nullptr, 0, nullptr);
 
     // Poke any stack arguments.
@@ -1668,10 +1659,17 @@ void InstructionSelector::EmitPrepareArguments(
       ++slot;
     }
   } else {
-    int push_count = static_cast<int>(descriptor->StackParameterCount());
+    int push_count = static_cast<int>(call_descriptor->StackParameterCount());
     if (push_count > 0) {
+      // Calculate needed space
+      int stack_size = 0;
+      for (PushParameter input : (*arguments)) {
+        if (input.node) {
+          stack_size += input.location.GetSizeInPointers();
+        }
+      }
       Emit(kMips64StackClaim, g.NoOutput(),
-           g.TempImmediate(push_count << kPointerSizeLog2));
+           g.TempImmediate(stack_size << kPointerSizeLog2));
     }
     for (size_t n = 0; n < arguments->size(); ++n) {
       PushParameter input = (*arguments)[n];
@@ -1683,9 +1681,9 @@ void InstructionSelector::EmitPrepareArguments(
   }
 }
 
-void InstructionSelector::EmitPrepareResults(ZoneVector<PushParameter>* results,
-                                             const CallDescriptor* descriptor,
-                                             Node* node) {
+void InstructionSelector::EmitPrepareResults(
+    ZoneVector<PushParameter>* results, const CallDescriptor* call_descriptor,
+    Node* node) {
   Mips64OperandGenerator g(this);
 
   int reverse_slot = 0;
@@ -1693,14 +1691,14 @@ void InstructionSelector::EmitPrepareResults(ZoneVector<PushParameter>* results,
     if (!output.location.IsCallerFrameSlot()) continue;
     // Skip any alignment holes in nodes.
     if (output.node != nullptr) {
-      DCHECK(!descriptor->IsCFunctionCall());
+      DCHECK(!call_descriptor->IsCFunctionCall());
       if (output.location.GetType() == MachineType::Float32()) {
         MarkAsFloat32(output.node);
       } else if (output.location.GetType() == MachineType::Float64()) {
         MarkAsFloat64(output.node);
       }
-      InstructionOperand result = g.DefineAsRegister(output.node);
-      Emit(kMips64Peek | MiscField::encode(reverse_slot), result);
+      Emit(kMips64Peek, g.DefineAsRegister(output.node),
+           g.UseImmediate(reverse_slot));
     }
     reverse_slot += output.location.GetSizeInPointers();
   }
@@ -1711,8 +1709,7 @@ bool InstructionSelector::IsTailCallAddressImmediate() { return false; }
 int InstructionSelector::GetTempsCountForTailCallFromJSFunction() { return 3; }
 
 void InstructionSelector::VisitUnalignedLoad(Node* node) {
-  UnalignedLoadRepresentation load_rep =
-      UnalignedLoadRepresentationOf(node->op());
+  LoadRepresentation load_rep = LoadRepresentationOf(node->op());
   Mips64OperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -1821,22 +1818,7 @@ namespace {
 static void VisitCompare(InstructionSelector* selector, InstructionCode opcode,
                          InstructionOperand left, InstructionOperand right,
                          FlagsContinuation* cont) {
-  Mips64OperandGenerator g(selector);
-  opcode = cont->Encode(opcode);
-  if (cont->IsBranch()) {
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.Label(cont->true_block()), g.Label(cont->false_block()));
-  } else if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, g.NoOutput(), left, right, cont->kind(),
-                             cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsSet()) {
-    selector->Emit(opcode, g.DefineAsRegister(cont->result()), left, right);
-  } else {
-    DCHECK(cont->IsTrap());
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.TempImmediate(cont->trap_id()));
-  }
+  selector->EmitWithContinuation(opcode, left, right, cont);
 }
 
 
@@ -1949,8 +1931,7 @@ bool IsNodeUnsigned(Node* n) {
     LoadRepresentation load_rep = LoadRepresentationOf(n->op());
     return load_rep.IsUnsigned();
   } else if (m.IsUnalignedLoad()) {
-    UnalignedLoadRepresentation load_rep =
-        UnalignedLoadRepresentationOf(n->op());
+    LoadRepresentation load_rep = LoadRepresentationOf(n->op());
     return load_rep.IsUnsigned();
   } else {
     return m.IsUint32Div() || m.IsUint32LessThan() ||
@@ -2039,30 +2020,17 @@ void VisitWord64Compare(InstructionSelector* selector, Node* node,
 void EmitWordCompareZero(InstructionSelector* selector, Node* value,
                          FlagsContinuation* cont) {
   Mips64OperandGenerator g(selector);
-  InstructionCode opcode = cont->Encode(kMips64Cmp);
-  InstructionOperand const value_operand = g.UseRegister(value);
-  if (cont->IsBranch()) {
-    selector->Emit(opcode, g.NoOutput(), value_operand, g.TempImmediate(0),
-                   g.Label(cont->true_block()), g.Label(cont->false_block()));
-  } else if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, g.NoOutput(), value_operand,
-                             g.TempImmediate(0), cont->kind(), cont->reason(),
-                             cont->feedback(), cont->frame_state());
-  } else if (cont->IsTrap()) {
-    selector->Emit(opcode, g.NoOutput(), value_operand, g.TempImmediate(0),
-                   g.TempImmediate(cont->trap_id()));
-  } else {
-    selector->Emit(opcode, g.DefineAsRegister(cont->result()), value_operand,
-                   g.TempImmediate(0));
-  }
+  selector->EmitWithContinuation(kMips64Cmp, g.UseRegister(value),
+                                 g.TempImmediate(0), cont);
 }
 
+}  // namespace
 
 // Shared routine for word comparisons against zero.
-void VisitWordCompareZero(InstructionSelector* selector, Node* user,
-                          Node* value, FlagsContinuation* cont) {
+void InstructionSelector::VisitWordCompareZero(Node* user, Node* value,
+                                               FlagsContinuation* cont) {
   // Try to combine with comparisons against 0 by simply inverting the branch.
-  while (selector->CanCover(user, value)) {
+  while (CanCover(user, value)) {
     if (value->opcode() == IrOpcode::kWord32Equal) {
       Int32BinopMatcher m(value);
       if (!m.right().Is(0)) break;
@@ -2080,56 +2048,56 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
     cont->Negate();
   }
 
-  if (selector->CanCover(user, value)) {
+  if (CanCover(user, value)) {
     switch (value->opcode()) {
       case IrOpcode::kWord32Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kInt32LessThan:
         cont->OverwriteAndNegateIfEqual(kSignedLessThan);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kInt32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kSignedLessThanOrEqual);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kUint32LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kUint32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kWord64Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kInt64LessThan:
         cont->OverwriteAndNegateIfEqual(kSignedLessThan);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kInt64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kSignedLessThanOrEqual);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kUint64LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kUint64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kFloat32Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat64Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kProjection:
         // Check if this is the overflow output projection of an
         // <Operation>WithOverflow node.
@@ -2141,23 +2109,23 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
           // *AFTER* this branch).
           Node* const node = value->InputAt(0);
           Node* const result = NodeProperties::FindProjection(node, 0);
-          if (result == nullptr || selector->IsDefined(result)) {
+          if (result == nullptr || IsDefined(result)) {
             switch (node->opcode()) {
               case IrOpcode::kInt32AddWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kMips64Dadd, cont);
+                return VisitBinop(this, node, kMips64Dadd, cont);
               case IrOpcode::kInt32SubWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kMips64Dsub, cont);
+                return VisitBinop(this, node, kMips64Dsub, cont);
               case IrOpcode::kInt32MulWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kMips64MulOvf, cont);
+                return VisitBinop(this, node, kMips64MulOvf, cont);
               case IrOpcode::kInt64AddWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kMips64DaddOvf, cont);
+                return VisitBinop(this, node, kMips64DaddOvf, cont);
               case IrOpcode::kInt64SubWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kMips64DsubOvf, cont);
+                return VisitBinop(this, node, kMips64DsubOvf, cont);
               default:
                 break;
             }
@@ -2166,49 +2134,14 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
         break;
       case IrOpcode::kWord32And:
       case IrOpcode::kWord64And:
-        return VisitWordCompare(selector, value, kMips64Tst, cont, true);
+        return VisitWordCompare(this, value, kMips64Tst, cont, true);
       default:
         break;
     }
   }
 
   // Continuation could not be combined with a compare, emit compare against 0.
-  EmitWordCompareZero(selector, value, cont);
-}
-
-}  // namespace
-
-void InstructionSelector::VisitBranch(Node* branch, BasicBlock* tbranch,
-                                      BasicBlock* fbranch) {
-  FlagsContinuation cont(kNotEqual, tbranch, fbranch);
-  VisitWordCompareZero(this, branch, branch->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeIf(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kNotEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeUnless(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapIf(Node* node, Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kNotEqual, func_id, node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapUnless(Node* node,
-                                          Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kEqual, func_id, node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
+  EmitWordCompareZero(this, value, cont);
 }
 
 void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
@@ -2216,24 +2149,26 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
   InstructionOperand value_operand = g.UseRegister(node->InputAt(0));
 
   // Emit either ArchTableSwitch or ArchLookupSwitch.
-  static const size_t kMaxTableSwitchValueRange = 2 << 16;
-  size_t table_space_cost = 10 + 2 * sw.value_range;
-  size_t table_time_cost = 3;
-  size_t lookup_space_cost = 2 + 2 * sw.case_count;
-  size_t lookup_time_cost = sw.case_count;
-  if (sw.case_count > 0 &&
-      table_space_cost + 3 * table_time_cost <=
-          lookup_space_cost + 3 * lookup_time_cost &&
-      sw.min_value > std::numeric_limits<int32_t>::min() &&
-      sw.value_range <= kMaxTableSwitchValueRange) {
-    InstructionOperand index_operand = value_operand;
-    if (sw.min_value) {
-      index_operand = g.TempRegister();
-      Emit(kMips64Sub, index_operand, value_operand,
-           g.TempImmediate(sw.min_value));
+  if (enable_switch_jump_table_ == kEnableSwitchJumpTable) {
+    static const size_t kMaxTableSwitchValueRange = 2 << 16;
+    size_t table_space_cost = 10 + 2 * sw.value_range();
+    size_t table_time_cost = 3;
+    size_t lookup_space_cost = 2 + 2 * sw.case_count();
+    size_t lookup_time_cost = sw.case_count();
+    if (sw.case_count() > 0 &&
+        table_space_cost + 3 * table_time_cost <=
+            lookup_space_cost + 3 * lookup_time_cost &&
+        sw.min_value() > std::numeric_limits<int32_t>::min() &&
+        sw.value_range() <= kMaxTableSwitchValueRange) {
+      InstructionOperand index_operand = value_operand;
+      if (sw.min_value()) {
+        index_operand = g.TempRegister();
+        Emit(kMips64Sub, index_operand, value_operand,
+             g.TempImmediate(sw.min_value()));
+      }
+      // Generate a table lookup.
+      return EmitTableSwitch(sw, index_operand);
     }
-    // Generate a table lookup.
-    return EmitTableSwitch(sw, index_operand);
   }
 
   // Generate a sequence of conditional jumps.
@@ -2245,7 +2180,7 @@ void InstructionSelector::VisitWord32Equal(Node* const node) {
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
   Int32BinopMatcher m(node);
   if (m.right().Is(0)) {
-    return VisitWordCompareZero(this, m.node(), m.left().node(), &cont);
+    return VisitWordCompareZero(m.node(), m.left().node(), &cont);
   }
 
   VisitWord32Compare(this, node, &cont);
@@ -2330,7 +2265,7 @@ void InstructionSelector::VisitWord64Equal(Node* const node) {
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
   Int64BinopMatcher m(node);
   if (m.right().Is(0)) {
-    return VisitWordCompareZero(this, m.node(), m.left().node(), &cont);
+    return VisitWordCompareZero(m.node(), m.left().node(), &cont);
   }
 
   VisitWord64Compare(this, node, &cont);
@@ -2431,7 +2366,7 @@ void InstructionSelector::VisitFloat64InsertHighWord32(Node* node) {
        g.UseRegister(left), g.UseRegister(right));
 }
 
-void InstructionSelector::VisitAtomicLoad(Node* node) {
+void InstructionSelector::VisitWord32AtomicLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
   Mips64OperandGenerator g(this);
   Node* base = node->InputAt(0);
@@ -2439,13 +2374,15 @@ void InstructionSelector::VisitAtomicLoad(Node* node) {
   ArchOpcode opcode = kArchNop;
   switch (load_rep.representation()) {
     case MachineRepresentation::kWord8:
-      opcode = load_rep.IsSigned() ? kAtomicLoadInt8 : kAtomicLoadUint8;
+      opcode =
+          load_rep.IsSigned() ? kWord32AtomicLoadInt8 : kWord32AtomicLoadUint8;
       break;
     case MachineRepresentation::kWord16:
-      opcode = load_rep.IsSigned() ? kAtomicLoadInt16 : kAtomicLoadUint16;
+      opcode = load_rep.IsSigned() ? kWord32AtomicLoadInt16
+                                   : kWord32AtomicLoadUint16;
       break;
     case MachineRepresentation::kWord32:
-      opcode = kAtomicLoadWord32;
+      opcode = kWord32AtomicLoadWord32;
       break;
     default:
       UNREACHABLE();
@@ -2464,7 +2401,7 @@ void InstructionSelector::VisitAtomicLoad(Node* node) {
   }
 }
 
-void InstructionSelector::VisitAtomicStore(Node* node) {
+void InstructionSelector::VisitWord32AtomicStore(Node* node) {
   MachineRepresentation rep = AtomicStoreRepresentationOf(node->op());
   Mips64OperandGenerator g(this);
   Node* base = node->InputAt(0);
@@ -2473,13 +2410,13 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
   ArchOpcode opcode = kArchNop;
   switch (rep) {
     case MachineRepresentation::kWord8:
-      opcode = kAtomicStoreWord8;
+      opcode = kWord32AtomicStoreWord8;
       break;
     case MachineRepresentation::kWord16:
-      opcode = kAtomicStoreWord16;
+      opcode = kWord32AtomicStoreWord16;
       break;
     case MachineRepresentation::kWord32:
-      opcode = kAtomicStoreWord32;
+      opcode = kWord32AtomicStoreWord32;
       break;
     default:
       UNREACHABLE();
@@ -2500,7 +2437,7 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
   }
 }
 
-void InstructionSelector::VisitAtomicExchange(Node* node) {
+void InstructionSelector::VisitWord32AtomicExchange(Node* node) {
   Mips64OperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -2508,15 +2445,15 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   ArchOpcode opcode = kArchNop;
   MachineType type = AtomicOpRepresentationOf(node->op());
   if (type == MachineType::Int8()) {
-    opcode = kAtomicExchangeInt8;
+    opcode = kWord32AtomicExchangeInt8;
   } else if (type == MachineType::Uint8()) {
-    opcode = kAtomicExchangeUint8;
+    opcode = kWord32AtomicExchangeUint8;
   } else if (type == MachineType::Int16()) {
-    opcode = kAtomicExchangeInt16;
+    opcode = kWord32AtomicExchangeInt16;
   } else if (type == MachineType::Uint16()) {
-    opcode = kAtomicExchangeUint16;
+    opcode = kWord32AtomicExchangeUint16;
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
-    opcode = kAtomicExchangeWord32;
+    opcode = kWord32AtomicExchangeWord32;
   } else {
     UNREACHABLE();
     return;
@@ -2538,7 +2475,7 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   Emit(code, 1, outputs, input_count, inputs, 3, temp);
 }
 
-void InstructionSelector::VisitAtomicCompareExchange(Node* node) {
+void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
   Mips64OperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -2547,15 +2484,15 @@ void InstructionSelector::VisitAtomicCompareExchange(Node* node) {
   ArchOpcode opcode = kArchNop;
   MachineType type = AtomicOpRepresentationOf(node->op());
   if (type == MachineType::Int8()) {
-    opcode = kAtomicCompareExchangeInt8;
+    opcode = kWord32AtomicCompareExchangeInt8;
   } else if (type == MachineType::Uint8()) {
-    opcode = kAtomicCompareExchangeUint8;
+    opcode = kWord32AtomicCompareExchangeUint8;
   } else if (type == MachineType::Int16()) {
-    opcode = kAtomicCompareExchangeInt16;
+    opcode = kWord32AtomicCompareExchangeInt16;
   } else if (type == MachineType::Uint16()) {
-    opcode = kAtomicCompareExchangeUint16;
+    opcode = kWord32AtomicCompareExchangeUint16;
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
-    opcode = kAtomicCompareExchangeWord32;
+    opcode = kWord32AtomicCompareExchangeWord32;
   } else {
     UNREACHABLE();
     return;
@@ -2619,11 +2556,12 @@ void InstructionSelector::VisitAtomicBinaryOperation(
   Emit(code, 1, outputs, input_count, inputs, 4, temps);
 }
 
-#define VISIT_ATOMIC_BINOP(op)                                              \
-  void InstructionSelector::VisitAtomic##op(Node* node) {                   \
-    VisitAtomicBinaryOperation(node, kAtomic##op##Int8, kAtomic##op##Uint8, \
-                               kAtomic##op##Int16, kAtomic##op##Uint16,     \
-                               kAtomic##op##Word32);                        \
+#define VISIT_ATOMIC_BINOP(op)                                   \
+  void InstructionSelector::VisitWord32Atomic##op(Node* node) {  \
+    VisitAtomicBinaryOperation(                                  \
+        node, kWord32Atomic##op##Int8, kWord32Atomic##op##Uint8, \
+        kWord32Atomic##op##Int16, kWord32Atomic##op##Uint16,     \
+        kWord32Atomic##op##Word32);                              \
   }
 VISIT_ATOMIC_BINOP(Add)
 VISIT_ATOMIC_BINOP(Sub)
@@ -2648,12 +2586,6 @@ void InstructionSelector::VisitSpeculationFence(Node* node) { UNREACHABLE(); }
   V(I16x8)                \
   V(I8x16)
 
-// TODO(mostynb@opera.com): this is never used, remove it?
-#define SIMD_FORMAT_LIST(V) \
-  V(32x4)                   \
-  V(16x8)                   \
-  V(8x16)
-
 #define SIMD_UNOP_LIST(V)                                  \
   V(F32x4SConvertI32x4, kMips64F32x4SConvertI32x4)         \
   V(F32x4UConvertI32x4, kMips64F32x4UConvertI32x4)         \
@@ -2890,7 +2822,7 @@ bool TryMatchArchShuffle(const uint8_t* shuffle, const ShuffleEntry* table,
 }  // namespace
 
 void InstructionSelector::VisitS8x16Shuffle(Node* node) {
-  const uint8_t* shuffle = OpParameter<uint8_t*>(node);
+  const uint8_t* shuffle = OpParameter<uint8_t*>(node->op());
   uint8_t mask = CanonicalizeShuffle(node);
   uint8_t shuffle32x4[4];
   ArchOpcode opcode;
@@ -2921,6 +2853,32 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
        g.UseImmediate(Pack4Lanes(shuffle + 12, mask)));
 }
 
+void InstructionSelector::VisitSignExtendWord8ToInt32(Node* node) {
+  Mips64OperandGenerator g(this);
+  Emit(kMips64Seb, g.DefineAsRegister(node), g.UseRegister(node->InputAt(0)));
+}
+
+void InstructionSelector::VisitSignExtendWord16ToInt32(Node* node) {
+  Mips64OperandGenerator g(this);
+  Emit(kMips64Seh, g.DefineAsRegister(node), g.UseRegister(node->InputAt(0)));
+}
+
+void InstructionSelector::VisitSignExtendWord8ToInt64(Node* node) {
+  Mips64OperandGenerator g(this);
+  Emit(kMips64Seb, g.DefineAsRegister(node), g.UseRegister(node->InputAt(0)));
+}
+
+void InstructionSelector::VisitSignExtendWord16ToInt64(Node* node) {
+  Mips64OperandGenerator g(this);
+  Emit(kMips64Seh, g.DefineAsRegister(node), g.UseRegister(node->InputAt(0)));
+}
+
+void InstructionSelector::VisitSignExtendWord32ToInt64(Node* node) {
+  Mips64OperandGenerator g(this);
+  Emit(kMips64Shl, g.DefineAsRegister(node), g.UseRegister(node->InputAt(0)),
+       g.TempImmediate(0));
+}
+
 // static
 MachineOperatorBuilder::Flags
 InstructionSelector::SupportedMachineOperatorFlags() {
@@ -2960,7 +2918,6 @@ InstructionSelector::AlignmentRequirements() {
 #undef SIMD_BINOP_LIST
 #undef SIMD_SHIFT_OP_LIST
 #undef SIMD_UNOP_LIST
-#undef SIMD_FORMAT_LIST
 #undef SIMD_TYPE_LIST
 #undef TRACE_UNIMPL
 #undef TRACE
diff --git a/deps/v8/src/compiler/move-optimizer.h b/deps/v8/src/compiler/move-optimizer.h
index 7c132ab1538..c78da1e5178 100644
--- a/deps/v8/src/compiler/move-optimizer.h
+++ b/deps/v8/src/compiler/move-optimizer.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_COMPILER_MOVE_OPTIMIZER_
-#define V8_COMPILER_MOVE_OPTIMIZER_
+#ifndef V8_COMPILER_MOVE_OPTIMIZER_H_
+#define V8_COMPILER_MOVE_OPTIMIZER_H_
 
 #include "src/compiler/instruction.h"
 #include "src/globals.h"
@@ -65,4 +65,4 @@ class V8_EXPORT_PRIVATE MoveOptimizer final {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_COMPILER_MOVE_OPTIMIZER_
+#endif  // V8_COMPILER_MOVE_OPTIMIZER_H_
diff --git a/deps/v8/src/compiler/node-aux-data.h b/deps/v8/src/compiler/node-aux-data.h
index 277ff18034e..c395475109d 100644
--- a/deps/v8/src/compiler/node-aux-data.h
+++ b/deps/v8/src/compiler/node-aux-data.h
@@ -15,15 +15,27 @@ namespace compiler {
 // Forward declarations.
 class Node;
 
-template <class T, T def()>
+template <class T>
+T DefaultConstruct() {
+  return T();
+}
+
+template <class T, T def() = DefaultConstruct<T>>
 class NodeAuxData {
  public:
   explicit NodeAuxData(Zone* zone) : aux_data_(zone) {}
+  explicit NodeAuxData(size_t initial_size, Zone* zone)
+      : aux_data_(initial_size, zone) {}
 
-  void Set(Node* node, T const& data) {
+  // Update entry. Returns true iff entry was changed.
+  bool Set(Node* node, T const& data) {
     size_t const id = node->id();
     if (id >= aux_data_.size()) aux_data_.resize(id + 1, def());
-    aux_data_[id] = data;
+    if (aux_data_[id] != data) {
+      aux_data_[id] = data;
+      return true;
+    }
+    return false;
   }
 
   T Get(Node* node) const {
diff --git a/deps/v8/src/compiler/node-matchers.h b/deps/v8/src/compiler/node-matchers.h
index d1eecfe9fdf..c31f9691f23 100644
--- a/deps/v8/src/compiler/node-matchers.h
+++ b/deps/v8/src/compiler/node-matchers.h
@@ -54,7 +54,7 @@ struct ValueMatcher : public NodeMatcher {
   explicit ValueMatcher(Node* node)
       : NodeMatcher(node), value_(), has_value_(opcode() == kOpcode) {
     if (has_value_) {
-      value_ = OpParameter<T>(node);
+      value_ = OpParameter<T>(node->op());
     }
   }
 
@@ -77,7 +77,7 @@ inline ValueMatcher<uint32_t, IrOpcode::kInt32Constant>::ValueMatcher(
       value_(),
       has_value_(opcode() == IrOpcode::kInt32Constant) {
   if (has_value_) {
-    value_ = static_cast<uint32_t>(OpParameter<int32_t>(node));
+    value_ = static_cast<uint32_t>(OpParameter<int32_t>(node->op()));
   }
 }
 
@@ -86,10 +86,10 @@ template <>
 inline ValueMatcher<int64_t, IrOpcode::kInt64Constant>::ValueMatcher(Node* node)
     : NodeMatcher(node), value_(), has_value_(false) {
   if (opcode() == IrOpcode::kInt32Constant) {
-    value_ = OpParameter<int32_t>(node);
+    value_ = OpParameter<int32_t>(node->op());
     has_value_ = true;
   } else if (opcode() == IrOpcode::kInt64Constant) {
-    value_ = OpParameter<int64_t>(node);
+    value_ = OpParameter<int64_t>(node->op());
     has_value_ = true;
   }
 }
@@ -100,10 +100,10 @@ inline ValueMatcher<uint64_t, IrOpcode::kInt64Constant>::ValueMatcher(
     Node* node)
     : NodeMatcher(node), value_(), has_value_(false) {
   if (opcode() == IrOpcode::kInt32Constant) {
-    value_ = static_cast<uint32_t>(OpParameter<int32_t>(node));
+    value_ = static_cast<uint32_t>(OpParameter<int32_t>(node->op()));
     has_value_ = true;
   } else if (opcode() == IrOpcode::kInt64Constant) {
-    value_ = static_cast<uint64_t>(OpParameter<int64_t>(node));
+    value_ = static_cast<uint64_t>(OpParameter<int64_t>(node->op()));
     has_value_ = true;
   }
 }
@@ -629,11 +629,11 @@ struct BaseWithIndexAndDisplacementMatcher {
     if (displacement != nullptr) {
       switch (displacement->opcode()) {
         case IrOpcode::kInt32Constant: {
-          value = OpParameter<int32_t>(displacement);
+          value = OpParameter<int32_t>(displacement->op());
           break;
         }
         case IrOpcode::kInt64Constant: {
-          value = OpParameter<int64_t>(displacement);
+          value = OpParameter<int64_t>(displacement->op());
           break;
         }
         default:
diff --git a/deps/v8/src/compiler/node-properties.cc b/deps/v8/src/compiler/node-properties.cc
index 22004337ebf..d8b23fb3624 100644
--- a/deps/v8/src/compiler/node-properties.cc
+++ b/deps/v8/src/compiler/node-properties.cc
@@ -515,6 +515,27 @@ MaybeHandle<Map> NodeProperties::GetMapWitness(Node* node) {
   return MaybeHandle<Map>();
 }
 
+// static
+bool NodeProperties::HasInstanceTypeWitness(Node* receiver, Node* effect,
+                                            InstanceType instance_type) {
+  ZoneHandleSet<Map> receiver_maps;
+  NodeProperties::InferReceiverMapsResult result =
+      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+  switch (result) {
+    case NodeProperties::kUnreliableReceiverMaps:
+    case NodeProperties::kReliableReceiverMaps:
+      DCHECK_NE(0, receiver_maps.size());
+      for (size_t i = 0; i < receiver_maps.size(); ++i) {
+        if (receiver_maps[i]->instance_type() != instance_type) return false;
+      }
+      return true;
+
+    case NodeProperties::kNoReceiverMaps:
+      return false;
+  }
+  UNREACHABLE();
+}
+
 // static
 bool NodeProperties::NoObservableSideEffectBetween(Node* effect,
                                                    Node* dominator) {
@@ -568,7 +589,6 @@ bool NodeProperties::CanBeNullOrUndefined(Node* receiver, Node* effect) {
     switch (receiver->opcode()) {
       case IrOpcode::kCheckInternalizedString:
       case IrOpcode::kCheckNumber:
-      case IrOpcode::kCheckSeqString:
       case IrOpcode::kCheckSmi:
       case IrOpcode::kCheckString:
       case IrOpcode::kCheckSymbol:
diff --git a/deps/v8/src/compiler/node-properties.h b/deps/v8/src/compiler/node-properties.h
index abc6622c837..7388bf94dd2 100644
--- a/deps/v8/src/compiler/node-properties.h
+++ b/deps/v8/src/compiler/node-properties.h
@@ -155,6 +155,8 @@ class V8_EXPORT_PRIVATE NodeProperties final {
       Node* receiver, Node* effect, ZoneHandleSet<Map>* maps_return);
 
   static MaybeHandle<Map> GetMapWitness(Node* node);
+  static bool HasInstanceTypeWitness(Node* receiver, Node* effect,
+                                     InstanceType instance_type);
 
   // Walks up the {effect} chain to check that there's no observable side-effect
   // between the {effect} and it's {dominator}. Aborts the walk if there's join
diff --git a/deps/v8/src/compiler/node.cc b/deps/v8/src/compiler/node.cc
index ededcc48067..f988b954fb0 100644
--- a/deps/v8/src/compiler/node.cc
+++ b/deps/v8/src/compiler/node.cc
@@ -60,8 +60,8 @@ Node* Node::New(Zone* zone, NodeId id, const Operator* op, int input_count,
   // Verify that none of the inputs are {nullptr}.
   for (int i = 0; i < input_count; i++) {
     if (inputs[i] == nullptr) {
-      V8_Fatal(__FILE__, __LINE__, "Node::New() Error: #%d:%s[%d] is nullptr",
-               static_cast<int>(id), op->mnemonic(), i);
+      FATAL("Node::New() Error: #%d:%s[%d] is nullptr", static_cast<int>(id),
+            op->mnemonic(), i);
     }
   }
 #endif
diff --git a/deps/v8/src/compiler/node.h b/deps/v8/src/compiler/node.h
index 8a4685114ba..ded45a24f4d 100644
--- a/deps/v8/src/compiler/node.h
+++ b/deps/v8/src/compiler/node.h
@@ -65,12 +65,12 @@ class V8_EXPORT_PRIVATE Node final {
 
 #ifdef DEBUG
   void Verify();
-#define BOUNDS_CHECK(index)                                                  \
-  do {                                                                       \
-    if (index < 0 || index >= InputCount()) {                                \
-      V8_Fatal(__FILE__, __LINE__, "Node #%d:%s->InputAt(%d) out of bounds", \
-               id(), op()->mnemonic(), index);                               \
-    }                                                                        \
+#define BOUNDS_CHECK(index)                                                   \
+  do {                                                                        \
+    if (index < 0 || index >= InputCount()) {                                 \
+      FATAL("Node #%d:%s->InputAt(%d) out of bounds", id(), op()->mnemonic(), \
+            index);                                                           \
+    }                                                                         \
   } while (false)
 #else
   // No bounds checks or verification in release mode.
@@ -313,12 +313,6 @@ typedef ZoneVector<Node*> NodeVector;
 typedef ZoneVector<NodeVector> NodeVectorVector;
 
 
-// Helper to extract parameters from Operator1<*> nodes.
-template <typename T>
-static inline const T& OpParameter(const Node* node) {
-  return OpParameter<T>(node->op());
-}
-
 class Node::InputEdges final {
  public:
   typedef Edge value_type;
diff --git a/deps/v8/src/compiler/opcodes.h b/deps/v8/src/compiler/opcodes.h
index ec6c720af2a..e5e4e59bd2d 100644
--- a/deps/v8/src/compiler/opcodes.h
+++ b/deps/v8/src/compiler/opcodes.h
@@ -136,11 +136,15 @@
   V(JSCreate)                   \
   V(JSCreateArguments)          \
   V(JSCreateArray)              \
+  V(JSCreateArrayIterator)      \
   V(JSCreateBoundFunction)      \
   V(JSCreateClosure)            \
   V(JSCreateGeneratorObject)    \
   V(JSCreateIterResultObject)   \
+  V(JSCreateStringIterator)     \
   V(JSCreateKeyValueArray)      \
+  V(JSCreatePromise)            \
+  V(JSCreateTypedArray)         \
   V(JSCreateLiteralArray)       \
   V(JSCreateEmptyLiteralArray)  \
   V(JSCreateLiteralObject)      \
@@ -157,6 +161,7 @@
   V(JSStoreNamedOwn)              \
   V(JSStoreGlobal)                \
   V(JSStoreDataPropertyInLiteral) \
+  V(JSStoreInArrayLiteral)        \
   V(JSDeleteProperty)             \
   V(JSHasProperty)                \
   V(JSGetSuperConstructor)
@@ -191,8 +196,14 @@
   V(JSStoreModule)                     \
   V(JSGeneratorStore)                  \
   V(JSGeneratorRestoreContinuation)    \
+  V(JSGeneratorRestoreContext)         \
   V(JSGeneratorRestoreRegister)        \
   V(JSGeneratorRestoreInputOrDebugPos) \
+  V(JSFulfillPromise)                  \
+  V(JSPerformPromiseThen)              \
+  V(JSPromiseResolve)                  \
+  V(JSRejectPromise)                   \
+  V(JSResolvePromise)                  \
   V(JSStackCheck)                      \
   V(JSDebugger)
 
@@ -331,17 +342,15 @@
   V(PlainPrimitiveToFloat64)            \
   V(BooleanNot)                         \
   V(StringToNumber)                     \
-  V(StringCharAt)                       \
   V(StringCharCodeAt)                   \
-  V(SeqStringCharCodeAt)                \
   V(StringCodePointAt)                  \
-  V(SeqStringCodePointAt)               \
-  V(StringFromCharCode)                 \
-  V(StringFromCodePoint)                \
+  V(StringFromSingleCharCode)           \
+  V(StringFromSingleCodePoint)          \
   V(StringIndexOf)                      \
   V(StringLength)                       \
   V(StringToLowerCaseIntl)              \
   V(StringToUpperCaseIntl)              \
+  V(StringSubstring)                    \
   V(CheckBounds)                        \
   V(CheckIf)                            \
   V(CheckMaps)                          \
@@ -349,7 +358,6 @@
   V(CheckInternalizedString)            \
   V(CheckReceiver)                      \
   V(CheckString)                        \
-  V(CheckSeqString)                     \
   V(CheckSymbol)                        \
   V(CheckSmi)                           \
   V(CheckHeapObject)                    \
@@ -361,7 +369,6 @@
   V(ConvertReceiver)                    \
   V(ConvertTaggedHoleToUndefined)       \
   V(TypeOf)                             \
-  V(ClassOf)                            \
   V(Allocate)                           \
   V(AllocateRaw)                        \
   V(LoadFieldByIndex)                   \
@@ -377,6 +384,12 @@
   V(TransitionAndStoreNonNumberElement) \
   V(ToBoolean)                          \
   V(NumberIsFloat64Hole)                \
+  V(NumberIsFinite)                     \
+  V(ObjectIsFiniteNumber)               \
+  V(NumberIsInteger)                    \
+  V(ObjectIsSafeInteger)                \
+  V(NumberIsSafeInteger)                \
+  V(ObjectIsInteger)                    \
   V(ObjectIsArrayBufferView)            \
   V(ObjectIsBigInt)                     \
   V(ObjectIsCallable)                   \
@@ -538,88 +551,106 @@
   V(Float64Mod)                       \
   V(Float64Pow)
 
-#define MACHINE_OP_LIST(V)      \
-  MACHINE_UNOP_32_LIST(V)       \
-  MACHINE_BINOP_32_LIST(V)      \
-  MACHINE_BINOP_64_LIST(V)      \
-  MACHINE_COMPARE_BINOP_LIST(V) \
-  MACHINE_FLOAT32_BINOP_LIST(V) \
-  MACHINE_FLOAT32_UNOP_LIST(V)  \
-  MACHINE_FLOAT64_BINOP_LIST(V) \
-  MACHINE_FLOAT64_UNOP_LIST(V)  \
-  V(DebugAbort)                 \
-  V(DebugBreak)                 \
-  V(Comment)                    \
-  V(Load)                       \
-  V(Store)                      \
-  V(StackSlot)                  \
-  V(Word32Popcnt)               \
-  V(Word64Popcnt)               \
-  V(Word64Clz)                  \
-  V(Word64Ctz)                  \
-  V(Word64ReverseBits)          \
-  V(Word64ReverseBytes)         \
-  V(Int64AbsWithOverflow)       \
-  V(BitcastTaggedToWord)        \
-  V(BitcastWordToTagged)        \
-  V(BitcastWordToTaggedSigned)  \
-  V(TruncateFloat64ToWord32)    \
-  V(ChangeFloat32ToFloat64)     \
-  V(ChangeFloat64ToInt32)       \
-  V(ChangeFloat64ToUint32)      \
-  V(ChangeFloat64ToUint64)      \
-  V(Float64SilenceNaN)          \
-  V(TruncateFloat64ToUint32)    \
-  V(TruncateFloat32ToInt32)     \
-  V(TruncateFloat32ToUint32)    \
-  V(TryTruncateFloat32ToInt64)  \
-  V(TryTruncateFloat64ToInt64)  \
-  V(TryTruncateFloat32ToUint64) \
-  V(TryTruncateFloat64ToUint64) \
-  V(ChangeInt32ToFloat64)       \
-  V(ChangeInt32ToInt64)         \
-  V(ChangeUint32ToFloat64)      \
-  V(ChangeUint32ToUint64)       \
-  V(TruncateFloat64ToFloat32)   \
-  V(TruncateInt64ToInt32)       \
-  V(RoundFloat64ToInt32)        \
-  V(RoundInt32ToFloat32)        \
-  V(RoundInt64ToFloat32)        \
-  V(RoundInt64ToFloat64)        \
-  V(RoundUint32ToFloat32)       \
-  V(RoundUint64ToFloat32)       \
-  V(RoundUint64ToFloat64)       \
-  V(BitcastFloat32ToInt32)      \
-  V(BitcastFloat64ToInt64)      \
-  V(BitcastInt32ToFloat32)      \
-  V(BitcastInt64ToFloat64)      \
-  V(Float64ExtractLowWord32)    \
-  V(Float64ExtractHighWord32)   \
-  V(Float64InsertLowWord32)     \
-  V(Float64InsertHighWord32)    \
-  V(LoadStackPointer)           \
-  V(LoadFramePointer)           \
-  V(LoadParentFramePointer)     \
-  V(UnalignedLoad)              \
-  V(UnalignedStore)             \
-  V(Int32PairAdd)               \
-  V(Int32PairSub)               \
-  V(Int32PairMul)               \
-  V(Word32PairShl)              \
-  V(Word32PairShr)              \
-  V(Word32PairSar)              \
-  V(ProtectedLoad)              \
-  V(ProtectedStore)             \
-  V(AtomicLoad)                 \
-  V(AtomicStore)                \
-  V(AtomicExchange)             \
-  V(AtomicCompareExchange)      \
-  V(AtomicAdd)                  \
-  V(AtomicSub)                  \
-  V(AtomicAnd)                  \
-  V(AtomicOr)                   \
-  V(AtomicXor)                  \
-  V(SpeculationFence)           \
+#define MACHINE_OP_LIST(V)       \
+  MACHINE_UNOP_32_LIST(V)        \
+  MACHINE_BINOP_32_LIST(V)       \
+  MACHINE_BINOP_64_LIST(V)       \
+  MACHINE_COMPARE_BINOP_LIST(V)  \
+  MACHINE_FLOAT32_BINOP_LIST(V)  \
+  MACHINE_FLOAT32_UNOP_LIST(V)   \
+  MACHINE_FLOAT64_BINOP_LIST(V)  \
+  MACHINE_FLOAT64_UNOP_LIST(V)   \
+  V(DebugAbort)                  \
+  V(DebugBreak)                  \
+  V(Comment)                     \
+  V(Load)                        \
+  V(PoisonedLoad)                \
+  V(Store)                       \
+  V(StackSlot)                   \
+  V(Word32Popcnt)                \
+  V(Word64Popcnt)                \
+  V(Word64Clz)                   \
+  V(Word64Ctz)                   \
+  V(Word64ReverseBits)           \
+  V(Word64ReverseBytes)          \
+  V(Int64AbsWithOverflow)        \
+  V(BitcastTaggedToWord)         \
+  V(BitcastWordToTagged)         \
+  V(BitcastWordToTaggedSigned)   \
+  V(TruncateFloat64ToWord32)     \
+  V(ChangeFloat32ToFloat64)      \
+  V(ChangeFloat64ToInt32)        \
+  V(ChangeFloat64ToUint32)       \
+  V(ChangeFloat64ToUint64)       \
+  V(Float64SilenceNaN)           \
+  V(TruncateFloat64ToUint32)     \
+  V(TruncateFloat32ToInt32)      \
+  V(TruncateFloat32ToUint32)     \
+  V(TryTruncateFloat32ToInt64)   \
+  V(TryTruncateFloat64ToInt64)   \
+  V(TryTruncateFloat32ToUint64)  \
+  V(TryTruncateFloat64ToUint64)  \
+  V(ChangeInt32ToFloat64)        \
+  V(ChangeInt32ToInt64)          \
+  V(ChangeUint32ToFloat64)       \
+  V(ChangeUint32ToUint64)        \
+  V(TruncateFloat64ToFloat32)    \
+  V(TruncateInt64ToInt32)        \
+  V(RoundFloat64ToInt32)         \
+  V(RoundInt32ToFloat32)         \
+  V(RoundInt64ToFloat32)         \
+  V(RoundInt64ToFloat64)         \
+  V(RoundUint32ToFloat32)        \
+  V(RoundUint64ToFloat32)        \
+  V(RoundUint64ToFloat64)        \
+  V(BitcastFloat32ToInt32)       \
+  V(BitcastFloat64ToInt64)       \
+  V(BitcastInt32ToFloat32)       \
+  V(BitcastInt64ToFloat64)       \
+  V(Float64ExtractLowWord32)     \
+  V(Float64ExtractHighWord32)    \
+  V(Float64InsertLowWord32)      \
+  V(Float64InsertHighWord32)     \
+  V(PoisonOnSpeculationTagged)   \
+  V(PoisonOnSpeculationWord)     \
+  V(LoadStackPointer)            \
+  V(LoadFramePointer)            \
+  V(LoadParentFramePointer)      \
+  V(LoadRootsPointer)            \
+  V(UnalignedLoad)               \
+  V(UnalignedStore)              \
+  V(Int32PairAdd)                \
+  V(Int32PairSub)                \
+  V(Int32PairMul)                \
+  V(Word32PairShl)               \
+  V(Word32PairShr)               \
+  V(Word32PairSar)               \
+  V(ProtectedLoad)               \
+  V(ProtectedStore)              \
+  V(Word32AtomicLoad)            \
+  V(Word32AtomicStore)           \
+  V(Word32AtomicExchange)        \
+  V(Word32AtomicCompareExchange) \
+  V(Word32AtomicAdd)             \
+  V(Word32AtomicSub)             \
+  V(Word32AtomicAnd)             \
+  V(Word32AtomicOr)              \
+  V(Word32AtomicXor)             \
+  V(Word64AtomicLoad)            \
+  V(Word64AtomicStore)           \
+  V(Word64AtomicAdd)             \
+  V(Word64AtomicSub)             \
+  V(Word64AtomicAnd)             \
+  V(Word64AtomicOr)              \
+  V(Word64AtomicXor)             \
+  V(Word64AtomicExchange)        \
+  V(Word64AtomicCompareExchange) \
+  V(SpeculationFence)            \
+  V(SignExtendWord8ToInt32)      \
+  V(SignExtendWord16ToInt32)     \
+  V(SignExtendWord8ToInt64)      \
+  V(SignExtendWord16ToInt64)     \
+  V(SignExtendWord32ToInt64)     \
   V(UnsafePointerAdd)
 
 #define MACHINE_SIMD_OP_LIST(V) \
diff --git a/deps/v8/src/compiler/operation-typer.cc b/deps/v8/src/compiler/operation-typer.cc
index 226faeaa82a..fc774f87067 100644
--- a/deps/v8/src/compiler/operation-typer.cc
+++ b/deps/v8/src/compiler/operation-typer.cc
@@ -510,7 +510,7 @@ Type* OperationTyper::NumberToString(Type* type) {
   if (type->IsNone()) return type;
   if (type->Is(Type::NaN())) return singleton_NaN_string_;
   if (type->Is(cache_.kZeroOrMinusZero)) return singleton_zero_string_;
-  return Type::SeqString();
+  return Type::String();
 }
 
 Type* OperationTyper::NumberToUint32(Type* type) {
diff --git a/deps/v8/src/compiler/operator-properties.cc b/deps/v8/src/compiler/operator-properties.cc
index d786bb3ee5b..89e19c271c8 100644
--- a/deps/v8/src/compiler/operator-properties.cc
+++ b/deps/v8/src/compiler/operator-properties.cc
@@ -71,6 +71,7 @@ bool OperatorProperties::HasFrameStateInput(const Operator* op) {
     case IrOpcode::kJSCreate:
     case IrOpcode::kJSCreateArguments:
     case IrOpcode::kJSCreateArray:
+    case IrOpcode::kJSCreateTypedArray:
     case IrOpcode::kJSCreateLiteralArray:
     case IrOpcode::kJSCreateLiteralObject:
     case IrOpcode::kJSCreateLiteralRegExp:
@@ -115,6 +116,9 @@ bool OperatorProperties::HasFrameStateInput(const Operator* op) {
     case IrOpcode::kJSDecrement:
     case IrOpcode::kJSIncrement:
     case IrOpcode::kJSNegate:
+    case IrOpcode::kJSPromiseResolve:
+    case IrOpcode::kJSRejectPromise:
+    case IrOpcode::kJSResolvePromise:
       return true;
 
     default:
diff --git a/deps/v8/src/compiler/persistent-map.h b/deps/v8/src/compiler/persistent-map.h
index ab0eebbbdd3..e94165b36af 100644
--- a/deps/v8/src/compiler/persistent-map.h
+++ b/deps/v8/src/compiler/persistent-map.h
@@ -2,11 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_COMPILER_PERSISTENT_H_
-#define V8_COMPILER_PERSISTENT_H_
+#ifndef V8_COMPILER_PERSISTENT_MAP_H_
+#define V8_COMPILER_PERSISTENT_MAP_H_
 
 #include <array>
-#include <bitset>
 #include <tuple>
 
 #include "src/base/functional.h"
@@ -74,8 +73,7 @@ class PersistentMap {
   }
 
   // Add or overwrite an existing key-value pair.
-  PersistentMap Add(Key key, Value value) const;
-  void Set(Key key, Value value) { *this = Add(key, value); }
+  void Set(Key key, Value value);
 
   bool operator==(const PersistentMap& other) const {
     if (tree_ == other.tree_) return true;
@@ -202,17 +200,16 @@ struct PersistentMap<Key, Value, Hasher>::FocusedTree {
 template <class Key, class Value, class Hasher>
 class PersistentMap<Key, Value, Hasher>::HashValue {
  public:
-  explicit HashValue(size_t hash) : bits_(hash) {}
-  explicit HashValue(std::bitset<kHashBits> hash) : bits_(hash) {}
+  explicit HashValue(size_t hash) : bits_(static_cast<uint32_t>(hash)) {}
 
   Bit operator[](int pos) const {
-    return bits_[kHashBits - pos - 1] ? kRight : kLeft;
+    DCHECK_LT(pos, kHashBits);
+    return bits_ & (static_cast<decltype(bits_)>(1) << (kHashBits - pos - 1))
+               ? kRight
+               : kLeft;
   }
 
-  bool operator<(HashValue other) const {
-    static_assert(sizeof(*this) <= sizeof(unsigned long), "");  // NOLINT
-    return bits_.to_ulong() < other.bits_.to_ulong();
-  }
+  bool operator<(HashValue other) const { return bits_ < other.bits_; }
   bool operator==(HashValue other) const { return bits_ == other.bits_; }
   bool operator!=(HashValue other) const { return bits_ != other.bits_; }
   HashValue operator^(HashValue other) const {
@@ -220,7 +217,8 @@ class PersistentMap<Key, Value, Hasher>::HashValue {
   }
 
  private:
-  std::bitset<kHashBits> bits_;
+  static_assert(sizeof(uint32_t) * 8 == kHashBits, "wrong type for bits_");
+  uint32_t bits_;
 };
 
 template <class Key, class Value, class Hasher>
@@ -263,7 +261,7 @@ class PersistentMap<Key, Value, Hasher>::iterator {
       if (current_->more) {
         more_iter_ = current_->more->begin();
       }
-    } while ((**this).second == def_value());
+    } while (!((**this).second != def_value()));
     return *this;
   }
 
@@ -281,12 +279,10 @@ class PersistentMap<Key, Value, Hasher>::iterator {
   bool operator<(const iterator& other) const {
     if (is_end()) return false;
     if (other.is_end()) return true;
-    if (current_->key_hash < other.current_->key_hash) {
-      return true;
-    } else if (current_->key_hash == other.current_->key_hash) {
+    if (current_->key_hash == other.current_->key_hash) {
       return (**this).first < (*other).first;
     } else {
-      return false;
+      return current_->key_hash < other.current_->key_hash;
     }
   }
 
@@ -300,6 +296,9 @@ class PersistentMap<Key, Value, Hasher>::iterator {
     if (i.current_->more) {
       i.more_iter_ = i.current_->more->begin();
     }
+    // Skip entries with default value. PersistentMap iterators must never point
+    // to a default value.
+    while (!i.is_end() && !((*i).second != def_value)) ++i;
     return i;
   }
 
@@ -333,8 +332,18 @@ class PersistentMap<Key, Value, Hasher>::double_iterator {
   }
 
   double_iterator& operator++() {
-    if (first_current_) ++first_;
-    if (second_current_) ++second_;
+#ifdef DEBUG
+    iterator old_first = first_;
+    iterator old_second = second_;
+#endif
+    if (first_current_) {
+      ++first_;
+      DCHECK(old_first < first_);
+    }
+    if (second_current_) {
+      ++second_;
+      DCHECK(old_second < second_);
+    }
     return *this = double_iterator(first_, second_);
   }
 
@@ -346,6 +355,7 @@ class PersistentMap<Key, Value, Hasher>::double_iterator {
       first_current_ = true;
       second_current_ = false;
     } else {
+      DCHECK(second_ < first_);
       first_current_ = false;
       second_current_ = true;
     }
@@ -365,14 +375,13 @@ class PersistentMap<Key, Value, Hasher>::double_iterator {
 };
 
 template <class Key, class Value, class Hasher>
-PersistentMap<Key, Value, Hasher> PersistentMap<Key, Value, Hasher>::Add(
-    Key key, Value value) const {
+void PersistentMap<Key, Value, Hasher>::Set(Key key, Value value) {
   HashValue key_hash = HashValue(Hasher()(key));
   std::array<const FocusedTree*, kHashBits> path;
   int length = 0;
   const FocusedTree* old = FindHash(key_hash, &path, &length);
   ZoneMap<Key, Value>* more = nullptr;
-  if (GetFocusedValue(old, key) == value) return *this;
+  if (!(GetFocusedValue(old, key) != value)) return;
   if (old && !(old->more == nullptr && old->key_value.key() == key)) {
     more = new (zone_->New(sizeof(*more))) ZoneMap<Key, Value>(zone_);
     if (old->more) {
@@ -393,7 +402,7 @@ PersistentMap<Key, Value, Hasher> PersistentMap<Key, Value, Hasher>::Add(
   for (int i = 0; i < length; ++i) {
     tree->path(i) = path[i];
   }
-  return PersistentMap(tree, zone_, def_value_);
+  *this = PersistentMap(tree, zone_, def_value_);
 }
 
 template <class Key, class Value, class Hasher>
diff --git a/deps/v8/src/compiler/pipeline-statistics.h b/deps/v8/src/compiler/pipeline-statistics.h
index b2bf3ac76ae..900cd1cd8f4 100644
--- a/deps/v8/src/compiler/pipeline-statistics.h
+++ b/deps/v8/src/compiler/pipeline-statistics.h
@@ -98,4 +98,4 @@ class PhaseScope {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_COMPILER_PIPELINE_STATISTICS_H_
diff --git a/deps/v8/src/compiler/pipeline.cc b/deps/v8/src/compiler/pipeline.cc
index b4567ab04f6..ef0ec99b5f4 100644
--- a/deps/v8/src/compiler/pipeline.cc
+++ b/deps/v8/src/compiler/pipeline.cc
@@ -83,6 +83,11 @@ struct ProtectedInstructionData;
 
 namespace compiler {
 
+// Turbofan can only handle 2^16 control inputs. Since each control flow split
+// requires at least two bytes (jump and offset), we limit the bytecode size
+// to 128K bytes.
+const int kMaxBytecodeSizeForTurbofan = 128 * 1024;
+
 class PipelineData {
  public:
   // For main entry point.
@@ -292,32 +297,32 @@ class PipelineData {
     register_allocation_data_ = nullptr;
   }
 
-  void InitializeInstructionSequence(const CallDescriptor* descriptor) {
+  void InitializeInstructionSequence(const CallDescriptor* call_descriptor) {
     DCHECK_NULL(sequence_);
     InstructionBlocks* instruction_blocks =
         InstructionSequence::InstructionBlocksFor(instruction_zone(),
                                                   schedule());
     sequence_ = new (instruction_zone())
         InstructionSequence(isolate(), instruction_zone(), instruction_blocks);
-    if (descriptor && descriptor->RequiresFrameAsIncoming()) {
+    if (call_descriptor && call_descriptor->RequiresFrameAsIncoming()) {
       sequence_->instruction_blocks()[0]->mark_needs_frame();
     } else {
-      DCHECK_EQ(0u, descriptor->CalleeSavedFPRegisters());
-      DCHECK_EQ(0u, descriptor->CalleeSavedRegisters());
+      DCHECK_EQ(0u, call_descriptor->CalleeSavedFPRegisters());
+      DCHECK_EQ(0u, call_descriptor->CalleeSavedRegisters());
     }
   }
 
-  void InitializeFrameData(CallDescriptor* descriptor) {
+  void InitializeFrameData(CallDescriptor* call_descriptor) {
     DCHECK_NULL(frame_);
     int fixed_frame_size = 0;
-    if (descriptor != nullptr) {
-      fixed_frame_size = descriptor->CalculateFixedFrameSize();
+    if (call_descriptor != nullptr) {
+      fixed_frame_size = call_descriptor->CalculateFixedFrameSize();
     }
     frame_ = new (codegen_zone()) Frame(fixed_frame_size);
   }
 
   void InitializeRegisterAllocationData(const RegisterConfiguration* config,
-                                        CallDescriptor* descriptor) {
+                                        CallDescriptor* call_descriptor) {
     DCHECK_NULL(register_allocation_data_);
     register_allocation_data_ = new (register_allocation_zone())
         RegisterAllocationData(config, register_allocation_zone(), frame(),
@@ -336,10 +341,12 @@ class PipelineData {
 
   void InitializeCodeGenerator(Linkage* linkage) {
     DCHECK_NULL(code_generator_);
-    code_generator_ =
-        new CodeGenerator(codegen_zone(), frame(), linkage, sequence(), info(),
-                          isolate(), osr_helper_, start_source_position_,
-                          jump_optimization_info_, protected_instructions_);
+    code_generator_ = new CodeGenerator(
+        codegen_zone(), frame(), linkage, sequence(), info(), isolate(),
+        osr_helper_, start_source_position_, jump_optimization_info_,
+        protected_instructions_,
+        info()->is_poison_loads() ? PoisoningMitigationLevel::kOn
+                                  : PoisoningMitigationLevel::kOff);
   }
 
   void BeginPhaseKind(const char* phase_kind_name) {
@@ -451,7 +458,7 @@ class PipelineImpl final {
   void RunPrintAndVerify(const char* phase, bool untyped = false);
   Handle<Code> GenerateCode(CallDescriptor* call_descriptor);
   void AllocateRegisters(const RegisterConfiguration* config,
-                         CallDescriptor* descriptor, bool run_verifier);
+                         CallDescriptor* call_descriptor, bool run_verifier);
 
   CompilationInfo* info() const;
   Isolate* isolate() const;
@@ -492,11 +499,11 @@ int PrintFunctionSource(CompilationInfo* info, Isolate* isolate,
       }
       os << shared->DebugName()->ToCString().get() << ") id{";
       os << info->optimization_id() << "," << source_id << "} start{";
-      os << shared->start_position() << "} ---\n";
+      os << shared->StartPosition() << "} ---\n";
       {
         DisallowHeapAllocation no_allocation;
-        int start = shared->start_position();
-        int len = shared->end_position() - start;
+        int start = shared->StartPosition();
+        int len = shared->EndPosition() - start;
         String::SubStringRange source(String::cast(script->source()), start,
                                       len);
         for (const auto& c : source) {
@@ -578,10 +585,10 @@ void PrintCode(Handle<Code> code, CompilationInfo* info) {
         os << "--- Raw source ---\n";
         StringCharacterStream stream(
             String::cast(Script::cast(shared->script())->source()),
-            shared->start_position());
+            shared->StartPosition());
         // fun->end_position() points to the last character in the stream. We
         // need to compensate by adding one to calculate the length.
-        int source_len = shared->end_position() - shared->start_position() + 1;
+        int source_len = shared->EndPosition() - shared->StartPosition() + 1;
         for (int i = 0; i < source_len; i++) {
           if (stream.HasMore()) {
             os << AsReversiblyEscapedUC16(stream.GetNext());
@@ -598,7 +605,7 @@ void PrintCode(Handle<Code> code, CompilationInfo* info) {
     }
     if (print_source) {
       Handle<SharedFunctionInfo> shared = info->shared_info();
-      os << "source_position = " << shared->start_position() << "\n";
+      os << "source_position = " << shared->StartPosition() << "\n";
     }
     code->Disassemble(debug_name.get(), os);
     os << "--- End code ---\n";
@@ -715,13 +722,13 @@ PipelineStatistics* CreatePipelineStatistics(Handle<Script> script,
   if (FLAG_trace_turbo) {
     TurboJsonFile json_of(info, std::ios_base::trunc);
     std::unique_ptr<char[]> function_name = info->GetDebugName();
-    int pos = info->IsStub() ? 0 : info->shared_info()->start_position();
+    int pos = info->IsStub() ? 0 : info->shared_info()->StartPosition();
     json_of << "{\"function\":\"" << function_name.get()
             << "\", \"sourcePosition\":" << pos << ", \"source\":\"";
     if (!script.is_null() && !script->source()->IsUndefined(isolate)) {
       DisallowHeapAllocation no_allocation;
-      int start = info->shared_info()->start_position();
-      int len = info->shared_info()->end_position() - start;
+      int start = info->shared_info()->StartPosition();
+      int len = info->shared_info()->EndPosition() - start;
       String::SubStringRange source(String::cast(script->source()), start, len);
       for (const auto& c : source) {
         json_of << AsEscapedUC16ForJSON(c);
@@ -778,6 +785,11 @@ class PipelineCompilationJob final : public CompilationJob {
 
 PipelineCompilationJob::Status PipelineCompilationJob::PrepareJobImpl(
     Isolate* isolate) {
+  if (compilation_info()->shared_info()->bytecode_array()->length() >
+      kMaxBytecodeSizeForTurbofan) {
+    return AbortOptimization(BailoutReason::kFunctionTooBig);
+  }
+
   if (!FLAG_always_opt) {
     compilation_info()->MarkAsBailoutOnUninitialized();
   }
@@ -790,13 +802,19 @@ PipelineCompilationJob::Status PipelineCompilationJob::PrepareJobImpl(
   if (FLAG_inline_accessors) {
     compilation_info()->MarkAsAccessorInliningEnabled();
   }
-  if (compilation_info()->closure()->feedback_vector_cell()->map() ==
+  if (FLAG_branch_load_poisoning) {
+    compilation_info()->MarkAsPoisonLoads();
+  }
+  if (FLAG_turbo_allocation_folding) {
+    compilation_info()->MarkAsAllocationFoldingEnabled();
+  }
+  if (compilation_info()->closure()->feedback_cell()->map() ==
       isolate->heap()->one_closure_cell_map()) {
     compilation_info()->MarkAsFunctionContextSpecializing();
   }
 
   data_.set_start_source_position(
-      compilation_info()->shared_info()->start_position());
+      compilation_info()->shared_info()->StartPosition());
 
   linkage_ = new (compilation_info()->zone()) Linkage(
       Linkage::ComputeIncoming(compilation_info()->zone(), compilation_info()));
@@ -839,29 +857,10 @@ PipelineCompilationJob::Status PipelineCompilationJob::FinalizeJobImpl(
   return SUCCEEDED;
 }
 
-namespace {
-
-void AddWeakObjectToCodeDependency(Isolate* isolate, Handle<HeapObject> object,
-                                   Handle<Code> code) {
-  Handle<WeakCell> cell = Code::WeakCellFor(code);
-  Heap* heap = isolate->heap();
-  if (heap->InNewSpace(*object)) {
-    heap->AddWeakNewSpaceObjectToCodeDependency(object, cell);
-  } else {
-    Handle<DependentCode> dep(heap->LookupWeakObjectToCodeDependency(object));
-    dep =
-        DependentCode::InsertWeakCode(dep, DependentCode::kWeakCodeGroup, cell);
-    heap->AddWeakObjectToCodeDependency(object, dep);
-  }
-}
-
-}  // namespace
-
 void PipelineCompilationJob::RegisterWeakObjectsInOptimizedCode(
     Handle<Code> code, Isolate* isolate) {
   DCHECK(code->is_optimized_code());
   std::vector<Handle<Map>> maps;
-  std::vector<Handle<HeapObject>> objects;
   {
     DisallowHeapAllocation no_gc;
     int const mode_mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
@@ -873,20 +872,12 @@ void PipelineCompilationJob::RegisterWeakObjectsInOptimizedCode(
                                   isolate);
         if (object->IsMap()) {
           maps.push_back(Handle<Map>::cast(object));
-        } else {
-          objects.push_back(object);
         }
       }
     }
   }
   for (Handle<Map> map : maps) {
-    if (map->dependent_code()->IsEmpty(DependentCode::kWeakCodeGroup)) {
-      isolate->heap()->AddRetainedMap(map);
-    }
-    Map::AddDependentCode(map, DependentCode::kWeakCodeGroup, code);
-  }
-  for (Handle<HeapObject> object : objects) {
-    AddWeakObjectToCodeDependency(isolate, object, code);
+    isolate->heap()->AddRetainedMap(map);
   }
   code->set_can_have_weak_objects(true);
 }
@@ -895,7 +886,7 @@ class PipelineWasmCompilationJob final : public CompilationJob {
  public:
   explicit PipelineWasmCompilationJob(
       CompilationInfo* info, Isolate* isolate, JSGraph* jsgraph,
-      CallDescriptor* descriptor, SourcePositionTable* source_positions,
+      CallDescriptor* call_descriptor, SourcePositionTable* source_positions,
       std::vector<trap_handler::ProtectedInstructionData>* protected_insts,
       bool asmjs_origin)
       : CompilationJob(isolate->stack_guard()->real_climit(), nullptr, info,
@@ -906,7 +897,7 @@ class PipelineWasmCompilationJob final : public CompilationJob {
         data_(&zone_stats_, isolate, info, jsgraph, pipeline_statistics_.get(),
               source_positions, protected_insts),
         pipeline_(&data_),
-        linkage_(descriptor),
+        linkage_(call_descriptor),
         asmjs_origin_(asmjs_origin) {}
 
  protected:
@@ -955,7 +946,8 @@ PipelineWasmCompilationJob::ExecuteJobImpl() {
     ValueNumberingReducer value_numbering(scope.zone(), data->graph()->zone());
     MachineOperatorReducer machine_reducer(data->jsgraph(), asmjs_origin_);
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
-                                         data->common(), data->machine());
+                                         data->common(), data->machine(),
+                                         scope.zone());
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &machine_reducer);
     AddReducer(data, &graph_reducer, &common_reducer);
@@ -976,22 +968,18 @@ size_t PipelineWasmCompilationJob::AllocatedMemory() const {
 
 PipelineWasmCompilationJob::Status PipelineWasmCompilationJob::FinalizeJobImpl(
     Isolate* isolate) {
-  if (!FLAG_wasm_jit_to_native) {
-    pipeline_.FinalizeCode();
-    ValidateImmovableEmbeddedObjects();
-  } else {
-    CodeGenerator* code_generator = pipeline_.data_->code_generator();
-    CompilationInfo::WasmCodeDesc* wasm_code_desc =
-        compilation_info()->wasm_code_desc();
-    code_generator->tasm()->GetCode(isolate, &wasm_code_desc->code_desc);
-    wasm_code_desc->safepoint_table_offset =
-        code_generator->GetSafepointTableOffset();
-    wasm_code_desc->frame_slot_count =
-        code_generator->frame()->GetTotalFrameSlotCount();
-    wasm_code_desc->source_positions_table =
-        code_generator->GetSourcePositionTable();
-    wasm_code_desc->handler_table = code_generator->GetHandlerTable();
-  }
+  CodeGenerator* code_generator = pipeline_.data_->code_generator();
+  CompilationInfo::WasmCodeDesc* wasm_code_desc =
+      compilation_info()->wasm_code_desc();
+  code_generator->tasm()->GetCode(isolate, &wasm_code_desc->code_desc);
+  wasm_code_desc->safepoint_table_offset =
+      code_generator->GetSafepointTableOffset();
+  wasm_code_desc->handler_table_offset =
+      code_generator->GetHandlerTableOffset();
+  wasm_code_desc->frame_slot_count =
+      code_generator->frame()->GetTotalFrameSlotCount();
+  wasm_code_desc->source_positions_table =
+      code_generator->GetSourcePositionTable();
   return SUCCEEDED;
 }
 
@@ -1074,7 +1062,8 @@ struct GraphBuilderPhase {
         handle(data->info()->closure()->feedback_vector()),
         data->info()->osr_offset(), data->jsgraph(), CallFrequency(1.0f),
         data->source_positions(), data->native_context(),
-        SourcePosition::kNotInlined, flags);
+        SourcePosition::kNotInlined, flags, true,
+        data->info()->is_analyze_environment_liveness());
     graph_builder.CreateGraph();
   }
 };
@@ -1113,7 +1102,8 @@ struct InliningPhase {
                                               data->common(), temp_zone);
     CheckpointElimination checkpoint_elimination(&graph_reducer);
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
-                                         data->common(), data->machine());
+                                         data->common(), data->machine(),
+                                         temp_zone);
     JSCallReducer call_reducer(&graph_reducer, data->jsgraph(),
                                data->info()->is_bailout_on_uninitialized()
                                    ? JSCallReducer::kBailoutOnUninitialized
@@ -1217,7 +1207,8 @@ struct TypedLoweringPhase {
     SimplifiedOperatorReducer simple_reducer(&graph_reducer, data->jsgraph());
     CheckpointElimination checkpoint_elimination(&graph_reducer);
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
-                                         data->common(), data->machine());
+                                         data->common(), data->machine(),
+                                         temp_zone);
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &builtin_reducer);
     AddReducer(data, &graph_reducer, &create_lowering);
@@ -1324,7 +1315,8 @@ struct EarlyOptimizationPhase {
     ValueNumberingReducer value_numbering(temp_zone, data->graph()->zone());
     MachineOperatorReducer machine_reducer(data->jsgraph());
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
-                                         data->common(), data->machine());
+                                         data->common(), data->machine(),
+                                         temp_zone);
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &simple_reducer);
     AddReducer(data, &graph_reducer, &redundancy_elimination);
@@ -1367,15 +1359,21 @@ struct EffectControlLinearizationPhase {
       if (FLAG_turbo_verify) ScheduleVerifier::Run(schedule);
       TraceSchedule(data->info(), data->isolate(), schedule);
 
+      // We only insert the array masking code if
+      //   - untrusted code mitigations are on,
+      //   - general load poisoning is off.
+      // TODO(jarin) Remove the array index masking code entirely once we have
+      // restricted load poisoning.
+      EffectControlLinearizer::MaskArrayIndexEnable mask_array_index =
+          (data->info()->has_untrusted_code_mitigations() &&
+           !data->info()->is_poison_loads())
+              ? EffectControlLinearizer::kMaskArrayIndex
+              : EffectControlLinearizer::kDoNotMaskArrayIndex;
       // Post-pass for wiring the control/effects
       // - connect allocating representation changes into the control&effect
       //   chains and lower them,
       // - get rid of the region markers,
       // - introduce effect phis and rewire effects to get SSA again.
-      EffectControlLinearizer::MaskArrayIndexEnable mask_array_index =
-          data->info()->has_untrusted_code_mitigations()
-              ? EffectControlLinearizer::kMaskArrayIndex
-              : EffectControlLinearizer::kDoNotMaskArrayIndex;
       EffectControlLinearizer linearizer(data->jsgraph(), schedule, temp_zone,
                                          data->source_positions(),
                                          mask_array_index);
@@ -1391,7 +1389,8 @@ struct EffectControlLinearizationPhase {
       DeadCodeElimination dead_code_elimination(&graph_reducer, data->graph(),
                                                 data->common(), temp_zone);
       CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
-                                           data->common(), data->machine());
+                                           data->common(), data->machine(),
+                                           temp_zone);
       AddReducer(data, &graph_reducer, &dead_code_elimination);
       AddReducer(data, &graph_reducer, &common_reducer);
       graph_reducer.ReduceGraph();
@@ -1427,7 +1426,8 @@ struct LoadEliminationPhase {
     CheckpointElimination checkpoint_elimination(&graph_reducer);
     ValueNumberingReducer value_numbering(temp_zone, data->graph()->zone());
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
-                                         data->common(), data->machine());
+                                         data->common(), data->machine(),
+                                         temp_zone);
     AddReducer(data, &graph_reducer, &branch_condition_elimination);
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &redundancy_elimination);
@@ -1450,7 +1450,13 @@ struct MemoryOptimizationPhase {
     trimmer.TrimGraph(roots.begin(), roots.end());
 
     // Optimize allocations and load/store operations.
-    MemoryOptimizer optimizer(data->jsgraph(), temp_zone);
+    MemoryOptimizer optimizer(
+        data->jsgraph(), temp_zone,
+        data->info()->is_poison_loads() ? PoisoningMitigationLevel::kOn
+                                        : PoisoningMitigationLevel::kOff,
+        data->info()->is_allocation_folding_enabled()
+            ? MemoryOptimizer::AllocationFolding::kDoAllocationFolding
+            : MemoryOptimizer::AllocationFolding::kDontAllocationFolding);
     optimizer.Optimize();
   }
 };
@@ -1467,7 +1473,8 @@ struct LateOptimizationPhase {
     ValueNumberingReducer value_numbering(temp_zone, data->graph()->zone());
     MachineOperatorReducer machine_reducer(data->jsgraph());
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
-                                         data->common(), data->machine());
+                                         data->common(), data->machine(),
+                                         temp_zone);
     SelectLowering select_lowering(data->jsgraph()->graph(),
                                    data->jsgraph()->common());
     AddReducer(data, &graph_reducer, &branch_condition_elimination);
@@ -1525,6 +1532,9 @@ struct InstructionSelectionPhase {
     InstructionSelector selector(
         temp_zone, data->graph()->NodeCount(), linkage, data->sequence(),
         data->schedule(), data->source_positions(), data->frame(),
+        data->info()->switch_jump_table_enabled()
+            ? InstructionSelector::kEnableSwitchJumpTable
+            : InstructionSelector::kDisableSwitchJumpTable,
         data->info()->is_source_positions_enabled()
             ? InstructionSelector::kAllSourcePositions
             : InstructionSelector::kCallSourcePositions,
@@ -1534,7 +1544,9 @@ struct InstructionSelectionPhase {
             : InstructionSelector::kDisableScheduling,
         data->isolate()->serializer_enabled()
             ? InstructionSelector::kEnableSerialization
-            : InstructionSelector::kDisableSerialization);
+            : InstructionSelector::kDisableSerialization,
+        data->info()->is_poison_loads() ? PoisoningMitigationLevel::kOn
+                                        : PoisoningMitigationLevel::kOff);
     if (!selector.SelectInstructions()) {
       data->set_compilation_failed();
     }
@@ -1951,11 +1963,16 @@ bool PipelineImpl::OptimizeGraph(Linkage* linkage) {
 Handle<Code> Pipeline::GenerateCodeForCodeStub(
     Isolate* isolate, CallDescriptor* call_descriptor, Graph* graph,
     Schedule* schedule, Code::Kind kind, const char* debug_name,
-    uint32_t stub_key, int32_t builtin_index, JumpOptimizationInfo* jump_opt) {
+    uint32_t stub_key, int32_t builtin_index, JumpOptimizationInfo* jump_opt,
+    PoisoningMitigationLevel poisoning_enabled) {
   CompilationInfo info(CStrVector(debug_name), graph->zone(), kind);
   info.set_builtin_index(builtin_index);
   info.set_stub_key(stub_key);
 
+  if (poisoning_enabled == PoisoningMitigationLevel::kOn) {
+    info.MarkAsPoisonLoads();
+  }
+
   // Construct a pipeline for scheduling and code generation.
   ZoneStats zone_stats(isolate->allocator());
   SourcePositionTable source_positions(graph);
@@ -2012,8 +2029,7 @@ Handle<Code> Pipeline::GenerateCodeForTesting(CompilationInfo* info,
 Handle<Code> Pipeline::GenerateCodeForTesting(CompilationInfo* info,
                                               Isolate* isolate, Graph* graph,
                                               Schedule* schedule) {
-  CallDescriptor* call_descriptor =
-      Linkage::ComputeIncoming(info->zone(), info);
+  auto call_descriptor = Linkage::ComputeIncoming(info->zone(), info);
   return GenerateCodeForTesting(info, isolate, call_descriptor, graph,
                                 schedule);
 }
@@ -2071,10 +2087,10 @@ CompilationJob* Pipeline::NewCompilationJob(Handle<JSFunction> function,
 // static
 CompilationJob* Pipeline::NewWasmCompilationJob(
     CompilationInfo* info, Isolate* isolate, JSGraph* jsgraph,
-    CallDescriptor* descriptor, SourcePositionTable* source_positions,
+    CallDescriptor* call_descriptor, SourcePositionTable* source_positions,
     std::vector<trap_handler::ProtectedInstructionData>* protected_instructions,
     wasm::ModuleOrigin asmjs_origin) {
-  return new PipelineWasmCompilationJob(info, isolate, jsgraph, descriptor,
+  return new PipelineWasmCompilationJob(info, isolate, jsgraph, call_descriptor,
                                         source_positions,
                                         protected_instructions, asmjs_origin);
 }
@@ -2105,7 +2121,7 @@ void PipelineImpl::ComputeScheduledGraph() {
 }
 
 bool PipelineImpl::SelectInstructions(Linkage* linkage) {
-  CallDescriptor* call_descriptor = linkage->GetIncomingDescriptor();
+  auto call_descriptor = linkage->GetIncomingDescriptor();
   PipelineData* data = this->data_;
 
   // We should have a scheduled graph.
@@ -2181,11 +2197,14 @@ bool PipelineImpl::SelectInstructions(Linkage* linkage) {
 
   // Allocate registers.
   if (call_descriptor->HasRestrictedAllocatableRegisters()) {
-    auto registers = call_descriptor->AllocatableRegisters();
+    RegList registers = call_descriptor->AllocatableRegisters();
     DCHECK_LT(0, NumRegs(registers));
     std::unique_ptr<const RegisterConfiguration> config;
     config.reset(RegisterConfiguration::RestrictGeneralRegisters(registers));
     AllocateRegisters(config.get(), call_descriptor, run_verifier);
+  } else if (data->info()->is_poison_loads()) {
+    AllocateRegisters(RegisterConfiguration::Poisoning(), call_descriptor,
+                      run_verifier);
   } else {
     AllocateRegisters(RegisterConfiguration::Default(), call_descriptor,
                       run_verifier);
@@ -2276,7 +2295,7 @@ Handle<Code> PipelineImpl::GenerateCode(CallDescriptor* call_descriptor) {
 }
 
 void PipelineImpl::AllocateRegisters(const RegisterConfiguration* config,
-                                     CallDescriptor* descriptor,
+                                     CallDescriptor* call_descriptor,
                                      bool run_verifier) {
   PipelineData* data = this->data_;
   // Don't track usage for this zone in compiler stats.
@@ -2294,7 +2313,7 @@ void PipelineImpl::AllocateRegisters(const RegisterConfiguration* config,
   data_->sequence()->ValidateDeferredBlockExitPaths();
 #endif
 
-  data->InitializeRegisterAllocationData(config, descriptor);
+  data->InitializeRegisterAllocationData(config, call_descriptor);
   if (info()->is_osr()) data->osr_helper()->SetupFrame(data->frame());
 
   Run<MeetRegisterConstraintsPhase>();
diff --git a/deps/v8/src/compiler/pipeline.h b/deps/v8/src/compiler/pipeline.h
index b5b6b5f1422..ada5f242e05 100644
--- a/deps/v8/src/compiler/pipeline.h
+++ b/deps/v8/src/compiler/pipeline.h
@@ -46,7 +46,7 @@ class Pipeline : public AllStatic {
   // Returns a new compilation job for the WebAssembly compilation info.
   static CompilationJob* NewWasmCompilationJob(
       CompilationInfo* info, Isolate* isolate, JSGraph* jsgraph,
-      CallDescriptor* descriptor, SourcePositionTable* source_positions,
+      CallDescriptor* call_descriptor, SourcePositionTable* source_positions,
       std::vector<trap_handler::ProtectedInstructionData>*
           protected_instructions,
       wasm::ModuleOrigin wasm_origin);
@@ -56,7 +56,8 @@ class Pipeline : public AllStatic {
   static Handle<Code> GenerateCodeForCodeStub(
       Isolate* isolate, CallDescriptor* call_descriptor, Graph* graph,
       Schedule* schedule, Code::Kind kind, const char* debug_name,
-      uint32_t stub_key, int32_t builtin_index, JumpOptimizationInfo* jump_opt);
+      uint32_t stub_key, int32_t builtin_index, JumpOptimizationInfo* jump_opt,
+      PoisoningMitigationLevel poisoning_enabled);
 
   // Run the entire pipeline and generate a handle to a code object suitable for
   // testing.
diff --git a/deps/v8/src/compiler/ppc/code-generator-ppc.cc b/deps/v8/src/compiler/ppc/code-generator-ppc.cc
index 7fc537784c0..58fca8dcd29 100644
--- a/deps/v8/src/compiler/ppc/code-generator-ppc.cc
+++ b/deps/v8/src/compiler/ppc/code-generator-ppc.cc
@@ -34,7 +34,9 @@ class PPCOperandConverter final : public InstructionOperandConverter {
   RCBit OutputRCBit() const {
     switch (instr_->flags_mode()) {
       case kFlags_branch:
+      case kFlags_branch_and_poison:
       case kFlags_deoptimize:
+      case kFlags_deoptimize_and_poison:
       case kFlags_set:
       case kFlags_trap:
         return SetRC;
@@ -270,6 +272,16 @@ Condition FlagsConditionToCondition(FlagsCondition condition, ArchOpcode op) {
   UNREACHABLE();
 }
 
+void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen, Instruction* instr,
+                                   PPCOperandConverter& i) {
+  const MemoryAccessMode access_mode =
+      static_cast<MemoryAccessMode>(MiscField::decode(instr->opcode()));
+  if (access_mode == kMemoryAccessPoisoned) {
+    Register value = i.OutputRegister();
+    codegen->tasm()->and_(value, value, kSpeculationPoisonRegister);
+  }
+}
+
 }  // namespace
 
 #define ASSEMBLE_FLOAT_UNOP_RC(asm_instr, round)                     \
@@ -779,21 +791,40 @@ void CodeGenerator::AssembleTailCallAfterGap(Instruction* instr,
                                 first_unused_stack_slot);
 }
 
+// Check that {kJavaScriptCallCodeStartRegister} is correct.
+void CodeGenerator::AssembleCodeStartRegisterCheck() {
+  Register scratch = kScratchReg;
+
+  Label current_pc;
+  __ mov_label_addr(scratch, &current_pc);
+
+  __ bind(&current_pc);
+  __ subi(scratch, scratch, Operand(__ pc_offset()));
+  __ cmp(scratch, kJavaScriptCallCodeStartRegister);
+  __ Assert(eq, AbortReason::kWrongFunctionCodeStart);
+}
+
 // Check if the code object is marked for deoptimization. If it is, then it
 // jumps to the CompileLazyDeoptimizedCode builtin. In order to do this we need
 // to:
-//    1. load the address of the current instruction;
-//    2. read from memory the word that contains that bit, which can be found in
+//    1. read from memory the word that contains that bit, which can be found in
 //       the flags in the referenced {CodeDataContainer} object;
-//    3. test kMarkedForDeoptimizationBit in those flags; and
-//    4. if it is not zero then it jumps to the builtin.
+//    2. test kMarkedForDeoptimizationBit in those flags; and
+//    3. if it is not zero then it jumps to the builtin.
 void CodeGenerator::BailoutIfDeoptimized() {
-  Label current;
-  __ mov_label_addr(r11, &current);
-  int pc_offset = __ pc_offset();
-  __ bind(&current);
-  int offset = Code::kCodeDataContainerOffset - (Code::kHeaderSize + pc_offset);
-  __ LoadP(r11, MemOperand(r11, offset));
+  if (FLAG_debug_code) {
+    // Check that {kJavaScriptCallCodeStartRegister} is correct.
+    Label current_pc;
+    __ mov_label_addr(ip, &current_pc);
+
+    __ bind(&current_pc);
+    __ subi(ip, ip, Operand(__ pc_offset()));
+    __ cmp(ip, kJavaScriptCallCodeStartRegister);
+    __ Assert(eq, AbortReason::kWrongFunctionCodeStart);
+  }
+
+  int offset = Code::kCodeDataContainerOffset - Code::kHeaderSize;
+  __ LoadP(r11, MemOperand(kJavaScriptCallCodeStartRegister, offset));
   __ LoadWordArith(
       r11, FieldMemOperand(r11, CodeDataContainer::kKindSpecificFlagsOffset));
   __ TestBit(r11, Code::kMarkedForDeoptimizationBit);
@@ -802,6 +833,30 @@ void CodeGenerator::BailoutIfDeoptimized() {
   __ Jump(code, RelocInfo::CODE_TARGET, ne, cr0);
 }
 
+void CodeGenerator::GenerateSpeculationPoisonFromCodeStartRegister() {
+  Register scratch = kScratchReg;
+
+  Label current_pc;
+  __ mov_label_addr(scratch, &current_pc);
+
+  __ bind(&current_pc);
+  __ subi(scratch, scratch, Operand(__ pc_offset()));
+
+  // Calculate a mask which has all bits set in the normal case, but has all
+  // bits cleared if we are speculatively executing the wrong PC.
+  __ cmp(kJavaScriptCallCodeStartRegister, scratch);
+  __ li(scratch, Operand::Zero());
+  __ notx(kSpeculationPoisonRegister, scratch);
+  __ isel(eq, kSpeculationPoisonRegister,
+          kSpeculationPoisonRegister, scratch);
+}
+
+void CodeGenerator::AssembleRegisterArgumentPoisoning() {
+  __ and_(kJSFunctionRegister, kJSFunctionRegister, kSpeculationPoisonRegister);
+  __ and_(kContextRegister, kContextRegister, kSpeculationPoisonRegister);
+  __ and_(sp, sp, kSpeculationPoisonRegister);
+}
+
 // Assembles an instruction after register allocation, producing machine code.
 CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     Instruction* instr) {
@@ -909,9 +964,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ cmp(cp, kScratchReg);
         __ Assert(eq, AbortReason::kWrongFunctionContext);
       }
-      __ LoadP(ip, FieldMemOperand(func, JSFunction::kCodeOffset));
-      __ addi(ip, ip, Operand(Code::kHeaderSize - kHeapObjectTag));
-      __ Call(ip);
+      static_assert(kJavaScriptCallCodeStartRegister == r5, "ABI mismatch");
+      __ LoadP(r5, FieldMemOperand(func, JSFunction::kCodeOffset));
+      __ addi(r5, r5, Operand(Code::kHeaderSize - kHeapObjectTag));
+      __ Call(r5);
       RecordCallPosition(instr);
       DCHECK_EQ(LeaveRC, i.OutputRCBit());
       frame_access_state()->ClearSPDelta();
@@ -1046,6 +1102,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mr(i.OutputRegister(), fp);
       }
       break;
+    case kArchRootsPointer:
+      __ mr(i.OutputRegister(), kRootRegister);
+      DCHECK_EQ(LeaveRC, i.OutputRCBit());
+      break;
     case kArchTruncateDoubleToI:
       // TODO(mbrandy): move slow call to stub out of line.
       __ TruncateDoubleToIDelayed(zone(), i.OutputRegister(),
@@ -1088,6 +1148,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
               Operand(offset.offset()));
       break;
     }
+    case kArchPoisonOnSpeculationWord:
+      __ and_(i.OutputRegister(), i.InputRegister(0),
+              kSpeculationPoisonRegister);
+      break;
     case kPPC_And:
       if (HasRegisterInput(instr, 1)) {
         __ and_(i.OutputRegister(), i.InputRegister(0), i.InputRegister(1),
@@ -1808,26 +1872,33 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
 #endif
     case kPPC_LoadWordU8:
       ASSEMBLE_LOAD_INTEGER(lbz, lbzx);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kPPC_LoadWordS8:
       ASSEMBLE_LOAD_INTEGER(lbz, lbzx);
       __ extsb(i.OutputRegister(), i.OutputRegister());
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kPPC_LoadWordU16:
       ASSEMBLE_LOAD_INTEGER(lhz, lhzx);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kPPC_LoadWordS16:
       ASSEMBLE_LOAD_INTEGER(lha, lhax);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kPPC_LoadWordU32:
       ASSEMBLE_LOAD_INTEGER(lwz, lwzx);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kPPC_LoadWordS32:
       ASSEMBLE_LOAD_INTEGER(lwa, lwax);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
 #if V8_TARGET_ARCH_PPC64
     case kPPC_LoadWord64:
       ASSEMBLE_LOAD_INTEGER(ld, ldx);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
 #endif
     case kPPC_LoadFloat32:
@@ -1856,47 +1927,47 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kPPC_StoreDouble:
       ASSEMBLE_STORE_DOUBLE();
       break;
-    case kAtomicLoadInt8:
+    case kWord32AtomicLoadInt8:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(lbz, lbzx);
       __ extsb(i.OutputRegister(), i.OutputRegister());
       break;
-    case kAtomicLoadUint8:
+    case kWord32AtomicLoadUint8:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(lbz, lbzx);
       break;
-    case kAtomicLoadInt16:
+    case kWord32AtomicLoadInt16:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(lha, lhax);
       break;
-    case kAtomicLoadUint16:
+    case kWord32AtomicLoadUint16:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(lhz, lhzx);
       break;
-    case kAtomicLoadWord32:
+    case kWord32AtomicLoadWord32:
       ASSEMBLE_ATOMIC_LOAD_INTEGER(lwz, lwzx);
       break;
 
-    case kAtomicStoreWord8:
+    case kWord32AtomicStoreWord8:
       ASSEMBLE_ATOMIC_STORE_INTEGER(stb, stbx);
       break;
-    case kAtomicStoreWord16:
+    case kWord32AtomicStoreWord16:
       ASSEMBLE_ATOMIC_STORE_INTEGER(sth, sthx);
       break;
-    case kAtomicStoreWord32:
+    case kWord32AtomicStoreWord32:
       ASSEMBLE_ATOMIC_STORE_INTEGER(stw, stwx);
       break;
-    case kAtomicExchangeInt8:
+    case kWord32AtomicExchangeInt8:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(lbarx, stbcx);
       __ extsb(i.OutputRegister(0), i.OutputRegister(0));
       break;
-    case kAtomicExchangeUint8:
+    case kWord32AtomicExchangeUint8:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(lbarx, stbcx);
       break;
-    case kAtomicExchangeInt16:
+    case kWord32AtomicExchangeInt16:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(lharx, sthcx);
       __ extsh(i.OutputRegister(0), i.OutputRegister(0));
       break;
-    case kAtomicExchangeUint16:
+    case kWord32AtomicExchangeUint16:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(lharx, sthcx);
       break;
-    case kAtomicExchangeWord32:
+    case kWord32AtomicExchangeWord32:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(lwarx, stwcx);
       break;
     default:
@@ -1931,6 +2002,20 @@ void CodeGenerator::AssembleArchBranch(Instruction* instr, BranchInfo* branch) {
   if (!branch->fallthru) __ b(flabel);  // no fallthru to flabel.
 }
 
+void CodeGenerator::AssembleBranchPoisoning(FlagsCondition condition,
+                                            Instruction* instr) {
+  // TODO(John) Handle float comparisons (kUnordered[Not]Equal).
+  if (condition == kUnorderedEqual || condition == kUnorderedNotEqual) {
+    return;
+  }
+
+  ArchOpcode op = instr->arch_opcode();
+  condition = NegateFlagsCondition(condition);
+  __ li(kScratchReg, Operand::Zero());
+  __ isel(FlagsConditionToCondition(condition, op), kSpeculationPoisonRegister,
+          kScratchReg, kSpeculationPoisonRegister, cr0);
+}
+
 void CodeGenerator::AssembleArchDeoptBranch(Instruction* instr,
                                             BranchInfo* branch) {
   AssembleArchBranch(instr, branch);
@@ -1978,8 +2063,9 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                              __ isolate()),
                          0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
-        CallDescriptor* descriptor = gen_->linkage()->GetIncomingDescriptor();
-        int pop_count = static_cast<int>(descriptor->StackParameterCount());
+        auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
+        int pop_count =
+            static_cast<int>(call_descriptor->StackParameterCount());
         __ Drop(pop_count);
         __ Ret();
       } else {
@@ -2109,8 +2195,8 @@ void CodeGenerator::AssembleArchTableSwitch(Instruction* instr) {
 }
 
 void CodeGenerator::FinishFrame(Frame* frame) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
-  const RegList double_saves = descriptor->CalleeSavedFPRegisters();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
+  const RegList double_saves = call_descriptor->CalleeSavedFPRegisters();
 
   // Save callee-saved Double registers.
   if (double_saves != 0) {
@@ -2121,10 +2207,10 @@ void CodeGenerator::FinishFrame(Frame* frame) {
                                              (kDoubleSize / kPointerSize));
   }
   // Save callee-saved registers.
-  const RegList saves =
-      FLAG_enable_embedded_constant_pool
-          ? descriptor->CalleeSavedRegisters() & ~kConstantPoolRegister.bit()
-          : descriptor->CalleeSavedRegisters();
+  const RegList saves = FLAG_enable_embedded_constant_pool
+                            ? call_descriptor->CalleeSavedRegisters() &
+                                  ~kConstantPoolRegister.bit()
+                            : call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     // register save area does not include the fp or constant pool pointer.
     const int num_saves =
@@ -2135,9 +2221,9 @@ void CodeGenerator::FinishFrame(Frame* frame) {
 }
 
 void CodeGenerator::AssembleConstructFrame() {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
   if (frame_access_state()->has_frame()) {
-    if (descriptor->IsCFunctionCall()) {
+    if (call_descriptor->IsCFunctionCall()) {
       __ function_descriptor();
       __ mflr(r0);
       if (FLAG_enable_embedded_constant_pool) {
@@ -2148,9 +2234,9 @@ void CodeGenerator::AssembleConstructFrame() {
         __ Push(r0, fp);
         __ mr(fp, sp);
       }
-    } else if (descriptor->IsJSFunctionCall()) {
-      __ Prologue(ip);
-      if (descriptor->PushArgumentCount()) {
+    } else if (call_descriptor->IsJSFunctionCall()) {
+      __ Prologue();
+      if (call_descriptor->PushArgumentCount()) {
         __ Push(kJavaScriptCallArgCountRegister);
       }
     } else {
@@ -2161,8 +2247,8 @@ void CodeGenerator::AssembleConstructFrame() {
     }
   }
 
-  int shrink_slots =
-      frame()->GetTotalFrameSlotCount() - descriptor->CalculateFixedFrameSize();
+  int shrink_slots = frame()->GetTotalFrameSlotCount() -
+                     call_descriptor->CalculateFixedFrameSize();
   if (info()->is_osr()) {
     // TurboFan OSR-compiled functions cannot be entered directly.
     __ Abort(AbortReason::kShouldNotDirectlyEnterOsrFunction);
@@ -2174,9 +2260,10 @@ void CodeGenerator::AssembleConstructFrame() {
     if (FLAG_code_comments) __ RecordComment("-- OSR entrypoint --");
     osr_pc_offset_ = __ pc_offset();
     shrink_slots -= osr_helper()->UnoptimizedFrameSlots();
+    ResetSpeculationPoison();
   }
 
-  const RegList double_saves = descriptor->CalleeSavedFPRegisters();
+  const RegList double_saves = call_descriptor->CalleeSavedFPRegisters();
   if (shrink_slots > 0) {
     __ Add(sp, sp, -shrink_slots * kPointerSize, r0);
   }
@@ -2189,10 +2276,10 @@ void CodeGenerator::AssembleConstructFrame() {
   }
 
   // Save callee-saved registers.
-  const RegList saves =
-      FLAG_enable_embedded_constant_pool
-          ? descriptor->CalleeSavedRegisters() & ~kConstantPoolRegister.bit()
-          : descriptor->CalleeSavedRegisters();
+  const RegList saves = FLAG_enable_embedded_constant_pool
+                            ? call_descriptor->CalleeSavedRegisters() &
+                                  ~kConstantPoolRegister.bit()
+                            : call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     __ MultiPush(saves);
     // register save area does not include the fp or constant pool pointer.
@@ -2200,26 +2287,26 @@ void CodeGenerator::AssembleConstructFrame() {
 }
 
 void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
-  int pop_count = static_cast<int>(descriptor->StackParameterCount());
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
+  int pop_count = static_cast<int>(call_descriptor->StackParameterCount());
 
   // Restore registers.
-  const RegList saves =
-      FLAG_enable_embedded_constant_pool
-          ? descriptor->CalleeSavedRegisters() & ~kConstantPoolRegister.bit()
-          : descriptor->CalleeSavedRegisters();
+  const RegList saves = FLAG_enable_embedded_constant_pool
+                            ? call_descriptor->CalleeSavedRegisters() &
+                                  ~kConstantPoolRegister.bit()
+                            : call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     __ MultiPop(saves);
   }
 
   // Restore double registers.
-  const RegList double_saves = descriptor->CalleeSavedFPRegisters();
+  const RegList double_saves = call_descriptor->CalleeSavedFPRegisters();
   if (double_saves != 0) {
     __ MultiPopDoubles(double_saves);
   }
   PPCOperandConverter g(this, nullptr);
 
-  if (descriptor->IsCFunctionCall()) {
+  if (call_descriptor->IsCFunctionCall()) {
     AssembleDeconstructFrame();
   } else if (frame_access_state()->has_frame()) {
     // Canonicalize JSFunction return sites for now unless they have an variable
@@ -2281,7 +2368,7 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
       switch (src.type()) {
         case Constant::kInt32:
 #if V8_TARGET_ARCH_PPC64
-          if (RelocInfo::IsWasmSizeReference(src.rmode())) {
+          if (false) {
 #else
           if (RelocInfo::IsWasmReference(src.rmode())) {
 #endif
@@ -2295,7 +2382,6 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
           if (RelocInfo::IsWasmPtrReference(src.rmode())) {
             __ mov(dst, Operand(src.ToInt64(), src.rmode()));
           } else {
-            DCHECK(!RelocInfo::IsWasmSizeReference(src.rmode()));
 #endif
             __ mov(dst, Operand(src.ToInt64()));
 #if V8_TARGET_ARCH_PPC64
diff --git a/deps/v8/src/compiler/ppc/instruction-selector-ppc.cc b/deps/v8/src/compiler/ppc/instruction-selector-ppc.cc
index fced5565dfa..5ad68043d7a 100644
--- a/deps/v8/src/compiler/ppc/instruction-selector-ppc.cc
+++ b/deps/v8/src/compiler/ppc/instruction-selector-ppc.cc
@@ -39,9 +39,9 @@ class PPCOperandGenerator final : public OperandGenerator {
   bool CanBeImmediate(Node* node, ImmediateMode mode) {
     int64_t value;
     if (node->opcode() == IrOpcode::kInt32Constant)
-      value = OpParameter<int32_t>(node);
+      value = OpParameter<int32_t>(node->op());
     else if (node->opcode() == IrOpcode::kInt64Constant)
-      value = OpParameter<int64_t>(node);
+      value = OpParameter<int64_t>(node->op());
     else
       return false;
     return CanBeImmediate(value, mode);
@@ -129,11 +129,6 @@ void VisitBinop(InstructionSelector* selector, Node* node,
   inputs[input_count++] = g.UseRegister(m.left().node());
   inputs[input_count++] = g.UseOperand(m.right().node(), operand_mode);
 
-  if (cont->IsBranch()) {
-    inputs[input_count++] = g.Label(cont->true_block());
-    inputs[input_count++] = g.Label(cont->false_block());
-  }
-
   if (cont->IsDeoptimize()) {
     // If we can deoptimize as a result of the binop, we need to make sure that
     // the deopt inputs are not overwritten by the binop result. One way
@@ -142,26 +137,14 @@ void VisitBinop(InstructionSelector* selector, Node* node,
   } else {
     outputs[output_count++] = g.DefineAsRegister(node);
   }
-  if (cont->IsSet()) {
-    outputs[output_count++] = g.DefineAsRegister(cont->result());
-  }
 
   DCHECK_NE(0u, input_count);
   DCHECK_NE(0u, output_count);
   DCHECK_GE(arraysize(inputs), input_count);
   DCHECK_GE(arraysize(outputs), output_count);
 
-  opcode = cont->Encode(opcode);
-  if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, output_count, outputs, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsTrap()) {
-    inputs[input_count++] = g.UseImmediate(cont->trap_id());
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  } else {
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, output_count, outputs, input_count,
+            inputs, cont);
 }
 
 
@@ -194,7 +177,7 @@ void InstructionSelector::VisitLoad(Node* node) {
   PPCOperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* offset = node->InputAt(1);
-  ArchOpcode opcode = kArchNop;
+  InstructionCode opcode = kArchNop;
   ImmediateMode mode = kInt16Imm;
   switch (load_rep.representation()) {
     case MachineRepresentation::kFloat32:
@@ -234,6 +217,12 @@ void InstructionSelector::VisitLoad(Node* node) {
       UNREACHABLE();
       return;
   }
+
+  if (node->opcode() == IrOpcode::kPoisonedLoad &&
+      poisoning_enabled_ == PoisoningMitigationLevel::kOn) {
+    opcode |= MiscField::encode(kMemoryAccessPoisoned);
+  }
+
   if (g.CanBeImmediate(offset, mode)) {
     Emit(opcode | AddressingModeField::encode(kMode_MRI),
          g.DefineAsRegister(node), g.UseRegister(base), g.UseImmediate(offset));
@@ -246,6 +235,8 @@ void InstructionSelector::VisitLoad(Node* node) {
   }
 }
 
+void InstructionSelector::VisitPoisonedLoad(Node* node) { VisitLoad(node); }
+
 void InstructionSelector::VisitProtectedLoad(Node* node) {
   // TODO(eholk)
   UNIMPLEMENTED();
@@ -1118,6 +1109,16 @@ void InstructionSelector::VisitTruncateFloat64ToUint32(Node* node) {
   VisitRR(this, kPPC_DoubleToUint32, node);
 }
 
+void InstructionSelector::VisitSignExtendWord8ToInt32(Node* node) {
+  // TODO(mbrandy): inspect input to see if nop is appropriate.
+  VisitRR(this, kPPC_ExtendSignWord8, node);
+}
+
+void InstructionSelector::VisitSignExtendWord16ToInt32(Node* node) {
+  // TODO(mbrandy): inspect input to see if nop is appropriate.
+  VisitRR(this, kPPC_ExtendSignWord16, node);
+}
+
 #if V8_TARGET_ARCH_PPC64
 void InstructionSelector::VisitTryTruncateFloat32ToInt64(Node* node) {
   VisitTryTruncateDouble(this, kPPC_DoubleToInt64, node);
@@ -1144,6 +1145,20 @@ void InstructionSelector::VisitChangeInt32ToInt64(Node* node) {
   VisitRR(this, kPPC_ExtendSignWord32, node);
 }
 
+void InstructionSelector::VisitSignExtendWord8ToInt64(Node* node) {
+  // TODO(mbrandy): inspect input to see if nop is appropriate.
+  VisitRR(this, kPPC_ExtendSignWord8, node);
+}
+
+void InstructionSelector::VisitSignExtendWord16ToInt64(Node* node) {
+  // TODO(mbrandy): inspect input to see if nop is appropriate.
+  VisitRR(this, kPPC_ExtendSignWord16, node);
+}
+
+void InstructionSelector::VisitSignExtendWord32ToInt64(Node* node) {
+  // TODO(mbrandy): inspect input to see if nop is appropriate.
+  VisitRR(this, kPPC_ExtendSignWord32, node);
+}
 
 void InstructionSelector::VisitChangeUint32ToUint64(Node* node) {
   // TODO(mbrandy): inspect input to see if nop is appropriate.
@@ -1454,22 +1469,7 @@ namespace {
 void VisitCompare(InstructionSelector* selector, InstructionCode opcode,
                   InstructionOperand left, InstructionOperand right,
                   FlagsContinuation* cont) {
-  PPCOperandGenerator g(selector);
-  opcode = cont->Encode(opcode);
-  if (cont->IsBranch()) {
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.Label(cont->true_block()), g.Label(cont->false_block()));
-  } else if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, g.NoOutput(), left, right, cont->kind(),
-                             cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsSet()) {
-    selector->Emit(opcode, g.DefineAsRegister(cont->result()), left, right);
-  } else {
-    DCHECK(cont->IsTrap());
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.UseImmediate(cont->trap_id()));
-  }
+  selector->EmitWithContinuation(opcode, left, right, cont);
 }
 
 
@@ -1533,14 +1533,13 @@ void VisitFloat64Compare(InstructionSelector* selector, Node* node,
                g.UseRegister(right), cont);
 }
 
+}  // namespace
 
 // Shared routine for word comparisons against zero.
-void VisitWordCompareZero(InstructionSelector* selector, Node* user,
-                          Node* value, InstructionCode opcode,
-                          FlagsContinuation* cont) {
+void InstructionSelector::VisitWordCompareZero(Node* user, Node* value,
+                                               FlagsContinuation* cont) {
   // Try to combine with comparisons against 0 by simply inverting the branch.
-  while (value->opcode() == IrOpcode::kWord32Equal &&
-         selector->CanCover(user, value)) {
+  while (value->opcode() == IrOpcode::kWord32Equal && CanCover(user, value)) {
     Int32BinopMatcher m(value);
     if (!m.right().Is(0)) break;
 
@@ -1549,58 +1548,58 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
     cont->Negate();
   }
 
-  if (selector->CanCover(user, value)) {
+  if (CanCover(user, value)) {
     switch (value->opcode()) {
       case IrOpcode::kWord32Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kInt32LessThan:
         cont->OverwriteAndNegateIfEqual(kSignedLessThan);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kInt32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kSignedLessThanOrEqual);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kUint32LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kUint32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
 #if V8_TARGET_ARCH_PPC64
       case IrOpcode::kWord64Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kInt64LessThan:
         cont->OverwriteAndNegateIfEqual(kSignedLessThan);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kInt64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kSignedLessThanOrEqual);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kUint64LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kUint64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
 #endif
       case IrOpcode::kFloat32Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat64Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kProjection:
         // Check if this is the overflow output projection of an
         // <Operation>WithOverflow node.
@@ -1612,28 +1611,27 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
           // *AFTER* this branch).
           Node* const node = value->InputAt(0);
           Node* const result = NodeProperties::FindProjection(node, 0);
-          if (result == nullptr || selector->IsDefined(result)) {
+          if (result == nullptr || IsDefined(result)) {
             switch (node->opcode()) {
               case IrOpcode::kInt32AddWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
                 return VisitBinop<Int32BinopMatcher>(
-                    selector, node, kPPC_AddWithOverflow32, kInt16Imm, cont);
+                    this, node, kPPC_AddWithOverflow32, kInt16Imm, cont);
               case IrOpcode::kInt32SubWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop<Int32BinopMatcher>(selector, node,
-                                                     kPPC_SubWithOverflow32,
-                                                     kInt16Imm_Negate, cont);
+                return VisitBinop<Int32BinopMatcher>(
+                    this, node, kPPC_SubWithOverflow32, kInt16Imm_Negate, cont);
               case IrOpcode::kInt32MulWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kNotEqual);
-                return EmitInt32MulWithOverflow(selector, node, cont);
+                return EmitInt32MulWithOverflow(this, node, cont);
 #if V8_TARGET_ARCH_PPC64
               case IrOpcode::kInt64AddWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop<Int64BinopMatcher>(selector, node, kPPC_Add64,
+                return VisitBinop<Int64BinopMatcher>(this, node, kPPC_Add64,
                                                      kInt16Imm, cont);
               case IrOpcode::kInt64SubWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop<Int64BinopMatcher>(selector, node, kPPC_Sub,
+                return VisitBinop<Int64BinopMatcher>(this, node, kPPC_Sub,
                                                      kInt16Imm_Negate, cont);
 #endif
               default:
@@ -1643,10 +1641,10 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
         }
         break;
       case IrOpcode::kInt32Sub:
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kWord32And:
         // TODO(mbandy): opportunity for rlwinm?
-        return VisitWordCompare(selector, value, kPPC_Tst32, cont, true,
+        return VisitWordCompare(this, value, kPPC_Tst32, cont, true,
                                 kInt16Imm_Unsigned);
 // TODO(mbrandy): Handle?
 // case IrOpcode::kInt32Add:
@@ -1658,10 +1656,10 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
 // case IrOpcode::kWord32Ror:
 #if V8_TARGET_ARCH_PPC64
       case IrOpcode::kInt64Sub:
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kWord64And:
         // TODO(mbandy): opportunity for rldic?
-        return VisitWordCompare(selector, value, kPPC_Tst64, cont, true,
+        return VisitWordCompare(this, value, kPPC_Tst64, cont, true,
                                 kInt16Imm_Unsigned);
 // TODO(mbrandy): Handle?
 // case IrOpcode::kInt64Add:
@@ -1678,84 +1676,36 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
   }
 
   // Branch could not be combined with a compare, emit compare against 0.
-  PPCOperandGenerator g(selector);
-  VisitCompare(selector, opcode, g.UseRegister(value), g.TempImmediate(0),
+  PPCOperandGenerator g(this);
+  VisitCompare(this, kPPC_Cmp32, g.UseRegister(value), g.TempImmediate(0),
                cont);
 }
 
-
-void VisitWord32CompareZero(InstructionSelector* selector, Node* user,
-                            Node* value, FlagsContinuation* cont) {
-  VisitWordCompareZero(selector, user, value, kPPC_Cmp32, cont);
-}
-
-
-#if V8_TARGET_ARCH_PPC64
-void VisitWord64CompareZero(InstructionSelector* selector, Node* user,
-                            Node* value, FlagsContinuation* cont) {
-  VisitWordCompareZero(selector, user, value, kPPC_Cmp64, cont);
-}
-#endif
-
-}  // namespace
-
-
-void InstructionSelector::VisitBranch(Node* branch, BasicBlock* tbranch,
-                                      BasicBlock* fbranch) {
-  FlagsContinuation cont(kNotEqual, tbranch, fbranch);
-  VisitWord32CompareZero(this, branch, branch->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeIf(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kNotEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWord32CompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeUnless(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWord32CompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapIf(Node* node, Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kNotEqual, func_id, node->InputAt(1));
-  VisitWord32CompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapUnless(Node* node,
-                                          Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kEqual, func_id, node->InputAt(1));
-  VisitWord32CompareZero(this, node, node->InputAt(0), &cont);
-}
-
 void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
   PPCOperandGenerator g(this);
   InstructionOperand value_operand = g.UseRegister(node->InputAt(0));
 
   // Emit either ArchTableSwitch or ArchLookupSwitch.
-  static const size_t kMaxTableSwitchValueRange = 2 << 16;
-  size_t table_space_cost = 4 + sw.value_range;
-  size_t table_time_cost = 3;
-  size_t lookup_space_cost = 3 + 2 * sw.case_count;
-  size_t lookup_time_cost = sw.case_count;
-  if (sw.case_count > 0 &&
-      table_space_cost + 3 * table_time_cost <=
-          lookup_space_cost + 3 * lookup_time_cost &&
-      sw.min_value > std::numeric_limits<int32_t>::min() &&
-      sw.value_range <= kMaxTableSwitchValueRange) {
-    InstructionOperand index_operand = value_operand;
-    if (sw.min_value) {
-      index_operand = g.TempRegister();
-      Emit(kPPC_Sub, index_operand, value_operand,
-           g.TempImmediate(sw.min_value));
+  if (enable_switch_jump_table_ == kEnableSwitchJumpTable) {
+    static const size_t kMaxTableSwitchValueRange = 2 << 16;
+    size_t table_space_cost = 4 + sw.value_range();
+    size_t table_time_cost = 3;
+    size_t lookup_space_cost = 3 + 2 * sw.case_count();
+    size_t lookup_time_cost = sw.case_count();
+    if (sw.case_count() > 0 &&
+        table_space_cost + 3 * table_time_cost <=
+            lookup_space_cost + 3 * lookup_time_cost &&
+        sw.min_value() > std::numeric_limits<int32_t>::min() &&
+        sw.value_range() <= kMaxTableSwitchValueRange) {
+      InstructionOperand index_operand = value_operand;
+      if (sw.min_value()) {
+        index_operand = g.TempRegister();
+        Emit(kPPC_Sub, index_operand, value_operand,
+             g.TempImmediate(sw.min_value()));
+      }
+      // Generate a table lookup.
+      return EmitTableSwitch(sw, index_operand);
     }
-    // Generate a table lookup.
-    return EmitTableSwitch(sw, index_operand);
   }
 
   // Generate a sequence of conditional jumps.
@@ -1765,10 +1715,6 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
 
 void InstructionSelector::VisitWord32Equal(Node* const node) {
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
-  Int32BinopMatcher m(node);
-  if (m.right().Is(0)) {
-    return VisitWord32CompareZero(this, m.node(), m.left().node(), &cont);
-  }
   VisitWord32Compare(this, node, &cont);
 }
 
@@ -1802,10 +1748,6 @@ void InstructionSelector::VisitUint32LessThanOrEqual(Node* node) {
 #if V8_TARGET_ARCH_PPC64
 void InstructionSelector::VisitWord64Equal(Node* const node) {
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
-  Int64BinopMatcher m(node);
-  if (m.right().Is(0)) {
-    return VisitWord64CompareZero(this, m.node(), m.left().node(), &cont);
-  }
   VisitWord64Compare(this, node, &cont);
 }
 
@@ -1883,16 +1825,15 @@ void InstructionSelector::VisitFloat64LessThanOrEqual(Node* node) {
   VisitFloat64Compare(this, node, &cont);
 }
 
-
 void InstructionSelector::EmitPrepareArguments(
-    ZoneVector<PushParameter>* arguments, const CallDescriptor* descriptor,
+    ZoneVector<PushParameter>* arguments, const CallDescriptor* call_descriptor,
     Node* node) {
   PPCOperandGenerator g(this);
 
   // Prepare for C function call.
-  if (descriptor->IsCFunctionCall()) {
-    Emit(kArchPrepareCallCFunction |
-             MiscField::encode(static_cast<int>(descriptor->ParameterCount())),
+  if (call_descriptor->IsCFunctionCall()) {
+    Emit(kArchPrepareCallCFunction | MiscField::encode(static_cast<int>(
+                                         call_descriptor->ParameterCount())),
          0, nullptr, 0, nullptr);
 
     // Poke any stack arguments.
@@ -1962,7 +1903,7 @@ void InstructionSelector::VisitFloat64InsertHighWord32(Node* node) {
        g.UseRegister(left), g.UseRegister(right));
 }
 
-void InstructionSelector::VisitAtomicLoad(Node* node) {
+void InstructionSelector::VisitWord32AtomicLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
   PPCOperandGenerator g(this);
   Node* base = node->InputAt(0);
@@ -1970,13 +1911,15 @@ void InstructionSelector::VisitAtomicLoad(Node* node) {
   ArchOpcode opcode = kArchNop;
   switch (load_rep.representation()) {
     case MachineRepresentation::kWord8:
-      opcode = load_rep.IsSigned() ? kAtomicLoadInt8 : kAtomicLoadUint8;
+      opcode =
+          load_rep.IsSigned() ? kWord32AtomicLoadInt8 : kWord32AtomicLoadUint8;
       break;
     case MachineRepresentation::kWord16:
-      opcode = load_rep.IsSigned() ? kAtomicLoadInt16 : kAtomicLoadUint16;
+      opcode = load_rep.IsSigned() ? kWord32AtomicLoadInt16
+                                   : kWord32AtomicLoadUint16;
       break;
     case MachineRepresentation::kWord32:
-      opcode = kAtomicLoadWord32;
+      opcode = kWord32AtomicLoadWord32;
       break;
     default:
       UNREACHABLE();
@@ -1986,7 +1929,7 @@ void InstructionSelector::VisitAtomicLoad(Node* node) {
       g.DefineAsRegister(node), g.UseRegister(base), g.UseRegister(index));
 }
 
-void InstructionSelector::VisitAtomicStore(Node* node) {
+void InstructionSelector::VisitWord32AtomicStore(Node* node) {
   MachineRepresentation rep = AtomicStoreRepresentationOf(node->op());
   PPCOperandGenerator g(this);
   Node* base = node->InputAt(0);
@@ -1995,13 +1938,13 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
   ArchOpcode opcode = kArchNop;
   switch (rep) {
     case MachineRepresentation::kWord8:
-      opcode = kAtomicStoreWord8;
+      opcode = kWord32AtomicStoreWord8;
       break;
     case MachineRepresentation::kWord16:
-      opcode = kAtomicStoreWord16;
+      opcode = kWord32AtomicStoreWord16;
       break;
     case MachineRepresentation::kWord32:
-      opcode = kAtomicStoreWord32;
+      opcode = kWord32AtomicStoreWord32;
       break;
     default:
       UNREACHABLE();
@@ -2017,7 +1960,7 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
       0, nullptr, input_count, inputs);
 }
 
-void InstructionSelector::VisitAtomicExchange(Node* node) {
+void InstructionSelector::VisitWord32AtomicExchange(Node* node) {
   PPCOperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -2025,15 +1968,15 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   ArchOpcode opcode = kArchNop;
   MachineType type = AtomicOpRepresentationOf(node->op());
   if (type == MachineType::Int8()) {
-    opcode = kAtomicExchangeInt8;
+    opcode = kWord32AtomicExchangeInt8;
   } else if (type == MachineType::Uint8()) {
-    opcode = kAtomicExchangeUint8;
+    opcode = kWord32AtomicExchangeUint8;
   } else if (type == MachineType::Int16()) {
-    opcode = kAtomicExchangeInt16;
+    opcode = kWord32AtomicExchangeInt16;
   } else if (type == MachineType::Uint16()) {
-    opcode = kAtomicExchangeUint16;
+    opcode = kWord32AtomicExchangeUint16;
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
-    opcode = kAtomicExchangeWord32;
+    opcode = kWord32AtomicExchangeWord32;
   } else {
     UNREACHABLE();
     return;
@@ -2051,19 +1994,19 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   Emit(code, 1, outputs, input_count, inputs);
 }
 
-void InstructionSelector::VisitAtomicCompareExchange(Node* node) {
+void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitAtomicAdd(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitWord32AtomicAdd(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitAtomicSub(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitWord32AtomicSub(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitAtomicAnd(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitWord32AtomicAnd(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitAtomicOr(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitWord32AtomicOr(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitAtomicXor(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitWord32AtomicXor(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitInt32AbsWithOverflow(Node* node) {
   UNREACHABLE();
@@ -2241,9 +2184,9 @@ void InstructionSelector::VisitF32x4ExtractLane(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitF32x4ReplaceLane(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::EmitPrepareResults(ZoneVector<PushParameter>* results,
-                                             const CallDescriptor* descriptor,
-                                             Node* node) {
+void InstructionSelector::EmitPrepareResults(
+    ZoneVector<PushParameter>* results, const CallDescriptor* call_descriptor,
+    Node* node) {
   // TODO(John): Port.
 }
 
@@ -2257,6 +2200,18 @@ void InstructionSelector::VisitF32x4Min(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitF32x4Max(Node* node) { UNIMPLEMENTED(); }
 
+void InstructionSelector::VisitS128Select(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF32x4Neg(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF32x4Abs(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF32x4RecipSqrtApprox(Node* node) {
+  UNIMPLEMENTED();
+}
+
+void InstructionSelector::VisitF32x4RecipApprox(Node* node) { UNIMPLEMENTED(); }
+
 // static
 MachineOperatorBuilder::Flags
 InstructionSelector::SupportedMachineOperatorFlags() {
diff --git a/deps/v8/src/compiler/property-access-builder.cc b/deps/v8/src/compiler/property-access-builder.cc
index bead0618f69..284da9350ae 100644
--- a/deps/v8/src/compiler/property-access-builder.cc
+++ b/deps/v8/src/compiler/property-access-builder.cc
@@ -47,32 +47,17 @@ bool HasOnlyNumberMaps(MapHandles const& maps) {
   return true;
 }
 
-bool HasOnlySequentialStringMaps(MapHandles const& maps) {
-  for (auto map : maps) {
-    if (!map->IsStringMap()) return false;
-    if (!StringShape(map->instance_type()).IsSequential()) {
-      return false;
-    }
-  }
-  return true;
-}
-
 }  // namespace
 
 bool PropertyAccessBuilder::TryBuildStringCheck(MapHandles const& maps,
                                                 Node** receiver, Node** effect,
                                                 Node* control) {
   if (HasOnlyStringMaps(maps)) {
-    if (HasOnlySequentialStringMaps(maps)) {
-      *receiver = *effect = graph()->NewNode(simplified()->CheckSeqString(),
-                                             *receiver, *effect, control);
-    } else {
-      // Monormorphic string access (ignoring the fact that there are multiple
-      // String maps).
-      *receiver = *effect =
-          graph()->NewNode(simplified()->CheckString(VectorSlotPair()),
-                           *receiver, *effect, control);
-    }
+    // Monormorphic string access (ignoring the fact that there are multiple
+    // String maps).
+    *receiver = *effect =
+        graph()->NewNode(simplified()->CheckString(VectorSlotPair()), *receiver,
+                         *effect, control);
     return true;
   }
   return false;
diff --git a/deps/v8/src/compiler/raw-machine-assembler.cc b/deps/v8/src/compiler/raw-machine-assembler.cc
index ed67c06cc76..5345cb0dce8 100644
--- a/deps/v8/src/compiler/raw-machine-assembler.cc
+++ b/deps/v8/src/compiler/raw-machine-assembler.cc
@@ -16,7 +16,8 @@ namespace compiler {
 RawMachineAssembler::RawMachineAssembler(
     Isolate* isolate, Graph* graph, CallDescriptor* call_descriptor,
     MachineRepresentation word, MachineOperatorBuilder::Flags flags,
-    MachineOperatorBuilder::AlignmentRequirements alignment_requirements)
+    MachineOperatorBuilder::AlignmentRequirements alignment_requirements,
+    PoisoningMitigationLevel poisoning_enabled)
     : isolate_(isolate),
       graph_(graph),
       schedule_(new (zone()) Schedule(zone())),
@@ -24,7 +25,8 @@ RawMachineAssembler::RawMachineAssembler(
       common_(zone()),
       call_descriptor_(call_descriptor),
       parameters_(parameter_count(), zone()),
-      current_block_(schedule()->start()) {
+      current_block_(schedule()->start()),
+      poisoning_enabled_(poisoning_enabled) {
   int param_count = static_cast<int>(parameter_count());
   // Add an extra input for the JSFunction parameter to the start node.
   graph->SetStart(graph->NewNode(common_.Start(param_count + 1)));
@@ -88,7 +90,9 @@ void RawMachineAssembler::Goto(RawMachineLabel* label) {
 void RawMachineAssembler::Branch(Node* condition, RawMachineLabel* true_val,
                                  RawMachineLabel* false_val) {
   DCHECK(current_block_ != schedule()->end());
-  Node* branch = MakeNode(common()->Branch(), 1, &condition);
+  Node* branch = MakeNode(
+      common()->Branch(BranchHint::kNone, IsSafetyCheck::kNoSafetyCheck), 1,
+      &condition);
   schedule()->AddBranch(CurrentBlock(), branch, Use(true_val), Use(false_val));
   current_block_ = nullptr;
 }
@@ -212,28 +216,29 @@ void RawMachineAssembler::Comment(const char* msg) {
   AddNode(machine()->Comment(msg));
 }
 
-Node* RawMachineAssembler::CallN(CallDescriptor* desc, int input_count,
-                                 Node* const* inputs) {
-  DCHECK(!desc->NeedsFrameState());
+Node* RawMachineAssembler::CallN(CallDescriptor* call_descriptor,
+                                 int input_count, Node* const* inputs) {
+  DCHECK(!call_descriptor->NeedsFrameState());
   // +1 is for target.
-  DCHECK_EQ(input_count, desc->ParameterCount() + 1);
-  return AddNode(common()->Call(desc), input_count, inputs);
+  DCHECK_EQ(input_count, call_descriptor->ParameterCount() + 1);
+  return AddNode(common()->Call(call_descriptor), input_count, inputs);
 }
 
-Node* RawMachineAssembler::CallNWithFrameState(CallDescriptor* desc,
+Node* RawMachineAssembler::CallNWithFrameState(CallDescriptor* call_descriptor,
                                                int input_count,
                                                Node* const* inputs) {
-  DCHECK(desc->NeedsFrameState());
+  DCHECK(call_descriptor->NeedsFrameState());
   // +2 is for target and frame state.
-  DCHECK_EQ(input_count, desc->ParameterCount() + 2);
-  return AddNode(common()->Call(desc), input_count, inputs);
+  DCHECK_EQ(input_count, call_descriptor->ParameterCount() + 2);
+  return AddNode(common()->Call(call_descriptor), input_count, inputs);
 }
 
-Node* RawMachineAssembler::TailCallN(CallDescriptor* desc, int input_count,
-                                     Node* const* inputs) {
+Node* RawMachineAssembler::TailCallN(CallDescriptor* call_descriptor,
+                                     int input_count, Node* const* inputs) {
   // +1 is for target.
-  DCHECK_EQ(input_count, desc->ParameterCount() + 1);
-  Node* tail_call = MakeNode(common()->TailCall(desc), input_count, inputs);
+  DCHECK_EQ(input_count, call_descriptor->ParameterCount() + 1);
+  Node* tail_call =
+      MakeNode(common()->TailCall(call_descriptor), input_count, inputs);
   schedule()->AddTailCall(CurrentBlock(), tail_call);
   current_block_ = nullptr;
   return tail_call;
@@ -243,10 +248,10 @@ Node* RawMachineAssembler::CallCFunction0(MachineType return_type,
                                           Node* function) {
   MachineSignature::Builder builder(zone(), 1, 0);
   builder.AddReturn(return_type);
-  const CallDescriptor* descriptor =
+  auto call_descriptor =
       Linkage::GetSimplifiedCDescriptor(zone(), builder.Build());
 
-  return AddNode(common()->Call(descriptor), function);
+  return AddNode(common()->Call(call_descriptor), function);
 }
 
 
@@ -256,10 +261,10 @@ Node* RawMachineAssembler::CallCFunction1(MachineType return_type,
   MachineSignature::Builder builder(zone(), 1, 1);
   builder.AddReturn(return_type);
   builder.AddParam(arg0_type);
-  const CallDescriptor* descriptor =
+  auto call_descriptor =
       Linkage::GetSimplifiedCDescriptor(zone(), builder.Build());
 
-  return AddNode(common()->Call(descriptor), function, arg0);
+  return AddNode(common()->Call(call_descriptor), function, arg0);
 }
 
 Node* RawMachineAssembler::CallCFunction1WithCallerSavedRegisters(
@@ -268,13 +273,13 @@ Node* RawMachineAssembler::CallCFunction1WithCallerSavedRegisters(
   MachineSignature::Builder builder(zone(), 1, 1);
   builder.AddReturn(return_type);
   builder.AddParam(arg0_type);
-  CallDescriptor* descriptor =
+  auto call_descriptor =
       Linkage::GetSimplifiedCDescriptor(zone(), builder.Build());
 
-  descriptor->set_save_fp_mode(mode);
+  call_descriptor->set_save_fp_mode(mode);
 
-  return AddNode(common()->CallWithCallerSavedRegisters(descriptor), function,
-                 arg0);
+  return AddNode(common()->CallWithCallerSavedRegisters(call_descriptor),
+                 function, arg0);
 }
 
 Node* RawMachineAssembler::CallCFunction2(MachineType return_type,
@@ -285,10 +290,10 @@ Node* RawMachineAssembler::CallCFunction2(MachineType return_type,
   builder.AddReturn(return_type);
   builder.AddParam(arg0_type);
   builder.AddParam(arg1_type);
-  const CallDescriptor* descriptor =
+  auto call_descriptor =
       Linkage::GetSimplifiedCDescriptor(zone(), builder.Build());
 
-  return AddNode(common()->Call(descriptor), function, arg0, arg1);
+  return AddNode(common()->Call(call_descriptor), function, arg0, arg1);
 }
 
 Node* RawMachineAssembler::CallCFunction3(MachineType return_type,
@@ -301,10 +306,10 @@ Node* RawMachineAssembler::CallCFunction3(MachineType return_type,
   builder.AddParam(arg0_type);
   builder.AddParam(arg1_type);
   builder.AddParam(arg2_type);
-  const CallDescriptor* descriptor =
+  auto call_descriptor =
       Linkage::GetSimplifiedCDescriptor(zone(), builder.Build());
 
-  return AddNode(common()->Call(descriptor), function, arg0, arg1, arg2);
+  return AddNode(common()->Call(call_descriptor), function, arg0, arg1, arg2);
 }
 
 Node* RawMachineAssembler::CallCFunction3WithCallerSavedRegisters(
@@ -316,13 +321,13 @@ Node* RawMachineAssembler::CallCFunction3WithCallerSavedRegisters(
   builder.AddParam(arg0_type);
   builder.AddParam(arg1_type);
   builder.AddParam(arg2_type);
-  CallDescriptor* descriptor =
+  auto call_descriptor =
       Linkage::GetSimplifiedCDescriptor(zone(), builder.Build());
 
-  descriptor->set_save_fp_mode(mode);
+  call_descriptor->set_save_fp_mode(mode);
 
-  return AddNode(common()->CallWithCallerSavedRegisters(descriptor), function,
-                 arg0, arg1, arg2);
+  return AddNode(common()->CallWithCallerSavedRegisters(call_descriptor),
+                 function, arg0, arg1, arg2);
 }
 
 Node* RawMachineAssembler::CallCFunction4(
@@ -335,10 +340,11 @@ Node* RawMachineAssembler::CallCFunction4(
   builder.AddParam(arg1_type);
   builder.AddParam(arg2_type);
   builder.AddParam(arg3_type);
-  const CallDescriptor* descriptor =
+  auto call_descriptor =
       Linkage::GetSimplifiedCDescriptor(zone(), builder.Build());
 
-  return AddNode(common()->Call(descriptor), function, arg0, arg1, arg2, arg3);
+  return AddNode(common()->Call(call_descriptor), function, arg0, arg1, arg2,
+                 arg3);
 }
 
 Node* RawMachineAssembler::CallCFunction5(
@@ -353,11 +359,11 @@ Node* RawMachineAssembler::CallCFunction5(
   builder.AddParam(arg2_type);
   builder.AddParam(arg3_type);
   builder.AddParam(arg4_type);
-  const CallDescriptor* descriptor =
+  auto call_descriptor =
       Linkage::GetSimplifiedCDescriptor(zone(), builder.Build());
 
-  return AddNode(common()->Call(descriptor), function, arg0, arg1, arg2, arg3,
-                 arg4);
+  return AddNode(common()->Call(call_descriptor), function, arg0, arg1, arg2,
+                 arg3, arg4);
 }
 
 Node* RawMachineAssembler::CallCFunction6(
@@ -373,11 +379,11 @@ Node* RawMachineAssembler::CallCFunction6(
   builder.AddParam(arg3_type);
   builder.AddParam(arg4_type);
   builder.AddParam(arg5_type);
-  const CallDescriptor* descriptor =
+  auto call_descriptor =
       Linkage::GetSimplifiedCDescriptor(zone(), builder.Build());
 
-  return AddNode(common()->Call(descriptor), function, arg0, arg1, arg2, arg3,
-                 arg4, arg5);
+  return AddNode(common()->Call(call_descriptor), function, arg0, arg1, arg2,
+                 arg3, arg4, arg5);
 }
 
 Node* RawMachineAssembler::CallCFunction8(
@@ -397,9 +403,9 @@ Node* RawMachineAssembler::CallCFunction8(
   builder.AddParam(arg6_type);
   builder.AddParam(arg7_type);
   Node* args[] = {function, arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7};
-  const CallDescriptor* descriptor =
+  auto call_descriptor =
       Linkage::GetSimplifiedCDescriptor(zone(), builder.Build());
-  return AddNode(common()->Call(descriptor), arraysize(args), args);
+  return AddNode(common()->Call(call_descriptor), arraysize(args), args);
 }
 
 Node* RawMachineAssembler::CallCFunction9(
@@ -421,9 +427,9 @@ Node* RawMachineAssembler::CallCFunction9(
   builder.AddParam(arg8_type);
   Node* args[] = {function, arg0, arg1, arg2, arg3,
                   arg4,     arg5, arg6, arg7, arg8};
-  const CallDescriptor* descriptor =
+  auto call_descriptor =
       Linkage::GetSimplifiedCDescriptor(zone(), builder.Build());
-  return AddNode(common()->Call(descriptor), arraysize(args), args);
+  return AddNode(common()->Call(call_descriptor), arraysize(args), args);
 }
 
 BasicBlock* RawMachineAssembler::Use(RawMachineLabel* label) {
diff --git a/deps/v8/src/compiler/raw-machine-assembler.h b/deps/v8/src/compiler/raw-machine-assembler.h
index 1cc56b33794..4df4b105b9e 100644
--- a/deps/v8/src/compiler/raw-machine-assembler.h
+++ b/deps/v8/src/compiler/raw-machine-assembler.h
@@ -44,7 +44,9 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
           MachineOperatorBuilder::Flag::kNoFlags,
       MachineOperatorBuilder::AlignmentRequirements alignment_requirements =
           MachineOperatorBuilder::AlignmentRequirements::
-              FullUnalignedAccessSupport());
+              FullUnalignedAccessSupport(),
+      PoisoningMitigationLevel poisoning_enabled =
+          PoisoningMitigationLevel::kOn);
   ~RawMachineAssembler() {}
 
   Isolate* isolate() const { return isolate_; }
@@ -53,6 +55,9 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
   MachineOperatorBuilder* machine() { return &machine_; }
   CommonOperatorBuilder* common() { return &common_; }
   CallDescriptor* call_descriptor() const { return call_descriptor_; }
+  PoisoningMitigationLevel poisoning_enabled() const {
+    return poisoning_enabled_;
+  }
 
   // Finalizes the schedule and exports it to be used for code generation. Note
   // that this RawMachineAssembler becomes invalid after export.
@@ -116,11 +121,18 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
   }
 
   // Memory Operations.
-  Node* Load(MachineType rep, Node* base) {
-    return Load(rep, base, IntPtrConstant(0));
-  }
-  Node* Load(MachineType rep, Node* base, Node* index) {
-    return AddNode(machine()->Load(rep), base, index);
+  Node* Load(MachineType rep, Node* base,
+             LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
+    return Load(rep, base, IntPtrConstant(0), needs_poisoning);
+  }
+  Node* Load(MachineType rep, Node* base, Node* index,
+             LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
+    const Operator* op = machine()->Load(rep);
+    if (needs_poisoning == LoadSensitivity::kNeedsPoisoning &&
+        poisoning_enabled_ == PoisoningMitigationLevel::kOn) {
+      op = machine()->PoisonedLoad(rep);
+    }
+    return AddNode(op, base, index);
   }
   Node* Store(MachineRepresentation rep, Node* base, Node* value,
               WriteBarrierKind write_barrier) {
@@ -162,15 +174,15 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
 
   // Atomic memory operations.
   Node* AtomicLoad(MachineType type, Node* base, Node* index) {
-    return AddNode(machine()->AtomicLoad(type), base, index);
+    return AddNode(machine()->Word32AtomicLoad(type), base, index);
   }
   Node* AtomicStore(MachineRepresentation rep, Node* base, Node* index,
                     Node* value) {
-    return AddNode(machine()->AtomicStore(rep), base, index, value);
+    return AddNode(machine()->Word32AtomicStore(rep), base, index, value);
   }
 #define ATOMIC_FUNCTION(name)                                                 \
   Node* Atomic##name(MachineType rep, Node* base, Node* index, Node* value) { \
-    return AddNode(machine()->Atomic##name(rep), base, index, value);         \
+    return AddNode(machine()->Word32Atomic##name(rep), base, index, value);   \
   }
   ATOMIC_FUNCTION(Exchange);
   ATOMIC_FUNCTION(Add);
@@ -182,7 +194,7 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
 
   Node* AtomicCompareExchange(MachineType rep, Node* base, Node* index,
                               Node* old_value, Node* new_value) {
-    return AddNode(machine()->AtomicCompareExchange(rep), base, index,
+    return AddNode(machine()->Word32AtomicCompareExchange(rep), base, index,
                    old_value, new_value);
   }
 
@@ -723,6 +735,9 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
     return AddNode(machine()->LoadParentFramePointer());
   }
 
+  // Root pointer operations.
+  Node* LoadRootsPointer() { return AddNode(machine()->LoadRootsPointer()); }
+
   // Parameters.
   Node* Parameter(size_t index);
 
@@ -745,18 +760,32 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
     return HeapConstant(isolate()->factory()->InternalizeUtf8String(string));
   }
 
+  Node* PoisonOnSpeculationTagged(Node* value) {
+    if (poisoning_enabled_ == PoisoningMitigationLevel::kOn)
+      return AddNode(machine()->PoisonOnSpeculationTagged(), value);
+    return value;
+  }
+
+  Node* PoisonOnSpeculationWord(Node* value) {
+    if (poisoning_enabled_ == PoisoningMitigationLevel::kOn)
+      return AddNode(machine()->PoisonOnSpeculationWord(), value);
+    return value;
+  }
+
   // Call a given call descriptor and the given arguments.
   // The call target is passed as part of the {inputs} array.
-  Node* CallN(CallDescriptor* desc, int input_count, Node* const* inputs);
+  Node* CallN(CallDescriptor* call_descriptor, int input_count,
+              Node* const* inputs);
 
   // Call a given call descriptor and the given arguments and frame-state.
   // The call target and frame state are passed as part of the {inputs} array.
-  Node* CallNWithFrameState(CallDescriptor* desc, int input_count,
+  Node* CallNWithFrameState(CallDescriptor* call_descriptor, int input_count,
                             Node* const* inputs);
 
   // Tail call a given call descriptor and the given arguments.
   // The call target is passed as part of the {inputs} array.
-  Node* TailCallN(CallDescriptor* desc, int input_count, Node* const* inputs);
+  Node* TailCallN(CallDescriptor* call_descriptor, int input_count,
+                  Node* const* inputs);
 
   // Call to a C function with zero arguments.
   Node* CallCFunction0(MachineType return_type, Node* function);
@@ -904,6 +933,7 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
   CallDescriptor* call_descriptor_;
   NodeVector parameters_;
   BasicBlock* current_block_;
+  PoisoningMitigationLevel poisoning_enabled_;
 
   DISALLOW_COPY_AND_ASSIGN(RawMachineAssembler);
 };
diff --git a/deps/v8/src/compiler/redundancy-elimination.cc b/deps/v8/src/compiler/redundancy-elimination.cc
index eedf946fb69..25f42efdcd6 100644
--- a/deps/v8/src/compiler/redundancy-elimination.cc
+++ b/deps/v8/src/compiler/redundancy-elimination.cc
@@ -29,7 +29,6 @@ Reduction RedundancyElimination::Reduce(Node* node) {
     case IrOpcode::kCheckNotTaggedHole:
     case IrOpcode::kCheckNumber:
     case IrOpcode::kCheckReceiver:
-    case IrOpcode::kCheckSeqString:
     case IrOpcode::kCheckSmi:
     case IrOpcode::kCheckString:
     case IrOpcode::kCheckSymbol:
diff --git a/deps/v8/src/compiler/register-allocator-verifier.cc b/deps/v8/src/compiler/register-allocator-verifier.cc
index 452ff705bd3..8c150d975ad 100644
--- a/deps/v8/src/compiler/register-allocator-verifier.cc
+++ b/deps/v8/src/compiler/register-allocator-verifier.cc
@@ -167,14 +167,18 @@ void RegisterAllocatorVerifier::BuildConstraint(const InstructionOperand* op,
       constraint->value_ = unallocated->fixed_slot_index();
     } else {
       switch (unallocated->extended_policy()) {
-        case UnallocatedOperand::ANY:
+        case UnallocatedOperand::REGISTER_OR_SLOT:
         case UnallocatedOperand::NONE:
           if (sequence()->IsFP(vreg)) {
-            constraint->type_ = kNoneFP;
+            constraint->type_ = kRegisterOrSlotFP;
           } else {
-            constraint->type_ = kNone;
+            constraint->type_ = kRegisterOrSlot;
           }
           break;
+        case UnallocatedOperand::REGISTER_OR_SLOT_OR_CONSTANT:
+          DCHECK(!sequence()->IsFP(vreg));
+          constraint->type_ = kRegisterOrSlotOrConstant;
+          break;
         case UnallocatedOperand::FIXED_REGISTER:
           if (unallocated->HasSecondaryStorage()) {
             constraint->type_ = kRegisterAndSlot;
@@ -252,12 +256,16 @@ void RegisterAllocatorVerifier::CheckConstraint(
       CHECK_EQ(ElementSizeLog2Of(LocationOperand::cast(op)->representation()),
                constraint->value_);
       return;
-    case kNone:
+    case kRegisterOrSlot:
       CHECK_WITH_MSG(op->IsRegister() || op->IsStackSlot(), caller_info_);
       return;
-    case kNoneFP:
+    case kRegisterOrSlotFP:
       CHECK_WITH_MSG(op->IsFPRegister() || op->IsFPStackSlot(), caller_info_);
       return;
+    case kRegisterOrSlotOrConstant:
+      CHECK_WITH_MSG(op->IsRegister() || op->IsStackSlot() || op->IsConstant(),
+                     caller_info_);
+      return;
     case kSameAsFirst:
       CHECK_WITH_MSG(false, caller_info_);
       return;
diff --git a/deps/v8/src/compiler/register-allocator-verifier.h b/deps/v8/src/compiler/register-allocator-verifier.h
index a961f0012fd..140b3a3ef52 100644
--- a/deps/v8/src/compiler/register-allocator-verifier.h
+++ b/deps/v8/src/compiler/register-allocator-verifier.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_REGISTER_ALLOCATOR_VERIFIER_H_
-#define V8_REGISTER_ALLOCATOR_VERIFIER_H_
+#ifndef V8_COMPILER_REGISTER_ALLOCATOR_VERIFIER_H_
+#define V8_COMPILER_REGISTER_ALLOCATOR_VERIFIER_H_
 
 #include "src/compiler/instruction.h"
 #include "src/zone/zone-containers.h"
@@ -185,8 +185,9 @@ class RegisterAllocatorVerifier final : public ZoneObject {
     kFixedFPRegister,
     kSlot,
     kFixedSlot,
-    kNone,
-    kNoneFP,
+    kRegisterOrSlot,
+    kRegisterOrSlotFP,
+    kRegisterOrSlotOrConstant,
     kExplicit,
     kSameAsFirst,
     kRegisterAndSlot
@@ -270,4 +271,4 @@ class RegisterAllocatorVerifier final : public ZoneObject {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_COMPILER_REGISTER_ALLOCATOR_VERIFIER_H_
diff --git a/deps/v8/src/compiler/register-allocator.cc b/deps/v8/src/compiler/register-allocator.cc
index 7f65695ee2f..a75317914ae 100644
--- a/deps/v8/src/compiler/register-allocator.cc
+++ b/deps/v8/src/compiler/register-allocator.cc
@@ -261,7 +261,7 @@ UsePosition::UsePosition(LifetimePosition pos, InstructionOperand* operand,
     : operand_(operand), hint_(hint), next_(nullptr), pos_(pos), flags_(0) {
   DCHECK_IMPLIES(hint == nullptr, hint_type == UsePositionHintType::kNone);
   bool register_beneficial = true;
-  UsePositionType type = UsePositionType::kAny;
+  UsePositionType type = UsePositionType::kRegisterOrSlot;
   if (operand_ != nullptr && operand_->IsUnallocated()) {
     const UnallocatedOperand* unalloc = UnallocatedOperand::cast(operand_);
     if (unalloc->HasRegisterPolicy()) {
@@ -269,8 +269,11 @@ UsePosition::UsePosition(LifetimePosition pos, InstructionOperand* operand,
     } else if (unalloc->HasSlotPolicy()) {
       type = UsePositionType::kRequiresSlot;
       register_beneficial = false;
+    } else if (unalloc->HasRegisterOrSlotOrConstantPolicy()) {
+      type = UsePositionType::kRegisterOrSlotOrConstant;
+      register_beneficial = false;
     } else {
-      register_beneficial = !unalloc->HasAnyPolicy();
+      register_beneficial = !unalloc->HasRegisterOrSlotPolicy();
     }
   }
   flags_ = TypeField::encode(type) | HintTypeField::encode(hint_type) |
@@ -713,8 +716,9 @@ void LiveRange::ConvertUsesToOperand(const InstructionOperand& op,
         break;
       case UsePositionType::kRequiresRegister:
         DCHECK(op.IsRegister() || op.IsFPRegister());
-      // Fall through.
-      case UsePositionType::kAny:
+        V8_FALLTHROUGH;
+      case UsePositionType::kRegisterOrSlot:
+      case UsePositionType::kRegisterOrSlotOrConstant:
         InstructionOperand::ReplaceWith(pos->operand(), &op);
         break;
     }
@@ -748,7 +752,8 @@ void LiveRange::SetUseHints(int register_index) {
       case UsePositionType::kRequiresSlot:
         break;
       case UsePositionType::kRequiresRegister:
-      case UsePositionType::kAny:
+      case UsePositionType::kRegisterOrSlot:
+      case UsePositionType::kRegisterOrSlotOrConstant:
         pos->set_assigned_register(register_index);
         break;
     }
@@ -1674,7 +1679,8 @@ void ConstraintBuilder::MeetRegisterConstraintsForLastInstructionInBlock(
         int gap_index = successor->first_instruction_index();
         // Create an unconstrained operand for the same virtual register
         // and insert a gap move from the fixed output to the operand.
-        UnallocatedOperand output_copy(UnallocatedOperand::ANY, output_vreg);
+        UnallocatedOperand output_copy(UnallocatedOperand::REGISTER_OR_SLOT,
+                                       output_vreg);
         data()->AddGapMove(gap_index, Instruction::START, *output, output_copy);
       }
     }
@@ -1715,7 +1721,8 @@ void ConstraintBuilder::MeetConstraintsAfter(int instr_index) {
     bool assigned = false;
     if (first_output->HasFixedPolicy()) {
       int output_vreg = first_output->virtual_register();
-      UnallocatedOperand output_copy(UnallocatedOperand::ANY, output_vreg);
+      UnallocatedOperand output_copy(UnallocatedOperand::REGISTER_OR_SLOT,
+                                     output_vreg);
       bool is_tagged = code()->IsReference(output_vreg);
       if (first_output->HasSecondaryStorage()) {
         range->MarkHasPreassignedSlot();
@@ -1757,7 +1764,8 @@ void ConstraintBuilder::MeetConstraintsBefore(int instr_index) {
     UnallocatedOperand* cur_input = UnallocatedOperand::cast(input);
     if (cur_input->HasFixedPolicy()) {
       int input_vreg = cur_input->virtual_register();
-      UnallocatedOperand input_copy(UnallocatedOperand::ANY, input_vreg);
+      UnallocatedOperand input_copy(UnallocatedOperand::REGISTER_OR_SLOT,
+                                    input_vreg);
       bool is_tagged = code()->IsReference(input_vreg);
       AllocateFixed(cur_input, instr_index, is_tagged);
       data()->AddGapMove(instr_index, Instruction::END, input_copy, *cur_input);
@@ -1774,7 +1782,8 @@ void ConstraintBuilder::MeetConstraintsBefore(int instr_index) {
         UnallocatedOperand::cast(second->InputAt(0));
     int output_vreg = second_output->virtual_register();
     int input_vreg = cur_input->virtual_register();
-    UnallocatedOperand input_copy(UnallocatedOperand::ANY, input_vreg);
+    UnallocatedOperand input_copy(UnallocatedOperand::REGISTER_OR_SLOT,
+                                  input_vreg);
     *cur_input =
         UnallocatedOperand(*cur_input, second_output->virtual_register());
     MoveOperands* gap_move = data()->AddGapMove(instr_index, Instruction::END,
@@ -1816,7 +1825,8 @@ void ConstraintBuilder::ResolvePhis(const InstructionBlock* block) {
     for (size_t i = 0; i < phi->operands().size(); ++i) {
       InstructionBlock* cur_block =
           code()->InstructionBlockAt(block->predecessors()[i]);
-      UnallocatedOperand input(UnallocatedOperand::ANY, phi->operands()[i]);
+      UnallocatedOperand input(UnallocatedOperand::REGISTER_OR_SLOT,
+                               phi->operands()[i]);
       MoveOperands* move = data()->AddGapMove(
           cur_block->last_instruction_index(), Instruction::END, input, output);
       map_value->AddOperand(&move->destination());
@@ -1897,10 +1907,10 @@ int LiveRangeBuilder::FixedFPLiveRangeID(int index, MachineRepresentation rep) {
   switch (rep) {
     case MachineRepresentation::kSimd128:
       result -= config()->num_float_registers();
-    // Fall through.
+      V8_FALLTHROUGH;
     case MachineRepresentation::kFloat32:
       result -= config()->num_double_registers();
-    // Fall through.
+      V8_FALLTHROUGH;
     case MachineRepresentation::kFloat64:
       result -= config()->num_general_registers();
       break;
@@ -2410,8 +2420,11 @@ void LiveRangeBuilder::BuildLiveRanges() {
     if (range->HasSpillOperand() && range->GetSpillOperand()->IsConstant()) {
       for (UsePosition* pos = range->first_pos(); pos != nullptr;
            pos = pos->next()) {
-        if (pos->type() == UsePositionType::kRequiresSlot) continue;
-        UsePositionType new_type = UsePositionType::kAny;
+        if (pos->type() == UsePositionType::kRequiresSlot ||
+            pos->type() == UsePositionType::kRegisterOrSlotOrConstant) {
+          continue;
+        }
+        UsePositionType new_type = UsePositionType::kRegisterOrSlot;
         // Can't mark phis as needing a register.
         if (!pos->pos().IsGapPosition()) {
           new_type = UsePositionType::kRequiresRegister;
@@ -2639,7 +2652,7 @@ LifetimePosition RegisterAllocator::FindOptimalSplitPos(LifetimePosition start,
                                                         LifetimePosition end) {
   int start_instr = start.ToInstructionIndex();
   int end_instr = end.ToInstructionIndex();
-  DCHECK(start_instr <= end_instr);
+  DCHECK_LE(start_instr, end_instr);
 
   // We have no choice
   if (start_instr == end_instr) return end;
diff --git a/deps/v8/src/compiler/register-allocator.h b/deps/v8/src/compiler/register-allocator.h
index 63e94fbdc84..b5d73a5bba5 100644
--- a/deps/v8/src/compiler/register-allocator.h
+++ b/deps/v8/src/compiler/register-allocator.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_REGISTER_ALLOCATOR_H_
-#define V8_REGISTER_ALLOCATOR_H_
+#ifndef V8_COMPILER_REGISTER_ALLOCATOR_H_
+#define V8_COMPILER_REGISTER_ALLOCATOR_H_
 
 #include "src/base/bits.h"
 #include "src/base/compiler-specific.h"
@@ -229,9 +229,12 @@ class UseInterval final : public ZoneObject {
   DISALLOW_COPY_AND_ASSIGN(UseInterval);
 };
 
-
-enum class UsePositionType : uint8_t { kAny, kRequiresRegister, kRequiresSlot };
-
+enum class UsePositionType : uint8_t {
+  kRegisterOrSlot,
+  kRegisterOrSlotOrConstant,
+  kRequiresRegister,
+  kRequiresSlot
+};
 
 enum class UsePositionHintType : uint8_t {
   kNone,
@@ -1213,4 +1216,4 @@ class LiveRangeConnector final : public ZoneObject {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_REGISTER_ALLOCATOR_H_
+#endif  // V8_COMPILER_REGISTER_ALLOCATOR_H_
diff --git a/deps/v8/src/compiler/representation-change.cc b/deps/v8/src/compiler/representation-change.cc
index f8a5a9c504e..012597e75a4 100644
--- a/deps/v8/src/compiler/representation-change.cc
+++ b/deps/v8/src/compiler/representation-change.cc
@@ -483,7 +483,7 @@ Node* RepresentationChanger::GetFloat32RepresentationFor(
   switch (node->opcode()) {
     case IrOpcode::kNumberConstant:
       return jsgraph()->Float32Constant(
-          DoubleToFloat32(OpParameter<double>(node)));
+          DoubleToFloat32(OpParameter<double>(node->op())));
     case IrOpcode::kInt32Constant:
     case IrOpcode::kFloat64Constant:
     case IrOpcode::kFloat32Constant:
@@ -543,7 +543,7 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
     // TODO(jarin) Handle checked constant conversions.
     switch (node->opcode()) {
       case IrOpcode::kNumberConstant:
-        return jsgraph()->Float64Constant(OpParameter<double>(node));
+        return jsgraph()->Float64Constant(OpParameter<double>(node->op()));
       case IrOpcode::kInt32Constant:
       case IrOpcode::kFloat64Constant:
       case IrOpcode::kFloat32Constant:
@@ -588,10 +588,11 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
     } else if (use_info.type_check() == TypeCheckKind::kNumber ||
                (use_info.type_check() == TypeCheckKind::kNumberOrOddball &&
                 !output_type->Maybe(Type::BooleanOrNullOrNumber()))) {
-      op = simplified()->CheckedTaggedToFloat64(CheckTaggedInputMode::kNumber);
+      op = simplified()->CheckedTaggedToFloat64(CheckTaggedInputMode::kNumber,
+                                                use_info.feedback());
     } else if (use_info.type_check() == TypeCheckKind::kNumberOrOddball) {
       op = simplified()->CheckedTaggedToFloat64(
-          CheckTaggedInputMode::kNumberOrOddball);
+          CheckTaggedInputMode::kNumberOrOddball, use_info.feedback());
     }
   } else if (output_rep == MachineRepresentation::kFloat32) {
     op = machine()->ChangeFloat32ToFloat64();
@@ -618,7 +619,7 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
       UNREACHABLE();
       break;
     case IrOpcode::kNumberConstant: {
-      double const fv = OpParameter<double>(node);
+      double const fv = OpParameter<double>(node->op());
       if (use_info.type_check() == TypeCheckKind::kNone ||
           ((use_info.type_check() == TypeCheckKind::kSignedSmall ||
             use_info.type_check() == TypeCheckKind::kSigned32) &&
@@ -767,6 +768,7 @@ Node* RepresentationChanger::GetBitRepresentationFor(
       } else if (m.Is(factory()->true_value())) {
         return jsgraph()->Int32Constant(1);
       }
+      break;
     }
     default:
       break;
@@ -1062,11 +1064,11 @@ Node* RepresentationChanger::TypeError(Node* node,
     std::ostringstream use_str;
     use_str << use;
 
-    V8_Fatal(__FILE__, __LINE__,
-             "RepresentationChangerError: node #%d:%s of "
-             "%s cannot be changed to %s",
-             node->id(), node->op()->mnemonic(), out_str.str().c_str(),
-             use_str.str().c_str());
+    FATAL(
+        "RepresentationChangerError: node #%d:%s of "
+        "%s cannot be changed to %s",
+        node->id(), node->op()->mnemonic(), out_str.str().c_str(),
+        use_str.str().c_str());
   }
   return node;
 }
diff --git a/deps/v8/src/compiler/representation-change.h b/deps/v8/src/compiler/representation-change.h
index b23a3dac5b0..571f13cd7dc 100644
--- a/deps/v8/src/compiler/representation-change.h
+++ b/deps/v8/src/compiler/representation-change.h
@@ -203,25 +203,29 @@ class UseInfo {
                    Truncation::Any(identify_zeros), TypeCheckKind::kSignedSmall,
                    feedback);
   }
-  static UseInfo CheckedSigned32AsWord32(IdentifyZeros identify_zeros) {
+  static UseInfo CheckedSigned32AsWord32(IdentifyZeros identify_zeros,
+                                         const VectorSlotPair& feedback) {
     return UseInfo(MachineRepresentation::kWord32,
-                   Truncation::Any(identify_zeros), TypeCheckKind::kSigned32);
+                   Truncation::Any(identify_zeros), TypeCheckKind::kSigned32,
+                   feedback);
   }
-  static UseInfo CheckedNumberAsFloat64() {
+  static UseInfo CheckedNumberAsFloat64(const VectorSlotPair& feedback) {
     return UseInfo(MachineRepresentation::kFloat64, Truncation::Any(),
-                   TypeCheckKind::kNumber);
+                   TypeCheckKind::kNumber, feedback);
   }
-  static UseInfo CheckedNumberAsWord32() {
+  static UseInfo CheckedNumberAsWord32(const VectorSlotPair& feedback) {
     return UseInfo(MachineRepresentation::kWord32, Truncation::Word32(),
-                   TypeCheckKind::kNumber);
+                   TypeCheckKind::kNumber, feedback);
   }
-  static UseInfo CheckedNumberOrOddballAsFloat64() {
+  static UseInfo CheckedNumberOrOddballAsFloat64(
+      const VectorSlotPair& feedback) {
     return UseInfo(MachineRepresentation::kFloat64, Truncation::Any(),
-                   TypeCheckKind::kNumberOrOddball);
+                   TypeCheckKind::kNumberOrOddball, feedback);
   }
-  static UseInfo CheckedNumberOrOddballAsWord32() {
+  static UseInfo CheckedNumberOrOddballAsWord32(
+      const VectorSlotPair& feedback) {
     return UseInfo(MachineRepresentation::kWord32, Truncation::Word32(),
-                   TypeCheckKind::kNumberOrOddball);
+                   TypeCheckKind::kNumberOrOddball, feedback);
   }
 
   // Undetermined representation.
diff --git a/deps/v8/src/compiler/s390/code-generator-s390.cc b/deps/v8/src/compiler/s390/code-generator-s390.cc
index c0d3146be1e..dfde68782f9 100644
--- a/deps/v8/src/compiler/s390/code-generator-s390.cc
+++ b/deps/v8/src/compiler/s390/code-generator-s390.cc
@@ -260,28 +260,28 @@ Condition FlagsConditionToCondition(FlagsCondition condition, ArchOpcode op) {
       // unsigned number never less than 0
       if (op == kS390_LoadAndTestWord32 || op == kS390_LoadAndTestWord64)
         return CC_NOP;
-    // fall through
+    V8_FALLTHROUGH;
     case kSignedLessThan:
       return lt;
     case kUnsignedGreaterThanOrEqual:
       // unsigned number always greater than or equal 0
       if (op == kS390_LoadAndTestWord32 || op == kS390_LoadAndTestWord64)
         return CC_ALWAYS;
-    // fall through
+    V8_FALLTHROUGH;
     case kSignedGreaterThanOrEqual:
       return ge;
     case kUnsignedLessThanOrEqual:
       // unsigned number never less than 0
       if (op == kS390_LoadAndTestWord32 || op == kS390_LoadAndTestWord64)
         return CC_EQ;
-    // fall through
+    V8_FALLTHROUGH;
     case kSignedLessThanOrEqual:
       return le;
     case kUnsignedGreaterThan:
       // unsigned number always greater than or equal 0
       if (op == kS390_LoadAndTestWord32 || op == kS390_LoadAndTestWord64)
         return ne;
-    // fall through
+    V8_FALLTHROUGH;
     case kSignedGreaterThan:
       return gt;
     case kOverflow:
@@ -984,6 +984,16 @@ void AdjustStackPointerForTailCall(
   }
 }
 
+void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen, Instruction* instr,
+                                   S390OperandConverter& i) {
+  const MemoryAccessMode access_mode =
+      static_cast<MemoryAccessMode>(MiscField::decode(instr->opcode()));
+  if (access_mode == kMemoryAccessPoisoned) {
+    Register value = i.OutputRegister();
+    codegen->tasm()->AndP(value, kSpeculationPoisonRegister);
+  }
+}
+
 }  // namespace
 
 void CodeGenerator::AssembleTailCallBeforeGap(Instruction* instr,
@@ -1028,21 +1038,33 @@ void CodeGenerator::AssembleTailCallAfterGap(Instruction* instr,
                                 first_unused_stack_slot);
 }
 
+// Check that {kJavaScriptCallCodeStartRegister} is correct.
+void CodeGenerator::AssembleCodeStartRegisterCheck() {
+  Register scratch = r1;
+  int pc_offset = __ pc_offset();
+  __ larl(scratch, Operand(-pc_offset/2));
+  __ CmpP(scratch, kJavaScriptCallCodeStartRegister);
+  __ Assert(eq, AbortReason::kWrongFunctionCodeStart);
+}
+
 // Check if the code object is marked for deoptimization. If it is, then it
 // jumps to the CompileLazyDeoptimizedCode builtin. In order to do this we need
 // to:
-//    1. load the address of the current instruction;
-//    2. read from memory the word that contains that bit, which can be found in
+//    1. read from memory the word that contains that bit, which can be found in
 //       the flags in the referenced {CodeDataContainer} object;
-//    3. test kMarkedForDeoptimizationBit in those flags; and
-//    4. if it is not zero then it jumps to the builtin.
+//    2. test kMarkedForDeoptimizationBit in those flags; and
+//    3. if it is not zero then it jumps to the builtin.
 void CodeGenerator::BailoutIfDeoptimized() {
-  Label current;
-  __ larl(r1, &current);
-  int pc_offset = __ pc_offset();
-  __ bind(&current);
-  int offset = Code::kCodeDataContainerOffset - (Code::kHeaderSize + pc_offset);
-  __ LoadP(ip, MemOperand(r1, offset));
+  if (FLAG_debug_code) {
+    // Check that {kJavaScriptCallCodeStartRegister} is correct.
+    int pc_offset = __ pc_offset();
+    __ larl(ip, Operand(-pc_offset/2));
+    __ CmpP(ip, kJavaScriptCallCodeStartRegister);
+    __ Assert(eq, AbortReason::kWrongFunctionCodeStart);
+  }
+
+  int offset = Code::kCodeDataContainerOffset - Code::kHeaderSize;
+  __ LoadP(ip, MemOperand(kJavaScriptCallCodeStartRegister, offset));
   __ LoadW(ip,
            FieldMemOperand(ip, CodeDataContainer::kKindSpecificFlagsOffset));
   __ TestBit(ip, Code::kMarkedForDeoptimizationBit);
@@ -1051,6 +1073,29 @@ void CodeGenerator::BailoutIfDeoptimized() {
   __ Jump(code, RelocInfo::CODE_TARGET, ne);
 }
 
+void CodeGenerator::GenerateSpeculationPoisonFromCodeStartRegister() {
+  Register scratch = r1;
+
+  Label current_pc;
+  __ larl(scratch, &current_pc);
+
+  __ bind(&current_pc);
+  __ SubP(scratch, Operand(__ pc_offset()));
+
+  // Calculate a mask which has all bits set in the normal case, but has all
+  // bits cleared if we are speculatively executing the wrong PC.
+  __ LoadImmP(kSpeculationPoisonRegister, Operand::Zero());
+  __ LoadImmP(r0, Operand(-1));
+  __ CmpP(kJavaScriptCallCodeStartRegister, scratch);
+  __ LoadOnConditionP(eq, kSpeculationPoisonRegister, r0);
+}
+
+void CodeGenerator::AssembleRegisterArgumentPoisoning() {
+  __ AndP(kJSFunctionRegister, kJSFunctionRegister, kSpeculationPoisonRegister);
+  __ AndP(kContextRegister, kContextRegister, kSpeculationPoisonRegister);
+  __ AndP(sp, sp, kSpeculationPoisonRegister);
+}
+
 // Assembles an instruction after register allocation, producing machine code.
 CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     Instruction* instr) {
@@ -1155,9 +1200,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ CmpP(cp, kScratchReg);
         __ Assert(eq, AbortReason::kWrongFunctionContext);
       }
-      __ LoadP(ip, FieldMemOperand(func, JSFunction::kCodeOffset));
-      __ AddP(ip, ip, Operand(Code::kHeaderSize - kHeapObjectTag));
-      __ Call(ip);
+      static_assert(kJavaScriptCallCodeStartRegister == r4, "ABI mismatch");
+      __ LoadP(r4, FieldMemOperand(func, JSFunction::kCodeOffset));
+      __ AddP(r4, r4, Operand(Code::kHeaderSize - kHeapObjectTag));
+      __ Call(r4);
       RecordCallPosition(instr);
       frame_access_state()->ClearSPDelta();
       break;
@@ -1279,6 +1325,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ LoadRR(i.OutputRegister(), fp);
       }
       break;
+    case kArchRootsPointer:
+      __ LoadRR(i.OutputRegister(), kRootRegister);
+      break;
     case kArchTruncateDoubleToI:
       // TODO(mbrandy): move slow call to stub out of line.
       __ TruncateDoubleToIDelayed(zone(), i.OutputRegister(),
@@ -1320,6 +1369,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
               Operand(offset.offset()));
       break;
     }
+    case kArchPoisonOnSpeculationWord:
+      DCHECK_EQ(i.OutputRegister(), i.InputRegister(0));
+      __ AndP(i.InputRegister(0), kSpeculationPoisonRegister);
+      break;
     case kS390_Abs32:
       // TODO(john.yan): zero-ext
       __ lpr(i.OutputRegister(0), i.InputRegister(0));
@@ -1925,15 +1978,21 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     }
-    case kS390_ExtendSignWord8:
+    case kS390_SignExtendWord8ToInt32:
       __ lbr(i.OutputRegister(), i.InputRegister(0));
       CHECK_AND_ZERO_EXT_OUTPUT(1);
       break;
-    case kS390_ExtendSignWord16:
+    case kS390_SignExtendWord16ToInt32:
       __ lhr(i.OutputRegister(), i.InputRegister(0));
       CHECK_AND_ZERO_EXT_OUTPUT(1);
       break;
-    case kS390_ExtendSignWord32:
+    case kS390_SignExtendWord8ToInt64:
+      __ lgbr(i.OutputRegister(), i.InputRegister(0));
+      break;
+    case kS390_SignExtendWord16ToInt64:
+      __ lghr(i.OutputRegister(), i.InputRegister(0));
+      break;
+    case kS390_SignExtendWord32ToInt64:
       __ lgfr(i.OutputRegister(), i.InputRegister(0));
       break;
     case kS390_Uint32ToUint64:
@@ -2106,6 +2165,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     case kS390_LoadWordS8:
       ASSEMBLE_LOAD_INTEGER(LoadB);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kS390_BitcastFloat32ToInt32:
       ASSEMBLE_UNARY_OP(R_DInstr(MovFloatToInt), R_MInstr(LoadlW), nullInstr);
@@ -2123,27 +2183,35 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
 #endif
     case kS390_LoadWordU8:
       ASSEMBLE_LOAD_INTEGER(LoadlB);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kS390_LoadWordU16:
       ASSEMBLE_LOAD_INTEGER(LoadLogicalHalfWordP);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kS390_LoadWordS16:
       ASSEMBLE_LOAD_INTEGER(LoadHalfWordP);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kS390_LoadWordU32:
       ASSEMBLE_LOAD_INTEGER(LoadlW);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kS390_LoadWordS32:
       ASSEMBLE_LOAD_INTEGER(LoadW);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kS390_LoadReverse16:
       ASSEMBLE_LOAD_INTEGER(lrvh);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kS390_LoadReverse32:
       ASSEMBLE_LOAD_INTEGER(lrv);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kS390_LoadReverse64:
       ASSEMBLE_LOAD_INTEGER(lrvg);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kS390_LoadReverse16RR:
       __ lrvr(i.OutputRegister(), i.InputRegister(0));
@@ -2157,6 +2225,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     case kS390_LoadWord64:
       ASSEMBLE_LOAD_INTEGER(lg);
+      EmitWordLoadPoisoningIfNeeded(this, instr, i);
       break;
     case kS390_LoadAndTestWord32: {
       ASSEMBLE_LOADANDTEST32(ltr, lt_z);
@@ -2204,28 +2273,28 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kS390_Lay:
       __ lay(i.OutputRegister(), i.MemoryOperand());
       break;
-    case kAtomicLoadInt8:
+    case kWord32AtomicLoadInt8:
       __ LoadB(i.OutputRegister(), i.MemoryOperand());
       break;
-    case kAtomicLoadUint8:
+    case kWord32AtomicLoadUint8:
       __ LoadlB(i.OutputRegister(), i.MemoryOperand());
       break;
-    case kAtomicLoadInt16:
+    case kWord32AtomicLoadInt16:
       __ LoadHalfWordP(i.OutputRegister(), i.MemoryOperand());
       break;
-    case kAtomicLoadUint16:
+    case kWord32AtomicLoadUint16:
       __ LoadLogicalHalfWordP(i.OutputRegister(), i.MemoryOperand());
       break;
-    case kAtomicLoadWord32:
+    case kWord32AtomicLoadWord32:
       __ LoadlW(i.OutputRegister(), i.MemoryOperand());
       break;
-    case kAtomicStoreWord8:
+    case kWord32AtomicStoreWord8:
       __ StoreByte(i.InputRegister(0), i.MemoryOperand(nullptr, 1));
       break;
-    case kAtomicStoreWord16:
+    case kWord32AtomicStoreWord16:
       __ StoreHalfWord(i.InputRegister(0), i.MemoryOperand(nullptr, 1));
       break;
-    case kAtomicStoreWord32:
+    case kWord32AtomicStoreWord32:
       __ StoreW(i.InputRegister(0), i.MemoryOperand(nullptr, 1));
       break;
 //         0x aa bb cc dd
@@ -2281,8 +2350,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     ATOMIC_EXCHANGE(start, end, shift_amount, -idx * 2);         \
   }
 #endif
-    case kAtomicExchangeInt8:
-    case kAtomicExchangeUint8: {
+    case kWord32AtomicExchangeInt8:
+    case kWord32AtomicExchangeUint8: {
       Register base = i.InputRegister(0);
       Register index = i.InputRegister(1);
       Register value = i.InputRegister(2);
@@ -2313,15 +2382,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       ATOMIC_EXCHANGE_BYTE(3);
 
       __ bind(&done);
-      if (opcode == kAtomicExchangeInt8) {
+      if (opcode == kWord32AtomicExchangeInt8) {
         __ lbr(output, output);
       } else {
         __ llcr(output, output);
       }
       break;
     }
-    case kAtomicExchangeInt16:
-    case kAtomicExchangeUint16: {
+    case kWord32AtomicExchangeInt16:
+    case kWord32AtomicExchangeUint16: {
       Register base = i.InputRegister(0);
       Register index = i.InputRegister(1);
       Register value = i.InputRegister(2);
@@ -2340,14 +2409,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       ATOMIC_EXCHANGE_HALFWORD(1);
 
       __ bind(&done);
-      if (opcode == kAtomicExchangeInt8) {
+      if (opcode == kWord32AtomicExchangeInt8) {
         __ lhr(output, output);
       } else {
         __ llhr(output, output);
       }
       break;
     }
-    case kAtomicExchangeWord32: {
+    case kWord32AtomicExchangeWord32: {
       Register base = i.InputRegister(0);
       Register index = i.InputRegister(1);
       Register value = i.InputRegister(2);
@@ -2389,6 +2458,19 @@ void CodeGenerator::AssembleArchBranch(Instruction* instr, BranchInfo* branch) {
   if (!branch->fallthru) __ b(flabel);  // no fallthru to flabel.
 }
 
+void CodeGenerator::AssembleBranchPoisoning(FlagsCondition condition,
+                                            Instruction* instr) {
+  // TODO(John) Handle float comparisons (kUnordered[Not]Equal).
+  if (condition == kUnorderedEqual || condition == kUnorderedNotEqual) {
+    return;
+  }
+
+  condition = NegateFlagsCondition(condition);
+  __ LoadImmP(r0, Operand::Zero());
+  __ LoadOnConditionP(FlagsConditionToCondition(condition, kArchNop),
+                      kSpeculationPoisonRegister, r0);
+}
+
 void CodeGenerator::AssembleArchDeoptBranch(Instruction* instr,
                                             BranchInfo* branch) {
   AssembleArchBranch(instr, branch);
@@ -2436,8 +2518,9 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                              __ isolate()),
                          0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
-        CallDescriptor* descriptor = gen_->linkage()->GetIncomingDescriptor();
-        int pop_count = static_cast<int>(descriptor->StackParameterCount());
+        auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
+        int pop_count =
+            static_cast<int>(call_descriptor->StackParameterCount());
         __ Drop(pop_count);
         __ Ret();
       } else {
@@ -2537,8 +2620,8 @@ void CodeGenerator::AssembleArchTableSwitch(Instruction* instr) {
 }
 
 void CodeGenerator::FinishFrame(Frame* frame) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
-  const RegList double_saves = descriptor->CalleeSavedFPRegisters();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
+  const RegList double_saves = call_descriptor->CalleeSavedFPRegisters();
 
   // Save callee-saved Double registers.
   if (double_saves != 0) {
@@ -2549,7 +2632,7 @@ void CodeGenerator::FinishFrame(Frame* frame) {
                                             (kDoubleSize / kPointerSize));
   }
   // Save callee-saved registers.
-  const RegList saves = descriptor->CalleeSavedRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     // register save area does not include the fp or constant pool pointer.
     const int num_saves = kNumCalleeSaved - 1;
@@ -2559,15 +2642,15 @@ void CodeGenerator::FinishFrame(Frame* frame) {
 }
 
 void CodeGenerator::AssembleConstructFrame() {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
 
   if (frame_access_state()->has_frame()) {
-    if (descriptor->IsCFunctionCall()) {
+    if (call_descriptor->IsCFunctionCall()) {
       __ Push(r14, fp);
       __ LoadRR(fp, sp);
-    } else if (descriptor->IsJSFunctionCall()) {
+    } else if (call_descriptor->IsJSFunctionCall()) {
       __ Prologue(ip);
-      if (descriptor->PushArgumentCount()) {
+      if (call_descriptor->PushArgumentCount()) {
         __ Push(kJavaScriptCallArgCountRegister);
       }
     } else {
@@ -2578,8 +2661,8 @@ void CodeGenerator::AssembleConstructFrame() {
     }
   }
 
-  int shrink_slots =
-      frame()->GetTotalFrameSlotCount() - descriptor->CalculateFixedFrameSize();
+  int shrink_slots = frame()->GetTotalFrameSlotCount() -
+                     call_descriptor->CalculateFixedFrameSize();
   if (info()->is_osr()) {
     // TurboFan OSR-compiled functions cannot be entered directly.
     __ Abort(AbortReason::kShouldNotDirectlyEnterOsrFunction);
@@ -2591,9 +2674,10 @@ void CodeGenerator::AssembleConstructFrame() {
     if (FLAG_code_comments) __ RecordComment("-- OSR entrypoint --");
     osr_pc_offset_ = __ pc_offset();
     shrink_slots -= osr_helper()->UnoptimizedFrameSlots();
+    ResetSpeculationPoison();
   }
 
-  const RegList double_saves = descriptor->CalleeSavedFPRegisters();
+  const RegList double_saves = call_descriptor->CalleeSavedFPRegisters();
   if (shrink_slots > 0) {
     __ lay(sp, MemOperand(sp, -shrink_slots * kPointerSize));
   }
@@ -2606,7 +2690,7 @@ void CodeGenerator::AssembleConstructFrame() {
   }
 
   // Save callee-saved registers.
-  const RegList saves = descriptor->CalleeSavedRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     __ MultiPush(saves);
     // register save area does not include the fp or constant pool pointer.
@@ -2614,23 +2698,23 @@ void CodeGenerator::AssembleConstructFrame() {
 }
 
 void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
-  int pop_count = static_cast<int>(descriptor->StackParameterCount());
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
+  int pop_count = static_cast<int>(call_descriptor->StackParameterCount());
 
   // Restore registers.
-  const RegList saves = descriptor->CalleeSavedRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     __ MultiPop(saves);
   }
 
   // Restore double registers.
-  const RegList double_saves = descriptor->CalleeSavedFPRegisters();
+  const RegList double_saves = call_descriptor->CalleeSavedFPRegisters();
   if (double_saves != 0) {
     __ MultiPopDoubles(double_saves);
   }
 
   S390OperandConverter g(this, nullptr);
-  if (descriptor->IsCFunctionCall()) {
+  if (call_descriptor->IsCFunctionCall()) {
     AssembleDeconstructFrame();
   } else if (frame_access_state()->has_frame()) {
     // Canonicalize JSFunction return sites for now unless they have an variable
@@ -2690,7 +2774,7 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
       switch (src.type()) {
         case Constant::kInt32:
 #if V8_TARGET_ARCH_S390X
-          if (RelocInfo::IsWasmSizeReference(src.rmode())) {
+          if (false) {
 #else
           if (RelocInfo::IsWasmReference(src.rmode())) {
 #endif
@@ -2704,7 +2788,6 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
           if (RelocInfo::IsWasmPtrReference(src.rmode())) {
             __ mov(dst, Operand(src.ToInt64(), src.rmode()));
           } else {
-            DCHECK(!RelocInfo::IsWasmSizeReference(src.rmode()));
             __ Load(dst, Operand(src.ToInt64()));
           }
 #else
diff --git a/deps/v8/src/compiler/s390/instruction-codes-s390.h b/deps/v8/src/compiler/s390/instruction-codes-s390.h
index cb94da2ec75..b5296f63d05 100644
--- a/deps/v8/src/compiler/s390/instruction-codes-s390.h
+++ b/deps/v8/src/compiler/s390/instruction-codes-s390.h
@@ -99,9 +99,11 @@ namespace compiler {
   V(S390_PushFrame)                \
   V(S390_StackClaim)               \
   V(S390_StoreToStackSlot)         \
-  V(S390_ExtendSignWord8)          \
-  V(S390_ExtendSignWord16)         \
-  V(S390_ExtendSignWord32)         \
+  V(S390_SignExtendWord8ToInt32)   \
+  V(S390_SignExtendWord16ToInt32)  \
+  V(S390_SignExtendWord8ToInt64)   \
+  V(S390_SignExtendWord16ToInt64)  \
+  V(S390_SignExtendWord32ToInt64)  \
   V(S390_Uint32ToUint64)           \
   V(S390_Int64ToInt32)             \
   V(S390_Int64ToFloat32)           \
diff --git a/deps/v8/src/compiler/s390/instruction-scheduler-s390.cc b/deps/v8/src/compiler/s390/instruction-scheduler-s390.cc
index 1850830f6ea..fd388a219a8 100644
--- a/deps/v8/src/compiler/s390/instruction-scheduler-s390.cc
+++ b/deps/v8/src/compiler/s390/instruction-scheduler-s390.cc
@@ -96,9 +96,11 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kS390_CmpDouble:
     case kS390_Tst32:
     case kS390_Tst64:
-    case kS390_ExtendSignWord8:
-    case kS390_ExtendSignWord16:
-    case kS390_ExtendSignWord32:
+    case kS390_SignExtendWord8ToInt32:
+    case kS390_SignExtendWord16ToInt32:
+    case kS390_SignExtendWord8ToInt64:
+    case kS390_SignExtendWord16ToInt64:
+    case kS390_SignExtendWord32ToInt64:
     case kS390_Uint32ToUint64:
     case kS390_Int64ToInt32:
     case kS390_Int64ToFloat32:
diff --git a/deps/v8/src/compiler/s390/instruction-selector-s390.cc b/deps/v8/src/compiler/s390/instruction-selector-s390.cc
index 457c5a1d827..d4d074bb7bb 100644
--- a/deps/v8/src/compiler/s390/instruction-selector-s390.cc
+++ b/deps/v8/src/compiler/s390/instruction-selector-s390.cc
@@ -101,9 +101,9 @@ class S390OperandGenerator final : public OperandGenerator {
 
   int64_t GetImmediate(Node* node) {
     if (node->opcode() == IrOpcode::kInt32Constant)
-      return OpParameter<int32_t>(node);
+      return OpParameter<int32_t>(node->op());
     else if (node->opcode() == IrOpcode::kInt64Constant)
-      return OpParameter<int64_t>(node);
+      return OpParameter<int64_t>(node->op());
     else
       UNIMPLEMENTED();
     return 0L;
@@ -112,9 +112,9 @@ class S390OperandGenerator final : public OperandGenerator {
   bool CanBeImmediate(Node* node, OperandModes mode) {
     int64_t value;
     if (node->opcode() == IrOpcode::kInt32Constant)
-      value = OpParameter<int32_t>(node);
+      value = OpParameter<int32_t>(node->op());
     else if (node->opcode() == IrOpcode::kInt64Constant)
-      value = OpParameter<int64_t>(node);
+      value = OpParameter<int64_t>(node->op());
     else
       return false;
     return CanBeImmediate(value, mode);
@@ -271,7 +271,7 @@ bool S390OpcodeOnlySupport12BitDisp(InstructionCode op) {
 
 ArchOpcode SelectLoadOpcode(Node* node) {
   NodeMatcher m(node);
-  DCHECK(m.IsLoad());
+  DCHECK(m.IsLoad() || m.IsPoisonedLoad());
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
   ArchOpcode opcode = kArchNop;
   switch (load_rep.representation()) {
@@ -329,6 +329,8 @@ ArchOpcode SelectLoadOpcode(Node* node) {
   V(Word32Popcnt)                  \
   V(Float64ExtractLowWord32)       \
   V(Float64ExtractHighWord32)      \
+  V(SignExtendWord8ToInt32)        \
+  V(SignExtendWord16ToInt32)       \
   /* Word32 bin op */              \
   V(Int32Add)                      \
   V(Int32Sub)                      \
@@ -581,11 +583,6 @@ void VisitUnaryOp(InstructionSelector* selector, Node* node,
     inputs[input_count++] = g.TempImmediate(!canEliminateZeroExt);
   }
 
-  if (cont->IsBranch()) {
-    inputs[input_count++] = g.Label(cont->true_block());
-    inputs[input_count++] = g.Label(cont->false_block());
-  }
-
   if (!cont->IsDeoptimize()) {
     // If we can deoptimize as a result of the binop, we need to make sure
     // that the deopt inputs are not overwritten by the binop result. One way
@@ -600,27 +597,13 @@ void VisitUnaryOp(InstructionSelector* selector, Node* node,
     outputs[output_count++] = g.DefineSameAsFirst(node);
   }
 
-  if (cont->IsSet()) {
-    outputs[output_count++] = g.DefineAsRegister(cont->result());
-  }
-
   DCHECK_NE(0u, input_count);
   DCHECK_NE(0u, output_count);
   DCHECK_GE(arraysize(inputs), input_count);
   DCHECK_GE(arraysize(outputs), output_count);
 
-  opcode = cont->Encode(opcode);
-
-  if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, output_count, outputs, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsTrap()) {
-    inputs[input_count++] = g.UseImmediate(cont->trap_id());
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  } else {
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, output_count, outputs, input_count,
+                                 inputs, cont);
 }
 
 template <class CanCombineWithLoad>
@@ -656,11 +639,6 @@ void VisitBinOp(InstructionSelector* selector, Node* node,
     inputs[input_count++] = g.TempImmediate(!canEliminateZeroExt);
   }
 
-  if (cont->IsBranch()) {
-    inputs[input_count++] = g.Label(cont->true_block());
-    inputs[input_count++] = g.Label(cont->false_block());
-  }
-
   if ((operand_mode & OperandMode::kAllowDistinctOps) &&
       // If we can deoptimize as a result of the binop, we need to make sure
       // that the deopt inputs are not overwritten by the binop result. One way
@@ -676,27 +654,13 @@ void VisitBinOp(InstructionSelector* selector, Node* node,
     outputs[output_count++] = g.DefineSameAsFirst(node);
   }
 
-  if (cont->IsSet()) {
-    outputs[output_count++] = g.DefineAsRegister(cont->result());
-  }
-
   DCHECK_NE(0u, input_count);
   DCHECK_NE(0u, output_count);
   DCHECK_GE(arraysize(inputs), input_count);
   DCHECK_GE(arraysize(outputs), output_count);
 
-  opcode = cont->Encode(opcode);
-
-  if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, output_count, outputs, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsTrap()) {
-    inputs[input_count++] = g.UseImmediate(cont->trap_id());
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  } else {
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, output_count, outputs, input_count,
+                                 inputs, cont);
 }
 
 }  // namespace
@@ -717,17 +681,24 @@ void InstructionSelector::VisitDebugAbort(Node* node) {
 
 void InstructionSelector::VisitLoad(Node* node) {
   S390OperandGenerator g(this);
-  ArchOpcode opcode = SelectLoadOpcode(node);
+  InstructionCode opcode = SelectLoadOpcode(node);
   InstructionOperand outputs[1];
   outputs[0] = g.DefineAsRegister(node);
   InstructionOperand inputs[3];
   size_t input_count = 0;
   AddressingMode mode =
       g.GetEffectiveAddressMemoryOperand(node, inputs, &input_count);
-  InstructionCode code = opcode | AddressingModeField::encode(mode);
-  Emit(code, 1, outputs, input_count, inputs);
+  opcode |= AddressingModeField::encode(mode);
+  if (node->opcode() == IrOpcode::kPoisonedLoad) {
+    CHECK_EQ(poisoning_enabled_, PoisoningMitigationLevel::kOn);
+    opcode |= MiscField::encode(kMemoryAccessPoisoned);
+  }
+
+  Emit(opcode, 1, outputs, input_count, inputs);
 }
 
+void InstructionSelector::VisitPoisonedLoad(Node* node) { VisitLoad(node); }
+
 void InstructionSelector::VisitProtectedLoad(Node* node) {
   // TODO(eholk)
   UNIMPLEMENTED();
@@ -1019,7 +990,7 @@ static inline bool TryMatchSignExtInt16OrInt8FromWord32Sar(
     Int32BinopMatcher mleft(m.left().node());
     if (mleft.right().Is(16) && m.right().Is(16)) {
       bool canEliminateZeroExt = ProduceWord32Result(mleft.left().node());
-      selector->Emit(kS390_ExtendSignWord16,
+      selector->Emit(kS390_SignExtendWord16ToInt32,
                      canEliminateZeroExt ? g.DefineSameAsFirst(node)
                                          : g.DefineAsRegister(node),
                      g.UseRegister(mleft.left().node()),
@@ -1027,7 +998,7 @@ static inline bool TryMatchSignExtInt16OrInt8FromWord32Sar(
       return true;
     } else if (mleft.right().Is(24) && m.right().Is(24)) {
       bool canEliminateZeroExt = ProduceWord32Result(mleft.left().node());
-      selector->Emit(kS390_ExtendSignWord8,
+      selector->Emit(kS390_SignExtendWord8ToInt32,
                      canEliminateZeroExt ? g.DefineSameAsFirst(node)
                                          : g.DefineAsRegister(node),
                      g.UseRegister(mleft.left().node()),
@@ -1415,6 +1386,10 @@ static inline bool TryMatchDoubleConstructFromInsert(
     null)                                                                    \
   V(Word32, ChangeUint32ToFloat64, kS390_Uint32ToDouble, OperandMode::kNone, \
     null)                                                                    \
+  V(Word32, SignExtendWord8ToInt32, kS390_SignExtendWord8ToInt32,            \
+    OperandMode::kNone, null)                                                \
+  V(Word32, SignExtendWord16ToInt32, kS390_SignExtendWord16ToInt32,          \
+    OperandMode::kNone, null)                                                \
   V(Word32, BitcastInt32ToFloat32, kS390_BitcastInt32ToFloat32,              \
     OperandMode::kNone, null)
 
@@ -1427,8 +1402,14 @@ static inline bool TryMatchDoubleConstructFromInsert(
     OperandMode::kNone, null)
 #define WORD32_UNARY_OP_LIST(V)                                             \
   WORD32_UNARY_OP_LIST_32(V)                                                \
-  V(Word32, ChangeInt32ToInt64, kS390_ExtendSignWord32, OperandMode::kNone, \
-    null)                                                                   \
+  V(Word32, ChangeInt32ToInt64, kS390_SignExtendWord32ToInt64,              \
+    OperandMode::kNone, null)                                               \
+  V(Word32, SignExtendWord8ToInt64, kS390_SignExtendWord8ToInt64,           \
+    OperandMode::kNone, null)                                               \
+  V(Word32, SignExtendWord16ToInt64, kS390_SignExtendWord16ToInt64,         \
+    OperandMode::kNone, null)                                               \
+  V(Word32, SignExtendWord32ToInt64, kS390_SignExtendWord32ToInt64,         \
+    OperandMode::kNone, null)                                               \
   V(Word32, ChangeUint32ToUint64, kS390_Uint32ToUint64, OperandMode::kNone, \
     [&]() -> bool {                                                         \
       if (ProduceWord32Result(node->InputAt(0))) {                          \
@@ -1632,28 +1613,9 @@ namespace {
 void VisitCompare(InstructionSelector* selector, InstructionCode opcode,
                   InstructionOperand left, InstructionOperand right,
                   FlagsContinuation* cont) {
-  S390OperandGenerator g(selector);
-  opcode = cont->Encode(opcode);
-  if (cont->IsBranch()) {
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.Label(cont->true_block()), g.Label(cont->false_block()));
-  } else if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, g.NoOutput(), left, right, cont->kind(),
-                             cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsSet()) {
-    selector->Emit(opcode, g.DefineAsRegister(cont->result()), left, right);
-  } else {
-    DCHECK(cont->IsTrap());
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.UseImmediate(cont->trap_id()));
-  }
+  selector->EmitWithContinuation(opcode, left, right, cont);
 }
 
-void VisitWordCompareZero(InstructionSelector* selector, Node* user,
-                          Node* value, InstructionCode opcode,
-                          FlagsContinuation* cont);
-
 void VisitLoadAndTest(InstructionSelector* selector, InstructionCode opcode,
                       Node* node, Node* value, FlagsContinuation* cont,
                       bool discard_output = false);
@@ -1712,27 +1674,9 @@ void VisitWordCompare(InstructionSelector* selector, Node* node,
     inputs[input_count++] = g.UseAnyExceptImmediate(right);
   }
 
-  opcode = cont->Encode(opcode);
-  if (cont->IsBranch()) {
-    inputs[input_count++] = g.Label(cont->true_block());
-    inputs[input_count++] = g.Label(cont->false_block());
-  } else if (cont->IsSet()) {
-    outputs[output_count++] = g.DefineAsRegister(cont->result());
-  } else if (cont->IsTrap()) {
-    inputs[input_count++] = g.UseImmediate(cont->trap_id());
-  } else {
-    DCHECK(cont->IsDeoptimize());
-    // nothing to do
-  }
-
   DCHECK(input_count <= 8 && output_count <= 1);
-  if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, 0, nullptr, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else {
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, output_count, outputs, input_count,
+                                 inputs, cont);
 }
 
 void VisitWord32Compare(InstructionSelector* selector, Node* node,
@@ -1817,37 +1761,18 @@ void VisitLoadAndTest(InstructionSelector* selector, InstructionCode opcode,
     outputs[output_count++] = g.DefineAsRegister(value);
   }
 
-  opcode = cont->Encode(opcode);
-  if (cont->IsBranch()) {
-    inputs[input_count++] = g.Label(cont->true_block());
-    inputs[input_count++] = g.Label(cont->false_block());
-  } else if (cont->IsSet()) {
-    outputs[output_count++] = g.DefineAsRegister(cont->result());
-  } else if (cont->IsTrap()) {
-    inputs[input_count++] = g.UseImmediate(cont->trap_id());
-  } else {
-    DCHECK(cont->IsDeoptimize());
-    // nothing to do
-  }
-
   DCHECK(input_count <= 8 && output_count <= 2);
-  opcode = cont->Encode(opcode);
-  if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, output_count, outputs, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else {
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, output_count, outputs, input_count,
+                                 inputs, cont);
 }
 
+}  // namespace
+
 // Shared routine for word comparisons against zero.
-void VisitWordCompareZero(InstructionSelector* selector, Node* user,
-                          Node* value, InstructionCode opcode,
-                          FlagsContinuation* cont) {
+void InstructionSelector::VisitWordCompareZero(Node* user, Node* value,
+                                               FlagsContinuation* cont) {
   // Try to combine with comparisons against 0 by simply inverting the branch.
-  while (value->opcode() == IrOpcode::kWord32Equal &&
-         selector->CanCover(user, value)) {
+  while (value->opcode() == IrOpcode::kWord32Equal && CanCover(user, value)) {
     Int32BinopMatcher m(value);
     if (!m.right().Is(0)) break;
 
@@ -1857,7 +1782,7 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
   }
 
   FlagsCondition fc = cont->condition();
-  if (selector->CanCover(user, value)) {
+  if (CanCover(user, value)) {
     switch (value->opcode()) {
       case IrOpcode::kWord32Equal: {
         cont->OverwriteAndNegateIfEqual(kEqual);
@@ -1866,31 +1791,31 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
           // Try to combine the branch with a comparison.
           Node* const user = m.node();
           Node* const value = m.left().node();
-          if (selector->CanCover(user, value)) {
+          if (CanCover(user, value)) {
             switch (value->opcode()) {
               case IrOpcode::kInt32Sub:
-                return VisitWord32Compare(selector, value, cont);
+                return VisitWord32Compare(this, value, cont);
               case IrOpcode::kWord32And:
-                return VisitTestUnderMask(selector, value, cont);
+                return VisitTestUnderMask(this, value, cont);
               default:
                 break;
             }
           }
         }
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       }
       case IrOpcode::kInt32LessThan:
         cont->OverwriteAndNegateIfEqual(kSignedLessThan);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kInt32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kSignedLessThanOrEqual);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kUint32LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
       case IrOpcode::kUint32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitWord32Compare(selector, value, cont);
+        return VisitWord32Compare(this, value, cont);
 #if V8_TARGET_ARCH_S390X
       case IrOpcode::kWord64Equal: {
         cont->OverwriteAndNegateIfEqual(kEqual);
@@ -1899,50 +1824,50 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
           // Try to combine the branch with a comparison.
           Node* const user = m.node();
           Node* const value = m.left().node();
-          if (selector->CanCover(user, value)) {
+          if (CanCover(user, value)) {
             switch (value->opcode()) {
               case IrOpcode::kInt64Sub:
-                return VisitWord64Compare(selector, value, cont);
+                return VisitWord64Compare(this, value, cont);
               case IrOpcode::kWord64And:
-                return VisitTestUnderMask(selector, value, cont);
+                return VisitTestUnderMask(this, value, cont);
               default:
                 break;
             }
           }
         }
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       }
       case IrOpcode::kInt64LessThan:
         cont->OverwriteAndNegateIfEqual(kSignedLessThan);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kInt64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kSignedLessThanOrEqual);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kUint64LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kUint64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
 #endif
       case IrOpcode::kFloat32Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat64Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kProjection:
         // Check if this is the overflow output projection of an
         // <Operation>WithOverflow node.
@@ -1954,46 +1879,46 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
           // *AFTER* this branch).
           Node* const node = value->InputAt(0);
           Node* const result = NodeProperties::FindProjection(node, 0);
-          if (result == nullptr || selector->IsDefined(result)) {
+          if (result == nullptr || IsDefined(result)) {
             switch (node->opcode()) {
               case IrOpcode::kInt32AddWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitWord32BinOp(selector, node, kS390_Add32,
-                                        AddOperandMode, cont);
+                return VisitWord32BinOp(this, node, kS390_Add32, AddOperandMode,
+                                        cont);
               case IrOpcode::kInt32SubWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitWord32BinOp(selector, node, kS390_Sub32,
-                                        SubOperandMode, cont);
+                return VisitWord32BinOp(this, node, kS390_Sub32, SubOperandMode,
+                                        cont);
               case IrOpcode::kInt32MulWithOverflow:
                 if (CpuFeatures::IsSupported(MISC_INSTR_EXT2)) {
                   cont->OverwriteAndNegateIfEqual(kOverflow);
                   return VisitWord32BinOp(
-                      selector, node, kS390_Mul32,
+                      this, node, kS390_Mul32,
                       OperandMode::kAllowRRR | OperandMode::kAllowRM, cont);
                 } else {
                   cont->OverwriteAndNegateIfEqual(kNotEqual);
                   return VisitWord32BinOp(
-                      selector, node, kS390_Mul32WithOverflow,
+                      this, node, kS390_Mul32WithOverflow,
                       OperandMode::kInt32Imm | OperandMode::kAllowDistinctOps,
                       cont);
                 }
               case IrOpcode::kInt32AbsWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitWord32UnaryOp(selector, node, kS390_Abs32,
+                return VisitWord32UnaryOp(this, node, kS390_Abs32,
                                           OperandMode::kNone, cont);
 #if V8_TARGET_ARCH_S390X
               case IrOpcode::kInt64AbsWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitWord64UnaryOp(selector, node, kS390_Abs64,
+                return VisitWord64UnaryOp(this, node, kS390_Abs64,
                                           OperandMode::kNone, cont);
               case IrOpcode::kInt64AddWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitWord64BinOp(selector, node, kS390_Add64,
-                                        AddOperandMode, cont);
+                return VisitWord64BinOp(this, node, kS390_Add64, AddOperandMode,
+                                        cont);
               case IrOpcode::kInt64SubWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitWord64BinOp(selector, node, kS390_Sub64,
-                                        SubOperandMode, cont);
+                return VisitWord64BinOp(this, node, kS390_Sub64, SubOperandMode,
+                                        cont);
 #endif
               default:
                 break;
@@ -2003,17 +1928,16 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
         break;
       case IrOpcode::kInt32Sub:
         if (fc == kNotEqual || fc == kEqual)
-          return VisitWord32Compare(selector, value, cont);
+          return VisitWord32Compare(this, value, cont);
         break;
       case IrOpcode::kWord32And:
-        return VisitTestUnderMask(selector, value, cont);
+        return VisitTestUnderMask(this, value, cont);
       case IrOpcode::kLoad: {
         LoadRepresentation load_rep = LoadRepresentationOf(value->op());
         switch (load_rep.representation()) {
           case MachineRepresentation::kWord32:
-            if (opcode == kS390_LoadAndTestWord32) {
-              return VisitLoadAndTest(selector, opcode, user, value, cont);
-            }
+            return VisitLoadAndTest(this, kS390_LoadAndTestWord32, user, value,
+                                    cont);
           default:
             break;
         }
@@ -2024,13 +1948,13 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
         break;
       case IrOpcode::kWord32Or:
         if (fc == kNotEqual || fc == kEqual)
-          return VisitWord32BinOp(selector, value, kS390_Or32, Or32OperandMode,
+          return VisitWord32BinOp(this, value, kS390_Or32, Or32OperandMode,
                                   cont);
         break;
       case IrOpcode::kWord32Xor:
         if (fc == kNotEqual || fc == kEqual)
-          return VisitWord32BinOp(selector, value, kS390_Xor32,
-                                  Xor32OperandMode, cont);
+          return VisitWord32BinOp(this, value, kS390_Xor32, Xor32OperandMode,
+                                  cont);
         break;
       case IrOpcode::kWord32Sar:
       case IrOpcode::kWord32Shl:
@@ -2041,22 +1965,22 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
 #if V8_TARGET_ARCH_S390X
       case IrOpcode::kInt64Sub:
         if (fc == kNotEqual || fc == kEqual)
-          return VisitWord64Compare(selector, value, cont);
+          return VisitWord64Compare(this, value, cont);
         break;
       case IrOpcode::kWord64And:
-        return VisitTestUnderMask(selector, value, cont);
+        return VisitTestUnderMask(this, value, cont);
       case IrOpcode::kInt64Add:
         // can't handle overflow case.
         break;
       case IrOpcode::kWord64Or:
         if (fc == kNotEqual || fc == kEqual)
-          return VisitWord64BinOp(selector, value, kS390_Or64, Or64OperandMode,
+          return VisitWord64BinOp(this, value, kS390_Or64, Or64OperandMode,
                                   cont);
         break;
       case IrOpcode::kWord64Xor:
         if (fc == kNotEqual || fc == kEqual)
-          return VisitWord64BinOp(selector, value, kS390_Xor64,
-                                  Xor64OperandMode, cont);
+          return VisitWord64BinOp(this, value, kS390_Xor64, Xor64OperandMode,
+                                  cont);
         break;
       case IrOpcode::kWord64Sar:
       case IrOpcode::kWord64Shl:
@@ -2071,54 +1995,7 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
   }
 
   // Branch could not be combined with a compare, emit LoadAndTest
-  VisitLoadAndTest(selector, opcode, user, value, cont, true);
-}
-
-void VisitWord32CompareZero(InstructionSelector* selector, Node* user,
-                            Node* value, FlagsContinuation* cont) {
-  VisitWordCompareZero(selector, user, value, kS390_LoadAndTestWord32, cont);
-}
-
-#if V8_TARGET_ARCH_S390X
-void VisitWord64CompareZero(InstructionSelector* selector, Node* user,
-                            Node* value, FlagsContinuation* cont) {
-  VisitWordCompareZero(selector, user, value, kS390_LoadAndTestWord64, cont);
-}
-#endif
-
-}  // namespace
-
-void InstructionSelector::VisitBranch(Node* branch, BasicBlock* tbranch,
-                                      BasicBlock* fbranch) {
-  FlagsContinuation cont(kNotEqual, tbranch, fbranch);
-  VisitWord32CompareZero(this, branch, branch->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeIf(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kNotEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWord32CompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeUnless(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWord32CompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapIf(Node* node, Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kNotEqual, func_id, node->InputAt(1));
-  VisitWord32CompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapUnless(Node* node,
-                                          Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kEqual, func_id, node->InputAt(1));
-  VisitWord32CompareZero(this, node, node->InputAt(0), &cont);
+  VisitLoadAndTest(this, kS390_LoadAndTestWord32, user, value, cont, true);
 }
 
 void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
@@ -2126,22 +2003,23 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
   InstructionOperand value_operand = g.UseRegister(node->InputAt(0));
 
   // Emit either ArchTableSwitch or ArchLookupSwitch.
-  static const size_t kMaxTableSwitchValueRange = 2 << 16;
-  size_t table_space_cost = 4 + sw.value_range;
-  size_t table_time_cost = 3;
-  size_t lookup_space_cost = 3 + 2 * sw.case_count;
-  size_t lookup_time_cost = sw.case_count;
-  if (sw.case_count > 0 &&
-      table_space_cost + 3 * table_time_cost <=
-          lookup_space_cost + 3 * lookup_time_cost &&
-      sw.min_value > std::numeric_limits<int32_t>::min() &&
-      sw.value_range <= kMaxTableSwitchValueRange) {
-    InstructionOperand index_operand = value_operand;
-    if (sw.min_value) {
-      index_operand = g.TempRegister();
-      Emit(kS390_Lay | AddressingModeField::encode(kMode_MRI), index_operand,
-           value_operand, g.TempImmediate(-sw.min_value));
-    }
+  if (enable_switch_jump_table_ == kEnableSwitchJumpTable) {
+    static const size_t kMaxTableSwitchValueRange = 2 << 16;
+    size_t table_space_cost = 4 + sw.value_range();
+    size_t table_time_cost = 3;
+    size_t lookup_space_cost = 3 + 2 * sw.case_count();
+    size_t lookup_time_cost = sw.case_count();
+    if (sw.case_count() > 0 &&
+        table_space_cost + 3 * table_time_cost <=
+            lookup_space_cost + 3 * lookup_time_cost &&
+        sw.min_value() > std::numeric_limits<int32_t>::min() &&
+        sw.value_range() <= kMaxTableSwitchValueRange) {
+      InstructionOperand index_operand = value_operand;
+      if (sw.min_value()) {
+        index_operand = g.TempRegister();
+        Emit(kS390_Lay | AddressingModeField::encode(kMode_MRI), index_operand,
+             value_operand, g.TempImmediate(-sw.min_value()));
+      }
 #if V8_TARGET_ARCH_S390X
     InstructionOperand index_operand_zero_ext = g.TempRegister();
     Emit(kS390_Uint32ToUint64, index_operand_zero_ext, index_operand);
@@ -2150,6 +2028,7 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
     // Generate a table lookup.
     return EmitTableSwitch(sw, index_operand);
   }
+  }
 
   // Generate a sequence of conditional jumps.
   return EmitLookupSwitch(sw, value_operand);
@@ -2159,7 +2038,8 @@ void InstructionSelector::VisitWord32Equal(Node* const node) {
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
   Int32BinopMatcher m(node);
   if (m.right().Is(0)) {
-    return VisitWord32CompareZero(this, m.node(), m.left().node(), &cont);
+    return VisitLoadAndTest(this, kS390_LoadAndTestWord32, m.node(),
+                            m.left().node(), &cont, true);
   }
   VisitWord32Compare(this, node, &cont);
 }
@@ -2191,7 +2071,8 @@ void InstructionSelector::VisitWord64Equal(Node* const node) {
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
   Int64BinopMatcher m(node);
   if (m.right().Is(0)) {
-    return VisitWord64CompareZero(this, m.node(), m.left().node(), &cont);
+    return VisitLoadAndTest(this, kS390_LoadAndTestWord64, m.node(),
+                            m.left().node(), &cont, true);
   }
   VisitWord64Compare(this, node, &cont);
 }
@@ -2252,14 +2133,14 @@ void InstructionSelector::VisitFloat64LessThanOrEqual(Node* node) {
 }
 
 void InstructionSelector::EmitPrepareArguments(
-    ZoneVector<PushParameter>* arguments, const CallDescriptor* descriptor,
+    ZoneVector<PushParameter>* arguments, const CallDescriptor* call_descriptor,
     Node* node) {
   S390OperandGenerator g(this);
 
   // Prepare for C function call.
-  if (descriptor->IsCFunctionCall()) {
-    Emit(kArchPrepareCallCFunction |
-             MiscField::encode(static_cast<int>(descriptor->ParameterCount())),
+  if (call_descriptor->IsCFunctionCall()) {
+    Emit(kArchPrepareCallCFunction | MiscField::encode(static_cast<int>(
+                                         call_descriptor->ParameterCount())),
          0, nullptr, 0, nullptr);
 
     // Poke any stack arguments.
@@ -2301,7 +2182,7 @@ bool InstructionSelector::IsTailCallAddressImmediate() { return false; }
 
 int InstructionSelector::GetTempsCountForTailCallFromJSFunction() { return 3; }
 
-void InstructionSelector::VisitAtomicLoad(Node* node) {
+void InstructionSelector::VisitWord32AtomicLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
   S390OperandGenerator g(this);
   Node* base = node->InputAt(0);
@@ -2309,13 +2190,15 @@ void InstructionSelector::VisitAtomicLoad(Node* node) {
   ArchOpcode opcode = kArchNop;
   switch (load_rep.representation()) {
     case MachineRepresentation::kWord8:
-      opcode = load_rep.IsSigned() ? kAtomicLoadInt8 : kAtomicLoadUint8;
+      opcode =
+          load_rep.IsSigned() ? kWord32AtomicLoadInt8 : kWord32AtomicLoadUint8;
       break;
     case MachineRepresentation::kWord16:
-      opcode = load_rep.IsSigned() ? kAtomicLoadInt16 : kAtomicLoadUint16;
+      opcode = load_rep.IsSigned() ? kWord32AtomicLoadInt16
+                                   : kWord32AtomicLoadUint16;
       break;
     case MachineRepresentation::kWord32:
-      opcode = kAtomicLoadWord32;
+      opcode = kWord32AtomicLoadWord32;
       break;
     default:
       UNREACHABLE();
@@ -2325,7 +2208,7 @@ void InstructionSelector::VisitAtomicLoad(Node* node) {
        g.DefineAsRegister(node), g.UseRegister(base), g.UseRegister(index));
 }
 
-void InstructionSelector::VisitAtomicStore(Node* node) {
+void InstructionSelector::VisitWord32AtomicStore(Node* node) {
   MachineRepresentation rep = AtomicStoreRepresentationOf(node->op());
   S390OperandGenerator g(this);
   Node* base = node->InputAt(0);
@@ -2334,13 +2217,13 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
   ArchOpcode opcode = kArchNop;
   switch (rep) {
     case MachineRepresentation::kWord8:
-      opcode = kAtomicStoreWord8;
+      opcode = kWord32AtomicStoreWord8;
       break;
     case MachineRepresentation::kWord16:
-      opcode = kAtomicStoreWord16;
+      opcode = kWord32AtomicStoreWord16;
       break;
     case MachineRepresentation::kWord32:
-      opcode = kAtomicStoreWord32;
+      opcode = kWord32AtomicStoreWord32;
       break;
     default:
       UNREACHABLE();
@@ -2356,7 +2239,7 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
        inputs);
 }
 
-void InstructionSelector::VisitAtomicExchange(Node* node) {
+void InstructionSelector::VisitWord32AtomicExchange(Node* node) {
   S390OperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -2364,15 +2247,15 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   ArchOpcode opcode = kArchNop;
   MachineType type = AtomicOpRepresentationOf(node->op());
   if (type == MachineType::Int8()) {
-    opcode = kAtomicExchangeInt8;
+    opcode = kWord32AtomicExchangeInt8;
   } else if (type == MachineType::Uint8()) {
-    opcode = kAtomicExchangeUint8;
+    opcode = kWord32AtomicExchangeUint8;
   } else if (type == MachineType::Int16()) {
-    opcode = kAtomicExchangeInt16;
+    opcode = kWord32AtomicExchangeInt16;
   } else if (type == MachineType::Uint16()) {
-    opcode = kAtomicExchangeUint16;
+    opcode = kWord32AtomicExchangeUint16;
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
-    opcode = kAtomicExchangeWord32;
+    opcode = kWord32AtomicExchangeWord32;
   } else {
     UNREACHABLE();
     return;
@@ -2390,19 +2273,19 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   Emit(code, 1, outputs, input_count, inputs);
 }
 
-void InstructionSelector::VisitAtomicCompareExchange(Node* node) {
+void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitAtomicAdd(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitWord32AtomicAdd(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitAtomicSub(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitWord32AtomicSub(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitAtomicAnd(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitWord32AtomicAnd(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitAtomicOr(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitWord32AtomicOr(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::VisitAtomicXor(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitWord32AtomicXor(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI32x4Splat(Node* node) { UNIMPLEMENTED(); }
 
@@ -2572,9 +2455,9 @@ void InstructionSelector::VisitF32x4ExtractLane(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitF32x4ReplaceLane(Node* node) { UNIMPLEMENTED(); }
 
-void InstructionSelector::EmitPrepareResults(ZoneVector<PushParameter>* results,
-                                             const CallDescriptor* descriptor,
-                                             Node* node) {
+void InstructionSelector::EmitPrepareResults(
+    ZoneVector<PushParameter>* results, const CallDescriptor* call_descriptor,
+    Node* node) {
   // TODO(John): Port.
 }
 
@@ -2588,6 +2471,18 @@ void InstructionSelector::VisitF32x4Min(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitF32x4Max(Node* node) { UNIMPLEMENTED(); }
 
+void InstructionSelector::VisitS128Select(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF32x4Neg(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF32x4Abs(Node* node) { UNIMPLEMENTED(); }
+
+void InstructionSelector::VisitF32x4RecipSqrtApprox(Node* node) {
+  UNIMPLEMENTED();
+}
+
+void InstructionSelector::VisitF32x4RecipApprox(Node* node) { UNIMPLEMENTED(); }
+
 // static
 MachineOperatorBuilder::Flags
 InstructionSelector::SupportedMachineOperatorFlags() {
diff --git a/deps/v8/src/compiler/schedule.cc b/deps/v8/src/compiler/schedule.cc
index 2ec3f11be78..41fad5da639 100644
--- a/deps/v8/src/compiler/schedule.cc
+++ b/deps/v8/src/compiler/schedule.cc
@@ -352,6 +352,25 @@ void Schedule::EnsureCFGWellFormedness() {
       if (block->deferred()) {
         EnsureDeferredCodeSingleEntryPoint(block);
       }
+    } else {
+      EliminateNoopPhiNodes(block);
+    }
+  }
+}
+
+void Schedule::EliminateNoopPhiNodes(BasicBlock* block) {
+  // Ensure that useless phi nodes in blocks that only have a single predecessor
+  // -- which can happen with the automatically generated code in the CSA and
+  // torque -- are pruned.
+  if (block->PredecessorCount() == 1) {
+    for (size_t i = 0; i < block->NodeCount();) {
+      Node* node = block->NodeAt(i);
+      if (node->opcode() == IrOpcode::kPhi) {
+        node->ReplaceUses(node->InputAt(0));
+        block->RemoveNode(block->begin() + i);
+      } else {
+        ++i;
+      }
     }
   }
 }
diff --git a/deps/v8/src/compiler/schedule.h b/deps/v8/src/compiler/schedule.h
index ed69958e8ba..74e51c53411 100644
--- a/deps/v8/src/compiler/schedule.h
+++ b/deps/v8/src/compiler/schedule.h
@@ -274,6 +274,10 @@ class V8_EXPORT_PRIVATE Schedule final : public NON_EXPORTED_BASE(ZoneObject) {
 
   // Ensure properties of the CFG assumed by further stages.
   void EnsureCFGWellFormedness();
+  // Eliminates no-op phi nodes added for blocks that only have a single
+  // predecessor. This ensures the property required for SSA deconstruction that
+  // the target block of a control flow split has no phis.
+  void EliminateNoopPhiNodes(BasicBlock* block);
   // Ensure split-edge form for a hand-assembled schedule.
   void EnsureSplitEdgeForm(BasicBlock* block);
   // Ensure entry into a deferred block happens from a single hot block.
diff --git a/deps/v8/src/compiler/simd-scalar-lowering.cc b/deps/v8/src/compiler/simd-scalar-lowering.cc
index 423d757a4fc..2ea0e5764cb 100644
--- a/deps/v8/src/compiler/simd-scalar-lowering.cc
+++ b/deps/v8/src/compiler/simd-scalar-lowering.cc
@@ -85,6 +85,7 @@ void SimdScalarLowering::LowerGraph() {
   V(I32x4Shl)                     \
   V(I32x4ShrS)                    \
   V(I32x4Add)                     \
+  V(I32x4AddHoriz)                \
   V(I32x4Sub)                     \
   V(I32x4Mul)                     \
   V(I32x4MinS)                    \
@@ -115,7 +116,10 @@ void SimdScalarLowering::LowerGraph() {
   V(F32x4UConvertI32x4)             \
   V(F32x4Abs)                       \
   V(F32x4Neg)                       \
+  V(F32x4RecipApprox)               \
+  V(F32x4RecipSqrtApprox)           \
   V(F32x4Add)                       \
+  V(F32x4AddHoriz)                  \
   V(F32x4Sub)                       \
   V(F32x4Mul)                       \
   V(F32x4Min)                       \
@@ -138,6 +142,7 @@ void SimdScalarLowering::LowerGraph() {
   V(I16x8ShrS)                    \
   V(I16x8Add)                     \
   V(I16x8AddSaturateS)            \
+  V(I16x8AddHoriz)                \
   V(I16x8Sub)                     \
   V(I16x8SubSaturateS)            \
   V(I16x8Mul)                     \
@@ -179,7 +184,8 @@ void SimdScalarLowering::LowerGraph() {
   V(I8x16LtS)                     \
   V(I8x16LeS)                     \
   V(I8x16LtU)                     \
-  V(I8x16LeU)
+  V(I8x16LeU)                     \
+  V(S8x16Shuffle)
 
 MachineType SimdScalarLowering::MachineTypeFrom(SimdType simdType) {
   switch (simdType) {
@@ -354,7 +360,6 @@ void SimdScalarLowering::LowerStoreOp(MachineRepresentation rep, Node* node,
     int num_lanes = NumLanes(rep_type);
     Node** indices = zone()->NewArray<Node*>(num_lanes);
     GetIndexNodes(index, indices, rep_type);
-    DCHECK_LT(2, node->InputCount());
     Node* value = node->InputAt(2);
     DCHECK(HasReplacement(1, value));
     Node** rep_nodes = zone()->NewArray<Node*>(num_lanes);
@@ -387,14 +392,30 @@ void SimdScalarLowering::LowerStoreOp(MachineRepresentation rep, Node* node,
 }
 
 void SimdScalarLowering::LowerBinaryOp(Node* node, SimdType input_rep_type,
-                                       const Operator* op) {
+                                       const Operator* op,
+                                       bool not_horizontal) {
   DCHECK_EQ(2, node->InputCount());
   Node** rep_left = GetReplacementsWithType(node->InputAt(0), input_rep_type);
   Node** rep_right = GetReplacementsWithType(node->InputAt(1), input_rep_type);
   int num_lanes = NumLanes(input_rep_type);
   Node** rep_node = zone()->NewArray<Node*>(num_lanes);
-  for (int i = 0; i < num_lanes; ++i) {
-    rep_node[i] = graph()->NewNode(op, rep_left[i], rep_right[i]);
+  if (not_horizontal) {
+    for (int i = 0; i < num_lanes; ++i) {
+      rep_node[i] = graph()->NewNode(op, rep_left[i], rep_right[i]);
+    }
+  } else {
+    for (int i = 0; i < num_lanes / 2; ++i) {
+#if defined(V8_TARGET_BIG_ENDIAN)
+      rep_node[i] =
+          graph()->NewNode(op, rep_right[i * 2], rep_right[i * 2 + 1]);
+      rep_node[i + num_lanes / 2] =
+          graph()->NewNode(op, rep_left[i * 2], rep_left[i * 2 + 1]);
+#else
+      rep_node[i] = graph()->NewNode(op, rep_left[i * 2], rep_left[i * 2 + 1]);
+      rep_node[i + num_lanes / 2] =
+          graph()->NewNode(op, rep_right[i * 2], rep_right[i * 2 + 1]);
+#endif
+    }
   }
   ReplaceNode(node, rep_node, num_lanes);
 }
@@ -436,7 +457,8 @@ Node* SimdScalarLowering::FixUpperBits(Node* input, int32_t shift) {
 
 void SimdScalarLowering::LowerBinaryOpForSmallInt(Node* node,
                                                   SimdType input_rep_type,
-                                                  const Operator* op) {
+                                                  const Operator* op,
+                                                  bool not_horizontal) {
   DCHECK_EQ(2, node->InputCount());
   DCHECK(input_rep_type == SimdType::kInt16x8 ||
          input_rep_type == SimdType::kInt8x16);
@@ -446,9 +468,29 @@ void SimdScalarLowering::LowerBinaryOpForSmallInt(Node* node,
   Node** rep_node = zone()->NewArray<Node*>(num_lanes);
   int32_t shift_val =
       (input_rep_type == SimdType::kInt16x8) ? kShift16 : kShift8;
-  for (int i = 0; i < num_lanes; ++i) {
-    rep_node[i] = FixUpperBits(graph()->NewNode(op, rep_left[i], rep_right[i]),
-                               shift_val);
+  if (not_horizontal) {
+    for (int i = 0; i < num_lanes; ++i) {
+      rep_node[i] = FixUpperBits(
+          graph()->NewNode(op, rep_left[i], rep_right[i]), shift_val);
+    }
+  } else {
+    for (int i = 0; i < num_lanes / 2; ++i) {
+#if defined(V8_TARGET_BIG_ENDIAN)
+      rep_node[i] = FixUpperBits(
+          graph()->NewNode(op, rep_right[i * 2], rep_right[i * 2 + 1]),
+          shift_val);
+      rep_node[i + num_lanes / 2] = FixUpperBits(
+          graph()->NewNode(op, rep_left[i * 2], rep_left[i * 2 + 1]),
+          shift_val);
+#else
+      rep_node[i] = FixUpperBits(
+          graph()->NewNode(op, rep_left[i * 2], rep_left[i * 2 + 1]),
+          shift_val);
+      rep_node[i + num_lanes / 2] = FixUpperBits(
+          graph()->NewNode(op, rep_right[i * 2], rep_right[i * 2 + 1]),
+          shift_val);
+#endif
+    }
   }
   ReplaceNode(node, rep_node, num_lanes);
 }
@@ -578,9 +620,9 @@ Node* SimdScalarLowering::BuildF64Trunc(Node* input) {
     args[3] = graph()->start();
     Signature<MachineType>::Builder sig_builder(zone(), 0, 1);
     sig_builder.AddParam(MachineType::Pointer());
-    CallDescriptor* desc =
+    auto call_descriptor =
         Linkage::GetSimplifiedCDescriptor(zone(), sig_builder.Build());
-    Node* call = graph()->NewNode(common()->Call(desc), 4, args);
+    Node* call = graph()->NewNode(common()->Call(call_descriptor), 4, args);
     return graph()->NewNode(machine()->Load(LoadRepresentation::Float64()),
                             stack_slot, jsgraph_->Int32Constant(0), call,
                             graph()->start());
@@ -622,7 +664,7 @@ void SimdScalarLowering::LowerConvertFromFloat(Node* node, bool is_signed) {
 
 void SimdScalarLowering::LowerShiftOp(Node* node, SimdType type) {
   DCHECK_EQ(1, node->InputCount());
-  int32_t shift_amount = OpParameter<int32_t>(node);
+  int32_t shift_amount = OpParameter<int32_t>(node->op());
   Node* shift_node = graph()->NewNode(common()->Int32Constant(shift_amount));
   Node** rep = GetReplacementsWithType(node->InputAt(0), type);
   int num_lanes = NumLanes(type);
@@ -636,7 +678,8 @@ void SimdScalarLowering::LowerShiftOp(Node* node, SimdType type) {
             graph()->NewNode(machine()->Word32Shr(), rep_node[i], shift_node);
         break;
       case IrOpcode::kI16x8ShrU:
-        rep_node[i] = Mask(rep_node[i], kMask16);  // Fall through.
+        rep_node[i] = Mask(rep_node[i], kMask16);
+        V8_FALLTHROUGH;
       case IrOpcode::kI32x4ShrU:
         rep_node[i] =
             graph()->NewNode(machine()->Word32Shr(), rep_node[i], shift_node);
@@ -744,29 +787,42 @@ void SimdScalarLowering::LowerNode(Node* node) {
     }
     case IrOpcode::kUnalignedLoad: {
       MachineRepresentation rep =
-          UnalignedLoadRepresentationOf(node->op()).representation();
+          LoadRepresentationOf(node->op()).representation();
       const Operator* load_op;
       load_op = machine()->UnalignedLoad(MachineTypeFrom(rep_type));
       LowerLoadOp(rep, node, load_op, rep_type);
       break;
     }
     case IrOpcode::kStore: {
+      // For store operation, use replacement type of its input instead of the
+      // one of its effected node.
+      DCHECK_LT(2, node->InputCount());
+      SimdType input_rep_type = ReplacementType(node->InputAt(2));
+      if (input_rep_type != rep_type)
+        replacements_[node->id()].type = input_rep_type;
       MachineRepresentation rep =
           StoreRepresentationOf(node->op()).representation();
       WriteBarrierKind write_barrier_kind =
           StoreRepresentationOf(node->op()).write_barrier_kind();
       const Operator* store_op;
-      store_op = machine()->Store(StoreRepresentation(
-          MachineTypeFrom(rep_type).representation(), write_barrier_kind));
-      LowerStoreOp(rep, node, store_op, rep_type);
+      store_op = machine()->Store(
+          StoreRepresentation(MachineTypeFrom(input_rep_type).representation(),
+                              write_barrier_kind));
+      LowerStoreOp(rep, node, store_op, input_rep_type);
       break;
     }
     case IrOpcode::kUnalignedStore: {
+      // For store operation, use replacement type of its input instead of the
+      // one of its effected node.
+      DCHECK_LT(2, node->InputCount());
+      SimdType input_rep_type = ReplacementType(node->InputAt(2));
+      if (input_rep_type != rep_type)
+        replacements_[node->id()].type = input_rep_type;
       MachineRepresentation rep = UnalignedStoreRepresentationOf(node->op());
       const Operator* store_op;
-      store_op =
-          machine()->UnalignedStore(MachineTypeFrom(rep_type).representation());
-      LowerStoreOp(rep, node, store_op, rep_type);
+      store_op = machine()->UnalignedStore(
+          MachineTypeFrom(input_rep_type).representation());
+      LowerStoreOp(rep, node, store_op, input_rep_type);
       break;
     }
     case IrOpcode::kReturn: {
@@ -779,18 +835,18 @@ void SimdScalarLowering::LowerNode(Node* node) {
     }
     case IrOpcode::kCall: {
       // TODO(turbofan): Make wasm code const-correct wrt. CallDescriptor.
-      CallDescriptor* descriptor =
+      auto call_descriptor =
           const_cast<CallDescriptor*>(CallDescriptorOf(node->op()));
       if (DefaultLowering(node) ||
-          (descriptor->ReturnCount() == 1 &&
-           descriptor->GetReturnType(0) == MachineType::Simd128())) {
+          (call_descriptor->ReturnCount() == 1 &&
+           call_descriptor->GetReturnType(0) == MachineType::Simd128())) {
         // We have to adjust the call descriptor.
-        const Operator* op =
-            common()->Call(GetI32WasmCallDescriptorForSimd(zone(), descriptor));
+        const Operator* op = common()->Call(
+            GetI32WasmCallDescriptorForSimd(zone(), call_descriptor));
         NodeProperties::ChangeOp(node, op);
       }
-      if (descriptor->ReturnCount() == 1 &&
-          descriptor->GetReturnType(0) == MachineType::Simd128()) {
+      if (call_descriptor->ReturnCount() == 1 &&
+          call_descriptor->GetReturnType(0) == MachineType::Simd128()) {
         // We access the additional return values through projections.
         Node* rep_node[kNumLanes32];
         for (int i = 0; i < kNumLanes32; ++i) {
@@ -831,6 +887,14 @@ void SimdScalarLowering::LowerNode(Node* node) {
       I32X4_BINOP_CASE(kS128Or, Word32Or)
       I32X4_BINOP_CASE(kS128Xor, Word32Xor)
 #undef I32X4_BINOP_CASE
+    case IrOpcode::kI32x4AddHoriz: {
+      LowerBinaryOp(node, rep_type, machine()->Int32Add(), false);
+      break;
+    }
+    case IrOpcode::kI16x8AddHoriz: {
+      LowerBinaryOpForSmallInt(node, rep_type, machine()->Int32Add(), false);
+      break;
+    }
     case IrOpcode::kI16x8Add:
     case IrOpcode::kI8x16Add: {
       LowerBinaryOpForSmallInt(node, rep_type, machine()->Int32Add());
@@ -940,6 +1004,10 @@ void SimdScalarLowering::LowerNode(Node* node) {
       LowerShiftOp(node, rep_type);
       break;
     }
+    case IrOpcode::kF32x4AddHoriz: {
+      LowerBinaryOp(node, rep_type, machine()->Float32Add(), false);
+      break;
+    }
 #define F32X4_BINOP_CASE(name)                                 \
   case IrOpcode::kF32x4##name: {                               \
     LowerBinaryOp(node, rep_type, machine()->Float32##name()); \
@@ -959,6 +1027,22 @@ void SimdScalarLowering::LowerNode(Node* node) {
       F32X4_UNOP_CASE(Abs)
       F32X4_UNOP_CASE(Neg)
 #undef F32x4_UNOP_CASE
+    case IrOpcode::kF32x4RecipApprox:
+    case IrOpcode::kF32x4RecipSqrtApprox: {
+      DCHECK_EQ(1, node->InputCount());
+      Node** rep = GetReplacementsWithType(node->InputAt(0), rep_type);
+      Node** rep_node = zone()->NewArray<Node*>(num_lanes);
+      Node* float_one = graph()->NewNode(common()->Float32Constant(1.0));
+      for (int i = 0; i < num_lanes; ++i) {
+        Node* tmp = rep[i];
+        if (node->opcode() == IrOpcode::kF32x4RecipSqrtApprox) {
+          tmp = graph()->NewNode(machine()->Float32Sqrt(), rep[i]);
+        }
+        rep_node[i] = graph()->NewNode(machine()->Float32Div(), float_one, tmp);
+      }
+      ReplaceNode(node, rep_node, num_lanes);
+      break;
+    }
     case IrOpcode::kF32x4SConvertI32x4: {
       LowerUnaryOp(node, SimdType::kInt32x4, machine()->RoundInt32ToFloat32());
       break;
@@ -986,7 +1070,7 @@ void SimdScalarLowering::LowerNode(Node* node) {
     case IrOpcode::kF32x4ExtractLane:
     case IrOpcode::kI16x8ExtractLane:
     case IrOpcode::kI8x16ExtractLane: {
-      int32_t lane = OpParameter<int32_t>(node);
+      int32_t lane = OpParameter<int32_t>(node->op());
       Node** rep_node = zone()->NewArray<Node*>(num_lanes);
       rep_node[0] = GetReplacementsWithType(node->InputAt(0), rep_type)[lane];
       for (int i = 1; i < num_lanes; ++i) {
@@ -1001,8 +1085,12 @@ void SimdScalarLowering::LowerNode(Node* node) {
     case IrOpcode::kI8x16ReplaceLane: {
       DCHECK_EQ(2, node->InputCount());
       Node* repNode = node->InputAt(1);
-      int32_t lane = OpParameter<int32_t>(node);
-      Node** rep_node = GetReplacementsWithType(node->InputAt(0), rep_type);
+      int32_t lane = OpParameter<int32_t>(node->op());
+      Node** old_rep_node = GetReplacementsWithType(node->InputAt(0), rep_type);
+      Node** rep_node = zone()->NewArray<Node*>(num_lanes);
+      for (int i = 0; i < num_lanes; ++i) {
+        rep_node[i] = old_rep_node[i];
+      }
       if (HasReplacement(0, repNode)) {
         rep_node[lane] = GetReplacements(repNode)[0];
       } else {
@@ -1075,15 +1163,29 @@ void SimdScalarLowering::LowerNode(Node* node) {
       Node** rep_right = GetReplacementsWithType(node->InputAt(2), rep_type);
       Node** rep_node = zone()->NewArray<Node*>(num_lanes);
       for (int i = 0; i < num_lanes; ++i) {
-        Diamond d(graph(), common(),
-                  graph()->NewNode(machine()->Word32Equal(), boolean_input[i],
-                                   jsgraph_->Int32Constant(0)));
-        rep_node[i] = d.Phi(MachineTypeFrom(rep_type).representation(),
-                            rep_right[1], rep_left[0]);
+        Node* tmp1 =
+            graph()->NewNode(machine()->Word32Xor(), rep_left[i], rep_right[i]);
+        Node* tmp2 =
+            graph()->NewNode(machine()->Word32And(), boolean_input[i], tmp1);
+        rep_node[i] =
+            graph()->NewNode(machine()->Word32Xor(), rep_right[i], tmp2);
       }
       ReplaceNode(node, rep_node, num_lanes);
       break;
     }
+    case IrOpcode::kS8x16Shuffle: {
+      DCHECK_EQ(2, node->InputCount());
+      const uint8_t* shuffle = OpParameter<uint8_t*>(node->op());
+      Node** rep_left = GetReplacementsWithType(node->InputAt(0), rep_type);
+      Node** rep_right = GetReplacementsWithType(node->InputAt(1), rep_type);
+      Node** rep_node = zone()->NewArray<Node*>(16);
+      for (int i = 0; i < 16; i++) {
+        int lane = shuffle[i];
+        rep_node[i] = lane < 16 ? rep_left[lane] : rep_right[lane - 16];
+      }
+      ReplaceNode(node, rep_node, 16);
+      break;
+    }
     default: { DefaultLowering(node); }
   }
 }
diff --git a/deps/v8/src/compiler/simd-scalar-lowering.h b/deps/v8/src/compiler/simd-scalar-lowering.h
index f7f276cd5ea..ad329877e26 100644
--- a/deps/v8/src/compiler/simd-scalar-lowering.h
+++ b/deps/v8/src/compiler/simd-scalar-lowering.h
@@ -73,12 +73,13 @@ class SimdScalarLowering {
                    const Operator* load_op, SimdType type);
   void LowerStoreOp(MachineRepresentation rep, Node* node,
                     const Operator* store_op, SimdType rep_type);
-  void LowerBinaryOp(Node* node, SimdType input_rep_type, const Operator* op);
+  void LowerBinaryOp(Node* node, SimdType input_rep_type, const Operator* op,
+                     bool not_horizontal = true);
   void LowerCompareOp(Node* node, SimdType input_rep_type, const Operator* op,
                       bool invert_inputs = false);
   Node* FixUpperBits(Node* input, int32_t shift);
   void LowerBinaryOpForSmallInt(Node* node, SimdType input_rep_type,
-                                const Operator* op);
+                                const Operator* op, bool not_horizontal = true);
   Node* Mask(Node* input, int32_t mask);
   void LowerSaturateBinaryOp(Node* node, SimdType input_rep_type,
                              const Operator* op, bool is_signed);
diff --git a/deps/v8/src/compiler/simplified-lowering.cc b/deps/v8/src/compiler/simplified-lowering.cc
index 6e6c011fc1e..8a10ea71e27 100644
--- a/deps/v8/src/compiler/simplified-lowering.cc
+++ b/deps/v8/src/compiler/simplified-lowering.cc
@@ -82,29 +82,32 @@ MachineRepresentation MachineRepresentationFromArrayType(
       return MachineRepresentation::kFloat32;
     case kExternalFloat64Array:
       return MachineRepresentation::kFloat64;
+    case kExternalBigInt64Array:
+    case kExternalBigUint64Array:
+      UNIMPLEMENTED();
   }
   UNREACHABLE();
 }
 
 UseInfo CheckedUseInfoAsWord32FromHint(
-    NumberOperationHint hint,
+    NumberOperationHint hint, const VectorSlotPair& feedback = VectorSlotPair(),
     IdentifyZeros identify_zeros = kDistinguishZeros) {
   switch (hint) {
     case NumberOperationHint::kSignedSmall:
     case NumberOperationHint::kSignedSmallInputs:
-      return UseInfo::CheckedSignedSmallAsWord32(identify_zeros,
-                                                 VectorSlotPair());
+      return UseInfo::CheckedSignedSmallAsWord32(identify_zeros, feedback);
     case NumberOperationHint::kSigned32:
-      return UseInfo::CheckedSigned32AsWord32(identify_zeros);
+      return UseInfo::CheckedSigned32AsWord32(identify_zeros, feedback);
     case NumberOperationHint::kNumber:
-      return UseInfo::CheckedNumberAsWord32();
+      return UseInfo::CheckedNumberAsWord32(feedback);
     case NumberOperationHint::kNumberOrOddball:
-      return UseInfo::CheckedNumberOrOddballAsWord32();
+      return UseInfo::CheckedNumberOrOddballAsWord32(feedback);
   }
   UNREACHABLE();
 }
 
-UseInfo CheckedUseInfoAsFloat64FromHint(NumberOperationHint hint) {
+UseInfo CheckedUseInfoAsFloat64FromHint(NumberOperationHint hint,
+                                        const VectorSlotPair& feedback) {
   switch (hint) {
     case NumberOperationHint::kSignedSmall:
     case NumberOperationHint::kSignedSmallInputs:
@@ -113,9 +116,9 @@ UseInfo CheckedUseInfoAsFloat64FromHint(NumberOperationHint hint) {
       UNREACHABLE();
       break;
     case NumberOperationHint::kNumber:
-      return UseInfo::CheckedNumberAsFloat64();
+      return UseInfo::CheckedNumberAsFloat64(feedback);
     case NumberOperationHint::kNumberOrOddball:
-      return UseInfo::CheckedNumberOrOddballAsFloat64();
+      return UseInfo::CheckedNumberOrOddballAsFloat64(feedback);
   }
   UNREACHABLE();
 }
@@ -123,6 +126,7 @@ UseInfo CheckedUseInfoAsFloat64FromHint(NumberOperationHint hint) {
 UseInfo TruncatingUseInfoFromRepresentation(MachineRepresentation rep) {
   switch (rep) {
     case MachineRepresentation::kTaggedSigned:
+      return UseInfo::TaggedSigned();
     case MachineRepresentation::kTaggedPointer:
     case MachineRepresentation::kTagged:
       return UseInfo::AnyTagged();
@@ -1022,8 +1026,8 @@ class RepresentationSelector {
   }
 
   void VisitCall(Node* node, SimplifiedLowering* lowering) {
-    const CallDescriptor* desc = CallDescriptorOf(node->op());
-    int params = static_cast<int>(desc->ParameterCount());
+    auto call_descriptor = CallDescriptorOf(node->op());
+    int params = static_cast<int>(call_descriptor->ParameterCount());
     int value_input_count = node->op()->ValueInputCount();
     // Propagate representation information from call descriptor.
     for (int i = 0; i < value_input_count; i++) {
@@ -1033,15 +1037,15 @@ class RepresentationSelector {
       } else if ((i - 1) < params) {
         ProcessInput(node, i,
                      TruncatingUseInfoFromRepresentation(
-                         desc->GetInputType(i).representation()));
+                         call_descriptor->GetInputType(i).representation()));
       } else {
         ProcessInput(node, i, UseInfo::AnyTagged());
       }
     }
     ProcessRemainingInputs(node, value_input_count);
 
-    if (desc->ReturnCount() > 0) {
-      SetOutput(node, desc->GetReturnType(0).representation());
+    if (call_descriptor->ReturnCount() > 0) {
+      SetOutput(node, call_descriptor->GetReturnType(0).representation());
     } else {
       SetOutput(node, MachineRepresentation::kTagged);
     }
@@ -1234,12 +1238,16 @@ class RepresentationSelector {
       MachineRepresentation field_representation, int field_offset,
       Type* field_type, MachineRepresentation value_representation,
       Node* value) {
-    if (base_taggedness == kTaggedBase &&
-        field_offset == HeapObject::kMapOffset) {
-      return kMapWriteBarrier;
+    WriteBarrierKind write_barrier_kind =
+        WriteBarrierKindFor(base_taggedness, field_representation, field_type,
+                            value_representation, value);
+    if (write_barrier_kind != kNoWriteBarrier) {
+      if (base_taggedness == kTaggedBase &&
+          field_offset == HeapObject::kMapOffset) {
+        write_barrier_kind = kMapWriteBarrier;
+      }
     }
-    return WriteBarrierKindFor(base_taggedness, field_representation,
-                               field_type, value_representation, value);
+    return write_barrier_kind;
   }
 
   Graph* graph() const { return jsgraph_->graph(); }
@@ -1321,13 +1329,14 @@ class RepresentationSelector {
           !right_feedback_type->Maybe(Type::MinusZero())) {
         left_identify_zeros = kIdentifyZeros;
       }
-      UseInfo left_use =
-          CheckedUseInfoAsWord32FromHint(hint, left_identify_zeros);
+      UseInfo left_use = CheckedUseInfoAsWord32FromHint(hint, VectorSlotPair(),
+                                                        left_identify_zeros);
       // For CheckedInt32Add and CheckedInt32Sub, we don't need to do
       // a minus zero check for the right hand side, since we already
       // know that the left hand side is a proper Signed32 value,
       // potentially guarded by a check.
-      UseInfo right_use = CheckedUseInfoAsWord32FromHint(hint, kIdentifyZeros);
+      UseInfo right_use = CheckedUseInfoAsWord32FromHint(hint, VectorSlotPair(),
+                                                         kIdentifyZeros);
       VisitBinop(node, left_use, right_use, MachineRepresentation::kWord32,
                  Type::Signed32());
     }
@@ -1357,7 +1366,7 @@ class RepresentationSelector {
     }
 
     // default case => Float64Add/Sub
-    VisitBinop(node, UseInfo::CheckedNumberOrOddballAsFloat64(),
+    VisitBinop(node, UseInfo::CheckedNumberOrOddballAsFloat64(VectorSlotPair()),
                MachineRepresentation::kFloat64, Type::Number());
     if (lower()) {
       ChangeToPureOp(node, Float64Op(node));
@@ -1456,7 +1465,7 @@ class RepresentationSelector {
       return;
     }
     // default case => Float64Mod
-    VisitBinop(node, UseInfo::CheckedNumberOrOddballAsFloat64(),
+    VisitBinop(node, UseInfo::CheckedNumberOrOddballAsFloat64(VectorSlotPair()),
                MachineRepresentation::kFloat64, Type::Number());
     if (lower()) ChangeToPureOp(node, Float64Op(node));
     return;
@@ -1498,7 +1507,7 @@ class RepresentationSelector {
       case IrOpcode::kExternalConstant:
         return VisitLeaf(node, MachineType::PointerRepresentation());
       case IrOpcode::kNumberConstant: {
-        double const value = OpParameter<double>(node);
+        double const value = OpParameter<double>(node->op());
         int value_as_int;
         if (DoubleToSmiInteger(value, &value_as_int)) {
           VisitLeaf(node, MachineRepresentation::kTaggedSigned);
@@ -1516,7 +1525,7 @@ class RepresentationSelector {
       case IrOpcode::kPointerConstant: {
         VisitLeaf(node, MachineType::PointerRepresentation());
         if (lower()) {
-          intptr_t const value = OpParameter<intptr_t>(node);
+          intptr_t const value = OpParameter<intptr_t>(node->op());
           DeferReplacement(node, lowering->jsgraph()->IntPtrConstant(value));
         }
         return;
@@ -1717,9 +1726,10 @@ class RepresentationSelector {
             // on Oddballs, so make sure we don't accidentially sneak in a
             // hint with Oddball feedback here.
             DCHECK_NE(IrOpcode::kSpeculativeNumberEqual, node->opcode());
-          // Fallthrough
+            V8_FALLTHROUGH;
           case NumberOperationHint::kNumber:
-            VisitBinop(node, CheckedUseInfoAsFloat64FromHint(hint),
+            VisitBinop(node,
+                       CheckedUseInfoAsFloat64FromHint(hint, VectorSlotPair()),
                        MachineRepresentation::kBit);
             if (lower()) ChangeToPureOp(node, Float64Op(node));
             return;
@@ -1792,7 +1802,8 @@ class RepresentationSelector {
         }
 
         // Checked float64 x float64 => float64
-        VisitBinop(node, UseInfo::CheckedNumberOrOddballAsFloat64(),
+        VisitBinop(node,
+                   UseInfo::CheckedNumberOrOddballAsFloat64(VectorSlotPair()),
                    MachineRepresentation::kFloat64, Type::Number());
         if (lower()) ChangeToPureOp(node, Float64Op(node));
         return;
@@ -1886,7 +1897,8 @@ class RepresentationSelector {
         }
 
         // default case => Float64Div
-        VisitBinop(node, UseInfo::CheckedNumberOrOddballAsFloat64(),
+        VisitBinop(node,
+                   UseInfo::CheckedNumberOrOddballAsFloat64(VectorSlotPair()),
                    MachineRepresentation::kFloat64, Type::Number());
         if (lower()) ChangeToPureOp(node, Float64Op(node));
         return;
@@ -2320,7 +2332,6 @@ class RepresentationSelector {
                    MachineRepresentation::kTaggedPointer);
         return;
       }
-      case IrOpcode::kClassOf:
       case IrOpcode::kTypeOf: {
         return VisitUnop(node, UseInfo::AnyTagged(),
                          MachineRepresentation::kTaggedPointer);
@@ -2338,38 +2349,22 @@ class RepresentationSelector {
         return VisitBinop(node, UseInfo::AnyTagged(),
                           MachineRepresentation::kTaggedPointer);
       }
-      case IrOpcode::kStringCharAt: {
-        VisitBinop(node, UseInfo::AnyTagged(), UseInfo::TruncatingWord32(),
-                   MachineRepresentation::kTaggedPointer);
-        return;
-      }
       case IrOpcode::kStringCharCodeAt: {
-        Type* string_type = TypeOf(node->InputAt(0));
-        if (string_type->Is(Type::SeqString())) {
-          VisitBinop(node, UseInfo::AnyTagged(), UseInfo::TruncatingWord32(),
-                     MachineRepresentation::kWord32);
-          if (lower()) {
-            NodeProperties::ChangeOp(node, simplified()->SeqStringCharCodeAt());
-          }
-        } else {
-          // TODO(turbofan): Allow builtins to return untagged values.
-          VisitBinop(node, UseInfo::AnyTagged(), UseInfo::TruncatingWord32(),
-                     MachineRepresentation::kTaggedSigned);
-        }
-        return;
+        return VisitBinop(node, UseInfo::AnyTagged(),
+                          UseInfo::TruncatingWord32(),
+                          MachineRepresentation::kWord32);
       }
       case IrOpcode::kStringCodePointAt: {
-        // TODO(turbofan): Allow builtins to return untagged values.
-        VisitBinop(node, UseInfo::AnyTagged(), UseInfo::TruncatingWord32(),
-                   MachineRepresentation::kTaggedSigned);
-        return;
+        return VisitBinop(node, UseInfo::AnyTagged(),
+                          UseInfo::TruncatingWord32(),
+                          MachineRepresentation::kTaggedSigned);
       }
-      case IrOpcode::kStringFromCharCode: {
+      case IrOpcode::kStringFromSingleCharCode: {
         VisitUnop(node, UseInfo::TruncatingWord32(),
                   MachineRepresentation::kTaggedPointer);
         return;
       }
-      case IrOpcode::kStringFromCodePoint: {
+      case IrOpcode::kStringFromSingleCodePoint: {
         VisitUnop(node, UseInfo::TruncatingWord32(),
                   MachineRepresentation::kTaggedPointer);
         return;
@@ -2389,6 +2384,14 @@ class RepresentationSelector {
                   MachineRepresentation::kTaggedSigned);
         return;
       }
+      case IrOpcode::kStringSubstring: {
+        ProcessInput(node, 0, UseInfo::AnyTagged());
+        ProcessInput(node, 1, UseInfo::TruncatingWord32());
+        ProcessInput(node, 2, UseInfo::TruncatingWord32());
+        ProcessRemainingInputs(node, 3);
+        SetOutput(node, MachineRepresentation::kTaggedPointer);
+        return;
+      }
       case IrOpcode::kStringToLowerCaseIntl:
       case IrOpcode::kStringToUpperCaseIntl: {
         VisitUnop(node, UseInfo::AnyTagged(),
@@ -2396,6 +2399,7 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kCheckBounds: {
+        const CheckParameters& p = CheckParametersOf(node->op());
         Type* index_type = TypeOf(node->InputAt(0));
         Type* length_type = TypeOf(node->InputAt(1));
         if (index_type->Is(Type::Integral32OrMinusZero())) {
@@ -2414,9 +2418,10 @@ class RepresentationSelector {
             }
           }
         } else {
-          VisitBinop(node, UseInfo::CheckedSigned32AsWord32(kIdentifyZeros),
-                     UseInfo::TruncatingWord32(),
-                     MachineRepresentation::kWord32);
+          VisitBinop(
+              node,
+              UseInfo::CheckedSigned32AsWord32(kIdentifyZeros, p.feedback()),
+              UseInfo::TruncatingWord32(), MachineRepresentation::kWord32);
         }
         return;
       }
@@ -2483,17 +2488,6 @@ class RepresentationSelector {
         VisitCheck(node, Type::Symbol(), lowering);
         return;
       }
-      case IrOpcode::kCheckSeqString: {
-        if (InputIs(node, Type::SeqString())) {
-          VisitUnop(node, UseInfo::AnyTagged(),
-                    MachineRepresentation::kTaggedPointer);
-          if (lower()) DeferReplacement(node, node->InputAt(0));
-        } else {
-          VisitUnop(node, UseInfo::CheckedHeapObjectAsTaggedPointer(),
-                    MachineRepresentation::kTaggedPointer);
-        }
-        return;
-      }
 
       case IrOpcode::kAllocate: {
         ProcessInput(node, 0, UseInfo::TruncatingWord32());
@@ -2522,6 +2516,11 @@ class RepresentationSelector {
         MachineRepresentation field_representation =
             access.machine_type.representation();
 
+        // Convert to Smi if possible, such that we can avoid a write barrier.
+        if (field_representation == MachineRepresentation::kTagged &&
+            TypeOf(value_node)->Is(Type::SignedSmall())) {
+          field_representation = MachineRepresentation::kTaggedSigned;
+        }
         WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
             access.base_is_tagged, field_representation, access.offset,
             access.type, input_info->representation(), value_node);
@@ -2555,6 +2554,11 @@ class RepresentationSelector {
         MachineRepresentation element_representation =
             access.machine_type.representation();
 
+        // Convert to Smi if possible, such that we can avoid a write barrier.
+        if (element_representation == MachineRepresentation::kTagged &&
+            TypeOf(value_node)->Is(Type::SignedSmall())) {
+          element_representation = MachineRepresentation::kTaggedSigned;
+        }
         WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
             access.base_is_tagged, element_representation, access.type,
             input_info->representation(), value_node);
@@ -2698,17 +2702,20 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kSpeculativeToNumber: {
-        NumberOperationHint const hint = NumberOperationHintOf(node->op());
-        switch (hint) {
+        NumberOperationParameters const& p =
+            NumberOperationParametersOf(node->op());
+        switch (p.hint()) {
           case NumberOperationHint::kSigned32:
           case NumberOperationHint::kSignedSmall:
           case NumberOperationHint::kSignedSmallInputs:
-            VisitUnop(node, CheckedUseInfoAsWord32FromHint(hint),
+            VisitUnop(node,
+                      CheckedUseInfoAsWord32FromHint(p.hint(), p.feedback()),
                       MachineRepresentation::kWord32, Type::Signed32());
             break;
           case NumberOperationHint::kNumber:
           case NumberOperationHint::kNumberOrOddball:
-            VisitUnop(node, CheckedUseInfoAsFloat64FromHint(hint),
+            VisitUnop(node,
+                      CheckedUseInfoAsFloat64FromHint(p.hint(), p.feedback()),
                       MachineRepresentation::kFloat64);
             break;
         }
@@ -2737,6 +2744,89 @@ class RepresentationSelector {
         VisitObjectIs(node, Type::DetectableCallable(), lowering);
         return;
       }
+      case IrOpcode::kObjectIsFiniteNumber: {
+        Type* const input_type = GetUpperBound(node->InputAt(0));
+        if (input_type->Is(type_cache_.kSafeInteger)) {
+          VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
+          if (lower()) {
+            DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
+          }
+        } else if (!input_type->Maybe(Type::Number())) {
+          VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
+          if (lower()) {
+            DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
+          }
+        } else if (input_type->Is(Type::Number())) {
+          VisitUnop(node, UseInfo::TruncatingFloat64(),
+                    MachineRepresentation::kBit);
+          if (lower()) {
+            NodeProperties::ChangeOp(node,
+                                     lowering->simplified()->NumberIsFinite());
+          }
+        } else {
+          VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
+        }
+        return;
+      }
+      case IrOpcode::kNumberIsFinite: {
+        UNREACHABLE();
+      }
+      case IrOpcode::kObjectIsSafeInteger: {
+        Type* const input_type = GetUpperBound(node->InputAt(0));
+        if (input_type->Is(type_cache_.kSafeInteger)) {
+          VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
+          if (lower()) {
+            DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
+          }
+        } else if (!input_type->Maybe(Type::Number())) {
+          VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
+          if (lower()) {
+            DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
+          }
+        } else if (input_type->Is(Type::Number())) {
+          VisitUnop(node, UseInfo::TruncatingFloat64(),
+                    MachineRepresentation::kBit);
+          if (lower()) {
+            NodeProperties::ChangeOp(
+                node, lowering->simplified()->NumberIsSafeInteger());
+          }
+        } else {
+          VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
+        }
+        return;
+      }
+      case IrOpcode::kNumberIsSafeInteger: {
+        UNREACHABLE();
+      }
+      case IrOpcode::kObjectIsInteger: {
+        Type* const input_type = GetUpperBound(node->InputAt(0));
+        if (input_type->Is(type_cache_.kSafeInteger)) {
+          VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
+          if (lower()) {
+            DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
+          }
+        } else if (!input_type->Maybe(Type::Number())) {
+          VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
+          if (lower()) {
+            DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
+          }
+        } else if (input_type->Is(Type::Number())) {
+          VisitUnop(node, UseInfo::TruncatingFloat64(),
+                    MachineRepresentation::kBit);
+          if (lower()) {
+            NodeProperties::ChangeOp(node,
+                                     lowering->simplified()->NumberIsInteger());
+          }
+        } else {
+          VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
+        }
+        return;
+      }
+      case IrOpcode::kNumberIsInteger: {
+        VisitUnop(node, UseInfo::TruncatingFloat64(),
+                  MachineRepresentation::kBit);
+        return;
+      }
       case IrOpcode::kObjectIsMinusZero: {
         Type* const input_type = GetUpperBound(node->InputAt(0));
         if (input_type->Is(Type::MinusZero())) {
@@ -3040,10 +3130,10 @@ class RepresentationSelector {
         // Assume the output is tagged.
         return SetOutput(node, MachineRepresentation::kTagged);
       case IrOpcode::kDeadValue:
+        ProcessInput(node, 0, UseInfo::Any());
         return SetOutput(node, MachineRepresentation::kNone);
       default:
-        V8_Fatal(
-            __FILE__, __LINE__,
+        FATAL(
             "Representation inference: unsupported opcode %i (%s), node #%i\n.",
             node->opcode(), node->op()->mnemonic(), node->id());
         break;
@@ -3621,14 +3711,14 @@ Node* SimplifiedLowering::Uint32Mod(Node* const node) {
   // General case for unsigned integer modulus, with optimization for (unknown)
   // power of 2 right hand side.
   //
-  //   if rhs then
+  //   if rhs == 0 then
+  //     zero
+  //   else
   //     msk = rhs - 1
   //     if rhs & msk != 0 then
   //       lhs % rhs
   //     else
   //       lhs & msk
-  //   else
-  //     zero
   //
   // Note: We do not use the Diamond helper class here, because it really hurts
   // readability with nested diamonds.
@@ -3636,16 +3726,20 @@ Node* SimplifiedLowering::Uint32Mod(Node* const node) {
   const Operator* const phi_op =
       common()->Phi(MachineRepresentation::kWord32, 2);
 
-  Node* branch0 = graph()->NewNode(common()->Branch(BranchHint::kTrue), rhs,
+  Node* check0 = graph()->NewNode(machine()->Word32Equal(), rhs, zero);
+  Node* branch0 = graph()->NewNode(common()->Branch(BranchHint::kFalse), check0,
                                    graph()->start());
 
   Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
-  Node* true0;
+  Node* true0 = zero;
+
+  Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
+  Node* false0;
   {
     Node* msk = graph()->NewNode(machine()->Int32Add(), rhs, minus_one);
 
     Node* check1 = graph()->NewNode(machine()->Word32And(), rhs, msk);
-    Node* branch1 = graph()->NewNode(common()->Branch(), check1, if_true0);
+    Node* branch1 = graph()->NewNode(common()->Branch(), check1, if_false0);
 
     Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
     Node* true1 = graph()->NewNode(machine()->Uint32Mod(), lhs, rhs, if_true1);
@@ -3653,13 +3747,10 @@ Node* SimplifiedLowering::Uint32Mod(Node* const node) {
     Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
     Node* false1 = graph()->NewNode(machine()->Word32And(), lhs, msk);
 
-    if_true0 = graph()->NewNode(merge_op, if_true1, if_false1);
-    true0 = graph()->NewNode(phi_op, true1, false1, if_true0);
+    if_false0 = graph()->NewNode(merge_op, if_true1, if_false1);
+    false0 = graph()->NewNode(phi_op, true1, false1, if_false0);
   }
 
-  Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
-  Node* false0 = zero;
-
   Node* merge0 = graph()->NewNode(merge_op, if_true0, if_false0);
   return graph()->NewNode(phi_op, true0, false0, merge0);
 }
@@ -3809,10 +3900,10 @@ Operator const* SimplifiedLowering::ToNumberOperator() {
   if (!to_number_operator_.is_set()) {
     Callable callable = Builtins::CallableFor(isolate(), Builtins::kToNumber);
     CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
-    CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
         isolate(), graph()->zone(), callable.descriptor(), 0, flags,
         Operator::kNoProperties);
-    to_number_operator_.set(common()->Call(desc));
+    to_number_operator_.set(common()->Call(call_descriptor));
   }
   return to_number_operator_.get();
 }
@@ -3821,10 +3912,10 @@ Operator const* SimplifiedLowering::ToNumericOperator() {
   if (!to_numeric_operator_.is_set()) {
     Callable callable = Builtins::CallableFor(isolate(), Builtins::kToNumeric);
     CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
-    CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
         isolate(), graph()->zone(), callable.descriptor(), 0, flags,
         Operator::kNoProperties);
-    to_numeric_operator_.set(common()->Call(desc));
+    to_numeric_operator_.set(common()->Call(call_descriptor));
   }
   return to_numeric_operator_.get();
 }
diff --git a/deps/v8/src/compiler/simplified-operator.cc b/deps/v8/src/compiler/simplified-operator.cc
index 9978bae1222..5a09dc34ae3 100644
--- a/deps/v8/src/compiler/simplified-operator.cc
+++ b/deps/v8/src/compiler/simplified-operator.cc
@@ -258,11 +258,6 @@ std::ostream& operator<<(std::ostream& os, CheckTaggedInputMode mode) {
   UNREACHABLE();
 }
 
-CheckTaggedInputMode CheckTaggedInputModeOf(const Operator* op) {
-  DCHECK(op->opcode() == IrOpcode::kCheckedTaggedToFloat64);
-  return OpParameter<CheckTaggedInputMode>(op);
-}
-
 std::ostream& operator<<(std::ostream& os, GrowFastElementsMode mode) {
   switch (mode) {
     case GrowFastElementsMode::kDoubleElements:
@@ -487,8 +482,7 @@ size_t hash_value(NumberOperationHint hint) {
 }
 
 NumberOperationHint NumberOperationHintOf(const Operator* op) {
-  DCHECK(op->opcode() == IrOpcode::kSpeculativeToNumber ||
-         op->opcode() == IrOpcode::kSpeculativeNumberAdd ||
+  DCHECK(op->opcode() == IrOpcode::kSpeculativeNumberAdd ||
          op->opcode() == IrOpcode::kSpeculativeNumberSubtract ||
          op->opcode() == IrOpcode::kSpeculativeNumberMultiply ||
          op->opcode() == IrOpcode::kSpeculativeNumberDivide ||
@@ -507,6 +501,25 @@ NumberOperationHint NumberOperationHintOf(const Operator* op) {
   return OpParameter<NumberOperationHint>(op);
 }
 
+bool operator==(NumberOperationParameters const& lhs,
+                NumberOperationParameters const& rhs) {
+  return lhs.hint() == rhs.hint() && lhs.feedback() == rhs.feedback();
+}
+
+size_t hash_value(NumberOperationParameters const& p) {
+  return base::hash_combine(p.hint(), p.feedback());
+}
+
+std::ostream& operator<<(std::ostream& os, NumberOperationParameters const& p) {
+  return os << p.hint() << " " << p.feedback();
+}
+
+NumberOperationParameters const& NumberOperationParametersOf(
+    Operator const* op) {
+  DCHECK_EQ(IrOpcode::kSpeculativeToNumber, op->opcode());
+  return OpParameter<NumberOperationParameters>(op);
+}
+
 size_t hash_value(AllocateParameters info) {
   return base::hash_combine(info.type(), info.pretenure());
 }
@@ -537,7 +550,8 @@ Type* AllocateTypeOf(const Operator* op) {
 }
 
 UnicodeEncoding UnicodeEncodingOf(const Operator* op) {
-  DCHECK_EQ(IrOpcode::kStringFromCodePoint, op->opcode());
+  DCHECK(op->opcode() == IrOpcode::kStringFromSingleCodePoint ||
+         op->opcode() == IrOpcode::kStringCodePointAt);
   return OpParameter<UnicodeEncoding>(op);
 }
 
@@ -553,7 +567,8 @@ DeoptimizeReason DeoptimizeReasonOf(const Operator* op) {
 
 const CheckTaggedInputParameters& CheckTaggedInputParametersOf(
     const Operator* op) {
-  DCHECK(op->opcode() == IrOpcode::kCheckedTruncateTaggedToWord32);
+  DCHECK(op->opcode() == IrOpcode::kCheckedTruncateTaggedToWord32 ||
+         op->opcode() == IrOpcode::kCheckedTaggedToFloat64);
   return OpParameter<CheckTaggedInputParameters>(op);
 }
 
@@ -655,18 +670,12 @@ bool operator==(CheckMinusZeroParameters const& lhs,
   V(NumberToUint8Clamped, Operator::kNoProperties, 1, 0)         \
   V(NumberSilenceNaN, Operator::kNoProperties, 1, 0)             \
   V(StringToNumber, Operator::kNoProperties, 1, 0)               \
-  V(StringCharAt, Operator::kNoProperties, 2, 1)                 \
-  V(StringCharCodeAt, Operator::kNoProperties, 2, 1)             \
-  V(SeqStringCharCodeAt, Operator::kNoProperties, 2, 1)          \
-  V(StringCodePointAt, Operator::kNoProperties, 2, 1)            \
-  V(SeqStringCodePointAt, Operator::kNoProperties, 2, 1)         \
-  V(StringFromCharCode, Operator::kNoProperties, 1, 0)           \
+  V(StringFromSingleCharCode, Operator::kNoProperties, 1, 0)     \
   V(StringIndexOf, Operator::kNoProperties, 3, 0)                \
   V(StringLength, Operator::kNoProperties, 1, 0)                 \
   V(StringToLowerCaseIntl, Operator::kNoProperties, 1, 0)        \
   V(StringToUpperCaseIntl, Operator::kNoProperties, 1, 0)        \
   V(TypeOf, Operator::kNoProperties, 1, 1)                       \
-  V(ClassOf, Operator::kNoProperties, 1, 1)                      \
   V(PlainPrimitiveToNumber, Operator::kNoProperties, 1, 0)       \
   V(PlainPrimitiveToWord32, Operator::kNoProperties, 1, 0)       \
   V(PlainPrimitiveToFloat64, Operator::kNoProperties, 1, 0)      \
@@ -700,6 +709,12 @@ bool operator==(CheckMinusZeroParameters const& lhs,
   V(ObjectIsSymbol, Operator::kNoProperties, 1, 0)               \
   V(ObjectIsUndetectable, Operator::kNoProperties, 1, 0)         \
   V(NumberIsFloat64Hole, Operator::kNoProperties, 1, 0)          \
+  V(NumberIsFinite, Operator::kNoProperties, 1, 0)               \
+  V(ObjectIsFiniteNumber, Operator::kNoProperties, 1, 0)         \
+  V(NumberIsInteger, Operator::kNoProperties, 1, 0)              \
+  V(ObjectIsSafeInteger, Operator::kNoProperties, 1, 0)          \
+  V(NumberIsSafeInteger, Operator::kNoProperties, 1, 0)          \
+  V(ObjectIsInteger, Operator::kNoProperties, 1, 0)              \
   V(ConvertTaggedHoleToUndefined, Operator::kNoProperties, 1, 0) \
   V(SameValue, Operator::kCommutative, 2, 0)                     \
   V(ReferenceEqual, Operator::kCommutative, 2, 0)                \
@@ -710,6 +725,10 @@ bool operator==(CheckMinusZeroParameters const& lhs,
   V(NewConsString, Operator::kNoProperties, 3, 0)                \
   V(MaskIndexWithBound, Operator::kNoProperties, 2, 0)
 
+#define EFFECT_DEPENDENT_OP_LIST(V)                     \
+  V(StringCharCodeAt, Operator::kNoProperties, 2, 1)    \
+  V(StringSubstring, Operator::kNoProperties, 3, 1)
+
 #define SPECULATIVE_NUMBER_BINOP_LIST(V)      \
   SIMPLIFIED_SPECULATIVE_NUMBER_BINOP_LIST(V) \
   V(SpeculativeNumberEqual)                   \
@@ -723,7 +742,6 @@ bool operator==(CheckMinusZeroParameters const& lhs,
   V(CheckInternalizedString, 1, 1)       \
   V(CheckNotTaggedHole, 1, 1)            \
   V(CheckReceiver, 1, 1)                 \
-  V(CheckSeqString, 1, 1)                \
   V(CheckSymbol, 1, 1)                   \
   V(CheckedInt32Add, 2, 1)               \
   V(CheckedInt32Div, 2, 1)               \
@@ -755,6 +773,20 @@ struct SimplifiedOperatorGlobalCache final {
   PURE_OP_LIST(PURE)
 #undef PURE
 
+#define EFFECT_DEPENDENT(Name, properties, value_input_count,              \
+                         control_input_count)                              \
+  struct Name##Operator final : public Operator {                          \
+    Name##Operator()                                                       \
+        : Operator(IrOpcode::k##Name,                                      \
+                   Operator::kNoDeopt | Operator::kNoWrite |               \
+                       Operator::kNoThrow | properties,                    \
+                   #Name, value_input_count, 1, control_input_count, 1, 1, \
+                   0) {}                                                   \
+  };                                                                       \
+  Name##Operator k##Name;
+  EFFECT_DEPENDENT_OP_LIST(EFFECT_DEPENDENT)
+#undef EFFECT_DEPENDENT
+
 #define CHECKED(Name, value_input_count, value_output_count)             \
   struct Name##Operator final : public Operator {                        \
     Name##Operator()                                                     \
@@ -791,16 +823,30 @@ struct SimplifiedOperatorGlobalCache final {
 #undef CHECK_IF
 
   template <UnicodeEncoding kEncoding>
-  struct StringFromCodePointOperator final : public Operator1<UnicodeEncoding> {
-    StringFromCodePointOperator()
-        : Operator1<UnicodeEncoding>(IrOpcode::kStringFromCodePoint,
-                                     Operator::kPure, "StringFromCodePoint", 1,
-                                     0, 0, 1, 0, 0, kEncoding) {}
+  struct StringCodePointAtOperator final : public Operator1<UnicodeEncoding> {
+    StringCodePointAtOperator()
+        : Operator1<UnicodeEncoding>(IrOpcode::kStringCodePointAt,
+                                     Operator::kFoldable | Operator::kNoThrow,
+                                     "StringCodePointAt", 2, 1, 1, 1, 1, 0,
+                                     kEncoding) {}
   };
-  StringFromCodePointOperator<UnicodeEncoding::UTF16>
-      kStringFromCodePointOperatorUTF16;
-  StringFromCodePointOperator<UnicodeEncoding::UTF32>
-      kStringFromCodePointOperatorUTF32;
+  StringCodePointAtOperator<UnicodeEncoding::UTF16>
+      kStringCodePointAtOperatorUTF16;
+  StringCodePointAtOperator<UnicodeEncoding::UTF32>
+      kStringCodePointAtOperatorUTF32;
+
+  template <UnicodeEncoding kEncoding>
+  struct StringFromSingleCodePointOperator final
+      : public Operator1<UnicodeEncoding> {
+    StringFromSingleCodePointOperator()
+        : Operator1<UnicodeEncoding>(
+              IrOpcode::kStringFromSingleCodePoint, Operator::kPure,
+              "StringFromSingleCodePoint", 1, 0, 0, 1, 0, 0, kEncoding) {}
+  };
+  StringFromSingleCodePointOperator<UnicodeEncoding::UTF16>
+      kStringFromSingleCodePointOperatorUTF16;
+  StringFromSingleCodePointOperator<UnicodeEncoding::UTF32>
+      kStringFromSingleCodePointOperatorUTF32;
 
   struct ArrayBufferWasNeuteredOperator final : public Operator {
     ArrayBufferWasNeuteredOperator()
@@ -891,12 +937,13 @@ struct SimplifiedOperatorGlobalCache final {
 
   template <CheckTaggedInputMode kMode>
   struct CheckedTaggedToFloat64Operator final
-      : public Operator1<CheckTaggedInputMode> {
+      : public Operator1<CheckTaggedInputParameters> {
     CheckedTaggedToFloat64Operator()
-        : Operator1<CheckTaggedInputMode>(
+        : Operator1<CheckTaggedInputParameters>(
               IrOpcode::kCheckedTaggedToFloat64,
               Operator::kFoldable | Operator::kNoThrow,
-              "CheckedTaggedToFloat64", 1, 1, 1, 1, 1, 0, kMode) {}
+              "CheckedTaggedToFloat64", 1, 1, 1, 1, 1, 0,
+              CheckTaggedInputParameters(kMode, VectorSlotPair())) {}
   };
   CheckedTaggedToFloat64Operator<CheckTaggedInputMode::kNumber>
       kCheckedTaggedToFloat64NumberOperator;
@@ -1004,14 +1051,13 @@ struct SimplifiedOperatorGlobalCache final {
 
   template <NumberOperationHint kHint>
   struct SpeculativeToNumberOperator final
-      : public Operator1<NumberOperationHint> {
+      : public Operator1<NumberOperationParameters> {
     SpeculativeToNumberOperator()
-        : Operator1<NumberOperationHint>(
-              IrOpcode::kSpeculativeToNumber,            // opcode
-              Operator::kFoldable | Operator::kNoThrow,  // flags
-              "SpeculativeToNumber",                     // name
-              1, 1, 1, 1, 1, 0,                          // counts
-              kHint) {}                                  // parameter
+        : Operator1<NumberOperationParameters>(
+              IrOpcode::kSpeculativeToNumber,
+              Operator::kFoldable | Operator::kNoThrow, "SpeculativeToNumber",
+              1, 1, 1, 1, 1, 0,
+              NumberOperationParameters(kHint, VectorSlotPair())) {}
   };
   SpeculativeToNumberOperator<NumberOperationHint::kSignedSmall>
       kSpeculativeToNumberSignedSmallOperator;
@@ -1032,6 +1078,7 @@ SimplifiedOperatorBuilder::SimplifiedOperatorBuilder(Zone* zone)
 #define GET_FROM_CACHE(Name, ...) \
   const Operator* SimplifiedOperatorBuilder::Name() { return &cache_.k##Name; }
 PURE_OP_LIST(GET_FROM_CACHE)
+EFFECT_DEPENDENT_OP_LIST(GET_FROM_CACHE)
 CHECKED_OP_LIST(GET_FROM_CACHE)
 GET_FROM_CACHE(ArrayBufferWasNeutered)
 GET_FROM_CACHE(ArgumentsFrame)
@@ -1140,14 +1187,19 @@ const Operator* SimplifiedOperatorBuilder::CheckedTaggedToInt32(
 }
 
 const Operator* SimplifiedOperatorBuilder::CheckedTaggedToFloat64(
-    CheckTaggedInputMode mode) {
-  switch (mode) {
-    case CheckTaggedInputMode::kNumber:
-      return &cache_.kCheckedTaggedToFloat64NumberOperator;
-    case CheckTaggedInputMode::kNumberOrOddball:
-      return &cache_.kCheckedTaggedToFloat64NumberOrOddballOperator;
+    CheckTaggedInputMode mode, const VectorSlotPair& feedback) {
+  if (!feedback.IsValid()) {
+    switch (mode) {
+      case CheckTaggedInputMode::kNumber:
+        return &cache_.kCheckedTaggedToFloat64NumberOperator;
+      case CheckTaggedInputMode::kNumberOrOddball:
+        return &cache_.kCheckedTaggedToFloat64NumberOrOddballOperator;
+    }
   }
-  UNREACHABLE();
+  return new (zone()) Operator1<CheckTaggedInputParameters>(
+      IrOpcode::kCheckedTaggedToFloat64,
+      Operator::kFoldable | Operator::kNoThrow, "CheckedTaggedToFloat64", 1, 1,
+      1, 1, 1, 0, CheckTaggedInputParameters(mode, feedback));
 }
 
 const Operator* SimplifiedOperatorBuilder::CheckedTruncateTaggedToWord32(
@@ -1222,20 +1274,25 @@ const Operator* SimplifiedOperatorBuilder::CheckFloat64Hole(
 }
 
 const Operator* SimplifiedOperatorBuilder::SpeculativeToNumber(
-    NumberOperationHint hint) {
-  switch (hint) {
-    case NumberOperationHint::kSignedSmall:
-      return &cache_.kSpeculativeToNumberSignedSmallOperator;
-    case NumberOperationHint::kSignedSmallInputs:
-      break;
-    case NumberOperationHint::kSigned32:
-      return &cache_.kSpeculativeToNumberSigned32Operator;
-    case NumberOperationHint::kNumber:
-      return &cache_.kSpeculativeToNumberNumberOperator;
-    case NumberOperationHint::kNumberOrOddball:
-      return &cache_.kSpeculativeToNumberNumberOrOddballOperator;
+    NumberOperationHint hint, const VectorSlotPair& feedback) {
+  if (!feedback.IsValid()) {
+    switch (hint) {
+      case NumberOperationHint::kSignedSmall:
+        return &cache_.kSpeculativeToNumberSignedSmallOperator;
+      case NumberOperationHint::kSignedSmallInputs:
+        break;
+      case NumberOperationHint::kSigned32:
+        return &cache_.kSpeculativeToNumberSigned32Operator;
+      case NumberOperationHint::kNumber:
+        return &cache_.kSpeculativeToNumberNumberOperator;
+      case NumberOperationHint::kNumberOrOddball:
+        return &cache_.kSpeculativeToNumberNumberOrOddballOperator;
+    }
   }
-  UNREACHABLE();
+  return new (zone()) Operator1<NumberOperationParameters>(
+      IrOpcode::kSpeculativeToNumber, Operator::kFoldable | Operator::kNoThrow,
+      "SpeculativeToNumber", 1, 1, 1, 1, 1, 0,
+      NumberOperationParameters(hint, feedback));
 }
 
 const Operator* SimplifiedOperatorBuilder::EnsureWritableFastElements() {
@@ -1362,6 +1419,11 @@ const Operator* SimplifiedOperatorBuilder::NewArgumentsElements(
       mapped_count);                    // parameter
 }
 
+int NewArgumentsElementsMappedCountOf(const Operator* op) {
+  DCHECK_EQ(IrOpcode::kNewArgumentsElements, op->opcode());
+  return OpParameter<int>(op);
+}
+
 const Operator* SimplifiedOperatorBuilder::Allocate(Type* type,
                                                     PretenureFlag pretenure) {
   return new (zone()) Operator1<AllocateParameters>(
@@ -1378,13 +1440,24 @@ const Operator* SimplifiedOperatorBuilder::AllocateRaw(
       "AllocateRaw", 1, 1, 1, 1, 1, 1, AllocateParameters(type, pretenure));
 }
 
-const Operator* SimplifiedOperatorBuilder::StringFromCodePoint(
+const Operator* SimplifiedOperatorBuilder::StringCodePointAt(
+    UnicodeEncoding encoding) {
+  switch (encoding) {
+    case UnicodeEncoding::UTF16:
+      return &cache_.kStringCodePointAtOperatorUTF16;
+    case UnicodeEncoding::UTF32:
+      return &cache_.kStringCodePointAtOperatorUTF32;
+  }
+  UNREACHABLE();
+}
+
+const Operator* SimplifiedOperatorBuilder::StringFromSingleCodePoint(
     UnicodeEncoding encoding) {
   switch (encoding) {
     case UnicodeEncoding::UTF16:
-      return &cache_.kStringFromCodePointOperatorUTF16;
+      return &cache_.kStringFromSingleCodePointOperatorUTF16;
     case UnicodeEncoding::UTF32:
-      return &cache_.kStringFromCodePointOperatorUTF32;
+      return &cache_.kStringFromSingleCodePointOperatorUTF32;
   }
   UNREACHABLE();
 }
@@ -1463,6 +1536,7 @@ const Operator* SimplifiedOperatorBuilder::TransitionAndStoreNonNumberElement(
 }
 
 #undef PURE_OP_LIST
+#undef EFFECT_DEPENDENT_OP_LIST
 #undef SPECULATIVE_NUMBER_BINOP_LIST
 #undef CHECKED_WITH_FEEDBACK_OP_LIST
 #undef CHECKED_OP_LIST
diff --git a/deps/v8/src/compiler/simplified-operator.h b/deps/v8/src/compiler/simplified-operator.h
index 10961cf452e..22dd5e151e3 100644
--- a/deps/v8/src/compiler/simplified-operator.h
+++ b/deps/v8/src/compiler/simplified-operator.h
@@ -49,6 +49,24 @@ struct FieldAccess {
   MachineType machine_type;       // machine type of the field.
   WriteBarrierKind write_barrier_kind;  // write barrier hint.
 
+  FieldAccess()
+      : base_is_tagged(kTaggedBase),
+        offset(0),
+        type(Type::None()),
+        machine_type(MachineType::None()),
+        write_barrier_kind(kFullWriteBarrier) {}
+
+  FieldAccess(BaseTaggedness base_is_tagged, int offset, MaybeHandle<Name> name,
+              MaybeHandle<Map> map, Type* type, MachineType machine_type,
+              WriteBarrierKind write_barrier_kind)
+      : base_is_tagged(base_is_tagged),
+        offset(offset),
+        name(name),
+        map(map),
+        type(type),
+        machine_type(machine_type),
+        write_barrier_kind(write_barrier_kind) {}
+
   int tag() const { return base_is_tagged == kTaggedBase ? kHeapObjectTag : 0; }
 };
 
@@ -58,7 +76,8 @@ size_t hash_value(FieldAccess const&);
 
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, FieldAccess const&);
 
-FieldAccess const& FieldAccessOf(const Operator* op) WARN_UNUSED_RESULT;
+V8_EXPORT_PRIVATE FieldAccess const& FieldAccessOf(const Operator* op)
+    WARN_UNUSED_RESULT;
 
 template <>
 void Operator1<FieldAccess>::PrintParameter(std::ostream& os,
@@ -75,6 +94,21 @@ struct ElementAccess {
   MachineType machine_type;       // machine type of the element.
   WriteBarrierKind write_barrier_kind;  // write barrier hint.
 
+  ElementAccess()
+      : base_is_tagged(kTaggedBase),
+        header_size(0),
+        type(Type::None()),
+        machine_type(MachineType::None()),
+        write_barrier_kind(kFullWriteBarrier) {}
+
+  ElementAccess(BaseTaggedness base_is_tagged, int header_size, Type* type,
+                MachineType machine_type, WriteBarrierKind write_barrier_kind)
+      : base_is_tagged(base_is_tagged),
+        header_size(header_size),
+        type(type),
+        machine_type(machine_type),
+        write_barrier_kind(write_barrier_kind) {}
+
   int tag() const { return base_is_tagged == kTaggedBase ? kHeapObjectTag : 0; }
 };
 
@@ -90,7 +124,8 @@ V8_EXPORT_PRIVATE ElementAccess const& ElementAccessOf(const Operator* op)
 ExternalArrayType ExternalArrayTypeOf(const Operator* op) WARN_UNUSED_RESULT;
 
 // The ConvertReceiverMode is used as parameter by ConvertReceiver operators.
-ConvertReceiverMode ConvertReceiverModeOf(Operator const* op);
+ConvertReceiverMode ConvertReceiverModeOf(Operator const* op)
+    WARN_UNUSED_RESULT;
 
 // A the parameters for several Check nodes. The {feedback} parameter is
 // optional. If {feedback} references a valid CallIC slot and this MapCheck
@@ -134,8 +169,6 @@ size_t hash_value(CheckTaggedInputMode);
 
 std::ostream& operator<<(std::ostream&, CheckTaggedInputMode);
 
-CheckTaggedInputMode CheckTaggedInputModeOf(const Operator*);
-
 class CheckTaggedInputParameters {
  public:
   CheckTaggedInputParameters(CheckTaggedInputMode mode,
@@ -331,11 +364,11 @@ ElementsTransition const& ElementsTransitionOf(const Operator* op)
 // Parameters for TransitionAndStoreElement, or
 // TransitionAndStoreNonNumberElement, or
 // TransitionAndStoreNumberElement.
-Handle<Map> DoubleMapParameterOf(const Operator* op);
-Handle<Map> FastMapParameterOf(const Operator* op);
+Handle<Map> DoubleMapParameterOf(const Operator* op) WARN_UNUSED_RESULT;
+Handle<Map> FastMapParameterOf(const Operator* op) WARN_UNUSED_RESULT;
 
 // Parameters for TransitionAndStoreNonNumberElement.
-Type* ValueTypeParameterOf(const Operator* op);
+Type* ValueTypeParameterOf(const Operator* op) WARN_UNUSED_RESULT;
 
 // A hint for speculative number operations.
 enum class NumberOperationHint : uint8_t {
@@ -350,7 +383,29 @@ size_t hash_value(NumberOperationHint);
 
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, NumberOperationHint);
 
-NumberOperationHint NumberOperationHintOf(const Operator* op)
+V8_EXPORT_PRIVATE NumberOperationHint NumberOperationHintOf(const Operator* op)
+    WARN_UNUSED_RESULT;
+
+class NumberOperationParameters {
+ public:
+  NumberOperationParameters(NumberOperationHint hint,
+                            const VectorSlotPair& feedback)
+      : hint_(hint), feedback_(feedback) {}
+
+  NumberOperationHint hint() const { return hint_; }
+  const VectorSlotPair& feedback() const { return feedback_; }
+
+ private:
+  NumberOperationHint hint_;
+  VectorSlotPair feedback_;
+};
+
+size_t hash_value(NumberOperationParameters const&);
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&,
+                                           const NumberOperationParameters&);
+bool operator==(NumberOperationParameters const&,
+                NumberOperationParameters const&);
+const NumberOperationParameters& NumberOperationParametersOf(const Operator* op)
     WARN_UNUSED_RESULT;
 
 int FormalParameterCountOf(const Operator* op) WARN_UNUSED_RESULT;
@@ -387,6 +442,8 @@ AbortReason AbortReasonOf(const Operator* op) WARN_UNUSED_RESULT;
 
 DeoptimizeReason DeoptimizeReasonOf(const Operator* op) WARN_UNUSED_RESULT;
 
+int NewArgumentsElementsMappedCountOf(const Operator* op) WARN_UNUSED_RESULT;
+
 // Interface for building simplified operators, which represent the
 // medium-level operations of V8, including adding numbers, allocating objects,
 // indexing into objects and arrays, etc.
@@ -494,29 +551,27 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* SameValue();
 
   const Operator* TypeOf();
-  const Operator* ClassOf();
 
   const Operator* ToBoolean();
 
   const Operator* StringEqual();
   const Operator* StringLessThan();
   const Operator* StringLessThanOrEqual();
-  const Operator* StringCharAt();
   const Operator* StringCharCodeAt();
-  const Operator* SeqStringCharCodeAt();
-  const Operator* StringCodePointAt();
-  const Operator* SeqStringCodePointAt();
-  const Operator* StringFromCharCode();
-  const Operator* StringFromCodePoint(UnicodeEncoding encoding);
+  const Operator* StringCodePointAt(UnicodeEncoding encoding);
+  const Operator* StringFromSingleCharCode();
+  const Operator* StringFromSingleCodePoint(UnicodeEncoding encoding);
   const Operator* StringIndexOf();
   const Operator* StringLength();
   const Operator* StringToLowerCaseIntl();
   const Operator* StringToUpperCaseIntl();
+  const Operator* StringSubstring();
 
   const Operator* FindOrderedHashMapEntry();
   const Operator* FindOrderedHashMapEntryForInt32Key();
 
-  const Operator* SpeculativeToNumber(NumberOperationHint hint);
+  const Operator* SpeculativeToNumber(NumberOperationHint hint,
+                                      const VectorSlotPair& feedback);
 
   const Operator* StringToNumber();
   const Operator* PlainPrimitiveToNumber();
@@ -556,7 +611,6 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* CheckNotTaggedHole();
   const Operator* CheckNumber(const VectorSlotPair& feedback);
   const Operator* CheckReceiver();
-  const Operator* CheckSeqString();
   const Operator* CheckSmi(const VectorSlotPair& feedback);
   const Operator* CheckString(const VectorSlotPair& feedback);
   const Operator* CheckSymbol();
@@ -570,7 +624,8 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* CheckedInt32Sub();
   const Operator* CheckedInt32ToTaggedSigned(const VectorSlotPair& feedback);
   const Operator* CheckedTaggedSignedToInt32(const VectorSlotPair& feedback);
-  const Operator* CheckedTaggedToFloat64(CheckTaggedInputMode);
+  const Operator* CheckedTaggedToFloat64(CheckTaggedInputMode,
+                                         const VectorSlotPair& feedback);
   const Operator* CheckedTaggedToInt32(CheckForMinusZeroMode,
                                        const VectorSlotPair& feedback);
   const Operator* CheckedTaggedToTaggedPointer(const VectorSlotPair& feedback);
@@ -602,6 +657,12 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* ObjectIsUndetectable();
 
   const Operator* NumberIsFloat64Hole();
+  const Operator* NumberIsFinite();
+  const Operator* ObjectIsFiniteNumber();
+  const Operator* NumberIsInteger();
+  const Operator* ObjectIsSafeInteger();
+  const Operator* NumberIsSafeInteger();
+  const Operator* ObjectIsInteger();
 
   const Operator* ArgumentsFrame();
   const Operator* ArgumentsLength(int formal_parameter_count,
diff --git a/deps/v8/src/compiler/store-store-elimination.cc b/deps/v8/src/compiler/store-store-elimination.cc
index 672acb203d9..4679573f872 100644
--- a/deps/v8/src/compiler/store-store-elimination.cc
+++ b/deps/v8/src/compiler/store-store-elimination.cc
@@ -27,12 +27,11 @@ namespace compiler {
 // expression will be evaluated at runtime. If it evaluates to false, then an
 // error message will be shown containing the condition, as well as the extra
 // info formatted like with printf.
-#define CHECK_EXTRA(condition, fmt, ...)                                 \
-  do {                                                                   \
-    if (V8_UNLIKELY(!(condition))) {                                     \
-      V8_Fatal(__FILE__, __LINE__, "Check failed: %s. Extra info: " fmt, \
-               #condition, ##__VA_ARGS__);                               \
-    }                                                                    \
+#define CHECK_EXTRA(condition, fmt, ...)                                      \
+  do {                                                                        \
+    if (V8_UNLIKELY(!(condition))) {                                          \
+      FATAL("Check failed: %s. Extra info: " fmt, #condition, ##__VA_ARGS__); \
+    }                                                                         \
   } while (0)
 
 #ifdef DEBUG
@@ -257,7 +256,7 @@ UnobservablesSet RedundantStoreFinder::RecomputeSet(Node* node,
   switch (node->op()->opcode()) {
     case IrOpcode::kStoreField: {
       Node* stored_to = node->InputAt(0);
-      FieldAccess access = OpParameter<FieldAccess>(node->op());
+      const FieldAccess& access = FieldAccessOf(node->op());
       StoreOffset offset = ToOffset(access);
 
       UnobservableStore observation = {stored_to->id(), offset};
@@ -298,7 +297,7 @@ UnobservablesSet RedundantStoreFinder::RecomputeSet(Node* node,
     }
     case IrOpcode::kLoadField: {
       Node* loaded_from = node->InputAt(0);
-      FieldAccess access = OpParameter<FieldAccess>(node->op());
+      const FieldAccess& access = FieldAccessOf(node->op());
       StoreOffset offset = ToOffset(access);
 
       TRACE(
diff --git a/deps/v8/src/compiler/type-cache.h b/deps/v8/src/compiler/type-cache.h
index 428688abdea..093d9d041e0 100644
--- a/deps/v8/src/compiler/type-cache.h
+++ b/deps/v8/src/compiler/type-cache.h
@@ -36,6 +36,8 @@ class TypeCache final {
   Type* const kUint32 = Type::Unsigned32();
   Type* const kFloat32 = Type::Number();
   Type* const kFloat64 = Type::Number();
+  Type* const kBigInt64 = Type::BigInt();
+  Type* const kBigUint64 = Type::BigInt();
 
   Type* const kHoleySmi =
       Type::Union(Type::SignedSmall(), Type::Hole(), zone());
@@ -95,8 +97,8 @@ class TypeCache final {
   // [0, kMaxUInt32].
   Type* const kJSArrayLengthType = Type::Unsigned32();
 
-  // The JSTyped::length property always contains a tagged number in the range
-  // [0, kMaxSmiValue].
+  // The JSTypedArray::length property always contains a tagged number in the
+  // range [0, kMaxSmiValue].
   Type* const kJSTypedArrayLengthType = Type::UnsignedSmall();
 
   // The String::length property always contains a smi in the range
@@ -151,6 +153,10 @@ class TypeCache final {
   Type* const kArgumentsLengthType =
       Type::Range(0.0, Code::kMaxArguments, zone());
 
+  // The JSArrayIterator::kind property always contains an integer in the
+  // range [0, 2], representing the possible IterationKinds.
+  Type* const kJSArrayIteratorKindType = CreateRange(0.0, 2.0);
+
  private:
   template <typename T>
   Type* CreateRange() {
diff --git a/deps/v8/src/compiler/typed-optimization.cc b/deps/v8/src/compiler/typed-optimization.cc
index 49a4cdfdb34..8cb2c666e60 100644
--- a/deps/v8/src/compiler/typed-optimization.cc
+++ b/deps/v8/src/compiler/typed-optimization.cc
@@ -6,6 +6,7 @@
 
 #include "src/compilation-dependencies.h"
 #include "src/compiler/js-graph.h"
+#include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/simplified-operator.h"
 #include "src/compiler/type-cache.h"
@@ -85,8 +86,6 @@ Reduction TypedOptimization::Reduce(Node* node) {
       return ReduceCheckNumber(node);
     case IrOpcode::kCheckString:
       return ReduceCheckString(node);
-    case IrOpcode::kCheckSeqString:
-      return ReduceCheckSeqString(node);
     case IrOpcode::kCheckEqualsInternalizedString:
       return ReduceCheckEqualsInternalizedString(node);
     case IrOpcode::kCheckEqualsSymbol:
@@ -105,6 +104,10 @@ Reduction TypedOptimization::Reduce(Node* node) {
       return ReducePhi(node);
     case IrOpcode::kReferenceEqual:
       return ReduceReferenceEqual(node);
+    case IrOpcode::kStringEqual:
+    case IrOpcode::kStringLessThan:
+    case IrOpcode::kStringLessThanOrEqual:
+      return ReduceStringComparison(node);
     case IrOpcode::kSameValue:
       return ReduceSameValue(node);
     case IrOpcode::kSelect:
@@ -213,16 +216,6 @@ Reduction TypedOptimization::ReduceCheckString(Node* node) {
   return NoChange();
 }
 
-Reduction TypedOptimization::ReduceCheckSeqString(Node* node) {
-  Node* const input = NodeProperties::GetValueInput(node, 0);
-  Type* const input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::SeqString())) {
-    ReplaceWithValue(node, input);
-    return Replace(input);
-  }
-  return NoChange();
-}
-
 Reduction TypedOptimization::ReduceCheckEqualsInternalizedString(Node* node) {
   Node* const exp = NodeProperties::GetValueInput(node, 0);
   Type* const exp_type = NodeProperties::GetType(exp);
@@ -359,6 +352,137 @@ Reduction TypedOptimization::ReduceReferenceEqual(Node* node) {
   return NoChange();
 }
 
+const Operator* TypedOptimization::NumberComparisonFor(const Operator* op) {
+  switch (op->opcode()) {
+    case IrOpcode::kStringEqual:
+      return simplified()->NumberEqual();
+    case IrOpcode::kStringLessThan:
+      return simplified()->NumberLessThan();
+    case IrOpcode::kStringLessThanOrEqual:
+      return simplified()->NumberLessThanOrEqual();
+    default:
+      break;
+  }
+  UNREACHABLE();
+}
+
+Reduction TypedOptimization::
+    TryReduceStringComparisonOfStringFromSingleCharCodeToConstant(
+        Node* comparison, Handle<String> string, bool inverted) {
+  switch (comparison->opcode()) {
+    case IrOpcode::kStringEqual:
+      if (string->length() != 1) {
+        // String.fromCharCode(x) always has length 1.
+        return Replace(jsgraph()->BooleanConstant(false));
+      }
+      break;
+    case IrOpcode::kStringLessThan:
+      V8_FALLTHROUGH;
+    case IrOpcode::kStringLessThanOrEqual:
+      if (string->length() == 0) {
+        // String.fromCharCode(x) <= "" is always false,
+        // "" < String.fromCharCode(x) is always true.
+        return Replace(jsgraph()->BooleanConstant(inverted));
+      }
+      break;
+    default:
+      UNREACHABLE();
+  }
+  return NoChange();
+}
+
+// Try to reduces a string comparison of the form
+// String.fromCharCode(x) {comparison} {constant} if inverted is false,
+// and {constant} {comparison} String.fromCharCode(x) if inverted is true.
+Reduction
+TypedOptimization::TryReduceStringComparisonOfStringFromSingleCharCode(
+    Node* comparison, Node* from_char_code, Node* constant, bool inverted) {
+  DCHECK_EQ(IrOpcode::kStringFromSingleCharCode, from_char_code->opcode());
+  HeapObjectMatcher m(constant);
+  if (!m.HasValue() || !m.Value()->IsString()) return NoChange();
+  Handle<String> string = Handle<String>::cast(m.Value());
+
+  // Check if comparison can be resolved statically.
+  Reduction red = TryReduceStringComparisonOfStringFromSingleCharCodeToConstant(
+      comparison, string, inverted);
+  if (red.Changed()) return red;
+
+  const Operator* comparison_op = NumberComparisonFor(comparison->op());
+  Node* from_char_code_repl = NodeProperties::GetValueInput(from_char_code, 0);
+  Type* from_char_code_repl_type = NodeProperties::GetType(from_char_code_repl);
+  if (!from_char_code_repl_type->Is(type_cache_.kUint16)) {
+    // Convert to signed int32 to satisfy type of {NumberBitwiseAnd}.
+    from_char_code_repl =
+        graph()->NewNode(simplified()->NumberToInt32(), from_char_code_repl);
+    from_char_code_repl = graph()->NewNode(
+        simplified()->NumberBitwiseAnd(), from_char_code_repl,
+        jsgraph()->Constant(std::numeric_limits<uint16_t>::max()));
+  }
+  Node* constant_repl = jsgraph()->Constant(string->Get(0));
+
+  Node* number_comparison = nullptr;
+  if (inverted) {
+    // "x..." <= String.fromCharCode(z) is true if x < z.
+    if (string->length() > 1 &&
+        comparison->opcode() == IrOpcode::kStringLessThanOrEqual) {
+      comparison_op = simplified()->NumberLessThan();
+    }
+    number_comparison =
+        graph()->NewNode(comparison_op, constant_repl, from_char_code_repl);
+  } else {
+    // String.fromCharCode(z) < "x..." is true if z <= x.
+    if (string->length() > 1 &&
+        comparison->opcode() == IrOpcode::kStringLessThan) {
+      comparison_op = simplified()->NumberLessThanOrEqual();
+    }
+    number_comparison =
+        graph()->NewNode(comparison_op, from_char_code_repl, constant_repl);
+  }
+  ReplaceWithValue(comparison, number_comparison);
+  return Replace(number_comparison);
+}
+
+Reduction TypedOptimization::ReduceStringComparison(Node* node) {
+  DCHECK(IrOpcode::kStringEqual == node->opcode() ||
+         IrOpcode::kStringLessThan == node->opcode() ||
+         IrOpcode::kStringLessThanOrEqual == node->opcode());
+  Node* const lhs = NodeProperties::GetValueInput(node, 0);
+  Node* const rhs = NodeProperties::GetValueInput(node, 1);
+  if (lhs->opcode() == IrOpcode::kStringFromSingleCharCode) {
+    if (rhs->opcode() == IrOpcode::kStringFromSingleCharCode) {
+      Node* left = NodeProperties::GetValueInput(lhs, 0);
+      Node* right = NodeProperties::GetValueInput(rhs, 0);
+      Type* left_type = NodeProperties::GetType(left);
+      Type* right_type = NodeProperties::GetType(right);
+      if (!left_type->Is(type_cache_.kUint16)) {
+        // Convert to signed int32 to satisfy type of {NumberBitwiseAnd}.
+        left = graph()->NewNode(simplified()->NumberToInt32(), left);
+        left = graph()->NewNode(
+            simplified()->NumberBitwiseAnd(), left,
+            jsgraph()->Constant(std::numeric_limits<uint16_t>::max()));
+      }
+      if (!right_type->Is(type_cache_.kUint16)) {
+        // Convert to signed int32 to satisfy type of {NumberBitwiseAnd}.
+        right = graph()->NewNode(simplified()->NumberToInt32(), right);
+        right = graph()->NewNode(
+            simplified()->NumberBitwiseAnd(), right,
+            jsgraph()->Constant(std::numeric_limits<uint16_t>::max()));
+      }
+      Node* equal =
+          graph()->NewNode(NumberComparisonFor(node->op()), left, right);
+      ReplaceWithValue(node, equal);
+      return Replace(equal);
+    } else {
+      return TryReduceStringComparisonOfStringFromSingleCharCode(node, lhs, rhs,
+                                                                 false);
+    }
+  } else if (rhs->opcode() == IrOpcode::kStringFromSingleCharCode) {
+    return TryReduceStringComparisonOfStringFromSingleCharCode(node, rhs, lhs,
+                                                               true);
+  }
+  return NoChange();
+}
+
 Reduction TypedOptimization::ReduceSameValue(Node* node) {
   DCHECK_EQ(IrOpcode::kSameValue, node->opcode());
   Node* const lhs = NodeProperties::GetValueInput(node, 0);
diff --git a/deps/v8/src/compiler/typed-optimization.h b/deps/v8/src/compiler/typed-optimization.h
index 75de75b143f..e906ab37eb0 100644
--- a/deps/v8/src/compiler/typed-optimization.h
+++ b/deps/v8/src/compiler/typed-optimization.h
@@ -41,7 +41,6 @@ class V8_EXPORT_PRIVATE TypedOptimization final
   Reduction ReduceCheckMaps(Node* node);
   Reduction ReduceCheckNumber(Node* node);
   Reduction ReduceCheckString(Node* node);
-  Reduction ReduceCheckSeqString(Node* node);
   Reduction ReduceCheckEqualsInternalizedString(Node* node);
   Reduction ReduceCheckEqualsSymbol(Node* node);
   Reduction ReduceLoadField(Node* node);
@@ -50,6 +49,7 @@ class V8_EXPORT_PRIVATE TypedOptimization final
   Reduction ReduceNumberToUint8Clamped(Node* node);
   Reduction ReducePhi(Node* node);
   Reduction ReduceReferenceEqual(Node* node);
+  Reduction ReduceStringComparison(Node* node);
   Reduction ReduceSameValue(Node* node);
   Reduction ReduceSelect(Node* node);
   Reduction ReduceSpeculativeToNumber(Node* node);
@@ -57,6 +57,12 @@ class V8_EXPORT_PRIVATE TypedOptimization final
   Reduction ReduceTypeOf(Node* node);
   Reduction ReduceToBoolean(Node* node);
 
+  Reduction TryReduceStringComparisonOfStringFromSingleCharCode(
+      Node* comparison, Node* from_char_code, Node* constant, bool inverted);
+  Reduction TryReduceStringComparisonOfStringFromSingleCharCodeToConstant(
+      Node* comparison, Handle<String> string, bool inverted);
+  const Operator* NumberComparisonFor(const Operator* op);
+
   CompilationDependencies* dependencies() const { return dependencies_; }
   Factory* factory() const;
   Graph* graph() const;
diff --git a/deps/v8/src/compiler/typer.cc b/deps/v8/src/compiler/typer.cc
index 12c9a194b88..7ccca4bf0dc 100644
--- a/deps/v8/src/compiler/typer.cc
+++ b/deps/v8/src/compiler/typer.cc
@@ -325,8 +325,8 @@ class Typer::Visitor : public Reducer {
   static Type* NumberLessThanOrEqualTyper(Type*, Type*, Typer*);
   static Type* ReferenceEqualTyper(Type*, Type*, Typer*);
   static Type* SameValueTyper(Type*, Type*, Typer*);
-  static Type* StringFromCharCodeTyper(Type*, Typer*);
-  static Type* StringFromCodePointTyper(Type*, Typer*);
+  static Type* StringFromSingleCharCodeTyper(Type*, Typer*);
+  static Type* StringFromSingleCodePointTyper(Type*, Typer*);
 
   Reduction UpdateType(Node* node, Type* current) {
     if (NodeProperties::IsTyped(node)) {
@@ -734,12 +734,12 @@ Type* Typer::Visitor::TypeFloat64Constant(Node* node) {
 }
 
 Type* Typer::Visitor::TypeNumberConstant(Node* node) {
-  double number = OpParameter<double>(node);
+  double number = OpParameter<double>(node->op());
   return Type::NewConstant(number, zone());
 }
 
 Type* Typer::Visitor::TypeHeapConstant(Node* node) {
-  return TypeConstant(OpParameter<Handle<HeapObject>>(node));
+  return TypeConstant(HeapConstantOf(node->op()));
 }
 
 Type* Typer::Visitor::TypeExternalConstant(Node* node) {
@@ -1150,10 +1150,6 @@ Type* Typer::Visitor::TypeJSNegate(Node* node) {
   return TypeUnaryOp(node, Negate);
 }
 
-Type* Typer::Visitor::TypeClassOf(Node* node) {
-  return Type::InternalizedStringOrNull();
-}
-
 Type* Typer::Visitor::TypeTypeOf(Node* node) {
   return Type::InternalizedString();
 }
@@ -1212,6 +1208,10 @@ Type* Typer::Visitor::TypeJSCreateArguments(Node* node) {
 
 Type* Typer::Visitor::TypeJSCreateArray(Node* node) { return Type::Array(); }
 
+Type* Typer::Visitor::TypeJSCreateArrayIterator(Node* node) {
+  return Type::OtherObject();
+}
+
 Type* Typer::Visitor::TypeJSCreateBoundFunction(Node* node) {
   return Type::BoundFunction();
 }
@@ -1229,10 +1229,22 @@ Type* Typer::Visitor::TypeJSCreateIterResultObject(Node* node) {
   return Type::OtherObject();
 }
 
+Type* Typer::Visitor::TypeJSCreateStringIterator(Node* node) {
+  return Type::OtherObject();
+}
+
 Type* Typer::Visitor::TypeJSCreateKeyValueArray(Node* node) {
   return Type::OtherObject();
 }
 
+Type* Typer::Visitor::TypeJSCreatePromise(Node* node) {
+  return Type::OtherObject();
+}
+
+Type* Typer::Visitor::TypeJSCreateTypedArray(Node* node) {
+  return Type::OtherObject();
+}
+
 Type* Typer::Visitor::TypeJSCreateLiteralArray(Node* node) {
   return Type::Array();
 }
@@ -1370,6 +1382,8 @@ Type* Typer::Visitor::TypeJSStoreDataPropertyInLiteral(Node* node) {
   UNREACHABLE();
 }
 
+Type* Typer::Visitor::TypeJSStoreInArrayLiteral(Node* node) { UNREACHABLE(); }
+
 Type* Typer::Visitor::TypeJSDeleteProperty(Node* node) {
   return Type::Boolean();
 }
@@ -1576,8 +1590,8 @@ Type* Typer::Visitor::JSCallTyper(Type* fun, Typer* t) {
         case kStringToString:
         case kStringToUpperCase:
         case kStringTrim:
-        case kStringTrimLeft:
-        case kStringTrimRight:
+        case kStringTrimEnd:
+        case kStringTrimStart:
         case kStringValueOf:
           return Type::String();
 
@@ -1768,8 +1782,6 @@ Type* Typer::Visitor::TypeJSCallRuntime(Node* node) {
       return TypeUnaryOp(node, ToObject);
     case Runtime::kInlineToString:
       return TypeUnaryOp(node, ToString);
-    case Runtime::kInlineClassOf:
-      return Type::InternalizedStringOrNull();
     case Runtime::kHasInPrototypeChain:
       return Type::Boolean();
     default:
@@ -1822,6 +1834,10 @@ Type* Typer::Visitor::TypeJSGeneratorRestoreContinuation(Node* node) {
   return Type::SignedSmall();
 }
 
+Type* Typer::Visitor::TypeJSGeneratorRestoreContext(Node* node) {
+  return Type::Any();
+}
+
 Type* Typer::Visitor::TypeJSGeneratorRestoreRegister(Node* node) {
   return Type::Any();
 }
@@ -1834,6 +1850,26 @@ Type* Typer::Visitor::TypeJSStackCheck(Node* node) { return Type::Any(); }
 
 Type* Typer::Visitor::TypeJSDebugger(Node* node) { return Type::Any(); }
 
+Type* Typer::Visitor::TypeJSFulfillPromise(Node* node) {
+  return Type::Undefined();
+}
+
+Type* Typer::Visitor::TypeJSPerformPromiseThen(Node* node) {
+  return Type::Receiver();
+}
+
+Type* Typer::Visitor::TypeJSPromiseResolve(Node* node) {
+  return Type::Receiver();
+}
+
+Type* Typer::Visitor::TypeJSRejectPromise(Node* node) {
+  return Type::Undefined();
+}
+
+Type* Typer::Visitor::TypeJSResolvePromise(Node* node) {
+  return Type::Undefined();
+}
+
 // Simplified operators.
 
 Type* Typer::Visitor::TypeBooleanNot(Node* node) { return Type::Boolean(); }
@@ -1926,25 +1962,23 @@ Type* Typer::Visitor::TypeStringLessThanOrEqual(Node* node) {
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::StringFromCharCodeTyper(Type* type, Typer* t) {
+Type* Typer::Visitor::StringFromSingleCharCodeTyper(Type* type, Typer* t) {
   return Type::String();
 }
 
-Type* Typer::Visitor::StringFromCodePointTyper(Type* type, Typer* t) {
+Type* Typer::Visitor::StringFromSingleCodePointTyper(Type* type, Typer* t) {
   return Type::String();
 }
 
-Type* Typer::Visitor::TypeStringCharAt(Node* node) { return Type::String(); }
-
-Type* Typer::Visitor::TypeStringToLowerCaseIntl(Node* node) { UNREACHABLE(); }
-
-Type* Typer::Visitor::TypeStringToUpperCaseIntl(Node* node) { UNREACHABLE(); }
+Type* Typer::Visitor::TypeStringToLowerCaseIntl(Node* node) {
+  return Type::String();
+}
 
-Type* Typer::Visitor::TypeStringCharCodeAt(Node* node) {
-  return typer_->cache_.kUint16;
+Type* Typer::Visitor::TypeStringToUpperCaseIntl(Node* node) {
+  return Type::String();
 }
 
-Type* Typer::Visitor::TypeSeqStringCharCodeAt(Node* node) {
+Type* Typer::Visitor::TypeStringCharCodeAt(Node* node) {
   return typer_->cache_.kUint16;
 }
 
@@ -1952,16 +1986,12 @@ Type* Typer::Visitor::TypeStringCodePointAt(Node* node) {
   return Type::Range(0.0, String::kMaxCodePoint, zone());
 }
 
-Type* Typer::Visitor::TypeSeqStringCodePointAt(Node* node) {
-  return Type::Range(0.0, String::kMaxCodePoint, zone());
-}
-
-Type* Typer::Visitor::TypeStringFromCharCode(Node* node) {
-  return TypeUnaryOp(node, StringFromCharCodeTyper);
+Type* Typer::Visitor::TypeStringFromSingleCharCode(Node* node) {
+  return TypeUnaryOp(node, StringFromSingleCharCodeTyper);
 }
 
-Type* Typer::Visitor::TypeStringFromCodePoint(Node* node) {
-  return TypeUnaryOp(node, StringFromCodePointTyper);
+Type* Typer::Visitor::TypeStringFromSingleCodePoint(Node* node) {
+  return TypeUnaryOp(node, StringFromSingleCodePointTyper);
 }
 
 Type* Typer::Visitor::TypeStringIndexOf(Node* node) {
@@ -1972,6 +2002,8 @@ Type* Typer::Visitor::TypeStringLength(Node* node) {
   return typer_->cache_.kStringLengthType;
 }
 
+Type* Typer::Visitor::TypeStringSubstring(Node* node) { return Type::String(); }
+
 Type* Typer::Visitor::TypeMaskIndexWithBound(Node* node) {
   return Type::Union(Operand(node, 0), typer_->cache_.kSingletonZero, zone());
 }
@@ -2030,11 +2062,6 @@ Type* Typer::Visitor::TypeCheckString(Node* node) {
   return Type::Intersect(arg, Type::String(), zone());
 }
 
-Type* Typer::Visitor::TypeCheckSeqString(Node* node) {
-  Type* arg = Operand(node, 0);
-  return Type::Intersect(arg, Type::SeqString(), zone());
-}
-
 Type* Typer::Visitor::TypeCheckSymbol(Node* node) {
   Type* arg = Operand(node, 0);
   return Type::Intersect(arg, Type::Symbol(), zone());
@@ -2149,6 +2176,24 @@ Type* Typer::Visitor::TypeNumberIsFloat64Hole(Node* node) {
   return Type::Boolean();
 }
 
+Type* Typer::Visitor::TypeNumberIsFinite(Node* node) { UNREACHABLE(); }
+
+Type* Typer::Visitor::TypeObjectIsFiniteNumber(Node* node) {
+  return Type::Boolean();
+}
+
+Type* Typer::Visitor::TypeNumberIsInteger(Node* node) { UNREACHABLE(); }
+
+Type* Typer::Visitor::TypeObjectIsSafeInteger(Node* node) {
+  return Type::Boolean();
+}
+
+Type* Typer::Visitor::TypeNumberIsSafeInteger(Node* node) { UNREACHABLE(); }
+
+Type* Typer::Visitor::TypeObjectIsInteger(Node* node) {
+  return Type::Boolean();
+}
+
 Type* Typer::Visitor::TypeObjectIsNaN(Node* node) {
   return TypeUnaryOp(node, ObjectIsNaN);
 }
@@ -2203,9 +2248,7 @@ Type* Typer::Visitor::TypeNewArgumentsElements(Node* node) {
   return Type::OtherInternal();
 }
 
-Type* Typer::Visitor::TypeNewConsString(Node* node) {
-  return Type::OtherNonSeqString();
-}
+Type* Typer::Visitor::TypeNewConsString(Node* node) { return Type::String(); }
 
 Type* Typer::Visitor::TypeArrayBufferWasNeutered(Node* node) {
   return Type::Boolean();
diff --git a/deps/v8/src/compiler/types.cc b/deps/v8/src/compiler/types.cc
index a3e90d579ab..f658a6bcff0 100644
--- a/deps/v8/src/compiler/types.cc
+++ b/deps/v8/src/compiler/types.cc
@@ -161,20 +161,18 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case SHORT_EXTERNAL_STRING_TYPE:
     case SHORT_EXTERNAL_ONE_BYTE_STRING_TYPE:
     case SHORT_EXTERNAL_STRING_WITH_ONE_BYTE_DATA_TYPE:
-      return kOtherNonSeqString;
     case STRING_TYPE:
     case ONE_BYTE_STRING_TYPE:
-      return kOtherSeqString;
+      return kString;
     case EXTERNAL_INTERNALIZED_STRING_TYPE:
     case EXTERNAL_ONE_BYTE_INTERNALIZED_STRING_TYPE:
     case EXTERNAL_INTERNALIZED_STRING_WITH_ONE_BYTE_DATA_TYPE:
     case SHORT_EXTERNAL_INTERNALIZED_STRING_TYPE:
     case SHORT_EXTERNAL_ONE_BYTE_INTERNALIZED_STRING_TYPE:
     case SHORT_EXTERNAL_INTERNALIZED_STRING_WITH_ONE_BYTE_DATA_TYPE:
-      return kInternalizedNonSeqString;
     case INTERNALIZED_STRING_TYPE:
     case ONE_BYTE_INTERNALIZED_STRING_TYPE:
-      return kInternalizedSeqString;
+      return kInternalizedString;
     case SYMBOL_TYPE:
       return kSymbol;
     case BIGINT_TYPE:
@@ -223,6 +221,7 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case JS_ASYNC_GENERATOR_OBJECT_TYPE:
     case JS_MODULE_NAMESPACE_TYPE:
     case JS_ARRAY_BUFFER_TYPE:
+    case JS_ARRAY_ITERATOR_TYPE:
     case JS_REGEXP_TYPE:  // TODO(rossberg): there should be a RegExp type.
     case JS_TYPED_ARRAY_TYPE:
     case JS_DATA_VIEW_TYPE:
@@ -235,11 +234,6 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case JS_MAP_VALUE_ITERATOR_TYPE:
     case JS_STRING_ITERATOR_TYPE:
     case JS_ASYNC_FROM_SYNC_ITERATOR_TYPE:
-
-#define ARRAY_ITERATOR_CASE(type) case type:
-      ARRAY_ITERATOR_TYPE_LIST(ARRAY_ITERATOR_CASE)
-#undef ARRAY_ITERATOR_CASE
-
     case JS_WEAK_MAP_TYPE:
     case JS_WEAK_SET_TYPE:
     case JS_PROMISE_TYPE:
@@ -268,14 +262,28 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case ACCESSOR_PAIR_TYPE:
     case FIXED_ARRAY_TYPE:
     case HASH_TABLE_TYPE:
+    case WEAK_FIXED_ARRAY_TYPE:
     case FIXED_DOUBLE_ARRAY_TYPE:
+    case FEEDBACK_METADATA_TYPE:
     case BYTE_ARRAY_TYPE:
     case BYTECODE_ARRAY_TYPE:
+    case BOILERPLATE_DESCRIPTION_TYPE:
     case DESCRIPTOR_ARRAY_TYPE:
     case TRANSITION_ARRAY_TYPE:
+    case FEEDBACK_CELL_TYPE:
     case FEEDBACK_VECTOR_TYPE:
     case PROPERTY_ARRAY_TYPE:
     case FOREIGN_TYPE:
+    case SCOPE_INFO_TYPE:
+    case BLOCK_CONTEXT_TYPE:
+    case CATCH_CONTEXT_TYPE:
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+    case EVAL_CONTEXT_TYPE:
+    case FUNCTION_CONTEXT_TYPE:
+    case MODULE_CONTEXT_TYPE:
+    case NATIVE_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TYPE:
+    case WITH_CONTEXT_TYPE:
     case SCRIPT_TYPE:
     case CODE_TYPE:
     case PROPERTY_CELL_TYPE:
@@ -299,8 +307,8 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case OBJECT_TEMPLATE_INFO_TYPE:
     case ALLOCATION_MEMENTO_TYPE:
     case ALIASED_ARGUMENTS_ENTRY_TYPE:
-    case PROMISE_RESOLVE_THENABLE_JOB_INFO_TYPE:
-    case PROMISE_REACTION_JOB_INFO_TYPE:
+    case PROMISE_CAPABILITY_TYPE:
+    case PROMISE_REACTION_TYPE:
     case DEBUG_INFO_TYPE:
     case STACK_FRAME_INFO_TYPE:
     case WEAK_CELL_TYPE:
@@ -309,11 +317,19 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case PROTOTYPE_INFO_TYPE:
     case TUPLE2_TYPE:
     case TUPLE3_TYPE:
+    case WASM_COMPILED_MODULE_TYPE:
+    case WASM_DEBUG_INFO_TYPE:
+    case WASM_SHARED_MODULE_DATA_TYPE:
     case LOAD_HANDLER_TYPE:
     case STORE_HANDLER_TYPE:
     case CONTEXT_EXTENSION_TYPE:
     case ASYNC_GENERATOR_REQUEST_TYPE:
     case CODE_DATA_CONTAINER_TYPE:
+    case CALLBACK_TASK_TYPE:
+    case CALLABLE_TASK_TYPE:
+    case PROMISE_FULFILL_REACTION_JOB_TASK_TYPE:
+    case PROMISE_REJECT_REACTION_JOB_TASK_TYPE:
+    case PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE:
       UNREACHABLE();
   }
   UNREACHABLE();
@@ -354,6 +370,7 @@ size_t BitsetType::BoundariesSize() {
 }
 
 Type::bitset BitsetType::ExpandInternals(Type::bitset bits) {
+  DCHECK_IMPLIES(bits & kOtherString, (bits & kString) == kString);
   DisallowHeapAllocation no_allocation;
   if (!(bits & kPlainNumber)) return bits;  // Shortcut.
   const Boundary* boundaries = Boundaries();
@@ -610,11 +627,6 @@ bool UnionType::Wellformed() {
 // -----------------------------------------------------------------------------
 // Union and intersection
 
-static bool AddIsSafe(int x, int y) {
-  return x >= 0 ? y <= std::numeric_limits<int>::max() - x
-                : y >= std::numeric_limits<int>::min() - x;
-}
-
 Type* Type::Intersect(Type* type1, Type* type2, Zone* zone) {
   // Fast case: bit sets.
   if (type1->IsBitset() && type2->IsBitset()) {
@@ -642,10 +654,9 @@ Type* Type::Intersect(Type* type1, Type* type2, Zone* zone) {
   bitset bits = type1->BitsetGlb() & type2->BitsetGlb();
   int size1 = type1->IsUnion() ? type1->AsUnion()->Length() : 1;
   int size2 = type2->IsUnion() ? type2->AsUnion()->Length() : 1;
-  if (!AddIsSafe(size1, size2)) return Any();
-  int size = size1 + size2;
-  if (!AddIsSafe(size, 2)) return Any();
-  size += 2;
+  int size;
+  if (base::bits::SignedAddOverflow32(size1, size2, &size)) return Any();
+  if (base::bits::SignedAddOverflow32(size, 2, &size)) return Any();
   Type* result_type = UnionType::New(size, zone);
   UnionType* result = result_type->AsUnion();
   size = 0;
@@ -822,7 +833,7 @@ Type* Type::NewConstant(i::Handle<i::Object> value, Zone* zone) {
   } else if (value->IsHeapNumber()) {
     return NewConstant(value->Number(), zone);
   } else if (value->IsString() && !value->IsInternalizedString()) {
-    return Type::OtherString();
+    return Type::String();
   }
   return HeapConstant(i::Handle<i::HeapObject>::cast(value), zone);
 }
@@ -844,10 +855,9 @@ Type* Type::Union(Type* type1, Type* type2, Zone* zone) {
   // Slow case: create union.
   int size1 = type1->IsUnion() ? type1->AsUnion()->Length() : 1;
   int size2 = type2->IsUnion() ? type2->AsUnion()->Length() : 1;
-  if (!AddIsSafe(size1, size2)) return Any();
-  int size = size1 + size2;
-  if (!AddIsSafe(size, 2)) return Any();
-  size += 2;
+  int size;
+  if (base::bits::SignedAddOverflow32(size1, size2, &size)) return Any();
+  if (base::bits::SignedAddOverflow32(size, 2, &size)) return Any();
   Type* result_type = UnionType::New(size, zone);
   UnionType* result = result_type->AsUnion();
   size = 0;
diff --git a/deps/v8/src/compiler/types.h b/deps/v8/src/compiler/types.h
index c4c371dab36..32ce987cea3 100644
--- a/deps/v8/src/compiler/types.h
+++ b/deps/v8/src/compiler/types.h
@@ -103,33 +103,31 @@ namespace compiler {
   V(OtherUnsigned32, 1u << 2)  \
   V(OtherSigned32,   1u << 3)  \
   V(OtherNumber,     1u << 4)  \
+  V(OtherString,     1u << 5)  \
 
 #define PROPER_BITSET_TYPE_LIST(V) \
   V(None,                     0u)        \
-  V(Negative31,               1u << 5)   \
-  V(Null,                     1u << 6)   \
-  V(Undefined,                1u << 7)   \
-  V(Boolean,                  1u << 8)   \
-  V(Unsigned30,               1u << 9)   \
-  V(MinusZero,                1u << 10)  \
-  V(NaN,                      1u << 11)  \
-  V(Symbol,                   1u << 12)  \
-  V(InternalizedNonSeqString, 1u << 13)  \
-  V(InternalizedSeqString,    1u << 14)  \
-  V(OtherNonSeqString,        1u << 15)  \
-  V(OtherSeqString,           1u << 16)  \
-  V(OtherCallable,            1u << 17)  \
-  V(OtherObject,              1u << 18)  \
-  V(OtherUndetectable,        1u << 19)  \
-  V(CallableProxy,            1u << 20)  \
-  V(OtherProxy,               1u << 21)  \
-  V(Function,                 1u << 22)  \
-  V(BoundFunction,            1u << 23)  \
-  V(Hole,                     1u << 24)  \
-  V(OtherInternal,            1u << 25)  \
-  V(ExternalPointer,          1u << 26)  \
-  V(Array,                    1u << 27)  \
-  V(BigInt,                   1u << 28)  \
+  V(Negative31,               1u << 6)   \
+  V(Null,                     1u << 7)   \
+  V(Undefined,                1u << 8)   \
+  V(Boolean,                  1u << 9)   \
+  V(Unsigned30,               1u << 10)   \
+  V(MinusZero,                1u << 11)  \
+  V(NaN,                      1u << 12)  \
+  V(Symbol,                   1u << 13)  \
+  V(InternalizedString,       1u << 14)  \
+  V(OtherCallable,            1u << 16)  \
+  V(OtherObject,              1u << 17)  \
+  V(OtherUndetectable,        1u << 18)  \
+  V(CallableProxy,            1u << 19)  \
+  V(OtherProxy,               1u << 20)  \
+  V(Function,                 1u << 21)  \
+  V(BoundFunction,            1u << 22)  \
+  V(Hole,                     1u << 23)  \
+  V(OtherInternal,            1u << 24)  \
+  V(ExternalPointer,          1u << 25)  \
+  V(Array,                    1u << 26)  \
+  V(BigInt,                   1u << 27)  \
   \
   V(Signed31,                     kUnsigned30 | kNegative31) \
   V(Signed32,                     kSigned31 | kOtherUnsigned31 | \
@@ -150,12 +148,6 @@ namespace compiler {
   V(MinusZeroOrNaN,               kMinusZero | kNaN) \
   V(Number,                       kOrderedNumber | kNaN) \
   V(Numeric,                      kNumber | kBigInt) \
-  V(InternalizedString,           kInternalizedNonSeqString | \
-                                  kInternalizedSeqString) \
-  V(OtherString,                  kOtherNonSeqString | kOtherSeqString) \
-  V(SeqString,                    kInternalizedSeqString | kOtherSeqString) \
-  V(NonSeqString,                 kInternalizedNonSeqString | \
-                                  kOtherNonSeqString) \
   V(String,                       kInternalizedString | kOtherString) \
   V(UniqueName,                   kSymbol | kInternalizedString) \
   V(Name,                         kSymbol | kString) \
diff --git a/deps/v8/src/compiler/unwinding-info-writer.h b/deps/v8/src/compiler/unwinding-info-writer.h
index 86f5e9e800b..723b6f9ec20 100644
--- a/deps/v8/src/compiler/unwinding-info-writer.h
+++ b/deps/v8/src/compiler/unwinding-info-writer.h
@@ -52,4 +52,4 @@ class UnwindingInfoWriter {
 
 #endif
 
-#endif
+#endif  // V8_COMPILER_UNWINDING_INFO_WRITER_H_
diff --git a/deps/v8/src/compiler/verifier.cc b/deps/v8/src/compiler/verifier.cc
index a66a73f5d3c..5acc837a437 100644
--- a/deps/v8/src/compiler/verifier.cc
+++ b/deps/v8/src/compiler/verifier.cc
@@ -191,20 +191,18 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
         }
       }
       if (discovered_if_success && !discovered_if_exception) {
-        V8_Fatal(__FILE__, __LINE__,
-                 "#%d:%s should be followed by IfSuccess/IfException, but is "
-                 "only followed by single #%d:%s",
-                 node->id(), node->op()->mnemonic(),
-                 discovered_if_success->id(),
-                 discovered_if_success->op()->mnemonic());
+        FATAL(
+            "#%d:%s should be followed by IfSuccess/IfException, but is "
+            "only followed by single #%d:%s",
+            node->id(), node->op()->mnemonic(), discovered_if_success->id(),
+            discovered_if_success->op()->mnemonic());
       }
       if (discovered_if_exception && !discovered_if_success) {
-        V8_Fatal(__FILE__, __LINE__,
-                 "#%d:%s should be followed by IfSuccess/IfException, but is "
-                 "only followed by single #%d:%s",
-                 node->id(), node->op()->mnemonic(),
-                 discovered_if_exception->id(),
-                 discovered_if_exception->op()->mnemonic());
+        FATAL(
+            "#%d:%s should be followed by IfSuccess/IfException, but is "
+            "only followed by single #%d:%s",
+            node->id(), node->op()->mnemonic(), discovered_if_exception->id(),
+            discovered_if_exception->op()->mnemonic());
       }
       if (discovered_if_success || discovered_if_exception) {
         CHECK_EQ(2, total_number_of_control_uses);
@@ -268,12 +266,13 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       break;
     }
     case IrOpcode::kIfTrue:
-    case IrOpcode::kIfFalse:
-      CHECK_EQ(IrOpcode::kBranch,
-               NodeProperties::GetControlInput(node, 0)->opcode());
+    case IrOpcode::kIfFalse: {
+      Node* control = NodeProperties::GetControlInput(node, 0);
+      CHECK_EQ(IrOpcode::kBranch, control->opcode());
       // Type is empty.
       CheckNotTyped(node);
       break;
+    }
     case IrOpcode::kIfSuccess: {
       // IfSuccess and IfException continuation only on throwing nodes.
       Node* input = NodeProperties::GetControlInput(node, 0);
@@ -299,8 +298,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
           case IrOpcode::kIfValue: {
             for (const Node* user : node->uses()) {
               if (user != use && user->opcode() == IrOpcode::kIfValue) {
-                CHECK_NE(OpParameter<int32_t>(use->op()),
-                         OpParameter<int32_t>(user->op()));
+                CHECK_NE(IfValueParametersOf(use->op()).value(),
+                         IfValueParametersOf(user->op()).value());
               }
             }
             ++count_case;
@@ -311,8 +310,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
             break;
           }
           default: {
-            V8_Fatal(__FILE__, __LINE__, "Switch #%d illegally used by #%d:%s",
-                     node->id(), use->id(), use->op()->mnemonic());
+            FATAL("Switch #%d illegally used by #%d:%s", node->id(), use->id(),
+                  use->op()->mnemonic());
             break;
           }
         }
@@ -572,6 +571,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     }
     case IrOpcode::kObjectId:
       CheckTypeIs(node, Type::Object());
+      break;
     case IrOpcode::kStateValues:
     case IrOpcode::kTypedStateValues:
     case IrOpcode::kArgumentsElementsState:
@@ -665,6 +665,10 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       // Type is Array.
       CheckTypeIs(node, Type::Array());
       break;
+    case IrOpcode::kJSCreateArrayIterator:
+      // Type is OtherObject.
+      CheckTypeIs(node, Type::OtherObject());
+      break;
     case IrOpcode::kJSCreateBoundFunction:
       // Type is BoundFunction.
       CheckTypeIs(node, Type::BoundFunction());
@@ -677,10 +681,22 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
       break;
+    case IrOpcode::kJSCreateStringIterator:
+      // Type is OtherObject.
+      CheckTypeIs(node, Type::OtherObject());
+      break;
     case IrOpcode::kJSCreateKeyValueArray:
       // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
       break;
+    case IrOpcode::kJSCreatePromise:
+      // Type is OtherObject.
+      CheckTypeIs(node, Type::OtherObject());
+      break;
+    case IrOpcode::kJSCreateTypedArray:
+      // Type is OtherObject.
+      CheckTypeIs(node, Type::OtherObject());
+      break;
     case IrOpcode::kJSCreateLiteralArray:
       // Type is Array.
       CheckTypeIs(node, Type::Array());
@@ -731,8 +747,10 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CHECK(StoreNamedOwnParametersOf(node->op()).feedback().IsValid());
       break;
     case IrOpcode::kJSStoreDataPropertyInLiteral:
+    case IrOpcode::kJSStoreInArrayLiteral:
       // Type is empty.
       CheckNotTyped(node);
+      CHECK(FeedbackParameterOf(node->op()).feedback().IsValid());
       break;
     case IrOpcode::kJSDeleteProperty:
     case IrOpcode::kJSHasProperty:
@@ -742,10 +760,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       // Type is Boolean.
       CheckTypeIs(node, Type::Boolean());
       break;
-    case IrOpcode::kClassOf:
-      // Type is InternaliedString \/ Null.
-      CheckTypeIs(node, Type::InternalizedStringOrNull());
-      break;
     case IrOpcode::kTypeOf:
       // Type is InternalizedString.
       CheckTypeIs(node, Type::InternalizedString());
@@ -831,6 +845,10 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckTypeIs(node, Type::SignedSmall());
       break;
 
+    case IrOpcode::kJSGeneratorRestoreContext:
+      CheckTypeIs(node, Type::Any());
+      break;
+
     case IrOpcode::kJSGeneratorRestoreRegister:
       CheckTypeIs(node, Type::Any());
       break;
@@ -845,6 +863,35 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckNotTyped(node);
       break;
 
+    case IrOpcode::kJSFulfillPromise:
+      CheckValueInputIs(node, 0, Type::Any());
+      CheckValueInputIs(node, 1, Type::Any());
+      CheckTypeIs(node, Type::Undefined());
+      break;
+    case IrOpcode::kJSPerformPromiseThen:
+      CheckValueInputIs(node, 0, Type::Any());
+      CheckValueInputIs(node, 1, Type::Any());
+      CheckValueInputIs(node, 2, Type::Any());
+      CheckValueInputIs(node, 3, Type::Any());
+      CheckTypeIs(node, Type::Receiver());
+      break;
+    case IrOpcode::kJSPromiseResolve:
+      CheckValueInputIs(node, 0, Type::Any());
+      CheckValueInputIs(node, 1, Type::Any());
+      CheckTypeIs(node, Type::Receiver());
+      break;
+    case IrOpcode::kJSRejectPromise:
+      CheckValueInputIs(node, 0, Type::Any());
+      CheckValueInputIs(node, 1, Type::Any());
+      CheckValueInputIs(node, 2, Type::Any());
+      CheckTypeIs(node, Type::Undefined());
+      break;
+    case IrOpcode::kJSResolvePromise:
+      CheckValueInputIs(node, 0, Type::Any());
+      CheckValueInputIs(node, 1, Type::Any());
+      CheckTypeIs(node, Type::Undefined());
+      break;
+
     case IrOpcode::kComment:
     case IrOpcode::kDebugAbort:
     case IrOpcode::kDebugBreak:
@@ -1041,42 +1088,24 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckValueInputIs(node, 0, Type::String());
       CheckTypeIs(node, Type::Number());
       break;
-    case IrOpcode::kStringCharAt:
-      // (String, Unsigned32) -> String
-      CheckValueInputIs(node, 0, Type::String());
-      CheckValueInputIs(node, 1, Type::Unsigned32());
-      CheckTypeIs(node, Type::String());
-      break;
     case IrOpcode::kStringCharCodeAt:
       // (String, Unsigned32) -> UnsignedSmall
       CheckValueInputIs(node, 0, Type::String());
       CheckValueInputIs(node, 1, Type::Unsigned32());
       CheckTypeIs(node, Type::UnsignedSmall());
       break;
-    case IrOpcode::kSeqStringCharCodeAt:
-      // (SeqString, Unsigned32) -> UnsignedSmall
-      CheckValueInputIs(node, 0, Type::SeqString());
-      CheckValueInputIs(node, 1, Type::Unsigned32());
-      CheckTypeIs(node, Type::UnsignedSmall());
-      break;
     case IrOpcode::kStringCodePointAt:
       // (String, Unsigned32) -> UnsignedSmall
       CheckValueInputIs(node, 0, Type::String());
       CheckValueInputIs(node, 1, Type::Unsigned32());
       CheckTypeIs(node, Type::UnsignedSmall());
       break;
-    case IrOpcode::kSeqStringCodePointAt:
-      // (String, Unsigned32) -> UnsignedSmall
-      CheckValueInputIs(node, 0, Type::String());
-      CheckValueInputIs(node, 1, Type::Unsigned32());
-      CheckTypeIs(node, Type::UnsignedSmall());
-      break;
-    case IrOpcode::kStringFromCharCode:
+    case IrOpcode::kStringFromSingleCharCode:
       // Number -> String
       CheckValueInputIs(node, 0, Type::Number());
       CheckTypeIs(node, Type::String());
       break;
-    case IrOpcode::kStringFromCodePoint:
+    case IrOpcode::kStringFromSingleCodePoint:
       // (Unsigned32) -> String
       CheckValueInputIs(node, 0, Type::Number());
       CheckTypeIs(node, Type::String());
@@ -1097,7 +1126,12 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckValueInputIs(node, 0, Type::String());
       CheckTypeIs(node, Type::String());
       break;
-
+    case IrOpcode::kStringSubstring:
+      CheckValueInputIs(node, 0, Type::String());
+      CheckValueInputIs(node, 1, Type::SignedSmall());
+      CheckValueInputIs(node, 2, Type::SignedSmall());
+      CheckTypeIs(node, Type::String());
+      break;
     case IrOpcode::kReferenceEqual:
       // (Unique, Any) -> Boolean  and
       // (Any, Unique) -> Boolean
@@ -1132,6 +1166,30 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckValueInputIs(node, 0, Type::NumberOrHole());
       CheckTypeIs(node, Type::Boolean());
       break;
+    case IrOpcode::kNumberIsFinite:
+      CheckValueInputIs(node, 0, Type::Number());
+      CheckTypeIs(node, Type::Boolean());
+      break;
+    case IrOpcode::kObjectIsFiniteNumber:
+      CheckValueInputIs(node, 0, Type::Any());
+      CheckTypeIs(node, Type::Boolean());
+      break;
+    case IrOpcode::kNumberIsInteger:
+      CheckValueInputIs(node, 0, Type::Number());
+      CheckTypeIs(node, Type::Boolean());
+      break;
+    case IrOpcode::kObjectIsSafeInteger:
+      CheckValueInputIs(node, 0, Type::Any());
+      CheckTypeIs(node, Type::Boolean());
+      break;
+    case IrOpcode::kNumberIsSafeInteger:
+      CheckValueInputIs(node, 0, Type::Number());
+      CheckTypeIs(node, Type::Boolean());
+      break;
+    case IrOpcode::kObjectIsInteger:
+      CheckValueInputIs(node, 0, Type::Any());
+      CheckTypeIs(node, Type::Boolean());
+      break;
     case IrOpcode::kFindOrderedHashMapEntry:
       CheckValueInputIs(node, 0, Type::Any());
       CheckTypeIs(node, Type::SignedSmall());
@@ -1164,7 +1222,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckValueInputIs(node, 0, TypeCache::Get().kStringLengthType);
       CheckValueInputIs(node, 1, Type::String());
       CheckValueInputIs(node, 2, Type::String());
-      CheckTypeIs(node, Type::OtherString());
+      CheckTypeIs(node, Type::String());
       break;
     case IrOpcode::kAllocate:
       CheckValueInputIs(node, 0, Type::PlainNumber());
@@ -1350,10 +1408,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckValueInputIs(node, 0, Type::Any());
       CheckTypeIs(node, Type::String());
       break;
-    case IrOpcode::kCheckSeqString:
-      CheckValueInputIs(node, 0, Type::Any());
-      CheckTypeIs(node, Type::SeqString());
-      break;
     case IrOpcode::kCheckSymbol:
       CheckValueInputIs(node, 0, Type::Any());
       CheckTypeIs(node, Type::Symbol());
@@ -1471,6 +1525,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     // Machine operators
     // -----------------------
     case IrOpcode::kLoad:
+    case IrOpcode::kPoisonedLoad:
     case IrOpcode::kProtectedLoad:
     case IrOpcode::kProtectedStore:
     case IrOpcode::kStore:
@@ -1630,21 +1685,38 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kWord32PairShl:
     case IrOpcode::kWord32PairShr:
     case IrOpcode::kWord32PairSar:
+    case IrOpcode::kPoisonOnSpeculationTagged:
+    case IrOpcode::kPoisonOnSpeculationWord:
     case IrOpcode::kLoadStackPointer:
     case IrOpcode::kLoadFramePointer:
     case IrOpcode::kLoadParentFramePointer:
+    case IrOpcode::kLoadRootsPointer:
     case IrOpcode::kUnalignedLoad:
     case IrOpcode::kUnalignedStore:
-    case IrOpcode::kAtomicLoad:
-    case IrOpcode::kAtomicStore:
-    case IrOpcode::kAtomicExchange:
-    case IrOpcode::kAtomicCompareExchange:
-    case IrOpcode::kAtomicAdd:
-    case IrOpcode::kAtomicSub:
-    case IrOpcode::kAtomicAnd:
-    case IrOpcode::kAtomicOr:
-    case IrOpcode::kAtomicXor:
+    case IrOpcode::kWord32AtomicLoad:
+    case IrOpcode::kWord32AtomicStore:
+    case IrOpcode::kWord32AtomicExchange:
+    case IrOpcode::kWord32AtomicCompareExchange:
+    case IrOpcode::kWord32AtomicAdd:
+    case IrOpcode::kWord32AtomicSub:
+    case IrOpcode::kWord32AtomicAnd:
+    case IrOpcode::kWord32AtomicOr:
+    case IrOpcode::kWord32AtomicXor:
+    case IrOpcode::kWord64AtomicLoad:
+    case IrOpcode::kWord64AtomicStore:
+    case IrOpcode::kWord64AtomicAdd:
+    case IrOpcode::kWord64AtomicSub:
+    case IrOpcode::kWord64AtomicAnd:
+    case IrOpcode::kWord64AtomicOr:
+    case IrOpcode::kWord64AtomicXor:
+    case IrOpcode::kWord64AtomicExchange:
+    case IrOpcode::kWord64AtomicCompareExchange:
     case IrOpcode::kSpeculationFence:
+    case IrOpcode::kSignExtendWord8ToInt32:
+    case IrOpcode::kSignExtendWord16ToInt32:
+    case IrOpcode::kSignExtendWord8ToInt64:
+    case IrOpcode::kSignExtendWord16ToInt64:
+    case IrOpcode::kSignExtendWord32ToInt64:
 
 #define SIMD_MACHINE_OP_CASE(Name) case IrOpcode::k##Name:
       MACHINE_SIMD_OP_LIST(SIMD_MACHINE_OP_CASE)
@@ -1673,9 +1745,8 @@ void Verifier::Run(Graph* graph, Typing typing, CheckInputs check_inputs,
           other->opcode() == IrOpcode::kProjection &&
           other->InputAt(0) == node &&
           ProjectionIndexOf(other->op()) == ProjectionIndexOf(proj->op())) {
-        V8_Fatal(__FILE__, __LINE__,
-                 "Node #%d:%s has duplicate projections #%d and #%d",
-                 node->id(), node->op()->mnemonic(), proj->id(), other->id());
+        FATAL("Node #%d:%s has duplicate projections #%d and #%d", node->id(),
+              node->op()->mnemonic(), proj->id(), other->id());
       }
     }
   }
@@ -1726,10 +1797,9 @@ static void CheckInputsDominate(Schedule* schedule, BasicBlock* block,
     Node* input = node->InputAt(j);
     if (!HasDominatingDef(schedule, node->InputAt(j), block, use_block,
                           use_pos)) {
-      V8_Fatal(__FILE__, __LINE__,
-               "Node #%d:%s in B%d is not dominated by input@%d #%d:%s",
-               node->id(), node->op()->mnemonic(), block->rpo_number(), j,
-               input->id(), input->op()->mnemonic());
+      FATAL("Node #%d:%s in B%d is not dominated by input@%d #%d:%s",
+            node->id(), node->op()->mnemonic(), block->rpo_number(), j,
+            input->id(), input->op()->mnemonic());
     }
   }
   // Ensure that nodes are dominated by their control inputs;
@@ -1739,10 +1809,9 @@ static void CheckInputsDominate(Schedule* schedule, BasicBlock* block,
       node->opcode() != IrOpcode::kEnd) {
     Node* ctl = NodeProperties::GetControlInput(node);
     if (!Dominates(schedule, ctl, node)) {
-      V8_Fatal(__FILE__, __LINE__,
-               "Node #%d:%s in B%d is not dominated by control input #%d:%s",
-               node->id(), node->op()->mnemonic(), block->rpo_number(),
-               ctl->id(), ctl->op()->mnemonic());
+      FATAL("Node #%d:%s in B%d is not dominated by control input #%d:%s",
+            node->id(), node->op()->mnemonic(), block->rpo_number(), ctl->id(),
+            ctl->op()->mnemonic());
     }
   }
 }
@@ -1835,8 +1904,8 @@ void ScheduleVerifier::Run(Schedule* schedule) {
       BitVector* block_doms = dominators[block->id().ToSize()];
       BasicBlock* idom = block->dominator();
       if (idom != nullptr && !block_doms->Contains(idom->id().ToInt())) {
-        V8_Fatal(__FILE__, __LINE__, "Block B%d is not dominated by B%d",
-                 block->rpo_number(), idom->rpo_number());
+        FATAL("Block B%d is not dominated by B%d", block->rpo_number(),
+              idom->rpo_number());
       }
       for (size_t s = 0; s < block->SuccessorCount(); s++) {
         BasicBlock* succ = block->SuccessorAt(s);
@@ -1872,9 +1941,8 @@ void ScheduleVerifier::Run(Schedule* schedule) {
             schedule->GetBlockById(BasicBlock::Id::FromInt(it.Current()));
         if (dom != idom &&
             !dominators[idom->id().ToSize()]->Contains(dom->id().ToInt())) {
-          V8_Fatal(__FILE__, __LINE__,
-                   "Block B%d is not immediately dominated by B%d",
-                   block->rpo_number(), idom->rpo_number());
+          FATAL("Block B%d is not immediately dominated by B%d",
+                block->rpo_number(), idom->rpo_number());
         }
       }
     }
diff --git a/deps/v8/src/compiler/wasm-compiler.cc b/deps/v8/src/compiler/wasm-compiler.cc
index 9bbf5f3a3f7..f4806789bae 100644
--- a/deps/v8/src/compiler/wasm-compiler.cc
+++ b/deps/v8/src/compiler/wasm-compiler.cc
@@ -10,6 +10,7 @@
 #include "src/base/optional.h"
 #include "src/base/platform/elapsed-timer.h"
 #include "src/base/platform/platform.h"
+#include "src/base/v8-fallthrough.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
 #include "src/compiler/access-builder.h"
@@ -53,9 +54,9 @@ namespace compiler {
 #define WASM_64 0
 #endif
 
-#define FATAL_UNSUPPORTED_OPCODE(opcode)                              \
-  V8_Fatal(__FILE__, __LINE__, "Unsupported opcode #%d:%s", (opcode), \
-           wasm::WasmOpcodes::OpcodeName(opcode));
+#define FATAL_UNSUPPORTED_OPCODE(opcode)        \
+  FATAL("Unsupported opcode 0x%x:%s", (opcode), \
+        wasm::WasmOpcodes::OpcodeName(opcode));
 
 namespace {
 
@@ -227,14 +228,14 @@ void WasmGraphBuilder::StackCheck(wasm::WasmCodePosition position,
   Handle<Code> code = BUILTIN_CODE(jsgraph()->isolate(), WasmStackGuard);
   CallInterfaceDescriptor idesc =
       WasmRuntimeCallDescriptor(jsgraph()->isolate());
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       jsgraph()->isolate(), jsgraph()->zone(), idesc, 0,
       CallDescriptor::kNoFlags, Operator::kNoProperties,
       MachineType::AnyTagged(), 1, Linkage::kNoContext);
   Node* stub_code = jsgraph()->HeapConstant(code);
 
-  Node* call = graph()->NewNode(jsgraph()->common()->Call(desc), stub_code,
-                                *effect, stack_check.if_false);
+  Node* call = graph()->NewNode(jsgraph()->common()->Call(call_descriptor),
+                                stub_code, *effect, stack_check.if_false);
 
   SetSourcePosition(call, position);
 
@@ -563,16 +564,15 @@ Node* WasmGraphBuilder::Unop(wasm::WasmOpcode opcode, Node* input,
     case wasm::kExprF64Sqrt:
       op = m->Float64Sqrt();
       break;
+    case wasm::kExprI32SConvertF32:
+    case wasm::kExprI32UConvertF32:
     case wasm::kExprI32SConvertF64:
-      return BuildI32SConvertF64(input, position, NumericImplementation::kTrap);
-    case wasm::kExprI32SConvertSatF64:
-      return BuildI32SConvertF64(input, position,
-                                 NumericImplementation::kSaturate);
     case wasm::kExprI32UConvertF64:
-      return BuildI32UConvertF64(input, position, NumericImplementation::kTrap);
+    case wasm::kExprI32SConvertSatF64:
     case wasm::kExprI32UConvertSatF64:
-      return BuildI32UConvertF64(input, position,
-                                 NumericImplementation::kSaturate);
+    case wasm::kExprI32SConvertSatF32:
+    case wasm::kExprI32UConvertSatF32:
+      return BuildIntConvertFloat(input, position, opcode);
     case wasm::kExprI32AsmjsSConvertF64:
       return BuildI32AsmjsSConvertF64(input);
     case wasm::kExprI32AsmjsUConvertF64:
@@ -592,16 +592,6 @@ Node* WasmGraphBuilder::Unop(wasm::WasmOpcode opcode, Node* input,
     case wasm::kExprF32UConvertI32:
       op = m->RoundUint32ToFloat32();
       break;
-    case wasm::kExprI32SConvertF32:
-      return BuildI32SConvertF32(input, position, NumericImplementation::kTrap);
-    case wasm::kExprI32SConvertSatF32:
-      return BuildI32SConvertF32(input, position,
-                                 NumericImplementation::kSaturate);
-    case wasm::kExprI32UConvertF32:
-      return BuildI32UConvertF32(input, position, NumericImplementation::kTrap);
-    case wasm::kExprI32UConvertSatF32:
-      return BuildI32UConvertF32(input, position,
-                                 NumericImplementation::kSaturate);
     case wasm::kExprI32AsmjsSConvertF32:
       return BuildI32AsmjsSConvertF32(input);
     case wasm::kExprI32AsmjsUConvertF32:
@@ -780,14 +770,32 @@ Node* WasmGraphBuilder::Unop(wasm::WasmOpcode opcode, Node* input,
       }
       op = m->RoundUint64ToFloat64();
       break;
+    case wasm::kExprI32SExtendI8:
+      op = m->SignExtendWord8ToInt32();
+      break;
+    case wasm::kExprI32SExtendI16:
+      op = m->SignExtendWord16ToInt32();
+      break;
+    case wasm::kExprI64SExtendI8:
+      op = m->SignExtendWord8ToInt64();
+      break;
+    case wasm::kExprI64SExtendI16:
+      op = m->SignExtendWord16ToInt64();
+      break;
+    case wasm::kExprI64SExtendI32:
+      op = m->SignExtendWord32ToInt64();
+      break;
     case wasm::kExprI64SConvertF32:
-      return BuildI64SConvertF32(input, position);
-    case wasm::kExprI64SConvertF64:
-      return BuildI64SConvertF64(input, position);
     case wasm::kExprI64UConvertF32:
-      return BuildI64UConvertF32(input, position);
+    case wasm::kExprI64SConvertF64:
     case wasm::kExprI64UConvertF64:
-      return BuildI64UConvertF64(input, position);
+    case wasm::kExprI64SConvertSatF32:
+    case wasm::kExprI64UConvertSatF32:
+    case wasm::kExprI64SConvertSatF64:
+    case wasm::kExprI64UConvertSatF64:
+      return jsgraph()->machine()->Is32()
+                 ? BuildCcallConvertFloat(input, position, opcode)
+                 : BuildIntConvertFloat(input, position, opcode);
     case wasm::kExprI32AsmjsLoadMem8S:
       return BuildAsmjsLoadMem(MachineType::Int8(), input);
     case wasm::kExprI32AsmjsLoadMem8U:
@@ -1037,12 +1045,14 @@ Node* WasmGraphBuilder::BuildChangeEndiannessStore(
     case wasm::kWasmF64:
       value = graph()->NewNode(m->BitcastFloat64ToInt64(), node);
       isFloat = true;
+      V8_FALLTHROUGH;
     case wasm::kWasmI64:
       result = jsgraph()->Int64Constant(0);
       break;
     case wasm::kWasmF32:
       value = graph()->NewNode(m->BitcastFloat32ToInt32(), node);
       isFloat = true;
+      V8_FALLTHROUGH;
     case wasm::kWasmI32:
       result = jsgraph()->Int32Constant(0);
       break;
@@ -1184,12 +1194,14 @@ Node* WasmGraphBuilder::BuildChangeEndiannessLoad(Node* node,
     case MachineRepresentation::kFloat64:
       value = graph()->NewNode(m->BitcastFloat64ToInt64(), node);
       isFloat = true;
+      V8_FALLTHROUGH;
     case MachineRepresentation::kWord64:
       result = jsgraph()->Int64Constant(0);
       break;
     case MachineRepresentation::kFloat32:
       value = graph()->NewNode(m->BitcastFloat32ToInt32(), node);
       isFloat = true;
+      V8_FALLTHROUGH;
     case MachineRepresentation::kWord32:
     case MachineRepresentation::kWord16:
       result = jsgraph()->Int32Constant(0);
@@ -1373,167 +1385,281 @@ Node* WasmGraphBuilder::BuildF64CopySign(Node* left, Node* right) {
 #endif
 }
 
-// Helper classes for float to int conversions.
-struct WasmGraphBuilder::IntConvertOps {
-  MachineRepresentation word_rep() const {
-    return MachineRepresentation::kWord32;
-  }
-  Node* zero() const { return builder_->Int32Constant(0); }
-  virtual Node* min() const = 0;
-  virtual Node* max() const = 0;
-  virtual ~IntConvertOps() = default;
-
- protected:
-  explicit IntConvertOps(WasmGraphBuilder* builder) : builder_(builder) {}
-  WasmGraphBuilder* builder_;
-  DISALLOW_IMPLICIT_CONSTRUCTORS(IntConvertOps);
-};
-
-struct I32SConvertOps final : public WasmGraphBuilder::IntConvertOps {
-  explicit I32SConvertOps(WasmGraphBuilder* builder)
-      : WasmGraphBuilder::IntConvertOps(builder) {}
-  ~I32SConvertOps() = default;
-  Node* min() const {
-    return builder_->Int32Constant(std::numeric_limits<int32_t>::min());
-  }
-  Node* max() const {
-    return builder_->Int32Constant(std::numeric_limits<int32_t>::max());
-  }
-  DISALLOW_IMPLICIT_CONSTRUCTORS(I32SConvertOps);
-};
-
-struct I32UConvertOps final : public WasmGraphBuilder::IntConvertOps {
-  explicit I32UConvertOps(WasmGraphBuilder* builder)
-      : WasmGraphBuilder::IntConvertOps(builder) {}
-  ~I32UConvertOps() = default;
-  Node* min() const {
-    return builder_->Int32Constant(std::numeric_limits<uint32_t>::min());
-  }
-  Node* max() const {
-    return builder_->Int32Constant(std::numeric_limits<uint32_t>::max());
-  }
-  DISALLOW_IMPLICIT_CONSTRUCTORS(I32UConvertOps);
-};
-
-struct WasmGraphBuilder::FloatConvertOps {
-  virtual Node* zero() const = 0;
-  virtual wasm::WasmOpcode trunc_op() const = 0;
-  virtual wasm::WasmOpcode ne_op() const = 0;
-  virtual wasm::WasmOpcode lt_op() const = 0;
-  virtual ~FloatConvertOps() = default;
-
- protected:
-  explicit FloatConvertOps(WasmGraphBuilder* builder) : builder_(builder) {}
-  WasmGraphBuilder* builder_;
-  DISALLOW_IMPLICIT_CONSTRUCTORS(FloatConvertOps);
-};
-
-struct F32ConvertOps final : public WasmGraphBuilder::FloatConvertOps {
-  explicit F32ConvertOps(WasmGraphBuilder* builder)
-      : WasmGraphBuilder::FloatConvertOps(builder) {}
-  ~F32ConvertOps() = default;
-  Node* zero() const { return builder_->Float32Constant(0.0); }
-  wasm::WasmOpcode trunc_op() const { return wasm::kExprF32Trunc; }
-  wasm::WasmOpcode ne_op() const { return wasm::kExprF32Ne; }
-  wasm::WasmOpcode lt_op() const { return wasm::kExprF32Lt; }
-  DISALLOW_IMPLICIT_CONSTRUCTORS(F32ConvertOps);
-};
-
-struct F64ConvertOps final : public WasmGraphBuilder::FloatConvertOps {
-  explicit F64ConvertOps(WasmGraphBuilder* builder)
-      : WasmGraphBuilder::FloatConvertOps(builder) {}
-  ~F64ConvertOps() = default;
-  Node* zero() const { return builder_->Float64Constant(0.0); }
-  wasm::WasmOpcode trunc_op() const { return wasm::kExprF64Trunc; }
-  wasm::WasmOpcode ne_op() const { return wasm::kExprF64Ne; }
-  wasm::WasmOpcode lt_op() const { return wasm::kExprF64Lt; }
-  DISALLOW_IMPLICIT_CONSTRUCTORS(F64ConvertOps);
-};
-
-Node* WasmGraphBuilder::BuildConvertCheck(Node* test, Node* result, Node* input,
-                                          wasm::WasmCodePosition position,
-                                          NumericImplementation impl,
-                                          const IntConvertOps* int_ops,
-                                          const FloatConvertOps* float_ops) {
-  switch (impl) {
-    case NumericImplementation::kTrap:
+namespace {
+
+MachineType IntConvertType(wasm::WasmOpcode opcode) {
+  switch (opcode) {
+    case wasm::kExprI32SConvertF32:
+    case wasm::kExprI32SConvertF64:
+    case wasm::kExprI32SConvertSatF32:
+    case wasm::kExprI32SConvertSatF64:
+      return MachineType::Int32();
+    case wasm::kExprI32UConvertF32:
+    case wasm::kExprI32UConvertF64:
+    case wasm::kExprI32UConvertSatF32:
+    case wasm::kExprI32UConvertSatF64:
+      return MachineType::Uint32();
+    case wasm::kExprI64SConvertF32:
+    case wasm::kExprI64SConvertF64:
+    case wasm::kExprI64SConvertSatF32:
+    case wasm::kExprI64SConvertSatF64:
+      return MachineType::Int64();
+    case wasm::kExprI64UConvertF32:
+    case wasm::kExprI64UConvertF64:
+    case wasm::kExprI64UConvertSatF32:
+    case wasm::kExprI64UConvertSatF64:
+      return MachineType::Uint64();
+    default:
+      UNREACHABLE();
+  }
+}
+
+MachineType FloatConvertType(wasm::WasmOpcode opcode) {
+  switch (opcode) {
+    case wasm::kExprI32SConvertF32:
+    case wasm::kExprI32UConvertF32:
+    case wasm::kExprI32SConvertSatF32:
+    case wasm::kExprI64SConvertF32:
+    case wasm::kExprI64UConvertF32:
+    case wasm::kExprI32UConvertSatF32:
+    case wasm::kExprI64SConvertSatF32:
+    case wasm::kExprI64UConvertSatF32:
+      return MachineType::Float32();
+    case wasm::kExprI32SConvertF64:
+    case wasm::kExprI32UConvertF64:
+    case wasm::kExprI64SConvertF64:
+    case wasm::kExprI64UConvertF64:
+    case wasm::kExprI32SConvertSatF64:
+    case wasm::kExprI32UConvertSatF64:
+    case wasm::kExprI64SConvertSatF64:
+    case wasm::kExprI64UConvertSatF64:
+      return MachineType::Float64();
+    default:
+      UNREACHABLE();
+  }
+}
+
+const Operator* ConvertOp(WasmGraphBuilder* builder, wasm::WasmOpcode opcode) {
+  switch (opcode) {
+    case wasm::kExprI32SConvertF32:
+    case wasm::kExprI32SConvertSatF32:
+      return builder->jsgraph()->machine()->TruncateFloat32ToInt32();
+    case wasm::kExprI32UConvertF32:
+    case wasm::kExprI32UConvertSatF32:
+      return builder->jsgraph()->machine()->TruncateFloat32ToUint32();
+    case wasm::kExprI32SConvertF64:
+    case wasm::kExprI32SConvertSatF64:
+      return builder->jsgraph()->machine()->ChangeFloat64ToInt32();
+    case wasm::kExprI32UConvertF64:
+    case wasm::kExprI32UConvertSatF64:
+      return builder->jsgraph()->machine()->TruncateFloat64ToUint32();
+    case wasm::kExprI64SConvertF32:
+    case wasm::kExprI64SConvertSatF32:
+      return builder->jsgraph()->machine()->TryTruncateFloat32ToInt64();
+    case wasm::kExprI64UConvertF32:
+    case wasm::kExprI64UConvertSatF32:
+      return builder->jsgraph()->machine()->TryTruncateFloat32ToUint64();
+    case wasm::kExprI64SConvertF64:
+    case wasm::kExprI64SConvertSatF64:
+      return builder->jsgraph()->machine()->TryTruncateFloat64ToInt64();
+    case wasm::kExprI64UConvertF64:
+    case wasm::kExprI64UConvertSatF64:
+      return builder->jsgraph()->machine()->TryTruncateFloat64ToUint64();
+    default:
+      UNREACHABLE();
+  }
+}
+
+wasm::WasmOpcode ConvertBackOp(wasm::WasmOpcode opcode) {
+  switch (opcode) {
+    case wasm::kExprI32SConvertF32:
+    case wasm::kExprI32SConvertSatF32:
+      return wasm::kExprF32SConvertI32;
+    case wasm::kExprI32UConvertF32:
+    case wasm::kExprI32UConvertSatF32:
+      return wasm::kExprF32UConvertI32;
+    case wasm::kExprI32SConvertF64:
+    case wasm::kExprI32SConvertSatF64:
+      return wasm::kExprF64SConvertI32;
+    case wasm::kExprI32UConvertF64:
+    case wasm::kExprI32UConvertSatF64:
+      return wasm::kExprF64UConvertI32;
+    default:
+      UNREACHABLE();
+  }
+}
+
+bool IsTrappingConvertOp(wasm::WasmOpcode opcode) {
+  switch (opcode) {
+    case wasm::kExprI32SConvertF32:
+    case wasm::kExprI32UConvertF32:
+    case wasm::kExprI32SConvertF64:
+    case wasm::kExprI32UConvertF64:
+    case wasm::kExprI64SConvertF32:
+    case wasm::kExprI64UConvertF32:
+    case wasm::kExprI64SConvertF64:
+    case wasm::kExprI64UConvertF64:
+      return true;
+    case wasm::kExprI32SConvertSatF64:
+    case wasm::kExprI32UConvertSatF64:
+    case wasm::kExprI32SConvertSatF32:
+    case wasm::kExprI32UConvertSatF32:
+    case wasm::kExprI64SConvertSatF32:
+    case wasm::kExprI64UConvertSatF32:
+    case wasm::kExprI64SConvertSatF64:
+    case wasm::kExprI64UConvertSatF64:
+      return false;
+    default:
+      UNREACHABLE();
+  }
+}
+
+Node* Zero(WasmGraphBuilder* builder, const MachineType& ty) {
+  switch (ty.representation()) {
+    case MachineRepresentation::kWord32:
+      return builder->Int32Constant(0);
+    case MachineRepresentation::kWord64:
+      return builder->Int64Constant(0);
+    case MachineRepresentation::kFloat32:
+      return builder->Float32Constant(0.0);
+    case MachineRepresentation::kFloat64:
+      return builder->Float64Constant(0.0);
+    default:
+      UNREACHABLE();
+  }
+}
+
+Node* Min(WasmGraphBuilder* builder, const MachineType& ty) {
+  switch (ty.semantic()) {
+    case MachineSemantic::kInt32:
+      return builder->Int32Constant(std::numeric_limits<int32_t>::min());
+    case MachineSemantic::kUint32:
+      return builder->Int32Constant(std::numeric_limits<uint32_t>::min());
+    case MachineSemantic::kInt64:
+      return builder->Int64Constant(std::numeric_limits<int64_t>::min());
+    case MachineSemantic::kUint64:
+      return builder->Int64Constant(std::numeric_limits<uint64_t>::min());
+    default:
+      UNREACHABLE();
+  }
+}
+
+Node* Max(WasmGraphBuilder* builder, const MachineType& ty) {
+  switch (ty.semantic()) {
+    case MachineSemantic::kInt32:
+      return builder->Int32Constant(std::numeric_limits<int32_t>::max());
+    case MachineSemantic::kUint32:
+      return builder->Int32Constant(std::numeric_limits<uint32_t>::max());
+    case MachineSemantic::kInt64:
+      return builder->Int64Constant(std::numeric_limits<int64_t>::max());
+    case MachineSemantic::kUint64:
+      return builder->Int64Constant(std::numeric_limits<uint64_t>::max());
+    default:
+      UNREACHABLE();
+  }
+}
+
+wasm::WasmOpcode TruncOp(const MachineType& ty) {
+  switch (ty.representation()) {
+    case MachineRepresentation::kFloat32:
+      return wasm::kExprF32Trunc;
+    case MachineRepresentation::kFloat64:
+      return wasm::kExprF64Trunc;
+    default:
+      UNREACHABLE();
+  }
+}
+
+wasm::WasmOpcode NeOp(const MachineType& ty) {
+  switch (ty.representation()) {
+    case MachineRepresentation::kFloat32:
+      return wasm::kExprF32Ne;
+    case MachineRepresentation::kFloat64:
+      return wasm::kExprF64Ne;
+    default:
+      UNREACHABLE();
+  }
+}
+
+wasm::WasmOpcode LtOp(const MachineType& ty) {
+  switch (ty.representation()) {
+    case MachineRepresentation::kFloat32:
+      return wasm::kExprF32Lt;
+    case MachineRepresentation::kFloat64:
+      return wasm::kExprF64Lt;
+    default:
+      UNREACHABLE();
+  }
+}
+
+Node* ConvertTrapTest(WasmGraphBuilder* builder, wasm::WasmOpcode opcode,
+                      const MachineType& int_ty, const MachineType& float_ty,
+                      Node* trunc, Node* converted_value) {
+  if (int_ty.representation() == MachineRepresentation::kWord32) {
+    Node* check = builder->Unop(ConvertBackOp(opcode), converted_value);
+    return builder->Binop(NeOp(float_ty), trunc, check);
+  }
+  return builder->graph()->NewNode(builder->jsgraph()->common()->Projection(1),
+                                   trunc, builder->graph()->start());
+}
+
+Node* ConvertSaturateTest(WasmGraphBuilder* builder, wasm::WasmOpcode opcode,
+                          const MachineType& int_ty,
+                          const MachineType& float_ty, Node* trunc,
+                          Node* converted_value) {
+  Node* test = ConvertTrapTest(builder, opcode, int_ty, float_ty, trunc,
+                               converted_value);
+  if (int_ty.representation() == MachineRepresentation::kWord64) {
+    test = builder->Binop(wasm::kExprI64Eq, test, builder->Int64Constant(0));
+  }
+  return test;
+}
+
+}  // namespace
+
+Node* WasmGraphBuilder::BuildIntConvertFloat(Node* input,
+                                             wasm::WasmCodePosition position,
+                                             wasm::WasmOpcode opcode) {
+  const MachineType int_ty = IntConvertType(opcode);
+  const MachineType float_ty = FloatConvertType(opcode);
+  const Operator* conv_op = ConvertOp(this, opcode);
+  Node* trunc = nullptr;
+  Node* converted_value = nullptr;
+  const bool is_int32 =
+      int_ty.representation() == MachineRepresentation::kWord32;
+  if (is_int32) {
+    trunc = Unop(TruncOp(float_ty), input);
+    converted_value = graph()->NewNode(conv_op, trunc);
+  } else {
+    trunc = graph()->NewNode(conv_op, input);
+    converted_value = graph()->NewNode(jsgraph()->common()->Projection(0),
+                                       trunc, graph()->start());
+  }
+  if (IsTrappingConvertOp(opcode)) {
+    Node* test =
+        ConvertTrapTest(this, opcode, int_ty, float_ty, trunc, converted_value);
+    if (is_int32) {
       TrapIfTrue(wasm::kTrapFloatUnrepresentable, test, position);
-      return result;
-    case NumericImplementation::kSaturate: {
-      Diamond tl_d(graph(), jsgraph()->common(), test, BranchHint::kFalse);
-      tl_d.Chain(*control_);
-      Diamond nan_d(graph(), jsgraph()->common(),
-                    Binop(float_ops->ne_op(), input, input),  // Checks if NaN.
-                    BranchHint::kFalse);
-      nan_d.Nest(tl_d, true);
-      Diamond sat_d(graph(), jsgraph()->common(),
-                    Binop(float_ops->lt_op(), input, float_ops->zero()),
-                    BranchHint::kNone);
-      sat_d.Nest(nan_d, false);
-      Node* sat_val =
-          sat_d.Phi(int_ops->word_rep(), int_ops->min(), int_ops->max());
-      Node* nan_val = nan_d.Phi(int_ops->word_rep(), int_ops->zero(), sat_val);
-      return tl_d.Phi(int_ops->word_rep(), nan_val, result);
+    } else {
+      ZeroCheck64(wasm::kTrapFloatUnrepresentable, test, position);
     }
-  }
-  UNREACHABLE();
-}
-
-Node* WasmGraphBuilder::BuildI32ConvertOp(
-    Node* input, wasm::WasmCodePosition position, NumericImplementation impl,
-    const Operator* op, wasm::WasmOpcode check_op, const IntConvertOps* int_ops,
-    const FloatConvertOps* float_ops) {
-  // Truncation of the input value is needed for the overflow check later.
-  Node* trunc = Unop(float_ops->trunc_op(), input);
-  Node* result = graph()->NewNode(op, trunc);
-
-  // Convert the result back to f64. If we end up at a different value than the
-  // truncated input value, then there has been an overflow and we
-  // trap/saturate.
-  Node* check = Unop(check_op, result);
-  Node* overflow = Binop(float_ops->ne_op(), trunc, check);
-  return BuildConvertCheck(overflow, result, input, position, impl, int_ops,
-                           float_ops);
-}
-
-Node* WasmGraphBuilder::BuildI32SConvertF32(Node* input,
-                                            wasm::WasmCodePosition position,
-                                            NumericImplementation impl) {
-  I32SConvertOps int_ops(this);
-  F32ConvertOps float_ops(this);
-  return BuildI32ConvertOp(input, position, impl,
-                           jsgraph()->machine()->TruncateFloat32ToInt32(),
-                           wasm::kExprF32SConvertI32, &int_ops, &float_ops);
-}
-
-Node* WasmGraphBuilder::BuildI32SConvertF64(Node* input,
-                                            wasm::WasmCodePosition position,
-                                            NumericImplementation impl) {
-  I32SConvertOps int_ops(this);
-  F64ConvertOps float_ops(this);
-  return BuildI32ConvertOp(input, position, impl,
-                           jsgraph()->machine()->ChangeFloat64ToInt32(),
-                           wasm::kExprF64SConvertI32, &int_ops, &float_ops);
-}
-
-Node* WasmGraphBuilder::BuildI32UConvertF32(Node* input,
-                                            wasm::WasmCodePosition position,
-                                            NumericImplementation impl) {
-  I32UConvertOps int_ops(this);
-  F32ConvertOps float_ops(this);
-  return BuildI32ConvertOp(input, position, impl,
-                           jsgraph()->machine()->TruncateFloat32ToUint32(),
-                           wasm::kExprF32UConvertI32, &int_ops, &float_ops);
-}
-
-Node* WasmGraphBuilder::BuildI32UConvertF64(Node* input,
-                                            wasm::WasmCodePosition position,
-                                            NumericImplementation impl) {
-  I32UConvertOps int_ops(this);
-  F64ConvertOps float_ops(this);
-  return BuildI32ConvertOp(input, position, impl,
-                           jsgraph()->machine()->TruncateFloat64ToUint32(),
-                           wasm::kExprF64UConvertI32, &int_ops, &float_ops);
+    return converted_value;
+  }
+  Node* test = ConvertSaturateTest(this, opcode, int_ty, float_ty, trunc,
+                                   converted_value);
+  Diamond tl_d(graph(), jsgraph()->common(), test, BranchHint::kFalse);
+  tl_d.Chain(Control());
+  Node* nan_test = Binop(NeOp(float_ty), input, input);
+  Diamond nan_d(graph(), jsgraph()->common(), nan_test, BranchHint::kFalse);
+  nan_d.Nest(tl_d, true);
+  Node* neg_test = Binop(LtOp(float_ty), input, Zero(this, float_ty));
+  Diamond sat_d(graph(), jsgraph()->common(), neg_test, BranchHint::kNone);
+  sat_d.Nest(nan_d, false);
+  Node* sat_val =
+      sat_d.Phi(int_ty.representation(), Min(this, int_ty), Max(this, int_ty));
+  Node* nan_val =
+      nan_d.Phi(int_ty.representation(), Zero(this, int_ty), sat_val);
+  return tl_d.Phi(int_ty.representation(), nan_val, converted_value);
 }
 
 Node* WasmGraphBuilder::BuildI32AsmjsSConvertF32(Node* input) {
@@ -1589,10 +1715,11 @@ Node* WasmGraphBuilder::BuildI32Ctz(Node* input) {
 }
 
 Node* WasmGraphBuilder::BuildI64Ctz(Node* input) {
-  return Unop(wasm::kExprI64UConvertI32,
-              BuildBitCountingCall(input, ExternalReference::wasm_word64_ctz(
-                                              jsgraph()->isolate()),
-                                   MachineRepresentation::kWord64));
+  return Unop(
+      wasm::kExprI64UConvertI32,
+      BuildBitCountingCall(
+          input, ExternalReference::wasm_word64_ctz(jsgraph()->isolate()),
+          MachineRepresentation::kWord64));
 }
 
 Node* WasmGraphBuilder::BuildI32Popcnt(Node* input) {
@@ -1602,10 +1729,11 @@ Node* WasmGraphBuilder::BuildI32Popcnt(Node* input) {
 }
 
 Node* WasmGraphBuilder::BuildI64Popcnt(Node* input) {
-  return Unop(wasm::kExprI64UConvertI32,
-              BuildBitCountingCall(input, ExternalReference::wasm_word64_popcnt(
-                                              jsgraph()->isolate()),
-                                   MachineRepresentation::kWord64));
+  return Unop(
+      wasm::kExprI64UConvertI32,
+      BuildBitCountingCall(
+          input, ExternalReference::wasm_word64_popcnt(jsgraph()->isolate()),
+          MachineRepresentation::kWord64));
 }
 
 Node* WasmGraphBuilder::BuildF32Trunc(Node* input) {
@@ -1797,106 +1925,81 @@ Node* WasmGraphBuilder::BuildIntToFloatConversionInstruction(
   return load;
 }
 
-Node* WasmGraphBuilder::BuildI64SConvertF32(Node* input,
-                                            wasm::WasmCodePosition position) {
-  if (jsgraph()->machine()->Is32()) {
-    return BuildFloatToIntConversionInstruction(
-        input, ExternalReference::wasm_float32_to_int64(jsgraph()->isolate()),
-        MachineRepresentation::kFloat32, MachineType::Int64(), position);
-  } else {
-    Node* trunc = graph()->NewNode(
-        jsgraph()->machine()->TryTruncateFloat32ToInt64(), input);
-    Node* result = graph()->NewNode(jsgraph()->common()->Projection(0), trunc,
-                                    graph()->start());
-    Node* overflow = graph()->NewNode(jsgraph()->common()->Projection(1), trunc,
-                                      graph()->start());
-    ZeroCheck64(wasm::kTrapFloatUnrepresentable, overflow, position);
-    return result;
-  }
-}
-
-Node* WasmGraphBuilder::BuildI64UConvertF32(Node* input,
-                                            wasm::WasmCodePosition position) {
-  if (jsgraph()->machine()->Is32()) {
-    return BuildFloatToIntConversionInstruction(
-        input, ExternalReference::wasm_float32_to_uint64(jsgraph()->isolate()),
-        MachineRepresentation::kFloat32, MachineType::Int64(), position);
-  } else {
-    Node* trunc = graph()->NewNode(
-        jsgraph()->machine()->TryTruncateFloat32ToUint64(), input);
-    Node* result = graph()->NewNode(jsgraph()->common()->Projection(0), trunc,
-                                    graph()->start());
-    Node* overflow = graph()->NewNode(jsgraph()->common()->Projection(1), trunc,
-                                      graph()->start());
-    ZeroCheck64(wasm::kTrapFloatUnrepresentable, overflow, position);
-    return result;
-  }
-}
+namespace {
 
-Node* WasmGraphBuilder::BuildI64SConvertF64(Node* input,
-                                            wasm::WasmCodePosition position) {
-  if (jsgraph()->machine()->Is32()) {
-    return BuildFloatToIntConversionInstruction(
-        input, ExternalReference::wasm_float64_to_int64(jsgraph()->isolate()),
-        MachineRepresentation::kFloat64, MachineType::Int64(), position);
-  } else {
-    Node* trunc = graph()->NewNode(
-        jsgraph()->machine()->TryTruncateFloat64ToInt64(), input);
-    Node* result = graph()->NewNode(jsgraph()->common()->Projection(0), trunc,
-                                    graph()->start());
-    Node* overflow = graph()->NewNode(jsgraph()->common()->Projection(1), trunc,
-                                      graph()->start());
-    ZeroCheck64(wasm::kTrapFloatUnrepresentable, overflow, position);
-    return result;
+ExternalReference convert_ccall_ref(WasmGraphBuilder* builder,
+                                    wasm::WasmOpcode opcode) {
+  switch (opcode) {
+    case wasm::kExprI64SConvertF32:
+    case wasm::kExprI64SConvertSatF32:
+      return ExternalReference::wasm_float32_to_int64(
+          builder->jsgraph()->isolate());
+    case wasm::kExprI64UConvertF32:
+    case wasm::kExprI64UConvertSatF32:
+      return ExternalReference::wasm_float32_to_uint64(
+          builder->jsgraph()->isolate());
+    case wasm::kExprI64SConvertF64:
+    case wasm::kExprI64SConvertSatF64:
+      return ExternalReference::wasm_float64_to_int64(
+          builder->jsgraph()->isolate());
+    case wasm::kExprI64UConvertF64:
+    case wasm::kExprI64UConvertSatF64:
+      return ExternalReference::wasm_float64_to_uint64(
+          builder->jsgraph()->isolate());
+    default:
+      UNREACHABLE();
   }
 }
 
-Node* WasmGraphBuilder::BuildI64UConvertF64(Node* input,
-                                            wasm::WasmCodePosition position) {
-  if (jsgraph()->machine()->Is32()) {
-    return BuildFloatToIntConversionInstruction(
-        input, ExternalReference::wasm_float64_to_uint64(jsgraph()->isolate()),
-        MachineRepresentation::kFloat64, MachineType::Int64(), position);
-  } else {
-    Node* trunc = graph()->NewNode(
-        jsgraph()->machine()->TryTruncateFloat64ToUint64(), input);
-    Node* result = graph()->NewNode(jsgraph()->common()->Projection(0), trunc,
-                                    graph()->start());
-    Node* overflow = graph()->NewNode(jsgraph()->common()->Projection(1), trunc,
-                                      graph()->start());
-    ZeroCheck64(wasm::kTrapFloatUnrepresentable, overflow, position);
-    return result;
-  }
-}
+}  // namespace
 
-Node* WasmGraphBuilder::BuildFloatToIntConversionInstruction(
-    Node* input, ExternalReference ref,
-    MachineRepresentation parameter_representation,
-    const MachineType result_type, wasm::WasmCodePosition position) {
+Node* WasmGraphBuilder::BuildCcallConvertFloat(Node* input,
+                                               wasm::WasmCodePosition position,
+                                               wasm::WasmOpcode opcode) {
+  const MachineType int_ty = IntConvertType(opcode);
+  const MachineType float_ty = FloatConvertType(opcode);
+  ExternalReference call_ref = convert_ccall_ref(this, opcode);
   Node* stack_slot_param = graph()->NewNode(
-      jsgraph()->machine()->StackSlot(parameter_representation));
+      jsgraph()->machine()->StackSlot(float_ty.representation()));
   Node* stack_slot_result = graph()->NewNode(
-      jsgraph()->machine()->StackSlot(result_type.representation()));
+      jsgraph()->machine()->StackSlot(int_ty.representation()));
   const Operator* store_op = jsgraph()->machine()->Store(
-      StoreRepresentation(parameter_representation, kNoWriteBarrier));
-  *effect_ =
-      graph()->NewNode(store_op, stack_slot_param, jsgraph()->Int32Constant(0),
-                       input, *effect_, *control_);
+      StoreRepresentation(float_ty.representation(), kNoWriteBarrier));
+  *effect_ = graph()->NewNode(store_op, stack_slot_param, Int32Constant(0),
+                              input, *effect_, *control_);
   MachineSignature::Builder sig_builder(jsgraph()->zone(), 1, 2);
   sig_builder.AddReturn(MachineType::Int32());
   sig_builder.AddParam(MachineType::Pointer());
   sig_builder.AddParam(MachineType::Pointer());
-  Node* function = graph()->NewNode(jsgraph()->common()->ExternalConstant(ref));
-  ZeroCheck32(wasm::kTrapFloatUnrepresentable,
-              BuildCCall(sig_builder.Build(), function, stack_slot_param,
-                         stack_slot_result),
-              position);
-  const Operator* load_op = jsgraph()->machine()->Load(result_type);
-  Node* load =
-      graph()->NewNode(load_op, stack_slot_result, jsgraph()->Int32Constant(0),
-                       *effect_, *control_);
-  *effect_ = load;
-  return load;
+  Node* function =
+      graph()->NewNode(jsgraph()->common()->ExternalConstant(call_ref));
+  Node* overflow = BuildCCall(sig_builder.Build(), function, stack_slot_param,
+                              stack_slot_result);
+  if (IsTrappingConvertOp(opcode)) {
+    ZeroCheck32(wasm::kTrapFloatUnrepresentable, overflow, position);
+    const Operator* load_op = jsgraph()->machine()->Load(int_ty);
+    Node* load = graph()->NewNode(load_op, stack_slot_result, Int32Constant(0),
+                                  *effect_, *control_);
+    *effect_ = load;
+    return load;
+  }
+  Node* test = Binop(wasm::kExprI32Eq, overflow, Int32Constant(0), position);
+  Diamond tl_d(graph(), jsgraph()->common(), test, BranchHint::kFalse);
+  tl_d.Chain(Control());
+  Node* nan_test = Binop(NeOp(float_ty), input, input);
+  Diamond nan_d(graph(), jsgraph()->common(), nan_test, BranchHint::kFalse);
+  nan_d.Nest(tl_d, true);
+  Node* neg_test = Binop(LtOp(float_ty), input, Zero(this, float_ty));
+  Diamond sat_d(graph(), jsgraph()->common(), neg_test, BranchHint::kNone);
+  sat_d.Nest(nan_d, false);
+  Node* sat_val =
+      sat_d.Phi(int_ty.representation(), Min(this, int_ty), Max(this, int_ty));
+  const Operator* load_op = jsgraph()->machine()->Load(int_ty);
+  Node* load = graph()->NewNode(load_op, stack_slot_result, Int32Constant(0),
+                                *effect_, *control_);
+  Node* nan_val =
+      nan_d.Phi(int_ty.representation(), Zero(this, int_ty), sat_val);
+  return tl_d.Phi(int_ty.representation(), nan_val, load);
 }
 
 Node* WasmGraphBuilder::GrowMemory(Node* input) {
@@ -1956,13 +2059,13 @@ Node* WasmGraphBuilder::Throw(uint32_t tag,
     switch (sig->GetParam(i)) {
       case wasm::kWasmF32:
         value = graph()->NewNode(m->BitcastFloat32ToInt32(), value);
-      // Intentionally fall to next case.
+        V8_FALLTHROUGH;
       case wasm::kWasmI32:
         BuildEncodeException32BitValue(&index, value);
         break;
       case wasm::kWasmF64:
         value = graph()->NewNode(m->BitcastFloat64ToInt64(), value);
-      // Intentionally fall to next case.
+        V8_FALLTHROUGH;
       case wasm::kWasmI64: {
         Node* upper32 = graph()->NewNode(
             m->TruncateInt64ToInt32(),
@@ -2417,10 +2520,10 @@ Node* WasmGraphBuilder::BuildCCall(MachineSignature* sig, Node* function,
   DCHECK_EQ(sizeof...(args), sig->parameter_count());
   Node* const call_args[] = {function, args..., *effect_, *control_};
 
-  CallDescriptor* desc =
+  auto call_descriptor =
       Linkage::GetSimplifiedCDescriptor(jsgraph()->zone(), sig);
 
-  const Operator* op = jsgraph()->common()->Call(desc);
+  const Operator* op = jsgraph()->common()->Call(call_descriptor);
   Node* call = graph()->NewNode(op, arraysize(call_args), call_args);
   *effect_ = call;
   return call;
@@ -2428,8 +2531,12 @@ Node* WasmGraphBuilder::BuildCCall(MachineSignature* sig, Node* function,
 
 Node* WasmGraphBuilder::BuildWasmCall(wasm::FunctionSig* sig, Node** args,
                                       Node*** rets,
-                                      wasm::WasmCodePosition position) {
-  DCHECK_NOT_NULL(wasm_context_);
+                                      wasm::WasmCodePosition position,
+                                      Node* wasm_context, bool use_retpoline) {
+  if (wasm_context == nullptr) {
+    DCHECK_NOT_NULL(wasm_context_);
+    wasm_context = wasm_context_.get();
+  }
   SetNeedsStackCheck();
   const size_t params = sig->parameter_count();
   const size_t extra = 3;  // wasm_context, effect, and control.
@@ -2440,14 +2547,15 @@ Node* WasmGraphBuilder::BuildWasmCall(wasm::FunctionSig* sig, Node** args,
 
   // Make room for the wasm_context parameter at index 1, just after code.
   memmove(&args[2], &args[1], params * sizeof(Node*));
-  args[1] = wasm_context_.get();
+  args[1] = wasm_context;
 
   // Add effect and control inputs.
   args[params + 2] = *effect_;
   args[params + 3] = *control_;
 
-  CallDescriptor* descriptor = GetWasmCallDescriptor(jsgraph()->zone(), sig);
-  const Operator* op = jsgraph()->common()->Call(descriptor);
+  auto call_descriptor =
+      GetWasmCallDescriptor(jsgraph()->zone(), sig, use_retpoline);
+  const Operator* op = jsgraph()->common()->Call(call_descriptor);
   Node* call = graph()->NewNode(op, static_cast<int>(count), args);
   SetSourcePosition(call, position);
 
@@ -2473,20 +2581,11 @@ Node* WasmGraphBuilder::CallDirect(uint32_t index, Node** args, Node*** rets,
                                    wasm::WasmCodePosition position) {
   DCHECK_NULL(args[0]);
   wasm::FunctionSig* sig = env_->module->functions[index].sig;
-  if (FLAG_wasm_jit_to_native) {
-    // Just encode the function index. This will be patched at instantiation.
-    Address code = reinterpret_cast<Address>(index);
-    args[0] = jsgraph()->RelocatableIntPtrConstant(
-        reinterpret_cast<intptr_t>(code), RelocInfo::WASM_CALL);
-  } else {
-    // Add code object as constant.
-    Handle<Code> code = index < env_->function_code.size()
-                            ? env_->function_code[index]
-                            : env_->default_function_code;
 
-    DCHECK(!code.is_null());
-    args[0] = HeapConstant(code);
-  }
+  // Just encode the function index. This will be patched at instantiation.
+  Address code = reinterpret_cast<Address>(index);
+  args[0] = jsgraph()->RelocatableIntPtrConstant(
+      reinterpret_cast<intptr_t>(code), RelocInfo::WASM_CALL);
 
   return BuildWasmCall(sig, args, rets, position);
 }
@@ -2501,55 +2600,73 @@ Node* WasmGraphBuilder::CallIndirect(uint32_t sig_index, Node** args,
   uint32_t table_index = 0;
   wasm::FunctionSig* sig = env_->module->signatures[sig_index];
 
-  EnsureFunctionTableNodes();
+  Node* table = nullptr;
+  Node* table_size = nullptr;
+  GetFunctionTableNodes(table_index, &table, &table_size);
   MachineOperatorBuilder* machine = jsgraph()->machine();
   Node* key = args[0];
 
   // Bounds check against the table size.
-  Node* size = function_tables_[table_index].size;
-  Node* in_bounds = graph()->NewNode(machine->Uint32LessThan(), key, size);
+  Node* in_bounds =
+      graph()->NewNode(machine->Uint32LessThan(), key, table_size);
   TrapIfFalse(wasm::kTrapFuncInvalid, in_bounds, position);
-  Node* table_address = function_tables_[table_index].table_addr;
-  Node* table = graph()->NewNode(
-      jsgraph()->machine()->Load(MachineType::AnyTagged()), table_address,
-      jsgraph()->IntPtrConstant(0), *effect_, *control_);
+
+  // Mask the key to prevent SSCA.
+  if (untrusted_code_mitigations_) {
+    // mask = ((key - size) & ~key) >> 31
+    Node* neg_key =
+        graph()->NewNode(machine->Word32Xor(), key, Int32Constant(-1));
+    Node* masked_diff = graph()->NewNode(
+        machine->Word32And(),
+        graph()->NewNode(machine->Int32Sub(), key, table_size), neg_key);
+    Node* mask =
+        graph()->NewNode(machine->Word32Sar(), masked_diff, Int32Constant(31));
+    key = graph()->NewNode(machine->Word32And(), key, mask);
+  }
+
   // Load signature from the table and check.
   // The table is a FixedArray; signatures are encoded as SMIs.
   // [sig1, code1, sig2, code2, sig3, code3, ...]
   static_assert(compiler::kFunctionTableEntrySize == 2, "consistency");
   static_assert(compiler::kFunctionTableSignatureOffset == 0, "consistency");
   static_assert(compiler::kFunctionTableCodeOffset == 1, "consistency");
-  ElementAccess access = AccessBuilder::ForFixedArrayElement();
-  const int fixed_offset = access.header_size - access.tag();
-  Node* key_offset = graph()->NewNode(machine->Word32Shl(), key,
-                                      Int32Constant(kPointerSizeLog2 + 1));
-  Node* load_sig =
-      graph()->NewNode(machine->Load(MachineType::AnyTagged()), table,
-                       graph()->NewNode(machine->Int32Add(), key_offset,
-                                        Int32Constant(fixed_offset)),
-                       *effect_, *control_);
+
   int32_t canonical_sig_num = env_->module->signature_ids[sig_index];
-  CHECK_GE(sig_index, 0);
-  Node* sig_match = graph()->NewNode(machine->WordEqual(), load_sig,
-                                     jsgraph()->SmiConstant(canonical_sig_num));
-  TrapIfFalse(wasm::kTrapFuncSigMismatch, sig_match, position);
 
-  // Load code object from the table. It is held by a Foreign.
-  Node* entry = graph()->NewNode(
-      machine->Load(MachineType::AnyTagged()), table,
-      graph()->NewNode(machine->Int32Add(), key_offset,
-                       Uint32Constant(fixed_offset + kPointerSize)),
-      *effect_, *control_);
-  if (FLAG_wasm_jit_to_native) {
-    Node* address = graph()->NewNode(
-        machine->Load(MachineType::Pointer()), entry,
-        Int32Constant(Foreign::kForeignAddressOffset - kHeapObjectTag),
-        *effect_, *control_);
-    args[0] = address;
+  // The table entries are {IndirectFunctionTableEntry} structs.
+  Node* scaled_key =
+      graph()->NewNode(machine->Int32Mul(), key,
+                       Int32Constant(sizeof(IndirectFunctionTableEntry)));
+  const Operator* add = nullptr;
+  if (machine->Is64()) {
+    scaled_key = graph()->NewNode(machine->ChangeInt32ToInt64(), scaled_key);
+    add = machine->Int64Add();
   } else {
-    args[0] = entry;
+    add = machine->Int32Add();
   }
-  return BuildWasmCall(sig, args, rets, position);
+  Node* entry_address = graph()->NewNode(add, table, scaled_key);
+  Node* loaded_sig = graph()->NewNode(
+      machine->Load(MachineType::Int32()), entry_address,
+      Int32Constant(offsetof(IndirectFunctionTableEntry, sig_id)), *effect_,
+      *control_);
+  Node* sig_match = graph()->NewNode(machine->WordEqual(), loaded_sig,
+                                     Int32Constant(canonical_sig_num));
+
+  TrapIfFalse(wasm::kTrapFuncSigMismatch, sig_match, position);
+
+  Node* target = graph()->NewNode(
+      machine->Load(MachineType::Pointer()), entry_address,
+      Int32Constant(offsetof(IndirectFunctionTableEntry, target)), *effect_,
+      *control_);
+
+  Node* loaded_context = graph()->NewNode(
+      machine->Load(MachineType::Pointer()), entry_address,
+      Int32Constant(offsetof(IndirectFunctionTableEntry, context)), *effect_,
+      *control_);
+
+  args[0] = target;
+
+  return BuildWasmCall(sig, args, rets, position, loaded_context);
 }
 
 Node* WasmGraphBuilder::BuildI32Rol(Node* left, Node* right) {
@@ -2701,13 +2818,14 @@ Node* WasmGraphBuilder::ToJS(Node* node, wasm::ValueType type) {
 Node* WasmGraphBuilder::BuildJavaScriptToNumber(Node* node, Node* js_context) {
   Callable callable =
       Builtins::CallableFor(jsgraph()->isolate(), Builtins::kToNumber);
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       jsgraph()->isolate(), jsgraph()->zone(), callable.descriptor(), 0,
       CallDescriptor::kNoFlags, Operator::kNoProperties);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
 
-  Node* result = graph()->NewNode(jsgraph()->common()->Call(desc), stub_code,
-                                  node, js_context, *effect_, *control_);
+  Node* result =
+      graph()->NewNode(jsgraph()->common()->Call(call_descriptor), stub_code,
+                       node, js_context, *effect_, *control_);
 
   SetSourcePosition(result, 1);
 
@@ -2853,10 +2971,10 @@ Node* WasmGraphBuilder::BuildAllocateHeapNumberWithValue(Node* value,
       graph()->NewNode(common->BeginRegion(RegionObservability::kNotObservable),
                        graph()->start());
   if (!allocate_heap_number_operator_.is_set()) {
-    CallDescriptor* descriptor = Linkage::GetStubCallDescriptor(
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
         jsgraph()->isolate(), jsgraph()->zone(), callable.descriptor(), 0,
         CallDescriptor::kNoFlags, Operator::kNoThrow);
-    allocate_heap_number_operator_.set(common->Call(descriptor));
+    allocate_heap_number_operator_.set(common->Call(call_descriptor));
   }
   Node* heap_number = graph()->NewNode(allocate_heap_number_operator_.get(),
                                        target, js_context, effect, control);
@@ -2878,7 +2996,7 @@ Node* WasmGraphBuilder::BuildHeapNumberValueIndexConstant() {
   return jsgraph()->IntPtrConstant(HeapNumber::kValueOffset - kHeapObjectTag);
 }
 
-void WasmGraphBuilder::BuildJSToWasmWrapper(WasmCodeWrapper wasm_code,
+void WasmGraphBuilder::BuildJSToWasmWrapper(wasm::WasmCode* wasm_code,
                                             Address wasm_context_address) {
   const int wasm_count = static_cast<int>(sig_->parameter_count());
   const int count =
@@ -2904,16 +3022,10 @@ void WasmGraphBuilder::BuildJSToWasmWrapper(WasmCodeWrapper wasm_code,
       reinterpret_cast<uintptr_t>(wasm_context_address),
       RelocInfo::WASM_CONTEXT_REFERENCE);
 
-  Node* wasm_code_node = nullptr;
-  if (!wasm_code.IsCodeObject()) {
-    const wasm::WasmCode* code = wasm_code.GetWasmCode();
-    Address instr_start =
-        code == nullptr ? nullptr : code->instructions().start();
-    wasm_code_node = jsgraph()->RelocatableIntPtrConstant(
-        reinterpret_cast<intptr_t>(instr_start), RelocInfo::JS_TO_WASM_CALL);
-  } else {
-    wasm_code_node = HeapConstant(wasm_code.GetCode());
-  }
+  Address instr_start =
+      wasm_code == nullptr ? nullptr : wasm_code->instructions().start();
+  Node* wasm_code_node = jsgraph()->RelocatableIntPtrConstant(
+      reinterpret_cast<intptr_t>(instr_start), RelocInfo::JS_TO_WASM_CALL);
   if (!wasm::IsJSCompatibleSignature(sig_)) {
     // Throw a TypeError. Use the js_context of the calling javascript function
     // (passed as a parameter), such that the generated code is js_context
@@ -2932,9 +3044,10 @@ void WasmGraphBuilder::BuildJSToWasmWrapper(WasmCodeWrapper wasm_code,
 
     // We only need a dummy call descriptor.
     wasm::FunctionSig::Builder dummy_sig_builder(jsgraph()->zone(), 0, 0);
-    CallDescriptor* desc =
+    auto call_descriptor =
         GetWasmCallDescriptor(jsgraph()->zone(), dummy_sig_builder.Build());
-    *effect_ = graph()->NewNode(jsgraph()->common()->Call(desc), pos, args);
+    *effect_ =
+        graph()->NewNode(jsgraph()->common()->Call(call_descriptor), pos, args);
     Return(jsgraph()->UndefinedConstant());
     return;
   }
@@ -2957,9 +3070,10 @@ void WasmGraphBuilder::BuildJSToWasmWrapper(WasmCodeWrapper wasm_code,
   args[pos++] = *control_;
 
   // Call the wasm code.
-  CallDescriptor* desc = GetWasmCallDescriptor(jsgraph()->zone(), sig_);
+  auto call_descriptor = GetWasmCallDescriptor(jsgraph()->zone(), sig_);
 
-  Node* call = graph()->NewNode(jsgraph()->common()->Call(desc), count, args);
+  Node* call =
+      graph()->NewNode(jsgraph()->common()->Call(call_descriptor), count, args);
   *effect_ = call;
 
   // Clear the ThreadInWasmFlag
@@ -3017,7 +3131,7 @@ bool WasmGraphBuilder::BuildWasmToJSWrapper(
 
   // Build the start and the parameter nodes.
   Isolate* isolate = jsgraph()->isolate();
-  CallDescriptor* desc;
+  CallDescriptor* call_descriptor;
   Node* start = Start(wasm_count + 3);
   *effect_ = start;
   *control_ = start;
@@ -3054,7 +3168,8 @@ bool WasmGraphBuilder::BuildWasmToJSWrapper(
 
   if (target->IsJSFunction()) {
     Handle<JSFunction> function = Handle<JSFunction>::cast(target);
-    if (function->shared()->internal_formal_parameter_count() == wasm_count) {
+    if (function->shared()->internal_formal_parameter_count() == wasm_count &&
+        !IsClassConstructor(function->shared()->kind())) {
       int pos = 0;
       args[pos++] =
           LoadImportData(index, kFunction, table);  // target callable.
@@ -3067,7 +3182,7 @@ bool WasmGraphBuilder::BuildWasmToJSWrapper(
             handle(isolate->heap()->undefined_value(), isolate));
       }
 
-      desc = Linkage::GetJSCallDescriptor(
+      call_descriptor = Linkage::GetJSCallDescriptor(
           graph()->zone(), false, wasm_count + 1, CallDescriptor::kNoFlags);
 
       // Convert wasm numbers to JS values.
@@ -3079,7 +3194,8 @@ bool WasmGraphBuilder::BuildWasmToJSWrapper(
       args[pos++] = *effect_;
       args[pos++] = *control_;
 
-      call = graph()->NewNode(jsgraph()->common()->Call(desc), pos, args);
+      call = graph()->NewNode(jsgraph()->common()->Call(call_descriptor), pos,
+                              args);
     }
   }
 
@@ -3090,13 +3206,13 @@ bool WasmGraphBuilder::BuildWasmToJSWrapper(
     Callable callable = CodeFactory::Call(isolate);
     args[pos++] = jsgraph()->HeapConstant(callable.code());
     args[pos++] = LoadImportData(index, kFunction, table);  // target callable.
-    args[pos++] = jsgraph()->Int32Constant(wasm_count);  // argument count
+    args[pos++] = jsgraph()->Int32Constant(wasm_count);     // argument count
     args[pos++] = jsgraph()->Constant(
         handle(isolate->heap()->undefined_value(), isolate));  // receiver
 
-    desc = Linkage::GetStubCallDescriptor(isolate, graph()->zone(),
-                                          callable.descriptor(), wasm_count + 1,
-                                          CallDescriptor::kNoFlags);
+    call_descriptor = Linkage::GetStubCallDescriptor(
+        isolate, graph()->zone(), callable.descriptor(), wasm_count + 1,
+        CallDescriptor::kNoFlags);
 
     // Convert wasm numbers to JS values.
     pos = AddParameterNodes(args, pos, wasm_count, sig_);
@@ -3111,7 +3227,8 @@ bool WasmGraphBuilder::BuildWasmToJSWrapper(
     args[pos++] = *effect_;
     args[pos++] = *control_;
 
-    call = graph()->NewNode(jsgraph()->common()->Call(desc), pos, args);
+    call =
+        graph()->NewNode(jsgraph()->common()->Call(call_descriptor), pos, args);
   }
 
   *effect_ = call;
@@ -3139,7 +3256,7 @@ bool HasInt64ParamOrReturn(wasm::FunctionSig* sig) {
 }
 }  // namespace
 
-void WasmGraphBuilder::BuildWasmToWasmWrapper(WasmCodeWrapper wasm_code,
+void WasmGraphBuilder::BuildWasmToWasmWrapper(wasm::WasmCode* wasm_code,
                                               Address new_context_address) {
   int wasm_count = static_cast<int>(sig_->parameter_count());
   int count = wasm_count + 4;  // wasm_code, wasm_context, effect, and control.
@@ -3152,15 +3269,10 @@ void WasmGraphBuilder::BuildWasmToWasmWrapper(WasmCodeWrapper wasm_code,
 
   int pos = 0;
   // Add the wasm code target.
-  if (!wasm_code.IsCodeObject()) {
-    const wasm::WasmCode* code = wasm_code.GetWasmCode();
-    Address instr_start =
-        code == nullptr ? nullptr : code->instructions().start();
-    args[pos++] = jsgraph()->RelocatableIntPtrConstant(
-        reinterpret_cast<intptr_t>(instr_start), RelocInfo::JS_TO_WASM_CALL);
-  } else {
-    args[pos++] = jsgraph()->HeapConstant(wasm_code.GetCode());
-  }
+  Address instr_start =
+      wasm_code == nullptr ? nullptr : wasm_code->instructions().start();
+  args[pos++] = jsgraph()->RelocatableIntPtrConstant(
+      reinterpret_cast<intptr_t>(instr_start), RelocInfo::JS_TO_WASM_CALL);
   // Add the wasm_context of the other instance.
   args[pos++] = jsgraph()->IntPtrConstant(
       reinterpret_cast<uintptr_t>(new_context_address));
@@ -3173,9 +3285,9 @@ void WasmGraphBuilder::BuildWasmToWasmWrapper(WasmCodeWrapper wasm_code,
   args[pos++] = *control_;
 
   // Tail-call the wasm code.
-  CallDescriptor* desc = GetWasmCallDescriptor(jsgraph()->zone(), sig_);
-  Node* tail_call =
-      graph()->NewNode(jsgraph()->common()->TailCall(desc), count, args);
+  auto call_descriptor = GetWasmCallDescriptor(jsgraph()->zone(), sig_);
+  Node* tail_call = graph()->NewNode(
+      jsgraph()->common()->TailCall(call_descriptor), count, args);
   MergeControlToEnd(jsgraph(), tail_call);
 }
 
@@ -3246,29 +3358,20 @@ void WasmGraphBuilder::BuildWasmInterpreterEntry(uint32_t func_index) {
   if (HasInt64ParamOrReturn(sig_)) LowerInt64();
 }
 
-void WasmGraphBuilder::BuildCWasmEntry(Address wasm_context_address) {
+void WasmGraphBuilder::BuildCWasmEntry() {
   // Build the start and the JS parameter nodes.
   Node* start = Start(CWasmEntryParameters::kNumParameters + 5);
   *control_ = start;
   *effect_ = start;
 
-  // Create the wasm_context node to pass as parameter.
-  DCHECK_NULL(wasm_context_);
-  wasm_context_ = jsgraph()->IntPtrConstant(
-      reinterpret_cast<uintptr_t>(wasm_context_address));
-
   // Create parameter nodes (offset by 1 for the receiver parameter).
-  Node* code_obj = nullptr;
-  if (FLAG_wasm_jit_to_native) {
-    Node* foreign_code_obj = Param(CWasmEntryParameters::kCodeObject + 1);
-    MachineOperatorBuilder* machine = jsgraph()->machine();
-    code_obj = graph()->NewNode(
-        machine->Load(MachineType::Pointer()), foreign_code_obj,
-        Int32Constant(Foreign::kForeignAddressOffset - kHeapObjectTag),
-        *effect_, *control_);
-  } else {
-    code_obj = Param(CWasmEntryParameters::kCodeObject + 1);
-  }
+  Node* foreign_code_obj = Param(CWasmEntryParameters::kCodeObject + 1);
+  MachineOperatorBuilder* machine = jsgraph()->machine();
+  Node* code_obj = graph()->NewNode(
+      machine->Load(MachineType::Pointer()), foreign_code_obj,
+      Int32Constant(Foreign::kForeignAddressOffset - kHeapObjectTag), *effect_,
+      *control_);
+  Node* wasm_context = Param(CWasmEntryParameters::kWasmContext + 1);
   Node* arg_buffer = Param(CWasmEntryParameters::kArgumentsBuffer + 1);
 
   int wasm_arg_count = static_cast<int>(sig_->parameter_count());
@@ -3277,7 +3380,7 @@ void WasmGraphBuilder::BuildCWasmEntry(Address wasm_context_address) {
 
   int pos = 0;
   args[pos++] = code_obj;
-  args[pos++] = wasm_context_.get();
+  args[pos++] = wasm_context;
 
   int offset = 0;
   for (wasm::ValueType type : sig_->parameters()) {
@@ -3294,10 +3397,10 @@ void WasmGraphBuilder::BuildCWasmEntry(Address wasm_context_address) {
   DCHECK_EQ(arg_count, pos);
 
   // Call the wasm code.
-  CallDescriptor* desc = GetWasmCallDescriptor(jsgraph()->zone(), sig_);
+  auto call_descriptor = GetWasmCallDescriptor(jsgraph()->zone(), sig_);
 
-  Node* call =
-      graph()->NewNode(jsgraph()->common()->Call(desc), arg_count, args);
+  Node* call = graph()->NewNode(jsgraph()->common()->Call(call_descriptor),
+                                arg_count, args);
   *effect_ = call;
 
   // Store the return value.
@@ -3495,21 +3598,21 @@ Node* WasmGraphBuilder::CurrentMemoryPages() {
       jsgraph()->Int32Constant(WhichPowerOf2(wasm::kWasmPageSize)));
 }
 
-void WasmGraphBuilder::EnsureFunctionTableNodes() {
-  if (function_tables_.size() > 0) return;
-  size_t tables_size = env_->function_tables.size();
-  for (size_t i = 0; i < tables_size; ++i) {
-    wasm::GlobalHandleAddress function_handle_address =
-        env_->function_tables[i];
-    Node* table_addr = jsgraph()->RelocatableIntPtrConstant(
-        reinterpret_cast<intptr_t>(function_handle_address),
-        RelocInfo::WASM_GLOBAL_HANDLE);
-    uint32_t table_size = env_->module->function_tables[i].initial_size;
-    Node* size = jsgraph()->RelocatableInt32Constant(
-        static_cast<uint32_t>(table_size),
-        RelocInfo::WASM_FUNCTION_TABLE_SIZE_REFERENCE);
-    function_tables_.push_back({table_addr, size});
-  }
+void WasmGraphBuilder::GetFunctionTableNodes(uint32_t table_index, Node** table,
+                                             Node** table_size) {
+  // The table address and size are stored in the WasmContext.
+  // Don't bother caching them, since they are only used in indirect calls,
+  // which would cause them to be spilled on the stack anyway.
+  *table = graph()->NewNode(
+      jsgraph()->machine()->Load(MachineType::UintPtr()), wasm_context_.get(),
+      jsgraph()->Int32Constant(
+          static_cast<int32_t>(offsetof(WasmContext, table))),
+      *effect_, *control_);
+  *table_size = graph()->NewNode(
+      jsgraph()->machine()->Load(MachineType::Uint32()), wasm_context_.get(),
+      jsgraph()->Int32Constant(
+          static_cast<int32_t>(offsetof(WasmContext, table_size))),
+      *effect_, *control_);
 }
 
 Node* WasmGraphBuilder::BuildModifyThreadInWasmFlag(bool new_value) {
@@ -3539,7 +3642,7 @@ Node* WasmGraphBuilder::BuildCallToRuntimeWithContext(Runtime::FunctionId f,
                                                       Node** parameters,
                                                       int parameter_count) {
   const Runtime::Function* fun = Runtime::FunctionForId(f);
-  CallDescriptor* desc = Linkage::GetRuntimeCallDescriptor(
+  auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
       jsgraph()->zone(), f, fun->nargs, Operator::kNoProperties,
       CallDescriptor::kNoFlags);
   // CEntryStubConstant nodes have to be created and cached in the main
@@ -3562,8 +3665,8 @@ Node* WasmGraphBuilder::BuildCallToRuntimeWithContext(Runtime::FunctionId f,
   inputs[count++] = *effect_;
   inputs[count++] = *control_;
 
-  Node* node = jsgraph()->graph()->NewNode(jsgraph()->common()->Call(desc),
-                                           count, inputs);
+  Node* node = jsgraph()->graph()->NewNode(
+      jsgraph()->common()->Call(call_descriptor), count, inputs);
   *effect_ = node;
 
   return node;
@@ -4368,40 +4471,76 @@ Node* WasmGraphBuilder::Simd8x16ShuffleOp(const uint8_t shuffle[16],
                           inputs[0], inputs[1]);
 }
 
-#define ATOMIC_BINOP_LIST(V)              \
-  V(I32AtomicAdd, Add, Uint32)            \
-  V(I32AtomicSub, Sub, Uint32)            \
-  V(I32AtomicAnd, And, Uint32)            \
-  V(I32AtomicOr, Or, Uint32)              \
-  V(I32AtomicXor, Xor, Uint32)            \
-  V(I32AtomicExchange, Exchange, Uint32)  \
-  V(I32AtomicAdd8U, Add, Uint8)           \
-  V(I32AtomicSub8U, Sub, Uint8)           \
-  V(I32AtomicAnd8U, And, Uint8)           \
-  V(I32AtomicOr8U, Or, Uint8)             \
-  V(I32AtomicXor8U, Xor, Uint8)           \
-  V(I32AtomicExchange8U, Exchange, Uint8) \
-  V(I32AtomicAdd16U, Add, Uint16)         \
-  V(I32AtomicSub16U, Sub, Uint16)         \
-  V(I32AtomicAnd16U, And, Uint16)         \
-  V(I32AtomicOr16U, Or, Uint16)           \
-  V(I32AtomicXor16U, Xor, Uint16)         \
-  V(I32AtomicExchange16U, Exchange, Uint16)
-
-#define ATOMIC_TERNARY_LIST(V)                          \
-  V(I32AtomicCompareExchange, CompareExchange, Uint32)  \
-  V(I32AtomicCompareExchange8U, CompareExchange, Uint8) \
-  V(I32AtomicCompareExchange16U, CompareExchange, Uint16)
-
-#define ATOMIC_LOAD_LIST(V) \
-  V(I32AtomicLoad, Uint32)  \
-  V(I32AtomicLoad8U, Uint8) \
-  V(I32AtomicLoad16U, Uint16)
-
-#define ATOMIC_STORE_LIST(V)         \
-  V(I32AtomicStore, Uint32, kWord32) \
-  V(I32AtomicStore8U, Uint8, kWord8) \
-  V(I32AtomicStore16U, Uint16, kWord16)
+#define ATOMIC_BINOP_LIST(V)                        \
+  V(I32AtomicAdd, Add, Uint32, Word32)              \
+  V(I64AtomicAdd, Add, Uint64, Word64)              \
+  V(I32AtomicAdd8U, Add, Uint8, Word32)             \
+  V(I32AtomicAdd16U, Add, Uint16, Word32)           \
+  V(I64AtomicAdd8U, Add, Uint8, Word64)             \
+  V(I64AtomicAdd16U, Add, Uint16, Word64)           \
+  V(I64AtomicAdd32U, Add, Uint32, Word64)           \
+  V(I32AtomicSub, Sub, Uint32, Word32)              \
+  V(I64AtomicSub, Sub, Uint64, Word64)              \
+  V(I32AtomicSub8U, Sub, Uint8, Word32)             \
+  V(I32AtomicSub16U, Sub, Uint16, Word32)           \
+  V(I64AtomicSub8U, Sub, Uint8, Word64)             \
+  V(I64AtomicSub16U, Sub, Uint16, Word64)           \
+  V(I64AtomicSub32U, Sub, Uint32, Word64)           \
+  V(I32AtomicAnd, And, Uint32, Word32)              \
+  V(I64AtomicAnd, And, Uint64, Word64)              \
+  V(I32AtomicAnd8U, And, Uint8, Word32)             \
+  V(I64AtomicAnd16U, And, Uint16, Word64)           \
+  V(I32AtomicAnd16U, And, Uint16, Word32)           \
+  V(I64AtomicAnd8U, And, Uint8, Word64)             \
+  V(I64AtomicAnd32U, And, Uint32, Word64)           \
+  V(I32AtomicOr, Or, Uint32, Word32)                \
+  V(I64AtomicOr, Or, Uint64, Word64)                \
+  V(I32AtomicOr8U, Or, Uint8, Word32)               \
+  V(I32AtomicOr16U, Or, Uint16, Word32)             \
+  V(I64AtomicOr8U, Or, Uint8, Word64)               \
+  V(I64AtomicOr16U, Or, Uint16, Word64)             \
+  V(I64AtomicOr32U, Or, Uint32, Word64)             \
+  V(I32AtomicXor, Xor, Uint32, Word32)              \
+  V(I64AtomicXor, Xor, Uint64, Word64)              \
+  V(I32AtomicXor8U, Xor, Uint8, Word32)             \
+  V(I32AtomicXor16U, Xor, Uint16, Word32)           \
+  V(I64AtomicXor8U, Xor, Uint8, Word64)             \
+  V(I64AtomicXor16U, Xor, Uint16, Word64)           \
+  V(I64AtomicXor32U, Xor, Uint32, Word64)           \
+  V(I32AtomicExchange, Exchange, Uint32, Word32)    \
+  V(I64AtomicExchange, Exchange, Uint64, Word64)    \
+  V(I32AtomicExchange8U, Exchange, Uint8, Word32)   \
+  V(I32AtomicExchange16U, Exchange, Uint16, Word32) \
+  V(I64AtomicExchange8U, Exchange, Uint8, Word64)   \
+  V(I64AtomicExchange16U, Exchange, Uint16, Word64) \
+  V(I64AtomicExchange32U, Exchange, Uint32, Word64)
+
+#define ATOMIC_CMP_EXCHG_LIST(V)                 \
+  V(I32AtomicCompareExchange, Uint32, Word32)    \
+  V(I64AtomicCompareExchange, Uint64, Word64)    \
+  V(I32AtomicCompareExchange8U, Uint8, Word32)   \
+  V(I32AtomicCompareExchange16U, Uint16, Word32) \
+  V(I64AtomicCompareExchange8U, Uint8, Word64)   \
+  V(I64AtomicCompareExchange16U, Uint16, Word64) \
+  V(I64AtomicCompareExchange32U, Uint32, Word64)
+
+#define ATOMIC_LOAD_LIST(V)           \
+  V(I32AtomicLoad, Uint32, Word32)    \
+  V(I64AtomicLoad, Uint64, Word64)    \
+  V(I32AtomicLoad8U, Uint8, Word32)   \
+  V(I32AtomicLoad16U, Uint16, Word32) \
+  V(I64AtomicLoad8U, Uint8, Word64)   \
+  V(I64AtomicLoad16U, Uint16, Word64) \
+  V(I64AtomicLoad32U, Uint32, Word64)
+
+#define ATOMIC_STORE_LIST(V)                    \
+  V(I32AtomicStore, Uint32, kWord32, Word32)    \
+  V(I64AtomicStore, Uint64, kWord64, Word64)    \
+  V(I32AtomicStore8U, Uint8, kWord8, Word32)    \
+  V(I32AtomicStore16U, Uint16, kWord16, Word32) \
+  V(I64AtomicStore8U, Uint8, kWord8, Word64)    \
+  V(I64AtomicStore16U, Uint16, kWord16, Word64) \
+  V(I64AtomicStore32U, Uint32, kWord32, Word64)
 
 Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
                                  uint32_t alignment, uint32_t offset,
@@ -4409,54 +4548,55 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
   // TODO(gdeepti): Add alignment validation, traps on misalignment
   Node* node;
   switch (opcode) {
-#define BUILD_ATOMIC_BINOP(Name, Operation, Type)                       \
-  case wasm::kExpr##Name: {                                             \
-    Node* index =                                                       \
-        BoundsCheckMem(wasm::WasmOpcodes::MemSize(MachineType::Type()), \
-                       inputs[0], offset, position, kNeedsBoundsCheck); \
-    node = graph()->NewNode(                                            \
-        jsgraph()->machine()->Atomic##Operation(MachineType::Type()),   \
-        MemBuffer(offset), index, inputs[1], *effect_, *control_);      \
-    break;                                                              \
+#define BUILD_ATOMIC_BINOP(Name, Operation, Type, Prefix)                     \
+  case wasm::kExpr##Name: {                                                   \
+    Node* index =                                                             \
+        BoundsCheckMem(wasm::WasmOpcodes::MemSize(MachineType::Type()),       \
+                       inputs[0], offset, position, kNeedsBoundsCheck);       \
+    node = graph()->NewNode(                                                  \
+        jsgraph()->machine()->Prefix##Atomic##Operation(MachineType::Type()), \
+        MemBuffer(offset), index, inputs[1], *effect_, *control_);            \
+    break;                                                                    \
   }
     ATOMIC_BINOP_LIST(BUILD_ATOMIC_BINOP)
 #undef BUILD_ATOMIC_BINOP
 
-#define BUILD_ATOMIC_TERNARY_OP(Name, Operation, Type)                        \
+#define BUILD_ATOMIC_CMP_EXCHG(Name, Type, Prefix)                            \
   case wasm::kExpr##Name: {                                                   \
     Node* index =                                                             \
         BoundsCheckMem(wasm::WasmOpcodes::MemSize(MachineType::Type()),       \
                        inputs[0], offset, position, kNeedsBoundsCheck);       \
     node = graph()->NewNode(                                                  \
-        jsgraph()->machine()->Atomic##Operation(MachineType::Type()),         \
+        jsgraph()->machine()->Prefix##AtomicCompareExchange(                  \
+            MachineType::Type()),                                             \
         MemBuffer(offset), index, inputs[1], inputs[2], *effect_, *control_); \
     break;                                                                    \
   }
-    ATOMIC_TERNARY_LIST(BUILD_ATOMIC_TERNARY_OP)
-#undef BUILD_ATOMIC_TERNARY_OP
+    ATOMIC_CMP_EXCHG_LIST(BUILD_ATOMIC_CMP_EXCHG)
+#undef BUILD_ATOMIC_CMP_EXCHG
 
-#define BUILD_ATOMIC_LOAD_OP(Name, Type)                                \
+#define BUILD_ATOMIC_LOAD_OP(Name, Type, Prefix)                        \
   case wasm::kExpr##Name: {                                             \
     Node* index =                                                       \
         BoundsCheckMem(wasm::WasmOpcodes::MemSize(MachineType::Type()), \
                        inputs[0], offset, position, kNeedsBoundsCheck); \
     node = graph()->NewNode(                                            \
-        jsgraph()->machine()->AtomicLoad(MachineType::Type()),          \
+        jsgraph()->machine()->Prefix##AtomicLoad(MachineType::Type()),  \
         MemBuffer(offset), index, *effect_, *control_);                 \
     break;                                                              \
   }
     ATOMIC_LOAD_LIST(BUILD_ATOMIC_LOAD_OP)
 #undef BUILD_ATOMIC_LOAD_OP
 
-#define BUILD_ATOMIC_STORE_OP(Name, Type, Rep)                          \
-  case wasm::kExpr##Name: {                                             \
-    Node* index =                                                       \
-        BoundsCheckMem(wasm::WasmOpcodes::MemSize(MachineType::Type()), \
-                       inputs[0], offset, position, kNeedsBoundsCheck); \
-    node = graph()->NewNode(                                            \
-        jsgraph()->machine()->AtomicStore(MachineRepresentation::Rep),  \
-        MemBuffer(offset), index, inputs[1], *effect_, *control_);      \
-    break;                                                              \
+#define BUILD_ATOMIC_STORE_OP(Name, Type, Rep, Prefix)                         \
+  case wasm::kExpr##Name: {                                                    \
+    Node* index =                                                              \
+        BoundsCheckMem(wasm::WasmOpcodes::MemSize(MachineType::Type()),        \
+                       inputs[0], offset, position, kNeedsBoundsCheck);        \
+    node = graph()->NewNode(                                                   \
+        jsgraph()->machine()->Prefix##AtomicStore(MachineRepresentation::Rep), \
+        MemBuffer(offset), index, inputs[1], *effect_, *control_);             \
+    break;                                                                     \
   }
     ATOMIC_STORE_LIST(BUILD_ATOMIC_STORE_OP)
 #undef BUILD_ATOMIC_STORE_OP
@@ -4468,7 +4608,7 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
 }
 
 #undef ATOMIC_BINOP_LIST
-#undef ATOMIC_TERNARY_LIST
+#undef ATOMIC_CMP_EXCHG_LIST
 #undef ATOMIC_LOAD_LIST
 #undef ATOMIC_STORE_LIST
 
@@ -4491,17 +4631,12 @@ void RecordFunctionCompilation(CodeEventListener::LogEventsAndTags tag,
   va_end(arguments);
   Handle<String> name_str =
       isolate->factory()->NewStringFromAsciiChecked(buffer.start());
-  Handle<String> script_str =
-      isolate->factory()->NewStringFromAsciiChecked("(wasm)");
-  Handle<SharedFunctionInfo> shared =
-      isolate->factory()->NewSharedFunctionInfo(name_str, code, false);
-  PROFILE(isolate, CodeCreateEvent(tag, AbstractCode::cast(*code), *shared,
-                                   *script_str, 0, 0));
+  PROFILE(isolate, CodeCreateEvent(tag, AbstractCode::cast(*code), *name_str));
 }
 }  // namespace
 
 Handle<Code> CompileJSToWasmWrapper(Isolate* isolate, wasm::WasmModule* module,
-                                    WasmCodeWrapper wasm_code, uint32_t index,
+                                    wasm::WasmCode* wasm_code, uint32_t index,
                                     Address wasm_context_address,
                                     bool use_trap_handler) {
   const wasm::WasmFunction* func = &module->functions[index];
@@ -4522,11 +4657,7 @@ Handle<Code> CompileJSToWasmWrapper(Isolate* isolate, wasm::WasmModule* module,
   Node* effect = nullptr;
 
   // TODO(titzer): compile JS to WASM wrappers without a {ModuleEnv}.
-  ModuleEnv env(module,
-                // TODO(mtrofin): remove the Illegal builtin when we don't need
-                // FLAG_wasm_jit_to_native
-                BUILTIN_CODE(isolate, Illegal),  // default_function_code
-                use_trap_handler);
+  ModuleEnv env(module, use_trap_handler);
 
   WasmGraphBuilder builder(&env, &zone, &jsgraph,
                            CEntryStub(isolate, 1).GetCode(), func->sig);
@@ -4562,13 +4693,14 @@ Handle<Code> CompileJSToWasmWrapper(Isolate* isolate, wasm::WasmModule* module,
       Pipeline::GenerateCodeForTesting(&info, isolate, incoming, &graph);
 #ifdef ENABLE_DISASSEMBLER
   if (FLAG_print_opt_code && !code.is_null()) {
-    OFStream os(stdout);
+    CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
+    OFStream os(tracing_scope.file());
     code->Disassemble(func_name.start(), os);
   }
 #endif
 
   if (must_record_function_compilation(isolate)) {
-    RecordFunctionCompilation(CodeEventListener::FUNCTION_TAG, isolate, code,
+    RecordFunctionCompilation(CodeEventListener::STUB_TAG, isolate, code,
                               "%.*s", func_name.length(), func_name.start());
   }
 
@@ -4639,7 +4771,7 @@ Handle<Code> CompileWasmToJSWrapper(
       origin == wasm::kAsmJsOrigin ? new (&zone) SourcePositionTable(&graph)
                                    : nullptr;
 
-  ModuleEnv env(nullptr, Handle<Code>::null(), use_trap_handler);
+  ModuleEnv env(nullptr, use_trap_handler);
   WasmGraphBuilder builder(&env, &zone, &jsgraph,
                            CEntryStub(isolate, 1).GetCode(), sig,
                            source_position_table);
@@ -4659,56 +4791,55 @@ Handle<Code> CompileWasmToJSWrapper(
     }
   }
 
-    if (FLAG_trace_turbo_graph) {  // Simple textual RPO.
-      OFStream os(stdout);
-      os << "-- Graph after change lowering -- " << std::endl;
-      os << AsRPO(graph);
-    }
+  if (FLAG_trace_turbo_graph) {  // Simple textual RPO.
+    OFStream os(stdout);
+    os << "-- Graph after change lowering -- " << std::endl;
+    os << AsRPO(graph);
+  }
 
-    // Schedule and compile to machine code.
-    CallDescriptor* incoming = GetWasmCallDescriptor(&zone, sig);
-    if (machine.Is32()) {
-      incoming = GetI32WasmCallDescriptor(&zone, incoming);
-    }
+  // Schedule and compile to machine code.
+  CallDescriptor* incoming = GetWasmCallDescriptor(&zone, sig);
+  if (machine.Is32()) {
+    incoming = GetI32WasmCallDescriptor(&zone, incoming);
+  }
 
 #ifdef DEBUG
-    EmbeddedVector<char, 32> func_name;
-    static unsigned id = 0;
-    func_name.Truncate(SNPrintF(func_name, "wasm-to-js#%d", id++));
+  EmbeddedVector<char, 32> func_name;
+  static unsigned id = 0;
+  func_name.Truncate(SNPrintF(func_name, "wasm-to-js#%d", id++));
 #else
-    Vector<const char> func_name = CStrVector("wasm-to-js");
+  Vector<const char> func_name = CStrVector("wasm-to-js");
 #endif
 
-    CompilationInfo info(func_name, &zone, Code::WASM_TO_JS_FUNCTION);
-    Handle<Code> code = Pipeline::GenerateCodeForTesting(
-        &info, isolate, incoming, &graph, nullptr, source_position_table);
-    ValidateImportWrapperReferencesImmovables(code);
-    Handle<FixedArray> deopt_data =
-        isolate->factory()->NewFixedArray(2, TENURED);
-    intptr_t loc =
-        reinterpret_cast<intptr_t>(global_js_imports_table.location());
-    Handle<Object> loc_handle = isolate->factory()->NewHeapNumberFromBits(loc);
-    deopt_data->set(0, *loc_handle);
-    Handle<Object> index_handle = isolate->factory()->NewNumberFromInt(
-        OffsetForImportData(index, WasmGraphBuilder::kFunction));
-    deopt_data->set(1, *index_handle);
-    code->set_deoptimization_data(*deopt_data);
+  CompilationInfo info(func_name, &zone, Code::WASM_TO_JS_FUNCTION);
+  Handle<Code> code = Pipeline::GenerateCodeForTesting(
+      &info, isolate, incoming, &graph, nullptr, source_position_table);
+  ValidateImportWrapperReferencesImmovables(code);
+  Handle<FixedArray> deopt_data = isolate->factory()->NewFixedArray(2, TENURED);
+  intptr_t loc = reinterpret_cast<intptr_t>(global_js_imports_table.location());
+  Handle<Object> loc_handle = isolate->factory()->NewHeapNumberFromBits(loc);
+  deopt_data->set(0, *loc_handle);
+  Handle<Object> index_handle = isolate->factory()->NewNumberFromInt(
+      OffsetForImportData(index, WasmGraphBuilder::kFunction));
+  deopt_data->set(1, *index_handle);
+  code->set_deoptimization_data(*deopt_data);
 #ifdef ENABLE_DISASSEMBLER
     if (FLAG_print_opt_code && !code.is_null()) {
-      OFStream os(stdout);
+      CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
+      OFStream os(tracing_scope.file());
       code->Disassemble(func_name.start(), os);
     }
 #endif
 
   if (must_record_function_compilation(isolate)) {
-    RecordFunctionCompilation(CodeEventListener::FUNCTION_TAG, isolate, code,
+    RecordFunctionCompilation(CodeEventListener::STUB_TAG, isolate, code,
                               "%.*s", func_name.length(), func_name.start());
   }
 
   return code;
 }
 
-Handle<Code> CompileWasmToWasmWrapper(Isolate* isolate, WasmCodeWrapper target,
+Handle<Code> CompileWasmToWasmWrapper(Isolate* isolate, wasm::WasmCode* target,
                                       wasm::FunctionSig* sig,
                                       Address new_wasm_context_address) {
   //----------------------------------------------------------------------------
@@ -4726,9 +4857,7 @@ Handle<Code> CompileWasmToWasmWrapper(Isolate* isolate, WasmCodeWrapper target,
   Node* control = nullptr;
   Node* effect = nullptr;
 
-  ModuleEnv env(
-      nullptr, Handle<Code>::null(),
-      !target.IsCodeObject() && target.GetWasmCode()->HasTrapHandlerIndex());
+  ModuleEnv env(nullptr, target->HasTrapHandlerIndex());
   WasmGraphBuilder builder(&env, &zone, &jsgraph, Handle<Code>(), sig);
   builder.set_control_ptr(&control);
   builder.set_effect_ptr(&effect);
@@ -4766,7 +4895,8 @@ Handle<Code> CompileWasmToWasmWrapper(Isolate* isolate, WasmCodeWrapper target,
       Pipeline::GenerateCodeForTesting(&info, isolate, incoming, &graph);
 #ifdef ENABLE_DISASSEMBLER
   if (FLAG_print_opt_code && !code.is_null()) {
-    OFStream os(stdout);
+    CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
+    OFStream os(tracing_scope.file());
     code->Disassemble(buffer.start(), os);
   }
 #endif
@@ -4774,7 +4904,7 @@ Handle<Code> CompileWasmToWasmWrapper(Isolate* isolate, WasmCodeWrapper target,
     buffer.Dispose();
   }
   if (isolate->logger()->is_logging_code_events() || isolate->is_profiling()) {
-    RecordFunctionCompilation(CodeEventListener::FUNCTION_TAG, isolate, code,
+    RecordFunctionCompilation(CodeEventListener::STUB_TAG, isolate, code,
                               "wasm-to-wasm");
   }
 
@@ -4831,29 +4961,22 @@ Handle<Code> CompileWasmInterpreterEntry(Isolate* isolate, uint32_t func_index,
                                             nullptr);
 #ifdef ENABLE_DISASSEMBLER
     if (FLAG_print_opt_code && !code.is_null()) {
-      OFStream os(stdout);
+      CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
+      OFStream os(tracing_scope.file());
       code->Disassemble(func_name.start(), os);
     }
 #endif
 
     if (must_record_function_compilation(isolate)) {
-      RecordFunctionCompilation(CodeEventListener::FUNCTION_TAG, isolate, code,
+      RecordFunctionCompilation(CodeEventListener::STUB_TAG, isolate, code,
                                 "%.*s", func_name.length(), func_name.start());
     }
   }
 
-  if (!FLAG_wasm_jit_to_native) {
-    Handle<FixedArray> deopt_data =
-        isolate->factory()->NewFixedArray(1, TENURED);
-    Handle<WeakCell> weak_instance = isolate->factory()->NewWeakCell(instance);
-    deopt_data->set(0, *weak_instance);
-    code->set_deoptimization_data(*deopt_data);
-  }
   return code;
 }
 
-Handle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig,
-                               Address wasm_context_address) {
+Handle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig) {
   Zone zone(isolate->allocator(), ZONE_NAME);
   Graph graph(&zone);
   CommonOperatorBuilder common(&zone);
@@ -4870,7 +4993,7 @@ Handle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig,
                            CEntryStub(isolate, 1).GetCode(), sig);
   builder.set_control_ptr(&control);
   builder.set_effect_ptr(&effect);
-  builder.BuildCWasmEntry(wasm_context_address);
+  builder.BuildCWasmEntry();
 
   if (FLAG_trace_turbo_graph) {  // Simple textual RPO.
     OFStream os(stdout);
@@ -4905,7 +5028,8 @@ Handle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig,
       Pipeline::GenerateCodeForTesting(&info, isolate, incoming, &graph);
 #ifdef ENABLE_DISASSEMBLER
   if (FLAG_print_opt_code && !code.is_null()) {
-    OFStream os(stdout);
+    CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
+    OFStream os(tracing_scope.file());
     code->Disassemble(debug_name, os);
   }
 #endif
@@ -4915,7 +5039,6 @@ Handle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig,
 
 SourcePositionTable* WasmCompilationUnit::BuildGraphForWasmFunction(
     double* decode_ms) {
-
   base::ElapsedTimer decode_timer;
   if (FLAG_trace_wasm_decode_time) {
     decode_timer.Start();
@@ -5036,12 +5159,7 @@ void WasmCompilationUnit::ExecuteCompilation() {
   TimedHistogramScope wasm_compile_function_time_scope(timed_histogram);
 
   if (FLAG_trace_wasm_compiler) {
-    if (func_name_.start() != nullptr) {
-      PrintF("Compiling wasm function %d:'%.*s'\n\n", func_index(),
-             func_name_.length(), func_name_.start());
-    } else {
-      PrintF("Compiling wasm function %d:<unnamed>\n\n", func_index());
-    }
+    PrintF("Compiling wasm function %d\n\n", func_index());
   }
 
   switch (mode_) {
@@ -5051,7 +5169,7 @@ void WasmCompilationUnit::ExecuteCompilation() {
       liftoff_.~LiftoffData();
       mode_ = WasmCompilationUnit::CompilationMode::kTurbofan;
       new (&tf_) TurbofanData();
-    // fall-through
+      V8_FALLTHROUGH;
     case WasmCompilationUnit::CompilationMode::kTurbofan:
       ExecuteTurbofanCompilation();
       break;
@@ -5089,19 +5207,20 @@ void WasmCompilationUnit::ExecuteTurbofanCompilation() {
     tf_.compilation_zone_.reset(new Zone(isolate_->allocator(), ZONE_NAME));
 
     // Run the compiler pipeline to generate machine code.
-    CallDescriptor* descriptor =
+    auto call_descriptor =
         GetWasmCallDescriptor(tf_.compilation_zone_.get(), func_body_.sig);
     if (tf_.jsgraph_->machine()->Is32()) {
-      descriptor =
-          GetI32WasmCallDescriptor(tf_.compilation_zone_.get(), descriptor);
+      call_descriptor = GetI32WasmCallDescriptor(tf_.compilation_zone_.get(),
+                                                 call_descriptor);
     }
     tf_.info_.reset(new CompilationInfo(
         GetDebugName(tf_.compilation_zone_.get(), func_name_, func_index_),
         tf_.compilation_zone_.get(), Code::WASM_FUNCTION));
 
     tf_.job_.reset(Pipeline::NewWasmCompilationJob(
-        tf_.info_.get(), isolate_, tf_.jsgraph_, descriptor, source_positions,
-        protected_instructions_.get(), env_->module->origin()));
+        tf_.info_.get(), isolate_, tf_.jsgraph_, call_descriptor,
+        source_positions, protected_instructions_.get(),
+        env_->module->origin()));
     ok_ = tf_.job_->ExecuteJob() == CompilationJob::SUCCEEDED;
     // TODO(bradnelson): Improve histogram handling of size_t.
     counters()->wasm_compile_function_peak_memory_bytes()->AddSample(
@@ -5127,9 +5246,9 @@ void WasmCompilationUnit::ExecuteTurbofanCompilation() {
 // WasmCompilationUnit::ExecuteLiftoffCompilation() is defined in
 // liftoff-compiler.cc.
 
-WasmCodeWrapper WasmCompilationUnit::FinishCompilation(
+wasm::WasmCode* WasmCompilationUnit::FinishCompilation(
     wasm::ErrorThrower* thrower) {
-  WasmCodeWrapper ret;
+  wasm::WasmCode* ret;
   switch (mode_) {
     case WasmCompilationUnit::CompilationMode::kLiftoff:
       ret = FinishLiftoffCompilation(thrower);
@@ -5140,13 +5259,13 @@ WasmCodeWrapper WasmCompilationUnit::FinishCompilation(
     default:
       UNREACHABLE();
   }
-  if (!ret.IsCodeObject() && ret.is_null()) {
+  if (ret == nullptr) {
     thrower->RuntimeError("Error finalizing code.");
   }
   return ret;
 }
 
-WasmCodeWrapper WasmCompilationUnit::FinishTurbofanCompilation(
+wasm::WasmCode* WasmCompilationUnit::FinishTurbofanCompilation(
     wasm::ErrorThrower* thrower) {
   if (!ok_) {
     if (tf_.graph_construction_result_.failed()) {
@@ -5162,7 +5281,7 @@ WasmCodeWrapper WasmCompilationUnit::FinishTurbofanCompilation(
       thrower->CompileFailed(message.start(), tf_.graph_construction_result_);
     }
 
-    return {};
+    return nullptr;
   }
   base::ElapsedTimer codegen_timer;
   if (FLAG_trace_wasm_decode_time) {
@@ -5170,96 +5289,34 @@ WasmCodeWrapper WasmCompilationUnit::FinishTurbofanCompilation(
   }
 
   if (tf_.job_->FinalizeJob(isolate_) != CompilationJob::SUCCEEDED) {
-    return {};
+    return nullptr;
   }
-  if (!FLAG_wasm_jit_to_native) {
-    Handle<Code> code = tf_.info_->code();
-    DCHECK(!code.is_null());
-
-    if (FLAG_trace_wasm_decode_time) {
-      double codegen_ms = codegen_timer.Elapsed().InMillisecondsF();
-      PrintF("wasm-code-generation ok: %u bytes, %0.3f ms code generation\n",
-             static_cast<unsigned>(func_body_.end - func_body_.start),
-             codegen_ms);
-    }
-
-    PackProtectedInstructions(code);
-    return WasmCodeWrapper(code);
-  } else {
-    // TODO(mtrofin): when we crystalize a design in lieu of WasmCodeDesc, that
-    // works for both wasm and non-wasm, we can simplify AddCode to just take
-    // that as a parameter.
-    const CodeDesc& desc =
-        tf_.job_->compilation_info()->wasm_code_desc()->code_desc;
-    wasm::WasmCode* code = native_module_->AddCode(
-        desc, tf_.job_->compilation_info()->wasm_code_desc()->frame_slot_count,
-        func_index_,
-        tf_.job_->compilation_info()->wasm_code_desc()->safepoint_table_offset,
-        std::move(protected_instructions_));
-    if (!code) {
-      return WasmCodeWrapper(code);
-    }
-    // TODO(mtrofin): add CodeEventListener call - see the non-native case.
-    if (FLAG_trace_wasm_decode_time) {
-      double codegen_ms = codegen_timer.Elapsed().InMillisecondsF();
-      PrintF("wasm-code-generation ok: %u bytes, %0.3f ms code generation\n",
-             static_cast<unsigned>(func_body_.end - func_body_.start),
-             codegen_ms);
-    }
-
-    Handle<ByteArray> source_positions =
-        tf_.job_->compilation_info()->wasm_code_desc()->source_positions_table;
-    MaybeHandle<HandlerTable> handler_table =
-        tf_.job_->compilation_info()->wasm_code_desc()->handler_table;
-
-    native_module_->compiled_module()->source_positions()->set(
-        func_index_, *source_positions);
-    if (!handler_table.is_null()) {
-      native_module_->compiled_module()->handler_table()->set(
-          func_index_, *handler_table.ToHandleChecked());
-    }
-
-#ifdef ENABLE_DISASSEMBLER
-    // Note: only do this after setting source positions, as this will be
-    // accessed and printed here.
-    if (FLAG_print_code || FLAG_print_wasm_code) {
-      // TODO(wasm): Use proper log files, here and elsewhere.
-      PrintF("--- Native Wasm code ---\n");
-      code->Print(isolate_);
-      PrintF("--- End code ---\n");
-    }
-#endif
 
-    // TODO(mtrofin): this should probably move up in the common caller,
-    // once liftoff has source positions. Until then, we'd need to handle
-    // undefined values, which is complicating the code.
-    LOG_CODE_EVENT(isolate_,
-                   CodeLinePosInfoRecordEvent(code->instructions().start(),
-                                              *source_positions));
-    return WasmCodeWrapper(code);
+  // TODO(mtrofin): when we crystalize a design in lieu of WasmCodeDesc, that
+  // works for both wasm and non-wasm, we can simplify AddCode to just take
+  // that as a parameter.
+  const CodeDesc& desc =
+      tf_.job_->compilation_info()->wasm_code_desc()->code_desc;
+  wasm::WasmCode* code = native_module_->AddCode(
+      desc, tf_.job_->compilation_info()->wasm_code_desc()->frame_slot_count,
+      func_index_,
+      tf_.job_->compilation_info()->wasm_code_desc()->safepoint_table_offset,
+      tf_.job_->compilation_info()->wasm_code_desc()->handler_table_offset,
+      std::move(protected_instructions_),
+      tf_.job_->compilation_info()->wasm_code_desc()->source_positions_table,
+      wasm::WasmCode::kTurbofan);
+  if (!code) return code;
+  if (FLAG_trace_wasm_decode_time) {
+    double codegen_ms = codegen_timer.Elapsed().InMillisecondsF();
+    PrintF("wasm-code-generation ok: %u bytes, %0.3f ms code generation\n",
+           static_cast<unsigned>(func_body_.end - func_body_.start),
+           codegen_ms);
   }
-}
 
-// TODO(mtrofin): remove when FLAG_wasm_jit_to_native is not needed
-void WasmCompilationUnit::PackProtectedInstructions(Handle<Code> code) const {
-  if (protected_instructions_->empty()) return;
-  DCHECK_LT(protected_instructions_->size(), std::numeric_limits<int>::max());
-  const int num_instructions =
-      static_cast<int>(protected_instructions_->size());
-  Handle<FixedArray> fn_protected = isolate_->factory()->NewFixedArray(
-      num_instructions * Code::kTrapDataSize, TENURED);
-  for (int i = 0; i < num_instructions; ++i) {
-    const trap_handler::ProtectedInstructionData& instruction =
-        protected_instructions_->at(i);
-    fn_protected->set(Code::kTrapDataSize * i + Code::kTrapCodeOffset,
-                      Smi::FromInt(instruction.instr_offset));
-    fn_protected->set(Code::kTrapDataSize * i + Code::kTrapLandingOffset,
-                      Smi::FromInt(instruction.landing_offset));
-  }
-  code->set_protected_instructions(*fn_protected);
+  return code;
 }
 
-WasmCodeWrapper WasmCompilationUnit::FinishLiftoffCompilation(
+wasm::WasmCode* WasmCompilationUnit::FinishLiftoffCompilation(
     wasm::ErrorThrower* thrower) {
   CodeDesc desc;
   liftoff_.asm_.GetCode(isolate_, &desc);
@@ -5267,56 +5324,16 @@ WasmCodeWrapper WasmCompilationUnit::FinishLiftoffCompilation(
   Handle<ByteArray> source_positions =
       liftoff_.source_position_table_builder_.ToSourcePositionTable(isolate_);
 
-  WasmCodeWrapper ret;
-  if (!FLAG_wasm_jit_to_native) {
-    Handle<Code> code;
-    code = isolate_->factory()->NewCode(
-        desc, Code::WASM_FUNCTION, code, Builtins::kNoBuiltinId,
-        MaybeHandle<HandlerTable>(), source_positions,
-        MaybeHandle<DeoptimizationData>(), kMovable,
-        0,                                       // stub_key
-        false,                                   // is_turbofanned
-        liftoff_.asm_.GetTotalFrameSlotCount(),  // stack_slots
-        liftoff_.safepoint_table_offset_);
-    if (isolate_->logger()->is_logging_code_events() ||
-        isolate_->is_profiling()) {
-      RecordFunctionCompilation(CodeEventListener::FUNCTION_TAG, isolate_, code,
-                                "wasm#%d-liftoff", func_index_);
-    }
+  wasm::WasmCode* code = native_module_->AddCode(
+      desc, liftoff_.asm_.GetTotalFrameSlotCount(), func_index_,
+      liftoff_.safepoint_table_offset_, 0, std::move(protected_instructions_),
+      source_positions, wasm::WasmCode::kLiftoff);
 
-    PackProtectedInstructions(code);
-    ret = WasmCodeWrapper(code);
-  } else {
-    // TODO(mtrofin): figure a way to raise events.
-    // Consider lifting it to FinishCompilation.
-    native_module_->compiled_module()->source_positions()->set(
-        func_index_, *source_positions);
-    ret = WasmCodeWrapper(
-        native_module_->AddCode(desc, liftoff_.asm_.GetTotalFrameSlotCount(),
-                                func_index_, liftoff_.safepoint_table_offset_,
-                                std::move(protected_instructions_), true));
-  }
-#ifdef ENABLE_DISASSEMBLER
-  if (FLAG_print_code || FLAG_print_wasm_code) {
-    // TODO(wasm): Use proper log files, here and elsewhere.
-    OFStream os(stdout);
-    os << "--- Wasm liftoff code ---\n";
-    EmbeddedVector<char, 64> func_name;
-    if (func_name_.start() != nullptr) {
-      SNPrintF(func_name, "#%d:%.*s", func_index(), func_name_.length(),
-               func_name_.start());
-    } else {
-      SNPrintF(func_name, "wasm#%d", func_index());
-    }
-    ret.Disassemble(func_name.start(), isolate_, os);
-    os << "--- End code ---\n";
-  }
-#endif
-  return ret;
+  return code;
 }
 
 // static
-WasmCodeWrapper WasmCompilationUnit::CompileWasmFunction(
+wasm::WasmCode* WasmCompilationUnit::CompileWasmFunction(
     wasm::NativeModule* native_module, wasm::ErrorThrower* thrower,
     Isolate* isolate, const wasm::ModuleWireBytes& wire_bytes, ModuleEnv* env,
     const wasm::WasmFunction* function, CompilationMode mode) {
@@ -5326,7 +5343,7 @@ WasmCodeWrapper WasmCompilationUnit::CompileWasmFunction(
       wire_bytes.start() + function->code.end_offset()};
 
   WasmCompilationUnit unit(isolate, env, native_module, function_body,
-                           wire_bytes.GetNameOrNull(function),
+                           wire_bytes.GetNameOrNull(function, env->module),
                            function->func_index,
                            CEntryStub(isolate, 1).GetCode(), mode);
   unit.ExecuteCompilation();
diff --git a/deps/v8/src/compiler/wasm-compiler.h b/deps/v8/src/compiler/wasm-compiler.h
index 22a2e1071e7..312b0808d78 100644
--- a/deps/v8/src/compiler/wasm-compiler.h
+++ b/deps/v8/src/compiler/wasm-compiler.h
@@ -72,30 +72,17 @@ struct ModuleEnv {
   // FixedArray.
   const std::vector<Address> function_tables;
 
-  // TODO(mtrofin): remove these 2 once we don't need FLAG_wasm_jit_to_native
-  // Contains the code objects to call for each direct call.
-  // (the same length as module.functions)
-  const std::vector<Handle<Code>> function_code;
-  // If the default code is not a null handle, always use it for direct calls.
-  const Handle<Code> default_function_code;
   // True if trap handling should be used in compiled code, rather than
   // compiling in bounds checks for each memory access.
   const bool use_trap_handler;
 
-  ModuleEnv(const wasm::WasmModule* module, Handle<Code> default_function_code,
-            bool use_trap_handler)
-      : module(module),
-        default_function_code(default_function_code),
-        use_trap_handler(use_trap_handler) {}
+  ModuleEnv(const wasm::WasmModule* module, bool use_trap_handler)
+      : module(module), use_trap_handler(use_trap_handler) {}
 
   ModuleEnv(const wasm::WasmModule* module,
-            std::vector<Address> function_tables,
-            std::vector<Handle<Code>> function_code,
-            Handle<Code> default_function_code, bool use_trap_handler)
+            std::vector<Address> function_tables, bool use_trap_handler)
       : module(module),
         function_tables(std::move(function_tables)),
-        function_code(std::move(function_code)),
-        default_function_code(default_function_code),
         use_trap_handler(use_trap_handler) {}
 };
 
@@ -127,9 +114,9 @@ class WasmCompilationUnit final {
   int func_index() const { return func_index_; }
 
   void ExecuteCompilation();
-  WasmCodeWrapper FinishCompilation(wasm::ErrorThrower* thrower);
+  wasm::WasmCode* FinishCompilation(wasm::ErrorThrower* thrower);
 
-  static WasmCodeWrapper CompileWasmFunction(
+  static wasm::WasmCode* CompileWasmFunction(
       wasm::NativeModule* native_module, wasm::ErrorThrower* thrower,
       Isolate* isolate, const wasm::ModuleWireBytes& wire_bytes, ModuleEnv* env,
       const wasm::WasmFunction* function,
@@ -138,8 +125,6 @@ class WasmCompilationUnit final {
   size_t memory_cost() const { return memory_cost_; }
 
  private:
-  void PackProtectedInstructions(Handle<Code> code) const;
-
   struct LiftoffData {
     wasm::LiftoffAssembler asm_;
     int safepoint_table_offset_;
@@ -165,11 +150,11 @@ class WasmCompilationUnit final {
   // Turbofan.
   SourcePositionTable* BuildGraphForWasmFunction(double* decode_ms);
   void ExecuteTurbofanCompilation();
-  WasmCodeWrapper FinishTurbofanCompilation(wasm::ErrorThrower*);
+  wasm::WasmCode* FinishTurbofanCompilation(wasm::ErrorThrower*);
 
   // Liftoff.
   bool ExecuteLiftoffCompilation();
-  WasmCodeWrapper FinishLiftoffCompilation(wasm::ErrorThrower*);
+  wasm::WasmCode* FinishLiftoffCompilation(wasm::ErrorThrower*);
 
   Isolate* isolate_;
   ModuleEnv* env_;
@@ -210,12 +195,12 @@ Handle<Code> CompileWasmToJSWrapper(Isolate* isolate, Handle<JSReceiver> target,
 
 // Wraps a given wasm code object, producing a code object.
 V8_EXPORT_PRIVATE Handle<Code> CompileJSToWasmWrapper(
-    Isolate* isolate, wasm::WasmModule* module, WasmCodeWrapper wasm_code,
+    Isolate* isolate, wasm::WasmModule* module, wasm::WasmCode* wasm_code,
     uint32_t index, Address wasm_context_address, bool use_trap_handler);
 
 // Wraps a wasm function, producing a code object that can be called from other
 // wasm instances (the WasmContext address must be changed).
-Handle<Code> CompileWasmToWasmWrapper(Isolate* isolate, WasmCodeWrapper target,
+Handle<Code> CompileWasmToWasmWrapper(Isolate* isolate, wasm::WasmCode* target,
                                       wasm::FunctionSig* sig,
                                       Address new_wasm_context_address);
 
@@ -227,6 +212,7 @@ Handle<Code> CompileWasmInterpreterEntry(Isolate* isolate, uint32_t func_index,
 
 enum CWasmEntryParameters {
   kCodeObject,
+  kWasmContext,
   kArgumentsBuffer,
   // marker:
   kNumParameters
@@ -235,8 +221,7 @@ enum CWasmEntryParameters {
 // Compiles a stub with JS linkage, taking parameters as described by
 // {CWasmEntryParameters}. It loads the wasm parameters from the argument
 // buffer and calls the wasm function given as first parameter.
-Handle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig,
-                               Address wasm_context_address);
+Handle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig);
 
 // Values from the {WasmContext} are cached between WASM-level function calls.
 // This struct allows the SSA environment handling this cache to be defined
@@ -255,8 +240,6 @@ typedef ZoneVector<Node*> NodeVector;
 class WasmGraphBuilder {
  public:
   enum EnforceBoundsCheck : bool { kNeedsBoundsCheck, kCanOmitBoundsCheck };
-  struct IntConvertOps;
-  struct FloatConvertOps;
 
   WasmGraphBuilder(ModuleEnv* env, Zone* zone, JSGraph* graph,
                    Handle<Code> centry_stub, wasm::FunctionSig* sig,
@@ -353,7 +336,7 @@ class WasmGraphBuilder {
   Node* CallIndirect(uint32_t index, Node** args, Node*** rets,
                      wasm::WasmCodePosition position);
 
-  void BuildJSToWasmWrapper(WasmCodeWrapper wasm_code_start,
+  void BuildJSToWasmWrapper(wasm::WasmCode* wasm_code_start,
                             Address wasm_context_address);
   enum ImportDataType {
     kFunction = 1,
@@ -366,15 +349,16 @@ class WasmGraphBuilder {
   bool BuildWasmToJSWrapper(Handle<JSReceiver> target,
                             Handle<FixedArray> global_js_imports_table,
                             int index);
-  void BuildWasmToWasmWrapper(WasmCodeWrapper wasm_code_start,
+  void BuildWasmToWasmWrapper(wasm::WasmCode* wasm_code_start,
                               Address new_wasm_context_address);
   void BuildWasmInterpreterEntry(uint32_t func_index);
-  void BuildCWasmEntry(Address wasm_context_address);
+  void BuildCWasmEntry();
 
   Node* ToJS(Node* node, wasm::ValueType type);
   Node* FromJS(Node* node, Node* js_context, wasm::ValueType type);
   Node* Invert(Node* node);
-  void EnsureFunctionTableNodes();
+  void GetFunctionTableNodes(uint32_t table_index, Node** table,
+                             Node** table_size);
 
   //-----------------------------------------------------------------------
   // Operations that concern the linear memory.
@@ -451,8 +435,10 @@ class WasmGraphBuilder {
 
   bool use_trap_handler() const { return env_ && env_->use_trap_handler; }
 
+  JSGraph* jsgraph() { return jsgraph_; }
+  Graph* graph();
+
  private:
-  enum class NumericImplementation : uint8_t { kTrap, kSaturate };
   static const int kDefaultBufferSize = 16;
 
   Zone* const zone_;
@@ -487,10 +473,6 @@ class WasmGraphBuilder {
 
   compiler::SourcePositionTable* const source_position_table_ = nullptr;
 
-  // Internal helper methods.
-  JSGraph* jsgraph() { return jsgraph_; }
-  Graph* graph();
-
   Node* String(const char* string);
   Node* MemBuffer(uint32_t offset);
   // BoundsCheckMem receives a uint32 {index} node and returns a ptrsize index.
@@ -510,29 +492,14 @@ class WasmGraphBuilder {
   template <typename... Args>
   Node* BuildCCall(MachineSignature* sig, Node* function, Args... args);
   Node* BuildWasmCall(wasm::FunctionSig* sig, Node** args, Node*** rets,
-                      wasm::WasmCodePosition position);
+                      wasm::WasmCodePosition position,
+                      Node* wasm_context = nullptr, bool use_retpoline = false);
 
   Node* BuildF32CopySign(Node* left, Node* right);
   Node* BuildF64CopySign(Node* left, Node* right);
 
-  Node* BuildI32ConvertOp(Node* input, wasm::WasmCodePosition position,
-                          NumericImplementation impl, const Operator* op,
-                          wasm::WasmOpcode check_op,
-                          const IntConvertOps* int_ops,
-                          const FloatConvertOps* float_ops);
-  Node* BuildConvertCheck(Node* test, Node* result, Node* input,
-                          wasm::WasmCodePosition position,
-                          NumericImplementation impl,
-                          const IntConvertOps* int_ops,
-                          const FloatConvertOps* float_ops);
-  Node* BuildI32SConvertF32(Node* input, wasm::WasmCodePosition position,
-                            NumericImplementation impl);
-  Node* BuildI32SConvertF64(Node* input, wasm::WasmCodePosition position,
-                            NumericImplementation impl);
-  Node* BuildI32UConvertF32(Node* input, wasm::WasmCodePosition position,
-                            NumericImplementation impl);
-  Node* BuildI32UConvertF64(Node* input, wasm::WasmCodePosition position,
-                            NumericImplementation impl);
+  Node* BuildIntConvertFloat(Node* input, wasm::WasmCodePosition position,
+                             wasm::WasmOpcode);
   Node* BuildI32Ctz(Node* input);
   Node* BuildI32Popcnt(Node* input);
   Node* BuildI64Ctz(Node* input);
@@ -567,14 +534,8 @@ class WasmGraphBuilder {
   Node* BuildF64SConvertI64(Node* input);
   Node* BuildF64UConvertI64(Node* input);
 
-  Node* BuildFloatToIntConversionInstruction(
-      Node* input, ExternalReference ref,
-      MachineRepresentation parameter_representation,
-      const MachineType result_type, wasm::WasmCodePosition position);
-  Node* BuildI64SConvertF32(Node* input, wasm::WasmCodePosition position);
-  Node* BuildI64UConvertF32(Node* input, wasm::WasmCodePosition position);
-  Node* BuildI64SConvertF64(Node* input, wasm::WasmCodePosition position);
-  Node* BuildI64UConvertF64(Node* input, wasm::WasmCodePosition position);
+  Node* BuildCcallConvertFloat(Node* input, wasm::WasmCodePosition position,
+                               wasm::WasmOpcode opcode);
 
   Node* BuildI32DivS(Node* left, Node* right, wasm::WasmCodePosition position);
   Node* BuildI32RemS(Node* left, Node* right, wasm::WasmCodePosition position);
@@ -655,11 +616,11 @@ class WasmGraphBuilder {
 constexpr int kWasmContextParameterIndex = 0;
 
 V8_EXPORT_PRIVATE CallDescriptor* GetWasmCallDescriptor(
-    Zone* zone, wasm::FunctionSig* signature);
+    Zone* zone, wasm::FunctionSig* signature, bool use_retpoline = false);
 V8_EXPORT_PRIVATE CallDescriptor* GetI32WasmCallDescriptor(
-    Zone* zone, CallDescriptor* descriptor);
+    Zone* zone, CallDescriptor* call_descriptor);
 V8_EXPORT_PRIVATE CallDescriptor* GetI32WasmCallDescriptorForSimd(
-    Zone* zone, CallDescriptor* descriptor);
+    Zone* zone, CallDescriptor* call_descriptor);
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/wasm-linkage.cc b/deps/v8/src/compiler/wasm-linkage.cc
index e7bb3c164a4..442a6c678aa 100644
--- a/deps/v8/src/compiler/wasm-linkage.cc
+++ b/deps/v8/src/compiler/wasm-linkage.cc
@@ -223,7 +223,8 @@ static constexpr Allocator parameter_registers(kGPParamRegisters,
 }  // namespace
 
 // General code uses the above configuration data.
-CallDescriptor* GetWasmCallDescriptor(Zone* zone, wasm::FunctionSig* fsig) {
+CallDescriptor* GetWasmCallDescriptor(Zone* zone, wasm::FunctionSig* fsig,
+                                      bool use_retpoline) {
   // The '+ 1' here is to accomodate the wasm_context as first parameter.
   LocationSignature::Builder locations(zone, fsig->return_count(),
                                        fsig->parameter_count() + 1);
@@ -256,101 +257,99 @@ CallDescriptor* GetWasmCallDescriptor(Zone* zone, wasm::FunctionSig* fsig) {
   const RegList kCalleeSaveFPRegisters = 0;
 
   // The target for wasm calls is always a code object.
-  MachineType target_type = FLAG_wasm_jit_to_native ? MachineType::Pointer()
-                                                    : MachineType::AnyTagged();
+  MachineType target_type = MachineType::Pointer();
   LinkageLocation target_loc = LinkageLocation::ForAnyRegister(target_type);
 
-  CallDescriptor::Kind kind = FLAG_wasm_jit_to_native
-                                  ? CallDescriptor::kCallWasmFunction
-                                  : CallDescriptor::kCallCodeObject;
-
-  return new (zone) CallDescriptor(              // --
-      kind,                                      // kind
-      target_type,                               // target MachineType
-      target_loc,                                // target location
-      locations.Build(),                         // location_sig
-      params.stack_offset,                       // stack_parameter_count
-      compiler::Operator::kNoProperties,         // properties
-      kCalleeSaveRegisters,                      // callee-saved registers
-      kCalleeSaveFPRegisters,                    // callee-saved fp regs
-      CallDescriptor::kNoFlags,                  // flags
+  CallDescriptor::Kind kind = CallDescriptor::kCallWasmFunction;
+
+  return new (zone) CallDescriptor(       // --
+      kind,                               // kind
+      target_type,                        // target MachineType
+      target_loc,                         // target location
+      locations.Build(),                  // location_sig
+      params.stack_offset,                // stack_parameter_count
+      compiler::Operator::kNoProperties,  // properties
+      kCalleeSaveRegisters,               // callee-saved registers
+      kCalleeSaveFPRegisters,             // callee-saved fp regs
+      use_retpoline ? CallDescriptor::kRetpoline
+                    : CallDescriptor::kNoFlags,  // flags
       "wasm-call",                               // debug name
       0,                                         // allocatable registers
       rets.stack_offset - params.stack_offset);  // stack_return_count
 }
 
 CallDescriptor* ReplaceTypeInCallDescriptorWith(
-    Zone* zone, CallDescriptor* descriptor, size_t num_replacements,
+    Zone* zone, CallDescriptor* call_descriptor, size_t num_replacements,
     MachineType input_type, MachineRepresentation output_type) {
-  size_t parameter_count = descriptor->ParameterCount();
-  size_t return_count = descriptor->ReturnCount();
-  for (size_t i = 0; i < descriptor->ParameterCount(); i++) {
-    if (descriptor->GetParameterType(i) == input_type) {
+  size_t parameter_count = call_descriptor->ParameterCount();
+  size_t return_count = call_descriptor->ReturnCount();
+  for (size_t i = 0; i < call_descriptor->ParameterCount(); i++) {
+    if (call_descriptor->GetParameterType(i) == input_type) {
       parameter_count += num_replacements - 1;
     }
   }
-  for (size_t i = 0; i < descriptor->ReturnCount(); i++) {
-    if (descriptor->GetReturnType(i) == input_type) {
+  for (size_t i = 0; i < call_descriptor->ReturnCount(); i++) {
+    if (call_descriptor->GetReturnType(i) == input_type) {
       return_count += num_replacements - 1;
     }
   }
-  if (parameter_count == descriptor->ParameterCount() &&
-      return_count == descriptor->ReturnCount()) {
-    return descriptor;
+  if (parameter_count == call_descriptor->ParameterCount() &&
+      return_count == call_descriptor->ReturnCount()) {
+    return call_descriptor;
   }
 
   LocationSignature::Builder locations(zone, return_count, parameter_count);
 
   Allocator params = parameter_registers;
-  for (size_t i = 0; i < descriptor->ParameterCount(); i++) {
-    if (descriptor->GetParameterType(i) == input_type) {
+  for (size_t i = 0; i < call_descriptor->ParameterCount(); i++) {
+    if (call_descriptor->GetParameterType(i) == input_type) {
       for (size_t j = 0; j < num_replacements; j++) {
         locations.AddParam(params.Next(output_type));
       }
     } else {
       locations.AddParam(
-          params.Next(descriptor->GetParameterType(i).representation()));
+          params.Next(call_descriptor->GetParameterType(i).representation()));
     }
   }
 
   Allocator rets = return_registers;
   rets.AdjustStackOffset(params.stack_offset);
-  for (size_t i = 0; i < descriptor->ReturnCount(); i++) {
-    if (descriptor->GetReturnType(i) == input_type) {
+  for (size_t i = 0; i < call_descriptor->ReturnCount(); i++) {
+    if (call_descriptor->GetReturnType(i) == input_type) {
       for (size_t j = 0; j < num_replacements; j++) {
         locations.AddReturn(rets.Next(output_type));
       }
     } else {
       locations.AddReturn(
-          rets.Next(descriptor->GetReturnType(i).representation()));
+          rets.Next(call_descriptor->GetReturnType(i).representation()));
     }
   }
 
-  return new (zone) CallDescriptor(              // --
-      descriptor->kind(),                        // kind
-      descriptor->GetInputType(0),               // target MachineType
-      descriptor->GetInputLocation(0),           // target location
-      locations.Build(),                         // location_sig
-      params.stack_offset,                       // stack_parameter_count
-      descriptor->properties(),                  // properties
-      descriptor->CalleeSavedRegisters(),        // callee-saved registers
-      descriptor->CalleeSavedFPRegisters(),      // callee-saved fp regs
-      descriptor->flags(),                       // flags
-      descriptor->debug_name(),                  // debug name
-      descriptor->AllocatableRegisters(),        // allocatable registers
-      rets.stack_offset - params.stack_offset);  // stack_return_count
+  return new (zone) CallDescriptor(               // --
+      call_descriptor->kind(),                    // kind
+      call_descriptor->GetInputType(0),           // target MachineType
+      call_descriptor->GetInputLocation(0),       // target location
+      locations.Build(),                          // location_sig
+      params.stack_offset,                        // stack_parameter_count
+      call_descriptor->properties(),              // properties
+      call_descriptor->CalleeSavedRegisters(),    // callee-saved registers
+      call_descriptor->CalleeSavedFPRegisters(),  // callee-saved fp regs
+      call_descriptor->flags(),                   // flags
+      call_descriptor->debug_name(),              // debug name
+      call_descriptor->AllocatableRegisters(),    // allocatable registers
+      rets.stack_offset - params.stack_offset);   // stack_return_count
 }
 
 CallDescriptor* GetI32WasmCallDescriptor(Zone* zone,
-                                         CallDescriptor* descriptor) {
-  return ReplaceTypeInCallDescriptorWith(zone, descriptor, 2,
+                                         CallDescriptor* call_descriptor) {
+  return ReplaceTypeInCallDescriptorWith(zone, call_descriptor, 2,
                                          MachineType::Int64(),
                                          MachineRepresentation::kWord32);
 }
 
-CallDescriptor* GetI32WasmCallDescriptorForSimd(Zone* zone,
-                                                CallDescriptor* descriptor) {
-  return ReplaceTypeInCallDescriptorWith(zone, descriptor, 4,
+CallDescriptor* GetI32WasmCallDescriptorForSimd(
+    Zone* zone, CallDescriptor* call_descriptor) {
+  return ReplaceTypeInCallDescriptorWith(zone, call_descriptor, 4,
                                          MachineType::Simd128(),
                                          MachineRepresentation::kWord32);
 }
diff --git a/deps/v8/src/compiler/x64/code-generator-x64.cc b/deps/v8/src/compiler/x64/code-generator-x64.cc
index bc92f9707c2..0b01b3cf76d 100644
--- a/deps/v8/src/compiler/x64/code-generator-x64.cc
+++ b/deps/v8/src/compiler/x64/code-generator-x64.cc
@@ -296,13 +296,25 @@ class WasmOutOfLineTrap final : public OutOfLineCode {
 void EmitOOLTrapIfNeeded(Zone* zone, CodeGenerator* codegen,
                          InstructionCode opcode, Instruction* instr,
                          X64OperandConverter& i, int pc) {
-  const X64MemoryProtection protection =
-      static_cast<X64MemoryProtection>(MiscField::decode(opcode));
-  if (protection == X64MemoryProtection::kProtected) {
+  const MemoryAccessMode access_mode =
+      static_cast<MemoryAccessMode>(MiscField::decode(opcode));
+  if (access_mode == kMemoryAccessProtected) {
     const bool frame_elided = !codegen->frame_access_state()->has_frame();
     new (zone) WasmOutOfLineTrap(codegen, pc, frame_elided, instr);
   }
 }
+
+void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
+                                   InstructionCode opcode, Instruction* instr,
+                                   X64OperandConverter& i) {
+  const MemoryAccessMode access_mode =
+      static_cast<MemoryAccessMode>(MiscField::decode(opcode));
+  if (access_mode == kMemoryAccessPoisoned) {
+    Register value = i.OutputRegister();
+    codegen->tasm()->andq(value, kSpeculationPoisonRegister);
+  }
+}
+
 }  // namespace
 
 
@@ -470,6 +482,18 @@ void EmitOOLTrapIfNeeded(Zone* zone, CodeGenerator* codegen,
     __ j(not_equal, &binop);                                    \
   } while (false)
 
+#define ASSEMBLE_ATOMIC64_BINOP(bin_inst, mov_inst, cmpxchg_inst) \
+  do {                                                            \
+    Label binop;                                                  \
+    __ bind(&binop);                                              \
+    __ mov_inst(rax, i.MemoryOperand(1));                         \
+    __ movq(i.TempRegister(0), rax);                              \
+    __ bin_inst(i.TempRegister(0), i.InputRegister(0));           \
+    __ lock();                                                    \
+    __ cmpxchg_inst(i.MemoryOperand(1), i.TempRegister(0));       \
+    __ j(not_equal, &binop);                                      \
+  } while (false)
+
 void CodeGenerator::AssembleDeconstructFrame() {
   unwinding_info_writer_.MarkFrameDeconstructed(__ pc_offset());
   __ movq(rsp, rbp);
@@ -570,32 +594,44 @@ void CodeGenerator::AssembleTailCallAfterGap(Instruction* instr,
                                 first_unused_stack_slot);
 }
 
+// Check that {kJavaScriptCallCodeStartRegister} is correct.
+void CodeGenerator::AssembleCodeStartRegisterCheck() {
+  __ ComputeCodeStartAddress(rbx);
+  __ cmpq(rbx, kJavaScriptCallCodeStartRegister);
+  __ Assert(equal, AbortReason::kWrongFunctionCodeStart);
+}
+
 // Check if the code object is marked for deoptimization. If it is, then it
-// jumps to CompileLazyDeoptimizedCode builtin. In order to do this we need to:
-//    1. load the address of the current instruction;
-//    2. read from memory the word that contains that bit, which can be found in
+// jumps to the CompileLazyDeoptimizedCode builtin. In order to do this we need
+// to:
+//    1. read from memory the word that contains that bit, which can be found in
 //       the flags in the referenced {CodeDataContainer} object;
-//    3. test kMarkedForDeoptimizationBit in those flags; and
-//    4. if it is not zero then it jumps to the builtin.
+//    2. test kMarkedForDeoptimizationBit in those flags; and
+//    3. if it is not zero then it jumps to the builtin.
 void CodeGenerator::BailoutIfDeoptimized() {
-  Label current;
-  // Load effective address to get the address of the current instruction into
-  // rcx.
-  __ leaq(rcx, Operand(&current));
-  __ bind(&current);
-  int pc = __ pc_offset();
-  int offset = Code::kCodeDataContainerOffset - (Code::kHeaderSize + pc);
-  __ movp(rcx, Operand(rcx, offset));
-  __ testl(FieldOperand(rcx, CodeDataContainer::kKindSpecificFlagsOffset),
+  int offset = Code::kCodeDataContainerOffset - Code::kHeaderSize;
+  __ movp(rbx, Operand(kJavaScriptCallCodeStartRegister, offset));
+  __ testl(FieldOperand(rbx, CodeDataContainer::kKindSpecificFlagsOffset),
            Immediate(1 << Code::kMarkedForDeoptimizationBit));
   Handle<Code> code = isolate()->builtins()->builtin_handle(
       Builtins::kCompileLazyDeoptimizedCode);
   __ j(not_zero, code, RelocInfo::CODE_TARGET);
 }
 
-inline bool HasCallDescriptorFlag(Instruction* instr,
-                                  CallDescriptor::Flag flag) {
-  return MiscField::decode(instr->opcode()) & flag;
+void CodeGenerator::GenerateSpeculationPoisonFromCodeStartRegister() {
+  // Set a mask which has all bits set in the normal case, but has all
+  // bits cleared if we are speculatively executing the wrong PC.
+  __ ComputeCodeStartAddress(rbx);
+  __ xorq(kSpeculationPoisonRegister, kSpeculationPoisonRegister);
+  __ cmpp(kJavaScriptCallCodeStartRegister, rbx);
+  __ movp(rbx, Immediate(-1));
+  __ cmovq(equal, kSpeculationPoisonRegister, rbx);
+}
+
+void CodeGenerator::AssembleRegisterArgumentPoisoning() {
+  __ andq(kJSFunctionRegister, kSpeculationPoisonRegister);
+  __ andq(kContextRegister, kSpeculationPoisonRegister);
+  __ andq(rsp, kSpeculationPoisonRegister);
 }
 
 // Assembles an instruction after register allocation, producing machine code.
@@ -697,6 +733,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchTailCallAddress: {
       CHECK(!HasImmediateInput(instr, 0));
       Register reg = i.InputRegister(0);
+      if (HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister)) {
+        static_assert(kJavaScriptCallCodeStartRegister == rcx, "ABI mismatch");
+        DCHECK_EQ(rcx, reg);
+      }
       if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
         __ RetpolineJump(reg);
       } else {
@@ -714,6 +754,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ cmpp(rsi, FieldOperand(func, JSFunction::kContextOffset));
         __ Assert(equal, AbortReason::kWrongFunctionContext);
       }
+      static_assert(kJavaScriptCallCodeStartRegister == rcx, "ABI mismatch");
       __ movp(rcx, FieldOperand(func, JSFunction::kCodeOffset));
       __ addp(rcx, Immediate(Code::kHeaderSize - kHeapObjectTag));
       __ call(rcx);
@@ -782,6 +823,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
             __ RequiredStackSizeForCallerSaved(fp_mode_, kReturnRegister0);
         frame_access_state()->IncreaseSPDelta(bytes / kPointerSize);
       }
+      // TODO(tebbi): Do we need an lfence here?
       break;
     }
     case kArchJmp:
@@ -843,6 +885,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ movq(i.OutputRegister(), rbp);
       }
       break;
+    case kArchRootsPointer:
+      __ movq(i.OutputRegister(), kRootRegister);
+      break;
     case kArchTruncateDoubleToI: {
       auto result = i.OutputRegister();
       auto input = i.InputDoubleRegister(0);
@@ -875,6 +920,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ bind(ool->exit());
       break;
     }
+    case kArchPoisonOnSpeculationWord:
+      DCHECK_EQ(i.OutputRegister(), i.InputRegister(0));
+      __ andq(i.InputRegister(0), kSpeculationPoisonRegister);
+      break;
     case kLFence:
       __ lfence();
       break;
@@ -1747,20 +1796,24 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
       ASSEMBLE_MOVX(movsxbl);
       __ AssertZeroExtended(i.OutputRegister());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kX64Movzxbl:
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
       ASSEMBLE_MOVX(movzxbl);
       __ AssertZeroExtended(i.OutputRegister());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kX64Movsxbq:
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
       ASSEMBLE_MOVX(movsxbq);
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kX64Movzxbq:
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
       ASSEMBLE_MOVX(movzxbq);
       __ AssertZeroExtended(i.OutputRegister());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kX64Movb: {
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
@@ -1771,17 +1824,20 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       } else {
         __ movb(operand, i.InputRegister(index));
       }
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     }
     case kX64Movsxwl:
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
       ASSEMBLE_MOVX(movsxwl);
       __ AssertZeroExtended(i.OutputRegister());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kX64Movzxwl:
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
       ASSEMBLE_MOVX(movzxwl);
       __ AssertZeroExtended(i.OutputRegister());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kX64Movsxwq:
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
@@ -1791,6 +1847,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
       ASSEMBLE_MOVX(movzxwq);
       __ AssertZeroExtended(i.OutputRegister());
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kX64Movw: {
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
@@ -1801,6 +1858,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       } else {
         __ movw(operand, i.InputRegister(index));
       }
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     }
     case kX64Movl:
@@ -1825,10 +1883,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
           __ movl(operand, i.InputRegister(index));
         }
       }
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kX64Movsxlq:
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
       ASSEMBLE_MOVX(movsxlq);
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kX64Movq:
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
@@ -1843,6 +1903,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
           __ movq(operand, i.InputRegister(index));
         }
       }
+      EmitWordLoadPoisoningIfNeeded(this, opcode, instr, i);
       break;
     case kX64Movss:
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
@@ -1854,16 +1915,28 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ movss(operand, i.InputDoubleRegister(index));
       }
       break;
-    case kX64Movsd:
+    case kX64Movsd: {
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
       if (instr->HasOutput()) {
-        __ Movsd(i.OutputDoubleRegister(), i.MemoryOperand());
+        const MemoryAccessMode access_mode =
+            static_cast<MemoryAccessMode>(MiscField::decode(opcode));
+        if (access_mode == kMemoryAccessPoisoned) {
+          // If we have to poison the loaded value, we load into a general
+          // purpose register first, mask it with the poison, and move the
+          // value from the general purpose register into the double register.
+          __ movq(kScratchRegister, i.MemoryOperand());
+          __ andq(kScratchRegister, kSpeculationPoisonRegister);
+          __ Movq(i.OutputDoubleRegister(), kScratchRegister);
+        } else {
+          __ Movsd(i.OutputDoubleRegister(), i.MemoryOperand());
+        }
       } else {
         size_t index = 0;
         Operand operand = i.MemoryOperand(&index);
         __ Movsd(operand, i.InputDoubleRegister(index));
       }
       break;
+    }
     case kX64Movdqu: {
       CpuFeatureScope sse_scope(tasm(), SSSE3);
       EmitOOLTrapIfNeeded(zone(), this, opcode, instr, i, __ pc_offset());
@@ -2064,9 +2137,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kX64F32x4Splat: {
       XMMRegister dst = i.OutputSimd128Register();
       if (instr->InputAt(0)->IsFPRegister()) {
-        __ Movss(dst, i.InputDoubleRegister(0));
+        __ movss(dst, i.InputDoubleRegister(0));
       } else {
-        __ Movss(dst, i.InputOperand(0));
+        __ movss(dst, i.InputOperand(0));
       }
       __ shufps(dst, dst, 0x0);
       break;
@@ -2085,6 +2158,34 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ insertps(i.OutputSimd128Register(), i.InputDoubleRegister(2), select);
       break;
     }
+    case kX64F32x4Abs: {
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src = i.InputSimd128Register(0);
+      if (dst == src) {
+        __ pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+        __ psrld(kScratchDoubleReg, 1);
+        __ andps(i.OutputSimd128Register(), kScratchDoubleReg);
+      } else {
+        __ pcmpeqd(dst, dst);
+        __ psrld(dst, 1);
+        __ andps(dst, i.InputSimd128Register(0));
+      }
+      break;
+    }
+    case kX64F32x4Neg: {
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src = i.InputSimd128Register(0);
+      if (dst == src) {
+        __ pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+        __ pslld(kScratchDoubleReg, 31);
+        __ xorps(i.OutputSimd128Register(), kScratchDoubleReg);
+      } else {
+        __ pcmpeqd(dst, dst);
+        __ pslld(dst, 31);
+        __ xorps(dst, i.InputSimd128Register(0));
+      }
+      break;
+    }
     case kX64F32x4RecipApprox: {
       __ rcpps(i.OutputSimd128Register(), i.InputSimd128Register(0));
       break;
@@ -2098,6 +2199,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ addps(i.OutputSimd128Register(), i.InputSimd128Register(1));
       break;
     }
+    case kX64F32x4AddHoriz: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      CpuFeatureScope sse_scope(tasm(), SSE3);
+      __ haddps(i.OutputSimd128Register(), i.InputSimd128Register(1));
+      break;
+    }
     case kX64F32x4Sub: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       __ subps(i.OutputSimd128Register(), i.InputSimd128Register(1));
@@ -2271,7 +2378,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       XMMRegister dst = i.OutputSimd128Register();
       __ movd(dst, i.InputRegister(0));
       __ pshuflw(dst, dst, 0x0);
-      __ pshufhw(dst, dst, 0x0);
       __ pshufd(dst, dst, 0x0);
       break;
     }
@@ -2571,77 +2677,77 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kX64StackCheck:
       __ CompareRoot(rsp, Heap::kStackLimitRootIndex);
       break;
-    case kAtomicExchangeInt8: {
+    case kWord32AtomicExchangeInt8: {
       __ xchgb(i.InputRegister(0), i.MemoryOperand(1));
       __ movsxbl(i.InputRegister(0), i.InputRegister(0));
       break;
     }
-    case kAtomicExchangeUint8: {
+    case kWord32AtomicExchangeUint8: {
       __ xchgb(i.InputRegister(0), i.MemoryOperand(1));
       __ movzxbl(i.InputRegister(0), i.InputRegister(0));
       break;
     }
-    case kAtomicExchangeInt16: {
+    case kWord32AtomicExchangeInt16: {
       __ xchgw(i.InputRegister(0), i.MemoryOperand(1));
       __ movsxwl(i.InputRegister(0), i.InputRegister(0));
       break;
     }
-    case kAtomicExchangeUint16: {
+    case kWord32AtomicExchangeUint16: {
       __ xchgw(i.InputRegister(0), i.MemoryOperand(1));
       __ movzxwl(i.InputRegister(0), i.InputRegister(0));
       break;
     }
-    case kAtomicExchangeWord32: {
+    case kWord32AtomicExchangeWord32: {
       __ xchgl(i.InputRegister(0), i.MemoryOperand(1));
       break;
     }
-    case kAtomicCompareExchangeInt8: {
+    case kWord32AtomicCompareExchangeInt8: {
       __ lock();
       __ cmpxchgb(i.MemoryOperand(2), i.InputRegister(1));
       __ movsxbl(rax, rax);
       break;
     }
-    case kAtomicCompareExchangeUint8: {
+    case kWord32AtomicCompareExchangeUint8: {
       __ lock();
       __ cmpxchgb(i.MemoryOperand(2), i.InputRegister(1));
       __ movzxbl(rax, rax);
       break;
     }
-    case kAtomicCompareExchangeInt16: {
+    case kWord32AtomicCompareExchangeInt16: {
       __ lock();
       __ cmpxchgw(i.MemoryOperand(2), i.InputRegister(1));
       __ movsxwl(rax, rax);
       break;
     }
-    case kAtomicCompareExchangeUint16: {
+    case kWord32AtomicCompareExchangeUint16: {
       __ lock();
       __ cmpxchgw(i.MemoryOperand(2), i.InputRegister(1));
       __ movzxwl(rax, rax);
       break;
     }
-    case kAtomicCompareExchangeWord32: {
+    case kWord32AtomicCompareExchangeWord32: {
       __ lock();
       __ cmpxchgl(i.MemoryOperand(2), i.InputRegister(1));
       break;
     }
 #define ATOMIC_BINOP_CASE(op, inst)              \
-  case kAtomic##op##Int8:                        \
+  case kWord32Atomic##op##Int8:                  \
     ASSEMBLE_ATOMIC_BINOP(inst, movb, cmpxchgb); \
     __ movsxbl(rax, rax);                        \
     break;                                       \
-  case kAtomic##op##Uint8:                       \
+  case kWord32Atomic##op##Uint8:                 \
     ASSEMBLE_ATOMIC_BINOP(inst, movb, cmpxchgb); \
     __ movzxbl(rax, rax);                        \
     break;                                       \
-  case kAtomic##op##Int16:                       \
+  case kWord32Atomic##op##Int16:                 \
     ASSEMBLE_ATOMIC_BINOP(inst, movw, cmpxchgw); \
     __ movsxwl(rax, rax);                        \
     break;                                       \
-  case kAtomic##op##Uint16:                      \
+  case kWord32Atomic##op##Uint16:                \
     ASSEMBLE_ATOMIC_BINOP(inst, movw, cmpxchgw); \
     __ movzxwl(rax, rax);                        \
     break;                                       \
-  case kAtomic##op##Word32:                      \
+  case kWord32Atomic##op##Word32:                \
     ASSEMBLE_ATOMIC_BINOP(inst, movl, cmpxchgl); \
     break;
       ATOMIC_BINOP_CASE(Add, addl)
@@ -2650,19 +2756,102 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       ATOMIC_BINOP_CASE(Or, orl)
       ATOMIC_BINOP_CASE(Xor, xorl)
 #undef ATOMIC_BINOP_CASE
-    case kAtomicLoadInt8:
-    case kAtomicLoadUint8:
-    case kAtomicLoadInt16:
-    case kAtomicLoadUint16:
-    case kAtomicLoadWord32:
-    case kAtomicStoreWord8:
-    case kAtomicStoreWord16:
-    case kAtomicStoreWord32:
+    case kX64Word64AtomicExchangeUint8: {
+      __ xchgb(i.InputRegister(0), i.MemoryOperand(1));
+      __ movzxbq(i.InputRegister(0), i.InputRegister(0));
+      break;
+    }
+    case kX64Word64AtomicExchangeUint16: {
+      __ xchgw(i.InputRegister(0), i.MemoryOperand(1));
+      __ movzxwq(i.InputRegister(0), i.InputRegister(0));
+      break;
+    }
+    case kX64Word64AtomicExchangeUint32: {
+      __ xchgl(i.InputRegister(0), i.MemoryOperand(1));
+      break;
+    }
+    case kX64Word64AtomicExchangeUint64: {
+      __ xchgq(i.InputRegister(0), i.MemoryOperand(1));
+      break;
+    }
+    case kX64Word64AtomicCompareExchangeUint8: {
+      __ lock();
+      __ cmpxchgb(i.MemoryOperand(2), i.InputRegister(1));
+      __ movzxbq(rax, rax);
+      break;
+    }
+    case kX64Word64AtomicCompareExchangeUint16: {
+      __ lock();
+      __ cmpxchgw(i.MemoryOperand(2), i.InputRegister(1));
+      __ movzxwq(rax, rax);
+      break;
+    }
+    case kX64Word64AtomicCompareExchangeUint32: {
+      __ lock();
+      __ cmpxchgl(i.MemoryOperand(2), i.InputRegister(1));
+      break;
+    }
+    case kX64Word64AtomicCompareExchangeUint64: {
+      __ lock();
+      __ cmpxchgq(i.MemoryOperand(2), i.InputRegister(1));
+      break;
+    }
+#define ATOMIC64_BINOP_CASE(op, inst)              \
+  case kX64Word64Atomic##op##Uint8:                \
+    ASSEMBLE_ATOMIC64_BINOP(inst, movb, cmpxchgb); \
+    __ movzxbq(rax, rax);                          \
+    break;                                         \
+  case kX64Word64Atomic##op##Uint16:               \
+    ASSEMBLE_ATOMIC64_BINOP(inst, movw, cmpxchgw); \
+    __ movzxwq(rax, rax);                          \
+    break;                                         \
+  case kX64Word64Atomic##op##Uint32:               \
+    ASSEMBLE_ATOMIC64_BINOP(inst, movl, cmpxchgl); \
+    break;                                         \
+  case kX64Word64Atomic##op##Uint64:               \
+    ASSEMBLE_ATOMIC64_BINOP(inst, movq, cmpxchgq); \
+    break;
+      ATOMIC64_BINOP_CASE(Add, addq)
+      ATOMIC64_BINOP_CASE(Sub, subq)
+      ATOMIC64_BINOP_CASE(And, andq)
+      ATOMIC64_BINOP_CASE(Or, orq)
+      ATOMIC64_BINOP_CASE(Xor, xorq)
+#undef ATOMIC64_BINOP_CASE
+    case kWord32AtomicLoadInt8:
+    case kWord32AtomicLoadUint8:
+    case kWord32AtomicLoadInt16:
+    case kWord32AtomicLoadUint16:
+    case kWord32AtomicLoadWord32:
+    case kWord32AtomicStoreWord8:
+    case kWord32AtomicStoreWord16:
+    case kWord32AtomicStoreWord32:
+    case kX64Word64AtomicLoadUint8:
+    case kX64Word64AtomicLoadUint16:
+    case kX64Word64AtomicLoadUint32:
+    case kX64Word64AtomicLoadUint64:
+    case kX64Word64AtomicStoreWord8:
+    case kX64Word64AtomicStoreWord16:
+    case kX64Word64AtomicStoreWord32:
+    case kX64Word64AtomicStoreWord64:
       UNREACHABLE();  // Won't be generated by instruction selector.
       break;
   }
   return kSuccess;
-}  // NOLINT(readability/fn_size)
+}  // NOLadability/fn_size)
+
+#undef ASSEMBLE_UNOP
+#undef ASSEMBLE_BINOP
+#undef ASSEMBLE_COMPARE
+#undef ASSEMBLE_MULT
+#undef ASSEMBLE_SHIFT
+#undef ASSEMBLE_MOVX
+#undef ASSEMBLE_SSE_BINOP
+#undef ASSEMBLE_SSE_UNOP
+#undef ASSEMBLE_AVX_BINOP
+#undef ASSEMBLE_IEEE754_BINOP
+#undef ASSEMBLE_IEEE754_UNOP
+#undef ASSEMBLE_ATOMIC_BINOP
+#undef ASSEMBLE_ATOMIC64_BINOP
 
 namespace {
 
@@ -2718,6 +2907,19 @@ void CodeGenerator::AssembleArchBranch(Instruction* instr, BranchInfo* branch) {
   if (!branch->fallthru) __ jmp(flabel, flabel_distance);
 }
 
+void CodeGenerator::AssembleBranchPoisoning(FlagsCondition condition,
+                                            Instruction* instr) {
+  // TODO(jarin) Handle float comparisons (kUnordered[Not]Equal).
+  if (condition == kUnorderedEqual || condition == kUnorderedNotEqual) {
+    return;
+  }
+
+  condition = NegateFlagsCondition(condition);
+  __ movl(kScratchRegister, Immediate(0));
+  __ cmovq(FlagsConditionToCondition(condition), kSpeculationPoisonRegister,
+           kScratchRegister);
+}
+
 void CodeGenerator::AssembleArchDeoptBranch(Instruction* instr,
                                             BranchInfo* branch) {
   Label::Distance flabel_distance =
@@ -2799,8 +3001,8 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                              __ isolate()),
                          0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
-        CallDescriptor* descriptor = gen_->linkage()->GetIncomingDescriptor();
-        size_t pop_size = descriptor->StackParameterCount() * kPointerSize;
+        auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
+        size_t pop_size = call_descriptor->StackParameterCount() * kPointerSize;
         // Use rcx as a scratch register, we return anyways immediately.
         __ Ret(static_cast<int>(pop_size), rcx);
       } else {
@@ -2858,7 +3060,6 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
   __ bind(&done);
 }
 
-
 void CodeGenerator::AssembleArchLookupSwitch(Instruction* instr) {
   X64OperandConverter i(this, instr);
   Register input = i.InputRegister(0);
@@ -2892,9 +3093,9 @@ static const int kQuadWordSize = 16;
 }  // namespace
 
 void CodeGenerator::FinishFrame(Frame* frame) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
 
-  const RegList saves_fp = descriptor->CalleeSavedFPRegisters();
+  const RegList saves_fp = call_descriptor->CalleeSavedFPRegisters();
   if (saves_fp != 0) {
     frame->AlignSavedCalleeRegisterSlots();
     if (saves_fp != 0) {  // Save callee-saved XMM registers.
@@ -2903,7 +3104,7 @@ void CodeGenerator::FinishFrame(Frame* frame) {
                                               (kQuadWordSize / kPointerSize));
     }
   }
-  const RegList saves = descriptor->CalleeSavedRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {  // Save callee-saved registers.
     int count = 0;
     for (int i = Register::kNumRegisters - 1; i >= 0; i--) {
@@ -2916,16 +3117,16 @@ void CodeGenerator::FinishFrame(Frame* frame) {
 }
 
 void CodeGenerator::AssembleConstructFrame() {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
   if (frame_access_state()->has_frame()) {
     int pc_base = __ pc_offset();
 
-    if (descriptor->IsCFunctionCall()) {
+    if (call_descriptor->IsCFunctionCall()) {
       __ pushq(rbp);
       __ movq(rbp, rsp);
-    } else if (descriptor->IsJSFunctionCall()) {
+    } else if (call_descriptor->IsJSFunctionCall()) {
       __ Prologue();
-      if (descriptor->PushArgumentCount()) {
+      if (call_descriptor->PushArgumentCount()) {
         __ pushq(kJavaScriptCallArgCountRegister);
       }
     } else {
@@ -2934,8 +3135,8 @@ void CodeGenerator::AssembleConstructFrame() {
 
     unwinding_info_writer_.MarkFrameConstructed(pc_base);
   }
-  int shrink_slots =
-      frame()->GetTotalFrameSlotCount() - descriptor->CalculateFixedFrameSize();
+  int shrink_slots = frame()->GetTotalFrameSlotCount() -
+                     call_descriptor->CalculateFixedFrameSize();
 
   if (info()->is_osr()) {
     // TurboFan OSR-compiled functions cannot be entered directly.
@@ -2948,10 +3149,11 @@ void CodeGenerator::AssembleConstructFrame() {
     if (FLAG_code_comments) __ RecordComment("-- OSR entrypoint --");
     osr_pc_offset_ = __ pc_offset();
     shrink_slots -= static_cast<int>(osr_helper()->UnoptimizedFrameSlots());
+    ResetSpeculationPoison();
   }
 
-  const RegList saves = descriptor->CalleeSavedRegisters();
-  const RegList saves_fp = descriptor->CalleeSavedFPRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
+  const RegList saves_fp = call_descriptor->CalleeSavedFPRegisters();
 
   if (shrink_slots > 0) {
     if (info()->IsWasm() && shrink_slots > 128) {
@@ -3024,10 +3226,10 @@ void CodeGenerator::AssembleConstructFrame() {
 }
 
 void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
-  CallDescriptor* descriptor = linkage()->GetIncomingDescriptor();
+  auto call_descriptor = linkage()->GetIncomingDescriptor();
 
   // Restore registers.
-  const RegList saves = descriptor->CalleeSavedRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     const int returns = frame()->GetReturnSlotCount();
     if (returns != 0) {
@@ -3038,7 +3240,7 @@ void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
       __ popq(Register::from_code(i));
     }
   }
-  const RegList saves_fp = descriptor->CalleeSavedFPRegisters();
+  const RegList saves_fp = call_descriptor->CalleeSavedFPRegisters();
   if (saves_fp != 0) {
     const uint32_t saves_fp_count = base::bits::CountPopulation(saves_fp);
     const int stack_size = saves_fp_count * kQuadWordSize;
@@ -3058,11 +3260,11 @@ void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
 
   // Might need rcx for scratch if pop_size is too big or if there is a variable
   // pop count.
-  DCHECK_EQ(0u, descriptor->CalleeSavedRegisters() & rcx.bit());
-  DCHECK_EQ(0u, descriptor->CalleeSavedRegisters() & rdx.bit());
-  size_t pop_size = descriptor->StackParameterCount() * kPointerSize;
+  DCHECK_EQ(0u, call_descriptor->CalleeSavedRegisters() & rcx.bit());
+  DCHECK_EQ(0u, call_descriptor->CalleeSavedRegisters() & rdx.bit());
+  size_t pop_size = call_descriptor->StackParameterCount() * kPointerSize;
   X64OperandConverter g(this, nullptr);
-  if (descriptor->IsCFunctionCall()) {
+  if (call_descriptor->IsCFunctionCall()) {
     AssembleDeconstructFrame();
   } else if (frame_access_state()->has_frame()) {
     if (pop->IsImmediate() && g.ToConstant(pop).ToInt32() == 0) {
@@ -3097,147 +3299,156 @@ void CodeGenerator::FinishCode() {}
 void CodeGenerator::AssembleMove(InstructionOperand* source,
                                  InstructionOperand* destination) {
   X64OperandConverter g(this, nullptr);
-  // Dispatch on the source and destination operand kinds.  Not all
-  // combinations are possible.
-  if (source->IsRegister()) {
-    DCHECK(destination->IsRegister() || destination->IsStackSlot());
-    Register src = g.ToRegister(source);
-    if (destination->IsRegister()) {
-      __ movq(g.ToRegister(destination), src);
-    } else {
-      __ movq(g.ToOperand(destination), src);
-    }
-  } else if (source->IsStackSlot()) {
-    DCHECK(destination->IsRegister() || destination->IsStackSlot());
-    Operand src = g.ToOperand(source);
-    if (destination->IsRegister()) {
-      Register dst = g.ToRegister(destination);
-      __ movq(dst, src);
-    } else {
-      // Spill on demand to use a temporary register for memory-to-memory
-      // moves.
-      Register tmp = kScratchRegister;
-      Operand dst = g.ToOperand(destination);
-      __ movq(tmp, src);
-      __ movq(dst, tmp);
-    }
-  } else if (source->IsConstant()) {
-    ConstantOperand* constant_source = ConstantOperand::cast(source);
-    Constant src = g.ToConstant(constant_source);
-    if (destination->IsRegister() || destination->IsStackSlot()) {
-      Register dst = destination->IsRegister() ? g.ToRegister(destination)
-                                               : kScratchRegister;
-      switch (src.type()) {
-        case Constant::kInt32: {
-          if (RelocInfo::IsWasmPtrReference(src.rmode())) {
-            __ movq(dst, src.ToInt64(), src.rmode());
-          } else {
-            int32_t value = src.ToInt32();
-            if (RelocInfo::IsWasmSizeReference(src.rmode())) {
-              __ movl(dst, Immediate(value, src.rmode()));
-            } else if (value == 0) {
-              __ xorl(dst, dst);
-            } else {
-              __ movl(dst, Immediate(value));
-            }
-          }
-          break;
-        }
-        case Constant::kInt64:
-          if (RelocInfo::IsWasmPtrReference(src.rmode())) {
-            __ movq(dst, src.ToInt64(), src.rmode());
-          } else {
-            DCHECK(!RelocInfo::IsWasmSizeReference(src.rmode()));
-            __ Set(dst, src.ToInt64());
-          }
-          break;
-        case Constant::kFloat32:
-          __ MoveNumber(dst, src.ToFloat32());
-          break;
-        case Constant::kFloat64:
-          __ MoveNumber(dst, src.ToFloat64().value());
-          break;
-        case Constant::kExternalReference:
-          __ Move(dst, src.ToExternalReference());
-          break;
-        case Constant::kHeapObject: {
-          Handle<HeapObject> src_object = src.ToHeapObject();
-          Heap::RootListIndex index;
-          if (IsMaterializableFromRoot(src_object, &index)) {
-            __ LoadRoot(dst, index);
+  // Helper function to write the given constant to the dst register.
+  auto MoveConstantToRegister = [&](Register dst, Constant src) {
+    switch (src.type()) {
+      case Constant::kInt32: {
+        if (RelocInfo::IsWasmPtrReference(src.rmode())) {
+          __ movq(dst, src.ToInt64(), src.rmode());
+        } else {
+          int32_t value = src.ToInt32();
+          if (value == 0) {
+            __ xorl(dst, dst);
           } else {
-            __ Move(dst, src_object);
+            __ movl(dst, Immediate(value));
           }
-          break;
         }
-        case Constant::kRpoNumber:
-          UNREACHABLE();  // TODO(dcarney): load of labels on x64.
-          break;
+        break;
       }
-      if (destination->IsStackSlot()) {
-        __ movq(g.ToOperand(destination), kScratchRegister);
+      case Constant::kInt64:
+        if (RelocInfo::IsWasmPtrReference(src.rmode())) {
+          __ movq(dst, src.ToInt64(), src.rmode());
+        } else {
+          __ Set(dst, src.ToInt64());
+        }
+        break;
+      case Constant::kFloat32:
+        __ MoveNumber(dst, src.ToFloat32());
+        break;
+      case Constant::kFloat64:
+        __ MoveNumber(dst, src.ToFloat64().value());
+        break;
+      case Constant::kExternalReference:
+        __ Move(dst, src.ToExternalReference());
+        break;
+      case Constant::kHeapObject: {
+        Handle<HeapObject> src_object = src.ToHeapObject();
+        Heap::RootListIndex index;
+        if (IsMaterializableFromRoot(src_object, &index)) {
+          __ LoadRoot(dst, index);
+        } else {
+          __ Move(dst, src_object);
+        }
+        break;
       }
-    } else if (src.type() == Constant::kFloat32) {
-      // TODO(turbofan): Can we do better here?
-      uint32_t src_const = bit_cast<uint32_t>(src.ToFloat32());
-      if (destination->IsFPRegister()) {
-        __ Move(g.ToDoubleRegister(destination), src_const);
+      case Constant::kRpoNumber:
+        UNREACHABLE();  // TODO(dcarney): load of labels on x64.
+        break;
+    }
+  };
+  // Dispatch on the source and destination operand kinds.
+  switch (MoveType::InferMove(source, destination)) {
+    case MoveType::kRegisterToRegister:
+      if (source->IsRegister()) {
+        __ movq(g.ToRegister(destination), g.ToRegister(source));
       } else {
-        DCHECK(destination->IsFPStackSlot());
-        Operand dst = g.ToOperand(destination);
-        __ movl(dst, Immediate(src_const));
+        DCHECK(source->IsFPRegister());
+        __ Movapd(g.ToDoubleRegister(destination), g.ToDoubleRegister(source));
       }
-    } else {
-      DCHECK_EQ(Constant::kFloat64, src.type());
-      uint64_t src_const = src.ToFloat64().AsUint64();
-      if (destination->IsFPRegister()) {
-        __ Move(g.ToDoubleRegister(destination), src_const);
+      return;
+    case MoveType::kRegisterToStack: {
+      Operand dst = g.ToOperand(destination);
+      if (source->IsRegister()) {
+        __ movq(dst, g.ToRegister(source));
+      } else {
+        DCHECK(source->IsFPRegister());
+        XMMRegister src = g.ToDoubleRegister(source);
+        MachineRepresentation rep =
+            LocationOperand::cast(source)->representation();
+        if (rep != MachineRepresentation::kSimd128) {
+          __ Movsd(dst, src);
+        } else {
+          __ Movups(dst, src);
+        }
+      }
+      return;
+    }
+    case MoveType::kStackToRegister: {
+      Operand src = g.ToOperand(source);
+      if (source->IsStackSlot()) {
+        __ movq(g.ToRegister(destination), src);
       } else {
-        DCHECK(destination->IsFPStackSlot());
-        __ movq(kScratchRegister, src_const);
-        __ movq(g.ToOperand(destination), kScratchRegister);
+        DCHECK(source->IsFPStackSlot());
+        XMMRegister dst = g.ToDoubleRegister(destination);
+        MachineRepresentation rep =
+            LocationOperand::cast(source)->representation();
+        if (rep != MachineRepresentation::kSimd128) {
+          __ Movsd(dst, src);
+        } else {
+          __ Movups(dst, src);
+        }
       }
+      return;
     }
-  } else if (source->IsFPRegister()) {
-    XMMRegister src = g.ToDoubleRegister(source);
-    if (destination->IsFPRegister()) {
-      XMMRegister dst = g.ToDoubleRegister(destination);
-      __ Movapd(dst, src);
-    } else {
-      DCHECK(destination->IsFPStackSlot());
+    case MoveType::kStackToStack: {
+      Operand src = g.ToOperand(source);
       Operand dst = g.ToOperand(destination);
-      MachineRepresentation rep =
-          LocationOperand::cast(source)->representation();
-      if (rep != MachineRepresentation::kSimd128) {
-        __ Movsd(dst, src);
-      } else {
-        __ Movups(dst, src);
+      if (source->IsStackSlot()) {
+        // Spill on demand to use a temporary register for memory-to-memory
+        // moves.
+        __ movq(kScratchRegister, src);
+        __ movq(dst, kScratchRegister);
+      } else {
+        MachineRepresentation rep =
+            LocationOperand::cast(source)->representation();
+        if (rep != MachineRepresentation::kSimd128) {
+          __ Movsd(kScratchDoubleReg, src);
+          __ Movsd(dst, kScratchDoubleReg);
+        } else {
+          DCHECK(source->IsSimd128StackSlot());
+          __ Movups(kScratchDoubleReg, src);
+          __ Movups(dst, kScratchDoubleReg);
+        }
       }
+      return;
     }
-  } else if (source->IsFPStackSlot()) {
-    DCHECK(destination->IsFPRegister() || destination->IsFPStackSlot());
-    Operand src = g.ToOperand(source);
-    MachineRepresentation rep = LocationOperand::cast(source)->representation();
-    if (destination->IsFPRegister()) {
-      XMMRegister dst = g.ToDoubleRegister(destination);
-      if (rep != MachineRepresentation::kSimd128) {
-        __ Movsd(dst, src);
+    case MoveType::kConstantToRegister: {
+      Constant src = g.ToConstant(source);
+      if (destination->IsRegister()) {
+        MoveConstantToRegister(g.ToRegister(destination), src);
       } else {
-        __ Movups(dst, src);
+        DCHECK(destination->IsFPRegister());
+        XMMRegister dst = g.ToDoubleRegister(destination);
+        if (src.type() == Constant::kFloat32) {
+          // TODO(turbofan): Can we do better here?
+          __ Move(dst, bit_cast<uint32_t>(src.ToFloat32()));
+        } else {
+          DCHECK_EQ(src.type(), Constant::kFloat64);
+          __ Move(dst, src.ToFloat64().AsUint64());
+        }
       }
-    } else {
+      return;
+    }
+    case MoveType::kConstantToStack: {
+      Constant src = g.ToConstant(source);
       Operand dst = g.ToOperand(destination);
-      if (rep != MachineRepresentation::kSimd128) {
-        __ Movsd(kScratchDoubleReg, src);
-        __ Movsd(dst, kScratchDoubleReg);
+      if (destination->IsStackSlot()) {
+        MoveConstantToRegister(kScratchRegister, src);
+        __ movq(dst, kScratchRegister);
       } else {
-        __ Movups(kScratchDoubleReg, src);
-        __ Movups(dst, kScratchDoubleReg);
+        DCHECK(destination->IsFPStackSlot());
+        if (src.type() == Constant::kFloat32) {
+          __ movl(dst, Immediate(bit_cast<uint32_t>(src.ToFloat32())));
+        } else {
+          DCHECK_EQ(src.type(), Constant::kFloat64);
+          __ movq(kScratchRegister, src.ToFloat64().AsUint64());
+          __ movq(dst, kScratchRegister);
+        }
       }
+      return;
     }
-  } else {
-    UNREACHABLE();
   }
+  UNREACHABLE();
 }
 
 
@@ -3246,88 +3457,95 @@ void CodeGenerator::AssembleSwap(InstructionOperand* source,
   X64OperandConverter g(this, nullptr);
   // Dispatch on the source and destination operand kinds.  Not all
   // combinations are possible.
-  if (source->IsRegister() && destination->IsRegister()) {
-    // Register-register.
-    Register src = g.ToRegister(source);
-    Register dst = g.ToRegister(destination);
-    __ movq(kScratchRegister, src);
-    __ movq(src, dst);
-    __ movq(dst, kScratchRegister);
-  } else if (source->IsRegister() && destination->IsStackSlot()) {
-    Register src = g.ToRegister(source);
-    __ pushq(src);
-    frame_access_state()->IncreaseSPDelta(1);
-    unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
-                                                     kPointerSize);
-    Operand dst = g.ToOperand(destination);
-    __ movq(src, dst);
-    frame_access_state()->IncreaseSPDelta(-1);
-    dst = g.ToOperand(destination);
-    __ popq(dst);
-    unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
-                                                     -kPointerSize);
-  } else if ((source->IsStackSlot() && destination->IsStackSlot()) ||
-             (source->IsFPStackSlot() && destination->IsFPStackSlot())) {
-    // Memory-memory.
-    Operand src = g.ToOperand(source);
-    Operand dst = g.ToOperand(destination);
-    MachineRepresentation rep = LocationOperand::cast(source)->representation();
-    if (rep != MachineRepresentation::kSimd128) {
-      Register tmp = kScratchRegister;
-      __ movq(tmp, dst);
-      __ pushq(src);  // Then use stack to copy src to destination.
-      unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
-                                                       kPointerSize);
-      __ popq(dst);
-      unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
-                                                       -kPointerSize);
-      __ movq(src, tmp);
-    } else {
-      // Without AVX, misaligned reads and writes will trap. Move using the
-      // stack, in two parts.
-      __ movups(kScratchDoubleReg, dst);  // Save dst in scratch register.
-      __ pushq(src);  // Then use stack to copy src to destination.
-      unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
-                                                       kPointerSize);
-      __ popq(dst);
-      unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
-                                                       -kPointerSize);
-      __ pushq(g.ToOperand(source, kPointerSize));
-      unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
-                                                       kPointerSize);
-      __ popq(g.ToOperand(destination, kPointerSize));
-      unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
-                                                       -kPointerSize);
-      __ movups(src, kScratchDoubleReg);
-    }
-  } else if (source->IsFPRegister() && destination->IsFPRegister()) {
-    // XMM register-register swap.
-    XMMRegister src = g.ToDoubleRegister(source);
-    XMMRegister dst = g.ToDoubleRegister(destination);
-    __ Movapd(kScratchDoubleReg, src);
-    __ Movapd(src, dst);
-    __ Movapd(dst, kScratchDoubleReg);
-  } else if (source->IsFPRegister() && destination->IsFPStackSlot()) {
-    // XMM register-memory swap.
-    XMMRegister src = g.ToDoubleRegister(source);
-    Operand dst = g.ToOperand(destination);
-    MachineRepresentation rep = LocationOperand::cast(source)->representation();
-    if (rep != MachineRepresentation::kSimd128) {
-      __ Movsd(kScratchDoubleReg, src);
-      __ Movsd(src, dst);
-      __ Movsd(dst, kScratchDoubleReg);
-    } else {
-      __ Movups(kScratchDoubleReg, src);
-      __ Movups(src, dst);
-      __ Movups(dst, kScratchDoubleReg);
+  switch (MoveType::InferSwap(source, destination)) {
+    case MoveType::kRegisterToRegister: {
+      if (source->IsRegister()) {
+        Register src = g.ToRegister(source);
+        Register dst = g.ToRegister(destination);
+        __ movq(kScratchRegister, src);
+        __ movq(src, dst);
+        __ movq(dst, kScratchRegister);
+      } else {
+        DCHECK(source->IsFPRegister());
+        XMMRegister src = g.ToDoubleRegister(source);
+        XMMRegister dst = g.ToDoubleRegister(destination);
+        __ Movapd(kScratchDoubleReg, src);
+        __ Movapd(src, dst);
+        __ Movapd(dst, kScratchDoubleReg);
+      }
+      return;
+    }
+    case MoveType::kRegisterToStack: {
+      if (source->IsRegister()) {
+        Register src = g.ToRegister(source);
+        __ pushq(src);
+        frame_access_state()->IncreaseSPDelta(1);
+        unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
+                                                         kPointerSize);
+        __ movq(src, g.ToOperand(destination));
+        frame_access_state()->IncreaseSPDelta(-1);
+        __ popq(g.ToOperand(destination));
+        unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
+                                                         -kPointerSize);
+      } else {
+        DCHECK(source->IsFPRegister());
+        XMMRegister src = g.ToDoubleRegister(source);
+        Operand dst = g.ToOperand(destination);
+        MachineRepresentation rep =
+            LocationOperand::cast(source)->representation();
+        if (rep != MachineRepresentation::kSimd128) {
+          __ Movsd(kScratchDoubleReg, src);
+          __ Movsd(src, dst);
+          __ Movsd(dst, kScratchDoubleReg);
+        } else {
+          __ Movups(kScratchDoubleReg, src);
+          __ Movups(src, dst);
+          __ Movups(dst, kScratchDoubleReg);
+        }
+      }
+      return;
     }
-  } else {
-    // No other combinations are possible.
-    UNREACHABLE();
+    case MoveType::kStackToStack: {
+      Operand src = g.ToOperand(source);
+      Operand dst = g.ToOperand(destination);
+      MachineRepresentation rep =
+          LocationOperand::cast(source)->representation();
+      if (rep != MachineRepresentation::kSimd128) {
+        Register tmp = kScratchRegister;
+        __ movq(tmp, dst);
+        __ pushq(src);  // Then use stack to copy src to destination.
+        unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
+                                                         kPointerSize);
+        __ popq(dst);
+        unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
+                                                         -kPointerSize);
+        __ movq(src, tmp);
+      } else {
+        // Without AVX, misaligned reads and writes will trap. Move using the
+        // stack, in two parts.
+        __ movups(kScratchDoubleReg, dst);  // Save dst in scratch register.
+        __ pushq(src);  // Then use stack to copy src to destination.
+        unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
+                                                         kPointerSize);
+        __ popq(dst);
+        unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
+                                                         -kPointerSize);
+        __ pushq(g.ToOperand(source, kPointerSize));
+        unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
+                                                         kPointerSize);
+        __ popq(g.ToOperand(destination, kPointerSize));
+        unwinding_info_writer_.MaybeIncreaseBaseOffsetAt(__ pc_offset(),
+                                                         -kPointerSize);
+        __ movups(src, kScratchDoubleReg);
+      }
+      return;
+    }
+    default:
+      UNREACHABLE();
+      break;
   }
 }
 
-
 void CodeGenerator::AssembleJumpTable(Label** targets, size_t target_count) {
   for (size_t index = 0; index < target_count; ++index) {
     __ dq(targets[index]);
diff --git a/deps/v8/src/compiler/x64/instruction-codes-x64.h b/deps/v8/src/compiler/x64/instruction-codes-x64.h
index 6d9bc6f820f..88474b24945 100644
--- a/deps/v8/src/compiler/x64/instruction-codes-x64.h
+++ b/deps/v8/src/compiler/x64/instruction-codes-x64.h
@@ -11,227 +11,266 @@ namespace compiler {
 
 // X64-specific opcodes that specify which assembly sequence to emit.
 // Most opcodes specify a single instruction.
-#define TARGET_ARCH_OPCODE_LIST(V) \
-  V(X64Add)                        \
-  V(X64Add32)                      \
-  V(X64And)                        \
-  V(X64And32)                      \
-  V(X64Cmp)                        \
-  V(X64Cmp32)                      \
-  V(X64Cmp16)                      \
-  V(X64Cmp8)                       \
-  V(X64Test)                       \
-  V(X64Test32)                     \
-  V(X64Test16)                     \
-  V(X64Test8)                      \
-  V(X64Or)                         \
-  V(X64Or32)                       \
-  V(X64Xor)                        \
-  V(X64Xor32)                      \
-  V(X64Sub)                        \
-  V(X64Sub32)                      \
-  V(X64Imul)                       \
-  V(X64Imul32)                     \
-  V(X64ImulHigh32)                 \
-  V(X64UmulHigh32)                 \
-  V(X64Idiv)                       \
-  V(X64Idiv32)                     \
-  V(X64Udiv)                       \
-  V(X64Udiv32)                     \
-  V(X64Not)                        \
-  V(X64Not32)                      \
-  V(X64Neg)                        \
-  V(X64Neg32)                      \
-  V(X64Shl)                        \
-  V(X64Shl32)                      \
-  V(X64Shr)                        \
-  V(X64Shr32)                      \
-  V(X64Sar)                        \
-  V(X64Sar32)                      \
-  V(X64Ror)                        \
-  V(X64Ror32)                      \
-  V(X64Lzcnt)                      \
-  V(X64Lzcnt32)                    \
-  V(X64Tzcnt)                      \
-  V(X64Tzcnt32)                    \
-  V(X64Popcnt)                     \
-  V(X64Popcnt32)                   \
-  V(LFence)                        \
-  V(SSEFloat32Cmp)                 \
-  V(SSEFloat32Add)                 \
-  V(SSEFloat32Sub)                 \
-  V(SSEFloat32Mul)                 \
-  V(SSEFloat32Div)                 \
-  V(SSEFloat32Abs)                 \
-  V(SSEFloat32Neg)                 \
-  V(SSEFloat32Sqrt)                \
-  V(SSEFloat32ToFloat64)           \
-  V(SSEFloat32ToInt32)             \
-  V(SSEFloat32ToUint32)            \
-  V(SSEFloat32Round)               \
-  V(SSEFloat64Cmp)                 \
-  V(SSEFloat64Add)                 \
-  V(SSEFloat64Sub)                 \
-  V(SSEFloat64Mul)                 \
-  V(SSEFloat64Div)                 \
-  V(SSEFloat64Mod)                 \
-  V(SSEFloat64Abs)                 \
-  V(SSEFloat64Neg)                 \
-  V(SSEFloat64Sqrt)                \
-  V(SSEFloat64Round)               \
-  V(SSEFloat32Max)                 \
-  V(SSEFloat64Max)                 \
-  V(SSEFloat32Min)                 \
-  V(SSEFloat64Min)                 \
-  V(SSEFloat64ToFloat32)           \
-  V(SSEFloat64ToInt32)             \
-  V(SSEFloat64ToUint32)            \
-  V(SSEFloat32ToInt64)             \
-  V(SSEFloat64ToInt64)             \
-  V(SSEFloat32ToUint64)            \
-  V(SSEFloat64ToUint64)            \
-  V(SSEInt32ToFloat64)             \
-  V(SSEInt32ToFloat32)             \
-  V(SSEInt64ToFloat32)             \
-  V(SSEInt64ToFloat64)             \
-  V(SSEUint64ToFloat32)            \
-  V(SSEUint64ToFloat64)            \
-  V(SSEUint32ToFloat64)            \
-  V(SSEUint32ToFloat32)            \
-  V(SSEFloat64ExtractLowWord32)    \
-  V(SSEFloat64ExtractHighWord32)   \
-  V(SSEFloat64InsertLowWord32)     \
-  V(SSEFloat64InsertHighWord32)    \
-  V(SSEFloat64LoadLowWord32)       \
-  V(SSEFloat64SilenceNaN)          \
-  V(AVXFloat32Cmp)                 \
-  V(AVXFloat32Add)                 \
-  V(AVXFloat32Sub)                 \
-  V(AVXFloat32Mul)                 \
-  V(AVXFloat32Div)                 \
-  V(AVXFloat64Cmp)                 \
-  V(AVXFloat64Add)                 \
-  V(AVXFloat64Sub)                 \
-  V(AVXFloat64Mul)                 \
-  V(AVXFloat64Div)                 \
-  V(AVXFloat64Abs)                 \
-  V(AVXFloat64Neg)                 \
-  V(AVXFloat32Abs)                 \
-  V(AVXFloat32Neg)                 \
-  V(X64Movsxbl)                    \
-  V(X64Movzxbl)                    \
-  V(X64Movsxbq)                    \
-  V(X64Movzxbq)                    \
-  V(X64Movb)                       \
-  V(X64Movsxwl)                    \
-  V(X64Movzxwl)                    \
-  V(X64Movsxwq)                    \
-  V(X64Movzxwq)                    \
-  V(X64Movw)                       \
-  V(X64Movl)                       \
-  V(X64Movsxlq)                    \
-  V(X64Movq)                       \
-  V(X64Movsd)                      \
-  V(X64Movss)                      \
-  V(X64Movdqu)                     \
-  V(X64BitcastFI)                  \
-  V(X64BitcastDL)                  \
-  V(X64BitcastIF)                  \
-  V(X64BitcastLD)                  \
-  V(X64Lea32)                      \
-  V(X64Lea)                        \
-  V(X64Dec32)                      \
-  V(X64Inc32)                      \
-  V(X64Push)                       \
-  V(X64Poke)                       \
-  V(X64Peek)                       \
-  V(X64StackCheck)                 \
-  V(X64F32x4Splat)                 \
-  V(X64F32x4ExtractLane)           \
-  V(X64F32x4ReplaceLane)           \
-  V(X64F32x4RecipApprox)           \
-  V(X64F32x4RecipSqrtApprox)       \
-  V(X64F32x4Add)                   \
-  V(X64F32x4Sub)                   \
-  V(X64F32x4Mul)                   \
-  V(X64F32x4Min)                   \
-  V(X64F32x4Max)                   \
-  V(X64F32x4Eq)                    \
-  V(X64F32x4Ne)                    \
-  V(X64F32x4Lt)                    \
-  V(X64F32x4Le)                    \
-  V(X64I32x4Splat)                 \
-  V(X64I32x4ExtractLane)           \
-  V(X64I32x4ReplaceLane)           \
-  V(X64I32x4Neg)                   \
-  V(X64I32x4Shl)                   \
-  V(X64I32x4ShrS)                  \
-  V(X64I32x4Add)                   \
-  V(X64I32x4AddHoriz)              \
-  V(X64I32x4Sub)                   \
-  V(X64I32x4Mul)                   \
-  V(X64I32x4MinS)                  \
-  V(X64I32x4MaxS)                  \
-  V(X64I32x4Eq)                    \
-  V(X64I32x4Ne)                    \
-  V(X64I32x4GtS)                   \
-  V(X64I32x4GeS)                   \
-  V(X64I32x4ShrU)                  \
-  V(X64I32x4MinU)                  \
-  V(X64I32x4MaxU)                  \
-  V(X64I32x4GtU)                   \
-  V(X64I32x4GeU)                   \
-  V(X64I16x8Splat)                 \
-  V(X64I16x8ExtractLane)           \
-  V(X64I16x8ReplaceLane)           \
-  V(X64I16x8Neg)                   \
-  V(X64I16x8Shl)                   \
-  V(X64I16x8ShrS)                  \
-  V(X64I16x8Add)                   \
-  V(X64I16x8AddSaturateS)          \
-  V(X64I16x8AddHoriz)              \
-  V(X64I16x8Sub)                   \
-  V(X64I16x8SubSaturateS)          \
-  V(X64I16x8Mul)                   \
-  V(X64I16x8MinS)                  \
-  V(X64I16x8MaxS)                  \
-  V(X64I16x8Eq)                    \
-  V(X64I16x8Ne)                    \
-  V(X64I16x8GtS)                   \
-  V(X64I16x8GeS)                   \
-  V(X64I16x8ShrU)                  \
-  V(X64I16x8AddSaturateU)          \
-  V(X64I16x8SubSaturateU)          \
-  V(X64I16x8MinU)                  \
-  V(X64I16x8MaxU)                  \
-  V(X64I16x8GtU)                   \
-  V(X64I16x8GeU)                   \
-  V(X64I8x16Splat)                 \
-  V(X64I8x16ExtractLane)           \
-  V(X64I8x16ReplaceLane)           \
-  V(X64I8x16Neg)                   \
-  V(X64I8x16Add)                   \
-  V(X64I8x16AddSaturateS)          \
-  V(X64I8x16Sub)                   \
-  V(X64I8x16SubSaturateS)          \
-  V(X64I8x16MinS)                  \
-  V(X64I8x16MaxS)                  \
-  V(X64I8x16Eq)                    \
-  V(X64I8x16Ne)                    \
-  V(X64I8x16GtS)                   \
-  V(X64I8x16GeS)                   \
-  V(X64I8x16AddSaturateU)          \
-  V(X64I8x16SubSaturateU)          \
-  V(X64I8x16MinU)                  \
-  V(X64I8x16MaxU)                  \
-  V(X64I8x16GtU)                   \
-  V(X64I8x16GeU)                   \
-  V(X64S128And)                    \
-  V(X64S128Or)                     \
-  V(X64S128Xor)                    \
-  V(X64S128Not)                    \
-  V(X64S128Select)                 \
-  V(X64S128Zero)
+#define TARGET_ARCH_OPCODE_LIST(V)        \
+  V(X64Add)                               \
+  V(X64Add32)                             \
+  V(X64And)                               \
+  V(X64And32)                             \
+  V(X64Cmp)                               \
+  V(X64Cmp32)                             \
+  V(X64Cmp16)                             \
+  V(X64Cmp8)                              \
+  V(X64Test)                              \
+  V(X64Test32)                            \
+  V(X64Test16)                            \
+  V(X64Test8)                             \
+  V(X64Or)                                \
+  V(X64Or32)                              \
+  V(X64Xor)                               \
+  V(X64Xor32)                             \
+  V(X64Sub)                               \
+  V(X64Sub32)                             \
+  V(X64Imul)                              \
+  V(X64Imul32)                            \
+  V(X64ImulHigh32)                        \
+  V(X64UmulHigh32)                        \
+  V(X64Idiv)                              \
+  V(X64Idiv32)                            \
+  V(X64Udiv)                              \
+  V(X64Udiv32)                            \
+  V(X64Not)                               \
+  V(X64Not32)                             \
+  V(X64Neg)                               \
+  V(X64Neg32)                             \
+  V(X64Shl)                               \
+  V(X64Shl32)                             \
+  V(X64Shr)                               \
+  V(X64Shr32)                             \
+  V(X64Sar)                               \
+  V(X64Sar32)                             \
+  V(X64Ror)                               \
+  V(X64Ror32)                             \
+  V(X64Lzcnt)                             \
+  V(X64Lzcnt32)                           \
+  V(X64Tzcnt)                             \
+  V(X64Tzcnt32)                           \
+  V(X64Popcnt)                            \
+  V(X64Popcnt32)                          \
+  V(LFence)                               \
+  V(SSEFloat32Cmp)                        \
+  V(SSEFloat32Add)                        \
+  V(SSEFloat32Sub)                        \
+  V(SSEFloat32Mul)                        \
+  V(SSEFloat32Div)                        \
+  V(SSEFloat32Abs)                        \
+  V(SSEFloat32Neg)                        \
+  V(SSEFloat32Sqrt)                       \
+  V(SSEFloat32ToFloat64)                  \
+  V(SSEFloat32ToInt32)                    \
+  V(SSEFloat32ToUint32)                   \
+  V(SSEFloat32Round)                      \
+  V(SSEFloat64Cmp)                        \
+  V(SSEFloat64Add)                        \
+  V(SSEFloat64Sub)                        \
+  V(SSEFloat64Mul)                        \
+  V(SSEFloat64Div)                        \
+  V(SSEFloat64Mod)                        \
+  V(SSEFloat64Abs)                        \
+  V(SSEFloat64Neg)                        \
+  V(SSEFloat64Sqrt)                       \
+  V(SSEFloat64Round)                      \
+  V(SSEFloat32Max)                        \
+  V(SSEFloat64Max)                        \
+  V(SSEFloat32Min)                        \
+  V(SSEFloat64Min)                        \
+  V(SSEFloat64ToFloat32)                  \
+  V(SSEFloat64ToInt32)                    \
+  V(SSEFloat64ToUint32)                   \
+  V(SSEFloat32ToInt64)                    \
+  V(SSEFloat64ToInt64)                    \
+  V(SSEFloat32ToUint64)                   \
+  V(SSEFloat64ToUint64)                   \
+  V(SSEInt32ToFloat64)                    \
+  V(SSEInt32ToFloat32)                    \
+  V(SSEInt64ToFloat32)                    \
+  V(SSEInt64ToFloat64)                    \
+  V(SSEUint64ToFloat32)                   \
+  V(SSEUint64ToFloat64)                   \
+  V(SSEUint32ToFloat64)                   \
+  V(SSEUint32ToFloat32)                   \
+  V(SSEFloat64ExtractLowWord32)           \
+  V(SSEFloat64ExtractHighWord32)          \
+  V(SSEFloat64InsertLowWord32)            \
+  V(SSEFloat64InsertHighWord32)           \
+  V(SSEFloat64LoadLowWord32)              \
+  V(SSEFloat64SilenceNaN)                 \
+  V(AVXFloat32Cmp)                        \
+  V(AVXFloat32Add)                        \
+  V(AVXFloat32Sub)                        \
+  V(AVXFloat32Mul)                        \
+  V(AVXFloat32Div)                        \
+  V(AVXFloat64Cmp)                        \
+  V(AVXFloat64Add)                        \
+  V(AVXFloat64Sub)                        \
+  V(AVXFloat64Mul)                        \
+  V(AVXFloat64Div)                        \
+  V(AVXFloat64Abs)                        \
+  V(AVXFloat64Neg)                        \
+  V(AVXFloat32Abs)                        \
+  V(AVXFloat32Neg)                        \
+  V(X64Movsxbl)                           \
+  V(X64Movzxbl)                           \
+  V(X64Movsxbq)                           \
+  V(X64Movzxbq)                           \
+  V(X64Movb)                              \
+  V(X64Movsxwl)                           \
+  V(X64Movzxwl)                           \
+  V(X64Movsxwq)                           \
+  V(X64Movzxwq)                           \
+  V(X64Movw)                              \
+  V(X64Movl)                              \
+  V(X64Movsxlq)                           \
+  V(X64Movq)                              \
+  V(X64Movsd)                             \
+  V(X64Movss)                             \
+  V(X64Movdqu)                            \
+  V(X64BitcastFI)                         \
+  V(X64BitcastDL)                         \
+  V(X64BitcastIF)                         \
+  V(X64BitcastLD)                         \
+  V(X64Lea32)                             \
+  V(X64Lea)                               \
+  V(X64Dec32)                             \
+  V(X64Inc32)                             \
+  V(X64Push)                              \
+  V(X64Poke)                              \
+  V(X64Peek)                              \
+  V(X64StackCheck)                        \
+  V(X64F32x4Splat)                        \
+  V(X64F32x4ExtractLane)                  \
+  V(X64F32x4ReplaceLane)                  \
+  V(X64F32x4Abs)                          \
+  V(X64F32x4Neg)                          \
+  V(X64F32x4RecipApprox)                  \
+  V(X64F32x4RecipSqrtApprox)              \
+  V(X64F32x4Add)                          \
+  V(X64F32x4AddHoriz)                     \
+  V(X64F32x4Sub)                          \
+  V(X64F32x4Mul)                          \
+  V(X64F32x4Min)                          \
+  V(X64F32x4Max)                          \
+  V(X64F32x4Eq)                           \
+  V(X64F32x4Ne)                           \
+  V(X64F32x4Lt)                           \
+  V(X64F32x4Le)                           \
+  V(X64I32x4Splat)                        \
+  V(X64I32x4ExtractLane)                  \
+  V(X64I32x4ReplaceLane)                  \
+  V(X64I32x4Neg)                          \
+  V(X64I32x4Shl)                          \
+  V(X64I32x4ShrS)                         \
+  V(X64I32x4Add)                          \
+  V(X64I32x4AddHoriz)                     \
+  V(X64I32x4Sub)                          \
+  V(X64I32x4Mul)                          \
+  V(X64I32x4MinS)                         \
+  V(X64I32x4MaxS)                         \
+  V(X64I32x4Eq)                           \
+  V(X64I32x4Ne)                           \
+  V(X64I32x4GtS)                          \
+  V(X64I32x4GeS)                          \
+  V(X64I32x4ShrU)                         \
+  V(X64I32x4MinU)                         \
+  V(X64I32x4MaxU)                         \
+  V(X64I32x4GtU)                          \
+  V(X64I32x4GeU)                          \
+  V(X64I16x8Splat)                        \
+  V(X64I16x8ExtractLane)                  \
+  V(X64I16x8ReplaceLane)                  \
+  V(X64I16x8Neg)                          \
+  V(X64I16x8Shl)                          \
+  V(X64I16x8ShrS)                         \
+  V(X64I16x8Add)                          \
+  V(X64I16x8AddSaturateS)                 \
+  V(X64I16x8AddHoriz)                     \
+  V(X64I16x8Sub)                          \
+  V(X64I16x8SubSaturateS)                 \
+  V(X64I16x8Mul)                          \
+  V(X64I16x8MinS)                         \
+  V(X64I16x8MaxS)                         \
+  V(X64I16x8Eq)                           \
+  V(X64I16x8Ne)                           \
+  V(X64I16x8GtS)                          \
+  V(X64I16x8GeS)                          \
+  V(X64I16x8ShrU)                         \
+  V(X64I16x8AddSaturateU)                 \
+  V(X64I16x8SubSaturateU)                 \
+  V(X64I16x8MinU)                         \
+  V(X64I16x8MaxU)                         \
+  V(X64I16x8GtU)                          \
+  V(X64I16x8GeU)                          \
+  V(X64I8x16Splat)                        \
+  V(X64I8x16ExtractLane)                  \
+  V(X64I8x16ReplaceLane)                  \
+  V(X64I8x16Neg)                          \
+  V(X64I8x16Add)                          \
+  V(X64I8x16AddSaturateS)                 \
+  V(X64I8x16Sub)                          \
+  V(X64I8x16SubSaturateS)                 \
+  V(X64I8x16MinS)                         \
+  V(X64I8x16MaxS)                         \
+  V(X64I8x16Eq)                           \
+  V(X64I8x16Ne)                           \
+  V(X64I8x16GtS)                          \
+  V(X64I8x16GeS)                          \
+  V(X64I8x16AddSaturateU)                 \
+  V(X64I8x16SubSaturateU)                 \
+  V(X64I8x16MinU)                         \
+  V(X64I8x16MaxU)                         \
+  V(X64I8x16GtU)                          \
+  V(X64I8x16GeU)                          \
+  V(X64S128And)                           \
+  V(X64S128Or)                            \
+  V(X64S128Xor)                           \
+  V(X64S128Not)                           \
+  V(X64S128Select)                        \
+  V(X64S128Zero)                          \
+  V(X64Word64AtomicLoadUint8)             \
+  V(X64Word64AtomicLoadUint16)            \
+  V(X64Word64AtomicLoadUint32)            \
+  V(X64Word64AtomicLoadUint64)            \
+  V(X64Word64AtomicStoreWord8)            \
+  V(X64Word64AtomicStoreWord16)           \
+  V(X64Word64AtomicStoreWord32)           \
+  V(X64Word64AtomicStoreWord64)           \
+  V(X64Word64AtomicAddUint8)              \
+  V(X64Word64AtomicAddUint16)             \
+  V(X64Word64AtomicAddUint32)             \
+  V(X64Word64AtomicAddUint64)             \
+  V(X64Word64AtomicSubUint8)              \
+  V(X64Word64AtomicSubUint16)             \
+  V(X64Word64AtomicSubUint32)             \
+  V(X64Word64AtomicSubUint64)             \
+  V(X64Word64AtomicAndUint8)              \
+  V(X64Word64AtomicAndUint16)             \
+  V(X64Word64AtomicAndUint32)             \
+  V(X64Word64AtomicAndUint64)             \
+  V(X64Word64AtomicOrUint8)               \
+  V(X64Word64AtomicOrUint16)              \
+  V(X64Word64AtomicOrUint32)              \
+  V(X64Word64AtomicOrUint64)              \
+  V(X64Word64AtomicXorUint8)              \
+  V(X64Word64AtomicXorUint16)             \
+  V(X64Word64AtomicXorUint32)             \
+  V(X64Word64AtomicXorUint64)             \
+  V(X64Word64AtomicExchangeUint8)         \
+  V(X64Word64AtomicExchangeUint16)        \
+  V(X64Word64AtomicExchangeUint32)        \
+  V(X64Word64AtomicExchangeUint64)        \
+  V(X64Word64AtomicCompareExchangeUint8)  \
+  V(X64Word64AtomicCompareExchangeUint16) \
+  V(X64Word64AtomicCompareExchangeUint32) \
+  V(X64Word64AtomicCompareExchangeUint64)
 
 // Addressing modes represent the "shape" of inputs to an instruction.
 // Many instructions support multiple addressing modes. Addressing modes
@@ -266,8 +305,6 @@ namespace compiler {
   V(M8I)  /* [      %r2*8 + K] */      \
   V(Root) /* [%root       + K] */
 
-enum X64MemoryProtection { kUnprotected = 0, kProtected = 1 };
-
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/x64/instruction-scheduler-x64.cc b/deps/v8/src/compiler/x64/instruction-scheduler-x64.cc
index c16fee58616..c3c0d3a2a5b 100644
--- a/deps/v8/src/compiler/x64/instruction-scheduler-x64.cc
+++ b/deps/v8/src/compiler/x64/instruction-scheduler-x64.cc
@@ -128,7 +128,10 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kX64F32x4ReplaceLane:
     case kX64F32x4RecipApprox:
     case kX64F32x4RecipSqrtApprox:
+    case kX64F32x4Abs:
+    case kX64F32x4Neg:
     case kX64F32x4Add:
+    case kX64F32x4AddHoriz:
     case kX64F32x4Sub:
     case kX64F32x4Mul:
     case kX64F32x4Min:
@@ -264,6 +267,46 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kLFence:
       return kHasSideEffect;
 
+    case kX64Word64AtomicLoadUint8:
+    case kX64Word64AtomicLoadUint16:
+    case kX64Word64AtomicLoadUint32:
+    case kX64Word64AtomicLoadUint64:
+      return kIsLoadOperation;
+
+    case kX64Word64AtomicStoreWord8:
+    case kX64Word64AtomicStoreWord16:
+    case kX64Word64AtomicStoreWord32:
+    case kX64Word64AtomicStoreWord64:
+    case kX64Word64AtomicAddUint8:
+    case kX64Word64AtomicAddUint16:
+    case kX64Word64AtomicAddUint32:
+    case kX64Word64AtomicAddUint64:
+    case kX64Word64AtomicSubUint8:
+    case kX64Word64AtomicSubUint16:
+    case kX64Word64AtomicSubUint32:
+    case kX64Word64AtomicSubUint64:
+    case kX64Word64AtomicAndUint8:
+    case kX64Word64AtomicAndUint16:
+    case kX64Word64AtomicAndUint32:
+    case kX64Word64AtomicAndUint64:
+    case kX64Word64AtomicOrUint8:
+    case kX64Word64AtomicOrUint16:
+    case kX64Word64AtomicOrUint32:
+    case kX64Word64AtomicOrUint64:
+    case kX64Word64AtomicXorUint8:
+    case kX64Word64AtomicXorUint16:
+    case kX64Word64AtomicXorUint32:
+    case kX64Word64AtomicXorUint64:
+    case kX64Word64AtomicExchangeUint8:
+    case kX64Word64AtomicExchangeUint16:
+    case kX64Word64AtomicExchangeUint32:
+    case kX64Word64AtomicExchangeUint64:
+    case kX64Word64AtomicCompareExchangeUint8:
+    case kX64Word64AtomicCompareExchangeUint16:
+    case kX64Word64AtomicCompareExchangeUint32:
+    case kX64Word64AtomicCompareExchangeUint64:
+      return kHasSideEffect;
+
 #define CASE(Name) case k##Name:
     COMMON_ARCH_OPCODE_LIST(CASE)
 #undef CASE
diff --git a/deps/v8/src/compiler/x64/instruction-selector-x64.cc b/deps/v8/src/compiler/x64/instruction-selector-x64.cc
index a0f14c687c8..db7584ccf93 100644
--- a/deps/v8/src/compiler/x64/instruction-selector-x64.cc
+++ b/deps/v8/src/compiler/x64/instruction-selector-x64.cc
@@ -25,12 +25,12 @@ class X64OperandGenerator final : public OperandGenerator {
       case IrOpcode::kRelocatableInt32Constant:
         return true;
       case IrOpcode::kInt64Constant: {
-        const int64_t value = OpParameter<int64_t>(node);
+        const int64_t value = OpParameter<int64_t>(node->op());
         return std::numeric_limits<int32_t>::min() < value &&
                value <= std::numeric_limits<int32_t>::max();
       }
       case IrOpcode::kNumberConstant: {
-        const double value = OpParameter<double>(node);
+        const double value = OpParameter<double>(node->op());
         return bit_cast<int64_t>(value) == 0;
       }
       default:
@@ -41,10 +41,10 @@ class X64OperandGenerator final : public OperandGenerator {
   int32_t GetImmediateIntegerValue(Node* node) {
     DCHECK(CanBeImmediate(node));
     if (node->opcode() == IrOpcode::kInt32Constant) {
-      return OpParameter<int32_t>(node);
+      return OpParameter<int32_t>(node->op());
     }
     DCHECK_EQ(IrOpcode::kInt64Constant, node->opcode());
-    return static_cast<int32_t>(OpParameter<int64_t>(node));
+    return static_cast<int32_t>(OpParameter<int64_t>(node->op()));
   }
 
   bool CanBeMemoryOperand(InstructionCode opcode, Node* node, Node* input,
@@ -96,10 +96,10 @@ class X64OperandGenerator final : public OperandGenerator {
     AddressingMode mode = kMode_MRI;
     if (base != nullptr && (index != nullptr || displacement != nullptr)) {
       if (base->opcode() == IrOpcode::kInt32Constant &&
-          OpParameter<int32_t>(base) == 0) {
+          OpParameter<int32_t>(base->op()) == 0) {
         base = nullptr;
       } else if (base->opcode() == IrOpcode::kInt64Constant &&
-                 OpParameter<int64_t>(base) == 0) {
+                 OpParameter<int64_t>(base->op()) == 0) {
         base = nullptr;
       }
     }
@@ -178,6 +178,17 @@ class X64OperandGenerator final : public OperandGenerator {
         }
       }
     }
+    if (operand->InputCount() == 2) {
+      Node* left = operand->InputAt(0);
+      Node* right = operand->InputAt(1);
+      if (left->opcode() == IrOpcode::kLoadRootsPointer &&
+          right->opcode() == IrOpcode::kInt64Constant) {
+        int64_t offset = OpParameter<int64_t>(right->op());
+        DCHECK(is_int32(offset));
+        inputs[(*input_count)++] = TempImmediate(static_cast<int32_t>(offset));
+        return kMode_Root;
+      }
+    }
     BaseWithIndexAndDisplacement64Matcher m(operand, AddressOption::kAllowAll);
     DCHECK(m.matches());
     if (m.displacement() == nullptr || CanBeImmediate(m.displacement())) {
@@ -307,11 +318,16 @@ void InstructionSelector::VisitLoad(Node* node) {
       g.GetEffectiveAddressMemoryOperand(node, inputs, &input_count);
   InstructionCode code = opcode | AddressingModeField::encode(mode);
   if (node->opcode() == IrOpcode::kProtectedLoad) {
-    code |= MiscField::encode(X64MemoryProtection::kProtected);
+    code |= MiscField::encode(kMemoryAccessProtected);
+  } else if (node->opcode() == IrOpcode::kPoisonedLoad) {
+    CHECK_EQ(poisoning_enabled_, PoisoningMitigationLevel::kOn);
+    code |= MiscField::encode(kMemoryAccessPoisoned);
   }
   Emit(code, 1, outputs, input_count, inputs);
 }
 
+void InstructionSelector::VisitPoisonedLoad(Node* node) { VisitLoad(node); }
+
 void InstructionSelector::VisitProtectedLoad(Node* node) { VisitLoad(node); }
 
 void InstructionSelector::VisitStore(Node* node) {
@@ -391,7 +407,7 @@ void InstructionSelector::VisitProtectedStore(Node* node) {
   AddressingMode addressing_mode =
       g.GetEffectiveAddressMemoryOperand(node, inputs, &input_count);
   InstructionCode code = opcode | AddressingModeField::encode(addressing_mode) |
-                         MiscField::encode(X64MemoryProtection::kProtected);
+                         MiscField::encode(kMemoryAccessProtected);
   InstructionOperand value_operand =
       g.CanBeImmediate(value) ? g.UseImmediate(value) : g.UseRegister(value);
   inputs[input_count++] = value_operand;
@@ -411,9 +427,9 @@ static void VisitBinop(InstructionSelector* selector, Node* node,
   Int32BinopMatcher m(node);
   Node* left = m.left().node();
   Node* right = m.right().node();
-  InstructionOperand inputs[6];
+  InstructionOperand inputs[4];
   size_t input_count = 0;
-  InstructionOperand outputs[2];
+  InstructionOperand outputs[1];
   size_t output_count = 0;
 
   // TODO(turbofan): match complex addressing modes.
@@ -460,23 +476,14 @@ static void VisitBinop(InstructionSelector* selector, Node* node,
   }
 
   outputs[output_count++] = g.DefineSameAsFirst(node);
-  if (cont->IsSet()) {
-    outputs[output_count++] = g.DefineAsRegister(cont->result());
-  }
 
   DCHECK_NE(0u, input_count);
-  DCHECK_NE(0u, output_count);
+  DCHECK_EQ(1u, output_count);
   DCHECK_GE(arraysize(inputs), input_count);
   DCHECK_GE(arraysize(outputs), output_count);
 
-  opcode = cont->Encode(opcode);
-  if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, output_count, outputs, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else {
-    selector->Emit(opcode, output_count, outputs, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, output_count, outputs, input_count,
+                                 inputs, cont);
 }
 
 
@@ -505,7 +512,6 @@ void InstructionSelector::VisitWord64And(Node* node) {
   VisitBinop(this, node, kX64And);
 }
 
-
 void InstructionSelector::VisitWord32Or(Node* node) {
   VisitBinop(this, node, kX64Or32);
 }
@@ -1139,7 +1145,8 @@ bool ZeroExtendsWord32ToWord64(Node* node) {
           return false;
       }
     }
-    case IrOpcode::kLoad: {
+    case IrOpcode::kLoad:
+    case IrOpcode::kPoisonedLoad: {
       // The movzxbl/movsxbl/movzxwl/movsxwl/movl operations implicitly
       // zero-extend to 64-bit on x64, so the zero-extension is a no-op.
       LoadRepresentation load_rep = LoadRepresentationOf(node->op());
@@ -1248,7 +1255,12 @@ void VisitFloatUnop(InstructionSelector* selector, Node* node, Node* input,
   V(BitcastInt32ToFloat32, kX64BitcastIF)                                \
   V(BitcastInt64ToFloat64, kX64BitcastLD)                                \
   V(Float64ExtractLowWord32, kSSEFloat64ExtractLowWord32)                \
-  V(Float64ExtractHighWord32, kSSEFloat64ExtractHighWord32)
+  V(Float64ExtractHighWord32, kSSEFloat64ExtractHighWord32)              \
+  V(SignExtendWord8ToInt32, kX64Movsxbl)                                 \
+  V(SignExtendWord16ToInt32, kX64Movsxwl)                                \
+  V(SignExtendWord8ToInt64, kX64Movsxbq)                                 \
+  V(SignExtendWord16ToInt64, kX64Movsxwq)                                \
+  V(SignExtendWord32ToInt64, kX64Movsxlq)
 
 #define RR_OP_LIST(V)                                                         \
   V(Float32RoundDown, kSSEFloat32Round | MiscField::encode(kRoundDown))       \
@@ -1425,14 +1437,14 @@ void InstructionSelector::VisitFloat64Ieee754Unop(Node* node,
 }
 
 void InstructionSelector::EmitPrepareArguments(
-    ZoneVector<PushParameter>* arguments, const CallDescriptor* descriptor,
+    ZoneVector<PushParameter>* arguments, const CallDescriptor* call_descriptor,
     Node* node) {
   X64OperandGenerator g(this);
 
   // Prepare for C function call.
-  if (descriptor->IsCFunctionCall()) {
-    Emit(kArchPrepareCallCFunction |
-             MiscField::encode(static_cast<int>(descriptor->ParameterCount())),
+  if (call_descriptor->IsCFunctionCall()) {
+    Emit(kArchPrepareCallCFunction | MiscField::encode(static_cast<int>(
+                                         call_descriptor->ParameterCount())),
          0, nullptr, 0, nullptr);
 
     // Poke any stack arguments.
@@ -1477,9 +1489,9 @@ void InstructionSelector::EmitPrepareArguments(
   }
 }
 
-void InstructionSelector::EmitPrepareResults(ZoneVector<PushParameter>* results,
-                                             const CallDescriptor* descriptor,
-                                             Node* node) {
+void InstructionSelector::EmitPrepareResults(
+    ZoneVector<PushParameter>* results, const CallDescriptor* call_descriptor,
+    Node* node) {
   X64OperandGenerator g(this);
 
   int reverse_slot = 0;
@@ -1488,7 +1500,7 @@ void InstructionSelector::EmitPrepareResults(ZoneVector<PushParameter>* results,
     reverse_slot += output.location.GetSizeInPointers();
     // Skip any alignment holes in nodes.
     if (output.node == nullptr) continue;
-    DCHECK(!descriptor->IsCFunctionCall());
+    DCHECK(!call_descriptor->IsCFunctionCall());
     if (output.location.GetType() == MachineType::Float32()) {
       MarkAsFloat32(output.node);
     } else if (output.location.GetType() == MachineType::Float64()) {
@@ -1513,51 +1525,20 @@ void VisitCompareWithMemoryOperand(InstructionSelector* selector,
   DCHECK_EQ(IrOpcode::kLoad, left->opcode());
   X64OperandGenerator g(selector);
   size_t input_count = 0;
-  InstructionOperand inputs[6];
+  InstructionOperand inputs[4];
   AddressingMode addressing_mode =
       g.GetEffectiveAddressMemoryOperand(left, inputs, &input_count);
   opcode |= AddressingModeField::encode(addressing_mode);
-  opcode = cont->Encode(opcode);
   inputs[input_count++] = right;
 
-  if (cont->IsBranch()) {
-    inputs[input_count++] = g.Label(cont->true_block());
-    inputs[input_count++] = g.Label(cont->false_block());
-    selector->Emit(opcode, 0, nullptr, input_count, inputs);
-  } else if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, 0, nullptr, input_count, inputs,
-                             cont->kind(), cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsSet()) {
-    InstructionOperand output = g.DefineAsRegister(cont->result());
-    selector->Emit(opcode, 1, &output, input_count, inputs);
-  } else {
-    DCHECK(cont->IsTrap());
-    inputs[input_count++] = g.UseImmediate(cont->trap_id());
-    selector->Emit(opcode, 0, nullptr, input_count, inputs);
-  }
+  selector->EmitWithContinuation(opcode, 0, nullptr, input_count, inputs, cont);
 }
 
 // Shared routine for multiple compare operations.
 void VisitCompare(InstructionSelector* selector, InstructionCode opcode,
                   InstructionOperand left, InstructionOperand right,
                   FlagsContinuation* cont) {
-  X64OperandGenerator g(selector);
-  opcode = cont->Encode(opcode);
-  if (cont->IsBranch()) {
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.Label(cont->true_block()), g.Label(cont->false_block()));
-  } else if (cont->IsDeoptimize()) {
-    selector->EmitDeoptimize(opcode, g.NoOutput(), left, right, cont->kind(),
-                             cont->reason(), cont->feedback(),
-                             cont->frame_state());
-  } else if (cont->IsSet()) {
-    selector->Emit(opcode, g.DefineAsRegister(cont->result()), left, right);
-  } else {
-    DCHECK(cont->IsTrap());
-    selector->Emit(opcode, g.NoOutput(), left, right,
-                   g.UseImmediate(cont->trap_id()));
-  }
+  selector->EmitWithContinuation(opcode, left, right, cont);
 }
 
 
@@ -1578,8 +1559,8 @@ MachineType MachineTypeForNarrow(Node* node, Node* hint_node) {
     if (node->opcode() == IrOpcode::kInt32Constant ||
         node->opcode() == IrOpcode::kInt64Constant) {
       int64_t constant = node->opcode() == IrOpcode::kInt32Constant
-                             ? OpParameter<int32_t>(node)
-                             : OpParameter<int64_t>(node);
+                             ? OpParameter<int32_t>(node->op())
+                             : OpParameter<int64_t>(node->op());
       if (hint == MachineType::Int8()) {
         if (constant >= std::numeric_limits<int8_t>::min() &&
             constant <= std::numeric_limits<int8_t>::max()) {
@@ -1733,19 +1714,8 @@ void VisitWord64Compare(InstructionSelector* selector, Node* node,
       // Compare(Load(js_stack_limit), LoadStackPointer)
       if (!node->op()->HasProperty(Operator::kCommutative)) cont->Commute();
       InstructionCode opcode = cont->Encode(kX64StackCheck);
-      if (cont->IsBranch()) {
-        selector->Emit(opcode, g.NoOutput(), g.Label(cont->true_block()),
-                       g.Label(cont->false_block()));
-      } else if (cont->IsDeoptimize()) {
-        selector->EmitDeoptimize(opcode, 0, nullptr, 0, nullptr, cont->kind(),
-                                 cont->reason(), cont->feedback(),
-                                 cont->frame_state());
-      } else if (cont->IsSet()) {
-        selector->Emit(opcode, g.DefineAsRegister(cont->result()));
-      } else {
-        DCHECK(cont->IsTrap());
-        selector->Emit(opcode, g.NoOutput(), g.UseImmediate(cont->trap_id()));
-      }
+      CHECK(cont->IsBranch());
+      selector->EmitWithContinuation(opcode, cont);
       return;
     }
   }
@@ -1782,12 +1752,13 @@ void VisitFloat64Compare(InstructionSelector* selector, Node* node,
   VisitCompare(selector, opcode, right, left, cont, false);
 }
 
+}  // namespace
+
 // Shared routine for word comparison against zero.
-void VisitWordCompareZero(InstructionSelector* selector, Node* user,
-                          Node* value, FlagsContinuation* cont) {
+void InstructionSelector::VisitWordCompareZero(Node* user, Node* value,
+                                               FlagsContinuation* cont) {
   // Try to combine with comparisons against 0 by simply inverting the branch.
-  while (value->opcode() == IrOpcode::kWord32Equal &&
-         selector->CanCover(user, value)) {
+  while (value->opcode() == IrOpcode::kWord32Equal && CanCover(user, value)) {
     Int32BinopMatcher m(value);
     if (!m.right().Is(0)) break;
 
@@ -1796,23 +1767,23 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
     cont->Negate();
   }
 
-  if (selector->CanCover(user, value)) {
+  if (CanCover(user, value)) {
     switch (value->opcode()) {
       case IrOpcode::kWord32Equal:
         cont->OverwriteAndNegateIfEqual(kEqual);
-        return VisitWordCompare(selector, value, kX64Cmp32, cont);
+        return VisitWordCompare(this, value, kX64Cmp32, cont);
       case IrOpcode::kInt32LessThan:
         cont->OverwriteAndNegateIfEqual(kSignedLessThan);
-        return VisitWordCompare(selector, value, kX64Cmp32, cont);
+        return VisitWordCompare(this, value, kX64Cmp32, cont);
       case IrOpcode::kInt32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kSignedLessThanOrEqual);
-        return VisitWordCompare(selector, value, kX64Cmp32, cont);
+        return VisitWordCompare(this, value, kX64Cmp32, cont);
       case IrOpcode::kUint32LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitWordCompare(selector, value, kX64Cmp32, cont);
+        return VisitWordCompare(this, value, kX64Cmp32, cont);
       case IrOpcode::kUint32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitWordCompare(selector, value, kX64Cmp32, cont);
+        return VisitWordCompare(this, value, kX64Cmp32, cont);
       case IrOpcode::kWord64Equal: {
         cont->OverwriteAndNegateIfEqual(kEqual);
         Int64BinopMatcher m(value);
@@ -1820,44 +1791,44 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
           // Try to combine the branch with a comparison.
           Node* const user = m.node();
           Node* const value = m.left().node();
-          if (selector->CanCover(user, value)) {
+          if (CanCover(user, value)) {
             switch (value->opcode()) {
               case IrOpcode::kInt64Sub:
-                return VisitWord64Compare(selector, value, cont);
+                return VisitWord64Compare(this, value, cont);
               case IrOpcode::kWord64And:
-                return VisitWordCompare(selector, value, kX64Test, cont);
+                return VisitWordCompare(this, value, kX64Test, cont);
               default:
                 break;
             }
           }
-          return VisitCompareZero(selector, value, kX64Cmp, cont);
+          return VisitCompareZero(this, value, kX64Cmp, cont);
         }
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       }
       case IrOpcode::kInt64LessThan:
         cont->OverwriteAndNegateIfEqual(kSignedLessThan);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kInt64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kSignedLessThanOrEqual);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kUint64LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThan);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kUint64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedLessThanOrEqual);
-        return VisitWord64Compare(selector, value, cont);
+        return VisitWord64Compare(this, value, cont);
       case IrOpcode::kFloat32Equal:
         cont->OverwriteAndNegateIfEqual(kUnorderedEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThan:
         cont->OverwriteAndNegateIfEqual(kUnsignedGreaterThan);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat32LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedGreaterThanOrEqual);
-        return VisitFloat32Compare(selector, value, cont);
+        return VisitFloat32Compare(this, value, cont);
       case IrOpcode::kFloat64Equal:
         cont->OverwriteAndNegateIfEqual(kUnorderedEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kFloat64LessThan: {
         Float64BinopMatcher m(value);
         if (m.left().Is(0.0) && m.right().IsFloat64Abs()) {
@@ -1871,16 +1842,16 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
           // avoids the costly Float64Abs.
           cont->OverwriteAndNegateIfEqual(kNotEqual);
           InstructionCode const opcode =
-              selector->IsSupported(AVX) ? kAVXFloat64Cmp : kSSEFloat64Cmp;
-          return VisitCompare(selector, opcode, m.left().node(),
+              IsSupported(AVX) ? kAVXFloat64Cmp : kSSEFloat64Cmp;
+          return VisitCompare(this, opcode, m.left().node(),
                               m.right().InputAt(0), cont, false);
         }
         cont->OverwriteAndNegateIfEqual(kUnsignedGreaterThan);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       }
       case IrOpcode::kFloat64LessThanOrEqual:
         cont->OverwriteAndNegateIfEqual(kUnsignedGreaterThanOrEqual);
-        return VisitFloat64Compare(selector, value, cont);
+        return VisitFloat64Compare(this, value, cont);
       case IrOpcode::kProjection:
         // Check if this is the overflow output projection of an
         // <Operation>WithOverflow node.
@@ -1892,23 +1863,23 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
           // *AFTER* this branch).
           Node* const node = value->InputAt(0);
           Node* const result = NodeProperties::FindProjection(node, 0);
-          if (result == nullptr || selector->IsDefined(result)) {
+          if (result == nullptr || IsDefined(result)) {
             switch (node->opcode()) {
               case IrOpcode::kInt32AddWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kX64Add32, cont);
+                return VisitBinop(this, node, kX64Add32, cont);
               case IrOpcode::kInt32SubWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kX64Sub32, cont);
+                return VisitBinop(this, node, kX64Sub32, cont);
               case IrOpcode::kInt32MulWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kX64Imul32, cont);
+                return VisitBinop(this, node, kX64Imul32, cont);
               case IrOpcode::kInt64AddWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kX64Add, cont);
+                return VisitBinop(this, node, kX64Add, cont);
               case IrOpcode::kInt64SubWithOverflow:
                 cont->OverwriteAndNegateIfEqual(kOverflow);
-                return VisitBinop(selector, node, kX64Sub, cont);
+                return VisitBinop(this, node, kX64Sub, cont);
               default:
                 break;
             }
@@ -1916,51 +1887,16 @@ void VisitWordCompareZero(InstructionSelector* selector, Node* user,
         }
         break;
       case IrOpcode::kInt32Sub:
-        return VisitWordCompare(selector, value, kX64Cmp32, cont);
+        return VisitWordCompare(this, value, kX64Cmp32, cont);
       case IrOpcode::kWord32And:
-        return VisitWordCompare(selector, value, kX64Test32, cont);
+        return VisitWordCompare(this, value, kX64Test32, cont);
       default:
         break;
     }
   }
 
   // Branch could not be combined with a compare, emit compare against 0.
-  VisitCompareZero(selector, value, kX64Cmp32, cont);
-}
-
-}  // namespace
-
-void InstructionSelector::VisitBranch(Node* branch, BasicBlock* tbranch,
-                                      BasicBlock* fbranch) {
-  FlagsContinuation cont(kNotEqual, tbranch, fbranch);
-  VisitWordCompareZero(this, branch, branch->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeIf(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kNotEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitDeoptimizeUnless(Node* node) {
-  DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapIf(Node* node, Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kNotEqual, func_id, node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
-}
-
-void InstructionSelector::VisitTrapUnless(Node* node,
-                                          Runtime::FunctionId func_id) {
-  FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kEqual, func_id, node->InputAt(1));
-  VisitWordCompareZero(this, node, node->InputAt(0), &cont);
+  VisitCompareZero(this, value, kX64Cmp32, cont);
 }
 
 void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
@@ -1968,27 +1904,30 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
   InstructionOperand value_operand = g.UseRegister(node->InputAt(0));
 
   // Emit either ArchTableSwitch or ArchLookupSwitch.
-  static const size_t kMaxTableSwitchValueRange = 2 << 16;
-  size_t table_space_cost = 4 + sw.value_range;
-  size_t table_time_cost = 3;
-  size_t lookup_space_cost = 3 + 2 * sw.case_count;
-  size_t lookup_time_cost = sw.case_count;
-  if (sw.case_count > 4 &&
-      table_space_cost + 3 * table_time_cost <=
-          lookup_space_cost + 3 * lookup_time_cost &&
-      sw.min_value > std::numeric_limits<int32_t>::min() &&
-      sw.value_range <= kMaxTableSwitchValueRange) {
-    InstructionOperand index_operand = g.TempRegister();
-    if (sw.min_value) {
-      // The leal automatically zero extends, so result is a valid 64-bit index.
-      Emit(kX64Lea32 | AddressingModeField::encode(kMode_MRI), index_operand,
-           value_operand, g.TempImmediate(-sw.min_value));
-    } else {
-      // Zero extend, because we use it as 64-bit index into the jump table.
-      Emit(kX64Movl, index_operand, value_operand);
+  if (enable_switch_jump_table_ == kEnableSwitchJumpTable) {
+    static const size_t kMaxTableSwitchValueRange = 2 << 16;
+    size_t table_space_cost = 4 + sw.value_range();
+    size_t table_time_cost = 3;
+    size_t lookup_space_cost = 3 + 2 * sw.case_count();
+    size_t lookup_time_cost = sw.case_count();
+    if (sw.case_count() > 4 &&
+        table_space_cost + 3 * table_time_cost <=
+            lookup_space_cost + 3 * lookup_time_cost &&
+        sw.min_value() > std::numeric_limits<int32_t>::min() &&
+        sw.value_range() <= kMaxTableSwitchValueRange) {
+      InstructionOperand index_operand = g.TempRegister();
+      if (sw.min_value()) {
+        // The leal automatically zero extends, so result is a valid 64-bit
+        // index.
+        Emit(kX64Lea32 | AddressingModeField::encode(kMode_MRI), index_operand,
+             value_operand, g.TempImmediate(-sw.min_value()));
+      } else {
+        // Zero extend, because we use it as 64-bit index into the jump table.
+        Emit(kX64Movl, index_operand, value_operand);
+      }
+      // Generate a table lookup.
+      return EmitTableSwitch(sw, index_operand);
     }
-    // Generate a table lookup.
-    return EmitTableSwitch(sw, index_operand);
   }
 
   // Generate a sequence of conditional jumps.
@@ -2001,7 +1940,7 @@ void InstructionSelector::VisitWord32Equal(Node* const node) {
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
   Int32BinopMatcher m(user);
   if (m.right().Is(0)) {
-    return VisitWordCompareZero(this, m.node(), m.left().node(), &cont);
+    return VisitWordCompareZero(m.node(), m.left().node(), &cont);
   }
   VisitWordCompare(this, node, kX64Cmp32, &cont);
 }
@@ -2182,7 +2121,7 @@ void InstructionSelector::VisitFloat64SilenceNaN(Node* node) {
        g.UseRegister(node->InputAt(0)));
 }
 
-void InstructionSelector::VisitAtomicLoad(Node* node) {
+void InstructionSelector::VisitWord32AtomicLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
   DCHECK(load_rep.representation() == MachineRepresentation::kWord8 ||
          load_rep.representation() == MachineRepresentation::kWord16 ||
@@ -2191,7 +2130,13 @@ void InstructionSelector::VisitAtomicLoad(Node* node) {
   VisitLoad(node);
 }
 
-void InstructionSelector::VisitAtomicStore(Node* node) {
+void InstructionSelector::VisitWord64AtomicLoad(Node* node) {
+  LoadRepresentation load_rep = LoadRepresentationOf(node->op());
+  USE(load_rep);
+  VisitLoad(node);
+}
+
+void InstructionSelector::VisitWord32AtomicStore(Node* node) {
   X64OperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -2201,13 +2146,13 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
   ArchOpcode opcode = kArchNop;
   switch (rep) {
     case MachineRepresentation::kWord8:
-      opcode = kAtomicExchangeInt8;
+      opcode = kWord32AtomicExchangeInt8;
       break;
     case MachineRepresentation::kWord16:
-      opcode = kAtomicExchangeInt16;
+      opcode = kWord32AtomicExchangeInt16;
       break;
     case MachineRepresentation::kWord32:
-      opcode = kAtomicExchangeWord32;
+      opcode = kWord32AtomicExchangeWord32;
       break;
     default:
       UNREACHABLE();
@@ -2229,7 +2174,49 @@ void InstructionSelector::VisitAtomicStore(Node* node) {
   Emit(code, 0, static_cast<InstructionOperand*>(nullptr), input_count, inputs);
 }
 
-void InstructionSelector::VisitAtomicExchange(Node* node) {
+void InstructionSelector::VisitWord64AtomicStore(Node* node) {
+  X64OperandGenerator g(this);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* value = node->InputAt(2);
+
+  MachineRepresentation rep = AtomicStoreRepresentationOf(node->op());
+  ArchOpcode opcode = kArchNop;
+  switch (rep) {
+    case MachineRepresentation::kWord8:
+      opcode = kX64Word64AtomicExchangeUint8;
+      break;
+    case MachineRepresentation::kWord16:
+      opcode = kX64Word64AtomicExchangeUint16;
+      break;
+    case MachineRepresentation::kWord32:
+      opcode = kX64Word64AtomicExchangeUint32;
+      break;
+    case MachineRepresentation::kWord64:
+      opcode = kX64Word64AtomicExchangeUint64;
+      break;
+    default:
+      UNREACHABLE();
+      return;
+  }
+  AddressingMode addressing_mode;
+  InstructionOperand inputs[4];
+  size_t input_count = 0;
+  inputs[input_count++] = g.UseUniqueRegister(value);
+  inputs[input_count++] = g.UseUniqueRegister(base);
+  if (g.CanBeImmediate(index)) {
+    inputs[input_count++] = g.UseImmediate(index);
+    addressing_mode = kMode_MRI;
+  } else {
+    inputs[input_count++] = g.UseUniqueRegister(index);
+    addressing_mode = kMode_MR1;
+  }
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+  DCHECK_LE(input_count, arraysize(inputs));
+  Emit(code, 0, static_cast<InstructionOperand*>(nullptr), input_count, inputs);
+}
+
+void InstructionSelector::VisitWord32AtomicExchange(Node* node) {
   X64OperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -2238,15 +2225,15 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   MachineType type = AtomicOpRepresentationOf(node->op());
   ArchOpcode opcode = kArchNop;
   if (type == MachineType::Int8()) {
-    opcode = kAtomicExchangeInt8;
+    opcode = kWord32AtomicExchangeInt8;
   } else if (type == MachineType::Uint8()) {
-    opcode = kAtomicExchangeUint8;
+    opcode = kWord32AtomicExchangeUint8;
   } else if (type == MachineType::Int16()) {
-    opcode = kAtomicExchangeInt16;
+    opcode = kWord32AtomicExchangeInt16;
   } else if (type == MachineType::Uint16()) {
-    opcode = kAtomicExchangeUint16;
+    opcode = kWord32AtomicExchangeUint16;
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
-    opcode = kAtomicExchangeWord32;
+    opcode = kWord32AtomicExchangeWord32;
   } else {
     UNREACHABLE();
     return;
@@ -2269,7 +2256,45 @@ void InstructionSelector::VisitAtomicExchange(Node* node) {
   Emit(code, 1, outputs, input_count, inputs);
 }
 
-void InstructionSelector::VisitAtomicCompareExchange(Node* node) {
+void InstructionSelector::VisitWord64AtomicExchange(Node* node) {
+  X64OperandGenerator g(this);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* value = node->InputAt(2);
+
+  MachineType type = AtomicOpRepresentationOf(node->op());
+  ArchOpcode opcode = kArchNop;
+  if (type == MachineType::Uint8()) {
+    opcode = kX64Word64AtomicExchangeUint8;
+  } else if (type == MachineType::Uint16()) {
+    opcode = kX64Word64AtomicExchangeUint16;
+  } else if (type == MachineType::Uint32()) {
+    opcode = kX64Word64AtomicExchangeUint32;
+  } else if (type == MachineType::Uint64()) {
+    opcode = kX64Word64AtomicExchangeUint64;
+  } else {
+    UNREACHABLE();
+    return;
+  }
+  InstructionOperand outputs[1];
+  AddressingMode addressing_mode;
+  InstructionOperand inputs[3];
+  size_t input_count = 0;
+  inputs[input_count++] = g.UseUniqueRegister(value);
+  inputs[input_count++] = g.UseUniqueRegister(base);
+  if (g.CanBeImmediate(index)) {
+    inputs[input_count++] = g.UseImmediate(index);
+    addressing_mode = kMode_MRI;
+  } else {
+    inputs[input_count++] = g.UseUniqueRegister(index);
+    addressing_mode = kMode_MR1;
+  }
+  outputs[0] = g.DefineSameAsFirst(node);
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+  Emit(code, 1, outputs, input_count, inputs);
+}
+
+void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
   X64OperandGenerator g(this);
   Node* base = node->InputAt(0);
   Node* index = node->InputAt(1);
@@ -2279,15 +2304,55 @@ void InstructionSelector::VisitAtomicCompareExchange(Node* node) {
   MachineType type = AtomicOpRepresentationOf(node->op());
   ArchOpcode opcode = kArchNop;
   if (type == MachineType::Int8()) {
-    opcode = kAtomicCompareExchangeInt8;
+    opcode = kWord32AtomicCompareExchangeInt8;
   } else if (type == MachineType::Uint8()) {
-    opcode = kAtomicCompareExchangeUint8;
+    opcode = kWord32AtomicCompareExchangeUint8;
   } else if (type == MachineType::Int16()) {
-    opcode = kAtomicCompareExchangeInt16;
+    opcode = kWord32AtomicCompareExchangeInt16;
   } else if (type == MachineType::Uint16()) {
-    opcode = kAtomicCompareExchangeUint16;
+    opcode = kWord32AtomicCompareExchangeUint16;
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
-    opcode = kAtomicCompareExchangeWord32;
+    opcode = kWord32AtomicCompareExchangeWord32;
+  } else {
+    UNREACHABLE();
+    return;
+  }
+  InstructionOperand outputs[1];
+  AddressingMode addressing_mode;
+  InstructionOperand inputs[4];
+  size_t input_count = 0;
+  inputs[input_count++] = g.UseFixed(old_value, rax);
+  inputs[input_count++] = g.UseUniqueRegister(new_value);
+  inputs[input_count++] = g.UseUniqueRegister(base);
+  if (g.CanBeImmediate(index)) {
+    inputs[input_count++] = g.UseImmediate(index);
+    addressing_mode = kMode_MRI;
+  } else {
+    inputs[input_count++] = g.UseUniqueRegister(index);
+    addressing_mode = kMode_MR1;
+  }
+  outputs[0] = g.DefineAsFixed(node, rax);
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+  Emit(code, 1, outputs, input_count, inputs);
+}
+
+void InstructionSelector::VisitWord64AtomicCompareExchange(Node* node) {
+  X64OperandGenerator g(this);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* old_value = node->InputAt(2);
+  Node* new_value = node->InputAt(3);
+
+  MachineType type = AtomicOpRepresentationOf(node->op());
+  ArchOpcode opcode = kArchNop;
+  if (type == MachineType::Uint8()) {
+    opcode = kX64Word64AtomicCompareExchangeUint8;
+  } else if (type == MachineType::Uint16()) {
+    opcode = kX64Word64AtomicCompareExchangeUint16;
+  } else if (type == MachineType::Uint32()) {
+    opcode = kX64Word64AtomicCompareExchangeUint32;
+  } else if (type == MachineType::Uint64()) {
+    opcode = kX64Word64AtomicCompareExchangeUint64;
   } else {
     UNREACHABLE();
     return;
@@ -2355,11 +2420,67 @@ void InstructionSelector::VisitAtomicBinaryOperation(
   Emit(code, 1, outputs, input_count, inputs, 1, temp);
 }
 
-#define VISIT_ATOMIC_BINOP(op)                                              \
-  void InstructionSelector::VisitAtomic##op(Node* node) {                   \
-    VisitAtomicBinaryOperation(node, kAtomic##op##Int8, kAtomic##op##Uint8, \
-                               kAtomic##op##Int16, kAtomic##op##Uint16,     \
-                               kAtomic##op##Word32);                        \
+#define VISIT_ATOMIC_BINOP(op)                                   \
+  void InstructionSelector::VisitWord32Atomic##op(Node* node) {  \
+    VisitAtomicBinaryOperation(                                  \
+        node, kWord32Atomic##op##Int8, kWord32Atomic##op##Uint8, \
+        kWord32Atomic##op##Int16, kWord32Atomic##op##Uint16,     \
+        kWord32Atomic##op##Word32);                              \
+  }
+VISIT_ATOMIC_BINOP(Add)
+VISIT_ATOMIC_BINOP(Sub)
+VISIT_ATOMIC_BINOP(And)
+VISIT_ATOMIC_BINOP(Or)
+VISIT_ATOMIC_BINOP(Xor)
+#undef VISIT_ATOMIC_BINOP
+
+void InstructionSelector::VisitWord64AtomicBinaryOperation(
+    Node* node, ArchOpcode uint8_op, ArchOpcode uint16_op, ArchOpcode uint32_op,
+    ArchOpcode word64_op) {
+  X64OperandGenerator g(this);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* value = node->InputAt(2);
+
+  MachineType type = AtomicOpRepresentationOf(node->op());
+  ArchOpcode opcode = kArchNop;
+  if (type == MachineType::Uint8()) {
+    opcode = uint8_op;
+  } else if (type == MachineType::Uint16()) {
+    opcode = uint16_op;
+  } else if (type == MachineType::Uint32()) {
+    opcode = uint32_op;
+  } else if (type == MachineType::Uint64()) {
+    opcode = word64_op;
+  } else {
+    UNREACHABLE();
+    return;
+  }
+  InstructionOperand outputs[1];
+  AddressingMode addressing_mode;
+  InstructionOperand inputs[3];
+  size_t input_count = 0;
+  inputs[input_count++] = g.UseUniqueRegister(value);
+  inputs[input_count++] = g.UseUniqueRegister(base);
+  if (g.CanBeImmediate(index)) {
+    inputs[input_count++] = g.UseImmediate(index);
+    addressing_mode = kMode_MRI;
+  } else {
+    inputs[input_count++] = g.UseUniqueRegister(index);
+    addressing_mode = kMode_MR1;
+  }
+  outputs[0] = g.DefineAsFixed(node, rax);
+  InstructionOperand temp[1];
+  temp[0] = g.TempRegister();
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+  Emit(code, 1, outputs, input_count, inputs, 1, temp);
+}
+
+#define VISIT_ATOMIC_BINOP(op)                                           \
+  void InstructionSelector::VisitWord64Atomic##op(Node* node) {          \
+    VisitWord64AtomicBinaryOperation(                                    \
+        node, kX64Word64Atomic##op##Uint8, kX64Word64Atomic##op##Uint16, \
+        kX64Word64Atomic##op##Uint32, kX64Word64Atomic##op##Uint64);     \
   }
 VISIT_ATOMIC_BINOP(Add)
 VISIT_ATOMIC_BINOP(Sub)
@@ -2376,6 +2497,7 @@ VISIT_ATOMIC_BINOP(Xor)
 
 #define SIMD_BINOP_LIST(V) \
   V(F32x4Add)              \
+  V(F32x4AddHoriz)         \
   V(F32x4Sub)              \
   V(F32x4Mul)              \
   V(F32x4Min)              \
@@ -2437,6 +2559,8 @@ VISIT_ATOMIC_BINOP(Xor)
   V(S128Xor)
 
 #define SIMD_UNOP_LIST(V) \
+  V(F32x4Abs)             \
+  V(F32x4Neg)             \
   V(F32x4RecipApprox)     \
   V(F32x4RecipSqrtApprox) \
   V(I32x4Neg)             \
@@ -2469,7 +2593,7 @@ SIMD_TYPES(VISIT_SIMD_SPLAT)
 #define VISIT_SIMD_EXTRACT_LANE(Type)                              \
   void InstructionSelector::Visit##Type##ExtractLane(Node* node) { \
     X64OperandGenerator g(this);                                   \
-    int32_t lane = OpParameter<int32_t>(node);                     \
+    int32_t lane = OpParameter<int32_t>(node->op());               \
     Emit(kX64##Type##ExtractLane, g.DefineAsRegister(node),        \
          g.UseRegister(node->InputAt(0)), g.UseImmediate(lane));   \
   }
@@ -2479,7 +2603,7 @@ SIMD_TYPES(VISIT_SIMD_EXTRACT_LANE)
 #define VISIT_SIMD_REPLACE_LANE(Type)                              \
   void InstructionSelector::Visit##Type##ReplaceLane(Node* node) { \
     X64OperandGenerator g(this);                                   \
-    int32_t lane = OpParameter<int32_t>(node);                     \
+    int32_t lane = OpParameter<int32_t>(node->op());               \
     Emit(kX64##Type##ReplaceLane, g.DefineSameAsFirst(node),       \
          g.UseRegister(node->InputAt(0)), g.UseImmediate(lane),    \
          g.Use(node->InputAt(1)));                                 \
@@ -2490,7 +2614,7 @@ SIMD_TYPES(VISIT_SIMD_REPLACE_LANE)
 #define VISIT_SIMD_SHIFT(Opcode)                                  \
   void InstructionSelector::Visit##Opcode(Node* node) {           \
     X64OperandGenerator g(this);                                  \
-    int32_t value = OpParameter<int32_t>(node);                   \
+    int32_t value = OpParameter<int32_t>(node->op());             \
     Emit(kX64##Opcode, g.DefineSameAsFirst(node),                 \
          g.UseRegister(node->InputAt(0)), g.UseImmediate(value)); \
   }
diff --git a/deps/v8/src/compiler/x64/unwinding-info-writer-x64.h b/deps/v8/src/compiler/x64/unwinding-info-writer-x64.h
index 8bb5903e54b..e1c6000d4ff 100644
--- a/deps/v8/src/compiler/x64/unwinding-info-writer-x64.h
+++ b/deps/v8/src/compiler/x64/unwinding-info-writer-x64.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_COMPILER_X64_UNWINDING_INFO_WRITER_H_
-#define V8_COMPILER_X64_UNWINDING_INFO_WRITER_H_
+#ifndef V8_COMPILER_X64_UNWINDING_INFO_WRITER_X64_H_
+#define V8_COMPILER_X64_UNWINDING_INFO_WRITER_X64_H_
 
 #include "src/eh-frame.h"
 
@@ -76,4 +76,4 @@ class UnwindingInfoWriter {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_COMPILER_X64_UNWINDING_INFO_WRITER_X64_H_
diff --git a/deps/v8/src/contexts-inl.h b/deps/v8/src/contexts-inl.h
index 22e3606e98a..3ff737e5f4e 100644
--- a/deps/v8/src/contexts-inl.h
+++ b/deps/v8/src/contexts-inl.h
@@ -80,48 +80,39 @@ void Context::set_native_context(Context* context) {
 }
 
 bool Context::IsNativeContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->native_context_map();
+  return map()->instance_type() == NATIVE_CONTEXT_TYPE;
 }
 
 bool Context::IsFunctionContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->function_context_map();
+  return map()->instance_type() == FUNCTION_CONTEXT_TYPE;
 }
 
 bool Context::IsCatchContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->catch_context_map();
+  return map()->instance_type() == CATCH_CONTEXT_TYPE;
 }
 
 bool Context::IsWithContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->with_context_map();
+  return map()->instance_type() == WITH_CONTEXT_TYPE;
 }
 
 bool Context::IsDebugEvaluateContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->debug_evaluate_context_map();
+  return map()->instance_type() == DEBUG_EVALUATE_CONTEXT_TYPE;
 }
 
 bool Context::IsBlockContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->block_context_map();
+  return map()->instance_type() == BLOCK_CONTEXT_TYPE;
 }
 
 bool Context::IsModuleContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->module_context_map();
+  return map()->instance_type() == MODULE_CONTEXT_TYPE;
 }
 
 bool Context::IsEvalContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->eval_context_map();
+  return map()->instance_type() == EVAL_CONTEXT_TYPE;
 }
 
 bool Context::IsScriptContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->script_context_map();
+  return map()->instance_type() == SCRIPT_CONTEXT_TYPE;
 }
 
 bool Context::HasSameSecurityTokenAs(Context* that) const {
diff --git a/deps/v8/src/contexts.h b/deps/v8/src/contexts.h
index c1bca7557ee..bb55d91c9ce 100644
--- a/deps/v8/src/contexts.h
+++ b/deps/v8/src/contexts.h
@@ -32,70 +32,48 @@ enum ContextLookupFlags {
 // must always be allocated via Heap::AllocateContext() or
 // Factory::NewContext.
 
-#define NATIVE_CONTEXT_INTRINSIC_FUNCTIONS(V)                               \
-  V(ASYNC_FUNCTION_AWAIT_CAUGHT_INDEX, JSFunction,                          \
-    async_function_await_caught)                                            \
-  V(ASYNC_FUNCTION_AWAIT_UNCAUGHT_INDEX, JSFunction,                        \
-    async_function_await_uncaught)                                          \
-  V(ASYNC_FUNCTION_PROMISE_CREATE_INDEX, JSFunction,                        \
-    async_function_promise_create)                                          \
-  V(ASYNC_FUNCTION_PROMISE_RELEASE_INDEX, JSFunction,                       \
-    async_function_promise_release)                                         \
-  V(IS_ARRAYLIKE, JSFunction, is_arraylike)                                 \
-  V(GENERATOR_NEXT_INTERNAL, JSFunction, generator_next_internal)           \
-  V(MAKE_ERROR_INDEX, JSFunction, make_error)                               \
-  V(MAKE_RANGE_ERROR_INDEX, JSFunction, make_range_error)                   \
-  V(MAKE_SYNTAX_ERROR_INDEX, JSFunction, make_syntax_error)                 \
-  V(MAKE_TYPE_ERROR_INDEX, JSFunction, make_type_error)                     \
-  V(MAKE_URI_ERROR_INDEX, JSFunction, make_uri_error)                       \
-  V(OBJECT_CREATE, JSFunction, object_create)                               \
-  V(OBJECT_DEFINE_PROPERTIES, JSFunction, object_define_properties)         \
-  V(OBJECT_DEFINE_PROPERTY, JSFunction, object_define_property)             \
-  V(OBJECT_GET_PROTOTYPE_OF, JSFunction, object_get_prototype_of)           \
-  V(OBJECT_IS_EXTENSIBLE, JSFunction, object_is_extensible)                 \
-  V(OBJECT_IS_FROZEN, JSFunction, object_is_frozen)                         \
-  V(OBJECT_IS_SEALED, JSFunction, object_is_sealed)                         \
-  V(OBJECT_KEYS, JSFunction, object_keys)                                   \
-  V(REGEXP_INTERNAL_MATCH, JSFunction, regexp_internal_match)               \
-  V(REFLECT_APPLY_INDEX, JSFunction, reflect_apply)                         \
-  V(REFLECT_CONSTRUCT_INDEX, JSFunction, reflect_construct)                 \
-  V(REFLECT_DEFINE_PROPERTY_INDEX, JSFunction, reflect_define_property)     \
-  V(REFLECT_DELETE_PROPERTY_INDEX, JSFunction, reflect_delete_property)     \
-  V(SPREAD_ARGUMENTS_INDEX, JSFunction, spread_arguments)                   \
-  V(SPREAD_ITERABLE_INDEX, JSFunction, spread_iterable)                     \
-  V(TYPED_ARRAY_CONSTRUCT_BY_ARRAY_BUFFER_INDEX, JSFunction,                \
-    typed_array_construct_by_array_buffer)                                  \
-  V(TYPED_ARRAY_CONSTRUCT_BY_ARRAY_LIKE_INDEX, JSFunction,                  \
-    typed_array_construct_by_array_like)                                    \
-  V(TYPED_ARRAY_CONSTRUCT_BY_LENGTH_INDEX, JSFunction,                      \
-    typed_array_construct_by_length)                                        \
-  V(MATH_FLOOR_INDEX, JSFunction, math_floor)                               \
-  V(MATH_POW_INDEX, JSFunction, math_pow)                                   \
-  V(NEW_PROMISE_CAPABILITY_INDEX, JSFunction, new_promise_capability)       \
-  V(PROMISE_INTERNAL_CONSTRUCTOR_INDEX, JSFunction,                         \
-    promise_internal_constructor)                                           \
-  V(PROMISE_INTERNAL_REJECT_INDEX, JSFunction, promise_internal_reject)     \
-  V(IS_PROMISE_INDEX, JSFunction, is_promise)                               \
-  V(PROMISE_RESOLVE_INDEX, JSFunction, promise_resolve)                     \
-  V(PROMISE_THEN_INDEX, JSFunction, promise_then)                           \
-  V(PROMISE_HANDLE_INDEX, JSFunction, promise_handle)                       \
-  V(PROMISE_HANDLE_REJECT_INDEX, JSFunction, promise_handle_reject)         \
-  V(ASYNC_GENERATOR_AWAIT_CAUGHT, JSFunction, async_generator_await_caught) \
-  V(ASYNC_GENERATOR_AWAIT_UNCAUGHT, JSFunction, async_generator_await_uncaught)
+#define NATIVE_CONTEXT_INTRINSIC_FUNCTIONS(V)                           \
+  V(ASYNC_FUNCTION_PROMISE_CREATE_INDEX, JSFunction,                    \
+    async_function_promise_create)                                      \
+  V(ASYNC_FUNCTION_PROMISE_RELEASE_INDEX, JSFunction,                   \
+    async_function_promise_release)                                     \
+  V(IS_ARRAYLIKE, JSFunction, is_arraylike)                             \
+  V(GENERATOR_NEXT_INTERNAL, JSFunction, generator_next_internal)       \
+  V(MAKE_ERROR_INDEX, JSFunction, make_error)                           \
+  V(MAKE_RANGE_ERROR_INDEX, JSFunction, make_range_error)               \
+  V(MAKE_SYNTAX_ERROR_INDEX, JSFunction, make_syntax_error)             \
+  V(MAKE_TYPE_ERROR_INDEX, JSFunction, make_type_error)                 \
+  V(MAKE_URI_ERROR_INDEX, JSFunction, make_uri_error)                   \
+  V(OBJECT_CREATE, JSFunction, object_create)                           \
+  V(OBJECT_DEFINE_PROPERTIES, JSFunction, object_define_properties)     \
+  V(OBJECT_DEFINE_PROPERTY, JSFunction, object_define_property)         \
+  V(OBJECT_GET_PROTOTYPE_OF, JSFunction, object_get_prototype_of)       \
+  V(OBJECT_IS_EXTENSIBLE, JSFunction, object_is_extensible)             \
+  V(OBJECT_IS_FROZEN, JSFunction, object_is_frozen)                     \
+  V(OBJECT_IS_SEALED, JSFunction, object_is_sealed)                     \
+  V(OBJECT_KEYS, JSFunction, object_keys)                               \
+  V(REGEXP_INTERNAL_MATCH, JSFunction, regexp_internal_match)           \
+  V(REFLECT_APPLY_INDEX, JSFunction, reflect_apply)                     \
+  V(REFLECT_CONSTRUCT_INDEX, JSFunction, reflect_construct)             \
+  V(REFLECT_DEFINE_PROPERTY_INDEX, JSFunction, reflect_define_property) \
+  V(REFLECT_DELETE_PROPERTY_INDEX, JSFunction, reflect_delete_property) \
+  V(MATH_FLOOR_INDEX, JSFunction, math_floor)                           \
+  V(MATH_POW_INDEX, JSFunction, math_pow)                               \
+  V(PROMISE_INTERNAL_CONSTRUCTOR_INDEX, JSFunction,                     \
+    promise_internal_constructor)                                       \
+  V(IS_PROMISE_INDEX, JSFunction, is_promise)                           \
+  V(PROMISE_THEN_INDEX, JSFunction, promise_then)
 
 #define NATIVE_CONTEXT_IMPORTED_FIELDS(V)                                 \
-  V(ARRAY_CONCAT_INDEX, JSFunction, array_concat)                         \
   V(ARRAY_POP_INDEX, JSFunction, array_pop)                               \
   V(ARRAY_PUSH_INDEX, JSFunction, array_push)                             \
   V(ARRAY_SHIFT_INDEX, JSFunction, array_shift)                           \
   V(ARRAY_SPLICE_INDEX, JSFunction, array_splice)                         \
-  V(ARRAY_SLICE_INDEX, JSFunction, array_slice)                           \
   V(ARRAY_UNSHIFT_INDEX, JSFunction, array_unshift)                       \
   V(ARRAY_ENTRIES_ITERATOR_INDEX, JSFunction, array_entries_iterator)     \
   V(ARRAY_FOR_EACH_ITERATOR_INDEX, JSFunction, array_for_each_iterator)   \
   V(ARRAY_KEYS_ITERATOR_INDEX, JSFunction, array_keys_iterator)           \
   V(ARRAY_VALUES_ITERATOR_INDEX, JSFunction, array_values_iterator)       \
-  V(DERIVED_GET_TRAP_INDEX, JSFunction, derived_get_trap)                 \
   V(ERROR_FUNCTION_INDEX, JSFunction, error_function)                     \
   V(ERROR_TO_STRING, JSFunction, error_to_string)                         \
   V(EVAL_ERROR_FUNCTION_INDEX, JSFunction, eval_error_function)           \
@@ -121,74 +99,10 @@ enum ContextLookupFlags {
   V(WASM_COMPILE_ERROR_FUNCTION_INDEX, JSFunction,                        \
     wasm_compile_error_function)                                          \
   V(WASM_LINK_ERROR_FUNCTION_INDEX, JSFunction, wasm_link_error_function) \
-  V(WASM_RUNTIME_ERROR_FUNCTION_INDEX, JSFunction, wasm_runtime_error_function)
-
-#define NATIVE_CONTEXT_JS_ARRAY_ITERATOR_MAPS(V)                               \
-  V(TYPED_ARRAY_KEY_ITERATOR_MAP_INDEX, Map, typed_array_key_iterator_map)     \
-  V(FAST_ARRAY_KEY_ITERATOR_MAP_INDEX, Map, fast_array_key_iterator_map)       \
-  V(GENERIC_ARRAY_KEY_ITERATOR_MAP_INDEX, Map, array_key_iterator_map)         \
-                                                                               \
-  V(UINT8_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                             \
-    uint8_array_key_value_iterator_map)                                        \
-  V(INT8_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                              \
-    int8_array_key_value_iterator_map)                                         \
-  V(UINT16_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                            \
-    uint16_array_key_value_iterator_map)                                       \
-  V(INT16_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                             \
-    int16_array_key_value_iterator_map)                                        \
-  V(UINT32_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                            \
-    uint32_array_key_value_iterator_map)                                       \
-  V(INT32_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                             \
-    int32_array_key_value_iterator_map)                                        \
-  V(FLOAT32_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                           \
-    float32_array_key_value_iterator_map)                                      \
-  V(FLOAT64_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                           \
-    float64_array_key_value_iterator_map)                                      \
-  V(UINT8_CLAMPED_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                     \
-    uint8_clamped_array_key_value_iterator_map)                                \
-                                                                               \
-  V(FAST_SMI_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                          \
-    fast_smi_array_key_value_iterator_map)                                     \
-  V(FAST_HOLEY_SMI_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                    \
-    fast_holey_smi_array_key_value_iterator_map)                               \
-  V(FAST_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                              \
-    fast_array_key_value_iterator_map)                                         \
-  V(FAST_HOLEY_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                        \
-    fast_holey_array_key_value_iterator_map)                                   \
-  V(FAST_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                       \
-    fast_double_array_key_value_iterator_map)                                  \
-  V(FAST_HOLEY_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                 \
-    fast_holey_double_array_key_value_iterator_map)                            \
-  V(GENERIC_ARRAY_KEY_VALUE_ITERATOR_MAP_INDEX, Map,                           \
-    array_key_value_iterator_map)                                              \
-                                                                               \
-  V(UINT8_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map, uint8_array_value_iterator_map) \
-  V(INT8_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map, int8_array_value_iterator_map)   \
-  V(UINT16_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map,                                \
-    uint16_array_value_iterator_map)                                           \
-  V(INT16_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map, int16_array_value_iterator_map) \
-  V(UINT32_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map,                                \
-    uint32_array_value_iterator_map)                                           \
-  V(INT32_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map, int32_array_value_iterator_map) \
-  V(FLOAT32_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map,                               \
-    float32_array_value_iterator_map)                                          \
-  V(FLOAT64_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map,                               \
-    float64_array_value_iterator_map)                                          \
-  V(UINT8_CLAMPED_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map,                         \
-    uint8_clamped_array_value_iterator_map)                                    \
-                                                                               \
-  V(FAST_SMI_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map,                              \
-    fast_smi_array_value_iterator_map)                                         \
-  V(FAST_HOLEY_SMI_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map,                        \
-    fast_holey_smi_array_value_iterator_map)                                   \
-  V(FAST_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map, fast_array_value_iterator_map)   \
-  V(FAST_HOLEY_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map,                            \
-    fast_holey_array_value_iterator_map)                                       \
-  V(FAST_DOUBLE_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map,                           \
-    fast_double_array_value_iterator_map)                                      \
-  V(FAST_HOLEY_DOUBLE_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map,                     \
-    fast_holey_double_array_value_iterator_map)                                \
-  V(GENERIC_ARRAY_VALUE_ITERATOR_MAP_INDEX, Map, array_value_iterator_map)
+  V(WASM_RUNTIME_ERROR_FUNCTION_INDEX, JSFunction,                        \
+    wasm_runtime_error_function)                                          \
+  V(WEAKMAP_SET_INDEX, JSFunction, weakmap_set)                           \
+  V(WEAKSET_ADD_INDEX, JSFunction, weakset_add)
 
 #define NATIVE_CONTEXT_FIELDS(V)                                               \
   V(GLOBAL_PROXY_INDEX, JSObject, global_proxy_object)                         \
@@ -197,35 +111,20 @@ enum ContextLookupFlags {
   V(ACCESSOR_PROPERTY_DESCRIPTOR_MAP_INDEX, Map,                               \
     accessor_property_descriptor_map)                                          \
   V(ALLOW_CODE_GEN_FROM_STRINGS_INDEX, Object, allow_code_gen_from_strings)    \
-  V(ALLOW_WASM_EVAL_INDEX, Object, allow_wasm_eval)                            \
   V(ARRAY_BUFFER_FUN_INDEX, JSFunction, array_buffer_fun)                      \
   V(ARRAY_BUFFER_MAP_INDEX, Map, array_buffer_map)                             \
   V(ARRAY_BUFFER_NOINIT_FUN_INDEX, JSFunction, array_buffer_noinit_fun)        \
   V(ARRAY_FUNCTION_INDEX, JSFunction, array_function)                          \
   V(ASYNC_FROM_SYNC_ITERATOR_MAP_INDEX, Map, async_from_sync_iterator_map)     \
-  V(ASYNC_FUNCTION_AWAIT_REJECT_SHARED_FUN, SharedFunctionInfo,                \
-    async_function_await_reject_shared_fun)                                    \
-  V(ASYNC_FUNCTION_AWAIT_RESOLVE_SHARED_FUN, SharedFunctionInfo,               \
-    async_function_await_resolve_shared_fun)                                   \
   V(ASYNC_FUNCTION_FUNCTION_INDEX, JSFunction, async_function_constructor)     \
   V(ASYNC_GENERATOR_FUNCTION_FUNCTION_INDEX, JSFunction,                       \
     async_generator_function_function)                                         \
   V(ASYNC_ITERATOR_VALUE_UNWRAP_SHARED_FUN, SharedFunctionInfo,                \
     async_iterator_value_unwrap_shared_fun)                                    \
-  V(ASYNC_GENERATOR_AWAIT_REJECT_SHARED_FUN, SharedFunctionInfo,               \
-    async_generator_await_reject_shared_fun)                                   \
-  V(ASYNC_GENERATOR_AWAIT_RESOLVE_SHARED_FUN, SharedFunctionInfo,              \
-    async_generator_await_resolve_shared_fun)                                  \
-  V(ASYNC_GENERATOR_YIELD_RESOLVE_SHARED_FUN, SharedFunctionInfo,              \
-    async_generator_yield_resolve_shared_fun)                                  \
-  V(ASYNC_GENERATOR_RETURN_RESOLVE_SHARED_FUN, SharedFunctionInfo,             \
-    async_generator_return_resolve_shared_fun)                                 \
-  V(ASYNC_GENERATOR_RETURN_CLOSED_RESOLVE_SHARED_FUN, SharedFunctionInfo,      \
-    async_generator_return_closed_resolve_shared_fun)                          \
-  V(ASYNC_GENERATOR_RETURN_CLOSED_REJECT_SHARED_FUN, SharedFunctionInfo,       \
-    async_generator_return_closed_reject_shared_fun)                           \
   V(ATOMICS_OBJECT, JSObject, atomics_object)                                  \
   V(BIGINT_FUNCTION_INDEX, JSFunction, bigint_function)                        \
+  V(BIGINT64_ARRAY_FUN_INDEX, JSFunction, bigint64_array_fun)                  \
+  V(BIGUINT64_ARRAY_FUN_INDEX, JSFunction, biguint64_array_fun)                \
   V(BOOLEAN_FUNCTION_INDEX, JSFunction, boolean_function)                      \
   V(BOUND_FUNCTION_WITH_CONSTRUCTOR_MAP_INDEX, Map,                            \
     bound_function_with_constructor_map)                                       \
@@ -256,18 +155,22 @@ enum ContextLookupFlags {
   V(GENERATOR_OBJECT_PROTOTYPE_MAP_INDEX, Map, generator_object_prototype_map) \
   V(ASYNC_GENERATOR_OBJECT_PROTOTYPE_MAP_INDEX, Map,                           \
     async_generator_object_prototype_map)                                      \
+  V(INITIAL_ARRAY_ITERATOR_MAP_INDEX, Map, initial_array_iterator_map)         \
   V(INITIAL_ARRAY_ITERATOR_PROTOTYPE_INDEX, JSObject,                          \
     initial_array_iterator_prototype)                                          \
-  V(INITIAL_ARRAY_ITERATOR_PROTOTYPE_MAP_INDEX, Map,                           \
-    initial_array_iterator_prototype_map)                                      \
   V(INITIAL_ARRAY_PROTOTYPE_INDEX, JSObject, initial_array_prototype)          \
+  V(INITIAL_ARRAY_PROTOTYPE_MAP_INDEX, Map, initial_array_prototype_map)       \
   V(INITIAL_ERROR_PROTOTYPE_INDEX, JSObject, initial_error_prototype)          \
   V(INITIAL_GENERATOR_PROTOTYPE_INDEX, JSObject, initial_generator_prototype)  \
   V(INITIAL_ASYNC_GENERATOR_PROTOTYPE_INDEX, JSObject,                         \
     initial_async_generator_prototype)                                         \
   V(INITIAL_ITERATOR_PROTOTYPE_INDEX, JSObject, initial_iterator_prototype)    \
+  V(INITIAL_MAP_PROTOTYPE_MAP_INDEX, Map, initial_map_prototype_map)           \
   V(INITIAL_OBJECT_PROTOTYPE_INDEX, JSObject, initial_object_prototype)        \
+  V(INITIAL_SET_PROTOTYPE_MAP_INDEX, Map, initial_set_prototype_map)           \
   V(INITIAL_STRING_PROTOTYPE_INDEX, JSObject, initial_string_prototype)        \
+  V(INITIAL_WEAKMAP_PROTOTYPE_MAP_INDEX, Map, initial_weakmap_prototype_map)   \
+  V(INITIAL_WEAKSET_PROTOTYPE_MAP_INDEX, Map, initial_weakset_prototype_map)   \
   V(INT16_ARRAY_FUN_INDEX, JSFunction, int16_array_fun)                        \
   V(INT32_ARRAY_FUN_INDEX, JSFunction, int32_array_fun)                        \
   V(INT8_ARRAY_FUN_INDEX, JSFunction, int8_array_fun)                          \
@@ -320,9 +223,10 @@ enum ContextLookupFlags {
   V(PROXY_REVOKE_SHARED_FUN, SharedFunctionInfo, proxy_revoke_shared_fun)      \
   V(PROMISE_GET_CAPABILITIES_EXECUTOR_SHARED_FUN, SharedFunctionInfo,          \
     promise_get_capabilities_executor_shared_fun)                              \
-  V(PROMISE_RESOLVE_SHARED_FUN, SharedFunctionInfo,                            \
-    promise_resolve_shared_fun)                                                \
-  V(PROMISE_REJECT_SHARED_FUN, SharedFunctionInfo, promise_reject_shared_fun)  \
+  V(PROMISE_CAPABILITY_DEFAULT_REJECT_SHARED_FUN_INDEX, SharedFunctionInfo,    \
+    promise_capability_default_reject_shared_fun)                              \
+  V(PROMISE_CAPABILITY_DEFAULT_RESOLVE_SHARED_FUN_INDEX, SharedFunctionInfo,   \
+    promise_capability_default_resolve_shared_fun)                             \
   V(PROMISE_THEN_FINALLY_SHARED_FUN, SharedFunctionInfo,                       \
     promise_then_finally_shared_fun)                                           \
   V(PROMISE_CATCH_FINALLY_SHARED_FUN, SharedFunctionInfo,                      \
@@ -333,7 +237,7 @@ enum ContextLookupFlags {
     promise_thrower_finally_shared_fun)                                        \
   V(PROMISE_ALL_RESOLVE_ELEMENT_SHARED_FUN, SharedFunctionInfo,                \
     promise_all_resolve_element_shared_fun)                                    \
-  V(PROMISE_PROTOTYPE_MAP_INDEX, Map, promise_prototype_map)                   \
+  V(PROMISE_PROTOTYPE_INDEX, JSObject, promise_prototype)                      \
   V(REGEXP_EXEC_FUNCTION_INDEX, JSFunction, regexp_exec_function)              \
   V(REGEXP_FUNCTION_INDEX, JSFunction, regexp_function)                        \
   V(REGEXP_LAST_MATCH_INFO_INDEX, RegExpMatchInfo, regexp_last_match_info)     \
@@ -356,7 +260,7 @@ enum ContextLookupFlags {
     slow_object_with_null_prototype_map)                                       \
   V(SLOW_OBJECT_WITH_OBJECT_PROTOTYPE_MAP, Map,                                \
     slow_object_with_object_prototype_map)                                     \
-  V(SLOW_TEMPLATE_INSTANTIATIONS_CACHE_INDEX, NumberDictionary,                \
+  V(SLOW_TEMPLATE_INSTANTIATIONS_CACHE_INDEX, SimpleNumberDictionary,          \
     slow_template_instantiations_cache)                                        \
   /* All *_FUNCTION_MAP_INDEX definitions used by Context::FunctionMapIndex */ \
   /* must remain together. */                                                  \
@@ -406,7 +310,6 @@ enum ContextLookupFlags {
   V(WASM_MEMORY_CONSTRUCTOR_INDEX, JSFunction, wasm_memory_constructor)        \
   V(WASM_MODULE_CONSTRUCTOR_INDEX, JSFunction, wasm_module_constructor)        \
   V(WASM_TABLE_CONSTRUCTOR_INDEX, JSFunction, wasm_table_constructor)          \
-  V(TEMPLATE_MAP_INDEX, HeapObject, template_map)                              \
   V(TYPED_ARRAY_FUN_INDEX, JSFunction, typed_array_function)                   \
   V(TYPED_ARRAY_PROTOTYPE_INDEX, JSObject, typed_array_prototype)              \
   V(UINT16_ARRAY_FUN_INDEX, JSFunction, uint16_array_fun)                      \
@@ -414,8 +317,7 @@ enum ContextLookupFlags {
   V(UINT8_ARRAY_FUN_INDEX, JSFunction, uint8_array_fun)                        \
   V(UINT8_CLAMPED_ARRAY_FUN_INDEX, JSFunction, uint8_clamped_array_fun)        \
   NATIVE_CONTEXT_INTRINSIC_FUNCTIONS(V)                                        \
-  NATIVE_CONTEXT_IMPORTED_FIELDS(V)                                            \
-  NATIVE_CONTEXT_JS_ARRAY_ITERATOR_MAPS(V)
+  NATIVE_CONTEXT_IMPORTED_FIELDS(V)
 
 // A table of all script contexts. Every loaded top-level script with top-level
 // lexical declarations contributes its ScriptContext into this table.
@@ -455,6 +357,7 @@ class ScriptContextTable : public FixedArray {
 
   static const int kUsedSlotIndex = 0;
   static const int kFirstContextSlotIndex = 1;
+  static const int kMinLength = kFirstContextSlotIndex;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(ScriptContextTable);
 };
diff --git a/deps/v8/src/conversions-inl.h b/deps/v8/src/conversions-inl.h
index 21f90a50ae5..b64f016df27 100644
--- a/deps/v8/src/conversions-inl.h
+++ b/deps/v8/src/conversions-inl.h
@@ -72,8 +72,10 @@ inline double DoubleToInteger(double x) {
 
 
 int32_t DoubleToInt32(double x) {
-  int32_t i = FastD2I(x);
-  if (FastI2D(i) == x) return i;
+  if ((std::isfinite(x)) && (x <= INT_MAX) && (x >= INT_MIN)) {
+    int32_t i = static_cast<int32_t>(x);
+    if (FastI2D(i) == x) return i;
+  }
   Double d(x);
   int exponent = d.Exponent();
   if (exponent < 0) {
@@ -94,14 +96,15 @@ bool DoubleToSmiInteger(double value, int* smi_int_value) {
 }
 
 bool IsSmiDouble(double value) {
-  return !IsMinusZero(value) && value >= Smi::kMinValue &&
-         value <= Smi::kMaxValue && value == FastI2D(FastD2I(value));
+  return std::isfinite(value) && !IsMinusZero(value) &&
+         value >= Smi::kMinValue && value <= Smi::kMaxValue &&
+         value == FastI2D(FastD2I(value));
 }
 
 
 bool IsInt32Double(double value) {
-  return !IsMinusZero(value) && value >= kMinInt && value <= kMaxInt &&
-         value == FastI2D(FastD2I(value));
+  return std::isfinite(value) && !IsMinusZero(value) && value >= kMinInt &&
+         value <= kMaxInt && value == FastI2D(FastD2I(value));
 }
 
 
diff --git a/deps/v8/src/conversions.cc b/deps/v8/src/conversions.cc
index c5ea1b8366e..827ccbd7738 100644
--- a/deps/v8/src/conversions.cc
+++ b/deps/v8/src/conversions.cc
@@ -175,8 +175,8 @@ double InternalStringToIntDouble(UnicodeCache* unicode_cache, Iterator current,
 }
 
 // ES6 18.2.5 parseInt(string, radix) (with NumberParseIntHelper subclass);
-// https://tc39.github.io/proposal-bigint/#sec-bigint-parseint-string-radix
-// (with BigIntParseIntHelper subclass).
+// and BigInt parsing cases from https://tc39.github.io/proposal-bigint/
+// (with StringToBigIntHelper subclass).
 class StringToIntHelper {
  public:
   StringToIntHelper(Isolate* isolate, Handle<String> subject, int radix)
@@ -852,17 +852,12 @@ double StringToInt(Isolate* isolate, Handle<String> string, int radix) {
   return helper.GetResult();
 }
 
-class BigIntParseIntHelper : public StringToIntHelper {
+class StringToBigIntHelper : public StringToIntHelper {
  public:
-  enum class Behavior { kParseInt, kStringToBigInt, kLiteral };
-
-  // Used for BigInt.parseInt API, where the input is a Heap-allocated String.
-  BigIntParseIntHelper(Isolate* isolate, Handle<String> string, int radix)
-      : StringToIntHelper(isolate, string, radix),
-        behavior_(Behavior::kParseInt) {}
+  enum class Behavior { kStringToBigInt, kLiteral };
 
   // Used for StringToBigInt operation (BigInt constructor and == operator).
-  BigIntParseIntHelper(Isolate* isolate, Handle<String> string)
+  StringToBigIntHelper(Isolate* isolate, Handle<String> string)
       : StringToIntHelper(isolate, string),
         behavior_(Behavior::kStringToBigInt) {
     set_allow_binary_and_octal_prefixes();
@@ -871,7 +866,7 @@ class BigIntParseIntHelper : public StringToIntHelper {
 
   // Used for parsing BigInt literals, where the input is a buffer of
   // one-byte ASCII digits, along with an optional radix prefix.
-  BigIntParseIntHelper(Isolate* isolate, const uint8_t* string, int length)
+  StringToBigIntHelper(Isolate* isolate, const uint8_t* string, int length)
       : StringToIntHelper(isolate, string, length),
         behavior_(Behavior::kLiteral) {
     set_allow_binary_and_octal_prefixes();
@@ -884,9 +879,7 @@ class BigIntParseIntHelper : public StringToIntHelper {
       return MaybeHandle<BigInt>();
     }
     if (state() == kEmpty) {
-      if (behavior_ == Behavior::kParseInt) {
-        set_state(kJunk);
-      } else if (behavior_ == Behavior::kStringToBigInt) {
+      if (behavior_ == Behavior::kStringToBigInt) {
         set_state(kZero);
       } else {
         UNREACHABLE();
@@ -924,9 +917,12 @@ class BigIntParseIntHelper : public StringToIntHelper {
     // Optimization opportunity: Would it makes sense to scan for trailing
     // junk before allocating the result?
     int charcount = length() - cursor();
-    // TODO(adamk): Pretenure if this is for a literal.
-    MaybeHandle<FreshlyAllocatedBigInt> maybe =
-        BigInt::AllocateFor(isolate(), radix(), charcount, should_throw());
+    // For literals, we pretenure the allocated BigInt, since it's about
+    // to be stored in the interpreter's constants array.
+    PretenureFlag pretenure =
+        behavior_ == Behavior::kLiteral ? TENURED : NOT_TENURED;
+    MaybeHandle<FreshlyAllocatedBigInt> maybe = BigInt::AllocateFor(
+        isolate(), radix(), charcount, should_throw(), pretenure);
     if (!maybe.ToHandle(&result_)) {
       set_state(kError);
     }
@@ -938,28 +934,20 @@ class BigIntParseIntHelper : public StringToIntHelper {
   }
 
  private:
-  ShouldThrow should_throw() const {
-    return behavior_ == Behavior::kParseInt ? kThrowOnError : kDontThrow;
-  }
+  ShouldThrow should_throw() const { return kDontThrow; }
 
   Handle<FreshlyAllocatedBigInt> result_;
   Behavior behavior_;
 };
 
-MaybeHandle<BigInt> BigIntParseInt(Isolate* isolate, Handle<String> string,
-                                   int radix) {
-  BigIntParseIntHelper helper(isolate, string, radix);
-  return helper.GetResult();
-}
-
 MaybeHandle<BigInt> StringToBigInt(Isolate* isolate, Handle<String> string) {
   string = String::Flatten(string);
-  BigIntParseIntHelper helper(isolate, string);
+  StringToBigIntHelper helper(isolate, string);
   return helper.GetResult();
 }
 
 MaybeHandle<BigInt> BigIntLiteral(Isolate* isolate, const char* string) {
-  BigIntParseIntHelper helper(isolate, reinterpret_cast<const uint8_t*>(string),
+  StringToBigIntHelper helper(isolate, reinterpret_cast<const uint8_t*>(string),
                               static_cast<int>(strlen(string)));
   return helper.GetResult();
 }
diff --git a/deps/v8/src/conversions.h b/deps/v8/src/conversions.h
index 915a286e8f6..6189fe0aa10 100644
--- a/deps/v8/src/conversions.h
+++ b/deps/v8/src/conversions.h
@@ -105,9 +105,6 @@ double StringToDouble(UnicodeCache* unicode_cache,
 
 double StringToInt(Isolate* isolate, Handle<String> string, int radix);
 
-// This follows BigInt.parseInt semantics: "" => SyntaxError.
-MaybeHandle<BigInt> BigIntParseInt(Isolate* isolate, Handle<String> string,
-                                   int radix);
 // This follows https://tc39.github.io/proposal-bigint/#sec-string-to-bigint
 // semantics: "" => 0n.
 MaybeHandle<BigInt> StringToBigInt(Isolate* isolate, Handle<String> string);
diff --git a/deps/v8/src/counters.cc b/deps/v8/src/counters.cc
index e41fa276a8c..001beb938e2 100644
--- a/deps/v8/src/counters.cc
+++ b/deps/v8/src/counters.cc
@@ -84,7 +84,6 @@ void TimedHistogram::Start(base::ElapsedTimer* timer, Isolate* isolate) {
 
 void TimedHistogram::Stop(base::ElapsedTimer* timer, Isolate* isolate) {
   if (Enabled()) {
-    // Compute the delta between start and stop, in microseconds.
     int64_t sample = resolution_ == HistogramTimerResolution::MICROSECOND
                          ? timer->Elapsed().InMicroseconds()
                          : timer->Elapsed().InMilliseconds();
@@ -96,6 +95,21 @@ void TimedHistogram::Stop(base::ElapsedTimer* timer, Isolate* isolate) {
   }
 }
 
+void TimedHistogram::RecordAbandon(base::ElapsedTimer* timer,
+                                   Isolate* isolate) {
+  if (Enabled()) {
+    DCHECK(timer->IsStarted());
+    timer->Stop();
+    int64_t sample = resolution_ == HistogramTimerResolution::MICROSECOND
+                         ? base::TimeDelta::Max().InMicroseconds()
+                         : base::TimeDelta::Max().InMilliseconds();
+    AddSample(static_cast<int>(sample));
+  }
+  if (isolate != nullptr) {
+    Logger::CallEventLogger(isolate, name(), Logger::END, true);
+  }
+}
+
 Counters::Counters(Isolate* isolate)
     : isolate_(isolate),
       stats_table_(this),
diff --git a/deps/v8/src/counters.h b/deps/v8/src/counters.h
index b3c6f8c8ffb..6bec214ef78 100644
--- a/deps/v8/src/counters.h
+++ b/deps/v8/src/counters.h
@@ -220,6 +220,12 @@ class Histogram {
   int max() const { return max_; }
   int num_buckets() const { return num_buckets_; }
 
+  // Asserts that |expected_counters| are the same as the Counters this
+  // Histogram reports to.
+  void AssertReportsToCounters(Counters* expected_counters) {
+    DCHECK_EQ(counters_, expected_counters);
+  }
+
  protected:
   Histogram() {}
   Histogram(const char* name, int min, int max, int num_buckets,
@@ -229,7 +235,9 @@ class Histogram {
         max_(max),
         num_buckets_(num_buckets),
         histogram_(nullptr),
-        counters_(counters) {}
+        counters_(counters) {
+    DCHECK(counters_);
+  }
 
   Counters* counters() const { return counters_; }
 
@@ -261,6 +269,10 @@ class TimedHistogram : public Histogram {
   // Stop the timer and record the results. Log if isolate non-null.
   void Stop(base::ElapsedTimer* timer, Isolate* isolate);
 
+  // Records a TimeDelta::Max() result. Useful to record percentage of tasks
+  // that never got to run in a given scenario. Log if isolate non-null.
+  void RecordAbandon(base::ElapsedTimer* timer, Isolate* isolate);
+
  protected:
   friend class Counters;
   HistogramTimerResolution resolution_;
@@ -282,6 +294,7 @@ class TimedHistogramScope {
       : histogram_(histogram), isolate_(isolate) {
     histogram_->Start(&timer_, isolate);
   }
+
   ~TimedHistogramScope() { histogram_->Stop(&timer_, isolate_); }
 
  private:
@@ -292,6 +305,42 @@ class TimedHistogramScope {
   DISALLOW_IMPLICIT_CONSTRUCTORS(TimedHistogramScope);
 };
 
+// Helper class for recording a TimedHistogram asynchronously with manual
+// controls (it will not generate a report if destroyed without explicitly
+// triggering a report). |async_counters| should be a shared_ptr to
+// |histogram->counters()|, making it is safe to report to an
+// AsyncTimedHistogram after the associated isolate has been destroyed.
+// AsyncTimedHistogram can be moved/copied to avoid computing Now() multiple
+// times when the times of multiple tasks are identical; each copy will generate
+// its own report.
+class AsyncTimedHistogram {
+ public:
+  explicit AsyncTimedHistogram(TimedHistogram* histogram,
+                               std::shared_ptr<Counters> async_counters)
+      : histogram_(histogram), async_counters_(std::move(async_counters)) {
+    histogram_->AssertReportsToCounters(async_counters_.get());
+    histogram_->Start(&timer_, nullptr);
+  }
+
+  ~AsyncTimedHistogram() = default;
+
+  AsyncTimedHistogram(const AsyncTimedHistogram& other) = default;
+  AsyncTimedHistogram& operator=(const AsyncTimedHistogram& other) = default;
+  AsyncTimedHistogram(AsyncTimedHistogram&& other) = default;
+  AsyncTimedHistogram& operator=(AsyncTimedHistogram&& other) = default;
+
+  // Records the time elapsed to |histogram_| and stops |timer_|.
+  void RecordDone() { histogram_->Stop(&timer_, nullptr); }
+
+  // Records TimeDelta::Max() to |histogram_| and stops |timer_|.
+  void RecordAbandon() { histogram_->RecordAbandon(&timer_, nullptr); }
+
+ private:
+  base::ElapsedTimer timer_;
+  TimedHistogram* histogram_;
+  std::shared_ptr<Counters> async_counters_;
+};
+
 // Helper class for scoping a TimedHistogram, where the histogram is selected at
 // stop time rather than start time.
 // TODO(leszeks): This is heavily reliant on TimedHistogram::Start() doing
@@ -643,6 +692,10 @@ class RuntimeCallTimer final {
   V(ArrayBuffer_New)                                       \
   V(Array_CloneElementAt)                                  \
   V(Array_New)                                             \
+  V(BigInt64Array_New)                                     \
+  V(BigUint64Array_New)                                    \
+  V(BigIntObject_New)                                      \
+  V(BigIntObject_BigIntValue)                              \
   V(BooleanObject_BooleanValue)                            \
   V(BooleanObject_New)                                     \
   V(Context_New)                                           \
@@ -716,6 +769,7 @@ class RuntimeCallTimer final {
   V(ObjectTemplate_New)                                    \
   V(ObjectTemplate_NewInstance)                            \
   V(Object_ToArrayIndex)                                   \
+  V(Object_ToBigInt)                                       \
   V(Object_ToDetailString)                                 \
   V(Object_ToInt32)                                        \
   V(Object_ToInteger)                                      \
@@ -795,7 +849,6 @@ class RuntimeCallTimer final {
   V(CompileBackgroundEval)                     \
   V(CompileBackgroundIgnition)                 \
   V(CompileBackgroundScript)                   \
-  V(CompileBackgroundRenumber)                 \
   V(CompileBackgroundRewriteReturnResult)      \
   V(CompileBackgroundScopeAnalysis)            \
   V(CompileDeserialize)                        \
@@ -805,7 +858,6 @@ class RuntimeCallTimer final {
   V(CompileGetFromOptimizedCodeMap)            \
   V(CompileIgnition)                           \
   V(CompileIgnitionFinalization)               \
-  V(CompileRenumber)                           \
   V(CompileRewriteReturnResult)                \
   V(CompileScopeAnalysis)                      \
   V(CompileScript)                             \
@@ -881,6 +933,7 @@ class RuntimeCallTimer final {
   V(KeyedStoreIC_SlowStub)                        \
   V(KeyedStoreIC_StoreFastElementStub)            \
   V(KeyedStoreIC_StoreElementStub)                \
+  V(StoreInArrayLiteralIC_SlowStub)               \
   V(LoadGlobalIC_LoadScriptContextField)          \
   V(LoadGlobalIC_SlowStub)                        \
   V(LoadIC_FunctionPrototypeStub)                 \
@@ -1170,7 +1223,9 @@ class RuntimeCallTimerScope {
   HT(compile_script_no_cache_because_cache_too_cold,                           \
      V8.CompileScriptMicroSeconds.NoCache.CacheTooCold, 1000000, MICROSECOND)  \
   HT(compile_script_on_background,                                             \
-     V8.CompileScriptMicroSeconds.BackgroundThread, 1000000, MICROSECOND)
+     V8.CompileScriptMicroSeconds.BackgroundThread, 1000000, MICROSECOND)      \
+  HT(gc_parallel_task_latency, V8.GC.ParallelTaskLatencyMicroSeconds, 1000000, \
+     MICROSECOND)
 
 #define AGGREGATABLE_HISTOGRAM_TIMER_LIST(AHT) \
   AHT(compile_lazy, V8.CompileLazyMicroSeconds)
diff --git a/deps/v8/src/d8-console.cc b/deps/v8/src/d8-console.cc
index 7f057e28673..cb7334af782 100644
--- a/deps/v8/src/d8-console.cc
+++ b/deps/v8/src/d8-console.cc
@@ -26,7 +26,7 @@ void WriteToFile(const char* prefix, FILE* file, Isolate* isolate,
     int n = static_cast<int>(fwrite(*str, sizeof(**str), str.length(), file));
     if (n != str.length()) {
       printf("Error in fwrite\n");
-      Shell::Exit(1);
+      base::OS::ExitProcess(1);
     }
   }
   fprintf(file, "\n");
diff --git a/deps/v8/src/d8-posix.cc b/deps/v8/src/d8-posix.cc
index 3aae30799fc..1172bf8536b 100644
--- a/deps/v8/src/d8-posix.cc
+++ b/deps/v8/src/d8-posix.cc
@@ -361,8 +361,8 @@ static Local<Value> GetStdout(Isolate* isolate, int child_fd,
 // We're disabling usage of waitid in Mac OS X because it doesn't work for us:
 // a parent process hangs on waiting while a child process is already a zombie.
 // See http://code.google.com/p/v8/issues/detail?id=401.
-#if defined(WNOWAIT) && !defined(ANDROID) && !defined(__APPLE__) \
-    && !defined(__NetBSD__)
+#if defined(WNOWAIT) && !defined(ANDROID) && !defined(__APPLE__) && \
+    !defined(__NetBSD__) && !defined(__Fuchsia__)
 #if !defined(__FreeBSD__)
 #define HAS_WAITID 1
 #endif
@@ -874,12 +874,4 @@ void Shell::AddOSMethods(Isolate* isolate, Local<ObjectTemplate> os_templ) {
                 FunctionTemplate::New(isolate, RemoveDirectory));
 }
 
-void Shell::Exit(int exit_code) {
-  // Use _exit instead of exit to avoid races between isolate
-  // threads and static destructors.
-  fflush(stdout);
-  fflush(stderr);
-  _exit(exit_code);
-}
-
 }  // namespace v8
diff --git a/deps/v8/src/d8-windows.cc b/deps/v8/src/d8-windows.cc
index 499292330f4..4dee20f4400 100644
--- a/deps/v8/src/d8-windows.cc
+++ b/deps/v8/src/d8-windows.cc
@@ -15,12 +15,4 @@ char* Shell::ReadCharsFromTcpPort(const char* name, int* size_out) {
   return nullptr;
 }
 
-void Shell::Exit(int exit_code) {
-  // Use TerminateProcess avoid races between isolate threads and
-  // static destructors.
-  fflush(stdout);
-  fflush(stderr);
-  TerminateProcess(GetCurrentProcess(), exit_code);
-}
-
 }  // namespace v8
diff --git a/deps/v8/src/d8.cc b/deps/v8/src/d8.cc
index 32f129821a8..1c2e86d27a7 100644
--- a/deps/v8/src/d8.cc
+++ b/deps/v8/src/d8.cc
@@ -40,14 +40,12 @@
 #include "src/trap-handler/trap-handler.h"
 #include "src/utils.h"
 #include "src/v8.h"
+#include "src/wasm/wasm-engine.h"
 
 #if !defined(_WIN32) && !defined(_WIN64)
 #include <unistd.h>  // NOLINT
 #else
 #include <windows.h>  // NOLINT
-#if defined(_MSC_VER)
-#include <crtdbg.h>  // NOLINT
-#endif               // defined(_MSC_VER)
 #endif               // !defined(_WIN32) && !defined(_WIN64)
 
 #ifndef DCHECK
@@ -84,17 +82,6 @@ class ArrayBufferAllocatorBase : public v8::ArrayBuffer::Allocator {
     allocator_->Free(data, length);
   }
 
-  void* Reserve(size_t length) override { return allocator_->Reserve(length); }
-
-  void Free(void* data, size_t length, AllocationMode mode) override {
-    allocator_->Free(data, length, mode);
-  }
-
-  void SetProtection(void* data, size_t length,
-                     Protection protection) override {
-    allocator_->SetProtection(data, length, protection);
-  }
-
  private:
   std::unique_ptr<Allocator> allocator_ =
       std::unique_ptr<Allocator>(NewDefaultAllocator());
@@ -121,18 +108,6 @@ class ShellArrayBufferAllocator : public ArrayBufferAllocatorBase {
     }
   }
 
-  void* Reserve(size_t length) override {
-    // |length| must be over the threshold so we can distinguish VM from
-    // malloced memory.
-    DCHECK_LE(kVMThreshold, length);
-    return ArrayBufferAllocatorBase::Reserve(length);
-  }
-
-  void Free(void* data, size_t length, AllocationMode) override {
-    // Ignore allocation mode; the appropriate action is determined by |length|.
-    Free(data, length);
-  }
-
  private:
   static constexpr size_t kVMThreshold = 65536;
   static constexpr size_t kTwoGB = 2u * 1024u * 1024u * 1024u;
@@ -172,14 +147,6 @@ class MockArrayBufferAllocator : public ArrayBufferAllocatorBase {
     return ArrayBufferAllocatorBase::Free(data, Adjust(length));
   }
 
-  void* Reserve(size_t length) override {
-    return ArrayBufferAllocatorBase::Reserve(Adjust(length));
-  }
-
-  void Free(void* data, size_t length, AllocationMode mode) override {
-    return ArrayBufferAllocatorBase::Free(data, Adjust(length), mode);
-  }
-
  private:
   size_t Adjust(size_t length) {
     const size_t kAllocationLimit = 10 * kMB;
@@ -214,19 +181,17 @@ class PredictablePlatform : public Platform {
     return platform_->GetForegroundTaskRunner(isolate);
   }
 
-  std::shared_ptr<TaskRunner> GetBackgroundTaskRunner(
+  std::shared_ptr<TaskRunner> GetWorkerThreadsTaskRunner(
       v8::Isolate* isolate) override {
     // Return the foreground task runner here, so that all tasks get executed
     // sequentially in a predictable order.
     return platform_->GetForegroundTaskRunner(isolate);
   }
 
-  void CallOnBackgroundThread(Task* task,
-                              ExpectedRuntime expected_runtime) override {
+  void CallOnWorkerThread(std::unique_ptr<Task> task) override {
     // It's not defined when background tasks are being executed, so we can just
     // execute them right away.
     task->Run();
-    delete task;
   }
 
   void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override {
@@ -604,8 +569,9 @@ void Shell::StoreInCodeCache(Isolate* isolate, Local<Value> source,
 
 // Executes a string within the current v8 context.
 bool Shell::ExecuteString(Isolate* isolate, Local<String> source,
-                          Local<Value> name, bool print_result,
-                          bool report_exceptions) {
+                          Local<Value> name, PrintResult print_result,
+                          ReportExceptions report_exceptions,
+                          ProcessMessageQueue process_message_queue) {
   HandleScope handle_scope(isolate);
   TryCatch try_catch(isolate);
   try_catch.SetVerbose(true);
@@ -621,8 +587,9 @@ bool Shell::ExecuteString(Isolate* isolate, Local<String> source,
     Local<Context> context(isolate->GetCurrentContext());
     ScriptOrigin origin(name);
 
-    if (options.compile_options == ScriptCompiler::kConsumeCodeCache ||
-        options.compile_options == ScriptCompiler::kConsumeParserCache) {
+    DCHECK(options.compile_options != ScriptCompiler::kProduceParserCache);
+    DCHECK(options.compile_options != ScriptCompiler::kConsumeParserCache);
+    if (options.compile_options == ScriptCompiler::kConsumeCodeCache) {
       ScriptCompiler::CachedData* cached_code =
           LookupCodeCache(isolate, source);
       if (cached_code != nullptr) {
@@ -656,9 +623,6 @@ bool Shell::ExecuteString(Isolate* isolate, Local<String> source,
       ScriptCompiler::Source script_source(source, origin);
       maybe_script = ScriptCompiler::Compile(context, &script_source,
                                              options.compile_options);
-      if (options.compile_options == ScriptCompiler::kProduceParserCache) {
-        StoreInCodeCache(isolate, source, script_source.GetCachedData());
-      }
     }
 
     Local<Script> script;
@@ -685,7 +649,7 @@ bool Shell::ExecuteString(Isolate* isolate, Local<String> source,
       StoreInCodeCache(isolate, source, cached_data);
       delete cached_data;
     }
-    if (!EmptyMessageQueues(isolate)) success = false;
+    if (process_message_queue && !EmptyMessageQueues(isolate)) success = false;
     data->realm_current_ = data->realm_switch_;
   }
   Local<Value> result;
@@ -957,9 +921,7 @@ void Shell::DoHostImportModuleDynamically(void* import_data) {
 
   std::string source_url = ToSTLString(isolate, referrer);
   std::string dir_name =
-      DirName(IsAbsolutePath(source_url)
-                  ? source_url
-                  : NormalizePath(source_url, GetWorkingDirectory()));
+      DirName(NormalizePath(source_url, GetWorkingDirectory()));
   std::string file_name = ToSTLString(isolate, specifier);
   std::string absolute_path = NormalizePath(file_name, dir_name);
 
@@ -1313,7 +1275,7 @@ void WriteToFile(FILE* file, const v8::FunctionCallbackInfo<v8::Value>& args) {
     int n = static_cast<int>(fwrite(*str, sizeof(**str), str.length(), file));
     if (n != str.length()) {
       printf("Error in fwrite\n");
-      Shell::Exit(1);
+      base::OS::ExitProcess(1);
     }
   }
 }
@@ -1409,11 +1371,14 @@ void Shell::Load(const v8::FunctionCallbackInfo<v8::Value>& args) {
       Throw(args.GetIsolate(), "Error loading file");
       return;
     }
-    if (!ExecuteString(args.GetIsolate(), source,
-                       String::NewFromUtf8(args.GetIsolate(), *file,
-                                           NewStringType::kNormal)
-                           .ToLocalChecked(),
-                       false, !options.quiet_load)) {
+    if (!ExecuteString(
+            args.GetIsolate(), source,
+            String::NewFromUtf8(args.GetIsolate(), *file,
+                                NewStringType::kNormal)
+                .ToLocalChecked(),
+            kNoPrintResult,
+            options.quiet_load ? kNoReportExceptions : kReportExceptions,
+            kNoProcessMessageQueue)) {
       Throw(args.GetIsolate(), "Error executing file");
       return;
     }
@@ -1532,7 +1497,7 @@ void Shell::QuitOnce(v8::FunctionCallbackInfo<v8::Value>* args) {
   CleanupWorkers();
   args->GetIsolate()->Exit();
   OnExit(args->GetIsolate());
-  Exit(exit_code);
+  base::OS::ExitProcess(exit_code);
 }
 
 
@@ -1656,7 +1621,7 @@ void Shell::MapCounters(v8::Isolate* isolate, const char* name) {
       (counters_file_ == nullptr) ? nullptr : counters_file_->memory();
   if (memory == nullptr) {
     printf("Could not map counters file %s\n", name);
-    Exit(1);
+    base::OS::ExitProcess(1);
   }
   counters_ = static_cast<CounterCollection*>(memory);
   isolate->SetCounterFunction(LookupCounter);
@@ -2305,7 +2270,8 @@ void Shell::RunShell(Isolate* isolate) {
     printf("d8> ");
     Local<String> input = Shell::ReadFromStdin(isolate);
     if (input.IsEmpty()) break;
-    ExecuteString(isolate, input, name, true, true);
+    ExecuteString(isolate, input, name, kPrintResult, kReportExceptions,
+                  kProcessMessageQueue);
   }
   printf("\n");
   // We need to explicitly clean up the module embedder data for
@@ -2467,7 +2433,9 @@ void SourceGroup::Execute(Isolate* isolate) {
           String::NewFromUtf8(isolate, argv_[i + 1], NewStringType::kNormal)
               .ToLocalChecked();
       Shell::options.script_executed = true;
-      if (!Shell::ExecuteString(isolate, source, file_name, false, true)) {
+      if (!Shell::ExecuteString(isolate, source, file_name,
+                                Shell::kNoPrintResult, Shell::kReportExceptions,
+                                Shell::kNoProcessMessageQueue)) {
         exception_was_thrown = true;
         break;
       }
@@ -2495,16 +2463,18 @@ void SourceGroup::Execute(Isolate* isolate) {
     Local<String> source = ReadFile(isolate, arg);
     if (source.IsEmpty()) {
       printf("Error reading '%s'\n", arg);
-      Shell::Exit(1);
+      base::OS::ExitProcess(1);
     }
     Shell::options.script_executed = true;
-    if (!Shell::ExecuteString(isolate, source, file_name, false, true)) {
+    if (!Shell::ExecuteString(isolate, source, file_name, Shell::kNoPrintResult,
+                              Shell::kReportExceptions,
+                              Shell::kProcessMessageQueue)) {
       exception_was_thrown = true;
       break;
     }
   }
   if (exception_was_thrown != Shell::options.expected_to_throw) {
-    Shell::Exit(1);
+    base::OS::ExitProcess(1);
   }
 }
 
@@ -2523,8 +2493,7 @@ void SourceGroup::ExecuteInThread() {
       Shell::HostImportModuleDynamically);
   isolate->SetHostInitializeImportMetaObjectCallback(
       Shell::HostInitializeImportMetaObject);
-
-  Shell::EnsureEventLoopInitialized(isolate);
+  Shell::SetWaitUntilDone(isolate, false);
   D8Console console(isolate);
   debug::SetConsoleDelegate(isolate, &console);
   for (int i = 0; i < Shell::options.stress_runs; ++i) {
@@ -2576,7 +2545,11 @@ void SourceGroup::JoinThread() {
 
 ExternalizedContents::~ExternalizedContents() {
   if (base_ != nullptr) {
-    Shell::array_buffer_allocator->Free(base_, length_, mode_);
+    if (mode_ == ArrayBuffer::Allocator::AllocationMode::kReservation) {
+      CHECK(i::FreePages(base_, length_));
+    } else {
+      Shell::array_buffer_allocator->Free(base_, length_);
+    }
   }
 }
 
@@ -2703,7 +2676,9 @@ void Worker::ExecuteInThread() {
         Local<String> source =
             String::NewFromUtf8(isolate, script_, NewStringType::kNormal)
                 .ToLocalChecked();
-        if (Shell::ExecuteString(isolate, source, file_name, false, true)) {
+        if (Shell::ExecuteString(
+                isolate, source, file_name, Shell::kNoPrintResult,
+                Shell::kReportExceptions, Shell::kProcessMessageQueue)) {
           // Get the message handler
           Local<Value> onmessage =
               global->Get(context, String::NewFromUtf8(isolate, "onmessage",
@@ -2825,6 +2800,11 @@ bool Shell::SetOptions(int argc, char* argv[]) {
     } else if (strcmp(argv[i], "--omit-quit") == 0) {
       options.omit_quit = true;
       argv[i] = nullptr;
+    } else if (strcmp(argv[i], "--no-wait-for-wasm") == 0) {
+      // TODO(herhut) Remove this flag once wasm compilation is fully
+      // isolate-independent.
+      options.wait_for_wasm = false;
+      argv[i] = nullptr;
     } else if (strcmp(argv[i], "-f") == 0) {
       // Ignore any -f flags for compatibility with other stand-alone
       // JavaScript engines.
@@ -2852,8 +2832,6 @@ bool Shell::SetOptions(int argc, char* argv[]) {
         options.compile_options = v8::ScriptCompiler::kNoCompileOptions;
         options.code_cache_options =
             ShellOptions::CodeCacheOptions::kProduceCache;
-      } else if (strncmp(value, "=parse", 7) == 0) {
-        options.compile_options = v8::ScriptCompiler::kProduceParserCache;
       } else if (strncmp(value, "=none", 6) == 0) {
         options.compile_options = v8::ScriptCompiler::kNoCompileOptions;
         options.code_cache_options =
@@ -2900,6 +2878,9 @@ bool Shell::SetOptions(int argc, char* argv[]) {
     } else if (strcmp(argv[i], "--quiet-load") == 0) {
       options.quiet_load = true;
       argv[i] = nullptr;
+    } else if (strncmp(argv[i], "--thread-pool-size=", 19) == 0) {
+      options.thread_pool_size = atoi(argv[i] + 19);
+      argv[i] = nullptr;
     }
   }
 
@@ -2941,7 +2922,7 @@ int Shell::RunMain(Isolate* isolate, int argc, char* argv[], bool last_run) {
     options.isolate_sources[i].StartExecuteInThread();
   }
   {
-    EnsureEventLoopInitialized(isolate);
+    SetWaitUntilDone(isolate, false);
     if (options.lcov_file) {
       debug::Coverage::SelectMode(isolate, debug::Coverage::kBlockCount);
     }
@@ -2992,11 +2973,6 @@ void Shell::CollectGarbage(Isolate* isolate) {
   }
 }
 
-void Shell::EnsureEventLoopInitialized(Isolate* isolate) {
-  v8::platform::EnsureEventLoopInitialized(GetDefaultPlatform(), isolate);
-  SetWaitUntilDone(isolate, false);
-}
-
 void Shell::SetWaitUntilDone(Isolate* isolate, bool value) {
   base::LockGuard<base::Mutex> guard(isolate_status_lock_.Pointer());
   if (isolate_status_.count(isolate) == 0) {
@@ -3037,13 +3013,19 @@ bool ProcessMessages(Isolate* isolate,
 }  // anonymous namespace
 
 void Shell::CompleteMessageLoop(Isolate* isolate) {
-  ProcessMessages(isolate, [isolate]() {
+  auto get_waiting_behaviour = [isolate]() {
     base::LockGuard<base::Mutex> guard(isolate_status_lock_.Pointer());
     DCHECK_GT(isolate_status_.count(isolate), 0);
-    return isolate_status_[isolate]
-               ? platform::MessageLoopBehavior::kWaitForWork
-               : platform::MessageLoopBehavior::kDoNotWait;
-  });
+    i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+    i::wasm::CompilationManager* wasm_compilation_manager =
+        i_isolate->wasm_engine()->compilation_manager();
+    bool should_wait = (options.wait_for_wasm &&
+                        wasm_compilation_manager->HasRunningCompileJob()) ||
+                       isolate_status_[isolate];
+    return should_wait ? platform::MessageLoopBehavior::kWaitForWork
+                       : platform::MessageLoopBehavior::kDoNotWait;
+  };
+  ProcessMessages(isolate, get_waiting_behaviour);
 }
 
 bool Shell::EmptyMessageQueues(Isolate* isolate) {
@@ -3085,6 +3067,13 @@ class Serializer : public ValueSerializer::Delegate {
 
   std::unique_ptr<SerializationData> Release() { return std::move(data_); }
 
+  void AppendExternalizedContentsTo(std::vector<ExternalizedContents>* to) {
+    to->insert(to->end(),
+               std::make_move_iterator(externalized_contents_.begin()),
+               std::make_move_iterator(externalized_contents_.end()));
+    externalized_contents_.clear();
+  }
+
  protected:
   // Implements ValueSerializer::Delegate.
   void ThrowDataCloneError(Local<String> message) override {
@@ -3102,6 +3091,8 @@ class Serializer : public ValueSerializer::Delegate {
 
     size_t index = shared_array_buffers_.size();
     shared_array_buffers_.emplace_back(isolate_, shared_array_buffer);
+    data_->shared_array_buffer_contents_.push_back(
+        MaybeExternalize(shared_array_buffer));
     return Just<uint32_t>(static_cast<uint32_t>(index));
   }
 
@@ -3155,7 +3146,7 @@ class Serializer : public ValueSerializer::Delegate {
       return array_buffer->GetContents();
     } else {
       typename T::Contents contents = array_buffer->Externalize();
-      data_->externalized_contents_.emplace_back(contents);
+      externalized_contents_.emplace_back(contents);
       return contents;
     }
   }
@@ -3174,13 +3165,6 @@ class Serializer : public ValueSerializer::Delegate {
       data_->array_buffer_contents_.push_back(contents);
     }
 
-    for (const auto& global_shared_array_buffer : shared_array_buffers_) {
-      Local<SharedArrayBuffer> shared_array_buffer =
-          Local<SharedArrayBuffer>::New(isolate_, global_shared_array_buffer);
-      data_->shared_array_buffer_contents_.push_back(
-          MaybeExternalize(shared_array_buffer));
-    }
-
     return Just(true);
   }
 
@@ -3189,6 +3173,7 @@ class Serializer : public ValueSerializer::Delegate {
   std::unique_ptr<SerializationData> data_;
   std::vector<Global<ArrayBuffer>> array_buffers_;
   std::vector<Global<SharedArrayBuffer>> shared_array_buffers_;
+  std::vector<ExternalizedContents> externalized_contents_;
   size_t current_memory_usage_;
 
   DISALLOW_COPY_AND_ASSIGN(Serializer);
@@ -3216,16 +3201,21 @@ class Deserializer : public ValueDeserializer::Delegate {
       deserializer_.TransferArrayBuffer(index++, array_buffer);
     }
 
-    index = 0;
-    for (const auto& contents : data_->shared_array_buffer_contents()) {
-      Local<SharedArrayBuffer> shared_array_buffer = SharedArrayBuffer::New(
-          isolate_, contents.Data(), contents.ByteLength());
-      deserializer_.TransferSharedArrayBuffer(index++, shared_array_buffer);
-    }
-
     return deserializer_.ReadValue(context);
   }
 
+  MaybeLocal<SharedArrayBuffer> GetSharedArrayBufferFromId(
+      Isolate* isolate, uint32_t clone_id) override {
+    DCHECK_NOT_NULL(data_);
+    if (clone_id < data_->shared_array_buffer_contents().size()) {
+      SharedArrayBuffer::Contents contents =
+          data_->shared_array_buffer_contents().at(clone_id);
+      return SharedArrayBuffer::New(isolate_, contents.Data(),
+                                    contents.ByteLength());
+    }
+    return MaybeLocal<SharedArrayBuffer>();
+  }
+
  private:
   Isolate* isolate_;
   ValueDeserializer deserializer_;
@@ -3242,9 +3232,11 @@ std::unique_ptr<SerializationData> Shell::SerializeValue(
   if (serializer.WriteValue(context, value, transfer).To(&ok)) {
     std::unique_ptr<SerializationData> data = serializer.Release();
     base::LockGuard<base::Mutex> lock_guard(workers_mutex_.Pointer());
-    data->AppendExternalizedContentsTo(&externalized_contents_);
+    serializer.AppendExternalizedContentsTo(&externalized_contents_);
     return data;
   }
+  // Append externalized contents even when WriteValue fails.
+  serializer.AppendExternalizedContentsTo(&externalized_contents_);
   return nullptr;
 }
 
@@ -3281,21 +3273,7 @@ void Shell::CleanupWorkers() {
 
 int Shell::Main(int argc, char* argv[]) {
   std::ofstream trace_file;
-#if (defined(_WIN32) || defined(_WIN64))
-  UINT new_flags =
-      SEM_FAILCRITICALERRORS | SEM_NOGPFAULTERRORBOX | SEM_NOOPENFILEERRORBOX;
-  UINT existing_flags = SetErrorMode(new_flags);
-  SetErrorMode(existing_flags | new_flags);
-#if defined(_MSC_VER)
-  _CrtSetReportMode(_CRT_WARN, _CRTDBG_MODE_DEBUG | _CRTDBG_MODE_FILE);
-  _CrtSetReportFile(_CRT_WARN, _CRTDBG_FILE_STDERR);
-  _CrtSetReportMode(_CRT_ASSERT, _CRTDBG_MODE_DEBUG | _CRTDBG_MODE_FILE);
-  _CrtSetReportFile(_CRT_ASSERT, _CRTDBG_FILE_STDERR);
-  _CrtSetReportMode(_CRT_ERROR, _CRTDBG_MODE_DEBUG | _CRTDBG_MODE_FILE);
-  _CrtSetReportFile(_CRT_ERROR, _CRTDBG_FILE_STDERR);
-  _set_error_mode(_OUT_TO_STDERR);
-#endif  // defined(_MSC_VER)
-#endif  // defined(_WIN32) || defined(_WIN64)
+  v8::base::EnsureConsoleOutput();
   if (!SetOptions(argc, argv)) return 1;
   v8::V8::InitializeICUDefaultLocation(argv[0], options.icu_data_file);
 
@@ -3318,8 +3296,8 @@ int Shell::Main(int argc, char* argv[]) {
 
   platform::tracing::TracingController* tracing_controller = tracing.get();
   g_platform = v8::platform::NewDefaultPlatform(
-      0, v8::platform::IdleTaskSupport::kEnabled, in_process_stack_dumping,
-      std::move(tracing));
+      options.thread_pool_size, v8::platform::IdleTaskSupport::kEnabled,
+      in_process_stack_dumping, std::move(tracing));
   if (i::FLAG_verify_predictable) {
     g_platform.reset(new PredictablePlatform(std::move(g_platform)));
   }
@@ -3358,8 +3336,9 @@ int Shell::Main(int argc, char* argv[]) {
     create_params.add_histogram_sample_callback = AddHistogramSample;
   }
 
-  if (i::trap_handler::IsTrapHandlerEnabled()) {
-    if (!v8::V8::RegisterDefaultSignalHandler()) {
+  if (V8_TRAP_HANDLER_SUPPORTED && i::FLAG_wasm_trap_handler) {
+    constexpr bool use_default_signal_handler = true;
+    if (!v8::V8::EnableWebAssemblyTrapHandler(use_default_signal_handler)) {
       fprintf(stderr, "Could not register signal handler");
       exit(1);
     }
@@ -3422,14 +3401,9 @@ int Shell::Main(int argc, char* argv[]) {
       result = RunMain(isolate, argc, argv, false);
 
       // Change the options to consume cache
-      if (options.compile_options == v8::ScriptCompiler::kProduceParserCache) {
-        options.compile_options = v8::ScriptCompiler::kConsumeParserCache;
-      } else {
-        DCHECK(options.compile_options == v8::ScriptCompiler::kEagerCompile ||
-               options.compile_options ==
-                   v8::ScriptCompiler::kNoCompileOptions);
-        options.compile_options = v8::ScriptCompiler::kConsumeCodeCache;
-      }
+      DCHECK(options.compile_options == v8::ScriptCompiler::kEagerCompile ||
+             options.compile_options == v8::ScriptCompiler::kNoCompileOptions);
+      options.compile_options = v8::ScriptCompiler::kConsumeCodeCache;
 
       printf("============ Run: Consume code cache ============\n");
       // Second run to consume the cache in new isolate
diff --git a/deps/v8/src/d8.h b/deps/v8/src/d8.h
index 8fc6eab0467..731b080880d 100644
--- a/deps/v8/src/d8.h
+++ b/deps/v8/src/d8.h
@@ -197,12 +197,6 @@ class SerializationData {
     return shared_array_buffer_contents_;
   }
 
-  void AppendExternalizedContentsTo(std::vector<ExternalizedContents>* to) {
-    to->insert(to->end(),
-               std::make_move_iterator(externalized_contents_.begin()),
-               std::make_move_iterator(externalized_contents_.end()));
-    externalized_contents_.clear();
-  }
 
  private:
   struct DataDeleter {
@@ -213,7 +207,6 @@ class SerializationData {
   size_t size_;
   std::vector<ArrayBuffer::Contents> array_buffer_contents_;
   std::vector<SharedArrayBuffer::Contents> shared_array_buffer_contents_;
-  std::vector<ExternalizedContents> externalized_contents_;
 
  private:
   friend class Serializer;
@@ -299,6 +292,7 @@ class ShellOptions {
         send_idle_notification(false),
         invoke_weak_callbacks(false),
         omit_quit(false),
+        wait_for_wasm(true),
         stress_opt(false),
         stress_deopt(false),
         stress_runs(1),
@@ -334,6 +328,7 @@ class ShellOptions {
   bool send_idle_notification;
   bool invoke_weak_callbacks;
   bool omit_quit;
+  bool wait_for_wasm;
   bool stress_opt;
   bool stress_deopt;
   int stress_runs;
@@ -358,13 +353,25 @@ class ShellOptions {
   int read_from_tcp_port;
   bool enable_os_system = false;
   bool quiet_load = false;
+  int thread_pool_size = 0;
 };
 
 class Shell : public i::AllStatic {
  public:
+  enum PrintResult : bool { kPrintResult = true, kNoPrintResult = false };
+  enum ReportExceptions : bool {
+    kReportExceptions = true,
+    kNoReportExceptions = false
+  };
+  enum ProcessMessageQueue : bool {
+    kProcessMessageQueue = true,
+    kNoProcessMessageQueue = false
+  };
+
   static bool ExecuteString(Isolate* isolate, Local<String> source,
-                            Local<Value> name, bool print_result,
-                            bool report_exceptions);
+                            Local<Value> name, PrintResult print_result,
+                            ReportExceptions report_exceptions,
+                            ProcessMessageQueue process_message_queue);
   static bool ExecuteModule(Isolate* isolate, const char* file_name);
   static void ReportException(Isolate* isolate, TryCatch* try_catch);
   static Local<String> ReadFile(Isolate* isolate, const char* name);
@@ -375,7 +382,6 @@ class Shell : public i::AllStatic {
   static void OnExit(Isolate* isolate);
   static void CollectGarbage(Isolate* isolate);
   static bool EmptyMessageQueues(Isolate* isolate);
-  static void EnsureEventLoopInitialized(Isolate* isolate);
   static void CompleteMessageLoop(Isolate* isolate);
 
   static std::unique_ptr<SerializationData> SerializeValue(
diff --git a/deps/v8/src/d8.isolate b/deps/v8/src/d8.isolate
deleted file mode 100644
index 1c9bd9e35ca..00000000000
--- a/deps/v8/src/d8.isolate
+++ /dev/null
@@ -1,16 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'command': [
-      '<(PRODUCT_DIR)/d8<(EXECUTABLE_SUFFIX)',
-    ],
-    'files': [
-      '<(PRODUCT_DIR)/d8<(EXECUTABLE_SUFFIX)',
-    ],
-  },
-  'includes': [
-    'base.isolate',
-  ],
-}
\ No newline at end of file
diff --git a/deps/v8/src/date.h b/deps/v8/src/date.h
index b8a9263d32b..d9fa13dae54 100644
--- a/deps/v8/src/date.h
+++ b/deps/v8/src/date.h
@@ -5,8 +5,6 @@
 #ifndef V8_DATE_H_
 #define V8_DATE_H_
 
-#include "src/allocation.h"
-#include "src/base/platform/platform.h"
 #include "src/base/timezone-cache.h"
 #include "src/globals.h"
 
@@ -289,4 +287,4 @@ class DateCache {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_DATE_H_
diff --git a/deps/v8/src/debug/arm64/debug-arm64.cc b/deps/v8/src/debug/arm64/debug-arm64.cc
index 47280bfbc9d..e2c3f4738d0 100644
--- a/deps/v8/src/debug/arm64/debug-arm64.cc
+++ b/deps/v8/src/debug/arm64/debug-arm64.cc
@@ -35,10 +35,9 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   // - Leave the frame.
   // - Restart the frame by calling the function.
   __ Mov(fp, x1);
-  __ AssertStackConsistency();
   __ Ldr(x1, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
 
-  __ Mov(masm->StackPointer(), Operand(fp));
+  __ Mov(sp, fp);
   __ Pop(fp, lr);  // Frame, Return address.
 
   __ Ldr(x0, FieldMemOperand(x1, JSFunction::kSharedFunctionInfoOffset));
diff --git a/deps/v8/src/debug/debug-coverage.cc b/deps/v8/src/debug/debug-coverage.cc
index 3eae96aa116..86622661aec 100644
--- a/deps/v8/src/debug/debug-coverage.cc
+++ b/deps/v8/src/debug/debug-coverage.cc
@@ -49,14 +49,14 @@ class SharedToCounterMap
 namespace {
 int StartPosition(SharedFunctionInfo* info) {
   int start = info->function_token_position();
-  if (start == kNoSourcePosition) start = info->start_position();
+  if (start == kNoSourcePosition) start = info->StartPosition();
   return start;
 }
 
 bool CompareSharedFunctionInfo(SharedFunctionInfo* a, SharedFunctionInfo* b) {
   int a_start = StartPosition(a);
   int b_start = StartPosition(b);
-  if (a_start == b_start) return a->end_position() > b->end_position();
+  if (a_start == b_start) return a->EndPosition() > b->EndPosition();
   return a_start < b_start;
 }
 
@@ -480,7 +480,7 @@ std::unique_ptr<Coverage> Coverage::Collect(
     // Use sorted list to reconstruct function nesting.
     for (SharedFunctionInfo* info : sorted) {
       int start = StartPosition(info);
-      int end = info->end_position();
+      int end = info->EndPosition();
       uint32_t count = counter_map.Get(info);
       // Find the correct outer function based on start position.
       while (!nesting.empty() && functions->at(nesting.back()).end <= start) {
diff --git a/deps/v8/src/debug/debug-evaluate.cc b/deps/v8/src/debug/debug-evaluate.cc
index e5865e639c3..d9defc778c4 100644
--- a/deps/v8/src/debug/debug-evaluate.cc
+++ b/deps/v8/src/debug/debug-evaluate.cc
@@ -21,29 +21,29 @@
 namespace v8 {
 namespace internal {
 
-static inline bool IsDebugContext(Isolate* isolate, Context* context) {
-  return context->native_context() == *isolate->debug()->debug_context();
-}
-
 MaybeHandle<Object> DebugEvaluate::Global(Isolate* isolate,
-                                          Handle<String> source) {
-  // Handle the processing of break.
-  DisableBreak disable_break_scope(isolate->debug());
+                                          Handle<String> source,
+                                          bool throw_on_side_effect) {
+  // Disable breaks in side-effect free mode.
+  DisableBreak disable_break_scope(isolate->debug(), throw_on_side_effect);
 
-  // Enter the top context from before the debugger was invoked.
-  SaveContext save(isolate);
-  SaveContext* top = &save;
-  while (top != nullptr && IsDebugContext(isolate, *top->context())) {
-    top = top->prev();
-  }
-  if (top != nullptr) isolate->set_context(*top->context());
-
-  // Get the native context now set to the top context from before the
-  // debugger was invoked.
   Handle<Context> context = isolate->native_context();
-  Handle<JSObject> receiver(context->global_proxy());
-  Handle<SharedFunctionInfo> outer_info(context->closure()->shared(), isolate);
-  return Evaluate(isolate, outer_info, context, receiver, source, false);
+  ScriptOriginOptions origin_options(false, true);
+  MaybeHandle<SharedFunctionInfo> maybe_function_info =
+      Compiler::GetSharedFunctionInfoForScript(
+          source, Compiler::ScriptDetails(isolate->factory()->empty_string()),
+          origin_options, nullptr, nullptr, ScriptCompiler::kNoCompileOptions,
+          ScriptCompiler::kNoCacheNoReason, NOT_NATIVES_CODE);
+
+  Handle<SharedFunctionInfo> shared_info;
+  if (!maybe_function_info.ToHandle(&shared_info)) return MaybeHandle<Object>();
+
+  Handle<JSFunction> fun =
+      isolate->factory()->NewFunctionFromSharedFunctionInfo(shared_info,
+                                                            context);
+  NoSideEffectScope no_side_effect(isolate, throw_on_side_effect);
+  return Execution::Call(isolate, fun,
+                         Handle<JSObject>(context->global_proxy()), 0, nullptr);
 }
 
 MaybeHandle<Object> DebugEvaluate::Local(Isolate* isolate,
@@ -77,6 +77,48 @@ MaybeHandle<Object> DebugEvaluate::Local(Isolate* isolate,
   return maybe_result;
 }
 
+MaybeHandle<Object> DebugEvaluate::WithTopmostArguments(Isolate* isolate,
+                                                        Handle<String> source) {
+  // Handle the processing of break.
+  DisableBreak disable_break_scope(isolate->debug());
+  Factory* factory = isolate->factory();
+  JavaScriptFrameIterator it(isolate);
+
+  // Get context and receiver.
+  Handle<Context> native_context(
+      Context::cast(it.frame()->context())->native_context(), isolate);
+
+  // Materialize arguments as property on an extension object.
+  Handle<JSObject> materialized = factory->NewJSObjectWithNullProto();
+  Handle<String> arguments_str = factory->arguments_string();
+  JSObject::SetOwnPropertyIgnoreAttributes(
+      materialized, arguments_str,
+      Accessors::FunctionGetArguments(it.frame(), 0), NONE)
+      .Check();
+
+  // Materialize receiver.
+  Handle<String> this_str = factory->this_string();
+  JSObject::SetOwnPropertyIgnoreAttributes(
+      materialized, this_str, Handle<Object>(it.frame()->receiver(), isolate),
+      NONE)
+      .Check();
+
+  // Use extension object in a debug-evaluate scope.
+  Handle<ScopeInfo> scope_info =
+      ScopeInfo::CreateForWithScope(isolate, Handle<ScopeInfo>::null());
+  scope_info->SetIsDebugEvaluateScope();
+  Handle<Context> evaluation_context =
+      factory->NewDebugEvaluateContext(native_context, scope_info, materialized,
+                                       Handle<Context>(), Handle<StringSet>());
+  Handle<SharedFunctionInfo> outer_info(native_context->closure()->shared(),
+                                        isolate);
+  Handle<JSObject> receiver(native_context->global_proxy());
+  const bool throw_on_side_effect = false;
+  MaybeHandle<Object> maybe_result =
+      Evaluate(isolate, outer_info, evaluation_context, receiver, source,
+               throw_on_side_effect);
+  return maybe_result;
+}
 
 // Compile and evaluate source for the given context.
 MaybeHandle<Object> DebugEvaluate::Evaluate(
@@ -273,50 +315,53 @@ bool IntrinsicHasNoSideEffect(Runtime::FunctionId id) {
 // Use macro to include both inlined and non-inlined version of an intrinsic.
 #define INTRINSIC_WHITELIST(V)           \
   /* Conversions */                      \
+  V(NumberToStringSkipCache)             \
+  V(ToBigInt)                            \
   V(ToInteger)                           \
-  V(ToObject)                            \
-  V(ToString)                            \
   V(ToLength)                            \
   V(ToNumber)                            \
-  V(NumberToStringSkipCache)             \
+  V(ToObject)                            \
+  V(ToString)                            \
   /* Type checks */                      \
-  V(IsJSReceiver)                        \
-  V(IsSmi)                               \
   V(IsArray)                             \
-  V(IsFunction)                          \
   V(IsDate)                              \
-  V(IsJSProxy)                           \
+  V(IsFunction)                          \
   V(IsJSMap)                             \
+  V(IsJSProxy)                           \
+  V(IsJSReceiver)                        \
   V(IsJSSet)                             \
   V(IsJSWeakMap)                         \
   V(IsJSWeakSet)                         \
   V(IsRegExp)                            \
+  V(IsSmi)                               \
   V(IsTypedArray)                        \
-  V(ClassOf)                             \
   /* Loads */                            \
   V(LoadLookupSlotForCall)               \
   /* Arrays */                           \
   V(ArraySpeciesConstructor)             \
-  V(NormalizeElements)                   \
+  V(EstimateNumberOfElements)            \
   V(GetArrayKeys)                        \
-  V(TrySliceSimpleNonFastElements)       \
   V(HasComplexElements)                  \
-  V(EstimateNumberOfElements)            \
+  V(NewArray)                            \
+  V(NormalizeElements)                   \
+  V(TrySliceSimpleNonFastElements)       \
+  V(TypedArrayGetBuffer)                 \
   /* Errors */                           \
+  V(NewTypeError)                        \
   V(ReThrow)                             \
+  V(ThrowCalledNonCallable)              \
+  V(ThrowInvalidStringLength)            \
+  V(ThrowIteratorResultNotAnObject)      \
   V(ThrowReferenceError)                 \
   V(ThrowSymbolIteratorInvalid)          \
-  V(ThrowIteratorResultNotAnObject)      \
-  V(NewTypeError)                        \
-  V(ThrowInvalidStringLength)            \
   /* Strings */                          \
-  V(StringIndexOf)                       \
+  V(RegExpInternalReplace)               \
   V(StringIncludes)                      \
+  V(StringIndexOf)                       \
   V(StringReplaceOneCharWithString)      \
+  V(StringSubstring)                     \
   V(StringToNumber)                      \
   V(StringTrim)                          \
-  V(SubString)                           \
-  V(RegExpInternalReplace)               \
   /* BigInts */                          \
   V(BigIntEqualToBigInt)                 \
   V(BigIntToBoolean)                     \
@@ -325,44 +370,50 @@ bool IntrinsicHasNoSideEffect(Runtime::FunctionId id) {
   V(CreateArrayLiteral)                  \
   V(CreateObjectLiteral)                 \
   V(CreateRegExpLiteral)                 \
-  /* Collections */                      \
-  V(GenericHash)                         \
   /* Called from builtins */             \
-  V(StringAdd)                           \
-  V(StringParseFloat)                    \
-  V(StringParseInt)                      \
-  V(StringCharCodeAt)                    \
-  V(StringIndexOfUnchecked)              \
-  V(StringEqual)                         \
-  V(RegExpInitializeAndCompile)          \
-  V(SymbolDescriptiveString)             \
-  V(GenerateRandomNumbers)               \
-  V(GlobalPrint)                         \
   V(AllocateInNewSpace)                  \
   V(AllocateInTargetSpace)               \
   V(AllocateSeqOneByteString)            \
   V(AllocateSeqTwoByteString)            \
-  V(ObjectCreate)                        \
-  V(ObjectHasOwnProperty)                \
-  V(ArrayIndexOf)                        \
   V(ArrayIncludes_Slow)                  \
+  V(ArrayIndexOf)                        \
   V(ArrayIsArray)                        \
-  V(ThrowTypeError)                      \
-  V(ThrowCalledOnNullOrUndefined)        \
-  V(ThrowIncompatibleMethodReceiver)     \
-  V(ThrowInvalidHint)                    \
-  V(ThrowNotDateError)                   \
-  V(ThrowRangeError)                     \
-  V(ToName)                              \
+  V(ClassOf)                             \
+  V(GenerateRandomNumbers)               \
+  V(GetFunctionName)                     \
   V(GetOwnPropertyDescriptor)            \
+  V(GlobalPrint)                         \
+  V(HasProperty)                         \
+  V(ObjectCreate)                        \
+  V(ObjectEntries)                       \
+  V(ObjectEntriesSkipFastPath)           \
+  V(ObjectHasOwnProperty)                \
+  V(ObjectValues)                        \
+  V(ObjectValuesSkipFastPath)            \
+  V(RegExpInitializeAndCompile)          \
   V(StackGuard)                          \
+  V(StringAdd)                           \
+  V(StringCharCodeAt)                    \
+  V(StringEqual)                         \
+  V(StringIndexOfUnchecked)              \
+  V(StringParseFloat)                    \
+  V(StringParseInt)                      \
+  V(SymbolDescriptiveString)             \
+  V(ThrowRangeError)                     \
+  V(ThrowTypeError)                      \
+  V(ToName)                              \
   /* Misc. */                            \
   V(Call)                                \
-  V(MaxSmi)                              \
-  V(NewObject)                           \
   V(CompleteInobjectSlackTrackingForMap) \
   V(HasInPrototypeChain)                 \
-  V(StringMaxLength)
+  V(MaxSmi)                              \
+  V(NewObject)                           \
+  V(StringMaxLength)                     \
+  /* Test */                             \
+  V(GetOptimizationStatus)               \
+  V(OptimizeFunctionOnNextCall)          \
+  V(OptimizeOsr)                         \
+  V(UnblockConcurrentRecompilation)
 
 #define CASE(Name)       \
   case Runtime::k##Name: \
@@ -383,6 +434,44 @@ bool IntrinsicHasNoSideEffect(Runtime::FunctionId id) {
 #undef INTRINSIC_WHITELIST
 }
 
+#ifdef DEBUG
+bool BuiltinToIntrinsicHasNoSideEffect(Builtins::Name builtin_id,
+                                       Runtime::FunctionId intrinsic_id) {
+  // First check the intrinsic whitelist.
+  if (IntrinsicHasNoSideEffect(intrinsic_id)) return true;
+
+// Whitelist intrinsics called from specific builtins.
+#define BUILTIN_INTRINSIC_WHITELIST(V, W)                                 \
+  /* Arrays */                                                            \
+  V(Builtins::kArrayFilter, W(CreateDataProperty))                        \
+  V(Builtins::kArrayMap, W(CreateDataProperty))                           \
+  V(Builtins::kArrayPrototypeSlice, W(CreateDataProperty) W(SetProperty)) \
+  /* TypedArrays */                                                       \
+  V(Builtins::kTypedArrayConstructor,                                     \
+    W(TypedArrayCopyElements) W(ThrowInvalidTypedArrayAlignment))         \
+  V(Builtins::kTypedArrayPrototypeFilter, W(TypedArrayCopyElements))      \
+  V(Builtins::kTypedArrayPrototypeMap, W(SetProperty))
+
+#define CASE(Builtin, ...) \
+  case Builtin:            \
+    return (__VA_ARGS__ false);
+
+#define MATCH(Intrinsic)                   \
+  intrinsic_id == Runtime::k##Intrinsic || \
+      intrinsic_id == Runtime::kInline##Intrinsic ||
+
+  switch (builtin_id) {
+    BUILTIN_INTRINSIC_WHITELIST(CASE, MATCH)
+    default:
+      return false;
+  }
+
+#undef MATCH
+#undef CASE
+#undef BUILTIN_INTRINSIC_WHITELIST
+}
+#endif  // DEBUG
+
 bool BytecodeHasNoSideEffect(interpreter::Bytecode bytecode) {
   typedef interpreter::Bytecode Bytecode;
   typedef interpreter::Bytecodes Bytecodes;
@@ -463,6 +552,7 @@ bool BytecodeHasNoSideEffect(interpreter::Bytecode bytecode) {
     case Bytecode::kToObject:
     case Bytecode::kToNumber:
     case Bytecode::kToName:
+    case Bytecode::kToString:
     // Misc.
     case Bytecode::kForInEnumerate:
     case Bytecode::kForInPrepare:
@@ -512,6 +602,7 @@ bool BuiltinHasNoSideEffect(Builtins::Name id) {
     case Builtins::kObjectPrototypePropertyIsEnumerable:
     case Builtins::kObjectPrototypeToString:
     // Array builtins.
+    case Builtins::kArrayIsArray:
     case Builtins::kArrayConstructor:
     case Builtins::kArrayIndexOf:
     case Builtins::kArrayPrototypeValues:
@@ -520,11 +611,59 @@ bool BuiltinHasNoSideEffect(Builtins::Name id) {
     case Builtins::kArrayPrototypeFind:
     case Builtins::kArrayPrototypeFindIndex:
     case Builtins::kArrayPrototypeKeys:
+    case Builtins::kArrayPrototypeSlice:
     case Builtins::kArrayForEach:
     case Builtins::kArrayEvery:
     case Builtins::kArraySome:
+    case Builtins::kArrayConcat:
+    case Builtins::kArrayFilter:
+    case Builtins::kArrayMap:
     case Builtins::kArrayReduce:
     case Builtins::kArrayReduceRight:
+    // TypedArray builtins.
+    case Builtins::kTypedArrayConstructor:
+    case Builtins::kTypedArrayPrototypeBuffer:
+    case Builtins::kTypedArrayPrototypeByteLength:
+    case Builtins::kTypedArrayPrototypeByteOffset:
+    case Builtins::kTypedArrayPrototypeLength:
+    case Builtins::kTypedArrayPrototypeEntries:
+    case Builtins::kTypedArrayPrototypeKeys:
+    case Builtins::kTypedArrayPrototypeValues:
+    case Builtins::kTypedArrayPrototypeFind:
+    case Builtins::kTypedArrayPrototypeFindIndex:
+    case Builtins::kTypedArrayPrototypeIncludes:
+    case Builtins::kTypedArrayPrototypeIndexOf:
+    case Builtins::kTypedArrayPrototypeLastIndexOf:
+    case Builtins::kTypedArrayPrototypeSlice:
+    case Builtins::kTypedArrayPrototypeSubArray:
+    case Builtins::kTypedArrayPrototypeEvery:
+    case Builtins::kTypedArrayPrototypeSome:
+    case Builtins::kTypedArrayPrototypeFilter:
+    case Builtins::kTypedArrayPrototypeMap:
+    case Builtins::kTypedArrayPrototypeReduce:
+    case Builtins::kTypedArrayPrototypeReduceRight:
+    case Builtins::kTypedArrayPrototypeForEach:
+    // ArrayBuffer builtins.
+    case Builtins::kArrayBufferConstructor:
+    case Builtins::kArrayBufferPrototypeGetByteLength:
+    case Builtins::kArrayBufferIsView:
+    case Builtins::kArrayBufferPrototypeSlice:
+    case Builtins::kReturnReceiver:
+    // DataView builtins.
+    case Builtins::kDataViewConstructor:
+    case Builtins::kDataViewPrototypeGetBuffer:
+    case Builtins::kDataViewPrototypeGetByteLength:
+    case Builtins::kDataViewPrototypeGetByteOffset:
+    case Builtins::kDataViewPrototypeGetInt8:
+    case Builtins::kDataViewPrototypeGetUint8:
+    case Builtins::kDataViewPrototypeGetInt16:
+    case Builtins::kDataViewPrototypeGetUint16:
+    case Builtins::kDataViewPrototypeGetInt32:
+    case Builtins::kDataViewPrototypeGetUint32:
+    case Builtins::kDataViewPrototypeGetFloat32:
+    case Builtins::kDataViewPrototypeGetFloat64:
+    case Builtins::kDataViewPrototypeGetBigInt64:
+    case Builtins::kDataViewPrototypeGetBigUint64:
     // Boolean bulitins.
     case Builtins::kBooleanConstructor:
     case Builtins::kBooleanPrototypeToString:
@@ -562,11 +701,17 @@ bool BuiltinHasNoSideEffect(Builtins::Name id) {
     case Builtins::kDatePrototypeValueOf:
     // Map builtins.
     case Builtins::kMapConstructor:
+    case Builtins::kMapPrototypeForEach:
     case Builtins::kMapPrototypeGet:
+    case Builtins::kMapPrototypeHas:
     case Builtins::kMapPrototypeEntries:
     case Builtins::kMapPrototypeGetSize:
     case Builtins::kMapPrototypeKeys:
     case Builtins::kMapPrototypeValues:
+    // WeakMap builtins.
+    case Builtins::kWeakMapConstructor:
+    case Builtins::kWeakMapGet:
+    case Builtins::kWeakMapHas:
     // Math builtins.
     case Builtins::kMathAbs:
     case Builtins::kMathAcos:
@@ -619,8 +764,13 @@ bool BuiltinHasNoSideEffect(Builtins::Name id) {
     // Set builtins.
     case Builtins::kSetConstructor:
     case Builtins::kSetPrototypeEntries:
+    case Builtins::kSetPrototypeForEach:
     case Builtins::kSetPrototypeGetSize:
+    case Builtins::kSetPrototypeHas:
     case Builtins::kSetPrototypeValues:
+    // WeakSet builtins.
+    case Builtins::kWeakSetConstructor:
+    case Builtins::kWeakSetHas:
     // String builtins. Strings are immutable.
     case Builtins::kStringFromCharCode:
     case Builtins::kStringFromCodePoint:
@@ -659,11 +809,11 @@ bool BuiltinHasNoSideEffect(Builtins::Name id) {
     case Builtins::kStringPrototypeToUpperCase:
 #endif
     case Builtins::kStringPrototypeTrim:
-    case Builtins::kStringPrototypeTrimLeft:
-    case Builtins::kStringPrototypeTrimRight:
+    case Builtins::kStringPrototypeTrimEnd:
+    case Builtins::kStringPrototypeTrimStart:
     case Builtins::kStringPrototypeValueOf:
     case Builtins::kStringToNumber:
-    case Builtins::kSubString:
+    case Builtins::kStringSubstring:
     // Symbol builtins.
     case Builtins::kSymbolConstructor:
     case Builtins::kSymbolKeyFor:
@@ -683,6 +833,7 @@ bool BuiltinHasNoSideEffect(Builtins::Name id) {
     case Builtins::kGlobalIsFinite:
     case Builtins::kGlobalIsNaN:
     // Error builtins.
+    case Builtins::kErrorConstructor:
     case Builtins::kMakeError:
     case Builtins::kMakeTypeError:
     case Builtins::kMakeSyntaxError:
@@ -698,16 +849,6 @@ bool BuiltinHasNoSideEffect(Builtins::Name id) {
   }
 }
 
-static const Address accessors_with_no_side_effect[] = {
-    // Whitelist for accessors.
-    FUNCTION_ADDR(Accessors::StringLengthGetter),
-    FUNCTION_ADDR(Accessors::ArrayLengthGetter),
-    FUNCTION_ADDR(Accessors::FunctionLengthGetter),
-    FUNCTION_ADDR(Accessors::FunctionNameGetter),
-    FUNCTION_ADDR(Accessors::BoundFunctionLengthGetter),
-    FUNCTION_ADDR(Accessors::BoundFunctionNameGetter),
-};
-
 }  // anonymous namespace
 
 // static
@@ -744,9 +885,8 @@ bool DebugEvaluate::FunctionHasNoSideEffect(Handle<SharedFunctionInfo> info) {
     return true;
   } else {
     // Check built-ins against whitelist.
-    int builtin_index = info->HasLazyDeserializationBuiltinId()
-                            ? info->lazy_deserialization_builtin_id()
-                            : info->code()->builtin_index();
+    int builtin_index =
+        info->HasBuiltinId() ? info->builtin_id() : Builtins::kNoBuiltinId;
     DCHECK_NE(Builtins::kDeserializeLazy, builtin_index);
     if (Builtins::IsBuiltinId(builtin_index) &&
         BuiltinHasNoSideEffect(static_cast<Builtins::Name>(builtin_index))) {
@@ -759,11 +899,6 @@ bool DebugEvaluate::FunctionHasNoSideEffect(Handle<SharedFunctionInfo> info) {
         DCHECK(Builtins::IsLazy(builtin_index));
         DCHECK_EQ(Builtins::TFJ, Builtins::KindOf(builtin_index));
 
-        if (FLAG_trace_lazy_deserialization) {
-          PrintF("Lazy-deserializing builtin %s\n",
-                 Builtins::name(builtin_index));
-        }
-
         code = Snapshot::DeserializeBuiltin(isolate, builtin_index);
         DCHECK_NE(Builtins::kDeserializeLazy, code->builtin_index());
       }
@@ -775,7 +910,9 @@ bool DebugEvaluate::FunctionHasNoSideEffect(Handle<SharedFunctionInfo> info) {
         Address address = rinfo->target_external_reference();
         const Runtime::Function* function = Runtime::FunctionForEntry(address);
         if (function == nullptr) continue;
-        if (!IntrinsicHasNoSideEffect(function->function_id)) {
+        if (!BuiltinToIntrinsicHasNoSideEffect(
+                static_cast<Builtins::Name>(builtin_index),
+                function->function_id)) {
           PrintF("Whitelisted builtin %s calls non-whitelisted intrinsic %s\n",
                  Builtins::name(builtin_index), function->name);
           failed = true;
@@ -791,14 +928,23 @@ bool DebugEvaluate::FunctionHasNoSideEffect(Handle<SharedFunctionInfo> info) {
 }
 
 // static
-bool DebugEvaluate::CallbackHasNoSideEffect(Address function_addr) {
-  for (size_t i = 0; i < arraysize(accessors_with_no_side_effect); i++) {
-    if (function_addr == accessors_with_no_side_effect[i]) return true;
-  }
-
-  if (FLAG_trace_side_effect_free_debug_evaluate) {
-    PrintF("[debug-evaluate] API Callback at %p may cause side effect.\n",
-           reinterpret_cast<void*>(function_addr));
+bool DebugEvaluate::CallbackHasNoSideEffect(Object* callback_info) {
+  DisallowHeapAllocation no_gc;
+  if (callback_info->IsAccessorInfo()) {
+    // List of whitelisted internal accessors can be found in accessors.h.
+    AccessorInfo* info = AccessorInfo::cast(callback_info);
+    if (info->has_no_side_effect()) return true;
+    if (FLAG_trace_side_effect_free_debug_evaluate) {
+      PrintF("[debug-evaluate] API Callback '");
+      info->name()->ShortPrint();
+      PrintF("' may cause side effect.\n");
+    }
+  } else if (callback_info->IsInterceptorInfo()) {
+    InterceptorInfo* info = InterceptorInfo::cast(callback_info);
+    if (info->has_no_side_effect()) return true;
+    if (FLAG_trace_side_effect_free_debug_evaluate) {
+      PrintF("[debug-evaluate] API Interceptor may cause side effect.\n");
+    }
   }
   return false;
 }
diff --git a/deps/v8/src/debug/debug-evaluate.h b/deps/v8/src/debug/debug-evaluate.h
index fbe747d0241..345749a9c15 100644
--- a/deps/v8/src/debug/debug-evaluate.h
+++ b/deps/v8/src/debug/debug-evaluate.h
@@ -18,7 +18,8 @@ class FrameInspector;
 
 class DebugEvaluate : public AllStatic {
  public:
-  static MaybeHandle<Object> Global(Isolate* isolate, Handle<String> source);
+  static MaybeHandle<Object> Global(Isolate* isolate, Handle<String> source,
+                                    bool throw_on_side_effect);
 
   // Evaluate a piece of JavaScript in the context of a stack frame for
   // debugging.  Things that need special attention are:
@@ -30,8 +31,14 @@ class DebugEvaluate : public AllStatic {
                                    Handle<String> source,
                                    bool throw_on_side_effect);
 
+  // This is used for break-at-entry for builtins and API functions.
+  // Evaluate a piece of JavaScript in the native context, but with the
+  // materialized arguments object and receiver of the current call.
+  static MaybeHandle<Object> WithTopmostArguments(Isolate* isolate,
+                                                  Handle<String> source);
+
   static bool FunctionHasNoSideEffect(Handle<SharedFunctionInfo> info);
-  static bool CallbackHasNoSideEffect(Address function_addr);
+  static bool CallbackHasNoSideEffect(Object* callback_info);
 
  private:
   // This class builds a context chain for evaluation of expressions
diff --git a/deps/v8/src/debug/debug-frames.cc b/deps/v8/src/debug/debug-frames.cc
index 70f3670ee43..a7426eb96e9 100644
--- a/deps/v8/src/debug/debug-frames.cc
+++ b/deps/v8/src/debug/debug-frames.cc
@@ -43,8 +43,9 @@ FrameInspector::FrameInspector(StandardFrame* frame, int inlined_frame_index,
         js_frame, inlined_frame_index, isolate));
   } else if (frame_->is_wasm_interpreter_entry()) {
     wasm_interpreted_frame_ =
-        summary.AsWasm().wasm_instance()->debug_info()->GetInterpretedFrame(
-            frame_->fp(), inlined_frame_index);
+        WasmInterpreterEntryFrame::cast(frame_)
+            ->debug_info()
+            ->GetInterpretedFrame(frame_->fp(), inlined_frame_index);
     DCHECK(wasm_interpreted_frame_);
   }
 }
diff --git a/deps/v8/src/debug/debug-interface.h b/deps/v8/src/debug/debug-interface.h
index c8c1e76ef23..b3f3ad917c1 100644
--- a/deps/v8/src/debug/debug-interface.h
+++ b/deps/v8/src/debug/debug-interface.h
@@ -5,7 +5,7 @@
 #ifndef V8_DEBUG_DEBUG_INTERFACE_H_
 #define V8_DEBUG_DEBUG_INTERFACE_H_
 
-#include "include/v8-debug.h"
+#include "include/v8-inspector.h"
 #include "include/v8-util.h"
 #include "include/v8.h"
 
@@ -30,6 +30,9 @@ namespace debug {
 void SetContextId(Local<Context> context, int id);
 int GetContextId(Local<Context> context);
 
+void SetInspector(Isolate* isolate, v8_inspector::V8Inspector*);
+v8_inspector::V8Inspector* GetInspector(Isolate* isolate);
+
 /**
  * Debugger is running in its own context which is entered while debugger
  * messages are being dispatched. This is an explicit getter for this
@@ -120,8 +123,11 @@ bool AllFramesOnStackAreBlackboxed(Isolate* isolate);
  * \param data the parameter provided during callback installation.
  */
 typedef void (*OutOfMemoryCallback)(void* data);
-void SetOutOfMemoryCallback(Isolate* isolate, OutOfMemoryCallback callback,
-                            void* data);
+
+V8_DEPRECATED("Use v8::Isolate::AddNearHeapLimitCallback",
+              void SetOutOfMemoryCallback(Isolate* isolate,
+                                          OutOfMemoryCallback callback,
+                                          void* data));
 
 /**
  * Native wrapper around v8::internal::Script object.
@@ -167,6 +173,7 @@ class WasmScript : public Script {
   std::pair<int, int> GetFunctionRange(int function_index) const;
 
   debug::WasmDisassembly DisassembleFunction(int function_index) const;
+  uint32_t GetFunctionHash(int function_index);
 };
 
 void GetLoadedScripts(Isolate* isolate, PersistentValueVector<Script>& scripts);
@@ -181,12 +188,10 @@ class DebugDelegate {
                                     bool is_blackboxed) {}
   virtual void ScriptCompiled(v8::Local<Script> script, bool is_live_edited,
                               bool has_compile_error) {}
-  // |break_points_hit| contains installed by JS debug API breakpoint objects.
   // |inspector_break_points_hit| contains id of breakpoints installed with
   // debug::Script::SetBreakpoint API.
   virtual void BreakProgramRequested(
       v8::Local<v8::Context> paused_context, v8::Local<v8::Object> exec_state,
-      v8::Local<v8::Value> break_points_hit,
       const std::vector<debug::BreakpointId>& inspector_break_points_hit) {}
   virtual void ExceptionThrown(v8::Local<v8::Context> paused_context,
                                v8::Local<v8::Object> exec_state,
@@ -500,6 +505,15 @@ int GetNativeAccessorDescriptor(v8::Local<v8::Context> context,
 
 int64_t GetNextRandomInt64(v8::Isolate* isolate);
 
+v8::MaybeLocal<v8::Value> EvaluateGlobal(v8::Isolate* isolate,
+                                         v8::Local<v8::String> source,
+                                         bool throw_on_side_effect);
+
+int GetDebuggingId(v8::Local<v8::Function> function);
+
+bool SetFunctionBreakpoint(v8::Local<v8::Function> function,
+                           v8::Local<v8::String> condition, BreakpointId* id);
+
 }  // namespace debug
 }  // namespace v8
 
diff --git a/deps/v8/src/debug/debug-scope-iterator.cc b/deps/v8/src/debug/debug-scope-iterator.cc
index 2e06dccab68..9d843ed17ee 100644
--- a/deps/v8/src/debug/debug-scope-iterator.cc
+++ b/deps/v8/src/debug/debug-scope-iterator.cc
@@ -176,8 +176,7 @@ v8::debug::ScopeIterator::ScopeType DebugWasmScopeIterator::GetType() {
 v8::Local<v8::Object> DebugWasmScopeIterator::GetObject() {
   DCHECK(!Done());
   Handle<WasmDebugInfo> debug_info(
-      WasmInterpreterEntryFrame::cast(frame_)->wasm_instance()->debug_info(),
-      isolate_);
+      WasmInterpreterEntryFrame::cast(frame_)->debug_info(), isolate_);
   switch (type_) {
     case debug::ScopeIterator::ScopeTypeGlobal:
       return Utils::ToLocal(WasmDebugInfo::GetGlobalScopeObject(
diff --git a/deps/v8/src/debug/debug-scopes.cc b/deps/v8/src/debug/debug-scopes.cc
index 77654de6353..b310bfb03be 100644
--- a/deps/v8/src/debug/debug-scopes.cc
+++ b/deps/v8/src/debug/debug-scopes.cc
@@ -82,9 +82,8 @@ void ScopeIterator::TryParseAndRetrieveScopes(ScopeIterator::Option option) {
       }
     }
     if (scope_info->scope_type() == FUNCTION_SCOPE) {
-      nested_scope_chain_.emplace_back(scope_info,
-                                       shared_info->start_position(),
-                                       shared_info->end_position());
+      nested_scope_chain_.emplace_back(scope_info, shared_info->StartPosition(),
+                                       shared_info->EndPosition());
     }
     if (!collect_non_locals) return;
   }
@@ -121,10 +120,11 @@ void ScopeIterator::TryParseAndRetrieveScopes(ScopeIterator::Option option) {
       CollectNonLocals(info.get(), scope);
     }
     if (!ignore_nested_scopes) {
-      DeclarationScope::Analyze(info.get());
-      DeclarationScope::AllocateScopeInfos(info.get(), isolate_,
-                                           AnalyzeMode::kDebugger);
-      RetrieveScopeChain(scope);
+      if (DeclarationScope::Analyze(info.get())) {
+        DeclarationScope::AllocateScopeInfos(info.get(), isolate_,
+                                             AnalyzeMode::kDebugger);
+        RetrieveScopeChain(scope);
+      }
     }
   } else {
     // A failed reparse indicates that the preparser has diverged from the
@@ -218,7 +218,7 @@ int ScopeIterator::start_position() {
   }
   if (!HasContext()) return 0;
   Handle<JSFunction> js_function = handle(CurrentContext()->closure());
-  return js_function.is_null() ? 0 : js_function->shared()->start_position();
+  return js_function.is_null() ? 0 : js_function->shared()->StartPosition();
 }
 
 int ScopeIterator::end_position() {
@@ -227,7 +227,7 @@ int ScopeIterator::end_position() {
   }
   if (!HasContext()) return 0;
   Handle<JSFunction> js_function = handle(CurrentContext()->closure());
-  return js_function.is_null() ? 0 : js_function->shared()->end_position();
+  return js_function.is_null() ? 0 : js_function->shared()->EndPosition();
 }
 
 void ScopeIterator::Next() {
@@ -956,8 +956,8 @@ void ScopeIterator::GetNestedScopeChain(Isolate* isolate, Scope* scope,
     // Do not collect scopes of nested inner functions inside the current one.
     // Nested arrow functions could have the same end positions.
     Handle<JSFunction> function = GetFunction();
-    if (scope->start_position() > function->shared()->start_position() &&
-        scope->end_position() <= function->shared()->end_position()) {
+    if (scope->start_position() > function->shared()->StartPosition() &&
+        scope->end_position() <= function->shared()->EndPosition()) {
       return;
     }
   }
diff --git a/deps/v8/src/debug/debug-type-profile.cc b/deps/v8/src/debug/debug-type-profile.cc
index 6288c11b94f..cc30ddee61d 100644
--- a/deps/v8/src/debug/debug-type-profile.cc
+++ b/deps/v8/src/debug/debug-type-profile.cc
@@ -50,7 +50,7 @@ std::unique_ptr<TypeProfile> TypeProfile::Collect(Isolate* isolate) {
         continue;
       }
       FeedbackSlot slot = vector->GetTypeProfileSlot();
-      CollectTypeProfileNexus nexus(vector, slot);
+      FeedbackNexus nexus(vector, slot);
       Handle<String> name(info->DebugName(), isolate);
       std::vector<int> source_positions = nexus.GetSourcePositions();
       for (int position : source_positions) {
@@ -60,7 +60,7 @@ std::unique_ptr<TypeProfile> TypeProfile::Collect(Isolate* isolate) {
       }
 
       // Releases type profile data collected so far.
-      nexus.Clear();
+      nexus.ResetTypeProfile();
     }
     if (!entries->empty()) {
       result->emplace_back(type_profile_script);
@@ -91,8 +91,8 @@ void TypeProfile::SelectMode(Isolate* isolate, debug::TypeProfile::Mode mode) {
         DCHECK(info->IsSubjectToDebugging());
         if (info->feedback_metadata()->HasTypeProfileSlot()) {
           FeedbackSlot slot = vector->GetTypeProfileSlot();
-          CollectTypeProfileNexus nexus(vector, slot);
-          nexus.Clear();
+          FeedbackNexus nexus(vector, slot);
+          nexus.ResetTypeProfile();
         }
       }
 
diff --git a/deps/v8/src/debug/debug.cc b/deps/v8/src/debug/debug.cc
index c087a0868c5..753220bef51 100644
--- a/deps/v8/src/debug/debug.cc
+++ b/deps/v8/src/debug/debug.cc
@@ -10,9 +10,9 @@
 #include "src/arguments.h"
 #include "src/assembler-inl.h"
 #include "src/bootstrapper.h"
+#include "src/builtins/builtins.h"
 #include "src/code-stubs.h"
 #include "src/compilation-cache.h"
-#include "src/compiler-dispatcher/optimizing-compile-dispatcher.h"
 #include "src/compiler.h"
 #include "src/debug/debug-evaluate.h"
 #include "src/debug/liveedit.h"
@@ -21,16 +21,16 @@
 #include "src/frames-inl.h"
 #include "src/global-handles.h"
 #include "src/globals.h"
+#include "src/interpreter/bytecode-array-accessor.h"
 #include "src/interpreter/interpreter.h"
 #include "src/isolate-inl.h"
 #include "src/log.h"
 #include "src/messages.h"
 #include "src/objects/debug-objects-inl.h"
 #include "src/snapshot/natives.h"
+#include "src/snapshot/snapshot.h"
 #include "src/wasm/wasm-objects-inl.h"
 
-#include "include/v8-debug.h"
-
 namespace v8 {
 namespace internal {
 
@@ -53,6 +53,9 @@ Debug::Debug(Isolate* isolate)
 
 BreakLocation BreakLocation::FromFrame(Handle<DebugInfo> debug_info,
                                        JavaScriptFrame* frame) {
+  if (debug_info->CanBreakAtEntry()) {
+    return BreakLocation(Debug::kBreakAtEntryPosition, DEBUG_BREAK_AT_ENTRY);
+  }
   auto summary = FrameSummary::GetTop(frame).AsJavaScript();
   int offset = summary.code_offset();
   Handle<AbstractCode> abstract_code = summary.abstract_code();
@@ -64,6 +67,7 @@ BreakLocation BreakLocation::FromFrame(Handle<DebugInfo> debug_info,
 void BreakLocation::AllAtCurrentStatement(
     Handle<DebugInfo> debug_info, JavaScriptFrame* frame,
     std::vector<BreakLocation>* result_out) {
+  DCHECK(!debug_info->CanBreakAtEntry());
   auto summary = FrameSummary::GetTop(frame).AsJavaScript();
   int offset = summary.code_offset();
   Handle<AbstractCode> abstract_code = summary.abstract_code();
@@ -81,6 +85,18 @@ void BreakLocation::AllAtCurrentStatement(
   }
 }
 
+JSGeneratorObject* BreakLocation::GetGeneratorObjectForSuspendedFrame(
+    JavaScriptFrame* frame) const {
+  DCHECK(IsSuspend());
+  DCHECK_GE(generator_obj_reg_index_, 0);
+
+  Object* generator_obj =
+      InterpretedFrame::cast(frame)->ReadInterpreterRegister(
+          generator_obj_reg_index_);
+
+  return JSGeneratorObject::cast(generator_obj);
+}
+
 int BreakLocation::BreakIndexFromCodeOffset(Handle<DebugInfo> debug_info,
                                             Handle<AbstractCode> abstract_code,
                                             int offset) {
@@ -103,13 +119,18 @@ int BreakLocation::BreakIndexFromCodeOffset(Handle<DebugInfo> debug_info,
 bool BreakLocation::HasBreakPoint(Handle<DebugInfo> debug_info) const {
   // First check whether there is a break point with the same source position.
   if (!debug_info->HasBreakPoint(position_)) return false;
-  // Then check whether a break point at that source position would have
-  // the same code offset. Otherwise it's just a break location that we can
-  // step to, but not actually a location where we can put a break point.
-  DCHECK(abstract_code_->IsBytecodeArray());
-  BreakIterator it(debug_info);
-  it.SkipToPosition(position_);
-  return it.code_offset() == code_offset_;
+  if (debug_info->CanBreakAtEntry()) {
+    DCHECK_EQ(Debug::kBreakAtEntryPosition, position_);
+    return debug_info->BreakAtEntry();
+  } else {
+    // Then check whether a break point at that source position would have
+    // the same code offset. Otherwise it's just a break location that we can
+    // step to, but not actually a location where we can put a break point.
+    DCHECK(abstract_code_->IsBytecodeArray());
+    BreakIterator it(debug_info);
+    it.SkipToPosition(position_);
+    return it.code_offset() == code_offset_;
+  }
 }
 
 debug::BreakLocationType BreakLocation::type() const {
@@ -120,10 +141,12 @@ debug::BreakLocationType BreakLocation::type() const {
       return debug::kCallBreakLocation;
     case DEBUG_BREAK_SLOT_AT_RETURN:
       return debug::kReturnBreakLocation;
+
+    // Externally, suspend breaks should look like normal breaks.
+    case DEBUG_BREAK_SLOT_AT_SUSPEND:
     default:
       return debug::kCommonBreakLocation;
   }
-  return debug::kCommonBreakLocation;
 }
 
 BreakIterator::BreakIterator(Handle<DebugInfo> debug_info)
@@ -131,7 +154,7 @@ BreakIterator::BreakIterator(Handle<DebugInfo> debug_info)
       break_index_(-1),
       source_position_iterator_(
           debug_info->DebugBytecodeArray()->SourcePositionTable()) {
-  position_ = debug_info->shared()->start_position();
+  position_ = debug_info->shared()->StartPosition();
   statement_position_ = position_;
   // There is at least one break location.
   DCHECK(!Done());
@@ -181,10 +204,18 @@ DebugBreakType BreakIterator::GetDebugBreakType() {
   interpreter::Bytecode bytecode =
       interpreter::Bytecodes::FromByte(bytecode_array->get(code_offset()));
 
+  // Make sure we read the actual bytecode, not a prefix scaling bytecode.
+  if (interpreter::Bytecodes::IsPrefixScalingBytecode(bytecode)) {
+    bytecode = interpreter::Bytecodes::FromByte(
+        bytecode_array->get(code_offset() + 1));
+  }
+
   if (bytecode == interpreter::Bytecode::kDebugger) {
     return DEBUGGER_STATEMENT;
   } else if (bytecode == interpreter::Bytecode::kReturn) {
     return DEBUG_BREAK_SLOT_AT_RETURN;
+  } else if (bytecode == interpreter::Bytecode::kSuspendGenerator) {
+    return DEBUG_BREAK_SLOT_AT_SUSPEND;
   } else if (interpreter::Bytecodes::IsCallOrConstruct(bytecode)) {
     return DEBUG_BREAK_SLOT_AT_CALL;
   } else if (source_position_iterator_.is_statement()) {
@@ -225,7 +256,25 @@ void BreakIterator::ClearDebugBreak() {
 BreakLocation BreakIterator::GetBreakLocation() {
   Handle<AbstractCode> code(
       AbstractCode::cast(debug_info_->DebugBytecodeArray()));
-  return BreakLocation(code, GetDebugBreakType(), code_offset(), position_);
+  DebugBreakType type = GetDebugBreakType();
+  int generator_object_reg_index = -1;
+  if (type == DEBUG_BREAK_SLOT_AT_SUSPEND) {
+    // For suspend break, we'll need the generator object to be able to step
+    // over the suspend as if it didn't return. We get the interpreter register
+    // index that holds the generator object by reading it directly off the
+    // bytecode array, and we'll read the actual generator object off the
+    // interpreter stack frame in GetGeneratorObjectForSuspendedFrame.
+    BytecodeArray* bytecode_array = debug_info_->OriginalBytecodeArray();
+    interpreter::BytecodeArrayAccessor accessor(handle(bytecode_array),
+                                                code_offset());
+
+    DCHECK_EQ(accessor.current_bytecode(),
+              interpreter::Bytecode::kSuspendGenerator);
+    interpreter::Register generator_obj_reg = accessor.GetRegisterOperand(0);
+    generator_object_reg_index = generator_obj_reg.index();
+  }
+  return BreakLocation(code, type, code_offset(), position_,
+                       generator_object_reg_index);
 }
 
 
@@ -276,9 +325,11 @@ char* Debug::RestoreDebug(char* storage) {
 int Debug::ArchiveSpacePerThread() { return 0; }
 
 void Debug::Iterate(RootVisitor* v) {
-  v->VisitRootPointer(Root::kDebug, &thread_local_.return_value_);
-  v->VisitRootPointer(Root::kDebug, &thread_local_.suspended_generator_);
-  v->VisitRootPointer(Root::kDebug, &thread_local_.ignore_step_into_function_);
+  v->VisitRootPointer(Root::kDebug, nullptr, &thread_local_.return_value_);
+  v->VisitRootPointer(Root::kDebug, nullptr,
+                      &thread_local_.suspended_generator_);
+  v->VisitRootPointer(Root::kDebug, nullptr,
+                      &thread_local_.ignore_step_into_function_);
 }
 
 DebugInfoListNode::DebugInfoListNode(DebugInfo* debug_info) : next_(nullptr) {
@@ -325,6 +376,9 @@ bool Debug::Load() {
   if (context.is_null()) return false;
 
   debug_context_ = isolate_->global_handles()->Create(*context);
+  GlobalHandles::AnnotateStrongRetainer(
+      Handle<Object>::cast(debug_context_).location(),
+      "v8::internal::Debug::debug_context_");
 
   feature_tracker()->Track(DebugFeatureTracker::kActive);
 
@@ -346,7 +400,7 @@ void Debug::Unload() {
   debug_context_ = Handle<Context>();
 }
 
-void Debug::Break(JavaScriptFrame* frame) {
+void Debug::Break(JavaScriptFrame* frame, Handle<JSFunction> break_target) {
   // Initialize LiveEdit.
   LiveEdit::InitializeThreadLocal(this);
 
@@ -362,8 +416,7 @@ void Debug::Break(JavaScriptFrame* frame) {
   DisableBreak no_recursive_break(this);
 
   // Return if we fail to retrieve debug info.
-  Handle<JSFunction> function(frame->function());
-  Handle<SharedFunctionInfo> shared(function->shared());
+  Handle<SharedFunctionInfo> shared(break_target->shared());
   if (!EnsureBreakInfo(shared)) return;
   Handle<DebugInfo> debug_info(shared->GetDebugInfo(), isolate_);
 
@@ -381,6 +434,14 @@ void Debug::Break(JavaScriptFrame* frame) {
     return;
   }
 
+  // Debug break at function entry, do not worry about stepping.
+  if (location.IsDebugBreakAtEntry()) {
+    DCHECK(debug_info->BreakAtEntry());
+    return;
+  }
+
+  DCHECK_NOT_NULL(frame);
+
   // No break point. Check for stepping.
   StepAction step_action = last_step_action();
   int current_frame_count = CurrentFrameCount();
@@ -390,7 +451,7 @@ void Debug::Break(JavaScriptFrame* frame) {
   // StepOut at not return position was requested and return break locations
   // were flooded with one shots.
   if (thread_local_.fast_forward_to_return_) {
-    DCHECK(location.IsReturn());
+    DCHECK(location.IsReturnOrSuspend());
     // We have to ignore recursive calls to function.
     if (current_frame_count > target_frame_count) return;
     ClearStepping();
@@ -410,8 +471,17 @@ void Debug::Break(JavaScriptFrame* frame) {
     case StepNext:
       // Step next should not break in a deeper frame than target frame.
       if (current_frame_count > target_frame_count) return;
-    // Fall through.
+      V8_FALLTHROUGH;
     case StepIn: {
+      // Special case "next" and "in" for generators that are about to suspend.
+      if (location.IsSuspend()) {
+        DCHECK(!has_suspended_generator());
+        thread_local_.suspended_generator_ =
+            location.GetGeneratorObjectForSuspendedFrame(frame);
+        ClearStepping();
+        return;
+      }
+
       FrameSummary summary = FrameSummary::GetTop(frame);
       step_break = step_break || location.IsReturn() ||
                    current_frame_count != last_frame_count ||
@@ -445,9 +515,7 @@ MaybeHandle<FixedArray> Debug::CheckBreakPoints(Handle<DebugInfo> debug_info,
   if (has_break_points) *has_break_points = has_break_points_to_check;
   if (!has_break_points_to_check) return {};
 
-  Handle<Object> break_point_objects =
-      debug_info->GetBreakPointObjects(location->position());
-  return Debug::GetHitBreakPointObjects(break_point_objects);
+  return Debug::GetHitBreakPoints(debug_info, location->position());
 }
 
 
@@ -502,58 +570,44 @@ MaybeHandle<Object> Debug::CallFunction(const char* name, int argc,
 
 
 // Check whether a single break point object is triggered.
-bool Debug::CheckBreakPoint(Handle<Object> break_point_object) {
-  Factory* factory = isolate_->factory();
+bool Debug::CheckBreakPoint(Handle<BreakPoint> break_point,
+                            bool is_break_at_entry) {
   HandleScope scope(isolate_);
 
-  // TODO(kozyatinskiy): replace this if by DCHEK once the JS debug API has been
-  // removed.
-  if (break_point_object->IsBreakPoint()) {
-    Handle<BreakPoint> break_point =
-        Handle<BreakPoint>::cast(break_point_object);
-    if (!break_point->condition()->length()) return true;
-    Handle<String> condition(break_point->condition());
-    Handle<Object> result;
+  if (!break_point->condition()->length()) return true;
+  Handle<String> condition(break_point->condition());
+  MaybeHandle<Object> maybe_result;
+  Handle<Object> result;
+
+  if (is_break_at_entry) {
+    maybe_result = DebugEvaluate::WithTopmostArguments(isolate_, condition);
+  } else {
     // Since we call CheckBreakpoint only for deoptimized frame on top of stack,
     // we can use 0 as index of inlined frame.
-    if (!DebugEvaluate::Local(isolate_, break_frame_id(),
-                              /* inlined_jsframe_index */ 0, condition, false)
-             .ToHandle(&result)) {
-      if (isolate_->has_pending_exception()) {
-        isolate_->clear_pending_exception();
-      }
-      return false;
-    }
-    return result->BooleanValue();
+    const int inlined_jsframe_index = 0;
+    const bool throw_on_side_effect = false;
+    maybe_result =
+        DebugEvaluate::Local(isolate_, break_frame_id(), inlined_jsframe_index,
+                             condition, throw_on_side_effect);
   }
 
-  // Ignore check if break point object is not a JSObject.
-  if (!break_point_object->IsJSObject()) return true;
-
-  // Get the break id as an object.
-  Handle<Object> break_id = factory->NewNumberFromInt(Debug::break_id());
-
-  // Call IsBreakPointTriggered.
-  Handle<Object> argv[] = { break_id, break_point_object };
-  Handle<Object> result;
-  if (!CallFunction("IsBreakPointTriggered", arraysize(argv), argv)
-           .ToHandle(&result)) {
+  if (!maybe_result.ToHandle(&result)) {
+    if (isolate_->has_pending_exception()) {
+      isolate_->clear_pending_exception();
+    }
     return false;
   }
-
-  // Return whether the break point is triggered.
-  return result->IsTrue(isolate_);
+  return result->BooleanValue();
 }
 
-
 bool Debug::SetBreakPoint(Handle<JSFunction> function,
-                          Handle<Object> break_point_object,
+                          Handle<BreakPoint> break_point,
                           int* source_position) {
   HandleScope scope(isolate_);
 
   // Make sure the function is compiled and has set up the debug info.
   Handle<SharedFunctionInfo> shared(function->shared());
-  if (!EnsureBreakInfo(shared)) return true;
+  if (!EnsureBreakInfo(shared)) return false;
   PrepareFunctionForBreakPoints(shared);
   Handle<DebugInfo> debug_info(shared->GetDebugInfo());
   // Source positions starts with zero.
@@ -561,7 +615,7 @@ bool Debug::SetBreakPoint(Handle<JSFunction> function,
 
   // Find the break point and change it.
   *source_position = FindBreakablePosition(debug_info, *source_position);
-  DebugInfo::SetBreakPoint(debug_info, *source_position, break_point_object);
+  DebugInfo::SetBreakPoint(debug_info, *source_position, break_point);
   // At least one active break point now.
   DCHECK_LT(0, debug_info->GetBreakPointCount());
 
@@ -573,13 +627,16 @@ bool Debug::SetBreakPoint(Handle<JSFunction> function,
 }
 
 bool Debug::SetBreakPointForScript(Handle<Script> script,
-                                   Handle<Object> break_point_object,
-                                   int* source_position) {
+                                   Handle<String> condition,
+                                   int* source_position, int* id) {
+  *id = ++thread_local_.last_breakpoint_id_;
+  Handle<BreakPoint> break_point =
+      isolate_->factory()->NewBreakPoint(*id, condition);
   if (script->type() == Script::TYPE_WASM) {
     Handle<WasmCompiledModule> compiled_module(
         WasmCompiledModule::cast(script->wasm_compiled_module()), isolate_);
     return WasmCompiledModule::SetBreakPoint(compiled_module, source_position,
-                                             break_point_object);
+                                             break_point);
   }
 
   HandleScope scope(isolate_);
@@ -596,8 +653,8 @@ bool Debug::SetBreakPointForScript(Handle<Script> script,
 
   // Find position within function. The script position might be before the
   // source position of the first function.
-  if (shared->start_position() > *source_position) {
-    *source_position = shared->start_position();
+  if (shared->StartPosition() > *source_position) {
+    *source_position = shared->StartPosition();
   }
 
   Handle<DebugInfo> debug_info(shared->GetDebugInfo());
@@ -609,7 +666,7 @@ bool Debug::SetBreakPointForScript(Handle<Script> script,
   if (breakable_position < *source_position) return false;
   *source_position = breakable_position;
 
-  DebugInfo::SetBreakPoint(debug_info, *source_position, break_point_object);
+  DebugInfo::SetBreakPoint(debug_info, *source_position, break_point);
   // At least one active break point now.
   DCHECK_LT(0, debug_info->GetBreakPointCount());
 
@@ -622,48 +679,60 @@ bool Debug::SetBreakPointForScript(Handle<Script> script,
 
 int Debug::FindBreakablePosition(Handle<DebugInfo> debug_info,
                                  int source_position) {
-  DCHECK(debug_info->HasDebugBytecodeArray());
-  BreakIterator it(debug_info);
-  it.SkipToPosition(source_position);
-  return it.position();
+  if (debug_info->CanBreakAtEntry()) {
+    return kBreakAtEntryPosition;
+  } else {
+    DCHECK(debug_info->HasDebugBytecodeArray());
+    BreakIterator it(debug_info);
+    it.SkipToPosition(source_position);
+    return it.position();
+  }
 }
 
 void Debug::ApplyBreakPoints(Handle<DebugInfo> debug_info) {
   DisallowHeapAllocation no_gc;
-  if (debug_info->break_points()->IsUndefined(isolate_)) return;
-  FixedArray* break_points = debug_info->break_points();
-  for (int i = 0; i < break_points->length(); i++) {
-    if (break_points->get(i)->IsUndefined(isolate_)) continue;
-    BreakPointInfo* info = BreakPointInfo::cast(break_points->get(i));
-    if (info->GetBreakPointCount() == 0) continue;
-    DCHECK(debug_info->HasDebugBytecodeArray());
-    BreakIterator it(debug_info);
-    it.SkipToPosition(info->source_position());
-    it.SetDebugBreak();
+  if (debug_info->CanBreakAtEntry()) {
+    debug_info->SetBreakAtEntry();
+  } else {
+    if (!debug_info->HasDebugBytecodeArray()) return;
+    FixedArray* break_points = debug_info->break_points();
+    for (int i = 0; i < break_points->length(); i++) {
+      if (break_points->get(i)->IsUndefined(isolate_)) continue;
+      BreakPointInfo* info = BreakPointInfo::cast(break_points->get(i));
+      if (info->GetBreakPointCount() == 0) continue;
+      DCHECK(debug_info->HasDebugBytecodeArray());
+      BreakIterator it(debug_info);
+      it.SkipToPosition(info->source_position());
+      it.SetDebugBreak();
+    }
   }
 }
 
 void Debug::ClearBreakPoints(Handle<DebugInfo> debug_info) {
-  // If we attempt to clear breakpoints but none exist, simply return. This can
-  // happen e.g. CoverageInfos exit but no breakpoints are set.
-  if (!debug_info->HasDebugBytecodeArray()) return;
+  if (debug_info->CanBreakAtEntry()) {
+    debug_info->ClearBreakAtEntry();
+  } else {
+    // If we attempt to clear breakpoints but none exist, simply return. This
+    // can happen e.g. CoverageInfos exist but no breakpoints are set.
+    if (!debug_info->HasDebugBytecodeArray()) return;
 
-  DisallowHeapAllocation no_gc;
-  for (BreakIterator it(debug_info); !it.Done(); it.Next()) {
-    it.ClearDebugBreak();
+    DisallowHeapAllocation no_gc;
+    for (BreakIterator it(debug_info); !it.Done(); it.Next()) {
+      it.ClearDebugBreak();
+    }
   }
 }
 
-void Debug::ClearBreakPoint(Handle<Object> break_point_object) {
+void Debug::ClearBreakPoint(Handle<BreakPoint> break_point) {
   HandleScope scope(isolate_);
 
   for (DebugInfoListNode* node = debug_info_list_; node != nullptr;
        node = node->next()) {
     Handle<Object> result =
-        DebugInfo::FindBreakPointInfo(node->debug_info(), break_point_object);
+        DebugInfo::FindBreakPointInfo(node->debug_info(), break_point);
     if (result->IsUndefined(isolate_)) continue;
     Handle<DebugInfo> debug_info = node->debug_info();
-    if (DebugInfo::ClearBreakPoint(debug_info, break_point_object)) {
+    if (DebugInfo::ClearBreakPoint(debug_info, break_point)) {
       ClearBreakPoints(debug_info);
       if (debug_info->GetBreakPointCount() == 0) {
         RemoveBreakInfoAndMaybeFree(debug_info);
@@ -675,12 +744,13 @@ void Debug::ClearBreakPoint(Handle<Object> break_point_object) {
   }
 }
 
-bool Debug::SetBreakpoint(Handle<Script> script, Handle<String> condition,
-                          int* offset, int* id) {
+bool Debug::SetBreakpointForFunction(Handle<JSFunction> function,
+                                     Handle<String> condition, int* id) {
   *id = ++thread_local_.last_breakpoint_id_;
   Handle<BreakPoint> breakpoint =
       isolate_->factory()->NewBreakPoint(*id, condition);
-  return SetBreakPointForScript(script, breakpoint, offset);
+  int source_position = 0;
+  return SetBreakPoint(function, breakpoint, &source_position);
 }
 
 void Debug::RemoveBreakpoint(int id) {
@@ -707,7 +777,7 @@ void Debug::FloodWithOneShot(Handle<SharedFunctionInfo> shared,
   // Flood the function with break points.
   DCHECK(debug_info->HasDebugBytecodeArray());
   for (BreakIterator it(debug_info); !it.Done(); it.Next()) {
-    if (returns_only && !it.GetBreakLocation().IsReturn()) continue;
+    if (returns_only && !it.GetBreakLocation().IsReturnOrSuspend()) continue;
     it.SetDebugBreak();
   }
 }
@@ -729,25 +799,31 @@ bool Debug::IsBreakOnException(ExceptionBreakType type) {
   }
 }
 
-MaybeHandle<FixedArray> Debug::GetHitBreakPointObjects(
-    Handle<Object> break_point_objects) {
-  DCHECK(!break_point_objects->IsUndefined(isolate_));
-  if (!break_point_objects->IsFixedArray()) {
-    if (!CheckBreakPoint(break_point_objects)) return {};
+MaybeHandle<FixedArray> Debug::GetHitBreakPoints(Handle<DebugInfo> debug_info,
+                                                 int position) {
+  Handle<Object> break_points = debug_info->GetBreakPoints(position);
+  bool is_break_at_entry = debug_info->BreakAtEntry();
+  DCHECK(!break_points->IsUndefined(isolate_));
+  if (!break_points->IsFixedArray()) {
+    if (!CheckBreakPoint(Handle<BreakPoint>::cast(break_points),
+                         is_break_at_entry)) {
+      return {};
+    }
     Handle<FixedArray> break_points_hit = isolate_->factory()->NewFixedArray(1);
-    break_points_hit->set(0, *break_point_objects);
+    break_points_hit->set(0, *break_points);
     return break_points_hit;
   }
 
-  Handle<FixedArray> array(FixedArray::cast(*break_point_objects));
+  Handle<FixedArray> array(FixedArray::cast(*break_points));
   int num_objects = array->length();
   Handle<FixedArray> break_points_hit =
       isolate_->factory()->NewFixedArray(num_objects);
   int break_points_hit_count = 0;
   for (int i = 0; i < num_objects; ++i) {
-    Handle<Object> break_point_object(array->get(i), isolate_);
-    if (CheckBreakPoint(break_point_object)) {
-      break_points_hit->set(break_points_hit_count++, *break_point_object);
+    Handle<Object> break_point(array->get(i), isolate_);
+    if (CheckBreakPoint(Handle<BreakPoint>::cast(break_point),
+                        is_break_at_entry)) {
+      break_points_hit->set(break_points_hit_count++, *break_point);
     }
   }
   if (break_points_hit_count == 0) return {};
@@ -824,11 +900,10 @@ void Debug::PrepareStepOnThrow() {
         if (summaries.size() > 1) {
           Handle<AbstractCode> code = summary.AsJavaScript().abstract_code();
           CHECK_EQ(AbstractCode::INTERPRETED_FUNCTION, code->kind());
-          BytecodeArray* bytecode = code->GetBytecodeArray();
-          HandlerTable* table = HandlerTable::cast(bytecode->handler_table());
+          HandlerTable table(code->GetBytecodeArray());
           int code_offset = summary.code_offset();
           HandlerTable::CatchPrediction prediction;
-          int index = table->LookupRange(code_offset, nullptr, &prediction);
+          int index = table.LookupRange(code_offset, nullptr, &prediction);
           if (index > 0) found_handler = true;
         } else {
           found_handler = true;
@@ -879,7 +954,7 @@ void Debug::PrepareStep(StepAction step_action) {
     if (frame->is_wasm_compiled()) return;
     WasmInterpreterEntryFrame* wasm_frame =
         WasmInterpreterEntryFrame::cast(frame);
-    wasm_frame->wasm_instance()->debug_info()->PrepareStep(step_action);
+    wasm_frame->debug_info()->PrepareStep(step_action);
     return;
   }
 
@@ -895,9 +970,9 @@ void Debug::PrepareStep(StepAction step_action) {
 
   BreakLocation location = BreakLocation::FromFrame(debug_info, js_frame);
 
-  // Any step at a return is a step-out and we need to schedule DebugOnFunction
-  // call callback.
-  if (location.IsReturn()) {
+  // Any step at a return is a step-out, and a step-out at a suspend behaves
+  // like a return.
+  if (location.IsReturn() || (location.IsSuspend() && step_action == StepOut)) {
     // On StepOut we'll ignore our further calls to current function in
     // PrepareStepIn callback.
     if (last_step_action() == StepOut) {
@@ -906,6 +981,8 @@ void Debug::PrepareStep(StepAction step_action) {
     step_action = StepOut;
     thread_local_.last_step_action_ = StepIn;
   }
+
+  // We need to schedule DebugOnFunction call callback
   UpdateHookOnFunctionCall();
 
   // A step-next in blackboxed function is a step-out.
@@ -926,7 +1003,7 @@ void Debug::PrepareStep(StepAction step_action) {
       // Clear last position info. For stepping out it does not matter.
       thread_local_.last_statement_position_ = kNoSourcePosition;
       thread_local_.last_frame_count_ = -1;
-      if (!location.IsReturn() && !IsBlackboxed(shared)) {
+      if (!location.IsReturnOrSuspend() && !IsBlackboxed(shared)) {
         // At not return position we flood return positions with one shots and
         // will repeat StepOut automatically at next break.
         thread_local_.target_frame_count_ = current_frame_count;
@@ -966,7 +1043,7 @@ void Debug::PrepareStep(StepAction step_action) {
     }
     case StepNext:
       thread_local_.target_frame_count_ = current_frame_count;
-    // Fall through.
+      V8_FALLTHROUGH;
     case StepIn:
       // TODO(clemensh): Implement stepping from JS into wasm.
       FloodWithOneShot(shared);
@@ -1060,10 +1137,7 @@ class RedirectActiveFunctions : public ThreadVisitor {
 void Debug::DeoptimizeFunction(Handle<SharedFunctionInfo> shared) {
   // Deoptimize all code compiled from this shared function info including
   // inlining.
-  if (isolate_->concurrent_recompilation_enabled()) {
-    isolate_->optimizing_compile_dispatcher()->Flush(
-        OptimizingCompileDispatcher::BlockingBehavior::kBlock);
-  }
+  isolate_->AbortConcurrentOptimization(BlockingBehavior::kBlock);
 
   // Make sure we abort incremental marking.
   isolate_->heap()->CollectAllGarbage(Heap::kMakeHeapIterableMask,
@@ -1094,16 +1168,73 @@ void Debug::PrepareFunctionForBreakPoints(Handle<SharedFunctionInfo> shared) {
   Handle<DebugInfo> debug_info = GetOrCreateDebugInfo(shared);
   if (debug_info->IsPreparedForBreakpoints()) return;
 
-  DeoptimizeFunction(shared);
-  // Update PCs on the stack to point to recompiled code.
-  RedirectActiveFunctions redirect_visitor(*shared);
-  redirect_visitor.VisitThread(isolate_, isolate_->thread_local_top());
-  isolate_->thread_manager()->IterateArchivedThreads(&redirect_visitor);
+  if (debug_info->CanBreakAtEntry()) {
+    // Deopt everything in case the function is inlined anywhere.
+    Deoptimizer::DeoptimizeAll(isolate_);
+    InstallDebugBreakTrampoline();
+  } else {
+    DeoptimizeFunction(shared);
+    // Update PCs on the stack to point to recompiled code.
+    RedirectActiveFunctions redirect_visitor(*shared);
+    redirect_visitor.VisitThread(isolate_, isolate_->thread_local_top());
+    isolate_->thread_manager()->IterateArchivedThreads(&redirect_visitor);
+  }
 
   debug_info->set_flags(debug_info->flags() |
                         DebugInfo::kPreparedForBreakpoints);
 }
 
+void Debug::InstallDebugBreakTrampoline() {
+  // Check the list of debug infos whether the debug break trampoline needs to
+  // be installed. If that's the case, iterate the heap for functions to rewire
+  // to the trampoline.
+  HandleScope scope(isolate_);
+  // If there is a breakpoint at function entry, we need to install trampoline.
+  bool needs_to_use_trampoline = false;
+  // If there we break at entry to an api callback, we need to clear ICs.
+  bool needs_to_clear_ic = false;
+  for (DebugInfoListNode* current = debug_info_list_; current != nullptr;
+       current = current->next()) {
+    if (current->debug_info()->CanBreakAtEntry()) {
+      needs_to_use_trampoline = true;
+      if (current->debug_info()->shared()->IsApiFunction()) {
+        needs_to_clear_ic = true;
+        break;
+      }
+    }
+  }
+
+  if (!needs_to_use_trampoline) return;
+
+  Handle<Code> trampoline = BUILTIN_CODE(isolate_, DebugBreakTrampoline);
+  std::vector<Handle<JSFunction>> needs_compile;
+  {
+    HeapIterator iterator(isolate_->heap());
+    while (HeapObject* obj = iterator.next()) {
+      if (needs_to_clear_ic && obj->IsFeedbackVector()) {
+        FeedbackVector::cast(obj)->ClearSlots(isolate_);
+        continue;
+      } else if (obj->IsJSFunction()) {
+        JSFunction* fun = JSFunction::cast(obj);
+        SharedFunctionInfo* shared = fun->shared();
+        if (!shared->HasDebugInfo()) continue;
+        if (!shared->GetDebugInfo()->CanBreakAtEntry()) continue;
+        if (!fun->is_compiled()) {
+          needs_compile.push_back(handle(fun));
+        } else {
+          fun->set_code(*trampoline);
+        }
+      }
+    }
+  }
+  // By overwriting the function code with DebugBreakTrampoline, which tailcalls
+  // to shared code, we bypass CompileLazy. Perform CompileLazy here instead.
+  for (Handle<JSFunction> fun : needs_compile) {
+    Compiler::Compile(fun, Compiler::CLEAR_EXCEPTION);
+    fun->set_code(*trampoline);
+  }
+}
+
 namespace {
 template <typename Iterator>
 void GetBreakablePositions(Iterator* it, int start_position, int end_position,
@@ -1149,8 +1280,8 @@ bool Debug::GetPossibleBreakpoints(Handle<Script> script, int start_position,
     SharedFunctionInfo::ScriptIterator iterator(script);
     for (SharedFunctionInfo* info = iterator.Next(); info != nullptr;
          info = iterator.Next()) {
-      if (info->end_position() < start_position ||
-          info->start_position() >= end_position) {
+      if (info->EndPosition() < start_position ||
+          info->StartPosition() >= end_position) {
         continue;
       }
       if (!info->IsSubjectToDebugging()) continue;
@@ -1184,19 +1315,6 @@ bool Debug::GetPossibleBreakpoints(Handle<Script> script, int start_position,
   UNREACHABLE();
 }
 
-void Debug::RecordGenerator(Handle<JSGeneratorObject> generator_object) {
-  if (last_step_action() <= StepOut) return;
-
-  if (last_step_action() == StepNext) {
-    // Only consider this generator a step-next target if not stepping in.
-    if (thread_local_.target_frame_count_ < CurrentFrameCount()) return;
-  }
-
-  DCHECK(!has_suspended_generator());
-  thread_local_.suspended_generator_ = *generator_object;
-  ClearStepping();
-}
-
 class SharedFunctionInfoFinder {
  public:
   explicit SharedFunctionInfoFinder(int target_position)
@@ -1209,15 +1327,15 @@ class SharedFunctionInfoFinder {
     if (!shared->IsSubjectToDebugging()) return;
     int start_position = shared->function_token_position();
     if (start_position == kNoSourcePosition) {
-      start_position = shared->start_position();
+      start_position = shared->StartPosition();
     }
 
     if (start_position > target_position_) return;
-    if (target_position_ > shared->end_position()) return;
+    if (target_position_ > shared->EndPosition()) return;
 
     if (current_candidate_ != nullptr) {
       if (current_start_position_ == start_position &&
-          shared->end_position() == current_candidate_->end_position()) {
+          shared->EndPosition() == current_candidate_->EndPosition()) {
         // If we already have a matching closure, do not throw it away.
         if (current_candidate_closure_ != nullptr && closure == nullptr) return;
         // If a top-level function contains only one function
@@ -1225,7 +1343,7 @@ class SharedFunctionInfoFinder {
         // is the same. In that case prefer the non top-level function.
         if (!current_candidate_->is_toplevel() && shared->is_toplevel()) return;
       } else if (start_position < current_start_position_ ||
-                 current_candidate_->end_position() < shared->end_position()) {
+                 current_candidate_->EndPosition() < shared->EndPosition()) {
         return;
       }
     }
@@ -1300,11 +1418,17 @@ Handle<Object> Debug::FindSharedFunctionInfoInScript(Handle<Script> script,
 bool Debug::EnsureBreakInfo(Handle<SharedFunctionInfo> shared) {
   // Return if we already have the break info for shared.
   if (shared->HasBreakInfo()) return true;
-  if (!shared->IsSubjectToDebugging()) return false;
+  if (!shared->IsSubjectToDebugging() && !CanBreakAtEntry(shared)) {
+    return false;
+  }
   if (!shared->is_compiled() &&
       !Compiler::Compile(shared, Compiler::CLEAR_EXCEPTION)) {
     return false;
   }
+  if (shared->GetCode() ==
+      isolate_->builtins()->builtin(Builtins::kDeserializeLazy)) {
+    Snapshot::EnsureBuiltinIsDeserialized(isolate_, shared);
+  }
   CreateBreakInfo(shared);
   return true;
 }
@@ -1328,7 +1452,10 @@ void Debug::CreateBreakInfo(Handle<SharedFunctionInfo> shared) {
     maybe_debug_bytecode_array = factory->CopyBytecodeArray(original);
   }
 
-  debug_info->set_flags(debug_info->flags() | DebugInfo::kHasBreakInfo);
+  int flags = debug_info->flags();
+  flags |= DebugInfo::kHasBreakInfo;
+  if (CanBreakAtEntry(shared)) flags |= DebugInfo::kCanBreakAtEntry;
+  debug_info->set_flags(flags);
   debug_info->set_debug_bytecode_array(*maybe_debug_bytecode_array);
   debug_info->set_break_points(*break_points);
 }
@@ -1468,11 +1595,11 @@ Handle<FixedArray> Debug::GetLoadedScripts() {
   isolate_->heap()->CollectAllGarbage(Heap::kFinalizeIncrementalMarkingMask,
                                       GarbageCollectionReason::kDebugger);
   Factory* factory = isolate_->factory();
-  if (!factory->script_list()->IsWeakFixedArray()) {
+  if (!factory->script_list()->IsFixedArrayOfWeakCells()) {
     return factory->empty_fixed_array();
   }
-  Handle<WeakFixedArray> array =
-      Handle<WeakFixedArray>::cast(factory->script_list());
+  Handle<FixedArrayOfWeakCells> array =
+      Handle<FixedArrayOfWeakCells>::cast(factory->script_list());
   Handle<FixedArray> results = factory->NewFixedArray(array->Length());
   int length = 0;
   {
@@ -1494,14 +1621,6 @@ MaybeHandle<Object> Debug::MakeExecutionState() {
 }
 
 
-MaybeHandle<Object> Debug::MakeBreakEvent(Handle<Object> break_points_hit) {
-  // Create the new break event object.
-  Handle<Object> argv[] = { isolate_->factory()->NewNumberFromInt(break_id()),
-                            break_points_hit };
-  return CallFunction("MakeBreakEvent", arraysize(argv), argv);
-}
-
-
 MaybeHandle<Object> Debug::MakeExceptionEvent(Handle<Object> exception,
                                               bool uncaught,
                                               Handle<Object> promise) {
@@ -1677,29 +1796,15 @@ void Debug::OnDebugBreak(Handle<FixedArray> break_points_hit) {
   int inspector_break_points_count = 0;
   // This array contains breakpoints installed using JS debug API.
   for (int i = 0; i < break_points_hit->length(); ++i) {
-    Object* break_point = break_points_hit->get(i);
-    if (break_point->IsBreakPoint()) {
-      inspector_break_points_hit.push_back(BreakPoint::cast(break_point)->id());
-      ++inspector_break_points_count;
-    } else {
-      break_points_hit->set(i - inspector_break_points_count, break_point);
-    }
-  }
-  int break_points_length =
-      break_points_hit->length() - inspector_break_points_count;
-  Handle<Object> break_points;
-  if (break_points_length) {
-    break_points_hit->Shrink(break_points_length);
-    break_points = isolate_->factory()->NewJSArrayWithElements(
-        break_points_hit, PACKED_ELEMENTS, break_points_length);
-  } else {
-    break_points = isolate_->factory()->undefined_value();
+    BreakPoint* break_point = BreakPoint::cast(break_points_hit->get(i));
+    inspector_break_points_hit.push_back(break_point->id());
+    ++inspector_break_points_count;
   }
 
   debug_delegate_->BreakProgramRequested(
       GetDebugEventContext(isolate_),
       v8::Utils::ToLocal(Handle<JSObject>::cast(exec_state)),
-      v8::Utils::ToLocal(break_points), inspector_break_points_hit);
+      inspector_break_points_hit);
 }
 
 
@@ -1778,19 +1883,20 @@ void Debug::RunPromiseHook(PromiseHookType hook_type, Handle<JSPromise> promise,
           return;
         }
         last_frame_was_promise_builtin = false;
-        Handle<Code> code(info->code());
-        if (*code == *BUILTIN_CODE(isolate_, AsyncFunctionPromiseCreate)) {
-          type = debug::kDebugAsyncFunctionPromiseCreated;
-          last_frame_was_promise_builtin = true;
-        } else if (*code == *BUILTIN_CODE(isolate_, PromisePrototypeThen)) {
-          type = debug::kDebugPromiseThen;
-          last_frame_was_promise_builtin = true;
-        } else if (*code == *BUILTIN_CODE(isolate_, PromisePrototypeCatch)) {
-          type = debug::kDebugPromiseCatch;
-          last_frame_was_promise_builtin = true;
-        } else if (*code == *BUILTIN_CODE(isolate_, PromisePrototypeFinally)) {
-          type = debug::kDebugPromiseFinally;
-          last_frame_was_promise_builtin = true;
+        if (info->HasBuiltinId()) {
+          if (info->builtin_id() == Builtins::kAsyncFunctionPromiseCreate) {
+            type = debug::kDebugAsyncFunctionPromiseCreated;
+            last_frame_was_promise_builtin = true;
+          } else if (info->builtin_id() == Builtins::kPromisePrototypeThen) {
+            type = debug::kDebugPromiseThen;
+            last_frame_was_promise_builtin = true;
+          } else if (info->builtin_id() == Builtins::kPromisePrototypeCatch) {
+            type = debug::kDebugPromiseCatch;
+            last_frame_was_promise_builtin = true;
+          } else if (info->builtin_id() == Builtins::kPromisePrototypeFinally) {
+            type = debug::kDebugPromiseFinally;
+            last_frame_was_promise_builtin = true;
+          }
         }
       }
       it.Advance();
@@ -1840,9 +1946,8 @@ bool Debug::IsBlackboxed(Handle<SharedFunctionInfo> shared) {
       DCHECK(shared->script()->IsScript());
       Handle<Script> script(Script::cast(shared->script()));
       DCHECK(script->IsUserJavaScript());
-      debug::Location start =
-          GetDebugLocation(script, shared->start_position());
-      debug::Location end = GetDebugLocation(script, shared->end_position());
+      debug::Location start = GetDebugLocation(script, shared->StartPosition());
+      debug::Location end = GetDebugLocation(script, shared->EndPosition());
       is_blackboxed = debug_delegate_->IsFunctionBlackboxed(
           ToApiHandle<debug::Script>(script), start, end);
     }
@@ -1860,6 +1965,16 @@ bool Debug::AllFramesOnStackAreBlackboxed() {
   return true;
 }
 
+bool Debug::CanBreakAtEntry(Handle<SharedFunctionInfo> shared) {
+  // Allow break at entry for builtin functions.
+  if (shared->native() || shared->IsApiFunction()) {
+    // Functions that are subject to debugging can have regular breakpoints.
+    DCHECK(!shared->IsSubjectToDebugging());
+    return true;
+  }
+  return false;
+}
+
 bool Debug::SetScriptSource(Handle<Script> script, Handle<String> source,
                             bool preview, bool* stack_changed) {
   DebugScope debug_scope(this);
@@ -2146,7 +2261,6 @@ bool Debug::PerformSideEffectCheck(Handle<JSFunction> function) {
       !Compiler::Compile(function, Compiler::KEEP_EXCEPTION)) {
     return false;
   }
-  Deoptimizer::DeoptimizeFunction(*function);
   if (!SharedFunctionInfo::HasNoSideEffect(handle(function->shared()))) {
     if (FLAG_trace_side_effect_free_debug_evaluate) {
       PrintF("[debug-evaluate] Function %s failed side effect check.\n",
@@ -2160,9 +2274,9 @@ bool Debug::PerformSideEffectCheck(Handle<JSFunction> function) {
   return true;
 }
 
-bool Debug::PerformSideEffectCheckForCallback(Address function) {
+bool Debug::PerformSideEffectCheckForCallback(Object* callback_info) {
   DCHECK(isolate_->needs_side_effect_check());
-  if (DebugEvaluate::CallbackHasNoSideEffect(function)) return true;
+  if (DebugEvaluate::CallbackHasNoSideEffect(callback_info)) return true;
   side_effect_check_failed_ = true;
   // Throw an uncatchable termination exception.
   isolate_->TerminateExecution();
@@ -2195,16 +2309,9 @@ void LegacyDebugDelegate::ScriptCompiled(v8::Local<v8::debug::Script> script,
 
 void LegacyDebugDelegate::BreakProgramRequested(
     v8::Local<v8::Context> paused_context, v8::Local<v8::Object> exec_state,
-    v8::Local<v8::Value> break_points_hit,
     const std::vector<debug::BreakpointId>&) {
-  Handle<Object> event_data;
-  if (isolate_->debug()
-          ->MakeBreakEvent(v8::Utils::OpenHandle(*break_points_hit))
-          .ToHandle(&event_data)) {
-    ProcessDebugEvent(
-        v8::Break, Handle<JSObject>::cast(event_data),
-        Handle<JSObject>::cast(v8::Utils::OpenHandle(*exec_state)));
-  }
+  ProcessDebugEvent(v8::Break, isolate_->factory()->NewJSObjectWithNullProto(),
+                    Handle<JSObject>::cast(v8::Utils::OpenHandle(*exec_state)));
 }
 
 void LegacyDebugDelegate::ExceptionThrown(v8::Local<v8::Context> paused_context,
@@ -2231,32 +2338,6 @@ void LegacyDebugDelegate::ProcessDebugEvent(v8::DebugEvent event,
   }
 }
 
-JavaScriptDebugDelegate::JavaScriptDebugDelegate(Isolate* isolate,
-                                                 Handle<JSFunction> listener,
-                                                 Handle<Object> data)
-    : LegacyDebugDelegate(isolate) {
-  GlobalHandles* global_handles = isolate->global_handles();
-  listener_ = global_handles->Create(*listener);
-  data_ = global_handles->Create(*data);
-}
-
-JavaScriptDebugDelegate::~JavaScriptDebugDelegate() {
-  GlobalHandles::Destroy(Handle<Object>::cast(listener_).location());
-  GlobalHandles::Destroy(data_.location());
-}
-
-void JavaScriptDebugDelegate::ProcessDebugEvent(v8::DebugEvent event,
-                                                Handle<JSObject> event_data,
-                                                Handle<JSObject> exec_state) {
-  AllowJavascriptExecutionDebugOnly allow_script(isolate_);
-  Handle<Object> argv[] = {Handle<Object>(Smi::FromInt(event), isolate_),
-                           exec_state, event_data, data_};
-  Handle<JSReceiver> global = isolate_->global_proxy();
-  // Listener must not throw.
-  Execution::Call(isolate_, listener_, global, arraysize(argv), argv)
-      .ToHandleChecked();
-}
-
 NativeDebugDelegate::NativeDebugDelegate(Isolate* isolate,
                                          v8::Debug::EventCallback callback,
                                          Handle<Object> data)
@@ -2324,7 +2405,7 @@ NoSideEffectScope::~NoSideEffectScope() {
     isolate_->Throw(*isolate_->factory()->NewEvalError(
         MessageTemplate::kNoSideEffectDebugEvaluate));
   }
-  isolate_->set_needs_side_effect_check(old_needs_side_effect_check_);
+  isolate_->set_needs_side_effect_check(false);
   isolate_->debug()->UpdateHookOnFunctionCall();
   isolate_->debug()->side_effect_check_failed_ = false;
 }
diff --git a/deps/v8/src/debug/debug.h b/deps/v8/src/debug/debug.h
index aec66f2f352..86092e1a851 100644
--- a/deps/v8/src/debug/debug.h
+++ b/deps/v8/src/debug/debug.h
@@ -25,12 +25,9 @@
 #include "src/string-stream.h"
 #include "src/v8threads.h"
 
-#include "include/v8-debug.h"
-
 namespace v8 {
 namespace internal {
 
-
 // Forward declarations.
 class DebugScope;
 
@@ -51,13 +48,14 @@ enum ExceptionBreakType {
   BreakUncaughtException = 1
 };
 
-
 enum DebugBreakType {
   NOT_DEBUG_BREAK,
   DEBUGGER_STATEMENT,
   DEBUG_BREAK_SLOT,
   DEBUG_BREAK_SLOT_AT_CALL,
   DEBUG_BREAK_SLOT_AT_RETURN,
+  DEBUG_BREAK_SLOT_AT_SUSPEND,
+  DEBUG_BREAK_AT_ENTRY,
 };
 
 enum IgnoreBreakMode {
@@ -74,12 +72,20 @@ class BreakLocation {
                                     JavaScriptFrame* frame,
                                     std::vector<BreakLocation>* result_out);
 
+  inline bool IsSuspend() const { return type_ == DEBUG_BREAK_SLOT_AT_SUSPEND; }
   inline bool IsReturn() const { return type_ == DEBUG_BREAK_SLOT_AT_RETURN; }
+  inline bool IsReturnOrSuspend() const {
+    return type_ >= DEBUG_BREAK_SLOT_AT_RETURN;
+  }
   inline bool IsCall() const { return type_ == DEBUG_BREAK_SLOT_AT_CALL; }
   inline bool IsDebugBreakSlot() const { return type_ >= DEBUG_BREAK_SLOT; }
   inline bool IsDebuggerStatement() const {
     return type_ == DEBUGGER_STATEMENT;
   }
+  inline bool IsDebugBreakAtEntry() const {
+    bool result = type_ == DEBUG_BREAK_AT_ENTRY;
+    return result;
+  }
 
   bool HasBreakPoint(Handle<DebugInfo> debug_info) const;
 
@@ -87,16 +93,26 @@ class BreakLocation {
 
   debug::BreakLocationType type() const;
 
+  JSGeneratorObject* GetGeneratorObjectForSuspendedFrame(
+      JavaScriptFrame* frame) const;
+
  private:
   BreakLocation(Handle<AbstractCode> abstract_code, DebugBreakType type,
-                int code_offset, int position)
+                int code_offset, int position, int generator_obj_reg_index)
       : abstract_code_(abstract_code),
         code_offset_(code_offset),
         type_(type),
-        position_(position) {
+        position_(position),
+        generator_obj_reg_index_(generator_obj_reg_index) {
     DCHECK_NE(NOT_DEBUG_BREAK, type_);
   }
 
+  BreakLocation(int position, DebugBreakType type)
+      : code_offset_(0),
+        type_(type),
+        position_(position),
+        generator_obj_reg_index_(0) {}
+
   static int BreakIndexFromCodeOffset(Handle<DebugInfo> debug_info,
                                       Handle<AbstractCode> abstract_code,
                                       int offset);
@@ -108,6 +124,7 @@ class BreakLocation {
   int code_offset_;
   DebugBreakType type_;
   int position_;
+  int generator_obj_reg_index_;
 
   friend class BreakIterator;
 };
@@ -215,32 +232,31 @@ class Debug {
 
   // Internal logic
   bool Load();
-  void Break(JavaScriptFrame* frame);
+  // The break target may not be the top-most frame, since we may be
+  // breaking before entering a function that cannot contain break points.
+  void Break(JavaScriptFrame* frame, Handle<JSFunction> break_target);
 
   // Scripts handling.
   Handle<FixedArray> GetLoadedScripts();
 
   // Break point handling.
   bool SetBreakPoint(Handle<JSFunction> function,
-                     Handle<Object> break_point_object,
-                     int* source_position);
-  bool SetBreakPointForScript(Handle<Script> script,
-                              Handle<Object> break_point_object,
-                              int* source_position);
-  void ClearBreakPoint(Handle<Object> break_point_object);
+                     Handle<BreakPoint> break_point, int* source_position);
+  void ClearBreakPoint(Handle<BreakPoint> break_point);
   void ChangeBreakOnException(ExceptionBreakType type, bool enable);
   bool IsBreakOnException(ExceptionBreakType type);
 
-  bool SetBreakpoint(Handle<Script> script, Handle<String> condition,
-                     int* offset, int* id);
+  bool SetBreakPointForScript(Handle<Script> script, Handle<String> condition,
+                              int* source_position, int* id);
+  bool SetBreakpointForFunction(Handle<JSFunction> function,
+                                Handle<String> condition, int* id);
   void RemoveBreakpoint(int id);
 
-  // The parameter is either a BreakPointInfo object, or a FixedArray of
-  // BreakPointInfo objects.
-  // Returns an empty handle if no breakpoint is hit, or a FixedArray with all
-  // hit breakpoints.
-  MaybeHandle<FixedArray> GetHitBreakPointObjects(
-      Handle<Object> break_point_objects);
+  // Find breakpoints from the debug info and the break location and check
+  // whether they are hit. Return an empty handle if not, or a FixedArray with
+  // hit BreakPoint objects.
+  MaybeHandle<FixedArray> GetHitBreakPoints(Handle<DebugInfo> debug_info,
+                                            int position);
 
   // Stepping handling.
   void PrepareStep(StepAction step_action);
@@ -252,12 +268,11 @@ class Debug {
 
   void DeoptimizeFunction(Handle<SharedFunctionInfo> shared);
   void PrepareFunctionForBreakPoints(Handle<SharedFunctionInfo> shared);
+  void InstallDebugBreakTrampoline();
   bool GetPossibleBreakpoints(Handle<Script> script, int start_position,
                               int end_position, bool restrict_to_function,
                               std::vector<BreakLocation>* locations);
 
-  void RecordGenerator(Handle<JSGeneratorObject> generator_object);
-
   void RunPromiseHook(PromiseHookType hook_type, Handle<JSPromise> promise,
                       Handle<Object> parent);
 
@@ -265,6 +280,8 @@ class Debug {
 
   bool IsBlackboxed(Handle<SharedFunctionInfo> shared);
 
+  bool CanBreakAtEntry(Handle<SharedFunctionInfo> shared);
+
   void SetDebugDelegate(debug::DebugDelegate* delegate, bool pass_ownership);
 
   // Returns whether the operation succeeded.
@@ -320,7 +337,7 @@ class Debug {
   }
 
   bool PerformSideEffectCheck(Handle<JSFunction> function);
-  bool PerformSideEffectCheckForCallback(Address function);
+  bool PerformSideEffectCheckForCallback(Object* callback_info);
 
   // Flags and states.
   DebugScope* debugger_entry() {
@@ -339,6 +356,10 @@ class Debug {
   inline bool in_debug_scope() const {
     return !!base::Relaxed_Load(&thread_local_.current_debug_scope_);
   }
+  inline bool needs_check_on_function_call() const {
+    return hook_on_function_call_;
+  }
+
   void set_break_points_active(bool v) { break_points_active_ = v; }
   bool break_points_active() const { return break_points_active_; }
 
@@ -376,6 +397,10 @@ class Debug {
 
   DebugFeatureTracker* feature_tracker() { return &feature_tracker_; }
 
+  // For functions in which we cannot set a break point, use a canonical
+  // source position for break points.
+  static const int kBreakAtEntryPosition = 0;
+
  private:
   explicit Debug(Isolate* isolate);
   ~Debug() { DCHECK_NULL(debug_delegate_); }
@@ -410,8 +435,6 @@ class Debug {
 
   // Constructors for debug event objects.
   MUST_USE_RESULT MaybeHandle<Object> MakeExecutionState();
-  MUST_USE_RESULT MaybeHandle<Object> MakeBreakEvent(
-      Handle<Object> break_points_hit);
   MUST_USE_RESULT MaybeHandle<Object> MakeExceptionEvent(
       Handle<Object> exception,
       bool uncaught,
@@ -445,7 +468,9 @@ class Debug {
                                            BreakLocation* location,
                                            bool* has_break_points = nullptr);
   bool IsMutedAtCurrentLocation(JavaScriptFrame* frame);
-  bool CheckBreakPoint(Handle<Object> break_point_object);
+  // Check whether a BreakPoint object is hit. Evaluate condition depending
+  // on whether this is a regular break location or a break at function entry.
+  bool CheckBreakPoint(Handle<BreakPoint> break_point, bool is_break_at_entry);
   MaybeHandle<Object> CallFunction(const char* name, int argc,
                                    Handle<Object> args[],
                                    bool catch_exceptions = true);
@@ -577,7 +602,6 @@ class LegacyDebugDelegate : public v8::debug::DebugDelegate {
                       bool has_compile_error) override;
   void BreakProgramRequested(v8::Local<v8::Context> paused_context,
                              v8::Local<v8::Object> exec_state,
-                             v8::Local<v8::Value> break_points_hit,
                              const std::vector<debug::BreakpointId>&) override;
   void ExceptionThrown(v8::Local<v8::Context> paused_context,
                        v8::Local<v8::Object> exec_state,
@@ -599,20 +623,6 @@ class LegacyDebugDelegate : public v8::debug::DebugDelegate {
                                  Handle<JSObject> exec_state) = 0;
 };
 
-class JavaScriptDebugDelegate : public LegacyDebugDelegate {
- public:
-  JavaScriptDebugDelegate(Isolate* isolate, Handle<JSFunction> listener,
-                          Handle<Object> data);
-  virtual ~JavaScriptDebugDelegate();
-
- private:
-  void ProcessDebugEvent(v8::DebugEvent event, Handle<JSObject> event_data,
-                         Handle<JSObject> exec_state) override;
-
-  Handle<JSFunction> listener_;
-  Handle<Object> data_;
-};
-
 class NativeDebugDelegate : public LegacyDebugDelegate {
  public:
   NativeDebugDelegate(Isolate* isolate, v8::Debug::EventCallback callback,
@@ -630,7 +640,6 @@ class NativeDebugDelegate : public LegacyDebugDelegate {
     virtual v8::Local<v8::Object> GetEventData() const;
     virtual v8::Local<v8::Context> GetEventContext() const;
     virtual v8::Local<v8::Value> GetCallbackData() const;
-    virtual v8::Debug::ClientData* GetClientData() const { return nullptr; }
     virtual v8::Isolate* GetIsolate() const;
 
    private:
@@ -691,9 +700,9 @@ class ReturnValueScope {
 // Stack allocated class for disabling break.
 class DisableBreak BASE_EMBEDDED {
  public:
-  explicit DisableBreak(Debug* debug)
+  explicit DisableBreak(Debug* debug, bool disable = true)
       : debug_(debug), previous_break_disabled_(debug->break_disabled_) {
-    debug_->break_disabled_ = true;
+    debug_->break_disabled_ = disable;
   }
   ~DisableBreak() {
     debug_->break_disabled_ = previous_break_disabled_;
@@ -723,10 +732,10 @@ class SuppressDebug BASE_EMBEDDED {
 class NoSideEffectScope {
  public:
   NoSideEffectScope(Isolate* isolate, bool disallow_side_effects)
-      : isolate_(isolate),
-        old_needs_side_effect_check_(isolate->needs_side_effect_check()) {
-    isolate->set_needs_side_effect_check(old_needs_side_effect_check_ ||
-                                         disallow_side_effects);
+      : isolate_(isolate) {
+    // NoSideEffectScope is not re-entrant if already enabled.
+    CHECK(!isolate->needs_side_effect_check());
+    isolate->set_needs_side_effect_check(disallow_side_effects);
     isolate->debug()->UpdateHookOnFunctionCall();
     isolate->debug()->side_effect_check_failed_ = false;
   }
@@ -734,7 +743,6 @@ class NoSideEffectScope {
 
  private:
   Isolate* isolate_;
-  bool old_needs_side_effect_check_;
   DISALLOW_COPY_AND_ASSIGN(NoSideEffectScope);
 };
 
@@ -752,6 +760,9 @@ class DebugCodegen : public AllStatic {
   // Builtin to atomically (wrt deopts) handle debugger statement and
   // drop frames to restart function if necessary.
   static void GenerateHandleDebuggerStatement(MacroAssembler* masm);
+
+  // Builtin to trigger a debug break before entering the function.
+  static void GenerateDebugBreakTrampoline(MacroAssembler* masm);
 };
 
 
diff --git a/deps/v8/src/debug/debug.js b/deps/v8/src/debug/debug.js
index 43be3c424a9..97a0886ca78 100644
--- a/deps/v8/src/debug/debug.js
+++ b/deps/v8/src/debug/debug.js
@@ -19,16 +19,8 @@ var ValueMirror = global.ValueMirror;
 
 //----------------------------------------------------------------------------
 
-// Default number of frames to include in the response to backtrace request.
-var kDefaultBacktraceLength = 10;
-
 var Debug = {};
 
-// Regular expression to skip "crud" at the beginning of a source line which is
-// not really code. Currently the regular expression matches whitespace and
-// comments.
-var sourceLineBeginningSkip = /^(?:\s*(?:\/\*.*?\*\/)*)*/;
-
 // Debug events which can occur in the V8 JavaScript engine. These originate
 // from the API include file debug.h.
 Debug.DebugEvent = { Break: 1,
@@ -58,29 +50,12 @@ Debug.ScriptCompilationType = { Host: 0,
                                 Eval: 1,
                                 JSON: 2 };
 
-// The different script break point types.
-Debug.ScriptBreakPointType = { ScriptId: 0,
-                               ScriptName: 1,
-                               ScriptRegExp: 2 };
-
 function ScriptTypeFlag(type) {
   return (1 << type);
 }
 
 // Globals.
-var next_response_seq = 0;
-var next_break_point_number = 1;
-var break_points = [];
-var script_break_points = [];
 var debugger_flags = {
-  breakPointsActive: {
-    value: true,
-    getValue: function() { return this.value; },
-    setValue: function(value) {
-      this.value = !!value;
-      %SetBreakPointsActive(this.value);
-    }
-  },
   breakOnCaughtException: {
     getValue: function() { return Debug.isBreakOnException(); },
     setValue: function(value) {
@@ -104,308 +79,6 @@ var debugger_flags = {
 };
 
 
-// Create a new break point object and add it to the list of break points.
-function MakeBreakPoint(source_position, opt_script_break_point) {
-  var break_point = new BreakPoint(source_position, opt_script_break_point);
-  break_points.push(break_point);
-  return break_point;
-}
-
-
-// Object representing a break point.
-// NOTE: This object does not have a reference to the function having break
-// point as this would cause function not to be garbage collected when it is
-// not used any more. We do not want break points to keep functions alive.
-function BreakPoint(source_position, opt_script_break_point) {
-  this.source_position_ = source_position;
-  if (opt_script_break_point) {
-    this.script_break_point_ = opt_script_break_point;
-  } else {
-    this.number_ = next_break_point_number++;
-  }
-  this.active_ = true;
-  this.condition_ = null;
-}
-
-
-BreakPoint.prototype.number = function() {
-  return this.number_;
-};
-
-
-BreakPoint.prototype.func = function() {
-  return this.func_;
-};
-
-
-BreakPoint.prototype.source_position = function() {
-  return this.source_position_;
-};
-
-
-BreakPoint.prototype.active = function() {
-  if (this.script_break_point()) {
-    return this.script_break_point().active();
-  }
-  return this.active_;
-};
-
-
-BreakPoint.prototype.condition = function() {
-  if (this.script_break_point() && this.script_break_point().condition()) {
-    return this.script_break_point().condition();
-  }
-  return this.condition_;
-};
-
-
-BreakPoint.prototype.script_break_point = function() {
-  return this.script_break_point_;
-};
-
-
-BreakPoint.prototype.enable = function() {
-  this.active_ = true;
-};
-
-
-BreakPoint.prototype.disable = function() {
-  this.active_ = false;
-};
-
-
-BreakPoint.prototype.setCondition = function(condition) {
-  this.condition_ = condition;
-};
-
-
-BreakPoint.prototype.isTriggered = function(exec_state) {
-  // Break point not active - not triggered.
-  if (!this.active()) return false;
-
-  // Check for conditional break point.
-  if (this.condition()) {
-    // If break point has condition try to evaluate it in the top frame.
-    try {
-      var mirror = exec_state.frame(0).evaluate(this.condition());
-      // If no sensible mirror or non true value break point not triggered.
-      if (!(mirror instanceof ValueMirror) || !mirror.value_) {
-        return false;
-      }
-    } catch (e) {
-      // Exception evaluating condition counts as not triggered.
-      return false;
-    }
-  }
-
-  // Break point triggered.
-  return true;
-};
-
-
-// Function called from the runtime when a break point is hit. Returns true if
-// the break point is triggered and supposed to break execution.
-function IsBreakPointTriggered(break_id, break_point) {
-  return break_point.isTriggered(MakeExecutionState(break_id));
-}
-
-
-// Object representing a script break point. The script is referenced by its
-// script name or script id and the break point is represented as line and
-// column.
-function ScriptBreakPoint(type, script_id_or_name, opt_line, opt_column,
-                          opt_groupId) {
-  this.type_ = type;
-  if (type == Debug.ScriptBreakPointType.ScriptId) {
-    this.script_id_ = script_id_or_name;
-  } else if (type == Debug.ScriptBreakPointType.ScriptName) {
-    this.script_name_ = script_id_or_name;
-  } else if (type == Debug.ScriptBreakPointType.ScriptRegExp) {
-    this.script_regexp_object_ = new GlobalRegExp(script_id_or_name);
-  } else {
-    throw %make_error(kDebugger, "Unexpected breakpoint type " + type);
-  }
-  this.line_ = opt_line || 0;
-  this.column_ = opt_column;
-  this.groupId_ = opt_groupId;
-  this.active_ = true;
-  this.condition_ = null;
-  this.break_points_ = [];
-}
-
-
-ScriptBreakPoint.prototype.number = function() {
-  return this.number_;
-};
-
-
-ScriptBreakPoint.prototype.groupId = function() {
-  return this.groupId_;
-};
-
-
-ScriptBreakPoint.prototype.type = function() {
-  return this.type_;
-};
-
-
-ScriptBreakPoint.prototype.script_id = function() {
-  return this.script_id_;
-};
-
-
-ScriptBreakPoint.prototype.script_name = function() {
-  return this.script_name_;
-};
-
-
-ScriptBreakPoint.prototype.script_regexp_object = function() {
-  return this.script_regexp_object_;
-};
-
-
-ScriptBreakPoint.prototype.line = function() {
-  return this.line_;
-};
-
-
-ScriptBreakPoint.prototype.column = function() {
-  return this.column_;
-};
-
-
-ScriptBreakPoint.prototype.actual_locations = function() {
-  var locations = [];
-  for (var i = 0; i < this.break_points_.length; i++) {
-    locations.push(this.break_points_[i].actual_location);
-  }
-  return locations;
-};
-
-
-ScriptBreakPoint.prototype.update_positions = function(line, column) {
-  this.line_ = line;
-  this.column_ = column;
-};
-
-
-ScriptBreakPoint.prototype.active = function() {
-  return this.active_;
-};
-
-
-ScriptBreakPoint.prototype.condition = function() {
-  return this.condition_;
-};
-
-
-ScriptBreakPoint.prototype.enable = function() {
-  this.active_ = true;
-};
-
-
-ScriptBreakPoint.prototype.disable = function() {
-  this.active_ = false;
-};
-
-
-ScriptBreakPoint.prototype.setCondition = function(condition) {
-  this.condition_ = condition;
-};
-
-
-// Check whether a script matches this script break point. Currently this is
-// only based on script name.
-ScriptBreakPoint.prototype.matchesScript = function(script) {
-  if (this.type_ == Debug.ScriptBreakPointType.ScriptId) {
-    return this.script_id_ == script.id;
-  } else {
-    // We might want to account columns here as well.
-    if (!(script.line_offset <= this.line_  &&
-          this.line_ < script.line_offset + %ScriptLineCount(script))) {
-      return false;
-    }
-    if (this.type_ == Debug.ScriptBreakPointType.ScriptName) {
-      return this.script_name_ == script.nameOrSourceURL();
-    } else if (this.type_ == Debug.ScriptBreakPointType.ScriptRegExp) {
-      return this.script_regexp_object_.test(script.nameOrSourceURL());
-    } else {
-      throw %make_error(kDebugger, "Unexpected breakpoint type " + this.type_);
-    }
-  }
-};
-
-
-// Set the script break point in a script.
-ScriptBreakPoint.prototype.set = function (script) {
-  var column = this.column();
-  var line = this.line();
-  // If the column is undefined the break is on the line. To help locate the
-  // first piece of breakable code on the line try to find the column on the
-  // line which contains some source.
-  if (IS_UNDEFINED(column)) {
-    var source_line = %ScriptSourceLine(script, line || script.line_offset);
-
-    // Allocate array for caching the columns where the actual source starts.
-    if (!script.sourceColumnStart_) {
-      script.sourceColumnStart_ = new GlobalArray(%ScriptLineCount(script));
-    }
-
-    // Fill cache if needed and get column where the actual source starts.
-    if (IS_UNDEFINED(script.sourceColumnStart_[line])) {
-      script.sourceColumnStart_[line] =
-          source_line.match(sourceLineBeginningSkip)[0].length;
-    }
-    column = script.sourceColumnStart_[line];
-  }
-
-  // Convert the line and column into an absolute position within the script.
-  var position = Debug.findScriptSourcePosition(script, this.line(), column);
-
-  // If the position is not found in the script (the script might be shorter
-  // than it used to be) just ignore it.
-  if (IS_NULL(position)) return;
-
-  // Create a break point object and set the break point.
-  var break_point = MakeBreakPoint(position, this);
-  var actual_position = %SetScriptBreakPoint(script, position,
-                                             break_point);
-  if (IS_UNDEFINED(actual_position)) {
-    actual_position = position;
-  }
-  var actual_location = script.locationFromPosition(actual_position, true);
-  break_point.actual_location = { line: actual_location.line,
-                                  column: actual_location.column,
-                                  script_id: script.id };
-  this.break_points_.push(break_point);
-  return break_point;
-};
-
-
-// Clear all the break points created from this script break point
-ScriptBreakPoint.prototype.clear = function () {
-  var remaining_break_points = [];
-  for (var i = 0; i < break_points.length; i++) {
-    if (break_points[i].script_break_point() &&
-        break_points[i].script_break_point() === this) {
-      %ClearBreakPoint(break_points[i]);
-    } else {
-      remaining_break_points.push(break_points[i]);
-    }
-  }
-  break_points = remaining_break_points;
-  this.break_points_ = [];
-};
-
-
-Debug.setListener = function(listener, opt_data) {
-  if (!IS_FUNCTION(listener) && !IS_UNDEFINED(listener) && !IS_NULL(listener)) {
-    throw %make_type_error(kDebuggerType);
-  }
-  %SetDebugEventListener(listener, opt_data);
-};
-
-
 // Returns a Script object. If the parameter is a function the return value
 // is the script in which the function is defined. If the parameter is a string
 // the return value is the script for which the script name has that string
@@ -475,246 +148,6 @@ Debug.findScriptSourcePosition = function(script, opt_line, opt_column) {
   return location ? location.position : null;
 };
 
-
-Debug.findBreakPoint = function(break_point_number, remove) {
-  var break_point;
-  for (var i = 0; i < break_points.length; i++) {
-    if (break_points[i].number() == break_point_number) {
-      break_point = break_points[i];
-      // Remove the break point from the list if requested.
-      if (remove) {
-        break_points.splice(i, 1);
-      }
-      break;
-    }
-  }
-  if (break_point) {
-    return break_point;
-  } else {
-    return this.findScriptBreakPoint(break_point_number, remove);
-  }
-};
-
-Debug.findBreakPointActualLocations = function(break_point_number) {
-  for (var i = 0; i < script_break_points.length; i++) {
-    if (script_break_points[i].number() == break_point_number) {
-      return script_break_points[i].actual_locations();
-    }
-  }
-  for (var i = 0; i < break_points.length; i++) {
-    if (break_points[i].number() == break_point_number) {
-      return [break_points[i].actual_location];
-    }
-  }
-  return [];
-};
-
-Debug.setBreakPoint = function(func, opt_line, opt_column, opt_condition) {
-  if (!IS_FUNCTION(func)) throw %make_type_error(kDebuggerType);
-  // Break points in API functions are not supported.
-  if (%FunctionIsAPIFunction(func)) {
-    throw %make_error(kDebugger, 'Cannot set break point in native code.');
-  }
-  // Find source position.
-  var source_position =
-      this.findFunctionSourceLocation(func, opt_line, opt_column).position;
-  // Find the script for the function.
-  var script = %FunctionGetScript(func);
-  // Break in builtin JavaScript code is not supported.
-  if (script.type == Debug.ScriptType.Native) {
-    throw %make_error(kDebugger, 'Cannot set break point in native code.');
-  }
-  // If the script for the function has a name convert this to a script break
-  // point.
-  if (script && script.id) {
-    // Find line and column for the position in the script and set a script
-    // break point from that.
-    var location = script.locationFromPosition(source_position, false);
-    return this.setScriptBreakPointById(script.id,
-                                        location.line, location.column,
-                                        opt_condition);
-  } else {
-    // Set a break point directly on the function.
-    var break_point = MakeBreakPoint(source_position);
-    var actual_position =
-        %SetFunctionBreakPoint(func, source_position, break_point);
-    var actual_location = script.locationFromPosition(actual_position, true);
-    break_point.actual_location = { line: actual_location.line,
-                                    column: actual_location.column,
-                                    script_id: script.id };
-    break_point.setCondition(opt_condition);
-    return break_point.number();
-  }
-};
-
-
-Debug.setBreakPointByScriptIdAndPosition = function(script_id, position,
-                                                    condition, enabled)
-{
-  var break_point = MakeBreakPoint(position);
-  break_point.setCondition(condition);
-  if (!enabled) {
-    break_point.disable();
-  }
-  var script = scriptById(script_id);
-  if (script) {
-    break_point.actual_position = %SetScriptBreakPoint(script, position, break_point);
-  }
-  return break_point;
-};
-
-
-Debug.enableBreakPoint = function(break_point_number) {
-  var break_point = this.findBreakPoint(break_point_number, false);
-  // Only enable if the breakpoint hasn't been deleted:
-  if (break_point) {
-    break_point.enable();
-  }
-};
-
-
-Debug.disableBreakPoint = function(break_point_number) {
-  var break_point = this.findBreakPoint(break_point_number, false);
-  // Only enable if the breakpoint hasn't been deleted:
-  if (break_point) {
-    break_point.disable();
-  }
-};
-
-
-Debug.changeBreakPointCondition = function(break_point_number, condition) {
-  var break_point = this.findBreakPoint(break_point_number, false);
-  break_point.setCondition(condition);
-};
-
-
-Debug.clearBreakPoint = function(break_point_number) {
-  var break_point = this.findBreakPoint(break_point_number, true);
-  if (break_point) {
-    return %ClearBreakPoint(break_point);
-  } else {
-    break_point = this.findScriptBreakPoint(break_point_number, true);
-    if (!break_point) throw %make_error(kDebugger, 'Invalid breakpoint');
-  }
-};
-
-
-Debug.clearAllBreakPoints = function() {
-  for (var i = 0; i < break_points.length; i++) {
-    var break_point = break_points[i];
-    %ClearBreakPoint(break_point);
-  }
-  break_points = [];
-};
-
-
-Debug.disableAllBreakPoints = function() {
-  // Disable all user defined breakpoints:
-  for (var i = 1; i < next_break_point_number; i++) {
-    Debug.disableBreakPoint(i);
-  }
-  // Disable all exception breakpoints:
-  %ChangeBreakOnException(Debug.ExceptionBreak.Caught, false);
-  %ChangeBreakOnException(Debug.ExceptionBreak.Uncaught, false);
-};
-
-
-Debug.findScriptBreakPoint = function(break_point_number, remove) {
-  var script_break_point;
-  for (var i = 0; i < script_break_points.length; i++) {
-    if (script_break_points[i].number() == break_point_number) {
-      script_break_point = script_break_points[i];
-      // Remove the break point from the list if requested.
-      if (remove) {
-        script_break_point.clear();
-        script_break_points.splice(i,1);
-      }
-      break;
-    }
-  }
-  return script_break_point;
-};
-
-
-// Sets a breakpoint in a script identified through id or name at the
-// specified source line and column within that line.
-Debug.setScriptBreakPoint = function(type, script_id_or_name,
-                                     opt_line, opt_column, opt_condition,
-                                     opt_groupId) {
-  // Create script break point object.
-  var script_break_point =
-      new ScriptBreakPoint(type, script_id_or_name, opt_line, opt_column,
-                           opt_groupId);
-
-  // Assign number to the new script break point and add it.
-  script_break_point.number_ = next_break_point_number++;
-  script_break_point.setCondition(opt_condition);
-  script_break_points.push(script_break_point);
-
-  // Run through all scripts to see if this script break point matches any
-  // loaded scripts.
-  var scripts = this.scripts();
-  for (var i = 0; i < scripts.length; i++) {
-    if (script_break_point.matchesScript(scripts[i])) {
-      script_break_point.set(scripts[i]);
-    }
-  }
-
-  return script_break_point.number();
-};
-
-
-Debug.setScriptBreakPointById = function(script_id,
-                                         opt_line, opt_column,
-                                         opt_condition, opt_groupId) {
-  return this.setScriptBreakPoint(Debug.ScriptBreakPointType.ScriptId,
-                                  script_id, opt_line, opt_column,
-                                  opt_condition, opt_groupId);
-};
-
-
-Debug.setScriptBreakPointByName = function(script_name,
-                                           opt_line, opt_column,
-                                           opt_condition, opt_groupId) {
-  return this.setScriptBreakPoint(Debug.ScriptBreakPointType.ScriptName,
-                                  script_name, opt_line, opt_column,
-                                  opt_condition, opt_groupId);
-};
-
-
-Debug.setScriptBreakPointByRegExp = function(script_regexp,
-                                             opt_line, opt_column,
-                                             opt_condition, opt_groupId) {
-  return this.setScriptBreakPoint(Debug.ScriptBreakPointType.ScriptRegExp,
-                                  script_regexp, opt_line, opt_column,
-                                  opt_condition, opt_groupId);
-};
-
-
-Debug.enableScriptBreakPoint = function(break_point_number) {
-  var script_break_point = this.findScriptBreakPoint(break_point_number, false);
-  script_break_point.enable();
-};
-
-
-Debug.disableScriptBreakPoint = function(break_point_number) {
-  var script_break_point = this.findScriptBreakPoint(break_point_number, false);
-  script_break_point.disable();
-};
-
-
-Debug.changeScriptBreakPointCondition = function(
-    break_point_number, condition) {
-  var script_break_point = this.findScriptBreakPoint(break_point_number, false);
-  script_break_point.setCondition(condition);
-};
-
-
-Debug.scriptBreakPoints = function() {
-  return script_break_points;
-};
-
-
 Debug.clearStepping = function() {
   %ClearStepping();
 };
@@ -743,28 +176,6 @@ Debug.isBreakOnUncaughtException = function() {
   return !!%IsBreakOnException(Debug.ExceptionBreak.Uncaught);
 };
 
-Debug.showBreakPoints = function(f, full) {
-  if (!IS_FUNCTION(f)) throw %make_error(kDebuggerType);
-  var source = full ? this.scriptSource(f) : this.source(f);
-  var offset = full ? 0 : this.sourcePosition(f);
-  var locations = %GetBreakLocations(f);
-  if (!locations) return source;
-  locations.sort(function(x, y) { return x - y; });
-  var result = "";
-  var prev_pos = 0;
-  var pos;
-  for (var i = 0; i < locations.length; i++) {
-    pos = locations[i] - offset;
-    result += source.slice(prev_pos, pos);
-    result += "[B" + i + "]";
-    prev_pos = pos;
-  }
-  pos = source.length;
-  result += source.substring(prev_pos, pos);
-  return result;
-};
-
-
 // Get all the scripts currently loaded. Locating all the scripts is based on
 // scanning the heap.
 Debug.scripts = function() {
@@ -837,46 +248,6 @@ ExecutionState.prototype.selectedFrame = function() {
   return this.selected_frame;
 };
 
-function MakeBreakEvent(break_id, break_points_hit) {
-  return new BreakEvent(break_id, break_points_hit);
-}
-
-
-function BreakEvent(break_id, break_points_hit) {
-  this.frame_ = new FrameMirror(break_id, 0);
-  this.break_points_hit_ = break_points_hit;
-}
-
-
-BreakEvent.prototype.eventType = function() {
-  return Debug.DebugEvent.Break;
-};
-
-
-BreakEvent.prototype.func = function() {
-  return this.frame_.func();
-};
-
-
-BreakEvent.prototype.sourceLine = function() {
-  return this.frame_.sourceLine();
-};
-
-
-BreakEvent.prototype.sourceColumn = function() {
-  return this.frame_.sourceColumn();
-};
-
-
-BreakEvent.prototype.sourceLineText = function() {
-  return this.frame_.sourceLineText();
-};
-
-
-BreakEvent.prototype.breakPointsHit = function() {
-  return this.break_points_hit_;
-};
-
 
 function MakeExceptionEvent(break_id, exception, uncaught, promise) {
   return new ExceptionEvent(break_id, exception, uncaught, promise);
@@ -994,19 +365,15 @@ AsyncTaskEvent.prototype.id = function() {
 
 utils.InstallConstants(global, [
   "Debug", Debug,
-  "BreakEvent", BreakEvent,
   "CompileEvent", CompileEvent,
-  "BreakPoint", BreakPoint,
 ]);
 
 // Functions needed by the debugger runtime.
 utils.InstallConstants(utils, [
   "MakeExecutionState", MakeExecutionState,
   "MakeExceptionEvent", MakeExceptionEvent,
-  "MakeBreakEvent", MakeBreakEvent,
   "MakeCompileEvent", MakeCompileEvent,
   "MakeAsyncTaskEvent", MakeAsyncTaskEvent,
-  "IsBreakPointTriggered", IsBreakPointTriggered,
 ]);
 
 })
diff --git a/deps/v8/src/debug/interface-types.h b/deps/v8/src/debug/interface-types.h
index 4dd83526959..7f5cd5f8059 100644
--- a/deps/v8/src/debug/interface-types.h
+++ b/deps/v8/src/debug/interface-types.h
@@ -176,4 +176,34 @@ typedef int BreakpointId;
 }  // namespace debug
 }  // namespace v8
 
+// TODO(yangguo): this is legacy left over from removing v8-debug.h, and still
+//                used in cctests. Let's get rid of these soon.
+namespace v8 {
+enum DebugEvent {
+  Break = 1,
+  Exception = 2,
+  AfterCompile = 3,
+  CompileError = 4,
+  AsyncTaskEvent = 5,
+};
+
+class Debug {
+ public:
+  class EventDetails {
+   public:
+    virtual DebugEvent GetEvent() const = 0;
+    virtual Local<Object> GetExecutionState() const = 0;
+    virtual Local<Object> GetEventData() const = 0;
+    virtual Local<Context> GetEventContext() const = 0;
+    virtual Local<Value> GetCallbackData() const = 0;
+
+    virtual Isolate* GetIsolate() const = 0;
+
+    virtual ~EventDetails() {}
+  };
+
+  typedef void (*EventCallback)(const EventDetails& event_details);
+};
+}  // namespace v8
+
 #endif  // V8_DEBUG_INTERFACE_TYPES_H_
diff --git a/deps/v8/src/debug/liveedit.cc b/deps/v8/src/debug/liveedit.cc
index a2b22d58d49..cac4a3b936e 100644
--- a/deps/v8/src/debug/liveedit.cc
+++ b/deps/v8/src/debug/liveedit.cc
@@ -743,11 +743,12 @@ class FeedbackVectorFixer {
 
     for (int i = 0; i < function_instances->length(); i++) {
       Handle<JSFunction> fun(JSFunction::cast(function_instances->get(i)));
-      Handle<Cell> new_cell = isolate->factory()->NewManyClosuresCell(
-          isolate->factory()->undefined_value());
-      fun->set_feedback_vector_cell(*new_cell);
+      Handle<FeedbackCell> feedback_cell =
+          isolate->factory()->NewManyClosuresCell(
+              isolate->factory()->undefined_value());
+      fun->set_feedback_cell(*feedback_cell);
       // Only create feedback vectors if we already have the metadata.
-      if (shared_info->is_compiled()) JSFunction::EnsureLiterals(fun);
+      if (shared_info->is_compiled()) JSFunction::EnsureFeedbackVector(fun);
     }
   }
 
@@ -823,11 +824,6 @@ void LiveEdit::ReplaceFunctionCode(
       compile_info_wrapper.GetSharedFunctionInfo();
 
   if (shared_info->is_compiled()) {
-    // Take whatever code we can get from the new shared function info. We
-    // expect activations of neither the old bytecode nor old FCG code, since
-    // the lowest activation is going to be restarted.
-    Handle<Code> old_code(shared_info->code());
-    Handle<Code> new_code(new_shared_info->code());
     // Clear old bytecode. This will trigger self-healing if we do not install
     // new bytecode.
     shared_info->ClearBytecodeArray();
@@ -846,14 +842,19 @@ void LiveEdit::ReplaceFunctionCode(
         new_shared_info->feedback_metadata());
     shared_info->set_feedback_metadata(*new_feedback_metadata);
   } else {
-    shared_info->set_feedback_metadata(
-        FeedbackMetadata::cast(isolate->heap()->empty_fixed_array()));
+    // Use an empty FeedbackMetadata.
+    Handle<FeedbackMetadata> feedback_metadata = FeedbackMetadata::New(isolate);
+    shared_info->set_feedback_metadata(*feedback_metadata);
   }
 
   int start_position = compile_info_wrapper.GetStartPosition();
   int end_position = compile_info_wrapper.GetEndPosition();
-  shared_info->set_start_position(start_position);
-  shared_info->set_end_position(end_position);
+  // TODO(cbruni): only store position information on the SFI.
+  shared_info->set_raw_start_position(start_position);
+  shared_info->set_raw_end_position(end_position);
+  if (shared_info->scope_info()->HasPositionInfo()) {
+    shared_info->scope_info()->SetPositionInfo(start_position, end_position);
+  }
 
   FeedbackVectorFixer::PatchFeedbackVector(&compile_info_wrapper, shared_info,
                                            isolate);
@@ -872,9 +873,9 @@ void LiveEdit::FunctionSourceUpdated(Handle<JSArray> shared_info_array,
 
 void LiveEdit::FixupScript(Handle<Script> script, int max_function_literal_id) {
   Isolate* isolate = script->GetIsolate();
-  Handle<FixedArray> old_infos(script->shared_function_infos(), isolate);
-  Handle<FixedArray> new_infos(
-      isolate->factory()->NewFixedArray(max_function_literal_id + 1));
+  Handle<WeakFixedArray> old_infos(script->shared_function_infos(), isolate);
+  Handle<WeakFixedArray> new_infos(
+      isolate->factory()->NewWeakFixedArray(max_function_literal_id + 1));
   script->set_shared_function_infos(*new_infos);
   SharedFunctionInfo::ScriptIterator iterator(isolate, old_infos);
   while (SharedFunctionInfo* shared = iterator.Next()) {
@@ -882,7 +883,7 @@ void LiveEdit::FixupScript(Handle<Script> script, int max_function_literal_id) {
     // as we severed the link from the Script to the SharedFunctionInfo above.
     Handle<SharedFunctionInfo> info(shared, isolate);
     info->set_script(isolate->heap()->undefined_value());
-    Handle<Object> new_noscript_list = WeakFixedArray::Add(
+    Handle<Object> new_noscript_list = FixedArrayOfWeakCells::Add(
         isolate->factory()->noscript_shared_function_infos(), info);
     isolate->heap()->SetRootNoScriptSharedFunctionInfos(*new_noscript_list);
 
@@ -974,16 +975,21 @@ void LiveEdit::PatchFunctionPositions(Handle<JSArray> shared_info_array,
   SharedInfoWrapper shared_info_wrapper(shared_info_array);
   Handle<SharedFunctionInfo> info = shared_info_wrapper.GetInfo();
 
-  int old_function_start = info->start_position();
+  int old_function_start = info->StartPosition();
   int new_function_start = TranslatePosition(old_function_start,
                                              position_change_array);
-  int new_function_end = TranslatePosition(info->end_position(),
-                                           position_change_array);
+  int new_function_end =
+      TranslatePosition(info->EndPosition(), position_change_array);
   int new_function_token_pos =
       TranslatePosition(info->function_token_position(), position_change_array);
 
-  info->set_start_position(new_function_start);
-  info->set_end_position(new_function_end);
+  info->set_raw_start_position(new_function_start);
+  info->set_raw_end_position(new_function_end);
+  // TODO(cbruni): Allocate helper ScopeInfo once the position fields are gone
+  // on the SFI.
+  if (info->scope_info()->HasPositionInfo()) {
+    info->scope_info()->SetPositionInfo(new_function_start, new_function_end);
+  }
   info->set_function_token_position(new_function_token_pos);
 
   if (info->HasBytecodeArray()) {
@@ -1013,7 +1019,7 @@ static Handle<Script> CreateScriptCopy(Handle<Script> original) {
       original->eval_from_shared_or_wrapped_arguments());
   copy->set_eval_from_position(original->eval_from_position());
 
-  Handle<FixedArray> infos(isolate->factory()->NewFixedArray(
+  Handle<WeakFixedArray> infos(isolate->factory()->NewWeakFixedArray(
       original->shared_function_infos()->length()));
   copy->set_shared_function_infos(*infos);
 
@@ -1060,7 +1066,7 @@ void LiveEdit::ReplaceRefToNestedFunction(
   Handle<SharedFunctionInfo> subst_shared =
       UnwrapSharedFunctionInfoFromJSValue(subst_function_wrapper);
 
-  for (RelocIterator it(parent_shared->code()); !it.done(); it.next()) {
+  for (RelocIterator it(parent_shared->GetCode()); !it.done(); it.next()) {
     if (it.rinfo()->rmode() == RelocInfo::EMBEDDED_OBJECT) {
       if (it.rinfo()->target_object() == *orig_shared) {
         it.rinfo()->set_target_object(*subst_shared);
diff --git a/deps/v8/src/debug/liveedit.h b/deps/v8/src/debug/liveedit.h
index 2335b94f103..db599b77e6a 100644
--- a/deps/v8/src/debug/liveedit.h
+++ b/deps/v8/src/debug/liveedit.h
@@ -321,4 +321,4 @@ class SharedInfoWrapper : public JSArrayBasedStruct<SharedInfoWrapper> {
 }  // namespace internal
 }  // namespace v8
 
-#endif /* V8_DEBUG_LIVEEDIT_H_ */
+#endif  // V8_DEBUG_LIVEEDIT_H_
diff --git a/deps/v8/src/debug/mips/OWNERS b/deps/v8/src/debug/mips/OWNERS
index 978563cab5e..4ce9d7f91da 100644
--- a/deps/v8/src/debug/mips/OWNERS
+++ b/deps/v8/src/debug/mips/OWNERS
@@ -1,2 +1,3 @@
 ivica.bogosavljevic@mips.com
 Miran.Karic@mips.com
+sreten.kovacevic@mips.com
\ No newline at end of file
diff --git a/deps/v8/src/debug/mips64/OWNERS b/deps/v8/src/debug/mips64/OWNERS
index 978563cab5e..4ce9d7f91da 100644
--- a/deps/v8/src/debug/mips64/OWNERS
+++ b/deps/v8/src/debug/mips64/OWNERS
@@ -1,2 +1,3 @@
 ivica.bogosavljevic@mips.com
 Miran.Karic@mips.com
+sreten.kovacevic@mips.com
\ No newline at end of file
diff --git a/deps/v8/src/debug/mirrors.js b/deps/v8/src/debug/mirrors.js
index 15d5e642581..85052b3cae2 100644
--- a/deps/v8/src/debug/mirrors.js
+++ b/deps/v8/src/debug/mirrors.js
@@ -54,11 +54,11 @@ macro IS_DATE(arg)
 endmacro
 
 macro IS_ERROR(arg)
-(%_ClassOf(arg) === 'Error')
+(%IsJSError(arg))
 endmacro
 
 macro IS_GENERATOR(arg)
-(%_ClassOf(arg) === 'Generator')
+(%IsJSGeneratorObject(arg))
 endmacro
 
 macro IS_MAP(arg)
@@ -66,11 +66,11 @@ macro IS_MAP(arg)
 endmacro
 
 macro IS_MAP_ITERATOR(arg)
-(%_ClassOf(arg) === 'Map Iterator')
+(%IsJSMapIterator(arg))
 endmacro
 
 macro IS_SCRIPT(arg)
-(%_ClassOf(arg) === 'Script')
+(%IsScriptWrapper(arg))
 endmacro
 
 macro IS_SET(arg)
@@ -78,7 +78,7 @@ macro IS_SET(arg)
 endmacro
 
 macro IS_SET_ITERATOR(arg)
-(%_ClassOf(arg) === 'Set Iterator')
+(%IsJSSetIterator(arg))
 endmacro
 
 // Must match PropertyFilter in property-details.h
@@ -638,7 +638,7 @@ inherits(ObjectMirror, ValueMirror);
 
 
 ObjectMirror.prototype.className = function() {
-  return %_ClassOf(this.value_);
+  return %ClassOf(this.value_);
 };
 
 
diff --git a/deps/v8/src/deoptimize-reason.h b/deps/v8/src/deoptimize-reason.h
index 3fabf555be1..6881e114b39 100644
--- a/deps/v8/src/deoptimize-reason.h
+++ b/deps/v8/src/deoptimize-reason.h
@@ -41,6 +41,7 @@ namespace internal {
   V(NotAJavaScriptObject, "not a JavaScript object")                           \
   V(NotANumberOrOddball, "not a Number or Oddball")                            \
   V(NotASmi, "not a Smi")                                                      \
+  V(NotAString, "not a String")                                                \
   V(NotASymbol, "not a Symbol")                                                \
   V(OutOfBounds, "out of bounds")                                              \
   V(Overflow, "overflow")                                                      \
@@ -53,7 +54,8 @@ namespace internal {
   V(WrongInstanceType, "wrong instance type")                                  \
   V(WrongMap, "wrong map")                                                     \
   V(WrongName, "wrong name")                                                   \
-  V(WrongValue, "wrong value")
+  V(WrongValue, "wrong value")                                                 \
+  V(NoInitialElement, "no initial element")
 
 enum class DeoptimizeReason : uint8_t {
 #define DEOPTIMIZE_REASON(Name, message) k##Name,
diff --git a/deps/v8/src/deoptimizer.cc b/deps/v8/src/deoptimizer.cc
index 362bd12cb66..15f50d264cc 100644
--- a/deps/v8/src/deoptimizer.cc
+++ b/deps/v8/src/deoptimizer.cc
@@ -276,6 +276,7 @@ void Deoptimizer::DeoptimizeAll(Isolate* isolate) {
     CodeTracer::Scope scope(isolate->GetCodeTracer());
     PrintF(scope.file(), "[deoptimize all code in all contexts]\n");
   }
+  isolate->AbortConcurrentOptimization(BlockingBehavior::kBlock);
   DisallowHeapAllocation no_allocation;
   // For all contexts, mark all code, then deoptimize.
   Object* context = isolate->heap()->native_contexts_list();
@@ -545,10 +546,8 @@ int LookupCatchHandler(TranslatedFrame* translated_frame, int* data_out) {
   switch (translated_frame->kind()) {
     case TranslatedFrame::kInterpretedFunction: {
       int bytecode_offset = translated_frame->node_id().ToInt();
-      BytecodeArray* bytecode =
-          translated_frame->raw_shared_info()->bytecode_array();
-      HandlerTable* table = HandlerTable::cast(bytecode->handler_table());
-      return table->LookupRange(bytecode_offset, data_out, nullptr);
+      HandlerTable table(translated_frame->raw_shared_info()->bytecode_array());
+      return table.LookupRange(bytecode_offset, data_out, nullptr);
     }
     default:
       break;
@@ -956,7 +955,8 @@ void Deoptimizer::DoComputeInterpretedFrame(TranslatedFrame* translated_frame,
       (!is_topmost || (bailout_type_ == LAZY)) && !goto_catch_handler
           ? builtins->builtin(Builtins::kInterpreterEnterBytecodeAdvance)
           : builtins->builtin(Builtins::kInterpreterEnterBytecodeDispatch);
-  output_frame->SetPc(reinterpret_cast<intptr_t>(dispatch_builtin->entry()));
+  output_frame->SetPc(
+      reinterpret_cast<intptr_t>(dispatch_builtin->InstructionStart()));
 
   // Update constant pool.
   if (FLAG_enable_embedded_constant_pool) {
@@ -980,7 +980,7 @@ void Deoptimizer::DoComputeInterpretedFrame(TranslatedFrame* translated_frame,
     // Set the continuation for the topmost frame.
     Code* continuation = builtins->builtin(Builtins::kNotifyDeoptimized);
     output_frame->SetContinuation(
-        reinterpret_cast<intptr_t>(continuation->entry()));
+        reinterpret_cast<intptr_t>(continuation->InstructionStart()));
   }
 }
 
@@ -1114,7 +1114,7 @@ void Deoptimizer::DoComputeArgumentsAdaptorFrame(
   Code* adaptor_trampoline =
       builtins->builtin(Builtins::kArgumentsAdaptorTrampoline);
   intptr_t pc_value = reinterpret_cast<intptr_t>(
-      adaptor_trampoline->instruction_start() +
+      adaptor_trampoline->InstructionStart() +
       isolate_->heap()->arguments_adaptor_deopt_pc_offset()->value());
   output_frame->SetPc(pc_value);
   if (FLAG_enable_embedded_constant_pool) {
@@ -1303,7 +1303,7 @@ void Deoptimizer::DoComputeConstructStubFrame(TranslatedFrame* translated_frame,
 
   // Compute this frame's PC.
   DCHECK(bailout_id.IsValidForConstructStub());
-  Address start = construct_stub->instruction_start();
+  Address start = construct_stub->InstructionStart();
   int pc_offset =
       bailout_id == BailoutId::ConstructStubCreate()
           ? isolate_->heap()->construct_stub_create_deopt_pc_offset()->value()
@@ -1338,7 +1338,7 @@ void Deoptimizer::DoComputeConstructStubFrame(TranslatedFrame* translated_frame,
     DCHECK_EQ(LAZY, bailout_type_);
     Code* continuation = builtins->builtin(Builtins::kNotifyDeoptimized);
     output_frame->SetContinuation(
-        reinterpret_cast<intptr_t>(continuation->entry()));
+        reinterpret_cast<intptr_t>(continuation->InstructionStart()));
   }
 }
 
@@ -1363,6 +1363,8 @@ void Deoptimizer::DoComputeConstructStubFrame(TranslatedFrame* translated_frame,
 //                TO
 //    |          ....           |
 //    +-------------------------+
+//    | arg padding (arch dept) |<- at most 1*kPointerSize
+//    +-------------------------+
 //    |     builtin param 0     |<- FrameState input value n becomes
 //    +-------------------------+
 //    |           ...           |
@@ -1384,7 +1386,13 @@ void Deoptimizer::DoComputeConstructStubFrame(TranslatedFrame* translated_frame,
 //    |          ...            |   to map a FrameState's 0..n-1 inputs to
 //    +-------------------------+   the builtin's n input register params.
 //    | builtin input GPR regn  |
-//    |-------------------------|<- spreg
+//    +-------------------------+
+//    | reg padding (arch dept) |
+//    +-------------------------+
+//    | res padding (arch dept) |<- only if {is_topmost}; result is pop'd by
+//    +-------------------------+<- kNotifyDeopt ASM stub and moved to acc
+//    |      result  value      |<- reg, as ContinueToBuiltin stub expects.
+//    +-------------------------+<- spreg
 //
 void Deoptimizer::DoComputeBuiltinContinuation(
     TranslatedFrame* translated_frame, int frame_index,
@@ -1398,7 +1406,7 @@ void Deoptimizer::DoComputeBuiltinContinuation(
 
   BailoutId bailout_id = translated_frame->node_id();
   Builtins::Name builtin_name = Builtins::GetBuiltinFromBailoutId(bailout_id);
-  DCHECK(!Builtins::IsLazy(builtin_name));
+  CHECK(!Builtins::IsLazy(builtin_name));
   Code* builtin = isolate()->builtins()->builtin(builtin_name);
   Callable continuation_callable =
       Builtins::CallableFor(isolate(), builtin_name);
@@ -1688,12 +1696,12 @@ void Deoptimizer::DoComputeBuiltinContinuation(
                  : isolate()->builtins()->builtin(
                        Builtins::kContinueToCodeStubBuiltin));
   output_frame->SetPc(
-      reinterpret_cast<intptr_t>(continue_to_builtin->instruction_start()));
+      reinterpret_cast<intptr_t>(continue_to_builtin->InstructionStart()));
 
   Code* continuation =
       isolate()->builtins()->builtin(Builtins::kNotifyDeoptimized);
   output_frame->SetContinuation(
-      reinterpret_cast<intptr_t>(continuation->entry()));
+      reinterpret_cast<intptr_t>(continuation->InstructionStart()));
 }
 
 void Deoptimizer::MaterializeHeapObjects() {
@@ -1832,14 +1840,13 @@ void Deoptimizer::EnsureCodeForDeoptimizationEntry(Isolate* isolate,
   GenerateDeoptimizationEntries(&masm, kMaxNumberOfEntries, type);
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
-  DCHECK(!RelocInfo::RequiresRelocation(isolate, desc));
+  DCHECK(!RelocInfo::RequiresRelocation(desc));
 
   // Allocate the code as immovable since the entry addresses will be used
   // directly and there is no support for relocating them.
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Object>(), Builtins::kNoBuiltinId,
-      MaybeHandle<HandlerTable>(), MaybeHandle<ByteArray>(),
-      MaybeHandle<DeoptimizationData>(), kImmovable);
+      MaybeHandle<ByteArray>(), MaybeHandle<DeoptimizationData>(), kImmovable);
   CHECK(Heap::IsImmovable(*code));
 
   CHECK_NULL(data->deopt_entry_code_[type]);
@@ -2287,7 +2294,7 @@ DeoptimizedFrameInfo::DeoptimizedFrameInfo(TranslatedState* state,
 
 
 Deoptimizer::DeoptInfo Deoptimizer::GetDeoptInfo(Code* code, Address pc) {
-  CHECK(code->instruction_start() <= pc && pc <= code->instruction_end());
+  CHECK(code->InstructionStart() <= pc && pc <= code->InstructionEnd());
   SourcePosition last_position = SourcePosition::Unknown();
   DeoptimizeReason last_reason = DeoptimizeReason::kUnknown;
   int last_deopt_id = kNoDeoptimizationId;
@@ -3376,6 +3383,16 @@ void TranslatedState::InitializeCapturedObjectAt(
       return;
 
     case FIXED_ARRAY_TYPE:
+    case BLOCK_CONTEXT_TYPE:
+    case CATCH_CONTEXT_TYPE:
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+    case EVAL_CONTEXT_TYPE:
+    case FUNCTION_CONTEXT_TYPE:
+    case MODULE_CONTEXT_TYPE:
+    case NATIVE_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TYPE:
+    case WITH_CONTEXT_TYPE:
+    case BOILERPLATE_DESCRIPTION_TYPE:
     case HASH_TABLE_TYPE:
     case PROPERTY_ARRAY_TYPE:
     case CONTEXT_EXTENSION_TYPE:
@@ -3501,6 +3518,15 @@ void TranslatedState::EnsureCapturedObjectAllocatedAt(
       return MaterializeMutableHeapNumber(frame, &value_index, slot);
 
     case FIXED_ARRAY_TYPE:
+    case BLOCK_CONTEXT_TYPE:
+    case CATCH_CONTEXT_TYPE:
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+    case EVAL_CONTEXT_TYPE:
+    case FUNCTION_CONTEXT_TYPE:
+    case MODULE_CONTEXT_TYPE:
+    case NATIVE_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TYPE:
+    case WITH_CONTEXT_TYPE:
     case HASH_TABLE_TYPE: {
       // Check we have the right size.
       int array_length =
@@ -3906,7 +3932,7 @@ bool TranslatedState::DoUpdateFeedback() {
   if (!feedback_vector_handle_.is_null()) {
     CHECK(!feedback_slot_.IsInvalid());
     isolate()->CountUsage(v8::Isolate::kDeoptimizerDisableSpeculation);
-    CallICNexus nexus(feedback_vector_handle_, feedback_slot_);
+    FeedbackNexus nexus(feedback_vector_handle_, feedback_slot_);
     nexus.SetSpeculationMode(SpeculationMode::kDisallowSpeculation);
     return true;
   }
diff --git a/deps/v8/src/deoptimizer.h b/deps/v8/src/deoptimizer.h
index e72878654d5..eddcdbcf70e 100644
--- a/deps/v8/src/deoptimizer.h
+++ b/deps/v8/src/deoptimizer.h
@@ -12,7 +12,9 @@
 #include "src/base/macros.h"
 #include "src/boxed-float.h"
 #include "src/deoptimize-reason.h"
+#include "src/feedback-vector.h"
 #include "src/frame-constants.h"
+#include "src/isolate.h"
 #include "src/macro-assembler.h"
 #include "src/source-position.h"
 #include "src/zone/zone-chunk-list.h"
diff --git a/deps/v8/src/disasm.h b/deps/v8/src/disasm.h
index 263aa317d55..00e0e29546d 100644
--- a/deps/v8/src/disasm.h
+++ b/deps/v8/src/disasm.h
@@ -41,6 +41,13 @@ class Disassembler {
   // Returns the length of the disassembled machine instruction in bytes.
   int InstructionDecode(v8::internal::Vector<char> buffer, byte* instruction);
 
+  // Disassemblers on ia32/x64 need a separate method for testing, as
+  // instruction decode method above continues on unimplemented opcodes, and
+  // does not test the disassemblers. Basic functionality of the method remains
+  // the same.
+  int InstructionDecodeForTesting(v8::internal::Vector<char> buffer,
+                                  byte* instruction);
+
   // Returns -1 if instruction does not mark the beginning of a constant pool,
   // or the number of entries in the constant pool beginning here.
   int ConstantPoolSizeAt(byte* instruction);
@@ -48,6 +55,7 @@ class Disassembler {
   // Write disassembly into specified file 'f' using specified NameConverter
   // (see constructor).
   static void Disassemble(FILE* f, byte* begin, byte* end);
+
  private:
   const NameConverter& converter_;
 
diff --git a/deps/v8/src/disassembler.cc b/deps/v8/src/disassembler.cc
index a26517b432f..c91e7b21885 100644
--- a/deps/v8/src/disassembler.cc
+++ b/deps/v8/src/disassembler.cc
@@ -135,6 +135,8 @@ static void PrintRelocInfo(StringBuilder* out, Isolate* isolate,
       out->AddFormatted(" %s, %s, ", Code::Kind2String(kind),
                         CodeStub::MajorName(major_key));
       out->AddFormatted("minor: %d", minor_key);
+    } else if (code->is_builtin()) {
+      out->AddFormatted(" Builtin::%s", Builtins::name(code->builtin_index()));
     } else {
       out->AddFormatted(" %s", Code::Kind2String(kind));
     }
@@ -256,7 +258,9 @@ static int DecodeIt(Isolate* isolate, std::ostream* os,
     // Print all the reloc info for this instruction which are not comments.
     for (size_t i = 0; i < pcs.size(); i++) {
       // Put together the reloc info
-      RelocInfo relocinfo(pcs[i], rmodes[i], datas[i], converter.code());
+      Code* host = converter.code();
+      RelocInfo relocinfo(pcs[i], rmodes[i], datas[i], host);
+      relocinfo.set_constant_pool(host ? host->constant_pool() : nullptr);
 
       bool first_reloc_info = (i == 0);
       PrintRelocInfo(&out, isolate, ref_encoder, os, &relocinfo,
@@ -267,7 +271,7 @@ static int DecodeIt(Isolate* isolate, std::ostream* os,
     // already, check if we can find some RelocInfo for the target address in
     // the constant pool.
     if (pcs.empty() && converter.code() != nullptr) {
-      RelocInfo dummy_rinfo(prev_pc, RelocInfo::NONE32, 0, nullptr);
+      RelocInfo dummy_rinfo(prev_pc, RelocInfo::NONE, 0, nullptr);
       if (dummy_rinfo.IsInConstantPool()) {
         byte* constant_pool_entry_address =
             dummy_rinfo.constant_pool_entry_address();
diff --git a/deps/v8/src/eh-frame.h b/deps/v8/src/eh-frame.h
index bd064eb9cdf..68a8c031c09 100644
--- a/deps/v8/src/eh-frame.h
+++ b/deps/v8/src/eh-frame.h
@@ -298,4 +298,4 @@ class EhFrameDisassembler final {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_EH_FRAME_H_
diff --git a/deps/v8/src/elements-kind.cc b/deps/v8/src/elements-kind.cc
index 0018d59c634..0905677c3c1 100644
--- a/deps/v8/src/elements-kind.cc
+++ b/deps/v8/src/elements-kind.cc
@@ -30,6 +30,8 @@ int ElementsKindToShiftSize(ElementsKind elements_kind) {
     case PACKED_DOUBLE_ELEMENTS:
     case HOLEY_DOUBLE_ELEMENTS:
     case FLOAT64_ELEMENTS:
+    case BIGINT64_ELEMENTS:
+    case BIGUINT64_ELEMENTS:
       return 3;
     case PACKED_SMI_ELEMENTS:
     case PACKED_ELEMENTS:
@@ -153,6 +155,92 @@ bool IsMoreGeneralElementsKindTransition(ElementsKind from_kind,
   return false;
 }
 
+bool UnionElementsKindUptoSize(ElementsKind* a_out, ElementsKind b) {
+  // Assert that the union of two ElementKinds can be computed via std::max.
+  static_assert(PACKED_SMI_ELEMENTS < HOLEY_SMI_ELEMENTS,
+                "ElementsKind union not computable via std::max.");
+  static_assert(HOLEY_SMI_ELEMENTS < PACKED_ELEMENTS,
+                "ElementsKind union not computable via std::max.");
+  static_assert(PACKED_ELEMENTS < HOLEY_ELEMENTS,
+                "ElementsKind union not computable via std::max.");
+  static_assert(PACKED_DOUBLE_ELEMENTS < HOLEY_DOUBLE_ELEMENTS,
+                "ElementsKind union not computable via std::max.");
+  ElementsKind a = *a_out;
+  switch (a) {
+    case PACKED_SMI_ELEMENTS:
+      switch (b) {
+        case PACKED_SMI_ELEMENTS:
+        case HOLEY_SMI_ELEMENTS:
+        case PACKED_ELEMENTS:
+        case HOLEY_ELEMENTS:
+          *a_out = b;
+          return true;
+        default:
+          return false;
+      }
+    case HOLEY_SMI_ELEMENTS:
+      switch (b) {
+        case PACKED_SMI_ELEMENTS:
+        case HOLEY_SMI_ELEMENTS:
+          *a_out = HOLEY_SMI_ELEMENTS;
+          return true;
+        case PACKED_ELEMENTS:
+        case HOLEY_ELEMENTS:
+          *a_out = HOLEY_ELEMENTS;
+          return true;
+        default:
+          return false;
+      }
+    case PACKED_ELEMENTS:
+      switch (b) {
+        case PACKED_SMI_ELEMENTS:
+        case PACKED_ELEMENTS:
+          *a_out = PACKED_ELEMENTS;
+          return true;
+        case HOLEY_SMI_ELEMENTS:
+        case HOLEY_ELEMENTS:
+          *a_out = HOLEY_ELEMENTS;
+          return true;
+        default:
+          return false;
+      }
+    case HOLEY_ELEMENTS:
+      switch (b) {
+        case PACKED_SMI_ELEMENTS:
+        case HOLEY_SMI_ELEMENTS:
+        case PACKED_ELEMENTS:
+        case HOLEY_ELEMENTS:
+          *a_out = HOLEY_ELEMENTS;
+          return true;
+        default:
+          return false;
+      }
+      break;
+    case PACKED_DOUBLE_ELEMENTS:
+      switch (b) {
+        case PACKED_DOUBLE_ELEMENTS:
+        case HOLEY_DOUBLE_ELEMENTS:
+          *a_out = b;
+          return true;
+        default:
+          return false;
+      }
+    case HOLEY_DOUBLE_ELEMENTS:
+      switch (b) {
+        case PACKED_DOUBLE_ELEMENTS:
+        case HOLEY_DOUBLE_ELEMENTS:
+          *a_out = HOLEY_DOUBLE_ELEMENTS;
+          return true;
+        default:
+          return false;
+      }
+
+      break;
+    default:
+      break;
+  }
+  return false;
+}
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/elements-kind.h b/deps/v8/src/elements-kind.h
index b03f9340f30..b00966ef109 100644
--- a/deps/v8/src/elements-kind.h
+++ b/deps/v8/src/elements-kind.h
@@ -49,17 +49,19 @@ enum ElementsKind {
   FLOAT32_ELEMENTS,
   FLOAT64_ELEMENTS,
   UINT8_CLAMPED_ELEMENTS,
+  BIGUINT64_ELEMENTS,
+  BIGINT64_ELEMENTS,
 
   // Sentinel ElementsKind for objects with no elements.
   NO_ELEMENTS,
 
   // Derived constants from ElementsKind.
   FIRST_ELEMENTS_KIND = PACKED_SMI_ELEMENTS,
-  LAST_ELEMENTS_KIND = UINT8_CLAMPED_ELEMENTS,
+  LAST_ELEMENTS_KIND = BIGINT64_ELEMENTS,
   FIRST_FAST_ELEMENTS_KIND = PACKED_SMI_ELEMENTS,
   LAST_FAST_ELEMENTS_KIND = HOLEY_DOUBLE_ELEMENTS,
   FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND = UINT8_ELEMENTS,
-  LAST_FIXED_TYPED_ARRAY_ELEMENTS_KIND = UINT8_CLAMPED_ELEMENTS,
+  LAST_FIXED_TYPED_ARRAY_ELEMENTS_KIND = BIGINT64_ELEMENTS,
   TERMINAL_FAST_ELEMENTS_KIND = HOLEY_ELEMENTS
 };
 
@@ -229,6 +231,8 @@ inline bool UnionElementsKindUptoPackedness(ElementsKind* a_out,
   return false;
 }
 
+bool UnionElementsKindUptoSize(ElementsKind* a_out, ElementsKind b);
+
 inline ElementsKind FastSmiToObjectElementsKind(ElementsKind from_kind) {
   DCHECK(IsSmiElementsKind(from_kind));
   return (from_kind == PACKED_SMI_ELEMENTS) ? PACKED_ELEMENTS : HOLEY_ELEMENTS;
diff --git a/deps/v8/src/elements.cc b/deps/v8/src/elements.cc
index 499af83078b..471798dd79a 100644
--- a/deps/v8/src/elements.cc
+++ b/deps/v8/src/elements.cc
@@ -12,7 +12,6 @@
 #include "src/messages.h"
 #include "src/objects-inl.h"
 #include "src/utils.h"
-#include "src/zone/zone.h"
 
 // Each concrete ElementsAccessor can handle exactly one ElementsKind,
 // several abstract ElementsAccessor classes are used to allow sharing
@@ -39,6 +38,8 @@
 //     - FixedFloat32ElementsAccessor
 //     - FixedFloat64ElementsAccessor
 //     - FixedUint8ClampedElementsAccessor
+//     - FixedBigUint64ElementsAccessor
+//     - FixedBigInt64ElementsAccessor
 //   - DictionaryElementsAccessor
 //   - SloppyArgumentsElementsAccessor
 //     - FastSloppyArgumentsElementsAccessor
@@ -90,7 +91,9 @@ enum Where { AT_START, AT_END };
   V(FixedFloat32ElementsAccessor, FLOAT32_ELEMENTS, FixedFloat32Array)        \
   V(FixedFloat64ElementsAccessor, FLOAT64_ELEMENTS, FixedFloat64Array)        \
   V(FixedUint8ClampedElementsAccessor, UINT8_CLAMPED_ELEMENTS,                \
-    FixedUint8ClampedArray)
+    FixedUint8ClampedArray)                                                   \
+  V(FixedBigUint64ElementsAccessor, BIGUINT64_ELEMENTS, FixedBigUint64Array)  \
+  V(FixedBigInt64ElementsAccessor, BIGINT64_ELEMENTS, FixedBigInt64Array)
 
 template<ElementsKind Kind> class ElementsKindTraits {
  public:
@@ -718,22 +721,11 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     return Subclass::SliceImpl(receiver, start, end);
   }
 
-  Handle<JSObject> Slice(Handle<JSObject> receiver, uint32_t start,
-                         uint32_t end, Handle<JSObject> result) final {
-    return Subclass::SliceWithResultImpl(receiver, start, end, result);
-  }
-
   static Handle<JSObject> SliceImpl(Handle<JSObject> receiver, uint32_t start,
                                     uint32_t end) {
     UNREACHABLE();
   }
 
-  static Handle<JSObject> SliceWithResultImpl(Handle<JSObject> receiver,
-                                              uint32_t start, uint32_t end,
-                                              Handle<JSObject> result) {
-    UNREACHABLE();
-  }
-
   Handle<JSArray> Splice(Handle<JSArray> receiver, uint32_t start,
                          uint32_t delete_count, Arguments* args,
                          uint32_t add_count) final {
@@ -1035,13 +1027,25 @@ class ElementsAccessorBase : public InternalElementsAccessor {
                                kPackedSizeNotKnown, size);
   }
 
-  Object* CopyElements(Handle<JSReceiver> source, Handle<JSObject> destination,
+  void CopyTypedArrayElementsSlice(JSTypedArray* source,
+                                   JSTypedArray* destination, size_t start,
+                                   size_t end) {
+    Subclass::CopyTypedArrayElementsSliceImpl(source, destination, start, end);
+  }
+
+  static void CopyTypedArrayElementsSliceImpl(JSTypedArray* source,
+                                              JSTypedArray* destination,
+                                              size_t start, size_t end) {
+    UNREACHABLE();
+  }
+
+  Object* CopyElements(Handle<Object> source, Handle<JSObject> destination,
                        size_t length, uint32_t offset) final {
     return Subclass::CopyElementsHandleImpl(source, destination, length,
                                             offset);
   }
 
-  static Object* CopyElementsHandleImpl(Handle<JSReceiver> source,
+  static Object* CopyElementsHandleImpl(Handle<Object> source,
                                         Handle<JSObject> destination,
                                         size_t length, uint32_t offset) {
     UNREACHABLE();
@@ -2995,15 +2999,9 @@ class TypedElementsAccessor
                           uint32_t end) {
     Handle<JSTypedArray> array = Handle<JSTypedArray>::cast(receiver);
     DCHECK(!array->WasNeutered());
-    DCHECK(obj_value->IsNumber());
+    DCHECK(obj_value->IsNumeric());
 
-    ctype value;
-    if (obj_value->IsSmi()) {
-      value = BackingStore::from(Smi::ToInt(*obj_value));
-    } else {
-      DCHECK(obj_value->IsHeapNumber());
-      value = BackingStore::from(HeapNumber::cast(*obj_value)->value());
-    }
+    ctype value = BackingStore::FromHandle(obj_value);
 
     // Ensure indexes are within array bounds
     DCHECK_LE(0, start);
@@ -3034,41 +3032,49 @@ class TypedElementsAccessor
         length > static_cast<uint32_t>(elements->length())) {
       return Just(true);
     }
-    if (!value->IsNumber()) return Just(false);
-
-    double search_value = value->Number();
-
-    if (!std::isfinite(search_value)) {
-      // Integral types cannot represent +Inf or NaN
-      if (AccessorClass::kind() < FLOAT32_ELEMENTS ||
-          AccessorClass::kind() > FLOAT64_ELEMENTS) {
-        return Just(false);
-      }
-    } else if (search_value < std::numeric_limits<ctype>::lowest() ||
-               search_value > std::numeric_limits<ctype>::max()) {
-      // Return false if value can't be represented in this space
-      return Just(false);
-    }
-
+    ctype typed_search_value;
     // Prototype has no elements, and not searching for the hole --- limit
     // search to backing store length.
     if (static_cast<uint32_t>(elements->length()) < length) {
       length = elements->length();
     }
 
-    if (!std::isnan(search_value)) {
-      for (uint32_t k = start_from; k < length; ++k) {
-        double element_k = elements->get_scalar(k);
-        if (element_k == search_value) return Just(true);
-      }
-      return Just(false);
+    if (Kind == BIGINT64_ELEMENTS || Kind == BIGUINT64_ELEMENTS) {
+      if (!value->IsBigInt()) return Just(false);
+      bool lossless;
+      typed_search_value = BackingStore::FromHandle(value, &lossless);
+      if (!lossless) return Just(false);
     } else {
-      for (uint32_t k = start_from; k < length; ++k) {
-        double element_k = elements->get_scalar(k);
-        if (std::isnan(element_k)) return Just(true);
+      if (!value->IsNumber()) return Just(false);
+      double search_value = value->Number();
+      if (!std::isfinite(search_value)) {
+        // Integral types cannot represent +Inf or NaN.
+        if (Kind < FLOAT32_ELEMENTS || Kind > FLOAT64_ELEMENTS) {
+          return Just(false);
+        }
+        if (std::isnan(search_value)) {
+          for (uint32_t k = start_from; k < length; ++k) {
+            double element_k = elements->get_scalar(k);
+            if (std::isnan(element_k)) return Just(true);
+          }
+          return Just(false);
+        }
+      } else if (search_value < std::numeric_limits<ctype>::lowest() ||
+                 search_value > std::numeric_limits<ctype>::max()) {
+        // Return false if value can't be represented in this space.
+        return Just(false);
       }
-      return Just(false);
+      typed_search_value = static_cast<ctype>(search_value);
+      if (static_cast<double>(typed_search_value) != search_value) {
+        return Just(false);  // Loss of precision.
+      }
+    }
+
+    for (uint32_t k = start_from; k < length; ++k) {
+      ctype element_k = elements->get_scalar(k);
+      if (element_k == typed_search_value) return Just(true);
     }
+    return Just(false);
   }
 
   static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
@@ -3080,20 +3086,33 @@ class TypedElementsAccessor
     if (WasNeutered(*receiver)) return Just<int64_t>(-1);
 
     BackingStore* elements = BackingStore::cast(receiver->elements());
-    if (!value->IsNumber()) return Just<int64_t>(-1);
-
-    double search_value = value->Number();
+    ctype typed_search_value;
 
-    if (!std::isfinite(search_value)) {
-      // Integral types cannot represent +Inf or NaN.
-      if (AccessorClass::kind() < FLOAT32_ELEMENTS ||
-          AccessorClass::kind() > FLOAT64_ELEMENTS) {
+    if (Kind == BIGINT64_ELEMENTS || Kind == BIGUINT64_ELEMENTS) {
+      if (!value->IsBigInt()) return Just<int64_t>(-1);
+      bool lossless;
+      typed_search_value = BackingStore::FromHandle(value, &lossless);
+      if (!lossless) return Just<int64_t>(-1);
+    } else {
+      if (!value->IsNumber()) return Just<int64_t>(-1);
+      double search_value = value->Number();
+      if (!std::isfinite(search_value)) {
+        // Integral types cannot represent +Inf or NaN.
+        if (Kind < FLOAT32_ELEMENTS || Kind > FLOAT64_ELEMENTS) {
+          return Just<int64_t>(-1);
+        }
+        if (std::isnan(search_value)) {
+          return Just<int64_t>(-1);
+        }
+      } else if (search_value < std::numeric_limits<ctype>::lowest() ||
+                 search_value > std::numeric_limits<ctype>::max()) {
+        // Return false if value can't be represented in this ElementsKind.
         return Just<int64_t>(-1);
       }
-    } else if (search_value < std::numeric_limits<ctype>::lowest() ||
-               search_value > std::numeric_limits<ctype>::max()) {
-      // Return false if value can't be represented in this ElementsKind.
-      return Just<int64_t>(-1);
+      typed_search_value = static_cast<ctype>(search_value);
+      if (static_cast<double>(typed_search_value) != search_value) {
+        return Just<int64_t>(-1);  // Loss of precision.
+      }
     }
 
     // Prototype has no elements, and not searching for the hole --- limit
@@ -3102,15 +3121,6 @@ class TypedElementsAccessor
       length = elements->length();
     }
 
-    if (std::isnan(search_value)) {
-      return Just<int64_t>(-1);
-    }
-
-    ctype typed_search_value = static_cast<ctype>(search_value);
-    if (static_cast<double>(typed_search_value) != search_value) {
-      return Just<int64_t>(-1);  // Loss of precision.
-    }
-
     for (uint32_t k = start_from; k < length; ++k) {
       ctype element_k = elements->get_scalar(k);
       if (element_k == typed_search_value) return Just<int64_t>(k);
@@ -3125,28 +3135,34 @@ class TypedElementsAccessor
     DisallowHeapAllocation no_gc;
     DCHECK(!WasNeutered(*receiver));
 
-    if (!value->IsNumber()) return Just<int64_t>(-1);
     BackingStore* elements = BackingStore::cast(receiver->elements());
+    ctype typed_search_value;
 
-    double search_value = value->Number();
-
-    if (!std::isfinite(search_value)) {
-      if (std::is_integral<ctype>::value) {
-        // Integral types cannot represent +Inf or NaN.
-        return Just<int64_t>(-1);
-      } else if (std::isnan(search_value)) {
-        // Strict Equality Comparison of NaN is always false.
+    if (Kind == BIGINT64_ELEMENTS || Kind == BIGUINT64_ELEMENTS) {
+      if (!value->IsBigInt()) return Just<int64_t>(-1);
+      bool lossless;
+      typed_search_value = BackingStore::FromHandle(value, &lossless);
+      if (!lossless) return Just<int64_t>(-1);
+    } else {
+      if (!value->IsNumber()) return Just<int64_t>(-1);
+      double search_value = value->Number();
+      if (!std::isfinite(search_value)) {
+        if (std::is_integral<ctype>::value) {
+          // Integral types cannot represent +Inf or NaN.
+          return Just<int64_t>(-1);
+        } else if (std::isnan(search_value)) {
+          // Strict Equality Comparison of NaN is always false.
+          return Just<int64_t>(-1);
+        }
+      } else if (search_value < std::numeric_limits<ctype>::lowest() ||
+                 search_value > std::numeric_limits<ctype>::max()) {
+        // Return -1 if value can't be represented in this ElementsKind.
         return Just<int64_t>(-1);
       }
-    } else if (search_value < std::numeric_limits<ctype>::lowest() ||
-               search_value > std::numeric_limits<ctype>::max()) {
-      // Return -1 if value can't be represented in this ElementsKind.
-      return Just<int64_t>(-1);
-    }
-
-    ctype typed_search_value = static_cast<ctype>(search_value);
-    if (static_cast<double>(typed_search_value) != search_value) {
-      return Just<int64_t>(-1);  // Loss of precision.
+      typed_search_value = static_cast<ctype>(search_value);
+      if (static_cast<double>(typed_search_value) != search_value) {
+        return Just<int64_t>(-1);  // Loss of precision.
+      }
     }
 
     DCHECK_LT(start_from, elements->length());
@@ -3186,55 +3202,52 @@ class TypedElementsAccessor
     return result;
   }
 
-  static Handle<JSObject> SliceWithResultImpl(Handle<JSObject> receiver,
-                                              uint32_t start, uint32_t end,
-                                              Handle<JSObject> result) {
-    Isolate* isolate = receiver->GetIsolate();
-    DCHECK(!WasNeutered(*receiver));
-    DCHECK(result->IsJSTypedArray());
-    DCHECK(!WasNeutered(*result));
+  static void CopyTypedArrayElementsSliceImpl(JSTypedArray* source,
+                                              JSTypedArray* destination,
+                                              size_t start, size_t end) {
+    DisallowHeapAllocation no_gc;
+    DCHECK_EQ(destination->GetElementsKind(), AccessorClass::kind());
+    DCHECK(!source->WasNeutered());
+    DCHECK(!destination->WasNeutered());
     DCHECK_LE(start, end);
+    DCHECK_LE(end, source->length_value());
 
-    Handle<JSTypedArray> array = Handle<JSTypedArray>::cast(receiver);
-    Handle<JSTypedArray> result_array = Handle<JSTypedArray>::cast(result);
-    DCHECK_LE(end, array->length_value());
+    size_t count = end - start;
+    DCHECK_LE(count, destination->length_value());
 
-    // Fast path for the same type result array
-    if (result_array->type() == array->type()) {
-      int64_t element_size = array->element_size();
-      int64_t count = end - start;
+    FixedTypedArrayBase* src_elements =
+        FixedTypedArrayBase::cast(source->elements());
+    BackingStore* dest_elements = BackingStore::cast(destination->elements());
 
-      DisallowHeapAllocation no_gc;
-      BackingStore* src_elements = BackingStore::cast(receiver->elements());
-      BackingStore* result_elements =
-          BackingStore::cast(result_array->elements());
-
-      DCHECK_LE(count, result_elements->length());
-      uint8_t* src =
-          static_cast<uint8_t*>(src_elements->DataPtr()) + start * element_size;
-      uint8_t* result = static_cast<uint8_t*>(result_elements->DataPtr());
-      if (array->buffer() != result_array->buffer()) {
-        std::memcpy(result, src, count * element_size);
-      } else {
-        // The spec defines the copy-step iteratively, which means that we
-        // cannot use memcpy if the buffer is shared.
-        uint8_t* end = src + count * element_size;
-        while (src < end) {
-          *result++ = *src++;
-        }
+    size_t element_size = source->element_size();
+    uint8_t* source_data =
+        static_cast<uint8_t*>(src_elements->DataPtr()) + start * element_size;
+
+    // Fast path for the same type result array
+    if (source->type() == destination->type()) {
+      uint8_t* dest_data = static_cast<uint8_t*>(dest_elements->DataPtr());
+
+      // The spec defines the copy-step iteratively, which means that we
+      // cannot use memcpy if the buffer is shared.
+      uint8_t* end_ptr = source_data + count * element_size;
+      while (source_data < end_ptr) {
+        *dest_data++ = *source_data++;
       }
-      return result_array;
+      return;
     }
 
-    // If the types of the two typed arrays are different, properly convert
-    // elements
-    Handle<BackingStore> from(BackingStore::cast(array->elements()), isolate);
-    ElementsAccessor* result_accessor = result_array->GetElementsAccessor();
-    for (uint32_t i = start; i < end; i++) {
-      Handle<Object> elem = AccessorClass::GetImpl(isolate, *from, i);
-      result_accessor->Set(result_array, i - start, *elem);
+    switch (source->GetElementsKind()) {
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                     \
+  case TYPE##_ELEMENTS:                                                     \
+    CopyBetweenBackingStores<Type##ArrayTraits>(source_data, dest_elements, \
+                                                count, 0);                  \
+    break;
+      TYPED_ARRAYS(TYPED_ARRAY_CASE)
+#undef TYPED_ARRAY_CASE
+      default:
+        UNREACHABLE();
+        break;
     }
-    return result_array;
   }
 
   static bool HasSimpleRepresentation(InstanceType type) {
@@ -3271,9 +3284,9 @@ class TypedElementsAccessor
         BackingStore::cast(destination->elements());
 
     DCHECK_LE(offset, destination->length_value());
-    DCHECK_LE(source->length_value(), destination->length_value() - offset);
+    DCHECK_LE(length, destination->length_value() - offset);
     DCHECK(source->length()->IsSmi());
-    DCHECK_EQ(length, source->length_value());
+    DCHECK_LE(length, source->length_value());
 
     InstanceType source_type = source_elements->map()->instance_type();
     InstanceType destination_type =
@@ -3298,15 +3311,15 @@ class TypedElementsAccessor
       std::memmove(dest_data + offset * element_size, source_data,
                    length * element_size);
     } else {
-      Isolate* isolate = source->GetIsolate();
-      Zone zone(isolate->allocator(), ZONE_NAME);
+      std::unique_ptr<uint8_t[]> cloned_source_elements;
 
       // If the typedarrays are overlapped, clone the source.
       if (dest_data + dest_byte_length > source_data &&
           source_data + source_byte_length > dest_data) {
-        uint8_t* temp_data = zone.NewArray<uint8_t>(source_byte_length);
-        std::memcpy(temp_data, source_data, source_byte_length);
-        source_data = temp_data;
+        cloned_source_elements.reset(new uint8_t[source_byte_length]);
+        std::memcpy(cloned_source_elements.get(), source_data,
+                    source_byte_length);
+        source_data = cloned_source_elements.get();
       }
 
       switch (source->GetElementsKind()) {
@@ -3339,7 +3352,8 @@ class TypedElementsAccessor
     // them.
     if (source_proto->IsNull(isolate)) return false;
     if (source_proto->IsJSProxy()) return true;
-    if (!context->is_initial_array_prototype(JSObject::cast(source_proto))) {
+    if (!context->native_context()->is_initial_array_prototype(
+            JSObject::cast(source_proto))) {
       return true;
     }
 
@@ -3349,6 +3363,7 @@ class TypedElementsAccessor
   static bool TryCopyElementsFastNumber(Context* context, JSArray* source,
                                         JSTypedArray* destination,
                                         size_t length, uint32_t offset) {
+    if (Kind == BIGINT64_ELEMENTS || Kind == BIGUINT64_ELEMENTS) return false;
     Isolate* isolate = source->GetIsolate();
     DisallowHeapAllocation no_gc;
     DisallowJavascriptExecution no_js(isolate);
@@ -3418,18 +3433,24 @@ class TypedElementsAccessor
     return false;
   }
 
-  static Object* CopyElementsHandleSlow(Handle<JSReceiver> source,
+  static Object* CopyElementsHandleSlow(Handle<Object> source,
                                         Handle<JSTypedArray> destination,
                                         size_t length, uint32_t offset) {
-    Isolate* isolate = source->GetIsolate();
+    Isolate* isolate = destination->GetIsolate();
     Handle<BackingStore> destination_elements(
         BackingStore::cast(destination->elements()));
     for (uint32_t i = 0; i < length; i++) {
-      LookupIterator it(isolate, source, i, source);
+      LookupIterator it(isolate, source, i);
       Handle<Object> elem;
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, elem,
                                          Object::GetProperty(&it));
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, elem, Object::ToNumber(elem));
+      if (Kind == BIGINT64_ELEMENTS || Kind == BIGUINT64_ELEMENTS) {
+        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, elem,
+                                           BigInt::FromObject(isolate, elem));
+      } else {
+        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, elem,
+                                           Object::ToNumber(elem));
+      }
 
       if (V8_UNLIKELY(destination->WasNeutered())) {
         const char* op = "set";
@@ -3450,7 +3471,7 @@ class TypedElementsAccessor
   // This doesn't guarantee that the destination array will be completely
   // filled. The caller must do this by passing a source with equal length, if
   // that is required.
-  static Object* CopyElementsHandleImpl(Handle<JSReceiver> source,
+  static Object* CopyElementsHandleImpl(Handle<Object> source,
                                         Handle<JSObject> destination,
                                         size_t length, uint32_t offset) {
     Isolate* isolate = destination->GetIsolate();
@@ -3463,8 +3484,30 @@ class TypedElementsAccessor
     // All conversions from TypedArrays can be done without allocation.
     if (source->IsJSTypedArray()) {
       Handle<JSTypedArray> source_ta = Handle<JSTypedArray>::cast(source);
-      CopyElementsFromTypedArray(*source_ta, *destination_ta, length, offset);
-      return *isolate->factory()->undefined_value();
+      ElementsKind source_kind = source_ta->GetElementsKind();
+      bool source_is_bigint =
+          source_kind == BIGINT64_ELEMENTS || source_kind == BIGUINT64_ELEMENTS;
+      bool target_is_bigint =
+          Kind == BIGINT64_ELEMENTS || Kind == BIGUINT64_ELEMENTS;
+      if (target_is_bigint) {
+        if (V8_UNLIKELY(!source_is_bigint)) {
+          Handle<Object> first =
+              JSReceiver::GetElement(isolate, source_ta, 0).ToHandleChecked();
+          THROW_NEW_ERROR_RETURN_FAILURE(
+              isolate, NewTypeError(MessageTemplate::kBigIntFromObject, first));
+        }
+      } else {
+        if (V8_UNLIKELY(source_is_bigint)) {
+          THROW_NEW_ERROR_RETURN_FAILURE(
+              isolate, NewTypeError(MessageTemplate::kBigIntToNumber));
+        }
+      }
+      // If we have to copy more elements than we have in the source, we need to
+      // do special handling and conversion; that happens in the slow case.
+      if (length + offset <= source_ta->length_value()) {
+        CopyElementsFromTypedArray(*source_ta, *destination_ta, length, offset);
+        return *isolate->factory()->undefined_value();
+      }
     }
 
     // Fast cases for packed numbers kinds where we don't need to allocate.
@@ -4459,6 +4502,13 @@ void CopyTypedArrayElementsToTypedArray(JSTypedArray* source,
   }
 }
 
+void CopyTypedArrayElementsSlice(JSTypedArray* source,
+                                 JSTypedArray* destination, uintptr_t start,
+                                 uintptr_t end) {
+  destination->GetElementsAccessor()->CopyTypedArrayElementsSlice(
+      source, destination, start, end);
+}
+
 void ElementsAccessor::InitializeOncePerProcess() {
   static ElementsAccessor* accessor_array[] = {
 #define ACCESSOR_ARRAY(Class, Kind, Store) new Class(#Kind),
diff --git a/deps/v8/src/elements.h b/deps/v8/src/elements.h
index de5aa0d878b..a2b8b49c931 100644
--- a/deps/v8/src/elements.h
+++ b/deps/v8/src/elements.h
@@ -12,6 +12,8 @@
 namespace v8 {
 namespace internal {
 
+class JSTypedArray;
+
 // Abstract base class for handles that can operate on objects with differing
 // ElementsKinds.
 class ElementsAccessor {
@@ -141,9 +143,6 @@ class ElementsAccessor {
   virtual Handle<JSObject> Slice(Handle<JSObject> receiver, uint32_t start,
                                  uint32_t end) = 0;
 
-  virtual Handle<JSObject> Slice(Handle<JSObject> receiver, uint32_t start,
-                                 uint32_t end, Handle<JSObject> result) = 0;
-
   virtual Handle<JSArray> Splice(Handle<JSArray> receiver,
                                  uint32_t start, uint32_t delete_count,
                                  Arguments* args, uint32_t add_count) = 0;
@@ -185,7 +184,7 @@ class ElementsAccessor {
                             ElementsKind source_kind,
                             Handle<FixedArrayBase> destination, int size) = 0;
 
-  virtual Object* CopyElements(Handle<JSReceiver> source,
+  virtual Object* CopyElements(Handle<Object> source,
                                Handle<JSObject> destination, size_t length,
                                uint32_t offset = 0) = 0;
 
@@ -193,6 +192,10 @@ class ElementsAccessor {
                                                      Handle<JSObject> object,
                                                      uint32_t length) = 0;
 
+  virtual void CopyTypedArrayElementsSlice(JSTypedArray* source,
+                                           JSTypedArray* destination,
+                                           size_t start, size_t end) = 0;
+
  protected:
   friend class LookupIterator;
 
@@ -241,7 +244,6 @@ MUST_USE_RESULT MaybeHandle<Object> ArrayConstructInitializeElements(
     Arguments* args);
 
 // Called directly from CSA.
-class JSTypedArray;
 void CopyFastNumberJSArrayElementsToTypedArray(Context* context,
                                                JSArray* source,
                                                JSTypedArray* destination,
@@ -250,6 +252,9 @@ void CopyFastNumberJSArrayElementsToTypedArray(Context* context,
 void CopyTypedArrayElementsToTypedArray(JSTypedArray* source,
                                         JSTypedArray* destination,
                                         uintptr_t length, uintptr_t offset);
+void CopyTypedArrayElementsSlice(JSTypedArray* source,
+                                 JSTypedArray* destination, uintptr_t start,
+                                 uintptr_t end);
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/execution.cc b/deps/v8/src/execution.cc
index edd329f5da0..7a47bef5228 100644
--- a/deps/v8/src/execution.cc
+++ b/deps/v8/src/execution.cc
@@ -35,7 +35,7 @@ void StackGuard::reset_limits(const ExecutionAccess& lock) {
 
 
 static void PrintDeserializedCodeInfo(Handle<JSFunction> function) {
-  if (function->code() == function->shared()->code() &&
+  if (function->code() == function->shared()->GetCode() &&
       function->shared()->deserialized()) {
     PrintF("[Running deserialized script");
     Object* script = function->shared()->script();
@@ -74,11 +74,13 @@ MUST_USE_RESULT MaybeHandle<Object> Invoke(
   }
 #endif
 
-  // api callbacks can be called directly.
+  // api callbacks can be called directly, unless we want to take the detour
+  // through JS to set up a frame for break-at-entry.
   if (target->IsJSFunction()) {
     Handle<JSFunction> function = Handle<JSFunction>::cast(target);
     if ((!is_construct || function->IsConstructor()) &&
-        function->shared()->IsApiFunction()) {
+        function->shared()->IsApiFunction() &&
+        !function->shared()->BreakAtEntry()) {
       SaveContext save(isolate);
       isolate->set_context(function->context());
       DCHECK(function->context()->global_object()->IsJSGlobalObject());
diff --git a/deps/v8/src/execution.h b/deps/v8/src/execution.h
index 7dd920a446f..5030e261d6f 100644
--- a/deps/v8/src/execution.h
+++ b/deps/v8/src/execution.h
@@ -5,11 +5,8 @@
 #ifndef V8_EXECUTION_H_
 #define V8_EXECUTION_H_
 
-#include "src/allocation.h"
 #include "src/base/atomicops.h"
 #include "src/globals.h"
-#include "src/objects/code.h"
-#include "src/utils.h"
 
 namespace v8 {
 namespace internal {
diff --git a/deps/v8/src/external-reference-table.cc b/deps/v8/src/external-reference-table.cc
index 52157b5034f..3c3ff92c654 100644
--- a/deps/v8/src/external-reference-table.cc
+++ b/deps/v8/src/external-reference-table.cc
@@ -5,8 +5,8 @@
 #include "src/external-reference-table.h"
 
 #include "src/accessors.h"
-#include "src/assembler.h"
 #include "src/counters.h"
+#include "src/external-reference.h"
 #include "src/ic/stub-cache.h"
 
 #if defined(DEBUG) && defined(V8_OS_LINUX) && !defined(V8_OS_ANDROID)
@@ -24,25 +24,20 @@ namespace internal {
 BUILTIN_LIST_C(FORWARD_DECLARE)
 #undef FORWARD_DECLARE
 
-ExternalReferenceTable* ExternalReferenceTable::instance(Isolate* isolate) {
-  ExternalReferenceTable* external_reference_table =
-      isolate->external_reference_table();
-  if (external_reference_table == nullptr) {
-    external_reference_table = new ExternalReferenceTable(isolate);
-    isolate->set_external_reference_table(external_reference_table);
-  }
-  return external_reference_table;
-}
+void ExternalReferenceTable::Init(Isolate* isolate) {
+  int index = 0;
 
-ExternalReferenceTable::ExternalReferenceTable(Isolate* isolate) {
   // nullptr is preserved through serialization/deserialization.
-  Add(nullptr, "nullptr");
-  AddReferences(isolate);
-  AddBuiltins(isolate);
-  AddRuntimeFunctions(isolate);
-  AddIsolateAddresses(isolate);
-  AddAccessors(isolate);
-  AddStubCache(isolate);
+  Add(nullptr, "nullptr", &index);
+  AddReferences(isolate, &index);
+  AddBuiltins(isolate, &index);
+  AddRuntimeFunctions(isolate, &index);
+  AddIsolateAddresses(isolate, &index);
+  AddAccessors(isolate, &index);
+  AddStubCache(isolate, &index);
+  is_initialized_ = true;
+
+  CHECK_EQ(kSize, index);
 }
 
 const char* ExternalReferenceTable::ResolveSymbol(void* address) {
@@ -58,300 +53,25 @@ const char* ExternalReferenceTable::ResolveSymbol(void* address) {
 #endif  // SYMBOLIZE_FUNCTION
 }
 
-void ExternalReferenceTable::Add(Address address, const char* name) {
-  refs_.emplace_back(address, name);
+void ExternalReferenceTable::Add(Address address, const char* name,
+                                 int* index) {
+  refs_[(*index)++] = {address, name};
 }
 
-void ExternalReferenceTable::AddReferences(Isolate* isolate) {
-  // Miscellaneous
-  Add(ExternalReference::roots_array_start(isolate).address(),
-      "Heap::roots_array_start()");
-  Add(ExternalReference::address_of_stack_limit(isolate).address(),
-      "StackGuard::address_of_jslimit()");
-  Add(ExternalReference::address_of_real_stack_limit(isolate).address(),
-      "StackGuard::address_of_real_jslimit()");
-  Add(ExternalReference::new_space_allocation_limit_address(isolate).address(),
-      "Heap::NewSpaceAllocationLimitAddress()");
-  Add(ExternalReference::new_space_allocation_top_address(isolate).address(),
-      "Heap::NewSpaceAllocationTopAddress()");
-  Add(ExternalReference::mod_two_doubles_operation(isolate).address(),
-      "mod_two_doubles");
-  Add(ExternalReference::handle_scope_next_address(isolate).address(),
-      "HandleScope::next");
-  Add(ExternalReference::handle_scope_limit_address(isolate).address(),
-      "HandleScope::limit");
-  Add(ExternalReference::handle_scope_level_address(isolate).address(),
-      "HandleScope::level");
-  Add(ExternalReference::new_deoptimizer_function(isolate).address(),
-      "Deoptimizer::New()");
-  Add(ExternalReference::compute_output_frames_function(isolate).address(),
-      "Deoptimizer::ComputeOutputFrames()");
-  Add(ExternalReference::address_of_min_int().address(),
-      "LDoubleConstant::min_int");
-  Add(ExternalReference::address_of_one_half().address(),
-      "LDoubleConstant::one_half");
-  Add(ExternalReference::isolate_address(isolate).address(), "isolate");
-  Add(ExternalReference::builtins_address(isolate).address(), "builtins");
-  Add(ExternalReference::handle_scope_implementer_address(isolate).address(),
-      "Isolate::handle_scope_implementer_address");
-  Add(ExternalReference::pending_microtask_count_address(isolate).address(),
-      "Isolate::pending_microtask_count_address()");
-  Add(ExternalReference::interpreter_dispatch_table_address(isolate).address(),
-      "Interpreter::dispatch_table_address");
-  Add(ExternalReference::bytecode_size_table_address(isolate).address(),
-      "Bytecodes::bytecode_size_table_address");
-  Add(ExternalReference::address_of_negative_infinity().address(),
-      "LDoubleConstant::negative_infinity");
-  Add(ExternalReference::power_double_double_function(isolate).address(),
-      "power_double_double_function");
-  Add(ExternalReference::ieee754_acos_function(isolate).address(),
-      "base::ieee754::acos");
-  Add(ExternalReference::ieee754_acosh_function(isolate).address(),
-      "base::ieee754::acosh");
-  Add(ExternalReference::ieee754_asin_function(isolate).address(),
-      "base::ieee754::asin");
-  Add(ExternalReference::ieee754_asinh_function(isolate).address(),
-      "base::ieee754::asinh");
-  Add(ExternalReference::ieee754_atan_function(isolate).address(),
-      "base::ieee754::atan");
-  Add(ExternalReference::ieee754_atanh_function(isolate).address(),
-      "base::ieee754::atanh");
-  Add(ExternalReference::ieee754_atan2_function(isolate).address(),
-      "base::ieee754::atan2");
-  Add(ExternalReference::ieee754_cbrt_function(isolate).address(),
-      "base::ieee754::cbrt");
-  Add(ExternalReference::ieee754_cos_function(isolate).address(),
-      "base::ieee754::cos");
-  Add(ExternalReference::ieee754_cosh_function(isolate).address(),
-      "base::ieee754::cosh");
-  Add(ExternalReference::ieee754_exp_function(isolate).address(),
-      "base::ieee754::exp");
-  Add(ExternalReference::ieee754_expm1_function(isolate).address(),
-      "base::ieee754::expm1");
-  Add(ExternalReference::ieee754_log_function(isolate).address(),
-      "base::ieee754::log");
-  Add(ExternalReference::ieee754_log1p_function(isolate).address(),
-      "base::ieee754::log1p");
-  Add(ExternalReference::ieee754_log10_function(isolate).address(),
-      "base::ieee754::log10");
-  Add(ExternalReference::ieee754_log2_function(isolate).address(),
-      "base::ieee754::log2");
-  Add(ExternalReference::ieee754_sin_function(isolate).address(),
-      "base::ieee754::sin");
-  Add(ExternalReference::ieee754_sinh_function(isolate).address(),
-      "base::ieee754::sinh");
-  Add(ExternalReference::ieee754_tan_function(isolate).address(),
-      "base::ieee754::tan");
-  Add(ExternalReference::ieee754_tanh_function(isolate).address(),
-      "base::ieee754::tanh");
-  Add(ExternalReference::store_buffer_top(isolate).address(),
-      "store_buffer_top");
-  Add(ExternalReference::heap_is_marking_flag_address(isolate).address(),
-      "heap_is_marking_flag_address");
-  Add(ExternalReference::address_of_the_hole_nan().address(), "the_hole_nan");
-  Add(ExternalReference::get_date_field_function(isolate).address(),
-      "JSDate::GetField");
-  Add(ExternalReference::date_cache_stamp(isolate).address(),
-      "date_cache_stamp");
-  Add(ExternalReference::address_of_pending_message_obj(isolate).address(),
-      "address_of_pending_message_obj");
-  Add(ExternalReference::cpu_features().address(), "cpu_features");
-  Add(ExternalReference::old_space_allocation_top_address(isolate).address(),
-      "Heap::OldSpaceAllocationTopAddress");
-  Add(ExternalReference::old_space_allocation_limit_address(isolate).address(),
-      "Heap::OldSpaceAllocationLimitAddress");
-  Add(ExternalReference::allocation_sites_list_address(isolate).address(),
-      "Heap::allocation_sites_list_address()");
-  Add(ExternalReference::address_of_uint32_bias().address(), "uint32_bias");
-  Add(ExternalReference::is_profiling_address(isolate).address(),
-      "Isolate::is_profiling");
-  Add(ExternalReference::scheduled_exception_address(isolate).address(),
-      "Isolate::scheduled_exception");
-  Add(ExternalReference::invoke_function_callback(isolate).address(),
-      "InvokeFunctionCallback");
-  Add(ExternalReference::invoke_accessor_getter_callback(isolate).address(),
-      "InvokeAccessorGetterCallback");
-  Add(ExternalReference::wasm_f32_trunc(isolate).address(),
-      "wasm::f32_trunc_wrapper");
-  Add(ExternalReference::wasm_f32_floor(isolate).address(),
-      "wasm::f32_floor_wrapper");
-  Add(ExternalReference::wasm_f32_ceil(isolate).address(),
-      "wasm::f32_ceil_wrapper");
-  Add(ExternalReference::wasm_f32_nearest_int(isolate).address(),
-      "wasm::f32_nearest_int_wrapper");
-  Add(ExternalReference::wasm_f64_trunc(isolate).address(),
-      "wasm::f64_trunc_wrapper");
-  Add(ExternalReference::wasm_f64_floor(isolate).address(),
-      "wasm::f64_floor_wrapper");
-  Add(ExternalReference::wasm_f64_ceil(isolate).address(),
-      "wasm::f64_ceil_wrapper");
-  Add(ExternalReference::wasm_f64_nearest_int(isolate).address(),
-      "wasm::f64_nearest_int_wrapper");
-  Add(ExternalReference::wasm_int64_to_float32(isolate).address(),
-      "wasm::int64_to_float32_wrapper");
-  Add(ExternalReference::wasm_uint64_to_float32(isolate).address(),
-      "wasm::uint64_to_float32_wrapper");
-  Add(ExternalReference::wasm_int64_to_float64(isolate).address(),
-      "wasm::int64_to_float64_wrapper");
-  Add(ExternalReference::wasm_uint64_to_float64(isolate).address(),
-      "wasm::uint64_to_float64_wrapper");
-  Add(ExternalReference::wasm_float32_to_int64(isolate).address(),
-      "wasm::float32_to_int64_wrapper");
-  Add(ExternalReference::wasm_float32_to_uint64(isolate).address(),
-      "wasm::float32_to_uint64_wrapper");
-  Add(ExternalReference::wasm_float64_to_int64(isolate).address(),
-      "wasm::float64_to_int64_wrapper");
-  Add(ExternalReference::wasm_float64_to_uint64(isolate).address(),
-      "wasm::float64_to_uint64_wrapper");
-  Add(ExternalReference::wasm_float64_pow(isolate).address(),
-      "wasm::float64_pow");
-  Add(ExternalReference::wasm_int64_div(isolate).address(), "wasm::int64_div");
-  Add(ExternalReference::wasm_int64_mod(isolate).address(), "wasm::int64_mod");
-  Add(ExternalReference::wasm_uint64_div(isolate).address(),
-      "wasm::uint64_div");
-  Add(ExternalReference::wasm_uint64_mod(isolate).address(),
-      "wasm::uint64_mod");
-  Add(ExternalReference::wasm_word32_ctz(isolate).address(),
-      "wasm::word32_ctz");
-  Add(ExternalReference::wasm_word64_ctz(isolate).address(),
-      "wasm::word64_ctz");
-  Add(ExternalReference::wasm_word32_popcnt(isolate).address(),
-      "wasm::word32_popcnt");
-  Add(ExternalReference::wasm_word64_popcnt(isolate).address(),
-      "wasm::word64_popcnt");
-  // If the trap handler is not supported, the optimizer will remove these
-  // runtime functions. In this case, the arm simulator will break if we add
-  // them to the external reference table.
-#ifdef V8_TARGET_ARCH_X64
-  Add(ExternalReference::wasm_set_thread_in_wasm_flag(isolate).address(),
-      "wasm::set_thread_in_wasm_flag");
-  Add(ExternalReference::wasm_clear_thread_in_wasm_flag(isolate).address(),
-      "wasm::clear_thread_in_wasm_flag");
-#endif
-  Add(ExternalReference::f64_acos_wrapper_function(isolate).address(),
-      "f64_acos_wrapper");
-  Add(ExternalReference::f64_asin_wrapper_function(isolate).address(),
-      "f64_asin_wrapper");
-  Add(ExternalReference::f64_mod_wrapper_function(isolate).address(),
-      "f64_mod_wrapper");
-  Add(ExternalReference::wasm_call_trap_callback_for_testing(isolate).address(),
-      "wasm::call_trap_callback_for_testing");
-  Add(ExternalReference::libc_memchr_function(isolate).address(),
-      "libc_memchr");
-  Add(ExternalReference::libc_memcpy_function(isolate).address(),
-      "libc_memcpy");
-  Add(ExternalReference::libc_memmove_function(isolate).address(),
-      "libc_memmove");
-  Add(ExternalReference::libc_memset_function(isolate).address(),
-      "libc_memset");
-  Add(ExternalReference::printf_function(isolate).address(), "printf");
-  Add(ExternalReference::try_internalize_string_function(isolate).address(),
-      "try_internalize_string_function");
-  Add(ExternalReference::check_object_type(isolate).address(),
-      "check_object_type");
-#ifdef V8_INTL_SUPPORT
-  Add(ExternalReference::intl_convert_one_byte_to_lower(isolate).address(),
-      "intl_convert_one_byte_to_lower");
-  Add(ExternalReference::intl_to_latin1_lower_table(isolate).address(),
-      "intl_to_latin1_lower_table");
-#endif  // V8_INTL_SUPPORT
-  Add(ExternalReference::search_string_raw<const uint8_t, const uint8_t>(
-          isolate)
-          .address(),
-      "search_string_raw<1-byte, 1-byte>");
-  Add(ExternalReference::search_string_raw<const uint8_t, const uc16>(isolate)
-          .address(),
-      "search_string_raw<1-byte, 2-byte>");
-  Add(ExternalReference::search_string_raw<const uc16, const uint8_t>(isolate)
-          .address(),
-      "search_string_raw<2-byte, 1-byte>");
-  Add(ExternalReference::search_string_raw<const uc16, const uc16>(isolate)
-          .address(),
-      "search_string_raw<1-byte, 2-byte>");
-  Add(ExternalReference::orderedhashmap_gethash_raw(isolate).address(),
-      "orderedhashmap_gethash_raw");
-  Add(ExternalReference::get_or_create_hash_raw(isolate).address(),
-      "get_or_create_hash_raw");
-  Add(ExternalReference::jsreceiver_create_identity_hash(isolate).address(),
-      "jsreceiver_create_identity_hash");
-  Add(ExternalReference::copy_fast_number_jsarray_elements_to_typed_array(
-          isolate)
-          .address(),
-      "copy_fast_number_jsarray_elements_to_typed_array");
-  Add(ExternalReference::copy_typed_array_elements_to_typed_array(isolate)
-          .address(),
-      "copy_typed_array_elements_to_typed_array");
-  Add(ExternalReference::log_enter_external_function(isolate).address(),
-      "Logger::EnterExternal");
-  Add(ExternalReference::log_leave_external_function(isolate).address(),
-      "Logger::LeaveExternal");
-  Add(ExternalReference::address_of_minus_one_half().address(),
-      "double_constants.minus_one_half");
-  Add(ExternalReference::stress_deopt_count(isolate).address(),
-      "Isolate::stress_deopt_count_address()");
-  Add(ExternalReference::force_slow_path(isolate).address(),
-      "Isolate::force_slow_path_address()");
-  Add(ExternalReference::runtime_function_table_address(isolate).address(),
-      "Runtime::runtime_function_table_address()");
-  Add(ExternalReference::address_of_float_abs_constant().address(),
-      "float_absolute_constant");
-  Add(ExternalReference::address_of_float_neg_constant().address(),
-      "float_negate_constant");
-  Add(ExternalReference::address_of_double_abs_constant().address(),
-      "double_absolute_constant");
-  Add(ExternalReference::address_of_double_neg_constant().address(),
-      "double_negate_constant");
-  Add(ExternalReference::promise_hook_or_debug_is_active_address(isolate)
-          .address(),
-      "Isolate::promise_hook_or_debug_is_active_address()");
-
-  // Debug addresses
-  Add(ExternalReference::debug_is_active_address(isolate).address(),
-      "Debug::is_active_address()");
-  Add(ExternalReference::debug_hook_on_function_call_address(isolate).address(),
-      "Debug::hook_on_function_call_address()");
-  Add(ExternalReference::debug_last_step_action_address(isolate).address(),
-      "Debug::step_in_enabled_address()");
-  Add(ExternalReference::debug_suspended_generator_address(isolate).address(),
-      "Debug::step_suspended_generator_address()");
-  Add(ExternalReference::debug_restart_fp_address(isolate).address(),
-      "Debug::restart_fp_address()");
-
-#ifndef V8_INTERPRETED_REGEXP
-  Add(ExternalReference::re_case_insensitive_compare_uc16(isolate).address(),
-      "NativeRegExpMacroAssembler::CaseInsensitiveCompareUC16()");
-  Add(ExternalReference::re_check_stack_guard_state(isolate).address(),
-      "RegExpMacroAssembler*::CheckStackGuardState()");
-  Add(ExternalReference::re_grow_stack(isolate).address(),
-      "NativeRegExpMacroAssembler::GrowStack()");
-  Add(ExternalReference::re_word_character_map().address(),
-      "NativeRegExpMacroAssembler::word_character_map");
-  Add(ExternalReference::address_of_regexp_stack_limit(isolate).address(),
-      "RegExpStack::limit_address()");
-  Add(ExternalReference::address_of_regexp_stack_memory_address(isolate)
-          .address(),
-      "RegExpStack::memory_address()");
-  Add(ExternalReference::address_of_regexp_stack_memory_size(isolate).address(),
-      "RegExpStack::memory_size()");
-  Add(ExternalReference::address_of_static_offsets_vector(isolate).address(),
-      "OffsetsVector::static_offsets_vector");
-#endif  // V8_INTERPRETED_REGEXP
-
-  // Runtime entries
-  Add(ExternalReference::delete_handle_scope_extensions(isolate).address(),
-      "HandleScope::DeleteExtensions");
-  Add(ExternalReference::incremental_marking_record_write_function(isolate)
-          .address(),
-      "IncrementalMarking::RecordWrite");
-  Add(ExternalReference::store_buffer_overflow_function(isolate).address(),
-      "StoreBuffer::StoreBufferOverflow");
-
-  Add(ExternalReference::invalidate_prototype_chains_function(isolate)
-          .address(),
-      "JSObject::InvalidatePrototypeChains()");
+void ExternalReferenceTable::AddReferences(Isolate* isolate, int* index) {
+  CHECK_EQ(kSpecialReferenceCount, *index);
+
+#define ADD_EXTERNAL_REFERENCE(name, desc) \
+  Add(ExternalReference::name(isolate).address(), desc, index);
+  EXTERNAL_REFERENCE_LIST(ADD_EXTERNAL_REFERENCE)
+#undef ADD_EXTERNAL_REFERENCE
+
+  CHECK_EQ(kSpecialReferenceCount + kExternalReferenceCount, *index);
 }
 
-void ExternalReferenceTable::AddBuiltins(Isolate* isolate) {
+void ExternalReferenceTable::AddBuiltins(Isolate* isolate, int* index) {
+  CHECK_EQ(kSpecialReferenceCount + kExternalReferenceCount, *index);
+
   struct CBuiltinEntry {
     Address address;
     const char* name;
@@ -363,11 +83,19 @@ void ExternalReferenceTable::AddBuiltins(Isolate* isolate) {
   };
   for (unsigned i = 0; i < arraysize(c_builtins); ++i) {
     Add(ExternalReference(c_builtins[i].address, isolate).address(),
-        c_builtins[i].name);
+        c_builtins[i].name, index);
   }
+
+  CHECK_EQ(kSpecialReferenceCount + kExternalReferenceCount +
+               kBuiltinsReferenceCount,
+           *index);
 }
 
-void ExternalReferenceTable::AddRuntimeFunctions(Isolate* isolate) {
+void ExternalReferenceTable::AddRuntimeFunctions(Isolate* isolate, int* index) {
+  CHECK_EQ(kSpecialReferenceCount + kExternalReferenceCount +
+               kBuiltinsReferenceCount,
+           *index);
+
   struct RuntimeEntry {
     Runtime::FunctionId id;
     const char* name;
@@ -381,11 +109,19 @@ void ExternalReferenceTable::AddRuntimeFunctions(Isolate* isolate) {
 
   for (unsigned i = 0; i < arraysize(runtime_functions); ++i) {
     ExternalReference ref(runtime_functions[i].id, isolate);
-    Add(ref.address(), runtime_functions[i].name);
+    Add(ref.address(), runtime_functions[i].name, index);
   }
+
+  CHECK_EQ(kSpecialReferenceCount + kExternalReferenceCount +
+               kBuiltinsReferenceCount + kRuntimeReferenceCount,
+           *index);
 }
 
-void ExternalReferenceTable::AddIsolateAddresses(Isolate* isolate) {
+void ExternalReferenceTable::AddIsolateAddresses(Isolate* isolate, int* index) {
+  CHECK_EQ(kSpecialReferenceCount + kExternalReferenceCount +
+               kBuiltinsReferenceCount + kRuntimeReferenceCount,
+           *index);
+
   // Top addresses
   static const char* address_names[] = {
 #define BUILD_NAME_LITERAL(Name, name) "Isolate::" #name "_address",
@@ -395,11 +131,21 @@ void ExternalReferenceTable::AddIsolateAddresses(Isolate* isolate) {
 
   for (int i = 0; i < IsolateAddressId::kIsolateAddressCount; ++i) {
     Add(isolate->get_address_from_id(static_cast<IsolateAddressId>(i)),
-        address_names[i]);
+        address_names[i], index);
   }
+
+  CHECK_EQ(kSpecialReferenceCount + kExternalReferenceCount +
+               kBuiltinsReferenceCount + kRuntimeReferenceCount +
+               kIsolateAddressReferenceCount,
+           *index);
 }
 
-void ExternalReferenceTable::AddAccessors(Isolate* isolate) {
+void ExternalReferenceTable::AddAccessors(Isolate* isolate, int* index) {
+  CHECK_EQ(kSpecialReferenceCount + kExternalReferenceCount +
+               kBuiltinsReferenceCount + kRuntimeReferenceCount +
+               kIsolateAddressReferenceCount,
+           *index);
+
   // Accessors
   struct AccessorRefTable {
     Address address;
@@ -421,46 +167,63 @@ void ExternalReferenceTable::AddAccessors(Isolate* isolate) {
   };
 
   for (unsigned i = 0; i < arraysize(getters); ++i) {
-    Add(getters[i].address, getters[i].name);
+    Add(getters[i].address, getters[i].name, index);
   }
 
   for (unsigned i = 0; i < arraysize(setters); ++i) {
-    Add(setters[i].address, setters[i].name);
+    Add(setters[i].address, setters[i].name, index);
   }
+
+  CHECK_EQ(kSpecialReferenceCount + kExternalReferenceCount +
+               kBuiltinsReferenceCount + kRuntimeReferenceCount +
+               kIsolateAddressReferenceCount + kAccessorReferenceCount,
+           *index);
 }
 
-void ExternalReferenceTable::AddStubCache(Isolate* isolate) {
+void ExternalReferenceTable::AddStubCache(Isolate* isolate, int* index) {
+  CHECK_EQ(kSpecialReferenceCount + kExternalReferenceCount +
+               kBuiltinsReferenceCount + kRuntimeReferenceCount +
+               kIsolateAddressReferenceCount + kAccessorReferenceCount,
+           *index);
+
   StubCache* load_stub_cache = isolate->load_stub_cache();
 
   // Stub cache tables
   Add(load_stub_cache->key_reference(StubCache::kPrimary).address(),
-      "Load StubCache::primary_->key");
+      "Load StubCache::primary_->key", index);
   Add(load_stub_cache->value_reference(StubCache::kPrimary).address(),
-      "Load StubCache::primary_->value");
+      "Load StubCache::primary_->value", index);
   Add(load_stub_cache->map_reference(StubCache::kPrimary).address(),
-      "Load StubCache::primary_->map");
+      "Load StubCache::primary_->map", index);
   Add(load_stub_cache->key_reference(StubCache::kSecondary).address(),
-      "Load StubCache::secondary_->key");
+      "Load StubCache::secondary_->key", index);
   Add(load_stub_cache->value_reference(StubCache::kSecondary).address(),
-      "Load StubCache::secondary_->value");
+      "Load StubCache::secondary_->value", index);
   Add(load_stub_cache->map_reference(StubCache::kSecondary).address(),
-      "Load StubCache::secondary_->map");
+      "Load StubCache::secondary_->map", index);
 
   StubCache* store_stub_cache = isolate->store_stub_cache();
 
   // Stub cache tables
   Add(store_stub_cache->key_reference(StubCache::kPrimary).address(),
-      "Store StubCache::primary_->key");
+      "Store StubCache::primary_->key", index);
   Add(store_stub_cache->value_reference(StubCache::kPrimary).address(),
-      "Store StubCache::primary_->value");
+      "Store StubCache::primary_->value", index);
   Add(store_stub_cache->map_reference(StubCache::kPrimary).address(),
-      "Store StubCache::primary_->map");
+      "Store StubCache::primary_->map", index);
   Add(store_stub_cache->key_reference(StubCache::kSecondary).address(),
-      "Store StubCache::secondary_->key");
+      "Store StubCache::secondary_->key", index);
   Add(store_stub_cache->value_reference(StubCache::kSecondary).address(),
-      "Store StubCache::secondary_->value");
+      "Store StubCache::secondary_->value", index);
   Add(store_stub_cache->map_reference(StubCache::kSecondary).address(),
-      "Store StubCache::secondary_->map");
+      "Store StubCache::secondary_->map", index);
+
+  CHECK_EQ(kSpecialReferenceCount + kExternalReferenceCount +
+               kBuiltinsReferenceCount + kRuntimeReferenceCount +
+               kIsolateAddressReferenceCount + kAccessorReferenceCount +
+               kStubCacheReferenceCount,
+           *index);
+  CHECK_EQ(kSize, *index);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/external-reference-table.h b/deps/v8/src/external-reference-table.h
index b2275049a0f..a0b53da2e33 100644
--- a/deps/v8/src/external-reference-table.h
+++ b/deps/v8/src/external-reference-table.h
@@ -7,8 +7,10 @@
 
 #include <vector>
 
+#include "src/accessors.h"
 #include "src/address-map.h"
 #include "src/builtins/builtins.h"
+#include "src/external-reference.h"
 
 namespace v8 {
 namespace internal {
@@ -20,35 +22,66 @@ class Isolate;
 // hashmaps in ExternalReferenceEncoder and ExternalReferenceDecoder.
 class ExternalReferenceTable {
  public:
-  static ExternalReferenceTable* instance(Isolate* isolate);
+  // For the nullptr ref, see the constructor.
+  static constexpr int kSpecialReferenceCount = 1;
+  static constexpr int kExternalReferenceCount =
+      ExternalReference::kExternalReferenceCount;
+  static constexpr int kBuiltinsReferenceCount =
+#define COUNT_C_BUILTIN(...) +1
+      BUILTIN_LIST_C(COUNT_C_BUILTIN);
+#undef COUNT_C_BUILTIN
+  static constexpr int kRuntimeReferenceCount =
+      Runtime::kNumFunctions / 2;  // Don't count dupe kInline... functions.
+  static constexpr int kIsolateAddressReferenceCount = kIsolateAddressCount;
+  static constexpr int kAccessorReferenceCount =
+      Accessors::kAccessorInfoCount + Accessors::kAccessorSetterCount;
+  // The number of stub cache external references, see AddStubCache.
+  static constexpr int kStubCacheReferenceCount = 12;
+  static constexpr int kSize =
+      kSpecialReferenceCount + kExternalReferenceCount +
+      kBuiltinsReferenceCount + kRuntimeReferenceCount +
+      kIsolateAddressReferenceCount + kAccessorReferenceCount +
+      kStubCacheReferenceCount;
 
-  uint32_t size() const { return static_cast<uint32_t>(refs_.size()); }
+  uint32_t size() const { return static_cast<uint32_t>(kSize); }
   Address address(uint32_t i) { return refs_[i].address; }
   const char* name(uint32_t i) { return refs_[i].name; }
 
+  bool is_initialized() const { return is_initialized_; }
+
   static const char* ResolveSymbol(void* address);
 
+  static uint32_t OffsetOfEntry(uint32_t i) {
+    // Used in CodeAssembler::LookupExternalReference.
+    STATIC_ASSERT(offsetof(ExternalReferenceEntry, address) == 0);
+    return i * sizeof(ExternalReferenceEntry);
+  }
+
+  ExternalReferenceTable() {}
+  void Init(Isolate* isolate);
+
  private:
   struct ExternalReferenceEntry {
     Address address;
     const char* name;
 
+    ExternalReferenceEntry() : address(nullptr), name(nullptr) {}
     ExternalReferenceEntry(Address address, const char* name)
         : address(address), name(name) {}
   };
 
-  explicit ExternalReferenceTable(Isolate* isolate);
+  void Add(Address address, const char* name, int* index);
 
-  void Add(Address address, const char* name);
+  void AddReferences(Isolate* isolate, int* index);
+  void AddBuiltins(Isolate* isolate, int* index);
+  void AddRuntimeFunctions(Isolate* isolate, int* index);
+  void AddIsolateAddresses(Isolate* isolate, int* index);
+  void AddAccessors(Isolate* isolate, int* index);
+  void AddStubCache(Isolate* isolate, int* index);
 
-  void AddReferences(Isolate* isolate);
-  void AddBuiltins(Isolate* isolate);
-  void AddRuntimeFunctions(Isolate* isolate);
-  void AddIsolateAddresses(Isolate* isolate);
-  void AddAccessors(Isolate* isolate);
-  void AddStubCache(Isolate* isolate);
+  ExternalReferenceEntry refs_[kSize];
+  bool is_initialized_ = false;
 
-  std::vector<ExternalReferenceEntry> refs_;
   DISALLOW_COPY_AND_ASSIGN(ExternalReferenceTable);
 };
 
diff --git a/deps/v8/src/external-reference.cc b/deps/v8/src/external-reference.cc
new file mode 100644
index 00000000000..e67afe41027
--- /dev/null
+++ b/deps/v8/src/external-reference.cc
@@ -0,0 +1,1023 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/external-reference.h"
+
+#include "src/api.h"
+#include "src/base/ieee754.h"
+#include "src/codegen.h"
+#include "src/compiler/code-assembler.h"
+#include "src/counters.h"
+#include "src/debug/debug.h"
+#include "src/deoptimizer.h"
+#include "src/elements.h"
+#include "src/heap/heap.h"
+#include "src/ic/stub-cache.h"
+#include "src/interpreter/interpreter.h"
+#include "src/isolate.h"
+#include "src/objects-inl.h"
+#include "src/regexp/regexp-stack.h"
+#include "src/string-search.h"
+#include "src/wasm/wasm-external-refs.h"
+
+// Include native regexp-macro-assembler.
+#ifndef V8_INTERPRETED_REGEXP
+#if V8_TARGET_ARCH_IA32
+#include "src/regexp/ia32/regexp-macro-assembler-ia32.h"  // NOLINT
+#elif V8_TARGET_ARCH_X64
+#include "src/regexp/x64/regexp-macro-assembler-x64.h"  // NOLINT
+#elif V8_TARGET_ARCH_ARM64
+#include "src/regexp/arm64/regexp-macro-assembler-arm64.h"  // NOLINT
+#elif V8_TARGET_ARCH_ARM
+#include "src/regexp/arm/regexp-macro-assembler-arm.h"  // NOLINT
+#elif V8_TARGET_ARCH_PPC
+#include "src/regexp/ppc/regexp-macro-assembler-ppc.h"  // NOLINT
+#elif V8_TARGET_ARCH_MIPS
+#include "src/regexp/mips/regexp-macro-assembler-mips.h"  // NOLINT
+#elif V8_TARGET_ARCH_MIPS64
+#include "src/regexp/mips64/regexp-macro-assembler-mips64.h"  // NOLINT
+#elif V8_TARGET_ARCH_S390
+#include "src/regexp/s390/regexp-macro-assembler-s390.h"  // NOLINT
+#else  // Unknown architecture.
+#error "Unknown architecture."
+#endif  // Target architecture.
+#endif  // V8_INTERPRETED_REGEXP
+
+#ifdef V8_INTL_SUPPORT
+#include "src/intl.h"
+#endif  // V8_INTL_SUPPORT
+
+namespace v8 {
+namespace internal {
+
+// -----------------------------------------------------------------------------
+// Common double constants.
+
+struct DoubleConstant BASE_EMBEDDED {
+  double min_int;
+  double one_half;
+  double minus_one_half;
+  double negative_infinity;
+  uint64_t the_hole_nan;
+  double uint32_bias;
+};
+
+static DoubleConstant double_constants;
+
+static struct V8_ALIGNED(16) {
+  uint32_t a;
+  uint32_t b;
+  uint32_t c;
+  uint32_t d;
+} float_absolute_constant = {0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF};
+
+static struct V8_ALIGNED(16) {
+  uint32_t a;
+  uint32_t b;
+  uint32_t c;
+  uint32_t d;
+} float_negate_constant = {0x80000000, 0x80000000, 0x80000000, 0x80000000};
+
+static struct V8_ALIGNED(16) {
+  uint64_t a;
+  uint64_t b;
+} double_absolute_constant = {uint64_t{0x7FFFFFFFFFFFFFFF},
+                              uint64_t{0x7FFFFFFFFFFFFFFF}};
+
+static struct V8_ALIGNED(16) {
+  uint64_t a;
+  uint64_t b;
+} double_negate_constant = {uint64_t{0x8000000000000000},
+                            uint64_t{0x8000000000000000}};
+
+// Implementation of ExternalReference
+
+static ExternalReference::Type BuiltinCallTypeForResultSize(int result_size) {
+  switch (result_size) {
+    case 1:
+      return ExternalReference::BUILTIN_CALL;
+    case 2:
+      return ExternalReference::BUILTIN_CALL_PAIR;
+  }
+  UNREACHABLE();
+}
+
+void ExternalReference::SetUp() {
+  double_constants.min_int = kMinInt;
+  double_constants.one_half = 0.5;
+  double_constants.minus_one_half = -0.5;
+  double_constants.the_hole_nan = kHoleNanInt64;
+  double_constants.negative_infinity = -V8_INFINITY;
+  double_constants.uint32_bias =
+      static_cast<double>(static_cast<uint32_t>(0xFFFFFFFF)) + 1;
+}
+
+ExternalReference::ExternalReference(Address address, Isolate* isolate)
+    : address_(Redirect(isolate, address)) {}
+
+ExternalReference::ExternalReference(
+    ApiFunction* fun, Type type = ExternalReference::BUILTIN_CALL,
+    Isolate* isolate = nullptr)
+    : address_(Redirect(isolate, fun->address(), type)) {}
+
+ExternalReference::ExternalReference(Runtime::FunctionId id, Isolate* isolate)
+    : ExternalReference(Runtime::FunctionForId(id), isolate) {}
+
+ExternalReference::ExternalReference(const Runtime::Function* f,
+                                     Isolate* isolate)
+    : address_(Redirect(isolate, f->entry,
+                        BuiltinCallTypeForResultSize(f->result_size))) {}
+
+ExternalReference ExternalReference::isolate_address(Isolate* isolate) {
+  return ExternalReference(isolate);
+}
+
+ExternalReference ExternalReference::builtins_address(Isolate* isolate) {
+  return ExternalReference(isolate->builtins()->builtins_table_address());
+}
+
+ExternalReference ExternalReference::handle_scope_implementer_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->handle_scope_implementer_address());
+}
+
+ExternalReference ExternalReference::pending_microtask_count_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->pending_microtask_count_address());
+}
+
+ExternalReference ExternalReference::interpreter_dispatch_table_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->interpreter()->dispatch_table_address());
+}
+
+ExternalReference ExternalReference::interpreter_dispatch_counters(
+    Isolate* isolate) {
+  return ExternalReference(
+      isolate->interpreter()->bytecode_dispatch_counters_table());
+}
+
+ExternalReference ExternalReference::bytecode_size_table_address(
+    Isolate* isolate) {
+  return ExternalReference(
+      interpreter::Bytecodes::bytecode_size_table_address());
+}
+
+ExternalReference::ExternalReference(StatsCounter* counter)
+    : address_(reinterpret_cast<Address>(counter->GetInternalPointer())) {}
+
+ExternalReference::ExternalReference(IsolateAddressId id, Isolate* isolate)
+    : address_(isolate->get_address_from_id(id)) {}
+
+ExternalReference::ExternalReference(const SCTableReference& table_ref)
+    : address_(table_ref.address()) {}
+
+ExternalReference ExternalReference::incremental_marking_record_write_function(
+    Isolate* isolate) {
+  return ExternalReference(Redirect(
+      isolate, FUNCTION_ADDR(IncrementalMarking::RecordWriteFromCode)));
+}
+
+ExternalReference ExternalReference::store_buffer_overflow_function(
+    Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(StoreBuffer::StoreBufferOverflow)));
+}
+
+ExternalReference ExternalReference::delete_handle_scope_extensions(
+    Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(HandleScope::DeleteExtensions)));
+}
+
+ExternalReference ExternalReference::get_date_field_function(Isolate* isolate) {
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(JSDate::GetField)));
+}
+
+ExternalReference ExternalReference::date_cache_stamp(Isolate* isolate) {
+  return ExternalReference(isolate->date_cache()->stamp_address());
+}
+
+// static
+ExternalReference
+ExternalReference::runtime_function_table_address_for_unittests(
+    Isolate* isolate) {
+  return runtime_function_table_address(isolate);
+}
+
+void ExternalReference::set_redirector(
+    Isolate* isolate, ExternalReferenceRedirector* redirector) {
+  // We can't stack them.
+  DCHECK_NULL(isolate->external_reference_redirector());
+  isolate->set_external_reference_redirector(
+      reinterpret_cast<ExternalReferenceRedirectorPointer*>(redirector));
+}
+
+// static
+void* ExternalReference::Redirect(Isolate* isolate, Address address_arg,
+                                  Type type) {
+  ExternalReferenceRedirector* redirector =
+      reinterpret_cast<ExternalReferenceRedirector*>(
+          isolate->external_reference_redirector());
+  void* address = reinterpret_cast<void*>(address_arg);
+  void* answer =
+      (redirector == nullptr) ? address : (*redirector)(address, type);
+  return answer;
+}
+
+ExternalReference ExternalReference::stress_deopt_count(Isolate* isolate) {
+  return ExternalReference(isolate->stress_deopt_count_address());
+}
+
+ExternalReference ExternalReference::force_slow_path(Isolate* isolate) {
+  return ExternalReference(isolate->force_slow_path_address());
+}
+
+ExternalReference ExternalReference::new_deoptimizer_function(
+    Isolate* isolate) {
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(Deoptimizer::New)));
+}
+
+ExternalReference ExternalReference::compute_output_frames_function(
+    Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(Deoptimizer::ComputeOutputFrames)));
+}
+
+ExternalReference ExternalReference::wasm_f32_trunc(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::f32_trunc_wrapper)));
+}
+ExternalReference ExternalReference::wasm_f32_floor(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::f32_floor_wrapper)));
+}
+ExternalReference ExternalReference::wasm_f32_ceil(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::f32_ceil_wrapper)));
+}
+ExternalReference ExternalReference::wasm_f32_nearest_int(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::f32_nearest_int_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_f64_trunc(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::f64_trunc_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_f64_floor(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::f64_floor_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_f64_ceil(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::f64_ceil_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_f64_nearest_int(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::f64_nearest_int_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_int64_to_float32(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::int64_to_float32_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_uint64_to_float32(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::uint64_to_float32_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_int64_to_float64(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::int64_to_float64_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_uint64_to_float64(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::uint64_to_float64_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_float32_to_int64(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::float32_to_int64_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_float32_to_uint64(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::float32_to_uint64_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_float64_to_int64(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::float64_to_int64_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_float64_to_uint64(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::float64_to_uint64_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_int64_div(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::int64_div_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_int64_mod(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::int64_mod_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_uint64_div(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::uint64_div_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_uint64_mod(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::uint64_mod_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_word32_ctz(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::word32_ctz_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_word64_ctz(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::word64_ctz_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_word32_popcnt(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::word32_popcnt_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_word64_popcnt(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::word64_popcnt_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_word32_rol(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::word32_rol_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_word32_ror(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::word32_ror_wrapper)));
+}
+
+static void f64_acos_wrapper(double* param) {
+  WriteDoubleValue(param, base::ieee754::acos(ReadDoubleValue(param)));
+}
+
+ExternalReference ExternalReference::f64_acos_wrapper_function(
+    Isolate* isolate) {
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f64_acos_wrapper)));
+}
+
+static void f64_asin_wrapper(double* param) {
+  WriteDoubleValue(param, base::ieee754::asin(ReadDoubleValue(param)));
+}
+
+ExternalReference ExternalReference::f64_asin_wrapper_function(
+    Isolate* isolate) {
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f64_asin_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_float64_pow(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::float64_pow_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_set_thread_in_wasm_flag(
+    Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::set_thread_in_wasm_flag)));
+}
+
+ExternalReference ExternalReference::wasm_clear_thread_in_wasm_flag(
+    Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::clear_thread_in_wasm_flag)));
+}
+
+static void f64_mod_wrapper(double* param0, double* param1) {
+  WriteDoubleValue(param0,
+                   Modulo(ReadDoubleValue(param0), ReadDoubleValue(param1)));
+}
+
+ExternalReference ExternalReference::f64_mod_wrapper_function(
+    Isolate* isolate) {
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f64_mod_wrapper)));
+}
+
+ExternalReference ExternalReference::wasm_call_trap_callback_for_testing(
+    Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(wasm::call_trap_callback_for_testing)));
+}
+
+ExternalReference ExternalReference::log_enter_external_function(
+    Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(Logger::EnterExternal)));
+}
+
+ExternalReference ExternalReference::log_leave_external_function(
+    Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(Logger::LeaveExternal)));
+}
+
+ExternalReference ExternalReference::roots_array_start(Isolate* isolate) {
+  return ExternalReference(isolate->heap()->roots_array_start());
+}
+
+ExternalReference ExternalReference::allocation_sites_list_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->heap()->allocation_sites_list_address());
+}
+
+ExternalReference ExternalReference::address_of_stack_limit(Isolate* isolate) {
+  return ExternalReference(isolate->stack_guard()->address_of_jslimit());
+}
+
+ExternalReference ExternalReference::address_of_real_stack_limit(
+    Isolate* isolate) {
+  return ExternalReference(isolate->stack_guard()->address_of_real_jslimit());
+}
+
+ExternalReference ExternalReference::store_buffer_top(Isolate* isolate) {
+  return ExternalReference(isolate->heap()->store_buffer_top_address());
+}
+
+ExternalReference ExternalReference::heap_is_marking_flag_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->heap()->IsMarkingFlagAddress());
+}
+
+ExternalReference ExternalReference::new_space_allocation_top_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->heap()->NewSpaceAllocationTopAddress());
+}
+
+ExternalReference ExternalReference::new_space_allocation_limit_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->heap()->NewSpaceAllocationLimitAddress());
+}
+
+ExternalReference ExternalReference::old_space_allocation_top_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->heap()->OldSpaceAllocationTopAddress());
+}
+
+ExternalReference ExternalReference::old_space_allocation_limit_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->heap()->OldSpaceAllocationLimitAddress());
+}
+
+ExternalReference ExternalReference::handle_scope_level_address(
+    Isolate* isolate) {
+  return ExternalReference(HandleScope::current_level_address(isolate));
+}
+
+ExternalReference ExternalReference::handle_scope_next_address(
+    Isolate* isolate) {
+  return ExternalReference(HandleScope::current_next_address(isolate));
+}
+
+ExternalReference ExternalReference::handle_scope_limit_address(
+    Isolate* isolate) {
+  return ExternalReference(HandleScope::current_limit_address(isolate));
+}
+
+ExternalReference ExternalReference::scheduled_exception_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->scheduled_exception_address());
+}
+
+ExternalReference ExternalReference::address_of_pending_message_obj(
+    Isolate* isolate) {
+  return ExternalReference(isolate->pending_message_obj_address());
+}
+
+ExternalReference ExternalReference::address_of_min_int(Isolate* isolate) {
+  return ExternalReference(reinterpret_cast<void*>(&double_constants.min_int));
+}
+
+ExternalReference ExternalReference::address_of_one_half(Isolate* isolate) {
+  return ExternalReference(reinterpret_cast<void*>(&double_constants.one_half));
+}
+
+ExternalReference ExternalReference::address_of_minus_one_half(
+    Isolate* isolate) {
+  return ExternalReference(
+      reinterpret_cast<void*>(&double_constants.minus_one_half));
+}
+
+ExternalReference ExternalReference::address_of_negative_infinity(
+    Isolate* isolate) {
+  return ExternalReference(
+      reinterpret_cast<void*>(&double_constants.negative_infinity));
+}
+
+ExternalReference ExternalReference::address_of_the_hole_nan(Isolate* isolate) {
+  return ExternalReference(
+      reinterpret_cast<void*>(&double_constants.the_hole_nan));
+}
+
+ExternalReference ExternalReference::address_of_uint32_bias(Isolate* isolate) {
+  return ExternalReference(
+      reinterpret_cast<void*>(&double_constants.uint32_bias));
+}
+
+ExternalReference ExternalReference::address_of_float_abs_constant(
+    Isolate* isolate) {
+  return ExternalReference(reinterpret_cast<void*>(&float_absolute_constant));
+}
+
+ExternalReference ExternalReference::address_of_float_neg_constant(
+    Isolate* isolate) {
+  return ExternalReference(reinterpret_cast<void*>(&float_negate_constant));
+}
+
+ExternalReference ExternalReference::address_of_double_abs_constant(
+    Isolate* isolate) {
+  return ExternalReference(reinterpret_cast<void*>(&double_absolute_constant));
+}
+
+ExternalReference ExternalReference::address_of_double_neg_constant(
+    Isolate* isolate) {
+  return ExternalReference(reinterpret_cast<void*>(&double_negate_constant));
+}
+
+ExternalReference ExternalReference::is_profiling_address(Isolate* isolate) {
+  return ExternalReference(isolate->is_profiling_address());
+}
+
+ExternalReference ExternalReference::invoke_function_callback(
+    Isolate* isolate) {
+  Address thunk_address = FUNCTION_ADDR(&InvokeFunctionCallback);
+  ExternalReference::Type thunk_type = ExternalReference::PROFILING_API_CALL;
+  ApiFunction thunk_fun(thunk_address);
+  return ExternalReference(&thunk_fun, thunk_type, isolate);
+}
+
+ExternalReference ExternalReference::invoke_accessor_getter_callback(
+    Isolate* isolate) {
+  Address thunk_address = FUNCTION_ADDR(&InvokeAccessorGetterCallback);
+  ExternalReference::Type thunk_type = ExternalReference::PROFILING_GETTER_CALL;
+  ApiFunction thunk_fun(thunk_address);
+  return ExternalReference(&thunk_fun, thunk_type, isolate);
+}
+
+#ifndef V8_INTERPRETED_REGEXP
+
+ExternalReference ExternalReference::re_check_stack_guard_state(
+    Isolate* isolate) {
+  Address function;
+#if V8_TARGET_ARCH_X64
+  function = FUNCTION_ADDR(RegExpMacroAssemblerX64::CheckStackGuardState);
+#elif V8_TARGET_ARCH_IA32
+  function = FUNCTION_ADDR(RegExpMacroAssemblerIA32::CheckStackGuardState);
+#elif V8_TARGET_ARCH_ARM64
+  function = FUNCTION_ADDR(RegExpMacroAssemblerARM64::CheckStackGuardState);
+#elif V8_TARGET_ARCH_ARM
+  function = FUNCTION_ADDR(RegExpMacroAssemblerARM::CheckStackGuardState);
+#elif V8_TARGET_ARCH_PPC
+  function = FUNCTION_ADDR(RegExpMacroAssemblerPPC::CheckStackGuardState);
+#elif V8_TARGET_ARCH_MIPS
+  function = FUNCTION_ADDR(RegExpMacroAssemblerMIPS::CheckStackGuardState);
+#elif V8_TARGET_ARCH_MIPS64
+  function = FUNCTION_ADDR(RegExpMacroAssemblerMIPS::CheckStackGuardState);
+#elif V8_TARGET_ARCH_S390
+  function = FUNCTION_ADDR(RegExpMacroAssemblerS390::CheckStackGuardState);
+#else
+  UNREACHABLE();
+#endif
+  return ExternalReference(Redirect(isolate, function));
+}
+
+ExternalReference ExternalReference::re_grow_stack(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(NativeRegExpMacroAssembler::GrowStack)));
+}
+
+ExternalReference ExternalReference::re_case_insensitive_compare_uc16(
+    Isolate* isolate) {
+  return ExternalReference(Redirect(
+      isolate,
+      FUNCTION_ADDR(NativeRegExpMacroAssembler::CaseInsensitiveCompareUC16)));
+}
+
+ExternalReference ExternalReference::re_word_character_map(Isolate* isolate) {
+  return ExternalReference(
+      NativeRegExpMacroAssembler::word_character_map_address());
+}
+
+ExternalReference ExternalReference::address_of_static_offsets_vector(
+    Isolate* isolate) {
+  return ExternalReference(
+      reinterpret_cast<Address>(isolate->jsregexp_static_offsets_vector()));
+}
+
+ExternalReference ExternalReference::address_of_regexp_stack_limit(
+    Isolate* isolate) {
+  return ExternalReference(isolate->regexp_stack()->limit_address());
+}
+
+ExternalReference ExternalReference::address_of_regexp_stack_memory_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->regexp_stack()->memory_address());
+}
+
+ExternalReference ExternalReference::address_of_regexp_stack_memory_size(
+    Isolate* isolate) {
+  return ExternalReference(isolate->regexp_stack()->memory_size_address());
+}
+
+#endif  // V8_INTERPRETED_REGEXP
+
+ExternalReference ExternalReference::ieee754_acos_function(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(base::ieee754::acos), BUILTIN_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_acosh_function(Isolate* isolate) {
+  return ExternalReference(Redirect(
+      isolate, FUNCTION_ADDR(base::ieee754::acosh), BUILTIN_FP_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_asin_function(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(base::ieee754::asin), BUILTIN_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_asinh_function(Isolate* isolate) {
+  return ExternalReference(Redirect(
+      isolate, FUNCTION_ADDR(base::ieee754::asinh), BUILTIN_FP_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_atan_function(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(base::ieee754::atan), BUILTIN_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_atanh_function(Isolate* isolate) {
+  return ExternalReference(Redirect(
+      isolate, FUNCTION_ADDR(base::ieee754::atanh), BUILTIN_FP_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_atan2_function(Isolate* isolate) {
+  return ExternalReference(Redirect(
+      isolate, FUNCTION_ADDR(base::ieee754::atan2), BUILTIN_FP_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_cbrt_function(Isolate* isolate) {
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(base::ieee754::cbrt),
+                                    BUILTIN_FP_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_cos_function(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(base::ieee754::cos), BUILTIN_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_cosh_function(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(base::ieee754::cosh), BUILTIN_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_exp_function(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(base::ieee754::exp), BUILTIN_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_expm1_function(Isolate* isolate) {
+  return ExternalReference(Redirect(
+      isolate, FUNCTION_ADDR(base::ieee754::expm1), BUILTIN_FP_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_log_function(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(base::ieee754::log), BUILTIN_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_log1p_function(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(base::ieee754::log1p), BUILTIN_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_log10_function(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(base::ieee754::log10), BUILTIN_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_log2_function(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(base::ieee754::log2), BUILTIN_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_sin_function(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(base::ieee754::sin), BUILTIN_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_sinh_function(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(base::ieee754::sinh), BUILTIN_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_tan_function(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(base::ieee754::tan), BUILTIN_FP_CALL));
+}
+
+ExternalReference ExternalReference::ieee754_tanh_function(Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(base::ieee754::tanh), BUILTIN_FP_CALL));
+}
+
+void* libc_memchr(void* string, int character, size_t search_length) {
+  return memchr(string, character, search_length);
+}
+
+ExternalReference ExternalReference::libc_memchr_function(Isolate* isolate) {
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(libc_memchr)));
+}
+
+void* libc_memcpy(void* dest, const void* src, size_t n) {
+  return memcpy(dest, src, n);
+}
+
+ExternalReference ExternalReference::libc_memcpy_function(Isolate* isolate) {
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(libc_memcpy)));
+}
+
+void* libc_memmove(void* dest, const void* src, size_t n) {
+  return memmove(dest, src, n);
+}
+
+ExternalReference ExternalReference::libc_memmove_function(Isolate* isolate) {
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(libc_memmove)));
+}
+
+void* libc_memset(void* dest, int byte, size_t n) {
+  DCHECK_EQ(static_cast<char>(byte), byte);
+  return memset(dest, byte, n);
+}
+
+ExternalReference ExternalReference::libc_memset_function(Isolate* isolate) {
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(libc_memset)));
+}
+
+ExternalReference ExternalReference::printf_function(Isolate* isolate) {
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(std::printf)));
+}
+
+template <typename SubjectChar, typename PatternChar>
+ExternalReference ExternalReference::search_string_raw(Isolate* isolate) {
+  auto f = SearchStringRaw<SubjectChar, PatternChar>;
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f)));
+}
+
+ExternalReference ExternalReference::search_string_raw_one_one(
+    Isolate* isolate) {
+  return search_string_raw<const uint8_t, const uint8_t>(isolate);
+}
+
+ExternalReference ExternalReference::search_string_raw_one_two(
+    Isolate* isolate) {
+  return search_string_raw<const uint8_t, const uc16>(isolate);
+}
+
+ExternalReference ExternalReference::search_string_raw_two_one(
+    Isolate* isolate) {
+  return search_string_raw<const uc16, const uint8_t>(isolate);
+}
+
+ExternalReference ExternalReference::search_string_raw_two_two(
+    Isolate* isolate) {
+  return search_string_raw<const uc16, const uc16>(isolate);
+}
+
+ExternalReference ExternalReference::orderedhashmap_gethash_raw(
+    Isolate* isolate) {
+  auto f = OrderedHashMap::GetHash;
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f)));
+}
+
+ExternalReference ExternalReference::get_or_create_hash_raw(Isolate* isolate) {
+  typedef Smi* (*GetOrCreateHash)(Isolate * isolate, Object * key);
+  GetOrCreateHash f = Object::GetOrCreateHash;
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f)));
+}
+
+ExternalReference ExternalReference::jsreceiver_create_identity_hash(
+    Isolate* isolate) {
+  typedef Smi* (*CreateIdentityHash)(Isolate * isolate, JSReceiver * key);
+  CreateIdentityHash f = JSReceiver::CreateIdentityHash;
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f)));
+}
+
+ExternalReference
+ExternalReference::copy_fast_number_jsarray_elements_to_typed_array(
+    Isolate* isolate) {
+  return ExternalReference(Redirect(
+      isolate, FUNCTION_ADDR(CopyFastNumberJSArrayElementsToTypedArray)));
+}
+
+ExternalReference ExternalReference::copy_typed_array_elements_to_typed_array(
+    Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(CopyTypedArrayElementsToTypedArray)));
+}
+
+ExternalReference ExternalReference::copy_typed_array_elements_slice(
+    Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(CopyTypedArrayElementsSlice)));
+}
+
+ExternalReference ExternalReference::try_internalize_string_function(
+    Isolate* isolate) {
+  return ExternalReference(Redirect(
+      isolate, FUNCTION_ADDR(StringTable::LookupStringIfExists_NoAllocate)));
+}
+
+ExternalReference ExternalReference::check_object_type(Isolate* isolate) {
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(CheckObjectType)));
+}
+
+#ifdef V8_INTL_SUPPORT
+ExternalReference ExternalReference::intl_convert_one_byte_to_lower(
+    Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(ConvertOneByteToLower)));
+}
+
+ExternalReference ExternalReference::intl_to_latin1_lower_table(
+    Isolate* isolate) {
+  uint8_t* ptr = const_cast<uint8_t*>(ToLatin1LowerTable());
+  return ExternalReference(reinterpret_cast<Address>(ptr));
+}
+#endif  // V8_INTL_SUPPORT
+
+// Explicit instantiations for all combinations of 1- and 2-byte strings.
+template ExternalReference
+ExternalReference::search_string_raw<const uint8_t, const uint8_t>(Isolate*);
+template ExternalReference
+ExternalReference::search_string_raw<const uint8_t, const uc16>(Isolate*);
+template ExternalReference
+ExternalReference::search_string_raw<const uc16, const uint8_t>(Isolate*);
+template ExternalReference
+ExternalReference::search_string_raw<const uc16, const uc16>(Isolate*);
+
+ExternalReference ExternalReference::page_flags(Page* page) {
+  return ExternalReference(reinterpret_cast<Address>(page) +
+                           MemoryChunk::kFlagsOffset);
+}
+
+ExternalReference ExternalReference::ForDeoptEntry(Address entry) {
+  return ExternalReference(entry);
+}
+
+ExternalReference ExternalReference::cpu_features(Isolate* isolate) {
+  DCHECK(CpuFeatures::initialized_);
+  return ExternalReference(&CpuFeatures::supported_);
+}
+
+ExternalReference ExternalReference::promise_hook_or_debug_is_active_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->promise_hook_or_debug_is_active_address());
+}
+
+ExternalReference ExternalReference::debug_is_active_address(Isolate* isolate) {
+  return ExternalReference(isolate->debug()->is_active_address());
+}
+
+ExternalReference ExternalReference::debug_hook_on_function_call_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->debug()->hook_on_function_call_address());
+}
+
+ExternalReference ExternalReference::runtime_function_table_address(
+    Isolate* isolate) {
+  return ExternalReference(
+      const_cast<Runtime::Function*>(Runtime::RuntimeFunctionTable(isolate)));
+}
+
+ExternalReference ExternalReference::invalidate_prototype_chains_function(
+    Isolate* isolate) {
+  return ExternalReference(
+      Redirect(isolate, FUNCTION_ADDR(JSObject::InvalidatePrototypeChains)));
+}
+
+double power_helper(Isolate* isolate, double x, double y) {
+  int y_int = static_cast<int>(y);
+  if (y == y_int) {
+    return power_double_int(x, y_int);  // Returns 1 if exponent is 0.
+  }
+  if (y == 0.5) {
+    lazily_initialize_fast_sqrt(isolate);
+    return (std::isinf(x)) ? V8_INFINITY
+                           : fast_sqrt(x + 0.0, isolate);  // Convert -0 to +0.
+  }
+  if (y == -0.5) {
+    lazily_initialize_fast_sqrt(isolate);
+    return (std::isinf(x)) ? 0
+                           : 1.0 / fast_sqrt(x + 0.0,
+                                             isolate);  // Convert -0 to +0.
+  }
+  return power_double_double(x, y);
+}
+
+// Helper function to compute x^y, where y is known to be an
+// integer. Uses binary decomposition to limit the number of
+// multiplications; see the discussion in "Hacker's Delight" by Henry
+// S. Warren, Jr., figure 11-6, page 213.
+double power_double_int(double x, int y) {
+  double m = (y < 0) ? 1 / x : x;
+  unsigned n = (y < 0) ? -y : y;
+  double p = 1;
+  while (n != 0) {
+    if ((n & 1) != 0) p *= m;
+    m *= m;
+    if ((n & 2) != 0) p *= m;
+    m *= m;
+    n >>= 2;
+  }
+  return p;
+}
+
+double power_double_double(double x, double y) {
+  // The checks for special cases can be dropped in ia32 because it has already
+  // been done in generated code before bailing out here.
+  if (std::isnan(y) || ((x == 1 || x == -1) && std::isinf(y))) {
+    return std::numeric_limits<double>::quiet_NaN();
+  }
+  return Pow(x, y);
+}
+
+double modulo_double_double(double x, double y) { return Modulo(x, y); }
+
+ExternalReference ExternalReference::power_double_double_function(
+    Isolate* isolate) {
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(power_double_double),
+                                    BUILTIN_FP_FP_CALL));
+}
+
+ExternalReference ExternalReference::mod_two_doubles_operation(
+    Isolate* isolate) {
+  return ExternalReference(Redirect(
+      isolate, FUNCTION_ADDR(modulo_double_double), BUILTIN_FP_FP_CALL));
+}
+
+ExternalReference ExternalReference::debug_last_step_action_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->debug()->last_step_action_address());
+}
+
+ExternalReference ExternalReference::debug_suspended_generator_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->debug()->suspended_generator_address());
+}
+
+ExternalReference ExternalReference::debug_restart_fp_address(
+    Isolate* isolate) {
+  return ExternalReference(isolate->debug()->restart_fp_address());
+}
+
+ExternalReference ExternalReference::fixed_typed_array_base_data_offset(
+    Isolate* isolate) {
+  return ExternalReference(reinterpret_cast<void*>(
+      FixedTypedArrayBase::kDataOffset - kHeapObjectTag));
+}
+
+bool operator==(ExternalReference lhs, ExternalReference rhs) {
+  return lhs.address() == rhs.address();
+}
+
+bool operator!=(ExternalReference lhs, ExternalReference rhs) {
+  return !(lhs == rhs);
+}
+
+size_t hash_value(ExternalReference reference) {
+  return base::hash<Address>()(reference.address());
+}
+
+std::ostream& operator<<(std::ostream& os, ExternalReference reference) {
+  os << static_cast<const void*>(reference.address());
+  const Runtime::Function* fn = Runtime::FunctionForEntry(reference.address());
+  if (fn) os << "<" << fn->name << ".entry>";
+  return os;
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/external-reference.h b/deps/v8/src/external-reference.h
new file mode 100644
index 00000000000..21f4bc32ba2
--- /dev/null
+++ b/deps/v8/src/external-reference.h
@@ -0,0 +1,304 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_EXTERNAL_REFERENCE_H_
+#define V8_EXTERNAL_REFERENCE_H_
+
+#include "src/globals.h"
+#include "src/runtime/runtime.h"
+
+namespace v8 {
+
+class ApiFunction;
+
+namespace internal {
+
+class Isolate;
+class Page;
+class SCTableReference;
+class StatsCounter;
+
+//------------------------------------------------------------------------------
+// External references
+
+#define EXTERNAL_REFERENCE_LIST(V)                                             \
+  V(address_of_double_abs_constant, "double_absolute_constant")                \
+  V(address_of_double_neg_constant, "double_negate_constant")                  \
+  V(address_of_float_abs_constant, "float_absolute_constant")                  \
+  V(address_of_float_neg_constant, "float_negate_constant")                    \
+  V(address_of_min_int, "LDoubleConstant::min_int")                            \
+  V(address_of_minus_one_half, "double_constants.minus_one_half")              \
+  V(address_of_negative_infinity, "LDoubleConstant::negative_infinity")        \
+  V(address_of_one_half, "LDoubleConstant::one_half")                          \
+  V(address_of_pending_message_obj, "address_of_pending_message_obj")          \
+  V(address_of_real_stack_limit, "StackGuard::address_of_real_jslimit()")      \
+  V(address_of_stack_limit, "StackGuard::address_of_jslimit()")                \
+  V(address_of_the_hole_nan, "the_hole_nan")                                   \
+  V(address_of_uint32_bias, "uint32_bias")                                     \
+  V(allocation_sites_list_address, "Heap::allocation_sites_list_address()")    \
+  V(builtins_address, "builtins")                                              \
+  V(bytecode_size_table_address, "Bytecodes::bytecode_size_table_address")     \
+  V(check_object_type, "check_object_type")                                    \
+  V(compute_output_frames_function, "Deoptimizer::ComputeOutputFrames()")      \
+  V(copy_fast_number_jsarray_elements_to_typed_array,                          \
+    "copy_fast_number_jsarray_elements_to_typed_array")                        \
+  V(copy_typed_array_elements_slice, "copy_typed_array_elements_slice")        \
+  V(copy_typed_array_elements_to_typed_array,                                  \
+    "copy_typed_array_elements_to_typed_array")                                \
+  V(cpu_features, "cpu_features")                                              \
+  V(date_cache_stamp, "date_cache_stamp")                                      \
+  V(debug_hook_on_function_call_address,                                       \
+    "Debug::hook_on_function_call_address()")                                  \
+  V(debug_is_active_address, "Debug::is_active_address()")                     \
+  V(debug_last_step_action_address, "Debug::step_in_enabled_address()")        \
+  V(debug_restart_fp_address, "Debug::restart_fp_address()")                   \
+  V(debug_suspended_generator_address,                                         \
+    "Debug::step_suspended_generator_address()")                               \
+  V(delete_handle_scope_extensions, "HandleScope::DeleteExtensions")           \
+  V(f64_acos_wrapper_function, "f64_acos_wrapper")                             \
+  V(f64_asin_wrapper_function, "f64_asin_wrapper")                             \
+  V(f64_mod_wrapper_function, "f64_mod_wrapper")                               \
+  V(fixed_typed_array_base_data_offset, "fixed_typed_array_base_data_offset")  \
+  V(force_slow_path, "Isolate::force_slow_path_address()")                     \
+  V(get_date_field_function, "JSDate::GetField")                               \
+  V(get_or_create_hash_raw, "get_or_create_hash_raw")                          \
+  V(handle_scope_implementer_address,                                          \
+    "Isolate::handle_scope_implementer_address")                               \
+  V(handle_scope_level_address, "HandleScope::level")                          \
+  V(handle_scope_limit_address, "HandleScope::limit")                          \
+  V(handle_scope_next_address, "HandleScope::next")                            \
+  V(heap_is_marking_flag_address, "heap_is_marking_flag_address")              \
+  V(ieee754_acos_function, "base::ieee754::acos")                              \
+  V(ieee754_acosh_function, "base::ieee754::acosh")                            \
+  V(ieee754_asin_function, "base::ieee754::asin")                              \
+  V(ieee754_asinh_function, "base::ieee754::asinh")                            \
+  V(ieee754_atan2_function, "base::ieee754::atan2")                            \
+  V(ieee754_atan_function, "base::ieee754::atan")                              \
+  V(ieee754_atanh_function, "base::ieee754::atanh")                            \
+  V(ieee754_cbrt_function, "base::ieee754::cbrt")                              \
+  V(ieee754_cos_function, "base::ieee754::cos")                                \
+  V(ieee754_cosh_function, "base::ieee754::cosh")                              \
+  V(ieee754_exp_function, "base::ieee754::exp")                                \
+  V(ieee754_expm1_function, "base::ieee754::expm1")                            \
+  V(ieee754_log10_function, "base::ieee754::log10")                            \
+  V(ieee754_log1p_function, "base::ieee754::log1p")                            \
+  V(ieee754_log2_function, "base::ieee754::log2")                              \
+  V(ieee754_log_function, "base::ieee754::log")                                \
+  V(ieee754_sin_function, "base::ieee754::sin")                                \
+  V(ieee754_sinh_function, "base::ieee754::sinh")                              \
+  V(ieee754_tan_function, "base::ieee754::tan")                                \
+  V(ieee754_tanh_function, "base::ieee754::tanh")                              \
+  V(incremental_marking_record_write_function,                                 \
+    "IncrementalMarking::RecordWrite")                                         \
+  V(interpreter_dispatch_counters, "Interpreter::dispatch_counters")           \
+  V(interpreter_dispatch_table_address, "Interpreter::dispatch_table_address") \
+  V(invalidate_prototype_chains_function,                                      \
+    "JSObject::InvalidatePrototypeChains()")                                   \
+  V(invoke_accessor_getter_callback, "InvokeAccessorGetterCallback")           \
+  V(invoke_function_callback, "InvokeFunctionCallback")                        \
+  V(isolate_address, "isolate")                                                \
+  V(is_profiling_address, "Isolate::is_profiling")                             \
+  V(jsreceiver_create_identity_hash, "jsreceiver_create_identity_hash")        \
+  V(libc_memchr_function, "libc_memchr")                                       \
+  V(libc_memcpy_function, "libc_memcpy")                                       \
+  V(libc_memmove_function, "libc_memmove")                                     \
+  V(libc_memset_function, "libc_memset")                                       \
+  V(log_enter_external_function, "Logger::EnterExternal")                      \
+  V(log_leave_external_function, "Logger::LeaveExternal")                      \
+  V(mod_two_doubles_operation, "mod_two_doubles")                              \
+  V(new_deoptimizer_function, "Deoptimizer::New()")                            \
+  V(new_space_allocation_limit_address,                                        \
+    "Heap::NewSpaceAllocationLimitAddress()")                                  \
+  V(new_space_allocation_top_address, "Heap::NewSpaceAllocationTopAddress()")  \
+  V(old_space_allocation_limit_address,                                        \
+    "Heap::OldSpaceAllocationLimitAddress")                                    \
+  V(old_space_allocation_top_address, "Heap::OldSpaceAllocationTopAddress")    \
+  V(orderedhashmap_gethash_raw, "orderedhashmap_gethash_raw")                  \
+  V(pending_microtask_count_address,                                           \
+    "Isolate::pending_microtask_count_address()")                              \
+  V(power_double_double_function, "power_double_double_function")              \
+  V(printf_function, "printf")                                                 \
+  V(promise_hook_or_debug_is_active_address,                                   \
+    "Isolate::promise_hook_or_debug_is_active_address()")                      \
+  V(roots_array_start, "Heap::roots_array_start()")                            \
+  V(runtime_function_table_address,                                            \
+    "Runtime::runtime_function_table_address()")                               \
+  V(scheduled_exception_address, "Isolate::scheduled_exception")               \
+  V(search_string_raw_one_one, "search_string_raw_one_one")                    \
+  V(search_string_raw_one_two, "search_string_raw_one_two")                    \
+  V(search_string_raw_two_one, "search_string_raw_two_one")                    \
+  V(search_string_raw_two_two, "search_string_raw_two_two")                    \
+  V(store_buffer_overflow_function, "StoreBuffer::StoreBufferOverflow")        \
+  V(store_buffer_top, "store_buffer_top")                                      \
+  V(stress_deopt_count, "Isolate::stress_deopt_count_address()")               \
+  V(try_internalize_string_function, "try_internalize_string_function")        \
+  V(wasm_call_trap_callback_for_testing,                                       \
+    "wasm::call_trap_callback_for_testing")                                    \
+  V(wasm_clear_thread_in_wasm_flag, "wasm::clear_thread_in_wasm_flag")         \
+  V(wasm_f32_ceil, "wasm::f32_ceil_wrapper")                                   \
+  V(wasm_f32_floor, "wasm::f32_floor_wrapper")                                 \
+  V(wasm_f32_nearest_int, "wasm::f32_nearest_int_wrapper")                     \
+  V(wasm_f32_trunc, "wasm::f32_trunc_wrapper")                                 \
+  V(wasm_f64_ceil, "wasm::f64_ceil_wrapper")                                   \
+  V(wasm_f64_floor, "wasm::f64_floor_wrapper")                                 \
+  V(wasm_f64_nearest_int, "wasm::f64_nearest_int_wrapper")                     \
+  V(wasm_f64_trunc, "wasm::f64_trunc_wrapper")                                 \
+  V(wasm_float32_to_int64, "wasm::float32_to_int64_wrapper")                   \
+  V(wasm_float32_to_uint64, "wasm::float32_to_uint64_wrapper")                 \
+  V(wasm_float64_pow, "wasm::float64_pow")                                     \
+  V(wasm_float64_to_int64, "wasm::float64_to_int64_wrapper")                   \
+  V(wasm_float64_to_uint64, "wasm::float64_to_uint64_wrapper")                 \
+  V(wasm_int64_div, "wasm::int64_div")                                         \
+  V(wasm_int64_mod, "wasm::int64_mod")                                         \
+  V(wasm_int64_to_float32, "wasm::int64_to_float32_wrapper")                   \
+  V(wasm_int64_to_float64, "wasm::int64_to_float64_wrapper")                   \
+  V(wasm_set_thread_in_wasm_flag, "wasm::set_thread_in_wasm_flag")             \
+  V(wasm_uint64_div, "wasm::uint64_div")                                       \
+  V(wasm_uint64_mod, "wasm::uint64_mod")                                       \
+  V(wasm_uint64_to_float32, "wasm::uint64_to_float32_wrapper")                 \
+  V(wasm_uint64_to_float64, "wasm::uint64_to_float64_wrapper")                 \
+  V(wasm_word32_ctz, "wasm::word32_ctz")                                       \
+  V(wasm_word32_popcnt, "wasm::word32_popcnt")                                 \
+  V(wasm_word32_rol, "wasm::word32_rol")                                       \
+  V(wasm_word32_ror, "wasm::word32_ror")                                       \
+  V(wasm_word64_ctz, "wasm::word64_ctz")                                       \
+  V(wasm_word64_popcnt, "wasm::word64_popcnt")                                 \
+  EXTERNAL_REFERENCE_LIST_NON_INTERPRETED_REGEXP(V)                            \
+  EXTERNAL_REFERENCE_LIST_INTL(V)
+
+#ifndef V8_INTERPRETED_REGEXP
+#define EXTERNAL_REFERENCE_LIST_NON_INTERPRETED_REGEXP(V)                     \
+  V(address_of_regexp_stack_limit, "RegExpStack::limit_address()")            \
+  V(address_of_regexp_stack_memory_address, "RegExpStack::memory_address()")  \
+  V(address_of_regexp_stack_memory_size, "RegExpStack::memory_size()")        \
+  V(address_of_static_offsets_vector, "OffsetsVector::static_offsets_vector") \
+  V(re_case_insensitive_compare_uc16,                                         \
+    "NativeRegExpMacroAssembler::CaseInsensitiveCompareUC16()")               \
+  V(re_check_stack_guard_state,                                               \
+    "RegExpMacroAssembler*::CheckStackGuardState()")                          \
+  V(re_grow_stack, "NativeRegExpMacroAssembler::GrowStack()")                 \
+  V(re_word_character_map, "NativeRegExpMacroAssembler::word_character_map")
+#else
+#define EXTERNAL_REFERENCE_LIST_NON_INTERPRETED_REGEXP(V)
+#endif  // V8_INTERPRETED_REGEXP
+
+#ifdef V8_INTL_SUPPORT
+#define EXTERNAL_REFERENCE_LIST_INTL(V)                               \
+  V(intl_convert_one_byte_to_lower, "intl_convert_one_byte_to_lower") \
+  V(intl_to_latin1_lower_table, "intl_to_latin1_lower_table")
+#else
+#define EXTERNAL_REFERENCE_LIST_INTL(V)
+#endif  // V8_INTL_SUPPORT
+
+// An ExternalReference represents a C++ address used in the generated
+// code. All references to C++ functions and variables must be encapsulated
+// in an ExternalReference instance. This is done in order to track the
+// origin of all external references in the code so that they can be bound
+// to the correct addresses when deserializing a heap.
+class ExternalReference BASE_EMBEDDED {
+ public:
+  // Used in the simulator to support different native api calls.
+  enum Type {
+    // Builtin call.
+    // Object* f(v8::internal::Arguments).
+    BUILTIN_CALL,  // default
+
+    // Builtin call returning object pair.
+    // ObjectPair f(v8::internal::Arguments).
+    BUILTIN_CALL_PAIR,
+
+    // Builtin that takes float arguments and returns an int.
+    // int f(double, double).
+    BUILTIN_COMPARE_CALL,
+
+    // Builtin call that returns floating point.
+    // double f(double, double).
+    BUILTIN_FP_FP_CALL,
+
+    // Builtin call that returns floating point.
+    // double f(double).
+    BUILTIN_FP_CALL,
+
+    // Builtin call that returns floating point.
+    // double f(double, int).
+    BUILTIN_FP_INT_CALL,
+
+    // Direct call to API function callback.
+    // void f(v8::FunctionCallbackInfo&)
+    DIRECT_API_CALL,
+
+    // Call to function callback via InvokeFunctionCallback.
+    // void f(v8::FunctionCallbackInfo&, v8::FunctionCallback)
+    PROFILING_API_CALL,
+
+    // Direct call to accessor getter callback.
+    // void f(Local<Name> property, PropertyCallbackInfo& info)
+    DIRECT_GETTER_CALL,
+
+    // Call to accessor getter callback via InvokeAccessorGetterCallback.
+    // void f(Local<Name> property, PropertyCallbackInfo& info,
+    //     AccessorNameGetterCallback callback)
+    PROFILING_GETTER_CALL
+  };
+
+  static constexpr int kExternalReferenceCount =
+#define COUNT_EXTERNAL_REFERENCE(name, desc) +1
+      EXTERNAL_REFERENCE_LIST(COUNT_EXTERNAL_REFERENCE);
+#undef COUNT_EXTERNAL_REFERENCE
+
+  static void SetUp();
+
+  typedef void* ExternalReferenceRedirector(void* original, Type type);
+
+  ExternalReference() : address_(nullptr) {}
+  explicit ExternalReference(const SCTableReference& table_ref);
+  explicit ExternalReference(StatsCounter* counter);
+  ExternalReference(Address address, Isolate* isolate);
+  ExternalReference(ApiFunction* ptr, Type type, Isolate* isolate);
+  ExternalReference(const Runtime::Function* f, Isolate* isolate);
+  ExternalReference(IsolateAddressId id, Isolate* isolate);
+  ExternalReference(Runtime::FunctionId id, Isolate* isolate);
+
+  template <typename SubjectChar, typename PatternChar>
+  static ExternalReference search_string_raw(Isolate* isolate);
+
+  static ExternalReference page_flags(Page* page);
+
+  static ExternalReference ForDeoptEntry(Address entry);
+
+#define DECL_EXTERNAL_REFERENCE(name, desc) \
+  static ExternalReference name(Isolate* isolate);
+  EXTERNAL_REFERENCE_LIST(DECL_EXTERNAL_REFERENCE)
+#undef DECL_EXTERNAL_REFERENCE
+
+  V8_EXPORT_PRIVATE V8_NOINLINE static ExternalReference
+  runtime_function_table_address_for_unittests(Isolate* isolate);
+
+  Address address() const { return reinterpret_cast<Address>(address_); }
+
+  // This lets you register a function that rewrites all external references.
+  // Used by the ARM simulator to catch calls to external references.
+  static void set_redirector(Isolate* isolate,
+                             ExternalReferenceRedirector* redirector);
+
+ private:
+  explicit ExternalReference(void* address) : address_(address) {}
+
+  static void* Redirect(Isolate* isolate, Address address_arg,
+                        Type type = ExternalReference::BUILTIN_CALL);
+
+  void* address_;
+};
+
+V8_EXPORT_PRIVATE bool operator==(ExternalReference, ExternalReference);
+bool operator!=(ExternalReference, ExternalReference);
+
+size_t hash_value(ExternalReference);
+
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, ExternalReference);
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_EXTERNAL_REFERENCE_H_
diff --git a/deps/v8/src/factory-inl.h b/deps/v8/src/factory-inl.h
index ace5c35472c..8fa558b325c 100644
--- a/deps/v8/src/factory-inl.h
+++ b/deps/v8/src/factory-inl.h
@@ -9,6 +9,7 @@
 
 #include "src/handles-inl.h"
 #include "src/objects-inl.h"
+#include "src/string-hasher.h"
 
 namespace v8 {
 namespace internal {
diff --git a/deps/v8/src/factory.cc b/deps/v8/src/factory.cc
index fab539bf8be..711271895da 100644
--- a/deps/v8/src/factory.cc
+++ b/deps/v8/src/factory.cc
@@ -17,7 +17,9 @@
 #include "src/objects/bigint.h"
 #include "src/objects/debug-objects-inl.h"
 #include "src/objects/frame-array-inl.h"
+#include "src/objects/microtask-inl.h"
 #include "src/objects/module.h"
+#include "src/objects/promise-inl.h"
 #include "src/objects/scope-info.h"
 #include "src/unicode-cache.h"
 #include "src/unicode-decoder.h"
@@ -39,30 +41,30 @@ namespace internal {
     return Handle<TYPE>(TYPE::cast(__object__), ISOLATE); \
   }
 
-#define CALL_HEAP_FUNCTION(ISOLATE, FUNCTION_CALL, TYPE)                      \
-  do {                                                                        \
-    AllocationResult __allocation__ = FUNCTION_CALL;                          \
-    Object* __object__ = nullptr;                                             \
-    RETURN_OBJECT_UNLESS_RETRY(ISOLATE, TYPE)                                 \
-    /* Two GCs before panicking.  In newspace will almost always succeed. */  \
-    for (int __i__ = 0; __i__ < 2; __i__++) {                                 \
-      (ISOLATE)->heap()->CollectGarbage(                                      \
-          __allocation__.RetrySpace(),                                        \
-          GarbageCollectionReason::kAllocationFailure);                       \
-      __allocation__ = FUNCTION_CALL;                                         \
-      RETURN_OBJECT_UNLESS_RETRY(ISOLATE, TYPE)                               \
-    }                                                                         \
-    (ISOLATE)->counters()->gc_last_resort_from_handles()->Increment();        \
-    (ISOLATE)->heap()->CollectAllAvailableGarbage(                            \
-        GarbageCollectionReason::kLastResort);                                \
-    {                                                                         \
-      AlwaysAllocateScope __scope__(ISOLATE);                                 \
-      __allocation__ = FUNCTION_CALL;                                         \
-    }                                                                         \
-    RETURN_OBJECT_UNLESS_RETRY(ISOLATE, TYPE)                                 \
-    /* TODO(1181417): Fix this. */                                            \
-    v8::internal::Heap::FatalProcessOutOfMemory("CALL_AND_RETRY_LAST", true); \
-    return Handle<TYPE>();                                                    \
+#define CALL_HEAP_FUNCTION(ISOLATE, FUNCTION_CALL, TYPE)                     \
+  do {                                                                       \
+    AllocationResult __allocation__ = FUNCTION_CALL;                         \
+    Object* __object__ = nullptr;                                            \
+    RETURN_OBJECT_UNLESS_RETRY(ISOLATE, TYPE)                                \
+    /* Two GCs before panicking.  In newspace will almost always succeed. */ \
+    for (int __i__ = 0; __i__ < 2; __i__++) {                                \
+      (ISOLATE)->heap()->CollectGarbage(                                     \
+          __allocation__.RetrySpace(),                                       \
+          GarbageCollectionReason::kAllocationFailure);                      \
+      __allocation__ = FUNCTION_CALL;                                        \
+      RETURN_OBJECT_UNLESS_RETRY(ISOLATE, TYPE)                              \
+    }                                                                        \
+    (ISOLATE)->counters()->gc_last_resort_from_handles()->Increment();       \
+    (ISOLATE)->heap()->CollectAllAvailableGarbage(                           \
+        GarbageCollectionReason::kLastResort);                               \
+    {                                                                        \
+      AlwaysAllocateScope __scope__(ISOLATE);                                \
+      __allocation__ = FUNCTION_CALL;                                        \
+    }                                                                        \
+    RETURN_OBJECT_UNLESS_RETRY(ISOLATE, TYPE)                                \
+    /* TODO(1181417): Fix this. */                                           \
+    (ISOLATE)->heap()->FatalProcessOutOfMemory("CALL_AND_RETRY_LAST");       \
+    return Handle<TYPE>();                                                   \
   } while (false)
 
 template<typename T>
@@ -98,9 +100,8 @@ Handle<HeapObject> Factory::NewFillerObject(int size,
 Handle<PrototypeInfo> Factory::NewPrototypeInfo() {
   Handle<PrototypeInfo> result =
       Handle<PrototypeInfo>::cast(NewStruct(PROTOTYPE_INFO_TYPE, TENURED));
-  result->set_prototype_users(WeakFixedArray::Empty());
+  result->set_prototype_users(FixedArrayOfWeakCells::Empty());
   result->set_registry_slot(PrototypeInfo::UNREGISTERED);
-  result->set_validity_cell(Smi::FromInt(Map::kPrototypeChainValid));
   result->set_bit_field(0);
   return result;
 }
@@ -149,13 +150,11 @@ Handle<ConstantElementsPair> Factory::NewConstantElementsPair(
 }
 
 Handle<TemplateObjectDescription> Factory::NewTemplateObjectDescription(
-    int hash, Handle<FixedArray> raw_strings,
-    Handle<FixedArray> cooked_strings) {
+    Handle<FixedArray> raw_strings, Handle<FixedArray> cooked_strings) {
   DCHECK_EQ(raw_strings->length(), cooked_strings->length());
   DCHECK_LT(0, raw_strings->length());
   Handle<TemplateObjectDescription> result =
-      Handle<TemplateObjectDescription>::cast(NewStruct(TUPLE3_TYPE, TENURED));
-  result->set_hash(hash);
+      Handle<TemplateObjectDescription>::cast(NewStruct(TUPLE2_TYPE, TENURED));
   result->set_raw_strings(*raw_strings);
   result->set_cooked_strings(*cooked_strings);
   return result;
@@ -178,17 +177,23 @@ Handle<PropertyArray> Factory::NewPropertyArray(int length,
       PropertyArray);
 }
 
-Handle<FixedArray> Factory::NewFixedArrayWithMap(
-    Heap::RootListIndex map_root_index, int length, PretenureFlag pretenure) {
+template <typename T>
+Handle<T> Factory::NewFixedArrayWithMap(Heap::RootListIndex map_root_index,
+                                        int length, PretenureFlag pretenure) {
+  static_assert(std::is_base_of<FixedArray, T>::value,
+                "T must be a descendant of FixedArray");
   // Zero-length case must be handled outside, where the knowledge about
   // the map is.
   DCHECK_LT(0, length);
   CALL_HEAP_FUNCTION(isolate(),
                      isolate()->heap()->AllocateFixedArrayWithMap(
                          map_root_index, length, pretenure),
-                     FixedArray);
+                     T);
 }
 
+template Handle<FixedArray> Factory::NewFixedArrayWithMap<FixedArray>(
+    Heap::RootListIndex, int, PretenureFlag);
+
 Handle<FixedArray> Factory::NewFixedArray(int length, PretenureFlag pretenure) {
   DCHECK_LE(0, length);
   if (length == 0) return empty_fixed_array();
@@ -198,6 +203,16 @@ Handle<FixedArray> Factory::NewFixedArray(int length, PretenureFlag pretenure) {
                      FixedArray);
 }
 
+Handle<WeakFixedArray> Factory::NewWeakFixedArray(int length,
+                                                  PretenureFlag pretenure) {
+  DCHECK_LE(0, length);
+  if (length == 0) return empty_weak_fixed_array();
+
+  CALL_HEAP_FUNCTION(
+      isolate(), isolate()->heap()->AllocateWeakFixedArray(length, pretenure),
+      WeakFixedArray);
+}
+
 MaybeHandle<FixedArray> Factory::TryNewFixedArray(int length,
                                                   PretenureFlag pretenure) {
   DCHECK_LE(0, length);
@@ -222,7 +237,8 @@ Handle<FixedArray> Factory::NewFixedArrayWithHoles(int length,
       FixedArray);
 }
 
-Handle<FixedArray> Factory::NewUninitializedFixedArray(int length) {
+Handle<FixedArray> Factory::NewUninitializedFixedArray(
+    int length, PretenureFlag pretenure) {
   DCHECK_LE(0, length);
   if (length == 0) return empty_fixed_array();
 
@@ -230,7 +246,7 @@ Handle<FixedArray> Factory::NewUninitializedFixedArray(int length) {
   // array. After getting canary/performance coverage, either remove the
   // function or revert to returning uninitilized array.
   CALL_HEAP_FUNCTION(isolate(),
-                     isolate()->heap()->AllocateFixedArray(length, NOT_TENURED),
+                     isolate()->heap()->AllocateFixedArray(length, pretenure),
                      FixedArray);
 }
 
@@ -260,13 +276,22 @@ Handle<BoilerplateDescription> Factory::NewBoilerplateDescription(
     size++;
   }
 
+  if (size == 0) {
+    return isolate()->factory()->empty_boilerplate_description();
+  }
+
+  /* Handle<FixedArray> array = NewFixedArray(size, TENURED); */
+  /* array->set_map_no_write_barrier(*boilerplate_description_map()); */
   Handle<BoilerplateDescription> description =
-      Handle<BoilerplateDescription>::cast(NewFixedArray(size, TENURED));
+      Handle<BoilerplateDescription>::cast(NewFixedArrayWithMap(
+          Heap::kBoilerplateDescriptionMapRootIndex, size, TENURED));
 
   if (has_different_size_backing_store) {
-    DCHECK((boilerplate != (all_properties - index_keys)) || has_seen_proto);
+    DCHECK_IMPLIES((boilerplate == (all_properties - index_keys)),
+                   has_seen_proto);
     description->set_backing_store_size(isolate(), backing_store_size);
   }
+
   return description;
 }
 
@@ -291,6 +316,13 @@ Handle<FixedArrayBase> Factory::NewFixedDoubleArrayWithHoles(
   return array;
 }
 
+Handle<FeedbackMetadata> Factory::NewFeedbackMetadata(int slot_count) {
+  DCHECK_LE(0, slot_count);
+  CALL_HEAP_FUNCTION(isolate(),
+                     isolate()->heap()->AllocateFeedbackMetadata(slot_count),
+                     FeedbackMetadata);
+}
+
 Handle<FrameArray> Factory::NewFrameArray(int number_of_frames,
                                           PretenureFlag pretenure) {
   DCHECK_LE(0, number_of_frames);
@@ -391,9 +423,9 @@ MaybeHandle<String> Factory::NewStringFromOneByte(Vector<const uint8_t> string,
 MaybeHandle<String> Factory::NewStringFromUtf8(Vector<const char> string,
                                                PretenureFlag pretenure) {
   // Check for ASCII first since this is the common case.
-  const char* start = string.start();
+  const char* ascii_data = string.start();
   int length = string.length();
-  int non_ascii_start = String::NonAsciiStart(start, length);
+  int non_ascii_start = String::NonAsciiStart(ascii_data, length);
   if (non_ascii_start >= length) {
     // If the string is ASCII, we do not need to convert the characters
     // since UTF8 is backwards compatible with ASCII.
@@ -401,35 +433,38 @@ MaybeHandle<String> Factory::NewStringFromUtf8(Vector<const char> string,
   }
 
   // Non-ASCII and we need to decode.
+  auto non_ascii = string.SubVector(non_ascii_start, length);
   Access<UnicodeCache::Utf8Decoder>
       decoder(isolate()->unicode_cache()->utf8_decoder());
-  decoder->Reset(string.start() + non_ascii_start,
-                 length - non_ascii_start);
+  decoder->Reset(non_ascii);
+
   int utf16_length = static_cast<int>(decoder->Utf16Length());
   DCHECK_GT(utf16_length, 0);
+
   // Allocate string.
   Handle<SeqTwoByteString> result;
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate(), result,
       NewRawTwoByteString(non_ascii_start + utf16_length, pretenure),
       String);
+
   // Copy ASCII portion.
   uint16_t* data = result->GetChars();
-  const char* ascii_data = string.start();
   for (int i = 0; i < non_ascii_start; i++) {
     *data++ = *ascii_data++;
   }
+
   // Now write the remainder.
-  decoder->WriteUtf16(data, utf16_length);
+  decoder->WriteUtf16(data, utf16_length, non_ascii);
   return result;
 }
 
 MaybeHandle<String> Factory::NewStringFromUtf8SubString(
     Handle<SeqOneByteString> str, int begin, int length,
     PretenureFlag pretenure) {
-  // Check for ASCII first since this is the common case.
-  const char* start = reinterpret_cast<const char*>(str->GetChars() + begin);
-  int non_ascii_start = String::NonAsciiStart(start, length);
+  const char* ascii_data =
+      reinterpret_cast<const char*>(str->GetChars() + begin);
+  int non_ascii_start = String::NonAsciiStart(ascii_data, length);
   if (non_ascii_start >= length) {
     // If the string is ASCII, we can just make a substring.
     // TODO(v8): the pretenure flag is ignored in this case.
@@ -437,28 +472,35 @@ MaybeHandle<String> Factory::NewStringFromUtf8SubString(
   }
 
   // Non-ASCII and we need to decode.
+  auto non_ascii = Vector<const char>(ascii_data + non_ascii_start,
+                                      length - non_ascii_start);
   Access<UnicodeCache::Utf8Decoder> decoder(
       isolate()->unicode_cache()->utf8_decoder());
-  decoder->Reset(start + non_ascii_start, length - non_ascii_start);
+  decoder->Reset(non_ascii);
+
   int utf16_length = static_cast<int>(decoder->Utf16Length());
   DCHECK_GT(utf16_length, 0);
+
   // Allocate string.
   Handle<SeqTwoByteString> result;
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate(), result,
       NewRawTwoByteString(non_ascii_start + utf16_length, pretenure), String);
 
-  // Reset the decoder, because the original {str} may have moved.
-  const char* ascii_data =
-      reinterpret_cast<const char*>(str->GetChars() + begin);
-  decoder->Reset(ascii_data + non_ascii_start, length - non_ascii_start);
+  // Update pointer references, since the original string may have moved after
+  // allocation.
+  ascii_data = reinterpret_cast<const char*>(str->GetChars() + begin);
+  non_ascii = Vector<const char>(ascii_data + non_ascii_start,
+                                 length - non_ascii_start);
+
   // Copy ASCII portion.
   uint16_t* data = result->GetChars();
   for (int i = 0; i < non_ascii_start; i++) {
     *data++ = *ascii_data++;
   }
+
   // Now write the remainder.
-  decoder->WriteUtf16(data, utf16_length);
+  decoder->WriteUtf16(data, utf16_length, non_ascii);
   return result;
 }
 
@@ -985,11 +1027,15 @@ Handle<Symbol> Factory::NewPrivateSymbol() {
   return symbol;
 }
 
+Handle<Symbol> Factory::NewPrivateFieldSymbol() {
+  Handle<Symbol> symbol = NewSymbol();
+  symbol->set_is_private_field();
+  return symbol;
+}
+
 Handle<Context> Factory::NewNativeContext() {
-  Handle<FixedArray> array =
-      NewFixedArray(Context::NATIVE_CONTEXT_SLOTS, TENURED);
-  array->set_map_no_write_barrier(*native_context_map());
-  Handle<Context> context = Handle<Context>::cast(array);
+  Handle<Context> context = NewFixedArrayWithMap<Context>(
+      Heap::kNativeContextMapRootIndex, Context::NATIVE_CONTEXT_SLOTS, TENURED);
   context->set_native_context(*context);
   context->set_errors_thrown(Smi::kZero);
   context->set_math_random_index(Smi::kZero);
@@ -1004,10 +1050,8 @@ Handle<Context> Factory::NewNativeContext() {
 Handle<Context> Factory::NewScriptContext(Handle<JSFunction> function,
                                           Handle<ScopeInfo> scope_info) {
   DCHECK_EQ(scope_info->scope_type(), SCRIPT_SCOPE);
-  Handle<FixedArray> array =
-      NewFixedArray(scope_info->ContextLength(), TENURED);
-  array->set_map_no_write_barrier(*script_context_map());
-  Handle<Context> context = Handle<Context>::cast(array);
+  Handle<Context> context = NewFixedArrayWithMap<Context>(
+      Heap::kScriptContextMapRootIndex, scope_info->ContextLength(), TENURED);
   context->set_closure(*function);
   context->set_previous(function->context());
   context->set_extension(*scope_info);
@@ -1018,10 +1062,10 @@ Handle<Context> Factory::NewScriptContext(Handle<JSFunction> function,
 
 
 Handle<ScriptContextTable> Factory::NewScriptContextTable() {
-  Handle<FixedArray> array = NewFixedArray(1);
-  array->set_map_no_write_barrier(*script_context_table_map());
   Handle<ScriptContextTable> context_table =
-      Handle<ScriptContextTable>::cast(array);
+      NewFixedArrayWithMap<ScriptContextTable>(
+          Heap::kScriptContextTableMapRootIndex,
+          ScriptContextTable::kMinLength);
   context_table->set_used(0);
   return context_table;
 }
@@ -1030,10 +1074,8 @@ Handle<Context> Factory::NewModuleContext(Handle<Module> module,
                                           Handle<JSFunction> function,
                                           Handle<ScopeInfo> scope_info) {
   DCHECK_EQ(scope_info->scope_type(), MODULE_SCOPE);
-  Handle<FixedArray> array =
-      NewFixedArray(scope_info->ContextLength(), TENURED);
-  array->set_map_no_write_barrier(*module_context_map());
-  Handle<Context> context = Handle<Context>::cast(array);
+  Handle<Context> context = NewFixedArrayWithMap<Context>(
+      Heap::kModuleContextMapRootIndex, scope_info->ContextLength(), TENURED);
   context->set_closure(*function);
   context->set_previous(function->context());
   context->set_extension(*module);
@@ -1047,20 +1089,18 @@ Handle<Context> Factory::NewFunctionContext(int length,
                                             ScopeType scope_type) {
   DCHECK(function->shared()->scope_info()->scope_type() == scope_type);
   DCHECK(length >= Context::MIN_CONTEXT_SLOTS);
-  Handle<FixedArray> array = NewFixedArray(length);
-  Handle<Map> map;
+  Heap::RootListIndex mapRootIndex;
   switch (scope_type) {
     case EVAL_SCOPE:
-      map = eval_context_map();
+      mapRootIndex = Heap::kEvalContextMapRootIndex;
       break;
     case FUNCTION_SCOPE:
-      map = function_context_map();
+      mapRootIndex = Heap::kFunctionContextMapRootIndex;
       break;
     default:
       UNREACHABLE();
   }
-  array->set_map_no_write_barrier(*map);
-  Handle<Context> context = Handle<Context>::cast(array);
+  Handle<Context> context = NewFixedArrayWithMap<Context>(mapRootIndex, length);
   context->set_closure(*function);
   context->set_previous(function->context());
   context->set_extension(*the_hole_value());
@@ -1075,9 +1115,8 @@ Handle<Context> Factory::NewCatchContext(Handle<JSFunction> function,
                                          Handle<Object> thrown_object) {
   STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == Context::THROWN_OBJECT_INDEX);
   Handle<ContextExtension> extension = NewContextExtension(scope_info, name);
-  Handle<FixedArray> array = NewFixedArray(Context::MIN_CONTEXT_SLOTS + 1);
-  array->set_map_no_write_barrier(*catch_context_map());
-  Handle<Context> context = Handle<Context>::cast(array);
+  Handle<Context> context = NewFixedArrayWithMap<Context>(
+      Heap::kCatchContextMapRootIndex, Context::MIN_CONTEXT_SLOTS + 1);
   context->set_closure(*function);
   context->set_previous(*previous);
   context->set_extension(*extension);
@@ -1096,9 +1135,8 @@ Handle<Context> Factory::NewDebugEvaluateContext(Handle<Context> previous,
   Handle<ContextExtension> context_extension = NewContextExtension(
       scope_info, extension.is_null() ? Handle<Object>::cast(undefined_value())
                                       : Handle<Object>::cast(extension));
-  Handle<FixedArray> array = NewFixedArray(Context::MIN_CONTEXT_SLOTS + 2);
-  array->set_map_no_write_barrier(*debug_evaluate_context_map());
-  Handle<Context> c = Handle<Context>::cast(array);
+  Handle<Context> c = NewFixedArrayWithMap<Context>(
+      Heap::kDebugEvaluateContextMapRootIndex, Context::MIN_CONTEXT_SLOTS + 2);
   c->set_closure(wrapped.is_null() ? previous->closure() : wrapped->closure());
   c->set_previous(*previous);
   c->set_native_context(previous->native_context());
@@ -1114,9 +1152,8 @@ Handle<Context> Factory::NewWithContext(Handle<JSFunction> function,
                                         Handle<JSReceiver> extension) {
   Handle<ContextExtension> context_extension =
       NewContextExtension(scope_info, extension);
-  Handle<FixedArray> array = NewFixedArray(Context::MIN_CONTEXT_SLOTS);
-  array->set_map_no_write_barrier(*with_context_map());
-  Handle<Context> context = Handle<Context>::cast(array);
+  Handle<Context> context = NewFixedArrayWithMap<Context>(
+      Heap::kWithContextMapRootIndex, Context::MIN_CONTEXT_SLOTS);
   context->set_closure(*function);
   context->set_previous(*previous);
   context->set_extension(*context_extension);
@@ -1129,9 +1166,8 @@ Handle<Context> Factory::NewBlockContext(Handle<JSFunction> function,
                                          Handle<Context> previous,
                                          Handle<ScopeInfo> scope_info) {
   DCHECK_EQ(scope_info->scope_type(), BLOCK_SCOPE);
-  Handle<FixedArray> array = NewFixedArray(scope_info->ContextLength());
-  array->set_map_no_write_barrier(*block_context_map());
-  Handle<Context> context = Handle<Context>::cast(array);
+  Handle<Context> context = NewFixedArrayWithMap<Context>(
+      Heap::kBlockContextMapRootIndex, scope_info->ContextLength());
   context->set_closure(*function);
   context->set_previous(*previous);
   context->set_extension(*scope_info);
@@ -1179,13 +1215,46 @@ Handle<Script> Factory::NewScript(Handle<String> source) {
   script->set_line_ends(heap->undefined_value());
   script->set_eval_from_shared_or_wrapped_arguments(heap->undefined_value());
   script->set_eval_from_position(0);
-  script->set_shared_function_infos(*empty_fixed_array(), SKIP_WRITE_BARRIER);
+  script->set_shared_function_infos(*empty_weak_fixed_array(),
+                                    SKIP_WRITE_BARRIER);
   script->set_flags(0);
   script->set_host_defined_options(*empty_fixed_array());
-  heap->set_script_list(*WeakFixedArray::Add(script_list(), script));
+  heap->set_script_list(*FixedArrayOfWeakCells::Add(script_list(), script));
   return script;
 }
 
+Handle<CallableTask> Factory::NewCallableTask(Handle<JSReceiver> callable,
+                                              Handle<Context> context) {
+  DCHECK(callable->IsCallable());
+  Handle<CallableTask> microtask =
+      Handle<CallableTask>::cast(NewStruct(CALLABLE_TASK_TYPE));
+  microtask->set_callable(*callable);
+  microtask->set_context(*context);
+  return microtask;
+}
+
+Handle<CallbackTask> Factory::NewCallbackTask(Handle<Foreign> callback,
+                                              Handle<Foreign> data) {
+  Handle<CallbackTask> microtask =
+      Handle<CallbackTask>::cast(NewStruct(CALLBACK_TASK_TYPE));
+  microtask->set_callback(*callback);
+  microtask->set_data(*data);
+  return microtask;
+}
+
+Handle<PromiseResolveThenableJobTask> Factory::NewPromiseResolveThenableJobTask(
+    Handle<JSPromise> promise_to_resolve, Handle<JSReceiver> then,
+    Handle<JSReceiver> thenable, Handle<Context> context) {
+  DCHECK(then->IsCallable());
+  Handle<PromiseResolveThenableJobTask> microtask =
+      Handle<PromiseResolveThenableJobTask>::cast(
+          NewStruct(PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE));
+  microtask->set_promise_to_resolve(*promise_to_resolve);
+  microtask->set_then(*then);
+  microtask->set_thenable(*thenable);
+  microtask->set_context(*context);
+  return microtask;
+}
 
 Handle<Foreign> Factory::NewForeign(Address addr, PretenureFlag pretenure) {
   CALL_HEAP_FUNCTION(isolate(),
@@ -1194,11 +1263,6 @@ Handle<Foreign> Factory::NewForeign(Address addr, PretenureFlag pretenure) {
 }
 
 
-Handle<Foreign> Factory::NewForeign(const AccessorDescriptor* desc) {
-  return NewForeign((Address) desc, TENURED);
-}
-
-
 Handle<ByteArray> Factory::NewByteArray(int length, PretenureFlag pretenure) {
   DCHECK_LE(0, length);
   CALL_HEAP_FUNCTION(
@@ -1247,22 +1311,28 @@ Handle<Cell> Factory::NewCell(Handle<Object> value) {
       Cell);
 }
 
-Handle<Cell> Factory::NewNoClosuresCell(Handle<Object> value) {
-  Handle<Cell> cell = NewCell(value);
-  cell->set_map_no_write_barrier(*no_closures_cell_map());
-  return cell;
+Handle<FeedbackCell> Factory::NewNoClosuresCell(Handle<HeapObject> value) {
+  AllowDeferredHandleDereference convert_to_cell;
+  CALL_HEAP_FUNCTION(isolate(),
+                     isolate()->heap()->AllocateFeedbackCell(
+                         isolate()->heap()->no_closures_cell_map(), *value),
+                     FeedbackCell);
 }
 
-Handle<Cell> Factory::NewOneClosureCell(Handle<Object> value) {
-  Handle<Cell> cell = NewCell(value);
-  cell->set_map_no_write_barrier(*one_closure_cell_map());
-  return cell;
+Handle<FeedbackCell> Factory::NewOneClosureCell(Handle<HeapObject> value) {
+  AllowDeferredHandleDereference convert_to_cell;
+  CALL_HEAP_FUNCTION(isolate(),
+                     isolate()->heap()->AllocateFeedbackCell(
+                         isolate()->heap()->one_closure_cell_map(), *value),
+                     FeedbackCell);
 }
 
-Handle<Cell> Factory::NewManyClosuresCell(Handle<Object> value) {
-  Handle<Cell> cell = NewCell(value);
-  cell->set_map_no_write_barrier(*many_closures_cell_map());
-  return cell;
+Handle<FeedbackCell> Factory::NewManyClosuresCell(Handle<HeapObject> value) {
+  AllowDeferredHandleDereference convert_to_cell;
+  CALL_HEAP_FUNCTION(isolate(),
+                     isolate()->heap()->AllocateFeedbackCell(
+                         isolate()->heap()->many_closures_cell_map(), *value),
+                     FeedbackCell);
 }
 
 Handle<PropertyCell> Factory::NewPropertyCell(Handle<Name> name) {
@@ -1423,8 +1493,10 @@ Handle<HeapNumber> Factory::NewHeapNumber(MutableMode mode,
                      HeapNumber);
 }
 
-Handle<FreshlyAllocatedBigInt> Factory::NewBigInt(int length) {
-  CALL_HEAP_FUNCTION(isolate(), isolate()->heap()->AllocateBigInt(length),
+Handle<FreshlyAllocatedBigInt> Factory::NewBigInt(int length,
+                                                  PretenureFlag pretenure) {
+  CALL_HEAP_FUNCTION(isolate(),
+                     isolate()->heap()->AllocateBigInt(length, pretenure),
                      FreshlyAllocatedBigInt);
 }
 
@@ -1517,9 +1589,9 @@ Handle<JSFunction> Factory::NewFunction(Handle<Map> map,
   function->initialize_properties();
   function->initialize_elements();
   function->set_shared(*info);
-  function->set_code(info->code());
+  function->set_code(info->GetCode());
   function->set_context(*context_or_undefined);
-  function->set_feedback_vector_cell(*undefined_cell());
+  function->set_feedback_cell(*many_closures_cell());
   int header_size;
   if (map->has_prototype_slot()) {
     header_size = JSFunction::kSizeWithPrototype;
@@ -1545,9 +1617,8 @@ Handle<JSFunction> Factory::NewFunction(const NewFunctionArgs& args) {
   // Create the SharedFunctionInfo.
   Handle<Context> context(isolate()->native_context());
   Handle<Map> map = args.GetMap(isolate());
-  Handle<SharedFunctionInfo> info =
-      NewSharedFunctionInfo(args.name_, args.maybe_code_, map->is_constructor(),
-                            kNormalFunction, args.maybe_builtin_id_);
+  Handle<SharedFunctionInfo> info = NewSharedFunctionInfo(
+      args.name_, args.maybe_code_, args.maybe_builtin_id_, kNormalFunction);
 
   // Proper language mode in shared function info will be set later.
   DCHECK(is_sloppy(info->language_mode()));
@@ -1556,7 +1627,6 @@ Handle<JSFunction> Factory::NewFunction(const NewFunctionArgs& args) {
 #ifdef DEBUG
   if (isolate()->bootstrapper()->IsActive()) {
     Handle<Code> code;
-    bool has_code = args.maybe_code_.ToHandle(&code);
     DCHECK(
         // During bootstrapping some of these maps could be not created yet.
         (*map == context->get(Context::STRICT_FUNCTION_MAP_INDEX)) ||
@@ -1567,8 +1637,8 @@ Handle<JSFunction> Factory::NewFunction(const NewFunctionArgs& args) {
              Context::STRICT_FUNCTION_WITH_READONLY_PROTOTYPE_MAP_INDEX)) ||
         // Check if it's a creation of an empty or Proxy function during
         // bootstrapping.
-        (has_code && (code->builtin_index() == Builtins::kEmptyFunction ||
-                      code->builtin_index() == Builtins::kProxyConstructor)));
+        (args.maybe_builtin_id_ == Builtins::kEmptyFunction ||
+         args.maybe_builtin_id_ == Builtins::kProxyConstructor));
   } else {
     DCHECK(
         (*map == *isolate()->sloppy_function_map()) ||
@@ -1664,11 +1734,11 @@ Handle<JSFunction> Factory::NewFunctionFromSharedFunctionInfo(
 
 Handle<JSFunction> Factory::NewFunctionFromSharedFunctionInfo(
     Handle<SharedFunctionInfo> info, Handle<Context> context,
-    Handle<Cell> vector, PretenureFlag pretenure) {
+    Handle<FeedbackCell> feedback_cell, PretenureFlag pretenure) {
   Handle<Map> initial_map(
       Map::cast(context->native_context()->get(info->function_map_index())));
-  return NewFunctionFromSharedFunctionInfo(initial_map, info, context, vector,
-                                           pretenure);
+  return NewFunctionFromSharedFunctionInfo(initial_map, info, context,
+                                           feedback_cell, pretenure);
 }
 
 Handle<JSFunction> Factory::NewFunctionFromSharedFunctionInfo(
@@ -1688,29 +1758,29 @@ Handle<JSFunction> Factory::NewFunctionFromSharedFunctionInfo(
 
 Handle<JSFunction> Factory::NewFunctionFromSharedFunctionInfo(
     Handle<Map> initial_map, Handle<SharedFunctionInfo> info,
-    Handle<Object> context_or_undefined, Handle<Cell> vector,
+    Handle<Object> context_or_undefined, Handle<FeedbackCell> feedback_cell,
     PretenureFlag pretenure) {
   DCHECK_EQ(JS_FUNCTION_TYPE, initial_map->instance_type());
   Handle<JSFunction> result =
       NewFunction(initial_map, info, context_or_undefined, pretenure);
 
-  // Bump the closure count that is encoded in the vector cell's map.
-  if (vector->map() == *no_closures_cell_map()) {
-    vector->set_map(*one_closure_cell_map());
-  } else if (vector->map() == *one_closure_cell_map()) {
-    vector->set_map(*many_closures_cell_map());
+  // Bump the closure count that is encoded in the feedback cell's map.
+  if (feedback_cell->map() == *no_closures_cell_map()) {
+    feedback_cell->set_map(*one_closure_cell_map());
+  } else if (feedback_cell->map() == *one_closure_cell_map()) {
+    feedback_cell->set_map(*many_closures_cell_map());
   } else {
-    DCHECK_EQ(vector->map(), *many_closures_cell_map());
+    DCHECK_EQ(feedback_cell->map(), *many_closures_cell_map());
   }
 
-  // Check that the optimized code in the feedback vector wasn't marked for
+  // Check that the optimized code in the feedback cell wasn't marked for
   // deoptimization while not pointed to by any live JSFunction.
-  if (vector->value()->IsFeedbackVector()) {
-    FeedbackVector::cast(vector->value())
+  if (feedback_cell->value()->IsFeedbackVector()) {
+    FeedbackVector::cast(feedback_cell->value())
         ->EvictOptimizedCodeMarkedForDeoptimization(
             *info, "new function from shared function info");
   }
-  result->set_feedback_vector_cell(*vector);
+  result->set_feedback_cell(*feedback_cell);
 
   if (context_or_undefined->IsContext()) {
     // Give compiler a chance to pre-initialize.
@@ -1721,16 +1791,13 @@ Handle<JSFunction> Factory::NewFunctionFromSharedFunctionInfo(
 }
 
 Handle<ScopeInfo> Factory::NewScopeInfo(int length) {
-  Handle<FixedArray> array = NewFixedArray(length, TENURED);
-  array->set_map_no_write_barrier(*scope_info_map());
-  Handle<ScopeInfo> scope_info = Handle<ScopeInfo>::cast(array);
-  return scope_info;
+  return NewFixedArrayWithMap<ScopeInfo>(Heap::kScopeInfoMapRootIndex, length,
+                                         TENURED);
 }
 
 Handle<ModuleInfo> Factory::NewModuleInfo() {
-  Handle<FixedArray> array = NewFixedArray(ModuleInfo::kLength, TENURED);
-  array->set_map_no_write_barrier(*module_info_map());
-  return Handle<ModuleInfo>::cast(array);
+  return NewFixedArrayWithMap<ModuleInfo>(Heap::kModuleInfoMapRootIndex,
+                                          ModuleInfo::kLength, TENURED);
 }
 
 Handle<PreParsedScopeData> Factory::NewPreParsedScopeData() {
@@ -1759,17 +1826,13 @@ Handle<CodeDataContainer> Factory::NewCodeDataContainer(int flags) {
 
 Handle<Code> Factory::NewCode(
     const CodeDesc& desc, Code::Kind kind, Handle<Object> self_ref,
-    int32_t builtin_index, MaybeHandle<HandlerTable> maybe_handler_table,
-    MaybeHandle<ByteArray> maybe_source_position_table,
+    int32_t builtin_index, MaybeHandle<ByteArray> maybe_source_position_table,
     MaybeHandle<DeoptimizationData> maybe_deopt_data, Movability movability,
     uint32_t stub_key, bool is_turbofanned, int stack_slots,
-    int safepoint_table_offset) {
+    int safepoint_table_offset, int handler_table_offset) {
   Handle<ByteArray> reloc_info = NewByteArray(desc.reloc_size, TENURED);
   Handle<CodeDataContainer> data_container = NewCodeDataContainer(0);
 
-  Handle<HandlerTable> handler_table =
-      maybe_handler_table.is_null() ? HandlerTable::Empty(isolate())
-                                    : maybe_handler_table.ToHandleChecked();
   Handle<ByteArray> source_position_table =
       maybe_source_position_table.is_null()
           ? empty_byte_array()
@@ -1778,13 +1841,13 @@ Handle<Code> Factory::NewCode(
       maybe_deopt_data.is_null() ? DeoptimizationData::Empty(isolate())
                                  : maybe_deopt_data.ToHandleChecked();
 
-  CALL_HEAP_FUNCTION(
-      isolate(),
-      isolate()->heap()->AllocateCode(
-          desc, kind, self_ref, builtin_index, *reloc_info, *data_container,
-          *handler_table, *source_position_table, *deopt_data, movability,
-          stub_key, is_turbofanned, stack_slots, safepoint_table_offset),
-      Code);
+  CALL_HEAP_FUNCTION(isolate(),
+                     isolate()->heap()->AllocateCode(
+                         desc, kind, self_ref, builtin_index, *reloc_info,
+                         *data_container, *source_position_table, *deopt_data,
+                         movability, stub_key, is_turbofanned, stack_slots,
+                         safepoint_table_offset, handler_table_offset),
+                     Code);
 }
 
 Handle<Code> Factory::NewCodeForDeserialization(uint32_t size) {
@@ -1792,6 +1855,37 @@ Handle<Code> Factory::NewCodeForDeserialization(uint32_t size) {
                      Code);
 }
 
+#ifdef V8_EMBEDDED_BUILTINS
+Handle<Code> Factory::NewOffHeapTrampolineFor(Handle<Code> code,
+                                              Address off_heap_entry) {
+  DCHECK(isolate()->serializer_enabled());
+  DCHECK_NOT_NULL(isolate()->embedded_blob());
+  DCHECK_NE(0, isolate()->embedded_blob_size());
+  DCHECK(Builtins::IsOffHeapBuiltin(*code));
+
+  Handle<Code> result =
+      Builtins::GenerateOffHeapTrampolineFor(isolate(), off_heap_entry);
+
+  // The trampoline code object must inherit specific flags from the original
+  // builtin (e.g. the safepoint-table offset). We set them manually here.
+
+  const int stack_slots = code->has_safepoint_info() ? code->stack_slots() : 0;
+  result->initialize_flags(code->kind(), code->has_unwinding_info(),
+                           code->is_turbofanned(), stack_slots);
+  result->set_builtin_index(code->builtin_index());
+  result->set_has_tagged_params(code->has_tagged_params());
+  result->set_handler_table_offset(code->handler_table_offset());
+  result->code_data_container()->set_kind_specific_flags(
+      code->code_data_container()->kind_specific_flags());
+  result->set_constant_pool_offset(code->constant_pool_offset());
+  if (code->has_safepoint_info()) {
+    result->set_safepoint_table_offset(code->safepoint_table_offset());
+  }
+
+  return result;
+}
+#endif
+
 Handle<Code> Factory::CopyCode(Handle<Code> code) {
   Handle<CodeDataContainer> data_container =
       NewCodeDataContainer(code->code_data_container()->kind_specific_flags());
@@ -2079,12 +2173,13 @@ Handle<JSIteratorResult> Factory::NewJSIteratorResult(Handle<Object> value,
 }
 
 Handle<JSAsyncFromSyncIterator> Factory::NewJSAsyncFromSyncIterator(
-    Handle<JSReceiver> sync_iterator) {
+    Handle<JSReceiver> sync_iterator, Handle<Object> next) {
   Handle<Map> map(isolate()->native_context()->async_from_sync_iterator_map());
   Handle<JSAsyncFromSyncIterator> iterator =
       Handle<JSAsyncFromSyncIterator>::cast(NewJSObjectFromMap(map));
 
   iterator->set_sync_iterator(*sync_iterator);
+  iterator->set_next(*next);
   return iterator;
 }
 
@@ -2450,29 +2545,14 @@ void Factory::ReinitializeJSGlobalProxy(Handle<JSGlobalProxy> object,
   heap->InitializeJSObjectFromMap(*object, *raw_properties_or_hash, *map);
 }
 
-Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfo(
-    MaybeHandle<String> name, FunctionKind kind, Handle<Code> code,
-    Handle<ScopeInfo> scope_info) {
-  DCHECK(IsValidFunctionKind(kind));
-  Handle<SharedFunctionInfo> shared =
-      NewSharedFunctionInfo(name, code, IsConstructable(kind), kind);
-  shared->set_scope_info(*scope_info);
-  shared->set_outer_scope_info(*the_hole_value());
-  if (IsGeneratorFunction(kind)) {
-    shared->set_instance_class_name(isolate()->heap()->Generator_string());
-  }
-  return shared;
-}
-
 Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfoForLiteral(
     FunctionLiteral* literal, Handle<Script> script) {
-  Handle<Code> code = BUILTIN_CODE(isolate(), CompileLazy);
-  Handle<ScopeInfo> scope_info(ScopeInfo::Empty(isolate()));
-  Handle<SharedFunctionInfo> result =
-      NewSharedFunctionInfo(literal->name(), literal->kind(), code, scope_info);
-  SharedFunctionInfo::InitFromFunctionLiteral(result, literal);
-  SharedFunctionInfo::SetScript(result, script, false);
-  return result;
+  FunctionKind kind = literal->kind();
+  Handle<SharedFunctionInfo> shared = NewSharedFunctionInfoForBuiltin(
+      literal->name(), Builtins::kCompileLazy, kind);
+  SharedFunctionInfo::InitFromFunctionLiteral(shared, literal);
+  SharedFunctionInfo::SetScript(shared, script, false);
+  return shared;
 }
 
 Handle<JSMessageObject> Factory::NewJSMessageObject(
@@ -2495,9 +2575,22 @@ Handle<JSMessageObject> Factory::NewJSMessageObject(
   return message_obj;
 }
 
+Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfoForApiFunction(
+    MaybeHandle<String> maybe_name,
+    Handle<FunctionTemplateInfo> function_template_info, FunctionKind kind) {
+  return NewSharedFunctionInfo(maybe_name, function_template_info,
+                               Builtins::kNoBuiltinId, kind);
+}
+
+Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfoForBuiltin(
+    MaybeHandle<String> maybe_name, int builtin_index, FunctionKind kind) {
+  return NewSharedFunctionInfo(maybe_name, MaybeHandle<Code>(), builtin_index,
+                               kind);
+}
+
 Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfo(
-    MaybeHandle<String> maybe_name, MaybeHandle<Code> maybe_code,
-    bool is_constructor, FunctionKind kind, int maybe_builtin_index) {
+    MaybeHandle<String> maybe_name, MaybeHandle<HeapObject> maybe_function_data,
+    int maybe_builtin_index, FunctionKind kind) {
   // Function names are assumed to be flat elsewhere. Must flatten before
   // allocating SharedFunctionInfo to avoid GC seeing the uninitialized SFI.
   Handle<String> shared_name;
@@ -2508,59 +2601,58 @@ Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfo(
 
   Handle<Map> map = shared_function_info_map();
   Handle<SharedFunctionInfo> share = New<SharedFunctionInfo>(map, OLD_SPACE);
-
-  // Set pointer fields.
-  share->set_raw_name(has_shared_name
-                          ? *shared_name
-                          : SharedFunctionInfo::kNoSharedNameSentinel);
-  Handle<Code> code;
-  if (!maybe_code.ToHandle(&code)) {
-    code = BUILTIN_CODE(isolate(), Illegal);
-  }
-  Object* function_data = (Builtins::IsBuiltinId(maybe_builtin_index) &&
-                           Builtins::IsLazy(maybe_builtin_index))
-                              ? Smi::FromInt(maybe_builtin_index)
-                              : Object::cast(*undefined_value());
-  share->set_function_data(function_data, SKIP_WRITE_BARRIER);
-  share->set_code(*code);
-  share->set_scope_info(ScopeInfo::Empty(isolate()));
-  share->set_outer_scope_info(*the_hole_value());
-  DCHECK(!Builtins::IsLazy(Builtins::kConstructedNonConstructable));
-  Handle<Code> construct_stub =
-      is_constructor ? isolate()->builtins()->JSConstructStubGeneric()
-                     : BUILTIN_CODE(isolate(), ConstructedNonConstructable);
-  share->SetConstructStub(*construct_stub);
-  share->set_instance_class_name(*Object_string());
-  share->set_script(*undefined_value(), SKIP_WRITE_BARRIER);
-  share->set_debug_info(Smi::kZero, SKIP_WRITE_BARRIER);
-  share->set_function_identifier(*undefined_value(), SKIP_WRITE_BARRIER);
-  StaticFeedbackVectorSpec empty_spec;
-  Handle<FeedbackMetadata> feedback_metadata =
-      FeedbackMetadata::New(isolate(), &empty_spec);
-  share->set_feedback_metadata(*feedback_metadata, SKIP_WRITE_BARRIER);
-  share->set_function_literal_id(FunctionLiteral::kIdTypeInvalid);
+  {
+    DisallowHeapAllocation no_allocation;
+
+    // Set pointer fields.
+    share->set_name_or_scope_info(
+        has_shared_name ? *shared_name
+                        : SharedFunctionInfo::kNoSharedNameSentinel);
+    Handle<HeapObject> function_data;
+    if (maybe_function_data.ToHandle(&function_data)) {
+      // If we pass function_data then we shouldn't pass a builtin index, and
+      // the function_data should not be code with a builtin.
+      DCHECK(!Builtins::IsBuiltinId(maybe_builtin_index));
+      DCHECK_IMPLIES(function_data->IsCode(),
+                     !Code::cast(*function_data)->is_builtin());
+      share->set_function_data(*function_data);
+    } else if (Builtins::IsBuiltinId(maybe_builtin_index)) {
+      DCHECK_NE(maybe_builtin_index, Builtins::kDeserializeLazy);
+      share->set_builtin_id(maybe_builtin_index);
+    } else {
+      share->set_builtin_id(Builtins::kIllegal);
+    }
+    share->set_outer_scope_info(*the_hole_value());
+    share->SetConstructStub(*isolate()->builtins()->JSConstructStubGeneric());
+    share->set_script(*undefined_value(), SKIP_WRITE_BARRIER);
+    share->set_debug_info(Smi::kZero, SKIP_WRITE_BARRIER);
+    share->set_function_identifier(*undefined_value(), SKIP_WRITE_BARRIER);
+    share->set_feedback_metadata(isolate()->heap()->empty_feedback_metadata(),
+                                 SKIP_WRITE_BARRIER);
+    share->set_function_literal_id(FunctionLiteral::kIdTypeInvalid);
 #if V8_SFI_HAS_UNIQUE_ID
-  share->set_unique_id(isolate()->GetNextUniqueSharedFunctionInfoId());
+    share->set_unique_id(isolate()->GetNextUniqueSharedFunctionInfoId());
 #endif
 
-  // Set integer fields (smi or int, depending on the architecture).
-  share->set_length(0);
-  share->set_internal_formal_parameter_count(0);
-  share->set_expected_nof_properties(0);
-  share->set_start_position_and_type(0);
-  share->set_end_position(0);
-  share->set_function_token_position(0);
-  // All compiler hints default to false or 0.
-  share->set_compiler_hints(0);
-  share->set_kind(kind);
-
-  share->clear_padding();
+    // Set integer fields (smi or int, depending on the architecture).
+    share->set_length(0);
+    share->set_internal_formal_parameter_count(0);
+    share->set_expected_nof_properties(0);
+    share->set_raw_start_position_and_type(0);
+    share->set_raw_end_position(0);
+    share->set_function_token_position(0);
+    // All flags default to false or 0.
+    share->set_flags(0);
+    share->set_kind(kind);
 
+    share->clear_padding();
+  }
   // Link into the list.
   Handle<Object> new_noscript_list =
-      WeakFixedArray::Add(noscript_shared_function_infos(), share);
+      FixedArrayOfWeakCells::Add(noscript_shared_function_infos(), share);
   isolate()->heap()->set_noscript_shared_function_infos(*new_noscript_list);
 
+  DCHECK_EQ(SharedFunctionInfo::kNoDebuggingId, share->debugging_id());
 #ifdef VERIFY_HEAP
   share->SharedFunctionInfoVerify();
 #endif
@@ -2673,7 +2765,7 @@ Handle<BreakPointInfo> Factory::NewBreakPointInfo(int source_position) {
   Handle<BreakPointInfo> new_break_point_info =
       Handle<BreakPointInfo>::cast(NewStruct(TUPLE2_TYPE, TENURED));
   new_break_point_info->set_source_position(source_position);
-  new_break_point_info->set_break_point_objects(*undefined_value());
+  new_break_point_info->set_break_points(*undefined_value());
   return new_break_point_info;
 }
 
@@ -2701,7 +2793,7 @@ Handle<StackFrameInfo> Factory::NewStackFrameInfo() {
 Handle<SourcePositionTableWithFrameCache>
 Factory::NewSourcePositionTableWithFrameCache(
     Handle<ByteArray> source_position_table,
-    Handle<NumberDictionary> stack_frame_cache) {
+    Handle<SimpleNumberDictionary> stack_frame_cache) {
   Handle<SourcePositionTableWithFrameCache>
       source_position_table_with_frame_cache =
           Handle<SourcePositionTableWithFrameCache>::cast(
@@ -3084,6 +3176,19 @@ Handle<Map> Factory::CreateClassFunctionMap(Handle<JSFunction> empty_function) {
   return map;
 }
 
+Handle<JSPromise> Factory::NewJSPromiseWithoutHook(PretenureFlag pretenure) {
+  CALL_HEAP_FUNCTION(isolate(),
+                     isolate()->heap()->AllocateJSPromise(
+                         *isolate()->promise_function(), pretenure),
+                     JSPromise);
+}
+
+Handle<JSPromise> Factory::NewJSPromise(PretenureFlag pretenure) {
+  Handle<JSPromise> promise = NewJSPromiseWithoutHook(pretenure);
+  isolate()->RunPromiseHook(PromiseHookType::kInit, promise, undefined_value());
+  return promise;
+}
+
 // static
 NewFunctionArgs NewFunctionArgs::ForWasm(Handle<String> name, Handle<Code> code,
                                          Handle<Map> map) {
@@ -3099,14 +3204,12 @@ NewFunctionArgs NewFunctionArgs::ForWasm(Handle<String> name, Handle<Code> code,
 
 // static
 NewFunctionArgs NewFunctionArgs::ForBuiltin(Handle<String> name,
-                                            Handle<Code> code, Handle<Map> map,
-                                            int builtin_id) {
+                                            Handle<Map> map, int builtin_id) {
   DCHECK(Builtins::IsBuiltinId(builtin_id));
 
   NewFunctionArgs args;
   args.name_ = name;
   args.maybe_map_ = map;
-  args.maybe_code_ = code;
   args.maybe_builtin_id_ = builtin_id;
   args.language_mode_ = LanguageMode::kStrict;
   args.prototype_mutability_ = MUTABLE;
@@ -3122,6 +3225,7 @@ NewFunctionArgs NewFunctionArgs::ForFunctionWithoutCode(
   NewFunctionArgs args;
   args.name_ = name;
   args.maybe_map_ = map;
+  args.maybe_builtin_id_ = Builtins::kIllegal;
   args.language_mode_ = language_mode;
   args.prototype_mutability_ = MUTABLE;
 
@@ -3132,14 +3236,13 @@ NewFunctionArgs NewFunctionArgs::ForFunctionWithoutCode(
 
 // static
 NewFunctionArgs NewFunctionArgs::ForBuiltinWithPrototype(
-    Handle<String> name, Handle<Code> code, Handle<Object> prototype,
-    InstanceType type, int instance_size, int inobject_properties,
-    int builtin_id, MutableMode prototype_mutability) {
+    Handle<String> name, Handle<Object> prototype, InstanceType type,
+    int instance_size, int inobject_properties, int builtin_id,
+    MutableMode prototype_mutability) {
   DCHECK(Builtins::IsBuiltinId(builtin_id));
 
   NewFunctionArgs args;
   args.name_ = name;
-  args.maybe_code_ = code;
   args.type_ = type;
   args.instance_size_ = instance_size;
   args.inobject_properties_ = inobject_properties;
@@ -3157,13 +3260,11 @@ NewFunctionArgs NewFunctionArgs::ForBuiltinWithPrototype(
 
 // static
 NewFunctionArgs NewFunctionArgs::ForBuiltinWithoutPrototype(
-    Handle<String> name, Handle<Code> code, int builtin_id,
-    LanguageMode language_mode) {
+    Handle<String> name, int builtin_id, LanguageMode language_mode) {
   DCHECK(Builtins::IsBuiltinId(builtin_id));
 
   NewFunctionArgs args;
   args.name_ = name;
-  args.maybe_code_ = code;
   args.maybe_builtin_id_ = builtin_id;
   args.language_mode_ = language_mode;
   args.prototype_mutability_ = MUTABLE;
@@ -3215,5 +3316,8 @@ Handle<Map> NewFunctionArgs::GetMap(Isolate* isolate) const {
   UNREACHABLE();
 }
 
+#undef RETURN_OBJECT_UNLESS_RETRY
+#undef CALL_HEAP_FUNCTION
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/factory.h b/deps/v8/src/factory.h
index f0e9d638856..2a709f29428 100644
--- a/deps/v8/src/factory.h
+++ b/deps/v8/src/factory.h
@@ -5,42 +5,52 @@
 #ifndef V8_FACTORY_H_
 #define V8_FACTORY_H_
 
-#include "src/feedback-vector.h"
+#include "src/builtins/builtins.h"
 #include "src/globals.h"
-#include "src/ic/handler-configuration.h"
-#include "src/isolate.h"
+#include "src/handles.h"
+#include "src/heap/heap.h"
 #include "src/messages.h"
-#include "src/objects/data-handler.h"
-#include "src/objects/descriptor-array.h"
+#include "src/objects/code.h"
 #include "src/objects/dictionary.h"
+#include "src/objects/hash-table.h"
 #include "src/objects/js-array.h"
 #include "src/objects/js-regexp.h"
-#include "src/objects/scope-info.h"
 #include "src/objects/string.h"
-#include "src/string-hasher.h"
 
 namespace v8 {
 namespace internal {
 
 // Forward declarations.
 class AliasedArgumentsEntry;
-class BreakPointInfo;
-class BreakPoint;
 class BoilerplateDescription;
+class BreakPoint;
+class BreakPointInfo;
+class CallableTask;
+class CallbackTask;
 class ConstantElementsPair;
 class CoverageInfo;
 class DebugInfo;
+class EnumCache;
 class FreshlyAllocatedBigInt;
+class Isolate;
 class JSMap;
 class JSMapIterator;
 class JSModuleNamespace;
 class JSSet;
 class JSSetIterator;
 class JSWeakMap;
+class LoadHandler;
+class ModuleInfo;
 class NewFunctionArgs;
-struct SourceRange;
 class PreParsedScopeData;
+class PromiseResolveThenableJobTask;
+class RegExpMatchInfo;
+class ScriptContextTable;
+class StoreHandler;
 class TemplateObjectDescription;
+struct SourceRange;
+template <typename T>
+class ZoneVector;
 
 enum FunctionMode {
   kWithNameBit = 1 << 0,
@@ -79,12 +89,19 @@ class V8_EXPORT_PRIVATE Factory final {
 
   // Allocates a fixed array-like object with given map and initialized with
   // undefined values.
-  Handle<FixedArray> NewFixedArrayWithMap(Heap::RootListIndex map_root_index,
-                                          int length, PretenureFlag pretenure);
+  template <typename T = FixedArray>
+  Handle<T> NewFixedArrayWithMap(Heap::RootListIndex map_root_index, int length,
+                                 PretenureFlag pretenure = NOT_TENURED);
 
   // Allocates a fixed array initialized with undefined values.
   Handle<FixedArray> NewFixedArray(int length,
                                    PretenureFlag pretenure = NOT_TENURED);
+
+  // Allocates a fixed array which may contain in-place weak references. The
+  // array is initialized with undefined values
+  Handle<WeakFixedArray> NewWeakFixedArray(
+      int length, PretenureFlag pretenure = NOT_TENURED);
+
   Handle<PropertyArray> NewPropertyArray(int length,
                                          PretenureFlag pretenure = NOT_TENURED);
   // Tries allocating a fixed array initialized with undefined values.
@@ -101,7 +118,8 @@ class V8_EXPORT_PRIVATE Factory final {
       int length, PretenureFlag pretenure = NOT_TENURED);
 
   // Allocates an uninitialized fixed array. It must be filled by the caller.
-  Handle<FixedArray> NewUninitializedFixedArray(int length);
+  Handle<FixedArray> NewUninitializedFixedArray(
+      int length, PretenureFlag pretenure = NOT_TENURED);
 
   // Allocates a feedback vector whose slots are initialized with undefined
   // values.
@@ -127,6 +145,8 @@ class V8_EXPORT_PRIVATE Factory final {
       int size,
       PretenureFlag pretenure = NOT_TENURED);
 
+  Handle<FeedbackMetadata> NewFeedbackMetadata(int slot_count);
+
   Handle<FrameArray> NewFrameArray(int number_of_frames,
                                    PretenureFlag pretenure = NOT_TENURED);
 
@@ -165,8 +185,7 @@ class V8_EXPORT_PRIVATE Factory final {
 
   // Create a new TemplateObjectDescription struct.
   Handle<TemplateObjectDescription> NewTemplateObjectDescription(
-      int hash, Handle<FixedArray> raw_strings,
-      Handle<FixedArray> cooked_strings);
+      Handle<FixedArray> raw_strings, Handle<FixedArray> cooked_strings);
 
   // Create a pre-tenured empty AccessorPair.
   Handle<AccessorPair> NewAccessorPair();
@@ -326,6 +345,7 @@ class V8_EXPORT_PRIVATE Factory final {
   // Create a symbol.
   Handle<Symbol> NewSymbol();
   Handle<Symbol> NewPrivateSymbol();
+  Handle<Symbol> NewPrivateFieldSymbol();
 
   // Create a global (but otherwise uninitialized) context.
   Handle<Context> NewNativeContext();
@@ -386,16 +406,21 @@ class V8_EXPORT_PRIVATE Factory final {
   Handle<SourcePositionTableWithFrameCache>
   NewSourcePositionTableWithFrameCache(
       Handle<ByteArray> source_position_table,
-      Handle<NumberDictionary> stack_frame_cache);
+      Handle<SimpleNumberDictionary> stack_frame_cache);
+
+  // Allocate various microtasks.
+  Handle<CallableTask> NewCallableTask(Handle<JSReceiver> callable,
+                                       Handle<Context> context);
+  Handle<CallbackTask> NewCallbackTask(Handle<Foreign> callback,
+                                       Handle<Foreign> data);
+  Handle<PromiseResolveThenableJobTask> NewPromiseResolveThenableJobTask(
+      Handle<JSPromise> promise_to_resolve, Handle<JSReceiver> then,
+      Handle<JSReceiver> thenable, Handle<Context> context);
 
   // Foreign objects are pretenured when allocated by the bootstrapper.
   Handle<Foreign> NewForeign(Address addr,
                              PretenureFlag pretenure = NOT_TENURED);
 
-  // Allocate a new foreign object.  The foreign is pretenured (allocated
-  // directly in the old generation).
-  Handle<Foreign> NewForeign(const AccessorDescriptor* foreign);
-
   Handle<ByteArray> NewByteArray(int length,
                                  PretenureFlag pretenure = NOT_TENURED);
 
@@ -417,9 +442,9 @@ class V8_EXPORT_PRIVATE Factory final {
 
   Handle<WeakCell> NewWeakCell(Handle<HeapObject> value);
 
-  Handle<Cell> NewNoClosuresCell(Handle<Object> value);
-  Handle<Cell> NewOneClosureCell(Handle<Object> value);
-  Handle<Cell> NewManyClosuresCell(Handle<Object> value);
+  Handle<FeedbackCell> NewNoClosuresCell(Handle<HeapObject> value);
+  Handle<FeedbackCell> NewOneClosureCell(Handle<HeapObject> value);
+  Handle<FeedbackCell> NewManyClosuresCell(Handle<HeapObject> value);
 
   Handle<TransitionArray> NewTransitionArray(int capacity);
 
@@ -495,7 +520,8 @@ class V8_EXPORT_PRIVATE Factory final {
 
   // Allocates a new BigInt with {length} digits. Only to be used by
   // MutableBigInt::New*.
-  Handle<FreshlyAllocatedBigInt> NewBigInt(int length);
+  Handle<FreshlyAllocatedBigInt> NewBigInt(
+      int length, PretenureFlag pretenure = NOT_TENURED);
 
   Handle<JSObject> NewArgumentsObject(Handle<JSFunction> callee, int length);
 
@@ -594,7 +620,7 @@ class V8_EXPORT_PRIVATE Factory final {
 
   Handle<JSIteratorResult> NewJSIteratorResult(Handle<Object> value, bool done);
   Handle<JSAsyncFromSyncIterator> NewJSAsyncFromSyncIterator(
-      Handle<JSReceiver> sync_iterator);
+      Handle<JSReceiver> sync_iterator, Handle<Object> next);
 
   Handle<JSMap> NewJSMap();
   Handle<JSSet> NewJSSet();
@@ -635,12 +661,12 @@ class V8_EXPORT_PRIVATE Factory final {
 
   Handle<JSFunction> NewFunctionFromSharedFunctionInfo(
       Handle<Map> initial_map, Handle<SharedFunctionInfo> function_info,
-      Handle<Object> context_or_undefined, Handle<Cell> vector,
+      Handle<Object> context_or_undefined, Handle<FeedbackCell> feedback_cell,
       PretenureFlag pretenure = TENURED);
 
   Handle<JSFunction> NewFunctionFromSharedFunctionInfo(
       Handle<SharedFunctionInfo> function_info, Handle<Context> context,
-      Handle<Cell> vector, PretenureFlag pretenure = TENURED);
+      Handle<FeedbackCell> feedback_cell, PretenureFlag pretenure = TENURED);
 
   Handle<JSFunction> NewFunctionFromSharedFunctionInfo(
       Handle<Map> initial_map, Handle<SharedFunctionInfo> function_info,
@@ -677,20 +703,26 @@ class V8_EXPORT_PRIVATE Factory final {
   Handle<Code> NewCode(const CodeDesc& desc, Code::Kind kind,
                        Handle<Object> self_reference,
                        int32_t builtin_index = Builtins::kNoBuiltinId,
-                       MaybeHandle<HandlerTable> maybe_handler_table =
-                           MaybeHandle<HandlerTable>(),
                        MaybeHandle<ByteArray> maybe_source_position_table =
                            MaybeHandle<ByteArray>(),
                        MaybeHandle<DeoptimizationData> maybe_deopt_data =
                            MaybeHandle<DeoptimizationData>(),
                        Movability movability = kMovable, uint32_t stub_key = 0,
                        bool is_turbofanned = false, int stack_slots = 0,
-                       int safepoint_table_offset = 0);
+                       int safepoint_table_offset = 0,
+                       int handler_table_offset = 0);
 
   // Allocates a new, empty code object for use by builtin deserialization. The
   // given {size} argument specifies the size of the entire code object.
   Handle<Code> NewCodeForDeserialization(uint32_t size);
 
+#ifdef V8_EMBEDDED_BUILTINS
+  // Allocates a new code object and initializes it as the trampoline to the
+  // given off-heap entry point.
+  Handle<Code> NewOffHeapTrampolineFor(Handle<Code> code,
+                                       Address off_heap_entry);
+#endif
+
   Handle<Code> CopyCode(Handle<Code> code);
 
   Handle<BytecodeArray> CopyBytecodeArray(Handle<BytecodeArray>);
@@ -764,13 +796,13 @@ class V8_EXPORT_PRIVATE Factory final {
 #undef ACCESSOR_INFO_ACCESSOR
 
   // Allocates a new SharedFunctionInfo object.
-  Handle<SharedFunctionInfo> NewSharedFunctionInfo(
-      MaybeHandle<String> name, FunctionKind kind, Handle<Code> code,
-      Handle<ScopeInfo> scope_info);
-  Handle<SharedFunctionInfo> NewSharedFunctionInfo(
-      MaybeHandle<String> name, MaybeHandle<Code> code, bool is_constructor,
-      FunctionKind kind = kNormalFunction,
-      int maybe_builtin_index = Builtins::kNoBuiltinId);
+  Handle<SharedFunctionInfo> NewSharedFunctionInfoForApiFunction(
+      MaybeHandle<String> maybe_name,
+      Handle<FunctionTemplateInfo> function_template_info, FunctionKind kind);
+
+  Handle<SharedFunctionInfo> NewSharedFunctionInfoForBuiltin(
+      MaybeHandle<String> name, int builtin_index,
+      FunctionKind kind = kNormalFunction);
 
   Handle<SharedFunctionInfo> NewSharedFunctionInfoForLiteral(
       FunctionLiteral* literal, Handle<Script> script);
@@ -848,6 +880,8 @@ class V8_EXPORT_PRIVATE Factory final {
   // Converts the given ToPrimitive hint to it's string representation.
   Handle<String> ToPrimitiveHintString(ToPrimitiveHint hint);
 
+  Handle<JSPromise> NewJSPromise(PretenureFlag pretenure = NOT_TENURED);
+
  private:
   Isolate* isolate() { return reinterpret_cast<Isolate*>(this); }
 
@@ -875,6 +909,13 @@ class V8_EXPORT_PRIVATE Factory final {
   // Create a JSArray with no elements and no length.
   Handle<JSArray> NewJSArray(ElementsKind elements_kind,
                              PretenureFlag pretenure = NOT_TENURED);
+
+  Handle<JSPromise> NewJSPromiseWithoutHook(
+      PretenureFlag pretenure = NOT_TENURED);
+
+  Handle<SharedFunctionInfo> NewSharedFunctionInfo(
+      MaybeHandle<String> name, MaybeHandle<HeapObject> maybe_function_data,
+      int maybe_builtin_index, FunctionKind kind = kNormalFunction);
 };
 
 // Utility class to simplify argument handling around JSFunction creation.
@@ -882,17 +923,16 @@ class NewFunctionArgs final {
  public:
   static NewFunctionArgs ForWasm(Handle<String> name, Handle<Code> code,
                                  Handle<Map> map);
-  static NewFunctionArgs ForBuiltin(Handle<String> name, Handle<Code> code,
-                                    Handle<Map> map, int builtin_id);
+  static NewFunctionArgs ForBuiltin(Handle<String> name, Handle<Map> map,
+                                    int builtin_id);
   static NewFunctionArgs ForFunctionWithoutCode(Handle<String> name,
                                                 Handle<Map> map,
                                                 LanguageMode language_mode);
   static NewFunctionArgs ForBuiltinWithPrototype(
-      Handle<String> name, Handle<Code> code, Handle<Object> prototype,
-      InstanceType type, int instance_size, int inobject_properties,
-      int builtin_id, MutableMode prototype_mutability);
+      Handle<String> name, Handle<Object> prototype, InstanceType type,
+      int instance_size, int inobject_properties, int builtin_id,
+      MutableMode prototype_mutability);
   static NewFunctionArgs ForBuiltinWithoutPrototype(Handle<String> name,
-                                                    Handle<Code> code,
                                                     int builtin_id,
                                                     LanguageMode language_mode);
 
diff --git a/deps/v8/src/fast-dtoa.cc b/deps/v8/src/fast-dtoa.cc
index 9572c7026da..8c061dae7fa 100644
--- a/deps/v8/src/fast-dtoa.cc
+++ b/deps/v8/src/fast-dtoa.cc
@@ -229,7 +229,8 @@ static void BiggestPowerTen(uint32_t number,
         *power = kTen9;
         *exponent = 9;
         break;
-      }  // else fallthrough
+      }
+      V8_FALLTHROUGH;
     case 29:
     case 28:
     case 27:
@@ -237,7 +238,8 @@ static void BiggestPowerTen(uint32_t number,
         *power = kTen8;
         *exponent = 8;
         break;
-      }  // else fallthrough
+      }
+      V8_FALLTHROUGH;
     case 26:
     case 25:
     case 24:
@@ -245,7 +247,8 @@ static void BiggestPowerTen(uint32_t number,
         *power = kTen7;
         *exponent = 7;
         break;
-      }  // else fallthrough
+      }
+      V8_FALLTHROUGH;
     case 23:
     case 22:
     case 21:
@@ -254,7 +257,8 @@ static void BiggestPowerTen(uint32_t number,
         *power = kTen6;
         *exponent = 6;
         break;
-      }  // else fallthrough
+      }
+      V8_FALLTHROUGH;
     case 19:
     case 18:
     case 17:
@@ -262,7 +266,8 @@ static void BiggestPowerTen(uint32_t number,
         *power = kTen5;
         *exponent = 5;
         break;
-      }  // else fallthrough
+      }
+      V8_FALLTHROUGH;
     case 16:
     case 15:
     case 14:
@@ -270,7 +275,8 @@ static void BiggestPowerTen(uint32_t number,
         *power = kTen4;
         *exponent = 4;
         break;
-      }  // else fallthrough
+      }
+      V8_FALLTHROUGH;
     case 13:
     case 12:
     case 11:
@@ -279,7 +285,8 @@ static void BiggestPowerTen(uint32_t number,
         *power = 1000;
         *exponent = 3;
         break;
-      }  // else fallthrough
+      }
+      V8_FALLTHROUGH;
     case 9:
     case 8:
     case 7:
@@ -287,7 +294,8 @@ static void BiggestPowerTen(uint32_t number,
         *power = 100;
         *exponent = 2;
         break;
-      }  // else fallthrough
+      }
+      V8_FALLTHROUGH;
     case 6:
     case 5:
     case 4:
@@ -295,7 +303,8 @@ static void BiggestPowerTen(uint32_t number,
         *power = 10;
         *exponent = 1;
         break;
-      }  // else fallthrough
+      }
+      V8_FALLTHROUGH;
     case 3:
     case 2:
     case 1:
@@ -303,7 +312,8 @@ static void BiggestPowerTen(uint32_t number,
         *power = 1;
         *exponent = 0;
         break;
-      }  // else fallthrough
+      }
+      V8_FALLTHROUGH;
     case 0:
       *power = 0;
       *exponent = -1;
diff --git a/deps/v8/src/feedback-vector-inl.h b/deps/v8/src/feedback-vector-inl.h
index 888fa018543..0fbf3f0ca06 100644
--- a/deps/v8/src/feedback-vector-inl.h
+++ b/deps/v8/src/feedback-vector-inl.h
@@ -10,6 +10,7 @@
 #include "src/globals.h"
 #include "src/heap/heap-inl.h"
 #include "src/heap/heap.h"
+#include "src/objects/maybe-object-inl.h"
 #include "src/objects/shared-function-info.h"
 
 // Has to be the last include (doesn't have include guards):
@@ -18,21 +19,35 @@
 namespace v8 {
 namespace internal {
 
+INT32_ACCESSORS(FeedbackMetadata, slot_count, kSlotCountOffset)
+
+int32_t FeedbackMetadata::synchronized_slot_count() const {
+  return base::Acquire_Load(reinterpret_cast<const base::Atomic32*>(
+          FIELD_ADDR_CONST(this, kSlotCountOffset)));
+}
+
 // static
 FeedbackMetadata* FeedbackMetadata::cast(Object* obj) {
   DCHECK(obj->IsFeedbackMetadata());
   return reinterpret_cast<FeedbackMetadata*>(obj);
 }
 
-bool FeedbackMetadata::is_empty() const {
-  if (length() == 0) return true;
-  return false;
+int32_t FeedbackMetadata::get(int index) const {
+  DCHECK(index >= 0 && index < length());
+  int offset = kHeaderSize + index * kInt32Size;
+  return READ_INT32_FIELD(this, offset);
 }
 
-int FeedbackMetadata::slot_count() const {
-  if (length() == 0) return 0;
-  DCHECK_GT(length(), kReservedIndexCount);
-  return Smi::ToInt(get(kSlotsCountIndex));
+void FeedbackMetadata::set(int index, int32_t value) {
+  DCHECK(index >= 0 && index < length());
+  int offset = kHeaderSize + index * kInt32Size;
+  WRITE_INT32_FIELD(this, offset, value);
+}
+
+bool FeedbackMetadata::is_empty() const { return slot_count() == 0; }
+
+int FeedbackMetadata::length() const {
+  return FeedbackMetadata::length(slot_count());
 }
 
 // static
@@ -64,6 +79,7 @@ int FeedbackMetadata::GetSlotSize(FeedbackSlotKind kind) {
     case FeedbackSlotKind::kStoreGlobalStrict:
     case FeedbackSlotKind::kStoreKeyedSloppy:
     case FeedbackSlotKind::kStoreKeyedStrict:
+    case FeedbackSlotKind::kStoreInArrayLiteral:
     case FeedbackSlotKind::kStoreDataPropertyInLiteral:
       return 2;
 
@@ -77,7 +93,7 @@ int FeedbackMetadata::GetSlotSize(FeedbackSlotKind kind) {
 
 ACCESSORS(FeedbackVector, shared_function_info, SharedFunctionInfo,
           kSharedFunctionInfoOffset)
-ACCESSORS(FeedbackVector, optimized_code_cell, Object, kOptimizedCodeOffset)
+WEAK_ACCESSORS(FeedbackVector, optimized_code_weak_or_smi, kOptimizedCodeOffset)
 INT32_ACCESSORS(FeedbackVector, length, kLengthOffset)
 INT32_ACCESSORS(FeedbackVector, invocation_count, kInvocationCountOffset)
 INT32_ACCESSORS(FeedbackVector, profiler_ticks, kProfilerTicksOffset)
@@ -99,16 +115,18 @@ void FeedbackVector::increment_deopt_count() {
 }
 
 Code* FeedbackVector::optimized_code() const {
-  Object* slot = optimized_code_cell();
-  if (slot->IsSmi()) return nullptr;
-  WeakCell* cell = WeakCell::cast(slot);
-  return cell->cleared() ? nullptr : Code::cast(cell->value());
+  MaybeObject* slot = optimized_code_weak_or_smi();
+  DCHECK(slot->IsSmi() || slot->IsClearedWeakHeapObject() ||
+         slot->IsWeakHeapObject());
+  HeapObject* heap_object;
+  return slot->ToStrongOrWeakHeapObject(&heap_object) ? Code::cast(heap_object)
+                                                      : nullptr;
 }
 
 OptimizationMarker FeedbackVector::optimization_marker() const {
-  Object* slot = optimized_code_cell();
-  if (!slot->IsSmi()) return OptimizationMarker::kNone;
-  Smi* value = Smi::cast(slot);
+  MaybeObject* slot = optimized_code_weak_or_smi();
+  Smi* value;
+  if (!slot->ToSmi(&value)) return OptimizationMarker::kNone;
   return static_cast<OptimizationMarker>(value->value());
 }
 
@@ -247,6 +265,7 @@ void FeedbackVector::ComputeCounts(int* with_type_info, int* generic,
       case FeedbackSlotKind::kStoreGlobalStrict:
       case FeedbackSlotKind::kStoreKeyedSloppy:
       case FeedbackSlotKind::kStoreKeyedStrict:
+      case FeedbackSlotKind::kStoreInArrayLiteral:
       case FeedbackSlotKind::kStoreDataPropertyInLiteral:
       case FeedbackSlotKind::kTypeProfile: {
         if (obj->IsWeakCell() || obj->IsFixedArray() || obj->IsString()) {
diff --git a/deps/v8/src/feedback-vector.cc b/deps/v8/src/feedback-vector.cc
index c3bdd826161..28ed6394c5d 100644
--- a/deps/v8/src/feedback-vector.cc
+++ b/deps/v8/src/feedback-vector.cc
@@ -12,35 +12,23 @@
 namespace v8 {
 namespace internal {
 
-template <typename Derived>
-FeedbackSlot FeedbackVectorSpecBase<Derived>::AddSlot(FeedbackSlotKind kind) {
-  int slot = This()->slots();
+FeedbackSlot FeedbackVectorSpec::AddSlot(FeedbackSlotKind kind) {
+  int slot = slots();
   int entries_per_slot = FeedbackMetadata::GetSlotSize(kind);
-  This()->append(kind);
+  append(kind);
   for (int i = 1; i < entries_per_slot; i++) {
-    This()->append(FeedbackSlotKind::kInvalid);
+    append(FeedbackSlotKind::kInvalid);
   }
   return FeedbackSlot(slot);
 }
 
-template FeedbackSlot FeedbackVectorSpecBase<FeedbackVectorSpec>::AddSlot(
-    FeedbackSlotKind kind);
-template FeedbackSlot FeedbackVectorSpecBase<StaticFeedbackVectorSpec>::AddSlot(
-    FeedbackSlotKind kind);
-
-template <typename Derived>
-FeedbackSlot FeedbackVectorSpecBase<Derived>::AddTypeProfileSlot() {
+FeedbackSlot FeedbackVectorSpec::AddTypeProfileSlot() {
   FeedbackSlot slot = AddSlot(FeedbackSlotKind::kTypeProfile);
   CHECK_EQ(FeedbackVectorSpec::kTypeProfileSlotIndex,
            FeedbackVector::GetIndex(slot));
   return slot;
 }
 
-template FeedbackSlot
-FeedbackVectorSpecBase<FeedbackVectorSpec>::AddTypeProfileSlot();
-template FeedbackSlot
-FeedbackVectorSpecBase<StaticFeedbackVectorSpec>::AddTypeProfileSlot();
-
 bool FeedbackVectorSpec::HasTypeProfileSlot() const {
   FeedbackSlot slot =
       FeedbackVector::ToSlot(FeedbackVectorSpec::kTypeProfileSlotIndex);
@@ -65,37 +53,30 @@ std::ostream& operator<<(std::ostream& os, FeedbackSlotKind kind) {
 }
 
 FeedbackSlotKind FeedbackMetadata::GetKind(FeedbackSlot slot) const {
-  int index = VectorICComputer::index(kReservedIndexCount, slot.ToInt());
-  int data = Smi::ToInt(get(index));
+  int index = VectorICComputer::index(0, slot.ToInt());
+  int data = get(index);
   return VectorICComputer::decode(data, slot.ToInt());
 }
 
 void FeedbackMetadata::SetKind(FeedbackSlot slot, FeedbackSlotKind kind) {
-  int index = VectorICComputer::index(kReservedIndexCount, slot.ToInt());
-  int data = Smi::ToInt(get(index));
+  int index = VectorICComputer::index(0, slot.ToInt());
+  int data = get(index);
   int new_data = VectorICComputer::encode(data, slot.ToInt(), kind);
-  set(index, Smi::FromInt(new_data));
+  set(index, new_data);
 }
 
-template Handle<FeedbackMetadata> FeedbackMetadata::New(
-    Isolate* isolate, const StaticFeedbackVectorSpec* spec);
-template Handle<FeedbackMetadata> FeedbackMetadata::New(
-    Isolate* isolate, const FeedbackVectorSpec* spec);
-
 // static
-template <typename Spec>
 Handle<FeedbackMetadata> FeedbackMetadata::New(Isolate* isolate,
-                                               const Spec* spec) {
+                                               const FeedbackVectorSpec* spec) {
   Factory* factory = isolate->factory();
 
-  const int slot_count = spec->slots();
-  const int slot_kinds_length = VectorICComputer::word_count(slot_count);
-  const int length = slot_kinds_length + kReservedIndexCount;
-  if (length == kReservedIndexCount) {
-    return Handle<FeedbackMetadata>::cast(factory->empty_fixed_array());
+  const int slot_count = spec == nullptr ? 0 : spec->slots();
+  if (slot_count == 0) {
+    return factory->empty_feedback_metadata();
   }
 #ifdef DEBUG
   for (int i = 0; i < slot_count;) {
+    DCHECK(spec);
     FeedbackSlotKind kind = spec->GetKind(FeedbackSlot(i));
     int entry_size = FeedbackMetadata::GetSlotSize(kind);
     for (int j = 1; j < entry_size; j++) {
@@ -106,28 +87,17 @@ Handle<FeedbackMetadata> FeedbackMetadata::New(Isolate* isolate,
   }
 #endif
 
-  Handle<FixedArray> array = factory->NewFixedArray(length, TENURED);
-  array->set(kSlotsCountIndex, Smi::FromInt(slot_count));
-  // Fill the bit-vector part with zeros.
-  for (int i = 0; i < slot_kinds_length; i++) {
-    array->set(kReservedIndexCount + i, Smi::kZero);
-  }
-
-  Handle<FeedbackMetadata> metadata = Handle<FeedbackMetadata>::cast(array);
+  Handle<FeedbackMetadata> metadata = factory->NewFeedbackMetadata(slot_count);
 
+  // Initialize the slots. The raw data section has already been pre-zeroed in
+  // NewFeedbackMetadata.
   for (int i = 0; i < slot_count; i++) {
+    DCHECK(spec);
     FeedbackSlot slot(i);
     FeedbackSlotKind kind = spec->GetKind(slot);
     metadata->SetKind(slot, kind);
   }
 
-  // It's important that the FeedbackMetadata have a COW map, since it's
-  // pointed to by both a SharedFunctionInfo and indirectly by closures through
-  // the FeedbackVector. The serializer uses the COW map type to decide
-  // this object belongs in the startup snapshot and not the partial
-  // snapshot(s).
-  metadata->set_map(isolate->heap()->fixed_cow_array_map());
-
   return metadata;
 }
 
@@ -179,6 +149,8 @@ const char* FeedbackMetadata::Kind2String(FeedbackSlotKind kind) {
       return "StoreKeyedSloppy";
     case FeedbackSlotKind::kStoreKeyedStrict:
       return "StoreKeyedStrict";
+    case FeedbackSlotKind::kStoreInArrayLiteral:
+      return "StoreInArrayLiteral";
     case FeedbackSlotKind::kBinaryOp:
       return "BinaryOp";
     case FeedbackSlotKind::kCompareOp:
@@ -204,7 +176,7 @@ const char* FeedbackMetadata::Kind2String(FeedbackSlotKind kind) {
 bool FeedbackMetadata::HasTypeProfileSlot() const {
   FeedbackSlot slot =
       FeedbackVector::ToSlot(FeedbackVectorSpec::kTypeProfileSlotIndex);
-  return slot.ToInt() < this->length() &&
+  return slot.ToInt() < slot_count() &&
          GetKind(slot) == FeedbackSlotKind::kTypeProfile;
 }
 
@@ -233,10 +205,11 @@ Handle<FeedbackVector> FeedbackVector::New(Isolate* isolate,
   DCHECK_EQ(vector->length(), slot_count);
 
   DCHECK_EQ(vector->shared_function_info(), *shared);
-  DCHECK_EQ(vector->optimized_code_cell(),
-            Smi::FromEnum(FLAG_log_function_events
-                              ? OptimizationMarker::kLogFirstExecution
-                              : OptimizationMarker::kNone));
+  DCHECK_EQ(
+      vector->optimized_code_weak_or_smi(),
+      MaybeObject::FromSmi(Smi::FromEnum(
+          FLAG_log_function_events ? OptimizationMarker::kLogFirstExecution
+                                   : OptimizationMarker::kNone)));
   DCHECK_EQ(vector->invocation_count(), 0);
   DCHECK_EQ(vector->profiler_ticks(), 0);
   DCHECK_EQ(vector->deopt_count(), 0);
@@ -266,7 +239,7 @@ Handle<FeedbackVector> FeedbackVector::New(Isolate* isolate,
         vector->set(index, Smi::kZero, SKIP_WRITE_BARRIER);
         break;
       case FeedbackSlotKind::kCreateClosure: {
-        Handle<Cell> cell = factory->NewNoClosuresCell(undefined_value);
+        Handle<FeedbackCell> cell = factory->NewNoClosuresCell(undefined_value);
         vector->set(index, *cell);
         break;
       }
@@ -284,6 +257,7 @@ Handle<FeedbackVector> FeedbackVector::New(Isolate* isolate,
       case FeedbackSlotKind::kStoreOwnNamed:
       case FeedbackSlotKind::kStoreKeyedSloppy:
       case FeedbackSlotKind::kStoreKeyedStrict:
+      case FeedbackSlotKind::kStoreInArrayLiteral:
       case FeedbackSlotKind::kStoreDataPropertyInLiteral:
       case FeedbackSlotKind::kTypeProfile:
       case FeedbackSlotKind::kInstanceOf:
@@ -338,9 +312,7 @@ void FeedbackVector::AddToVectorsForProfilingTools(
 void FeedbackVector::SetOptimizedCode(Handle<FeedbackVector> vector,
                                       Handle<Code> code) {
   DCHECK_EQ(code->kind(), Code::OPTIMIZED_FUNCTION);
-  Factory* factory = vector->GetIsolate()->factory();
-  Handle<WeakCell> cell = factory->NewWeakCell(code);
-  vector->set_optimized_code_cell(*cell);
+  vector->set_optimized_code_weak_or_smi(HeapObjectReference::Weak(*code));
 }
 
 void FeedbackVector::ClearOptimizedCode() {
@@ -354,21 +326,22 @@ void FeedbackVector::ClearOptimizationMarker() {
 }
 
 void FeedbackVector::SetOptimizationMarker(OptimizationMarker marker) {
-  set_optimized_code_cell(Smi::FromEnum(marker));
+  set_optimized_code_weak_or_smi(MaybeObject::FromSmi(Smi::FromEnum(marker)));
 }
 
 void FeedbackVector::EvictOptimizedCodeMarkedForDeoptimization(
     SharedFunctionInfo* shared, const char* reason) {
-  Object* slot = optimized_code_cell();
-  if (slot->IsSmi()) return;
+  MaybeObject* slot = optimized_code_weak_or_smi();
+  if (slot->IsSmi()) {
+    return;
+  }
 
-  WeakCell* cell = WeakCell::cast(slot);
-  if (cell->cleared()) {
+  if (slot->IsClearedWeakHeapObject()) {
     ClearOptimizationMarker();
     return;
   }
 
-  Code* code = Code::cast(cell->value());
+  Code* code = Code::cast(slot->GetHeapObject());
   if (code->marked_for_deoptimization()) {
     if (FLAG_trace_deopt) {
       PrintF("[evicting optimizing code marked for deoptimization (%s) for ",
@@ -392,110 +365,11 @@ bool FeedbackVector::ClearSlots(Isolate* isolate) {
   FeedbackMetadataIterator iter(metadata());
   while (iter.HasNext()) {
     FeedbackSlot slot = iter.Next();
-    FeedbackSlotKind kind = iter.kind();
 
     Object* obj = Get(slot);
     if (obj != uninitialized_sentinel) {
-      switch (kind) {
-        case FeedbackSlotKind::kCall: {
-          CallICNexus nexus(this, slot);
-          if (!nexus.IsCleared()) {
-            nexus.Clear();
-            feedback_updated = true;
-          }
-          break;
-        }
-        case FeedbackSlotKind::kLoadProperty: {
-          LoadICNexus nexus(this, slot);
-          if (!nexus.IsCleared()) {
-            nexus.Clear();
-            feedback_updated = true;
-          }
-          break;
-        }
-        case FeedbackSlotKind::kLoadGlobalInsideTypeof:
-        case FeedbackSlotKind::kLoadGlobalNotInsideTypeof: {
-          LoadGlobalICNexus nexus(this, slot);
-          if (!nexus.IsCleared()) {
-            nexus.Clear();
-            feedback_updated = true;
-          }
-          break;
-        }
-        case FeedbackSlotKind::kLoadKeyed: {
-          KeyedLoadICNexus nexus(this, slot);
-          if (!nexus.IsCleared()) {
-            nexus.Clear();
-            feedback_updated = true;
-          }
-          break;
-        }
-        case FeedbackSlotKind::kStoreNamedSloppy:
-        case FeedbackSlotKind::kStoreNamedStrict:
-        case FeedbackSlotKind::kStoreOwnNamed: {
-          StoreICNexus nexus(this, slot);
-          if (!nexus.IsCleared()) {
-            nexus.Clear();
-            feedback_updated = true;
-          }
-          break;
-        }
-        case FeedbackSlotKind::kStoreGlobalSloppy:
-        case FeedbackSlotKind::kStoreGlobalStrict: {
-          StoreGlobalICNexus nexus(this, slot);
-          if (!nexus.IsCleared()) {
-            nexus.Clear();
-            feedback_updated = true;
-          }
-          break;
-        }
-        case FeedbackSlotKind::kStoreKeyedSloppy:
-        case FeedbackSlotKind::kStoreKeyedStrict: {
-          KeyedStoreICNexus nexus(this, slot);
-          if (!nexus.IsCleared()) {
-            nexus.Clear();
-            feedback_updated = true;
-          }
-          break;
-        }
-        case FeedbackSlotKind::kForIn:
-        case FeedbackSlotKind::kBinaryOp:
-        case FeedbackSlotKind::kCompareOp: {
-          DCHECK(Get(slot)->IsSmi());
-          // don't clear these smi slots.
-          // Set(slot, Smi::kZero);
-          break;
-        }
-        case FeedbackSlotKind::kInstanceOf: {
-          InstanceOfICNexus nexus(this, slot);
-          if (!nexus.IsCleared()) {
-            nexus.Clear();
-            feedback_updated = true;
-          }
-          break;
-        }
-        case FeedbackSlotKind::kCreateClosure:
-        case FeedbackSlotKind::kTypeProfile: {
-          break;
-        }
-        case FeedbackSlotKind::kLiteral: {
-          Set(slot, Smi::kZero, SKIP_WRITE_BARRIER);
-          feedback_updated = true;
-          break;
-        }
-        case FeedbackSlotKind::kStoreDataPropertyInLiteral: {
-          StoreDataPropertyInLiteralICNexus nexus(this, slot);
-          if (!nexus.IsCleared()) {
-            nexus.Clear();
-            feedback_updated = true;
-          }
-          break;
-        }
-        case FeedbackSlotKind::kInvalid:
-        case FeedbackSlotKind::kKindsNumber:
-          UNREACHABLE();
-          break;
-      }
+      FeedbackNexus nexus(this, slot);
+      feedback_updated |= nexus.Clear();
     }
   }
   return feedback_updated;
@@ -526,10 +400,93 @@ Handle<FixedArray> FeedbackNexus::EnsureExtraArrayOfSize(int length) {
 }
 
 void FeedbackNexus::ConfigureUninitialized() {
-  SetFeedback(*FeedbackVector::UninitializedSentinel(GetIsolate()),
-              SKIP_WRITE_BARRIER);
-  SetFeedbackExtra(*FeedbackVector::UninitializedSentinel(GetIsolate()),
-                   SKIP_WRITE_BARRIER);
+  Isolate* isolate = GetIsolate();
+  switch (kind()) {
+    case FeedbackSlotKind::kStoreGlobalSloppy:
+    case FeedbackSlotKind::kStoreGlobalStrict:
+    case FeedbackSlotKind::kLoadGlobalNotInsideTypeof:
+    case FeedbackSlotKind::kLoadGlobalInsideTypeof: {
+      SetFeedback(isolate->heap()->empty_weak_cell(), SKIP_WRITE_BARRIER);
+      SetFeedbackExtra(*FeedbackVector::UninitializedSentinel(isolate),
+                       SKIP_WRITE_BARRIER);
+      break;
+    }
+    case FeedbackSlotKind::kCall: {
+      SetFeedback(*FeedbackVector::UninitializedSentinel(isolate),
+                  SKIP_WRITE_BARRIER);
+      SetFeedbackExtra(Smi::kZero, SKIP_WRITE_BARRIER);
+      break;
+    }
+    case FeedbackSlotKind::kInstanceOf: {
+      SetFeedback(*FeedbackVector::UninitializedSentinel(isolate),
+                  SKIP_WRITE_BARRIER);
+      break;
+    }
+    case FeedbackSlotKind::kStoreDataPropertyInLiteral: {
+      SetFeedback(*FeedbackVector::UninitializedSentinel(isolate),
+                  SKIP_WRITE_BARRIER);
+      SetFeedbackExtra(*FeedbackVector::UninitializedSentinel(isolate),
+                       SKIP_WRITE_BARRIER);
+      break;
+    }
+    default:
+      UNREACHABLE();
+  }
+}
+
+bool FeedbackNexus::Clear() {
+  bool feedback_updated = false;
+
+  switch (kind()) {
+    case FeedbackSlotKind::kCreateClosure:
+    case FeedbackSlotKind::kTypeProfile:
+      // We don't clear these kinds ever.
+      break;
+
+    case FeedbackSlotKind::kCompareOp:
+    case FeedbackSlotKind::kForIn:
+    case FeedbackSlotKind::kBinaryOp:
+      // We don't clear these, either.
+      break;
+
+    case FeedbackSlotKind::kLiteral:
+      SetFeedback(Smi::kZero, SKIP_WRITE_BARRIER);
+      feedback_updated = true;
+      break;
+
+    case FeedbackSlotKind::kStoreNamedSloppy:
+    case FeedbackSlotKind::kStoreNamedStrict:
+    case FeedbackSlotKind::kStoreKeyedSloppy:
+    case FeedbackSlotKind::kStoreKeyedStrict:
+    case FeedbackSlotKind::kStoreInArrayLiteral:
+    case FeedbackSlotKind::kStoreOwnNamed:
+    case FeedbackSlotKind::kLoadProperty:
+    case FeedbackSlotKind::kLoadKeyed:
+      if (!IsCleared()) {
+        ConfigurePremonomorphic();
+        feedback_updated = true;
+      }
+      break;
+
+    case FeedbackSlotKind::kStoreGlobalSloppy:
+    case FeedbackSlotKind::kStoreGlobalStrict:
+    case FeedbackSlotKind::kLoadGlobalNotInsideTypeof:
+    case FeedbackSlotKind::kLoadGlobalInsideTypeof:
+    case FeedbackSlotKind::kCall:
+    case FeedbackSlotKind::kInstanceOf:
+    case FeedbackSlotKind::kStoreDataPropertyInLiteral:
+      if (!IsCleared()) {
+        ConfigureUninitialized();
+        feedback_updated = true;
+      }
+      break;
+
+    case FeedbackSlotKind::kInvalid:
+    case FeedbackSlotKind::kKindsNumber:
+      UNREACHABLE();
+      break;
+  }
+  return feedback_updated;
 }
 
 void FeedbackNexus::ConfigurePremonomorphic() {
@@ -557,70 +514,148 @@ bool FeedbackNexus::ConfigureMegamorphic(IcCheckType property_type) {
   return changed;
 }
 
-InlineCacheState LoadICNexus::StateFromFeedback() const {
+InlineCacheState FeedbackNexus::StateFromFeedback() const {
   Isolate* isolate = GetIsolate();
   Object* feedback = GetFeedback();
 
-  if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
-    return UNINITIALIZED;
-  } else if (feedback == *FeedbackVector::MegamorphicSentinel(isolate)) {
-    return MEGAMORPHIC;
-  } else if (feedback == *FeedbackVector::PremonomorphicSentinel(isolate)) {
-    return PREMONOMORPHIC;
-  } else if (feedback->IsFixedArray()) {
-    // Determine state purely by our structure, don't check if the maps are
-    // cleared.
-    return POLYMORPHIC;
-  } else if (feedback->IsWeakCell()) {
-    // Don't check if the map is cleared.
-    return MONOMORPHIC;
-  }
+  switch (kind()) {
+    case FeedbackSlotKind::kCreateClosure:
+    case FeedbackSlotKind::kLiteral:
+      // CreateClosure and literal slots don't have a notion of state.
+      UNREACHABLE();
+      break;
 
-  return UNINITIALIZED;
-}
+    case FeedbackSlotKind::kStoreGlobalSloppy:
+    case FeedbackSlotKind::kStoreGlobalStrict:
+    case FeedbackSlotKind::kLoadGlobalNotInsideTypeof:
+    case FeedbackSlotKind::kLoadGlobalInsideTypeof: {
+      if (feedback->IsSmi()) return MONOMORPHIC;
 
-InlineCacheState KeyedLoadICNexus::StateFromFeedback() const {
-  Isolate* isolate = GetIsolate();
-  Object* feedback = GetFeedback();
+      Object* extra = GetFeedbackExtra();
+      if (!WeakCell::cast(feedback)->cleared() ||
+          extra != *FeedbackVector::UninitializedSentinel(isolate)) {
+        return MONOMORPHIC;
+      }
+      return UNINITIALIZED;
+    }
 
-  if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
-    return UNINITIALIZED;
-  } else if (feedback == *FeedbackVector::PremonomorphicSentinel(isolate)) {
-    return PREMONOMORPHIC;
-  } else if (feedback == *FeedbackVector::MegamorphicSentinel(isolate)) {
-    return MEGAMORPHIC;
-  } else if (feedback->IsFixedArray()) {
-    // Determine state purely by our structure, don't check if the maps are
-    // cleared.
-    return POLYMORPHIC;
-  } else if (feedback->IsWeakCell()) {
-    // Don't check if the map is cleared.
-    return MONOMORPHIC;
-  } else if (feedback->IsName()) {
-    Object* extra = GetFeedbackExtra();
-    FixedArray* extra_array = FixedArray::cast(extra);
-    return extra_array->length() > 2 ? POLYMORPHIC : MONOMORPHIC;
-  }
+    case FeedbackSlotKind::kStoreNamedSloppy:
+    case FeedbackSlotKind::kStoreNamedStrict:
+    case FeedbackSlotKind::kStoreKeyedSloppy:
+    case FeedbackSlotKind::kStoreKeyedStrict:
+    case FeedbackSlotKind::kStoreInArrayLiteral:
+    case FeedbackSlotKind::kStoreOwnNamed:
+    case FeedbackSlotKind::kLoadProperty:
+    case FeedbackSlotKind::kLoadKeyed: {
+      if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
+        return UNINITIALIZED;
+      }
+      if (feedback == *FeedbackVector::MegamorphicSentinel(isolate)) {
+        return MEGAMORPHIC;
+      }
+      if (feedback == *FeedbackVector::PremonomorphicSentinel(isolate)) {
+        return PREMONOMORPHIC;
+      }
+      if (feedback->IsFixedArray()) {
+        // Determine state purely by our structure, don't check if the maps are
+        // cleared.
+        return POLYMORPHIC;
+      }
+      if (feedback->IsWeakCell()) {
+        // Don't check if the map is cleared.
+        return MONOMORPHIC;
+      }
+      if (feedback->IsName()) {
+        DCHECK(IsKeyedLoadICKind(kind()) || IsKeyedStoreICKind(kind()));
+        Object* extra = GetFeedbackExtra();
+        FixedArray* extra_array = FixedArray::cast(extra);
+        return extra_array->length() > 2 ? POLYMORPHIC : MONOMORPHIC;
+      }
+      UNREACHABLE();
+    }
+    case FeedbackSlotKind::kCall: {
+      if (feedback == *FeedbackVector::MegamorphicSentinel(isolate)) {
+        return GENERIC;
+      } else if (feedback->IsAllocationSite() || feedback->IsWeakCell()) {
+        return MONOMORPHIC;
+      }
 
-  return UNINITIALIZED;
-}
+      CHECK(feedback == *FeedbackVector::UninitializedSentinel(isolate));
+      return UNINITIALIZED;
+    }
+    case FeedbackSlotKind::kBinaryOp: {
+      BinaryOperationHint hint = GetBinaryOperationFeedback();
+      if (hint == BinaryOperationHint::kNone) {
+        return UNINITIALIZED;
+      } else if (hint == BinaryOperationHint::kAny) {
+        return GENERIC;
+      }
 
-void GlobalICNexus::ConfigureUninitialized() {
-  Isolate* isolate = GetIsolate();
-  SetFeedback(isolate->heap()->empty_weak_cell(), SKIP_WRITE_BARRIER);
-  SetFeedbackExtra(*FeedbackVector::UninitializedSentinel(isolate),
-                   SKIP_WRITE_BARRIER);
+      return MONOMORPHIC;
+    }
+    case FeedbackSlotKind::kCompareOp: {
+      CompareOperationHint hint = GetCompareOperationFeedback();
+      if (hint == CompareOperationHint::kNone) {
+        return UNINITIALIZED;
+      } else if (hint == CompareOperationHint::kAny) {
+        return GENERIC;
+      }
+
+      return MONOMORPHIC;
+    }
+    case FeedbackSlotKind::kForIn: {
+      ForInHint hint = GetForInFeedback();
+      if (hint == ForInHint::kNone) {
+        return UNINITIALIZED;
+      } else if (hint == ForInHint::kAny) {
+        return GENERIC;
+      }
+      return MONOMORPHIC;
+    }
+    case FeedbackSlotKind::kInstanceOf: {
+      if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
+        return UNINITIALIZED;
+      } else if (feedback == *FeedbackVector::MegamorphicSentinel(isolate)) {
+        return MEGAMORPHIC;
+      }
+      return MONOMORPHIC;
+    }
+    case FeedbackSlotKind::kStoreDataPropertyInLiteral: {
+      if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
+        return UNINITIALIZED;
+      } else if (feedback->IsWeakCell()) {
+        // Don't check if the map is cleared.
+        return MONOMORPHIC;
+      }
+
+      return MEGAMORPHIC;
+    }
+    case FeedbackSlotKind::kTypeProfile: {
+      if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
+        return UNINITIALIZED;
+      }
+      return MONOMORPHIC;
+    }
+
+    case FeedbackSlotKind::kInvalid:
+    case FeedbackSlotKind::kKindsNumber:
+      UNREACHABLE();
+      break;
+  }
+  return UNINITIALIZED;
 }
 
-void GlobalICNexus::ConfigurePropertyCellMode(Handle<PropertyCell> cell) {
+void FeedbackNexus::ConfigurePropertyCellMode(Handle<PropertyCell> cell) {
+  DCHECK(IsGlobalICKind(kind()));
   Isolate* isolate = GetIsolate();
   SetFeedback(*isolate->factory()->NewWeakCell(cell));
   SetFeedbackExtra(*FeedbackVector::UninitializedSentinel(isolate),
                    SKIP_WRITE_BARRIER);
 }
 
-bool GlobalICNexus::ConfigureLexicalVarMode(int script_context_index,
+bool FeedbackNexus::ConfigureLexicalVarMode(int script_context_index,
                                             int context_slot_index) {
+  DCHECK(IsGlobalICKind(kind()));
   DCHECK_LE(0, script_context_index);
   DCHECK_LE(0, context_slot_index);
   if (!ContextIndexBits::is_valid(script_context_index) ||
@@ -637,112 +672,44 @@ bool GlobalICNexus::ConfigureLexicalVarMode(int script_context_index,
   return true;
 }
 
-void GlobalICNexus::ConfigureHandlerMode(Handle<Object> handler) {
+void FeedbackNexus::ConfigureHandlerMode(Handle<Object> handler) {
+  DCHECK(IsGlobalICKind(kind()));
   SetFeedback(GetIsolate()->heap()->empty_weak_cell());
   SetFeedbackExtra(*handler);
 }
 
-InlineCacheState GlobalICNexus::StateFromFeedback() const {
-  Isolate* isolate = GetIsolate();
-  Object* feedback = GetFeedback();
-  if (feedback->IsSmi()) return MONOMORPHIC;
+int FeedbackNexus::GetCallCount() {
+  DCHECK(IsCallICKind(kind()));
 
-  Object* extra = GetFeedbackExtra();
-  if (!WeakCell::cast(feedback)->cleared() ||
-      extra != *FeedbackVector::UninitializedSentinel(isolate)) {
-    return MONOMORPHIC;
-  }
-  return UNINITIALIZED;
-}
-
-InlineCacheState StoreICNexus::StateFromFeedback() const {
-  Isolate* isolate = GetIsolate();
-  Object* feedback = GetFeedback();
-
-  if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
-    return UNINITIALIZED;
-  } else if (feedback == *FeedbackVector::MegamorphicSentinel(isolate)) {
-    return MEGAMORPHIC;
-  } else if (feedback == *FeedbackVector::PremonomorphicSentinel(isolate)) {
-    return PREMONOMORPHIC;
-  } else if (feedback->IsFixedArray()) {
-    // Determine state purely by our structure, don't check if the maps are
-    // cleared.
-    return POLYMORPHIC;
-  } else if (feedback->IsWeakCell()) {
-    // Don't check if the map is cleared.
-    return MONOMORPHIC;
-  }
-
-  return UNINITIALIZED;
-}
-
-InlineCacheState KeyedStoreICNexus::StateFromFeedback() const {
-  Isolate* isolate = GetIsolate();
-  Object* feedback = GetFeedback();
-
-  if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
-    return UNINITIALIZED;
-  } else if (feedback == *FeedbackVector::PremonomorphicSentinel(isolate)) {
-    return PREMONOMORPHIC;
-  } else if (feedback == *FeedbackVector::MegamorphicSentinel(isolate)) {
-    return MEGAMORPHIC;
-  } else if (feedback->IsFixedArray()) {
-    // Determine state purely by our structure, don't check if the maps are
-    // cleared.
-    return POLYMORPHIC;
-  } else if (feedback->IsWeakCell()) {
-    // Don't check if the map is cleared.
-    return MONOMORPHIC;
-  } else if (feedback->IsName()) {
-    Object* extra = GetFeedbackExtra();
-    FixedArray* extra_array = FixedArray::cast(extra);
-    return extra_array->length() > 2 ? POLYMORPHIC : MONOMORPHIC;
-  }
-
-  return UNINITIALIZED;
-}
-
-InlineCacheState CallICNexus::StateFromFeedback() const {
-  Isolate* isolate = GetIsolate();
-  Object* feedback = GetFeedback();
-  DCHECK(GetFeedbackExtra() ==
-             *FeedbackVector::UninitializedSentinel(isolate) ||
-         GetFeedbackExtra()->IsSmi());
-
-  if (feedback == *FeedbackVector::MegamorphicSentinel(isolate)) {
-    return GENERIC;
-  } else if (feedback->IsAllocationSite() || feedback->IsWeakCell()) {
-    return MONOMORPHIC;
-  }
-
-  CHECK(feedback == *FeedbackVector::UninitializedSentinel(isolate));
-  return UNINITIALIZED;
-}
-
-int CallICNexus::GetCallCount() {
   Object* call_count = GetFeedbackExtra();
   CHECK(call_count->IsSmi());
   uint32_t value = static_cast<uint32_t>(Smi::ToInt(call_count));
   return CallCountField::decode(value);
 }
 
-void CallICNexus::SetSpeculationMode(SpeculationMode mode) {
+void FeedbackNexus::SetSpeculationMode(SpeculationMode mode) {
+  DCHECK(IsCallICKind(kind()));
+
   Object* call_count = GetFeedbackExtra();
   CHECK(call_count->IsSmi());
-  uint32_t value = static_cast<uint32_t>(Smi::ToInt(call_count));
-  int result = static_cast<int>(CallCountField::decode(value) |
-                                SpeculationModeField::encode(mode));
+  uint32_t count = static_cast<uint32_t>(Smi::ToInt(call_count));
+  uint32_t value = CallCountField::encode(CallCountField::decode(count));
+  int result = static_cast<int>(value | SpeculationModeField::encode(mode));
   SetFeedbackExtra(Smi::FromInt(result), SKIP_WRITE_BARRIER);
 }
 
-SpeculationMode CallICNexus::GetSpeculationMode() {
+SpeculationMode FeedbackNexus::GetSpeculationMode() {
+  DCHECK(IsCallICKind(kind()));
+
   Object* call_count = GetFeedbackExtra();
   CHECK(call_count->IsSmi());
   uint32_t value = static_cast<uint32_t>(Smi::ToInt(call_count));
   return SpeculationModeField::decode(value);
 }
-float CallICNexus::ComputeCallFrequency() {
+
+float FeedbackNexus::ComputeCallFrequency() {
+  DCHECK(IsCallICKind(kind()));
+
   double const invocation_count = vector()->invocation_count();
   double const call_count = GetCallCount();
   if (invocation_count == 0) {
@@ -752,25 +719,23 @@ float CallICNexus::ComputeCallFrequency() {
   return static_cast<float>(call_count / invocation_count);
 }
 
-void CallICNexus::ConfigureUninitialized() {
-  Isolate* isolate = GetIsolate();
-  SetFeedback(*FeedbackVector::UninitializedSentinel(isolate),
-              SKIP_WRITE_BARRIER);
-  SetFeedbackExtra(Smi::kZero, SKIP_WRITE_BARRIER);
-}
-
 void FeedbackNexus::ConfigureMonomorphic(Handle<Name> name,
                                          Handle<Map> receiver_map,
                                          Handle<Object> handler) {
   Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map);
-  if (name.is_null()) {
+  if (kind() == FeedbackSlotKind::kStoreDataPropertyInLiteral) {
     SetFeedback(*cell);
-    SetFeedbackExtra(*handler);
+    SetFeedbackExtra(*name);
   } else {
-    Handle<FixedArray> array = EnsureExtraArrayOfSize(2);
-    SetFeedback(*name);
-    array->set(0, *cell);
-    array->set(1, *handler);
+    if (name.is_null()) {
+      SetFeedback(*cell);
+      SetFeedbackExtra(*handler);
+    } else {
+      Handle<FixedArray> array = EnsureExtraArrayOfSize(2);
+      SetFeedback(*name);
+      array->set(0, *cell);
+      array->set(1, *handler);
+    }
   }
 }
 
@@ -798,6 +763,11 @@ void FeedbackNexus::ConfigurePolymorphic(Handle<Name> name,
 }
 
 int FeedbackNexus::ExtractMaps(MapHandles* maps) const {
+  DCHECK(IsLoadICKind(kind()) || IsStoreICKind(kind()) ||
+         IsKeyedLoadICKind(kind()) || IsKeyedStoreICKind(kind()) ||
+         IsStoreOwnICKind(kind()) || IsStoreDataPropertyInLiteralKind(kind()) ||
+         IsStoreInArrayLiteralICKind(kind()));
+
   Isolate* isolate = GetIsolate();
   Object* feedback = GetFeedback();
   bool is_named_feedback = IsPropertyNameFeedback(feedback);
@@ -831,6 +801,10 @@ int FeedbackNexus::ExtractMaps(MapHandles* maps) const {
 }
 
 MaybeHandle<Object> FeedbackNexus::FindHandlerForMap(Handle<Map> map) const {
+  DCHECK(IsLoadICKind(kind()) || IsStoreICKind(kind()) ||
+         IsKeyedLoadICKind(kind()) || IsKeyedStoreICKind(kind()) ||
+         IsStoreOwnICKind(kind()) || IsStoreDataPropertyInLiteralKind(kind()));
+
   Object* feedback = GetFeedback();
   Isolate* isolate = GetIsolate();
   bool is_named_feedback = IsPropertyNameFeedback(feedback);
@@ -868,6 +842,11 @@ MaybeHandle<Object> FeedbackNexus::FindHandlerForMap(Handle<Map> map) const {
 }
 
 bool FeedbackNexus::FindHandlers(ObjectHandles* code_list, int length) const {
+  DCHECK(IsLoadICKind(kind()) || IsStoreICKind(kind()) ||
+         IsKeyedLoadICKind(kind()) || IsKeyedStoreICKind(kind()) ||
+         IsStoreOwnICKind(kind()) || IsStoreDataPropertyInLiteralKind(kind()) ||
+         IsStoreInArrayLiteralICKind(kind()));
+
   Object* feedback = GetFeedback();
   Isolate* isolate = GetIsolate();
   int count = 0;
@@ -901,23 +880,18 @@ bool FeedbackNexus::FindHandlers(ObjectHandles* code_list, int length) const {
   return count == length;
 }
 
-Name* KeyedLoadICNexus::FindFirstName() const {
-  Object* feedback = GetFeedback();
-  if (IsPropertyNameFeedback(feedback)) {
-    return Name::cast(feedback);
-  }
-  return nullptr;
-}
-
-Name* KeyedStoreICNexus::FindFirstName() const {
-  Object* feedback = GetFeedback();
-  if (IsPropertyNameFeedback(feedback)) {
-    return Name::cast(feedback);
+Name* FeedbackNexus::FindFirstName() const {
+  if (IsKeyedStoreICKind(kind()) || IsKeyedLoadICKind(kind())) {
+    Object* feedback = GetFeedback();
+    if (IsPropertyNameFeedback(feedback)) {
+      return Name::cast(feedback);
+    }
   }
   return nullptr;
 }
 
-KeyedAccessLoadMode KeyedLoadICNexus::GetKeyedAccessLoadMode() const {
+KeyedAccessLoadMode FeedbackNexus::GetKeyedAccessLoadMode() const {
+  DCHECK(IsKeyedLoadICKind(kind()));
   MapHandles maps;
   ObjectHandles handlers;
 
@@ -933,7 +907,8 @@ KeyedAccessLoadMode KeyedLoadICNexus::GetKeyedAccessLoadMode() const {
   return STANDARD_LOAD;
 }
 
-KeyedAccessStoreMode KeyedStoreICNexus::GetKeyedAccessStoreMode() const {
+KeyedAccessStoreMode FeedbackNexus::GetKeyedAccessStoreMode() const {
+  DCHECK(IsKeyedStoreICKind(kind()) || IsStoreInArrayLiteralICKind(kind()));
   KeyedAccessStoreMode mode = STANDARD_STORE;
   MapHandles maps;
   ObjectHandles handlers;
@@ -963,6 +938,7 @@ KeyedAccessStoreMode KeyedStoreICNexus::GetKeyedAccessStoreMode() const {
     CHECK(major_key == CodeStub::KeyedStoreSloppyArguments ||
           major_key == CodeStub::StoreFastElement ||
           major_key == CodeStub::StoreSlowElement ||
+          major_key == CodeStub::StoreInArrayLiteralSlow ||
           major_key == CodeStub::ElementsTransitionAndStore ||
           major_key == CodeStub::NoCache);
     if (major_key != CodeStub::NoCache) {
@@ -974,15 +950,9 @@ KeyedAccessStoreMode KeyedStoreICNexus::GetKeyedAccessStoreMode() const {
   return mode;
 }
 
-IcCheckType KeyedLoadICNexus::GetKeyType() const {
-  Object* feedback = GetFeedback();
-  if (feedback == *FeedbackVector::MegamorphicSentinel(GetIsolate())) {
-    return static_cast<IcCheckType>(Smi::ToInt(GetFeedbackExtra()));
-  }
-  return IsPropertyNameFeedback(feedback) ? PROPERTY : ELEMENT;
-}
-
-IcCheckType KeyedStoreICNexus::GetKeyType() const {
+IcCheckType FeedbackNexus::GetKeyType() const {
+  DCHECK(IsKeyedStoreICKind(kind()) || IsKeyedLoadICKind(kind()) ||
+         IsStoreInArrayLiteralICKind(kind()));
   Object* feedback = GetFeedback();
   if (feedback == *FeedbackVector::MegamorphicSentinel(GetIsolate())) {
     return static_cast<IcCheckType>(Smi::ToInt(GetFeedbackExtra()));
@@ -990,71 +960,31 @@ IcCheckType KeyedStoreICNexus::GetKeyType() const {
   return IsPropertyNameFeedback(feedback) ? PROPERTY : ELEMENT;
 }
 
-InlineCacheState BinaryOpICNexus::StateFromFeedback() const {
-  BinaryOperationHint hint = GetBinaryOperationFeedback();
-  if (hint == BinaryOperationHint::kNone) {
-    return UNINITIALIZED;
-  } else if (hint == BinaryOperationHint::kAny) {
-    return GENERIC;
-  }
-
-  return MONOMORPHIC;
-}
-
-InlineCacheState CompareICNexus::StateFromFeedback() const {
-  CompareOperationHint hint = GetCompareOperationFeedback();
-  if (hint == CompareOperationHint::kNone) {
-    return UNINITIALIZED;
-  } else if (hint == CompareOperationHint::kAny) {
-    return GENERIC;
-  }
-
-  return MONOMORPHIC;
-}
-
-BinaryOperationHint BinaryOpICNexus::GetBinaryOperationFeedback() const {
+BinaryOperationHint FeedbackNexus::GetBinaryOperationFeedback() const {
+  DCHECK_EQ(kind(), FeedbackSlotKind::kBinaryOp);
   int feedback = Smi::ToInt(GetFeedback());
   return BinaryOperationHintFromFeedback(feedback);
 }
 
-CompareOperationHint CompareICNexus::GetCompareOperationFeedback() const {
+CompareOperationHint FeedbackNexus::GetCompareOperationFeedback() const {
+  DCHECK_EQ(kind(), FeedbackSlotKind::kCompareOp);
   int feedback = Smi::ToInt(GetFeedback());
   return CompareOperationHintFromFeedback(feedback);
 }
 
-InlineCacheState ForInICNexus::StateFromFeedback() const {
-  ForInHint hint = GetForInFeedback();
-  if (hint == ForInHint::kNone) {
-    return UNINITIALIZED;
-  } else if (hint == ForInHint::kAny) {
-    return GENERIC;
-  }
-  return MONOMORPHIC;
-}
-
-ForInHint ForInICNexus::GetForInFeedback() const {
+ForInHint FeedbackNexus::GetForInFeedback() const {
+  DCHECK_EQ(kind(), FeedbackSlotKind::kForIn);
   int feedback = Smi::ToInt(GetFeedback());
   return ForInHintFromFeedback(feedback);
 }
 
-void InstanceOfICNexus::ConfigureUninitialized() {
-  SetFeedback(*FeedbackVector::UninitializedSentinel(GetIsolate()),
-              SKIP_WRITE_BARRIER);
+Handle<FeedbackCell> FeedbackNexus::GetFeedbackCell() const {
+  DCHECK_EQ(FeedbackSlotKind::kCreateClosure, kind());
+  return handle(FeedbackCell::cast(GetFeedback()));
 }
 
-InlineCacheState InstanceOfICNexus::StateFromFeedback() const {
-  Isolate* isolate = GetIsolate();
-  Object* feedback = GetFeedback();
-
-  if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
-    return UNINITIALIZED;
-  } else if (feedback == *FeedbackVector::MegamorphicSentinel(isolate)) {
-    return MEGAMORPHIC;
-  }
-  return MONOMORPHIC;
-}
-
-MaybeHandle<JSObject> InstanceOfICNexus::GetConstructorFeedback() const {
+MaybeHandle<JSObject> FeedbackNexus::GetConstructorFeedback() const {
+  DCHECK_EQ(kind(), FeedbackSlotKind::kInstanceOf);
   Isolate* isolate = GetIsolate();
   Object* feedback = GetFeedback();
   if (feedback->IsWeakCell() && !WeakCell::cast(feedback)->cleared()) {
@@ -1063,38 +993,6 @@ MaybeHandle<JSObject> InstanceOfICNexus::GetConstructorFeedback() const {
   return MaybeHandle<JSObject>();
 }
 
-InlineCacheState StoreDataPropertyInLiteralICNexus::StateFromFeedback() const {
-  Isolate* isolate = GetIsolate();
-  Object* feedback = GetFeedback();
-
-  if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
-    return UNINITIALIZED;
-  } else if (feedback->IsWeakCell()) {
-    // Don't check if the map is cleared.
-    return MONOMORPHIC;
-  }
-
-  return MEGAMORPHIC;
-}
-
-void StoreDataPropertyInLiteralICNexus::ConfigureMonomorphic(
-    Handle<Name> name, Handle<Map> receiver_map) {
-  Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map);
-
-  SetFeedback(*cell);
-  SetFeedbackExtra(*name);
-}
-
-InlineCacheState CollectTypeProfileNexus::StateFromFeedback() const {
-  Isolate* isolate = GetIsolate();
-  Object* const feedback = GetFeedback();
-
-  if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
-    return UNINITIALIZED;
-  }
-  return MONOMORPHIC;
-}
-
 namespace {
 
 bool InList(Handle<ArrayList> types, Handle<String> type) {
@@ -1108,44 +1006,42 @@ bool InList(Handle<ArrayList> types, Handle<String> type) {
 }
 }  // anonymous namespace
 
-void CollectTypeProfileNexus::Collect(Handle<String> type, int position) {
+void FeedbackNexus::Collect(Handle<String> type, int position) {
+  DCHECK(IsTypeProfileKind(kind()));
   DCHECK_GE(position, 0);
   Isolate* isolate = GetIsolate();
 
   Object* const feedback = GetFeedback();
 
   // Map source position to collection of types
-  Handle<NumberDictionary> types;
+  Handle<SimpleNumberDictionary> types;
 
   if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
-    types = NumberDictionary::New(isolate, 1);
+    types = SimpleNumberDictionary::New(isolate, 1);
   } else {
-    types = handle(NumberDictionary::cast(feedback));
+    types = handle(SimpleNumberDictionary::cast(feedback));
   }
 
   Handle<ArrayList> position_specific_types;
 
   int entry = types->FindEntry(position);
-  if (entry == NumberDictionary::kNotFound) {
+  if (entry == SimpleNumberDictionary::kNotFound) {
     position_specific_types = ArrayList::New(isolate, 1);
-    types = NumberDictionary::Set(
+    types = SimpleNumberDictionary::Set(
         types, position, ArrayList::Add(position_specific_types, type));
   } else {
     DCHECK(types->ValueAt(entry)->IsArrayList());
     position_specific_types = handle(ArrayList::cast(types->ValueAt(entry)));
     if (!InList(position_specific_types, type)) {  // Add type
-      types = NumberDictionary::Set(
+      types = SimpleNumberDictionary::Set(
           types, position, ArrayList::Add(position_specific_types, type));
     }
   }
   SetFeedback(*types);
 }
 
-void CollectTypeProfileNexus::Clear() {
-  SetFeedback(*FeedbackVector::UninitializedSentinel(GetIsolate()));
-}
-
-std::vector<int> CollectTypeProfileNexus::GetSourcePositions() const {
+std::vector<int> FeedbackNexus::GetSourcePositions() const {
+  DCHECK(IsTypeProfileKind(kind()));
   std::vector<int> source_positions;
   Isolate* isolate = GetIsolate();
 
@@ -1155,12 +1051,12 @@ std::vector<int> CollectTypeProfileNexus::GetSourcePositions() const {
     return source_positions;
   }
 
-  Handle<NumberDictionary> types =
-      Handle<NumberDictionary>(NumberDictionary::cast(feedback), isolate);
+  Handle<SimpleNumberDictionary> types = Handle<SimpleNumberDictionary>(
+      SimpleNumberDictionary::cast(feedback), isolate);
 
-  for (int index = NumberDictionary::kElementsStartIndex;
-       index < types->length(); index += NumberDictionary::kEntrySize) {
-    int key_index = index + NumberDictionary::kEntryKeyIndex;
+  for (int index = SimpleNumberDictionary::kElementsStartIndex;
+       index < types->length(); index += SimpleNumberDictionary::kEntrySize) {
+    int key_index = index + SimpleNumberDictionary::kEntryKeyIndex;
     Object* key = types->get(key_index);
     if (key->IsSmi()) {
       int position = Smi::cast(key)->value();
@@ -1170,8 +1066,9 @@ std::vector<int> CollectTypeProfileNexus::GetSourcePositions() const {
   return source_positions;
 }
 
-std::vector<Handle<String>> CollectTypeProfileNexus::GetTypesForSourcePositions(
+std::vector<Handle<String>> FeedbackNexus::GetTypesForSourcePositions(
     uint32_t position) const {
+  DCHECK(IsTypeProfileKind(kind()));
   Isolate* isolate = GetIsolate();
 
   Object* const feedback = GetFeedback();
@@ -1180,11 +1077,11 @@ std::vector<Handle<String>> CollectTypeProfileNexus::GetTypesForSourcePositions(
     return types_for_position;
   }
 
-  Handle<NumberDictionary> types =
-      Handle<NumberDictionary>(NumberDictionary::cast(feedback), isolate);
+  Handle<SimpleNumberDictionary> types = Handle<SimpleNumberDictionary>(
+      SimpleNumberDictionary::cast(feedback), isolate);
 
   int entry = types->FindEntry(position);
-  if (entry == NumberDictionary::kNotFound) {
+  if (entry == SimpleNumberDictionary::kNotFound) {
     return types_for_position;
   }
   DCHECK(types->ValueAt(entry)->IsArrayList());
@@ -1201,16 +1098,17 @@ std::vector<Handle<String>> CollectTypeProfileNexus::GetTypesForSourcePositions(
 namespace {
 
 Handle<JSObject> ConvertToJSObject(Isolate* isolate,
-                                   Handle<NumberDictionary> feedback) {
+                                   Handle<SimpleNumberDictionary> feedback) {
   Handle<JSObject> type_profile =
       isolate->factory()->NewJSObject(isolate->object_function());
 
-  for (int index = NumberDictionary::kElementsStartIndex;
-       index < feedback->length(); index += NumberDictionary::kEntrySize) {
-    int key_index = index + NumberDictionary::kEntryKeyIndex;
+  for (int index = SimpleNumberDictionary::kElementsStartIndex;
+       index < feedback->length();
+       index += SimpleNumberDictionary::kEntrySize) {
+    int key_index = index + SimpleNumberDictionary::kEntryKeyIndex;
     Object* key = feedback->get(key_index);
     if (key->IsSmi()) {
-      int value_index = index + NumberDictionary::kEntryValueIndex;
+      int value_index = index + SimpleNumberDictionary::kEntryValueIndex;
 
       Handle<ArrayList> position_specific_types(
           ArrayList::cast(feedback->get(value_index)));
@@ -1228,7 +1126,8 @@ Handle<JSObject> ConvertToJSObject(Isolate* isolate,
 }
 }  // namespace
 
-JSObject* CollectTypeProfileNexus::GetTypeProfile() const {
+JSObject* FeedbackNexus::GetTypeProfile() const {
+  DCHECK(IsTypeProfileKind(kind()));
   Isolate* isolate = GetIsolate();
 
   Object* const feedback = GetFeedback();
@@ -1237,7 +1136,13 @@ JSObject* CollectTypeProfileNexus::GetTypeProfile() const {
     return *isolate->factory()->NewJSObject(isolate->object_function());
   }
 
-  return *ConvertToJSObject(isolate, handle(NumberDictionary::cast(feedback)));
+  return *ConvertToJSObject(isolate,
+                            handle(SimpleNumberDictionary::cast(feedback)));
+}
+
+void FeedbackNexus::ResetTypeProfile() {
+  DCHECK(IsTypeProfileKind(kind()));
+  SetFeedback(*FeedbackVector::UninitializedSentinel(GetIsolate()));
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/feedback-vector.h b/deps/v8/src/feedback-vector.h
index 9f8096d1389..02acb797511 100644
--- a/deps/v8/src/feedback-vector.h
+++ b/deps/v8/src/feedback-vector.h
@@ -42,6 +42,7 @@ enum class FeedbackSlotKind {
   kStoreNamedStrict,
   kStoreOwnNamed,
   kStoreKeyedStrict,
+  kStoreInArrayLiteral,
   kBinaryOp,
   kCompareOp,
   kStoreDataPropertyInLiteral,
@@ -85,11 +86,19 @@ inline bool IsStoreOwnICKind(FeedbackSlotKind kind) {
   return kind == FeedbackSlotKind::kStoreOwnNamed;
 }
 
+inline bool IsStoreDataPropertyInLiteralKind(FeedbackSlotKind kind) {
+  return kind == FeedbackSlotKind::kStoreDataPropertyInLiteral;
+}
+
 inline bool IsKeyedStoreICKind(FeedbackSlotKind kind) {
   return kind == FeedbackSlotKind::kStoreKeyedSloppy ||
          kind == FeedbackSlotKind::kStoreKeyedStrict;
 }
 
+inline bool IsStoreInArrayLiteralICKind(FeedbackSlotKind kind) {
+  return kind == FeedbackSlotKind::kStoreInArrayLiteral;
+}
+
 inline bool IsGlobalICKind(FeedbackSlotKind kind) {
   return IsLoadGlobalICKind(kind) || IsStoreGlobalICKind(kind);
 }
@@ -147,9 +156,9 @@ class FeedbackVector : public HeapObject {
   // feedback vector.
   DECL_ACCESSORS(shared_function_info, SharedFunctionInfo)
 
-  // [optimized_code_cell]: WeakCell containing optimized code or a Smi marker
-  // defining optimization behaviour.
-  DECL_ACCESSORS(optimized_code_cell, Object)
+  // [optimized_code_weak_or_smi]: weak reference to optimized code or a Smi
+  // marker defining optimization behaviour.
+  DECL_ACCESSORS(optimized_code_weak_or_smi, MaybeObject)
 
   // [length]: The length of the feedback vector (not including the header, i.e.
   // the number of feedback slots).
@@ -202,8 +211,8 @@ class FeedbackVector : public HeapObject {
 
   FeedbackSlot GetTypeProfileSlot() const;
 
-  static Handle<FeedbackVector> New(Isolate* isolate,
-                                    Handle<SharedFunctionInfo> shared);
+  V8_EXPORT_PRIVATE static Handle<FeedbackVector> New(
+      Isolate* isolate, Handle<SharedFunctionInfo> shared);
 
   static Handle<FeedbackVector> Copy(Isolate* isolate,
                                      Handle<FeedbackVector> vector);
@@ -293,15 +302,28 @@ class FeedbackVector : public HeapObject {
   static void AddToVectorsForProfilingTools(Isolate* isolate,
                                             Handle<FeedbackVector> vector);
 
-  void FeedbackSlotPrint(std::ostream& os, FeedbackSlot slot,
-                         FeedbackSlotKind kind);  // NOLINT
-
   DISALLOW_IMPLICIT_CONSTRUCTORS(FeedbackVector);
 };
 
-template <typename Derived>
-class V8_EXPORT_PRIVATE FeedbackVectorSpecBase {
+class V8_EXPORT_PRIVATE FeedbackVectorSpec {
  public:
+  explicit FeedbackVectorSpec(Zone* zone) : slot_kinds_(zone) {
+    slot_kinds_.reserve(16);
+  }
+
+  int slots() const { return static_cast<int>(slot_kinds_.size()); }
+
+  FeedbackSlotKind GetKind(FeedbackSlot slot) const {
+    return static_cast<FeedbackSlotKind>(slot_kinds_.at(slot.ToInt()));
+  }
+
+  bool HasTypeProfileSlot() const;
+
+  // If used, the TypeProfileSlot is always added as the first slot and its
+  // index is constant. If other slots are added before the TypeProfileSlot,
+  // this number changes.
+  static const int kTypeProfileSlotIndex = 0;
+
   FeedbackSlot AddCallICSlot() { return AddSlot(FeedbackSlotKind::kCall); }
 
   FeedbackSlot AddLoadICSlot() {
@@ -347,6 +369,10 @@ class V8_EXPORT_PRIVATE FeedbackVectorSpecBase {
                        : FeedbackSlotKind::kStoreKeyedSloppy);
   }
 
+  FeedbackSlot AddStoreInArrayLiteralICSlot() {
+    return AddSlot(FeedbackSlotKind::kStoreInArrayLiteral);
+  }
+
   FeedbackSlot AddBinaryOpICSlot() {
     return AddSlot(FeedbackSlotKind::kBinaryOp);
   }
@@ -379,58 +405,6 @@ class V8_EXPORT_PRIVATE FeedbackVectorSpecBase {
  private:
   FeedbackSlot AddSlot(FeedbackSlotKind kind);
 
-  Derived* This() { return static_cast<Derived*>(this); }
-};
-
-class StaticFeedbackVectorSpec
-    : public FeedbackVectorSpecBase<StaticFeedbackVectorSpec> {
- public:
-  StaticFeedbackVectorSpec() : slot_count_(0) {}
-
-  int slots() const { return slot_count_; }
-
-  FeedbackSlotKind GetKind(FeedbackSlot slot) const {
-    DCHECK(slot.ToInt() >= 0 && slot.ToInt() < slot_count_);
-    return kinds_[slot.ToInt()];
-  }
-
- private:
-  friend class FeedbackVectorSpecBase<StaticFeedbackVectorSpec>;
-
-  void append(FeedbackSlotKind kind) {
-    DCHECK_LT(slot_count_, kMaxLength);
-    kinds_[slot_count_++] = kind;
-  }
-
-  static const int kMaxLength = 12;
-
-  int slot_count_;
-  FeedbackSlotKind kinds_[kMaxLength];
-};
-
-class V8_EXPORT_PRIVATE FeedbackVectorSpec
-    : public FeedbackVectorSpecBase<FeedbackVectorSpec> {
- public:
-  explicit FeedbackVectorSpec(Zone* zone) : slot_kinds_(zone) {
-    slot_kinds_.reserve(16);
-  }
-
-  int slots() const { return static_cast<int>(slot_kinds_.size()); }
-
-  FeedbackSlotKind GetKind(FeedbackSlot slot) const {
-    return static_cast<FeedbackSlotKind>(slot_kinds_.at(slot.ToInt()));
-  }
-
-  bool HasTypeProfileSlot() const;
-
-  // If used, the TypeProfileSlot is always added as the first slot and its
-  // index is constant. If other slots are added before the TypeProfileSlot,
-  // this number changes.
-  static const int kTypeProfileSlotIndex = 0;
-
- private:
-  friend class FeedbackVectorSpecBase<FeedbackVectorSpec>;
-
   void append(FeedbackSlotKind kind) {
     slot_kinds_.push_back(static_cast<unsigned char>(kind));
   }
@@ -438,19 +412,21 @@ class V8_EXPORT_PRIVATE FeedbackVectorSpec
   ZoneVector<unsigned char> slot_kinds_;
 };
 
-// The shape of the FeedbackMetadata is an array with:
-// 0: slot_count
-// 1: names table
-// 2: parameters table
-// 3..N: slot kinds packed into a bit vector
-//
-class FeedbackMetadata : public FixedArray {
+// FeedbackMetadata is an array-like object with a slot count (indicating how
+// many slots are stored). We save space by packing several slots into an array
+// of int32 data. The length is never stored - it is always calculated from
+// slot_count. All instances are created through the static New function, and
+// the number of slots is static once an instance is created.
+class FeedbackMetadata : public HeapObject {
  public:
   // Casting.
   static inline FeedbackMetadata* cast(Object* obj);
 
-  static const int kSlotsCountIndex = 0;
-  static const int kReservedIndexCount = 1;
+  // The number of slots that this metadata contains. Stored as an int32.
+  DECL_INT32_ACCESSORS(slot_count)
+
+  // Get slot_count using an acquire load.
+  inline int32_t synchronized_slot_count() const;
 
   // Returns number of feedback vector elements used by given slot kind.
   static inline int GetSlotSize(FeedbackSlotKind kind);
@@ -459,14 +435,12 @@ class FeedbackMetadata : public FixedArray {
 
   inline bool is_empty() const;
 
-  // Returns number of slots in the vector.
-  inline int slot_count() const;
-
   // Returns slot kind for given slot.
   FeedbackSlotKind GetKind(FeedbackSlot slot) const;
 
-  template <typename Spec>
-  static Handle<FeedbackMetadata> New(Isolate* isolate, const Spec* spec);
+  // If {spec} is null, then it is considered empty.
+  V8_EXPORT_PRIVATE static Handle<FeedbackMetadata> New(
+      Isolate* isolate, const FeedbackVectorSpec* spec = nullptr);
 
 #ifdef OBJECT_PRINT
   // For gdb debugging.
@@ -474,21 +448,47 @@ class FeedbackMetadata : public FixedArray {
 #endif  // OBJECT_PRINT
 
   DECL_PRINTER(FeedbackMetadata)
+  DECL_VERIFIER(FeedbackMetadata)
 
   static const char* Kind2String(FeedbackSlotKind kind);
   bool HasTypeProfileSlot() const;
 
+  // Garbage collection support.
+  // This includes any necessary padding at the end of the object for pointer
+  // size alignment.
+  static int SizeFor(int slot_count) {
+    return OBJECT_POINTER_ALIGN(kHeaderSize + length(slot_count) * kInt32Size);
+  }
+
+  static const int kSlotCountOffset = HeapObject::kHeaderSize;
+  static const int kHeaderSize = kSlotCountOffset + kInt32Size;
+
+  class BodyDescriptor;
+  // No weak fields.
+  typedef BodyDescriptor BodyDescriptorWeak;
+
  private:
   friend class AccessorAssembler;
 
+  // Raw accessors to the encoded slot data.
+  inline int32_t get(int index) const;
+  inline void set(int index, int32_t value);
+
+  // The number of int32 data fields needed to store {slot_count} slots.
+  // Does not include any extra padding for pointer size alignment.
+  static int length(int slot_count) {
+    return VectorICComputer::word_count(slot_count);
+  }
+  inline int length() const;
+
   static const int kFeedbackSlotKindBits = 5;
   STATIC_ASSERT(static_cast<int>(FeedbackSlotKind::kKindsNumber) <
                 (1 << kFeedbackSlotKindBits));
 
   void SetKind(FeedbackSlot slot, FeedbackSlotKind kind);
 
-  typedef BitSetComputer<FeedbackSlotKind, kFeedbackSlotKindBits, kSmiValueSize,
-                         uint32_t>
+  typedef BitSetComputer<FeedbackSlotKind, kFeedbackSlotKindBits,
+                         kInt32Size * kBitsPerByte, uint32_t>
       VectorICComputer;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(FeedbackMetadata);
@@ -551,14 +551,15 @@ class FeedbackMetadataIterator {
 };
 
 // A FeedbackNexus is the combination of a FeedbackVector and a slot.
-// Derived classes customize the update and retrieval of feedback.
-class FeedbackNexus {
+class FeedbackNexus final {
  public:
   FeedbackNexus(Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : vector_handle_(vector), vector_(nullptr), slot_(slot) {}
+      : vector_handle_(vector),
+        vector_(nullptr),
+        slot_(slot),
+        kind_(vector->GetKind(slot)) {}
   FeedbackNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : vector_(vector), slot_(slot) {}
-  virtual ~FeedbackNexus() {}
+      : vector_(vector), slot_(slot), kind_(vector->GetKind(slot)) {}
 
   Handle<FeedbackVector> vector_handle() const {
     DCHECK_NULL(vector_);
@@ -568,12 +569,20 @@ class FeedbackNexus {
     return vector_handle_.is_null() ? vector_ : *vector_handle_;
   }
   FeedbackSlot slot() const { return slot_; }
-  FeedbackSlotKind kind() const { return vector()->GetKind(slot()); }
+  FeedbackSlotKind kind() const { return kind_; }
+
+  inline LanguageMode GetLanguageMode() const {
+    return vector()->GetLanguageMode(slot());
+  }
 
   InlineCacheState ic_state() const { return StateFromFeedback(); }
   bool IsUninitialized() const { return StateFromFeedback() == UNINITIALIZED; }
   bool IsMegamorphic() const { return StateFromFeedback() == MEGAMORPHIC; }
   bool IsGeneric() const { return StateFromFeedback() == GENERIC; }
+
+  void Print(std::ostream& os);  // NOLINT
+
+  // For map-based ICs (load, keyed-load, store, keyed-store).
   Map* FindFirstMap() const {
     MapHandles maps;
     ExtractMaps(&maps);
@@ -581,19 +590,19 @@ class FeedbackNexus {
     return nullptr;
   }
 
-  virtual InlineCacheState StateFromFeedback() const = 0;
-  virtual int ExtractMaps(MapHandles* maps) const;
-  virtual MaybeHandle<Object> FindHandlerForMap(Handle<Map> map) const;
-  virtual bool FindHandlers(ObjectHandles* code_list, int length = -1) const;
-  virtual Name* FindFirstName() const { return nullptr; }
+  InlineCacheState StateFromFeedback() const;
+  int ExtractMaps(MapHandles* maps) const;
+  MaybeHandle<Object> FindHandlerForMap(Handle<Map> map) const;
+  bool FindHandlers(ObjectHandles* code_list, int length = -1) const;
 
-  bool IsCleared() {
+  bool IsCleared() const {
     InlineCacheState state = StateFromFeedback();
     return !FLAG_use_ic || state == UNINITIALIZED || state == PREMONOMORPHIC;
   }
 
-  virtual void Clear() { ConfigureUninitialized(); }
-  virtual void ConfigureUninitialized();
+  // Clear() returns true if the state of the underlying vector was changed.
+  bool Clear();
+  void ConfigureUninitialized();
   void ConfigurePremonomorphic();
   bool ConfigureMegamorphic(IcCheckType property_type);
 
@@ -608,51 +617,21 @@ class FeedbackNexus {
   void ConfigurePolymorphic(Handle<Name> name, MapHandles const& maps,
                             ObjectHandles* handlers);
 
- protected:
-  inline void SetFeedback(Object* feedback,
-                          WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
-  inline void SetFeedbackExtra(Object* feedback_extra,
-                               WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
-
-  Handle<FixedArray> EnsureArrayOfSize(int length);
-  Handle<FixedArray> EnsureExtraArrayOfSize(int length);
-
- private:
-  // The reason for having a vector handle and a raw pointer is that we can and
-  // should use handles during IC miss, but not during GC when we clear ICs. If
-  // you have a handle to the vector that is better because more operations can
-  // be done, like allocation.
-  Handle<FeedbackVector> vector_handle_;
-  FeedbackVector* vector_;
-  FeedbackSlot slot_;
-};
-
-class CallICNexus final : public FeedbackNexus {
- public:
-  CallICNexus(Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK(vector->IsCallIC(slot));
-  }
-  CallICNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK(vector->IsCallIC(slot));
-  }
+  BinaryOperationHint GetBinaryOperationFeedback() const;
+  CompareOperationHint GetCompareOperationFeedback() const;
+  ForInHint GetForInFeedback() const;
 
-  void ConfigureUninitialized() final;
+  // For KeyedLoad ICs.
+  KeyedAccessLoadMode GetKeyedAccessLoadMode() const;
 
-  InlineCacheState StateFromFeedback() const final;
+  // For KeyedStore ICs.
+  KeyedAccessStoreMode GetKeyedAccessStoreMode() const;
 
-  int ExtractMaps(MapHandles* maps) const final {
-    // CallICs don't record map feedback.
-    return 0;
-  }
-  MaybeHandle<Object> FindHandlerForMap(Handle<Map> map) const final {
-    return MaybeHandle<Code>();
-  }
-  bool FindHandlers(ObjectHandles* code_list, int length = -1) const final {
-    return length == 0;
-  }
+  // For KeyedLoad and KeyedStore ICs.
+  IcCheckType GetKeyType() const;
+  Name* FindFirstName() const;
 
+  // For Call ICs.
   int GetCallCount();
   void SetSpeculationMode(SpeculationMode mode);
   SpeculationMode GetSpeculationMode();
@@ -663,91 +642,20 @@ class CallICNexus final : public FeedbackNexus {
 
   typedef BitField<SpeculationMode, 0, 1> SpeculationModeField;
   typedef BitField<uint32_t, 1, 31> CallCountField;
-};
 
-class LoadICNexus : public FeedbackNexus {
- public:
-  LoadICNexus(Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK(vector->IsLoadIC(slot));
-  }
-  LoadICNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK(vector->IsLoadIC(slot));
-  }
-
-  void Clear() override { ConfigurePremonomorphic(); }
+  // For CreateClosure ICs.
+  Handle<FeedbackCell> GetFeedbackCell() const;
 
-  InlineCacheState StateFromFeedback() const override;
-};
-
-class KeyedLoadICNexus : public FeedbackNexus {
- public:
-  KeyedLoadICNexus(Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK(vector->IsKeyedLoadIC(slot));
-  }
-  KeyedLoadICNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK(vector->IsKeyedLoadIC(slot));
-  }
-
-  void Clear() override { ConfigurePremonomorphic(); }
-
-  KeyedAccessLoadMode GetKeyedAccessLoadMode() const;
-  IcCheckType GetKeyType() const;
-  InlineCacheState StateFromFeedback() const override;
-  Name* FindFirstName() const override;
-};
-
-class StoreICNexus : public FeedbackNexus {
- public:
-  StoreICNexus(Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK(vector->IsStoreIC(slot) || vector->IsStoreOwnIC(slot));
-  }
-  StoreICNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK(vector->IsStoreIC(slot) || vector->IsStoreOwnIC(slot));
-  }
-
-  void Clear() override { ConfigurePremonomorphic(); }
-
-  InlineCacheState StateFromFeedback() const override;
-};
-
-// Base class for LoadGlobalICNexus and StoreGlobalICNexus.
-class GlobalICNexus : public FeedbackNexus {
- public:
-  GlobalICNexus(Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK(vector->IsGlobalIC(slot));
-  }
-  GlobalICNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK(vector->IsGlobalIC(slot));
-  }
-
-  int ExtractMaps(MapHandles* maps) const final {
-    // Load/StoreGlobalICs don't record map feedback.
-    return 0;
-  }
-  MaybeHandle<Object> FindHandlerForMap(Handle<Map> map) const final {
-    return MaybeHandle<Code>();
-  }
-  bool FindHandlers(ObjectHandles* code_list, int length = -1) const final {
-    return length == 0;
-  }
+  // For InstanceOf ICs.
+  MaybeHandle<JSObject> GetConstructorFeedback() const;
 
-  void ConfigureUninitialized() override;
+  // For Global Load and Store ICs.
   void ConfigurePropertyCellMode(Handle<PropertyCell> cell);
   // Returns false if given combination of indices is not allowed.
   bool ConfigureLexicalVarMode(int script_context_index,
                                int context_slot_index);
   void ConfigureHandlerMode(Handle<Object> handler);
 
-  InlineCacheState StateFromFeedback() const override;
-
 // Bit positions in a smi that encodes lexical environment variable access.
 #define LEXICAL_MODE_BIT_FIELDS(V, _)  \
   V(ContextIndexBits, unsigned, 12, _) \
@@ -758,187 +666,10 @@ class GlobalICNexus : public FeedbackNexus {
 
   // Make sure we don't overflow the smi.
   STATIC_ASSERT(LEXICAL_MODE_BIT_FIELDS_Ranges::kBitsCount <= kSmiValueSize);
-};
-
-class LoadGlobalICNexus : public GlobalICNexus {
- public:
-  LoadGlobalICNexus(Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : GlobalICNexus(vector, slot) {
-    DCHECK(vector->IsLoadGlobalIC(slot));
-  }
-  LoadGlobalICNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : GlobalICNexus(vector, slot) {
-    DCHECK(vector->IsLoadGlobalIC(slot));
-  }
-};
-
-class StoreGlobalICNexus : public GlobalICNexus {
- public:
-  StoreGlobalICNexus(Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : GlobalICNexus(vector, slot) {
-    DCHECK(vector->IsStoreGlobalIC(slot));
-  }
-  StoreGlobalICNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : GlobalICNexus(vector, slot) {
-    DCHECK(vector->IsStoreGlobalIC(slot));
-  }
-};
 
-// TODO(ishell): Currently we use StoreOwnIC only for storing properties that
-// already exist in the boilerplate therefore we can use StoreIC.
-typedef StoreICNexus StoreOwnICNexus;
-
-class KeyedStoreICNexus : public FeedbackNexus {
- public:
-  KeyedStoreICNexus(Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK(vector->IsKeyedStoreIC(slot));
-  }
-  KeyedStoreICNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK(vector->IsKeyedStoreIC(slot));
-  }
-
-  void Clear() override { ConfigurePremonomorphic(); }
-
-  KeyedAccessStoreMode GetKeyedAccessStoreMode() const;
-  IcCheckType GetKeyType() const;
-
-  InlineCacheState StateFromFeedback() const override;
-  Name* FindFirstName() const override;
-};
-
-class BinaryOpICNexus final : public FeedbackNexus {
- public:
-  BinaryOpICNexus(Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK_EQ(FeedbackSlotKind::kBinaryOp, vector->GetKind(slot));
-  }
-  BinaryOpICNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK_EQ(FeedbackSlotKind::kBinaryOp, vector->GetKind(slot));
-  }
-
-  InlineCacheState StateFromFeedback() const final;
-  BinaryOperationHint GetBinaryOperationFeedback() const;
-
-  int ExtractMaps(MapHandles* maps) const final {
-    // BinaryOpICs don't record map feedback.
-    return 0;
-  }
-  MaybeHandle<Object> FindHandlerForMap(Handle<Map> map) const final {
-    return MaybeHandle<Code>();
-  }
-  bool FindHandlers(ObjectHandles* code_list, int length = -1) const final {
-    return length == 0;
-  }
-};
-
-class CompareICNexus final : public FeedbackNexus {
- public:
-  CompareICNexus(Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK_EQ(FeedbackSlotKind::kCompareOp, vector->GetKind(slot));
-  }
-  CompareICNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK_EQ(FeedbackSlotKind::kCompareOp, vector->GetKind(slot));
-  }
-
-  InlineCacheState StateFromFeedback() const final;
-  CompareOperationHint GetCompareOperationFeedback() const;
-
-  int ExtractMaps(MapHandles* maps) const final {
-    // CompareICs don't record map feedback.
-    return 0;
-  }
-  MaybeHandle<Object> FindHandlerForMap(Handle<Map> map) const final {
-    return MaybeHandle<Code>();
-  }
-  bool FindHandlers(ObjectHandles* code_list, int length = -1) const final {
-    return length == 0;
-  }
-};
-
-class ForInICNexus final : public FeedbackNexus {
- public:
-  ForInICNexus(Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK_EQ(FeedbackSlotKind::kForIn, vector->GetKind(slot));
-  }
-  ForInICNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK_EQ(FeedbackSlotKind::kForIn, vector->GetKind(slot));
-  }
-
-  InlineCacheState StateFromFeedback() const final;
-  ForInHint GetForInFeedback() const;
-
-  int ExtractMaps(MapHandles* maps) const final { return 0; }
-  MaybeHandle<Object> FindHandlerForMap(Handle<Map> map) const final {
-    return MaybeHandle<Code>();
-  }
-  bool FindHandlers(ObjectHandles* code_list, int length = -1) const final {
-    return length == 0;
-  }
-};
-
-class InstanceOfICNexus final : public FeedbackNexus {
- public:
-  InstanceOfICNexus(Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK_EQ(FeedbackSlotKind::kInstanceOf, vector->GetKind(slot));
-  }
-  InstanceOfICNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK_EQ(FeedbackSlotKind::kInstanceOf, vector->GetKind(slot));
-  }
-
-  void ConfigureUninitialized() final;
-
-  InlineCacheState StateFromFeedback() const final;
-  MaybeHandle<JSObject> GetConstructorFeedback() const;
-
-  int ExtractMaps(MapHandles* maps) const final { return 0; }
-  MaybeHandle<Object> FindHandlerForMap(Handle<Map> map) const final {
-    return MaybeHandle<Code>();
-  }
-  bool FindHandlers(ObjectHandles* code_list, int length = -1) const final {
-    return length == 0;
-  }
-};
-
-class StoreDataPropertyInLiteralICNexus : public FeedbackNexus {
- public:
-  StoreDataPropertyInLiteralICNexus(Handle<FeedbackVector> vector,
-                                    FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK_EQ(FeedbackSlotKind::kStoreDataPropertyInLiteral,
-              vector->GetKind(slot));
-  }
-  StoreDataPropertyInLiteralICNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK_EQ(FeedbackSlotKind::kStoreDataPropertyInLiteral,
-              vector->GetKind(slot));
-  }
-
-  void ConfigureMonomorphic(Handle<Name> name, Handle<Map> receiver_map);
-
-  InlineCacheState StateFromFeedback() const override;
-};
-
-// For each assignment, store the type of the value in the collection of types
-// in the feedback vector.
-class CollectTypeProfileNexus : public FeedbackNexus {
- public:
-  CollectTypeProfileNexus(Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK_EQ(FeedbackSlotKind::kTypeProfile, vector->GetKind(slot));
-  }
-  CollectTypeProfileNexus(FeedbackVector* vector, FeedbackSlot slot)
-      : FeedbackNexus(vector, slot) {
-    DCHECK_EQ(FeedbackSlotKind::kTypeProfile, vector->GetKind(slot));
-  }
+  // For TypeProfile feedback vector slots.
+  // ResetTypeProfile will always reset type profile information.
+  void ResetTypeProfile();
 
   // Add a type to the list of types for source position <position>.
   void Collect(Handle<String> type, int position);
@@ -947,9 +678,24 @@ class CollectTypeProfileNexus : public FeedbackNexus {
   std::vector<int> GetSourcePositions() const;
   std::vector<Handle<String>> GetTypesForSourcePositions(uint32_t pos) const;
 
-  void Clear() override;
+ protected:
+  inline void SetFeedback(Object* feedback,
+                          WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+  inline void SetFeedbackExtra(Object* feedback_extra,
+                               WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+  Handle<FixedArray> EnsureArrayOfSize(int length);
+  Handle<FixedArray> EnsureExtraArrayOfSize(int length);
 
-  InlineCacheState StateFromFeedback() const override;
+ private:
+  // The reason for having a vector handle and a raw pointer is that we can and
+  // should use handles during IC miss, but not during GC when we clear ICs. If
+  // you have a handle to the vector that is better because more operations can
+  // be done, like allocation.
+  Handle<FeedbackVector> vector_handle_;
+  FeedbackVector* vector_;
+  FeedbackSlot slot_;
+  FeedbackSlotKind kind_;
 };
 
 inline BinaryOperationHint BinaryOperationHintFromFeedback(int type_feedback);
diff --git a/deps/v8/src/field-index-inl.h b/deps/v8/src/field-index-inl.h
index 61540773db0..41fddb6e0b5 100644
--- a/deps/v8/src/field-index-inl.h
+++ b/deps/v8/src/field-index-inl.h
@@ -99,4 +99,4 @@ inline FieldIndex FieldIndex::ForDescriptor(const Map* map,
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_FIELD_INDEX_INL_H_
diff --git a/deps/v8/src/field-index.h b/deps/v8/src/field-index.h
index 9e390e3d465..a1552f050e3 100644
--- a/deps/v8/src/field-index.h
+++ b/deps/v8/src/field-index.h
@@ -135,4 +135,4 @@ class FieldIndex final {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_FIELD_INDEX_H_
diff --git a/deps/v8/src/field-type.h b/deps/v8/src/field-type.h
index 40114f76d39..8eec7a5b583 100644
--- a/deps/v8/src/field-type.h
+++ b/deps/v8/src/field-type.h
@@ -7,7 +7,6 @@
 
 #include "src/objects.h"
 #include "src/objects/map.h"
-#include "src/ostreams.h"
 
 namespace v8 {
 namespace internal {
diff --git a/deps/v8/src/flag-definitions.h b/deps/v8/src/flag-definitions.h
index 8c3a08f81ab..d7267054c4c 100644
--- a/deps/v8/src/flag-definitions.h
+++ b/deps/v8/src/flag-definitions.h
@@ -9,6 +9,8 @@
 // This include does not have a guard, because it is a template-style include,
 // which can be included multiple times in different modes.  It expects to have
 // a mode defined before it's included.  The modes are FLAG_MODE_... below:
+//
+// PRESUBMIT_INTENTIONALLY_MISSING_INCLUDE_GUARD
 
 #define DEFINE_IMPLICATION(whenflag, thenflag)              \
   DEFINE_VALUE_IMPLICATION(whenflag, thenflag, true)
@@ -203,33 +205,38 @@ DEFINE_IMPLICATION(harmony_class_fields, harmony_public_fields)
 DEFINE_IMPLICATION(harmony_class_fields, harmony_static_fields)
 DEFINE_IMPLICATION(harmony_class_fields, harmony_private_fields)
 
+// Update bootstrapper.cc whenever adding a new feature flag.
+
 // Features that are still work in progress (behind individual flags).
 #define HARMONY_INPROGRESS(V)                                         \
-  V(harmony_import_meta, "harmony import.meta property")              \
   V(harmony_array_prototype_values, "harmony Array.prototype.values") \
-  V(harmony_function_sent, "harmony function.sent")                   \
   V(harmony_do_expressions, "harmony do-expressions")                 \
   V(harmony_class_fields, "harmony fields in class literals")         \
   V(harmony_static_fields, "harmony static fields in class literals") \
-  V(harmony_bigint, "harmony arbitrary precision integers")           \
-  V(harmony_private_fields, "harmony private fields in class literals")
+  V(harmony_array_flatten, "harmony Array.prototype.flat{ten,Map}")
 
 // Features that are complete (but still behind --harmony/es-staging flag).
 #define HARMONY_STAGED(V)                                               \
-  V(harmony_function_tostring, "harmony Function.prototype.toString")   \
   V(harmony_restrict_constructor_return,                                \
     "harmony disallow non undefined primitive return value from class " \
     "constructor")                                                      \
-  V(harmony_dynamic_import, "harmony dynamic import")                   \
   V(harmony_public_fields, "harmony public fields in class literals")   \
-  V(harmony_optional_catch_binding, "allow omitting binding in catch blocks")
+  V(harmony_private_fields, "harmony private fields in class literals") \
+  V(harmony_numeric_separator, "harmony numeric separator between digits")
 
 // Features that are shipping (turned on by default, but internal flag remains).
-#define HARMONY_SHIPPING_BASE(V)                                        \
-  V(harmony_sharedarraybuffer, "harmony sharedarraybuffer")             \
-  V(harmony_regexp_named_captures, "harmony regexp named captures")     \
-  V(harmony_regexp_property, "harmony Unicode regexp property classes") \
-  V(harmony_promise_finally, "harmony Promise.prototype.finally")
+#define HARMONY_SHIPPING_BASE(V)                                              \
+  V(harmony_subsume_json, "harmony subsume JSON")                             \
+  V(harmony_string_trimming, "harmony String.prototype.trim{Start,End}")      \
+  V(harmony_sharedarraybuffer, "harmony sharedarraybuffer")                   \
+  V(harmony_regexp_named_captures, "harmony regexp named captures")           \
+  V(harmony_regexp_property, "harmony Unicode regexp property classes")       \
+  V(harmony_function_tostring, "harmony Function.prototype.toString")         \
+  V(harmony_promise_finally, "harmony Promise.prototype.finally")             \
+  V(harmony_optional_catch_binding, "allow omitting binding in catch blocks") \
+  V(harmony_import_meta, "harmony import.meta property")                      \
+  V(harmony_bigint, "harmony arbitrary precision integers")                   \
+  V(harmony_dynamic_import, "harmony dynamic import")
 
 #ifdef V8_INTL_SUPPORT
 #define HARMONY_SHIPPING(V)                      \
@@ -265,8 +272,7 @@ HARMONY_SHIPPING(FLAG_SHIPPING_FEATURES)
 #undef FLAG_SHIPPING_FEATURES
 
 #ifdef V8_INTL_SUPPORT
-DEFINE_BOOL(icu_timezone_data, false,
-            "get information about timezones from ICU")
+DEFINE_BOOL(icu_timezone_data, true, "get information about timezones from ICU")
 #endif
 
 #ifdef V8_ENABLE_FUTURE
@@ -278,7 +284,6 @@ DEFINE_BOOL(future, FUTURE_BOOL,
             "Implies all staged features that we want to ship in the "
             "not-too-far future")
 
-DEFINE_IMPLICATION(future, background_compile)
 DEFINE_IMPLICATION(future, write_protect_code_memory)
 
 // Flags for experimental implementation features.
@@ -320,6 +325,18 @@ DEFINE_VALUE_IMPLICATION(optimize_for_size, max_semi_space_size, 1)
 DEFINE_BOOL(unbox_double_arrays, true, "automatically unbox arrays of doubles")
 DEFINE_BOOL_READONLY(string_slices, true, "use string slices")
 
+// Flags for Ignition for no-snapshot builds.
+#undef FLAG
+#ifndef V8_USE_SNAPSHOT
+#define FLAG FLAG_FULL
+#else
+#define FLAG FLAG_READONLY
+#endif
+DEFINE_INT(interrupt_budget, 144 * KB,
+           "interrupt budget which should be used for the profiler counter")
+#undef FLAG
+#define FLAG FLAG_FULL
+
 // Flags for Ignition.
 DEFINE_BOOL(ignition_elide_noneffectful_bytecodes, true,
             "elide bytecodes which won't have any external effect")
@@ -461,6 +478,7 @@ DEFINE_BOOL(turbo_loop_peeling, true, "Turbofan loop peeling")
 DEFINE_BOOL(turbo_loop_variable, true, "Turbofan loop variable optimization")
 DEFINE_BOOL(turbo_cf_optimization, true, "optimize control flow in TurboFan")
 DEFINE_BOOL(turbo_escape, true, "enable escape analysis")
+DEFINE_BOOL(turbo_allocation_folding, true, "Turbofan allocation folding")
 DEFINE_BOOL(turbo_instruction_scheduling, false,
             "enable instruction scheduling in TurboFan")
 DEFINE_BOOL(turbo_stress_instruction_scheduling, false,
@@ -470,6 +488,8 @@ DEFINE_BOOL(turbo_store_elimination, true,
 DEFINE_BOOL(trace_store_elimination, false, "trace store elimination")
 DEFINE_BOOL(turbo_rewrite_far_jumps, true,
             "rewrite far to near jumps (ia32,x64)")
+DEFINE_BOOL(experimental_inline_promise_constructor, false,
+            "inline the Promise constructor in TurboFan")
 
 #ifdef DISABLE_UNTRUSTED_CODE_MITIGATIONS
 #define V8_DEFAULT_UNTRUSTED_CODE_MITIGATIONS false
@@ -480,6 +500,13 @@ DEFINE_BOOL(untrusted_code_mitigations, V8_DEFAULT_UNTRUSTED_CODE_MITIGATIONS,
             "Enable mitigations for executing untrusted code")
 #undef V8_DEFAULT_UNTRUSTED_CODE_MITIGATIONS
 
+DEFINE_BOOL(turbo_disable_switch_jump_table, false,
+            "do not emit jump-tables in Turbofan")
+DEFINE_IMPLICATION(untrusted_code_mitigations, turbo_disable_switch_jump_table)
+
+DEFINE_BOOL(branch_load_poisoning, false, "Mask loads with branch conditions.")
+DEFINE_IMPLICATION(future, branch_load_poisoning)
+
 // Flags to help platform porters
 DEFINE_BOOL(minimal, false,
             "simplifies execution model to make porting "
@@ -497,11 +524,8 @@ DEFINE_INT(wasm_num_compilation_tasks, 10,
            "number of parallel compilation tasks for wasm")
 DEFINE_DEBUG_BOOL(wasm_trace_native_heap, false,
                   "trace wasm native heap events")
-DEFINE_BOOL(wasm_jit_to_native, true,
-            "JIT wasm code to native (not JS GC) memory")
 DEFINE_BOOL(wasm_write_protect_code_memory, false,
             "write protect code memory on the wasm native heap")
-DEFINE_IMPLICATION(future, wasm_jit_to_native)
 DEFINE_BOOL(wasm_trace_serialization, false,
             "trace serialization/deserialization")
 DEFINE_BOOL(wasm_async_compilation, true,
@@ -562,6 +586,10 @@ DEFINE_BOOL(experimental_wasm_threads, false,
             "enable prototype threads for wasm")
 DEFINE_BOOL(experimental_wasm_sat_f2i_conversions, false,
             "enable non-trapping float-to-int conversions for wasm")
+DEFINE_BOOL(experimental_wasm_se, false,
+            "enable prototype sign extension opcodes for wasm")
+DEFINE_BOOL(experimental_wasm_anyref, false,
+            "enable prototype anyref support for wasm")
 
 DEFINE_BOOL(wasm_opt, false, "enable wasm optimization")
 DEFINE_BOOL(wasm_no_bounds_checks, false,
@@ -632,6 +660,9 @@ DEFINE_BOOL(trace_gc_verbose, false,
             "print more details following each garbage collection")
 DEFINE_INT(trace_allocation_stack_interval, -1,
            "print stack trace after <n> free-list allocations")
+DEFINE_INT(trace_duplicate_threshold_kb, 0,
+           "print duplicate objects in the heap if their size is more than "
+           "given threshold")
 DEFINE_BOOL(trace_fragmentation, false, "report fragmentation for old space")
 DEFINE_BOOL(trace_fragmentation_verbose, false,
             "report fragmentation for old space (detailed)")
@@ -641,9 +672,10 @@ DEFINE_BOOL(trace_mutator_utilization, false,
 DEFINE_BOOL(incremental_marking, true, "use incremental marking")
 DEFINE_BOOL(incremental_marking_wrappers, true,
             "use incremental marking for marking wrappers")
+DEFINE_BOOL(trace_unmapper, false, "Trace the unmapping")
 DEFINE_BOOL(parallel_scavenge, true, "parallel scavenge")
 DEFINE_BOOL(trace_parallel_scavenge, false, "trace parallel scavenge")
-DEFINE_BOOL(write_protect_code_memory, false, "write protect code memory")
+DEFINE_BOOL(write_protect_code_memory, true, "write protect code memory")
 #ifdef V8_CONCURRENT_MARKING
 #define V8_CONCURRENT_MARKING_BOOL true
 #else
@@ -666,6 +698,8 @@ DEFINE_BOOL(concurrent_sweeping, true, "use concurrent sweeping")
 DEFINE_BOOL(parallel_compaction, true, "use parallel compaction")
 DEFINE_BOOL(parallel_pointer_update, true,
             "use parallel pointer update during compaction")
+DEFINE_BOOL(detect_ineffective_gcs_near_heap_limit, true,
+            "trigger out-of-memory failure to avoid GC storm near heap limit")
 DEFINE_BOOL(trace_incremental_marking, false,
             "trace progress of the incremental marking")
 DEFINE_BOOL(trace_stress_marking, false, "trace stress marking progress")
@@ -733,6 +767,8 @@ DEFINE_INT(stress_scavenge, 0,
 DEFINE_IMPLICATION(fuzzer_gc_analysis, stress_marking)
 DEFINE_IMPLICATION(fuzzer_gc_analysis, stress_scavenge)
 
+DEFINE_BOOL(disable_abortjs, false, "disables AbortJS runtime function")
+
 DEFINE_BOOL(manual_evacuation_candidates_selection, false,
             "Test mode only flag. It allows an unit test to select evacuation "
             "candidates pages (requires --stress_compaction).")
@@ -798,7 +834,7 @@ DEFINE_BOOL(expose_trigger_failure, false, "expose trigger-failure extension")
 DEFINE_INT(stack_trace_limit, 10, "number of stack frames to capture")
 DEFINE_BOOL(builtins_in_stack_traces, false,
             "show built-in functions in stack traces")
-DEFINE_BOOL(enable_experimental_builtins, true,
+DEFINE_BOOL(enable_experimental_builtins, false,
             "enable new csa-based experimental builtins")
 DEFINE_BOOL(disallow_code_generation_from_strings, false,
             "disallow eval and friends")
@@ -894,7 +930,10 @@ DEFINE_INT(histogram_interval, 600000,
 // heap-snapshot-generator.cc
 DEFINE_BOOL(heap_profiler_trace_objects, false,
             "Dump heap object allocations/movements/size_updates")
-
+DEFINE_BOOL(heap_profiler_use_embedder_graph, true,
+            "Use the new EmbedderGraph API to get embedder nodes")
+DEFINE_INT(heap_snapshot_string_limit, 1024,
+           "truncate strings to this length in the heap snapshot")
 
 // sampling-heap-profiler.cc
 DEFINE_BOOL(sampling_heap_profiler_suppress_randomness, false,
@@ -921,7 +960,6 @@ DEFINE_BOOL(native_code_counters, false,
 
 // objects.cc
 DEFINE_BOOL(thin_strings, true, "Enable ThinString support")
-DEFINE_BOOL(trace_weak_arrays, false, "Trace WeakFixedArray usage")
 DEFINE_BOOL(trace_prototype_users, false,
             "Trace updates to prototype user tracking")
 DEFINE_BOOL(use_verbose_printer, true, "allows verbose printing")
@@ -940,9 +978,6 @@ DEFINE_BOOL(preparser_scope_analysis, true,
             "perform scope analysis for preparsed inner functions")
 DEFINE_IMPLICATION(preparser_scope_analysis, aggressive_lazy_inner_functions)
 
-// compiler.cc
-DEFINE_BOOL(background_compile, false, "enable background compilation")
-
 // simulator-arm.cc, simulator-arm64.cc and simulator-mips.cc
 DEFINE_BOOL(trace_sim, false, "Trace simulator execution")
 DEFINE_BOOL(debug_sim, false, "Enable debugging the simulator")
@@ -1028,6 +1063,11 @@ DEFINE_STRING(testing_string_flag, "Hello, world!", "string-flag")
 DEFINE_INT(testing_prng_seed, 42, "Seed used for threading test randomness")
 
 // mksnapshot.cc
+DEFINE_STRING(embedded_src, nullptr,
+              "Path for the generated embedded data file. (mksnapshot only)")
+DEFINE_STRING(
+    embedded_variant, nullptr,
+    "Label to disambiguate symbols in embedded data file. (mksnapshot only)")
 DEFINE_STRING(startup_src, nullptr,
               "Write V8 startup as C++ src. (mksnapshot only)")
 DEFINE_STRING(startup_blob, nullptr,
@@ -1277,6 +1317,7 @@ DEFINE_BOOL(predictable, false, "enable predictable mode")
 DEFINE_IMPLICATION(predictable, single_threaded)
 DEFINE_NEG_IMPLICATION(predictable, memory_reducer)
 DEFINE_VALUE_IMPLICATION(single_threaded, wasm_num_compilation_tasks, 0)
+DEFINE_NEG_IMPLICATION(single_threaded, wasm_async_compilation)
 
 //
 // Threading related flags.
diff --git a/deps/v8/src/frames-inl.h b/deps/v8/src/frames-inl.h
index f5a14471ba9..fe150ca1884 100644
--- a/deps/v8/src/frames-inl.h
+++ b/deps/v8/src/frames-inl.h
@@ -270,7 +270,7 @@ JavaScriptFrame* StackTraceFrameIterator::javascript_frame() const {
 inline StackFrame* SafeStackFrameIterator::frame() const {
   DCHECK(!done());
   DCHECK(frame_->is_java_script() || frame_->is_exit() ||
-         frame_->is_builtin_exit());
+         frame_->is_builtin_exit() || frame_->is_wasm());
   return frame_;
 }
 
diff --git a/deps/v8/src/frames.cc b/deps/v8/src/frames.cc
index d5a04ad9330..15da1d2628e 100644
--- a/deps/v8/src/frames.cc
+++ b/deps/v8/src/frames.cc
@@ -177,18 +177,28 @@ bool IsInterpreterFramePc(Isolate* isolate, Address pc) {
   Code* interpreter_bytecode_dispatch =
       isolate->builtins()->builtin(Builtins::kInterpreterEnterBytecodeDispatch);
 
-  return (pc >= interpreter_entry_trampoline->instruction_start() &&
-          pc < interpreter_entry_trampoline->instruction_end()) ||
-         (pc >= interpreter_bytecode_advance->instruction_start() &&
-          pc < interpreter_bytecode_advance->instruction_end()) ||
-         (pc >= interpreter_bytecode_dispatch->instruction_start() &&
-          pc < interpreter_bytecode_dispatch->instruction_end());
+  return (pc >= interpreter_entry_trampoline->InstructionStart() &&
+          pc < interpreter_entry_trampoline->InstructionEnd()) ||
+         (pc >= interpreter_bytecode_advance->InstructionStart() &&
+          pc < interpreter_bytecode_advance->InstructionEnd()) ||
+         (pc >= interpreter_bytecode_dispatch->InstructionStart() &&
+          pc < interpreter_bytecode_dispatch->InstructionEnd());
 }
 
 DISABLE_ASAN Address ReadMemoryAt(Address address) {
   return Memory::Address_at(address);
 }
 
+WasmInstanceObject* LookupWasmInstanceObjectFromStandardFrame(
+    const StandardFrame* frame) {
+  // TODO(titzer): WASM instances cannot be found from the code in the future.
+  WasmInstanceObject* ret = WasmInstanceObject::GetOwningInstance(
+      frame->isolate()->wasm_engine()->code_manager()->LookupCode(frame->pc()));
+  // This is a live stack frame, there must be a live wasm instance available.
+  DCHECK_NOT_NULL(ret);
+  return ret;
+}
+
 }  // namespace
 
 SafeStackFrameIterator::SafeStackFrameIterator(
@@ -349,7 +359,7 @@ void SafeStackFrameIterator::Advance() {
       last_callback_scope = external_callback_scope_;
       external_callback_scope_ = external_callback_scope_->previous();
     }
-    if (frame_->is_java_script()) break;
+    if (frame_->is_java_script() || frame_->is_wasm()) break;
     if (frame_->is_exit() || frame_->is_builtin_exit()) {
       // Some of the EXIT frames may have ExternalCallbackScope allocated on
       // top of them. In that case the scope corresponds to the first EXIT
@@ -376,8 +386,8 @@ Code* GetContainingCode(Isolate* isolate, Address pc) {
 
 Code* StackFrame::LookupCode() const {
   Code* result = GetContainingCode(isolate(), pc());
-  DCHECK_GE(pc(), result->instruction_start());
-  DCHECK_LT(pc(), result->instruction_end());
+  DCHECK_GE(pc(), result->InstructionStart());
+  DCHECK_LT(pc(), result->InstructionEnd());
   return result;
 }
 
@@ -385,12 +395,12 @@ void StackFrame::IteratePc(RootVisitor* v, Address* pc_address,
                            Address* constant_pool_address, Code* holder) {
   Address pc = *pc_address;
   DCHECK(holder->GetHeap()->GcSafeCodeContains(holder, pc));
-  unsigned pc_offset = static_cast<unsigned>(pc - holder->instruction_start());
+  unsigned pc_offset = static_cast<unsigned>(pc - holder->InstructionStart());
   Object* code = holder;
-  v->VisitRootPointer(Root::kTop, &code);
+  v->VisitRootPointer(Root::kTop, nullptr, &code);
   if (code == holder) return;
   holder = reinterpret_cast<Code*>(code);
-  pc = holder->instruction_start() + pc_offset;
+  pc = holder->InstructionStart() + pc_offset;
   *pc_address = pc;
   if (FLAG_enable_embedded_constant_pool && constant_pool_address) {
     *constant_pool_address = holder->constant_pool();
@@ -435,10 +445,8 @@ StackFrame::Type StackFrame::ComputeType(const StackFrameIteratorBase* iterator,
     }
   } else {
     Address pc = *(state->pc_address);
-    // If FLAG_wasm_jit_to_native is disabled, we still have an empty
-    // wasm_code_manager, and this test will be false. This is easier to read
-    // than checking the flag, then getting the code, and then, if both are true
-    // (non-null, respectivelly), going down the wasm_code path.
+    // If the {pc} does not point into WebAssembly code we can rely on the
+    // returned {wasm_code} to be null and fall back to {GetContainingCode}.
     wasm::WasmCode* wasm_code =
         iterator->isolate()->wasm_engine()->code_manager()->LookupCode(pc);
     if (wasm_code != nullptr) {
@@ -600,7 +608,7 @@ void ExitFrame::Iterate(RootVisitor* v) const {
   // The arguments are traversed as part of the expression stack of
   // the calling frame.
   IteratePc(v, pc_address(), constant_pool_address(), LookupCode());
-  v->VisitRootPointer(Root::kTop, &code_slot());
+  v->VisitRootPointer(Root::kTop, nullptr, &code_slot());
 }
 
 
@@ -688,8 +696,28 @@ void PrintIndex(StringStream* accumulator, StackFrame::PrintMode mode,
                 int index) {
   accumulator->Add((mode == StackFrame::OVERVIEW) ? "%5d: " : "[%d]: ", index);
 }
+
+const char* StringForStackFrameType(StackFrame::Type type) {
+  switch (type) {
+#define CASE(value, name) \
+  case StackFrame::value: \
+    return #name;
+    STACK_FRAME_TYPE_LIST(CASE)
+#undef CASE
+    default:
+      UNREACHABLE();
+  }
+}
 }  // namespace
 
+void StackFrame::Print(StringStream* accumulator, PrintMode mode,
+                       int index) const {
+  DisallowHeapAllocation no_gc;
+  PrintIndex(accumulator, mode, index);
+  accumulator->Add(StringForStackFrameType(type()));
+  accumulator->Add(" [pc: %p]\n", pc());
+}
+
 void BuiltinExitFrame::Print(StringStream* accumulator, PrintMode mode,
                              int index) const {
   DisallowHeapAllocation no_gc;
@@ -785,9 +813,7 @@ void StandardFrame::IterateCompiledFrame(RootVisitor* v) const {
   // Find the code and compute the safepoint information.
   Address inner_pointer = pc();
   const wasm::WasmCode* wasm_code =
-      FLAG_wasm_jit_to_native
-          ? isolate()->wasm_engine()->code_manager()->LookupCode(inner_pointer)
-          : nullptr;
+      isolate()->wasm_engine()->code_manager()->LookupCode(inner_pointer);
   SafepointEntry safepoint_entry;
   uint32_t stack_slots;
   Code* code = nullptr;
@@ -868,7 +894,7 @@ void StandardFrame::IterateCompiledFrame(RootVisitor* v) const {
 
   // Visit the parameters that may be on top of the saved registers.
   if (safepoint_entry.argument_count() > 0) {
-    v->VisitRootPointers(Root::kTop, parameters_base,
+    v->VisitRootPointers(Root::kTop, nullptr, parameters_base,
                          parameters_base + safepoint_entry.argument_count());
     parameters_base += safepoint_entry.argument_count();
   }
@@ -887,7 +913,8 @@ void StandardFrame::IterateCompiledFrame(RootVisitor* v) const {
     for (int i = kNumSafepointRegisters - 1; i >=0; i--) {
       if (safepoint_entry.HasRegisterAt(i)) {
         int reg_stack_index = MacroAssembler::SafepointRegisterStackIndex(i);
-        v->VisitRootPointer(Root::kTop, parameters_base + reg_stack_index);
+        v->VisitRootPointer(Root::kTop, nullptr,
+                            parameters_base + reg_stack_index);
       }
     }
     // Skip the words containing the register values.
@@ -900,7 +927,8 @@ void StandardFrame::IterateCompiledFrame(RootVisitor* v) const {
 
   // Visit the rest of the parameters if they are tagged.
   if (has_tagged_params) {
-    v->VisitRootPointers(Root::kTop, parameters_base, parameters_limit);
+    v->VisitRootPointers(Root::kTop, nullptr, parameters_base,
+                         parameters_limit);
   }
 
   // Visit pointer spill slots and locals.
@@ -908,7 +936,7 @@ void StandardFrame::IterateCompiledFrame(RootVisitor* v) const {
     int byte_index = index >> kBitsPerByteLog2;
     int bit_index = index & (kBitsPerByte - 1);
     if ((safepoint_bits[byte_index] & (1U << bit_index)) != 0) {
-      v->VisitRootPointer(Root::kTop, parameters_limit + index);
+      v->VisitRootPointer(Root::kTop, nullptr, parameters_limit + index);
     }
   }
 
@@ -921,7 +949,8 @@ void StandardFrame::IterateCompiledFrame(RootVisitor* v) const {
   if (!is_wasm() && !is_wasm_to_js()) {
     // If this frame has JavaScript ABI, visit the context (in stub and JS
     // frames) and the function (in JS frames).
-    v->VisitRootPointers(Root::kTop, frame_header_base, frame_header_limit);
+    v->VisitRootPointers(Root::kTop, nullptr, frame_header_base,
+                         frame_header_limit);
   }
 }
 
@@ -945,10 +974,10 @@ int StubFrame::LookupExceptionHandlerInTable(int* stack_slots) {
   Code* code = LookupCode();
   DCHECK(code->is_turbofanned());
   DCHECK_EQ(code->kind(), Code::BUILTIN);
-  HandlerTable* table = HandlerTable::cast(code->handler_table());
-  int pc_offset = static_cast<int>(pc() - code->entry());
+  HandlerTable table(code);
+  int pc_offset = static_cast<int>(pc() - code->InstructionStart());
   *stack_slots = code->stack_slots();
-  return table->LookupReturn(pc_offset);
+  return table.LookupReturn(pc_offset);
 }
 
 void OptimizedFrame::Iterate(RootVisitor* v) const { IterateCompiledFrame(v); }
@@ -983,10 +1012,18 @@ Code* JavaScriptFrame::unchecked_code() const {
 int JavaScriptFrame::GetNumberOfIncomingArguments() const {
   DCHECK(can_access_heap_objects() &&
          isolate()->heap()->gc_state() == Heap::NOT_IN_GC);
-
   return function()->shared()->internal_formal_parameter_count();
 }
 
+int OptimizedFrame::GetNumberOfIncomingArguments() const {
+  Code* code = LookupCode();
+  if (code->kind() == Code::BUILTIN) {
+    return static_cast<int>(
+        Memory::intptr_at(fp() + OptimizedBuiltinFrameConstants::kArgCOffset));
+  } else {
+    return JavaScriptFrame::GetNumberOfIncomingArguments();
+  }
+}
 
 Address JavaScriptFrame::GetCallerStackPointer() const {
   return fp() + StandardFrameConstants::kCallerSPOffset;
@@ -1011,7 +1048,7 @@ void JavaScriptFrame::GetFunctions(
 void JavaScriptFrame::Summarize(std::vector<FrameSummary>* functions) const {
   DCHECK(functions->empty());
   Code* code = LookupCode();
-  int offset = static_cast<int>(pc() - code->instruction_start());
+  int offset = static_cast<int>(pc() - code->InstructionStart());
   AbstractCode* abstract_code = AbstractCode::cast(code);
   FrameSummary::JavaScriptFrameSummary summary(isolate(), receiver(),
                                                function(), abstract_code,
@@ -1047,7 +1084,7 @@ Script* JavaScriptFrame::script() const {
 
 int JavaScriptFrame::LookupExceptionHandlerInTable(
     int* stack_depth, HandlerTable::CatchPrediction* prediction) {
-  DCHECK_EQ(0, LookupCode()->handler_table()->length());
+  DCHECK_EQ(0, LookupCode()->handler_table_offset());
   DCHECK(!LookupCode()->is_optimized_code());
   return -1;
 }
@@ -1097,7 +1134,7 @@ void JavaScriptFrame::PrintTop(Isolate* isolate, FILE* file, bool print_args,
         code_offset = iframe->GetBytecodeOffset();
       } else {
         Code* code = frame->unchecked_code();
-        code_offset = static_cast<int>(frame->pc() - code->instruction_start());
+        code_offset = static_cast<int>(frame->pc() - code->InstructionStart());
       }
       PrintFunctionAndOffset(function, function->abstract_code(), code_offset,
                              file, print_line_number);
@@ -1155,7 +1192,7 @@ void JavaScriptFrame::CollectTopFrameForICStats(Isolate* isolate) {
         code_offset = iframe->GetBytecodeOffset();
       } else {
         Code* code = frame->unchecked_code();
-        code_offset = static_cast<int>(frame->pc() - code->instruction_start());
+        code_offset = static_cast<int>(frame->pc() - code->InstructionStart());
       }
       CollectFunctionAndOffsetForICStats(function, function->abstract_code(),
                                          code_offset);
@@ -1269,7 +1306,7 @@ Handle<Context> FrameSummary::WasmFrameSummary::native_context() const {
 }
 
 FrameSummary::WasmCompiledFrameSummary::WasmCompiledFrameSummary(
-    Isolate* isolate, Handle<WasmInstanceObject> instance, WasmCodeWrapper code,
+    Isolate* isolate, Handle<WasmInstanceObject> instance, wasm::WasmCode* code,
     int code_offset, bool at_to_number_conversion)
     : WasmFrameSummary(isolate, WASM_COMPILED, instance,
                        at_to_number_conversion),
@@ -1277,15 +1314,7 @@ FrameSummary::WasmCompiledFrameSummary::WasmCompiledFrameSummary(
       code_offset_(code_offset) {}
 
 uint32_t FrameSummary::WasmCompiledFrameSummary::function_index() const {
-  if (code().IsCodeObject()) {
-    FixedArray* deopt_data = code().GetCode()->deoptimization_data();
-    DCHECK_EQ(2, deopt_data->length());
-    DCHECK(deopt_data->get(1)->IsSmi());
-    int val = Smi::ToInt(deopt_data->get(1));
-    DCHECK_LE(0, val);
-    return static_cast<uint32_t>(val);
-  }
-  return code().GetWasmCode()->index();
+  return code()->index();
 }
 
 int FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
@@ -1293,10 +1322,7 @@ int FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
   int position = 0;
   // Subtract one because the current PC is one instruction after the call site.
   offset--;
-  Handle<ByteArray> source_position_table(
-      ByteArray::cast(code->owner()->compiled_module()->source_positions()->get(
-          code->index())));
-  for (SourcePositionTableIterator iterator(source_position_table);
+  for (SourcePositionTableIterator iterator(code->source_positions());
        !iterator.done() && iterator.code_offset() <= offset;
        iterator.Advance()) {
     position = iterator.source_position().ScriptOffset();
@@ -1305,10 +1331,7 @@ int FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
 }
 
 int FrameSummary::WasmCompiledFrameSummary::byte_offset() const {
-  if (code().IsCodeObject()) {
-    return AbstractCode::cast(*code().GetCode())->SourcePosition(code_offset());
-  }
-  return GetWasmSourcePosition(code_.GetWasmCode(), code_offset());
+  return GetWasmSourcePosition(code_, code_offset());
 }
 
 FrameSummary::WasmInterpretedFrameSummary::WasmInterpretedFrameSummary(
@@ -1467,8 +1490,8 @@ int OptimizedFrame::LookupExceptionHandlerInTable(
   // code to perform prediction there.
   DCHECK_NULL(prediction);
   Code* code = LookupCode();
-  HandlerTable* table = HandlerTable::cast(code->handler_table());
-  int pc_offset = static_cast<int>(pc() - code->entry());
+  HandlerTable table(code);
+  int pc_offset = static_cast<int>(pc() - code->InstructionStart());
   if (stack_slots) *stack_slots = code->stack_slots();
 
   // When the return pc has been replaced by a trampoline there won't be
@@ -1479,7 +1502,7 @@ int OptimizedFrame::LookupExceptionHandlerInTable(
     SafepointTable safepoints(code);
     pc_offset = safepoints.find_return_pc(pc_offset);
   }
-  return table->LookupReturn(pc_offset);
+  return table.LookupReturn(pc_offset);
 }
 
 DeoptimizationData* OptimizedFrame::GetDeoptimizationData(
@@ -1588,9 +1611,8 @@ int InterpretedFrame::position() const {
 
 int InterpretedFrame::LookupExceptionHandlerInTable(
     int* context_register, HandlerTable::CatchPrediction* prediction) {
-  BytecodeArray* bytecode = function()->shared()->bytecode_array();
-  HandlerTable* table = HandlerTable::cast(bytecode->handler_table());
-  return table->LookupRange(GetBytecodeOffset(), context_register, prediction);
+  HandlerTable table(function()->shared()->bytecode_array());
+  return table.LookupRange(GetBytecodeOffset(), context_register, prediction);
 }
 
 int InterpretedFrame::GetBytecodeOffset() const {
@@ -1702,18 +1724,15 @@ void WasmCompiledFrame::Print(StringStream* accumulator, PrintMode mode,
   accumulator->Add("WASM [");
   Script* script = this->script();
   accumulator->PrintName(script->name());
-  Address instruction_start = FLAG_wasm_jit_to_native
-                                  ? isolate()
-                                        ->wasm_engine()
-                                        ->code_manager()
-                                        ->LookupCode(pc())
-                                        ->instructions()
-                                        .start()
-                                  : LookupCode()->instruction_start();
+  Address instruction_start = isolate()
+                                  ->wasm_engine()
+                                  ->code_manager()
+                                  ->LookupCode(pc())
+                                  ->instructions()
+                                  .start();
   int pc = static_cast<int>(this->pc() - instruction_start);
-  WasmSharedModuleData* shared = wasm_instance()->compiled_module()->shared();
   Vector<const uint8_t> raw_func_name =
-      shared->GetRawFunctionName(this->function_index());
+      shared()->GetRawFunctionName(this->function_index());
   const int kMaxPrintedFunctionName = 64;
   char func_name[kMaxPrintedFunctionName + 1];
   int func_name_len = std::min(kMaxPrintedFunctionName, raw_func_name.length());
@@ -1736,31 +1755,29 @@ Address WasmCompiledFrame::GetCallerStackPointer() const {
   return fp() + ExitFrameConstants::kCallerSPOffset;
 }
 
-WasmCodeWrapper WasmCompiledFrame::wasm_code() const {
-  return FLAG_wasm_jit_to_native
-             ? WasmCodeWrapper(
-                   isolate()->wasm_engine()->code_manager()->LookupCode(pc()))
-             : WasmCodeWrapper(Handle<Code>(LookupCode(), isolate()));
+wasm::WasmCode* WasmCompiledFrame::wasm_code() const {
+  return isolate()->wasm_engine()->code_manager()->LookupCode(pc());
 }
 
 WasmInstanceObject* WasmCompiledFrame::wasm_instance() const {
-  WasmInstanceObject* obj =
-      FLAG_wasm_jit_to_native
-          ? WasmInstanceObject::GetOwningInstance(
-                isolate()->wasm_engine()->code_manager()->LookupCode(pc()))
-          : WasmInstanceObject::GetOwningInstanceGC(LookupCode());
-  // This is a live stack frame; it must have a live instance.
-  DCHECK_NOT_NULL(obj);
-  return obj;
+  return LookupWasmInstanceObjectFromStandardFrame(this);
+}
+
+WasmSharedModuleData* WasmCompiledFrame::shared() const {
+  return LookupWasmInstanceObjectFromStandardFrame(this)
+      ->compiled_module()
+      ->shared();
+}
+
+WasmCompiledModule* WasmCompiledFrame::compiled_module() const {
+  return LookupWasmInstanceObjectFromStandardFrame(this)->compiled_module();
 }
 
 uint32_t WasmCompiledFrame::function_index() const {
   return FrameSummary::GetSingle(this).AsWasmCompiled().function_index();
 }
 
-Script* WasmCompiledFrame::script() const {
-  return wasm_instance()->compiled_module()->shared()->script();
-}
+Script* WasmCompiledFrame::script() const { return shared()->script(); }
 
 int WasmCompiledFrame::position() const {
   return FrameSummary::GetSingle(this).SourcePosition();
@@ -1768,9 +1785,10 @@ int WasmCompiledFrame::position() const {
 
 void WasmCompiledFrame::Summarize(std::vector<FrameSummary>* functions) const {
   DCHECK(functions->empty());
-  WasmCodeWrapper code = wasm_code();
-  int offset = static_cast<int>(pc() - code.instructions().start());
-  Handle<WasmInstanceObject> instance = code.wasm_instance();
+  wasm::WasmCode* code = wasm_code();
+  int offset = static_cast<int>(pc() - code->instructions().start());
+  Handle<WasmInstanceObject> instance(
+      LookupWasmInstanceObjectFromStandardFrame(this), isolate());
   FrameSummary::WasmCompiledFrameSummary summary(
       isolate(), instance, code, offset, at_to_number_conversion());
   functions->push_back(summary);
@@ -1780,22 +1798,14 @@ bool WasmCompiledFrame::at_to_number_conversion() const {
   // Check whether our callee is a WASM_TO_JS frame, and this frame is at the
   // ToNumber conversion call.
   Address callee_pc = reinterpret_cast<Address>(this->callee_pc());
-  int pos = -1;
-  if (FLAG_wasm_jit_to_native) {
-    wasm::WasmCode* code =
-        callee_pc
-            ? isolate()->wasm_engine()->code_manager()->LookupCode(callee_pc)
-            : nullptr;
-    if (!code || code->kind() != wasm::WasmCode::kWasmToJsWrapper) return false;
-    int offset = static_cast<int>(callee_pc - code->instructions().start());
-    pos = FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(code,
-                                                                        offset);
-  } else {
-    Code* code = callee_pc ? isolate()->FindCodeObject(callee_pc) : nullptr;
-    if (!code || code->kind() != Code::WASM_TO_JS_FUNCTION) return false;
-    int offset = static_cast<int>(callee_pc - code->instruction_start());
-    pos = AbstractCode::cast(code)->SourcePosition(offset);
-  }
+  wasm::WasmCode* code =
+      callee_pc
+          ? isolate()->wasm_engine()->code_manager()->LookupCode(callee_pc)
+          : nullptr;
+  if (!code || code->kind() != wasm::WasmCode::kWasmToJsWrapper) return false;
+  int offset = static_cast<int>(callee_pc - code->instructions().start());
+  int pos = FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
+      code, offset);
   DCHECK(pos == 0 || pos == 1);
   // The imported call has position 0, ToNumber has position 1.
   return !!pos;
@@ -1803,24 +1813,14 @@ bool WasmCompiledFrame::at_to_number_conversion() const {
 
 int WasmCompiledFrame::LookupExceptionHandlerInTable(int* stack_slots) {
   DCHECK_NOT_NULL(stack_slots);
-  if (!FLAG_wasm_jit_to_native) {
-    Code* code = LookupCode();
-    HandlerTable* table = HandlerTable::cast(code->handler_table());
-    int pc_offset = static_cast<int>(pc() - code->entry());
-    *stack_slots = code->stack_slots();
-    return table->LookupReturn(pc_offset);
-  }
   wasm::WasmCode* code =
       isolate()->wasm_engine()->code_manager()->LookupCode(pc());
-  if (!code->IsAnonymous()) {
-    Object* table_entry =
-        code->owner()->compiled_module()->handler_table()->get(code->index());
-    if (table_entry->IsHandlerTable()) {
-      HandlerTable* table = HandlerTable::cast(table_entry);
-      int pc_offset = static_cast<int>(pc() - code->instructions().start());
-      *stack_slots = static_cast<int>(code->stack_slots());
-      return table->LookupReturn(pc_offset);
-    }
+  if (!code->IsAnonymous() && code->handler_table_offset() > 0) {
+    HandlerTable table(code->instructions().start(),
+                       code->handler_table_offset());
+    int pc_offset = static_cast<int>(pc() - code->instructions().start());
+    *stack_slots = static_cast<int>(code->stack_slots());
+    return table.LookupReturn(pc_offset);
   }
   return -1;
 }
@@ -1841,7 +1841,8 @@ void WasmInterpreterEntryFrame::Print(StringStream* accumulator, PrintMode mode,
 
 void WasmInterpreterEntryFrame::Summarize(
     std::vector<FrameSummary>* functions) const {
-  Handle<WasmInstanceObject> instance(wasm_instance(), isolate());
+  Handle<WasmInstanceObject> instance(
+      LookupWasmInstanceObjectFromStandardFrame(this), isolate());
   std::vector<std::pair<uint32_t, int>> interpreted_stack =
       instance->debug_info()->GetInterpretedStack(fp());
 
@@ -1852,35 +1853,35 @@ void WasmInterpreterEntryFrame::Summarize(
   }
 }
 
-Code* WasmInterpreterEntryFrame::unchecked_code() const {
-  if (FLAG_wasm_jit_to_native) {
-    UNIMPLEMENTED();
-  } else {
-    return isolate()->FindCodeObject(pc());
-  }
-}
+Code* WasmInterpreterEntryFrame::unchecked_code() const { UNREACHABLE(); }
 
+// TODO(titzer): deprecate this method.
 WasmInstanceObject* WasmInterpreterEntryFrame::wasm_instance() const {
-  WasmInstanceObject* ret =
-      FLAG_wasm_jit_to_native
-          ? WasmInstanceObject::GetOwningInstance(
-                isolate()->wasm_engine()->code_manager()->LookupCode(pc()))
-          : WasmInstanceObject::GetOwningInstanceGC(LookupCode());
-  // This is a live stack frame, there must be a live wasm instance available.
-  DCHECK_NOT_NULL(ret);
-  return ret;
+  return LookupWasmInstanceObjectFromStandardFrame(this);
+}
+
+WasmDebugInfo* WasmInterpreterEntryFrame::debug_info() const {
+  return LookupWasmInstanceObjectFromStandardFrame(this)->debug_info();
+}
+
+WasmSharedModuleData* WasmInterpreterEntryFrame::shared() const {
+  return LookupWasmInstanceObjectFromStandardFrame(this)
+      ->compiled_module()
+      ->shared();
 }
 
-Script* WasmInterpreterEntryFrame::script() const {
-  return wasm_instance()->compiled_module()->shared()->script();
+WasmCompiledModule* WasmInterpreterEntryFrame::compiled_module() const {
+  return LookupWasmInstanceObjectFromStandardFrame(this)->compiled_module();
 }
 
+Script* WasmInterpreterEntryFrame::script() const { return shared()->script(); }
+
 int WasmInterpreterEntryFrame::position() const {
   return FrameSummary::GetBottom(this).AsWasmInterpreted().SourcePosition();
 }
 
 Object* WasmInterpreterEntryFrame::context() const {
-  return wasm_instance()->compiled_module()->native_context();
+  return compiled_module()->native_context();
 }
 
 Address WasmInterpreterEntryFrame::GetCallerStackPointer() const {
@@ -1918,6 +1919,7 @@ void JavaScriptFrame::Print(StringStream* accumulator,
   Code* code = nullptr;
   if (IsConstructor()) accumulator->Add("new ");
   accumulator->PrintFunction(function, receiver, &code);
+  accumulator->Add(" [%p]", function);
 
   // Get scope information for nicer output, if possible. If code is nullptr, or
   // doesn't contain scope info, scope_info will return 0 for the number of
@@ -1941,7 +1943,7 @@ void JavaScriptFrame::Print(StringStream* accumulator,
       int line = script->GetLineNumber(source_pos) + 1;
       accumulator->Add(":%d] [bytecode=%p offset=%d]", line, bytecodes, offset);
     } else {
-      int function_start_pos = shared->start_position();
+      int function_start_pos = shared->StartPosition();
       int line = script->GetLineNumber(function_start_pos) + 1;
       accumulator->Add(":~%d] [pc=%p]", line, pc);
     }
@@ -2081,7 +2083,7 @@ void StandardFrame::IterateExpressions(RootVisitor* v) const {
   const int offset = StandardFrameConstants::kLastObjectOffset;
   Object** base = &Memory::Object_at(sp());
   Object** limit = &Memory::Object_at(fp() + offset) + 1;
-  v->VisitRootPointers(Root::kTop, base, limit);
+  v->VisitRootPointers(Root::kTop, nullptr, base, limit);
 }
 
 void JavaScriptFrame::Iterate(RootVisitor* v) const {
@@ -2091,9 +2093,7 @@ void JavaScriptFrame::Iterate(RootVisitor* v) const {
 
 void InternalFrame::Iterate(RootVisitor* v) const {
   wasm::WasmCode* wasm_code =
-      FLAG_wasm_jit_to_native
-          ? isolate()->wasm_engine()->code_manager()->LookupCode(pc())
-          : nullptr;
+      isolate()->wasm_engine()->code_manager()->LookupCode(pc());
   if (wasm_code != nullptr) {
     DCHECK(wasm_code->kind() == wasm::WasmCode::kLazyStub);
   } else {
diff --git a/deps/v8/src/frames.h b/deps/v8/src/frames.h
index 0c988770f6f..8e58d37eeb6 100644
--- a/deps/v8/src/frames.h
+++ b/deps/v8/src/frames.h
@@ -5,8 +5,6 @@
 #ifndef V8_FRAMES_H_
 #define V8_FRAMES_H_
 
-#include "src/allocation.h"
-#include "src/flags.h"
 #include "src/handles.h"
 #include "src/objects.h"
 #include "src/objects/code.h"
@@ -18,18 +16,20 @@ namespace wasm {
 class WasmCode;
 }
 
+// Forward declarations.
 class AbstractCode;
 class Debug;
-class ObjectVisitor;
-class StringStream;
-
-// Forward declarations.
 class ExternalCallbackScope;
 class Isolate;
+class ObjectVisitor;
 class RootVisitor;
 class StackFrameIteratorBase;
+class StringStream;
 class ThreadLocalTop;
+class WasmCompiledModule;
+class WasmDebugInfo;
 class WasmInstanceObject;
+class WasmSharedModuleData;
 
 class InnerPointerToCodeCache {
  public:
@@ -286,9 +286,8 @@ class StackFrame BASE_EMBEDDED {
 
   // Printing support.
   enum PrintMode { OVERVIEW, DETAILS };
-  virtual void Print(StringStream* accumulator,
-                     PrintMode mode,
-                     int index) const { }
+  virtual void Print(StringStream* accumulator, PrintMode mode,
+                     int index) const;
 
   Isolate* isolate() const { return isolate_; }
 
@@ -550,16 +549,16 @@ class FrameSummary BASE_EMBEDDED {
   class WasmCompiledFrameSummary : public WasmFrameSummary {
    public:
     WasmCompiledFrameSummary(Isolate*, Handle<WasmInstanceObject>,
-                             WasmCodeWrapper, int code_offset,
+                             wasm::WasmCode*, int code_offset,
                              bool at_to_number_conversion);
     uint32_t function_index() const;
-    WasmCodeWrapper code() const { return code_; }
+    wasm::WasmCode* code() const { return code_; }
     int code_offset() const { return code_offset_; }
     int byte_offset() const;
     static int GetWasmSourcePosition(const wasm::WasmCode* code, int offset);
 
    private:
-    WasmCodeWrapper const code_;
+    wasm::WasmCode* const code_;
     int code_offset_;
   };
 
@@ -849,6 +848,8 @@ class OptimizedFrame : public JavaScriptFrame {
  protected:
   inline explicit OptimizedFrame(StackFrameIteratorBase* iterator);
 
+  int GetNumberOfIncomingArguments() const override;
+
  private:
   friend class StackFrameIteratorBase;
 
@@ -890,6 +891,11 @@ class InterpretedFrame : public JavaScriptFrame {
 
   static int GetBytecodeOffset(Address fp);
 
+  static InterpretedFrame* cast(StackFrame* frame) {
+    DCHECK(frame->is_interpreted());
+    return static_cast<InterpretedFrame*>(frame);
+  }
+
  protected:
   inline explicit InterpretedFrame(StackFrameIteratorBase* iterator);
 
@@ -968,8 +974,8 @@ class WasmCompiledFrame final : public StandardFrame {
   Code* unchecked_code() const override;
 
   // Accessors.
-  WasmInstanceObject* wasm_instance() const;
-  WasmCodeWrapper wasm_code() const;
+  WasmInstanceObject* wasm_instance() const;  // TODO(titzer): deprecate.
+  wasm::WasmCode* wasm_code() const;
   uint32_t function_index() const;
   Script* script() const override;
   int position() const override;
@@ -989,6 +995,8 @@ class WasmCompiledFrame final : public StandardFrame {
 
  private:
   friend class StackFrameIteratorBase;
+  WasmCompiledModule* compiled_module() const;
+  WasmSharedModuleData* shared() const;
 };
 
 class WasmInterpreterEntryFrame final : public StandardFrame {
@@ -1008,7 +1016,9 @@ class WasmInterpreterEntryFrame final : public StandardFrame {
   Code* unchecked_code() const override;
 
   // Accessors.
-  WasmInstanceObject* wasm_instance() const;
+  WasmDebugInfo* debug_info() const;
+  WasmInstanceObject* wasm_instance() const;  // TODO(titzer): deprecate.
+
   Script* script() const override;
   int position() const override;
   Object* context() const override;
@@ -1025,6 +1035,8 @@ class WasmInterpreterEntryFrame final : public StandardFrame {
 
  private:
   friend class StackFrameIteratorBase;
+  WasmCompiledModule* compiled_module() const;
+  WasmSharedModuleData* shared() const;
 };
 
 class WasmToJsFrame : public StubFrame {
diff --git a/deps/v8/src/gdb-jit.cc b/deps/v8/src/gdb-jit.cc
index de56faa4fd1..027ad5531df 100644
--- a/deps/v8/src/gdb-jit.cc
+++ b/deps/v8/src/gdb-jit.cc
@@ -996,11 +996,7 @@ class CodeDescription BASE_EMBEDDED {
 
   Script* script() { return Script::cast(shared_info_->script()); }
 
-  bool IsLineInfoAvailable() {
-    return has_script() && script()->source()->IsString() &&
-           script()->HasValidSource() && script()->name()->IsString() &&
-           lineinfo_ != nullptr;
-  }
+  bool IsLineInfoAvailable() { return lineinfo_ != nullptr; }
 
 #if V8_TARGET_ARCH_X64
   uintptr_t GetStackStateStartAddress(StackState state) const {
@@ -1015,11 +1011,22 @@ class CodeDescription BASE_EMBEDDED {
 #endif
 
   std::unique_ptr<char[]> GetFilename() {
-    return String::cast(script()->name())->ToCString();
+    if (shared_info_ != nullptr) {
+      return String::cast(script()->name())->ToCString();
+    } else {
+      std::unique_ptr<char[]> result(new char[1]);
+      result[0] = 0;
+      return result;
+    }
   }
 
-  int GetScriptLineNumber(int pos) { return script()->GetLineNumber(pos) + 1; }
-
+  int GetScriptLineNumber(int pos) {
+    if (shared_info_ != nullptr) {
+      return script()->GetLineNumber(pos) + 1;
+    } else {
+      return 0;
+    }
+  }
 
  private:
   const char* name_;
@@ -2167,6 +2174,7 @@ static void AddCode(const char* name, Code* code, SharedFunctionInfo* shared,
 
 void EventHandler(const v8::JitCodeEvent* event) {
   if (!FLAG_gdbjit) return;
+  if (event->code_type != v8::JitCodeEvent::JIT_CODE) return;
   base::LockGuard<base::Mutex> lock_guard(mutex.Pointer());
   switch (event->type) {
     case v8::JitCodeEvent::CODE_ADDED: {
diff --git a/deps/v8/src/gdb-jit.h b/deps/v8/src/gdb-jit.h
index b915e71ebe8..7ffc6459fb4 100644
--- a/deps/v8/src/gdb-jit.h
+++ b/deps/v8/src/gdb-jit.h
@@ -36,4 +36,4 @@ void EventHandler(const v8::JitCodeEvent* event);
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_GDB_JIT_H_
diff --git a/deps/v8/src/global-handles.cc b/deps/v8/src/global-handles.cc
index 7845d71fb19..51800d17c35 100644
--- a/deps/v8/src/global-handles.cc
+++ b/deps/v8/src/global-handles.cc
@@ -54,7 +54,7 @@ class GlobalHandles::Node {
     index_ = 0;
     set_active(false);
     set_in_new_space_list(false);
-    parameter_or_next_free_.next_free = nullptr;
+    data_.next_free = nullptr;
     weak_callback_ = nullptr;
   }
 #endif
@@ -65,7 +65,7 @@ class GlobalHandles::Node {
     DCHECK(static_cast<int>(index_) == index);
     set_state(FREE);
     set_in_new_space_list(false);
-    parameter_or_next_free_.next_free = *first_free;
+    data_.next_free = *first_free;
     *first_free = this;
   }
 
@@ -75,7 +75,7 @@ class GlobalHandles::Node {
     class_id_ = v8::HeapProfiler::kPersistentHandleNoClassId;
     set_active(false);
     set_state(NORMAL);
-    parameter_or_next_free_.parameter = nullptr;
+    data_.parameter = nullptr;
     weak_callback_ = nullptr;
     IncreaseBlockUses();
   }
@@ -100,6 +100,7 @@ class GlobalHandles::Node {
   // Object slot accessors.
   Object* object() const { return object_; }
   Object** location() { return &object_; }
+  const char* label() { return state() == NORMAL ? data_.label : nullptr; }
   Handle<Object> handle() { return Handle<Object>(location()); }
 
   // Wrapper class ID accessors.
@@ -185,21 +186,21 @@ class GlobalHandles::Node {
   // Callback parameter accessors.
   void set_parameter(void* parameter) {
     DCHECK(IsInUse());
-    parameter_or_next_free_.parameter = parameter;
+    data_.parameter = parameter;
   }
   void* parameter() const {
     DCHECK(IsInUse());
-    return parameter_or_next_free_.parameter;
+    return data_.parameter;
   }
 
   // Accessors for next free node in the free list.
   Node* next_free() {
     DCHECK(state() == FREE);
-    return parameter_or_next_free_.next_free;
+    return data_.next_free;
   }
   void set_next_free(Node* value) {
     DCHECK(state() == FREE);
-    parameter_or_next_free_.next_free = value;
+    data_.next_free = value;
   }
 
   void MakeWeak(void* parameter,
@@ -241,6 +242,11 @@ class GlobalHandles::Node {
     return p;
   }
 
+  void AnnotateStrongRetainer(const char* label) {
+    DCHECK_EQ(state(), NORMAL);
+    data_.label = label;
+  }
+
   void CollectPhantomCallbackData(
       Isolate* isolate,
       std::vector<PendingPhantomCallback>* pending_phantom_callbacks) {
@@ -346,12 +352,15 @@ class GlobalHandles::Node {
   // Handle specific callback - might be a weak reference in disguise.
   WeakCallbackInfo<void>::Callback weak_callback_;
 
-  // Provided data for callback.  In FREE state, this is used for
-  // the free list link.
+  // The meaning of this field depends on node state:
+  // state == FREE: it stores the next free node pointer.
+  // state == NORMAL: it stores the strong retainer label.
+  // otherwise: it stores the parameter for the weak callback.
   union {
-    void* parameter;
     Node* next_free;
-  } parameter_or_next_free_;
+    const char* label;
+    void* parameter;
+  } data_;
 
   DISALLOW_COPY_AND_ASSIGN(Node);
 };
@@ -447,7 +456,7 @@ void GlobalHandles::Node::IncreaseBlockUses() {
 void GlobalHandles::Node::DecreaseBlockUses() {
   NodeBlock* node_block = FindBlock();
   GlobalHandles* global_handles = node_block->global_handles();
-  parameter_or_next_free_.next_free = global_handles->first_free_;
+  data_.next_free = global_handles->first_free_;
   global_handles->first_free_ = this;
   node_block->DecreaseUses();
   global_handles->isolate()->counters()->global_handles()->Decrement();
@@ -579,6 +588,11 @@ void* GlobalHandles::ClearWeakness(Object** location) {
   return Node::FromLocation(location)->ClearWeakness();
 }
 
+void GlobalHandles::AnnotateStrongRetainer(Object** location,
+                                           const char* label) {
+  Node::FromLocation(location)->AnnotateStrongRetainer(label);
+}
+
 bool GlobalHandles::IsNearDeath(Object** location) {
   return Node::FromLocation(location)->IsNearDeath();
 }
@@ -596,7 +610,8 @@ void GlobalHandles::IterateWeakRootsForFinalizers(RootVisitor* v) {
       DCHECK(!node->IsPhantomCallback());
       DCHECK(!node->IsPhantomResetHandle());
       // Finalizers need to survive.
-      v->VisitRootPointer(Root::kGlobalHandles, node->location());
+      v->VisitRootPointer(Root::kGlobalHandles, node->label(),
+                          node->location());
     }
   }
 }
@@ -635,7 +650,8 @@ void GlobalHandles::IterateNewSpaceStrongAndDependentRoots(RootVisitor* v) {
   for (Node* node : new_space_nodes_) {
     if (node->IsStrongRetainer() ||
         (node->IsWeakRetainer() && node->is_active())) {
-      v->VisitRootPointer(Root::kGlobalHandles, node->location());
+      v->VisitRootPointer(Root::kGlobalHandles, node->label(),
+                          node->location());
     }
   }
 }
@@ -649,7 +665,8 @@ void GlobalHandles::IterateNewSpaceStrongAndDependentRootsAndIdentifyUnmodified(
     }
     if (node->IsStrongRetainer() ||
         (node->IsWeakRetainer() && node->is_active())) {
-      v->VisitRootPointer(Root::kGlobalHandles, node->location());
+      v->VisitRootPointer(Root::kGlobalHandles, node->label(),
+                          node->location());
     }
   }
 }
@@ -685,7 +702,8 @@ void GlobalHandles::IterateNewSpaceWeakUnmodifiedRootsForFinalizers(
       DCHECK(!node->IsPhantomCallback());
       DCHECK(!node->IsPhantomResetHandle());
       // Finalizers need to survive.
-      v->VisitRootPointer(Root::kGlobalHandles, node->location());
+      v->VisitRootPointer(Root::kGlobalHandles, node->label(),
+                          node->location());
     }
   }
 }
@@ -712,7 +730,8 @@ void GlobalHandles::IterateNewSpaceWeakUnmodifiedRootsForPhantomHandles(
         }
       } else {
         // Node survived and needs to be visited.
-        v->VisitRootPointer(Root::kGlobalHandles, node->location());
+        v->VisitRootPointer(Root::kGlobalHandles, node->label(),
+                            node->location());
       }
     }
   }
@@ -858,8 +877,12 @@ void GlobalHandles::PendingPhantomCallback::Invoke(Isolate* isolate) {
   callback_ = nullptr;
   callback(data);
   if (node_ != nullptr) {
-    // Transition to second pass state.
-    DCHECK(node_->state() == Node::FREE);
+    // Transition to second pass. It is required that the first pass callback
+    // resets the handle using |v8::PersistentBase::Reset|. Also see comments on
+    // |v8::WeakCallbackInfo|.
+    CHECK_WITH_MSG(Node::FREE == node_->state(),
+                   "Handle not reset in first callback. See comments on "
+                   "|v8::WeakCallbackInfo|.");
     node_ = nullptr;
   }
 }
@@ -902,17 +925,27 @@ int GlobalHandles::PostGarbageCollectionProcessing(
 void GlobalHandles::IterateStrongRoots(RootVisitor* v) {
   for (NodeIterator it(this); !it.done(); it.Advance()) {
     if (it.node()->IsStrongRetainer()) {
-      v->VisitRootPointer(Root::kGlobalHandles, it.node()->location());
+      v->VisitRootPointer(Root::kGlobalHandles, it.node()->label(),
+                          it.node()->location());
     }
   }
 }
 
+void GlobalHandles::IterateWeakRoots(RootVisitor* v) {
+  for (NodeIterator it(this); !it.done(); it.Advance()) {
+    if (it.node()->IsWeak()) {
+      v->VisitRootPointer(Root::kGlobalHandles, it.node()->label(),
+                          it.node()->location());
+    }
+  }
+}
 
 DISABLE_CFI_PERF
 void GlobalHandles::IterateAllRoots(RootVisitor* v) {
   for (NodeIterator it(this); !it.done(); it.Advance()) {
     if (it.node()->IsRetainer()) {
-      v->VisitRootPointer(Root::kGlobalHandles, it.node()->location());
+      v->VisitRootPointer(Root::kGlobalHandles, it.node()->label(),
+                          it.node()->location());
     }
   }
 }
@@ -921,7 +954,8 @@ DISABLE_CFI_PERF
 void GlobalHandles::IterateAllNewSpaceRoots(RootVisitor* v) {
   for (Node* node : new_space_nodes_) {
     if (node->IsRetainer()) {
-      v->VisitRootPointer(Root::kGlobalHandles, node->location());
+      v->VisitRootPointer(Root::kGlobalHandles, node->label(),
+                          node->location());
     }
   }
 }
@@ -932,7 +966,8 @@ void GlobalHandles::IterateNewSpaceRoots(RootVisitor* v, size_t start,
   for (size_t i = start; i < end; ++i) {
     Node* node = new_space_nodes_[i];
     if (node->IsRetainer()) {
-      v->VisitRootPointer(Root::kGlobalHandles, node->location());
+      v->VisitRootPointer(Root::kGlobalHandles, node->label(),
+                          node->location());
     }
   }
 }
@@ -1054,7 +1089,7 @@ void EternalHandles::IterateAllRoots(RootVisitor* visitor) {
   int limit = size_;
   for (Object** block : blocks_) {
     DCHECK_GT(limit, 0);
-    visitor->VisitRootPointers(Root::kEternalHandles, block,
+    visitor->VisitRootPointers(Root::kEternalHandles, nullptr, block,
                                block + Min(limit, kSize));
     limit -= kSize;
   }
@@ -1062,7 +1097,8 @@ void EternalHandles::IterateAllRoots(RootVisitor* visitor) {
 
 void EternalHandles::IterateNewSpaceRoots(RootVisitor* visitor) {
   for (int index : new_space_indices_) {
-    visitor->VisitRootPointer(Root::kEternalHandles, GetLocation(index));
+    visitor->VisitRootPointer(Root::kEternalHandles, nullptr,
+                              GetLocation(index));
   }
 }
 
diff --git a/deps/v8/src/global-handles.h b/deps/v8/src/global-handles.h
index 59b94e371bf..e96b74b8834 100644
--- a/deps/v8/src/global-handles.h
+++ b/deps/v8/src/global-handles.h
@@ -77,6 +77,8 @@ class GlobalHandles {
 
   static void MakeWeak(Object*** location_addr);
 
+  static void AnnotateStrongRetainer(Object** location, const char* label);
+
   void RecordStats(HeapStats* stats);
 
   // Returns the current number of handles to global objects.
@@ -108,10 +110,10 @@ class GlobalHandles {
   int PostGarbageCollectionProcessing(
       GarbageCollector collector, const v8::GCCallbackFlags gc_callback_flags);
 
-  // Iterates over all strong handles.
   void IterateStrongRoots(RootVisitor* v);
 
-  // Iterates over all handles.
+  void IterateWeakRoots(RootVisitor* v);
+
   void IterateAllRoots(RootVisitor* v);
 
   void IterateAllNewSpaceRoots(RootVisitor* v);
diff --git a/deps/v8/src/globals.h b/deps/v8/src/globals.h
index bc28181db19..acc128fa5a0 100644
--- a/deps/v8/src/globals.h
+++ b/deps/v8/src/globals.h
@@ -11,6 +11,7 @@
 #include <limits>
 #include <ostream>
 
+#include "include/v8.h"
 #include "src/base/build_config.h"
 #include "src/base/flags.h"
 #include "src/base/logging.h"
@@ -413,10 +414,8 @@ constexpr int kCodeAlignmentBits = 5;
 constexpr intptr_t kCodeAlignment = 1 << kCodeAlignmentBits;
 constexpr intptr_t kCodeAlignmentMask = kCodeAlignment - 1;
 
-// Weak references are tagged using the second bit in a pointer.
-constexpr int kWeakReferenceTag = 3;
-constexpr int kWeakReferenceTagSize = 2;
-constexpr intptr_t kWeakReferenceTagMask = (1 << kWeakReferenceTagSize) - 1;
+const intptr_t kWeakHeapObjectMask = 1 << 1;
+const intptr_t kClearedWeakHeapObject = 3;
 
 // Zap-value: The value used for zapping dead objects.
 // Should be a recognizable hex value tagged as a failure.
@@ -470,12 +469,14 @@ class FreeStoreAllocationPolicy;
 class FunctionTemplateInfo;
 class MemoryChunk;
 class NumberDictionary;
+class SimpleNumberDictionary;
 class NameDictionary;
 class GlobalDictionary;
 template <typename T> class MaybeHandle;
 template <typename T> class Handle;
 class Heap;
 class HeapObject;
+class HeapObjectReference;
 class IC;
 class InterceptorInfo;
 class Isolate;
@@ -488,10 +489,12 @@ class MacroAssembler;
 class Map;
 class MapSpace;
 class MarkCompactCollector;
+class MaybeObject;
 class NewSpace;
 class Object;
 class OldSpace;
 class ParameterCount;
+class ReadOnlySpace;
 class Foreign;
 class Scope;
 class DeclarationScope;
@@ -519,44 +522,27 @@ typedef bool (*WeakSlotCallbackWithHeap)(Heap* heap, Object** pointer);
 
 // NOTE: SpaceIterator depends on AllocationSpace enumeration values being
 // consecutive.
-// Keep this enum in sync with the ObjectSpace enum in v8.h
 enum AllocationSpace {
+  // TODO(v8:7464): Actually map this space's memory as read-only.
+  RO_SPACE,    // Immortal, immovable and immutable objects,
   NEW_SPACE,   // Semispaces collected with copying collector.
   OLD_SPACE,   // May contain pointers to new space.
   CODE_SPACE,  // No pointers to new space, marked executable.
   MAP_SPACE,   // Only and all map objects.
   LO_SPACE,    // Promoted large objects.
 
-  FIRST_SPACE = NEW_SPACE,
+  FIRST_SPACE = RO_SPACE,
   LAST_SPACE = LO_SPACE,
-  FIRST_PAGED_SPACE = OLD_SPACE,
-  LAST_PAGED_SPACE = MAP_SPACE
+  FIRST_GROWABLE_PAGED_SPACE = OLD_SPACE,
+  LAST_GROWABLE_PAGED_SPACE = MAP_SPACE
 };
-constexpr int kSpaceTagSize = 3;
+constexpr int kSpaceTagSize = 4;
+STATIC_ASSERT(FIRST_SPACE == 0);
 
 enum AllocationAlignment { kWordAligned, kDoubleAligned, kDoubleUnaligned };
 
 enum class AccessMode { ATOMIC, NON_ATOMIC };
 
-// Possible outcomes for decisions.
-enum class Decision : uint8_t { kUnknown, kTrue, kFalse };
-
-inline size_t hash_value(Decision decision) {
-  return static_cast<uint8_t>(decision);
-}
-
-inline std::ostream& operator<<(std::ostream& os, Decision decision) {
-  switch (decision) {
-    case Decision::kUnknown:
-      return os << "Unknown";
-    case Decision::kTrue:
-      return os << "True";
-    case Decision::kFalse:
-      return os << "False";
-  }
-  UNREACHABLE();
-}
-
 // Supported write barrier modes.
 enum WriteBarrierKind : uint8_t {
   kNoWriteBarrier,
@@ -628,9 +614,6 @@ enum NativesFlag {
   INSPECTOR_CODE
 };
 
-// JavaScript defines two kinds of 'nil'.
-enum NilValue { kNullValue, kUndefinedValue };
-
 // ParseRestriction is used to restrict the set of valid statements in a
 // unit of compilation.  Restriction violations cause a syntax error.
 enum ParseRestriction {
@@ -747,15 +730,6 @@ constexpr int kIeeeDoubleMantissaWordOffset = 4;
 constexpr int kIeeeDoubleExponentWordOffset = 0;
 #endif
 
-// AccessorCallback
-struct AccessorDescriptor {
-  Object* (*getter)(Isolate* isolate, Object* object, void* data);
-  Object* (*setter)(
-      Isolate* isolate, JSObject* object, Object* value, void* data);
-  void* data;
-};
-
-
 // -----------------------------------------------------------------------------
 // Macros
 
@@ -811,8 +785,6 @@ enum CpuFeature {
   MIPSr2,
   MIPSr6,
   MIPS_SIMD,  // MSA instructions
-  // ARM64
-  ALWAYS_ALIGN_CSP,
   // PPC
   FPR_GPR_MOV,
   LWSYNC,
@@ -889,13 +861,6 @@ inline std::ostream& operator<<(std::ostream& os, CreateArgumentsType type) {
   UNREACHABLE();
 }
 
-// Used to specify if a macro instruction must perform a smi check on tagged
-// values.
-enum SmiCheckType {
-  DONT_DO_SMI_CHECK,
-  DO_SMI_CHECK
-};
-
 enum ScopeType : uint8_t {
   EVAL_SCOPE,      // The top-level scope for an eval source.
   FUNCTION_SCOPE,  // The top-level scope for a function.
@@ -906,6 +871,26 @@ enum ScopeType : uint8_t {
   WITH_SCOPE       // The scope introduced by with.
 };
 
+inline std::ostream& operator<<(std::ostream& os, ScopeType type) {
+  switch (type) {
+    case ScopeType::EVAL_SCOPE:
+      return os << "EVAL_SCOPE";
+    case ScopeType::FUNCTION_SCOPE:
+      return os << "FUNCTION_SCOPE";
+    case ScopeType::MODULE_SCOPE:
+      return os << "MODULE_SCOPE";
+    case ScopeType::SCRIPT_SCOPE:
+      return os << "SCRIPT_SCOPE";
+    case ScopeType::CATCH_SCOPE:
+      return os << "CATCH_SCOPE";
+    case ScopeType::BLOCK_SCOPE:
+      return os << "BLOCK_SCOPE";
+    case ScopeType::WITH_SCOPE:
+      return os << "WITH_SCOPE";
+  }
+  UNREACHABLE();
+}
+
 // AllocationSiteMode controls whether allocations are tracked by an allocation
 // site.
 enum AllocationSiteMode {
@@ -1060,99 +1045,60 @@ enum VariableLocation : uint8_t {
 // immediately initialized upon creation (kCreatedInitialized).
 enum InitializationFlag : uint8_t { kNeedsInitialization, kCreatedInitialized };
 
-enum class HoleCheckMode { kRequired, kElided };
-
 enum MaybeAssignedFlag : uint8_t { kNotAssigned, kMaybeAssigned };
 
 // Serialized in PreparseData, so numeric values should not be changed.
 enum ParseErrorType { kSyntaxError = 0, kReferenceError = 1 };
 
-
-enum MinusZeroMode {
-  TREAT_MINUS_ZERO_AS_ZERO,
-  FAIL_ON_MINUS_ZERO
-};
-
-
-enum Signedness { kSigned, kUnsigned };
-
-enum FunctionKind : uint16_t {
-  kNormalFunction = 0,
-  kArrowFunction = 1 << 0,
-  kGeneratorFunction = 1 << 1,
-  kConciseMethod = 1 << 2,
-  kDefaultConstructor = 1 << 3,
-  kDerivedConstructor = 1 << 4,
-  kBaseConstructor = 1 << 5,
-  kGetterFunction = 1 << 6,
-  kSetterFunction = 1 << 7,
-  kAsyncFunction = 1 << 8,
-  kModule = 1 << 9,
-  kClassFieldsInitializerFunction = 1 << 10 | kConciseMethod,
-  kLastFunctionKind = kClassFieldsInitializerFunction,
-
-  kConciseGeneratorMethod = kGeneratorFunction | kConciseMethod,
-  kAccessorFunction = kGetterFunction | kSetterFunction,
-  kDefaultBaseConstructor = kDefaultConstructor | kBaseConstructor,
-  kDefaultDerivedConstructor = kDefaultConstructor | kDerivedConstructor,
-  kClassConstructor =
-      kBaseConstructor | kDerivedConstructor | kDefaultConstructor,
-  kAsyncArrowFunction = kArrowFunction | kAsyncFunction,
-  kAsyncConciseMethod = kAsyncFunction | kConciseMethod,
-
-  // https://tc39.github.io/proposal-async-iteration/
-  kAsyncConciseGeneratorMethod = kAsyncFunction | kConciseGeneratorMethod,
-  kAsyncGeneratorFunction = kAsyncFunction | kGeneratorFunction
+enum FunctionKind : uint8_t {
+  kNormalFunction,
+  kArrowFunction,
+  kGeneratorFunction,
+  kConciseMethod,
+  kDerivedConstructor,
+  kBaseConstructor,
+  kGetterFunction,
+  kSetterFunction,
+  kAsyncFunction,
+  kModule,
+  kClassFieldsInitializerFunction,
+
+  kDefaultBaseConstructor,
+  kDefaultDerivedConstructor,
+  kAsyncArrowFunction,
+  kAsyncConciseMethod,
+
+  kConciseGeneratorMethod,
+  kAsyncConciseGeneratorMethod,
+  kAsyncGeneratorFunction,
+  kLastFunctionKind = kAsyncGeneratorFunction,
 };
 
-inline bool IsValidFunctionKind(FunctionKind kind) {
-  return kind == FunctionKind::kNormalFunction ||
-         kind == FunctionKind::kArrowFunction ||
-         kind == FunctionKind::kGeneratorFunction ||
-         kind == FunctionKind::kModule ||
-         kind == FunctionKind::kConciseMethod ||
-         kind == FunctionKind::kConciseGeneratorMethod ||
-         kind == FunctionKind::kGetterFunction ||
-         kind == FunctionKind::kSetterFunction ||
-         kind == FunctionKind::kAccessorFunction ||
-         kind == FunctionKind::kDefaultBaseConstructor ||
-         kind == FunctionKind::kDefaultDerivedConstructor ||
-         kind == FunctionKind::kBaseConstructor ||
-         kind == FunctionKind::kDerivedConstructor ||
-         kind == FunctionKind::kAsyncFunction ||
-         kind == FunctionKind::kAsyncArrowFunction ||
-         kind == FunctionKind::kAsyncConciseMethod ||
-         kind == FunctionKind::kAsyncConciseGeneratorMethod ||
-         kind == FunctionKind::kAsyncGeneratorFunction ||
-         kind == FunctionKind::kClassFieldsInitializerFunction;
-}
-
-
 inline bool IsArrowFunction(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
-  return (kind & FunctionKind::kArrowFunction) != 0;
+  return kind == FunctionKind::kArrowFunction ||
+         kind == FunctionKind::kAsyncArrowFunction;
 }
 
-
-inline bool IsGeneratorFunction(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
-  return (kind & FunctionKind::kGeneratorFunction) != 0;
+inline bool IsModule(FunctionKind kind) {
+  return kind == FunctionKind::kModule;
 }
 
-inline bool IsModule(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
-  return (kind & FunctionKind::kModule) != 0;
+inline bool IsAsyncGeneratorFunction(FunctionKind kind) {
+  return kind == FunctionKind::kAsyncGeneratorFunction ||
+         kind == FunctionKind::kAsyncConciseGeneratorMethod;
 }
 
-inline bool IsAsyncFunction(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
-  return (kind & FunctionKind::kAsyncFunction) != 0;
+inline bool IsGeneratorFunction(FunctionKind kind) {
+  return kind == FunctionKind::kGeneratorFunction ||
+         kind == FunctionKind::kConciseGeneratorMethod ||
+         IsAsyncGeneratorFunction(kind);
 }
 
-inline bool IsAsyncGeneratorFunction(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
-  const FunctionKind kMask = FunctionKind::kAsyncGeneratorFunction;
-  return (kind & kMask) == kMask;
+inline bool IsAsyncFunction(FunctionKind kind) {
+  return kind == FunctionKind::kAsyncFunction ||
+         kind == FunctionKind::kAsyncArrowFunction ||
+         kind == FunctionKind::kAsyncConciseMethod ||
+         IsAsyncGeneratorFunction(kind);
 }
 
 inline bool IsResumableFunction(FunctionKind kind) {
@@ -1160,50 +1106,47 @@ inline bool IsResumableFunction(FunctionKind kind) {
 }
 
 inline bool IsConciseMethod(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
-  return (kind & FunctionKind::kConciseMethod) != 0;
+  return kind == FunctionKind::kConciseMethod ||
+         kind == FunctionKind::kConciseGeneratorMethod ||
+         kind == FunctionKind::kAsyncConciseMethod ||
+         kind == FunctionKind::kAsyncConciseGeneratorMethod ||
+         kind == FunctionKind::kClassFieldsInitializerFunction;
 }
 
 inline bool IsGetterFunction(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
-  return (kind & FunctionKind::kGetterFunction) != 0;
+  return kind == FunctionKind::kGetterFunction;
 }
 
 inline bool IsSetterFunction(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
-  return (kind & FunctionKind::kSetterFunction) != 0;
+  return kind == FunctionKind::kSetterFunction;
 }
 
 inline bool IsAccessorFunction(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
-  return (kind & FunctionKind::kAccessorFunction) != 0;
+  return kind == FunctionKind::kGetterFunction ||
+         kind == FunctionKind::kSetterFunction;
 }
 
-
 inline bool IsDefaultConstructor(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
-  return (kind & FunctionKind::kDefaultConstructor) != 0;
+  return kind == FunctionKind::kDefaultBaseConstructor ||
+         kind == FunctionKind::kDefaultDerivedConstructor;
 }
 
-
 inline bool IsBaseConstructor(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
-  return (kind & FunctionKind::kBaseConstructor) != 0;
+  return kind == FunctionKind::kBaseConstructor ||
+         kind == FunctionKind::kDefaultBaseConstructor;
 }
 
 inline bool IsDerivedConstructor(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
-  return (kind & FunctionKind::kDerivedConstructor) != 0;
+  return kind == FunctionKind::kDerivedConstructor ||
+         kind == FunctionKind::kDefaultDerivedConstructor;
 }
 
 
 inline bool IsClassConstructor(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
-  return (kind & FunctionKind::kClassConstructor) != 0;
+  return IsBaseConstructor(kind) || IsDerivedConstructor(kind);
 }
 
 inline bool IsClassFieldsInitializerFunction(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
   return kind == FunctionKind::kClassFieldsInitializerFunction;
 }
 
@@ -1216,8 +1159,50 @@ inline bool IsConstructable(FunctionKind kind) {
   return true;
 }
 
+inline std::ostream& operator<<(std::ostream& os, FunctionKind kind) {
+  switch (kind) {
+    case FunctionKind::kNormalFunction:
+      return os << "NormalFunction";
+    case FunctionKind::kArrowFunction:
+      return os << "ArrowFunction";
+    case FunctionKind::kGeneratorFunction:
+      return os << "GeneratorFunction";
+    case FunctionKind::kConciseMethod:
+      return os << "ConciseMethod";
+    case FunctionKind::kDerivedConstructor:
+      return os << "DerivedConstructor";
+    case FunctionKind::kBaseConstructor:
+      return os << "BaseConstructor";
+    case FunctionKind::kGetterFunction:
+      return os << "GetterFunction";
+    case FunctionKind::kSetterFunction:
+      return os << "SetterFunction";
+    case FunctionKind::kAsyncFunction:
+      return os << "AsyncFunction";
+    case FunctionKind::kModule:
+      return os << "Module";
+    case FunctionKind::kClassFieldsInitializerFunction:
+      return os << "ClassFieldsInitializerFunction";
+    case FunctionKind::kDefaultBaseConstructor:
+      return os << "DefaultBaseConstructor";
+    case FunctionKind::kDefaultDerivedConstructor:
+      return os << "DefaultDerivedConstructor";
+    case FunctionKind::kAsyncArrowFunction:
+      return os << "AsyncArrowFunction";
+    case FunctionKind::kAsyncConciseMethod:
+      return os << "AsyncConciseMethod";
+    case FunctionKind::kConciseGeneratorMethod:
+      return os << "ConciseGeneratorMethod";
+    case FunctionKind::kAsyncConciseGeneratorMethod:
+      return os << "AsyncConciseGeneratorMethod";
+    case FunctionKind::kAsyncGeneratorFunction:
+      return os << "AsyncGeneratorFunction";
+  }
+  UNREACHABLE();
+}
+
 enum class InterpreterPushArgsMode : unsigned {
-  kJSFunction,
+  kArrayFunction,
   kWithFinalSpread,
   kOther
 };
@@ -1229,8 +1214,8 @@ inline size_t hash_value(InterpreterPushArgsMode mode) {
 inline std::ostream& operator<<(std::ostream& os,
                                 InterpreterPushArgsMode mode) {
   switch (mode) {
-    case InterpreterPushArgsMode::kJSFunction:
-      return os << "JSFunction";
+    case InterpreterPushArgsMode::kArrayFunction:
+      return os << "ArrayFunction";
     case InterpreterPushArgsMode::kWithFinalSpread:
       return os << "WithFinalSpread";
     case InterpreterPushArgsMode::kOther:
@@ -1406,6 +1391,8 @@ enum ExternalArrayType {
   kExternalFloat32Array,
   kExternalFloat64Array,
   kExternalUint8ClampedArray,
+  kExternalBigInt64Array,
+  kExternalBigUint64Array,
 };
 
 struct AssemblerDebugInfo {
@@ -1462,6 +1449,8 @@ inline std::ostream& operator<<(std::ostream& os,
   return os;
 }
 
+enum class BlockingBehavior { kBlock, kDontBlock };
+
 enum class ConcurrencyMode { kNotConcurrent, kConcurrent };
 
 #define FOR_EACH_ISOLATE_ADDRESS_NAME(C)                       \
@@ -1476,9 +1465,7 @@ enum class ConcurrencyMode { kNotConcurrent, kConcurrent };
   C(PendingHandlerFP, pending_handler_fp)                      \
   C(PendingHandlerSP, pending_handler_sp)                      \
   C(ExternalCaughtException, external_caught_exception)        \
-  C(JSEntrySP, js_entry_sp)                                    \
-  C(MicrotaskQueueBailoutIndex, microtask_queue_bailout_index) \
-  C(MicrotaskQueueBailoutCount, microtask_queue_bailout_count)
+  C(JSEntrySP, js_entry_sp)
 
 enum IsolateAddressId {
 #define DECLARE_ENUM(CamelName, hacker_name) k##CamelName##Address,
@@ -1487,6 +1474,46 @@ enum IsolateAddressId {
       kIsolateAddressCount
 };
 
+V8_INLINE static bool HasWeakHeapObjectTag(const internal::MaybeObject* value) {
+  return ((reinterpret_cast<intptr_t>(value) & kHeapObjectTagMask) ==
+          kWeakHeapObjectTag);
+}
+
+// Object* should never have the weak tag; this variant is for overzealous
+// checking.
+V8_INLINE static bool HasWeakHeapObjectTag(const Object* value) {
+  return ((reinterpret_cast<intptr_t>(value) & kHeapObjectTagMask) ==
+          kWeakHeapObjectTag);
+}
+
+V8_INLINE static bool IsClearedWeakHeapObject(MaybeObject* value) {
+  return reinterpret_cast<intptr_t>(value) == kClearedWeakHeapObject;
+}
+
+V8_INLINE static HeapObject* RemoveWeakHeapObjectMask(
+    HeapObjectReference* value) {
+  return reinterpret_cast<HeapObject*>(reinterpret_cast<intptr_t>(value) &
+                                       ~kWeakHeapObjectMask);
+}
+
+V8_INLINE static HeapObjectReference* AddWeakHeapObjectMask(HeapObject* value) {
+  return reinterpret_cast<HeapObjectReference*>(
+      reinterpret_cast<intptr_t>(value) | kWeakHeapObjectMask);
+}
+
+V8_INLINE static MaybeObject* AddWeakHeapObjectMask(MaybeObject* value) {
+  return reinterpret_cast<MaybeObject*>(reinterpret_cast<intptr_t>(value) |
+                                        kWeakHeapObjectMask);
+}
+
+enum class HeapObjectReferenceType {
+  WEAK,
+  STRONG,
+};
+
+enum class PoisoningMitigationLevel { kOff, kOn };
+enum class LoadSensitivity { kSafe, kNeedsPoisoning };
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/handler-table.cc b/deps/v8/src/handler-table.cc
new file mode 100644
index 00000000000..72e0e6caf8d
--- /dev/null
+++ b/deps/v8/src/handler-table.cc
@@ -0,0 +1,220 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/handler-table.h"
+
+#include <iomanip>
+
+#include "src/assembler-inl.h"
+#include "src/objects-inl.h"
+#include "src/objects/code-inl.h"
+
+namespace v8 {
+namespace internal {
+
+HandlerTable::HandlerTable(Code* code)
+    : HandlerTable(code->InstructionStart(), code->handler_table_offset()) {}
+
+HandlerTable::HandlerTable(BytecodeArray* bytecode_array)
+    : HandlerTable(bytecode_array->handler_table()) {}
+
+HandlerTable::HandlerTable(ByteArray* byte_array)
+    : number_of_entries_(byte_array->length() / kRangeEntrySize /
+                         sizeof(int32_t)),
+#ifdef DEBUG
+      mode_(kRangeBasedEncoding),
+#endif
+      raw_encoded_data_(byte_array->GetDataStartAddress()) {
+}
+
+HandlerTable::HandlerTable(Address instruction_start,
+                           size_t handler_table_offset)
+    : number_of_entries_(0),
+#ifdef DEBUG
+      mode_(kReturnAddressBasedEncoding),
+#endif
+      raw_encoded_data_(instruction_start + handler_table_offset) {
+  if (handler_table_offset > 0) {
+    number_of_entries_ = Memory::int32_at(raw_encoded_data_);
+    raw_encoded_data_ += sizeof(int32_t);
+  }
+}
+
+int HandlerTable::GetRangeStart(int index) const {
+  DCHECK_EQ(kRangeBasedEncoding, mode_);
+  DCHECK_LT(index, NumberOfRangeEntries());
+  int offset = index * kRangeEntrySize + kRangeStartIndex;
+  return Memory::int32_at(raw_encoded_data_ + offset * sizeof(int32_t));
+}
+
+int HandlerTable::GetRangeEnd(int index) const {
+  DCHECK_EQ(kRangeBasedEncoding, mode_);
+  DCHECK_LT(index, NumberOfRangeEntries());
+  int offset = index * kRangeEntrySize + kRangeEndIndex;
+  return Memory::int32_at(raw_encoded_data_ + offset * sizeof(int32_t));
+}
+
+int HandlerTable::GetRangeHandler(int index) const {
+  DCHECK_EQ(kRangeBasedEncoding, mode_);
+  DCHECK_LT(index, NumberOfRangeEntries());
+  int offset = index * kRangeEntrySize + kRangeHandlerIndex;
+  return HandlerOffsetField::decode(
+      Memory::int32_at(raw_encoded_data_ + offset * sizeof(int32_t)));
+}
+
+int HandlerTable::GetRangeData(int index) const {
+  DCHECK_EQ(kRangeBasedEncoding, mode_);
+  DCHECK_LT(index, NumberOfRangeEntries());
+  int offset = index * kRangeEntrySize + kRangeDataIndex;
+  return Memory::int32_at(raw_encoded_data_ + offset * sizeof(int32_t));
+}
+
+HandlerTable::CatchPrediction HandlerTable::GetRangePrediction(
+    int index) const {
+  DCHECK_EQ(kRangeBasedEncoding, mode_);
+  DCHECK_LT(index, NumberOfRangeEntries());
+  int offset = index * kRangeEntrySize + kRangeHandlerIndex;
+  return HandlerPredictionField::decode(
+      Memory::int32_at(raw_encoded_data_ + offset * sizeof(int32_t)));
+}
+
+int HandlerTable::GetReturnOffset(int index) const {
+  DCHECK_EQ(kReturnAddressBasedEncoding, mode_);
+  DCHECK_LT(index, NumberOfReturnEntries());
+  int offset = index * kReturnEntrySize + kReturnOffsetIndex;
+  return Memory::int32_at(raw_encoded_data_ + offset * sizeof(int32_t));
+}
+
+int HandlerTable::GetReturnHandler(int index) const {
+  DCHECK_EQ(kReturnAddressBasedEncoding, mode_);
+  DCHECK_LT(index, NumberOfReturnEntries());
+  int offset = index * kReturnEntrySize + kReturnHandlerIndex;
+  return HandlerOffsetField::decode(
+      Memory::int32_at(raw_encoded_data_ + offset * sizeof(int32_t)));
+}
+
+void HandlerTable::SetRangeStart(int index, int value) {
+  int offset = index * kRangeEntrySize + kRangeStartIndex;
+  Memory::int32_at(raw_encoded_data_ + offset * sizeof(int32_t)) = value;
+}
+
+void HandlerTable::SetRangeEnd(int index, int value) {
+  int offset = index * kRangeEntrySize + kRangeEndIndex;
+  Memory::int32_at(raw_encoded_data_ + offset * sizeof(int32_t)) = value;
+}
+
+void HandlerTable::SetRangeHandler(int index, int handler_offset,
+                                   CatchPrediction prediction) {
+  int value = HandlerOffsetField::encode(handler_offset) |
+              HandlerPredictionField::encode(prediction);
+  int offset = index * kRangeEntrySize + kRangeHandlerIndex;
+  Memory::int32_at(raw_encoded_data_ + offset * sizeof(int32_t)) = value;
+}
+
+void HandlerTable::SetRangeData(int index, int value) {
+  int offset = index * kRangeEntrySize + kRangeDataIndex;
+  Memory::int32_at(raw_encoded_data_ + offset * sizeof(int32_t)) = value;
+}
+
+// static
+int HandlerTable::LengthForRange(int entries) {
+  return entries * kRangeEntrySize * sizeof(int32_t);
+}
+
+// static
+int HandlerTable::EmitReturnTableStart(Assembler* masm, int entries) {
+  masm->DataAlign(sizeof(int32_t));  // Make sure entries are aligned.
+  masm->RecordComment(";;; Exception handler table.");
+  int table_start = masm->pc_offset();
+  masm->dd(entries);
+  return table_start;
+}
+
+// static
+void HandlerTable::EmitReturnEntry(Assembler* masm, int offset, int handler) {
+  masm->dd(offset);
+  masm->dd(HandlerOffsetField::encode(handler));
+}
+
+int HandlerTable::NumberOfRangeEntries() const {
+  DCHECK_EQ(kRangeBasedEncoding, mode_);
+  return number_of_entries_;
+}
+
+int HandlerTable::NumberOfReturnEntries() const {
+  DCHECK_EQ(kReturnAddressBasedEncoding, mode_);
+  return number_of_entries_;
+}
+
+int HandlerTable::LookupRange(int pc_offset, int* data_out,
+                              CatchPrediction* prediction_out) {
+  int innermost_handler = -1;
+#ifdef DEBUG
+  // Assuming that ranges are well nested, we don't need to track the innermost
+  // offsets. This is just to verify that the table is actually well nested.
+  int innermost_start = std::numeric_limits<int>::min();
+  int innermost_end = std::numeric_limits<int>::max();
+#endif
+  for (int i = 0; i < NumberOfRangeEntries(); ++i) {
+    int start_offset = GetRangeStart(i);
+    int end_offset = GetRangeEnd(i);
+    int handler_offset = GetRangeHandler(i);
+    int handler_data = GetRangeData(i);
+    CatchPrediction prediction = GetRangePrediction(i);
+    if (pc_offset >= start_offset && pc_offset < end_offset) {
+      DCHECK_GE(start_offset, innermost_start);
+      DCHECK_LT(end_offset, innermost_end);
+      innermost_handler = handler_offset;
+#ifdef DEBUG
+      innermost_start = start_offset;
+      innermost_end = end_offset;
+#endif
+      if (data_out) *data_out = handler_data;
+      if (prediction_out) *prediction_out = prediction;
+    }
+  }
+  return innermost_handler;
+}
+
+// TODO(turbofan): Make sure table is sorted and use binary search.
+int HandlerTable::LookupReturn(int pc_offset) {
+  for (int i = 0; i < NumberOfReturnEntries(); ++i) {
+    int return_offset = GetReturnOffset(i);
+    if (pc_offset == return_offset) {
+      return GetReturnHandler(i);
+    }
+  }
+  return -1;
+}
+
+#ifdef ENABLE_DISASSEMBLER
+
+void HandlerTable::HandlerTableRangePrint(std::ostream& os) {
+  os << "   from   to       hdlr (prediction,   data)\n";
+  for (int i = 0; i < NumberOfRangeEntries(); ++i) {
+    int pc_start = GetRangeStart(i);
+    int pc_end = GetRangeEnd(i);
+    int handler_offset = GetRangeHandler(i);
+    int handler_data = GetRangeData(i);
+    CatchPrediction prediction = GetRangePrediction(i);
+    os << "  (" << std::setw(4) << pc_start << "," << std::setw(4) << pc_end
+       << ")  ->  " << std::setw(4) << handler_offset
+       << " (prediction=" << prediction << ", data=" << handler_data << ")\n";
+  }
+}
+
+void HandlerTable::HandlerTableReturnPrint(std::ostream& os) {
+  os << "   off      hdlr\n";
+  for (int i = 0; i < NumberOfReturnEntries(); ++i) {
+    int pc_offset = GetReturnOffset(i);
+    int handler_offset = GetReturnHandler(i);
+    os << "  " << std::setw(4) << pc_offset << "  ->  " << std::setw(4)
+       << handler_offset << "\n";
+  }
+}
+
+#endif  // ENABLE_DISASSEMBLER
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/handler-table.h b/deps/v8/src/handler-table.h
new file mode 100644
index 00000000000..c2e282001c1
--- /dev/null
+++ b/deps/v8/src/handler-table.h
@@ -0,0 +1,135 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HANDLER_TABLE_H_
+#define V8_HANDLER_TABLE_H_
+
+#include "src/assert-scope.h"
+#include "src/globals.h"
+#include "src/utils.h"
+
+namespace v8 {
+namespace internal {
+
+class Assembler;
+class ByteArray;
+class BytecodeArray;
+
+// HandlerTable is a byte array containing entries for exception handlers in
+// the code object it is associated with. The tables come in two flavors:
+// 1) Based on ranges: Used for unoptimized code. Stored in a {ByteArray} that
+//    is attached to each {BytecodeArray}. Contains one entry per exception
+//    handler and a range representing the try-block covered by that handler.
+//    Layout looks as follows:
+//      [ range-start , range-end , handler-offset , handler-data ]
+// 2) Based on return addresses: Used for turbofanned code. Stored directly in
+//    the instruction stream of the {Code} object. Contains one entry per
+//    call-site that could throw an exception. Layout looks as follows:
+//      [ return-address-offset , handler-offset ]
+class V8_EXPORT_PRIVATE HandlerTable {
+ public:
+  // Conservative prediction whether a given handler will locally catch an
+  // exception or cause a re-throw to outside the code boundary. Since this is
+  // undecidable it is merely an approximation (e.g. useful for debugger).
+  enum CatchPrediction {
+    UNCAUGHT,     // The handler will (likely) rethrow the exception.
+    CAUGHT,       // The exception will be caught by the handler.
+    PROMISE,      // The exception will be caught and cause a promise rejection.
+    DESUGARING,   // The exception will be caught, but both the exception and
+                  // the catching are part of a desugaring and should therefore
+                  // not be visible to the user (we won't notify the debugger of
+                  // such exceptions).
+    ASYNC_AWAIT,  // The exception will be caught and cause a promise rejection
+                  // in the desugaring of an async function, so special
+                  // async/await handling in the debugger can take place.
+  };
+
+  // Constructors for the various encodings.
+  explicit HandlerTable(Code* code);
+  explicit HandlerTable(ByteArray* byte_array);
+  explicit HandlerTable(BytecodeArray* bytecode_array);
+  explicit HandlerTable(Address instruction_start, size_t handler_table_offset);
+
+  // Getters for handler table based on ranges.
+  int GetRangeStart(int index) const;
+  int GetRangeEnd(int index) const;
+  int GetRangeHandler(int index) const;
+  int GetRangeData(int index) const;
+
+  // Setters for handler table based on ranges.
+  void SetRangeStart(int index, int value);
+  void SetRangeEnd(int index, int value);
+  void SetRangeHandler(int index, int offset, CatchPrediction pred);
+  void SetRangeData(int index, int value);
+
+  // Returns the required length of the underlying byte array.
+  static int LengthForRange(int entries);
+
+  // Emitters for handler table based on return addresses.
+  static int EmitReturnTableStart(Assembler* masm, int entries);
+  static void EmitReturnEntry(Assembler* masm, int offset, int handler);
+
+  // Lookup handler in a table based on ranges. The {pc_offset} is an offset to
+  // the start of the potentially throwing instruction (using return addresses
+  // for this value would be invalid).
+  int LookupRange(int pc_offset, int* data, CatchPrediction* prediction);
+
+  // Lookup handler in a table based on return addresses.
+  int LookupReturn(int pc_offset);
+
+  // Returns the number of entries in the table.
+  int NumberOfRangeEntries() const;
+  int NumberOfReturnEntries() const;
+
+#ifdef ENABLE_DISASSEMBLER
+  void HandlerTableRangePrint(std::ostream& os);   // NOLINT
+  void HandlerTableReturnPrint(std::ostream& os);  // NOLINT
+#endif
+
+ private:
+  enum EncodingMode { kRangeBasedEncoding, kReturnAddressBasedEncoding };
+
+  // Getters for handler table based on ranges.
+  CatchPrediction GetRangePrediction(int index) const;
+
+  // Getters for handler table based on return addresses.
+  int GetReturnOffset(int index) const;
+  int GetReturnHandler(int index) const;
+
+  // Number of entries in the loaded handler table.
+  int number_of_entries_;
+
+#ifdef DEBUG
+  // The encoding mode of the table. Mostly useful for debugging to check that
+  // used accessors and constructors fit together.
+  EncodingMode mode_;
+#endif
+
+  // Direct pointer into the encoded data. This pointer points into object on
+  // the GC heap (either {ByteArray} or {Code}) and hence would become stale
+  // during a collection. Hence we disallow any allocation.
+  Address raw_encoded_data_;
+  DisallowHeapAllocation no_gc_;
+
+  // Layout description for handler table based on ranges.
+  static const int kRangeStartIndex = 0;
+  static const int kRangeEndIndex = 1;
+  static const int kRangeHandlerIndex = 2;
+  static const int kRangeDataIndex = 3;
+  static const int kRangeEntrySize = 4;
+
+  // Layout description for handler table based on return addresses.
+  static const int kReturnOffsetIndex = 0;
+  static const int kReturnHandlerIndex = 1;
+  static const int kReturnEntrySize = 2;
+
+  // Encoding of the {handler} field.
+  class HandlerPredictionField : public BitField<CatchPrediction, 0, 3> {};
+  class HandlerOffsetField : public BitField<int, 3, 29> {};
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HANDLER_TABLE_H_
diff --git a/deps/v8/src/handles.cc b/deps/v8/src/handles.cc
index ef4d4b155ac..cfa65d11b81 100644
--- a/deps/v8/src/handles.cc
+++ b/deps/v8/src/handles.cc
@@ -16,12 +16,9 @@ namespace internal {
 // Handles should be trivially copyable so that they can be efficiently passed
 // by value. If they are not trivially copyable, they cannot be passed in
 // registers.
-static_assert(IS_TRIVIALLY_COPYABLE(HandleBase),
-              "HandleBase should be trivially copyable");
-static_assert(IS_TRIVIALLY_COPYABLE(Handle<Object>),
-              "Handle<Object> should be trivially copyable");
-static_assert(IS_TRIVIALLY_COPYABLE(MaybeHandle<Object>),
-              "MaybeHandle<Object> should be trivially copyable");
+ASSERT_TRIVIALLY_COPYABLE(HandleBase);
+ASSERT_TRIVIALLY_COPYABLE(Handle<Object>);
+ASSERT_TRIVIALLY_COPYABLE(MaybeHandle<Object>);
 
 #ifdef DEBUG
 bool HandleBase::IsDereferenceAllowed(DereferenceCheckMode mode) const {
diff --git a/deps/v8/src/heap-symbols.h b/deps/v8/src/heap-symbols.h
index e747ba27204..a1918cde5cb 100644
--- a/deps/v8/src/heap-symbols.h
+++ b/deps/v8/src/heap-symbols.h
@@ -5,245 +5,259 @@
 #ifndef V8_HEAP_SYMBOLS_H_
 #define V8_HEAP_SYMBOLS_H_
 
-#define INTERNALIZED_STRING_LIST(V)                                         \
-  V(anonymous_function_string, "(anonymous function)")                      \
-  V(anonymous_string, "anonymous")                                          \
-  V(add_string, "add")                                                      \
-  V(apply_string, "apply")                                                  \
-  V(arguments_string, "arguments")                                          \
-  V(Arguments_string, "Arguments")                                          \
-  V(arguments_to_string, "[object Arguments]")                              \
-  V(Array_string, "Array")                                                  \
-  V(ArrayIterator_string, "Array Iterator")                                 \
-  V(assign_string, "assign")                                                \
-  V(async_string, "async")                                                  \
-  V(await_string, "await")                                                  \
-  V(array_to_string, "[object Array]")                                      \
-  V(boolean_to_string, "[object Boolean]")                                  \
-  V(date_to_string, "[object Date]")                                        \
-  V(error_to_string, "[object Error]")                                      \
-  V(function_to_string, "[object Function]")                                \
-  V(number_to_string, "[object Number]")                                    \
-  V(object_to_string, "[object Object]")                                    \
-  V(regexp_to_string, "[object RegExp]")                                    \
-  V(string_to_string, "[object String]")                                    \
-  V(bigint_string, "bigint")                                                \
-  V(BigInt_string, "BigInt")                                                \
-  V(bind_string, "bind")                                                    \
-  V(boolean_string, "boolean")                                              \
-  V(Boolean_string, "Boolean")                                              \
-  V(bound__string, "bound ")                                                \
-  V(buffer_string, "buffer")                                                \
-  V(byte_length_string, "byteLength")                                       \
-  V(byte_offset_string, "byteOffset")                                       \
-  V(call_string, "call")                                                    \
-  V(callee_string, "callee")                                                \
-  V(caller_string, "caller")                                                \
-  V(cell_value_string, "%cell_value")                                       \
-  V(char_at_string, "CharAt")                                               \
-  V(closure_string, "(closure)")                                            \
-  V(column_string, "column")                                                \
-  V(configurable_string, "configurable")                                    \
-  V(constructor_string, "constructor")                                      \
-  V(construct_string, "construct")                                          \
-  V(create_string, "create")                                                \
-  V(currency_string, "currency")                                            \
-  V(Date_string, "Date")                                                    \
-  V(dayperiod_string, "dayperiod")                                          \
-  V(day_string, "day")                                                      \
-  V(decimal_string, "decimal")                                              \
-  V(default_string, "default")                                              \
-  V(defineProperty_string, "defineProperty")                                \
-  V(deleteProperty_string, "deleteProperty")                                \
-  V(did_handle_string, "didHandle")                                         \
-  V(display_name_string, "displayName")                                     \
-  V(done_string, "done")                                                    \
-  V(dotAll_string, "dotAll")                                                \
-  V(dot_catch_string, ".catch")                                             \
-  V(dot_for_string, ".for")                                                 \
-  V(dot_generator_object_string, ".generator_object")                       \
-  V(dot_iterator_string, ".iterator")                                       \
-  V(dot_result_string, ".result")                                           \
-  V(dot_switch_tag_string, ".switch_tag")                                   \
-  V(dot_string, ".")                                                        \
-  V(exec_string, "exec")                                                    \
-  V(entries_string, "entries")                                              \
-  V(enqueue_string, "enqueue")                                              \
-  V(enumerable_string, "enumerable")                                        \
-  V(era_string, "era")                                                      \
-  V(Error_string, "Error")                                                  \
-  V(eval_string, "eval")                                                    \
-  V(EvalError_string, "EvalError")                                          \
-  V(false_string, "false")                                                  \
-  V(flags_string, "flags")                                                  \
-  V(fraction_string, "fraction")                                            \
-  V(function_string, "function")                                            \
-  V(Function_string, "Function")                                            \
-  V(Generator_string, "Generator")                                          \
-  V(getOwnPropertyDescriptor_string, "getOwnPropertyDescriptor")            \
-  V(getOwnPropertyDescriptors_string, "getOwnPropertyDescriptors")          \
-  V(getPrototypeOf_string, "getPrototypeOf")                                \
-  V(get_string, "get")                                                      \
-  V(get_space_string, "get ")                                               \
-  V(global_string, "global")                                                \
-  V(group_string, "group")                                                  \
-  V(groups_string, "groups")                                                \
-  V(has_string, "has")                                                      \
-  V(hour_string, "hour")                                                    \
-  V(ignoreCase_string, "ignoreCase")                                        \
-  V(illegal_access_string, "illegal access")                                \
-  V(illegal_argument_string, "illegal argument")                            \
-  V(index_string, "index")                                                  \
-  V(infinity_string, "infinity")                                            \
-  V(Infinity_string, "Infinity")                                            \
-  V(integer_string, "integer")                                              \
-  V(input_string, "input")                                                  \
-  V(isExtensible_string, "isExtensible")                                    \
-  V(isView_string, "isView")                                                \
-  V(KeyedLoadMonomorphic_string, "KeyedLoadMonomorphic")                    \
-  V(KeyedStoreMonomorphic_string, "KeyedStoreMonomorphic")                  \
-  V(keys_string, "keys")                                                    \
-  V(lastIndex_string, "lastIndex")                                          \
-  V(length_string, "length")                                                \
-  V(let_string, "let")                                                      \
-  V(line_string, "line")                                                    \
-  V(literal_string, "literal")                                              \
-  V(Map_string, "Map")                                                      \
-  V(message_string, "message")                                              \
-  V(minus_Infinity_string, "-Infinity")                                     \
-  V(minus_zero_string, "-0")                                                \
-  V(minusSign_string, "minusSign")                                          \
-  V(minute_string, "minute")                                                \
-  V(Module_string, "Module")                                                \
-  V(month_string, "month")                                                  \
-  V(multiline_string, "multiline")                                          \
-  V(name_string, "name")                                                    \
-  V(native_string, "native")                                                \
-  V(nan_string, "nan")                                                      \
-  V(NaN_string, "NaN")                                                      \
-  V(new_target_string, ".new.target")                                       \
-  V(next_string, "next")                                                    \
-  V(NFC_string, "NFC")                                                      \
-  V(NFD_string, "NFD")                                                      \
-  V(NFKC_string, "NFKC")                                                    \
-  V(NFKD_string, "NFKD")                                                    \
-  V(not_equal, "not-equal")                                                 \
-  V(null_string, "null")                                                    \
-  V(null_to_string, "[object Null]")                                        \
-  V(number_string, "number")                                                \
-  V(Number_string, "Number")                                                \
-  V(object_string, "object")                                                \
-  V(Object_string, "Object")                                                \
-  V(ok, "ok")                                                               \
-  V(one_string, "1")                                                        \
-  V(ownKeys_string, "ownKeys")                                              \
-  V(percentSign_string, "percentSign")                                      \
-  V(plusSign_string, "plusSign")                                            \
-  V(position_string, "position")                                            \
-  V(preventExtensions_string, "preventExtensions")                          \
-  V(Promise_string, "Promise")                                              \
-  V(PromiseResolveThenableJob_string, "PromiseResolveThenableJob")          \
-  V(promise_string, "promise")                                              \
-  V(proto_string, "__proto__")                                              \
-  V(prototype_string, "prototype")                                          \
-  V(proxy_string, "proxy")                                                  \
-  V(Proxy_string, "Proxy")                                                  \
-  V(query_colon_string, "(?:)")                                             \
-  V(RangeError_string, "RangeError")                                        \
-  V(raw_string, "raw")                                                      \
-  V(ReferenceError_string, "ReferenceError")                                \
-  V(RegExp_string, "RegExp")                                                \
-  V(reject_string, "reject")                                                \
-  V(resolve_string, "resolve")                                              \
-  V(return_string, "return")                                                \
-  V(revoke_string, "revoke")                                                \
-  V(script_string, "script")                                                \
-  V(second_string, "second")                                                \
-  V(setPrototypeOf_string, "setPrototypeOf")                                \
-  V(set_space_string, "set ")                                               \
-  V(set_string, "set")                                                      \
-  V(Set_string, "Set")                                                      \
-  V(source_string, "source")                                                \
-  V(sourceText_string, "sourceText")                                        \
-  V(stack_string, "stack")                                                  \
-  V(stackTraceLimit_string, "stackTraceLimit")                              \
-  V(star_default_star_string, "*default*")                                  \
-  V(sticky_string, "sticky")                                                \
-  V(string_string, "string")                                                \
-  V(String_string, "String")                                                \
-  V(symbol_string, "symbol")                                                \
-  V(Symbol_string, "Symbol")                                                \
-  V(symbol_species_string, "[Symbol.species]")                              \
-  V(SyntaxError_string, "SyntaxError")                                      \
-  V(then_string, "then")                                                    \
-  V(this_function_string, ".this_function")                                 \
-  V(this_string, "this")                                                    \
-  V(throw_string, "throw")                                                  \
-  V(timed_out, "timed-out")                                                 \
-  V(timeZoneName_string, "timeZoneName")                                    \
-  V(toJSON_string, "toJSON")                                                \
-  V(toString_string, "toString")                                            \
-  V(true_string, "true")                                                    \
-  V(TypeError_string, "TypeError")                                          \
-  V(type_string, "type")                                                    \
-  V(CompileError_string, "CompileError")                                    \
-  V(LinkError_string, "LinkError")                                          \
-  V(RuntimeError_string, "RuntimeError")                                    \
-  V(undefined_string, "undefined")                                          \
-  V(undefined_to_string, "[object Undefined]")                              \
-  V(unicode_string, "unicode")                                              \
-  V(use_asm_string, "use asm")                                              \
-  V(use_strict_string, "use strict")                                        \
-  V(URIError_string, "URIError")                                            \
-  V(valueOf_string, "valueOf")                                              \
-  V(values_string, "values")                                                \
-  V(value_string, "value")                                                  \
-  V(WeakMap_string, "WeakMap")                                              \
-  V(WeakSet_string, "WeakSet")                                              \
-  V(weekday_string, "weekday")                                              \
-  V(will_handle_string, "willHandle")                                       \
-  V(writable_string, "writable")                                            \
-  V(year_string, "year")                                                    \
+#define INTERNALIZED_STRING_LIST(V)                                \
+  V(add_string, "add")                                             \
+  V(anonymous_function_string, "(anonymous function)")             \
+  V(anonymous_string, "anonymous")                                 \
+  V(apply_string, "apply")                                         \
+  V(Arguments_string, "Arguments")                                 \
+  V(arguments_string, "arguments")                                 \
+  V(arguments_to_string, "[object Arguments]")                     \
+  V(Array_string, "Array")                                         \
+  V(array_to_string, "[object Array]")                             \
+  V(ArrayBuffer_string, "ArrayBuffer")                             \
+  V(ArrayIterator_string, "Array Iterator")                        \
+  V(assign_string, "assign")                                       \
+  V(async_string, "async")                                         \
+  V(await_string, "await")                                         \
+  V(BigInt_string, "BigInt")                                       \
+  V(bigint_string, "bigint")                                       \
+  V(BigInt64Array_string, "BigInt64Array")                         \
+  V(BigUint64Array_string, "BigUint64Array")                       \
+  V(bind_string, "bind")                                           \
+  V(Boolean_string, "Boolean")                                     \
+  V(boolean_string, "boolean")                                     \
+  V(boolean_to_string, "[object Boolean]")                         \
+  V(bound__string, "bound ")                                       \
+  V(buffer_string, "buffer")                                       \
+  V(byte_length_string, "byteLength")                              \
+  V(byte_offset_string, "byteOffset")                              \
+  V(call_string, "call")                                           \
+  V(callee_string, "callee")                                       \
+  V(caller_string, "caller")                                       \
+  V(cell_value_string, "%cell_value")                              \
+  V(char_at_string, "CharAt")                                      \
+  V(closure_string, "(closure)")                                   \
+  V(column_string, "column")                                       \
+  V(CompileError_string, "CompileError")                           \
+  V(configurable_string, "configurable")                           \
+  V(construct_string, "construct")                                 \
+  V(constructor_string, "constructor")                             \
+  V(create_string, "create")                                       \
+  V(currency_string, "currency")                                   \
+  V(Date_string, "Date")                                           \
+  V(date_to_string, "[object Date]")                               \
+  V(day_string, "day")                                             \
+  V(dayperiod_string, "dayperiod")                                 \
+  V(decimal_string, "decimal")                                     \
+  V(default_string, "default")                                     \
+  V(defineProperty_string, "defineProperty")                       \
+  V(deleteProperty_string, "deleteProperty")                       \
+  V(did_handle_string, "didHandle")                                \
+  V(display_name_string, "displayName")                            \
+  V(done_string, "done")                                           \
+  V(dot_catch_string, ".catch")                                    \
+  V(dot_for_string, ".for")                                        \
+  V(dot_generator_object_string, ".generator_object")              \
+  V(dot_iterator_string, ".iterator")                              \
+  V(dot_result_string, ".result")                                  \
+  V(dot_string, ".")                                               \
+  V(dot_switch_tag_string, ".switch_tag")                          \
+  V(dotAll_string, "dotAll")                                       \
+  V(enqueue_string, "enqueue")                                     \
+  V(entries_string, "entries")                                     \
+  V(enumerable_string, "enumerable")                               \
+  V(era_string, "era")                                             \
+  V(Error_string, "Error")                                         \
+  V(error_to_string, "[object Error]")                             \
+  V(eval_string, "eval")                                           \
+  V(EvalError_string, "EvalError")                                 \
+  V(exec_string, "exec")                                           \
+  V(false_string, "false")                                         \
+  V(flags_string, "flags")                                         \
+  V(Float32Array_string, "Float32Array")                           \
+  V(Float64Array_string, "Float64Array")                           \
+  V(fraction_string, "fraction")                                   \
+  V(Function_string, "Function")                                   \
+  V(function_native_code_string, "function () { [native code] }")  \
+  V(function_string, "function")                                   \
+  V(function_to_string, "[object Function]")                       \
+  V(Generator_string, "Generator")                                 \
+  V(get_space_string, "get ")                                      \
+  V(get_string, "get")                                             \
+  V(getOwnPropertyDescriptor_string, "getOwnPropertyDescriptor")   \
+  V(getOwnPropertyDescriptors_string, "getOwnPropertyDescriptors") \
+  V(getPrototypeOf_string, "getPrototypeOf")                       \
+  V(global_string, "global")                                       \
+  V(group_string, "group")                                         \
+  V(groups_string, "groups")                                       \
+  V(has_string, "has")                                             \
+  V(hour_string, "hour")                                           \
+  V(ignoreCase_string, "ignoreCase")                               \
+  V(illegal_access_string, "illegal access")                       \
+  V(illegal_argument_string, "illegal argument")                   \
+  V(index_string, "index")                                         \
+  V(Infinity_string, "Infinity")                                   \
+  V(infinity_string, "infinity")                                   \
+  V(input_string, "input")                                         \
+  V(Int16Array_string, "Int16Array")                               \
+  V(Int32Array_string, "Int32Array")                               \
+  V(Int8Array_string, "Int8Array")                                 \
+  V(integer_string, "integer")                                     \
+  V(isExtensible_string, "isExtensible")                           \
+  V(isView_string, "isView")                                       \
+  V(KeyedLoadMonomorphic_string, "KeyedLoadMonomorphic")           \
+  V(KeyedStoreMonomorphic_string, "KeyedStoreMonomorphic")         \
+  V(keys_string, "keys")                                           \
+  V(lastIndex_string, "lastIndex")                                 \
+  V(length_string, "length")                                       \
+  V(let_string, "let")                                             \
+  V(line_string, "line")                                           \
+  V(LinkError_string, "LinkError")                                 \
+  V(literal_string, "literal")                                     \
+  V(Map_string, "Map")                                             \
+  V(MapIterator_string, "Map Iterator")                            \
+  V(message_string, "message")                                     \
+  V(minus_Infinity_string, "-Infinity")                            \
+  V(minus_zero_string, "-0")                                       \
+  V(minusSign_string, "minusSign")                                 \
+  V(minute_string, "minute")                                       \
+  V(Module_string, "Module")                                       \
+  V(month_string, "month")                                         \
+  V(multiline_string, "multiline")                                 \
+  V(name_string, "name")                                           \
+  V(NaN_string, "NaN")                                             \
+  V(nan_string, "nan")                                             \
+  V(native_string, "native")                                       \
+  V(new_target_string, ".new.target")                              \
+  V(next_string, "next")                                           \
+  V(NFC_string, "NFC")                                             \
+  V(NFD_string, "NFD")                                             \
+  V(NFKC_string, "NFKC")                                           \
+  V(NFKD_string, "NFKD")                                           \
+  V(not_equal, "not-equal")                                        \
+  V(null_string, "null")                                           \
+  V(null_to_string, "[object Null]")                               \
+  V(Number_string, "Number")                                       \
+  V(number_string, "number")                                       \
+  V(number_to_string, "[object Number]")                           \
+  V(Object_string, "Object")                                       \
+  V(object_string, "object")                                       \
+  V(object_to_string, "[object Object]")                           \
+  V(ok, "ok")                                                      \
+  V(one_string, "1")                                               \
+  V(ownKeys_string, "ownKeys")                                     \
+  V(percentSign_string, "percentSign")                             \
+  V(plusSign_string, "plusSign")                                   \
+  V(position_string, "position")                                   \
+  V(preventExtensions_string, "preventExtensions")                 \
+  V(Promise_string, "Promise")                                     \
+  V(promise_string, "promise")                                     \
+  V(PromiseResolveThenableJob_string, "PromiseResolveThenableJob") \
+  V(proto_string, "__proto__")                                     \
+  V(prototype_string, "prototype")                                 \
+  V(proxy_string, "proxy")                                         \
+  V(Proxy_string, "Proxy")                                         \
+  V(query_colon_string, "(?:)")                                    \
+  V(RangeError_string, "RangeError")                               \
+  V(raw_string, "raw")                                             \
+  V(ReconfigureToDataProperty_string, "ReconfigureToDataProperty") \
+  V(ReferenceError_string, "ReferenceError")                       \
+  V(RegExp_string, "RegExp")                                       \
+  V(regexp_to_string, "[object RegExp]")                           \
+  V(reject_string, "reject")                                       \
+  V(resolve_string, "resolve")                                     \
+  V(return_string, "return")                                       \
+  V(revoke_string, "revoke")                                       \
+  V(RuntimeError_string, "RuntimeError")                           \
+  V(Script_string, "Script")                                       \
+  V(script_string, "script")                                       \
+  V(second_string, "second")                                       \
+  V(set_space_string, "set ")                                      \
+  V(Set_string, "Set")                                             \
+  V(set_string, "set")                                             \
+  V(SetIterator_string, "Set Iterator")                            \
+  V(setPrototypeOf_string, "setPrototypeOf")                       \
+  V(SharedArrayBuffer_string, "SharedArrayBuffer")                 \
+  V(source_string, "source")                                       \
+  V(sourceText_string, "sourceText")                               \
+  V(stack_string, "stack")                                         \
+  V(stackTraceLimit_string, "stackTraceLimit")                     \
+  V(star_default_star_string, "*default*")                         \
+  V(sticky_string, "sticky")                                       \
+  V(String_string, "String")                                       \
+  V(string_string, "string")                                       \
+  V(string_to_string, "[object String]")                           \
+  V(symbol_species_string, "[Symbol.species]")                     \
+  V(Symbol_string, "Symbol")                                       \
+  V(symbol_string, "symbol")                                       \
+  V(SyntaxError_string, "SyntaxError")                             \
+  V(then_string, "then")                                           \
+  V(this_function_string, ".this_function")                        \
+  V(this_string, "this")                                           \
+  V(throw_string, "throw")                                         \
+  V(timed_out, "timed-out")                                        \
+  V(timeZoneName_string, "timeZoneName")                           \
+  V(toJSON_string, "toJSON")                                       \
+  V(toString_string, "toString")                                   \
+  V(true_string, "true")                                           \
+  V(TypeError_string, "TypeError")                                 \
+  V(type_string, "type")                                           \
+  V(Uint16Array_string, "Uint16Array")                             \
+  V(Uint32Array_string, "Uint32Array")                             \
+  V(Uint8Array_string, "Uint8Array")                               \
+  V(Uint8ClampedArray_string, "Uint8ClampedArray")                 \
+  V(undefined_string, "undefined")                                 \
+  V(undefined_to_string, "[object Undefined]")                     \
+  V(unicode_string, "unicode")                                     \
+  V(URIError_string, "URIError")                                   \
+  V(use_asm_string, "use asm")                                     \
+  V(use_strict_string, "use strict")                               \
+  V(value_string, "value")                                         \
+  V(valueOf_string, "valueOf")                                     \
+  V(values_string, "values")                                       \
+  V(WeakMap_string, "WeakMap")                                     \
+  V(WeakSet_string, "WeakSet")                                     \
+  V(weekday_string, "weekday")                                     \
+  V(will_handle_string, "willHandle")                              \
+  V(writable_string, "writable")                                   \
+  V(year_string, "year")                                           \
   V(zero_string, "0")
 
-#define PRIVATE_SYMBOL_LIST(V)              \
-  V(array_iteration_kind_symbol)            \
-  V(array_iterator_next_symbol)             \
-  V(array_iterator_object_symbol)           \
-  V(call_site_frame_array_symbol)           \
-  V(call_site_frame_index_symbol)           \
-  V(console_context_id_symbol)              \
-  V(console_context_name_symbol)            \
-  V(class_fields_symbol)                    \
-  V(class_positions_symbol)                 \
-  V(detailed_stack_trace_symbol)            \
-  V(elements_transition_symbol)             \
-  V(error_end_pos_symbol)                   \
-  V(error_script_symbol)                    \
-  V(error_start_pos_symbol)                 \
-  V(frozen_symbol)                          \
-  V(generic_symbol)                         \
-  V(home_object_symbol)                     \
-  V(intl_initialized_marker_symbol)         \
-  V(intl_pattern_symbol)                    \
-  V(intl_resolved_symbol)                   \
-  V(megamorphic_symbol)                     \
-  V(native_context_index_symbol)            \
-  V(nonextensible_symbol)                   \
-  V(not_mapped_symbol)                      \
-  V(premonomorphic_symbol)                  \
-  V(promise_async_stack_id_symbol)          \
-  V(promise_debug_marker_symbol)            \
-  V(promise_forwarding_handler_symbol)      \
-  V(promise_handled_by_symbol)              \
-  V(promise_async_id_symbol)                \
-  V(promise_default_resolve_handler_symbol) \
-  V(promise_default_reject_handler_symbol)  \
-  V(sealed_symbol)                          \
-  V(stack_trace_symbol)                     \
-  V(strict_function_transition_symbol)      \
-  V(wasm_function_index_symbol)             \
-  V(wasm_instance_symbol)                   \
+#define PRIVATE_SYMBOL_LIST(V)         \
+  V(call_site_frame_array_symbol)      \
+  V(call_site_frame_index_symbol)      \
+  V(console_context_id_symbol)         \
+  V(console_context_name_symbol)       \
+  V(class_fields_symbol)               \
+  V(class_positions_symbol)            \
+  V(detailed_stack_trace_symbol)       \
+  V(elements_transition_symbol)        \
+  V(error_end_pos_symbol)              \
+  V(error_script_symbol)               \
+  V(error_start_pos_symbol)            \
+  V(frozen_symbol)                     \
+  V(generator_outer_promise_symbol)    \
+  V(generic_symbol)                    \
+  V(home_object_symbol)                \
+  V(intl_initialized_marker_symbol)    \
+  V(intl_pattern_symbol)               \
+  V(intl_resolved_symbol)              \
+  V(megamorphic_symbol)                \
+  V(native_context_index_symbol)       \
+  V(nonextensible_symbol)              \
+  V(not_mapped_symbol)                 \
+  V(premonomorphic_symbol)             \
+  V(promise_async_stack_id_symbol)     \
+  V(promise_debug_marker_symbol)       \
+  V(promise_forwarding_handler_symbol) \
+  V(promise_handled_by_symbol)         \
+  V(promise_async_id_symbol)           \
+  V(sealed_symbol)                     \
+  V(stack_trace_symbol)                \
+  V(strict_function_transition_symbol) \
+  V(wasm_function_index_symbol)        \
+  V(wasm_instance_symbol)              \
   V(uninitialized_symbol)
 
 #define PUBLIC_SYMBOL_LIST(V)                    \
@@ -296,6 +310,7 @@
   F(MC_CLEAR_WEAK_CELLS)                             \
   F(MC_CLEAR_WEAK_COLLECTIONS)                       \
   F(MC_CLEAR_WEAK_LISTS)                             \
+  F(MC_CLEAR_WEAK_REFERENCES)                        \
   F(MC_EPILOGUE)                                     \
   F(MC_EVACUATE)                                     \
   F(MC_EVACUATE_CANDIDATES)                          \
diff --git a/deps/v8/src/heap/array-buffer-collector.cc b/deps/v8/src/heap/array-buffer-collector.cc
index cf0297bb2a1..412e4ad05ae 100644
--- a/deps/v8/src/heap/array-buffer-collector.cc
+++ b/deps/v8/src/heap/array-buffer-collector.cc
@@ -4,6 +4,7 @@
 
 #include "src/heap/array-buffer-collector.h"
 
+#include "src/base/template-utils.h"
 #include "src/heap/array-buffer-tracker.h"
 #include "src/heap/heap-inl.h"
 
@@ -47,10 +48,9 @@ class ArrayBufferCollector::FreeingTask final : public CancelableTask {
 
 void ArrayBufferCollector::FreeAllocationsOnBackgroundThread() {
   heap_->account_external_memory_concurrently_freed();
-  if (heap_->use_tasks() && FLAG_concurrent_array_buffer_freeing) {
-    FreeingTask* task = new FreeingTask(heap_);
-    V8::GetCurrentPlatform()->CallOnBackgroundThread(
-        task, v8::Platform::kShortRunningTask);
+  if (!heap_->IsTearingDown() && FLAG_concurrent_array_buffer_freeing) {
+    V8::GetCurrentPlatform()->CallOnWorkerThread(
+        base::make_unique<FreeingTask>(heap_));
   } else {
     // Fallback for when concurrency is disabled/restricted.
     FreeAllocations();
diff --git a/deps/v8/src/heap/array-buffer-tracker-inl.h b/deps/v8/src/heap/array-buffer-tracker-inl.h
index 568f149b04a..3ab5aefaaf6 100644
--- a/deps/v8/src/heap/array-buffer-tracker-inl.h
+++ b/deps/v8/src/heap/array-buffer-tracker-inl.h
@@ -54,7 +54,7 @@ void LocalArrayBufferTracker::Free(Callback should_free) {
   for (TrackingData::iterator it = array_buffers_.begin();
        it != array_buffers_.end();) {
     JSArrayBuffer* buffer = reinterpret_cast<JSArrayBuffer*>(*it);
-    const size_t length = buffer->allocation_length();
+    const size_t length = buffer->byte_length()->Number();
     if (should_free(buffer)) {
       buffer->FreeBackingStore();
       it = array_buffers_.erase(it);
diff --git a/deps/v8/src/heap/array-buffer-tracker.cc b/deps/v8/src/heap/array-buffer-tracker.cc
index 5acf9b9bfbb..b09debd589b 100644
--- a/deps/v8/src/heap/array-buffer-tracker.cc
+++ b/deps/v8/src/heap/array-buffer-tracker.cc
@@ -55,9 +55,10 @@ void LocalArrayBufferTracker::Process(Callback callback) {
       void* allocation_base = old_buffer->allocation_base();
       DCHECK_NOT_NULL(allocation_base);
 
-      backing_stores_to_free->emplace_back(allocation_base,
-                                           old_buffer->allocation_length(),
-                                           old_buffer->allocation_mode());
+      backing_stores_to_free->emplace_back(
+          allocation_base, old_buffer->allocation_length(),
+          old_buffer->backing_store(), old_buffer->allocation_mode(),
+          old_buffer->is_wasm_memory());
       it = array_buffers_.erase(it);
     } else {
       UNREACHABLE();
diff --git a/deps/v8/src/heap/concurrent-marking.cc b/deps/v8/src/heap/concurrent-marking.cc
index 44ab099ba8c..3f2ede0bd7e 100644
--- a/deps/v8/src/heap/concurrent-marking.cc
+++ b/deps/v8/src/heap/concurrent-marking.cc
@@ -7,6 +7,8 @@
 #include <stack>
 #include <unordered_map>
 
+#include "include/v8config.h"
+#include "src/base/template-utils.h"
 #include "src/heap/gc-tracer.h"
 #include "src/heap/heap-inl.h"
 #include "src/heap/heap.h"
@@ -90,12 +92,61 @@ class ConcurrentMarkingVisitor final
     return marking_state_.GreyToBlack(object);
   }
 
+  bool AllowDefaultJSObjectVisit() { return false; }
+
+  void ProcessStrongHeapObject(HeapObject* host, Object** slot,
+                               HeapObject* heap_object) {
+    MarkObject(heap_object);
+    MarkCompactCollector::RecordSlot(host, slot, heap_object);
+  }
+
+  void ProcessWeakHeapObject(HeapObject* host, HeapObjectReference** slot,
+                             HeapObject* heap_object) {
+#ifdef THREAD_SANITIZER
+    // Perform a dummy acquire load to tell TSAN that there is no data race
+    // in mark-bit initialization. See MemoryChunk::Initialize for the
+    // corresponding release store.
+    MemoryChunk* chunk = MemoryChunk::FromAddress(heap_object->address());
+    CHECK_NOT_NULL(chunk->synchronized_heap());
+#endif
+    if (marking_state_.IsBlackOrGrey(heap_object)) {
+      // Weak references with live values are directly processed here to
+      // reduce the processing time of weak cells during the main GC
+      // pause.
+      MarkCompactCollector::RecordSlot(host, slot, heap_object);
+    } else {
+      // If we do not know about liveness of the value, we have to process
+      // the reference when we know the liveness of the whole transitive
+      // closure.
+      weak_objects_->weak_references.Push(task_id_, std::make_pair(host, slot));
+    }
+  }
+
   void VisitPointers(HeapObject* host, Object** start, Object** end) override {
     for (Object** slot = start; slot < end; slot++) {
       Object* object = base::AsAtomicPointer::Relaxed_Load(slot);
-      if (!object->IsHeapObject()) continue;
-      MarkObject(HeapObject::cast(object));
-      MarkCompactCollector::RecordSlot(host, slot, object);
+      DCHECK(!HasWeakHeapObjectTag(object));
+      if (object->IsHeapObject()) {
+        ProcessStrongHeapObject(host, slot, HeapObject::cast(object));
+      }
+    }
+  }
+
+  void VisitPointers(HeapObject* host, MaybeObject** start,
+                     MaybeObject** end) override {
+    for (MaybeObject** slot = start; slot < end; slot++) {
+      MaybeObject* object = base::AsAtomicPointer::Relaxed_Load(slot);
+      HeapObject* heap_object;
+      if (object->ToStrongHeapObject(&heap_object)) {
+        // If the reference changes concurrently from strong to weak, the write
+        // barrier will treat the weak reference as strong, so we won't miss the
+        // weak reference.
+        ProcessStrongHeapObject(host, reinterpret_cast<Object**>(slot),
+                                heap_object);
+      } else if (object->ToWeakHeapObject(&heap_object)) {
+        ProcessWeakHeapObject(
+            host, reinterpret_cast<HeapObjectReference**>(slot), heap_object);
+      }
     }
   }
 
@@ -103,6 +154,7 @@ class ConcurrentMarkingVisitor final
     for (int i = 0; i < snapshot.number_of_slots(); i++) {
       Object** slot = snapshot.slot(i);
       Object* object = snapshot.value(i);
+      DCHECK(!HasWeakHeapObjectTag(object));
       if (!object->IsHeapObject()) continue;
       MarkObject(HeapObject::cast(object));
       MarkCompactCollector::RecordSlot(host, slot, object);
@@ -114,18 +166,19 @@ class ConcurrentMarkingVisitor final
   // ===========================================================================
 
   int VisitJSObject(Map* map, JSObject* object) {
-    int size = JSObject::BodyDescriptor::SizeOf(map, object);
-    int used_size = map->UsedInstanceSize();
-    DCHECK_LE(used_size, size);
-    DCHECK_GE(used_size, JSObject::kHeaderSize);
-    const SlotSnapshot& snapshot = MakeSlotSnapshot(map, object, used_size);
-    if (!ShouldVisit(object)) return 0;
-    VisitPointersInSnapshot(object, snapshot);
-    return size;
+    return VisitJSObjectSubclass(map, object);
   }
 
   int VisitJSObjectFast(Map* map, JSObject* object) {
-    return VisitJSObject(map, object);
+    return VisitJSObjectSubclass(map, object);
+  }
+
+  int VisitJSArrayBuffer(Map* map, JSArrayBuffer* object) {
+    return VisitJSObjectSubclass(map, object);
+  }
+
+  int VisitWasmInstanceObject(Map* map, WasmInstanceObject* object) {
+    return VisitJSObjectSubclass(map, object);
   }
 
   int VisitJSApiObject(Map* map, JSObject* object) {
@@ -136,6 +189,17 @@ class ConcurrentMarkingVisitor final
     return 0;
   }
 
+  int VisitJSFunction(Map* map, JSFunction* object) {
+    int size = JSFunction::BodyDescriptorWeak::SizeOf(map, object);
+    int used_size = map->UsedInstanceSize();
+    DCHECK_LE(used_size, size);
+    DCHECK_GE(used_size, JSObject::kHeaderSize);
+    const SlotSnapshot& snapshot = MakeSlotSnapshotWeak(map, object, used_size);
+    if (!ShouldVisit(object)) return 0;
+    VisitPointersInSnapshot(object, snapshot);
+    return size;
+  }
+
   // ===========================================================================
   // Strings with pointers =====================================================
   // ===========================================================================
@@ -187,17 +251,11 @@ class ConcurrentMarkingVisitor final
   // ===========================================================================
 
   int VisitFixedArray(Map* map, FixedArray* object) {
-    // The synchronized_length() function checks that the length is a Smi.
-    // This is not necessarily the case if the array is being left-trimmed.
-    Object* length = object->unchecked_synchronized_length();
-    if (!ShouldVisit(object)) return 0;
-    // The cached length must be the actual length as the array is not black.
-    // Left trimming marks the array black before over-writing the length.
-    DCHECK(length->IsSmi());
-    int size = FixedArray::SizeFor(Smi::ToInt(length));
-    VisitMapPointer(object, object->map_slot());
-    FixedArray::BodyDescriptor::IterateBody(object, size, this);
-    return size;
+    return VisitLeftTrimmableArray(map, object);
+  }
+
+  int VisitFixedDoubleArray(Map* map, FixedDoubleArray* object) {
+    return VisitLeftTrimmableArray(map, object);
   }
 
   // ===========================================================================
@@ -217,7 +275,7 @@ class ConcurrentMarkingVisitor final
     if (!ShouldVisit(object)) return 0;
     int size = BytecodeArray::BodyDescriptorWeak::SizeOf(map, object);
     VisitMapPointer(object, object->map_slot());
-    BytecodeArray::BodyDescriptorWeak::IterateBody(object, size, this);
+    BytecodeArray::BodyDescriptorWeak::IterateBody(map, object, size, this);
     object->MakeOlder();
     return size;
   }
@@ -226,7 +284,7 @@ class ConcurrentMarkingVisitor final
     if (!ShouldVisit(object)) return 0;
     int size = AllocationSite::BodyDescriptorWeak::SizeOf(map, object);
     VisitMapPointer(object, object->map_slot());
-    AllocationSite::BodyDescriptorWeak::IterateBody(object, size, this);
+    AllocationSite::BodyDescriptorWeak::IterateBody(map, object, size, this);
     return size;
   }
 
@@ -234,15 +292,7 @@ class ConcurrentMarkingVisitor final
     if (!ShouldVisit(object)) return 0;
     int size = CodeDataContainer::BodyDescriptorWeak::SizeOf(map, object);
     VisitMapPointer(object, object->map_slot());
-    CodeDataContainer::BodyDescriptorWeak::IterateBody(object, size, this);
-    return size;
-  }
-
-  int VisitJSFunction(Map* map, JSFunction* object) {
-    if (!ShouldVisit(object)) return 0;
-    int size = JSFunction::BodyDescriptorWeak::SizeOf(map, object);
-    VisitMapPointer(object, object->map_slot());
-    JSFunction::BodyDescriptorWeak::IterateBody(object, size, this);
+    CodeDataContainer::BodyDescriptorWeak::IterateBody(map, object, size, this);
     return size;
   }
 
@@ -268,7 +318,7 @@ class ConcurrentMarkingVisitor final
     if (!ShouldVisit(object)) return 0;
     int size = Context::BodyDescriptorWeak::SizeOf(map, object);
     VisitMapPointer(object, object->map_slot());
-    Context::BodyDescriptorWeak::IterateBody(object, size, this);
+    Context::BodyDescriptorWeak::IterateBody(map, object, size, this);
     return size;
   }
 
@@ -276,7 +326,7 @@ class ConcurrentMarkingVisitor final
     if (!ShouldVisit(array)) return 0;
     VisitMapPointer(array, array->map_slot());
     int size = TransitionArray::BodyDescriptor::SizeOf(map, array);
-    TransitionArray::BodyDescriptor::IterateBody(array, size, this);
+    TransitionArray::BodyDescriptor::IterateBody(map, array, size, this);
     weak_objects_->transition_arrays.Push(task_id_, array);
     return size;
   }
@@ -338,18 +388,59 @@ class ConcurrentMarkingVisitor final
       }
     }
 
+    void VisitPointers(HeapObject* host, MaybeObject** start,
+                       MaybeObject** end) override {
+      // This should never happen, because we don't use snapshotting for objects
+      // which contain weak references.
+      UNREACHABLE();
+    }
+
    private:
     SlotSnapshot* slot_snapshot_;
   };
 
+  template <typename T>
+  int VisitJSObjectSubclass(Map* map, T* object) {
+    int size = T::BodyDescriptor::SizeOf(map, object);
+    int used_size = map->UsedInstanceSize();
+    DCHECK_LE(used_size, size);
+    DCHECK_GE(used_size, T::kHeaderSize);
+    const SlotSnapshot& snapshot = MakeSlotSnapshot(map, object, used_size);
+    if (!ShouldVisit(object)) return 0;
+    VisitPointersInSnapshot(object, snapshot);
+    return size;
+  }
+
+  template <typename T>
+  int VisitLeftTrimmableArray(Map* map, T* object) {
+    // The synchronized_length() function checks that the length is a Smi.
+    // This is not necessarily the case if the array is being left-trimmed.
+    Object* length = object->unchecked_synchronized_length();
+    if (!ShouldVisit(object)) return 0;
+    // The cached length must be the actual length as the array is not black.
+    // Left trimming marks the array black before over-writing the length.
+    DCHECK(length->IsSmi());
+    int size = T::SizeFor(Smi::ToInt(length));
+    VisitMapPointer(object, object->map_slot());
+    T::BodyDescriptor::IterateBody(map, object, size, this);
+    return size;
+  }
+
   template <typename T>
   const SlotSnapshot& MakeSlotSnapshot(Map* map, T* object, int size) {
-    // TODO(ulan): Iterate only the existing fields and skip slack at the end
-    // of the object.
     SlotSnapshottingVisitor visitor(&slot_snapshot_);
     visitor.VisitPointer(object,
                          reinterpret_cast<Object**>(object->map_slot()));
-    T::BodyDescriptor::IterateBody(object, size, &visitor);
+    T::BodyDescriptor::IterateBody(map, object, size, &visitor);
+    return slot_snapshot_;
+  }
+
+  template <typename T>
+  const SlotSnapshot& MakeSlotSnapshotWeak(Map* map, T* object, int size) {
+    SlotSnapshottingVisitor visitor(&slot_snapshot_);
+    visitor.VisitPointer(object,
+                         reinterpret_cast<Object**>(object->map_slot()));
+    T::BodyDescriptorWeak::IterateBody(map, object, size, &visitor);
     return slot_snapshot_;
   }
   ConcurrentMarking::MarkingWorklist::View shared_;
@@ -424,18 +515,11 @@ ConcurrentMarking::ConcurrentMarking(Heap* heap, MarkingWorklist* shared,
       shared_(shared),
       bailout_(bailout),
       on_hold_(on_hold),
-      weak_objects_(weak_objects),
-      total_marked_bytes_(0),
-      pending_task_count_(0),
-      task_count_(0) {
+      weak_objects_(weak_objects) {
 // The runtime flag should be set only if the compile time flag was set.
 #ifndef V8_CONCURRENT_MARKING
   CHECK(!FLAG_concurrent_marking);
 #endif
-  for (int i = 0; i <= kMaxTasks; i++) {
-    is_pending_[i] = false;
-    task_state_[i].marked_bytes = 0;
-  }
 }
 
 void ConcurrentMarking::Run(int task_id, TaskState* task_state) {
@@ -443,13 +527,8 @@ void ConcurrentMarking::Run(int task_id, TaskState* task_state) {
                       GCTracer::BackgroundScope::MC_BACKGROUND_MARKING);
   size_t kBytesUntilInterruptCheck = 64 * KB;
   int kObjectsUntilInterrupCheck = 1000;
-  LiveBytesMap* live_bytes = nullptr;
-  {
-    base::LockGuard<base::Mutex> guard(&task_state->lock);
-    live_bytes = &task_state->live_bytes;
-  }
-  ConcurrentMarkingVisitor visitor(shared_, bailout_, live_bytes, weak_objects_,
-                                   task_id);
+  ConcurrentMarkingVisitor visitor(shared_, bailout_, &task_state->live_bytes,
+                                   weak_objects_, task_id);
   double time_ms;
   size_t marked_bytes = 0;
   if (FLAG_trace_concurrent_marking) {
@@ -458,9 +537,9 @@ void ConcurrentMarking::Run(int task_id, TaskState* task_state) {
   }
   {
     TimedScope scope(&time_ms);
+
     bool done = false;
     while (!done) {
-      base::LockGuard<base::Mutex> guard(&task_state->lock);
       size_t current_marked_bytes = 0;
       int objects_processed = 0;
       while (current_marked_bytes < kBytesUntilInterruptCheck &&
@@ -484,19 +563,19 @@ void ConcurrentMarking::Run(int task_id, TaskState* task_state) {
       marked_bytes += current_marked_bytes;
       base::AsAtomicWord::Relaxed_Store<size_t>(&task_state->marked_bytes,
                                                 marked_bytes);
-      if (task_state->interrupt_request.Value()) {
-        task_state->interrupt_condition.Wait(&task_state->lock);
+      if (task_state->preemption_request.Value()) {
+        TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+                     "ConcurrentMarking::Run Preempted");
+        break;
       }
     }
-    {
-      // Take the lock to synchronize with worklist update after
-      // young generation GC.
-      base::LockGuard<base::Mutex> guard(&task_state->lock);
-      bailout_->FlushToGlobal(task_id);
-      on_hold_->FlushToGlobal(task_id);
-    }
+    shared_->FlushToGlobal(task_id);
+    bailout_->FlushToGlobal(task_id);
+    on_hold_->FlushToGlobal(task_id);
+
     weak_objects_->weak_cells.FlushToGlobal(task_id);
     weak_objects_->transition_arrays.FlushToGlobal(task_id);
+    weak_objects_->weak_references.FlushToGlobal(task_id);
     base::AsAtomicWord::Relaxed_Store<size_t>(&task_state->marked_bytes, 0);
     total_marked_bytes_.Increment(marked_bytes);
     {
@@ -514,36 +593,46 @@ void ConcurrentMarking::Run(int task_id, TaskState* task_state) {
 }
 
 void ConcurrentMarking::ScheduleTasks() {
-  DCHECK(heap_->use_tasks());
+  DCHECK(!heap_->IsTearingDown());
   if (!FLAG_concurrent_marking) return;
   base::LockGuard<base::Mutex> guard(&pending_lock_);
+  DCHECK_EQ(0, pending_task_count_);
   if (task_count_ == 0) {
-    // TODO(ulan): Increase the number of tasks for platforms that benefit
-    // from it.
-    task_count_ = static_cast<int>(
-        V8::GetCurrentPlatform()->NumberOfAvailableBackgroundThreads() / 2);
-    task_count_ = Max(Min(task_count_, kMaxTasks), 1);
+    static const int num_cores =
+        V8::GetCurrentPlatform()->NumberOfWorkerThreads() + 1;
+#if defined(V8_OS_MACOSX)
+    // Mac OSX 10.11 and prior seems to have trouble when doing concurrent
+    // marking on competing hyper-threads (regresses Octane/Splay). As such,
+    // only use num_cores/2, leaving one of those for the main thread.
+    // TODO(ulan): Use all cores on Mac 10.12+.
+    task_count_ = Max(1, Min(kMaxTasks, (num_cores / 2) - 1));
+#else   // defined(OS_MACOSX)
+    // On other platforms use all logical cores, leaving one for the main
+    // thread.
+    task_count_ = Max(1, Min(kMaxTasks, num_cores - 1));
+#endif  // defined(OS_MACOSX)
   }
   // Task id 0 is for the main thread.
-  for (int i = 1; i <= task_count_ && pending_task_count_ < task_count_; i++) {
+  for (int i = 1; i <= task_count_; i++) {
     if (!is_pending_[i]) {
       if (FLAG_trace_concurrent_marking) {
         heap_->isolate()->PrintWithTimestamp(
             "Scheduling concurrent marking task %d\n", i);
       }
-      task_state_[i].interrupt_request.SetValue(false);
+      task_state_[i].preemption_request.SetValue(false);
       is_pending_[i] = true;
       ++pending_task_count_;
-      Task* task = new Task(heap_->isolate(), this, &task_state_[i], i);
+      auto task =
+          base::make_unique<Task>(heap_->isolate(), this, &task_state_[i], i);
       cancelable_id_[i] = task->id();
-      V8::GetCurrentPlatform()->CallOnBackgroundThread(
-          task, v8::Platform::kShortRunningTask);
+      V8::GetCurrentPlatform()->CallOnWorkerThread(std::move(task));
     }
   }
+  DCHECK_EQ(task_count_, pending_task_count_);
 }
 
 void ConcurrentMarking::RescheduleTasksIfNeeded() {
-  if (!FLAG_concurrent_marking || !heap_->use_tasks()) return;
+  if (!FLAG_concurrent_marking || heap_->IsTearingDown()) return;
   {
     base::LockGuard<base::Mutex> guard(&pending_lock_);
     if (pending_task_count_ > 0) return;
@@ -553,25 +642,24 @@ void ConcurrentMarking::RescheduleTasksIfNeeded() {
   }
 }
 
-void ConcurrentMarking::WaitForTasks() {
-  if (!FLAG_concurrent_marking) return;
+bool ConcurrentMarking::Stop(StopRequest stop_request) {
+  if (!FLAG_concurrent_marking) return false;
   base::LockGuard<base::Mutex> guard(&pending_lock_);
-  while (pending_task_count_ > 0) {
-    pending_condition_.Wait(&pending_lock_);
-  }
-}
 
-void ConcurrentMarking::EnsureCompleted() {
-  if (!FLAG_concurrent_marking) return;
-  base::LockGuard<base::Mutex> guard(&pending_lock_);
-  CancelableTaskManager* task_manager =
-      heap_->isolate()->cancelable_task_manager();
-  for (int i = 1; i <= task_count_; i++) {
-    if (is_pending_[i]) {
-      if (task_manager->TryAbort(cancelable_id_[i]) ==
-          CancelableTaskManager::kTaskAborted) {
-        is_pending_[i] = false;
-        --pending_task_count_;
+  if (pending_task_count_ == 0) return false;
+
+  if (stop_request != StopRequest::COMPLETE_TASKS_FOR_TESTING) {
+    CancelableTaskManager* task_manager =
+        heap_->isolate()->cancelable_task_manager();
+    for (int i = 1; i <= task_count_; i++) {
+      if (is_pending_[i]) {
+        if (task_manager->TryAbort(cancelable_id_[i]) ==
+            CancelableTaskManager::kTaskAborted) {
+          is_pending_[i] = false;
+          --pending_task_count_;
+        } else if (stop_request == StopRequest::PREEMPT_TASKS) {
+          task_state_[i].preemption_request.SetValue(true);
+        }
       }
     }
   }
@@ -581,6 +669,7 @@ void ConcurrentMarking::EnsureCompleted() {
   for (int i = 1; i <= task_count_; i++) {
     DCHECK(!is_pending_[i]);
   }
+  return true;
 }
 
 void ConcurrentMarking::FlushLiveBytes(
@@ -620,25 +709,14 @@ size_t ConcurrentMarking::TotalMarkedBytes() {
 }
 
 ConcurrentMarking::PauseScope::PauseScope(ConcurrentMarking* concurrent_marking)
-    : concurrent_marking_(concurrent_marking) {
-  if (!FLAG_concurrent_marking) return;
-  // Request task_state for all tasks.
-  for (int i = 1; i <= kMaxTasks; i++) {
-    concurrent_marking_->task_state_[i].interrupt_request.SetValue(true);
-  }
-  // Now take a lock to ensure that the tasks are waiting.
-  for (int i = 1; i <= kMaxTasks; i++) {
-    concurrent_marking_->task_state_[i].lock.Lock();
-  }
+    : concurrent_marking_(concurrent_marking),
+      resume_on_exit_(concurrent_marking_->Stop(
+          ConcurrentMarking::StopRequest::PREEMPT_TASKS)) {
+  DCHECK_IMPLIES(resume_on_exit_, FLAG_concurrent_marking);
 }
 
 ConcurrentMarking::PauseScope::~PauseScope() {
-  if (!FLAG_concurrent_marking) return;
-  for (int i = kMaxTasks; i >= 1; i--) {
-    concurrent_marking_->task_state_[i].interrupt_request.SetValue(false);
-    concurrent_marking_->task_state_[i].interrupt_condition.NotifyAll();
-    concurrent_marking_->task_state_[i].lock.Unlock();
-  }
+  if (resume_on_exit_) concurrent_marking_->RescheduleTasksIfNeeded();
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/concurrent-marking.h b/deps/v8/src/heap/concurrent-marking.h
index 0f0c8bf992e..c5af406e45c 100644
--- a/deps/v8/src/heap/concurrent-marking.h
+++ b/deps/v8/src/heap/concurrent-marking.h
@@ -2,10 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_HEAP_CONCURRENT_MARKING_
-#define V8_HEAP_CONCURRENT_MARKING_
+#ifndef V8_HEAP_CONCURRENT_MARKING_H_
+#define V8_HEAP_CONCURRENT_MARKING_H_
 
+#include "include/v8-platform.h"
 #include "src/allocation.h"
+#include "src/base/atomic-utils.h"
+#include "src/base/platform/condition-variable.h"
+#include "src/base/platform/mutex.h"
 #include "src/cancelable-task.h"
 #include "src/heap/spaces.h"
 #include "src/heap/worklist.h"
@@ -26,26 +30,48 @@ using LiveBytesMap =
 class ConcurrentMarking {
  public:
   // When the scope is entered, the concurrent marking tasks
-  // are paused and are not looking at the heap objects.
+  // are preempted and are not looking at the heap objects, concurrent marking
+  // is resumed when the scope is exited.
   class PauseScope {
    public:
     explicit PauseScope(ConcurrentMarking* concurrent_marking);
     ~PauseScope();
 
    private:
-    ConcurrentMarking* concurrent_marking_;
+    ConcurrentMarking* const concurrent_marking_;
+    const bool resume_on_exit_;
   };
 
-  static const int kMaxTasks = 4;
+  enum class StopRequest {
+    // Preempt ongoing tasks ASAP (and cancel unstarted tasks).
+    PREEMPT_TASKS,
+    // Wait for ongoing tasks to complete (and cancels unstarted tasks).
+    COMPLETE_ONGOING_TASKS,
+    // Wait for all scheduled tasks to complete (only use this in tests that
+    // control the full stack -- otherwise tasks cancelled by the platform can
+    // make this call hang).
+    COMPLETE_TASKS_FOR_TESTING,
+  };
+
+  // TODO(gab): The only thing that prevents this being above 7 is
+  // Worklist::kMaxNumTasks being maxed at 8 (concurrent marking doesn't use
+  // task 0, reserved for the main thread).
+  static constexpr int kMaxTasks = 7;
   using MarkingWorklist = Worklist<HeapObject*, 64 /* segment size */>;
 
   ConcurrentMarking(Heap* heap, MarkingWorklist* shared,
                     MarkingWorklist* bailout, MarkingWorklist* on_hold,
                     WeakObjects* weak_objects);
 
+  // Schedules asynchronous tasks to perform concurrent marking. Objects in the
+  // heap should not be moved while these are active (can be stopped safely via
+  // Stop() or PauseScope).
   void ScheduleTasks();
-  void WaitForTasks();
-  void EnsureCompleted();
+
+  // Stops concurrent marking per |stop_request|'s semantics. Returns true
+  // if concurrent marking was in progress, false otherwise.
+  bool Stop(StopRequest stop_request);
+
   void RescheduleTasksIfNeeded();
   // Flushes the local live bytes into the given marking state.
   void FlushLiveBytes(MajorNonAtomicMarkingState* marking_state);
@@ -59,37 +85,32 @@ class ConcurrentMarking {
 
  private:
   struct TaskState {
-    // When the concurrent marking task has this lock, then objects in the
-    // heap are guaranteed to not move.
-    base::Mutex lock;
-    // The main thread sets this flag to true, when it wants the concurrent
-    // maker to give up the lock.
-    base::AtomicValue<bool> interrupt_request;
-    // The concurrent marker waits on this condition until the request
-    // flag is cleared by the main thread.
-    base::ConditionVariable interrupt_condition;
+    // The main thread sets this flag to true when it wants the concurrent
+    // marker to give up the worker thread.
+    base::AtomicValue<bool> preemption_request;
+
     LiveBytesMap live_bytes;
-    size_t marked_bytes;
+    size_t marked_bytes = 0;
     char cache_line_padding[64];
   };
   class Task;
   void Run(int task_id, TaskState* task_state);
-  Heap* heap_;
-  MarkingWorklist* shared_;
-  MarkingWorklist* bailout_;
-  MarkingWorklist* on_hold_;
-  WeakObjects* weak_objects_;
+  Heap* const heap_;
+  MarkingWorklist* const shared_;
+  MarkingWorklist* const bailout_;
+  MarkingWorklist* const on_hold_;
+  WeakObjects* const weak_objects_;
   TaskState task_state_[kMaxTasks + 1];
-  base::AtomicNumber<size_t> total_marked_bytes_;
+  base::AtomicNumber<size_t> total_marked_bytes_{0};
   base::Mutex pending_lock_;
   base::ConditionVariable pending_condition_;
-  int pending_task_count_;
-  bool is_pending_[kMaxTasks + 1];
-  CancelableTaskManager::Id cancelable_id_[kMaxTasks + 1];
-  int task_count_;
+  int pending_task_count_ = 0;
+  bool is_pending_[kMaxTasks + 1] = {};
+  CancelableTaskManager::Id cancelable_id_[kMaxTasks + 1] = {};
+  int task_count_ = 0;
 };
 
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_HEAP_PAGE_PARALLEL_JOB_
+#endif  // V8_HEAP_CONCURRENT_MARKING_H_
diff --git a/deps/v8/src/heap/gc-tracer.cc b/deps/v8/src/heap/gc-tracer.cc
index 30abe44ca65..9900b343fd6 100644
--- a/deps/v8/src/heap/gc-tracer.cc
+++ b/deps/v8/src/heap/gc-tracer.cc
@@ -152,7 +152,11 @@ GCTracer::GCTracer(Heap* heap)
       new_space_allocation_in_bytes_since_gc_(0),
       old_generation_allocation_in_bytes_since_gc_(0),
       combined_mark_compact_speed_cache_(0.0),
-      start_counter_(0) {
+      start_counter_(0),
+      average_mutator_duration_(0),
+      average_mark_compact_duration_(0),
+      current_mark_compact_mutator_utilization_(1.0),
+      previous_mark_compact_end_time_(0) {
   // All accesses to incremental_marking_scope assume that incremental marking
   // scopes come first.
   STATIC_ASSERT(0 == Scope::FIRST_INCREMENTAL_SCOPE);
@@ -188,6 +192,10 @@ void GCTracer::ResetForTesting() {
   recorded_context_disposal_times_.Reset();
   recorded_survival_ratios_.Reset();
   start_counter_ = 0;
+  average_mutator_duration_ = 0;
+  average_mark_compact_duration_ = 0;
+  current_mark_compact_mutator_utilization_ = 1.0;
+  previous_mark_compact_end_time_ = 0;
   base::LockGuard<base::Mutex> guard(&background_counter_mutex_);
   for (int i = 0; i < BackgroundScope::NUMBER_OF_SCOPES; i++) {
     background_counter_[i].total_duration_ms = 0;
@@ -322,6 +330,9 @@ void GCTracer::Stop(GarbageCollector collector) {
         current_.incremental_marking_scopes[i] = incremental_marking_scopes_[i];
         current_.scopes[i] = incremental_marking_scopes_[i].duration;
       }
+
+      RecordMutatorUtilization(
+          current_.end_time, duration + current_.incremental_marking_duration);
       RecordIncrementalMarkingSpeed(current_.incremental_marking_bytes,
                                     current_.incremental_marking_duration);
       recorded_incremental_mark_compacts_.Push(
@@ -333,6 +344,8 @@ void GCTracer::Stop(GarbageCollector collector) {
     case Event::MARK_COMPACTOR:
       DCHECK_EQ(0u, current_.incremental_marking_bytes);
       DCHECK_EQ(0, current_.incremental_marking_duration);
+      RecordMutatorUtilization(
+          current_.end_time, duration + current_.incremental_marking_duration);
       recorded_mark_compacts_.Push(
           MakeBytesAndDuration(current_.start_object_size, duration));
       ResetIncrementalMarkingCounters();
@@ -469,7 +482,7 @@ void GCTracer::Print() const {
       "[%d:%p] "
       "%8.0f ms: "
       "%s %.1f (%.1f) -> %.1f (%.1f) MB, "
-      "%.1f / %.1f ms %s %s %s\n",
+      "%.1f / %.1f ms %s (average mu = %.3f, current mu = %.3f) %s %s\n",
       base::OS::GetCurrentProcessId(),
       reinterpret_cast<void*>(heap_->isolate()),
       heap_->isolate()->time_millis_since_init(), current_.TypeName(false),
@@ -478,6 +491,8 @@ void GCTracer::Print() const {
       static_cast<double>(current_.end_object_size) / MB,
       static_cast<double>(current_.end_memory_size) / MB, duration,
       TotalExternalTime(), incremental_buffer,
+      AverageMarkCompactMutatorUtilization(),
+      CurrentMarkCompactMutatorUtilization(),
       Heap::GarbageCollectionReasonToString(current_.gc_reason),
       current_.collector_reason != nullptr ? current_.collector_reason : "");
 }
@@ -662,6 +677,7 @@ void GCTracer::PrintNVP() const {
           "clear.weak_cells=%.1f "
           "clear.weak_collections=%.1f "
           "clear.weak_lists=%.1f "
+          "clear.weak_references=%.1f "
           "epilogue=%.1f "
           "evacuate=%.1f "
           "evacuate.candidates=%.1f "
@@ -756,6 +772,7 @@ void GCTracer::PrintNVP() const {
           current_.scopes[Scope::MC_CLEAR_WEAK_CELLS],
           current_.scopes[Scope::MC_CLEAR_WEAK_COLLECTIONS],
           current_.scopes[Scope::MC_CLEAR_WEAK_LISTS],
+          current_.scopes[Scope::MC_CLEAR_WEAK_REFERENCES],
           current_.scopes[Scope::MC_EPILOGUE],
           current_.scopes[Scope::MC_EVACUATE],
           current_.scopes[Scope::MC_EVACUATE_CANDIDATES],
@@ -869,6 +886,43 @@ void GCTracer::RecordIncrementalMarkingSpeed(size_t bytes, double duration) {
   }
 }
 
+void GCTracer::RecordMutatorUtilization(double mark_compact_end_time,
+                                        double mark_compact_duration) {
+  if (previous_mark_compact_end_time_ == 0) {
+    // The first event only contributes to previous_mark_compact_end_time_,
+    // because we cannot compute the mutator duration.
+    previous_mark_compact_end_time_ = mark_compact_end_time;
+  } else {
+    double total_duration =
+        mark_compact_end_time - previous_mark_compact_end_time_;
+    double mutator_duration = total_duration - mark_compact_duration;
+    if (average_mark_compact_duration_ == 0 && average_mutator_duration_ == 0) {
+      // This is the first event with mutator and mark-compact durations.
+      average_mark_compact_duration_ = mark_compact_duration;
+      average_mutator_duration_ = mutator_duration;
+    } else {
+      average_mark_compact_duration_ =
+          (average_mark_compact_duration_ + mark_compact_duration) / 2;
+      average_mutator_duration_ =
+          (average_mutator_duration_ + mutator_duration) / 2;
+    }
+    current_mark_compact_mutator_utilization_ =
+        total_duration ? mutator_duration / total_duration : 0;
+    previous_mark_compact_end_time_ = mark_compact_end_time;
+  }
+}
+
+double GCTracer::AverageMarkCompactMutatorUtilization() const {
+  double average_total_duration =
+      average_mark_compact_duration_ + average_mutator_duration_;
+  if (average_total_duration == 0) return 1.0;
+  return average_mutator_duration_ / average_total_duration;
+}
+
+double GCTracer::CurrentMarkCompactMutatorUtilization() const {
+  return current_mark_compact_mutator_utilization_;
+}
+
 double GCTracer::IncrementalMarkingSpeedInBytesPerMillisecond() const {
   const int kConservativeSpeedInBytesPerMillisecond = 128 * KB;
   if (recorded_incremental_marking_speed_ != 0) {
diff --git a/deps/v8/src/heap/gc-tracer.h b/deps/v8/src/heap/gc-tracer.h
index fb0f001e3d9..f35fa50d453 100644
--- a/deps/v8/src/heap/gc-tracer.h
+++ b/deps/v8/src/heap/gc-tracer.h
@@ -300,6 +300,11 @@ class V8_EXPORT_PRIVATE GCTracer {
 
   void NotifyIncrementalMarkingStart();
 
+  // Returns average mutator utilization with respect to mark-compact
+  // garbage collections. This ignores scavenger.
+  double AverageMarkCompactMutatorUtilization() const;
+  double CurrentMarkCompactMutatorUtilization() const;
+
   V8_INLINE void AddScopeSample(Scope::ScopeId scope, double duration) {
     DCHECK(scope < Scope::NUMBER_OF_SCOPES);
     if (scope >= Scope::FIRST_INCREMENTAL_SCOPE &&
@@ -328,6 +333,7 @@ class V8_EXPORT_PRIVATE GCTracer {
   FRIEND_TEST(GCTracerTest, IncrementalMarkingDetails);
   FRIEND_TEST(GCTracerTest, IncrementalScope);
   FRIEND_TEST(GCTracerTest, IncrementalMarkingSpeed);
+  FRIEND_TEST(GCTracerTest, MutatorUtilization);
 
   struct BackgroundCounter {
     double total_duration_ms;
@@ -344,6 +350,8 @@ class V8_EXPORT_PRIVATE GCTracer {
   void ResetForTesting();
   void ResetIncrementalMarkingCounters();
   void RecordIncrementalMarkingSpeed(size_t bytes, double duration);
+  void RecordMutatorUtilization(double mark_compactor_end_time,
+                                double mark_compactor_duration);
 
   // Print one detailed trace line in name=value format.
   // TODO(ernstm): Move to Heap.
@@ -415,6 +423,12 @@ class V8_EXPORT_PRIVATE GCTracer {
   // Counts how many tracers were started without stopping.
   int start_counter_;
 
+  // Used for computing average mutator utilization.
+  double average_mutator_duration_;
+  double average_mark_compact_duration_;
+  double current_mark_compact_mutator_utilization_;
+  double previous_mark_compact_end_time_;
+
   base::RingBuffer<BytesAndDuration> recorded_minor_gcs_total_;
   base::RingBuffer<BytesAndDuration> recorded_minor_gcs_survived_;
   base::RingBuffer<BytesAndDuration> recorded_compactions_;
diff --git a/deps/v8/src/heap/heap-inl.h b/deps/v8/src/heap/heap-inl.h
index f4e5c1fe134..dc3cd3ea4ba 100644
--- a/deps/v8/src/heap/heap-inl.h
+++ b/deps/v8/src/heap/heap-inl.h
@@ -23,6 +23,8 @@
 #include "src/log.h"
 #include "src/msan.h"
 #include "src/objects-inl.h"
+#include "src/objects/descriptor-array.h"
+#include "src/objects/literal-objects.h"
 #include "src/objects/scope-info.h"
 #include "src/objects/script-inl.h"
 #include "src/profiler/heap-profiler.h"
@@ -245,6 +247,42 @@ AllocationResult Heap::AllocateFixedArray(int length, PretenureFlag pretenure) {
                                       pretenure, undefined_value());
 }
 
+AllocationResult Heap::AllocateWeakFixedArray(int length,
+                                              PretenureFlag pretenure) {
+  // Zero-length case must be handled outside, where the knowledge about
+  // the map is.
+  DCHECK_LT(0, length);
+  HeapObject* result = nullptr;
+  {
+    AllocationResult allocation = AllocateRawWeakFixedArray(length, pretenure);
+    if (!allocation.To(&result)) return allocation;
+  }
+  DCHECK(RootIsImmortalImmovable(Heap::kWeakFixedArrayMapRootIndex));
+  Map* map = Map::cast(root(Heap::kWeakFixedArrayMapRootIndex));
+  result->set_map_after_allocation(map, SKIP_WRITE_BARRIER);
+  WeakFixedArray* array = WeakFixedArray::cast(result);
+  array->set_length(length);
+  MemsetPointer(array->data_start(),
+                HeapObjectReference::Strong(undefined_value()), length);
+  return array;
+}
+
+AllocationResult Heap::AllocateRawFixedArray(int length,
+                                             PretenureFlag pretenure) {
+  if (length < 0 || length > FixedArray::kMaxLength) {
+    FatalProcessOutOfMemory("invalid array length");
+  }
+  return AllocateRawArray(FixedArray::SizeFor(length), pretenure);
+}
+
+AllocationResult Heap::AllocateRawWeakFixedArray(int length,
+                                                 PretenureFlag pretenure) {
+  if (length < 0 || length > WeakFixedArray::kMaxLength) {
+    FatalProcessOutOfMemory("invalid array length");
+  }
+  return AllocateRawArray(WeakFixedArray::SizeFor(length), pretenure);
+}
+
 AllocationResult Heap::AllocateRaw(int size_in_bytes, AllocationSpace space,
                                    AllocationAlignment alignment) {
   DCHECK(AllowHandleAllocation::IsAllowed());
@@ -295,11 +333,24 @@ AllocationResult Heap::AllocateRaw(int size_in_bytes, AllocationSpace space,
     allocation = lo_space_->AllocateRaw(size_in_bytes, NOT_EXECUTABLE);
   } else if (MAP_SPACE == space) {
     allocation = map_space_->AllocateRawUnaligned(size_in_bytes);
+  } else if (RO_SPACE == space) {
+#ifdef V8_USE_SNAPSHOT
+    DCHECK(isolate_->serializer_enabled());
+#endif
+    DCHECK(!large_object);
+    allocation = read_only_space_->AllocateRaw(size_in_bytes, alignment);
   } else {
     // NEW_SPACE is not allowed here.
     UNREACHABLE();
   }
+
   if (allocation.To(&object)) {
+    if (space == CODE_SPACE) {
+      // Unprotect the memory chunk of the object if it was not unprotected
+      // already.
+      UnprotectAndRegisterMemoryChunk(object);
+      ZapCodeObject(object->address(), size_in_bytes);
+    }
     OnAllocationEvent(object, size_in_bytes);
   }
 
@@ -410,26 +461,42 @@ void Heap::FinalizeExternalString(String* string) {
 Address Heap::NewSpaceTop() { return new_space_->top(); }
 
 bool Heap::InNewSpace(Object* object) {
+  DCHECK(!HasWeakHeapObjectTag(object));
+  return InNewSpace(MaybeObject::FromObject(object));
+}
+
+bool Heap::InFromSpace(Object* object) {
+  DCHECK(!HasWeakHeapObjectTag(object));
+  return InFromSpace(MaybeObject::FromObject(object));
+}
+
+bool Heap::InToSpace(Object* object) {
+  DCHECK(!HasWeakHeapObjectTag(object));
+  return InToSpace(MaybeObject::FromObject(object));
+}
+
+bool Heap::InNewSpace(MaybeObject* object) {
   // Inlined check from NewSpace::Contains.
-  bool result =
-      object->IsHeapObject() &&
-      Page::FromAddress(HeapObject::cast(object)->address())->InNewSpace();
+  HeapObject* heap_object;
+  bool result = object->ToStrongOrWeakHeapObject(&heap_object) &&
+                Page::FromAddress(heap_object->address())->InNewSpace();
   DCHECK(!result ||                 // Either not in new space
          gc_state_ != NOT_IN_GC ||  // ... or in the middle of GC
          InToSpace(object));        // ... or in to-space (where we allocate).
   return result;
 }
 
-bool Heap::InFromSpace(Object* object) {
-  return object->IsHeapObject() &&
-         MemoryChunk::FromAddress(HeapObject::cast(object)->address())
+bool Heap::InFromSpace(MaybeObject* object) {
+  HeapObject* heap_object;
+  return object->ToStrongOrWeakHeapObject(&heap_object) &&
+         MemoryChunk::FromAddress(heap_object->address())
              ->IsFlagSet(Page::IN_FROM_SPACE);
 }
 
-
-bool Heap::InToSpace(Object* object) {
-  return object->IsHeapObject() &&
-         MemoryChunk::FromAddress(HeapObject::cast(object)->address())
+bool Heap::InToSpace(MaybeObject* object) {
+  HeapObject* heap_object;
+  return object->ToStrongOrWeakHeapObject(&heap_object) &&
+         MemoryChunk::FromAddress(heap_object->address())
              ->IsFlagSet(Page::IN_TO_SPACE);
 }
 
@@ -451,6 +518,13 @@ bool Heap::ShouldBePromoted(Address old_address) {
 }
 
 void Heap::RecordWrite(Object* object, Object** slot, Object* value) {
+  DCHECK(!HasWeakHeapObjectTag(*slot));
+  DCHECK(!HasWeakHeapObjectTag(value));
+  RecordWrite(object, reinterpret_cast<MaybeObject**>(slot),
+              reinterpret_cast<MaybeObject*>(value));
+}
+
+void Heap::RecordWrite(Object* object, MaybeObject** slot, MaybeObject* value) {
   if (!InNewSpace(value) || !object->IsHeapObject() || InNewSpace(object)) {
     return;
   }
@@ -594,15 +668,22 @@ uint32_t Heap::HashSeed() {
 
 int Heap::NextScriptId() {
   int last_id = last_script_id()->value();
-  if (last_id == Smi::kMaxValue) {
-    last_id = 1;
-  } else {
-    last_id++;
-  }
+  if (last_id == Smi::kMaxValue) last_id = v8::UnboundScript::kNoScriptId;
+  last_id++;
   set_last_script_id(Smi::FromInt(last_id));
   return last_id;
 }
 
+int Heap::NextDebuggingId() {
+  int last_id = last_debugging_id()->value();
+  if (last_id == SharedFunctionInfo::DebuggingIdBits::kMax) {
+    last_id = SharedFunctionInfo::kNoDebuggingId;
+  }
+  last_id++;
+  set_last_debugging_id(Smi::FromInt(last_id));
+  return last_id;
+}
+
 int Heap::GetNextTemplateSerialNumber() {
   int next_serial_number = next_template_serial_number()->value() + 1;
   set_next_template_serial_number(Smi::FromInt(next_serial_number));
@@ -620,12 +701,14 @@ AlwaysAllocateScope::~AlwaysAllocateScope() {
 
 CodeSpaceMemoryModificationScope::CodeSpaceMemoryModificationScope(Heap* heap)
     : heap_(heap) {
+  DCHECK(!heap_->unprotected_memory_chunks_registry_enabled());
   if (heap_->write_protect_code_memory()) {
     heap_->increment_code_space_memory_modification_scope_depth();
     heap_->code_space()->SetReadAndWritable();
     LargePage* page = heap_->lo_space()->first_page();
     while (page != nullptr) {
       if (page->IsFlagSet(MemoryChunk::IS_EXECUTABLE)) {
+        CHECK(heap_->memory_allocator()->IsMemoryChunkExecutable(page));
         page->SetReadAndWritable();
       }
       page = page->next_page();
@@ -634,12 +717,14 @@ CodeSpaceMemoryModificationScope::CodeSpaceMemoryModificationScope(Heap* heap)
 }
 
 CodeSpaceMemoryModificationScope::~CodeSpaceMemoryModificationScope() {
+  DCHECK(!heap_->unprotected_memory_chunks_registry_enabled());
   if (heap_->write_protect_code_memory()) {
     heap_->decrement_code_space_memory_modification_scope_depth();
     heap_->code_space()->SetReadAndExecutable();
     LargePage* page = heap_->lo_space()->first_page();
     while (page != nullptr) {
       if (page->IsFlagSet(MemoryChunk::IS_EXECUTABLE)) {
+        CHECK(heap_->memory_allocator()->IsMemoryChunkExecutable(page));
         page->SetReadAndExecutable();
       }
       page = page->next_page();
@@ -647,6 +732,24 @@ CodeSpaceMemoryModificationScope::~CodeSpaceMemoryModificationScope() {
   }
 }
 
+CodePageCollectionMemoryModificationScope::
+    CodePageCollectionMemoryModificationScope(Heap* heap)
+    : heap_(heap) {
+  if (heap_->write_protect_code_memory() &&
+      !heap_->code_space_memory_modification_scope_depth()) {
+    heap_->EnableUnprotectedMemoryChunksRegistry();
+  }
+}
+
+CodePageCollectionMemoryModificationScope::
+    ~CodePageCollectionMemoryModificationScope() {
+  if (heap_->write_protect_code_memory() &&
+      !heap_->code_space_memory_modification_scope_depth()) {
+    heap_->ProtectUnprotectedMemoryChunks();
+    heap_->DisableUnprotectedMemoryChunksRegistry();
+  }
+}
+
 CodePageMemoryModificationScope::CodePageMemoryModificationScope(
     MemoryChunk* chunk)
     : chunk_(chunk),
diff --git a/deps/v8/src/heap/heap.cc b/deps/v8/src/heap/heap.cc
index 7f965602b8a..a3f8582b393 100644
--- a/deps/v8/src/heap/heap.cc
+++ b/deps/v8/src/heap/heap.cc
@@ -17,7 +17,6 @@
 #include "src/bootstrapper.h"
 #include "src/code-stubs.h"
 #include "src/compilation-cache.h"
-#include "src/compiler-dispatcher/optimizing-compile-dispatcher.h"
 #include "src/conversions.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
@@ -46,8 +45,10 @@
 #include "src/heap/stress-marking-observer.h"
 #include "src/heap/stress-scavenge-observer.h"
 #include "src/heap/sweeper.h"
+#include "src/instruction-stream.h"
 #include "src/interpreter/interpreter.h"
 #include "src/objects/data-handler.h"
+#include "src/objects/maybe-object.h"
 #include "src/objects/shared-function-info.h"
 #include "src/regexp/jsregexp.h"
 #include "src/runtime-profiler.h"
@@ -55,7 +56,7 @@
 #include "src/snapshot/serializer-common.h"
 #include "src/snapshot/snapshot.h"
 #include "src/tracing/trace-event.h"
-#include "src/trap-handler/trap-handler.h"
+#include "src/unicode-decoder.h"
 #include "src/unicode-inl.h"
 #include "src/utils-inl.h"
 #include "src/utils.h"
@@ -160,8 +161,6 @@ Heap::Heap()
       survived_last_scavenge_(0),
       always_allocate_scope_count_(0),
       memory_pressure_level_(MemoryPressureLevel::kNone),
-      out_of_memory_callback_(nullptr),
-      out_of_memory_callback_data_(nullptr),
       contexts_disposed_(0),
       number_of_disposed_maps_(0),
       new_space_(nullptr),
@@ -169,6 +168,7 @@ Heap::Heap()
       code_space_(nullptr),
       map_space_(nullptr),
       lo_space_(nullptr),
+      read_only_space_(nullptr),
       write_protect_code_memory_(false),
       code_space_memory_modification_scope_depth_(0),
       gc_state_(NOT_IN_GC),
@@ -177,9 +177,11 @@ Heap::Heap()
       raw_allocations_hash_(0),
       stress_marking_observer_(nullptr),
       stress_scavenge_observer_(nullptr),
+      allocation_step_in_progress_(false),
       max_marking_limit_reached_(0.0),
       ms_count_(0),
       gc_count_(0),
+      consecutive_ineffective_mark_compacts_(0),
       mmap_region_base_(0),
       remembered_unmapped_pages_index_(0),
       old_generation_allocation_limit_(initial_old_generation_size_),
@@ -227,10 +229,10 @@ Heap::Heap()
       heap_iterator_depth_(0),
       local_embedder_heap_tracer_(nullptr),
       fast_promotion_mode_(false),
-      use_tasks_(true),
       force_oom_(false),
       delay_sweeper_tasks_for_testing_(false),
-      pending_layout_change_object_(nullptr)
+      pending_layout_change_object_(nullptr),
+      unprotected_memory_chunks_registry_enabled_(false)
 #ifdef V8_ENABLE_ALLOCATION_TIMEOUT
       ,
       allocation_timeout_(0)
@@ -248,6 +250,12 @@ Heap::Heap()
   RememberUnmappedPage(nullptr, false);
 }
 
+size_t Heap::MaxReserved() {
+  const double kFactor = Page::kPageSize * 1.0 / Page::kAllocatableMemory;
+  return static_cast<size_t>(
+      (2 * max_semi_space_size_ + max_old_generation_size_) * kFactor);
+}
+
 size_t Heap::Capacity() {
   if (!HasBeenSetUp()) return 0;
 
@@ -322,7 +330,8 @@ bool Heap::CanExpandOldGeneration(size_t size) {
 
 bool Heap::HasBeenSetUp() {
   return old_space_ != nullptr && code_space_ != nullptr &&
-         map_space_ != nullptr && lo_space_ != nullptr;
+         map_space_ != nullptr && lo_space_ != nullptr &&
+         read_only_space_ != nullptr;
 }
 
 
@@ -436,10 +445,10 @@ void Heap::ReportStatisticsAfterGC() {
 void Heap::AddRetainingPathTarget(Handle<HeapObject> object,
                                   RetainingPathOption option) {
   if (!FLAG_track_retaining_path) {
-    PrintF("Retaining path tracking requires --trace-retaining-path\n");
+    PrintF("Retaining path tracking requires --track-retaining-path\n");
   } else {
     int index = 0;
-    Handle<WeakFixedArray> array = WeakFixedArray::Add(
+    Handle<FixedArrayOfWeakCells> array = FixedArrayOfWeakCells::Add(
         handle(retaining_path_targets(), isolate()), object, &index);
     set_retaining_path_targets(*array);
     retaining_path_target_option_[index] = option;
@@ -448,8 +457,9 @@ void Heap::AddRetainingPathTarget(Handle<HeapObject> object,
 
 bool Heap::IsRetainingPathTarget(HeapObject* object,
                                  RetainingPathOption* option) {
-  if (!retaining_path_targets()->IsWeakFixedArray()) return false;
-  WeakFixedArray* targets = WeakFixedArray::cast(retaining_path_targets());
+  if (!retaining_path_targets()->IsFixedArrayOfWeakCells()) return false;
+  FixedArrayOfWeakCells* targets =
+      FixedArrayOfWeakCells::cast(retaining_path_targets());
   int length = targets->Length();
   for (int i = 0; i < length; i++) {
     if (targets->Get(i) == object) {
@@ -461,30 +471,6 @@ bool Heap::IsRetainingPathTarget(HeapObject* object,
   return false;
 }
 
-namespace {
-const char* RootToString(Root root) {
-  switch (root) {
-#define ROOT_CASE(root_id, ignore, description) \
-  case Root::root_id:                           \
-    return description;
-    ROOT_ID_LIST(ROOT_CASE)
-#undef ROOT_CASE
-    case Root::kCodeFlusher:
-      return "(Code flusher)";
-    case Root::kPartialSnapshotCache:
-      return "(Partial snapshot cache)";
-    case Root::kWeakCollections:
-      return "(Weak collections)";
-    case Root::kWrapperTracing:
-      return "(Wrapper tracing)";
-    case Root::kUnknown:
-      return "(Unknown)";
-  }
-  UNREACHABLE();
-  return nullptr;
-}
-}  // namespace
-
 void Heap::PrintRetainingPath(HeapObject* target, RetainingPathOption option) {
   PrintF("\n\n\n");
   PrintF("#################################################\n");
@@ -527,7 +513,7 @@ void Heap::PrintRetainingPath(HeapObject* target, RetainingPathOption option) {
   }
   PrintF("\n");
   PrintF("^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n");
-  PrintF("Root: %s\n", RootToString(root));
+  PrintF("Root: %s\n", RootVisitor::RootName(root));
   PrintF("-------------------------------------------------\n");
 }
 
@@ -638,13 +624,15 @@ const char* Heap::GetSpaceName(int idx) {
       return "code_space";
     case LO_SPACE:
       return "large_object_space";
+    case RO_SPACE:
+      return "read_only_space";
     default:
       UNREACHABLE();
   }
   return nullptr;
 }
 
-void Heap::SetRootCodeStubs(NumberDictionary* value) {
+void Heap::SetRootCodeStubs(SimpleNumberDictionary* value) {
   roots_[kCodeStubsRootIndex] = value;
 }
 
@@ -987,7 +975,7 @@ void Heap::GarbageCollectionEpilogue() {
 
 
 void Heap::PreprocessStackTraces() {
-  WeakFixedArray::Iterator iterator(weak_stack_trace_list());
+  FixedArrayOfWeakCells::Iterator iterator(weak_stack_trace_list());
   FixedArray* elements;
   while ((elements = iterator.Next<FixedArray>()) != nullptr) {
     for (int j = 1; j < elements->length(); j += 4) {
@@ -1112,6 +1100,66 @@ void Heap::CollectAllGarbage(int flags, GarbageCollectionReason gc_reason,
   set_current_gc_flags(kNoGCFlags);
 }
 
+namespace {
+
+intptr_t CompareWords(int size, HeapObject* a, HeapObject* b) {
+  int words = size / kPointerSize;
+  DCHECK_EQ(a->Size(), size);
+  DCHECK_EQ(b->Size(), size);
+  intptr_t* slot_a = reinterpret_cast<intptr_t*>(a->address());
+  intptr_t* slot_b = reinterpret_cast<intptr_t*>(b->address());
+  for (int i = 0; i < words; i++) {
+    if (*slot_a != *slot_b) {
+      return *slot_a - *slot_b;
+    }
+    slot_a++;
+    slot_b++;
+  }
+  return 0;
+}
+
+void ReportDuplicates(int size, std::vector<HeapObject*>& objects) {
+  if (objects.size() == 0) return;
+
+  sort(objects.begin(), objects.end(), [size](HeapObject* a, HeapObject* b) {
+    intptr_t c = CompareWords(size, a, b);
+    if (c != 0) return c < 0;
+    return a < b;
+  });
+
+  std::vector<std::pair<int, HeapObject*>> duplicates;
+  HeapObject* current = objects[0];
+  int count = 1;
+  for (size_t i = 1; i < objects.size(); i++) {
+    if (CompareWords(size, current, objects[i]) == 0) {
+      count++;
+    } else {
+      if (count > 1) {
+        duplicates.push_back(std::make_pair(count - 1, current));
+      }
+      count = 1;
+      current = objects[i];
+    }
+  }
+  if (count > 1) {
+    duplicates.push_back(std::make_pair(count - 1, current));
+  }
+
+  int threshold = FLAG_trace_duplicate_threshold_kb * KB;
+
+  sort(duplicates.begin(), duplicates.end());
+  for (auto it = duplicates.rbegin(); it != duplicates.rend(); ++it) {
+    int duplicate_bytes = it->first * size;
+    if (duplicate_bytes < threshold) break;
+    PrintF("%d duplicates of size %d each (%dKB)\n", it->first, size,
+           duplicate_bytes / KB);
+    PrintF("Sample object: ");
+    it->second->Print();
+    PrintF("============================\n");
+  }
+}
+}  // anonymous namespace
+
 void Heap::CollectAllAvailableGarbage(GarbageCollectionReason gc_reason) {
   // Since we are ignoring the return value, the exact choice of space does
   // not matter, so long as we do not specify NEW_SPACE, which would not
@@ -1125,16 +1173,13 @@ void Heap::CollectAllAvailableGarbage(GarbageCollectionReason gc_reason) {
   // hope that eventually there will be no weak callbacks invocations.
   // Therefore stop recollecting after several attempts.
   if (gc_reason == GarbageCollectionReason::kLastResort) {
-    InvokeOutOfMemoryCallback();
+    InvokeNearHeapLimitCallback();
   }
   RuntimeCallTimerScope runtime_timer(
       isolate(), RuntimeCallCounterId::kGC_Custom_AllAvailableGarbage);
-  if (isolate()->concurrent_recompilation_enabled()) {
-    // The optimizing compiler may be unnecessarily holding on to memory.
-    DisallowHeapAllocation no_recursive_gc;
-    isolate()->optimizing_compile_dispatcher()->Flush(
-        OptimizingCompileDispatcher::BlockingBehavior::kDontBlock);
-  }
+
+  // The optimizing compiler may be unnecessarily holding on to memory.
+  isolate()->AbortConcurrentOptimization(BlockingBehavior::kDontBlock);
   isolate()->ClearSerializerData();
   set_current_gc_flags(kMakeHeapIterableMask | kReduceMemoryFootprintMask);
   isolate_->compilation_cache()->Clear();
@@ -1151,6 +1196,28 @@ void Heap::CollectAllAvailableGarbage(GarbageCollectionReason gc_reason) {
   set_current_gc_flags(kNoGCFlags);
   new_space_->Shrink();
   UncommitFromSpace();
+
+  if (FLAG_trace_duplicate_threshold_kb) {
+    std::map<int, std::vector<HeapObject*>> objects_by_size;
+    PagedSpaces spaces(this);
+    for (PagedSpace* space = spaces.next(); space != nullptr;
+         space = spaces.next()) {
+      HeapObjectIterator it(space);
+      for (HeapObject* obj = it.Next(); obj != nullptr; obj = it.Next()) {
+        objects_by_size[obj->Size()].push_back(obj);
+      }
+    }
+    {
+      LargeObjectIterator it(lo_space());
+      for (HeapObject* obj = it.Next(); obj != nullptr; obj = it.Next()) {
+        objects_by_size[obj->Size()].push_back(obj);
+      }
+    }
+    for (auto it = objects_by_size.rbegin(); it != objects_by_size.rend();
+         ++it) {
+      ReportDuplicates(it->first, it->second);
+    }
+  }
 }
 
 void Heap::ReportExternalMemoryPressure() {
@@ -1210,12 +1277,16 @@ void Heap::EnsureFillerObjectAtTop() {
 bool Heap::CollectGarbage(AllocationSpace space,
                           GarbageCollectionReason gc_reason,
                           const v8::GCCallbackFlags gc_callback_flags) {
-  // The VM is in the GC state until exiting this function.
-  VMState<GC> state(isolate());
-
   const char* collector_reason = nullptr;
   GarbageCollector collector = SelectGarbageCollector(space, &collector_reason);
 
+  if (!CanExpandOldGeneration(new_space()->Capacity())) {
+    InvokeNearHeapLimitCallback();
+  }
+
+  // The VM is in the GC state until exiting this function.
+  VMState<GC> state(isolate());
+
 #ifdef V8_ENABLE_ALLOCATION_TIMEOUT
   // Reset the allocation timeout, but make sure to allow at least a few
   // allocations after a collection. The reason for this is that we have a lot
@@ -1316,11 +1387,8 @@ int Heap::NotifyContextDisposed(bool dependant_context) {
     event.time_ms = MonotonicallyIncreasingTimeInMs();
     memory_reducer_->NotifyPossibleGarbage(event);
   }
-  if (isolate()->concurrent_recompilation_enabled()) {
-    // Flush the queued recompilation tasks.
-    isolate()->optimizing_compile_dispatcher()->Flush(
-        OptimizingCompileDispatcher::BlockingBehavior::kDontBlock);
-  }
+  isolate()->AbortConcurrentOptimization(BlockingBehavior::kDontBlock);
+
   number_of_disposed_maps_ = retained_maps()->Length();
   tracer()->AddContextDisposalTime(MonotonicallyIncreasingTimeInMs());
   return ++contexts_disposed_;
@@ -1391,6 +1459,7 @@ class StringTableVerifier : public ObjectVisitor {
   void VisitPointers(HeapObject* host, Object** start, Object** end) override {
     // Visit all HeapObject pointers in [start, end).
     for (Object** p = start; p < end; p++) {
+      DCHECK(!HasWeakHeapObjectTag(*p));
       if ((*p)->IsHeapObject()) {
         HeapObject* object = HeapObject::cast(*p);
         Isolate* isolate = object->GetIsolate();
@@ -1400,6 +1469,10 @@ class StringTableVerifier : public ObjectVisitor {
       }
     }
   }
+  void VisitPointers(HeapObject* host, MaybeObject** start,
+                     MaybeObject** end) override {
+    UNREACHABLE();
+  }
 };
 
 
@@ -1415,8 +1488,8 @@ bool Heap::ReserveSpace(Reservation* reservations, std::vector<Address>* maps) {
   static const int kThreshold = 20;
   while (gc_performed && counter++ < kThreshold) {
     gc_performed = false;
-    for (int space = NEW_SPACE; space < SerializerDeserializer::kNumberOfSpaces;
-         space++) {
+    for (int space = FIRST_SPACE;
+         space < SerializerDeserializer::kNumberOfSpaces; space++) {
       Reservation* reservation = &reservations[space];
       DCHECK_LE(1, reservation->size());
       if (reservation->at(0).size == 0) continue;
@@ -1489,7 +1562,7 @@ bool Heap::ReserveSpace(Reservation* reservations, std::vector<Address>* maps) {
         // so that we cannot allocate space to deserialize the initial heap.
         if (!deserialization_complete_) {
           V8::FatalProcessOutOfMemory(
-              "insufficient memory to create an Isolate");
+              isolate(), "insufficient memory to create an Isolate");
         }
         if (space == NEW_SPACE) {
           CollectGarbage(NEW_SPACE, GarbageCollectionReason::kDeserializer);
@@ -1518,7 +1591,7 @@ void Heap::EnsureFromSpaceIsCommitted() {
 
   // Committing memory to from space failed.
   // Memory is exhausted and we will die.
-  V8::FatalProcessOutOfMemory("Committing semi space failed.");
+  FatalProcessOutOfMemory("Committing semi space failed.");
 }
 
 
@@ -1653,6 +1726,8 @@ bool Heap::PerformGarbageCollection(
     external_memory_at_last_mark_compact_ = external_memory_;
     external_memory_limit_ = external_memory_ + kExternalAllocationSoftLimit;
     SetOldGenerationAllocationLimit(old_gen_size, gc_speed, mutator_speed);
+    CheckIneffectiveMarkCompact(
+        old_gen_size, tracer()->AverageMarkCompactMutatorUtilization());
   } else if (HasLowYoungGenerationAllocationRate() &&
              old_generation_size_configured_) {
     DampenOldGenerationAllocationLimit(old_gen_size, gc_speed, mutator_speed);
@@ -1733,12 +1808,12 @@ void Heap::MarkCompact() {
 void Heap::MinorMarkCompact() {
   DCHECK(FLAG_minor_mc);
 
+  PauseAllocationObserversScope pause_observers(this);
   SetGCState(MINOR_MARK_COMPACT);
   LOG(isolate_, ResourceEvent("MinorMarkCompact", "begin"));
 
   TRACE_GC(tracer(), GCTracer::Scope::MINOR_MC);
   AlwaysAllocateScope always_allocate(isolate());
-  PauseAllocationObserversScope pause_observers(this);
   IncrementalMarking::PauseBlackAllocationScope pause_black_allocation(
       incremental_marking());
   CodeSpaceMemoryModificationScope code_modifcation(this);
@@ -1924,11 +1999,14 @@ int Heap::NumberOfScavengeTasks() {
   if (!FLAG_parallel_scavenge) return 1;
   const int num_scavenge_tasks =
       static_cast<int>(new_space()->TotalCapacity()) / MB;
-  return Max(
-      1,
-      Min(Min(num_scavenge_tasks, kMaxScavengerTasks),
-          static_cast<int>(
-              V8::GetCurrentPlatform()->NumberOfAvailableBackgroundThreads())));
+  static int num_cores = V8::GetCurrentPlatform()->NumberOfWorkerThreads() + 1;
+  int tasks =
+      Max(1, Min(Min(num_scavenge_tasks, kMaxScavengerTasks), num_cores));
+  if (!CanExpandOldGeneration(static_cast<size_t>(tasks * Page::kPageSize))) {
+    // Optimize for memory usage near the heap limit.
+    tasks = 1;
+  }
+  return tasks;
 }
 
 void Heap::Scavenge() {
@@ -2015,7 +2093,7 @@ void Heap::Scavenge() {
     {
       // Parallel phase scavenging all copied and promoted objects.
       TRACE_GC(tracer(), GCTracer::Scope::SCAVENGER_SCAVENGE_PARALLEL);
-      job.Run();
+      job.Run(isolate()->async_counters());
       DCHECK(copied_list.IsGlobalEmpty());
       DCHECK(promotion_list.IsGlobalEmpty());
     }
@@ -2105,6 +2183,27 @@ void Heap::ComputeFastPromotionMode(double survival_rate) {
   }
 }
 
+void Heap::UnprotectAndRegisterMemoryChunk(MemoryChunk* chunk) {
+  if (unprotected_memory_chunks_registry_enabled_ &&
+      unprotected_memory_chunks_.insert(chunk).second) {
+    chunk->SetReadAndWritable();
+  }
+}
+
+void Heap::UnprotectAndRegisterMemoryChunk(HeapObject* object) {
+  UnprotectAndRegisterMemoryChunk(MemoryChunk::FromAddress(object->address()));
+}
+
+void Heap::ProtectUnprotectedMemoryChunks() {
+  DCHECK(unprotected_memory_chunks_registry_enabled_);
+  for (auto chunk = unprotected_memory_chunks_.begin();
+       chunk != unprotected_memory_chunks_.end(); chunk++) {
+    CHECK(memory_allocator()->IsMemoryChunkExecutable(*chunk));
+    (*chunk)->SetReadAndExecutable();
+  }
+  unprotected_memory_chunks_.clear();
+}
+
 String* Heap::UpdateNewSpaceReferenceInExternalStringTableEntry(Heap* heap,
                                                                 Object** p) {
   MapWord first_word = HeapObject::cast(*p)->map_word();
@@ -2187,7 +2286,8 @@ void Heap::ExternalStringTable::PromoteAllNewSpaceStrings() {
 
 void Heap::ExternalStringTable::IterateNewSpaceStrings(RootVisitor* v) {
   if (!new_space_strings_.empty()) {
-    v->VisitRootPointers(Root::kExternalStringsTable, new_space_strings_.data(),
+    v->VisitRootPointers(Root::kExternalStringsTable, nullptr,
+                         new_space_strings_.data(),
                          new_space_strings_.data() + new_space_strings_.size());
   }
 }
@@ -2195,7 +2295,8 @@ void Heap::ExternalStringTable::IterateNewSpaceStrings(RootVisitor* v) {
 void Heap::ExternalStringTable::IterateAll(RootVisitor* v) {
   IterateNewSpaceStrings(v);
   if (!old_space_strings_.empty()) {
-    v->VisitRootPointers(Root::kExternalStringsTable, old_space_strings_.data(),
+    v->VisitRootPointers(Root::kExternalStringsTable, nullptr,
+                         old_space_strings_.data(),
                          old_space_strings_.data() + old_space_strings_.size());
   }
 }
@@ -2301,7 +2402,8 @@ void Heap::VisitExternalResources(v8::ExternalResourceVisitor* visitor) {
     explicit ExternalStringTableVisitorAdapter(
         v8::ExternalResourceVisitor* visitor)
         : visitor_(visitor) {}
-    virtual void VisitRootPointers(Root root, Object** start, Object** end) {
+    virtual void VisitRootPointers(Root root, const char* description,
+                                   Object** start, Object** end) {
       for (Object** p = start; p < end; p++) {
         DCHECK((*p)->IsExternalString());
         visitor_->VisitExternalString(
@@ -2410,9 +2512,11 @@ AllocationResult Heap::AllocatePartialMap(InstanceType instance_type,
   map->set_visitor_id(Map::GetVisitorId(map));
   map->set_inobject_properties_start_or_constructor_function_index(0);
   DCHECK(!map->IsJSObjectMap());
+  map->set_prototype_validity_cell(Smi::FromInt(Map::kPrototypeChainValid));
   map->SetInObjectUnusedPropertyFields(0);
   map->set_bit_field(0);
   map->set_bit_field2(0);
+  DCHECK(!map->is_in_retained_map_list());
   int bit_field3 = Map::EnumLengthBits::encode(kInvalidEnumCacheSentinel) |
                    Map::OwnsDescriptorsBit::encode(true) |
                    Map::ConstructionCounterBits::encode(Map::kNoSlackTracking);
@@ -2446,9 +2550,11 @@ AllocationResult Heap::AllocateMap(InstanceType instance_type,
     map->SetInObjectPropertiesStartInWords(instance_size / kPointerSize -
                                            inobject_properties);
     DCHECK_EQ(map->GetInObjectProperties(), inobject_properties);
+    map->set_prototype_validity_cell(invalid_prototype_validity_cell());
   } else {
     DCHECK_EQ(inobject_properties, 0);
     map->set_inobject_properties_start_or_constructor_function_index(0);
+    map->set_prototype_validity_cell(Smi::FromInt(Map::kPrototypeChainValid));
   }
   map->set_dependent_code(DependentCode::cast(empty_fixed_array()),
                           SKIP_WRITE_BARRIER);
@@ -2464,6 +2570,7 @@ AllocationResult Heap::AllocateMap(InstanceType instance_type,
   map->set_visitor_id(Map::GetVisitorId(map));
   map->set_bit_field(0);
   map->set_bit_field2(Map::IsExtensibleBit::kMask);
+  DCHECK(!map->is_in_retained_map_list());
   int bit_field3 = Map::EnumLengthBits::encode(kInvalidEnumCacheSentinel) |
                    Map::OwnsDescriptorsBit::encode(true) |
                    Map::ConstructionCounterBits::encode(Map::kNoSlackTracking);
@@ -2512,12 +2619,12 @@ AllocationResult Heap::AllocateHeapNumber(MutableMode mode,
   return result;
 }
 
-AllocationResult Heap::AllocateBigInt(int length) {
+AllocationResult Heap::AllocateBigInt(int length, PretenureFlag pretenure) {
   if (length < 0 || length > BigInt::kMaxLength) {
-    v8::internal::Heap::FatalProcessOutOfMemory("invalid BigInt length", true);
+    FatalProcessOutOfMemory("invalid BigInt length");
   }
   int size = BigInt::SizeFor(length);
-  AllocationSpace space = SelectSpace(NOT_TENURED);
+  AllocationSpace space = SelectSpace(pretenure);
   HeapObject* result = nullptr;
   {
     AllocationResult allocation = AllocateRaw(size, space);
@@ -2541,6 +2648,20 @@ AllocationResult Heap::AllocateCell(Object* value) {
   return result;
 }
 
+AllocationResult Heap::AllocateFeedbackCell(Map* map, HeapObject* value) {
+  int size = FeedbackCell::kSize;
+  STATIC_ASSERT(FeedbackCell::kSize <= kMaxRegularHeapObjectSize);
+
+  HeapObject* result = nullptr;
+  {
+    AllocationResult allocation = AllocateRaw(size, OLD_SPACE);
+    if (!allocation.To(&result)) return allocation;
+  }
+  result->set_map_after_allocation(map, SKIP_WRITE_BARRIER);
+  FeedbackCell::cast(result)->set_value(value);
+  return result;
+}
+
 AllocationResult Heap::AllocatePropertyCell(Name* name) {
   DCHECK(name->IsUniqueName());
   int size = PropertyCell::kSize;
@@ -2653,8 +2774,6 @@ bool Heap::RootCanBeWrittenAfterInitialization(Heap::RootListIndex root_index) {
     case kMaterializedObjectsRootIndex:
     case kMicrotaskQueueRootIndex:
     case kDetachedContextsRootIndex:
-    case kWeakObjectToCodeTableRootIndex:
-    case kWeakNewSpaceObjectToCodeListRootIndex:
     case kRetainedMapsRootIndex:
     case kRetainingPathTargetsRootIndex:
     case kFeedbackVectorsForProfilingToolsRootIndex:
@@ -2807,7 +2926,7 @@ AllocationResult Heap::AllocateSmallOrderedHashMap(int capacity,
 
 AllocationResult Heap::AllocateByteArray(int length, PretenureFlag pretenure) {
   if (length < 0 || length > ByteArray::kMaxLength) {
-    v8::internal::Heap::FatalProcessOutOfMemory("invalid array length", true);
+    FatalProcessOutOfMemory("invalid array length");
   }
   int size = ByteArray::SizeFor(length);
   AllocationSpace space = SelectSpace(pretenure);
@@ -2830,7 +2949,7 @@ AllocationResult Heap::AllocateBytecodeArray(int length,
                                              int parameter_count,
                                              FixedArray* constant_pool) {
   if (length < 0 || length > BytecodeArray::kMaxLength) {
-    v8::internal::Heap::FatalProcessOutOfMemory("invalid array length", true);
+    FatalProcessOutOfMemory("invalid array length");
   }
   // Bytecode array is pretenured, so constant pool array should be to.
   DCHECK(!InNewSpace(constant_pool));
@@ -2849,11 +2968,11 @@ AllocationResult Heap::AllocateBytecodeArray(int length,
   instance->set_parameter_count(parameter_count);
   instance->set_incoming_new_target_or_generator_register(
       interpreter::Register::invalid_value());
-  instance->set_interrupt_budget(interpreter::Interpreter::kInterruptBudget);
+  instance->set_interrupt_budget(interpreter::Interpreter::InterruptBudget());
   instance->set_osr_loop_nesting_level(0);
   instance->set_bytecode_age(BytecodeArray::kNoAgeBytecodeAge);
   instance->set_constant_pool(constant_pool);
-  instance->set_handler_table(empty_fixed_array());
+  instance->set_handler_table(empty_byte_array());
   instance->set_source_position_table(empty_byte_array());
   CopyBytes(instance->GetFirstBytecodeAddress(), raw_bytecodes, length);
   instance->clear_padding();
@@ -2915,8 +3034,9 @@ FixedArrayBase* Heap::LeftTrimFixedArray(FixedArrayBase* object,
                                          int elements_to_trim) {
   CHECK_NOT_NULL(object);
   DCHECK(CanMoveObjectStart(object));
-  DCHECK(!object->IsFixedTypedArrayBase());
-  DCHECK(!object->IsByteArray());
+  // Add custom visitor to concurrent marker if new left-trimmable type
+  // is added.
+  DCHECK(object->IsFixedArray() || object->IsFixedDoubleArray());
   const int element_size = object->IsFixedArray() ? kPointerSize : kDoubleSize;
   const int bytes_to_trim = elements_to_trim * element_size;
   Map* map = object->map();
@@ -3098,7 +3218,8 @@ AllocationResult Heap::AllocateFixedTypedArray(int length,
   FixedTypedArrayBase* elements = FixedTypedArrayBase::cast(object);
   elements->set_base_pointer(elements, SKIP_WRITE_BARRIER);
   elements->set_external_pointer(
-      ExternalReference::fixed_typed_array_base_data_offset().address(),
+      ExternalReference::fixed_typed_array_base_data_offset(isolate())
+          .address(),
       SKIP_WRITE_BARRIER);
   elements->set_length(length);
   if (initialize) memset(elements->DataPtr(), 0, elements->DataSize());
@@ -3111,6 +3232,7 @@ AllocationResult Heap::AllocateCode(int object_size, Movability movability) {
 
   HeapObject* result = nullptr;
   if (!allocation.To(&result)) return allocation;
+
   if (movability == kImmovable) {
     Address address = result->address();
     MemoryChunk* chunk = MemoryChunk::FromAddress(address);
@@ -3129,6 +3251,9 @@ AllocationResult Heap::AllocateCode(int object_size, Movability movability) {
         allocation = lo_space_->AllocateRaw(object_size, EXECUTABLE);
         if (!allocation.To(&result)) return allocation;
         OnAllocationEvent(result, object_size);
+        // The old allocation was discarded. We have to unprotect the new
+        // allocation target.
+        UnprotectAndRegisterMemoryChunk(result);
       }
     }
   }
@@ -3145,10 +3270,10 @@ AllocationResult Heap::AllocateCode(int object_size, Movability movability) {
 AllocationResult Heap::AllocateCode(
     const CodeDesc& desc, Code::Kind kind, Handle<Object> self_ref,
     int32_t builtin_index, ByteArray* reloc_info,
-    CodeDataContainer* data_container, HandlerTable* handler_table,
-    ByteArray* source_position_table, DeoptimizationData* deopt_data,
-    Movability movability, uint32_t stub_key, bool is_turbofanned,
-    int stack_slots, int safepoint_table_offset) {
+    CodeDataContainer* data_container, ByteArray* source_position_table,
+    DeoptimizationData* deopt_data, Movability movability, uint32_t stub_key,
+    bool is_turbofanned, int stack_slots, int safepoint_table_offset,
+    int handler_table_offset) {
   bool has_unwinding_info = desc.unwinding_info != nullptr;
   DCHECK((has_unwinding_info && desc.unwinding_info_size > 0) ||
          (!has_unwinding_info && desc.unwinding_info_size == 0));
@@ -3163,7 +3288,8 @@ AllocationResult Heap::AllocateCode(
   int object_size = Code::SizeFor(RoundUp(body_size, kObjectAlignment));
 
   Code* code = nullptr;
-  CodeSpaceMemoryModificationScope code_allocation(this);
+  CodePageCollectionMemoryModificationScope code_allocation(this);
+
   AllocationResult allocation = AllocateCode(object_size, movability);
   if (!allocation.To(&code)) return allocation;
 
@@ -3174,16 +3300,14 @@ AllocationResult Heap::AllocateCode(
   code->set_relocation_info(reloc_info);
   code->initialize_flags(kind, has_unwinding_info, is_turbofanned, stack_slots);
   code->set_safepoint_table_offset(safepoint_table_offset);
+  code->set_handler_table_offset(handler_table_offset);
   code->set_code_data_container(data_container);
   code->set_has_tagged_params(true);
   code->set_deoptimization_data(deopt_data);
   code->set_stub_key(stub_key);
-  code->set_handler_table(handler_table);
   code->set_source_position_table(source_position_table);
-  code->set_protected_instructions(empty_fixed_array(), SKIP_WRITE_BARRIER);
   code->set_constant_pool_offset(desc.instr_size - desc.constant_pool_size);
   code->set_builtin_index(builtin_index);
-  code->set_trap_handler_index(Smi::FromInt(-1));
 
   switch (code->kind()) {
     case Code::OPTIMIZED_FUNCTION:
@@ -3239,11 +3363,6 @@ AllocationResult Heap::CopyCode(Code* code, CodeDataContainer* data_container) {
   // Set the {CodeDataContainer}, it cannot be shared.
   new_code->set_code_data_container(data_container);
 
-  // Clear the trap handler index since they can't be shared between code. We
-  // have to do this before calling Relocate because relocate would adjust the
-  // base pointer for the old code.
-  new_code->set_trap_handler_index(Smi::FromInt(trap_handler::kInvalidIndex));
-
   // Relocate the copy.
   new_code->Relocate(new_addr - old_addr);
   // We have to iterate over the object and process its pointers when black
@@ -3322,6 +3441,21 @@ AllocationResult Heap::Allocate(Map* map, AllocationSpace space,
   return result;
 }
 
+AllocationResult Heap::AllocateJSPromise(JSFunction* constructor,
+                                         PretenureFlag pretenure) {
+  AllocationResult allocation = AllocateJSObject(constructor, pretenure);
+  JSPromise* promise = nullptr;
+  if (!allocation.To(&promise)) return allocation;
+
+  // Setup JSPromise fields
+  promise->set_reactions_or_result(Smi::kZero);
+  promise->set_flags(0);
+  for (int i = 0; i < v8::Promise::kEmbedderFieldCount; i++) {
+    promise->SetEmbedderField(i, Smi::kZero);
+  }
+  return promise;
+}
+
 void Heap::InitializeJSObjectFromMap(JSObject* obj, Object* properties,
                                      Map* map) {
   obj->set_raw_properties_or_hash(properties);
@@ -3503,28 +3637,17 @@ static inline void WriteOneByteData(Vector<const char> vector, uint8_t* chars,
 
 static inline void WriteTwoByteData(Vector<const char> vector, uint16_t* chars,
                                     int len) {
-  const uint8_t* stream = reinterpret_cast<const uint8_t*>(vector.start());
-  size_t stream_length = vector.length();
-  while (stream_length != 0) {
-    size_t consumed = 0;
-    uint32_t c = unibrow::Utf8::ValueOf(stream, stream_length, &consumed);
+  unibrow::Utf8Iterator it = unibrow::Utf8Iterator(vector);
+  while (!it.Done()) {
+    DCHECK_GT(len, 0);
+    len -= 1;
+
+    uint16_t c = *it;
+    ++it;
     DCHECK_NE(unibrow::Utf8::kBadChar, c);
-    DCHECK(consumed <= stream_length);
-    stream_length -= consumed;
-    stream += consumed;
-    if (c > unibrow::Utf16::kMaxNonSurrogateCharCode) {
-      len -= 2;
-      if (len < 0) break;
-      *chars++ = unibrow::Utf16::LeadSurrogate(c);
-      *chars++ = unibrow::Utf16::TrailSurrogate(c);
-    } else {
-      len -= 1;
-      if (len < 0) break;
-      *chars++ = c;
-    }
+    *chars++ = c;
   }
-  DCHECK_EQ(0, stream_length);
-  DCHECK_EQ(0, len);
+  DCHECK_EQ(len, 0);
 }
 
 
@@ -3653,6 +3776,18 @@ AllocationResult Heap::AllocateEmptyFixedArray() {
   return result;
 }
 
+AllocationResult Heap::AllocateEmptyWeakFixedArray() {
+  int size = WeakFixedArray::SizeFor(0);
+  HeapObject* result = nullptr;
+  {
+    AllocationResult allocation = AllocateRaw(size, OLD_SPACE);
+    if (!allocation.To(&result)) return allocation;
+  }
+  result->set_map_after_allocation(weak_fixed_array_map(), SKIP_WRITE_BARRIER);
+  WeakFixedArray::cast(result)->set_length(0);
+  return result;
+}
+
 AllocationResult Heap::AllocateEmptyScopeInfo() {
   int size = FixedArray::SizeFor(0);
   HeapObject* result = nullptr;
@@ -3666,6 +3801,20 @@ AllocationResult Heap::AllocateEmptyScopeInfo() {
   return result;
 }
 
+AllocationResult Heap::AllocateEmptyBoilerplateDescription() {
+  int size = FixedArray::SizeFor(0);
+  HeapObject* result = nullptr;
+  {
+    AllocationResult allocation = AllocateRaw(size, OLD_SPACE);
+    if (!allocation.To(&result)) return allocation;
+  }
+  // Initialize the object.
+  result->set_map_after_allocation(boilerplate_description_map(),
+                                   SKIP_WRITE_BARRIER);
+  FixedArray::cast(result)->set_length(0);
+  return result;
+}
+
 AllocationResult Heap::CopyAndTenureFixedCOWArray(FixedArray* src) {
   if (!InNewSpace(src)) {
     return src;
@@ -3843,7 +3992,7 @@ AllocationResult Heap::CopyFeedbackVector(FeedbackVector* src) {
 
   // Slow case: Just copy the content one-by-one.
   result->set_shared_function_info(src->shared_function_info());
-  result->set_optimized_code_cell(src->optimized_code_cell());
+  result->set_optimized_code_weak_or_smi(src->optimized_code_weak_or_smi());
   result->set_invocation_count(src->invocation_count());
   result->set_profiler_ticks(src->profiler_ticks());
   result->set_deopt_count(src->deopt_count());
@@ -3851,12 +4000,7 @@ AllocationResult Heap::CopyFeedbackVector(FeedbackVector* src) {
   return result;
 }
 
-AllocationResult Heap::AllocateRawFixedArray(int length,
-                                             PretenureFlag pretenure) {
-  if (length < 0 || length > FixedArray::kMaxLength) {
-    v8::internal::Heap::FatalProcessOutOfMemory("invalid array length", true);
-  }
-  int size = FixedArray::SizeFor(length);
+AllocationResult Heap::AllocateRawArray(int size, PretenureFlag pretenure) {
   AllocationSpace space = SelectSpace(pretenure);
 
   AllocationResult result = AllocateRaw(size, space);
@@ -3944,7 +4088,7 @@ AllocationResult Heap::AllocateUninitializedFixedDoubleArray(
 AllocationResult Heap::AllocateRawFixedDoubleArray(int length,
                                                    PretenureFlag pretenure) {
   if (length < 0 || length > FixedDoubleArray::kMaxLength) {
-    v8::internal::Heap::FatalProcessOutOfMemory("invalid array length", true);
+    FatalProcessOutOfMemory("invalid array length");
   }
   int size = FixedDoubleArray::SizeFor(length);
   AllocationSpace space = SelectSpace(pretenure);
@@ -3958,6 +4102,24 @@ AllocationResult Heap::AllocateRawFixedDoubleArray(int length,
   return object;
 }
 
+AllocationResult Heap::AllocateFeedbackMetadata(int slot_count) {
+  HeapObject* result = nullptr;
+  int size = FeedbackMetadata::SizeFor(slot_count);
+  AllocationSpace space = SelectSpace(TENURED);
+
+  AllocationResult allocation = AllocateRaw(size, space);
+  if (!allocation.To(&result)) return allocation;
+
+  result->set_map_after_allocation(feedback_metadata_map(), SKIP_WRITE_BARRIER);
+  FeedbackMetadata::cast(result)->set_slot_count(slot_count);
+
+  // Initialize the data section to 0.
+  int data_size = size - FeedbackMetadata::kHeaderSize;
+  byte* data_start = result->address() + FeedbackMetadata::kHeaderSize;
+  memset(data_start, 0, data_size);
+  return result;
+}
+
 AllocationResult Heap::AllocateRawFeedbackVector(int length,
                                                  PretenureFlag pretenure) {
   DCHECK_LE(0, length);
@@ -3988,9 +4150,9 @@ AllocationResult Heap::AllocateFeedbackVector(SharedFunctionInfo* shared,
   result->set_map_after_allocation(feedback_vector_map(), SKIP_WRITE_BARRIER);
   FeedbackVector* vector = FeedbackVector::cast(result);
   vector->set_shared_function_info(shared);
-  vector->set_optimized_code_cell(Smi::FromEnum(
+  vector->set_optimized_code_weak_or_smi(MaybeObject::FromSmi(Smi::FromEnum(
       FLAG_log_function_events ? OptimizationMarker::kLogFirstExecution
-                               : OptimizationMarker::kNone));
+                               : OptimizationMarker::kNone)));
   vector->set_length(length);
   vector->set_invocation_count(0);
   vector->set_profiler_ticks(0);
@@ -4117,6 +4279,34 @@ bool Heap::HasLowAllocationRate() {
          HasLowOldGenerationAllocationRate();
 }
 
+bool Heap::IsIneffectiveMarkCompact(size_t old_generation_size,
+                                    double mutator_utilization) {
+  const double kHighHeapPercentage = 0.8;
+  const double kLowMutatorUtilization = 0.4;
+  return old_generation_size >=
+             kHighHeapPercentage * max_old_generation_size_ &&
+         mutator_utilization < kLowMutatorUtilization;
+}
+
+void Heap::CheckIneffectiveMarkCompact(size_t old_generation_size,
+                                       double mutator_utilization) {
+  const int kMaxConsecutiveIneffectiveMarkCompacts = 4;
+  if (!FLAG_detect_ineffective_gcs_near_heap_limit) return;
+  if (!IsIneffectiveMarkCompact(old_generation_size, mutator_utilization)) {
+    consecutive_ineffective_mark_compacts_ = 0;
+    return;
+  }
+  ++consecutive_ineffective_mark_compacts_;
+  if (consecutive_ineffective_mark_compacts_ ==
+      kMaxConsecutiveIneffectiveMarkCompacts) {
+    if (InvokeNearHeapLimitCallback()) {
+      // The callback increased the heap limit.
+      consecutive_ineffective_mark_compacts_ = 0;
+      return;
+    }
+    FatalProcessOutOfMemory("Ineffective mark-compacts near heap limit");
+  }
+}
 
 bool Heap::HasHighFragmentation() {
   size_t used = PromotedSpaceSizeOfObjects();
@@ -4254,17 +4444,22 @@ void Heap::NotifyObjectLayoutChange(HeapObject* object, int size,
 class SlotCollectingVisitor final : public ObjectVisitor {
  public:
   void VisitPointers(HeapObject* host, Object** start, Object** end) override {
-    for (Object** p = start; p < end; p++) {
+    VisitPointers(host, reinterpret_cast<MaybeObject**>(start),
+                  reinterpret_cast<MaybeObject**>(end));
+  }
+  void VisitPointers(HeapObject* host, MaybeObject** start,
+                     MaybeObject** end) final {
+    for (MaybeObject** p = start; p < end; p++) {
       slots_.push_back(p);
     }
   }
 
   int number_of_slots() { return static_cast<int>(slots_.size()); }
 
-  Object** slot(int i) { return slots_[i]; }
+  MaybeObject** slot(int i) { return slots_[i]; }
 
  private:
-  std::vector<Object**> slots_;
+  std::vector<MaybeObject**> slots_;
 };
 
 void Heap::VerifyObjectLayoutChange(HeapObject* object, Map* new_map) {
@@ -4447,12 +4642,8 @@ class MemoryPressureInterruptTask : public CancelableTask {
 
 void Heap::CheckMemoryPressure() {
   if (HighMemoryPressure()) {
-    if (isolate()->concurrent_recompilation_enabled()) {
-      // The optimizing compiler may be unnecessarily holding on to memory.
-      DisallowHeapAllocation no_recursive_gc;
-      isolate()->optimizing_compile_dispatcher()->Flush(
-          OptimizingCompileDispatcher::BlockingBehavior::kDontBlock);
-    }
+    // The optimizing compiler may be unnecessarily holding on to memory.
+    isolate()->AbortConcurrentOptimization(BlockingBehavior::kDontBlock);
   }
   if (memory_pressure_level_.Value() == MemoryPressureLevel::kCritical) {
     CollectGarbageOnMemoryPressure();
@@ -4526,16 +4717,43 @@ void Heap::MemoryPressureNotification(MemoryPressureLevel level,
   }
 }
 
-void Heap::SetOutOfMemoryCallback(v8::debug::OutOfMemoryCallback callback,
-                                  void* data) {
-  out_of_memory_callback_ = callback;
-  out_of_memory_callback_data_ = data;
+void Heap::AddNearHeapLimitCallback(v8::NearHeapLimitCallback callback,
+                                    void* data) {
+  const size_t kMaxCallbacks = 100;
+  CHECK_LT(near_heap_limit_callbacks_.size(), kMaxCallbacks);
+  for (auto callback_data : near_heap_limit_callbacks_) {
+    CHECK_NE(callback_data.first, callback);
+  }
+  near_heap_limit_callbacks_.push_back(std::make_pair(callback, data));
 }
 
-void Heap::InvokeOutOfMemoryCallback() {
-  if (out_of_memory_callback_) {
-    out_of_memory_callback_(out_of_memory_callback_data_);
+void Heap::RemoveNearHeapLimitCallback(v8::NearHeapLimitCallback callback,
+                                       size_t heap_limit) {
+  for (size_t i = 0; i < near_heap_limit_callbacks_.size(); i++) {
+    if (near_heap_limit_callbacks_[i].first == callback) {
+      near_heap_limit_callbacks_.erase(near_heap_limit_callbacks_.begin() + i);
+      if (heap_limit) {
+        RestoreHeapLimit(heap_limit);
+      }
+      return;
+    }
   }
+  UNREACHABLE();
+}
+
+bool Heap::InvokeNearHeapLimitCallback() {
+  if (near_heap_limit_callbacks_.size() > 0) {
+    v8::NearHeapLimitCallback callback =
+        near_heap_limit_callbacks_.back().first;
+    void* data = near_heap_limit_callbacks_.back().second;
+    size_t heap_limit = callback(data, max_old_generation_size_,
+                                 initial_max_old_generation_size_);
+    if (heap_limit > max_old_generation_size_) {
+      max_old_generation_size_ = heap_limit;
+      return true;
+    }
+  }
+  return false;
 }
 
 void Heap::CollectCodeStatistics() {
@@ -4625,7 +4843,7 @@ bool Heap::Contains(HeapObject* value) {
   return HasBeenSetUp() &&
          (new_space_->ToSpaceContains(value) || old_space_->Contains(value) ||
           code_space_->Contains(value) || map_space_->Contains(value) ||
-          lo_space_->Contains(value));
+          lo_space_->Contains(value) || read_only_space_->Contains(value));
 }
 
 bool Heap::ContainsSlow(Address addr) {
@@ -4635,7 +4853,8 @@ bool Heap::ContainsSlow(Address addr) {
   return HasBeenSetUp() &&
          (new_space_->ToSpaceContainsSlow(addr) ||
           old_space_->ContainsSlow(addr) || code_space_->ContainsSlow(addr) ||
-          map_space_->ContainsSlow(addr) || lo_space_->ContainsSlow(addr));
+          map_space_->ContainsSlow(addr) || lo_space_->ContainsSlow(addr) ||
+          read_only_space_->Contains(addr));
 }
 
 bool Heap::InSpace(HeapObject* value, AllocationSpace space) {
@@ -4655,6 +4874,8 @@ bool Heap::InSpace(HeapObject* value, AllocationSpace space) {
       return map_space_->Contains(value);
     case LO_SPACE:
       return lo_space_->Contains(value);
+    case RO_SPACE:
+      return read_only_space_->Contains(value);
   }
   UNREACHABLE();
 }
@@ -4676,6 +4897,8 @@ bool Heap::InSpaceSlow(Address addr, AllocationSpace space) {
       return map_space_->ContainsSlow(addr);
     case LO_SPACE:
       return lo_space_->ContainsSlow(addr);
+    case RO_SPACE:
+      return read_only_space_->ContainsSlow(addr);
   }
   UNREACHABLE();
 }
@@ -4688,6 +4911,7 @@ bool Heap::IsValidAllocationSpace(AllocationSpace space) {
     case CODE_SPACE:
     case MAP_SPACE:
     case LO_SPACE:
+    case RO_SPACE:
       return true;
     default:
       return false;
@@ -4713,6 +4937,22 @@ bool Heap::RootIsImmortalImmovable(int root_index) {
 }
 
 #ifdef VERIFY_HEAP
+class VerifyReadOnlyPointersVisitor : public VerifyPointersVisitor {
+ protected:
+  void VerifyPointers(HeapObject* host, MaybeObject** start,
+                      MaybeObject** end) override {
+    VerifyPointersVisitor::VerifyPointers(host, start, end);
+
+    for (MaybeObject** current = start; current < end; current++) {
+      HeapObject* object;
+      if ((*current)->ToStrongOrWeakHeapObject(&object)) {
+        CHECK(
+            object->GetIsolate()->heap()->read_only_space()->Contains(object));
+      }
+    }
+  }
+};
+
 void Heap::Verify() {
   CHECK(HasBeenSetUp());
   HandleScope scope(isolate());
@@ -4736,7 +4976,8 @@ void Heap::Verify() {
 
   lo_space_->Verify();
 
-  mark_compact_collector()->VerifyWeakEmbeddedObjectsInCode();
+  VerifyReadOnlyPointersVisitor read_only_visitor;
+  read_only_space_->Verify(&read_only_visitor);
 }
 
 class SlotVerifyingVisitor : public ObjectVisitor {
@@ -4745,10 +4986,22 @@ class SlotVerifyingVisitor : public ObjectVisitor {
                        std::set<std::pair<SlotType, Address> >* typed)
       : untyped_(untyped), typed_(typed) {}
 
-  virtual bool ShouldHaveBeenRecorded(HeapObject* host, Object* target) = 0;
+  virtual bool ShouldHaveBeenRecorded(HeapObject* host,
+                                      MaybeObject* target) = 0;
 
   void VisitPointers(HeapObject* host, Object** start, Object** end) override {
+#ifdef DEBUG
     for (Object** slot = start; slot < end; slot++) {
+      DCHECK(!HasWeakHeapObjectTag(*slot));
+    }
+#endif  // DEBUG
+    VisitPointers(host, reinterpret_cast<MaybeObject**>(start),
+                  reinterpret_cast<MaybeObject**>(end));
+  }
+
+  void VisitPointers(HeapObject* host, MaybeObject** start,
+                     MaybeObject** end) final {
+    for (MaybeObject** slot = start; slot < end; slot++) {
       if (ShouldHaveBeenRecorded(host, *slot)) {
         CHECK_GT(untyped_->count(reinterpret_cast<Address>(slot)), 0);
       }
@@ -4757,7 +5010,7 @@ class SlotVerifyingVisitor : public ObjectVisitor {
 
   void VisitCodeTarget(Code* host, RelocInfo* rinfo) override {
     Object* target = Code::GetCodeFromTargetAddress(rinfo->target_address());
-    if (ShouldHaveBeenRecorded(host, target)) {
+    if (ShouldHaveBeenRecorded(host, MaybeObject::FromObject(target))) {
       CHECK(
           InTypedSet(CODE_TARGET_SLOT, rinfo->pc()) ||
           (rinfo->IsInConstantPool() &&
@@ -4767,7 +5020,7 @@ class SlotVerifyingVisitor : public ObjectVisitor {
 
   void VisitEmbeddedPointer(Code* host, RelocInfo* rinfo) override {
     Object* target = rinfo->target_object();
-    if (ShouldHaveBeenRecorded(host, target)) {
+    if (ShouldHaveBeenRecorded(host, MaybeObject::FromObject(target))) {
       CHECK(InTypedSet(EMBEDDED_OBJECT_SLOT, rinfo->pc()) ||
             (rinfo->IsInConstantPool() &&
              InTypedSet(OBJECT_SLOT, rinfo->constant_pool_entry_address())));
@@ -4788,10 +5041,11 @@ class OldToNewSlotVerifyingVisitor : public SlotVerifyingVisitor {
                                std::set<std::pair<SlotType, Address> >* typed)
       : SlotVerifyingVisitor(untyped, typed), heap_(heap) {}
 
-  bool ShouldHaveBeenRecorded(HeapObject* host, Object* target) override {
-    DCHECK_IMPLIES(target->IsHeapObject() && heap_->InNewSpace(target),
-                   heap_->InToSpace(target));
-    return target->IsHeapObject() && heap_->InNewSpace(target) &&
+  bool ShouldHaveBeenRecorded(HeapObject* host, MaybeObject* target) override {
+    DCHECK_IMPLIES(
+        target->IsStrongOrWeakHeapObject() && heap_->InNewSpace(target),
+        heap_->InToSpace(target));
+    return target->IsStrongOrWeakHeapObject() && heap_->InNewSpace(target) &&
            !heap_->InNewSpace(host);
   }
 
@@ -4868,6 +5122,14 @@ void Heap::ZapFromSpace() {
   }
 }
 
+void Heap::ZapCodeObject(Address start_address, int size_in_bytes) {
+#ifdef DEBUG
+  for (int i = 0; i < size_in_bytes / kPointerSize; i++) {
+    reinterpret_cast<Object**>(start_address)[i] = Smi::FromInt(kCodeZapValue);
+  }
+#endif
+}
+
 void Heap::IterateRoots(RootVisitor* v, VisitMode mode) {
   IterateStrongRoots(v, mode);
   IterateWeakRoots(v, mode);
@@ -4877,8 +5139,9 @@ void Heap::IterateWeakRoots(RootVisitor* v, VisitMode mode) {
   const bool isMinorGC = mode == VISIT_ALL_IN_SCAVENGE ||
                          mode == VISIT_ALL_IN_MINOR_MC_MARK ||
                          mode == VISIT_ALL_IN_MINOR_MC_UPDATE;
-  v->VisitRootPointer(Root::kStringTable, reinterpret_cast<Object**>(
-                                              &roots_[kStringTableRootIndex]));
+  v->VisitRootPointer(
+      Root::kStringTable, nullptr,
+      reinterpret_cast<Object**>(&roots_[kStringTableRootIndex]));
   v->Synchronize(VisitorSynchronization::kStringTable);
   if (!isMinorGC && mode != VISIT_ALL_IN_SWEEP_NEWSPACE &&
       mode != VISIT_FOR_SERIALIZATION) {
@@ -4893,13 +5156,13 @@ void Heap::IterateWeakRoots(RootVisitor* v, VisitMode mode) {
 void Heap::IterateSmiRoots(RootVisitor* v) {
   // Acquire execution access since we are going to read stack limit values.
   ExecutionAccess access(isolate());
-  v->VisitRootPointers(Root::kSmiRootList, &roots_[kSmiRootsStart],
+  v->VisitRootPointers(Root::kSmiRootList, nullptr, &roots_[kSmiRootsStart],
                        &roots_[kRootListLength]);
   v->Synchronize(VisitorSynchronization::kSmiRootList);
 }
 
 void Heap::IterateEncounteredWeakCollections(RootVisitor* visitor) {
-  visitor->VisitRootPointer(Root::kWeakCollections,
+  visitor->VisitRootPointer(Root::kWeakCollections, nullptr,
                             &encountered_weak_collections_);
 }
 
@@ -4913,9 +5176,13 @@ class FixStaleLeftTrimmedHandlesVisitor : public RootVisitor {
     USE(heap_);
   }
 
-  void VisitRootPointer(Root root, Object** p) override { FixHandle(p); }
+  void VisitRootPointer(Root root, const char* description,
+                        Object** p) override {
+    FixHandle(p);
+  }
 
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {
     for (Object** p = start; p < end; p++) FixHandle(p);
   }
 
@@ -4951,7 +5218,7 @@ void Heap::IterateStrongRoots(RootVisitor* v, VisitMode mode) {
   const bool isMinorGC = mode == VISIT_ALL_IN_SCAVENGE ||
                          mode == VISIT_ALL_IN_MINOR_MC_MARK ||
                          mode == VISIT_ALL_IN_MINOR_MC_UPDATE;
-  v->VisitRootPointers(Root::kStrongRootList, &roots_[0],
+  v->VisitRootPointers(Root::kStrongRootList, nullptr, &roots_[0],
                        &roots_[kStrongRootListLength]);
   v->Synchronize(VisitorSynchronization::kStrongRootList);
 
@@ -5026,7 +5293,7 @@ void Heap::IterateStrongRoots(RootVisitor* v, VisitMode mode) {
 
   // Iterate over other strong roots (currently only identity maps).
   for (StrongRootsList* list = strong_roots_list_; list; list = list->next) {
-    v->VisitRootPointers(Root::kStrongRoots, list->start, list->end);
+    v->VisitRootPointers(Root::kStrongRoots, nullptr, list->start, list->end);
   }
   v->Synchronize(VisitorSynchronization::kStrongRoots);
 
@@ -5038,6 +5305,9 @@ void Heap::IterateStrongRoots(RootVisitor* v, VisitMode mode) {
   }
 }
 
+void Heap::IterateWeakGlobalHandles(RootVisitor* v) {
+  isolate_->global_handles()->IterateWeakRoots(v);
+}
 
 // TODO(1236194): Since the heap size is configurable on the command line
 // and through the API, we should gracefully handle the case that the heap
@@ -5111,7 +5381,8 @@ bool Heap::ConfigureHeap(size_t max_semi_space_size_in_kb,
   }
 
   // The old generation is paged and needs at least one page for each space.
-  int paged_space_count = LAST_PAGED_SPACE - FIRST_PAGED_SPACE + 1;
+  int paged_space_count =
+      LAST_GROWABLE_PAGED_SPACE - FIRST_GROWABLE_PAGED_SPACE + 1;
   initial_max_old_generation_size_ = max_old_generation_size_ =
       Max(static_cast<size_t>(paged_space_count * Page::kPageSize),
           max_old_generation_size_);
@@ -5544,7 +5815,8 @@ bool Heap::SetUp() {
 
   mark_compact_collector_ = new MarkCompactCollector(this);
   incremental_marking_ =
-      new IncrementalMarking(this, mark_compact_collector_->marking_worklist());
+      new IncrementalMarking(this, mark_compact_collector_->marking_worklist(),
+                             mark_compact_collector_->weak_objects());
 
   if (FLAG_concurrent_marking) {
     MarkCompactCollector::MarkingWorklist* marking_worklist =
@@ -5582,6 +5854,10 @@ bool Heap::SetUp() {
   space_[LO_SPACE] = lo_space_ = new LargeObjectSpace(this, LO_SPACE);
   if (!lo_space_->SetUp()) return false;
 
+  space_[RO_SPACE] = read_only_space_ =
+      new ReadOnlySpace(this, RO_SPACE, NOT_EXECUTABLE);
+  if (!read_only_space_->SetUp()) return false;
+
   // Set up the seed that is used to randomize the string hash function.
   DCHECK_EQ(Smi::kZero, hash_seed());
   if (FLAG_randomize_hashes) InitializeHashSeed();
@@ -5633,6 +5909,8 @@ bool Heap::SetUp() {
 
   write_protect_code_memory_ = FLAG_write_protect_code_memory;
 
+  external_reference_table_.Init(isolate_);
+
   return true;
 }
 
@@ -5744,8 +6022,10 @@ void Heap::RegisterExternallyReferencedObject(Object** object) {
   }
 }
 
+void Heap::StartTearDown() { SetGCState(TEAR_DOWN); }
+
 void Heap::TearDown() {
-  use_tasks_ = false;
+  DCHECK_EQ(gc_state_, TEAR_DOWN);
 #ifdef VERIFY_HEAP
   if (FLAG_verify_heap) {
     Verify();
@@ -5863,6 +6143,11 @@ void Heap::TearDown() {
     lo_space_ = nullptr;
   }
 
+  if (read_only_space_ != nullptr) {
+    delete read_only_space_;
+    read_only_space_ = nullptr;
+  }
+
   store_buffer()->TearDown();
 
   memory_allocator()->TearDown();
@@ -5927,64 +6212,37 @@ void Heap::RemoveGCEpilogueCallback(v8::Isolate::GCCallbackWithData callback,
   UNREACHABLE();
 }
 
-// TODO(ishell): Find a better place for this.
-void Heap::AddWeakNewSpaceObjectToCodeDependency(Handle<HeapObject> obj,
-                                                 Handle<WeakCell> code) {
-  DCHECK(InNewSpace(*obj));
-  DCHECK(!InNewSpace(*code));
-  Handle<ArrayList> list(weak_new_space_object_to_code_list(), isolate());
-  list = ArrayList::Add(list, isolate()->factory()->NewWeakCell(obj), code);
-  if (*list != weak_new_space_object_to_code_list()) {
-    set_weak_new_space_object_to_code_list(*list);
-  }
-}
-
-// TODO(ishell): Find a better place for this.
-void Heap::AddWeakObjectToCodeDependency(Handle<HeapObject> obj,
-                                         Handle<DependentCode> dep) {
-  DCHECK(!InNewSpace(*obj));
-  DCHECK(!InNewSpace(*dep));
-  Handle<WeakHashTable> table(weak_object_to_code_table(), isolate());
-  table = WeakHashTable::Put(table, obj, dep);
-  if (*table != weak_object_to_code_table())
-    set_weak_object_to_code_table(*table);
-  DCHECK_EQ(*dep, LookupWeakObjectToCodeDependency(obj));
-}
-
-
-DependentCode* Heap::LookupWeakObjectToCodeDependency(Handle<HeapObject> obj) {
-  Object* dep = weak_object_to_code_table()->Lookup(obj);
-  if (dep->IsDependentCode()) return DependentCode::cast(dep);
-  return DependentCode::cast(empty_fixed_array());
-}
-
 namespace {
-void CompactWeakFixedArray(Object* object) {
-  if (object->IsWeakFixedArray()) {
-    WeakFixedArray* array = WeakFixedArray::cast(object);
-    array->Compact<WeakFixedArray::NullCallback>();
+void CompactFixedArrayOfWeakCells(Object* object) {
+  if (object->IsFixedArrayOfWeakCells()) {
+    FixedArrayOfWeakCells* array = FixedArrayOfWeakCells::cast(object);
+    array->Compact<FixedArrayOfWeakCells::NullCallback>();
   }
 }
 }  // anonymous namespace
 
-void Heap::CompactWeakFixedArrays() {
-  // Find known WeakFixedArrays and compact them.
+void Heap::CompactFixedArraysOfWeakCells() {
+  // Find known FixedArrayOfWeakCells and compact them.
   HeapIterator iterator(this);
   for (HeapObject* o = iterator.next(); o != nullptr; o = iterator.next()) {
     if (o->IsPrototypeInfo()) {
       Object* prototype_users = PrototypeInfo::cast(o)->prototype_users();
-      if (prototype_users->IsWeakFixedArray()) {
-        WeakFixedArray* array = WeakFixedArray::cast(prototype_users);
+      if (prototype_users->IsFixedArrayOfWeakCells()) {
+        FixedArrayOfWeakCells* array =
+            FixedArrayOfWeakCells::cast(prototype_users);
         array->Compact<JSObject::PrototypeRegistryCompactionCallback>();
       }
     }
   }
-  CompactWeakFixedArray(noscript_shared_function_infos());
-  CompactWeakFixedArray(script_list());
-  CompactWeakFixedArray(weak_stack_trace_list());
+  CompactFixedArrayOfWeakCells(noscript_shared_function_infos());
+  CompactFixedArrayOfWeakCells(script_list());
+  CompactFixedArrayOfWeakCells(weak_stack_trace_list());
 }
 
 void Heap::AddRetainedMap(Handle<Map> map) {
+  if (map->is_in_retained_map_list()) {
+    return;
+  }
   Handle<WeakCell> cell = Map::WeakCellForMap(map);
   Handle<ArrayList> array(retained_maps(), isolate());
   if (array->IsFull()) {
@@ -5996,6 +6254,7 @@ void Heap::AddRetainedMap(Handle<Map> map) {
   if (*array != retained_maps()) {
     set_retained_maps(*array);
   }
+  map->set_is_in_retained_map_list(true);
 }
 
 
@@ -6027,15 +6286,16 @@ void Heap::CompactRetainedMaps(ArrayList* retained_maps) {
   if (new_length != length) retained_maps->SetLength(new_length);
 }
 
-void Heap::FatalProcessOutOfMemory(const char* location, bool is_heap_oom) {
-  v8::internal::V8::FatalProcessOutOfMemory(location, is_heap_oom);
+void Heap::FatalProcessOutOfMemory(const char* location) {
+  v8::internal::V8::FatalProcessOutOfMemory(isolate(), location, true);
 }
 
 #ifdef DEBUG
 
 class PrintHandleVisitor : public RootVisitor {
  public:
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {
     for (Object** p = start; p < end; p++)
       PrintF("  handle %p to %p\n", reinterpret_cast<void*>(p),
              reinterpret_cast<void*>(*p));
@@ -6057,7 +6317,8 @@ class CheckHandleCountVisitor : public RootVisitor {
   ~CheckHandleCountVisitor() override {
     CHECK_GT(HandleScope::kCheckHandleThreshold, handle_count_);
   }
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {
     handle_count_ += end - start;
   }
 
@@ -6130,6 +6391,10 @@ void Heap::RecordWritesIntoCode(Code* code) {
 
 PagedSpace* PagedSpaces::next() {
   switch (counter_++) {
+    case RO_SPACE:
+      // skip NEW_SPACE
+      counter_++;
+      return heap_->read_only_space();
     case OLD_SPACE:
       return heap_->old_space();
     case CODE_SPACE:
@@ -6204,13 +6469,21 @@ class UnreachableObjectsFilter : public HeapObjectsFilter {
 
     void VisitPointers(HeapObject* host, Object** start,
                        Object** end) override {
-      MarkPointers(start, end);
+      MarkPointers(reinterpret_cast<MaybeObject**>(start),
+                   reinterpret_cast<MaybeObject**>(end));
     }
 
-    void VisitRootPointers(Root root, Object** start, Object** end) override {
+    void VisitPointers(HeapObject* host, MaybeObject** start,
+                       MaybeObject** end) final {
       MarkPointers(start, end);
     }
 
+    void VisitRootPointers(Root root, const char* description, Object** start,
+                           Object** end) override {
+      MarkPointers(reinterpret_cast<MaybeObject**>(start),
+                   reinterpret_cast<MaybeObject**>(end));
+    }
+
     void TransitiveClosure() {
       while (!marking_stack_.empty()) {
         HeapObject* obj = marking_stack_.back();
@@ -6220,12 +6493,14 @@ class UnreachableObjectsFilter : public HeapObjectsFilter {
     }
 
    private:
-    void MarkPointers(Object** start, Object** end) {
-      for (Object** p = start; p < end; p++) {
-        if (!(*p)->IsHeapObject()) continue;
-        HeapObject* obj = HeapObject::cast(*p);
-        if (filter_->MarkAsReachable(obj)) {
-          marking_stack_.push_back(obj);
+    void MarkPointers(MaybeObject** start, MaybeObject** end) {
+      // Treat weak references as strong.
+      for (MaybeObject** p = start; p < end; p++) {
+        HeapObject* heap_object;
+        if ((*p)->ToStrongOrWeakHeapObject(&heap_object)) {
+          if (filter_->MarkAsReachable(heap_object)) {
+            marking_stack_.push_back(heap_object);
+          }
         }
       }
     }
@@ -6449,6 +6724,10 @@ void Heap::SetDeserializeLazyHandlerExtraWide(Code* code) {
   set_deserialize_lazy_handler_extra_wide(code);
 }
 
+void Heap::SetBuiltinsConstantsTable(FixedArray* cache) {
+  set_builtins_constants_table(cache);
+}
+
 size_t Heap::NumberOfTrackedHeapObjectTypes() {
   return ObjectStats::OBJECT_STATS_COUNT;
 }
@@ -6480,19 +6759,13 @@ bool Heap::GetObjectTypeName(size_t index, const char** object_type,
     return true;
     INSTANCE_TYPE_LIST(COMPARE_AND_RETURN_NAME)
 #undef COMPARE_AND_RETURN_NAME
-#define COMPARE_AND_RETURN_NAME(name)                      \
-  case ObjectStats::FIRST_CODE_KIND_SUB_TYPE + Code::name: \
-    *object_type = "CODE_TYPE";                            \
-    *object_sub_type = "CODE_KIND/" #name;                 \
-    return true;
-    CODE_KIND_LIST(COMPARE_AND_RETURN_NAME)
-#undef COMPARE_AND_RETURN_NAME
-#define COMPARE_AND_RETURN_NAME(name)                  \
-  case ObjectStats::FIRST_FIXED_ARRAY_SUB_TYPE + name: \
-    *object_type = "FIXED_ARRAY_TYPE";                 \
-    *object_sub_type = #name;                          \
+
+#define COMPARE_AND_RETURN_NAME(name)                       \
+  case ObjectStats::FIRST_VIRTUAL_TYPE + ObjectStats::name: \
+    *object_type = #name;                                   \
+    *object_sub_type = "";                                  \
     return true;
-    FIXED_ARRAY_SUB_INSTANCE_TYPE_LIST(COMPARE_AND_RETURN_NAME)
+    VIRTUAL_INSTANCE_TYPE_LIST(COMPARE_AND_RETURN_NAME)
 #undef COMPARE_AND_RETURN_NAME
   }
   return false;
@@ -6526,6 +6799,8 @@ const char* AllocationSpaceName(AllocationSpace space) {
       return "MAP_SPACE";
     case LO_SPACE:
       return "LO_SPACE";
+    case RO_SPACE:
+      return "RO_SPACE";
     default:
       UNREACHABLE();
   }
@@ -6534,28 +6809,38 @@ const char* AllocationSpaceName(AllocationSpace space) {
 
 void VerifyPointersVisitor::VisitPointers(HeapObject* host, Object** start,
                                           Object** end) {
-  VerifyPointers(start, end);
+  VerifyPointers(host, reinterpret_cast<MaybeObject**>(start),
+                 reinterpret_cast<MaybeObject**>(end));
 }
 
-void VerifyPointersVisitor::VisitRootPointers(Root root, Object** start,
-                                              Object** end) {
-  VerifyPointers(start, end);
+void VerifyPointersVisitor::VisitPointers(HeapObject* host, MaybeObject** start,
+                                          MaybeObject** end) {
+  VerifyPointers(host, start, end);
 }
 
-void VerifyPointersVisitor::VerifyPointers(Object** start, Object** end) {
-  for (Object** current = start; current < end; current++) {
-    if ((*current)->IsHeapObject()) {
-      HeapObject* object = HeapObject::cast(*current);
+void VerifyPointersVisitor::VisitRootPointers(Root root,
+                                              const char* description,
+                                              Object** start, Object** end) {
+  VerifyPointers(nullptr, reinterpret_cast<MaybeObject**>(start),
+                 reinterpret_cast<MaybeObject**>(end));
+}
+
+void VerifyPointersVisitor::VerifyPointers(HeapObject* host,
+                                           MaybeObject** start,
+                                           MaybeObject** end) {
+  for (MaybeObject** current = start; current < end; current++) {
+    HeapObject* object;
+    if ((*current)->ToStrongOrWeakHeapObject(&object)) {
       CHECK(object->GetIsolate()->heap()->Contains(object));
       CHECK(object->map()->IsMap());
     } else {
-      CHECK((*current)->IsSmi());
+      CHECK((*current)->IsSmi() || (*current)->IsClearedWeakHeapObject());
     }
   }
 }
 
-void VerifySmisVisitor::VisitRootPointers(Root root, Object** start,
-                                          Object** end) {
+void VerifySmisVisitor::VisitRootPointers(Root root, const char* description,
+                                          Object** start, Object** end) {
   for (Object** current = start; current < end; current++) {
     CHECK((*current)->IsSmi());
   }
@@ -6580,14 +6865,14 @@ bool Heap::AllowedToBeMigrated(HeapObject* obj, AllocationSpace dst) {
   AllocationSpace src = chunk->owner()->identity();
   switch (src) {
     case NEW_SPACE:
-      return dst == src || dst == OLD_SPACE;
+      return dst == NEW_SPACE || dst == OLD_SPACE;
     case OLD_SPACE:
-      return dst == src &&
-             (dst == OLD_SPACE || obj->IsFiller() || obj->IsExternalString());
+      return dst == OLD_SPACE;
     case CODE_SPACE:
-      return dst == src && type == CODE_TYPE;
+      return dst == CODE_SPACE && type == CODE_TYPE;
     case MAP_SPACE:
     case LO_SPACE:
+    case RO_SPACE:
       return false;
   }
   UNREACHABLE();
@@ -6612,6 +6897,7 @@ void AllocationObserver::AllocationStep(int bytes_allocated,
     step_size_ = GetNextStepSize();
     bytes_to_next_step_ = step_size_;
   }
+  DCHECK_GE(bytes_to_next_step_, 0);
 }
 
 namespace {
@@ -6638,12 +6924,20 @@ Code* GcSafeCastToCode(Heap* heap, HeapObject* object, Address inner_pointer) {
 bool Heap::GcSafeCodeContains(HeapObject* code, Address addr) {
   Map* map = GcSafeMapOfCodeSpaceObject(code);
   DCHECK(map == code->GetHeap()->code_map());
+#ifdef V8_EMBEDDED_BUILTINS
+  if (InstructionStream::TryLookupCode(isolate(), addr) == code) return true;
+#endif
   Address start = code->address();
   Address end = code->address() + code->SizeFromMap(map);
   return start <= addr && addr < end;
 }
 
 Code* Heap::GcSafeFindCodeForInnerPointer(Address inner_pointer) {
+#ifdef V8_EMBEDDED_BUILTINS
+  Code* code = InstructionStream::TryLookupCode(isolate(), inner_pointer);
+  if (code != nullptr) return code;
+#endif
+
   // Check if the inner pointer points into a large object chunk.
   LargePage* large_page = lo_space()->FindPage(inner_pointer);
   if (large_page != nullptr) {
diff --git a/deps/v8/src/heap/heap.h b/deps/v8/src/heap/heap.h
index 7cc65479cab..f48cdd04d00 100644
--- a/deps/v8/src/heap/heap.h
+++ b/deps/v8/src/heap/heap.h
@@ -8,6 +8,7 @@
 #include <cmath>
 #include <map>
 #include <unordered_map>
+#include <unordered_set>
 #include <vector>
 
 // Clients of this interface shouldn't depend on lots of heap internals.
@@ -17,6 +18,7 @@
 #include "src/allocation.h"
 #include "src/assert-scope.h"
 #include "src/base/atomic-utils.h"
+#include "src/external-reference-table.h"
 #include "src/globals.h"
 #include "src/heap-symbols.h"
 #include "src/objects.h"
@@ -38,6 +40,7 @@ class HeapTester;
 class TestMemoryAllocatorScope;
 }  // namespace heap
 
+class BoilerplateDescription;
 class BytecodeArray;
 class CodeDataContainer;
 class DeoptimizationData;
@@ -87,7 +90,7 @@ using v8::MemoryPressureLevel;
   /* Entries beyond the first 32                                            */ \
   /* The roots above this line should be boring from a GC point of view.    */ \
   /* This means they are never in new space and never on a page that is     */ \
-  /* being compacted.                                                       */ \
+  /* being compacted.*/                                                        \
   /* Oddballs */                                                               \
   V(Oddball, arguments_marker, ArgumentsMarker)                                \
   V(Oddball, exception, Exception)                                             \
@@ -105,30 +108,33 @@ using v8::MemoryPressureLevel;
   V(Map, debug_evaluate_context_map, DebugEvaluateContextMap)                  \
   V(Map, script_context_table_map, ScriptContextTableMap)                      \
   /* Maps */                                                                   \
-  V(Map, descriptor_array_map, DescriptorArrayMap)                             \
+  V(Map, feedback_metadata_map, FeedbackMetadataArrayMap)                      \
   V(Map, array_list_map, ArrayListMap)                                         \
+  V(Map, bigint_map, BigIntMap)                                                \
+  V(Map, boilerplate_description_map, BoilerplateDescriptionMap)               \
+  V(Map, bytecode_array_map, BytecodeArrayMap)                                 \
+  V(Map, code_data_container_map, CodeDataContainerMap)                        \
+  V(Map, descriptor_array_map, DescriptorArrayMap)                             \
+  V(Map, external_map, ExternalMap)                                            \
   V(Map, fixed_double_array_map, FixedDoubleArrayMap)                          \
-  V(Map, mutable_heap_number_map, MutableHeapNumberMap)                        \
-  V(Map, ordered_hash_map_map, OrderedHashMapMap)                              \
-  V(Map, ordered_hash_set_map, OrderedHashSetMap)                              \
-  V(Map, name_dictionary_map, NameDictionaryMap)                               \
   V(Map, global_dictionary_map, GlobalDictionaryMap)                           \
-  V(Map, number_dictionary_map, NumberDictionaryMap)                           \
-  V(Map, string_table_map, StringTableMap)                                     \
-  V(Map, weak_hash_table_map, WeakHashTableMap)                                \
-  V(Map, sloppy_arguments_elements_map, SloppyArgumentsElementsMap)            \
-  V(Map, small_ordered_hash_map_map, SmallOrderedHashMapMap)                   \
-  V(Map, small_ordered_hash_set_map, SmallOrderedHashSetMap)                   \
-  V(Map, code_data_container_map, CodeDataContainerMap)                        \
+  V(Map, many_closures_cell_map, ManyClosuresCellMap)                          \
   V(Map, message_object_map, JSMessageObjectMap)                               \
-  V(Map, external_map, ExternalMap)                                            \
-  V(Map, bytecode_array_map, BytecodeArrayMap)                                 \
   V(Map, module_info_map, ModuleInfoMap)                                       \
+  V(Map, mutable_heap_number_map, MutableHeapNumberMap)                        \
+  V(Map, name_dictionary_map, NameDictionaryMap)                               \
   V(Map, no_closures_cell_map, NoClosuresCellMap)                              \
+  V(Map, number_dictionary_map, NumberDictionaryMap)                           \
   V(Map, one_closure_cell_map, OneClosureCellMap)                              \
-  V(Map, many_closures_cell_map, ManyClosuresCellMap)                          \
+  V(Map, ordered_hash_map_map, OrderedHashMapMap)                              \
+  V(Map, ordered_hash_set_map, OrderedHashSetMap)                              \
   V(Map, property_array_map, PropertyArrayMap)                                 \
-  V(Map, bigint_map, BigIntMap)                                                \
+  V(Map, simple_number_dictionary_map, SimpleNumberDictionaryMap)              \
+  V(Map, sloppy_arguments_elements_map, SloppyArgumentsElementsMap)            \
+  V(Map, small_ordered_hash_map_map, SmallOrderedHashMapMap)                   \
+  V(Map, small_ordered_hash_set_map, SmallOrderedHashSetMap)                   \
+  V(Map, string_table_map, StringTableMap)                                     \
+  V(Map, weak_fixed_array_map, WeakFixedArrayMap)                              \
   /* String maps */                                                            \
   V(Map, native_source_string_map, NativeSourceStringMap)                      \
   V(Map, string_map, StringMap)                                                \
@@ -168,6 +174,8 @@ using v8::MemoryPressureLevel;
   V(Map, fixed_float32_array_map, FixedFloat32ArrayMap)                        \
   V(Map, fixed_float64_array_map, FixedFloat64ArrayMap)                        \
   V(Map, fixed_uint8_clamped_array_map, FixedUint8ClampedArrayMap)             \
+  V(Map, fixed_biguint64_array_map, FixedBigUint64ArrayMap)                    \
+  V(Map, fixed_bigint64_array_map, FixedBigInt64ArrayMap)                      \
   /* Oddball maps */                                                           \
   V(Map, undefined_map, UndefinedMap)                                          \
   V(Map, the_hole_map, TheHoleMap)                                             \
@@ -183,6 +191,8 @@ using v8::MemoryPressureLevel;
   V(EnumCache, empty_enum_cache, EmptyEnumCache)                               \
   V(PropertyArray, empty_property_array, EmptyPropertyArray)                   \
   V(ByteArray, empty_byte_array, EmptyByteArray)                               \
+  V(BoilerplateDescription, empty_boilerplate_description,                     \
+    EmptyBoilerplateDescription)                                               \
   V(FixedTypedArrayBase, empty_fixed_uint8_array, EmptyFixedUint8Array)        \
   V(FixedTypedArrayBase, empty_fixed_int8_array, EmptyFixedInt8Array)          \
   V(FixedTypedArrayBase, empty_fixed_uint16_array, EmptyFixedUint16Array)      \
@@ -193,26 +203,34 @@ using v8::MemoryPressureLevel;
   V(FixedTypedArrayBase, empty_fixed_float64_array, EmptyFixedFloat64Array)    \
   V(FixedTypedArrayBase, empty_fixed_uint8_clamped_array,                      \
     EmptyFixedUint8ClampedArray)                                               \
+  V(FixedTypedArrayBase, empty_fixed_biguint64_array,                          \
+    EmptyFixedBigUint64Array)                                                  \
+  V(FixedTypedArrayBase, empty_fixed_bigint64_array, EmptyFixedBigInt64Array)  \
   V(Script, empty_script, EmptyScript)                                         \
-  V(Cell, undefined_cell, UndefinedCell)                                       \
+  V(FeedbackCell, many_closures_cell, ManyClosuresCell)                        \
   V(FixedArray, empty_sloppy_arguments_elements, EmptySloppyArgumentsElements) \
   V(NumberDictionary, empty_slow_element_dictionary,                           \
     EmptySlowElementDictionary)                                                \
   V(FixedArray, empty_ordered_hash_map, EmptyOrderedHashMap)                   \
   V(FixedArray, empty_ordered_hash_set, EmptyOrderedHashSet)                   \
+  V(FeedbackMetadata, empty_feedback_metadata, EmptyFeedbackMetadata)          \
   V(PropertyCell, empty_property_cell, EmptyPropertyCell)                      \
   V(WeakCell, empty_weak_cell, EmptyWeakCell)                                  \
+  V(Cell, invalid_prototype_validity_cell, InvalidPrototypeValidityCell)       \
   V(InterceptorInfo, noop_interceptor_info, NoOpInterceptorInfo)               \
+  V(WeakFixedArray, empty_weak_fixed_array, EmptyWeakFixedArray)               \
   /* Protectors */                                                             \
   V(Cell, array_constructor_protector, ArrayConstructorProtector)              \
   V(PropertyCell, no_elements_protector, NoElementsProtector)                  \
   V(Cell, is_concat_spreadable_protector, IsConcatSpreadableProtector)         \
   V(PropertyCell, species_protector, SpeciesProtector)                         \
   V(Cell, string_length_protector, StringLengthProtector)                      \
-  V(Cell, fast_array_iteration_protector, FastArrayIterationProtector)         \
   V(PropertyCell, array_iterator_protector, ArrayIteratorProtector)            \
   V(PropertyCell, array_buffer_neutering_protector,                            \
     ArrayBufferNeuteringProtector)                                             \
+  V(PropertyCell, promise_hook_protector, PromiseHookProtector)                \
+  V(Cell, promise_resolve_protector, PromiseResolveProtector)                  \
+  V(PropertyCell, promise_then_protector, PromiseThenProtector)                \
   /* Special numbers */                                                        \
   V(HeapNumber, nan_value, NanValue)                                           \
   V(HeapNumber, hole_nan_value, HoleNanValue)                                  \
@@ -230,18 +248,14 @@ using v8::MemoryPressureLevel;
   V(NameDictionary, api_symbol_table, ApiSymbolTable)                          \
   V(NameDictionary, api_private_symbol_table, ApiPrivateSymbolTable)           \
   V(Object, script_list, ScriptList)                                           \
-  V(NumberDictionary, code_stubs, CodeStubs)                                   \
+  V(SimpleNumberDictionary, code_stubs, CodeStubs)                             \
   V(FixedArray, materialized_objects, MaterializedObjects)                     \
   V(FixedArray, microtask_queue, MicrotaskQueue)                               \
   V(FixedArray, detached_contexts, DetachedContexts)                           \
   V(HeapObject, retaining_path_targets, RetainingPathTargets)                  \
   V(ArrayList, retained_maps, RetainedMaps)                                    \
-  V(WeakHashTable, weak_object_to_code_table, WeakObjectToCodeTable)           \
-  /* weak_new_space_object_to_code_list is an array of weak cells, where */    \
-  /* slots with even indices refer to the weak object, and the subsequent */   \
-  /* slots refer to the code with the reference to the weak object. */         \
-  V(ArrayList, weak_new_space_object_to_code_list,                             \
-    WeakNewSpaceObjectToCodeList)                                              \
+  /* Indirection lists for isolate-independent builtins */                     \
+  V(FixedArray, builtins_constants_table, BuiltinsConstantsTable)              \
   /* Feedback vectors that we need for code coverage or type profile */        \
   V(Object, feedback_vectors_for_profiling_tools,                              \
     FeedbackVectorsForProfilingTools)                                          \
@@ -265,6 +279,7 @@ using v8::MemoryPressureLevel;
   V(Smi, stack_limit, StackLimit)                                              \
   V(Smi, real_stack_limit, RealStackLimit)                                     \
   V(Smi, last_script_id, LastScriptId)                                         \
+  V(Smi, last_debugging_id, LastDebuggingId)                                   \
   V(Smi, hash_seed, HashSeed)                                                  \
   /* To distinguish the function templates, so that we can find them in the */ \
   /* function cache of the native context. */                                  \
@@ -289,15 +304,16 @@ using v8::MemoryPressureLevel;
   V(ArgumentsMarkerMap)                 \
   V(ArrayBufferNeuteringProtector)      \
   V(ArrayIteratorProtector)             \
-  V(NoElementsProtector)                \
   V(BigIntMap)                          \
   V(BlockContextMap)                    \
+  V(BoilerplateDescriptionMap)          \
   V(BooleanMap)                         \
   V(ByteArrayMap)                       \
   V(BytecodeArrayMap)                   \
   V(CatchContextMap)                    \
   V(CellMap)                            \
   V(CodeMap)                            \
+  V(DebugEvaluateContextMap)            \
   V(DescriptorArrayMap)                 \
   V(EmptyByteArray)                     \
   V(EmptyDescriptorArray)               \
@@ -318,12 +334,10 @@ using v8::MemoryPressureLevel;
   V(EmptyScript)                        \
   V(EmptySloppyArgumentsElements)       \
   V(EmptySlowElementDictionary)         \
-  V(empty_string)                       \
   V(EmptyWeakCell)                      \
   V(EvalContextMap)                     \
   V(Exception)                          \
   V(FalseValue)                         \
-  V(FastArrayIterationProtector)        \
   V(FixedArrayMap)                      \
   V(FixedCOWArrayMap)                   \
   V(FixedDoubleArrayMap)                \
@@ -337,9 +351,10 @@ using v8::MemoryPressureLevel;
   V(HoleNanValue)                       \
   V(InfinityValue)                      \
   V(IsConcatSpreadableProtector)        \
+  V(JSMessageObjectMap)                 \
   V(JsConstructEntryCode)               \
   V(JsEntryCode)                        \
-  V(JSMessageObjectMap)                 \
+  V(ManyClosuresCell)                   \
   V(ManyClosuresCellMap)                \
   V(MetaMap)                            \
   V(MinusInfinityValue)                 \
@@ -351,6 +366,7 @@ using v8::MemoryPressureLevel;
   V(NanValue)                           \
   V(NativeContextMap)                   \
   V(NoClosuresCellMap)                  \
+  V(NoElementsProtector)                \
   V(NullMap)                            \
   V(NullValue)                          \
   V(NumberDictionaryMap)                \
@@ -362,7 +378,9 @@ using v8::MemoryPressureLevel;
   V(PropertyArrayMap)                   \
   V(ScopeInfoMap)                       \
   V(ScriptContextMap)                   \
+  V(ScriptContextTableMap)              \
   V(SharedFunctionInfoMap)              \
+  V(SimpleNumberDictionaryMap)          \
   V(SloppyArgumentsElementsMap)         \
   V(SmallOrderedHashMapMap)             \
   V(SmallOrderedHashSetMap)             \
@@ -377,14 +395,14 @@ using v8::MemoryPressureLevel;
   V(TransitionArrayMap)                 \
   V(TrueValue)                          \
   V(TwoPointerFillerMap)                \
-  V(UndefinedCell)                      \
   V(UndefinedMap)                       \
   V(UndefinedValue)                     \
   V(UninitializedMap)                   \
   V(UninitializedValue)                 \
   V(WeakCellMap)                        \
-  V(WeakHashTableMap)                   \
+  V(WeakFixedArrayMap)                  \
   V(WithContextMap)                     \
+  V(empty_string)                       \
   PRIVATE_SYMBOL_LIST(V)
 
 #define FIXED_ARRAY_ELEMENTS_WRITE_BARRIER(heap, array, start, length) \
@@ -575,7 +593,13 @@ class Heap {
 
   enum FindMementoMode { kForRuntime, kForGC };
 
-  enum HeapState { NOT_IN_GC, SCAVENGE, MARK_COMPACT, MINOR_MARK_COMPACT };
+  enum HeapState {
+    NOT_IN_GC,
+    SCAVENGE,
+    MARK_COMPACT,
+    MINOR_MARK_COMPACT,
+    TEAR_DOWN
+  };
 
   using PretenuringFeedbackMap = std::unordered_map<AllocationSite*, size_t>;
 
@@ -657,8 +681,7 @@ class Heap {
   template <typename T>
   static inline bool IsOneByte(T t, int chars);
 
-  static void FatalProcessOutOfMemory(const char* location,
-                                      bool is_heap_oom = false);
+  void FatalProcessOutOfMemory(const char* location);
 
   V8_EXPORT_PRIVATE static bool RootIsImmortalImmovable(int root_index);
 
@@ -802,8 +825,26 @@ class Heap {
     code_space_memory_modification_scope_depth_--;
   }
 
+  void UnprotectAndRegisterMemoryChunk(MemoryChunk* chunk);
+  void UnprotectAndRegisterMemoryChunk(HeapObject* object);
+
+  void ProtectUnprotectedMemoryChunks();
+
+  void EnableUnprotectedMemoryChunksRegistry() {
+    unprotected_memory_chunks_registry_enabled_ = true;
+  }
+
+  void DisableUnprotectedMemoryChunksRegistry() {
+    unprotected_memory_chunks_registry_enabled_ = false;
+  }
+
+  bool unprotected_memory_chunks_registry_enabled() {
+    return unprotected_memory_chunks_registry_enabled_;
+  }
+
   inline HeapState gc_state() { return gc_state_; }
   void SetGCState(HeapState state);
+  bool IsTearingDown() const { return gc_state_ == TEAR_DOWN; }
 
   inline bool IsInGCPostProcessing() { return gc_post_processing_depth_ > 0; }
 
@@ -829,8 +870,9 @@ class Heap {
                                   bool is_isolate_locked);
   void CheckMemoryPressure();
 
-  void SetOutOfMemoryCallback(v8::debug::OutOfMemoryCallback callback,
-                              void* data);
+  void AddNearHeapLimitCallback(v8::NearHeapLimitCallback, void* data);
+  void RemoveNearHeapLimitCallback(v8::NearHeapLimitCallback callback,
+                                   size_t heap_limit);
 
   double MonotonicallyIncreasingTimeInMs();
 
@@ -850,6 +892,7 @@ class Heap {
   inline uint32_t HashSeed();
 
   inline int NextScriptId();
+  inline int NextDebuggingId();
   inline int GetNextTemplateSerialNumber();
 
   void SetSerializedObjects(FixedArray* objects);
@@ -872,15 +915,7 @@ class Heap {
     external_memory_concurrently_freed_.SetValue(0);
   }
 
-  void AddWeakNewSpaceObjectToCodeDependency(Handle<HeapObject> obj,
-                                             Handle<WeakCell> code);
-
-  void AddWeakObjectToCodeDependency(Handle<HeapObject> obj,
-                                     Handle<DependentCode> dep);
-
-  DependentCode* LookupWeakObjectToCodeDependency(Handle<HeapObject> obj);
-
-  void CompactWeakFixedArrays();
+  void CompactFixedArraysOfWeakCells();
 
   void AddRetainedMap(Handle<Map> map);
 
@@ -908,28 +943,11 @@ class Heap {
     return memory_pressure_level_.Value() != MemoryPressureLevel::kNone;
   }
 
-  size_t HeapLimitForDebugging() {
-    const size_t kDebugHeapSizeFactor = 4;
-    size_t max_limit = std::numeric_limits<size_t>::max() / 4;
-    return Min(max_limit,
-               initial_max_old_generation_size_ * kDebugHeapSizeFactor);
-  }
-
-  void IncreaseHeapLimitForDebugging() {
-    max_old_generation_size_ =
-        Max(max_old_generation_size_, HeapLimitForDebugging());
-  }
-
-  void RestoreOriginalHeapLimit() {
+  void RestoreHeapLimit(size_t heap_limit) {
     // Do not set the limit lower than the live size + some slack.
     size_t min_limit = SizeOfObjects() + SizeOfObjects() / 4;
     max_old_generation_size_ =
-        Min(max_old_generation_size_,
-            Max(initial_max_old_generation_size_, min_limit));
-  }
-
-  bool IsHeapLimitIncreasedForDebugging() {
-    return max_old_generation_size_ == HeapLimitForDebugging();
+        Min(max_old_generation_size_, Max(heap_limit, min_limit));
   }
 
   // ===========================================================================
@@ -960,14 +978,15 @@ class Heap {
   // Create ObjectStats if live_object_stats_ or dead_object_stats_ are nullptr.
   void CreateObjectStats();
 
+  // Sets the TearDown state, so no new GC tasks get posted.
+  void StartTearDown();
+
   // Destroys all memory allocated by the heap.
   void TearDown();
 
   // Returns whether SetUp has been called.
   bool HasBeenSetUp();
 
-  bool use_tasks() const { return use_tasks_; }
-
   // ===========================================================================
   // Getters for spaces. =======================================================
   // ===========================================================================
@@ -979,6 +998,7 @@ class Heap {
   OldSpace* code_space() { return code_space_; }
   MapSpace* map_space() { return map_space_; }
   LargeObjectSpace* lo_space() { return lo_space_; }
+  ReadOnlySpace* read_only_space() { return read_only_space_; }
 
   inline PagedSpace* paged_space(int idx);
   inline Space* space(int idx);
@@ -1061,8 +1081,17 @@ class Heap {
   // Generated code can embed this address to get access to the roots.
   Object** roots_array_start() { return roots_; }
 
+  ExternalReferenceTable* external_reference_table() {
+    DCHECK(external_reference_table_.is_initialized());
+    return &external_reference_table_;
+  }
+
+  static constexpr int roots_to_external_reference_table_offset() {
+    return kRootsExternalReferenceTableOffset;
+  }
+
   // Sets the stub_cache_ (only used when expanding the dictionary).
-  void SetRootCodeStubs(NumberDictionary* value);
+  void SetRootCodeStubs(SimpleNumberDictionary* value);
 
   void SetRootMaterializedObjects(FixedArray* objects) {
     roots_[kMaterializedObjectsRootIndex] = objects;
@@ -1110,6 +1139,8 @@ class Heap {
   void SetDeserializeLazyHandlerWide(Code* code);
   void SetDeserializeLazyHandlerExtraWide(Code* code);
 
+  void SetBuiltinsConstantsTable(FixedArray* cache);
+
   // ===========================================================================
   // Inline allocation. ========================================================
   // ===========================================================================
@@ -1161,21 +1192,23 @@ class Heap {
   // Iterators. ================================================================
   // ===========================================================================
 
-  // Iterates over all roots in the heap.
   void IterateRoots(RootVisitor* v, VisitMode mode);
-  // Iterates over all strong roots in the heap.
   void IterateStrongRoots(RootVisitor* v, VisitMode mode);
   // Iterates over entries in the smi roots list.  Only interesting to the
   // serializer/deserializer, since GC does not care about smis.
   void IterateSmiRoots(RootVisitor* v);
-  // Iterates over all the other roots in the heap.
+  // Iterates over weak string tables.
   void IterateWeakRoots(RootVisitor* v, VisitMode mode);
+  // Iterates over weak global handles.
+  void IterateWeakGlobalHandles(RootVisitor* v);
 
   // ===========================================================================
   // Store buffer API. =========================================================
   // ===========================================================================
 
   // Write barrier support for object[offset] = o;
+  inline void RecordWrite(Object* object, MaybeObject** slot,
+                          MaybeObject* value);
   inline void RecordWrite(Object* object, Object** slot, Object* value);
   inline void RecordWriteIntoCode(Code* host, RelocInfo* rinfo, Object* target);
   void RecordWriteIntoCodeSlow(Code* host, RelocInfo* rinfo, Object* target);
@@ -1296,6 +1329,9 @@ class Heap {
   inline bool InNewSpace(Object* object);
   inline bool InFromSpace(Object* object);
   inline bool InToSpace(Object* object);
+  inline bool InNewSpace(MaybeObject* object);
+  inline bool InFromSpace(MaybeObject* object);
+  inline bool InToSpace(MaybeObject* object);
 
   // Returns whether the object resides in old space.
   inline bool InOldSpace(Object* object);
@@ -1352,9 +1388,7 @@ class Heap {
   // ===========================================================================
 
   // Returns the maximum amount of memory reserved for the heap.
-  size_t MaxReserved() {
-    return 2 * max_semi_space_size_ + max_old_generation_size_;
-  }
+  size_t MaxReserved();
   size_t MaxSemiSpaceSize() { return max_semi_space_size_; }
   size_t InitialSemiSpaceSize() { return initial_semispace_size_; }
   size_t MaxOldGenerationSize() { return max_old_generation_size_; }
@@ -1571,6 +1605,11 @@ class Heap {
   void RemoveAllocationObserversFromAllSpaces(
       AllocationObserver* observer, AllocationObserver* new_space_observer);
 
+  bool allocation_step_in_progress() { return allocation_step_in_progress_; }
+  void set_allocation_step_in_progress(bool val) {
+    allocation_step_in_progress_ = val;
+  }
+
   // ===========================================================================
   // Retaining path tracking. ==================================================
   // ===========================================================================
@@ -1715,7 +1754,7 @@ class Heap {
     void* data;
   };
 
-  static const int kInitialStringTableSize = 2048;
+  static const int kInitialStringTableSize = StringTable::kMinCapacity;
   static const int kInitialEvalCacheSize = 64;
   static const int kInitialNumberStringCacheSize = 256;
 
@@ -1831,6 +1870,9 @@ class Heap {
   // Fill in bogus values in from space
   void ZapFromSpace();
 
+  // Zaps the memory of a code object.
+  void ZapCodeObject(Address start_address, int size_in_bytes);
+
   // Deopts all code that contains allocation instruction which are tenured or
   // not tenured. Moreover it clears the pretenuring allocation site statistics.
   void ResetAllAllocationSitesDependentCode(PretenureFlag flag);
@@ -1884,7 +1926,7 @@ class Heap {
 
   void CollectGarbageOnMemoryPressure();
 
-  void InvokeOutOfMemoryCallback();
+  bool InvokeNearHeapLimitCallback();
 
   void ComputeFastPromotionMode(double survival_rate);
 
@@ -1979,6 +2021,11 @@ class Heap {
 
   bool MaximumSizeScavenge() { return maximum_size_scavenges_ > 0; }
 
+  bool IsIneffectiveMarkCompact(size_t old_generation_size,
+                                double mutator_utilization);
+  void CheckIneffectiveMarkCompact(size_t old_generation_size,
+                                   double mutator_utilization);
+
   // ===========================================================================
   // Growing strategy. =========================================================
   // ===========================================================================
@@ -2015,10 +2062,6 @@ class Heap {
 
   bool CanExpandOldGeneration(size_t size);
 
-  bool IsCloseToOutOfMemory(size_t slack) {
-    return OldGenerationCapacity() + slack >= MaxOldGenerationSize();
-  }
-
   bool ShouldExpandOldGenerationOnSlowAllocation();
 
   enum class IncrementalMarkingLimit { kNoLimit, kSoftLimit, kHardLimit };
@@ -2076,7 +2119,8 @@ class Heap {
   MUST_USE_RESULT AllocationResult AllocateHeapNumber(
       MutableMode mode = IMMUTABLE, PretenureFlag pretenure = NOT_TENURED);
 
-  MUST_USE_RESULT AllocationResult AllocateBigInt(int length);
+  MUST_USE_RESULT AllocationResult
+  AllocateBigInt(int length, PretenureFlag pretenure = NOT_TENURED);
 
   // Allocates a byte array of the specified length
   MUST_USE_RESULT AllocationResult
@@ -2103,6 +2147,19 @@ class Heap {
   MUST_USE_RESULT inline AllocationResult AllocateFixedArray(
       int length, PretenureFlag pretenure = NOT_TENURED);
 
+  // Allocates an array allowing in-place weak references, initialized with
+  // undefined values
+  MUST_USE_RESULT inline AllocationResult AllocateWeakFixedArray(
+      int length, PretenureFlag pretenure = NOT_TENURED);
+
+  // Allocate memory for an uninitialized FixedArray.
+  MUST_USE_RESULT inline AllocationResult AllocateRawFixedArray(
+      int length, PretenureFlag pretenure);
+
+  // Allocate memory for an uninitialized WeakFixedArray.
+  MUST_USE_RESULT inline AllocationResult AllocateRawWeakFixedArray(
+      int length, PretenureFlag pretenure);
+
   // Allocates a property array initialized with undefined values
   MUST_USE_RESULT AllocationResult
   AllocatePropertyArray(int length, PretenureFlag pretenure = NOT_TENURED);
@@ -2143,9 +2200,9 @@ class Heap {
   MUST_USE_RESULT AllocationResult
       AllocateFillerObject(int size, bool double_align, AllocationSpace space);
 
-  // Allocate an uninitialized fixed array.
-  MUST_USE_RESULT AllocationResult
-      AllocateRawFixedArray(int length, PretenureFlag pretenure);
+  // Allocate memory for an uninitialized array (e.g., a FixedArray or similar).
+  MUST_USE_RESULT AllocationResult AllocateRawArray(int size,
+                                                    PretenureFlag pretenure);
 
   // Allocate an uninitialized fixed double array.
   MUST_USE_RESULT AllocationResult
@@ -2252,11 +2309,16 @@ class Heap {
   MUST_USE_RESULT AllocationResult AllocateUninitializedFixedDoubleArray(
       int length, PretenureFlag pretenure = NOT_TENURED);
 
-  // Allocate empty fixed array.
+  // Allocates a FeedbackMedata object and zeroes the data section.
+  MUST_USE_RESULT AllocationResult AllocateFeedbackMetadata(int slot_count);
+
+  // Allocate empty fixed array like objects.
   MUST_USE_RESULT AllocationResult AllocateEmptyFixedArray();
 
-  // Allocate empty scope info.
+  MUST_USE_RESULT AllocationResult AllocateEmptyWeakFixedArray();
+
   MUST_USE_RESULT AllocationResult AllocateEmptyScopeInfo();
+  MUST_USE_RESULT AllocationResult AllocateEmptyBoilerplateDescription();
 
   // Allocate empty fixed typed array of given type.
   MUST_USE_RESULT AllocationResult
@@ -2265,6 +2327,10 @@ class Heap {
   // Allocate a tenured simple cell.
   MUST_USE_RESULT AllocationResult AllocateCell(Object* value);
 
+  // Allocate a tenured simple feedback cell.
+  MUST_USE_RESULT AllocationResult AllocateFeedbackCell(Map* map,
+                                                        HeapObject* value);
+
   // Allocate a tenured JS global property cell initialized with the hole.
   MUST_USE_RESULT AllocationResult AllocatePropertyCell(Name* name);
 
@@ -2287,13 +2353,16 @@ class Heap {
 
   // Allocates a new code object (fully initialized). All header fields of the
   // returned object are immutable and the code object is write protected.
-  MUST_USE_RESULT AllocationResult
-  AllocateCode(const CodeDesc& desc, Code::Kind kind, Handle<Object> self_ref,
-               int32_t builtin_index, ByteArray* reloc_info,
-               CodeDataContainer* data_container, HandlerTable* handler_table,
-               ByteArray* source_position_table, DeoptimizationData* deopt_data,
-               Movability movability, uint32_t stub_key, bool is_turbofanned,
-               int stack_slots, int safepoint_table_offset);
+  MUST_USE_RESULT AllocationResult AllocateCode(
+      const CodeDesc& desc, Code::Kind kind, Handle<Object> self_ref,
+      int32_t builtin_index, ByteArray* reloc_info,
+      CodeDataContainer* data_container, ByteArray* source_position_table,
+      DeoptimizationData* deopt_data, Movability movability, uint32_t stub_key,
+      bool is_turbofanned, int stack_slots, int safepoint_table_offset,
+      int handler_table_offset);
+
+  MUST_USE_RESULT AllocationResult AllocateJSPromise(
+      JSFunction* constructor, PretenureFlag pretenure = NOT_TENURED);
 
   void set_force_oom(bool value) { force_oom_ = value; }
 
@@ -2327,6 +2396,13 @@ class Heap {
 
   Object* roots_[kRootListLength];
 
+  // This table is accessed from builtin code compiled into the snapshot, and
+  // thus its offset from roots_ must remain static. This is verified in
+  // Isolate::Init() using runtime checks.
+  static constexpr int kRootsExternalReferenceTableOffset =
+      kRootListLength * kPointerSize;
+  ExternalReferenceTable external_reference_table_;
+
   size_t code_range_size_;
   size_t max_semi_space_size_;
   size_t initial_semispace_size_;
@@ -2351,8 +2427,8 @@ class Heap {
   // and reset by a mark-compact garbage collection.
   base::AtomicValue<MemoryPressureLevel> memory_pressure_level_;
 
-  v8::debug::OutOfMemoryCallback out_of_memory_callback_;
-  void* out_of_memory_callback_data_;
+  std::vector<std::pair<v8::NearHeapLimitCallback, void*> >
+      near_heap_limit_callbacks_;
 
   // For keeping track of context disposals.
   int contexts_disposed_;
@@ -2367,6 +2443,7 @@ class Heap {
   OldSpace* code_space_;
   MapSpace* map_space_;
   LargeObjectSpace* lo_space_;
+  ReadOnlySpace* read_only_space_;
   // Map from the space id to the space.
   Space* space_[LAST_SPACE + 1];
 
@@ -2400,6 +2477,8 @@ class Heap {
   // Observer that can cause early scavenge start.
   StressScavengeObserver* stress_scavenge_observer_;
 
+  bool allocation_step_in_progress_;
+
   // The maximum percent of the marking limit reached wihout causing marking.
   // This is tracked when specyfing --fuzzer-gc-analysis.
   double max_marking_limit_reached_;
@@ -2410,6 +2489,10 @@ class Heap {
   // How many gc happened.
   unsigned int gc_count_;
 
+  // The number of Mark-Compact garbage collections that are considered as
+  // ineffective. See IsIneffectiveMarkCompact() predicate.
+  int consecutive_ineffective_mark_compacts_;
+
   static const uintptr_t kMmapRegionMask = 0xFFFFFFFFu;
   uintptr_t mmap_region_base_;
 
@@ -2554,14 +2637,15 @@ class Heap {
 
   bool fast_promotion_mode_;
 
-  bool use_tasks_;
-
   // Used for testing purposes.
   bool force_oom_;
   bool delay_sweeper_tasks_for_testing_;
 
   HeapObject* pending_layout_change_object_;
 
+  std::unordered_set<MemoryChunk*> unprotected_memory_chunks_;
+  bool unprotected_memory_chunks_registry_enabled_;
+
 #ifdef V8_ENABLE_ALLOCATION_TIMEOUT
   // If the --gc-interval flag is set to a positive value, this
   // variable holds the value indicating the number of allocations
@@ -2658,6 +2742,7 @@ class AlwaysAllocateScope {
   Heap* heap_;
 };
 
+// The CodeSpaceMemoryModificationScope can only be used by the main thread.
 class CodeSpaceMemoryModificationScope {
  public:
   explicit inline CodeSpaceMemoryModificationScope(Heap* heap);
@@ -2667,6 +2752,21 @@ class CodeSpaceMemoryModificationScope {
   Heap* heap_;
 };
 
+// The CodePageCollectionMemoryModificationScope can only be used by the main
+// thread. It will not be enabled if a CodeSpaceMemoryModificationScope is
+// already active.
+class CodePageCollectionMemoryModificationScope {
+ public:
+  explicit inline CodePageCollectionMemoryModificationScope(Heap* heap);
+  inline ~CodePageCollectionMemoryModificationScope();
+
+ private:
+  Heap* heap_;
+};
+
+// The CodePageMemoryModificationScope does not check if tansitions to
+// writeable and back to executable are actually allowed, i.e. the MemoryChunk
+// was registered to be executable. It can be used by concurrent threads.
 class CodePageMemoryModificationScope {
  public:
   explicit inline CodePageMemoryModificationScope(MemoryChunk* chunk);
@@ -2689,25 +2789,36 @@ class CodePageMemoryModificationScope {
 class VerifyPointersVisitor : public ObjectVisitor, public RootVisitor {
  public:
   void VisitPointers(HeapObject* host, Object** start, Object** end) override;
-  void VisitRootPointers(Root root, Object** start, Object** end) override;
+  void VisitPointers(HeapObject* host, MaybeObject** start,
+                     MaybeObject** end) override;
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override;
 
- private:
-  void VerifyPointers(Object** start, Object** end);
+ protected:
+  virtual void VerifyPointers(HeapObject* host, MaybeObject** start,
+                              MaybeObject** end);
 };
 
 
 // Verify that all objects are Smis.
 class VerifySmisVisitor : public RootVisitor {
  public:
-  void VisitRootPointers(Root root, Object** start, Object** end) override;
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override;
 };
 
 // Space iterator for iterating over all the paged spaces of the heap: Map
-// space, old space, code space and cell space.  Returns
-// each space in turn, and null when it is done.
+// space, old space, code space and optionally read only space. Returns each
+// space in turn, and null when it is done.
 class V8_EXPORT_PRIVATE PagedSpaces BASE_EMBEDDED {
  public:
-  explicit PagedSpaces(Heap* heap) : heap_(heap), counter_(OLD_SPACE) {}
+  enum class SpacesSpecifier { kSweepablePagedSpaces, kAllPagedSpaces };
+
+  explicit PagedSpaces(Heap* heap, SpacesSpecifier specifier =
+                                       SpacesSpecifier::kSweepablePagedSpaces)
+      : heap_(heap),
+        counter_(specifier == SpacesSpecifier::kAllPagedSpaces ? RO_SPACE
+                                                               : OLD_SPACE) {}
   PagedSpace* next();
 
  private:
diff --git a/deps/v8/src/heap/incremental-marking-inl.h b/deps/v8/src/heap/incremental-marking-inl.h
index 84f31ef350b..b64c203a8d7 100644
--- a/deps/v8/src/heap/incremental-marking-inl.h
+++ b/deps/v8/src/heap/incremental-marking-inl.h
@@ -7,6 +7,7 @@
 
 #include "src/heap/incremental-marking.h"
 #include "src/isolate.h"
+#include "src/objects/maybe-object.h"
 
 namespace v8 {
 namespace internal {
@@ -14,8 +15,21 @@ namespace internal {
 
 void IncrementalMarking::RecordWrite(HeapObject* obj, Object** slot,
                                      Object* value) {
-  if (IsMarking() && value->IsHeapObject()) {
-    RecordWriteSlow(obj, slot, value);
+  DCHECK_IMPLIES(slot != nullptr, !HasWeakHeapObjectTag(*slot));
+  DCHECK(!HasWeakHeapObjectTag(value));
+  RecordMaybeWeakWrite(obj, reinterpret_cast<MaybeObject**>(slot),
+                       reinterpret_cast<MaybeObject*>(value));
+}
+
+void IncrementalMarking::RecordMaybeWeakWrite(HeapObject* obj,
+                                              MaybeObject** slot,
+                                              MaybeObject* value) {
+  // When writing a weak reference, treat it as strong for the purposes of the
+  // marking barrier.
+  HeapObject* heap_object;
+  if (IsMarking() && value->ToStrongOrWeakHeapObject(&heap_object)) {
+    RecordWriteSlow(obj, reinterpret_cast<HeapObjectReference**>(slot),
+                    heap_object);
   }
 }
 
diff --git a/deps/v8/src/heap/incremental-marking-job.cc b/deps/v8/src/heap/incremental-marking-job.cc
index fa6082ae7c2..6413ed68130 100644
--- a/deps/v8/src/heap/incremental-marking-job.cc
+++ b/deps/v8/src/heap/incremental-marking-job.cc
@@ -21,7 +21,7 @@ void IncrementalMarkingJob::Start(Heap* heap) {
 }
 
 void IncrementalMarkingJob::ScheduleTask(Heap* heap) {
-  if (!task_pending_ && heap->use_tasks()) {
+  if (!task_pending_ && !heap->IsTearingDown()) {
     v8::Isolate* isolate = reinterpret_cast<v8::Isolate*>(heap->isolate());
     task_pending_ = true;
     auto task = new Task(heap->isolate(), this);
diff --git a/deps/v8/src/heap/incremental-marking.cc b/deps/v8/src/heap/incremental-marking.cc
index 4868adc26ea..5a55938ad41 100644
--- a/deps/v8/src/heap/incremental-marking.cc
+++ b/deps/v8/src/heap/incremental-marking.cc
@@ -53,9 +53,11 @@ void IncrementalMarking::Observer::Step(int bytes_allocated, Address addr,
 }
 
 IncrementalMarking::IncrementalMarking(
-    Heap* heap, MarkCompactCollector::MarkingWorklist* marking_worklist)
+    Heap* heap, MarkCompactCollector::MarkingWorklist* marking_worklist,
+    WeakObjects* weak_objects)
     : heap_(heap),
       marking_worklist_(marking_worklist),
+      weak_objects_(weak_objects),
       initial_old_generation_size_(0),
       bytes_marked_ahead_of_schedule_(0),
       bytes_marked_concurrently_(0),
@@ -91,8 +93,8 @@ bool IncrementalMarking::BaseRecordWrite(HeapObject* obj, Object* value) {
   return is_compacting_ && need_recording;
 }
 
-
-void IncrementalMarking::RecordWriteSlow(HeapObject* obj, Object** slot,
+void IncrementalMarking::RecordWriteSlow(HeapObject* obj,
+                                         HeapObjectReference** slot,
                                          Object* value) {
   if (BaseRecordWrite(obj, value) && slot != nullptr) {
     // Object is not going to be rescanned we need to record the slot.
@@ -203,11 +205,13 @@ class IncrementalMarkingRootMarkingVisitor : public RootVisitor {
       IncrementalMarking* incremental_marking)
       : heap_(incremental_marking->heap()) {}
 
-  void VisitRootPointer(Root root, Object** p) override {
+  void VisitRootPointer(Root root, const char* description,
+                        Object** p) override {
     MarkObjectByPointer(p);
   }
 
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {
     for (Object** p = start; p < end; p++) MarkObjectByPointer(p);
   }
 
@@ -420,7 +424,7 @@ void IncrementalMarking::StartMarking() {
   IncrementalMarkingRootMarkingVisitor visitor(this);
   heap_->IterateStrongRoots(&visitor, VISIT_ONLY_STRONG);
 
-  if (FLAG_concurrent_marking && heap_->use_tasks()) {
+  if (FLAG_concurrent_marking && !heap_->IsTearingDown()) {
     heap_->concurrent_marking()->ScheduleTasks();
   }
 
@@ -556,8 +560,6 @@ void IncrementalMarking::FinalizeIncrementally() {
   // objects to reduce the marking load in the final pause.
   // 1) We scan and mark the roots again to find all changes to the root set.
   // 2) Age and retain maps embedded in optimized code.
-  // 3) Remove weak cell with live values from the list of weak cells, they
-  // do not need processing during GC.
   MarkRoots();
 
   // Map retaining is needed for perfromance, not correctness,
@@ -636,6 +638,43 @@ void IncrementalMarking::UpdateMarkingWorklistAfterScavenge() {
       return false;
     }
   });
+
+  UpdateWeakReferencesAfterScavenge();
+}
+
+void IncrementalMarking::UpdateWeakReferencesAfterScavenge() {
+  weak_objects_->weak_references.Update(
+      [](std::pair<HeapObject*, HeapObjectReference**> slot_in,
+         std::pair<HeapObject*, HeapObjectReference**>* slot_out) -> bool {
+        HeapObject* heap_obj = slot_in.first;
+        MapWord map_word = heap_obj->map_word();
+        if (map_word.IsForwardingAddress()) {
+          ptrdiff_t distance_to_slot =
+              reinterpret_cast<Address>(slot_in.second) -
+              reinterpret_cast<Address>(slot_in.first);
+          Address new_slot =
+              reinterpret_cast<Address>(map_word.ToForwardingAddress()) +
+              distance_to_slot;
+          slot_out->first = map_word.ToForwardingAddress();
+          slot_out->second = reinterpret_cast<HeapObjectReference**>(new_slot);
+        } else {
+          *slot_out = slot_in;
+        }
+        return true;
+      });
+  weak_objects_->weak_objects_in_code.Update(
+      [](std::pair<HeapObject*, Code*> slot_in,
+         std::pair<HeapObject*, Code*>* slot_out) -> bool {
+        HeapObject* heap_obj = slot_in.first;
+        MapWord map_word = heap_obj->map_word();
+        if (map_word.IsForwardingAddress()) {
+          slot_out->first = map_word.ToForwardingAddress();
+          slot_out->second = slot_in.second;
+        } else {
+          *slot_out = slot_in;
+        }
+        return true;
+      });
 }
 
 void IncrementalMarking::UpdateMarkedBytesAfterScavenge(
@@ -653,15 +692,17 @@ bool IncrementalMarking::IsFixedArrayWithProgressBar(HeapObject* obj) {
 
 int IncrementalMarking::VisitObject(Map* map, HeapObject* obj) {
   DCHECK(marking_state()->IsGrey(obj) || marking_state()->IsBlack(obj));
-  // The object can already be black in two cases:
-  // 1. The object is a fixed array with the progress bar.
-  // 2. The object is a JSObject that was colored black before
-  //    unsafe layout change.
-  // 3. The object is a string that was colored black before
-  //    unsafe layout change.
   if (!marking_state()->GreyToBlack(obj)) {
-    DCHECK(IsFixedArrayWithProgressBar(obj) || obj->IsJSObject() ||
-           obj->IsString());
+    // The object can already be black in these cases:
+    // 1. The object is a fixed array with the progress bar.
+    // 2. The object is a JSObject that was colored black before
+    //    unsafe layout change.
+    // 3. The object is a string that was colored black before
+    //    unsafe layout change.
+    // 4. The object is materizalized by the deoptimizer.
+    DCHECK(obj->IsHashTable() || obj->IsPropertyArray() ||
+           obj->IsContextExtension() || obj->IsFixedArray() ||
+           obj->IsJSObject() || obj->IsString());
   }
   DCHECK(marking_state()->IsBlack(obj));
   WhiteToGreyAndPush(map);
@@ -904,7 +945,7 @@ size_t IncrementalMarking::StepSizeToMakeProgress() {
   const size_t kTargetStepCountAtOOM = 32;
   size_t oom_slack = heap()->new_space()->Capacity() + 64 * MB;
 
-  if (heap()->IsCloseToOutOfMemory(oom_slack)) {
+  if (!heap()->CanExpandOldGeneration(oom_slack)) {
     return heap()->PromotedSpaceSizeOfObjects() / kTargetStepCountAtOOM;
   }
 
diff --git a/deps/v8/src/heap/incremental-marking.h b/deps/v8/src/heap/incremental-marking.h
index 87a1751fd9f..b9f6a664440 100644
--- a/deps/v8/src/heap/incremental-marking.h
+++ b/deps/v8/src/heap/incremental-marking.h
@@ -87,7 +87,8 @@ class V8_EXPORT_PRIVATE IncrementalMarking {
 #endif
 
   IncrementalMarking(Heap* heap,
-                     MarkCompactCollector::MarkingWorklist* marking_worklist);
+                     MarkCompactCollector::MarkingWorklist* marking_worklist,
+                     WeakObjects* weak_objects);
 
   MarkingState* marking_state() { return &marking_state_; }
 
@@ -165,6 +166,7 @@ class V8_EXPORT_PRIVATE IncrementalMarking {
   void FinalizeIncrementally();
 
   void UpdateMarkingWorklistAfterScavenge();
+  void UpdateWeakReferencesAfterScavenge();
   void UpdateMarkedBytesAfterScavenge(size_t dead_bytes_in_new_space);
 
   void Hurry();
@@ -205,11 +207,14 @@ class V8_EXPORT_PRIVATE IncrementalMarking {
   // the incremental cycle (stays white).
   V8_INLINE bool BaseRecordWrite(HeapObject* obj, Object* value);
   V8_INLINE void RecordWrite(HeapObject* obj, Object** slot, Object* value);
+  V8_INLINE void RecordMaybeWeakWrite(HeapObject* obj, MaybeObject** slot,
+                                      MaybeObject* value);
   V8_INLINE void RecordWriteIntoCode(Code* host, RelocInfo* rinfo,
                                      Object* value);
   V8_INLINE void RecordWrites(HeapObject* obj);
 
-  void RecordWriteSlow(HeapObject* obj, Object** slot, Object* value);
+  void RecordWriteSlow(HeapObject* obj, HeapObjectReference** slot,
+                       Object* value);
   void RecordWriteIntoCodeSlow(Code* host, RelocInfo* rinfo, Object* value);
 
   // Returns true if the function succeeds in transitioning the object
@@ -324,6 +329,7 @@ class V8_EXPORT_PRIVATE IncrementalMarking {
 
   Heap* const heap_;
   MarkCompactCollector::MarkingWorklist* const marking_worklist_;
+  WeakObjects* weak_objects_;
 
   double start_time_ms_;
   size_t initial_old_generation_size_;
diff --git a/deps/v8/src/heap/invalidated-slots-inl.h b/deps/v8/src/heap/invalidated-slots-inl.h
index b62aa93cde8..577c4a55764 100644
--- a/deps/v8/src/heap/invalidated-slots-inl.h
+++ b/deps/v8/src/heap/invalidated-slots-inl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INVALIDATED_SLOTS_INL_H
-#define V8_INVALIDATED_SLOTS_INL_H
+#ifndef V8_HEAP_INVALIDATED_SLOTS_INL_H_
+#define V8_HEAP_INVALIDATED_SLOTS_INL_H_
 
 #include <map>
 
@@ -61,10 +61,10 @@ bool InvalidatedSlotsFilter::IsValid(Address slot) {
     // we can return true here.
     return true;
   }
-  return invalidated_object_->IsValidSlot(offset);
+  return invalidated_object_->IsValidSlot(invalidated_object_->map(), offset);
 }
 
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_INVALIDATED_SLOTS_INL_H
+#endif  // V8_HEAP_INVALIDATED_SLOTS_INL_H_
diff --git a/deps/v8/src/heap/invalidated-slots.h b/deps/v8/src/heap/invalidated-slots.h
index 78ac03bc795..e9410575a33 100644
--- a/deps/v8/src/heap/invalidated-slots.h
+++ b/deps/v8/src/heap/invalidated-slots.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INVALIDATED_SLOTS_H
-#define V8_INVALIDATED_SLOTS_H
+#ifndef V8_HEAP_INVALIDATED_SLOTS_H_
+#define V8_HEAP_INVALIDATED_SLOTS_H_
 
 #include <map>
 #include <stack>
@@ -51,4 +51,4 @@ class InvalidatedSlotsFilter {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_INVALIDATED_SLOTS_H
+#endif  // V8_HEAP_INVALIDATED_SLOTS_H_
diff --git a/deps/v8/src/heap/item-parallel-job.cc b/deps/v8/src/heap/item-parallel-job.cc
new file mode 100644
index 00000000000..e909ef69d78
--- /dev/null
+++ b/deps/v8/src/heap/item-parallel-job.cc
@@ -0,0 +1,130 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/item-parallel-job.h"
+
+#include "src/base/platform/semaphore.h"
+#include "src/v8.h"
+
+namespace v8 {
+namespace internal {
+
+ItemParallelJob::Task::Task(Isolate* isolate) : CancelableTask(isolate) {}
+
+ItemParallelJob::Task::~Task() {
+  // The histogram is reset in RunInternal(). If it's still around it means
+  // this task was cancelled before being scheduled.
+  if (gc_parallel_task_latency_histogram_)
+    gc_parallel_task_latency_histogram_->RecordAbandon();
+}
+
+void ItemParallelJob::Task::SetupInternal(
+    base::Semaphore* on_finish, std::vector<Item*>* items, size_t start_index,
+    base::Optional<AsyncTimedHistogram> gc_parallel_task_latency_histogram) {
+  on_finish_ = on_finish;
+  items_ = items;
+
+  if (start_index < items->size()) {
+    cur_index_ = start_index;
+  } else {
+    items_considered_ = items_->size();
+  }
+
+  gc_parallel_task_latency_histogram_ =
+      std::move(gc_parallel_task_latency_histogram);
+}
+
+void ItemParallelJob::Task::RunInternal() {
+  if (gc_parallel_task_latency_histogram_) {
+    gc_parallel_task_latency_histogram_->RecordDone();
+    gc_parallel_task_latency_histogram_.reset();
+  }
+
+  RunInParallel();
+  on_finish_->Signal();
+}
+
+ItemParallelJob::ItemParallelJob(CancelableTaskManager* cancelable_task_manager,
+                                 base::Semaphore* pending_tasks)
+    : cancelable_task_manager_(cancelable_task_manager),
+      pending_tasks_(pending_tasks) {}
+
+ItemParallelJob::~ItemParallelJob() {
+  for (size_t i = 0; i < items_.size(); i++) {
+    Item* item = items_[i];
+    CHECK(item->IsFinished());
+    delete item;
+  }
+}
+
+void ItemParallelJob::Run(std::shared_ptr<Counters> async_counters) {
+  DCHECK_GT(tasks_.size(), 0);
+  const size_t num_items = items_.size();
+  const size_t num_tasks = tasks_.size();
+
+  TRACE_EVENT_INSTANT2(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+                       "ItemParallelJob::Run", TRACE_EVENT_SCOPE_THREAD,
+                       "num_tasks", static_cast<int>(num_tasks), "num_items",
+                       static_cast<int>(num_items));
+
+  AsyncTimedHistogram gc_parallel_task_latency_histogram(
+      async_counters->gc_parallel_task_latency(), async_counters);
+
+  // Some jobs have more tasks than items (when the items are mere coarse
+  // grain tasks that generate work dynamically for a second phase which all
+  // tasks participate in). Some jobs even have 0 items to preprocess but
+  // still have multiple tasks.
+  // TODO(gab): Figure out a cleaner scheme for this.
+  const size_t num_tasks_processing_items = Min(num_items, tasks_.size());
+
+  // In the event of an uneven workload, distribute an extra item to the first
+  // |items_remainder| tasks.
+  const size_t items_remainder = num_tasks_processing_items > 0
+                                     ? num_items % num_tasks_processing_items
+                                     : 0;
+  // Base |items_per_task|, will be bumped by 1 for the first
+  // |items_remainder| tasks.
+  const size_t items_per_task = num_tasks_processing_items > 0
+                                    ? num_items / num_tasks_processing_items
+                                    : 0;
+  CancelableTaskManager::Id* task_ids =
+      new CancelableTaskManager::Id[num_tasks];
+  std::unique_ptr<Task> main_task;
+  for (size_t i = 0, start_index = 0; i < num_tasks;
+       i++, start_index += items_per_task + (i < items_remainder ? 1 : 0)) {
+    auto task = std::move(tasks_[i]);
+    DCHECK(task);
+
+    // By definition there are less |items_remainder| to distribute then
+    // there are tasks processing items so this cannot overflow while we are
+    // assigning work items.
+    DCHECK_IMPLIES(start_index >= num_items, i >= num_tasks_processing_items);
+
+    task->SetupInternal(pending_tasks_, &items_, start_index,
+                        i > 0 ? gc_parallel_task_latency_histogram
+                              : base::Optional<AsyncTimedHistogram>());
+    task_ids[i] = task->id();
+    if (i > 0) {
+      V8::GetCurrentPlatform()->CallBlockingTaskOnWorkerThread(std::move(task));
+    } else {
+      main_task = std::move(task);
+    }
+  }
+
+  // Contribute on main thread.
+  DCHECK(main_task);
+  main_task->Run();
+
+  // Wait for background tasks.
+  for (size_t i = 0; i < num_tasks; i++) {
+    if (cancelable_task_manager_->TryAbort(task_ids[i]) !=
+        CancelableTaskManager::kTaskAborted) {
+      pending_tasks_->Wait();
+    }
+  }
+  delete[] task_ids;
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/item-parallel-job.h b/deps/v8/src/heap/item-parallel-job.h
index 23c709f87b6..51e0afd4018 100644
--- a/deps/v8/src/heap/item-parallel-job.h
+++ b/deps/v8/src/heap/item-parallel-job.h
@@ -2,18 +2,29 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_HEAP_ITEM_PARALLEL_JOB_
-#define V8_HEAP_ITEM_PARALLEL_JOB_
+#ifndef V8_HEAP_ITEM_PARALLEL_JOB_H_
+#define V8_HEAP_ITEM_PARALLEL_JOB_H_
 
+#include <memory>
 #include <vector>
 
-#include "src/base/platform/semaphore.h"
+#include "src/base/atomic-utils.h"
+#include "src/base/logging.h"
+#include "src/base/macros.h"
+#include "src/base/optional.h"
 #include "src/cancelable-task.h"
-#include "src/v8.h"
+#include "src/counters.h"
+#include "src/globals.h"
 
 namespace v8 {
+
+namespace base {
+class Semaphore;
+}
+
 namespace internal {
 
+class Counters;
 class Isolate;
 
 // This class manages background tasks that process a set of items in parallel.
@@ -25,14 +36,17 @@ class Isolate;
 //
 // Items need to be marked as finished after processing them. Task and Item
 // ownership is transferred to the job.
-class ItemParallelJob {
+//
+// Each parallel (non-main thread) task will report the time between the job
+// being created and it being scheduled to |gc_parallel_task_latency_histogram|.
+class V8_EXPORT_PRIVATE ItemParallelJob {
  public:
   class Task;
 
-  class Item {
+  class V8_EXPORT_PRIVATE Item {
    public:
-    Item() : state_(kAvailable) {}
-    virtual ~Item() {}
+    Item() = default;
+    virtual ~Item() = default;
 
     // Marks an item as being finished.
     void MarkFinished() { CHECK(state_.TrySetValue(kProcessing, kFinished)); }
@@ -45,7 +59,7 @@ class ItemParallelJob {
     }
     bool IsFinished() { return state_.Value() == kFinished; }
 
-    base::AtomicValue<ProcessingState> state_;
+    base::AtomicValue<ProcessingState> state_{kAvailable};
 
     friend class ItemParallelJob;
     friend class ItemParallelJob::Task;
@@ -53,15 +67,10 @@ class ItemParallelJob {
     DISALLOW_COPY_AND_ASSIGN(Item);
   };
 
-  class Task : public CancelableTask {
+  class V8_EXPORT_PRIVATE Task : public CancelableTask {
    public:
-    explicit Task(Isolate* isolate)
-        : CancelableTask(isolate),
-          items_(nullptr),
-          cur_index_(0),
-          items_considered_(0),
-          on_finish_(nullptr) {}
-    virtual ~Task() {}
+    explicit Task(Isolate* isolate);
+    virtual ~Task();
 
     virtual void RunInParallel() = 0;
 
@@ -85,45 +94,39 @@ class ItemParallelJob {
     }
 
    private:
-    void SetupInternal(base::Semaphore* on_finish, std::vector<Item*>* items,
-                       size_t start_index) {
-      on_finish_ = on_finish;
-      items_ = items;
-      cur_index_ = start_index;
-    }
+    friend class ItemParallelJob;
+    friend class Item;
 
-    // We don't allow overriding this method any further.
-    void RunInternal() final {
-      RunInParallel();
-      on_finish_->Signal();
-    }
+    // Sets up state required before invoking Run(). If
+    // |start_index is >= items_.size()|, this task will not process work items
+    // (some jobs have more tasks than work items in order to parallelize post-
+    // processing, e.g. scavenging). If |gc_parallel_task_latency_histogram| is
+    // provided, it will be used to report histograms on the latency between
+    // posting the task and it being scheduled.
+    void SetupInternal(
+        base::Semaphore* on_finish, std::vector<Item*>* items,
+        size_t start_index,
+        base::Optional<AsyncTimedHistogram> gc_parallel_task_latency_histogram);
 
-    std::vector<Item*>* items_;
-    size_t cur_index_;
-    size_t items_considered_;
-    base::Semaphore* on_finish_;
+    // We don't allow overriding this method any further.
+    void RunInternal() final;
 
-    friend class ItemParallelJob;
-    friend class Item;
+    std::vector<Item*>* items_ = nullptr;
+    size_t cur_index_ = 0;
+    size_t items_considered_ = 0;
+    base::Semaphore* on_finish_ = nullptr;
+    base::Optional<AsyncTimedHistogram> gc_parallel_task_latency_histogram_;
 
     DISALLOW_COPY_AND_ASSIGN(Task);
   };
 
   ItemParallelJob(CancelableTaskManager* cancelable_task_manager,
-                  base::Semaphore* pending_tasks)
-      : cancelable_task_manager_(cancelable_task_manager),
-        pending_tasks_(pending_tasks) {}
-
-  ~ItemParallelJob() {
-    for (size_t i = 0; i < items_.size(); i++) {
-      Item* item = items_[i];
-      CHECK(item->IsFinished());
-      delete item;
-    }
-  }
+                  base::Semaphore* pending_tasks);
+
+  ~ItemParallelJob();
 
   // Adds a task to the job. Transfers ownership to the job.
-  void AddTask(Task* task) { tasks_.push_back(task); }
+  void AddTask(Task* task) { tasks_.push_back(std::unique_ptr<Task>(task)); }
 
   // Adds an item to the job. Transfers ownership to the job.
   void AddItem(Item* item) { items_.push_back(item); }
@@ -131,46 +134,13 @@ class ItemParallelJob {
   int NumberOfItems() const { return static_cast<int>(items_.size()); }
   int NumberOfTasks() const { return static_cast<int>(tasks_.size()); }
 
-  void Run() {
-    DCHECK_GE(tasks_.size(), 0);
-    const size_t num_tasks = tasks_.size();
-    const size_t num_items = items_.size();
-    const size_t items_per_task = (num_items + num_tasks - 1) / num_tasks;
-    CancelableTaskManager::Id* task_ids =
-        new CancelableTaskManager::Id[num_tasks];
-    size_t start_index = 0;
-    Task* main_task = nullptr;
-    Task* task = nullptr;
-    for (size_t i = 0; i < num_tasks; i++, start_index += items_per_task) {
-      task = tasks_[i];
-      if (start_index >= num_items) {
-        start_index -= num_items;
-      }
-      task->SetupInternal(pending_tasks_, &items_, start_index);
-      task_ids[i] = task->id();
-      if (i > 0) {
-        V8::GetCurrentPlatform()->CallOnBackgroundThread(
-            task, v8::Platform::kShortRunningTask);
-      } else {
-        main_task = task;
-      }
-    }
-    // Contribute on main thread.
-    main_task->Run();
-    delete main_task;
-    // Wait for background tasks.
-    for (size_t i = 0; i < num_tasks; i++) {
-      if (cancelable_task_manager_->TryAbort(task_ids[i]) !=
-          CancelableTaskManager::kTaskAborted) {
-        pending_tasks_->Wait();
-      }
-    }
-    delete[] task_ids;
-  }
+  // Runs this job. Reporting metrics in a thread-safe manner to
+  // |async_counters|.
+  void Run(std::shared_ptr<Counters> async_counters);
 
  private:
   std::vector<Item*> items_;
-  std::vector<Task*> tasks_;
+  std::vector<std::unique_ptr<Task>> tasks_;
   CancelableTaskManager* cancelable_task_manager_;
   base::Semaphore* pending_tasks_;
   DISALLOW_COPY_AND_ASSIGN(ItemParallelJob);
@@ -179,4 +149,4 @@ class ItemParallelJob {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_HEAP_ITEM_PARALLEL_JOB_
+#endif  // V8_HEAP_ITEM_PARALLEL_JOB_H_
diff --git a/deps/v8/src/heap/mark-compact-inl.h b/deps/v8/src/heap/mark-compact-inl.h
index a6bbecd88e6..8a1e783ea50 100644
--- a/deps/v8/src/heap/mark-compact-inl.h
+++ b/deps/v8/src/heap/mark-compact-inl.h
@@ -28,7 +28,7 @@ int MarkingVisitor<fixed_array_mode, retaining_path_mode,
                    MarkingState>::VisitAllocationSite(Map* map,
                                                       AllocationSite* object) {
   int size = AllocationSite::BodyDescriptorWeak::SizeOf(map, object);
-  AllocationSite::BodyDescriptorWeak::IterateBody(object, size, this);
+  AllocationSite::BodyDescriptorWeak::IterateBody(map, object, size, this);
   return size;
 }
 
@@ -38,7 +38,7 @@ int MarkingVisitor<fixed_array_mode, retaining_path_mode,
                    MarkingState>::VisitBytecodeArray(Map* map,
                                                      BytecodeArray* array) {
   int size = BytecodeArray::BodyDescriptor::SizeOf(map, array);
-  BytecodeArray::BodyDescriptor::IterateBody(array, size, this);
+  BytecodeArray::BodyDescriptor::IterateBody(map, array, size, this);
   array->MakeOlder();
   return size;
 }
@@ -48,7 +48,7 @@ template <FixedArrayVisitationMode fixed_array_mode,
 int MarkingVisitor<fixed_array_mode, retaining_path_mode, MarkingState>::
     VisitCodeDataContainer(Map* map, CodeDataContainer* object) {
   int size = CodeDataContainer::BodyDescriptorWeak::SizeOf(map, object);
-  CodeDataContainer::BodyDescriptorWeak::IterateBody(object, size, this);
+  CodeDataContainer::BodyDescriptorWeak::IterateBody(map, object, size, this);
   return size;
 }
 
@@ -71,7 +71,7 @@ int MarkingVisitor<fixed_array_mode, retaining_path_mode,
     heap_->TracePossibleWrapper(object);
   }
   int size = JSObject::BodyDescriptor::SizeOf(map, object);
-  JSObject::BodyDescriptor::IterateBody(object, size, this);
+  JSObject::BodyDescriptor::IterateBody(map, object, size, this);
   return size;
 }
 
@@ -81,7 +81,7 @@ int MarkingVisitor<fixed_array_mode, retaining_path_mode,
                    MarkingState>::VisitJSFunction(Map* map,
                                                   JSFunction* object) {
   int size = JSFunction::BodyDescriptorWeak::SizeOf(map, object);
-  JSFunction::BodyDescriptorWeak::IterateBody(object, size, this);
+  JSFunction::BodyDescriptorWeak::IterateBody(map, object, size, this);
   return size;
 }
 
@@ -98,7 +98,7 @@ int MarkingVisitor<fixed_array_mode, retaining_path_mode, MarkingState>::
   // Skip visiting the backing hash table containing the mappings and the
   // pointer to the other enqueued weak collections, both are post-processed.
   int size = JSWeakCollection::BodyDescriptorWeak::SizeOf(map, weak_collection);
-  JSWeakCollection::BodyDescriptorWeak::IterateBody(weak_collection, size,
+  JSWeakCollection::BodyDescriptorWeak::IterateBody(map, weak_collection, size,
                                                     this);
 
   // Partially initialized weak collection is enqueued, but table is ignored.
@@ -135,7 +135,7 @@ int MarkingVisitor<fixed_array_mode, retaining_path_mode,
                    MarkingState>::VisitNativeContext(Map* map,
                                                      Context* context) {
   int size = Context::BodyDescriptorWeak::SizeOf(map, context);
-  Context::BodyDescriptorWeak::IterateBody(context, size, this);
+  Context::BodyDescriptorWeak::IterateBody(map, context, size, this);
   return size;
 }
 
@@ -145,7 +145,7 @@ int MarkingVisitor<fixed_array_mode, retaining_path_mode,
                    MarkingState>::VisitTransitionArray(Map* map,
                                                        TransitionArray* array) {
   int size = TransitionArray::BodyDescriptor::SizeOf(map, array);
-  TransitionArray::BodyDescriptor::IterateBody(array, size, this);
+  TransitionArray::BodyDescriptor::IterateBody(map, array, size, this);
   collector_->AddTransitionArray(array);
   return size;
 }
@@ -184,6 +184,32 @@ void MarkingVisitor<fixed_array_mode, retaining_path_mode,
   MarkObject(host, target_object);
 }
 
+template <FixedArrayVisitationMode fixed_array_mode,
+          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
+void MarkingVisitor<fixed_array_mode, retaining_path_mode,
+                    MarkingState>::VisitPointer(HeapObject* host,
+                                                MaybeObject** p) {
+  HeapObject* target_object;
+  if ((*p)->ToStrongHeapObject(&target_object)) {
+    collector_->RecordSlot(host, reinterpret_cast<HeapObjectReference**>(p),
+                           target_object);
+    MarkObject(host, target_object);
+  } else if ((*p)->ToWeakHeapObject(&target_object)) {
+    if (marking_state()->IsBlackOrGrey(target_object)) {
+      // Weak references with live values are directly processed here to reduce
+      // the processing time of weak cells during the main GC pause.
+      collector_->RecordSlot(host, reinterpret_cast<HeapObjectReference**>(p),
+                             target_object);
+    } else {
+      // If we do not know about liveness of values of weak cells, we have to
+      // process them when we know the liveness of the whole transitive
+      // closure.
+      collector_->AddWeakReference(host,
+                                   reinterpret_cast<HeapObjectReference**>(p));
+    }
+  }
+}
+
 template <FixedArrayVisitationMode fixed_array_mode,
           TraceRetainingPathMode retaining_path_mode, typename MarkingState>
 void MarkingVisitor<fixed_array_mode, retaining_path_mode,
@@ -194,6 +220,17 @@ void MarkingVisitor<fixed_array_mode, retaining_path_mode,
   }
 }
 
+template <FixedArrayVisitationMode fixed_array_mode,
+          TraceRetainingPathMode retaining_path_mode, typename MarkingState>
+void MarkingVisitor<fixed_array_mode, retaining_path_mode,
+                    MarkingState>::VisitPointers(HeapObject* host,
+                                                 MaybeObject** start,
+                                                 MaybeObject** end) {
+  for (MaybeObject** p = start; p < end; p++) {
+    VisitPointer(host, p);
+  }
+}
+
 template <FixedArrayVisitationMode fixed_array_mode,
           TraceRetainingPathMode retaining_path_mode, typename MarkingState>
 void MarkingVisitor<fixed_array_mode, retaining_path_mode,
@@ -204,6 +241,8 @@ void MarkingVisitor<fixed_array_mode, retaining_path_mode,
   collector_->RecordRelocSlot(host, rinfo, object);
   if (!host->IsWeakObject(object)) {
     MarkObject(host, object);
+  } else if (!marking_state()->IsBlackOrGrey(object)) {
+    collector_->AddWeakObjectInCode(object, host);
   }
 }
 
@@ -288,7 +327,7 @@ int MarkingVisitor<fixed_array_mode, retaining_path_mode, MarkingState>::
       }
     }
   } else {
-    FixedArray::BodyDescriptor::IterateBody(object, object_size, this);
+    FixedArray::BodyDescriptor::IterateBody(map, object, object_size, this);
   }
   return object_size;
 }
@@ -353,6 +392,12 @@ void MarkCompactCollector::MarkExternallyReferencedObject(HeapObject* obj) {
 
 void MarkCompactCollector::RecordSlot(HeapObject* object, Object** slot,
                                       Object* target) {
+  RecordSlot(object, reinterpret_cast<HeapObjectReference**>(slot), target);
+}
+
+void MarkCompactCollector::RecordSlot(HeapObject* object,
+                                      HeapObjectReference** slot,
+                                      Object* target) {
   Page* target_page = Page::FromAddress(reinterpret_cast<Address>(target));
   Page* source_page = Page::FromAddress(reinterpret_cast<Address>(object));
   if (target_page->IsEvacuationCandidate<AccessMode::ATOMIC>() &&
diff --git a/deps/v8/src/heap/mark-compact.cc b/deps/v8/src/heap/mark-compact.cc
index 30a7e55d6bd..0555b3ff3ce 100644
--- a/deps/v8/src/heap/mark-compact.cc
+++ b/deps/v8/src/heap/mark-compact.cc
@@ -16,7 +16,6 @@
 #include "src/global-handles.h"
 #include "src/heap/array-buffer-collector.h"
 #include "src/heap/array-buffer-tracker-inl.h"
-#include "src/heap/concurrent-marking.h"
 #include "src/heap/gc-tracer.h"
 #include "src/heap/incremental-marking.h"
 #include "src/heap/invalidated-slots-inl.h"
@@ -63,6 +62,7 @@ class MarkingVerifier : public ObjectVisitor, public RootVisitor {
   virtual Bitmap* bitmap(const MemoryChunk* chunk) = 0;
 
   virtual void VerifyPointers(Object** start, Object** end) = 0;
+  virtual void VerifyPointers(MaybeObject** start, MaybeObject** end) = 0;
 
   virtual bool IsMarked(HeapObject* object) = 0;
 
@@ -72,7 +72,13 @@ class MarkingVerifier : public ObjectVisitor, public RootVisitor {
     VerifyPointers(start, end);
   }
 
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
+  void VisitPointers(HeapObject* host, MaybeObject** start,
+                     MaybeObject** end) override {
+    VerifyPointers(start, end);
+  }
+
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {
     VerifyPointers(start, end);
   }
 
@@ -182,6 +188,15 @@ class FullMarkingVerifier : public MarkingVerifier {
     }
   }
 
+  void VerifyPointers(MaybeObject** start, MaybeObject** end) override {
+    for (MaybeObject** current = start; current < end; current++) {
+      HeapObject* object;
+      if ((*current)->ToStrongHeapObject(&object)) {
+        CHECK(marking_state_->IsBlackOrGrey(object));
+      }
+    }
+  }
+
   void VisitEmbeddedPointer(Code* host, RelocInfo* rinfo) override {
     DCHECK(rinfo->rmode() == RelocInfo::EMBEDDED_OBJECT);
     if (!host->IsWeakObject(rinfo->target_object())) {
@@ -220,6 +235,7 @@ class YoungGenerationMarkingVerifier : public MarkingVerifier {
 
   void VerifyPointers(Object** start, Object** end) override {
     for (Object** current = start; current < end; current++) {
+      DCHECK(!HasWeakHeapObjectTag(*current));
       if ((*current)->IsHeapObject()) {
         HeapObject* object = HeapObject::cast(*current);
         if (!heap_->InNewSpace(object)) return;
@@ -228,6 +244,19 @@ class YoungGenerationMarkingVerifier : public MarkingVerifier {
     }
   }
 
+  void VerifyPointers(MaybeObject** start, MaybeObject** end) override {
+    for (MaybeObject** current = start; current < end; current++) {
+      HeapObject* object;
+      // Minor MC treats weak references as strong.
+      if ((*current)->ToStrongOrWeakHeapObject(&object)) {
+        if (!heap_->InNewSpace(object)) {
+          continue;
+        }
+        CHECK(IsMarked(object));
+      }
+    }
+  }
+
  private:
   MinorMarkCompactCollector::NonAtomicMarkingState* marking_state_;
 };
@@ -240,7 +269,13 @@ class EvacuationVerifier : public ObjectVisitor, public RootVisitor {
     VerifyPointers(start, end);
   }
 
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
+  void VisitPointers(HeapObject* host, MaybeObject** start,
+                     MaybeObject** end) override {
+    VerifyPointers(start, end);
+  }
+
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {
     VerifyPointers(start, end);
   }
 
@@ -250,6 +285,7 @@ class EvacuationVerifier : public ObjectVisitor, public RootVisitor {
   inline Heap* heap() { return heap_; }
 
   virtual void VerifyPointers(Object** start, Object** end) = 0;
+  virtual void VerifyPointers(MaybeObject** start, MaybeObject** end) = 0;
 
   void VerifyRoots(VisitMode mode);
   void VerifyEvacuationOnPage(Address start, Address end);
@@ -319,6 +355,17 @@ class FullEvacuationVerifier : public EvacuationVerifier {
       }
     }
   }
+  void VerifyPointers(MaybeObject** start, MaybeObject** end) override {
+    for (MaybeObject** current = start; current < end; current++) {
+      HeapObject* object;
+      if ((*current)->ToStrongHeapObject(&object)) {
+        if (heap()->InNewSpace(object)) {
+          CHECK(heap()->InToSpace(object));
+        }
+        CHECK(!MarkCompactCollector::IsOnEvacuationCandidate(object));
+      }
+    }
+  }
 };
 
 class YoungGenerationEvacuationVerifier : public EvacuationVerifier {
@@ -343,6 +390,14 @@ class YoungGenerationEvacuationVerifier : public EvacuationVerifier {
       }
     }
   }
+  void VerifyPointers(MaybeObject** start, MaybeObject** end) override {
+    for (MaybeObject** current = start; current < end; current++) {
+      HeapObject* object;
+      if ((*current)->ToStrongOrWeakHeapObject(&object)) {
+        CHECK_IMPLIES(heap()->InNewSpace(object), heap()->InToSpace(object));
+      }
+    }
+  }
 };
 
 }  // namespace
@@ -369,12 +424,14 @@ class RootMarkingVisitorSeedOnly : public RootVisitor {
     buffered_objects_.reserve(kBufferSize);
   }
 
-  void VisitRootPointer(Root root, Object** p) override {
+  void VisitRootPointer(Root root, const char* description,
+                        Object** p) override {
     if (!(*p)->IsHeapObject()) return;
     AddObject(*p);
   }
 
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {
     for (Object** p = start; p < end; p++) {
       if (!(*p)->IsHeapObject()) continue;
       AddObject(*p);
@@ -404,17 +461,26 @@ class RootMarkingVisitorSeedOnly : public RootVisitor {
   std::vector<Object*> buffered_objects_;
 };
 
-}  // namespace
-
-static int NumberOfAvailableCores() {
-  return Max(
-      1, static_cast<int>(
-             V8::GetCurrentPlatform()->NumberOfAvailableBackgroundThreads()));
+int NumberOfAvailableCores() {
+  static int num_cores = V8::GetCurrentPlatform()->NumberOfWorkerThreads() + 1;
+  // This number of cores should be greater than zero and never change.
+  DCHECK_GE(num_cores, 1);
+  DCHECK_EQ(num_cores, V8::GetCurrentPlatform()->NumberOfWorkerThreads() + 1);
+  return num_cores;
 }
 
+}  // namespace
+
 int MarkCompactCollectorBase::NumberOfParallelCompactionTasks(int pages) {
   DCHECK_GT(pages, 0);
-  return FLAG_parallel_compaction ? Min(NumberOfAvailableCores(), pages) : 1;
+  int tasks =
+      FLAG_parallel_compaction ? Min(NumberOfAvailableCores(), pages) : 1;
+  if (!heap_->CanExpandOldGeneration(
+          static_cast<size_t>(tasks * Page::kPageSize))) {
+    // Optimize for memory usage near the heap limit.
+    tasks = 1;
+  }
+  return tasks;
 }
 
 int MarkCompactCollectorBase::NumberOfParallelPointerUpdateTasks(int pages,
@@ -547,6 +613,13 @@ void MarkCompactCollector::CollectGarbage() {
 }
 
 #ifdef VERIFY_HEAP
+void MarkCompactCollector::VerifyMarkbitsAreDirty(PagedSpace* space) {
+  HeapObjectIterator iterator(space);
+  while (HeapObject* object = iterator.Next()) {
+    CHECK(non_atomic_marking_state()->IsBlack(object));
+  }
+}
+
 void MarkCompactCollector::VerifyMarkbitsAreClean(PagedSpace* space) {
   for (Page* p : *space) {
     CHECK(non_atomic_marking_state()->bitmap(p)->IsClean());
@@ -568,6 +641,9 @@ void MarkCompactCollector::VerifyMarkbitsAreClean() {
   VerifyMarkbitsAreClean(heap_->code_space());
   VerifyMarkbitsAreClean(heap_->map_space());
   VerifyMarkbitsAreClean(heap_->new_space());
+  // Read-only space should always be black since we never collect any objects
+  // in it or linked from it.
+  VerifyMarkbitsAreDirty(heap_->read_only_space());
 
   LargeObjectIterator it(heap_->lo_space());
   for (HeapObject* obj = it.Next(); obj != nullptr; obj = it.Next()) {
@@ -577,17 +653,6 @@ void MarkCompactCollector::VerifyMarkbitsAreClean() {
   }
 }
 
-void MarkCompactCollector::VerifyWeakEmbeddedObjectsInCode() {
-  HeapObjectIterator code_iterator(heap()->code_space());
-  for (HeapObject* obj = code_iterator.Next(); obj != nullptr;
-       obj = code_iterator.Next()) {
-    Code* code = Code::cast(obj);
-    if (!code->is_optimized_code()) continue;
-    if (WillBeDeoptimized(code)) continue;
-    code->VerifyEmbeddedObjectsDependency();
-  }
-}
-
 #endif  // VERIFY_HEAP
 
 void MarkCompactCollector::ClearMarkbitsInPagedSpace(PagedSpace* space) {
@@ -855,7 +920,7 @@ void MarkCompactCollector::Prepare() {
   if (was_marked_incrementally_ && heap_->ShouldAbortIncrementalMarking()) {
     heap()->incremental_marking()->Stop();
     heap()->incremental_marking()->AbortBlackAllocation();
-    FinishConcurrentMarking();
+    FinishConcurrentMarking(ConcurrentMarking::StopRequest::PREEMPT_TASKS);
     heap()->incremental_marking()->Deactivate();
     ClearMarkbits();
     AbortWeakCollections();
@@ -891,9 +956,10 @@ void MarkCompactCollector::Prepare() {
 #endif
 }
 
-void MarkCompactCollector::FinishConcurrentMarking() {
+void MarkCompactCollector::FinishConcurrentMarking(
+    ConcurrentMarking::StopRequest stop_request) {
   if (FLAG_concurrent_marking) {
-    heap()->concurrent_marking()->EnsureCompleted();
+    heap()->concurrent_marking()->Stop(stop_request);
     heap()->concurrent_marking()->FlushLiveBytes(non_atomic_marking_state());
   }
 }
@@ -924,9 +990,6 @@ void MarkCompactCollector::Finish() {
   sweeper()->StartSweeperTasks();
   sweeper()->StartIterabilityTasks();
 
-  // The hashing of weak_object_to_code_table is no longer valid.
-  heap()->weak_object_to_code_table()->Rehash();
-
   // Clear the marking state of live large objects.
   heap_->lo_space()->ClearMarkingStateOfLiveObjects();
 
@@ -965,11 +1028,12 @@ class MarkCompactCollector::RootMarkingVisitor final : public RootVisitor {
   explicit RootMarkingVisitor(MarkCompactCollector* collector)
       : collector_(collector) {}
 
-  void VisitRootPointer(Root root, Object** p) final {
+  void VisitRootPointer(Root root, const char* description, Object** p) final {
     MarkObjectByPointer(root, p);
   }
 
-  void VisitRootPointers(Root root, Object** start, Object** end) final {
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) final {
     for (Object** p = start; p < end; p++) MarkObjectByPointer(root, p);
   }
 
@@ -1003,7 +1067,16 @@ class MarkCompactCollector::CustomRootBodyMarkingVisitor final
   }
 
   void VisitPointers(HeapObject* host, Object** start, Object** end) final {
-    for (Object** p = start; p < end; p++) MarkObject(host, *p);
+    for (Object** p = start; p < end; p++) {
+      DCHECK(!HasWeakHeapObjectTag(*p));
+      MarkObject(host, *p);
+    }
+  }
+
+  void VisitPointers(HeapObject* host, MaybeObject** start,
+                     MaybeObject** end) final {
+    // At the moment, custom roots cannot contain weak pointers.
+    UNREACHABLE();
   }
 
   // VisitEmbedderPointer is defined by ObjectVisitor to call VisitPointers.
@@ -1044,6 +1117,11 @@ class InternalizedStringTableCleaner : public ObjectVisitor {
     }
   }
 
+  void VisitPointers(HeapObject* host, MaybeObject** start,
+                     MaybeObject** end) final {
+    UNREACHABLE();
+  }
+
   int PointersRemoved() {
     return pointers_removed_;
   }
@@ -1058,7 +1136,8 @@ class ExternalStringTableCleaner : public RootVisitor {
  public:
   explicit ExternalStringTableCleaner(Heap* heap) : heap_(heap) {}
 
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {
     // Visit all HeapObject pointers in [start, end).
     MarkCompactCollector::NonAtomicMarkingState* marking_state =
         heap_->mark_compact_collector()->non_atomic_marking_state();
@@ -1093,7 +1172,8 @@ class YoungGenerationExternalStringTableCleaner : public RootVisitor {
       : heap_(collector->heap()),
         marking_state_(collector->non_atomic_marking_state()) {}
 
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {
     DCHECK_EQ(static_cast<int>(root),
               static_cast<int>(Root::kExternalStringsTable));
     // Visit all HeapObject pointers in [start, end).
@@ -1182,13 +1262,27 @@ class RecordMigratedSlotVisitor : public ObjectVisitor {
       : collector_(collector) {}
 
   inline void VisitPointer(HeapObject* host, Object** p) final {
+    DCHECK(!HasWeakHeapObjectTag(*p));
+    RecordMigratedSlot(host, reinterpret_cast<MaybeObject*>(*p),
+                       reinterpret_cast<Address>(p));
+  }
+
+  inline void VisitPointer(HeapObject* host, MaybeObject** p) final {
     RecordMigratedSlot(host, *p, reinterpret_cast<Address>(p));
   }
 
   inline void VisitPointers(HeapObject* host, Object** start,
                             Object** end) final {
     while (start < end) {
-      RecordMigratedSlot(host, *start, reinterpret_cast<Address>(start));
+      VisitPointer(host, start);
+      ++start;
+    }
+  }
+
+  inline void VisitPointers(HeapObject* host, MaybeObject** start,
+                            MaybeObject** end) final {
+    while (start < end) {
+      VisitPointer(host, start);
       ++start;
     }
   }
@@ -1218,9 +1312,9 @@ class RecordMigratedSlotVisitor : public ObjectVisitor {
   inline void VisitInternalReference(Code* host, RelocInfo* rinfo) final {}
 
  protected:
-  inline virtual void RecordMigratedSlot(HeapObject* host, Object* value,
+  inline virtual void RecordMigratedSlot(HeapObject* host, MaybeObject* value,
                                          Address slot) {
-    if (value->IsHeapObject()) {
+    if (value->IsStrongOrWeakHeapObject()) {
       Page* p = Page::FromAddress(reinterpret_cast<Address>(value));
       if (p->InNewSpace()) {
         DCHECK_IMPLIES(p->InToSpace(),
@@ -1305,9 +1399,9 @@ class YoungGenerationRecordMigratedSlotVisitor final
     return collector_->non_atomic_marking_state()->IsBlack(object);
   }
 
-  inline void RecordMigratedSlot(HeapObject* host, Object* value,
+  inline void RecordMigratedSlot(HeapObject* host, MaybeObject* value,
                                  Address slot) final {
-    if (value->IsHeapObject()) {
+    if (value->IsStrongOrWeakHeapObject()) {
       Page* p = Page::FromAddress(reinterpret_cast<Address>(value));
       if (p->InNewSpace()) {
         DCHECK_IMPLIES(p->InToSpace(),
@@ -1356,16 +1450,14 @@ class EvacuateVisitorBase : public HeapObjectVisitor {
       base->heap_->CopyBlock(dst_addr, src_addr, size);
       if (mode != MigrationMode::kFast)
         base->ExecuteMigrationObservers(dest, src, dst, size);
-      dst->IterateBodyFast(dst->map()->instance_type(), size,
-                           base->record_visitor_);
+      dst->IterateBodyFast(dst->map(), size, base->record_visitor_);
     } else if (dest == CODE_SPACE) {
       DCHECK_CODEOBJECT_SIZE(size, base->heap_->code_space());
       base->heap_->CopyBlock(dst_addr, src_addr, size);
       Code::cast(dst)->Relocate(dst_addr - src_addr);
       if (mode != MigrationMode::kFast)
         base->ExecuteMigrationObservers(dest, src, dst, size);
-      dst->IterateBodyFast(dst->map()->instance_type(), size,
-                           base->record_visitor_);
+      dst->IterateBodyFast(dst->map(), size, base->record_visitor_);
     } else {
       DCHECK_OBJECT_SIZE(size);
       DCHECK(dest == NEW_SPACE);
@@ -1391,7 +1483,8 @@ class EvacuateVisitorBase : public HeapObjectVisitor {
 #ifdef VERIFY_HEAP
     if (AbortCompactionForTesting(object)) return false;
 #endif  // VERIFY_HEAP
-    AllocationAlignment alignment = object->RequiredAlignment();
+    AllocationAlignment alignment =
+        HeapObject::RequiredAlignment(object->map());
     AllocationResult allocation =
         local_allocator_->Allocate(target_space, size, alignment);
     if (allocation.To(target_object)) {
@@ -1496,7 +1589,8 @@ class EvacuateNewSpaceVisitor final : public EvacuateVisitorBase {
 
   inline AllocationSpace AllocateTargetObject(HeapObject* old_object, int size,
                                               HeapObject** target_object) {
-    AllocationAlignment alignment = old_object->RequiredAlignment();
+    AllocationAlignment alignment =
+        HeapObject::RequiredAlignment(old_object->map());
     AllocationSpace space_allocated_in = NEW_SPACE;
     AllocationResult allocation =
         local_allocator_->Allocate(NEW_SPACE, size, alignment);
@@ -1515,8 +1609,8 @@ class EvacuateNewSpaceVisitor final : public EvacuateVisitorBase {
     AllocationResult allocation =
         local_allocator_->Allocate(OLD_SPACE, size_in_bytes, alignment);
     if (allocation.IsRetry()) {
-      v8::internal::Heap::FatalProcessOutOfMemory(
-          "MarkCompactCollector: semi-space copy, fallback in old gen", true);
+      heap_->FatalProcessOutOfMemory(
+          "MarkCompactCollector: semi-space copy, fallback in old gen");
     }
     return allocation;
   }
@@ -1599,7 +1693,7 @@ class EvacuateRecordOnlyVisitor final : public HeapObjectVisitor {
 
   inline bool Visit(HeapObject* object, int size) {
     RecordMigratedSlotVisitor visitor(heap_->mark_compact_collector());
-    object->IterateBody(&visitor);
+    object->IterateBodyFast(&visitor);
     return true;
   }
 
@@ -1682,7 +1776,7 @@ void MarkCompactCollector::ProcessTopOptimizedFrame(ObjectVisitor* visitor) {
     if (it.frame()->type() == StackFrame::OPTIMIZED) {
       Code* code = it.frame()->LookupCode();
       if (!code->CanDeoptAt(it.frame()->pc())) {
-        Code::BodyDescriptor::IterateBody(code, visitor);
+        Code::BodyDescriptor::IterateBody(code->map(), code, visitor);
       }
       return;
     }
@@ -1731,14 +1825,34 @@ class YoungGenerationMarkingVisitor final
     }
   }
 
+  V8_INLINE void VisitPointers(HeapObject* host, MaybeObject** start,
+                               MaybeObject** end) final {
+    for (MaybeObject** p = start; p < end; p++) {
+      VisitPointer(host, p);
+    }
+  }
+
   V8_INLINE void VisitPointer(HeapObject* host, Object** slot) final {
     Object* target = *slot;
+    DCHECK(!HasWeakHeapObjectTag(target));
     if (heap_->InNewSpace(target)) {
       HeapObject* target_object = HeapObject::cast(target);
       MarkObjectViaMarkingWorklist(target_object);
     }
   }
 
+  V8_INLINE void VisitPointer(HeapObject* host, MaybeObject** slot) final {
+    MaybeObject* target = *slot;
+    if (heap_->InNewSpace(target)) {
+      HeapObject* target_object;
+      // Treat weak references as strong. TODO(marja): Proper weakness handling
+      // for minor-mcs.
+      if (target->ToStrongOrWeakHeapObject(&target_object)) {
+        MarkObjectViaMarkingWorklist(target_object);
+      }
+    }
+  }
+
  private:
   inline void MarkObjectViaMarkingWorklist(HeapObject* object) {
     if (marking_state_->WhiteToGrey(object)) {
@@ -1758,11 +1872,13 @@ class MinorMarkCompactCollector::RootMarkingVisitor : public RootVisitor {
       : collector_(collector),
         marking_state_(collector_->non_atomic_marking_state()) {}
 
-  void VisitRootPointer(Root root, Object** p) override {
+  void VisitRootPointer(Root root, const char* description,
+                        Object** p) override {
     MarkObjectByPointer(p);
   }
 
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {
     for (Object** p = start; p < end; p++) MarkObjectByPointer(p);
   }
 
@@ -1883,6 +1999,8 @@ class BatchedRootMarkingItem : public MarkingItem {
   virtual ~BatchedRootMarkingItem() {}
 
   void Process(YoungGenerationMarkingTask* task) override {
+    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+                 "BatchedRootMarkingItem::Process");
     for (Object* object : objects_) {
       task->MarkObject(object);
     }
@@ -1900,6 +2018,8 @@ class PageMarkingItem : public MarkingItem {
   virtual ~PageMarkingItem() { global_slots_->Increment(slots_); }
 
   void Process(YoungGenerationMarkingTask* task) override {
+    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+                 "PageMarkingItem::Process");
     base::LockGuard<base::Mutex> guard(chunk_->mutex());
     MarkUntypedPointers(task);
     MarkTypedPointers(task);
@@ -1921,7 +2041,7 @@ class PageMarkingItem : public MarkingItem {
         chunk_, [this, isolate, task](SlotType slot_type, Address host_addr,
                                       Address slot) {
           return UpdateTypedSlotHelper::UpdateTypedSlot(
-              isolate, slot_type, slot, [this, task](Object** slot) {
+              isolate, slot_type, slot, [this, task](MaybeObject** slot) {
                 return CheckAndMarkObject(task,
                                           reinterpret_cast<Address>(slot));
               });
@@ -1930,12 +2050,15 @@ class PageMarkingItem : public MarkingItem {
 
   SlotCallbackResult CheckAndMarkObject(YoungGenerationMarkingTask* task,
                                         Address slot_address) {
-    Object* object = *reinterpret_cast<Object**>(slot_address);
+    MaybeObject* object = *reinterpret_cast<MaybeObject**>(slot_address);
     if (heap()->InNewSpace(object)) {
       // Marking happens before flipping the young generation, so the object
       // has to be in ToSpace.
       DCHECK(heap()->InToSpace(object));
-      HeapObject* heap_object = reinterpret_cast<HeapObject*>(object);
+      HeapObject* heap_object;
+      bool success = object->ToStrongOrWeakHeapObject(&heap_object);
+      USE(success);
+      DCHECK(success);
       task->MarkObject(heap_object);
       slots_++;
       return KEEP_SLOT;
@@ -1956,6 +2079,8 @@ class GlobalHandlesMarkingItem : public MarkingItem {
   virtual ~GlobalHandlesMarkingItem() {}
 
   void Process(YoungGenerationMarkingTask* task) override {
+    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+                 "GlobalHandlesMarkingItem::Process");
     GlobalHandlesRootMarkingVisitor visitor(task);
     global_handles_
         ->IterateNewSpaceStrongAndDependentRootsAndIdentifyUnmodified(
@@ -1968,12 +2093,14 @@ class GlobalHandlesMarkingItem : public MarkingItem {
     explicit GlobalHandlesRootMarkingVisitor(YoungGenerationMarkingTask* task)
         : task_(task) {}
 
-    void VisitRootPointer(Root root, Object** p) override {
+    void VisitRootPointer(Root root, const char* description,
+                          Object** p) override {
       DCHECK_EQ(Root::kGlobalHandles, root);
       task_->MarkObject(*p);
     }
 
-    void VisitRootPointers(Root root, Object** start, Object** end) override {
+    void VisitRootPointers(Root root, const char* description, Object** start,
+                           Object** end) override {
       DCHECK_EQ(Root::kGlobalHandles, root);
       for (Object** p = start; p < end; p++) {
         task_->MarkObject(*p);
@@ -2061,7 +2188,7 @@ void MinorMarkCompactCollector::MarkRootSetInParallel() {
         job.AddTask(
             new YoungGenerationMarkingTask(isolate(), this, worklist(), i));
       }
-      job.Run();
+      job.Run(isolate()->async_counters());
       DCHECK(worklist()->IsGlobalEmpty());
     }
   }
@@ -2272,7 +2399,7 @@ void MinorMarkCompactCollector::Evacuate() {
   {
     TRACE_GC(heap()->tracer(), GCTracer::Scope::MINOR_MC_EVACUATE_REBALANCE);
     if (!heap()->new_space()->Rebalance()) {
-      FatalProcessOutOfMemory("NewSpace::Rebalance");
+      heap()->FatalProcessOutOfMemory("NewSpace::Rebalance");
     }
   }
 
@@ -2336,7 +2463,8 @@ void MarkCompactCollector::MarkLiveObjects() {
     }
     ProcessMarkingWorklist();
 
-    FinishConcurrentMarking();
+    FinishConcurrentMarking(
+        ConcurrentMarking::StopRequest::COMPLETE_ONGOING_TASKS);
     ProcessMarkingWorklist();
   }
 
@@ -2435,73 +2563,29 @@ void MarkCompactCollector::ClearNonLiveReferences() {
     // ClearFullMapTransitions must be called before WeakCells are cleared.
     ClearFullMapTransitions();
   }
-  DependentCode* dependent_code_list;
-  ClearWeakCellsAndSimpleMapTransitions(&dependent_code_list);
-  MarkDependentCodeForDeoptimization(dependent_code_list);
+  ClearWeakCellsAndSimpleMapTransitions();
+  ClearWeakReferences();
+  MarkDependentCodeForDeoptimization();
 
   ClearWeakCollections();
 
   DCHECK(weak_objects_.weak_cells.IsGlobalEmpty());
   DCHECK(weak_objects_.transition_arrays.IsGlobalEmpty());
+  DCHECK(weak_objects_.weak_references.IsGlobalEmpty());
+  DCHECK(weak_objects_.weak_objects_in_code.IsGlobalEmpty());
 }
 
-
-void MarkCompactCollector::MarkDependentCodeForDeoptimization(
-    DependentCode* list_head) {
-  TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_CLEAR_DEPENDENT_CODE);
-  Isolate* isolate = this->isolate();
-  DependentCode* current = list_head;
-  while (current->length() > 0) {
-    have_code_to_deoptimize_ |= current->MarkCodeForDeoptimization(
-        isolate, DependentCode::kWeakCodeGroup);
-    current = current->next_link();
-  }
-
-  {
-    ArrayList* list = heap_->weak_new_space_object_to_code_list();
-    int counter = 0;
-    for (int i = 0; i < list->Length(); i += 2) {
-      WeakCell* obj = WeakCell::cast(list->Get(i));
-      WeakCell* dep = WeakCell::cast(list->Get(i + 1));
-      if (obj->cleared() || dep->cleared()) {
-        if (!dep->cleared()) {
-          Code* code = Code::cast(dep->value());
-          if (!code->marked_for_deoptimization()) {
-            DependentCode::SetMarkedForDeoptimization(
-                code, DependentCode::DependencyGroup::kWeakCodeGroup);
-            code->InvalidateEmbeddedObjects();
-            have_code_to_deoptimize_ = true;
-          }
-        }
-      } else {
-        // We record the slot manually because marking is finished at this
-        // point and the write barrier would bailout.
-        list->Set(counter, obj, SKIP_WRITE_BARRIER);
-        RecordSlot(list, list->Slot(counter), obj);
-        counter++;
-        list->Set(counter, dep, SKIP_WRITE_BARRIER);
-        RecordSlot(list, list->Slot(counter), dep);
-        counter++;
-      }
-    }
-  }
-
-  WeakHashTable* table = heap_->weak_object_to_code_table();
-  uint32_t capacity = table->Capacity();
-  for (uint32_t i = 0; i < capacity; i++) {
-    uint32_t key_index = table->EntryToIndex(i);
-    Object* key = table->get(key_index);
-    if (!table->IsKey(isolate, key)) continue;
-    uint32_t value_index = table->EntryToValueIndex(i);
-    Object* value = table->get(value_index);
-    DCHECK(key->IsWeakCell());
-    if (WeakCell::cast(key)->cleared()) {
-      have_code_to_deoptimize_ |=
-          DependentCode::cast(value)->MarkCodeForDeoptimization(
-              isolate, DependentCode::kWeakCodeGroup);
-      table->set(key_index, heap_->the_hole_value());
-      table->set(value_index, heap_->the_hole_value());
-      table->ElementRemoved();
+void MarkCompactCollector::MarkDependentCodeForDeoptimization() {
+  std::pair<HeapObject*, Code*> weak_object_in_code;
+  while (weak_objects_.weak_objects_in_code.Pop(kMainThread,
+                                                &weak_object_in_code)) {
+    HeapObject* object = weak_object_in_code.first;
+    Code* code = weak_object_in_code.second;
+    if (!non_atomic_marking_state()->IsBlackOrGrey(object) &&
+        !code->marked_for_deoptimization()) {
+      code->SetMarkedForDeoptimization("weak objects");
+      code->InvalidateEmbeddedObjects();
+      have_code_to_deoptimize_ = true;
     }
   }
 }
@@ -2723,12 +2807,9 @@ void MarkCompactCollector::AbortWeakCollections() {
   heap()->set_encountered_weak_collections(Smi::kZero);
 }
 
-void MarkCompactCollector::ClearWeakCellsAndSimpleMapTransitions(
-    DependentCode** dependent_code_list) {
+void MarkCompactCollector::ClearWeakCellsAndSimpleMapTransitions() {
   Heap* heap = this->heap();
   TRACE_GC(heap->tracer(), GCTracer::Scope::MC_CLEAR_WEAK_CELLS);
-  DependentCode* dependent_code_head =
-      DependentCode::cast(heap->empty_fixed_array());
   WeakCell* weak_cell;
   while (weak_objects_.weak_cells.Pop(kMainThread, &weak_cell)) {
     // We do not insert cleared weak cells into the list, so the value
@@ -2757,15 +2838,6 @@ void MarkCompactCollector::ClearWeakCellsAndSimpleMapTransitions(
       } else if (value->IsMap()) {
         // The map is non-live.
         Map* map = Map::cast(value);
-        // Add dependent code to the dependent_code_list.
-        DependentCode* candidate = map->dependent_code();
-        // We rely on the fact that the weak code group comes first.
-        STATIC_ASSERT(DependentCode::kWeakCodeGroup == 0);
-        if (candidate->length() > 0 &&
-            candidate->group() == DependentCode::kWeakCodeGroup) {
-          candidate->set_next_link(dependent_code_head);
-          dependent_code_head = candidate;
-        }
         ClearSimpleMapTransition(weak_cell, map);
         weak_cell->clear();
       } else {
@@ -2778,12 +2850,32 @@ void MarkCompactCollector::ClearWeakCellsAndSimpleMapTransitions(
       RecordSlot(weak_cell, slot, *slot);
     }
   }
-  *dependent_code_list = dependent_code_head;
+}
+
+void MarkCompactCollector::ClearWeakReferences() {
+  TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_CLEAR_WEAK_REFERENCES);
+  std::pair<HeapObject*, HeapObjectReference**> slot;
+  while (weak_objects_.weak_references.Pop(kMainThread, &slot)) {
+    HeapObject* value;
+    HeapObjectReference** location = slot.second;
+    if ((*location)->ToWeakHeapObject(&value)) {
+      DCHECK(!value->IsCell());
+      DCHECK(!value->IsMap());
+      if (non_atomic_marking_state()->IsBlackOrGrey(value)) {
+        // The value of the weak reference is alive.
+        RecordSlot(slot.first, location, value);
+      } else {
+        *location = HeapObjectReference::ClearedValue();
+      }
+    }
+  }
 }
 
 void MarkCompactCollector::AbortWeakObjects() {
   weak_objects_.weak_cells.Clear();
   weak_objects_.transition_arrays.Clear();
+  weak_objects_.weak_references.Clear();
+  weak_objects_.weak_objects_in_code.Clear();
 }
 
 void MarkCompactCollector::RecordRelocSlot(Code* host, RelocInfo* rinfo,
@@ -2811,30 +2903,57 @@ void MarkCompactCollector::RecordRelocSlot(Code* host, RelocInfo* rinfo,
 }
 
 template <AccessMode access_mode>
-static inline SlotCallbackResult UpdateSlot(Object** slot) {
-  Object* obj = *slot;
-  if (obj->IsHeapObject()) {
-    HeapObject* heap_obj = HeapObject::cast(obj);
-    MapWord map_word = heap_obj->map_word();
-    if (map_word.IsForwardingAddress()) {
-      DCHECK(heap_obj->GetHeap()->InFromSpace(heap_obj) ||
-             MarkCompactCollector::IsOnEvacuationCandidate(heap_obj) ||
-             Page::FromAddress(heap_obj->address())
-                 ->IsFlagSet(Page::COMPACTION_WAS_ABORTED));
-      HeapObject* target = map_word.ToForwardingAddress();
-      if (access_mode == AccessMode::NON_ATOMIC) {
-        *slot = target;
-      } else {
-        base::AsAtomicPointer::Release_CompareAndSwap(slot, obj, target);
-      }
-      DCHECK(!heap_obj->GetHeap()->InFromSpace(target));
-      DCHECK(!MarkCompactCollector::IsOnEvacuationCandidate(target));
+static inline SlotCallbackResult UpdateSlot(
+    MaybeObject** slot, MaybeObject* old, HeapObject* heap_obj,
+    HeapObjectReferenceType reference_type) {
+  MapWord map_word = heap_obj->map_word();
+  if (map_word.IsForwardingAddress()) {
+    DCHECK(heap_obj->GetHeap()->InFromSpace(heap_obj) ||
+           MarkCompactCollector::IsOnEvacuationCandidate(heap_obj) ||
+           Page::FromAddress(heap_obj->address())
+               ->IsFlagSet(Page::COMPACTION_WAS_ABORTED));
+    MaybeObject* target =
+        reference_type == HeapObjectReferenceType::WEAK
+            ? HeapObjectReference::Weak(map_word.ToForwardingAddress())
+            : HeapObjectReference::Strong(map_word.ToForwardingAddress());
+    if (access_mode == AccessMode::NON_ATOMIC) {
+      *slot = target;
+    } else {
+      base::AsAtomicPointer::Release_CompareAndSwap(slot, old, target);
     }
+    DCHECK(!heap_obj->GetHeap()->InFromSpace(target));
+    DCHECK(!MarkCompactCollector::IsOnEvacuationCandidate(target));
   }
   // OLD_TO_OLD slots are always removed after updating.
   return REMOVE_SLOT;
 }
 
+template <AccessMode access_mode>
+static inline SlotCallbackResult UpdateSlot(MaybeObject** slot) {
+  MaybeObject* obj = base::AsAtomicPointer::Relaxed_Load(slot);
+  HeapObject* heap_obj;
+  if (obj->ToWeakHeapObject(&heap_obj)) {
+    UpdateSlot<access_mode>(slot, obj, heap_obj, HeapObjectReferenceType::WEAK);
+  } else if (obj->ToStrongHeapObject(&heap_obj)) {
+    return UpdateSlot<access_mode>(slot, obj, heap_obj,
+                                   HeapObjectReferenceType::STRONG);
+  }
+  return REMOVE_SLOT;
+}
+
+template <AccessMode access_mode>
+static inline SlotCallbackResult UpdateStrongSlot(MaybeObject** maybe_slot) {
+  DCHECK((*maybe_slot)->IsSmi() || (*maybe_slot)->IsStrongHeapObject());
+  Object** slot = reinterpret_cast<Object**>(maybe_slot);
+  Object* obj = base::AsAtomicPointer::Relaxed_Load(slot);
+  if (obj->IsHeapObject()) {
+    HeapObject* heap_obj = HeapObject::cast(obj);
+    return UpdateSlot<access_mode>(maybe_slot, MaybeObject::FromObject(obj),
+                                   heap_obj, HeapObjectReferenceType::STRONG);
+  }
+  return REMOVE_SLOT;
+}
+
 // Visitor for updating root pointers and to-space pointers.
 // It does not expect to encounter pointers to dead objects.
 // TODO(ulan): Remove code object specific functions. This visitor
@@ -2842,31 +2961,61 @@ static inline SlotCallbackResult UpdateSlot(Object** slot) {
 class PointersUpdatingVisitor : public ObjectVisitor, public RootVisitor {
  public:
   void VisitPointer(HeapObject* host, Object** p) override {
+    UpdateStrongSlotInternal(p);
+  }
+
+  void VisitPointer(HeapObject* host, MaybeObject** p) override {
     UpdateSlotInternal(p);
   }
 
   void VisitPointers(HeapObject* host, Object** start, Object** end) override {
-    for (Object** p = start; p < end; p++) UpdateSlotInternal(p);
+    for (Object** p = start; p < end; p++) {
+      UpdateStrongSlotInternal(p);
+    }
   }
 
-  void VisitRootPointer(Root root, Object** p) override {
-    UpdateSlotInternal(p);
+  void VisitPointers(HeapObject* host, MaybeObject** start,
+                     MaybeObject** end) final {
+    for (MaybeObject** p = start; p < end; p++) {
+      UpdateSlotInternal(p);
+    }
+  }
+
+  void VisitRootPointer(Root root, const char* description,
+                        Object** p) override {
+    UpdateStrongSlotInternal(p);
   }
 
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
-    for (Object** p = start; p < end; p++) UpdateSlotInternal(p);
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {
+    for (Object** p = start; p < end; p++) UpdateStrongSlotInternal(p);
   }
 
   void VisitEmbeddedPointer(Code* host, RelocInfo* rinfo) override {
-    UpdateTypedSlotHelper::UpdateEmbeddedPointer(rinfo, UpdateSlotInternal);
+    UpdateTypedSlotHelper::UpdateEmbeddedPointer(
+        rinfo, UpdateStrongMaybeObjectSlotInternal);
   }
 
   void VisitCodeTarget(Code* host, RelocInfo* rinfo) override {
-    UpdateTypedSlotHelper::UpdateCodeTarget(rinfo, UpdateSlotInternal);
+    UpdateTypedSlotHelper::UpdateCodeTarget(
+        rinfo, UpdateStrongMaybeObjectSlotInternal);
   }
 
  private:
-  static inline SlotCallbackResult UpdateSlotInternal(Object** slot) {
+  static inline SlotCallbackResult UpdateStrongMaybeObjectSlotInternal(
+      MaybeObject** slot) {
+    DCHECK(!(*slot)->IsWeakHeapObject());
+    DCHECK(!(*slot)->IsClearedWeakHeapObject());
+    return UpdateStrongSlotInternal(reinterpret_cast<Object**>(slot));
+  }
+
+  static inline SlotCallbackResult UpdateStrongSlotInternal(Object** slot) {
+    DCHECK(!HasWeakHeapObjectTag(*slot));
+    return UpdateStrongSlot<AccessMode::NON_ATOMIC>(
+        reinterpret_cast<MaybeObject**>(slot));
+  }
+
+  static inline SlotCallbackResult UpdateSlotInternal(MaybeObject** slot) {
     return UpdateSlot<AccessMode::NON_ATOMIC>(slot);
   }
 };
@@ -3009,6 +3158,7 @@ class Evacuator : public Malloced {
 };
 
 void Evacuator::EvacuatePage(Page* page) {
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"), "Evacuator::EvacuatePage");
   DCHECK(page->SweepingDone());
   intptr_t saved_live_bytes = 0;
   double evacuation_time = 0.0;
@@ -3066,11 +3216,15 @@ class FullEvacuator : public Evacuator {
 };
 
 void FullEvacuator::RawEvacuatePage(Page* page, intptr_t* live_bytes) {
+  const EvacuationMode evacuation_mode = ComputeEvacuationMode(page);
+  TRACE_EVENT1(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+               "FullEvacuator::RawEvacuatePage", "evacuation_mode",
+               evacuation_mode);
   MarkCompactCollector::NonAtomicMarkingState* marking_state =
       collector_->non_atomic_marking_state();
   *live_bytes = marking_state->live_bytes(page);
   HeapObject* failed_object = nullptr;
-  switch (ComputeEvacuationMode(page)) {
+  switch (evacuation_mode) {
     case kObjectsNewToOld:
       LiveObjectVisitor::VisitBlackObjectsNoFail(
           page, marking_state, &new_space_visitor_,
@@ -3127,6 +3281,8 @@ class YoungGenerationEvacuator : public Evacuator {
 
 void YoungGenerationEvacuator::RawEvacuatePage(Page* page,
                                                intptr_t* live_bytes) {
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+               "YoungGenerationEvacuator::RawEvacuatePage");
   MinorMarkCompactCollector::NonAtomicMarkingState* marking_state =
       collector_->non_atomic_marking_state();
   *live_bytes = marking_state->live_bytes(page);
@@ -3241,7 +3397,7 @@ void MarkCompactCollectorBase::CreateAndExecuteEvacuationTasks(
       evacuators[i]->AddObserver(migration_observer);
     job->AddTask(new PageEvacuationTask(heap()->isolate(), evacuators[i]));
   }
-  job->Run();
+  job->Run(isolate()->async_counters());
   for (int i = 0; i < wanted_num_tasks; i++) {
     evacuators[i]->Finalize();
     delete evacuators[i];
@@ -3251,12 +3407,12 @@ void MarkCompactCollectorBase::CreateAndExecuteEvacuationTasks(
   if (FLAG_trace_evacuation) {
     PrintIsolate(isolate(),
                  "%8.0f ms: evacuation-summary: parallel=%s pages=%d "
-                 "wanted_tasks=%d tasks=%d cores=%" PRIuS
-                 " live_bytes=%" V8PRIdPTR " compaction_speed=%.f\n",
+                 "wanted_tasks=%d tasks=%d cores=%d live_bytes=%" V8PRIdPTR
+                 " compaction_speed=%.f\n",
                  isolate()->time_millis_since_init(),
                  FLAG_parallel_compaction ? "yes" : "no", job->NumberOfItems(),
                  wanted_num_tasks, job->NumberOfTasks(),
-                 V8::GetCurrentPlatform()->NumberOfAvailableBackgroundThreads(),
+                 V8::GetCurrentPlatform()->NumberOfWorkerThreads() + 1,
                  live_bytes, compaction_speed);
   }
 }
@@ -3365,6 +3521,8 @@ bool LiveObjectVisitor::VisitBlackObjects(MemoryChunk* chunk,
                                           Visitor* visitor,
                                           IterationMode iteration_mode,
                                           HeapObject** failed_object) {
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+               "LiveObjectVisitor::VisitBlackObjects");
   for (auto object_and_size :
        LiveObjectRange<kBlackObjects>(chunk, marking_state->bitmap(chunk))) {
     HeapObject* const object = object_and_size.first;
@@ -3389,6 +3547,8 @@ void LiveObjectVisitor::VisitBlackObjectsNoFail(MemoryChunk* chunk,
                                                 MarkingState* marking_state,
                                                 Visitor* visitor,
                                                 IterationMode iteration_mode) {
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+               "LiveObjectVisitor::VisitBlackObjectsNoFail");
   for (auto object_and_size :
        LiveObjectRange<kBlackObjects>(chunk, marking_state->bitmap(chunk))) {
     HeapObject* const object = object_and_size.first;
@@ -3407,6 +3567,8 @@ void LiveObjectVisitor::VisitGreyObjectsNoFail(MemoryChunk* chunk,
                                                MarkingState* marking_state,
                                                Visitor* visitor,
                                                IterationMode iteration_mode) {
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+               "LiveObjectVisitor::VisitGreyObjectsNoFail");
   for (auto object_and_size :
        LiveObjectRange<kGreyObjects>(chunk, marking_state->bitmap(chunk))) {
     HeapObject* const object = object_and_size.first;
@@ -3451,7 +3613,7 @@ void MarkCompactCollector::Evacuate() {
   {
     TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_EVACUATE_REBALANCE);
     if (!heap()->new_space()->Rebalance()) {
-      FatalProcessOutOfMemory("NewSpace::Rebalance");
+      heap()->FatalProcessOutOfMemory("NewSpace::Rebalance");
     }
   }
 
@@ -3553,17 +3715,21 @@ class ToSpaceUpdatingItem : public UpdatingItem {
 
  private:
   void ProcessVisitAll() {
+    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+                 "ToSpaceUpdatingItem::ProcessVisitAll");
     PointersUpdatingVisitor visitor;
     for (Address cur = start_; cur < end_;) {
       HeapObject* object = HeapObject::FromAddress(cur);
       Map* map = object->map();
       int size = object->SizeFromMap(map);
-      object->IterateBody(map->instance_type(), size, &visitor);
+      object->IterateBodyFast(map, size, &visitor);
       cur += size;
     }
   }
 
   void ProcessVisitLive() {
+    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+                 "ToSpaceUpdatingItem::ProcessVisitLive");
     // For young generation evacuations we want to visit grey objects, for
     // full MC, we need to visit black objects.
     PointersUpdatingVisitor visitor;
@@ -3592,42 +3758,43 @@ class RememberedSetUpdatingItem : public UpdatingItem {
   virtual ~RememberedSetUpdatingItem() {}
 
   void Process() override {
+    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+                 "RememberedSetUpdatingItem::Process");
     base::LockGuard<base::Mutex> guard(chunk_->mutex());
     UpdateUntypedPointers();
     UpdateTypedPointers();
   }
 
  private:
-  template <AccessMode access_mode>
   inline SlotCallbackResult CheckAndUpdateOldToNewSlot(Address slot_address) {
-    Object** slot = reinterpret_cast<Object**>(slot_address);
-    if (heap_->InFromSpace(*slot)) {
-      HeapObject* heap_object = reinterpret_cast<HeapObject*>(*slot);
-      DCHECK(heap_object->IsHeapObject());
+    MaybeObject** slot = reinterpret_cast<MaybeObject**>(slot_address);
+    HeapObject* heap_object;
+    if (!(*slot)->ToStrongOrWeakHeapObject(&heap_object)) {
+      return REMOVE_SLOT;
+    }
+    if (heap_->InFromSpace(heap_object)) {
       MapWord map_word = heap_object->map_word();
       if (map_word.IsForwardingAddress()) {
-        if (access_mode == AccessMode::ATOMIC) {
-          HeapObject** heap_obj_slot = reinterpret_cast<HeapObject**>(slot);
-          base::AsAtomicPointer::Relaxed_Store(heap_obj_slot,
-                                               map_word.ToForwardingAddress());
-        } else {
-          *slot = map_word.ToForwardingAddress();
-        }
+        HeapObjectReference::Update(
+            reinterpret_cast<HeapObjectReference**>(slot),
+            map_word.ToForwardingAddress());
       }
+      bool success = (*slot)->ToStrongOrWeakHeapObject(&heap_object);
+      USE(success);
+      DCHECK(success);
       // If the object was in from space before and is after executing the
       // callback in to space, the object is still live.
       // Unfortunately, we do not know about the slot. It could be in a
       // just freed free space object.
-      if (heap_->InToSpace(*slot)) {
+      if (heap_->InToSpace(heap_object)) {
         return KEEP_SLOT;
       }
-    } else if (heap_->InToSpace(*slot)) {
+    } else if (heap_->InToSpace(heap_object)) {
       // Slots can point to "to" space if the page has been moved, or if the
       // slot has been recorded multiple times in the remembered set, or
       // if the slot was already updated during old->old updating.
       // In case the page has been moved, check markbits to determine liveness
       // of the slot. In the other case, the slot can just be kept.
-      HeapObject* heap_object = reinterpret_cast<HeapObject*>(*slot);
       if (Page::FromAddress(heap_object->address())
               ->IsFlagSet(Page::PAGE_NEW_NEW_PROMOTION)) {
         // IsBlackOrGrey is required because objects are marked as grey for
@@ -3641,19 +3808,17 @@ class RememberedSetUpdatingItem : public UpdatingItem {
       }
       return KEEP_SLOT;
     } else {
-      DCHECK(!heap_->InNewSpace(*slot));
+      DCHECK(!heap_->InNewSpace(heap_object));
     }
     return REMOVE_SLOT;
   }
 
   void UpdateUntypedPointers() {
     if (chunk_->slot_set<OLD_TO_NEW, AccessMode::NON_ATOMIC>() != nullptr) {
-        RememberedSet<OLD_TO_NEW>::Iterate(
-            chunk_,
-            [this](Address slot) {
-              return CheckAndUpdateOldToNewSlot<AccessMode::NON_ATOMIC>(slot);
-            },
-            SlotSet::PREFREE_EMPTY_BUCKETS);
+      RememberedSet<OLD_TO_NEW>::Iterate(
+          chunk_,
+          [this](Address slot) { return CheckAndUpdateOldToNewSlot(slot); },
+          SlotSet::PREFREE_EMPTY_BUCKETS);
     }
     if ((updating_mode_ == RememberedSetUpdatingMode::ALL) &&
         (chunk_->slot_set<OLD_TO_OLD, AccessMode::NON_ATOMIC>() != nullptr)) {
@@ -3663,7 +3828,7 @@ class RememberedSetUpdatingItem : public UpdatingItem {
           [&filter](Address slot) {
             if (!filter.IsValid(slot)) return REMOVE_SLOT;
             return UpdateSlot<AccessMode::NON_ATOMIC>(
-                reinterpret_cast<Object**>(slot));
+                reinterpret_cast<MaybeObject**>(slot));
           },
           SlotSet::PREFREE_EMPTY_BUCKETS);
     }
@@ -3691,8 +3856,8 @@ class RememberedSetUpdatingItem : public UpdatingItem {
           chunk_,
           [isolate, this](SlotType slot_type, Address host_addr, Address slot) {
             return UpdateTypedSlotHelper::UpdateTypedSlot(
-                isolate, slot_type, slot, [this](Object** slot) {
-                  return CheckAndUpdateOldToNewSlot<AccessMode::NON_ATOMIC>(
+                isolate, slot_type, slot, [this](MaybeObject** slot) {
+                  return CheckAndUpdateOldToNewSlot(
                       reinterpret_cast<Address>(slot));
                 });
           });
@@ -3704,8 +3869,11 @@ class RememberedSetUpdatingItem : public UpdatingItem {
       RememberedSet<OLD_TO_OLD>::IterateTyped(
           chunk_,
           [isolate](SlotType slot_type, Address host_addr, Address slot) {
+            // Using UpdateStrongSlot is OK here, because there are no weak
+            // typed slots.
             return UpdateTypedSlotHelper::UpdateTypedSlot(
-                isolate, slot_type, slot, UpdateSlot<AccessMode::NON_ATOMIC>);
+                isolate, slot_type, slot,
+                UpdateStrongSlot<AccessMode::NON_ATOMIC>);
           });
     }
   }
@@ -3748,6 +3916,8 @@ class GlobalHandlesUpdatingItem : public UpdatingItem {
   virtual ~GlobalHandlesUpdatingItem() {}
 
   void Process() override {
+    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+                 "GlobalHandlesUpdatingItem::Process");
     PointersUpdatingVisitor updating_visitor;
     global_handles_->IterateNewSpaceRoots(&updating_visitor, start_, end_);
   }
@@ -3772,6 +3942,9 @@ class ArrayBufferTrackerUpdatingItem : public UpdatingItem {
   virtual ~ArrayBufferTrackerUpdatingItem() {}
 
   void Process() override {
+    TRACE_EVENT1(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
+                 "ArrayBufferTrackerUpdatingItem::Process", "EvacuationState",
+                 state_);
     switch (state_) {
       case EvacuationState::kRegular:
         ArrayBufferTracker::ProcessBuffers(
@@ -3922,7 +4095,7 @@ void MarkCompactCollector::UpdatePointersAfterEvacuation() {
           isolate(),
           GCTracer::BackgroundScope::MC_BACKGROUND_EVACUATE_UPDATE_POINTERS));
     }
-    updating_job.Run();
+    updating_job.Run(isolate()->async_counters());
   }
 
   {
@@ -3954,7 +4127,7 @@ void MarkCompactCollector::UpdatePointersAfterEvacuation() {
             isolate(),
             GCTracer::BackgroundScope::MC_BACKGROUND_EVACUATE_UPDATE_POINTERS));
       }
-      updating_job.Run();
+      updating_job.Run(isolate()->async_counters());
       heap()->array_buffer_collector()->FreeAllocationsOnBackgroundThread();
     }
   }
@@ -4016,7 +4189,7 @@ void MinorMarkCompactCollector::UpdatePointersAfterEvacuation() {
   {
     TRACE_GC(heap()->tracer(),
              GCTracer::Scope::MINOR_MC_EVACUATE_UPDATE_POINTERS_SLOTS);
-    updating_job.Run();
+    updating_job.Run(isolate()->async_counters());
     heap()->array_buffer_collector()->FreeAllocationsOnBackgroundThread();
   }
 
diff --git a/deps/v8/src/heap/mark-compact.h b/deps/v8/src/heap/mark-compact.h
index 6fda00633c3..42c222c387b 100644
--- a/deps/v8/src/heap/mark-compact.h
+++ b/deps/v8/src/heap/mark-compact.h
@@ -8,6 +8,7 @@
 #include <deque>
 #include <vector>
 
+#include "src/heap/concurrent-marking.h"
 #include "src/heap/marking.h"
 #include "src/heap/objects-visiting.h"
 #include "src/heap/spaces.h"
@@ -494,6 +495,10 @@ class MajorNonAtomicMarkingState final
 struct WeakObjects {
   Worklist<WeakCell*, 64> weak_cells;
   Worklist<TransitionArray*, 64> transition_arrays;
+  // TODO(marja): For old space, we only need the slot, not the host
+  // object. Optimize this by adding a different storage for old space.
+  Worklist<std::pair<HeapObject*, HeapObjectReference**>, 64> weak_references;
+  Worklist<std::pair<HeapObject*, Code*>, 64> weak_objects_in_code;
 };
 
 // Collector for young and old generation.
@@ -649,13 +654,20 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   // choosing spaces to compact.
   void Prepare();
 
-  void FinishConcurrentMarking();
+  // Stop concurrent marking (either by preempting it right away or waiting for
+  // it to complete as requested by |stop_request|).
+  void FinishConcurrentMarking(ConcurrentMarking::StopRequest stop_request);
 
   bool StartCompaction();
 
   void AbortCompaction();
 
-  static inline bool IsOnEvacuationCandidate(HeapObject* obj) {
+  static inline bool IsOnEvacuationCandidate(Object* obj) {
+    return Page::FromAddress(reinterpret_cast<Address>(obj))
+        ->IsEvacuationCandidate();
+  }
+
+  static inline bool IsOnEvacuationCandidate(MaybeObject* obj) {
     return Page::FromAddress(reinterpret_cast<Address>(obj))
         ->IsEvacuationCandidate();
   }
@@ -663,6 +675,8 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   void RecordRelocSlot(Code* host, RelocInfo* rinfo, Object* target);
   V8_INLINE static void RecordSlot(HeapObject* object, Object** slot,
                                    Object* target);
+  V8_INLINE static void RecordSlot(HeapObject* object,
+                                   HeapObjectReference** slot, Object* target);
   void RecordLiveSlotsOnPage(Page* page);
 
   void UpdateSlots(SlotsBuffer* buffer);
@@ -696,6 +710,15 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
     weak_objects_.transition_arrays.Push(kMainThread, array);
   }
 
+  void AddWeakReference(HeapObject* host, HeapObjectReference** slot) {
+    weak_objects_.weak_references.Push(kMainThread, std::make_pair(host, slot));
+  }
+
+  void AddWeakObjectInCode(HeapObject* object, Code* code) {
+    weak_objects_.weak_objects_in_code.Push(kMainThread,
+                                            std::make_pair(object, code));
+  }
+
   Sweeper* sweeper() { return sweeper_; }
 
 #ifdef DEBUG
@@ -708,9 +731,9 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
 #ifdef VERIFY_HEAP
   void VerifyValidStoreAndSlotsBufferEntries();
   void VerifyMarkbitsAreClean();
+  void VerifyMarkbitsAreDirty(PagedSpace* space);
   void VerifyMarkbitsAreClean(PagedSpace* space);
   void VerifyMarkbitsAreClean(NewSpace* space);
-  void VerifyWeakEmbeddedObjectsInCode();
 #endif
 
  private:
@@ -771,7 +794,7 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   // Clear non-live references in weak cells, transition and descriptor arrays,
   // and deoptimize dependent code of non-live maps.
   void ClearNonLiveReferences() override;
-  void MarkDependentCodeForDeoptimization(DependentCode* list);
+  void MarkDependentCodeForDeoptimization();
   // Checks if the given weak cell is a simple transition from the parent map
   // of the given dead target. If so it clears the transition and trims
   // the descriptor array of the parent if needed.
@@ -804,8 +827,8 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   // dead values. If the value is a dead map and the parent map transitions to
   // the dead map via weak cell, then this function also clears the map
   // transition.
-  void ClearWeakCellsAndSimpleMapTransitions(
-      DependentCode** dependent_code_list);
+  void ClearWeakCellsAndSimpleMapTransitions();
+  void ClearWeakReferences();
   void AbortWeakObjects();
 
   // Starts sweeping of spaces by contributing on the main thread and setting
@@ -914,8 +937,11 @@ class MarkingVisitor final
 
   // ObjectVisitor implementation.
   V8_INLINE void VisitPointer(HeapObject* host, Object** p) final;
+  V8_INLINE void VisitPointer(HeapObject* host, MaybeObject** p) final;
   V8_INLINE void VisitPointers(HeapObject* host, Object** start,
                                Object** end) final;
+  V8_INLINE void VisitPointers(HeapObject* host, MaybeObject** start,
+                               MaybeObject** end) final;
   V8_INLINE void VisitEmbeddedPointer(Code* host, RelocInfo* rinfo) final;
   V8_INLINE void VisitCodeTarget(Code* host, RelocInfo* rinfo) final;
 
diff --git a/deps/v8/src/heap/marking.cc b/deps/v8/src/heap/marking.cc
index 5e631187d20..23fbdd3465a 100644
--- a/deps/v8/src/heap/marking.cc
+++ b/deps/v8/src/heap/marking.cc
@@ -17,6 +17,16 @@ void Bitmap::Clear() {
   base::SeqCst_MemoryFence();
 }
 
+void Bitmap::MarkAllBits() {
+  base::Atomic32* cell_base = reinterpret_cast<base::Atomic32*>(cells());
+  for (int i = 0; i < CellsCount(); i++) {
+    base::Relaxed_Store(cell_base + i, 0xffffffff);
+  }
+  // This fence prevents re-ordering of publishing stores with the mark-bit
+  // clearing stores.
+  base::SeqCst_MemoryFence();
+}
+
 void Bitmap::SetRange(uint32_t start_index, uint32_t end_index) {
   unsigned int start_cell_index = start_index >> Bitmap::kBitsPerCellLog2;
   MarkBit::CellType start_index_mask = 1u << Bitmap::IndexInCell(start_index);
diff --git a/deps/v8/src/heap/marking.h b/deps/v8/src/heap/marking.h
index 9b1fe61236f..bfa813091e5 100644
--- a/deps/v8/src/heap/marking.h
+++ b/deps/v8/src/heap/marking.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_MARKING_H
-#define V8_MARKING_H
+#ifndef V8_HEAP_MARKING_H_
+#define V8_HEAP_MARKING_H_
 
 #include "src/base/atomic-utils.h"
 #include "src/utils.h"
@@ -142,6 +142,8 @@ class V8_EXPORT_PRIVATE Bitmap {
 
   void Clear();
 
+  void MarkAllBits();
+
   // Clears bits in the given cell. The mask specifies bits to clear: if a
   // bit is set in the mask then the corresponding bit is cleared in the cell.
   template <AccessMode mode = AccessMode::NON_ATOMIC>
@@ -316,4 +318,4 @@ class Marking : public AllStatic {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_MARKING_H_
+#endif  // V8_HEAP_MARKING_H_
diff --git a/deps/v8/src/heap/memory-reducer.cc b/deps/v8/src/heap/memory-reducer.cc
index cc1030846a9..baa4d6c00b2 100644
--- a/deps/v8/src/heap/memory-reducer.cc
+++ b/deps/v8/src/heap/memory-reducer.cc
@@ -202,6 +202,7 @@ MemoryReducer::State MemoryReducer::Step(const State& state,
 
 void MemoryReducer::ScheduleTimer(double time_ms, double delay_ms) {
   DCHECK_LT(0, delay_ms);
+  if (heap()->IsTearingDown()) return;
   // Leave some room for precision error in task scheduler.
   const double kSlackMs = 100;
   v8::Isolate* isolate = reinterpret_cast<v8::Isolate*>(heap()->isolate());
diff --git a/deps/v8/src/heap/memory-reducer.h b/deps/v8/src/heap/memory-reducer.h
index 0f0ad6eaa06..ce6564596eb 100644
--- a/deps/v8/src/heap/memory-reducer.h
+++ b/deps/v8/src/heap/memory-reducer.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_HEAP_memory_reducer_H
-#define V8_HEAP_memory_reducer_H
+#ifndef V8_HEAP_MEMORY_REDUCER_H_
+#define V8_HEAP_MEMORY_REDUCER_H_
 
 #include "include/v8-platform.h"
 #include "src/base/macros.h"
@@ -171,4 +171,4 @@ class V8_EXPORT_PRIVATE MemoryReducer {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_HEAP_memory_reducer_H
+#endif  // V8_HEAP_MEMORY_REDUCER_H_
diff --git a/deps/v8/src/heap/object-stats.cc b/deps/v8/src/heap/object-stats.cc
index f58a4726717..008ba7879de 100644
--- a/deps/v8/src/heap/object-stats.cc
+++ b/deps/v8/src/heap/object-stats.cc
@@ -1,4 +1,5 @@
 // Copyright 2015 the V8 project authors. All rights reserved.
+//
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -12,6 +13,7 @@
 #include "src/counters.h"
 #include "src/globals.h"
 #include "src/heap/heap-inl.h"
+#include "src/heap/mark-compact.h"
 #include "src/isolate.h"
 #include "src/objects/compilation-cache-inl.h"
 #include "src/utils.h"
@@ -31,7 +33,6 @@ void ObjectStats::ClearObjectStats(bool clear_last_time_stats) {
     memset(object_counts_last_time_, 0, sizeof(object_counts_last_time_));
     memset(object_sizes_last_time_, 0, sizeof(object_sizes_last_time_));
   }
-  visited_fixed_array_sub_types_.clear();
 }
 
 // Tell the compiler to never inline this: occasionally, the optimizer will
@@ -99,23 +100,14 @@ void ObjectStats::PrintJSON(const char* key) {
 
 #define INSTANCE_TYPE_WRAPPER(name) \
   PrintInstanceTypeJSON(key, gc_count, #name, name);
-#define CODE_KIND_WRAPPER(name)                        \
-  PrintInstanceTypeJSON(key, gc_count, "*CODE_" #name, \
-                        FIRST_CODE_KIND_SUB_TYPE + Code::name);
-#define FIXED_ARRAY_SUB_INSTANCE_TYPE_WRAPPER(name)           \
-  PrintInstanceTypeJSON(key, gc_count, "*FIXED_ARRAY_" #name, \
-                        FIRST_FIXED_ARRAY_SUB_TYPE + name);
+
 #define VIRTUAL_INSTANCE_TYPE_WRAPPER(name) \
   PrintInstanceTypeJSON(key, gc_count, #name, FIRST_VIRTUAL_TYPE + name);
 
   INSTANCE_TYPE_LIST(INSTANCE_TYPE_WRAPPER)
-  CODE_KIND_LIST(CODE_KIND_WRAPPER)
-  FIXED_ARRAY_SUB_INSTANCE_TYPE_LIST(FIXED_ARRAY_SUB_INSTANCE_TYPE_WRAPPER)
   VIRTUAL_INSTANCE_TYPE_LIST(VIRTUAL_INSTANCE_TYPE_WRAPPER)
 
 #undef INSTANCE_TYPE_WRAPPER
-#undef CODE_KIND_WRAPPER
-#undef FIXED_ARRAY_SUB_INSTANCE_TYPE_WRAPPER
 #undef VIRTUAL_INSTANCE_TYPE_WRAPPER
 }
 
@@ -150,25 +142,15 @@ void ObjectStats::Dump(std::stringstream& stream) {
   stream << "\"type_data\":{";
 
 #define INSTANCE_TYPE_WRAPPER(name) DumpInstanceTypeData(stream, #name, name);
-#define CODE_KIND_WRAPPER(name)                \
-  DumpInstanceTypeData(stream, "*CODE_" #name, \
-                       FIRST_CODE_KIND_SUB_TYPE + Code::name);
 
-#define FIXED_ARRAY_SUB_INSTANCE_TYPE_WRAPPER(name)   \
-  DumpInstanceTypeData(stream, "*FIXED_ARRAY_" #name, \
-                       FIRST_FIXED_ARRAY_SUB_TYPE + name);
 #define VIRTUAL_INSTANCE_TYPE_WRAPPER(name) \
   DumpInstanceTypeData(stream, #name, FIRST_VIRTUAL_TYPE + name);
 
   INSTANCE_TYPE_LIST(INSTANCE_TYPE_WRAPPER);
-  CODE_KIND_LIST(CODE_KIND_WRAPPER);
-  FIXED_ARRAY_SUB_INSTANCE_TYPE_LIST(FIXED_ARRAY_SUB_INSTANCE_TYPE_WRAPPER);
   VIRTUAL_INSTANCE_TYPE_LIST(VIRTUAL_INSTANCE_TYPE_WRAPPER)
   stream << "\"END\":{}}}";
 
 #undef INSTANCE_TYPE_WRAPPER
-#undef CODE_KIND_WRAPPER
-#undef FIXED_ARRAY_SUB_INSTANCE_TYPE_WRAPPER
 #undef VIRTUAL_INSTANCE_TYPE_WRAPPER
 }
 
@@ -202,93 +184,88 @@ void ObjectStats::RecordObjectStats(InstanceType type, size_t size) {
 }
 
 void ObjectStats::RecordVirtualObjectStats(VirtualInstanceType type,
-                                           size_t size) {
+                                           size_t size, size_t over_allocated) {
   DCHECK_LE(type, LAST_VIRTUAL_TYPE);
   object_counts_[FIRST_VIRTUAL_TYPE + type]++;
   object_sizes_[FIRST_VIRTUAL_TYPE + type] += size;
   size_histogram_[FIRST_VIRTUAL_TYPE + type][HistogramIndexFromSize(size)]++;
-}
-
-void ObjectStats::RecordCodeSubTypeStats(int code_sub_type, size_t size) {
-  int code_sub_type_index = FIRST_CODE_KIND_SUB_TYPE + code_sub_type;
-  DCHECK_GE(code_sub_type_index, FIRST_CODE_KIND_SUB_TYPE);
-  DCHECK_LT(code_sub_type_index, FIRST_FIXED_ARRAY_SUB_TYPE);
-  object_counts_[code_sub_type_index]++;
-  object_sizes_[code_sub_type_index] += size;
-  size_histogram_[code_sub_type_index][HistogramIndexFromSize(size)]++;
-}
-
-bool ObjectStats::RecordFixedArraySubTypeStats(FixedArrayBase* array,
-                                               int array_sub_type, size_t size,
-                                               size_t over_allocated) {
-  auto it = visited_fixed_array_sub_types_.insert(array);
-  if (!it.second) return false;
-  DCHECK_LE(array_sub_type, LAST_FIXED_ARRAY_SUB_TYPE);
-  object_counts_[FIRST_FIXED_ARRAY_SUB_TYPE + array_sub_type]++;
-  object_sizes_[FIRST_FIXED_ARRAY_SUB_TYPE + array_sub_type] += size;
-  size_histogram_[FIRST_FIXED_ARRAY_SUB_TYPE + array_sub_type]
-                 [HistogramIndexFromSize(size)]++;
-  if (over_allocated > 0) {
-    InstanceType type =
-        array->IsHashTable() ? HASH_TABLE_TYPE : FIXED_ARRAY_TYPE;
-    over_allocated_[FIRST_FIXED_ARRAY_SUB_TYPE + array_sub_type] +=
-        over_allocated;
-    over_allocated_histogram_[FIRST_FIXED_ARRAY_SUB_TYPE + array_sub_type]
-                             [HistogramIndexFromSize(over_allocated)]++;
-    over_allocated_[type] += over_allocated;
-    over_allocated_histogram_[type][HistogramIndexFromSize(over_allocated)]++;
-  }
-  return true;
+  over_allocated_[FIRST_VIRTUAL_TYPE + type] += over_allocated;
+  over_allocated_histogram_[FIRST_VIRTUAL_TYPE + type]
+                           [HistogramIndexFromSize(size)]++;
 }
 
 Isolate* ObjectStats::isolate() { return heap()->isolate(); }
 
 class ObjectStatsCollectorImpl {
  public:
+  enum Phase {
+    kPhase1,
+    kPhase2,
+  };
+  static const int kNumberOfPhases = kPhase2 + 1;
+
   ObjectStatsCollectorImpl(Heap* heap, ObjectStats* stats);
 
   void CollectGlobalStatistics();
+  void CollectStatistics(HeapObject* obj, Phase phase);
 
-  // Collects statistics of objects for virtual instance types.
-  void CollectVirtualStatistics(HeapObject* obj);
+ private:
+  enum CowMode {
+    kCheckCow,
+    kIgnoreCow,
+  };
 
-  // Collects statistics of objects for regular instance types.
-  void CollectStatistics(HeapObject* obj);
+  Isolate* isolate() { return heap_->isolate(); }
 
- private:
-  class CompilationCacheTableVisitor;
+  bool RecordVirtualObjectStats(HeapObject* parent, HeapObject* obj,
+                                ObjectStats::VirtualInstanceType type,
+                                size_t size, size_t over_allocated,
+                                CowMode check_cow_array = kCheckCow);
+  // Gets size from |ob| and assumes no over allocating.
+  bool RecordSimpleVirtualObjectStats(HeapObject* parent, HeapObject* obj,
+                                      ObjectStats::VirtualInstanceType type);
+  // For HashTable it is possible to compute over allocated memory.
+  void RecordHashTableVirtualObjectStats(HeapObject* parent,
+                                         FixedArray* hash_table,
+                                         ObjectStats::VirtualInstanceType type);
 
-  void RecordObjectStats(HeapObject* obj, InstanceType type, size_t size);
-  void RecordBytecodeArrayDetails(BytecodeArray* obj);
-  void RecordCodeDetails(Code* code);
-  void RecordFixedArrayDetails(FixedArray* array);
-  void RecordJSCollectionDetails(JSObject* obj);
-  void RecordJSObjectDetails(JSObject* object);
-  void RecordJSWeakCollectionDetails(JSWeakCollection* obj);
-  void RecordMapDetails(Map* map);
-  void RecordScriptDetails(Script* obj);
-  void RecordTemplateInfoDetails(TemplateInfo* obj);
-  void RecordSharedFunctionInfoDetails(SharedFunctionInfo* sfi);
-
-  bool RecordFixedArrayHelper(HeapObject* parent, FixedArray* array,
-                              int subtype, size_t overhead);
-  void RecursivelyRecordFixedArrayHelper(HeapObject* parent, FixedArray* array,
-                                         int subtype);
-  template <class HashTable>
-  void RecordHashTableHelper(HeapObject* parent, HashTable* array, int subtype);
   bool SameLiveness(HeapObject* obj1, HeapObject* obj2);
+  bool CanRecordFixedArray(FixedArrayBase* array);
+  bool IsCowArray(FixedArrayBase* array);
 
-  void RecordVirtualObjectStats(HeapObject* obj,
-                                ObjectStats::VirtualInstanceType type,
-                                size_t size);
+  // Blacklist for objects that should not be recorded using
+  // VirtualObjectStats and RecordSimpleVirtualObjectStats. For recording those
+  // objects dispatch to the low level ObjectStats::RecordObjectStats manually.
+  bool ShouldRecordObject(HeapObject* object, CowMode check_cow_array);
+
+  void RecordObjectStats(HeapObject* obj, InstanceType type, size_t size);
+
+  // Specific recursion into constant pool or embedded code objects. Records
+  // FixedArrays and Tuple2 that look like ConstantElementsPair.
+  void RecordVirtualObjectsForConstantPoolOrEmbeddedObjects(
+      HeapObject* parent, HeapObject* object,
+      ObjectStats::VirtualInstanceType type);
+
+  // Details.
   void RecordVirtualAllocationSiteDetails(AllocationSite* site);
+  void RecordVirtualBytecodeArrayDetails(BytecodeArray* bytecode);
+  void RecordVirtualCodeDetails(Code* code);
+  void RecordVirtualContext(Context* context);
+  void RecordVirtualFeedbackVectorDetails(FeedbackVector* vector);
+  void RecordVirtualFixedArrayDetails(FixedArray* array);
+  void RecordVirtualFunctionTemplateInfoDetails(FunctionTemplateInfo* fti);
+  void RecordVirtualJSGlobalObjectDetails(JSGlobalObject* object);
+  void RecordVirtualJSCollectionDetails(JSObject* object);
+  void RecordVirtualJSObjectDetails(JSObject* object);
+  void RecordVirtualMapDetails(Map* map);
+  void RecordVirtualScriptDetails(Script* script);
+  void RecordVirtualSharedFunctionInfoDetails(SharedFunctionInfo* info);
+  void RecordVirtualJSFunctionDetails(JSFunction* function);
 
   Heap* heap_;
   ObjectStats* stats_;
   MarkCompactCollector::NonAtomicMarkingState* marking_state_;
   std::unordered_set<HeapObject*> virtual_objects_;
-
-  friend class ObjectStatsCollectorImpl::CompilationCacheTableVisitor;
 };
 
 ObjectStatsCollectorImpl::ObjectStatsCollectorImpl(Heap* heap,
@@ -298,18 +275,45 @@ ObjectStatsCollectorImpl::ObjectStatsCollectorImpl(Heap* heap,
       marking_state_(
           heap->mark_compact_collector()->non_atomic_marking_state()) {}
 
-// For entries which shared the same instance type (historically FixedArrays)
-// we do a pre-pass and create virtual instance types.
-void ObjectStatsCollectorImpl::CollectVirtualStatistics(HeapObject* obj) {
-  if (obj->IsAllocationSite()) {
-    RecordVirtualAllocationSiteDetails(AllocationSite::cast(obj));
+bool ObjectStatsCollectorImpl::ShouldRecordObject(HeapObject* obj,
+                                                  CowMode check_cow_array) {
+  if (obj->IsFixedArrayExact()) {
+    FixedArray* fixed_array = FixedArray::cast(obj);
+    bool cow_check = check_cow_array == kIgnoreCow || !IsCowArray(fixed_array);
+    return CanRecordFixedArray(fixed_array) && cow_check;
   }
+  if (obj == heap_->empty_property_array()) return false;
+  return true;
+}
+
+void ObjectStatsCollectorImpl::RecordHashTableVirtualObjectStats(
+    HeapObject* parent, FixedArray* hash_table,
+    ObjectStats::VirtualInstanceType type) {
+  CHECK(hash_table->IsHashTable());
+  // TODO(mlippautz): Implement over allocation for hash tables.
+  RecordVirtualObjectStats(parent, hash_table, type, hash_table->Size(),
+                           ObjectStats::kNoOverAllocation);
 }
 
-void ObjectStatsCollectorImpl::RecordVirtualObjectStats(
-    HeapObject* obj, ObjectStats::VirtualInstanceType type, size_t size) {
-  virtual_objects_.insert(obj);
-  stats_->RecordVirtualObjectStats(type, size);
+bool ObjectStatsCollectorImpl::RecordSimpleVirtualObjectStats(
+    HeapObject* parent, HeapObject* obj,
+    ObjectStats::VirtualInstanceType type) {
+  return RecordVirtualObjectStats(parent, obj, type, obj->Size(),
+                                  ObjectStats::kNoOverAllocation, kCheckCow);
+}
+
+bool ObjectStatsCollectorImpl::RecordVirtualObjectStats(
+    HeapObject* parent, HeapObject* obj, ObjectStats::VirtualInstanceType type,
+    size_t size, size_t over_allocated, CowMode check_cow_array) {
+  if (!SameLiveness(parent, obj) || !ShouldRecordObject(obj, check_cow_array))
+    return false;
+
+  if (virtual_objects_.find(obj) == virtual_objects_.end()) {
+    virtual_objects_.insert(obj);
+    stats_->RecordVirtualObjectStats(type, size, over_allocated);
+    return true;
+  }
+  return false;
 }
 
 void ObjectStatsCollectorImpl::RecordVirtualAllocationSiteDetails(
@@ -317,141 +321,284 @@ void ObjectStatsCollectorImpl::RecordVirtualAllocationSiteDetails(
   if (!site->PointsToLiteral()) return;
   JSObject* boilerplate = site->boilerplate();
   if (boilerplate->IsJSArray()) {
-    RecordVirtualObjectStats(boilerplate,
-                             ObjectStats::JS_ARRAY_BOILERPLATE_TYPE,
-                             boilerplate->Size());
+    RecordSimpleVirtualObjectStats(site, boilerplate,
+                                   ObjectStats::JS_ARRAY_BOILERPLATE_TYPE);
     // Array boilerplates cannot have properties.
   } else {
-    RecordVirtualObjectStats(boilerplate,
-                             ObjectStats::JS_OBJECT_BOILERPLATE_TYPE,
-                             boilerplate->Size());
+    RecordVirtualObjectStats(
+        site, boilerplate, ObjectStats::JS_OBJECT_BOILERPLATE_TYPE,
+        boilerplate->Size(), ObjectStats::kNoOverAllocation);
     if (boilerplate->HasFastProperties()) {
-      // We'll misclassify the empty_proeprty_array here. Given that there is a
-      // single instance, this is neglible.
+      // We'll mis-classify the empty_property_array here. Given that there is a
+      // single instance, this is negligible.
       PropertyArray* properties = boilerplate->property_array();
-      RecordVirtualObjectStats(properties,
-                               ObjectStats::BOILERPLATE_PROPERTY_ARRAY_TYPE,
-                               properties->Size());
+      RecordSimpleVirtualObjectStats(
+          site, properties, ObjectStats::BOILERPLATE_PROPERTY_ARRAY_TYPE);
     } else {
       NameDictionary* properties = boilerplate->property_dictionary();
-      RecordVirtualObjectStats(properties,
-                               ObjectStats::BOILERPLATE_NAME_DICTIONARY_TYPE,
-                               properties->Size());
+      RecordSimpleVirtualObjectStats(
+          site, properties, ObjectStats::BOILERPLATE_PROPERTY_DICTIONARY_TYPE);
     }
   }
   FixedArrayBase* elements = boilerplate->elements();
-  // We skip COW elements since they are shared, and we are sure that if the
-  // boilerplate exists there must have been at least one instantiation.
-  if (!elements->IsCowArray()) {
-    RecordVirtualObjectStats(elements, ObjectStats::BOILERPLATE_ELEMENTS_TYPE,
-                             elements->Size());
-  }
+  RecordSimpleVirtualObjectStats(site, elements,
+                                 ObjectStats::BOILERPLATE_ELEMENTS_TYPE);
 }
 
-void ObjectStatsCollectorImpl::CollectStatistics(HeapObject* obj) {
-  Map* map = obj->map();
-
-  // Record for the InstanceType.
-  int object_size = obj->Size();
-  RecordObjectStats(obj, map->instance_type(), object_size);
-
-  // Record specific sub types where possible.
-  if (obj->IsMap()) RecordMapDetails(Map::cast(obj));
-  if (obj->IsObjectTemplateInfo() || obj->IsFunctionTemplateInfo()) {
-    RecordTemplateInfoDetails(TemplateInfo::cast(obj));
+void ObjectStatsCollectorImpl::RecordVirtualFunctionTemplateInfoDetails(
+    FunctionTemplateInfo* fti) {
+  // named_property_handler and indexed_property_handler are recorded as
+  // INTERCEPTOR_INFO_TYPE.
+  if (!fti->call_code()->IsUndefined(isolate())) {
+    RecordSimpleVirtualObjectStats(
+        fti, CallHandlerInfo::cast(fti->call_code()),
+        ObjectStats::FUNCTION_TEMPLATE_INFO_ENTRIES_TYPE);
   }
-  if (obj->IsBytecodeArray()) {
-    RecordBytecodeArrayDetails(BytecodeArray::cast(obj));
+  if (!fti->instance_call_handler()->IsUndefined(isolate())) {
+    RecordSimpleVirtualObjectStats(
+        fti, CallHandlerInfo::cast(fti->instance_call_handler()),
+        ObjectStats::FUNCTION_TEMPLATE_INFO_ENTRIES_TYPE);
   }
-  if (obj->IsCode()) RecordCodeDetails(Code::cast(obj));
-  if (obj->IsSharedFunctionInfo()) {
-    RecordSharedFunctionInfoDetails(SharedFunctionInfo::cast(obj));
+}
+
+void ObjectStatsCollectorImpl::RecordVirtualJSGlobalObjectDetails(
+    JSGlobalObject* object) {
+  // Properties.
+  GlobalDictionary* properties = object->global_dictionary();
+  RecordHashTableVirtualObjectStats(object, properties,
+                                    ObjectStats::GLOBAL_PROPERTIES_TYPE);
+  // Elements.
+  FixedArrayBase* elements = object->elements();
+  RecordSimpleVirtualObjectStats(object, elements,
+                                 ObjectStats::GLOBAL_ELEMENTS_TYPE);
+}
+
+void ObjectStatsCollectorImpl::RecordVirtualJSCollectionDetails(
+    JSObject* object) {
+  if (object->IsJSMap()) {
+    RecordSimpleVirtualObjectStats(
+        object, FixedArray::cast(JSMap::cast(object)->table()),
+        ObjectStats::JS_COLLETION_TABLE_TYPE);
   }
-  if (obj->IsFixedArray()) RecordFixedArrayDetails(FixedArray::cast(obj));
-  if (obj->IsJSObject()) RecordJSObjectDetails(JSObject::cast(obj));
-  if (obj->IsJSWeakCollection()) {
-    RecordJSWeakCollectionDetails(JSWeakCollection::cast(obj));
+  if (object->IsJSSet()) {
+    RecordSimpleVirtualObjectStats(
+        object, FixedArray::cast(JSSet::cast(object)->table()),
+        ObjectStats::JS_COLLETION_TABLE_TYPE);
   }
-  if (obj->IsJSCollection()) {
-    RecordJSCollectionDetails(JSObject::cast(obj));
+}
+
+void ObjectStatsCollectorImpl::RecordVirtualJSObjectDetails(JSObject* object) {
+  // JSGlobalObject is recorded separately.
+  if (object->IsJSGlobalObject()) return;
+
+  // Properties.
+  if (object->HasFastProperties()) {
+    PropertyArray* properties = object->property_array();
+    CHECK_EQ(PROPERTY_ARRAY_TYPE, properties->map()->instance_type());
+  } else {
+    NameDictionary* properties = object->property_dictionary();
+    RecordHashTableVirtualObjectStats(
+        object, properties, ObjectStats::OBJECT_PROPERTY_DICTIONARY_TYPE);
   }
-  if (obj->IsScript()) RecordScriptDetails(Script::cast(obj));
+  // Elements.
+  FixedArrayBase* elements = object->elements();
+  RecordSimpleVirtualObjectStats(object, elements, ObjectStats::ELEMENTS_TYPE);
 }
 
-class ObjectStatsCollectorImpl::CompilationCacheTableVisitor
-    : public RootVisitor {
- public:
-  explicit CompilationCacheTableVisitor(ObjectStatsCollectorImpl* parent)
-      : parent_(parent) {}
-
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
-    for (Object** current = start; current < end; current++) {
-      HeapObject* obj = HeapObject::cast(*current);
-      if (obj->IsUndefined(parent_->heap_->isolate())) continue;
-      CHECK(obj->IsCompilationCacheTable());
-      parent_->RecordHashTableHelper(nullptr, CompilationCacheTable::cast(obj),
-                                     COMPILATION_CACHE_TABLE_SUB_TYPE);
+static ObjectStats::VirtualInstanceType GetFeedbackSlotType(
+    Object* obj, FeedbackSlotKind kind, Isolate* isolate) {
+  switch (kind) {
+    case FeedbackSlotKind::kCall:
+      if (obj == *isolate->factory()->uninitialized_symbol() ||
+          obj == *isolate->factory()->premonomorphic_symbol()) {
+        return ObjectStats::FEEDBACK_VECTOR_SLOT_CALL_UNUSED_TYPE;
+      }
+      return ObjectStats::FEEDBACK_VECTOR_SLOT_CALL_TYPE;
+
+    case FeedbackSlotKind::kLoadProperty:
+    case FeedbackSlotKind::kLoadGlobalInsideTypeof:
+    case FeedbackSlotKind::kLoadGlobalNotInsideTypeof:
+    case FeedbackSlotKind::kLoadKeyed:
+      if (obj == *isolate->factory()->uninitialized_symbol() ||
+          obj == *isolate->factory()->premonomorphic_symbol()) {
+        return ObjectStats::FEEDBACK_VECTOR_SLOT_LOAD_UNUSED_TYPE;
+      }
+      return ObjectStats::FEEDBACK_VECTOR_SLOT_LOAD_TYPE;
+
+    case FeedbackSlotKind::kStoreNamedSloppy:
+    case FeedbackSlotKind::kStoreNamedStrict:
+    case FeedbackSlotKind::kStoreOwnNamed:
+    case FeedbackSlotKind::kStoreGlobalSloppy:
+    case FeedbackSlotKind::kStoreGlobalStrict:
+    case FeedbackSlotKind::kStoreKeyedSloppy:
+    case FeedbackSlotKind::kStoreKeyedStrict:
+      if (obj == *isolate->factory()->uninitialized_symbol() ||
+          obj == *isolate->factory()->premonomorphic_symbol()) {
+        return ObjectStats::FEEDBACK_VECTOR_SLOT_STORE_UNUSED_TYPE;
+      }
+      return ObjectStats::FEEDBACK_VECTOR_SLOT_STORE_TYPE;
+
+    case FeedbackSlotKind::kBinaryOp:
+    case FeedbackSlotKind::kCompareOp:
+      return ObjectStats::FEEDBACK_VECTOR_SLOT_ENUM_TYPE;
+
+    default:
+      return ObjectStats::FEEDBACK_VECTOR_SLOT_OTHER_TYPE;
+  }
+}
+
+void ObjectStatsCollectorImpl::RecordVirtualFeedbackVectorDetails(
+    FeedbackVector* vector) {
+  if (virtual_objects_.find(vector) == virtual_objects_.end()) {
+    // Manually insert the feedback vector into the virtual object list, since
+    // we're logging its component parts separately.
+    virtual_objects_.insert(vector);
+
+    size_t calculated_size = 0;
+
+    // Log the feedback vector's header (fixed fields).
+    size_t header_size =
+        reinterpret_cast<Address>(vector->slots_start()) - vector->address();
+    stats_->RecordVirtualObjectStats(ObjectStats::FEEDBACK_VECTOR_HEADER_TYPE,
+                                     header_size,
+                                     ObjectStats::kNoOverAllocation);
+    calculated_size += header_size;
+
+    // Iterate over the feedback slots and log each one.
+    FeedbackMetadataIterator it(vector->metadata());
+    while (it.HasNext()) {
+      FeedbackSlot slot = it.Next();
+      // Log the entry (or entries) taken up by this slot.
+      size_t slot_size = it.entry_size() * kPointerSize;
+      stats_->RecordVirtualObjectStats(
+          GetFeedbackSlotType(vector->Get(slot), it.kind(), heap_->isolate()),
+          slot_size, ObjectStats::kNoOverAllocation);
+      calculated_size += slot_size;
+
+      // Log the monomorphic/polymorphic helper objects that this slot owns.
+      for (int i = 0; i < it.entry_size(); i++) {
+        Object* raw_object = vector->get(slot.ToInt() + i);
+        if (!raw_object->IsHeapObject()) continue;
+        HeapObject* object = HeapObject::cast(raw_object);
+        if (object->IsCell() || object->IsFixedArrayExact()) {
+          RecordSimpleVirtualObjectStats(
+              vector, object, ObjectStats::FEEDBACK_VECTOR_ENTRY_TYPE);
+        }
+      }
     }
+
+    CHECK_EQ(calculated_size, vector->Size());
   }
+}
 
- private:
-  ObjectStatsCollectorImpl* parent_;
-};
+void ObjectStatsCollectorImpl::RecordVirtualFixedArrayDetails(
+    FixedArray* array) {
+  if (IsCowArray(array)) {
+    RecordVirtualObjectStats(nullptr, array, ObjectStats::COW_ARRAY_TYPE,
+                             array->Size(), ObjectStats::kNoOverAllocation,
+                             kIgnoreCow);
+  }
+}
+
+void ObjectStatsCollectorImpl::CollectStatistics(HeapObject* obj, Phase phase) {
+  Map* map = obj->map();
+  switch (phase) {
+    case kPhase1:
+      if (obj->IsFeedbackVector()) {
+        RecordVirtualFeedbackVectorDetails(FeedbackVector::cast(obj));
+      } else if (obj->IsMap()) {
+        RecordVirtualMapDetails(Map::cast(obj));
+      } else if (obj->IsBytecodeArray()) {
+        RecordVirtualBytecodeArrayDetails(BytecodeArray::cast(obj));
+      } else if (obj->IsCode()) {
+        RecordVirtualCodeDetails(Code::cast(obj));
+      } else if (obj->IsFunctionTemplateInfo()) {
+        RecordVirtualFunctionTemplateInfoDetails(
+            FunctionTemplateInfo::cast(obj));
+      } else if (obj->IsJSFunction()) {
+        RecordVirtualJSFunctionDetails(JSFunction::cast(obj));
+      } else if (obj->IsJSGlobalObject()) {
+        RecordVirtualJSGlobalObjectDetails(JSGlobalObject::cast(obj));
+      } else if (obj->IsJSObject()) {
+        // This phase needs to come after RecordVirtualAllocationSiteDetails
+        // to properly split among boilerplates.
+        RecordVirtualJSObjectDetails(JSObject::cast(obj));
+      } else if (obj->IsJSCollection()) {
+        RecordVirtualJSCollectionDetails(JSObject::cast(obj));
+      } else if (obj->IsSharedFunctionInfo()) {
+        RecordVirtualSharedFunctionInfoDetails(SharedFunctionInfo::cast(obj));
+      } else if (obj->IsContext()) {
+        RecordVirtualContext(Context::cast(obj));
+      } else if (obj->IsScript()) {
+        RecordVirtualScriptDetails(Script::cast(obj));
+      } else if (obj->IsFixedArrayExact()) {
+        // Has to go last as it triggers too eagerly.
+        RecordVirtualFixedArrayDetails(FixedArray::cast(obj));
+      }
+      break;
+    case kPhase2:
+      RecordObjectStats(obj, map->instance_type(), obj->Size());
+      break;
+  }
+}
 
 void ObjectStatsCollectorImpl::CollectGlobalStatistics() {
-  // Global FixedArrays.
-  RecordFixedArrayHelper(nullptr, heap_->weak_new_space_object_to_code_list(),
-                         WEAK_NEW_SPACE_OBJECT_TO_CODE_SUB_TYPE, 0);
-  RecordFixedArrayHelper(nullptr, heap_->serialized_objects(),
-                         SERIALIZED_OBJECTS_SUB_TYPE, 0);
-  RecordFixedArrayHelper(nullptr, heap_->number_string_cache(),
-                         NUMBER_STRING_CACHE_SUB_TYPE, 0);
-  RecordFixedArrayHelper(nullptr, heap_->single_character_string_cache(),
-                         SINGLE_CHARACTER_STRING_CACHE_SUB_TYPE, 0);
-  RecordFixedArrayHelper(nullptr, heap_->string_split_cache(),
-                         STRING_SPLIT_CACHE_SUB_TYPE, 0);
-  RecordFixedArrayHelper(nullptr, heap_->regexp_multiple_cache(),
-                         REGEXP_MULTIPLE_CACHE_SUB_TYPE, 0);
-  RecordFixedArrayHelper(nullptr, heap_->retained_maps(),
-                         RETAINED_MAPS_SUB_TYPE, 0);
-
-  // Global weak FixedArrays.
-  RecordFixedArrayHelper(
-      nullptr, WeakFixedArray::cast(heap_->noscript_shared_function_infos()),
-      NOSCRIPT_SHARED_FUNCTION_INFOS_SUB_TYPE, 0);
-  RecordFixedArrayHelper(nullptr, WeakFixedArray::cast(heap_->script_list()),
-                         SCRIPT_LIST_SUB_TYPE, 0);
-
-  // Global hash tables.
-  RecordHashTableHelper(nullptr, heap_->string_table(), STRING_TABLE_SUB_TYPE);
-  RecordHashTableHelper(nullptr, heap_->weak_object_to_code_table(),
-                        OBJECT_TO_CODE_SUB_TYPE);
-  RecordHashTableHelper(nullptr, heap_->code_stubs(),
-                        CODE_STUBS_TABLE_SUB_TYPE);
-  RecordHashTableHelper(nullptr, heap_->empty_property_dictionary(),
-                        EMPTY_PROPERTIES_DICTIONARY_SUB_TYPE);
-  CompilationCache* compilation_cache = heap_->isolate()->compilation_cache();
-  CompilationCacheTableVisitor v(this);
-  compilation_cache->Iterate(&v);
+  // Iterate boilerplates first to disambiguate them from regular JS objects.
+  Object* list = heap_->allocation_sites_list();
+  while (list->IsAllocationSite()) {
+    AllocationSite* site = AllocationSite::cast(list);
+    RecordVirtualAllocationSiteDetails(site);
+    list = site->weak_next();
+  }
+
+  // FixedArray.
+  RecordSimpleVirtualObjectStats(nullptr, heap_->serialized_objects(),
+                                 ObjectStats::SERIALIZED_OBJECTS_TYPE);
+  RecordSimpleVirtualObjectStats(nullptr, heap_->number_string_cache(),
+                                 ObjectStats::NUMBER_STRING_CACHE_TYPE);
+  RecordSimpleVirtualObjectStats(
+      nullptr, heap_->single_character_string_cache(),
+      ObjectStats::SINGLE_CHARACTER_STRING_CACHE_TYPE);
+  RecordSimpleVirtualObjectStats(nullptr, heap_->string_split_cache(),
+                                 ObjectStats::STRING_SPLIT_CACHE_TYPE);
+  RecordSimpleVirtualObjectStats(nullptr, heap_->regexp_multiple_cache(),
+                                 ObjectStats::REGEXP_MULTIPLE_CACHE_TYPE);
+  RecordSimpleVirtualObjectStats(nullptr, heap_->retained_maps(),
+                                 ObjectStats::RETAINED_MAPS_TYPE);
+
+  // FixedArrayOfWeakCells.
+  RecordSimpleVirtualObjectStats(
+      nullptr,
+      FixedArrayOfWeakCells::cast(heap_->noscript_shared_function_infos()),
+      ObjectStats::NOSCRIPT_SHARED_FUNCTION_INFOS_TYPE);
+  RecordSimpleVirtualObjectStats(
+      nullptr, FixedArrayOfWeakCells::cast(heap_->script_list()),
+      ObjectStats::SCRIPT_LIST_TYPE);
+
+  // HashTable.
+  RecordHashTableVirtualObjectStats(nullptr, heap_->string_table(),
+                                    ObjectStats::STRING_TABLE_TYPE);
+  RecordHashTableVirtualObjectStats(nullptr, heap_->code_stubs(),
+                                    ObjectStats::CODE_STUBS_TABLE_TYPE);
 }
 
 void ObjectStatsCollectorImpl::RecordObjectStats(HeapObject* obj,
                                                  InstanceType type,
                                                  size_t size) {
-  if (virtual_objects_.find(obj) == virtual_objects_.end())
+  if (virtual_objects_.find(obj) == virtual_objects_.end()) {
     stats_->RecordObjectStats(type, size);
+  }
 }
 
-static bool CanRecordFixedArray(Heap* heap, FixedArrayBase* array) {
-  return array->map()->instance_type() == FIXED_ARRAY_TYPE &&
-         array != heap->empty_fixed_array() &&
-         array != heap->empty_sloppy_arguments_elements() &&
-         array != heap->empty_slow_element_dictionary() &&
-         array != heap->empty_property_dictionary();
+bool ObjectStatsCollectorImpl::CanRecordFixedArray(FixedArrayBase* array) {
+  return array != heap_->empty_fixed_array() &&
+         array != heap_->empty_sloppy_arguments_elements() &&
+         array != heap_->empty_slow_element_dictionary() &&
+         array != heap_->empty_property_dictionary();
 }
 
-static bool IsCowArray(Heap* heap, FixedArrayBase* array) {
-  return array->map() == heap->fixed_cow_array_map();
+bool ObjectStatsCollectorImpl::IsCowArray(FixedArrayBase* array) {
+  return array->map() == heap_->fixed_cow_array_map();
 }
 
 bool ObjectStatsCollectorImpl::SameLiveness(HeapObject* obj1,
@@ -460,256 +607,209 @@ bool ObjectStatsCollectorImpl::SameLiveness(HeapObject* obj1,
          marking_state_->Color(obj1) == marking_state_->Color(obj2);
 }
 
-bool ObjectStatsCollectorImpl::RecordFixedArrayHelper(HeapObject* parent,
-                                                      FixedArray* array,
-                                                      int subtype,
-                                                      size_t overhead) {
-  if (SameLiveness(parent, array) && CanRecordFixedArray(heap_, array) &&
-      !IsCowArray(heap_, array)) {
-    return stats_->RecordFixedArraySubTypeStats(array, subtype, array->Size(),
-                                                overhead);
+void ObjectStatsCollectorImpl::RecordVirtualMapDetails(Map* map) {
+  // TODO(mlippautz): map->dependent_code(): DEPENDENT_CODE_TYPE.
+
+  DescriptorArray* array = map->instance_descriptors();
+  if (map->owns_descriptors() && array != heap_->empty_descriptor_array()) {
+    // DescriptorArray has its own instance type.
+    EnumCache* enum_cache = array->GetEnumCache();
+    RecordSimpleVirtualObjectStats(array, enum_cache->keys(),
+                                   ObjectStats::ENUM_CACHE_TYPE);
+    RecordSimpleVirtualObjectStats(array, enum_cache->indices(),
+                                   ObjectStats::ENUM_INDICES_CACHE_TYPE);
   }
-  return false;
-}
 
-void ObjectStatsCollectorImpl::RecursivelyRecordFixedArrayHelper(
-    HeapObject* parent, FixedArray* array, int subtype) {
-  if (RecordFixedArrayHelper(parent, array, subtype, 0)) {
-    for (int i = 0; i < array->length(); i++) {
-      if (array->get(i)->IsFixedArray()) {
-        RecursivelyRecordFixedArrayHelper(
-            parent, FixedArray::cast(array->get(i)), subtype);
+  if (map->is_prototype_map()) {
+    if (map->prototype_info()->IsPrototypeInfo()) {
+      PrototypeInfo* info = PrototypeInfo::cast(map->prototype_info());
+      Object* users = info->prototype_users();
+      if (users->IsFixedArrayOfWeakCells()) {
+        RecordSimpleVirtualObjectStats(map, FixedArrayOfWeakCells::cast(users),
+                                       ObjectStats::PROTOTYPE_USERS_TYPE);
       }
     }
   }
 }
 
-template <class HashTable>
-void ObjectStatsCollectorImpl::RecordHashTableHelper(HeapObject* parent,
-                                                     HashTable* array,
-                                                     int subtype) {
-  int used = array->NumberOfElements() * HashTable::kEntrySize * kPointerSize;
-  CHECK_GE(array->Size(), used);
-  size_t overhead = array->Size() - used -
-                    HashTable::kElementsStartIndex * kPointerSize -
-                    FixedArray::kHeaderSize;
-  RecordFixedArrayHelper(parent, array, subtype, overhead);
-}
+void ObjectStatsCollectorImpl::RecordVirtualScriptDetails(Script* script) {
+  RecordSimpleVirtualObjectStats(
+      script, script->shared_function_infos(),
+      ObjectStats::SCRIPT_SHARED_FUNCTION_INFOS_TYPE);
 
-void ObjectStatsCollectorImpl::RecordJSObjectDetails(JSObject* object) {
-  size_t overhead = 0;
-  FixedArrayBase* elements = object->elements();
-  if (CanRecordFixedArray(heap_, elements) && !IsCowArray(heap_, elements)) {
-    if (elements->IsDictionary() && SameLiveness(object, elements)) {
-      NumberDictionary* dict = NumberDictionary::cast(elements);
-      RecordHashTableHelper(object, dict, DICTIONARY_ELEMENTS_SUB_TYPE);
-    } else {
-      if (IsHoleyElementsKind(object->GetElementsKind())) {
-        int used = object->GetFastElementsUsage() * kPointerSize;
-        if (object->GetElementsKind() == HOLEY_DOUBLE_ELEMENTS) used *= 2;
-        CHECK_GE(elements->Size(), used);
-        overhead = elements->Size() - used - FixedArray::kHeaderSize;
-      }
-      stats_->RecordFixedArraySubTypeStats(elements, PACKED_ELEMENTS_SUB_TYPE,
-                                           elements->Size(), overhead);
-    }
-  }
-
-  if (object->IsJSGlobalObject()) {
-    GlobalDictionary* properties =
-        JSGlobalObject::cast(object)->global_dictionary();
-    if (CanRecordFixedArray(heap_, properties) &&
-        SameLiveness(object, properties)) {
-      RecordHashTableHelper(object, properties, DICTIONARY_PROPERTIES_SUB_TYPE);
-    }
-  } else if (!object->HasFastProperties()) {
-    NameDictionary* properties = object->property_dictionary();
-    if (CanRecordFixedArray(heap_, properties) &&
-        SameLiveness(object, properties)) {
-      RecordHashTableHelper(object, properties, DICTIONARY_PROPERTIES_SUB_TYPE);
-    }
+  // Log the size of external source code.
+  Object* source = script->source();
+  if (source->IsExternalString()) {
+    // The contents of external strings aren't on the heap, so we have to record
+    // them manually.
+    ExternalString* external_source_string = ExternalString::cast(source);
+    size_t length_multiplier = external_source_string->IsTwoByteRepresentation()
+                                   ? kShortSize
+                                   : kCharSize;
+    size_t off_heap_size = external_source_string->length() * length_multiplier;
+    size_t on_heap_size = external_source_string->Size();
+    RecordVirtualObjectStats(script, external_source_string,
+                             ObjectStats::SCRIPT_SOURCE_EXTERNAL_TYPE,
+                             on_heap_size + off_heap_size,
+                             ObjectStats::kNoOverAllocation);
+  } else if (source->IsHeapObject()) {
+    RecordSimpleVirtualObjectStats(
+        script, HeapObject::cast(source),
+        ObjectStats::SCRIPT_SOURCE_NON_EXTERNAL_TYPE);
   }
 }
 
-void ObjectStatsCollectorImpl::RecordJSWeakCollectionDetails(
-    JSWeakCollection* obj) {
-  if (obj->table()->IsHashTable()) {
-    ObjectHashTable* table = ObjectHashTable::cast(obj->table());
-    int used = table->NumberOfElements() * ObjectHashTable::kEntrySize;
-    size_t overhead = table->Size() - used;
-    RecordFixedArrayHelper(obj, table, JS_WEAK_COLLECTION_SUB_TYPE, overhead);
+void ObjectStatsCollectorImpl::RecordVirtualSharedFunctionInfoDetails(
+    SharedFunctionInfo* info) {
+  // Uncompiled SharedFunctionInfo gets its own category.
+  if (!info->is_compiled()) {
+    RecordSimpleVirtualObjectStats(
+        nullptr, info, ObjectStats::UNCOMPILED_SHARED_FUNCTION_INFO_TYPE);
   }
 }
 
-void ObjectStatsCollectorImpl::RecordJSCollectionDetails(JSObject* obj) {
-  // The JS versions use a different HashTable implementation that cannot use
-  // the regular helper. Since overall impact is usually small just record
-  // without overhead.
-  if (obj->IsJSMap()) {
-    RecordFixedArrayHelper(nullptr, FixedArray::cast(JSMap::cast(obj)->table()),
-                           JS_COLLECTION_SUB_TYPE, 0);
-  }
-  if (obj->IsJSSet()) {
-    RecordFixedArrayHelper(nullptr, FixedArray::cast(JSSet::cast(obj)->table()),
-                           JS_COLLECTION_SUB_TYPE, 0);
+void ObjectStatsCollectorImpl::RecordVirtualJSFunctionDetails(
+    JSFunction* function) {
+  // Uncompiled JSFunctions get their own category.
+  if (!function->is_compiled()) {
+    RecordSimpleVirtualObjectStats(nullptr, function,
+                                   ObjectStats::UNCOMPILED_JS_FUNCTION_TYPE);
   }
 }
 
-void ObjectStatsCollectorImpl::RecordScriptDetails(Script* obj) {
-  FixedArray* infos = FixedArray::cast(obj->shared_function_infos());
-  RecordFixedArrayHelper(obj, infos, SHARED_FUNCTION_INFOS_SUB_TYPE, 0);
-}
+namespace {
 
-void ObjectStatsCollectorImpl::RecordMapDetails(Map* map_obj) {
-  DescriptorArray* array = map_obj->instance_descriptors();
-  if (map_obj->owns_descriptors() && array != heap_->empty_descriptor_array() &&
-      SameLiveness(map_obj, array)) {
-    RecordFixedArrayHelper(map_obj, array, DESCRIPTOR_ARRAY_SUB_TYPE, 0);
-    EnumCache* enum_cache = array->GetEnumCache();
-    RecordFixedArrayHelper(array, enum_cache->keys(), ENUM_CACHE_SUB_TYPE, 0);
-    RecordFixedArrayHelper(array, enum_cache->indices(),
-                           ENUM_INDICES_CACHE_SUB_TYPE, 0);
-  }
+bool MatchesConstantElementsPair(Object* object) {
+  if (!object->IsTuple2()) return false;
+  Tuple2* tuple = Tuple2::cast(object);
+  return tuple->value1()->IsSmi() && tuple->value2()->IsFixedArrayExact();
+}
 
-  for (DependentCode* cur_dependent_code = map_obj->dependent_code();
-       cur_dependent_code != heap_->empty_fixed_array();
-       cur_dependent_code = DependentCode::cast(
-           cur_dependent_code->get(DependentCode::kNextLinkIndex))) {
-    RecordFixedArrayHelper(map_obj, cur_dependent_code, DEPENDENT_CODE_SUB_TYPE,
-                           0);
-  }
+}  // namespace
 
-  if (map_obj->is_prototype_map()) {
-    if (map_obj->prototype_info()->IsPrototypeInfo()) {
-      PrototypeInfo* info = PrototypeInfo::cast(map_obj->prototype_info());
-      Object* users = info->prototype_users();
-      if (users->IsWeakFixedArray()) {
-        RecordFixedArrayHelper(map_obj, WeakFixedArray::cast(users),
-                               PROTOTYPE_USERS_SUB_TYPE, 0);
-      }
+void ObjectStatsCollectorImpl::
+    RecordVirtualObjectsForConstantPoolOrEmbeddedObjects(
+        HeapObject* parent, HeapObject* object,
+        ObjectStats::VirtualInstanceType type) {
+  if (!RecordSimpleVirtualObjectStats(parent, object, type)) return;
+  if (object->IsFixedArrayExact()) {
+    FixedArray* array = FixedArray::cast(object);
+    for (int i = 0; i < array->length(); i++) {
+      Object* entry = array->get(i);
+      if (!entry->IsHeapObject()) continue;
+      RecordVirtualObjectsForConstantPoolOrEmbeddedObjects(
+          array, HeapObject::cast(entry), type);
+    }
+  } else if (MatchesConstantElementsPair(object)) {
+    Tuple2* tuple = Tuple2::cast(object);
+    RecordVirtualObjectsForConstantPoolOrEmbeddedObjects(
+        tuple, HeapObject::cast(tuple->value2()), type);
+  }
+}
+
+void ObjectStatsCollectorImpl::RecordVirtualBytecodeArrayDetails(
+    BytecodeArray* bytecode) {
+  RecordSimpleVirtualObjectStats(
+      bytecode, bytecode->constant_pool(),
+      ObjectStats::BYTECODE_ARRAY_CONSTANT_POOL_TYPE);
+  // FixedArrays on constant pool are used for holding descriptor information.
+  // They are shared with optimized code.
+  FixedArray* constant_pool = FixedArray::cast(bytecode->constant_pool());
+  for (int i = 0; i < constant_pool->length(); i++) {
+    Object* entry = constant_pool->get(i);
+    if (entry->IsFixedArrayExact() || MatchesConstantElementsPair(entry)) {
+      RecordVirtualObjectsForConstantPoolOrEmbeddedObjects(
+          constant_pool, HeapObject::cast(entry),
+          ObjectStats::EMBEDDED_OBJECT_TYPE);
     }
   }
+  RecordSimpleVirtualObjectStats(
+      bytecode, bytecode->handler_table(),
+      ObjectStats::BYTECODE_ARRAY_HANDLER_TABLE_TYPE);
 }
 
-void ObjectStatsCollectorImpl::RecordTemplateInfoDetails(TemplateInfo* obj) {
-  if (obj->property_accessors()->IsFixedArray()) {
-    RecordFixedArrayHelper(obj, FixedArray::cast(obj->property_accessors()),
-                           TEMPLATE_INFO_SUB_TYPE, 0);
-  }
-  if (obj->property_list()->IsFixedArray()) {
-    RecordFixedArrayHelper(obj, FixedArray::cast(obj->property_list()),
-                           TEMPLATE_INFO_SUB_TYPE, 0);
+namespace {
+
+ObjectStats::VirtualInstanceType CodeKindToVirtualInstanceType(
+    Code::Kind kind) {
+  switch (kind) {
+#define CODE_KIND_CASE(type) \
+  case Code::type:           \
+    return ObjectStats::type;
+    CODE_KIND_LIST(CODE_KIND_CASE)
+#undef CODE_KIND_CASE
+    default:
+      UNREACHABLE();
   }
+  UNREACHABLE();
 }
 
-void ObjectStatsCollectorImpl::RecordBytecodeArrayDetails(BytecodeArray* obj) {
-  RecordFixedArrayHelper(obj, obj->constant_pool(),
-                         BYTECODE_ARRAY_CONSTANT_POOL_SUB_TYPE, 0);
-  RecordFixedArrayHelper(obj, obj->handler_table(),
-                         BYTECODE_ARRAY_HANDLER_TABLE_SUB_TYPE, 0);
-}
+}  // namespace
 
-void ObjectStatsCollectorImpl::RecordCodeDetails(Code* code) {
-  stats_->RecordCodeSubTypeStats(code->kind(), code->Size());
-  RecordFixedArrayHelper(code, code->deoptimization_data(),
-                         DEOPTIMIZATION_DATA_SUB_TYPE, 0);
+void ObjectStatsCollectorImpl::RecordVirtualCodeDetails(Code* code) {
+  RecordSimpleVirtualObjectStats(nullptr, code,
+                                 CodeKindToVirtualInstanceType(code->kind()));
+  RecordSimpleVirtualObjectStats(code, code->deoptimization_data(),
+                                 ObjectStats::DEOPTIMIZATION_DATA_TYPE);
   if (code->kind() == Code::Kind::OPTIMIZED_FUNCTION) {
     DeoptimizationData* input_data =
         DeoptimizationData::cast(code->deoptimization_data());
     if (input_data->length() > 0) {
-      RecordFixedArrayHelper(code->deoptimization_data(),
-                             input_data->LiteralArray(),
-                             OPTIMIZED_CODE_LITERALS_SUB_TYPE, 0);
+      RecordSimpleVirtualObjectStats(code->deoptimization_data(),
+                                     input_data->LiteralArray(),
+                                     ObjectStats::OPTIMIZED_CODE_LITERALS_TYPE);
     }
   }
-  RecordFixedArrayHelper(code, code->handler_table(), HANDLER_TABLE_SUB_TYPE,
-                         0);
   int const mode_mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
   for (RelocIterator it(code, mode_mask); !it.done(); it.next()) {
     RelocInfo::Mode mode = it.rinfo()->rmode();
     if (mode == RelocInfo::EMBEDDED_OBJECT) {
       Object* target = it.rinfo()->target_object();
-      if (target->IsFixedArray()) {
-        RecursivelyRecordFixedArrayHelper(code, FixedArray::cast(target),
-                                          EMBEDDED_OBJECT_SUB_TYPE);
+      if (target->IsFixedArrayExact() || MatchesConstantElementsPair(target)) {
+        RecordVirtualObjectsForConstantPoolOrEmbeddedObjects(
+            code, HeapObject::cast(target), ObjectStats::EMBEDDED_OBJECT_TYPE);
       }
     }
   }
 }
 
-void ObjectStatsCollectorImpl::RecordSharedFunctionInfoDetails(
-    SharedFunctionInfo* sfi) {
-  FixedArray* scope_info = sfi->scope_info();
-  RecordFixedArrayHelper(sfi, scope_info, SCOPE_INFO_SUB_TYPE, 0);
-  FeedbackMetadata* feedback_metadata = sfi->feedback_metadata();
-  if (!feedback_metadata->is_empty()) {
-    RecordFixedArrayHelper(sfi, feedback_metadata, FEEDBACK_METADATA_SUB_TYPE,
-                           0);
-  }
-}
-
-void ObjectStatsCollectorImpl::RecordFixedArrayDetails(FixedArray* array) {
-  if (array->IsContext()) {
-    RecordFixedArrayHelper(nullptr, array, CONTEXT_SUB_TYPE, 0);
-  }
-  if (IsCowArray(heap_, array) && CanRecordFixedArray(heap_, array)) {
-    stats_->RecordFixedArraySubTypeStats(array, COPY_ON_WRITE_SUB_TYPE,
-                                         array->Size(), 0);
-  }
-  if (array->IsNativeContext()) {
-    Context* native_ctx = Context::cast(array);
-    RecordHashTableHelper(array,
-                          native_ctx->slow_template_instantiations_cache(),
-                          SLOW_TEMPLATE_INSTANTIATIONS_CACHE_SUB_TYPE);
-    FixedArray* fast_cache = native_ctx->fast_template_instantiations_cache();
-    stats_->RecordFixedArraySubTypeStats(
-        fast_cache, FAST_TEMPLATE_INSTANTIATIONS_CACHE_SUB_TYPE,
-        fast_cache->Size(), 0);
+void ObjectStatsCollectorImpl::RecordVirtualContext(Context* context) {
+  if (context->IsNativeContext()) {
+    RecordObjectStats(context, NATIVE_CONTEXT_TYPE, context->Size());
+  } else if (context->IsFunctionContext()) {
+    RecordObjectStats(context, FUNCTION_CONTEXT_TYPE, context->Size());
+  } else {
+    RecordSimpleVirtualObjectStats(nullptr, context,
+                                   ObjectStats::OTHER_CONTEXT_TYPE);
   }
 }
 
 class ObjectStatsVisitor {
  public:
-  enum CollectionMode {
-    kRegular,
-    kVirtual,
-  };
-
   ObjectStatsVisitor(Heap* heap, ObjectStatsCollectorImpl* live_collector,
                      ObjectStatsCollectorImpl* dead_collector,
-                     CollectionMode mode)
+                     ObjectStatsCollectorImpl::Phase phase)
       : live_collector_(live_collector),
         dead_collector_(dead_collector),
         marking_state_(
             heap->mark_compact_collector()->non_atomic_marking_state()),
-        mode_(mode) {}
+        phase_(phase) {}
 
   bool Visit(HeapObject* obj, int size) {
     if (marking_state_->IsBlack(obj)) {
-      Collect(live_collector_, obj);
+      live_collector_->CollectStatistics(obj, phase_);
     } else {
       DCHECK(!marking_state_->IsGrey(obj));
-      Collect(dead_collector_, obj);
+      dead_collector_->CollectStatistics(obj, phase_);
     }
     return true;
   }
 
  private:
-  void Collect(ObjectStatsCollectorImpl* collector, HeapObject* obj) {
-    switch (mode_) {
-      case kRegular:
-        collector->CollectStatistics(obj);
-        break;
-      case kVirtual:
-        collector->CollectVirtualStatistics(obj);
-        break;
-    }
-  }
-
   ObjectStatsCollectorImpl* live_collector_;
   ObjectStatsCollectorImpl* dead_collector_;
   MarkCompactCollector::NonAtomicMarkingState* marking_state_;
-  CollectionMode mode_;
+  ObjectStatsCollectorImpl::Phase phase_;
 };
 
 namespace {
@@ -731,19 +831,10 @@ void IterateHeap(Heap* heap, ObjectStatsVisitor* visitor) {
 void ObjectStatsCollector::Collect() {
   ObjectStatsCollectorImpl live_collector(heap_, live_);
   ObjectStatsCollectorImpl dead_collector(heap_, dead_);
-  // 1. Collect system type otherwise indistinguishable from other types.
-  {
-    ObjectStatsVisitor visitor(heap_, &live_collector, &dead_collector,
-                               ObjectStatsVisitor::kVirtual);
-    IterateHeap(heap_, &visitor);
-  }
-
-  // 2. Collect globals; only applies to live objects.
   live_collector.CollectGlobalStatistics();
-  // 3. Collect rest.
-  {
+  for (int i = 0; i < ObjectStatsCollectorImpl::kNumberOfPhases; i++) {
     ObjectStatsVisitor visitor(heap_, &live_collector, &dead_collector,
-                               ObjectStatsVisitor::kRegular);
+                               static_cast<ObjectStatsCollectorImpl::Phase>(i));
     IterateHeap(heap_, &visitor);
   }
 }
diff --git a/deps/v8/src/heap/object-stats.h b/deps/v8/src/heap/object-stats.h
index 500ce36bd90..3648b9985bc 100644
--- a/deps/v8/src/heap/object-stats.h
+++ b/deps/v8/src/heap/object-stats.h
@@ -5,13 +5,8 @@
 #ifndef V8_HEAP_OBJECT_STATS_H_
 #define V8_HEAP_OBJECT_STATS_H_
 
-#include <set>
-
-#include "src/base/ieee754.h"
-#include "src/heap/heap.h"
-#include "src/heap/mark-compact.h"
-#include "src/heap/objects-visiting.h"
 #include "src/objects.h"
+#include "src/objects/code.h"
 
 // These instance types do not exist for actual use but are merely introduced
 // for object stats tracing. In contrast to Code and FixedArray sub types
@@ -19,18 +14,68 @@
 // tracing.
 //
 // Update LAST_VIRTUAL_TYPE below when changing this macro.
-#define VIRTUAL_INSTANCE_TYPE_LIST(V) \
-  V(BOILERPLATE_ELEMENTS_TYPE)        \
-  V(BOILERPLATE_NAME_DICTIONARY_TYPE) \
-  V(BOILERPLATE_PROPERTY_ARRAY_TYPE)  \
-  V(JS_ARRAY_BOILERPLATE_TYPE)        \
-  V(JS_OBJECT_BOILERPLATE_TYPE)
+#define VIRTUAL_INSTANCE_TYPE_LIST(V)       \
+  CODE_KIND_LIST(V)                         \
+  V(BOILERPLATE_ELEMENTS_TYPE)              \
+  V(BOILERPLATE_PROPERTY_ARRAY_TYPE)        \
+  V(BOILERPLATE_PROPERTY_DICTIONARY_TYPE)   \
+  V(BYTECODE_ARRAY_CONSTANT_POOL_TYPE)      \
+  V(BYTECODE_ARRAY_HANDLER_TABLE_TYPE)      \
+  V(CODE_STUBS_TABLE_TYPE)                  \
+  V(COW_ARRAY_TYPE)                         \
+  V(DEOPTIMIZATION_DATA_TYPE)               \
+  V(DEPENDENT_CODE_TYPE)                    \
+  V(ELEMENTS_TYPE)                          \
+  V(EMBEDDED_OBJECT_TYPE)                   \
+  V(ENUM_CACHE_TYPE)                        \
+  V(ENUM_INDICES_CACHE_TYPE)                \
+  V(FEEDBACK_VECTOR_ENTRY_TYPE)             \
+  V(FEEDBACK_VECTOR_HEADER_TYPE)            \
+  V(FEEDBACK_VECTOR_SLOT_CALL_TYPE)         \
+  V(FEEDBACK_VECTOR_SLOT_CALL_UNUSED_TYPE)  \
+  V(FEEDBACK_VECTOR_SLOT_ENUM_TYPE)         \
+  V(FEEDBACK_VECTOR_SLOT_LOAD_TYPE)         \
+  V(FEEDBACK_VECTOR_SLOT_LOAD_UNUSED_TYPE)  \
+  V(FEEDBACK_VECTOR_SLOT_OTHER_TYPE)        \
+  V(FEEDBACK_VECTOR_SLOT_STORE_TYPE)        \
+  V(FEEDBACK_VECTOR_SLOT_STORE_UNUSED_TYPE) \
+  V(FUNCTION_TEMPLATE_INFO_ENTRIES_TYPE)    \
+  V(GLOBAL_ELEMENTS_TYPE)                   \
+  V(GLOBAL_PROPERTIES_TYPE)                 \
+  V(JS_ARRAY_BOILERPLATE_TYPE)              \
+  V(JS_COLLETION_TABLE_TYPE)                \
+  V(JS_OBJECT_BOILERPLATE_TYPE)             \
+  V(NOSCRIPT_SHARED_FUNCTION_INFOS_TYPE)    \
+  V(NUMBER_STRING_CACHE_TYPE)               \
+  V(OBJECT_PROPERTY_DICTIONARY_TYPE)        \
+  V(OBJECT_TO_CODE_TYPE)                    \
+  V(OPTIMIZED_CODE_LITERALS_TYPE)           \
+  V(OTHER_CONTEXT_TYPE)                     \
+  V(PROTOTYPE_USERS_TYPE)                   \
+  V(REGEXP_MULTIPLE_CACHE_TYPE)             \
+  V(RETAINED_MAPS_TYPE)                     \
+  V(SCRIPT_LIST_TYPE)                       \
+  V(SCRIPT_SHARED_FUNCTION_INFOS_TYPE)      \
+  V(SCRIPT_SOURCE_EXTERNAL_TYPE)            \
+  V(SCRIPT_SOURCE_NON_EXTERNAL_TYPE)        \
+  V(SERIALIZED_OBJECTS_TYPE)                \
+  V(SINGLE_CHARACTER_STRING_CACHE_TYPE)     \
+  V(STRING_SPLIT_CACHE_TYPE)                \
+  V(STRING_TABLE_TYPE)                      \
+  V(UNCOMPILED_JS_FUNCTION_TYPE)            \
+  V(UNCOMPILED_SHARED_FUNCTION_INFO_TYPE)   \
+  V(WEAK_NEW_SPACE_OBJECT_TO_CODE_TYPE)
 
 namespace v8 {
 namespace internal {
 
+class Heap;
+class Isolate;
+
 class ObjectStats {
  public:
+  static const size_t kNoOverAllocation = 0;
+
   explicit ObjectStats(Heap* heap) : heap_(heap) { ClearObjectStats(); }
 
   // See description on VIRTUAL_INSTANCE_TYPE_LIST.
@@ -38,18 +83,14 @@ class ObjectStats {
 #define DEFINE_VIRTUAL_INSTANCE_TYPE(type) type,
     VIRTUAL_INSTANCE_TYPE_LIST(DEFINE_VIRTUAL_INSTANCE_TYPE)
 #undef DEFINE_FIXED_ARRAY_SUB_INSTANCE_TYPE
-        LAST_VIRTUAL_TYPE = JS_OBJECT_BOILERPLATE_TYPE,
+        LAST_VIRTUAL_TYPE = WEAK_NEW_SPACE_OBJECT_TO_CODE_TYPE,
   };
 
   // ObjectStats are kept in two arrays, counts and sizes. Related stats are
   // stored in a contiguous linear buffer. Stats groups are stored one after
   // another.
   enum {
-    FIRST_CODE_KIND_SUB_TYPE = LAST_TYPE + 1,
-    FIRST_FIXED_ARRAY_SUB_TYPE =
-        FIRST_CODE_KIND_SUB_TYPE + Code::NUMBER_OF_KINDS,
-    FIRST_VIRTUAL_TYPE =
-        FIRST_FIXED_ARRAY_SUB_TYPE + LAST_FIXED_ARRAY_SUB_TYPE + 1,
+    FIRST_VIRTUAL_TYPE = LAST_TYPE + 1,
     OBJECT_STATS_COUNT = FIRST_VIRTUAL_TYPE + LAST_VIRTUAL_TYPE + 1,
   };
 
@@ -60,10 +101,8 @@ class ObjectStats {
 
   void CheckpointObjectStats();
   void RecordObjectStats(InstanceType type, size_t size);
-  void RecordVirtualObjectStats(VirtualInstanceType type, size_t size);
-  void RecordCodeSubTypeStats(int code_sub_type, size_t size);
-  bool RecordFixedArraySubTypeStats(FixedArrayBase* array, int array_sub_type,
-                                    size_t size, size_t over_allocated);
+  void RecordVirtualObjectStats(VirtualInstanceType type, size_t size,
+                                size_t over_allocated);
 
   size_t object_count_last_gc(size_t index) {
     return object_counts_last_time_[index];
@@ -105,8 +144,6 @@ class ObjectStats {
   // Detailed histograms by InstanceType.
   size_t size_histogram_[OBJECT_STATS_COUNT][kNumberOfBuckets];
   size_t over_allocated_histogram_[OBJECT_STATS_COUNT][kNumberOfBuckets];
-
-  std::set<FixedArrayBase*> visited_fixed_array_sub_types_;
 };
 
 class ObjectStatsCollector {
diff --git a/deps/v8/src/heap/objects-visiting-inl.h b/deps/v8/src/heap/objects-visiting-inl.h
index 0a8c866979d..b47dba78305 100644
--- a/deps/v8/src/heap/objects-visiting-inl.h
+++ b/deps/v8/src/heap/objects-visiting-inl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_OBJECTS_VISITING_INL_H_
-#define V8_OBJECTS_VISITING_INL_H_
+#ifndef V8_HEAP_OBJECTS_VISITING_INL_H_
+#define V8_HEAP_OBJECTS_VISITING_INL_H_
 
 #include "src/heap/objects-visiting.h"
 
@@ -71,17 +71,22 @@ void HeapVisitor<ResultType, ConcreteVisitor>::VisitMapPointer(
       host, reinterpret_cast<Object**>(map));
 }
 
-#define VISIT(type)                                                 \
-  template <typename ResultType, typename ConcreteVisitor>          \
-  ResultType HeapVisitor<ResultType, ConcreteVisitor>::Visit##type( \
-      Map* map, type* object) {                                     \
-    ConcreteVisitor* visitor = static_cast<ConcreteVisitor*>(this); \
-    if (!visitor->ShouldVisit(object)) return ResultType();         \
-    int size = type::BodyDescriptor::SizeOf(map, object);           \
-    if (visitor->ShouldVisitMapPointer())                           \
-      visitor->VisitMapPointer(object, object->map_slot());         \
-    type::BodyDescriptor::IterateBody(object, size, visitor);       \
-    return static_cast<ResultType>(size);                           \
+#define VISIT(type)                                                            \
+  template <typename ResultType, typename ConcreteVisitor>                     \
+  ResultType HeapVisitor<ResultType, ConcreteVisitor>::Visit##type(            \
+      Map* map, type* object) {                                                \
+    ConcreteVisitor* visitor = static_cast<ConcreteVisitor*>(this);            \
+    if (!visitor->ShouldVisit(object)) return ResultType();                    \
+    if (!visitor->AllowDefaultJSObjectVisit()) {                               \
+      DCHECK_WITH_MSG(!map->IsJSObjectMap(),                                   \
+                      "Implement custom visitor for new JSObject subclass in " \
+                      "concurrent marker");                                    \
+    }                                                                          \
+    int size = type::BodyDescriptor::SizeOf(map, object);                      \
+    if (visitor->ShouldVisitMapPointer())                                      \
+      visitor->VisitMapPointer(object, object->map_slot());                    \
+    type::BodyDescriptor::IterateBody(map, object, size, visitor);             \
+    return static_cast<ResultType>(size);                                      \
   }
 TYPED_VISITOR_ID_LIST(VISIT)
 #undef VISIT
@@ -100,7 +105,7 @@ ResultType HeapVisitor<ResultType, ConcreteVisitor>::VisitNativeContext(
   int size = Context::BodyDescriptor::SizeOf(map, object);
   if (visitor->ShouldVisitMapPointer())
     visitor->VisitMapPointer(object, object->map_slot());
-  Context::BodyDescriptor::IterateBody(object, size, visitor);
+  Context::BodyDescriptor::IterateBody(map, object, size, visitor);
   return static_cast<ResultType>(size);
 }
 
@@ -123,7 +128,7 @@ ResultType HeapVisitor<ResultType, ConcreteVisitor>::VisitJSObjectFast(
   int size = JSObject::FastBodyDescriptor::SizeOf(map, object);
   if (visitor->ShouldVisitMapPointer())
     visitor->VisitMapPointer(object, object->map_slot());
-  JSObject::FastBodyDescriptor::IterateBody(object, size, visitor);
+  JSObject::FastBodyDescriptor::IterateBody(map, object, size, visitor);
   return static_cast<ResultType>(size);
 }
 
@@ -135,7 +140,7 @@ ResultType HeapVisitor<ResultType, ConcreteVisitor>::VisitJSApiObject(
   int size = JSObject::BodyDescriptor::SizeOf(map, object);
   if (visitor->ShouldVisitMapPointer())
     visitor->VisitMapPointer(object, object->map_slot());
-  JSObject::BodyDescriptor::IterateBody(object, size, visitor);
+  JSObject::BodyDescriptor::IterateBody(map, object, size, visitor);
   return static_cast<ResultType>(size);
 }
 
@@ -147,7 +152,7 @@ ResultType HeapVisitor<ResultType, ConcreteVisitor>::VisitStruct(
   int size = map->instance_size();
   if (visitor->ShouldVisitMapPointer())
     visitor->VisitMapPointer(object, object->map_slot());
-  StructBodyDescriptor::IterateBody(object, size, visitor);
+  StructBodyDescriptor::IterateBody(map, object, size, visitor);
   return static_cast<ResultType>(size);
 }
 
@@ -166,7 +171,7 @@ int NewSpaceVisitor<ConcreteVisitor>::VisitJSFunction(Map* map,
                                                       JSFunction* object) {
   ConcreteVisitor* visitor = static_cast<ConcreteVisitor*>(this);
   int size = JSFunction::BodyDescriptorWeak::SizeOf(map, object);
-  JSFunction::BodyDescriptorWeak::IterateBody(object, size, visitor);
+  JSFunction::BodyDescriptorWeak::IterateBody(map, object, size, visitor);
   return size;
 }
 
@@ -175,7 +180,7 @@ int NewSpaceVisitor<ConcreteVisitor>::VisitNativeContext(Map* map,
                                                          Context* object) {
   ConcreteVisitor* visitor = static_cast<ConcreteVisitor*>(this);
   int size = Context::BodyDescriptor::SizeOf(map, object);
-  Context::BodyDescriptor::IterateBody(object, size, visitor);
+  Context::BodyDescriptor::IterateBody(map, object, size, visitor);
   return size;
 }
 
@@ -189,4 +194,4 @@ int NewSpaceVisitor<ConcreteVisitor>::VisitJSApiObject(Map* map,
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_OBJECTS_VISITING_INL_H_
+#endif  // V8_HEAP_OBJECTS_VISITING_INL_H_
diff --git a/deps/v8/src/heap/objects-visiting.h b/deps/v8/src/heap/objects-visiting.h
index c20434a283b..88e38dcb0c8 100644
--- a/deps/v8/src/heap/objects-visiting.h
+++ b/deps/v8/src/heap/objects-visiting.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_OBJECTS_VISITING_H_
-#define V8_OBJECTS_VISITING_H_
+#ifndef V8_HEAP_OBJECTS_VISITING_H_
+#define V8_HEAP_OBJECTS_VISITING_H_
 
 #include "src/allocation.h"
 #include "src/layout-descriptor.h"
@@ -31,6 +31,7 @@ class JSWeakCollection;
   V(Code)                        \
   V(CodeDataContainer)           \
   V(ConsString)                  \
+  V(FeedbackCell)                \
   V(FeedbackVector)              \
   V(FixedArray)                  \
   V(FixedDoubleArray)            \
@@ -39,7 +40,6 @@ class JSWeakCollection;
   V(JSArrayBuffer)               \
   V(JSFunction)                  \
   V(JSObject)                    \
-  V(JSRegExp)                    \
   V(JSWeakCollection)            \
   V(Map)                         \
   V(Oddball)                     \
@@ -54,7 +54,9 @@ class JSWeakCollection;
   V(Symbol)                      \
   V(ThinString)                  \
   V(TransitionArray)             \
-  V(WeakCell)
+  V(WasmInstanceObject)          \
+  V(WeakCell)                    \
+  V(WeakFixedArray)
 
 // The base class for visitors that need to dispatch on object type. The default
 // behavior of all visit functions is to iterate body of the given object using
@@ -82,6 +84,9 @@ class HeapVisitor : public ObjectVisitor {
   V8_INLINE bool ShouldVisitMapPointer() { return true; }
   // A callback for visiting the map pointer in the object header.
   V8_INLINE void VisitMapPointer(HeapObject* host, HeapObject** map);
+  // If this predicate returns false, then the heap visitor will fail
+  // in default Visit implemention for subclasses of JSObject.
+  V8_INLINE bool AllowDefaultJSObjectVisit() { return true; }
 
 #define VISIT(type) V8_INLINE ResultType Visit##type(Map* map, type* object);
   TYPED_VISITOR_ID_LIST(VISIT)
@@ -132,4 +137,4 @@ Object* VisitWeakList(Heap* heap, Object* list, WeakObjectRetainer* retainer);
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_OBJECTS_VISITING_H_
+#endif  // V8_HEAP_OBJECTS_VISITING_H_
diff --git a/deps/v8/src/heap/remembered-set.h b/deps/v8/src/heap/remembered-set.h
index cd9c45141d4..7ede5da713e 100644
--- a/deps/v8/src/heap/remembered-set.h
+++ b/deps/v8/src/heap/remembered-set.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_REMEMBERED_SET_H
-#define V8_REMEMBERED_SET_H
+#ifndef V8_HEAP_REMEMBERED_SET_H_
+#define V8_HEAP_REMEMBERED_SET_H_
 
 #include "src/assembler.h"
 #include "src/heap/heap.h"
@@ -280,7 +280,9 @@ class UpdateTypedSlotHelper {
                                             Callback callback) {
     Object* code = Code::GetObjectFromEntryAddress(entry_address);
     Object* old_code = code;
-    SlotCallbackResult result = callback(&code);
+    SlotCallbackResult result =
+        callback(reinterpret_cast<MaybeObject**>(&code));
+    DCHECK(!HasWeakHeapObjectTag(code));
     if (code != old_code) {
       Memory::Address_at(entry_address) =
           reinterpret_cast<Code*>(code)->entry();
@@ -296,10 +298,11 @@ class UpdateTypedSlotHelper {
     DCHECK(RelocInfo::IsCodeTarget(rinfo->rmode()));
     Code* old_target = Code::GetCodeFromTargetAddress(rinfo->target_address());
     Object* new_target = old_target;
-    SlotCallbackResult result = callback(&new_target);
+    SlotCallbackResult result =
+        callback(reinterpret_cast<MaybeObject**>(&new_target));
+    DCHECK(!HasWeakHeapObjectTag(new_target));
     if (new_target != old_target) {
-      rinfo->set_target_address(old_target->GetIsolate(),
-                                Code::cast(new_target)->instruction_start());
+      rinfo->set_target_address(Code::cast(new_target)->instruction_start());
     }
     return result;
   }
@@ -312,7 +315,9 @@ class UpdateTypedSlotHelper {
     DCHECK(rinfo->rmode() == RelocInfo::EMBEDDED_OBJECT);
     HeapObject* old_target = rinfo->target_object();
     Object* new_target = old_target;
-    SlotCallbackResult result = callback(&new_target);
+    SlotCallbackResult result =
+        callback(reinterpret_cast<MaybeObject**>(&new_target));
+    DCHECK(!HasWeakHeapObjectTag(new_target));
     if (new_target != old_target) {
       rinfo->set_target_object(HeapObject::cast(new_target));
     }
@@ -320,7 +325,7 @@ class UpdateTypedSlotHelper {
   }
 
   // Updates a typed slot using an untyped slot callback.
-  // The callback accepts Object** and returns SlotCallbackResult.
+  // The callback accepts MaybeObject** and returns SlotCallbackResult.
   template <typename Callback>
   static SlotCallbackResult UpdateTypedSlot(Isolate* isolate,
                                             SlotType slot_type, Address addr,
@@ -338,7 +343,7 @@ class UpdateTypedSlotHelper {
         return UpdateEmbeddedPointer(&rinfo, callback);
       }
       case OBJECT_SLOT: {
-        return callback(reinterpret_cast<Object**>(addr));
+        return callback(reinterpret_cast<MaybeObject**>(addr));
       }
       case CLEARED_SLOT:
         break;
@@ -359,4 +364,4 @@ inline SlotType SlotTypeForRelocInfoMode(RelocInfo::Mode rmode) {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_REMEMBERED_SET_H
+#endif  // V8_HEAP_REMEMBERED_SET_H_
diff --git a/deps/v8/src/heap/scavenge-job.cc b/deps/v8/src/heap/scavenge-job.cc
index b649c010aef..9feebbf4d5d 100644
--- a/deps/v8/src/heap/scavenge-job.cc
+++ b/deps/v8/src/heap/scavenge-job.cc
@@ -103,7 +103,7 @@ void ScavengeJob::ScheduleIdleTaskIfNeeded(Heap* heap, int bytes_allocated) {
 
 
 void ScavengeJob::ScheduleIdleTask(Heap* heap) {
-  if (!idle_task_pending_ && heap->use_tasks()) {
+  if (!idle_task_pending_ && !heap->IsTearingDown()) {
     v8::Isolate* isolate = reinterpret_cast<v8::Isolate*>(heap->isolate());
     if (V8::GetCurrentPlatform()->IdleTasksEnabled(isolate)) {
       idle_task_pending_ = true;
diff --git a/deps/v8/src/heap/scavenge-job.h b/deps/v8/src/heap/scavenge-job.h
index e84659c6d4a..34f7bfafc36 100644
--- a/deps/v8/src/heap/scavenge-job.h
+++ b/deps/v8/src/heap/scavenge-job.h
@@ -64,7 +64,7 @@ class V8_EXPORT_PRIVATE ScavengeJob {
   static const int kAverageIdleTimeMs = 5;
   // The number of bytes to be allocated in new space before the next idle
   // task is posted.
-  static const size_t kBytesAllocatedBeforeNextIdleTask = 512 * KB;
+  static const size_t kBytesAllocatedBeforeNextIdleTask = 1024 * KB;
   // The minimum size of allocated new space objects to trigger a scavenge.
   static const size_t kMinAllocationLimit = 512 * KB;
   // The allocation limit cannot exceed this fraction of the new space capacity.
diff --git a/deps/v8/src/heap/scavenger-inl.h b/deps/v8/src/heap/scavenger-inl.h
index b61872074ef..4b07f16d119 100644
--- a/deps/v8/src/heap/scavenger-inl.h
+++ b/deps/v8/src/heap/scavenger-inl.h
@@ -6,6 +6,7 @@
 #define V8_HEAP_SCAVENGER_INL_H_
 
 #include "src/heap/scavenger.h"
+#include "src/objects-inl.h"
 #include "src/objects/map.h"
 
 namespace v8 {
@@ -30,13 +31,13 @@ bool Scavenger::ContainsOnlyData(VisitorId visitor_id) {
   return false;
 }
 
-void Scavenger::PageMemoryFence(Object* object) {
+void Scavenger::PageMemoryFence(MaybeObject* object) {
 #ifdef THREAD_SANITIZER
   // Perform a dummy acquire load to tell TSAN that there is no data race
   // with  page initialization.
-  if (object->IsHeapObject()) {
-    MemoryChunk* chunk =
-        MemoryChunk::FromAddress(HeapObject::cast(object)->address());
+  HeapObject* heap_object;
+  if (object->ToStrongOrWeakHeapObject(&heap_object)) {
+    MemoryChunk* chunk = MemoryChunk::FromAddress(heap_object->address());
     CHECK_NOT_NULL(chunk->synchronized_heap());
   }
 #endif
@@ -68,10 +69,10 @@ bool Scavenger::MigrateObject(Map* map, HeapObject* source, HeapObject* target,
   return true;
 }
 
-bool Scavenger::SemiSpaceCopyObject(Map* map, HeapObject** slot,
+bool Scavenger::SemiSpaceCopyObject(Map* map, HeapObjectReference** slot,
                                     HeapObject* object, int object_size) {
   DCHECK(heap()->AllowedToBeMigrated(object, NEW_SPACE));
-  AllocationAlignment alignment = object->RequiredAlignment();
+  AllocationAlignment alignment = HeapObject::RequiredAlignment(map);
   AllocationResult allocation =
       allocator_.Allocate(NEW_SPACE, object_size, alignment);
 
@@ -83,10 +84,10 @@ bool Scavenger::SemiSpaceCopyObject(Map* map, HeapObject** slot,
     if (!self_success) {
       allocator_.FreeLast(NEW_SPACE, target, object_size);
       MapWord map_word = object->map_word();
-      *slot = map_word.ToForwardingAddress();
+      HeapObjectReference::Update(slot, map_word.ToForwardingAddress());
       return true;
     }
-    *slot = target;
+    HeapObjectReference::Update(slot, target);
 
     copied_list_.Push(ObjectAndSize(target, object_size));
     copied_size_ += object_size;
@@ -95,9 +96,9 @@ bool Scavenger::SemiSpaceCopyObject(Map* map, HeapObject** slot,
   return false;
 }
 
-bool Scavenger::PromoteObject(Map* map, HeapObject** slot, HeapObject* object,
-                              int object_size) {
-  AllocationAlignment alignment = object->RequiredAlignment();
+bool Scavenger::PromoteObject(Map* map, HeapObjectReference** slot,
+                              HeapObject* object, int object_size) {
+  AllocationAlignment alignment = HeapObject::RequiredAlignment(map);
   AllocationResult allocation =
       allocator_.Allocate(OLD_SPACE, object_size, alignment);
 
@@ -109,11 +110,10 @@ bool Scavenger::PromoteObject(Map* map, HeapObject** slot, HeapObject* object,
     if (!self_success) {
       allocator_.FreeLast(OLD_SPACE, target, object_size);
       MapWord map_word = object->map_word();
-      *slot = map_word.ToForwardingAddress();
+      HeapObjectReference::Update(slot, map_word.ToForwardingAddress());
       return true;
     }
-    *slot = target;
-
+    HeapObjectReference::Update(slot, target);
     if (!ContainsOnlyData(map->visitor_id())) {
       promotion_list_.Push(ObjectAndSize(target, object_size));
     }
@@ -123,7 +123,7 @@ bool Scavenger::PromoteObject(Map* map, HeapObject** slot, HeapObject* object,
   return false;
 }
 
-void Scavenger::EvacuateObjectDefault(Map* map, HeapObject** slot,
+void Scavenger::EvacuateObjectDefault(Map* map, HeapObjectReference** slot,
                                       HeapObject* object, int object_size) {
   SLOW_DCHECK(object_size <= Page::kAllocatableMemory);
   SLOW_DCHECK(object->SizeFromMap(map) == object_size);
@@ -139,7 +139,7 @@ void Scavenger::EvacuateObjectDefault(Map* map, HeapObject** slot,
   // If promotion failed, we try to copy the object to the other semi-space
   if (SemiSpaceCopyObject(map, slot, object, object_size)) return;
 
-  FatalProcessOutOfMemory("Scavenger: semi-space copy\n");
+  heap()->FatalProcessOutOfMemory("Scavenger: semi-space copy");
 }
 
 void Scavenger::EvacuateThinString(Map* map, HeapObject** slot,
@@ -157,7 +157,8 @@ void Scavenger::EvacuateThinString(Map* map, HeapObject** slot,
     return;
   }
 
-  EvacuateObjectDefault(map, slot, object, object_size);
+  EvacuateObjectDefault(map, reinterpret_cast<HeapObjectReference**>(slot),
+                        object, object_size);
 }
 
 void Scavenger::EvacuateShortcutCandidate(Map* map, HeapObject** slot,
@@ -187,17 +188,19 @@ void Scavenger::EvacuateShortcutCandidate(Map* map, HeapObject** slot,
       return;
     }
     Map* map = first_word.ToMap();
-    EvacuateObjectDefault(map, slot, first, first->SizeFromMap(map));
+    EvacuateObjectDefault(map, reinterpret_cast<HeapObjectReference**>(slot),
+                          first, first->SizeFromMap(map));
     base::AsAtomicPointer::Relaxed_Store(
         reinterpret_cast<Map**>(object->address()),
         MapWord::FromForwardingAddress(*slot).ToMap());
     return;
   }
 
-  EvacuateObjectDefault(map, slot, object, object_size);
+  EvacuateObjectDefault(map, reinterpret_cast<HeapObjectReference**>(slot),
+                        object, object_size);
 }
 
-void Scavenger::EvacuateObject(HeapObject** slot, Map* map,
+void Scavenger::EvacuateObject(HeapObjectReference** slot, Map* map,
                                HeapObject* source) {
   SLOW_DCHECK(heap_->InFromSpace(source));
   SLOW_DCHECK(!MapWord::FromMap(map).IsForwardingAddress());
@@ -206,11 +209,15 @@ void Scavenger::EvacuateObject(HeapObject** slot, Map* map,
   // that require re-reading the map.
   switch (map->visitor_id()) {
     case kVisitThinString:
-      EvacuateThinString(map, slot, reinterpret_cast<ThinString*>(source),
-                         size);
+      // At the moment we don't allow weak pointers to thin strings.
+      DCHECK(!(*slot)->IsWeakHeapObject());
+      EvacuateThinString(map, reinterpret_cast<HeapObject**>(slot),
+                         reinterpret_cast<ThinString*>(source), size);
       break;
     case kVisitShortcutCandidate:
-      EvacuateShortcutCandidate(map, slot,
+      DCHECK(!(*slot)->IsWeakHeapObject());
+      // At the moment we don't allow weak pointers to cons strings.
+      EvacuateShortcutCandidate(map, reinterpret_cast<HeapObject**>(slot),
                                 reinterpret_cast<ConsString*>(source), size);
       break;
     default:
@@ -219,7 +226,7 @@ void Scavenger::EvacuateObject(HeapObject** slot, Map* map,
   }
 }
 
-void Scavenger::ScavengeObject(HeapObject** p, HeapObject* object) {
+void Scavenger::ScavengeObject(HeapObjectReference** p, HeapObject* object) {
   DCHECK(heap()->InFromSpace(object));
 
   // Synchronized load that consumes the publishing CAS of MigrateObject.
@@ -229,8 +236,13 @@ void Scavenger::ScavengeObject(HeapObject** p, HeapObject* object) {
   // copied.
   if (first_word.IsForwardingAddress()) {
     HeapObject* dest = first_word.ToForwardingAddress();
-    DCHECK(object->GetIsolate()->heap()->InFromSpace(*p));
-    base::AsAtomicPointer::Relaxed_Store(p, dest);
+    DCHECK(heap()->InFromSpace(*p));
+    if ((*p)->IsWeakHeapObject()) {
+      *p = HeapObjectReference::Weak(dest);
+    } else {
+      DCHECK((*p)->IsStrongHeapObject());
+      *p = HeapObjectReference::Strong(dest);
+    }
     return;
   }
 
@@ -243,13 +255,16 @@ void Scavenger::ScavengeObject(HeapObject** p, HeapObject* object) {
 
 SlotCallbackResult Scavenger::CheckAndScavengeObject(Heap* heap,
                                                      Address slot_address) {
-  Object** slot = reinterpret_cast<Object**>(slot_address);
-  Object* object = *slot;
+  MaybeObject** slot = reinterpret_cast<MaybeObject**>(slot_address);
+  MaybeObject* object = *slot;
   if (heap->InFromSpace(object)) {
-    HeapObject* heap_object = reinterpret_cast<HeapObject*>(object);
+    HeapObject* heap_object;
+    bool success = object->ToStrongOrWeakHeapObject(&heap_object);
+    USE(success);
+    DCHECK(success);
     DCHECK(heap_object->IsHeapObject());
 
-    ScavengeObject(reinterpret_cast<HeapObject**>(slot), heap_object);
+    ScavengeObject(reinterpret_cast<HeapObjectReference**>(slot), heap_object);
 
     object = *slot;
     // If the object was in from space before and is after executing the
@@ -275,11 +290,27 @@ void ScavengeVisitor::VisitPointers(HeapObject* host, Object** start,
   for (Object** p = start; p < end; p++) {
     Object* object = *p;
     if (!heap_->InNewSpace(object)) continue;
-    scavenger_->ScavengeObject(reinterpret_cast<HeapObject**>(p),
+    scavenger_->ScavengeObject(reinterpret_cast<HeapObjectReference**>(p),
                                reinterpret_cast<HeapObject*>(object));
   }
 }
 
+void ScavengeVisitor::VisitPointers(HeapObject* host, MaybeObject** start,
+                                    MaybeObject** end) {
+  for (MaybeObject** p = start; p < end; p++) {
+    MaybeObject* object = *p;
+    if (!heap_->InNewSpace(object)) continue;
+    // Treat the weak reference as strong.
+    HeapObject* heap_object;
+    if (object->ToStrongOrWeakHeapObject(&heap_object)) {
+      scavenger_->ScavengeObject(reinterpret_cast<HeapObjectReference**>(p),
+                                 heap_object);
+    } else {
+      UNREACHABLE();
+    }
+  }
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/heap/scavenger.cc b/deps/v8/src/heap/scavenger.cc
index be5fb87a90d..cd6c5347040 100644
--- a/deps/v8/src/heap/scavenger.cc
+++ b/deps/v8/src/heap/scavenger.cc
@@ -23,34 +23,53 @@ class IterateAndScavengePromotedObjectsVisitor final : public ObjectVisitor {
 
   inline void VisitPointers(HeapObject* host, Object** start,
                             Object** end) final {
-    for (Address slot_address = reinterpret_cast<Address>(start);
-         slot_address < reinterpret_cast<Address>(end);
-         slot_address += kPointerSize) {
-      Object** slot = reinterpret_cast<Object**>(slot_address);
+    for (Object** slot = start; slot < end; ++slot) {
       Object* target = *slot;
-      scavenger_->PageMemoryFence(target);
-
+      DCHECK(!HasWeakHeapObjectTag(target));
       if (target->IsHeapObject()) {
-        if (heap_->InFromSpace(target)) {
-          scavenger_->ScavengeObject(reinterpret_cast<HeapObject**>(slot),
-                                     HeapObject::cast(target));
-          target = *slot;
-          scavenger_->PageMemoryFence(target);
-
-          if (heap_->InNewSpace(target)) {
-            SLOW_DCHECK(target->IsHeapObject());
-            SLOW_DCHECK(heap_->InToSpace(target));
-            RememberedSet<OLD_TO_NEW>::Insert(Page::FromAddress(slot_address),
-                                              slot_address);
-          }
-          SLOW_DCHECK(!MarkCompactCollector::IsOnEvacuationCandidate(
-              HeapObject::cast(target)));
-        } else if (record_slots_ &&
-                   MarkCompactCollector::IsOnEvacuationCandidate(
-                       HeapObject::cast(target))) {
-          heap_->mark_compact_collector()->RecordSlot(host, slot, target);
-        }
+        HandleSlot(host, reinterpret_cast<Address>(slot),
+                   HeapObject::cast(target));
+      }
+    }
+  }
+
+  inline void VisitPointers(HeapObject* host, MaybeObject** start,
+                            MaybeObject** end) final {
+    // Treat weak references as strong. TODO(marja): Proper weakness handling in
+    // the young generation.
+    for (MaybeObject** slot = start; slot < end; ++slot) {
+      MaybeObject* target = *slot;
+      HeapObject* heap_object;
+      if (target->ToStrongOrWeakHeapObject(&heap_object)) {
+        HandleSlot(host, reinterpret_cast<Address>(slot), heap_object);
+      }
+    }
+  }
+
+  inline void HandleSlot(HeapObject* host, Address slot_address,
+                         HeapObject* target) {
+    HeapObjectReference** slot =
+        reinterpret_cast<HeapObjectReference**>(slot_address);
+    scavenger_->PageMemoryFence(reinterpret_cast<MaybeObject*>(target));
+
+    if (heap_->InFromSpace(target)) {
+      scavenger_->ScavengeObject(slot, target);
+      bool success = (*slot)->ToStrongOrWeakHeapObject(&target);
+      USE(success);
+      DCHECK(success);
+      scavenger_->PageMemoryFence(reinterpret_cast<MaybeObject*>(target));
+
+      if (heap_->InNewSpace(target)) {
+        SLOW_DCHECK(target->IsHeapObject());
+        SLOW_DCHECK(heap_->InToSpace(target));
+        RememberedSet<OLD_TO_NEW>::Insert(Page::FromAddress(slot_address),
+                                          slot_address);
       }
+      SLOW_DCHECK(!MarkCompactCollector::IsOnEvacuationCandidate(
+          HeapObject::cast(target)));
+    } else if (record_slots_ && MarkCompactCollector::IsOnEvacuationCandidate(
+                                    HeapObject::cast(target))) {
+      heap_->mark_compact_collector()->RecordSlot(host, slot, target);
     }
   }
 
@@ -84,7 +103,7 @@ void Scavenger::IterateAndScavengePromotedObject(HeapObject* target, int size) {
       is_compacting_ &&
       heap()->incremental_marking()->atomic_marking_state()->IsBlack(target);
   IterateAndScavengePromotedObjectsVisitor visitor(heap(), this, record_slots);
-  target->IterateBody(target->map()->instance_type(), size, &visitor);
+  target->IterateBodyFast(target->map(), size, &visitor);
 }
 
 void Scavenger::AddPageToSweeperIfNecessary(MemoryChunk* page) {
@@ -97,6 +116,7 @@ void Scavenger::AddPageToSweeperIfNecessary(MemoryChunk* page) {
 }
 
 void Scavenger::ScavengePage(MemoryChunk* page) {
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"), "Scavenger::ScavengePage");
   CodePageMemoryModificationScope memory_modification_scope(page);
   RememberedSet<OLD_TO_NEW>::Iterate(
       page,
@@ -105,7 +125,7 @@ void Scavenger::ScavengePage(MemoryChunk* page) {
   RememberedSet<OLD_TO_NEW>::IterateTyped(
       page, [this](SlotType type, Address host_addr, Address addr) {
         return UpdateTypedSlotHelper::UpdateTypedSlot(
-            heap_->isolate(), type, addr, [this](Object** addr) {
+            heap_->isolate(), type, addr, [this](MaybeObject** addr) {
               return CheckAndScavengeObject(heap(),
                                             reinterpret_cast<Address>(addr));
             });
@@ -115,6 +135,7 @@ void Scavenger::ScavengePage(MemoryChunk* page) {
 }
 
 void Scavenger::Process(OneshotBarrier* barrier) {
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"), "Scavenger::Process");
   // Threshold when to switch processing the promotion list to avoid
   // allocating too much backing store in the worklist.
   const int kProcessPromotionListThreshold = kPromotionListSegmentSize / 2;
@@ -160,21 +181,24 @@ void Scavenger::Finalize() {
   allocator_.Finalize();
 }
 
-void RootScavengeVisitor::VisitRootPointer(Root root, Object** p) {
+void RootScavengeVisitor::VisitRootPointer(Root root, const char* description,
+                                           Object** p) {
+  DCHECK(!HasWeakHeapObjectTag(*p));
   ScavengePointer(p);
 }
 
-void RootScavengeVisitor::VisitRootPointers(Root root, Object** start,
-                                            Object** end) {
+void RootScavengeVisitor::VisitRootPointers(Root root, const char* description,
+                                            Object** start, Object** end) {
   // Copy all HeapObject pointers in [start, end)
   for (Object** p = start; p < end; p++) ScavengePointer(p);
 }
 
 void RootScavengeVisitor::ScavengePointer(Object** p) {
   Object* object = *p;
+  DCHECK(!HasWeakHeapObjectTag(object));
   if (!heap_->InNewSpace(object)) return;
 
-  scavenger_->ScavengeObject(reinterpret_cast<HeapObject**>(p),
+  scavenger_->ScavengeObject(reinterpret_cast<HeapObjectReference**>(p),
                              reinterpret_cast<HeapObject*>(object));
 }
 
diff --git a/deps/v8/src/heap/scavenger.h b/deps/v8/src/heap/scavenger.h
index 27ae2e8ab74..de2f49f0e20 100644
--- a/deps/v8/src/heap/scavenger.h
+++ b/deps/v8/src/heap/scavenger.h
@@ -50,7 +50,7 @@ class Scavenger {
 
   inline Heap* heap() { return heap_; }
 
-  inline void PageMemoryFence(Object* object);
+  inline void PageMemoryFence(MaybeObject* object);
 
   void AddPageToSweeperIfNecessary(MemoryChunk* page);
 
@@ -61,24 +61,24 @@ class Scavenger {
 
   // Scavenges an object |object| referenced from slot |p|. |object| is required
   // to be in from space.
-  inline void ScavengeObject(HeapObject** p, HeapObject* object);
+  inline void ScavengeObject(HeapObjectReference** p, HeapObject* object);
 
   // Copies |source| to |target| and sets the forwarding pointer in |source|.
   V8_INLINE bool MigrateObject(Map* map, HeapObject* source, HeapObject* target,
                                int size);
 
-  V8_INLINE bool SemiSpaceCopyObject(Map* map, HeapObject** slot,
+  V8_INLINE bool SemiSpaceCopyObject(Map* map, HeapObjectReference** slot,
                                      HeapObject* object, int object_size);
 
-  V8_INLINE bool PromoteObject(Map* map, HeapObject** slot, HeapObject* object,
-                               int object_size);
+  V8_INLINE bool PromoteObject(Map* map, HeapObjectReference** slot,
+                               HeapObject* object, int object_size);
 
-  V8_INLINE void EvacuateObject(HeapObject** slot, Map* map,
+  V8_INLINE void EvacuateObject(HeapObjectReference** slot, Map* map,
                                 HeapObject* source);
 
   // Different cases for object evacuation.
 
-  V8_INLINE void EvacuateObjectDefault(Map* map, HeapObject** slot,
+  V8_INLINE void EvacuateObjectDefault(Map* map, HeapObjectReference** slot,
                                        HeapObject* object, int object_size);
 
   V8_INLINE void EvacuateJSFunction(Map* map, HeapObject** slot,
@@ -117,8 +117,9 @@ class RootScavengeVisitor final : public RootVisitor {
   RootScavengeVisitor(Heap* heap, Scavenger* scavenger)
       : heap_(heap), scavenger_(scavenger) {}
 
-  void VisitRootPointer(Root root, Object** p) final;
-  void VisitRootPointers(Root root, Object** start, Object** end) final;
+  void VisitRootPointer(Root root, const char* description, Object** p) final;
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) final;
 
  private:
   void ScavengePointer(Object** p);
@@ -134,6 +135,8 @@ class ScavengeVisitor final : public NewSpaceVisitor<ScavengeVisitor> {
 
   V8_INLINE void VisitPointers(HeapObject* host, Object** start,
                                Object** end) final;
+  V8_INLINE void VisitPointers(HeapObject* host, MaybeObject** start,
+                               MaybeObject** end) final;
 
  private:
   Heap* const heap_;
diff --git a/deps/v8/src/heap/setup-heap-internal.cc b/deps/v8/src/heap/setup-heap-internal.cc
index 9e2d7e6354a..1753f4f9c09 100644
--- a/deps/v8/src/heap/setup-heap-internal.cc
+++ b/deps/v8/src/heap/setup-heap-internal.cc
@@ -27,6 +27,7 @@
 #include "src/objects/shared-function-info.h"
 #include "src/objects/string.h"
 #include "src/regexp/jsregexp.h"
+#include "src/wasm/wasm-objects.h"
 
 namespace v8 {
 namespace internal {
@@ -112,6 +113,8 @@ bool Heap::CreateInitialMaps() {
     }
 
     ALLOCATE_PARTIAL_MAP(FIXED_ARRAY_TYPE, kVariableSizeSentinel, fixed_array);
+    ALLOCATE_PARTIAL_MAP(WEAK_FIXED_ARRAY_TYPE, kVariableSizeSentinel,
+                         weak_fixed_array);
     ALLOCATE_PARTIAL_MAP(FIXED_ARRAY_TYPE, kVariableSizeSentinel,
                          fixed_cow_array)
     DCHECK_NE(fixed_array_map(), fixed_cow_array_map());
@@ -133,6 +136,12 @@ bool Heap::CreateInitialMaps() {
   }
   set_empty_fixed_array(FixedArray::cast(obj));
 
+  {
+    AllocationResult allocation = AllocateEmptyWeakFixedArray();
+    if (!allocation.To(&obj)) return false;
+  }
+  set_empty_weak_fixed_array(WeakFixedArray::cast(obj));
+
   {
     AllocationResult allocation = Allocate(null_map(), OLD_SPACE);
     if (!allocation.To(&obj)) return false;
@@ -191,6 +200,7 @@ bool Heap::CreateInitialMaps() {
   // Fix the instance_descriptors for the existing maps.
   FinalizePartialMap(this, meta_map());
   FinalizePartialMap(this, fixed_array_map());
+  FinalizePartialMap(this, weak_fixed_array_map());
   FinalizePartialMap(this, fixed_cow_array_map());
   FinalizePartialMap(this, descriptor_array_map());
   FinalizePartialMap(this, undefined_map());
@@ -222,7 +232,7 @@ bool Heap::CreateInitialMaps() {
           (constructor_function_index));                          \
     }
 
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, scope_info)
+    ALLOCATE_VARSIZE_MAP(SCOPE_INFO_TYPE, scope_info)
     ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, module_info)
     ALLOCATE_VARSIZE_MAP(FEEDBACK_VECTOR_TYPE, feedback_vector)
     ALLOCATE_PRIMITIVE_MAP(HEAP_NUMBER_TYPE, HeapNumber::kSize, heap_number,
@@ -269,6 +279,7 @@ bool Heap::CreateInitialMaps() {
 
     ALLOCATE_VARSIZE_MAP(FIXED_DOUBLE_ARRAY_TYPE, fixed_double_array)
     fixed_double_array_map()->set_elements_kind(HOLEY_DOUBLE_ELEMENTS);
+    ALLOCATE_VARSIZE_MAP(FEEDBACK_METADATA_TYPE, feedback_metadata)
     ALLOCATE_VARSIZE_MAP(BYTE_ARRAY_TYPE, byte_array)
     ALLOCATE_VARSIZE_MAP(BYTECODE_ARRAY_TYPE, bytecode_array)
     ALLOCATE_VARSIZE_MAP(FREE_SPACE_TYPE, free_space)
@@ -286,15 +297,28 @@ bool Heap::CreateInitialMaps() {
 
     ALLOCATE_VARSIZE_MAP(CODE_TYPE, code)
 
-    ALLOCATE_MAP(CELL_TYPE, Cell::kSize, cell)
+    ALLOCATE_MAP(CELL_TYPE, Cell::kSize, cell);
+    {
+      // The invalid_prototype_validity_cell is needed for JSObject maps.
+      Smi* value = Smi::FromInt(Map::kPrototypeChainInvalid);
+      Cell* cell;
+      if (!AllocateCell(value).To(&cell)) return false;
+      set_invalid_prototype_validity_cell(cell);
+    }
+
     ALLOCATE_MAP(PROPERTY_CELL_TYPE, PropertyCell::kSize, global_property_cell)
     ALLOCATE_MAP(WEAK_CELL_TYPE, WeakCell::kSize, weak_cell)
-    ALLOCATE_MAP(CELL_TYPE, Cell::kSize, no_closures_cell)
-    ALLOCATE_MAP(CELL_TYPE, Cell::kSize, one_closure_cell)
-    ALLOCATE_MAP(CELL_TYPE, Cell::kSize, many_closures_cell)
     ALLOCATE_MAP(FILLER_TYPE, kPointerSize, one_pointer_filler)
     ALLOCATE_MAP(FILLER_TYPE, 2 * kPointerSize, two_pointer_filler)
 
+    // The "no closures" and "one closure" FeedbackCell maps need
+    // to be marked unstable because their objects can change maps.
+    ALLOCATE_MAP(FEEDBACK_CELL_TYPE, FeedbackCell::kSize, no_closures_cell)
+    no_closures_cell_map()->mark_unstable();
+    ALLOCATE_MAP(FEEDBACK_CELL_TYPE, FeedbackCell::kSize, one_closure_cell)
+    one_closure_cell_map()->mark_unstable();
+    ALLOCATE_MAP(FEEDBACK_CELL_TYPE, FeedbackCell::kSize, many_closures_cell)
+
     ALLOCATE_VARSIZE_MAP(TRANSITION_ARRAY_TYPE, transition_array)
 
     ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, hash_table)
@@ -303,22 +327,24 @@ bool Heap::CreateInitialMaps() {
     ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, name_dictionary)
     ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, global_dictionary)
     ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, number_dictionary)
+    ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, simple_number_dictionary)
     ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, string_table)
-    ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, weak_hash_table)
 
     ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, array_list)
 
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, function_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, catch_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, with_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, debug_evaluate_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, block_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, module_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, eval_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, script_context)
+    ALLOCATE_VARSIZE_MAP(FUNCTION_CONTEXT_TYPE, function_context)
+    ALLOCATE_VARSIZE_MAP(CATCH_CONTEXT_TYPE, catch_context)
+    ALLOCATE_VARSIZE_MAP(WITH_CONTEXT_TYPE, with_context)
+    ALLOCATE_VARSIZE_MAP(DEBUG_EVALUATE_CONTEXT_TYPE, debug_evaluate_context)
+    ALLOCATE_VARSIZE_MAP(BLOCK_CONTEXT_TYPE, block_context)
+    ALLOCATE_VARSIZE_MAP(MODULE_CONTEXT_TYPE, module_context)
+    ALLOCATE_VARSIZE_MAP(EVAL_CONTEXT_TYPE, eval_context)
+    ALLOCATE_VARSIZE_MAP(SCRIPT_CONTEXT_TYPE, script_context)
     ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, script_context_table)
 
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, native_context)
+    ALLOCATE_VARSIZE_MAP(BOILERPLATE_DESCRIPTION_TYPE, boilerplate_description)
+
+    ALLOCATE_VARSIZE_MAP(NATIVE_CONTEXT_TYPE, native_context)
     native_context_map()->set_visitor_id(kVisitNativeContext);
 
     ALLOCATE_MAP(SHARED_FUNCTION_INFO_TYPE, SharedFunctionInfo::kAlignedSize,
@@ -339,8 +365,14 @@ bool Heap::CreateInitialMaps() {
     AllocationResult allocation = AllocateEmptyScopeInfo();
     if (!allocation.To(&obj)) return false;
   }
-
   set_empty_scope_info(ScopeInfo::cast(obj));
+
+  {
+    AllocationResult allocation = AllocateEmptyBoilerplateDescription();
+    if (!allocation.To(&obj)) return false;
+  }
+  set_empty_boilerplate_description(BoilerplateDescription::cast(obj));
+
   {
     AllocationResult allocation = Allocate(boolean_map(), OLD_SPACE);
     if (!allocation.To(&obj)) return false;
@@ -475,7 +507,7 @@ void Heap::CreateInitialObjects() {
 
   // Create the code_stubs dictionary. The initial size is set to avoid
   // expanding the dictionary during bootstrapping.
-  set_code_stubs(*NumberDictionary::New(isolate(), 128));
+  set_code_stubs(*SimpleNumberDictionary::New(isolate(), 128));
 
   {
     HandleScope scope(isolate());
@@ -533,7 +565,10 @@ void Heap::CreateInitialObjects() {
   set_regexp_multiple_cache(*factory->NewFixedArray(
       RegExpResultsCache::kRegExpResultsCacheSize, TENURED));
 
-  set_undefined_cell(*factory->NewCell(factory->undefined_value()));
+  // Allocate FeedbackCell for builtins.
+  Handle<FeedbackCell> many_closures_cell =
+      factory->NewManyClosuresCell(factory->undefined_value());
+  set_many_closures_cell(*many_closures_cell);
 
   // Microtask queue uses the empty fixed array as a sentinel for "empty".
   // Number of queued microtasks stored in Isolate::pending_microtask_count().
@@ -557,10 +592,6 @@ void Heap::CreateInitialObjects() {
   set_retained_maps(ArrayList::cast(empty_fixed_array()));
   set_retaining_path_targets(undefined_value());
 
-  set_weak_object_to_code_table(*WeakHashTable::New(isolate(), 16, TENURED));
-
-  set_weak_new_space_object_to_code_list(*ArrayList::New(isolate(), 16));
-
   set_feedback_vectors_for_profiling_tools(undefined_value());
 
   set_script_list(Smi::kZero);
@@ -575,6 +606,7 @@ void Heap::CreateInitialObjects() {
 
   // Handling of script id generation is in Heap::NextScriptId().
   set_last_script_id(Smi::FromInt(v8::UnboundScript::kNoScriptId));
+  set_last_debugging_id(Smi::FromInt(SharedFunctionInfo::kNoDebuggingId));
   set_next_template_serial_number(Smi::kZero);
 
   // Allocate the empty OrderedHashMap.
@@ -597,6 +629,11 @@ void Heap::CreateInitialObjects() {
   }
   set_empty_ordered_hash_set(*empty_ordered_hash_set);
 
+  // Allocate the empty FeedbackMetadata.
+  Handle<FeedbackMetadata> empty_feedback_metadata =
+      factory->NewFeedbackMetadata(0);
+  set_empty_feedback_metadata(*empty_feedback_metadata);
+
   // Allocate the empty script.
   Handle<Script> script = factory->NewScript(factory->empty_string());
   script->set_type(Script::TYPE_NATIVE);
@@ -630,13 +667,21 @@ void Heap::CreateInitialObjects() {
       handle(Smi::FromInt(Isolate::kProtectorValid), isolate()));
   set_string_length_protector(*string_length_overflow_cell);
 
-  Handle<Cell> fast_array_iteration_cell = factory->NewCell(
+  cell = factory->NewPropertyCell(factory->empty_string());
+  cell->set_value(Smi::FromInt(Isolate::kProtectorValid));
+  set_array_buffer_neutering_protector(*cell);
+
+  cell = factory->NewPropertyCell(factory->empty_string());
+  cell->set_value(Smi::FromInt(Isolate::kProtectorValid));
+  set_promise_hook_protector(*cell);
+
+  Handle<Cell> promise_resolve_cell = factory->NewCell(
       handle(Smi::FromInt(Isolate::kProtectorValid), isolate()));
-  set_fast_array_iteration_protector(*fast_array_iteration_cell);
+  set_promise_resolve_protector(*promise_resolve_cell);
 
   cell = factory->NewPropertyCell(factory->empty_string());
   cell->set_value(Smi::FromInt(Isolate::kProtectorValid));
-  set_array_buffer_neutering_protector(*cell);
+  set_promise_then_protector(*cell);
 
   set_serialized_objects(empty_fixed_array());
   set_serialized_global_proxy_sizes(empty_fixed_array());
@@ -650,6 +695,9 @@ void Heap::CreateInitialObjects() {
   set_deserialize_lazy_handler_wide(Smi::kZero);
   set_deserialize_lazy_handler_extra_wide(Smi::kZero);
 
+  // Initialize builtins constants table.
+  set_builtins_constants_table(empty_fixed_array());
+
   // Initialize context slot cache.
   isolate_->context_slot_cache()->Clear();
 
@@ -670,6 +718,12 @@ void Heap::CreateInternalAccessorInfoObjects() {
   roots_[k##AccessorName##AccessorRootIndex] = *acessor_info;
   ACCESSOR_INFO_LIST(INIT_ACCESSOR_INFO)
 #undef INIT_ACCESSOR_INFO
+
+#define INIT_SIDE_EFFECT_FLAG(AccessorName)                      \
+  AccessorInfo::cast(roots_[k##AccessorName##AccessorRootIndex]) \
+      ->set_has_no_side_effect(true);
+  SIDE_EFFECT_FREE_ACCESSOR_INFO_LIST(INIT_SIDE_EFFECT_FLAG)
+#undef INIT_SIDE_EFFECT_FLAG
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/slot-set.h b/deps/v8/src/heap/slot-set.h
index f1edb6f2fb4..7423665bcbf 100644
--- a/deps/v8/src/heap/slot-set.h
+++ b/deps/v8/src/heap/slot-set.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_SLOT_SET_H
-#define V8_SLOT_SET_H
+#ifndef V8_HEAP_SLOT_SET_H_
+#define V8_HEAP_SLOT_SET_H_
 
 #include <map>
 #include <stack>
@@ -641,4 +641,4 @@ class TypedSlotSet {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_SLOT_SET_H
+#endif  // V8_HEAP_SLOT_SET_H_
diff --git a/deps/v8/src/heap/spaces-inl.h b/deps/v8/src/heap/spaces-inl.h
index 39a62327dfe..498c34bd545 100644
--- a/deps/v8/src/heap/spaces-inl.h
+++ b/deps/v8/src/heap/spaces-inl.h
@@ -5,6 +5,7 @@
 #ifndef V8_HEAP_SPACES_INL_H_
 #define V8_HEAP_SPACES_INL_H_
 
+#include "src/base/v8-fallthrough.h"
 #include "src/heap/incremental-marking.h"
 #include "src/heap/spaces.h"
 #include "src/msan.h"
@@ -137,12 +138,6 @@ bool NewSpace::FromSpaceContainsSlow(Address a) {
 bool NewSpace::ToSpaceContains(Object* o) { return to_space_.Contains(o); }
 bool NewSpace::FromSpaceContains(Object* o) { return from_space_.Contains(o); }
 
-void MemoryChunk::InitializeFreeListCategories() {
-  for (int i = kFirstCategory; i < kNumberOfCategories; i++) {
-    categories_[i].Initialize(static_cast<FreeListCategoryType>(i));
-  }
-}
-
 bool PagedSpace::Contains(Address addr) {
   if (heap_->lo_space()->FindPage(addr)) return false;
   return MemoryChunk::FromAnyPointerAddress(heap(), addr)->owner() == this;
@@ -157,6 +152,7 @@ void PagedSpace::UnlinkFreeListCategories(Page* page) {
   DCHECK_EQ(this, page->owner());
   page->ForAllFreeListCategories([this](FreeListCategory* category) {
     DCHECK_EQ(free_list(), category->owner());
+    category->set_free_list(nullptr);
     free_list()->RemoveCategory(category);
   });
 }
@@ -164,7 +160,8 @@ void PagedSpace::UnlinkFreeListCategories(Page* page) {
 size_t PagedSpace::RelinkFreeListCategories(Page* page) {
   DCHECK_EQ(this, page->owner());
   size_t added = 0;
-  page->ForAllFreeListCategories([&added](FreeListCategory* category) {
+  page->ForAllFreeListCategories([this, &added](FreeListCategory* category) {
+    category->set_free_list(&free_list_);
     added += category->available();
     category->Relink();
   });
@@ -230,23 +227,23 @@ MemoryChunk* MemoryChunkIterator::next() {
     case kOldSpaceState: {
       if (old_iterator_ != heap_->old_space()->end()) return *(old_iterator_++);
       state_ = kMapState;
-      // Fall through.
+      V8_FALLTHROUGH;
     }
     case kMapState: {
       if (map_iterator_ != heap_->map_space()->end()) return *(map_iterator_++);
       state_ = kCodeState;
-      // Fall through.
+      V8_FALLTHROUGH;
     }
     case kCodeState: {
       if (code_iterator_ != heap_->code_space()->end())
         return *(code_iterator_++);
       state_ = kLargeObjectState;
-      // Fall through.
+      V8_FALLTHROUGH;
     }
     case kLargeObjectState: {
       if (lo_iterator_ != heap_->lo_space()->end()) return *(lo_iterator_++);
       state_ = kFinishedState;
-      // Fall through;
+      V8_FALLTHROUGH;
     }
     case kFinishedState:
       return nullptr;
@@ -256,23 +253,14 @@ MemoryChunk* MemoryChunkIterator::next() {
   UNREACHABLE();
 }
 
-Page* FreeListCategory::page() const {
-  return Page::FromAddress(
-      reinterpret_cast<Address>(const_cast<FreeListCategory*>(this)));
-}
-
 Page* FreeList::GetPageForCategoryType(FreeListCategoryType type) {
   return top(type) ? top(type)->page() : nullptr;
 }
 
-FreeList* FreeListCategory::owner() {
-  return reinterpret_cast<PagedSpace*>(
-             Page::FromAddress(reinterpret_cast<Address>(this))->owner())
-      ->free_list();
-}
+FreeList* FreeListCategory::owner() { return free_list_; }
 
 bool FreeListCategory::is_linked() {
-  return prev_ != nullptr || next_ != nullptr || owner()->top(type_) == this;
+  return prev_ != nullptr || next_ != nullptr;
 }
 
 AllocationResult LocalAllocationBuffer::AllocateRawAligned(
diff --git a/deps/v8/src/heap/spaces.cc b/deps/v8/src/heap/spaces.cc
index 2dd5e9b24de..ecbffb35e4b 100644
--- a/deps/v8/src/heap/spaces.cc
+++ b/deps/v8/src/heap/spaces.cc
@@ -9,6 +9,7 @@
 #include "src/base/bits.h"
 #include "src/base/macros.h"
 #include "src/base/platform/semaphore.h"
+#include "src/base/template-utils.h"
 #include "src/counters.h"
 #include "src/heap/array-buffer-tracker.h"
 #include "src/heap/concurrent-marking.h"
@@ -46,7 +47,8 @@ HeapObjectIterator::HeapObjectIterator(Page* page)
   Space* owner = page->owner();
   DCHECK(owner == page->heap()->old_space() ||
          owner == page->heap()->map_space() ||
-         owner == page->heap()->code_space());
+         owner == page->heap()->code_space() ||
+         owner == page->heap()->read_only_space());
 #endif  // DEBUG
 }
 
@@ -71,6 +73,8 @@ bool HeapObjectIterator::AdvanceToNextPage() {
 
 PauseAllocationObserversScope::PauseAllocationObserversScope(Heap* heap)
     : heap_(heap) {
+  DCHECK_EQ(heap->gc_state(), Heap::NOT_IN_GC);
+
   for (SpaceIterator it(heap_); it.has_next();) {
     it.next()->PauseAllocationObservers();
   }
@@ -322,7 +326,12 @@ class MemoryAllocator::Unmapper::UnmapFreeMemoryTask : public CancelableTask {
     TRACE_BACKGROUND_GC(tracer_,
                         GCTracer::BackgroundScope::BACKGROUND_UNMAPPER);
     unmapper_->PerformFreeMemoryOnQueuedChunks<FreeMode::kUncommitPooled>();
+    unmapper_->active_unmapping_tasks_.Decrement(1);
     unmapper_->pending_unmapping_tasks_semaphore_.Signal();
+    if (FLAG_trace_unmapper) {
+      PrintIsolate(unmapper_->heap_->isolate(),
+                   "UnmapFreeMemoryTask Done: id=%" PRIu64 "\n", id());
+    }
   }
 
   Unmapper* const unmapper_;
@@ -331,34 +340,69 @@ class MemoryAllocator::Unmapper::UnmapFreeMemoryTask : public CancelableTask {
 };
 
 void MemoryAllocator::Unmapper::FreeQueuedChunks() {
-  if (heap_->use_tasks() && FLAG_concurrent_sweeping) {
-    if (concurrent_unmapping_tasks_active_ >= kMaxUnmapperTasks) {
+  if (!heap_->IsTearingDown() && FLAG_concurrent_sweeping) {
+    if (!MakeRoomForNewTasks()) {
       // kMaxUnmapperTasks are already running. Avoid creating any more.
+      if (FLAG_trace_unmapper) {
+        PrintIsolate(heap_->isolate(),
+                     "Unmapper::FreeQueuedChunks: reached task limit (%d)\n",
+                     kMaxUnmapperTasks);
+      }
       return;
     }
-    UnmapFreeMemoryTask* task = new UnmapFreeMemoryTask(heap_->isolate(), this);
-    DCHECK_LT(concurrent_unmapping_tasks_active_, kMaxUnmapperTasks);
-    task_ids_[concurrent_unmapping_tasks_active_++] = task->id();
-    V8::GetCurrentPlatform()->CallOnBackgroundThread(
-        task, v8::Platform::kShortRunningTask);
+    auto task = base::make_unique<UnmapFreeMemoryTask>(heap_->isolate(), this);
+    if (FLAG_trace_unmapper) {
+      PrintIsolate(heap_->isolate(),
+                   "Unmapper::FreeQueuedChunks: new task id=%" PRIu64 "\n",
+                   task->id());
+    }
+    DCHECK_LT(pending_unmapping_tasks_, kMaxUnmapperTasks);
+    DCHECK_LE(active_unmapping_tasks_.Value(), pending_unmapping_tasks_);
+    DCHECK_GE(active_unmapping_tasks_.Value(), 0);
+    active_unmapping_tasks_.Increment(1);
+    task_ids_[pending_unmapping_tasks_++] = task->id();
+    V8::GetCurrentPlatform()->CallOnWorkerThread(std::move(task));
   } else {
     PerformFreeMemoryOnQueuedChunks<FreeMode::kUncommitPooled>();
   }
 }
 
 void MemoryAllocator::Unmapper::WaitUntilCompleted() {
-  for (int i = 0; i < concurrent_unmapping_tasks_active_; i++) {
+  for (int i = 0; i < pending_unmapping_tasks_; i++) {
     if (heap_->isolate()->cancelable_task_manager()->TryAbort(task_ids_[i]) !=
         CancelableTaskManager::kTaskAborted) {
       pending_unmapping_tasks_semaphore_.Wait();
     }
   }
-  concurrent_unmapping_tasks_active_ = 0;
+  pending_unmapping_tasks_ = 0;
+  active_unmapping_tasks_.SetValue(0);
+
+  if (FLAG_trace_unmapper) {
+    PrintIsolate(heap_->isolate(),
+                 "Unmapper::WaitUntilCompleted: no tasks remaining\n");
+  }
+}
+
+bool MemoryAllocator::Unmapper::MakeRoomForNewTasks() {
+  DCHECK_LE(pending_unmapping_tasks_, kMaxUnmapperTasks);
+
+  if (active_unmapping_tasks_.Value() == 0 && pending_unmapping_tasks_ > 0) {
+    // All previous unmapping tasks have been run to completion.
+    // Finalize those tasks to make room for new ones.
+    WaitUntilCompleted();
+  }
+  return pending_unmapping_tasks_ != kMaxUnmapperTasks;
 }
 
 template <MemoryAllocator::Unmapper::FreeMode mode>
 void MemoryAllocator::Unmapper::PerformFreeMemoryOnQueuedChunks() {
   MemoryChunk* chunk = nullptr;
+  if (FLAG_trace_unmapper) {
+    PrintIsolate(
+        heap_->isolate(),
+        "Unmapper::PerformFreeMemoryOnQueuedChunks: %d queued chunks\n",
+        NumberOfChunks());
+  }
   // Regular chunks.
   while ((chunk = GetMemoryChunkSafe<kRegular>()) != nullptr) {
     bool pooled = chunk->IsFlagSet(MemoryChunk::POOLED);
@@ -380,7 +424,7 @@ void MemoryAllocator::Unmapper::PerformFreeMemoryOnQueuedChunks() {
 }
 
 void MemoryAllocator::Unmapper::TearDown() {
-  CHECK_EQ(0, concurrent_unmapping_tasks_active_);
+  CHECK_EQ(0, pending_unmapping_tasks_);
   PerformFreeMemoryOnQueuedChunks<FreeMode::kReleasePooled>();
   for (int i = 0; i < kNumberOfChunkQueues; i++) {
     DCHECK(chunks_[i].empty());
@@ -583,9 +627,20 @@ MemoryChunk* MemoryChunk::Initialize(Heap* heap, Address base, size_t size,
   chunk->set_next_chunk(nullptr);
   chunk->set_prev_chunk(nullptr);
   chunk->local_tracker_ = nullptr;
-  chunk->InitializeFreeListCategories();
 
-  heap->incremental_marking()->non_atomic_marking_state()->ClearLiveness(chunk);
+  for (int i = kFirstCategory; i < kNumberOfCategories; i++) {
+    chunk->categories_[i] = nullptr;
+  }
+
+  if (owner->identity() == RO_SPACE) {
+    heap->incremental_marking()
+        ->non_atomic_marking_state()
+        ->bitmap(chunk)
+        ->MarkAllBits();
+  } else {
+    heap->incremental_marking()->non_atomic_marking_state()->ClearLiveness(
+        chunk);
+  }
 
   DCHECK_EQ(kFlagsOffset, OFFSET_OF(MemoryChunk, flags_));
 
@@ -606,6 +661,7 @@ MemoryChunk* MemoryChunk::Initialize(Heap* heap, Address base, size_t size,
   if (reservation != nullptr) {
     chunk->reservation_.TakeControl(reservation);
   }
+
   return chunk;
 }
 
@@ -615,6 +671,8 @@ Page* PagedSpace::InitializePage(MemoryChunk* chunk, Executability executable) {
   // Make sure that categories are initialized before freeing the area.
   page->ResetAllocatedBytes();
   heap()->incremental_marking()->SetOldSpacePageFlags(page);
+  page->AllocateFreeListCategories();
+  page->InitializeFreeListCategories();
   page->InitializationMemoryFence();
   return page;
 }
@@ -662,6 +720,28 @@ LargePage* LargePage::Initialize(Heap* heap, MemoryChunk* chunk,
   return page;
 }
 
+void Page::AllocateFreeListCategories() {
+  for (int i = kFirstCategory; i < kNumberOfCategories; i++) {
+    categories_[i] = new FreeListCategory(
+        reinterpret_cast<PagedSpace*>(owner())->free_list(), this);
+  }
+}
+
+void Page::InitializeFreeListCategories() {
+  for (int i = kFirstCategory; i < kNumberOfCategories; i++) {
+    categories_[i]->Initialize(static_cast<FreeListCategoryType>(i));
+  }
+}
+
+void Page::ReleaseFreeListCategories() {
+  for (int i = kFirstCategory; i < kNumberOfCategories; i++) {
+    if (categories_[i] != nullptr) {
+      delete categories_[i];
+      categories_[i] = nullptr;
+    }
+  }
+}
+
 Page* Page::ConvertNewToOld(Page* old_page) {
   DCHECK(!old_page->is_anchor());
   DCHECK(old_page->InNewSpace());
@@ -679,6 +759,10 @@ size_t MemoryChunk::CommittedPhysicalMemory() {
   return high_water_mark_.Value();
 }
 
+bool MemoryChunk::IsPagedSpace() const {
+  return owner()->identity() != LO_SPACE;
+}
+
 void MemoryChunk::InsertAfter(MemoryChunk* other) {
   MemoryChunk* other_next = other->next_chunk();
 
@@ -710,7 +794,8 @@ MemoryChunk* MemoryAllocator::AllocateChunk(size_t reserve_area_size,
   VirtualMemory reservation;
   Address area_start = nullptr;
   Address area_end = nullptr;
-  void* address_hint = heap->GetRandomMmapAddr();
+  void* address_hint =
+      AlignedAddress(heap->GetRandomMmapAddr(), MemoryChunk::kAlignment);
 
   //
   // MemoryChunk layout:
@@ -826,8 +911,12 @@ MemoryChunk* MemoryAllocator::AllocateChunk(size_t reserve_area_size,
                          owner);
   }
 
-  return MemoryChunk::Initialize(heap, base, chunk_size, area_start, area_end,
-                                 executable, owner, &reservation);
+  MemoryChunk* chunk =
+      MemoryChunk::Initialize(heap, base, chunk_size, area_start, area_end,
+                              executable, owner, &reservation);
+
+  if (chunk->executable()) RegisterExecutableMemoryChunk(chunk);
+  return chunk;
 }
 
 void Page::ResetAllocatedBytes() { allocated_bytes_ = area_size(); }
@@ -970,6 +1059,8 @@ void MemoryAllocator::PreFreeMemory(MemoryChunk* chunk) {
   }
 
   chunk->SetFlag(MemoryChunk::PRE_FREED);
+
+  if (chunk->executable()) UnregisterExecutableMemoryChunk(chunk);
 }
 
 
@@ -1005,7 +1096,7 @@ void MemoryAllocator::Free(MemoryChunk* chunk) {
       DCHECK_EQ(chunk->size(), static_cast<size_t>(MemoryChunk::kPageSize));
       DCHECK_EQ(chunk->executable(), NOT_EXECUTABLE);
       chunk->SetFlag(MemoryChunk::POOLED);
-    // Fall through to kPreFreeAndQueue.
+      V8_FALLTHROUGH;
     case kPreFreeAndQueue:
       PreFreeMemory(chunk);
       // The chunks added to this queue will be freed by a concurrent thread.
@@ -1198,6 +1289,11 @@ void MemoryChunk::ReleaseAllocatedMemory() {
   ReleaseInvalidatedSlots();
   if (local_tracker_ != nullptr) ReleaseLocalTracker();
   if (young_generation_bitmap_ != nullptr) ReleaseYoungGenerationBitmap();
+
+  if (IsPagedSpace()) {
+    Page* page = static_cast<Page*>(this);
+    page->ReleaseFreeListCategories();
+  }
 }
 
 static SlotSet* AllocateAndInitializeSlotSet(size_t size, Address page_start) {
@@ -1315,15 +1411,6 @@ void MemoryChunk::ReleaseYoungGenerationBitmap() {
 // -----------------------------------------------------------------------------
 // PagedSpace implementation
 
-STATIC_ASSERT(static_cast<ObjectSpace>(1 << AllocationSpace::NEW_SPACE) ==
-              ObjectSpace::kObjectSpaceNewSpace);
-STATIC_ASSERT(static_cast<ObjectSpace>(1 << AllocationSpace::OLD_SPACE) ==
-              ObjectSpace::kObjectSpaceOldSpace);
-STATIC_ASSERT(static_cast<ObjectSpace>(1 << AllocationSpace::CODE_SPACE) ==
-              ObjectSpace::kObjectSpaceCodeSpace);
-STATIC_ASSERT(static_cast<ObjectSpace>(1 << AllocationSpace::MAP_SPACE) ==
-              ObjectSpace::kObjectSpaceMapSpace);
-
 void Space::AddAllocationObserver(AllocationObserver* observer) {
   allocation_observers_.push_back(observer);
   StartNextInlineAllocationStep();
@@ -1345,12 +1432,17 @@ void Space::ResumeAllocationObservers() {
 
 void Space::AllocationStep(int bytes_since_last, Address soon_object,
                            int size) {
-  if (AllocationObserversActive()) {
-    heap()->CreateFillerObjectAt(soon_object, size, ClearRecordedSlots::kNo);
-    for (AllocationObserver* observer : allocation_observers_) {
-      observer->AllocationStep(bytes_since_last, soon_object, size);
-    }
+  if (!AllocationObserversActive()) {
+    return;
   }
+
+  DCHECK(!heap()->allocation_step_in_progress());
+  heap()->set_allocation_step_in_progress(true);
+  heap()->CreateFillerObjectAt(soon_object, size, ClearRecordedSlots::kNo);
+  for (AllocationObserver* observer : allocation_observers_) {
+    observer->AllocationStep(bytes_since_last, soon_object, size);
+  }
+  heap()->set_allocation_step_in_progress(false);
 }
 
 intptr_t Space::GetNextInlineAllocationStepSize() {
@@ -1359,15 +1451,13 @@ intptr_t Space::GetNextInlineAllocationStepSize() {
     next_step = next_step ? Min(next_step, observer->bytes_to_next_step())
                           : observer->bytes_to_next_step();
   }
-  DCHECK(allocation_observers_.size() == 0 || next_step != 0);
+  DCHECK(allocation_observers_.size() == 0 || next_step > 0);
   return next_step;
 }
 
 PagedSpace::PagedSpace(Heap* heap, AllocationSpace space,
                        Executability executable)
-    : SpaceWithLinearArea(heap, space, executable),
-      anchor_(this),
-      free_list_(this) {
+    : SpaceWithLinearArea(heap, space, executable), anchor_(this) {
   area_size_ = MemoryAllocator::PageAreaSize(space);
   accounting_stats_.Clear();
 }
@@ -1394,7 +1484,7 @@ void PagedSpace::RefillFreeList() {
   // Any PagedSpace might invoke RefillFreeList. We filter all but our old
   // generation spaces out.
   if (identity() != OLD_SPACE && identity() != CODE_SPACE &&
-      identity() != MAP_SPACE) {
+      identity() != MAP_SPACE && identity() != RO_SPACE) {
     return;
   }
   MarkCompactCollector* collector = heap()->mark_compact_collector();
@@ -1570,7 +1660,8 @@ bool PagedSpace::Expand() {
   // Pages created during bootstrapping may contain immortal immovable objects.
   if (!heap()->deserialization_complete()) page->MarkNeverEvacuate();
   AddPage(page);
-  Free(page->area_start(), page->area_size());
+  Free(page->area_start(), page->area_size(),
+       SpaceAccountingMode::kSpaceAccounted);
   DCHECK(Capacity() <= heap()->MaxOldGenerationSize());
   return true;
 }
@@ -1606,7 +1697,8 @@ void PagedSpace::DecreaseLimit(Address new_limit) {
   DCHECK_GE(old_limit, new_limit);
   if (new_limit != old_limit) {
     SetTopAndLimit(top(), new_limit);
-    Free(new_limit, old_limit - new_limit);
+    Free(new_limit, old_limit - new_limit,
+         SpaceAccountingMode::kSpaceAccounted);
     if (heap()->incremental_marking()->black_allocation()) {
       Page::FromAllocationAreaAddress(new_limit)->DestroyBlackArea(new_limit,
                                                                    old_limit);
@@ -1692,7 +1784,15 @@ void PagedSpace::FreeLinearAllocationArea() {
   InlineAllocationStep(current_top, nullptr, nullptr, 0);
   SetTopAndLimit(nullptr, nullptr);
   DCHECK_GE(current_limit, current_top);
-  Free(current_top, current_limit - current_top);
+
+  // The code page of the linear allocation area needs to be unprotected
+  // because we are going to write a filler into that memory area below.
+  if (identity() == CODE_SPACE) {
+    heap_->UnprotectAndRegisterMemoryChunk(
+        MemoryChunk::FromAddress(current_top));
+  }
+  Free(current_top, current_limit - current_top,
+       SpaceAccountingMode::kSpaceAccounted);
 }
 
 void PagedSpace::ReleasePage(Page* page) {
@@ -1722,6 +1822,7 @@ void PagedSpace::ReleasePage(Page* page) {
 void PagedSpace::SetReadAndExecutable() {
   DCHECK(identity() == CODE_SPACE);
   for (Page* page : *this) {
+    CHECK(heap_->memory_allocator()->IsMemoryChunkExecutable(page));
     page->SetReadAndExecutable();
   }
 }
@@ -1729,6 +1830,7 @@ void PagedSpace::SetReadAndExecutable() {
 void PagedSpace::SetReadAndWritable() {
   DCHECK(identity() == CODE_SPACE);
   for (Page* page : *this) {
+    CHECK(heap_->memory_allocator()->IsMemoryChunkExecutable(page));
     page->SetReadAndWritable();
   }
 }
@@ -1764,13 +1866,6 @@ bool PagedSpace::RefillLinearAllocationAreaFromFreeList(size_t size_in_bytes) {
 
   DCHECK_GE(new_node_size, size_in_bytes);
 
-#ifdef DEBUG
-  for (size_t i = 0; i < size_in_bytes / kPointerSize; i++) {
-    reinterpret_cast<Object**>(new_node->address())[i] =
-        Smi::FromInt(kCodeZapValue);
-  }
-#endif
-
   // The old-space-step might have finished sweeping and restarted marking.
   // Verify that it did not turn the page of the new node into an evacuation
   // candidate.
@@ -1778,7 +1873,8 @@ bool PagedSpace::RefillLinearAllocationAreaFromFreeList(size_t size_in_bytes) {
 
   // Memory in the linear allocation area is counted as allocated.  We may free
   // a little of this again immediately - see below.
-  IncreaseAllocatedBytes(new_node_size, Page::FromAddress(new_node->address()));
+  Page* page = Page::FromAddress(new_node->address());
+  IncreaseAllocatedBytes(new_node_size, page);
 
   Address start = new_node->address();
   Address end = new_node->address() + new_node_size;
@@ -1786,7 +1882,10 @@ bool PagedSpace::RefillLinearAllocationAreaFromFreeList(size_t size_in_bytes) {
   DCHECK_LE(limit, end);
   DCHECK_LE(size_in_bytes, limit - start);
   if (limit != end) {
-    Free(limit, end - limit);
+    if (identity() == CODE_SPACE) {
+      heap_->UnprotectAndRegisterMemoryChunk(page);
+    }
+    Free(limit, end - limit, SpaceAccountingMode::kSpaceAccounted);
   }
   SetLinearAllocationArea(start, limit);
 
@@ -1832,7 +1931,7 @@ void PagedSpace::Verify(ObjectVisitor* visitor) {
 
       // All the interior pointers should be contained in the heap.
       int size = object->Size();
-      object->IterateBody(map->instance_type(), size, visitor);
+      object->IterateBody(map, size, visitor);
       CHECK(object->address() + size <= top);
       end_of_previous_object = object->address() + size;
     }
@@ -2078,22 +2177,21 @@ LocalAllocationBuffer& LocalAllocationBuffer::operator=(
 }
 
 void NewSpace::UpdateLinearAllocationArea() {
-  Address old_top = top();
-  Address new_top = to_space_.page_low();
+  // Make sure there is no unaccounted allocations.
+  DCHECK(!AllocationObserversActive() || top_on_previous_step_ == top());
 
+  Address new_top = to_space_.page_low();
   MemoryChunk::UpdateHighWaterMark(allocation_info_.top());
   allocation_info_.Reset(new_top, to_space_.page_high());
   original_top_.SetValue(top());
   original_limit_.SetValue(limit());
-  UpdateInlineAllocationLimit(0);
-  // TODO(ofrobots): It would be more correct to do a step before setting the
-  // limit on the new allocation area. However, fixing this causes a regression
-  // due to the idle scavenger getting pinged too frequently. crbug.com/795323.
-  InlineAllocationStep(old_top, new_top, nullptr, 0);
+  StartNextInlineAllocationStep();
   DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
 }
 
 void NewSpace::ResetLinearAllocationArea() {
+  // Do a step to account for memory allocated so far before resetting.
+  InlineAllocationStep(top(), top(), nullptr, 0);
   to_space_.Reset();
   UpdateLinearAllocationArea();
   // Clear all mark-bits in the to-space.
@@ -2121,6 +2219,10 @@ void PagedSpace::UpdateInlineAllocationLimit(size_t min_size) {
 bool NewSpace::AddFreshPage() {
   Address top = allocation_info_.top();
   DCHECK(!Page::IsAtObjectStart(top));
+
+  // Do a step to account for memory allocated on previous page.
+  InlineAllocationStep(top, top, nullptr, 0);
+
   if (!to_space_.AdvancePage()) {
     // No more pages left to advance.
     return false;
@@ -2176,6 +2278,11 @@ bool NewSpace::EnsureAllocation(int size_in_bytes,
 }
 
 void SpaceWithLinearArea::StartNextInlineAllocationStep() {
+  if (heap()->allocation_step_in_progress()) {
+    // If we are mid-way through an existing step, don't start a new one.
+    return;
+  }
+
   if (AllocationObserversActive()) {
     top_on_previous_step_ = top();
     UpdateInlineAllocationLimit(0);
@@ -2217,6 +2324,11 @@ void SpaceWithLinearArea::InlineAllocationStep(Address top,
                                                Address top_for_next_step,
                                                Address soon_object,
                                                size_t size) {
+  if (heap()->allocation_step_in_progress()) {
+    // Avoid starting a new step if we are mid-way through an existing one.
+    return;
+  }
+
   if (top_on_previous_step_) {
     if (top < top_on_previous_step_) {
       // Generated code decreased the top pointer to do folded allocations.
@@ -2271,7 +2383,7 @@ void NewSpace::Verify() {
       // All the interior pointers should be contained in the heap.
       VerifyPointersVisitor visitor;
       int size = object->Size();
-      object->IterateBody(map->instance_type(), size, &visitor);
+      object->IterateBody(map, size, &visitor);
 
       current += size;
     } else {
@@ -2606,34 +2718,23 @@ void FreeListCategory::Reset() {
   available_ = 0;
 }
 
-FreeSpace* FreeListCategory::PickNodeFromList(size_t* node_size) {
+FreeSpace* FreeListCategory::PickNodeFromList(size_t minimum_size,
+                                              size_t* node_size) {
   DCHECK(page()->CanAllocate());
-
   FreeSpace* node = top();
-  if (node == nullptr) return nullptr;
-  set_top(node->next());
-  *node_size = node->Size();
-  available_ -= *node_size;
-  return node;
-}
-
-FreeSpace* FreeListCategory::TryPickNodeFromList(size_t minimum_size,
-                                                 size_t* node_size) {
-  DCHECK(page()->CanAllocate());
-
-  FreeSpace* node = PickNodeFromList(node_size);
-  if ((node != nullptr) && (*node_size < minimum_size)) {
-    Free(node, *node_size, kLinkCategory);
+  if (node == nullptr || static_cast<size_t>(node->Size()) < minimum_size) {
     *node_size = 0;
     return nullptr;
   }
+  set_top(node->next());
+  *node_size = node->Size();
+  available_ -= *node_size;
   return node;
 }
 
 FreeSpace* FreeListCategory::SearchForNodeInList(size_t minimum_size,
                                                  size_t* node_size) {
   DCHECK(page()->CanAllocate());
-
   FreeSpace* prev_non_evac_node = nullptr;
   for (FreeSpace* cur_node = top(); cur_node != nullptr;
        cur_node = cur_node->next()) {
@@ -2645,6 +2746,11 @@ FreeSpace* FreeListCategory::SearchForNodeInList(size_t minimum_size,
         set_top(cur_node->next());
       }
       if (prev_non_evac_node != nullptr) {
+        MemoryChunk* chunk =
+            MemoryChunk::FromAddress(prev_non_evac_node->address());
+        if (chunk->owner()->identity() == CODE_SPACE) {
+          chunk->heap()->UnprotectAndRegisterMemoryChunk(chunk);
+        }
         prev_non_evac_node->set_next(cur_node->next());
       }
       *node_size = size;
@@ -2656,9 +2762,10 @@ FreeSpace* FreeListCategory::SearchForNodeInList(size_t minimum_size,
   return nullptr;
 }
 
-void FreeListCategory::Free(FreeSpace* free_space, size_t size_in_bytes,
+void FreeListCategory::Free(Address start, size_t size_in_bytes,
                             FreeMode mode) {
-  CHECK(page()->CanAllocate());
+  DCHECK(page()->CanAllocate());
+  FreeSpace* free_space = FreeSpace::cast(HeapObject::FromAddress(start));
   free_space->set_next(top());
   set_top(free_space);
   available_ += size_in_bytes;
@@ -2686,7 +2793,7 @@ void FreeListCategory::Relink() {
   owner()->AddCategory(this);
 }
 
-FreeList::FreeList(PagedSpace* owner) : owner_(owner), wasted_bytes_(0) {
+FreeList::FreeList() : wasted_bytes_(0) {
   for (int i = kFirstCategory; i < kNumberOfCategories; i++) {
     categories_[i] = nullptr;
   }
@@ -2704,11 +2811,6 @@ void FreeList::Reset() {
 }
 
 size_t FreeList::Free(Address start, size_t size_in_bytes, FreeMode mode) {
-  if (size_in_bytes == 0) return 0;
-
-  owner()->heap()->CreateFillerObjectAt(start, static_cast<int>(size_in_bytes),
-                                        ClearRecordedSlots::kNo);
-
   Page* page = Page::FromAddress(start);
   page->DecreaseAllocatedBytes(size_in_bytes);
 
@@ -2719,22 +2821,22 @@ size_t FreeList::Free(Address start, size_t size_in_bytes, FreeMode mode) {
     return size_in_bytes;
   }
 
-  FreeSpace* free_space = FreeSpace::cast(HeapObject::FromAddress(start));
   // Insert other blocks at the head of a free list of the appropriate
   // magnitude.
   FreeListCategoryType type = SelectFreeListCategoryType(size_in_bytes);
-  page->free_list_category(type)->Free(free_space, size_in_bytes, mode);
+  page->free_list_category(type)->Free(start, size_in_bytes, mode);
   DCHECK_EQ(page->AvailableInFreeList(),
             page->AvailableInFreeListFromAllocatedBytes());
   return 0;
 }
 
-FreeSpace* FreeList::FindNodeIn(FreeListCategoryType type, size_t* node_size) {
+FreeSpace* FreeList::FindNodeIn(FreeListCategoryType type, size_t minimum_size,
+                                size_t* node_size) {
   FreeListCategoryIterator it(this, type);
   FreeSpace* node = nullptr;
   while (it.HasNext()) {
     FreeListCategory* current = it.Next();
-    node = current->PickNodeFromList(node_size);
+    node = current->PickNodeFromList(minimum_size, node_size);
     if (node != nullptr) {
       DCHECK(IsVeryLong() || Available() == SumFreeLists());
       return node;
@@ -2744,11 +2846,11 @@ FreeSpace* FreeList::FindNodeIn(FreeListCategoryType type, size_t* node_size) {
   return node;
 }
 
-FreeSpace* FreeList::TryFindNodeIn(FreeListCategoryType type, size_t* node_size,
-                                   size_t minimum_size) {
+FreeSpace* FreeList::TryFindNodeIn(FreeListCategoryType type,
+                                   size_t minimum_size, size_t* node_size) {
   if (categories_[type] == nullptr) return nullptr;
   FreeSpace* node =
-      categories_[type]->TryPickNodeFromList(minimum_size, node_size);
+      categories_[type]->PickNodeFromList(minimum_size, node_size);
   if (node != nullptr) {
     DCHECK(IsVeryLong() || Available() == SumFreeLists());
   }
@@ -2782,7 +2884,8 @@ FreeSpace* FreeList::Allocate(size_t size_in_bytes, size_t* node_size) {
   FreeListCategoryType type =
       SelectFastAllocationFreeListCategoryType(size_in_bytes);
   for (int i = type; i < kHuge && node == nullptr; i++) {
-    node = FindNodeIn(static_cast<FreeListCategoryType>(i), node_size);
+    node = FindNodeIn(static_cast<FreeListCategoryType>(i), size_in_bytes,
+                      node_size);
   }
 
   if (node == nullptr) {
@@ -2795,7 +2898,7 @@ FreeSpace* FreeList::Allocate(size_t size_in_bytes, size_t* node_size) {
     // We didn't find anything in the huge list. Now search the best fitting
     // free list for a node that has at least the requested size.
     type = SelectFreeListCategoryType(size_in_bytes);
-    node = TryFindNodeIn(type, node_size, size_in_bytes);
+    node = TryFindNodeIn(type, size_in_bytes, node_size);
   }
 
   if (node != nullptr) {
@@ -3371,7 +3474,7 @@ void LargeObjectSpace::Verify() {
     // Byte arrays and strings don't have interior pointers.
     if (object->IsAbstractCode()) {
       VerifyPointersVisitor code_visitor;
-      object->IterateBody(map->instance_type(), object->Size(), &code_visitor);
+      object->IterateBody(map, object->Size(), &code_visitor);
     } else if (object->IsFixedArray()) {
       FixedArray* array = FixedArray::cast(object);
       for (int j = 0; j < array->length(); j++) {
diff --git a/deps/v8/src/heap/spaces.h b/deps/v8/src/heap/spaces.h
index 08fef7d6e38..a7a1a179e07 100644
--- a/deps/v8/src/heap/spaces.h
+++ b/deps/v8/src/heap/spaces.h
@@ -139,6 +139,8 @@ enum FreeListCategoryType {
 
 enum FreeMode { kLinkCategory, kDoNotLinkCategory };
 
+enum class SpaceAccountingMode { kSpaceAccounted, kSpaceUnaccounted };
+
 enum RememberedSetType {
   OLD_TO_NEW,
   OLD_TO_OLD,
@@ -148,15 +150,10 @@ enum RememberedSetType {
 // A free list category maintains a linked list of free memory blocks.
 class FreeListCategory {
  public:
-  static const int kSize = kIntSize +      // FreeListCategoryType type_
-                           kIntSize +      // padding for type_
-                           kSizetSize +    // size_t available_
-                           kPointerSize +  // FreeSpace* top_
-                           kPointerSize +  // FreeListCategory* prev_
-                           kPointerSize;   // FreeListCategory* next_
-
-  FreeListCategory()
-      : type_(kInvalidCategory),
+  FreeListCategory(FreeList* free_list, Page* page)
+      : free_list_(free_list),
+        page_(page),
+        type_(kInvalidCategory),
         available_(0),
         top_(nullptr),
         prev_(nullptr),
@@ -180,27 +177,25 @@ class FreeListCategory {
   // category is currently unlinked.
   void Relink();
 
-  void Free(FreeSpace* node, size_t size_in_bytes, FreeMode mode);
-
-  // Picks a node from the list and stores its size in |node_size|. Returns
-  // nullptr if the category is empty.
-  FreeSpace* PickNodeFromList(size_t* node_size);
+  void Free(Address address, size_t size_in_bytes, FreeMode mode);
 
   // Performs a single try to pick a node of at least |minimum_size| from the
   // category. Stores the actual size in |node_size|. Returns nullptr if no
   // node is found.
-  FreeSpace* TryPickNodeFromList(size_t minimum_size, size_t* node_size);
+  FreeSpace* PickNodeFromList(size_t minimum_size, size_t* node_size);
 
   // Picks a node of at least |minimum_size| from the category. Stores the
   // actual size in |node_size|. Returns nullptr if no node is found.
   FreeSpace* SearchForNodeInList(size_t minimum_size, size_t* node_size);
 
   inline FreeList* owner();
-  inline Page* page() const;
+  inline Page* page() const { return page_; }
   inline bool is_linked();
   bool is_empty() { return top() == nullptr; }
   size_t available() const { return available_; }
 
+  void set_free_list(FreeList* free_list) { free_list_ = free_list; }
+
 #ifdef DEBUG
   size_t SumFreeList();
   int FreeListLength();
@@ -218,6 +213,12 @@ class FreeListCategory {
   FreeListCategory* next() { return next_; }
   void set_next(FreeListCategory* next) { next_ = next; }
 
+  // This FreeListCategory is owned by the given free_list_.
+  FreeList* free_list_;
+
+  // This FreeListCategory holds free list entries of the given page_.
+  Page* const page_;
+
   // |type_|: The type of this free list category.
   FreeListCategoryType type_;
 
@@ -233,6 +234,8 @@ class FreeListCategory {
 
   friend class FreeList;
   friend class PagedSpace;
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(FreeListCategory);
 };
 
 // MemoryChunk represents a memory region owned by a specific space.
@@ -370,7 +373,7 @@ class MemoryChunk {
       + kSizetSize    // size_t wasted_memory_
       + kPointerSize  // AtomicValue next_chunk_
       + kPointerSize  // AtomicValue prev_chunk_
-      + FreeListCategory::kSize * kNumberOfCategories
+      + kPointerSize * kNumberOfCategories
       // FreeListCategory categories_[kNumberOfCategories]
       + kPointerSize   // LocalArrayBufferTracker* local_tracker_
       + kIntptrSize    // intptr_t young_generation_live_byte_count_
@@ -610,6 +613,8 @@ class MemoryChunk {
 
   void set_owner(Space* space) { owner_.SetValue(space); }
 
+  bool IsPagedSpace() const;
+
   void InsertAfter(MemoryChunk* other);
   void Unlink();
 
@@ -620,8 +625,6 @@ class MemoryChunk {
   void SetReadAndExecutable();
   void SetReadAndWritable();
 
-  inline void InitializeFreeListCategories();
-
  protected:
   static MemoryChunk* Initialize(Heap* heap, Address base, size_t size,
                                  Address area_start, Address area_end,
@@ -699,7 +702,7 @@ class MemoryChunk {
   // prev_chunk_ holds a pointer of type MemoryChunk
   base::AtomicValue<MemoryChunk*> prev_chunk_;
 
-  FreeListCategory categories_[kNumberOfCategories];
+  FreeListCategory* categories_[kNumberOfCategories];
 
   LocalArrayBufferTracker* local_tracker_;
 
@@ -788,7 +791,7 @@ class Page : public MemoryChunk {
   template <typename Callback>
   inline void ForAllFreeListCategories(Callback callback) {
     for (int i = kFirstCategory; i < kNumberOfCategories; i++) {
-      callback(&categories_[i]);
+      callback(categories_[i]);
     }
   }
 
@@ -820,7 +823,7 @@ class Page : public MemoryChunk {
   }
 
   FreeListCategory* free_list_category(FreeListCategoryType type) {
-    return &categories_[type];
+    return categories_[type];
   }
 
   bool is_anchor() { return IsFlagSet(Page::ANCHOR); }
@@ -845,6 +848,10 @@ class Page : public MemoryChunk {
   V8_EXPORT_PRIVATE void CreateBlackArea(Address start, Address end);
   void DestroyBlackArea(Address start, Address end);
 
+  void InitializeFreeListCategories();
+  void AllocateFreeListCategories();
+  void ReleaseFreeListCategories();
+
 #ifdef DEBUG
   void Print();
 #endif  // DEBUG
@@ -1170,14 +1177,14 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
         : heap_(heap),
           allocator_(allocator),
           pending_unmapping_tasks_semaphore_(0),
-          concurrent_unmapping_tasks_active_(0) {
+          pending_unmapping_tasks_(0),
+          active_unmapping_tasks_(0) {
       chunks_[kRegular].reserve(kReservedQueueingSlots);
       chunks_[kPooled].reserve(kReservedQueueingSlots);
     }
 
     void AddMemoryChunkSafe(MemoryChunk* chunk) {
-      if ((chunk->size() == Page::kPageSize) &&
-          (chunk->executable() != EXECUTABLE)) {
+      if (chunk->IsPagedSpace() && chunk->executable() != EXECUTABLE) {
         AddMemoryChunkSafe<kRegular>(chunk);
       } else {
         AddMemoryChunkSafe<kNonRegular>(chunk);
@@ -1238,6 +1245,8 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
       return chunk;
     }
 
+    bool MakeRoomForNewTasks();
+
     template <FreeMode mode>
     void PerformFreeMemoryOnQueuedChunks();
 
@@ -1247,7 +1256,8 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
     std::vector<MemoryChunk*> chunks_[kNumberOfChunkQueues];
     CancelableTaskManager::Id task_ids_[kMaxUnmapperTasks];
     base::Semaphore pending_unmapping_tasks_semaphore_;
-    intptr_t concurrent_unmapping_tasks_active_;
+    intptr_t pending_unmapping_tasks_;
+    base::AtomicNumber<intptr_t> active_unmapping_tasks_;
 
     friend class MemoryAllocator;
   };
@@ -1359,6 +1369,12 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
   // and false otherwise.
   bool CommitBlock(Address start, size_t size, Executability executable);
 
+  // Checks if an allocated MemoryChunk was intended to be used for executable
+  // memory.
+  bool IsMemoryChunkExecutable(MemoryChunk* chunk) {
+    return executable_memory_.find(chunk) != executable_memory_.end();
+  }
+
   // Uncommit a contiguous block of memory [start..(start+size)[.
   // start is not nullptr, the size is greater than zero, and the
   // block is contained in the initial chunk.  Returns true if it succeeded
@@ -1409,6 +1425,17 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
     } while ((high > ptr) && !highest_ever_allocated_.TrySetValue(ptr, high));
   }
 
+  void RegisterExecutableMemoryChunk(MemoryChunk* chunk) {
+    DCHECK(chunk->IsFlagSet(MemoryChunk::IS_EXECUTABLE));
+    DCHECK_EQ(executable_memory_.find(chunk), executable_memory_.end());
+    executable_memory_.insert(chunk);
+  }
+
+  void UnregisterExecutableMemoryChunk(MemoryChunk* chunk) {
+    DCHECK_NE(executable_memory_.find(chunk), executable_memory_.end());
+    executable_memory_.erase(chunk);
+  }
+
   Isolate* isolate_;
   CodeRange* code_range_;
 
@@ -1431,6 +1458,9 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
   VirtualMemory last_chunk_;
   Unmapper unmapper_;
 
+  // Data structure to remember allocated executable memory chunks.
+  std::unordered_set<MemoryChunk*> executable_memory_;
+
   friend class heap::TestCodeRangeScope;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(MemoryAllocator);
@@ -1731,7 +1761,7 @@ class V8_EXPORT_PRIVATE FreeList {
     return kHuge;
   }
 
-  explicit FreeList(PagedSpace* owner);
+  FreeList();
 
   // Adds a node on the free list. The block of size {size_in_bytes} starting
   // at {start} is placed on the free list. The return value is the number of
@@ -1779,7 +1809,6 @@ class V8_EXPORT_PRIVATE FreeList {
   size_t EvictFreeListItems(Page* page);
   bool ContainsPageFreeListItems(Page* page);
 
-  PagedSpace* owner() { return owner_; }
   size_t wasted_bytes() { return wasted_bytes_.Value(); }
 
   template <typename Callback>
@@ -1846,12 +1875,14 @@ class V8_EXPORT_PRIVATE FreeList {
 
   // Walks all available categories for a given |type| and tries to retrieve
   // a node. Returns nullptr if the category is empty.
-  FreeSpace* FindNodeIn(FreeListCategoryType type, size_t* node_size);
+  FreeSpace* FindNodeIn(FreeListCategoryType type, size_t minimum_size,
+                        size_t* node_size);
 
   // Tries to retrieve a node from the first category in a given |type|.
-  // Returns nullptr if the category is empty.
-  FreeSpace* TryFindNodeIn(FreeListCategoryType type, size_t* node_size,
-                           size_t minimum_size);
+  // Returns nullptr if the category is empty or the top entry is smaller
+  // than minimum_size.
+  FreeSpace* TryFindNodeIn(FreeListCategoryType type, size_t minimum_size,
+                           size_t* node_size);
 
   // Searches a given |type| for a node of at least |minimum_size|.
   FreeSpace* SearchForNodeInList(FreeListCategoryType type, size_t* node_size,
@@ -1874,13 +1905,10 @@ class V8_EXPORT_PRIVATE FreeList {
     return categories_[type];
   }
 
-  PagedSpace* owner_;
   base::AtomicNumber<size_t> wasted_bytes_;
   FreeListCategory* categories_[kNumberOfCategories];
 
   friend class FreeListCategory;
-
-  DISALLOW_IMPLICIT_CONSTRUCTORS(FreeList);
 };
 
 // LocalAllocationBuffer represents a linear allocation area that is created
@@ -2086,11 +2114,22 @@ class V8_EXPORT_PRIVATE PagedSpace
   MUST_USE_RESULT inline AllocationResult AllocateRaw(
       int size_in_bytes, AllocationAlignment alignment);
 
+  size_t Free(Address start, size_t size_in_bytes, SpaceAccountingMode mode) {
+    if (size_in_bytes == 0) return 0;
+    heap_->CreateFillerObjectAt(start, static_cast<int>(size_in_bytes),
+                                ClearRecordedSlots::kNo);
+    if (mode == SpaceAccountingMode::kSpaceAccounted) {
+      return AccountedFree(start, size_in_bytes);
+    } else {
+      return UnaccountedFree(start, size_in_bytes);
+    }
+  }
+
   // Give a block of memory to the space's free list.  It might be added to
   // the free list or accounted as waste.
   // If add_to_freelist is false then just accounting stats are updated and
   // no attempt to add area to free list is made.
-  size_t Free(Address start, size_t size_in_bytes) {
+  size_t AccountedFree(Address start, size_t size_in_bytes) {
     size_t wasted = free_list_.Free(start, size_in_bytes, kLinkCategory);
     Page* page = Page::FromAddress(start);
     accounting_stats_.DecreaseAllocatedBytes(size_in_bytes, page);
@@ -2839,6 +2878,14 @@ class MapSpace : public PagedSpace {
 #endif
 };
 
+// -----------------------------------------------------------------------------
+// Read Only space for all Immortal Immovable and Immutable objects
+
+class ReadOnlySpace : public PagedSpace {
+ public:
+  ReadOnlySpace(Heap* heap, AllocationSpace id, Executability executable)
+      : PagedSpace(heap, id, executable) {}
+};
 
 // -----------------------------------------------------------------------------
 // Large objects ( > kMaxRegularHeapObjectSize ) are allocated and
diff --git a/deps/v8/src/heap/store-buffer.cc b/deps/v8/src/heap/store-buffer.cc
index 724edf57219..3df5a5a53f2 100644
--- a/deps/v8/src/heap/store-buffer.cc
+++ b/deps/v8/src/heap/store-buffer.cc
@@ -7,6 +7,7 @@
 #include <algorithm>
 
 #include "src/base/macros.h"
+#include "src/base/template-utils.h"
 #include "src/counters.h"
 #include "src/heap/incremental-marking.h"
 #include "src/isolate.h"
@@ -35,7 +36,7 @@ void StoreBuffer::SetUp() {
   VirtualMemory reservation;
   if (!AllocVirtualMemory(kStoreBufferSize * 3, heap_->GetRandomMmapAddr(),
                           &reservation)) {
-    V8::FatalProcessOutOfMemory("StoreBuffer::SetUp");
+    heap_->FatalProcessOutOfMemory("StoreBuffer::SetUp");
   }
   uintptr_t start_as_int = reinterpret_cast<uintptr_t>(reservation.address());
   start_[0] =
@@ -59,7 +60,7 @@ void StoreBuffer::SetUp() {
   if (!reservation.SetPermissions(reinterpret_cast<Address>(start_[0]),
                                   kStoreBufferSize * kStoreBuffers,
                                   PageAllocator::kReadWrite)) {
-    V8::FatalProcessOutOfMemory("StoreBuffer::SetUp");
+    heap_->FatalProcessOutOfMemory("StoreBuffer::SetUp");
   }
   current_ = 0;
   top_ = start_[current_];
@@ -94,9 +95,8 @@ void StoreBuffer::FlipStoreBuffers() {
 
   if (!task_running_ && FLAG_concurrent_store_buffer) {
     task_running_ = true;
-    Task* task = new Task(heap_->isolate(), this);
-    V8::GetCurrentPlatform()->CallOnBackgroundThread(
-        task, v8::Platform::kShortRunningTask);
+    V8::GetCurrentPlatform()->CallOnWorkerThread(
+        base::make_unique<Task>(heap_->isolate(), this));
   }
 }
 
diff --git a/deps/v8/src/heap/store-buffer.h b/deps/v8/src/heap/store-buffer.h
index a69abcc886f..58f47f48341 100644
--- a/deps/v8/src/heap/store-buffer.h
+++ b/deps/v8/src/heap/store-buffer.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_STORE_BUFFER_H_
-#define V8_STORE_BUFFER_H_
+#ifndef V8_HEAP_STORE_BUFFER_H_
+#define V8_HEAP_STORE_BUFFER_H_
 
 #include "src/allocation.h"
 #include "src/base/logging.h"
@@ -225,4 +225,4 @@ class StoreBuffer {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_STORE_BUFFER_H_
+#endif  // V8_HEAP_STORE_BUFFER_H_
diff --git a/deps/v8/src/heap/stress-marking-observer.h b/deps/v8/src/heap/stress-marking-observer.h
index b97c2b179cd..37ebb821974 100644
--- a/deps/v8/src/heap/stress-marking-observer.h
+++ b/deps/v8/src/heap/stress-marking-observer.h
@@ -23,4 +23,4 @@ class StressMarkingObserver : public AllocationObserver {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_HEAP_STRESS_MARKING_OBSERVER_H_
diff --git a/deps/v8/src/heap/stress-scavenge-observer.h b/deps/v8/src/heap/stress-scavenge-observer.h
index 6f69afe4c59..b39b2eac598 100644
--- a/deps/v8/src/heap/stress-scavenge-observer.h
+++ b/deps/v8/src/heap/stress-scavenge-observer.h
@@ -36,4 +36,4 @@ class StressScavengeObserver : public AllocationObserver {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_HEAP_STRESS_SCAVENGE_OBSERVER_H_
diff --git a/deps/v8/src/heap/sweeper.cc b/deps/v8/src/heap/sweeper.cc
index 25ba0df8fdc..b2c45493893 100644
--- a/deps/v8/src/heap/sweeper.cc
+++ b/deps/v8/src/heap/sweeper.cc
@@ -4,6 +4,7 @@
 
 #include "src/heap/sweeper.h"
 
+#include "src/base/template-utils.h"
 #include "src/heap/array-buffer-tracker-inl.h"
 #include "src/heap/gc-tracer.h"
 #include "src/heap/mark-compact-inl.h"
@@ -78,16 +79,18 @@ class Sweeper::SweeperTask final : public CancelableTask {
   void RunInternal() final {
     TRACE_BACKGROUND_GC(tracer_,
                         GCTracer::BackgroundScope::MC_BACKGROUND_SWEEPING);
-    DCHECK_GE(space_to_start_, FIRST_PAGED_SPACE);
-    DCHECK_LE(space_to_start_, LAST_PAGED_SPACE);
-    const int offset = space_to_start_ - FIRST_PAGED_SPACE;
-    const int num_spaces = LAST_PAGED_SPACE - FIRST_PAGED_SPACE + 1;
+    DCHECK_GE(space_to_start_, FIRST_GROWABLE_PAGED_SPACE);
+    DCHECK_LE(space_to_start_, LAST_GROWABLE_PAGED_SPACE);
+    const int offset = space_to_start_ - FIRST_GROWABLE_PAGED_SPACE;
+    const int num_spaces =
+        LAST_GROWABLE_PAGED_SPACE - FIRST_GROWABLE_PAGED_SPACE + 1;
     for (int i = 0; i < num_spaces; i++) {
-      const int space_id = FIRST_PAGED_SPACE + ((i + offset) % num_spaces);
+      const int space_id =
+          FIRST_GROWABLE_PAGED_SPACE + ((i + offset) % num_spaces);
       // Do not sweep code space concurrently.
       if (static_cast<AllocationSpace>(space_id) == CODE_SPACE) continue;
-      DCHECK_GE(space_id, FIRST_PAGED_SPACE);
-      DCHECK_LE(space_id, LAST_PAGED_SPACE);
+      DCHECK_GE(space_id, FIRST_GROWABLE_PAGED_SPACE);
+      DCHECK_LE(space_id, LAST_GROWABLE_PAGED_SPACE);
       sweeper_->SweepSpaceFromTask(static_cast<AllocationSpace>(space_id));
     }
     num_sweeping_tasks_->Decrement(1);
@@ -152,13 +155,12 @@ void Sweeper::StartSweeperTasks() {
     ForAllSweepingSpaces([this](AllocationSpace space) {
       DCHECK(IsValidSweepingSpace(space));
       num_sweeping_tasks_.Increment(1);
-      SweeperTask* task = new SweeperTask(heap_->isolate(), this,
-                                          &pending_sweeper_tasks_semaphore_,
-                                          &num_sweeping_tasks_, space);
+      auto task = base::make_unique<SweeperTask>(
+          heap_->isolate(), this, &pending_sweeper_tasks_semaphore_,
+          &num_sweeping_tasks_, space);
       DCHECK_LT(num_tasks_, kMaxSweeperTasks);
       task_ids_[num_tasks_++] = task->id();
-      V8::GetCurrentPlatform()->CallOnBackgroundThread(
-          task, v8::Platform::kShortRunningTask);
+      V8::GetCurrentPlatform()->CallOnWorkerThread(std::move(task));
     });
     ScheduleIncrementalSweepingTask();
   }
@@ -279,8 +281,8 @@ int Sweeper::RawSweep(Page* p, FreeListRebuildingMode free_list_mode,
         memset(free_start, 0xCC, size);
       }
       if (free_list_mode == REBUILD_FREE_LIST) {
-        freed_bytes = reinterpret_cast<PagedSpace*>(space)->UnaccountedFree(
-            free_start, size);
+        freed_bytes = reinterpret_cast<PagedSpace*>(space)->Free(
+            free_start, size, SpaceAccountingMode::kSpaceUnaccounted);
         max_freed_bytes = Max(freed_bytes, max_freed_bytes);
       } else {
         p->heap()->CreateFillerObjectAt(free_start, static_cast<int>(size),
@@ -318,8 +320,8 @@ int Sweeper::RawSweep(Page* p, FreeListRebuildingMode free_list_mode,
       memset(free_start, 0xCC, size);
     }
     if (free_list_mode == REBUILD_FREE_LIST) {
-      freed_bytes = reinterpret_cast<PagedSpace*>(space)->UnaccountedFree(
-          free_start, size);
+      freed_bytes = reinterpret_cast<PagedSpace*>(space)->Free(
+          free_start, size, SpaceAccountingMode::kSpaceUnaccounted);
       max_freed_bytes = Max(freed_bytes, max_freed_bytes);
     } else {
       p->heap()->CreateFillerObjectAt(free_start, static_cast<int>(size),
@@ -550,12 +552,11 @@ void Sweeper::StartIterabilityTasks() {
 
   DCHECK(!iterability_task_started_);
   if (FLAG_concurrent_sweeping && !iterability_list_.empty()) {
-    IterabilityTask* task = new IterabilityTask(heap_->isolate(), this,
-                                                &iterability_task_semaphore_);
+    auto task = base::make_unique<IterabilityTask>(
+        heap_->isolate(), this, &iterability_task_semaphore_);
     iterability_task_id_ = task->id();
     iterability_task_started_ = true;
-    V8::GetCurrentPlatform()->CallOnBackgroundThread(
-        task, v8::Platform::kShortRunningTask);
+    V8::GetCurrentPlatform()->CallOnWorkerThread(std::move(task));
   }
 }
 
diff --git a/deps/v8/src/heap/sweeper.h b/deps/v8/src/heap/sweeper.h
index 6eee902bccb..a7fd1f04930 100644
--- a/deps/v8/src/heap/sweeper.h
+++ b/deps/v8/src/heap/sweeper.h
@@ -123,7 +123,7 @@ class Sweeper {
   class IterabilityTask;
   class SweeperTask;
 
-  static const int kNumberOfSweepingSpaces = LAST_PAGED_SPACE + 1;
+  static const int kNumberOfSweepingSpaces = LAST_GROWABLE_PAGED_SPACE + 1;
   static const int kMaxSweeperTasks = 3;
 
   template <typename Callback>
@@ -159,11 +159,12 @@ class Sweeper {
   void MakeIterable(Page* page);
 
   bool IsValidIterabilitySpace(AllocationSpace space) {
-    return space == NEW_SPACE;
+    return space == NEW_SPACE || space == RO_SPACE;
   }
 
   bool IsValidSweepingSpace(AllocationSpace space) {
-    return space >= FIRST_PAGED_SPACE && space <= LAST_PAGED_SPACE;
+    return space >= FIRST_GROWABLE_PAGED_SPACE &&
+           space <= LAST_GROWABLE_PAGED_SPACE;
   }
 
   Heap* const heap_;
diff --git a/deps/v8/src/heap/worklist.h b/deps/v8/src/heap/worklist.h
index 3421e166113..bb3eae22284 100644
--- a/deps/v8/src/heap/worklist.h
+++ b/deps/v8/src/heap/worklist.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_HEAP_WORKLIST_
-#define V8_HEAP_WORKLIST_
+#ifndef V8_HEAP_WORKLIST_H_
+#define V8_HEAP_WORKLIST_H_
 
 #include <cstddef>
 #include <utility>
@@ -388,4 +388,4 @@ class Worklist {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_HEAP_WORKLIST_
+#endif  // V8_HEAP_WORKLIST_H_
diff --git a/deps/v8/src/ia32/assembler-ia32-inl.h b/deps/v8/src/ia32/assembler-ia32-inl.h
index 368addd7186..1217e0db835 100644
--- a/deps/v8/src/ia32/assembler-ia32-inl.h
+++ b/deps/v8/src/ia32/assembler-ia32-inl.h
@@ -46,13 +46,10 @@
 namespace v8 {
 namespace internal {
 
-bool CpuFeatures::SupportsCrankshaft() { return true; }
+bool CpuFeatures::SupportsOptimizer() { return true; }
 
 bool CpuFeatures::SupportsWasmSimd128() { return IsSupported(SSE4_1); }
 
-static const byte kCallOpcode = 0xE8;
-static const int kNoCodeAgeSequenceLength = 5;
-
 
 // The modes possibly affected by apply must be in kApplyMask.
 void RelocInfo::apply(intptr_t delta) {
@@ -75,7 +72,8 @@ Address RelocInfo::target_address() {
 
 Address RelocInfo::target_address_address() {
   DCHECK(IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_) || IsWasmCall(rmode_) ||
-         rmode_ == EMBEDDED_OBJECT || rmode_ == EXTERNAL_REFERENCE);
+         IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
+         IsOffHeapTarget(rmode_));
   return reinterpret_cast<Address>(pc_);
 }
 
@@ -105,7 +103,7 @@ void RelocInfo::set_target_object(HeapObject* target,
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
   Memory::Object_at(pc_) = target;
   if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(target->GetIsolate(), pc_, sizeof(Address));
+    Assembler::FlushICache(pc_, sizeof(Address));
   }
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr) {
     host()->GetHeap()->RecordWriteIntoCode(host(), this, target);
@@ -138,22 +136,27 @@ Address RelocInfo::target_runtime_entry(Assembler* origin) {
   return reinterpret_cast<Address>(*reinterpret_cast<int32_t*>(pc_));
 }
 
-void RelocInfo::set_target_runtime_entry(Isolate* isolate, Address target,
+void RelocInfo::set_target_runtime_entry(Address target,
                                          WriteBarrierMode write_barrier_mode,
                                          ICacheFlushMode icache_flush_mode) {
   DCHECK(IsRuntimeEntry(rmode_));
   if (target_address() != target) {
-    set_target_address(isolate, target, write_barrier_mode, icache_flush_mode);
+    set_target_address(target, write_barrier_mode, icache_flush_mode);
   }
 }
 
-void RelocInfo::WipeOut(Isolate* isolate) {
+Address RelocInfo::target_off_heap_target() {
+  DCHECK(IsOffHeapTarget(rmode_));
+  return Memory::Address_at(pc_);
+}
+
+void RelocInfo::WipeOut() {
   if (IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
       IsInternalReference(rmode_)) {
     Memory::Address_at(pc_) = nullptr;
   } else if (IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_)) {
     // Effectively write zero into the relocation.
-    Assembler::set_target_address_at(isolate, pc_, constant_pool_,
+    Assembler::set_target_address_at(pc_, constant_pool_,
                                      pc_ + sizeof(int32_t));
   } else {
     UNREACHABLE();
@@ -161,11 +164,11 @@ void RelocInfo::WipeOut(Isolate* isolate) {
 }
 
 template <typename ObjectVisitor>
-void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
+void RelocInfo::Visit(ObjectVisitor* visitor) {
   RelocInfo::Mode mode = rmode();
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
-    Assembler::FlushICache(isolate, pc_, sizeof(Address));
+    Assembler::FlushICache(pc_, sizeof(Address));
   } else if (RelocInfo::IsCodeTarget(mode)) {
     visitor->VisitCodeTarget(host(), this);
   } else if (mode == RelocInfo::EXTERNAL_REFERENCE) {
@@ -174,6 +177,8 @@ void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
     visitor->VisitInternalReference(host(), this);
   } else if (IsRuntimeEntry(mode)) {
     visitor->VisitRuntimeEntry(host(), this);
+  } else if (RelocInfo::IsOffHeapTarget(mode)) {
+    visitor->VisitOffHeapTarget(host(), this);
   }
 }
 
@@ -249,15 +254,13 @@ Address Assembler::target_address_at(Address pc, Address constant_pool) {
   return pc + sizeof(int32_t) + *reinterpret_cast<int32_t*>(pc);
 }
 
-
-void Assembler::set_target_address_at(Isolate* isolate, Address pc,
-                                      Address constant_pool, Address target,
+void Assembler::set_target_address_at(Address pc, Address constant_pool,
+                                      Address target,
                                       ICacheFlushMode icache_flush_mode) {
-  DCHECK_IMPLIES(isolate == nullptr, icache_flush_mode == SKIP_ICACHE_FLUSH);
   int32_t* p = reinterpret_cast<int32_t*>(pc);
   *p = target - (pc + sizeof(int32_t));
   if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(isolate, p, sizeof(int32_t));
+    Assembler::FlushICache(p, sizeof(int32_t));
   }
 }
 
@@ -266,8 +269,8 @@ Address Assembler::target_address_from_return_address(Address pc) {
 }
 
 void Assembler::deserialization_set_special_target_at(
-    Isolate* isolate, Address instruction_payload, Code* code, Address target) {
-  set_target_address_at(isolate, instruction_payload,
+    Address instruction_payload, Code* code, Address target) {
+  set_target_address_at(instruction_payload,
                         code ? code->constant_pool() : nullptr, target);
 }
 
@@ -299,9 +302,8 @@ void Assembler::emit_near_disp(Label* L) {
   *pc_++ = disp;
 }
 
-
 void Assembler::deserialization_set_target_internal_reference_at(
-    Isolate* isolate, Address pc, Address target, RelocInfo::Mode mode) {
+    Address pc, Address target, RelocInfo::Mode mode) {
   Memory::Address_at(pc) = target;
 }
 
@@ -321,12 +323,6 @@ void Operand::set_disp8(int8_t disp) {
   *reinterpret_cast<int8_t*>(&buf_[len_++]) = disp;
 }
 
-
-Operand::Operand(Immediate imm) {
-  // [disp/r]
-  set_modrm(0, ebp);
-  set_dispr(imm.immediate(), imm.rmode_);
-}
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/ia32/assembler-ia32.cc b/deps/v8/src/ia32/assembler-ia32.cc
index 38508c76320..8277b4bd4bd 100644
--- a/deps/v8/src/ia32/assembler-ia32.cc
+++ b/deps/v8/src/ia32/assembler-ia32.cc
@@ -105,7 +105,7 @@ bool OSHasAVXSupport() {
   size_t buffer_size = arraysize(buffer);
   int ctl_name[] = {CTL_KERN, KERN_OSRELEASE};
   if (sysctl(ctl_name, 2, buffer, &buffer_size, nullptr, 0) != 0) {
-    V8_Fatal(__FILE__, __LINE__, "V8 failed to get kernel version");
+    FATAL("V8 failed to get kernel version");
   }
   // The buffer now contains a string of the form XX.YY.ZZ, where
   // XX is the major kernel version component.
@@ -207,26 +207,26 @@ Address RelocInfo::embedded_address() const { return Memory::Address_at(pc_); }
 
 uint32_t RelocInfo::embedded_size() const { return Memory::uint32_at(pc_); }
 
-void RelocInfo::set_embedded_address(Isolate* isolate, Address address,
+void RelocInfo::set_embedded_address(Address address,
                                      ICacheFlushMode icache_flush_mode) {
   Memory::Address_at(pc_) = address;
   if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(isolate, pc_, sizeof(Address));
+    Assembler::FlushICache(pc_, sizeof(Address));
   }
 }
 
-void RelocInfo::set_embedded_size(Isolate* isolate, uint32_t size,
+void RelocInfo::set_embedded_size(uint32_t size,
                                   ICacheFlushMode icache_flush_mode) {
   Memory::uint32_at(pc_) = size;
   if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(isolate, pc_, sizeof(uint32_t));
+    Assembler::FlushICache(pc_, sizeof(uint32_t));
   }
 }
 
-void RelocInfo::set_js_to_wasm_address(Isolate* isolate, Address address,
+void RelocInfo::set_js_to_wasm_address(Address address,
                                        ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  Assembler::set_target_address_at(isolate, pc_, constant_pool_, address,
+  Assembler::set_target_address_at(pc_, constant_pool_, address,
                                    icache_flush_mode);
 }
 
@@ -411,6 +411,7 @@ void Assembler::Nop(int bytes) {
     switch (bytes) {
       case 2:
         EMIT(0x66);
+        V8_FALLTHROUGH;
       case 1:
         EMIT(0x90);
         return;
@@ -427,6 +428,7 @@ void Assembler::Nop(int bytes) {
         return;
       case 6:
         EMIT(0x66);
+        V8_FALLTHROUGH;
       case 5:
         EMIT(0xF);
         EMIT(0x1F);
@@ -447,12 +449,15 @@ void Assembler::Nop(int bytes) {
       case 11:
         EMIT(0x66);
         bytes--;
+        V8_FALLTHROUGH;
       case 10:
         EMIT(0x66);
         bytes--;
+        V8_FALLTHROUGH;
       case 9:
         EMIT(0x66);
         bytes--;
+        V8_FALLTHROUGH;
       case 8:
         EMIT(0xF);
         EMIT(0x1F);
@@ -528,8 +533,7 @@ void Assembler::push(Register src) {
   EMIT(0x50 | src.code());
 }
 
-
-void Assembler::push(const Operand& src) {
+void Assembler::push(Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xFF);
   emit_operand(esi, src);
@@ -542,8 +546,7 @@ void Assembler::pop(Register dst) {
   EMIT(0x58 | dst.code());
 }
 
-
-void Assembler::pop(const Operand& dst) {
+void Assembler::pop(Operand dst) {
   EnsureSpace ensure_space(this);
   EMIT(0x8F);
   emit_operand(eax, dst);
@@ -563,48 +566,42 @@ void Assembler::leave() {
   EMIT(0xC9);
 }
 
-
-void Assembler::mov_b(Register dst, const Operand& src) {
+void Assembler::mov_b(Register dst, Operand src) {
   CHECK(dst.is_byte_register());
   EnsureSpace ensure_space(this);
   EMIT(0x8A);
   emit_operand(dst, src);
 }
 
-
-void Assembler::mov_b(const Operand& dst, const Immediate& src) {
+void Assembler::mov_b(Operand dst, const Immediate& src) {
   EnsureSpace ensure_space(this);
   EMIT(0xC6);
   emit_operand(eax, dst);
   EMIT(static_cast<int8_t>(src.immediate()));
 }
 
-
-void Assembler::mov_b(const Operand& dst, Register src) {
+void Assembler::mov_b(Operand dst, Register src) {
   CHECK(src.is_byte_register());
   EnsureSpace ensure_space(this);
   EMIT(0x88);
   emit_operand(src, dst);
 }
 
-
-void Assembler::mov_w(Register dst, const Operand& src) {
+void Assembler::mov_w(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x8B);
   emit_operand(dst, src);
 }
 
-
-void Assembler::mov_w(const Operand& dst, Register src) {
+void Assembler::mov_w(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x89);
   emit_operand(src, dst);
 }
 
-
-void Assembler::mov_w(const Operand& dst, const Immediate& src) {
+void Assembler::mov_w(Operand dst, const Immediate& src) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0xC7);
@@ -633,8 +630,7 @@ void Assembler::mov(Register dst, Handle<HeapObject> handle) {
   emit(handle);
 }
 
-
-void Assembler::mov(Register dst, const Operand& src) {
+void Assembler::mov(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x8B);
   emit_operand(dst, src);
@@ -647,62 +643,62 @@ void Assembler::mov(Register dst, Register src) {
   EMIT(0xC0 | src.code() << 3 | dst.code());
 }
 
-
-void Assembler::mov(const Operand& dst, const Immediate& x) {
+void Assembler::mov(Operand dst, const Immediate& x) {
   EnsureSpace ensure_space(this);
   EMIT(0xC7);
   emit_operand(eax, dst);
   emit(x);
 }
 
-void Assembler::mov(const Operand& dst, Handle<HeapObject> handle) {
+void Assembler::mov(Operand dst, Address src, RelocInfo::Mode rmode) {
   EnsureSpace ensure_space(this);
   EMIT(0xC7);
   emit_operand(eax, dst);
-  emit(handle);
+  emit(reinterpret_cast<uint32_t>(src), rmode);
 }
 
+void Assembler::mov(Operand dst, Handle<HeapObject> handle) {
+  EnsureSpace ensure_space(this);
+  EMIT(0xC7);
+  emit_operand(eax, dst);
+  emit(handle);
+}
 
-void Assembler::mov(const Operand& dst, Register src) {
+void Assembler::mov(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   EMIT(0x89);
   emit_operand(src, dst);
 }
 
-
-void Assembler::movsx_b(Register dst, const Operand& src) {
+void Assembler::movsx_b(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0xBE);
   emit_operand(dst, src);
 }
 
-
-void Assembler::movsx_w(Register dst, const Operand& src) {
+void Assembler::movsx_w(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0xBF);
   emit_operand(dst, src);
 }
 
-
-void Assembler::movzx_b(Register dst, const Operand& src) {
+void Assembler::movzx_b(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0xB6);
   emit_operand(dst, src);
 }
 
-
-void Assembler::movzx_w(Register dst, const Operand& src) {
+void Assembler::movzx_w(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0xB7);
   emit_operand(dst, src);
 }
 
-
-void Assembler::cmov(Condition cc, Register dst, const Operand& src) {
+void Assembler::cmov(Condition cc, Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   // Opcode: 0f 40 + cc /r.
   EMIT(0x0F);
@@ -747,21 +743,20 @@ void Assembler::xchg(Register dst, Register src) {
   }
 }
 
-
-void Assembler::xchg(Register dst, const Operand& src) {
+void Assembler::xchg(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x87);
   emit_operand(dst, src);
 }
 
-void Assembler::xchg_b(Register reg, const Operand& op) {
+void Assembler::xchg_b(Register reg, Operand op) {
   DCHECK(reg.is_byte_register());
   EnsureSpace ensure_space(this);
   EMIT(0x86);
   emit_operand(reg, op);
 }
 
-void Assembler::xchg_w(Register reg, const Operand& op) {
+void Assembler::xchg_w(Register reg, Operand op) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x87);
@@ -773,14 +768,14 @@ void Assembler::lock() {
   EMIT(0xF0);
 }
 
-void Assembler::cmpxchg(const Operand& dst, Register src) {
+void Assembler::cmpxchg(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0xB1);
   emit_operand(src, dst);
 }
 
-void Assembler::cmpxchg_b(const Operand& dst, Register src) {
+void Assembler::cmpxchg_b(Operand dst, Register src) {
   DCHECK(src.is_byte_register());
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
@@ -788,7 +783,7 @@ void Assembler::cmpxchg_b(const Operand& dst, Register src) {
   emit_operand(src, dst);
 }
 
-void Assembler::cmpxchg_w(const Operand& dst, Register src) {
+void Assembler::cmpxchg_w(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x0F);
@@ -803,34 +798,36 @@ void Assembler::lfence() {
   EMIT(0xE8);
 }
 
+void Assembler::pause() {
+  EnsureSpace ensure_space(this);
+  EMIT(0xF3);
+  EMIT(0x90);
+}
+
 void Assembler::adc(Register dst, int32_t imm32) {
   EnsureSpace ensure_space(this);
   emit_arith(2, Operand(dst), Immediate(imm32));
 }
 
-
-void Assembler::adc(Register dst, const Operand& src) {
+void Assembler::adc(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x13);
   emit_operand(dst, src);
 }
 
-
-void Assembler::add(Register dst, const Operand& src) {
+void Assembler::add(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x03);
   emit_operand(dst, src);
 }
 
-
-void Assembler::add(const Operand& dst, Register src) {
+void Assembler::add(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   EMIT(0x01);
   emit_operand(src, dst);
 }
 
-
-void Assembler::add(const Operand& dst, const Immediate& x) {
+void Assembler::add(Operand dst, const Immediate& x) {
   DCHECK_NOT_NULL(reloc_info_writer.last_pc());
   EnsureSpace ensure_space(this);
   emit_arith(0, dst, x);
@@ -847,27 +844,24 @@ void Assembler::and_(Register dst, const Immediate& x) {
   emit_arith(4, Operand(dst), x);
 }
 
-
-void Assembler::and_(Register dst, const Operand& src) {
+void Assembler::and_(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x23);
   emit_operand(dst, src);
 }
 
-
-void Assembler::and_(const Operand& dst, const Immediate& x) {
+void Assembler::and_(Operand dst, const Immediate& x) {
   EnsureSpace ensure_space(this);
   emit_arith(4, dst, x);
 }
 
-
-void Assembler::and_(const Operand& dst, Register src) {
+void Assembler::and_(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   EMIT(0x21);
   emit_operand(src, dst);
 }
 
-void Assembler::cmpb(const Operand& op, Immediate imm8) {
+void Assembler::cmpb(Operand op, Immediate imm8) {
   DCHECK(imm8.is_int8() || imm8.is_uint8());
   EnsureSpace ensure_space(this);
   if (op.is_reg(eax)) {
@@ -879,24 +873,21 @@ void Assembler::cmpb(const Operand& op, Immediate imm8) {
   emit_b(imm8);
 }
 
-
-void Assembler::cmpb(const Operand& op, Register reg) {
+void Assembler::cmpb(Operand op, Register reg) {
   CHECK(reg.is_byte_register());
   EnsureSpace ensure_space(this);
   EMIT(0x38);
   emit_operand(reg, op);
 }
 
-
-void Assembler::cmpb(Register reg, const Operand& op) {
+void Assembler::cmpb(Register reg, Operand op) {
   CHECK(reg.is_byte_register());
   EnsureSpace ensure_space(this);
   EMIT(0x3A);
   emit_operand(reg, op);
 }
 
-
-void Assembler::cmpw(const Operand& op, Immediate imm16) {
+void Assembler::cmpw(Operand op, Immediate imm16) {
   DCHECK(imm16.is_int16() || imm16.is_uint16());
   EnsureSpace ensure_space(this);
   EMIT(0x66);
@@ -905,14 +896,14 @@ void Assembler::cmpw(const Operand& op, Immediate imm16) {
   emit_w(imm16);
 }
 
-void Assembler::cmpw(Register reg, const Operand& op) {
+void Assembler::cmpw(Register reg, Operand op) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x3B);
   emit_operand(reg, op);
 }
 
-void Assembler::cmpw(const Operand& op, Register reg) {
+void Assembler::cmpw(Operand op, Register reg) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x39);
@@ -929,38 +920,35 @@ void Assembler::cmp(Register reg, Handle<HeapObject> handle) {
   emit_arith(7, Operand(reg), Immediate(handle));
 }
 
-
-void Assembler::cmp(Register reg, const Operand& op) {
+void Assembler::cmp(Register reg, Operand op) {
   EnsureSpace ensure_space(this);
   EMIT(0x3B);
   emit_operand(reg, op);
 }
 
-void Assembler::cmp(const Operand& op, Register reg) {
+void Assembler::cmp(Operand op, Register reg) {
   EnsureSpace ensure_space(this);
   EMIT(0x39);
   emit_operand(reg, op);
 }
 
-void Assembler::cmp(const Operand& op, const Immediate& imm) {
+void Assembler::cmp(Operand op, const Immediate& imm) {
   EnsureSpace ensure_space(this);
   emit_arith(7, op, imm);
 }
 
-void Assembler::cmp(const Operand& op, Handle<HeapObject> handle) {
+void Assembler::cmp(Operand op, Handle<HeapObject> handle) {
   EnsureSpace ensure_space(this);
   emit_arith(7, op, Immediate(handle));
 }
 
-
-void Assembler::cmpb_al(const Operand& op) {
+void Assembler::cmpb_al(Operand op) {
   EnsureSpace ensure_space(this);
   EMIT(0x38);  // CMP r/m8, r8
   emit_operand(eax, op);  // eax has same code as register al.
 }
 
-
-void Assembler::cmpw_ax(const Operand& op) {
+void Assembler::cmpw_ax(Operand op) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x39);  // CMP r/m16, r16
@@ -975,8 +963,7 @@ void Assembler::dec_b(Register dst) {
   EMIT(0xC8 | dst.code());
 }
 
-
-void Assembler::dec_b(const Operand& dst) {
+void Assembler::dec_b(Operand dst) {
   EnsureSpace ensure_space(this);
   EMIT(0xFE);
   emit_operand(ecx, dst);
@@ -988,8 +975,7 @@ void Assembler::dec(Register dst) {
   EMIT(0x48 | dst.code());
 }
 
-
-void Assembler::dec(const Operand& dst) {
+void Assembler::dec(Operand dst) {
   EnsureSpace ensure_space(this);
   EMIT(0xFF);
   emit_operand(ecx, dst);
@@ -1001,15 +987,13 @@ void Assembler::cdq() {
   EMIT(0x99);
 }
 
-
-void Assembler::idiv(const Operand& src) {
+void Assembler::idiv(Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF7);
   emit_operand(edi, src);
 }
 
-
-void Assembler::div(const Operand& src) {
+void Assembler::div(Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF7);
   emit_operand(esi, src);
@@ -1022,8 +1006,7 @@ void Assembler::imul(Register reg) {
   EMIT(0xE8 | reg.code());
 }
 
-
-void Assembler::imul(Register dst, const Operand& src) {
+void Assembler::imul(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0xAF);
@@ -1035,8 +1018,7 @@ void Assembler::imul(Register dst, Register src, int32_t imm32) {
   imul(dst, Operand(src), imm32);
 }
 
-
-void Assembler::imul(Register dst, const Operand& src, int32_t imm32) {
+void Assembler::imul(Register dst, Operand src, int32_t imm32) {
   EnsureSpace ensure_space(this);
   if (is_int8(imm32)) {
     EMIT(0x6B);
@@ -1055,15 +1037,13 @@ void Assembler::inc(Register dst) {
   EMIT(0x40 | dst.code());
 }
 
-
-void Assembler::inc(const Operand& dst) {
+void Assembler::inc(Operand dst) {
   EnsureSpace ensure_space(this);
   EMIT(0xFF);
   emit_operand(eax, dst);
 }
 
-
-void Assembler::lea(Register dst, const Operand& src) {
+void Assembler::lea(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x8D);
   emit_operand(dst, src);
@@ -1083,8 +1063,7 @@ void Assembler::neg(Register dst) {
   EMIT(0xD8 | dst.code());
 }
 
-
-void Assembler::neg(const Operand& dst) {
+void Assembler::neg(Operand dst) {
   EnsureSpace ensure_space(this);
   EMIT(0xF7);
   emit_operand(ebx, dst);
@@ -1097,8 +1076,7 @@ void Assembler::not_(Register dst) {
   EMIT(0xD0 | dst.code());
 }
 
-
-void Assembler::not_(const Operand& dst) {
+void Assembler::not_(Operand dst) {
   EnsureSpace ensure_space(this);
   EMIT(0xF7);
   emit_operand(edx, dst);
@@ -1110,21 +1088,18 @@ void Assembler::or_(Register dst, int32_t imm32) {
   emit_arith(1, Operand(dst), Immediate(imm32));
 }
 
-
-void Assembler::or_(Register dst, const Operand& src) {
+void Assembler::or_(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0B);
   emit_operand(dst, src);
 }
 
-
-void Assembler::or_(const Operand& dst, const Immediate& x) {
+void Assembler::or_(Operand dst, const Immediate& x) {
   EnsureSpace ensure_space(this);
   emit_arith(1, dst, x);
 }
 
-
-void Assembler::or_(const Operand& dst, Register src) {
+void Assembler::or_(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   EMIT(0x09);
   emit_operand(src, dst);
@@ -1158,8 +1133,7 @@ void Assembler::rcr(Register dst, uint8_t imm8) {
   }
 }
 
-
-void Assembler::ror(const Operand& dst, uint8_t imm8) {
+void Assembler::ror(Operand dst, uint8_t imm8) {
   EnsureSpace ensure_space(this);
   DCHECK(is_uint5(imm8));  // illegal shift count
   if (imm8 == 1) {
@@ -1172,15 +1146,13 @@ void Assembler::ror(const Operand& dst, uint8_t imm8) {
   }
 }
 
-
-void Assembler::ror_cl(const Operand& dst) {
+void Assembler::ror_cl(Operand dst) {
   EnsureSpace ensure_space(this);
   EMIT(0xD3);
   emit_operand(ecx, dst);
 }
 
-
-void Assembler::sar(const Operand& dst, uint8_t imm8) {
+void Assembler::sar(Operand dst, uint8_t imm8) {
   EnsureSpace ensure_space(this);
   DCHECK(is_uint5(imm8));  // illegal shift count
   if (imm8 == 1) {
@@ -1193,14 +1165,13 @@ void Assembler::sar(const Operand& dst, uint8_t imm8) {
   }
 }
 
-
-void Assembler::sar_cl(const Operand& dst) {
+void Assembler::sar_cl(Operand dst) {
   EnsureSpace ensure_space(this);
   EMIT(0xD3);
   emit_operand(edi, dst);
 }
 
-void Assembler::sbb(Register dst, const Operand& src) {
+void Assembler::sbb(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x1B);
   emit_operand(dst, src);
@@ -1222,8 +1193,7 @@ void Assembler::shld_cl(Register dst, Register src) {
   emit_operand(src, Operand(dst));
 }
 
-
-void Assembler::shl(const Operand& dst, uint8_t imm8) {
+void Assembler::shl(Operand dst, uint8_t imm8) {
   EnsureSpace ensure_space(this);
   DCHECK(is_uint5(imm8));  // illegal shift count
   if (imm8 == 1) {
@@ -1236,14 +1206,13 @@ void Assembler::shl(const Operand& dst, uint8_t imm8) {
   }
 }
 
-
-void Assembler::shl_cl(const Operand& dst) {
+void Assembler::shl_cl(Operand dst) {
   EnsureSpace ensure_space(this);
   EMIT(0xD3);
   emit_operand(esp, dst);
 }
 
-void Assembler::shr(const Operand& dst, uint8_t imm8) {
+void Assembler::shr(Operand dst, uint8_t imm8) {
   EnsureSpace ensure_space(this);
   DCHECK(is_uint5(imm8));  // illegal shift count
   if (imm8 == 1) {
@@ -1256,8 +1225,7 @@ void Assembler::shr(const Operand& dst, uint8_t imm8) {
   }
 }
 
-
-void Assembler::shr_cl(const Operand& dst) {
+void Assembler::shr_cl(Operand dst) {
   EnsureSpace ensure_space(this);
   EMIT(0xD3);
   emit_operand(ebp, dst);
@@ -1272,32 +1240,37 @@ void Assembler::shrd(Register dst, Register src, uint8_t shift) {
   EMIT(shift);
 }
 
-void Assembler::shrd_cl(const Operand& dst, Register src) {
+void Assembler::shrd_cl(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0xAD);
   emit_operand(src, dst);
 }
 
-void Assembler::sub(const Operand& dst, const Immediate& x) {
+void Assembler::sub(Operand dst, const Immediate& x) {
   EnsureSpace ensure_space(this);
   emit_arith(5, dst, x);
 }
 
-
-void Assembler::sub(Register dst, const Operand& src) {
+void Assembler::sub(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x2B);
   emit_operand(dst, src);
 }
 
-
-void Assembler::sub(const Operand& dst, Register src) {
+void Assembler::sub(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   EMIT(0x29);
   emit_operand(src, dst);
 }
 
+void Assembler::sub_sp_32(uint32_t imm) {
+  EnsureSpace ensure_space(this);
+  EMIT(0x81);  // using a literal 32-bit immediate.
+  static constexpr Register ireg = Register::from_code<5>();
+  emit_operand(ireg, Operand(esp));
+  emit(imm);
+}
 
 void Assembler::test(Register reg, const Immediate& imm) {
   if (imm.is_uint8()) {
@@ -1317,23 +1290,20 @@ void Assembler::test(Register reg, const Immediate& imm) {
   emit(imm);
 }
 
-
-void Assembler::test(Register reg, const Operand& op) {
+void Assembler::test(Register reg, Operand op) {
   EnsureSpace ensure_space(this);
   EMIT(0x85);
   emit_operand(reg, op);
 }
 
-
-void Assembler::test_b(Register reg, const Operand& op) {
+void Assembler::test_b(Register reg, Operand op) {
   CHECK(reg.is_byte_register());
   EnsureSpace ensure_space(this);
   EMIT(0x84);
   emit_operand(reg, op);
 }
 
-
-void Assembler::test(const Operand& op, const Immediate& imm) {
+void Assembler::test(Operand op, const Immediate& imm) {
   if (op.is_reg_only()) {
     test(op.reg(), imm);
     return;
@@ -1365,7 +1335,7 @@ void Assembler::test_b(Register reg, Immediate imm8) {
   }
 }
 
-void Assembler::test_b(const Operand& op, Immediate imm8) {
+void Assembler::test_b(Operand op, Immediate imm8) {
   if (op.is_reg_only()) {
     test_b(op.reg(), imm8);
     return;
@@ -1390,14 +1360,14 @@ void Assembler::test_w(Register reg, Immediate imm16) {
   }
 }
 
-void Assembler::test_w(Register reg, const Operand& op) {
+void Assembler::test_w(Register reg, Operand op) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x85);
   emit_operand(reg, op);
 }
 
-void Assembler::test_w(const Operand& op, Immediate imm16) {
+void Assembler::test_w(Operand op, Immediate imm16) {
   DCHECK(imm16.is_int16() || imm16.is_uint16());
   if (op.is_reg_only()) {
     test_w(op.reg(), imm16);
@@ -1415,52 +1385,45 @@ void Assembler::xor_(Register dst, int32_t imm32) {
   emit_arith(6, Operand(dst), Immediate(imm32));
 }
 
-
-void Assembler::xor_(Register dst, const Operand& src) {
+void Assembler::xor_(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x33);
   emit_operand(dst, src);
 }
 
-
-void Assembler::xor_(const Operand& dst, Register src) {
+void Assembler::xor_(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   EMIT(0x31);
   emit_operand(src, dst);
 }
 
-
-void Assembler::xor_(const Operand& dst, const Immediate& x) {
+void Assembler::xor_(Operand dst, const Immediate& x) {
   EnsureSpace ensure_space(this);
   emit_arith(6, dst, x);
 }
 
-
-void Assembler::bt(const Operand& dst, Register src) {
+void Assembler::bt(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0xA3);
   emit_operand(src, dst);
 }
 
-
-void Assembler::bts(const Operand& dst, Register src) {
+void Assembler::bts(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0xAB);
   emit_operand(src, dst);
 }
 
-
-void Assembler::bsr(Register dst, const Operand& src) {
+void Assembler::bsr(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0xBD);
   emit_operand(dst, src);
 }
 
-
-void Assembler::bsf(Register dst, const Operand& src) {
+void Assembler::bsf(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0xBC);
@@ -1650,13 +1613,12 @@ void Assembler::wasm_call(Address entry, RelocInfo::Mode rmode) {
   emit(reinterpret_cast<intptr_t>(entry), rmode);
 }
 
-int Assembler::CallSize(const Operand& adr) {
+int Assembler::CallSize(Operand adr) {
   // Call size is 1 (opcode) + adr.len_ (operand).
   return 1 + adr.len_;
 }
 
-
-void Assembler::call(const Operand& adr) {
+void Assembler::call(Operand adr) {
   EnsureSpace ensure_space(this);
   EMIT(0xFF);
   emit_operand(edx, adr);
@@ -1729,8 +1691,7 @@ void Assembler::jmp(byte* entry, RelocInfo::Mode rmode) {
   }
 }
 
-
-void Assembler::jmp(const Operand& adr) {
+void Assembler::jmp(Operand adr) {
   EnsureSpace ensure_space(this);
   EMIT(0xFF);
   emit_operand(esp, adr);
@@ -1854,94 +1815,81 @@ void Assembler::fldln2() {
   EMIT(0xED);
 }
 
-
-void Assembler::fld_s(const Operand& adr) {
+void Assembler::fld_s(Operand adr) {
   EnsureSpace ensure_space(this);
   EMIT(0xD9);
   emit_operand(eax, adr);
 }
 
-
-void Assembler::fld_d(const Operand& adr) {
+void Assembler::fld_d(Operand adr) {
   EnsureSpace ensure_space(this);
   EMIT(0xDD);
   emit_operand(eax, adr);
 }
 
-
-void Assembler::fstp_s(const Operand& adr) {
+void Assembler::fstp_s(Operand adr) {
   EnsureSpace ensure_space(this);
   EMIT(0xD9);
   emit_operand(ebx, adr);
 }
 
-
-void Assembler::fst_s(const Operand& adr) {
+void Assembler::fst_s(Operand adr) {
   EnsureSpace ensure_space(this);
   EMIT(0xD9);
   emit_operand(edx, adr);
 }
 
-
-void Assembler::fstp_d(const Operand& adr) {
+void Assembler::fstp_d(Operand adr) {
   EnsureSpace ensure_space(this);
   EMIT(0xDD);
   emit_operand(ebx, adr);
 }
 
-
-void Assembler::fst_d(const Operand& adr) {
+void Assembler::fst_d(Operand adr) {
   EnsureSpace ensure_space(this);
   EMIT(0xDD);
   emit_operand(edx, adr);
 }
 
-
-void Assembler::fild_s(const Operand& adr) {
+void Assembler::fild_s(Operand adr) {
   EnsureSpace ensure_space(this);
   EMIT(0xDB);
   emit_operand(eax, adr);
 }
 
-
-void Assembler::fild_d(const Operand& adr) {
+void Assembler::fild_d(Operand adr) {
   EnsureSpace ensure_space(this);
   EMIT(0xDF);
   emit_operand(ebp, adr);
 }
 
-
-void Assembler::fistp_s(const Operand& adr) {
+void Assembler::fistp_s(Operand adr) {
   EnsureSpace ensure_space(this);
   EMIT(0xDB);
   emit_operand(ebx, adr);
 }
 
-
-void Assembler::fisttp_s(const Operand& adr) {
+void Assembler::fisttp_s(Operand adr) {
   DCHECK(IsEnabled(SSE3));
   EnsureSpace ensure_space(this);
   EMIT(0xDB);
   emit_operand(ecx, adr);
 }
 
-
-void Assembler::fisttp_d(const Operand& adr) {
+void Assembler::fisttp_d(Operand adr) {
   DCHECK(IsEnabled(SSE3));
   EnsureSpace ensure_space(this);
   EMIT(0xDD);
   emit_operand(ecx, adr);
 }
 
-
-void Assembler::fist_s(const Operand& adr) {
+void Assembler::fist_s(Operand adr) {
   EnsureSpace ensure_space(this);
   EMIT(0xDB);
   emit_operand(edx, adr);
 }
 
-
-void Assembler::fistp_d(const Operand& adr) {
+void Assembler::fistp_d(Operand adr) {
   EnsureSpace ensure_space(this);
   EMIT(0xDF);
   emit_operand(edi, adr);
@@ -2034,8 +1982,7 @@ void Assembler::fsub_i(int i) {
   emit_farith(0xD8, 0xE0, i);
 }
 
-
-void Assembler::fisub_s(const Operand& adr) {
+void Assembler::fisub_s(Operand adr) {
   EnsureSpace ensure_space(this);
   EMIT(0xDA);
   emit_operand(esp, adr);
@@ -2211,8 +2158,7 @@ void Assembler::setcc(Condition cc, Register reg) {
   EMIT(0xC0 | reg.code());
 }
 
-
-void Assembler::cvttss2si(Register dst, const Operand& src) {
+void Assembler::cvttss2si(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
   EMIT(0x0F);
@@ -2220,8 +2166,7 @@ void Assembler::cvttss2si(Register dst, const Operand& src) {
   emit_operand(dst, src);
 }
 
-
-void Assembler::cvttsd2si(Register dst, const Operand& src) {
+void Assembler::cvttsd2si(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);
   EMIT(0x0F);
@@ -2238,8 +2183,7 @@ void Assembler::cvtsd2si(Register dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::cvtsi2ss(XMMRegister dst, const Operand& src) {
+void Assembler::cvtsi2ss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
   EMIT(0x0F);
@@ -2247,8 +2191,7 @@ void Assembler::cvtsi2ss(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::cvtsi2sd(XMMRegister dst, const Operand& src) {
+void Assembler::cvtsi2sd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);
   EMIT(0x0F);
@@ -2256,8 +2199,7 @@ void Assembler::cvtsi2sd(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::cvtss2sd(XMMRegister dst, const Operand& src) {
+void Assembler::cvtss2sd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
   EMIT(0x0F);
@@ -2265,8 +2207,7 @@ void Assembler::cvtss2sd(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::cvtsd2ss(XMMRegister dst, const Operand& src) {
+void Assembler::cvtsd2ss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);
   EMIT(0x0F);
@@ -2274,14 +2215,14 @@ void Assembler::cvtsd2ss(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::cvtdq2ps(XMMRegister dst, const Operand& src) {
+void Assembler::cvtdq2ps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x5B);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::cvttps2dq(XMMRegister dst, const Operand& src) {
+void Assembler::cvttps2dq(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
   EMIT(0x0F);
@@ -2289,7 +2230,7 @@ void Assembler::cvttps2dq(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::addsd(XMMRegister dst, const Operand& src) {
+void Assembler::addsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);
   EMIT(0x0F);
@@ -2297,8 +2238,7 @@ void Assembler::addsd(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::mulsd(XMMRegister dst, const Operand& src) {
+void Assembler::mulsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);
   EMIT(0x0F);
@@ -2306,8 +2246,7 @@ void Assembler::mulsd(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::subsd(XMMRegister dst, const Operand& src) {
+void Assembler::subsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);
   EMIT(0x0F);
@@ -2315,8 +2254,7 @@ void Assembler::subsd(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::divsd(XMMRegister dst, const Operand& src) {
+void Assembler::divsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);
   EMIT(0x0F);
@@ -2324,8 +2262,7 @@ void Assembler::divsd(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::xorpd(XMMRegister dst, XMMRegister src) {
+void Assembler::xorpd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x0F);
@@ -2333,91 +2270,84 @@ void Assembler::xorpd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::andps(XMMRegister dst, const Operand& src) {
+void Assembler::andps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x54);
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::orps(XMMRegister dst, const Operand& src) {
+void Assembler::orps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x56);
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::xorps(XMMRegister dst, const Operand& src) {
+void Assembler::xorps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x57);
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::addps(XMMRegister dst, const Operand& src) {
+void Assembler::addps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x58);
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::subps(XMMRegister dst, const Operand& src) {
+void Assembler::subps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x5C);
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::mulps(XMMRegister dst, const Operand& src) {
+void Assembler::mulps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x59);
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::divps(XMMRegister dst, const Operand& src) {
+void Assembler::divps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x5E);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::rcpps(XMMRegister dst, const Operand& src) {
+void Assembler::rcpps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x53);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::rsqrtps(XMMRegister dst, const Operand& src) {
+void Assembler::rsqrtps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x52);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::minps(XMMRegister dst, const Operand& src) {
+void Assembler::minps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x5D);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::maxps(XMMRegister dst, const Operand& src) {
+void Assembler::maxps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x5F);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::cmpps(XMMRegister dst, const Operand& src, int8_t cmp) {
+void Assembler::cmpps(XMMRegister dst, Operand src, int8_t cmp) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0xC2);
@@ -2425,7 +2355,7 @@ void Assembler::cmpps(XMMRegister dst, const Operand& src, int8_t cmp) {
   EMIT(cmp);
 }
 
-void Assembler::sqrtsd(XMMRegister dst, const Operand& src) {
+void Assembler::sqrtsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);
   EMIT(0x0F);
@@ -2433,7 +2363,8 @@ void Assembler::sqrtsd(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::haddps(XMMRegister dst, const Operand& src) {
+void Assembler::haddps(XMMRegister dst, Operand src) {
+  DCHECK(IsEnabled(SSE3));
   EnsureSpace ensure_space(this);
   EMIT(0xF2);
   EMIT(0x0F);
@@ -2441,7 +2372,7 @@ void Assembler::haddps(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::andpd(XMMRegister dst, XMMRegister src) {
+void Assembler::andpd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x0F);
@@ -2449,8 +2380,7 @@ void Assembler::andpd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::orpd(XMMRegister dst, XMMRegister src) {
+void Assembler::orpd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x0F);
@@ -2458,8 +2388,7 @@ void Assembler::orpd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::ucomisd(XMMRegister dst, const Operand& src) {
+void Assembler::ucomisd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x0F);
@@ -2510,8 +2439,7 @@ void Assembler::movmskps(Register dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::maxsd(XMMRegister dst, const Operand& src) {
+void Assembler::maxsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);
   EMIT(0x0F);
@@ -2519,8 +2447,7 @@ void Assembler::maxsd(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::minsd(XMMRegister dst, const Operand& src) {
+void Assembler::minsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);
   EMIT(0x0F);
@@ -2553,14 +2480,14 @@ void Assembler::movups(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::movups(XMMRegister dst, const Operand& src) {
+void Assembler::movups(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x10);
   emit_sse_operand(dst, src);
 }
 
-void Assembler::movups(const Operand& dst, XMMRegister src) {
+void Assembler::movups(Operand dst, XMMRegister src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x11);
@@ -2576,8 +2503,7 @@ void Assembler::shufps(XMMRegister dst, XMMRegister src, byte imm8) {
   EMIT(imm8);
 }
 
-
-void Assembler::movdqa(const Operand& dst, XMMRegister src) {
+void Assembler::movdqa(Operand dst, XMMRegister src) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x0F);
@@ -2585,8 +2511,7 @@ void Assembler::movdqa(const Operand& dst, XMMRegister src) {
   emit_sse_operand(src, dst);
 }
 
-
-void Assembler::movdqa(XMMRegister dst, const Operand& src) {
+void Assembler::movdqa(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x0F);
@@ -2594,8 +2519,7 @@ void Assembler::movdqa(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::movdqu(const Operand& dst, XMMRegister src ) {
+void Assembler::movdqu(Operand dst, XMMRegister src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
   EMIT(0x0F);
@@ -2603,8 +2527,7 @@ void Assembler::movdqu(const Operand& dst, XMMRegister src ) {
   emit_sse_operand(src, dst);
 }
 
-
-void Assembler::movdqu(XMMRegister dst, const Operand& src) {
+void Assembler::movdqu(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
   EMIT(0x0F);
@@ -2612,8 +2535,7 @@ void Assembler::movdqu(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::prefetch(const Operand& src, int level) {
+void Assembler::prefetch(Operand src, int level) {
   DCHECK(is_uint2(level));
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
@@ -2623,8 +2545,7 @@ void Assembler::prefetch(const Operand& src, int level) {
   emit_sse_operand(code, src);
 }
 
-
-void Assembler::movsd(const Operand& dst, XMMRegister src ) {
+void Assembler::movsd(Operand dst, XMMRegister src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);  // double
   EMIT(0x0F);
@@ -2632,8 +2553,7 @@ void Assembler::movsd(const Operand& dst, XMMRegister src ) {
   emit_sse_operand(src, dst);
 }
 
-
-void Assembler::movsd(XMMRegister dst, const Operand& src) {
+void Assembler::movsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);  // double
   EMIT(0x0F);
@@ -2641,8 +2561,7 @@ void Assembler::movsd(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::movss(const Operand& dst, XMMRegister src ) {
+void Assembler::movss(Operand dst, XMMRegister src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);  // float
   EMIT(0x0F);
@@ -2650,8 +2569,7 @@ void Assembler::movss(const Operand& dst, XMMRegister src ) {
   emit_sse_operand(src, dst);
 }
 
-
-void Assembler::movss(XMMRegister dst, const Operand& src) {
+void Assembler::movss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);  // float
   EMIT(0x0F);
@@ -2659,8 +2577,7 @@ void Assembler::movss(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::movd(XMMRegister dst, const Operand& src) {
+void Assembler::movd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x0F);
@@ -2668,8 +2585,7 @@ void Assembler::movd(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::movd(const Operand& dst, XMMRegister src) {
+void Assembler::movd(Operand dst, XMMRegister src) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x0F);
@@ -2791,7 +2707,7 @@ void Assembler::psrlq(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::pshuflw(XMMRegister dst, const Operand& src, uint8_t shuffle) {
+void Assembler::pshuflw(XMMRegister dst, Operand src, uint8_t shuffle) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);
   EMIT(0x0F);
@@ -2800,7 +2716,7 @@ void Assembler::pshuflw(XMMRegister dst, const Operand& src, uint8_t shuffle) {
   EMIT(shuffle);
 }
 
-void Assembler::pshufd(XMMRegister dst, const Operand& src, uint8_t shuffle) {
+void Assembler::pshufd(XMMRegister dst, Operand src, uint8_t shuffle) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
   EMIT(0x0F);
@@ -2809,7 +2725,18 @@ void Assembler::pshufd(XMMRegister dst, const Operand& src, uint8_t shuffle) {
   EMIT(shuffle);
 }
 
-void Assembler::pextrb(const Operand& dst, XMMRegister src, int8_t offset) {
+void Assembler::pblendw(XMMRegister dst, Operand src, uint8_t mask) {
+  DCHECK(IsEnabled(SSE4_1));
+  EnsureSpace ensure_space(this);
+  EMIT(0x66);
+  EMIT(0x0F);
+  EMIT(0x3A);
+  EMIT(0x0E);
+  emit_sse_operand(dst, src);
+  EMIT(mask);
+}
+
+void Assembler::pextrb(Operand dst, XMMRegister src, int8_t offset) {
   DCHECK(IsEnabled(SSE4_1));
   EnsureSpace ensure_space(this);
   EMIT(0x66);
@@ -2820,7 +2747,7 @@ void Assembler::pextrb(const Operand& dst, XMMRegister src, int8_t offset) {
   EMIT(offset);
 }
 
-void Assembler::pextrw(const Operand& dst, XMMRegister src, int8_t offset) {
+void Assembler::pextrw(Operand dst, XMMRegister src, int8_t offset) {
   DCHECK(IsEnabled(SSE4_1));
   EnsureSpace ensure_space(this);
   EMIT(0x66);
@@ -2831,7 +2758,7 @@ void Assembler::pextrw(const Operand& dst, XMMRegister src, int8_t offset) {
   EMIT(offset);
 }
 
-void Assembler::pextrd(const Operand& dst, XMMRegister src, int8_t offset) {
+void Assembler::pextrd(Operand dst, XMMRegister src, int8_t offset) {
   DCHECK(IsEnabled(SSE4_1));
   EnsureSpace ensure_space(this);
   EMIT(0x66);
@@ -2842,7 +2769,7 @@ void Assembler::pextrd(const Operand& dst, XMMRegister src, int8_t offset) {
   EMIT(offset);
 }
 
-void Assembler::insertps(XMMRegister dst, const Operand& src, int8_t offset) {
+void Assembler::insertps(XMMRegister dst, Operand src, int8_t offset) {
   DCHECK(IsEnabled(SSE4_1));
   EnsureSpace ensure_space(this);
   EMIT(0x66);
@@ -2853,7 +2780,7 @@ void Assembler::insertps(XMMRegister dst, const Operand& src, int8_t offset) {
   EMIT(offset);
 }
 
-void Assembler::pinsrb(XMMRegister dst, const Operand& src, int8_t offset) {
+void Assembler::pinsrb(XMMRegister dst, Operand src, int8_t offset) {
   DCHECK(IsEnabled(SSE4_1));
   EnsureSpace ensure_space(this);
   EMIT(0x66);
@@ -2864,7 +2791,7 @@ void Assembler::pinsrb(XMMRegister dst, const Operand& src, int8_t offset) {
   EMIT(offset);
 }
 
-void Assembler::pinsrw(XMMRegister dst, const Operand& src, int8_t offset) {
+void Assembler::pinsrw(XMMRegister dst, Operand src, int8_t offset) {
   DCHECK(is_uint8(offset));
   EnsureSpace ensure_space(this);
   EMIT(0x66);
@@ -2874,7 +2801,7 @@ void Assembler::pinsrw(XMMRegister dst, const Operand& src, int8_t offset) {
   EMIT(offset);
 }
 
-void Assembler::pinsrd(XMMRegister dst, const Operand& src, int8_t offset) {
+void Assembler::pinsrd(XMMRegister dst, Operand src, int8_t offset) {
   DCHECK(IsEnabled(SSE4_1));
   EnsureSpace ensure_space(this);
   EMIT(0x66);
@@ -2885,8 +2812,7 @@ void Assembler::pinsrd(XMMRegister dst, const Operand& src, int8_t offset) {
   EMIT(offset);
 }
 
-
-void Assembler::addss(XMMRegister dst, const Operand& src) {
+void Assembler::addss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
   EMIT(0x0F);
@@ -2894,8 +2820,7 @@ void Assembler::addss(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::subss(XMMRegister dst, const Operand& src) {
+void Assembler::subss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
   EMIT(0x0F);
@@ -2903,8 +2828,7 @@ void Assembler::subss(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::mulss(XMMRegister dst, const Operand& src) {
+void Assembler::mulss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
   EMIT(0x0F);
@@ -2912,8 +2836,7 @@ void Assembler::mulss(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::divss(XMMRegister dst, const Operand& src) {
+void Assembler::divss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
   EMIT(0x0F);
@@ -2921,8 +2844,7 @@ void Assembler::divss(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::sqrtss(XMMRegister dst, const Operand& src) {
+void Assembler::sqrtss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
   EMIT(0x0F);
@@ -2930,16 +2852,14 @@ void Assembler::sqrtss(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::ucomiss(XMMRegister dst, const Operand& src) {
+void Assembler::ucomiss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0x0F);
   EMIT(0x2E);
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::maxss(XMMRegister dst, const Operand& src) {
+void Assembler::maxss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
   EMIT(0x0F);
@@ -2947,8 +2867,7 @@ void Assembler::maxss(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::minss(XMMRegister dst, const Operand& src) {
+void Assembler::minss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
   EMIT(0x0F);
@@ -2959,7 +2878,7 @@ void Assembler::minss(XMMRegister dst, const Operand& src) {
 
 // AVX instructions
 void Assembler::vfmasd(byte op, XMMRegister dst, XMMRegister src1,
-                       const Operand& src2) {
+                       Operand src2) {
   DCHECK(IsEnabled(FMA3));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(src1, kLIG, k66, k0F38, kW1);
@@ -2967,9 +2886,8 @@ void Assembler::vfmasd(byte op, XMMRegister dst, XMMRegister src1,
   emit_sse_operand(dst, src2);
 }
 
-
 void Assembler::vfmass(byte op, XMMRegister dst, XMMRegister src1,
-                       const Operand& src2) {
+                       Operand src2) {
   DCHECK(IsEnabled(FMA3));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(src1, kLIG, k66, k0F38, kW0);
@@ -2977,37 +2895,29 @@ void Assembler::vfmass(byte op, XMMRegister dst, XMMRegister src1,
   emit_sse_operand(dst, src2);
 }
 
-
-void Assembler::vsd(byte op, XMMRegister dst, XMMRegister src1,
-                    const Operand& src2) {
+void Assembler::vsd(byte op, XMMRegister dst, XMMRegister src1, Operand src2) {
   vinstr(op, dst, src1, src2, kF2, k0F, kWIG);
 }
 
-
-void Assembler::vss(byte op, XMMRegister dst, XMMRegister src1,
-                    const Operand& src2) {
+void Assembler::vss(byte op, XMMRegister dst, XMMRegister src1, Operand src2) {
   vinstr(op, dst, src1, src2, kF3, k0F, kWIG);
 }
 
-
-void Assembler::vps(byte op, XMMRegister dst, XMMRegister src1,
-                    const Operand& src2) {
+void Assembler::vps(byte op, XMMRegister dst, XMMRegister src1, Operand src2) {
   vinstr(op, dst, src1, src2, kNone, k0F, kWIG);
 }
 
-
-void Assembler::vpd(byte op, XMMRegister dst, XMMRegister src1,
-                    const Operand& src2) {
+void Assembler::vpd(byte op, XMMRegister dst, XMMRegister src1, Operand src2) {
   vinstr(op, dst, src1, src2, k66, k0F, kWIG);
 }
 
-void Assembler::vcmpps(XMMRegister dst, XMMRegister src1, const Operand& src2,
+void Assembler::vcmpps(XMMRegister dst, XMMRegister src1, Operand src2,
                        int8_t cmp) {
   vps(0xC2, dst, src1, src2);
   EMIT(cmp);
 }
 
-void Assembler::vshufps(XMMRegister dst, XMMRegister src1, const Operand& src2,
+void Assembler::vshufps(XMMRegister dst, XMMRegister src1, Operand src2,
                         byte imm8) {
   DCHECK(is_uint8(imm8));
   vps(0xC6, dst, src1, src2);
@@ -3050,56 +2960,62 @@ void Assembler::vpsrad(XMMRegister dst, XMMRegister src, int8_t imm8) {
   EMIT(imm8);
 }
 
-void Assembler::vpshuflw(XMMRegister dst, const Operand& src, uint8_t shuffle) {
+void Assembler::vpshuflw(XMMRegister dst, Operand src, uint8_t shuffle) {
   vinstr(0x70, dst, xmm0, src, kF2, k0F, kWIG);
   EMIT(shuffle);
 }
 
-void Assembler::vpshufd(XMMRegister dst, const Operand& src, uint8_t shuffle) {
+void Assembler::vpshufd(XMMRegister dst, Operand src, uint8_t shuffle) {
   vinstr(0x70, dst, xmm0, src, k66, k0F, kWIG);
   EMIT(shuffle);
 }
 
-void Assembler::vpextrb(const Operand& dst, XMMRegister src, int8_t offset) {
+void Assembler::vpblendw(XMMRegister dst, XMMRegister src1, Operand src2,
+                         uint8_t mask) {
+  vinstr(0x0E, dst, src1, src2, k66, k0F3A, kWIG);
+  EMIT(mask);
+}
+
+void Assembler::vpextrb(Operand dst, XMMRegister src, int8_t offset) {
   vinstr(0x14, src, xmm0, dst, k66, k0F3A, kWIG);
   EMIT(offset);
 }
 
-void Assembler::vpextrw(const Operand& dst, XMMRegister src, int8_t offset) {
+void Assembler::vpextrw(Operand dst, XMMRegister src, int8_t offset) {
   vinstr(0x15, src, xmm0, dst, k66, k0F3A, kWIG);
   EMIT(offset);
 }
 
-void Assembler::vpextrd(const Operand& dst, XMMRegister src, int8_t offset) {
+void Assembler::vpextrd(Operand dst, XMMRegister src, int8_t offset) {
   vinstr(0x16, src, xmm0, dst, k66, k0F3A, kWIG);
   EMIT(offset);
 }
 
-void Assembler::vinsertps(XMMRegister dst, XMMRegister src1,
-                          const Operand& src2, int8_t offset) {
+void Assembler::vinsertps(XMMRegister dst, XMMRegister src1, Operand src2,
+                          int8_t offset) {
   vinstr(0x21, dst, src1, src2, k66, k0F3A, kWIG);
   EMIT(offset);
 }
 
-void Assembler::vpinsrb(XMMRegister dst, XMMRegister src1, const Operand& src2,
+void Assembler::vpinsrb(XMMRegister dst, XMMRegister src1, Operand src2,
                         int8_t offset) {
   vinstr(0x20, dst, src1, src2, k66, k0F3A, kWIG);
   EMIT(offset);
 }
 
-void Assembler::vpinsrw(XMMRegister dst, XMMRegister src1, const Operand& src2,
+void Assembler::vpinsrw(XMMRegister dst, XMMRegister src1, Operand src2,
                         int8_t offset) {
   vinstr(0xC4, dst, src1, src2, k66, k0F, kWIG);
   EMIT(offset);
 }
 
-void Assembler::vpinsrd(XMMRegister dst, XMMRegister src1, const Operand& src2,
+void Assembler::vpinsrd(XMMRegister dst, XMMRegister src1, Operand src2,
                         int8_t offset) {
   vinstr(0x22, dst, src1, src2, k66, k0F3A, kWIG);
   EMIT(offset);
 }
 
-void Assembler::bmi1(byte op, Register reg, Register vreg, const Operand& rm) {
+void Assembler::bmi1(byte op, Register reg, Register vreg, Operand rm) {
   DCHECK(IsEnabled(BMI1));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(vreg, kLZ, kNone, k0F38, kW0);
@@ -3107,8 +3023,7 @@ void Assembler::bmi1(byte op, Register reg, Register vreg, const Operand& rm) {
   emit_operand(reg, rm);
 }
 
-
-void Assembler::tzcnt(Register dst, const Operand& src) {
+void Assembler::tzcnt(Register dst, Operand src) {
   DCHECK(IsEnabled(BMI1));
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
@@ -3117,8 +3032,7 @@ void Assembler::tzcnt(Register dst, const Operand& src) {
   emit_operand(dst, src);
 }
 
-
-void Assembler::lzcnt(Register dst, const Operand& src) {
+void Assembler::lzcnt(Register dst, Operand src) {
   DCHECK(IsEnabled(LZCNT));
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
@@ -3127,8 +3041,7 @@ void Assembler::lzcnt(Register dst, const Operand& src) {
   emit_operand(dst, src);
 }
 
-
-void Assembler::popcnt(Register dst, const Operand& src) {
+void Assembler::popcnt(Register dst, Operand src) {
   DCHECK(IsEnabled(POPCNT));
   EnsureSpace ensure_space(this);
   EMIT(0xF3);
@@ -3137,9 +3050,8 @@ void Assembler::popcnt(Register dst, const Operand& src) {
   emit_operand(dst, src);
 }
 
-
 void Assembler::bmi2(SIMDPrefix pp, byte op, Register reg, Register vreg,
-                     const Operand& rm) {
+                     Operand rm) {
   DCHECK(IsEnabled(BMI2));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(vreg, kLZ, pp, k0F38, kW0);
@@ -3147,8 +3059,7 @@ void Assembler::bmi2(SIMDPrefix pp, byte op, Register reg, Register vreg,
   emit_operand(reg, rm);
 }
 
-
-void Assembler::rorx(Register dst, const Operand& src, byte imm8) {
+void Assembler::rorx(Register dst, Operand src, byte imm8) {
   DCHECK(IsEnabled(BMI2));
   DCHECK(is_uint8(imm8));
   Register vreg = Register::from_code<0>();  // VEX.vvvv unused
@@ -3159,7 +3070,7 @@ void Assembler::rorx(Register dst, const Operand& src, byte imm8) {
   EMIT(imm8);
 }
 
-void Assembler::sse2_instr(XMMRegister dst, const Operand& src, byte prefix,
+void Assembler::sse2_instr(XMMRegister dst, Operand src, byte prefix,
                            byte escape, byte opcode) {
   EnsureSpace ensure_space(this);
   EMIT(prefix);
@@ -3168,7 +3079,7 @@ void Assembler::sse2_instr(XMMRegister dst, const Operand& src, byte prefix,
   emit_sse_operand(dst, src);
 }
 
-void Assembler::ssse3_instr(XMMRegister dst, const Operand& src, byte prefix,
+void Assembler::ssse3_instr(XMMRegister dst, Operand src, byte prefix,
                             byte escape1, byte escape2, byte opcode) {
   DCHECK(IsEnabled(SSSE3));
   EnsureSpace ensure_space(this);
@@ -3179,7 +3090,7 @@ void Assembler::ssse3_instr(XMMRegister dst, const Operand& src, byte prefix,
   emit_sse_operand(dst, src);
 }
 
-void Assembler::sse4_instr(XMMRegister dst, const Operand& src, byte prefix,
+void Assembler::sse4_instr(XMMRegister dst, Operand src, byte prefix,
                            byte escape1, byte escape2, byte opcode) {
   DCHECK(IsEnabled(SSE4_1));
   EnsureSpace ensure_space(this);
@@ -3190,9 +3101,8 @@ void Assembler::sse4_instr(XMMRegister dst, const Operand& src, byte prefix,
   emit_sse_operand(dst, src);
 }
 
-void Assembler::vinstr(byte op, XMMRegister dst, XMMRegister src1,
-                       const Operand& src2, SIMDPrefix pp, LeadingOpcode m,
-                       VexW w) {
+void Assembler::vinstr(byte op, XMMRegister dst, XMMRegister src1, Operand src2,
+                       SIMDPrefix pp, LeadingOpcode m, VexW w) {
   DCHECK(IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(src1, kL128, pp, m, w);
@@ -3200,7 +3110,7 @@ void Assembler::vinstr(byte op, XMMRegister dst, XMMRegister src1,
   emit_sse_operand(dst, src2);
 }
 
-void Assembler::emit_sse_operand(XMMRegister reg, const Operand& adr) {
+void Assembler::emit_sse_operand(XMMRegister reg, Operand adr) {
   Register ireg = Register::from_code(reg.code());
   emit_operand(ireg, adr);
 }
@@ -3253,7 +3163,7 @@ void Assembler::GrowBuffer() {
   // Some internal data structures overflow for very large buffers,
   // they must ensure that kMaximalBufferSize is not too large.
   if (desc.buffer_size > kMaximalBufferSize) {
-    V8::FatalProcessOutOfMemory("Assembler::GrowBuffer");
+    V8::FatalProcessOutOfMemory(nullptr, "Assembler::GrowBuffer");
   }
 
   // Set up new buffer.
@@ -3320,8 +3230,7 @@ void Assembler::emit_arith(int sel, Operand dst, const Immediate& x) {
   }
 }
 
-
-void Assembler::emit_operand(Register reg, const Operand& adr) {
+void Assembler::emit_operand(Register reg, Operand adr) {
   const unsigned length = adr.len_;
   DCHECK_GT(length, 0);
 
diff --git a/deps/v8/src/ia32/assembler-ia32.h b/deps/v8/src/ia32/assembler-ia32.h
index d57e3bee714..78bcec73a45 100644
--- a/deps/v8/src/ia32/assembler-ia32.h
+++ b/deps/v8/src/ia32/assembler-ia32.h
@@ -103,8 +103,8 @@ class Register : public RegisterBase<Register, kRegAfterLast> {
   explicit constexpr Register(int code) : RegisterBase(code) {}
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(Register) &&
-                  sizeof(Register) == sizeof(int),
+ASSERT_TRIVIALLY_COPYABLE(Register);
+static_assert(sizeof(Register) == sizeof(int),
               "Register can efficiently be passed by value");
 
 #define DEFINE_REGISTER(R) \
@@ -233,30 +233,19 @@ enum RoundingMode {
 
 class Immediate BASE_EMBEDDED {
  public:
-  inline explicit Immediate(int x) {
+  inline explicit Immediate(int x, RelocInfo::Mode rmode = RelocInfo::NONE) {
     value_.immediate = x;
-    rmode_ = RelocInfo::NONE32;
-  }
-  inline explicit Immediate(const ExternalReference& ext) {
-    value_.immediate = reinterpret_cast<int32_t>(ext.address());
-    rmode_ = RelocInfo::EXTERNAL_REFERENCE;
-  }
-  inline explicit Immediate(Handle<HeapObject> handle) {
-    value_.immediate = reinterpret_cast<intptr_t>(handle.address());
-    rmode_ = RelocInfo::EMBEDDED_OBJECT;
-  }
-  inline explicit Immediate(Smi* value) {
-    value_.immediate = reinterpret_cast<intptr_t>(value);
-    rmode_ = RelocInfo::NONE32;
-  }
-  inline explicit Immediate(Address addr) {
-    value_.immediate = reinterpret_cast<int32_t>(addr);
-    rmode_ = RelocInfo::NONE32;
-  }
-  inline explicit Immediate(Address x, RelocInfo::Mode rmode) {
-    value_.immediate = reinterpret_cast<int32_t>(x);
     rmode_ = rmode;
   }
+  inline explicit Immediate(const ExternalReference& ext)
+      : Immediate(ext.address(), RelocInfo::EXTERNAL_REFERENCE) {}
+  inline explicit Immediate(Handle<HeapObject> handle)
+      : Immediate(handle.address(), RelocInfo::EMBEDDED_OBJECT) {}
+  inline explicit Immediate(Smi* value)
+      : Immediate(reinterpret_cast<intptr_t>(value)) {}
+  inline explicit Immediate(Address addr,
+                            RelocInfo::Mode rmode = RelocInfo::NONE)
+      : Immediate(reinterpret_cast<int32_t>(addr), rmode) {}
 
   static Immediate EmbeddedNumber(double number);  // Smi or HeapNumber.
   static Immediate EmbeddedCode(CodeStub* code);
@@ -333,8 +322,7 @@ enum ScaleFactor {
   times_twice_pointer_size = times_8
 };
 
-
-class Operand BASE_EMBEDDED {
+class Operand {
  public:
   // reg
   INLINE(explicit Operand(Register reg)) { set_modrm(3, reg); }
@@ -352,24 +340,22 @@ class Operand BASE_EMBEDDED {
   }
 
   // [disp/r]
-  INLINE(explicit Operand(Immediate imm));
+  INLINE(explicit Operand(Immediate imm)) {
+    set_modrm(0, ebp);
+    set_dispr(imm.immediate(), imm.rmode_);
+  }
 
   // [base + disp/r]
   explicit Operand(Register base, int32_t disp,
-                   RelocInfo::Mode rmode = RelocInfo::NONE32);
+                   RelocInfo::Mode rmode = RelocInfo::NONE);
 
   // [base + index*scale + disp/r]
-  explicit Operand(Register base,
-                   Register index,
-                   ScaleFactor scale,
-                   int32_t disp,
-                   RelocInfo::Mode rmode = RelocInfo::NONE32);
+  explicit Operand(Register base, Register index, ScaleFactor scale,
+                   int32_t disp, RelocInfo::Mode rmode = RelocInfo::NONE);
 
   // [index*scale + disp/r]
-  explicit Operand(Register index,
-                   ScaleFactor scale,
-                   int32_t disp,
-                   RelocInfo::Mode rmode = RelocInfo::NONE32);
+  explicit Operand(Register index, ScaleFactor scale, int32_t disp,
+                   RelocInfo::Mode rmode = RelocInfo::NONE);
 
   static Operand JumpTable(Register index, ScaleFactor scale, Label* table) {
     return Operand(index, scale, reinterpret_cast<int32_t>(table),
@@ -429,13 +415,16 @@ class Operand BASE_EMBEDDED {
 
   byte buf_[6];
   // The number of bytes in buf_.
-  unsigned int len_;
+  uint8_t len_;
   // Only valid if len_ > 4.
   RelocInfo::Mode rmode_;
 
+  // TODO(clemensh): Get rid of this friendship, or make Operand immutable.
   friend class Assembler;
 };
-
+ASSERT_TRIVIALLY_COPYABLE(Operand);
+static_assert(sizeof(Operand) <= 2 * kPointerSize,
+              "Operand must be small enough to pass it by value");
 
 // -----------------------------------------------------------------------------
 // A Displacement describes the 32bit immediate field of an instruction which
@@ -529,7 +518,7 @@ class Assembler : public AssemblerBase {
   // The isolate argument is unused (and may be nullptr) when skipping flushing.
   inline static Address target_address_at(Address pc, Address constant_pool);
   inline static void set_target_address_at(
-      Isolate* isolate, Address pc, Address constant_pool, Address target,
+      Address pc, Address constant_pool, Address target,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
   // Return the code target address at a call site from the return address
@@ -539,12 +528,11 @@ class Assembler : public AssemblerBase {
   // This sets the branch destination (which is in the instruction on x86).
   // This is for calls and branches within generated code.
   inline static void deserialization_set_special_target_at(
-      Isolate* isolate, Address instruction_payload, Code* code,
-      Address target);
+      Address instruction_payload, Code* code, Address target);
 
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
-      Isolate* isolate, Address pc, Address target,
+      Address pc, Address target,
       RelocInfo::Mode mode = RelocInfo::INTERNAL_REFERENCE);
 
   static constexpr int kSpecialTargetSize = kPointerSize;
@@ -610,53 +598,54 @@ class Assembler : public AssemblerBase {
   void push(const Immediate& x);
   void push_imm32(int32_t imm32);
   void push(Register src);
-  void push(const Operand& src);
+  void push(Operand src);
 
   void pop(Register dst);
-  void pop(const Operand& dst);
+  void pop(Operand dst);
 
   void enter(const Immediate& size);
   void leave();
 
   // Moves
   void mov_b(Register dst, Register src) { mov_b(dst, Operand(src)); }
-  void mov_b(Register dst, const Operand& src);
+  void mov_b(Register dst, Operand src);
   void mov_b(Register dst, int8_t imm8) { mov_b(Operand(dst), imm8); }
-  void mov_b(const Operand& dst, int8_t src) { mov_b(dst, Immediate(src)); }
-  void mov_b(const Operand& dst, const Immediate& src);
-  void mov_b(const Operand& dst, Register src);
+  void mov_b(Operand dst, int8_t src) { mov_b(dst, Immediate(src)); }
+  void mov_b(Operand dst, const Immediate& src);
+  void mov_b(Operand dst, Register src);
 
-  void mov_w(Register dst, const Operand& src);
-  void mov_w(const Operand& dst, int16_t src) { mov_w(dst, Immediate(src)); }
-  void mov_w(const Operand& dst, const Immediate& src);
-  void mov_w(const Operand& dst, Register src);
+  void mov_w(Register dst, Operand src);
+  void mov_w(Operand dst, int16_t src) { mov_w(dst, Immediate(src)); }
+  void mov_w(Operand dst, const Immediate& src);
+  void mov_w(Operand dst, Register src);
 
   void mov(Register dst, int32_t imm32);
   void mov(Register dst, const Immediate& x);
   void mov(Register dst, Handle<HeapObject> handle);
-  void mov(Register dst, const Operand& src);
+  void mov(Register dst, Operand src);
   void mov(Register dst, Register src);
-  void mov(const Operand& dst, const Immediate& x);
-  void mov(const Operand& dst, Handle<HeapObject> handle);
-  void mov(const Operand& dst, Register src);
+  void mov(Operand dst, const Immediate& x);
+  void mov(Operand dst, Handle<HeapObject> handle);
+  void mov(Operand dst, Register src);
+  void mov(Operand dst, Address src, RelocInfo::Mode);
 
   void movsx_b(Register dst, Register src) { movsx_b(dst, Operand(src)); }
-  void movsx_b(Register dst, const Operand& src);
+  void movsx_b(Register dst, Operand src);
 
   void movsx_w(Register dst, Register src) { movsx_w(dst, Operand(src)); }
-  void movsx_w(Register dst, const Operand& src);
+  void movsx_w(Register dst, Operand src);
 
   void movzx_b(Register dst, Register src) { movzx_b(dst, Operand(src)); }
-  void movzx_b(Register dst, const Operand& src);
+  void movzx_b(Register dst, Operand src);
 
   void movzx_w(Register dst, Register src) { movzx_w(dst, Operand(src)); }
-  void movzx_w(Register dst, const Operand& src);
+  void movzx_w(Register dst, Operand src);
 
   // Conditional moves
   void cmov(Condition cc, Register dst, Register src) {
     cmov(cc, dst, Operand(src));
   }
-  void cmov(Condition cc, Register dst, const Operand& src);
+  void cmov(Condition cc, Register dst, Operand src);
 
   // Flag management.
   void cld();
@@ -668,167 +657,170 @@ class Assembler : public AssemblerBase {
 
   // Exchange
   void xchg(Register dst, Register src);
-  void xchg(Register dst, const Operand& src);
-  void xchg_b(Register reg, const Operand& op);
-  void xchg_w(Register reg, const Operand& op);
+  void xchg(Register dst, Operand src);
+  void xchg_b(Register reg, Operand op);
+  void xchg_w(Register reg, Operand op);
 
   // Lock prefix
   void lock();
 
   // CompareExchange
-  void cmpxchg(const Operand& dst, Register src);
-  void cmpxchg_b(const Operand& dst, Register src);
-  void cmpxchg_w(const Operand& dst, Register src);
+  void cmpxchg(Operand dst, Register src);
+  void cmpxchg_b(Operand dst, Register src);
+  void cmpxchg_w(Operand dst, Register src);
 
   // Memory Fence
   void lfence();
 
+  void pause();
+
   // Arithmetics
   void adc(Register dst, int32_t imm32);
-  void adc(Register dst, const Operand& src);
+  void adc(Register dst, Operand src);
 
   void add(Register dst, Register src) { add(dst, Operand(src)); }
-  void add(Register dst, const Operand& src);
-  void add(const Operand& dst, Register src);
+  void add(Register dst, Operand src);
+  void add(Operand dst, Register src);
   void add(Register dst, const Immediate& imm) { add(Operand(dst), imm); }
-  void add(const Operand& dst, const Immediate& x);
+  void add(Operand dst, const Immediate& x);
 
   void and_(Register dst, int32_t imm32);
   void and_(Register dst, const Immediate& x);
   void and_(Register dst, Register src) { and_(dst, Operand(src)); }
-  void and_(Register dst, const Operand& src);
-  void and_(const Operand& dst, Register src);
-  void and_(const Operand& dst, const Immediate& x);
+  void and_(Register dst, Operand src);
+  void and_(Operand dst, Register src);
+  void and_(Operand dst, const Immediate& x);
 
   void cmpb(Register reg, Immediate imm8) { cmpb(Operand(reg), imm8); }
-  void cmpb(const Operand& op, Immediate imm8);
-  void cmpb(Register reg, const Operand& op);
-  void cmpb(const Operand& op, Register reg);
+  void cmpb(Operand op, Immediate imm8);
+  void cmpb(Register reg, Operand op);
+  void cmpb(Operand op, Register reg);
   void cmpb(Register dst, Register src) { cmpb(Operand(dst), src); }
-  void cmpb_al(const Operand& op);
-  void cmpw_ax(const Operand& op);
-  void cmpw(const Operand& dst, Immediate src);
+  void cmpb_al(Operand op);
+  void cmpw_ax(Operand op);
+  void cmpw(Operand dst, Immediate src);
   void cmpw(Register dst, Immediate src) { cmpw(Operand(dst), src); }
-  void cmpw(Register dst, const Operand& src);
+  void cmpw(Register dst, Operand src);
   void cmpw(Register dst, Register src) { cmpw(Operand(dst), src); }
-  void cmpw(const Operand& dst, Register src);
+  void cmpw(Operand dst, Register src);
   void cmp(Register reg, int32_t imm32);
   void cmp(Register reg, Handle<HeapObject> handle);
   void cmp(Register reg0, Register reg1) { cmp(reg0, Operand(reg1)); }
-  void cmp(Register reg, const Operand& op);
+  void cmp(Register reg, Operand op);
   void cmp(Register reg, const Immediate& imm) { cmp(Operand(reg), imm); }
-  void cmp(const Operand& op, Register reg);
-  void cmp(const Operand& op, const Immediate& imm);
-  void cmp(const Operand& op, Handle<HeapObject> handle);
+  void cmp(Operand op, Register reg);
+  void cmp(Operand op, const Immediate& imm);
+  void cmp(Operand op, Handle<HeapObject> handle);
 
   void dec_b(Register dst);
-  void dec_b(const Operand& dst);
+  void dec_b(Operand dst);
 
   void dec(Register dst);
-  void dec(const Operand& dst);
+  void dec(Operand dst);
 
   void cdq();
 
   void idiv(Register src) { idiv(Operand(src)); }
-  void idiv(const Operand& src);
+  void idiv(Operand src);
   void div(Register src) { div(Operand(src)); }
-  void div(const Operand& src);
+  void div(Operand src);
 
   // Signed multiply instructions.
   void imul(Register src);                               // edx:eax = eax * src.
   void imul(Register dst, Register src) { imul(dst, Operand(src)); }
-  void imul(Register dst, const Operand& src);           // dst = dst * src.
+  void imul(Register dst, Operand src);                  // dst = dst * src.
   void imul(Register dst, Register src, int32_t imm32);  // dst = src * imm32.
-  void imul(Register dst, const Operand& src, int32_t imm32);
+  void imul(Register dst, Operand src, int32_t imm32);
 
   void inc(Register dst);
-  void inc(const Operand& dst);
+  void inc(Operand dst);
 
-  void lea(Register dst, const Operand& src);
+  void lea(Register dst, Operand src);
 
   // Unsigned multiply instruction.
   void mul(Register src);                                // edx:eax = eax * reg.
 
   void neg(Register dst);
-  void neg(const Operand& dst);
+  void neg(Operand dst);
 
   void not_(Register dst);
-  void not_(const Operand& dst);
+  void not_(Operand dst);
 
   void or_(Register dst, int32_t imm32);
   void or_(Register dst, Register src) { or_(dst, Operand(src)); }
-  void or_(Register dst, const Operand& src);
-  void or_(const Operand& dst, Register src);
+  void or_(Register dst, Operand src);
+  void or_(Operand dst, Register src);
   void or_(Register dst, const Immediate& imm) { or_(Operand(dst), imm); }
-  void or_(const Operand& dst, const Immediate& x);
+  void or_(Operand dst, const Immediate& x);
 
   void rcl(Register dst, uint8_t imm8);
   void rcr(Register dst, uint8_t imm8);
 
   void ror(Register dst, uint8_t imm8) { ror(Operand(dst), imm8); }
-  void ror(const Operand& dst, uint8_t imm8);
+  void ror(Operand dst, uint8_t imm8);
   void ror_cl(Register dst) { ror_cl(Operand(dst)); }
-  void ror_cl(const Operand& dst);
+  void ror_cl(Operand dst);
 
   void sar(Register dst, uint8_t imm8) { sar(Operand(dst), imm8); }
-  void sar(const Operand& dst, uint8_t imm8);
+  void sar(Operand dst, uint8_t imm8);
   void sar_cl(Register dst) { sar_cl(Operand(dst)); }
-  void sar_cl(const Operand& dst);
+  void sar_cl(Operand dst);
 
-  void sbb(Register dst, const Operand& src);
+  void sbb(Register dst, Operand src);
 
   void shl(Register dst, uint8_t imm8) { shl(Operand(dst), imm8); }
-  void shl(const Operand& dst, uint8_t imm8);
+  void shl(Operand dst, uint8_t imm8);
   void shl_cl(Register dst) { shl_cl(Operand(dst)); }
-  void shl_cl(const Operand& dst);
+  void shl_cl(Operand dst);
   void shld(Register dst, Register src, uint8_t shift);
   void shld_cl(Register dst, Register src);
 
   void shr(Register dst, uint8_t imm8) { shr(Operand(dst), imm8); }
-  void shr(const Operand& dst, uint8_t imm8);
+  void shr(Operand dst, uint8_t imm8);
   void shr_cl(Register dst) { shr_cl(Operand(dst)); }
-  void shr_cl(const Operand& dst);
+  void shr_cl(Operand dst);
   void shrd(Register dst, Register src, uint8_t shift);
   void shrd_cl(Register dst, Register src) { shrd_cl(Operand(dst), src); }
-  void shrd_cl(const Operand& dst, Register src);
+  void shrd_cl(Operand dst, Register src);
 
   void sub(Register dst, const Immediate& imm) { sub(Operand(dst), imm); }
-  void sub(const Operand& dst, const Immediate& x);
+  void sub(Operand dst, const Immediate& x);
   void sub(Register dst, Register src) { sub(dst, Operand(src)); }
-  void sub(Register dst, const Operand& src);
-  void sub(const Operand& dst, Register src);
+  void sub(Register dst, Operand src);
+  void sub(Operand dst, Register src);
+  void sub_sp_32(uint32_t imm);
 
   void test(Register reg, const Immediate& imm);
   void test(Register reg0, Register reg1) { test(reg0, Operand(reg1)); }
-  void test(Register reg, const Operand& op);
-  void test(const Operand& op, const Immediate& imm);
-  void test(const Operand& op, Register reg) { test(reg, op); }
-  void test_b(Register reg, const Operand& op);
+  void test(Register reg, Operand op);
+  void test(Operand op, const Immediate& imm);
+  void test(Operand op, Register reg) { test(reg, op); }
+  void test_b(Register reg, Operand op);
   void test_b(Register reg, Immediate imm8);
-  void test_b(const Operand& op, Immediate imm8);
-  void test_b(const Operand& op, Register reg) { test_b(reg, op); }
+  void test_b(Operand op, Immediate imm8);
+  void test_b(Operand op, Register reg) { test_b(reg, op); }
   void test_b(Register dst, Register src) { test_b(dst, Operand(src)); }
-  void test_w(Register reg, const Operand& op);
+  void test_w(Register reg, Operand op);
   void test_w(Register reg, Immediate imm16);
-  void test_w(const Operand& op, Immediate imm16);
-  void test_w(const Operand& op, Register reg) { test_w(reg, op); }
+  void test_w(Operand op, Immediate imm16);
+  void test_w(Operand op, Register reg) { test_w(reg, op); }
   void test_w(Register dst, Register src) { test_w(dst, Operand(src)); }
 
   void xor_(Register dst, int32_t imm32);
   void xor_(Register dst, Register src) { xor_(dst, Operand(src)); }
-  void xor_(Register dst, const Operand& src);
-  void xor_(const Operand& dst, Register src);
+  void xor_(Register dst, Operand src);
+  void xor_(Operand dst, Register src);
   void xor_(Register dst, const Immediate& imm) { xor_(Operand(dst), imm); }
-  void xor_(const Operand& dst, const Immediate& x);
+  void xor_(Operand dst, const Immediate& x);
 
   // Bit operations.
-  void bt(const Operand& dst, Register src);
+  void bt(Operand dst, Register src);
   void bts(Register dst, Register src) { bts(Operand(dst), src); }
-  void bts(const Operand& dst, Register src);
+  void bts(Operand dst, Register src);
   void bsr(Register dst, Register src) { bsr(dst, Operand(src)); }
-  void bsr(Register dst, const Operand& src);
+  void bsr(Register dst, Operand src);
   void bsf(Register dst, Register src) { bsf(dst, Operand(src)); }
-  void bsf(Register dst, const Operand& src);
+  void bsf(Register dst, Operand src);
 
   // Miscellaneous
   void hlt();
@@ -857,9 +849,9 @@ class Assembler : public AssemblerBase {
   // Calls
   void call(Label* L);
   void call(byte* entry, RelocInfo::Mode rmode);
-  int CallSize(const Operand& adr);
+  int CallSize(Operand adr);
   void call(Register reg) { call(Operand(reg)); }
-  void call(const Operand& adr);
+  void call(Operand adr);
   int CallSize(Handle<Code> code, RelocInfo::Mode mode);
   void call(Handle<Code> code, RelocInfo::Mode rmode);
   void call(CodeStub* stub);
@@ -870,7 +862,7 @@ class Assembler : public AssemblerBase {
   void jmp(Label* L, Label::Distance distance = Label::kFar);
   void jmp(byte* entry, RelocInfo::Mode rmode);
   void jmp(Register reg) { jmp(Operand(reg)); }
-  void jmp(const Operand& adr);
+  void jmp(Operand adr);
   void jmp(Handle<Code> code, RelocInfo::Mode rmode);
 
   // Conditional jumps
@@ -890,25 +882,25 @@ class Assembler : public AssemblerBase {
   void fldpi();
   void fldln2();
 
-  void fld_s(const Operand& adr);
-  void fld_d(const Operand& adr);
+  void fld_s(Operand adr);
+  void fld_d(Operand adr);
 
-  void fstp_s(const Operand& adr);
-  void fst_s(const Operand& adr);
-  void fstp_d(const Operand& adr);
-  void fst_d(const Operand& adr);
+  void fstp_s(Operand adr);
+  void fst_s(Operand adr);
+  void fstp_d(Operand adr);
+  void fst_d(Operand adr);
 
-  void fild_s(const Operand& adr);
-  void fild_d(const Operand& adr);
+  void fild_s(Operand adr);
+  void fild_d(Operand adr);
 
-  void fist_s(const Operand& adr);
+  void fist_s(Operand adr);
 
-  void fistp_s(const Operand& adr);
-  void fistp_d(const Operand& adr);
+  void fistp_s(Operand adr);
+  void fistp_d(Operand adr);
 
   // The fisttp instructions require SSE3.
-  void fisttp_s(const Operand& adr);
-  void fisttp_d(const Operand& adr);
+  void fisttp_s(Operand adr);
+  void fisttp_d(Operand adr);
 
   void fabs();
   void fchs();
@@ -929,7 +921,7 @@ class Assembler : public AssemblerBase {
   void fdiv(int i);
   void fdiv_i(int i);
 
-  void fisub_s(const Operand& adr);
+  void fisub_s(Operand adr);
 
   void faddp(int i = 1);
   void fsubp(int i = 1);
@@ -962,62 +954,62 @@ class Assembler : public AssemblerBase {
 
   // SSE instructions
   void addss(XMMRegister dst, XMMRegister src) { addss(dst, Operand(src)); }
-  void addss(XMMRegister dst, const Operand& src);
+  void addss(XMMRegister dst, Operand src);
   void subss(XMMRegister dst, XMMRegister src) { subss(dst, Operand(src)); }
-  void subss(XMMRegister dst, const Operand& src);
+  void subss(XMMRegister dst, Operand src);
   void mulss(XMMRegister dst, XMMRegister src) { mulss(dst, Operand(src)); }
-  void mulss(XMMRegister dst, const Operand& src);
+  void mulss(XMMRegister dst, Operand src);
   void divss(XMMRegister dst, XMMRegister src) { divss(dst, Operand(src)); }
-  void divss(XMMRegister dst, const Operand& src);
+  void divss(XMMRegister dst, Operand src);
   void sqrtss(XMMRegister dst, XMMRegister src) { sqrtss(dst, Operand(src)); }
-  void sqrtss(XMMRegister dst, const Operand& src);
+  void sqrtss(XMMRegister dst, Operand src);
 
   void ucomiss(XMMRegister dst, XMMRegister src) { ucomiss(dst, Operand(src)); }
-  void ucomiss(XMMRegister dst, const Operand& src);
+  void ucomiss(XMMRegister dst, Operand src);
   void movaps(XMMRegister dst, XMMRegister src);
   void movups(XMMRegister dst, XMMRegister src);
-  void movups(XMMRegister dst, const Operand& src);
-  void movups(const Operand& dst, XMMRegister src);
+  void movups(XMMRegister dst, Operand src);
+  void movups(Operand dst, XMMRegister src);
   void shufps(XMMRegister dst, XMMRegister src, byte imm8);
 
   void maxss(XMMRegister dst, XMMRegister src) { maxss(dst, Operand(src)); }
-  void maxss(XMMRegister dst, const Operand& src);
+  void maxss(XMMRegister dst, Operand src);
   void minss(XMMRegister dst, XMMRegister src) { minss(dst, Operand(src)); }
-  void minss(XMMRegister dst, const Operand& src);
+  void minss(XMMRegister dst, Operand src);
 
-  void andps(XMMRegister dst, const Operand& src);
+  void andps(XMMRegister dst, Operand src);
   void andps(XMMRegister dst, XMMRegister src) { andps(dst, Operand(src)); }
-  void xorps(XMMRegister dst, const Operand& src);
+  void xorps(XMMRegister dst, Operand src);
   void xorps(XMMRegister dst, XMMRegister src) { xorps(dst, Operand(src)); }
-  void orps(XMMRegister dst, const Operand& src);
+  void orps(XMMRegister dst, Operand src);
   void orps(XMMRegister dst, XMMRegister src) { orps(dst, Operand(src)); }
 
-  void addps(XMMRegister dst, const Operand& src);
+  void addps(XMMRegister dst, Operand src);
   void addps(XMMRegister dst, XMMRegister src) { addps(dst, Operand(src)); }
-  void subps(XMMRegister dst, const Operand& src);
+  void subps(XMMRegister dst, Operand src);
   void subps(XMMRegister dst, XMMRegister src) { subps(dst, Operand(src)); }
-  void mulps(XMMRegister dst, const Operand& src);
+  void mulps(XMMRegister dst, Operand src);
   void mulps(XMMRegister dst, XMMRegister src) { mulps(dst, Operand(src)); }
-  void divps(XMMRegister dst, const Operand& src);
+  void divps(XMMRegister dst, Operand src);
   void divps(XMMRegister dst, XMMRegister src) { divps(dst, Operand(src)); }
-  void rcpps(XMMRegister dst, const Operand& src);
+  void rcpps(XMMRegister dst, Operand src);
   void rcpps(XMMRegister dst, XMMRegister src) { rcpps(dst, Operand(src)); }
-  void rsqrtps(XMMRegister dst, const Operand& src);
+  void rsqrtps(XMMRegister dst, Operand src);
   void rsqrtps(XMMRegister dst, XMMRegister src) { rsqrtps(dst, Operand(src)); }
-  void haddps(XMMRegister dst, const Operand& src);
+  void haddps(XMMRegister dst, Operand src);
   void haddps(XMMRegister dst, XMMRegister src) { haddps(dst, Operand(src)); }
 
-  void minps(XMMRegister dst, const Operand& src);
+  void minps(XMMRegister dst, Operand src);
   void minps(XMMRegister dst, XMMRegister src) { minps(dst, Operand(src)); }
-  void maxps(XMMRegister dst, const Operand& src);
+  void maxps(XMMRegister dst, Operand src);
   void maxps(XMMRegister dst, XMMRegister src) { maxps(dst, Operand(src)); }
 
-  void cmpps(XMMRegister dst, const Operand& src, int8_t cmp);
+  void cmpps(XMMRegister dst, Operand src, int8_t cmp);
 #define SSE_CMP_P(instr, imm8)                       \
   void instr##ps(XMMRegister dst, XMMRegister src) { \
     cmpps(dst, Operand(src), imm8);                  \
   }                                                  \
-  void instr##ps(XMMRegister dst, const Operand& src) { cmpps(dst, src, imm8); }
+  void instr##ps(XMMRegister dst, Operand src) { cmpps(dst, src, imm8); }
 
   SSE_CMP_P(cmpeq, 0x0);
   SSE_CMP_P(cmplt, 0x1);
@@ -1027,54 +1019,57 @@ class Assembler : public AssemblerBase {
 #undef SSE_CMP_P
 
   // SSE2 instructions
-  void cvttss2si(Register dst, const Operand& src);
+  void cvttss2si(Register dst, Operand src);
   void cvttss2si(Register dst, XMMRegister src) {
     cvttss2si(dst, Operand(src));
   }
-  void cvttsd2si(Register dst, const Operand& src);
+  void cvttsd2si(Register dst, Operand src);
   void cvttsd2si(Register dst, XMMRegister src) {
     cvttsd2si(dst, Operand(src));
   }
   void cvtsd2si(Register dst, XMMRegister src);
 
   void cvtsi2ss(XMMRegister dst, Register src) { cvtsi2ss(dst, Operand(src)); }
-  void cvtsi2ss(XMMRegister dst, const Operand& src);
+  void cvtsi2ss(XMMRegister dst, Operand src);
   void cvtsi2sd(XMMRegister dst, Register src) { cvtsi2sd(dst, Operand(src)); }
-  void cvtsi2sd(XMMRegister dst, const Operand& src);
-  void cvtss2sd(XMMRegister dst, const Operand& src);
+  void cvtsi2sd(XMMRegister dst, Operand src);
+  void cvtss2sd(XMMRegister dst, Operand src);
   void cvtss2sd(XMMRegister dst, XMMRegister src) {
     cvtss2sd(dst, Operand(src));
   }
-  void cvtsd2ss(XMMRegister dst, const Operand& src);
+  void cvtsd2ss(XMMRegister dst, Operand src);
   void cvtsd2ss(XMMRegister dst, XMMRegister src) {
     cvtsd2ss(dst, Operand(src));
   }
   void cvtdq2ps(XMMRegister dst, XMMRegister src) {
     cvtdq2ps(dst, Operand(src));
   }
-  void cvtdq2ps(XMMRegister dst, const Operand& src);
+  void cvtdq2ps(XMMRegister dst, Operand src);
   void cvttps2dq(XMMRegister dst, XMMRegister src) {
     cvttps2dq(dst, Operand(src));
   }
-  void cvttps2dq(XMMRegister dst, const Operand& src);
+  void cvttps2dq(XMMRegister dst, Operand src);
 
   void addsd(XMMRegister dst, XMMRegister src) { addsd(dst, Operand(src)); }
-  void addsd(XMMRegister dst, const Operand& src);
+  void addsd(XMMRegister dst, Operand src);
   void subsd(XMMRegister dst, XMMRegister src) { subsd(dst, Operand(src)); }
-  void subsd(XMMRegister dst, const Operand& src);
+  void subsd(XMMRegister dst, Operand src);
   void mulsd(XMMRegister dst, XMMRegister src) { mulsd(dst, Operand(src)); }
-  void mulsd(XMMRegister dst, const Operand& src);
+  void mulsd(XMMRegister dst, Operand src);
   void divsd(XMMRegister dst, XMMRegister src) { divsd(dst, Operand(src)); }
-  void divsd(XMMRegister dst, const Operand& src);
-  void xorpd(XMMRegister dst, XMMRegister src);
+  void divsd(XMMRegister dst, Operand src);
+  void xorpd(XMMRegister dst, XMMRegister src) { xorpd(dst, Operand(src)); }
+  void xorpd(XMMRegister dst, Operand src);
   void sqrtsd(XMMRegister dst, XMMRegister src) { sqrtsd(dst, Operand(src)); }
-  void sqrtsd(XMMRegister dst, const Operand& src);
+  void sqrtsd(XMMRegister dst, Operand src);
 
-  void andpd(XMMRegister dst, XMMRegister src);
-  void orpd(XMMRegister dst, XMMRegister src);
+  void andpd(XMMRegister dst, XMMRegister src) { andpd(dst, Operand(src)); }
+  void andpd(XMMRegister dst, Operand src);
+  void orpd(XMMRegister dst, XMMRegister src) { orpd(dst, Operand(src)); }
+  void orpd(XMMRegister dst, Operand src);
 
   void ucomisd(XMMRegister dst, XMMRegister src) { ucomisd(dst, Operand(src)); }
-  void ucomisd(XMMRegister dst, const Operand& src);
+  void ucomisd(XMMRegister dst, Operand src);
 
   void roundss(XMMRegister dst, XMMRegister src, RoundingMode mode);
   void roundsd(XMMRegister dst, XMMRegister src, RoundingMode mode);
@@ -1085,15 +1080,15 @@ class Assembler : public AssemblerBase {
   void cmpltsd(XMMRegister dst, XMMRegister src);
 
   void maxsd(XMMRegister dst, XMMRegister src) { maxsd(dst, Operand(src)); }
-  void maxsd(XMMRegister dst, const Operand& src);
+  void maxsd(XMMRegister dst, Operand src);
   void minsd(XMMRegister dst, XMMRegister src) { minsd(dst, Operand(src)); }
-  void minsd(XMMRegister dst, const Operand& src);
+  void minsd(XMMRegister dst, Operand src);
 
-  void movdqa(XMMRegister dst, const Operand& src);
-  void movdqa(const Operand& dst, XMMRegister src);
-  void movdqu(XMMRegister dst, const Operand& src);
-  void movdqu(const Operand& dst, XMMRegister src);
-  void movdq(bool aligned, XMMRegister dst, const Operand& src) {
+  void movdqa(XMMRegister dst, Operand src);
+  void movdqa(Operand dst, XMMRegister src);
+  void movdqu(XMMRegister dst, Operand src);
+  void movdqu(Operand dst, XMMRegister src);
+  void movdq(bool aligned, XMMRegister dst, Operand src) {
     if (aligned) {
       movdqa(dst, src);
     } else {
@@ -1102,16 +1097,15 @@ class Assembler : public AssemblerBase {
   }
 
   void movd(XMMRegister dst, Register src) { movd(dst, Operand(src)); }
-  void movd(XMMRegister dst, const Operand& src);
+  void movd(XMMRegister dst, Operand src);
   void movd(Register dst, XMMRegister src) { movd(Operand(dst), src); }
-  void movd(const Operand& dst, XMMRegister src);
+  void movd(Operand dst, XMMRegister src);
   void movsd(XMMRegister dst, XMMRegister src) { movsd(dst, Operand(src)); }
-  void movsd(XMMRegister dst, const Operand& src);
-  void movsd(const Operand& dst, XMMRegister src);
-
+  void movsd(XMMRegister dst, Operand src);
+  void movsd(Operand dst, XMMRegister src);
 
-  void movss(XMMRegister dst, const Operand& src);
-  void movss(const Operand& dst, XMMRegister src);
+  void movss(XMMRegister dst, Operand src);
+  void movss(Operand dst, XMMRegister src);
   void movss(XMMRegister dst, XMMRegister src) { movss(dst, Operand(src)); }
   void extractps(Register dst, XMMRegister src, byte imm8);
 
@@ -1131,42 +1125,47 @@ class Assembler : public AssemblerBase {
   void pshuflw(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
     pshuflw(dst, Operand(src), shuffle);
   }
-  void pshuflw(XMMRegister dst, const Operand& src, uint8_t shuffle);
+  void pshuflw(XMMRegister dst, Operand src, uint8_t shuffle);
   void pshufd(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
     pshufd(dst, Operand(src), shuffle);
   }
-  void pshufd(XMMRegister dst, const Operand& src, uint8_t shuffle);
+  void pshufd(XMMRegister dst, Operand src, uint8_t shuffle);
+
+  void pblendw(XMMRegister dst, XMMRegister src, uint8_t mask) {
+    pblendw(dst, Operand(src), mask);
+  }
+  void pblendw(XMMRegister dst, Operand src, uint8_t mask);
 
   void pextrb(Register dst, XMMRegister src, int8_t offset) {
     pextrb(Operand(dst), src, offset);
   }
-  void pextrb(const Operand& dst, XMMRegister src, int8_t offset);
+  void pextrb(Operand dst, XMMRegister src, int8_t offset);
   // Use SSE4_1 encoding for pextrw reg, xmm, imm8 for consistency
   void pextrw(Register dst, XMMRegister src, int8_t offset) {
     pextrw(Operand(dst), src, offset);
   }
-  void pextrw(const Operand& dst, XMMRegister src, int8_t offset);
+  void pextrw(Operand dst, XMMRegister src, int8_t offset);
   void pextrd(Register dst, XMMRegister src, int8_t offset) {
     pextrd(Operand(dst), src, offset);
   }
-  void pextrd(const Operand& dst, XMMRegister src, int8_t offset);
+  void pextrd(Operand dst, XMMRegister src, int8_t offset);
 
   void insertps(XMMRegister dst, XMMRegister src, int8_t offset) {
     insertps(dst, Operand(src), offset);
   }
-  void insertps(XMMRegister dst, const Operand& src, int8_t offset);
+  void insertps(XMMRegister dst, Operand src, int8_t offset);
   void pinsrb(XMMRegister dst, Register src, int8_t offset) {
     pinsrb(dst, Operand(src), offset);
   }
-  void pinsrb(XMMRegister dst, const Operand& src, int8_t offset);
+  void pinsrb(XMMRegister dst, Operand src, int8_t offset);
   void pinsrw(XMMRegister dst, Register src, int8_t offset) {
     pinsrw(dst, Operand(src), offset);
   }
-  void pinsrw(XMMRegister dst, const Operand& src, int8_t offset);
+  void pinsrw(XMMRegister dst, Operand src, int8_t offset);
   void pinsrd(XMMRegister dst, Register src, int8_t offset) {
     pinsrd(dst, Operand(src), offset);
   }
-  void pinsrd(XMMRegister dst, const Operand& src, int8_t offset);
+  void pinsrd(XMMRegister dst, Operand src, int8_t offset);
 
   // AVX instructions
   void vfmadd132sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
@@ -1178,13 +1177,13 @@ class Assembler : public AssemblerBase {
   void vfmadd231sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfmadd231sd(dst, src1, Operand(src2));
   }
-  void vfmadd132sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmadd132sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0x99, dst, src1, src2);
   }
-  void vfmadd213sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmadd213sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xa9, dst, src1, src2);
   }
-  void vfmadd231sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmadd231sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xb9, dst, src1, src2);
   }
   void vfmsub132sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
@@ -1196,13 +1195,13 @@ class Assembler : public AssemblerBase {
   void vfmsub231sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfmsub231sd(dst, src1, Operand(src2));
   }
-  void vfmsub132sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmsub132sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0x9b, dst, src1, src2);
   }
-  void vfmsub213sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmsub213sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xab, dst, src1, src2);
   }
-  void vfmsub231sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmsub231sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xbb, dst, src1, src2);
   }
   void vfnmadd132sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
@@ -1214,13 +1213,13 @@ class Assembler : public AssemblerBase {
   void vfnmadd231sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfnmadd231sd(dst, src1, Operand(src2));
   }
-  void vfnmadd132sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmadd132sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0x9d, dst, src1, src2);
   }
-  void vfnmadd213sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmadd213sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xad, dst, src1, src2);
   }
-  void vfnmadd231sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmadd231sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xbd, dst, src1, src2);
   }
   void vfnmsub132sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
@@ -1232,16 +1231,16 @@ class Assembler : public AssemblerBase {
   void vfnmsub231sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfnmsub231sd(dst, src1, Operand(src2));
   }
-  void vfnmsub132sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmsub132sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0x9f, dst, src1, src2);
   }
-  void vfnmsub213sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmsub213sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xaf, dst, src1, src2);
   }
-  void vfnmsub231sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmsub231sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xbf, dst, src1, src2);
   }
-  void vfmasd(byte op, XMMRegister dst, XMMRegister src1, const Operand& src2);
+  void vfmasd(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
 
   void vfmadd132ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfmadd132ss(dst, src1, Operand(src2));
@@ -1252,13 +1251,13 @@ class Assembler : public AssemblerBase {
   void vfmadd231ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfmadd231ss(dst, src1, Operand(src2));
   }
-  void vfmadd132ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmadd132ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0x99, dst, src1, src2);
   }
-  void vfmadd213ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmadd213ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xa9, dst, src1, src2);
   }
-  void vfmadd231ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmadd231ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xb9, dst, src1, src2);
   }
   void vfmsub132ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
@@ -1270,13 +1269,13 @@ class Assembler : public AssemblerBase {
   void vfmsub231ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfmsub231ss(dst, src1, Operand(src2));
   }
-  void vfmsub132ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmsub132ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0x9b, dst, src1, src2);
   }
-  void vfmsub213ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmsub213ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xab, dst, src1, src2);
   }
-  void vfmsub231ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmsub231ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xbb, dst, src1, src2);
   }
   void vfnmadd132ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
@@ -1288,13 +1287,13 @@ class Assembler : public AssemblerBase {
   void vfnmadd231ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfnmadd231ss(dst, src1, Operand(src2));
   }
-  void vfnmadd132ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmadd132ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0x9d, dst, src1, src2);
   }
-  void vfnmadd213ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmadd213ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xad, dst, src1, src2);
   }
-  void vfnmadd231ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmadd231ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xbd, dst, src1, src2);
   }
   void vfnmsub132ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
@@ -1306,111 +1305,128 @@ class Assembler : public AssemblerBase {
   void vfnmsub231ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfnmsub231ss(dst, src1, Operand(src2));
   }
-  void vfnmsub132ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmsub132ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0x9f, dst, src1, src2);
   }
-  void vfnmsub213ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmsub213ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xaf, dst, src1, src2);
   }
-  void vfnmsub231ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmsub231ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xbf, dst, src1, src2);
   }
-  void vfmass(byte op, XMMRegister dst, XMMRegister src1, const Operand& src2);
+  void vfmass(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
 
   void vaddsd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vaddsd(dst, src1, Operand(src2));
   }
-  void vaddsd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vaddsd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vsd(0x58, dst, src1, src2);
   }
   void vsubsd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vsubsd(dst, src1, Operand(src2));
   }
-  void vsubsd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vsubsd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vsd(0x5c, dst, src1, src2);
   }
   void vmulsd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vmulsd(dst, src1, Operand(src2));
   }
-  void vmulsd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vmulsd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vsd(0x59, dst, src1, src2);
   }
   void vdivsd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vdivsd(dst, src1, Operand(src2));
   }
-  void vdivsd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vdivsd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vsd(0x5e, dst, src1, src2);
   }
   void vmaxsd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vmaxsd(dst, src1, Operand(src2));
   }
-  void vmaxsd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vmaxsd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vsd(0x5f, dst, src1, src2);
   }
   void vminsd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vminsd(dst, src1, Operand(src2));
   }
-  void vminsd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vminsd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vsd(0x5d, dst, src1, src2);
   }
-  void vsd(byte op, XMMRegister dst, XMMRegister src1, const Operand& src2);
+  void vsqrtsd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
+    vsqrtsd(dst, src1, Operand(src2));
+  }
+  void vsqrtsd(XMMRegister dst, XMMRegister src1, Operand src2) {
+    vsd(0x51, dst, src1, src2);
+  }
+  void vsd(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
 
   void vaddss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vaddss(dst, src1, Operand(src2));
   }
-  void vaddss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vaddss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vss(0x58, dst, src1, src2);
   }
   void vsubss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vsubss(dst, src1, Operand(src2));
   }
-  void vsubss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vsubss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vss(0x5c, dst, src1, src2);
   }
   void vmulss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vmulss(dst, src1, Operand(src2));
   }
-  void vmulss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vmulss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vss(0x59, dst, src1, src2);
   }
   void vdivss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vdivss(dst, src1, Operand(src2));
   }
-  void vdivss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vdivss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vss(0x5e, dst, src1, src2);
   }
   void vmaxss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vmaxss(dst, src1, Operand(src2));
   }
-  void vmaxss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vmaxss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vss(0x5f, dst, src1, src2);
   }
   void vminss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vminss(dst, src1, Operand(src2));
   }
-  void vminss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vminss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vss(0x5d, dst, src1, src2);
   }
-  void vss(byte op, XMMRegister dst, XMMRegister src1, const Operand& src2);
+  void vsqrtss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
+    vsqrtss(dst, src1, Operand(src2));
+  }
+  void vsqrtss(XMMRegister dst, XMMRegister src1, Operand src2) {
+    vss(0x51, dst, src1, src2);
+  }
+  void vss(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
 
   void vrcpps(XMMRegister dst, XMMRegister src) { vrcpps(dst, Operand(src)); }
-  void vrcpps(XMMRegister dst, const Operand& src) {
+  void vrcpps(XMMRegister dst, Operand src) {
     vinstr(0x53, dst, xmm0, src, kNone, k0F, kWIG);
   }
   void vrsqrtps(XMMRegister dst, XMMRegister src) {
     vrsqrtps(dst, Operand(src));
   }
-  void vrsqrtps(XMMRegister dst, const Operand& src) {
+  void vrsqrtps(XMMRegister dst, Operand src) {
     vinstr(0x52, dst, xmm0, src, kNone, k0F, kWIG);
   }
+  void vhaddps(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
+    vhaddps(dst, src1, Operand(src2));
+  }
+  void vhaddps(XMMRegister dst, XMMRegister src1, Operand src2) {
+    vinstr(0x7C, dst, src1, src2, kF2, k0F, kWIG);
+  }
   void vmovaps(XMMRegister dst, XMMRegister src) {
     vps(0x28, dst, xmm0, Operand(src));
   }
   void vshufps(XMMRegister dst, XMMRegister src1, XMMRegister src2, byte imm8) {
     vshufps(dst, src1, Operand(src2), imm8);
   }
-  void vshufps(XMMRegister dst, XMMRegister src1, const Operand& src2,
-               byte imm8);
+  void vshufps(XMMRegister dst, XMMRegister src1, Operand src2, byte imm8);
 
   void vpsllw(XMMRegister dst, XMMRegister src, int8_t imm8);
   void vpslld(XMMRegister dst, XMMRegister src, int8_t imm8);
@@ -1422,75 +1438,78 @@ class Assembler : public AssemblerBase {
   void vpshuflw(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
     vpshuflw(dst, Operand(src), shuffle);
   }
-  void vpshuflw(XMMRegister dst, const Operand& src, uint8_t shuffle);
+  void vpshuflw(XMMRegister dst, Operand src, uint8_t shuffle);
   void vpshufd(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
     vpshufd(dst, Operand(src), shuffle);
   }
-  void vpshufd(XMMRegister dst, const Operand& src, uint8_t shuffle);
+  void vpshufd(XMMRegister dst, Operand src, uint8_t shuffle);
+
+  void vpblendw(XMMRegister dst, XMMRegister src1, XMMRegister src2,
+                uint8_t mask) {
+    vpblendw(dst, src1, Operand(src2), mask);
+  }
+  void vpblendw(XMMRegister dst, XMMRegister src1, Operand src2, uint8_t mask);
 
   void vpextrb(Register dst, XMMRegister src, int8_t offset) {
     vpextrb(Operand(dst), src, offset);
   }
-  void vpextrb(const Operand& dst, XMMRegister src, int8_t offset);
+  void vpextrb(Operand dst, XMMRegister src, int8_t offset);
   void vpextrw(Register dst, XMMRegister src, int8_t offset) {
     vpextrw(Operand(dst), src, offset);
   }
-  void vpextrw(const Operand& dst, XMMRegister src, int8_t offset);
+  void vpextrw(Operand dst, XMMRegister src, int8_t offset);
   void vpextrd(Register dst, XMMRegister src, int8_t offset) {
     vpextrd(Operand(dst), src, offset);
   }
-  void vpextrd(const Operand& dst, XMMRegister src, int8_t offset);
+  void vpextrd(Operand dst, XMMRegister src, int8_t offset);
 
   void vinsertps(XMMRegister dst, XMMRegister src1, XMMRegister src2,
                  int8_t offset) {
     vinsertps(dst, src1, Operand(src2), offset);
   }
-  void vinsertps(XMMRegister dst, XMMRegister src1, const Operand& src2,
+  void vinsertps(XMMRegister dst, XMMRegister src1, Operand src2,
                  int8_t offset);
   void vpinsrb(XMMRegister dst, XMMRegister src1, Register src2,
                int8_t offset) {
     vpinsrb(dst, src1, Operand(src2), offset);
   }
-  void vpinsrb(XMMRegister dst, XMMRegister src1, const Operand& src2,
-               int8_t offset);
+  void vpinsrb(XMMRegister dst, XMMRegister src1, Operand src2, int8_t offset);
   void vpinsrw(XMMRegister dst, XMMRegister src1, Register src2,
                int8_t offset) {
     vpinsrw(dst, src1, Operand(src2), offset);
   }
-  void vpinsrw(XMMRegister dst, XMMRegister src1, const Operand& src2,
-               int8_t offset);
+  void vpinsrw(XMMRegister dst, XMMRegister src1, Operand src2, int8_t offset);
   void vpinsrd(XMMRegister dst, XMMRegister src1, Register src2,
                int8_t offset) {
     vpinsrd(dst, src1, Operand(src2), offset);
   }
-  void vpinsrd(XMMRegister dst, XMMRegister src1, const Operand& src2,
-               int8_t offset);
+  void vpinsrd(XMMRegister dst, XMMRegister src1, Operand src2, int8_t offset);
 
   void vcvtdq2ps(XMMRegister dst, XMMRegister src) {
     vcvtdq2ps(dst, Operand(src));
   }
-  void vcvtdq2ps(XMMRegister dst, const Operand& src) {
+  void vcvtdq2ps(XMMRegister dst, Operand src) {
     vinstr(0x5B, dst, xmm0, src, kNone, k0F, kWIG);
   }
   void vcvttps2dq(XMMRegister dst, XMMRegister src) {
     vcvttps2dq(dst, Operand(src));
   }
-  void vcvttps2dq(XMMRegister dst, const Operand& src) {
+  void vcvttps2dq(XMMRegister dst, Operand src) {
     vinstr(0x5B, dst, xmm0, src, kF3, k0F, kWIG);
   }
 
-  void vmovdqu(XMMRegister dst, const Operand& src) {
+  void vmovdqu(XMMRegister dst, Operand src) {
     vinstr(0x6F, dst, xmm0, src, kF3, k0F, kWIG);
   }
-  void vmovdqu(const Operand& dst, XMMRegister src) {
+  void vmovdqu(Operand dst, XMMRegister src) {
     vinstr(0x7F, src, xmm0, dst, kF3, k0F, kWIG);
   }
   void vmovd(XMMRegister dst, Register src) { vmovd(dst, Operand(src)); }
-  void vmovd(XMMRegister dst, const Operand& src) {
+  void vmovd(XMMRegister dst, Operand src) {
     vinstr(0x6E, dst, xmm0, src, k66, k0F, kWIG);
   }
   void vmovd(Register dst, XMMRegister src) { movd(Operand(dst), src); }
-  void vmovd(const Operand& dst, XMMRegister src) {
+  void vmovd(Operand dst, XMMRegister src) {
     vinstr(0x7E, src, xmm0, dst, k66, k0F, kWIG);
   }
 
@@ -1498,76 +1517,76 @@ class Assembler : public AssemblerBase {
   void andn(Register dst, Register src1, Register src2) {
     andn(dst, src1, Operand(src2));
   }
-  void andn(Register dst, Register src1, const Operand& src2) {
+  void andn(Register dst, Register src1, Operand src2) {
     bmi1(0xf2, dst, src1, src2);
   }
   void bextr(Register dst, Register src1, Register src2) {
     bextr(dst, Operand(src1), src2);
   }
-  void bextr(Register dst, const Operand& src1, Register src2) {
+  void bextr(Register dst, Operand src1, Register src2) {
     bmi1(0xf7, dst, src2, src1);
   }
   void blsi(Register dst, Register src) { blsi(dst, Operand(src)); }
-  void blsi(Register dst, const Operand& src) { bmi1(0xf3, ebx, dst, src); }
+  void blsi(Register dst, Operand src) { bmi1(0xf3, ebx, dst, src); }
   void blsmsk(Register dst, Register src) { blsmsk(dst, Operand(src)); }
-  void blsmsk(Register dst, const Operand& src) { bmi1(0xf3, edx, dst, src); }
+  void blsmsk(Register dst, Operand src) { bmi1(0xf3, edx, dst, src); }
   void blsr(Register dst, Register src) { blsr(dst, Operand(src)); }
-  void blsr(Register dst, const Operand& src) { bmi1(0xf3, ecx, dst, src); }
+  void blsr(Register dst, Operand src) { bmi1(0xf3, ecx, dst, src); }
   void tzcnt(Register dst, Register src) { tzcnt(dst, Operand(src)); }
-  void tzcnt(Register dst, const Operand& src);
+  void tzcnt(Register dst, Operand src);
 
   void lzcnt(Register dst, Register src) { lzcnt(dst, Operand(src)); }
-  void lzcnt(Register dst, const Operand& src);
+  void lzcnt(Register dst, Operand src);
 
   void popcnt(Register dst, Register src) { popcnt(dst, Operand(src)); }
-  void popcnt(Register dst, const Operand& src);
+  void popcnt(Register dst, Operand src);
 
   void bzhi(Register dst, Register src1, Register src2) {
     bzhi(dst, Operand(src1), src2);
   }
-  void bzhi(Register dst, const Operand& src1, Register src2) {
+  void bzhi(Register dst, Operand src1, Register src2) {
     bmi2(kNone, 0xf5, dst, src2, src1);
   }
   void mulx(Register dst1, Register dst2, Register src) {
     mulx(dst1, dst2, Operand(src));
   }
-  void mulx(Register dst1, Register dst2, const Operand& src) {
+  void mulx(Register dst1, Register dst2, Operand src) {
     bmi2(kF2, 0xf6, dst1, dst2, src);
   }
   void pdep(Register dst, Register src1, Register src2) {
     pdep(dst, src1, Operand(src2));
   }
-  void pdep(Register dst, Register src1, const Operand& src2) {
+  void pdep(Register dst, Register src1, Operand src2) {
     bmi2(kF2, 0xf5, dst, src1, src2);
   }
   void pext(Register dst, Register src1, Register src2) {
     pext(dst, src1, Operand(src2));
   }
-  void pext(Register dst, Register src1, const Operand& src2) {
+  void pext(Register dst, Register src1, Operand src2) {
     bmi2(kF3, 0xf5, dst, src1, src2);
   }
   void sarx(Register dst, Register src1, Register src2) {
     sarx(dst, Operand(src1), src2);
   }
-  void sarx(Register dst, const Operand& src1, Register src2) {
+  void sarx(Register dst, Operand src1, Register src2) {
     bmi2(kF3, 0xf7, dst, src2, src1);
   }
   void shlx(Register dst, Register src1, Register src2) {
     shlx(dst, Operand(src1), src2);
   }
-  void shlx(Register dst, const Operand& src1, Register src2) {
+  void shlx(Register dst, Operand src1, Register src2) {
     bmi2(k66, 0xf7, dst, src2, src1);
   }
   void shrx(Register dst, Register src1, Register src2) {
     shrx(dst, Operand(src1), src2);
   }
-  void shrx(Register dst, const Operand& src1, Register src2) {
+  void shrx(Register dst, Operand src1, Register src2) {
     bmi2(kF2, 0xf7, dst, src2, src1);
   }
   void rorx(Register dst, Register src, byte imm8) {
     rorx(dst, Operand(src), imm8);
   }
-  void rorx(Register dst, const Operand& src, byte imm8);
+  void rorx(Register dst, Operand src, byte imm8);
 
 #define PACKED_OP_LIST(V) \
   V(and, 0x54)            \
@@ -1579,34 +1598,31 @@ class Assembler : public AssemblerBase {
   V(div, 0x5e)            \
   V(max, 0x5f)
 
-#define AVX_PACKED_OP_DECLARE(name, opcode)                                  \
-  void v##name##ps(XMMRegister dst, XMMRegister src1, XMMRegister src2) {    \
-    vps(opcode, dst, src1, Operand(src2));                                   \
-  }                                                                          \
-  void v##name##ps(XMMRegister dst, XMMRegister src1, const Operand& src2) { \
-    vps(opcode, dst, src1, src2);                                            \
-  }                                                                          \
-  void v##name##pd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {    \
-    vpd(opcode, dst, src1, Operand(src2));                                   \
-  }                                                                          \
-  void v##name##pd(XMMRegister dst, XMMRegister src1, const Operand& src2) { \
-    vpd(opcode, dst, src1, src2);                                            \
+#define AVX_PACKED_OP_DECLARE(name, opcode)                               \
+  void v##name##ps(XMMRegister dst, XMMRegister src1, XMMRegister src2) { \
+    vps(opcode, dst, src1, Operand(src2));                                \
+  }                                                                       \
+  void v##name##ps(XMMRegister dst, XMMRegister src1, Operand src2) {     \
+    vps(opcode, dst, src1, src2);                                         \
+  }                                                                       \
+  void v##name##pd(XMMRegister dst, XMMRegister src1, XMMRegister src2) { \
+    vpd(opcode, dst, src1, Operand(src2));                                \
+  }                                                                       \
+  void v##name##pd(XMMRegister dst, XMMRegister src1, Operand src2) {     \
+    vpd(opcode, dst, src1, src2);                                         \
   }
 
   PACKED_OP_LIST(AVX_PACKED_OP_DECLARE);
-  void vps(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2);
-  void vps(byte op, XMMRegister dst, XMMRegister src1, const Operand& src2);
-  void vpd(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2);
-  void vpd(byte op, XMMRegister dst, XMMRegister src1, const Operand& src2);
+  void vps(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
+  void vpd(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
 
-  void vcmpps(XMMRegister dst, XMMRegister src1, const Operand& src2,
-              int8_t cmp);
-#define AVX_CMP_P(instr, imm8)                                             \
-  void instr##ps(XMMRegister dst, XMMRegister src1, XMMRegister src2) {    \
-    vcmpps(dst, src1, Operand(src2), imm8);                                \
-  }                                                                        \
-  void instr##ps(XMMRegister dst, XMMRegister src1, const Operand& src2) { \
-    vcmpps(dst, src1, src2, imm8);                                         \
+  void vcmpps(XMMRegister dst, XMMRegister src1, Operand src2, int8_t cmp);
+#define AVX_CMP_P(instr, imm8)                                          \
+  void instr##ps(XMMRegister dst, XMMRegister src1, XMMRegister src2) { \
+    vcmpps(dst, src1, Operand(src2), imm8);                             \
+  }                                                                     \
+  void instr##ps(XMMRegister dst, XMMRegister src1, Operand src2) {     \
+    vcmpps(dst, src1, src2, imm8);                                      \
   }
 
   AVX_CMP_P(vcmpeq, 0x0);
@@ -1621,7 +1637,7 @@ class Assembler : public AssemblerBase {
   void instruction(XMMRegister dst, XMMRegister src) {                \
     instruction(dst, Operand(src));                                   \
   }                                                                   \
-  void instruction(XMMRegister dst, const Operand& src) {             \
+  void instruction(XMMRegister dst, Operand src) {                    \
     sse2_instr(dst, src, 0x##prefix, 0x##escape, 0x##opcode);         \
   }
 
@@ -1632,8 +1648,7 @@ class Assembler : public AssemblerBase {
   void v##instruction(XMMRegister dst, XMMRegister src1, XMMRegister src2) { \
     v##instruction(dst, src1, Operand(src2));                                \
   }                                                                          \
-  void v##instruction(XMMRegister dst, XMMRegister src1,                     \
-                      const Operand& src2) {                                 \
+  void v##instruction(XMMRegister dst, XMMRegister src1, Operand src2) {     \
     vinstr(0x##opcode, dst, src1, src2, k##prefix, k##escape, kW0);          \
   }
 
@@ -1645,7 +1660,7 @@ class Assembler : public AssemblerBase {
   void instruction(XMMRegister dst, XMMRegister src) {                       \
     instruction(dst, Operand(src));                                          \
   }                                                                          \
-  void instruction(XMMRegister dst, const Operand& src) {                    \
+  void instruction(XMMRegister dst, Operand src) {                           \
     ssse3_instr(dst, src, 0x##prefix, 0x##escape1, 0x##escape2, 0x##opcode); \
   }
 
@@ -1657,7 +1672,7 @@ class Assembler : public AssemblerBase {
   void instruction(XMMRegister dst, XMMRegister src) {                      \
     instruction(dst, Operand(src));                                         \
   }                                                                         \
-  void instruction(XMMRegister dst, const Operand& src) {                   \
+  void instruction(XMMRegister dst, Operand src) {                          \
     sse4_instr(dst, src, 0x##prefix, 0x##escape1, 0x##escape2, 0x##opcode); \
   }
 
@@ -1669,8 +1684,7 @@ class Assembler : public AssemblerBase {
   void v##instruction(XMMRegister dst, XMMRegister src1, XMMRegister src2) {  \
     v##instruction(dst, src1, Operand(src2));                                 \
   }                                                                           \
-  void v##instruction(XMMRegister dst, XMMRegister src1,                      \
-                      const Operand& src2) {                                  \
+  void v##instruction(XMMRegister dst, XMMRegister src1, Operand src2) {      \
     vinstr(0x##opcode, dst, src1, src2, k##prefix, k##escape1##escape2, kW0); \
   }
 
@@ -1681,7 +1695,7 @@ class Assembler : public AssemblerBase {
   // Prefetch src position into cache level.
   // Level 1, 2 or 3 specifies CPU cache level. Level 0 specifies a
   // non-temporal
-  void prefetch(const Operand& src, int level);
+  void prefetch(Operand src, int level);
   // TODO(lrn): Need SFENCE for movnt?
 
   // Check the code size generated from label to here.
@@ -1735,7 +1749,7 @@ class Assembler : public AssemblerBase {
   }
 
  protected:
-  void emit_sse_operand(XMMRegister reg, const Operand& adr);
+  void emit_sse_operand(XMMRegister reg, Operand adr);
   void emit_sse_operand(XMMRegister dst, XMMRegister src);
   void emit_sse_operand(Register dst, XMMRegister src);
   void emit_sse_operand(XMMRegister dst, Register src);
@@ -1774,7 +1788,7 @@ class Assembler : public AssemblerBase {
   // sel specifies the /n in the modrm byte (see the Intel PRM).
   void emit_arith(int sel, Operand dst, const Immediate& x);
 
-  void emit_operand(Register reg, const Operand& adr);
+  void emit_operand(Register reg, Operand adr);
 
   void emit_label(Label* label);
 
@@ -1800,18 +1814,17 @@ class Assembler : public AssemblerBase {
   inline void emit_disp(Label* L, Displacement::Type type);
   inline void emit_near_disp(Label* L);
 
-  void sse2_instr(XMMRegister dst, const Operand& src, byte prefix, byte escape,
+  void sse2_instr(XMMRegister dst, Operand src, byte prefix, byte escape,
                   byte opcode);
-  void ssse3_instr(XMMRegister dst, const Operand& src, byte prefix,
-                   byte escape1, byte escape2, byte opcode);
-  void sse4_instr(XMMRegister dst, const Operand& src, byte prefix,
-                  byte escape1, byte escape2, byte opcode);
-  void vinstr(byte op, XMMRegister dst, XMMRegister src1, const Operand& src2,
+  void ssse3_instr(XMMRegister dst, Operand src, byte prefix, byte escape1,
+                   byte escape2, byte opcode);
+  void sse4_instr(XMMRegister dst, Operand src, byte prefix, byte escape1,
+                  byte escape2, byte opcode);
+  void vinstr(byte op, XMMRegister dst, XMMRegister src1, Operand src2,
               SIMDPrefix pp, LeadingOpcode m, VexW w);
   // Most BMI instructions are similar.
-  void bmi1(byte op, Register reg, Register vreg, const Operand& rm);
-  void bmi2(SIMDPrefix pp, byte op, Register reg, Register vreg,
-            const Operand& rm);
+  void bmi1(byte op, Register reg, Register vreg, Operand rm);
+  void bmi2(SIMDPrefix pp, byte op, Register reg, Register vreg, Operand rm);
 
   // record reloc info for current pc_
   void RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data = 0);
diff --git a/deps/v8/src/ia32/code-stubs-ia32.cc b/deps/v8/src/ia32/code-stubs-ia32.cc
index 697539713a3..d954edc189f 100644
--- a/deps/v8/src/ia32/code-stubs-ia32.cc
+++ b/deps/v8/src/ia32/code-stubs-ia32.cc
@@ -163,7 +163,6 @@ void MathPowStub::Generate(MacroAssembler* masm) {
   if (exponent_type() != INTEGER) {
     Label fast_power, try_arithmetic_simplification;
     __ DoubleToI(exponent, double_exponent, double_scratch,
-                 TREAT_MINUS_ZERO_AS_ZERO, &try_arithmetic_simplification,
                  &try_arithmetic_simplification,
                  &try_arithmetic_simplification);
     __ jmp(&int_exponent);
@@ -424,6 +423,12 @@ void CEntryStub::Generate(MacroAssembler* masm) {
   __ mov(Operand(ebp, StandardFrameConstants::kContextOffset), esi);
   __ bind(&skip);
 
+  // Reset the masking register. This is done independent of the underlying
+  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
+  // both configurations. It is safe to always do this, because the underlying
+  // register is caller-saved and can be arbitrarily clobbered.
+  __ ResetSpeculationPoisonRegister();
+
   // Compute the handler entry address and jump to it.
   __ mov(edi, Operand::StaticVariable(pending_handler_entrypoint_address));
   __ jmp(edi);
diff --git a/deps/v8/src/ia32/codegen-ia32.cc b/deps/v8/src/ia32/codegen-ia32.cc
index 8bd6b5f30c1..2acd35cf966 100644
--- a/deps/v8/src/ia32/codegen-ia32.cc
+++ b/deps/v8/src/ia32/codegen-ia32.cc
@@ -7,6 +7,7 @@
 #include "src/codegen.h"
 #include "src/factory-inl.h"
 #include "src/heap/heap.h"
+#include "src/isolate.h"
 #include "src/macro-assembler.h"
 
 namespace v8 {
@@ -35,9 +36,9 @@ UnaryMathFunctionWithIsolate CreateSqrtFunction(Isolate* isolate) {
 
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
-  DCHECK(!RelocInfo::RequiresRelocation(isolate, desc));
+  DCHECK(!RelocInfo::RequiresRelocation(desc));
 
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   CHECK(SetPermissions(buffer, allocated, PageAllocator::kReadExecute));
   return FUNCTION_CAST<UnaryMathFunctionWithIsolate>(buffer);
 }
@@ -447,8 +448,8 @@ MemMoveFunction CreateMemMoveFunction(Isolate* isolate) {
 
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
-  DCHECK(!RelocInfo::RequiresRelocation(isolate, desc));
-  Assembler::FlushICache(isolate, buffer, allocated);
+  DCHECK(!RelocInfo::RequiresRelocation(desc));
+  Assembler::FlushICache(buffer, allocated);
   CHECK(SetPermissions(buffer, allocated, PageAllocator::kReadExecute));
   // TODO(jkummerow): It would be nice to register this code creation event
   // with the PROFILE / GDBJIT system.
diff --git a/deps/v8/src/ia32/disasm-ia32.cc b/deps/v8/src/ia32/disasm-ia32.cc
index 6ce62e93bb7..5f07f0803d1 100644
--- a/deps/v8/src/ia32/disasm-ia32.cc
+++ b/deps/v8/src/ia32/disasm-ia32.cc
@@ -819,6 +819,13 @@ int DisassemblerIA32::AVXInstruction(byte* data) {
     int mod, regop, rm, vvvv = vex_vreg();
     get_modrm(*current, &mod, &regop, &rm);
     switch (opcode) {
+      case 0x0E:
+        AppendToBuffer("vpblendw %s,%s,", NameOfXMMRegister(regop),
+                       NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        AppendToBuffer(",%d", *reinterpret_cast<uint8_t*>(current));
+        current++;
+        break;
       case 0x14:
         AppendToBuffer("vpextrb ");
         current += PrintRightOperand(current);
@@ -868,6 +875,11 @@ int DisassemblerIA32::AVXInstruction(byte* data) {
     int mod, regop, rm, vvvv = vex_vreg();
     get_modrm(*current, &mod, &regop, &rm);
     switch (opcode) {
+      case 0x51:
+        AppendToBuffer("vsqrtsd %s,%s,", NameOfXMMRegister(regop),
+                       NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        break;
       case 0x58:
         AppendToBuffer("vaddsd %s,%s,", NameOfXMMRegister(regop),
                        NameOfXMMRegister(vvvv));
@@ -904,6 +916,11 @@ int DisassemblerIA32::AVXInstruction(byte* data) {
         AppendToBuffer(",%d", *reinterpret_cast<int8_t*>(current));
         current++;
         break;
+      case 0x7C:
+        AppendToBuffer("vhaddps %s,%s,", NameOfXMMRegister(regop),
+                       NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        break;
       default:
         UnimplementedInstruction();
     }
@@ -911,6 +928,11 @@ int DisassemblerIA32::AVXInstruction(byte* data) {
     int mod, regop, rm, vvvv = vex_vreg();
     get_modrm(*current, &mod, &regop, &rm);
     switch (opcode) {
+      case 0x51:
+        AppendToBuffer("vsqrtss %s,%s,", NameOfXMMRegister(regop),
+                       NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        break;
       case 0x58:
         AppendToBuffer("vaddss %s,%s,", NameOfXMMRegister(regop),
                        NameOfXMMRegister(vvvv));
@@ -1946,6 +1968,14 @@ int DisassemblerIA32::InstructionDecode(v8::internal::Vector<char> out_buffer,
                              NameOfXMMRegister(rm),
                              static_cast<int>(imm8));
               data += 2;
+            } else if (*data == 0x0E) {
+              data++;
+              int mod, regop, rm;
+              get_modrm(*data, &mod, &regop, &rm);
+              AppendToBuffer("pblendw %s,", NameOfXMMRegister(regop));
+              data += PrintRightXMMOperand(data);
+              AppendToBuffer(",%d", *reinterpret_cast<uint8_t*>(data));
+              data++;
             } else if (*data == 0x14) {
               data++;
               int mod, regop, rm;
@@ -2564,6 +2594,11 @@ int Disassembler::InstructionDecode(v8::internal::Vector<char> buffer,
   return d.InstructionDecode(buffer, instruction);
 }
 
+int Disassembler::InstructionDecodeForTesting(v8::internal::Vector<char> buffer,
+                                              byte* instruction) {
+  DisassemblerIA32 d(converter_, true /*crash if unimplemented*/);
+  return d.InstructionDecode(buffer, instruction);
+}
 
 // The IA-32 assembler does not currently use constant pools.
 int Disassembler::ConstantPoolSizeAt(byte* instruction) { return -1; }
diff --git a/deps/v8/src/ia32/frame-constants-ia32.h b/deps/v8/src/ia32/frame-constants-ia32.h
index b745a19466e..a262b92af96 100644
--- a/deps/v8/src/ia32/frame-constants-ia32.h
+++ b/deps/v8/src/ia32/frame-constants-ia32.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_IA32_FRAMES_IA32_H_
-#define V8_IA32_FRAMES_IA32_H_
+#ifndef V8_IA32_FRAME_CONSTANTS_IA32_H_
+#define V8_IA32_FRAME_CONSTANTS_IA32_H_
 
 namespace v8 {
 namespace internal {
@@ -50,4 +50,4 @@ class JavaScriptFrameConstants : public AllStatic {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_IA32_FRAMES_IA32_H_
+#endif  // V8_IA32_FRAME_CONSTANTS_IA32_H_
diff --git a/deps/v8/src/ia32/interface-descriptors-ia32.cc b/deps/v8/src/ia32/interface-descriptors-ia32.cc
index 9edad9a44c3..a4c6894ae8a 100644
--- a/deps/v8/src/ia32/interface-descriptors-ia32.cc
+++ b/deps/v8/src/ia32/interface-descriptors-ia32.cc
@@ -69,13 +69,6 @@ const Register GrowArrayElementsDescriptor::ObjectRegister() { return eax; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return ebx; }
 
 
-void FastNewClosureDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // SharedFunctionInfo, vector, slot index.
-  Register registers[] = {ebx, ecx, edx};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
 // static
 const Register TypeConversionDescriptor::ArgumentRegister() { return eax; }
 
diff --git a/deps/v8/src/ia32/macro-assembler-ia32.cc b/deps/v8/src/ia32/macro-assembler-ia32.cc
index ebc8b39ab94..e0f3f738043 100644
--- a/deps/v8/src/ia32/macro-assembler-ia32.cc
+++ b/deps/v8/src/ia32/macro-assembler-ia32.cc
@@ -14,6 +14,7 @@
 #include "src/external-reference-table.h"
 #include "src/frame-constants.h"
 #include "src/frames-inl.h"
+#include "src/instruction-stream.h"
 #include "src/runtime/runtime.h"
 
 #include "src/ia32/assembler-ia32-inl.h"
@@ -79,9 +80,7 @@ void MacroAssembler::CompareRoot(Register with, Heap::RootListIndex index) {
   }
 }
 
-
-void MacroAssembler::CompareRoot(const Operand& with,
-                                 Heap::RootListIndex index) {
+void MacroAssembler::CompareRoot(Operand with, Heap::RootListIndex index) {
   DCHECK(isolate()->heap()->RootCanBeTreatedAsConstant(index));
   Handle<Object> object = isolate()->heap()->root_handle(index);
   if (object->IsHeapObject()) {
@@ -183,36 +182,21 @@ void TurboAssembler::SlowTruncateToIDelayed(Zone* zone, Register result_reg) {
 }
 
 void MacroAssembler::DoubleToI(Register result_reg, XMMRegister input_reg,
-                               XMMRegister scratch,
-                               MinusZeroMode minus_zero_mode,
-                               Label* lost_precision, Label* is_nan,
-                               Label* minus_zero, Label::Distance dst) {
+                               XMMRegister scratch, Label* lost_precision,
+                               Label* is_nan, Label::Distance dst) {
   DCHECK(input_reg != scratch);
   cvttsd2si(result_reg, Operand(input_reg));
   Cvtsi2sd(scratch, Operand(result_reg));
   ucomisd(scratch, input_reg);
   j(not_equal, lost_precision, dst);
   j(parity_even, is_nan, dst);
-  if (minus_zero_mode == FAIL_ON_MINUS_ZERO) {
-    Label done;
-    // The integer converted back is equal to the original. We
-    // only have to test if we got -0 as an input.
-    test(result_reg, Operand(result_reg));
-    j(not_zero, &done, Label::kNear);
-    movmskpd(result_reg, input_reg);
-    // Bit 0 contains the sign of the double in input_reg.
-    // If input was positive, we are ok and return 0, otherwise
-    // jump to minus_zero.
-    and_(result_reg, 1);
-    j(not_zero, minus_zero, dst);
-    bind(&done);
-  }
 }
 
-void TurboAssembler::LoadUint32(XMMRegister dst, const Operand& src) {
+void TurboAssembler::LoadUint32(XMMRegister dst, Operand src) {
   Label done;
   cmp(src, Immediate(0));
-  ExternalReference uint32_bias = ExternalReference::address_of_uint32_bias();
+  ExternalReference uint32_bias =
+      ExternalReference::address_of_uint32_bias(isolate());
   Cvtsi2sd(dst, src);
   j(not_sign, &done, Label::kNear);
   addsd(dst, Operand::StaticVariable(uint32_bias));
@@ -385,7 +369,7 @@ void MacroAssembler::MaybeDropFrames() {
     RelocInfo::CODE_TARGET);
 }
 
-void TurboAssembler::Cvtsi2sd(XMMRegister dst, const Operand& src) {
+void TurboAssembler::Cvtsi2sd(XMMRegister dst, Operand src) {
   xorps(dst, dst);
   cvtsi2sd(dst, src);
 }
@@ -504,6 +488,19 @@ void MacroAssembler::AssertFixedArray(Register object) {
   }
 }
 
+void MacroAssembler::AssertConstructor(Register object) {
+  if (emit_debug_code()) {
+    test(object, Immediate(kSmiTagMask));
+    Check(not_equal, AbortReason::kOperandIsASmiAndNotAConstructor);
+    Push(object);
+    mov(object, FieldOperand(object, HeapObject::kMapOffset));
+    test_b(FieldOperand(object, Map::kBitFieldOffset),
+           Immediate(Map::IsConstructorBit::kMask));
+    Pop(object);
+    Check(not_zero, AbortReason::kOperandIsNotAConstructor);
+  }
+}
+
 void MacroAssembler::AssertFunction(Register object) {
   if (emit_debug_code()) {
     test(object, Immediate(kSmiTagMask));
@@ -595,10 +592,11 @@ void TurboAssembler::EnterFrame(StackFrame::Type type) {
   push(Immediate(StackFrame::TypeToMarker(type)));
   if (type == StackFrame::INTERNAL) {
     push(Immediate(CodeObject()));
-  }
-  if (emit_debug_code()) {
-    cmp(Operand(esp, 0), Immediate(isolate()->factory()->undefined_value()));
-    Check(not_equal, AbortReason::kCodeObjectNotProperlyPatched);
+    // Check at runtime that this code object was patched correctly.
+    if (emit_debug_code()) {
+      cmp(Operand(esp, 0), Immediate(isolate()->factory()->undefined_value()));
+      Check(not_equal, AbortReason::kCodeObjectNotProperlyPatched);
+    }
   }
 }
 
@@ -862,6 +860,11 @@ void MacroAssembler::JumpToExternalReference(const ExternalReference& ext,
   jmp(ces.GetCode(), RelocInfo::CODE_TARGET);
 }
 
+void MacroAssembler::JumpToInstructionStream(Address entry) {
+  mov(kOffHeapTrampolineRegister, Immediate(entry, RelocInfo::OFF_HEAP_TARGET));
+  jmp(kOffHeapTrampolineRegister);
+}
+
 void TurboAssembler::PrepareForTailCall(
     const ParameterCount& callee_args_count, Register caller_args_count_reg,
     Register scratch0, Register scratch1,
@@ -1002,10 +1005,12 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
                                     const ParameterCount& expected,
                                     const ParameterCount& actual) {
   Label skip_hook;
+
   ExternalReference debug_hook_active =
       ExternalReference::debug_hook_on_function_call_address(isolate());
   cmpb(Operand::StaticVariable(debug_hook_active), Immediate(0));
   j(equal, &skip_hook);
+
   {
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
@@ -1064,6 +1069,7 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
     // We call indirectly through the code field in the function to
     // allow recompilation to take effect without changing any of the
     // call sites.
+    static_assert(kJavaScriptCallCodeStartRegister == ecx, "ABI mismatch");
     mov(ecx, FieldOperand(function, JSFunction::kCodeOffset));
     add(ecx, Immediate(Code::kHeaderSize - kHeapObjectTag));
     if (flag == CALL_FUNCTION) {
@@ -1104,14 +1110,6 @@ void MacroAssembler::InvokeFunction(Register fun,
   InvokeFunctionCode(edi, no_reg, expected, actual, flag);
 }
 
-void MacroAssembler::InvokeFunction(Handle<JSFunction> function,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual,
-                                    InvokeFlag flag) {
-  Move(edi, function);
-  InvokeFunction(edi, expected, actual, flag);
-}
-
 void MacroAssembler::LoadGlobalProxy(Register dst) {
   mov(dst, NativeContextOperand());
   mov(dst, ContextOperand(dst, Context::GLOBAL_PROXY_INDEX));
@@ -1159,17 +1157,14 @@ void TurboAssembler::Move(Register dst, Register src) {
 }
 
 void TurboAssembler::Move(Register dst, const Immediate& x) {
-  if (!x.is_heap_object_request() && x.is_zero() &&
-      RelocInfo::IsNone(x.rmode())) {
+  if (!x.is_heap_object_request() && x.is_zero()) {
     xor_(dst, dst);  // Shorter than mov of 32-bit immediate 0.
   } else {
     mov(dst, x);
   }
 }
 
-void TurboAssembler::Move(const Operand& dst, const Immediate& x) {
-  mov(dst, x);
-}
+void TurboAssembler::Move(Operand dst, const Immediate& x) { mov(dst, x); }
 
 void TurboAssembler::Move(Register dst, Handle<HeapObject> object) {
   mov(dst, object);
@@ -1224,7 +1219,9 @@ void TurboAssembler::Move(XMMRegister dst, uint64_t src) {
       push(eax);
       Move(eax, Immediate(lower));
       movd(dst, Operand(eax));
-      Move(eax, Immediate(upper));
+      if (upper != lower) {
+        Move(eax, Immediate(upper));
+      }
       pinsrd(dst, Operand(eax), 1);
       pop(eax);
     } else {
@@ -1236,8 +1233,7 @@ void TurboAssembler::Move(XMMRegister dst, uint64_t src) {
   }
 }
 
-void TurboAssembler::Pshuflw(XMMRegister dst, const Operand& src,
-                             uint8_t shuffle) {
+void TurboAssembler::Pshuflw(XMMRegister dst, Operand src, uint8_t shuffle) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vpshuflw(dst, src, shuffle);
@@ -1246,8 +1242,7 @@ void TurboAssembler::Pshuflw(XMMRegister dst, const Operand& src,
   }
 }
 
-void TurboAssembler::Pshufd(XMMRegister dst, const Operand& src,
-                            uint8_t shuffle) {
+void TurboAssembler::Pshufd(XMMRegister dst, Operand src, uint8_t shuffle) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vpshufd(dst, src, shuffle);
@@ -1256,7 +1251,7 @@ void TurboAssembler::Pshufd(XMMRegister dst, const Operand& src,
   }
 }
 
-void TurboAssembler::Psignb(XMMRegister dst, const Operand& src) {
+void TurboAssembler::Psignb(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vpsignb(dst, dst, src);
@@ -1270,7 +1265,7 @@ void TurboAssembler::Psignb(XMMRegister dst, const Operand& src) {
   UNREACHABLE();
 }
 
-void TurboAssembler::Psignw(XMMRegister dst, const Operand& src) {
+void TurboAssembler::Psignw(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vpsignw(dst, dst, src);
@@ -1284,7 +1279,7 @@ void TurboAssembler::Psignw(XMMRegister dst, const Operand& src) {
   UNREACHABLE();
 }
 
-void TurboAssembler::Psignd(XMMRegister dst, const Operand& src) {
+void TurboAssembler::Psignd(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vpsignd(dst, dst, src);
@@ -1298,7 +1293,7 @@ void TurboAssembler::Psignd(XMMRegister dst, const Operand& src) {
   UNREACHABLE();
 }
 
-void TurboAssembler::Pshufb(XMMRegister dst, const Operand& src) {
+void TurboAssembler::Pshufb(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vpshufb(dst, dst, src);
@@ -1360,7 +1355,7 @@ void TurboAssembler::Pextrd(Register dst, XMMRegister src, int8_t imm8) {
   movd(dst, xmm0);
 }
 
-void TurboAssembler::Pinsrd(XMMRegister dst, const Operand& src, int8_t imm8,
+void TurboAssembler::Pinsrd(XMMRegister dst, Operand src, int8_t imm8,
                             bool is_64_bits) {
   if (CpuFeatures::IsSupported(SSE4_1)) {
     CpuFeatureScope sse_scope(this, SSE4_1);
@@ -1388,7 +1383,7 @@ void TurboAssembler::Pinsrd(XMMRegister dst, const Operand& src, int8_t imm8,
   }
 }
 
-void TurboAssembler::Lzcnt(Register dst, const Operand& src) {
+void TurboAssembler::Lzcnt(Register dst, Operand src) {
   if (CpuFeatures::IsSupported(LZCNT)) {
     CpuFeatureScope scope(this, LZCNT);
     lzcnt(dst, src);
@@ -1402,7 +1397,7 @@ void TurboAssembler::Lzcnt(Register dst, const Operand& src) {
   xor_(dst, Immediate(31));  // for x in [0..31], 31^x == 31-x.
 }
 
-void TurboAssembler::Tzcnt(Register dst, const Operand& src) {
+void TurboAssembler::Tzcnt(Register dst, Operand src) {
   if (CpuFeatures::IsSupported(BMI1)) {
     CpuFeatureScope scope(this, BMI1);
     tzcnt(dst, src);
@@ -1415,7 +1410,7 @@ void TurboAssembler::Tzcnt(Register dst, const Operand& src) {
   bind(&not_zero_src);
 }
 
-void TurboAssembler::Popcnt(Register dst, const Operand& src) {
+void TurboAssembler::Popcnt(Register dst, Operand src) {
   if (CpuFeatures::IsSupported(POPCNT)) {
     CpuFeatureScope scope(this, POPCNT);
     popcnt(dst, src);
@@ -1424,6 +1419,12 @@ void TurboAssembler::Popcnt(Register dst, const Operand& src) {
   UNREACHABLE();
 }
 
+void MacroAssembler::LoadWeakValue(Register in_out, Label* target_if_cleared) {
+  cmp(in_out, Immediate(kClearedWeakHeapObject));
+  j(equal, target_if_cleared);
+
+  and_(in_out, Immediate(~kWeakHeapObjectMask));
+}
 
 void MacroAssembler::IncrementCounter(StatsCounter* counter, int value) {
   DCHECK_GT(value, 0);
@@ -1548,6 +1549,59 @@ void TurboAssembler::CallCFunction(Register function, int num_arguments) {
   }
 }
 
+void TurboAssembler::RetpolineCall(Register reg) {
+  Label setup_return, setup_target, inner_indirect_branch, capture_spec;
+
+  jmp(&setup_return);  // Jump past the entire retpoline below.
+
+  bind(&inner_indirect_branch);
+  call(&setup_target);
+
+  bind(&capture_spec);
+  pause();
+  jmp(&capture_spec);
+
+  bind(&setup_target);
+  mov(Operand(esp, 0), reg);
+  ret(0);
+
+  bind(&setup_return);
+  call(&inner_indirect_branch);  // Callee will return after this instruction.
+}
+
+void TurboAssembler::RetpolineCall(Address destination, RelocInfo::Mode rmode) {
+  Label setup_return, setup_target, inner_indirect_branch, capture_spec;
+
+  jmp(&setup_return);  // Jump past the entire retpoline below.
+
+  bind(&inner_indirect_branch);
+  call(&setup_target);
+
+  bind(&capture_spec);
+  pause();
+  jmp(&capture_spec);
+
+  bind(&setup_target);
+  mov(Operand(esp, 0), destination, rmode);
+  ret(0);
+
+  bind(&setup_return);
+  call(&inner_indirect_branch);  // Callee will return after this instruction.
+}
+
+void TurboAssembler::RetpolineJump(Register reg) {
+  Label setup_target, capture_spec;
+
+  call(&setup_target);
+
+  bind(&capture_spec);
+  pause();
+  jmp(&capture_spec);
+
+  bind(&setup_target);
+  mov(Operand(esp, 0), reg);
+  ret(0);
+}
 
 #ifdef DEBUG
 bool AreAliased(Register reg1,
@@ -1596,6 +1650,24 @@ void TurboAssembler::CheckPageFlag(Register object, Register scratch, int mask,
   j(cc, condition_met, condition_met_distance);
 }
 
+void TurboAssembler::ComputeCodeStartAddress(Register dst) {
+  // In order to get the address of the current instruction, we first need
+  // to use a call and then use a pop, thus pushing the return address to
+  // the stack and then popping it into the register.
+  Label current;
+  call(&current);
+  int pc = pc_offset();
+  bind(&current);
+  pop(dst);
+  if (pc != 0) {
+    sub(dst, Immediate(pc));
+  }
+}
+
+void TurboAssembler::ResetSpeculationPoisonRegister() {
+  mov(kSpeculationPoisonRegister, Immediate(-1));
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/ia32/macro-assembler-ia32.h b/deps/v8/src/ia32/macro-assembler-ia32.h
index 6242333847c..c51e6b9d2d1 100644
--- a/deps/v8/src/ia32/macro-assembler-ia32.h
+++ b/deps/v8/src/ia32/macro-assembler-ia32.h
@@ -20,12 +20,15 @@ constexpr Register kReturnRegister2 = edi;
 constexpr Register kJSFunctionRegister = edi;
 constexpr Register kContextRegister = esi;
 constexpr Register kAllocateSizeRegister = edx;
+constexpr Register kSpeculationPoisonRegister = ebx;
 constexpr Register kInterpreterAccumulatorRegister = eax;
-constexpr Register kInterpreterBytecodeOffsetRegister = ecx;
+constexpr Register kInterpreterBytecodeOffsetRegister = edx;
 constexpr Register kInterpreterBytecodeArrayRegister = edi;
 constexpr Register kInterpreterDispatchTableRegister = esi;
 constexpr Register kJavaScriptCallArgCountRegister = eax;
+constexpr Register kJavaScriptCallCodeStartRegister = ecx;
 constexpr Register kJavaScriptCallNewTargetRegister = edx;
+constexpr Register kOffHeapTrampolineRegister = ecx;
 constexpr Register kRuntimeCallFunctionRegister = ebx;
 constexpr Register kRuntimeCallArgCountRegister = eax;
 
@@ -100,7 +103,7 @@ class TurboAssembler : public Assembler {
   // Move if the registers are not identical.
   void Move(Register target, Register source);
 
-  void Move(const Operand& dst, const Immediate& x);
+  void Move(Operand dst, const Immediate& x);
 
   // Move an immediate into an XMM register.
   void Move(XMMRegister dst, uint32_t src);
@@ -113,6 +116,11 @@ class TurboAssembler : public Assembler {
   void Call(Handle<Code> target, RelocInfo::Mode rmode) { call(target, rmode); }
   void Call(Label* target) { call(target); }
 
+  void RetpolineCall(Register reg);
+  void RetpolineCall(Address destination, RelocInfo::Mode rmode);
+
+  void RetpolineJump(Register reg);
+
   void CallForDeoptimization(Address target, RelocInfo::Mode rmode) {
     call(target, rmode);
   }
@@ -171,7 +179,7 @@ class TurboAssembler : public Assembler {
   void ShlPair(Register high, Register low, uint8_t imm8);
   void ShlPair_cl(Register high, Register low);
   void ShrPair(Register high, Register low, uint8_t imm8);
-  void ShrPair_cl(Register high, Register src);
+  void ShrPair_cl(Register high, Register low);
   void SarPair(Register high, Register low, uint8_t imm8);
   void SarPair_cl(Register high, Register low);
 
@@ -180,13 +188,13 @@ class TurboAssembler : public Assembler {
   void Prologue();
 
   void Lzcnt(Register dst, Register src) { Lzcnt(dst, Operand(src)); }
-  void Lzcnt(Register dst, const Operand& src);
+  void Lzcnt(Register dst, Operand src);
 
   void Tzcnt(Register dst, Register src) { Tzcnt(dst, Operand(src)); }
-  void Tzcnt(Register dst, const Operand& src);
+  void Tzcnt(Register dst, Operand src);
 
   void Popcnt(Register dst, Register src) { Popcnt(dst, Operand(src)); }
-  void Popcnt(Register dst, const Operand& src);
+  void Popcnt(Register dst, Operand src);
 
   void Ret();
 
@@ -197,11 +205,11 @@ class TurboAssembler : public Assembler {
   void Pshuflw(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
     Pshuflw(dst, Operand(src), shuffle);
   }
-  void Pshuflw(XMMRegister dst, const Operand& src, uint8_t shuffle);
+  void Pshuflw(XMMRegister dst, Operand src, uint8_t shuffle);
   void Pshufd(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
     Pshufd(dst, Operand(src), shuffle);
   }
-  void Pshufd(XMMRegister dst, const Operand& src, uint8_t shuffle);
+  void Pshufd(XMMRegister dst, Operand src, uint8_t shuffle);
 
 // SSE/SSE2 instructions with AVX version.
 #define AVX_OP2_WITH_TYPE(macro_name, name, dst_type, src_type) \
@@ -214,12 +222,15 @@ class TurboAssembler : public Assembler {
     }                                                           \
   }
 
-  AVX_OP2_WITH_TYPE(Movdqu, movdqu, XMMRegister, const Operand&)
-  AVX_OP2_WITH_TYPE(Movdqu, movdqu, const Operand&, XMMRegister)
+  AVX_OP2_WITH_TYPE(Rcpps, rcpps, XMMRegister, const Operand&)
+  AVX_OP2_WITH_TYPE(Rsqrtps, rsqrtps, XMMRegister, const Operand&)
+  AVX_OP2_WITH_TYPE(Movdqu, movdqu, XMMRegister, Operand)
+  AVX_OP2_WITH_TYPE(Movdqu, movdqu, Operand, XMMRegister)
   AVX_OP2_WITH_TYPE(Movd, movd, XMMRegister, Register)
-  AVX_OP2_WITH_TYPE(Movd, movd, XMMRegister, const Operand&)
+  AVX_OP2_WITH_TYPE(Movd, movd, XMMRegister, Operand)
   AVX_OP2_WITH_TYPE(Movd, movd, Register, XMMRegister)
-  AVX_OP2_WITH_TYPE(Movd, movd, const Operand&, XMMRegister)
+  AVX_OP2_WITH_TYPE(Movd, movd, Operand, XMMRegister)
+  AVX_OP2_WITH_TYPE(Cvtdq2ps, cvtdq2ps, XMMRegister, Operand)
 
 #undef AVX_OP2_WITH_TYPE
 
@@ -236,27 +247,33 @@ class TurboAssembler : public Assembler {
   }
 #define AVX_OP3_XO(macro_name, name)                            \
   AVX_OP3_WITH_TYPE(macro_name, name, XMMRegister, XMMRegister) \
-  AVX_OP3_WITH_TYPE(macro_name, name, XMMRegister, const Operand&)
+  AVX_OP3_WITH_TYPE(macro_name, name, XMMRegister, Operand)
 
   AVX_OP3_XO(Pcmpeqd, pcmpeqd)
   AVX_OP3_XO(Psubb, psubb)
   AVX_OP3_XO(Psubw, psubw)
   AVX_OP3_XO(Psubd, psubd)
   AVX_OP3_XO(Pxor, pxor)
+  AVX_OP3_XO(Andps, andps)
+  AVX_OP3_XO(Andpd, andpd)
+  AVX_OP3_XO(Xorps, xorps)
+  AVX_OP3_XO(Xorpd, xorpd)
+  AVX_OP3_XO(Sqrtss, sqrtss)
+  AVX_OP3_XO(Sqrtsd, sqrtsd)
 
 #undef AVX_OP3_XO
 #undef AVX_OP3_WITH_TYPE
 
   // Non-SSE2 instructions.
   void Pshufb(XMMRegister dst, XMMRegister src) { Pshufb(dst, Operand(src)); }
-  void Pshufb(XMMRegister dst, const Operand& src);
+  void Pshufb(XMMRegister dst, Operand src);
 
   void Psignb(XMMRegister dst, XMMRegister src) { Psignb(dst, Operand(src)); }
-  void Psignb(XMMRegister dst, const Operand& src);
+  void Psignb(XMMRegister dst, Operand src);
   void Psignw(XMMRegister dst, XMMRegister src) { Psignw(dst, Operand(src)); }
-  void Psignw(XMMRegister dst, const Operand& src);
+  void Psignw(XMMRegister dst, Operand src);
   void Psignd(XMMRegister dst, XMMRegister src) { Psignd(dst, Operand(src)); }
-  void Psignd(XMMRegister dst, const Operand& src);
+  void Psignd(XMMRegister dst, Operand src);
 
   void Pextrb(Register dst, XMMRegister src, int8_t imm8);
   void Pextrw(Register dst, XMMRegister src, int8_t imm8);
@@ -265,27 +282,27 @@ class TurboAssembler : public Assembler {
               bool is_64_bits = false) {
     Pinsrd(dst, Operand(src), imm8, is_64_bits);
   }
-  void Pinsrd(XMMRegister dst, const Operand& src, int8_t imm8,
+  void Pinsrd(XMMRegister dst, Operand src, int8_t imm8,
               bool is_64_bits = false);
 
   void LoadUint32(XMMRegister dst, Register src) {
     LoadUint32(dst, Operand(src));
   }
-  void LoadUint32(XMMRegister dst, const Operand& src);
+  void LoadUint32(XMMRegister dst, Operand src);
 
   // Expression support
   // cvtsi2sd instruction only writes to the low 64-bit of dst register, which
   // hinders register renaming and makes dependence chains longer. So we use
   // xorps to clear the dst register before cvtsi2sd to solve this issue.
   void Cvtsi2sd(XMMRegister dst, Register src) { Cvtsi2sd(dst, Operand(src)); }
-  void Cvtsi2sd(XMMRegister dst, const Operand& src);
+  void Cvtsi2sd(XMMRegister dst, Operand src);
 
   void Cvtui2ss(XMMRegister dst, Register src, Register tmp);
 
   void SlowTruncateToIDelayed(Zone* zone, Register result_reg);
 
   void Push(Register src) { push(src); }
-  void Push(const Operand& src) { push(src); }
+  void Push(Operand src) { push(src); }
   void Push(Immediate value) { push(value); }
   void Push(Handle<HeapObject> handle) { push(Immediate(handle)); }
   void Push(Smi* smi) { Push(Immediate(smi)); }
@@ -320,6 +337,12 @@ class TurboAssembler : public Assembler {
                      Register exclusion2 = no_reg,
                      Register exclusion3 = no_reg);
 
+  // Compute the start of the generated instruction stream from the current PC.
+  // This is an alternative to embedding the {CodeObject} handle as a reference.
+  void ComputeCodeStartAddress(Register dst);
+
+  void ResetSpeculationPoisonRegister();
+
  private:
   bool has_frame_ = false;
   Isolate* const isolate_;
@@ -341,7 +364,7 @@ class MacroAssembler : public TurboAssembler {
       mov(dst, Immediate(x));
     }
   }
-  void Set(const Operand& dst, int32_t x) { mov(dst, Immediate(x)); }
+  void Set(Operand dst, int32_t x) { mov(dst, Immediate(x)); }
 
   // Operations on roots in the root-array.
   void LoadRoot(Register destination, Heap::RootListIndex index);
@@ -349,7 +372,7 @@ class MacroAssembler : public TurboAssembler {
   // These methods can only be used with constant roots (i.e. non-writable
   // and not in new space).
   void CompareRoot(Register with, Heap::RootListIndex index);
-  void CompareRoot(const Operand& with, Heap::RootListIndex index);
+  void CompareRoot(Operand with, Heap::RootListIndex index);
   void PushRoot(Heap::RootListIndex index);
 
   // Compare the object in a register to a value and jump if they are equal.
@@ -358,8 +381,7 @@ class MacroAssembler : public TurboAssembler {
     CompareRoot(with, index);
     j(equal, if_equal, if_equal_distance);
   }
-  void JumpIfRoot(const Operand& with, Heap::RootListIndex index,
-                  Label* if_equal,
+  void JumpIfRoot(Operand with, Heap::RootListIndex index, Label* if_equal,
                   Label::Distance if_equal_distance = Label::kFar) {
     CompareRoot(with, index);
     j(equal, if_equal, if_equal_distance);
@@ -372,7 +394,7 @@ class MacroAssembler : public TurboAssembler {
     CompareRoot(with, index);
     j(not_equal, if_not_equal, if_not_equal_distance);
   }
-  void JumpIfNotRoot(const Operand& with, Heap::RootListIndex index,
+  void JumpIfNotRoot(Operand with, Heap::RootListIndex index,
                      Label* if_not_equal,
                      Label::Distance if_not_equal_distance = Label::kFar) {
     CompareRoot(with, index);
@@ -443,6 +465,7 @@ class MacroAssembler : public TurboAssembler {
                           const ParameterCount& actual, InvokeFlag flag);
 
   // On function call, call into the debugger if necessary.
+  // This may clobber ecx.
   void CheckDebugHook(Register fun, Register new_target,
                       const ParameterCount& expected,
                       const ParameterCount& actual);
@@ -455,10 +478,6 @@ class MacroAssembler : public TurboAssembler {
   void InvokeFunction(Register function, const ParameterCount& expected,
                       const ParameterCount& actual, InvokeFlag flag);
 
-  void InvokeFunction(Handle<JSFunction> function,
-                      const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
-
   // Compare object type for heap object.
   // Incoming register is heap_object and outgoing register is map.
   void CmpObjectType(Register heap_object, InstanceType type, Register map);
@@ -467,8 +486,7 @@ class MacroAssembler : public TurboAssembler {
   void CmpInstanceType(Register map, InstanceType type);
 
   void DoubleToI(Register result_reg, XMMRegister input_reg,
-                 XMMRegister scratch, MinusZeroMode minus_zero_mode,
-                 Label* lost_precision, Label* is_nan, Label* minus_zero,
+                 XMMRegister scratch, Label* lost_precision, Label* is_nan,
                  Label::Distance dst = Label::kFar);
 
   // Smi tagging support.
@@ -521,6 +539,9 @@ class MacroAssembler : public TurboAssembler {
   // Abort execution if argument is not a JSFunction, enabled via --debug-code.
   void AssertFunction(Register object);
 
+  // Abort execution if argument is not a Constructor, enabled via --debug-code.
+  void AssertConstructor(Register object);
+
   // Abort execution if argument is not a JSBoundFunction,
   // enabled via --debug-code.
   void AssertBoundFunction(Register object);
@@ -575,6 +596,9 @@ class MacroAssembler : public TurboAssembler {
   void JumpToExternalReference(const ExternalReference& ext,
                                bool builtin_exit_frame = false);
 
+  // Generates a trampoline to jump to the off-heap instruction stream.
+  void JumpToInstructionStream(Address entry);
+
   // ---------------------------------------------------------------------------
   // Utilities
 
@@ -584,10 +608,14 @@ class MacroAssembler : public TurboAssembler {
 
   void Jump(Handle<Code> target, RelocInfo::Mode rmode) { jmp(target, rmode); }
   void Pop(Register dst) { pop(dst); }
-  void Pop(const Operand& dst) { pop(dst); }
+  void Pop(Operand dst) { pop(dst); }
   void PushReturnAddressFrom(Register src) { push(src); }
   void PopReturnAddressTo(Register dst) { pop(dst); }
 
+  // ---------------------------------------------------------------------------
+  // In-place weak references.
+  void LoadWeakValue(Register in_out, Label* target_if_cleared);
+
   // ---------------------------------------------------------------------------
   // StatsCounter support
 
diff --git a/deps/v8/src/ia32/sse-instr.h b/deps/v8/src/ia32/sse-instr.h
index 82cb0e2e58e..cb4cba3ad00 100644
--- a/deps/v8/src/ia32/sse-instr.h
+++ b/deps/v8/src/ia32/sse-instr.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_SSE_INSTR_H_
-#define V8_SSE_INSTR_H_
+#ifndef V8_IA32_SSE_INSTR_H_
+#define V8_IA32_SSE_INSTR_H_
 
 #define SSE2_INSTRUCTION_LIST(V) \
   V(paddb, 66, 0F, FC)           \
@@ -44,6 +44,8 @@
   V(pxor, 66, 0F, EF)
 
 #define SSSE3_INSTRUCTION_LIST(V) \
+  V(phaddd, 66, 0F, 38, 02)       \
+  V(phaddw, 66, 0F, 38, 01)       \
   V(pshufb, 66, 0F, 38, 00)       \
   V(psignb, 66, 0F, 38, 08)       \
   V(psignw, 66, 0F, 38, 09)       \
@@ -60,4 +62,4 @@
   V(pmaxud, 66, 0F, 38, 3F)      \
   V(pmulld, 66, 0F, 38, 40)
 
-#endif  // V8_SSE_INSTR_H_
+#endif  // V8_IA32_SSE_INSTR_H_
diff --git a/deps/v8/src/ic/accessor-assembler.cc b/deps/v8/src/ic/accessor-assembler.cc
index dfd88862bd0..4a1ea6af4b3 100644
--- a/deps/v8/src/ic/accessor-assembler.cc
+++ b/deps/v8/src/ic/accessor-assembler.cc
@@ -17,14 +17,19 @@ namespace internal {
 
 using compiler::CodeAssemblerState;
 using compiler::Node;
+template <typename T>
+using TNode = compiler::TNode<T>;
+template <typename T>
+using SloppyTNode = compiler::SloppyTNode<T>;
 
 //////////////////// Private helpers.
 
 // Loads dataX field from the DataHandler object.
-Node* AccessorAssembler::LoadHandlerDataField(Node* handler, int data_index) {
+TNode<Object> AccessorAssembler::LoadHandlerDataField(
+    SloppyTNode<DataHandler> handler, int data_index) {
 #ifdef DEBUG
-  Node* handler_map = LoadMap(handler);
-  Node* instance_type = LoadMapInstanceType(handler_map);
+  TNode<Map> handler_map = LoadMap(handler);
+  TNode<Int32T> instance_type = LoadMapInstanceType(handler_map);
 #endif
   CSA_ASSERT(this,
              Word32Or(InstanceTypeEqual(instance_type, LOAD_HANDLER_TYPE),
@@ -124,7 +129,7 @@ void AccessorAssembler::HandlePolymorphicCase(Node* receiver_map,
 
     Label next_entry(this);
     Node* cached_map =
-        LoadWeakCellValue(LoadFixedArrayElement(feedback, map_index));
+        LoadWeakCellValue(CAST(LoadFixedArrayElement(feedback, map_index)));
     GotoIf(WordNotEqual(receiver_map, cached_map), &next_entry);
 
     // Found, now call handler.
@@ -144,7 +149,7 @@ void AccessorAssembler::HandlePolymorphicCase(Node* receiver_map,
       start_index, end_index,
       [this, receiver_map, feedback, if_handler, var_handler](Node* index) {
         Node* cached_map =
-            LoadWeakCellValue(LoadFixedArrayElement(feedback, index));
+            LoadWeakCellValue(CAST(LoadFixedArrayElement(feedback, index)));
 
         Label next_entry(this);
         GotoIf(WordNotEqual(receiver_map, cached_map), &next_entry);
@@ -300,18 +305,18 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
       Comment("out of bounds elements access");
       Label return_undefined(this);
 
-      // Negative indices aren't valid array indices (according to
-      // the ECMAScript specification), and are stored as properties
-      // in V8, not elements. So we cannot handle them here.
-      GotoIf(IntPtrLessThan(intptr_index, IntPtrConstant(0)), miss);
-
       // Check if we're allowed to handle OOB accesses.
       Node* allow_out_of_bounds =
           IsSetWord<LoadHandler::AllowOutOfBoundsBits>(handler_word);
       GotoIfNot(allow_out_of_bounds, miss);
 
-      // For typed arrays we never lookup elements in the prototype chain.
+      // Negative indices aren't valid array indices (according to
+      // the ECMAScript specification), and are stored as properties
+      // in V8, not elements. So we cannot handle them here, except
+      // in case of typed arrays, where integer indexed properties
+      // aren't looked up in the prototype chain.
       GotoIf(IsJSTypedArray(holder), &return_undefined);
+      GotoIf(IntPtrLessThan(intptr_index, IntPtrConstant(0)), miss);
 
       // For all other receivers we need to check that the prototype chain
       // doesn't contain any elements.
@@ -339,7 +344,7 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
       Node* length = LoadStringLengthAsWord(holder);
       GotoIf(UintPtrGreaterThanOrEqual(intptr_index, length), &if_oob);
       TNode<Int32T> code = StringCharCodeAt(holder, intptr_index);
-      TNode<String> result = StringFromCharCode(code);
+      TNode<String> result = StringFromSingleCharCode(code);
       Return(result);
 
       BIND(&if_oob);
@@ -467,11 +472,10 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
 
     // Context is stored either in data2 or data3 field depending on whether
     // the access check is enabled for this handler or not.
-    Node* context_cell = Select(
+    TNode<Object> context_cell = Select<Object>(
         IsSetWord<LoadHandler::DoAccessCheckOnReceiverBits>(handler_word),
         [=] { return LoadHandlerDataField(handler, 3); },
-        [=] { return LoadHandlerDataField(handler, 2); },
-        MachineRepresentation::kTagged);
+        [=] { return LoadHandlerDataField(handler, 2); });
 
     Node* context = LoadWeakCellValueUnchecked(context_cell);
     Node* foreign =
@@ -609,15 +613,9 @@ Node* AccessorAssembler::HandleProtoHandler(
   // Check prototype validity cell.
   //
   {
-    Label done(this);
-    Node* validity_cell =
+    Node* maybe_validity_cell =
         LoadObjectField(handler, ICHandler::kValidityCellOffset);
-    GotoIf(WordEqual(validity_cell, SmiConstant(0)), &done);
-    Node* cell_value = LoadObjectField(validity_cell, Cell::kValueOffset);
-    GotoIf(WordNotEqual(cell_value, SmiConstant(Map::kPrototypeChainValid)),
-           miss);
-    Goto(&done);
-    BIND(&done);
+    CheckPrototypeValidityCell(maybe_validity_cell, miss);
   }
 
   //
@@ -790,7 +788,7 @@ void AccessorAssembler::HandleStoreICHandlerCase(
     ElementSupport support_elements) {
   Label if_smi_handler(this), if_nonsmi_handler(this);
   Label if_proto_handler(this), if_element_handler(this), call_handler(this),
-      store_global(this);
+      store_transition_or_global(this);
 
   Branch(TaggedIsSmi(handler), &if_smi_handler, &if_nonsmi_handler);
 
@@ -855,8 +853,7 @@ void AccessorAssembler::HandleStoreICHandlerCase(
 
       BIND(&data);
       // Handle non-transitioning field stores.
-      HandleStoreICSmiHandlerCase(handler_word, holder, p->value, nullptr,
-                                  miss);
+      HandleStoreICSmiHandlerCase(handler_word, holder, p->value, miss);
     }
 
     BIND(&if_proxy);
@@ -866,7 +863,7 @@ void AccessorAssembler::HandleStoreICHandlerCase(
   BIND(&if_nonsmi_handler);
   {
     Node* handler_map = LoadMap(handler);
-    GotoIf(IsWeakCellMap(handler_map), &store_global);
+    GotoIf(IsWeakCellMap(handler_map), &store_transition_or_global);
     Branch(IsCodeMap(handler_map), &call_handler, &if_proto_handler);
   }
 
@@ -881,14 +878,299 @@ void AccessorAssembler::HandleStoreICHandlerCase(
                  p->value, p->slot, p->vector);
   }
 
-  BIND(&store_global);
+  BIND(&store_transition_or_global);
   {
     // Load value or miss if the {handler} weak cell is cleared.
-    Node* cell = LoadWeakCellValue(handler, miss);
+    Node* map_or_property_cell = LoadWeakCellValue(handler, miss);
 
-    ExitPoint direct_exit(this);
-    StoreGlobalIC_PropertyCellCase(cell, p->value, &direct_exit, miss);
+    Label store_global(this), store_transition(this);
+    Branch(IsMap(map_or_property_cell), &store_transition, &store_global);
+
+    BIND(&store_global);
+    {
+      ExitPoint direct_exit(this);
+      StoreGlobalIC_PropertyCellCase(map_or_property_cell, p->value,
+                                     &direct_exit, miss);
+    }
+    BIND(&store_transition);
+    HandleStoreICTransitionMapHandlerCase(p, map_or_property_cell, miss, false);
+  }
+}
+
+void AccessorAssembler::HandleStoreICTransitionMapHandlerCase(
+    const StoreICParameters* p, Node* transition_map, Label* miss,
+    bool validate_transition_handler) {
+  Node* maybe_validity_cell =
+      LoadObjectField(transition_map, Map::kPrototypeValidityCellOffset);
+  CheckPrototypeValidityCell(maybe_validity_cell, miss);
+
+  TNode<Uint32T> bitfield3 = LoadMapBitField3(transition_map);
+  CSA_ASSERT(this, IsClearWord32<Map::IsDictionaryMapBit>(bitfield3));
+  GotoIf(IsSetWord32<Map::IsDeprecatedBit>(bitfield3), miss);
+
+  // Load last descriptor details.
+  Node* nof = DecodeWordFromWord32<Map::NumberOfOwnDescriptorsBits>(bitfield3);
+  CSA_ASSERT(this, WordNotEqual(nof, IntPtrConstant(0)));
+  Node* descriptors = LoadMapDescriptors(transition_map);
+
+  Node* factor = IntPtrConstant(DescriptorArray::kEntrySize);
+  Node* last_key_index = IntPtrAdd(
+      IntPtrConstant(DescriptorArray::ToKeyIndex(-1)), IntPtrMul(nof, factor));
+  if (validate_transition_handler) {
+    Node* key = LoadFixedArrayElement(descriptors, last_key_index);
+    GotoIf(WordNotEqual(key, p->name), miss);
+  } else {
+    CSA_ASSERT(
+        this,
+        WordEqual(LoadFixedArrayElement(descriptors, last_key_index), p->name));
+  }
+  Node* details =
+      LoadDetailsByKeyIndex<DescriptorArray>(descriptors, last_key_index);
+  if (validate_transition_handler) {
+    // Follow transitions only in the following cases:
+    // 1) name is a non-private symbol and attributes equal to NONE,
+    // 2) name is a private symbol and attributes equal to DONT_ENUM.
+    Label attributes_ok(this);
+    const int kAttributesDontDeleteReadOnlyMask =
+        PropertyDetails::kAttributesDontDeleteMask |
+        PropertyDetails::kAttributesReadOnlyMask;
+    // Both DontDelete and ReadOnly attributes must not be set.
+    GotoIf(IsSetWord32(details, kAttributesDontDeleteReadOnlyMask), miss);
+
+    // DontEnum attribute is allowed only for private symbols and vice versa.
+    Branch(Word32Equal(
+               IsSetWord32(details, PropertyDetails::kAttributesDontEnumMask),
+               IsPrivateSymbol(p->name)),
+           &attributes_ok, miss);
+
+    BIND(&attributes_ok);
+  }
+
+  OverwriteExistingFastDataProperty(p->receiver, transition_map, descriptors,
+                                    last_key_index, details, p->value, miss,
+                                    true);
+  Return(p->value);
+}
+
+void AccessorAssembler::CheckFieldType(Node* descriptors, Node* name_index,
+                                       Node* representation, Node* value,
+                                       Label* bailout) {
+  Label r_smi(this), r_double(this), r_heapobject(this), all_fine(this);
+  // Ignore FLAG_track_fields etc. and always emit code for all checks,
+  // because this builtin is part of the snapshot and therefore should
+  // be flag independent.
+  GotoIf(Word32Equal(representation, Int32Constant(Representation::kSmi)),
+         &r_smi);
+  GotoIf(Word32Equal(representation, Int32Constant(Representation::kDouble)),
+         &r_double);
+  GotoIf(
+      Word32Equal(representation, Int32Constant(Representation::kHeapObject)),
+      &r_heapobject);
+  GotoIf(Word32Equal(representation, Int32Constant(Representation::kNone)),
+         bailout);
+  CSA_ASSERT(this, Word32Equal(representation,
+                               Int32Constant(Representation::kTagged)));
+  Goto(&all_fine);
+
+  BIND(&r_smi);
+  { Branch(TaggedIsSmi(value), &all_fine, bailout); }
+
+  BIND(&r_double);
+  {
+    GotoIf(TaggedIsSmi(value), &all_fine);
+    Node* value_map = LoadMap(value);
+    // While supporting mutable HeapNumbers would be straightforward, such
+    // objects should not end up here anyway.
+    CSA_ASSERT(this,
+               WordNotEqual(value_map,
+                            LoadRoot(Heap::kMutableHeapNumberMapRootIndex)));
+    Branch(IsHeapNumberMap(value_map), &all_fine, bailout);
+  }
+
+  BIND(&r_heapobject);
+  {
+    GotoIf(TaggedIsSmi(value), bailout);
+    Node* field_type =
+        LoadValueByKeyIndex<DescriptorArray>(descriptors, name_index);
+    intptr_t kNoneType = reinterpret_cast<intptr_t>(FieldType::None());
+    intptr_t kAnyType = reinterpret_cast<intptr_t>(FieldType::Any());
+    // FieldType::None can't hold any value.
+    GotoIf(WordEqual(field_type, IntPtrConstant(kNoneType)), bailout);
+    // FieldType::Any can hold any value.
+    GotoIf(WordEqual(field_type, IntPtrConstant(kAnyType)), &all_fine);
+    CSA_ASSERT(this, IsWeakCell(field_type));
+    // Cleared WeakCells count as FieldType::None, which can't hold any value.
+    field_type = LoadWeakCellValue(field_type, bailout);
+    // FieldType::Class(...) performs a map check.
+    CSA_ASSERT(this, IsMap(field_type));
+    Branch(WordEqual(LoadMap(value), field_type), &all_fine, bailout);
+  }
+
+  BIND(&all_fine);
+}
+
+void AccessorAssembler::OverwriteExistingFastDataProperty(
+    Node* object, Node* object_map, Node* descriptors,
+    Node* descriptor_name_index, Node* details, Node* value, Label* slow,
+    bool do_transitioning_store) {
+  Label done(this), if_field(this), if_descriptor(this);
+
+  CSA_ASSERT(this,
+             Word32Equal(DecodeWord32<PropertyDetails::KindField>(details),
+                         Int32Constant(kData)));
+
+  Branch(Word32Equal(DecodeWord32<PropertyDetails::LocationField>(details),
+                     Int32Constant(kField)),
+         &if_field, &if_descriptor);
+
+  BIND(&if_field);
+  {
+    if (FLAG_track_constant_fields && !do_transitioning_store) {
+      // TODO(ishell): Taking the slow path is not necessary if new and old
+      // values are identical.
+      GotoIf(Word32Equal(DecodeWord32<PropertyDetails::ConstnessField>(details),
+                         Int32Constant(kConst)),
+             slow);
+    }
+
+    Node* representation =
+        DecodeWord32<PropertyDetails::RepresentationField>(details);
+
+    CheckFieldType(descriptors, descriptor_name_index, representation, value,
+                   slow);
+
+    Node* field_index =
+        DecodeWordFromWord32<PropertyDetails::FieldIndexField>(details);
+    field_index = IntPtrAdd(field_index,
+                            LoadMapInobjectPropertiesStartInWords(object_map));
+    Node* instance_size_in_words = LoadMapInstanceSizeInWords(object_map);
+
+    Label inobject(this), backing_store(this);
+    Branch(UintPtrLessThan(field_index, instance_size_in_words), &inobject,
+           &backing_store);
+
+    BIND(&inobject);
+    {
+      Node* field_offset = TimesPointerSize(field_index);
+      Label tagged_rep(this), double_rep(this);
+      Branch(
+          Word32Equal(representation, Int32Constant(Representation::kDouble)),
+          &double_rep, &tagged_rep);
+      BIND(&double_rep);
+      {
+        Node* double_value = ChangeNumberToFloat64(value);
+        if (FLAG_unbox_double_fields) {
+          if (do_transitioning_store) {
+            StoreMap(object, object_map);
+          }
+          StoreObjectFieldNoWriteBarrier(object, field_offset, double_value,
+                                         MachineRepresentation::kFloat64);
+        } else {
+          if (do_transitioning_store) {
+            Node* mutable_heap_number =
+                AllocateHeapNumberWithValue(double_value, MUTABLE);
+            StoreMap(object, object_map);
+            StoreObjectField(object, field_offset, mutable_heap_number);
+          } else {
+            Node* mutable_heap_number = LoadObjectField(object, field_offset);
+            StoreHeapNumberValue(mutable_heap_number, double_value);
+          }
+        }
+        Goto(&done);
+      }
+
+      BIND(&tagged_rep);
+      {
+        if (do_transitioning_store) {
+          StoreMap(object, object_map);
+        }
+        StoreObjectField(object, field_offset, value);
+        Goto(&done);
+      }
+    }
+
+    BIND(&backing_store);
+    {
+      Node* backing_store_index =
+          IntPtrSub(field_index, instance_size_in_words);
+
+      if (do_transitioning_store) {
+        // Allocate mutable heap number before extending properties backing
+        // store to ensure that heap verifier will not see the heap in
+        // inconsistent state.
+        VARIABLE(var_value, MachineRepresentation::kTagged, value);
+        {
+          Label cont(this);
+          GotoIf(Word32NotEqual(representation,
+                                Int32Constant(Representation::kDouble)),
+                 &cont);
+          {
+            Node* double_value = ChangeNumberToFloat64(value);
+            Node* mutable_heap_number =
+                AllocateHeapNumberWithValue(double_value, MUTABLE);
+            var_value.Bind(mutable_heap_number);
+            Goto(&cont);
+          }
+          BIND(&cont);
+        }
+
+        Node* properties =
+            ExtendPropertiesBackingStore(object, backing_store_index);
+        StoreFixedArrayElement(properties, backing_store_index,
+                               var_value.value());
+        StoreMap(object, object_map);
+        Goto(&done);
+
+      } else {
+        Label tagged_rep(this), double_rep(this);
+        Node* properties = LoadFastProperties(object);
+        Branch(
+            Word32Equal(representation, Int32Constant(Representation::kDouble)),
+            &double_rep, &tagged_rep);
+        BIND(&double_rep);
+        {
+          Node* mutable_heap_number =
+              LoadFixedArrayElement(properties, backing_store_index);
+          Node* double_value = ChangeNumberToFloat64(value);
+          StoreHeapNumberValue(mutable_heap_number, double_value);
+          Goto(&done);
+        }
+        BIND(&tagged_rep);
+        {
+          StoreFixedArrayElement(properties, backing_store_index, value);
+          Goto(&done);
+        }
+      }
+    }
+  }
+
+  BIND(&if_descriptor);
+  {
+    // Check that constant matches value.
+    Node* constant = LoadValueByKeyIndex<DescriptorArray>(
+        descriptors, descriptor_name_index);
+    GotoIf(WordNotEqual(value, constant), slow);
+
+    if (do_transitioning_store) {
+      StoreMap(object, object_map);
+    }
+    Goto(&done);
   }
+  BIND(&done);
+}
+
+void AccessorAssembler::CheckPrototypeValidityCell(Node* maybe_validity_cell,
+                                                   Label* miss) {
+  Label done(this);
+  GotoIf(WordEqual(maybe_validity_cell, SmiConstant(Map::kPrototypeChainValid)),
+         &done);
+  CSA_ASSERT(this, TaggedIsNotSmi(maybe_validity_cell));
+
+  Node* cell_value = LoadObjectField(maybe_validity_cell, Cell::kValueOffset);
+  Branch(WordEqual(cell_value, SmiConstant(Map::kPrototypeChainValid)), &done,
+         miss);
+
+  BIND(&done);
 }
 
 void AccessorAssembler::HandleStoreAccessor(const StoreICParameters* p,
@@ -943,7 +1225,6 @@ void AccessorAssembler::HandleStoreICProtoHandler(
       p, handler, on_code_handler,
       // on_found_on_receiver
       [=](Node* properties, Node* name_index) {
-        // TODO(ishell): combine with |found| case inside |if_store_normal|.
         Node* details =
             LoadDetailsByKeyIndex<NameDictionary>(properties, name_index);
         // Check that the property is a writable data property (no accessor).
@@ -958,99 +1239,20 @@ void AccessorAssembler::HandleStoreICProtoHandler(
       },
       miss, ic_mode);
 
-  Label if_transition_map(this), if_holder_object(this);
-
-  Node* maybe_transition_or_holder_cell = LoadHandlerDataField(handler, 1);
-  Node* maybe_transition_or_holder =
-      LoadWeakCellValue(maybe_transition_or_holder_cell, miss);
-  Branch(IsMap(maybe_transition_or_holder), &if_transition_map,
-         &if_holder_object);
-
-  BIND(&if_transition_map);
   {
-    Label if_transition_to_constant(this), if_store_normal(this);
+    Label if_add_normal(this), if_store_global_proxy(this), if_api_setter(this),
+        if_accessor(this), if_native_data_property(this);
 
-    Node* holder = p->receiver;
-    Node* transition_map = maybe_transition_or_holder;
-
-    GotoIf(IsDeprecatedMap(transition_map), miss);
+    CSA_ASSERT(this, TaggedIsSmi(smi_handler));
     Node* handler_word = SmiUntag(smi_handler);
 
     Node* handler_kind = DecodeWord<StoreHandler::KindBits>(handler_word);
     GotoIf(WordEqual(handler_kind, IntPtrConstant(StoreHandler::kNormal)),
-           &if_store_normal);
-    GotoIf(WordEqual(handler_kind,
-                     IntPtrConstant(StoreHandler::kTransitionToConstant)),
-           &if_transition_to_constant);
-
-    CSA_ASSERT(this,
-               WordEqual(handler_kind,
-                         IntPtrConstant(StoreHandler::kTransitionToField)));
-
-    // Handle transitioning field stores.
-    HandleStoreICSmiHandlerCase(handler_word, holder, p->value, transition_map,
-                                miss);
-
-    BIND(&if_transition_to_constant);
-    {
-      // Check that constant matches value.
-      Node* descriptor = DecodeWord<StoreHandler::DescriptorBits>(handler_word);
-      Node* constant = LoadDescriptorValue(transition_map, descriptor);
-      GotoIf(WordNotEqual(p->value, constant), miss);
-
-      StoreMap(p->receiver, transition_map);
-      Return(p->value);
-    }
-
-    BIND(&if_store_normal);
-    {
-      Node* properties = LoadSlowProperties(p->receiver);
-
-      VARIABLE(var_name_index, MachineType::PointerRepresentation());
-      Label found(this, &var_name_index), not_found(this);
-      NameDictionaryLookup<NameDictionary>(properties, p->name, &found,
-                                           &var_name_index, &not_found);
-      BIND(&found);
-      {
-        Node* details = LoadDetailsByKeyIndex<NameDictionary>(
-            properties, var_name_index.value());
-        // Check that the property is a writable data property (no accessor).
-        const int kTypeAndReadOnlyMask =
-            PropertyDetails::KindField::kMask |
-            PropertyDetails::kAttributesReadOnlyMask;
-        STATIC_ASSERT(kData == 0);
-        GotoIf(IsSetWord32(details, kTypeAndReadOnlyMask), miss);
-
-        StoreValueByKeyIndex<NameDictionary>(properties, var_name_index.value(),
-                                             p->value);
-        Return(p->value);
-      }
-
-      BIND(&not_found);
-      {
-        Label slow(this);
-        Node* receiver_map = LoadMap(p->receiver);
-        InvalidateValidityCellIfPrototype(receiver_map);
-
-        Add<NameDictionary>(properties, p->name, p->value, &slow);
-        Return(p->value);
-
-        BIND(&slow);
-        TailCallRuntime(Runtime::kAddDictionaryProperty, p->context,
-                        p->receiver, p->name, p->value);
-      }
-    }
-  }
-  BIND(&if_holder_object);
-  {
-    Label if_store_global_proxy(this), if_api_setter(this), if_accessor(this),
-        if_native_data_property(this);
-    Node* holder = maybe_transition_or_holder;
+           &if_add_normal);
 
-    CSA_ASSERT(this, TaggedIsSmi(smi_handler));
-    Node* handler_word = SmiUntag(smi_handler);
+    Node* holder_cell = LoadHandlerDataField(handler, 1);
+    Node* holder = LoadWeakCellValue(holder_cell, miss);
 
-    Node* handler_kind = DecodeWord<StoreHandler::KindBits>(handler_word);
     GotoIf(WordEqual(handler_kind, IntPtrConstant(StoreHandler::kGlobalProxy)),
            &if_store_global_proxy);
 
@@ -1072,6 +1274,25 @@ void AccessorAssembler::HandleStoreICProtoHandler(
                WordEqual(handler_kind, IntPtrConstant(StoreHandler::kProxy)));
     HandleStoreToProxy(p, holder, miss, support_elements);
 
+    BIND(&if_add_normal);
+    {
+      // This is a case of "transitioning store" to a dictionary mode object
+      // when the property is still does not exist. The "existing property"
+      // case is covered above by LookupOnReceiver bit handling of the smi
+      // handler.
+      Label slow(this);
+      Node* receiver_map = LoadMap(p->receiver);
+      InvalidateValidityCellIfPrototype(receiver_map);
+
+      Node* properties = LoadSlowProperties(p->receiver);
+      Add<NameDictionary>(properties, p->name, p->value, &slow);
+      Return(p->value);
+
+      BIND(&slow);
+      TailCallRuntime(Runtime::kAddDictionaryProperty, p->context, p->receiver,
+                      p->name, p->value);
+    }
+
     BIND(&if_accessor);
     HandleStoreAccessor(p, holder, handler_word);
 
@@ -1086,11 +1307,10 @@ void AccessorAssembler::HandleStoreICProtoHandler(
 
       // Context is stored either in data2 or data3 field depending on whether
       // the access check is enabled for this handler or not.
-      Node* context_cell = Select(
+      TNode<Object> context_cell = Select<Object>(
           IsSetWord<LoadHandler::DoAccessCheckOnReceiverBits>(handler_word),
           [=] { return LoadHandlerDataField(handler, 3); },
-          [=] { return LoadHandlerDataField(handler, 2); },
-          MachineRepresentation::kTagged);
+          [=] { return LoadHandlerDataField(handler, 2); });
 
       Node* context = LoadWeakCellValueUnchecked(context_cell);
 
@@ -1177,30 +1397,19 @@ void AccessorAssembler::HandleStoreToProxy(const StoreICParameters* p,
 
 void AccessorAssembler::HandleStoreICSmiHandlerCase(Node* handler_word,
                                                     Node* holder, Node* value,
-                                                    Node* transition,
                                                     Label* miss) {
-  Comment(transition ? "transitioning field store" : "field store");
+  Comment("field store");
 #ifdef DEBUG
   Node* handler_kind = DecodeWord<StoreHandler::KindBits>(handler_word);
-  if (transition) {
+  if (FLAG_track_constant_fields) {
     CSA_ASSERT(
         this,
-        Word32Or(
-            WordEqual(handler_kind,
-                      IntPtrConstant(StoreHandler::kTransitionToField)),
-            WordEqual(handler_kind,
-                      IntPtrConstant(StoreHandler::kTransitionToConstant))));
+        Word32Or(WordEqual(handler_kind, IntPtrConstant(StoreHandler::kField)),
+                 WordEqual(handler_kind,
+                           IntPtrConstant(StoreHandler::kConstField))));
   } else {
-    if (FLAG_track_constant_fields) {
-      CSA_ASSERT(
-          this, Word32Or(WordEqual(handler_kind,
-                                   IntPtrConstant(StoreHandler::kField)),
-                         WordEqual(handler_kind,
-                                   IntPtrConstant(StoreHandler::kConstField))));
-    } else {
-      CSA_ASSERT(this,
-                 WordEqual(handler_kind, IntPtrConstant(StoreHandler::kField)));
-    }
+    CSA_ASSERT(this,
+               WordEqual(handler_kind, IntPtrConstant(StoreHandler::kField)));
   }
 #endif
 
@@ -1225,40 +1434,37 @@ void AccessorAssembler::HandleStoreICSmiHandlerCase(Node* handler_word,
   {
     Comment("store tagged field");
     HandleStoreFieldAndReturn(handler_word, holder, Representation::Tagged(),
-                              value, transition, miss);
+                              value, miss);
   }
 
   BIND(&if_double_field);
   {
     Comment("store double field");
     HandleStoreFieldAndReturn(handler_word, holder, Representation::Double(),
-                              value, transition, miss);
+                              value, miss);
   }
 
   BIND(&if_heap_object_field);
   {
     Comment("store heap object field");
     HandleStoreFieldAndReturn(handler_word, holder,
-                              Representation::HeapObject(), value, transition,
-                              miss);
+                              Representation::HeapObject(), value, miss);
   }
 
   BIND(&if_smi_field);
   {
     Comment("store smi field");
     HandleStoreFieldAndReturn(handler_word, holder, Representation::Smi(),
-                              value, transition, miss);
+                              value, miss);
   }
 }
 
 void AccessorAssembler::HandleStoreFieldAndReturn(Node* handler_word,
                                                   Node* holder,
                                                   Representation representation,
-                                                  Node* value, Node* transition,
-                                                  Label* miss) {
-  bool transition_to_field = transition != nullptr;
-  Node* prepared_value = PrepareValueForStore(
-      handler_word, holder, representation, transition, value, miss);
+                                                  Node* value, Label* miss) {
+  Node* prepared_value =
+      PrepareValueForStore(handler_word, holder, representation, value, miss);
 
   Label if_inobject(this), if_out_of_object(this);
   Branch(IsSetWord<StoreHandler::IsInobjectBits>(handler_word), &if_inobject,
@@ -1267,32 +1473,21 @@ void AccessorAssembler::HandleStoreFieldAndReturn(Node* handler_word,
   BIND(&if_inobject);
   {
     StoreNamedField(handler_word, holder, true, representation, prepared_value,
-                    transition_to_field, miss);
-    if (transition_to_field) {
-      StoreMap(holder, transition);
-    }
+                    miss);
     Return(value);
   }
 
   BIND(&if_out_of_object);
   {
-    if (transition_to_field) {
-      ExtendPropertiesBackingStore(holder, handler_word);
-    }
-
     StoreNamedField(handler_word, holder, false, representation, prepared_value,
-                    transition_to_field, miss);
-    if (transition_to_field) {
-      StoreMap(holder, transition);
-    }
+                    miss);
     Return(value);
   }
 }
 
 Node* AccessorAssembler::PrepareValueForStore(Node* handler_word, Node* holder,
                                               Representation representation,
-                                              Node* transition, Node* value,
-                                              Label* bailout) {
+                                              Node* value, Label* bailout) {
   if (representation.IsDouble()) {
     value = TryTaggedToFloat64(value, bailout);
 
@@ -1300,7 +1495,7 @@ Node* AccessorAssembler::PrepareValueForStore(Node* handler_word, Node* holder,
     GotoIf(TaggedIsSmi(value), bailout);
 
     Label done(this);
-    if (FLAG_track_constant_fields && !transition) {
+    if (FLAG_track_constant_fields) {
       // Skip field type check in favor of constant value check when storing
       // to constant field.
       GotoIf(WordEqual(DecodeWord<StoreHandler::KindBits>(handler_word),
@@ -1308,8 +1503,7 @@ Node* AccessorAssembler::PrepareValueForStore(Node* handler_word, Node* holder,
              &done);
     }
     Node* descriptor = DecodeWord<StoreHandler::DescriptorBits>(handler_word);
-    Node* maybe_field_type = LoadDescriptorValue(
-        transition ? transition : LoadMap(holder), descriptor);
+    Node* maybe_field_type = LoadDescriptorValue(LoadMap(holder), descriptor);
 
     GotoIf(TaggedIsSmi(maybe_field_type), &done);
     // Check that value type matches the field type.
@@ -1328,10 +1522,8 @@ Node* AccessorAssembler::PrepareValueForStore(Node* handler_word, Node* holder,
   return value;
 }
 
-void AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
-                                                     Node* handler_word) {
-  Label done(this);
-  GotoIfNot(IsSetWord<StoreHandler::ExtendStorageBits>(handler_word), &done);
+Node* AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
+                                                      Node* index) {
   Comment("[ Extend storage");
 
   ParameterMode mode = OptimalParameterMode();
@@ -1350,7 +1542,7 @@ void AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
 
   BIND(&if_smi_hash);
   {
-    Node* hash = SmiToWord32(properties);
+    Node* hash = SmiToInt32(properties);
     Node* encoded_hash =
         Word32Shl(hash, Int32Constant(PropertyArray::HashField::kShift));
     var_encoded_hash.Bind(encoded_hash);
@@ -1368,21 +1560,21 @@ void AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
     Node* length_intptr = ChangeInt32ToIntPtr(
         Word32And(length_and_hash_int32,
                   Int32Constant(PropertyArray::LengthField::kMask)));
-    Node* length = WordToParameter(length_intptr, mode);
+    Node* length = IntPtrToParameter(length_intptr, mode);
     var_length.Bind(length);
     Goto(&extend_store);
   }
 
   BIND(&extend_store);
   {
+    VARIABLE(var_new_properties, MachineRepresentation::kTaggedPointer,
+             var_properties.value());
+    Label done(this);
     // Previous property deletion could have left behind unused backing store
     // capacity even for a map that think it doesn't have any unused fields.
     // Perform a bounds check to see if we actually have to grow the array.
-    Node* index = DecodeWord<StoreHandler::FieldIndexBits>(handler_word);
-    Node* offset = IntPtrMul(index, IntPtrConstant(kPointerSize));
-    Node* size = ElementOffsetFromIndex(var_length.value(), PACKED_ELEMENTS,
-                                        mode, FixedArray::kHeaderSize);
-    GotoIf(UintPtrLessThan(offset, size), &done);
+    GotoIf(UintPtrLessThan(index, ParameterToIntPtr(var_length.value(), mode)),
+           &done);
 
     Node* delta = IntPtrOrSmiConstant(JSObject::kFieldsAdded, mode);
     Node* new_capacity = IntPtrOrSmiAdd(var_length.value(), delta, mode);
@@ -1400,6 +1592,7 @@ void AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
                    mode));
 
     Node* new_properties = AllocatePropertyArray(new_capacity, mode);
+    var_new_properties.Bind(new_properties);
 
     FillPropertyArrayWithUndefined(new_properties, var_length.value(),
                                    new_capacity, mode);
@@ -1412,23 +1605,23 @@ void AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
     // TODO(gsathya): Clean up the type conversions by creating smarter
     // helpers that do the correct op based on the mode.
     Node* new_capacity_int32 =
-        TruncateWordToWord32(ParameterToWord(new_capacity, mode));
+        TruncateIntPtrToInt32(ParameterToIntPtr(new_capacity, mode));
     Node* new_length_and_hash_int32 =
         Word32Or(var_encoded_hash.value(), new_capacity_int32);
     StoreObjectField(new_properties, PropertyArray::kLengthAndHashOffset,
-                     SmiFromWord32(new_length_and_hash_int32));
+                     SmiFromInt32(new_length_and_hash_int32));
     StoreObjectField(object, JSObject::kPropertiesOrHashOffset, new_properties);
     Comment("] Extend storage");
     Goto(&done);
+    BIND(&done);
+    return var_new_properties.value();
   }
-  BIND(&done);
 }
 
 void AccessorAssembler::StoreNamedField(Node* handler_word, Node* object,
                                         bool is_inobject,
                                         Representation representation,
-                                        Node* value, bool transition_to_field,
-                                        Label* bailout) {
+                                        Node* value, Label* bailout) {
   bool store_value_as_double = representation.IsDouble();
   Node* property_storage = object;
   if (!is_inobject) {
@@ -1439,22 +1632,15 @@ void AccessorAssembler::StoreNamedField(Node* handler_word, Node* object,
   Node* offset = IntPtrMul(index, IntPtrConstant(kPointerSize));
   if (representation.IsDouble()) {
     if (!FLAG_unbox_double_fields || !is_inobject) {
-      if (transition_to_field) {
-        Node* heap_number = AllocateHeapNumberWithValue(value, MUTABLE);
-        // Store the new mutable heap number into the object.
-        value = heap_number;
-        store_value_as_double = false;
-      } else {
-        // Load the heap number.
-        property_storage = LoadObjectField(property_storage, offset);
-        // Store the double value into it.
-        offset = IntPtrConstant(HeapNumber::kValueOffset);
-      }
+      // Load the mutable heap number.
+      property_storage = LoadObjectField(property_storage, offset);
+      // Store the double value into it.
+      offset = IntPtrConstant(HeapNumber::kValueOffset);
     }
   }
 
   // Do constant value check if necessary.
-  if (FLAG_track_constant_fields && !transition_to_field) {
+  if (FLAG_track_constant_fields) {
     Label done(this);
     GotoIfNot(WordEqual(DecodeWord<StoreHandler::KindBits>(handler_word),
                         IntPtrConstant(StoreHandler::kConstField)),
@@ -1614,26 +1800,22 @@ void AccessorAssembler::EmitElementLoad(
         SmiUntag(CAST(LoadObjectField(object, JSTypedArray::kLengthOffset)));
     GotoIfNot(UintPtrLessThan(intptr_index, length), out_of_bounds);
 
-    // Backing store = external_pointer + base_pointer.
-    Node* external_pointer =
-        LoadObjectField(elements, FixedTypedArrayBase::kExternalPointerOffset,
-                        MachineType::Pointer());
-    Node* base_pointer =
-        LoadObjectField(elements, FixedTypedArrayBase::kBasePointerOffset);
-    Node* backing_store =
-        IntPtrAdd(external_pointer, BitcastTaggedToWord(base_pointer));
+    Node* backing_store = LoadFixedTypedArrayBackingStore(CAST(elements));
 
     Label uint8_elements(this), int8_elements(this), uint16_elements(this),
         int16_elements(this), uint32_elements(this), int32_elements(this),
-        float32_elements(this), float64_elements(this);
+        float32_elements(this), float64_elements(this), bigint64_elements(this),
+        biguint64_elements(this);
     Label* elements_kind_labels[] = {
-        &uint8_elements,  &uint8_elements,   &int8_elements,
-        &uint16_elements, &int16_elements,   &uint32_elements,
-        &int32_elements,  &float32_elements, &float64_elements};
+        &uint8_elements,    &uint8_elements,    &int8_elements,
+        &uint16_elements,   &int16_elements,    &uint32_elements,
+        &int32_elements,    &float32_elements,  &float64_elements,
+        &bigint64_elements, &biguint64_elements};
     int32_t elements_kinds[] = {
-        UINT8_ELEMENTS,  UINT8_CLAMPED_ELEMENTS, INT8_ELEMENTS,
-        UINT16_ELEMENTS, INT16_ELEMENTS,         UINT32_ELEMENTS,
-        INT32_ELEMENTS,  FLOAT32_ELEMENTS,       FLOAT64_ELEMENTS};
+        UINT8_ELEMENTS,    UINT8_CLAMPED_ELEMENTS, INT8_ELEMENTS,
+        UINT16_ELEMENTS,   INT16_ELEMENTS,         UINT32_ELEMENTS,
+        INT32_ELEMENTS,    FLOAT32_ELEMENTS,       FLOAT64_ELEMENTS,
+        BIGINT64_ELEMENTS, BIGUINT64_ELEMENTS};
     const size_t kTypedElementsKindCount =
         LAST_FIXED_TYPED_ARRAY_ELEMENTS_KIND -
         FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND + 1;
@@ -1645,27 +1827,27 @@ void AccessorAssembler::EmitElementLoad(
     {
       Comment("UINT8_ELEMENTS");  // Handles UINT8_CLAMPED_ELEMENTS too.
       Node* element = Load(MachineType::Uint8(), backing_store, intptr_index);
-      exit_point->Return(SmiFromWord32(element));
+      exit_point->Return(SmiFromInt32(element));
     }
     BIND(&int8_elements);
     {
       Comment("INT8_ELEMENTS");
       Node* element = Load(MachineType::Int8(), backing_store, intptr_index);
-      exit_point->Return(SmiFromWord32(element));
+      exit_point->Return(SmiFromInt32(element));
     }
     BIND(&uint16_elements);
     {
       Comment("UINT16_ELEMENTS");
       Node* index = WordShl(intptr_index, IntPtrConstant(1));
       Node* element = Load(MachineType::Uint16(), backing_store, index);
-      exit_point->Return(SmiFromWord32(element));
+      exit_point->Return(SmiFromInt32(element));
     }
     BIND(&int16_elements);
     {
       Comment("INT16_ELEMENTS");
       Node* index = WordShl(intptr_index, IntPtrConstant(1));
       Node* element = Load(MachineType::Int16(), backing_store, index);
-      exit_point->Return(SmiFromWord32(element));
+      exit_point->Return(SmiFromInt32(element));
     }
     BIND(&uint32_elements);
     {
@@ -1697,6 +1879,18 @@ void AccessorAssembler::EmitElementLoad(
       var_double_value->Bind(element);
       Goto(rebox_double);
     }
+    BIND(&bigint64_elements);
+    {
+      Comment("BIGINT64_ELEMENTS");
+      exit_point->Return(LoadFixedTypedArrayElementAsTagged(
+          backing_store, intptr_index, BIGINT64_ELEMENTS, INTPTR_PARAMETERS));
+    }
+    BIND(&biguint64_elements);
+    {
+      Comment("BIGUINT64_ELEMENTS");
+      exit_point->Return(LoadFixedTypedArrayElementAsTagged(
+          backing_store, intptr_index, BIGUINT64_ELEMENTS, INTPTR_PARAMETERS));
+    }
   }
 }
 
@@ -1718,15 +1912,20 @@ void AccessorAssembler::BranchIfStrictMode(Node* vector, Node* slot,
       LoadObjectField(vector, FeedbackVector::kSharedFunctionInfoOffset);
   Node* metadata =
       LoadObjectField(sfi, SharedFunctionInfo::kFeedbackMetadataOffset);
-  Node* slot_int = SmiToWord32(slot);
+  Node* slot_int = SmiToInt32(slot);
 
   // See VectorICComputer::index().
   const int kItemsPerWord = FeedbackMetadata::VectorICComputer::kItemsPerWord;
   Node* word_index = Int32Div(slot_int, Int32Constant(kItemsPerWord));
   Node* word_offset = Int32Mod(slot_int, Int32Constant(kItemsPerWord));
-  Node* data = SmiToWord32(LoadFixedArrayElement(
-      metadata, ChangeInt32ToIntPtr(word_index),
-      FeedbackMetadata::kReservedIndexCount * kPointerSize, INTPTR_PARAMETERS));
+
+  int32_t first_item = FeedbackMetadata::kHeaderSize - kHeapObjectTag;
+  Node* offset =
+      ElementOffsetFromIndex(ChangeInt32ToIntPtr(word_index), UINT32_ELEMENTS,
+                             INTPTR_PARAMETERS, first_item);
+
+  Node* data = Load(MachineType::Int32(), metadata, offset);
+
   // See VectorICComputer::decode().
   const int kBitsPerItem = FeedbackMetadata::kFeedbackSlotKindBits;
   Node* shift = Int32Mul(word_offset, Int32Constant(kBitsPerItem));
@@ -1803,10 +2002,12 @@ void AccessorAssembler::GenericElementLoad(Node* receiver, Node* receiver_map,
   BIND(&if_oob);
   {
     Comment("out of bounds");
-    // Negative keys can't take the fast OOB path.
-    GotoIf(IntPtrLessThan(index, IntPtrConstant(0)), slow);
     // Positive OOB indices are effectively the same as hole loads.
-    Goto(&if_element_hole);
+    GotoIf(IntPtrGreaterThanOrEqual(index, IntPtrConstant(0)),
+           &if_element_hole);
+    // Negative keys can't take the fast OOB path, except for typed arrays.
+    GotoIfNot(InstanceTypeEqual(instance_type, JS_TYPED_ARRAY_TYPE), slow);
+    Return(UndefinedConstant());
   }
 
   BIND(&if_element_hole);
@@ -1847,9 +2048,7 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
 
   // Receivers requiring non-standard accesses (interceptors, access
   // checks, strings and string wrappers) are handled in the runtime.
-  GotoIf(Int32LessThanOrEqual(instance_type,
-                              Int32Constant(LAST_SPECIAL_RECEIVER_TYPE)),
-         &special_receiver);
+  GotoIf(IsSpecialReceiverInstanceType(instance_type), &special_receiver);
 
   // Check if the receiver has fast or slow properties.
   Node* bitfield3 = LoadMapBitField3(receiver_map);
@@ -1861,7 +2060,7 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
   Node* descriptors = LoadMapDescriptors(receiver_map);
 
   Label if_descriptor_found(this), stub_cache(this);
-  VARIABLE(var_name_index, MachineType::PointerRepresentation());
+  TVARIABLE(IntPtrT, var_name_index);
   Label* notfound =
       use_stub_cache == kUseStubCache ? &stub_cache : &lookup_prototype_chain;
   DescriptorLookup(p->name, descriptors, bitfield3, &if_descriptor_found,
@@ -1977,6 +2176,9 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
     // TODO(jkummerow): Consider supporting JSModuleNamespace.
     GotoIfNot(InstanceTypeEqual(instance_type, JS_PROXY_TYPE), slow);
 
+    // Private field/symbol lookup is not supported.
+    GotoIf(IsPrivateSymbol(p->name), slow);
+
     direct_exit.ReturnCallStub(
         Builtins::CallableFor(isolate(), Builtins::kProxyGetProperty),
         p->context, receiver /*holder is the same as receiver*/, p->name,
@@ -2004,7 +2206,7 @@ Node* AccessorAssembler::StubCachePrimaryOffset(Node* name, Node* map) {
   // Using only the low bits in 64-bit mode is unlikely to increase the
   // risk of collision even if the heap is spread over an area larger than
   // 4Gb (and not at all if it isn't).
-  Node* map32 = TruncateWordToWord32(BitcastTaggedToWord(map));
+  Node* map32 = TruncateIntPtrToInt32(BitcastTaggedToWord(map));
   // Base the offset on a simple combination of name and map.
   Node* hash = Int32Add(hash_field, map32);
   uint32_t mask = (StubCache::kPrimaryTableSize - 1)
@@ -2016,8 +2218,8 @@ Node* AccessorAssembler::StubCacheSecondaryOffset(Node* name, Node* seed) {
   // See v8::internal::StubCache::SecondaryOffset().
 
   // Use the seed from the primary cache in the secondary cache.
-  Node* name32 = TruncateWordToWord32(BitcastTaggedToWord(name));
-  Node* hash = Int32Sub(TruncateWordToWord32(seed), name32);
+  Node* name32 = TruncateIntPtrToInt32(BitcastTaggedToWord(name));
+  Node* hash = Int32Sub(TruncateIntPtrToInt32(seed), name32);
   hash = Int32Add(hash, Int32Constant(StubCache::kSecondaryMagic));
   int32_t mask = (StubCache::kSecondaryTableSize - 1)
                  << StubCache::kCacheIndexShift;
@@ -2340,9 +2542,9 @@ void AccessorAssembler::LoadGlobalIC_TryPropertyCellCase(
     Comment("Load lexical variable");
     TNode<IntPtrT> lexical_handler = SmiUntag(CAST(maybe_weak_cell));
     TNode<IntPtrT> context_index =
-        Signed(DecodeWord<GlobalICNexus::ContextIndexBits>(lexical_handler));
+        Signed(DecodeWord<FeedbackNexus::ContextIndexBits>(lexical_handler));
     TNode<IntPtrT> slot_index =
-        Signed(DecodeWord<GlobalICNexus::SlotIndexBits>(lexical_handler));
+        Signed(DecodeWord<FeedbackNexus::SlotIndexBits>(lexical_handler));
     TNode<Context> context = lazy_context();
     TNode<Context> script_context = LoadScriptContext(context, context_index);
     TNode<Object> result = LoadContextElement(script_context, slot_index);
@@ -2420,9 +2622,8 @@ void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p) {
     GotoIfNot(WordEqual(feedback, LoadRoot(Heap::kmegamorphic_symbolRootIndex)),
               &try_polymorphic_name);
     // TODO(jkummerow): Inline this? Or some of it?
-    TailCallStub(
-        Builtins::CallableFor(isolate(), Builtins::kKeyedLoadIC_Megamorphic),
-        p->context, p->receiver, p->name, p->slot, p->vector);
+    TailCallBuiltin(Builtins::kKeyedLoadIC_Megamorphic, p->context, p->receiver,
+                    p->name, p->slot, p->vector);
   }
   BIND(&try_polymorphic_name);
   {
@@ -2628,10 +2829,8 @@ void AccessorAssembler::StoreIC(const StoreICParameters* p) {
     GotoIfNot(
         WordEqual(feedback, LoadRoot(Heap::kuninitialized_symbolRootIndex)),
         &miss);
-    Callable stub =
-        Builtins::CallableFor(isolate(), Builtins::kStoreIC_Uninitialized);
-    TailCallStub(stub, p->context, p->receiver, p->name, p->value, p->slot,
-                 p->vector);
+    TailCallBuiltin(Builtins::kStoreIC_Uninitialized, p->context, p->receiver,
+                    p->name, p->value, p->slot, p->vector);
   }
   BIND(&miss);
   {
@@ -2685,9 +2884,9 @@ void AccessorAssembler::StoreGlobalIC(const StoreICParameters* pp) {
     Comment("Store lexical variable");
     TNode<IntPtrT> lexical_handler = SmiUntag(maybe_weak_cell);
     TNode<IntPtrT> context_index =
-        Signed(DecodeWord<GlobalICNexus::ContextIndexBits>(lexical_handler));
+        Signed(DecodeWord<FeedbackNexus::ContextIndexBits>(lexical_handler));
     TNode<IntPtrT> slot_index =
-        Signed(DecodeWord<GlobalICNexus::SlotIndexBits>(lexical_handler));
+        Signed(DecodeWord<FeedbackNexus::SlotIndexBits>(lexical_handler));
     TNode<Context> script_context =
         LoadScriptContext(CAST(pp->context), context_index);
     StoreContextElement(script_context, slot_index, CAST(pp->value));
@@ -2801,9 +3000,8 @@ void AccessorAssembler::KeyedStoreIC(const StoreICParameters* p) {
       GotoIfNot(
           WordEqual(feedback, LoadRoot(Heap::kmegamorphic_symbolRootIndex)),
           &try_polymorphic_name);
-      TailCallStub(
-          Builtins::CallableFor(isolate(), Builtins::kKeyedStoreIC_Megamorphic),
-          p->context, p->receiver, p->name, p->value, p->slot, p->vector);
+      TailCallBuiltin(Builtins::kKeyedStoreIC_Megamorphic, p->context,
+                      p->receiver, p->name, p->value, p->slot, p->vector);
     }
 
     BIND(&try_polymorphic_name);
@@ -2827,6 +3025,86 @@ void AccessorAssembler::KeyedStoreIC(const StoreICParameters* p) {
   }
 }
 
+void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
+  Label miss(this, Label::kDeferred);
+  {
+    VARIABLE(var_handler, MachineRepresentation::kTagged);
+
+    Label if_handler(this, &var_handler),
+        try_polymorphic(this, Label::kDeferred),
+        try_megamorphic(this, Label::kDeferred);
+
+    Node* array_map = LoadReceiverMap(p->receiver);
+    GotoIf(IsDeprecatedMap(array_map), &miss);
+    Node* feedback =
+        TryMonomorphicCase(p->slot, p->vector, array_map, &if_handler,
+                           &var_handler, &try_polymorphic);
+
+    BIND(&if_handler);
+    {
+      Comment("StoreInArrayLiteralIC_if_handler");
+      // This is a stripped-down version of HandleStoreICHandlerCase.
+
+      Node* handler = var_handler.value();
+      Label if_transitioning_element_store(this);
+      GotoIfNot(IsCode(handler), &if_transitioning_element_store);
+      StoreWithVectorDescriptor descriptor(isolate());
+      TailCallStub(descriptor, handler, p->context, p->receiver, p->name,
+                   p->value, p->slot, p->vector);
+
+      BIND(&if_transitioning_element_store);
+      {
+        Node* transition_map_cell = LoadHandlerDataField(handler, 1);
+        Node* transition_map = LoadWeakCellValue(transition_map_cell, &miss);
+        CSA_ASSERT(this, IsMap(transition_map));
+        GotoIf(IsDeprecatedMap(transition_map), &miss);
+        Node* code = LoadObjectField(handler, StoreHandler::kSmiHandlerOffset);
+        CSA_ASSERT(this, IsCode(code));
+        StoreTransitionDescriptor descriptor(isolate());
+        TailCallStub(descriptor, code, p->context, p->receiver, p->name,
+                     transition_map, p->value, p->slot, p->vector);
+      }
+    }
+
+    BIND(&try_polymorphic);
+    {
+      Comment("StoreInArrayLiteralIC_try_polymorphic");
+      GotoIfNot(
+          WordEqual(LoadMap(feedback), LoadRoot(Heap::kFixedArrayMapRootIndex)),
+          &try_megamorphic);
+      HandlePolymorphicCase(array_map, feedback, &if_handler, &var_handler,
+                            &miss, 2);
+    }
+
+    BIND(&try_megamorphic);
+    {
+      Comment("StoreInArrayLiteralIC_try_megamorphic");
+      CSA_ASSERT(
+          this,
+          Word32Or(
+              Word32Or(
+                  IsWeakCellMap(LoadMap(feedback)),
+                  WordEqual(feedback,
+                            LoadRoot(Heap::kuninitialized_symbolRootIndex))),
+              WordEqual(feedback,
+                        LoadRoot(Heap::kmegamorphic_symbolRootIndex))));
+      GotoIfNot(
+          WordEqual(feedback, LoadRoot(Heap::kmegamorphic_symbolRootIndex)),
+          &miss);
+      TailCallRuntime(Runtime::kStoreInArrayLiteralIC_Slow, p->context,
+                      p->value, p->receiver, p->name);
+    }
+  }
+
+  BIND(&miss);
+  {
+    Comment("StoreInArrayLiteralIC_miss");
+    // TODO(neis): Introduce Runtime::kStoreInArrayLiteralIC_Miss.
+    TailCallRuntime(Runtime::kKeyedStoreIC_Miss, p->context, p->value, p->slot,
+                    p->vector, p->receiver, p->name);
+  }
+}
+
 //////////////////// Public methods.
 
 void AccessorAssembler::GenerateLoadIC() {
@@ -3022,9 +3300,7 @@ void AccessorAssembler::GenerateStoreGlobalICTrampoline() {
   Node* context = Parameter(Descriptor::kContext);
   Node* vector = LoadFeedbackVectorForStub();
 
-  Callable callable =
-      Builtins::CallableFor(isolate(), Builtins::kStoreGlobalIC);
-  TailCallStub(callable, context, name, value, slot, vector);
+  TailCallBuiltin(Builtins::kStoreGlobalIC, context, name, value, slot, vector);
 }
 
 void AccessorAssembler::GenerateStoreIC() {
@@ -3051,8 +3327,8 @@ void AccessorAssembler::GenerateStoreICTrampoline() {
   Node* context = Parameter(Descriptor::kContext);
   Node* vector = LoadFeedbackVectorForStub();
 
-  Callable callable = Builtins::CallableFor(isolate(), Builtins::kStoreIC);
-  TailCallStub(callable, context, receiver, name, value, slot, vector);
+  TailCallBuiltin(Builtins::kStoreIC, context, receiver, name, value, slot,
+                  vector);
 }
 
 void AccessorAssembler::GenerateKeyedStoreIC() {
@@ -3079,8 +3355,22 @@ void AccessorAssembler::GenerateKeyedStoreICTrampoline() {
   Node* context = Parameter(Descriptor::kContext);
   Node* vector = LoadFeedbackVectorForStub();
 
-  Callable callable = Builtins::CallableFor(isolate(), Builtins::kKeyedStoreIC);
-  TailCallStub(callable, context, receiver, name, value, slot, vector);
+  TailCallBuiltin(Builtins::kKeyedStoreIC, context, receiver, name, value, slot,
+                  vector);
+}
+
+void AccessorAssembler::GenerateStoreInArrayLiteralIC() {
+  typedef StoreWithVectorDescriptor Descriptor;
+
+  Node* array = Parameter(Descriptor::kReceiver);
+  Node* index = Parameter(Descriptor::kName);
+  Node* value = Parameter(Descriptor::kValue);
+  Node* slot = Parameter(Descriptor::kSlot);
+  Node* vector = Parameter(Descriptor::kVector);
+  Node* context = Parameter(Descriptor::kContext);
+
+  StoreICParameters p(context, array, index, value, slot, vector);
+  StoreInArrayLiteralIC(&p);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/ic/accessor-assembler.h b/deps/v8/src/ic/accessor-assembler.h
index 46376dd6a84..1c358fbb57a 100644
--- a/deps/v8/src/ic/accessor-assembler.h
+++ b/deps/v8/src/ic/accessor-assembler.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_SRC_IC_ACCESSOR_ASSEMBLER_H_
-#define V8_SRC_IC_ACCESSOR_ASSEMBLER_H_
+#ifndef V8_IC_ACCESSOR_ASSEMBLER_H_
+#define V8_IC_ACCESSOR_ASSEMBLER_H_
 
 #include "src/code-stub-assembler.h"
 
@@ -18,7 +18,11 @@ class ExitPoint;
 
 class AccessorAssembler : public CodeStubAssembler {
  public:
-  typedef compiler::Node Node;
+  using Node = compiler::Node;
+  template <class T>
+  using TNode = compiler::TNode<T>;
+  template <class T>
+  using SloppyTNode = compiler::SloppyTNode<T>;
 
   explicit AccessorAssembler(compiler::CodeAssemblerState* state)
       : CodeStubAssembler(state) {}
@@ -43,6 +47,8 @@ class AccessorAssembler : public CodeStubAssembler {
   void GenerateKeyedStoreIC();
   void GenerateKeyedStoreICTrampoline();
 
+  void GenerateStoreInArrayLiteralIC();
+
   void TryProbeStubCache(StubCache* stub_cache, Node* receiver, Node* name,
                          Label* if_handler, Variable* var_handler,
                          Label* if_miss);
@@ -83,7 +89,8 @@ class AccessorAssembler : public CodeStubAssembler {
   void LoadIC_BytecodeHandler(const LoadICParameters* p, ExitPoint* exit_point);
 
   // Loads dataX field from the DataHandler object.
-  Node* LoadHandlerDataField(Node* handler, int data_index);
+  TNode<Object> LoadHandlerDataField(SloppyTNode<DataHandler> handler,
+                                     int data_index);
 
  protected:
   struct StoreICParameters : public LoadICParameters {
@@ -99,12 +106,26 @@ class AccessorAssembler : public CodeStubAssembler {
   void HandleStoreICHandlerCase(
       const StoreICParameters* p, Node* handler, Label* miss, ICMode ic_mode,
       ElementSupport support_elements = kOnlyProperties);
+  void HandleStoreICTransitionMapHandlerCase(const StoreICParameters* p,
+                                             Node* transition_map, Label* miss,
+                                             bool validate_transition_handler);
+
   void JumpIfDataProperty(Node* details, Label* writable, Label* readonly);
 
   void BranchIfStrictMode(Node* vector, Node* slot, Label* if_strict);
 
   void InvalidateValidityCellIfPrototype(Node* map, Node* bitfield2 = nullptr);
 
+  void OverwriteExistingFastDataProperty(Node* object, Node* object_map,
+                                         Node* descriptors,
+                                         Node* descriptor_name_index,
+                                         Node* details, Node* value,
+                                         Label* slow,
+                                         bool do_transitioning_store);
+
+  void CheckFieldType(Node* descriptors, Node* name_index, Node* representation,
+                      Node* value, Label* bailout);
+
  private:
   // Stub generation entry points.
 
@@ -127,6 +148,7 @@ class AccessorAssembler : public CodeStubAssembler {
   void StoreGlobalIC_PropertyCellCase(Node* property_cell, Node* value,
                                       ExitPoint* exit_point, Label* miss);
   void KeyedStoreIC(const StoreICParameters* p);
+  void StoreInArrayLiteralIC(const StoreICParameters* p);
 
   // IC dispatcher behavior.
 
@@ -184,16 +206,13 @@ class AccessorAssembler : public CodeStubAssembler {
   void HandleStoreICProtoHandler(const StoreICParameters* p, Node* handler,
                                  Label* miss, ICMode ic_mode,
                                  ElementSupport support_elements);
-  // If |transition| is nullptr then the normal field store is generated or
-  // transitioning store otherwise.
   void HandleStoreICSmiHandlerCase(Node* handler_word, Node* holder,
-                                   Node* value, Node* transition, Label* miss);
-  // If |transition| is nullptr then the normal field store is generated or
-  // transitioning store otherwise.
+                                   Node* value, Label* miss);
   void HandleStoreFieldAndReturn(Node* handler_word, Node* holder,
                                  Representation representation, Node* value,
-                                 Node* transition, Label* miss);
+                                 Label* miss);
 
+  void CheckPrototypeValidityCell(Node* maybe_validity_cell, Label* miss);
   void HandleStoreICNativeDataProperty(const StoreICParameters* p, Node* holder,
                                        Node* handler_word);
 
@@ -229,15 +248,16 @@ class AccessorAssembler : public CodeStubAssembler {
   Node* GetLanguageMode(Node* vector, Node* slot);
 
   Node* PrepareValueForStore(Node* handler_word, Node* holder,
-                             Representation representation, Node* transition,
-                             Node* value, Label* bailout);
+                             Representation representation, Node* value,
+                             Label* bailout);
 
-  // Extends properties backing store by JSObject::kFieldsAdded elements.
-  void ExtendPropertiesBackingStore(Node* object, Node* handler_word);
+  // Extends properties backing store by JSObject::kFieldsAdded elements,
+  // returns updated properties backing store.
+  Node* ExtendPropertiesBackingStore(Node* object, Node* index);
 
   void StoreNamedField(Node* handler_word, Node* object, bool is_inobject,
                        Representation representation, Node* value,
-                       bool transition_to_field, Label* bailout);
+                       Label* bailout);
 
   void EmitFastElementsBoundsCheck(Node* object, Node* elements,
                                    Node* intptr_index,
@@ -335,4 +355,4 @@ class ExitPoint {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_SRC_IC_ACCESSOR_ASSEMBLER_H_
+#endif  // V8_IC_ACCESSOR_ASSEMBLER_H_
diff --git a/deps/v8/src/ic/binary-op-assembler.h b/deps/v8/src/ic/binary-op-assembler.h
index d7afd7b6557..420f66c174c 100644
--- a/deps/v8/src/ic/binary-op-assembler.h
+++ b/deps/v8/src/ic/binary-op-assembler.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_SRC_IC_BINARY_OP_ASSEMBLER_H_
-#define V8_SRC_IC_BINARY_OP_ASSEMBLER_H_
+#ifndef V8_IC_BINARY_OP_ASSEMBLER_H_
+#define V8_IC_BINARY_OP_ASSEMBLER_H_
 
 #include <functional>
 #include "src/code-stub-assembler.h"
@@ -60,4 +60,4 @@ class BinaryOpAssembler : public CodeStubAssembler {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_SRC_IC_BINARY_OP_ASSEMBLER_H_
+#endif  // V8_IC_BINARY_OP_ASSEMBLER_H_
diff --git a/deps/v8/src/ic/handler-configuration-inl.h b/deps/v8/src/ic/handler-configuration-inl.h
index cf2577a01fe..08054ef4984 100644
--- a/deps/v8/src/ic/handler-configuration-inl.h
+++ b/deps/v8/src/ic/handler-configuration-inl.h
@@ -130,8 +130,7 @@ Handle<Smi> StoreHandler::StoreProxy(Isolate* isolate) {
 
 Handle<Smi> StoreHandler::StoreField(Isolate* isolate, Kind kind,
                                      int descriptor, FieldIndex field_index,
-                                     Representation representation,
-                                     bool extend_storage) {
+                                     Representation representation) {
   FieldRepresentation field_rep;
   switch (representation.kind()) {
     case Representation::kSmi:
@@ -150,13 +149,9 @@ Handle<Smi> StoreHandler::StoreField(Isolate* isolate, Kind kind,
       UNREACHABLE();
   }
 
-  DCHECK(kind == kField || kind == kTransitionToField ||
-         (kind == kConstField && FLAG_track_constant_fields));
-  DCHECK_IMPLIES(extend_storage, kind == kTransitionToField);
-  DCHECK_IMPLIES(field_index.is_inobject(), !extend_storage);
+  DCHECK(kind == kField || (kind == kConstField && FLAG_track_constant_fields));
 
   int config = KindBits::encode(kind) |
-               ExtendStorageBits::encode(extend_storage) |
                IsInobjectBits::encode(field_index.is_inobject()) |
                FieldRepresentationBits::encode(field_rep) |
                DescriptorBits::encode(descriptor) |
@@ -170,24 +165,7 @@ Handle<Smi> StoreHandler::StoreField(Isolate* isolate, int descriptor,
                                      Representation representation) {
   DCHECK_IMPLIES(!FLAG_track_constant_fields, constness == kMutable);
   Kind kind = constness == kMutable ? kField : kConstField;
-  return StoreField(isolate, kind, descriptor, field_index, representation,
-                    false);
-}
-
-Handle<Smi> StoreHandler::TransitionToField(Isolate* isolate, int descriptor,
-                                            FieldIndex field_index,
-                                            Representation representation,
-                                            bool extend_storage) {
-  return StoreField(isolate, kTransitionToField, descriptor, field_index,
-                    representation, extend_storage);
-}
-
-Handle<Smi> StoreHandler::TransitionToConstant(Isolate* isolate,
-                                               int descriptor) {
-  DCHECK(!FLAG_track_constant_fields);
-  int config = KindBits::encode(kTransitionToConstant) |
-               DescriptorBits::encode(descriptor);
-  return handle(Smi::FromInt(config), isolate);
+  return StoreField(isolate, kind, descriptor, field_index, representation);
 }
 
 Handle<Smi> StoreHandler::StoreNativeDataProperty(Isolate* isolate,
diff --git a/deps/v8/src/ic/handler-configuration.cc b/deps/v8/src/ic/handler-configuration.cc
index 19614a4322c..04dcc82783f 100644
--- a/deps/v8/src/ic/handler-configuration.cc
+++ b/deps/v8/src/ic/handler-configuration.cc
@@ -124,11 +124,7 @@ Handle<Object> LoadHandler::LoadFromPrototype(Isolate* isolate,
   Handle<Object> validity_cell =
       Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate);
   if (validity_cell.is_null()) {
-    // Although in case of kApiGetter we load from receiver we still have to
-    // use the "prototype" shape of a handler in order to provide additional
-    // data to the dispatcher.
-    DCHECK_EQ(kApiGetter, GetHandlerKind(*smi_handler));
-    validity_cell = handle(Smi::kZero, isolate);
+    validity_cell = handle(Smi::FromInt(Map::kPrototypeChainValid), isolate);
   }
 
   int data_count = 1 + checks_count;
@@ -157,7 +153,7 @@ Handle<Object> LoadHandler::LoadFullChain(Isolate* isolate,
     DCHECK_EQ(0, checks_count);
     // Lookup on receiver isn't supported in case of a simple smi handler.
     if (!LookupOnReceiverBits::decode(smi_handler->value())) return smi_handler;
-    validity_cell = handle(Smi::kZero, isolate);
+    validity_cell = handle(Smi::FromInt(Map::kPrototypeChainValid), isolate);
   }
 
   int data_count = 1 + checks_count;
@@ -196,7 +192,7 @@ Handle<Object> StoreHandler::StoreElementTransition(
   Handle<Object> validity_cell =
       Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate);
   if (validity_cell.is_null()) {
-    validity_cell = handle(Smi::kZero, isolate);
+    validity_cell = handle(Smi::FromInt(Map::kPrototypeChainValid), isolate);
   }
   Handle<WeakCell> cell = Map::WeakCellForMap(transition);
   Handle<StoreHandler> handler = isolate->factory()->NewStoreHandler(1);
@@ -206,28 +202,53 @@ Handle<Object> StoreHandler::StoreElementTransition(
   return handler;
 }
 
-Handle<Smi> StoreHandler::StoreTransition(Isolate* isolate,
-                                          Handle<Map> transition_map) {
-  int descriptor = transition_map->LastAdded();
-  Handle<DescriptorArray> descriptors(transition_map->instance_descriptors());
-  PropertyDetails details = descriptors->GetDetails(descriptor);
-  Representation representation = details.representation();
-  DCHECK(!representation.IsNone());
-
+Handle<Object> StoreHandler::StoreTransition(Isolate* isolate,
+                                             Handle<Map> transition_map) {
+  bool is_dictionary_map = transition_map->is_dictionary_map();
+#ifdef DEBUG
+  if (!is_dictionary_map) {
+    int descriptor = transition_map->LastAdded();
+    Handle<DescriptorArray> descriptors(transition_map->instance_descriptors());
+    PropertyDetails details = descriptors->GetDetails(descriptor);
+    if (descriptors->GetKey(descriptor)->IsPrivate()) {
+      DCHECK_EQ(DONT_ENUM, details.attributes());
+    } else {
+      DCHECK_EQ(NONE, details.attributes());
+    }
+    Representation representation = details.representation();
+    DCHECK(!representation.IsNone());
+  }
+#endif
   // Declarative handlers don't support access checks.
   DCHECK(!transition_map->is_access_check_needed());
 
-  DCHECK_EQ(kData, details.kind());
-  if (details.location() == PropertyLocation::kDescriptor) {
-    return TransitionToConstant(isolate, descriptor);
+  // Get validity cell value if it is necessary for the handler.
+  Handle<Object> validity_cell;
+  if (is_dictionary_map || !transition_map->IsPrototypeValidityCellValid()) {
+    validity_cell =
+        Map::GetOrCreatePrototypeChainValidityCell(transition_map, isolate);
+    if (validity_cell.is_null()) {
+      validity_cell = handle(Smi::FromInt(Map::kPrototypeChainValid), isolate);
+    }
   }
-  DCHECK_EQ(PropertyLocation::kField, details.location());
-  bool extend_storage =
-      Map::cast(transition_map->GetBackPointer())->UnusedPropertyFields() == 0;
 
-  FieldIndex index = FieldIndex::ForDescriptor(*transition_map, descriptor);
-  return TransitionToField(isolate, descriptor, index, representation,
-                           extend_storage);
+  if (is_dictionary_map) {
+    DCHECK(!transition_map->IsJSGlobalObjectMap());
+    Handle<StoreHandler> handler = isolate->factory()->NewStoreHandler(0);
+    // Store normal with enabled lookup on receiver.
+    int config = KindBits::encode(kNormal) | LookupOnReceiverBits::encode(true);
+    handler->set_smi_handler(Smi::FromInt(config));
+    handler->set_validity_cell(*validity_cell);
+    return handler;
+
+  } else {
+    // Ensure the transition map contains a valid prototype validity cell.
+    if (!validity_cell.is_null()) {
+      transition_map->set_prototype_validity_cell(*validity_cell);
+    }
+    Handle<WeakCell> cell = Map::WeakCellForMap(transition_map);
+    return cell;
+  }
 }
 
 // static
@@ -247,7 +268,7 @@ Handle<Object> StoreHandler::StoreThroughPrototype(
       Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate);
   if (validity_cell.is_null()) {
     DCHECK_EQ(0, checks_count);
-    validity_cell = handle(Smi::kZero, isolate);
+    validity_cell = handle(Smi::FromInt(Map::kPrototypeChainValid), isolate);
   }
 
   int data_count = 1 + checks_count;
diff --git a/deps/v8/src/ic/handler-configuration.h b/deps/v8/src/ic/handler-configuration.h
index 514a5ed5fa6..67f7a1d08e0 100644
--- a/deps/v8/src/ic/handler-configuration.h
+++ b/deps/v8/src/ic/handler-configuration.h
@@ -192,9 +192,6 @@ class StoreHandler final : public DataHandler {
     kElement,
     kField,
     kConstField,
-    // TODO(ishell): remove once constant field tracking is done.
-    kTransitionToConstant = kConstField,
-    kTransitionToField,
     kAccessor,
     kNativeDataProperty,
     kApiSetter,
@@ -236,8 +233,7 @@ class StoreHandler final : public DataHandler {
   //
   // Encoding when KindBits contains kField or kTransitionToField.
   //
-  class ExtendStorageBits : public BitField<bool, DescriptorBits::kNext, 1> {};
-  class IsInobjectBits : public BitField<bool, ExtendStorageBits::kNext, 1> {};
+  class IsInobjectBits : public BitField<bool, DescriptorBits::kNext, 1> {};
   class FieldRepresentationBits
       : public BitField<FieldRepresentation, IsInobjectBits::kNext, 2> {};
   // +1 here is to cover all possible JSObject header sizes.
@@ -257,8 +253,8 @@ class StoreHandler final : public DataHandler {
                                        PropertyConstness constness,
                                        Representation representation);
 
-  static Handle<Smi> StoreTransition(Isolate* isolate,
-                                     Handle<Map> transition_map);
+  static Handle<Object> StoreTransition(Isolate* isolate,
+                                        Handle<Map> transition_map);
 
   // Creates a Smi-handler for storing a native data property on a fast object.
   static inline Handle<Smi> StoreNativeDataProperty(Isolate* isolate,
@@ -303,19 +299,7 @@ class StoreHandler final : public DataHandler {
  private:
   static inline Handle<Smi> StoreField(Isolate* isolate, Kind kind,
                                        int descriptor, FieldIndex field_index,
-                                       Representation representation,
-                                       bool extend_storage);
-
-  // Creates a Smi-handler for transitioning store to a field.
-  static inline Handle<Smi> TransitionToField(Isolate* isolate, int descriptor,
-                                              FieldIndex field_index,
-                                              Representation representation,
-                                              bool extend_storage);
-
-  // Creates a Smi-handler for transitioning store to a constant field (in this
-  // case the only thing that needs to be done is an update of a map).
-  static inline Handle<Smi> TransitionToConstant(Isolate* isolate,
-                                                 int descriptor);
+                                       Representation representation);
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/ic/ic-inl.h b/deps/v8/src/ic/ic-inl.h
index d6fa23611e7..83ab9d86b85 100644
--- a/deps/v8/src/ic/ic-inl.h
+++ b/deps/v8/src/ic/ic-inl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_IC_INL_H_
-#define V8_IC_INL_H_
+#ifndef V8_IC_IC_INL_H_
+#define V8_IC_IC_INL_H_
 
 #include "src/ic/ic.h"
 
@@ -59,4 +59,4 @@ bool IC::AddressIsDeoptimizedCode(Isolate* isolate, Address address) {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_IC_INL_H_
+#endif  // V8_IC_IC_INL_H_
diff --git a/deps/v8/src/ic/ic.cc b/deps/v8/src/ic/ic.cc
index 62a2e7cf597..ddd42d78ac1 100644
--- a/deps/v8/src/ic/ic.cc
+++ b/deps/v8/src/ic/ic.cc
@@ -58,18 +58,22 @@ const char* GetModifier(KeyedAccessLoadMode mode) {
 }
 
 const char* GetModifier(KeyedAccessStoreMode mode) {
-  if (mode == STORE_NO_TRANSITION_HANDLE_COW) return ".COW";
-  if (mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
-    return ".IGNORE_OOB";
+  switch (mode) {
+    case STORE_NO_TRANSITION_HANDLE_COW:
+      return ".COW";
+    case STORE_AND_GROW_NO_TRANSITION_HANDLE_COW:
+      return ".STORE+COW";
+    case STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS:
+      return ".IGNORE_OOB";
+    default:
+      break;
   }
-  if (IsGrowStoreMode(mode)) return ".GROW";
-  return "";
+  DCHECK(!IsCOWHandlingStoreMode(mode));
+  return IsGrowStoreMode(mode) ? ".GROW" : "";
 }
 
 }  // namespace
 
-#define TRACE_GENERIC_IC(reason) set_slow_stub_reason(reason);
-
 void IC::TraceIC(const char* type, Handle<Object> name) {
   if (FLAG_ic_stats) {
     if (AddressIsDeoptimizedCode()) return;
@@ -89,18 +93,18 @@ void IC::TraceIC(const char* type, Handle<Object> name, State old_state,
 
   const char* modifier = "";
   if (IsKeyedLoadIC()) {
-    KeyedAccessLoadMode mode =
-        casted_nexus<KeyedLoadICNexus>()->GetKeyedAccessLoadMode();
+    KeyedAccessLoadMode mode = nexus()->GetKeyedAccessLoadMode();
     modifier = GetModifier(mode);
-  } else if (IsKeyedStoreIC()) {
-    KeyedAccessStoreMode mode =
-        casted_nexus<KeyedStoreICNexus>()->GetKeyedAccessStoreMode();
+  } else if (IsKeyedStoreIC() || IsStoreInArrayLiteralICKind(kind())) {
+    KeyedAccessStoreMode mode = nexus()->GetKeyedAccessStoreMode();
     modifier = GetModifier(mode);
   }
 
+  bool keyed_prefix = is_keyed() && !IsStoreInArrayLiteralICKind(kind());
+
   if (!(FLAG_ic_stats &
         v8::tracing::TracingCategoryObserver::ENABLED_BY_TRACING)) {
-    LOG(isolate(), ICEvent(type, is_keyed(), map, *name,
+    LOG(isolate(), ICEvent(type, keyed_prefix, map, *name,
                            TransitionMarkFromState(old_state),
                            TransitionMarkFromState(new_state), modifier,
                            slow_stub_reason_));
@@ -109,7 +113,7 @@ void IC::TraceIC(const char* type, Handle<Object> name, State old_state,
 
   ICStats::instance()->Begin();
   ICInfo& ic_info = ICStats::instance()->Current();
-  ic_info.type = is_keyed() ? "Keyed" : "";
+  ic_info.type = keyed_prefix ? "Keyed" : "";
   ic_info.type += type;
 
   Object* maybe_function =
@@ -145,15 +149,14 @@ void IC::TraceIC(const char* type, Handle<Object> name, State old_state,
 }
 
 
-#define TRACE_IC(type, name) TraceIC(type, name)
-
-IC::IC(FrameDepth depth, Isolate* isolate, FeedbackNexus* nexus)
+IC::IC(FrameDepth depth, Isolate* isolate, Handle<FeedbackVector> vector,
+       FeedbackSlot slot)
     : isolate_(isolate),
       vector_set_(false),
       kind_(FeedbackSlotKind::kInvalid),
       target_maps_set_(false),
       slow_stub_reason_(nullptr),
-      nexus_(nexus) {
+      nexus_(vector, slot) {
   // To improve the performance of the (much used) IC code, we unfold a few
   // levels of the stack frame iteration code. This yields a ~35% speedup when
   // running DeltaBlue and a ~25% speedup of gbemu with the '--nouse-ic' flag.
@@ -199,9 +202,8 @@ IC::IC(FrameDepth depth, Isolate* isolate, FeedbackNexus* nexus)
     constant_pool_address_ = constant_pool;
   }
   pc_address_ = StackFrame::ResolveReturnAddressLocation(pc_address);
-  DCHECK_NOT_NULL(nexus);
-  kind_ = nexus->kind();
-  state_ = nexus->StateFromFeedback();
+  kind_ = nexus_.kind();
+  state_ = nexus_.StateFromFeedback();
   old_state_ = state_;
 }
 
@@ -251,12 +253,12 @@ static void LookupForRead(LookupIterator* it) {
 bool IC::ShouldRecomputeHandler(Handle<String> name) {
   if (!RecomputeHandlerForName(name)) return false;
 
-  maybe_handler_ = nexus()->FindHandlerForMap(receiver_map());
-
   // This is a contextual access, always just update the handler and stay
   // monomorphic.
   if (IsGlobalIC()) return true;
 
+  maybe_handler_ = nexus()->FindHandlerForMap(receiver_map());
+
   // The current map wasn't handled yet. There's no reason to stay monomorphic,
   // *unless* we're moving from a deprecated map to its replacement, or
   // to a more general elements kind.
@@ -315,6 +317,13 @@ MaybeHandle<Object> IC::ReferenceError(Handle<Name> name) {
       isolate(), NewReferenceError(MessageTemplate::kNotDefined, name), Object);
 }
 
+// static
+void IC::OnFeedbackChanged(Isolate* isolate, FeedbackNexus* nexus,
+                           JSFunction* host_function, const char* reason) {
+  FeedbackVector* vector = nexus->vector();
+  FeedbackSlot slot = nexus->slot();
+  OnFeedbackChanged(isolate, vector, slot, host_function, reason);
+}
 
 // static
 void IC::OnFeedbackChanged(Isolate* isolate, FeedbackVector* vector,
@@ -385,21 +394,15 @@ bool IC::ConfigureVectorState(IC::State new_state, Handle<Object> key) {
 
   vector_set_ = true;
   OnFeedbackChanged(
-      isolate(), *vector(), slot(), GetHostFunction(),
+      isolate(), nexus(), GetHostFunction(),
       new_state == PREMONOMORPHIC ? "Premonomorphic" : "Megamorphic");
   return changed;
 }
 
 void IC::ConfigureVectorState(Handle<Name> name, Handle<Map> map,
                               Handle<Object> handler) {
-  if (IsLoadGlobalIC()) {
-    LoadGlobalICNexus* nexus = casted_nexus<LoadGlobalICNexus>();
-    nexus->ConfigureHandlerMode(handler);
-
-  } else if (IsStoreGlobalIC()) {
-    StoreGlobalICNexus* nexus = casted_nexus<StoreGlobalICNexus>();
-    nexus->ConfigureHandlerMode(handler);
-
+  if (IsGlobalIC()) {
+    nexus()->ConfigureHandlerMode(handler);
   } else {
     // Non-keyed ICs don't track the name explicitly.
     if (!is_keyed()) name = Handle<Name>::null();
@@ -407,7 +410,7 @@ void IC::ConfigureVectorState(Handle<Name> name, Handle<Map> map,
   }
 
   vector_set_ = true;
-  OnFeedbackChanged(isolate(), *vector(), slot(), GetHostFunction(),
+  OnFeedbackChanged(isolate(), nexus(), GetHostFunction(),
                     IsLoadGlobalIC() ? "LoadGlobal" : "Monomorphic");
 }
 
@@ -419,8 +422,7 @@ void IC::ConfigureVectorState(Handle<Name> name, MapHandles const& maps,
   nexus()->ConfigurePolymorphic(name, maps, handlers);
 
   vector_set_ = true;
-  OnFeedbackChanged(isolate(), *vector(), slot(), GetHostFunction(),
-                    "Polymorphic");
+  OnFeedbackChanged(isolate(), nexus(), GetHostFunction(), "Polymorphic");
 }
 
 MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name) {
@@ -432,7 +434,7 @@ MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name) {
       TRACE_HANDLER_STATS(isolate(), LoadIC_NonReceiver);
       update_receiver_map(object);
       PatchCache(name, slow_stub());
-      TRACE_IC("LoadIC", name);
+      TraceIC("LoadIC", name);
     }
 
     if (*name == isolate()->heap()->iterator_symbol()) {
@@ -451,6 +453,19 @@ MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name) {
   LookupIterator it(object, name);
   LookupForRead(&it);
 
+  if (name->IsPrivate()) {
+    if (name->IsPrivateField() && !it.IsFound()) {
+      return TypeError(MessageTemplate::kInvalidPrivateFieldAccess, object,
+                       name);
+    }
+
+    // IC handling of private symbols/fields lookup on JSProxy is not
+    // supported.
+    if (object->IsJSProxy()) {
+      use_ic = false;
+    }
+  }
+
   if (it.IsFound() || !ShouldThrowReferenceError()) {
     // Update inline cache and stub cache.
     if (use_ic) UpdateCaches(&it);
@@ -492,16 +507,15 @@ MaybeHandle<Object> LoadGlobalIC::Load(Handle<Name> name) {
       }
 
       if (FLAG_use_ic) {
-        LoadGlobalICNexus* nexus = casted_nexus<LoadGlobalICNexus>();
-        if (nexus->ConfigureLexicalVarMode(lookup_result.context_index,
-                                           lookup_result.slot_index)) {
+        if (nexus()->ConfigureLexicalVarMode(lookup_result.context_index,
+                                             lookup_result.slot_index)) {
           TRACE_HANDLER_STATS(isolate(), LoadGlobalIC_LoadScriptContextField);
         } else {
           // Given combination of indices can't be encoded, so use slow stub.
           TRACE_HANDLER_STATS(isolate(), LoadGlobalIC_SlowStub);
           PatchCache(name, slow_stub());
         }
-        TRACE_IC("LoadGlobalIC", name);
+        TraceIC("LoadGlobalIC", name);
       }
       return result;
     }
@@ -638,14 +652,14 @@ void IC::PatchCache(Handle<Name> name, Handle<Object> handler) {
         UpdateMonomorphicIC(handler, name);
         break;
       }
-    // Fall through.
+      V8_FALLTHROUGH;
     case POLYMORPHIC:
       if (UpdatePolymorphicIC(name, handler)) break;
       if (!is_keyed() || state() == RECOMPUTE_HANDLER) {
         CopyICToMegamorphicCache(name);
       }
       ConfigureVectorState(MEGAMORPHIC, name);
-    // Fall through.
+      V8_FALLTHROUGH;
     case MEGAMORPHIC:
       UpdateMegamorphicCache(*receiver_map(), *name, *handler);
       // Indicate that we've handled this case.
@@ -663,7 +677,7 @@ void LoadIC::UpdateCaches(LookupIterator* lookup) {
     // the pre monomorphic stub to delay setting the monomorphic state.
     TRACE_HANDLER_STATS(isolate(), LoadIC_Premonomorphic);
     ConfigureVectorState(PREMONOMORPHIC, Handle<Object>());
-    TRACE_IC("LoadIC", lookup->name());
+    TraceIC("LoadIC", lookup->name());
     return;
   }
 
@@ -685,9 +699,8 @@ void LoadIC::UpdateCaches(LookupIterator* lookup) {
           lookup->GetReceiver().is_identical_to(lookup->GetHolder<Object>())) {
         DCHECK(lookup->GetReceiver()->IsJSGlobalObject());
         // Now update the cell in the feedback vector.
-        LoadGlobalICNexus* nexus = casted_nexus<LoadGlobalICNexus>();
-        nexus->ConfigurePropertyCellMode(lookup->GetPropertyCell());
-        TRACE_IC("LoadGlobalIC", lookup->name());
+        nexus()->ConfigurePropertyCellMode(lookup->GetPropertyCell());
+        TraceIC("LoadGlobalIC", lookup->name());
         return;
       }
     }
@@ -695,7 +708,7 @@ void LoadIC::UpdateCaches(LookupIterator* lookup) {
   }
 
   PatchCache(lookup->name(), code);
-  TRACE_IC("LoadIC", lookup->name());
+  TraceIC("LoadIC", lookup->name());
 }
 
 StubCache* IC::stub_cache() {
@@ -807,15 +820,16 @@ Handle<Object> LoadIC::ComputeHandler(LookupIterator* lookup) {
           return ComputeHandler(lookup);
         }
 
-        // When debugging we need to go the slow path to flood the accessor.
-        if (GetHostFunction()->shared()->HasBreakInfo()) {
+        Handle<Object> getter(AccessorPair::cast(*accessors)->getter(),
+                              isolate());
+        if (!getter->IsJSFunction() && !getter->IsFunctionTemplateInfo()) {
           TRACE_HANDLER_STATS(isolate(), LoadIC_SlowStub);
           return slow_stub();
         }
 
-        Handle<Object> getter(AccessorPair::cast(*accessors)->getter(),
-                              isolate());
-        if (!getter->IsJSFunction() && !getter->IsFunctionTemplateInfo()) {
+        if (getter->IsFunctionTemplateInfo() &&
+            FunctionTemplateInfo::cast(*getter)->BreakAtEntry()) {
+          // Do not install an IC if the api function has a breakpoint.
           TRACE_HANDLER_STATS(isolate(), LoadIC_SlowStub);
           return slow_stub();
         }
@@ -993,11 +1007,11 @@ void KeyedLoadIC::UpdateLoadElement(Handle<HeapObject> receiver,
   for (Handle<Map> map : target_receiver_maps) {
     if (map.is_null()) continue;
     if (map->instance_type() == JS_VALUE_TYPE) {
-      TRACE_GENERIC_IC("JSValue");
+      set_slow_stub_reason("JSValue");
       return;
     }
     if (map->instance_type() == JS_PROXY_TYPE) {
-      TRACE_GENERIC_IC("JSProxy");
+      set_slow_stub_reason("JSProxy");
       return;
     }
   }
@@ -1030,7 +1044,7 @@ void KeyedLoadIC::UpdateLoadElement(Handle<HeapObject> receiver,
         !CanChangeToAllowOutOfBounds(receiver_map)) {
       // If the miss wasn't due to an unseen map, a polymorphic stub
       // won't help, use the generic stub.
-      TRACE_GENERIC_IC("same map added twice");
+      set_slow_stub_reason("same map added twice");
       return;
     }
   }
@@ -1038,7 +1052,7 @@ void KeyedLoadIC::UpdateLoadElement(Handle<HeapObject> receiver,
   // If the maximum number of receiver maps has been exceeded, use the generic
   // version of the IC.
   if (target_receiver_maps.size() > kMaxKeyedPolymorphism) {
-    TRACE_GENERIC_IC("max polymorph exceeded");
+    set_slow_stub_reason("max polymorph exceeded");
     return;
   }
 
@@ -1199,19 +1213,25 @@ MaybeHandle<Object> KeyedLoadIC::Load(Handle<Object> object,
                                Object);
   } else if (FLAG_use_ic && !object->IsAccessCheckNeeded() &&
              !object->IsJSValue()) {
-    if ((object->IsJSReceiver() || object->IsString()) &&
-        key->ToArrayIndex(&index)) {
+    // For regular JSReceiver or String {object}s the {key} must be a positive
+    // array index, for JSTypedArray {object}s we can also support negative
+    // {key}s which we just map into the [2*31,2*32-1] range (via a bit_cast).
+    // This is valid since JSTypedArray::length is always a Smi.
+    if (((object->IsJSReceiver() || object->IsString()) &&
+         key->ToArrayIndex(&index)) ||
+        (object->IsJSTypedArray() &&
+         key->ToInt32(bit_cast<int32_t*>(&index)))) {
       KeyedAccessLoadMode load_mode = GetLoadMode(object, index);
       UpdateLoadElement(Handle<HeapObject>::cast(object), load_mode);
       if (is_vector_set()) {
-        TRACE_IC("LoadIC", key);
+        TraceIC("LoadIC", key);
       }
     }
   }
 
   if (vector_needs_update()) {
     ConfigureVectorState(MEGAMORPHIC, key);
-    TRACE_IC("LoadIC", key);
+    TraceIC("LoadIC", key);
   }
 
   if (!load_handle.is_null()) return load_handle;
@@ -1233,61 +1253,63 @@ bool StoreIC::LookupForWrite(LookupIterator* it, Handle<Object> value,
   Handle<JSObject> receiver = Handle<JSObject>::cast(object);
   DCHECK(!receiver->map()->is_deprecated());
 
-  for (; it->IsFound(); it->Next()) {
-    switch (it->state()) {
-      case LookupIterator::NOT_FOUND:
-      case LookupIterator::TRANSITION:
-        UNREACHABLE();
-      case LookupIterator::JSPROXY:
-        return true;
-      case LookupIterator::INTERCEPTOR: {
-        Handle<JSObject> holder = it->GetHolder<JSObject>();
-        InterceptorInfo* info = holder->GetNamedInterceptor();
-        if (it->HolderIsReceiverOrHiddenPrototype()) {
-          return !info->non_masking() && receiver.is_identical_to(holder) &&
-                 !info->setter()->IsUndefined(it->isolate());
-        } else if (!info->getter()->IsUndefined(it->isolate()) ||
-                   !info->query()->IsUndefined(it->isolate())) {
-          return false;
-        }
-        break;
-      }
-      case LookupIterator::ACCESS_CHECK:
-        if (it->GetHolder<JSObject>()->IsAccessCheckNeeded()) return false;
-        break;
-      case LookupIterator::ACCESSOR:
-        return !it->IsReadOnly();
-      case LookupIterator::INTEGER_INDEXED_EXOTIC:
-        return false;
-      case LookupIterator::DATA: {
-        if (it->IsReadOnly()) return false;
-        Handle<JSObject> holder = it->GetHolder<JSObject>();
-        if (receiver.is_identical_to(holder)) {
-          it->PrepareForDataProperty(value);
-          // The previous receiver map might just have been deprecated,
-          // so reload it.
-          update_receiver_map(receiver);
+  if (it->state() != LookupIterator::TRANSITION) {
+    for (; it->IsFound(); it->Next()) {
+      switch (it->state()) {
+        case LookupIterator::NOT_FOUND:
+        case LookupIterator::TRANSITION:
+          UNREACHABLE();
+        case LookupIterator::JSPROXY:
           return true;
+        case LookupIterator::INTERCEPTOR: {
+          Handle<JSObject> holder = it->GetHolder<JSObject>();
+          InterceptorInfo* info = holder->GetNamedInterceptor();
+          if (it->HolderIsReceiverOrHiddenPrototype()) {
+            return !info->non_masking() && receiver.is_identical_to(holder) &&
+                   !info->setter()->IsUndefined(it->isolate());
+          } else if (!info->getter()->IsUndefined(it->isolate()) ||
+                     !info->query()->IsUndefined(it->isolate())) {
+            return false;
+          }
+          break;
         }
+        case LookupIterator::ACCESS_CHECK:
+          if (it->GetHolder<JSObject>()->IsAccessCheckNeeded()) return false;
+          break;
+        case LookupIterator::ACCESSOR:
+          return !it->IsReadOnly();
+        case LookupIterator::INTEGER_INDEXED_EXOTIC:
+          return false;
+        case LookupIterator::DATA: {
+          if (it->IsReadOnly()) return false;
+          Handle<JSObject> holder = it->GetHolder<JSObject>();
+          if (receiver.is_identical_to(holder)) {
+            it->PrepareForDataProperty(value);
+            // The previous receiver map might just have been deprecated,
+            // so reload it.
+            update_receiver_map(receiver);
+            return true;
+          }
 
-        // Receiver != holder.
-        if (receiver->IsJSGlobalProxy()) {
-          PrototypeIterator iter(it->isolate(), receiver);
-          return it->GetHolder<Object>().is_identical_to(
-              PrototypeIterator::GetCurrent(iter));
-        }
+          // Receiver != holder.
+          if (receiver->IsJSGlobalProxy()) {
+            PrototypeIterator iter(it->isolate(), receiver);
+            return it->GetHolder<Object>().is_identical_to(
+                PrototypeIterator::GetCurrent(iter));
+          }
 
-        if (it->HolderIsReceiverOrHiddenPrototype()) return false;
+          if (it->HolderIsReceiverOrHiddenPrototype()) return false;
 
-        if (it->ExtendingNonExtensible(receiver)) return false;
-        created_new_transition_ = it->PrepareTransitionToDataProperty(
-            receiver, value, NONE, store_mode);
-        return it->IsCacheableTransition();
+          if (it->ExtendingNonExtensible(receiver)) return false;
+          created_new_transition_ = it->PrepareTransitionToDataProperty(
+              receiver, value, NONE, store_mode);
+          return it->IsCacheableTransition();
+        }
       }
     }
   }
 
-  receiver = it->GetStoreTarget();
+  receiver = it->GetStoreTarget<JSObject>();
   if (it->ExtendingNonExtensible(receiver)) return false;
   created_new_transition_ =
       it->PrepareTransitionToDataProperty(receiver, value, NONE, store_mode);
@@ -1322,16 +1344,15 @@ MaybeHandle<Object> StoreGlobalIC::Store(Handle<Name> name,
     }
 
     if (FLAG_use_ic) {
-      StoreGlobalICNexus* nexus = casted_nexus<StoreGlobalICNexus>();
-      if (nexus->ConfigureLexicalVarMode(lookup_result.context_index,
-                                         lookup_result.slot_index)) {
+      if (nexus()->ConfigureLexicalVarMode(lookup_result.context_index,
+                                           lookup_result.slot_index)) {
         TRACE_HANDLER_STATS(isolate(), StoreGlobalIC_StoreScriptContextField);
       } else {
         // Given combination of indices can't be encoded, so use slow stub.
         TRACE_HANDLER_STATS(isolate(), StoreGlobalIC_SlowStub);
         PatchCache(name, slow_stub());
       }
-      TRACE_IC("StoreGlobalIC", name);
+      TraceIC("StoreGlobalIC", name);
     }
 
     script_context->set(lookup_result.slot_index, *value);
@@ -1362,7 +1383,7 @@ MaybeHandle<Object> StoreIC::Store(Handle<Object> object, Handle<Name> name,
       TRACE_HANDLER_STATS(isolate(), StoreIC_NonReceiver);
       update_receiver_map(object);
       PatchCache(name, slow_stub());
-      TRACE_IC("StoreIC", name);
+      TraceIC("StoreIC", name);
     }
     return TypeError(MessageTemplate::kNonObjectPropertyStore, object, name);
   }
@@ -1370,20 +1391,31 @@ MaybeHandle<Object> StoreIC::Store(Handle<Object> object, Handle<Name> name,
   if (state() != UNINITIALIZED) {
     JSObject::MakePrototypesFast(object, kStartAtPrototype, isolate());
   }
-  MaybeHandle<Object> cached_handler;
-  Handle<Map> transition_map;
+  MaybeHandle<Map> maybe_transition_map;
   if (object->IsJSReceiver()) {
     name = isolate()->factory()->InternalizeName(name);
-    TransitionsAccessor transitions(receiver_map());
-    Object* maybe_handler = transitions.SearchHandler(*name, &transition_map);
-    if (maybe_handler != nullptr) {
-      cached_handler = MaybeHandle<Object>(maybe_handler, isolate());
-    }
+    maybe_transition_map =
+        TransitionsAccessor(receiver_map()).FindTransitionToDataProperty(name);
   }
 
   LookupIterator it = LookupIterator::ForTransitionHandler(
-      isolate(), object, name, value, cached_handler, transition_map);
-  if (FLAG_use_ic) UpdateCaches(&it, value, store_mode, cached_handler);
+      isolate(), object, name, value, maybe_transition_map);
+
+  bool use_ic = FLAG_use_ic;
+
+  if (name->IsPrivate()) {
+    if (name->IsPrivateField() && !it.IsFound()) {
+      return TypeError(MessageTemplate::kInvalidPrivateFieldAccess, object,
+                       name);
+    }
+
+    // IC handling of private fields/symbols stores on JSProxy is not
+    // supported.
+    if (object->IsJSProxy()) {
+      use_ic = false;
+    }
+  }
+  if (use_ic) UpdateCaches(&it, value, store_mode);
 
   MAYBE_RETURN_NULL(
       Object::SetProperty(&it, value, language_mode(), store_mode));
@@ -1391,62 +1423,59 @@ MaybeHandle<Object> StoreIC::Store(Handle<Object> object, Handle<Name> name,
 }
 
 void StoreIC::UpdateCaches(LookupIterator* lookup, Handle<Object> value,
-                           JSReceiver::StoreFromKeyed store_mode,
-                           MaybeHandle<Object> cached_handler) {
+                           JSReceiver::StoreFromKeyed store_mode) {
   if (state() == UNINITIALIZED && !IsStoreGlobalIC()) {
     // This is the first time we execute this inline cache. Set the target to
     // the pre monomorphic stub to delay setting the monomorphic state.
     TRACE_HANDLER_STATS(isolate(), StoreIC_Premonomorphic);
     ConfigureVectorState(PREMONOMORPHIC, Handle<Object>());
-    TRACE_IC("StoreIC", lookup->name());
+    TraceIC("StoreIC", lookup->name());
     return;
   }
 
   Handle<Object> handler;
-  if (!cached_handler.is_null()) {
-    handler = cached_handler.ToHandleChecked();
-  } else if (LookupForWrite(lookup, value, store_mode)) {
+  if (LookupForWrite(lookup, value, store_mode)) {
     if (IsStoreGlobalIC()) {
       if (lookup->state() == LookupIterator::DATA &&
           lookup->GetReceiver().is_identical_to(lookup->GetHolder<Object>())) {
         DCHECK(lookup->GetReceiver()->IsJSGlobalObject());
         // Now update the cell in the feedback vector.
-        StoreGlobalICNexus* nexus = casted_nexus<StoreGlobalICNexus>();
-        nexus->ConfigurePropertyCellMode(lookup->GetPropertyCell());
-        TRACE_IC("StoreGlobalIC", lookup->name());
+        nexus()->ConfigurePropertyCellMode(lookup->GetPropertyCell());
+        TraceIC("StoreGlobalIC", lookup->name());
         return;
       }
     }
     if (created_new_transition_) {
       // The first time a transition is performed, there's a good chance that
       // it won't be taken again, so don't bother creating a handler.
-      TRACE_GENERIC_IC("new transition");
-      TRACE_IC("StoreIC", lookup->name());
+      set_slow_stub_reason("new transition");
+      TraceIC("StoreIC", lookup->name());
       return;
     }
     handler = ComputeHandler(lookup);
   } else {
-    TRACE_GENERIC_IC("LookupForWrite said 'false'");
+    set_slow_stub_reason("LookupForWrite said 'false'");
     handler = slow_stub();
   }
 
   PatchCache(lookup->name(), handler);
-  TRACE_IC("StoreIC", lookup->name());
+  TraceIC("StoreIC", lookup->name());
 }
 
 Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
   switch (lookup->state()) {
     case LookupIterator::TRANSITION: {
-      Handle<JSObject> holder = lookup->GetHolder<JSObject>();
-
-      Handle<JSObject> store_target = lookup->GetStoreTarget();
+      Handle<JSObject> store_target = lookup->GetStoreTarget<JSObject>();
       if (store_target->IsJSGlobalObject()) {
         TRACE_HANDLER_STATS(isolate(), StoreIC_StoreGlobalTransitionDH);
 
         if (receiver_map()->IsJSGlobalObject()) {
           DCHECK(IsStoreGlobalIC());
+#ifdef DEBUG
+          Handle<JSObject> holder = lookup->GetHolder<JSObject>();
           DCHECK_EQ(*lookup->GetReceiver(), *holder);
           DCHECK_EQ(*store_target, *holder);
+#endif
           return StoreHandler::StoreGlobal(isolate(),
                                            lookup->transition_cell());
         }
@@ -1458,31 +1487,13 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
             isolate(), receiver_map(), store_target, smi_handler, cell);
         return handler;
       }
-      // Currently not handled by CompileStoreTransition.
-      if (!holder->HasFastProperties()) {
-        TRACE_GENERIC_IC("transition from slow");
-        TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
-        return slow_stub();
-      }
+      // Dictionary-to-fast transitions are not expected and not supported.
+      DCHECK_IMPLIES(!lookup->transition_map()->is_dictionary_map(),
+                     !receiver_map()->is_dictionary_map());
 
       DCHECK(lookup->IsCacheableTransition());
-      Handle<Map> transition = lookup->transition_map();
-
-      Handle<Smi> smi_handler;
-      if (transition->is_dictionary_map()) {
-        TRACE_HANDLER_STATS(isolate(), StoreIC_StoreNormalDH);
-        smi_handler = StoreHandler::StoreNormal(isolate());
-      } else {
-        TRACE_HANDLER_STATS(isolate(), StoreIC_StoreTransitionDH);
-        smi_handler = StoreHandler::StoreTransition(isolate(), transition);
-      }
 
-      Handle<WeakCell> cell = Map::WeakCellForMap(transition);
-      Handle<Object> handler = StoreHandler::StoreThroughPrototype(
-          isolate(), receiver_map(), holder, smi_handler, cell);
-      TransitionsAccessor(receiver_map())
-          .UpdateHandler(*lookup->name(), *handler);
-      return handler;
+      return StoreHandler::StoreTransition(isolate(), lookup->transition_map());
     }
 
     case LookupIterator::INTERCEPTOR: {
@@ -1502,7 +1513,7 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
       DCHECK(!receiver->IsAccessCheckNeeded() || lookup->name()->IsPrivate());
 
       if (!holder->HasFastProperties()) {
-        TRACE_GENERIC_IC("accessor on slow map");
+        set_slow_stub_reason("accessor on slow map");
         TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
         return slow_stub();
       }
@@ -1510,19 +1521,19 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
       if (accessors->IsAccessorInfo()) {
         Handle<AccessorInfo> info = Handle<AccessorInfo>::cast(accessors);
         if (v8::ToCData<Address>(info->setter()) == nullptr) {
-          TRACE_GENERIC_IC("setter == nullptr");
+          set_slow_stub_reason("setter == nullptr");
           TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
           return slow_stub();
         }
         if (AccessorInfo::cast(*accessors)->is_special_data_property() &&
             !lookup->HolderIsReceiverOrHiddenPrototype()) {
-          TRACE_GENERIC_IC("special data property in prototype chain");
+          set_slow_stub_reason("special data property in prototype chain");
           TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
           return slow_stub();
         }
         if (!AccessorInfo::IsCompatibleReceiverMap(isolate(), info,
                                                    receiver_map())) {
-          TRACE_GENERIC_IC("incompatible receiver type");
+          set_slow_stub_reason("incompatible receiver type");
           TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
           return slow_stub();
         }
@@ -1540,10 +1551,18 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
         Handle<Object> setter(Handle<AccessorPair>::cast(accessors)->setter(),
                               isolate());
         if (!setter->IsJSFunction() && !setter->IsFunctionTemplateInfo()) {
-          TRACE_GENERIC_IC("setter not a function");
+          set_slow_stub_reason("setter not a function");
           TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
           return slow_stub();
         }
+
+        if (setter->IsFunctionTemplateInfo() &&
+            FunctionTemplateInfo::cast(*setter)->BreakAtEntry()) {
+          // Do not install an IC if the api function has a breakpoint.
+          TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
+          return slow_stub();
+        }
+
         CallOptimization call_optimization(setter);
         if (call_optimization.is_simple_api_call()) {
           if (call_optimization.IsCompatibleReceiver(receiver, holder)) {
@@ -1566,11 +1585,11 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
                 isolate(), receiver_map(), holder, smi_handler, data_cell,
                 context_cell);
           }
-          TRACE_GENERIC_IC("incompatible receiver");
+          set_slow_stub_reason("incompatible receiver");
           TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
           return slow_stub();
         } else if (setter->IsFunctionTemplateInfo()) {
-          TRACE_GENERIC_IC("setter non-simple template");
+          set_slow_stub_reason("setter non-simple template");
           TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
           return slow_stub();
         }
@@ -1625,7 +1644,7 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
 
       // -------------- Constant properties --------------
       DCHECK_EQ(kDescriptor, lookup->property_details().location());
-      TRACE_GENERIC_IC("constant property");
+      set_slow_stub_reason("constant property");
       TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
       return slow_stub();
     }
@@ -1646,20 +1665,22 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
 }
 
 void KeyedStoreIC::UpdateStoreElement(Handle<Map> receiver_map,
-                                      KeyedAccessStoreMode store_mode) {
+                                      KeyedAccessStoreMode store_mode,
+                                      bool receiver_was_cow) {
   MapHandles target_receiver_maps;
   TargetMaps(&target_receiver_maps);
   if (target_receiver_maps.empty()) {
     Handle<Map> monomorphic_map =
         ComputeTransitionedMap(receiver_map, store_mode);
-    store_mode = GetNonTransitioningStoreMode(store_mode);
+    store_mode = GetNonTransitioningStoreMode(store_mode, receiver_was_cow);
     Handle<Object> handler = StoreElementHandler(monomorphic_map, store_mode);
     return ConfigureVectorState(Handle<Name>(), monomorphic_map, handler);
   }
 
   for (Handle<Map> map : target_receiver_maps) {
     if (!map.is_null() && map->instance_type() == JS_VALUE_TYPE) {
-      TRACE_GENERIC_IC("JSValue");
+      DCHECK(!IsStoreInArrayLiteralICKind(kind()));
+      set_slow_stub_reason("JSValue");
       return;
     }
   }
@@ -1684,7 +1705,7 @@ void KeyedStoreIC::UpdateStoreElement(Handle<Map> receiver_map,
       // If the "old" and "new" maps are in the same elements map family, or
       // if they at least come from the same origin for a transitioning store,
       // stay MONOMORPHIC and use the map for the most generic ElementsKind.
-      store_mode = GetNonTransitioningStoreMode(store_mode);
+      store_mode = GetNonTransitioningStoreMode(store_mode, receiver_was_cow);
       Handle<Object> handler =
           StoreElementHandler(transitioned_receiver_map, store_mode);
       ConfigureVectorState(Handle<Name>(), transitioned_receiver_map, handler);
@@ -1692,7 +1713,7 @@ void KeyedStoreIC::UpdateStoreElement(Handle<Map> receiver_map,
     }
     if (receiver_map.is_identical_to(previous_receiver_map) &&
         old_store_mode == STANDARD_STORE &&
-        (store_mode == STORE_AND_GROW_NO_TRANSITION ||
+        (store_mode == STORE_AND_GROW_NO_TRANSITION_HANDLE_COW ||
          store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS ||
          store_mode == STORE_NO_TRANSITION_HANDLE_COW)) {
       // A "normal" IC that handles stores can switch to a version that can
@@ -1718,7 +1739,7 @@ void KeyedStoreIC::UpdateStoreElement(Handle<Map> receiver_map,
   if (!map_added) {
     // If the miss wasn't due to an unseen map, a polymorphic stub
     // won't help, use the megamorphic stub which can handle everything.
-    TRACE_GENERIC_IC("same map added twice");
+    set_slow_stub_reason("same map added twice");
     return;
   }
 
@@ -1728,12 +1749,12 @@ void KeyedStoreIC::UpdateStoreElement(Handle<Map> receiver_map,
 
   // Make sure all polymorphic handlers have the same store mode, otherwise the
   // megamorphic stub must be used.
-  store_mode = GetNonTransitioningStoreMode(store_mode);
+  store_mode = GetNonTransitioningStoreMode(store_mode, receiver_was_cow);
   if (old_store_mode != STANDARD_STORE) {
     if (store_mode == STANDARD_STORE) {
       store_mode = old_store_mode;
     } else if (store_mode != old_store_mode) {
-      TRACE_GENERIC_IC("store mode mismatch");
+      set_slow_stub_reason("store mode mismatch");
       return;
     }
   }
@@ -1745,12 +1766,15 @@ void KeyedStoreIC::UpdateStoreElement(Handle<Map> receiver_map,
     size_t external_arrays = 0;
     for (Handle<Map> map : target_receiver_maps) {
       if (map->has_fixed_typed_array_elements()) {
+        DCHECK(!IsStoreInArrayLiteralICKind(kind()));
         external_arrays++;
       }
     }
     if (external_arrays != 0 &&
         external_arrays != target_receiver_maps.size()) {
-      TRACE_GENERIC_IC("unsupported combination of external and normal arrays");
+      DCHECK(!IsStoreInArrayLiteralICKind(kind()));
+      set_slow_stub_reason(
+          "unsupported combination of external and normal arrays");
       return;
     }
   }
@@ -1787,10 +1811,10 @@ Handle<Map> KeyedStoreIC::ComputeTransitionedMap(
     }
     case STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS:
       DCHECK(map->has_fixed_typed_array_elements());
-    // Fall through
+      V8_FALLTHROUGH;
     case STORE_NO_TRANSITION_HANDLE_COW:
     case STANDARD_STORE:
-    case STORE_AND_GROW_NO_TRANSITION:
+    case STORE_AND_GROW_NO_TRANSITION_HANDLE_COW:
       return map;
   }
   UNREACHABLE();
@@ -1799,10 +1823,11 @@ Handle<Map> KeyedStoreIC::ComputeTransitionedMap(
 Handle<Object> KeyedStoreIC::StoreElementHandler(
     Handle<Map> receiver_map, KeyedAccessStoreMode store_mode) {
   DCHECK(store_mode == STANDARD_STORE ||
-         store_mode == STORE_AND_GROW_NO_TRANSITION ||
+         store_mode == STORE_AND_GROW_NO_TRANSITION_HANDLE_COW ||
          store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS ||
          store_mode == STORE_NO_TRANSITION_HANDLE_COW);
-  DCHECK(!receiver_map->DictionaryElementsInPrototypeChainOnly());
+  DCHECK_IMPLIES(receiver_map->DictionaryElementsInPrototypeChainOnly(),
+                 IsStoreInArrayLiteralICKind(kind()));
 
   if (receiver_map->IsJSProxyMap()) {
     return StoreHandler::StoreProxy(isolate());
@@ -1822,11 +1847,17 @@ Handle<Object> KeyedStoreIC::StoreElementHandler(
         StoreFastElementStub(isolate(), is_jsarray, elements_kind, store_mode)
             .GetCode();
     if (receiver_map->has_fixed_typed_array_elements()) return stub;
+  } else if (IsStoreInArrayLiteralICKind(kind())) {
+    TRACE_HANDLER_STATS(isolate(), StoreInArrayLiteralIC_SlowStub);
+    stub = StoreInArrayLiteralSlowStub(isolate(), store_mode).GetCode();
   } else {
     TRACE_HANDLER_STATS(isolate(), KeyedStoreIC_StoreElementStub);
     DCHECK_EQ(DICTIONARY_ELEMENTS, elements_kind);
     stub = StoreSlowElementStub(isolate(), store_mode).GetCode();
   }
+
+  if (IsStoreInArrayLiteralICKind(kind())) return stub;
+
   Handle<Object> validity_cell =
       Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
   if (validity_cell.is_null()) return stub;
@@ -1840,7 +1871,7 @@ void KeyedStoreIC::StoreElementPolymorphicHandlers(
     MapHandles* receiver_maps, ObjectHandles* handlers,
     KeyedAccessStoreMode store_mode) {
   DCHECK(store_mode == STANDARD_STORE ||
-         store_mode == STORE_AND_GROW_NO_TRANSITION ||
+         store_mode == STORE_AND_GROW_NO_TRANSITION_HANDLE_COW ||
          store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS ||
          store_mode == STORE_NO_TRANSITION_HANDLE_COW);
 
@@ -1860,7 +1891,7 @@ void KeyedStoreIC::StoreElementPolymorphicHandlers(
       // TODO(mvstanton): Consider embedding store_mode in the state of the slow
       // keyed store ic for uniformity.
       TRACE_HANDLER_STATS(isolate(), KeyedStoreIC_SlowStub);
-      handler = BUILTIN_CODE(isolate(), KeyedStoreIC_Slow);
+      handler = slow_stub();
 
     } else {
       {
@@ -1915,7 +1946,7 @@ static KeyedAccessStoreMode GetStoreMode(Handle<JSObject> receiver,
         return STORE_AND_GROW_TRANSITION_TO_OBJECT;
       }
     }
-    return STORE_AND_GROW_NO_TRANSITION;
+    return STORE_AND_GROW_NO_TRANSITION_HANDLE_COW;
   } else {
     // Handle only in-bounds elements accesses.
     if (receiver->HasSmiElements()) {
@@ -1933,12 +1964,8 @@ static KeyedAccessStoreMode GetStoreMode(Handle<JSObject> receiver,
         receiver->map()->has_fixed_typed_array_elements() && oob_access) {
       return STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS;
     }
-    Heap* heap = receiver->GetHeap();
-    if (receiver->elements()->map() == heap->fixed_cow_array_map()) {
-      return STORE_NO_TRANSITION_HANDLE_COW;
-    } else {
-      return STANDARD_STORE;
-    }
+    return receiver->elements()->IsCowArray() ? STORE_NO_TRANSITION_HANDLE_COW
+                                              : STANDARD_STORE;
   }
 }
 
@@ -1974,8 +2001,8 @@ MaybeHandle<Object> KeyedStoreIC::Store(Handle<Object> object,
         Object);
     if (vector_needs_update()) {
       if (ConfigureVectorState(MEGAMORPHIC, key)) {
-        TRACE_GENERIC_IC("unhandled internalized string key");
-        TRACE_IC("StoreIC", key);
+        set_slow_stub_reason("unhandled internalized string key");
+        TraceIC("StoreIC", key);
       }
     }
     return store_handle;
@@ -1991,7 +2018,7 @@ MaybeHandle<Object> KeyedStoreIC::Store(Handle<Object> object,
     // the runtime to enable optimization of element hole access.
     Handle<HeapObject> heap_object = Handle<HeapObject>::cast(object);
     if (heap_object->map()->IsMapInArrayPrototypeChain()) {
-      TRACE_GENERIC_IC("map in array prototype");
+      set_slow_stub_reason("map in array prototype");
       use_ic = false;
     }
   }
@@ -2005,7 +2032,13 @@ MaybeHandle<Object> KeyedStoreIC::Store(Handle<Object> object,
     old_receiver_map = handle(receiver->map(), isolate());
     is_arguments = receiver->IsJSArgumentsObject();
     bool is_proxy = receiver->IsJSProxy();
-    key_is_valid_index = key->IsSmi() && Smi::ToInt(*key) >= 0;
+    // For JSTypedArray {object}s we can handle negative indices as OOB
+    // accesses, since integer indexed properties are never looked up
+    // on the prototype chain. For this we simply map the negative {key}s
+    // to the [2**31,2**32-1] range, which is safe since JSTypedArray::length
+    // is always an unsigned Smi.
+    key_is_valid_index =
+        key->IsSmi() && (Smi::ToInt(*key) >= 0 || object->IsJSTypedArray());
     if (!is_arguments && !is_proxy) {
       if (key_is_valid_index) {
         uint32_t index = static_cast<uint32_t>(Smi::ToInt(*key));
@@ -2016,6 +2049,9 @@ MaybeHandle<Object> KeyedStoreIC::Store(Handle<Object> object,
   }
 
   DCHECK(store_handle.is_null());
+  bool receiver_was_cow =
+      object->IsJSArray() &&
+      Handle<JSArray>::cast(object)->elements()->IsCowArray();
   ASSIGN_RETURN_ON_EXCEPTION(isolate(), store_handle,
                              Runtime::SetObjectProperty(isolate(), object, key,
                                                         value, language_mode()),
@@ -2024,45 +2060,92 @@ MaybeHandle<Object> KeyedStoreIC::Store(Handle<Object> object,
   if (use_ic) {
     if (!old_receiver_map.is_null()) {
       if (is_arguments) {
-        TRACE_GENERIC_IC("arguments receiver");
+        set_slow_stub_reason("arguments receiver");
       } else if (key_is_valid_index) {
         if (old_receiver_map->is_abandoned_prototype_map()) {
-          TRACE_GENERIC_IC("receiver with prototype map");
+          set_slow_stub_reason("receiver with prototype map");
         } else if (!old_receiver_map
                         ->DictionaryElementsInPrototypeChainOnly()) {
           // We should go generic if receiver isn't a dictionary, but our
           // prototype chain does have dictionary elements. This ensures that
           // other non-dictionary receivers in the polymorphic case benefit
           // from fast path keyed stores.
-          UpdateStoreElement(old_receiver_map, store_mode);
+          UpdateStoreElement(old_receiver_map, store_mode, receiver_was_cow);
         } else {
-          TRACE_GENERIC_IC("dictionary or proxy prototype");
+          set_slow_stub_reason("dictionary or proxy prototype");
         }
       } else {
-        TRACE_GENERIC_IC("non-smi-like key");
+        set_slow_stub_reason("non-smi-like key");
       }
     } else {
-      TRACE_GENERIC_IC("non-JSObject receiver");
+      set_slow_stub_reason("non-JSObject receiver");
     }
   }
 
   if (vector_needs_update()) {
     ConfigureVectorState(MEGAMORPHIC, key);
   }
-  TRACE_IC("StoreIC", key);
+  TraceIC("StoreIC", key);
 
   return store_handle;
 }
 
+namespace {
+void StoreOwnElement(Handle<JSArray> array, Handle<Object> index,
+                     Handle<Object> value) {
+  DCHECK(index->IsNumber());
+  bool success = false;
+  LookupIterator it = LookupIterator::PropertyOrElement(
+      array->GetIsolate(), array, index, &success, LookupIterator::OWN);
+  DCHECK(success);
+
+  CHECK(JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, NONE,
+                                                    kThrowOnError)
+            .FromJust());
+}
+}  // namespace
+
+void StoreInArrayLiteralIC::Store(Handle<JSArray> array, Handle<Object> index,
+                                  Handle<Object> value) {
+  DCHECK(!array->map()->IsMapInArrayPrototypeChain());
+  DCHECK(index->IsNumber());
+
+  if (!FLAG_use_ic || MigrateDeprecated(array)) {
+    StoreOwnElement(array, index, value);
+    TraceIC("StoreInArrayLiteralIC", index);
+    return;
+  }
+
+  // TODO(neis): Convert HeapNumber to Smi if possible?
+
+  KeyedAccessStoreMode store_mode = STANDARD_STORE;
+  if (index->IsSmi()) {
+    DCHECK_GE(Smi::ToInt(*index), 0);
+    uint32_t index32 = static_cast<uint32_t>(Smi::ToInt(*index));
+    store_mode = GetStoreMode(array, index32, value);
+  }
+
+  Handle<Map> old_array_map(array->map(), isolate());
+  bool array_was_cow = array->elements()->IsCowArray();
+  StoreOwnElement(array, index, value);
 
-#undef TRACE_IC
+  if (index->IsSmi()) {
+    DCHECK(!old_array_map->is_abandoned_prototype_map());
+    UpdateStoreElement(old_array_map, store_mode, array_was_cow);
+  } else {
+    set_slow_stub_reason("index out of Smi range");
+  }
 
+  if (vector_needs_update()) {
+    ConfigureVectorState(MEGAMORPHIC, index);
+  }
+  TraceIC("StoreInArrayLiteralIC", index);
+}
 
 // ----------------------------------------------------------------------------
 // Static IC stub generators.
 //
 
-// Used from ic-<arch>.cc.
 RUNTIME_FUNCTION(Runtime_LoadIC_Miss) {
   HandleScope scope(isolate);
   DCHECK_EQ(4, args.length());
@@ -2071,35 +2154,31 @@ RUNTIME_FUNCTION(Runtime_LoadIC_Miss) {
   Handle<Name> key = args.at<Name>(1);
   Handle<Smi> slot = args.at<Smi>(2);
   Handle<FeedbackVector> vector = args.at<FeedbackVector>(3);
-  FeedbackSlot vector_slot = vector->ToSlot(slot->value());
+  FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
   // A monomorphic or polymorphic KeyedLoadIC with a string key can call the
   // LoadIC miss handler if the handler misses. Since the vector Nexus is
   // set up outside the IC, handle that here.
   FeedbackSlotKind kind = vector->GetKind(vector_slot);
   if (IsLoadICKind(kind)) {
-    LoadICNexus nexus(vector, vector_slot);
-    LoadIC ic(isolate, &nexus);
+    LoadIC ic(isolate, vector, vector_slot);
     ic.UpdateState(receiver, key);
     RETURN_RESULT_OR_FAILURE(isolate, ic.Load(receiver, key));
 
   } else if (IsLoadGlobalICKind(kind)) {
     DCHECK_EQ(isolate->native_context()->global_proxy(), *receiver);
     receiver = isolate->global_object();
-    LoadGlobalICNexus nexus(vector, vector_slot);
-    LoadGlobalIC ic(isolate, &nexus);
+    LoadGlobalIC ic(isolate, vector, vector_slot);
     ic.UpdateState(receiver, key);
     RETURN_RESULT_OR_FAILURE(isolate, ic.Load(key));
 
   } else {
     DCHECK(IsKeyedLoadICKind(kind));
-    KeyedLoadICNexus nexus(vector, vector_slot);
-    KeyedLoadIC ic(isolate, &nexus);
+    KeyedLoadIC ic(isolate, vector, vector_slot);
     ic.UpdateState(receiver, key);
     RETURN_RESULT_OR_FAILURE(isolate, ic.Load(receiver, key));
   }
 }
 
-// Used from ic-<arch>.cc.
 RUNTIME_FUNCTION(Runtime_LoadGlobalIC_Miss) {
   HandleScope scope(isolate);
   DCHECK_EQ(3, args.length());
@@ -2108,10 +2187,9 @@ RUNTIME_FUNCTION(Runtime_LoadGlobalIC_Miss) {
   Handle<String> name = args.at<String>(0);
   Handle<Smi> slot = args.at<Smi>(1);
   Handle<FeedbackVector> vector = args.at<FeedbackVector>(2);
-  FeedbackSlot vector_slot = vector->ToSlot(slot->value());
+  FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
 
-  LoadGlobalICNexus nexus(vector, vector_slot);
-  LoadGlobalIC ic(isolate, &nexus);
+  LoadGlobalIC ic(isolate, vector, vector_slot);
   ic.UpdateState(global, name);
 
   Handle<Object> result;
@@ -2150,7 +2228,7 @@ RUNTIME_FUNCTION(Runtime_LoadGlobalIC_Slow) {
   if (!is_found) {
     Handle<Smi> slot = args.at<Smi>(1);
     Handle<FeedbackVector> vector = args.at<FeedbackVector>(2);
-    FeedbackSlot vector_slot = vector->ToSlot(slot->value());
+    FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
     FeedbackSlotKind kind = vector->GetKind(vector_slot);
     // It is actually a LoadGlobalICs here but the predicate handles this case
     // properly.
@@ -2162,7 +2240,6 @@ RUNTIME_FUNCTION(Runtime_LoadGlobalIC_Slow) {
   return *result;
 }
 
-// Used from ic-<arch>.cc
 RUNTIME_FUNCTION(Runtime_KeyedLoadIC_Miss) {
   HandleScope scope(isolate);
   DCHECK_EQ(4, args.length());
@@ -2171,14 +2248,12 @@ RUNTIME_FUNCTION(Runtime_KeyedLoadIC_Miss) {
   Handle<Object> key = args.at(1);
   Handle<Smi> slot = args.at<Smi>(2);
   Handle<FeedbackVector> vector = args.at<FeedbackVector>(3);
-  FeedbackSlot vector_slot = vector->ToSlot(slot->value());
-  KeyedLoadICNexus nexus(vector, vector_slot);
-  KeyedLoadIC ic(isolate, &nexus);
+  FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
+  KeyedLoadIC ic(isolate, vector, vector_slot);
   ic.UpdateState(receiver, key);
   RETURN_RESULT_OR_FAILURE(isolate, ic.Load(receiver, key));
 }
 
-// Used from ic-<arch>.cc.
 RUNTIME_FUNCTION(Runtime_StoreIC_Miss) {
   HandleScope scope(isolate);
   DCHECK_EQ(5, args.length());
@@ -2188,24 +2263,21 @@ RUNTIME_FUNCTION(Runtime_StoreIC_Miss) {
   Handle<FeedbackVector> vector = args.at<FeedbackVector>(2);
   Handle<Object> receiver = args.at(3);
   Handle<Name> key = args.at<Name>(4);
-  FeedbackSlot vector_slot = vector->ToSlot(slot->value());
+  FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
   FeedbackSlotKind kind = vector->GetKind(vector_slot);
   if (IsStoreICKind(kind) || IsStoreOwnICKind(kind)) {
-    StoreICNexus nexus(vector, vector_slot);
-    StoreIC ic(isolate, &nexus);
+    StoreIC ic(isolate, vector, vector_slot);
     ic.UpdateState(receiver, key);
     RETURN_RESULT_OR_FAILURE(isolate, ic.Store(receiver, key, value));
   } else if (IsStoreGlobalICKind(kind)) {
     DCHECK_EQ(isolate->native_context()->global_proxy(), *receiver);
     receiver = isolate->global_object();
-    StoreGlobalICNexus nexus(vector, vector_slot);
-    StoreGlobalIC ic(isolate, &nexus);
+    StoreGlobalIC ic(isolate, vector, vector_slot);
     ic.UpdateState(receiver, key);
     RETURN_RESULT_OR_FAILURE(isolate, ic.Store(key, value));
   } else {
     DCHECK(IsKeyedStoreICKind(kind));
-    KeyedStoreICNexus nexus(vector, vector_slot);
-    KeyedStoreIC ic(isolate, &nexus);
+    KeyedStoreIC ic(isolate, vector, vector_slot);
     ic.UpdateState(receiver, key);
     RETURN_RESULT_OR_FAILURE(isolate, ic.Store(receiver, key, value));
   }
@@ -2219,9 +2291,8 @@ RUNTIME_FUNCTION(Runtime_StoreGlobalIC_Miss) {
   Handle<Smi> slot = args.at<Smi>(1);
   Handle<FeedbackVector> vector = args.at<FeedbackVector>(2);
   Handle<Name> key = args.at<Name>(3);
-  FeedbackSlot vector_slot = vector->ToSlot(slot->value());
-  StoreGlobalICNexus nexus(vector, vector_slot);
-  StoreGlobalIC ic(isolate, &nexus);
+  FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
+  StoreGlobalIC ic(isolate, vector, vector_slot);
   Handle<JSGlobalObject> global = isolate->global_object();
   ic.UpdateState(global, key);
   RETURN_RESULT_OR_FAILURE(isolate, ic.Store(key, value));
@@ -2238,7 +2309,7 @@ RUNTIME_FUNCTION(Runtime_StoreGlobalIC_Slow) {
 
 #ifdef DEBUG
   {
-    FeedbackSlot vector_slot = vector->ToSlot(slot->value());
+    FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
     FeedbackSlotKind slot_kind = vector->GetKind(vector_slot);
     DCHECK(IsStoreGlobalICKind(slot_kind));
     Handle<Object> receiver = args.at(3);
@@ -2272,14 +2343,13 @@ RUNTIME_FUNCTION(Runtime_StoreGlobalIC_Slow) {
     return *value;
   }
 
-  FeedbackSlot vector_slot = vector->ToSlot(slot->value());
+  FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
   LanguageMode language_mode = vector->GetLanguageMode(vector_slot);
   RETURN_RESULT_OR_FAILURE(
       isolate,
       Runtime::SetObjectProperty(isolate, global, name, value, language_mode));
 }
 
-// Used from ic-<arch>.cc.
 RUNTIME_FUNCTION(Runtime_KeyedStoreIC_Miss) {
   HandleScope scope(isolate);
   DCHECK_EQ(5, args.length());
@@ -2289,13 +2359,25 @@ RUNTIME_FUNCTION(Runtime_KeyedStoreIC_Miss) {
   Handle<FeedbackVector> vector = args.at<FeedbackVector>(2);
   Handle<Object> receiver = args.at(3);
   Handle<Object> key = args.at(4);
-  FeedbackSlot vector_slot = vector->ToSlot(slot->value());
-  KeyedStoreICNexus nexus(vector, vector_slot);
-  KeyedStoreIC ic(isolate, &nexus);
-  ic.UpdateState(receiver, key);
-  RETURN_RESULT_OR_FAILURE(isolate, ic.Store(receiver, key, value));
-}
+  FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
+  FeedbackSlotKind kind = vector->GetKind(vector_slot);
 
+  // The elements store stubs miss into this function, but they are shared by
+  // different ICs.
+  if (IsKeyedStoreICKind(kind)) {
+    KeyedStoreIC ic(isolate, vector, vector_slot);
+    ic.UpdateState(receiver, key);
+    RETURN_RESULT_OR_FAILURE(isolate, ic.Store(receiver, key, value));
+  } else {
+    DCHECK(IsStoreInArrayLiteralICKind(kind));
+    DCHECK(receiver->IsJSArray());
+    DCHECK(key->IsNumber());
+    StoreInArrayLiteralIC ic(isolate, vector, vector_slot);
+    ic.UpdateState(receiver, key);
+    ic.Store(Handle<JSArray>::cast(receiver), key, value);
+    return *value;
+  }
+}
 
 RUNTIME_FUNCTION(Runtime_KeyedStoreIC_Slow) {
   HandleScope scope(isolate);
@@ -2306,13 +2388,25 @@ RUNTIME_FUNCTION(Runtime_KeyedStoreIC_Slow) {
   Handle<FeedbackVector> vector = args.at<FeedbackVector>(2);
   Handle<Object> object = args.at(3);
   Handle<Object> key = args.at(4);
-  FeedbackSlot vector_slot = vector->ToSlot(slot->value());
-  LanguageMode language_mode = vector->GetLanguageMode(vector_slot);
+  FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
+  FeedbackSlotKind kind = vector->GetKind(vector_slot);
+  DCHECK(IsStoreICKind(kind) || IsKeyedStoreICKind(kind));
+  LanguageMode language_mode = GetLanguageModeFromSlotKind(kind);
   RETURN_RESULT_OR_FAILURE(
       isolate,
       Runtime::SetObjectProperty(isolate, object, key, value, language_mode));
 }
 
+RUNTIME_FUNCTION(Runtime_StoreInArrayLiteralIC_Slow) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(3, args.length());
+  // Runtime functions don't follow the IC's calling convention.
+  Handle<Object> value = args.at(0);
+  Handle<Object> array = args.at(1);
+  Handle<Object> index = args.at(2);
+  StoreOwnElement(Handle<JSArray>::cast(array), index, value);
+  return *value;
+}
 
 RUNTIME_FUNCTION(Runtime_ElementsTransitionAndStoreIC_Miss) {
   HandleScope scope(isolate);
@@ -2324,20 +2418,24 @@ RUNTIME_FUNCTION(Runtime_ElementsTransitionAndStoreIC_Miss) {
   Handle<Map> map = args.at<Map>(3);
   Handle<Smi> slot = args.at<Smi>(4);
   Handle<FeedbackVector> vector = args.at<FeedbackVector>(5);
-  FeedbackSlot vector_slot = vector->ToSlot(slot->value());
-  LanguageMode language_mode = vector->GetLanguageMode(vector_slot);
+  FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
+  FeedbackSlotKind kind = vector->GetKind(vector_slot);
+
   if (object->IsJSObject()) {
     JSObject::TransitionElementsKind(Handle<JSObject>::cast(object),
                                      map->elements_kind());
   }
-  RETURN_RESULT_OR_FAILURE(
-      isolate,
-      Runtime::SetObjectProperty(isolate, object, key, value, language_mode));
-}
 
-
-RUNTIME_FUNCTION(Runtime_Unreachable) {
-  UNREACHABLE();
+  if (IsStoreInArrayLiteralICKind(kind)) {
+    StoreOwnElement(Handle<JSArray>::cast(object), key, value);
+    return *value;
+  } else {
+    DCHECK(IsKeyedStoreICKind(kind) || IsStoreICKind(kind));
+    LanguageMode language_mode = GetLanguageModeFromSlotKind(kind);
+    RETURN_RESULT_OR_FAILURE(
+        isolate,
+        Runtime::SetObjectProperty(isolate, object, key, value, language_mode));
+  }
 }
 
 
@@ -2413,7 +2511,7 @@ RUNTIME_FUNCTION(Runtime_LoadPropertyWithInterceptor) {
 
   Handle<Smi> slot = args.at<Smi>(3);
   Handle<FeedbackVector> vector = args.at<FeedbackVector>(4);
-  FeedbackSlot vector_slot = vector->ToSlot(slot->value());
+  FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
   FeedbackSlotKind slot_kind = vector->GetKind(vector_slot);
   // It could actually be any kind of load IC slot here but the predicate
   // handles all the cases properly.
@@ -2436,7 +2534,7 @@ RUNTIME_FUNCTION(Runtime_StorePropertyWithInterceptor) {
   Handle<FeedbackVector> vector = args.at<FeedbackVector>(2);
   Handle<JSObject> receiver = args.at<JSObject>(3);
   Handle<Name> name = args.at<Name>(4);
-  FeedbackSlot vector_slot = vector->ToSlot(slot->value());
+  FeedbackSlot vector_slot = FeedbackVector::ToSlot(slot->value());
   LanguageMode language_mode = vector->GetLanguageMode(vector_slot);
 
   // TODO(ishell): Cache interceptor_holder in the store handler like we do
diff --git a/deps/v8/src/ic/ic.h b/deps/v8/src/ic/ic.h
index a63202395b9..fb82d86bd6a 100644
--- a/deps/v8/src/ic/ic.h
+++ b/deps/v8/src/ic/ic.h
@@ -2,13 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_IC_H_
-#define V8_IC_H_
+#ifndef V8_IC_IC_H_
+#define V8_IC_IC_H_
 
 #include <vector>
 
 #include "src/factory.h"
 #include "src/feedback-vector.h"
+#include "src/ic/stub-cache.h"
+#include "src/isolate.h"
 #include "src/macro-assembler.h"
 #include "src/messages.h"
 #include "src/objects/map.h"
@@ -36,7 +38,8 @@ class IC {
 
   // Construct the IC structure with the given number of extra
   // JavaScript frames on the stack.
-  IC(FrameDepth depth, Isolate* isolate, FeedbackNexus* nexus = nullptr);
+  IC(FrameDepth depth, Isolate* isolate, Handle<FeedbackVector> vector,
+     FeedbackSlot slot);
   virtual ~IC() {}
 
   State state() const { return state_; }
@@ -57,7 +60,7 @@ class IC {
   }
   bool IsAnyStore() const {
     return IsStoreIC() || IsStoreOwnIC() || IsStoreGlobalIC() ||
-           IsKeyedStoreIC();
+           IsKeyedStoreIC() || IsStoreInArrayLiteralICKind(kind());
   }
 
   static inline bool IsHandler(Object* object);
@@ -67,6 +70,9 @@ class IC {
                                 FeedbackSlot slot, JSFunction* host_function,
                                 const char* reason);
 
+  static void OnFeedbackChanged(Isolate* isolate, FeedbackNexus* nexus,
+                                JSFunction* host_function, const char* reason);
+
  protected:
   Address fp() const { return fp_; }
   Address pc() const { return *pc_address_; }
@@ -127,7 +133,10 @@ class IC {
   bool IsStoreIC() const { return IsStoreICKind(kind_); }
   bool IsStoreOwnIC() const { return IsStoreOwnICKind(kind_); }
   bool IsKeyedStoreIC() const { return IsKeyedStoreICKind(kind_); }
-  bool is_keyed() const { return IsKeyedLoadIC() || IsKeyedStoreIC(); }
+  bool is_keyed() const {
+    return IsKeyedLoadIC() || IsKeyedStoreIC() ||
+           IsStoreInArrayLiteralICKind(kind_);
+  }
   bool ShouldRecomputeHandler(Handle<String> name);
 
   Handle<Map> receiver_map() { return receiver_map_; }
@@ -151,17 +160,12 @@ class IC {
     return !target_maps_.empty() ? *target_maps_[0] : nullptr;
   }
 
-  Handle<FeedbackVector> vector() const { return nexus()->vector_handle(); }
-  FeedbackSlot slot() const { return nexus()->slot(); }
   State saved_state() const {
     return state() == RECOMPUTE_HANDLER ? old_state_ : state();
   }
 
-  template <class NexusClass>
-  NexusClass* casted_nexus() {
-    return static_cast<NexusClass*>(nexus_);
-  }
-  FeedbackNexus* nexus() const { return nexus_; }
+  const FeedbackNexus* nexus() const { return &nexus_; }
+  FeedbackNexus* nexus() { return &nexus_; }
 
  private:
   inline Address constant_pool() const;
@@ -200,7 +204,7 @@ class IC {
 
   const char* slow_stub_reason_;
 
-  FeedbackNexus* nexus_;
+  FeedbackNexus nexus_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(IC);
 };
@@ -208,18 +212,15 @@ class IC {
 
 class CallIC : public IC {
  public:
-  CallIC(Isolate* isolate, CallICNexus* nexus)
-      : IC(EXTRA_CALL_FRAME, isolate, nexus) {
-    DCHECK_NOT_NULL(nexus);
-  }
+  CallIC(Isolate* isolate, Handle<FeedbackVector> vector, FeedbackSlot slot)
+      : IC(EXTRA_CALL_FRAME, isolate, vector, slot) {}
 };
 
 
 class LoadIC : public IC {
  public:
-  LoadIC(Isolate* isolate, FeedbackNexus* nexus)
-      : IC(NO_EXTRA_FRAME, isolate, nexus) {
-    DCHECK_NOT_NULL(nexus);
+  LoadIC(Isolate* isolate, Handle<FeedbackVector> vector, FeedbackSlot slot)
+      : IC(NO_EXTRA_FRAME, isolate, vector, slot) {
     DCHECK(IsAnyLoad());
   }
 
@@ -252,8 +253,9 @@ class LoadIC : public IC {
 
 class LoadGlobalIC : public LoadIC {
  public:
-  LoadGlobalIC(Isolate* isolate, FeedbackNexus* nexus)
-      : LoadIC(isolate, nexus) {}
+  LoadGlobalIC(Isolate* isolate, Handle<FeedbackVector> vector,
+               FeedbackSlot slot)
+      : LoadIC(isolate, vector, slot) {}
 
   MUST_USE_RESULT MaybeHandle<Object> Load(Handle<Name> name);
 
@@ -265,10 +267,9 @@ class LoadGlobalIC : public LoadIC {
 
 class KeyedLoadIC : public LoadIC {
  public:
-  KeyedLoadIC(Isolate* isolate, KeyedLoadICNexus* nexus)
-      : LoadIC(isolate, nexus) {
-    DCHECK_NOT_NULL(nexus);
-  }
+  KeyedLoadIC(Isolate* isolate, Handle<FeedbackVector> vector,
+              FeedbackSlot slot)
+      : LoadIC(isolate, vector, slot) {}
 
   MUST_USE_RESULT MaybeHandle<Object> Load(Handle<Object> object,
                                            Handle<Object> key);
@@ -297,14 +298,12 @@ class KeyedLoadIC : public LoadIC {
 
 class StoreIC : public IC {
  public:
-  StoreIC(Isolate* isolate, FeedbackNexus* nexus)
-      : IC(NO_EXTRA_FRAME, isolate, nexus) {
+  StoreIC(Isolate* isolate, Handle<FeedbackVector> vector, FeedbackSlot slot)
+      : IC(NO_EXTRA_FRAME, isolate, vector, slot) {
     DCHECK(IsAnyStore());
   }
 
-  LanguageMode language_mode() const {
-    return nexus()->vector()->GetLanguageMode(nexus()->slot());
-  }
+  LanguageMode language_mode() const { return nexus()->GetLanguageMode(); }
 
   MUST_USE_RESULT MaybeHandle<Object> Store(
       Handle<Object> object, Handle<Name> name, Handle<Object> value,
@@ -324,8 +323,7 @@ class StoreIC : public IC {
   // Update the inline cache and the global stub cache based on the
   // lookup result.
   void UpdateCaches(LookupIterator* lookup, Handle<Object> value,
-                    JSReceiver::StoreFromKeyed store_mode,
-                    MaybeHandle<Object> cached_handler);
+                    JSReceiver::StoreFromKeyed store_mode);
 
  private:
   Handle<Object> ComputeHandler(LookupIterator* lookup);
@@ -337,8 +335,9 @@ class StoreIC : public IC {
 
 class StoreGlobalIC : public StoreIC {
  public:
-  StoreGlobalIC(Isolate* isolate, FeedbackNexus* nexus)
-      : StoreIC(isolate, nexus) {}
+  StoreGlobalIC(Isolate* isolate, Handle<FeedbackVector> vector,
+                FeedbackSlot slot)
+      : StoreIC(isolate, vector, slot) {}
 
   MUST_USE_RESULT MaybeHandle<Object> Store(Handle<Name> name,
                                             Handle<Object> value);
@@ -358,11 +357,12 @@ enum KeyedStoreIncrementLength { kDontIncrementLength, kIncrementLength };
 class KeyedStoreIC : public StoreIC {
  public:
   KeyedAccessStoreMode GetKeyedAccessStoreMode() {
-    return casted_nexus<KeyedStoreICNexus>()->GetKeyedAccessStoreMode();
+    return nexus()->GetKeyedAccessStoreMode();
   }
 
-  KeyedStoreIC(Isolate* isolate, KeyedStoreICNexus* nexus)
-      : StoreIC(isolate, nexus) {}
+  KeyedStoreIC(Isolate* isolate, Handle<FeedbackVector> vector,
+               FeedbackSlot slot)
+      : StoreIC(isolate, vector, slot) {}
 
   MUST_USE_RESULT MaybeHandle<Object> Store(Handle<Object> object,
                                             Handle<Object> name,
@@ -370,7 +370,12 @@ class KeyedStoreIC : public StoreIC {
 
  protected:
   void UpdateStoreElement(Handle<Map> receiver_map,
-                          KeyedAccessStoreMode store_mode);
+                          KeyedAccessStoreMode store_mode,
+                          bool receiver_was_cow);
+
+  Handle<Code> slow_stub() const override {
+    return BUILTIN_CODE(isolate(), KeyedStoreIC_Slow);
+  }
 
  private:
   Handle<Map> ComputeTransitionedMap(Handle<Map> map,
@@ -386,7 +391,23 @@ class KeyedStoreIC : public StoreIC {
   friend class IC;
 };
 
+class StoreInArrayLiteralIC : public KeyedStoreIC {
+ public:
+  StoreInArrayLiteralIC(Isolate* isolate, Handle<FeedbackVector> vector,
+                        FeedbackSlot slot)
+      : KeyedStoreIC(isolate, vector, slot) {
+    DCHECK(IsStoreInArrayLiteralICKind(kind()));
+  }
+
+  void Store(Handle<JSArray> array, Handle<Object> index, Handle<Object> value);
+
+ private:
+  Handle<Code> slow_stub() const override {
+    return BUILTIN_CODE(isolate(), StoreInArrayLiteralIC_Slow);
+  }
+};
+
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_IC_H_
+#endif  // V8_IC_IC_H_
diff --git a/deps/v8/src/ic/keyed-store-generic.cc b/deps/v8/src/ic/keyed-store-generic.cc
index b9a11c2ec72..51d8a01f996 100644
--- a/deps/v8/src/ic/keyed-store-generic.cc
+++ b/deps/v8/src/ic/keyed-store-generic.cc
@@ -77,13 +77,6 @@ class KeyedStoreGenericAssembler : public AccessorAssembler {
                                       Variable* var_accessor_pair,
                                       Variable* var_accessor_holder,
                                       Label* readonly, Label* bailout);
-
-  void CheckFieldType(Node* descriptors, Node* name_index, Node* representation,
-                      Node* value, Label* bailout);
-  void OverwriteExistingFastProperty(Node* object, Node* object_map,
-                                     Node* properties, Node* descriptors,
-                                     Node* descriptor_name_index, Node* details,
-                                     Node* value, Label* slow);
 };
 
 void KeyedStoreGenericGenerator::Generate(compiler::CodeAssemblerState* state) {
@@ -243,10 +236,11 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
     GotoIf(IsDictionaryMap(receiver_map), slow);
     // The length property is non-configurable, so it's guaranteed to always
     // be the first property.
-    Node* descriptors = LoadMapDescriptors(receiver_map);
-    Node* details =
-        LoadFixedArrayElement(descriptors, DescriptorArray::ToDetailsIndex(0));
-    GotoIf(IsSetSmi(details, PropertyDetails::kAttributesReadOnlyMask), slow);
+    TNode<DescriptorArray> descriptors = LoadMapDescriptors(receiver_map);
+    TNode<Int32T> details = LoadAndUntagToWord32FixedArrayElement(
+        descriptors, DescriptorArray::ToDetailsIndex(0));
+    GotoIf(IsSetWord32(details, PropertyDetails::kAttributesReadOnlyMask),
+           slow);
   }
   STATIC_ASSERT(FixedArray::kHeaderSize == FixedDoubleArray::kHeaderSize);
   const int kHeaderSize = FixedArray::kHeaderSize - kHeapObjectTag;
@@ -428,9 +422,10 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
 void KeyedStoreGenericAssembler::EmitGenericElementStore(
     Node* receiver, Node* receiver_map, Node* instance_type, Node* intptr_index,
     Node* value, Node* context, Label* slow) {
-  Label if_fast(this), if_in_bounds(this), if_increment_length_by_one(this),
-      if_bump_length_with_gap(this), if_grow(this), if_nonfast(this),
-      if_typed_array(this), if_dictionary(this);
+  Label if_fast(this), if_in_bounds(this), if_out_of_bounds(this),
+      if_increment_length_by_one(this), if_bump_length_with_gap(this),
+      if_grow(this), if_nonfast(this), if_typed_array(this),
+      if_dictionary(this);
   Node* elements = LoadElements(receiver);
   Node* elements_kind = LoadMapElementsKind(receiver_map);
   Branch(IsFastElementsKind(elements_kind), &if_fast, &if_nonfast);
@@ -440,7 +435,8 @@ void KeyedStoreGenericAssembler::EmitGenericElementStore(
   GotoIf(InstanceTypeEqual(instance_type, JS_ARRAY_TYPE), &if_array);
   {
     Node* capacity = SmiUntag(LoadFixedArrayBaseLength(elements));
-    Branch(UintPtrLessThan(intptr_index, capacity), &if_in_bounds, &if_grow);
+    Branch(UintPtrLessThan(intptr_index, capacity), &if_in_bounds,
+           &if_out_of_bounds);
   }
   BIND(&if_array);
   {
@@ -459,6 +455,16 @@ void KeyedStoreGenericAssembler::EmitGenericElementStore(
                              kDontChangeLength);
   }
 
+  BIND(&if_out_of_bounds);
+  {
+    // Integer indexed out-of-bounds accesses to typed arrays are simply
+    // ignored, since we never look up integer indexed properties on the
+    // prototypes of typed arrays. For all other types, we may need to
+    // grow the backing store.
+    GotoIfNot(InstanceTypeEqual(instance_type, JS_TYPED_ARRAY_TYPE), &if_grow);
+    Return(value);
+  }
+
   BIND(&if_increment_length_by_one);
   {
     StoreElementWithCapacity(receiver, receiver_map, elements, elements_kind,
@@ -535,8 +541,8 @@ void KeyedStoreGenericAssembler::LookupPropertyOnPrototypeChain(
     Label next_proto(this);
     {
       Label found(this), found_fast(this), found_dict(this), found_global(this);
-      VARIABLE(var_meta_storage, MachineRepresentation::kTagged);
-      VARIABLE(var_entry, MachineType::PointerRepresentation());
+      TVARIABLE(HeapObject, var_meta_storage);
+      TVARIABLE(IntPtrT, var_entry);
       TryLookupProperty(holder, holder_map, instance_type, name, &found_fast,
                         &found_dict, &found_global, &var_meta_storage,
                         &var_entry, &next_proto, bailout);
@@ -604,145 +610,6 @@ void KeyedStoreGenericAssembler::LookupPropertyOnPrototypeChain(
   BIND(&ok_to_write);
 }
 
-void KeyedStoreGenericAssembler::CheckFieldType(Node* descriptors,
-                                                Node* name_index,
-                                                Node* representation,
-                                                Node* value, Label* bailout) {
-  Label r_smi(this), r_double(this), r_heapobject(this), all_fine(this);
-  // Ignore FLAG_track_fields etc. and always emit code for all checks,
-  // because this builtin is part of the snapshot and therefore should
-  // be flag independent.
-  GotoIf(Word32Equal(representation, Int32Constant(Representation::kSmi)),
-         &r_smi);
-  GotoIf(Word32Equal(representation, Int32Constant(Representation::kDouble)),
-         &r_double);
-  GotoIf(
-      Word32Equal(representation, Int32Constant(Representation::kHeapObject)),
-      &r_heapobject);
-  GotoIf(Word32Equal(representation, Int32Constant(Representation::kNone)),
-         bailout);
-  CSA_ASSERT(this, Word32Equal(representation,
-                               Int32Constant(Representation::kTagged)));
-  Goto(&all_fine);
-
-  BIND(&r_smi);
-  { Branch(TaggedIsSmi(value), &all_fine, bailout); }
-
-  BIND(&r_double);
-  {
-    GotoIf(TaggedIsSmi(value), &all_fine);
-    Node* value_map = LoadMap(value);
-    // While supporting mutable HeapNumbers would be straightforward, such
-    // objects should not end up here anyway.
-    CSA_ASSERT(this,
-               WordNotEqual(value_map,
-                            LoadRoot(Heap::kMutableHeapNumberMapRootIndex)));
-    Branch(IsHeapNumberMap(value_map), &all_fine, bailout);
-  }
-
-  BIND(&r_heapobject);
-  {
-    GotoIf(TaggedIsSmi(value), bailout);
-    Node* field_type =
-        LoadValueByKeyIndex<DescriptorArray>(descriptors, name_index);
-    intptr_t kNoneType = reinterpret_cast<intptr_t>(FieldType::None());
-    intptr_t kAnyType = reinterpret_cast<intptr_t>(FieldType::Any());
-    // FieldType::None can't hold any value.
-    GotoIf(WordEqual(field_type, IntPtrConstant(kNoneType)), bailout);
-    // FieldType::Any can hold any value.
-    GotoIf(WordEqual(field_type, IntPtrConstant(kAnyType)), &all_fine);
-    CSA_ASSERT(this, IsWeakCell(field_type));
-    // Cleared WeakCells count as FieldType::None, which can't hold any value.
-    field_type = LoadWeakCellValue(field_type, bailout);
-    // FieldType::Class(...) performs a map check.
-    CSA_ASSERT(this, IsMap(field_type));
-    Branch(WordEqual(LoadMap(value), field_type), &all_fine, bailout);
-  }
-
-  BIND(&all_fine);
-}
-
-void KeyedStoreGenericAssembler::OverwriteExistingFastProperty(
-    Node* object, Node* object_map, Node* properties, Node* descriptors,
-    Node* descriptor_name_index, Node* details, Node* value, Label* slow) {
-  // Properties in descriptors can't be overwritten without map transition.
-  GotoIf(Word32NotEqual(DecodeWord32<PropertyDetails::LocationField>(details),
-                        Int32Constant(kField)),
-         slow);
-
-  if (FLAG_track_constant_fields) {
-    // TODO(ishell): Taking the slow path is not necessary if new and old
-    // values are identical.
-    GotoIf(Word32Equal(DecodeWord32<PropertyDetails::ConstnessField>(details),
-                       Int32Constant(kConst)),
-           slow);
-  }
-
-  Label done(this);
-  Node* representation =
-      DecodeWord32<PropertyDetails::RepresentationField>(details);
-
-  CheckFieldType(descriptors, descriptor_name_index, representation, value,
-                 slow);
-  Node* field_index =
-      DecodeWordFromWord32<PropertyDetails::FieldIndexField>(details);
-  field_index =
-      IntPtrAdd(field_index, LoadMapInobjectPropertiesStartInWords(object_map));
-  Node* instance_size_in_words = LoadMapInstanceSizeInWords(object_map);
-
-  Label inobject(this), backing_store(this);
-  Branch(UintPtrLessThan(field_index, instance_size_in_words), &inobject,
-         &backing_store);
-
-  BIND(&inobject);
-  {
-    Node* field_offset = TimesPointerSize(field_index);
-    Label tagged_rep(this), double_rep(this);
-    Branch(Word32Equal(representation, Int32Constant(Representation::kDouble)),
-           &double_rep, &tagged_rep);
-    BIND(&double_rep);
-    {
-      Node* double_value = ChangeNumberToFloat64(value);
-      if (FLAG_unbox_double_fields) {
-        StoreObjectFieldNoWriteBarrier(object, field_offset, double_value,
-                                       MachineRepresentation::kFloat64);
-      } else {
-        Node* mutable_heap_number = LoadObjectField(object, field_offset);
-        StoreHeapNumberValue(mutable_heap_number, double_value);
-      }
-      Goto(&done);
-    }
-
-    BIND(&tagged_rep);
-    {
-      StoreObjectField(object, field_offset, value);
-      Goto(&done);
-    }
-  }
-
-  BIND(&backing_store);
-  {
-    Node* backing_store_index = IntPtrSub(field_index, instance_size_in_words);
-    Label tagged_rep(this), double_rep(this);
-    Branch(Word32Equal(representation, Int32Constant(Representation::kDouble)),
-           &double_rep, &tagged_rep);
-    BIND(&double_rep);
-    {
-      Node* double_value = ChangeNumberToFloat64(value);
-      Node* mutable_heap_number =
-          LoadFixedArrayElement(properties, backing_store_index);
-      StoreHeapNumberValue(mutable_heap_number, double_value);
-      Goto(&done);
-    }
-    BIND(&tagged_rep);
-    {
-      StoreFixedArrayElement(properties, backing_store_index, value);
-      Goto(&done);
-    }
-  }
-  BIND(&done);
-}
-
 void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
     Node* receiver, Node* receiver_map, const StoreICParameters* p, Label* slow,
     UseStubCache use_stub_cache) {
@@ -759,7 +626,7 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
     Comment("fast property store");
     Node* descriptors = LoadMapDescriptors(receiver_map);
     Label descriptor_found(this), lookup_transition(this);
-    VARIABLE(var_name_index, MachineType::PointerRepresentation());
+    TVARIABLE(IntPtrT, var_name_index);
     Label* notfound = use_stub_cache == kUseStubCache ? &stub_cache : slow;
     DescriptorLookup(p->name, descriptors, bitfield3, &descriptor_found,
                      &var_name_index, &lookup_transition);
@@ -783,49 +650,29 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
       BIND(&data_property);
       {
         CheckForAssociatedProtector(p->name, slow);
-        Node* properties = LoadFastProperties(receiver);
-        OverwriteExistingFastProperty(receiver, receiver_map, properties,
-                                      descriptors, name_index, details,
-                                      p->value, slow);
+        OverwriteExistingFastDataProperty(receiver, receiver_map, descriptors,
+                                          name_index, details, p->value, slow,
+                                          false);
         Return(p->value);
       }
     }
-
     BIND(&lookup_transition);
     {
       Comment("lookup transition");
-      VARIABLE(var_handler, MachineRepresentation::kTagged);
-      Label check_key(this), found_handler(this, &var_handler);
+      Label found_simple_transition_handler(this);
       Node* maybe_handler =
           LoadObjectField(receiver_map, Map::kTransitionsOrPrototypeInfoOffset);
       GotoIf(TaggedIsSmi(maybe_handler), notfound);
-      GotoIf(HasInstanceType(maybe_handler, STORE_HANDLER_TYPE), &check_key);
+      GotoIf(IsWeakCell(maybe_handler), &found_simple_transition_handler);
 
       // TODO(jkummerow): Consider implementing TransitionArray search.
       Goto(notfound);
 
-      BIND(&check_key);
+      BIND(&found_simple_transition_handler);
       {
-        Node* transition_cell =
-            LoadObjectField(maybe_handler, StoreHandler::kData1Offset);
-        Node* transition = LoadWeakCellValue(transition_cell, slow);
-        Node* transition_bitfield3 = LoadMapBitField3(transition);
-        GotoIf(IsSetWord32<Map::IsDeprecatedBit>(transition_bitfield3), slow);
-        Node* nof =
-            DecodeWord32<Map::NumberOfOwnDescriptorsBits>(transition_bitfield3);
-        Node* last_added = Int32Sub(nof, Int32Constant(1));
-        Node* transition_descriptors = LoadMapDescriptors(transition);
-        Node* key = DescriptorArrayGetKey(transition_descriptors, last_added);
-        GotoIf(WordNotEqual(key, p->name), slow);
-        var_handler.Bind(maybe_handler);
-        Goto(&found_handler);
-      }
-
-      BIND(&found_handler);
-      {
-        Comment("KeyedStoreGeneric found transition handler");
-        HandleStoreICHandlerCase(p, var_handler.value(), notfound,
-                                 ICMode::kNonGlobalIC);
+        Node* transition_cell = maybe_handler;
+        Node* transition_map = LoadWeakCellValue(transition_cell, slow);
+        HandleStoreICTransitionMapHandlerCase(p, transition_map, slow, true);
       }
     }
   }
@@ -911,9 +758,8 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
 
       BIND(&strict);
       {
-        Node* message = SmiConstant(MessageTemplate::kNoSetterInCallback);
-        TailCallRuntime(Runtime::kThrowTypeError, p->context, message, p->name,
-                        var_accessor_holder.value());
+        ThrowTypeError(p->context, MessageTemplate::kNoSetterInCallback,
+                       p->name, var_accessor_holder.value());
       }
     }
   }
@@ -926,10 +772,9 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
 
     BIND(&strict);
     {
-      Node* message = SmiConstant(MessageTemplate::kStrictReadOnlyProperty);
       Node* type = Typeof(p->receiver);
-      TailCallRuntime(Runtime::kThrowTypeError, p->context, message, p->name,
-                      type, p->receiver);
+      ThrowTypeError(p->context, MessageTemplate::kStrictReadOnlyProperty,
+                     p->name, type, p->receiver);
     }
   }
 
@@ -1040,9 +885,7 @@ void KeyedStoreGenericAssembler::StoreIC_Uninitialized() {
   Node* instance_type = LoadMapInstanceType(receiver_map);
   // Receivers requiring non-standard element accesses (interceptors, access
   // checks, strings and string wrappers, proxies) are handled in the runtime.
-  GotoIf(Int32LessThanOrEqual(instance_type,
-                              Int32Constant(LAST_SPECIAL_RECEIVER_TYPE)),
-         &miss);
+  GotoIf(IsSpecialReceiverInstanceType(instance_type), &miss);
 
   // Optimistically write the state transition to the vector.
   StoreFeedbackVectorSlot(vector, slot,
diff --git a/deps/v8/src/ic/keyed-store-generic.h b/deps/v8/src/ic/keyed-store-generic.h
index 4d82840be34..1a0de3b2b4e 100644
--- a/deps/v8/src/ic/keyed-store-generic.h
+++ b/deps/v8/src/ic/keyed-store-generic.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_SRC_IC_KEYED_STORE_GENERIC_H_
-#define V8_SRC_IC_KEYED_STORE_GENERIC_H_
+#ifndef V8_IC_KEYED_STORE_GENERIC_H_
+#define V8_IC_KEYED_STORE_GENERIC_H_
 
 #include "src/globals.h"
 
@@ -27,4 +27,4 @@ class StoreICUninitializedGenerator {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_SRC_IC_KEYED_STORE_GENERIC_H_
+#endif  // V8_IC_KEYED_STORE_GENERIC_H_
diff --git a/deps/v8/src/ic/stub-cache.h b/deps/v8/src/ic/stub-cache.h
index cd081edfb22..870266eefdc 100644
--- a/deps/v8/src/ic/stub-cache.h
+++ b/deps/v8/src/ic/stub-cache.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_STUB_CACHE_H_
-#define V8_STUB_CACHE_H_
+#ifndef V8_IC_STUB_CACHE_H_
+#define V8_IC_STUB_CACHE_H_
 
 #include "src/macro-assembler.h"
 #include "src/objects/name.h"
@@ -140,4 +140,4 @@ class StubCache {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_STUB_CACHE_H_
+#endif  // V8_IC_STUB_CACHE_H_
diff --git a/deps/v8/src/identity-map.cc b/deps/v8/src/identity-map.cc
index b652d6a6db5..6a3bd4ca616 100644
--- a/deps/v8/src/identity-map.cc
+++ b/deps/v8/src/identity-map.cc
@@ -11,7 +11,7 @@ namespace v8 {
 namespace internal {
 
 static const int kInitialIdentityMapSize = 4;
-static const int kResizeFactor = 4;
+static const int kResizeFactor = 2;
 
 IdentityMapBase::~IdentityMapBase() {
   // Clear must be called by the subclass to avoid calling the virtual
@@ -87,7 +87,8 @@ void* IdentityMapBase::DeleteIndex(int index) {
   size_--;
   DCHECK_GE(size_, 0);
 
-  if (size_ * kResizeFactor < capacity_ / kResizeFactor) {
+  if (capacity_ > kInitialIdentityMapSize &&
+      size_ * kResizeFactor < capacity_ / kResizeFactor) {
     Resize(capacity_ / kResizeFactor);
     return ret_value;  // No need to fix collisions as resize reinserts keys.
   }
@@ -194,6 +195,14 @@ void* IdentityMapBase::DeleteEntry(Object* key) {
   return DeleteIndex(index);
 }
 
+Object* IdentityMapBase::KeyAtIndex(int index) const {
+  DCHECK_LE(0, index);
+  DCHECK_LT(index, capacity_);
+  DCHECK_NE(keys_[index], heap_->not_mapped_symbol());
+  CHECK(is_iterable());  // Must be iterable to access by index;
+  return keys_[index];
+}
+
 IdentityMapBase::RawEntry IdentityMapBase::EntryAtIndex(int index) const {
   DCHECK_LE(0, index);
   DCHECK_LT(index, capacity_);
diff --git a/deps/v8/src/identity-map.h b/deps/v8/src/identity-map.h
index cd198e1cb5f..4e69d3198af 100644
--- a/deps/v8/src/identity-map.h
+++ b/deps/v8/src/identity-map.h
@@ -46,6 +46,8 @@ class IdentityMapBase {
   void* DeleteEntry(Object* key);
   void Clear();
 
+  Object* KeyAtIndex(int index) const;
+
   V8_EXPORT_PRIVATE RawEntry EntryAtIndex(int index) const;
   V8_EXPORT_PRIVATE int NextIndex(int index) const;
 
@@ -126,8 +128,13 @@ class IdentityMap : public IdentityMapBase {
       return *this;
     }
 
-    V* operator*() { return reinterpret_cast<V*>(map_->EntryAtIndex(index_)); }
-    V* operator->() { return reinterpret_cast<V*>(map_->EntryAtIndex(index_)); }
+    Object* key() const { return map_->KeyAtIndex(index_); }
+    V* entry() const {
+      return reinterpret_cast<V*>(map_->EntryAtIndex(index_));
+    }
+
+    V* operator*() { return entry(); }
+    V* operator->() { return entry(); }
     bool operator!=(const Iterator& other) { return index_ != other.index_; }
 
    private:
diff --git a/deps/v8/src/inspector/DEPS b/deps/v8/src/inspector/DEPS
index 85b506a9568..f396d64b99b 100644
--- a/deps/v8/src/inspector/DEPS
+++ b/deps/v8/src/inspector/DEPS
@@ -7,6 +7,7 @@ include_rules = [
   "+src/base/platform/platform.h",
   "+src/conversions.h",
   "+src/flags.h",
+  "+src/utils.h",
   "+src/unicode-cache.h",
   "+src/inspector",
   "+src/tracing",
diff --git a/deps/v8/src/inspector/injected-script-source.js b/deps/v8/src/inspector/injected-script-source.js
index 0849d44202e..b06e4bd638c 100644
--- a/deps/v8/src/inspector/injected-script-source.js
+++ b/deps/v8/src/inspector/injected-script-source.js
@@ -66,6 +66,8 @@ function toString(obj)
 }
 
 /**
+ * TODO(luoe): remove type-check suppression once bigint is supported by closure.
+ * @suppress {checkTypes}
  * @param {*} obj
  * @return {string}
  */
@@ -73,6 +75,8 @@ function toStringDescription(obj)
 {
     if (typeof obj === "number" && obj === 0 && 1 / obj < 0)
         return "-0"; // Negative zero.
+    if (typeof obj === "bigint")
+        return toString(obj) + "n";
     return toString(obj);
 }
 
@@ -167,6 +171,7 @@ InjectedScript.primitiveTypes = {
     "boolean": true,
     "number": true,
     "string": true,
+    "bigint": true,
     __proto__: null
 }
 
@@ -747,6 +752,13 @@ InjectedScript.RemoteObject = function(object, objectGroupName, doNotBind, force
             }
         }
 
+        // The "n" suffix of bigint primitives are not JSON serializable.
+        if (this.type === "bigint") {
+            delete this.value;
+            this.description = toStringDescription(object);
+            this.unserializableValue = this.description;
+        }
+
         return;
     }
 
@@ -1002,9 +1014,10 @@ InjectedScript.RemoteObject.prototype = {
 
             var maxLength = 100;
             if (InjectedScript.primitiveTypes[type]) {
-                if (type === "string" && value.length > maxLength)
-                    value = this._abbreviateString(value, maxLength, true);
-                push(preview.properties, { name: name, type: type, value: toStringDescription(value), __proto__: null });
+                var valueString = type === "string" ? value : toStringDescription(value);
+                if (valueString.length > maxLength)
+                    valueString = this._abbreviateString(valueString, maxLength, true);
+                push(preview.properties, { name: name, type: type, value: valueString, __proto__: null });
                 continue;
             }
 
diff --git a/deps/v8/src/inspector/injected-script.cc b/deps/v8/src/inspector/injected-script.cc
index a5e981cda50..d51b201bcec 100644
--- a/deps/v8/src/inspector/injected-script.cc
+++ b/deps/v8/src/inspector/injected-script.cc
@@ -49,6 +49,10 @@ namespace v8_inspector {
 
 namespace {
 static const char privateKeyName[] = "v8-inspector#injectedScript";
+static const char kGlobalHandleLabel[] = "DevTools console";
+static bool isResolvableNumberLike(String16 query) {
+  return query == "Infinity" || query == "-Infinity" || query == "NaN";
+}
 }  // namespace
 
 using protocol::Array;
@@ -511,6 +515,7 @@ v8::Local<v8::Value> InjectedScript::lastEvaluationResult() const {
 
 void InjectedScript::setLastEvaluationResult(v8::Local<v8::Value> result) {
   m_lastEvaluationResult.Reset(m_context->isolate(), result);
+  m_lastEvaluationResult.AnnotateStrongRetainer(kGlobalHandleLabel);
 }
 
 Response InjectedScript::resolveCallArgument(
@@ -528,10 +533,17 @@ Response InjectedScript::resolveCallArgument(
     return findObject(*remoteObjectId, result);
   }
   if (callArgument->hasValue() || callArgument->hasUnserializableValue()) {
-    String16 value =
-        callArgument->hasValue()
-            ? "(" + callArgument->getValue(nullptr)->serialize() + ")"
-            : "Number(\"" + callArgument->getUnserializableValue("") + "\")";
+    String16 value;
+    if (callArgument->hasValue()) {
+      value = "(" + callArgument->getValue(nullptr)->serialize() + ")";
+    } else {
+      String16 unserializableValue = callArgument->getUnserializableValue("");
+      // Protect against potential identifier resolution for NaN and Infinity.
+      if (isResolvableNumberLike(unserializableValue))
+        value = "Number(\"" + unserializableValue + "\")";
+      else
+        value = unserializableValue;
+    }
     if (!m_context->inspector()
              ->compileAndRunInternalScript(
                  m_context->context(), toV8String(m_context->isolate(), value))
@@ -601,9 +613,14 @@ Response InjectedScript::wrapEvaluateResult(
     Response response = wrapObject(resultValue, objectGroup, returnByValue,
                                    generatePreview, result);
     if (!response.isSuccess()) return response;
-    if (objectGroup == "console")
+    if (objectGroup == "console") {
       m_lastEvaluationResult.Reset(m_context->isolate(), resultValue);
+      m_lastEvaluationResult.AnnotateStrongRetainer(kGlobalHandleLabel);
+    }
   } else {
+    if (tryCatch.HasTerminated() || !tryCatch.CanContinue()) {
+      return Response::Error("Execution was terminated");
+    }
     v8::Local<v8::Value> exception = tryCatch.Exception();
     Response response =
         wrapObject(exception, objectGroup, false,
@@ -624,6 +641,7 @@ v8::Local<v8::Object> InjectedScript::commandLineAPI() {
         m_context->isolate(),
         m_context->inspector()->console()->createCommandLineAPI(
             m_context->context(), m_sessionId));
+    m_commandLineAPI.AnnotateStrongRetainer(kGlobalHandleLabel);
   }
   return m_commandLineAPI.Get(m_context->isolate());
 }
@@ -769,6 +787,7 @@ int InjectedScript::bindObject(v8::Local<v8::Value> value,
   if (m_lastBoundObjectId <= 0) m_lastBoundObjectId = 1;
   int id = m_lastBoundObjectId++;
   m_idToWrappedObject[id].Reset(m_context->isolate(), value);
+  m_idToWrappedObject[id].AnnotateStrongRetainer(kGlobalHandleLabel);
 
   if (!groupName.isEmpty() && id > 0) {
     m_idToObjectGroupName[id] = groupName;
diff --git a/deps/v8/src/inspector/injected-script.h b/deps/v8/src/inspector/injected-script.h
index 16938fb317b..90a1ed31713 100644
--- a/deps/v8/src/inspector/injected-script.h
+++ b/deps/v8/src/inspector/injected-script.h
@@ -28,8 +28,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8_INSPECTOR_INJECTEDSCRIPT_H_
-#define V8_INSPECTOR_INJECTEDSCRIPT_H_
+#ifndef V8_INSPECTOR_INJECTED_SCRIPT_H_
+#define V8_INSPECTOR_INJECTED_SCRIPT_H_
 
 #include <unordered_map>
 #include <unordered_set>
@@ -220,4 +220,4 @@ class InjectedScript final {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_INJECTEDSCRIPT_H_
+#endif  // V8_INSPECTOR_INJECTED_SCRIPT_H_
diff --git a/deps/v8/src/inspector/inspected-context.h b/deps/v8/src/inspector/inspected-context.h
index ac33071f623..ef0a0ca52a0 100644
--- a/deps/v8/src/inspector/inspected-context.h
+++ b/deps/v8/src/inspector/inspected-context.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_INSPECTEDCONTEXT_H_
-#define V8_INSPECTOR_INSPECTEDCONTEXT_H_
+#ifndef V8_INSPECTOR_INSPECTED_CONTEXT_H_
+#define V8_INSPECTOR_INSPECTED_CONTEXT_H_
 
 #include <unordered_map>
 #include <unordered_set>
@@ -65,4 +65,4 @@ class InspectedContext {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_INSPECTEDCONTEXT_H_
+#endif  // V8_INSPECTOR_INSPECTED_CONTEXT_H_
diff --git a/deps/v8/src/inspector/inspector.gypi b/deps/v8/src/inspector/inspector.gypi
deleted file mode 100644
index d6443283f5a..00000000000
--- a/deps/v8/src/inspector/inspector.gypi
+++ /dev/null
@@ -1,90 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'variables': {
-    'inspector_generated_sources': [
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Forward.h',
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Protocol.cpp',
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Protocol.h',
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Console.cpp',
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Console.h',
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Debugger.cpp',
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Debugger.h',
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/HeapProfiler.cpp',
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/HeapProfiler.h',
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Profiler.cpp',
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Profiler.h',
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Runtime.cpp',
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Runtime.h',
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Schema.cpp',
-      '<(SHARED_INTERMEDIATE_DIR)/src/inspector/protocol/Schema.h',
-      '<(SHARED_INTERMEDIATE_DIR)/include/inspector/Debugger.h',
-      '<(SHARED_INTERMEDIATE_DIR)/include/inspector/Runtime.h',
-      '<(SHARED_INTERMEDIATE_DIR)/include/inspector/Schema.h',
-    ],
-
-    'inspector_injected_script_source': 'injected-script-source.js',
-    'inspector_generated_injected_script': '<(SHARED_INTERMEDIATE_DIR)/src/inspector/injected-script-source.h',
-
-    'inspector_all_sources': [
-      '<@(inspector_generated_sources)',
-      '<(inspector_generated_injected_script)',
-      '../include/v8-inspector.h',
-      '../include/v8-inspector-protocol.h',
-      'inspector/injected-script.cc',
-      'inspector/injected-script.h',
-      'inspector/inspected-context.cc',
-      'inspector/inspected-context.h',
-      'inspector/remote-object-id.cc',
-      'inspector/remote-object-id.h',
-      'inspector/search-util.cc',
-      'inspector/search-util.h',
-      'inspector/string-16.cc',
-      'inspector/string-16.h',
-      'inspector/string-util.cc',
-      'inspector/string-util.h',
-      'inspector/test-interface.cc',
-      'inspector/test-interface.h',
-      'inspector/v8-console.cc',
-      'inspector/v8-console.h',
-      'inspector/v8-console-agent-impl.cc',
-      'inspector/v8-console-agent-impl.h',
-      'inspector/v8-console-message.cc',
-      'inspector/v8-console-message.h',
-      'inspector/v8-debugger.cc',
-      'inspector/v8-debugger.h',
-      'inspector/v8-debugger-agent-impl.cc',
-      'inspector/v8-debugger-agent-impl.h',
-      'inspector/v8-debugger-script.cc',
-      'inspector/v8-debugger-script.h',
-      'inspector/v8-function-call.cc',
-      'inspector/v8-function-call.h',
-      'inspector/v8-heap-profiler-agent-impl.cc',
-      'inspector/v8-heap-profiler-agent-impl.h',
-      'inspector/v8-injected-script-host.cc',
-      'inspector/v8-injected-script-host.h',
-      'inspector/v8-inspector-impl.cc',
-      'inspector/v8-inspector-impl.h',
-      'inspector/v8-inspector-session-impl.cc',
-      'inspector/v8-inspector-session-impl.h',
-      'inspector/v8-internal-value-type.cc',
-      'inspector/v8-internal-value-type.h',
-      'inspector/v8-profiler-agent-impl.cc',
-      'inspector/v8-profiler-agent-impl.h',
-      'inspector/v8-regex.cc',
-      'inspector/v8-regex.h',
-      'inspector/v8-runtime-agent-impl.cc',
-      'inspector/v8-runtime-agent-impl.h',
-      'inspector/v8-schema-agent-impl.cc',
-      'inspector/v8-schema-agent-impl.h',
-      'inspector/v8-stack-trace-impl.cc',
-      'inspector/v8-stack-trace-impl.h',
-      'inspector/v8-value-utils.cc',
-      'inspector/v8-value-utils.h',
-      'inspector/wasm-translation.cc',
-      'inspector/wasm-translation.h',
-    ]
-  }
-}
diff --git a/deps/v8/src/inspector/inspector_protocol_config.json b/deps/v8/src/inspector/inspector_protocol_config.json
index fdb2b64b905..fa073128b35 100644
--- a/deps/v8/src/inspector/inspector_protocol_config.json
+++ b/deps/v8/src/inspector/inspector_protocol_config.json
@@ -11,7 +11,7 @@
             },
             {
                 "domain": "Runtime",
-                "async": ["evaluate", "awaitPromise", "callFunctionOn", "runScript"],
+                "async": ["evaluate", "awaitPromise", "callFunctionOn", "runScript", "terminateExecution"],
                 "exported": ["StackTrace", "StackTraceId", "RemoteObject", "ExecutionContextId"]
             },
             {
diff --git a/deps/v8/src/inspector/js_protocol.json b/deps/v8/src/inspector/js_protocol.json
index a0f7fcd7eda..eb8785dfdef 100644
--- a/deps/v8/src/inspector/js_protocol.json
+++ b/deps/v8/src/inspector/js_protocol.json
@@ -1781,14 +1781,8 @@
                 },
                 {
                     "id": "UnserializableValue",
-                    "description": "Primitive value which cannot be JSON-stringified.",
-                    "type": "string",
-                    "enum": [
-                        "Infinity",
-                        "NaN",
-                        "-Infinity",
-                        "-0"
-                    ]
+                    "description": "Primitive value which cannot be JSON-stringified. Includes values `-0`, `NaN`, `Infinity`,\n`-Infinity`, and bigint literals.",
+                    "type": "string"
                 },
                 {
                     "id": "RemoteObject",
@@ -1806,7 +1800,8 @@
                                 "string",
                                 "number",
                                 "boolean",
-                                "symbol"
+                                "symbol",
+                                "bigint"
                             ]
                         },
                         {
@@ -1922,7 +1917,8 @@
                                 "string",
                                 "number",
                                 "boolean",
-                                "symbol"
+                                "symbol",
+                                "bigint"
                             ]
                         },
                         {
@@ -1997,7 +1993,8 @@
                                 "number",
                                 "boolean",
                                 "symbol",
-                                "accessor"
+                                "accessor",
+                                "bigint"
                             ]
                         },
                         {
@@ -2573,6 +2570,13 @@
                             "description": "Whether execution should `await` for resulting value and return once awaited promise is\nresolved.",
                             "optional": true,
                             "type": "boolean"
+                        },
+                        {
+                            "name": "throwOnSideEffect",
+                            "description": "Whether to throw an exception if side effect cannot be ruled out during evaluation.",
+                            "experimental": true,
+                            "optional": true,
+                            "type": "boolean"
                         }
                     ],
                     "returns": [
@@ -2589,6 +2593,35 @@
                         }
                     ]
                 },
+                {
+                    "name": "getIsolateId",
+                    "description": "Returns the isolate id.",
+                    "experimental": true,
+                    "returns": [
+                        {
+                            "name": "id",
+                            "description": "The isolate id.",
+                            "type": "string"
+                        }
+                    ]
+                },
+                {
+                    "name": "getHeapUsage",
+                    "description": "Returns the JavaScript heap usage.\nIt is the total usage of the corresponding isolate not scoped to a particular Runtime.",
+                    "experimental": true,
+                    "returns": [
+                        {
+                            "name": "usedSize",
+                            "description": "Used heap size in bytes.",
+                            "type": "number"
+                        },
+                        {
+                            "name": "totalSize",
+                            "description": "Allocated heap size in bytes.",
+                            "type": "number"
+                        }
+                    ]
+                },
                 {
                     "name": "getProperties",
                     "description": "Returns properties of a given object. Object group of the result is inherited from the target\nobject.",
@@ -2673,6 +2706,12 @@
                             "name": "prototypeObjectId",
                             "description": "Identifier of the prototype to return objects for.",
                             "$ref": "RemoteObjectId"
+                        },
+                        {
+                            "name": "objectGroup",
+                            "description": "Symbolic group name that can be used to release the results.",
+                            "optional": true,
+                            "type": "string"
                         }
                     ],
                     "returns": [
@@ -2784,6 +2823,11 @@
                             "type": "boolean"
                         }
                     ]
+                },
+                {
+                    "name": "terminateExecution",
+                    "description": "Terminate current or next JavaScript execution.\nWill cancel the termination when the outer-most script execution ends.",
+                    "experimental": true
                 }
             ],
             "events": [
diff --git a/deps/v8/src/inspector/js_protocol.pdl b/deps/v8/src/inspector/js_protocol.pdl
index 5a23199e4a2..d6e239cfb53 100644
--- a/deps/v8/src/inspector/js_protocol.pdl
+++ b/deps/v8/src/inspector/js_protocol.pdl
@@ -823,13 +823,9 @@ domain Runtime
   # Unique object identifier.
   type RemoteObjectId extends string
 
-  # Primitive value which cannot be JSON-stringified.
+  # Primitive value which cannot be JSON-stringified. Includes values `-0`, `NaN`, `Infinity`,
+  # `-Infinity`, and bigint literals.
   type UnserializableValue extends string
-    enum
-      Infinity
-      NaN
-      -Infinity
-      -0
 
   # Mirror object referencing original JavaScript object.
   type RemoteObject extends object
@@ -843,6 +839,7 @@ domain Runtime
         number
         boolean
         symbol
+        bigint
       # Object subtype hint. Specified for `object` type values only.
       optional enum subtype
         array
@@ -895,6 +892,7 @@ domain Runtime
         number
         boolean
         symbol
+        bigint
       # Object subtype hint. Specified for `object` type values only.
       optional enum subtype
         array
@@ -932,6 +930,7 @@ domain Runtime
         boolean
         symbol
         accessor
+        bigint
       # User-friendly property value string.
       optional string value
       # Nested value preview.
@@ -1188,12 +1187,29 @@ domain Runtime
       # Whether execution should `await` for resulting value and return once awaited promise is
       # resolved.
       optional boolean awaitPromise
+      # Whether to throw an exception if side effect cannot be ruled out during evaluation.
+      experimental optional boolean throwOnSideEffect
     returns
       # Evaluation result.
       RemoteObject result
       # Exception details.
       optional ExceptionDetails exceptionDetails
 
+  # Returns the isolate id.
+  experimental command getIsolateId
+    returns
+      # The isolate id.
+      string id
+
+  # Returns the JavaScript heap usage.
+  # It is the total usage of the corresponding isolate not scoped to a particular Runtime.
+  experimental command getHeapUsage
+    returns
+      # Used heap size in bytes.
+      number usedSize
+      # Allocated heap size in bytes.
+      number totalSize
+
   # Returns properties of a given object. Object group of the result is inherited from the target
   # object.
   command getProperties
@@ -1228,6 +1244,8 @@ domain Runtime
     parameters
       # Identifier of the prototype to return objects for.
       RemoteObjectId prototypeObjectId
+      # Symbolic group name that can be used to release the results.
+      optional string objectGroup
     returns
       # Array with objects.
       RemoteObject objects
@@ -1279,6 +1297,10 @@ domain Runtime
     parameters
       boolean enabled
 
+  # Terminate current or next JavaScript execution.
+  # Will cancel the termination when the outer-most script execution ends.
+  experimental command terminateExecution
+
   # Issued when console API was called.
   event consoleAPICalled
     parameters
diff --git a/deps/v8/src/inspector/remote-object-id.h b/deps/v8/src/inspector/remote-object-id.h
index 3e6928a87e2..923274236d5 100644
--- a/deps/v8/src/inspector/remote-object-id.h
+++ b/deps/v8/src/inspector/remote-object-id.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_REMOTEOBJECTID_H_
-#define V8_INSPECTOR_REMOTEOBJECTID_H_
+#ifndef V8_INSPECTOR_REMOTE_OBJECT_ID_H_
+#define V8_INSPECTOR_REMOTE_OBJECT_ID_H_
 
 #include "src/inspector/protocol/Forward.h"
 
@@ -54,4 +54,4 @@ class RemoteCallFrameId final : public RemoteObjectIdBase {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_REMOTEOBJECTID_H_
+#endif  // V8_INSPECTOR_REMOTE_OBJECT_ID_H_
diff --git a/deps/v8/src/inspector/search-util.h b/deps/v8/src/inspector/search-util.h
index 8f5753b6202..3c8a9fe31ca 100644
--- a/deps/v8/src/inspector/search-util.h
+++ b/deps/v8/src/inspector/search-util.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_SEARCHUTIL_H_
-#define V8_INSPECTOR_SEARCHUTIL_H_
+#ifndef V8_INSPECTOR_SEARCH_UTIL_H_
+#define V8_INSPECTOR_SEARCH_UTIL_H_
 
 #include "src/inspector/protocol/Debugger.h"
 #include "src/inspector/string-util.h"
@@ -21,4 +21,4 @@ searchInTextByLinesImpl(V8InspectorSession*, const String16& text,
 
 }  //  namespace v8_inspector
 
-#endif  // V8_INSPECTOR_SEARCHUTIL_H_
+#endif  // V8_INSPECTOR_SEARCH_UTIL_H_
diff --git a/deps/v8/src/inspector/string-16.cc b/deps/v8/src/inspector/string-16.cc
index dc753fee40e..f5d8556da88 100644
--- a/deps/v8/src/inspector/string-16.cc
+++ b/deps/v8/src/inspector/string-16.cc
@@ -136,16 +136,19 @@ ConversionResult convertUTF16ToUTF8(const UChar** sourceStart,
       result = targetExhausted;
       break;
     }
-    switch (bytesToWrite) {  // note: everything falls through.
+    switch (bytesToWrite) {
       case 4:
         *--target = static_cast<char>((ch | byteMark) & byteMask);
         ch >>= 6;
+        V8_FALLTHROUGH;
       case 3:
         *--target = static_cast<char>((ch | byteMark) & byteMask);
         ch >>= 6;
+        V8_FALLTHROUGH;
       case 2:
         *--target = static_cast<char>((ch | byteMark) & byteMask);
         ch >>= 6;
+        V8_FALLTHROUGH;
       case 1:
         *--target = static_cast<char>(ch | firstByteMark[bytesToWrite]);
     }
@@ -210,8 +213,10 @@ static bool isLegalUTF8(const unsigned char* source, int length) {
     // Everything else falls through when "true"...
     case 4:
       if ((a = (*--srcptr)) < 0x80 || a > 0xBF) return false;
+      V8_FALLTHROUGH;
     case 3:
       if ((a = (*--srcptr)) < 0x80 || a > 0xBF) return false;
+      V8_FALLTHROUGH;
     case 2:
       if ((a = (*--srcptr)) > 0xBF) return false;
 
@@ -232,6 +237,7 @@ static bool isLegalUTF8(const unsigned char* source, int length) {
         default:
           if (a < 0x80) return false;
       }
+      V8_FALLTHROUGH;
 
     case 1:
       if (*source >= 0x80 && *source < 0xC2) return false;
@@ -258,18 +264,23 @@ static inline UChar32 readUTF8Sequence(const char*& sequence, size_t length) {
     case 6:
       character += static_cast<unsigned char>(*sequence++);
       character <<= 6;
+      V8_FALLTHROUGH;
     case 5:
       character += static_cast<unsigned char>(*sequence++);
       character <<= 6;
+      V8_FALLTHROUGH;
     case 4:
       character += static_cast<unsigned char>(*sequence++);
       character <<= 6;
+      V8_FALLTHROUGH;
     case 3:
       character += static_cast<unsigned char>(*sequence++);
       character <<= 6;
+      V8_FALLTHROUGH;
     case 2:
       character += static_cast<unsigned char>(*sequence++);
       character <<= 6;
+      V8_FALLTHROUGH;
     case 1:
       character += static_cast<unsigned char>(*sequence++);
   }
@@ -482,22 +493,39 @@ void String16Builder::append(const char* characters, size_t length) {
 }
 
 void String16Builder::appendNumber(int number) {
-  const int kBufferSize = 11;
+  constexpr int kBufferSize = 11;
   char buffer[kBufferSize];
   int chars = v8::base::OS::SNPrintF(buffer, kBufferSize, "%d", number);
-  DCHECK_GT(kBufferSize, chars);
+  DCHECK_LE(0, chars);
   m_buffer.insert(m_buffer.end(), buffer, buffer + chars);
 }
 
 void String16Builder::appendNumber(size_t number) {
-  const int kBufferSize = 20;
+  constexpr int kBufferSize = 20;
   char buffer[kBufferSize];
 #if !defined(_WIN32) && !defined(_WIN64)
   int chars = v8::base::OS::SNPrintF(buffer, kBufferSize, "%zu", number);
 #else
   int chars = v8::base::OS::SNPrintF(buffer, kBufferSize, "%Iu", number);
 #endif
-  DCHECK_GT(kBufferSize, chars);
+  DCHECK_LE(0, chars);
+  m_buffer.insert(m_buffer.end(), buffer, buffer + chars);
+}
+
+void String16Builder::appendUnsignedAsHex(uint64_t number) {
+  constexpr int kBufferSize = 17;
+  char buffer[kBufferSize];
+  int chars =
+      v8::base::OS::SNPrintF(buffer, kBufferSize, "%016" PRIx64, number);
+  DCHECK_LE(0, chars);
+  m_buffer.insert(m_buffer.end(), buffer, buffer + chars);
+}
+
+void String16Builder::appendUnsignedAsHex(uint32_t number) {
+  constexpr int kBufferSize = 9;
+  char buffer[kBufferSize];
+  int chars = v8::base::OS::SNPrintF(buffer, kBufferSize, "%08" PRIx32, number);
+  DCHECK_LE(0, chars);
   m_buffer.insert(m_buffer.end(), buffer, buffer + chars);
 }
 
diff --git a/deps/v8/src/inspector/string-16.h b/deps/v8/src/inspector/string-16.h
index 1dc9350e966..461b2961e15 100644
--- a/deps/v8/src/inspector/string-16.h
+++ b/deps/v8/src/inspector/string-16.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_STRING16_H_
-#define V8_INSPECTOR_STRING16_H_
+#ifndef V8_INSPECTOR_STRING_16_H_
+#define V8_INSPECTOR_STRING_16_H_
 
 #include <stdint.h>
 #include <cctype>
@@ -112,6 +112,8 @@ class String16Builder {
   void append(const char*, size_t);
   void appendNumber(int);
   void appendNumber(size_t);
+  void appendUnsignedAsHex(uint64_t);
+  void appendUnsignedAsHex(uint32_t);
   String16 toString();
   void reserveCapacity(size_t);
 
@@ -149,4 +151,4 @@ struct hash<v8_inspector::String16> {
 
 #endif  // !defined(__APPLE__) || defined(_LIBCPP_VERSION)
 
-#endif  // V8_INSPECTOR_STRING16_H_
+#endif  // V8_INSPECTOR_STRING_16_H_
diff --git a/deps/v8/src/inspector/string-util.h b/deps/v8/src/inspector/string-util.h
index 8aaf3ce850d..0c025ef93a4 100644
--- a/deps/v8/src/inspector/string-util.h
+++ b/deps/v8/src/inspector/string-util.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_STRINGUTIL_H_
-#define V8_INSPECTOR_STRINGUTIL_H_
+#ifndef V8_INSPECTOR_STRING_UTIL_H_
+#define V8_INSPECTOR_STRING_UTIL_H_
 
 #include <memory>
 
@@ -92,4 +92,4 @@ String16 stackTraceIdToString(uintptr_t id);
 
 }  //  namespace v8_inspector
 
-#endif  // V8_INSPECTOR_STRINGUTIL_H_
+#endif  // V8_INSPECTOR_STRING_UTIL_H_
diff --git a/deps/v8/src/inspector/test-interface.h b/deps/v8/src/inspector/test-interface.h
index 70fbca186f8..946d1f6020c 100644
--- a/deps/v8/src/inspector/test-interface.h
+++ b/deps/v8/src/inspector/test-interface.h
@@ -16,4 +16,4 @@ V8_EXPORT void DumpAsyncTaskStacksStateForTest(V8Inspector* inspector);
 
 }  //  v8_inspector
 
-#endif  //  V8_INSPECTOR_TEST_INTERFACE_H_
+#endif  // V8_INSPECTOR_TEST_INTERFACE_H_
diff --git a/deps/v8/src/inspector/v8-console-agent-impl.h b/deps/v8/src/inspector/v8-console-agent-impl.h
index db17e547182..f436aa2f5cb 100644
--- a/deps/v8/src/inspector/v8-console-agent-impl.h
+++ b/deps/v8/src/inspector/v8-console-agent-impl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_V8CONSOLEAGENTIMPL_H_
-#define V8_INSPECTOR_V8CONSOLEAGENTIMPL_H_
+#ifndef V8_INSPECTOR_V8_CONSOLE_AGENT_IMPL_H_
+#define V8_INSPECTOR_V8_CONSOLE_AGENT_IMPL_H_
 
 #include "src/base/macros.h"
 #include "src/inspector/protocol/Console.h"
@@ -45,4 +45,4 @@ class V8ConsoleAgentImpl : public protocol::Console::Backend {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8CONSOLEAGENTIMPL_H_
+#endif  // V8_INSPECTOR_V8_CONSOLE_AGENT_IMPL_H_
diff --git a/deps/v8/src/inspector/v8-console-message.cc b/deps/v8/src/inspector/v8-console-message.cc
index e96e89c0eb6..83aee258255 100644
--- a/deps/v8/src/inspector/v8-console-message.cc
+++ b/deps/v8/src/inspector/v8-console-message.cc
@@ -58,6 +58,7 @@ String16 consoleAPITypeValue(ConsoleAPIType type) {
   return protocol::Runtime::ConsoleAPICalled::TypeEnum::Log;
 }
 
+const char kGlobalConsoleMessageHandleLabel[] = "DevTools console";
 const unsigned maxConsoleMessageCount = 1000;
 const int maxConsoleMessageV8Size = 10 * 1024 * 1024;
 const unsigned maxArrayItemsLimit = 10000;
@@ -91,6 +92,9 @@ class V8ValueStringBuilder {
     if (value->IsString()) return append(v8::Local<v8::String>::Cast(value));
     if (value->IsStringObject())
       return append(v8::Local<v8::StringObject>::Cast(value)->ValueOf());
+    if (value->IsBigInt()) return append(v8::Local<v8::BigInt>::Cast(value));
+    if (value->IsBigIntObject())
+      return append(v8::Local<v8::BigIntObject>::Cast(value)->ValueOf());
     if (value->IsSymbol()) return append(v8::Local<v8::Symbol>::Cast(value));
     if (value->IsSymbolObject())
       return append(v8::Local<v8::SymbolObject>::Cast(value)->ValueOf());
@@ -155,6 +159,13 @@ class V8ValueStringBuilder {
     return result;
   }
 
+  bool append(v8::Local<v8::BigInt> bigint) {
+    bool result = append(bigint->ToString());
+    if (m_tryCatch.HasCaught()) return false;
+    m_builder.append('n');
+    return result;
+  }
+
   bool append(v8::Local<v8::String> string) {
     if (m_tryCatch.HasCaught()) return false;
     if (!string.IsEmpty()) m_builder.append(toProtocolString(string));
@@ -379,8 +390,10 @@ std::unique_ptr<V8ConsoleMessage> V8ConsoleMessage::createForConsoleAPI(
   message->m_type = type;
   message->m_contextId = contextId;
   for (size_t i = 0; i < arguments.size(); ++i) {
-    message->m_arguments.push_back(std::unique_ptr<v8::Global<v8::Value>>(
-        new v8::Global<v8::Value>(isolate, arguments.at(i))));
+    std::unique_ptr<v8::Global<v8::Value>> argument(
+        new v8::Global<v8::Value>(isolate, arguments.at(i)));
+    argument->AnnotateStrongRetainer(kGlobalConsoleMessageHandleLabel);
+    message->m_arguments.push_back(std::move(argument));
     message->m_v8Size +=
         v8::debug::EstimatedValueSize(isolate, arguments.at(i));
   }
diff --git a/deps/v8/src/inspector/v8-console-message.h b/deps/v8/src/inspector/v8-console-message.h
index f82f8e5a133..103cb9002b6 100644
--- a/deps/v8/src/inspector/v8-console-message.h
+++ b/deps/v8/src/inspector/v8-console-message.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_V8CONSOLEMESSAGE_H_
-#define V8_INSPECTOR_V8CONSOLEMESSAGE_H_
+#ifndef V8_INSPECTOR_V8_CONSOLE_MESSAGE_H_
+#define V8_INSPECTOR_V8_CONSOLE_MESSAGE_H_
 
 #include <deque>
 #include <map>
@@ -138,4 +138,4 @@ class V8ConsoleMessageStorage {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8CONSOLEMESSAGE_H_
+#endif  // V8_INSPECTOR_V8_CONSOLE_MESSAGE_H_
diff --git a/deps/v8/src/inspector/v8-console.cc b/deps/v8/src/inspector/v8-console.cc
index fa04209dece..6f3278ee9f7 100644
--- a/deps/v8/src/inspector/v8-console.cc
+++ b/deps/v8/src/inspector/v8-console.cc
@@ -484,23 +484,15 @@ void V8Console::valuesCallback(const v8::FunctionCallbackInfo<v8::Value>& info,
 static void setFunctionBreakpoint(ConsoleHelper& helper, int sessionId,
                                   v8::Local<v8::Function> function,
                                   V8DebuggerAgentImpl::BreakpointSource source,
-                                  const String16& condition, bool enable) {
-  String16 scriptId = String16::fromInteger(function->ScriptId());
-  int lineNumber = function->GetScriptLineNumber();
-  int columnNumber = function->GetScriptColumnNumber();
-  if (lineNumber == v8::Function::kLineOffsetNotFound ||
-      columnNumber == v8::Function::kLineOffsetNotFound)
-    return;
-
-  if (V8InspectorSessionImpl* session = helper.session(sessionId)) {
-    if (!session->debuggerAgent()->enabled()) return;
-    if (enable) {
-      session->debuggerAgent()->setBreakpointAt(
-          scriptId, lineNumber, columnNumber, source, condition);
-    } else {
-      session->debuggerAgent()->removeBreakpointAt(scriptId, lineNumber,
-                                                   columnNumber, source);
-    }
+                                  v8::Local<v8::String> condition,
+                                  bool enable) {
+  V8InspectorSessionImpl* session = helper.session(sessionId);
+  if (session == nullptr) return;
+  if (!session->debuggerAgent()->enabled()) return;
+  if (enable) {
+    session->debuggerAgent()->setBreakpointFor(function, condition, source);
+  } else {
+    session->debuggerAgent()->removeBreakpointFor(function, source);
   }
 }
 
@@ -509,10 +501,14 @@ void V8Console::debugFunctionCallback(
   v8::debug::ConsoleCallArguments args(info);
   ConsoleHelper helper(args, v8::debug::ConsoleContext(), m_inspector);
   v8::Local<v8::Function> function;
+  v8::Local<v8::String> condition;
   if (!helper.firstArgAsFunction().ToLocal(&function)) return;
+  if (args.Length() > 1 && args[1]->IsString()) {
+    condition = args[1].As<v8::String>();
+  }
   setFunctionBreakpoint(helper, sessionId, function,
                         V8DebuggerAgentImpl::DebugCommandBreakpointSource,
-                        String16(), true);
+                        condition, true);
 }
 
 void V8Console::undebugFunctionCallback(
@@ -523,7 +519,7 @@ void V8Console::undebugFunctionCallback(
   if (!helper.firstArgAsFunction().ToLocal(&function)) return;
   setFunctionBreakpoint(helper, sessionId, function,
                         V8DebuggerAgentImpl::DebugCommandBreakpointSource,
-                        String16(), false);
+                        v8::Local<v8::String>(), false);
 }
 
 void V8Console::monitorFunctionCallback(
@@ -547,7 +543,8 @@ void V8Console::monitorFunctionCallback(
       "Array.prototype.join.call(arguments, \", \") : \"\")) && false");
   setFunctionBreakpoint(helper, sessionId, function,
                         V8DebuggerAgentImpl::MonitorCommandBreakpointSource,
-                        builder.toString(), true);
+                        toV8String(info.GetIsolate(), builder.toString()),
+                        true);
 }
 
 void V8Console::unmonitorFunctionCallback(
@@ -558,7 +555,7 @@ void V8Console::unmonitorFunctionCallback(
   if (!helper.firstArgAsFunction().ToLocal(&function)) return;
   setFunctionBreakpoint(helper, sessionId, function,
                         V8DebuggerAgentImpl::MonitorCommandBreakpointSource,
-                        String16(), false);
+                        v8::Local<v8::String>(), false);
 }
 
 void V8Console::lastEvaluationResultCallback(
@@ -711,7 +708,7 @@ v8::Local<v8::Object> V8Console::createCommandLineAPI(
   createBoundFunctionProperty(
       context, commandLineAPI, data, "debug",
       &V8Console::call<&V8Console::debugFunctionCallback>,
-      "function debug(function) { [Command Line API] }");
+      "function debug(function, condition) { [Command Line API] }");
   createBoundFunctionProperty(
       context, commandLineAPI, data, "undebug",
       &V8Console::call<&V8Console::undebugFunctionCallback>,
diff --git a/deps/v8/src/inspector/v8-console.h b/deps/v8/src/inspector/v8-console.h
index ba4dfe328bf..311625efde5 100644
--- a/deps/v8/src/inspector/v8-console.h
+++ b/deps/v8/src/inspector/v8-console.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_V8CONSOLE_H_
-#define V8_INSPECTOR_V8CONSOLE_H_
+#ifndef V8_INSPECTOR_V8_CONSOLE_H_
+#define V8_INSPECTOR_V8_CONSOLE_H_
 
 #include "src/base/macros.h"
 
@@ -172,4 +172,4 @@ class V8Console : public v8::debug::ConsoleDelegate {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8CONSOLE_H_
+#endif  // V8_INSPECTOR_V8_CONSOLE_H_
diff --git a/deps/v8/src/inspector/v8-debugger-agent-impl.cc b/deps/v8/src/inspector/v8-debugger-agent-impl.cc
index 7bfde09b71a..ece808b58bc 100644
--- a/deps/v8/src/inspector/v8-debugger-agent-impl.cc
+++ b/deps/v8/src/inspector/v8-debugger-agent-impl.cc
@@ -57,6 +57,8 @@ static const char kDebuggerNotPaused[] =
 static const size_t kBreakpointHintMaxLength = 128;
 static const intptr_t kBreakpointHintMaxSearchOffset = 80 * 10;
 
+static const int kMaxScriptFailedToParseScripts = 1000;
+
 namespace {
 
 void TranslateLocation(protocol::Debugger::Location* location,
@@ -95,25 +97,38 @@ String16 generateBreakpointId(BreakpointType type,
   return builder.toString();
 }
 
+String16 generateBreakpointId(BreakpointType type,
+                              v8::Local<v8::Function> function) {
+  String16Builder builder;
+  builder.appendNumber(static_cast<int>(type));
+  builder.append(':');
+  builder.appendNumber(v8::debug::GetDebuggingId(function));
+  return builder.toString();
+}
+
 bool parseBreakpointId(const String16& breakpointId, BreakpointType* type,
                        String16* scriptSelector = nullptr,
                        int* lineNumber = nullptr, int* columnNumber = nullptr) {
   size_t typeLineSeparator = breakpointId.find(':');
   if (typeLineSeparator == String16::kNotFound) return false;
+
+  int rawType = breakpointId.substring(0, typeLineSeparator).toInteger();
+  if (rawType < static_cast<int>(BreakpointType::kByUrl) ||
+      rawType > static_cast<int>(BreakpointType::kMonitorCommand)) {
+    return false;
+  }
+  if (type) *type = static_cast<BreakpointType>(rawType);
+  if (rawType == static_cast<int>(BreakpointType::kDebugCommand) ||
+      rawType == static_cast<int>(BreakpointType::kMonitorCommand)) {
+    // The script and source position is not encoded in this case.
+    return true;
+  }
+
   size_t lineColumnSeparator = breakpointId.find(':', typeLineSeparator + 1);
   if (lineColumnSeparator == String16::kNotFound) return false;
   size_t columnSelectorSeparator =
       breakpointId.find(':', lineColumnSeparator + 1);
   if (columnSelectorSeparator == String16::kNotFound) return false;
-
-  if (type) {
-    int rawType = breakpointId.substring(0, typeLineSeparator).toInteger();
-    if (rawType < static_cast<int>(BreakpointType::kByUrl) ||
-        rawType > static_cast<int>(BreakpointType::kMonitorCommand)) {
-      return false;
-    }
-    *type = static_cast<BreakpointType>(rawType);
-  }
   if (scriptSelector) {
     *scriptSelector = breakpointId.substring(columnSelectorSeparator + 1);
   }
@@ -820,6 +835,19 @@ V8DebuggerAgentImpl::setBreakpointImpl(const String16& breakpointId,
       .build();
 }
 
+void V8DebuggerAgentImpl::setBreakpointImpl(const String16& breakpointId,
+                                            v8::Local<v8::Function> function,
+                                            v8::Local<v8::String> condition) {
+  v8::debug::BreakpointId debuggerBreakpointId;
+  if (!v8::debug::SetFunctionBreakpoint(function, condition,
+                                        &debuggerBreakpointId)) {
+    return;
+  }
+  m_debuggerBreakpointIdToBreakpointId[debuggerBreakpointId] = breakpointId;
+  m_breakpointIdToDebuggerBreakpointIds[breakpointId].push_back(
+      debuggerBreakpointId);
+}
+
 Response V8DebuggerAgentImpl::searchInContent(
     const String16& scriptId, const String16& query,
     Maybe<bool> optionalCaseSensitive, Maybe<bool> optionalIsRegex,
@@ -1355,10 +1383,12 @@ bool V8DebuggerAgentImpl::isPaused() const {
 void V8DebuggerAgentImpl::didParseSource(
     std::unique_ptr<V8DebuggerScript> script, bool success) {
   v8::HandleScope handles(m_isolate);
-  String16 scriptSource = script->source();
-  if (!success) script->setSourceURL(findSourceURL(scriptSource, false));
-  if (!success)
+  if (!success) {
+    DCHECK(!script->isSourceLoadedLazily());
+    String16 scriptSource = script->source();
+    script->setSourceURL(findSourceURL(scriptSource, false));
     script->setSourceMappingURL(findSourceMapURL(scriptSource, false));
+  }
 
   int contextId = script->executionContextId();
   int contextGroupId = m_inspector->contextGroupId(contextId);
@@ -1400,13 +1430,23 @@ void V8DebuggerAgentImpl::didParseSource(
       stack && !stack->isEmpty() ? stack->buildInspectorObjectImpl(m_debugger)
                                  : nullptr;
   if (success) {
-    m_frontend.scriptParsed(
-        scriptId, scriptURL, scriptRef->startLine(), scriptRef->startColumn(),
-        scriptRef->endLine(), scriptRef->endColumn(), contextId,
-        scriptRef->hash(), std::move(executionContextAuxDataParam),
-        isLiveEditParam, std::move(sourceMapURLParam), hasSourceURLParam,
-        isModuleParam, static_cast<int>(scriptRef->source().length()),
-        std::move(stackTrace));
+    // TODO(herhut, dgozman): Report correct length for WASM if needed for
+    // coverage. Or do not send the length at all and change coverage instead.
+    if (scriptRef->isSourceLoadedLazily()) {
+      m_frontend.scriptParsed(
+          scriptId, scriptURL, 0, 0, 0, 0, contextId, scriptRef->hash(),
+          std::move(executionContextAuxDataParam), isLiveEditParam,
+          std::move(sourceMapURLParam), hasSourceURLParam, isModuleParam, 0,
+          std::move(stackTrace));
+    } else {
+      m_frontend.scriptParsed(
+          scriptId, scriptURL, scriptRef->startLine(), scriptRef->startColumn(),
+          scriptRef->endLine(), scriptRef->endColumn(), contextId,
+          scriptRef->hash(), std::move(executionContextAuxDataParam),
+          isLiveEditParam, std::move(sourceMapURLParam), hasSourceURLParam,
+          isModuleParam, static_cast<int>(scriptRef->source().length()),
+          std::move(stackTrace));
+    }
   } else {
     m_frontend.scriptFailedToParse(
         scriptId, scriptURL, scriptRef->startLine(), scriptRef->startColumn(),
@@ -1416,7 +1456,13 @@ void V8DebuggerAgentImpl::didParseSource(
         static_cast<int>(scriptRef->source().length()), std::move(stackTrace));
   }
 
-  if (!success) return;
+  if (!success) {
+    if (scriptURL.isEmpty()) {
+      m_failedToParseAnonymousScriptIds.push_back(scriptId);
+      cleanupOldFailedToParseAnonymousScriptsIfNeeded();
+    }
+    return;
+  }
 
   std::vector<protocol::DictionaryValue*> potentialBreakpoints;
   if (!scriptURL.isEmpty()) {
@@ -1584,29 +1630,26 @@ void V8DebuggerAgentImpl::breakProgram(
   }
 }
 
-void V8DebuggerAgentImpl::setBreakpointAt(const String16& scriptId,
-                                          int lineNumber, int columnNumber,
-                                          BreakpointSource source,
-                                          const String16& condition) {
+void V8DebuggerAgentImpl::setBreakpointFor(v8::Local<v8::Function> function,
+                                           v8::Local<v8::String> condition,
+                                           BreakpointSource source) {
   String16 breakpointId = generateBreakpointId(
       source == DebugCommandBreakpointSource ? BreakpointType::kDebugCommand
                                              : BreakpointType::kMonitorCommand,
-      scriptId, lineNumber, columnNumber);
+      function);
   if (m_breakpointIdToDebuggerBreakpointIds.find(breakpointId) !=
       m_breakpointIdToDebuggerBreakpointIds.end()) {
     return;
   }
-  setBreakpointImpl(breakpointId, scriptId, condition, lineNumber,
-                    columnNumber);
+  setBreakpointImpl(breakpointId, function, condition);
 }
 
-void V8DebuggerAgentImpl::removeBreakpointAt(const String16& scriptId,
-                                             int lineNumber, int columnNumber,
-                                             BreakpointSource source) {
+void V8DebuggerAgentImpl::removeBreakpointFor(v8::Local<v8::Function> function,
+                                              BreakpointSource source) {
   String16 breakpointId = generateBreakpointId(
       source == DebugCommandBreakpointSource ? BreakpointType::kDebugCommand
                                              : BreakpointType::kMonitorCommand,
-      scriptId, lineNumber, columnNumber);
+      function);
   removeBreakpointImpl(breakpointId);
 }
 
@@ -1618,4 +1661,18 @@ void V8DebuggerAgentImpl::reset() {
   m_breakpointIdToDebuggerBreakpointIds.clear();
 }
 
+void V8DebuggerAgentImpl::cleanupOldFailedToParseAnonymousScriptsIfNeeded() {
+  if (m_failedToParseAnonymousScriptIds.size() <=
+      kMaxScriptFailedToParseScripts)
+    return;
+  static_assert(kMaxScriptFailedToParseScripts > 100,
+                "kMaxScriptFailedToParseScripts should be greater then 100");
+  while (m_failedToParseAnonymousScriptIds.size() >
+         kMaxScriptFailedToParseScripts - 100 + 1) {
+    String16 scriptId = m_failedToParseAnonymousScriptIds.front();
+    m_failedToParseAnonymousScriptIds.pop_front();
+    m_scripts.erase(scriptId);
+  }
+}
+
 }  // namespace v8_inspector
diff --git a/deps/v8/src/inspector/v8-debugger-agent-impl.h b/deps/v8/src/inspector/v8-debugger-agent-impl.h
index 168c5a7724b..c67e20142d1 100644
--- a/deps/v8/src/inspector/v8-debugger-agent-impl.h
+++ b/deps/v8/src/inspector/v8-debugger-agent-impl.h
@@ -2,9 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_V8DEBUGGERAGENTIMPL_H_
-#define V8_INSPECTOR_V8DEBUGGERAGENTIMPL_H_
+#ifndef V8_INSPECTOR_V8_DEBUGGER_AGENT_IMPL_H_
+#define V8_INSPECTOR_V8_DEBUGGER_AGENT_IMPL_H_
 
+#include <deque>
 #include <vector>
 
 #include "src/base/macros.h"
@@ -119,11 +120,11 @@ class V8DebuggerAgentImpl : public protocol::Debugger::Backend {
 
   bool enabled() const { return m_enabled; }
 
-  void setBreakpointAt(const String16& scriptId, int lineNumber,
-                       int columnNumber, BreakpointSource,
-                       const String16& condition = String16());
-  void removeBreakpointAt(const String16& scriptId, int lineNumber,
-                          int columnNumber, BreakpointSource);
+  void setBreakpointFor(v8::Local<v8::Function> function,
+                        v8::Local<v8::String> condition,
+                        BreakpointSource source);
+  void removeBreakpointFor(v8::Local<v8::Function> function,
+                           BreakpointSource source);
   void schedulePauseOnNextStatement(
       const String16& breakReason,
       std::unique_ptr<protocol::DictionaryValue> data);
@@ -163,6 +164,9 @@ class V8DebuggerAgentImpl : public protocol::Debugger::Backend {
   std::unique_ptr<protocol::Debugger::Location> setBreakpointImpl(
       const String16& breakpointId, const String16& scriptId,
       const String16& condition, int lineNumber, int columnNumber);
+  void setBreakpointImpl(const String16& breakpointId,
+                         v8::Local<v8::Function> function,
+                         v8::Local<v8::String> condition);
   void removeBreakpointImpl(const String16& breakpointId);
   void clearBreakDetails();
 
@@ -192,6 +196,9 @@ class V8DebuggerAgentImpl : public protocol::Debugger::Backend {
   BreakpointIdToDebuggerBreakpointIdsMap m_breakpointIdToDebuggerBreakpointIds;
   DebuggerBreakpointIdToBreakpointIdMap m_debuggerBreakpointIdToBreakpointId;
 
+  std::deque<String16> m_failedToParseAnonymousScriptIds;
+  void cleanupOldFailedToParseAnonymousScriptsIfNeeded();
+
   using BreakReason =
       std::pair<String16, std::unique_ptr<protocol::DictionaryValue>>;
   std::vector<BreakReason> m_breakReason;
@@ -215,4 +222,4 @@ String16 scopeType(v8::debug::ScopeIterator::ScopeType type);
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8DEBUGGERAGENTIMPL_H_
+#endif  // V8_INSPECTOR_V8_DEBUGGER_AGENT_IMPL_H_
diff --git a/deps/v8/src/inspector/v8-debugger-script.cc b/deps/v8/src/inspector/v8-debugger-script.cc
index 6ec7f32c890..dc5054a6658 100644
--- a/deps/v8/src/inspector/v8-debugger-script.cc
+++ b/deps/v8/src/inspector/v8-debugger-script.cc
@@ -7,20 +7,13 @@
 #include "src/inspector/inspected-context.h"
 #include "src/inspector/string-util.h"
 #include "src/inspector/wasm-translation.h"
+#include "src/utils.h"
 
 namespace v8_inspector {
 
 namespace {
 
-const char hexDigits[17] = "0123456789ABCDEF";
-
-void appendUnsignedAsHex(uint64_t number, String16Builder* destination) {
-  for (size_t i = 0; i < 8; ++i) {
-    UChar c = hexDigits[number & 0xF];
-    destination->append(c);
-    number >>= 4;
-  }
-}
+const char kGlobalDebuggerScriptHandleLabel[] = "DevTools debugger";
 
 // Hash algorithm for substrings is described in "Über die Komplexität der
 // Multiplikation in
@@ -43,11 +36,12 @@ String16 calculateHash(const String16& str) {
   const uint32_t* data = nullptr;
   size_t sizeInBytes = sizeof(UChar) * str.length();
   data = reinterpret_cast<const uint32_t*>(str.characters16());
-  for (size_t i = 0; i < sizeInBytes / 4; i += 4) {
+  for (size_t i = 0; i < sizeInBytes / 4; ++i) {
+    uint32_t d = v8::internal::ReadUnalignedUInt32(data + i);
 #if V8_TARGET_LITTLE_ENDIAN
-    uint32_t v = data[i];
+    uint32_t v = d;
 #else
-    uint32_t v = (data[i] << 16) | (data[i] >> 16);
+    uint32_t v = (d << 16) | (d >> 16);
 #endif
     uint64_t xi = v * randomOdd[current] & 0x7FFFFFFF;
     hashes[current] = (hashes[current] + zi[current] * xi) % prime[current];
@@ -56,15 +50,16 @@ String16 calculateHash(const String16& str) {
   }
   if (sizeInBytes % 4) {
     uint32_t v = 0;
+    const uint8_t* data_8b = reinterpret_cast<const uint8_t*>(data);
     for (size_t i = sizeInBytes - sizeInBytes % 4; i < sizeInBytes; ++i) {
       v <<= 8;
 #if V8_TARGET_LITTLE_ENDIAN
-      v |= reinterpret_cast<const uint8_t*>(data)[i];
+      v |= data_8b[i];
 #else
       if (i % 2) {
-        v |= reinterpret_cast<const uint8_t*>(data)[i - 1];
+        v |= data_8b[i - 1];
       } else {
-        v |= reinterpret_cast<const uint8_t*>(data)[i + 1];
+        v |= data_8b[i + 1];
       }
 #endif
     }
@@ -78,7 +73,8 @@ String16 calculateHash(const String16& str) {
     hashes[i] = (hashes[i] + zi[i] * (prime[i] - 1)) % prime[i];
 
   String16Builder hash;
-  for (size_t i = 0; i < hashesSize; ++i) appendUnsignedAsHex(hashes[i], &hash);
+  for (size_t i = 0; i < hashesSize; ++i)
+    hash.appendUnsignedAsHex((uint32_t)hashes[i]);
   return hash.toString();
 }
 
@@ -147,11 +143,19 @@ class ActualScript : public V8DebuggerScript {
     m_isModule = script->IsModule();
 
     m_script.Reset(m_isolate, script);
+    m_script.AnnotateStrongRetainer(kGlobalDebuggerScriptHandleLabel);
   }
 
   bool isLiveEdit() const override { return m_isLiveEdit; }
   bool isModule() const override { return m_isModule; }
 
+  const String16& source() const override { return m_source; }
+  int startLine() const override { return m_startLine; }
+  int startColumn() const override { return m_startColumn; }
+  int endLine() const override { return m_endLine; }
+  int endColumn() const override { return m_endColumn; }
+  bool isSourceLoadedLazily() const override { return false; }
+
   const String16& sourceMappingURL() const override {
     return m_sourceMappingURL;
   }
@@ -236,6 +240,12 @@ class ActualScript : public V8DebuggerScript {
                                    id);
   }
 
+  const String16& hash() const override {
+    if (m_hash.isEmpty()) m_hash = calculateHash(source());
+    DCHECK(!m_hash.isEmpty());
+    return m_hash;
+  }
+
  private:
   String16 GetNameOrSourceUrl(v8::Local<v8::debug::Script> script) {
     v8::Local<v8::String> name;
@@ -251,6 +261,12 @@ class ActualScript : public V8DebuggerScript {
   String16 m_sourceMappingURL;
   bool m_isLiveEdit = false;
   bool m_isModule = false;
+  String16 m_source;
+  mutable String16 m_hash;
+  int m_startLine = 0;
+  int m_startColumn = 0;
+  int m_endLine = 0;
+  int m_endColumn = 0;
   v8::Global<v8::debug::Script> m_script;
 };
 
@@ -260,21 +276,12 @@ class WasmVirtualScript : public V8DebuggerScript {
  public:
   WasmVirtualScript(v8::Isolate* isolate, WasmTranslation* wasmTranslation,
                     v8::Local<v8::debug::WasmScript> script, String16 id,
-                    String16 url, String16 source)
+                    String16 url, int functionIndex)
       : V8DebuggerScript(isolate, std::move(id), std::move(url)),
         m_script(isolate, script),
-        m_wasmTranslation(wasmTranslation) {
-    int num_lines = 0;
-    int last_newline = -1;
-    size_t next_newline = source.find('\n', last_newline + 1);
-    while (next_newline != String16::kNotFound) {
-      last_newline = static_cast<int>(next_newline);
-      next_newline = source.find('\n', last_newline + 1);
-      ++num_lines;
-    }
-    m_endLine = num_lines;
-    m_endColumn = static_cast<int>(source.length()) - last_newline - 1;
-    m_source = std::move(source);
+        m_wasmTranslation(wasmTranslation),
+        m_functionIndex(functionIndex) {
+    m_script.AnnotateStrongRetainer(kGlobalDebuggerScriptHandleLabel);
     m_executionContextId = script->ContextId().ToChecked();
   }
 
@@ -283,6 +290,22 @@ class WasmVirtualScript : public V8DebuggerScript {
   bool isModule() const override { return false; }
   void setSourceMappingURL(const String16&) override {}
   void setSource(const String16&, bool, bool*) override { UNREACHABLE(); }
+  bool isSourceLoadedLazily() const override { return true; }
+  const String16& source() const override {
+    return m_wasmTranslation->GetSource(m_id, m_functionIndex);
+  }
+  int startLine() const override {
+    return m_wasmTranslation->GetStartLine(m_id, m_functionIndex);
+  }
+  int startColumn() const override {
+    return m_wasmTranslation->GetStartColumn(m_id, m_functionIndex);
+  }
+  int endLine() const override {
+    return m_wasmTranslation->GetEndLine(m_id, m_functionIndex);
+  }
+  int endColumn() const override {
+    return m_wasmTranslation->GetEndColumn(m_id, m_functionIndex);
+  }
 
   bool getPossibleBreakpoints(
       const v8::debug::Location& start, const v8::debug::Location& end,
@@ -341,6 +364,13 @@ class WasmVirtualScript : public V8DebuggerScript {
     return true;
   }
 
+  const String16& hash() const override {
+    if (m_hash.isEmpty()) {
+      m_hash = m_wasmTranslation->GetHash(m_id, m_functionIndex);
+    }
+    return m_hash;
+  }
+
  private:
   static const String16& emptyString() {
     static const String16 singleEmptyString;
@@ -353,6 +383,8 @@ class WasmVirtualScript : public V8DebuggerScript {
 
   v8::Global<v8::debug::WasmScript> m_script;
   WasmTranslation* m_wasmTranslation;
+  int m_functionIndex;
+  mutable String16 m_hash;
 };
 
 }  // namespace
@@ -367,10 +399,10 @@ std::unique_ptr<V8DebuggerScript> V8DebuggerScript::Create(
 std::unique_ptr<V8DebuggerScript> V8DebuggerScript::CreateWasm(
     v8::Isolate* isolate, WasmTranslation* wasmTranslation,
     v8::Local<v8::debug::WasmScript> underlyingScript, String16 id,
-    String16 url, String16 source) {
+    String16 url, int functionIndex) {
   return std::unique_ptr<WasmVirtualScript>(
       new WasmVirtualScript(isolate, wasmTranslation, underlyingScript,
-                            std::move(id), std::move(url), std::move(source)));
+                            std::move(id), std::move(url), functionIndex));
 }
 
 V8DebuggerScript::V8DebuggerScript(v8::Isolate* isolate, String16 id,
@@ -383,12 +415,6 @@ const String16& V8DebuggerScript::sourceURL() const {
   return m_sourceURL.isEmpty() ? m_url : m_sourceURL;
 }
 
-const String16& V8DebuggerScript::hash() const {
-  if (m_hash.isEmpty()) m_hash = calculateHash(source());
-  DCHECK(!m_hash.isEmpty());
-  return m_hash;
-}
-
 void V8DebuggerScript::setSourceURL(const String16& sourceURL) {
   m_sourceURL = sourceURL;
 }
diff --git a/deps/v8/src/inspector/v8-debugger-script.h b/deps/v8/src/inspector/v8-debugger-script.h
index f1e28184b58..3e3885ed52e 100644
--- a/deps/v8/src/inspector/v8-debugger-script.h
+++ b/deps/v8/src/inspector/v8-debugger-script.h
@@ -27,8 +27,8 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8_INSPECTOR_V8DEBUGGERSCRIPT_H_
-#define V8_INSPECTOR_V8DEBUGGERSCRIPT_H_
+#ifndef V8_INSPECTOR_V8_DEBUGGER_SCRIPT_H_
+#define V8_INSPECTOR_V8_DEBUGGER_SCRIPT_H_
 
 #include "src/base/macros.h"
 #include "src/inspector/string-16.h"
@@ -50,7 +50,7 @@ class V8DebuggerScript {
   static std::unique_ptr<V8DebuggerScript> CreateWasm(
       v8::Isolate* isolate, WasmTranslation* wasmTranslation,
       v8::Local<v8::debug::WasmScript> underlyingScript, String16 id,
-      String16 url, String16 source);
+      String16 url, int functionIndex);
 
   virtual ~V8DebuggerScript();
 
@@ -59,15 +59,16 @@ class V8DebuggerScript {
   bool hasSourceURL() const { return !m_sourceURL.isEmpty(); }
   const String16& sourceURL() const;
   virtual const String16& sourceMappingURL() const = 0;
-  const String16& source() const { return m_source; }
-  const String16& hash() const;
-  int startLine() const { return m_startLine; }
-  int startColumn() const { return m_startColumn; }
-  int endLine() const { return m_endLine; }
-  int endColumn() const { return m_endColumn; }
+  virtual const String16& source() const = 0;
+  virtual const String16& hash() const = 0;
+  virtual int startLine() const = 0;
+  virtual int startColumn() const = 0;
+  virtual int endLine() const = 0;
+  virtual int endColumn() const = 0;
   int executionContextId() const { return m_executionContextId; }
   virtual bool isLiveEdit() const = 0;
   virtual bool isModule() const = 0;
+  virtual bool isSourceLoadedLazily() const = 0;
 
   void setSourceURL(const String16&);
   virtual void setSourceMappingURL(const String16&) = 0;
@@ -95,12 +96,6 @@ class V8DebuggerScript {
   String16 m_id;
   String16 m_url;
   String16 m_sourceURL;
-  String16 m_source;
-  mutable String16 m_hash;
-  int m_startLine = 0;
-  int m_startColumn = 0;
-  int m_endLine = 0;
-  int m_endColumn = 0;
   int m_executionContextId = 0;
 
   v8::Isolate* m_isolate;
@@ -111,4 +106,4 @@ class V8DebuggerScript {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8DEBUGGERSCRIPT_H_
+#endif  // V8_INSPECTOR_V8_DEBUGGER_SCRIPT_H_
diff --git a/deps/v8/src/inspector/v8-debugger.cc b/deps/v8/src/inspector/v8-debugger.cc
index c86f320252b..1cdbce27e63 100644
--- a/deps/v8/src/inspector/v8-debugger.cc
+++ b/deps/v8/src/inspector/v8-debugger.cc
@@ -154,7 +154,6 @@ class MatchPrototypePredicate : public v8::debug::QueryObjectPredicate {
   v8::Local<v8::Context> m_context;
   v8::Local<v8::Value> m_prototype;
 };
-
 }  // namespace
 
 V8Debugger::V8Debugger(v8::Isolate* isolate, V8InspectorImpl* inspector)
@@ -168,14 +167,20 @@ V8Debugger::V8Debugger(v8::Isolate* isolate, V8InspectorImpl* inspector)
       m_pauseOnExceptionsState(v8::debug::NoBreakOnException),
       m_wasmTranslation(isolate) {}
 
-V8Debugger::~V8Debugger() {}
+V8Debugger::~V8Debugger() {
+  if (m_terminateExecutionCallback) {
+    m_isolate->RemoveCallCompletedCallback(
+        &V8Debugger::terminateExecutionCompletedCallback);
+    m_isolate->RemoveMicrotasksCompletedCallback(
+        &V8Debugger::terminateExecutionCompletedCallback);
+  }
+}
 
 void V8Debugger::enable() {
   if (m_enableCount++) return;
   v8::HandleScope scope(m_isolate);
   v8::debug::SetDebugDelegate(m_isolate, this);
-  v8::debug::SetOutOfMemoryCallback(m_isolate, &V8Debugger::v8OOMCallback,
-                                    this);
+  m_isolate->AddNearHeapLimitCallback(&V8Debugger::nearHeapLimitCallback, this);
   v8::debug::ChangeBreakOnException(m_isolate, v8::debug::NoBreakOnException);
   m_pauseOnExceptionsState = v8::debug::NoBreakOnException;
 }
@@ -189,8 +194,9 @@ void V8Debugger::disable() {
   m_pauseOnAsyncCall = false;
   m_wasmTranslation.Clear();
   v8::debug::SetDebugDelegate(m_isolate, nullptr);
-  v8::debug::SetOutOfMemoryCallback(m_isolate, nullptr, nullptr);
-  m_isolate->RestoreOriginalHeapLimit();
+  m_isolate->RemoveNearHeapLimitCallback(&V8Debugger::nearHeapLimitCallback,
+                                         m_originalHeapLimit);
+  m_originalHeapLimit = 0;
 }
 
 bool V8Debugger::isPausedInContextGroup(int contextGroupId) const {
@@ -334,6 +340,34 @@ void V8Debugger::pauseOnAsyncCall(int targetContextGroupId, uintptr_t task,
   m_taskWithScheduledBreakDebuggerId = debuggerId;
 }
 
+void V8Debugger::terminateExecution(
+    std::unique_ptr<TerminateExecutionCallback> callback) {
+  if (m_terminateExecutionCallback) {
+    callback->sendFailure(
+        Response::Error("There is current termination request in progress"));
+    return;
+  }
+  m_terminateExecutionCallback = std::move(callback);
+  m_isolate->AddCallCompletedCallback(
+      &V8Debugger::terminateExecutionCompletedCallback);
+  m_isolate->AddMicrotasksCompletedCallback(
+      &V8Debugger::terminateExecutionCompletedCallback);
+  m_isolate->TerminateExecution();
+}
+
+void V8Debugger::terminateExecutionCompletedCallback(v8::Isolate* isolate) {
+  isolate->RemoveCallCompletedCallback(
+      &V8Debugger::terminateExecutionCompletedCallback);
+  isolate->RemoveMicrotasksCompletedCallback(
+      &V8Debugger::terminateExecutionCompletedCallback);
+  V8InspectorImpl* inspector =
+      static_cast<V8InspectorImpl*>(v8::debug::GetInspector(isolate));
+  V8Debugger* debugger = inspector->debugger();
+  debugger->m_isolate->CancelTerminateExecution();
+  debugger->m_terminateExecutionCallback->sendSuccess();
+  debugger->m_terminateExecutionCallback.reset();
+}
+
 Response V8Debugger::continueToLocation(
     int targetContextGroupId, V8DebuggerScript* script,
     std::unique_ptr<protocol::Debugger::Location> location,
@@ -455,14 +489,26 @@ void V8Debugger::handleProgramBreak(
   m_scheduledAssertBreak = false;
 }
 
-void V8Debugger::v8OOMCallback(void* data) {
+namespace {
+
+size_t HeapLimitForDebugging(size_t initial_heap_limit) {
+  const size_t kDebugHeapSizeFactor = 4;
+  size_t max_limit = std::numeric_limits<size_t>::max() / 4;
+  return std::min(max_limit, initial_heap_limit * kDebugHeapSizeFactor);
+}
+
+}  // anonymous namespace
+
+size_t V8Debugger::nearHeapLimitCallback(void* data, size_t current_heap_limit,
+                                         size_t initial_heap_limit) {
   V8Debugger* thisPtr = static_cast<V8Debugger*>(data);
-  thisPtr->m_isolate->IncreaseHeapLimitForDebugging();
+  thisPtr->m_originalHeapLimit = current_heap_limit;
   thisPtr->m_scheduledOOMBreak = true;
   v8::Local<v8::Context> context = thisPtr->m_isolate->GetEnteredContext();
   DCHECK(!context.IsEmpty());
   thisPtr->setPauseOnNextStatement(
       true, thisPtr->m_inspector->contextGroupId(context));
+  return HeapLimitForDebugging(initial_heap_limit);
 }
 
 void V8Debugger::ScriptCompiled(v8::Local<v8::debug::Script> script,
@@ -494,7 +540,6 @@ void V8Debugger::ScriptCompiled(v8::Local<v8::debug::Script> script,
 
 void V8Debugger::BreakProgramRequested(
     v8::Local<v8::Context> pausedContext, v8::Local<v8::Object>,
-    v8::Local<v8::Value>,
     const std::vector<v8::debug::BreakpointId>& break_points_hit) {
   handleProgramBreak(pausedContext, v8::Local<v8::Value>(), break_points_hit);
 }
diff --git a/deps/v8/src/inspector/v8-debugger.h b/deps/v8/src/inspector/v8-debugger.h
index 4828fcad525..351e5b66adb 100644
--- a/deps/v8/src/inspector/v8-debugger.h
+++ b/deps/v8/src/inspector/v8-debugger.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_V8DEBUGGER_H_
-#define V8_INSPECTOR_V8DEBUGGER_H_
+#ifndef V8_INSPECTOR_V8_DEBUGGER_H_
+#define V8_INSPECTOR_V8_DEBUGGER_H_
 
 #include <list>
 #include <unordered_map>
@@ -32,6 +32,8 @@ struct V8StackTraceId;
 using protocol::Response;
 using ScheduleStepIntoAsyncCallback =
     protocol::Debugger::Backend::ScheduleStepIntoAsyncCallback;
+using TerminateExecutionCallback =
+    protocol::Runtime::Backend::TerminateExecutionCallback;
 
 class V8Debugger : public v8::debug::DebugDelegate {
  public:
@@ -60,6 +62,8 @@ class V8Debugger : public v8::debug::DebugDelegate {
   void pauseOnAsyncCall(int targetContextGroupId, uintptr_t task,
                         const String16& debuggerId);
 
+  void terminateExecution(std::unique_ptr<TerminateExecutionCallback> callback);
+
   Response continueToLocation(int targetContextGroupId,
                               V8DebuggerScript* script,
                               std::unique_ptr<protocol::Debugger::Location>,
@@ -131,7 +135,9 @@ class V8Debugger : public v8::debug::DebugDelegate {
   void clearContinueToLocation();
   bool shouldContinueToCurrentLocation();
 
-  static void v8OOMCallback(void* data);
+  static size_t nearHeapLimitCallback(void* data, size_t current_heap_limit,
+                                      size_t initial_heap_limit);
+  static void terminateExecutionCompletedCallback(v8::Isolate* isolate);
 
   void handleProgramBreak(
       v8::Local<v8::Context> pausedContext, v8::Local<v8::Value> exception,
@@ -169,7 +175,6 @@ class V8Debugger : public v8::debug::DebugDelegate {
                       bool has_compile_error) override;
   void BreakProgramRequested(
       v8::Local<v8::Context> paused_context, v8::Local<v8::Object>,
-      v8::Local<v8::Value>,
       const std::vector<v8::debug::BreakpointId>& break_points_hit) override;
   void ExceptionThrown(v8::Local<v8::Context> paused_context,
                        v8::Local<v8::Object>, v8::Local<v8::Value> exception,
@@ -185,6 +190,7 @@ class V8Debugger : public v8::debug::DebugDelegate {
   int m_enableCount;
   int m_breakpointsActiveCount = 0;
   int m_ignoreScriptParsedEventsCounter;
+  size_t m_originalHeapLimit = 0;
   bool m_scheduledOOMBreak = false;
   bool m_scheduledAssertBreak = false;
   int m_targetContextGroupId = 0;
@@ -233,6 +239,8 @@ class V8Debugger : public v8::debug::DebugDelegate {
   protocol::HashMap<String16, std::pair<int64_t, int64_t>>
       m_serializedDebuggerIdToDebuggerId;
 
+  std::unique_ptr<TerminateExecutionCallback> m_terminateExecutionCallback;
+
   WasmTranslation m_wasmTranslation;
 
   DISALLOW_COPY_AND_ASSIGN(V8Debugger);
@@ -240,4 +248,4 @@ class V8Debugger : public v8::debug::DebugDelegate {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8DEBUGGER_H_
+#endif  // V8_INSPECTOR_V8_DEBUGGER_H_
diff --git a/deps/v8/src/inspector/v8-function-call.h b/deps/v8/src/inspector/v8-function-call.h
index 0337caa339e..28a5886c917 100644
--- a/deps/v8/src/inspector/v8-function-call.h
+++ b/deps/v8/src/inspector/v8-function-call.h
@@ -28,8 +28,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8_INSPECTOR_V8FUNCTIONCALL_H_
-#define V8_INSPECTOR_V8FUNCTIONCALL_H_
+#ifndef V8_INSPECTOR_V8_FUNCTION_CALL_H_
+#define V8_INSPECTOR_V8_FUNCTION_CALL_H_
 
 #include "src/inspector/string-16.h"
 
@@ -62,4 +62,4 @@ class V8FunctionCall {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8FUNCTIONCALL_H_
+#endif  // V8_INSPECTOR_V8_FUNCTION_CALL_H_
diff --git a/deps/v8/src/inspector/v8-heap-profiler-agent-impl.h b/deps/v8/src/inspector/v8-heap-profiler-agent-impl.h
index 7491a80f108..5c2107d5739 100644
--- a/deps/v8/src/inspector/v8-heap-profiler-agent-impl.h
+++ b/deps/v8/src/inspector/v8-heap-profiler-agent-impl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_V8HEAPPROFILERAGENTIMPL_H_
-#define V8_INSPECTOR_V8HEAPPROFILERAGENTIMPL_H_
+#ifndef V8_INSPECTOR_V8_HEAP_PROFILER_AGENT_IMPL_H_
+#define V8_INSPECTOR_V8_HEAP_PROFILER_AGENT_IMPL_H_
 
 #include "src/base/macros.h"
 #include "src/inspector/protocol/Forward.h"
@@ -66,4 +66,4 @@ class V8HeapProfilerAgentImpl : public protocol::HeapProfiler::Backend {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8HEAPPROFILERAGENTIMPL_H_
+#endif  // V8_INSPECTOR_V8_HEAP_PROFILER_AGENT_IMPL_H_
diff --git a/deps/v8/src/inspector/v8-injected-script-host.cc b/deps/v8/src/inspector/v8-injected-script-host.cc
index 1455cf6dbcc..23f56f93e21 100644
--- a/deps/v8/src/inspector/v8-injected-script-host.cc
+++ b/deps/v8/src/inspector/v8-injected-script-host.cc
@@ -257,7 +257,8 @@ void V8InjectedScriptHost::getInternalPropertiesCallback(
 
   std::unordered_set<String16> allowedProperties;
   if (info[0]->IsBooleanObject() || info[0]->IsNumberObject() ||
-      info[0]->IsStringObject() || info[0]->IsSymbolObject()) {
+      info[0]->IsStringObject() || info[0]->IsSymbolObject() ||
+      info[0]->IsBigIntObject()) {
     allowedProperties.insert(String16("[[PrimitiveValue]]"));
   } else if (info[0]->IsPromise()) {
     allowedProperties.insert(String16("[[PromiseStatus]]"));
diff --git a/deps/v8/src/inspector/v8-injected-script-host.h b/deps/v8/src/inspector/v8-injected-script-host.h
index 18f9139d63b..6a3ee3d3867 100644
--- a/deps/v8/src/inspector/v8-injected-script-host.h
+++ b/deps/v8/src/inspector/v8-injected-script-host.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_V8INJECTEDSCRIPTHOST_H_
-#define V8_INSPECTOR_V8INJECTEDSCRIPTHOST_H_
+#ifndef V8_INSPECTOR_V8_INJECTED_SCRIPT_HOST_H_
+#define V8_INSPECTOR_V8_INJECTED_SCRIPT_HOST_H_
 
 #include "include/v8.h"
 
@@ -50,4 +50,4 @@ class V8InjectedScriptHost {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8INJECTEDSCRIPTHOST_H_
+#endif  // V8_INSPECTOR_V8_INJECTED_SCRIPT_HOST_H_
diff --git a/deps/v8/src/inspector/v8-inspector-impl.cc b/deps/v8/src/inspector/v8-inspector-impl.cc
index a29f07b0bf6..14b79255145 100644
--- a/deps/v8/src/inspector/v8-inspector-impl.cc
+++ b/deps/v8/src/inspector/v8-inspector-impl.cc
@@ -58,11 +58,14 @@ V8InspectorImpl::V8InspectorImpl(v8::Isolate* isolate,
       m_debugger(new V8Debugger(isolate, this)),
       m_capturingStackTracesCount(0),
       m_lastExceptionId(0),
-      m_lastContextId(0) {
+      m_lastContextId(0),
+      m_isolateId(v8::debug::GetNextRandomInt64(m_isolate)) {
+  v8::debug::SetInspector(m_isolate, this);
   v8::debug::SetConsoleDelegate(m_isolate, console());
 }
 
 V8InspectorImpl::~V8InspectorImpl() {
+  v8::debug::SetInspector(m_isolate, nullptr);
   v8::debug::SetConsoleDelegate(m_isolate, nullptr);
 }
 
@@ -234,21 +237,9 @@ void V8InspectorImpl::resetContextGroup(int contextGroupId) {
   m_debugger->wasmTranslation()->Clear();
 }
 
-void V8InspectorImpl::idleStarted() {
-  for (auto& it : m_sessions) {
-    for (auto& it2 : it.second) {
-      if (it2.second->profilerAgent()->idleStarted()) return;
-    }
-  }
-}
+void V8InspectorImpl::idleStarted() { m_isolate->SetIdle(true); }
 
-void V8InspectorImpl::idleFinished() {
-  for (auto& it : m_sessions) {
-    for (auto& it2 : it.second) {
-      if (it2.second->profilerAgent()->idleFinished()) return;
-    }
-  }
-}
+void V8InspectorImpl::idleFinished() { m_isolate->SetIdle(false); }
 
 unsigned V8InspectorImpl::exceptionThrown(
     v8::Local<v8::Context> context, const StringView& message,
diff --git a/deps/v8/src/inspector/v8-inspector-impl.h b/deps/v8/src/inspector/v8-inspector-impl.h
index 92e7b219607..d34eddfa68a 100644
--- a/deps/v8/src/inspector/v8-inspector-impl.h
+++ b/deps/v8/src/inspector/v8-inspector-impl.h
@@ -28,8 +28,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8_INSPECTOR_V8INSPECTORIMPL_H_
-#define V8_INSPECTOR_V8INSPECTORIMPL_H_
+#ifndef V8_INSPECTOR_V8_INSPECTOR_IMPL_H_
+#define V8_INSPECTOR_V8_INSPECTOR_IMPL_H_
 
 #include <functional>
 #include <map>
@@ -61,6 +61,7 @@ class V8InspectorImpl : public V8Inspector {
   V8Debugger* debugger() { return m_debugger.get(); }
   int contextGroupId(v8::Local<v8::Context>) const;
   int contextGroupId(int contextId) const;
+  uint64_t isolateId() const { return m_isolateId; }
 
   v8::MaybeLocal<v8::Value> compileAndRunInternalScript(v8::Local<v8::Context>,
                                                         v8::Local<v8::String>);
@@ -128,6 +129,7 @@ class V8InspectorImpl : public V8Inspector {
   unsigned m_lastExceptionId;
   int m_lastContextId;
   int m_lastSessionId = 0;
+  uint64_t m_isolateId;
 
   using MuteExceptionsMap = protocol::HashMap<int, int>;
   MuteExceptionsMap m_muteExceptionsMap;
@@ -154,4 +156,4 @@ class V8InspectorImpl : public V8Inspector {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8INSPECTORIMPL_H_
+#endif  // V8_INSPECTOR_V8_INSPECTOR_IMPL_H_
diff --git a/deps/v8/src/inspector/v8-inspector-session-impl.cc b/deps/v8/src/inspector/v8-inspector-session-impl.cc
index d580c41e30f..1d8d12ac0d1 100644
--- a/deps/v8/src/inspector/v8-inspector-session-impl.cc
+++ b/deps/v8/src/inspector/v8-inspector-session-impl.cc
@@ -197,8 +197,11 @@ Response V8InspectorSessionImpl::findInjectedScript(
   if (!context) return Response::Error("Cannot find context with specified id");
   injectedScript = context->getInjectedScript(m_sessionId);
   if (!injectedScript) {
-    if (!context->createInjectedScript(m_sessionId))
+    if (!context->createInjectedScript(m_sessionId)) {
+      if (m_inspector->isolate()->IsExecutionTerminating())
+        return Response::Error("Execution was terminated");
       return Response::Error("Cannot access specified execution context");
+    }
     injectedScript = context->getInjectedScript(m_sessionId);
     if (m_customObjectFormatterEnabled)
       injectedScript->setCustomObjectFormatterEnabled(true);
diff --git a/deps/v8/src/inspector/v8-inspector-session-impl.h b/deps/v8/src/inspector/v8-inspector-session-impl.h
index 4fb924f7499..8ca0915b66f 100644
--- a/deps/v8/src/inspector/v8-inspector-session-impl.h
+++ b/deps/v8/src/inspector/v8-inspector-session-impl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_V8INSPECTORSESSIONIMPL_H_
-#define V8_INSPECTOR_V8INSPECTORSESSIONIMPL_H_
+#ifndef V8_INSPECTOR_V8_INSPECTOR_SESSION_IMPL_H_
+#define V8_INSPECTOR_V8_INSPECTOR_SESSION_IMPL_H_
 
 #include <vector>
 
@@ -126,4 +126,4 @@ class V8InspectorSessionImpl : public V8InspectorSession,
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8INSPECTORSESSIONIMPL_H_
+#endif  // V8_INSPECTOR_V8_INSPECTOR_SESSION_IMPL_H_
diff --git a/deps/v8/src/inspector/v8-internal-value-type.h b/deps/v8/src/inspector/v8-internal-value-type.h
index e648a0d4a3e..991919a82e0 100644
--- a/deps/v8/src/inspector/v8-internal-value-type.h
+++ b/deps/v8/src/inspector/v8-internal-value-type.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_V8INTERNALVALUETYPE_H_
-#define V8_INSPECTOR_V8INTERNALVALUETYPE_H_
+#ifndef V8_INSPECTOR_V8_INTERNAL_VALUE_TYPE_H_
+#define V8_INSPECTOR_V8_INTERNAL_VALUE_TYPE_H_
 
 #include "include/v8.h"
 
@@ -20,4 +20,4 @@ v8::Local<v8::Value> v8InternalValueTypeFrom(v8::Local<v8::Context>,
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8INTERNALVALUETYPE_H_
+#endif  // V8_INSPECTOR_V8_INTERNAL_VALUE_TYPE_H_
diff --git a/deps/v8/src/inspector/v8-profiler-agent-impl.cc b/deps/v8/src/inspector/v8-profiler-agent-impl.cc
index 26752161436..59a99d79d54 100644
--- a/deps/v8/src/inspector/v8-profiler-agent-impl.cc
+++ b/deps/v8/src/inspector/v8-profiler-agent-impl.cc
@@ -476,7 +476,6 @@ void V8ProfilerAgentImpl::startProfiling(const String16& title) {
   if (!m_startedProfilesCount) {
     DCHECK(!m_profiler);
     m_profiler = v8::CpuProfiler::New(m_isolate);
-    m_profiler->SetIdle(m_idle);
     int interval =
         m_state->integerProperty(ProfilerAgentState::samplingInterval, 0);
     if (interval) m_profiler->SetSamplingInterval(interval);
@@ -503,16 +502,4 @@ std::unique_ptr<protocol::Profiler::Profile> V8ProfilerAgentImpl::stopProfiling(
   return result;
 }
 
-bool V8ProfilerAgentImpl::idleStarted() {
-  m_idle = true;
-  if (m_profiler) m_profiler->SetIdle(m_idle);
-  return m_profiler;
-}
-
-bool V8ProfilerAgentImpl::idleFinished() {
-  m_idle = false;
-  if (m_profiler) m_profiler->SetIdle(m_idle);
-  return m_profiler;
-}
-
 }  // namespace v8_inspector
diff --git a/deps/v8/src/inspector/v8-profiler-agent-impl.h b/deps/v8/src/inspector/v8-profiler-agent-impl.h
index e758a900fae..5370d39eb48 100644
--- a/deps/v8/src/inspector/v8-profiler-agent-impl.h
+++ b/deps/v8/src/inspector/v8-profiler-agent-impl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_V8PROFILERAGENTIMPL_H_
-#define V8_INSPECTOR_V8PROFILERAGENTIMPL_H_
+#ifndef V8_INSPECTOR_V8_PROFILER_AGENT_IMPL_H_
+#define V8_INSPECTOR_V8_PROFILER_AGENT_IMPL_H_
 
 #include <vector>
 
@@ -57,9 +57,6 @@ class V8ProfilerAgentImpl : public protocol::Profiler::Backend {
   void consoleProfile(const String16& title);
   void consoleProfileEnd(const String16& title);
 
-  bool idleStarted();
-  bool idleFinished();
-
  private:
   String16 nextProfileId();
 
@@ -77,7 +74,6 @@ class V8ProfilerAgentImpl : public protocol::Profiler::Backend {
   class ProfileDescriptor;
   std::vector<ProfileDescriptor> m_startedProfiles;
   String16 m_frontendInitiatedProfileId;
-  bool m_idle = false;
   int m_startedProfilesCount = 0;
 
   DISALLOW_COPY_AND_ASSIGN(V8ProfilerAgentImpl);
@@ -85,4 +81,4 @@ class V8ProfilerAgentImpl : public protocol::Profiler::Backend {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8PROFILERAGENTIMPL_H_
+#endif  // V8_INSPECTOR_V8_PROFILER_AGENT_IMPL_H_
diff --git a/deps/v8/src/inspector/v8-regex.h b/deps/v8/src/inspector/v8-regex.h
index b4b1f8ce135..0c4136fc8b0 100644
--- a/deps/v8/src/inspector/v8-regex.h
+++ b/deps/v8/src/inspector/v8-regex.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_V8REGEX_H_
-#define V8_INSPECTOR_V8REGEX_H_
+#ifndef V8_INSPECTOR_V8_REGEX_H_
+#define V8_INSPECTOR_V8_REGEX_H_
 
 #include "src/base/macros.h"
 #include "src/inspector/string-16.h"
@@ -34,4 +34,4 @@ class V8Regex {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8REGEX_H_
+#endif  // V8_INSPECTOR_V8_REGEX_H_
diff --git a/deps/v8/src/inspector/v8-runtime-agent-impl.cc b/deps/v8/src/inspector/v8-runtime-agent-impl.cc
index 22d48e23bf2..6f921b538fd 100644
--- a/deps/v8/src/inspector/v8-runtime-agent-impl.cc
+++ b/deps/v8/src/inspector/v8-runtime-agent-impl.cc
@@ -30,6 +30,8 @@
 
 #include "src/inspector/v8-runtime-agent-impl.h"
 
+#include <inttypes.h>
+
 #include "src/debug/debug-interface.h"
 #include "src/inspector/injected-script.h"
 #include "src/inspector/inspected-context.h"
@@ -227,7 +229,8 @@ void V8RuntimeAgentImpl::evaluate(
     Maybe<bool> includeCommandLineAPI, Maybe<bool> silent,
     Maybe<int> executionContextId, Maybe<bool> returnByValue,
     Maybe<bool> generatePreview, Maybe<bool> userGesture,
-    Maybe<bool> awaitPromise, std::unique_ptr<EvaluateCallback> callback) {
+    Maybe<bool> awaitPromise, Maybe<bool> throwOnSideEffect,
+    std::unique_ptr<EvaluateCallback> callback) {
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"),
                "EvaluateScript");
   int contextId = 0;
@@ -255,13 +258,13 @@ void V8RuntimeAgentImpl::evaluate(
   if (evalIsDisabled) scope.context()->AllowCodeGenerationFromStrings(true);
 
   v8::MaybeLocal<v8::Value> maybeResultValue;
-  v8::Local<v8::Script> script;
-  if (m_inspector->compileScript(scope.context(), expression, String16())
-          .ToLocal(&script)) {
+  {
     v8::MicrotasksScope microtasksScope(m_inspector->isolate(),
                                         v8::MicrotasksScope::kRunMicrotasks);
-    maybeResultValue = script->Run(scope.context());
-  }
+    maybeResultValue = v8::debug::EvaluateGlobal(
+        m_inspector->isolate(), toV8String(m_inspector->isolate(), expression),
+        throwOnSideEffect.fromMaybe(false));
+  }  // Run microtasks before returning result.
 
   if (evalIsDisabled) scope.context()->AllowCodeGenerationFromStrings(false);
 
@@ -572,7 +575,7 @@ void V8RuntimeAgentImpl::runScript(
 }
 
 Response V8RuntimeAgentImpl::queryObjects(
-    const String16& prototypeObjectId,
+    const String16& prototypeObjectId, Maybe<String16> objectGroup,
     std::unique_ptr<protocol::Runtime::RemoteObject>* objects) {
   InjectedScript::ObjectScope scope(m_session, prototypeObjectId);
   Response response = scope.initialize();
@@ -583,7 +586,8 @@ Response V8RuntimeAgentImpl::queryObjects(
   v8::Local<v8::Array> resultArray = m_inspector->debugger()->queryObjects(
       scope.context(), v8::Local<v8::Object>::Cast(scope.object()));
   return scope.injectedScript()->wrapObject(
-      resultArray, scope.objectGroupName(), false, false, objects);
+      resultArray, objectGroup.fromMaybe(scope.objectGroupName()), false, false,
+      objects);
 }
 
 Response V8RuntimeAgentImpl::globalLexicalScopeNames(
@@ -607,6 +611,27 @@ Response V8RuntimeAgentImpl::globalLexicalScopeNames(
   return Response::OK();
 }
 
+Response V8RuntimeAgentImpl::getIsolateId(String16* outIsolateId) {
+  char buf[40];
+  std::snprintf(buf, sizeof(buf), "%" PRIx64, m_inspector->isolateId());
+  *outIsolateId = buf;
+  return Response::OK();
+}
+
+Response V8RuntimeAgentImpl::getHeapUsage(double* out_usedSize,
+                                          double* out_totalSize) {
+  v8::HeapStatistics stats;
+  m_inspector->isolate()->GetHeapStatistics(&stats);
+  *out_usedSize = stats.used_heap_size();
+  *out_totalSize = stats.total_heap_size();
+  return Response::OK();
+}
+
+void V8RuntimeAgentImpl::terminateExecution(
+    std::unique_ptr<TerminateExecutionCallback> callback) {
+  m_inspector->debugger()->terminateExecution(std::move(callback));
+}
+
 void V8RuntimeAgentImpl::restore() {
   if (!m_state->booleanProperty(V8RuntimeAgentImplState::runtimeEnabled, false))
     return;
diff --git a/deps/v8/src/inspector/v8-runtime-agent-impl.h b/deps/v8/src/inspector/v8-runtime-agent-impl.h
index cc63b697c93..3975e1b970b 100644
--- a/deps/v8/src/inspector/v8-runtime-agent-impl.h
+++ b/deps/v8/src/inspector/v8-runtime-agent-impl.h
@@ -28,8 +28,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8_INSPECTOR_V8RUNTIMEAGENTIMPL_H_
-#define V8_INSPECTOR_V8RUNTIMEAGENTIMPL_H_
+#ifndef V8_INSPECTOR_V8_RUNTIME_AGENT_IMPL_H_
+#define V8_INSPECTOR_V8_RUNTIME_AGENT_IMPL_H_
 
 #include "src/base/macros.h"
 #include "src/inspector/protocol/Forward.h"
@@ -63,7 +63,7 @@ class V8RuntimeAgentImpl : public protocol::Runtime::Backend {
                 Maybe<bool> includeCommandLineAPI, Maybe<bool> silent,
                 Maybe<int> executionContextId, Maybe<bool> returnByValue,
                 Maybe<bool> generatePreview, Maybe<bool> userGesture,
-                Maybe<bool> awaitPromise,
+                Maybe<bool> awaitPromise, Maybe<bool> throwOnSideEffect,
                 std::unique_ptr<EvaluateCallback>) override;
   void awaitPromise(const String16& promiseObjectId, Maybe<bool> returnByValue,
                     Maybe<bool> generatePreview,
@@ -99,11 +99,15 @@ class V8RuntimeAgentImpl : public protocol::Runtime::Backend {
                  Maybe<bool> generatePreview, Maybe<bool> awaitPromise,
                  std::unique_ptr<RunScriptCallback>) override;
   Response queryObjects(
-      const String16& prototypeObjectId,
+      const String16& prototypeObjectId, Maybe<String16> objectGroup,
       std::unique_ptr<protocol::Runtime::RemoteObject>* objects) override;
   Response globalLexicalScopeNames(
       Maybe<int> executionContextId,
       std::unique_ptr<protocol::Array<String16>>* outNames) override;
+  Response getIsolateId(String16* outIsolateId) override;
+  Response getHeapUsage(double* out_usedSize, double* out_totalSize) override;
+  void terminateExecution(
+      std::unique_ptr<TerminateExecutionCallback> callback) override;
 
   void reset();
   void reportExecutionContextCreated(InspectedContext*);
@@ -129,4 +133,4 @@ class V8RuntimeAgentImpl : public protocol::Runtime::Backend {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8RUNTIMEAGENTIMPL_H_
+#endif  // V8_INSPECTOR_V8_RUNTIME_AGENT_IMPL_H_
diff --git a/deps/v8/src/inspector/v8-schema-agent-impl.h b/deps/v8/src/inspector/v8-schema-agent-impl.h
index e733aa0d5a8..b96cce14013 100644
--- a/deps/v8/src/inspector/v8-schema-agent-impl.h
+++ b/deps/v8/src/inspector/v8-schema-agent-impl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_V8SCHEMAAGENTIMPL_H_
-#define V8_INSPECTOR_V8SCHEMAAGENTIMPL_H_
+#ifndef V8_INSPECTOR_V8_SCHEMA_AGENT_IMPL_H_
+#define V8_INSPECTOR_V8_SCHEMA_AGENT_IMPL_H_
 
 #include "src/base/macros.h"
 #include "src/inspector/protocol/Forward.h"
@@ -33,4 +33,4 @@ class V8SchemaAgentImpl : public protocol::Schema::Backend {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8SCHEMAAGENTIMPL_H_
+#endif  // V8_INSPECTOR_V8_SCHEMA_AGENT_IMPL_H_
diff --git a/deps/v8/src/inspector/v8-stack-trace-impl.h b/deps/v8/src/inspector/v8-stack-trace-impl.h
index 08d98110ae3..87d2b0f0270 100644
--- a/deps/v8/src/inspector/v8-stack-trace-impl.h
+++ b/deps/v8/src/inspector/v8-stack-trace-impl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_V8STACKTRACEIMPL_H_
-#define V8_INSPECTOR_V8STACKTRACEIMPL_H_
+#ifndef V8_INSPECTOR_V8_STACK_TRACE_IMPL_H_
+#define V8_INSPECTOR_V8_STACK_TRACE_IMPL_H_
 
 #include <memory>
 #include <vector>
@@ -145,4 +145,4 @@ class AsyncStackTrace {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8STACKTRACEIMPL_H_
+#endif  // V8_INSPECTOR_V8_STACK_TRACE_IMPL_H_
diff --git a/deps/v8/src/inspector/v8-value-utils.h b/deps/v8/src/inspector/v8-value-utils.h
index 4d7b77077fe..029fee224b1 100644
--- a/deps/v8/src/inspector/v8-value-utils.h
+++ b/deps/v8/src/inspector/v8-value-utils.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_V8VALUEUTILS_H_
-#define V8_INSPECTOR_V8VALUEUTILS_H_
+#ifndef V8_INSPECTOR_V8_VALUE_UTILS_H_
+#define V8_INSPECTOR_V8_VALUE_UTILS_H_
 
 #include "src/inspector/protocol/Protocol.h"
 
@@ -23,4 +23,4 @@ protocol::Response toProtocolValue(v8::Local<v8::Context>, v8::Local<v8::Value>,
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_V8VALUEUTILS_H_
+#endif  // V8_INSPECTOR_V8_VALUE_UTILS_H_
diff --git a/deps/v8/src/inspector/wasm-translation.cc b/deps/v8/src/inspector/wasm-translation.cc
index 431573d842f..1982f4932ab 100644
--- a/deps/v8/src/inspector/wasm-translation.cc
+++ b/deps/v8/src/inspector/wasm-translation.cc
@@ -5,6 +5,7 @@
 #include "src/inspector/wasm-translation.h"
 
 #include <algorithm>
+#include <utility>
 
 #include "src/debug/debug-interface.h"
 #include "src/inspector/string-util.h"
@@ -15,6 +16,42 @@
 
 namespace v8_inspector {
 
+using OffsetTable = v8::debug::WasmDisassembly::OffsetTable;
+
+struct WasmSourceInformation {
+  String16 source;
+  int end_line = 0;
+  int end_column = 0;
+
+  OffsetTable offset_table;
+  OffsetTable reverse_offset_table;
+
+  WasmSourceInformation(String16 source, OffsetTable offset_table)
+      : source(std::move(source)), offset_table(std::move(offset_table)) {
+    int num_lines = 0;
+    int last_newline = -1;
+    size_t next_newline = this->source.find('\n', last_newline + 1);
+    while (next_newline != String16::kNotFound) {
+      last_newline = static_cast<int>(next_newline);
+      next_newline = this->source.find('\n', last_newline + 1);
+      ++num_lines;
+    }
+    end_line = num_lines;
+    end_column = static_cast<int>(this->source.length()) - last_newline - 1;
+
+    reverse_offset_table = this->offset_table;
+    // Order by line, column, then byte offset.
+    auto cmp = [](OffsetTable::value_type el1, OffsetTable::value_type el2) {
+      if (el1.line != el2.line) return el1.line < el2.line;
+      if (el1.column != el2.column) return el1.column < el2.column;
+      return el1.byte_offset < el2.byte_offset;
+    };
+    std::sort(reverse_offset_table.begin(), reverse_offset_table.end(), cmp);
+  }
+
+  WasmSourceInformation() = default;
+};
+
 class WasmTranslation::TranslatorImpl {
  public:
   struct TransLocation {
@@ -33,6 +70,10 @@ class WasmTranslation::TranslatorImpl {
   virtual void Init(v8::Isolate*, WasmTranslation*, V8DebuggerAgentImpl*) = 0;
   virtual void Translate(TransLocation*) = 0;
   virtual void TranslateBack(TransLocation*) = 0;
+  virtual const WasmSourceInformation& GetSourceInformation(v8::Isolate*,
+                                                            int index) = 0;
+  virtual const String16 GetHash(v8::Isolate*, int index) = 0;
+
   virtual ~TranslatorImpl() {}
 
   class RawTranslator;
@@ -42,14 +83,22 @@ class WasmTranslation::TranslatorImpl {
 class WasmTranslation::TranslatorImpl::RawTranslator
     : public WasmTranslation::TranslatorImpl {
  public:
-  void Init(v8::Isolate*, WasmTranslation*, V8DebuggerAgentImpl*) {}
-  void Translate(TransLocation*) {}
-  void TranslateBack(TransLocation*) {}
+  void Init(v8::Isolate*, WasmTranslation*, V8DebuggerAgentImpl*) override {}
+  void Translate(TransLocation*) override {}
+  void TranslateBack(TransLocation*) override {}
+  const WasmSourceInformation& GetSourceInformation(v8::Isolate*,
+                                                    int index) override {
+    static const WasmSourceInformation singleEmptySourceInformation;
+    return singleEmptySourceInformation;
+  }
+  const String16 GetHash(v8::Isolate*, int index) override {
+    // TODO(herhut): Find useful hash default value.
+    return String16();
+  }
 };
 
 class WasmTranslation::TranslatorImpl::DisassemblingTranslator
     : public WasmTranslation::TranslatorImpl {
-  using OffsetTable = v8::debug::WasmDisassembly::OffsetTable;
 
  public:
   DisassemblingTranslator(v8::Isolate* isolate,
@@ -99,48 +148,36 @@ class WasmTranslation::TranslatorImpl::DisassemblingTranslator
     }
   }
 
+  static bool LessThan(const v8::debug::WasmDisassemblyOffsetTableEntry& entry,
+                       const TransLocation& loc) {
+    return entry.line < loc.line ||
+           (entry.line == loc.line && entry.column < loc.column);
+  }
+
   void TranslateBack(TransLocation* loc) override {
-    int func_index = GetFunctionIndexFromFakeScriptId(loc->script_id);
-    const OffsetTable* reverse_table = GetReverseTable(func_index);
-    if (!reverse_table) return;
-    DCHECK(!reverse_table->empty());
     v8::Isolate* isolate = loc->translation->isolate_;
+    int func_index = GetFunctionIndexFromFakeScriptId(loc->script_id);
+    const OffsetTable& reverse_table = GetReverseTable(isolate, func_index);
+    if (reverse_table.empty()) return;
 
     // Binary search for the given line and column.
-    unsigned left = 0;                                              // inclusive
-    unsigned right = static_cast<unsigned>(reverse_table->size());  // exclusive
-    while (right - left > 1) {
-      unsigned mid = (left + right) / 2;
-      auto& entry = (*reverse_table)[mid];
-      if (entry.line < loc->line ||
-          (entry.line == loc->line && entry.column <= loc->column)) {
-        left = mid;
-      } else {
-        right = mid;
-      }
-    }
+    auto element = std::lower_bound(reverse_table.begin(), reverse_table.end(),
+                                    *loc, LessThan);
 
     int found_byte_offset = 0;
-    // [left] is <= <line,column>, or left==0 and [0] > <line,column>.
-    // We are searching for the smallest entry >= <line,column> which is still
-    // on the same line. This must be either [left] or [left + 1].
-    // If we don't find such an entry, we might have hit the special case of
-    // pointing after the last line, which is translated to the end of the
-    // function (one byte after the last function byte).
-    if ((*reverse_table)[left].line == loc->line &&
-        (*reverse_table)[left].column >= loc->column) {
-      found_byte_offset = (*reverse_table)[left].byte_offset;
-    } else if (left + 1 < reverse_table->size() &&
-               (*reverse_table)[left + 1].line == loc->line &&
-               (*reverse_table)[left + 1].column >= loc->column) {
-      found_byte_offset = (*reverse_table)[left + 1].byte_offset;
-    } else if (left == reverse_table->size() - 1 &&
-               (*reverse_table)[left].line == loc->line - 1 &&
-               loc->column == 0) {
+    // We want an entry on the same line if possible.
+    if (element == reverse_table.end()) {
+      // We did not find an element, so this points after the function.
       std::pair<int, int> func_range =
           script_.Get(isolate)->GetFunctionRange(func_index);
       DCHECK_LE(func_range.first, func_range.second);
       found_byte_offset = func_range.second - func_range.first;
+    } else if (element->line == loc->line || element == reverse_table.begin()) {
+      found_byte_offset = element->byte_offset;
+    } else {
+      auto prev = element - 1;
+      DCHECK(prev->line == loc->line);
+      found_byte_offset = prev->byte_offset;
     }
 
     loc->script_id = String16::fromInteger(script_.Get(isolate)->Id());
@@ -148,6 +185,31 @@ class WasmTranslation::TranslatorImpl::DisassemblingTranslator
     loc->column = found_byte_offset;
   }
 
+  const WasmSourceInformation& GetSourceInformation(v8::Isolate* isolate,
+                                                    int index) override {
+    auto it = source_informations_.find(index);
+    if (it != source_informations_.end()) return it->second;
+    v8::HandleScope scope(isolate);
+    v8::Local<v8::debug::WasmScript> script = script_.Get(isolate);
+    v8::debug::WasmDisassembly disassembly = script->DisassembleFunction(index);
+
+    auto inserted = source_informations_.insert(std::make_pair(
+        index, WasmSourceInformation({disassembly.disassembly.data(),
+                                      disassembly.disassembly.length()},
+                                     std::move(disassembly.offset_table))));
+    DCHECK(inserted.second);
+    return inserted.first->second;
+  }
+
+  const String16 GetHash(v8::Isolate* isolate, int index) override {
+    v8::HandleScope scope(isolate);
+    v8::Local<v8::debug::WasmScript> script = script_.Get(isolate);
+    uint32_t hash = script->GetFunctionHash(index);
+    String16Builder builder;
+    builder.appendUnsignedAsHex(hash);
+    return builder.toString();
+  }
+
  private:
   String16 GetFakeScriptUrl(v8::Isolate* isolate, int func_index) {
     v8::Local<v8::debug::WasmScript> script = script_.Get(isolate);
@@ -182,20 +244,10 @@ class WasmTranslation::TranslatorImpl::DisassemblingTranslator
     String16 fake_script_id = GetFakeScriptId(underlyingScriptId, func_idx);
     String16 fake_script_url = GetFakeScriptUrl(isolate, func_idx);
 
-    v8::Local<v8::debug::WasmScript> script = script_.Get(isolate);
-    // TODO(clemensh): Generate disassembly lazily when queried by the frontend.
-    v8::debug::WasmDisassembly disassembly =
-        script->DisassembleFunction(func_idx);
-
-    DCHECK_EQ(0, offset_tables_.count(func_idx));
-    offset_tables_.insert(
-        std::make_pair(func_idx, std::move(disassembly.offset_table)));
-    String16 source(disassembly.disassembly.data(),
-                    disassembly.disassembly.length());
     std::unique_ptr<V8DebuggerScript> fake_script =
-        V8DebuggerScript::CreateWasm(isolate, translation, script,
+        V8DebuggerScript::CreateWasm(isolate, translation, script_.Get(isolate),
                                      fake_script_id, std::move(fake_script_url),
-                                     source);
+                                     func_idx);
 
     translation->AddFakeScript(fake_script->scriptId(), this);
     agent->didParseSource(std::move(fake_script), true);
@@ -212,42 +264,19 @@ class WasmTranslation::TranslatorImpl::DisassemblingTranslator
 
   const OffsetTable& GetOffsetTable(const TransLocation* loc) {
     int func_index = loc->line;
-    auto it = offset_tables_.find(func_index);
-    // TODO(clemensh): Once we load disassembly lazily, the offset table
-    // might not be there yet. Load it lazily then.
-    DCHECK(it != offset_tables_.end());
-    return it->second;
+    return GetSourceInformation(loc->translation->isolate_, func_index)
+        .offset_table;
   }
 
-  const OffsetTable* GetReverseTable(int func_index) {
-    auto it = reverse_tables_.find(func_index);
-    if (it != reverse_tables_.end()) return &it->second;
-
-    // Find offset table, copy and sort it to get reverse table.
-    it = offset_tables_.find(func_index);
-    if (it == offset_tables_.end()) return nullptr;
-
-    OffsetTable reverse_table = it->second;
-    // Order by line, column, then byte offset.
-    auto cmp = [](OffsetTable::value_type el1, OffsetTable::value_type el2) {
-      if (el1.line != el2.line) return el1.line < el2.line;
-      if (el1.column != el2.column) return el1.column < el2.column;
-      return el1.byte_offset < el2.byte_offset;
-    };
-    std::sort(reverse_table.begin(), reverse_table.end(), cmp);
-
-    auto inserted = reverse_tables_.insert(
-        std::make_pair(func_index, std::move(reverse_table)));
-    DCHECK(inserted.second);
-    return &inserted.first->second;
+  const OffsetTable& GetReverseTable(v8::Isolate* isolate, int func_index) {
+    return GetSourceInformation(isolate, func_index).reverse_offset_table;
   }
 
   v8::Global<v8::debug::WasmScript> script_;
 
   // We assume to only disassemble a subset of the functions, so store them in a
   // map instead of an array.
-  std::unordered_map<int, const OffsetTable> offset_tables_;
-  std::unordered_map<int, const OffsetTable> reverse_tables_;
+  std::unordered_map<int, WasmSourceInformation> source_informations_;
 };
 
 WasmTranslation::WasmTranslation(v8::Isolate* isolate)
@@ -280,6 +309,31 @@ void WasmTranslation::Clear() {
   fake_scripts_.clear();
 }
 
+const String16& WasmTranslation::GetSource(const String16& script_id,
+                                           int func_index) {
+  auto it = fake_scripts_.find(script_id);
+  DCHECK_NE(it, fake_scripts_.end());
+  return it->second->GetSourceInformation(isolate_, func_index).source;
+}
+
+int WasmTranslation::GetEndLine(const String16& script_id, int func_index) {
+  auto it = fake_scripts_.find(script_id);
+  DCHECK_NE(it, fake_scripts_.end());
+  return it->second->GetSourceInformation(isolate_, func_index).end_line;
+}
+
+int WasmTranslation::GetEndColumn(const String16& script_id, int func_index) {
+  auto it = fake_scripts_.find(script_id);
+  DCHECK_NE(it, fake_scripts_.end());
+  return it->second->GetSourceInformation(isolate_, func_index).end_column;
+}
+
+String16 WasmTranslation::GetHash(const String16& script_id, int func_index) {
+  auto it = fake_scripts_.find(script_id);
+  DCHECK_NE(it, fake_scripts_.end());
+  return it->second->GetHash(isolate_, func_index);
+}
+
 // Translation "forward" (to artificial scripts).
 bool WasmTranslation::TranslateWasmScriptLocationToProtocolLocation(
     String16* script_id, int* line_number, int* column_number) {
@@ -326,5 +380,4 @@ void WasmTranslation::AddFakeScript(const String16& scriptId,
   DCHECK_EQ(0, fake_scripts_.count(scriptId));
   fake_scripts_.insert(std::make_pair(scriptId, translator));
 }
-
 }  // namespace v8_inspector
diff --git a/deps/v8/src/inspector/wasm-translation.h b/deps/v8/src/inspector/wasm-translation.h
index 2162edee679..0df1f58e21c 100644
--- a/deps/v8/src/inspector/wasm-translation.h
+++ b/deps/v8/src/inspector/wasm-translation.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_INSPECTOR_WASMTRANSLATION_H_
-#define V8_INSPECTOR_WASMTRANSLATION_H_
+#ifndef V8_INSPECTOR_WASM_TRANSLATION_H_
+#define V8_INSPECTOR_WASM_TRANSLATION_H_
 
 #include <unordered_map>
 
@@ -56,6 +56,13 @@ class WasmTranslation {
                                                      int* line_number,
                                                      int* column_number);
 
+  const String16& GetSource(const String16& script_id, int func_index);
+  int GetStartLine(const String16& script_id, int func_index) { return 0; }
+  int GetStartColumn(const String16& script_id, int func_index) { return 0; }
+  int GetEndLine(const String16& script_id, int func_index);
+  int GetEndColumn(const String16& script_id, int func_index);
+  String16 GetHash(const String16& script_id, int func_index);
+
  private:
   class TranslatorImpl;
   friend class TranslatorImpl;
@@ -72,4 +79,4 @@ class WasmTranslation {
 
 }  // namespace v8_inspector
 
-#endif  // V8_INSPECTOR_WASMTRANSLATION_H_
+#endif  // V8_INSPECTOR_WASM_TRANSLATION_H_
diff --git a/deps/v8/src/instruction-stream.cc b/deps/v8/src/instruction-stream.cc
new file mode 100644
index 00000000000..6a95534af8f
--- /dev/null
+++ b/deps/v8/src/instruction-stream.cc
@@ -0,0 +1,85 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/instruction-stream.h"
+
+#include "src/builtins/builtins.h"
+#include "src/objects-inl.h"
+#include "src/snapshot/snapshot.h"
+
+namespace v8 {
+namespace internal {
+
+// static
+bool InstructionStream::PcIsOffHeap(Isolate* isolate, Address pc) {
+#ifdef V8_EMBEDDED_BUILTINS
+  const uint8_t* start = isolate->embedded_blob();
+  return start <= pc && pc < start + isolate->embedded_blob_size();
+#else
+  return false;
+#endif
+}
+
+// static
+Code* InstructionStream::TryLookupCode(Isolate* isolate, Address address) {
+#ifdef V8_EMBEDDED_BUILTINS
+  if (!PcIsOffHeap(isolate, address)) return nullptr;
+
+  EmbeddedData d = EmbeddedData::FromBlob();
+
+  int l = 0, r = Builtins::builtin_count;
+  while (l < r) {
+    const int mid = (l + r) / 2;
+    const uint8_t* start = d.InstructionStartOfBuiltin(mid);
+    const uint8_t* end = start + d.InstructionSizeOfBuiltin(mid);
+
+    if (address < start) {
+      r = mid;
+    } else if (address >= end) {
+      l = mid + 1;
+    } else {
+      return isolate->builtins()->builtin(mid);
+    }
+  }
+
+  UNREACHABLE();
+#else
+  return nullptr;
+#endif
+}
+
+#ifdef V8_EMBEDDED_BUILTINS
+// static
+void InstructionStream::CreateOffHeapInstructionStream(Isolate* isolate,
+                                                       uint8_t** data,
+                                                       uint32_t* size) {
+  EmbeddedData d = EmbeddedData::FromIsolate(isolate);
+
+  const uint32_t page_size = static_cast<uint32_t>(AllocatePageSize());
+  const uint32_t allocated_size = RoundUp(d.size(), page_size);
+
+  uint8_t* allocated_bytes = static_cast<uint8_t*>(
+      AllocatePages(GetRandomMmapAddr(), allocated_size, page_size,
+                    PageAllocator::kReadWrite));
+  CHECK_NOT_NULL(allocated_bytes);
+
+  std::memcpy(allocated_bytes, d.data(), d.size());
+  CHECK(SetPermissions(allocated_bytes, allocated_size,
+                       PageAllocator::kReadExecute));
+
+  *data = allocated_bytes;
+  *size = allocated_size;
+
+  d.Dispose();
+}
+
+// static
+void InstructionStream::FreeOffHeapInstructionStream(uint8_t* data,
+                                                     uint32_t size) {
+  CHECK(FreePages(data, size));
+}
+#endif  // V8_EMBEDDED_BUILTINS
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/instruction-stream.h b/deps/v8/src/instruction-stream.h
new file mode 100644
index 00000000000..d659de4266a
--- /dev/null
+++ b/deps/v8/src/instruction-stream.h
@@ -0,0 +1,41 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_INSTRUCTION_STREAM_H_
+#define V8_INSTRUCTION_STREAM_H_
+
+#include "src/base/macros.h"
+#include "src/globals.h"
+
+namespace v8 {
+namespace internal {
+
+class Code;
+class Isolate;
+
+// Wraps an off-heap instruction stream.
+// TODO(jgruber,v8:6666): Remove this class.
+class InstructionStream final : public AllStatic {
+ public:
+  // Returns true, iff the given pc points into an off-heap instruction stream.
+  static bool PcIsOffHeap(Isolate* isolate, Address pc);
+
+  // Returns the corresponding Code object if it exists, and nullptr otherwise.
+  static Code* TryLookupCode(Isolate* isolate, Address address);
+
+#ifdef V8_EMBEDDED_BUILTINS
+  // During snapshot creation, we first create an executable off-heap area
+  // containing all off-heap code. The area is guaranteed to be contiguous.
+  // Note that this only applies when building the snapshot, e.g. for
+  // mksnapshot. Otherwise, off-heap code is embedded directly into the binary.
+  static void CreateOffHeapInstructionStream(Isolate* isolate, uint8_t** data,
+                                             uint32_t* size);
+  static void FreeOffHeapInstructionStream(uint8_t* data, uint32_t size);
+#endif
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_INSTRUCTION_STREAM_H_
diff --git a/deps/v8/src/interface-descriptors.cc b/deps/v8/src/interface-descriptors.cc
index 3b466aceb9a..9771f0e00c2 100644
--- a/deps/v8/src/interface-descriptors.cc
+++ b/deps/v8/src/interface-descriptors.cc
@@ -284,6 +284,21 @@ void StringAtDescriptor::InitializePlatformSpecific(
   DefaultInitializePlatformSpecific(data, kParameterCount);
 }
 
+void StringSubstringDescriptor::InitializePlatformIndependent(
+    CallInterfaceDescriptorData* data) {
+  // kString, kFrom, kTo
+  // TODO(turbofan): Allow builtins to return untagged values.
+  MachineType machine_types[] = {MachineType::AnyTagged(),
+                                 MachineType::IntPtr(), MachineType::IntPtr()};
+  data->InitializePlatformIndependent(arraysize(machine_types), 0,
+                                      machine_types);
+}
+
+void StringSubstringDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  DefaultInitializePlatformSpecific(data, kParameterCount);
+}
+
 void TypeConversionDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {ArgumentRegister()};
diff --git a/deps/v8/src/interface-descriptors.h b/deps/v8/src/interface-descriptors.h
index 12b25a510a9..61da0c3f4ea 100644
--- a/deps/v8/src/interface-descriptors.h
+++ b/deps/v8/src/interface-descriptors.h
@@ -2,13 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_CALL_INTERFACE_DESCRIPTOR_H_
-#define V8_CALL_INTERFACE_DESCRIPTOR_H_
+#ifndef V8_INTERFACE_DESCRIPTORS_H_
+#define V8_INTERFACE_DESCRIPTORS_H_
 
 #include <memory>
 
 #include "src/assembler.h"
 #include "src/globals.h"
+#include "src/isolate.h"
 #include "src/macro-assembler.h"
 
 namespace v8 {
@@ -30,7 +31,6 @@ class PlatformInterfaceDescriptor;
   V(StoreTransition)                  \
   V(StoreGlobal)                      \
   V(StoreGlobalWithVector)            \
-  V(FastNewClosure)                   \
   V(FastNewFunctionContext)           \
   V(FastNewObject)                    \
   V(FastNewArguments)                 \
@@ -63,6 +63,7 @@ class PlatformInterfaceDescriptor;
   V(BinaryOp)                         \
   V(StringAdd)                        \
   V(StringAt)                         \
+  V(StringSubstring)                  \
   V(ForInPrepare)                     \
   V(GetProperty)                      \
   V(ArgumentAdaptor)                  \
@@ -80,6 +81,7 @@ class PlatformInterfaceDescriptor;
   V(FrameDropperTrampoline)           \
   V(WasmRuntimeCall)                  \
   V(RunMicrotasks)                    \
+  V(PromiseReactionHandler)           \
   BUILTIN_LIST_TFS(V)
 
 class V8_EXPORT_PRIVATE CallInterfaceDescriptorData {
@@ -514,12 +516,6 @@ class LoadGlobalWithVectorDescriptor : public LoadGlobalDescriptor {
   }
 };
 
-class FastNewClosureDescriptor : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS(kSharedFunctionInfo, kVector, kSlot)
-  DECLARE_DESCRIPTOR(FastNewClosureDescriptor, CallInterfaceDescriptor)
-};
-
 class FastNewFunctionContextDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kFunction, kSlots)
@@ -661,7 +657,9 @@ class ConstructStubDescriptor : public CallInterfaceDescriptor {
                                                CallInterfaceDescriptor)
 };
 
-
+// This descriptor is also used by DebugBreakTrampoline because it handles both
+// regular function calls and construct calls, and we need to pass new.target
+// for the latter.
 class ConstructTrampolineDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kFunction, kNewTarget, kActualArgumentsCount)
@@ -770,6 +768,13 @@ class StringAtDescriptor final : public CallInterfaceDescriptor {
                                                CallInterfaceDescriptor)
 };
 
+class StringSubstringDescriptor final : public CallInterfaceDescriptor {
+ public:
+  DEFINE_PARAMETERS(kString, kFrom, kTo)
+  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(StringSubstringDescriptor,
+                                               CallInterfaceDescriptor)
+};
+
 class ArgumentAdaptorDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kFunction, kNewTarget, kActualArgumentsCount,
@@ -884,6 +889,13 @@ class RunMicrotasksDescriptor final : public CallInterfaceDescriptor {
                              0)
 };
 
+class PromiseReactionHandlerDescriptor final : public CallInterfaceDescriptor {
+ public:
+  DEFINE_PARAMETERS(kArgument, kGenerator)
+  DECLARE_DEFAULT_DESCRIPTOR(PromiseReactionHandlerDescriptor,
+                             CallInterfaceDescriptor, 2)
+};
+
 #define DEFINE_TFS_BUILTIN_DESCRIPTOR(Name, ...)                          \
   class Name##Descriptor : public CallInterfaceDescriptor {               \
    public:                                                                \
@@ -917,4 +929,4 @@ INTERFACE_DESCRIPTOR_LIST(DEF_KEY)
 #include "src/arm/interface-descriptors-arm.h"
 #endif
 
-#endif  // V8_CALL_INTERFACE_DESCRIPTOR_H_
+#endif  // V8_INTERFACE_DESCRIPTORS_H_
diff --git a/deps/v8/src/interpreter/bytecode-array-accessor.cc b/deps/v8/src/interpreter/bytecode-array-accessor.cc
index 784bb14eb61..2a5923b2a48 100644
--- a/deps/v8/src/interpreter/bytecode-array-accessor.cc
+++ b/deps/v8/src/interpreter/bytecode-array-accessor.cc
@@ -4,6 +4,7 @@
 
 #include "src/interpreter/bytecode-array-accessor.h"
 
+#include "src/feedback-vector.h"
 #include "src/interpreter/bytecode-decoder.h"
 #include "src/interpreter/interpreter-intrinsics.h"
 #include "src/objects-inl.h"
@@ -125,6 +126,11 @@ uint32_t BytecodeArrayAccessor::GetIndexOperand(int operand_index) const {
   return GetUnsignedOperand(operand_index, operand_type);
 }
 
+FeedbackSlot BytecodeArrayAccessor::GetSlotOperand(int operand_index) const {
+  int index = GetIndexOperand(operand_index);
+  return FeedbackVector::ToSlot(index);
+}
+
 Register BytecodeArrayAccessor::GetRegisterOperand(int operand_index) const {
   OperandType operand_type =
       Bytecodes::GetOperandType(current_bytecode(), operand_index);
@@ -206,12 +212,18 @@ int BytecodeArrayAccessor::GetJumpTargetOffset() const {
 
 JumpTableTargetOffsets BytecodeArrayAccessor::GetJumpTableTargetOffsets()
     const {
-  DCHECK_EQ(current_bytecode(), Bytecode::kSwitchOnSmiNoFeedback);
-
-  uint32_t table_start = GetIndexOperand(0);
-  uint32_t table_size = GetUnsignedImmediateOperand(1);
-  int32_t case_value_base = GetImmediateOperand(2);
-
+  uint32_t table_start, table_size;
+  int32_t case_value_base;
+  if (current_bytecode() == Bytecode::kSwitchOnGeneratorState) {
+    table_start = GetIndexOperand(1);
+    table_size = GetUnsignedImmediateOperand(2);
+    case_value_base = 0;
+  } else {
+    DCHECK_EQ(current_bytecode(), Bytecode::kSwitchOnSmiNoFeedback);
+    table_start = GetIndexOperand(0);
+    table_size = GetUnsignedImmediateOperand(1);
+    case_value_base = GetImmediateOperand(2);
+  }
   return JumpTableTargetOffsets(this, table_start, table_size, case_value_base);
 }
 
diff --git a/deps/v8/src/interpreter/bytecode-array-accessor.h b/deps/v8/src/interpreter/bytecode-array-accessor.h
index d585e6dc33d..f31d2d0e7f2 100644
--- a/deps/v8/src/interpreter/bytecode-array-accessor.h
+++ b/deps/v8/src/interpreter/bytecode-array-accessor.h
@@ -83,6 +83,7 @@ class V8_EXPORT_PRIVATE BytecodeArrayAccessor {
   uint32_t GetUnsignedImmediateOperand(int operand_index) const;
   int32_t GetImmediateOperand(int operand_index) const;
   uint32_t GetIndexOperand(int operand_index) const;
+  FeedbackSlot GetSlotOperand(int operand_index) const;
   uint32_t GetRegisterCountOperand(int operand_index) const;
   Register GetRegisterOperand(int operand_index) const;
   int GetRegisterOperandRange(int operand_index) const;
@@ -130,4 +131,4 @@ class V8_EXPORT_PRIVATE BytecodeArrayAccessor {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_INTERPRETER_BYTECODE_GRAPH_ACCESSOR_H_
+#endif  // V8_INTERPRETER_BYTECODE_ARRAY_ACCESSOR_H_
diff --git a/deps/v8/src/interpreter/bytecode-array-builder.cc b/deps/v8/src/interpreter/bytecode-array-builder.cc
index dcbe8029f9e..0558f45acf2 100644
--- a/deps/v8/src/interpreter/bytecode-array-builder.cc
+++ b/deps/v8/src/interpreter/bytecode-array-builder.cc
@@ -92,7 +92,7 @@ Handle<BytecodeArray> BytecodeArrayBuilder::ToBytecodeArray(Isolate* isolate) {
     register_count = register_optimizer_->maxiumum_register_index() + 1;
   }
 
-  Handle<FixedArray> handler_table =
+  Handle<ByteArray> handler_table =
       handler_table_builder()->ToHandlerTable(isolate);
   return bytecode_array_writer_.ToBytecodeArray(
       isolate, register_count, parameter_count(), handler_table);
@@ -864,6 +864,12 @@ BytecodeArrayBuilder& BytecodeArrayBuilder::StoreKeyedProperty(
   return *this;
 }
 
+BytecodeArrayBuilder& BytecodeArrayBuilder::StoreInArrayLiteral(
+    Register array, Register index, int feedback_slot) {
+  OutputStaInArrayLiteral(array, index, feedback_slot);
+  return *this;
+}
+
 BytecodeArrayBuilder& BytecodeArrayBuilder::StoreHomeObjectProperty(
     Register object, int feedback_slot, LanguageMode language_mode) {
   size_t name_index = HomeObjectSymbolConstantPoolEntry();
@@ -973,8 +979,8 @@ BytecodeArrayBuilder& BytecodeArrayBuilder::CreateEmptyObjectLiteral() {
 }
 
 BytecodeArrayBuilder& BytecodeArrayBuilder::GetTemplateObject(
-    size_t template_object_description_entry) {
-  OutputGetTemplateObject(template_object_description_entry);
+    size_t template_object_description_entry, int feedback_slot) {
+  OutputGetTemplateObject(template_object_description_entry, feedback_slot);
   return *this;
 }
 
@@ -998,6 +1004,11 @@ BytecodeArrayBuilder& BytecodeArrayBuilder::ToName(Register out) {
   return *this;
 }
 
+BytecodeArrayBuilder& BytecodeArrayBuilder::ToString() {
+  OutputToString();
+  return *this;
+}
+
 BytecodeArrayBuilder& BytecodeArrayBuilder::ToNumber(int feedback_slot) {
   OutputToNumber(feedback_slot);
   return *this;
@@ -1271,16 +1282,19 @@ BytecodeArrayBuilder& BytecodeArrayBuilder::SuspendGenerator(
   return *this;
 }
 
-BytecodeArrayBuilder& BytecodeArrayBuilder::RestoreGeneratorState(
-    Register generator) {
-  OutputRestoreGeneratorState(generator);
+BytecodeArrayBuilder& BytecodeArrayBuilder::SwitchOnGeneratorState(
+    Register generator, BytecodeJumpTable* jump_table) {
+  DCHECK_EQ(jump_table->case_value_base(), 0);
+  BytecodeNode node(CreateSwitchOnGeneratorStateNode(
+      generator, jump_table->constant_pool_index(), jump_table->size()));
+  WriteSwitch(&node, jump_table);
+  LeaveBasicBlock();
   return *this;
 }
 
 BytecodeArrayBuilder& BytecodeArrayBuilder::ResumeGenerator(
-    Register generator, Register generator_state, RegisterList registers) {
-  OutputResumeGenerator(generator, generator_state, registers,
-                        registers.register_count());
+    Register generator, RegisterList registers) {
+  OutputResumeGenerator(generator, registers, registers.register_count());
   return *this;
 }
 
diff --git a/deps/v8/src/interpreter/bytecode-array-builder.h b/deps/v8/src/interpreter/bytecode-array-builder.h
index 021222abe55..a22462d1fac 100644
--- a/deps/v8/src/interpreter/bytecode-array-builder.h
+++ b/deps/v8/src/interpreter/bytecode-array-builder.h
@@ -21,6 +21,7 @@
 namespace v8 {
 namespace internal {
 
+class FeedbackVectorSpec;
 class Isolate;
 
 namespace interpreter {
@@ -160,6 +161,10 @@ class V8_EXPORT_PRIVATE BytecodeArrayBuilder final {
   BytecodeArrayBuilder& StoreKeyedProperty(Register object, Register key,
                                            int feedback_slot,
                                            LanguageMode language_mode);
+  // Store an own element in an array literal. The value to be stored should be
+  // in the accumulator.
+  BytecodeArrayBuilder& StoreInArrayLiteral(Register array, Register index,
+                                            int feedback_slot);
   // Store the home object property. The value to be stored should be in the
   // accumulator.
   BytecodeArrayBuilder& StoreHomeObjectProperty(Register object,
@@ -240,7 +245,7 @@ class V8_EXPORT_PRIVATE BytecodeArrayBuilder final {
   // Gets or creates the template for a TemplateObjectDescription which will
   // be inserted at constant pool index |template_object_description_entry|.
   BytecodeArrayBuilder& GetTemplateObject(
-      size_t template_object_description_entry);
+      size_t template_object_description_entry, int feedback_slot);
 
   // Push the context in accumulator as the new context, and store in register
   // |context|.
@@ -354,6 +359,9 @@ class V8_EXPORT_PRIVATE BytecodeArrayBuilder final {
   // the key to be deleted and the register contains a reference to the object.
   BytecodeArrayBuilder& Delete(Register object, LanguageMode language_mode);
 
+  // JavaScript defines two kinds of 'nil'.
+  enum NilValue { kNullValue, kUndefinedValue };
+
   // Tests.
   BytecodeArrayBuilder& CompareOperation(Token::Value op, Register reg,
                                          int feedback_slot);
@@ -368,6 +376,7 @@ class V8_EXPORT_PRIVATE BytecodeArrayBuilder final {
   // Converts accumulator and stores result in register |out|.
   BytecodeArrayBuilder& ToObject(Register out);
   BytecodeArrayBuilder& ToName(Register out);
+  BytecodeArrayBuilder& ToString();
 
   // Converts accumulator and stores result back in accumulator.
   BytecodeArrayBuilder& ToNumber(int feedback_slot);
@@ -430,9 +439,9 @@ class V8_EXPORT_PRIVATE BytecodeArrayBuilder final {
   BytecodeArrayBuilder& SuspendGenerator(Register generator,
                                          RegisterList registers,
                                          int suspend_id);
-  BytecodeArrayBuilder& RestoreGeneratorState(Register generator);
+  BytecodeArrayBuilder& SwitchOnGeneratorState(Register generator,
+                                               BytecodeJumpTable* jump_table);
   BytecodeArrayBuilder& ResumeGenerator(Register generator,
-                                        Register generator_state,
                                         RegisterList registers);
 
   // Exception handling.
diff --git a/deps/v8/src/interpreter/bytecode-array-writer.cc b/deps/v8/src/interpreter/bytecode-array-writer.cc
index 9aea3d83fa5..81f49baeeac 100644
--- a/deps/v8/src/interpreter/bytecode-array-writer.cc
+++ b/deps/v8/src/interpreter/bytecode-array-writer.cc
@@ -38,7 +38,7 @@ BytecodeArrayWriter::BytecodeArrayWriter(
 
 Handle<BytecodeArray> BytecodeArrayWriter::ToBytecodeArray(
     Isolate* isolate, int register_count, int parameter_count,
-    Handle<FixedArray> handler_table) {
+    Handle<ByteArray> handler_table) {
   DCHECK_EQ(0, unbound_jumps_);
 
   int bytecode_size = static_cast<int>(bytecodes()->size());
@@ -158,6 +158,7 @@ void BytecodeArrayWriter::UpdateExitSeenInBlock(Bytecode bytecode) {
     case Bytecode::kAbort:
     case Bytecode::kJump:
     case Bytecode::kJumpConstant:
+    case Bytecode::kSuspendGenerator:
       exit_seen_in_block_ = true;
       break;
     default:
diff --git a/deps/v8/src/interpreter/bytecode-array-writer.h b/deps/v8/src/interpreter/bytecode-array-writer.h
index c53df101297..9700d2c1cf0 100644
--- a/deps/v8/src/interpreter/bytecode-array-writer.h
+++ b/deps/v8/src/interpreter/bytecode-array-writer.h
@@ -43,7 +43,7 @@ class V8_EXPORT_PRIVATE BytecodeArrayWriter final {
   void BindJumpTableEntry(BytecodeJumpTable* jump_table, int case_value);
   Handle<BytecodeArray> ToBytecodeArray(Isolate* isolate, int register_count,
                                         int parameter_count,
-                                        Handle<FixedArray> handler_table);
+                                        Handle<ByteArray> handler_table);
 
  private:
   // Maximum sized packed bytecode is comprised of a prefix bytecode,
diff --git a/deps/v8/src/interpreter/bytecode-generator.cc b/deps/v8/src/interpreter/bytecode-generator.cc
index ee94e7a2e26..65f6146b916 100644
--- a/deps/v8/src/interpreter/bytecode-generator.cc
+++ b/deps/v8/src/interpreter/bytecode-generator.cc
@@ -593,6 +593,11 @@ class BytecodeGenerator::ExpressionResultScope {
     type_hint_ = TypeHint::kBoolean;
   }
 
+  void SetResultIsString() {
+    DCHECK_EQ(type_hint_, TypeHint::kAny);
+    type_hint_ = TypeHint::kString;
+  }
+
   TypeHint type_hint() const { return type_hint_; }
 
  private:
@@ -799,31 +804,33 @@ class BytecodeGenerator::CurrentScope final {
 
 class BytecodeGenerator::FeedbackSlotCache : public ZoneObject {
  public:
-  typedef std::pair<TypeofMode, void*> Key;
-
   explicit FeedbackSlotCache(Zone* zone) : map_(zone) {}
 
-  void Put(TypeofMode typeof_mode, Variable* variable, FeedbackSlot slot) {
-    Key key = std::make_pair(typeof_mode, variable);
-    auto entry = std::make_pair(key, slot);
-    map_.insert(entry);
+  void Put(FeedbackSlotKind slot_kind, Variable* variable, FeedbackSlot slot) {
+    PutImpl(slot_kind, variable, slot);
   }
-  void Put(AstNode* node, FeedbackSlot slot) {
-    Key key = std::make_pair(NOT_INSIDE_TYPEOF, node);
+  void Put(FeedbackSlotKind slot_kind, AstNode* node, FeedbackSlot slot) {
+    PutImpl(slot_kind, node, slot);
+  }
+
+  FeedbackSlot Get(FeedbackSlotKind slot_kind, Variable* variable) const {
+    return GetImpl(slot_kind, variable);
+  }
+  FeedbackSlot Get(FeedbackSlotKind slot_kind, AstNode* node) const {
+    return GetImpl(slot_kind, node);
+  }
+
+ private:
+  typedef std::pair<FeedbackSlotKind, void*> Key;
+
+  void PutImpl(FeedbackSlotKind slot_kind, void* node, FeedbackSlot slot) {
+    Key key = std::make_pair(slot_kind, node);
     auto entry = std::make_pair(key, slot);
     map_.insert(entry);
   }
 
-  FeedbackSlot Get(TypeofMode typeof_mode, Variable* variable) const {
-    Key key = std::make_pair(typeof_mode, variable);
-    auto iter = map_.find(key);
-    if (iter != map_.end()) {
-      return iter->second;
-    }
-    return FeedbackSlot();
-  }
-  FeedbackSlot Get(AstNode* node) const {
-    Key key = std::make_pair(NOT_INSIDE_TYPEOF, node);
+  FeedbackSlot GetImpl(FeedbackSlotKind slot_kind, void* node) const {
+    Key key = std::make_pair(slot_kind, node);
     auto iter = map_.find(key);
     if (iter != map_.end()) {
       return iter->second;
@@ -831,7 +838,6 @@ class BytecodeGenerator::FeedbackSlotCache : public ZoneObject {
     return FeedbackSlot();
   }
 
- private:
   ZoneMap<Key, FeedbackSlot> map_;
 };
 
@@ -853,8 +859,22 @@ class BytecodeGenerator::IteratorRecord final {
   Register next_;
 };
 
+#ifdef DEBUG
+
+static bool IsInEagerLiterals(
+    FunctionLiteral* literal,
+    const ZoneVector<FunctionLiteral*>& eager_literals) {
+  for (FunctionLiteral* eager_literal : eager_literals) {
+    if (literal == eager_literal) return true;
+  }
+  return false;
+}
+
+#endif  // DEBUG
+
 BytecodeGenerator::BytecodeGenerator(
-    CompilationInfo* info, const AstStringConstants* ast_string_constants)
+    CompilationInfo* info, const AstStringConstants* ast_string_constants,
+    ZoneVector<FunctionLiteral*>* eager_inner_literals)
     : zone_(info->zone()),
       builder_(zone(), info->num_parameters_including_this(),
                info->scope()->num_stack_slots(), info->feedback_vector_spec(),
@@ -863,6 +883,7 @@ BytecodeGenerator::BytecodeGenerator(
       ast_string_constants_(ast_string_constants),
       closure_scope_(info->scope()),
       current_scope_(info->scope()),
+      eager_inner_literals_(eager_inner_literals),
       feedback_slot_cache_(new (zone()) FeedbackSlotCache(zone())),
       globals_builder_(new (zone()) GlobalDeclarationsBuilder(zone())),
       block_coverage_builder_(nullptr),
@@ -878,7 +899,7 @@ BytecodeGenerator::BytecodeGenerator(
       execution_result_(nullptr),
       incoming_new_target_or_generator_(),
       generator_jump_table_(nullptr),
-      generator_state_(),
+      suspend_count_(0),
       loop_depth_(0),
       catch_prediction_(HandlerTable::UNCAUGHT) {
   DCHECK_EQ(closure_scope(), closure_scope()->GetClosureScope());
@@ -898,7 +919,7 @@ Handle<BytecodeArray> BytecodeGenerator::FinalizeBytecode(
     info()->set_coverage_info(
         isolate->factory()->NewCoverageInfo(block_coverage_builder_->slots()));
     if (FLAG_trace_block_coverage) {
-      info()->coverage_info()->Print(info()->shared_info()->name());
+      info()->coverage_info()->Print(info()->shared_info()->Name());
     }
   }
 
@@ -1091,8 +1112,6 @@ void BytecodeGenerator::GenerateBytecodeBody() {
 
 void BytecodeGenerator::AllocateTopLevelRegisters() {
   if (info()->literal()->CanSuspend()) {
-    // Allocate a register for generator_state_.
-    generator_state_ = register_allocator()->NewRegister();
     // Either directly use generator_object_var or allocate a new register for
     // the incoming generator object.
     Variable* generator_object_var = closure_scope()->generator_object_var();
@@ -1115,81 +1134,19 @@ void BytecodeGenerator::AllocateTopLevelRegisters() {
   }
 }
 
-void BytecodeGenerator::VisitIterationHeader(IterationStatement* stmt,
-                                             LoopBuilder* loop_builder) {
-  VisitIterationHeader(stmt->first_suspend_id(), stmt->suspend_count(),
-                       loop_builder);
-}
-
-void BytecodeGenerator::VisitIterationHeader(int first_suspend_id,
-                                             int suspend_count,
-                                             LoopBuilder* loop_builder) {
-  // Recall that suspend_count is always zero inside ordinary (i.e.
-  // non-generator) functions.
-  if (suspend_count == 0) {
-    loop_builder->LoopHeader();
-  } else {
-    loop_builder->LoopHeaderInGenerator(&generator_jump_table_,
-                                        first_suspend_id, suspend_count);
-
-    // Perform state dispatch on the generator state, assuming this is a resume.
-    builder()
-        ->LoadAccumulatorWithRegister(generator_state_)
-        .SwitchOnSmiNoFeedback(generator_jump_table_);
-
-    // We fall through when the generator state is not in the jump table. If we
-    // are not resuming, we want to fall through to the loop body.
-    // TODO(leszeks): Only generate this test for debug builds, we can skip it
-    // entirely in release assuming that the generator states is always valid.
-    BytecodeLabel not_resuming;
-    builder()
-        ->LoadLiteral(Smi::FromInt(JSGeneratorObject::kGeneratorExecuting))
-        .CompareOperation(Token::Value::EQ_STRICT, generator_state_)
-        .JumpIfTrue(ToBooleanMode::kAlreadyBoolean, &not_resuming);
-
-    // Otherwise this is an error.
-    builder()->Abort(AbortReason::kInvalidJumpTableIndex);
-
-    builder()->Bind(&not_resuming);
-  }
-}
-
 void BytecodeGenerator::BuildGeneratorPrologue() {
   DCHECK_GT(info()->literal()->suspend_count(), 0);
-  DCHECK(generator_state_.is_valid());
   DCHECK(generator_object().is_valid());
   generator_jump_table_ =
       builder()->AllocateJumpTable(info()->literal()->suspend_count(), 0);
 
-  BytecodeLabel regular_call;
-  builder()
-      ->LoadAccumulatorWithRegister(generator_object())
-      .JumpIfUndefined(&regular_call);
-
-  // This is a resume call. Restore the current context and the registers,
-  // then perform state dispatch.
-  {
-    RegisterAllocationScope register_scope(this);
-    Register generator_context = register_allocator()->NewRegister();
-    builder()
-        ->CallRuntime(Runtime::kInlineGeneratorGetContext, generator_object())
-        .PushContext(generator_context)
-        .RestoreGeneratorState(generator_object())
-        .StoreAccumulatorInRegister(generator_state_)
-        .SwitchOnSmiNoFeedback(generator_jump_table_);
-  }
-  // We fall through when the generator state is not in the jump table.
-  // TODO(leszeks): Only generate this for debug builds.
-  builder()->Abort(AbortReason::kInvalidJumpTableIndex);
+  // If the generator is not undefined, this is a resume, so perform state
+  // dispatch.
+  builder()->SwitchOnGeneratorState(generator_object(), generator_jump_table_);
 
-  // This is a regular call.
-  builder()
-      ->Bind(&regular_call)
-      .LoadLiteral(Smi::FromInt(JSGeneratorObject::kGeneratorExecuting))
-      .StoreAccumulatorInRegister(generator_state_);
-  // Now fall through to the ordinary function prologue, after which we will run
-  // into the generator object creation and other extra code inserted by the
-  // parser.
+  // Otherwise, fall-through to the ordinary function prologue, after which we
+  // will run into the generator object creation and other extra code inserted
+  // by the parser.
 }
 
 void BytecodeGenerator::VisitBlock(Block* stmt) {
@@ -1274,6 +1231,7 @@ void BytecodeGenerator::VisitFunctionDeclaration(FunctionDeclaration* decl) {
       FeedbackSlot literal_slot = GetCachedCreateClosureSlot(decl->fun());
       globals_builder()->AddFunctionDeclaration(variable->raw_name(), slot,
                                                 literal_slot, decl->fun());
+      AddToEagerLiteralsIfEager(decl->fun());
       break;
     }
     case VariableLocation::PARAMETER:
@@ -1306,6 +1264,8 @@ void BytecodeGenerator::VisitFunctionDeclaration(FunctionDeclaration* decl) {
       BuildVariableAssignment(variable, Token::INIT, HoleCheckMode::kElided);
       break;
   }
+  DCHECK_IMPLIES(decl->fun()->ShouldEagerCompile(),
+                 IsInEagerLiterals(decl->fun(), *eager_inner_literals_));
 }
 
 void BytecodeGenerator::VisitModuleNamespaceImports() {
@@ -1347,7 +1307,7 @@ void BytecodeGenerator::VisitDeclarations(Declaration::List* declarations) {
       .LoadLiteral(Smi::FromInt(encoded_flags))
       .StoreAccumulatorInRegister(args[1])
       .MoveRegister(Register::function_closure(), args[2])
-      .CallRuntime(Runtime::kDeclareGlobalsForInterpreter, args);
+      .CallRuntime(Runtime::kDeclareGlobals, args);
 
   // Push and reset globals builder.
   global_declarations_.push_back(globals_builder());
@@ -1505,11 +1465,11 @@ void BytecodeGenerator::VisitDoWhileStatement(DoWhileStatement* stmt) {
   if (stmt->cond()->ToBooleanIsFalse()) {
     VisitIterationBody(stmt, &loop_builder);
   } else if (stmt->cond()->ToBooleanIsTrue()) {
-    VisitIterationHeader(stmt, &loop_builder);
+    loop_builder.LoopHeader();
     VisitIterationBody(stmt, &loop_builder);
     loop_builder.JumpToHeader(loop_depth_);
   } else {
-    VisitIterationHeader(stmt, &loop_builder);
+    loop_builder.LoopHeader();
     VisitIterationBody(stmt, &loop_builder);
     builder()->SetExpressionAsStatementPosition(stmt->cond());
     BytecodeLabels loop_backbranch(zone());
@@ -1528,7 +1488,7 @@ void BytecodeGenerator::VisitWhileStatement(WhileStatement* stmt) {
     return;
   }
 
-  VisitIterationHeader(stmt, &loop_builder);
+  loop_builder.LoopHeader();
   if (!stmt->cond()->ToBooleanIsTrue()) {
     builder()->SetExpressionAsStatementPosition(stmt->cond());
     BytecodeLabels loop_body(zone());
@@ -1552,7 +1512,7 @@ void BytecodeGenerator::VisitForStatement(ForStatement* stmt) {
     return;
   }
 
-  VisitIterationHeader(stmt, &loop_builder);
+  loop_builder.LoopHeader();
   if (stmt->cond() && !stmt->cond()->ToBooleanIsTrue()) {
     builder()->SetExpressionAsStatementPosition(stmt->cond());
     BytecodeLabels loop_body(zone());
@@ -1670,7 +1630,7 @@ void BytecodeGenerator::VisitForInStatement(ForInStatement* stmt) {
   // The loop
   {
     LoopBuilder loop_builder(builder(), block_coverage_builder_, stmt);
-    VisitIterationHeader(stmt, &loop_builder);
+    loop_builder.LoopHeader();
     builder()->SetExpressionAsStatementPosition(stmt->each());
     builder()->ForInContinue(index, cache_length);
     loop_builder.BreakIfFalse(ToBooleanMode::kAlreadyBoolean);
@@ -1694,7 +1654,7 @@ void BytecodeGenerator::VisitForOfStatement(ForOfStatement* stmt) {
   VisitForEffect(stmt->assign_iterator());
   VisitForEffect(stmt->assign_next());
 
-  VisitIterationHeader(stmt, &loop_builder);
+  loop_builder.LoopHeader();
   builder()->SetExpressionAsStatementPosition(stmt->next_result());
   VisitForEffect(stmt->next_result());
   TypeHint type_hint = VisitForAccumulatorValue(stmt->result_done());
@@ -1832,6 +1792,14 @@ void BytecodeGenerator::VisitFunctionLiteral(FunctionLiteral* expr) {
   FeedbackSlot slot = GetCachedCreateClosureSlot(expr);
   builder()->CreateClosure(entry, feedback_index(slot), flags);
   function_literals_.push_back(std::make_pair(expr, entry));
+  AddToEagerLiteralsIfEager(expr);
+}
+
+void BytecodeGenerator::AddToEagerLiteralsIfEager(FunctionLiteral* literal) {
+  if (eager_inner_literals_ && literal->ShouldEagerCompile()) {
+    DCHECK(!IsInEagerLiterals(literal, *eager_inner_literals_));
+    eager_inner_literals_->push_back(literal);
+  }
 }
 
 void BytecodeGenerator::BuildClassLiteral(ClassLiteral* expr) {
@@ -1867,6 +1835,7 @@ void BytecodeGenerator::BuildClassLiteral(ClassLiteral* expr) {
     for (int i = 0; i < expr->properties()->length(); i++) {
       ClassLiteral::Property* property = expr->properties()->at(i);
       if (property->is_computed_name()) {
+        DCHECK_NE(property->kind(), ClassLiteral::Property::PRIVATE_FIELD);
         Register key = register_allocator()->GrowRegisterList(&args);
 
         BuildLoadPropertyKey(property, key);
@@ -1884,7 +1853,7 @@ void BytecodeGenerator::BuildClassLiteral(ClassLiteral* expr) {
               .Bind(&done);
         }
 
-        if (property->kind() == ClassLiteral::Property::FIELD) {
+        if (property->kind() == ClassLiteral::Property::PUBLIC_FIELD) {
           // Initialize field's name variable with the computed name.
           DCHECK_NOT_NULL(property->computed_name_var());
           builder()->LoadAccumulatorWithRegister(key);
@@ -1892,11 +1861,19 @@ void BytecodeGenerator::BuildClassLiteral(ClassLiteral* expr) {
                                   HoleCheckMode::kElided);
         }
       }
-      if (property->kind() == ClassLiteral::Property::FIELD) {
+
+      if (property->kind() == ClassLiteral::Property::PUBLIC_FIELD) {
         // We don't compute field's value here, but instead do it in the
         // initializer function.
         continue;
+      } else if (property->kind() == ClassLiteral::Property::PRIVATE_FIELD) {
+        builder()->CallRuntime(Runtime::kCreatePrivateFieldSymbol);
+        DCHECK_NOT_NULL(property->private_field_name_var());
+        BuildVariableAssignment(property->private_field_name_var(), Token::INIT,
+                                HoleCheckMode::kElided);
+        continue;
       }
+
       Register value = register_allocator()->GrowRegisterList(&args);
       VisitForRegisterValue(property->value(), value);
     }
@@ -1976,12 +1953,18 @@ void BytecodeGenerator::VisitInitializeClassFieldsStatement(
     ClassLiteral::Property* property = expr->fields()->at(i);
 
     if (property->is_computed_name()) {
+      DCHECK_EQ(property->kind(), ClassLiteral::Property::PUBLIC_FIELD);
       Variable* var = property->computed_name_var();
       DCHECK_NOT_NULL(var);
       // The computed name is already evaluated and stored in a
       // variable at class definition time.
       BuildVariableLoad(var, HoleCheckMode::kElided);
       builder()->StoreAccumulatorInRegister(key);
+    } else if (property->kind() == ClassLiteral::Property::PRIVATE_FIELD) {
+      Variable* private_field_name_var = property->private_field_name_var();
+      DCHECK_NOT_NULL(private_field_name_var);
+      BuildVariableLoad(private_field_name_var, HoleCheckMode::kElided);
+      builder()->StoreAccumulatorInRegister(key);
     } else {
       BuildLoadPropertyKey(property, key);
     }
@@ -1989,7 +1972,11 @@ void BytecodeGenerator::VisitInitializeClassFieldsStatement(
     VisitForRegisterValue(property->value(), value);
     VisitSetHomeObject(value, constructor, property);
 
-    builder()->CallRuntime(Runtime::kCreateDataProperty, args);
+    Runtime::FunctionId function_id =
+        property->kind() == ClassLiteral::Property::PUBLIC_FIELD
+            ? Runtime::kCreateDataProperty
+            : Runtime::kAddPrivateField;
+    builder()->CallRuntime(function_id, args);
   }
 }
 
@@ -2076,6 +2063,7 @@ void BytecodeGenerator::VisitLiteral(Literal* expr) {
       break;
     case Literal::kString:
       builder()->LoadLiteral(expr->AsRawString());
+      execution_result()->SetResultIsString();
       break;
     case Literal::kSymbol:
       builder()->LoadLiteral(expr->AsSymbol());
@@ -2114,7 +2102,7 @@ void BytecodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
   // If constant properties is an empty fixed array, use a cached empty fixed
   // array to ensure it's only added to the constant pool once.
   if (expr->properties_count() == 0) {
-    entry = builder()->EmptyFixedArrayConstantPoolEntry();
+    entry = builder()->EmptyBoilerplateDescriptionConstantPoolEntry();
   } else {
     entry = builder()->AllocateDeferredConstantPoolEntry();
     object_literals_.push_back(std::make_pair(expr, entry));
@@ -2140,13 +2128,14 @@ void BytecodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
         UNREACHABLE();
       case ObjectLiteral::Property::MATERIALIZED_LITERAL:
         DCHECK(!CompileTimeValue::IsCompileTimeValue(property->value()));
-      // Fall through.
+        V8_FALLTHROUGH;
       case ObjectLiteral::Property::COMPUTED: {
         // It is safe to use [[Put]] here because the boilerplate already
         // contains computed properties with an uninitialized value.
         if (key->IsStringLiteral()) {
           DCHECK(key->IsPropertyName());
           if (property->emit_store()) {
+            builder()->SetExpressionPosition(property->value());
             VisitForAccumulatorValue(property->value());
             FeedbackSlot slot = feedback_spec()->AddStoreOwnICSlot();
             if (FunctionLiteral::NeedsHomeObject(property->value())) {
@@ -2161,13 +2150,16 @@ void BytecodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
                   literal, key->AsRawPropertyName(), feedback_index(slot));
             }
           } else {
+            builder()->SetExpressionPosition(property->value());
             VisitForEffect(property->value());
           }
         } else {
           RegisterList args = register_allocator()->NewRegisterList(4);
 
           builder()->MoveRegister(literal, args[0]);
+          builder()->SetExpressionPosition(property->key());
           VisitForRegisterValue(property->key(), args[1]);
+          builder()->SetExpressionPosition(property->value());
           VisitForRegisterValue(property->value(), args[2]);
           if (property->emit_store()) {
             builder()
@@ -2187,6 +2179,7 @@ void BytecodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
         DCHECK(!property->NeedsSetFunctionName());
         RegisterList args = register_allocator()->NewRegisterList(2);
         builder()->MoveRegister(literal, args[0]);
+        builder()->SetExpressionPosition(property->value());
         VisitForRegisterValue(property->value(), args[1]);
         builder()->CallRuntime(Runtime::kInternalSetPrototype, args);
         break;
@@ -2240,6 +2233,7 @@ void BytecodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
       DCHECK(!property->NeedsSetFunctionName());
       RegisterList args = register_allocator()->NewRegisterList(2);
       builder()->MoveRegister(literal, args[0]);
+      builder()->SetExpressionPosition(property->value());
       VisitForRegisterValue(property->value(), args[1]);
       builder()->CallRuntime(Runtime::kInternalSetPrototype, args);
       continue;
@@ -2251,6 +2245,7 @@ void BytecodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
       case ObjectLiteral::Property::MATERIALIZED_LITERAL: {
         Register key = register_allocator()->NewRegister();
         BuildLoadPropertyKey(property, key);
+        builder()->SetExpressionPosition(property->value());
         Register value = VisitForRegisterValue(property->value());
         VisitSetHomeObject(value, literal, property);
 
@@ -2273,6 +2268,7 @@ void BytecodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
         RegisterList args = register_allocator()->NewRegisterList(4);
         builder()->MoveRegister(literal, args[0]);
         BuildLoadPropertyKey(property, args[1]);
+        builder()->SetExpressionPosition(property->value());
         VisitForRegisterValue(property->value(), args[2]);
         VisitSetHomeObject(args[2], literal, property);
         builder()
@@ -2288,6 +2284,7 @@ void BytecodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
       case ObjectLiteral::Property::SPREAD: {
         RegisterList args = register_allocator()->NewRegisterList(2);
         builder()->MoveRegister(literal, args[0]);
+        builder()->SetExpressionPosition(property->value());
         VisitForRegisterValue(property->value(), args[1]);
         builder()->CallRuntime(Runtime::kCopyDataProperties, args);
         break;
@@ -2319,17 +2316,18 @@ void BytecodeGenerator::VisitArrayLiteral(ArrayLiteral* expr) {
   builder()->CreateArrayLiteral(entry, literal_index, flags);
   array_literals_.push_back(std::make_pair(expr, entry));
 
-  Register index = register_allocator()->NewRegister();
   Register literal = register_allocator()->NewRegister();
   builder()->StoreAccumulatorInRegister(literal);
 
   // We'll reuse the same literal slot for all of the non-constant
   // subexpressions that use a keyed store IC.
 
+  Register index = register_allocator()->NewRegister();
+  int array_index = 0;
+
   // Evaluate all the non-constant subexpressions and store them into the
   // newly cloned array.
   FeedbackSlot slot;
-  int array_index = 0;
   ZoneList<Expression*>::iterator iter = expr->BeginValue();
   for (; iter != expr->FirstSpreadOrEndValue(); ++iter, array_index++) {
     Expression* subexpr = *iter;
@@ -2345,32 +2343,38 @@ void BytecodeGenerator::VisitArrayLiteral(ArrayLiteral* expr) {
     builder()->StoreKeyedProperty(literal, index, feedback_index(slot),
                                   language_mode());
   }
-
-  // Handle spread elements and elements following.
-  for (; iter != expr->EndValue(); ++iter) {
-    Expression* subexpr = *iter;
-    if (subexpr->IsSpread()) {
-      BuildArrayLiteralSpread(subexpr->AsSpread(), literal);
-    } else if (!subexpr->IsTheHoleLiteral()) {
-      // Perform %AppendElement(array, <subexpr>)
-      RegisterAllocationScope register_scope(this);
-      RegisterList args = register_allocator()->NewRegisterList(2);
-      builder()->MoveRegister(literal, args[0]);
-      VisitForRegisterValue(subexpr, args[1]);
-      builder()->CallRuntime(Runtime::kAppendElement, args);
-    } else {
-      // Peform ++<array>.length;
-      // TODO(caitp): Why can't we just %AppendElement(array, <The Hole>?)
-      auto length = ast_string_constants()->length_string();
-      builder()->LoadNamedProperty(
-          literal, length, feedback_index(feedback_spec()->AddLoadICSlot()));
-      builder()->UnaryOperation(
-          Token::INC, feedback_index(feedback_spec()->AddBinaryOpICSlot()));
-      builder()->StoreNamedProperty(
-          literal, length,
-          feedback_index(
-              feedback_spec()->AddStoreICSlot(LanguageMode::kStrict)),
-          LanguageMode::kStrict);
+  if (iter != expr->EndValue()) {
+    builder()->LoadLiteral(array_index).StoreAccumulatorInRegister(index);
+
+    // Handle the first spread element and everything that follows.
+    FeedbackSlot element_slot = feedback_spec()->AddStoreInArrayLiteralICSlot();
+    FeedbackSlot index_slot = feedback_spec()->AddBinaryOpICSlot();
+    // TODO(neis): Only create length_slot when there are holes.
+    FeedbackSlot length_slot =
+        feedback_spec()->AddStoreICSlot(LanguageMode::kStrict);
+    for (; iter != expr->EndValue(); ++iter) {
+      Expression* subexpr = *iter;
+      if (subexpr->IsSpread()) {
+        BuildArrayLiteralSpread(subexpr->AsSpread(), literal, index, index_slot,
+                                element_slot);
+      } else if (!subexpr->IsTheHoleLiteral()) {
+        // literal[index++] = subexpr
+        VisitForAccumulatorValue(subexpr);
+        builder()
+            ->StoreInArrayLiteral(literal, index, feedback_index(element_slot))
+            .LoadAccumulatorWithRegister(index)
+            .UnaryOperation(Token::INC, feedback_index(index_slot))
+            .StoreAccumulatorInRegister(index);
+      } else {
+        // literal.length = ++index
+        auto length = ast_string_constants()->length_string();
+        builder()
+            ->LoadAccumulatorWithRegister(index)
+            .UnaryOperation(Token::INC, feedback_index(index_slot))
+            .StoreAccumulatorInRegister(index)
+            .StoreNamedProperty(literal, length, feedback_index(length_slot),
+                                LanguageMode::kStrict);
+      }
     }
   }
 
@@ -2378,38 +2382,58 @@ void BytecodeGenerator::VisitArrayLiteral(ArrayLiteral* expr) {
   builder()->LoadAccumulatorWithRegister(literal);
 }
 
-void BytecodeGenerator::BuildArrayLiteralSpread(Spread* spread,
-                                                Register array) {
+void BytecodeGenerator::BuildArrayLiteralSpread(Spread* spread, Register array,
+                                                Register index,
+                                                FeedbackSlot index_slot,
+                                                FeedbackSlot element_slot) {
   RegisterAllocationScope register_scope(this);
-  RegisterList args = register_allocator()->NewRegisterList(2);
-  builder()->MoveRegister(array, args[0]);
-  Register next_result = args[1];
+  Register value = register_allocator()->NewRegister();
 
   builder()->SetExpressionAsStatementPosition(spread->expression());
   IteratorRecord iterator =
       BuildGetIteratorRecord(spread->expression(), IteratorType::kNormal);
+
   LoopBuilder loop_builder(builder(), nullptr, nullptr);
   loop_builder.LoopHeader();
 
   // Call the iterator's .next() method. Break from the loop if the `done`
   // property is truthy, otherwise load the value from the iterator result and
   // append the argument.
-  BuildIteratorNext(iterator, next_result);
+  BuildIteratorNext(iterator, value);
   builder()->LoadNamedProperty(
-      next_result, ast_string_constants()->done_string(),
+      value, ast_string_constants()->done_string(),
       feedback_index(feedback_spec()->AddLoadICSlot()));
   loop_builder.BreakIfTrue(ToBooleanMode::kConvertToBoolean);
 
   loop_builder.LoopBody();
   builder()
-      ->LoadNamedProperty(next_result, ast_string_constants()->value_string(),
+      // value = value.value
+      ->LoadNamedProperty(value, ast_string_constants()->value_string(),
                           feedback_index(feedback_spec()->AddLoadICSlot()))
-      .StoreAccumulatorInRegister(args[1])
-      .CallRuntime(Runtime::kAppendElement, args);
+      .StoreAccumulatorInRegister(value)
+      // array[index] = value
+      .StoreInArrayLiteral(array, index, feedback_index(element_slot))
+      // index++
+      .LoadAccumulatorWithRegister(index)
+      .UnaryOperation(Token::INC, feedback_index(index_slot))
+      .StoreAccumulatorInRegister(index);
   loop_builder.BindContinueTarget();
   loop_builder.JumpToHeader(loop_depth_);
 }
 
+void BytecodeGenerator::VisitStoreInArrayLiteral(StoreInArrayLiteral* expr) {
+  builder()->SetExpressionAsStatementPosition(expr);
+  RegisterAllocationScope register_scope(this);
+  Register array = register_allocator()->NewRegister();
+  Register index = register_allocator()->NewRegister();
+  VisitForRegisterValue(expr->array(), array);
+  VisitForRegisterValue(expr->index(), index);
+  VisitForAccumulatorValue(expr->value());
+  builder()->StoreInArrayLiteral(
+      array, index,
+      feedback_index(feedback_spec()->AddStoreInArrayLiteralICSlot()));
+}
+
 void BytecodeGenerator::VisitVariableProxy(VariableProxy* proxy) {
   builder()->SetExpressionPosition(proxy);
   BuildVariableLoad(proxy->var(), proxy->hole_check_mode());
@@ -2563,7 +2587,7 @@ void BytecodeGenerator::BuildAsyncReturn(int source_position) {
     BuildVariableLoad(var_promise, HoleCheckMode::kElided);
     builder()
         ->StoreAccumulatorInRegister(promise)
-        .CallJSRuntime(Context::PROMISE_RESOLVE_INDEX, args)
+        .CallRuntime(Runtime::kInlineResolvePromise, args)
         .LoadAccumulatorWithRegister(promise);
   }
 
@@ -2635,9 +2659,7 @@ void BytecodeGenerator::BuildVariableAssignment(
       break;
     }
     case VariableLocation::UNALLOCATED: {
-      // TODO(ishell): consider using FeedbackSlotCache for variables here.
-      FeedbackSlot slot =
-          feedback_spec()->AddStoreGlobalICSlot(language_mode());
+      FeedbackSlot slot = GetCachedStoreGlobalICSlot(language_mode(), variable);
       builder()->StoreGlobal(variable->raw_name(), feedback_index(slot));
       break;
     }
@@ -2863,32 +2885,33 @@ void BytecodeGenerator::VisitCompoundAssignment(CompoundAssignment* expr) {
   VisitAssignment(expr);
 }
 
-// Suspends the generator to resume at |suspend_id|, with output stored in the
-// accumulator. When the generator is resumed, the sent value is loaded in the
-// accumulator.
-void BytecodeGenerator::BuildSuspendPoint(int suspend_id) {
+// Suspends the generator to resume at the next suspend_id, with output stored
+// in the accumulator. When the generator is resumed, the sent value is loaded
+// in the accumulator.
+void BytecodeGenerator::BuildSuspendPoint(Expression* suspend_expr) {
+  const int suspend_id = suspend_count_++;
+
   RegisterList registers = register_allocator()->AllLiveRegisters();
 
-  // Save context, registers, and state. Then return.
+  // Save context, registers, and state. This bytecode then returns the value
+  // in the accumulator.
+  builder()->SetExpressionPosition(suspend_expr);
   builder()->SuspendGenerator(generator_object(), registers, suspend_id);
 
-  builder()->SetReturnPosition(kNoSourcePosition, info()->literal());
-  builder()->Return();  // Hard return (ignore any finally blocks).
-
   // Upon resume, we continue here.
   builder()->Bind(generator_jump_table_, suspend_id);
 
-  // Clobbers all registers, updating the state to indicate that we have
-  // finished resuming and setting the accumulator to the [[input_or_debug_pos]]
-  // slot of the generator object.
-  builder()->ResumeGenerator(generator_object(), generator_state_, registers);
+  // Clobbers all registers and sets the accumulator to the
+  // [[input_or_debug_pos]] slot of the generator object.
+  builder()->ResumeGenerator(generator_object(), registers);
 }
 
 void BytecodeGenerator::VisitYield(Yield* expr) {
   builder()->SetExpressionPosition(expr);
   VisitForAccumulatorValue(expr->expression());
 
-  if (!expr->IsInitialYield()) {
+  // If this is not the first yield
+  if (suspend_count_ > 0) {
     if (IsAsyncGeneratorFunction(function_kind())) {
       // AsyncGenerator yields (with the exception of the initial yield)
       // delegate work to the AsyncGeneratorYield stub, which Awaits the operand
@@ -2914,7 +2937,7 @@ void BytecodeGenerator::VisitYield(Yield* expr) {
     }
   }
 
-  BuildSuspendPoint(expr->suspend_id());
+  BuildSuspendPoint(expr);
   // At this point, the generator has been resumed, with the received value in
   // the accumulator.
 
@@ -3053,10 +3076,16 @@ void BytecodeGenerator::VisitYieldStar(YieldStar* expr) {
       // visible to the user, and we therefore neither pass the block coverage
       // builder nor the expression.
       //
-      // YieldStar in AsyncGenerator functions includes 3 suspend points, rather
-      // than 1. These are documented in the YieldStar AST node.
+      // In addition to the normal suspend for yield*, a yield* in an async
+      // generator has 2 additional suspends:
+      //   - One for awaiting the iterator result of closing the generator when
+      //     resumed with a "throw" completion, and a throw method is not
+      //     present on the delegated iterator
+      //   - One for awaiting the iterator result yielded by the delegated
+      //     iterator
+
       LoopBuilder loop(builder(), nullptr, nullptr);
-      VisitIterationHeader(expr->suspend_id(), expr->suspend_count(), &loop);
+      loop.LoopHeader();
 
       {
         BytecodeLabels after_switch(zone());
@@ -3110,7 +3139,7 @@ void BytecodeGenerator::VisitYieldStar(YieldStar* expr) {
           // If there is no "throw" method, perform IteratorClose, and finally
           // throw a TypeError.
           no_throw_method.Bind(builder());
-          BuildIteratorClose(iterator, expr->await_iterator_close_suspend_id());
+          BuildIteratorClose(iterator, expr);
           builder()->CallRuntime(Runtime::kThrowThrowMethodMissing);
         }
 
@@ -3119,7 +3148,7 @@ void BytecodeGenerator::VisitYieldStar(YieldStar* expr) {
 
       if (iterator_type == IteratorType::kAsync) {
         // Await the result of the method invocation.
-        BuildAwait(expr->await_delegated_iterator_output_suspend_id());
+        BuildAwait(expr);
       }
 
       // Check that output is an object.
@@ -3159,7 +3188,7 @@ void BytecodeGenerator::VisitYieldStar(YieldStar* expr) {
             .CallRuntime(Runtime::kInlineAsyncGeneratorYield, args);
       }
 
-      BuildSuspendPoint(expr->suspend_id());
+      BuildSuspendPoint(expr);
       builder()->StoreAccumulatorInRegister(input);
       builder()
           ->CallRuntime(Runtime::kInlineGeneratorGetResumeMode,
@@ -3195,7 +3224,7 @@ void BytecodeGenerator::VisitYieldStar(YieldStar* expr) {
   builder()->LoadAccumulatorWithRegister(output_value);
 }
 
-void BytecodeGenerator::BuildAwait(int suspend_id) {
+void BytecodeGenerator::BuildAwait(Expression* await_expr) {
   // Rather than HandlerTable::UNCAUGHT, async functions use
   // HandlerTable::ASYNC_AWAIT to communicate that top-level exceptions are
   // transformed into promise rejections. This is necessary to prevent emitting
@@ -3208,22 +3237,20 @@ void BytecodeGenerator::BuildAwait(int suspend_id) {
     // Await(operand) and suspend.
     RegisterAllocationScope register_scope(this);
 
-    int await_builtin_context_index;
+    Runtime::FunctionId id;
     RegisterList args;
     if (IsAsyncGeneratorFunction(function_kind())) {
-      await_builtin_context_index =
-          catch_prediction() == HandlerTable::ASYNC_AWAIT
-              ? Context::ASYNC_GENERATOR_AWAIT_UNCAUGHT
-              : Context::ASYNC_GENERATOR_AWAIT_CAUGHT;
+      id = catch_prediction() == HandlerTable::ASYNC_AWAIT
+               ? Runtime::kInlineAsyncGeneratorAwaitUncaught
+               : Runtime::kInlineAsyncGeneratorAwaitCaught;
       args = register_allocator()->NewRegisterList(2);
       builder()
           ->MoveRegister(generator_object(), args[0])
           .StoreAccumulatorInRegister(args[1]);
     } else {
-      await_builtin_context_index =
-          catch_prediction() == HandlerTable::ASYNC_AWAIT
-              ? Context::ASYNC_FUNCTION_AWAIT_UNCAUGHT_INDEX
-              : Context::ASYNC_FUNCTION_AWAIT_CAUGHT_INDEX;
+      id = catch_prediction() == HandlerTable::ASYNC_AWAIT
+               ? Runtime::kInlineAsyncFunctionAwaitUncaught
+               : Runtime::kInlineAsyncFunctionAwaitCaught;
       args = register_allocator()->NewRegisterList(3);
       builder()
           ->MoveRegister(generator_object(), args[0])
@@ -3236,10 +3263,10 @@ void BytecodeGenerator::BuildAwait(int suspend_id) {
       builder()->StoreAccumulatorInRegister(args[2]);
     }
 
-    builder()->CallJSRuntime(await_builtin_context_index, args);
+    builder()->CallRuntime(id, args);
   }
 
-  BuildSuspendPoint(suspend_id);
+  BuildSuspendPoint(await_expr);
 
   Register input = register_allocator()->NewRegister();
   Register resume_mode = register_allocator()->NewRegister();
@@ -3267,7 +3294,7 @@ void BytecodeGenerator::BuildAwait(int suspend_id) {
 void BytecodeGenerator::VisitAwait(Await* expr) {
   builder()->SetExpressionPosition(expr);
   VisitForAccumulatorValue(expr->expression());
-  BuildAwait(expr->suspend_id());
+  BuildAwait(expr);
   BuildIncrementBlockCoverageCounterIfEnabled(expr,
                                               SourceRangeKind::kContinuation);
 }
@@ -3914,7 +3941,8 @@ void BytecodeGenerator::VisitNaryOperation(NaryOperation* expr) {
   }
 }
 
-void BytecodeGenerator::BuildLiteralCompareNil(Token::Value op, NilValue nil) {
+void BytecodeGenerator::BuildLiteralCompareNil(
+    Token::Value op, BytecodeArrayBuilder::NilValue nil) {
   if (execution_result()->IsTest()) {
     TestResultScope* test_result = execution_result()->AsTest();
     switch (test_result->fallthrough()) {
@@ -3953,11 +3981,11 @@ void BytecodeGenerator::VisitCompareOperation(CompareOperation* expr) {
   } else if (expr->IsLiteralCompareUndefined(&sub_expr)) {
     VisitForAccumulatorValue(sub_expr);
     builder()->SetExpressionPosition(expr);
-    BuildLiteralCompareNil(expr->op(), kUndefinedValue);
+    BuildLiteralCompareNil(expr->op(), BytecodeArrayBuilder::kUndefinedValue);
   } else if (expr->IsLiteralCompareNull(&sub_expr)) {
     VisitForAccumulatorValue(sub_expr);
     builder()->SetExpressionPosition(expr);
-    BuildLiteralCompareNil(expr->op(), kNullValue);
+    BuildLiteralCompareNil(expr->op(), BytecodeArrayBuilder::kNullValue);
   } else {
     Register lhs = VisitForRegisterValue(expr->left());
     VisitForAccumulatorValue(expr->right());
@@ -3981,13 +4009,23 @@ void BytecodeGenerator::VisitArithmeticExpression(BinaryOperation* expr) {
   Expression* subexpr;
   Smi* literal;
   if (expr->IsSmiLiteralOperation(&subexpr, &literal)) {
-    VisitForAccumulatorValue(subexpr);
+    TypeHint type_hint = VisitForAccumulatorValue(subexpr);
     builder()->SetExpressionPosition(expr);
     builder()->BinaryOperationSmiLiteral(expr->op(), literal,
                                          feedback_index(slot));
+    if (expr->op() == Token::ADD && type_hint == TypeHint::kString) {
+      execution_result()->SetResultIsString();
+    }
   } else {
-    Register lhs = VisitForRegisterValue(expr->left());
-    VisitForAccumulatorValue(expr->right());
+    TypeHint lhs_type = VisitForAccumulatorValue(expr->left());
+    Register lhs = register_allocator()->NewRegister();
+    builder()->StoreAccumulatorInRegister(lhs);
+    TypeHint rhs_type = VisitForAccumulatorValue(expr->right());
+    if (expr->op() == Token::ADD &&
+        (lhs_type == TypeHint::kString || rhs_type == TypeHint::kString)) {
+      execution_result()->SetResultIsString();
+    }
+
     builder()->SetExpressionPosition(expr);
     builder()->BinaryOperation(expr->op(), lhs, feedback_index(slot));
   }
@@ -3995,7 +4033,7 @@ void BytecodeGenerator::VisitArithmeticExpression(BinaryOperation* expr) {
 
 void BytecodeGenerator::VisitNaryArithmeticExpression(NaryOperation* expr) {
   // TODO(leszeks): Add support for lhs smi in commutative ops.
-  VisitForAccumulatorValue(expr->first());
+  TypeHint type_hint = VisitForAccumulatorValue(expr->first());
 
   for (size_t i = 0; i < expr->subsequent_length(); ++i) {
     RegisterAllocationScope register_scope(this);
@@ -4007,15 +4045,23 @@ void BytecodeGenerator::VisitNaryArithmeticExpression(NaryOperation* expr) {
     } else {
       Register lhs = register_allocator()->NewRegister();
       builder()->StoreAccumulatorInRegister(lhs);
-      VisitForAccumulatorValue(expr->subsequent(i));
+      TypeHint rhs_hint = VisitForAccumulatorValue(expr->subsequent(i));
+      if (rhs_hint == TypeHint::kString) type_hint = TypeHint::kString;
       builder()->SetExpressionPosition(expr->subsequent_op_position(i));
       builder()->BinaryOperation(
           expr->op(), lhs,
           feedback_index(feedback_spec()->AddBinaryOpICSlot()));
     }
   }
+
+  if (type_hint == TypeHint::kString && expr->op() == Token::ADD) {
+    // If any operand of an ADD is a String, a String is produced.
+    execution_result()->SetResultIsString();
+  }
 }
 
+// Note: the actual spreading is performed by the surrounding expression's
+// visitor.
 void BytecodeGenerator::VisitSpread(Spread* expr) { Visit(expr->expression()); }
 
 void BytecodeGenerator::VisitEmptyParentheses(EmptyParentheses* expr) {
@@ -4154,7 +4200,7 @@ void BytecodeGenerator::BuildCallIteratorMethod(Register iterator,
 }
 
 void BytecodeGenerator::BuildIteratorClose(const IteratorRecord& iterator,
-                                           int suspend_id) {
+                                           Expression* expr) {
   RegisterAllocationScope register_scope(this);
   BytecodeLabels done(zone());
   BytecodeLabel if_called;
@@ -4165,8 +4211,8 @@ void BytecodeGenerator::BuildIteratorClose(const IteratorRecord& iterator,
   builder()->Bind(&if_called);
 
   if (iterator.type() == IteratorType::kAsync) {
-    DCHECK_GE(suspend_id, 0);
-    BuildAwait(suspend_id);
+    DCHECK_NOT_NULL(expr);
+    BuildAwait(expr);
   }
 
   builder()->JumpIfJSReceiver(done.New());
@@ -4190,7 +4236,55 @@ void BytecodeGenerator::VisitGetTemplateObject(GetTemplateObject* expr) {
   builder()->SetExpressionPosition(expr);
   size_t entry = builder()->AllocateDeferredConstantPoolEntry();
   template_objects_.push_back(std::make_pair(expr, entry));
-  builder()->GetTemplateObject(entry);
+  FeedbackSlot literal_slot = feedback_spec()->AddLiteralSlot();
+  builder()->GetTemplateObject(entry, feedback_index(literal_slot));
+}
+
+void BytecodeGenerator::VisitTemplateLiteral(TemplateLiteral* expr) {
+  const TemplateLiteral::StringList& parts = *expr->string_parts();
+  const TemplateLiteral::ExpressionList& substitutions = *expr->substitutions();
+  // Template strings with no substitutions are turned into StringLiterals.
+  DCHECK_GT(substitutions.length(), 0);
+  DCHECK_EQ(parts.length(), substitutions.length() + 1);
+
+  // Generate string concatenation
+  // TODO(caitp): Don't generate feedback slot if it's not used --- introduce
+  // a simple, concise, reusable mechanism to lazily create reusable slots.
+  FeedbackSlot slot = feedback_spec()->AddBinaryOpICSlot();
+  Register last_part = register_allocator()->NewRegister();
+  bool last_part_valid = false;
+
+  builder()->SetExpressionPosition(expr);
+  for (int i = 0; i < substitutions.length(); ++i) {
+    if (i != 0) {
+      builder()->StoreAccumulatorInRegister(last_part);
+      last_part_valid = true;
+    }
+
+    if (!parts[i]->IsEmpty()) {
+      builder()->LoadLiteral(parts[i]);
+      if (last_part_valid) {
+        builder()->BinaryOperation(Token::ADD, last_part, feedback_index(slot));
+      }
+      builder()->StoreAccumulatorInRegister(last_part);
+      last_part_valid = true;
+    }
+
+    TypeHint type_hint = VisitForAccumulatorValue(substitutions[i]);
+    if (type_hint != TypeHint::kString) {
+      builder()->ToString();
+    }
+    if (last_part_valid) {
+      builder()->BinaryOperation(Token::ADD, last_part, feedback_index(slot));
+    }
+    last_part_valid = false;
+  }
+
+  if (!parts.last()->IsEmpty()) {
+    builder()->StoreAccumulatorInRegister(last_part);
+    builder()->LoadLiteral(parts.last());
+    builder()->BinaryOperation(Token::ADD, last_part, feedback_index(slot));
+  }
 }
 
 void BytecodeGenerator::VisitThisFunction(ThisFunction* expr) {
@@ -4868,23 +4962,42 @@ int BytecodeGenerator::feedback_index(FeedbackSlot slot) const {
 
 FeedbackSlot BytecodeGenerator::GetCachedLoadGlobalICSlot(
     TypeofMode typeof_mode, Variable* variable) {
-  FeedbackSlot slot = feedback_slot_cache()->Get(typeof_mode, variable);
+  FeedbackSlotKind slot_kind =
+      typeof_mode == INSIDE_TYPEOF
+          ? FeedbackSlotKind::kLoadGlobalInsideTypeof
+          : FeedbackSlotKind::kLoadGlobalNotInsideTypeof;
+  FeedbackSlot slot = feedback_slot_cache()->Get(slot_kind, variable);
   if (!slot.IsInvalid()) {
     return slot;
   }
   slot = feedback_spec()->AddLoadGlobalICSlot(typeof_mode);
-  feedback_slot_cache()->Put(typeof_mode, variable, slot);
+  feedback_slot_cache()->Put(slot_kind, variable, slot);
+  return slot;
+}
+
+FeedbackSlot BytecodeGenerator::GetCachedStoreGlobalICSlot(
+    LanguageMode language_mode, Variable* variable) {
+  FeedbackSlotKind slot_kind = is_strict(language_mode)
+                                   ? FeedbackSlotKind::kStoreGlobalStrict
+                                   : FeedbackSlotKind::kStoreGlobalSloppy;
+  FeedbackSlot slot = feedback_slot_cache()->Get(slot_kind, variable);
+  if (!slot.IsInvalid()) {
+    return slot;
+  }
+  slot = feedback_spec()->AddStoreGlobalICSlot(language_mode);
+  feedback_slot_cache()->Put(slot_kind, variable, slot);
   return slot;
 }
 
 FeedbackSlot BytecodeGenerator::GetCachedCreateClosureSlot(
     FunctionLiteral* literal) {
-  FeedbackSlot slot = feedback_slot_cache()->Get(literal);
+  FeedbackSlotKind slot_kind = FeedbackSlotKind::kCreateClosure;
+  FeedbackSlot slot = feedback_slot_cache()->Get(slot_kind, literal);
   if (!slot.IsInvalid()) {
     return slot;
   }
   slot = feedback_spec()->AddCreateClosureSlot();
-  feedback_slot_cache()->Put(literal, slot);
+  feedback_slot_cache()->Put(slot_kind, literal, slot);
   return slot;
 }
 
diff --git a/deps/v8/src/interpreter/bytecode-generator.h b/deps/v8/src/interpreter/bytecode-generator.h
index f9de9550fe1..797dc483022 100644
--- a/deps/v8/src/interpreter/bytecode-generator.h
+++ b/deps/v8/src/interpreter/bytecode-generator.h
@@ -28,8 +28,9 @@ class BytecodeJumpTable;
 
 class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
  public:
-  explicit BytecodeGenerator(CompilationInfo* info,
-                             const AstStringConstants* ast_string_constants);
+  explicit BytecodeGenerator(
+      CompilationInfo* info, const AstStringConstants* ast_string_constants,
+      ZoneVector<FunctionLiteral*>* eager_inner_literals);
 
   void GenerateBytecode(uintptr_t stack_limit);
   Handle<BytecodeArray> FinalizeBytecode(Isolate* isolate,
@@ -65,7 +66,7 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
   using ToBooleanMode = BytecodeArrayBuilder::ToBooleanMode;
 
   enum class TestFallthrough { kThen, kElse, kNone };
-  enum class TypeHint { kAny, kBoolean };
+  enum class TypeHint { kAny, kBoolean, kString };
 
   void GenerateBytecodeBody();
   void AllocateDeferredConstants(Isolate* isolate, Handle<Script> script);
@@ -126,7 +127,8 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
   void BuildVariableAssignment(
       Variable* variable, Token::Value op, HoleCheckMode hole_check_mode,
       LookupHoistingMode lookup_hoisting_mode = LookupHoistingMode::kNormal);
-  void BuildLiteralCompareNil(Token::Value compare_op, NilValue nil);
+  void BuildLiteralCompareNil(Token::Value compare_op,
+                              BytecodeArrayBuilder::NilValue nil);
   void BuildReturn(int source_position = kNoSourcePosition);
   void BuildAsyncReturn(int source_position = kNoSourcePosition);
   void BuildAsyncGeneratorReturn();
@@ -146,9 +148,9 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
   void BuildNewLocalWithContext(Scope* scope);
 
   void BuildGeneratorPrologue();
-  void BuildSuspendPoint(int suspend_id);
+  void BuildSuspendPoint(Expression* suspend_expr);
 
-  void BuildAwait(int suspend_id);
+  void BuildAwait(Expression* await_expr);
 
   void BuildGetIterator(Expression* iterable, IteratorType hint);
 
@@ -164,13 +166,16 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
   IteratorRecord BuildGetIteratorRecord(Expression* iterable,
                                         IteratorType hint);
   void BuildIteratorNext(const IteratorRecord& iterator, Register next_result);
-  void BuildIteratorClose(const IteratorRecord& iterator, int suspend_id = -1);
+  void BuildIteratorClose(const IteratorRecord& iterator,
+                          Expression* expr = nullptr);
   void BuildCallIteratorMethod(Register iterator, const AstRawString* method,
                                RegisterList receiver_and_args,
                                BytecodeLabel* if_called,
                                BytecodeLabels* if_notcalled);
 
-  void BuildArrayLiteralSpread(Spread* spread, Register array);
+  void BuildArrayLiteralSpread(Spread* spread, Register array, Register index,
+                               FeedbackSlot index_slot,
+                               FeedbackSlot element_slot);
 
   void AllocateTopLevelRegisters();
   void VisitArgumentsObject(Variable* variable);
@@ -212,11 +217,7 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
                                     BytecodeLabels* end_labels,
                                     int coverage_slot);
 
-  // Visit the header/body of a loop iteration.
-  void VisitIterationHeader(IterationStatement* stmt,
-                            LoopBuilder* loop_builder);
-  void VisitIterationHeader(int first_suspend_id, int suspend_count,
-                            LoopBuilder* loop_builder);
+  // Visit the body of a loop iteration.
   void VisitIterationBody(IterationStatement* stmt, LoopBuilder* loop_builder);
 
   // Visit a statement and switch scopes, the context is in the accumulator.
@@ -261,8 +262,12 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
   // already exists.
   FeedbackSlot GetCachedLoadGlobalICSlot(TypeofMode typeof_mode,
                                          Variable* variable);
+  FeedbackSlot GetCachedStoreGlobalICSlot(LanguageMode language_mode,
+                                          Variable* variable);
   FeedbackSlot GetCachedCreateClosureSlot(FunctionLiteral* literal);
 
+  void AddToEagerLiteralsIfEager(FunctionLiteral* literal);
+
   static constexpr ToBooleanMode ToBooleanModeFromTypeHint(TypeHint type_hint) {
     return type_hint == TypeHint::kBoolean ? ToBooleanMode::kAlreadyBoolean
                                            : ToBooleanMode::kConvertToBoolean;
@@ -324,6 +329,9 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
   DeclarationScope* closure_scope_;
   Scope* current_scope_;
 
+  // External vector of literals to be eagerly compiled.
+  ZoneVector<FunctionLiteral*>* eager_inner_literals_;
+
   FeedbackSlotCache* feedback_slot_cache_;
 
   GlobalDeclarationsBuilder* globals_builder_;
@@ -344,7 +352,7 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
   Register incoming_new_target_or_generator_;
 
   BytecodeJumpTable* generator_jump_table_;
-  Register generator_state_;
+  int suspend_count_;
   int loop_depth_;
 
   HandlerTable::CatchPrediction catch_prediction_;
diff --git a/deps/v8/src/interpreter/bytecodes.cc b/deps/v8/src/interpreter/bytecodes.cc
index 61173a83413..88cdae6ce52 100644
--- a/deps/v8/src/interpreter/bytecodes.cc
+++ b/deps/v8/src/interpreter/bytecodes.cc
@@ -200,6 +200,17 @@ bool Bytecodes::IsRegisterOperandType(OperandType operand_type) {
   return false;
 }
 
+// static
+bool Bytecodes::IsRegisterListOperandType(OperandType operand_type) {
+  switch (operand_type) {
+    case OperandType::kRegList:
+    case OperandType::kRegOutList:
+      return true;
+    default:
+      return false;
+  }
+}
+
 bool Bytecodes::MakesCallAlongCriticalPath(Bytecode bytecode) {
   if (IsCallOrConstruct(bytecode) || IsCallRuntime(bytecode)) return true;
   switch (bytecode) {
diff --git a/deps/v8/src/interpreter/bytecodes.h b/deps/v8/src/interpreter/bytecodes.h
index ce01566d52d..1d133a0eef9 100644
--- a/deps/v8/src/interpreter/bytecodes.h
+++ b/deps/v8/src/interpreter/bytecodes.h
@@ -97,6 +97,8 @@ namespace interpreter {
     OperandType::kIdx, OperandType::kIdx)                                      \
   V(StaKeyedProperty, AccumulatorUse::kReadWrite, OperandType::kReg,           \
     OperandType::kReg, OperandType::kIdx)                                      \
+  V(StaInArrayLiteral, AccumulatorUse::kReadWrite, OperandType::kReg,          \
+    OperandType::kReg, OperandType::kIdx)                                      \
   V(StaDataPropertyInLiteral, AccumulatorUse::kRead, OperandType::kReg,        \
     OperandType::kReg, OperandType::kFlag8, OperandType::kIdx)                 \
   V(CollectTypeProfile, AccumulatorUse::kRead, OperandType::kImm)              \
@@ -221,6 +223,7 @@ namespace interpreter {
   V(ToNumber, AccumulatorUse::kReadWrite, OperandType::kIdx)                   \
   V(ToNumeric, AccumulatorUse::kReadWrite, OperandType::kIdx)                  \
   V(ToObject, AccumulatorUse::kRead, OperandType::kRegOut)                     \
+  V(ToString, AccumulatorUse::kReadWrite)                                      \
                                                                                \
   /* Literals */                                                               \
   V(CreateRegExpLiteral, AccumulatorUse::kWrite, OperandType::kIdx,            \
@@ -233,7 +236,8 @@ namespace interpreter {
   V(CreateEmptyObjectLiteral, AccumulatorUse::kWrite)                          \
                                                                                \
   /* Tagged templates */                                                       \
-  V(GetTemplateObject, AccumulatorUse::kWrite, OperandType::kIdx)              \
+  V(GetTemplateObject, AccumulatorUse::kWrite, OperandType::kIdx,              \
+    OperandType::kIdx)                                                         \
                                                                                \
   /* Closure allocation */                                                     \
   V(CreateClosure, AccumulatorUse::kWrite, OperandType::kIdx,                  \
@@ -314,11 +318,12 @@ namespace interpreter {
   V(ThrowSuperAlreadyCalledIfNotHole, AccumulatorUse::kRead)                   \
                                                                                \
   /* Generators */                                                             \
-  V(RestoreGeneratorState, AccumulatorUse::kWrite, OperandType::kReg)          \
-  V(SuspendGenerator, AccumulatorUse::kNone, OperandType::kReg,                \
+  V(SwitchOnGeneratorState, AccumulatorUse::kNone, OperandType::kReg,          \
+    OperandType::kIdx, OperandType::kUImm)                                     \
+  V(SuspendGenerator, AccumulatorUse::kRead, OperandType::kReg,                \
     OperandType::kRegList, OperandType::kRegCount, OperandType::kUImm)         \
   V(ResumeGenerator, AccumulatorUse::kWrite, OperandType::kReg,                \
-    OperandType::kRegOut, OperandType::kRegOutList, OperandType::kRegCount)    \
+    OperandType::kRegOutList, OperandType::kRegCount)                          \
                                                                                \
   /* Debugger */                                                               \
   V(Debugger, AccumulatorUse::kNone)                                           \
@@ -432,6 +437,10 @@ namespace interpreter {
   JUMP_FORWARD_BYTECODE_LIST(V) \
   V(JumpLoop)
 
+#define RETURN_BYTECODE_LIST(V) \
+  V(Return)                     \
+  V(SuspendGenerator)
+
 // Enumeration of interpreter bytecodes.
 enum class Bytecode : uint8_t {
 #define DECLARE_BYTECODE(Name, ...) k##Name,
@@ -613,11 +622,6 @@ class V8_EXPORT_PRIVATE Bytecodes final : public AllStatic {
            bytecode <= Bytecode::kJumpIfJSReceiver;
   }
 
-  // Returns true if the bytecode is a conditional jump, a jump, or a return.
-  static constexpr bool IsJumpOrReturn(Bytecode bytecode) {
-    return bytecode == Bytecode::kReturn || IsJump(bytecode);
-  }
-
   // Return true if |bytecode| is a jump without effects,
   // e.g.  any jump excluding those that include type coercion like
   // JumpIfTrueToBoolean.
@@ -627,7 +631,8 @@ class V8_EXPORT_PRIVATE Bytecodes final : public AllStatic {
 
   // Returns true if the bytecode is a switch.
   static constexpr bool IsSwitch(Bytecode bytecode) {
-    return bytecode == Bytecode::kSwitchOnSmiNoFeedback;
+    return bytecode == Bytecode::kSwitchOnSmiNoFeedback ||
+           bytecode == Bytecode::kSwitchOnGeneratorState;
   }
 
   // Returns true if |bytecode| has no effects. These bytecodes only manipulate
@@ -681,9 +686,16 @@ class V8_EXPORT_PRIVATE Bytecodes final : public AllStatic {
     return true;
   }
 
+  // Returns true if the bytecode returns.
+  static constexpr bool Returns(Bytecode bytecode) {
+#define OR_BYTECODE(NAME) || bytecode == Bytecode::k##NAME
+    return false RETURN_BYTECODE_LIST(OR_BYTECODE);
+#undef OR_BYTECODE
+  }
+
   // Returns the number of values which |bytecode| returns.
   static constexpr size_t ReturnCount(Bytecode bytecode) {
-    return bytecode == Bytecode::kReturn ? 1 : 0;
+    return Returns(bytecode) ? 1 : 0;
   }
 
   // Returns the number of operands expected by |bytecode|.
@@ -812,6 +824,9 @@ class V8_EXPORT_PRIVATE Bytecodes final : public AllStatic {
   // Returns true if |operand_type| represents a register used as an output.
   static bool IsRegisterOutputOperandType(OperandType operand_type);
 
+  // Returns true if |operand_type| represents a register list operand.
+  static bool IsRegisterListOperandType(OperandType operand_type);
+
   // Returns true if the handler for |bytecode| should look ahead and inline a
   // dispatch to a Star bytecode.
   static bool IsStarLookahead(Bytecode bytecode, OperandScale operand_scale);
diff --git a/deps/v8/src/interpreter/constant-array-builder.h b/deps/v8/src/interpreter/constant-array-builder.h
index 549b2edefc6..292bd8398c8 100644
--- a/deps/v8/src/interpreter/constant-array-builder.h
+++ b/deps/v8/src/interpreter/constant-array-builder.h
@@ -21,13 +21,14 @@ class AstValue;
 namespace interpreter {
 
 // Constant array entries that represent singletons.
-#define SINGLETON_CONSTANT_ENTRY_TYPES(V)       \
-  V(NaN, nan_value)                             \
-  V(IteratorSymbol, iterator_symbol)            \
-  V(AsyncIteratorSymbol, async_iterator_symbol) \
-  V(HomeObjectSymbol, home_object_symbol)       \
-  V(EmptyFixedArray, empty_fixed_array)         \
-  V(ClassFieldsSymbol, class_fields_symbol)
+#define SINGLETON_CONSTANT_ENTRY_TYPES(V)                       \
+  V(AsyncIteratorSymbol, async_iterator_symbol)                 \
+  V(ClassFieldsSymbol, class_fields_symbol)                     \
+  V(EmptyBoilerplateDescription, empty_boilerplate_description) \
+  V(EmptyFixedArray, empty_fixed_array)                         \
+  V(HomeObjectSymbol, home_object_symbol)                       \
+  V(IteratorSymbol, iterator_symbol)                            \
+  V(NaN, nan_value)
 
 // A helper class for constructing constant arrays for the
 // interpreter. Each instance of this class is intended to be used to
diff --git a/deps/v8/src/interpreter/control-flow-builders.cc b/deps/v8/src/interpreter/control-flow-builders.cc
index ea316f286f2..bada935e4a2 100644
--- a/deps/v8/src/interpreter/control-flow-builders.cc
+++ b/deps/v8/src/interpreter/control-flow-builders.cc
@@ -47,10 +47,6 @@ void BreakableControlFlowBuilder::EmitJumpIfNull(BytecodeLabels* sites) {
 
 LoopBuilder::~LoopBuilder() {
   DCHECK(continue_labels_.empty() || continue_labels_.is_bound());
-  // Restore the parent jump table.
-  if (generator_jump_table_location_ != nullptr) {
-    *generator_jump_table_location_ = parent_generator_jump_table_;
-  }
 }
 
 void LoopBuilder::LoopHeader() {
@@ -62,26 +58,6 @@ void LoopBuilder::LoopHeader() {
   builder()->Bind(&loop_header_);
 }
 
-void LoopBuilder::LoopHeaderInGenerator(
-    BytecodeJumpTable** generator_jump_table, int first_resume_id,
-    int resume_count) {
-  // Bind all the resume points that are inside the loop to be at the loop
-  // header.
-  for (int id = first_resume_id; id < first_resume_id + resume_count; ++id) {
-    builder()->Bind(*generator_jump_table, id);
-  }
-
-  // Create the loop header.
-  LoopHeader();
-
-  // Create a new jump table for after the loop header for only these
-  // resume points.
-  generator_jump_table_location_ = generator_jump_table;
-  parent_generator_jump_table_ = *generator_jump_table;
-  *generator_jump_table =
-      builder()->AllocateJumpTable(resume_count, first_resume_id);
-}
-
 void LoopBuilder::LoopBody() {
   if (block_coverage_builder_ != nullptr) {
     block_coverage_builder_->IncrementBlockCounter(block_coverage_body_slot_);
diff --git a/deps/v8/src/interpreter/control-flow-builders.h b/deps/v8/src/interpreter/control-flow-builders.h
index 4a81b1f2053..405e81bc763 100644
--- a/deps/v8/src/interpreter/control-flow-builders.h
+++ b/deps/v8/src/interpreter/control-flow-builders.h
@@ -105,9 +105,7 @@ class V8_EXPORT_PRIVATE LoopBuilder final : public BreakableControlFlowBuilder {
   LoopBuilder(BytecodeArrayBuilder* builder,
               BlockCoverageBuilder* block_coverage_builder, AstNode* node)
       : BreakableControlFlowBuilder(builder, block_coverage_builder, node),
-        continue_labels_(builder->zone()),
-        generator_jump_table_location_(nullptr),
-        parent_generator_jump_table_(nullptr) {
+        continue_labels_(builder->zone()) {
     if (block_coverage_builder_ != nullptr) {
       set_needs_continuation_counter();
       block_coverage_body_slot_ =
@@ -118,8 +116,6 @@ class V8_EXPORT_PRIVATE LoopBuilder final : public BreakableControlFlowBuilder {
   ~LoopBuilder();
 
   void LoopHeader();
-  void LoopHeaderInGenerator(BytecodeJumpTable** parent_generator_jump_table,
-                             int first_resume_id, int resume_count);
   void LoopBody();
   void JumpToHeader(int loop_depth);
   void BindContinueTarget();
@@ -138,13 +134,6 @@ class V8_EXPORT_PRIVATE LoopBuilder final : public BreakableControlFlowBuilder {
   // jumps from checking the loop condition to the header for do-while loops.
   BytecodeLabels continue_labels_;
 
-  // While we're in the loop, we want to have a different jump table for
-  // generator switch statements. We restore it at the end of the loop.
-  // TODO(leszeks): Storing a pointer to the BytecodeGenerator's jump table
-  // field is ugly, figure out a better way to do this.
-  BytecodeJumpTable** generator_jump_table_location_;
-  BytecodeJumpTable* parent_generator_jump_table_;
-
   int block_coverage_body_slot_;
 };
 
diff --git a/deps/v8/src/interpreter/handler-table-builder.cc b/deps/v8/src/interpreter/handler-table-builder.cc
index 4b6c44b95df..93db1e969a7 100644
--- a/deps/v8/src/interpreter/handler-table-builder.cc
+++ b/deps/v8/src/interpreter/handler-table-builder.cc
@@ -15,20 +15,20 @@ namespace interpreter {
 
 HandlerTableBuilder::HandlerTableBuilder(Zone* zone) : entries_(zone) {}
 
-Handle<HandlerTable> HandlerTableBuilder::ToHandlerTable(Isolate* isolate) {
+Handle<ByteArray> HandlerTableBuilder::ToHandlerTable(Isolate* isolate) {
   int handler_table_size = static_cast<int>(entries_.size());
-  Handle<HandlerTable> table =
-      Handle<HandlerTable>::cast(isolate->factory()->NewFixedArray(
-          HandlerTable::LengthForRange(handler_table_size), TENURED));
+  Handle<ByteArray> table_byte_array = isolate->factory()->NewByteArray(
+      HandlerTable::LengthForRange(handler_table_size), TENURED);
+  HandlerTable table(*table_byte_array);
   for (int i = 0; i < handler_table_size; ++i) {
     Entry& entry = entries_[i];
     HandlerTable::CatchPrediction pred = entry.catch_prediction_;
-    table->SetRangeStart(i, static_cast<int>(entry.offset_start));
-    table->SetRangeEnd(i, static_cast<int>(entry.offset_end));
-    table->SetRangeHandler(i, static_cast<int>(entry.offset_target), pred);
-    table->SetRangeData(i, entry.context.index());
+    table.SetRangeStart(i, static_cast<int>(entry.offset_start));
+    table.SetRangeEnd(i, static_cast<int>(entry.offset_end));
+    table.SetRangeHandler(i, static_cast<int>(entry.offset_target), pred);
+    table.SetRangeData(i, entry.context.index());
   }
-  return table;
+  return table_byte_array;
 }
 
 
diff --git a/deps/v8/src/interpreter/handler-table-builder.h b/deps/v8/src/interpreter/handler-table-builder.h
index 381606f98b0..021fefad298 100644
--- a/deps/v8/src/interpreter/handler-table-builder.h
+++ b/deps/v8/src/interpreter/handler-table-builder.h
@@ -27,7 +27,7 @@ class V8_EXPORT_PRIVATE HandlerTableBuilder final BASE_EMBEDDED {
 
   // Builds the actual handler table by copying the current values into a heap
   // object. Any further mutations to the builder won't be reflected.
-  Handle<HandlerTable> ToHandlerTable(Isolate* isolate);
+  Handle<ByteArray> ToHandlerTable(Isolate* isolate);
 
   // Creates a new handler table entry and returns a {hander_id} identifying the
   // entry, so that it can be referenced by below setter functions.
diff --git a/deps/v8/src/interpreter/interpreter-assembler.cc b/deps/v8/src/interpreter/interpreter-assembler.cc
index 846b69281e4..0ebc3039231 100644
--- a/deps/v8/src/interpreter/interpreter-assembler.cc
+++ b/deps/v8/src/interpreter/interpreter-assembler.cc
@@ -59,7 +59,7 @@ InterpreterAssembler::InterpreterAssembler(CodeAssemblerState* state,
   // Save the bytecode offset immediately if bytecode will make a call along the
   // critical path, or it is a return bytecode.
   if (Bytecodes::MakesCallAlongCriticalPath(bytecode) ||
-      bytecode_ == Bytecode::kReturn) {
+      Bytecodes::Returns(bytecode)) {
     SaveBytecodeOffset();
   }
 }
@@ -139,7 +139,7 @@ Node* InterpreterAssembler::GetAccumulatorUnchecked() {
 Node* InterpreterAssembler::GetAccumulator() {
   DCHECK(Bytecodes::ReadsAccumulator(bytecode_));
   accumulator_use_ = accumulator_use_ | AccumulatorUse::kRead;
-  return GetAccumulatorUnchecked();
+  return PoisonOnSpeculationTagged(GetAccumulatorUnchecked());
 }
 
 void InterpreterAssembler::SetAccumulator(Node* value) {
@@ -222,22 +222,26 @@ void InterpreterAssembler::GotoIfHasContextExtensionUpToDepth(Node* context,
 }
 
 Node* InterpreterAssembler::RegisterLocation(Node* reg_index) {
-  return IntPtrAdd(GetInterpretedFramePointer(),
-                   RegisterFrameOffset(reg_index));
+  return PoisonOnSpeculationWord(
+      IntPtrAdd(GetInterpretedFramePointer(), RegisterFrameOffset(reg_index)));
+}
+
+Node* InterpreterAssembler::RegisterLocation(Register reg) {
+  return RegisterLocation(IntPtrConstant(reg.ToOperand()));
 }
 
 Node* InterpreterAssembler::RegisterFrameOffset(Node* index) {
   return TimesPointerSize(index);
 }
 
-Node* InterpreterAssembler::LoadRegister(Register reg) {
+Node* InterpreterAssembler::LoadRegister(Node* reg_index) {
   return Load(MachineType::AnyTagged(), GetInterpretedFramePointer(),
-              IntPtrConstant(reg.ToOperand() << kPointerSizeLog2));
+              RegisterFrameOffset(reg_index), LoadSensitivity::kNeedsPoisoning);
 }
 
-Node* InterpreterAssembler::LoadRegister(Node* reg_index) {
+Node* InterpreterAssembler::LoadRegister(Register reg) {
   return Load(MachineType::AnyTagged(), GetInterpretedFramePointer(),
-              RegisterFrameOffset(reg_index));
+              IntPtrConstant(reg.ToOperand() << kPointerSizeLog2));
 }
 
 Node* InterpreterAssembler::LoadAndUntagRegister(Register reg) {
@@ -245,22 +249,97 @@ Node* InterpreterAssembler::LoadAndUntagRegister(Register reg) {
                                                            << kPointerSizeLog2);
 }
 
-Node* InterpreterAssembler::StoreRegister(Node* value, Register reg) {
-  return StoreNoWriteBarrier(
+Node* InterpreterAssembler::LoadRegisterAtOperandIndex(int operand_index) {
+  return LoadRegister(
+      BytecodeOperandReg(operand_index, LoadSensitivity::kSafe));
+}
+
+std::pair<Node*, Node*> InterpreterAssembler::LoadRegisterPairAtOperandIndex(
+    int operand_index) {
+  DCHECK_EQ(OperandType::kRegPair,
+            Bytecodes::GetOperandType(bytecode_, operand_index));
+  Node* first_reg_index =
+      BytecodeOperandReg(operand_index, LoadSensitivity::kSafe);
+  Node* second_reg_index = NextRegister(first_reg_index);
+  return std::make_pair(LoadRegister(first_reg_index),
+                        LoadRegister(second_reg_index));
+}
+
+InterpreterAssembler::RegListNodePair
+InterpreterAssembler::GetRegisterListAtOperandIndex(int operand_index) {
+  DCHECK(Bytecodes::IsRegisterListOperandType(
+      Bytecodes::GetOperandType(bytecode_, operand_index)));
+  DCHECK_EQ(OperandType::kRegCount,
+            Bytecodes::GetOperandType(bytecode_, operand_index + 1));
+  Node* base_reg = RegisterLocation(
+      BytecodeOperandReg(operand_index, LoadSensitivity::kSafe));
+  Node* reg_count = BytecodeOperandCount(operand_index + 1);
+  return RegListNodePair(base_reg, reg_count);
+}
+
+Node* InterpreterAssembler::LoadRegisterFromRegisterList(
+    const RegListNodePair& reg_list, int index) {
+  Node* location = RegisterLocationInRegisterList(reg_list, index);
+  // Location is already poisoned on speculation, so no need to poison here.
+  return Load(MachineType::AnyTagged(), location);
+}
+
+Node* InterpreterAssembler::RegisterLocationInRegisterList(
+    const RegListNodePair& reg_list, int index) {
+  CSA_ASSERT(this,
+             Uint32GreaterThan(reg_list.reg_count(), Int32Constant(index)));
+  Node* offset = RegisterFrameOffset(IntPtrConstant(index));
+  // Register indexes are negative, so subtract index from base location to get
+  // location.
+  return IntPtrSub(reg_list.base_reg_location(), offset);
+}
+
+void InterpreterAssembler::StoreRegister(Node* value, Register reg) {
+  StoreNoWriteBarrier(
       MachineRepresentation::kTagged, GetInterpretedFramePointer(),
       IntPtrConstant(reg.ToOperand() << kPointerSizeLog2), value);
 }
 
-Node* InterpreterAssembler::StoreRegister(Node* value, Node* reg_index) {
-  return StoreNoWriteBarrier(MachineRepresentation::kTagged,
-                             GetInterpretedFramePointer(),
-                             RegisterFrameOffset(reg_index), value);
+void InterpreterAssembler::StoreRegister(Node* value, Node* reg_index) {
+  StoreNoWriteBarrier(MachineRepresentation::kTagged,
+                      GetInterpretedFramePointer(),
+                      RegisterFrameOffset(reg_index), value);
 }
 
-Node* InterpreterAssembler::StoreAndTagRegister(compiler::Node* value,
-                                                Register reg) {
+void InterpreterAssembler::StoreAndTagRegister(Node* value, Register reg) {
   int offset = reg.ToOperand() << kPointerSizeLog2;
-  return StoreAndTagSmi(GetInterpretedFramePointer(), offset, value);
+  StoreAndTagSmi(GetInterpretedFramePointer(), offset, value);
+}
+
+void InterpreterAssembler::StoreRegisterAtOperandIndex(Node* value,
+                                                       int operand_index) {
+  StoreRegister(value,
+                BytecodeOperandReg(operand_index, LoadSensitivity::kSafe));
+}
+
+void InterpreterAssembler::StoreRegisterPairAtOperandIndex(Node* value1,
+                                                           Node* value2,
+                                                           int operand_index) {
+  DCHECK_EQ(OperandType::kRegOutPair,
+            Bytecodes::GetOperandType(bytecode_, operand_index));
+  Node* first_reg_index =
+      BytecodeOperandReg(operand_index, LoadSensitivity::kSafe);
+  StoreRegister(value1, first_reg_index);
+  Node* second_reg_index = NextRegister(first_reg_index);
+  StoreRegister(value2, second_reg_index);
+}
+
+void InterpreterAssembler::StoreRegisterTripleAtOperandIndex(
+    Node* value1, Node* value2, Node* value3, int operand_index) {
+  DCHECK_EQ(OperandType::kRegOutTriple,
+            Bytecodes::GetOperandType(bytecode_, operand_index));
+  Node* first_reg_index =
+      BytecodeOperandReg(operand_index, LoadSensitivity::kSafe);
+  StoreRegister(value1, first_reg_index);
+  Node* second_reg_index = NextRegister(first_reg_index);
+  StoreRegister(value2, second_reg_index);
+  Node* third_reg_index = NextRegister(second_reg_index);
+  StoreRegister(value3, third_reg_index);
 }
 
 Node* InterpreterAssembler::NextRegister(Node* reg_index) {
@@ -273,26 +352,29 @@ Node* InterpreterAssembler::OperandOffset(int operand_index) {
       Bytecodes::GetOperandOffset(bytecode_, operand_index, operand_scale()));
 }
 
-Node* InterpreterAssembler::BytecodeOperandUnsignedByte(int operand_index) {
+Node* InterpreterAssembler::BytecodeOperandUnsignedByte(
+    int operand_index, LoadSensitivity needs_poisoning) {
   DCHECK_LT(operand_index, Bytecodes::NumberOfOperands(bytecode_));
   DCHECK_EQ(OperandSize::kByte, Bytecodes::GetOperandSize(
                                     bytecode_, operand_index, operand_scale()));
   Node* operand_offset = OperandOffset(operand_index);
   return Load(MachineType::Uint8(), BytecodeArrayTaggedPointer(),
-              IntPtrAdd(BytecodeOffset(), operand_offset));
+              IntPtrAdd(BytecodeOffset(), operand_offset), needs_poisoning);
 }
 
-Node* InterpreterAssembler::BytecodeOperandSignedByte(int operand_index) {
+Node* InterpreterAssembler::BytecodeOperandSignedByte(
+    int operand_index, LoadSensitivity needs_poisoning) {
   DCHECK_LT(operand_index, Bytecodes::NumberOfOperands(bytecode_));
   DCHECK_EQ(OperandSize::kByte, Bytecodes::GetOperandSize(
                                     bytecode_, operand_index, operand_scale()));
   Node* operand_offset = OperandOffset(operand_index);
   return Load(MachineType::Int8(), BytecodeArrayTaggedPointer(),
-              IntPtrAdd(BytecodeOffset(), operand_offset));
+              IntPtrAdd(BytecodeOffset(), operand_offset), needs_poisoning);
 }
 
-compiler::Node* InterpreterAssembler::BytecodeOperandReadUnaligned(
-    int relative_offset, MachineType result_type) {
+Node* InterpreterAssembler::BytecodeOperandReadUnaligned(
+    int relative_offset, MachineType result_type,
+    LoadSensitivity needs_poisoning) {
   static const int kMaxCount = 4;
   DCHECK(!TargetSupportsUnalignedAccess());
 
@@ -324,12 +406,13 @@ compiler::Node* InterpreterAssembler::BytecodeOperandReadUnaligned(
   // Read the most signicant bytecode into bytes[0] and then in order
   // down to least significant in bytes[count - 1].
   DCHECK_LE(count, kMaxCount);
-  compiler::Node* bytes[kMaxCount];
+  Node* bytes[kMaxCount];
   for (int i = 0; i < count; i++) {
     MachineType machine_type = (i == 0) ? msb_type : MachineType::Uint8();
     Node* offset = IntPtrConstant(relative_offset + msb_offset + i * kStep);
     Node* array_offset = IntPtrAdd(BytecodeOffset(), offset);
-    bytes[i] = Load(machine_type, BytecodeArrayTaggedPointer(), array_offset);
+    bytes[i] = Load(machine_type, BytecodeArrayTaggedPointer(), array_offset,
+                    needs_poisoning);
   }
 
   // Pack LSB to MSB.
@@ -342,7 +425,8 @@ compiler::Node* InterpreterAssembler::BytecodeOperandReadUnaligned(
   return result;
 }
 
-Node* InterpreterAssembler::BytecodeOperandUnsignedShort(int operand_index) {
+Node* InterpreterAssembler::BytecodeOperandUnsignedShort(
+    int operand_index, LoadSensitivity needs_poisoning) {
   DCHECK_LT(operand_index, Bytecodes::NumberOfOperands(bytecode_));
   DCHECK_EQ(
       OperandSize::kShort,
@@ -351,13 +435,16 @@ Node* InterpreterAssembler::BytecodeOperandUnsignedShort(int operand_index) {
       Bytecodes::GetOperandOffset(bytecode_, operand_index, operand_scale());
   if (TargetSupportsUnalignedAccess()) {
     return Load(MachineType::Uint16(), BytecodeArrayTaggedPointer(),
-                IntPtrAdd(BytecodeOffset(), IntPtrConstant(operand_offset)));
+                IntPtrAdd(BytecodeOffset(), IntPtrConstant(operand_offset)),
+                needs_poisoning);
   } else {
-    return BytecodeOperandReadUnaligned(operand_offset, MachineType::Uint16());
+    return BytecodeOperandReadUnaligned(operand_offset, MachineType::Uint16(),
+                                        needs_poisoning);
   }
 }
 
-Node* InterpreterAssembler::BytecodeOperandSignedShort(int operand_index) {
+Node* InterpreterAssembler::BytecodeOperandSignedShort(
+    int operand_index, LoadSensitivity needs_poisoning) {
   DCHECK_LT(operand_index, Bytecodes::NumberOfOperands(bytecode_));
   DCHECK_EQ(
       OperandSize::kShort,
@@ -366,13 +453,16 @@ Node* InterpreterAssembler::BytecodeOperandSignedShort(int operand_index) {
       Bytecodes::GetOperandOffset(bytecode_, operand_index, operand_scale());
   if (TargetSupportsUnalignedAccess()) {
     return Load(MachineType::Int16(), BytecodeArrayTaggedPointer(),
-                IntPtrAdd(BytecodeOffset(), IntPtrConstant(operand_offset)));
+                IntPtrAdd(BytecodeOffset(), IntPtrConstant(operand_offset)),
+                needs_poisoning);
   } else {
-    return BytecodeOperandReadUnaligned(operand_offset, MachineType::Int16());
+    return BytecodeOperandReadUnaligned(operand_offset, MachineType::Int16(),
+                                        needs_poisoning);
   }
 }
 
-Node* InterpreterAssembler::BytecodeOperandUnsignedQuad(int operand_index) {
+Node* InterpreterAssembler::BytecodeOperandUnsignedQuad(
+    int operand_index, LoadSensitivity needs_poisoning) {
   DCHECK_LT(operand_index, Bytecodes::NumberOfOperands(bytecode_));
   DCHECK_EQ(OperandSize::kQuad, Bytecodes::GetOperandSize(
                                     bytecode_, operand_index, operand_scale()));
@@ -380,13 +470,16 @@ Node* InterpreterAssembler::BytecodeOperandUnsignedQuad(int operand_index) {
       Bytecodes::GetOperandOffset(bytecode_, operand_index, operand_scale());
   if (TargetSupportsUnalignedAccess()) {
     return Load(MachineType::Uint32(), BytecodeArrayTaggedPointer(),
-                IntPtrAdd(BytecodeOffset(), IntPtrConstant(operand_offset)));
+                IntPtrAdd(BytecodeOffset(), IntPtrConstant(operand_offset)),
+                needs_poisoning);
   } else {
-    return BytecodeOperandReadUnaligned(operand_offset, MachineType::Uint32());
+    return BytecodeOperandReadUnaligned(operand_offset, MachineType::Uint32(),
+                                        needs_poisoning);
   }
 }
 
-Node* InterpreterAssembler::BytecodeOperandSignedQuad(int operand_index) {
+Node* InterpreterAssembler::BytecodeOperandSignedQuad(
+    int operand_index, LoadSensitivity needs_poisoning) {
   DCHECK_LT(operand_index, Bytecodes::NumberOfOperands(bytecode_));
   DCHECK_EQ(OperandSize::kQuad, Bytecodes::GetOperandSize(
                                     bytecode_, operand_index, operand_scale()));
@@ -394,40 +487,44 @@ Node* InterpreterAssembler::BytecodeOperandSignedQuad(int operand_index) {
       Bytecodes::GetOperandOffset(bytecode_, operand_index, operand_scale());
   if (TargetSupportsUnalignedAccess()) {
     return Load(MachineType::Int32(), BytecodeArrayTaggedPointer(),
-                IntPtrAdd(BytecodeOffset(), IntPtrConstant(operand_offset)));
+                IntPtrAdd(BytecodeOffset(), IntPtrConstant(operand_offset)),
+                needs_poisoning);
   } else {
-    return BytecodeOperandReadUnaligned(operand_offset, MachineType::Int32());
+    return BytecodeOperandReadUnaligned(operand_offset, MachineType::Int32(),
+                                        needs_poisoning);
   }
 }
 
-Node* InterpreterAssembler::BytecodeSignedOperand(int operand_index,
-                                                  OperandSize operand_size) {
+Node* InterpreterAssembler::BytecodeSignedOperand(
+    int operand_index, OperandSize operand_size,
+    LoadSensitivity needs_poisoning) {
   DCHECK(!Bytecodes::IsUnsignedOperandType(
       Bytecodes::GetOperandType(bytecode_, operand_index)));
   switch (operand_size) {
     case OperandSize::kByte:
-      return BytecodeOperandSignedByte(operand_index);
+      return BytecodeOperandSignedByte(operand_index, needs_poisoning);
     case OperandSize::kShort:
-      return BytecodeOperandSignedShort(operand_index);
+      return BytecodeOperandSignedShort(operand_index, needs_poisoning);
     case OperandSize::kQuad:
-      return BytecodeOperandSignedQuad(operand_index);
+      return BytecodeOperandSignedQuad(operand_index, needs_poisoning);
     case OperandSize::kNone:
       UNREACHABLE();
   }
   return nullptr;
 }
 
-Node* InterpreterAssembler::BytecodeUnsignedOperand(int operand_index,
-                                                    OperandSize operand_size) {
+Node* InterpreterAssembler::BytecodeUnsignedOperand(
+    int operand_index, OperandSize operand_size,
+    LoadSensitivity needs_poisoning) {
   DCHECK(Bytecodes::IsUnsignedOperandType(
       Bytecodes::GetOperandType(bytecode_, operand_index)));
   switch (operand_size) {
     case OperandSize::kByte:
-      return BytecodeOperandUnsignedByte(operand_index);
+      return BytecodeOperandUnsignedByte(operand_index, needs_poisoning);
     case OperandSize::kShort:
-      return BytecodeOperandUnsignedShort(operand_index);
+      return BytecodeOperandUnsignedShort(operand_index, needs_poisoning);
     case OperandSize::kQuad:
-      return BytecodeOperandUnsignedQuad(operand_index);
+      return BytecodeOperandUnsignedQuad(operand_index, needs_poisoning);
     case OperandSize::kNone:
       UNREACHABLE();
   }
@@ -464,7 +561,7 @@ Node* InterpreterAssembler::BytecodeOperandUImmWord(int operand_index) {
 }
 
 Node* InterpreterAssembler::BytecodeOperandUImmSmi(int operand_index) {
-  return SmiFromWord32(BytecodeOperandUImm(operand_index));
+  return SmiFromInt32(BytecodeOperandUImm(operand_index));
 }
 
 Node* InterpreterAssembler::BytecodeOperandImm(int operand_index) {
@@ -480,7 +577,7 @@ Node* InterpreterAssembler::BytecodeOperandImmIntPtr(int operand_index) {
 }
 
 Node* InterpreterAssembler::BytecodeOperandImmSmi(int operand_index) {
-  return SmiFromWord32(BytecodeOperandImm(operand_index));
+  return SmiFromInt32(BytecodeOperandImm(operand_index));
 }
 
 Node* InterpreterAssembler::BytecodeOperandIdxInt32(int operand_index) {
@@ -499,13 +596,24 @@ Node* InterpreterAssembler::BytecodeOperandIdxSmi(int operand_index) {
   return SmiTag(BytecodeOperandIdx(operand_index));
 }
 
-Node* InterpreterAssembler::BytecodeOperandReg(int operand_index) {
+Node* InterpreterAssembler::BytecodeOperandConstantPoolIdx(
+    int operand_index, LoadSensitivity needs_poisoning) {
+  DCHECK_EQ(OperandType::kIdx,
+            Bytecodes::GetOperandType(bytecode_, operand_index));
+  OperandSize operand_size =
+      Bytecodes::GetOperandSize(bytecode_, operand_index, operand_scale());
+  return ChangeUint32ToWord(
+      BytecodeUnsignedOperand(operand_index, operand_size, needs_poisoning));
+}
+
+Node* InterpreterAssembler::BytecodeOperandReg(
+    int operand_index, LoadSensitivity needs_poisoning) {
   DCHECK(Bytecodes::IsRegisterOperandType(
       Bytecodes::GetOperandType(bytecode_, operand_index)));
   OperandSize operand_size =
       Bytecodes::GetOperandSize(bytecode_, operand_index, operand_scale());
   return ChangeInt32ToIntPtr(
-      BytecodeSignedOperand(operand_index, operand_size));
+      BytecodeSignedOperand(operand_index, operand_size, needs_poisoning));
 }
 
 Node* InterpreterAssembler::BytecodeOperandRuntimeId(int operand_index) {
@@ -539,18 +647,29 @@ Node* InterpreterAssembler::BytecodeOperandIntrinsicId(int operand_index) {
 Node* InterpreterAssembler::LoadConstantPoolEntry(Node* index) {
   Node* constant_pool = LoadObjectField(BytecodeArrayTaggedPointer(),
                                         BytecodeArray::kConstantPoolOffset);
-  return LoadFixedArrayElement(constant_pool, index);
+  return LoadFixedArrayElement(constant_pool, UncheckedCast<IntPtrT>(index),
+                               LoadSensitivity::kNeedsPoisoning);
 }
 
 Node* InterpreterAssembler::LoadAndUntagConstantPoolEntry(Node* index) {
   return SmiUntag(LoadConstantPoolEntry(index));
 }
 
+Node* InterpreterAssembler::LoadConstantPoolEntryAtOperandIndex(
+    int operand_index) {
+  Node* index =
+      BytecodeOperandConstantPoolIdx(operand_index, LoadSensitivity::kSafe);
+  return LoadConstantPoolEntry(index);
+}
+
+Node* InterpreterAssembler::LoadAndUntagConstantPoolEntryAtOperandIndex(
+    int operand_index) {
+  return SmiUntag(LoadConstantPoolEntryAtOperandIndex(operand_index));
+}
+
 Node* InterpreterAssembler::LoadFeedbackVector() {
   Node* function = LoadRegister(Register::function_closure());
-  Node* cell = LoadObjectField(function, JSFunction::kFeedbackVectorOffset);
-  Node* vector = LoadObjectField(cell, Cell::kValueOffset);
-  return vector;
+  return CodeStubAssembler::LoadFeedbackVector(function);
 }
 
 void InterpreterAssembler::CallPrologue() {
@@ -586,11 +705,11 @@ void InterpreterAssembler::IncrementCallCount(Node* feedback_vector,
   Comment("increment call count");
   Node* call_count =
       LoadFeedbackVectorSlot(feedback_vector, slot_id, kPointerSize);
-  // The lowest {CallICNexus::CallCountField::kShift} bits of the call
+  // The lowest {FeedbackNexus::CallCountField::kShift} bits of the call
   // count are used as flags. To increment the call count by 1 we hence
-  // have to increment by 1 << {CallICNexus::CallCountField::kShift}.
-  Node* new_count =
-      SmiAdd(call_count, SmiConstant(1 << CallICNexus::CallCountField::kShift));
+  // have to increment by 1 << {FeedbackNexus::CallCountField::kShift}.
+  Node* new_count = SmiAdd(
+      call_count, SmiConstant(1 << FeedbackNexus::CallCountField::kShift));
   // Count is Smi, so we don't need a write barrier.
   StoreFeedbackVectorSlot(feedback_vector, slot_id, new_count,
                           SKIP_WRITE_BARRIER, kPointerSize);
@@ -707,18 +826,30 @@ void InterpreterAssembler::CollectCallFeedback(Node* target, Node* context,
 }
 
 void InterpreterAssembler::CallJSAndDispatch(
-    Node* function, Node* context, Node* first_arg, Node* arg_count,
+    Node* function, Node* context, const RegListNodePair& args,
     ConvertReceiverMode receiver_mode) {
   DCHECK(Bytecodes::MakesCallAlongCriticalPath(bytecode_));
   DCHECK(Bytecodes::IsCallOrConstruct(bytecode_) ||
          bytecode_ == Bytecode::kInvokeIntrinsic);
   DCHECK_EQ(Bytecodes::GetReceiverMode(bytecode_), receiver_mode);
+
+  Node* args_count;
+  if (receiver_mode == ConvertReceiverMode::kNullOrUndefined) {
+    // The receiver is implied, so it is not in the argument list.
+    args_count = args.reg_count();
+  } else {
+    // Subtract the receiver from the argument count.
+    Node* receiver_count = Int32Constant(1);
+    args_count = Int32Sub(args.reg_count(), receiver_count);
+  }
+
   Callable callable = CodeFactory::InterpreterPushArgsThenCall(
       isolate(), receiver_mode, InterpreterPushArgsMode::kOther);
   Node* code_target = HeapConstant(callable.code());
 
   TailCallStubThenBytecodeDispatch(callable.descriptor(), code_target, context,
-                                   arg_count, first_arg, function);
+                                   args_count, args.base_reg_location(),
+                                   function);
   // TailCallStubThenDispatch updates accumulator with result.
   accumulator_use_ = accumulator_use_ | AccumulatorUse::kWrite;
 }
@@ -764,8 +895,8 @@ template V8_EXPORT_PRIVATE void InterpreterAssembler::CallJSAndDispatch(
     ConvertReceiverMode receiver_mode, Node*, Node*, Node*);
 
 void InterpreterAssembler::CallJSWithSpreadAndDispatch(
-    Node* function, Node* context, Node* first_arg, Node* arg_count,
-    Node* slot_id, Node* feedback_vector) {
+    Node* function, Node* context, const RegListNodePair& args, Node* slot_id,
+    Node* feedback_vector) {
   DCHECK(Bytecodes::MakesCallAlongCriticalPath(bytecode_));
   DCHECK_EQ(Bytecodes::GetReceiverMode(bytecode_), ConvertReceiverMode::kAny);
   CollectCallFeedback(function, context, feedback_vector, slot_id);
@@ -775,16 +906,19 @@ void InterpreterAssembler::CallJSWithSpreadAndDispatch(
       InterpreterPushArgsMode::kWithFinalSpread);
   Node* code_target = HeapConstant(callable.code());
 
+  Node* receiver_count = Int32Constant(1);
+  Node* args_count = Int32Sub(args.reg_count(), receiver_count);
   TailCallStubThenBytecodeDispatch(callable.descriptor(), code_target, context,
-                                   arg_count, first_arg, function);
+                                   args_count, args.base_reg_location(),
+                                   function);
   // TailCallStubThenDispatch updates accumulator with result.
   accumulator_use_ = accumulator_use_ | AccumulatorUse::kWrite;
 }
 
 Node* InterpreterAssembler::Construct(Node* target, Node* context,
-                                      Node* new_target, Node* first_arg,
-                                      Node* arg_count, Node* slot_id,
-                                      Node* feedback_vector) {
+                                      Node* new_target,
+                                      const RegListNodePair& args,
+                                      Node* slot_id, Node* feedback_vector) {
   DCHECK(Bytecodes::MakesCallAlongCriticalPath(bytecode_));
   VARIABLE(var_result, MachineRepresentation::kTagged);
   VARIABLE(var_site, MachineRepresentation::kTagged);
@@ -934,11 +1068,11 @@ Node* InterpreterAssembler::Construct(Node* target, Node* context,
     // constructor feedback collection inside of Ignition.
     Comment("call using ConstructArray builtin");
     Callable callable = CodeFactory::InterpreterPushArgsThenConstruct(
-        isolate(), InterpreterPushArgsMode::kJSFunction);
+        isolate(), InterpreterPushArgsMode::kArrayFunction);
     Node* code_target = HeapConstant(callable.code());
     var_result.Bind(CallStub(callable.descriptor(), code_target, context,
-                             arg_count, new_target, target, var_site.value(),
-                             first_arg));
+                             args.reg_count(), new_target, target,
+                             var_site.value(), args.base_reg_location()));
     Goto(&return_result);
   }
 
@@ -950,8 +1084,8 @@ Node* InterpreterAssembler::Construct(Node* target, Node* context,
         isolate(), InterpreterPushArgsMode::kOther);
     Node* code_target = HeapConstant(callable.code());
     var_result.Bind(CallStub(callable.descriptor(), code_target, context,
-                             arg_count, new_target, target, UndefinedConstant(),
-                             first_arg));
+                             args.reg_count(), new_target, target,
+                             UndefinedConstant(), args.base_reg_location()));
     Goto(&return_result);
   }
 
@@ -961,8 +1095,8 @@ Node* InterpreterAssembler::Construct(Node* target, Node* context,
 
 Node* InterpreterAssembler::ConstructWithSpread(Node* target, Node* context,
                                                 Node* new_target,
-                                                Node* first_arg,
-                                                Node* arg_count, Node* slot_id,
+                                                const RegListNodePair& args,
+                                                Node* slot_id,
                                                 Node* feedback_vector) {
   // TODO(bmeurer): Unify this with the Construct bytecode feedback
   // above once we have a way to pass the AllocationSite to the Array
@@ -1075,12 +1209,13 @@ Node* InterpreterAssembler::ConstructWithSpread(Node* target, Node* context,
   Callable callable = CodeFactory::InterpreterPushArgsThenConstruct(
       isolate(), InterpreterPushArgsMode::kWithFinalSpread);
   Node* code_target = HeapConstant(callable.code());
-  return CallStub(callable.descriptor(), code_target, context, arg_count,
-                  new_target, target, UndefinedConstant(), first_arg);
+  return CallStub(callable.descriptor(), code_target, context, args.reg_count(),
+                  new_target, target, UndefinedConstant(),
+                  args.base_reg_location());
 }
 
 Node* InterpreterAssembler::CallRuntimeN(Node* function_id, Node* context,
-                                         Node* first_arg, Node* arg_count,
+                                         const RegListNodePair& args,
                                          int result_size) {
   DCHECK(Bytecodes::MakesCallAlongCriticalPath(bytecode_));
   DCHECK(Bytecodes::IsCallRuntime(bytecode_));
@@ -1099,7 +1234,7 @@ Node* InterpreterAssembler::CallRuntimeN(Node* function_id, Node* context,
            IntPtrConstant(offsetof(Runtime::Function, entry)));
 
   return CallStubR(callable.descriptor(), result_size, code_target, context,
-                   arg_count, first_arg, function_entry);
+                   args.reg_count(), args.base_reg_location(), function_entry);
 }
 
 void InterpreterAssembler::UpdateInterruptBudget(Node* weight, bool backward) {
@@ -1132,7 +1267,7 @@ void InterpreterAssembler::UpdateInterruptBudget(Node* weight, bool backward) {
     BIND(&interrupt_check);
     {
       CallRuntime(Runtime::kInterrupt, GetContext());
-      new_budget.Bind(Int32Constant(Interpreter::kInterruptBudget));
+      new_budget.Bind(Int32Constant(Interpreter::InterruptBudget()));
       Goto(&ok);
     }
 
@@ -1169,7 +1304,7 @@ Node* InterpreterAssembler::Advance(Node* delta, bool backward) {
 Node* InterpreterAssembler::Jump(Node* delta, bool backward) {
   DCHECK(!Bytecodes::IsStarLookahead(bytecode_, operand_scale_));
 
-  UpdateInterruptBudget(TruncateWordToWord32(delta), backward);
+  UpdateInterruptBudget(TruncateIntPtrToInt32(delta), backward);
   Node* new_bytecode_offset = Advance(delta, backward);
   Node* target_bytecode = LoadBytecode(new_bytecode_offset);
   return DispatchToBytecode(target_bytecode, new_bytecode_offset);
@@ -1200,7 +1335,7 @@ void InterpreterAssembler::JumpIfWordNotEqual(Node* lhs, Node* rhs,
   JumpConditional(WordNotEqual(lhs, rhs), delta);
 }
 
-Node* InterpreterAssembler::LoadBytecode(compiler::Node* bytecode_offset) {
+Node* InterpreterAssembler::LoadBytecode(Node* bytecode_offset) {
   Node* bytecode =
       Load(MachineType::Uint8(), BytecodeArrayTaggedPointer(), bytecode_offset);
   return ChangeUint32ToWord(bytecode);
@@ -1236,7 +1371,8 @@ void InterpreterAssembler::InlineStar() {
 #ifdef V8_TRACE_IGNITION
   TraceBytecode(Runtime::kInterpreterTraceBytecodeEntry);
 #endif
-  StoreRegister(GetAccumulator(), BytecodeOperandReg(0));
+  StoreRegister(GetAccumulator(),
+                BytecodeOperandReg(0, LoadSensitivity::kSafe));
 
   DCHECK_EQ(accumulator_use_, Bytecodes::GetAccumulatorUse(bytecode_));
 
@@ -1267,24 +1403,29 @@ Node* InterpreterAssembler::DispatchToBytecode(Node* target_bytecode,
       Load(MachineType::Pointer(), DispatchTableRawPointer(),
            TimesPointerSize(target_bytecode));
 
-  return DispatchToBytecodeHandlerEntry(target_code_entry, new_bytecode_offset);
+  return DispatchToBytecodeHandlerEntry(target_code_entry, new_bytecode_offset,
+                                        target_bytecode);
 }
 
 Node* InterpreterAssembler::DispatchToBytecodeHandler(Node* handler,
-                                                      Node* bytecode_offset) {
+                                                      Node* bytecode_offset,
+                                                      Node* target_bytecode) {
   // TODO(ishell): Add CSA::CodeEntryPoint(code).
   Node* handler_entry =
       IntPtrAdd(BitcastTaggedToWord(handler),
                 IntPtrConstant(Code::kHeaderSize - kHeapObjectTag));
-  return DispatchToBytecodeHandlerEntry(handler_entry, bytecode_offset);
+  return DispatchToBytecodeHandlerEntry(handler_entry, bytecode_offset,
+                                        target_bytecode);
 }
 
 Node* InterpreterAssembler::DispatchToBytecodeHandlerEntry(
-    Node* handler_entry, Node* bytecode_offset) {
+    Node* handler_entry, Node* bytecode_offset, Node* target_bytecode) {
   InterpreterDispatchDescriptor descriptor(isolate());
+  // Propagate speculation poisoning.
+  Node* poisoned_handler_entry = PoisonOnSpeculationWord(handler_entry);
   return TailCallBytecodeDispatch(
-      descriptor, handler_entry, GetAccumulatorUnchecked(), bytecode_offset,
-      BytecodeArrayTaggedPointer(), DispatchTableRawPointer());
+      descriptor, poisoned_handler_entry, GetAccumulatorUnchecked(),
+      bytecode_offset, BytecodeArrayTaggedPointer(), DispatchTableRawPointer());
 }
 
 void InterpreterAssembler::DispatchWide(OperandScale operand_scale) {
@@ -1319,7 +1460,8 @@ void InterpreterAssembler::DispatchWide(OperandScale operand_scale) {
       Load(MachineType::Pointer(), DispatchTableRawPointer(),
            TimesPointerSize(target_index));
 
-  DispatchToBytecodeHandlerEntry(target_code_entry, next_bytecode_offset);
+  DispatchToBytecodeHandlerEntry(target_code_entry, next_bytecode_offset,
+                                 next_bytecode);
 }
 
 void InterpreterAssembler::UpdateInterruptBudgetOnReturn() {
@@ -1342,7 +1484,7 @@ void InterpreterAssembler::UpdateInterruptBudgetOnReturn() {
   // of the first bytecode.
 
   const int kFirstBytecodeOffset = BytecodeArray::kHeaderSize - kHeapObjectTag;
-  Node* profiling_weight = Int32Sub(TruncateWordToWord32(BytecodeOffset()),
+  Node* profiling_weight = Int32Sub(TruncateIntPtrToInt32(BytecodeOffset()),
                                     Int32Constant(kFirstBytecodeOffset));
   UpdateInterruptBudget(profiling_weight, true);
 }
@@ -1451,9 +1593,12 @@ void InterpreterAssembler::AbortIfRegisterCountInvalid(Node* register_file,
   BIND(&ok);
 }
 
-Node* InterpreterAssembler::ExportRegisterFile(Node* array,
-                                               Node* register_count) {
+Node* InterpreterAssembler::ExportRegisterFile(
+    Node* array, const RegListNodePair& registers) {
+  Node* register_count = ChangeUint32ToWord(registers.reg_count());
   if (FLAG_debug_code) {
+    CSA_ASSERT(this, IntPtrEqual(registers.base_reg_location(),
+                                 RegisterLocation(Register(0))));
     AbortIfRegisterCountInvalid(array, register_count);
   }
 
@@ -1483,9 +1628,12 @@ Node* InterpreterAssembler::ExportRegisterFile(Node* array,
   return array;
 }
 
-Node* InterpreterAssembler::ImportRegisterFile(Node* array,
-                                               Node* register_count) {
+Node* InterpreterAssembler::ImportRegisterFile(
+    Node* array, const RegListNodePair& registers) {
+  Node* register_count = ChangeUint32ToWord(registers.reg_count());
   if (FLAG_debug_code) {
+    CSA_ASSERT(this, IntPtrEqual(registers.base_reg_location(),
+                                 RegisterLocation(Register(0))));
     AbortIfRegisterCountInvalid(array, register_count);
   }
 
@@ -1587,8 +1735,7 @@ void InterpreterAssembler::DeserializeLazyAndDispatch() {
   Node* target_handler =
       CallRuntime(Runtime::kInterpreterDeserializeLazy, context,
                   SmiTag(bytecode), SmiConstant(operand_scale()));
-
-  DispatchToBytecodeHandler(target_handler, bytecode_offset);
+  DispatchToBytecodeHandler(target_handler, bytecode_offset, bytecode);
 }
 
 }  // namespace interpreter
diff --git a/deps/v8/src/interpreter/interpreter-assembler.h b/deps/v8/src/interpreter/interpreter-assembler.h
index 63d17091455..6f8ee3d3231 100644
--- a/deps/v8/src/interpreter/interpreter-assembler.h
+++ b/deps/v8/src/interpreter/interpreter-assembler.h
@@ -56,9 +56,6 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
   // Returns the smi immediate for bytecode operand |operand_index| in the
   // current bytecode.
   compiler::Node* BytecodeOperandImmSmi(int operand_index);
-  // Returns the word-size sign-extended register index for bytecode operand
-  // |operand_index| in the current bytecode.
-  compiler::Node* BytecodeOperandReg(int operand_index);
   // Returns the 32-bit unsigned runtime id immediate for bytecode operand
   // |operand_index| in the current bytecode.
   compiler::Node* BytecodeOperandRuntimeId(int operand_index);
@@ -86,31 +83,58 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
   void GotoIfHasContextExtensionUpToDepth(compiler::Node* context,
                                           compiler::Node* depth, Label* target);
 
+  // A RegListNodePair provides an abstraction over lists of registers.
+  class RegListNodePair {
+   public:
+    RegListNodePair(Node* base_reg_location, Node* reg_count)
+        : base_reg_location_(base_reg_location), reg_count_(reg_count) {}
+
+    compiler::Node* reg_count() const { return reg_count_; }
+    compiler::Node* base_reg_location() const { return base_reg_location_; }
+
+   private:
+    compiler::Node* base_reg_location_;
+    compiler::Node* reg_count_;
+  };
+
   // Backup/restore register file to/from a fixed array of the correct length.
   compiler::Node* ExportRegisterFile(compiler::Node* array,
-                                     compiler::Node* register_count);
+                                     const RegListNodePair& registers);
   compiler::Node* ImportRegisterFile(compiler::Node* array,
-                                     compiler::Node* register_count);
+                                     const RegListNodePair& registers);
 
   // Loads from and stores to the interpreter register file.
   compiler::Node* LoadRegister(Register reg);
-  compiler::Node* LoadRegister(compiler::Node* reg_index);
   compiler::Node* LoadAndUntagRegister(Register reg);
-  compiler::Node* StoreRegister(compiler::Node* value, Register reg);
-  compiler::Node* StoreRegister(compiler::Node* value,
-                                compiler::Node* reg_index);
-  compiler::Node* StoreAndTagRegister(compiler::Node* value, Register reg);
-
-  // Returns the next consecutive register.
-  compiler::Node* NextRegister(compiler::Node* reg_index);
-
-  // Returns the location in memory of the register |reg_index| in the
-  // interpreter register file.
-  compiler::Node* RegisterLocation(compiler::Node* reg_index);
-
+  compiler::Node* LoadRegisterAtOperandIndex(int operand_index);
+  std::pair<compiler::Node*, compiler::Node*> LoadRegisterPairAtOperandIndex(
+      int operand_index);
+  void StoreRegister(compiler::Node* value, Register reg);
+  void StoreAndTagRegister(compiler::Node* value, Register reg);
+  void StoreRegisterAtOperandIndex(compiler::Node* value, int operand_index);
+  void StoreRegisterPairAtOperandIndex(compiler::Node* value1,
+                                       compiler::Node* value2,
+                                       int operand_index);
+  void StoreRegisterTripleAtOperandIndex(compiler::Node* value1,
+                                         compiler::Node* value2,
+                                         compiler::Node* value3,
+                                         int operand_index);
+
+  RegListNodePair GetRegisterListAtOperandIndex(int operand_index);
+  Node* LoadRegisterFromRegisterList(const RegListNodePair& reg_list,
+                                     int index);
+  Node* RegisterLocationInRegisterList(const RegListNodePair& reg_list,
+                                       int index);
+
+  // Load constant at the index specified in operand |operand_index| from the
+  // constant pool.
+  compiler::Node* LoadConstantPoolEntryAtOperandIndex(int operand_index);
+  // Load and untag constant at the index specified in operand |operand_index|
+  // from the constant pool.
+  compiler::Node* LoadAndUntagConstantPoolEntryAtOperandIndex(
+      int operand_index);
   // Load constant at |index| in the constant pool.
   compiler::Node* LoadConstantPoolEntry(compiler::Node* index);
-
   // Load and untag constant at |index| in the constant pool.
   compiler::Node* LoadAndUntagConstantPoolEntry(compiler::Node* index);
 
@@ -135,12 +159,11 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
                            compiler::Node* feedback_vector,
                            compiler::Node* slot_id);
 
-  // Call JSFunction or Callable |function| with |arg_count| arguments (not
-  // including receiver) and the first argument located at |first_arg|, possibly
+  // Call JSFunction or Callable |function| with |args| arguments, possibly
   // including the receiver depending on |receiver_mode|. After the call returns
   // directly dispatches to the next bytecode.
   void CallJSAndDispatch(compiler::Node* function, compiler::Node* context,
-                         compiler::Node* first_arg, compiler::Node* arg_count,
+                         const RegListNodePair& args,
                          ConvertReceiverMode receiver_mode);
 
   // Call JSFunction or Callable |function| with |arg_count| arguments (not
@@ -151,46 +174,41 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
   void CallJSAndDispatch(Node* function, Node* context, Node* arg_count,
                          ConvertReceiverMode receiver_mode, TArgs... args);
 
-  // Call JSFunction or Callable |function| with |arg_count|
-  // arguments (not including receiver) and the first argument
-  // located at |first_arg|, and the final argument being spread. After the call
-  // returns directly dispatches to the next bytecode.
+  // Call JSFunction or Callable |function| with |args|
+  // arguments (not including receiver), and the final argument being spread.
+  // After the call returns directly dispatches to the next bytecode.
   void CallJSWithSpreadAndDispatch(compiler::Node* function,
                                    compiler::Node* context,
-                                   compiler::Node* first_arg,
-                                   compiler::Node* arg_count,
+                                   const RegListNodePair& args,
                                    compiler::Node* slot_id,
                                    compiler::Node* feedback_vector);
 
-  // Call constructor |target| with |arg_count| arguments (not
-  // including receiver) and the first argument located at
-  // |first_arg|. The |new_target| is the same as the
-  // |target| for the new keyword, but differs for the super
-  // keyword.
+  // Call constructor |target| with |args| arguments (not including receiver).
+  // The |new_target| is the same as the |target| for the new keyword, but
+  // differs for the super keyword.
   compiler::Node* Construct(compiler::Node* target, compiler::Node* context,
                             compiler::Node* new_target,
-                            compiler::Node* first_arg,
-                            compiler::Node* arg_count, compiler::Node* slot_id,
+                            const RegListNodePair& args,
+                            compiler::Node* slot_id,
                             compiler::Node* feedback_vector);
 
-  // Call constructor |target| with |arg_count| arguments (not including
-  // receiver) and the first argument located at |first_arg|. The last argument
-  // is always a spread. The |new_target| is the same as the |target| for
-  // the new keyword, but differs for the super keyword.
+  // Call constructor |target| with |args| arguments (not including
+  // receiver). The last argument is always a spread. The |new_target| is the
+  // same as the |target| for the new keyword, but differs for the super
+  // keyword.
   compiler::Node* ConstructWithSpread(compiler::Node* target,
                                       compiler::Node* context,
                                       compiler::Node* new_target,
-                                      compiler::Node* first_arg,
-                                      compiler::Node* arg_count,
+                                      const RegListNodePair& args,
                                       compiler::Node* slot_id,
                                       compiler::Node* feedback_vector);
 
-  // Call runtime function with |arg_count| arguments and the first argument
-  // located at |first_arg|.
+  // Call runtime function with |args| arguments which will return |return_size|
+  // number of values.
   compiler::Node* CallRuntimeN(compiler::Node* function_id,
                                compiler::Node* context,
-                               compiler::Node* first_arg,
-                               compiler::Node* arg_count, int return_size = 1);
+                               const RegListNodePair& args,
+                               int return_size = 1);
 
   // Jump forward relative to the current bytecode by the |jump_offset|.
   compiler::Node* Jump(compiler::Node* jump_offset);
@@ -217,14 +235,14 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
   // Dispatch to the bytecode.
   compiler::Node* Dispatch();
 
-  // Dispatch to bytecode handler.
-  compiler::Node* DispatchToBytecodeHandler(compiler::Node* handler) {
-    return DispatchToBytecodeHandler(handler, BytecodeOffset());
-  }
-
   // Dispatch bytecode as wide operand variant.
   void DispatchWide(OperandScale operand_scale);
 
+  // Dispatch to |target_bytecode| at |new_bytecode_offset|.
+  // |target_bytecode| should be equivalent to loading from the offset.
+  compiler::Node* DispatchToBytecode(compiler::Node* target_bytecode,
+                                     compiler::Node* new_bytecode_offset);
+
   // Abort with the given abort reason.
   void Abort(AbortReason abort_reason);
   void AbortIfWordNotEqual(compiler::Node* lhs, compiler::Node* rhs,
@@ -264,6 +282,13 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
   // interpreted.
   compiler::Node* GetInterpretedFramePointer();
 
+  // Operations on registers.
+  compiler::Node* RegisterLocation(Register reg);
+  compiler::Node* RegisterLocation(compiler::Node* reg_index);
+  compiler::Node* NextRegister(compiler::Node* reg_index);
+  compiler::Node* LoadRegister(Node* reg_index);
+  void StoreRegister(compiler::Node* value, compiler::Node* reg_index);
+
   // Saves and restores interpreter bytecode offset to the interpreter stack
   // frame when performing a call.
   void CallPrologue();
@@ -291,23 +316,51 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
   // The |result_type| determines the size and signedness.  of the
   // value read. This method should only be used on architectures that
   // do not support unaligned memory accesses.
-  compiler::Node* BytecodeOperandReadUnaligned(int relative_offset,
-                                               MachineType result_type);
+  compiler::Node* BytecodeOperandReadUnaligned(
+      int relative_offset, MachineType result_type,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
 
   // Returns zero- or sign-extended to word32 value of the operand.
-  compiler::Node* BytecodeOperandUnsignedByte(int operand_index);
-  compiler::Node* BytecodeOperandSignedByte(int operand_index);
-  compiler::Node* BytecodeOperandUnsignedShort(int operand_index);
-  compiler::Node* BytecodeOperandSignedShort(int operand_index);
-  compiler::Node* BytecodeOperandUnsignedQuad(int operand_index);
-  compiler::Node* BytecodeOperandSignedQuad(int operand_index);
+  compiler::Node* BytecodeOperandUnsignedByte(
+      int operand_index,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+  compiler::Node* BytecodeOperandSignedByte(
+      int operand_index,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+  compiler::Node* BytecodeOperandUnsignedShort(
+      int operand_index,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+  compiler::Node* BytecodeOperandSignedShort(
+      int operand_index,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+  compiler::Node* BytecodeOperandUnsignedQuad(
+      int operand_index,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+  compiler::Node* BytecodeOperandSignedQuad(
+      int operand_index,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
 
   // Returns zero- or sign-extended to word32 value of the operand of
   // given size.
-  compiler::Node* BytecodeSignedOperand(int operand_index,
-                                        OperandSize operand_size);
-  compiler::Node* BytecodeUnsignedOperand(int operand_index,
-                                          OperandSize operand_size);
+  compiler::Node* BytecodeSignedOperand(
+      int operand_index, OperandSize operand_size,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+  compiler::Node* BytecodeUnsignedOperand(
+      int operand_index, OperandSize operand_size,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+
+  // Returns the word-size sign-extended register index for bytecode operand
+  // |operand_index| in the current bytecode. Value is not poisoned on
+  // speculation since the value loaded from the register is poisoned instead.
+  compiler::Node* BytecodeOperandReg(
+      int operand_index,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+
+  // Returns the word zero-extended index immediate for bytecode operand
+  // |operand_index| in the current bytecode for use when loading a .
+  compiler::Node* BytecodeOperandConstantPoolIdx(
+      int operand_index,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
 
   // Jump relative to the current bytecode by the |jump_offset|. If |backward|,
   // then jump backward (subtract the offset), otherwise jump forward (add the
@@ -344,18 +397,15 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
   // next dispatch offset.
   void InlineStar();
 
-  // Dispatch to |target_bytecode| at |new_bytecode_offset|.
-  // |target_bytecode| should be equivalent to loading from the offset.
-  compiler::Node* DispatchToBytecode(compiler::Node* target_bytecode,
-                                     compiler::Node* new_bytecode_offset);
-
   // Dispatch to the bytecode handler with code offset |handler|.
   compiler::Node* DispatchToBytecodeHandler(compiler::Node* handler,
-                                            compiler::Node* bytecode_offset);
+                                            compiler::Node* bytecode_offset,
+                                            compiler::Node* target_bytecode);
 
   // Dispatch to the bytecode handler with code entry point |handler_entry|.
   compiler::Node* DispatchToBytecodeHandlerEntry(
-      compiler::Node* handler_entry, compiler::Node* bytecode_offset);
+      compiler::Node* handler_entry, compiler::Node* bytecode_offset,
+      compiler::Node* target_bytecode);
 
   int CurrentBytecodeSize() const;
 
@@ -372,7 +422,6 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
   bool made_call_;
   bool reloaded_frame_ptr_;
   bool bytecode_array_valid_;
-
   bool disable_stack_check_across_call_;
   compiler::Node* stack_pointer_before_call_;
 
diff --git a/deps/v8/src/interpreter/interpreter-generator.cc b/deps/v8/src/interpreter/interpreter-generator.cc
index 5dabc13ea09..dc5ca335a3f 100644
--- a/deps/v8/src/interpreter/interpreter-generator.cc
+++ b/deps/v8/src/interpreter/interpreter-generator.cc
@@ -73,8 +73,7 @@ IGNITION_HANDLER(LdaSmi, InterpreterAssembler) {
 //
 // Load constant literal at |idx| in the constant pool into the accumulator.
 IGNITION_HANDLER(LdaConstant, InterpreterAssembler) {
-  Node* index = BytecodeOperandIdx(0);
-  Node* constant = LoadConstantPoolEntry(index);
+  Node* constant = LoadConstantPoolEntryAtOperandIndex(0);
   SetAccumulator(constant);
   Dispatch();
 }
@@ -123,8 +122,7 @@ IGNITION_HANDLER(LdaFalse, InterpreterAssembler) {
 //
 // Load accumulator with value from register <src>.
 IGNITION_HANDLER(Ldar, InterpreterAssembler) {
-  Node* reg_index = BytecodeOperandReg(0);
-  Node* value = LoadRegister(reg_index);
+  Node* value = LoadRegisterAtOperandIndex(0);
   SetAccumulator(value);
   Dispatch();
 }
@@ -133,9 +131,8 @@ IGNITION_HANDLER(Ldar, InterpreterAssembler) {
 //
 // Store accumulator to register <dst>.
 IGNITION_HANDLER(Star, InterpreterAssembler) {
-  Node* reg_index = BytecodeOperandReg(0);
   Node* accumulator = GetAccumulator();
-  StoreRegister(accumulator, reg_index);
+  StoreRegisterAtOperandIndex(accumulator, 0);
   Dispatch();
 }
 
@@ -143,10 +140,8 @@ IGNITION_HANDLER(Star, InterpreterAssembler) {
 //
 // Stores the value of register <src> to register <dst>.
 IGNITION_HANDLER(Mov, InterpreterAssembler) {
-  Node* src_index = BytecodeOperandReg(0);
-  Node* src_value = LoadRegister(src_index);
-  Node* dst_index = BytecodeOperandReg(1);
-  StoreRegister(src_value, dst_index);
+  Node* src_value = LoadRegisterAtOperandIndex(0);
+  StoreRegisterAtOperandIndex(src_value, 1);
   Dispatch();
 }
 
@@ -169,8 +164,7 @@ class InterpreterLoadGlobalAssembler : public InterpreterAssembler {
     LazyNode<Context> lazy_context = [=] { return CAST(GetContext()); };
 
     LazyNode<Name> lazy_name = [=] {
-      Node* name_index = BytecodeOperandIdx(name_operand_index);
-      Node* name = LoadConstantPoolEntry(name_index);
+      Node* name = LoadConstantPoolEntryAtOperandIndex(name_operand_index);
       return CAST(name);
     };
 
@@ -214,14 +208,13 @@ IGNITION_HANDLER(StaGlobal, InterpreterAssembler) {
   Node* context = GetContext();
 
   // Store the global via the StoreGlobalIC.
-  Node* constant_index = BytecodeOperandIdx(0);
-  Node* name = LoadConstantPoolEntry(constant_index);
+  Node* name = LoadConstantPoolEntryAtOperandIndex(0);
   Node* value = GetAccumulator();
   Node* raw_slot = BytecodeOperandIdx(1);
   Node* smi_slot = SmiTag(raw_slot);
   Node* feedback_vector = LoadFeedbackVector();
-  Callable ic = Builtins::CallableFor(isolate(), Builtins::kStoreGlobalIC);
-  CallStub(ic, context, name, value, smi_slot, feedback_vector);
+  CallBuiltin(Builtins::kStoreGlobalIC, context, name, value, smi_slot,
+              feedback_vector);
   Dispatch();
 }
 
@@ -230,8 +223,7 @@ IGNITION_HANDLER(StaGlobal, InterpreterAssembler) {
 // Load the object in |slot_index| of the context at |depth| in the context
 // chain starting at |context| into the accumulator.
 IGNITION_HANDLER(LdaContextSlot, InterpreterAssembler) {
-  Node* reg_index = BytecodeOperandReg(0);
-  Node* context = LoadRegister(reg_index);
+  Node* context = LoadRegisterAtOperandIndex(0);
   Node* slot_index = BytecodeOperandIdx(1);
   Node* depth = BytecodeOperandUImm(2);
   Node* slot_context = GetContextAtDepth(context, depth);
@@ -245,8 +237,7 @@ IGNITION_HANDLER(LdaContextSlot, InterpreterAssembler) {
 // Load the object in |slot_index| of the context at |depth| in the context
 // chain starting at |context| into the accumulator.
 IGNITION_HANDLER(LdaImmutableContextSlot, InterpreterAssembler) {
-  Node* reg_index = BytecodeOperandReg(0);
-  Node* context = LoadRegister(reg_index);
+  Node* context = LoadRegisterAtOperandIndex(0);
   Node* slot_index = BytecodeOperandIdx(1);
   Node* depth = BytecodeOperandUImm(2);
   Node* slot_context = GetContextAtDepth(context, depth);
@@ -283,8 +274,7 @@ IGNITION_HANDLER(LdaImmutableCurrentContextSlot, InterpreterAssembler) {
 // |depth| in the context chain starting at |context|.
 IGNITION_HANDLER(StaContextSlot, InterpreterAssembler) {
   Node* value = GetAccumulator();
-  Node* reg_index = BytecodeOperandReg(0);
-  Node* context = LoadRegister(reg_index);
+  Node* context = LoadRegisterAtOperandIndex(0);
   Node* slot_index = BytecodeOperandIdx(1);
   Node* depth = BytecodeOperandUImm(2);
   Node* slot_context = GetContextAtDepth(context, depth);
@@ -309,8 +299,7 @@ IGNITION_HANDLER(StaCurrentContextSlot, InterpreterAssembler) {
 // Lookup the object with the name in constant pool entry |name_index|
 // dynamically.
 IGNITION_HANDLER(LdaLookupSlot, InterpreterAssembler) {
-  Node* name_index = BytecodeOperandIdx(0);
-  Node* name = LoadConstantPoolEntry(name_index);
+  Node* name = LoadConstantPoolEntryAtOperandIndex(0);
   Node* context = GetContext();
   Node* result = CallRuntime(Runtime::kLoadLookupSlot, context, name);
   SetAccumulator(result);
@@ -322,8 +311,7 @@ IGNITION_HANDLER(LdaLookupSlot, InterpreterAssembler) {
 // Lookup the object with the name in constant pool entry |name_index|
 // dynamically without causing a NoReferenceError.
 IGNITION_HANDLER(LdaLookupSlotInsideTypeof, InterpreterAssembler) {
-  Node* name_index = BytecodeOperandIdx(0);
-  Node* name = LoadConstantPoolEntry(name_index);
+  Node* name = LoadConstantPoolEntryAtOperandIndex(0);
   Node* context = GetContext();
   Node* result =
       CallRuntime(Runtime::kLoadLookupSlotInsideTypeof, context, name);
@@ -340,7 +328,6 @@ class InterpreterLookupContextSlotAssembler : public InterpreterAssembler {
 
   void LookupContextSlot(Runtime::FunctionId function_id) {
     Node* context = GetContext();
-    Node* name_index = BytecodeOperandIdx(0);
     Node* slot_index = BytecodeOperandIdx(1);
     Node* depth = BytecodeOperandUImm(2);
 
@@ -360,7 +347,7 @@ class InterpreterLookupContextSlotAssembler : public InterpreterAssembler {
     // Slow path when we have to call out to the runtime.
     BIND(&slowpath);
     {
-      Node* name = LoadConstantPoolEntry(name_index);
+      Node* name = LoadConstantPoolEntryAtOperandIndex(0);
       Node* result = CallRuntime(function_id, context, name);
       SetAccumulator(result);
       Dispatch();
@@ -416,8 +403,7 @@ class InterpreterLookupGlobalAssembler : public InterpreterLoadGlobalAssembler {
     // Slow path when we have to call out to the runtime
     BIND(&slowpath);
     {
-      Node* name_index = BytecodeOperandIdx(0);
-      Node* name = LoadConstantPoolEntry(name_index);
+      Node* name = LoadConstantPoolEntryAtOperandIndex(0);
       Node* result = CallRuntime(function_id, context, name);
       SetAccumulator(result);
       Dispatch();
@@ -448,9 +434,8 @@ IGNITION_HANDLER(LdaLookupGlobalSlotInsideTypeof,
 // pool entry |name_index|.
 IGNITION_HANDLER(StaLookupSlot, InterpreterAssembler) {
   Node* value = GetAccumulator();
-  Node* index = BytecodeOperandIdx(0);
+  Node* name = LoadConstantPoolEntryAtOperandIndex(0);
   Node* bytecode_flags = BytecodeOperandFlag(1);
-  Node* name = LoadConstantPoolEntry(index);
   Node* context = GetContext();
   Variable var_result(this, MachineRepresentation::kTagged);
 
@@ -510,14 +495,11 @@ IGNITION_HANDLER(LdaNamedProperty, InterpreterAssembler) {
   Node* smi_slot = SmiTag(feedback_slot);
 
   // Load receiver.
-  Node* register_index = BytecodeOperandReg(0);
-  Node* recv = LoadRegister(register_index);
+  Node* recv = LoadRegisterAtOperandIndex(0);
 
   // Load the name.
   // TODO(jgruber): Not needed for monomorphic smi handler constant/field case.
-  Node* constant_index = BytecodeOperandIdx(1);
-  Node* name = LoadConstantPoolEntry(constant_index);
-
+  Node* name = LoadConstantPoolEntryAtOperandIndex(1);
   Node* context = GetContext();
 
   Label done(this);
@@ -541,17 +523,14 @@ IGNITION_HANDLER(LdaNamedProperty, InterpreterAssembler) {
 // Calls the KeyedLoadIC at FeedBackVector slot <slot> for <object> and the key
 // in the accumulator.
 IGNITION_HANDLER(LdaKeyedProperty, InterpreterAssembler) {
-  Callable ic = Builtins::CallableFor(isolate(), Builtins::kKeyedLoadIC);
-  Node* code_target = HeapConstant(ic.code());
-  Node* reg_index = BytecodeOperandReg(0);
-  Node* object = LoadRegister(reg_index);
+  Node* object = LoadRegisterAtOperandIndex(0);
   Node* name = GetAccumulator();
   Node* raw_slot = BytecodeOperandIdx(1);
   Node* smi_slot = SmiTag(raw_slot);
   Node* feedback_vector = LoadFeedbackVector();
   Node* context = GetContext();
-  Node* result = CallStub(ic.descriptor(), code_target, context, object, name,
-                          smi_slot, feedback_vector);
+  Node* result = CallBuiltin(Builtins::kKeyedLoadIC, context, object, name,
+                             smi_slot, feedback_vector);
   SetAccumulator(result);
   Dispatch();
 }
@@ -565,10 +544,8 @@ class InterpreterStoreNamedPropertyAssembler : public InterpreterAssembler {
 
   void StaNamedProperty(Callable ic) {
     Node* code_target = HeapConstant(ic.code());
-    Node* object_reg_index = BytecodeOperandReg(0);
-    Node* object = LoadRegister(object_reg_index);
-    Node* constant_index = BytecodeOperandIdx(1);
-    Node* name = LoadConstantPoolEntry(constant_index);
+    Node* object = LoadRegisterAtOperandIndex(0);
+    Node* name = LoadConstantPoolEntryAtOperandIndex(1);
     Node* value = GetAccumulator();
     Node* raw_slot = BytecodeOperandIdx(2);
     Node* smi_slot = SmiTag(raw_slot);
@@ -576,7 +553,9 @@ class InterpreterStoreNamedPropertyAssembler : public InterpreterAssembler {
     Node* context = GetContext();
     Node* result = CallStub(ic.descriptor(), code_target, context, object, name,
                             value, smi_slot, feedback_vector);
-    // It doesn't really matter what we write to the accumulator here, since we
+    // To avoid special logic in the deoptimizer to re-materialize the value in
+    // the accumulator, we overwrite the accumulator after the IC call. It
+    // doesn't really matter what we write to the accumulator here, since we
     // restore to the correct value on the outside. Storing the result means we
     // don't need to keep unnecessary state alive across the callstub.
     SetAccumulator(result);
@@ -609,20 +588,41 @@ IGNITION_HANDLER(StaNamedOwnProperty, InterpreterStoreNamedPropertyAssembler) {
 // Calls the KeyedStoreIC at FeedbackVector slot <slot> for <object> and
 // the key <key> with the value in the accumulator.
 IGNITION_HANDLER(StaKeyedProperty, InterpreterAssembler) {
-  Callable ic = Builtins::CallableFor(isolate(), Builtins::kKeyedStoreIC);
-  Node* code_target = HeapConstant(ic.code());
-  Node* object_reg_index = BytecodeOperandReg(0);
-  Node* object = LoadRegister(object_reg_index);
-  Node* name_reg_index = BytecodeOperandReg(1);
-  Node* name = LoadRegister(name_reg_index);
+  Node* object = LoadRegisterAtOperandIndex(0);
+  Node* name = LoadRegisterAtOperandIndex(1);
+  Node* value = GetAccumulator();
+  Node* raw_slot = BytecodeOperandIdx(2);
+  Node* smi_slot = SmiTag(raw_slot);
+  Node* feedback_vector = LoadFeedbackVector();
+  Node* context = GetContext();
+  Node* result = CallBuiltin(Builtins::kKeyedStoreIC, context, object, name,
+                             value, smi_slot, feedback_vector);
+  // To avoid special logic in the deoptimizer to re-materialize the value in
+  // the accumulator, we overwrite the accumulator after the IC call. It
+  // doesn't really matter what we write to the accumulator here, since we
+  // restore to the correct value on the outside. Storing the result means we
+  // don't need to keep unnecessary state alive across the callstub.
+  SetAccumulator(result);
+  Dispatch();
+}
+
+// StaInArrayLiteral <array> <index> <slot>
+//
+// Calls the StoreInArrayLiteralIC at FeedbackVector slot <slot> for <array> and
+// the key <index> with the value in the accumulator.
+IGNITION_HANDLER(StaInArrayLiteral, InterpreterAssembler) {
+  Node* array = LoadRegisterAtOperandIndex(0);
+  Node* index = LoadRegisterAtOperandIndex(1);
   Node* value = GetAccumulator();
   Node* raw_slot = BytecodeOperandIdx(2);
   Node* smi_slot = SmiTag(raw_slot);
   Node* feedback_vector = LoadFeedbackVector();
   Node* context = GetContext();
-  Node* result = CallStub(ic.descriptor(), code_target, context, object, name,
-                          value, smi_slot, feedback_vector);
-  // It doesn't really matter what we write to the accumulator here, since we
+  Node* result = CallBuiltin(Builtins::kStoreInArrayLiteralIC, context, array,
+                             index, value, smi_slot, feedback_vector);
+  // To avoid special logic in the deoptimizer to re-materialize the value in
+  // the accumulator, we overwrite the accumulator after the IC call. It
+  // doesn't really matter what we write to the accumulator here, since we
   // restore to the correct value on the outside. Storing the result means we
   // don't need to keep unnecessary state alive across the callstub.
   SetAccumulator(result);
@@ -638,10 +638,10 @@ IGNITION_HANDLER(StaKeyedProperty, InterpreterAssembler) {
 // This definition is not observable and is used only for definitions
 // in object or class literals.
 IGNITION_HANDLER(StaDataPropertyInLiteral, InterpreterAssembler) {
-  Node* object = LoadRegister(BytecodeOperandReg(0));
-  Node* name = LoadRegister(BytecodeOperandReg(1));
+  Node* object = LoadRegisterAtOperandIndex(0);
+  Node* name = LoadRegisterAtOperandIndex(1);
   Node* value = GetAccumulator();
-  Node* flags = SmiFromWord32(BytecodeOperandFlag(2));
+  Node* flags = SmiFromInt32(BytecodeOperandFlag(2));
   Node* vector_index = SmiTag(BytecodeOperandIdx(3));
 
   Node* feedback_vector = LoadFeedbackVector();
@@ -749,10 +749,9 @@ IGNITION_HANDLER(StaModuleVariable, InterpreterAssembler) {
 // Saves the current context in <context>, and pushes the accumulator as the
 // new current context.
 IGNITION_HANDLER(PushContext, InterpreterAssembler) {
-  Node* reg_index = BytecodeOperandReg(0);
   Node* new_context = GetAccumulator();
   Node* old_context = GetContext();
-  StoreRegister(old_context, reg_index);
+  StoreRegisterAtOperandIndex(old_context, 0);
   SetContext(new_context);
   Dispatch();
 }
@@ -761,8 +760,7 @@ IGNITION_HANDLER(PushContext, InterpreterAssembler) {
 //
 // Pops the current context and sets <context> as the new context.
 IGNITION_HANDLER(PopContext, InterpreterAssembler) {
-  Node* reg_index = BytecodeOperandReg(0);
-  Node* context = LoadRegister(reg_index);
+  Node* context = LoadRegisterAtOperandIndex(0);
   SetContext(context);
   Dispatch();
 }
@@ -780,8 +778,7 @@ class InterpreterBinaryOpAssembler : public InterpreterAssembler {
                                                         bool lhs_is_smi);
 
   void BinaryOpWithFeedback(BinaryOpGenerator generator) {
-    Node* reg_index = BytecodeOperandReg(0);
-    Node* lhs = LoadRegister(reg_index);
+    Node* lhs = LoadRegisterAtOperandIndex(0);
     Node* rhs = GetAccumulator();
     Node* context = GetContext();
     Node* slot_index = BytecodeOperandIdx(1);
@@ -902,8 +899,7 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
       : InterpreterAssembler(state, bytecode, operand_scale) {}
 
   void BitwiseBinaryOpWithFeedback(Operation bitwise_op) {
-    Node* reg_index = BytecodeOperandReg(0);
-    Node* left = LoadRegister(reg_index);
+    Node* left = LoadRegisterAtOperandIndex(0);
     Node* right = GetAccumulator();
     Node* context = GetContext();
     Node* slot_index = BytecodeOperandIdx(1);
@@ -969,7 +965,7 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
                                        &var_left_bigint, &var_left_feedback);
     BIND(&do_smi_op);
     Node* result =
-        BitwiseOp(var_left_word32.value(), SmiToWord32(right), bitwise_op);
+        BitwiseOp(var_left_word32.value(), SmiToInt32(right), bitwise_op);
     Node* result_type = SelectSmiConstant(TaggedIsSmi(result),
                                           BinaryOperationFeedback::kSignedSmall,
                                           BinaryOperationFeedback::kNumber);
@@ -1279,7 +1275,7 @@ IGNITION_HANDLER(ToName, InterpreterAssembler) {
   Node* object = GetAccumulator();
   Node* context = GetContext();
   Node* result = ToName(context, object);
-  StoreRegister(result, BytecodeOperandReg(0));
+  StoreRegisterAtOperandIndex(result, 0);
   Dispatch();
 }
 
@@ -1301,12 +1297,18 @@ IGNITION_HANDLER(ToNumeric, InterpreterAssembler) {
 //
 // Convert the object referenced by the accumulator to a JSReceiver.
 IGNITION_HANDLER(ToObject, InterpreterAssembler) {
-  Callable callable = Builtins::CallableFor(isolate(), Builtins::kToObject);
-  Node* target = HeapConstant(callable.code());
   Node* accumulator = GetAccumulator();
   Node* context = GetContext();
-  Node* result = CallStub(callable.descriptor(), target, context, accumulator);
-  StoreRegister(result, BytecodeOperandReg(0));
+  Node* result = CallBuiltin(Builtins::kToObject, context, accumulator);
+  StoreRegisterAtOperandIndex(result, 0);
+  Dispatch();
+}
+
+// ToString
+//
+// Convert the accumulator to a String.
+IGNITION_HANDLER(ToString, InterpreterAssembler) {
+  SetAccumulator(ToString_Inline(GetContext(), GetAccumulator()));
   Dispatch();
 }
 
@@ -1449,8 +1451,7 @@ IGNITION_HANDLER(TypeOf, InterpreterAssembler) {
 // Delete the property specified in the accumulator from the object
 // referenced by the register operand following strict mode semantics.
 IGNITION_HANDLER(DeletePropertyStrict, InterpreterAssembler) {
-  Node* reg_index = BytecodeOperandReg(0);
-  Node* object = LoadRegister(reg_index);
+  Node* object = LoadRegisterAtOperandIndex(0);
   Node* key = GetAccumulator();
   Node* context = GetContext();
   Node* result = CallBuiltin(Builtins::kDeleteProperty, context, object, key,
@@ -1464,8 +1465,7 @@ IGNITION_HANDLER(DeletePropertyStrict, InterpreterAssembler) {
 // Delete the property specified in the accumulator from the object
 // referenced by the register operand following sloppy mode semantics.
 IGNITION_HANDLER(DeletePropertySloppy, InterpreterAssembler) {
-  Node* reg_index = BytecodeOperandReg(0);
-  Node* object = LoadRegister(reg_index);
+  Node* object = LoadRegisterAtOperandIndex(0);
   Node* key = GetAccumulator();
   Node* context = GetContext();
   Node* result = CallBuiltin(Builtins::kDeleteProperty, context, object, key,
@@ -1482,8 +1482,7 @@ IGNITION_HANDLER(GetSuperConstructor, InterpreterAssembler) {
   Node* active_function = GetAccumulator();
   Node* context = GetContext();
   Node* result = GetSuperConstructor(active_function, context);
-  Node* reg = BytecodeOperandReg(0);
-  StoreRegister(result, reg);
+  StoreRegisterAtOperandIndex(result, 0);
   Dispatch();
 }
 
@@ -1495,20 +1494,8 @@ class InterpreterJSCallAssembler : public InterpreterAssembler {
 
   // Generates code to perform a JS call that collects type feedback.
   void JSCall(ConvertReceiverMode receiver_mode) {
-    Node* function_reg = BytecodeOperandReg(0);
-    Node* function = LoadRegister(function_reg);
-    Node* first_arg_reg = BytecodeOperandReg(1);
-    Node* first_arg = RegisterLocation(first_arg_reg);
-    Node* arg_list_count = BytecodeOperandCount(2);
-    Node* args_count;
-    if (receiver_mode == ConvertReceiverMode::kNullOrUndefined) {
-      // The receiver is implied, so it is not in the argument list.
-      args_count = arg_list_count;
-    } else {
-      // Subtract the receiver from the argument count.
-      Node* receiver_count = Int32Constant(1);
-      args_count = Int32Sub(arg_list_count, receiver_count);
-    }
+    Node* function = LoadRegisterAtOperandIndex(0);
+    RegListNodePair args = GetRegisterListAtOperandIndex(1);
     Node* slot_id = BytecodeOperandIdx(3);
     Node* feedback_vector = LoadFeedbackVector();
     Node* context = GetContext();
@@ -1517,7 +1504,7 @@ class InterpreterJSCallAssembler : public InterpreterAssembler {
     CollectCallFeedback(function, context, feedback_vector, slot_id);
 
     // Call the function and dispatch to the next handler.
-    CallJSAndDispatch(function, context, first_arg, args_count, receiver_mode);
+    CallJSAndDispatch(function, context, args, receiver_mode);
   }
 
   // Generates code to perform a JS call with a known number of arguments that
@@ -1531,8 +1518,7 @@ class InterpreterJSCallAssembler : public InterpreterAssembler {
     const int kSlotOperandIndex =
         kFirstArgumentOperandIndex + kRecieverAndArgOperandCount;
 
-    Node* function_reg = BytecodeOperandReg(0);
-    Node* function = LoadRegister(function_reg);
+    Node* function = LoadRegisterAtOperandIndex(0);
     Node* slot_id = BytecodeOperandIdx(kSlotOperandIndex);
     Node* feedback_vector = LoadFeedbackVector();
     Node* context = GetContext();
@@ -1548,20 +1534,20 @@ class InterpreterJSCallAssembler : public InterpreterAssembler {
       case 1:
         CallJSAndDispatch(
             function, context, Int32Constant(arg_count), receiver_mode,
-            LoadRegister(BytecodeOperandReg(kFirstArgumentOperandIndex)));
+            LoadRegisterAtOperandIndex(kFirstArgumentOperandIndex));
         break;
       case 2:
         CallJSAndDispatch(
             function, context, Int32Constant(arg_count), receiver_mode,
-            LoadRegister(BytecodeOperandReg(kFirstArgumentOperandIndex)),
-            LoadRegister(BytecodeOperandReg(kFirstArgumentOperandIndex + 1)));
+            LoadRegisterAtOperandIndex(kFirstArgumentOperandIndex),
+            LoadRegisterAtOperandIndex(kFirstArgumentOperandIndex + 1));
         break;
       case 3:
         CallJSAndDispatch(
             function, context, Int32Constant(arg_count), receiver_mode,
-            LoadRegister(BytecodeOperandReg(kFirstArgumentOperandIndex)),
-            LoadRegister(BytecodeOperandReg(kFirstArgumentOperandIndex + 1)),
-            LoadRegister(BytecodeOperandReg(kFirstArgumentOperandIndex + 2)));
+            LoadRegisterAtOperandIndex(kFirstArgumentOperandIndex),
+            LoadRegisterAtOperandIndex(kFirstArgumentOperandIndex + 1),
+            LoadRegisterAtOperandIndex(kFirstArgumentOperandIndex + 2));
         break;
       default:
         UNREACHABLE();
@@ -1617,11 +1603,9 @@ IGNITION_HANDLER(CallUndefinedReceiver2, InterpreterJSCallAssembler) {
 // registers.
 IGNITION_HANDLER(CallRuntime, InterpreterAssembler) {
   Node* function_id = BytecodeOperandRuntimeId(0);
-  Node* first_arg_reg = BytecodeOperandReg(1);
-  Node* first_arg = RegisterLocation(first_arg_reg);
-  Node* args_count = BytecodeOperandCount(2);
+  RegListNodePair args = GetRegisterListAtOperandIndex(1);
   Node* context = GetContext();
-  Node* result = CallRuntimeN(function_id, context, first_arg, args_count);
+  Node* result = CallRuntimeN(function_id, context, args);
   SetAccumulator(result);
   Dispatch();
 }
@@ -1633,11 +1617,9 @@ IGNITION_HANDLER(CallRuntime, InterpreterAssembler) {
 // arguments in subsequent registers.
 IGNITION_HANDLER(InvokeIntrinsic, InterpreterAssembler) {
   Node* function_id = BytecodeOperandIntrinsicId(0);
-  Node* first_arg_reg = BytecodeOperandReg(1);
-  Node* arg_count = BytecodeOperandCount(2);
+  RegListNodePair args = GetRegisterListAtOperandIndex(1);
   Node* context = GetContext();
-  Node* result = GenerateInvokeIntrinsic(this, function_id, context,
-                                         first_arg_reg, arg_count);
+  Node* result = GenerateInvokeIntrinsic(this, function_id, context, args);
   SetAccumulator(result);
   Dispatch();
 }
@@ -1651,19 +1633,13 @@ IGNITION_HANDLER(InvokeIntrinsic, InterpreterAssembler) {
 IGNITION_HANDLER(CallRuntimeForPair, InterpreterAssembler) {
   // Call the runtime function.
   Node* function_id = BytecodeOperandRuntimeId(0);
-  Node* first_arg_reg = BytecodeOperandReg(1);
-  Node* first_arg = RegisterLocation(first_arg_reg);
-  Node* args_count = BytecodeOperandCount(2);
+  RegListNodePair args = GetRegisterListAtOperandIndex(1);
   Node* context = GetContext();
-  Node* result_pair =
-      CallRuntimeN(function_id, context, first_arg, args_count, 2);
+  Node* result_pair = CallRuntimeN(function_id, context, args, 2);
   // Store the results in <first_return> and <first_return + 1>
-  Node* first_return_reg = BytecodeOperandReg(3);
-  Node* second_return_reg = NextRegister(first_return_reg);
   Node* result0 = Projection(0, result_pair);
   Node* result1 = Projection(1, result_pair);
-  StoreRegister(result0, first_return_reg);
-  StoreRegister(result1, second_return_reg);
+  StoreRegisterPairAtOperandIndex(result0, result1, 3);
   Dispatch();
 }
 
@@ -1673,9 +1649,7 @@ IGNITION_HANDLER(CallRuntimeForPair, InterpreterAssembler) {
 // in register |receiver| and |arg_count| arguments in subsequent registers.
 IGNITION_HANDLER(CallJSRuntime, InterpreterAssembler) {
   Node* context_index = BytecodeOperandNativeContextIndex(0);
-  Node* receiver_reg = BytecodeOperandReg(1);
-  Node* first_arg = RegisterLocation(receiver_reg);
-  Node* args_count = BytecodeOperandCount(2);
+  RegListNodePair args = GetRegisterListAtOperandIndex(1);
 
   // Get the function to call from the native context.
   Node* context = GetContext();
@@ -1683,7 +1657,7 @@ IGNITION_HANDLER(CallJSRuntime, InterpreterAssembler) {
   Node* function = LoadContextElement(native_context, context_index);
 
   // Call the function.
-  CallJSAndDispatch(function, context, first_arg, args_count,
+  CallJSAndDispatch(function, context, args,
                     ConvertReceiverMode::kNullOrUndefined);
 }
 
@@ -1694,20 +1668,15 @@ IGNITION_HANDLER(CallJSRuntime, InterpreterAssembler) {
 // final argument is always a spread.
 //
 IGNITION_HANDLER(CallWithSpread, InterpreterAssembler) {
-  Node* callable_reg = BytecodeOperandReg(0);
-  Node* callable = LoadRegister(callable_reg);
-  Node* receiver_reg = BytecodeOperandReg(1);
-  Node* receiver_arg = RegisterLocation(receiver_reg);
-  Node* receiver_args_count = BytecodeOperandCount(2);
-  Node* receiver_count = Int32Constant(1);
-  Node* args_count = Int32Sub(receiver_args_count, receiver_count);
+  Node* callable = LoadRegisterAtOperandIndex(0);
+  RegListNodePair args = GetRegisterListAtOperandIndex(1);
   Node* slot_id = BytecodeOperandIdx(3);
   Node* feedback_vector = LoadFeedbackVector();
   Node* context = GetContext();
 
   // Call into Runtime function CallWithSpread which does everything.
-  CallJSWithSpreadAndDispatch(callable, context, receiver_arg, args_count,
-                              slot_id, feedback_vector);
+  CallJSWithSpreadAndDispatch(callable, context, args, slot_id,
+                              feedback_vector);
 }
 
 // ConstructWithSpread <first_arg> <arg_count>
@@ -1718,17 +1687,13 @@ IGNITION_HANDLER(CallWithSpread, InterpreterAssembler) {
 //
 IGNITION_HANDLER(ConstructWithSpread, InterpreterAssembler) {
   Node* new_target = GetAccumulator();
-  Node* constructor_reg = BytecodeOperandReg(0);
-  Node* constructor = LoadRegister(constructor_reg);
-  Node* first_arg_reg = BytecodeOperandReg(1);
-  Node* first_arg = RegisterLocation(first_arg_reg);
-  Node* args_count = BytecodeOperandCount(2);
+  Node* constructor = LoadRegisterAtOperandIndex(0);
+  RegListNodePair args = GetRegisterListAtOperandIndex(1);
   Node* slot_id = BytecodeOperandIdx(3);
   Node* feedback_vector = LoadFeedbackVector();
   Node* context = GetContext();
-  Node* result =
-      ConstructWithSpread(constructor, context, new_target, first_arg,
-                          args_count, slot_id, feedback_vector);
+  Node* result = ConstructWithSpread(constructor, context, new_target, args,
+                                     slot_id, feedback_vector);
   SetAccumulator(result);
   Dispatch();
 }
@@ -1741,16 +1706,13 @@ IGNITION_HANDLER(ConstructWithSpread, InterpreterAssembler) {
 //
 IGNITION_HANDLER(Construct, InterpreterAssembler) {
   Node* new_target = GetAccumulator();
-  Node* constructor_reg = BytecodeOperandReg(0);
-  Node* constructor = LoadRegister(constructor_reg);
-  Node* first_arg_reg = BytecodeOperandReg(1);
-  Node* first_arg = RegisterLocation(first_arg_reg);
-  Node* args_count = BytecodeOperandCount(2);
+  Node* constructor = LoadRegisterAtOperandIndex(0);
+  RegListNodePair args = GetRegisterListAtOperandIndex(1);
   Node* slot_id = BytecodeOperandIdx(3);
   Node* feedback_vector = LoadFeedbackVector();
   Node* context = GetContext();
-  Node* result = Construct(constructor, context, new_target, first_arg,
-                           args_count, slot_id, feedback_vector);
+  Node* result = Construct(constructor, context, new_target, args, slot_id,
+                           feedback_vector);
   SetAccumulator(result);
   Dispatch();
 }
@@ -1762,8 +1724,7 @@ class InterpreterCompareOpAssembler : public InterpreterAssembler {
       : InterpreterAssembler(state, bytecode, operand_scale) {}
 
   void CompareOpWithFeedback(Operation compare_op) {
-    Node* reg_index = BytecodeOperandReg(0);
-    Node* lhs = LoadRegister(reg_index);
+    Node* lhs = LoadRegisterAtOperandIndex(0);
     Node* rhs = GetAccumulator();
     Node* context = GetContext();
 
@@ -1844,8 +1805,7 @@ IGNITION_HANDLER(TestGreaterThanOrEqual, InterpreterCompareOpAssembler) {
 // Test if the value in the <src> register is strictly equal to the accumulator.
 // Type feedback is not collected.
 IGNITION_HANDLER(TestEqualStrictNoFeedback, InterpreterAssembler) {
-  Node* reg_index = BytecodeOperandReg(0);
-  Node* lhs = LoadRegister(reg_index);
+  Node* lhs = LoadRegisterAtOperandIndex(0);
   Node* rhs = GetAccumulator();
   // TODO(5310): This is called only when lhs and rhs are Smis (for ex:
   // try-finally or generators) or strings (only when visiting
@@ -1861,8 +1821,7 @@ IGNITION_HANDLER(TestEqualStrictNoFeedback, InterpreterAssembler) {
 // Test if the object referenced by the register operand is a property of the
 // object referenced by the accumulator.
 IGNITION_HANDLER(TestIn, InterpreterAssembler) {
-  Node* reg_index = BytecodeOperandReg(0);
-  Node* property = LoadRegister(reg_index);
+  Node* property = LoadRegisterAtOperandIndex(0);
   Node* object = GetAccumulator();
   Node* context = GetContext();
 
@@ -1875,8 +1834,7 @@ IGNITION_HANDLER(TestIn, InterpreterAssembler) {
 // Test if the object referenced by the <src> register is an an instance of type
 // referenced by the accumulator.
 IGNITION_HANDLER(TestInstanceOf, InterpreterAssembler) {
-  Node* object_reg = BytecodeOperandReg(0);
-  Node* object = LoadRegister(object_reg);
+  Node* object = LoadRegisterAtOperandIndex(0);
   Node* callable = GetAccumulator();
   Node* slot_id = BytecodeOperandIdx(1);
   Node* feedback_vector = LoadFeedbackVector();
@@ -2063,8 +2021,7 @@ IGNITION_HANDLER(Jump, InterpreterAssembler) {
 // Jump by the number of bytes in the Smi in the |idx| entry in the constant
 // pool.
 IGNITION_HANDLER(JumpConstant, InterpreterAssembler) {
-  Node* index = BytecodeOperandIdx(0);
-  Node* relative_jump = LoadAndUntagConstantPoolEntry(index);
+  Node* relative_jump = LoadAndUntagConstantPoolEntryAtOperandIndex(0);
   Jump(relative_jump);
 }
 
@@ -2088,8 +2045,7 @@ IGNITION_HANDLER(JumpIfTrue, InterpreterAssembler) {
 // and will misbehave if passed arbitrary input values.
 IGNITION_HANDLER(JumpIfTrueConstant, InterpreterAssembler) {
   Node* accumulator = GetAccumulator();
-  Node* index = BytecodeOperandIdx(0);
-  Node* relative_jump = LoadAndUntagConstantPoolEntry(index);
+  Node* relative_jump = LoadAndUntagConstantPoolEntryAtOperandIndex(0);
   CSA_ASSERT(this, TaggedIsNotSmi(accumulator));
   CSA_ASSERT(this, IsBoolean(accumulator));
   JumpIfWordEqual(accumulator, TrueConstant(), relative_jump);
@@ -2115,8 +2071,7 @@ IGNITION_HANDLER(JumpIfFalse, InterpreterAssembler) {
 // and will misbehave if passed arbitrary input values.
 IGNITION_HANDLER(JumpIfFalseConstant, InterpreterAssembler) {
   Node* accumulator = GetAccumulator();
-  Node* index = BytecodeOperandIdx(0);
-  Node* relative_jump = LoadAndUntagConstantPoolEntry(index);
+  Node* relative_jump = LoadAndUntagConstantPoolEntryAtOperandIndex(0);
   CSA_ASSERT(this, TaggedIsNotSmi(accumulator));
   CSA_ASSERT(this, IsBoolean(accumulator));
   JumpIfWordEqual(accumulator, FalseConstant(), relative_jump);
@@ -2144,8 +2099,7 @@ IGNITION_HANDLER(JumpIfToBooleanTrue, InterpreterAssembler) {
 // cast to boolean.
 IGNITION_HANDLER(JumpIfToBooleanTrueConstant, InterpreterAssembler) {
   Node* value = GetAccumulator();
-  Node* index = BytecodeOperandIdx(0);
-  Node* relative_jump = LoadAndUntagConstantPoolEntry(index);
+  Node* relative_jump = LoadAndUntagConstantPoolEntryAtOperandIndex(0);
   Label if_true(this), if_false(this);
   BranchIfToBooleanIsTrue(value, &if_true, &if_false);
   BIND(&if_true);
@@ -2176,8 +2130,7 @@ IGNITION_HANDLER(JumpIfToBooleanFalse, InterpreterAssembler) {
 // cast to boolean.
 IGNITION_HANDLER(JumpIfToBooleanFalseConstant, InterpreterAssembler) {
   Node* value = GetAccumulator();
-  Node* index = BytecodeOperandIdx(0);
-  Node* relative_jump = LoadAndUntagConstantPoolEntry(index);
+  Node* relative_jump = LoadAndUntagConstantPoolEntryAtOperandIndex(0);
   Label if_true(this), if_false(this);
   BranchIfToBooleanIsTrue(value, &if_true, &if_false);
   BIND(&if_true);
@@ -2202,8 +2155,7 @@ IGNITION_HANDLER(JumpIfNull, InterpreterAssembler) {
 // pool if the object referenced by the accumulator is the null constant.
 IGNITION_HANDLER(JumpIfNullConstant, InterpreterAssembler) {
   Node* accumulator = GetAccumulator();
-  Node* index = BytecodeOperandIdx(0);
-  Node* relative_jump = LoadAndUntagConstantPoolEntry(index);
+  Node* relative_jump = LoadAndUntagConstantPoolEntryAtOperandIndex(0);
   JumpIfWordEqual(accumulator, NullConstant(), relative_jump);
 }
 
@@ -2223,8 +2175,7 @@ IGNITION_HANDLER(JumpIfNotNull, InterpreterAssembler) {
 // pool if the object referenced by the accumulator is not the null constant.
 IGNITION_HANDLER(JumpIfNotNullConstant, InterpreterAssembler) {
   Node* accumulator = GetAccumulator();
-  Node* index = BytecodeOperandIdx(0);
-  Node* relative_jump = LoadAndUntagConstantPoolEntry(index);
+  Node* relative_jump = LoadAndUntagConstantPoolEntryAtOperandIndex(0);
   JumpIfWordNotEqual(accumulator, NullConstant(), relative_jump);
 }
 
@@ -2244,8 +2195,7 @@ IGNITION_HANDLER(JumpIfUndefined, InterpreterAssembler) {
 // pool if the object referenced by the accumulator is the undefined constant.
 IGNITION_HANDLER(JumpIfUndefinedConstant, InterpreterAssembler) {
   Node* accumulator = GetAccumulator();
-  Node* index = BytecodeOperandIdx(0);
-  Node* relative_jump = LoadAndUntagConstantPoolEntry(index);
+  Node* relative_jump = LoadAndUntagConstantPoolEntryAtOperandIndex(0);
   JumpIfWordEqual(accumulator, UndefinedConstant(), relative_jump);
 }
 
@@ -2266,8 +2216,7 @@ IGNITION_HANDLER(JumpIfNotUndefined, InterpreterAssembler) {
 // constant.
 IGNITION_HANDLER(JumpIfNotUndefinedConstant, InterpreterAssembler) {
   Node* accumulator = GetAccumulator();
-  Node* index = BytecodeOperandIdx(0);
-  Node* relative_jump = LoadAndUntagConstantPoolEntry(index);
+  Node* relative_jump = LoadAndUntagConstantPoolEntryAtOperandIndex(0);
   JumpIfWordNotEqual(accumulator, UndefinedConstant(), relative_jump);
 }
 
@@ -2297,8 +2246,7 @@ IGNITION_HANDLER(JumpIfJSReceiver, InterpreterAssembler) {
 // pool if the object referenced by the accumulator is a JSReceiver.
 IGNITION_HANDLER(JumpIfJSReceiverConstant, InterpreterAssembler) {
   Node* accumulator = GetAccumulator();
-  Node* index = BytecodeOperandIdx(0);
-  Node* relative_jump = LoadAndUntagConstantPoolEntry(index);
+  Node* relative_jump = LoadAndUntagConstantPoolEntryAtOperandIndex(0);
 
   Label if_object(this), if_notobject(this), if_notsmi(this);
   Branch(TaggedIsSmi(accumulator), &if_notobject, &if_notsmi);
@@ -2378,11 +2326,10 @@ IGNITION_HANDLER(SwitchOnSmiNoFeedback, InterpreterAssembler) {
 // Creates a regular expression literal for literal index <literal_idx> with
 // <flags> and the pattern in <pattern_idx>.
 IGNITION_HANDLER(CreateRegExpLiteral, InterpreterAssembler) {
-  Node* pattern_index = BytecodeOperandIdx(0);
-  Node* pattern = LoadConstantPoolEntry(pattern_index);
+  Node* pattern = LoadConstantPoolEntryAtOperandIndex(0);
   Node* feedback_vector = LoadFeedbackVector();
   Node* slot_id = BytecodeOperandIdx(1);
-  Node* flags = SmiFromWord32(BytecodeOperandFlag(2));
+  Node* flags = SmiFromInt32(BytecodeOperandFlag(2));
   Node* context = GetContext();
   ConstructorBuiltinsAssembler constructor_assembler(state());
   Node* result = constructor_assembler.EmitCreateRegExpLiteral(
@@ -2421,8 +2368,7 @@ IGNITION_HANDLER(CreateArrayLiteral, InterpreterAssembler) {
     Node* flags_raw = DecodeWordFromWord32<CreateArrayLiteralFlags::FlagsBits>(
         bytecode_flags);
     Node* flags = SmiTag(flags_raw);
-    Node* index = BytecodeOperandIdx(0);
-    Node* constant_elements = LoadConstantPoolEntry(index);
+    Node* constant_elements = LoadConstantPoolEntryAtOperandIndex(0);
     Node* result =
         CallRuntime(Runtime::kCreateArrayLiteral, context, feedback_vector,
                     SmiTag(slot_id), constant_elements, flags);
@@ -2466,15 +2412,14 @@ IGNITION_HANDLER(CreateObjectLiteral, InterpreterAssembler) {
     ConstructorBuiltinsAssembler constructor_assembler(state());
     Node* result = constructor_assembler.EmitCreateShallowObjectLiteral(
         feedback_vector, slot_id, &if_not_fast_clone);
-    StoreRegister(result, BytecodeOperandReg(3));
+    StoreRegisterAtOperandIndex(result, 3);
     Dispatch();
   }
 
   BIND(&if_not_fast_clone);
   {
     // If we can't do a fast clone, call into the runtime.
-    Node* index = BytecodeOperandIdx(0);
-    Node* boilerplate_description = LoadConstantPoolEntry(index);
+    Node* boilerplate_description = LoadConstantPoolEntryAtOperandIndex(0);
     Node* context = GetContext();
 
     Node* flags_raw = DecodeWordFromWord32<CreateObjectLiteralFlags::FlagsBits>(
@@ -2484,7 +2429,7 @@ IGNITION_HANDLER(CreateObjectLiteral, InterpreterAssembler) {
     Node* result =
         CallRuntime(Runtime::kCreateObjectLiteral, context, feedback_vector,
                     SmiTag(slot_id), boilerplate_description, flags);
-    StoreRegister(result, BytecodeOperandReg(3));
+    StoreRegisterAtOperandIndex(result, 3);
     // TODO(klaasb) build a single dispatch once the call is inlined
     Dispatch();
   }
@@ -2501,19 +2446,34 @@ IGNITION_HANDLER(CreateEmptyObjectLiteral, InterpreterAssembler) {
   Dispatch();
 }
 
-// GetTemplateObject
+// GetTemplateObject <descriptor_idx> <literal_idx>
 //
 // Creates the template to pass for tagged templates and returns it in the
 // accumulator, creating and caching the site object on-demand as per the
 // specification.
 IGNITION_HANDLER(GetTemplateObject, InterpreterAssembler) {
-  Node* description_index = BytecodeOperandIdx(0);
-  Node* description = LoadConstantPoolEntry(description_index);
-  Node* context = GetContext();
+  Node* feedback_vector = LoadFeedbackVector();
+  Node* slot = BytecodeOperandIdx(1);
+  Node* cached_value =
+      LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS);
 
-  Node* result = CallRuntime(Runtime::kGetTemplateObject, context, description);
-  SetAccumulator(result);
+  Label call_runtime(this, Label::kDeferred);
+  GotoIf(WordEqual(cached_value, SmiConstant(0)), &call_runtime);
+
+  SetAccumulator(cached_value);
   Dispatch();
+
+  BIND(&call_runtime);
+  {
+    Node* description = LoadConstantPoolEntryAtOperandIndex(0);
+    Node* context = GetContext();
+    Node* result =
+        CallRuntime(Runtime::kCreateTemplateObject, context, description);
+    StoreFeedbackVectorSlot(feedback_vector, slot, result, UPDATE_WRITE_BARRIER,
+                            0, INTPTR_PARAMETERS);
+    SetAccumulator(result);
+    Dispatch();
+  }
 }
 
 // CreateClosure <index> <slot> <tenured>
@@ -2521,35 +2481,47 @@ IGNITION_HANDLER(GetTemplateObject, InterpreterAssembler) {
 // Creates a new closure for SharedFunctionInfo at position |index| in the
 // constant pool and with the PretenureFlag <tenured>.
 IGNITION_HANDLER(CreateClosure, InterpreterAssembler) {
-  Node* index = BytecodeOperandIdx(0);
-  Node* shared = LoadConstantPoolEntry(index);
+  Node* shared = LoadConstantPoolEntryAtOperandIndex(0);
   Node* flags = BytecodeOperandFlag(2);
   Node* context = GetContext();
-
-  Label call_runtime(this, Label::kDeferred);
-  GotoIfNot(IsSetWord32<CreateClosureFlags::FastNewClosureBit>(flags),
-            &call_runtime);
-  ConstructorBuiltinsAssembler constructor_assembler(state());
-  Node* vector_index = BytecodeOperandIdx(1);
-  vector_index = SmiTag(vector_index);
+  Node* slot = BytecodeOperandIdx(1);
   Node* feedback_vector = LoadFeedbackVector();
-  SetAccumulator(constructor_assembler.EmitFastNewClosure(
-      shared, feedback_vector, vector_index, context));
-  Dispatch();
+  Node* feedback_cell = LoadFeedbackVectorSlot(feedback_vector, slot);
 
-  BIND(&call_runtime);
+  Label if_fast(this), if_slow(this, Label::kDeferred);
+  Branch(IsSetWord32<CreateClosureFlags::FastNewClosureBit>(flags), &if_fast,
+         &if_slow);
+
+  BIND(&if_fast);
   {
-    Node* tenured_raw =
-        DecodeWordFromWord32<CreateClosureFlags::PretenuredBit>(flags);
-    Node* tenured = SmiTag(tenured_raw);
-    feedback_vector = LoadFeedbackVector();
-    vector_index = BytecodeOperandIdx(1);
-    vector_index = SmiTag(vector_index);
-    Node* result = CallRuntime(Runtime::kInterpreterNewClosure, context, shared,
-                               feedback_vector, vector_index, tenured);
+    Node* result =
+        CallBuiltin(Builtins::kFastNewClosure, context, shared, feedback_cell);
     SetAccumulator(result);
     Dispatch();
   }
+
+  BIND(&if_slow);
+  {
+    Label if_newspace(this), if_oldspace(this);
+    Branch(IsSetWord32<CreateClosureFlags::PretenuredBit>(flags), &if_oldspace,
+           &if_newspace);
+
+    BIND(&if_newspace);
+    {
+      Node* result =
+          CallRuntime(Runtime::kNewClosure, context, shared, feedback_cell);
+      SetAccumulator(result);
+      Dispatch();
+    }
+
+    BIND(&if_oldspace);
+    {
+      Node* result = CallRuntime(Runtime::kNewClosure_Tenured, context, shared,
+                                 feedback_cell);
+      SetAccumulator(result);
+      Dispatch();
+    }
+  }
 }
 
 // CreateBlockContext <index>
@@ -2557,8 +2529,7 @@ IGNITION_HANDLER(CreateClosure, InterpreterAssembler) {
 // Creates a new block context with the scope info constant at |index| and the
 // closure in the accumulator.
 IGNITION_HANDLER(CreateBlockContext, InterpreterAssembler) {
-  Node* index = BytecodeOperandIdx(0);
-  Node* scope_info = LoadConstantPoolEntry(index);
+  Node* scope_info = LoadConstantPoolEntryAtOperandIndex(0);
   Node* closure = GetAccumulator();
   Node* context = GetContext();
   SetAccumulator(
@@ -2572,12 +2543,9 @@ IGNITION_HANDLER(CreateBlockContext, InterpreterAssembler) {
 // the variable name at |name_idx|, the ScopeInfo at |scope_info_idx|, and the
 // closure in the accumulator.
 IGNITION_HANDLER(CreateCatchContext, InterpreterAssembler) {
-  Node* exception_reg = BytecodeOperandReg(0);
-  Node* exception = LoadRegister(exception_reg);
-  Node* name_idx = BytecodeOperandIdx(1);
-  Node* name = LoadConstantPoolEntry(name_idx);
-  Node* scope_info_idx = BytecodeOperandIdx(2);
-  Node* scope_info = LoadConstantPoolEntry(scope_info_idx);
+  Node* exception = LoadRegisterAtOperandIndex(0);
+  Node* name = LoadConstantPoolEntryAtOperandIndex(1);
+  Node* scope_info = LoadConstantPoolEntryAtOperandIndex(2);
   Node* closure = GetAccumulator();
   Node* context = GetContext();
   SetAccumulator(CallRuntime(Runtime::kPushCatchContext, context, name,
@@ -2617,10 +2585,8 @@ IGNITION_HANDLER(CreateEvalContext, InterpreterAssembler) {
 // with-statement with the object in |register| and the closure in the
 // accumulator.
 IGNITION_HANDLER(CreateWithContext, InterpreterAssembler) {
-  Node* reg_index = BytecodeOperandReg(0);
-  Node* object = LoadRegister(reg_index);
-  Node* scope_info_idx = BytecodeOperandIdx(1);
-  Node* scope_info = LoadConstantPoolEntry(scope_info_idx);
+  Node* object = LoadRegisterAtOperandIndex(0);
+  Node* scope_info = LoadConstantPoolEntryAtOperandIndex(1);
   Node* closure = GetAccumulator();
   Node* context = GetContext();
   SetAccumulator(CallRuntime(Runtime::kPushWithContext, context, object,
@@ -2643,12 +2609,10 @@ IGNITION_HANDLER(CreateMappedArguments, InterpreterAssembler) {
   // duplicate parameters.
   Node* shared_info =
       LoadObjectField(closure, JSFunction::kSharedFunctionInfoOffset);
-  Node* compiler_hints =
-      LoadObjectField(shared_info, SharedFunctionInfo::kCompilerHintsOffset,
-                      MachineType::Uint32());
+  Node* flags = LoadObjectField(shared_info, SharedFunctionInfo::kFlagsOffset,
+                                MachineType::Uint32());
   Node* has_duplicate_parameters =
-      IsSetWord32<SharedFunctionInfo::HasDuplicateParametersBit>(
-          compiler_hints);
+      IsSetWord32<SharedFunctionInfo::HasDuplicateParametersBit>(flags);
   Branch(has_duplicate_parameters, &if_duplicate_parameters,
          &if_not_duplicate_parameters);
 
@@ -2771,7 +2735,7 @@ IGNITION_HANDLER(ThrowReferenceErrorIfHole, InterpreterAssembler) {
 
   BIND(&throw_error);
   {
-    Node* name = LoadConstantPoolEntry(BytecodeOperandIdx(0));
+    Node* name = LoadConstantPoolEntryAtOperandIndex(0);
     CallRuntime(Runtime::kThrowReferenceError, GetContext(), name);
     // We shouldn't ever return from a throw.
     Abort(AbortReason::kUnexpectedReturnFromThrow);
@@ -2834,10 +2798,10 @@ IGNITION_HANDLER(Debugger, InterpreterAssembler) {
     Node* result_pair =                                                    \
         CallRuntime(Runtime::kDebugBreakOnBytecode, context, accumulator); \
     Node* return_value = Projection(0, result_pair);                       \
-    Node* original_handler = Projection(1, result_pair);                   \
+    Node* original_bytecode = SmiUntag(Projection(1, result_pair));        \
     MaybeDropFrames(context);                                              \
     SetAccumulator(return_value);                                          \
-    DispatchToBytecodeHandler(original_handler);                           \
+    DispatchToBytecode(original_bytecode, BytecodeOffset());               \
   }
 DEBUG_BREAK_BYTECODE_LIST(DEBUG_BREAK);
 #undef DEBUG_BREAK
@@ -2856,30 +2820,13 @@ IGNITION_HANDLER(IncBlockCounter, InterpreterAssembler) {
   Dispatch();
 }
 
-class InterpreterForInPrepareAssembler : public InterpreterAssembler {
- public:
-  InterpreterForInPrepareAssembler(CodeAssemblerState* state, Bytecode bytecode,
-                                   OperandScale operand_scale)
-      : InterpreterAssembler(state, bytecode, operand_scale) {}
-
-  void BuildForInPrepareResult(Node* output_register, Node* cache_type,
-                               Node* cache_array, Node* cache_length) {
-    StoreRegister(cache_type, output_register);
-    output_register = NextRegister(output_register);
-    StoreRegister(cache_array, output_register);
-    output_register = NextRegister(output_register);
-    StoreRegister(cache_length, output_register);
-  }
-};
-
 // ForInEnumerate <receiver>
 //
 // Enumerates the enumerable keys of the |receiver| and either returns the
 // map of the |receiver| if it has a usable enum cache or a fixed array
 // with the keys to enumerate in the accumulator.
 IGNITION_HANDLER(ForInEnumerate, InterpreterAssembler) {
-  Node* receiver_register = BytecodeOperandReg(0);
-  Node* receiver = LoadRegister(receiver_register);
+  Node* receiver = LoadRegisterAtOperandIndex(0);
   Node* context = GetContext();
 
   Label if_empty(this), if_runtime(this, Label::kDeferred);
@@ -2910,9 +2857,8 @@ IGNITION_HANDLER(ForInEnumerate, InterpreterAssembler) {
 // The result is output in registers |cache_info_triple| to
 // |cache_info_triple + 2|, with the registers holding cache_type, cache_array,
 // and cache_length respectively.
-IGNITION_HANDLER(ForInPrepare, InterpreterForInPrepareAssembler) {
+IGNITION_HANDLER(ForInPrepare, InterpreterAssembler) {
   Node* enumerator = GetAccumulator();
-  Node* output_register = BytecodeOperandReg(0);
   Node* vector_index = BytecodeOperandIdx(1);
   Node* feedback_vector = LoadFeedbackVector();
 
@@ -2946,8 +2892,7 @@ IGNITION_HANDLER(ForInPrepare, InterpreterForInPrepareAssembler) {
     Node* cache_type = enumerator;
     Node* cache_array = enum_keys;
     Node* cache_length = SmiTag(enum_length);
-    BuildForInPrepareResult(output_register, cache_type, cache_array,
-                            cache_length);
+    StoreRegisterTripleAtOperandIndex(cache_type, cache_array, cache_length, 0);
     Dispatch();
   }
 
@@ -2964,8 +2909,7 @@ IGNITION_HANDLER(ForInPrepare, InterpreterForInPrepareAssembler) {
     Node* cache_type = enumerator;
     Node* cache_array = enumerator;
     Node* cache_length = LoadFixedArrayBaseLength(enumerator);
-    BuildForInPrepareResult(output_register, cache_type, cache_array,
-                            cache_length);
+    StoreRegisterTripleAtOperandIndex(cache_type, cache_array, cache_length, 0);
     Dispatch();
   }
 }
@@ -2974,14 +2918,11 @@ IGNITION_HANDLER(ForInPrepare, InterpreterForInPrepareAssembler) {
 //
 // Returns the next enumerable property in the the accumulator.
 IGNITION_HANDLER(ForInNext, InterpreterAssembler) {
-  Node* receiver_reg = BytecodeOperandReg(0);
-  Node* receiver = LoadRegister(receiver_reg);
-  Node* index_reg = BytecodeOperandReg(1);
-  Node* index = LoadRegister(index_reg);
-  Node* cache_type_reg = BytecodeOperandReg(2);
-  Node* cache_type = LoadRegister(cache_type_reg);
-  Node* cache_array_reg = NextRegister(cache_type_reg);
-  Node* cache_array = LoadRegister(cache_array_reg);
+  Node* receiver = LoadRegisterAtOperandIndex(0);
+  Node* index = LoadRegisterAtOperandIndex(1);
+  Node* cache_type;
+  Node* cache_array;
+  std::tie(cache_type, cache_array) = LoadRegisterPairAtOperandIndex(2);
   Node* vector_index = BytecodeOperandIdx(3);
   Node* feedback_vector = LoadFeedbackVector();
 
@@ -3017,10 +2958,8 @@ IGNITION_HANDLER(ForInNext, InterpreterAssembler) {
 //
 // Returns false if the end of the enumerable properties has been reached.
 IGNITION_HANDLER(ForInContinue, InterpreterAssembler) {
-  Node* index_reg = BytecodeOperandReg(0);
-  Node* index = LoadRegister(index_reg);
-  Node* cache_length_reg = BytecodeOperandReg(1);
-  Node* cache_length = LoadRegister(cache_length_reg);
+  Node* index = LoadRegisterAtOperandIndex(0);
+  Node* cache_length = LoadRegisterAtOperandIndex(1);
 
   // Check if {index} is at {cache_length} already.
   Label if_true(this), if_false(this), end(this);
@@ -3044,8 +2983,7 @@ IGNITION_HANDLER(ForInContinue, InterpreterAssembler) {
 // Increments the loop counter in register |index| and stores the result
 // in the accumulator.
 IGNITION_HANDLER(ForInStep, InterpreterAssembler) {
-  Node* index_reg = BytecodeOperandReg(0);
-  Node* index = LoadRegister(index_reg);
+  Node* index = LoadRegisterAtOperandIndex(0);
   Node* one = SmiConstant(1);
   Node* result = SmiAdd(index, one);
   SetAccumulator(result);
@@ -3078,34 +3016,16 @@ IGNITION_HANDLER(Illegal, InterpreterAssembler) {
 //
 // Exports the register file and stores it into the generator.  Also stores the
 // current context, |suspend_id|, and the current bytecode offset (for debugging
-// purposes) into the generator.
+// purposes) into the generator. Then, returns the value in the accumulator.
 IGNITION_HANDLER(SuspendGenerator, InterpreterAssembler) {
-  Node* generator_reg = BytecodeOperandReg(0);
-
-  Node* generator = LoadRegister(generator_reg);
-
-  Label if_stepping(this, Label::kDeferred), ok(this);
-  Node* step_action_address = ExternalConstant(
-      ExternalReference::debug_last_step_action_address(isolate()));
-  Node* step_action = Load(MachineType::Int8(), step_action_address);
-  STATIC_ASSERT(StepIn > StepNext);
-  STATIC_ASSERT(LastStepAction == StepIn);
-  Node* step_next = Int32Constant(StepNext);
-  Branch(Int32LessThanOrEqual(step_next, step_action), &if_stepping, &ok);
-  BIND(&ok);
-
+  Node* generator = LoadRegisterAtOperandIndex(0);
   Node* array =
       LoadObjectField(generator, JSGeneratorObject::kRegisterFileOffset);
   Node* context = GetContext();
+  RegListNodePair registers = GetRegisterListAtOperandIndex(1);
   Node* suspend_id = BytecodeOperandUImmSmi(3);
 
-  // Bytecode operand 1 should be always 0 (we are always store registers
-  // from the beginning).
-  CSA_ASSERT(this, WordEqual(BytecodeOperandReg(1),
-                             IntPtrConstant(Register(0).ToOperand())));
-  // Bytecode operand 2 is the number of registers to store to the generator.
-  Node* register_count = ChangeUint32ToWord(BytecodeOperandCount(2));
-  ExportRegisterFile(array, register_count);
+  ExportRegisterFile(array, registers);
   StoreObjectField(generator, JSGeneratorObject::kContextOffset, context);
   StoreObjectField(generator, JSGeneratorObject::kContinuationOffset,
                    suspend_id);
@@ -3115,59 +3035,66 @@ IGNITION_HANDLER(SuspendGenerator, InterpreterAssembler) {
   Node* offset = SmiTag(BytecodeOffset());
   StoreObjectField(generator, JSGeneratorObject::kInputOrDebugPosOffset,
                    offset);
-  Dispatch();
 
-  BIND(&if_stepping);
-  {
-    Node* context = GetContext();
-    CallRuntime(Runtime::kDebugRecordGenerator, context, generator);
-    Goto(&ok);
-  }
+  UpdateInterruptBudgetOnReturn();
+  Return(GetAccumulator());
 }
 
-// RestoreGeneratorState <generator>
+// SwitchOnGeneratorState <generator> <table_start> <table_length>
 //
-// Loads the generator's state and stores it in the accumulator,
-// before overwriting it with kGeneratorExecuting.
-IGNITION_HANDLER(RestoreGeneratorState, InterpreterAssembler) {
-  Node* generator_reg = BytecodeOperandReg(0);
-  Node* generator = LoadRegister(generator_reg);
+// If |generator| is undefined, falls through. Otherwise, loads the
+// generator's state (overwriting it with kGeneratorExecuting), sets the context
+// to the generator's resume context, and performs state dispatch on the
+// generator's state by looking up the generator state in a jump table in the
+// constant pool, starting at |table_start|, and of length |table_length|.
+IGNITION_HANDLER(SwitchOnGeneratorState, InterpreterAssembler) {
+  Node* generator = LoadRegisterAtOperandIndex(0);
+
+  Label fallthrough(this);
+  GotoIf(WordEqual(generator, UndefinedConstant()), &fallthrough);
 
-  Node* old_state =
+  Node* state =
       LoadObjectField(generator, JSGeneratorObject::kContinuationOffset);
-  Node* new_state = Int32Constant(JSGeneratorObject::kGeneratorExecuting);
+  Node* new_state = SmiConstant(JSGeneratorObject::kGeneratorExecuting);
   StoreObjectField(generator, JSGeneratorObject::kContinuationOffset,
-                   SmiTag(new_state));
-  SetAccumulator(old_state);
+                   new_state);
+
+  Node* context = LoadObjectField(generator, JSGeneratorObject::kContextOffset);
+  SetContext(context);
+
+  Node* table_start = BytecodeOperandIdx(1);
+  // TODO(leszeks): table_length is only used for a CSA_ASSERT, we don't
+  // actually need it otherwise.
+  Node* table_length = BytecodeOperandUImmWord(2);
 
+  // The state must be a Smi.
+  CSA_ASSERT(this, TaggedIsSmi(state));
+
+  Node* case_value = SmiUntag(state);
+
+  CSA_ASSERT(this, IntPtrGreaterThanOrEqual(case_value, IntPtrConstant(0)));
+  CSA_ASSERT(this, IntPtrLessThan(case_value, table_length));
+  USE(table_length);
+
+  Node* entry = IntPtrAdd(table_start, case_value);
+  Node* relative_jump = LoadAndUntagConstantPoolEntry(entry);
+  Jump(relative_jump);
+
+  BIND(&fallthrough);
   Dispatch();
 }
 
-// ResumeGenerator <generator> <generator_state> <first output
-// register> <register count>
+// ResumeGenerator <generator> <first output register> <register count>
 //
 // Imports the register file stored in the generator and marks the generator
 // state as executing.
 IGNITION_HANDLER(ResumeGenerator, InterpreterAssembler) {
-  Node* generator_reg = BytecodeOperandReg(0);
-  Node* generator_state_reg = BytecodeOperandReg(1);
-  // Bytecode operand 2 is the start register. It should always be 0, so let's
-  // ignore it.
-  CSA_ASSERT(this, WordEqual(BytecodeOperandReg(2),
-                             IntPtrConstant(Register(0).ToOperand())));
-  // Bytecode operand 3 is the number of registers to store to the generator.
-  Node* register_count = ChangeUint32ToWord(BytecodeOperandCount(3));
-
-  Node* generator = LoadRegister(generator_reg);
+  Node* generator = LoadRegisterAtOperandIndex(0);
+  RegListNodePair registers = GetRegisterListAtOperandIndex(1);
 
   ImportRegisterFile(
       LoadObjectField(generator, JSGeneratorObject::kRegisterFileOffset),
-      register_count);
-
-  // Since we're resuming, update the generator state to indicate that the
-  // generator is now executing.
-  StoreRegister(SmiConstant(JSGeneratorObject::kGeneratorExecuting),
-                generator_state_reg);
+      registers);
 
   // Return the generator's input_or_debug_pos in the accumulator.
   SetAccumulator(
@@ -3184,7 +3111,10 @@ Handle<Code> GenerateBytecodeHandler(Isolate* isolate, Bytecode bytecode,
   InterpreterDispatchDescriptor descriptor(isolate);
   compiler::CodeAssemblerState state(
       isolate, &zone, descriptor, Code::BYTECODE_HANDLER,
-      Bytecodes::ToString(bytecode), Bytecodes::ReturnCount(bytecode));
+      Bytecodes::ToString(bytecode),
+      FLAG_untrusted_code_mitigations ? PoisoningMitigationLevel::kOn
+                                      : PoisoningMitigationLevel::kOff,
+      Bytecodes::ReturnCount(bytecode));
 
   switch (bytecode) {
 #define CALL_GENERATOR(Name, ...)                     \
@@ -3254,9 +3184,11 @@ Handle<Code> GenerateDeserializeLazyHandler(Isolate* isolate,
   }
 
   InterpreterDispatchDescriptor descriptor(isolate);
-  compiler::CodeAssemblerState state(isolate, &zone, descriptor,
-                                     Code::BYTECODE_HANDLER, debug_name.c_str(),
-                                     return_count);
+  compiler::CodeAssemblerState state(
+      isolate, &zone, descriptor, Code::BYTECODE_HANDLER, debug_name.c_str(),
+      FLAG_untrusted_code_mitigations ? PoisoningMitigationLevel::kOn
+                                      : PoisoningMitigationLevel::kOff,
+      return_count);
 
   DeserializeLazyAssembler::Generate(&state, operand_scale);
   Handle<Code> code = compiler::CodeAssembler::GenerateCode(&state);
diff --git a/deps/v8/src/interpreter/interpreter-intrinsics-generator.cc b/deps/v8/src/interpreter/interpreter-intrinsics-generator.cc
index 7ad8d49b63b..b5d178d58db 100644
--- a/deps/v8/src/interpreter/interpreter-intrinsics-generator.cc
+++ b/deps/v8/src/interpreter/interpreter-intrinsics-generator.cc
@@ -7,6 +7,7 @@
 #include "src/allocation.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
+#include "src/factory-inl.h"
 #include "src/frames.h"
 #include "src/interpreter/bytecodes.h"
 #include "src/interpreter/interpreter-assembler.h"
@@ -19,6 +20,8 @@ namespace internal {
 namespace interpreter {
 
 using compiler::Node;
+template <typename T>
+using TNode = compiler::TNode<T>;
 
 class IntrinsicsGenerator {
  public:
@@ -27,8 +30,8 @@ class IntrinsicsGenerator {
         zone_(assembler->zone()),
         assembler_(assembler) {}
 
-  Node* InvokeIntrinsic(Node* function_id, Node* context, Node* first_arg_reg,
-                        Node* arg_count);
+  Node* InvokeIntrinsic(Node* function_id, Node* context,
+                        const InterpreterAssembler::RegListNodePair& args);
 
  private:
   enum InstanceTypeCompareMode {
@@ -38,18 +41,21 @@ class IntrinsicsGenerator {
 
   Node* IsInstanceType(Node* input, int type);
   Node* CompareInstanceType(Node* map, int type, InstanceTypeCompareMode mode);
-  Node* IntrinsicAsStubCall(Node* input, Node* context,
-                            Callable const& callable);
-  Node* IntrinsicAsBuiltinCall(Node* input, Node* context, Builtins::Name name);
+  Node* IntrinsicAsStubCall(const InterpreterAssembler::RegListNodePair& args,
+                            Node* context, Callable const& callable);
+  Node* IntrinsicAsBuiltinCall(
+      const InterpreterAssembler::RegListNodePair& args, Node* context,
+      Builtins::Name name);
   void AbortIfArgCountMismatch(int expected, compiler::Node* actual);
 
 #define DECLARE_INTRINSIC_HELPER(name, lower_case, count) \
-  Node* name(Node* input, Node* arg_count, Node* context);
+  Node* name(const InterpreterAssembler::RegListNodePair& args, Node* context);
   INTRINSICS_LIST(DECLARE_INTRINSIC_HELPER)
 #undef DECLARE_INTRINSIC_HELPER
 
   Isolate* isolate() { return isolate_; }
   Zone* zone() { return zone_; }
+  Factory* factory() { return isolate()->factory(); }
 
   Isolate* isolate_;
   Zone* zone_;
@@ -58,19 +64,18 @@ class IntrinsicsGenerator {
   DISALLOW_COPY_AND_ASSIGN(IntrinsicsGenerator);
 };
 
-Node* GenerateInvokeIntrinsic(InterpreterAssembler* assembler,
-                              Node* function_id, Node* context,
-                              Node* first_arg_reg, Node* arg_count) {
+Node* GenerateInvokeIntrinsic(
+    InterpreterAssembler* assembler, Node* function_id, Node* context,
+    const InterpreterAssembler::RegListNodePair& args) {
   IntrinsicsGenerator generator(assembler);
-  return generator.InvokeIntrinsic(function_id, context, first_arg_reg,
-                                   arg_count);
+  return generator.InvokeIntrinsic(function_id, context, args);
 }
 
 #define __ assembler_->
 
-Node* IntrinsicsGenerator::InvokeIntrinsic(Node* function_id, Node* context,
-                                           Node* first_arg_reg,
-                                           Node* arg_count) {
+Node* IntrinsicsGenerator::InvokeIntrinsic(
+    Node* function_id, Node* context,
+    const InterpreterAssembler::RegListNodePair& args) {
   InterpreterAssembler::Label abort(assembler_), end(assembler_);
   InterpreterAssembler::Variable result(assembler_,
                                         MachineRepresentation::kTagged);
@@ -90,17 +95,17 @@ Node* IntrinsicsGenerator::InvokeIntrinsic(Node* function_id, Node* context,
 #undef CASE
 
   __ Switch(function_id, &abort, cases, labels, arraysize(cases));
-#define HANDLE_CASE(name, lower_case, expected_arg_count)     \
-  __ BIND(&lower_case);                                       \
-  {                                                           \
-    if (FLAG_debug_code && expected_arg_count >= 0) {         \
-      AbortIfArgCountMismatch(expected_arg_count, arg_count); \
-    }                                                         \
-    Node* value = name(first_arg_reg, arg_count, context);    \
-    if (value) {                                              \
-      result.Bind(value);                                     \
-      __ Goto(&end);                                          \
-    }                                                         \
+#define HANDLE_CASE(name, lower_case, expected_arg_count)            \
+  __ BIND(&lower_case);                                              \
+  {                                                                  \
+    if (FLAG_debug_code && expected_arg_count >= 0) {                \
+      AbortIfArgCountMismatch(expected_arg_count, args.reg_count()); \
+    }                                                                \
+    Node* value = name(args, context);                               \
+    if (value) {                                                     \
+      result.Bind(value);                                            \
+      __ Goto(&end);                                                 \
+    }                                                                \
   }
   INTRINSICS_LIST(HANDLE_CASE)
 #undef HANDLE_CASE
@@ -129,238 +134,193 @@ Node* IntrinsicsGenerator::CompareInstanceType(Node* object, int type,
 }
 
 Node* IntrinsicsGenerator::IsInstanceType(Node* input, int type) {
-  InterpreterAssembler::Variable return_value(assembler_,
-                                              MachineRepresentation::kTagged);
-  // TODO(ishell): Use Select here.
-  InterpreterAssembler::Label if_not_smi(assembler_), return_true(assembler_),
-      return_false(assembler_), end(assembler_);
-  Node* arg = __ LoadRegister(input);
-  __ GotoIf(__ TaggedIsSmi(arg), &return_false);
-
-  Node* condition = CompareInstanceType(arg, type, kInstanceTypeEqual);
-  __ Branch(condition, &return_true, &return_false);
-
-  __ BIND(&return_true);
-  {
-    return_value.Bind(__ TrueConstant());
-    __ Goto(&end);
-  }
-
-  __ BIND(&return_false);
-  {
-    return_value.Bind(__ FalseConstant());
-    __ Goto(&end);
-  }
-
-  __ BIND(&end);
-  return return_value.value();
-}
-
-Node* IntrinsicsGenerator::IsJSReceiver(Node* input, Node* arg_count,
-                                        Node* context) {
-  // TODO(ishell): Use Select here.
-  // TODO(ishell): Use CSA::IsJSReceiverInstanceType here.
-  InterpreterAssembler::Variable return_value(assembler_,
-                                              MachineRepresentation::kTagged);
-  InterpreterAssembler::Label return_true(assembler_), return_false(assembler_),
-      end(assembler_);
-
-  Node* arg = __ LoadRegister(input);
-  __ GotoIf(__ TaggedIsSmi(arg), &return_false);
-
-  STATIC_ASSERT(LAST_TYPE == LAST_JS_RECEIVER_TYPE);
-  Node* condition = CompareInstanceType(arg, FIRST_JS_RECEIVER_TYPE,
-                                        kInstanceTypeGreaterThanOrEqual);
-  __ Branch(condition, &return_true, &return_false);
-
-  __ BIND(&return_true);
-  {
-    return_value.Bind(__ TrueConstant());
-    __ Goto(&end);
-  }
-
-  __ BIND(&return_false);
-  {
-    return_value.Bind(__ FalseConstant());
-    __ Goto(&end);
-  }
-
-  __ BIND(&end);
-  return return_value.value();
-}
-
-Node* IntrinsicsGenerator::IsArray(Node* input, Node* arg_count,
-                                   Node* context) {
+  TNode<Oddball> result = __ Select<Oddball>(
+      __ TaggedIsSmi(input), [=] { return __ FalseConstant(); },
+      [=] {
+        return __ SelectBooleanConstant(
+            CompareInstanceType(input, type, kInstanceTypeEqual));
+      });
+  return result;
+}
+
+Node* IntrinsicsGenerator::IsJSReceiver(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  Node* input = __ LoadRegisterFromRegisterList(args, 0);
+  TNode<Oddball> result = __ Select<Oddball>(
+      __ TaggedIsSmi(input), [=] { return __ FalseConstant(); },
+      [=] { return __ SelectBooleanConstant(__ IsJSReceiver(input)); });
+  return result;
+}
+
+Node* IntrinsicsGenerator::IsArray(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  Node* input = __ LoadRegisterFromRegisterList(args, 0);
   return IsInstanceType(input, JS_ARRAY_TYPE);
 }
 
-Node* IntrinsicsGenerator::IsJSProxy(Node* input, Node* arg_count,
-                                     Node* context) {
+Node* IntrinsicsGenerator::IsJSProxy(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  Node* input = __ LoadRegisterFromRegisterList(args, 0);
   return IsInstanceType(input, JS_PROXY_TYPE);
 }
 
-Node* IntrinsicsGenerator::IsTypedArray(Node* input, Node* arg_count,
-                                        Node* context) {
+Node* IntrinsicsGenerator::IsTypedArray(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  Node* input = __ LoadRegisterFromRegisterList(args, 0);
   return IsInstanceType(input, JS_TYPED_ARRAY_TYPE);
 }
 
-Node* IntrinsicsGenerator::IsJSMap(Node* input, Node* arg_count,
-                                   Node* context) {
+Node* IntrinsicsGenerator::IsJSMap(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  Node* input = __ LoadRegisterFromRegisterList(args, 0);
   return IsInstanceType(input, JS_MAP_TYPE);
 }
 
-Node* IntrinsicsGenerator::IsJSSet(Node* input, Node* arg_count,
-                                   Node* context) {
+Node* IntrinsicsGenerator::IsJSSet(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  Node* input = __ LoadRegisterFromRegisterList(args, 0);
   return IsInstanceType(input, JS_SET_TYPE);
 }
 
-Node* IntrinsicsGenerator::IsJSWeakMap(Node* input, Node* arg_count,
-                                       Node* context) {
+Node* IntrinsicsGenerator::IsJSWeakMap(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  Node* input = __ LoadRegisterFromRegisterList(args, 0);
   return IsInstanceType(input, JS_WEAK_MAP_TYPE);
 }
 
-Node* IntrinsicsGenerator::IsJSWeakSet(Node* input, Node* arg_count,
-                                       Node* context) {
+Node* IntrinsicsGenerator::IsJSWeakSet(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  Node* input = __ LoadRegisterFromRegisterList(args, 0);
   return IsInstanceType(input, JS_WEAK_SET_TYPE);
 }
 
-Node* IntrinsicsGenerator::IsSmi(Node* input, Node* arg_count, Node* context) {
-  // TODO(ishell): Use SelectBooleanConstant here.
-  InterpreterAssembler::Variable return_value(assembler_,
-                                              MachineRepresentation::kTagged);
-  InterpreterAssembler::Label if_smi(assembler_), if_not_smi(assembler_),
-      end(assembler_);
-
-  Node* arg = __ LoadRegister(input);
-
-  __ Branch(__ TaggedIsSmi(arg), &if_smi, &if_not_smi);
-  __ BIND(&if_smi);
-  {
-    return_value.Bind(__ TrueConstant());
-    __ Goto(&end);
-  }
-
-  __ BIND(&if_not_smi);
-  {
-    return_value.Bind(__ FalseConstant());
-    __ Goto(&end);
-  }
-
-  __ BIND(&end);
-  return return_value.value();
+Node* IntrinsicsGenerator::IsSmi(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  Node* input = __ LoadRegisterFromRegisterList(args, 0);
+  return __ SelectBooleanConstant(__ TaggedIsSmi(input));
 }
 
-Node* IntrinsicsGenerator::IntrinsicAsStubCall(Node* args_reg, Node* context,
-                                               Callable const& callable) {
+Node* IntrinsicsGenerator::IntrinsicAsStubCall(
+    const InterpreterAssembler::RegListNodePair& args, Node* context,
+    Callable const& callable) {
   int param_count = callable.descriptor().GetParameterCount();
   int input_count = param_count + 2;  // +2 for target and context
-  Node** args = zone()->NewArray<Node*>(input_count);
+  Node** stub_args = zone()->NewArray<Node*>(input_count);
   int index = 0;
-  args[index++] = __ HeapConstant(callable.code());
+  stub_args[index++] = __ HeapConstant(callable.code());
   for (int i = 0; i < param_count; i++) {
-    args[index++] = __ LoadRegister(args_reg);
-    args_reg = __ NextRegister(args_reg);
+    stub_args[index++] = __ LoadRegisterFromRegisterList(args, i);
   }
-  args[index++] = context;
-  return __ CallStubN(callable.descriptor(), 1, input_count, args);
+  stub_args[index++] = context;
+  return __ CallStubN(callable.descriptor(), 1, input_count, stub_args);
 }
 
-Node* IntrinsicsGenerator::IntrinsicAsBuiltinCall(Node* input, Node* context,
-                                                  Builtins::Name name) {
+Node* IntrinsicsGenerator::IntrinsicAsBuiltinCall(
+    const InterpreterAssembler::RegListNodePair& args, Node* context,
+    Builtins::Name name) {
   Callable callable = Builtins::CallableFor(isolate_, name);
-  return IntrinsicAsStubCall(input, context, callable);
+  return IntrinsicAsStubCall(args, context, callable);
 }
 
-Node* IntrinsicsGenerator::CreateIterResultObject(Node* input, Node* arg_count,
-                                                  Node* context) {
+Node* IntrinsicsGenerator::CreateIterResultObject(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
   return IntrinsicAsStubCall(
-      input, context,
+      args, context,
       Builtins::CallableFor(isolate(), Builtins::kCreateIterResultObject));
 }
 
-Node* IntrinsicsGenerator::HasProperty(Node* input, Node* arg_count,
-                                       Node* context) {
+Node* IntrinsicsGenerator::HasProperty(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
   return IntrinsicAsStubCall(
-      input, context, Builtins::CallableFor(isolate(), Builtins::kHasProperty));
+      args, context, Builtins::CallableFor(isolate(), Builtins::kHasProperty));
 }
 
-Node* IntrinsicsGenerator::ToString(Node* input, Node* arg_count,
-                                    Node* context) {
+Node* IntrinsicsGenerator::RejectPromise(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
   return IntrinsicAsStubCall(
-      input, context, Builtins::CallableFor(isolate(), Builtins::kToString));
+      args, context,
+      Builtins::CallableFor(isolate(), Builtins::kRejectPromise));
 }
 
-Node* IntrinsicsGenerator::ToLength(Node* input, Node* arg_count,
-                                    Node* context) {
+Node* IntrinsicsGenerator::ResolvePromise(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
   return IntrinsicAsStubCall(
-      input, context, Builtins::CallableFor(isolate(), Builtins::kToLength));
+      args, context,
+      Builtins::CallableFor(isolate(), Builtins::kResolvePromise));
 }
 
-Node* IntrinsicsGenerator::ToInteger(Node* input, Node* arg_count,
-                                     Node* context) {
+Node* IntrinsicsGenerator::ToString(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
   return IntrinsicAsStubCall(
-      input, context, Builtins::CallableFor(isolate(), Builtins::kToInteger));
+      args, context, Builtins::CallableFor(isolate(), Builtins::kToString));
 }
 
-Node* IntrinsicsGenerator::ToNumber(Node* input, Node* arg_count,
-                                    Node* context) {
+Node* IntrinsicsGenerator::ToLength(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
   return IntrinsicAsStubCall(
-      input, context, Builtins::CallableFor(isolate(), Builtins::kToNumber));
+      args, context, Builtins::CallableFor(isolate(), Builtins::kToLength));
 }
 
-Node* IntrinsicsGenerator::ToObject(Node* input, Node* arg_count,
-                                    Node* context) {
+Node* IntrinsicsGenerator::ToInteger(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
   return IntrinsicAsStubCall(
-      input, context, Builtins::CallableFor(isolate(), Builtins::kToObject));
+      args, context, Builtins::CallableFor(isolate(), Builtins::kToInteger));
 }
 
-Node* IntrinsicsGenerator::Call(Node* args_reg, Node* arg_count,
-                                Node* context) {
-  // First argument register contains the function target.
-  Node* function = __ LoadRegister(args_reg);
+Node* IntrinsicsGenerator::ToNumber(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  return IntrinsicAsStubCall(
+      args, context, Builtins::CallableFor(isolate(), Builtins::kToNumber));
+}
 
-  // Receiver is the second runtime call argument.
-  Node* receiver_reg = __ NextRegister(args_reg);
-  Node* receiver_arg = __ RegisterLocation(receiver_reg);
+Node* IntrinsicsGenerator::ToObject(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  return IntrinsicAsStubCall(
+      args, context, Builtins::CallableFor(isolate(), Builtins::kToObject));
+}
 
-  // Subtract function and receiver from arg count.
-  Node* function_and_receiver_count = __ Int32Constant(2);
-  Node* target_args_count = __ Int32Sub(arg_count, function_and_receiver_count);
+Node* IntrinsicsGenerator::Call(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  // First argument register contains the function target.
+  Node* function = __ LoadRegisterFromRegisterList(args, 0);
+
+  // The arguments for the target function are from the second runtime call
+  // argument.
+  InterpreterAssembler::RegListNodePair target_args(
+      __ RegisterLocationInRegisterList(args, 1),
+      __ Int32Sub(args.reg_count(), __ Int32Constant(1)));
 
   if (FLAG_debug_code) {
     InterpreterAssembler::Label arg_count_positive(assembler_);
-    Node* comparison = __ Int32LessThan(target_args_count, __ Int32Constant(0));
+    Node* comparison =
+        __ Int32LessThan(target_args.reg_count(), __ Int32Constant(0));
     __ GotoIfNot(comparison, &arg_count_positive);
     __ Abort(AbortReason::kWrongArgumentCountForInvokeIntrinsic);
     __ Goto(&arg_count_positive);
     __ BIND(&arg_count_positive);
   }
 
-  __ CallJSAndDispatch(function, context, receiver_arg, target_args_count,
+  __ CallJSAndDispatch(function, context, target_args,
                        ConvertReceiverMode::kAny);
   return nullptr;  // We never return from the CallJSAndDispatch above.
 }
 
-Node* IntrinsicsGenerator::ClassOf(Node* args_reg, Node* arg_count,
-                                   Node* context) {
-  Node* value = __ LoadRegister(args_reg);
-  return __ ClassOf(value);
-}
-
-Node* IntrinsicsGenerator::CreateAsyncFromSyncIterator(Node* args_reg,
-                                                       Node* arg_count,
-                                                       Node* context) {
+Node* IntrinsicsGenerator::CreateAsyncFromSyncIterator(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
   InterpreterAssembler::Label not_receiver(
       assembler_, InterpreterAssembler::Label::kDeferred);
   InterpreterAssembler::Label done(assembler_);
   InterpreterAssembler::Variable return_value(assembler_,
                                               MachineRepresentation::kTagged);
 
-  Node* sync_iterator = __ LoadRegister(args_reg);
+  Node* sync_iterator = __ LoadRegisterFromRegisterList(args, 0);
 
   __ GotoIf(__ TaggedIsSmi(sync_iterator), &not_receiver);
   __ GotoIfNot(__ IsJSReceiver(sync_iterator), &not_receiver);
 
+  Node* const next =
+      __ GetProperty(context, sync_iterator, factory()->next_string());
+
   Node* const native_context = __ LoadNativeContext(context);
   Node* const map = __ LoadContextElement(
       native_context, Context::ASYNC_FROM_SYNC_ITERATOR_MAP_INDEX);
@@ -368,6 +328,8 @@ Node* IntrinsicsGenerator::CreateAsyncFromSyncIterator(Node* args_reg,
 
   __ StoreObjectFieldNoWriteBarrier(
       iterator, JSAsyncFromSyncIterator::kSyncIteratorOffset, sync_iterator);
+  __ StoreObjectFieldNoWriteBarrier(iterator,
+                                    JSAsyncFromSyncIterator::kNextOffset, next);
 
   return_value.Bind(iterator);
   __ Goto(&done);
@@ -385,52 +347,41 @@ Node* IntrinsicsGenerator::CreateAsyncFromSyncIterator(Node* args_reg,
   return return_value.value();
 }
 
-Node* IntrinsicsGenerator::CreateJSGeneratorObject(Node* input, Node* arg_count,
-                                                   Node* context) {
-  return IntrinsicAsBuiltinCall(input, context,
+Node* IntrinsicsGenerator::CreateJSGeneratorObject(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  return IntrinsicAsBuiltinCall(args, context,
                                 Builtins::kCreateGeneratorObject);
 }
 
-Node* IntrinsicsGenerator::GeneratorGetContext(Node* args_reg, Node* arg_count,
-                                               Node* context) {
-  Node* generator = __ LoadRegister(args_reg);
-  Node* const value =
-      __ LoadObjectField(generator, JSGeneratorObject::kContextOffset);
-
-  return value;
-}
-
-Node* IntrinsicsGenerator::GeneratorGetInputOrDebugPos(Node* args_reg,
-                                                       Node* arg_count,
-                                                       Node* context) {
-  Node* generator = __ LoadRegister(args_reg);
+Node* IntrinsicsGenerator::GeneratorGetInputOrDebugPos(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  Node* generator = __ LoadRegisterFromRegisterList(args, 0);
   Node* const value =
       __ LoadObjectField(generator, JSGeneratorObject::kInputOrDebugPosOffset);
 
   return value;
 }
 
-Node* IntrinsicsGenerator::GeneratorGetResumeMode(Node* args_reg,
-                                                  Node* arg_count,
-                                                  Node* context) {
-  Node* generator = __ LoadRegister(args_reg);
+Node* IntrinsicsGenerator::GeneratorGetResumeMode(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  Node* generator = __ LoadRegisterFromRegisterList(args, 0);
   Node* const value =
       __ LoadObjectField(generator, JSGeneratorObject::kResumeModeOffset);
 
   return value;
 }
 
-Node* IntrinsicsGenerator::GeneratorClose(Node* args_reg, Node* arg_count,
-                                          Node* context) {
-  Node* generator = __ LoadRegister(args_reg);
+Node* IntrinsicsGenerator::GeneratorClose(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  Node* generator = __ LoadRegisterFromRegisterList(args, 0);
   __ StoreObjectFieldNoWriteBarrier(
       generator, JSGeneratorObject::kContinuationOffset,
       __ SmiConstant(JSGeneratorObject::kGeneratorClosed));
   return __ UndefinedConstant();
 }
 
-Node* IntrinsicsGenerator::GetImportMetaObject(Node* args_reg, Node* arg_count,
-                                               Node* context) {
+Node* IntrinsicsGenerator::GetImportMetaObject(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
   Node* const module_context = __ LoadModuleContext(context);
   Node* const module =
       __ LoadContextElement(module_context, Context::EXTENSION_INDEX);
@@ -451,21 +402,44 @@ Node* IntrinsicsGenerator::GetImportMetaObject(Node* args_reg, Node* arg_count,
   return return_value.value();
 }
 
-Node* IntrinsicsGenerator::AsyncGeneratorReject(Node* input, Node* arg_count,
-                                                Node* context) {
-  return IntrinsicAsBuiltinCall(input, context,
-                                Builtins::kAsyncGeneratorReject);
+Node* IntrinsicsGenerator::AsyncFunctionAwaitCaught(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  return IntrinsicAsBuiltinCall(args, context,
+                                Builtins::kAsyncFunctionAwaitCaught);
+}
+
+Node* IntrinsicsGenerator::AsyncFunctionAwaitUncaught(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  return IntrinsicAsBuiltinCall(args, context,
+                                Builtins::kAsyncFunctionAwaitUncaught);
+}
+
+Node* IntrinsicsGenerator::AsyncGeneratorAwaitCaught(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  return IntrinsicAsBuiltinCall(args, context,
+                                Builtins::kAsyncGeneratorAwaitCaught);
+}
+
+Node* IntrinsicsGenerator::AsyncGeneratorAwaitUncaught(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  return IntrinsicAsBuiltinCall(args, context,
+                                Builtins::kAsyncGeneratorAwaitUncaught);
+}
+
+Node* IntrinsicsGenerator::AsyncGeneratorReject(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  return IntrinsicAsBuiltinCall(args, context, Builtins::kAsyncGeneratorReject);
 }
 
-Node* IntrinsicsGenerator::AsyncGeneratorResolve(Node* input, Node* arg_count,
-                                                 Node* context) {
-  return IntrinsicAsBuiltinCall(input, context,
+Node* IntrinsicsGenerator::AsyncGeneratorResolve(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  return IntrinsicAsBuiltinCall(args, context,
                                 Builtins::kAsyncGeneratorResolve);
 }
 
-Node* IntrinsicsGenerator::AsyncGeneratorYield(Node* input, Node* arg_count,
-                                               Node* context) {
-  return IntrinsicAsBuiltinCall(input, context, Builtins::kAsyncGeneratorYield);
+Node* IntrinsicsGenerator::AsyncGeneratorYield(
+    const InterpreterAssembler::RegListNodePair& args, Node* context) {
+  return IntrinsicAsBuiltinCall(args, context, Builtins::kAsyncGeneratorYield);
 }
 
 void IntrinsicsGenerator::AbortIfArgCountMismatch(int expected, Node* actual) {
diff --git a/deps/v8/src/interpreter/interpreter-intrinsics-generator.h b/deps/v8/src/interpreter/interpreter-intrinsics-generator.h
index 11442438d5d..fd4e167ed0f 100644
--- a/deps/v8/src/interpreter/interpreter-intrinsics-generator.h
+++ b/deps/v8/src/interpreter/interpreter-intrinsics-generator.h
@@ -5,6 +5,8 @@
 #ifndef V8_INTERPRETER_INTERPRETER_INTRINSICS_GENERATOR_H_
 #define V8_INTERPRETER_INTERPRETER_INTRINSICS_GENERATOR_H_
 
+#include "src/interpreter/interpreter-assembler.h"
+
 namespace v8 {
 namespace internal {
 
@@ -14,13 +16,9 @@ class Node;
 
 namespace interpreter {
 
-class InterpreterAssembler;
-
-extern compiler::Node* GenerateInvokeIntrinsic(InterpreterAssembler* assembler,
-                                               compiler::Node* function_id,
-                                               compiler::Node* context,
-                                               compiler::Node* first_arg_reg,
-                                               compiler::Node* arg_count);
+extern compiler::Node* GenerateInvokeIntrinsic(
+    InterpreterAssembler* assembler, compiler::Node* function_id,
+    compiler::Node* context, const InterpreterAssembler::RegListNodePair& args);
 
 }  // namespace interpreter
 }  // namespace internal
diff --git a/deps/v8/src/interpreter/interpreter-intrinsics.h b/deps/v8/src/interpreter/interpreter-intrinsics.h
index b9137c8559a..6cdfec2d04f 100644
--- a/deps/v8/src/interpreter/interpreter-intrinsics.h
+++ b/deps/v8/src/interpreter/interpreter-intrinsics.h
@@ -14,17 +14,19 @@ namespace interpreter {
 // List of supported intrisics, with upper case name, lower case name and
 // expected number of arguments (-1 denoting argument count is variable).
 #define INTRINSICS_LIST(V)                                            \
+  V(AsyncFunctionAwaitCaught, async_function_await_caught, 3)         \
+  V(AsyncFunctionAwaitUncaught, async_function_await_uncaught, 3)     \
+  V(AsyncGeneratorAwaitCaught, async_generator_await_caught, 2)       \
+  V(AsyncGeneratorAwaitUncaught, async_generator_await_uncaught, 2)   \
   V(AsyncGeneratorReject, async_generator_reject, 2)                  \
   V(AsyncGeneratorResolve, async_generator_resolve, 3)                \
   V(AsyncGeneratorYield, async_generator_yield, 3)                    \
   V(CreateJSGeneratorObject, create_js_generator_object, 2)           \
-  V(GeneratorGetContext, generator_get_context, 1)                    \
   V(GeneratorGetResumeMode, generator_get_resume_mode, 1)             \
   V(GeneratorGetInputOrDebugPos, generator_get_input_or_debug_pos, 1) \
   V(GeneratorClose, generator_close, 1)                               \
   V(GetImportMetaObject, get_import_meta_object, 0)                   \
   V(Call, call, -1)                                                   \
-  V(ClassOf, class_of, 1)                                             \
   V(CreateIterResultObject, create_iter_result_object, 2)             \
   V(CreateAsyncFromSyncIterator, create_async_from_sync_iterator, 1)  \
   V(HasProperty, has_property, 2)                                     \
@@ -37,6 +39,8 @@ namespace interpreter {
   V(IsJSWeakSet, is_js_weak_set, 1)                                   \
   V(IsSmi, is_smi, 1)                                                 \
   V(IsTypedArray, is_typed_array, 1)                                  \
+  V(RejectPromise, reject_promise, 3)                                 \
+  V(ResolvePromise, resolve_promise, 2)                               \
   V(ToString, to_string, 1)                                           \
   V(ToLength, to_length, 1)                                           \
   V(ToInteger, to_integer, 1)                                         \
@@ -65,4 +69,4 @@ class IntrinsicsHelper {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_INTERPRETER_INTERPRETER_INTRINSICS_H_
diff --git a/deps/v8/src/interpreter/interpreter.cc b/deps/v8/src/interpreter/interpreter.cc
index fb74d37df49..4df884cdc87 100644
--- a/deps/v8/src/interpreter/interpreter.cc
+++ b/deps/v8/src/interpreter/interpreter.cc
@@ -29,7 +29,8 @@ namespace interpreter {
 class InterpreterCompilationJob final : public CompilationJob {
  public:
   InterpreterCompilationJob(ParseInfo* parse_info, FunctionLiteral* literal,
-                            AccountingAllocator* allocator);
+                            AccountingAllocator* allocator,
+                            ZoneVector<FunctionLiteral*>* eager_inner_literals);
 
  protected:
   Status PrepareJobImpl(Isolate* isolate) final;
@@ -66,11 +67,6 @@ Code* Interpreter::GetAndMaybeDeserializeBytecodeHandler(
   if (!isolate_->heap()->IsDeserializeLazyHandler(code)) return code;
 
   DCHECK(FLAG_lazy_handler_deserialization);
-  if (FLAG_trace_lazy_deserialization) {
-    PrintF("Lazy-deserializing handler %s\n",
-           Bytecodes::ToString(bytecode, operand_scale).c_str());
-  }
-
   DCHECK(Bytecodes::BytecodeHasHandler(bytecode, operand_scale));
   code = Snapshot::DeserializeHandler(isolate_, bytecode, operand_scale);
 
@@ -123,13 +119,17 @@ void Interpreter::IterateDispatchTable(RootVisitor* v) {
                        ? nullptr
                        : Code::GetCodeFromTargetAddress(code_entry);
     Object* old_code = code;
-    v->VisitRootPointer(Root::kDispatchTable, &code);
+    v->VisitRootPointer(Root::kDispatchTable, nullptr, &code);
     if (code != old_code) {
       dispatch_table_[i] = reinterpret_cast<Code*>(code)->entry();
     }
   }
 }
 
+int Interpreter::InterruptBudget() {
+  return FLAG_interrupt_budget;
+}
+
 namespace {
 
 void MaybePrintAst(ParseInfo* parse_info, CompilationInfo* compilation_info) {
@@ -163,12 +163,14 @@ bool ShouldPrintBytecode(Handle<SharedFunctionInfo> shared) {
 
 InterpreterCompilationJob::InterpreterCompilationJob(
     ParseInfo* parse_info, FunctionLiteral* literal,
-    AccountingAllocator* allocator)
+    AccountingAllocator* allocator,
+    ZoneVector<FunctionLiteral*>* eager_inner_literals)
     : CompilationJob(parse_info->stack_limit(), parse_info, &compilation_info_,
                      "Ignition", State::kReadyToExecute),
       zone_(allocator, ZONE_NAME),
       compilation_info_(&zone_, parse_info, literal),
-      generator_(&compilation_info_, parse_info->ast_string_constants()) {}
+      generator_(&compilation_info_, parse_info->ast_string_constants(),
+                 eager_inner_literals) {}
 
 InterpreterCompilationJob::Status InterpreterCompilationJob::PrepareJobImpl(
     Isolate* isolate) {
@@ -221,15 +223,15 @@ InterpreterCompilationJob::Status InterpreterCompilationJob::FinalizeJobImpl(
   }
 
   compilation_info()->SetBytecodeArray(bytecodes);
-  compilation_info()->SetCode(
-      BUILTIN_CODE(isolate, InterpreterEntryTrampoline));
   return SUCCEEDED;
 }
 
-CompilationJob* Interpreter::NewCompilationJob(ParseInfo* parse_info,
-                                               FunctionLiteral* literal,
-                                               AccountingAllocator* allocator) {
-  return new InterpreterCompilationJob(parse_info, literal, allocator);
+CompilationJob* Interpreter::NewCompilationJob(
+    ParseInfo* parse_info, FunctionLiteral* literal,
+    AccountingAllocator* allocator,
+    ZoneVector<FunctionLiteral*>* eager_inner_literals) {
+  return new InterpreterCompilationJob(parse_info, literal, allocator,
+                                       eager_inner_literals);
 }
 
 bool Interpreter::IsDispatchTableInitialized() const {
diff --git a/deps/v8/src/interpreter/interpreter.h b/deps/v8/src/interpreter/interpreter.h
index 7e6d013a29c..83dfea89f9e 100644
--- a/deps/v8/src/interpreter/interpreter.h
+++ b/deps/v8/src/interpreter/interpreter.h
@@ -27,6 +27,8 @@ class FunctionLiteral;
 class ParseInfo;
 class RootVisitor;
 class SetupIsolateDelegate;
+template <typename>
+class ZoneVector;
 
 namespace interpreter {
 
@@ -37,10 +39,16 @@ class Interpreter {
   explicit Interpreter(Isolate* isolate);
   virtual ~Interpreter() {}
 
+  // Returns the interrupt budget which should be used for the profiler counter.
+  static int InterruptBudget();
+
   // Creates a compilation job which will generate bytecode for |literal|.
-  static CompilationJob* NewCompilationJob(ParseInfo* parse_info,
-                                           FunctionLiteral* literal,
-                                           AccountingAllocator* allocator);
+  // Additionally, if |eager_inner_literals| is not null, adds any eagerly
+  // compilable inner FunctionLiterals to this list.
+  static CompilationJob* NewCompilationJob(
+      ParseInfo* parse_info, FunctionLiteral* literal,
+      AccountingAllocator* allocator,
+      ZoneVector<FunctionLiteral*>* eager_inner_literals);
 
   // If the bytecode handler for |bytecode| and |operand_scale| has not yet
   // been loaded, deserialize it. Then return the handler.
@@ -72,9 +80,6 @@ class Interpreter {
     return reinterpret_cast<Address>(bytecode_dispatch_counters_table_.get());
   }
 
-  // The interrupt budget which should be used for the profiler counter.
-  static const int kInterruptBudget = 144 * KB;
-
  private:
   friend class SetupInterpreter;
   friend class v8::internal::SetupIsolateDelegate;
diff --git a/deps/v8/src/isolate-inl.h b/deps/v8/src/isolate-inl.h
index f51c1cd29a6..cdce5f25093 100644
--- a/deps/v8/src/isolate-inl.h
+++ b/deps/v8/src/isolate-inl.h
@@ -93,7 +93,9 @@ void Isolate::FireBeforeCallEnteredCallback() {
 }
 
 void Isolate::FireMicrotasksCompletedCallback() {
-  for (auto& callback : microtasks_completed_callbacks_) {
+  std::vector<MicrotasksCompletedCallback> callbacks(
+      microtasks_completed_callbacks_);
+  for (auto& callback : callbacks) {
     callback(reinterpret_cast<v8::Isolate*>(this));
   }
 }
@@ -131,7 +133,7 @@ bool Isolate::IsArrayConstructorIntact() {
   return array_constructor_cell->value() == Smi::FromInt(kProtectorValid);
 }
 
-bool Isolate::IsArraySpeciesLookupChainIntact() {
+bool Isolate::IsSpeciesLookupChainIntact() {
   // Note: It would be nice to have debug checks to make sure that the
   // species protector is accurate, but this would be hard to do for most of
   // what the protector stands for:
@@ -154,11 +156,6 @@ bool Isolate::IsStringLengthOverflowIntact() {
   return string_length_cell->value() == Smi::FromInt(kProtectorValid);
 }
 
-bool Isolate::IsFastArrayIterationIntact() {
-  Cell* fast_iteration_cell = heap()->fast_array_iteration_protector();
-  return fast_iteration_cell->value() == Smi::FromInt(kProtectorValid);
-}
-
 bool Isolate::IsArrayBufferNeuteringIntact() {
   PropertyCell* buffer_neutering = heap()->array_buffer_neutering_protector();
   return buffer_neutering->value() == Smi::FromInt(kProtectorValid);
diff --git a/deps/v8/src/isolate.cc b/deps/v8/src/isolate.cc
index 7165d88d34b..9909082ab4c 100644
--- a/deps/v8/src/isolate.cc
+++ b/deps/v8/src/isolate.cc
@@ -6,6 +6,7 @@
 
 #include <stdlib.h>
 
+#include <atomic>
 #include <fstream>  // NOLINT(readability/streams)
 #include <sstream>
 
@@ -20,6 +21,7 @@
 #include "src/base/utils/random-number-generator.h"
 #include "src/basic-block-profiler.h"
 #include "src/bootstrapper.h"
+#include "src/builtins/constants-table-builder.h"
 #include "src/cancelable-task.h"
 #include "src/code-stubs.h"
 #include "src/compilation-cache.h"
@@ -29,16 +31,16 @@
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
 #include "src/elements.h"
-#include "src/external-reference-table.h"
 #include "src/frames-inl.h"
 #include "src/ic/stub-cache.h"
-#include "src/interface-descriptors.h"
+#include "src/instruction-stream.h"
 #include "src/interpreter/interpreter.h"
 #include "src/isolate-inl.h"
 #include "src/libsampler/sampler.h"
 #include "src/log.h"
 #include "src/messages.h"
 #include "src/objects/frame-array-inl.h"
+#include "src/objects/promise-inl.h"
 #include "src/profiler/cpu-profiler.h"
 #include "src/prototype.h"
 #include "src/regexp/regexp-stack.h"
@@ -64,6 +66,50 @@ namespace internal {
 
 base::Atomic32 ThreadId::highest_thread_id_ = 0;
 
+#ifdef V8_EMBEDDED_BUILTINS
+extern const uint8_t* DefaultEmbeddedBlob();
+extern uint32_t DefaultEmbeddedBlobSize();
+
+#ifdef V8_MULTI_SNAPSHOTS
+extern const uint8_t* TrustedEmbeddedBlob();
+extern uint32_t TrustedEmbeddedBlobSize();
+#endif
+
+namespace {
+// These variables provide access to the current embedded blob without requiring
+// an isolate instance. This is needed e.g. by Code::InstructionStart, which may
+// not have access to an isolate but still needs to access the embedded blob.
+// The variables are initialized by each isolate in Init(). Writes and reads are
+// relaxed since we can guarantee that the current thread has initialized these
+// variables before accessing them. Different threads may race, but this is fine
+// since they all attempt to set the same values of the blob pointer and size.
+
+std::atomic<const uint8_t*> current_embedded_blob_(nullptr);
+std::atomic<uint32_t> current_embedded_blob_size_(0);
+}  // namespace
+
+void Isolate::SetEmbeddedBlob(const uint8_t* blob, uint32_t blob_size) {
+  embedded_blob_ = blob;
+  embedded_blob_size_ = blob_size;
+  current_embedded_blob_.store(blob, std::memory_order_relaxed);
+  current_embedded_blob_size_.store(blob_size, std::memory_order_relaxed);
+}
+
+const uint8_t* Isolate::embedded_blob() const { return embedded_blob_; }
+uint32_t Isolate::embedded_blob_size() const { return embedded_blob_size_; }
+
+// static
+const uint8_t* Isolate::CurrentEmbeddedBlob() {
+  return current_embedded_blob_.load(std::memory_order::memory_order_relaxed);
+}
+
+// static
+uint32_t Isolate::CurrentEmbeddedBlobSize() {
+  return current_embedded_blob_size_.load(
+      std::memory_order::memory_order_relaxed);
+}
+#endif  // V8_EMBEDDED_BUILTINS
+
 int ThreadId::AllocateThreadId() {
   int new_id = base::Relaxed_AtomicIncrement(&highest_thread_id_, 1);
   return new_id;
@@ -110,8 +156,6 @@ void ThreadLocalTop::InitializeInternal() {
   rethrowing_message_ = false;
   pending_message_obj_ = nullptr;
   scheduled_exception_ = nullptr;
-  microtask_queue_bailout_index_ = -1;
-  microtask_queue_bailout_count_ = 0;
 }
 
 
@@ -221,16 +265,19 @@ void Isolate::IterateThread(ThreadVisitor* v, char* t) {
 
 void Isolate::Iterate(RootVisitor* v, ThreadLocalTop* thread) {
   // Visit the roots from the top for a given thread.
-  v->VisitRootPointer(Root::kTop, &thread->pending_exception_);
-  v->VisitRootPointer(Root::kTop, &thread->wasm_caught_exception_);
-  v->VisitRootPointer(Root::kTop, &thread->pending_message_obj_);
-  v->VisitRootPointer(Root::kTop, bit_cast<Object**>(&(thread->context_)));
-  v->VisitRootPointer(Root::kTop, &thread->scheduled_exception_);
+  v->VisitRootPointer(Root::kTop, nullptr, &thread->pending_exception_);
+  v->VisitRootPointer(Root::kTop, nullptr, &thread->wasm_caught_exception_);
+  v->VisitRootPointer(Root::kTop, nullptr, &thread->pending_message_obj_);
+  v->VisitRootPointer(Root::kTop, nullptr,
+                      bit_cast<Object**>(&(thread->context_)));
+  v->VisitRootPointer(Root::kTop, nullptr, &thread->scheduled_exception_);
 
   for (v8::TryCatch* block = thread->try_catch_handler(); block != nullptr;
        block = block->next_) {
-    v->VisitRootPointer(Root::kTop, bit_cast<Object**>(&(block->exception_)));
-    v->VisitRootPointer(Root::kTop, bit_cast<Object**>(&(block->message_obj_)));
+    v->VisitRootPointer(Root::kTop, nullptr,
+                        bit_cast<Object**>(&(block->exception_)));
+    v->VisitRootPointer(Root::kTop, nullptr,
+                        bit_cast<Object**>(&(block->message_obj_)));
   }
 
   // Iterate over pointers on native execution stack.
@@ -312,61 +359,44 @@ Handle<String> Isolate::StackTraceString() {
   }
 }
 
-void Isolate::PushStackTraceAndDie(unsigned int magic1, void* ptr1, void* ptr2,
-                                   unsigned int magic2) {
-  PushStackTraceAndDie(magic1, ptr1, ptr2, nullptr, nullptr, nullptr, nullptr,
-                       nullptr, nullptr, magic2);
+void Isolate::PushStackTraceAndDie(void* ptr1, void* ptr2, void* ptr3,
+                                   void* ptr4) {
+  StackTraceFailureMessage message(this, ptr1, ptr2, ptr3, ptr4);
+  message.Print();
+  base::OS::Abort();
 }
 
-void Isolate::PushStackTraceAndDie(unsigned int magic1, void* ptr1, void* ptr2,
-                                   void* ptr3, void* ptr4, void* ptr5,
-                                   void* ptr6, void* ptr7, void* ptr8,
-                                   unsigned int magic2) {
-  const int kMaxStackTraceSize = 32 * KB;
-  Handle<String> trace = StackTraceString();
-  uint8_t buffer[kMaxStackTraceSize];
-  int length = Min(kMaxStackTraceSize - 1, trace->length());
-  String::WriteToFlat(*trace, buffer, 0, length);
-  buffer[length] = '\0';
-  // TODO(dcarney): convert buffer to utf8?
-  base::OS::PrintError(
-      "Stacktrace:"
-      "\n   magic1=%x magic2=%x ptr1=%p ptr2=%p ptr3=%p ptr4=%p ptr5=%p "
-      "ptr6=%p ptr7=%p ptr8=%p\n\n%s",
-      magic1, magic2, ptr1, ptr2, ptr3, ptr4, ptr5, ptr6, ptr7, ptr8,
-      reinterpret_cast<char*>(buffer));
-  PushCodeObjectsAndDie(0xDEADC0DE, ptr1, ptr2, ptr3, ptr4, ptr5, ptr6, ptr7,
-                        ptr8, 0xDEADC0DE);
-}
-
-void Isolate::PushCodeObjectsAndDie(unsigned int magic1, void* ptr1, void* ptr2,
-                                    void* ptr3, void* ptr4, void* ptr5,
-                                    void* ptr6, void* ptr7, void* ptr8,
-                                    unsigned int magic2) {
-  const int kMaxCodeObjects = 16;
-  // Mark as volatile to lower the probability of optimizing code_objects
-  // away. The first and last entries are set to the magic markers, making it
-  // easier to spot the array on the stack.
-  void* volatile code_objects[kMaxCodeObjects + 2];
-  code_objects[0] = reinterpret_cast<void*>(magic1);
-  code_objects[kMaxCodeObjects + 1] = reinterpret_cast<void*>(magic2);
-  StackFrameIterator it(this);
-  int numCodeObjects = 0;
-  for (; !it.done() && numCodeObjects < kMaxCodeObjects; it.Advance()) {
-    code_objects[1 + numCodeObjects++] = it.frame()->unchecked_code();
-  }
-
-  // Keep the top raw code object pointers on the stack in the hope that the
-  // corresponding pages end up more frequently in the minidump.
+void StackTraceFailureMessage::Print() volatile {
+  // Print the details of this failure message object, including its own address
+  // to force stack allocation.
   base::OS::PrintError(
-      "\nCodeObjects (%p length=%i): 1:%p 2:%p 3:%p 4:%p..."
-      "\n   magic1=%x magic2=%x ptr1=%p ptr2=%p ptr3=%p ptr4=%p ptr5=%p "
-      "ptr6=%p ptr7=%p ptr8=%p\n\n",
-      static_cast<void*>(code_objects[0]), numCodeObjects,
-      static_cast<void*>(code_objects[1]), static_cast<void*>(code_objects[2]),
-      static_cast<void*>(code_objects[3]), static_cast<void*>(code_objects[4]),
-      magic1, magic2, ptr1, ptr2, ptr3, ptr4, ptr5, ptr6, ptr7, ptr8);
-  base::OS::Abort();
+      "Stacktrace:\n   ptr1=%p\n    ptr2=%p\n    ptr3=%p\n    ptr4=%p\n    "
+      "failure_message_object=%p\n%s",
+      ptr1_, ptr2_, ptr3_, ptr4_, this, &js_stack_trace_[0]);
+}
+
+StackTraceFailureMessage::StackTraceFailureMessage(Isolate* isolate, void* ptr1,
+                                                   void* ptr2, void* ptr3,
+                                                   void* ptr4) {
+  isolate_ = isolate;
+  ptr1_ = ptr1;
+  ptr2_ = ptr2;
+  ptr3_ = ptr3;
+  ptr4_ = ptr4;
+  // Write a stracktrace into the {js_stack_trace_} buffer.
+  const size_t buffer_length = arraysize(js_stack_trace_);
+  memset(&js_stack_trace_, 0, buffer_length);
+  FixedStringAllocator fixed(&js_stack_trace_[0], buffer_length - 1);
+  StringStream accumulator(&fixed, StringStream::kPrintObjectConcise);
+  isolate->PrintStack(&accumulator, Isolate::kPrintStackVerbose);
+  // Keeping a reference to the last code objects to increase likelyhood that
+  // they get included in the minidump.
+  const size_t code_objects_length = arraysize(code_objects_);
+  size_t i = 0;
+  StackFrameIterator it(isolate);
+  for (; !it.done() && i < code_objects_length; it.Advance()) {
+    code_objects_[i++] = it.frame()->unchecked_code();
+  }
 }
 
 namespace {
@@ -431,8 +461,7 @@ class FrameArrayBuilder {
         // Handle a WASM compiled frame.
         //====================================================================
         const auto& summary = summ.AsWasmCompiled();
-        if (!summary.code().IsCodeObject() &&
-            summary.code().GetWasmCode()->kind() != wasm::WasmCode::kFunction) {
+        if (summary.code()->kind() != wasm::WasmCode::kFunction) {
           continue;
         }
         Handle<WasmInstanceObject> instance = summary.wasm_instance();
@@ -717,16 +746,16 @@ class CaptureStackTraceHelper {
     int code_offset;
     Handle<ByteArray> source_position_table;
     Handle<Object> maybe_cache;
-    Handle<NumberDictionary> cache;
+    Handle<SimpleNumberDictionary> cache;
     if (!FLAG_optimize_for_size) {
       code_offset = summ.code_offset();
       source_position_table =
           handle(summ.abstract_code()->source_position_table(), isolate_);
       maybe_cache = handle(summ.abstract_code()->stack_frame_cache(), isolate_);
-      if (maybe_cache->IsNumberDictionary()) {
-        cache = Handle<NumberDictionary>::cast(maybe_cache);
+      if (maybe_cache->IsSimpleNumberDictionary()) {
+        cache = Handle<SimpleNumberDictionary>::cast(maybe_cache);
       } else {
-        cache = NumberDictionary::New(isolate_, 1);
+        cache = SimpleNumberDictionary::New(isolate_, 1);
       }
       int entry = cache->FindEntry(code_offset);
       if (entry != NumberDictionary::kNotFound) {
@@ -759,7 +788,7 @@ class CaptureStackTraceHelper {
     frame->set_is_constructor(summ.is_constructor());
     frame->set_is_wasm(false);
     if (!FLAG_optimize_for_size) {
-      auto new_cache = NumberDictionary::Set(cache, code_offset, frame);
+      auto new_cache = SimpleNumberDictionary::Set(cache, code_offset, frame);
       if (*new_cache != *cache || !maybe_cache->IsNumberDictionary()) {
         AbstractCode::SetStackFrameCache(summ.abstract_code(), new_cache);
       }
@@ -1278,10 +1307,11 @@ Object* Isolate::UnwindAndFindHandler() {
 
         // Gather information from the handler.
         Code* code = frame->LookupCode();
-        return FoundHandler(
-            nullptr, code->instruction_start(),
-            Smi::ToInt(code->handler_table()->get(0)), code->constant_pool(),
-            handler->address() + StackHandlerConstants::kSize, 0);
+        HandlerTable table(code);
+        return FoundHandler(nullptr, code->InstructionStart(),
+                            table.LookupReturn(0), code->constant_pool(),
+                            handler->address() + StackHandlerConstants::kSize,
+                            0);
       }
 
       case StackFrame::WASM_COMPILED: {
@@ -1307,17 +1337,10 @@ Object* Isolate::UnwindAndFindHandler() {
         trap_handler::SetThreadInWasm();
 
         set_wasm_caught_exception(exception);
-        if (FLAG_wasm_jit_to_native) {
-          wasm::WasmCode* wasm_code =
-              wasm_engine()->code_manager()->LookupCode(frame->pc());
-          return FoundHandler(nullptr, wasm_code->instructions().start(),
-                              offset, wasm_code->constant_pool(), return_sp,
-                              frame->fp());
-        } else {
-          Code* code = frame->LookupCode();
-          return FoundHandler(nullptr, code->instruction_start(), offset,
-                              code->constant_pool(), return_sp, frame->fp());
-        }
+        wasm::WasmCode* wasm_code =
+            wasm_engine()->code_manager()->LookupCode(frame->pc());
+        return FoundHandler(nullptr, wasm_code->instructions().start(), offset,
+                            wasm_code->constant_pool(), return_sp, frame->fp());
       }
 
       case StackFrame::OPTIMIZED: {
@@ -1348,7 +1371,7 @@ Object* Isolate::UnwindAndFindHandler() {
           set_deoptimizer_lazy_throw(true);
         }
 
-        return FoundHandler(nullptr, code->instruction_start(), offset,
+        return FoundHandler(nullptr, code->InstructionStart(), offset,
                             code->constant_pool(), return_sp, frame->fp());
       }
 
@@ -1358,7 +1381,7 @@ Object* Isolate::UnwindAndFindHandler() {
         StubFrame* stub_frame = static_cast<StubFrame*>(frame);
         Code* code = stub_frame->LookupCode();
         if (!code->IsCode() || code->kind() != Code::BUILTIN ||
-            !code->handler_table()->length() || !code->is_turbofanned()) {
+            !code->handler_table_offset() || !code->is_turbofanned()) {
           break;
         }
 
@@ -1372,7 +1395,7 @@ Object* Isolate::UnwindAndFindHandler() {
                             StandardFrameConstants::kFixedFrameSizeAboveFp -
                             stack_slots * kPointerSize;
 
-        return FoundHandler(nullptr, code->instruction_start(), offset,
+        return FoundHandler(nullptr, code->InstructionStart(), offset,
                             code->constant_pool(), return_sp, frame->fp());
       }
 
@@ -1405,7 +1428,7 @@ Object* Isolate::UnwindAndFindHandler() {
 
         Code* code =
             builtins()->builtin(Builtins::kInterpreterEnterBytecodeDispatch);
-        return FoundHandler(context, code->instruction_start(), 0,
+        return FoundHandler(context, code->InstructionStart(), 0,
                             code->constant_pool(), return_sp, frame->fp());
       }
 
@@ -1425,7 +1448,7 @@ Object* Isolate::UnwindAndFindHandler() {
         WasmInterpreterEntryFrame* interpreter_frame =
             WasmInterpreterEntryFrame::cast(frame);
         // TODO(wasm): Implement try-catch in the interpreter.
-        interpreter_frame->wasm_instance()->debug_info()->Unwind(frame->fp());
+        interpreter_frame->debug_info()->Unwind(frame->fp());
       } break;
 
       default:
@@ -1468,9 +1491,8 @@ HandlerTable::CatchPrediction PredictException(JavaScriptFrame* frame) {
         // Must have been constructed from a bytecode array.
         CHECK_EQ(AbstractCode::INTERPRETED_FUNCTION, code->kind());
         int code_offset = summary.code_offset();
-        BytecodeArray* bytecode = code->GetBytecodeArray();
-        HandlerTable* table = HandlerTable::cast(bytecode->handler_table());
-        int index = table->LookupRange(code_offset, nullptr, &prediction);
+        HandlerTable table(code->GetBytecodeArray());
+        int index = table.LookupRange(code_offset, nullptr, &prediction);
         if (index <= 0) continue;
         if (prediction == HandlerTable::UNCAUGHT) continue;
         return prediction;
@@ -1534,7 +1556,7 @@ Isolate::CatchType Isolate::PredictExceptionCatcher() {
       case StackFrame::STUB: {
         Handle<Code> code(frame->LookupCode());
         if (!code->IsCode() || code->kind() != Code::BUILTIN ||
-            !code->handler_table()->length() || !code->is_turbofanned()) {
+            !code->handler_table_offset() || !code->is_turbofanned()) {
           break;
         }
 
@@ -1699,11 +1721,9 @@ bool Isolate::ComputeLocationFromStackTrace(MessageLocation* target,
       // TODO(titzer): store a reference to the code object in FrameArray;
       // a second lookup here could lead to inconsistency.
       int byte_offset =
-          FLAG_wasm_jit_to_native
-              ? FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
-                    compiled_module->GetNativeModule()->GetCode(func_index),
-                    code_offset)
-              : elements->Code(i)->SourcePosition(code_offset);
+          FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
+              compiled_module->GetNativeModule()->GetCode(func_index),
+              code_offset);
 
       bool is_at_number_conversion =
           elements->IsAsmJsWasmFrame(i) &&
@@ -2013,6 +2033,7 @@ void Isolate::PopPromise() {
 }
 
 namespace {
+
 bool InternalPromiseHasUserDefinedRejectHandler(Isolate* isolate,
                                                 Handle<JSPromise> promise);
 
@@ -2058,39 +2079,28 @@ bool InternalPromiseHasUserDefinedRejectHandler(Isolate* isolate,
     return true;
   }
 
-  Handle<Object> queue(promise->reject_reactions(), isolate);
-  Handle<Object> deferred_promise(promise->deferred_promise(), isolate);
-
-  if (queue->IsUndefined(isolate)) {
-    return false;
-  }
-
-  if (queue->IsCallable()) {
-    return PromiseHandlerCheck(isolate, Handle<JSReceiver>::cast(queue),
-                               Handle<JSReceiver>::cast(deferred_promise));
-  }
-
-  if (queue->IsSymbol()) {
-    return InternalPromiseHasUserDefinedRejectHandler(
-        isolate, Handle<JSPromise>::cast(deferred_promise));
-  }
-
-  Handle<FixedArray> queue_arr = Handle<FixedArray>::cast(queue);
-  Handle<FixedArray> deferred_promise_arr =
-      Handle<FixedArray>::cast(deferred_promise);
-  for (int i = 0; i < deferred_promise_arr->length(); i++) {
-    Handle<JSReceiver> deferred_promise_item(
-        JSReceiver::cast(deferred_promise_arr->get(i)));
-    if (queue_arr->get(i)->IsSymbol()) {
-      if (InternalPromiseHasUserDefinedRejectHandler(
-              isolate, Handle<JSPromise>::cast(deferred_promise_item))) {
-        return true;
-      }
-    } else {
-      Handle<JSReceiver> queue_item(JSReceiver::cast(queue_arr->get(i)));
-      if (PromiseHandlerCheck(isolate, queue_item, deferred_promise_item)) {
-        return true;
+  if (promise->status() == Promise::kPending) {
+    Handle<Object> current(promise->reactions(), isolate);
+    while (!current->IsSmi()) {
+      Handle<PromiseReaction> current_reaction =
+          Handle<PromiseReaction>::cast(current);
+      Handle<HeapObject> payload(current_reaction->payload(), isolate);
+      Handle<JSPromise> current_promise;
+      if (JSPromise::From(payload).ToHandle(&current_promise)) {
+        if (current_reaction->reject_handler()->IsCallable()) {
+          Handle<JSReceiver> current_handler(
+              JSReceiver::cast(current_reaction->reject_handler()), isolate);
+          if (PromiseHandlerCheck(isolate, current_handler, current_promise)) {
+            return true;
+          }
+        } else {
+          if (InternalPromiseHasUserDefinedRejectHandler(isolate,
+                                                         current_promise)) {
+            return true;
+          }
+        }
       }
+      current = handle(current_reaction->next(), isolate);
     }
   }
 
@@ -2124,7 +2134,7 @@ Handle<Object> Isolate::GetPromiseOnStackOnThrow() {
     } else if (frame->type() == StackFrame::STUB) {
       Code* code = frame->LookupCode();
       if (!code->IsCode() || code->kind() != Code::BUILTIN ||
-          !code->handler_table()->length() || !code->is_turbofanned()) {
+          !code->handler_table_offset() || !code->is_turbofanned()) {
         continue;
       }
       catch_prediction = code->GetBuiltinCatchPrediction();
@@ -2607,8 +2617,6 @@ void Isolate::GlobalTearDown() {
 
 
 void Isolate::ClearSerializerData() {
-  delete external_reference_table_;
-  external_reference_table_ = nullptr;
   delete external_reference_map_;
   external_reference_map_ = nullptr;
 }
@@ -2625,7 +2633,7 @@ void Isolate::Deinit() {
     optimizing_compile_dispatcher_ = nullptr;
   }
 
-  wasm_engine()->compilation_manager()->TearDown();
+  wasm_engine()->TearDown();
 
   heap_.mark_compact_collector()->EnsureSweepingCompleted();
   heap_.memory_allocator()->unmapper()->WaitUntilCompleted();
@@ -2645,6 +2653,10 @@ void Isolate::Deinit() {
   if (sampler && sampler->IsActive()) sampler->Stop();
 
   FreeThreadResources();
+
+  // We start with the heap tear down so that releasing managed objects does
+  // not cause a GC.
+  heap_.StartTearDown();
   // Release managed objects before shutting down the heap. The finalizer might
   // need to access heap objects.
   ReleaseManagedObjects();
@@ -2665,7 +2677,7 @@ void Isolate::Deinit() {
   delete heap_profiler_;
   heap_profiler_ = nullptr;
 
-  compiler_dispatcher_->AbortAll(CompilerDispatcher::BlockingBehavior::kBlock);
+  compiler_dispatcher_->AbortAll(BlockingBehavior::kBlock);
   delete compiler_dispatcher_;
   compiler_dispatcher_ = nullptr;
 
@@ -2674,6 +2686,14 @@ void Isolate::Deinit() {
   heap_.TearDown();
   logger_->TearDown();
 
+#ifdef V8_EMBEDDED_BUILTINS
+  if (DefaultEmbeddedBlob() == nullptr && embedded_blob() != nullptr) {
+    // We own the embedded blob. Free it.
+    uint8_t* data = const_cast<uint8_t*>(embedded_blob_);
+    InstructionStream::FreeOffHeapInstructionStream(data, embedded_blob_size_);
+  }
+#endif
+
   delete interpreter_;
   interpreter_ = nullptr;
 
@@ -2774,11 +2794,6 @@ Isolate::~Isolate() {
 
   delete allocator_;
   allocator_ = nullptr;
-
-#if USE_SIMULATOR
-  Simulator::TearDown(simulator_i_cache_);
-  simulator_i_cache_ = nullptr;
-#endif
 }
 
 
@@ -2787,6 +2802,12 @@ void Isolate::InitializeThreadLocal() {
   thread_local_top_.Initialize();
 }
 
+void Isolate::SetTerminationOnExternalTryCatch() {
+  if (try_catch_handler() == nullptr) return;
+  try_catch_handler()->can_continue_ = false;
+  try_catch_handler()->has_terminated_ = true;
+  try_catch_handler()->exception_ = heap()->null_value();
+}
 
 bool Isolate::PropagatePendingExceptionToExternalTryCatch() {
   Object* exception = pending_exception();
@@ -2803,9 +2824,7 @@ bool Isolate::PropagatePendingExceptionToExternalTryCatch() {
 
   thread_local_top_.external_caught_exception_ = true;
   if (!is_catchable_by_javascript(exception)) {
-    try_catch_handler()->can_continue_ = false;
-    try_catch_handler()->has_terminated_ = true;
-    try_catch_handler()->exception_ = heap()->null_value();
+    SetTerminationOnExternalTryCatch();
   } else {
     v8::TryCatch* handler = try_catch_handler();
     DCHECK(thread_local_top_.pending_message_obj_->IsJSMessageObject() ||
@@ -2841,15 +2860,72 @@ void PrintBuiltinSizes(Isolate* isolate) {
     const char* name = builtins->name(i);
     const char* kind = Builtins::KindNameOf(i);
     Code* code = builtins->builtin(i);
-    PrintF(stdout, "%s Builtin, %s, %d\n", kind, name,
-           code->instruction_size());
+    PrintF(stdout, "%s Builtin, %s, %d\n", kind, name, code->InstructionSize());
+  }
+}
+
+#ifdef V8_EMBEDDED_BUILTINS
+void CreateOffHeapTrampolines(Isolate* isolate) {
+  DCHECK(isolate->serializer_enabled());
+  DCHECK_NOT_NULL(isolate->embedded_blob());
+  DCHECK_NE(0, isolate->embedded_blob_size());
+
+  HandleScope scope(isolate);
+  Builtins* builtins = isolate->builtins();
+
+  EmbeddedData d = EmbeddedData::FromBlob();
+
+  CodeSpaceMemoryModificationScope code_allocation(isolate->heap());
+  for (int i = 0; i < Builtins::builtin_count; i++) {
+    if (!Builtins::IsOffHeapSafe(i)) continue;
+
+    const uint8_t* instruction_start = d.InstructionStartOfBuiltin(i);
+    Handle<Code> trampoline = isolate->factory()->NewOffHeapTrampolineFor(
+        builtins->builtin_handle(i), const_cast<Address>(instruction_start));
+
+    // Note that references to the old, on-heap code objects may still exist on
+    // the heap. This is fine for the sake of serialization, as serialization
+    // will replace all of them with a builtin reference which is later
+    // deserialized to point to the object within the builtins table.
+    //
+    // From this point onwards, some builtin code objects may be unreachable and
+    // thus collected by the GC.
+    builtins->set_builtin(i, *trampoline);
+
+    if (isolate->logger()->is_logging_code_events() ||
+        isolate->is_profiling()) {
+      isolate->logger()->LogCodeObject(*trampoline);
+    }
   }
 }
+#endif  // V8_EMBEDDED_BUILTINS
 }  // namespace
 
+#ifdef V8_EMBEDDED_BUILTINS
+void Isolate::PrepareEmbeddedBlobForSerialization() {
+  // When preparing the embedded blob, ensure it doesn't exist yet.
+  DCHECK_NULL(embedded_blob());
+  DCHECK_NULL(DefaultEmbeddedBlob());
+  DCHECK(serializer_enabled());
+
+  // The isolate takes ownership of this pointer into an executable mmap'd
+  // area. We muck around with const-casts because the standard use-case in
+  // shipping builds is for embedded_blob_ to point into a read-only
+  // .text-embedded section.
+  uint8_t* data;
+  uint32_t size;
+  InstructionStream::CreateOffHeapInstructionStream(this, &data, &size);
+  SetEmbeddedBlob(const_cast<const uint8_t*>(data), size);
+  CreateOffHeapTrampolines(this);
+}
+#endif  // V8_EMBEDDED_BUILTINS
+
 bool Isolate::Init(StartupDeserializer* des) {
   TRACE_ISOLATE(init);
 
+  base::ElapsedTimer timer;
+  if (des == nullptr && FLAG_profile_deserialization) timer.Start();
+
   time_millis_at_init_ = heap_.MonotonicallyIncreasingTimeInMs();
 
   stress_deopt_count_ = FLAG_deopt_every_n_times;
@@ -2900,6 +2976,18 @@ bool Isolate::Init(StartupDeserializer* des) {
   compiler_dispatcher_ =
       new CompilerDispatcher(this, V8::GetCurrentPlatform(), FLAG_stack_size);
 
+#ifdef V8_EMBEDDED_BUILTINS
+#ifdef V8_MULTI_SNAPSHOTS
+  if (FLAG_untrusted_code_mitigations) {
+    SetEmbeddedBlob(DefaultEmbeddedBlob(), DefaultEmbeddedBlobSize());
+  } else {
+    SetEmbeddedBlob(TrustedEmbeddedBlob(), TrustedEmbeddedBlobSize());
+  }
+#else
+  SetEmbeddedBlob(DefaultEmbeddedBlob(), DefaultEmbeddedBlobSize());
+#endif
+#endif
+
   // Enable logging before setting up the heap
   logger_->SetUp(this);
 
@@ -2919,7 +3007,7 @@ bool Isolate::Init(StartupDeserializer* des) {
   // SetUp the object heap.
   DCHECK(!heap_.HasBeenSetUp());
   if (!heap_.SetUp()) {
-    V8::FatalProcessOutOfMemory("heap setup");
+    V8::FatalProcessOutOfMemory(this, "heap setup");
     return false;
   }
 
@@ -2947,13 +3035,19 @@ bool Isolate::Init(StartupDeserializer* des) {
   }
 
   if (!setup_delegate_->SetupHeap(&heap_)) {
-    V8::FatalProcessOutOfMemory("heap object creation");
+    V8::FatalProcessOutOfMemory(this, "heap object creation");
     return false;
   }
 
   if (create_heap_objects) {
     // Terminate the partial snapshot cache so we can iterate.
     partial_snapshot_cache_.push_back(heap_.undefined_value());
+#ifdef V8_EMBEDDED_BUILTINS
+    if (serializer_enabled()) {
+      builtins_constants_table_builder_ =
+          new BuiltinsConstantsTableBuilder(this);
+    }
+#endif
   }
 
   InitializeThreadLocal();
@@ -2986,6 +3080,14 @@ bool Isolate::Init(StartupDeserializer* des) {
     store_stub_cache_->Initialize();
     setup_delegate_->SetupInterpreter(interpreter_);
 
+#ifdef V8_EMBEDDED_BUILTINS
+    if (create_heap_objects && serializer_enabled()) {
+      builtins_constants_table_builder_->Finalize();
+      delete builtins_constants_table_builder_;
+      builtins_constants_table_builder_ = nullptr;
+    }
+#endif  // V8_EMBEDDED_BUILTINS
+
     heap_.NotifyDeserializationComplete();
   }
   delete setup_delegate_;
@@ -3021,6 +3123,10 @@ bool Isolate::Init(StartupDeserializer* des) {
   CHECK_EQ(static_cast<int>(
                OFFSET_OF(Isolate, heap_.external_memory_at_last_mark_compact_)),
            Internals::kExternalMemoryAtLastMarkCompactOffset);
+  CHECK_EQ(
+      static_cast<int>(OFFSET_OF(Isolate, heap_.external_reference_table_)),
+      Internals::kIsolateRootsOffset +
+          Heap::kRootsExternalReferenceTableOffset);
 
   {
     HandleScope scope(this);
@@ -3047,6 +3153,11 @@ bool Isolate::Init(StartupDeserializer* des) {
                                                sampling_flags);
   }
 
+  if (des == nullptr && FLAG_profile_deserialization) {
+    double ms = timer.Elapsed().InMillisecondsF();
+    PrintF("[Initializing isolate from scratch took %0.3f ms]\n", ms);
+  }
+
   return true;
 }
 
@@ -3162,6 +3273,12 @@ void Isolate::DumpAndResetStats() {
   }
 }
 
+void Isolate::AbortConcurrentOptimization(BlockingBehavior behavior) {
+  if (concurrent_recompilation_enabled()) {
+    DisallowHeapAllocation no_recursive_gc;
+    optimizing_compile_dispatcher()->Flush(behavior);
+  }
+}
 
 CompilationStatistics* Isolate::GetTurboStatistics() {
   if (turbo_statistics() == nullptr)
@@ -3176,8 +3293,7 @@ CodeTracer* Isolate::GetCodeTracer() {
 }
 
 bool Isolate::use_optimizer() {
-  return FLAG_opt && !serializer_enabled_ &&
-         CpuFeatures::SupportsCrankshaft() &&
+  return FLAG_opt && !serializer_enabled_ && CpuFeatures::SupportsOptimizer() &&
          !is_precise_count_code_coverage() && !is_block_count_code_coverage();
 }
 
@@ -3368,6 +3484,39 @@ bool Isolate::IsIsConcatSpreadableLookupChainIntact(JSReceiver* receiver) {
   return !receiver->HasProxyInPrototype(this);
 }
 
+bool Isolate::IsPromiseHookProtectorIntact() {
+  PropertyCell* promise_hook_cell = heap()->promise_hook_protector();
+  bool is_promise_hook_protector_intact =
+      Smi::ToInt(promise_hook_cell->value()) == kProtectorValid;
+  DCHECK_IMPLIES(is_promise_hook_protector_intact,
+                 !promise_hook_or_debug_is_active_);
+  return is_promise_hook_protector_intact;
+}
+
+bool Isolate::IsPromiseResolveLookupChainIntact() {
+  Cell* promise_resolve_cell = heap()->promise_resolve_protector();
+  bool is_promise_resolve_protector_intact =
+      Smi::ToInt(promise_resolve_cell->value()) == kProtectorValid;
+  return is_promise_resolve_protector_intact;
+}
+
+bool Isolate::IsPromiseThenLookupChainIntact() {
+  PropertyCell* promise_then_cell = heap()->promise_then_protector();
+  bool is_promise_then_protector_intact =
+      Smi::ToInt(promise_then_cell->value()) == kProtectorValid;
+  return is_promise_then_protector_intact;
+}
+
+bool Isolate::IsPromiseThenLookupChainIntact(Handle<JSReceiver> receiver) {
+  DisallowHeapAllocation no_gc;
+  if (!receiver->IsJSPromise()) return false;
+  if (!IsInAnyContext(receiver->map()->prototype(),
+                      Context::PROMISE_PROTOTYPE_INDEX)) {
+    return false;
+  }
+  return IsPromiseThenLookupChainIntact();
+}
+
 void Isolate::UpdateNoElementsProtectorOnSetElement(Handle<JSObject> object) {
   DisallowHeapAllocation no_gc;
   if (!object->map()->is_prototype_map()) return;
@@ -3394,11 +3543,11 @@ void Isolate::InvalidateArrayConstructorProtector() {
   DCHECK(!IsArrayConstructorIntact());
 }
 
-void Isolate::InvalidateArraySpeciesProtector() {
+void Isolate::InvalidateSpeciesProtector() {
   DCHECK(factory()->species_protector()->value()->IsSmi());
-  DCHECK(IsArraySpeciesLookupChainIntact());
+  DCHECK(IsSpeciesLookupChainIntact());
   factory()->species_protector()->set_value(Smi::FromInt(kProtectorInvalid));
-  DCHECK(!IsArraySpeciesLookupChainIntact());
+  DCHECK(!IsSpeciesLookupChainIntact());
 }
 
 void Isolate::InvalidateStringLengthOverflowProtector() {
@@ -3427,6 +3576,32 @@ void Isolate::InvalidateArrayBufferNeuteringProtector() {
   DCHECK(!IsArrayBufferNeuteringIntact());
 }
 
+void Isolate::InvalidatePromiseHookProtector() {
+  DCHECK(factory()->promise_hook_protector()->value()->IsSmi());
+  DCHECK(IsPromiseHookProtectorIntact());
+  PropertyCell::SetValueWithInvalidation(
+      factory()->promise_hook_protector(),
+      handle(Smi::FromInt(kProtectorInvalid), this));
+  DCHECK(!IsPromiseHookProtectorIntact());
+}
+
+void Isolate::InvalidatePromiseResolveProtector() {
+  DCHECK(factory()->promise_resolve_protector()->value()->IsSmi());
+  DCHECK(IsPromiseResolveLookupChainIntact());
+  factory()->promise_resolve_protector()->set_value(
+      Smi::FromInt(kProtectorInvalid));
+  DCHECK(!IsPromiseResolveLookupChainIntact());
+}
+
+void Isolate::InvalidatePromiseThenProtector() {
+  DCHECK(factory()->promise_then_protector()->value()->IsSmi());
+  DCHECK(IsPromiseThenLookupChainIntact());
+  PropertyCell::SetValueWithInvalidation(
+      factory()->promise_then_protector(),
+      handle(Smi::FromInt(kProtectorInvalid), this));
+  DCHECK(!IsPromiseThenLookupChainIntact());
+}
+
 bool Isolate::IsAnyInitialArrayPrototype(Handle<JSArray> array) {
   DisallowHeapAllocation no_gc;
   return IsInAnyContext(*array, Context::INITIAL_ARRAY_PROTOTYPE_INDEX);
@@ -3582,13 +3757,18 @@ void Isolate::FireCallCompletedCallback() {
   // Fire callbacks.  Increase call depth to prevent recursive callbacks.
   v8::Isolate* isolate = reinterpret_cast<v8::Isolate*>(this);
   v8::Isolate::SuppressMicrotaskExecutionScope suppress(isolate);
-  for (auto& callback : call_completed_callbacks_) {
+  std::vector<CallCompletedCallback> callbacks(call_completed_callbacks_);
+  for (auto& callback : callbacks) {
     callback(reinterpret_cast<v8::Isolate*>(this));
   }
 }
 
 void Isolate::DebugStateUpdated() {
-  promise_hook_or_debug_is_active_ = promise_hook_ || debug()->is_active();
+  bool promise_hook_or_debug_is_active = promise_hook_ || debug()->is_active();
+  if (promise_hook_or_debug_is_active && IsPromiseHookProtectorIntact()) {
+    InvalidatePromiseHookProtector();
+  }
+  promise_hook_or_debug_is_active_ = promise_hook_or_debug_is_active;
 }
 
 namespace {
@@ -3698,83 +3878,16 @@ void Isolate::ReportPromiseReject(Handle<JSPromise> promise,
       v8::Utils::StackTraceToLocal(stack_trace)));
 }
 
-void Isolate::PromiseReactionJob(Handle<PromiseReactionJobInfo> info,
-                                 MaybeHandle<Object>* result,
-                                 MaybeHandle<Object>* maybe_exception) {
-  Handle<Object> value(info->value(), this);
-  Handle<Object> tasks(info->tasks(), this);
-  Handle<JSFunction> promise_handle_fn = promise_handle();
-  Handle<Object> undefined = factory()->undefined_value();
-  Handle<Object> deferred_promise(info->deferred_promise(), this);
-
-  if (deferred_promise->IsFixedArray()) {
-    DCHECK(tasks->IsFixedArray());
-    Handle<FixedArray> deferred_promise_arr =
-        Handle<FixedArray>::cast(deferred_promise);
-    Handle<FixedArray> deferred_on_resolve_arr(
-        FixedArray::cast(info->deferred_on_resolve()), this);
-    Handle<FixedArray> deferred_on_reject_arr(
-        FixedArray::cast(info->deferred_on_reject()), this);
-    Handle<FixedArray> tasks_arr = Handle<FixedArray>::cast(tasks);
-    for (int i = 0; i < deferred_promise_arr->length(); i++) {
-      Handle<Object> argv[] = {value, handle(tasks_arr->get(i), this),
-                               handle(deferred_promise_arr->get(i), this),
-                               handle(deferred_on_resolve_arr->get(i), this),
-                               handle(deferred_on_reject_arr->get(i), this)};
-      *result = Execution::TryCall(
-          this, promise_handle_fn, undefined, arraysize(argv), argv,
-          Execution::MessageHandling::kReport, maybe_exception);
-      // If execution is terminating, just bail out.
-      if (result->is_null() && maybe_exception->is_null()) {
-        return;
-      }
-    }
-  } else {
-    Handle<Object> argv[] = {value, tasks, deferred_promise,
-                             handle(info->deferred_on_resolve(), this),
-                             handle(info->deferred_on_reject(), this)};
-    *result = Execution::TryCall(
-        this, promise_handle_fn, undefined, arraysize(argv), argv,
-        Execution::MessageHandling::kReport, maybe_exception);
-  }
-}
-
-void Isolate::PromiseResolveThenableJob(
-    Handle<PromiseResolveThenableJobInfo> info, MaybeHandle<Object>* result,
-    MaybeHandle<Object>* maybe_exception) {
-  Handle<JSReceiver> thenable(info->thenable(), this);
-  Handle<JSFunction> resolve(info->resolve(), this);
-  Handle<JSFunction> reject(info->reject(), this);
-  Handle<JSReceiver> then(info->then(), this);
-  Handle<Object> argv[] = {resolve, reject};
-  *result =
-      Execution::TryCall(this, then, thenable, arraysize(argv), argv,
-                         Execution::MessageHandling::kReport, maybe_exception);
-
-  Handle<Object> reason;
-  if (maybe_exception->ToHandle(&reason)) {
-    DCHECK(result->is_null());
-    Handle<Object> reason_arg[] = {reason};
-    *result = Execution::TryCall(
-        this, reject, factory()->undefined_value(), arraysize(reason_arg),
-        reason_arg, Execution::MessageHandling::kReport, maybe_exception);
-  }
-}
-
-void Isolate::EnqueueMicrotask(Handle<Object> microtask) {
-  DCHECK(microtask->IsJSFunction() || microtask->IsCallHandlerInfo() ||
-         microtask->IsPromiseResolveThenableJobInfo() ||
-         microtask->IsPromiseReactionJobInfo());
+void Isolate::EnqueueMicrotask(Handle<Microtask> microtask) {
   Handle<FixedArray> queue(heap()->microtask_queue(), this);
   int num_tasks = pending_microtask_count();
-  DCHECK(num_tasks <= queue->length());
-  if (num_tasks == 0) {
-    queue = factory()->NewFixedArray(8);
-    heap()->set_microtask_queue(*queue);
-  } else if (num_tasks == queue->length()) {
-    queue = factory()->CopyFixedArrayAndGrow(queue, num_tasks);
+  DCHECK_LE(num_tasks, queue->length());
+  if (num_tasks == queue->length()) {
+    queue = factory()->CopyFixedArrayAndGrow(queue, std::max(num_tasks, 8));
     heap()->set_microtask_queue(*queue);
   }
+  DCHECK_LE(8, queue->length());
+  DCHECK_LT(num_tasks, queue->length());
   DCHECK(queue->get(num_tasks)->IsUndefined(this));
   queue->set(num_tasks, *microtask);
   set_pending_microtask_count(num_tasks + 1);
@@ -3785,100 +3898,28 @@ void Isolate::RunMicrotasks() {
   // Increase call depth to prevent recursive callbacks.
   v8::Isolate::SuppressMicrotaskExecutionScope suppress(
       reinterpret_cast<v8::Isolate*>(this));
-  is_running_microtasks_ = true;
-  RunMicrotasksInternal();
-  is_running_microtasks_ = false;
-  FireMicrotasksCompletedCallback();
-}
-
+  if (pending_microtask_count()) {
+    is_running_microtasks_ = true;
+    TRACE_EVENT0("v8.execute", "RunMicrotasks");
+    TRACE_EVENT_CALL_STATS_SCOPED(this, "v8", "V8.RunMicrotasks");
 
-void Isolate::RunMicrotasksInternal() {
-  if (!pending_microtask_count()) return;
-  TRACE_EVENT0("v8.execute", "RunMicrotasks");
-  TRACE_EVENT_CALL_STATS_SCOPED(this, "v8", "V8.RunMicrotasks");
-
-  do {
-    HandleScope handle_scope(this);
-    set_microtask_queue_bailout_index(-1);
-    set_microtask_queue_bailout_count(-1);
+    HandleScope scope(this);
     MaybeHandle<Object> maybe_exception;
     MaybeHandle<Object> maybe_result = Execution::RunMicrotasks(
         this, Execution::MessageHandling::kReport, &maybe_exception);
+    // If execution is terminating, bail out, clean up, and propagate to
+    // TryCatch scope.
     if (maybe_result.is_null() && maybe_exception.is_null()) {
       heap()->set_microtask_queue(heap()->empty_fixed_array());
       set_pending_microtask_count(0);
-      return;
+      handle_scope_implementer()->LeaveMicrotaskContext();
+      SetTerminationOnExternalTryCatch();
     }
-
-    Handle<Object> result = maybe_result.ToHandleChecked();
-    if (result->IsUndefined(this)) return;
-
-    Handle<FixedArray> queue = Handle<FixedArray>::cast(result);
-    int num_tasks = microtask_queue_bailout_count();
-    DCHECK_GE(microtask_queue_bailout_index(), 0);
-
-    Isolate* isolate = this;
-    FOR_WITH_HANDLE_SCOPE(
-        isolate, int, i = microtask_queue_bailout_index(), i, i < num_tasks,
-        i++, {
-          Handle<Object> microtask(queue->get(i), this);
-
-          if (microtask->IsCallHandlerInfo()) {
-            Handle<CallHandlerInfo> callback_info =
-                Handle<CallHandlerInfo>::cast(microtask);
-            v8::MicrotaskCallback callback =
-                v8::ToCData<v8::MicrotaskCallback>(callback_info->callback());
-            void* data = v8::ToCData<void*>(callback_info->data());
-            callback(data);
-          } else {
-            SaveContext save(this);
-            Context* context;
-            if (microtask->IsJSFunction()) {
-              context = Handle<JSFunction>::cast(microtask)->context();
-            } else if (microtask->IsPromiseResolveThenableJobInfo()) {
-              context = Handle<PromiseResolveThenableJobInfo>::cast(microtask)
-                            ->context();
-            } else {
-              context =
-                  Handle<PromiseReactionJobInfo>::cast(microtask)->context();
-            }
-
-            set_context(context->native_context());
-            handle_scope_implementer_->EnterMicrotaskContext(
-                Handle<Context>(context, this));
-
-            MaybeHandle<Object> result;
-            MaybeHandle<Object> maybe_exception;
-
-            if (microtask->IsJSFunction()) {
-              Handle<JSFunction> microtask_function =
-                  Handle<JSFunction>::cast(microtask);
-              result = Execution::TryCall(
-                  this, microtask_function, factory()->undefined_value(), 0,
-                  nullptr, Execution::MessageHandling::kReport,
-                  &maybe_exception);
-            } else if (microtask->IsPromiseResolveThenableJobInfo()) {
-              PromiseResolveThenableJob(
-                  Handle<PromiseResolveThenableJobInfo>::cast(microtask),
-                  &result, &maybe_exception);
-            } else {
-              PromiseReactionJob(
-                  Handle<PromiseReactionJobInfo>::cast(microtask), &result,
-                  &maybe_exception);
-            }
-
-            handle_scope_implementer_->LeaveMicrotaskContext();
-
-            // If execution is terminating, just bail out.
-            if (result.is_null() && maybe_exception.is_null()) {
-              // Clear out any remaining callbacks in the queue.
-              heap()->set_microtask_queue(heap()->empty_fixed_array());
-              set_pending_microtask_count(0);
-              return;
-            }
-          }
-        });
-  } while (pending_microtask_count() > 0);
+    CHECK_EQ(0, pending_microtask_count());
+    CHECK_EQ(0, heap()->microtask_queue()->length());
+    is_running_microtasks_ = false;
+  }
+  FireMicrotasksCompletedCallback();
 }
 
 void Isolate::SetUseCounterCallback(v8::Isolate::UseCounterCallback callback) {
@@ -4009,6 +4050,18 @@ void Isolate::PrintWithTimestamp(const char* format, ...) {
   va_end(arguments);
 }
 
+void Isolate::SetIdle(bool is_idle) {
+  if (!is_profiling()) return;
+  StateTag state = current_vm_state();
+  DCHECK(state == EXTERNAL || state == IDLE);
+  if (js_entry_sp() != nullptr) return;
+  if (is_idle) {
+    set_current_vm_state(IDLE);
+  } else if (state == IDLE) {
+    set_current_vm_state(EXTERNAL);
+  }
+}
+
 bool StackLimitCheck::JsHasOverflowed(uintptr_t gap) const {
   StackGuard* stack_guard = isolate_->stack_guard();
 #ifdef USE_SIMULATOR
diff --git a/deps/v8/src/isolate.h b/deps/v8/src/isolate.h
index 8eca55ffd6e..b8ccf71b994 100644
--- a/deps/v8/src/isolate.h
+++ b/deps/v8/src/isolate.h
@@ -10,23 +10,24 @@
 #include <queue>
 #include <vector>
 
-#include "include/v8-debug.h"
+#include "include/v8-inspector.h"
+#include "include/v8.h"
 #include "src/allocation.h"
 #include "src/base/atomicops.h"
+#include "src/base/macros.h"
 #include "src/builtins/builtins.h"
 #include "src/contexts.h"
 #include "src/date.h"
 #include "src/debug/debug-interface.h"
 #include "src/execution.h"
 #include "src/futex-emulation.h"
-#include "src/global-handles.h"
+#include "src/globals.h"
 #include "src/handles.h"
 #include "src/heap/heap.h"
 #include "src/messages.h"
 #include "src/objects/code.h"
-#include "src/regexp/regexp-stack.h"
 #include "src/runtime/runtime.h"
-#include "src/zone/zone.h"
+#include "src/unicode.h"
 
 namespace v8 {
 
@@ -49,6 +50,7 @@ class AddressToIndexHashMap;
 class AstStringConstants;
 class BasicBlockProfiler;
 class Bootstrapper;
+class BuiltinsConstantsTableBuilder;
 class CallInterfaceDescriptorData;
 class CancelableTaskManager;
 class CodeEventDispatcher;
@@ -67,16 +69,18 @@ class Debug;
 class DeoptimizerData;
 class DescriptorLookupCache;
 class EmptyStatement;
+class EternalHandles;
 class ExternalCallbackScope;
-class ExternalReferenceTable;
 class Factory;
 class HandleScopeImplementer;
 class HeapObjectToIndexHashMap;
 class HeapProfiler;
 class InlineRuntimeFunctionsTable;
 class InnerPointerToCodeCache;
+class InstructionStream;
 class Logger;
 class MaterializedObjectStore;
+class Microtask;
 class OptimizingCompileDispatcher;
 class PromiseOnStack;
 class Redirection;
@@ -372,9 +376,6 @@ class ThreadLocalTop BASE_EMBEDDED {
   // Call back function to report unsafe JS accesses.
   v8::FailedAccessCheckCallback failed_access_check_callback_;
 
-  int microtask_queue_bailout_index_;
-  int microtask_queue_bailout_count_;
-
  private:
   void InitializeInternal();
 
@@ -382,17 +383,6 @@ class ThreadLocalTop BASE_EMBEDDED {
 };
 
 
-#if USE_SIMULATOR
-
-#define ISOLATE_INIT_SIMULATOR_LIST(V)  \
-  V(base::CustomMatcherHashMap*, simulator_i_cache, nullptr)
-#else
-
-#define ISOLATE_INIT_SIMULATOR_LIST(V)
-
-#endif
-
-
 #ifdef DEBUG
 
 #define ISOLATE_INIT_DEBUG_ARRAY_LIST(V)               \
@@ -431,7 +421,6 @@ typedef std::vector<HeapObject*> DebugObjectCache;
   V(Relocatable*, relocatable_top, nullptr)                                   \
   V(DebugObjectCache*, string_stream_debug_object_cache, nullptr)             \
   V(Object*, string_stream_current_security_token, nullptr)                   \
-  V(ExternalReferenceTable*, external_reference_table, nullptr)               \
   V(const intptr_t*, api_external_references, nullptr)                        \
   V(AddressToIndexHashMap*, external_reference_map, nullptr)                  \
   V(HeapObjectToIndexHashMap*, root_index_map, nullptr)                       \
@@ -454,7 +443,7 @@ typedef std::vector<HeapObject*> DebugObjectCache;
   V(debug::TypeProfile::Mode, type_profile_mode, debug::TypeProfile::kNone)   \
   V(int, last_stack_frame_info_id, 0)                                         \
   V(int, last_console_context_id, 0)                                          \
-  ISOLATE_INIT_SIMULATOR_LIST(V)
+  V(v8_inspector::V8Inspector*, inspector, nullptr)
 
 #define THREAD_LOCAL_TOP_ACCESSOR(type, name)                        \
   inline void set_##name(type v) { thread_local_top_.name##_ = v; }  \
@@ -675,18 +664,6 @@ class Isolate {
     return &thread_local_top_.js_entry_sp_;
   }
 
-  THREAD_LOCAL_TOP_ACCESSOR(int, microtask_queue_bailout_index)
-  Address microtask_queue_bailout_index_address() {
-    return reinterpret_cast<Address>(
-        &thread_local_top_.microtask_queue_bailout_index_);
-  }
-
-  THREAD_LOCAL_TOP_ACCESSOR(int, microtask_queue_bailout_count)
-  Address microtask_queue_bailout_count_address() {
-    return reinterpret_cast<Address>(
-        &thread_local_top_.microtask_queue_bailout_count_);
-  }
-
   // Returns the global object of the current context. It could be
   // a builtin object, or a JS global object.
   inline Handle<JSGlobalObject> global_object();
@@ -743,16 +720,10 @@ class Isolate {
   Handle<String> StackTraceString();
   // Stores a stack trace in a stack-allocated temporary buffer which will
   // end up in the minidump for debugging purposes.
-  NO_INLINE(void PushStackTraceAndDie(unsigned int magic1, void* ptr1,
-                                      void* ptr2, unsigned int magic2));
-  NO_INLINE(void PushStackTraceAndDie(unsigned int magic1, void* ptr1,
-                                      void* ptr2, void* ptr3, void* ptr4,
-                                      void* ptr5, void* ptr6, void* ptr7,
-                                      void* ptr8, unsigned int magic2));
-  NO_INLINE(void PushCodeObjectsAndDie(unsigned int magic, void* ptr1,
-                                       void* ptr2, void* ptr3, void* ptr4,
-                                       void* ptr5, void* ptr6, void* ptr7,
-                                       void* ptr8, unsigned int magic2));
+  NO_INLINE(void PushStackTraceAndDie(void* ptr1 = nullptr,
+                                      void* ptr2 = nullptr,
+                                      void* ptr3 = nullptr,
+                                      void* ptr4 = nullptr));
   Handle<FixedArray> CaptureCurrentStackTrace(
       int frame_limit, StackTrace::StackTraceOptions options);
   Handle<Object> CaptureSimpleStackTrace(Handle<JSReceiver> error_object,
@@ -1104,18 +1075,31 @@ class Isolate {
   bool IsNoElementsProtectorIntact(Context* context);
   bool IsNoElementsProtectorIntact();
 
-  inline bool IsArraySpeciesLookupChainIntact();
+  inline bool IsSpeciesLookupChainIntact();
   bool IsIsConcatSpreadableLookupChainIntact();
   bool IsIsConcatSpreadableLookupChainIntact(JSReceiver* receiver);
   inline bool IsStringLengthOverflowIntact();
   inline bool IsArrayIteratorLookupChainIntact();
 
-  // Avoid deopt loops if fast Array Iterators migrate to slow Array Iterators.
-  inline bool IsFastArrayIterationIntact();
-
   // Make sure we do check for neutered array buffers.
   inline bool IsArrayBufferNeuteringIntact();
 
+  // Disable promise optimizations if promise (debug) hooks have ever been
+  // active.
+  bool IsPromiseHookProtectorIntact();
+
+  // Make sure a lookup of "resolve" on the %Promise% intrinsic object
+  // yeidls the initial Promise.resolve method.
+  bool IsPromiseResolveLookupChainIntact();
+
+  // Make sure a lookup of "then" on any JSPromise whose [[Prototype]] is the
+  // initial %PromisePrototype% yields the initial method. In addition this
+  // protector also guards the negative lookup of "then" on the intrinsic
+  // %ObjectPrototype%, meaning that such lookups are guaranteed to yield
+  // undefined without triggering any side-effects.
+  bool IsPromiseThenLookupChainIntact();
+  bool IsPromiseThenLookupChainIntact(Handle<JSReceiver> receiver);
+
   // On intent to set an element in object, make sure that appropriate
   // notifications occur if the set is on the elements of the array or
   // object prototype. Also ensure that changes to prototype chain between
@@ -1131,11 +1115,14 @@ class Isolate {
     UpdateNoElementsProtectorOnSetElement(object);
   }
   void InvalidateArrayConstructorProtector();
-  void InvalidateArraySpeciesProtector();
+  void InvalidateSpeciesProtector();
   void InvalidateIsConcatSpreadableProtector();
   void InvalidateStringLengthOverflowProtector();
   void InvalidateArrayIteratorProtector();
   void InvalidateArrayBufferNeuteringProtector();
+  V8_EXPORT_PRIVATE void InvalidatePromiseHookProtector();
+  void InvalidatePromiseResolveProtector();
+  void InvalidatePromiseThenProtector();
 
   // Returns true if array is the initial array prototype in any native context.
   bool IsAnyInitialArrayPrototype(Handle<JSArray> array);
@@ -1161,6 +1148,9 @@ class Isolate {
   OptimizingCompileDispatcher* optimizing_compile_dispatcher() {
     return optimizing_compile_dispatcher_;
   }
+  // Flushes all pending concurrent optimzation jobs from the optimizing
+  // compile dispatcher's queue.
+  void AbortConcurrentOptimization(BlockingBehavior blocking_behavior);
 
   int id() const { return static_cast<int>(id_); }
 
@@ -1176,8 +1166,8 @@ class Isolate {
 
   void* stress_deopt_count_address() { return &stress_deopt_count_; }
 
-  bool force_slow_path() { return force_slow_path_; }
-
+  void set_force_slow_path(bool v) { force_slow_path_ = v; }
+  bool force_slow_path() const { return force_slow_path_; }
   bool* force_slow_path_address() { return &force_slow_path_; }
 
   V8_EXPORT_PRIVATE base::RandomNumberGenerator* random_number_generator();
@@ -1199,6 +1189,9 @@ class Isolate {
     return id;
   }
 
+  void AddNearHeapLimitCallback(v8::NearHeapLimitCallback, void* data);
+  void RemoveNearHeapLimitCallback(v8::NearHeapLimitCallback callback,
+                                   size_t heap_limit);
   void AddCallCompletedCallback(CallCompletedCallback callback);
   void RemoveCallCompletedCallback(CallCompletedCallback callback);
   void FireCallCompletedCallback();
@@ -1215,14 +1208,7 @@ class Isolate {
   void ReportPromiseReject(Handle<JSPromise> promise, Handle<Object> value,
                            v8::PromiseRejectEvent event);
 
-  void PromiseReactionJob(Handle<PromiseReactionJobInfo> info,
-                          MaybeHandle<Object>* result,
-                          MaybeHandle<Object>* maybe_exception);
-  void PromiseResolveThenableJob(Handle<PromiseResolveThenableJobInfo> info,
-                                 MaybeHandle<Object>* result,
-                                 MaybeHandle<Object>* maybe_exception);
-
-  void EnqueueMicrotask(Handle<Object> microtask);
+  void EnqueueMicrotask(Handle<Microtask> microtask);
   void RunMicrotasks();
   bool IsRunningMicrotasks() const { return is_running_microtasks_; }
 
@@ -1266,6 +1252,24 @@ class Isolate {
     return &partial_snapshot_cache_;
   }
 
+#ifdef V8_EMBEDDED_BUILTINS
+  // Called only prior to serialization.
+  // This function copies off-heap-safe builtins off the heap, creates off-heap
+  // trampolines, and sets up this isolate's embedded blob.
+  void PrepareEmbeddedBlobForSerialization();
+
+  BuiltinsConstantsTableBuilder* builtins_constants_table_builder() const {
+    return builtins_constants_table_builder_;
+  }
+
+  static const uint8_t* CurrentEmbeddedBlob();
+  static uint32_t CurrentEmbeddedBlobSize();
+
+  // TODO(jgruber): Remove these in favor of the static methods above.
+  const uint8_t* embedded_blob() const;
+  uint32_t embedded_blob_size() const;
+#endif
+
   void set_array_buffer_allocator(v8::ArrayBuffer::Allocator* allocator) {
     array_buffer_allocator_ = allocator;
   }
@@ -1317,10 +1321,6 @@ class Isolate {
 
   PRINTF_FORMAT(2, 3) void PrintWithTimestamp(const char* format, ...);
 
-#ifdef USE_SIMULATOR
-  base::Mutex* simulator_i_cache_mutex() { return &simulator_i_cache_mutex_; }
-#endif
-
   void set_allow_atomics_wait(bool set) { allow_atomics_wait_ = set; }
   bool allow_atomics_wait() { return allow_atomics_wait_; }
 
@@ -1373,6 +1373,8 @@ class Isolate {
     top_backup_incumbent_scope_ = top_backup_incumbent_scope;
   }
 
+  void SetIdle(bool is_idle);
+
  protected:
   explicit Isolate(bool enable_serializer);
   bool IsArrayOrObjectOrStringPrototype(Object* object);
@@ -1476,7 +1478,7 @@ class Isolate {
   // then return true.
   bool PropagatePendingExceptionToExternalTryCatch();
 
-  void RunMicrotasksInternal();
+  void SetTerminationOnExternalTryCatch();
 
   const char* RAILModeName(RAILMode rail_mode) const {
     switch (rail_mode) {
@@ -1639,6 +1641,17 @@ class Isolate {
 
   std::vector<Object*> partial_snapshot_cache_;
 
+#ifdef V8_EMBEDDED_BUILTINS
+  // Used during builtins compilation to build the builtins constants table,
+  // which is stored on the root list prior to serialization.
+  BuiltinsConstantsTableBuilder* builtins_constants_table_builder_ = nullptr;
+
+  void SetEmbeddedBlob(const uint8_t* blob, uint32_t blob_size);
+
+  const uint8_t* embedded_blob_ = nullptr;
+  uint32_t embedded_blob_size_ = 0;
+#endif
+
   v8::ArrayBuffer::Allocator* array_buffer_allocator_;
 
   FutexWaitListNode futex_wait_list_node_;
@@ -1650,10 +1663,6 @@ class Isolate {
   v8::Isolate::AbortOnUncaughtExceptionCallback
       abort_on_uncaught_exception_callback_;
 
-#ifdef USE_SIMULATOR
-  base::Mutex simulator_i_cache_mutex_;
-#endif
-
   bool allow_atomics_wait_;
 
   ManagedObjectFinalizer managed_object_finalizers_list_;
@@ -1672,16 +1681,16 @@ class Isolate {
   friend class HandleScopeImplementer;
   friend class heap::HeapTester;
   friend class OptimizingCompileDispatcher;
-  friend class SweeperThread;
-  friend class ThreadManager;
   friend class Simulator;
   friend class StackGuard;
+  friend class SweeperThread;
   friend class TestIsolate;
   friend class ThreadId;
+  friend class ThreadManager;
   friend class v8::Isolate;
   friend class v8::Locker;
-  friend class v8::Unlocker;
   friend class v8::SnapshotCreator;
+  friend class v8::Unlocker;
   friend v8::StartupData v8::V8::CreateSnapshotDataBlob(const char*);
   friend v8::StartupData v8::V8::WarmUpSnapshotDataBlob(v8::StartupData,
                                                         const char*);
@@ -1897,6 +1906,29 @@ class CodeTracer final : public Malloced {
   int scope_depth_;
 };
 
+class StackTraceFailureMessage {
+ public:
+  explicit StackTraceFailureMessage(Isolate* isolate, void* ptr1 = nullptr,
+                                    void* ptr2 = nullptr, void* ptr3 = nullptr,
+                                    void* ptr4 = nullptr);
+
+  V8_NOINLINE void Print() volatile;
+
+  static const uintptr_t kStartMarker = 0xdecade30;
+  static const uintptr_t kEndMarker = 0xdecade31;
+  static const int kStacktraceBufferSize = 32 * KB;
+
+  uintptr_t start_marker_ = kStartMarker;
+  void* isolate_;
+  void* ptr1_;
+  void* ptr2_;
+  void* ptr3_;
+  void* ptr4_;
+  void* code_objects_[4];
+  char js_stack_trace_[kStacktraceBufferSize];
+  uintptr_t end_marker_ = kEndMarker;
+};
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/js/OWNERS b/deps/v8/src/js/OWNERS
index 0108c712e3d..de2152c0566 100644
--- a/deps/v8/src/js/OWNERS
+++ b/deps/v8/src/js/OWNERS
@@ -7,7 +7,6 @@ ishell@chromium.org
 jgruber@chromium.org
 jkummerow@chromium.org
 littledan@chromium.org
-rossberg@chromium.org
 verwaest@chromium.org
 yangguo@chromium.org
 
diff --git a/deps/v8/src/js/array.js b/deps/v8/src/js/array.js
index 7605fc1a7d5..5b393263dac 100644
--- a/deps/v8/src/js/array.js
+++ b/deps/v8/src/js/array.js
@@ -11,8 +11,6 @@
 // -------------------------------------------------------------------
 // Imports
 
-var GetIterator;
-var GetMethod;
 var GlobalArray = global.Array;
 var InternalArray = utils.InternalArray;
 var MathMax = global.Math.max;
@@ -22,11 +20,6 @@ var ObjectToString = global.Object.prototype.toString;
 var iteratorSymbol = utils.ImportNow("iterator_symbol");
 var unscopablesSymbol = utils.ImportNow("unscopables_symbol");
 
-utils.Import(function(from) {
-  GetIterator = from.GetIterator;
-  GetMethod = from.GetMethod;
-});
-
 // -------------------------------------------------------------------
 
 macro IS_PROXY(arg)
@@ -585,46 +578,14 @@ function ArrayUnshiftFallback(arg1) {  // length == 1
 }
 
 
+// Oh the humanity... don't remove the following function because js2c for some
+// reason gets symbol minifiation wrong if it's not there. Instead of spending
+// the time fixing js2c (which will go away when all of the internal .js runtime
+// files are gone), just keep this work-around.
 function ArraySliceFallback(start, end) {
-  var array = TO_OBJECT(this);
-  var len = TO_LENGTH(array.length);
-  var start_i = TO_INTEGER(start);
-  var end_i = len;
-
-  if (!IS_UNDEFINED(end)) end_i = TO_INTEGER(end);
-
-  if (start_i < 0) {
-    start_i += len;
-    if (start_i < 0) start_i = 0;
-  } else {
-    if (start_i > len) start_i = len;
-  }
-
-  if (end_i < 0) {
-    end_i += len;
-    if (end_i < 0) end_i = 0;
-  } else {
-    if (end_i > len) end_i = len;
-  }
-
-  var result = ArraySpeciesCreate(array, MathMax(end_i - start_i, 0));
-
-  if (end_i < start_i) return result;
-
-  if (UseSparseVariant(array, len, IS_ARRAY(array), end_i - start_i)) {
-    %NormalizeElements(array);
-    if (IS_ARRAY(result)) %NormalizeElements(result);
-    SparseSlice(array, start_i, end_i - start_i, len, result);
-  } else {
-    SimpleSlice(array, start_i, end_i - start_i, len, result);
-  }
-
-  result.length = end_i - start_i;
-
-  return result;
+  return null;
 }
 
-
 function ComputeSpliceStartIndex(start_i, len) {
   if (start_i < 0) {
     start_i += len;
@@ -1153,81 +1114,6 @@ DEFINE_METHOD_LEN(
   1  /* Set function length */
 );
 
-
-// ES6, draft 10-14-14, section 22.1.2.1
-DEFINE_METHOD_LEN(
-  GlobalArray,
-  'from'(arrayLike, mapfn, receiver) {
-    var items = TO_OBJECT(arrayLike);
-    var mapping = !IS_UNDEFINED(mapfn);
-
-    if (mapping) {
-      if (!IS_CALLABLE(mapfn)) {
-        throw %make_type_error(kCalledNonCallable, mapfn);
-      }
-    }
-
-    var iterable = GetMethod(items, iteratorSymbol);
-    var k;
-    var result;
-    var mappedValue;
-    var nextValue;
-
-    if (!IS_UNDEFINED(iterable)) {
-      result = %IsConstructor(this) ? new this() : [];
-      k = 0;
-
-      for (nextValue of
-           { [iteratorSymbol]() { return GetIterator(items, iterable) } }) {
-        if (mapping) {
-          mappedValue = %_Call(mapfn, receiver, nextValue, k);
-        } else {
-          mappedValue = nextValue;
-        }
-        %CreateDataProperty(result, k, mappedValue);
-        k++;
-      }
-      result.length = k;
-      return result;
-    } else {
-      var len = TO_LENGTH(items.length);
-      result = %IsConstructor(this) ? new this(len) : new GlobalArray(len);
-
-      for (k = 0; k < len; ++k) {
-        nextValue = items[k];
-        if (mapping) {
-          mappedValue = %_Call(mapfn, receiver, nextValue, k);
-        } else {
-          mappedValue = nextValue;
-        }
-        %CreateDataProperty(result, k, mappedValue);
-      }
-
-      result.length = k;
-      return result;
-    }
-  },
-  1  /* Set function length. */
-);
-
-// ES6, draft 05-22-14, section 22.1.2.3
-DEFINE_METHOD(
-  GlobalArray,
-  of(...args) {
-    var length = args.length;
-    var constructor = this;
-    // TODO: Implement IsConstructor (ES6 section 7.2.5)
-    var array = %IsConstructor(constructor) ? new constructor(length) : [];
-    for (var i = 0; i < length; i++) {
-      %CreateDataProperty(array, i, args[i]);
-    }
-    array.length = length;
-    return array;
-  }
-);
-
-// -------------------------------------------------------------------
-
 // Set up unscopable properties on the Array.prototype object.
 var unscopables = {
   __proto__: null,
@@ -1311,7 +1197,6 @@ utils.Export(function(to) {
   "array_push", ArrayPushFallback,
   "array_shift", ArrayShiftFallback,
   "array_splice", ArraySpliceFallback,
-  "array_slice", ArraySliceFallback,
   "array_unshift", ArrayUnshiftFallback,
 ]);
 
diff --git a/deps/v8/src/js/prologue.js b/deps/v8/src/js/prologue.js
index 32f826691d6..bc2652129d6 100644
--- a/deps/v8/src/js/prologue.js
+++ b/deps/v8/src/js/prologue.js
@@ -99,42 +99,6 @@ function PostNatives(utils) {
   utils.PostNatives = UNDEFINED;
 }
 
-// ----------------------------------------------------------------------------
-// Object
-
-var iteratorSymbol = ImportNow("iterator_symbol");
-
-// ES6 7.3.9
-function GetMethod(obj, p) {
-  var func = obj[p];
-  if (IS_NULL_OR_UNDEFINED(func)) return UNDEFINED;
-  if (IS_CALLABLE(func)) return func;
-  throw %make_type_error(kCalledNonCallable, typeof func);
-}
-
-// ----------------------------------------------------------------------------
-// Iterator related spec functions.
-
-// ES6 7.4.1 GetIterator(obj, method)
-function GetIterator(obj, method) {
-  if (IS_UNDEFINED(method)) {
-    method = obj[iteratorSymbol];
-  }
-  if (!IS_CALLABLE(method)) {
-    throw %make_type_error(kNotIterable, obj);
-  }
-  var iterator = %_Call(method, obj);
-  if (!IS_RECEIVER(iterator)) {
-    throw %make_type_error(kNotAnIterator, iterator);
-  }
-  return iterator;
-}
-
-
-exports_container.GetIterator = GetIterator;
-exports_container.GetMethod = GetMethod;
-
-
 // -----------------------------------------------------------------------
 
 %OptimizeObjectForAddingMultipleProperties(utils, 14);
@@ -177,13 +141,7 @@ extrasUtils.createPrivateSymbol = function createPrivateSymbol(name) {
 //
 // Technically they could all be derived from combinations of
 // Function.prototype.{bind,call,apply} but that introduces lots of layers of
-// indirection and slowness given how un-optimized bind is.
-
-extrasUtils.simpleBind = function simpleBind(func, thisArg) {
-  return function(...args) {
-    return %reflect_apply(func, thisArg, args);
-  };
-};
+// indirection.
 
 extrasUtils.uncurryThis = function uncurryThis(func) {
   return function(thisArg, ...args) {
@@ -191,11 +149,6 @@ extrasUtils.uncurryThis = function uncurryThis(func) {
   };
 };
 
-// We pass true to trigger the debugger's on exception handler.
-extrasUtils.rejectPromise = function rejectPromise(promise, reason) {
-  %promise_internal_reject(promise, reason, true);
-}
-
 extrasUtils.markPromiseAsHandled = function markPromiseAsHandled(promise) {
   %PromiseMarkAsHandled(promise);
 };
diff --git a/deps/v8/src/js/spread.js b/deps/v8/src/js/spread.js
deleted file mode 100644
index 0b56ca7edd3..00000000000
--- a/deps/v8/src/js/spread.js
+++ /dev/null
@@ -1,51 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-(function(global, utils) {
-
-"use strict";
-
-// -------------------------------------------------------------------
-// Imports
-var InternalArray = utils.InternalArray;
-
-// -------------------------------------------------------------------
-
-function SpreadArguments() {
-  var count = arguments.length;
-  var args = new InternalArray();
-
-  for (var i = 0; i < count; ++i) {
-    var array = arguments[i];
-    var length = array.length;
-    for (var j = 0; j < length; ++j) {
-      args.push(array[j]);
-    }
-  }
-
-  return args;
-}
-
-
-function SpreadIterable(collection) {
-  if (IS_NULL_OR_UNDEFINED(collection)) {
-    throw %make_type_error(kNotIterable, collection);
-  }
-
-  var args = new InternalArray();
-  for (var value of collection) {
-    args.push(value);
-  }
-  return args;
-}
-
-// ----------------------------------------------------------------------------
-// Exports
-
-%InstallToContext([
-  "spread_arguments", SpreadArguments,
-  "spread_iterable", SpreadIterable,
-]);
-
-})
diff --git a/deps/v8/src/js/typedarray.js b/deps/v8/src/js/typedarray.js
index 7fa638fa897..b186aa9dc9b 100644
--- a/deps/v8/src/js/typedarray.js
+++ b/deps/v8/src/js/typedarray.js
@@ -13,21 +13,9 @@
 
 // array.js has to come before typedarray.js for this to work
 var ArrayToString = utils.ImportNow("ArrayToString");
-var GetIterator;
-var GetMethod;
-var GlobalArray = global.Array;
-var GlobalArrayBuffer = global.ArrayBuffer;
-var GlobalArrayBufferPrototype = GlobalArrayBuffer.prototype;
-var GlobalObject = global.Object;
 var InnerArrayJoin;
 var InnerArraySort;
 var InnerArrayToLocaleString;
-var InternalArray = utils.InternalArray;
-var MathMax = global.Math.max;
-var MathMin = global.Math.min;
-var iteratorSymbol = utils.ImportNow("iterator_symbol");
-var speciesSymbol = utils.ImportNow("species_symbol");
-var toStringTagSymbol = utils.ImportNow("to_string_tag_symbol");
 
 macro TYPED_ARRAYS(FUNCTION)
 FUNCTION(Uint8Array, 1)
@@ -39,6 +27,8 @@ FUNCTION(Int32Array, 4)
 FUNCTION(Float32Array, 4)
 FUNCTION(Float64Array, 8)
 FUNCTION(Uint8ClampedArray, 1)
+FUNCTION(BigUint64Array, 8)
+FUNCTION(BigInt64Array, 8)
 endmacro
 
 macro DECLARE_GLOBALS(NAME, SIZE)
@@ -47,14 +37,6 @@ endmacro
 
 TYPED_ARRAYS(DECLARE_GLOBALS)
 
-macro IS_ARRAYBUFFER(arg)
-(%_ClassOf(arg) === 'ArrayBuffer')
-endmacro
-
-macro IS_SHAREDARRAYBUFFER(arg)
-(%_ClassOf(arg) === 'SharedArrayBuffer')
-endmacro
-
 macro IS_TYPEDARRAY(arg)
 (%_IsTypedArray(arg))
 endmacro
@@ -62,32 +44,11 @@ endmacro
 var GlobalTypedArray = %object_get_prototype_of(GlobalUint8Array);
 
 utils.Import(function(from) {
-  GetIterator = from.GetIterator;
-  GetMethod = from.GetMethod;
   InnerArrayJoin = from.InnerArrayJoin;
   InnerArraySort = from.InnerArraySort;
   InnerArrayToLocaleString = from.InnerArrayToLocaleString;
 });
 
-// ES2015 7.3.20
-function SpeciesConstructor(object, defaultConstructor) {
-  var constructor = object.constructor;
-  if (IS_UNDEFINED(constructor)) {
-    return defaultConstructor;
-  }
-  if (!IS_RECEIVER(constructor)) {
-    throw %make_type_error(kConstructorNotReceiver);
-  }
-  var species = constructor[speciesSymbol];
-  if (IS_NULL_OR_UNDEFINED(species)) {
-    return defaultConstructor;
-  }
-  if (%IsConstructor(species)) {
-    return species;
-  }
-  throw %make_type_error(kSpeciesNotConstructor);
-}
-
 // --------------- Typed Arrays ---------------------
 
 // ES6 section 22.2.3.5.1 ValidateTypedArray ( O )
@@ -98,201 +59,6 @@ function ValidateTypedArray(array, methodName) {
     throw %make_type_error(kDetachedOperation, methodName);
 }
 
-function TypedArrayDefaultConstructor(typedArray) {
-  switch (%_ClassOf(typedArray)) {
-macro TYPED_ARRAY_CONSTRUCTOR_CASE(NAME, ELEMENT_SIZE)
-    case "NAME":
-      return GlobalNAME;
-endmacro
-TYPED_ARRAYS(TYPED_ARRAY_CONSTRUCTOR_CASE)
-  }
-  // The TypeError should not be generated since all callers should
-  // have already called ValidateTypedArray.
-  throw %make_type_error(kIncompatibleMethodReceiver,
-                      "TypedArrayDefaultConstructor", this);
-}
-
-function TypedArrayCreate(constructor, arg0, arg1, arg2) {
-  if (IS_UNDEFINED(arg1)) {
-    var newTypedArray = new constructor(arg0);
-  } else {
-    var newTypedArray = new constructor(arg0, arg1, arg2);
-  }
-  ValidateTypedArray(newTypedArray, "TypedArrayCreate");
-  if (IS_NUMBER(arg0) && %_TypedArrayGetLength(newTypedArray) < arg0) {
-    throw %make_type_error(kTypedArrayTooShort);
-  }
-  return newTypedArray;
-}
-
-function TypedArraySpeciesCreate(exemplar, arg0, arg1, arg2) {
-  var defaultConstructor = TypedArrayDefaultConstructor(exemplar);
-  var constructor = SpeciesConstructor(exemplar, defaultConstructor);
-  return TypedArrayCreate(constructor, arg0, arg1, arg2);
-}
-
-macro TYPED_ARRAY_CONSTRUCTOR(NAME, ELEMENT_SIZE)
-function NAMEConstructByIterable(obj, iterable, iteratorFn) {
-  if (%IterableToListCanBeElided(iterable)) {
-    // This .length access is unobservable, because it being observable would
-    // mean that iteration has side effects, and we wouldn't reach this path.
-    %typed_array_construct_by_array_like(
-        obj, iterable, iterable.length, ELEMENT_SIZE);
-  } else {
-    var list = new InternalArray();
-    // Reading the Symbol.iterator property of iterable twice would be
-    // observable with getters, so instead, we call the function which
-    // was already looked up, and wrap it in another iterable. The
-    // __proto__ of the new iterable is set to null to avoid any chance
-    // of modifications to Object.prototype being observable here.
-    var iterator = %_Call(iteratorFn, iterable);
-    var newIterable = {
-      __proto__: null
-    };
-    // TODO(littledan): Computed properties don't work yet in nosnap.
-    // Rephrase when they do.
-    newIterable[iteratorSymbol] = function() { return iterator; }
-    for (var value of newIterable) {
-      list.push(value);
-    }
-    %typed_array_construct_by_array_like(obj, list, list.length, ELEMENT_SIZE);
-  }
-}
-
-// ES#sec-typedarray-typedarray TypedArray ( typedArray )
-function NAMEConstructByTypedArray(obj, typedArray) {
-  // TODO(littledan): Throw on detached typedArray
-  var srcData = %TypedArrayGetBuffer(typedArray);
-  var length = %_TypedArrayGetLength(typedArray);
-  var byteLength = %_ArrayBufferViewGetByteLength(typedArray);
-  var newByteLength = length * ELEMENT_SIZE;
-  %typed_array_construct_by_array_like(obj, typedArray, length, ELEMENT_SIZE);
-  // The spec requires that constructing a typed array using a SAB-backed typed
-  // array use the ArrayBuffer constructor, not the species constructor. See
-  // https://tc39.github.io/ecma262/#sec-typedarray-typedarray.
-  var bufferConstructor = IS_SHAREDARRAYBUFFER(srcData)
-                            ? GlobalArrayBuffer
-                            : SpeciesConstructor(srcData, GlobalArrayBuffer);
-  var prototype = bufferConstructor.prototype;
-  // TODO(littledan): Use the right prototype based on bufferConstructor's realm
-  if (IS_RECEIVER(prototype) && prototype !== GlobalArrayBufferPrototype) {
-    %InternalSetPrototype(%TypedArrayGetBuffer(obj), prototype);
-  }
-}
-
-function NAMEConstructor(arg1, arg2, arg3) {
-  if (!IS_UNDEFINED(new.target)) {
-    if (IS_ARRAYBUFFER(arg1) || IS_SHAREDARRAYBUFFER(arg1)) {
-      %typed_array_construct_by_array_buffer(
-          this, arg1, arg2, arg3, ELEMENT_SIZE);
-    } else if (IS_TYPEDARRAY(arg1)) {
-      NAMEConstructByTypedArray(this, arg1);
-    } else if (IS_RECEIVER(arg1)) {
-      var iteratorFn = arg1[iteratorSymbol];
-      if (IS_UNDEFINED(iteratorFn)) {
-        %typed_array_construct_by_array_like(
-            this, arg1, arg1.length, ELEMENT_SIZE);
-      } else {
-        NAMEConstructByIterable(this, arg1, iteratorFn);
-      }
-    } else {
-      %typed_array_construct_by_length(this, arg1, ELEMENT_SIZE);
-    }
-  } else {
-    throw %make_type_error(kConstructorNotFunction, "NAME")
-  }
-}
-
-function NAMESubArray(begin, end) {
-  var beginInt = TO_INTEGER(begin);
-  if (!IS_UNDEFINED(end)) {
-    var endInt = TO_INTEGER(end);
-    var srcLength = %_TypedArrayGetLength(this);
-  } else {
-    var srcLength = %_TypedArrayGetLength(this);
-    var endInt = srcLength;
-  }
-
-  if (beginInt < 0) {
-    beginInt = MathMax(0, srcLength + beginInt);
-  } else {
-    beginInt = MathMin(beginInt, srcLength);
-  }
-
-  if (endInt < 0) {
-    endInt = MathMax(0, srcLength + endInt);
-  } else {
-    endInt = MathMin(endInt, srcLength);
-  }
-
-  if (endInt < beginInt) {
-    endInt = beginInt;
-  }
-
-  var newLength = endInt - beginInt;
-  var beginByteOffset =
-      %_ArrayBufferViewGetByteOffset(this) + beginInt * ELEMENT_SIZE;
-  return TypedArraySpeciesCreate(this, %TypedArrayGetBuffer(this),
-                                 beginByteOffset, newLength);
-}
-endmacro
-
-TYPED_ARRAYS(TYPED_ARRAY_CONSTRUCTOR)
-
-DEFINE_METHOD(
-  GlobalTypedArray.prototype,
-  subarray(begin, end) {
-    switch (%_ClassOf(this)) {
-macro TYPED_ARRAY_SUBARRAY_CASE(NAME, ELEMENT_SIZE)
-      case "NAME":
-        return %_Call(NAMESubArray, this, begin, end);
-endmacro
-TYPED_ARRAYS(TYPED_ARRAY_SUBARRAY_CASE)
-    }
-    throw %make_type_error(kIncompatibleMethodReceiver,
-                        "get %TypedArray%.prototype.subarray", this);
-  }
-);
-
-
-// The following functions cannot be made efficient on sparse arrays while
-// preserving the semantics, since the calls to the receiver function can add
-// or delete elements from the array.
-function InnerTypedArrayFilter(f, receiver, array, length, result) {
-  var result_length = 0;
-  for (var i = 0; i < length; i++) {
-    if (i in array) {
-      var element = array[i];
-      if (%_Call(f, receiver, element, i, array)) {
-        %CreateDataProperty(result, result_length, element);
-        result_length++;
-      }
-    }
-  }
-  return result;
-}
-
-
-// ES6 draft 07-15-13, section 22.2.3.9
-DEFINE_METHOD_LEN(
-  GlobalTypedArray.prototype,
-  filter(f, thisArg) {
-    ValidateTypedArray(this, "%TypeArray%.prototype.filter");
-
-    var length = %_TypedArrayGetLength(this);
-    if (!IS_CALLABLE(f)) throw %make_type_error(kCalledNonCallable, f);
-    var result = new InternalArray();
-    InnerTypedArrayFilter(f, thisArg, this, length, result);
-    var captured = result.length;
-    var output = TypedArraySpeciesCreate(this, captured);
-    for (var i = 0; i < captured; i++) {
-      output[i] = result[i];
-    }
-    return output;
-  },
-  1  /* Set function length. */
-);
-
 // ES6 draft 05-18-15, section 22.2.3.25
 DEFINE_METHOD(
   GlobalTypedArray.prototype,
@@ -339,71 +105,6 @@ DEFINE_METHOD(
   }
 );
 
-
-// ES6 draft 08-24-14, section 22.2.2.2
-DEFINE_METHOD(
-  GlobalTypedArray,
-  of() {
-    var length = arguments.length;
-    var array = TypedArrayCreate(this, length);
-    for (var i = 0; i < length; i++) {
-      array[i] = arguments[i];
-    }
-    return array;
-  }
-);
-
-
-// ES#sec-iterabletoarraylike Runtime Semantics: IterableToArrayLike( items )
-function IterableToArrayLike(items) {
-  var iterable = GetMethod(items, iteratorSymbol);
-  if (!IS_UNDEFINED(iterable)) {
-    var internal_array = new InternalArray();
-    var i = 0;
-    for (var value of
-         { [iteratorSymbol]() { return GetIterator(items, iterable) } }) {
-      internal_array[i] = value;
-      i++;
-    }
-    var array = [];
-    %MoveArrayContents(internal_array, array);
-    return array;
-  }
-  return TO_OBJECT(items);
-}
-
-
-// ES#sec-%typedarray%.from
-// %TypedArray%.from ( source [ , mapfn [ , thisArg ] ] )
-DEFINE_METHOD_LEN(
-  GlobalTypedArray,
-  'from'(source, mapfn, thisArg) {
-    if (!%IsConstructor(this)) throw %make_type_error(kNotConstructor, this);
-    var mapping;
-    if (!IS_UNDEFINED(mapfn)) {
-      if (!IS_CALLABLE(mapfn)) throw %make_type_error(kCalledNonCallable, this);
-      mapping = true;
-    } else {
-      mapping = false;
-    }
-    var arrayLike = IterableToArrayLike(source);
-    var length = TO_LENGTH(arrayLike.length);
-    var targetObject = TypedArrayCreate(this, length);
-    var value, mappedValue;
-    for (var i = 0; i < length; i++) {
-      value = arrayLike[i];
-      if (mapping) {
-        mappedValue = %_Call(mapfn, thisArg, value, i);
-      } else {
-        mappedValue = value;
-      }
-      targetObject[i] = mappedValue;
-    }
-    return targetObject;
-  },
-  1  /* Set function length. */
-);
-
 // TODO(bmeurer): Migrate this to a proper builtin.
 function TypedArrayConstructor() {
   throw %make_type_error(kConstructAbstractClass, "TypedArray");
@@ -417,11 +118,4 @@ function TypedArrayConstructor() {
 %AddNamedProperty(GlobalTypedArray.prototype, "toString", ArrayToString,
                   DONT_ENUM);
 
-
-macro SETUP_TYPED_ARRAY(NAME, ELEMENT_SIZE)
-  %SetCode(GlobalNAME, NAMEConstructor);
-endmacro
-
-TYPED_ARRAYS(SETUP_TYPED_ARRAY)
-
 })
diff --git a/deps/v8/src/json-parser.cc b/deps/v8/src/json-parser.cc
index 57e7fff8c56..0f21da7dd6d 100644
--- a/deps/v8/src/json-parser.cc
+++ b/deps/v8/src/json-parser.cc
@@ -416,12 +416,13 @@ Handle<Object> JsonParser<seq_one_byte>::ParseJsonObject() {
       if (!follow_expected) {
         // If the expected transition failed, parse an internalized string and
         // try to find a matching transition.
-        key = ParseJsonInternalizedString();
+        key = ParseJsonString();
         if (key.is_null()) return ReportUnexpectedCharacter();
 
-        target = TransitionsAccessor(map).FindTransitionToField(key);
         // If a transition was found, follow it and continue.
-        transitioning = !target.is_null();
+        transitioning =
+            TransitionsAccessor(map).FindTransitionToField(key).ToHandle(
+                &target);
       }
       if (c0_ != ':') return ReportUnexpectedCharacter();
 
@@ -491,7 +492,7 @@ Handle<Object> JsonParser<seq_one_byte>::ParseJsonObject() {
         Handle<String> key;
         Handle<Object> value;
 
-        key = ParseJsonInternalizedString();
+        key = ParseJsonString();
         if (key.is_null() || c0_ != ':') return ReportUnexpectedCharacter();
 
         AdvanceSkipWhitespace();
@@ -812,7 +813,6 @@ Handle<String> JsonParser<seq_one_byte>::SlowScanJsonString(
 }
 
 template <bool seq_one_byte>
-template <bool is_internalized>
 Handle<String> JsonParser<seq_one_byte>::ScanJsonString() {
   DCHECK_EQ('"', c0_);
   Advance();
@@ -821,7 +821,7 @@ Handle<String> JsonParser<seq_one_byte>::ScanJsonString() {
     return factory()->empty_string();
   }
 
-  if (seq_one_byte && is_internalized) {
+  if (seq_one_byte) {
     // Fast path for existing internalized strings.  If the the string being
     // parsed is not a known internalized string, contains backslashes or
     // unexpectedly reaches the end of string, return with an empty handle.
@@ -829,9 +829,13 @@ Handle<String> JsonParser<seq_one_byte>::ScanJsonString() {
     // We intentionally use local variables instead of fields, compute hash
     // while we are iterating a string and manually inline StringTable lookup
     // here.
-    uint32_t running_hash = isolate()->heap()->HashSeed();
+
     int position = position_;
     uc32 c0 = c0_;
+    uint32_t running_hash = isolate()->heap()->HashSeed();
+    uint32_t index = 0;
+    bool is_array_index = true;
+
     do {
       if (c0 == '\\') {
         c0_ = c0;
@@ -845,6 +849,16 @@ Handle<String> JsonParser<seq_one_byte>::ScanJsonString() {
         position_ = position;
         return Handle<String>::null();
       }
+      if (is_array_index) {
+        // With leading zero, the string has to be "0" to be a valid index.
+        if (!IsDecimalDigit(c0) || (position > position_ && index == 0)) {
+          is_array_index = false;
+        } else {
+          int d = c0 - '0';
+          is_array_index = index <= 429496729U - ((d + 3) >> 3);
+          index = (index * 10) + d;
+        }
+      }
       running_hash = StringHasher::AddCharacterCore(running_hash,
                                                     static_cast<uint16_t>(c0));
       position++;
@@ -856,9 +870,15 @@ Handle<String> JsonParser<seq_one_byte>::ScanJsonString() {
       c0 = seq_source_->SeqOneByteStringGet(position);
     } while (c0 != '"');
     int length = position - position_;
-    uint32_t hash = (length <= String::kMaxHashCalcLength)
-                        ? StringHasher::GetHashCore(running_hash)
-                        : static_cast<uint32_t>(length);
+    uint32_t hash;
+    if (is_array_index) {
+      hash =
+          StringHasher::MakeArrayIndexHash(index, length) >> String::kHashShift;
+    } else if (length <= String::kMaxHashCalcLength) {
+      hash = StringHasher::GetHashCore(running_hash);
+    } else {
+      hash = static_cast<uint32_t>(length);
+    }
     Vector<const uint8_t> string_vector(seq_source_->GetChars() + position_,
                                         length);
     StringTable* string_table = isolate()->heap()->string_table();
@@ -877,12 +897,8 @@ Handle<String> JsonParser<seq_one_byte>::ScanJsonString() {
       if (!element->IsTheHole(isolate()) &&
           String::cast(element)->IsOneByteEqualTo(string_vector)) {
         result = Handle<String>(String::cast(element), isolate());
-#ifdef DEBUG
-        uint32_t hash_field =
-            (hash << String::kHashShift) | String::kIsNotArrayIndexMask;
-        DCHECK_EQ(static_cast<int>(result->Hash()),
-                  static_cast<int>(hash_field >> String::kHashShift));
-#endif
+        DCHECK_EQ(result->Hash(),
+                  (hash << String::kHashShift) >> String::kHashShift);
         break;
       }
       entry = StringTable::NextProbe(entry, count++, capacity);
diff --git a/deps/v8/src/json-parser.h b/deps/v8/src/json-parser.h
index 6566c92e404..094569a46a7 100644
--- a/deps/v8/src/json-parser.h
+++ b/deps/v8/src/json-parser.h
@@ -6,7 +6,9 @@
 #define V8_JSON_PARSER_H_
 
 #include "src/factory.h"
+#include "src/isolate.h"
 #include "src/objects.h"
+#include "src/zone/zone-containers.h"
 
 namespace v8 {
 namespace internal {
@@ -75,19 +77,14 @@ class JsonParser BASE_EMBEDDED {
   // literals. The string must only be double-quoted (not single-quoted), and
   // the only allowed backslash-escapes are ", /, \, b, f, n, r, t and
   // four-digit hex escapes (uXXXX). Any other use of backslashes is invalid.
-  Handle<String> ParseJsonString() {
-    return ScanJsonString<false>();
-  }
-
   bool ParseJsonString(Handle<String> expected);
 
-  Handle<String> ParseJsonInternalizedString() {
-    Handle<String> result = ScanJsonString<true>();
+  Handle<String> ParseJsonString() {
+    Handle<String> result = ScanJsonString();
     if (result.is_null()) return result;
     return factory()->InternalizeString(result);
   }
 
-  template <bool is_internalized>
   Handle<String> ScanJsonString();
   // Creates a new string and copies prefix[start..end] into the beginning
   // of it. Then scans the rest of the string, adding characters after the
diff --git a/deps/v8/src/keys.cc b/deps/v8/src/keys.cc
index 4f59c2553ca..e5981434ae0 100644
--- a/deps/v8/src/keys.cc
+++ b/deps/v8/src/keys.cc
@@ -653,6 +653,16 @@ Maybe<bool> KeyAccumulator::CollectOwnPropertyNames(Handle<JSReceiver> receiver,
       enum_keys = GetOwnEnumPropertyDictionaryKeys(
           isolate_, mode_, this, object, object->property_dictionary());
     }
+    if (object->IsJSModuleNamespace()) {
+      // Simulate [[GetOwnProperty]] for establishing enumerability, which
+      // throws for uninitialized exports.
+      for (int i = 0, n = enum_keys->length(); i < n; ++i) {
+        Handle<String> key(String::cast(enum_keys->get(i)), isolate_);
+        if (Handle<JSModuleNamespace>::cast(object)->GetExport(key).is_null()) {
+          return Nothing<bool>();
+        }
+      }
+    }
     AddKeys(enum_keys, DO_NOT_CONVERT);
   } else {
     if (object->HasFastProperties()) {
diff --git a/deps/v8/src/keys.h b/deps/v8/src/keys.h
index 0db12d96ba4..bd4f048c697 100644
--- a/deps/v8/src/keys.h
+++ b/deps/v8/src/keys.h
@@ -55,8 +55,11 @@ class KeyAccumulator final BASE_EMBEDDED {
 
   // Might return directly the object's enum_cache, copy the result before using
   // as an elements backing store for a JSObject.
+  // Does not throw for uninitialized exports in module namespace objects, so
+  // this has to be checked separately.
   static Handle<FixedArray> GetOwnEnumPropertyKeys(Isolate* isolate,
                                                    Handle<JSObject> object);
+
   void AddKey(Object* key, AddKeyConversion convert = DO_NOT_CONVERT);
   void AddKey(Handle<Object> key, AddKeyConversion convert = DO_NOT_CONVERT);
   void AddKeys(Handle<FixedArray> array, AddKeyConversion convert);
diff --git a/deps/v8/src/libplatform/default-foreground-task-runner.cc b/deps/v8/src/libplatform/default-foreground-task-runner.cc
index c9cb5fa4d7f..140dd404ec6 100644
--- a/deps/v8/src/libplatform/default-foreground-task-runner.cc
+++ b/deps/v8/src/libplatform/default-foreground-task-runner.cc
@@ -12,9 +12,7 @@ namespace platform {
 
 DefaultForegroundTaskRunner::DefaultForegroundTaskRunner(
     IdleTaskSupport idle_task_support, TimeFunction time_function)
-    : event_loop_control_(0),
-      idle_task_support_(idle_task_support),
-      time_function_(time_function) {}
+    : idle_task_support_(idle_task_support), time_function_(time_function) {}
 
 void DefaultForegroundTaskRunner::Terminate() {
   base::LockGuard<base::Mutex> guard(&lock_);
@@ -27,10 +25,10 @@ void DefaultForegroundTaskRunner::Terminate() {
 }
 
 void DefaultForegroundTaskRunner::PostTaskLocked(
-    std::unique_ptr<Task> task, const base::LockGuard<base::Mutex>& guard) {
+    std::unique_ptr<Task> task, const base::LockGuard<base::Mutex>&) {
   if (terminated_) return;
   task_queue_.push(std::move(task));
-  event_loop_control_.Signal();
+  event_loop_control_.NotifyOne();
 }
 
 void DefaultForegroundTaskRunner::PostTask(std::unique_ptr<Task> task) {
@@ -62,7 +60,8 @@ bool DefaultForegroundTaskRunner::IdleTasksEnabled() {
   return idle_task_support_ == IdleTaskSupport::kEnabled;
 }
 
-std::unique_ptr<Task> DefaultForegroundTaskRunner::PopTaskFromQueue() {
+std::unique_ptr<Task> DefaultForegroundTaskRunner::PopTaskFromQueue(
+    MessageLoopBehavior wait_for_work) {
   base::LockGuard<base::Mutex> guard(&lock_);
   // Move delayed tasks that hit their deadline to the main queue.
   std::unique_ptr<Task> task = PopTaskFromDelayedQueueLocked(guard);
@@ -71,7 +70,10 @@ std::unique_ptr<Task> DefaultForegroundTaskRunner::PopTaskFromQueue() {
     task = PopTaskFromDelayedQueueLocked(guard);
   }
 
-  if (task_queue_.empty()) return {};
+  while (task_queue_.empty()) {
+    if (wait_for_work == MessageLoopBehavior::kDoNotWait) return {};
+    WaitForTaskLocked(guard);
+  }
 
   task = std::move(task_queue_.front());
   task_queue_.pop();
@@ -81,7 +83,7 @@ std::unique_ptr<Task> DefaultForegroundTaskRunner::PopTaskFromQueue() {
 
 std::unique_ptr<Task>
 DefaultForegroundTaskRunner::PopTaskFromDelayedQueueLocked(
-    const base::LockGuard<base::Mutex>& guard) {
+    const base::LockGuard<base::Mutex>&) {
   if (delayed_task_queue_.empty()) return {};
 
   double now = MonotonicallyIncreasingTime();
@@ -109,7 +111,10 @@ std::unique_ptr<IdleTask> DefaultForegroundTaskRunner::PopTaskFromIdleQueue() {
   return task;
 }
 
-void DefaultForegroundTaskRunner::WaitForTask() { event_loop_control_.Wait(); }
+void DefaultForegroundTaskRunner::WaitForTaskLocked(
+    const base::LockGuard<base::Mutex>&) {
+  event_loop_control_.Wait(&lock_);
+}
 
 }  // namespace platform
 }  // namespace v8
diff --git a/deps/v8/src/libplatform/default-foreground-task-runner.h b/deps/v8/src/libplatform/default-foreground-task-runner.h
index 7dfb4878283..a0869d0bc7f 100644
--- a/deps/v8/src/libplatform/default-foreground-task-runner.h
+++ b/deps/v8/src/libplatform/default-foreground-task-runner.h
@@ -9,8 +9,8 @@
 
 #include "include/libplatform/libplatform.h"
 #include "include/v8-platform.h"
+#include "src/base/platform/condition-variable.h"
 #include "src/base/platform/mutex.h"
-#include "src/base/platform/semaphore.h"
 
 namespace v8 {
 namespace platform {
@@ -25,11 +25,11 @@ class V8_PLATFORM_EXPORT DefaultForegroundTaskRunner
 
   void Terminate();
 
-  std::unique_ptr<Task> PopTaskFromQueue();
+  std::unique_ptr<Task> PopTaskFromQueue(MessageLoopBehavior wait_for_work);
 
   std::unique_ptr<IdleTask> PopTaskFromIdleQueue();
 
-  void WaitForTask();
+  void WaitForTaskLocked(const base::LockGuard<base::Mutex>&);
 
   double MonotonicallyIncreasingTime();
 
@@ -47,16 +47,16 @@ class V8_PLATFORM_EXPORT DefaultForegroundTaskRunner
   // The same as PostTask, but the lock is already held by the caller. The
   // {guard} parameter should make sure that the caller is holding the lock.
   void PostTaskLocked(std::unique_ptr<Task> task,
-                      const base::LockGuard<base::Mutex>& guard);
+                      const base::LockGuard<base::Mutex>&);
 
   // A caller of this function has to hold {lock_}. The {guard} parameter should
   // make sure that the caller is holding the lock.
   std::unique_ptr<Task> PopTaskFromDelayedQueueLocked(
-      const base::LockGuard<base::Mutex>& guard);
+      const base::LockGuard<base::Mutex>&);
 
   bool terminated_ = false;
   base::Mutex lock_;
-  base::Semaphore event_loop_control_;
+  base::ConditionVariable event_loop_control_;
   std::queue<std::unique_ptr<Task>> task_queue_;
   IdleTaskSupport idle_task_support_;
   std::queue<std::unique_ptr<IdleTask>> idle_task_queue_;
diff --git a/deps/v8/src/libplatform/default-platform.cc b/deps/v8/src/libplatform/default-platform.cc
index 39d9525effe..74975e71fa9 100644
--- a/deps/v8/src/libplatform/default-platform.cc
+++ b/deps/v8/src/libplatform/default-platform.cc
@@ -14,8 +14,8 @@
 #include "src/base/platform/platform.h"
 #include "src/base/platform/time.h"
 #include "src/base/sys-info.h"
-#include "src/libplatform/default-background-task-runner.h"
 #include "src/libplatform/default-foreground-task-runner.h"
+#include "src/libplatform/default-worker-threads-task-runner.h"
 
 namespace v8 {
 namespace platform {
@@ -96,7 +96,7 @@ DefaultPlatform::DefaultPlatform(
 
 DefaultPlatform::~DefaultPlatform() {
   base::LockGuard<base::Mutex> guard(&lock_);
-  if (background_task_runner_) background_task_runner_->Terminate();
+  if (worker_threads_task_runner_) worker_threads_task_runner_->Terminate();
   for (auto it : foreground_task_runner_map_) {
     it.second->Terminate();
   }
@@ -114,9 +114,9 @@ void DefaultPlatform::SetThreadPoolSize(int thread_pool_size) {
 
 void DefaultPlatform::EnsureBackgroundTaskRunnerInitialized() {
   base::LockGuard<base::Mutex> guard(&lock_);
-  if (!background_task_runner_) {
-    background_task_runner_ =
-        std::make_shared<DefaultBackgroundTaskRunner>(thread_pool_size_);
+  if (!worker_threads_task_runner_) {
+    worker_threads_task_runner_ =
+        std::make_shared<DefaultWorkerThreadsTaskRunner>(thread_pool_size_);
   }
 }
 
@@ -138,8 +138,8 @@ void DefaultPlatform::SetTimeFunctionForTesting(
 }
 
 bool DefaultPlatform::PumpMessageLoop(v8::Isolate* isolate,
-                                      MessageLoopBehavior behavior) {
-  bool failed_result = behavior == MessageLoopBehavior::kWaitForWork;
+                                      MessageLoopBehavior wait_for_work) {
+  bool failed_result = wait_for_work == MessageLoopBehavior::kWaitForWork;
   std::shared_ptr<DefaultForegroundTaskRunner> task_runner;
   {
     base::LockGuard<base::Mutex> guard(&lock_);
@@ -149,11 +149,8 @@ bool DefaultPlatform::PumpMessageLoop(v8::Isolate* isolate,
     }
     task_runner = foreground_task_runner_map_[isolate];
   }
-  if (behavior == MessageLoopBehavior::kWaitForWork) {
-    task_runner->WaitForTask();
-  }
 
-  std::unique_ptr<Task> task = task_runner->PopTaskFromQueue();
+  std::unique_ptr<Task> task = task_runner->PopTaskFromQueue(wait_for_work);
   if (!task) return failed_result;
 
   task->Run();
@@ -196,15 +193,14 @@ std::shared_ptr<TaskRunner> DefaultPlatform::GetForegroundTaskRunner(
   return foreground_task_runner_map_[isolate];
 }
 
-std::shared_ptr<TaskRunner> DefaultPlatform::GetBackgroundTaskRunner(
+std::shared_ptr<TaskRunner> DefaultPlatform::GetWorkerThreadsTaskRunner(
     v8::Isolate*) {
   EnsureBackgroundTaskRunnerInitialized();
-  return background_task_runner_;
+  return worker_threads_task_runner_;
 }
 
-void DefaultPlatform::CallOnBackgroundThread(Task* task,
-                                             ExpectedRuntime expected_runtime) {
-  GetBackgroundTaskRunner(nullptr)->PostTask(std::unique_ptr<Task>(task));
+void DefaultPlatform::CallOnWorkerThread(std::unique_ptr<Task> task) {
+  GetWorkerThreadsTaskRunner(nullptr)->PostTask(std::move(task));
 }
 
 void DefaultPlatform::CallOnForegroundThread(v8::Isolate* isolate, Task* task) {
@@ -248,9 +244,7 @@ void DefaultPlatform::SetTracingController(
   tracing_controller_ = std::move(tracing_controller);
 }
 
-size_t DefaultPlatform::NumberOfAvailableBackgroundThreads() {
-  return static_cast<size_t>(thread_pool_size_);
-}
+int DefaultPlatform::NumberOfWorkerThreads() { return thread_pool_size_; }
 
 Platform::StackTracePrinter DefaultPlatform::GetStackTracePrinter() {
   return PrintStackTrace;
diff --git a/deps/v8/src/libplatform/default-platform.h b/deps/v8/src/libplatform/default-platform.h
index b73f38a5feb..77a7a865869 100644
--- a/deps/v8/src/libplatform/default-platform.h
+++ b/deps/v8/src/libplatform/default-platform.h
@@ -26,7 +26,7 @@ namespace platform {
 class Thread;
 class WorkerThread;
 class DefaultForegroundTaskRunner;
-class DefaultBackgroundTaskRunner;
+class DefaultWorkerThreadsTaskRunner;
 class DefaultPageAllocator;
 
 class V8_PLATFORM_EXPORT DefaultPlatform : public NON_EXPORTED_BASE(Platform) {
@@ -55,13 +55,12 @@ class V8_PLATFORM_EXPORT DefaultPlatform : public NON_EXPORTED_BASE(Platform) {
   void SetTimeFunctionForTesting(TimeFunction time_function);
 
   // v8::Platform implementation.
-  size_t NumberOfAvailableBackgroundThreads() override;
+  int NumberOfWorkerThreads() override;
   std::shared_ptr<TaskRunner> GetForegroundTaskRunner(
       v8::Isolate* isolate) override;
-  std::shared_ptr<TaskRunner> GetBackgroundTaskRunner(
+  std::shared_ptr<TaskRunner> GetWorkerThreadsTaskRunner(
       v8::Isolate* isolate) override;
-  void CallOnBackgroundThread(Task* task,
-                              ExpectedRuntime expected_runtime) override;
+  void CallOnWorkerThread(std::unique_ptr<Task> task) override;
   void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override;
   void CallDelayedOnForegroundThread(Isolate* isolate, Task* task,
                                      double delay_in_seconds) override;
@@ -79,7 +78,7 @@ class V8_PLATFORM_EXPORT DefaultPlatform : public NON_EXPORTED_BASE(Platform) {
   base::Mutex lock_;
   int thread_pool_size_;
   IdleTaskSupport idle_task_support_;
-  std::shared_ptr<DefaultBackgroundTaskRunner> background_task_runner_;
+  std::shared_ptr<DefaultWorkerThreadsTaskRunner> worker_threads_task_runner_;
   std::map<v8::Isolate*, std::shared_ptr<DefaultForegroundTaskRunner>>
       foreground_task_runner_map_;
 
diff --git a/deps/v8/src/libplatform/default-background-task-runner.cc b/deps/v8/src/libplatform/default-worker-threads-task-runner.cc
similarity index 59%
rename from deps/v8/src/libplatform/default-background-task-runner.cc
rename to deps/v8/src/libplatform/default-worker-threads-task-runner.cc
index b556b6c3fec..bc2ebbd0154 100644
--- a/deps/v8/src/libplatform/default-background-task-runner.cc
+++ b/deps/v8/src/libplatform/default-worker-threads-task-runner.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/libplatform/default-background-task-runner.h"
+#include "src/libplatform/default-worker-threads-task-runner.h"
 
 #include "src/base/platform/mutex.h"
 #include "src/libplatform/worker-thread.h"
@@ -10,19 +10,19 @@
 namespace v8 {
 namespace platform {
 
-DefaultBackgroundTaskRunner::DefaultBackgroundTaskRunner(
+DefaultWorkerThreadsTaskRunner::DefaultWorkerThreadsTaskRunner(
     uint32_t thread_pool_size) {
   for (uint32_t i = 0; i < thread_pool_size; ++i) {
     thread_pool_.push_back(base::make_unique<WorkerThread>(&queue_));
   }
 }
 
-DefaultBackgroundTaskRunner::~DefaultBackgroundTaskRunner() {
+DefaultWorkerThreadsTaskRunner::~DefaultWorkerThreadsTaskRunner() {
   // This destructor is needed because we have unique_ptr to the WorkerThreads,
   // und the {WorkerThread} class is forward declared in the header file.
 }
 
-void DefaultBackgroundTaskRunner::Terminate() {
+void DefaultWorkerThreadsTaskRunner::Terminate() {
   base::LockGuard<base::Mutex> guard(&lock_);
   terminated_ = true;
   queue_.Terminate();
@@ -30,28 +30,29 @@ void DefaultBackgroundTaskRunner::Terminate() {
   thread_pool_.clear();
 }
 
-void DefaultBackgroundTaskRunner::PostTask(std::unique_ptr<Task> task) {
+void DefaultWorkerThreadsTaskRunner::PostTask(std::unique_ptr<Task> task) {
   base::LockGuard<base::Mutex> guard(&lock_);
   if (terminated_) return;
   queue_.Append(std::move(task));
 }
 
-void DefaultBackgroundTaskRunner::PostDelayedTask(std::unique_ptr<Task> task,
-                                                  double delay_in_seconds) {
+void DefaultWorkerThreadsTaskRunner::PostDelayedTask(std::unique_ptr<Task> task,
+                                                     double delay_in_seconds) {
   base::LockGuard<base::Mutex> guard(&lock_);
   if (terminated_) return;
-  // There is no use case for this function on a background thread at the
+  // There is no use case for this function on a worker thread at the
   // moment, but it is still part of the interface.
   UNIMPLEMENTED();
 }
 
-void DefaultBackgroundTaskRunner::PostIdleTask(std::unique_ptr<IdleTask> task) {
-  // There are no idle background tasks.
+void DefaultWorkerThreadsTaskRunner::PostIdleTask(
+    std::unique_ptr<IdleTask> task) {
+  // There are no idle worker tasks.
   UNREACHABLE();
 }
 
-bool DefaultBackgroundTaskRunner::IdleTasksEnabled() {
-  // There are no idle background tasks.
+bool DefaultWorkerThreadsTaskRunner::IdleTasksEnabled() {
+  // There are no idle worker tasks.
   return false;
 }
 
diff --git a/deps/v8/src/libplatform/default-background-task-runner.h b/deps/v8/src/libplatform/default-worker-threads-task-runner.h
similarity index 72%
rename from deps/v8/src/libplatform/default-background-task-runner.h
rename to deps/v8/src/libplatform/default-worker-threads-task-runner.h
index ce2f7efa05a..5e46e3dd41b 100644
--- a/deps/v8/src/libplatform/default-background-task-runner.h
+++ b/deps/v8/src/libplatform/default-worker-threads-task-runner.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_LIBPLATFORM_DEFAULT_BACKGROUND_TASK_RUNNER_H_
-#define V8_LIBPLATFORM_DEFAULT_BACKGROUND_TASK_RUNNER_H_
+#ifndef V8_LIBPLATFORM_DEFAULT_WORKER_THREADS_TASK_RUNNER_H_
+#define V8_LIBPLATFORM_DEFAULT_WORKER_THREADS_TASK_RUNNER_H_
 
 #include "include/v8-platform.h"
 #include "src/libplatform/task-queue.h"
@@ -14,12 +14,12 @@ namespace platform {
 class Thread;
 class WorkerThread;
 
-class V8_PLATFORM_EXPORT DefaultBackgroundTaskRunner
+class V8_PLATFORM_EXPORT DefaultWorkerThreadsTaskRunner
     : public NON_EXPORTED_BASE(TaskRunner) {
  public:
-  DefaultBackgroundTaskRunner(uint32_t thread_pool_size);
+  DefaultWorkerThreadsTaskRunner(uint32_t thread_pool_size);
 
-  ~DefaultBackgroundTaskRunner();
+  ~DefaultWorkerThreadsTaskRunner();
 
   void Terminate();
 
@@ -42,4 +42,4 @@ class V8_PLATFORM_EXPORT DefaultBackgroundTaskRunner
 
 }  // namespace platform
 }  // namespace v8
-#endif  // V8_LIBPLATFORM_DEFAULT_BACKGROUND_TASK_RUNNER_H_
+#endif  // V8_LIBPLATFORM_DEFAULT_WORKER_THREADS_TASK_RUNNER_H_
diff --git a/deps/v8/src/libplatform/tracing/trace-buffer.h b/deps/v8/src/libplatform/tracing/trace-buffer.h
index 16f3b2a12e7..3c756b7a699 100644
--- a/deps/v8/src/libplatform/tracing/trace-buffer.h
+++ b/deps/v8/src/libplatform/tracing/trace-buffer.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SRC_LIBPLATFORM_TRACING_TRACE_BUFFER_H_
-#define SRC_LIBPLATFORM_TRACING_TRACE_BUFFER_H_
+#ifndef V8_LIBPLATFORM_TRACING_TRACE_BUFFER_H_
+#define V8_LIBPLATFORM_TRACING_TRACE_BUFFER_H_
 
 #include <memory>
 #include <vector>
@@ -45,4 +45,4 @@ class TraceBufferRingBuffer : public TraceBuffer {
 }  // namespace platform
 }  // namespace v8
 
-#endif  // SRC_LIBPLATFORM_TRACING_TRACE_BUFFER_H_
+#endif  // V8_LIBPLATFORM_TRACING_TRACE_BUFFER_H_
diff --git a/deps/v8/src/libplatform/tracing/trace-writer.h b/deps/v8/src/libplatform/tracing/trace-writer.h
index 43d7cb6a906..7e1bdc24d68 100644
--- a/deps/v8/src/libplatform/tracing/trace-writer.h
+++ b/deps/v8/src/libplatform/tracing/trace-writer.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SRC_LIBPLATFORM_TRACING_TRACE_WRITER_H_
-#define SRC_LIBPLATFORM_TRACING_TRACE_WRITER_H_
+#ifndef V8_LIBPLATFORM_TRACING_TRACE_WRITER_H_
+#define V8_LIBPLATFORM_TRACING_TRACE_WRITER_H_
 
 #include "include/libplatform/v8-tracing.h"
 
@@ -30,4 +30,4 @@ class JSONTraceWriter : public TraceWriter {
 }  // namespace platform
 }  // namespace v8
 
-#endif  // SRC_LIBPLATFORM_TRACING_TRACE_WRITER_H_
+#endif  // V8_LIBPLATFORM_TRACING_TRACE_WRITER_H_
diff --git a/deps/v8/src/libsampler/sampler.cc b/deps/v8/src/libsampler/sampler.cc
index 75161fc7d69..492606475e9 100644
--- a/deps/v8/src/libsampler/sampler.cc
+++ b/deps/v8/src/libsampler/sampler.cc
@@ -4,7 +4,7 @@
 
 #include "src/libsampler/sampler.h"
 
-#if V8_OS_POSIX && !V8_OS_CYGWIN
+#if V8_OS_POSIX && !V8_OS_CYGWIN && !V8_OS_FUCHSIA
 
 #define USE_SIGNALS
 
@@ -13,7 +13,7 @@
 #include <signal.h>
 #include <sys/time.h>
 
-#if !V8_OS_QNX && !V8_OS_FUCHSIA && !V8_OS_AIX
+#if !V8_OS_QNX && !V8_OS_AIX
 #include <sys/syscall.h>  // NOLINT
 #endif
 
@@ -39,6 +39,28 @@
 
 #include "src/base/win32-headers.h"
 
+#elif V8_OS_FUCHSIA
+
+#include <zircon/process.h>
+#include <zircon/syscalls.h>
+#include <zircon/syscalls/debug.h>
+#include <zircon/types.h>
+
+// TODO(wez): Remove this once the Fuchsia SDK has rolled.
+#if defined(ZX_THREAD_STATE_REGSET0)
+#define ZX_THREAD_STATE_GENERAL_REGS ZX_THREAD_STATE_REGSET0
+zx_status_t zx_thread_read_state(zx_handle_t h, uint32_t k, void* b, size_t l) {
+  uint32_t dummy_out_len = 0;
+  return zx_thread_read_state(h, k, b, static_cast<uint32_t>(l),
+                              &dummy_out_len);
+}
+#if defined(__x86_64__)
+typedef zx_x86_64_general_regs_t zx_thread_state_general_regs_t;
+#else
+typedef zx_arm64_general_regs_t zx_thread_state_general_regs_t;
+#endif
+#endif  // !defined(ZX_THREAD_STATE_GENERAL_REGS)
+
 #endif
 
 #include <algorithm>
@@ -336,6 +358,28 @@ class Sampler::PlatformData {
  private:
   HANDLE profiled_thread_;
 };
+
+#elif V8_OS_FUCHSIA
+
+class Sampler::PlatformData {
+ public:
+  PlatformData() {
+    zx_handle_duplicate(zx_thread_self(), ZX_RIGHT_SAME_RIGHTS,
+                        &profiled_thread_);
+  }
+  ~PlatformData() {
+    if (profiled_thread_ != ZX_HANDLE_INVALID) {
+      zx_handle_close(profiled_thread_);
+      profiled_thread_ = ZX_HANDLE_INVALID;
+    }
+  }
+
+  zx_handle_t profiled_thread() { return profiled_thread_; }
+
+ private:
+  zx_handle_t profiled_thread_ = ZX_HANDLE_INVALID;
+};
+
 #endif  // USE_SIGNALS
 
 
@@ -415,7 +459,7 @@ void SignalHandler::FillRegisterState(void* context, RegisterState* state) {
 #if !(V8_OS_OPENBSD || (V8_OS_LINUX && (V8_HOST_ARCH_PPC || V8_HOST_ARCH_S390)))
   mcontext_t& mcontext = ucontext->uc_mcontext;
 #endif
-#if V8_OS_LINUX || V8_OS_FUCHSIA
+#if V8_OS_LINUX
 #if V8_HOST_ARCH_IA32
   state->pc = reinterpret_cast<void*>(mcontext.gregs[REG_EIP]);
   state->sp = reinterpret_cast<void*>(mcontext.gregs[REG_ESP]);
@@ -664,6 +708,53 @@ void Sampler::DoSample() {
   ResumeThread(profiled_thread);
 }
 
+#elif V8_OS_FUCHSIA
+
+void Sampler::DoSample() {
+  zx_handle_t profiled_thread = platform_data()->profiled_thread();
+  if (profiled_thread == ZX_HANDLE_INVALID) return;
+
+  if (zx_task_suspend(profiled_thread) != ZX_OK) return;
+
+  // Wait for the target thread to become suspended, or to exit.
+  // TODO(wez): There is currently no suspension count for threads, so there
+  // is a risk that some other caller resumes the thread in-between our suspend
+  // and wait calls, causing us to miss the SUSPENDED signal. We apply a 100ms
+  // deadline to protect against hanging the sampler thread in this case.
+  zx_signals_t signals = 0;
+  zx_status_t suspended = zx_object_wait_one(
+      profiled_thread, ZX_THREAD_SUSPENDED | ZX_THREAD_TERMINATED,
+      zx_deadline_after(ZX_MSEC(100)), &signals);
+  if (suspended != ZX_OK || (signals & ZX_THREAD_SUSPENDED) == 0) {
+    zx_task_resume(profiled_thread, 0);
+    return;
+  }
+
+  // Fetch a copy of its "general register" states.
+  zx_thread_state_general_regs_t thread_state = {};
+  if (zx_thread_read_state(profiled_thread, ZX_THREAD_STATE_GENERAL_REGS,
+                           &thread_state, sizeof(thread_state)) == ZX_OK) {
+    v8::RegisterState state;
+#if V8_HOST_ARCH_X64
+    state.pc = reinterpret_cast<void*>(thread_state.rip);
+    state.sp = reinterpret_cast<void*>(thread_state.rsp);
+    state.fp = reinterpret_cast<void*>(thread_state.rbp);
+#elif V8_HOST_ARCH_ARM64
+    state.pc = reinterpret_cast<void*>(thread_state.pc);
+    state.sp = reinterpret_cast<void*>(thread_state.sp);
+    state.fp = reinterpret_cast<void*>(thread_state.r[29]);
+#endif
+    SampleStack(state);
+  }
+
+  zx_task_resume(profiled_thread, 0);
+}
+
+// TODO(wez): Remove this once the Fuchsia SDK has rolled.
+#if defined(ZX_THREAD_STATE_REGSET0)
+#undef ZX_THREAD_STATE_GENERAL_REGS
+#endif
+
 #endif  // USE_SIGNALS
 
 }  // namespace sampler
diff --git a/deps/v8/src/locked-queue-inl.h b/deps/v8/src/locked-queue-inl.h
index 31e8bd2fd83..65c8736d7ae 100644
--- a/deps/v8/src/locked-queue-inl.h
+++ b/deps/v8/src/locked-queue-inl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_LOCKED_QUEUE_INL_
-#define V8_LOCKED_QUEUE_INL_
+#ifndef V8_LOCKED_QUEUE_INL_H_
+#define V8_LOCKED_QUEUE_INL_H_
 
 #include "src/base/atomic-utils.h"
 #include "src/locked-queue.h"
@@ -88,4 +88,4 @@ inline bool LockedQueue<Record>::Peek(Record* record) const {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_LOCKED_QUEUE_INL_
+#endif  // V8_LOCKED_QUEUE_INL_H_
diff --git a/deps/v8/src/locked-queue.h b/deps/v8/src/locked-queue.h
index 5bb97c8a125..1667917329c 100644
--- a/deps/v8/src/locked-queue.h
+++ b/deps/v8/src/locked-queue.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_LOCKED_QUEUE_
-#define V8_LOCKED_QUEUE_
+#ifndef V8_LOCKED_QUEUE_H_
+#define V8_LOCKED_QUEUE_H_
 
 #include "src/allocation.h"
 #include "src/base/platform/platform.h"
@@ -40,4 +40,4 @@ class LockedQueue final BASE_EMBEDDED {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_LOCKED_QUEUE_
+#endif  // V8_LOCKED_QUEUE_H_
diff --git a/deps/v8/src/log-utils.h b/deps/v8/src/log-utils.h
index feb14ea1a00..9f530293d4d 100644
--- a/deps/v8/src/log-utils.h
+++ b/deps/v8/src/log-utils.h
@@ -32,7 +32,7 @@ class Log {
   static bool InitLogAtStart() {
     return FLAG_log || FLAG_log_api || FLAG_log_code || FLAG_log_handles ||
            FLAG_log_suspect || FLAG_ll_prof || FLAG_perf_basic_prof ||
-           FLAG_perf_prof || FLAG_log_source_code ||
+           FLAG_perf_prof || FLAG_log_source_code || FLAG_gdbjit ||
            FLAG_log_internal_timer_events || FLAG_prof_cpp || FLAG_trace_ic ||
            FLAG_log_function_events;
   }
@@ -83,7 +83,7 @@ class Log {
     void AppendCharacter(const char character);
 
     // Delegate insertion to the underlying {log_}.
-    // All appened srings are escaped to maintain one-line log entries.
+    // All appended strings are escaped to maintain one-line log entries.
     template <typename T>
     MessageBuilder& operator<<(T value) {
       log_->os_ << value;
diff --git a/deps/v8/src/log.cc b/deps/v8/src/log.cc
index f5d5be68482..22a28382f9a 100644
--- a/deps/v8/src/log.cc
+++ b/deps/v8/src/log.cc
@@ -16,6 +16,7 @@
 #include "src/counters.h"
 #include "src/deoptimizer.h"
 #include "src/global-handles.h"
+#include "src/instruction-stream.h"
 #include "src/interpreter/bytecodes.h"
 #include "src/interpreter/interpreter.h"
 #include "src/libsampler/sampler.h"
@@ -30,6 +31,8 @@
 #include "src/tracing/tracing-category-observer.h"
 #include "src/unicode-inl.h"
 #include "src/vm-state-inl.h"
+#include "src/wasm/wasm-code-manager.h"
+#include "src/wasm/wasm-objects-inl.h"
 
 #include "src/utils.h"
 #include "src/version.h"
@@ -54,6 +57,16 @@ static const char* ComputeMarker(SharedFunctionInfo* shared,
   }
 }
 
+static const char* ComputeMarker(const wasm::WasmCode* code) {
+  switch (code->kind()) {
+    case wasm::WasmCode::kFunction:
+      return code->is_liftoff() ? "" : "*";
+    case wasm::WasmCode::kInterpreterStub:
+      return "~";
+    default:
+      return "";
+  }
+}
 
 class CodeEventLogger::NameBuffer {
  public:
@@ -200,6 +213,24 @@ void CodeEventLogger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   LogRecordedBuffer(code, shared, name_buffer_->get(), name_buffer_->size());
 }
 
+void CodeEventLogger::CodeCreateEvent(LogEventsAndTags tag,
+                                      const wasm::WasmCode* code,
+                                      wasm::WasmName name) {
+  name_buffer_->Init(tag);
+  if (name.is_empty()) {
+    name_buffer_->AppendBytes("<wasm-unknown>");
+  } else {
+    name_buffer_->AppendBytes(name.start(), name.length());
+  }
+  name_buffer_->AppendByte('-');
+  if (code->IsAnonymous()) {
+    name_buffer_->AppendBytes("<anonymous>");
+  } else {
+    name_buffer_->AppendInt(code->index());
+  }
+  LogRecordedBuffer(code, name_buffer_->get(), name_buffer_->size());
+}
+
 void CodeEventLogger::RegExpCodeCreateEvent(AbstractCode* code,
                                             String* source) {
   name_buffer_->Init(CodeEventListener::REG_EXP_TAG);
@@ -207,7 +238,6 @@ void CodeEventLogger::RegExpCodeCreateEvent(AbstractCode* code,
   LogRecordedBuffer(code, nullptr, name_buffer_->get(), name_buffer_->size());
 }
 
-
 // Linux perf tool logging support
 class PerfBasicLogger : public CodeEventLogger {
  public:
@@ -221,6 +251,10 @@ class PerfBasicLogger : public CodeEventLogger {
  private:
   void LogRecordedBuffer(AbstractCode* code, SharedFunctionInfo* shared,
                          const char* name, int length) override;
+  void LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
+                         int length) override;
+  void WriteLogRecordedBuffer(uintptr_t address, int size, const char* name,
+                              int name_length);
 
   // Extension added to V8 log file name to get the low-level log name.
   static const char kFilenameFormatString[];
@@ -254,6 +288,19 @@ PerfBasicLogger::~PerfBasicLogger() {
   perf_output_handle_ = nullptr;
 }
 
+void PerfBasicLogger::WriteLogRecordedBuffer(uintptr_t address, int size,
+                                             const char* name,
+                                             int name_length) {
+  // Linux perf expects hex literals without a leading 0x, while some
+  // implementations of printf might prepend one when using the %p format
+  // for pointers, leading to wrongly formatted JIT symbols maps.
+  //
+  // Instead, we use V8PRIxPTR format string and cast pointer to uintpr_t,
+  // so that we have control over the exact output format.
+  base::OS::FPrint(perf_output_handle_, "%" V8PRIxPTR " %x %.*s\n", address,
+                   size, name_length, name);
+}
+
 void PerfBasicLogger::LogRecordedBuffer(AbstractCode* code, SharedFunctionInfo*,
                                         const char* name, int length) {
   if (FLAG_perf_basic_prof_only_functions &&
@@ -262,15 +309,15 @@ void PerfBasicLogger::LogRecordedBuffer(AbstractCode* code, SharedFunctionInfo*,
     return;
   }
 
-  // Linux perf expects hex literals without a leading 0x, while some
-  // implementations of printf might prepend one when using the %p format
-  // for pointers, leading to wrongly formatted JIT symbols maps.
-  //
-  // Instead, we use V8PRIxPTR format string and cast pointer to uintpr_t,
-  // so that we have control over the exact output format.
-  base::OS::FPrint(perf_output_handle_, "%" V8PRIxPTR " %x %.*s\n",
-                   reinterpret_cast<uintptr_t>(code->instruction_start()),
-                   code->instruction_size(), length, name);
+  WriteLogRecordedBuffer(reinterpret_cast<uintptr_t>(code->instruction_start()),
+                         code->instruction_size(), name, length);
+}
+
+void PerfBasicLogger::LogRecordedBuffer(const wasm::WasmCode* code,
+                                        const char* name, int length) {
+  WriteLogRecordedBuffer(
+      reinterpret_cast<uintptr_t>(code->instructions().start()),
+      code->instructions().length(), name, length);
 }
 
 // Low-level logging support.
@@ -290,6 +337,8 @@ class LowLevelLogger : public CodeEventLogger {
  private:
   void LogRecordedBuffer(AbstractCode* code, SharedFunctionInfo* shared,
                          const char* name, int length) override;
+  void LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
+                         int length) override;
 
   // Low-level profiling event structures.
   struct CodeCreateStruct {
@@ -386,6 +435,18 @@ void LowLevelLogger::LogRecordedBuffer(AbstractCode* code, SharedFunctionInfo*,
       code->instruction_size());
 }
 
+void LowLevelLogger::LogRecordedBuffer(const wasm::WasmCode* code,
+                                       const char* name, int length) {
+  CodeCreateStruct event;
+  event.name_size = length;
+  event.code_address = code->instructions().start();
+  event.code_size = code->instructions().length();
+  LogWriteStruct(event);
+  LogWriteBytes(name, length);
+  LogWriteBytes(reinterpret_cast<const char*>(code->instructions().start()),
+                code->instructions().length());
+}
+
 void LowLevelLogger::CodeMoveEvent(AbstractCode* from, Address to) {
   CodeMoveStruct event;
   event.from_address = from->instruction_start();
@@ -425,6 +486,8 @@ class JitLogger : public CodeEventLogger {
  private:
   void LogRecordedBuffer(AbstractCode* code, SharedFunctionInfo* shared,
                          const char* name, int length) override;
+  void LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
+                         int length) override;
 
   JitCodeEventHandler code_event_handler_;
   base::Mutex logger_mutex_;
@@ -442,6 +505,8 @@ void JitLogger::LogRecordedBuffer(AbstractCode* code,
   memset(&event, 0, sizeof(event));
   event.type = JitCodeEvent::CODE_ADDED;
   event.code_start = code->instruction_start();
+  event.code_type =
+      code->IsCode() ? JitCodeEvent::JIT_CODE : JitCodeEvent::BYTE_CODE;
   event.code_len = code->instruction_size();
   Handle<SharedFunctionInfo> shared_function_handle;
   if (shared && shared->script()->IsScript()) {
@@ -453,11 +518,26 @@ void JitLogger::LogRecordedBuffer(AbstractCode* code,
   code_event_handler_(&event);
 }
 
+void JitLogger::LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
+                                  int length) {
+  JitCodeEvent event;
+  memset(&event, 0, sizeof(event));
+  event.type = JitCodeEvent::CODE_ADDED;
+  event.code_type = JitCodeEvent::JIT_CODE;
+  event.code_start = code->instructions().start();
+  event.code_len = code->instructions().length();
+  event.name.str = name;
+  event.name.len = length;
+  code_event_handler_(&event);
+}
+
 void JitLogger::CodeMoveEvent(AbstractCode* from, Address to) {
   base::LockGuard<base::Mutex> guard(&logger_mutex_);
 
   JitCodeEvent event;
   event.type = JitCodeEvent::CODE_MOVED;
+  event.code_type =
+      from->IsCode() ? JitCodeEvent::JIT_CODE : JitCodeEvent::BYTE_CODE;
   event.code_start = from->instruction_start();
   event.code_len = from->instruction_size();
 
@@ -979,12 +1059,20 @@ namespace {
 
 void AppendCodeCreateHeader(Log::MessageBuilder& msg,
                             CodeEventListener::LogEventsAndTags tag,
-                            AbstractCode* code, base::ElapsedTimer* timer) {
+                            AbstractCode::Kind kind, uint8_t* address, int size,
+                            base::ElapsedTimer* timer) {
   msg << kLogEventsNames[CodeEventListener::CODE_CREATION_EVENT]
-      << Logger::kNext << kLogEventsNames[tag] << Logger::kNext << code->kind()
+      << Logger::kNext << kLogEventsNames[tag] << Logger::kNext << kind
       << Logger::kNext << timer->Elapsed().InMicroseconds() << Logger::kNext
-      << reinterpret_cast<void*>(code->instruction_start()) << Logger::kNext
-      << code->instruction_size() << Logger::kNext;
+      << reinterpret_cast<void*>(address) << Logger::kNext << size
+      << Logger::kNext;
+}
+
+void AppendCodeCreateHeader(Log::MessageBuilder& msg,
+                            CodeEventListener::LogEventsAndTags tag,
+                            AbstractCode* code, base::ElapsedTimer* timer) {
+  AppendCodeCreateHeader(msg, tag, code->kind(), code->InstructionStart(),
+                         code->InstructionSize(), timer);
 }
 
 }  // namespace
@@ -1026,6 +1114,29 @@ void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   msg.WriteToLogFile();
 }
 
+void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
+                             const wasm::WasmCode* code, wasm::WasmName name) {
+  if (!is_logging_code_events()) return;
+  if (!FLAG_log_code || !log_->IsEnabled()) return;
+  Log::MessageBuilder msg(log_);
+  AppendCodeCreateHeader(msg, tag, AbstractCode::Kind::WASM_FUNCTION,
+                         code->instructions().start(),
+                         code->instructions().length(), &timer_);
+  if (name.is_empty()) {
+    msg << "<unknown wasm>";
+  } else {
+    msg.AppendStringPart(name.start(), name.length());
+  }
+  // We have to add two extra fields that allow the tick processor to group
+  // events for the same wasm function, even if it gets compiled again. For
+  // normal JS functions, we use the shared function info. For wasm, the pointer
+  // to the native module + function index works well enough.
+  // TODO(herhut) Clean up the tick processor code instead.
+  void* tag_ptr =
+      reinterpret_cast<byte*>(code->native_module()) + code->index();
+  msg << kNext << tag_ptr << kNext << ComputeMarker(code);
+  msg.WriteToLogFile();
+}
 
 // Although, it is possible to extract source and line from
 // the SharedFunctionInfo object, we left it to caller
@@ -1093,7 +1204,7 @@ void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   //      S<shared-function-info-address>
   msg << "code-source-info" << kNext
       << static_cast<void*>(code->instruction_start()) << kNext << script_id
-      << kNext << shared->start_position() << kNext << shared->end_position()
+      << kNext << shared->StartPosition() << kNext << shared->EndPosition()
       << kNext;
 
   SourcePositionTableIterator iterator(code->source_position_table());
@@ -1179,26 +1290,41 @@ void Logger::CodeMoveEvent(AbstractCode* from, Address to) {
   MoveEventInternal(CodeEventListener::CODE_MOVE_EVENT, from->address(), to);
 }
 
-void Logger::CodeLinePosInfoRecordEvent(Address code_start,
-                                        ByteArray* source_position_table) {
-  if (jit_logger_) {
-    void* jit_handler_data = jit_logger_->StartCodePosInfoEvent();
-    for (SourcePositionTableIterator iter(source_position_table); !iter.done();
-         iter.Advance()) {
+namespace {
+
+void CodeLinePosEvent(JitLogger* jit_logger, Address code_start,
+                      SourcePositionTableIterator& iter) {
+  if (jit_logger) {
+    void* jit_handler_data = jit_logger->StartCodePosInfoEvent();
+    for (; !iter.done(); iter.Advance()) {
       if (iter.is_statement()) {
-        jit_logger_->AddCodeLinePosInfoEvent(
+        jit_logger->AddCodeLinePosInfoEvent(
             jit_handler_data, iter.code_offset(),
             iter.source_position().ScriptOffset(),
             JitCodeEvent::STATEMENT_POSITION);
       }
-      jit_logger_->AddCodeLinePosInfoEvent(
-          jit_handler_data, iter.code_offset(),
-          iter.source_position().ScriptOffset(), JitCodeEvent::POSITION);
+      jit_logger->AddCodeLinePosInfoEvent(jit_handler_data, iter.code_offset(),
+                                          iter.source_position().ScriptOffset(),
+                                          JitCodeEvent::POSITION);
     }
-    jit_logger_->EndCodePosInfoEvent(code_start, jit_handler_data);
+    jit_logger->EndCodePosInfoEvent(code_start, jit_handler_data);
   }
 }
 
+}  // namespace
+
+void Logger::CodeLinePosInfoRecordEvent(Address code_start,
+                                        ByteArray* source_position_table) {
+  SourcePositionTableIterator iter(source_position_table);
+  CodeLinePosEvent(jit_logger_, code_start, iter);
+}
+
+void Logger::CodeLinePosInfoRecordEvent(
+    Address code_start, Vector<const byte> source_position_table) {
+  SourcePositionTableIterator iter(source_position_table);
+  CodeLinePosEvent(jit_logger_, code_start, iter);
+}
+
 void Logger::CodeNameEvent(Address addr, int pos, const char* code_name) {
   if (code_name == nullptr) return;  // Not a code object.
   Log::MessageBuilder msg(log_);
@@ -1452,19 +1578,9 @@ static int EnumerateCompiledFunctions(Heap* heap,
       if (sfi->is_compiled() &&
           (!sfi->script()->IsScript() ||
            Script::cast(sfi->script())->HasValidSource())) {
-        // In some cases, an SFI might have (and have executing!) both bytecode
-        // and baseline code, so check for both and add them both if needed.
-        if (sfi->HasBytecodeArray()) {
-          AddFunctionAndCode(sfi, AbstractCode::cast(sfi->bytecode_array()),
-                             sfis, code_objects, compiled_funcs_count);
-          ++compiled_funcs_count;
-        }
-
-        if (!sfi->IsInterpreted()) {
-          AddFunctionAndCode(sfi, AbstractCode::cast(sfi->code()), sfis,
-                             code_objects, compiled_funcs_count);
-          ++compiled_funcs_count;
-        }
+        AddFunctionAndCode(sfi, AbstractCode::cast(sfi->abstract_code()), sfis,
+                           code_objects, compiled_funcs_count);
+        ++compiled_funcs_count;
       }
     } else if (obj->IsJSFunction()) {
       // Given that we no longer iterate over all optimized JSFunctions, we need
@@ -1489,6 +1605,24 @@ static int EnumerateCompiledFunctions(Heap* heap,
   return compiled_funcs_count;
 }
 
+static int EnumerateWasmModules(Heap* heap,
+                                Handle<WasmCompiledModule>* modules) {
+  HeapIterator iterator(heap);
+  DisallowHeapAllocation no_gc;
+  int wasm_modules_count = 0;
+
+  for (HeapObject* obj = iterator.next(); obj != nullptr;
+       obj = iterator.next()) {
+    if (obj->IsWasmCompiledModule()) {
+      WasmCompiledModule* module = WasmCompiledModule::cast(obj);
+      if (modules != nullptr) {
+        modules[wasm_modules_count] = Handle<WasmCompiledModule>(module);
+      }
+      wasm_modules_count++;
+    }
+  }
+  return wasm_modules_count;
+}
 
 void Logger::LogCodeObject(Object* object) {
   AbstractCode* code_object = AbstractCode::cast(object);
@@ -1517,7 +1651,7 @@ void Logger::LogCodeObject(Object* object) {
       break;
     case AbstractCode::WASM_FUNCTION:
       description = "A Wasm function";
-      tag = CodeEventListener::STUB_TAG;
+      tag = CodeEventListener::FUNCTION_TAG;
       break;
     case AbstractCode::JS_TO_WASM_FUNCTION:
       description = "A JavaScript to Wasm adapter";
@@ -1545,7 +1679,6 @@ void Logger::LogCodeObject(Object* object) {
   PROFILE(isolate_, CodeCreateEvent(tag, code_object, description));
 }
 
-
 void Logger::LogCodeObjects() {
   Heap* heap = isolate_->heap();
   HeapIterator iterator(heap);
@@ -1592,9 +1725,9 @@ void Logger::LogExistingFunction(Handle<SharedFunctionInfo> shared,
                                  Handle<AbstractCode> code) {
   if (shared->script()->IsScript()) {
     Handle<Script> script(Script::cast(shared->script()));
-    int line_num = Script::GetLineNumber(script, shared->start_position()) + 1;
+    int line_num = Script::GetLineNumber(script, shared->StartPosition()) + 1;
     int column_num =
-        Script::GetColumnNumber(script, shared->start_position()) + 1;
+        Script::GetColumnNumber(script, shared->StartPosition()) + 1;
     if (script->name()->IsString()) {
       Handle<String> script_name(String::cast(script->name()));
       if (line_num > 0) {
@@ -1637,13 +1770,12 @@ void Logger::LogExistingFunction(Handle<SharedFunctionInfo> shared,
   }
 }
 
-
 void Logger::LogCompiledFunctions() {
   Heap* heap = isolate_->heap();
   HandleScope scope(isolate_);
   const int compiled_funcs_count =
       EnumerateCompiledFunctions(heap, nullptr, nullptr);
-  ScopedVector< Handle<SharedFunctionInfo> > sfis(compiled_funcs_count);
+  ScopedVector<Handle<SharedFunctionInfo>> sfis(compiled_funcs_count);
   ScopedVector<Handle<AbstractCode> > code_objects(compiled_funcs_count);
   EnumerateCompiledFunctions(heap, sfis.start(), code_objects.start());
 
@@ -1654,8 +1786,14 @@ void Logger::LogCompiledFunctions() {
       continue;
     LogExistingFunction(sfis[i], code_objects[i]);
   }
-}
 
+  const int compiled_wasm_modules_count = EnumerateWasmModules(heap, nullptr);
+  ScopedVector<Handle<WasmCompiledModule>> modules(compiled_wasm_modules_count);
+  EnumerateWasmModules(heap, modules.start());
+  for (int i = 0; i < compiled_wasm_modules_count; ++i) {
+    modules[i]->LogWasmCodes(isolate_);
+  }
+}
 
 void Logger::LogAccessorCallbacks() {
   Heap* heap = isolate_->heap();
diff --git a/deps/v8/src/log.h b/deps/v8/src/log.h
index 8305eb10017..6f3e1f244a8 100644
--- a/deps/v8/src/log.h
+++ b/deps/v8/src/log.h
@@ -74,6 +74,11 @@ class Profiler;
 class ProfilerListener;
 class RuntimeCallTimer;
 class Ticker;
+class WasmCompiledModule;
+
+namespace wasm {
+class WasmCode;
+}
 
 #undef LOG
 #define LOG(isolate, Call)                              \
@@ -176,6 +181,8 @@ class Logger : public CodeEventListener {
   void CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
                        AbstractCode* code, SharedFunctionInfo* shared,
                        Name* source, int line, int column);
+  void CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
+                       const wasm::WasmCode* code, wasm::WasmName name);
   // Emits a code deoptimization event.
   void CodeDisableOptEvent(AbstractCode* code, SharedFunctionInfo* shared);
   void CodeMovingGCEvent();
@@ -186,6 +193,8 @@ class Logger : public CodeEventListener {
   // Emits a code line info record event.
   void CodeLinePosInfoRecordEvent(Address code_start,
                                   ByteArray* source_position_table);
+  void CodeLinePosInfoRecordEvent(Address code_start,
+                                  Vector<const byte> source_position_table);
 
   void SharedFunctionInfoMoveEvent(Address from, Address to);
 
@@ -234,6 +243,7 @@ class Logger : public CodeEventListener {
 
   void LogExistingFunction(Handle<SharedFunctionInfo> shared,
                            Handle<AbstractCode> code);
+  void LogCompiledModule(Handle<WasmCompiledModule> module);
   // Logs all compiled functions found in the heap.
   void LogCompiledFunctions();
   // Logs all accessor callbacks found in the heap.
@@ -379,8 +389,10 @@ class CodeEventLogger : public CodeEventListener {
   void CodeCreateEvent(LogEventsAndTags tag, AbstractCode* code,
                        SharedFunctionInfo* shared, Name* source, int line,
                        int column) override;
-  void RegExpCodeCreateEvent(AbstractCode* code, String* source) override;
+  void CodeCreateEvent(LogEventsAndTags tag, const wasm::WasmCode* code,
+                       wasm::WasmName name) override;
 
+  void RegExpCodeCreateEvent(AbstractCode* code, String* source) override;
   void CallbackEvent(Name* name, Address entry_point) override {}
   void GetterCallbackEvent(Name* name, Address entry_point) override {}
   void SetterCallbackEvent(Name* name, Address entry_point) override {}
@@ -394,6 +406,8 @@ class CodeEventLogger : public CodeEventListener {
 
   virtual void LogRecordedBuffer(AbstractCode* code, SharedFunctionInfo* shared,
                                  const char* name, int length) = 0;
+  virtual void LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
+                                 int length) = 0;
 
   NameBuffer* name_buffer_;
 };
diff --git a/deps/v8/src/lookup.cc b/deps/v8/src/lookup.cc
index 71902dff848..409b90bd6a0 100644
--- a/deps/v8/src/lookup.cc
+++ b/deps/v8/src/lookup.cc
@@ -77,9 +77,13 @@ LookupIterator LookupIterator::PropertyOrElement(Isolate* isolate,
 // static
 LookupIterator LookupIterator::ForTransitionHandler(
     Isolate* isolate, Handle<Object> receiver, Handle<Name> name,
-    Handle<Object> value, MaybeHandle<Object> handler,
-    Handle<Map> transition_map) {
-  if (handler.is_null()) return LookupIterator(receiver, name);
+    Handle<Object> value, MaybeHandle<Map> maybe_transition_map) {
+  Handle<Map> transition_map;
+  if (!maybe_transition_map.ToHandle(&transition_map) ||
+      !transition_map->IsPrototypeValidityCellValid()) {
+    // This map is not a valid transition handler, so full lookup is required.
+    return LookupIterator(receiver, name);
+  }
 
   PropertyDetails details = PropertyDetails::Empty();
   bool has_property;
@@ -90,6 +94,13 @@ LookupIterator LookupIterator::ForTransitionHandler(
     details = transition_map->GetLastDescriptorDetails();
     has_property = true;
   }
+#ifdef DEBUG
+  if (name->IsPrivate()) {
+    DCHECK_EQ(DONT_ENUM, details.attributes());
+  } else {
+    DCHECK_EQ(NONE, details.attributes());
+  }
+#endif
   LookupIterator it(isolate, receiver, name, transition_map, details,
                     has_property);
 
@@ -211,8 +222,7 @@ Handle<JSReceiver> LookupIterator::GetRootForNonJSReceiver(
   auto root =
       handle(receiver->GetPrototypeChainRootMap(isolate)->prototype(), isolate);
   if (root->IsNull(isolate)) {
-    unsigned int magic = 0xBBBBBBBB;
-    isolate->PushStackTraceAndDie(magic, *receiver, nullptr, magic);
+    isolate->PushStackTraceAndDie(*receiver);
   }
   return Handle<JSReceiver>::cast(root);
 }
@@ -238,6 +248,7 @@ void LookupIterator::ReloadPropertyInformation() {
 }
 
 namespace {
+
 bool IsTypedArrayFunctionInAnyContext(Isolate* isolate, JSReceiver* holder) {
   static uint32_t context_slots[] = {
 #define TYPED_ARRAY_CONTEXT_SLOTS(Type, type, TYPE, ctype, size) \
@@ -253,43 +264,57 @@ bool IsTypedArrayFunctionInAnyContext(Isolate* isolate, JSReceiver* holder) {
       std::begin(context_slots), std::end(context_slots),
       [=](uint32_t slot) { return isolate->IsInAnyContext(holder, slot); });
 }
+
 }  // namespace
 
 void LookupIterator::InternalUpdateProtector() {
   if (isolate_->bootstrapper()->IsActive()) return;
 
   if (*name_ == heap()->constructor_string()) {
-    if (!isolate_->IsArraySpeciesLookupChainIntact()) return;
+    if (!isolate_->IsSpeciesLookupChainIntact()) return;
     // Setting the constructor property could change an instance's @@species
-    if (holder_->IsJSArray() || holder_->IsJSTypedArray()) {
+    if (holder_->IsJSArray() || holder_->IsJSPromise() ||
+        holder_->IsJSTypedArray()) {
       isolate_->CountUsage(
           v8::Isolate::UseCounterFeature::kArrayInstanceConstructorModified);
-      isolate_->InvalidateArraySpeciesProtector();
+      isolate_->InvalidateSpeciesProtector();
     } else if (holder_->map()->is_prototype_map()) {
       DisallowHeapAllocation no_gc;
-      // Setting the constructor of Array.prototype or %TypedArray%.prototype of
-      // any realm also needs to invalidate the species protector.
+      // Setting the constructor of Array.prototype, Promise.prototype or
+      // %TypedArray%.prototype of any realm also needs to invalidate the
+      // @@species protector.
       // For typed arrays, we check a prototype of this holder since TypedArrays
       // have different prototypes for each type, and their parent prototype is
       // pointing the same TYPED_ARRAY_PROTOTYPE.
       if (isolate_->IsInAnyContext(*holder_,
                                    Context::INITIAL_ARRAY_PROTOTYPE_INDEX) ||
+          isolate_->IsInAnyContext(*holder_,
+                                   Context::PROMISE_PROTOTYPE_INDEX) ||
           isolate_->IsInAnyContext(holder_->map()->prototype(),
                                    Context::TYPED_ARRAY_PROTOTYPE_INDEX)) {
         isolate_->CountUsage(v8::Isolate::UseCounterFeature::
                                  kArrayPrototypeConstructorModified);
-        isolate_->InvalidateArraySpeciesProtector();
+        isolate_->InvalidateSpeciesProtector();
       }
     }
+  } else if (*name_ == heap()->next_string()) {
+    if (!isolate_->IsArrayIteratorLookupChainIntact()) return;
+    // Setting the next property of %ArrayIteratorPrototype% also needs to
+    // invalidate the array iterator protector.
+    if (isolate_->IsInAnyContext(
+            *holder_, Context::INITIAL_ARRAY_ITERATOR_PROTOTYPE_INDEX)) {
+      isolate_->InvalidateArrayIteratorProtector();
+    }
   } else if (*name_ == heap()->species_symbol()) {
-    if (!isolate_->IsArraySpeciesLookupChainIntact()) return;
-    // Setting the Symbol.species property of any Array or TypedArray
-    // constructor invalidates the species protector
+    if (!isolate_->IsSpeciesLookupChainIntact()) return;
+    // Setting the Symbol.species property of any Array, Promise or TypedArray
+    // constructor invalidates the @@species protector
     if (isolate_->IsInAnyContext(*holder_, Context::ARRAY_FUNCTION_INDEX) ||
+        isolate_->IsInAnyContext(*holder_, Context::PROMISE_FUNCTION_INDEX) ||
         IsTypedArrayFunctionInAnyContext(isolate_, *holder_)) {
       isolate_->CountUsage(
           v8::Isolate::UseCounterFeature::kArraySpeciesModified);
-      isolate_->InvalidateArraySpeciesProtector();
+      isolate_->InvalidateSpeciesProtector();
     }
   } else if (*name_ == heap()->is_concat_spreadable_symbol()) {
     if (!isolate_->IsIsConcatSpreadableLookupChainIntact()) return;
@@ -299,6 +324,28 @@ void LookupIterator::InternalUpdateProtector() {
     if (holder_->IsJSArray()) {
       isolate_->InvalidateArrayIteratorProtector();
     }
+  } else if (*name_ == heap()->resolve_string()) {
+    if (!isolate_->IsPromiseResolveLookupChainIntact()) return;
+    // Setting the "resolve" property on any %Promise% intrinsic object
+    // invalidates the Promise.resolve protector.
+    if (isolate_->IsInAnyContext(*holder_, Context::PROMISE_FUNCTION_INDEX)) {
+      isolate_->InvalidatePromiseResolveProtector();
+    }
+  } else if (*name_ == heap()->then_string()) {
+    if (!isolate_->IsPromiseThenLookupChainIntact()) return;
+    // Setting the "then" property on any JSPromise instance or on the
+    // initial %PromisePrototype% invalidates the Promise#then protector.
+    // Also setting the "then" property on the initial %ObjectPrototype%
+    // invalidates the Promise#then protector, since we use this protector
+    // to guard the fast-path in AsyncGeneratorResolve, where we can skip
+    // the ResolvePromise step and go directly to FulfillPromise if we
+    // know that the Object.prototype doesn't contain a "then" method.
+    if (holder_->IsJSPromise() ||
+        isolate_->IsInAnyContext(*holder_,
+                                 Context::INITIAL_OBJECT_PROTOTYPE_INDEX) ||
+        isolate_->IsInAnyContext(*holder_, Context::PROMISE_PROTOTYPE_INDEX)) {
+      isolate_->InvalidatePromiseThenProtector();
+    }
   }
 }
 
@@ -306,35 +353,41 @@ void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
   DCHECK(state_ == DATA || state_ == ACCESSOR);
   DCHECK(HolderIsReceiverOrHiddenPrototype());
 
-  Handle<JSObject> holder = GetHolder<JSObject>();
+  Handle<JSReceiver> holder = GetHolder<JSReceiver>();
+  // JSProxy does not have fast properties so we do an early return.
+  DCHECK_IMPLIES(holder->IsJSProxy(), !holder->HasFastProperties());
+  DCHECK_IMPLIES(holder->IsJSProxy(), name()->IsPrivate());
+  if (holder->IsJSProxy()) return;
+
+  Handle<JSObject> holder_obj = Handle<JSObject>::cast(holder);
 
   if (IsElement()) {
-    ElementsKind kind = holder->GetElementsKind();
+    ElementsKind kind = holder_obj->GetElementsKind();
     ElementsKind to = value->OptimalElementsKind();
     if (IsHoleyOrDictionaryElementsKind(kind)) to = GetHoleyElementsKind(to);
     to = GetMoreGeneralElementsKind(kind, to);
 
     if (kind != to) {
-      JSObject::TransitionElementsKind(holder, to);
+      JSObject::TransitionElementsKind(holder_obj, to);
     }
 
     // Copy the backing store if it is copy-on-write.
     if (IsSmiOrObjectElementsKind(to)) {
-      JSObject::EnsureWritableFastElements(holder);
+      JSObject::EnsureWritableFastElements(holder_obj);
     }
     return;
   }
 
-  if (holder->IsJSGlobalObject()) {
+  if (holder_obj->IsJSGlobalObject()) {
     Handle<GlobalDictionary> dictionary(
-        JSGlobalObject::cast(*holder)->global_dictionary());
+        JSGlobalObject::cast(*holder_obj)->global_dictionary());
     Handle<PropertyCell> cell(dictionary->CellAt(dictionary_entry()));
     property_details_ = cell->property_details();
     PropertyCell::PrepareForValue(dictionary, dictionary_entry(), value,
                                   property_details_);
     return;
   }
-  if (!holder->HasFastProperties()) return;
+  if (!holder_obj->HasFastProperties()) return;
 
   PropertyConstness new_constness = kConst;
   if (FLAG_track_constant_fields) {
@@ -348,7 +401,7 @@ void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
     new_constness = kMutable;
   }
 
-  Handle<Map> old_map(holder->map(), isolate_);
+  Handle<Map> old_map(holder_obj->map(), isolate_);
   Handle<Map> new_map = Map::PrepareForDataProperty(
       old_map, descriptor_number(), new_constness, value);
 
@@ -361,7 +414,7 @@ void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
     return;
   }
 
-  JSObject::MigrateToMap(holder, new_map);
+  JSObject::MigrateToMap(holder_obj, new_map);
   ReloadPropertyInformation<false>();
 }
 
@@ -370,38 +423,55 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
                                              PropertyAttributes attributes) {
   DCHECK(state_ == DATA || state_ == ACCESSOR);
   DCHECK(HolderIsReceiverOrHiddenPrototype());
-  Handle<JSObject> holder = GetHolder<JSObject>();
+
+  Handle<JSReceiver> holder = GetHolder<JSReceiver>();
+
+  // Property details can never change for private fields.
+  if (holder->IsJSProxy()) {
+    DCHECK(name()->IsPrivate());
+    return;
+  }
+
+  Handle<JSObject> holder_obj = Handle<JSObject>::cast(holder);
   if (IsElement()) {
-    DCHECK(!holder->HasFixedTypedArrayElements());
-    DCHECK(attributes != NONE || !holder->HasFastElements());
-    Handle<FixedArrayBase> elements(holder->elements());
-    holder->GetElementsAccessor()->Reconfigure(holder, elements, number_, value,
-                                               attributes);
+    DCHECK(!holder_obj->HasFixedTypedArrayElements());
+    DCHECK(attributes != NONE || !holder_obj->HasFastElements());
+    Handle<FixedArrayBase> elements(holder_obj->elements());
+    holder_obj->GetElementsAccessor()->Reconfigure(holder_obj, elements,
+                                                   number_, value, attributes);
     ReloadPropertyInformation<true>();
-  } else if (holder->HasFastProperties()) {
-    Handle<Map> old_map(holder->map(), isolate_);
+  } else if (holder_obj->HasFastProperties()) {
+    Handle<Map> old_map(holder_obj->map(), isolate_);
     Handle<Map> new_map = Map::ReconfigureExistingProperty(
         old_map, descriptor_number(), i::kData, attributes);
     // Force mutable to avoid changing constant value by reconfiguring
     // kData -> kAccessor -> kData.
     new_map = Map::PrepareForDataProperty(new_map, descriptor_number(),
                                           kMutable, value);
-    JSObject::MigrateToMap(holder, new_map);
+    JSObject::MigrateToMap(holder_obj, new_map);
     ReloadPropertyInformation<false>();
   }
 
-  if (!IsElement() && !holder->HasFastProperties()) {
+  if (!IsElement() && !holder_obj->HasFastProperties()) {
     PropertyDetails details(kData, attributes, PropertyCellType::kMutable);
-    if (holder->IsJSGlobalObject()) {
+    if (holder_obj->map()->is_prototype_map() &&
+        (property_details_.attributes() & READ_ONLY) == 0 &&
+        (attributes & READ_ONLY) != 0) {
+      // Invalidate prototype validity cell when a property is reconfigured
+      // from writable to read-only as this may invalidate transitioning store
+      // IC handlers.
+      JSObject::InvalidatePrototypeChains(holder->map());
+    }
+    if (holder_obj->IsJSGlobalObject()) {
       Handle<GlobalDictionary> dictionary(
-          JSGlobalObject::cast(*holder)->global_dictionary());
+          JSGlobalObject::cast(*holder_obj)->global_dictionary());
 
       Handle<PropertyCell> cell = PropertyCell::PrepareForValue(
           dictionary, dictionary_entry(), value, details);
       cell->set_value(*value);
       property_details_ = cell->property_details();
     } else {
-      Handle<NameDictionary> dictionary(holder->property_dictionary());
+      Handle<NameDictionary> dictionary(holder_obj->property_dictionary());
       PropertyDetails original_details =
           dictionary->DetailsAt(dictionary_entry());
       int enumeration_index = original_details.dictionary_index();
@@ -417,7 +487,7 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
 
 #if VERIFY_HEAP
   if (FLAG_verify_heap) {
-    holder->JSObjectVerify();
+    holder->HeapObjectVerify();
   }
 #endif
 }
@@ -427,9 +497,10 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
 // Returns true if a new transition has been created, or false if an existing
 // transition was followed.
 bool LookupIterator::PrepareTransitionToDataProperty(
-    Handle<JSObject> receiver, Handle<Object> value,
+    Handle<JSReceiver> receiver, Handle<Object> value,
     PropertyAttributes attributes, Object::StoreFromKeyed store_mode) {
-  DCHECK(receiver.is_identical_to(GetStoreTarget()));
+  DCHECK_IMPLIES(receiver->IsJSProxy(), name()->IsPrivate());
+  DCHECK(receiver.is_identical_to(GetStoreTarget<JSReceiver>()));
   if (state_ == TRANSITION) return false;
 
   if (!IsElement() && name()->IsPrivate()) {
@@ -497,10 +568,11 @@ bool LookupIterator::PrepareTransitionToDataProperty(
   return created_new_map;
 }
 
-void LookupIterator::ApplyTransitionToDataProperty(Handle<JSObject> receiver) {
+void LookupIterator::ApplyTransitionToDataProperty(
+    Handle<JSReceiver> receiver) {
   DCHECK_EQ(TRANSITION, state_);
 
-  DCHECK(receiver.is_identical_to(GetStoreTarget()));
+  DCHECK(receiver.is_identical_to(GetStoreTarget<JSReceiver>()));
   holder_ = receiver;
   if (receiver->IsJSGlobalObject()) {
     JSObject::InvalidatePrototypeChains(receiver->map());
@@ -509,7 +581,23 @@ void LookupIterator::ApplyTransitionToDataProperty(Handle<JSObject> receiver) {
   }
   Handle<Map> transition = transition_map();
   bool simple_transition = transition->GetBackPointer() == receiver->map();
-  JSObject::MigrateToMap(receiver, transition);
+
+  if (configuration_ == DEFAULT && !transition->is_dictionary_map() &&
+      !transition->IsPrototypeValidityCellValid()) {
+    // Only LookupIterator instances with DEFAULT (full prototype chain)
+    // configuration can produce valid transition handler maps.
+    Handle<Object> validity_cell =
+        Map::GetOrCreatePrototypeChainValidityCell(transition, isolate());
+    if (validity_cell.is_null()) {
+      validity_cell =
+          handle(Smi::FromInt(Map::kPrototypeChainValid), isolate());
+    }
+    transition->set_prototype_validity_cell(*validity_cell);
+  }
+
+  if (!receiver->IsJSProxy()) {
+    JSObject::MigrateToMap(Handle<JSObject>::cast(receiver), transition);
+  }
 
   if (simple_transition) {
     int number = transition->LastAdded();
@@ -520,7 +608,7 @@ void LookupIterator::ApplyTransitionToDataProperty(Handle<JSObject> receiver) {
     Handle<NameDictionary> dictionary(receiver->property_dictionary(),
                                       isolate_);
     int entry;
-    if (receiver->map()->is_prototype_map()) {
+    if (receiver->map()->is_prototype_map() && receiver->IsJSObject()) {
       JSObject::InvalidatePrototypeChains(receiver->map());
     }
     dictionary = NameDictionary::Add(dictionary, name(),
@@ -546,6 +634,7 @@ void LookupIterator::Delete() {
     ElementsAccessor* accessor = object->GetElementsAccessor();
     accessor->Delete(object, number_);
   } else {
+    DCHECK(!name()->IsPrivateField());
     bool is_prototype_map = holder->map()->is_prototype_map();
     RuntimeCallTimerScope stats_scope(
         isolate_, is_prototype_map
@@ -575,7 +664,7 @@ void LookupIterator::TransitionToAccessorProperty(
   // Can only be called when the receiver is a JSObject. JSProxy has to be
   // handled via a trap. Adding properties to primitive values is not
   // observable.
-  Handle<JSObject> receiver = GetStoreTarget();
+  Handle<JSObject> receiver = GetStoreTarget<JSObject>();
   if (!IsElement() && name()->IsPrivate()) {
     attributes = static_cast<PropertyAttributes>(attributes | DONT_ENUM);
   }
@@ -639,7 +728,7 @@ void LookupIterator::TransitionToAccessorProperty(
 
 void LookupIterator::TransitionToAccessorPair(Handle<Object> pair,
                                               PropertyAttributes attributes) {
-  Handle<JSObject> receiver = GetStoreTarget();
+  Handle<JSObject> receiver = GetStoreTarget<JSObject>();
   holder_ = receiver;
 
   PropertyDetails details(kAccessor, attributes, PropertyCellType::kMutable);
@@ -868,6 +957,7 @@ void LookupIterator::WriteDataValue(Handle<Object> value,
         JSGlobalObject::cast(*holder)->global_dictionary();
     dictionary->CellAt(dictionary_entry())->set_value(*value);
   } else {
+    DCHECK_IMPLIES(holder->IsJSProxy(), name()->IsPrivate());
     NameDictionary* dictionary = holder->property_dictionary();
     dictionary->ValueAtPut(dictionary_entry(), *value);
   }
@@ -883,7 +973,7 @@ bool LookupIterator::SkipInterceptor(JSObject* holder) {
     switch (interceptor_state_) {
       case InterceptorState::kUninitialized:
         interceptor_state_ = InterceptorState::kSkipNonMasking;
-      // Fall through.
+        V8_FALLTHROUGH;
       case InterceptorState::kSkipNonMasking:
         return true;
       case InterceptorState::kProcessNonMasking:
@@ -934,13 +1024,13 @@ LookupIterator::State LookupIterator::LookupInSpecialHolder(
       if (map->is_access_check_needed()) {
         if (is_element || !name_->IsPrivate()) return ACCESS_CHECK;
       }
-    // Fall through.
+      V8_FALLTHROUGH;
     case ACCESS_CHECK:
       if (check_interceptor() && HasInterceptor<is_element>(map) &&
           !SkipInterceptor<is_element>(JSObject::cast(holder))) {
         if (is_element || !name_->IsPrivate()) return INTERCEPTOR;
       }
-    // Fall through.
+      V8_FALLTHROUGH;
     case INTERCEPTOR:
       if (!is_element && map->IsJSGlobalObjectMap()) {
         GlobalDictionary* dict =
@@ -996,6 +1086,7 @@ LookupIterator::State LookupIterator::LookupInRegularHolder(
     number_ = static_cast<uint32_t>(number);
     property_details_ = descriptors->GetDetails(number_);
   } else {
+    DCHECK_IMPLIES(holder->IsJSProxy(), name()->IsPrivate());
     NameDictionary* dict = holder->property_dictionary();
     int number = dict->FindEntry(name_);
     if (number == NameDictionary::kNotFound) return NotFound(holder);
diff --git a/deps/v8/src/lookup.h b/deps/v8/src/lookup.h
index 9ea2d77cf60..4487bc160a3 100644
--- a/deps/v8/src/lookup.h
+++ b/deps/v8/src/lookup.h
@@ -135,12 +135,9 @@ class V8_EXPORT_PRIVATE LookupIterator final BASE_EMBEDDED {
       Isolate* isolate, Handle<Object> receiver, Handle<Object> key,
       bool* success, Configuration configuration = DEFAULT);
 
-  static LookupIterator ForTransitionHandler(Isolate* isolate,
-                                             Handle<Object> receiver,
-                                             Handle<Name> name,
-                                             Handle<Object> value,
-                                             MaybeHandle<Object> handler,
-                                             Handle<Map> transition_map);
+  static LookupIterator ForTransitionHandler(
+      Isolate* isolate, Handle<Object> receiver, Handle<Name> name,
+      Handle<Object> value, MaybeHandle<Map> maybe_transition_map);
 
   void Restart() {
     InterceptorState state = InterceptorState::kUninitialized;
@@ -176,17 +173,17 @@ class V8_EXPORT_PRIVATE LookupIterator final BASE_EMBEDDED {
   Factory* factory() const { return isolate_->factory(); }
   Handle<Object> GetReceiver() const { return receiver_; }
 
-  Handle<JSObject> GetStoreTarget() const {
-    DCHECK(receiver_->IsJSObject());
+  template <class T>
+  Handle<T> GetStoreTarget() const {
+    DCHECK(receiver_->IsJSReceiver());
     if (receiver_->IsJSGlobalProxy()) {
       Map* map = JSGlobalProxy::cast(*receiver_)->map();
       if (map->has_hidden_prototype()) {
         return handle(JSGlobalObject::cast(map->prototype()), isolate_);
       }
     }
-    return Handle<JSObject>::cast(receiver_);
+    return Handle<T>::cast(receiver_);
   }
-
   bool is_dictionary_holder() const { return !holder_->HasFastProperties(); }
   Handle<Map> transition_map() const {
     DCHECK_EQ(TRANSITION, state_);
@@ -213,13 +210,13 @@ class V8_EXPORT_PRIVATE LookupIterator final BASE_EMBEDDED {
   bool HasAccess() const;
 
   /* PROPERTY */
-  bool ExtendingNonExtensible(Handle<JSObject> receiver) {
-    DCHECK(receiver.is_identical_to(GetStoreTarget()));
+  bool ExtendingNonExtensible(Handle<JSReceiver> receiver) {
+    DCHECK(receiver.is_identical_to(GetStoreTarget<JSReceiver>()));
     return !receiver->map()->is_extensible() &&
            (IsElement() || !name_->IsPrivate());
   }
   void PrepareForDataProperty(Handle<Object> value);
-  bool PrepareTransitionToDataProperty(Handle<JSObject> receiver,
+  bool PrepareTransitionToDataProperty(Handle<JSReceiver> receiver,
                                        Handle<Object> value,
                                        PropertyAttributes attributes,
                                        Object::StoreFromKeyed store_mode);
@@ -227,10 +224,10 @@ class V8_EXPORT_PRIVATE LookupIterator final BASE_EMBEDDED {
     DCHECK_EQ(TRANSITION, state_);
     return transition_->IsPropertyCell() ||
            (transition_map()->is_dictionary_map() &&
-            !GetStoreTarget()->HasFastProperties()) ||
+            !GetStoreTarget<JSReceiver>()->HasFastProperties()) ||
            transition_map()->GetBackPointer()->IsMap();
   }
-  void ApplyTransitionToDataProperty(Handle<JSObject> receiver);
+  void ApplyTransitionToDataProperty(Handle<JSReceiver> receiver);
   void ReconfigureDataProperty(Handle<Object> value,
                                PropertyAttributes attributes);
   void Delete();
@@ -275,11 +272,12 @@ class V8_EXPORT_PRIVATE LookupIterator final BASE_EMBEDDED {
   inline void UpdateProtector() {
     if (IsElement()) return;
     // This list must be kept in sync with
-    // CodeStubAssembler::HasAssociatedProtector!
+    // CodeStubAssembler::CheckForAssociatedProtector!
     if (*name_ == heap()->is_concat_spreadable_symbol() ||
         *name_ == heap()->constructor_string() ||
-        *name_ == heap()->species_symbol() ||
-        *name_ == heap()->iterator_symbol()) {
+        *name_ == heap()->next_string() || *name_ == heap()->species_symbol() ||
+        *name_ == heap()->iterator_symbol() ||
+        *name_ == heap()->resolve_string() || *name_ == heap()->then_string()) {
       InternalUpdateProtector();
     }
   }
diff --git a/deps/v8/src/macro-assembler.h b/deps/v8/src/macro-assembler.h
index fcdddbb1fa1..a78476a82a5 100644
--- a/deps/v8/src/macro-assembler.h
+++ b/deps/v8/src/macro-assembler.h
@@ -7,6 +7,7 @@
 
 #include "src/assembler.h"
 #include "src/frames.h"
+#include "src/heap/heap.h"
 
 // Helper types to make boolean flag easier to read at call-site.
 enum InvokeFlag {
diff --git a/deps/v8/src/messages.cc b/deps/v8/src/messages.cc
index 5876e5f5e44..fe1c246e954 100644
--- a/deps/v8/src/messages.cc
+++ b/deps/v8/src/messages.cc
@@ -194,8 +194,8 @@ Object* EvalFromFunctionName(Isolate* isolate, Handle<Script> script) {
 
   Handle<SharedFunctionInfo> shared(script->eval_from_shared());
   // Find the name of the function calling eval.
-  if (shared->name()->BooleanValue()) {
-    return shared->name();
+  if (shared->Name()->BooleanValue()) {
+    return shared->Name();
   }
 
   return shared->inferred_name();
@@ -385,7 +385,7 @@ Handle<Object> JSStackFrame::GetMethodName() {
     return isolate_->factory()->null_value();
   }
 
-  Handle<String> name(function_->shared()->name(), isolate_);
+  Handle<String> name(function_->shared()->Name(), isolate_);
   // ES2015 gives getters and setters name prefixes which must
   // be stripped to find the property name.
   if (name->IsUtf8EqualTo(CStrVector("get "), true) ||
@@ -648,18 +648,10 @@ void WasmStackFrame::FromFrameArray(Isolate* isolate, Handle<FrameArray> array,
   wasm_instance_ = handle(array->WasmInstance(frame_ix), isolate);
   wasm_func_index_ = array->WasmFunctionIndex(frame_ix)->value();
   if (array->IsWasmInterpretedFrame(frame_ix)) {
-    code_ = {};
+    code_ = nullptr;
   } else {
-    code_ =
-        FLAG_wasm_jit_to_native
-            ? WasmCodeWrapper(
-                  wasm_instance_->compiled_module()->GetNativeModule()->GetCode(
-                      wasm_func_index_))
-            : WasmCodeWrapper(handle(
-                  Code::cast(
-                      wasm_instance_->compiled_module()->code_table()->get(
-                          wasm_func_index_)),
-                  isolate));
+    code_ = wasm_instance_->compiled_module()->GetNativeModule()->GetCode(
+        wasm_func_index_);
   }
   offset_ = array->Offset(frame_ix)->value();
 }
@@ -723,11 +715,8 @@ MaybeHandle<String> WasmStackFrame::ToString() {
 int WasmStackFrame::GetPosition() const {
   return IsInterpreted()
              ? offset_
-             : (code_.IsCodeObject()
-                    ? Handle<AbstractCode>::cast(code_.GetCode())
-                          ->SourcePosition(offset_)
-                    : FrameSummary::WasmCompiledFrameSummary::
-                          GetWasmSourcePosition(code_.GetWasmCode(), offset_));
+             : FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
+                   code_, offset_);
 }
 
 Handle<Object> WasmStackFrame::Null() const {
@@ -778,10 +767,8 @@ Handle<Object> AsmJsWasmStackFrame::GetScriptNameOrSourceUrl() {
 int AsmJsWasmStackFrame::GetPosition() const {
   DCHECK_LE(0, offset_);
   int byte_offset =
-      code_.IsCodeObject()
-          ? Handle<AbstractCode>::cast(code_.GetCode())->SourcePosition(offset_)
-          : FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
-                code_.GetWasmCode(), offset_);
+      FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(code_,
+                                                                    offset_);
   Handle<WasmSharedModuleData> shared(
       wasm_instance_->compiled_module()->shared(), isolate_);
   DCHECK_LE(0, byte_offset);
diff --git a/deps/v8/src/messages.h b/deps/v8/src/messages.h
index 923535517ac..187bd4d308a 100644
--- a/deps/v8/src/messages.h
+++ b/deps/v8/src/messages.h
@@ -13,7 +13,6 @@
 #include <memory>
 
 #include "src/handles.h"
-#include "src/wasm/wasm-code-wrapper.h"
 
 namespace v8 {
 namespace internal {
@@ -153,7 +152,7 @@ class WasmStackFrame : public StackFrameBase {
   bool IsToplevel() override { return false; }
   bool IsConstructor() override { return false; }
   bool IsStrict() const override { return false; }
-  bool IsInterpreted() const { return code_.is_null(); }
+  bool IsInterpreted() const { return code_ == nullptr; }
 
   MaybeHandle<String> ToString() override;
 
@@ -165,7 +164,7 @@ class WasmStackFrame : public StackFrameBase {
 
   Handle<WasmInstanceObject> wasm_instance_;
   uint32_t wasm_func_index_;
-  WasmCodeWrapper code_;  // null for interpreted frames.
+  wasm::WasmCode* code_;  // null for interpreted frames.
   int offset_;
 
  private:
@@ -259,6 +258,7 @@ class ErrorUtils : public AllStatic {
   T(Debugger, "Debugger: %")                                                   \
   T(DebuggerLoading, "Error loading debugger")                                 \
   T(DefaultOptionsMissing, "Internal % error. Default options are missing.")   \
+  T(DeletePrivateField, "Private fields can not be deleted")                   \
   T(UncaughtException, "Uncaught %")                                           \
   T(Unsupported, "Not supported")                                              \
   T(WrongServiceType, "Internal error, wrong service type: %")                 \
@@ -340,8 +340,10 @@ class ErrorUtils : public AllStatic {
   T(InvalidRegExpExecResult,                                                   \
     "RegExp exec method returned something other than an Object or null")      \
   T(IteratorResultNotAnObject, "Iterator result % is not an object")           \
+  T(IteratorSymbolNonCallable, "Found non-callable @@iterator")                \
   T(IteratorValueNotAnObject, "Iterator value % is not an entry object")       \
   T(LanguageID, "Language ID should be string or object.")                     \
+  T(MapperFunctionNonCallable, "flatMap mapper function is not callable")      \
   T(MethodCalledOnWrongObject,                                                 \
     "Method % called on a non-object or on a wrong type of object.")           \
   T(MethodInvokedOnNullOrUndefined,                                            \
@@ -554,7 +556,13 @@ class ErrorUtils : public AllStatic {
   T(LetInLexicalBinding, "let is disallowed as a lexically bound name")        \
   T(LocaleMatcher, "Illegal value for localeMatcher:%")                        \
   T(NormalizationForm, "The normalization form should be one of %.")           \
+  T(ZeroDigitNumericSeparator,                                                 \
+    "Numeric separator can not be used after leading 0.")                      \
   T(NumberFormatRange, "% argument must be between 0 and 100")                 \
+  T(TrailingNumericSeparator,                                                  \
+    "Numeric separators are not allowed at the end of numeric literals")       \
+  T(ContinuousNumericSeparator,                                                \
+    "Only one underscore is allowed as numeric separator")                     \
   T(PropertyValueOutOfRange, "% value is out of range.")                       \
   T(StackOverflow, "Maximum call stack size exceeded")                         \
   T(ToPrecisionFormatRange,                                                    \
@@ -598,6 +606,7 @@ class ErrorUtils : public AllStatic {
   T(IllegalLanguageModeDirective,                                              \
     "Illegal '%' directive in function with non-simple parameter list")        \
   T(IllegalReturn, "Illegal return statement")                                 \
+  T(IntrinsicWithSpread, "Intrinsic calls do not support spread arguments")    \
   T(InvalidRestBindingPattern,                                                 \
     "`...` must be followed by an identifier in declaration contexts")         \
   T(InvalidRestAssignmentPattern,                                              \
@@ -615,6 +624,7 @@ class ErrorUtils : public AllStatic {
     "Invalid left-hand side expression in prefix operation")                   \
   T(InvalidRegExpFlags, "Invalid flags supplied to RegExp constructor '%'")    \
   T(InvalidOrUnexpectedToken, "Invalid or unexpected token")                   \
+  T(InvalidPrivateFieldAccess, "Invalid private field '%'")                    \
   T(JsonParseUnexpectedEOS, "Unexpected end of JSON input")                    \
   T(JsonParseUnexpectedToken, "Unexpected token % in JSON at position %")      \
   T(JsonParseUnexpectedTokenNumber, "Unexpected number in JSON at position %") \
@@ -634,6 +644,9 @@ class ErrorUtils : public AllStatic {
   T(NoCatchOrFinally, "Missing catch or finally after try")                    \
   T(NotIsvar, "builtin %%IS_VAR: not a variable")                              \
   T(ParamAfterRest, "Rest parameter must be last formal parameter")            \
+  T(FlattenPastSafeLength,                                                     \
+    "Flattening % elements on an array-like of length % "                      \
+    "is disallowed, as the total surpasses 2**53-1")                           \
   T(PushPastSafeLength,                                                        \
     "Pushing % elements on an array-like of length % "                         \
     "is disallowed, as the total surpasses 2**53-1")                           \
@@ -682,11 +695,10 @@ class ErrorUtils : public AllStatic {
   T(TooManySpreads,                                                            \
     "Literal containing too many nested spreads (up to 65534 allowed)")        \
   T(TooManyVariables, "Too many variables declared (only 4194303 allowed)")    \
+  T(TooManyElementsInPromiseAll, "Too many elements passed to Promise.all")    \
   T(TypedArrayTooShort,                                                        \
     "Derived TypedArray constructor created an array which was too small")     \
   T(UnexpectedEOS, "Unexpected end of input")                                  \
-  T(UnexpectedFunctionSent,                                                    \
-    "function.sent expression is not allowed outside a generator")             \
   T(UnexpectedReserved, "Unexpected reserved word")                            \
   T(UnexpectedStrictReserved, "Unexpected strict mode reserved word")          \
   T(UnexpectedSuper, "'super' keyword unexpected here")                        \
@@ -722,11 +734,10 @@ class ErrorUtils : public AllStatic {
   T(WasmTrapDivByZero, "divide by zero")                                       \
   T(WasmTrapDivUnrepresentable, "divide result unrepresentable")               \
   T(WasmTrapRemByZero, "remainder by zero")                                    \
-  T(WasmTrapFloatUnrepresentable, "integer result unrepresentable")            \
-  T(WasmTrapFuncInvalid, "invalid function")                                   \
+  T(WasmTrapFloatUnrepresentable, "float unrepresentable in integer range")    \
+  T(WasmTrapFuncInvalid, "invalid index into function table")                  \
   T(WasmTrapFuncSigMismatch, "function signature mismatch")                    \
-  T(WasmTrapInvalidIndex, "invalid index into function table")                 \
-  T(WasmTrapTypeError, "invalid type")                                         \
+  T(WasmTrapTypeError, "wasm function signature contains illegal type")        \
   T(WasmExceptionError, "wasm exception")                                      \
   /* Asm.js validation related */                                              \
   T(AsmJsInvalid, "Invalid asm.js: %")                                         \
diff --git a/deps/v8/src/mips/OWNERS b/deps/v8/src/mips/OWNERS
index 978563cab5e..4ce9d7f91da 100644
--- a/deps/v8/src/mips/OWNERS
+++ b/deps/v8/src/mips/OWNERS
@@ -1,2 +1,3 @@
 ivica.bogosavljevic@mips.com
 Miran.Karic@mips.com
+sreten.kovacevic@mips.com
\ No newline at end of file
diff --git a/deps/v8/src/mips/assembler-mips-inl.h b/deps/v8/src/mips/assembler-mips-inl.h
index 803c16b8294..908bf95f14a 100644
--- a/deps/v8/src/mips/assembler-mips-inl.h
+++ b/deps/v8/src/mips/assembler-mips-inl.h
@@ -46,8 +46,7 @@
 namespace v8 {
 namespace internal {
 
-
-bool CpuFeatures::SupportsCrankshaft() { return IsSupported(FPU); }
+bool CpuFeatures::SupportsOptimizer() { return IsSupported(FPU); }
 
 bool CpuFeatures::SupportsWasmSimd128() { return IsSupported(MIPS_SIMD); }
 
@@ -83,7 +82,8 @@ Address RelocInfo::target_address() {
 
 Address RelocInfo::target_address_address() {
   DCHECK(IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_) || IsWasmCall(rmode_) ||
-         rmode_ == EMBEDDED_OBJECT || rmode_ == EXTERNAL_REFERENCE);
+         IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
+         IsOffHeapTarget(rmode_));
   // Read the address of the word containing the target_address in an
   // instruction stream.
   // The only architecture-independent user of this function is the serializer.
@@ -126,16 +126,14 @@ Address Assembler::target_address_from_return_address(Address pc) {
 }
 
 void Assembler::deserialization_set_special_target_at(
-    Isolate* isolate, Address instruction_payload, Code* code, Address target) {
+    Address instruction_payload, Code* code, Address target) {
   if (IsMipsArchVariant(kMips32r6)) {
     // On R6 the address location is shifted by one instruction
     set_target_address_at(
-        isolate,
         instruction_payload - (kInstructionsFor32BitConstant - 1) * kInstrSize,
         code ? code->constant_pool() : nullptr, target);
   } else {
     set_target_address_at(
-        isolate,
         instruction_payload - kInstructionsFor32BitConstant * kInstrSize,
         code ? code->constant_pool() : nullptr, target);
   }
@@ -172,9 +170,8 @@ void Assembler::set_target_internal_reference_encoded_at(Address pc,
   // after complete deserialization, no need to flush on each reference.
 }
 
-
 void Assembler::deserialization_set_target_internal_reference_at(
-    Isolate* isolate, Address pc, Address target, RelocInfo::Mode mode) {
+    Address pc, Address target, RelocInfo::Mode mode) {
   if (mode == RelocInfo::INTERNAL_REFERENCE_ENCODED) {
     DCHECK(IsLui(instr_at(pc)));
     set_target_internal_reference_encoded_at(pc, target);
@@ -200,7 +197,7 @@ void RelocInfo::set_target_object(HeapObject* target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
-  Assembler::set_target_address_at(target->GetIsolate(), pc_, constant_pool_,
+  Assembler::set_target_address_at(pc_, constant_pool_,
                                    reinterpret_cast<Address>(target),
                                    icache_flush_mode);
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr) {
@@ -250,15 +247,20 @@ Address RelocInfo::target_runtime_entry(Assembler* origin) {
   return target_address();
 }
 
-void RelocInfo::set_target_runtime_entry(Isolate* isolate, Address target,
+void RelocInfo::set_target_runtime_entry(Address target,
                                          WriteBarrierMode write_barrier_mode,
                                          ICacheFlushMode icache_flush_mode) {
   DCHECK(IsRuntimeEntry(rmode_));
   if (target_address() != target)
-    set_target_address(isolate, target, write_barrier_mode, icache_flush_mode);
+    set_target_address(target, write_barrier_mode, icache_flush_mode);
+}
+
+Address RelocInfo::target_off_heap_target() {
+  DCHECK(IsOffHeapTarget(rmode_));
+  return Assembler::target_address_at(pc_, constant_pool_);
 }
 
-void RelocInfo::WipeOut(Isolate* isolate) {
+void RelocInfo::WipeOut() {
   DCHECK(IsEmbeddedObject(rmode_) || IsCodeTarget(rmode_) ||
          IsRuntimeEntry(rmode_) || IsExternalReference(rmode_) ||
          IsInternalReference(rmode_) || IsInternalReferenceEncoded(rmode_));
@@ -267,12 +269,12 @@ void RelocInfo::WipeOut(Isolate* isolate) {
   } else if (IsInternalReferenceEncoded(rmode_)) {
     Assembler::set_target_internal_reference_encoded_at(pc_, nullptr);
   } else {
-    Assembler::set_target_address_at(isolate, pc_, constant_pool_, nullptr);
+    Assembler::set_target_address_at(pc_, constant_pool_, nullptr);
   }
 }
 
 template <typename ObjectVisitor>
-void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
+void RelocInfo::Visit(ObjectVisitor* visitor) {
   RelocInfo::Mode mode = rmode();
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
@@ -285,6 +287,8 @@ void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
     visitor->VisitInternalReference(host(), this);
   } else if (RelocInfo::IsRuntimeEntry(mode)) {
     visitor->VisitRuntimeEntry(host(), this);
+  } else if (RelocInfo::IsOffHeapTarget(mode)) {
+    visitor->VisitOffHeapTarget(host(), this);
   }
 }
 
diff --git a/deps/v8/src/mips/assembler-mips.cc b/deps/v8/src/mips/assembler-mips.cc
index bd540346c09..88b71514015 100644
--- a/deps/v8/src/mips/assembler-mips.cc
+++ b/deps/v8/src/mips/assembler-mips.cc
@@ -79,6 +79,9 @@ void CpuFeatures::ProbeImpl(bool cross_compile) {
 #if defined(_MIPS_ARCH_MIPS32R6)
   // FP64 mode is implied on r6.
   supported_ |= 1u << FP64FPU;
+#if defined(_MIPS_MSA)
+  supported_ |= 1u << MIPS_SIMD;
+#endif
 #endif
 #if defined(FPU_MODE_FP64)
   supported_ |= 1u << FP64FPU;
@@ -91,8 +94,14 @@ void CpuFeatures::ProbeImpl(bool cross_compile) {
   if (cpu.is_fp64_mode()) supported_ |= 1u << FP64FPU;
 #elif defined(FPU_MODE_FP64)
   supported_ |= 1u << FP64FPU;
+#if defined(_MIPS_ARCH_MIPS32R6)
+#if defined(_MIPS_MSA)
+  supported_ |= 1u << MIPS_SIMD;
+#else
   if (cpu.has_msa()) supported_ |= 1u << MIPS_SIMD;
 #endif
+#endif
+#endif
 #if defined(_MIPS_ARCH_MIPS32RX)
   if (cpu.architecture() == 6) {
     supported_ |= 1u << MIPSr6;
@@ -200,22 +209,20 @@ uint32_t RelocInfo::embedded_size() const {
       Assembler::target_address_at(pc_, constant_pool_));
 }
 
-void RelocInfo::set_embedded_address(Isolate* isolate, Address address,
+void RelocInfo::set_embedded_address(Address address,
                                      ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(isolate, pc_, constant_pool_, address,
-                                   flush_mode);
+  Assembler::set_target_address_at(pc_, constant_pool_, address, flush_mode);
 }
 
-void RelocInfo::set_embedded_size(Isolate* isolate, uint32_t size,
-                                  ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(isolate, pc_, constant_pool_,
+void RelocInfo::set_embedded_size(uint32_t size, ICacheFlushMode flush_mode) {
+  Assembler::set_target_address_at(pc_, constant_pool_,
                                    reinterpret_cast<Address>(size), flush_mode);
 }
 
-void RelocInfo::set_js_to_wasm_address(Isolate* isolate, Address address,
+void RelocInfo::set_js_to_wasm_address(Address address,
                                        ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  set_embedded_address(isolate, address, icache_flush_mode);
+  set_embedded_address(address, icache_flush_mode);
 }
 
 Address RelocInfo::js_to_wasm_address() const {
@@ -272,8 +279,7 @@ void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
         break;
     }
     Address pc = buffer_ + request.offset();
-    set_target_value_at(isolate, pc,
-                        reinterpret_cast<uint32_t>(object.location()));
+    set_target_value_at(pc, reinterpret_cast<uint32_t>(object.location()));
   }
 }
 
@@ -2492,15 +2498,6 @@ void Assembler::cfc1(Register rt, FPUControlRegister fs) {
 }
 
 
-void Assembler::DoubleAsTwoUInt32(double d, uint32_t* lo, uint32_t* hi) {
-  uint64_t i;
-  memcpy(&i, &d, 8);
-
-  *lo = i & 0xFFFFFFFF;
-  *hi = i >> 32;
-}
-
-
 void Assembler::movn_s(FPURegister fd, FPURegister fs, Register rt) {
   DCHECK(!IsMipsArchVariant(kMips32r6));
   GenInstrRegister(COP1, S, rt, fs, fd, MOVN_C);
@@ -3669,7 +3666,7 @@ void Assembler::GrowBuffer() {
   // Some internal data structures overflow for very large buffers,
   // they must ensure that kMaximalBufferSize is not too large.
   if (desc.buffer_size > kMaximalBufferSize) {
-    V8::FatalProcessOutOfMemory("Assembler::GrowBuffer");
+    V8::FatalProcessOutOfMemory(nullptr, "Assembler::GrowBuffer");
   }
 
   // Set up new buffer.
@@ -3889,11 +3886,8 @@ void Assembler::QuietNaN(HeapObject* object) {
 // There is an optimization below, which emits a nop when the address
 // fits in just 16 bits. This is unlikely to help, and should be benchmarked,
 // and possibly removed.
-void Assembler::set_target_value_at(Isolate* isolate, Address pc,
-                                    uint32_t target,
+void Assembler::set_target_value_at(Address pc, uint32_t target,
                                     ICacheFlushMode icache_flush_mode) {
-  DCHECK_IMPLIES(isolate == nullptr, icache_flush_mode == SKIP_ICACHE_FLUSH);
-
   Instr instr2 = instr_at(pc + kInstrSize);
   uint32_t rt_code = GetRtField(instr2);
   uint32_t* p = reinterpret_cast<uint32_t*>(pc);
@@ -3924,7 +3918,7 @@ void Assembler::set_target_value_at(Isolate* isolate, Address pc,
   }
 
   if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(isolate, pc, 2 * sizeof(int32_t));
+    Assembler::FlushICache(pc, 2 * sizeof(int32_t));
   }
 }
 
diff --git a/deps/v8/src/mips/assembler-mips.h b/deps/v8/src/mips/assembler-mips.h
index 4c68e730b34..280e239a887 100644
--- a/deps/v8/src/mips/assembler-mips.h
+++ b/deps/v8/src/mips/assembler-mips.h
@@ -388,7 +388,7 @@ class Operand BASE_EMBEDDED {
  public:
   // Immediate.
   INLINE(explicit Operand(int32_t immediate,
-                          RelocInfo::Mode rmode = RelocInfo::NONE32))
+                          RelocInfo::Mode rmode = RelocInfo::NONE))
       : rm_(no_reg), rmode_(rmode) {
     value_.immediate = immediate;
   }
@@ -400,8 +400,7 @@ class Operand BASE_EMBEDDED {
   INLINE(explicit Operand(Object** opp));
   INLINE(explicit Operand(Context** cpp));
   explicit Operand(Handle<HeapObject> handle);
-  INLINE(explicit Operand(Smi* value))
-      : rm_(no_reg), rmode_(RelocInfo::NONE32) {
+  INLINE(explicit Operand(Smi* value)) : rm_(no_reg), rmode_(RelocInfo::NONE) {
     value_.immediate = reinterpret_cast<intptr_t>(value);
   }
 
@@ -568,9 +567,9 @@ class Assembler : public AssemblerBase {
   // The isolate argument is unused (and may be nullptr) when skipping flushing.
   static Address target_address_at(Address pc);
   INLINE(static void set_target_address_at)
-  (Isolate* isolate, Address pc, Address target,
+  (Address pc, Address target,
    ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED) {
-    set_target_value_at(isolate, pc, reinterpret_cast<uint32_t>(target),
+    set_target_value_at(pc, reinterpret_cast<uint32_t>(target),
                         icache_flush_mode);
   }
   // On MIPS there is no Constant Pool so we skip that parameter.
@@ -578,13 +577,13 @@ class Assembler : public AssemblerBase {
     return target_address_at(pc);
   }
   INLINE(static void set_target_address_at(
-      Isolate* isolate, Address pc, Address constant_pool, Address target,
+      Address pc, Address constant_pool, Address target,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED)) {
-    set_target_address_at(isolate, pc, target, icache_flush_mode);
+    set_target_address_at(pc, target, icache_flush_mode);
   }
 
   static void set_target_value_at(
-      Isolate* isolate, Address pc, uint32_t target,
+      Address pc, uint32_t target,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
   // Return the code target address at a call site from the return address
@@ -597,12 +596,11 @@ class Assembler : public AssemblerBase {
   // This is for calls and branches within generated code.  The serializer
   // has already deserialized the lui/ori instructions etc.
   inline static void deserialization_set_special_target_at(
-      Isolate* isolate, Address instruction_payload, Code* code,
-      Address target);
+      Address instruction_payload, Code* code, Address target);
 
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
-      Isolate* isolate, Address pc, Address target,
+      Address pc, Address target,
       RelocInfo::Mode mode = RelocInfo::INTERNAL_REFERENCE);
 
   // Size of an instruction.
@@ -676,9 +674,6 @@ class Assembler : public AssemblerBase {
     // Helper values.
     LAST_CODE_MARKER,
     FIRST_IC_MARKER = PROPERTY_ACCESS_INLINED,
-    // Code aging
-    CODE_AGE_MARKER_NOP = 6,
-    CODE_AGE_SEQUENCE_NOP
   };
 
   // Type == 0 is the default non-marking nop. For mips this is a
@@ -1893,8 +1888,6 @@ class Assembler : public AssemblerBase {
     return internal_trampoline_exception_;
   }
 
-  void DoubleAsTwoUInt32(double d, uint32_t* lo, uint32_t* hi);
-
   bool is_trampoline_emitted() const {
     return trampoline_emitted_;
   }
@@ -2235,4 +2228,4 @@ class UseScratchRegisterScope {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_ARM_ASSEMBLER_MIPS_H_
+#endif  // V8_MIPS_ASSEMBLER_MIPS_H_
diff --git a/deps/v8/src/mips/code-stubs-mips.cc b/deps/v8/src/mips/code-stubs-mips.cc
index 7ae3451f34c..faeba44ebde 100644
--- a/deps/v8/src/mips/code-stubs-mips.cc
+++ b/deps/v8/src/mips/code-stubs-mips.cc
@@ -466,6 +466,12 @@ void CEntryStub::Generate(MacroAssembler* masm) {
   __ sw(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
   __ bind(&zero);
 
+  // Reset the masking register. This is done independent of the underlying
+  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
+  // both configurations. It is safe to always do this, because the underlying
+  // register is caller-saved and can be arbitrarily clobbered.
+  __ ResetSpeculationPoisonRegister();
+
   // Compute the handler entry address and jump to it.
   __ li(t9, Operand(pending_handler_entrypoint_address));
   __ lw(t9, MemOperand(t9));
diff --git a/deps/v8/src/mips/codegen-mips.cc b/deps/v8/src/mips/codegen-mips.cc
index c07422ff5f2..4641090cbcb 100644
--- a/deps/v8/src/mips/codegen-mips.cc
+++ b/deps/v8/src/mips/codegen-mips.cc
@@ -7,6 +7,7 @@
 #include <memory>
 
 #include "src/codegen.h"
+#include "src/isolate.h"
 #include "src/macro-assembler.h"
 #include "src/mips/simulator-mips.h"
 
@@ -541,9 +542,9 @@ MemCopyUint8Function CreateMemCopyUint8Function(Isolate* isolate,
   }
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
-  DCHECK(!RelocInfo::RequiresRelocation(isolate, desc));
+  DCHECK(!RelocInfo::RequiresRelocation(desc));
 
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   CHECK(SetPermissions(buffer, allocated, PageAllocator::kReadExecute));
   return FUNCTION_CAST<MemCopyUint8Function>(buffer);
 #endif
@@ -568,9 +569,9 @@ UnaryMathFunctionWithIsolate CreateSqrtFunction(Isolate* isolate) {
 
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
-  DCHECK(!RelocInfo::RequiresRelocation(isolate, desc));
+  DCHECK(!RelocInfo::RequiresRelocation(desc));
 
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   CHECK(SetPermissions(buffer, allocated, PageAllocator::kReadExecute));
   return FUNCTION_CAST<UnaryMathFunctionWithIsolate>(buffer);
 #endif
diff --git a/deps/v8/src/mips/constants-mips.h b/deps/v8/src/mips/constants-mips.h
index 565fcd9a68f..496c715e818 100644
--- a/deps/v8/src/mips/constants-mips.h
+++ b/deps/v8/src/mips/constants-mips.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef  V8_MIPS_CONSTANTS_H_
-#define  V8_MIPS_CONSTANTS_H_
+#ifndef V8_MIPS_CONSTANTS_MIPS_H_
+#define V8_MIPS_CONSTANTS_MIPS_H_
 #include "src/globals.h"
 // UNIMPLEMENTED_ macro for MIPS.
 #ifdef DEBUG
@@ -1931,4 +1931,4 @@ bool InstructionGetters<T>::IsForbiddenAfterBranchInstr(Instr instr) {
 }  // namespace internal
 }  // namespace v8
 
-#endif    // #ifndef V8_MIPS_CONSTANTS_H_
+#endif  // V8_MIPS_CONSTANTS_MIPS_H_
diff --git a/deps/v8/src/mips/cpu-mips.cc b/deps/v8/src/mips/cpu-mips.cc
index 1199365b7d2..2e71817bd8b 100644
--- a/deps/v8/src/mips/cpu-mips.cc
+++ b/deps/v8/src/mips/cpu-mips.cc
@@ -38,9 +38,7 @@ void CpuFeatures::FlushICache(void* start, size_t size) {
   int res;
   // See http://www.linux-mips.org/wiki/Cacheflush_Syscall.
   res = syscall(__NR_cacheflush, start, size, ICACHE);
-  if (res) {
-    V8_Fatal(__FILE__, __LINE__, "Failed to flush the instruction cache");
-  }
+  if (res) FATAL("Failed to flush the instruction cache");
 #endif  // ANDROID
 #endif  // !USE_SIMULATOR.
 }
diff --git a/deps/v8/src/mips/disasm-mips.cc b/deps/v8/src/mips/disasm-mips.cc
index f27bdc9b68a..d2f8ebb0eef 100644
--- a/deps/v8/src/mips/disasm-mips.cc
+++ b/deps/v8/src/mips/disasm-mips.cc
@@ -917,6 +917,7 @@ int Decoder::FormatOption(Instruction* instr, const char* format) {
         PrintMsaImmElm(instr);
         return 4;
       }
+      UNREACHABLE();
     }
     case 'r': {   // 'r: registers.
       return FormatRegister(instr, format);
diff --git a/deps/v8/src/mips/frame-constants-mips.h b/deps/v8/src/mips/frame-constants-mips.h
index 344453794a8..6d7e471b09f 100644
--- a/deps/v8/src/mips/frame-constants-mips.h
+++ b/deps/v8/src/mips/frame-constants-mips.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_MIPS_FRAMES_MIPS_H_
-#define V8_MIPS_FRAMES_MIPS_H_
+#ifndef V8_MIPS_FRAME_CONSTANTS_MIPS_H_
+#define V8_MIPS_FRAME_CONSTANTS_MIPS_H_
 
 namespace v8 {
 namespace internal {
@@ -49,4 +49,4 @@ class JavaScriptFrameConstants : public AllStatic {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_MIPS_FRAME_CONSTANTS_MIPS_H_
diff --git a/deps/v8/src/mips/interface-descriptors-mips.cc b/deps/v8/src/mips/interface-descriptors-mips.cc
index 795fdc4af8b..a23f8f0fd43 100644
--- a/deps/v8/src/mips/interface-descriptors-mips.cc
+++ b/deps/v8/src/mips/interface-descriptors-mips.cc
@@ -68,12 +68,6 @@ const Register GrowArrayElementsDescriptor::ObjectRegister() { return a0; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return a3; }
 
 
-void FastNewClosureDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {a1, a2, a3};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
 // static
 const Register TypeConversionDescriptor::ArgumentRegister() { return a0; }
 
diff --git a/deps/v8/src/mips/macro-assembler-mips.cc b/deps/v8/src/mips/macro-assembler-mips.cc
index 5c89467cd8d..84f948b5ed9 100644
--- a/deps/v8/src/mips/macro-assembler-mips.cc
+++ b/deps/v8/src/mips/macro-assembler-mips.cc
@@ -14,6 +14,7 @@
 #include "src/debug/debug.h"
 #include "src/external-reference-table.h"
 #include "src/frames-inl.h"
+#include "src/instruction-stream.h"
 #include "src/mips/assembler-mips-inl.h"
 #include "src/mips/macro-assembler-mips.h"
 #include "src/register-configuration.h"
@@ -37,6 +38,14 @@ TurboAssembler::TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
   }
 }
 
+static inline bool IsZero(const Operand& rt) {
+  if (rt.is_reg()) {
+    return rt.rm() == zero_reg;
+  } else {
+    return rt.immediate() == 0;
+  }
+}
+
 int TurboAssembler::RequiredStackSizeForCallerSaved(SaveFPRegsMode fp_mode,
                                                     Register exclusion1,
                                                     Register exclusion2,
@@ -820,6 +829,70 @@ void TurboAssembler::Sltu(Register rd, Register rs, const Operand& rt) {
   }
 }
 
+void TurboAssembler::Sle(Register rd, Register rs, const Operand& rt) {
+  if (rt.is_reg()) {
+    slt(rd, rt.rm(), rs);
+  } else {
+    // li handles the relocation.
+    UseScratchRegisterScope temps(this);
+    Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
+    DCHECK(rs != scratch);
+    li(scratch, rt);
+    slt(rd, scratch, rs);
+  }
+  xori(rd, rd, 1);
+}
+
+void TurboAssembler::Sleu(Register rd, Register rs, const Operand& rt) {
+  if (rt.is_reg()) {
+    sltu(rd, rt.rm(), rs);
+  } else {
+    // li handles the relocation.
+    UseScratchRegisterScope temps(this);
+    Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
+    DCHECK(rs != scratch);
+    li(scratch, rt);
+    sltu(rd, scratch, rs);
+  }
+  xori(rd, rd, 1);
+}
+
+void TurboAssembler::Sge(Register rd, Register rs, const Operand& rt) {
+  Slt(rd, rs, rt);
+  xori(rd, rd, 1);
+}
+
+void TurboAssembler::Sgeu(Register rd, Register rs, const Operand& rt) {
+  Sltu(rd, rs, rt);
+  xori(rd, rd, 1);
+}
+
+void TurboAssembler::Sgt(Register rd, Register rs, const Operand& rt) {
+  if (rt.is_reg()) {
+    slt(rd, rt.rm(), rs);
+  } else {
+    // li handles the relocation.
+    UseScratchRegisterScope temps(this);
+    Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
+    DCHECK(rs != scratch);
+    li(scratch, rt);
+    slt(rd, scratch, rs);
+  }
+}
+
+void TurboAssembler::Sgtu(Register rd, Register rs, const Operand& rt) {
+  if (rt.is_reg()) {
+    sltu(rd, rt.rm(), rs);
+  } else {
+    // li handles the relocation.
+    UseScratchRegisterScope temps(this);
+    Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
+    DCHECK(rs != scratch);
+    li(scratch, rt);
+    sltu(rd, scratch, rs);
+  }
+}
+
 void TurboAssembler::Ror(Register rd, Register rs, const Operand& rt) {
   if (IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) {
     if (rt.is_reg()) {
@@ -900,37 +973,38 @@ void TurboAssembler::ByteSwapSigned(Register dest, Register src,
                                     int operand_size) {
   DCHECK(operand_size == 1 || operand_size == 2 || operand_size == 4);
 
+  Register input = src;
   if (operand_size == 2) {
-    Seh(src, src);
+    input = dest;
+    Seh(dest, src);
   } else if (operand_size == 1) {
-    Seb(src, src);
+    input = dest;
+    Seb(dest, src);
   }
   // No need to do any preparation if operand_size is 4
 
   if (IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) {
-    wsbh(dest, src);
+    wsbh(dest, input);
     rotr(dest, dest, 16);
   } else if (IsMipsArchVariant(kMips32r1) || IsMipsArchVariant(kLoongson)) {
-    Register tmp = t0;
-    Register tmp2 = t1;
+    Register tmp = at;
+    Register tmp2 = t8;
+    DCHECK(dest != tmp && dest != tmp2);
+    DCHECK(src != tmp && src != tmp2);
 
-    andi(tmp2, src, 0xFF);
-    sll(tmp2, tmp2, 24);
-    or_(tmp, zero_reg, tmp2);
+    andi(tmp2, input, 0xFF);
+    sll(tmp, tmp2, 24);
 
-    andi(tmp2, src, 0xFF00);
+    andi(tmp2, input, 0xFF00);
     sll(tmp2, tmp2, 8);
     or_(tmp, tmp, tmp2);
 
-    srl(src, src, 8);
-    andi(tmp2, src, 0xFF00);
+    srl(tmp2, input, 8);
+    andi(tmp2, tmp2, 0xFF00);
     or_(tmp, tmp, tmp2);
 
-    srl(src, src, 16);
-    andi(tmp2, src, 0xFF);
-    or_(tmp, tmp, tmp2);
-
-    or_(dest, tmp, zero_reg);
+    srl(tmp2, input, 24);
+    or_(dest, tmp, tmp2);
   }
 }
 
@@ -939,25 +1013,28 @@ void TurboAssembler::ByteSwapUnsigned(Register dest, Register src,
   DCHECK(operand_size == 1 || operand_size == 2);
 
   if (IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) {
+    Register input = src;
     if (operand_size == 1) {
-      andi(src, src, 0xFF);
+      input = dest;
+      andi(dest, src, 0xFF);
     } else {
-      andi(src, src, 0xFFFF);
+      input = dest;
+      andi(dest, src, 0xFFFF);
     }
     // No need to do any preparation if operand_size is 4
 
-    wsbh(dest, src);
+    wsbh(dest, input);
     rotr(dest, dest, 16);
   } else if (IsMipsArchVariant(kMips32r1) || IsMipsArchVariant(kLoongson)) {
     if (operand_size == 1) {
-      sll(src, src, 24);
+      sll(dest, src, 24);
     } else {
-      Register tmp = t0;
+      Register tmp = at;
 
       andi(tmp, src, 0xFF00);
-      sll(src, src, 24);
+      sll(dest, src, 24);
       sll(tmp, tmp, 8);
-      or_(dest, tmp, src);
+      or_(dest, tmp, dest);
     }
   }
 }
@@ -1162,45 +1239,54 @@ void TurboAssembler::Usdc1(FPURegister fd, const MemOperand& rs,
 void TurboAssembler::Ldc1(FPURegister fd, const MemOperand& src) {
   // Workaround for non-8-byte alignment of HeapNumber, convert 64-bit
   // load to two 32-bit loads.
-  DCHECK(Register::kMantissaOffset <= 4 && Register::kExponentOffset <= 4);
-  MemOperand tmp = src;
-  AdjustBaseAndOffset(tmp, OffsetAccessType::TWO_ACCESSES);
-  lwc1(fd, MemOperand(tmp.rm(), tmp.offset() + Register::kMantissaOffset));
-  if (IsFp32Mode()) {  // fp32 mode.
-    FPURegister nextfpreg = FPURegister::from_code(fd.code() + 1);
-    lwc1(nextfpreg,
+  {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
+    DCHECK(Register::kMantissaOffset <= 4 && Register::kExponentOffset <= 4);
+    MemOperand tmp = src;
+    AdjustBaseAndOffset(tmp, OffsetAccessType::TWO_ACCESSES);
+    lwc1(fd, MemOperand(tmp.rm(), tmp.offset() + Register::kMantissaOffset));
+    if (IsFp32Mode()) {  // fp32 mode.
+      FPURegister nextfpreg = FPURegister::from_code(fd.code() + 1);
+      lwc1(nextfpreg,
+           MemOperand(tmp.rm(), tmp.offset() + Register::kExponentOffset));
+    } else {
+      DCHECK(IsFp64Mode() || IsFpxxMode());
+      // Currently we support FPXX and FP64 on Mips32r2 and Mips32r6
+      DCHECK(IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6));
+      UseScratchRegisterScope temps(this);
+      Register scratch = temps.Acquire();
+      DCHECK(src.rm() != scratch);
+      lw(scratch,
          MemOperand(tmp.rm(), tmp.offset() + Register::kExponentOffset));
-  } else {
-    DCHECK(IsFp64Mode() || IsFpxxMode());
-    // Currently we support FPXX and FP64 on Mips32r2 and Mips32r6
-    DCHECK(IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6));
-    UseScratchRegisterScope temps(this);
-    Register scratch = temps.Acquire();
-    DCHECK(src.rm() != scratch);
-    lw(scratch, MemOperand(tmp.rm(), tmp.offset() + Register::kExponentOffset));
-    Mthc1(scratch, fd);
+      Mthc1(scratch, fd);
+    }
   }
+  CheckTrampolinePoolQuick(1);
 }
 
 void TurboAssembler::Sdc1(FPURegister fd, const MemOperand& src) {
   // Workaround for non-8-byte alignment of HeapNumber, convert 64-bit
   // store to two 32-bit stores.
-  DCHECK(Register::kMantissaOffset <= 4 && Register::kExponentOffset <= 4);
-  MemOperand tmp = src;
-  AdjustBaseAndOffset(tmp, OffsetAccessType::TWO_ACCESSES);
-  swc1(fd, MemOperand(tmp.rm(), tmp.offset() + Register::kMantissaOffset));
-  if (IsFp32Mode()) {  // fp32 mode.
-    FPURegister nextfpreg = FPURegister::from_code(fd.code() + 1);
-    swc1(nextfpreg,
-         MemOperand(tmp.rm(), tmp.offset() + Register::kExponentOffset));
-  } else {
-    DCHECK(IsFp64Mode() || IsFpxxMode());
-    // Currently we support FPXX and FP64 on Mips32r2 and Mips32r6
-    DCHECK(IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6));
-    DCHECK(src.rm() != t8);
-    Mfhc1(t8, fd);
-    sw(t8, MemOperand(tmp.rm(), tmp.offset() + Register::kExponentOffset));
+  {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
+    DCHECK(Register::kMantissaOffset <= 4 && Register::kExponentOffset <= 4);
+    MemOperand tmp = src;
+    AdjustBaseAndOffset(tmp, OffsetAccessType::TWO_ACCESSES);
+    swc1(fd, MemOperand(tmp.rm(), tmp.offset() + Register::kMantissaOffset));
+    if (IsFp32Mode()) {  // fp32 mode.
+      FPURegister nextfpreg = FPURegister::from_code(fd.code() + 1);
+      swc1(nextfpreg,
+           MemOperand(tmp.rm(), tmp.offset() + Register::kExponentOffset));
+    } else {
+      DCHECK(IsFp64Mode() || IsFpxxMode());
+      // Currently we support FPXX and FP64 on Mips32r2 and Mips32r6
+      DCHECK(IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6));
+      DCHECK(src.rm() != t8);
+      Mfhc1(t8, fd);
+      sw(t8, MemOperand(tmp.rm(), tmp.offset() + Register::kExponentOffset));
+    }
   }
+  CheckTrampolinePoolQuick(1);
 }
 
 void TurboAssembler::Ll(Register rd, const MemOperand& rs) {
@@ -2170,23 +2256,22 @@ void TurboAssembler::FmoveLow(FPURegister dst, Register src_low) {
   }
 }
 
-void TurboAssembler::Move(FPURegister dst, float imm) {
+void TurboAssembler::Move(FPURegister dst, uint32_t src) {
   UseScratchRegisterScope temps(this);
   Register scratch = temps.Acquire();
-  li(scratch, Operand(bit_cast<int32_t>(imm)));
+  li(scratch, Operand(static_cast<int32_t>(src)));
   mtc1(scratch, dst);
 }
 
-void TurboAssembler::Move(FPURegister dst, double imm) {
-  int64_t imm_bits = bit_cast<int64_t>(imm);
+void TurboAssembler::Move(FPURegister dst, uint64_t src) {
   // Handle special values first.
-  if (imm_bits == bit_cast<int64_t>(0.0) && has_double_zero_reg_set_) {
+  if (src == bit_cast<uint64_t>(0.0) && has_double_zero_reg_set_) {
     mov_d(dst, kDoubleRegZero);
-  } else if (imm_bits == bit_cast<int64_t>(-0.0) && has_double_zero_reg_set_) {
+  } else if (src == bit_cast<uint64_t>(-0.0) && has_double_zero_reg_set_) {
     Neg_d(dst, kDoubleRegZero);
   } else {
-    uint32_t lo, hi;
-    DoubleAsTwoUInt32(imm, &lo, &hi);
+    uint32_t lo = src & 0xFFFFFFFF;
+    uint32_t hi = src >> 32;
     // Move the low part of the double into the lower of the corresponding FPU
     // register of FPU register pair.
     if (lo != 0) {
@@ -2211,6 +2296,115 @@ void TurboAssembler::Move(FPURegister dst, double imm) {
   }
 }
 
+void TurboAssembler::LoadZeroOnCondition(Register rd, Register rs,
+                                         const Operand& rt, Condition cond) {
+  switch (cond) {
+    case cc_always:
+      mov(rd, zero_reg);
+      break;
+    case eq:
+      if (rs == zero_reg) {
+        if (rt.is_reg()) {
+          LoadZeroIfConditionZero(rd, rt.rm());
+        } else {
+          if (rt.immediate() == 0) {
+            mov(rd, zero_reg);
+          } else {
+            nop();
+          }
+        }
+      } else if (IsZero(rt)) {
+        LoadZeroIfConditionZero(rd, rs);
+      } else {
+        Subu(t9, rs, rt);
+        LoadZeroIfConditionZero(rd, t9);
+      }
+      break;
+    case ne:
+      if (rs == zero_reg) {
+        if (rt.is_reg()) {
+          LoadZeroIfConditionNotZero(rd, rt.rm());
+        } else {
+          if (rt.immediate() != 0) {
+            mov(rd, zero_reg);
+          } else {
+            nop();
+          }
+        }
+      } else if (IsZero(rt)) {
+        LoadZeroIfConditionNotZero(rd, rs);
+      } else {
+        Subu(t9, rs, rt);
+        LoadZeroIfConditionNotZero(rd, t9);
+      }
+      break;
+
+    // Signed comparison.
+    case greater:
+      Sgt(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      break;
+    case greater_equal:
+      Sge(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      // rs >= rt
+      break;
+    case less:
+      Slt(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      // rs < rt
+      break;
+    case less_equal:
+      Sle(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      // rs <= rt
+      break;
+
+    // Unsigned comparison.
+    case Ugreater:
+      Sgtu(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      // rs > rt
+      break;
+
+    case Ugreater_equal:
+      Sgeu(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      // rs >= rt
+      break;
+    case Uless:
+      Sltu(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      // rs < rt
+      break;
+    case Uless_equal:
+      Sleu(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      // rs <= rt
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+void TurboAssembler::LoadZeroIfConditionNotZero(Register dest,
+                                                Register condition) {
+  if (IsMipsArchVariant(kMips32r6)) {
+    seleqz(dest, dest, condition);
+  } else {
+    Movn(dest, zero_reg, condition);
+  }
+}
+
+void TurboAssembler::LoadZeroIfConditionZero(Register dest,
+                                             Register condition) {
+  if (IsMipsArchVariant(kMips32r6)) {
+    selnez(dest, dest, condition);
+  } else {
+    Movz(dest, zero_reg, condition);
+  }
+}
+
 void TurboAssembler::Movz(Register rd, Register rs, Register rt) {
   if (IsMipsArchVariant(kLoongson) || IsMipsArchVariant(kMips32r6)) {
     Label done;
@@ -2308,6 +2502,79 @@ void TurboAssembler::Clz(Register rd, Register rs) {
   }
 }
 
+void TurboAssembler::Ctz(Register rd, Register rs) {
+  if (IsMipsArchVariant(kMips32r6)) {
+    // We don't have an instruction to count the number of trailing zeroes.
+    // Start by flipping the bits end-for-end so we can count the number of
+    // leading zeroes instead.
+    Ror(rd, rs, 16);
+    wsbh(rd, rd);
+    bitswap(rd, rd);
+    Clz(rd, rd);
+  } else {
+    // Convert trailing zeroes to trailing ones, and bits to their left
+    // to zeroes.
+    UseScratchRegisterScope temps(this);
+    Register scratch = temps.Acquire();
+    Addu(scratch, rs, -1);
+    Xor(rd, scratch, rs);
+    And(rd, rd, scratch);
+    // Count number of leading zeroes.
+    Clz(rd, rd);
+    // Subtract number of leading zeroes from 32 to get number of trailing
+    // ones. Remember that the trailing ones were formerly trailing zeroes.
+    li(scratch, 32);
+    Subu(rd, scratch, rd);
+  }
+}
+
+void TurboAssembler::Popcnt(Register rd, Register rs) {
+  // https://graphics.stanford.edu/~seander/bithacks.html#CountBitsSetParallel
+  //
+  // A generalization of the best bit counting method to integers of
+  // bit-widths up to 128 (parameterized by type T) is this:
+  //
+  // v = v - ((v >> 1) & (T)~(T)0/3);                           // temp
+  // v = (v & (T)~(T)0/15*3) + ((v >> 2) & (T)~(T)0/15*3);      // temp
+  // v = (v + (v >> 4)) & (T)~(T)0/255*15;                      // temp
+  // c = (T)(v * ((T)~(T)0/255)) >> (sizeof(T) - 1) * BITS_PER_BYTE; //count
+  //
+  // For comparison, for 32-bit quantities, this algorithm can be executed
+  // using 20 MIPS instructions (the calls to LoadConst32() generate two
+  // machine instructions each for the values being used in this algorithm).
+  // A(n unrolled) loop-based algorithm requires 25 instructions.
+  //
+  // For 64-bit quantities, this algorithm gets executed twice, (once
+  // for in_lo, and again for in_hi), but saves a few instructions
+  // because the mask values only have to be loaded once. Using this
+  // algorithm the count for a 64-bit operand can be performed in 29
+  // instructions compared to a loop-based algorithm which requires 47
+  // instructions.
+  uint32_t B0 = 0x55555555;     // (T)~(T)0/3
+  uint32_t B1 = 0x33333333;     // (T)~(T)0/15*3
+  uint32_t B2 = 0x0F0F0F0F;     // (T)~(T)0/255*15
+  uint32_t value = 0x01010101;  // (T)~(T)0/255
+  uint32_t shift = 24;          // (sizeof(T) - 1) * BITS_PER_BYTE
+  UseScratchRegisterScope temps(this);
+  Register scratch = temps.Acquire();
+  Register scratch2 = t8;
+  srl(scratch, rs, 1);
+  li(scratch2, B0);
+  And(scratch, scratch, scratch2);
+  Subu(scratch, rs, scratch);
+  li(scratch2, B1);
+  And(rd, scratch, scratch2);
+  srl(scratch, scratch, 2);
+  And(scratch, scratch, scratch2);
+  Addu(scratch, rd, scratch);
+  srl(rd, scratch, 4);
+  Addu(rd, rd, scratch);
+  li(scratch2, B2);
+  And(rd, rd, scratch2);
+  li(scratch, value);
+  Mul(rd, rd, scratch);
+  srl(rd, rd, shift);
+}
 
 void MacroAssembler::EmitFPUTruncate(FPURoundingMode rounding_mode,
                                      Register result,
@@ -2526,14 +2793,6 @@ void TurboAssembler::BranchShort(Label* L, BranchDelaySlot bdslot) {
 }
 
 
-static inline bool IsZero(const Operand& rt) {
-  if (rt.is_reg()) {
-    return rt.rm() == zero_reg;
-  } else {
-    return rt.immediate() == 0;
-  }
-}
-
 int32_t TurboAssembler::GetOffset(int32_t offset, Label* L, OffsetSize bits) {
   if (L) {
     offset = branch_offset_helper(L, bits) >> 2;
@@ -3997,6 +4256,7 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
   li(t0, Operand(debug_hook_active));
   lb(t0, MemOperand(t0));
   Branch(&skip_hook, eq, t0, Operand(zero_reg));
+
   {
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
@@ -4054,13 +4314,15 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
     // We call indirectly through the code field in the function to
     // allow recompilation to take effect without changing any of the
     // call sites.
-    Register code = t0;
+    Register code = kJavaScriptCallCodeStartRegister;
     lw(code, FieldMemOperand(function, JSFunction::kCodeOffset));
     if (flag == CALL_FUNCTION) {
-      Call(code, Code::kHeaderSize - kHeapObjectTag);
+      Addu(code, code, Code::kHeaderSize - kHeapObjectTag);
+      Call(code);
     } else {
       DCHECK(flag == JUMP_FUNCTION);
-      Jump(code, Code::kHeaderSize - kHeapObjectTag);
+      Addu(code, code, Code::kHeaderSize - kHeapObjectTag);
+      Jump(code);
     }
     // Continue here if InvokePrologue does handle the invocation due to
     // mismatched parameter counts.
@@ -4105,14 +4367,6 @@ void MacroAssembler::InvokeFunction(Register function,
   InvokeFunctionCode(a1, no_reg, expected, actual, flag);
 }
 
-void MacroAssembler::InvokeFunction(Handle<JSFunction> function,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual,
-                                    InvokeFlag flag) {
-  li(a1, function);
-  InvokeFunction(a1, expected, actual, flag);
-}
-
 
 // ---------------------------------------------------------------------------
 // Support functions.
@@ -4161,254 +4415,90 @@ bool TurboAssembler::AllowThisStubCall(CodeStub* stub) {
   return has_frame() || !stub->SometimesSetsUpAFrame();
 }
 
-static inline void BranchOvfHelper(TurboAssembler* tasm, Register overflow_dst,
-                                   Label* overflow_label,
-                                   Label* no_overflow_label) {
-  DCHECK(overflow_label || no_overflow_label);
-  if (!overflow_label) {
-    DCHECK(no_overflow_label);
-    tasm->Branch(no_overflow_label, ge, overflow_dst, Operand(zero_reg));
+void TurboAssembler::AddOverflow(Register dst, Register left,
+                                 const Operand& right, Register overflow) {
+  Register right_reg = no_reg;
+  Register scratch = t8;
+  if (!right.is_reg()) {
+    li(at, Operand(right));
+    right_reg = at;
   } else {
-    tasm->Branch(overflow_label, lt, overflow_dst, Operand(zero_reg));
-    if (no_overflow_label) tasm->Branch(no_overflow_label);
+    right_reg = right.rm();
   }
-}
 
-void TurboAssembler::AddBranchOvf(Register dst, Register left,
-                                  const Operand& right, Label* overflow_label,
-                                  Label* no_overflow_label, Register scratch) {
-  if (right.is_reg()) {
-    AddBranchOvf(dst, left, right.rm(), overflow_label, no_overflow_label,
-                 scratch);
+  DCHECK(left != scratch && right_reg != scratch && dst != scratch &&
+         overflow != scratch);
+  DCHECK(overflow != left && overflow != right_reg);
+
+  if (dst == left || dst == right_reg) {
+    addu(scratch, left, right_reg);
+    xor_(overflow, scratch, left);
+    xor_(at, scratch, right_reg);
+    and_(overflow, overflow, at);
+    mov(dst, scratch);
   } else {
-    if (IsMipsArchVariant(kMips32r6)) {
-      Register right_reg = t9;
-      DCHECK(left != right_reg);
-      li(right_reg, Operand(right));
-      AddBranchOvf(dst, left, right_reg, overflow_label, no_overflow_label);
-    } else {
-      Register overflow_dst = t9;
-      DCHECK(dst != scratch);
-      DCHECK(dst != overflow_dst);
-      DCHECK(scratch != overflow_dst);
-      DCHECK(left != overflow_dst);
-      if (dst == left) {
-        mov(scratch, left);                  // Preserve left.
-        Addu(dst, left, right.immediate());  // Left is overwritten.
-        xor_(scratch, dst, scratch);         // Original left.
-        // Load right since xori takes uint16 as immediate.
-        Addu(overflow_dst, zero_reg, right);
-        xor_(overflow_dst, dst, overflow_dst);
-        and_(overflow_dst, overflow_dst, scratch);
-      } else {
-        Addu(dst, left, right.immediate());
-        xor_(overflow_dst, dst, left);
-        // Load right since xori takes uint16 as immediate.
-        Addu(scratch, zero_reg, right);
-        xor_(scratch, dst, scratch);
-        and_(overflow_dst, scratch, overflow_dst);
-      }
-      BranchOvfHelper(this, overflow_dst, overflow_label, no_overflow_label);
-    }
+    addu(dst, left, right_reg);
+    xor_(overflow, dst, left);
+    xor_(at, dst, right_reg);
+    and_(overflow, overflow, at);
   }
 }
 
-void TurboAssembler::AddBranchOvf(Register dst, Register left, Register right,
-                                  Label* overflow_label,
-                                  Label* no_overflow_label, Register scratch) {
-  if (IsMipsArchVariant(kMips32r6)) {
-    if (!overflow_label) {
-      DCHECK(no_overflow_label);
-      DCHECK(dst != scratch);
-      Register left_reg = left == dst ? scratch : left;
-      Register right_reg = right == dst ? t9 : right;
-      DCHECK(dst != left_reg);
-      DCHECK(dst != right_reg);
-      Move(left_reg, left);
-      Move(right_reg, right);
-      addu(dst, left, right);
-      Bnvc(left_reg, right_reg, no_overflow_label);
-    } else {
-      Bovc(left, right, overflow_label);
-      addu(dst, left, right);
-      if (no_overflow_label) bc(no_overflow_label);
-    }
-  } else {
-    Register overflow_dst = t9;
-    DCHECK(dst != scratch);
-    DCHECK(dst != overflow_dst);
-    DCHECK(scratch != overflow_dst);
-    DCHECK(left != overflow_dst);
-    DCHECK(right != overflow_dst);
-    DCHECK(left != scratch);
-    DCHECK(right != scratch);
-
-    if (left == right && dst == left) {
-      mov(overflow_dst, right);
-      right = overflow_dst;
-    }
-
-    if (dst == left) {
-      mov(scratch, left);           // Preserve left.
-      addu(dst, left, right);       // Left is overwritten.
-      xor_(scratch, dst, scratch);  // Original left.
-      xor_(overflow_dst, dst, right);
-      and_(overflow_dst, overflow_dst, scratch);
-    } else if (dst == right) {
-      mov(scratch, right);          // Preserve right.
-      addu(dst, left, right);       // Right is overwritten.
-      xor_(scratch, dst, scratch);  // Original right.
-      xor_(overflow_dst, dst, left);
-      and_(overflow_dst, overflow_dst, scratch);
-    } else {
-      addu(dst, left, right);
-      xor_(overflow_dst, dst, left);
-      xor_(scratch, dst, right);
-      and_(overflow_dst, scratch, overflow_dst);
-    }
-    BranchOvfHelper(this, overflow_dst, overflow_label, no_overflow_label);
-  }
-}
-
-void TurboAssembler::SubBranchOvf(Register dst, Register left,
-                                  const Operand& right, Label* overflow_label,
-                                  Label* no_overflow_label, Register scratch) {
-  DCHECK(overflow_label || no_overflow_label);
-  if (right.is_reg()) {
-    SubBranchOvf(dst, left, right.rm(), overflow_label, no_overflow_label,
-                 scratch);
-  } else {
-    Register overflow_dst = t9;
-    DCHECK(dst != scratch);
-    DCHECK(dst != overflow_dst);
-    DCHECK(scratch != overflow_dst);
-    DCHECK(left != overflow_dst);
-    DCHECK(left != scratch);
-    if (dst == left) {
-      mov(scratch, left);                      // Preserve left.
-      Subu(dst, left, right.immediate());      // Left is overwritten.
-      // Load right since xori takes uint16 as immediate.
-      Addu(overflow_dst, zero_reg, right);
-      xor_(overflow_dst, scratch, overflow_dst);  // scratch is original left.
-      xor_(scratch, dst, scratch);                // scratch is original left.
-      and_(overflow_dst, scratch, overflow_dst);
-    } else {
-      Subu(dst, left, right);
-      xor_(overflow_dst, dst, left);
-      // Load right since xori takes uint16 as immediate.
-      Addu(scratch, zero_reg, right);
-      xor_(scratch, left, scratch);
-      and_(overflow_dst, scratch, overflow_dst);
-    }
-    BranchOvfHelper(this, overflow_dst, overflow_label, no_overflow_label);
-  }
-}
-
-void TurboAssembler::SubBranchOvf(Register dst, Register left, Register right,
-                                  Label* overflow_label,
-                                  Label* no_overflow_label, Register scratch) {
-  DCHECK(overflow_label || no_overflow_label);
-  Register overflow_dst = t9;
-  DCHECK(dst != scratch);
-  DCHECK(dst != overflow_dst);
-  DCHECK(scratch != overflow_dst);
-  DCHECK(overflow_dst != left);
-  DCHECK(overflow_dst != right);
-  DCHECK(scratch != left);
-  DCHECK(scratch != right);
-
-  // This happens with some crankshaft code. Since Subu works fine if
-  // left == right, let's not make that restriction here.
-  if (left == right) {
-    mov(dst, zero_reg);
-    if (no_overflow_label) {
-      Branch(no_overflow_label);
-    }
-  }
-
-  if (dst == left) {
-    mov(scratch, left);  // Preserve left.
-    subu(dst, left, right);  // Left is overwritten.
-    xor_(overflow_dst, dst, scratch);  // scratch is original left.
-    xor_(scratch, scratch, right);  // scratch is original left.
-    and_(overflow_dst, scratch, overflow_dst);
-  } else if (dst == right) {
-    mov(scratch, right);  // Preserve right.
-    subu(dst, left, right);  // Right is overwritten.
-    xor_(overflow_dst, dst, left);
-    xor_(scratch, left, scratch);  // Original right.
-    and_(overflow_dst, scratch, overflow_dst);
-  } else {
-    subu(dst, left, right);
-    xor_(overflow_dst, dst, left);
-    xor_(scratch, left, right);
-    and_(overflow_dst, scratch, overflow_dst);
-  }
-  BranchOvfHelper(this, overflow_dst, overflow_label, no_overflow_label);
-}
-
-static inline void BranchOvfHelperMult(TurboAssembler* tasm,
-                                       Register overflow_dst,
-                                       Label* overflow_label,
-                                       Label* no_overflow_label) {
-  DCHECK(overflow_label || no_overflow_label);
-  if (!overflow_label) {
-    DCHECK(no_overflow_label);
-    tasm->Branch(no_overflow_label, eq, overflow_dst, Operand(zero_reg));
-  } else {
-    tasm->Branch(overflow_label, ne, overflow_dst, Operand(zero_reg));
-    if (no_overflow_label) tasm->Branch(no_overflow_label);
-  }
-}
-
-void TurboAssembler::MulBranchOvf(Register dst, Register left,
-                                  const Operand& right, Label* overflow_label,
-                                  Label* no_overflow_label, Register scratch) {
-  DCHECK(overflow_label || no_overflow_label);
-  if (right.is_reg()) {
-    MulBranchOvf(dst, left, right.rm(), overflow_label, no_overflow_label,
-                 scratch);
-  } else {
-    Register overflow_dst = t9;
-    DCHECK(dst != scratch);
-    DCHECK(dst != overflow_dst);
-    DCHECK(scratch != overflow_dst);
-    DCHECK(left != overflow_dst);
-    DCHECK(left != scratch);
-
-    Mul(overflow_dst, dst, left, right.immediate());
-    sra(scratch, dst, 31);
-    xor_(overflow_dst, overflow_dst, scratch);
+void TurboAssembler::SubOverflow(Register dst, Register left,
+                                 const Operand& right, Register overflow) {
+  Register right_reg = no_reg;
+  Register scratch = t8;
+  if (!right.is_reg()) {
+    li(at, Operand(right));
+    right_reg = at;
+  } else {
+    right_reg = right.rm();
+  }
+
+  DCHECK(left != scratch && right_reg != scratch && dst != scratch &&
+         overflow != scratch);
+  DCHECK(overflow != left && overflow != right_reg);
 
-    BranchOvfHelperMult(this, overflow_dst, overflow_label, no_overflow_label);
+  if (dst == left || dst == right_reg) {
+    subu(scratch, left, right_reg);
+    xor_(overflow, left, scratch);
+    xor_(at, left, right_reg);
+    and_(overflow, overflow, at);
+    mov(dst, scratch);
+  } else {
+    subu(dst, left, right_reg);
+    xor_(overflow, left, dst);
+    xor_(at, left, right_reg);
+    and_(overflow, overflow, at);
   }
 }
 
-void TurboAssembler::MulBranchOvf(Register dst, Register left, Register right,
-                                  Label* overflow_label,
-                                  Label* no_overflow_label, Register scratch) {
-  DCHECK(overflow_label || no_overflow_label);
-  Register overflow_dst = t9;
-  DCHECK(dst != scratch);
-  DCHECK(dst != overflow_dst);
-  DCHECK(scratch != overflow_dst);
-  DCHECK(overflow_dst != left);
-  DCHECK(overflow_dst != right);
-  DCHECK(scratch != left);
-  DCHECK(scratch != right);
+void TurboAssembler::MulOverflow(Register dst, Register left,
+                                 const Operand& right, Register overflow) {
+  Register right_reg = no_reg;
+  Register scratch = t8;
+  Register scratch2 = t9;
+  if (!right.is_reg()) {
+    li(at, Operand(right));
+    right_reg = at;
+  } else {
+    right_reg = right.rm();
+  }
+
+  DCHECK(left != scratch && right_reg != scratch && dst != scratch &&
+         overflow != scratch);
+  DCHECK(overflow != left && overflow != right_reg);
 
-  if (IsMipsArchVariant(kMips32r6) && dst == right) {
-    mov(scratch, right);
-    Mul(overflow_dst, dst, left, scratch);
-    sra(scratch, dst, 31);
-    xor_(overflow_dst, overflow_dst, scratch);
+  if (dst == left || dst == right_reg) {
+    Mul(overflow, scratch2, left, right_reg);
+    sra(scratch, scratch2, 31);
+    xor_(overflow, overflow, scratch);
+    mov(dst, scratch2);
   } else {
-    Mul(overflow_dst, dst, left, right);
+    Mul(overflow, dst, left, right_reg);
     sra(scratch, dst, 31);
-    xor_(overflow_dst, overflow_dst, scratch);
+    xor_(overflow, overflow, scratch);
   }
-
-  BranchOvfHelperMult(this, overflow_dst, overflow_label, no_overflow_label);
 }
 
 void TurboAssembler::CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
@@ -4467,6 +4557,19 @@ void MacroAssembler::JumpToExternalReference(const ExternalReference& builtin,
        bd);
 }
 
+void MacroAssembler::JumpToInstructionStream(Address entry) {
+  li(kOffHeapTrampolineRegister,
+     Operand(reinterpret_cast<int32_t>(entry), RelocInfo::OFF_HEAP_TARGET));
+  Jump(kOffHeapTrampolineRegister);
+}
+
+void MacroAssembler::LoadWeakValue(Register out, Register in,
+                                   Label* target_if_cleared) {
+  Branch(target_if_cleared, eq, in, Operand(kClearedWeakHeapObject));
+
+  And(out, in, Operand(~kWeakHeapObjectMask));
+}
+
 void MacroAssembler::IncrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK_GT(value, 0);
@@ -4853,6 +4956,20 @@ void MacroAssembler::AssertFixedArray(Register object) {
   }
 }
 
+void MacroAssembler::AssertConstructor(Register object) {
+  if (emit_debug_code()) {
+    STATIC_ASSERT(kSmiTag == 0);
+    SmiTst(object, t8);
+    Check(ne, AbortReason::kOperandIsASmiAndNotAConstructor, t8,
+          Operand(zero_reg));
+
+    lw(t8, FieldMemOperand(object, HeapObject::kMapOffset));
+    lbu(t8, FieldMemOperand(t8, Map::kBitFieldOffset));
+    And(t8, t8, Operand(Map::IsConstructorBit::kMask));
+    Check(ne, AbortReason::kOperandIsNotAConstructor, t8, Operand(zero_reg));
+  }
+}
+
 void MacroAssembler::AssertFunction(Register object) {
   if (emit_debug_code()) {
     STATIC_ASSERT(kSmiTag == 0);
@@ -5274,6 +5391,28 @@ bool AreAliased(Register reg1, Register reg2, Register reg3, Register reg4,
   return n_of_valid_regs != n_of_non_aliasing_regs;
 }
 
+void TurboAssembler::ComputeCodeStartAddress(Register dst) {
+  // This push on ra and the pop below together ensure that we restore the
+  // register ra, which is needed while computing the code start address.
+  push(ra);
+
+  // The bal instruction puts the address of the current instruction into
+  // the return address (ra) register, which we can use later on.
+  Label current;
+  bal(&current);
+  nop();
+  int pc = pc_offset();
+  bind(&current);
+  li(dst, pc);
+  subu(dst, ra, dst);
+
+  pop(ra);  // Restore ra
+}
+
+void TurboAssembler::ResetSpeculationPoisonRegister() {
+  li(kSpeculationPoisonRegister, -1);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/mips/macro-assembler-mips.h b/deps/v8/src/mips/macro-assembler-mips.h
index 8c70eb54a36..f85184caccb 100644
--- a/deps/v8/src/mips/macro-assembler-mips.h
+++ b/deps/v8/src/mips/macro-assembler-mips.h
@@ -19,12 +19,15 @@ constexpr Register kReturnRegister2 = a0;
 constexpr Register kJSFunctionRegister = a1;
 constexpr Register kContextRegister = s7;
 constexpr Register kAllocateSizeRegister = a0;
+constexpr Register kSpeculationPoisonRegister = t3;
 constexpr Register kInterpreterAccumulatorRegister = v0;
 constexpr Register kInterpreterBytecodeOffsetRegister = t4;
 constexpr Register kInterpreterBytecodeArrayRegister = t5;
 constexpr Register kInterpreterDispatchTableRegister = t6;
 constexpr Register kJavaScriptCallArgCountRegister = a0;
+constexpr Register kJavaScriptCallCodeStartRegister = a2;
 constexpr Register kJavaScriptCallNewTargetRegister = a3;
+constexpr Register kOffHeapTrampolineRegister = at;
 constexpr Register kRuntimeCallFunctionRegister = a1;
 constexpr Register kRuntimeCallArgCountRegister = a0;
 
@@ -458,6 +461,12 @@ class TurboAssembler : public Assembler {
 
   DEFINE_INSTRUCTION(Slt);
   DEFINE_INSTRUCTION(Sltu);
+  DEFINE_INSTRUCTION(Sle);
+  DEFINE_INSTRUCTION(Sleu);
+  DEFINE_INSTRUCTION(Sgt);
+  DEFINE_INSTRUCTION(Sgtu);
+  DEFINE_INSTRUCTION(Sge);
+  DEFINE_INSTRUCTION(Sgeu);
 
   // MIPS32 R2 instruction macro.
   DEFINE_INSTRUCTION(Ror);
@@ -558,7 +567,14 @@ class TurboAssembler : public Assembler {
   void Movt(Register rd, Register rs, uint16_t cc = 0);
   void Movf(Register rd, Register rs, uint16_t cc = 0);
 
+  void LoadZeroIfConditionNotZero(Register dest, Register condition);
+  void LoadZeroIfConditionZero(Register dest, Register condition);
+  void LoadZeroOnCondition(Register rd, Register rs, const Operand& rt,
+                           Condition cond);
+
   void Clz(Register rd, Register rs);
+  void Ctz(Register rd, Register rs);
+  void Popcnt(Register rd, Register rs);
 
   // Int64Lowering instructions
   void AddPair(Register dst_low, Register dst_high, Register left_low,
@@ -731,67 +747,25 @@ class TurboAssembler : public Assembler {
     Mthc1(src_high, dst);
   }
 
-  void Move(FPURegister dst, float imm);
-  void Move(FPURegister dst, double imm);
+  void Move(FPURegister dst, float imm) { Move(dst, bit_cast<uint32_t>(imm)); }
+  void Move(FPURegister dst, double imm) { Move(dst, bit_cast<uint64_t>(imm)); }
+  void Move(FPURegister dst, uint32_t src);
+  void Move(FPURegister dst, uint64_t src);
 
   // -------------------------------------------------------------------------
-  // Overflow handling functions.
-  // Usage: first call the appropriate arithmetic function, then call one of the
-  // jump functions with the overflow_dst register as the second parameter.
-
-  inline void AddBranchOvf(Register dst, Register left, const Operand& right,
-                           Label* overflow_label, Register scratch = at) {
-    AddBranchOvf(dst, left, right, overflow_label, nullptr, scratch);
-  }
-
-  inline void AddBranchNoOvf(Register dst, Register left, const Operand& right,
-                             Label* no_overflow_label, Register scratch = at) {
-    AddBranchOvf(dst, left, right, nullptr, no_overflow_label, scratch);
-  }
-
-  void AddBranchOvf(Register dst, Register left, const Operand& right,
-                    Label* overflow_label, Label* no_overflow_label,
-                    Register scratch = at);
-
-  void AddBranchOvf(Register dst, Register left, Register right,
-                    Label* overflow_label, Label* no_overflow_label,
-                    Register scratch = at);
-
-  inline void SubBranchOvf(Register dst, Register left, const Operand& right,
-                           Label* overflow_label, Register scratch = at) {
-    SubBranchOvf(dst, left, right, overflow_label, nullptr, scratch);
-  }
-
-  inline void SubBranchNoOvf(Register dst, Register left, const Operand& right,
-                             Label* no_overflow_label, Register scratch = at) {
-    SubBranchOvf(dst, left, right, nullptr, no_overflow_label, scratch);
-  }
-
-  void SubBranchOvf(Register dst, Register left, const Operand& right,
-                    Label* overflow_label, Label* no_overflow_label,
-                    Register scratch = at);
-
-  void SubBranchOvf(Register dst, Register left, Register right,
-                    Label* overflow_label, Label* no_overflow_label,
-                    Register scratch = at);
-
-  inline void MulBranchOvf(Register dst, Register left, const Operand& right,
-                           Label* overflow_label, Register scratch = at) {
-    MulBranchOvf(dst, left, right, overflow_label, nullptr, scratch);
-  }
-
-  inline void MulBranchNoOvf(Register dst, Register left, const Operand& right,
-                             Label* no_overflow_label, Register scratch = at) {
-    MulBranchOvf(dst, left, right, nullptr, no_overflow_label, scratch);
-  }
-
-  void MulBranchOvf(Register dst, Register left, const Operand& right,
-                    Label* overflow_label, Label* no_overflow_label,
-                    Register scratch = at);
-
-  void MulBranchOvf(Register dst, Register left, Register right,
-                    Label* overflow_label, Label* no_overflow_label,
-                    Register scratch = at);
+  // Overflow operations.
+
+  // AddOverflow sets overflow register to a negative value if
+  // overflow occured, otherwise it is zero or positive
+  void AddOverflow(Register dst, Register left, const Operand& right,
+                   Register overflow);
+  // SubOverflow sets overflow register to a negative value if
+  // overflow occured, otherwise it is zero or positive
+  void SubOverflow(Register dst, Register left, const Operand& right,
+                   Register overflow);
+  // MulOverflow sets overflow register to zero if no overflow occured
+  void MulOverflow(Register dst, Register left, const Operand& right,
+                   Register overflow);
 
 // Number of instructions needed for calculation of switch table entry address
 #ifdef _MIPS_ARCH_MIPS32R6
@@ -844,6 +818,12 @@ class TurboAssembler : public Assembler {
     BranchF64(bd, target, nan, cc, cmp1, cmp2);
   }
 
+  // Compute the start of the generated instruction stream from the current PC.
+  // This is an alternative to embedding the {CodeObject} handle as a reference.
+  void ComputeCodeStartAddress(Register dst);
+
+  void ResetSpeculationPoisonRegister();
+
  protected:
   void BranchLong(Label* L, BranchDelaySlot bdslot);
 
@@ -1023,10 +1003,6 @@ class MacroAssembler : public TurboAssembler {
   void InvokeFunction(Register function, const ParameterCount& expected,
                       const ParameterCount& actual, InvokeFlag flag);
 
-  void InvokeFunction(Handle<JSFunction> function,
-                      const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
-
   // Frame restart support.
   void MaybeDropFrames();
 
@@ -1089,6 +1065,13 @@ const Operand& rt = Operand(zero_reg), BranchDelaySlot bd = PROTECT
                                BranchDelaySlot bd = PROTECT,
                                bool builtin_exit_frame = false);
 
+  // Generates a trampoline to jump to the off-heap instruction stream.
+  void JumpToInstructionStream(Address entry);
+
+  // ---------------------------------------------------------------------------
+  // In-place weak references.
+  void LoadWeakValue(Register out, Register in, Label* target_if_cleared);
+
   // -------------------------------------------------------------------------
   // StatsCounter support.
 
@@ -1131,6 +1114,9 @@ const Operand& rt = Operand(zero_reg), BranchDelaySlot bd = PROTECT
   // Abort execution if argument is not a FixedArray, enabled via --debug-code.
   void AssertFixedArray(Register object);
 
+  // Abort execution if argument is not a Constructor, enabled via --debug-code.
+  void AssertConstructor(Register object);
+
   // Abort execution if argument is not a JSFunction, enabled via --debug-code.
   void AssertFunction(Register object);
 
diff --git a/deps/v8/src/mips/simulator-mips.cc b/deps/v8/src/mips/simulator-mips.cc
index 4994418ef58..b55273eba54 100644
--- a/deps/v8/src/mips/simulator-mips.cc
+++ b/deps/v8/src/mips/simulator-mips.cc
@@ -783,8 +783,7 @@ void MipsDebugger::Debug() {
 #undef XSTR
 }
 
-
-static bool ICacheMatch(void* one, void* two) {
+bool Simulator::ICacheMatch(void* one, void* two) {
   DCHECK_EQ(reinterpret_cast<intptr_t>(one) & CachePage::kPageMask, 0);
   DCHECK_EQ(reinterpret_cast<intptr_t>(two) & CachePage::kPageMask, 0);
   return one == two;
@@ -883,11 +882,6 @@ void Simulator::CheckICache(base::CustomMatcherHashMap* i_cache,
 
 
 Simulator::Simulator(Isolate* isolate) : isolate_(isolate) {
-  i_cache_ = isolate_->simulator_i_cache();
-  if (i_cache_ == nullptr) {
-    i_cache_ = new base::CustomMatcherHashMap(&ICacheMatch);
-    isolate_->set_simulator_i_cache(i_cache_);
-  }
   // Set up simulator support first. Some of this information is needed to
   // setup the architecture state.
   stack_ = reinterpret_cast<char*>(malloc(stack_size_));
@@ -2539,8 +2533,7 @@ void Simulator::PrintStopInfo(uint32_t code) {
 
 
 void Simulator::SignalException(Exception e) {
-  V8_Fatal(__FILE__, __LINE__, "Error: Exception %i raised.",
-           static_cast<int>(e));
+  FATAL("Error: Exception %i raised.", static_cast<int>(e));
 }
 
 // Min/Max template functions for Double and Single arguments.
@@ -5690,7 +5683,8 @@ void Simulator::DecodeTypeMsa3RF() {
     case MSUB_Q:
     case MADDR_Q:
     case MSUBR_Q:
-      get_msa_register(wd_reg(), &wd);  // fall-through
+      get_msa_register(wd_reg(), &wd);
+      V8_FALLTHROUGH;
     case MUL_Q:
     case MULR_Q:
       switch (DecodeMsaDataFormat()) {
@@ -6912,7 +6906,7 @@ void Simulator::DecodeTypeJump() {
 // Executes the current instruction.
 void Simulator::InstructionDecode(Instruction* instr) {
   if (v8::internal::FLAG_check_icache) {
-    CheckICache(isolate_->simulator_i_cache(), instr);
+    CheckICache(i_cache(), instr);
   }
   pc_modified_ = false;
   v8::internal::EmbeddedVector<char, 256> buffer;
diff --git a/deps/v8/src/mips/simulator-mips.h b/deps/v8/src/mips/simulator-mips.h
index 0c417becd53..ffd2c467406 100644
--- a/deps/v8/src/mips/simulator-mips.h
+++ b/deps/v8/src/mips/simulator-mips.h
@@ -258,6 +258,7 @@ class Simulator : public SimulatorBase {
   static void SetRedirectInstruction(Instruction* instruction);
 
   // ICache checking.
+  static bool ICacheMatch(void* one, void* two);
   static void FlushICache(base::CustomMatcherHashMap* i_cache, void* start,
                           size_t size);
 
@@ -450,10 +451,10 @@ class Simulator : public SimulatorBase {
     Instruction* instr_after_compact_branch =
         reinterpret_cast<Instruction*>(current_pc + Instruction::kInstrSize);
     if (instr_after_compact_branch->IsForbiddenAfterBranch()) {
-      V8_Fatal(__FILE__, __LINE__,
-               "Error: Unexpected instruction 0x%08x immediately after a "
-               "compact branch instruction.",
-               *reinterpret_cast<uint32_t*>(instr_after_compact_branch));
+      FATAL(
+          "Error: Unexpected instruction 0x%08x immediately after a "
+          "compact branch instruction.",
+          *reinterpret_cast<uint32_t*>(instr_after_compact_branch));
     }
   }
 
@@ -480,9 +481,8 @@ class Simulator : public SimulatorBase {
     }
 
     if (instr->IsForbiddenInBranchDelay()) {
-      V8_Fatal(__FILE__, __LINE__,
-               "Eror:Unexpected %i opcode in a branch delay slot.",
-               instr->OpcodeValue());
+      FATAL("Eror:Unexpected %i opcode in a branch delay slot.",
+            instr->OpcodeValue());
     }
     InstructionDecode(instr);
     SNPrintF(trace_buf_, " ");
@@ -538,9 +538,6 @@ class Simulator : public SimulatorBase {
   // Debugger input.
   char* last_debugger_input_;
 
-  // Icache simulation.
-  base::CustomMatcherHashMap* i_cache_;
-
   v8::internal::Isolate* isolate_;
 
   // Registered breakpoints.
diff --git a/deps/v8/src/mips64/OWNERS b/deps/v8/src/mips64/OWNERS
index 3fce7dd6883..4ce9d7f91da 100644
--- a/deps/v8/src/mips64/OWNERS
+++ b/deps/v8/src/mips64/OWNERS
@@ -1,2 +1,3 @@
 ivica.bogosavljevic@mips.com
-Miran.Karic@mips.com
\ No newline at end of file
+Miran.Karic@mips.com
+sreten.kovacevic@mips.com
\ No newline at end of file
diff --git a/deps/v8/src/mips64/assembler-mips64-inl.h b/deps/v8/src/mips64/assembler-mips64-inl.h
index ded3da224c9..78ff8343541 100644
--- a/deps/v8/src/mips64/assembler-mips64-inl.h
+++ b/deps/v8/src/mips64/assembler-mips64-inl.h
@@ -33,9 +33,8 @@
 // modified significantly by Google Inc.
 // Copyright 2012 the V8 project authors. All rights reserved.
 
-
-#ifndef V8_MIPS_ASSEMBLER_MIPS_INL_H_
-#define V8_MIPS_ASSEMBLER_MIPS_INL_H_
+#ifndef V8_MIPS64_ASSEMBLER_MIPS64_INL_H_
+#define V8_MIPS64_ASSEMBLER_MIPS64_INL_H_
 
 #include "src/mips64/assembler-mips64.h"
 
@@ -46,8 +45,7 @@
 namespace v8 {
 namespace internal {
 
-
-bool CpuFeatures::SupportsCrankshaft() { return IsSupported(FPU); }
+bool CpuFeatures::SupportsOptimizer() { return IsSupported(FPU); }
 
 bool CpuFeatures::SupportsWasmSimd128() { return IsSupported(MIPS_SIMD); }
 
@@ -82,10 +80,9 @@ Address RelocInfo::target_address() {
 }
 
 Address RelocInfo::target_address_address() {
-  DCHECK(IsCodeTarget(rmode_) ||
-         IsRuntimeEntry(rmode_) ||
-         rmode_ == EMBEDDED_OBJECT ||
-         rmode_ == EXTERNAL_REFERENCE);
+  DCHECK(IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_) || IsWasmCall(rmode_) ||
+         IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
+         IsOffHeapTarget(rmode_));
   // Read the address of the word containing the target_address in an
   // instruction stream.
   // The only architecture-independent user of this function is the serializer.
@@ -121,9 +118,9 @@ Address Assembler::target_address_from_return_address(Address pc) {
 }
 
 void Assembler::deserialization_set_special_target_at(
-    Isolate* isolate, Address instruction_payload, Code* code, Address target) {
+    Address instruction_payload, Code* code, Address target) {
   set_target_address_at(
-      isolate, instruction_payload - kInstructionsFor64BitConstant * kInstrSize,
+      instruction_payload - kInstructionsFor64BitConstant * kInstrSize,
       code ? code->constant_pool() : nullptr, target);
 }
 
@@ -144,9 +141,8 @@ void Assembler::set_target_internal_reference_encoded_at(Address pc,
   // after complete deserialization, no need to flush on each reference.
 }
 
-
 void Assembler::deserialization_set_target_internal_reference_at(
-    Isolate* isolate, Address pc, Address target, RelocInfo::Mode mode) {
+    Address pc, Address target, RelocInfo::Mode mode) {
   if (mode == RelocInfo::INTERNAL_REFERENCE_ENCODED) {
     DCHECK(IsJ(instr_at(pc)));
     set_target_internal_reference_encoded_at(pc, target);
@@ -172,7 +168,7 @@ void RelocInfo::set_target_object(HeapObject* target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
-  Assembler::set_target_address_at(target->GetIsolate(), pc_, constant_pool_,
+  Assembler::set_target_address_at(pc_, constant_pool_,
                                    reinterpret_cast<Address>(target),
                                    icache_flush_mode);
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr &&
@@ -217,15 +213,20 @@ Address RelocInfo::target_runtime_entry(Assembler* origin) {
   return target_address();
 }
 
-void RelocInfo::set_target_runtime_entry(Isolate* isolate, Address target,
+void RelocInfo::set_target_runtime_entry(Address target,
                                          WriteBarrierMode write_barrier_mode,
                                          ICacheFlushMode icache_flush_mode) {
   DCHECK(IsRuntimeEntry(rmode_));
   if (target_address() != target)
-    set_target_address(isolate, target, write_barrier_mode, icache_flush_mode);
+    set_target_address(target, write_barrier_mode, icache_flush_mode);
+}
+
+Address RelocInfo::target_off_heap_target() {
+  DCHECK(IsOffHeapTarget(rmode_));
+  return Assembler::target_address_at(pc_, constant_pool_);
 }
 
-void RelocInfo::WipeOut(Isolate* isolate) {
+void RelocInfo::WipeOut() {
   DCHECK(IsEmbeddedObject(rmode_) || IsCodeTarget(rmode_) ||
          IsRuntimeEntry(rmode_) || IsExternalReference(rmode_) ||
          IsInternalReference(rmode_) || IsInternalReferenceEncoded(rmode_));
@@ -234,12 +235,12 @@ void RelocInfo::WipeOut(Isolate* isolate) {
   } else if (IsInternalReferenceEncoded(rmode_)) {
     Assembler::set_target_internal_reference_encoded_at(pc_, nullptr);
   } else {
-    Assembler::set_target_address_at(isolate, pc_, constant_pool_, nullptr);
+    Assembler::set_target_address_at(pc_, constant_pool_, nullptr);
   }
 }
 
 template <typename ObjectVisitor>
-void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
+void RelocInfo::Visit(ObjectVisitor* visitor) {
   RelocInfo::Mode mode = rmode();
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
@@ -252,6 +253,8 @@ void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
     visitor->VisitInternalReference(host(), this);
   } else if (RelocInfo::IsRuntimeEntry(mode)) {
     visitor->VisitRuntimeEntry(host(), this);
+  } else if (RelocInfo::IsOffHeapTarget(mode)) {
+    visitor->VisitOffHeapTarget(host(), this);
   }
 }
 
@@ -343,4 +346,4 @@ EnsureSpace::EnsureSpace(Assembler* assembler) { assembler->CheckBuffer(); }
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_MIPS_ASSEMBLER_MIPS_INL_H_
+#endif  // V8_MIPS64_ASSEMBLER_MIPS64_INL_H_
diff --git a/deps/v8/src/mips64/assembler-mips64.cc b/deps/v8/src/mips64/assembler-mips64.cc
index a056f66849c..99ed69a19bb 100644
--- a/deps/v8/src/mips64/assembler-mips64.cc
+++ b/deps/v8/src/mips64/assembler-mips64.cc
@@ -76,12 +76,21 @@ void CpuFeatures::ProbeImpl(bool cross_compile) {
 #ifndef __mips__
   // For the simulator build, use FPU.
   supported_ |= 1u << FPU;
+#if defined(_MIPS_ARCH_MIPS64R6) && defined(_MIPS_MSA)
+  supported_ |= 1u << MIPS_SIMD;
+#endif
 #else
   // Probe for additional features at runtime.
   base::CPU cpu;
   if (cpu.has_fpu()) supported_ |= 1u << FPU;
+#if defined(_MIPS_ARCH_MIPS64R6)
+#if defined(_MIPS_MSA)
+  supported_ |= 1u << MIPS_SIMD;
+#else
   if (cpu.has_msa()) supported_ |= 1u << MIPS_SIMD;
 #endif
+#endif
+#endif
 }
 
 
@@ -178,22 +187,20 @@ uint32_t RelocInfo::embedded_size() const {
       (Assembler::target_address_at(pc_, constant_pool_))));
 }
 
-void RelocInfo::set_embedded_address(Isolate* isolate, Address address,
+void RelocInfo::set_embedded_address(Address address,
                                      ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(isolate, pc_, constant_pool_, address,
-                                   flush_mode);
+  Assembler::set_target_address_at(pc_, constant_pool_, address, flush_mode);
 }
 
-void RelocInfo::set_embedded_size(Isolate* isolate, uint32_t size,
-                                  ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(isolate, pc_, constant_pool_,
+void RelocInfo::set_embedded_size(uint32_t size, ICacheFlushMode flush_mode) {
+  Assembler::set_target_address_at(pc_, constant_pool_,
                                    reinterpret_cast<Address>(size), flush_mode);
 }
 
-void RelocInfo::set_js_to_wasm_address(Isolate* isolate, Address address,
+void RelocInfo::set_js_to_wasm_address(Address address,
                                        ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  set_embedded_address(isolate, address, icache_flush_mode);
+  set_embedded_address(address, icache_flush_mode);
 }
 
 Address RelocInfo::js_to_wasm_address() const {
@@ -251,8 +258,7 @@ void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
         break;
     }
     Address pc = buffer_ + request.offset();
-    set_target_value_at(isolate, pc,
-                        reinterpret_cast<uint64_t>(object.location()));
+    set_target_value_at(pc, reinterpret_cast<uint64_t>(object.location()));
   }
 }
 
@@ -2893,15 +2899,6 @@ void Assembler::cfc1(Register rt, FPUControlRegister fs) {
 }
 
 
-void Assembler::DoubleAsTwoUInt32(double d, uint32_t* lo, uint32_t* hi) {
-  uint64_t i;
-  memcpy(&i, &d, 8);
-
-  *lo = i & 0xFFFFFFFF;
-  *hi = i >> 32;
-}
-
-
 void Assembler::sel(SecondaryField fmt, FPURegister fd, FPURegister fs,
                     FPURegister ft) {
   DCHECK_EQ(kArchVariant, kMips64r6);
@@ -4019,7 +4016,7 @@ void Assembler::GrowBuffer() {
   // Some internal data structures overflow for very large buffers,
   // they must ensure that kMaximalBufferSize is not too large.
   if (desc.buffer_size > kMaximalBufferSize) {
-    V8::FatalProcessOutOfMemory("Assembler::GrowBuffer");
+    V8::FatalProcessOutOfMemory(nullptr, "Assembler::GrowBuffer");
   }
 
   // Set up new buffer.
@@ -4217,8 +4214,7 @@ void Assembler::QuietNaN(HeapObject* object) {
 // There is an optimization below, which emits a nop when the address
 // fits in just 16 bits. This is unlikely to help, and should be benchmarked,
 // and possibly removed.
-void Assembler::set_target_value_at(Isolate* isolate, Address pc,
-                                    uint64_t target,
+void Assembler::set_target_value_at(Address pc, uint64_t target,
                                     ICacheFlushMode icache_flush_mode) {
   // There is an optimization where only 4 instructions are used to load address
   // in code on MIP64 because only 48-bits of address is effectively used.
@@ -4249,7 +4245,7 @@ void Assembler::set_target_value_at(Isolate* isolate, Address pc,
              (target & kImm16Mask);
 
   if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(isolate, pc, 4 * Assembler::kInstrSize);
+    Assembler::FlushICache(pc, 4 * Assembler::kInstrSize);
   }
 }
 
diff --git a/deps/v8/src/mips64/assembler-mips64.h b/deps/v8/src/mips64/assembler-mips64.h
index 3530c7e7b28..6a5d3643e3d 100644
--- a/deps/v8/src/mips64/assembler-mips64.h
+++ b/deps/v8/src/mips64/assembler-mips64.h
@@ -32,9 +32,8 @@
 // modified significantly by Google Inc.
 // Copyright 2012 the V8 project authors. All rights reserved.
 
-
-#ifndef V8_MIPS_ASSEMBLER_MIPS_H_
-#define V8_MIPS_ASSEMBLER_MIPS_H_
+#ifndef V8_MIPS64_ASSEMBLER_MIPS64_H_
+#define V8_MIPS64_ASSEMBLER_MIPS64_H_
 
 #include <stdio.h>
 
@@ -396,7 +395,7 @@ class Operand BASE_EMBEDDED {
  public:
   // Immediate.
   INLINE(explicit Operand(int64_t immediate,
-                          RelocInfo::Mode rmode = RelocInfo::NONE64))
+                          RelocInfo::Mode rmode = RelocInfo::NONE))
       : rm_(no_reg), rmode_(rmode) {
     value_.immediate = immediate;
   }
@@ -408,8 +407,7 @@ class Operand BASE_EMBEDDED {
   INLINE(explicit Operand(Object** opp));
   INLINE(explicit Operand(Context** cpp));
   explicit Operand(Handle<HeapObject> handle);
-  INLINE(explicit Operand(Smi* value))
-      : rm_(no_reg), rmode_(RelocInfo::NONE32) {
+  INLINE(explicit Operand(Smi* value)) : rm_(no_reg), rmode_(RelocInfo::NONE) {
     value_.immediate = reinterpret_cast<intptr_t>(value);
   }
 
@@ -577,9 +575,9 @@ class Assembler : public AssemblerBase {
   // The isolate argument is unused (and may be nullptr) when skipping flushing.
   static Address target_address_at(Address pc);
   INLINE(static void set_target_address_at(
-      Isolate* isolate, Address pc, Address target,
+      Address pc, Address target,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED)) {
-    set_target_value_at(isolate, pc, reinterpret_cast<uint64_t>(target),
+    set_target_value_at(pc, reinterpret_cast<uint64_t>(target),
                         icache_flush_mode);
   }
   // On MIPS there is no Constant Pool so we skip that parameter.
@@ -587,13 +585,13 @@ class Assembler : public AssemblerBase {
     return target_address_at(pc);
   }
   INLINE(static void set_target_address_at(
-      Isolate* isolate, Address pc, Address constant_pool, Address target,
+      Address pc, Address constant_pool, Address target,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED)) {
-    set_target_address_at(isolate, pc, target, icache_flush_mode);
+    set_target_address_at(pc, target, icache_flush_mode);
   }
 
   static void set_target_value_at(
-      Isolate* isolate, Address pc, uint64_t target,
+      Address pc, uint64_t target,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
   // Return the code target address at a call site from the return address
@@ -608,12 +606,11 @@ class Assembler : public AssemblerBase {
   // This is for calls and branches within generated code.  The serializer
   // has already deserialized the lui/ori instructions etc.
   inline static void deserialization_set_special_target_at(
-      Isolate* isolate, Address instruction_payload, Code* code,
-      Address target);
+      Address instruction_payload, Code* code, Address target);
 
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
-      Isolate* isolate, Address pc, Address target,
+      Address pc, Address target,
       RelocInfo::Mode mode = RelocInfo::INTERNAL_REFERENCE);
 
   // Size of an instruction.
@@ -684,9 +681,6 @@ class Assembler : public AssemblerBase {
     // Helper values.
     LAST_CODE_MARKER,
     FIRST_IC_MARKER = PROPERTY_ACCESS_INLINED,
-    // Code aging
-    CODE_AGE_MARKER_NOP = 6,
-    CODE_AGE_SEQUENCE_NOP
   };
 
   // Type == 0 is the default non-marking nop. For mips this is a
@@ -1963,8 +1957,6 @@ class Assembler : public AssemblerBase {
     return internal_trampoline_exception_;
   }
 
-  void DoubleAsTwoUInt32(double d, uint32_t* lo, uint32_t* hi);
-
   bool is_trampoline_emitted() const {
     return trampoline_emitted_;
   }
@@ -2300,4 +2292,4 @@ class UseScratchRegisterScope {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_ARM_ASSEMBLER_MIPS_H_
+#endif  // V8_MIPS64_ASSEMBLER_MIPS64_H_
diff --git a/deps/v8/src/mips64/code-stubs-mips64.cc b/deps/v8/src/mips64/code-stubs-mips64.cc
index f8075885a99..73e3287b976 100644
--- a/deps/v8/src/mips64/code-stubs-mips64.cc
+++ b/deps/v8/src/mips64/code-stubs-mips64.cc
@@ -465,6 +465,12 @@ void CEntryStub::Generate(MacroAssembler* masm) {
   __ Sd(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
   __ bind(&zero);
 
+  // Reset the masking register. This is done independent of the underlying
+  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
+  // both configurations. It is safe to always do this, because the underlying
+  // register is caller-saved and can be arbitrarily clobbered.
+  __ ResetSpeculationPoisonRegister();
+
   // Compute the handler entry address and jump to it.
   __ li(t9, Operand(pending_handler_entrypoint_address));
   __ Ld(t9, MemOperand(t9));
diff --git a/deps/v8/src/mips64/code-stubs-mips64.h b/deps/v8/src/mips64/code-stubs-mips64.h
index 0513611664e..f5d20d8c2bd 100644
--- a/deps/v8/src/mips64/code-stubs-mips64.h
+++ b/deps/v8/src/mips64/code-stubs-mips64.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_MIPS_CODE_STUBS_MIPS64_H_
-#define V8_MIPS_CODE_STUBS_MIPS64_H_
+#ifndef V8_MIPS64_CODE_STUBS_MIPS64_H_
+#define V8_MIPS64_CODE_STUBS_MIPS64_H_
 
 namespace v8 {
 namespace internal {
@@ -28,4 +28,4 @@ class DirectCEntryStub : public PlatformCodeStub {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_MIPS_CODE_STUBS_MIPS64_H_
+#endif  // V8_MIPS64_CODE_STUBS_MIPS64_H_
diff --git a/deps/v8/src/mips64/codegen-mips64.cc b/deps/v8/src/mips64/codegen-mips64.cc
index 3be5e504bbd..d51ead5a6c6 100644
--- a/deps/v8/src/mips64/codegen-mips64.cc
+++ b/deps/v8/src/mips64/codegen-mips64.cc
@@ -7,6 +7,7 @@
 #include <memory>
 
 #include "src/codegen.h"
+#include "src/isolate.h"
 #include "src/macro-assembler.h"
 #include "src/mips64/simulator-mips64.h"
 
@@ -542,9 +543,9 @@ MemCopyUint8Function CreateMemCopyUint8Function(Isolate* isolate,
   }
   CodeDesc desc;
   masm.GetCode(isolte, &desc);
-  DCHECK(!RelocInfo::RequiresRelocation(isolate, desc));
+  DCHECK(!RelocInfo::RequiresRelocation(desc));
 
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   CHECK(SetPermissions(buffer, allocated, PageAllocator::kReadExecute));
   return FUNCTION_CAST<MemCopyUint8Function>(buffer);
 #endif
@@ -569,9 +570,9 @@ UnaryMathFunctionWithIsolate CreateSqrtFunction(Isolate* isolate) {
 
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
-  DCHECK(!RelocInfo::RequiresRelocation(isolate, desc));
+  DCHECK(!RelocInfo::RequiresRelocation(desc));
 
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   CHECK(SetPermissions(buffer, allocated, PageAllocator::kReadExecute));
   return FUNCTION_CAST<UnaryMathFunctionWithIsolate>(buffer);
 #endif
diff --git a/deps/v8/src/mips64/constants-mips64.h b/deps/v8/src/mips64/constants-mips64.h
index 0c107d1e1bb..e89c4a5df3d 100644
--- a/deps/v8/src/mips64/constants-mips64.h
+++ b/deps/v8/src/mips64/constants-mips64.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef  V8_MIPS_CONSTANTS_H_
-#define  V8_MIPS_CONSTANTS_H_
+#ifndef V8_MIPS64_CONSTANTS_MIPS64_H_
+#define V8_MIPS64_CONSTANTS_MIPS64_H_
 
 #include "src/base/logging.h"
 #include "src/base/macros.h"
@@ -2013,4 +2013,4 @@ bool InstructionGetters<T>::IsForbiddenAfterBranchInstr(Instr instr) {
 }  // namespace internal
 }  // namespace v8
 
-#endif    // #ifndef V8_MIPS_CONSTANTS_H_
+#endif  // V8_MIPS64_CONSTANTS_MIPS64_H_
diff --git a/deps/v8/src/mips64/cpu-mips64.cc b/deps/v8/src/mips64/cpu-mips64.cc
index ab9cf69620e..cc8ecdbd5a4 100644
--- a/deps/v8/src/mips64/cpu-mips64.cc
+++ b/deps/v8/src/mips64/cpu-mips64.cc
@@ -38,9 +38,7 @@ void CpuFeatures::FlushICache(void* start, size_t size) {
   long res;  // NOLINT(runtime/int)
   // See http://www.linux-mips.org/wiki/Cacheflush_Syscall.
   res = syscall(__NR_cacheflush, start, size, ICACHE);
-  if (res) {
-    V8_Fatal(__FILE__, __LINE__, "Failed to flush the instruction cache");
-  }
+  if (res) FATAL("Failed to flush the instruction cache");
 #endif  // ANDROID
 #endif  // !USE_SIMULATOR.
 }
diff --git a/deps/v8/src/mips64/disasm-mips64.cc b/deps/v8/src/mips64/disasm-mips64.cc
index d53b47d0c63..8f77a68b215 100644
--- a/deps/v8/src/mips64/disasm-mips64.cc
+++ b/deps/v8/src/mips64/disasm-mips64.cc
@@ -958,6 +958,7 @@ int Decoder::FormatOption(Instruction* instr, const char* format) {
         PrintMsaImmElm(instr);
         return 4;
       }
+      UNREACHABLE();
     }
     case 'r': {   // 'r: registers.
       return FormatRegister(instr, format);
diff --git a/deps/v8/src/mips64/frame-constants-mips64.h b/deps/v8/src/mips64/frame-constants-mips64.h
index 344453794a8..9c7455bcc51 100644
--- a/deps/v8/src/mips64/frame-constants-mips64.h
+++ b/deps/v8/src/mips64/frame-constants-mips64.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_MIPS_FRAMES_MIPS_H_
-#define V8_MIPS_FRAMES_MIPS_H_
+#ifndef V8_MIPS64_FRAME_CONSTANTS_MIPS64_H_
+#define V8_MIPS64_FRAME_CONSTANTS_MIPS64_H_
 
 namespace v8 {
 namespace internal {
@@ -49,4 +49,4 @@ class JavaScriptFrameConstants : public AllStatic {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_MIPS64_FRAME_CONSTANTS_MIPS64_H_
diff --git a/deps/v8/src/mips64/interface-descriptors-mips64.cc b/deps/v8/src/mips64/interface-descriptors-mips64.cc
index 8bc04a0401f..6aba359b78a 100644
--- a/deps/v8/src/mips64/interface-descriptors-mips64.cc
+++ b/deps/v8/src/mips64/interface-descriptors-mips64.cc
@@ -68,12 +68,6 @@ const Register GrowArrayElementsDescriptor::ObjectRegister() { return a0; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return a3; }
 
 
-void FastNewClosureDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {a1, a2, a3};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
 // static
 const Register TypeConversionDescriptor::ArgumentRegister() { return a0; }
 
diff --git a/deps/v8/src/mips64/macro-assembler-mips64.cc b/deps/v8/src/mips64/macro-assembler-mips64.cc
index 841f4665cf2..f6463da4ebe 100644
--- a/deps/v8/src/mips64/macro-assembler-mips64.cc
+++ b/deps/v8/src/mips64/macro-assembler-mips64.cc
@@ -14,6 +14,7 @@
 #include "src/debug/debug.h"
 #include "src/external-reference-table.h"
 #include "src/frames-inl.h"
+#include "src/instruction-stream.h"
 #include "src/mips64/assembler-mips64-inl.h"
 #include "src/mips64/macro-assembler-mips64.h"
 #include "src/register-configuration.h"
@@ -37,6 +38,14 @@ TurboAssembler::TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
   }
 }
 
+static inline bool IsZero(const Operand& rt) {
+  if (rt.is_reg()) {
+    return rt.rm() == zero_reg;
+  } else {
+    return rt.immediate() == 0;
+  }
+}
+
 int TurboAssembler::RequiredStackSizeForCallerSaved(SaveFPRegsMode fp_mode,
                                                     Register exclusion1,
                                                     Register exclusion2,
@@ -958,6 +967,70 @@ void TurboAssembler::Sltu(Register rd, Register rs, const Operand& rt) {
   }
 }
 
+void TurboAssembler::Sle(Register rd, Register rs, const Operand& rt) {
+  if (rt.is_reg()) {
+    slt(rd, rt.rm(), rs);
+  } else {
+    // li handles the relocation.
+    UseScratchRegisterScope temps(this);
+    Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
+    DCHECK(rs != scratch);
+    li(scratch, rt);
+    slt(rd, scratch, rs);
+  }
+  xori(rd, rd, 1);
+}
+
+void TurboAssembler::Sleu(Register rd, Register rs, const Operand& rt) {
+  if (rt.is_reg()) {
+    sltu(rd, rt.rm(), rs);
+  } else {
+    // li handles the relocation.
+    UseScratchRegisterScope temps(this);
+    Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
+    DCHECK(rs != scratch);
+    li(scratch, rt);
+    sltu(rd, scratch, rs);
+  }
+  xori(rd, rd, 1);
+}
+
+void TurboAssembler::Sge(Register rd, Register rs, const Operand& rt) {
+  Slt(rd, rs, rt);
+  xori(rd, rd, 1);
+}
+
+void TurboAssembler::Sgeu(Register rd, Register rs, const Operand& rt) {
+  Sltu(rd, rs, rt);
+  xori(rd, rd, 1);
+}
+
+void TurboAssembler::Sgt(Register rd, Register rs, const Operand& rt) {
+  if (rt.is_reg()) {
+    slt(rd, rt.rm(), rs);
+  } else {
+    // li handles the relocation.
+    UseScratchRegisterScope temps(this);
+    Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
+    DCHECK(rs != scratch);
+    li(scratch, rt);
+    slt(rd, scratch, rs);
+  }
+}
+
+void TurboAssembler::Sgtu(Register rd, Register rs, const Operand& rt) {
+  if (rt.is_reg()) {
+    sltu(rd, rt.rm(), rs);
+  } else {
+    // li handles the relocation.
+    UseScratchRegisterScope temps(this);
+    Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
+    DCHECK(rs != scratch);
+    li(scratch, rt);
+    sltu(rd, scratch, rs);
+  }
+}
+
 void TurboAssembler::Ror(Register rd, Register rs, const Operand& rt) {
   if (rt.is_reg()) {
     rotrv(rd, rs, rt.rm());
@@ -2703,39 +2776,38 @@ void TurboAssembler::FmoveLow(FPURegister dst, Register src_low) {
   mthc1(scratch, dst);
 }
 
-void TurboAssembler::Move(FPURegister dst, float imm) {
+void TurboAssembler::Move(FPURegister dst, uint32_t src) {
   UseScratchRegisterScope temps(this);
   Register scratch = temps.Acquire();
-  li(scratch, Operand(bit_cast<int32_t>(imm)));
+  li(scratch, Operand(static_cast<int32_t>(src)));
   mtc1(scratch, dst);
 }
 
-void TurboAssembler::Move(FPURegister dst, double imm) {
-  int64_t imm_bits = bit_cast<int64_t>(imm);
+void TurboAssembler::Move(FPURegister dst, uint64_t src) {
   // Handle special values first.
-  if (imm_bits == bit_cast<int64_t>(0.0) && has_double_zero_reg_set_) {
+  if (src == bit_cast<uint64_t>(0.0) && has_double_zero_reg_set_) {
     mov_d(dst, kDoubleRegZero);
-  } else if (imm_bits == bit_cast<int64_t>(-0.0) && has_double_zero_reg_set_) {
+  } else if (src == bit_cast<uint64_t>(-0.0) && has_double_zero_reg_set_) {
     Neg_d(dst, kDoubleRegZero);
   } else {
-    uint32_t lo, hi;
-    DoubleAsTwoUInt32(imm, &lo, &hi);
-    // Move the low part of the double into the lower bits of the corresponding
-    // FPU register.
+    uint32_t lo = src & 0xFFFFFFFF;
+    uint32_t hi = src >> 32;
+    // Move the low part of the double into the lower of the corresponding FPU
+    // register of FPU register pair.
     if (lo != 0) {
       UseScratchRegisterScope temps(this);
       Register scratch = temps.Acquire();
-      li(scratch, lo);
+      li(scratch, Operand(lo));
       mtc1(scratch, dst);
     } else {
       mtc1(zero_reg, dst);
     }
-    // Move the high part of the double into the high bits of the corresponding
-    // FPU register.
+    // Move the high part of the double into the higher of the corresponding FPU
+    // register of FPU register pair.
     if (hi != 0) {
       UseScratchRegisterScope temps(this);
       Register scratch = temps.Acquire();
-      li(scratch, hi);
+      li(scratch, Operand(hi));
       mthc1(scratch, dst);
     } else {
       mthc1(zero_reg, dst);
@@ -2766,6 +2838,115 @@ void TurboAssembler::Movn(Register rd, Register rs, Register rt) {
   }
 }
 
+void TurboAssembler::LoadZeroOnCondition(Register rd, Register rs,
+                                         const Operand& rt, Condition cond) {
+  switch (cond) {
+    case cc_always:
+      mov(rd, zero_reg);
+      break;
+    case eq:
+      if (rs == zero_reg) {
+        if (rt.is_reg()) {
+          LoadZeroIfConditionZero(rd, rt.rm());
+        } else {
+          if (rt.immediate() == 0) {
+            mov(rd, zero_reg);
+          } else {
+            nop();
+          }
+        }
+      } else if (IsZero(rt)) {
+        LoadZeroIfConditionZero(rd, rs);
+      } else {
+        Dsubu(t9, rs, rt);
+        LoadZeroIfConditionZero(rd, t9);
+      }
+      break;
+    case ne:
+      if (rs == zero_reg) {
+        if (rt.is_reg()) {
+          LoadZeroIfConditionNotZero(rd, rt.rm());
+        } else {
+          if (rt.immediate() != 0) {
+            mov(rd, zero_reg);
+          } else {
+            nop();
+          }
+        }
+      } else if (IsZero(rt)) {
+        LoadZeroIfConditionNotZero(rd, rs);
+      } else {
+        Dsubu(t9, rs, rt);
+        LoadZeroIfConditionNotZero(rd, t9);
+      }
+      break;
+
+    // Signed comparison.
+    case greater:
+      Sgt(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      break;
+    case greater_equal:
+      Sge(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      // rs >= rt
+      break;
+    case less:
+      Slt(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      // rs < rt
+      break;
+    case less_equal:
+      Sle(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      // rs <= rt
+      break;
+
+    // Unsigned comparison.
+    case Ugreater:
+      Sgtu(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      // rs > rt
+      break;
+
+    case Ugreater_equal:
+      Sgeu(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      // rs >= rt
+      break;
+    case Uless:
+      Sltu(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      // rs < rt
+      break;
+    case Uless_equal:
+      Sleu(t9, rs, rt);
+      LoadZeroIfConditionNotZero(rd, t9);
+      // rs <= rt
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+void TurboAssembler::LoadZeroIfConditionNotZero(Register dest,
+                                                Register condition) {
+  if (kArchVariant == kMips64r6) {
+    seleqz(dest, dest, condition);
+  } else {
+    Movn(dest, zero_reg, condition);
+  }
+}
+
+void TurboAssembler::LoadZeroIfConditionZero(Register dest,
+                                             Register condition) {
+  if (kArchVariant == kMips64r6) {
+    selnez(dest, dest, condition);
+  } else {
+    Movz(dest, zero_reg, condition);
+  }
+}
+
 void TurboAssembler::Movt(Register rd, Register rs, uint16_t cc) {
   movt(rd, rs, cc);
 }
@@ -2776,6 +2957,136 @@ void TurboAssembler::Movf(Register rd, Register rs, uint16_t cc) {
 
 void TurboAssembler::Clz(Register rd, Register rs) { clz(rd, rs); }
 
+void TurboAssembler::Ctz(Register rd, Register rs) {
+  if (kArchVariant == kMips64r6) {
+    // We don't have an instruction to count the number of trailing zeroes.
+    // Start by flipping the bits end-for-end so we can count the number of
+    // leading zeroes instead.
+    rotr(rd, rs, 16);
+    wsbh(rd, rd);
+    bitswap(rd, rd);
+    Clz(rd, rd);
+  } else {
+    // Convert trailing zeroes to trailing ones, and bits to their left
+    // to zeroes.
+    UseScratchRegisterScope temps(this);
+    Register scratch = temps.Acquire();
+    Daddu(scratch, rs, -1);
+    Xor(rd, scratch, rs);
+    And(rd, rd, scratch);
+    // Count number of leading zeroes.
+    Clz(rd, rd);
+    // Subtract number of leading zeroes from 32 to get number of trailing
+    // ones. Remember that the trailing ones were formerly trailing zeroes.
+    li(scratch, 32);
+    Subu(rd, scratch, rd);
+  }
+}
+
+void TurboAssembler::Dctz(Register rd, Register rs) {
+  if (kArchVariant == kMips64r6) {
+    // We don't have an instruction to count the number of trailing zeroes.
+    // Start by flipping the bits end-for-end so we can count the number of
+    // leading zeroes instead.
+    dsbh(rd, rs);
+    dshd(rd, rd);
+    dbitswap(rd, rd);
+    dclz(rd, rd);
+  } else {
+    // Convert trailing zeroes to trailing ones, and bits to their left
+    // to zeroes.
+    UseScratchRegisterScope temps(this);
+    Register scratch = temps.Acquire();
+    Daddu(scratch, rs, -1);
+    Xor(rd, scratch, rs);
+    And(rd, rd, scratch);
+    // Count number of leading zeroes.
+    dclz(rd, rd);
+    // Subtract number of leading zeroes from 64 to get number of trailing
+    // ones. Remember that the trailing ones were formerly trailing zeroes.
+    li(scratch, 64);
+    Dsubu(rd, scratch, rd);
+  }
+}
+
+void TurboAssembler::Popcnt(Register rd, Register rs) {
+  // https://graphics.stanford.edu/~seander/bithacks.html#CountBitsSetParallel
+  //
+  // A generalization of the best bit counting method to integers of
+  // bit-widths up to 128 (parameterized by type T) is this:
+  //
+  // v = v - ((v >> 1) & (T)~(T)0/3);                           // temp
+  // v = (v & (T)~(T)0/15*3) + ((v >> 2) & (T)~(T)0/15*3);      // temp
+  // v = (v + (v >> 4)) & (T)~(T)0/255*15;                      // temp
+  // c = (T)(v * ((T)~(T)0/255)) >> (sizeof(T) - 1) * BITS_PER_BYTE; //count
+  //
+  // For comparison, for 32-bit quantities, this algorithm can be executed
+  // using 20 MIPS instructions (the calls to LoadConst32() generate two
+  // machine instructions each for the values being used in this algorithm).
+  // A(n unrolled) loop-based algorithm requires 25 instructions.
+  //
+  // For a 64-bit operand this can be performed in 24 instructions compared
+  // to a(n unrolled) loop based algorithm which requires 38 instructions.
+  //
+  // There are algorithms which are faster in the cases where very few
+  // bits are set but the algorithm here attempts to minimize the total
+  // number of instructions executed even when a large number of bits
+  // are set.
+  uint32_t B0 = 0x55555555;     // (T)~(T)0/3
+  uint32_t B1 = 0x33333333;     // (T)~(T)0/15*3
+  uint32_t B2 = 0x0F0F0F0F;     // (T)~(T)0/255*15
+  uint32_t value = 0x01010101;  // (T)~(T)0/255
+  uint32_t shift = 24;          // (sizeof(T) - 1) * BITS_PER_BYTE
+
+  UseScratchRegisterScope temps(this);
+  Register scratch = temps.Acquire();
+  Register scratch2 = t8;
+  srl(scratch, rs, 1);
+  li(scratch2, B0);
+  And(scratch, scratch, scratch2);
+  Subu(scratch, rs, scratch);
+  li(scratch2, B1);
+  And(rd, scratch, scratch2);
+  srl(scratch, scratch, 2);
+  And(scratch, scratch, scratch2);
+  Addu(scratch, rd, scratch);
+  srl(rd, scratch, 4);
+  Addu(rd, rd, scratch);
+  li(scratch2, B2);
+  And(rd, rd, scratch2);
+  li(scratch, value);
+  Mul(rd, rd, scratch);
+  srl(rd, rd, shift);
+}
+
+void TurboAssembler::Dpopcnt(Register rd, Register rs) {
+  uint64_t B0 = 0x5555555555555555l;     // (T)~(T)0/3
+  uint64_t B1 = 0x3333333333333333l;     // (T)~(T)0/15*3
+  uint64_t B2 = 0x0F0F0F0F0F0F0F0Fl;     // (T)~(T)0/255*15
+  uint64_t value = 0x0101010101010101l;  // (T)~(T)0/255
+  uint64_t shift = 24;                   // (sizeof(T) - 1) * BITS_PER_BYTE
+
+  UseScratchRegisterScope temps(this);
+  Register scratch = temps.Acquire();
+  Register scratch2 = t8;
+  dsrl(scratch, rs, 1);
+  li(scratch2, B0);
+  And(scratch, scratch, scratch2);
+  Dsubu(scratch, rs, scratch);
+  li(scratch2, B1);
+  And(rd, scratch, scratch2);
+  dsrl(scratch, scratch, 2);
+  And(scratch, scratch, scratch2);
+  Daddu(scratch, rd, scratch);
+  dsrl(rd, scratch, 4);
+  Daddu(rd, rd, scratch);
+  li(scratch2, B2);
+  And(rd, rd, scratch2);
+  li(scratch, value);
+  Dmul(rd, rd, scratch);
+  dsrl32(rd, rd, shift);
+}
+
 void MacroAssembler::EmitFPUTruncate(FPURoundingMode rounding_mode,
                                      Register result,
                                      DoubleRegister double_input,
@@ -2993,14 +3304,6 @@ void TurboAssembler::BranchShort(Label* L, BranchDelaySlot bdslot) {
 }
 
 
-static inline bool IsZero(const Operand& rt) {
-  if (rt.is_reg()) {
-    return rt.rm() == zero_reg;
-  } else {
-    return rt.immediate() == 0;
-  }
-}
-
 int32_t TurboAssembler::GetOffset(int32_t offset, Label* L, OffsetSize bits) {
   if (L) {
     offset = branch_offset_helper(L, bits) >> 2;
@@ -4268,11 +4571,13 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
                                     const ParameterCount& expected,
                                     const ParameterCount& actual) {
   Label skip_hook;
+
   ExternalReference debug_hook_active =
       ExternalReference::debug_hook_on_function_call_address(isolate());
   li(t0, Operand(debug_hook_active));
   Lb(t0, MemOperand(t0));
   Branch(&skip_hook, eq, t0, Operand(zero_reg));
+
   {
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
@@ -4330,7 +4635,7 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
     // We call indirectly through the code field in the function to
     // allow recompilation to take effect without changing any of the
     // call sites.
-    Register code = t0;
+    Register code = kJavaScriptCallCodeStartRegister;
     Ld(code, FieldMemOperand(function, JSFunction::kCodeOffset));
     if (flag == CALL_FUNCTION) {
       Daddu(code, code, Operand(Code::kHeaderSize - kHeapObjectTag));
@@ -4383,14 +4688,6 @@ void MacroAssembler::InvokeFunction(Register function,
   InvokeFunctionCode(a1, no_reg, expected, actual, flag);
 }
 
-void MacroAssembler::InvokeFunction(Handle<JSFunction> function,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual,
-                                    InvokeFlag flag) {
-  li(a1, function);
-  InvokeFunction(a1, expected, actual, flag);
-}
-
 
 // ---------------------------------------------------------------------------
 // Support functions.
@@ -4440,231 +4737,90 @@ bool TurboAssembler::AllowThisStubCall(CodeStub* stub) {
   return has_frame() || !stub->SometimesSetsUpAFrame();
 }
 
-static inline void BranchOvfHelper(TurboAssembler* tasm, Register overflow_dst,
-                                   Label* overflow_label,
-                                   Label* no_overflow_label) {
-  DCHECK(overflow_label || no_overflow_label);
-  if (!overflow_label) {
-    DCHECK(no_overflow_label);
-    tasm->Branch(no_overflow_label, ge, overflow_dst, Operand(zero_reg));
+void TurboAssembler::DaddOverflow(Register dst, Register left,
+                                  const Operand& right, Register overflow) {
+  Register right_reg = no_reg;
+  Register scratch = t8;
+  if (!right.is_reg()) {
+    li(at, Operand(right));
+    right_reg = at;
   } else {
-    tasm->Branch(overflow_label, lt, overflow_dst, Operand(zero_reg));
-    if (no_overflow_label) tasm->Branch(no_overflow_label);
+    right_reg = right.rm();
   }
-}
 
-void TurboAssembler::DaddBranchOvf(Register dst, Register left,
-                                   const Operand& right, Label* overflow_label,
-                                   Label* no_overflow_label, Register scratch) {
-  if (right.is_reg()) {
-    DaddBranchOvf(dst, left, right.rm(), overflow_label, no_overflow_label,
-                  scratch);
-  } else {
-    Register overflow_dst = t9;
-    DCHECK(dst != scratch);
-    DCHECK(dst != overflow_dst);
-    DCHECK(scratch != overflow_dst);
-    DCHECK(left != overflow_dst);
-    li(overflow_dst, right);  // Load right.
-    if (dst == left) {
-      mov(scratch, left);              // Preserve left.
-      Daddu(dst, left, overflow_dst);  // Left is overwritten.
-      xor_(scratch, dst, scratch);     // Original left.
-      xor_(overflow_dst, dst, overflow_dst);
-      and_(overflow_dst, overflow_dst, scratch);
-    } else {
-      Daddu(dst, left, overflow_dst);
-      xor_(scratch, dst, overflow_dst);
-      xor_(overflow_dst, dst, left);
-      and_(overflow_dst, scratch, overflow_dst);
-    }
-    BranchOvfHelper(this, overflow_dst, overflow_label, no_overflow_label);
-  }
-}
-
-void TurboAssembler::DaddBranchOvf(Register dst, Register left, Register right,
-                                   Label* overflow_label,
-                                   Label* no_overflow_label, Register scratch) {
-  Register overflow_dst = t9;
-  DCHECK(dst != scratch);
-  DCHECK(dst != overflow_dst);
-  DCHECK(scratch != overflow_dst);
-  DCHECK(left != overflow_dst);
-  DCHECK(right != overflow_dst);
-  DCHECK(left != scratch);
-  DCHECK(right != scratch);
-
-  if (left == right && dst == left) {
-    mov(overflow_dst, right);
-    right = overflow_dst;
-  }
-
-  if (dst == left) {
-    mov(scratch, left);           // Preserve left.
-    daddu(dst, left, right);      // Left is overwritten.
-    xor_(scratch, dst, scratch);  // Original left.
-    xor_(overflow_dst, dst, right);
-    and_(overflow_dst, overflow_dst, scratch);
-  } else if (dst == right) {
-    mov(scratch, right);          // Preserve right.
-    daddu(dst, left, right);      // Right is overwritten.
-    xor_(scratch, dst, scratch);  // Original right.
-    xor_(overflow_dst, dst, left);
-    and_(overflow_dst, overflow_dst, scratch);
+  DCHECK(left != scratch && right_reg != scratch && dst != scratch &&
+         overflow != scratch);
+  DCHECK(overflow != left && overflow != right_reg);
+
+  if (dst == left || dst == right_reg) {
+    daddu(scratch, left, right_reg);
+    xor_(overflow, scratch, left);
+    xor_(at, scratch, right_reg);
+    and_(overflow, overflow, at);
+    mov(dst, scratch);
   } else {
-    daddu(dst, left, right);
-    xor_(overflow_dst, dst, left);
-    xor_(scratch, dst, right);
-    and_(overflow_dst, scratch, overflow_dst);
+    daddu(dst, left, right_reg);
+    xor_(overflow, dst, left);
+    xor_(at, dst, right_reg);
+    and_(overflow, overflow, at);
   }
-  BranchOvfHelper(this, overflow_dst, overflow_label, no_overflow_label);
 }
 
-void TurboAssembler::DsubBranchOvf(Register dst, Register left,
-                                   const Operand& right, Label* overflow_label,
-                                   Label* no_overflow_label, Register scratch) {
-  DCHECK(overflow_label || no_overflow_label);
-  if (right.is_reg()) {
-    DsubBranchOvf(dst, left, right.rm(), overflow_label, no_overflow_label,
-                  scratch);
+void TurboAssembler::DsubOverflow(Register dst, Register left,
+                                  const Operand& right, Register overflow) {
+  Register right_reg = no_reg;
+  Register scratch = t8;
+  if (!right.is_reg()) {
+    li(at, Operand(right));
+    right_reg = at;
   } else {
-    Register overflow_dst = t9;
-    DCHECK(dst != scratch);
-    DCHECK(dst != overflow_dst);
-    DCHECK(scratch != overflow_dst);
-    DCHECK(left != overflow_dst);
-    DCHECK(left != scratch);
-    li(overflow_dst, right);  // Load right.
-    if (dst == left) {
-      mov(scratch, left);                         // Preserve left.
-      Dsubu(dst, left, overflow_dst);             // Left is overwritten.
-      xor_(overflow_dst, scratch, overflow_dst);  // scratch is original left.
-      xor_(scratch, dst, scratch);                // scratch is original left.
-      and_(overflow_dst, scratch, overflow_dst);
-    } else {
-      Dsubu(dst, left, overflow_dst);
-      xor_(scratch, left, overflow_dst);
-      xor_(overflow_dst, dst, left);
-      and_(overflow_dst, scratch, overflow_dst);
-    }
-    BranchOvfHelper(this, overflow_dst, overflow_label, no_overflow_label);
-  }
-}
-
-void TurboAssembler::DsubBranchOvf(Register dst, Register left, Register right,
-                                   Label* overflow_label,
-                                   Label* no_overflow_label, Register scratch) {
-  DCHECK(overflow_label || no_overflow_label);
-  Register overflow_dst = t9;
-  DCHECK(dst != scratch);
-  DCHECK(dst != overflow_dst);
-  DCHECK(scratch != overflow_dst);
-  DCHECK(overflow_dst != left);
-  DCHECK(overflow_dst != right);
-  DCHECK(scratch != left);
-  DCHECK(scratch != right);
-
-  // This happens with some crankshaft code. Since Subu works fine if
-  // left == right, let's not make that restriction here.
-  if (left == right) {
-    mov(dst, zero_reg);
-    if (no_overflow_label) {
-      Branch(no_overflow_label);
-    }
+    right_reg = right.rm();
   }
 
-  if (dst == left) {
-    mov(scratch, left);                // Preserve left.
-    dsubu(dst, left, right);           // Left is overwritten.
-    xor_(overflow_dst, dst, scratch);  // scratch is original left.
-    xor_(scratch, scratch, right);     // scratch is original left.
-    and_(overflow_dst, scratch, overflow_dst);
-  } else if (dst == right) {
-    mov(scratch, right);      // Preserve right.
-    dsubu(dst, left, right);  // Right is overwritten.
-    xor_(overflow_dst, dst, left);
-    xor_(scratch, left, scratch);  // Original right.
-    and_(overflow_dst, scratch, overflow_dst);
-  } else {
-    dsubu(dst, left, right);
-    xor_(overflow_dst, dst, left);
-    xor_(scratch, left, right);
-    and_(overflow_dst, scratch, overflow_dst);
-  }
-  BranchOvfHelper(this, overflow_dst, overflow_label, no_overflow_label);
-}
-
-static inline void BranchOvfHelperMult(TurboAssembler* tasm,
-                                       Register overflow_dst,
-                                       Label* overflow_label,
-                                       Label* no_overflow_label) {
-  DCHECK(overflow_label || no_overflow_label);
-  if (!overflow_label) {
-    DCHECK(no_overflow_label);
-    tasm->Branch(no_overflow_label, eq, overflow_dst, Operand(zero_reg));
+  DCHECK(left != scratch && right_reg != scratch && dst != scratch &&
+         overflow != scratch);
+  DCHECK(overflow != left && overflow != right_reg);
+
+  if (dst == left || dst == right_reg) {
+    dsubu(scratch, left, right_reg);
+    xor_(overflow, left, scratch);
+    xor_(at, left, right_reg);
+    and_(overflow, overflow, at);
+    mov(dst, scratch);
   } else {
-    tasm->Branch(overflow_label, ne, overflow_dst, Operand(zero_reg));
-    if (no_overflow_label) tasm->Branch(no_overflow_label);
+    dsubu(dst, left, right_reg);
+    xor_(overflow, left, dst);
+    xor_(at, left, right_reg);
+    and_(overflow, overflow, at);
   }
 }
 
-void TurboAssembler::MulBranchOvf(Register dst, Register left,
-                                  const Operand& right, Label* overflow_label,
-                                  Label* no_overflow_label, Register scratch) {
-  DCHECK(overflow_label || no_overflow_label);
-  if (right.is_reg()) {
-    MulBranchOvf(dst, left, right.rm(), overflow_label, no_overflow_label,
-                 scratch);
+void TurboAssembler::MulOverflow(Register dst, Register left,
+                                 const Operand& right, Register overflow) {
+  Register right_reg = no_reg;
+  Register scratch = t8;
+  if (!right.is_reg()) {
+    li(at, Operand(right));
+    right_reg = at;
   } else {
-    Register overflow_dst = t9;
-    DCHECK(dst != scratch);
-    DCHECK(dst != overflow_dst);
-    DCHECK(scratch != overflow_dst);
-    DCHECK(left != overflow_dst);
-    DCHECK(left != scratch);
-
-    if (dst == left) {
-      Mul(scratch, left, static_cast<int32_t>(right.immediate()));
-      Mulh(overflow_dst, left, static_cast<int32_t>(right.immediate()));
-      mov(dst, scratch);
-    } else {
-      Mul(dst, left, static_cast<int32_t>(right.immediate()));
-      Mulh(overflow_dst, left, static_cast<int32_t>(right.immediate()));
-    }
-
-    dsra32(scratch, dst, 0);
-    xor_(overflow_dst, overflow_dst, scratch);
-
-    BranchOvfHelperMult(this, overflow_dst, overflow_label, no_overflow_label);
+    right_reg = right.rm();
   }
-}
 
-void TurboAssembler::MulBranchOvf(Register dst, Register left, Register right,
-                                  Label* overflow_label,
-                                  Label* no_overflow_label, Register scratch) {
-  DCHECK(overflow_label || no_overflow_label);
-  Register overflow_dst = t9;
-  DCHECK(dst != scratch);
-  DCHECK(dst != overflow_dst);
-  DCHECK(scratch != overflow_dst);
-  DCHECK(overflow_dst != left);
-  DCHECK(overflow_dst != right);
-  DCHECK(scratch != left);
-  DCHECK(scratch != right);
+  DCHECK(left != scratch && right_reg != scratch && dst != scratch &&
+         overflow != scratch);
+  DCHECK(overflow != left && overflow != right_reg);
 
-  if (dst == left || dst == right) {
-    Mul(scratch, left, right);
-    Mulh(overflow_dst, left, right);
+  if (dst == left || dst == right_reg) {
+    Mul(scratch, left, right_reg);
+    Mulh(overflow, left, right_reg);
     mov(dst, scratch);
   } else {
-    Mul(dst, left, right);
-    Mulh(overflow_dst, left, right);
+    Mul(dst, left, right_reg);
+    Mulh(overflow, left, right_reg);
   }
 
   dsra32(scratch, dst, 0);
-  xor_(overflow_dst, overflow_dst, scratch);
-
-  BranchOvfHelperMult(this, overflow_dst, overflow_label, no_overflow_label);
+  xor_(overflow, overflow, scratch);
 }
 
 void TurboAssembler::CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
@@ -4723,6 +4879,19 @@ void MacroAssembler::JumpToExternalReference(const ExternalReference& builtin,
        bd);
 }
 
+void MacroAssembler::JumpToInstructionStream(Address entry) {
+  li(kOffHeapTrampolineRegister,
+     Operand(reinterpret_cast<uint64_t>(entry), RelocInfo::OFF_HEAP_TARGET));
+  Jump(kOffHeapTrampolineRegister);
+}
+
+void MacroAssembler::LoadWeakValue(Register out, Register in,
+                                   Label* target_if_cleared) {
+  Branch(target_if_cleared, eq, in, Operand(kClearedWeakHeapObject));
+
+  And(out, in, Operand(~kWeakHeapObjectMask));
+}
+
 void MacroAssembler::IncrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK_GT(value, 0);
@@ -5125,6 +5294,20 @@ void MacroAssembler::AssertFixedArray(Register object) {
   }
 }
 
+void MacroAssembler::AssertConstructor(Register object) {
+  if (emit_debug_code()) {
+    STATIC_ASSERT(kSmiTag == 0);
+    SmiTst(object, t8);
+    Check(ne, AbortReason::kOperandIsASmiAndNotAConstructor, t8,
+          Operand(zero_reg));
+
+    ld(t8, FieldMemOperand(object, HeapObject::kMapOffset));
+    Lbu(t8, FieldMemOperand(t8, Map::kBitFieldOffset));
+    And(t8, t8, Operand(Map::IsConstructorBit::kMask));
+    Check(ne, AbortReason::kOperandIsNotAConstructor, t8, Operand(zero_reg));
+  }
+}
+
 void MacroAssembler::AssertFunction(Register object) {
   if (emit_debug_code()) {
     STATIC_ASSERT(kSmiTag == 0);
@@ -5543,6 +5726,28 @@ bool AreAliased(Register reg1, Register reg2, Register reg3, Register reg4,
   return n_of_valid_regs != n_of_non_aliasing_regs;
 }
 
+void TurboAssembler::ComputeCodeStartAddress(Register dst) {
+  // This push on ra and the pop below together ensure that we restore the
+  // register ra, which is needed while computing the code start address.
+  push(ra);
+
+  // The bal instruction puts the address of the current instruction into
+  // the return address (ra) register, which we can use later on.
+  Label current;
+  bal(&current);
+  nop();
+  int pc = pc_offset();
+  bind(&current);
+  li(dst, Operand(pc));
+  Dsubu(dst, ra, dst);
+
+  pop(ra);  // Restore ra
+}
+
+void TurboAssembler::ResetSpeculationPoisonRegister() {
+  li(kSpeculationPoisonRegister, -1);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/mips64/macro-assembler-mips64.h b/deps/v8/src/mips64/macro-assembler-mips64.h
index f89682d34c4..d636ad3065e 100644
--- a/deps/v8/src/mips64/macro-assembler-mips64.h
+++ b/deps/v8/src/mips64/macro-assembler-mips64.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_MIPS_MACRO_ASSEMBLER_MIPS_H_
-#define V8_MIPS_MACRO_ASSEMBLER_MIPS_H_
+#ifndef V8_MIPS64_MACRO_ASSEMBLER_MIPS64_H_
+#define V8_MIPS64_MACRO_ASSEMBLER_MIPS64_H_
 
 #include "src/assembler.h"
 #include "src/globals.h"
@@ -19,12 +19,15 @@ constexpr Register kReturnRegister2 = a0;
 constexpr Register kJSFunctionRegister = a1;
 constexpr Register kContextRegister = s7;
 constexpr Register kAllocateSizeRegister = a0;
+constexpr Register kSpeculationPoisonRegister = a7;
 constexpr Register kInterpreterAccumulatorRegister = v0;
 constexpr Register kInterpreterBytecodeOffsetRegister = t0;
 constexpr Register kInterpreterBytecodeArrayRegister = t1;
 constexpr Register kInterpreterDispatchTableRegister = t2;
 constexpr Register kJavaScriptCallArgCountRegister = a0;
+constexpr Register kJavaScriptCallCodeStartRegister = a2;
 constexpr Register kJavaScriptCallNewTargetRegister = a3;
+constexpr Register kOffHeapTrampolineRegister = at;
 constexpr Register kRuntimeCallFunctionRegister = a1;
 constexpr Register kRuntimeCallArgCountRegister = a0;
 
@@ -492,6 +495,12 @@ class TurboAssembler : public Assembler {
 
   DEFINE_INSTRUCTION(Slt);
   DEFINE_INSTRUCTION(Sltu);
+  DEFINE_INSTRUCTION(Sle);
+  DEFINE_INSTRUCTION(Sleu);
+  DEFINE_INSTRUCTION(Sgt);
+  DEFINE_INSTRUCTION(Sgtu);
+  DEFINE_INSTRUCTION(Sge);
+  DEFINE_INSTRUCTION(Sgeu);
 
   // MIPS32 R2 instruction macro.
   DEFINE_INSTRUCTION(Ror);
@@ -600,7 +609,16 @@ class TurboAssembler : public Assembler {
   void Movt(Register rd, Register rs, uint16_t cc = 0);
   void Movf(Register rd, Register rs, uint16_t cc = 0);
 
+  void LoadZeroIfConditionNotZero(Register dest, Register condition);
+  void LoadZeroIfConditionZero(Register dest, Register condition);
+  void LoadZeroOnCondition(Register rd, Register rs, const Operand& rt,
+                           Condition cond);
+
   void Clz(Register rd, Register rs);
+  void Ctz(Register rd, Register rs);
+  void Dctz(Register rd, Register rs);
+  void Popcnt(Register rd, Register rs);
+  void Dpopcnt(Register rd, Register rs);
 
   // MIPS64 R2 instruction macro.
   void Ext(Register rt, Register rs, uint16_t pos, uint16_t size);
@@ -744,62 +762,22 @@ class TurboAssembler : public Assembler {
     }
   }
 
-  void Move(FPURegister dst, float imm);
-  void Move(FPURegister dst, double imm);
-
-  inline void MulBranchOvf(Register dst, Register left, const Operand& right,
-                           Label* overflow_label, Register scratch = at) {
-    MulBranchOvf(dst, left, right, overflow_label, nullptr, scratch);
-  }
-
-  inline void MulBranchNoOvf(Register dst, Register left, const Operand& right,
-                             Label* no_overflow_label, Register scratch = at) {
-    MulBranchOvf(dst, left, right, nullptr, no_overflow_label, scratch);
-  }
-
-  void MulBranchOvf(Register dst, Register left, const Operand& right,
-                    Label* overflow_label, Label* no_overflow_label,
-                    Register scratch = at);
-
-  void MulBranchOvf(Register dst, Register left, Register right,
-                    Label* overflow_label, Label* no_overflow_label,
-                    Register scratch = at);
-
-  inline void DaddBranchOvf(Register dst, Register left, const Operand& right,
-                            Label* overflow_label, Register scratch = at) {
-    DaddBranchOvf(dst, left, right, overflow_label, nullptr, scratch);
-  }
-
-  inline void DaddBranchNoOvf(Register dst, Register left, const Operand& right,
-                              Label* no_overflow_label, Register scratch = at) {
-    DaddBranchOvf(dst, left, right, nullptr, no_overflow_label, scratch);
-  }
-
-  void DaddBranchOvf(Register dst, Register left, const Operand& right,
-                     Label* overflow_label, Label* no_overflow_label,
-                     Register scratch = at);
-
-  void DaddBranchOvf(Register dst, Register left, Register right,
-                     Label* overflow_label, Label* no_overflow_label,
-                     Register scratch = at);
-
-  inline void DsubBranchOvf(Register dst, Register left, const Operand& right,
-                            Label* overflow_label, Register scratch = at) {
-    DsubBranchOvf(dst, left, right, overflow_label, nullptr, scratch);
-  }
-
-  inline void DsubBranchNoOvf(Register dst, Register left, const Operand& right,
-                              Label* no_overflow_label, Register scratch = at) {
-    DsubBranchOvf(dst, left, right, nullptr, no_overflow_label, scratch);
-  }
-
-  void DsubBranchOvf(Register dst, Register left, const Operand& right,
-                     Label* overflow_label, Label* no_overflow_label,
-                     Register scratch = at);
-
-  void DsubBranchOvf(Register dst, Register left, Register right,
-                     Label* overflow_label, Label* no_overflow_label,
-                     Register scratch = at);
+  void Move(FPURegister dst, float imm) { Move(dst, bit_cast<uint32_t>(imm)); }
+  void Move(FPURegister dst, double imm) { Move(dst, bit_cast<uint64_t>(imm)); }
+  void Move(FPURegister dst, uint32_t src);
+  void Move(FPURegister dst, uint64_t src);
+
+  // DaddOverflow sets overflow register to a negative value if
+  // overflow occured, otherwise it is zero or positive
+  void DaddOverflow(Register dst, Register left, const Operand& right,
+                    Register overflow);
+  // DsubOverflow sets overflow register to a negative value if
+  // overflow occured, otherwise it is zero or positive
+  void DsubOverflow(Register dst, Register left, const Operand& right,
+                    Register overflow);
+  // MulOverflow sets overflow register to zero if no overflow occured
+  void MulOverflow(Register dst, Register left, const Operand& right,
+                   Register overflow);
 
 // Number of instructions needed for calculation of switch table entry address
 #ifdef _MIPS_ARCH_MIPS64R6
@@ -875,6 +853,12 @@ class TurboAssembler : public Assembler {
   void Dlsa(Register rd, Register rs, Register rt, uint8_t sa,
             Register scratch = at);
 
+  // Compute the start of the generated instruction stream from the current PC.
+  // This is an alternative to embedding the {CodeObject} handle as a reference.
+  void ComputeCodeStartAddress(Register dst);
+
+  void ResetSpeculationPoisonRegister();
+
  protected:
   inline Register GetRtAsRegisterHelper(const Operand& rt, Register scratch);
   inline int32_t GetOffset(int32_t offset, Label* L, OffsetSize bits);
@@ -1091,10 +1075,6 @@ class MacroAssembler : public TurboAssembler {
   void InvokeFunction(Register function, const ParameterCount& expected,
                       const ParameterCount& actual, InvokeFlag flag);
 
-  void InvokeFunction(Handle<JSFunction> function,
-                      const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
-
   // Frame restart support.
   void MaybeDropFrames();
 
@@ -1156,6 +1136,13 @@ const Operand& rt = Operand(zero_reg), BranchDelaySlot bd = PROTECT
                                BranchDelaySlot bd = PROTECT,
                                bool builtin_exit_frame = false);
 
+  // Generates a trampoline to jump to the off-heap instruction stream.
+  void JumpToInstructionStream(Address entry);
+
+  // ---------------------------------------------------------------------------
+  // In-place weak references.
+  void LoadWeakValue(Register out, Register in, Label* target_if_cleared);
+
   // -------------------------------------------------------------------------
   // StatsCounter support.
 
@@ -1219,6 +1206,9 @@ const Operand& rt = Operand(zero_reg), BranchDelaySlot bd = PROTECT
   // Abort execution if argument is not a FixedArray, enabled via --debug-code.
   void AssertFixedArray(Register object);
 
+  // Abort execution if argument is not a Constructor, enabled via --debug-code.
+  void AssertConstructor(Register object);
+
   // Abort execution if argument is not a JSFunction, enabled via --debug-code.
   void AssertFunction(Register object);
 
@@ -1301,4 +1291,4 @@ void TurboAssembler::GenerateSwitchTable(Register index, size_t case_count,
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_MIPS_MACRO_ASSEMBLER_MIPS_H_
+#endif  // V8_MIPS64_MACRO_ASSEMBLER_MIPS64_H_
diff --git a/deps/v8/src/mips64/simulator-mips64.cc b/deps/v8/src/mips64/simulator-mips64.cc
index ebb8a76ad7a..9177f8e6aa8 100644
--- a/deps/v8/src/mips64/simulator-mips64.cc
+++ b/deps/v8/src/mips64/simulator-mips64.cc
@@ -715,8 +715,7 @@ void MipsDebugger::Debug() {
 #undef XSTR
 }
 
-
-static bool ICacheMatch(void* one, void* two) {
+bool Simulator::ICacheMatch(void* one, void* two) {
   DCHECK_EQ(reinterpret_cast<intptr_t>(one) & CachePage::kPageMask, 0);
   DCHECK_EQ(reinterpret_cast<intptr_t>(two) & CachePage::kPageMask, 0);
   return one == two;
@@ -814,11 +813,6 @@ void Simulator::CheckICache(base::CustomMatcherHashMap* i_cache,
 
 
 Simulator::Simulator(Isolate* isolate) : isolate_(isolate) {
-  i_cache_ = isolate_->simulator_i_cache();
-  if (i_cache_ == nullptr) {
-    i_cache_ = new base::CustomMatcherHashMap(&ICacheMatch);
-    isolate_->set_simulator_i_cache(i_cache_);
-  }
   // Set up simulator support first. Some of this information is needed to
   // setup the architecture state.
   stack_size_ = FLAG_sim_stack_size * KB;
@@ -2484,8 +2478,7 @@ void Simulator::PrintStopInfo(uint64_t code) {
 
 
 void Simulator::SignalException(Exception e) {
-  V8_Fatal(__FILE__, __LINE__, "Error: Exception %i raised.",
-           static_cast<int>(e));
+  FATAL("Error: Exception %i raised.", static_cast<int>(e));
 }
 
 // Min/Max template functions for Double and Single arguments.
@@ -5914,7 +5907,8 @@ void Simulator::DecodeTypeMsa3RF() {
     case MSUB_Q:
     case MADDR_Q:
     case MSUBR_Q:
-      get_msa_register(wd_reg(), &wd);  // fall-through
+      get_msa_register(wd_reg(), &wd);
+      V8_FALLTHROUGH;
     case MUL_Q:
     case MULR_Q:
       switch (DecodeMsaDataFormat()) {
@@ -7260,7 +7254,7 @@ void Simulator::DecodeTypeJump() {
 // Executes the current instruction.
 void Simulator::InstructionDecode(Instruction* instr) {
   if (v8::internal::FLAG_check_icache) {
-    CheckICache(isolate_->simulator_i_cache(), instr);
+    CheckICache(i_cache(), instr);
   }
   pc_modified_ = false;
 
diff --git a/deps/v8/src/mips64/simulator-mips64.h b/deps/v8/src/mips64/simulator-mips64.h
index c4292236b08..115dde2103a 100644
--- a/deps/v8/src/mips64/simulator-mips64.h
+++ b/deps/v8/src/mips64/simulator-mips64.h
@@ -9,8 +9,8 @@
 // which will start execution in the Simulator or forwards to the real entry
 // on a MIPS HW platform.
 
-#ifndef V8_MIPS_SIMULATOR_MIPS_H_
-#define V8_MIPS_SIMULATOR_MIPS_H_
+#ifndef V8_MIPS64_SIMULATOR_MIPS64_H_
+#define V8_MIPS64_SIMULATOR_MIPS64_H_
 
 #include "src/allocation.h"
 #include "src/mips64/constants-mips64.h"
@@ -260,6 +260,7 @@ class Simulator : public SimulatorBase {
   static void SetRedirectInstruction(Instruction* instruction);
 
   // ICache checking.
+  static bool ICacheMatch(void* one, void* two);
   static void FlushICache(base::CustomMatcherHashMap* i_cache, void* start,
                           size_t size);
 
@@ -472,10 +473,10 @@ class Simulator : public SimulatorBase {
     Instruction* instr_after_compact_branch =
         reinterpret_cast<Instruction*>(current_pc + Instruction::kInstrSize);
     if (instr_after_compact_branch->IsForbiddenAfterBranch()) {
-      V8_Fatal(__FILE__, __LINE__,
-               "Error: Unexpected instruction 0x%08x immediately after a "
-               "compact branch instruction.",
-               *reinterpret_cast<uint32_t*>(instr_after_compact_branch));
+      FATAL(
+          "Error: Unexpected instruction 0x%08x immediately after a "
+          "compact branch instruction.",
+          *reinterpret_cast<uint32_t*>(instr_after_compact_branch));
     }
   }
 
@@ -502,9 +503,8 @@ class Simulator : public SimulatorBase {
     }
 
     if (instr->IsForbiddenAfterBranch()) {
-      V8_Fatal(__FILE__, __LINE__,
-               "Eror:Unexpected %i opcode in a branch delay slot.",
-               instr->OpcodeValue());
+      FATAL("Eror:Unexpected %i opcode in a branch delay slot.",
+            instr->OpcodeValue());
     }
     InstructionDecode(instr);
     SNPrintF(trace_buf_, " ");
@@ -559,9 +559,6 @@ class Simulator : public SimulatorBase {
   // Debugger input.
   char* last_debugger_input_;
 
-  // Icache simulation.
-  base::CustomMatcherHashMap* i_cache_;
-
   v8::internal::Isolate* isolate_;
 
   // Registered breakpoints.
@@ -586,4 +583,4 @@ class Simulator : public SimulatorBase {
 }  // namespace v8
 
 #endif  // defined(USE_SIMULATOR)
-#endif  // V8_MIPS_SIMULATOR_MIPS_H_
+#endif  // V8_MIPS64_SIMULATOR_MIPS64_H_
diff --git a/deps/v8/src/objects-body-descriptors-inl.h b/deps/v8/src/objects-body-descriptors-inl.h
index bd391d272bb..d22ef97bf1c 100644
--- a/deps/v8/src/objects-body-descriptors-inl.h
+++ b/deps/v8/src/objects-body-descriptors-inl.h
@@ -10,6 +10,7 @@
 #include "src/objects-body-descriptors.h"
 #include "src/objects/hash-table.h"
 #include "src/transitions.h"
+#include "src/wasm/wasm-objects-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -19,30 +20,32 @@ int FlexibleBodyDescriptor<start_offset>::SizeOf(Map* map, HeapObject* object) {
   return object->SizeFromMap(map);
 }
 
-bool BodyDescriptorBase::IsValidSlotImpl(HeapObject* obj, int offset) {
-  if (!FLAG_unbox_double_fields || obj->map()->HasFastPointerLayout()) {
+bool BodyDescriptorBase::IsValidSlotImpl(Map* map, HeapObject* obj,
+                                         int offset) {
+  if (!FLAG_unbox_double_fields || map->HasFastPointerLayout()) {
     return true;
   } else {
     DCHECK(FLAG_unbox_double_fields);
     DCHECK(IsAligned(offset, kPointerSize));
 
-    LayoutDescriptorHelper helper(obj->map());
+    LayoutDescriptorHelper helper(map);
     DCHECK(!helper.all_fields_tagged());
     return helper.IsTagged(offset);
   }
 }
 
 template <typename ObjectVisitor>
-void BodyDescriptorBase::IterateBodyImpl(HeapObject* obj, int start_offset,
-                                         int end_offset, ObjectVisitor* v) {
-  if (!FLAG_unbox_double_fields || obj->map()->HasFastPointerLayout()) {
+void BodyDescriptorBase::IterateBodyImpl(Map* map, HeapObject* obj,
+                                         int start_offset, int end_offset,
+                                         ObjectVisitor* v) {
+  if (!FLAG_unbox_double_fields || map->HasFastPointerLayout()) {
     IteratePointers(obj, start_offset, end_offset, v);
   } else {
     DCHECK(FLAG_unbox_double_fields);
     DCHECK(IsAligned(start_offset, kPointerSize) &&
            IsAligned(end_offset, kPointerSize));
 
-    LayoutDescriptorHelper helper(obj->map());
+    LayoutDescriptorHelper helper(map);
     DCHECK(!helper.all_fields_tagged());
     for (int offset = start_offset; offset < end_offset;) {
       int end_of_region_offset;
@@ -69,19 +72,32 @@ void BodyDescriptorBase::IteratePointer(HeapObject* obj, int offset,
   v->VisitPointer(obj, HeapObject::RawField(obj, offset));
 }
 
+template <typename ObjectVisitor>
+DISABLE_CFI_PERF void BodyDescriptorBase::IterateMaybeWeakPointers(
+    HeapObject* obj, int start_offset, int end_offset, ObjectVisitor* v) {
+  v->VisitPointers(obj, HeapObject::RawMaybeWeakField(obj, start_offset),
+                   HeapObject::RawMaybeWeakField(obj, end_offset));
+}
+
+template <typename ObjectVisitor>
+void BodyDescriptorBase::IterateMaybeWeakPointer(HeapObject* obj, int offset,
+                                                 ObjectVisitor* v) {
+  v->VisitPointer(obj, HeapObject::RawMaybeWeakField(obj, offset));
+}
+
 class JSObject::BodyDescriptor final : public BodyDescriptorBase {
  public:
   static const int kStartOffset = JSReceiver::kPropertiesOrHashOffset;
 
-  static bool IsValidSlot(HeapObject* obj, int offset) {
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
     if (offset < kStartOffset) return false;
-    return IsValidSlotImpl(obj, offset);
+    return IsValidSlotImpl(map, obj, offset);
   }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
-    IterateBodyImpl(obj, kStartOffset, object_size, v);
+    IterateBodyImpl(map, obj, kStartOffset, object_size, v);
   }
 
   static inline int SizeOf(Map* map, HeapObject* object) {
@@ -93,12 +109,12 @@ class JSObject::FastBodyDescriptor final : public BodyDescriptorBase {
  public:
   static const int kStartOffset = JSReceiver::kPropertiesOrHashOffset;
 
-  static bool IsValidSlot(HeapObject* obj, int offset) {
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
     return offset >= kStartOffset;
   }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
     IteratePointers(obj, kStartOffset, object_size, v);
   }
@@ -110,20 +126,21 @@ class JSObject::FastBodyDescriptor final : public BodyDescriptorBase {
 
 class JSFunction::BodyDescriptor final : public BodyDescriptorBase {
  public:
-  static bool IsValidSlot(HeapObject* obj, int offset) {
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
     if (offset < kSizeWithoutPrototype) return true;
-    if (offset < kSizeWithPrototype && obj->map()->has_prototype_slot()) {
+    if (offset < kSizeWithPrototype && map->has_prototype_slot()) {
       return true;
     }
-    return IsValidSlotImpl(obj, offset);
+    return IsValidSlotImpl(map, obj, offset);
   }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
-    int header_size = JSFunction::cast(obj)->GetHeaderSize();
+    int header_size = JSFunction::GetHeaderSize(map->has_prototype_slot());
+    DCHECK_EQ(header_size, JSObject::GetHeaderSize(map));
     IteratePointers(obj, kPropertiesOrHashOffset, header_size, v);
-    IterateBodyImpl(obj, header_size, object_size, v);
+    IterateBodyImpl(map, obj, header_size, object_size, v);
   }
 
   static inline int SizeOf(Map* map, HeapObject* object) {
@@ -134,23 +151,23 @@ class JSFunction::BodyDescriptor final : public BodyDescriptorBase {
 class JSArrayBuffer::BodyDescriptor final : public BodyDescriptorBase {
  public:
   STATIC_ASSERT(kByteLengthOffset + kPointerSize == kBackingStoreOffset);
-  STATIC_ASSERT(kAllocationLengthOffset + kPointerSize == kBitFieldSlot);
+  STATIC_ASSERT(kBackingStoreOffset + kPointerSize == kBitFieldSlot);
   STATIC_ASSERT(kBitFieldSlot + kPointerSize == kSize);
 
-  static bool IsValidSlot(HeapObject* obj, int offset) {
-    if (offset < kAllocationLengthOffset) return true;
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    if (offset < kBitFieldSlot) return true;
     if (offset < kSize) return false;
-    return IsValidSlotImpl(obj, offset);
+    return IsValidSlotImpl(map, obj, offset);
   }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
     // Array buffers contain raw pointers that the GC does not know about. These
     // are stored at kBackStoreOffset and later, so we do not iterate over
     // those.
     IteratePointers(obj, kPropertiesOrHashOffset, kBackingStoreOffset, v);
-    IterateBodyImpl(obj, kSize, object_size, v);
+    IterateBodyImpl(map, obj, kSize, object_size, v);
   }
 
   static inline int SizeOf(Map* map, HeapObject* object) {
@@ -162,14 +179,14 @@ template <typename Derived>
 class SmallOrderedHashTable<Derived>::BodyDescriptor final
     : public BodyDescriptorBase {
  public:
-  static bool IsValidSlot(HeapObject* obj, int offset) {
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
     Derived* table = reinterpret_cast<Derived*>(obj);
     if (offset < table->GetDataTableStartOffset()) return false;
-    return IsValidSlotImpl(obj, offset);
+    return IsValidSlotImpl(map, obj, offset);
   }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
     Derived* table = reinterpret_cast<Derived*>(obj);
     int start = table->GetDataTableStartOffset();
@@ -186,10 +203,12 @@ class SmallOrderedHashTable<Derived>::BodyDescriptor final
 
 class ByteArray::BodyDescriptor final : public BodyDescriptorBase {
  public:
-  static bool IsValidSlot(HeapObject* obj, int offset) { return false; }
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    return false;
+  }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {}
 
   static inline int SizeOf(Map* map, HeapObject* obj) {
@@ -199,13 +218,13 @@ class ByteArray::BodyDescriptor final : public BodyDescriptorBase {
 
 class BytecodeArray::BodyDescriptor final : public BodyDescriptorBase {
  public:
-  static bool IsValidSlot(HeapObject* obj, int offset) {
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
     return offset >= kConstantPoolOffset &&
            offset <= kSourcePositionTableOffset;
   }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
     IteratePointer(obj, kConstantPoolOffset, v);
     IteratePointer(obj, kHandlerTableOffset, v);
@@ -220,10 +239,12 @@ class BytecodeArray::BodyDescriptor final : public BodyDescriptorBase {
 
 class BigInt::BodyDescriptor final : public BodyDescriptorBase {
  public:
-  static bool IsValidSlot(HeapObject* obj, int offset) { return false; }
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    return false;
+  }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {}
 
   static inline int SizeOf(Map* map, HeapObject* obj) {
@@ -233,10 +254,12 @@ class BigInt::BodyDescriptor final : public BodyDescriptorBase {
 
 class FixedDoubleArray::BodyDescriptor final : public BodyDescriptorBase {
  public:
-  static bool IsValidSlot(HeapObject* obj, int offset) { return false; }
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    return false;
+  }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {}
 
   static inline int SizeOf(Map* map, HeapObject* obj) {
@@ -247,12 +270,12 @@ class FixedDoubleArray::BodyDescriptor final : public BodyDescriptorBase {
 
 class FixedTypedArrayBase::BodyDescriptor final : public BodyDescriptorBase {
  public:
-  static bool IsValidSlot(HeapObject* obj, int offset) {
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
     return offset == kBasePointerOffset;
   }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
     IteratePointer(obj, kBasePointerOffset, v);
   }
@@ -262,18 +285,51 @@ class FixedTypedArrayBase::BodyDescriptor final : public BodyDescriptorBase {
   }
 };
 
+class WeakFixedArray::BodyDescriptor final : public BodyDescriptorBase {
+ public:
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    return offset >= kHeaderSize;
+  }
+
+  template <typename ObjectVisitor>
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
+                                 ObjectVisitor* v) {
+    IterateMaybeWeakPointers(obj, kHeaderSize, object_size, v);
+  }
+
+  static inline int SizeOf(Map* map, HeapObject* object) {
+    return object->SizeFromMap(map);
+  }
+};
+
+class FeedbackMetadata::BodyDescriptor final : public BodyDescriptorBase {
+ public:
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    return false;
+  }
+
+  template <typename ObjectVisitor>
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
+                                 ObjectVisitor* v) {}
+
+  static inline int SizeOf(Map* map, HeapObject* obj) {
+    return FeedbackMetadata::SizeFor(
+        FeedbackMetadata::cast(obj)->synchronized_slot_count());
+  }
+};
+
 class FeedbackVector::BodyDescriptor final : public BodyDescriptorBase {
  public:
-  static bool IsValidSlot(HeapObject* obj, int offset) {
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
     return offset == kSharedFunctionInfoOffset ||
            offset == kOptimizedCodeOffset || offset >= kFeedbackSlotsOffset;
   }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
     IteratePointer(obj, kSharedFunctionInfoOffset, v);
-    IteratePointer(obj, kOptimizedCodeOffset, v);
+    IterateMaybeWeakPointer(obj, kOptimizedCodeOffset, v);
     IteratePointers(obj, kFeedbackSlotsOffset, object_size, v);
   }
 
@@ -288,18 +344,18 @@ class JSWeakCollection::BodyDescriptorImpl final : public BodyDescriptorBase {
   STATIC_ASSERT(kTableOffset + kPointerSize == kNextOffset);
   STATIC_ASSERT(kNextOffset + kPointerSize == kSize);
 
-  static bool IsValidSlot(HeapObject* obj, int offset) {
-    return IsValidSlotImpl(obj, offset);
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    return IsValidSlotImpl(map, obj, offset);
   }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
     if (body_visiting_policy == kIgnoreWeakness) {
-      IterateBodyImpl(obj, kPropertiesOrHashOffset, object_size, v);
+      IterateBodyImpl(map, obj, kPropertiesOrHashOffset, object_size, v);
     } else {
       IteratePointers(obj, kPropertiesOrHashOffset, kTableOffset, v);
-      IterateBodyImpl(obj, kSize, object_size, v);
+      IterateBodyImpl(map, obj, kSize, object_size, v);
     }
   }
 
@@ -310,10 +366,12 @@ class JSWeakCollection::BodyDescriptorImpl final : public BodyDescriptorBase {
 
 class Foreign::BodyDescriptor final : public BodyDescriptorBase {
  public:
-  static bool IsValidSlot(HeapObject* obj, int offset) { return false; }
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    return false;
+  }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
     v->VisitExternalReference(Foreign::cast(obj),
                               reinterpret_cast<Address*>(HeapObject::RawField(
@@ -325,69 +383,68 @@ class Foreign::BodyDescriptor final : public BodyDescriptorBase {
 
 class ExternalOneByteString::BodyDescriptor final : public BodyDescriptorBase {
  public:
-  static bool IsValidSlot(HeapObject* obj, int offset) { return false; }
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    return false;
+  }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
-                                 ObjectVisitor* v) {
-  }
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
+                                 ObjectVisitor* v) {}
 
   static inline int SizeOf(Map* map, HeapObject* object) { return kSize; }
 };
 
 class ExternalTwoByteString::BodyDescriptor final : public BodyDescriptorBase {
  public:
-  static bool IsValidSlot(HeapObject* obj, int offset) { return false; }
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    return false;
+  }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
-                                 ObjectVisitor* v) {
-  }
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
+                                 ObjectVisitor* v) {}
 
   static inline int SizeOf(Map* map, HeapObject* object) { return kSize; }
 };
 
 class Code::BodyDescriptor final : public BodyDescriptorBase {
  public:
-  STATIC_ASSERT(kRelocationInfoOffset + kPointerSize == kHandlerTableOffset);
-  STATIC_ASSERT(kHandlerTableOffset + kPointerSize ==
+  STATIC_ASSERT(kRelocationInfoOffset + kPointerSize ==
                 kDeoptimizationDataOffset);
   STATIC_ASSERT(kDeoptimizationDataOffset + kPointerSize ==
                 kSourcePositionTableOffset);
   STATIC_ASSERT(kSourcePositionTableOffset + kPointerSize ==
-                kProtectedInstructionsOffset);
-  STATIC_ASSERT(kProtectedInstructionsOffset + kPointerSize ==
                 kCodeDataContainerOffset);
   STATIC_ASSERT(kCodeDataContainerOffset + kPointerSize == kDataStart);
 
-  static bool IsValidSlot(HeapObject* obj, int offset) {
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
     // Slots in code can't be invalid because we never trim code objects.
     return true;
   }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, ObjectVisitor* v) {
+  static inline void IterateBody(Map* map, HeapObject* obj, ObjectVisitor* v) {
     int mode_mask = RelocInfo::kCodeTargetMask |
                     RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
                     RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE) |
                     RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) |
                     RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED) |
+                    RelocInfo::ModeMask(RelocInfo::OFF_HEAP_TARGET) |
                     RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY);
 
     // GC does not visit data/code in the header and in the body directly.
     IteratePointers(obj, kRelocationInfoOffset, kDataStart, v);
 
     RelocIterator it(Code::cast(obj), mode_mask);
-    Isolate* isolate = obj->GetIsolate();
     for (; !it.done(); it.next()) {
-      it.rinfo()->Visit(isolate, v);
+      it.rinfo()->Visit(v);
     }
   }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
-    IterateBody(obj, v);
+    IterateBody(map, obj, v);
   }
 
   static inline int SizeOf(Map* map, HeapObject* object) {
@@ -397,10 +454,12 @@ class Code::BodyDescriptor final : public BodyDescriptorBase {
 
 class SeqOneByteString::BodyDescriptor final : public BodyDescriptorBase {
  public:
-  static bool IsValidSlot(HeapObject* obj, int offset) { return false; }
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    return false;
+  }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {}
 
   static inline int SizeOf(Map* map, HeapObject* obj) {
@@ -411,10 +470,12 @@ class SeqOneByteString::BodyDescriptor final : public BodyDescriptorBase {
 
 class SeqTwoByteString::BodyDescriptor final : public BodyDescriptorBase {
  public:
-  static bool IsValidSlot(HeapObject* obj, int offset) { return false; }
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    return false;
+  }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {}
 
   static inline int SizeOf(Map* map, HeapObject* obj) {
@@ -423,45 +484,85 @@ class SeqTwoByteString::BodyDescriptor final : public BodyDescriptorBase {
   }
 };
 
+class WasmInstanceObject::BodyDescriptor final : public BodyDescriptorBase {
+ public:
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    if (offset < kMemoryStartOffset) return true;
+    if (offset < kCompiledModuleOffset) return false;
+    return IsValidSlotImpl(map, obj, offset);
+  }
+
+  template <typename ObjectVisitor>
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
+                                 ObjectVisitor* v) {
+    IteratePointers(obj, kPropertiesOrHashOffset, kFirstUntaggedOffset, v);
+    IterateBodyImpl(map, obj, kSize, object_size, v);
+  }
+
+  static inline int SizeOf(Map* map, HeapObject* object) {
+    return map->instance_size();
+  }
+};
+
 template <typename Op, typename ReturnType, typename T1, typename T2,
-          typename T3>
-ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3) {
+          typename T3, typename T4>
+ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
   if (type < FIRST_NONSTRING_TYPE) {
     switch (type & kStringRepresentationMask) {
       case kSeqStringTag:
         return ReturnType();
       case kConsStringTag:
-        return Op::template apply<ConsString::BodyDescriptor>(p1, p2, p3);
+        return Op::template apply<ConsString::BodyDescriptor>(p1, p2, p3, p4);
       case kThinStringTag:
-        return Op::template apply<ThinString::BodyDescriptor>(p1, p2, p3);
+        return Op::template apply<ThinString::BodyDescriptor>(p1, p2, p3, p4);
       case kSlicedStringTag:
-        return Op::template apply<SlicedString::BodyDescriptor>(p1, p2, p3);
+        return Op::template apply<SlicedString::BodyDescriptor>(p1, p2, p3, p4);
       case kExternalStringTag:
         if ((type & kStringEncodingMask) == kOneByteStringTag) {
           return Op::template apply<ExternalOneByteString::BodyDescriptor>(
-              p1, p2, p3);
+              p1, p2, p3, p4);
         } else {
           return Op::template apply<ExternalTwoByteString::BodyDescriptor>(
-              p1, p2, p3);
+              p1, p2, p3, p4);
         }
     }
     UNREACHABLE();
   }
 
   switch (type) {
-    case HASH_TABLE_TYPE:
     case FIXED_ARRAY_TYPE:
-      return Op::template apply<FixedArray::BodyDescriptor>(p1, p2, p3);
+    case BOILERPLATE_DESCRIPTION_TYPE:
+    case HASH_TABLE_TYPE:
+    case SCOPE_INFO_TYPE:
+    case BLOCK_CONTEXT_TYPE:
+    case CATCH_CONTEXT_TYPE:
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+    case EVAL_CONTEXT_TYPE:
+    case FUNCTION_CONTEXT_TYPE:
+    case MODULE_CONTEXT_TYPE:
+    case NATIVE_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TYPE:
+    case WITH_CONTEXT_TYPE:
+      return Op::template apply<FixedArray::BodyDescriptor>(p1, p2, p3, p4);
+    case WEAK_FIXED_ARRAY_TYPE:
+      return Op::template apply<WeakFixedArray::BodyDescriptor>(p1, p2, p3, p4);
     case FIXED_DOUBLE_ARRAY_TYPE:
       return ReturnType();
+    case FEEDBACK_METADATA_TYPE:
+      return Op::template apply<FeedbackMetadata::BodyDescriptor>(p1, p2, p3,
+                                                                  p4);
     case PROPERTY_ARRAY_TYPE:
-      return Op::template apply<PropertyArray::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<PropertyArray::BodyDescriptor>(p1, p2, p3, p4);
     case DESCRIPTOR_ARRAY_TYPE:
-      return Op::template apply<DescriptorArray::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<DescriptorArray::BodyDescriptor>(p1, p2, p3,
+                                                                 p4);
     case TRANSITION_ARRAY_TYPE:
-      return Op::template apply<TransitionArray::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<TransitionArray::BodyDescriptor>(p1, p2, p3,
+                                                                 p4);
+    case FEEDBACK_CELL_TYPE:
+      return Op::template apply<FeedbackCell::BodyDescriptor>(p1, p2, p3, p4);
     case FEEDBACK_VECTOR_TYPE:
-      return Op::template apply<FeedbackVector::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<FeedbackVector::BodyDescriptor>(p1, p2, p3, p4);
     case JS_OBJECT_TYPE:
     case JS_ERROR_TYPE:
     case JS_ARGUMENTS_TYPE:
@@ -473,6 +574,7 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3) {
     case JS_VALUE_TYPE:
     case JS_DATE_TYPE:
     case JS_ARRAY_TYPE:
+    case JS_ARRAY_ITERATOR_TYPE:
     case JS_MODULE_NAMESPACE_TYPE:
     case JS_TYPED_ARRAY_TYPE:
     case JS_DATA_VIEW_TYPE:
@@ -484,11 +586,6 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3) {
     case JS_MAP_KEY_VALUE_ITERATOR_TYPE:
     case JS_MAP_VALUE_ITERATOR_TYPE:
     case JS_STRING_ITERATOR_TYPE:
-
-#define ARRAY_ITERATOR_CASE(type) case type:
-      ARRAY_ITERATOR_TYPE_LIST(ARRAY_ITERATOR_CASE)
-#undef ARRAY_ITERATOR_CASE
-
     case JS_REGEXP_TYPE:
     case JS_GLOBAL_PROXY_TYPE:
     case JS_GLOBAL_OBJECT_TYPE:
@@ -496,48 +593,52 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3) {
     case JS_SPECIAL_API_OBJECT_TYPE:
     case JS_MESSAGE_OBJECT_TYPE:
     case JS_BOUND_FUNCTION_TYPE:
-    case WASM_INSTANCE_TYPE:
     case WASM_MEMORY_TYPE:
     case WASM_MODULE_TYPE:
     case WASM_TABLE_TYPE:
-      return Op::template apply<JSObject::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<JSObject::BodyDescriptor>(p1, p2, p3, p4);
+    case WASM_INSTANCE_TYPE:
+      return Op::template apply<WasmInstanceObject::BodyDescriptor>(p1, p2, p3,
+                                                                    p4);
     case JS_WEAK_MAP_TYPE:
     case JS_WEAK_SET_TYPE:
-      return Op::template apply<JSWeakCollection::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<JSWeakCollection::BodyDescriptor>(p1, p2, p3,
+                                                                  p4);
     case JS_ARRAY_BUFFER_TYPE:
-      return Op::template apply<JSArrayBuffer::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<JSArrayBuffer::BodyDescriptor>(p1, p2, p3, p4);
     case JS_FUNCTION_TYPE:
-      return Op::template apply<JSFunction::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<JSFunction::BodyDescriptor>(p1, p2, p3, p4);
     case ODDBALL_TYPE:
-      return Op::template apply<Oddball::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<Oddball::BodyDescriptor>(p1, p2, p3, p4);
     case JS_PROXY_TYPE:
-      return Op::template apply<JSProxy::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<JSProxy::BodyDescriptor>(p1, p2, p3, p4);
     case FOREIGN_TYPE:
-      return Op::template apply<Foreign::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<Foreign::BodyDescriptor>(p1, p2, p3, p4);
     case MAP_TYPE:
-      return Op::template apply<Map::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<Map::BodyDescriptor>(p1, p2, p3, p4);
     case CODE_TYPE:
-      return Op::template apply<Code::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<Code::BodyDescriptor>(p1, p2, p3, p4);
     case CELL_TYPE:
-      return Op::template apply<Cell::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<Cell::BodyDescriptor>(p1, p2, p3, p4);
     case PROPERTY_CELL_TYPE:
-      return Op::template apply<PropertyCell::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<PropertyCell::BodyDescriptor>(p1, p2, p3, p4);
     case WEAK_CELL_TYPE:
-      return Op::template apply<WeakCell::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<WeakCell::BodyDescriptor>(p1, p2, p3, p4);
     case SYMBOL_TYPE:
-      return Op::template apply<Symbol::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<Symbol::BodyDescriptor>(p1, p2, p3, p4);
     case BYTECODE_ARRAY_TYPE:
-      return Op::template apply<BytecodeArray::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<BytecodeArray::BodyDescriptor>(p1, p2, p3, p4);
     case SMALL_ORDERED_HASH_SET_TYPE:
       return Op::template apply<
           SmallOrderedHashTable<SmallOrderedHashSet>::BodyDescriptor>(p1, p2,
-                                                                      p3);
+                                                                      p3, p4);
     case SMALL_ORDERED_HASH_MAP_TYPE:
       return Op::template apply<
           SmallOrderedHashTable<SmallOrderedHashMap>::BodyDescriptor>(p1, p2,
-                                                                      p3);
+                                                                      p3, p4);
     case CODE_DATA_CONTAINER_TYPE:
-      return Op::template apply<CodeDataContainer::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<CodeDataContainer::BodyDescriptor>(p1, p2, p3,
+                                                                   p4);
     case HEAP_NUMBER_TYPE:
     case MUTABLE_HEAP_NUMBER_TYPE:
     case FILLER_TYPE:
@@ -546,27 +647,30 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3) {
     case BIGINT_TYPE:
       return ReturnType();
 
-#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
-  case FIXED_##TYPE##_ARRAY_TYPE:                       \
-    return Op::template apply<FixedTypedArrayBase::BodyDescriptor>(p1, p2, p3);
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                        \
+  case FIXED_##TYPE##_ARRAY_TYPE:                                              \
+    return Op::template apply<FixedTypedArrayBase::BodyDescriptor>(p1, p2, p3, \
+                                                                   p4);
       TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
 
     case SHARED_FUNCTION_INFO_TYPE: {
-      return Op::template apply<SharedFunctionInfo::BodyDescriptor>(p1, p2, p3);
+      return Op::template apply<SharedFunctionInfo::BodyDescriptor>(p1, p2, p3,
+                                                                    p4);
     }
 
 #define MAKE_STRUCT_CASE(NAME, Name, name) case NAME##_TYPE:
       STRUCT_LIST(MAKE_STRUCT_CASE)
 #undef MAKE_STRUCT_CASE
       if (type == ALLOCATION_SITE_TYPE) {
-        return Op::template apply<AllocationSite::BodyDescriptor>(p1, p2, p3);
+        return Op::template apply<AllocationSite::BodyDescriptor>(p1, p2, p3,
+                                                                  p4);
       } else {
-        return Op::template apply<StructBodyDescriptor>(p1, p2, p3);
+        return Op::template apply<StructBodyDescriptor>(p1, p2, p3, p4);
       }
     case LOAD_HANDLER_TYPE:
     case STORE_HANDLER_TYPE:
-      return Op::template apply<StructBodyDescriptor>(p1, p2, p3);
+      return Op::template apply<StructBodyDescriptor>(p1, p2, p3, p4);
     default:
       PrintF("Unknown type: %d\n", type);
       UNREACHABLE();
@@ -584,21 +688,22 @@ void HeapObject::IterateFast(ObjectVisitor* v) {
 template <typename ObjectVisitor>
 void HeapObject::IterateBodyFast(ObjectVisitor* v) {
   Map* m = map();
-  IterateBodyFast(m->instance_type(), SizeFromMap(m), v);
+  IterateBodyFast(m, SizeFromMap(m), v);
 }
 
 
 struct CallIterateBody {
   template <typename BodyDescriptor, typename ObjectVisitor>
-  static void apply(HeapObject* obj, int object_size, ObjectVisitor* v) {
-    BodyDescriptor::IterateBody(obj, object_size, v);
+  static void apply(Map* map, HeapObject* obj, int object_size,
+                    ObjectVisitor* v) {
+    BodyDescriptor::IterateBody(map, obj, object_size, v);
   }
 };
 
 template <typename ObjectVisitor>
-void HeapObject::IterateBodyFast(InstanceType type, int object_size,
-                                 ObjectVisitor* v) {
-  BodyDescriptorApply<CallIterateBody, void>(type, this, object_size, v);
+void HeapObject::IterateBodyFast(Map* map, int object_size, ObjectVisitor* v) {
+  BodyDescriptorApply<CallIterateBody, void>(map->instance_type(), map, this,
+                                             object_size, v);
 }
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects-body-descriptors.h b/deps/v8/src/objects-body-descriptors.h
index a867fc15270..d6baf86e112 100644
--- a/deps/v8/src/objects-body-descriptors.h
+++ b/deps/v8/src/objects-body-descriptors.h
@@ -18,13 +18,13 @@ namespace internal {
 //    It is used for invalid slots filtering. If the offset points outside
 //    of the object or to the map word, the result is UNDEFINED (!!!).
 //
-//   static bool IsValidSlot(HeapObject* obj, int offset);
+//   static bool IsValidSlot(Map* map, HeapObject* obj, int offset);
 //
 //
 // 2) Iterate object's body using stateful object visitor.
 //
 //   template <typename ObjectVisitor>
-//   static inline void IterateBody(HeapObject* obj, int object_size,
+//   static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
 //                                  ObjectVisitor* v);
 class BodyDescriptorBase BASE_EMBEDDED {
  public:
@@ -36,14 +36,23 @@ class BodyDescriptorBase BASE_EMBEDDED {
   static inline void IteratePointer(HeapObject* obj, int offset,
                                     ObjectVisitor* v);
 
+  template <typename ObjectVisitor>
+  static inline void IterateMaybeWeakPointers(HeapObject* obj, int start_offset,
+                                              int end_offset, ObjectVisitor* v);
+
+  template <typename ObjectVisitor>
+  static inline void IterateMaybeWeakPointer(HeapObject* obj, int offset,
+                                             ObjectVisitor* v);
+
  protected:
   // Returns true for all header and embedder fields.
-  static inline bool IsValidSlotImpl(HeapObject* obj, int offset);
+  static inline bool IsValidSlotImpl(Map* map, HeapObject* obj, int offset);
 
   // Treats all header and embedder fields in the range as tagged.
   template <typename ObjectVisitor>
-  static inline void IterateBodyImpl(HeapObject* obj, int start_offset,
-                                     int end_offset, ObjectVisitor* v);
+  static inline void IterateBodyImpl(Map* map, HeapObject* obj,
+                                     int start_offset, int end_offset,
+                                     ObjectVisitor* v);
 };
 
 
@@ -57,19 +66,19 @@ class FixedBodyDescriptor final : public BodyDescriptorBase {
   static const int kEndOffset = end_offset;
   static const int kSize = size;
 
-  static bool IsValidSlot(HeapObject* obj, int offset) {
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
     return offset >= kStartOffset && offset < kEndOffset;
   }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, ObjectVisitor* v) {
+  static inline void IterateBody(Map* map, HeapObject* obj, ObjectVisitor* v) {
     IteratePointers(obj, start_offset, end_offset, v);
   }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
-    IterateBody(obj, v);
+    IterateBody(map, obj, v);
   }
 
   static inline int SizeOf(Map* map, HeapObject* object) { return kSize; }
@@ -84,12 +93,12 @@ class FlexibleBodyDescriptor final : public BodyDescriptorBase {
  public:
   static const int kStartOffset = start_offset;
 
-  static bool IsValidSlot(HeapObject* obj, int offset) {
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
     return (offset >= kStartOffset);
   }
 
   template <typename ObjectVisitor>
-  static inline void IterateBody(HeapObject* obj, int object_size,
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
     IteratePointers(obj, start_offset, object_size, v);
   }
diff --git a/deps/v8/src/objects-debug.cc b/deps/v8/src/objects-debug.cc
index 142dbf66110..d3759c090e4 100644
--- a/deps/v8/src/objects-debug.cc
+++ b/deps/v8/src/objects-debug.cc
@@ -17,14 +17,40 @@
 #include "src/objects/data-handler-inl.h"
 #include "src/objects/debug-objects-inl.h"
 #include "src/objects/literal-objects.h"
+#include "src/objects/maybe-object.h"
+#include "src/objects/microtask-inl.h"
 #include "src/objects/module.h"
+#include "src/objects/promise-inl.h"
 #include "src/ostreams.h"
 #include "src/regexp/jsregexp.h"
 #include "src/transitions.h"
+#include "src/wasm/wasm-objects-inl.h"
 
 namespace v8 {
 namespace internal {
 
+// Heap Verification Overview
+// --------------------------
+// - Each InstanceType has a separate XXXVerify method which checks an object's
+//   integrity in isolation.
+// - --verify-heap will iterate over all gc spaces and call ObjectVerify() on
+//   every encountered tagged pointer.
+// - Verification should be pushed down to the specific instance type if its
+//   integrity is independent of an outer object.
+// - In cases where the InstanceType is too genernic (e.g. FixedArray) the
+//   XXXVerify of the outer method has to do recursive verification.
+// - If the corresponding objects have inheritence the parent's Verify method
+//   is called as well.
+// - For any field containing pointes VerifyPointer(...) should be called.
+//
+// Caveats
+// -------
+// - Assume that any of the verify methods is incomplete!
+// - Some integrity checks are only partially done due to objects being in
+//   partially initialized states when a gc happens, for instance when outer
+//   objects are allocted before inner ones.
+//
+
 #ifdef VERIFY_HEAP
 
 void Object::ObjectVerify() {
@@ -45,6 +71,15 @@ void Object::VerifyPointer(Object* p) {
   }
 }
 
+void MaybeObject::VerifyMaybeObjectPointer(MaybeObject* p) {
+  HeapObject* heap_object;
+  if (p->ToStrongOrWeakHeapObject(&heap_object)) {
+    HeapObject::VerifyHeapPointer(heap_object);
+  } else {
+    CHECK(p->IsSmi() || p->IsClearedWeakHeapObject());
+  }
+}
+
 namespace {
 void VerifyForeignPointer(HeapObject* host, Object* foreign) {
   host->VerifyPointer(foreign);
@@ -65,12 +100,13 @@ void HeapObject::HeapObjectVerify() {
   CHECK(map()->IsMap());
   InstanceType instance_type = map()->instance_type();
 
-  if (instance_type < FIRST_NONSTRING_TYPE) {
-    String::cast(this)->StringVerify();
-    return;
-  }
 
   switch (instance_type) {
+#define STRING_TYPE_CASE(TYPE, size, name, camel_name) case TYPE:
+    STRING_TYPE_LIST(STRING_TYPE_CASE)
+#undef STRING_TYPE_CASE
+    String::cast(this)->StringVerify();
+    break;
     case SYMBOL_TYPE:
       Symbol::cast(this)->SymbolVerify();
       break;
@@ -85,12 +121,29 @@ void HeapObject::HeapObjectVerify() {
       BigInt::cast(this)->BigIntVerify();
       break;
     case HASH_TABLE_TYPE:
+    case BOILERPLATE_DESCRIPTION_TYPE:
     case FIXED_ARRAY_TYPE:
+    case SCOPE_INFO_TYPE:
+    case BLOCK_CONTEXT_TYPE:
+    case CATCH_CONTEXT_TYPE:
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+    case EVAL_CONTEXT_TYPE:
+    case FUNCTION_CONTEXT_TYPE:
+    case MODULE_CONTEXT_TYPE:
+    case NATIVE_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TYPE:
+    case WITH_CONTEXT_TYPE:
       FixedArray::cast(this)->FixedArrayVerify();
       break;
+    case WEAK_FIXED_ARRAY_TYPE:
+      WeakFixedArray::cast(this)->WeakFixedArrayVerify();
+      break;
     case FIXED_DOUBLE_ARRAY_TYPE:
       FixedDoubleArray::cast(this)->FixedDoubleArrayVerify();
       break;
+    case FEEDBACK_METADATA_TYPE:
+      FeedbackMetadata::cast(this)->FeedbackMetadataVerify();
+      break;
     case BYTE_ARRAY_TYPE:
       ByteArray::cast(this)->ByteArrayVerify();
       break;
@@ -109,6 +162,9 @@ void HeapObject::HeapObjectVerify() {
     case FREE_SPACE_TYPE:
       FreeSpace::cast(this)->FreeSpaceVerify();
       break;
+    case FEEDBACK_CELL_TYPE:
+      FeedbackCell::cast(this)->FeedbackCellVerify();
+      break;
     case FEEDBACK_VECTOR_TYPE:
       FeedbackVector::cast(this)->FeedbackVectorVerify();
       break;
@@ -195,13 +251,9 @@ void HeapObject::HeapObjectVerify() {
     case JS_MAP_VALUE_ITERATOR_TYPE:
       JSMapIterator::cast(this)->JSMapIteratorVerify();
       break;
-
-#define ARRAY_ITERATOR_CASE(type) case type:
-      ARRAY_ITERATOR_TYPE_LIST(ARRAY_ITERATOR_CASE)
-#undef ARRAY_ITERATOR_CASE
+    case JS_ARRAY_ITERATOR_TYPE:
       JSArrayIterator::cast(this)->JSArrayIteratorVerify();
       break;
-
     case JS_STRING_ITERATOR_TYPE:
       JSStringIterator::cast(this)->JSStringIteratorVerify();
       break;
@@ -267,10 +319,6 @@ void HeapObject::HeapObjectVerify() {
     case STORE_HANDLER_TYPE:
       StoreHandler::cast(this)->StoreHandlerVerify();
       break;
-
-    default:
-      UNREACHABLE();
-      break;
   }
 }
 
@@ -287,6 +335,7 @@ void Symbol::SymbolVerify() {
   CHECK(HasHashCode());
   CHECK_GT(Hash(), 0);
   CHECK(name()->IsUndefined(GetIsolate()) || name()->IsString());
+  CHECK_IMPLIES(IsPrivateField(), IsPrivate());
 }
 
 
@@ -315,7 +364,20 @@ void FreeSpace::FreeSpaceVerify() {
   CHECK(IsFreeSpace());
 }
 
-void FeedbackVector::FeedbackVectorVerify() { CHECK(IsFeedbackVector()); }
+void FeedbackCell::FeedbackCellVerify() {
+  CHECK(IsFeedbackCell());
+  Isolate* const isolate = GetIsolate();
+  VerifyHeapPointer(value());
+  CHECK(value()->IsUndefined(isolate) || value()->IsFeedbackVector());
+}
+
+void FeedbackVector::FeedbackVectorVerify() {
+  CHECK(IsFeedbackVector());
+  MaybeObject* code = optimized_code_weak_or_smi();
+  MaybeObject::VerifyMaybeObjectPointer(code);
+  CHECK(code->IsSmi() || code->IsClearedWeakHeapObject() ||
+        code->IsWeakHeapObject());
+}
 
 template <class Traits>
 void FixedTypedArray<Traits>::FixedTypedArrayVerify() {
@@ -324,7 +386,8 @@ void FixedTypedArray<Traits>::FixedTypedArrayVerify() {
             Traits::kInstanceType);
   if (base_pointer() == this) {
     CHECK(external_pointer() ==
-          ExternalReference::fixed_typed_array_base_data_offset().address());
+          ExternalReference::fixed_typed_array_base_data_offset(GetIsolate())
+              .address());
   } else {
     CHECK_NULL(base_pointer());
   }
@@ -452,6 +515,8 @@ void Map::MapVerify() {
     DCHECK(prototype_info() == Smi::kZero ||
            prototype_info()->IsPrototypeInfo());
   }
+  CHECK(prototype_validity_cell()->IsSmi() ||
+        prototype_validity_cell()->IsCell());
 }
 
 
@@ -476,6 +541,12 @@ void FixedArray::FixedArrayVerify() {
   }
 }
 
+void WeakFixedArray::WeakFixedArrayVerify() {
+  for (int i = 0; i < length(); i++) {
+    MaybeObject::VerifyMaybeObjectPointer(Get(i));
+  }
+}
+
 void PropertyArray::PropertyArrayVerify() {
   if (length() == 0) {
     CHECK_EQ(this, this->GetHeap()->empty_property_array());
@@ -504,6 +575,20 @@ void FixedDoubleArray::FixedDoubleArrayVerify() {
   }
 }
 
+void FeedbackMetadata::FeedbackMetadataVerify() {
+  if (slot_count() == 0) {
+    CHECK_EQ(GetHeap()->empty_feedback_metadata(), this);
+  } else {
+    FeedbackMetadataIterator iter(this);
+    while (iter.HasNext()) {
+      iter.Next();
+      FeedbackSlotKind kind = iter.kind();
+      CHECK_NE(FeedbackSlotKind::kInvalid, kind);
+      CHECK_GT(FeedbackSlotKind::kKindsNumber, kind);
+    }
+  }
+}
+
 void DescriptorArray::DescriptorArrayVerify() {
   FixedArrayVerify();
   if (number_of_descriptors_storage() == 0) {
@@ -742,6 +827,9 @@ void JSBoundFunction::JSBoundFunctionVerify() {
 
 void JSFunction::JSFunctionVerify() {
   CHECK(IsJSFunction());
+  JSObjectVerify();
+  VerifyHeapPointer(feedback_cell());
+  CHECK(feedback_cell()->IsFeedbackCell());
   CHECK(code()->IsCode());
   CHECK(map()->is_callable());
   if (has_prototype_slot()) {
@@ -753,34 +841,39 @@ void JSFunction::JSFunctionVerify() {
 void SharedFunctionInfo::SharedFunctionInfoVerify() {
   CHECK(IsSharedFunctionInfo());
 
-  VerifyObjectField(kCodeOffset);
+  VerifyObjectField(kFunctionDataOffset);
   VerifyObjectField(kDebugInfoOffset);
   VerifyObjectField(kFeedbackMetadataOffset);
-  VerifyObjectField(kFunctionDataOffset);
   VerifyObjectField(kFunctionIdentifierOffset);
-  VerifyObjectField(kInstanceClassNameOffset);
-  VerifyObjectField(kNameOffset);
+  VerifyObjectField(kNameOrScopeInfoOffset);
   VerifyObjectField(kOuterScopeInfoOffset);
-  VerifyObjectField(kScopeInfoOffset);
   VerifyObjectField(kScriptOffset);
 
-  CHECK(raw_name() == kNoSharedNameSentinel || raw_name()->IsString());
+  Object* value = name_or_scope_info();
+  CHECK(value == kNoSharedNameSentinel || value->IsString() ||
+        value->IsScopeInfo());
+  if (value->IsScopeInfo()) {
+    CHECK_LT(0, ScopeInfo::cast(value)->length());
+    CHECK_NE(value, GetHeap()->empty_scope_info());
+  }
 
   Isolate* isolate = GetIsolate();
-  CHECK(function_data()->IsUndefined(isolate) || IsApiFunction() ||
-        HasBytecodeArray() || HasAsmWasmData() ||
-        HasLazyDeserializationBuiltinId() || HasPreParsedScopeData());
+  CHECK(HasCodeObject() || IsApiFunction() || HasBytecodeArray() ||
+        HasAsmWasmData() || HasBuiltinId() || HasPreParsedScopeData());
 
   CHECK(function_identifier()->IsUndefined(isolate) || HasBuiltinFunctionId() ||
         HasInferredName());
 
   int expected_map_index = Context::FunctionMapIndex(
-      language_mode(), kind(), true, has_shared_name(), needs_home_object());
+      language_mode(), kind(), true, HasSharedName(), needs_home_object());
   CHECK_EQ(expected_map_index, function_map_index());
 
   if (scope_info()->length() > 0) {
-    CHECK(kind() == scope_info()->function_kind());
-    CHECK_EQ(kind() == kModule, scope_info()->scope_type() == MODULE_SCOPE);
+    ScopeInfo* info = scope_info();
+    CHECK(kind() == info->function_kind());
+    CHECK_EQ(kind() == kModule, info->scope_type() == MODULE_SCOPE);
+    CHECK_EQ(raw_start_position(), info->StartPosition());
+    CHECK_EQ(raw_end_position(), info->EndPosition());
   }
 }
 
@@ -873,7 +966,8 @@ void CodeDataContainer::CodeDataContainerVerify() {
 }
 
 void Code::CodeVerify() {
-  CHECK(IsAligned(reinterpret_cast<intptr_t>(instruction_start()),
+  CHECK_LE(constant_pool_offset(), InstructionSize());
+  CHECK(IsAligned(reinterpret_cast<intptr_t>(InstructionStart()),
                   kCodeAlignment));
   relocation_info()->ObjectVerify();
   Address last_gc_pc = nullptr;
@@ -889,46 +983,6 @@ void Code::CodeVerify() {
 }
 
 
-void Code::VerifyEmbeddedObjectsDependency() {
-  if (!CanContainWeakObjects()) return;
-  WeakCell* cell = CachedWeakCell();
-  DisallowHeapAllocation no_gc;
-  Isolate* isolate = GetIsolate();
-  HandleScope scope(isolate);
-  int mode_mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
-  for (RelocIterator it(this, mode_mask); !it.done(); it.next()) {
-    Object* obj = it.rinfo()->target_object();
-    if (IsWeakObject(obj)) {
-      if (obj->IsMap()) {
-        Map* map = Map::cast(obj);
-        CHECK(map->dependent_code()->Contains(DependentCode::kWeakCodeGroup,
-                                              cell));
-      } else if (obj->IsJSObject()) {
-        if (isolate->heap()->InNewSpace(obj)) {
-          ArrayList* list =
-              GetIsolate()->heap()->weak_new_space_object_to_code_list();
-          bool found = false;
-          for (int i = 0; i < list->Length(); i += 2) {
-            WeakCell* obj_cell = WeakCell::cast(list->Get(i));
-            if (!obj_cell->cleared() && obj_cell->value() == obj &&
-                WeakCell::cast(list->Get(i + 1)) == cell) {
-              found = true;
-              break;
-            }
-          }
-          CHECK(found);
-        } else {
-          Handle<HeapObject> key_obj(HeapObject::cast(obj), isolate);
-          DependentCode* dep =
-              GetIsolate()->heap()->LookupWeakObjectToCodeDependency(key_obj);
-          dep->Contains(DependentCode::kWeakCodeGroup, cell);
-        }
-      }
-    }
-  }
-}
-
-
 void JSArray::JSArrayVerify() {
   JSObjectVerify();
   Isolate* isolate = GetIsolate();
@@ -1012,11 +1066,20 @@ void JSWeakMap::JSWeakMapVerify() {
 void JSArrayIterator::JSArrayIteratorVerify() {
   CHECK(IsJSArrayIterator());
   JSObjectVerify();
-  CHECK(object()->IsJSReceiver() || object()->IsUndefined(GetIsolate()));
-
-  CHECK_GE(index()->Number(), 0);
-  CHECK_LE(index()->Number(), kMaxSafeInteger);
-  CHECK(object_map()->IsMap() || object_map()->IsUndefined(GetIsolate()));
+  CHECK(iterated_object()->IsJSReceiver() ||
+        iterated_object()->IsUndefined(GetIsolate()));
+
+  CHECK_GE(next_index()->Number(), 0);
+  CHECK_LE(next_index()->Number(), kMaxSafeInteger);
+
+  if (iterated_object()->IsJSTypedArray()) {
+    // JSTypedArray::length is limited to Smi range.
+    CHECK(next_index()->IsSmi());
+    CHECK_LE(next_index()->Number(), Smi::kMaxValue);
+  } else if (iterated_object()->IsJSArray()) {
+    // JSArray::length is limited to Uint32 range.
+    CHECK_LE(next_index()->Number(), kMaxUInt32);
+  }
 }
 
 void JSStringIterator::JSStringIteratorVerify() {
@@ -1041,33 +1104,102 @@ void JSWeakSet::JSWeakSetVerify() {
   CHECK(table()->IsHashTable() || table()->IsUndefined(GetIsolate()));
 }
 
+void Microtask::MicrotaskVerify() { CHECK(IsMicrotask()); }
+
+void CallableTask::CallableTaskVerify() {
+  CHECK(IsCallableTask());
+  MicrotaskVerify();
+  VerifyHeapPointer(callable());
+  CHECK(callable()->IsCallable());
+  VerifyHeapPointer(context());
+  CHECK(context()->IsContext());
+}
+
+void CallbackTask::CallbackTaskVerify() {
+  CHECK(IsCallbackTask());
+  MicrotaskVerify();
+  VerifyHeapPointer(callback());
+  VerifyHeapPointer(data());
+}
+
+void PromiseReactionJobTask::PromiseReactionJobTaskVerify() {
+  CHECK(IsPromiseReactionJobTask());
+  MicrotaskVerify();
+  Isolate* isolate = GetIsolate();
+  VerifyPointer(argument());
+  VerifyHeapPointer(context());
+  CHECK(context()->IsContext());
+  VerifyHeapPointer(handler());
+  VerifyHeapPointer(payload());
+  if (handler()->IsCode()) {
+    CHECK(payload()->IsJSReceiver());
+  } else {
+    CHECK(handler()->IsUndefined(isolate) || handler()->IsCallable());
+    CHECK(payload()->IsJSPromise() || payload()->IsPromiseCapability());
+  }
+}
+
+void PromiseFulfillReactionJobTask::PromiseFulfillReactionJobTaskVerify() {
+  CHECK(IsPromiseFulfillReactionJobTask());
+  PromiseReactionJobTaskVerify();
+}
+
+void PromiseRejectReactionJobTask::PromiseRejectReactionJobTaskVerify() {
+  CHECK(IsPromiseRejectReactionJobTask());
+  PromiseReactionJobTaskVerify();
+}
+
+void PromiseResolveThenableJobTask::PromiseResolveThenableJobTaskVerify() {
+  CHECK(IsPromiseResolveThenableJobTask());
+  MicrotaskVerify();
+  VerifyHeapPointer(context());
+  CHECK(context()->IsContext());
+  VerifyHeapPointer(promise_to_resolve());
+  CHECK(promise_to_resolve()->IsJSPromise());
+  VerifyHeapPointer(then());
+  CHECK(then()->IsCallable());
+  CHECK(then()->IsJSReceiver());
+  VerifyHeapPointer(thenable());
+  CHECK(thenable()->IsJSReceiver());
+}
+
 void PromiseCapability::PromiseCapabilityVerify() {
   CHECK(IsPromiseCapability());
-  VerifyPointer(promise());
+  Isolate* isolate = GetIsolate();
+  VerifyHeapPointer(promise());
+  CHECK(promise()->IsJSReceiver() || promise()->IsUndefined(isolate));
   VerifyPointer(resolve());
   VerifyPointer(reject());
 }
 
+void PromiseReaction::PromiseReactionVerify() {
+  CHECK(IsPromiseReaction());
+  Isolate* isolate = GetIsolate();
+  VerifyPointer(next());
+  CHECK(next()->IsSmi() || next()->IsPromiseReaction());
+  VerifyHeapPointer(reject_handler());
+  VerifyHeapPointer(fulfill_handler());
+  VerifyHeapPointer(payload());
+  if (reject_handler()->IsCode()) {
+    CHECK(fulfill_handler()->IsCode());
+    CHECK(payload()->IsJSReceiver());
+  } else {
+    CHECK(reject_handler()->IsUndefined(isolate) ||
+          reject_handler()->IsCallable());
+    CHECK(fulfill_handler()->IsUndefined(isolate) ||
+          fulfill_handler()->IsCallable());
+    CHECK(payload()->IsJSPromise() || payload()->IsPromiseCapability());
+  }
+}
+
 void JSPromise::JSPromiseVerify() {
   CHECK(IsJSPromise());
   JSObjectVerify();
-  Isolate* isolate = GetIsolate();
-  CHECK(result()->IsUndefined(isolate) || result()->IsObject());
-  CHECK(deferred_promise()->IsUndefined(isolate) ||
-        deferred_promise()->IsJSReceiver() ||
-        deferred_promise()->IsFixedArray());
-  CHECK(deferred_on_resolve()->IsUndefined(isolate) ||
-        deferred_on_resolve()->IsCallable() ||
-        deferred_on_resolve()->IsFixedArray());
-  CHECK(deferred_on_reject()->IsUndefined(isolate) ||
-        deferred_on_reject()->IsCallable() ||
-        deferred_on_reject()->IsFixedArray());
-  CHECK(fulfill_reactions()->IsUndefined(isolate) ||
-        fulfill_reactions()->IsCallable() || fulfill_reactions()->IsSymbol() ||
-        fulfill_reactions()->IsFixedArray());
-  CHECK(reject_reactions()->IsUndefined(isolate) ||
-        reject_reactions()->IsSymbol() || reject_reactions()->IsCallable() ||
-        reject_reactions()->IsFixedArray());
+  VerifyPointer(reactions_or_result());
+  VerifySmiField(kFlagsOffset);
+  if (status() == Promise::kPending) {
+    CHECK(reactions()->IsSmi() || reactions()->IsPromiseReaction());
+  }
 }
 
 template <typename Derived>
@@ -1214,33 +1346,6 @@ void Foreign::ForeignVerify() {
 }
 
 
-void PromiseResolveThenableJobInfo::PromiseResolveThenableJobInfoVerify() {
-  CHECK(IsPromiseResolveThenableJobInfo());
-  CHECK(thenable()->IsJSReceiver());
-  CHECK(then()->IsJSReceiver());
-  CHECK(resolve()->IsJSFunction());
-  CHECK(reject()->IsJSFunction());
-  CHECK(context()->IsContext());
-}
-
-void PromiseReactionJobInfo::PromiseReactionJobInfoVerify() {
-  Isolate* isolate = GetIsolate();
-  CHECK(IsPromiseReactionJobInfo());
-  CHECK(value()->IsObject());
-  CHECK(tasks()->IsFixedArray() || tasks()->IsCallable() ||
-        tasks()->IsSymbol());
-  CHECK(deferred_promise()->IsUndefined(isolate) ||
-        deferred_promise()->IsJSReceiver() ||
-        deferred_promise()->IsFixedArray());
-  CHECK(deferred_on_resolve()->IsUndefined(isolate) ||
-        deferred_on_resolve()->IsCallable() ||
-        deferred_on_resolve()->IsFixedArray());
-  CHECK(deferred_on_reject()->IsUndefined(isolate) ||
-        deferred_on_reject()->IsCallable() ||
-        deferred_on_reject()->IsFixedArray());
-  CHECK(context()->IsContext());
-}
-
 void AsyncGeneratorRequest::AsyncGeneratorRequestVerify() {
   CHECK(IsAsyncGeneratorRequest());
   VerifySmiField(kResumeModeOffset);
@@ -1256,8 +1361,6 @@ void BigInt::BigIntVerify() {
   CHECK(IsBigInt());
   CHECK_GE(length(), 0);
   CHECK_IMPLIES(is_zero(), !sign());  // There is no -0n.
-  // TODO(neis): Somewhere check that MSD is non-zero. Doesn't hold during some
-  // operations that allocate which is why we can't test it here.
 }
 
 void JSModuleNamespace::JSModuleNamespaceVerify() {
@@ -1298,7 +1401,7 @@ void Module::ModuleVerify() {
 
   CHECK((status() >= kEvaluating && code()->IsModuleInfo()) ||
         (status() == kInstantiated && code()->IsJSGeneratorObject()) ||
-        (status() >= kInstantiating && code()->IsJSFunction()) ||
+        (status() == kInstantiating && code()->IsJSFunction()) ||
         (code()->IsSharedFunctionInfo()));
 
   CHECK_EQ(status() == kErrored, !exception()->IsTheHole(GetIsolate()));
@@ -1320,12 +1423,11 @@ void Module::ModuleVerify() {
 void PrototypeInfo::PrototypeInfoVerify() {
   CHECK(IsPrototypeInfo());
   CHECK(weak_cell()->IsWeakCell() || weak_cell()->IsUndefined(GetIsolate()));
-  if (prototype_users()->IsWeakFixedArray()) {
-    WeakFixedArray::cast(prototype_users())->FixedArrayVerify();
+  if (prototype_users()->IsFixedArrayOfWeakCells()) {
+    FixedArrayOfWeakCells::cast(prototype_users())->FixedArrayVerify();
   } else {
     CHECK(prototype_users()->IsSmi());
   }
-  CHECK(validity_cell()->IsSmi() || validity_cell()->IsCell());
 }
 
 void Tuple2::Tuple2Verify() {
@@ -1347,6 +1449,45 @@ void Tuple3::Tuple3Verify() {
   VerifyObjectField(kValue3Offset);
 }
 
+void WasmCompiledModule::WasmCompiledModuleVerify() {
+  CHECK(IsWasmCompiledModule());
+  VerifyObjectField(kSharedOffset);
+  VerifyObjectField(kNativeContextOffset);
+  VerifyObjectField(kExportWrappersOffset);
+  VerifyObjectField(kWeakExportedFunctionsOffset);
+  VerifyObjectField(kNextInstanceOffset);
+  VerifyObjectField(kPrevInstanceOffset);
+  VerifyObjectField(kOwningInstanceOffset);
+  VerifyObjectField(kWasmModuleOffset);
+  VerifyObjectField(kNativeModuleOffset);
+  VerifyObjectField(kLazyCompileDataOffset);
+  VerifyObjectField(kUseTrapHandlerOffset);
+}
+
+void WasmDebugInfo::WasmDebugInfoVerify() {
+  CHECK(IsWasmDebugInfo());
+  VerifyObjectField(kInstanceOffset);
+  CHECK(wasm_instance()->IsWasmInstanceObject());
+  VerifyObjectField(kInterpreterHandleOffset);
+  CHECK(interpreter_handle()->IsUndefined(GetIsolate()) ||
+        interpreter_handle()->IsForeign());
+  VerifyObjectField(kInterpretedFunctionsOffset);
+  VerifyObjectField(kLocalsNamesOffset);
+  VerifyObjectField(kCWasmEntriesOffset);
+  VerifyObjectField(kCWasmEntryMapOffset);
+}
+
+void WasmSharedModuleData::WasmSharedModuleDataVerify() {
+  CHECK(IsWasmSharedModuleData());
+  VerifyObjectField(kModuleWrapperOffset);
+  CHECK(module_wrapper()->IsForeign());
+  VerifyObjectField(kModuleBytesOffset);
+  VerifyObjectField(kScriptOffset);
+  VerifyObjectField(kAsmJsOffsetTableOffset);
+  VerifyObjectField(kBreakPointInfosOffset);
+  VerifyObjectField(kLazyCompilationOrchestratorOffset);
+}
+
 void DataHandler::DataHandlerVerify() {
   CHECK(IsDataHandler());
   CHECK_IMPLIES(!smi_handler()->IsSmi(),
@@ -1468,6 +1609,14 @@ void Script::ScriptVerify() {
   VerifyPointer(name());
   VerifyPointer(wrapper());
   VerifyPointer(line_ends());
+  for (int i = 0; i < shared_function_infos()->length(); ++i) {
+    MaybeObject* maybe_object = shared_function_infos()->Get(i);
+    HeapObject* heap_object;
+    CHECK(maybe_object->IsWeakHeapObject() ||
+          maybe_object->IsClearedWeakHeapObject() ||
+          (maybe_object->ToStrongHeapObject(&heap_object) &&
+           heap_object->IsUndefined(GetIsolate())));
+  }
 }
 
 
diff --git a/deps/v8/src/objects-inl.h b/deps/v8/src/objects-inl.h
index 1cbc2ca418e..011c3aa64cc 100644
--- a/deps/v8/src/objects-inl.h
+++ b/deps/v8/src/objects-inl.h
@@ -40,6 +40,7 @@
 #include "src/objects/hash-table.h"
 #include "src/objects/js-array-inl.h"
 #include "src/objects/js-collection-inl.h"
+#include "src/objects/js-promise-inl.h"
 #include "src/objects/js-regexp-inl.h"
 #include "src/objects/literal-objects.h"
 #include "src/objects/module-inl.h"
@@ -78,6 +79,7 @@ int PropertyDetails::field_width_in_words() const {
 }
 
 TYPE_CHECKER(BigInt, BIGINT_TYPE)
+TYPE_CHECKER(BoilerplateDescription, BOILERPLATE_DESCRIPTION_TYPE)
 TYPE_CHECKER(BreakPoint, TUPLE2_TYPE)
 TYPE_CHECKER(BreakPointInfo, TUPLE2_TYPE)
 TYPE_CHECKER(CallHandlerInfo, TUPLE3_TYPE)
@@ -85,11 +87,14 @@ TYPE_CHECKER(Cell, CELL_TYPE)
 TYPE_CHECKER(ConstantElementsPair, TUPLE2_TYPE)
 TYPE_CHECKER(CoverageInfo, FIXED_ARRAY_TYPE)
 TYPE_CHECKER(DescriptorArray, DESCRIPTOR_ARRAY_TYPE)
+TYPE_CHECKER(FeedbackCell, FEEDBACK_CELL_TYPE)
+TYPE_CHECKER(FeedbackMetadata, FEEDBACK_METADATA_TYPE)
 TYPE_CHECKER(FeedbackVector, FEEDBACK_VECTOR_TYPE)
 TYPE_CHECKER(Foreign, FOREIGN_TYPE)
 TYPE_CHECKER(FreeSpace, FREE_SPACE_TYPE)
 TYPE_CHECKER(HashTable, HASH_TABLE_TYPE)
 TYPE_CHECKER(HeapNumber, HEAP_NUMBER_TYPE)
+TYPE_CHECKER(JSArrayIterator, JS_ARRAY_ITERATOR_TYPE)
 TYPE_CHECKER(JSAsyncFromSyncIterator, JS_ASYNC_FROM_SYNC_ITERATOR_TYPE)
 TYPE_CHECKER(JSAsyncGeneratorObject, JS_ASYNC_GENERATOR_OBJECT_TYPE)
 TYPE_CHECKER(JSBoundFunction, JS_BOUND_FUNCTION_TYPE)
@@ -100,7 +105,6 @@ TYPE_CHECKER(JSError, JS_ERROR_TYPE)
 TYPE_CHECKER(JSFunction, JS_FUNCTION_TYPE)
 TYPE_CHECKER(JSGlobalObject, JS_GLOBAL_OBJECT_TYPE)
 TYPE_CHECKER(JSMessageObject, JS_MESSAGE_OBJECT_TYPE)
-TYPE_CHECKER(JSPromise, JS_PROMISE_TYPE)
 TYPE_CHECKER(JSStringIterator, JS_STRING_ITERATOR_TYPE)
 TYPE_CHECKER(JSValue, JS_VALUE_TYPE)
 TYPE_CHECKER(MutableHeapNumber, MUTABLE_HEAP_NUMBER_TYPE)
@@ -109,11 +113,11 @@ TYPE_CHECKER(PreParsedScopeData, TUPLE2_TYPE)
 TYPE_CHECKER(PropertyArray, PROPERTY_ARRAY_TYPE)
 TYPE_CHECKER(PropertyCell, PROPERTY_CELL_TYPE)
 TYPE_CHECKER(PropertyDescriptorObject, FIXED_ARRAY_TYPE)
+TYPE_CHECKER(ScopeInfo, SCOPE_INFO_TYPE)
 TYPE_CHECKER(SmallOrderedHashMap, SMALL_ORDERED_HASH_MAP_TYPE)
 TYPE_CHECKER(SmallOrderedHashSet, SMALL_ORDERED_HASH_SET_TYPE)
 TYPE_CHECKER(SourcePositionTableWithFrameCache, TUPLE2_TYPE)
-TYPE_CHECKER(TemplateMap, HASH_TABLE_TYPE)
-TYPE_CHECKER(TemplateObjectDescription, TUPLE3_TYPE)
+TYPE_CHECKER(TemplateObjectDescription, TUPLE2_TYPE)
 TYPE_CHECKER(TransitionArray, TRANSITION_ARRAY_TYPE)
 TYPE_CHECKER(WasmInstanceObject, WASM_INSTANCE_TYPE)
 TYPE_CHECKER(WasmMemoryObject, WASM_MEMORY_TYPE)
@@ -150,10 +154,6 @@ bool HeapObject::IsJSGeneratorObject() const {
          IsJSAsyncGeneratorObject();
 }
 
-bool HeapObject::IsBoilerplateDescription() const {
-  return IsFixedArrayExact();
-}
-
 bool HeapObject::IsClassBoilerplate() const { return IsFixedArrayExact(); }
 
 bool HeapObject::IsExternal() const {
@@ -310,19 +310,21 @@ bool HeapObject::IsJSSetIterator() const {
           instance_type == JS_SET_KEY_VALUE_ITERATOR_TYPE);
 }
 
-bool HeapObject::IsJSArrayIterator() const {
-  InstanceType instance_type = map()->instance_type();
-  return (instance_type >= FIRST_ARRAY_ITERATOR_TYPE &&
-          instance_type <= LAST_ARRAY_ITERATOR_TYPE);
-}
-
 bool HeapObject::IsJSWeakCollection() const {
   return IsJSWeakMap() || IsJSWeakSet();
 }
 
 bool HeapObject::IsJSCollection() const { return IsJSMap() || IsJSSet(); }
 
-bool HeapObject::IsPromiseCapability() const { return IsTuple3(); }
+bool HeapObject::IsMicrotask() const {
+  InstanceType instance_type = map()->instance_type();
+  return (instance_type >= FIRST_MICROTASK_TYPE &&
+          instance_type <= LAST_MICROTASK_TYPE);
+}
+
+bool HeapObject::IsPromiseReactionJobTask() const {
+  return IsPromiseFulfillReactionJobTask() || IsPromiseRejectReactionJobTask();
+}
 
 bool HeapObject::IsEnumCache() const { return IsTuple2(); }
 
@@ -337,8 +339,6 @@ bool HeapObject::IsRegExpMatchInfo() const { return IsFixedArrayExact(); }
 
 bool Object::IsLayoutDescriptor() const { return IsSmi() || IsByteArray(); }
 
-bool HeapObject::IsFeedbackMetadata() const { return IsFixedArrayExact(); }
-
 bool HeapObject::IsDeoptimizationData() const {
   // Must be a fixed array.
   if (!IsFixedArrayExact()) return false;
@@ -395,10 +395,6 @@ bool HeapObject::IsScriptContextTable() const {
   return map() == GetHeap()->script_context_table_map();
 }
 
-bool HeapObject::IsScopeInfo() const {
-  return map() == GetHeap()->scope_info_map();
-}
-
 template <>
 inline bool Is<JSFunction>(Object* obj) {
   return obj->IsJSFunction();
@@ -412,6 +408,26 @@ bool HeapObject::IsStringWrapper() const {
   return IsJSValue() && JSValue::cast(this)->value()->IsString();
 }
 
+bool HeapObject::IsBooleanWrapper() const {
+  return IsJSValue() && JSValue::cast(this)->value()->IsBoolean();
+}
+
+bool HeapObject::IsScriptWrapper() const {
+  return IsJSValue() && JSValue::cast(this)->value()->IsScript();
+}
+
+bool HeapObject::IsNumberWrapper() const {
+  return IsJSValue() && JSValue::cast(this)->value()->IsNumber();
+}
+
+bool HeapObject::IsBigIntWrapper() const {
+  return IsJSValue() && JSValue::cast(this)->value()->IsBigInt();
+}
+
+bool HeapObject::IsSymbolWrapper() const {
+  return IsJSValue() && JSValue::cast(this)->value()->IsSymbol();
+}
+
 bool HeapObject::IsBoolean() const {
   return IsOddball() &&
          ((Oddball::cast(this)->kind() & Oddball::kNotBooleanMask) == 0);
@@ -421,10 +437,6 @@ bool HeapObject::IsJSArrayBufferView() const {
   return IsJSDataView() || IsJSTypedArray();
 }
 
-bool HeapObject::IsWeakHashTable() const {
-  return map() == GetHeap()->weak_hash_table_map();
-}
-
 bool HeapObject::IsDictionary() const {
   return IsHashTable() && this != GetHeap()->string_table();
 }
@@ -441,6 +453,10 @@ bool HeapObject::IsNumberDictionary() const {
   return map() == GetHeap()->number_dictionary_map();
 }
 
+bool HeapObject::IsSimpleNumberDictionary() const {
+  return map() == GetHeap()->simple_number_dictionary_map();
+}
+
 bool HeapObject::IsStringTable() const {
   return map() == GetHeap()->string_table_map();
 }
@@ -556,6 +572,7 @@ CAST_ACCESSOR(ConstantElementsPair)
 CAST_ACCESSOR(ContextExtension)
 CAST_ACCESSOR(DescriptorArray)
 CAST_ACCESSOR(EnumCache)
+CAST_ACCESSOR(FeedbackCell)
 CAST_ACCESSOR(Foreign)
 CAST_ACCESSOR(FunctionTemplateInfo)
 CAST_ACCESSOR(GlobalDictionary)
@@ -572,7 +589,6 @@ CAST_ACCESSOR(JSGlobalObject)
 CAST_ACCESSOR(JSGlobalProxy)
 CAST_ACCESSOR(JSMessageObject)
 CAST_ACCESSOR(JSObject)
-CAST_ACCESSOR(JSPromise)
 CAST_ACCESSOR(JSProxy)
 CAST_ACCESSOR(JSReceiver)
 CAST_ACCESSOR(JSStringIterator)
@@ -580,6 +596,7 @@ CAST_ACCESSOR(JSValue)
 CAST_ACCESSOR(LayoutDescriptor)
 CAST_ACCESSOR(NameDictionary)
 CAST_ACCESSOR(NormalizedMapCache)
+CAST_ACCESSOR(NumberDictionary)
 CAST_ACCESSOR(Object)
 CAST_ACCESSOR(ObjectHashSet)
 CAST_ACCESSOR(ObjectHashTable)
@@ -587,15 +604,12 @@ CAST_ACCESSOR(ObjectTemplateInfo)
 CAST_ACCESSOR(Oddball)
 CAST_ACCESSOR(OrderedHashMap)
 CAST_ACCESSOR(OrderedHashSet)
-CAST_ACCESSOR(PromiseCapability)
-CAST_ACCESSOR(PromiseReactionJobInfo)
-CAST_ACCESSOR(PromiseResolveThenableJobInfo)
 CAST_ACCESSOR(PropertyArray)
 CAST_ACCESSOR(PropertyCell)
 CAST_ACCESSOR(PrototypeInfo)
 CAST_ACCESSOR(RegExpMatchInfo)
 CAST_ACCESSOR(ScopeInfo)
-CAST_ACCESSOR(NumberDictionary)
+CAST_ACCESSOR(SimpleNumberDictionary)
 CAST_ACCESSOR(SmallOrderedHashMap)
 CAST_ACCESSOR(SmallOrderedHashSet)
 CAST_ACCESSOR(Smi)
@@ -605,12 +619,10 @@ CAST_ACCESSOR(StringSet)
 CAST_ACCESSOR(StringTable)
 CAST_ACCESSOR(Struct)
 CAST_ACCESSOR(TemplateInfo)
-CAST_ACCESSOR(TemplateMap)
 CAST_ACCESSOR(TemplateObjectDescription)
 CAST_ACCESSOR(Tuple2)
 CAST_ACCESSOR(Tuple3)
 CAST_ACCESSOR(WeakCell)
-CAST_ACCESSOR(WeakHashTable)
 
 bool Object::HasValidElements() {
   // Dictionary is covered under FixedArray.
@@ -805,10 +817,6 @@ MaybeHandle<Object> Object::ToIndex(Isolate* isolate, Handle<Object> input,
   return ConvertToIndex(isolate, input, error_index);
 }
 
-bool Object::HasSpecificClassOf(String* name) {
-  return this->IsJSObject() && (JSObject::cast(this)->class_name() == name);
-}
-
 MaybeHandle<Object> Object::GetProperty(Handle<Object> object,
                                         Handle<Name> name) {
   LookupIterator it(object, name);
@@ -906,6 +914,10 @@ Object** HeapObject::RawField(HeapObject* obj, int byte_offset) {
   return reinterpret_cast<Object**>(FIELD_ADDR(obj, byte_offset));
 }
 
+MaybeObject** HeapObject::RawMaybeWeakField(HeapObject* obj, int byte_offset) {
+  return reinterpret_cast<MaybeObject**>(FIELD_ADDR(obj, byte_offset));
+}
+
 int Smi::ToInt(const Object* object) { return Smi::cast(object)->value(); }
 
 MapWord MapWord::FromMap(const Map* map) {
@@ -1371,6 +1383,7 @@ Handle<Object> Oddball::ToNumber(Handle<Oddball> input) {
 
 
 ACCESSORS(Cell, value, Object, kValueOffset)
+ACCESSORS(FeedbackCell, value, HeapObject, kValueOffset)
 ACCESSORS(PropertyCell, dependent_code, DependentCode, kDependentCodeOffset)
 ACCESSORS(PropertyCell, name, Name, kNameOffset)
 ACCESSORS(PropertyCell, value, Object, kValueOffset)
@@ -1643,8 +1656,8 @@ void Object::VerifyApiCallResultType() {
   DCHECK(IsHeapObject());
   Isolate* isolate = HeapObject::cast(this)->GetIsolate();
   if (!(IsString() || IsSymbol() || IsJSReceiver() || IsHeapNumber() ||
-        IsUndefined(isolate) || IsTrue(isolate) || IsFalse(isolate) ||
-        IsNull(isolate))) {
+        IsBigInt() || IsUndefined(isolate) || IsTrue(isolate) ||
+        IsFalse(isolate) || IsNull(isolate))) {
     FATAL("API call returned invalid object");
   }
 #endif  // DEBUG
@@ -1716,13 +1729,14 @@ WriteBarrierMode HeapObject::GetWriteBarrierMode(
   return UPDATE_WRITE_BARRIER;
 }
 
-AllocationAlignment HeapObject::RequiredAlignment() const {
+AllocationAlignment HeapObject::RequiredAlignment(Map* map) {
 #ifdef V8_HOST_ARCH_32_BIT
-  if ((IsFixedFloat64Array() || IsFixedDoubleArray()) &&
-      FixedArrayBase::cast(this)->length() != 0) {
+  int instance_type = map->instance_type();
+  if (instance_type == FIXED_FLOAT64_ARRAY_TYPE ||
+      instance_type == FIXED_DOUBLE_ARRAY_TYPE) {
     return kDoubleAligned;
   }
-  if (IsHeapNumber()) return kDoubleUnaligned;
+  if (instance_type == HEAP_NUMBER_TYPE) return kDoubleUnaligned;
 #endif  // V8_HOST_ARCH_32_BIT
   return kWordAligned;
 }
@@ -2210,6 +2224,15 @@ int HeapObject::SizeFromMap(Map* map) const {
     return FixedDoubleArray::SizeFor(
         reinterpret_cast<const FixedDoubleArray*>(this)->synchronized_length());
   }
+  if (instance_type == FEEDBACK_METADATA_TYPE) {
+    return FeedbackMetadata::SizeFor(
+        reinterpret_cast<const FeedbackMetadata*>(this)
+            ->synchronized_slot_count());
+  }
+  if (instance_type == WEAK_FIXED_ARRAY_TYPE) {
+    return WeakFixedArray::SizeFor(
+        reinterpret_cast<const WeakFixedArray*>(this)->synchronized_length());
+  }
   if (instance_type >= FIRST_FIXED_TYPED_ARRAY_TYPE &&
       instance_type <= LAST_FIXED_TYPED_ARRAY_TYPE) {
     return reinterpret_cast<const FixedTypedArrayBase*>(this)->TypedArraySize(
@@ -2246,7 +2269,7 @@ ACCESSORS(JSBoundFunction, bound_this, Object, kBoundThisOffset)
 ACCESSORS(JSBoundFunction, bound_arguments, FixedArray, kBoundArgumentsOffset)
 
 ACCESSORS(JSFunction, shared, SharedFunctionInfo, kSharedFunctionInfoOffset)
-ACCESSORS(JSFunction, feedback_vector_cell, Cell, kFeedbackVectorOffset)
+ACCESSORS(JSFunction, feedback_cell, FeedbackCell, kFeedbackCellOffset)
 
 ACCESSORS(JSGlobalObject, native_context, Context, kNativeContextOffset)
 ACCESSORS(JSGlobalObject, global_proxy, JSObject, kGlobalProxyOffset)
@@ -2272,21 +2295,12 @@ bool AccessorInfo::has_getter() {
   return result;
 }
 
-ACCESSORS(PromiseResolveThenableJobInfo, thenable, JSReceiver, kThenableOffset)
-ACCESSORS(PromiseResolveThenableJobInfo, then, JSReceiver, kThenOffset)
-ACCESSORS(PromiseResolveThenableJobInfo, resolve, JSFunction, kResolveOffset)
-ACCESSORS(PromiseResolveThenableJobInfo, reject, JSFunction, kRejectOffset)
-ACCESSORS(PromiseResolveThenableJobInfo, context, Context, kContextOffset);
-
-ACCESSORS(PromiseReactionJobInfo, value, Object, kValueOffset);
-ACCESSORS(PromiseReactionJobInfo, tasks, Object, kTasksOffset);
-ACCESSORS(PromiseReactionJobInfo, deferred_promise, Object,
-          kDeferredPromiseOffset);
-ACCESSORS(PromiseReactionJobInfo, deferred_on_resolve, Object,
-          kDeferredOnResolveOffset);
-ACCESSORS(PromiseReactionJobInfo, deferred_on_reject, Object,
-          kDeferredOnRejectOffset);
-ACCESSORS(PromiseReactionJobInfo, context, Context, kContextOffset);
+bool AccessorInfo::has_setter() {
+  bool result = setter() != Smi::kZero;
+  DCHECK_EQ(result, setter() != Smi::kZero &&
+                        Foreign::cast(setter())->foreign_address() != nullptr);
+  return result;
+}
 
 ACCESSORS(AsyncGeneratorRequest, next, Object, kNextOffset)
 SMI_ACCESSORS(AsyncGeneratorRequest, resume_mode, kResumeModeOffset)
@@ -2313,6 +2327,15 @@ bool FunctionTemplateInfo::instantiated() {
   return shared_function_info()->IsSharedFunctionInfo();
 }
 
+bool FunctionTemplateInfo::BreakAtEntry() {
+  Object* maybe_shared = shared_function_info();
+  if (maybe_shared->IsSharedFunctionInfo()) {
+    SharedFunctionInfo* shared = SharedFunctionInfo::cast(maybe_shared);
+    return shared->BreakAtEntry();
+  }
+  return false;
+}
+
 FunctionTemplateInfo* FunctionTemplateInfo::GetParent(Isolate* isolate) {
   Object* parent = parent_template();
   return parent->IsUndefined(isolate) ? nullptr
@@ -2338,7 +2361,6 @@ ACCESSORS(PrototypeInfo, weak_cell, Object, kWeakCellOffset)
 ACCESSORS(PrototypeInfo, prototype_users, Object, kPrototypeUsersOffset)
 ACCESSORS(PrototypeInfo, object_create_map, Object, kObjectCreateMap)
 SMI_ACCESSORS(PrototypeInfo, registry_slot, kRegistrySlotOffset)
-ACCESSORS(PrototypeInfo, validity_cell, Object, kValidityCellOffset)
 SMI_ACCESSORS(PrototypeInfo, bit_field, kBitFieldOffset)
 BOOL_ACCESSORS(PrototypeInfo, bit_field, should_be_fast_map, kShouldBeFastBit)
 
@@ -2356,7 +2378,6 @@ bool ConstantElementsPair::is_empty() const {
   return constant_values()->length() == 0;
 }
 
-SMI_ACCESSORS(TemplateObjectDescription, hash, kHashOffset)
 ACCESSORS(TemplateObjectDescription, raw_strings, FixedArray, kRawStringsOffset)
 ACCESSORS(TemplateObjectDescription, cooked_strings, FixedArray,
           kCookedStringsOffset)
@@ -2384,6 +2405,7 @@ BOOL_ACCESSORS(InterceptorInfo, flags, can_intercept_symbols,
 BOOL_ACCESSORS(InterceptorInfo, flags, all_can_read, kAllCanReadBit)
 BOOL_ACCESSORS(InterceptorInfo, flags, non_masking, kNonMasking)
 BOOL_ACCESSORS(InterceptorInfo, flags, is_named, kNamed)
+BOOL_ACCESSORS(InterceptorInfo, flags, has_no_side_effect, kHasNoSideEffect)
 
 ACCESSORS(CallHandlerInfo, callback, Object, kCallbackOffset)
 ACCESSORS(CallHandlerInfo, js_callback, Object, kJsCallbackOffset)
@@ -2494,7 +2516,7 @@ SMI_ACCESSORS(StackFrameInfo, id, kIdIndex)
 ACCESSORS(SourcePositionTableWithFrameCache, source_position_table, ByteArray,
           kSourcePositionTableIndex)
 ACCESSORS(SourcePositionTableWithFrameCache, stack_frame_cache,
-          NumberDictionary, kStackFrameCacheIndex)
+          SimpleNumberDictionary, kStackFrameCacheIndex)
 
 SMI_ACCESSORS(FunctionTemplateInfo, length, kLengthOffset)
 BOOL_ACCESSORS(FunctionTemplateInfo, flag, hidden_prototype,
@@ -2512,8 +2534,8 @@ BOOL_ACCESSORS(FunctionTemplateInfo, flag, accept_any_receiver,
                kAcceptAnyReceiver)
 
 FeedbackVector* JSFunction::feedback_vector() const {
-  DCHECK(feedback_vector_cell()->value()->IsFeedbackVector());
-  return FeedbackVector::cast(feedback_vector_cell()->value());
+  DCHECK(has_feedback_vector());
+  return FeedbackVector::cast(feedback_cell()->value());
 }
 
 // Code objects that are marked for deoptimization are not considered to be
@@ -2542,8 +2564,12 @@ void JSFunction::ClearOptimizationMarker() {
   feedback_vector()->ClearOptimizationMarker();
 }
 
+// Optimized code marked for deoptimization will tier back down to running
+// interpreted on its next activation, and already doesn't count as IsOptimized.
 bool JSFunction::IsInterpreted() {
-  return code()->is_interpreter_trampoline_builtin();
+  return code()->is_interpreter_trampoline_builtin() ||
+         (code()->kind() == Code::OPTIMIZED_FUNCTION &&
+          code()->marked_for_deoptimization());
 }
 
 bool JSFunction::ChecksOptimizationMarker() {
@@ -2620,21 +2646,7 @@ void JSFunction::SetOptimizationMarker(OptimizationMarker marker) {
 }
 
 bool JSFunction::has_feedback_vector() const {
-  return !feedback_vector_cell()->value()->IsUndefined(GetIsolate());
-}
-
-JSFunction::FeedbackVectorState JSFunction::GetFeedbackVectorState(
-    Isolate* isolate) const {
-  Cell* cell = feedback_vector_cell();
-  if (shared()->HasAsmWasmData()) {
-    return NO_VECTOR_NEEDED;
-  } else if (cell == isolate->heap()->undefined_cell()) {
-    return TOP_LEVEL_SCRIPT_NEEDS_VECTOR;
-  } else if (cell->value() == isolate->heap()->undefined_value() ||
-             !has_feedback_vector()) {
-    return NEEDS_VECTOR;
-  }
-  return HAS_VECTOR;
+  return !feedback_cell()->value()->IsUndefined(GetIsolate());
 }
 
 Context* JSFunction::context() {
@@ -2769,8 +2781,7 @@ bool JSGeneratorObject::is_executing() const {
 }
 
 ACCESSORS(JSAsyncGeneratorObject, queue, HeapObject, kQueueOffset)
-ACCESSORS(JSAsyncGeneratorObject, awaited_promise, HeapObject,
-          kAwaitedPromiseOffset)
+SMI_ACCESSORS(JSAsyncGeneratorObject, is_awaiting, kIsAwaitingOffset)
 
 ACCESSORS(JSValue, value, Object, kValueOffset)
 
@@ -2806,23 +2817,6 @@ SMI_ACCESSORS(JSMessageObject, start_position, kStartPositionOffset)
 SMI_ACCESSORS(JSMessageObject, end_position, kEndPositionOffset)
 SMI_ACCESSORS(JSMessageObject, error_level, kErrorLevelOffset)
 
-
-
-ACCESSORS(PromiseCapability, promise, Object, kPromiseOffset)
-ACCESSORS(PromiseCapability, resolve, Object, kResolveOffset)
-ACCESSORS(PromiseCapability, reject, Object, kRejectOffset)
-
-ACCESSORS(JSPromise, result, Object, kResultOffset)
-ACCESSORS(JSPromise, deferred_promise, Object, kDeferredPromiseOffset)
-ACCESSORS(JSPromise, deferred_on_resolve, Object, kDeferredOnResolveOffset)
-ACCESSORS(JSPromise, deferred_on_reject, Object, kDeferredOnRejectOffset)
-ACCESSORS(JSPromise, fulfill_reactions, Object, kFulfillReactionsOffset)
-ACCESSORS(JSPromise, reject_reactions, Object, kRejectReactionsOffset)
-SMI_ACCESSORS(JSPromise, flags, kFlagsOffset)
-BOOL_ACCESSORS(JSPromise, flags, has_handler, kHasHandlerBit)
-BOOL_ACCESSORS(JSPromise, flags, handled_hint, kHandledHintBit)
-
-
 ElementsKind JSObject::GetElementsKind() {
   ElementsKind kind = map()->elements_kind();
 #if VERIFY_HEAP && DEBUG
@@ -3180,6 +3174,8 @@ BIT_FIELD_ACCESSORS(AccessorInfo, flags, is_special_data_property,
 BIT_FIELD_ACCESSORS(AccessorInfo, flags, replace_on_access,
                     AccessorInfo::ReplaceOnAccessBit)
 BIT_FIELD_ACCESSORS(AccessorInfo, flags, is_sloppy, AccessorInfo::IsSloppyBit)
+BIT_FIELD_ACCESSORS(AccessorInfo, flags, has_no_side_effect,
+                    AccessorInfo::HasNoSideEffectBit)
 BIT_FIELD_ACCESSORS(AccessorInfo, flags, initial_property_attributes,
                     AccessorInfo::InitialAttributesBits)
 
@@ -3304,30 +3300,35 @@ void GlobalDictionary::ValueAtPut(int entry, Object* value) {
   set(EntryToIndex(entry), value);
 }
 
-bool NumberDictionaryShape::IsMatch(uint32_t key, Object* other) {
+bool NumberDictionaryBaseShape::IsMatch(uint32_t key, Object* other) {
   DCHECK(other->IsNumber());
   return key == static_cast<uint32_t>(other->Number());
 }
 
-uint32_t NumberDictionaryShape::Hash(Isolate* isolate, uint32_t key) {
+uint32_t NumberDictionaryBaseShape::Hash(Isolate* isolate, uint32_t key) {
   return ComputeIntegerHash(key, isolate->heap()->HashSeed());
 }
 
-uint32_t NumberDictionaryShape::HashForObject(Isolate* isolate, Object* other) {
+uint32_t NumberDictionaryBaseShape::HashForObject(Isolate* isolate,
+                                                  Object* other) {
   DCHECK(other->IsNumber());
   return ComputeIntegerHash(static_cast<uint32_t>(other->Number()),
                             isolate->heap()->HashSeed());
 }
 
+Handle<Object> NumberDictionaryBaseShape::AsHandle(Isolate* isolate,
+                                                   uint32_t key) {
+  return isolate->factory()->NewNumberFromUint(key);
+}
+
 int NumberDictionaryShape::GetMapRootIndex() {
   return Heap::kNumberDictionaryMapRootIndex;
 }
 
-Handle<Object> NumberDictionaryShape::AsHandle(Isolate* isolate, uint32_t key) {
-  return isolate->factory()->NewNumberFromUint(key);
+int SimpleNumberDictionaryShape::GetMapRootIndex() {
+  return Heap::kSimpleNumberDictionaryMapRootIndex;
 }
 
-
 bool NameDictionaryShape::IsMatch(Handle<Name> key, Object* other) {
   DCHECK(other->IsTheHole(key->GetIsolate()) ||
          Name::cast(other)->IsUniqueName());
@@ -3400,35 +3401,6 @@ Handle<ObjectHashTable> ObjectHashTable::Shrink(Handle<ObjectHashTable> table) {
   return DerivedHashTable::Shrink(table);
 }
 
-bool WeakHashTableShape::IsMatch(Handle<Object> key, Object* other) {
-  if (other->IsWeakCell()) other = WeakCell::cast(other)->value();
-  return key->IsWeakCell() ? WeakCell::cast(*key)->value() == other
-                           : *key == other;
-}
-
-uint32_t WeakHashTableShape::Hash(Isolate* isolate, Handle<Object> key) {
-  intptr_t hash =
-      key->IsWeakCell()
-          ? reinterpret_cast<intptr_t>(WeakCell::cast(*key)->value())
-          : reinterpret_cast<intptr_t>(*key);
-  return (uint32_t)(hash & 0xFFFFFFFF);
-}
-
-uint32_t WeakHashTableShape::HashForObject(Isolate* isolate, Object* other) {
-  if (other->IsWeakCell()) other = WeakCell::cast(other)->value();
-  intptr_t hash = reinterpret_cast<intptr_t>(other);
-  return (uint32_t)(hash & 0xFFFFFFFF);
-}
-
-Handle<Object> WeakHashTableShape::AsHandle(Isolate* isolate,
-                                            Handle<Object> key) {
-  return key;
-}
-
-int WeakHashTableShape::GetMapRootIndex() {
-  return Heap::kWeakHashTableMapRootIndex;
-}
-
 Relocatable::Relocatable(Isolate* isolate) {
   isolate_ = isolate;
   prev_ = isolate->relocatable_top();
@@ -3488,19 +3460,20 @@ ACCESSORS(JSIteratorResult, done, Object, kDoneOffset)
 
 ACCESSORS(JSAsyncFromSyncIterator, sync_iterator, JSReceiver,
           kSyncIteratorOffset)
+ACCESSORS(JSAsyncFromSyncIterator, next, Object, kNextOffset)
 
 ACCESSORS(JSStringIterator, string, String, kStringOffset)
 SMI_ACCESSORS(JSStringIterator, index, kNextIndexOffset)
 
-bool ScopeInfo::IsAsmModule() { return AsmModuleField::decode(Flags()); }
+bool ScopeInfo::IsAsmModule() const { return AsmModuleField::decode(Flags()); }
 
-bool ScopeInfo::HasSimpleParameters() {
+bool ScopeInfo::HasSimpleParameters() const {
   return HasSimpleParametersField::decode(Flags());
 }
 
 #define FIELD_ACCESSORS(name)                                                 \
   void ScopeInfo::Set##name(int value) { set(k##name, Smi::FromInt(value)); } \
-  int ScopeInfo::name() {                                                     \
+  int ScopeInfo::name() const {                                               \
     if (length() > 0) {                                                       \
       return Smi::ToInt(get(k##name));                                        \
     } else {                                                                  \
diff --git a/deps/v8/src/objects-printer.cc b/deps/v8/src/objects-printer.cc
index f13c222632e..4019f760777 100644
--- a/deps/v8/src/objects-printer.cc
+++ b/deps/v8/src/objects-printer.cc
@@ -13,6 +13,8 @@
 #include "src/interpreter/bytecodes.h"
 #include "src/objects-inl.h"
 #include "src/objects/debug-objects-inl.h"
+#include "src/objects/microtask-inl.h"
+#include "src/objects/promise-inl.h"
 #include "src/ostreams.h"
 #include "src/regexp/jsregexp.h"
 #include "src/transitions-inl.h"
@@ -41,7 +43,6 @@ void Object::Print(std::ostream& os) {  // NOLINT
   }
 }
 
-
 void HeapObject::PrintHeader(std::ostream& os, const char* id) {  // NOLINT
   os << reinterpret_cast<void*>(this) << ": [";
   if (id != nullptr) {
@@ -51,6 +52,7 @@ void HeapObject::PrintHeader(std::ostream& os, const char* id) {  // NOLINT
   }
   os << "]";
   if (GetHeap()->InOldSpace(this)) os << " in OldSpace";
+  if (!IsMap()) os << "\n - map: " << Brief(map());
 }
 
 
@@ -89,8 +91,20 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
       break;
     case HASH_TABLE_TYPE:
     case FIXED_ARRAY_TYPE:
+    case BLOCK_CONTEXT_TYPE:
+    case CATCH_CONTEXT_TYPE:
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+    case EVAL_CONTEXT_TYPE:
+    case FUNCTION_CONTEXT_TYPE:
+    case MODULE_CONTEXT_TYPE:
+    case NATIVE_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TYPE:
+    case WITH_CONTEXT_TYPE:
       FixedArray::cast(this)->FixedArrayPrint(os);
       break;
+    case BOILERPLATE_DESCRIPTION_TYPE:
+      BoilerplateDescription::cast(this)->BoilerplateDescriptionPrint(os);
+      break;
     case PROPERTY_ARRAY_TYPE:
       PropertyArray::cast(this)->PropertyArrayPrint(os);
       break;
@@ -106,6 +120,9 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
     case TRANSITION_ARRAY_TYPE:
       TransitionArray::cast(this)->TransitionArrayPrint(os);
       break;
+    case FEEDBACK_CELL_TYPE:
+      FeedbackCell::cast(this)->FeedbackCellPrint(os);
+      break;
     case FEEDBACK_VECTOR_TYPE:
       FeedbackVector::cast(this)->FeedbackVectorPrint(os);
       break;
@@ -121,12 +138,6 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
     TYPED_ARRAYS(PRINT_FIXED_TYPED_ARRAY)
 #undef PRINT_FIXED_TYPED_ARRAY
 
-#define ARRAY_ITERATOR_CASE(type) case type:
-    ARRAY_ITERATOR_TYPE_LIST(ARRAY_ITERATOR_CASE)
-#undef ARRAY_ITERATOR_CASE
-    JSArrayIterator::cast(this)->JSArrayIteratorPrint(os);
-    break;
-
     case FILLER_TYPE:
       os << "filler";
       break;
@@ -228,6 +239,9 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
     case JS_ARRAY_BUFFER_TYPE:
       JSArrayBuffer::cast(this)->JSArrayBufferPrint(os);
       break;
+    case JS_ARRAY_ITERATOR_TYPE:
+      JSArrayIterator::cast(this)->JSArrayIteratorPrint(os);
+      break;
     case JS_TYPED_ARRAY_TYPE:
       JSTypedArray::cast(this)->JSTypedArrayPrint(os);
       break;
@@ -244,11 +258,15 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
     case LOAD_HANDLER_TYPE:
       LoadHandler::cast(this)->LoadHandlerPrint(os);
       break;
-
     case STORE_HANDLER_TYPE:
       StoreHandler::cast(this)->StoreHandlerPrint(os);
       break;
-
+    case SCOPE_INFO_TYPE:
+      ScopeInfo::cast(this)->ScopeInfoPrint(os);
+      break;
+    case FEEDBACK_METADATA_TYPE:
+      FeedbackMetadata::cast(this)->FeedbackMetadataPrint(os);
+      break;
     default:
       os << "UNKNOWN TYPE " << map()->instance_type();
       UNREACHABLE();
@@ -412,14 +430,14 @@ void PrintSloppyArgumentElements(std::ostream& os, ElementsKind kind,
                                  SloppyArgumentsElements* elements) {
   Isolate* isolate = elements->GetIsolate();
   FixedArray* arguments_store = elements->arguments();
-  os << "\n    0: context = " << Brief(elements->context())
-     << "\n    1: arguments_store = " << Brief(arguments_store)
+  os << "\n    0: context: " << Brief(elements->context())
+     << "\n    1: arguments_store: " << Brief(arguments_store)
      << "\n    parameter to context slot map:";
   for (uint32_t i = 0; i < elements->parameter_map_length(); i++) {
     uint32_t raw_index = i + SloppyArgumentsElements::kParameterMapStart;
     Object* mapped_entry = elements->get_mapped_entry(i);
     os << "\n    " << raw_index << ": param(" << i
-       << ") = " << Brief(mapped_entry);
+       << "): " << Brief(mapped_entry);
     if (mapped_entry->IsTheHole(isolate)) {
       os << " in the arguments_store[" << i << "]";
     } else {
@@ -428,7 +446,7 @@ void PrintSloppyArgumentElements(std::ostream& os, ElementsKind kind,
   }
   if (arguments_store->length() == 0) return;
   os << "\n }"
-     << "\n - arguments_store = " << Brief(arguments_store) << " "
+     << "\n - arguments_store: " << Brief(arguments_store) << " "
      << ElementsKindToString(arguments_store->map()->elements_kind()) << " {";
   if (kind == FAST_SLOPPY_ARGUMENTS_ELEMENTS) {
     PrintFixedArrayElements(os, arguments_store);
@@ -443,7 +461,7 @@ void PrintSloppyArgumentElements(std::ostream& os, ElementsKind kind,
 void JSObject::PrintElements(std::ostream& os) {  // NOLINT
   // Don't call GetElementsKind, its validation code can cause the printer to
   // fail when debugging.
-  os << " - elements = " << Brief(elements()) << " {";
+  os << " - elements: " << Brief(elements()) << " {";
   if (elements()->length() == 0) {
     os << " }\n";
     return;
@@ -492,21 +510,21 @@ static void JSObjectPrintHeader(std::ostream& os, JSObject* obj,
   obj->PrintHeader(os, id);
   // Don't call GetElementsKind, its validation code can cause the printer to
   // fail when debugging.
-  os << "\n - map = " << reinterpret_cast<void*>(obj->map()) << " [";
+  os << " [";
   if (obj->HasFastProperties()) {
     os << "FastProperties";
   } else {
     os << "DictionaryProperties";
   }
   PrototypeIterator iter(obj->GetIsolate(), obj);
-  os << "]\n - prototype = " << reinterpret_cast<void*>(iter.GetCurrent());
-  os << "\n - elements = " << Brief(obj->elements()) << " ["
+  os << "]\n - prototype: " << Brief(iter.GetCurrent());
+  os << "\n - elements: " << Brief(obj->elements()) << " ["
      << ElementsKindToString(obj->map()->elements_kind());
   if (obj->elements()->IsCowArray()) os << " (COW)";
   os << "]";
   Object* hash = obj->GetHash();
   if (hash->IsSmi()) {
-    os << "\n - hash = " << Brief(hash);
+    os << "\n - hash: " << Brief(hash);
   }
   if (obj->GetEmbedderFieldCount() > 0) {
     os << "\n - embedder fields: " << obj->GetEmbedderFieldCount();
@@ -516,7 +534,7 @@ static void JSObjectPrintHeader(std::ostream& os, JSObject* obj,
 
 static void JSObjectPrintBody(std::ostream& os, JSObject* obj,  // NOLINT
                               bool print_elements = true) {
-  os << "\n - properties = ";
+  os << "\n - properties: ";
   Object* properties_or_hash = obj->raw_properties_or_hash();
   if (!properties_or_hash->IsSmi()) {
     os << Brief(properties_or_hash);
@@ -545,27 +563,26 @@ void JSObject::JSObjectPrint(std::ostream& os) {  // NOLINT
 
 void JSArray::JSArrayPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSArray");
-  os << "\n - length = " << Brief(this->length());
+  os << "\n - length: " << Brief(this->length());
   JSObjectPrintBody(os, this);
 }
 
 void JSPromise::JSPromisePrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSPromise");
-  os << "\n - status = " << JSPromise::Status(status());
-  os << "\n - result = " << Brief(result());
-  os << "\n - deferred_promise: " << Brief(deferred_promise());
-  os << "\n - deferred_on_resolve: " << Brief(deferred_on_resolve());
-  os << "\n - deferred_on_reject: " << Brief(deferred_on_reject());
-  os << "\n - fulfill_reactions = " << Brief(fulfill_reactions());
-  os << "\n - reject_reactions = " << Brief(reject_reactions());
-  os << "\n - has_handler = " << has_handler();
+  os << "\n - status: " << JSPromise::Status(status());
+  if (status() == Promise::kPending) {
+    os << "\n - reactions: " << Brief(reactions());
+  } else {
+    os << "\n - result: " << Brief(result());
+  }
+  os << "\n - has_handler: " << has_handler();
   os << "\n ";
 }
 
 void JSRegExp::JSRegExpPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSRegExp");
-  os << "\n - data = " << Brief(data());
-  os << "\n - source = " << Brief(source());
+  os << "\n - data: " << Brief(data());
+  os << "\n - source: " << Brief(source());
   JSObjectPrintBody(os, this);
 }
 
@@ -585,7 +602,12 @@ void Symbol::SymbolPrint(std::ostream& os) {  // NOLINT
 void Map::MapPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "Map");
   os << "\n - type: " << instance_type();
-  os << "\n - instance size: " << instance_size();
+  os << "\n - instance size: ";
+  if (instance_size() == kVariableSizeSentinel) {
+    os << "variable";
+  } else {
+    os << instance_size();
+  }
   if (IsJSObjectMap()) {
     os << "\n - inobject properties: " << GetInObjectProperties();
   }
@@ -620,6 +642,7 @@ void Map::MapPrint(std::ostream& os) {  // NOLINT
   } else {
     os << "\n - back pointer: " << Brief(GetBackPointer());
   }
+  os << "\n - prototype_validity cell: " << Brief(prototype_validity_cell());
   os << "\n - instance descriptors " << (owns_descriptors() ? "(own) " : "")
      << "#" << NumberOfOwnDescriptors() << ": "
      << Brief(instance_descriptors());
@@ -651,18 +674,27 @@ void AliasedArgumentsEntry::AliasedArgumentsEntryPrint(
   os << "\n - aliased_context_slot: " << aliased_context_slot();
 }
 
+namespace {
+void PrintFixedArrayWithHeader(std::ostream& os, FixedArray* array,
+                               const char* type) {
+  array->PrintHeader(os, type);
+  os << "\n - length: " << array->length();
+  PrintFixedArrayElements(os, array);
+  os << "\n";
+}
+}  // namespace
 
 void FixedArray::FixedArrayPrint(std::ostream& os) {  // NOLINT
-  HeapObject::PrintHeader(os, IsHashTable() ? "HashTable" : "FixedArray");
-  os << "\n - map = " << Brief(map());
-  os << "\n - length: " << length();
-  PrintFixedArrayElements(os, this);
-  os << "\n";
+  PrintFixedArrayWithHeader(os, this,
+                            IsHashTable() ? "HashTable" : "FixedArray");
+}
+
+void BoilerplateDescription::BoilerplateDescriptionPrint(std::ostream& os) {
+  PrintFixedArrayWithHeader(os, this, "BoilerplateDescription");
 }
 
 void PropertyArray::PropertyArrayPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "PropertyArray");
-  os << "\n - map = " << Brief(map());
   os << "\n - length: " << length();
   os << "\n - hash: " << Hash();
   PrintFixedArrayElements(os, this);
@@ -671,7 +703,6 @@ void PropertyArray::PropertyArrayPrint(std::ostream& os) {  // NOLINT
 
 void FixedDoubleArray::FixedDoubleArrayPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "FixedDoubleArray");
-  os << "\n - map = " << Brief(map());
   os << "\n - length: " << length();
   DoPrintElements<FixedDoubleArray>(os, this);
   os << "\n";
@@ -689,20 +720,31 @@ void TransitionArray::TransitionArrayPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-template void FeedbackVectorSpecBase<StaticFeedbackVectorSpec>::Print();
-template void FeedbackVectorSpecBase<FeedbackVectorSpec>::Print();
+void FeedbackCell::FeedbackCellPrint(std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "FeedbackCell");
+  if (map() == GetHeap()->no_closures_cell_map()) {
+    os << "\n - no closures";
+  } else if (map() == GetHeap()->one_closure_cell_map()) {
+    os << "\n - one closure";
+  } else if (map() == GetHeap()->many_closures_cell_map()) {
+    os << "\n - many closures";
+  } else {
+    os << "\n - Invalid FeedbackCell map";
+  }
+  os << " - value: " << Brief(value());
+  os << "\n";
+}
 
-template <typename Derived>
-void FeedbackVectorSpecBase<Derived>::Print() {
+void FeedbackVectorSpec::Print() {
   OFStream os(stdout);
+
   FeedbackVectorSpecPrint(os);
+
   os << std::flush;
 }
 
-template <typename Derived>
-void FeedbackVectorSpecBase<Derived>::FeedbackVectorSpecPrint(
-    std::ostream& os) {  // NOLINT
-  int slot_count = This()->slots();
+void FeedbackVectorSpec::FeedbackVectorSpecPrint(std::ostream& os) {  // NOLINT
+  int slot_count = slots();
   os << " - slot_count: " << slot_count;
   if (slot_count == 0) {
     os << " (empty)\n";
@@ -710,7 +752,7 @@ void FeedbackVectorSpecBase<Derived>::FeedbackVectorSpecPrint(
   }
 
   for (int slot = 0; slot < slot_count;) {
-    FeedbackSlotKind kind = This()->GetKind(FeedbackSlot(slot));
+    FeedbackSlotKind kind = GetKind(FeedbackSlot(slot));
     int entry_size = FeedbackMetadata::GetSlotSize(kind);
     DCHECK_LT(0, entry_size);
     os << "\n Slot #" << slot << " " << kind;
@@ -725,13 +767,8 @@ void FeedbackMetadata::Print() {
   os << std::flush;
 }
 
-void FeedbackMetadata::FeedbackMetadataPrint(std::ostream& os) {  // NOLINT
+void FeedbackMetadata::FeedbackMetadataPrint(std::ostream& os) {
   HeapObject::PrintHeader(os, "FeedbackMetadata");
-  os << "\n - length: " << length();
-  if (length() == 0) {
-    os << " (empty)\n";
-    return;
-  }
   os << "\n - slot_count: " << slot_count();
 
   FeedbackMetadataIterator iter(this);
@@ -773,7 +810,7 @@ void FeedbackVector::FeedbackVectorPrint(std::ostream& os) {  // NOLINT
     FeedbackSlotKind kind = iter.kind();
 
     os << "\n - slot " << slot << " " << kind << " ";
-    FeedbackSlotPrint(os, slot, kind);
+    FeedbackSlotPrint(os, slot);
 
     int entry_size = iter.entry_size();
     if (entry_size > 0) os << " {";
@@ -788,71 +825,63 @@ void FeedbackVector::FeedbackVectorPrint(std::ostream& os) {  // NOLINT
 
 void FeedbackVector::FeedbackSlotPrint(std::ostream& os,
                                        FeedbackSlot slot) {  // NOLINT
-  FeedbackSlotPrint(os, slot, GetKind(slot));
+  FeedbackNexus nexus(this, slot);
+  nexus.Print(os);
 }
 
-void FeedbackVector::FeedbackSlotPrint(std::ostream& os, FeedbackSlot slot,
-                                       FeedbackSlotKind kind) {  // NOLINT
-  switch (kind) {
-    case FeedbackSlotKind::kLoadProperty: {
-      LoadICNexus nexus(this, slot);
-      os << Code::ICState2String(nexus.StateFromFeedback());
-      break;
-    }
+namespace {
+
+const char* ICState2String(InlineCacheState state) {
+  switch (state) {
+    case UNINITIALIZED:
+      return "UNINITIALIZED";
+    case PREMONOMORPHIC:
+      return "PREMONOMORPHIC";
+    case MONOMORPHIC:
+      return "MONOMORPHIC";
+    case RECOMPUTE_HANDLER:
+      return "RECOMPUTE_HANDLER";
+    case POLYMORPHIC:
+      return "POLYMORPHIC";
+    case MEGAMORPHIC:
+      return "MEGAMORPHIC";
+    case GENERIC:
+      return "GENERIC";
+  }
+  UNREACHABLE();
+}
+}  // anonymous namespace
+
+void FeedbackNexus::Print(std::ostream& os) {  // NOLINT
+  switch (kind()) {
+    case FeedbackSlotKind::kCall:
+    case FeedbackSlotKind::kLoadProperty:
+    case FeedbackSlotKind::kLoadKeyed:
     case FeedbackSlotKind::kLoadGlobalInsideTypeof:
-    case FeedbackSlotKind::kLoadGlobalNotInsideTypeof: {
-      LoadGlobalICNexus nexus(this, slot);
-      os << Code::ICState2String(nexus.StateFromFeedback());
-      break;
-    }
-    case FeedbackSlotKind::kLoadKeyed: {
-      KeyedLoadICNexus nexus(this, slot);
-      os << Code::ICState2String(nexus.StateFromFeedback());
-      break;
-    }
-    case FeedbackSlotKind::kCall: {
-      CallICNexus nexus(this, slot);
-      os << Code::ICState2String(nexus.StateFromFeedback());
-      break;
-    }
+    case FeedbackSlotKind::kLoadGlobalNotInsideTypeof:
     case FeedbackSlotKind::kStoreNamedSloppy:
     case FeedbackSlotKind::kStoreNamedStrict:
     case FeedbackSlotKind::kStoreOwnNamed:
     case FeedbackSlotKind::kStoreGlobalSloppy:
-    case FeedbackSlotKind::kStoreGlobalStrict: {
-      StoreICNexus nexus(this, slot);
-      os << Code::ICState2String(nexus.StateFromFeedback());
-      break;
-    }
+    case FeedbackSlotKind::kStoreGlobalStrict:
     case FeedbackSlotKind::kStoreKeyedSloppy:
-    case FeedbackSlotKind::kStoreKeyedStrict: {
-      KeyedStoreICNexus nexus(this, slot);
-      os << Code::ICState2String(nexus.StateFromFeedback());
+    case FeedbackSlotKind::kInstanceOf:
+    case FeedbackSlotKind::kStoreDataPropertyInLiteral:
+    case FeedbackSlotKind::kStoreKeyedStrict:
+    case FeedbackSlotKind::kStoreInArrayLiteral: {
+      os << ICState2String(StateFromFeedback());
       break;
     }
     case FeedbackSlotKind::kBinaryOp: {
-      BinaryOpICNexus nexus(this, slot);
-      os << "BinaryOp:" << nexus.GetBinaryOperationFeedback();
+      os << "BinaryOp:" << GetBinaryOperationFeedback();
       break;
     }
     case FeedbackSlotKind::kCompareOp: {
-      CompareICNexus nexus(this, slot);
-      os << "CompareOp:" << nexus.GetCompareOperationFeedback();
+      os << "CompareOp:" << GetCompareOperationFeedback();
       break;
     }
     case FeedbackSlotKind::kForIn: {
-      ForInICNexus nexus(this, slot);
-      os << "ForIn:" << nexus.GetForInFeedback();
-      break;
-    }
-    case FeedbackSlotKind::kInstanceOf: {
-      InstanceOfICNexus nexus(this, slot);
-      os << Code::ICState2String(nexus.StateFromFeedback());
-      break;
-    }
-    case FeedbackSlotKind::kStoreDataPropertyInLiteral: {
-      StoreDataPropertyInLiteralICNexus nexus(this, slot);
-      os << Code::ICState2String(nexus.StateFromFeedback());
+      os << "ForIn:" << GetForInFeedback();
       break;
     }
     case FeedbackSlotKind::kCreateClosure:
@@ -868,7 +897,7 @@ void FeedbackVector::FeedbackSlotPrint(std::ostream& os, FeedbackSlot slot,
 
 void JSValue::JSValuePrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSValue");
-  os << "\n - value = " << Brief(value());
+  os << "\n - value: " << Brief(value());
   JSObjectPrintBody(os, this);
 }
 
@@ -933,7 +962,7 @@ static const char* const weekdays[] = {
 
 void JSDate::JSDatePrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSDate");
-  os << "\n - value = " << Brief(value());
+  os << "\n - value: " << Brief(value());
   if (!year()->IsSmi()) {
     os << "\n - time = NaN\n";
   } else {
@@ -955,10 +984,9 @@ void JSDate::JSDatePrint(std::ostream& os) {  // NOLINT
 
 void JSProxy::JSProxyPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "JSProxy");
-  os << "\n - map = " << reinterpret_cast<void*>(map());
-  os << "\n - target = ";
+  os << "\n - target: ";
   target()->ShortPrint(os);
-  os << "\n - handler = ";
+  os << "\n - handler: ";
   handler()->ShortPrint(os);
   os << "\n";
 }
@@ -966,21 +994,21 @@ void JSProxy::JSProxyPrint(std::ostream& os) {  // NOLINT
 
 void JSSet::JSSetPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSSet");
-  os << " - table = " << Brief(table());
+  os << " - table: " << Brief(table());
   JSObjectPrintBody(os, this);
 }
 
 
 void JSMap::JSMapPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSMap");
-  os << " - table = " << Brief(table());
+  os << " - table: " << Brief(table());
   JSObjectPrintBody(os, this);
 }
 
 void JSCollectionIterator::JSCollectionIteratorPrint(
     std::ostream& os) {  // NOLINT
-  os << "\n - table = " << Brief(table());
-  os << "\n - index = " << Brief(index());
+  os << "\n - table: " << Brief(table());
+  os << "\n - index: " << Brief(index());
   os << "\n";
 }
 
@@ -999,27 +1027,27 @@ void JSMapIterator::JSMapIteratorPrint(std::ostream& os) {  // NOLINT
 
 void JSWeakMap::JSWeakMapPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSWeakMap");
-  os << "\n - table = " << Brief(table());
+  os << "\n - table: " << Brief(table());
   JSObjectPrintBody(os, this);
 }
 
 
 void JSWeakSet::JSWeakSetPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSWeakSet");
-  os << "\n - table = " << Brief(table());
+  os << "\n - table: " << Brief(table());
   JSObjectPrintBody(os, this);
 }
 
 
 void JSArrayBuffer::JSArrayBufferPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSArrayBuffer");
-  os << "\n - backing_store = " << backing_store();
-  os << "\n - byte_length = " << Brief(byte_length());
+  os << "\n - backing_store: " << backing_store();
+  os << "\n - byte_length: " << Brief(byte_length());
   if (is_external()) os << "\n - external";
   if (is_neuterable()) os << "\n - neuterable";
   if (was_neutered()) os << "\n - neutered";
   if (is_shared()) os << "\n - shared";
-  if (has_guard_region()) os << "\n - has_guard_region";
+  if (is_wasm_memory()) os << "\n - is_wasm_memory";
   if (is_growable()) os << "\n - growable";
   JSObjectPrintBody(os, this, !was_neutered());
 }
@@ -1027,39 +1055,27 @@ void JSArrayBuffer::JSArrayBufferPrint(std::ostream& os) {  // NOLINT
 
 void JSTypedArray::JSTypedArrayPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSTypedArray");
-  os << "\n - buffer = " << Brief(buffer());
-  os << "\n - byte_offset = " << Brief(byte_offset());
-  os << "\n - byte_length = " << Brief(byte_length());
-  os << "\n - length = " << Brief(length());
+  os << "\n - buffer: " << Brief(buffer());
+  os << "\n - byte_offset: " << Brief(byte_offset());
+  os << "\n - byte_length: " << Brief(byte_length());
+  os << "\n - length: " << Brief(length());
   if (WasNeutered()) os << "\n - neutered";
   JSObjectPrintBody(os, this, !WasNeutered());
 }
 
 void JSArrayIterator::JSArrayIteratorPrint(std::ostream& os) {  // NOLING
   JSObjectPrintHeader(os, this, "JSArrayIterator");
-
-  InstanceType instance_type = map()->instance_type();
-  std::string type;
-  if (instance_type <= LAST_ARRAY_KEY_ITERATOR_TYPE) {
-    type = "keys";
-  } else if (instance_type <= LAST_ARRAY_KEY_VALUE_ITERATOR_TYPE) {
-    type = "entries";
-  } else {
-    type = "values";
-  }
-
-  os << "\n - type = " << type;
-  os << "\n - object = " << Brief(object());
-  os << "\n - index = " << Brief(index());
-
+  os << "\n - iterated_object: " << Brief(iterated_object());
+  os << "\n - next_index: " << Brief(next_index());
+  os << "\n - kind: " << kind();
   JSObjectPrintBody(os, this);
 }
 
 void JSDataView::JSDataViewPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSDataView");
   os << "\n - buffer =" << Brief(buffer());
-  os << "\n - byte_offset = " << Brief(byte_offset());
-  os << "\n - byte_length = " << Brief(byte_length());
+  os << "\n - byte_offset: " << Brief(byte_offset());
+  os << "\n - byte_length: " << Brief(byte_length());
   if (WasNeutered()) os << "\n - neutered";
   JSObjectPrintBody(os, this, !WasNeutered());
 }
@@ -1067,45 +1083,15 @@ void JSDataView::JSDataViewPrint(std::ostream& os) {  // NOLINT
 
 void JSBoundFunction::JSBoundFunctionPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSBoundFunction");
-  os << "\n - bound_target_function = " << Brief(bound_target_function());
-  os << "\n - bound_this = " << Brief(bound_this());
-  os << "\n - bound_arguments = " << Brief(bound_arguments());
+  os << "\n - bound_target_function: " << Brief(bound_target_function());
+  os << "\n - bound_this: " << Brief(bound_this());
+  os << "\n - bound_arguments: " << Brief(bound_arguments());
   JSObjectPrintBody(os, this);
 }
 
-
-namespace {
-
-std::ostream& operator<<(std::ostream& os, FunctionKind kind) {
-  os << "[";
-  if (kind == FunctionKind::kNormalFunction) {
-    os << " NormalFunction";
-  } else {
-#define PRINT_FLAG(name)                                                  \
-  if (static_cast<int>(kind) & static_cast<int>(FunctionKind::k##name)) { \
-    os << " " << #name;                                                   \
-  }
-
-    PRINT_FLAG(ArrowFunction)
-    PRINT_FLAG(GeneratorFunction)
-    PRINT_FLAG(ConciseMethod)
-    PRINT_FLAG(DefaultConstructor)
-    PRINT_FLAG(DerivedConstructor)
-    PRINT_FLAG(BaseConstructor)
-    PRINT_FLAG(GetterFunction)
-    PRINT_FLAG(SetterFunction)
-    PRINT_FLAG(AsyncFunction)
-    PRINT_FLAG(Module)
-#undef PRINT_FLAG
-  }
-  return os << " ]";
-}
-
-}  // namespace
-
 void JSFunction::JSFunctionPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "Function");
-  os << "\n - function prototype = ";
+  os << "\n - function prototype: ";
   if (has_prototype_slot()) {
     if (has_prototype()) {
       os << Brief(prototype());
@@ -1113,22 +1099,37 @@ void JSFunction::JSFunctionPrint(std::ostream& os) {  // NOLINT
         os << " (non-instance prototype)";
       }
     }
-    os << "\n - initial_map = ";
+    os << "\n - initial_map: ";
     if (has_initial_map()) os << Brief(initial_map());
   } else {
     os << "<no-prototype-slot>";
   }
-  os << "\n - shared_info = " << Brief(shared());
-  os << "\n - name = " << Brief(shared()->name());
-  os << "\n - formal_parameter_count = "
+  os << "\n - shared_info: " << Brief(shared());
+  os << "\n - name: " << Brief(shared()->Name());
+
+  // Print Builtin name for builtin functions
+  int builtin_index = code()->builtin_index();
+  if (builtin_index != -1 && !IsInterpreted()) {
+    if (builtin_index == Builtins::kDeserializeLazy) {
+      if (shared()->HasBuiltinId()) {
+        builtin_index = shared()->builtin_id();
+        os << "\n - builtin: " << GetIsolate()->builtins()->name(builtin_index)
+           << "(lazy)";
+      }
+    } else {
+      os << "\n - builtin: " << GetIsolate()->builtins()->name(builtin_index);
+    }
+  }
+
+  os << "\n - formal_parameter_count: "
      << shared()->internal_formal_parameter_count();
-  os << "\n - kind = " << shared()->kind();
-  os << "\n - context = " << Brief(context());
-  os << "\n - code = " << Brief(code());
+  os << "\n - kind: " << shared()->kind();
+  os << "\n - context: " << Brief(context());
+  os << "\n - code: " << Brief(code());
   if (IsInterpreted()) {
     os << "\n - interpreted";
     if (shared()->HasBytecodeArray()) {
-      os << "\n - bytecode = " << shared()->bytecode_array();
+      os << "\n - bytecode: " << shared()->bytecode_array();
     }
   }
   if (WasmExportedFunction::IsWasmExportedFunction(this)) {
@@ -1142,7 +1143,7 @@ void JSFunction::JSFunctionPrint(std::ostream& os) {  // NOLINT
   shared()->PrintSourceCode(os);
   JSObjectPrintBody(os, this);
   os << "\n - feedback vector: ";
-  if (feedback_vector_cell()->value()->IsFeedbackVector()) {
+  if (has_feedback_vector()) {
     feedback_vector()->FeedbackVectorPrint(os);
   } else {
     os << "not available\n";
@@ -1151,10 +1152,10 @@ void JSFunction::JSFunctionPrint(std::ostream& os) {  // NOLINT
 
 void SharedFunctionInfo::PrintSourceCode(std::ostream& os) {
   if (HasSourceCode()) {
-    os << "\n - source code = ";
+    os << "\n - source code: ";
     String* source = String::cast(Script::cast(script())->source());
-    int start = start_position();
-    int length = end_position() - start;
+    int start = StartPosition();
+    int length = EndPosition() - start;
     std::unique_ptr<char[]> source_string = source->ToCString(
         DISALLOW_NULLS, FAST_STRING_TRAVERSAL, start, length, nullptr);
     os << source_string.get();
@@ -1163,29 +1164,25 @@ void SharedFunctionInfo::PrintSourceCode(std::ostream& os) {
 
 void SharedFunctionInfo::SharedFunctionInfoPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "SharedFunctionInfo");
-  os << "\n - name = ";
-  if (has_shared_name()) {
-    os << Brief(raw_name());
+  os << "\n - name: ";
+  if (HasSharedName()) {
+    os << Brief(Name());
   } else {
     os << "<no-shared-name>";
   }
-  os << "\n - kind = " << kind();
+  if (HasInferredName()) {
+    os << "\n - inferred name: " << Brief(inferred_name());
+  }
+  os << "\n - kind: " << kind();
   if (needs_home_object()) {
     os << "\n - needs_home_object";
   }
-  os << "\n - function_map_index = " << function_map_index();
-  os << "\n - formal_parameter_count = " << internal_formal_parameter_count();
-  os << "\n - expected_nof_properties = " << expected_nof_properties();
-  os << "\n - language_mode = " << language_mode();
-  os << "\n - instance class name = ";
-  instance_class_name()->Print(os);
-  os << " - code = " << Brief(code());
-  if (HasBytecodeArray()) {
-    os << "\n - bytecode_array = " << bytecode_array();
-  }
-  if (HasAsmWasmData()) {
-    os << "\n - asm_wasm_data = " << Brief(asm_wasm_data());
-  }
+  os << "\n - function_map_index: " << function_map_index();
+  os << "\n - formal_parameter_count: " << internal_formal_parameter_count();
+  os << "\n - expected_nof_properties: " << expected_nof_properties();
+  os << "\n - language_mode: " << language_mode();
+  os << "\n - data: " << Brief(function_data());
+  os << "\n - code (from data): " << Brief(GetCode());
   PrintSourceCode(os);
   // Script files are often large, hard to read.
   // os << "\n - script =";
@@ -1197,22 +1194,18 @@ void SharedFunctionInfo::SharedFunctionInfoPrint(std::ostream& os) {  // NOLINT
   } else if (is_declaration()) {
     os << "\n - declaration";
   }
-  os << "\n - function token position = " << function_token_position();
-  os << "\n - start position = " << start_position();
-  os << "\n - end position = " << end_position();
+  os << "\n - function token position: " << function_token_position();
+  os << "\n - start position: " << StartPosition();
+  os << "\n - end position: " << EndPosition();
   if (HasDebugInfo()) {
-    os << "\n - debug info = " << Brief(debug_info());
+    os << "\n - debug info: " << Brief(debug_info());
   } else {
     os << "\n - no debug info";
   }
-  os << "\n - length = " << length();
-  os << "\n - feedback_metadata = ";
+  os << "\n - scope info: " << Brief(scope_info());
+  os << "\n - length: " << length();
+  os << "\n - feedback_metadata: ";
   feedback_metadata()->FeedbackMetadataPrint(os);
-  if (HasPreParsedScopeData()) {
-    os << "\n - preparsed scope data = " << preparsed_scope_data();
-  } else {
-    os << "\n - no preparsed scope data";
-  }
   os << "\n";
 }
 
@@ -1220,7 +1213,7 @@ void SharedFunctionInfo::SharedFunctionInfoPrint(std::ostream& os) {  // NOLINT
 void JSGlobalProxy::JSGlobalProxyPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSGlobalProxy");
   if (!GetIsolate()->bootstrapper()->IsActive()) {
-    os << "\n - native context = " << Brief(native_context());
+    os << "\n - native context: " << Brief(native_context());
   }
   JSObjectPrintBody(os, this);
 }
@@ -1229,9 +1222,9 @@ void JSGlobalProxy::JSGlobalProxyPrint(std::ostream& os) {  // NOLINT
 void JSGlobalObject::JSGlobalObjectPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, this, "JSGlobalObject");
   if (!GetIsolate()->bootstrapper()->IsActive()) {
-    os << "\n - native context = " << Brief(native_context());
+    os << "\n - native context: " << Brief(native_context());
   }
-  os << "\n - global proxy = " << Brief(global_proxy());
+  os << "\n - global proxy: " << Brief(global_proxy());
   JSObjectPrintBody(os, this);
 }
 
@@ -1338,34 +1331,64 @@ void AccessorInfo::AccessorInfoPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-void PromiseCapability::PromiseCapabilityPrint(std::ostream& os) {  // NOLINT
-  HeapObject::PrintHeader(os, "PromiseCapability");
-  os << "\n - promise: " << Brief(promise());
-  os << "\n - resolve: " << Brief(resolve());
-  os << "\n - reject: " << Brief(reject());
+void CallbackTask::CallbackTaskPrint(std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "CallbackTask");
+  os << "\n - callback: " << Brief(callback());
+  os << "\n - data: " << Brief(data());
   os << "\n";
 }
 
-void PromiseResolveThenableJobInfo::PromiseResolveThenableJobInfoPrint(
+void CallableTask::CallableTaskPrint(std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "CallableTask");
+  os << "\n - context: " << Brief(context());
+  os << "\n - callable: " << Brief(callable());
+  os << "\n";
+}
+
+void PromiseFulfillReactionJobTask::PromiseFulfillReactionJobTaskPrint(
     std::ostream& os) {  // NOLINT
-  HeapObject::PrintHeader(os, "PromiseResolveThenableJobInfo");
-  os << "\n - thenable: " << Brief(thenable());
+  HeapObject::PrintHeader(os, "PromiseFulfillReactionJobTask");
+  os << "\n - argument: " << Brief(argument());
+  os << "\n - context: " << Brief(context());
+  os << "\n - handler: " << Brief(handler());
+  os << "\n - payload: " << Brief(payload());
+  os << "\n";
+}
+
+void PromiseRejectReactionJobTask::PromiseRejectReactionJobTaskPrint(
+    std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "PromiseRejectReactionJobTask");
+  os << "\n - argument: " << Brief(argument());
+  os << "\n - context: " << Brief(context());
+  os << "\n - handler: " << Brief(handler());
+  os << "\n - payload: " << Brief(payload());
+  os << "\n";
+}
+
+void PromiseResolveThenableJobTask::PromiseResolveThenableJobTaskPrint(
+    std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "PromiseResolveThenableJobTask");
+  os << "\n - context: " << Brief(context());
+  os << "\n - promise_to_resolve: " << Brief(promise_to_resolve());
   os << "\n - then: " << Brief(then());
+  os << "\n - thenable: " << Brief(thenable());
+  os << "\n";
+}
+
+void PromiseCapability::PromiseCapabilityPrint(std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "PromiseCapability");
+  os << "\n - promise: " << Brief(promise());
   os << "\n - resolve: " << Brief(resolve());
   os << "\n - reject: " << Brief(reject());
-  os << "\n - context: " << Brief(context());
   os << "\n";
 }
 
-void PromiseReactionJobInfo::PromiseReactionJobInfoPrint(
-    std::ostream& os) {  // NOLINT
-  HeapObject::PrintHeader(os, "PromiseReactionJobInfo");
-  os << "\n - value: " << Brief(value());
-  os << "\n - tasks: " << Brief(tasks());
-  os << "\n - deferred_promise: " << Brief(deferred_promise());
-  os << "\n - deferred_on_resolve: " << Brief(deferred_on_resolve());
-  os << "\n - deferred_on_reject: " << Brief(deferred_on_reject());
-  os << "\n - reaction context: " << Brief(context());
+void PromiseReaction::PromiseReactionPrint(std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "PromiseReaction");
+  os << "\n - next: " << Brief(next());
+  os << "\n - reject_handler: " << Brief(reject_handler());
+  os << "\n - fulfill_handler: " << Brief(fulfill_handler());
+  os << "\n - payload: " << Brief(payload());
   os << "\n";
 }
 
@@ -1426,7 +1449,6 @@ void PrototypeInfo::PrototypeInfoPrint(std::ostream& os) {  // NOLINT
   os << "\n - weak cell: " << Brief(weak_cell());
   os << "\n - prototype users: " << Brief(prototype_users());
   os << "\n - registry slot: " << registry_slot();
-  os << "\n - validity cell: " << Brief(validity_cell());
   os << "\n - object create map: " << Brief(object_create_map());
   os << "\n - should_be_fast_map: " << should_be_fast_map();
   os << "\n";
@@ -1447,6 +1469,25 @@ void Tuple3::Tuple3Print(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
+void WasmCompiledModule::WasmCompiledModulePrint(std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "WasmCompiledModule");
+  os << "\n - shared: " << Brief(shared());
+  os << "\n";
+}
+
+void WasmDebugInfo::WasmDebugInfoPrint(std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "WasmDebugInfo");
+  os << "\n - wasm_instance: " << Brief(wasm_instance());
+  os << "\n";
+}
+
+void WasmSharedModuleData::WasmSharedModuleDataPrint(
+    std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "WasmSharedModuleData");
+  os << "\n - module: " << module();
+  os << "\n";
+}
+
 void LoadHandler::LoadHandlerPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "LoadHandler");
   // TODO(ishell): implement printing based on handler kind
@@ -1616,6 +1657,62 @@ void Script::ScriptPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
+namespace {
+void PrintScopeInfoList(ScopeInfo* scope_info, std::ostream& os,
+                        const char* list_name, int nof_internal_slots,
+                        int start, int length) {
+  if (length <= 0) return;
+  int end = start + length;
+  os << "\n - " << list_name;
+  if (nof_internal_slots > 0) {
+    os << " " << start << "-" << end << " [internal slots]";
+  }
+  os << " {\n";
+  for (int i = nof_internal_slots; start < end; ++i, ++start) {
+    os << "    - " << i << ": ";
+    String::cast(scope_info->get(start))->ShortPrint(os);
+    os << "\n";
+  }
+  os << "  }";
+}
+}  // namespace
+
+void ScopeInfo::ScopeInfoPrint(std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "ScopeInfo");
+  if (length() == 0) {
+    os << "\n - length = 0\n";
+    return;
+  }
+
+  os << "\n - scope type: " << scope_type();
+  os << "\n - language mode: " << language_mode();
+  os << "\n - local count: " << LocalCount();
+  os << "\n - stack slot count: " << StackSlotCount();
+  if (HasReceiver()) os << "\n - has receiver";
+  if (HasNewTarget()) os << "\n - needs new target";
+  if (HasOuterScopeInfo()) {
+    os << "\n - outer scope info: " << Brief(OuterScopeInfo());
+  }
+  if (HasFunctionName()) {
+    os << "\n - function name: ";
+    FunctionName()->ShortPrint(os);
+  }
+  if (HasPositionInfo()) {
+    os << "\n - start position: " << StartPosition();
+    os << "\n - end position: " << EndPosition();
+  }
+  os << "\n - length: " << length();
+  if (length() > 0) {
+    PrintScopeInfoList(this, os, "parameters", 0, ParameterNamesIndex(),
+                       ParameterCount());
+    PrintScopeInfoList(this, os, "stack slots", 0, StackLocalNamesIndex(),
+                       StackLocalCount());
+    PrintScopeInfoList(this, os, "context slots", Context::MIN_CONTEXT_SLOTS,
+                       ContextLocalNamesIndex(), ContextLocalCount());
+    // TODO(neis): Print module stuff if present.
+  }
+  os << "\n";
+}
 
 void DebugInfo::DebugInfoPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "DebugInfo");
diff --git a/deps/v8/src/objects.cc b/deps/v8/src/objects.cc
index af2e3eccb37..f426e276e7e 100644
--- a/deps/v8/src/objects.cc
+++ b/deps/v8/src/objects.cc
@@ -60,18 +60,21 @@
 #include "src/objects/frame-array-inl.h"
 #include "src/objects/hash-table.h"
 #include "src/objects/map.h"
+#include "src/objects/microtask-inl.h"
+#include "src/objects/promise-inl.h"
 #include "src/parsing/preparsed-scope-data.h"
 #include "src/property-descriptor.h"
 #include "src/prototype.h"
 #include "src/regexp/jsregexp.h"
 #include "src/safepoint-table.h"
 #include "src/snapshot/code-serializer.h"
+#include "src/snapshot/snapshot.h"
 #include "src/source-position-table.h"
 #include "src/string-builder.h"
 #include "src/string-search.h"
 #include "src/string-stream.h"
-#include "src/trap-handler/trap-handler.h"
 #include "src/unicode-cache-inl.h"
+#include "src/unicode-decoder.h"
 #include "src/utils-inl.h"
 #include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-objects.h"
@@ -698,39 +701,6 @@ Handle<String> Object::TypeOf(Isolate* isolate, Handle<Object> object) {
 }
 
 
-// static
-MaybeHandle<Object> Object::Multiply(Isolate* isolate, Handle<Object> lhs,
-                                     Handle<Object> rhs) {
-  if (!lhs->IsNumber() || !rhs->IsNumber()) {
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, lhs, Object::ToNumber(lhs), Object);
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, rhs, Object::ToNumber(rhs), Object);
-  }
-  return isolate->factory()->NewNumber(lhs->Number() * rhs->Number());
-}
-
-
-// static
-MaybeHandle<Object> Object::Divide(Isolate* isolate, Handle<Object> lhs,
-                                   Handle<Object> rhs) {
-  if (!lhs->IsNumber() || !rhs->IsNumber()) {
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, lhs, Object::ToNumber(lhs), Object);
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, rhs, Object::ToNumber(rhs), Object);
-  }
-  return isolate->factory()->NewNumber(lhs->Number() / rhs->Number());
-}
-
-
-// static
-MaybeHandle<Object> Object::Modulus(Isolate* isolate, Handle<Object> lhs,
-                                    Handle<Object> rhs) {
-  if (!lhs->IsNumber() || !rhs->IsNumber()) {
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, lhs, Object::ToNumber(lhs), Object);
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, rhs, Object::ToNumber(rhs), Object);
-  }
-  return isolate->factory()->NewNumber(Modulo(lhs->Number(), rhs->Number()));
-}
-
-
 // static
 MaybeHandle<Object> Object::Add(Isolate* isolate, Handle<Object> lhs,
                                 Handle<Object> rhs) {
@@ -756,89 +726,6 @@ MaybeHandle<Object> Object::Add(Isolate* isolate, Handle<Object> lhs,
 }
 
 
-// static
-MaybeHandle<Object> Object::Subtract(Isolate* isolate, Handle<Object> lhs,
-                                     Handle<Object> rhs) {
-  if (!lhs->IsNumber() || !rhs->IsNumber()) {
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, lhs, Object::ToNumber(lhs), Object);
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, rhs, Object::ToNumber(rhs), Object);
-  }
-  return isolate->factory()->NewNumber(lhs->Number() - rhs->Number());
-}
-
-
-// static
-MaybeHandle<Object> Object::ShiftLeft(Isolate* isolate, Handle<Object> lhs,
-                                      Handle<Object> rhs) {
-  if (!lhs->IsNumber() || !rhs->IsNumber()) {
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, lhs, Object::ToNumber(lhs), Object);
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, rhs, Object::ToNumber(rhs), Object);
-  }
-  return isolate->factory()->NewNumberFromInt(NumberToInt32(*lhs)
-                                              << (NumberToUint32(*rhs) & 0x1F));
-}
-
-
-// static
-MaybeHandle<Object> Object::ShiftRight(Isolate* isolate, Handle<Object> lhs,
-                                       Handle<Object> rhs) {
-  if (!lhs->IsNumber() || !rhs->IsNumber()) {
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, lhs, Object::ToNumber(lhs), Object);
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, rhs, Object::ToNumber(rhs), Object);
-  }
-  return isolate->factory()->NewNumberFromInt(NumberToInt32(*lhs) >>
-                                              (NumberToUint32(*rhs) & 0x1F));
-}
-
-
-// static
-MaybeHandle<Object> Object::ShiftRightLogical(Isolate* isolate,
-                                              Handle<Object> lhs,
-                                              Handle<Object> rhs) {
-  if (!lhs->IsNumber() || !rhs->IsNumber()) {
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, lhs, Object::ToNumber(lhs), Object);
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, rhs, Object::ToNumber(rhs), Object);
-  }
-  return isolate->factory()->NewNumberFromUint(NumberToUint32(*lhs) >>
-                                               (NumberToUint32(*rhs) & 0x1F));
-}
-
-
-// static
-MaybeHandle<Object> Object::BitwiseAnd(Isolate* isolate, Handle<Object> lhs,
-                                       Handle<Object> rhs) {
-  if (!lhs->IsNumber() || !rhs->IsNumber()) {
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, lhs, Object::ToNumber(lhs), Object);
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, rhs, Object::ToNumber(rhs), Object);
-  }
-  return isolate->factory()->NewNumberFromInt(NumberToInt32(*lhs) &
-                                              NumberToInt32(*rhs));
-}
-
-
-// static
-MaybeHandle<Object> Object::BitwiseOr(Isolate* isolate, Handle<Object> lhs,
-                                      Handle<Object> rhs) {
-  if (!lhs->IsNumber() || !rhs->IsNumber()) {
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, lhs, Object::ToNumber(lhs), Object);
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, rhs, Object::ToNumber(rhs), Object);
-  }
-  return isolate->factory()->NewNumberFromInt(NumberToInt32(*lhs) |
-                                              NumberToInt32(*rhs));
-}
-
-
-// static
-MaybeHandle<Object> Object::BitwiseXor(Isolate* isolate, Handle<Object> lhs,
-                                       Handle<Object> rhs) {
-  if (!lhs->IsNumber() || !rhs->IsNumber()) {
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, lhs, Object::ToNumber(lhs), Object);
-    ASSIGN_RETURN_ON_EXCEPTION(isolate, rhs, Object::ToNumber(rhs), Object);
-  }
-  return isolate->factory()->NewNumberFromInt(NumberToInt32(*lhs) ^
-                                              NumberToInt32(*rhs));
-}
-
 // static
 MaybeHandle<Object> Object::OrdinaryHasInstance(Isolate* isolate,
                                                 Handle<Object> callable,
@@ -1272,7 +1159,7 @@ Handle<Object> JSReceiver::GetDataProperty(LookupIterator* it) {
         // Support calling this method without an active context, but refuse
         // access to access-checked objects in that case.
         if (it->isolate()->context() != nullptr && it->HasAccess()) continue;
-      // Fall through.
+        V8_FALLTHROUGH;
       case LookupIterator::JSPROXY:
         it->NotFound();
         return it->isolate()->factory()->undefined_value();
@@ -1313,36 +1200,32 @@ Handle<SharedFunctionInfo> FunctionTemplateInfo::GetOrCreateSharedFunctionInfo(
   if (current_info->IsSharedFunctionInfo()) {
     return handle(SharedFunctionInfo::cast(current_info), isolate);
   }
-  Handle<Object> class_name(info->class_name(), isolate);
   Handle<Name> name;
   Handle<String> name_string;
   if (maybe_name.ToHandle(&name) && name->IsString()) {
     name_string = Handle<String>::cast(name);
+  } else if (info->class_name()->IsString()) {
+    name_string = handle(String::cast(info->class_name()));
   } else {
-    name_string = class_name->IsString() ? Handle<String>::cast(class_name)
-                                         : isolate->factory()->empty_string();
+    name_string = isolate->factory()->empty_string();
   }
-  Handle<Code> code = BUILTIN_CODE(isolate, HandleApiCall);
   bool is_constructor;
   FunctionKind function_kind;
-  if (!info->remove_prototype()) {
-    is_constructor = true;
-    function_kind = kNormalFunction;
-  } else {
+  if (info->remove_prototype()) {
     is_constructor = false;
     function_kind = kConciseMethod;
+  } else {
+    is_constructor = true;
+    function_kind = kNormalFunction;
   }
-  Handle<SharedFunctionInfo> result = isolate->factory()->NewSharedFunctionInfo(
-      name_string, code, is_constructor, function_kind);
+  Handle<SharedFunctionInfo> result =
+      isolate->factory()->NewSharedFunctionInfoForApiFunction(name_string, info,
+                                                              function_kind);
   if (is_constructor) {
     result->SetConstructStub(*BUILTIN_CODE(isolate, JSConstructStubApi));
   }
 
   result->set_length(info->length());
-  if (class_name->IsString()) {
-    result->set_instance_class_name(String::cast(*class_name));
-  }
-  result->set_api_func_data(*info);
   result->DontAdaptArguments();
   DCHECK(result->IsApiFunction());
 
@@ -1458,8 +1341,7 @@ int JSObject::GetHeaderSize(InstanceType type,
     case JS_BOUND_FUNCTION_TYPE:
       return JSBoundFunction::kSize;
     case JS_FUNCTION_TYPE:
-      return function_has_prototype_slot ? JSFunction::kSizeWithPrototype
-                                         : JSFunction::kSizeWithoutPrototype;
+      return JSFunction::GetHeaderSize(function_has_prototype_slot);
     case JS_VALUE_TYPE:
       return JSValue::kSize;
     case JS_DATE_TYPE:
@@ -1468,6 +1350,8 @@ int JSObject::GetHeaderSize(InstanceType type,
       return JSArray::kSize;
     case JS_ARRAY_BUFFER_TYPE:
       return JSArrayBuffer::kSize;
+    case JS_ARRAY_ITERATOR_TYPE:
+      return JSArrayIterator::kSize;
     case JS_TYPED_ARRAY_TYPE:
       return JSTypedArray::kSize;
     case JS_DATA_VIEW_TYPE:
@@ -1512,10 +1396,6 @@ int JSObject::GetHeaderSize(InstanceType type,
     case WASM_TABLE_TYPE:
       return WasmTableObject::kSize;
     default:
-      if (type >= FIRST_ARRAY_ITERATOR_TYPE &&
-          type <= LAST_ARRAY_ITERATOR_TYPE) {
-        return JSArrayIterator::kSize;
-      }
       UNREACHABLE();
   }
 }
@@ -1621,10 +1501,9 @@ MaybeHandle<Object> Object::GetPropertyWithAccessor(LookupIterator* it) {
     if (result.is_null()) return isolate->factory()->undefined_value();
     Handle<Object> reboxed_result = handle(*result, isolate);
     if (info->replace_on_access() && receiver->IsJSReceiver()) {
-      args.CallNamedSetterCallback(
-          reinterpret_cast<GenericNamedPropertySetterCallback>(
-              &Accessors::ReconfigureToDataProperty),
-          name, result);
+      args.CallAccessorSetter(
+          isolate->factory()->reconfigure_to_data_property_accessor(), name,
+          result);
       RETURN_EXCEPTION_IF_SCHEDULED_EXCEPTION(isolate, Object);
     }
     return reboxed_result;
@@ -1710,15 +1589,7 @@ Maybe<bool> Object::SetPropertyWithAccessor(LookupIterator* it,
       return Nothing<bool>();
     }
 
-    // The actual type of call_fun is either v8::AccessorNameSetterCallback or
-    // i::Accesors::AccessorNameBooleanSetterCallback, depending on whether the
-    // AccessorInfo was created by the API or internally (see accessors.cc).
-    // Here we handle both cases using GenericNamedPropertySetterCallback and
-    // its Call method.
-    GenericNamedPropertySetterCallback call_fun =
-        v8::ToCData<GenericNamedPropertySetterCallback>(info->setter());
-
-    if (call_fun == nullptr) {
+    if (!info->has_setter()) {
       // TODO(verwaest): We should not get here anymore once all AccessorInfos
       // are marked as special_data_property. They cannot both be writable and
       // not have a setter.
@@ -1731,9 +1602,15 @@ Maybe<bool> Object::SetPropertyWithAccessor(LookupIterator* it,
           Nothing<bool>());
     }
 
+    // The actual type of setter callback is either
+    // v8::AccessorNameSetterCallback or
+    // i::Accesors::AccessorNameBooleanSetterCallback, depending on whether the
+    // AccessorInfo was created by the API or internally (see accessors.cc).
+    // Here we handle both cases using GenericNamedPropertySetterCallback and
+    // its Call method.
     PropertyCallbackArguments args(isolate, info->data(), *receiver, *holder,
                                    should_throw);
-    Handle<Object> result = args.CallNamedSetterCallback(call_fun, name, value);
+    Handle<Object> result = args.CallAccessorSetter(info, name, value);
     // In the case of AccessorNameSetterCallback, we know that the result value
     // cannot have been set, so the result of Call will be null.  In the case of
     // AccessorNameBooleanSetterCallback, the result will either be null
@@ -2253,7 +2130,14 @@ MUST_USE_RESULT Maybe<bool> FastAssign(
     }
 
     if (use_set) {
-      LookupIterator it(target, next_key, target);
+      Handle<Map> target_map(target->map(), isolate);
+      MaybeHandle<Map> maybe_transition_map =
+          TransitionsAccessor(target_map)
+              .FindTransitionToDataProperty(next_key);
+
+      LookupIterator it = LookupIterator::ForTransitionHandler(
+          isolate, target, next_key, prop_value, maybe_transition_map);
+
       Maybe<bool> result =
           Object::SetProperty(&it, prop_value, LanguageMode::kStrict,
                               Object::CERTAINLY_NOT_STORE_FROM_KEYED);
@@ -2482,7 +2366,7 @@ MaybeHandle<Object> Object::ArraySpeciesConstructor(
   Handle<Object> default_species = isolate->array_function();
   if (original_array->IsJSArray() &&
       Handle<JSArray>::cast(original_array)->HasArrayPrototype(isolate) &&
-      isolate->IsArraySpeciesLookupChainIntact()) {
+      isolate->IsSpeciesLookupChainIntact()) {
     return default_species;
   }
   Handle<Object> constructor = isolate->factory()->undefined_value();
@@ -2583,12 +2467,6 @@ bool Object::IterationHasObservableEffects() {
   // affect iteration.
   if (!isolate->IsArrayIteratorLookupChainIntact()) return true;
 
-  // Check that the map of the initial array iterator hasn't changed.
-  Map* iterator_map = isolate->initial_array_iterator_prototype()->map();
-  if (!isolate->is_initial_array_iterator_prototype_map(iterator_map)) {
-    return true;
-  }
-
   // For FastPacked kinds, iteration will have the same effect as simply
   // accessing each property in order.
   ElementsKind array_kind = array->GetElementsKind();
@@ -2979,7 +2857,7 @@ void JSObject::JSObjectShortPrint(StringStream* accumulator) {
             accumulator->Add("!!!INVALID SHARED ON CONSTRUCTOR!!!");
           } else {
             String* constructor_name =
-                JSFunction::cast(constructor)->shared()->name();
+                JSFunction::cast(constructor)->shared()->Name();
             if (constructor_name->length() > 0) {
               accumulator->Add(global_object ? "<GlobalObject " : "<");
               accumulator->Put(constructor_name);
@@ -3103,17 +2981,34 @@ VisitorId Map::GetVisitorId(Map* map) {
     case FREE_SPACE_TYPE:
       return kVisitFreeSpace;
 
-    case HASH_TABLE_TYPE:
     case FIXED_ARRAY_TYPE:
+    case BOILERPLATE_DESCRIPTION_TYPE:
+    case HASH_TABLE_TYPE:
     case DESCRIPTOR_ARRAY_TYPE:
+    case SCOPE_INFO_TYPE:
+    case BLOCK_CONTEXT_TYPE:
+    case CATCH_CONTEXT_TYPE:
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+    case EVAL_CONTEXT_TYPE:
+    case FUNCTION_CONTEXT_TYPE:
+    case MODULE_CONTEXT_TYPE:
+    case NATIVE_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TYPE:
+    case WITH_CONTEXT_TYPE:
       return kVisitFixedArray;
 
+    case WEAK_FIXED_ARRAY_TYPE:
+      return kVisitWeakFixedArray;
+
     case FIXED_DOUBLE_ARRAY_TYPE:
       return kVisitFixedDoubleArray;
 
     case PROPERTY_ARRAY_TYPE:
       return kVisitPropertyArray;
 
+    case FEEDBACK_CELL_TYPE:
+      return kVisitFeedbackCell;
+
     case FEEDBACK_VECTOR_TYPE:
       return kVisitFeedbackVector;
 
@@ -3142,8 +3037,6 @@ VisitorId Map::GetVisitorId(Map* map) {
     case JS_WEAK_SET_TYPE:
       return kVisitJSWeakCollection;
 
-    case JS_REGEXP_TYPE:
-      return kVisitJSRegExp;
 
     case SHARED_FUNCTION_INFO_TYPE:
       return kVisitSharedFunctionInfo;
@@ -3166,6 +3059,9 @@ VisitorId Map::GetVisitorId(Map* map) {
     case CODE_DATA_CONTAINER_TYPE:
       return kVisitCodeDataContainer;
 
+    case WASM_INSTANCE_TYPE:
+      return kVisitWasmInstanceObject;
+
     case JS_OBJECT_TYPE:
     case JS_ERROR_TYPE:
     case JS_ARGUMENTS_TYPE:
@@ -3176,6 +3072,7 @@ VisitorId Map::GetVisitorId(Map* map) {
     case JS_MODULE_NAMESPACE_TYPE:
     case JS_VALUE_TYPE:
     case JS_DATE_TYPE:
+    case JS_ARRAY_ITERATOR_TYPE:
     case JS_ARRAY_TYPE:
     case JS_GLOBAL_PROXY_TYPE:
     case JS_GLOBAL_OBJECT_TYPE:
@@ -3190,13 +3087,8 @@ VisitorId Map::GetVisitorId(Map* map) {
     case JS_MAP_KEY_VALUE_ITERATOR_TYPE:
     case JS_MAP_VALUE_ITERATOR_TYPE:
     case JS_STRING_ITERATOR_TYPE:
-
-#define ARRAY_ITERATOR_CASE(type) case type:
-      ARRAY_ITERATOR_TYPE_LIST(ARRAY_ITERATOR_CASE)
-#undef ARRAY_ITERATOR_CASE
-
     case JS_PROMISE_TYPE:
-    case WASM_INSTANCE_TYPE:
+    case JS_REGEXP_TYPE:
     case WASM_MEMORY_TYPE:
     case WASM_MODULE_TYPE:
     case WASM_TABLE_TYPE:
@@ -3213,6 +3105,7 @@ VisitorId Map::GetVisitorId(Map* map) {
     case FOREIGN_TYPE:
     case HEAP_NUMBER_TYPE:
     case MUTABLE_HEAP_NUMBER_TYPE:
+    case FEEDBACK_METADATA_TYPE:
       return kVisitDataObject;
 
     case BIGINT_TYPE:
@@ -3226,6 +3119,8 @@ VisitorId Map::GetVisitorId(Map* map) {
     case FIXED_INT32_ARRAY_TYPE:
     case FIXED_FLOAT32_ARRAY_TYPE:
     case FIXED_UINT8_CLAMPED_ARRAY_TYPE:
+    case FIXED_BIGUINT64_ARRAY_TYPE:
+    case FIXED_BIGINT64_ARRAY_TYPE:
       return kVisitFixedTypedArrayBase;
 
     case FIXED_FLOAT64_ARRAY_TYPE:
@@ -3370,9 +3265,43 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
     return;
   }
   switch (map()->instance_type()) {
-    case MAP_TYPE:
-      os << "<Map(" << ElementsKindToString(Map::cast(this)->elements_kind())
-         << ")>";
+    case MAP_TYPE: {
+      os << "<Map";
+      Map* mapInstance = Map::cast(this);
+      if (mapInstance->IsJSObjectMap()) {
+        os << "(" << ElementsKindToString(mapInstance->elements_kind()) << ")";
+      } else if (mapInstance->instance_size() != kVariableSizeSentinel) {
+        os << "[" << mapInstance->instance_size() << "]";
+      }
+      os << ">";
+    } break;
+    case BLOCK_CONTEXT_TYPE:
+      os << "<BlockContext[" << FixedArray::cast(this)->length() << "]>";
+      break;
+    case CATCH_CONTEXT_TYPE:
+      os << "<CatchContext[" << FixedArray::cast(this)->length() << "]>";
+      break;
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+      os << "<DebugEvaluateContext[" << FixedArray::cast(this)->length()
+         << "]>";
+      break;
+    case EVAL_CONTEXT_TYPE:
+      os << "<EvalContext[" << FixedArray::cast(this)->length() << "]>";
+      break;
+    case FUNCTION_CONTEXT_TYPE:
+      os << "<FunctionContext[" << FixedArray::cast(this)->length() << "]>";
+      break;
+    case MODULE_CONTEXT_TYPE:
+      os << "<ModuleContext[" << FixedArray::cast(this)->length() << "]>";
+      break;
+    case NATIVE_CONTEXT_TYPE:
+      os << "<NativeContext[" << FixedArray::cast(this)->length() << "]>";
+      break;
+    case SCRIPT_CONTEXT_TYPE:
+      os << "<ScriptContext[" << FixedArray::cast(this)->length() << "]>";
+      break;
+    case WITH_CONTEXT_TYPE:
+      os << "<WithContext[" << FixedArray::cast(this)->length() << "]>";
       break;
     case HASH_TABLE_TYPE:
       os << "<HashTable[" << FixedArray::cast(this)->length() << "]>";
@@ -3380,6 +3309,10 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
     case FIXED_ARRAY_TYPE:
       os << "<FixedArray[" << FixedArray::cast(this)->length() << "]>";
       break;
+    case BOILERPLATE_DESCRIPTION_TYPE:
+      os << "<BoilerplateDescription[" << FixedArray::cast(this)->length()
+         << "]>";
+      break;
     case FIXED_DOUBLE_ARRAY_TYPE:
       os << "<FixedDoubleArray[" << FixedDoubleArray::cast(this)->length()
          << "]>";
@@ -3401,6 +3334,20 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
     case PROPERTY_ARRAY_TYPE:
       os << "<PropertyArray[" << PropertyArray::cast(this)->length() << "]>";
       break;
+    case FEEDBACK_CELL_TYPE: {
+      os << "<FeedbackCell[";
+      if (map() == heap->no_closures_cell_map()) {
+        os << "no closures";
+      } else if (map() == heap->one_closure_cell_map()) {
+        os << "one closure";
+      } else if (map() == heap->many_closures_cell_map()) {
+        os << "many closures";
+      } else {
+        os << "!!!INVALID MAP!!!";
+      }
+      os << "]>";
+      break;
+    }
     case FEEDBACK_VECTOR_TYPE:
       os << "<FeedbackVector[" << FeedbackVector::cast(this)->length() << "]>";
       break;
@@ -3437,11 +3384,20 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
     break;
       STRUCT_LIST(MAKE_STRUCT_CASE)
 #undef MAKE_STRUCT_CASE
+    case SCOPE_INFO_TYPE: {
+      ScopeInfo* scope = ScopeInfo::cast(this);
+      os << "<ScopeInfo";
+      if (scope->length()) os << " " << scope->scope_type() << " ";
+      os << "[" << scope->length() << "]>";
+      break;
+    }
     case CODE_TYPE: {
       Code* code = Code::cast(this);
       os << "<Code " << Code::Kind2String(code->kind());
       if (code->is_stub()) {
         os << " " << CodeStub::MajorName(CodeStub::GetMajorKey(code));
+      } else if (code->is_builtin()) {
+        os << " " << Builtins::name(code->builtin_index());
       }
       os << ">";
       break;
@@ -3540,32 +3496,33 @@ void Tuple3::BriefPrintDetails(std::ostream& os) {
      << Brief(value3());
 }
 
+void CallableTask::BriefPrintDetails(std::ostream& os) {
+  os << " callable=" << Brief(callable());
+}
+
 void HeapObject::Iterate(ObjectVisitor* v) { IterateFast<ObjectVisitor>(v); }
 
 
 void HeapObject::IterateBody(ObjectVisitor* v) {
   Map* m = map();
-  IterateBodyFast<ObjectVisitor>(m->instance_type(), SizeFromMap(m), v);
+  IterateBodyFast<ObjectVisitor>(m, SizeFromMap(m), v);
 }
 
-
-void HeapObject::IterateBody(InstanceType type, int object_size,
-                             ObjectVisitor* v) {
-  IterateBodyFast<ObjectVisitor>(type, object_size, v);
+void HeapObject::IterateBody(Map* map, int object_size, ObjectVisitor* v) {
+  IterateBodyFast<ObjectVisitor>(map, object_size, v);
 }
 
 
 struct CallIsValidSlot {
   template <typename BodyDescriptor>
-  static bool apply(HeapObject* obj, int offset, int) {
-    return BodyDescriptor::IsValidSlot(obj, offset);
+  static bool apply(Map* map, HeapObject* obj, int offset, int) {
+    return BodyDescriptor::IsValidSlot(map, obj, offset);
   }
 };
 
-
-bool HeapObject::IsValidSlot(int offset) {
+bool HeapObject::IsValidSlot(Map* map, int offset) {
   DCHECK_NE(0, offset);
-  return BodyDescriptorApply<CallIsValidSlot, bool>(map()->instance_type(),
+  return BodyDescriptorApply<CallIsValidSlot, bool>(map->instance_type(), map,
                                                     this, offset, 0);
 }
 
@@ -3589,20 +3546,63 @@ void HeapNumber::HeapNumberPrint(std::ostream& os) {  // NOLINT
   (*reinterpret_cast<const byte*>(FIELD_ADDR_CONST(p, offset)))
 
 String* JSReceiver::class_name() {
-  if (IsFunction()) {
-    return GetHeap()->Function_string();
+  if (IsFunction()) return GetHeap()->Function_string();
+  if (IsJSArgumentsObject()) return GetHeap()->Arguments_string();
+  if (IsJSArray()) return GetHeap()->Array_string();
+  if (IsJSArrayBuffer()) {
+    if (JSArrayBuffer::cast(this)->is_shared()) {
+      return GetHeap()->SharedArrayBuffer_string();
+    }
+    return GetHeap()->ArrayBuffer_string();
+  }
+  if (IsJSArrayIterator()) return GetHeap()->ArrayIterator_string();
+  if (IsJSDate()) return GetHeap()->Date_string();
+  if (IsJSError()) return GetHeap()->Error_string();
+  if (IsJSGeneratorObject()) return GetHeap()->Generator_string();
+  if (IsJSMap()) return GetHeap()->Map_string();
+  if (IsJSMapIterator()) return GetHeap()->MapIterator_string();
+  if (IsJSProxy()) {
+    return map()->is_callable() ? GetHeap()->Function_string()
+                                : GetHeap()->Object_string();
+  }
+  if (IsJSRegExp()) return GetHeap()->RegExp_string();
+  if (IsJSSet()) return GetHeap()->Set_string();
+  if (IsJSSetIterator()) return GetHeap()->SetIterator_string();
+  if (IsJSTypedArray()) {
+#define SWITCH_KIND(Type, type, TYPE, ctype, size) \
+  if (map()->elements_kind() == TYPE##_ELEMENTS) { \
+    return GetHeap()->Type##Array_string();        \
+  }
+    TYPED_ARRAYS(SWITCH_KIND)
+#undef SWITCH_KIND
+  }
+  if (IsJSValue()) {
+    Object* value = JSValue::cast(this)->value();
+    if (value->IsBoolean()) return GetHeap()->Boolean_string();
+    if (value->IsString()) return GetHeap()->String_string();
+    if (value->IsNumber()) return GetHeap()->Number_string();
+    if (value->IsBigInt()) return GetHeap()->BigInt_string();
+    if (value->IsSymbol()) return GetHeap()->Symbol_string();
+    if (value->IsScript()) return GetHeap()->Script_string();
+    UNREACHABLE();
   }
+  if (IsJSWeakMap()) return GetHeap()->WeakMap_string();
+  if (IsJSWeakSet()) return GetHeap()->WeakSet_string();
+  if (IsJSGlobalProxy()) return GetHeap()->global_string();
+
   Object* maybe_constructor = map()->GetConstructor();
   if (maybe_constructor->IsJSFunction()) {
     JSFunction* constructor = JSFunction::cast(maybe_constructor);
-    return String::cast(constructor->shared()->instance_class_name());
-  } else if (maybe_constructor->IsFunctionTemplateInfo()) {
+    if (constructor->shared()->IsApiFunction()) {
+      maybe_constructor = constructor->shared()->get_api_func_data();
+    }
+  }
+
+  if (maybe_constructor->IsFunctionTemplateInfo()) {
     FunctionTemplateInfo* info = FunctionTemplateInfo::cast(maybe_constructor);
-    return info->class_name()->IsString() ? String::cast(info->class_name())
-                                          : GetHeap()->empty_string();
+    if (info->class_name()->IsString()) return String::cast(info->class_name());
   }
 
-  // If the constructor is not present, return "Object".
   return GetHeap()->Object_string();
 }
 
@@ -3612,7 +3612,8 @@ bool HeapObject::CanBeRehashed() const {
     case HASH_TABLE_TYPE:
       // TODO(yangguo): actually support rehashing OrderedHash{Map,Set}.
       return IsNameDictionary() || IsGlobalDictionary() ||
-             IsNumberDictionary() || IsStringTable() || IsWeakHashTable();
+             IsNumberDictionary() || IsSimpleNumberDictionary() ||
+             IsStringTable();
     case DESCRIPTOR_ARRAY_TYPE:
       return true;
     case TRANSITION_ARRAY_TYPE:
@@ -3634,12 +3635,12 @@ void HeapObject::RehashBasedOnMap() {
         NameDictionary::cast(this)->Rehash();
       } else if (IsNumberDictionary()) {
         NumberDictionary::cast(this)->Rehash();
+      } else if (IsSimpleNumberDictionary()) {
+        SimpleNumberDictionary::cast(this)->Rehash();
       } else if (IsGlobalDictionary()) {
         GlobalDictionary::cast(this)->Rehash();
       } else if (IsStringTable()) {
         StringTable::cast(this)->Rehash();
-      } else if (IsWeakHashTable()) {
-        WeakHashTable::cast(this)->Rehash();
       } else {
         UNREACHABLE();
       }
@@ -4885,7 +4886,7 @@ Maybe<bool> Object::SetPropertyInternal(LookupIterator* it,
         if (it->HolderIsReceiverOrHiddenPrototype()) {
           return SetDataProperty(it, value);
         }
-      // Fall through.
+        V8_FALLTHROUGH;
       case LookupIterator::TRANSITION:
         *found = false;
         return Nothing<bool>();
@@ -4970,7 +4971,7 @@ Maybe<bool> Object::SetSuperProperty(LookupIterator* it, Handle<Object> value,
           return JSObject::SetPropertyWithAccessor(&own_lookup, value,
                                                    should_throw);
         }
-      // Fall through.
+        V8_FALLTHROUGH;
       case LookupIterator::INTEGER_INDEXED_EXOTIC:
         return RedefineIncompatibleProperty(isolate, it->GetName(), value,
                                             should_throw);
@@ -5054,17 +5055,32 @@ Maybe<bool> Object::RedefineIncompatibleProperty(Isolate* isolate,
 
 
 Maybe<bool> Object::SetDataProperty(LookupIterator* it, Handle<Object> value) {
-  // Proxies are handled elsewhere. Other non-JSObjects cannot have own
-  // properties.
-  Handle<JSObject> receiver = Handle<JSObject>::cast(it->GetReceiver());
+  DCHECK_IMPLIES(it->GetReceiver()->IsJSProxy(),
+                 it->GetName()->IsPrivateField());
+  DCHECK_IMPLIES(!it->IsElement() && it->GetName()->IsPrivateField(),
+                 it->state() == LookupIterator::DATA);
+  Handle<JSReceiver> receiver = Handle<JSReceiver>::cast(it->GetReceiver());
 
   // Store on the holder which may be hidden behind the receiver.
   DCHECK(it->HolderIsReceiverOrHiddenPrototype());
 
   Handle<Object> to_assign = value;
   // Convert the incoming value to a number for storing into typed arrays.
-  if (it->IsElement() && receiver->HasFixedTypedArrayElements()) {
-    if (!value->IsNumber() && !value->IsUndefined(it->isolate())) {
+  if (it->IsElement() && receiver->IsJSObject() &&
+      JSObject::cast(*receiver)->HasFixedTypedArrayElements()) {
+    ElementsKind elements_kind = JSObject::cast(*receiver)->GetElementsKind();
+    if (elements_kind == BIGINT64_ELEMENTS ||
+        elements_kind == BIGUINT64_ELEMENTS) {
+      ASSIGN_RETURN_ON_EXCEPTION_VALUE(it->isolate(), to_assign,
+                                       BigInt::FromObject(it->isolate(), value),
+                                       Nothing<bool>());
+      // We have to recheck the length. However, it can only change if the
+      // underlying buffer was neutered, so just check that.
+      if (Handle<JSArrayBufferView>::cast(receiver)->WasNeutered()) {
+        return Just(true);
+        // TODO(neis): According to the spec, this should throw a TypeError.
+      }
+    } else if (!value->IsNumber() && !value->IsUndefined(it->isolate())) {
       ASSIGN_RETURN_ON_EXCEPTION_VALUE(
           it->isolate(), to_assign, Object::ToNumber(value), Nothing<bool>());
       // We have to recheck the length. However, it can only change if the
@@ -5085,7 +5101,7 @@ Maybe<bool> Object::SetDataProperty(LookupIterator* it, Handle<Object> value) {
 
 #if VERIFY_HEAP
   if (FLAG_verify_heap) {
-    receiver->JSObjectVerify();
+    receiver->HeapObjectVerify();
   }
 #endif
   return Just(true);
@@ -5096,18 +5112,25 @@ Maybe<bool> Object::AddDataProperty(LookupIterator* it, Handle<Object> value,
                                     PropertyAttributes attributes,
                                     ShouldThrow should_throw,
                                     StoreFromKeyed store_mode) {
-  if (!it->GetReceiver()->IsJSObject()) {
-    if (it->GetReceiver()->IsJSProxy() && it->GetName()->IsPrivate()) {
-      RETURN_FAILURE(it->isolate(), should_throw,
-                     NewTypeError(MessageTemplate::kProxyPrivate));
-    }
+  if (!it->GetReceiver()->IsJSReceiver()) {
     return CannotCreateProperty(it->isolate(), it->GetReceiver(), it->GetName(),
                                 value, should_throw);
   }
 
+  // Private symbols should be installed on JSProxy using
+  // JSProxy::SetPrivateSymbol.
+  if (it->GetReceiver()->IsJSProxy() && it->GetName()->IsPrivate() &&
+      !it->GetName()->IsPrivateField()) {
+    RETURN_FAILURE(it->isolate(), should_throw,
+                   NewTypeError(MessageTemplate::kProxyPrivate));
+  }
+
   DCHECK_NE(LookupIterator::INTEGER_INDEXED_EXOTIC, it->state());
 
-  Handle<JSObject> receiver = it->GetStoreTarget();
+  Handle<JSReceiver> receiver = it->GetStoreTarget<JSReceiver>();
+  DCHECK_IMPLIES(receiver->IsJSProxy(), it->GetName()->IsPrivateField());
+  DCHECK_IMPLIES(receiver->IsJSProxy(),
+                 it->state() == LookupIterator::NOT_FOUND);
 
   // If the receiver is a JSGlobalProxy, store on the prototype (JSGlobalObject)
   // instead. If the prototype is Null, the proxy is detached.
@@ -5141,9 +5164,10 @@ Maybe<bool> Object::AddDataProperty(LookupIterator* it, Handle<Object> value,
       }
     }
 
-    Maybe<bool> result = JSObject::AddDataElement(receiver, it->index(), value,
-                                                  attributes, should_throw);
-    JSObject::ValidateElements(*receiver);
+    Handle<JSObject> receiver_obj = Handle<JSObject>::cast(receiver);
+    Maybe<bool> result = JSObject::AddDataElement(
+        receiver_obj, it->index(), value, attributes, should_throw);
+    JSObject::ValidateElements(*receiver_obj);
     return result;
   } else {
     it->UpdateProtector();
@@ -5159,7 +5183,7 @@ Maybe<bool> Object::AddDataProperty(LookupIterator* it, Handle<Object> value,
 
 #if VERIFY_HEAP
     if (FLAG_verify_heap) {
-      receiver->JSObjectVerify();
+      receiver->HeapObjectVerify();
     }
 #endif
   }
@@ -5825,7 +5849,7 @@ Handle<Object> JSFunction::GetName(Isolate* isolate,
   if (function->shared()->name_should_print_as_anonymous()) {
     return isolate->factory()->anonymous_string();
   }
-  return handle(function->shared()->name(), isolate);
+  return handle(function->shared()->Name(), isolate);
 }
 
 // static
@@ -6166,6 +6190,11 @@ Maybe<PropertyAttributes> JSReceiver::GetPropertyAttributes(
       case LookupIterator::INTEGER_INDEXED_EXOTIC:
         return Just(ABSENT);
       case LookupIterator::ACCESSOR:
+        if (it->GetHolder<Object>()->IsJSModuleNamespace()) {
+          return JSModuleNamespace::GetPropertyAttributes(it);
+        } else {
+          return Just(it->property_attributes());
+        }
       case LookupIterator::DATA:
         return Just(it->property_attributes());
     }
@@ -6633,6 +6662,11 @@ void JSReceiver::DeleteNormalizedProperty(Handle<JSReceiver> object,
     dictionary = NameDictionary::DeleteEntry(dictionary, entry);
     object->SetProperties(*dictionary);
   }
+  if (object->map()->is_prototype_map()) {
+    // Invalidate prototype validity cell as this may invalidate transitioning
+    // store IC handlers.
+    JSObject::InvalidatePrototypeChains(object->map());
+  }
 }
 
 
@@ -7260,7 +7294,6 @@ Maybe<bool> JSObject::CreateDataProperty(LookupIterator* it,
   return Just(true);
 }
 
-
 // TODO(jkummerow): Consider unification with FastAsArrayLength() in
 // accessors.cc.
 bool PropertyKeyToArrayLength(Handle<Object> value, uint32_t* length) {
@@ -7472,8 +7505,9 @@ Maybe<bool> JSProxy::DefineOwnProperty(Isolate* isolate, Handle<JSProxy> proxy,
                                        ShouldThrow should_throw) {
   STACK_CHECK(isolate, Nothing<bool>());
   if (key->IsSymbol() && Handle<Symbol>::cast(key)->IsPrivate()) {
-    return SetPrivateProperty(isolate, proxy, Handle<Symbol>::cast(key), desc,
-                              should_throw);
+    DCHECK(!Handle<Symbol>::cast(key)->IsPrivateField());
+    return JSProxy::SetPrivateSymbol(isolate, proxy, Handle<Symbol>::cast(key),
+                                     desc, should_throw);
   }
   Handle<String> trap_name = isolate->factory()->defineProperty_string();
   // 1. Assert: IsPropertyKey(P) is true.
@@ -7576,12 +7610,12 @@ Maybe<bool> JSProxy::DefineOwnProperty(Isolate* isolate, Handle<JSProxy> proxy,
   return Just(true);
 }
 
-
 // static
-Maybe<bool> JSProxy::SetPrivateProperty(Isolate* isolate, Handle<JSProxy> proxy,
-                                        Handle<Symbol> private_name,
-                                        PropertyDescriptor* desc,
-                                        ShouldThrow should_throw) {
+Maybe<bool> JSProxy::SetPrivateSymbol(Isolate* isolate, Handle<JSProxy> proxy,
+                                      Handle<Symbol> private_name,
+                                      PropertyDescriptor* desc,
+                                      ShouldThrow should_throw) {
+  DCHECK(!private_name->IsPrivateField());
   // Despite the generic name, this can only add private data properties.
   if (!PropertyDescriptor::IsDataDescriptor(desc) ||
       desc->ToAttributes() != DONT_ENUM) {
@@ -7611,7 +7645,6 @@ Maybe<bool> JSProxy::SetPrivateProperty(Isolate* isolate, Handle<JSProxy> proxy,
   return Just(true);
 }
 
-
 // static
 Maybe<bool> JSReceiver::GetOwnPropertyDescriptor(Isolate* isolate,
                                                  Handle<JSReceiver> object,
@@ -8001,8 +8034,9 @@ Maybe<bool> JSReceiver::SetIntegrityLevel(Handle<JSReceiver> receiver,
   if (receiver->IsJSObject()) {
     Handle<JSObject> object = Handle<JSObject>::cast(receiver);
 
-    if (!object->HasSloppyArgumentsElements()) {  // Fast path.
-      // prevent memory leaks by not adding unnecessary transitions
+    if (!object->HasSloppyArgumentsElements() &&
+        !object->IsJSModuleNamespace()) {  // Fast path.
+      // Prevent memory leaks by not adding unnecessary transitions.
       Maybe<bool> test = JSObject::TestIntegrityLevel(object, level);
       MAYBE_RETURN(test, Nothing<bool>());
       if (test.FromJust()) return test;
@@ -8396,8 +8430,10 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
     Handle<JSObject> object, ShouldThrow should_throw) {
   STATIC_ASSERT(attrs == NONE || attrs == SEALED || attrs == FROZEN);
 
-  // Sealing/freezing sloppy arguments should be handled elsewhere.
+  // Sealing/freezing sloppy arguments or namespace objects should be handled
+  // elsewhere.
   DCHECK(!object->HasSloppyArgumentsElements());
+  DCHECK_IMPLIES(object->IsJSModuleNamespace(), attrs == NONE);
 
   Isolate* isolate = object->GetIsolate();
   if (object->IsAccessCheckNeeded() &&
@@ -8791,9 +8827,10 @@ MUST_USE_RESULT Maybe<bool> FastGetOwnValuesOrEntries(
 MaybeHandle<FixedArray> GetOwnValuesOrEntries(Isolate* isolate,
                                               Handle<JSReceiver> object,
                                               PropertyFilter filter,
+                                              bool try_fast_path,
                                               bool get_entries) {
   Handle<FixedArray> values_or_entries;
-  if (filter == ENUMERABLE_STRINGS) {
+  if (try_fast_path && filter == ENUMERABLE_STRINGS) {
     Maybe<bool> fast_values_or_entries = FastGetOwnValuesOrEntries(
         isolate, object, get_entries, &values_or_entries);
     if (fast_values_or_entries.IsNothing()) return MaybeHandle<FixedArray>();
@@ -8846,13 +8883,17 @@ MaybeHandle<FixedArray> GetOwnValuesOrEntries(Isolate* isolate,
 }
 
 MaybeHandle<FixedArray> JSReceiver::GetOwnValues(Handle<JSReceiver> object,
-                                                 PropertyFilter filter) {
-  return GetOwnValuesOrEntries(object->GetIsolate(), object, filter, false);
+                                                 PropertyFilter filter,
+                                                 bool try_fast_path) {
+  return GetOwnValuesOrEntries(object->GetIsolate(), object, filter,
+                               try_fast_path, false);
 }
 
 MaybeHandle<FixedArray> JSReceiver::GetOwnEntries(Handle<JSReceiver> object,
-                                                  PropertyFilter filter) {
-  return GetOwnValuesOrEntries(object->GetIsolate(), object, filter, true);
+                                                  PropertyFilter filter,
+                                                  bool try_fast_path) {
+  return GetOwnValuesOrEntries(object->GetIsolate(), object, filter,
+                               try_fast_path, true);
 }
 
 bool Map::DictionaryElementsInPrototypeChainOnly() {
@@ -9062,7 +9103,7 @@ Handle<Map> Map::Normalize(Handle<Map> fast_map, PropertyNormalizationMode mode,
 #ifdef ENABLE_SLOW_DCHECKS
     if (FLAG_enable_slow_asserts) {
       // The cached map should match newly created normalized map bit-by-bit,
-      // except for the code cache, which can contain some ics which can be
+      // except for the code cache, which can contain some ICs which can be
       // applied to the shared map, dependent code and weak cell cache.
       Handle<Map> fresh = Map::CopyNormalized(fast_map, mode);
 
@@ -9082,7 +9123,9 @@ Handle<Map> Map::Normalize(Handle<Map> fast_map, PropertyNormalizationMode mode,
       }
       STATIC_ASSERT(Map::kWeakCellCacheOffset ==
                     Map::kDependentCodeOffset + kPointerSize);
-      int offset = Map::kWeakCellCacheOffset + kPointerSize;
+      STATIC_ASSERT(Map::kPrototypeValidityCellOffset ==
+                    Map::kWeakCellCacheOffset + kPointerSize);
+      int offset = Map::kPrototypeValidityCellOffset + kPointerSize;
       DCHECK_EQ(0, memcmp(fresh->address() + offset,
                           new_map->address() + offset, Map::kSize - offset));
     }
@@ -10027,7 +10070,8 @@ Handle<Map> Map::CopyReplaceDescriptor(Handle<Map> map,
 }
 
 Handle<FixedArray> FixedArray::SetAndGrow(Handle<FixedArray> array, int index,
-                                          Handle<Object> value) {
+                                          Handle<Object> value,
+                                          PretenureFlag pretenure) {
   if (index < array->length()) {
     array->set(index, *value);
     return array;
@@ -10037,7 +10081,8 @@ Handle<FixedArray> FixedArray::SetAndGrow(Handle<FixedArray> array, int index,
     capacity = JSObject::NewElementsCapacity(capacity);
   } while (capacity <= index);
   Handle<FixedArray> new_array =
-      array->GetIsolate()->factory()->NewUninitializedFixedArray(capacity);
+      array->GetIsolate()->factory()->NewUninitializedFixedArray(capacity,
+                                                                 pretenure);
   array->CopyTo(0, *new_array, 0, array->length());
   new_array->FillWithHoles(array->length(), new_array->length());
   new_array->set(index, *value);
@@ -10072,28 +10117,25 @@ bool FixedArray::IsEqualTo(FixedArray* other) {
 
 
 // static
-void WeakFixedArray::Set(Handle<WeakFixedArray> array, int index,
-                         Handle<HeapObject> value) {
+void FixedArrayOfWeakCells::Set(Handle<FixedArrayOfWeakCells> array, int index,
+                                Handle<HeapObject> value) {
   DCHECK(array->IsEmptySlot(index));  // Don't overwrite anything.
   Handle<WeakCell> cell =
       value->IsMap() ? Map::WeakCellForMap(Handle<Map>::cast(value))
                      : array->GetIsolate()->factory()->NewWeakCell(value);
   Handle<FixedArray>::cast(array)->set(index + kFirstIndex, *cell);
-  if (FLAG_trace_weak_arrays) {
-    PrintF("[WeakFixedArray: storing at index %d ]\n", index);
-  }
   array->set_last_used_index(index);
 }
 
 
 // static
-Handle<WeakFixedArray> WeakFixedArray::Add(Handle<Object> maybe_array,
-                                           Handle<HeapObject> value,
-                                           int* assigned_index) {
-  Handle<WeakFixedArray> array =
-      (maybe_array.is_null() || !maybe_array->IsWeakFixedArray())
-          ? Allocate(value->GetIsolate(), 1, Handle<WeakFixedArray>::null())
-          : Handle<WeakFixedArray>::cast(maybe_array);
+Handle<FixedArrayOfWeakCells> FixedArrayOfWeakCells::Add(
+    Handle<Object> maybe_array, Handle<HeapObject> value, int* assigned_index) {
+  Handle<FixedArrayOfWeakCells> array =
+      (maybe_array.is_null() || !maybe_array->IsFixedArrayOfWeakCells())
+          ? Allocate(value->GetIsolate(), 1,
+                     Handle<FixedArrayOfWeakCells>::null())
+          : Handle<FixedArrayOfWeakCells>::cast(maybe_array);
   // Try to store the new entry if there's room. Optimize for consecutive
   // accesses.
   int first_index = array->last_used_index();
@@ -10101,13 +10143,10 @@ Handle<WeakFixedArray> WeakFixedArray::Add(Handle<Object> maybe_array,
   if (length > 0) {
     for (int i = first_index;;) {
       if (array->IsEmptySlot((i))) {
-        WeakFixedArray::Set(array, i, value);
+        FixedArrayOfWeakCells::Set(array, i, value);
         if (assigned_index != nullptr) *assigned_index = i;
         return array;
       }
-      if (FLAG_trace_weak_arrays) {
-        PrintF("[WeakFixedArray: searching for free slot]\n");
-      }
       i = (i + 1) % length;
       if (i == first_index) break;
     }
@@ -10115,19 +10154,15 @@ Handle<WeakFixedArray> WeakFixedArray::Add(Handle<Object> maybe_array,
 
   // No usable slot found, grow the array.
   int new_length = length == 0 ? 1 : length + (length >> 1) + 4;
-  Handle<WeakFixedArray> new_array =
+  Handle<FixedArrayOfWeakCells> new_array =
       Allocate(array->GetIsolate(), new_length, array);
-  if (FLAG_trace_weak_arrays) {
-    PrintF("[WeakFixedArray: growing to size %d ]\n", new_length);
-  }
-  WeakFixedArray::Set(new_array, length, value);
+  FixedArrayOfWeakCells::Set(new_array, length, value);
   if (assigned_index != nullptr) *assigned_index = length;
   return new_array;
 }
 
-
 template <class CompactionCallback>
-void WeakFixedArray::Compact() {
+void FixedArrayOfWeakCells::Compact() {
   FixedArray* array = FixedArray::cast(this);
   int new_length = kFirstIndex;
   for (int i = kFirstIndex; i < array->length(); i++) {
@@ -10143,10 +10178,9 @@ void WeakFixedArray::Compact() {
   set_last_used_index(0);
 }
 
-
-void WeakFixedArray::Iterator::Reset(Object* maybe_array) {
-  if (maybe_array->IsWeakFixedArray()) {
-    list_ = WeakFixedArray::cast(maybe_array);
+void FixedArrayOfWeakCells::Iterator::Reset(Object* maybe_array) {
+  if (maybe_array->IsFixedArrayOfWeakCells()) {
+    list_ = FixedArrayOfWeakCells::cast(maybe_array);
     index_ = 0;
 #ifdef DEBUG
     last_used_index_ = list_->last_used_index();
@@ -10166,20 +10200,20 @@ void JSObject::PrototypeRegistryCompactionCallback::Callback(Object* value,
   proto_info->set_registry_slot(new_index);
 }
 
-
-template void WeakFixedArray::Compact<WeakFixedArray::NullCallback>();
 template void
-WeakFixedArray::Compact<JSObject::PrototypeRegistryCompactionCallback>();
-
+FixedArrayOfWeakCells::Compact<FixedArrayOfWeakCells::NullCallback>();
+template void
+FixedArrayOfWeakCells::Compact<JSObject::PrototypeRegistryCompactionCallback>();
 
-bool WeakFixedArray::Remove(Handle<HeapObject> value) {
+bool FixedArrayOfWeakCells::Remove(Handle<HeapObject> value) {
   if (Length() == 0) return false;
   // Optimize for the most recently added element to be removed again.
   int first_index = last_used_index();
   for (int i = first_index;;) {
     if (Get(i) == *value) {
       Clear(i);
-      // Users of WeakFixedArray should make sure that there are no duplicates.
+      // Users of FixedArrayOfWeakCells should make sure that there are no
+      // duplicates.
       return true;
     }
     i = (i + 1) % Length();
@@ -10190,8 +10224,8 @@ bool WeakFixedArray::Remove(Handle<HeapObject> value) {
 
 
 // static
-Handle<WeakFixedArray> WeakFixedArray::Allocate(
-    Isolate* isolate, int size, Handle<WeakFixedArray> initialize_from) {
+Handle<FixedArrayOfWeakCells> FixedArrayOfWeakCells::Allocate(
+    Isolate* isolate, int size, Handle<FixedArrayOfWeakCells> initialize_from) {
   DCHECK_LE(0, size);
   Handle<FixedArray> result =
       isolate->factory()->NewUninitializedFixedArray(size + kFirstIndex);
@@ -10210,7 +10244,7 @@ Handle<WeakFixedArray> WeakFixedArray::Allocate(
     result->set(index, Smi::kZero);
     index++;
   }
-  return Handle<WeakFixedArray>::cast(result);
+  return Handle<FixedArrayOfWeakCells>::cast(result);
 }
 
 // static
@@ -10324,19 +10358,14 @@ Handle<FrameArray> FrameArray::AppendJSFrame(Handle<FrameArray> in,
 // static
 Handle<FrameArray> FrameArray::AppendWasmFrame(
     Handle<FrameArray> in, Handle<WasmInstanceObject> wasm_instance,
-    int wasm_function_index, WasmCodeWrapper code, int offset, int flags) {
+    int wasm_function_index, wasm::WasmCode* code, int offset, int flags) {
   const int frame_count = in->FrameCount();
   const int new_length = LengthFor(frame_count + 1);
   Handle<FrameArray> array = EnsureSpace(in, new_length);
   array->SetWasmInstance(frame_count, *wasm_instance);
   array->SetWasmFunctionIndex(frame_count, Smi::FromInt(wasm_function_index));
-  // code will be a null handle for interpreted wasm frames.
-  if (!code.IsCodeObject()) {
-    array->SetIsWasmInterpreterFrame(frame_count, Smi::FromInt(code.is_null()));
-  } else {
-    if (!code.is_null())
-      array->SetCode(frame_count, AbstractCode::cast(*code.GetCode()));
-  }
+  // The {code} will be {nullptr} for interpreted wasm frames.
+  array->SetIsWasmInterpreterFrame(frame_count, Smi::FromInt(code == nullptr));
   array->SetOffset(frame_count, Smi::FromInt(offset));
   array->SetFlags(frame_count, Smi::FromInt(flags));
   array->set(kFrameCountIndex, Smi::FromInt(frame_count + 1));
@@ -10493,54 +10522,6 @@ SharedFunctionInfo* DeoptimizationData::GetInlinedFunction(int index) {
   }
 }
 
-int HandlerTable::LookupRange(int pc_offset, int* data_out,
-                              CatchPrediction* prediction_out) {
-  int innermost_handler = -1;
-#ifdef DEBUG
-  // Assuming that ranges are well nested, we don't need to track the innermost
-  // offsets. This is just to verify that the table is actually well nested.
-  int innermost_start = std::numeric_limits<int>::min();
-  int innermost_end = std::numeric_limits<int>::max();
-#endif
-  for (int i = 0; i < length(); i += kRangeEntrySize) {
-    int start_offset = Smi::ToInt(get(i + kRangeStartIndex));
-    int end_offset = Smi::ToInt(get(i + kRangeEndIndex));
-    int handler_field = Smi::ToInt(get(i + kRangeHandlerIndex));
-    int handler_offset = HandlerOffsetField::decode(handler_field);
-    CatchPrediction prediction = HandlerPredictionField::decode(handler_field);
-    int handler_data = Smi::ToInt(get(i + kRangeDataIndex));
-    if (pc_offset >= start_offset && pc_offset < end_offset) {
-      DCHECK_GE(start_offset, innermost_start);
-      DCHECK_LT(end_offset, innermost_end);
-      innermost_handler = handler_offset;
-#ifdef DEBUG
-      innermost_start = start_offset;
-      innermost_end = end_offset;
-#endif
-      if (data_out) *data_out = handler_data;
-      if (prediction_out) *prediction_out = prediction;
-    }
-  }
-  return innermost_handler;
-}
-
-
-// TODO(turbofan): Make sure table is sorted and use binary search.
-int HandlerTable::LookupReturn(int pc_offset) {
-  for (int i = 0; i < length(); i += kReturnEntrySize) {
-    int return_offset = Smi::ToInt(get(i + kReturnOffsetIndex));
-    int handler_field = Smi::ToInt(get(i + kReturnHandlerIndex));
-    if (pc_offset == return_offset) {
-      return HandlerOffsetField::decode(handler_field);
-    }
-  }
-  return -1;
-}
-
-Handle<HandlerTable> HandlerTable::Empty(Isolate* isolate) {
-  return Handle<HandlerTable>::cast(isolate->factory()->empty_fixed_array());
-}
-
 #ifdef DEBUG
 bool DescriptorArray::IsEqualTo(DescriptorArray* other) {
   if (length() != other->length()) return false;
@@ -10560,7 +10541,7 @@ Handle<String> String::Trim(Handle<String> string, TrimMode mode) {
   // Perform left trimming if requested.
   int left = 0;
   UnicodeCache* unicode_cache = isolate->unicode_cache();
-  if (mode == kTrim || mode == kTrimLeft) {
+  if (mode == kTrim || mode == kTrimStart) {
     while (left < length &&
            unicode_cache->IsWhiteSpaceOrLineTerminator(string->Get(left))) {
       left++;
@@ -10569,7 +10550,7 @@ Handle<String> String::Trim(Handle<String> string, TrimMode mode) {
 
   // Perform right trimming if requested.
   int right = length;
-  if (mode == kTrim || mode == kTrimRight) {
+  if (mode == kTrim || mode == kTrimEnd) {
     while (
         right > left &&
         unicode_cache->IsWhiteSpaceOrLineTerminator(string->Get(right - 1))) {
@@ -11908,24 +11889,15 @@ bool String::IsUtf8EqualTo(Vector<const char> str, bool allow_prefix_match) {
           str_len > slen*static_cast<int>(unibrow::Utf8::kMaxEncodedSize))) {
     return false;
   }
-  int i;
-  size_t remaining_in_str = static_cast<size_t>(str_len);
-  const uint8_t* utf8_data = reinterpret_cast<const uint8_t*>(str.start());
-  for (i = 0; i < slen && remaining_in_str > 0; i++) {
-    size_t cursor = 0;
-    uint32_t r = unibrow::Utf8::ValueOf(utf8_data, remaining_in_str, &cursor);
-    DCHECK(cursor > 0 && cursor <= remaining_in_str);
-    if (r > unibrow::Utf16::kMaxNonSurrogateCharCode) {
-      if (i > slen - 1) return false;
-      if (Get(i++) != unibrow::Utf16::LeadSurrogate(r)) return false;
-      if (Get(i) != unibrow::Utf16::TrailSurrogate(r)) return false;
-    } else {
-      if (Get(i) != r) return false;
-    }
-    utf8_data += cursor;
-    remaining_in_str -= cursor;
+
+  int i = 0;
+  unibrow::Utf8Iterator it = unibrow::Utf8Iterator(str);
+  while (i < slen && !it.Done()) {
+    if (Get(i++) != *it) return false;
+    ++it;
   }
-  return (allow_prefix_match || i == slen) && remaining_in_str == 0;
+
+  return (allow_prefix_match || i == slen) && it.Done();
 }
 
 template <>
@@ -12094,37 +12066,31 @@ uint32_t StringHasher::ComputeUtf8Hash(Vector<const char> chars,
     *utf16_length_out = vector_length;
     return HashSequentialString(chars.start(), vector_length, seed);
   }
+
   // Start with a fake length which won't affect computation.
   // It will be updated later.
   StringHasher hasher(String::kMaxArrayIndexSize, seed);
-  size_t remaining = static_cast<size_t>(vector_length);
-  const uint8_t* stream = reinterpret_cast<const uint8_t*>(chars.start());
+  DCHECK(hasher.is_array_index_);
+
+  unibrow::Utf8Iterator it = unibrow::Utf8Iterator(chars);
   int utf16_length = 0;
   bool is_index = true;
-  DCHECK(hasher.is_array_index_);
-  while (remaining > 0) {
-    size_t consumed = 0;
-    uint32_t c = unibrow::Utf8::ValueOf(stream, remaining, &consumed);
-    DCHECK(consumed > 0 && consumed <= remaining);
-    stream += consumed;
-    remaining -= consumed;
-    bool is_two_characters = c > unibrow::Utf16::kMaxNonSurrogateCharCode;
-    utf16_length += is_two_characters ? 2 : 1;
-    // No need to keep hashing. But we do need to calculate utf16_length.
-    if (utf16_length > String::kMaxHashCalcLength) continue;
-    if (is_two_characters) {
-      uint16_t c1 = unibrow::Utf16::LeadSurrogate(c);
-      uint16_t c2 = unibrow::Utf16::TrailSurrogate(c);
-      hasher.AddCharacter(c1);
-      hasher.AddCharacter(c2);
-      if (is_index) is_index = hasher.UpdateIndex(c1);
-      if (is_index) is_index = hasher.UpdateIndex(c2);
-    } else {
-      hasher.AddCharacter(c);
-      if (is_index) is_index = hasher.UpdateIndex(c);
-    }
+
+  while (utf16_length < String::kMaxHashCalcLength && !it.Done()) {
+    utf16_length++;
+    uint16_t c = *it;
+    ++it;
+    hasher.AddCharacter(c);
+    if (is_index) is_index = hasher.UpdateIndex(c);
+  }
+
+  // Now that hashing is done, we just need to calculate utf16_length
+  while (!it.Done()) {
+    ++it;
+    utf16_length++;
   }
-  *utf16_length_out = static_cast<int>(utf16_length);
+
+  *utf16_length_out = utf16_length;
   // Must set length here so that hash computation is correct.
   hasher.length_ = utf16_length;
   return hasher.GetHashField();
@@ -12250,6 +12216,8 @@ void JSFunction::MarkForOptimization(ConcurrencyMode mode) {
     mode = ConcurrencyMode::kNotConcurrent;
   }
 
+  DCHECK(!is_compiled() || IsInterpreted());
+  DCHECK(shared()->IsInterpreted());
   DCHECK(!IsOptimized());
   DCHECK(!HasOptimizedCode());
   DCHECK(shared()->allows_lazy_compilation() ||
@@ -12271,43 +12239,27 @@ void JSFunction::MarkForOptimization(ConcurrencyMode mode) {
     }
   }
 
-  if (!IsInterpreted()) {
-    // For non I+TF path, install a shim which checks the optimization marker.
-    // No write barrier required, since the builtin is part of the root set.
-    set_code_no_write_barrier(
-        isolate->builtins()->builtin(Builtins::kCheckOptimizationMarker));
-  }
   SetOptimizationMarker(mode == ConcurrencyMode::kConcurrent
                             ? OptimizationMarker::kCompileOptimizedConcurrent
                             : OptimizationMarker::kCompileOptimized);
 }
 
 // static
-void JSFunction::EnsureLiterals(Handle<JSFunction> function) {
-  Handle<SharedFunctionInfo> shared(function->shared());
-  Isolate* isolate = shared->GetIsolate();
-
-  FeedbackVectorState state = function->GetFeedbackVectorState(isolate);
-  switch (state) {
-    case TOP_LEVEL_SCRIPT_NEEDS_VECTOR: {
-      // A top level script didn't get it's literals installed.
-      Handle<FeedbackVector> feedback_vector =
-          FeedbackVector::New(isolate, shared);
-      Handle<Cell> new_cell =
-          isolate->factory()->NewOneClosureCell(feedback_vector);
-      function->set_feedback_vector_cell(*new_cell);
-      break;
-    }
-    case NEEDS_VECTOR: {
+void JSFunction::EnsureFeedbackVector(Handle<JSFunction> function) {
+  Isolate* const isolate = function->GetIsolate();
+  if (function->feedback_cell()->value()->IsUndefined(isolate)) {
+    Handle<SharedFunctionInfo> shared(function->shared(), isolate);
+    if (!shared->HasAsmWasmData()) {
       Handle<FeedbackVector> feedback_vector =
           FeedbackVector::New(isolate, shared);
-      function->feedback_vector_cell()->set_value(*feedback_vector);
-      break;
+      if (function->feedback_cell() == isolate->heap()->many_closures_cell()) {
+        Handle<FeedbackCell> feedback_cell =
+            isolate->factory()->NewOneClosureCell(feedback_vector);
+        function->set_feedback_cell(*feedback_cell);
+      } else {
+        function->feedback_cell()->set_value(*feedback_vector);
+      }
     }
-    case HAS_VECTOR:
-    case NO_VECTOR_NEEDED:
-      // Nothing to do.
-      break;
   }
 }
 
@@ -12410,9 +12362,7 @@ void JSObject::OptimizeAsPrototype(Handle<JSObject> object,
     Object* maybe_constructor = object->map()->GetConstructor();
     if (maybe_constructor->IsJSFunction()) {
       JSFunction* constructor = JSFunction::cast(maybe_constructor);
-      Isolate* isolate = object->GetIsolate();
-      if (!constructor->shared()->IsApiFunction() &&
-          object->class_name() == isolate->heap()->Object_string()) {
+      if (!constructor->shared()->IsApiFunction()) {
         Context* context = constructor->context()->native_context();
         JSFunction* object_function = context->object_function();
         object->map()->SetConstructor(object_function);
@@ -12453,8 +12403,8 @@ void JSObject::LazyRegisterPrototypeUser(Handle<Map> user, Isolate* isolate) {
         Map::GetOrCreatePrototypeInfo(proto, isolate);
     Handle<Object> maybe_registry(proto_info->prototype_users(), isolate);
     int slot = 0;
-    Handle<WeakFixedArray> new_array =
-        WeakFixedArray::Add(maybe_registry, current_user, &slot);
+    Handle<FixedArrayOfWeakCells> new_array =
+        FixedArrayOfWeakCells::Add(maybe_registry, current_user, &slot);
     current_user_info->set_registry_slot(slot);
     if (!maybe_registry.is_identical_to(new_array)) {
       proto_info->set_prototype_users(*new_array);
@@ -12484,7 +12434,7 @@ bool JSObject::UnregisterPrototypeUser(Handle<Map> user, Isolate* isolate) {
   if (!user->prototype()->IsJSObject()) {
     Object* users =
         PrototypeInfo::cast(user->prototype_info())->prototype_users();
-    return users->IsWeakFixedArray();
+    return users->IsFixedArrayOfWeakCells();
   }
   Handle<JSObject> prototype(JSObject::cast(user->prototype()), isolate);
   Handle<PrototypeInfo> user_info =
@@ -12498,9 +12448,9 @@ bool JSObject::UnregisterPrototypeUser(Handle<Map> user, Isolate* isolate) {
   Handle<PrototypeInfo> proto_info(PrototypeInfo::cast(maybe_proto_info),
                                    isolate);
   Object* maybe_registry = proto_info->prototype_users();
-  DCHECK(maybe_registry->IsWeakFixedArray());
-  DCHECK(WeakFixedArray::cast(maybe_registry)->Get(slot) == *user);
-  WeakFixedArray::cast(maybe_registry)->Clear(slot);
+  DCHECK(maybe_registry->IsFixedArrayOfWeakCells());
+  DCHECK(FixedArrayOfWeakCells::cast(maybe_registry)->Get(slot) == *user);
+  FixedArrayOfWeakCells::cast(maybe_registry)->Clear(slot);
   if (FLAG_trace_prototype_users) {
     PrintF("Unregistering %p as a user of prototype %p.\n",
            reinterpret_cast<void*>(*user), reinterpret_cast<void*>(*prototype));
@@ -12513,29 +12463,27 @@ namespace {
 // This function must be kept in sync with
 // AccessorAssembler::InvalidateValidityCellIfPrototype() which does pre-checks
 // before jumping here.
-PrototypeInfo* InvalidateOnePrototypeValidityCellInternal(Map* map) {
+void InvalidateOnePrototypeValidityCellInternal(Map* map) {
   DCHECK(map->is_prototype_map());
   if (FLAG_trace_prototype_users) {
     PrintF("Invalidating prototype map %p 's cell\n",
            reinterpret_cast<void*>(map));
   }
-  Object* maybe_proto_info = map->prototype_info();
-  if (!maybe_proto_info->IsPrototypeInfo()) return nullptr;
-  PrototypeInfo* proto_info = PrototypeInfo::cast(maybe_proto_info);
-  Object* maybe_cell = proto_info->validity_cell();
+  Object* maybe_cell = map->prototype_validity_cell();
   if (maybe_cell->IsCell()) {
     // Just set the value; the cell will be replaced lazily.
     Cell* cell = Cell::cast(maybe_cell);
     cell->set_value(Smi::FromInt(Map::kPrototypeChainInvalid));
   }
-  return proto_info;
 }
 
 void InvalidatePrototypeChainsInternal(Map* map) {
-  PrototypeInfo* proto_info = InvalidateOnePrototypeValidityCellInternal(map);
-  if (proto_info == nullptr) return;
+  InvalidateOnePrototypeValidityCellInternal(map);
 
-  WeakFixedArray::Iterator iterator(proto_info->prototype_users());
+  Object* maybe_proto_info = map->prototype_info();
+  if (!maybe_proto_info->IsPrototypeInfo()) return;
+  PrototypeInfo* proto_info = PrototypeInfo::cast(maybe_proto_info);
+  FixedArrayOfWeakCells::Iterator iterator(proto_info->prototype_users());
   // For now, only maps register themselves as users.
   Map* user;
   while ((user = iterator.Next<Map>()) != nullptr) {
@@ -12613,21 +12561,15 @@ Handle<Cell> Map::GetOrCreatePrototypeChainValidityCell(Handle<Map> map,
   } else {
     maybe_prototype =
         handle(map->GetPrototypeChainRootMap(isolate)->prototype(), isolate);
-    if (!maybe_prototype->IsJSReceiver()) return Handle<Cell>::null();
-  }
-  if (maybe_prototype->IsJSProxy()) {
-    Handle<Cell> cell = isolate->factory()->NewCell(
-        handle(Smi::FromInt(Map::kPrototypeChainValid), isolate));
-    return cell;
   }
+  if (!maybe_prototype->IsJSObject()) return Handle<Cell>::null();
   Handle<JSObject> prototype = Handle<JSObject>::cast(maybe_prototype);
   // Ensure the prototype is registered with its own prototypes so its cell
   // will be invalidated when necessary.
   JSObject::LazyRegisterPrototypeUser(handle(prototype->map(), isolate),
                                       isolate);
-  Handle<PrototypeInfo> proto_info =
-      GetOrCreatePrototypeInfo(prototype, isolate);
-  Object* maybe_cell = proto_info->validity_cell();
+
+  Object* maybe_cell = prototype->map()->prototype_validity_cell();
   // Return existing cell if it's still valid.
   if (maybe_cell->IsCell()) {
     Handle<Cell> cell(Cell::cast(maybe_cell), isolate);
@@ -12638,21 +12580,17 @@ Handle<Cell> Map::GetOrCreatePrototypeChainValidityCell(Handle<Map> map,
   // Otherwise create a new cell.
   Handle<Cell> cell = isolate->factory()->NewCell(
       handle(Smi::FromInt(Map::kPrototypeChainValid), isolate));
-  proto_info->set_validity_cell(*cell);
+  prototype->map()->set_prototype_validity_cell(*cell);
   return cell;
 }
 
 // static
 bool Map::IsPrototypeChainInvalidated(Map* map) {
   DCHECK(map->is_prototype_map());
-  Object* maybe_proto_info = map->prototype_info();
-  if (maybe_proto_info->IsPrototypeInfo()) {
-    PrototypeInfo* proto_info = PrototypeInfo::cast(maybe_proto_info);
-    Object* maybe_cell = proto_info->validity_cell();
-    if (maybe_cell->IsCell()) {
-      Cell* cell = Cell::cast(maybe_cell);
-      return cell->value() == Smi::FromInt(Map::kPrototypeChainInvalid);
-    }
+  Object* maybe_cell = map->prototype_validity_cell();
+  if (maybe_cell->IsCell()) {
+    Cell* cell = Cell::cast(maybe_cell);
+    return cell->value() != Smi::FromInt(Map::kPrototypeChainValid);
   }
   return true;
 }
@@ -12880,6 +12818,7 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
       return true;
 
     case BIGINT_TYPE:
+    case BOILERPLATE_DESCRIPTION_TYPE:
     case BYTECODE_ARRAY_TYPE:
     case BYTE_ARRAY_TYPE:
     case CELL_TYPE:
@@ -12887,6 +12826,7 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
     case FILLER_TYPE:
     case FIXED_ARRAY_TYPE:
     case FIXED_DOUBLE_ARRAY_TYPE:
+    case FEEDBACK_METADATA_TYPE:
     case FOREIGN_TYPE:
     case FREE_SPACE_TYPE:
     case HASH_TABLE_TYPE:
@@ -13139,15 +13079,12 @@ bool JSFunction::SetName(Handle<JSFunction> function, Handle<Name> name,
 
 namespace {
 
-char const kNativeCodeSource[] = "function () { [native code] }";
-
-
 Handle<String> NativeCodeFunctionSourceString(
     Handle<SharedFunctionInfo> shared_info) {
   Isolate* const isolate = shared_info->GetIsolate();
   IncrementalStringBuilder builder(isolate);
   builder.AppendCString("function ");
-  builder.AppendString(handle(shared_info->name(), isolate));
+  builder.AppendString(handle(shared_info->Name(), isolate));
   builder.AppendCString("() { [native code] }");
   return builder.Finish().ToHandleChecked();
 }
@@ -13158,7 +13095,7 @@ Handle<String> NativeCodeFunctionSourceString(
 // static
 Handle<String> JSBoundFunction::ToString(Handle<JSBoundFunction> function) {
   Isolate* const isolate = function->GetIsolate();
-  return isolate->factory()->NewStringFromAsciiChecked(kNativeCodeSource);
+  return isolate->factory()->function_native_code_string();
 }
 
 
@@ -13220,7 +13157,7 @@ Handle<String> JSFunction::ToString(Handle<JSFunction> function) {
     if (shared_info->name_should_print_as_anonymous()) {
       builder.AppendCString("anonymous");
     } else if (!shared_info->is_anonymous_expression()) {
-      builder.AppendString(handle(shared_info->name(), isolate));
+      builder.AppendString(handle(shared_info->Name(), isolate));
     }
   }
   if (shared_info->is_wrapped()) {
@@ -13495,11 +13432,14 @@ MaybeHandle<SharedFunctionInfo> Script::FindSharedFunctionInfo(
   // AstTraversalVisitor doesn't recurse properly in the construct which
   // triggers the mismatch.
   CHECK_LT(fun->function_literal_id(), shared_function_infos()->length());
-  Object* shared = shared_function_infos()->get(fun->function_literal_id());
-  if (shared->IsUndefined(isolate) || WeakCell::cast(shared)->cleared()) {
+  MaybeObject* shared =
+      shared_function_infos()->Get(fun->function_literal_id());
+  HeapObject* heap_object;
+  if (!shared->ToStrongOrWeakHeapObject(&heap_object) ||
+      heap_object->IsUndefined(isolate)) {
     return MaybeHandle<SharedFunctionInfo>();
   }
-  return handle(SharedFunctionInfo::cast(WeakCell::cast(shared)->value()));
+  return handle(SharedFunctionInfo::cast(heap_object));
 }
 
 Script::Iterator::Iterator(Isolate* isolate)
@@ -13514,16 +13454,20 @@ SharedFunctionInfo::ScriptIterator::ScriptIterator(Handle<Script> script)
                      handle(script->shared_function_infos())) {}
 
 SharedFunctionInfo::ScriptIterator::ScriptIterator(
-    Isolate* isolate, Handle<FixedArray> shared_function_infos)
+    Isolate* isolate, Handle<WeakFixedArray> shared_function_infos)
     : isolate_(isolate),
       shared_function_infos_(shared_function_infos),
       index_(0) {}
 
 SharedFunctionInfo* SharedFunctionInfo::ScriptIterator::Next() {
   while (index_ < shared_function_infos_->length()) {
-    Object* raw = shared_function_infos_->get(index_++);
-    if (raw->IsUndefined(isolate_) || WeakCell::cast(raw)->cleared()) continue;
-    return SharedFunctionInfo::cast(WeakCell::cast(raw)->value());
+    MaybeObject* raw = shared_function_infos_->Get(index_++);
+    HeapObject* heap_object;
+    if (!raw->ToStrongOrWeakHeapObject(&heap_object) ||
+        heap_object->IsUndefined(isolate_)) {
+      continue;
+    }
+    return SharedFunctionInfo::cast(heap_object);
   }
   return nullptr;
 }
@@ -13567,24 +13511,24 @@ void SharedFunctionInfo::SetScript(Handle<SharedFunctionInfo> shared,
   // duplicates.
   if (script_object->IsScript()) {
     Handle<Script> script = Handle<Script>::cast(script_object);
-    Handle<FixedArray> list = handle(script->shared_function_infos(), isolate);
+    Handle<WeakFixedArray> list =
+        handle(script->shared_function_infos(), isolate);
 #ifdef DEBUG
     DCHECK_LT(shared->function_literal_id(), list->length());
-    if (list->get(shared->function_literal_id())->IsWeakCell() &&
-        !WeakCell::cast(list->get(shared->function_literal_id()))->cleared()) {
-      DCHECK(
-          WeakCell::cast(list->get(shared->function_literal_id()))->value() ==
-          *shared);
+    MaybeObject* maybe_object = list->Get(shared->function_literal_id());
+    HeapObject* heap_object;
+    if (maybe_object->ToWeakHeapObject(&heap_object)) {
+      DCHECK_EQ(heap_object, *shared);
     }
 #endif
-    Handle<WeakCell> cell = isolate->factory()->NewWeakCell(shared);
-    list->set(shared->function_literal_id(), *cell);
+    list->Set(shared->function_literal_id(),
+              HeapObjectReference::Weak(*shared));
   } else {
     Handle<Object> list = isolate->factory()->noscript_shared_function_infos();
 
 #ifdef DEBUG
     if (FLAG_enable_slow_asserts) {
-      WeakFixedArray::Iterator iterator(*list);
+      FixedArrayOfWeakCells::Iterator iterator(*list);
       SharedFunctionInfo* next;
       while ((next = iterator.Next<SharedFunctionInfo>()) != nullptr) {
         DCHECK_NE(next, *shared);
@@ -13592,7 +13536,7 @@ void SharedFunctionInfo::SetScript(Handle<SharedFunctionInfo> shared,
     }
 #endif  // DEBUG
 
-    list = WeakFixedArray::Add(list, shared);
+    list = FixedArrayOfWeakCells::Add(list, shared);
 
     isolate->heap()->SetRootNoScriptSharedFunctionInfos(*list);
   }
@@ -13603,19 +13547,21 @@ void SharedFunctionInfo::SetScript(Handle<SharedFunctionInfo> shared,
 
     // Due to liveedit, it might happen that the old_script doesn't know
     // about the SharedFunctionInfo, so we have to guard against that.
-    Handle<FixedArray> infos(old_script->shared_function_infos(), isolate);
+    Handle<WeakFixedArray> infos(old_script->shared_function_infos(), isolate);
     if (shared->function_literal_id() < infos->length()) {
-      Object* raw = old_script->shared_function_infos()->get(
+      MaybeObject* raw = old_script->shared_function_infos()->Get(
           shared->function_literal_id());
-      if (!raw->IsWeakCell() || WeakCell::cast(raw)->value() == *shared) {
-        old_script->shared_function_infos()->set(
-            shared->function_literal_id(), isolate->heap()->undefined_value());
+      HeapObject* heap_object;
+      if (raw->ToWeakHeapObject(&heap_object) && heap_object == *shared) {
+        old_script->shared_function_infos()->Set(
+            shared->function_literal_id(),
+            HeapObjectReference::Strong(isolate->heap()->undefined_value()));
       }
     }
   } else {
     // Remove shared function info from root array.
     Object* list = isolate->heap()->noscript_shared_function_infos();
-    CHECK(WeakFixedArray::cast(list)->Remove(shared));
+    CHECK(FixedArrayOfWeakCells::cast(list)->Remove(shared));
   }
 
   // Finally set new script.
@@ -13626,10 +13572,16 @@ bool SharedFunctionInfo::HasBreakInfo() const {
   if (!HasDebugInfo()) return false;
   DebugInfo* info = DebugInfo::cast(debug_info());
   bool has_break_info = info->HasBreakInfo();
-  DCHECK_IMPLIES(has_break_info, HasBytecodeArray());
   return has_break_info;
 }
 
+bool SharedFunctionInfo::BreakAtEntry() const {
+  if (!HasDebugInfo()) return false;
+  DebugInfo* info = DebugInfo::cast(debug_info());
+  bool break_at_entry = info->BreakAtEntry();
+  return break_at_entry;
+}
+
 bool SharedFunctionInfo::HasCoverageInfo() const {
   if (!HasDebugInfo()) return false;
   DebugInfo* info = DebugInfo::cast(debug_info());
@@ -13661,8 +13613,8 @@ void SharedFunctionInfo::set_debugger_hints(int value) {
 }
 
 String* SharedFunctionInfo::DebugName() {
-  if (name()->length() == 0) return inferred_name();
-  return name();
+  if (Name()->length() == 0) return inferred_name();
+  return Name();
 }
 
 // static
@@ -13723,8 +13675,8 @@ Handle<Object> SharedFunctionInfo::GetSourceCode(
   Isolate* isolate = shared->GetIsolate();
   if (!shared->HasSourceCode()) return isolate->factory()->undefined_value();
   Handle<String> source(String::cast(Script::cast(shared->script())->source()));
-  return isolate->factory()->NewSubString(source, shared->start_position(),
-                                          shared->end_position());
+  return isolate->factory()->NewSubString(source, shared->StartPosition(),
+                                          shared->EndPosition());
 }
 
 // static
@@ -13735,15 +13687,15 @@ Handle<Object> SharedFunctionInfo::GetSourceCodeHarmony(
   Handle<String> script_source(
       String::cast(Script::cast(shared->script())->source()));
   int start_pos = shared->function_token_position();
-  if (start_pos == kNoSourcePosition) start_pos = shared->start_position();
+  if (start_pos == kNoSourcePosition) start_pos = shared->StartPosition();
   Handle<String> source = isolate->factory()->NewSubString(
-      script_source, start_pos, shared->end_position());
+      script_source, start_pos, shared->EndPosition());
   if (!shared->is_wrapped()) return source;
 
   DCHECK(!shared->name_should_print_as_anonymous());
   IncrementalStringBuilder builder(isolate);
   builder.AppendCString("function ");
-  builder.AppendString(Handle<String>(shared->name(), isolate));
+  builder.AppendString(Handle<String>(shared->Name(), isolate));
   builder.AppendCString("(");
   Handle<FixedArray> args(Script::cast(shared->script())->wrapped_arguments());
   int argc = args->length();
@@ -13768,9 +13720,7 @@ bool SharedFunctionInfo::IsInlineable() {
   return !optimization_disabled();
 }
 
-int SharedFunctionInfo::SourceSize() {
-  return end_position() - start_position();
-}
+int SharedFunctionInfo::SourceSize() { return EndPosition() - StartPosition(); }
 
 void JSFunction::CalculateInstanceSizeHelper(InstanceType instance_type,
                                              bool has_prototype_slot,
@@ -13854,19 +13804,19 @@ std::ostream& operator<<(std::ostream& os, const SourceCodeOf& v) {
 
   if (!s->is_toplevel()) {
     os << "function ";
-    String* name = s->name();
+    String* name = s->Name();
     if (name->length() > 0) {
       name->PrintUC16(os);
     }
   }
 
-  int len = s->end_position() - s->start_position();
+  int len = s->EndPosition() - s->StartPosition();
   if (len <= v.max_length || v.max_length < 0) {
-    script_source->PrintUC16(os, s->start_position(), s->end_position());
+    script_source->PrintUC16(os, s->StartPosition(), s->EndPosition());
     return os;
   } else {
-    script_source->PrintUC16(os, s->start_position(),
-                             s->start_position() + v.max_length);
+    script_source->PrintUC16(os, s->StartPosition(),
+                             s->StartPosition() + v.max_length);
     return os << "...\n";
   }
 }
@@ -13875,8 +13825,7 @@ std::ostream& operator<<(std::ostream& os, const SourceCodeOf& v) {
 void SharedFunctionInfo::DisableOptimization(BailoutReason reason) {
   DCHECK_NE(reason, BailoutReason::kNoReason);
 
-  set_compiler_hints(
-      DisabledOptimizationReasonBits::update(compiler_hints(), reason));
+  set_flags(DisabledOptimizationReasonBits::update(flags(), reason));
   // Code should be the lazy compilation stub or else interpreted.
   DCHECK(abstract_code()->kind() == AbstractCode::INTERPRETED_FUNCTION ||
          abstract_code()->kind() == AbstractCode::BUILTIN);
@@ -13894,8 +13843,12 @@ void SharedFunctionInfo::InitFromFunctionLiteral(
   // updated accordingly.
   shared_info->set_internal_formal_parameter_count(lit->parameter_count());
   shared_info->set_function_token_position(lit->function_token_position());
-  shared_info->set_start_position(lit->start_position());
-  shared_info->set_end_position(lit->end_position());
+  shared_info->set_raw_start_position(lit->start_position());
+  shared_info->set_raw_end_position(lit->end_position());
+  if (shared_info->scope_info()->HasPositionInfo()) {
+    shared_info->scope_info()->SetPositionInfo(lit->start_position(),
+                                               lit->end_position());
+  }
   shared_info->set_is_declaration(lit->is_declaration());
   shared_info->set_is_named_expression(lit->is_named_expression());
   shared_info->set_is_anonymous_expression(lit->is_anonymous_expression());
@@ -13906,10 +13859,8 @@ void SharedFunctionInfo::InitFromFunctionLiteral(
   //  shared_info->set_kind(lit->kind());
   // FunctionKind must have already been set.
   DCHECK(lit->kind() == shared_info->kind());
-  if (!IsConstructable(lit->kind())) {
-    shared_info->SetConstructStub(
-        *BUILTIN_CODE(shared_info->GetIsolate(), ConstructedNonConstructable));
-  }
+  DCHECK_EQ(*shared_info->GetIsolate()->builtins()->JSConstructStubGeneric(),
+            shared_info->construct_stub());
   shared_info->set_needs_home_object(lit->scope()->NeedsHomeObject());
   shared_info->set_function_literal_id(lit->function_literal_id());
   DCHECK_IMPLIES(lit->requires_instance_fields_initializer(),
@@ -13969,7 +13920,9 @@ void SharedFunctionInfo::SetConstructStub(Code* code) {
     int builtin_id = code->builtin_index();
     DCHECK_NE(Builtins::kDeserializeLazy, builtin_id);
     DCHECK(builtin_id == Builtins::kJSBuiltinsConstructStub ||
-           this->code() == code || !Builtins::IsLazy(builtin_id));
+           !Builtins::IsLazy(builtin_id));
+    // Builtins should use JSBuiltinsConstructStub.
+    DCHECK_NE(this->GetCode(), code);
   }
 #endif
   set_construct_stub(code);
@@ -14011,16 +13964,10 @@ void Code::InvalidateEmbeddedObjects() {
 
 
 void Code::Relocate(intptr_t delta) {
-  if (trap_handler::IsTrapHandlerEnabled() && is_wasm_code()) {
-    const int index = trap_handler_index()->value();
-    if (index >= 0) {
-      trap_handler::UpdateHandlerDataCodePointer(index, instruction_start());
-    }
-  }
   for (RelocIterator it(this, RelocInfo::kApplyMask); !it.done(); it.next()) {
     it.rinfo()->apply(delta);
   }
-  Assembler::FlushICache(GetIsolate(), instruction_start(), instruction_size());
+  Assembler::FlushICache(instruction_start(), instruction_size());
 }
 
 
@@ -14061,18 +14008,18 @@ void Code::CopyFrom(const CodeDesc& desc) {
       // code object
       Handle<Object> p = it.rinfo()->target_object_handle(origin);
       Code* code = Code::cast(*p);
-      it.rinfo()->set_target_address(GetIsolate(), code->instruction_start(),
+      it.rinfo()->set_target_address(code->instruction_start(),
                                      UPDATE_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
     } else if (RelocInfo::IsRuntimeEntry(mode)) {
       Address p = it.rinfo()->target_runtime_entry(origin);
-      it.rinfo()->set_target_runtime_entry(
-          GetIsolate(), p, UPDATE_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
+      it.rinfo()->set_target_runtime_entry(p, UPDATE_WRITE_BARRIER,
+                                           SKIP_ICACHE_FLUSH);
     } else {
       intptr_t delta = instruction_start() - desc.buffer;
       it.rinfo()->apply(delta);
     }
   }
-  Assembler::FlushICache(GetIsolate(), instruction_start(), instruction_size());
+  Assembler::FlushICache(instruction_start(), instruction_size());
 }
 
 
@@ -14081,11 +14028,36 @@ SafepointEntry Code::GetSafepointEntry(Address pc) {
   return table.FindEntry(pc);
 }
 
+#ifdef V8_EMBEDDED_BUILTINS
+int Code::OffHeapInstructionSize() const {
+  DCHECK(Builtins::IsOffHeapBuiltin(this));
+  if (Isolate::CurrentEmbeddedBlob() == nullptr) return instruction_size();
+  EmbeddedData d = EmbeddedData::FromBlob();
+  return d.InstructionSizeOfBuiltin(builtin_index());
+}
+
+Address Code::OffHeapInstructionStart() const {
+  DCHECK(Builtins::IsOffHeapBuiltin(this));
+  if (Isolate::CurrentEmbeddedBlob() == nullptr) return instruction_start();
+  EmbeddedData d = EmbeddedData::FromBlob();
+  return reinterpret_cast<Address>(
+      const_cast<uint8_t*>(d.InstructionStartOfBuiltin(builtin_index())));
+}
+
+Address Code::OffHeapInstructionEnd() const {
+  DCHECK(Builtins::IsOffHeapBuiltin(this));
+  if (Isolate::CurrentEmbeddedBlob() == nullptr) return instruction_end();
+  EmbeddedData d = EmbeddedData::FromBlob();
+  return reinterpret_cast<Address>(
+      const_cast<uint8_t*>(d.InstructionStartOfBuiltin(builtin_index()) +
+                           d.InstructionSizeOfBuiltin(builtin_index())));
+}
+#endif
 
 namespace {
 template <typename Code>
 void SetStackFrameCacheCommon(Handle<Code> code,
-                              Handle<NumberDictionary> cache) {
+                              Handle<SimpleNumberDictionary> cache) {
   Handle<Object> maybe_table(code->source_position_table(), code->GetIsolate());
   if (maybe_table->IsSourcePositionTableWithFrameCache()) {
     Handle<SourcePositionTableWithFrameCache>::cast(maybe_table)
@@ -14103,7 +14075,7 @@ void SetStackFrameCacheCommon(Handle<Code> code,
 
 // static
 void AbstractCode::SetStackFrameCache(Handle<AbstractCode> abstract_code,
-                                      Handle<NumberDictionary> cache) {
+                                      Handle<SimpleNumberDictionary> cache) {
   if (abstract_code->IsCode()) {
     SetStackFrameCacheCommon(handle(abstract_code->GetCode()), cache);
   } else {
@@ -14161,7 +14133,7 @@ int AbstractCode::SourceStatementPosition(int offset) {
 }
 
 void JSFunction::ClearTypeFeedbackInfo() {
-  if (feedback_vector_cell()->value()->IsFeedbackVector()) {
+  if (feedback_cell()->value()->IsFeedbackVector()) {
     FeedbackVector* vector = feedback_vector();
     Isolate* isolate = GetIsolate();
     if (vector->ClearSlots(isolate)) {
@@ -14217,6 +14189,36 @@ const char* AbstractCode::Kind2String(Kind kind) {
   UNREACHABLE();
 }
 
+#ifdef V8_EMBEDDED_BUILTINS
+bool Code::IsProcessIndependent() {
+  constexpr int all_real_modes_mask =
+      (1 << (RelocInfo::LAST_REAL_RELOC_MODE + 1)) - 1;
+  constexpr int mode_mask =
+      all_real_modes_mask & ~RelocInfo::ModeMask(RelocInfo::COMMENT) &
+      ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) &
+      ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED) &
+      ~RelocInfo::ModeMask(RelocInfo::OFF_HEAP_TARGET) &
+      ~RelocInfo::ModeMask(RelocInfo::CONST_POOL) &
+      ~RelocInfo::ModeMask(RelocInfo::VENEER_POOL);
+  STATIC_ASSERT(RelocInfo::LAST_REAL_RELOC_MODE == RelocInfo::VENEER_POOL);
+  STATIC_ASSERT(RelocInfo::ModeMask(RelocInfo::COMMENT) ==
+                (1 << RelocInfo::COMMENT));
+  STATIC_ASSERT(
+      mode_mask ==
+      (RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
+       RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
+       RelocInfo::ModeMask(RelocInfo::WASM_CONTEXT_REFERENCE) |
+       RelocInfo::ModeMask(RelocInfo::WASM_GLOBAL_HANDLE) |
+       RelocInfo::ModeMask(RelocInfo::WASM_CALL) |
+       RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL) |
+       RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
+       RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE)));
+
+  RelocIterator it(this, mode_mask);
+  return it.done();
+}
+#endif
+
 Handle<WeakCell> Code::WeakCellFor(Handle<Code> code) {
   DCHECK(code->kind() == OPTIMIZED_FUNCTION);
   WeakCell* raw_cell = code->CachedWeakCell();
@@ -14285,30 +14287,6 @@ Code* Code::OptimizedCodeIterator::Next() {
   return code;
 }
 
-#if defined(OBJECT_PRINT) || defined(ENABLE_DISASSEMBLER)
-
-const char* Code::ICState2String(InlineCacheState state) {
-  switch (state) {
-    case UNINITIALIZED:
-      return "UNINITIALIZED";
-    case PREMONOMORPHIC:
-      return "PREMONOMORPHIC";
-    case MONOMORPHIC:
-      return "MONOMORPHIC";
-    case RECOMPUTE_HANDLER:
-      return "RECOMPUTE_HANDLER";
-    case POLYMORPHIC:
-      return "POLYMORPHIC";
-    case MEGAMORPHIC:
-      return "MEGAMORPHIC";
-    case GENERIC:
-      return "GENERIC";
-  }
-  UNREACHABLE();
-}
-
-#endif  // defined(OBJECT_PRINT) || defined(ENABLE_DISASSEMBLER)
-
 #ifdef ENABLE_DISASSEMBLER
 
 namespace {
@@ -14537,34 +14515,6 @@ void DeoptimizationData::DeoptimizationDataPrint(std::ostream& os) {  // NOLINT
 }
 
 
-void HandlerTable::HandlerTableRangePrint(std::ostream& os) {
-  os << "   from   to       hdlr\n";
-  for (int i = 0; i < length(); i += kRangeEntrySize) {
-    int pc_start = Smi::ToInt(get(i + kRangeStartIndex));
-    int pc_end = Smi::ToInt(get(i + kRangeEndIndex));
-    int handler_field = Smi::ToInt(get(i + kRangeHandlerIndex));
-    int handler_offset = HandlerOffsetField::decode(handler_field);
-    CatchPrediction prediction = HandlerPredictionField::decode(handler_field);
-    int data = Smi::ToInt(get(i + kRangeDataIndex));
-    os << "  (" << std::setw(4) << pc_start << "," << std::setw(4) << pc_end
-       << ")  ->  " << std::setw(4) << handler_offset
-       << " (prediction=" << prediction << ", data=" << data << ")\n";
-  }
-}
-
-
-void HandlerTable::HandlerTableReturnPrint(std::ostream& os) {
-  os << "   off      hdlr (c)\n";
-  for (int i = 0; i < length(); i += kReturnEntrySize) {
-    int pc_offset = Smi::ToInt(get(i + kReturnOffsetIndex));
-    int handler_field = Smi::ToInt(get(i + kReturnHandlerIndex));
-    int handler_offset = HandlerOffsetField::decode(handler_field);
-    CatchPrediction prediction = HandlerPredictionField::decode(handler_field);
-    os << "  " << std::setw(4) << pc_offset << "  ->  " << std::setw(4)
-       << handler_offset << " (prediction=" << prediction << ")\n";
-  }
-}
-
 void Code::Disassemble(const char* name, std::ostream& os, void* current_pc) {
   os << "kind = " << Kind2String(kind()) << "\n";
   if (is_stub()) {
@@ -14593,20 +14543,20 @@ void Code::Disassemble(const char* name, std::ostream& os, void* current_pc) {
   os << "compiler = " << (is_turbofanned() ? "turbofan" : "unknown") << "\n";
   os << "address = " << static_cast<const void*>(this) << "\n";
 
-  os << "Body (size = " << instruction_size() << ")\n";
+  os << "Body (size = " << InstructionSize() << ")\n";
   {
     Isolate* isolate = GetIsolate();
-    int size = instruction_size();
+    int size = InstructionSize();
     int safepoint_offset =
         has_safepoint_info() ? safepoint_table_offset() : size;
-    int constant_pool_offset = FLAG_enable_embedded_constant_pool
-                                   ? this->constant_pool_offset()
-                                   : size;
+    int constant_pool_offset = this->constant_pool_offset();
+    int handler_offset = handler_table_offset() ? handler_table_offset() : size;
 
     // Stop before reaching any embedded tables
-    int code_size = Min(safepoint_offset, constant_pool_offset);
+    int code_size =
+        Min(handler_offset, Min(safepoint_offset, constant_pool_offset));
     os << "Instructions (size = " << code_size << ")\n";
-    byte* begin = instruction_start();
+    byte* begin = InstructionStart();
     byte* end = begin + code_size;
     Disassembler::Decode(isolate, &os, begin, end, this, current_pc);
 
@@ -14647,7 +14597,7 @@ void Code::Disassemble(const char* name, std::ostream& os, void* current_pc) {
     os << "Safepoints (size = " << table.size() << ")\n";
     for (unsigned i = 0; i < table.length(); i++) {
       unsigned pc_offset = table.GetPcOffset(i);
-      os << static_cast<const void*>(instruction_start() + pc_offset) << "  ";
+      os << static_cast<const void*>(InstructionStart() + pc_offset) << "  ";
       os << std::setw(6) << std::hex << pc_offset << "  " << std::setw(4);
       int trampoline_pc = table.GetTrampolinePcOffset(i);
       print_pc(os, trampoline_pc);
@@ -14668,10 +14618,11 @@ void Code::Disassemble(const char* name, std::ostream& os, void* current_pc) {
     os << "\n";
   }
 
-  if (handler_table()->length() > 0) {
-    os << "Handler Table (size = " << handler_table()->Size() << ")\n";
+  if (handler_table_offset() > 0) {
+    HandlerTable table(this);
+    os << "Handler Table (size = " << table.NumberOfReturnEntries() << ")\n";
     if (kind() == OPTIMIZED_FUNCTION) {
-      HandlerTable::cast(handler_table())->HandlerTableReturnPrint(os);
+      table.HandlerTableReturnPrint(os);
     }
     os << "\n";
   }
@@ -14744,10 +14695,11 @@ void BytecodeArray::Disassemble(std::ostream& os) {
   }
 #endif
 
-  os << "Handler Table (size = " << handler_table()->Size() << ")\n";
+  os << "Handler Table (size = " << handler_table()->length() << ")\n";
 #ifdef ENABLE_DISASSEMBLER
   if (handler_table()->length() > 0) {
-    HandlerTable::cast(handler_table())->HandlerTableRangePrint(os);
+    HandlerTable table(this);
+    table.HandlerTableRangePrint(os);
   }
 #endif
 }
@@ -15011,7 +14963,6 @@ bool DependentCode::MarkCodeForDeoptimization(
   DisallowHeapAllocation no_allocation_scope;
   // Mark all the code that needs to be deoptimized.
   bool marked = false;
-  bool invalidate_embedded_objects = group == kWeakCodeGroup;
   int count = this->count();
   for (int i = 0; i < count; i++) {
     Object* obj = object_at(i);
@@ -15020,10 +14971,7 @@ bool DependentCode::MarkCodeForDeoptimization(
       if (cell->cleared()) continue;
       Code* code = Code::cast(cell->value());
       if (!code->marked_for_deoptimization()) {
-        SetMarkedForDeoptimization(code, group);
-        if (invalidate_embedded_objects) {
-          code->InvalidateEmbeddedObjects();
-        }
+        code->SetMarkedForDeoptimization(DependencyGroupName(group));
         marked = true;
       }
     } else {
@@ -15053,27 +15001,24 @@ void DependentCode::DeoptimizeDependentCodeGroup(
   }
 }
 
-
-void DependentCode::SetMarkedForDeoptimization(Code* code,
-                                               DependencyGroup group) {
-  code->set_marked_for_deoptimization(true);
+void Code::SetMarkedForDeoptimization(const char* reason) {
+  set_marked_for_deoptimization(true);
   if (FLAG_trace_deopt &&
-      (code->deoptimization_data() != code->GetHeap()->empty_fixed_array())) {
+      (deoptimization_data() != GetHeap()->empty_fixed_array())) {
     DeoptimizationData* deopt_data =
-        DeoptimizationData::cast(code->deoptimization_data());
-    CodeTracer::Scope scope(code->GetHeap()->isolate()->GetCodeTracer());
-    PrintF(scope.file(), "[marking dependent code 0x%08" V8PRIxPTR
-                         " (opt #%d) for deoptimization, reason: %s]\n",
-           reinterpret_cast<intptr_t>(code),
-           deopt_data->OptimizationId()->value(), DependencyGroupName(group));
+        DeoptimizationData::cast(deoptimization_data());
+    CodeTracer::Scope scope(GetHeap()->isolate()->GetCodeTracer());
+    PrintF(scope.file(),
+           "[marking dependent code 0x%08" V8PRIxPTR
+           " (opt #%d) for deoptimization, reason: %s]\n",
+           reinterpret_cast<intptr_t>(this),
+           deopt_data->OptimizationId()->value(), reason);
   }
 }
 
 
 const char* DependentCode::DependencyGroupName(DependencyGroup group) {
   switch (group) {
-    case kWeakCodeGroup:
-      return "weak-code";
     case kTransitionGroup:
       return "transition";
     case kPrototypeCheckGroup:
@@ -15720,7 +15665,7 @@ int JSObject::GetFastElementsUsage() {
                          : store->length();
     case FAST_SLOPPY_ARGUMENTS_ELEMENTS:
       store = SloppyArgumentsElements::cast(store)->arguments();
-    // Fall through.
+      V8_FALLTHROUGH;
     case HOLEY_SMI_ELEMENTS:
     case HOLEY_ELEMENTS:
     case FAST_STRING_WRAPPER_ELEMENTS:
@@ -15938,6 +15883,11 @@ v8::Promise::PromiseState JSPromise::status() const {
   return static_cast<v8::Promise::PromiseState>(value);
 }
 
+void JSPromise::set_status(Promise::PromiseState status) {
+  int value = flags() & ~kStatusMask;
+  set_flags(value | status);
+}
+
 // static
 const char* JSPromise::Status(v8::Promise::PromiseState status) {
   switch (status) {
@@ -15951,6 +15901,217 @@ const char* JSPromise::Status(v8::Promise::PromiseState status) {
   UNREACHABLE();
 }
 
+// static
+Handle<Object> JSPromise::Fulfill(Handle<JSPromise> promise,
+                                  Handle<Object> value) {
+  Isolate* const isolate = promise->GetIsolate();
+
+  // 1. Assert: The value of promise.[[PromiseState]] is "pending".
+  DCHECK_EQ(Promise::kPending, promise->status());
+
+  // 2. Let reactions be promise.[[PromiseFulfillReactions]].
+  Handle<Object> reactions(promise->reactions(), isolate);
+
+  // 3. Set promise.[[PromiseResult]] to value.
+  // 4. Set promise.[[PromiseFulfillReactions]] to undefined.
+  // 5. Set promise.[[PromiseRejectReactions]] to undefined.
+  promise->set_reactions_or_result(*value);
+
+  // 6. Set promise.[[PromiseState]] to "fulfilled".
+  promise->set_status(Promise::kFulfilled);
+
+  // 7. Return TriggerPromiseReactions(reactions, value).
+  return TriggerPromiseReactions(isolate, reactions, value,
+                                 PromiseReaction::kFulfill);
+}
+
+// static
+Handle<Object> JSPromise::Reject(Handle<JSPromise> promise,
+                                 Handle<Object> reason, bool debug_event) {
+  Isolate* const isolate = promise->GetIsolate();
+
+  if (debug_event) isolate->debug()->OnPromiseReject(promise, reason);
+  isolate->RunPromiseHook(PromiseHookType::kResolve, promise,
+                          isolate->factory()->undefined_value());
+
+  // 1. Assert: The value of promise.[[PromiseState]] is "pending".
+  DCHECK_EQ(Promise::kPending, promise->status());
+
+  // 2. Let reactions be promise.[[PromiseRejectReactions]].
+  Handle<Object> reactions(promise->reactions(), isolate);
+
+  // 3. Set promise.[[PromiseResult]] to reason.
+  // 4. Set promise.[[PromiseFulfillReactions]] to undefined.
+  // 5. Set promise.[[PromiseRejectReactions]] to undefined.
+  promise->set_reactions_or_result(*reason);
+
+  // 6. Set promise.[[PromiseState]] to "rejected".
+  promise->set_status(Promise::kRejected);
+
+  // 7. If promise.[[PromiseIsHandled]] is false, perform
+  //    HostPromiseRejectionTracker(promise, "reject").
+  if (!promise->has_handler()) {
+    isolate->ReportPromiseReject(promise, reason, kPromiseRejectWithNoHandler);
+  }
+
+  // 8. Return TriggerPromiseReactions(reactions, reason).
+  return TriggerPromiseReactions(isolate, reactions, reason,
+                                 PromiseReaction::kReject);
+}
+
+// static
+MaybeHandle<Object> JSPromise::Resolve(Handle<JSPromise> promise,
+                                       Handle<Object> resolution) {
+  Isolate* const isolate = promise->GetIsolate();
+
+  isolate->RunPromiseHook(PromiseHookType::kResolve, promise,
+                          isolate->factory()->undefined_value());
+
+  // 6. If SameValue(resolution, promise) is true, then
+  if (promise.is_identical_to(resolution)) {
+    // a. Let selfResolutionError be a newly created TypeError object.
+    Handle<Object> self_resolution_error = isolate->factory()->NewTypeError(
+        MessageTemplate::kPromiseCyclic, resolution);
+    // b. Return RejectPromise(promise, selfResolutionError).
+    return Reject(promise, self_resolution_error);
+  }
+
+  // 7. If Type(resolution) is not Object, then
+  if (!resolution->IsJSReceiver()) {
+    // a. Return FulfillPromise(promise, resolution).
+    return Fulfill(promise, resolution);
+  }
+
+  // 8. Let then be Get(resolution, "then").
+  MaybeHandle<Object> then;
+  if (isolate->IsPromiseThenLookupChainIntact(
+          Handle<JSReceiver>::cast(resolution))) {
+    // We can skip the "then" lookup on {resolution} if its [[Prototype]]
+    // is the (initial) Promise.prototype and the Promise#then protector
+    // is intact, as that guards the lookup path for the "then" property
+    // on JSPromise instances which have the (initial) %PromisePrototype%.
+    then = isolate->promise_then();
+  } else {
+    then = JSReceiver::GetProperty(Handle<JSReceiver>::cast(resolution),
+                                   isolate->factory()->then_string());
+  }
+
+  // 9. If then is an abrupt completion, then
+  Handle<Object> then_action;
+  if (!then.ToHandle(&then_action)) {
+    // a. Return RejectPromise(promise, then.[[Value]]).
+    Handle<Object> reason(isolate->pending_exception(), isolate);
+    isolate->clear_pending_exception();
+    return Reject(promise, reason, false);
+  }
+
+  // 10. Let thenAction be then.[[Value]].
+  // 11. If IsCallable(thenAction) is false, then
+  if (!then_action->IsCallable()) {
+    // a. Return FulfillPromise(promise, resolution).
+    return Fulfill(promise, resolution);
+  }
+
+  // 12. Perform EnqueueJob("PromiseJobs", PromiseResolveThenableJob,
+  //                        «promise, resolution, thenAction»).
+  Handle<PromiseResolveThenableJobTask> task =
+      isolate->factory()->NewPromiseResolveThenableJobTask(
+          promise, Handle<JSReceiver>::cast(then_action),
+          Handle<JSReceiver>::cast(resolution), isolate->native_context());
+  if (isolate->debug()->is_active() && resolution->IsJSPromise()) {
+    // Mark the dependency of the new {promise} on the {resolution}.
+    Object::SetProperty(resolution,
+                        isolate->factory()->promise_handled_by_symbol(),
+                        promise, LanguageMode::kStrict)
+        .Check();
+  }
+  isolate->EnqueueMicrotask(task);
+
+  // 13. Return undefined.
+  return isolate->factory()->undefined_value();
+}
+
+// static
+MaybeHandle<JSPromise> JSPromise::From(Handle<HeapObject> object) {
+  Isolate* const isolate = object->GetIsolate();
+  if (object->IsJSPromise()) {
+    return Handle<JSPromise>::cast(object);
+  } else if (object->IsPromiseCapability()) {
+    Handle<PromiseCapability> capability =
+        Handle<PromiseCapability>::cast(object);
+    if (capability->promise()->IsJSPromise()) {
+      return handle(JSPromise::cast(capability->promise()), isolate);
+    }
+  } else if (object->IsJSGeneratorObject()) {
+    Handle<JSGeneratorObject> generator =
+        Handle<JSGeneratorObject>::cast(object);
+    Handle<Object> handled_by = JSObject::GetDataProperty(
+        generator, isolate->factory()->generator_outer_promise_symbol());
+    if (handled_by->IsJSPromise()) return Handle<JSPromise>::cast(handled_by);
+  }
+  return MaybeHandle<JSPromise>();
+}
+
+// static
+Handle<Object> JSPromise::TriggerPromiseReactions(Isolate* isolate,
+                                                  Handle<Object> reactions,
+                                                  Handle<Object> argument,
+                                                  PromiseReaction::Type type) {
+  DCHECK(reactions->IsSmi() || reactions->IsPromiseReaction());
+
+  // We need to reverse the {reactions} here, since we record them
+  // on the JSPromise in the reverse order.
+  {
+    DisallowHeapAllocation no_gc;
+    Object* current = *reactions;
+    Object* reversed = Smi::kZero;
+    while (!current->IsSmi()) {
+      Object* next = PromiseReaction::cast(current)->next();
+      PromiseReaction::cast(current)->set_next(reversed);
+      reversed = current;
+      current = next;
+    }
+    reactions = handle(reversed, isolate);
+  }
+
+  // Morph the {reactions} into PromiseReactionJobTasks
+  // and push them onto the microtask queue.
+  while (!reactions->IsSmi()) {
+    Handle<HeapObject> task = Handle<HeapObject>::cast(reactions);
+    Handle<PromiseReaction> reaction = Handle<PromiseReaction>::cast(task);
+    reactions = handle(reaction->next(), isolate);
+
+    STATIC_ASSERT(PromiseReaction::kSize == PromiseReactionJobTask::kSize);
+    if (type == PromiseReaction::kFulfill) {
+      task->synchronized_set_map(
+          isolate->heap()->promise_fulfill_reaction_job_task_map());
+      Handle<PromiseFulfillReactionJobTask>::cast(task)->set_argument(
+          *argument);
+      Handle<PromiseFulfillReactionJobTask>::cast(task)->set_context(
+          *isolate->native_context());
+      STATIC_ASSERT(PromiseReaction::kFulfillHandlerOffset ==
+                    PromiseFulfillReactionJobTask::kHandlerOffset);
+      STATIC_ASSERT(PromiseReaction::kPayloadOffset ==
+                    PromiseFulfillReactionJobTask::kPayloadOffset);
+    } else {
+      DisallowHeapAllocation no_gc;
+      HeapObject* handler = reaction->reject_handler();
+      task->synchronized_set_map(
+          isolate->heap()->promise_reject_reaction_job_task_map());
+      Handle<PromiseRejectReactionJobTask>::cast(task)->set_argument(*argument);
+      Handle<PromiseRejectReactionJobTask>::cast(task)->set_context(
+          *isolate->native_context());
+      Handle<PromiseRejectReactionJobTask>::cast(task)->set_handler(handler);
+      STATIC_ASSERT(PromiseReaction::kPayloadOffset ==
+                    PromiseRejectReactionJobTask::kPayloadOffset);
+    }
+
+    isolate->EnqueueMicrotask(Handle<PromiseReactionJobTask>::cast(task));
+  }
+
+  return isolate->factory()->undefined_value();
+}
+
 namespace {
 
 JSRegExp::Flags RegExpFlagsFromString(Handle<String> flags, bool* success) {
@@ -16249,7 +16410,7 @@ Handle<Derived> HashTable<Derived, Shape>::New(
                      ? at_least_space_for
                      : ComputeCapacity(at_least_space_for);
   if (capacity > HashTable::kMaxCapacity) {
-    v8::internal::Heap::FatalProcessOutOfMemory("invalid table size", true);
+    isolate->heap()->FatalProcessOutOfMemory("invalid table size");
   }
   return NewInternal(isolate, capacity, pretenure);
 }
@@ -16412,19 +16573,21 @@ bool HashTable<Derived, Shape>::HasSufficientCapacityToAdd(
 }
 
 template <typename Derived, typename Shape>
-Handle<Derived> HashTable<Derived, Shape>::Shrink(Handle<Derived> table) {
+Handle<Derived> HashTable<Derived, Shape>::Shrink(Handle<Derived> table,
+                                                  int additionalCapacity) {
   int capacity = table->Capacity();
   int nof = table->NumberOfElements();
 
   // Shrink to fit the number of elements if only a quarter of the
   // capacity is filled with elements.
   if (nof > (capacity >> 2)) return table;
-  // Allocate a new dictionary with room for at least the current
-  // number of elements. The allocation method will make sure that
-  // there is extra room in the dictionary for additions. Don't go
-  // lower than room for 16 elements.
-  int at_least_room_for = nof;
-  if (at_least_room_for < 16) return table;
+  // Allocate a new dictionary with room for at least the current number of
+  // elements + {additionalCapacity}. The allocation method will make sure that
+  // there is extra room in the dictionary for additions. Don't go lower than
+  // room for {kMinShrinkCapacity} elements.
+  int at_least_room_for = nof + additionalCapacity;
+  DCHECK_LE(at_least_room_for, capacity);
+  if (at_least_room_for < Derived::kMinShrinkCapacity) return table;
 
   Isolate* isolate = table->GetIsolate();
   const int kMinCapacityForPretenure = 256;
@@ -16464,10 +16627,6 @@ template class HashTable<CompilationCacheTable, CompilationCacheShape>;
 
 template class HashTable<ObjectHashTable, ObjectHashTableShape>;
 
-template class HashTable<WeakHashTable, WeakHashTableShape>;
-
-template class HashTable<TemplateMap, TemplateMapShape>;
-
 template class Dictionary<NameDictionary, NameDictionaryShape>;
 
 template class Dictionary<GlobalDictionary, GlobalDictionaryShape>;
@@ -16478,6 +16637,12 @@ template class EXPORT_TEMPLATE_DEFINE(
 template class EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
     Dictionary<NumberDictionary, NumberDictionaryShape>;
 
+template class EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
+    HashTable<SimpleNumberDictionary, SimpleNumberDictionaryShape>;
+
+template class EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
+    Dictionary<SimpleNumberDictionary, SimpleNumberDictionaryShape>;
+
 template Handle<NameDictionary>
 BaseNameDictionary<NameDictionary, NameDictionaryShape>::New(
     Isolate*, int n, PretenureFlag pretenure, MinimumCapacity capacity_option);
@@ -16490,6 +16655,11 @@ template Handle<NumberDictionary>
     Dictionary<NumberDictionary, NumberDictionaryShape>::AtPut(
         Handle<NumberDictionary>, uint32_t, Handle<Object>, PropertyDetails);
 
+template Handle<SimpleNumberDictionary>
+    Dictionary<SimpleNumberDictionary, SimpleNumberDictionaryShape>::AtPut(
+        Handle<SimpleNumberDictionary>, uint32_t, Handle<Object>,
+        PropertyDetails);
+
 template Object* Dictionary<
     NumberDictionary, NumberDictionaryShape>::SlowReverseLookup(Object* value);
 
@@ -16504,6 +16674,10 @@ template Handle<NumberDictionary>
 Dictionary<NumberDictionary, NumberDictionaryShape>::DeleteEntry(
     Handle<NumberDictionary>, int);
 
+template Handle<SimpleNumberDictionary>
+Dictionary<SimpleNumberDictionary, SimpleNumberDictionaryShape>::DeleteEntry(
+    Handle<SimpleNumberDictionary>, int);
+
 template Handle<NameDictionary>
 HashTable<NameDictionary, NameDictionaryShape>::New(Isolate*, int,
                                                     PretenureFlag,
@@ -16514,8 +16688,9 @@ HashTable<ObjectHashSet, ObjectHashSetShape>::New(Isolate*, int n,
                                                   PretenureFlag,
                                                   MinimumCapacity);
 
-template Handle<NameDictionary> HashTable<
-    NameDictionary, NameDictionaryShape>::Shrink(Handle<NameDictionary>);
+template Handle<NameDictionary>
+HashTable<NameDictionary, NameDictionaryShape>::Shrink(Handle<NameDictionary>,
+                                                       int additionalCapacity);
 
 template Handle<NameDictionary>
 BaseNameDictionary<NameDictionary, NameDictionaryShape>::Add(
@@ -16537,6 +16712,11 @@ template Handle<NameDictionary>
 BaseNameDictionary<NameDictionary, NameDictionaryShape>::EnsureCapacity(
     Handle<NameDictionary>, int);
 
+template Handle<SimpleNumberDictionary>
+Dictionary<SimpleNumberDictionary, SimpleNumberDictionaryShape>::Add(
+    Handle<SimpleNumberDictionary>, uint32_t, Handle<Object>, PropertyDetails,
+    int*);
+
 template int Dictionary<GlobalDictionary,
                         GlobalDictionaryShape>::NumberOfEnumerableProperties();
 
@@ -16692,63 +16872,6 @@ size_t JSTypedArray::element_size() {
   }
 }
 
-// static
-MaybeHandle<JSTypedArray> JSTypedArray::Create(Isolate* isolate,
-                                               Handle<Object> default_ctor,
-                                               int argc, Handle<Object>* argv,
-                                               const char* method_name) {
-  // 1. Let newTypedArray be ? Construct(constructor, argumentList).
-  Handle<Object> new_obj;
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, new_obj,
-                             Execution::New(isolate, default_ctor, argc, argv),
-                             JSTypedArray);
-
-  // 2. Perform ? ValidateTypedArray(newTypedArray).
-  Handle<JSTypedArray> new_array;
-  ASSIGN_RETURN_ON_EXCEPTION(
-      isolate, new_array, JSTypedArray::Validate(isolate, new_obj, method_name),
-      JSTypedArray);
-
-  // 3. If argumentList is a List of a single Number, then
-  // If newTypedArray.[[ArrayLength]] < size, throw a TypeError exception.
-  DCHECK_IMPLIES(argc == 1, argv[0]->IsSmi());
-  if (argc == 1 && new_array->length_value() < argv[0]->Number()) {
-    const MessageTemplate::Template message =
-        MessageTemplate::kTypedArrayTooShort;
-    THROW_NEW_ERROR(isolate, NewTypeError(message), JSTypedArray);
-  }
-
-  // 4. Return newTypedArray.
-  return new_array;
-}
-
-// static
-MaybeHandle<JSTypedArray> JSTypedArray::SpeciesCreate(
-    Isolate* isolate, Handle<JSTypedArray> exemplar, int argc,
-    Handle<Object>* argv, const char* method_name) {
-  // 1. Assert: exemplar is an Object that has a [[TypedArrayName]] internal
-  // slot.
-  DCHECK(exemplar->IsJSTypedArray());
-
-  // 2. Let defaultConstructor be the intrinsic object listed in column one of
-  // Table 51 for exemplar.[[TypedArrayName]].
-  Handle<JSFunction> default_ctor =
-      JSTypedArray::DefaultConstructor(isolate, exemplar);
-
-  // 3. Let constructor be ? SpeciesConstructor(exemplar, defaultConstructor).
-  Handle<Object> ctor = default_ctor;
-  if (!exemplar->HasJSTypedArrayPrototype(isolate) ||
-      !isolate->IsArraySpeciesLookupChainIntact()) {
-    ASSIGN_RETURN_ON_EXCEPTION(
-        isolate, ctor,
-        Object::SpeciesConstructor(isolate, exemplar, default_ctor),
-        JSTypedArray);
-  }
-
-  // 4. Return ? TypedArrayCreate(constructor, argumentList).
-  return Create(isolate, ctor, argc, argv, method_name);
-}
-
 void JSGlobalObject::InvalidatePropertyCell(Handle<JSGlobalObject> global,
                                             Handle<Name> name) {
   // Regardless of whether the property is there or not invalidate
@@ -16973,25 +17096,46 @@ Handle<String> StringTable::LookupKey(Isolate* isolate, StringTableKey* key) {
     return handle(String::cast(table->KeyAt(entry)), isolate);
   }
 
+  table = StringTable::CautiousShrink(table);
   // Adding new string. Grow table if needed.
   table = StringTable::EnsureCapacity(table, 1);
+  isolate->heap()->SetRootStringTable(*table);
+
+  return AddKeyNoResize(isolate, key);
+}
 
+Handle<String> StringTable::AddKeyNoResize(Isolate* isolate,
+                                           StringTableKey* key) {
+  Handle<StringTable> table = isolate->factory()->string_table();
+  DCHECK(table->HasSufficientCapacityToAdd(1));
   // Create string object.
   Handle<String> string = key->AsHandle(isolate);
   // There must be no attempts to internalize strings that could throw
   // InvalidStringLength error.
   CHECK(!string.is_null());
   DCHECK(string->HasHashCode());
+  DCHECK_EQ(table->FindEntry(key), kNotFound);
 
   // Add the new string and return it along with the string table.
-  entry = table->FindInsertionEntry(key->Hash());
+  int entry = table->FindInsertionEntry(key->Hash());
   table->set(EntryToIndex(entry), *string);
   table->ElementAdded();
 
-  isolate->heap()->SetRootStringTable(*table);
   return Handle<String>::cast(string);
 }
 
+Handle<StringTable> StringTable::CautiousShrink(Handle<StringTable> table) {
+  // Only shrink if the table is very empty to avoid performance penalty.
+  int capacity = table->Capacity();
+  int nof = table->NumberOfElements();
+  if (capacity <= StringTable::kMinCapacity) return table;
+  if (nof > (capacity / kMaxEmptyFactor)) return table;
+  // Make sure that after shrinking the table is half empty (aka. has capacity
+  // for another {nof} elements).
+  DCHECK_LE(nof * 2, capacity);
+  return Shrink(table, nof);
+}
+
 namespace {
 
 class StringTableNoAllocateKey : public StringTableKey {
@@ -17007,12 +17151,22 @@ class StringTableNoAllocateKey : public StringTableKey {
       special_flattening_ = true;
       uint32_t hash_field = 0;
       if (one_byte_) {
-        one_byte_content_ = new uint8_t[length];
+        if (V8_LIKELY(length <=
+                      static_cast<int>(arraysize(one_byte_buffer_)))) {
+          one_byte_content_ = one_byte_buffer_;
+        } else {
+          one_byte_content_ = new uint8_t[length];
+        }
         String::WriteToFlat(string, one_byte_content_, 0, length);
         hash_field =
             StringHasher::HashSequentialString(one_byte_content_, length, seed);
       } else {
-        two_byte_content_ = new uint16_t[length];
+        if (V8_LIKELY(length <=
+                      static_cast<int>(arraysize(two_byte_buffer_)))) {
+          two_byte_content_ = two_byte_buffer_;
+        } else {
+          two_byte_content_ = new uint16_t[length];
+        }
         String::WriteToFlat(string, two_byte_content_, 0, length);
         hash_field =
             StringHasher::HashSequentialString(two_byte_content_, length, seed);
@@ -17030,9 +17184,9 @@ class StringTableNoAllocateKey : public StringTableKey {
 
   ~StringTableNoAllocateKey() {
     if (one_byte_) {
-      delete[] one_byte_content_;
+      if (one_byte_content_ != one_byte_buffer_) delete[] one_byte_content_;
     } else {
-      delete[] two_byte_content_;
+      if (two_byte_content_ != two_byte_buffer_) delete[] two_byte_content_;
     }
   }
 
@@ -17106,6 +17260,10 @@ class StringTableNoAllocateKey : public StringTableKey {
     uint8_t* one_byte_content_;
     uint16_t* two_byte_content_;
   };
+  union {
+    uint8_t one_byte_buffer_[256];
+    uint16_t two_byte_buffer_[128];
+  };
 };
 
 }  // namespace
@@ -17235,8 +17393,9 @@ int SearchLiteralsMapEntry(CompilationCacheTable* cache, int cache_entry,
   return -1;
 }
 
-void AddToLiteralsMap(Handle<CompilationCacheTable> cache, int cache_entry,
-                      Handle<Context> native_context, Handle<Cell> literals) {
+void AddToFeedbackCellsMap(Handle<CompilationCacheTable> cache, int cache_entry,
+                           Handle<Context> native_context,
+                           Handle<FeedbackCell> feedback_cell) {
   Isolate* isolate = native_context->GetIsolate();
   DCHECK(native_context->IsNativeContext());
   STATIC_ASSERT(kLiteralEntryLength == 2);
@@ -17255,7 +17414,7 @@ void AddToLiteralsMap(Handle<CompilationCacheTable> cache, int cache_entry,
     if (entry >= 0) {
       // Just set the code of the entry.
       Handle<WeakCell> literals_cell =
-          isolate->factory()->NewWeakCell(literals);
+          isolate->factory()->NewWeakCell(feedback_cell);
       old_literals_map->set(entry + kLiteralLiteralsOffset, *literals_cell);
       return;
     }
@@ -17280,7 +17439,8 @@ void AddToLiteralsMap(Handle<CompilationCacheTable> cache, int cache_entry,
     }
   }
 
-  Handle<WeakCell> literals_cell = isolate->factory()->NewWeakCell(literals);
+  Handle<WeakCell> literals_cell =
+      isolate->factory()->NewWeakCell(feedback_cell);
   WeakCell* context_cell = native_context->self_weak_cell();
 
   new_literals_map->set(entry + kLiteralContextOffset, context_cell);
@@ -17292,7 +17452,7 @@ void AddToLiteralsMap(Handle<CompilationCacheTable> cache, int cache_entry,
         WeakCell::cast(new_literals_map->get(i + kLiteralContextOffset));
     DCHECK(cell->cleared() || cell->value()->IsNativeContext());
     cell = WeakCell::cast(new_literals_map->get(i + kLiteralLiteralsOffset));
-    DCHECK(cell->cleared() || (cell->value()->IsCell()));
+    DCHECK(cell->cleared() || (cell->value()->IsFeedbackCell()));
   }
 #endif
 
@@ -17302,9 +17462,9 @@ void AddToLiteralsMap(Handle<CompilationCacheTable> cache, int cache_entry,
   }
 }
 
-Cell* SearchLiteralsMap(CompilationCacheTable* cache, int cache_entry,
-                        Context* native_context) {
-  Cell* result = nullptr;
+FeedbackCell* SearchLiteralsMap(CompilationCacheTable* cache, int cache_entry,
+                                Context* native_context) {
+  FeedbackCell* result = nullptr;
   int entry = SearchLiteralsMapEntry(cache, cache_entry, native_context);
   if (entry >= 0) {
     FixedArray* literals_map = FixedArray::cast(cache->get(cache_entry));
@@ -17312,37 +17472,33 @@ Cell* SearchLiteralsMap(CompilationCacheTable* cache, int cache_entry,
     WeakCell* cell =
         WeakCell::cast(literals_map->get(entry + kLiteralLiteralsOffset));
 
-    result = cell->cleared() ? nullptr : Cell::cast(cell->value());
+    result = cell->cleared() ? nullptr : FeedbackCell::cast(cell->value());
   }
-  DCHECK(result == nullptr || result->IsCell());
+  DCHECK(result == nullptr || result->IsFeedbackCell());
   return result;
 }
 
 }  // namespace
 
-InfoVectorPair CompilationCacheTable::LookupScript(Handle<String> src,
-                                                   Handle<Context> context,
-                                                   LanguageMode language_mode) {
-  InfoVectorPair empty_result;
+MaybeHandle<SharedFunctionInfo> CompilationCacheTable::LookupScript(
+    Handle<String> src, Handle<Context> context, LanguageMode language_mode) {
   Handle<SharedFunctionInfo> shared(context->closure()->shared());
   StringSharedKey key(src, shared, language_mode, kNoSourcePosition);
   int entry = FindEntry(&key);
-  if (entry == kNotFound) return empty_result;
+  if (entry == kNotFound) return MaybeHandle<SharedFunctionInfo>();
   int index = EntryToIndex(entry);
-  if (!get(index)->IsFixedArray()) return empty_result;
+  if (!get(index)->IsFixedArray()) return MaybeHandle<SharedFunctionInfo>();
   Object* obj = get(index + 1);
   if (obj->IsSharedFunctionInfo()) {
-    Cell* literals =
-        SearchLiteralsMap(this, index + 2, context->native_context());
-    return InfoVectorPair(SharedFunctionInfo::cast(obj), literals);
+    return handle(SharedFunctionInfo::cast(obj));
   }
-  return empty_result;
+  return MaybeHandle<SharedFunctionInfo>();
 }
 
-InfoVectorPair CompilationCacheTable::LookupEval(
+InfoCellPair CompilationCacheTable::LookupEval(
     Handle<String> src, Handle<SharedFunctionInfo> outer_info,
     Handle<Context> native_context, LanguageMode language_mode, int position) {
-  InfoVectorPair empty_result;
+  InfoCellPair empty_result;
   StringSharedKey key(src, outer_info, language_mode, position);
   int entry = FindEntry(&key);
   if (entry == kNotFound) return empty_result;
@@ -17350,9 +17506,9 @@ InfoVectorPair CompilationCacheTable::LookupEval(
   if (!get(index)->IsFixedArray()) return empty_result;
   Object* obj = get(EntryToIndex(entry) + 1);
   if (obj->IsSharedFunctionInfo()) {
-    Cell* literals =
+    FeedbackCell* feedback_cell =
         SearchLiteralsMap(this, EntryToIndex(entry) + 2, *native_context);
-    return InfoVectorPair(SharedFunctionInfo::cast(obj), literals);
+    return InfoCellPair(SharedFunctionInfo::cast(obj), feedback_cell);
   }
   return empty_result;
 }
@@ -17386,7 +17542,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::Put(
 Handle<CompilationCacheTable> CompilationCacheTable::PutScript(
     Handle<CompilationCacheTable> cache, Handle<String> src,
     Handle<Context> context, LanguageMode language_mode,
-    Handle<SharedFunctionInfo> value, Handle<Cell> literals) {
+    Handle<SharedFunctionInfo> value) {
   Isolate* isolate = cache->GetIsolate();
   Handle<SharedFunctionInfo> shared(context->closure()->shared());
   Handle<Context> native_context(context->native_context());
@@ -17396,7 +17552,6 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutScript(
   int entry = cache->FindInsertionEntry(key.Hash());
   cache->set(EntryToIndex(entry), *k);
   cache->set(EntryToIndex(entry) + 1, *value);
-  AddToLiteralsMap(cache, EntryToIndex(entry) + 2, native_context, literals);
   cache->ElementAdded();
   return cache;
 }
@@ -17404,7 +17559,8 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutScript(
 Handle<CompilationCacheTable> CompilationCacheTable::PutEval(
     Handle<CompilationCacheTable> cache, Handle<String> src,
     Handle<SharedFunctionInfo> outer_info, Handle<SharedFunctionInfo> value,
-    Handle<Context> native_context, Handle<Cell> literals, int position) {
+    Handle<Context> native_context, Handle<FeedbackCell> feedback_cell,
+    int position) {
   Isolate* isolate = cache->GetIsolate();
   StringSharedKey key(src, outer_info, value->language_mode(), position);
   {
@@ -17413,11 +17569,11 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutEval(
     if (entry != kNotFound) {
       cache->set(EntryToIndex(entry), *k);
       cache->set(EntryToIndex(entry) + 1, *value);
-      // AddToLiteralsMap may allocate a new sub-array to live in the entry,
-      // but it won't change the cache array. Therefore EntryToIndex and
-      // entry remains correct.
-      AddToLiteralsMap(cache, EntryToIndex(entry) + 2, native_context,
-                       literals);
+      // AddToFeedbackCellsMap may allocate a new sub-array to live in the
+      // entry, but it won't change the cache array. Therefore EntryToIndex
+      // and entry remains correct.
+      AddToFeedbackCellsMap(cache, EntryToIndex(entry) + 2, native_context,
+                            feedback_cell);
       return cache;
     }
   }
@@ -17621,6 +17777,13 @@ Handle<Derived> Dictionary<Derived, Shape>::Add(Handle<Derived> dictionary,
   return dictionary;
 }
 
+// static
+Handle<SimpleNumberDictionary> SimpleNumberDictionary::Set(
+    Handle<SimpleNumberDictionary> dictionary, uint32_t key,
+    Handle<Object> value) {
+  return AtPut(dictionary, key, value, PropertyDetails::Empty());
+}
+
 bool NumberDictionary::HasComplexElements() {
   if (!requires_slow_elements()) return false;
   Isolate* isolate = this->GetIsolate();
@@ -18003,48 +18166,6 @@ void ObjectHashTable::RemoveEntry(int entry) {
   ElementRemoved();
 }
 
-
-Object* WeakHashTable::Lookup(Handle<HeapObject> key) {
-  DisallowHeapAllocation no_gc;
-  Isolate* isolate = GetIsolate();
-  DCHECK(IsKey(isolate, *key));
-  int entry = FindEntry(key);
-  if (entry == kNotFound) return isolate->heap()->the_hole_value();
-  return get(EntryToValueIndex(entry));
-}
-
-
-Handle<WeakHashTable> WeakHashTable::Put(Handle<WeakHashTable> table,
-                                         Handle<HeapObject> key,
-                                         Handle<HeapObject> value) {
-  Isolate* isolate = key->GetIsolate();
-  DCHECK(table->IsKey(isolate, *key));
-  int entry = table->FindEntry(key);
-  // Key is already in table, just overwrite value.
-  if (entry != kNotFound) {
-    table->set(EntryToValueIndex(entry), *value);
-    return table;
-  }
-
-  Handle<WeakCell> key_cell = isolate->factory()->NewWeakCell(key);
-
-  // Check whether the hash table should be extended.
-  table = EnsureCapacity(table, 1, TENURED);
-
-  uint32_t hash = ShapeT::Hash(isolate, key);
-  table->AddEntry(table->FindInsertionEntry(hash), key_cell, value);
-  return table;
-}
-
-
-void WeakHashTable::AddEntry(int entry, Handle<WeakCell> key_cell,
-                             Handle<HeapObject> value) {
-  DisallowHeapAllocation no_allocation;
-  set(EntryToIndex(entry), *key_cell);
-  set(EntryToValueIndex(entry), *value);
-  ElementAdded();
-}
-
 template <class Derived, int entrysize>
 Handle<Derived> OrderedHashTable<Derived, entrysize>::Allocate(
     Isolate* isolate, int capacity, PretenureFlag pretenure) {
@@ -18055,7 +18176,7 @@ Handle<Derived> OrderedHashTable<Derived, entrysize>::Allocate(
   // field of this object.
   capacity = base::bits::RoundUpToPowerOfTwo32(Max(kMinCapacity, capacity));
   if (capacity > kMaxCapacity) {
-    v8::internal::Heap::FatalProcessOutOfMemory("invalid table size", true);
+    isolate->heap()->FatalProcessOutOfMemory("invalid table size");
   }
   int num_buckets = capacity / kLoadFactor;
   Handle<FixedArray> backing_store = isolate->factory()->NewFixedArrayWithMap(
@@ -18965,12 +19086,12 @@ Handle<String> JSMessageObject::GetSourceLine() const {
 
 void JSArrayBuffer::Neuter() {
   CHECK(is_neuterable());
+  CHECK(!was_neutered());
   CHECK(is_external());
   set_backing_store(nullptr);
   set_byte_length(Smi::kZero);
-  set_allocation_base(nullptr);
-  set_allocation_length(0);
   set_was_neutered(true);
+  set_is_neuterable(false);
   // Invalidate the neutering protector.
   Isolate* const isolate = GetIsolate();
   if (isolate->IsArrayBufferNeuteringIntact()) {
@@ -18982,45 +19103,41 @@ void JSArrayBuffer::FreeBackingStore() {
   if (allocation_base() == nullptr) {
     return;
   }
-  using AllocationMode = ArrayBuffer::Allocator::AllocationMode;
-  const size_t length = allocation_length();
-  const AllocationMode mode = allocation_mode();
-  FreeBackingStore(GetIsolate(), {allocation_base(), length, mode});
-
+  FreeBackingStore(GetIsolate(),
+                   {allocation_base(), allocation_length(), backing_store(),
+                    allocation_mode(), is_wasm_memory()});
   // Zero out the backing store and allocation base to avoid dangling
   // pointers.
   set_backing_store(nullptr);
-  // TODO(eholk): set_byte_length(0) once we aren't using Smis for the
-  // byte_length. We can't do it now because the GC needs to call
-  // FreeBackingStore while it is collecting.
-  set_allocation_base(nullptr);
-  set_allocation_length(0);
 }
 
 // static
 void JSArrayBuffer::FreeBackingStore(Isolate* isolate, Allocation allocation) {
   if (allocation.mode == ArrayBuffer::Allocator::AllocationMode::kReservation) {
-    // TODO(eholk): check with WasmAllocationTracker to make sure this is
-    // actually a buffer we are tracking.
-    isolate->wasm_engine()->allocation_tracker()->ReleaseAddressSpace(
-        allocation.length);
+    bool needs_free = true;
+    if (allocation.is_wasm_memory) {
+      wasm::WasmMemoryTracker* memory_tracker =
+          isolate->wasm_engine()->memory_tracker();
+      if (memory_tracker->FreeMemoryIfIsWasmMemory(allocation.backing_store)) {
+        needs_free = false;
+      }
+    }
+    if (needs_free) {
+      CHECK(FreePages(allocation.allocation_base, allocation.length));
+    }
+  } else {
+    isolate->array_buffer_allocator()->Free(allocation.allocation_base,
+                                            allocation.length);
   }
-
-  isolate->array_buffer_allocator()->Free(allocation.allocation_base,
-                                          allocation.length, allocation.mode);
 }
 
-void JSArrayBuffer::Setup(Handle<JSArrayBuffer> array_buffer, Isolate* isolate,
-                          bool is_external, void* data, size_t allocated_length,
-                          SharedFlag shared) {
-  return Setup(array_buffer, isolate, is_external, data, allocated_length, data,
-               allocated_length, shared);
+void JSArrayBuffer::set_is_wasm_memory(bool is_wasm_memory) {
+  set_bit_field(IsWasmMemory::update(bit_field(), is_wasm_memory));
 }
 
 void JSArrayBuffer::Setup(Handle<JSArrayBuffer> array_buffer, Isolate* isolate,
-                          bool is_external, void* allocation_base,
-                          size_t allocation_length, void* data,
-                          size_t byte_length, SharedFlag shared) {
+                          bool is_external, void* data, size_t byte_length,
+                          SharedFlag shared, bool is_wasm_memory) {
   DCHECK_EQ(array_buffer->GetEmbedderFieldCount(),
             v8::ArrayBuffer::kEmbedderFieldCount);
   for (int i = 0; i < v8::ArrayBuffer::kEmbedderFieldCount; i++) {
@@ -19030,6 +19147,7 @@ void JSArrayBuffer::Setup(Handle<JSArrayBuffer> array_buffer, Isolate* isolate,
   array_buffer->set_is_external(is_external);
   array_buffer->set_is_neuterable(shared == SharedFlag::kNotShared);
   array_buffer->set_is_shared(shared == SharedFlag::kShared);
+  array_buffer->set_is_wasm_memory(is_wasm_memory);
 
   Handle<Object> heap_byte_length =
       isolate->factory()->NewNumberFromSize(byte_length);
@@ -19041,9 +19159,6 @@ void JSArrayBuffer::Setup(Handle<JSArrayBuffer> array_buffer, Isolate* isolate,
   // already been promoted.
   array_buffer->set_backing_store(data);
 
-  array_buffer->set_allocation_base(allocation_base);
-  array_buffer->set_allocation_length(allocation_length);
-
   if (data && !is_external) {
     isolate->heap()->RegisterNewArrayBuffer(*array_buffer);
   }
@@ -19105,6 +19220,9 @@ Handle<JSArrayBuffer> JSTypedArray::MaterializeArrayBuffer(
 
   Handle<JSArrayBuffer> buffer(JSArrayBuffer::cast(typed_array->buffer()),
                                isolate);
+  // This code does not know how to materialize from wasm buffers.
+  DCHECK(!buffer->is_wasm_memory());
+
   void* backing_store =
       isolate->array_buffer_allocator()->AllocateUninitialized(
           fixed_typed_array->DataSize());
@@ -19117,8 +19235,6 @@ Handle<JSArrayBuffer> JSTypedArray::MaterializeArrayBuffer(
   // registration method below handles the case of registering a buffer that has
   // already been promoted.
   buffer->set_backing_store(backing_store);
-  buffer->set_allocation_base(backing_store);
-  buffer->set_allocation_length(NumberToSize(buffer->byte_length()));
   // RegisterNewArrayBuffer expects a valid length for adjusting counters.
   isolate->heap()->RegisterNewArrayBuffer(*buffer);
   memcpy(buffer->backing_store(),
@@ -19139,7 +19255,8 @@ Handle<JSArrayBuffer> JSTypedArray::GetBuffer() {
   Handle<JSArrayBuffer> array_buffer(JSArrayBuffer::cast(buffer()),
                                      GetIsolate());
   if (array_buffer->was_neutered() ||
-      array_buffer->backing_store() != nullptr) {
+      array_buffer->backing_store() != nullptr ||
+      array_buffer->is_wasm_memory()) {
     return array_buffer;
   }
   Handle<JSTypedArray> self(this);
@@ -19218,12 +19335,12 @@ PropertyCellType PropertyCell::UpdatedType(Handle<PropertyCell> cell,
       return PropertyCellType::kConstant;
     case PropertyCellType::kConstant:
       if (*value == cell->value()) return PropertyCellType::kConstant;
-    // Fall through.
+      V8_FALLTHROUGH;
     case PropertyCellType::kConstantType:
       if (RemainsConstantType(cell, value)) {
         return PropertyCellType::kConstantType;
       }
-    // Fall through.
+      V8_FALLTHROUGH;
     case PropertyCellType::kMutable:
       return PropertyCellType::kMutable;
   }
@@ -19361,46 +19478,11 @@ MaybeHandle<Name> FunctionTemplateInfo::TryGetCachedPropertyName(
   return MaybeHandle<Name>();
 }
 
-// static
-ElementsKind JSArrayIterator::ElementsKindForInstanceType(InstanceType type) {
-  DCHECK_GE(type, FIRST_ARRAY_ITERATOR_TYPE);
-  DCHECK_LE(type, LAST_ARRAY_ITERATOR_TYPE);
+#undef FIELD_ADDR
+#undef FIELD_ADDR_CONST
+#undef READ_INT32_FIELD
+#undef READ_INT64_FIELD
+#undef READ_BYTE_FIELD
 
-  if (type <= LAST_ARRAY_KEY_ITERATOR_TYPE) {
-    // Should be ignored for key iterators.
-    return PACKED_ELEMENTS;
-  } else {
-    ElementsKind kind;
-    if (type < FIRST_ARRAY_VALUE_ITERATOR_TYPE) {
-      // Convert `type` to a value iterator from an entries iterator
-      type = static_cast<InstanceType>(type +
-                                       (FIRST_ARRAY_VALUE_ITERATOR_TYPE -
-                                        FIRST_ARRAY_KEY_VALUE_ITERATOR_TYPE));
-      DCHECK_GE(type, FIRST_ARRAY_VALUE_ITERATOR_TYPE);
-      DCHECK_LE(type, LAST_ARRAY_ITERATOR_TYPE);
-    }
-
-    if (type <= JS_UINT8_CLAMPED_ARRAY_VALUE_ITERATOR_TYPE) {
-      kind =
-          static_cast<ElementsKind>(FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND +
-                                    (type - FIRST_ARRAY_VALUE_ITERATOR_TYPE));
-      DCHECK_LE(kind, LAST_FIXED_TYPED_ARRAY_ELEMENTS_KIND);
-    } else if (type < JS_GENERIC_ARRAY_VALUE_ITERATOR_TYPE) {
-      kind = static_cast<ElementsKind>(
-          FIRST_FAST_ELEMENTS_KIND +
-          (type - JS_FAST_SMI_ARRAY_VALUE_ITERATOR_TYPE));
-      DCHECK_LE(kind, LAST_FAST_ELEMENTS_KIND);
-    } else {
-      // For any slow element cases, the actual elements kind is not known.
-      // Simply
-      // return a slow elements kind in this case. Users of this function must
-      // not
-      // depend on this.
-      return DICTIONARY_ELEMENTS;
-    }
-    DCHECK_LE(kind, LAST_ELEMENTS_KIND);
-    return kind;
-  }
-}
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects.h b/deps/v8/src/objects.h
index c4e3d972e11..7321a2bd11c 100644
--- a/deps/v8/src/objects.h
+++ b/deps/v8/src/objects.h
@@ -12,7 +12,6 @@
 #include "src/bailout-reason.h"
 #include "src/base/bits.h"
 #include "src/base/flags.h"
-#include "src/builtins/builtins-definitions.h"
 #include "src/checks.h"
 #include "src/elements-kind.h"
 #include "src/field-index.h"
@@ -100,7 +99,7 @@
 //         - ScopeInfo
 //         - ModuleInfo
 //         - ScriptContextTable
-//         - WeakFixedArray
+//         - FixedArrayOfWeakCells
 //         - WasmSharedModuleData
 //         - WasmCompiledModule
 //       - FixedDoubleArray
@@ -140,8 +139,7 @@
 //     - SharedFunctionInfo
 //     - Struct
 //       - AccessorInfo
-//       - PromiseResolveThenableJobInfo
-//       - PromiseReactionJobInfo
+//       - PromiseReaction
 //       - PromiseCapability
 //       - AccessorPair
 //       - AccessCheckInfo
@@ -159,10 +157,18 @@
 //       - SourcePositionTableWithFrameCache
 //       - CodeCache
 //       - PrototypeInfo
+//       - Microtask
+//         - CallbackTask
+//         - CallableTask
+//         - PromiseReactionJobTask
+//           - PromiseFulfillReactionJobTask
+//           - PromiseRejectReactionJobTask
+//         - PromiseResolveThenableJobTask
 //       - Module
 //       - ModuleInfoEntry
 //       - PreParsedScopeData
 //     - WeakCell
+//     - FeedbackCell
 //     - FeedbackVector
 //
 // Formats of Object*:
@@ -184,7 +190,7 @@ enum KeyedAccessStoreMode {
   STANDARD_STORE,
   STORE_TRANSITION_TO_OBJECT,
   STORE_TRANSITION_TO_DOUBLE,
-  STORE_AND_GROW_NO_TRANSITION,
+  STORE_AND_GROW_NO_TRANSITION_HANDLE_COW,
   STORE_AND_GROW_TRANSITION_TO_OBJECT,
   STORE_AND_GROW_TRANSITION_TO_DOUBLE,
   STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS,
@@ -204,21 +210,37 @@ static inline bool IsTransitionStoreMode(KeyedAccessStoreMode store_mode) {
          store_mode == STORE_AND_GROW_TRANSITION_TO_DOUBLE;
 }
 
+static inline bool IsCOWHandlingStoreMode(KeyedAccessStoreMode store_mode) {
+  return store_mode == STORE_NO_TRANSITION_HANDLE_COW ||
+         store_mode == STORE_AND_GROW_NO_TRANSITION_HANDLE_COW;
+}
 
 static inline KeyedAccessStoreMode GetNonTransitioningStoreMode(
-    KeyedAccessStoreMode store_mode) {
-  if (store_mode >= STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
-    return store_mode;
-  }
-  if (store_mode >= STORE_AND_GROW_NO_TRANSITION) {
-    return STORE_AND_GROW_NO_TRANSITION;
+    KeyedAccessStoreMode store_mode, bool receiver_was_cow) {
+  switch (store_mode) {
+    case STORE_AND_GROW_NO_TRANSITION_HANDLE_COW:
+    case STORE_AND_GROW_TRANSITION_TO_OBJECT:
+    case STORE_AND_GROW_TRANSITION_TO_DOUBLE:
+      store_mode = STORE_AND_GROW_NO_TRANSITION_HANDLE_COW;
+      break;
+    case STANDARD_STORE:
+    case STORE_TRANSITION_TO_OBJECT:
+    case STORE_TRANSITION_TO_DOUBLE:
+      store_mode =
+          receiver_was_cow ? STORE_NO_TRANSITION_HANDLE_COW : STANDARD_STORE;
+      break;
+    case STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS:
+    case STORE_NO_TRANSITION_HANDLE_COW:
+      break;
   }
-  return STANDARD_STORE;
+  DCHECK(!IsTransitionStoreMode(store_mode));
+  DCHECK_IMPLIES(receiver_was_cow, IsCOWHandlingStoreMode(store_mode));
+  return store_mode;
 }
 
 
 static inline bool IsGrowStoreMode(KeyedAccessStoreMode store_mode) {
-  return store_mode >= STORE_AND_GROW_NO_TRANSITION &&
+  return store_mode >= STORE_AND_GROW_NO_TRANSITION_HANDLE_COW &&
          store_mode <= STORE_AND_GROW_TRANSITION_TO_DOUBLE;
 }
 
@@ -345,8 +367,11 @@ const int kStubMinorKeyBits = kSmiValueSize - kStubMajorKeyBits - 1;
   V(FIXED_FLOAT32_ARRAY_TYPE)                                   \
   V(FIXED_FLOAT64_ARRAY_TYPE)                                   \
   V(FIXED_UINT8_CLAMPED_ARRAY_TYPE)                             \
+  V(FIXED_BIGINT64_ARRAY_TYPE)                                  \
+  V(FIXED_BIGUINT64_ARRAY_TYPE)                                 \
                                                                 \
   V(FIXED_DOUBLE_ARRAY_TYPE)                                    \
+  V(FEEDBACK_METADATA_TYPE)                                     \
   V(FILLER_TYPE)                                                \
                                                                 \
   V(ACCESS_CHECK_INFO_TYPE)                                     \
@@ -363,21 +388,43 @@ const int kStubMinorKeyBits = kSmiValueSize - kStubMajorKeyBits - 1;
   V(MODULE_INFO_ENTRY_TYPE)                                     \
   V(MODULE_TYPE)                                                \
   V(OBJECT_TEMPLATE_INFO_TYPE)                                  \
-  V(PROMISE_REACTION_JOB_INFO_TYPE)                             \
-  V(PROMISE_RESOLVE_THENABLE_JOB_INFO_TYPE)                     \
+  V(PROMISE_CAPABILITY_TYPE)                                    \
+  V(PROMISE_REACTION_TYPE)                                      \
   V(PROTOTYPE_INFO_TYPE)                                        \
   V(SCRIPT_TYPE)                                                \
   V(STACK_FRAME_INFO_TYPE)                                      \
   V(TUPLE2_TYPE)                                                \
   V(TUPLE3_TYPE)                                                \
+  V(WASM_COMPILED_MODULE_TYPE)                                  \
+  V(WASM_DEBUG_INFO_TYPE)                                       \
+  V(WASM_SHARED_MODULE_DATA_TYPE)                               \
+                                                                \
+  V(CALLABLE_TASK_TYPE)                                         \
+  V(CALLBACK_TASK_TYPE)                                         \
+  V(PROMISE_FULFILL_REACTION_JOB_TASK_TYPE)                     \
+  V(PROMISE_REJECT_REACTION_JOB_TASK_TYPE)                      \
+  V(PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE)                     \
                                                                 \
   V(FIXED_ARRAY_TYPE)                                           \
+  V(BOILERPLATE_DESCRIPTION_TYPE)                               \
   V(DESCRIPTOR_ARRAY_TYPE)                                      \
   V(HASH_TABLE_TYPE)                                            \
+  V(SCOPE_INFO_TYPE)                                            \
   V(TRANSITION_ARRAY_TYPE)                                      \
                                                                 \
+  V(BLOCK_CONTEXT_TYPE)                                         \
+  V(CATCH_CONTEXT_TYPE)                                         \
+  V(DEBUG_EVALUATE_CONTEXT_TYPE)                                \
+  V(EVAL_CONTEXT_TYPE)                                          \
+  V(FUNCTION_CONTEXT_TYPE)                                      \
+  V(MODULE_CONTEXT_TYPE)                                        \
+  V(NATIVE_CONTEXT_TYPE)                                        \
+  V(SCRIPT_CONTEXT_TYPE)                                        \
+  V(WITH_CONTEXT_TYPE)                                          \
+                                                                \
   V(CELL_TYPE)                                                  \
   V(CODE_DATA_CONTAINER_TYPE)                                   \
+  V(FEEDBACK_CELL_TYPE)                                         \
   V(FEEDBACK_VECTOR_TYPE)                                       \
   V(LOAD_HANDLER_TYPE)                                          \
   V(PROPERTY_ARRAY_TYPE)                                        \
@@ -387,6 +434,7 @@ const int kStubMinorKeyBits = kSmiValueSize - kStubMajorKeyBits - 1;
   V(SMALL_ORDERED_HASH_SET_TYPE)                                \
   V(STORE_HANDLER_TYPE)                                         \
   V(WEAK_CELL_TYPE)                                             \
+  V(WEAK_FIXED_ARRAY_TYPE)                                      \
                                                                 \
   V(JS_PROXY_TYPE)                                              \
   V(JS_GLOBAL_OBJECT_TYPE)                                      \
@@ -399,6 +447,7 @@ const int kStubMinorKeyBits = kSmiValueSize - kStubMajorKeyBits - 1;
                                                                 \
   V(JS_ARGUMENTS_TYPE)                                          \
   V(JS_ARRAY_BUFFER_TYPE)                                       \
+  V(JS_ARRAY_ITERATOR_TYPE)                                     \
   V(JS_ARRAY_TYPE)                                              \
   V(JS_ASYNC_FROM_SYNC_ITERATOR_TYPE)                           \
   V(JS_ASYNC_GENERATOR_OBJECT_TYPE)                             \
@@ -423,8 +472,6 @@ const int kStubMinorKeyBits = kSmiValueSize - kStubMajorKeyBits - 1;
   V(JS_TYPED_ARRAY_TYPE)                                        \
   V(JS_DATA_VIEW_TYPE)                                          \
                                                                 \
-  ARRAY_ITERATOR_TYPE_LIST(V)                                   \
-                                                                \
   V(WASM_INSTANCE_TYPE)                                         \
   V(WASM_MEMORY_TYPE)                                           \
   V(WASM_MODULE_TYPE)                                           \
@@ -486,47 +533,6 @@ const int kStubMinorKeyBits = kSmiValueSize - kStubMajorKeyBits - 1;
   V(THIN_ONE_BYTE_STRING_TYPE, ThinString::kSize, thin_one_byte_string,       \
     ThinOneByteString)
 
-#define ARRAY_ITERATOR_TYPE_LIST(V)                     \
-  V(JS_TYPED_ARRAY_KEY_ITERATOR_TYPE)                   \
-  V(JS_FAST_ARRAY_KEY_ITERATOR_TYPE)                    \
-  V(JS_GENERIC_ARRAY_KEY_ITERATOR_TYPE)                 \
-                                                        \
-  V(JS_UINT8_ARRAY_KEY_VALUE_ITERATOR_TYPE)             \
-  V(JS_INT8_ARRAY_KEY_VALUE_ITERATOR_TYPE)              \
-  V(JS_UINT16_ARRAY_KEY_VALUE_ITERATOR_TYPE)            \
-  V(JS_INT16_ARRAY_KEY_VALUE_ITERATOR_TYPE)             \
-  V(JS_UINT32_ARRAY_KEY_VALUE_ITERATOR_TYPE)            \
-  V(JS_INT32_ARRAY_KEY_VALUE_ITERATOR_TYPE)             \
-  V(JS_FLOAT32_ARRAY_KEY_VALUE_ITERATOR_TYPE)           \
-  V(JS_FLOAT64_ARRAY_KEY_VALUE_ITERATOR_TYPE)           \
-  V(JS_UINT8_CLAMPED_ARRAY_KEY_VALUE_ITERATOR_TYPE)     \
-                                                        \
-  V(JS_FAST_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE)          \
-  V(JS_FAST_HOLEY_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE)    \
-  V(JS_FAST_ARRAY_KEY_VALUE_ITERATOR_TYPE)              \
-  V(JS_FAST_HOLEY_ARRAY_KEY_VALUE_ITERATOR_TYPE)        \
-  V(JS_FAST_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE)       \
-  V(JS_FAST_HOLEY_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE) \
-  V(JS_GENERIC_ARRAY_KEY_VALUE_ITERATOR_TYPE)           \
-                                                        \
-  V(JS_UINT8_ARRAY_VALUE_ITERATOR_TYPE)                 \
-  V(JS_INT8_ARRAY_VALUE_ITERATOR_TYPE)                  \
-  V(JS_UINT16_ARRAY_VALUE_ITERATOR_TYPE)                \
-  V(JS_INT16_ARRAY_VALUE_ITERATOR_TYPE)                 \
-  V(JS_UINT32_ARRAY_VALUE_ITERATOR_TYPE)                \
-  V(JS_INT32_ARRAY_VALUE_ITERATOR_TYPE)                 \
-  V(JS_FLOAT32_ARRAY_VALUE_ITERATOR_TYPE)               \
-  V(JS_FLOAT64_ARRAY_VALUE_ITERATOR_TYPE)               \
-  V(JS_UINT8_CLAMPED_ARRAY_VALUE_ITERATOR_TYPE)         \
-                                                        \
-  V(JS_FAST_SMI_ARRAY_VALUE_ITERATOR_TYPE)              \
-  V(JS_FAST_HOLEY_SMI_ARRAY_VALUE_ITERATOR_TYPE)        \
-  V(JS_FAST_ARRAY_VALUE_ITERATOR_TYPE)                  \
-  V(JS_FAST_HOLEY_ARRAY_VALUE_ITERATOR_TYPE)            \
-  V(JS_FAST_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE)           \
-  V(JS_FAST_HOLEY_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE)     \
-  V(JS_GENERIC_ARRAY_VALUE_ITERATOR_TYPE)
-
 // A struct is a simple object a set of object-valued fields.  Including an
 // object type in this causes the compiler to generate most of the boilerplate
 // code for the class including allocation and garbage collection routines,
@@ -551,15 +557,24 @@ const int kStubMinorKeyBits = kSmiValueSize - kStubMajorKeyBits - 1;
   V(MODULE_INFO_ENTRY, ModuleInfoEntry, module_info_entry)                   \
   V(MODULE, Module, module)                                                  \
   V(OBJECT_TEMPLATE_INFO, ObjectTemplateInfo, object_template_info)          \
-  V(PROMISE_REACTION_JOB_INFO, PromiseReactionJobInfo,                       \
-    promise_reaction_job_info)                                               \
-  V(PROMISE_RESOLVE_THENABLE_JOB_INFO, PromiseResolveThenableJobInfo,        \
-    promise_resolve_thenable_job_info)                                       \
+  V(PROMISE_CAPABILITY, PromiseCapability, promise_capability)               \
+  V(PROMISE_REACTION, PromiseReaction, promise_reaction)                     \
   V(PROTOTYPE_INFO, PrototypeInfo, prototype_info)                           \
   V(SCRIPT, Script, script)                                                  \
   V(STACK_FRAME_INFO, StackFrameInfo, stack_frame_info)                      \
   V(TUPLE2, Tuple2, tuple2)                                                  \
-  V(TUPLE3, Tuple3, tuple3)
+  V(TUPLE3, Tuple3, tuple3)                                                  \
+  V(WASM_COMPILED_MODULE, WasmCompiledModule, wasm_compiled_module)          \
+  V(WASM_DEBUG_INFO, WasmDebugInfo, wasm_debug_info)                         \
+  V(WASM_SHARED_MODULE_DATA, WasmSharedModuleData, wasm_shared_module_data)  \
+  V(CALLABLE_TASK, CallableTask, callable_task)                              \
+  V(CALLBACK_TASK, CallbackTask, callback_task)                              \
+  V(PROMISE_FULFILL_REACTION_JOB_TASK, PromiseFulfillReactionJobTask,        \
+    promise_fulfill_reaction_job_task)                                       \
+  V(PROMISE_REJECT_REACTION_JOB_TASK, PromiseRejectReactionJobTask,          \
+    promise_reject_reaction_job_task)                                        \
+  V(PROMISE_RESOLVE_THENABLE_JOB_TASK, PromiseResolveThenableJobTask,        \
+    promise_resolve_thenable_job_task)
 
 #define DATA_HANDLER_LIST(V)                        \
   V(LOAD_HANDLER, LoadHandler, 1, load_handler1)    \
@@ -714,8 +729,11 @@ enum InstanceType : uint16_t {
   FIXED_UINT32_ARRAY_TYPE,
   FIXED_FLOAT32_ARRAY_TYPE,
   FIXED_FLOAT64_ARRAY_TYPE,
-  FIXED_UINT8_CLAMPED_ARRAY_TYPE,  // LAST_FIXED_TYPED_ARRAY_TYPE
+  FIXED_UINT8_CLAMPED_ARRAY_TYPE,
+  FIXED_BIGINT64_ARRAY_TYPE,
+  FIXED_BIGUINT64_ARRAY_TYPE,  // LAST_FIXED_TYPED_ARRAY_TYPE
   FIXED_DOUBLE_ARRAY_TYPE,
+  FEEDBACK_METADATA_TYPE,
   FILLER_TYPE,  // LAST_DATA_TYPE
 
   // Structs.
@@ -733,23 +751,44 @@ enum InstanceType : uint16_t {
   MODULE_INFO_ENTRY_TYPE,
   MODULE_TYPE,
   OBJECT_TEMPLATE_INFO_TYPE,
-  PROMISE_REACTION_JOB_INFO_TYPE,
-  PROMISE_RESOLVE_THENABLE_JOB_INFO_TYPE,
+  PROMISE_CAPABILITY_TYPE,
+  PROMISE_REACTION_TYPE,
   PROTOTYPE_INFO_TYPE,
   SCRIPT_TYPE,
   STACK_FRAME_INFO_TYPE,
   TUPLE2_TYPE,
   TUPLE3_TYPE,
+  WASM_COMPILED_MODULE_TYPE,
+  WASM_DEBUG_INFO_TYPE,
+  WASM_SHARED_MODULE_DATA_TYPE,
+
+  CALLABLE_TASK_TYPE,  // FIRST_MICROTASK_TYPE
+  CALLBACK_TASK_TYPE,
+  PROMISE_FULFILL_REACTION_JOB_TASK_TYPE,
+  PROMISE_REJECT_REACTION_JOB_TASK_TYPE,
+  PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE,  // LAST_MICROTASK_TYPE
 
   // FixedArrays.
   FIXED_ARRAY_TYPE,  // FIRST_FIXED_ARRAY_TYPE
+  BOILERPLATE_DESCRIPTION_TYPE,
   DESCRIPTOR_ARRAY_TYPE,
   HASH_TABLE_TYPE,
-  TRANSITION_ARRAY_TYPE,  // LAST_FIXED_ARRAY_TYPE
+  SCOPE_INFO_TYPE,
+  TRANSITION_ARRAY_TYPE,
+  BLOCK_CONTEXT_TYPE,  // FIRST_CONTEXT_TYPE
+  CATCH_CONTEXT_TYPE,
+  DEBUG_EVALUATE_CONTEXT_TYPE,
+  EVAL_CONTEXT_TYPE,
+  FUNCTION_CONTEXT_TYPE,
+  MODULE_CONTEXT_TYPE,
+  NATIVE_CONTEXT_TYPE,
+  SCRIPT_CONTEXT_TYPE,
+  WITH_CONTEXT_TYPE,  // LAST_FIXED_ARRAY_TYPE, LAST_CONTEXT_TYPE
 
   // Misc.
   CELL_TYPE,
   CODE_DATA_CONTAINER_TYPE,
+  FEEDBACK_CELL_TYPE,
   FEEDBACK_VECTOR_TYPE,
   LOAD_HANDLER_TYPE,
   PROPERTY_ARRAY_TYPE,
@@ -759,6 +798,7 @@ enum InstanceType : uint16_t {
   SMALL_ORDERED_HASH_SET_TYPE,
   STORE_HANDLER_TYPE,
   WEAK_CELL_TYPE,
+  WEAK_FIXED_ARRAY_TYPE,
 
   // All the following types are subtypes of JSReceiver, which corresponds to
   // objects in the JS sense. The first and the last type in this range are
@@ -780,6 +820,7 @@ enum InstanceType : uint16_t {
   JS_OBJECT_TYPE,
   JS_ARGUMENTS_TYPE,
   JS_ARRAY_BUFFER_TYPE,
+  JS_ARRAY_ITERATOR_TYPE,
   JS_ARRAY_TYPE,
   JS_ASYNC_FROM_SYNC_ITERATOR_TYPE,
   JS_ASYNC_GENERATOR_OBJECT_TYPE,
@@ -804,11 +845,7 @@ enum InstanceType : uint16_t {
   JS_TYPED_ARRAY_TYPE,
   JS_DATA_VIEW_TYPE,
 
-#define ARRAY_ITERATOR_TYPE(type) type,
-  ARRAY_ITERATOR_TYPE_LIST(ARRAY_ITERATOR_TYPE)
-#undef ARRAY_ITERATOR_TYPE
-
-      WASM_INSTANCE_TYPE,
+  WASM_INSTANCE_TYPE,
   WASM_MEMORY_TYPE,
   WASM_MODULE_TYPE,
   WASM_TABLE_TYPE,
@@ -829,10 +866,16 @@ enum InstanceType : uint16_t {
   LAST_FUNCTION_TYPE = JS_FUNCTION_TYPE,
   // Boundaries for testing if given HeapObject is a subclass of FixedArray.
   FIRST_FIXED_ARRAY_TYPE = FIXED_ARRAY_TYPE,
-  LAST_FIXED_ARRAY_TYPE = TRANSITION_ARRAY_TYPE,
+  LAST_FIXED_ARRAY_TYPE = WITH_CONTEXT_TYPE,
+  // Boundaries for testing if given HeapObject is a Context
+  FIRST_CONTEXT_TYPE = BLOCK_CONTEXT_TYPE,
+  LAST_CONTEXT_TYPE = WITH_CONTEXT_TYPE,
+  // Boundaries for testing if given HeapObject is a subclass of Microtask.
+  FIRST_MICROTASK_TYPE = CALLABLE_TASK_TYPE,
+  LAST_MICROTASK_TYPE = PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE,
   // Boundaries for testing for a fixed typed array.
   FIRST_FIXED_TYPED_ARRAY_TYPE = FIXED_INT8_ARRAY_TYPE,
-  LAST_FIXED_TYPED_ARRAY_TYPE = FIXED_UINT8_CLAMPED_ARRAY_TYPE,
+  LAST_FIXED_TYPED_ARRAY_TYPE = FIXED_BIGUINT64_ARRAY_TYPE,
   // Boundary for promotion to old space.
   LAST_DATA_TYPE = FILLER_TYPE,
   // Boundary for objects represented as JSReceiver (i.e. JSObject or JSProxy).
@@ -852,18 +895,6 @@ enum InstanceType : uint16_t {
   // wrappers.
   LAST_CUSTOM_ELEMENTS_RECEIVER = JS_VALUE_TYPE,
 
-  FIRST_ARRAY_KEY_ITERATOR_TYPE = JS_TYPED_ARRAY_KEY_ITERATOR_TYPE,
-  LAST_ARRAY_KEY_ITERATOR_TYPE = JS_GENERIC_ARRAY_KEY_ITERATOR_TYPE,
-
-  FIRST_ARRAY_KEY_VALUE_ITERATOR_TYPE = JS_UINT8_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-  LAST_ARRAY_KEY_VALUE_ITERATOR_TYPE = JS_GENERIC_ARRAY_KEY_VALUE_ITERATOR_TYPE,
-
-  FIRST_ARRAY_VALUE_ITERATOR_TYPE = JS_UINT8_ARRAY_VALUE_ITERATOR_TYPE,
-  LAST_ARRAY_VALUE_ITERATOR_TYPE = JS_GENERIC_ARRAY_VALUE_ITERATOR_TYPE,
-
-  FIRST_ARRAY_ITERATOR_TYPE = FIRST_ARRAY_KEY_ITERATOR_TYPE,
-  LAST_ARRAY_ITERATOR_TYPE = LAST_ARRAY_VALUE_ITERATOR_TYPE,
-
   FIRST_SET_ITERATOR_TYPE = JS_SET_KEY_VALUE_ITERATOR_TYPE,
   LAST_SET_ITERATOR_TYPE = JS_SET_VALUE_ITERATOR_TYPE,
 
@@ -907,6 +938,7 @@ class FixedArrayBase;
 class PropertyArray;
 class FunctionLiteral;
 class JSGlobalObject;
+class JSPromise;
 class KeyAccumulator;
 class LayoutDescriptor;
 class LookupIterator;
@@ -921,12 +953,12 @@ class RootVisitor;
 class SafepointEntry;
 class SharedFunctionInfo;
 class StringStream;
+class FeedbackCell;
 class FeedbackMetadata;
 class FeedbackVector;
 class WeakCell;
 class TransitionArray;
 class TemplateList;
-class TemplateMap;
 template <typename T>
 class ZoneForwardList;
 
@@ -952,14 +984,16 @@ template <class C> inline bool Is(Object* obj);
   V(AccessCheckNeeded)                    \
   V(ArrayList)                            \
   V(BigInt)                               \
+  V(BigIntWrapper)                        \
   V(BoilerplateDescription)               \
   V(Boolean)                              \
+  V(BooleanWrapper)                       \
   V(BreakPoint)                           \
   V(BreakPointInfo)                       \
   V(ByteArray)                            \
   V(BytecodeArray)                        \
-  V(Callable)                             \
   V(CallHandlerInfo)                      \
+  V(Callable)                             \
   V(Cell)                                 \
   V(ClassBoilerplate)                     \
   V(Code)                                 \
@@ -979,12 +1013,16 @@ template <class C> inline bool Is(Object* obj);
   V(ExternalOneByteString)                \
   V(ExternalString)                       \
   V(ExternalTwoByteString)                \
+  V(FeedbackCell)                         \
   V(FeedbackMetadata)                     \
   V(FeedbackVector)                       \
   V(Filler)                               \
   V(FixedArray)                           \
   V(FixedArrayBase)                       \
   V(FixedArrayExact)                      \
+  V(FixedArrayOfWeakCells)                \
+  V(FixedBigInt64Array)                   \
+  V(FixedBigUint64Array)                  \
   V(FixedDoubleArray)                     \
   V(FixedFloat32Array)                    \
   V(FixedFloat64Array)                    \
@@ -1042,30 +1080,34 @@ template <class C> inline bool Is(Object* obj);
   V(LoadHandler)                          \
   V(Map)                                  \
   V(MapCache)                             \
+  V(Microtask)                            \
   V(ModuleInfo)                           \
   V(MutableHeapNumber)                    \
   V(Name)                                 \
   V(NameDictionary)                       \
   V(NativeContext)                        \
   V(NormalizedMapCache)                   \
+  V(NumberDictionary)                     \
+  V(NumberWrapper)                        \
   V(ObjectHashSet)                        \
   V(ObjectHashTable)                      \
   V(Oddball)                              \
   V(OrderedHashMap)                       \
   V(OrderedHashSet)                       \
   V(PreParsedScopeData)                   \
-  V(PromiseCapability)                    \
+  V(PromiseReactionJobTask)               \
   V(PropertyArray)                        \
   V(PropertyCell)                         \
   V(PropertyDescriptorObject)             \
   V(RegExpMatchInfo)                      \
   V(ScopeInfo)                            \
   V(ScriptContextTable)                   \
-  V(NumberDictionary)                     \
+  V(ScriptWrapper)                        \
   V(SeqOneByteString)                     \
   V(SeqString)                            \
   V(SeqTwoByteString)                     \
   V(SharedFunctionInfo)                   \
+  V(SimpleNumberDictionary)               \
   V(SlicedString)                         \
   V(SloppyArgumentsElements)              \
   V(SmallOrderedHashMap)                  \
@@ -1078,9 +1120,9 @@ template <class C> inline bool Is(Object* obj);
   V(StringWrapper)                        \
   V(Struct)                               \
   V(Symbol)                               \
+  V(SymbolWrapper)                        \
   V(TemplateInfo)                         \
   V(TemplateList)                         \
-  V(TemplateMap)                          \
   V(TemplateObjectDescription)            \
   V(ThinString)                           \
   V(TransitionArray)                      \
@@ -1091,8 +1133,7 @@ template <class C> inline bool Is(Object* obj);
   V(WasmModuleObject)                     \
   V(WasmTableObject)                      \
   V(WeakCell)                             \
-  V(WeakFixedArray)                       \
-  V(WeakHashTable)
+  V(WeakFixedArray)
 
 #define HEAP_OBJECT_TEMPLATE_TYPE_LIST(V) \
   V(Dictionary)                           \
@@ -1210,8 +1251,6 @@ class Object {
   // implementation of a JSObject's elements.
   inline bool HasValidElements();
 
-  inline bool HasSpecificClassOf(String* name);
-
   bool BooleanValue();                                      // ECMA-262 9.2.
 
   // ES6 section 7.2.11 Abstract Relational Comparison
@@ -1304,34 +1343,10 @@ class Object {
   // ES6 section 12.5.6 The typeof Operator
   static Handle<String> TypeOf(Isolate* isolate, Handle<Object> object);
 
-  // ES6 section 12.6 Multiplicative Operators
-  MUST_USE_RESULT static MaybeHandle<Object> Multiply(Isolate* isolate,
-                                                      Handle<Object> lhs,
-                                                      Handle<Object> rhs);
-  MUST_USE_RESULT static MaybeHandle<Object> Divide(Isolate* isolate,
-                                                    Handle<Object> lhs,
-                                                    Handle<Object> rhs);
-  MUST_USE_RESULT static MaybeHandle<Object> Modulus(Isolate* isolate,
-                                                     Handle<Object> lhs,
-                                                     Handle<Object> rhs);
-
   // ES6 section 12.7 Additive Operators
   MUST_USE_RESULT static MaybeHandle<Object> Add(Isolate* isolate,
                                                  Handle<Object> lhs,
                                                  Handle<Object> rhs);
-  MUST_USE_RESULT static MaybeHandle<Object> Subtract(Isolate* isolate,
-                                                      Handle<Object> lhs,
-                                                      Handle<Object> rhs);
-
-  // ES6 section 12.8 Bitwise Shift Operators
-  MUST_USE_RESULT static MaybeHandle<Object> ShiftLeft(Isolate* isolate,
-                                                       Handle<Object> lhs,
-                                                       Handle<Object> rhs);
-  MUST_USE_RESULT static MaybeHandle<Object> ShiftRight(Isolate* isolate,
-                                                        Handle<Object> lhs,
-                                                        Handle<Object> rhs);
-  MUST_USE_RESULT static MaybeHandle<Object> ShiftRightLogical(
-      Isolate* isolate, Handle<Object> lhs, Handle<Object> rhs);
 
   // ES6 section 12.9 Relational Operators
   MUST_USE_RESULT static inline Maybe<bool> GreaterThan(Handle<Object> x,
@@ -1343,17 +1358,6 @@ class Object {
   MUST_USE_RESULT static inline Maybe<bool> LessThanOrEqual(Handle<Object> x,
                                                             Handle<Object> y);
 
-  // ES6 section 12.11 Binary Bitwise Operators
-  MUST_USE_RESULT static MaybeHandle<Object> BitwiseAnd(Isolate* isolate,
-                                                        Handle<Object> lhs,
-                                                        Handle<Object> rhs);
-  MUST_USE_RESULT static MaybeHandle<Object> BitwiseOr(Isolate* isolate,
-                                                       Handle<Object> lhs,
-                                                       Handle<Object> rhs);
-  MUST_USE_RESULT static MaybeHandle<Object> BitwiseXor(Isolate* isolate,
-                                                        Handle<Object> lhs,
-                                                        Handle<Object> rhs);
-
   // ES6 section 7.3.19 OrdinaryHasInstance (C, O).
   MUST_USE_RESULT static MaybeHandle<Object> OrdinaryHasInstance(
       Isolate* isolate, Handle<Object> callable, Handle<Object> object);
@@ -1746,19 +1750,18 @@ class HeapObject: public Object {
   // If it's not performance critical iteration use the non-templatized
   // version.
   void IterateBody(ObjectVisitor* v);
-  void IterateBody(InstanceType type, int object_size, ObjectVisitor* v);
+  void IterateBody(Map* map, int object_size, ObjectVisitor* v);
 
   template <typename ObjectVisitor>
   inline void IterateBodyFast(ObjectVisitor* v);
 
   template <typename ObjectVisitor>
-  inline void IterateBodyFast(InstanceType type, int object_size,
-                              ObjectVisitor* v);
+  inline void IterateBodyFast(Map* map, int object_size, ObjectVisitor* v);
 
   // Returns true if the object contains a tagged value at given offset.
   // It is used for invalid slots filtering. If the offset points outside
   // of the object or to the map word, the result is UNDEFINED (!!!).
-  bool IsValidSlot(int offset);
+  bool IsValidSlot(Map* map, int offset);
 
   // Returns the heap object's size in bytes
   inline int Size() const;
@@ -1773,6 +1776,7 @@ class HeapObject: public Object {
   // Does not invoke write barrier, so should only be assigned to
   // during marking GC.
   static inline Object** RawField(HeapObject* obj, int offset);
+  static inline MaybeObject** RawMaybeWeakField(HeapObject* obj, int offset);
 
   DECL_CAST(HeapObject)
 
@@ -1800,7 +1804,7 @@ class HeapObject: public Object {
   static void VerifyHeapPointer(Object* p);
 #endif
 
-  inline AllocationAlignment RequiredAlignment() const;
+  static inline AllocationAlignment RequiredAlignment(Map* map);
 
   // Whether the object needs rehashing. That is the case if the object's
   // content depends on FLAG_hash_seed. When the object is deserialized into
@@ -1900,7 +1904,10 @@ enum AccessorComponent {
   ACCESSOR_SETTER
 };
 
-enum class GetKeysConversion { kKeepNumbers, kConvertToString };
+enum class GetKeysConversion {
+  kKeepNumbers = static_cast<int>(v8::KeyConversionMode::kKeepNumbers),
+  kConvertToString = static_cast<int>(v8::KeyConversionMode::kConvertToString)
+};
 
 enum class KeyCollectionMode {
   kOwnOnly = static_cast<int>(v8::KeyCollectionMode::kOwnOnly),
@@ -2182,10 +2189,12 @@ class JSReceiver: public HeapObject {
       Handle<JSReceiver> object);
 
   MUST_USE_RESULT static MaybeHandle<FixedArray> GetOwnValues(
-      Handle<JSReceiver> object, PropertyFilter filter);
+      Handle<JSReceiver> object, PropertyFilter filter,
+      bool try_fast_path = true);
 
   MUST_USE_RESULT static MaybeHandle<FixedArray> GetOwnEntries(
-      Handle<JSReceiver> object, PropertyFilter filter);
+      Handle<JSReceiver> object, PropertyFilter filter,
+      bool try_fast_path = true);
 
   static const int kHashMask = PropertyArray::HashField::kMask;
 
@@ -2273,6 +2282,8 @@ class JSObject: public JSReceiver {
   inline bool HasFixedUint32Elements();
   inline bool HasFixedFloat32Elements();
   inline bool HasFixedFloat64Elements();
+  inline bool HasFixedBigInt64Elements();
+  inline bool HasFixedBigUint64Elements();
 
   inline bool HasFastArgumentsElements();
   inline bool HasSlowArgumentsElements();
@@ -2380,7 +2391,7 @@ class JSObject: public JSReceiver {
   // Utility used by many Array builtins and runtime functions
   static inline bool PrototypeHasNoElements(Isolate* isolate, JSObject* object);
 
-  // Alternative implementation of WeakFixedArray::NullCallback.
+  // Alternative implementation of FixedArrayOfWeakCells::NullCallback.
   class PrototypeRegistryCompactionCallback {
    public:
     static void Callback(Object* value, int old_index, int new_index);
@@ -2872,86 +2883,6 @@ class Tuple3 : public Tuple2 {
   DISALLOW_IMPLICIT_CONSTRUCTORS(Tuple3);
 };
 
-class PromiseCapability : public Tuple3 {
- public:
-  DECL_CAST(PromiseCapability)
-  DECL_PRINTER(PromiseCapability)
-  DECL_VERIFIER(PromiseCapability)
-
-  DECL_ACCESSORS(promise, Object)
-  DECL_ACCESSORS(resolve, Object)
-  DECL_ACCESSORS(reject, Object)
-
-  static const int kPromiseOffset = Tuple3::kValue1Offset;
-  static const int kResolveOffset = Tuple3::kValue2Offset;
-  static const int kRejectOffset = Tuple3::kValue3Offset;
-  static const int kSize = Tuple3::kSize;
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(PromiseCapability);
-};
-
-// A container struct to hold state required for PromiseResolveThenableJob.
-class PromiseResolveThenableJobInfo : public Struct {
- public:
-  DECL_ACCESSORS(thenable, JSReceiver)
-  DECL_ACCESSORS(then, JSReceiver)
-  DECL_ACCESSORS(resolve, JSFunction)
-  DECL_ACCESSORS(reject, JSFunction)
-
-  DECL_ACCESSORS(context, Context)
-
-  static const int kThenableOffset = Struct::kHeaderSize;
-  static const int kThenOffset = kThenableOffset + kPointerSize;
-  static const int kResolveOffset = kThenOffset + kPointerSize;
-  static const int kRejectOffset = kResolveOffset + kPointerSize;
-  static const int kContextOffset = kRejectOffset + kPointerSize;
-  static const int kSize = kContextOffset + kPointerSize;
-
-  DECL_CAST(PromiseResolveThenableJobInfo)
-  DECL_PRINTER(PromiseResolveThenableJobInfo)
-  DECL_VERIFIER(PromiseResolveThenableJobInfo)
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(PromiseResolveThenableJobInfo);
-};
-
-class JSPromise;
-
-// Struct to hold state required for PromiseReactionJob.
-class PromiseReactionJobInfo : public Struct {
- public:
-  DECL_ACCESSORS(value, Object)
-  DECL_ACCESSORS(tasks, Object)
-
-  // Check comment in JSPromise for information on what state these
-  // deferred fields could be in.
-  DECL_ACCESSORS(deferred_promise, Object)
-  DECL_ACCESSORS(deferred_on_resolve, Object)
-  DECL_ACCESSORS(deferred_on_reject, Object)
-
-  DECL_INT_ACCESSORS(debug_id)
-
-  DECL_ACCESSORS(context, Context)
-
-  static const int kValueOffset = Struct::kHeaderSize;
-  static const int kTasksOffset = kValueOffset + kPointerSize;
-  static const int kDeferredPromiseOffset = kTasksOffset + kPointerSize;
-  static const int kDeferredOnResolveOffset =
-      kDeferredPromiseOffset + kPointerSize;
-  static const int kDeferredOnRejectOffset =
-      kDeferredOnResolveOffset + kPointerSize;
-  static const int kContextOffset = kDeferredOnRejectOffset + kPointerSize;
-  static const int kSize = kContextOffset + kPointerSize;
-
-  DECL_CAST(PromiseReactionJobInfo)
-  DECL_PRINTER(PromiseReactionJobInfo)
-  DECL_VERIFIER(PromiseReactionJobInfo)
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(PromiseReactionJobInfo);
-};
-
 class AsyncGeneratorRequest : public Struct {
  public:
   // Holds an AsyncGeneratorRequest, or Undefined.
@@ -2982,8 +2913,8 @@ class PrototypeInfo : public Struct {
   // [weak_cell]: A WeakCell containing this prototype. ICs cache the cell here.
   DECL_ACCESSORS(weak_cell, Object)
 
-  // [prototype_users]: WeakFixedArray containing maps using this prototype,
-  // or Smi(0) if uninitialized.
+  // [prototype_users]: FixedArrayOfWeakCells containing maps using this
+  // prototype, or Smi(0) if uninitialized.
   DECL_ACCESSORS(prototype_users, Object)
 
   // [object_create_map]: A field caching the map for Object.create(prototype).
@@ -2996,13 +2927,7 @@ class PrototypeInfo : public Struct {
   // is stored. Returns UNREGISTERED if this prototype has not been registered.
   inline int registry_slot() const;
   inline void set_registry_slot(int slot);
-  // [validity_cell]: Cell containing the validity bit for prototype chains
-  // going through this object, or Smi(0) if uninitialized.
-  // When a prototype object changes its map, then both its own validity cell
-  // and those of all "downstream" prototypes are invalidated; handlers for a
-  // given receiver embed the currently valid cell for that receiver's prototype
-  // during their compilation and check it on execution.
-  DECL_ACCESSORS(validity_cell, Object)
+
   // [bit_field]
   inline int bit_field() const;
   inline void set_bit_field(int bit_field);
@@ -3128,8 +3053,8 @@ class ContextExtension : public Struct {
   V(String.prototype, toString, StringToString)             \
   V(String.prototype, toUpperCase, StringToUpperCase)       \
   V(String.prototype, trim, StringTrim)                     \
-  V(String.prototype, trimLeft, StringTrimLeft)             \
-  V(String.prototype, trimRight, StringTrimRight)           \
+  V(String.prototype, trimLeft, StringTrimStart)            \
+  V(String.prototype, trimRight, StringTrimEnd)             \
   V(String.prototype, valueOf, StringValueOf)               \
   V(String, fromCharCode, StringFromCharCode)               \
   V(String, fromCodePoint, StringFromCodePoint)             \
@@ -3335,14 +3260,14 @@ class JSAsyncGeneratorObject : public JSGeneratorObject {
   // undefined.
   DECL_ACCESSORS(queue, HeapObject)
 
-  // [awaited_promise]
-  // A reference to the Promise of an AwaitExpression.
-  DECL_ACCESSORS(awaited_promise, HeapObject)
+  // [is_awaiting]
+  // Whether or not the generator is currently awaiting.
+  DECL_INT_ACCESSORS(is_awaiting)
 
   // Layout description.
   static const int kQueueOffset = JSGeneratorObject::kSize;
-  static const int kAwaitedPromiseOffset = kQueueOffset + kPointerSize;
-  static const int kSize = kAwaitedPromiseOffset + kPointerSize;
+  static const int kIsAwaitingOffset = kQueueOffset + kPointerSize;
+  static const int kSize = kIsAwaitingOffset + kPointerSize;
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSAsyncGeneratorObject);
@@ -3477,22 +3402,14 @@ class JSFunction: public JSObject {
   // Completes inobject slack tracking on initial map if it is active.
   inline void CompleteInobjectSlackTrackingIfActive();
 
-  // [feedback_vector_cell]: The feedback vector.
-  DECL_ACCESSORS(feedback_vector_cell, Cell)
-
-  enum FeedbackVectorState {
-    TOP_LEVEL_SCRIPT_NEEDS_VECTOR,
-    NEEDS_VECTOR,
-    HAS_VECTOR,
-    NO_VECTOR_NEEDED
-  };
-
-  inline FeedbackVectorState GetFeedbackVectorState(Isolate* isolate) const;
+  // [feedback_cell]: The FeedbackCell used to hold the FeedbackVector
+  // eventually.
+  DECL_ACCESSORS(feedback_cell, FeedbackCell)
 
   // feedback_vector() can be used once the function is compiled.
   inline FeedbackVector* feedback_vector() const;
   inline bool has_feedback_vector() const;
-  static void EnsureLiterals(Handle<JSFunction> function);
+  static void EnsureFeedbackVector(Handle<JSFunction> function);
 
   // Unconditionally clear the type feedback vector.
   void ClearTypeFeedbackInfo();
@@ -3527,6 +3444,11 @@ class JSFunction: public JSObject {
   // Returns if this function has been compiled to native code yet.
   inline bool is_compiled();
 
+  static int GetHeaderSize(bool function_has_prototype_slot) {
+    return function_has_prototype_slot ? JSFunction::kSizeWithPrototype
+                                       : JSFunction::kSizeWithoutPrototype;
+  }
+
   // Prints the name of the function using PrintF.
   void PrintName(FILE* out = stdout);
 
@@ -3575,7 +3497,7 @@ class JSFunction: public JSObject {
   /* Pointer fields. */                                    \
   V(kSharedFunctionInfoOffset, kPointerSize)               \
   V(kContextOffset, kPointerSize)                          \
-  V(kFeedbackVectorOffset, kPointerSize)                   \
+  V(kFeedbackCellOffset, kPointerSize)                     \
   V(kEndOfStrongFieldsOffset, 0)                           \
   V(kCodeOffset, kPointerSize)                             \
   /* Size of JSFunction object without prototype field. */ \
@@ -3851,76 +3773,6 @@ class JSMessageObject: public JSObject {
   typedef BodyDescriptor BodyDescriptorWeak;
 };
 
-class JSPromise : public JSObject {
- public:
-  DECL_ACCESSORS(result, Object)
-
-  // There are 3 possible states for these fields --
-  // 1) Undefined -- This is the zero state when there is no callback
-  // or deferred fields registered.
-  //
-  // 2) Object -- There is a single callback directly attached to the
-  // fulfill_reactions, reject_reactions and the deferred fields are
-  // directly attached to the slots. In this state, deferred_promise
-  // is a JSReceiver and deferred_on_{resolve, reject} are Callables.
-  //
-  // 3) FixedArray -- There is more than one callback and deferred
-  // fields attached to a FixedArray.
-  //
-  // The callback can be a Callable or a Symbol.
-  DECL_ACCESSORS(deferred_promise, Object)
-  DECL_ACCESSORS(deferred_on_resolve, Object)
-  DECL_ACCESSORS(deferred_on_reject, Object)
-  DECL_ACCESSORS(fulfill_reactions, Object)
-  DECL_ACCESSORS(reject_reactions, Object)
-
-  DECL_INT_ACCESSORS(flags)
-
-  // [has_handler]: Whether this promise has a reject handler or not.
-  DECL_BOOLEAN_ACCESSORS(has_handler)
-
-  // [handled_hint]: Whether this promise will be handled by a catch
-  // block in an async function.
-  DECL_BOOLEAN_ACCESSORS(handled_hint)
-
-  static const char* Status(v8::Promise::PromiseState status);
-  v8::Promise::PromiseState status() const;
-
-  DECL_CAST(JSPromise)
-
-  // Dispatched behavior.
-  DECL_PRINTER(JSPromise)
-  DECL_VERIFIER(JSPromise)
-
-  // Layout description.
-  static const int kResultOffset = JSObject::kHeaderSize;
-  static const int kDeferredPromiseOffset = kResultOffset + kPointerSize;
-  static const int kDeferredOnResolveOffset =
-      kDeferredPromiseOffset + kPointerSize;
-  static const int kDeferredOnRejectOffset =
-      kDeferredOnResolveOffset + kPointerSize;
-  static const int kFulfillReactionsOffset =
-      kDeferredOnRejectOffset + kPointerSize;
-  static const int kRejectReactionsOffset =
-      kFulfillReactionsOffset + kPointerSize;
-  static const int kFlagsOffset = kRejectReactionsOffset + kPointerSize;
-  static const int kSize = kFlagsOffset + kPointerSize;
-  static const int kSizeWithEmbedderFields =
-      kSize + v8::Promise::kEmbedderFieldCount * kPointerSize;
-
-  // Flags layout.
-  // The first two bits store the v8::Promise::PromiseState.
-  static const int kStatusBits = 2;
-  static const int kHasHandlerBit = 2;
-  static const int kHandledHintBit = 3;
-
-  static const int kStatusShift = 0;
-  static const int kStatusMask = 0x3;
-  STATIC_ASSERT(v8::Promise::kPending == 0);
-  STATIC_ASSERT(v8::Promise::kFulfilled == 1);
-  STATIC_ASSERT(v8::Promise::kRejected == 2);
-};
-
 class AllocationSite: public Struct {
  public:
   static const uint32_t kMaximumArrayBytesToPretransition = 8 * 1024;
@@ -4217,6 +4069,33 @@ class Cell: public HeapObject {
   DISALLOW_IMPLICIT_CONSTRUCTORS(Cell);
 };
 
+// This is a special cell used to maintain both the link between a
+// closure and it's feedback vector, as well as a way to count the
+// number of closures created for a certain function per native
+// context. There's at most one FeedbackCell for each function in
+// a native context.
+class FeedbackCell : public Struct {
+ public:
+  // [value]: value of the cell.
+  DECL_ACCESSORS(value, HeapObject)
+
+  DECL_CAST(FeedbackCell)
+
+  // Dispatched behavior.
+  DECL_PRINTER(FeedbackCell)
+  DECL_VERIFIER(FeedbackCell)
+
+  static const int kValueOffset = HeapObject::kHeaderSize;
+  static const int kSize = kValueOffset + kPointerSize;
+
+  typedef FixedBodyDescriptor<kValueOffset, kValueOffset + kPointerSize, kSize>
+      BodyDescriptor;
+  // No weak fields.
+  typedef BodyDescriptor BodyDescriptorWeak;
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(FeedbackCell);
+};
 
 class PropertyCell : public HeapObject {
  public:
@@ -4415,10 +4294,10 @@ class JSProxy: public JSReceiver {
   // No weak fields.
   typedef BodyDescriptor BodyDescriptorWeak;
 
-  static Maybe<bool> SetPrivateProperty(Isolate* isolate, Handle<JSProxy> proxy,
-                                        Handle<Symbol> private_name,
-                                        PropertyDescriptor* desc,
-                                        ShouldThrow should_throw);
+  static Maybe<bool> SetPrivateSymbol(Isolate* isolate, Handle<JSProxy> proxy,
+                                      Handle<Symbol> private_name,
+                                      PropertyDescriptor* desc,
+                                      ShouldThrow should_throw);
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSProxy);
@@ -4459,9 +4338,14 @@ class JSAsyncFromSyncIterator : public JSObject {
   // (proposal-async-iteration/#table-async-from-sync-iterator-internal-slots)
   DECL_ACCESSORS(sync_iterator, JSReceiver)
 
+  // The "next" method is loaded during GetIterator, and is not reloaded for
+  // subsequent "next" invocations.
+  DECL_ACCESSORS(next, Object)
+
   // Offsets of object fields.
   static const int kSyncIteratorOffset = JSObject::kHeaderSize;
-  static const int kSize = kSyncIteratorOffset + kPointerSize;
+  static const int kNextOffset = kSyncIteratorOffset + kPointerSize;
+  static const int kSize = kNextOffset + kPointerSize;
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSAsyncFromSyncIterator);
@@ -4543,6 +4427,7 @@ class AccessorInfo: public Struct {
   DECL_ACCESSORS(getter, Object)
   inline bool has_getter();
   DECL_ACCESSORS(setter, Object)
+  inline bool has_setter();
   // This either points at the same as above, or a trampoline in case we are
   // running with the simulator. Use these entries from generated code.
   DECL_ACCESSORS(js_getter, Object)
@@ -4560,6 +4445,7 @@ class AccessorInfo: public Struct {
   DECL_BOOLEAN_ACCESSORS(is_special_data_property)
   DECL_BOOLEAN_ACCESSORS(replace_on_access)
   DECL_BOOLEAN_ACCESSORS(is_sloppy)
+  DECL_BOOLEAN_ACCESSORS(has_no_side_effect)
 
   // The property attributes used when an API object template is instantiated
   // for the first time. Changing of this value afterwards does not affect
@@ -4608,6 +4494,7 @@ class AccessorInfo: public Struct {
   V(IsSpecialDataPropertyBit, bool, 1, _)    \
   V(IsSloppyBit, bool, 1, _)                 \
   V(ReplaceOnAccessBit, bool, 1, _)          \
+  V(HasNoSideEffectBit, bool, 1, _)          \
   V(InitialAttributesBits, PropertyAttributes, 3, _)
 
   DEFINE_BIT_FIELDS(ACCESSOR_INFO_FLAGS_BIT_FIELDS)
@@ -4707,6 +4594,7 @@ class InterceptorInfo: public Struct {
   DECL_BOOLEAN_ACCESSORS(all_can_read)
   DECL_BOOLEAN_ACCESSORS(non_masking)
   DECL_BOOLEAN_ACCESSORS(is_named)
+  DECL_BOOLEAN_ACCESSORS(has_no_side_effect)
 
   inline int flags() const;
   inline void set_flags(int flags);
@@ -4732,6 +4620,7 @@ class InterceptorInfo: public Struct {
   static const int kAllCanReadBit = 1;
   static const int kNonMasking = 2;
   static const int kNamed = 3;
+  static const int kHasNoSideEffect = 4;
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(InterceptorInfo);
@@ -4912,6 +4801,8 @@ class FunctionTemplateInfo: public TemplateInfo {
   bool IsTemplateFor(Map* map);
   inline bool instantiated();
 
+  inline bool BreakAtEntry();
+
   // Helper function for cached accessors.
   static MaybeHandle<Name> TryGetCachedPropertyName(Isolate* isolate,
                                                     Handle<Object> getter);
@@ -5002,7 +4893,7 @@ class StackFrameInfo : public Struct {
 class SourcePositionTableWithFrameCache : public Tuple2 {
  public:
   DECL_ACCESSORS(source_position_table, ByteArray)
-  DECL_ACCESSORS(stack_frame_cache, NumberDictionary)
+  DECL_ACCESSORS(stack_frame_cache, SimpleNumberDictionary)
 
   DECL_CAST(SourcePositionTableWithFrameCache)
 
diff --git a/deps/v8/src/objects/bigint.cc b/deps/v8/src/objects/bigint.cc
index df5f8543959..4391217fd69 100644
--- a/deps/v8/src/objects/bigint.cc
+++ b/deps/v8/src/objects/bigint.cc
@@ -40,7 +40,8 @@ class MutableBigInt : public FreshlyAllocatedBigInt {
   static Handle<BigInt> MakeImmutable(Handle<MutableBigInt> result);
 
   // Allocation helpers.
-  static MaybeHandle<MutableBigInt> New(Isolate* isolate, int length);
+  static MaybeHandle<MutableBigInt> New(Isolate* isolate, int length,
+                                        PretenureFlag pretenure = NOT_TENURED);
   static Handle<BigInt> NewFromInt(Isolate* isolate, int value);
   static Handle<BigInt> NewFromSafeInteger(Isolate* isolate, double value);
   void InitializeDigits(int length, byte value = 0);
@@ -145,6 +146,10 @@ class MutableBigInt : public FreshlyAllocatedBigInt {
   static Rounding DecideRounding(Handle<BigIntBase> x, int mantissa_bits_unset,
                                  int digit_index, uint64_t current_digit);
 
+  // Returns the least significant 64 bits, simulating two's complement
+  // representation.
+  static uint64_t GetRawBits(BigIntBase* x, bool* lossless);
+
   // Digit arithmetic helpers.
   static inline digit_t digit_add(digit_t a, digit_t b, digit_t* carry);
   static inline digit_t digit_sub(digit_t a, digit_t b, digit_t* borrow);
@@ -168,22 +173,29 @@ class MutableBigInt : public FreshlyAllocatedBigInt {
     bitfield = LengthBits::update(static_cast<uint32_t>(bitfield), new_length);
     WRITE_INTPTR_FIELD(this, kBitfieldOffset, bitfield);
   }
+  inline void initialize_bitfield(bool sign, int length) {
+    intptr_t bitfield = LengthBits::encode(length) | SignBits::encode(sign);
+    WRITE_INTPTR_FIELD(this, kBitfieldOffset, bitfield);
+  }
   inline void set_digit(int n, digit_t value) {
     SLOW_DCHECK(0 <= n && n < length());
     byte* address = FIELD_ADDR(this, kDigitsOffset + n * kDigitSize);
     (*reinterpret_cast<digit_t*>(reinterpret_cast<intptr_t>(address))) = value;
   }
 #include "src/objects/object-macros-undef.h"
+
+  void set_64_bits(uint64_t bits);
 };
 
-MaybeHandle<MutableBigInt> MutableBigInt::New(Isolate* isolate, int length) {
+MaybeHandle<MutableBigInt> MutableBigInt::New(Isolate* isolate, int length,
+                                              PretenureFlag pretenure) {
   if (length > BigInt::kMaxLength) {
     THROW_NEW_ERROR(isolate, NewRangeError(MessageTemplate::kBigIntTooBig),
                     MutableBigInt);
   }
-  Handle<MutableBigInt> result = Cast(isolate->factory()->NewBigInt(length));
-  result->set_length(length);
-  result->set_sign(false);
+  Handle<MutableBigInt> result =
+      Cast(isolate->factory()->NewBigInt(length, pretenure));
+  result->initialize_bitfield(false, length);
 #if DEBUG
   result->InitializeDigits(length, 0xBF);
 #endif
@@ -193,12 +205,11 @@ MaybeHandle<MutableBigInt> MutableBigInt::New(Isolate* isolate, int length) {
 Handle<BigInt> MutableBigInt::NewFromInt(Isolate* isolate, int value) {
   if (value == 0) return Zero(isolate);
   Handle<MutableBigInt> result = Cast(isolate->factory()->NewBigInt(1));
-  result->set_length(1);
-  if (value > 0) {
-    result->set_sign(false);
+  bool sign = value < 0;
+  result->initialize_bitfield(sign, 1);
+  if (!sign) {
     result->set_digit(0, value);
   } else {
-    result->set_sign(true);
     if (value == kMinInt) {
       STATIC_ASSERT(kMinInt == -kMaxInt - 1);
       result->set_digit(0, static_cast<BigInt::digit_t>(kMaxInt) + 1);
@@ -216,15 +227,9 @@ Handle<BigInt> MutableBigInt::NewFromSafeInteger(Isolate* isolate,
   uint64_t absolute = std::abs(value);
   int length = 64 / kDigitBits;
   Handle<MutableBigInt> result = Cast(isolate->factory()->NewBigInt(length));
-  result->set_length(length);
-  result->set_sign(value < 0);  // Treats -0 like 0.
-  if (kDigitBits == 64) {
-    result->set_digit(0, absolute);
-  } else {
-    DCHECK_EQ(kDigitBits, 32);
-    result->set_digit(0, absolute);
-    result->set_digit(1, absolute >> 32);
-  }
+  bool sign = value < 0;  // Treats -0 like 0.
+  result->initialize_bitfield(sign, length);
+  result->set_64_bits(absolute);
   return MakeImmutable(result);
 }
 
@@ -318,7 +323,14 @@ MaybeHandle<BigInt> BigInt::Exponentiate(Handle<BigInt> base,
   // 3. Return a BigInt representing the mathematical value of base raised
   //    to the power exponent.
   if (base->is_zero()) return base;
-  if (base->length() == 1 && base->digit(0) == 1) return base;
+  if (base->length() == 1 && base->digit(0) == 1) {
+    // (-1) ** even_number == 1.
+    if (base->sign() && (exponent->digit(0) & 1) == 0) {
+      return UnaryMinus(base);
+    }
+    // (-1) ** odd_number == -1; 1 ** anything == 1.
+    return base;
+  }
   // For all bases >= 2, very large exponents would lead to unrepresentable
   // results.
   STATIC_ASSERT(kMaxLengthBits < std::numeric_limits<digit_t>::max());
@@ -337,8 +349,10 @@ MaybeHandle<BigInt> BigInt::Exponentiate(Handle<BigInt> base,
   if (base->length() == 1 && base->digit(0) == 2) {
     // Fast path for 2^n.
     int needed_digits = 1 + (n / kDigitBits);
-    Handle<MutableBigInt> result =
-        MutableBigInt::New(isolate, needed_digits).ToHandleChecked();
+    Handle<MutableBigInt> result;
+    if (!MutableBigInt::New(isolate, needed_digits).ToHandle(&result)) {
+      return MaybeHandle<BigInt>();
+    }
     result->InitializeDigits(needed_digits);
     // All bits are zero. Now set the n-th bit.
     digit_t msd = static_cast<digit_t>(1) << (n % kDigitBits);
@@ -353,18 +367,14 @@ MaybeHandle<BigInt> BigInt::Exponentiate(Handle<BigInt> base,
   if (n & 1) result = base;
   n >>= 1;
   for (; n != 0; n >>= 1) {
-    if (!Multiply(running_square, running_square).ToHandle(&running_square)) {
-      THROW_NEW_ERROR(isolate, NewRangeError(MessageTemplate::kBigIntTooBig),
-                      BigInt);
-    }
+    MaybeHandle<BigInt> maybe_result = Multiply(running_square, running_square);
+    if (!maybe_result.ToHandle(&running_square)) return maybe_result;
     if (n & 1) {
       if (result.is_null()) {
         result = running_square;
       } else {
-        if (!Multiply(result, running_square).ToHandle(&result)) {
-          THROW_NEW_ERROR(
-              isolate, NewRangeError(MessageTemplate::kBigIntTooBig), BigInt);
-        }
+        maybe_result = Multiply(result, running_square);
+        if (!maybe_result.ToHandle(&result)) return maybe_result;
       }
     }
   }
@@ -554,7 +564,8 @@ MaybeHandle<MutableBigInt> MutableBigInt::BitwiseAnd(Handle<BigInt> x,
     if (!AbsoluteSubOne(x, result_length).ToHandle(&result)) {
       return MaybeHandle<MutableBigInt>();
     }
-    result = AbsoluteOr(result, AbsoluteSubOne(y), *result);
+    Handle<MutableBigInt> y_1 = AbsoluteSubOne(y);
+    result = AbsoluteOr(result, y_1, *result);
     return AbsoluteAddOne(result, true, *result);
   } else {
     DCHECK(x->sign() != y->sign());
@@ -578,7 +589,8 @@ MaybeHandle<MutableBigInt> MutableBigInt::BitwiseXor(Handle<BigInt> x,
     // (-x) ^ (-y) == ~(x-1) ^ ~(y-1) == (x-1) ^ (y-1)
     Handle<MutableBigInt> result =
         AbsoluteSubOne(x, result_length).ToHandleChecked();
-    return AbsoluteXor(result, AbsoluteSubOne(y), *result);
+    Handle<MutableBigInt> y_1 = AbsoluteSubOne(y);
+    return AbsoluteXor(result, y_1, *result);
   } else {
     DCHECK(x->sign() != y->sign());
     int result_length = Max(x->length(), y->length()) + 1;
@@ -608,7 +620,8 @@ MaybeHandle<MutableBigInt> MutableBigInt::BitwiseOr(Handle<BigInt> x,
     // == -(((x-1) & (y-1)) + 1)
     Handle<MutableBigInt> result =
         AbsoluteSubOne(x, result_length).ToHandleChecked();
-    result = AbsoluteAnd(result, AbsoluteSubOne(y), *result);
+    Handle<MutableBigInt> y_1 = AbsoluteSubOne(y);
+    result = AbsoluteAnd(result, y_1, *result);
     return AbsoluteAddOne(result, true, *result);
   } else {
     DCHECK(x->sign() != y->sign());
@@ -975,7 +988,8 @@ MutableBigInt::Rounding MutableBigInt::DecideRounding(Handle<BigIntBase> x,
   // If any other remaining bit is set, round up.
   bitmask -= 1;
   if ((current_digit & bitmask) != 0) return kRoundUp;
-  for (; digit_index >= 0; digit_index--) {
+  while (digit_index > 0) {
+    digit_index--;
     if (x->digit(digit_index) != 0) return kRoundUp;
   }
   return kTie;
@@ -1702,7 +1716,8 @@ static const int kBitsPerCharTableShift = 5;
 static const size_t kBitsPerCharTableMultiplier = 1u << kBitsPerCharTableShift;
 
 MaybeHandle<FreshlyAllocatedBigInt> BigInt::AllocateFor(
-    Isolate* isolate, int radix, int charcount, ShouldThrow should_throw) {
+    Isolate* isolate, int radix, int charcount, ShouldThrow should_throw,
+    PretenureFlag pretenure) {
   DCHECK(2 <= radix && radix <= 36);
   DCHECK_GE(charcount, 0);
   size_t bits_per_char = kMaxBitsPerChar[radix];
@@ -1717,7 +1732,7 @@ MaybeHandle<FreshlyAllocatedBigInt> BigInt::AllocateFor(
       int length = (static_cast<int>(bits_min) + kDigitBits - 1) / kDigitBits;
       if (length <= kMaxLength) {
         Handle<MutableBigInt> result =
-            MutableBigInt::New(isolate, length).ToHandleChecked();
+            MutableBigInt::New(isolate, length, pretenure).ToHandleChecked();
         result->InitializeDigits(length);
         return result;
       }
@@ -1738,6 +1753,51 @@ Handle<BigInt> BigInt::Finalize(Handle<FreshlyAllocatedBigInt> x, bool sign) {
   return MutableBigInt::MakeImmutable(bigint);
 }
 
+// The serialization format MUST NOT CHANGE without updating the format
+// version in value-serializer.cc!
+uint32_t BigInt::GetBitfieldForSerialization() const {
+  // In order to make the serialization format the same on 32/64 bit builds,
+  // we convert the length-in-digits to length-in-bytes for serialization.
+  // Being able to do this depends on having enough LengthBits:
+  STATIC_ASSERT(kMaxLength * kDigitSize <= LengthBits::kMax);
+  int bytelength = length() * kDigitSize;
+  return SignBits::encode(sign()) | LengthBits::encode(bytelength);
+}
+
+int BigInt::DigitsByteLengthForBitfield(uint32_t bitfield) {
+  return LengthBits::decode(bitfield);
+}
+
+// The serialization format MUST NOT CHANGE without updating the format
+// version in value-serializer.cc!
+void BigInt::SerializeDigits(uint8_t* storage) {
+  int bytelength = length() * kDigitSize;
+  void* digits = reinterpret_cast<void*>(reinterpret_cast<Address>(this) +
+                                         kDigitsOffset - kHeapObjectTag);
+  memcpy(storage, digits, bytelength);
+}
+
+// The serialization format MUST NOT CHANGE without updating the format
+// version in value-serializer.cc!
+MaybeHandle<BigInt> BigInt::FromSerializedDigits(
+    Isolate* isolate, uint32_t bitfield, Vector<const uint8_t> digits_storage,
+    PretenureFlag pretenure) {
+  int bytelength = LengthBits::decode(bitfield);
+  DCHECK(digits_storage.length() == bytelength);
+  bool sign = SignBits::decode(bitfield);
+  int length = (bytelength + kDigitSize - 1) / kDigitSize;  // Round up.
+  Handle<MutableBigInt> result =
+      MutableBigInt::Cast(isolate->factory()->NewBigInt(length, pretenure));
+  result->initialize_bitfield(sign, length);
+  void* digits = reinterpret_cast<void*>(reinterpret_cast<Address>(*result) +
+                                         kDigitsOffset - kHeapObjectTag);
+  memcpy(digits, digits_storage.start(), bytelength);
+  void* padding_start =
+      reinterpret_cast<void*>(reinterpret_cast<Address>(digits) + bytelength);
+  memset(padding_start, 0, length * kDigitSize - bytelength);
+  return MutableBigInt::MakeImmutable(result);
+}
+
 static const char kConversionChars[] = "0123456789abcdefghijklmnopqrstuvwxyz";
 
 MaybeHandle<String> MutableBigInt::ToStringBasePowerOfTwo(Handle<BigIntBase> x,
@@ -2079,6 +2139,66 @@ Handle<BigInt> MutableBigInt::TruncateAndSubFromPowerOfTwo(int n,
   return MakeImmutable(result);
 }
 
+Handle<BigInt> BigInt::FromInt64(Isolate* isolate, int64_t n) {
+  if (n == 0) return MutableBigInt::Zero(isolate);
+  STATIC_ASSERT(kDigitBits == 64 || kDigitBits == 32);
+  int length = 64 / kDigitBits;
+  Handle<MutableBigInt> result =
+      MutableBigInt::Cast(isolate->factory()->NewBigInt(length));
+  bool sign = n < 0;
+  result->initialize_bitfield(sign, length);
+  uint64_t absolute;
+  if (!sign) {
+    absolute = static_cast<uint64_t>(n);
+  } else {
+    if (n == std::numeric_limits<int64_t>::min()) {
+      absolute = static_cast<uint64_t>(std::numeric_limits<int64_t>::max()) + 1;
+    } else {
+      absolute = static_cast<uint64_t>(-n);
+    }
+  }
+  result->set_64_bits(absolute);
+  return MutableBigInt::MakeImmutable(result);
+}
+
+Handle<BigInt> BigInt::FromUint64(Isolate* isolate, uint64_t n) {
+  if (n == 0) return MutableBigInt::Zero(isolate);
+  STATIC_ASSERT(kDigitBits == 64 || kDigitBits == 32);
+  int length = 64 / kDigitBits;
+  Handle<MutableBigInt> result =
+      MutableBigInt::Cast(isolate->factory()->NewBigInt(length));
+  result->initialize_bitfield(false, length);
+  result->set_64_bits(n);
+  return MutableBigInt::MakeImmutable(result);
+}
+
+uint64_t MutableBigInt::GetRawBits(BigIntBase* x, bool* lossless) {
+  if (lossless != nullptr) *lossless = true;
+  if (x->is_zero()) return 0;
+  int len = x->length();
+  STATIC_ASSERT(kDigitBits == 64 || kDigitBits == 32);
+  if (lossless != nullptr && len > 64 / kDigitBits) *lossless = false;
+  uint64_t raw = static_cast<uint64_t>(x->digit(0));
+  if (kDigitBits == 32 && len > 1) {
+    raw |= static_cast<uint64_t>(x->digit(1)) << 32;
+  }
+  // Simulate two's complement. MSVC dislikes "-raw".
+  return x->sign() ? ((~raw) + 1u) : raw;
+}
+
+int64_t BigInt::AsInt64(bool* lossless) {
+  uint64_t raw = MutableBigInt::GetRawBits(this, lossless);
+  int64_t result = static_cast<int64_t>(raw);
+  if (lossless != nullptr && (result < 0) != sign()) *lossless = false;
+  return result;
+}
+
+uint64_t BigInt::AsUint64(bool* lossless) {
+  uint64_t result = MutableBigInt::GetRawBits(this, lossless);
+  if (lossless != nullptr && sign()) *lossless = false;
+  return result;
+}
+
 // Digit arithmetic helpers.
 
 #if V8_TARGET_ARCH_32_BIT
@@ -2240,20 +2360,30 @@ BigInt::digit_t MutableBigInt::digit_pow(digit_t base, digit_t exponent) {
 
 #undef HAVE_TWODIGIT_T
 
+void MutableBigInt::set_64_bits(uint64_t bits) {
+  STATIC_ASSERT(kDigitBits == 64 || kDigitBits == 32);
+  if (kDigitBits == 64) {
+    set_digit(0, static_cast<digit_t>(bits));
+  } else {
+    set_digit(0, static_cast<digit_t>(bits & 0xFFFFFFFFu));
+    set_digit(1, static_cast<digit_t>(bits >> 32));
+  }
+}
+
 #ifdef OBJECT_PRINT
 void BigInt::BigIntPrint(std::ostream& os) {
   DisallowHeapAllocation no_gc;
   HeapObject::PrintHeader(os, "BigInt");
   int len = length();
-  os << "- length: " << len << "\n";
-  os << "- sign: " << sign() << "\n";
+  os << "\n- length: " << len;
+  os << "\n- sign: " << sign();
   if (len > 0) {
-    os << "- digits:";
+    os << "\n- digits:";
     for (int i = 0; i < len; i++) {
       os << "\n    0x" << std::hex << digit(i);
     }
-    os << std::dec << "\n";
   }
+  os << std::dec << "\n";
 }
 #endif  // OBJECT_PRINT
 
diff --git a/deps/v8/src/objects/bigint.h b/deps/v8/src/objects/bigint.h
index 9e29a69b3bd..caf8939ceab 100644
--- a/deps/v8/src/objects/bigint.h
+++ b/deps/v8/src/objects/bigint.h
@@ -15,6 +15,10 @@
 namespace v8 {
 namespace internal {
 
+class BigInt;
+class ValueDeserializer;
+class ValueSerializer;
+
 // BigIntBase is just the raw data object underlying a BigInt. Use with care!
 // Most code should be using BigInts instead.
 class BigIntBase : public HeapObject {
@@ -30,15 +34,16 @@ class BigIntBase : public HeapObject {
 
   static const int kLengthFieldBits = 30;
   STATIC_ASSERT(kMaxLength <= ((1 << kLengthFieldBits) - 1));
-  class LengthBits : public BitField<int, 0, kLengthFieldBits> {};
-  class SignBits : public BitField<bool, LengthBits::kNext, 1> {};
+  class SignBits : public BitField<bool, 0, 1> {};
+  class LengthBits : public BitField<int, SignBits::kNext, kLengthFieldBits> {};
+  STATIC_ASSERT(LengthBits::kNext <= 32);
 
   static const int kBitfieldOffset = HeapObject::kHeaderSize;
   static const int kDigitsOffset = kBitfieldOffset + kPointerSize;
   static const int kHeaderSize = kDigitsOffset;
 
  private:
-  friend class BigInt;
+  friend class ::v8::internal::BigInt;  // MSVC wants full namespace.
   friend class MutableBigInt;
 
   typedef uintptr_t digit_t;
@@ -137,6 +142,11 @@ class V8_EXPORT_PRIVATE BigInt : public BigIntBase {
   static Handle<BigInt> AsIntN(uint64_t n, Handle<BigInt> x);
   static MaybeHandle<BigInt> AsUintN(uint64_t n, Handle<BigInt> x);
 
+  static Handle<BigInt> FromInt64(Isolate* isolate, int64_t n);
+  static Handle<BigInt> FromUint64(Isolate* isolate, uint64_t n);
+  int64_t AsInt64(bool* lossless = nullptr);
+  uint64_t AsUint64(bool* lossless = nullptr);
+
   DECL_CAST(BigInt)
   DECL_VERIFIER(BigInt)
   DECL_PRINTER(BigInt)
@@ -162,16 +172,29 @@ class V8_EXPORT_PRIVATE BigInt : public BigIntBase {
   class BodyDescriptor;
 
  private:
-  friend class BigIntParseIntHelper;
+  friend class StringToBigIntHelper;
+  friend class ValueDeserializer;
+  friend class ValueSerializer;
 
-  // Special functions for BigIntParseIntHelper:
+  // Special functions for StringToBigIntHelper:
   static Handle<BigInt> Zero(Isolate* isolate);
   static MaybeHandle<FreshlyAllocatedBigInt> AllocateFor(
-      Isolate* isolate, int radix, int charcount, ShouldThrow should_throw);
+      Isolate* isolate, int radix, int charcount, ShouldThrow should_throw,
+      PretenureFlag pretenure);
   static void InplaceMultiplyAdd(Handle<FreshlyAllocatedBigInt> x,
                                  uintptr_t factor, uintptr_t summand);
   static Handle<BigInt> Finalize(Handle<FreshlyAllocatedBigInt> x, bool sign);
 
+  // Special functions for ValueSerializer/ValueDeserializer:
+  uint32_t GetBitfieldForSerialization() const;
+  static int DigitsByteLengthForBitfield(uint32_t bitfield);
+  // Expects {storage} to have a length of at least
+  // {DigitsByteLengthForBitfield(GetBitfieldForSerialization())}.
+  void SerializeDigits(uint8_t* storage);
+  MUST_USE_RESULT static MaybeHandle<BigInt> FromSerializedDigits(
+      Isolate* isolate, uint32_t bitfield, Vector<const uint8_t> digits_storage,
+      PretenureFlag pretenure);
+
   DISALLOW_IMPLICIT_CONSTRUCTORS(BigInt);
 };
 
diff --git a/deps/v8/src/objects/code-inl.h b/deps/v8/src/objects/code-inl.h
index 4c3e7f0d979..466c96f50a0 100644
--- a/deps/v8/src/objects/code-inl.h
+++ b/deps/v8/src/objects/code-inl.h
@@ -7,6 +7,7 @@
 
 #include "src/objects/code.h"
 
+#include "src/isolate.h"
 #include "src/objects/dictionary.h"
 #include "src/v8memory.h"
 
@@ -26,7 +27,6 @@ CAST_ACCESSOR(Code)
 CAST_ACCESSOR(CodeDataContainer)
 CAST_ACCESSOR(DependentCode)
 CAST_ACCESSOR(DeoptimizationData)
-CAST_ACCESSOR(HandlerTable)
 
 int AbstractCode::instruction_size() {
   if (IsCode()) {
@@ -36,6 +36,14 @@ int AbstractCode::instruction_size() {
   }
 }
 
+int AbstractCode::InstructionSize() {
+  if (IsCode()) {
+    return GetCode()->InstructionSize();
+  } else {
+    return GetBytecodeArray()->length();
+  }
+}
+
 ByteArray* AbstractCode::source_position_table() {
   if (IsCode()) {
     return GetCode()->SourcePositionTable();
@@ -81,6 +89,14 @@ Address AbstractCode::instruction_start() {
   }
 }
 
+Address AbstractCode::InstructionStart() {
+  if (IsCode()) {
+    return GetCode()->InstructionStart();
+  } else {
+    return GetBytecodeArray()->GetFirstBytecodeAddress();
+  }
+}
+
 Address AbstractCode::instruction_end() {
   if (IsCode()) {
     return GetCode()->instruction_end();
@@ -90,6 +106,15 @@ Address AbstractCode::instruction_end() {
   }
 }
 
+Address AbstractCode::InstructionEnd() {
+  if (IsCode()) {
+    return GetCode()->InstructionEnd();
+  } else {
+    return GetBytecodeArray()->GetFirstBytecodeAddress() +
+           GetBytecodeArray()->length();
+  }
+}
+
 bool AbstractCode::contains(byte* inner_pointer) {
   return (address() <= inner_pointer) && (inner_pointer <= address() + Size());
 }
@@ -149,25 +174,20 @@ void DependentCode::copy(int from, int to) {
 }
 
 INT_ACCESSORS(Code, instruction_size, kInstructionSizeOffset)
-INT_ACCESSORS(Code, constant_pool_offset, kConstantPoolOffset)
+INT_ACCESSORS(Code, handler_table_offset, kHandlerTableOffsetOffset)
 #define CODE_ACCESSORS(name, type, offset)           \
   ACCESSORS_CHECKED2(Code, name, type, offset, true, \
                      !GetHeap()->InNewSpace(value))
 CODE_ACCESSORS(relocation_info, ByteArray, kRelocationInfoOffset)
-CODE_ACCESSORS(handler_table, FixedArray, kHandlerTableOffset)
 CODE_ACCESSORS(deoptimization_data, FixedArray, kDeoptimizationDataOffset)
 CODE_ACCESSORS(source_position_table, Object, kSourcePositionTableOffset)
-CODE_ACCESSORS(protected_instructions, FixedArray, kProtectedInstructionsOffset)
 CODE_ACCESSORS(code_data_container, CodeDataContainer, kCodeDataContainerOffset)
-CODE_ACCESSORS(trap_handler_index, Smi, kTrapHandlerIndex)
 #undef CODE_ACCESSORS
 
 void Code::WipeOutHeader() {
   WRITE_FIELD(this, kRelocationInfoOffset, nullptr);
-  WRITE_FIELD(this, kHandlerTableOffset, nullptr);
   WRITE_FIELD(this, kDeoptimizationDataOffset, nullptr);
   WRITE_FIELD(this, kSourcePositionTableOffset, nullptr);
-  WRITE_FIELD(this, kProtectedInstructionsOffset, nullptr);
   WRITE_FIELD(this, kCodeDataContainerOffset, nullptr);
 }
 
@@ -204,14 +224,35 @@ void Code::set_next_code_link(Object* value) {
   code_data_container()->set_next_code_link(value);
 }
 
+int Code::InstructionSize() const {
+#ifdef V8_EMBEDDED_BUILTINS
+  if (Builtins::IsOffHeapBuiltin(this)) return OffHeapInstructionSize();
+#endif
+  return instruction_size();
+}
+
 byte* Code::instruction_start() const {
   return const_cast<byte*>(FIELD_ADDR_CONST(this, kHeaderSize));
 }
 
+Address Code::InstructionStart() const {
+#ifdef V8_EMBEDDED_BUILTINS
+  if (Builtins::IsOffHeapBuiltin(this)) return OffHeapInstructionStart();
+#endif
+  return instruction_start();
+}
+
 byte* Code::instruction_end() const {
   return instruction_start() + instruction_size();
 }
 
+Address Code::InstructionEnd() const {
+#ifdef V8_EMBEDDED_BUILTINS
+  if (Builtins::IsOffHeapBuiltin(this)) return OffHeapInstructionEnd();
+#endif
+  return instruction_end();
+}
+
 int Code::GetUnwindingInfoSizeOffset() const {
   DCHECK(has_unwinding_info());
   return RoundUp(kHeaderSize + instruction_size(), kInt64Size);
@@ -252,8 +293,6 @@ int Code::SizeIncludingMetadata() const {
   int size = CodeSize();
   size += relocation_info()->Size();
   size += deoptimization_data()->Size();
-  size += handler_table()->Size();
-  size += protected_instructions()->Size();
   return size;
 }
 
@@ -314,8 +353,7 @@ inline bool Code::checks_optimization_marker() const {
   Builtins* builtins = GetIsolate()->builtins();
   bool checks_marker =
       (this == builtins->builtin(Builtins::kCompileLazy) ||
-       this == builtins->builtin(Builtins::kInterpreterEntryTrampoline) ||
-       this == builtins->builtin(Builtins::kCheckOptimizationMarker));
+       this == builtins->builtin(Builtins::kInterpreterEntryTrampoline));
   DCHECK_IMPLIES(checks_marker, !Builtins::IsLazy(builtin_index()));
   return checks_marker ||
          (kind() == OPTIMIZED_FUNCTION && marked_for_deoptimization());
@@ -464,15 +502,24 @@ bool Code::is_stub() const { return kind() == STUB; }
 bool Code::is_optimized_code() const { return kind() == OPTIMIZED_FUNCTION; }
 bool Code::is_wasm_code() const { return kind() == WASM_FUNCTION; }
 
-Address Code::constant_pool() {
-  Address constant_pool = nullptr;
+int Code::constant_pool_offset() const {
+  if (!FLAG_enable_embedded_constant_pool) return InstructionSize();
+  return READ_INT_FIELD(this, kConstantPoolOffset);
+}
+
+void Code::set_constant_pool_offset(int value) {
+  if (!FLAG_enable_embedded_constant_pool) return;
+  WRITE_INT_FIELD(this, kConstantPoolOffset, value);
+}
+
+Address Code::constant_pool() const {
   if (FLAG_enable_embedded_constant_pool) {
     int offset = constant_pool_offset();
-    if (offset < instruction_size()) {
-      constant_pool = FIELD_ADDR(this, kHeaderSize + offset);
+    if (offset < InstructionSize()) {
+      return InstructionStart() + offset;
     }
   }
-  return constant_pool;
+  return nullptr;
 }
 
 Code* Code::GetCodeFromTargetAddress(Address address) {
@@ -618,7 +665,7 @@ int BytecodeArray::parameter_count() const {
 }
 
 ACCESSORS(BytecodeArray, constant_pool, FixedArray, kConstantPoolOffset)
-ACCESSORS(BytecodeArray, handler_table, FixedArray, kHandlerTableOffset)
+ACCESSORS(BytecodeArray, handler_table, ByteArray, kHandlerTableOffset)
 ACCESSORS(BytecodeArray, source_position_table, Object,
           kSourcePositionTableOffset)
 
@@ -657,55 +704,6 @@ int BytecodeArray::SizeIncludingMetadata() {
   return size;
 }
 
-int HandlerTable::GetRangeStart(int index) const {
-  return Smi::ToInt(get(index * kRangeEntrySize + kRangeStartIndex));
-}
-
-int HandlerTable::GetRangeEnd(int index) const {
-  return Smi::ToInt(get(index * kRangeEntrySize + kRangeEndIndex));
-}
-
-int HandlerTable::GetRangeHandler(int index) const {
-  return HandlerOffsetField::decode(
-      Smi::ToInt(get(index * kRangeEntrySize + kRangeHandlerIndex)));
-}
-
-int HandlerTable::GetRangeData(int index) const {
-  return Smi::ToInt(get(index * kRangeEntrySize + kRangeDataIndex));
-}
-
-void HandlerTable::SetRangeStart(int index, int value) {
-  set(index * kRangeEntrySize + kRangeStartIndex, Smi::FromInt(value));
-}
-
-void HandlerTable::SetRangeEnd(int index, int value) {
-  set(index * kRangeEntrySize + kRangeEndIndex, Smi::FromInt(value));
-}
-
-void HandlerTable::SetRangeHandler(int index, int offset,
-                                   CatchPrediction prediction) {
-  int value = HandlerOffsetField::encode(offset) |
-              HandlerPredictionField::encode(prediction);
-  set(index * kRangeEntrySize + kRangeHandlerIndex, Smi::FromInt(value));
-}
-
-void HandlerTable::SetRangeData(int index, int value) {
-  set(index * kRangeEntrySize + kRangeDataIndex, Smi::FromInt(value));
-}
-
-void HandlerTable::SetReturnOffset(int index, int value) {
-  set(index * kReturnEntrySize + kReturnOffsetIndex, Smi::FromInt(value));
-}
-
-void HandlerTable::SetReturnHandler(int index, int offset) {
-  int value = HandlerOffsetField::encode(offset);
-  set(index * kReturnEntrySize + kReturnHandlerIndex, Smi::FromInt(value));
-}
-
-int HandlerTable::NumberOfRangeEntries() const {
-  return length() / kRangeEntrySize;
-}
-
 BailoutId DeoptimizationData::BytecodeOffset(int i) {
   return BailoutId(BytecodeOffsetRaw(i)->value());
 }
diff --git a/deps/v8/src/objects/code.h b/deps/v8/src/objects/code.h
index c43e07c1f92..1e9687bc634 100644
--- a/deps/v8/src/objects/code.h
+++ b/deps/v8/src/objects/code.h
@@ -5,6 +5,7 @@
 #ifndef V8_OBJECTS_CODE_H_
 #define V8_OBJECTS_CODE_H_
 
+#include "src/handler-table.h"
 #include "src/objects.h"
 #include "src/objects/fixed-array.h"
 
@@ -18,92 +19,6 @@ class ByteArray;
 class BytecodeArray;
 class CodeDataContainer;
 
-// HandlerTable is a fixed array containing entries for exception handlers in
-// the code object it is associated with. The tables comes in two flavors:
-// 1) Based on ranges: Used for unoptimized code. Contains one entry per
-//    exception handler and a range representing the try-block covered by that
-//    handler. Layout looks as follows:
-//      [ range-start , range-end , handler-offset , handler-data ]
-// 2) Based on return addresses: Used for turbofanned code. Contains one entry
-//    per call-site that could throw an exception. Layout looks as follows:
-//      [ return-address-offset , handler-offset ]
-class HandlerTable : public FixedArray {
- public:
-  // Conservative prediction whether a given handler will locally catch an
-  // exception or cause a re-throw to outside the code boundary. Since this is
-  // undecidable it is merely an approximation (e.g. useful for debugger).
-  enum CatchPrediction {
-    UNCAUGHT,    // The handler will (likely) rethrow the exception.
-    CAUGHT,      // The exception will be caught by the handler.
-    PROMISE,     // The exception will be caught and cause a promise rejection.
-    DESUGARING,  // The exception will be caught, but both the exception and the
-                 // catching are part of a desugaring and should therefore not
-                 // be visible to the user (we won't notify the debugger of such
-                 // exceptions).
-    ASYNC_AWAIT,  // The exception will be caught and cause a promise rejection
-                  // in the desugaring of an async function, so special
-                  // async/await handling in the debugger can take place.
-  };
-
-  // Getters for handler table based on ranges.
-  inline int GetRangeStart(int index) const;
-  inline int GetRangeEnd(int index) const;
-  inline int GetRangeHandler(int index) const;
-  inline int GetRangeData(int index) const;
-
-  // Setters for handler table based on ranges.
-  inline void SetRangeStart(int index, int value);
-  inline void SetRangeEnd(int index, int value);
-  inline void SetRangeHandler(int index, int offset, CatchPrediction pred);
-  inline void SetRangeData(int index, int value);
-
-  // Setters for handler table based on return addresses.
-  inline void SetReturnOffset(int index, int value);
-  inline void SetReturnHandler(int index, int offset);
-
-  // Lookup handler in a table based on ranges. The {pc_offset} is an offset to
-  // the start of the potentially throwing instruction (using return addresses
-  // for this value would be invalid).
-  int LookupRange(int pc_offset, int* data, CatchPrediction* prediction);
-
-  // Lookup handler in a table based on return addresses.
-  int LookupReturn(int pc_offset);
-
-  // Returns the number of entries in the table.
-  inline int NumberOfRangeEntries() const;
-
-  // Returns the required length of the underlying fixed array.
-  static int LengthForRange(int entries) { return entries * kRangeEntrySize; }
-  static int LengthForReturn(int entries) { return entries * kReturnEntrySize; }
-
-  // Returns an empty handler table.
-  static Handle<HandlerTable> Empty(Isolate* isolate);
-
-  DECL_CAST(HandlerTable)
-
-#ifdef ENABLE_DISASSEMBLER
-  void HandlerTableRangePrint(std::ostream& os);   // NOLINT
-  void HandlerTableReturnPrint(std::ostream& os);  // NOLINT
-#endif
-
- private:
-  // Layout description for handler table based on ranges.
-  static const int kRangeStartIndex = 0;
-  static const int kRangeEndIndex = 1;
-  static const int kRangeHandlerIndex = 2;
-  static const int kRangeDataIndex = 3;
-  static const int kRangeEntrySize = 4;
-
-  // Layout description for handler table based on return addresses.
-  static const int kReturnOffsetIndex = 0;
-  static const int kReturnHandlerIndex = 1;
-  static const int kReturnEntrySize = 2;
-
-  // Encoding of the {handler} field.
-  class HandlerPredictionField : public BitField<CatchPrediction, 0, 3> {};
-  class HandlerOffsetField : public BitField<int, 3, 29> {};
-};
-
 // Code describes objects with on-the-fly generated machine code.
 class Code : public HeapObject {
  public:
@@ -133,27 +48,30 @@ class Code : public HeapObject {
 
   static const char* Kind2String(Kind kind);
 
-#if defined(OBJECT_PRINT) || defined(ENABLE_DISASSEMBLER)
-  // Printing
-  static const char* ICState2String(InlineCacheState state);
-#endif  // defined(OBJECT_PRINT) || defined(ENABLE_DISASSEMBLER)
-
 #ifdef ENABLE_DISASSEMBLER
   void Disassemble(const char* name, std::ostream& os,
                    void* current_pc = nullptr);  // NOLINT
 #endif
 
-  // [instruction_size]: Size of the native instructions
+  // [instruction_size]: Size of the native instructions, including embedded
+  // data such as the safepoints table.
   inline int instruction_size() const;
   inline void set_instruction_size(int value);
 
+  // Returns the size of the native instructions, including embedded
+  // data such as the safepoints table. For off-heap code objects
+  // this may from instruction_size in that this will return the size of the
+  // off-heap instruction stream rather than the on-heap trampoline located
+  // at instruction_start.
+  inline int InstructionSize() const;
+#ifdef V8_EMBEDDED_BUILTINS
+  int OffHeapInstructionSize() const;
+#endif
+
   // [relocation_info]: Code relocation information
   DECL_ACCESSORS(relocation_info, ByteArray)
   void InvalidateEmbeddedObjects();
 
-  // [handler_table]: Fixed array containing offsets of exception handlers.
-  DECL_ACCESSORS(handler_table, FixedArray)
-
   // [deoptimization_data]: Array containing data for deopt.
   DECL_ACCESSORS(deoptimization_data, FixedArray)
 
@@ -162,18 +80,9 @@ class Code : public HeapObject {
   DECL_ACCESSORS(source_position_table, Object)
   inline ByteArray* SourcePositionTable() const;
 
-  // TODO(mtrofin): remove when we don't need FLAG_wasm_jit_to_native
-  // [protected instructions]: Array containing list of protected
-  // instructions and corresponding landing pad offset.
-  DECL_ACCESSORS(protected_instructions, FixedArray)
-
   // [code_data_container]: A container indirection for all mutable fields.
   DECL_ACCESSORS(code_data_container, CodeDataContainer)
 
-  // [trap_handler_index]: An index into the trap handler's master list of code
-  // objects.
-  DECL_ACCESSORS(trap_handler_index, Smi)
-
   // [stub_key]: The major/minor key of a code stub.
   inline uint32_t stub_key() const;
   inline void set_stub_key(uint32_t key);
@@ -245,6 +154,11 @@ class Code : public HeapObject {
   inline int safepoint_table_offset() const;
   inline void set_safepoint_table_offset(int offset);
 
+  // [handler_table_offset]: The offset in the instruction stream where the
+  // exception handler table starts.
+  inline int handler_table_offset() const;
+  inline void set_handler_table_offset(int offset);
+
   // [marked_for_deoptimization]: For kind OPTIMIZED_FUNCTION tells whether
   // the code is going to be deoptimized because of dead embedded maps.
   inline bool marked_for_deoptimization() const;
@@ -268,7 +182,7 @@ class Code : public HeapObject {
   inline void set_is_exception_caught(bool flag);
 
   // [constant_pool]: The constant pool for this function.
-  inline Address constant_pool();
+  inline Address constant_pool() const;
 
   // Get the safepoint entry for the given pc.
   SafepointEntry GetSafepointEntry(Address pc);
@@ -302,9 +216,25 @@ class Code : public HeapObject {
   // Returns the address of the first instruction.
   inline byte* instruction_start() const;
 
+  // Returns the address of the first instruction. For off-heap code objects
+  // this differs from instruction_start (which would point to the off-heap
+  // trampoline instead).
+  inline Address InstructionStart() const;
+#ifdef V8_EMBEDDED_BUILTINS
+  Address OffHeapInstructionStart() const;
+#endif
+
   // Returns the address right after the last instruction.
   inline byte* instruction_end() const;
 
+  // Returns the address right after the last instruction. For off-heap code
+  // objects this differs from instruction_end (which would point to the
+  // off-heap trampoline instead).
+  inline Address InstructionEnd() const;
+#ifdef V8_EMBEDDED_BUILTINS
+  Address OffHeapInstructionEnd() const;
+#endif
+
   // Returns the size of the instructions, padding, relocation and unwinding
   // information.
   inline int body_size() const;
@@ -393,16 +323,19 @@ class Code : public HeapObject {
   void PrintDeoptLocation(FILE* out, const char* str, Address pc);
   bool CanDeoptAt(Address pc);
 
+  void SetMarkedForDeoptimization(const char* reason);
+
   inline HandlerTable::CatchPrediction GetBuiltinCatchPrediction();
-#ifdef VERIFY_HEAP
-  void VerifyEmbeddedObjectsDependency();
-#endif
 
 #ifdef DEBUG
   enum VerifyMode { kNoContextSpecificPointers, kNoContextRetainingPointers };
   void VerifyEmbeddedObjects(VerifyMode mode = kNoContextRetainingPointers);
 #endif  // DEBUG
 
+#ifdef V8_EMBEDDED_BUILTINS
+  bool IsProcessIndependent();
+#endif
+
   inline bool CanContainWeakObjects();
 
   inline bool IsWeakObject(Object* object);
@@ -434,25 +367,23 @@ class Code : public HeapObject {
 
   // Layout description.
   static const int kRelocationInfoOffset = HeapObject::kHeaderSize;
-  static const int kHandlerTableOffset = kRelocationInfoOffset + kPointerSize;
   static const int kDeoptimizationDataOffset =
-      kHandlerTableOffset + kPointerSize;
+      kRelocationInfoOffset + kPointerSize;
   static const int kSourcePositionTableOffset =
       kDeoptimizationDataOffset + kPointerSize;
-  static const int kProtectedInstructionsOffset =
-      kSourcePositionTableOffset + kPointerSize;
   static const int kCodeDataContainerOffset =
-      kProtectedInstructionsOffset + kPointerSize;
+      kSourcePositionTableOffset + kPointerSize;
   static const int kInstructionSizeOffset =
       kCodeDataContainerOffset + kPointerSize;
   static const int kFlagsOffset = kInstructionSizeOffset + kIntSize;
   static const int kSafepointTableOffsetOffset = kFlagsOffset + kIntSize;
-  static const int kStubKeyOffset = kSafepointTableOffsetOffset + kIntSize;
+  static const int kHandlerTableOffsetOffset =
+      kSafepointTableOffsetOffset + kIntSize;
+  static const int kStubKeyOffset = kHandlerTableOffsetOffset + kIntSize;
   static const int kConstantPoolOffset = kStubKeyOffset + kIntSize;
   static const int kBuiltinIndexOffset =
       kConstantPoolOffset + kConstantPoolSize;
-  static const int kTrapHandlerIndex = kBuiltinIndexOffset + kIntSize;
-  static const int kHeaderPaddingStart = kTrapHandlerIndex + kPointerSize;
+  static const int kHeaderPaddingStart = kBuiltinIndexOffset + kIntSize;
 
   // Add padding to align the instruction start following right after
   // the Code object header.
@@ -464,8 +395,6 @@ class Code : public HeapObject {
   // Objects embedded into code is visited via reloc info.
   static const int kDataStart = kInstructionSizeOffset;
 
-  enum TrapFields { kTrapCodeOffset, kTrapLandingOffset, kTrapDataSize };
-
   inline int GetUnwindingInfoSizeOffset() const;
 
   class BodyDescriptor;
@@ -573,18 +502,35 @@ class AbstractCode : public HeapObject {
   // Returns the address of the first instruction.
   inline Address instruction_start();
 
+  // Returns the address of the first instruction. For off-heap code objects
+  // this differs from instruction_start (which would point to the off-heap
+  // trampoline instead).
+  inline Address InstructionStart();
+
   // Returns the address right after the last instruction.
   inline Address instruction_end();
 
+  // Returns the address right after the last instruction. For off-heap code
+  // objects this differs from instruction_end (which would point to the
+  // off-heap trampoline instead).
+  inline Address InstructionEnd();
+
   // Returns the size of the code instructions.
   inline int instruction_size();
 
+  // Returns the size of the native instructions, including embedded
+  // data such as the safepoints table. For off-heap code objects
+  // this may from instruction_size in that this will return the size of the
+  // off-heap instruction stream rather than the on-heap trampoline located
+  // at instruction_start.
+  inline int InstructionSize();
+
   // Return the source position table.
   inline ByteArray* source_position_table();
 
   inline Object* stack_frame_cache();
   static void SetStackFrameCache(Handle<AbstractCode> abstract_code,
-                                 Handle<NumberDictionary> cache);
+                                 Handle<SimpleNumberDictionary> cache);
   void DropStackFrameCache();
 
   // Returns the size of instructions and the metadata.
@@ -631,9 +577,6 @@ class AbstractCode : public HeapObject {
 class DependentCode : public FixedArray {
  public:
   enum DependencyGroup {
-    // Group of code that weakly embed this map and depend on being
-    // deoptimized when the map is garbage collected.
-    kWeakCodeGroup,
     // Group of code that embed a transition to this map, and depend on being
     // deoptimized when the transition is replaced by a new version.
     kTransitionGroup,
@@ -702,7 +645,6 @@ class DependentCode : public FixedArray {
   DECL_CAST(DependentCode)
 
   static const char* DependencyGroupName(DependencyGroup group);
-  static void SetMarkedForDeoptimization(Code* code, DependencyGroup group);
 
  private:
   static Handle<DependentCode> Insert(Handle<DependentCode> entries,
@@ -787,7 +729,7 @@ class BytecodeArray : public FixedArrayBase {
   DECL_ACCESSORS(constant_pool, FixedArray)
 
   // Accessors for handler table containing offsets of exception handlers.
-  DECL_ACCESSORS(handler_table, FixedArray)
+  DECL_ACCESSORS(handler_table, ByteArray)
 
   // Accessors for source position table containing mappings between byte code
   // offset and source position or SourcePositionTableWithFrameCache.
diff --git a/deps/v8/src/objects/compilation-cache.h b/deps/v8/src/objects/compilation-cache.h
index 16bced9998e..5836b010910 100644
--- a/deps/v8/src/objects/compilation-cache.h
+++ b/deps/v8/src/objects/compilation-cache.h
@@ -37,21 +37,21 @@ class CompilationCacheShape : public BaseShape<HashTableKey*> {
   static const int kEntrySize = 3;
 };
 
-class InfoVectorPair {
+class InfoCellPair {
  public:
-  InfoVectorPair() : shared_(nullptr), vector_cell_(nullptr) {}
-  InfoVectorPair(SharedFunctionInfo* shared, Cell* vector_cell)
-      : shared_(shared), vector_cell_(vector_cell) {}
+  InfoCellPair() : shared_(nullptr), feedback_cell_(nullptr) {}
+  InfoCellPair(SharedFunctionInfo* shared, FeedbackCell* feedback_cell)
+      : shared_(shared), feedback_cell_(feedback_cell) {}
 
+  FeedbackCell* feedback_cell() const { return feedback_cell_; }
   SharedFunctionInfo* shared() const { return shared_; }
-  Cell* vector() const { return vector_cell_; }
 
+  bool has_feedback_cell() const { return feedback_cell_ != nullptr; }
   bool has_shared() const { return shared_ != nullptr; }
-  bool has_vector() const { return vector_cell_ != nullptr; }
 
  private:
   SharedFunctionInfo* shared_;
-  Cell* vector_cell_;
+  FeedbackCell* feedback_cell_;
 };
 
 // This cache is used in two different variants. For regexp caching, it simply
@@ -71,12 +71,12 @@ class CompilationCacheTable
   // Find cached value for a string key, otherwise return null.
   Handle<Object> Lookup(Handle<String> src, Handle<Context> context,
                         LanguageMode language_mode);
-  InfoVectorPair LookupScript(Handle<String> src, Handle<Context> context,
-                              LanguageMode language_mode);
-  InfoVectorPair LookupEval(Handle<String> src,
-                            Handle<SharedFunctionInfo> shared,
-                            Handle<Context> native_context,
-                            LanguageMode language_mode, int position);
+  MaybeHandle<SharedFunctionInfo> LookupScript(Handle<String> src,
+                                               Handle<Context> context,
+                                               LanguageMode language_mode);
+  InfoCellPair LookupEval(Handle<String> src, Handle<SharedFunctionInfo> shared,
+                          Handle<Context> native_context,
+                          LanguageMode language_mode, int position);
   Handle<Object> LookupRegExp(Handle<String> source, JSRegExp::Flags flags);
   static Handle<CompilationCacheTable> Put(Handle<CompilationCacheTable> cache,
                                            Handle<String> src,
@@ -86,11 +86,12 @@ class CompilationCacheTable
   static Handle<CompilationCacheTable> PutScript(
       Handle<CompilationCacheTable> cache, Handle<String> src,
       Handle<Context> context, LanguageMode language_mode,
-      Handle<SharedFunctionInfo> value, Handle<Cell> literals);
+      Handle<SharedFunctionInfo> value);
   static Handle<CompilationCacheTable> PutEval(
       Handle<CompilationCacheTable> cache, Handle<String> src,
       Handle<SharedFunctionInfo> outer_info, Handle<SharedFunctionInfo> value,
-      Handle<Context> native_context, Handle<Cell> literals, int position);
+      Handle<Context> native_context, Handle<FeedbackCell> feedback_cell,
+      int position);
   static Handle<CompilationCacheTable> PutRegExp(
       Handle<CompilationCacheTable> cache, Handle<String> src,
       JSRegExp::Flags flags, Handle<FixedArray> value);
diff --git a/deps/v8/src/objects/data-handler-inl.h b/deps/v8/src/objects/data-handler-inl.h
index 40c3658e60f..f0650479f7a 100644
--- a/deps/v8/src/objects/data-handler-inl.h
+++ b/deps/v8/src/objects/data-handler-inl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_DATA_HANDLER_INL_H_
-#define V8_DATA_HANDLER_INL_H_
+#ifndef V8_OBJECTS_DATA_HANDLER_INL_H_
+#define V8_OBJECTS_DATA_HANDLER_INL_H_
 
 #include "src/objects/data-handler.h"
 
@@ -38,4 +38,4 @@ ACCESSORS_CHECKED(DataHandler, data3, Object, kData3Offset,
 
 #include "src/objects/object-macros-undef.h"
 
-#endif  // V8_DATA_HANDLER_INL_H_
+#endif  // V8_OBJECTS_DATA_HANDLER_INL_H_
diff --git a/deps/v8/src/objects/data-handler.h b/deps/v8/src/objects/data-handler.h
index f11d00fa383..8b3298207fa 100644
--- a/deps/v8/src/objects/data-handler.h
+++ b/deps/v8/src/objects/data-handler.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_DATA_HANDLER_H_
-#define V8_DATA_HANDLER_H_
+#ifndef V8_OBJECTS_DATA_HANDLER_H_
+#define V8_OBJECTS_DATA_HANDLER_H_
 
 #include "src/objects.h"
 
@@ -60,4 +60,4 @@ class DataHandler : public Struct {
 
 #include "src/objects/object-macros-undef.h"
 
-#endif  // V8_DATA_HANDLER_H_
+#endif  // V8_OBJECTS_DATA_HANDLER_H_
diff --git a/deps/v8/src/objects/debug-objects-inl.h b/deps/v8/src/objects/debug-objects-inl.h
index 002ac5215dd..084ea7b15c7 100644
--- a/deps/v8/src/objects/debug-objects-inl.h
+++ b/deps/v8/src/objects/debug-objects-inl.h
@@ -28,7 +28,7 @@ ACCESSORS(DebugInfo, break_points, FixedArray, kBreakPointsStateOffset)
 ACCESSORS(DebugInfo, coverage_info, Object, kCoverageInfoOffset)
 
 SMI_ACCESSORS(BreakPointInfo, source_position, kSourcePositionOffset)
-ACCESSORS(BreakPointInfo, break_point_objects, Object, kBreakPointObjectsOffset)
+ACCESSORS(BreakPointInfo, break_points, Object, kBreakPointsOffset)
 
 SMI_ACCESSORS(BreakPoint, id, kIdOffset)
 ACCESSORS(BreakPoint, condition, String, kConditionOffset)
diff --git a/deps/v8/src/objects/debug-objects.cc b/deps/v8/src/objects/debug-objects.cc
index c0425fca8a9..6505ca6e7f4 100644
--- a/deps/v8/src/objects/debug-objects.cc
+++ b/deps/v8/src/objects/debug-objects.cc
@@ -23,12 +23,30 @@ bool DebugInfo::ClearBreakInfo() {
   set_debug_bytecode_array(isolate->heap()->undefined_value());
   set_break_points(isolate->heap()->empty_fixed_array());
 
-  int new_flags = flags() & ~kHasBreakInfo & ~kPreparedForBreakpoints;
+  int new_flags = flags();
+  new_flags &= ~kHasBreakInfo & ~kPreparedForBreakpoints;
+  new_flags &= ~kBreakAtEntry & ~kCanBreakAtEntry;
   set_flags(new_flags);
 
   return new_flags == kNone;
 }
 
+void DebugInfo::SetBreakAtEntry() {
+  DCHECK(CanBreakAtEntry());
+  set_flags(flags() | kBreakAtEntry);
+}
+
+void DebugInfo::ClearBreakAtEntry() {
+  DCHECK(CanBreakAtEntry());
+  set_flags(flags() & ~kBreakAtEntry);
+}
+
+bool DebugInfo::BreakAtEntry() const { return (flags() & kBreakAtEntry) != 0; }
+
+bool DebugInfo::CanBreakAtEntry() const {
+  return (flags() & kCanBreakAtEntry) != 0;
+}
+
 // Check if there is a break point at this source position.
 bool DebugInfo::HasBreakPoint(int source_position) {
   DCHECK(HasBreakInfo());
@@ -45,14 +63,12 @@ bool DebugInfo::HasBreakPoint(int source_position) {
 Object* DebugInfo::GetBreakPointInfo(int source_position) {
   DCHECK(HasBreakInfo());
   Isolate* isolate = GetIsolate();
-  if (!break_points()->IsUndefined(isolate)) {
-    for (int i = 0; i < break_points()->length(); i++) {
-      if (!break_points()->get(i)->IsUndefined(isolate)) {
-        BreakPointInfo* break_point_info =
-            BreakPointInfo::cast(break_points()->get(i));
-        if (break_point_info->source_position() == source_position) {
-          return break_point_info;
-        }
+  for (int i = 0; i < break_points()->length(); i++) {
+    if (!break_points()->get(i)->IsUndefined(isolate)) {
+      BreakPointInfo* break_point_info =
+          BreakPointInfo::cast(break_points()->get(i));
+      if (break_point_info->source_position() == source_position) {
+        return break_point_info;
       }
     }
   }
@@ -60,18 +76,16 @@ Object* DebugInfo::GetBreakPointInfo(int source_position) {
 }
 
 bool DebugInfo::ClearBreakPoint(Handle<DebugInfo> debug_info,
-                                Handle<Object> break_point_object) {
+                                Handle<BreakPoint> break_point) {
   DCHECK(debug_info->HasBreakInfo());
   Isolate* isolate = debug_info->GetIsolate();
-  if (debug_info->break_points()->IsUndefined(isolate)) return false;
 
   for (int i = 0; i < debug_info->break_points()->length(); i++) {
     if (debug_info->break_points()->get(i)->IsUndefined(isolate)) continue;
     Handle<BreakPointInfo> break_point_info = Handle<BreakPointInfo>(
         BreakPointInfo::cast(debug_info->break_points()->get(i)), isolate);
-    if (BreakPointInfo::HasBreakPointObject(break_point_info,
-                                            break_point_object)) {
-      BreakPointInfo::ClearBreakPoint(break_point_info, break_point_object);
+    if (BreakPointInfo::HasBreakPoint(break_point_info, break_point)) {
+      BreakPointInfo::ClearBreakPoint(break_point_info, break_point);
       return true;
     }
   }
@@ -79,14 +93,14 @@ bool DebugInfo::ClearBreakPoint(Handle<DebugInfo> debug_info,
 }
 
 void DebugInfo::SetBreakPoint(Handle<DebugInfo> debug_info, int source_position,
-                              Handle<Object> break_point_object) {
+                              Handle<BreakPoint> break_point) {
   DCHECK(debug_info->HasBreakInfo());
   Isolate* isolate = debug_info->GetIsolate();
   Handle<Object> break_point_info(
       debug_info->GetBreakPointInfo(source_position), isolate);
   if (!break_point_info->IsUndefined(isolate)) {
     BreakPointInfo::SetBreakPoint(
-        Handle<BreakPointInfo>::cast(break_point_info), break_point_object);
+        Handle<BreakPointInfo>::cast(break_point_info), break_point);
     return;
   }
 
@@ -102,8 +116,8 @@ void DebugInfo::SetBreakPoint(Handle<DebugInfo> debug_info, int source_position,
   }
   if (index == kNoBreakPointInfo) {
     // No free slot - extend break point info array.
-    Handle<FixedArray> old_break_points = Handle<FixedArray>(
-        FixedArray::cast(debug_info->break_points()), isolate);
+    Handle<FixedArray> old_break_points =
+        Handle<FixedArray>(debug_info->break_points(), isolate);
     Handle<FixedArray> new_break_points = isolate->factory()->NewFixedArray(
         old_break_points->length() +
         DebugInfo::kEstimatedNofBreakPointsInFunction);
@@ -119,27 +133,26 @@ void DebugInfo::SetBreakPoint(Handle<DebugInfo> debug_info, int source_position,
   // Allocate new BreakPointInfo object and set the break point.
   Handle<BreakPointInfo> new_break_point_info =
       isolate->factory()->NewBreakPointInfo(source_position);
-  BreakPointInfo::SetBreakPoint(new_break_point_info, break_point_object);
+  BreakPointInfo::SetBreakPoint(new_break_point_info, break_point);
   debug_info->break_points()->set(index, *new_break_point_info);
 }
 
 // Get the break point objects for a source position.
-Handle<Object> DebugInfo::GetBreakPointObjects(int source_position) {
+Handle<Object> DebugInfo::GetBreakPoints(int source_position) {
   DCHECK(HasBreakInfo());
   Object* break_point_info = GetBreakPointInfo(source_position);
   Isolate* isolate = GetIsolate();
   if (break_point_info->IsUndefined(isolate)) {
     return isolate->factory()->undefined_value();
   }
-  return Handle<Object>(
-      BreakPointInfo::cast(break_point_info)->break_point_objects(), isolate);
+  return Handle<Object>(BreakPointInfo::cast(break_point_info)->break_points(),
+                        isolate);
 }
 
 // Get the total number of break points.
 int DebugInfo::GetBreakPointCount() {
   DCHECK(HasBreakInfo());
   Isolate* isolate = GetIsolate();
-  if (break_points()->IsUndefined(isolate)) return 0;
   int count = 0;
   for (int i = 0; i < break_points()->length(); i++) {
     if (!break_points()->get(i)->IsUndefined(isolate)) {
@@ -151,19 +164,16 @@ int DebugInfo::GetBreakPointCount() {
   return count;
 }
 
-Handle<Object> DebugInfo::FindBreakPointInfo(
-    Handle<DebugInfo> debug_info, Handle<Object> break_point_object) {
+Handle<Object> DebugInfo::FindBreakPointInfo(Handle<DebugInfo> debug_info,
+                                             Handle<BreakPoint> break_point) {
   DCHECK(debug_info->HasBreakInfo());
   Isolate* isolate = debug_info->GetIsolate();
-  if (!debug_info->break_points()->IsUndefined(isolate)) {
-    for (int i = 0; i < debug_info->break_points()->length(); i++) {
-      if (!debug_info->break_points()->get(i)->IsUndefined(isolate)) {
-        Handle<BreakPointInfo> break_point_info = Handle<BreakPointInfo>(
-            BreakPointInfo::cast(debug_info->break_points()->get(i)), isolate);
-        if (BreakPointInfo::HasBreakPointObject(break_point_info,
-                                                break_point_object)) {
-          return break_point_info;
-        }
+  for (int i = 0; i < debug_info->break_points()->length(); i++) {
+    if (!debug_info->break_points()->get(i)->IsUndefined(isolate)) {
+      Handle<BreakPointInfo> break_point_info = Handle<BreakPointInfo>(
+          BreakPointInfo::cast(debug_info->break_points()->get(i)), isolate);
+      if (BreakPointInfo::HasBreakPoint(break_point_info, break_point)) {
+        return break_point_info;
       }
     }
   }
@@ -187,40 +197,34 @@ bool DebugInfo::ClearCoverageInfo() {
 }
 
 namespace {
-bool IsEqual(Object* break_point1, Object* break_point2) {
-  // TODO(kozyatinskiy): remove non-BreakPoint logic once the JS debug API has
-  // been removed.
-  if (break_point1->IsBreakPoint() != break_point2->IsBreakPoint())
-    return false;
-  if (!break_point1->IsBreakPoint()) return break_point1 == break_point2;
-  return BreakPoint::cast(break_point1)->id() ==
-         BreakPoint::cast(break_point2)->id();
+bool IsEqual(BreakPoint* break_point1, BreakPoint* break_point2) {
+  return break_point1->id() == break_point2->id();
 }
 }  // namespace
 
 // Remove the specified break point object.
 void BreakPointInfo::ClearBreakPoint(Handle<BreakPointInfo> break_point_info,
-                                     Handle<Object> break_point_object) {
+                                     Handle<BreakPoint> break_point) {
   Isolate* isolate = break_point_info->GetIsolate();
   // If there are no break points just ignore.
-  if (break_point_info->break_point_objects()->IsUndefined(isolate)) return;
+  if (break_point_info->break_points()->IsUndefined(isolate)) return;
   // If there is a single break point clear it if it is the same.
-  if (!break_point_info->break_point_objects()->IsFixedArray()) {
-    if (IsEqual(break_point_info->break_point_objects(), *break_point_object)) {
-      break_point_info->set_break_point_objects(
-          isolate->heap()->undefined_value());
+  if (!break_point_info->break_points()->IsFixedArray()) {
+    if (IsEqual(BreakPoint::cast(break_point_info->break_points()),
+                *break_point)) {
+      break_point_info->set_break_points(isolate->heap()->undefined_value());
     }
     return;
   }
   // If there are multiple break points shrink the array
-  DCHECK(break_point_info->break_point_objects()->IsFixedArray());
-  Handle<FixedArray> old_array = Handle<FixedArray>(
-      FixedArray::cast(break_point_info->break_point_objects()));
+  DCHECK(break_point_info->break_points()->IsFixedArray());
+  Handle<FixedArray> old_array =
+      Handle<FixedArray>(FixedArray::cast(break_point_info->break_points()));
   Handle<FixedArray> new_array =
       isolate->factory()->NewFixedArray(old_array->length() - 1);
   int found_count = 0;
   for (int i = 0; i < old_array->length(); i++) {
-    if (IsEqual(old_array->get(i), *break_point_object)) {
+    if (IsEqual(BreakPoint::cast(old_array->get(i)), *break_point)) {
       DCHECK_EQ(found_count, 0);
       found_count++;
     } else {
@@ -228,61 +232,60 @@ void BreakPointInfo::ClearBreakPoint(Handle<BreakPointInfo> break_point_info,
     }
   }
   // If the break point was found in the list change it.
-  if (found_count > 0) break_point_info->set_break_point_objects(*new_array);
+  if (found_count > 0) break_point_info->set_break_points(*new_array);
 }
 
 // Add the specified break point object.
 void BreakPointInfo::SetBreakPoint(Handle<BreakPointInfo> break_point_info,
-                                   Handle<Object> break_point_object) {
+                                   Handle<BreakPoint> break_point) {
   Isolate* isolate = break_point_info->GetIsolate();
 
   // If there was no break point objects before just set it.
-  if (break_point_info->break_point_objects()->IsUndefined(isolate)) {
-    break_point_info->set_break_point_objects(*break_point_object);
+  if (break_point_info->break_points()->IsUndefined(isolate)) {
+    break_point_info->set_break_points(*break_point);
     return;
   }
   // If the break point object is the same as before just ignore.
-  if (break_point_info->break_point_objects() == *break_point_object) return;
+  if (break_point_info->break_points() == *break_point) return;
   // If there was one break point object before replace with array.
-  if (!break_point_info->break_point_objects()->IsFixedArray()) {
+  if (!break_point_info->break_points()->IsFixedArray()) {
     Handle<FixedArray> array = isolate->factory()->NewFixedArray(2);
-    array->set(0, break_point_info->break_point_objects());
-    array->set(1, *break_point_object);
-    break_point_info->set_break_point_objects(*array);
+    array->set(0, break_point_info->break_points());
+    array->set(1, *break_point);
+    break_point_info->set_break_points(*array);
     return;
   }
   // If there was more than one break point before extend array.
-  Handle<FixedArray> old_array = Handle<FixedArray>(
-      FixedArray::cast(break_point_info->break_point_objects()));
+  Handle<FixedArray> old_array =
+      Handle<FixedArray>(FixedArray::cast(break_point_info->break_points()));
   Handle<FixedArray> new_array =
       isolate->factory()->NewFixedArray(old_array->length() + 1);
   for (int i = 0; i < old_array->length(); i++) {
     // If the break point was there before just ignore.
-    if (IsEqual(old_array->get(i), *break_point_object)) return;
+    if (IsEqual(BreakPoint::cast(old_array->get(i)), *break_point)) return;
     new_array->set(i, old_array->get(i));
   }
   // Add the new break point.
-  new_array->set(old_array->length(), *break_point_object);
-  break_point_info->set_break_point_objects(*new_array);
+  new_array->set(old_array->length(), *break_point);
+  break_point_info->set_break_points(*new_array);
 }
 
-bool BreakPointInfo::HasBreakPointObject(
-    Handle<BreakPointInfo> break_point_info,
-    Handle<Object> break_point_object) {
+bool BreakPointInfo::HasBreakPoint(Handle<BreakPointInfo> break_point_info,
+                                   Handle<BreakPoint> break_point) {
   // No break point.
   Isolate* isolate = break_point_info->GetIsolate();
-  if (break_point_info->break_point_objects()->IsUndefined(isolate)) {
+  if (break_point_info->break_points()->IsUndefined(isolate)) {
     return false;
   }
   // Single break point.
-  if (!break_point_info->break_point_objects()->IsFixedArray()) {
-    return IsEqual(break_point_info->break_point_objects(),
-                   *break_point_object);
+  if (!break_point_info->break_points()->IsFixedArray()) {
+    return IsEqual(BreakPoint::cast(break_point_info->break_points()),
+                   *break_point);
   }
   // Multiple break points.
-  FixedArray* array = FixedArray::cast(break_point_info->break_point_objects());
+  FixedArray* array = FixedArray::cast(break_point_info->break_points());
   for (int i = 0; i < array->length(); i++) {
-    if (IsEqual(array->get(i), *break_point_object)) {
+    if (IsEqual(BreakPoint::cast(array->get(i)), *break_point)) {
       return true;
     }
   }
@@ -292,11 +295,11 @@ bool BreakPointInfo::HasBreakPointObject(
 // Get the number of break points.
 int BreakPointInfo::GetBreakPointCount() {
   // No break point.
-  if (break_point_objects()->IsUndefined(GetIsolate())) return 0;
+  if (break_points()->IsUndefined(GetIsolate())) return 0;
   // Single break point.
-  if (!break_point_objects()->IsFixedArray()) return 1;
+  if (!break_points()->IsFixedArray()) return 1;
   // Multiple break points.
-  return FixedArray::cast(break_point_objects())->length();
+  return FixedArray::cast(break_points())->length();
 }
 
 int CoverageInfo::SlotCount() const {
diff --git a/deps/v8/src/objects/debug-objects.h b/deps/v8/src/objects/debug-objects.h
index 0ce134b0b3d..767cd7e81be 100644
--- a/deps/v8/src/objects/debug-objects.h
+++ b/deps/v8/src/objects/debug-objects.h
@@ -14,6 +14,7 @@
 namespace v8 {
 namespace internal {
 
+class BreakPoint;
 class BytecodeArray;
 
 // The DebugInfo class holds additional information for a function being
@@ -24,7 +25,9 @@ class DebugInfo : public Struct {
     kNone = 0,
     kHasBreakInfo = 1 << 0,
     kPreparedForBreakpoints = 1 << 1,
-    kHasCoverageInfo = 2 << 1,
+    kHasCoverageInfo = 1 << 2,
+    kBreakAtEntry = 1 << 3,
+    kCanBreakAtEntry = 1 << 4
   };
   typedef base::Flags<Flag> Flags;
 
@@ -51,6 +54,12 @@ class DebugInfo : public Struct {
   // DebugInfo is now empty.
   bool ClearBreakInfo();
 
+  // Accessors to flag whether to break before entering the function.
+  // This is used to break for functions with no source, e.g. builtins.
+  void SetBreakAtEntry();
+  void ClearBreakAtEntry();
+  bool BreakAtEntry() const;
+
   // The instrumented bytecode array for functions with break points.
   DECL_ACCESSORS(debug_bytecode_array, Object)
 
@@ -61,15 +70,15 @@ class DebugInfo : public Struct {
   bool HasBreakPoint(int source_position);
   // Attempt to clear a break point. Return true if successful.
   static bool ClearBreakPoint(Handle<DebugInfo> debug_info,
-                              Handle<Object> break_point_object);
+                              Handle<BreakPoint> break_point);
   // Set a break point.
   static void SetBreakPoint(Handle<DebugInfo> debug_info, int source_position,
-                            Handle<Object> break_point_object);
+                            Handle<BreakPoint> break_point);
   // Get the break point objects for a source position.
-  Handle<Object> GetBreakPointObjects(int source_position);
+  Handle<Object> GetBreakPoints(int source_position);
   // Find the break point info holding this break point object.
   static Handle<Object> FindBreakPointInfo(Handle<DebugInfo> debug_info,
-                                           Handle<Object> break_point_object);
+                                           Handle<BreakPoint> break_point);
   // Get the number of break points for this function.
   int GetBreakPointCount();
 
@@ -78,6 +87,10 @@ class DebugInfo : public Struct {
   inline BytecodeArray* OriginalBytecodeArray();
   inline BytecodeArray* DebugBytecodeArray();
 
+  // Returns whether we should be able to break before entering the function.
+  // This is true for functions with no source, e.g. builtins.
+  bool CanBreakAtEntry() const;
+
   // --- Block Coverage ---
   // ----------------------
 
@@ -122,17 +135,17 @@ class BreakPointInfo : public Tuple2 {
   // The position in the source for the break position.
   DECL_INT_ACCESSORS(source_position)
   // List of related JavaScript break points.
-  DECL_ACCESSORS(break_point_objects, Object)
+  DECL_ACCESSORS(break_points, Object)
 
   // Removes a break point.
   static void ClearBreakPoint(Handle<BreakPointInfo> info,
-                              Handle<Object> break_point_object);
+                              Handle<BreakPoint> break_point);
   // Set a break point.
   static void SetBreakPoint(Handle<BreakPointInfo> info,
-                            Handle<Object> break_point_object);
-  // Check if break point info has this break point object.
-  static bool HasBreakPointObject(Handle<BreakPointInfo> info,
-                                  Handle<Object> break_point_object);
+                            Handle<BreakPoint> break_point);
+  // Check if break point info has this break point.
+  static bool HasBreakPoint(Handle<BreakPointInfo> info,
+                            Handle<BreakPoint> break_point);
   // Get the number of break points for this code offset.
   int GetBreakPointCount();
 
@@ -141,7 +154,7 @@ class BreakPointInfo : public Tuple2 {
   DECL_CAST(BreakPointInfo)
 
   static const int kSourcePositionOffset = kValue1Offset;
-  static const int kBreakPointObjectsOffset = kValue2Offset;
+  static const int kBreakPointsOffset = kValue2Offset;
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(BreakPointInfo);
diff --git a/deps/v8/src/objects/descriptor-array.h b/deps/v8/src/objects/descriptor-array.h
index a89a31fcd53..f520cfb2e0f 100644
--- a/deps/v8/src/objects/descriptor-array.h
+++ b/deps/v8/src/objects/descriptor-array.h
@@ -164,20 +164,20 @@ class DescriptorArray : public FixedArray {
 
   // Returns the fixed array length required to hold number_of_descriptors
   // descriptors.
-  static int LengthFor(int number_of_descriptors) {
+  static constexpr int LengthFor(int number_of_descriptors) {
     return ToKeyIndex(number_of_descriptors);
   }
 
-  static int ToDetailsIndex(int descriptor_number) {
+  static constexpr int ToDetailsIndex(int descriptor_number) {
     return kFirstIndex + (descriptor_number * kEntrySize) + kEntryDetailsIndex;
   }
 
   // Conversion from descriptor number to array indices.
-  static int ToKeyIndex(int descriptor_number) {
+  static constexpr int ToKeyIndex(int descriptor_number) {
     return kFirstIndex + (descriptor_number * kEntrySize) + kEntryKeyIndex;
   }
 
-  static int ToValueIndex(int descriptor_number) {
+  static constexpr int ToValueIndex(int descriptor_number) {
     return kFirstIndex + (descriptor_number * kEntrySize) + kEntryValueIndex;
   }
 
diff --git a/deps/v8/src/objects/dictionary.h b/deps/v8/src/objects/dictionary.h
index 5cf6bfb67d9..4e0307fd082 100644
--- a/deps/v8/src/objects/dictionary.h
+++ b/deps/v8/src/objects/dictionary.h
@@ -165,6 +165,8 @@ class BaseNameDictionary : public Dictionary<Derived, Shape> {
   static Handle<FixedArray> IterationIndices(Handle<Derived> dictionary);
 
   // Copies enumerable keys to preallocated fixed array.
+  // Does not throw for uninitialized exports in module namespace objects, so
+  // this has to be checked separately.
   static void CopyEnumKeysTo(Handle<Derived> dictionary,
                              Handle<FixedArray> storage, KeyCollectionMode mode,
                              KeyAccumulator* accumulator);
@@ -228,26 +230,70 @@ class GlobalDictionary
   inline void ValueAtPut(int entry, Object* value);
 };
 
-class NumberDictionaryShape : public BaseDictionaryShape<uint32_t> {
+class NumberDictionaryBaseShape : public BaseDictionaryShape<uint32_t> {
  public:
-  static const int kPrefixSize = 1;
-  static const int kEntrySize = 3;
-
   static inline bool IsMatch(uint32_t key, Object* other);
   static inline Handle<Object> AsHandle(Isolate* isolate, uint32_t key);
 
   static inline uint32_t Hash(Isolate* isolate, uint32_t key);
   static inline uint32_t HashForObject(Isolate* isolate, Object* object);
+};
+
+class NumberDictionaryShape : public NumberDictionaryBaseShape {
+ public:
+  static const int kPrefixSize = 1;
+  static const int kEntrySize = 3;
+
+  static inline int GetMapRootIndex();
+};
+
+class SimpleNumberDictionaryShape : public NumberDictionaryBaseShape {
+ public:
+  static const bool kHasDetails = false;
+  static const int kPrefixSize = 0;
+  static const int kEntrySize = 2;
+
+  template <typename Dictionary>
+  static inline PropertyDetails DetailsAt(Dictionary* dict, int entry) {
+    UNREACHABLE();
+  }
+
+  template <typename Dictionary>
+  static inline void DetailsAtPut(Dictionary* dict, int entry,
+                                  PropertyDetails value) {
+    UNREACHABLE();
+  }
 
   static inline int GetMapRootIndex();
 };
 
+extern template class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
+    HashTable<SimpleNumberDictionary, SimpleNumberDictionaryShape>;
+
+extern template class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
+    Dictionary<SimpleNumberDictionary, SimpleNumberDictionaryShape>;
+
+// SimpleNumberDictionary is used to map number to an entry.
+class SimpleNumberDictionary
+    : public Dictionary<SimpleNumberDictionary, SimpleNumberDictionaryShape> {
+ public:
+  DECL_CAST(SimpleNumberDictionary)
+  // Type specific at put (default NONE attributes is used when adding).
+  MUST_USE_RESULT static Handle<SimpleNumberDictionary> Set(
+      Handle<SimpleNumberDictionary> dictionary, uint32_t key,
+      Handle<Object> value);
+
+  static const int kEntryValueIndex = 1;
+};
+
 extern template class EXPORT_TEMPLATE_DECLARE(
     V8_EXPORT_PRIVATE) HashTable<NumberDictionary, NumberDictionaryShape>;
 
 extern template class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
     Dictionary<NumberDictionary, NumberDictionaryShape>;
 
+// NumberDictionary is used as elements backing store and provides a bitfield
+// and stores property details for every entry.
 class NumberDictionary
     : public Dictionary<NumberDictionary, NumberDictionaryShape> {
  public:
diff --git a/deps/v8/src/objects/fixed-array-inl.h b/deps/v8/src/objects/fixed-array-inl.h
index edca36c92e0..8c708f48cfa 100644
--- a/deps/v8/src/objects/fixed-array-inl.h
+++ b/deps/v8/src/objects/fixed-array-inl.h
@@ -16,7 +16,8 @@ namespace internal {
 TYPE_CHECKER(ByteArray, BYTE_ARRAY_TYPE)
 TYPE_CHECKER(FixedArrayExact, FIXED_ARRAY_TYPE)
 TYPE_CHECKER(FixedDoubleArray, FIXED_DOUBLE_ARRAY_TYPE)
-TYPE_CHECKER(WeakFixedArray, FIXED_ARRAY_TYPE)
+TYPE_CHECKER(FixedArrayOfWeakCells, FIXED_ARRAY_TYPE)
+TYPE_CHECKER(WeakFixedArray, WEAK_FIXED_ARRAY_TYPE)
 
 CAST_ACCESSOR(ArrayList)
 CAST_ACCESSOR(ByteArray)
@@ -25,10 +26,13 @@ CAST_ACCESSOR(FixedArrayBase)
 CAST_ACCESSOR(FixedDoubleArray)
 CAST_ACCESSOR(FixedTypedArrayBase)
 CAST_ACCESSOR(TemplateList)
+CAST_ACCESSOR(FixedArrayOfWeakCells)
 CAST_ACCESSOR(WeakFixedArray)
 
 SMI_ACCESSORS(FixedArrayBase, length, kLengthOffset)
 SYNCHRONIZED_SMI_ACCESSORS(FixedArrayBase, length, kLengthOffset)
+SMI_ACCESSORS(WeakFixedArray, length, kLengthOffset)
+SYNCHRONIZED_SMI_ACCESSORS(WeakFixedArray, length, kLengthOffset)
 
 Object* FixedArrayBase::unchecked_synchronized_length() const {
   return ACQUIRE_READ_FIELD(this, kLengthOffset);
@@ -142,7 +146,7 @@ void FixedArray::FillWithHoles(int from, int to) {
 }
 
 Object** FixedArray::data_start() {
-  return HeapObject::RawField(this, kHeaderSize);
+  return HeapObject::RawField(this, OffsetOfElementAt(0));
 }
 
 Object** FixedArray::RawFieldOfElementAt(int index) {
@@ -215,36 +219,53 @@ void FixedDoubleArray::FillWithHoles(int from, int to) {
   }
 }
 
-Object* WeakFixedArray::Get(int index) const {
+MaybeObject* WeakFixedArray::Get(int index) const {
+  SLOW_DCHECK(index >= 0 && index < this->length());
+  return RELAXED_READ_WEAK_FIELD(this, OffsetOfElementAt(index));
+}
+
+void WeakFixedArray::Set(int index, MaybeObject* value) {
+  DCHECK_GE(index, 0);
+  DCHECK_LT(index, length());
+  int offset = OffsetOfElementAt(index);
+  RELAXED_WRITE_FIELD(this, offset, value);
+  WEAK_WRITE_BARRIER(GetHeap(), this, offset, value);
+}
+
+MaybeObject** WeakFixedArray::data_start() {
+  return HeapObject::RawMaybeWeakField(this, kHeaderSize);
+}
+
+Object* FixedArrayOfWeakCells::Get(int index) const {
   Object* raw = FixedArray::cast(this)->get(index + kFirstIndex);
   if (raw->IsSmi()) return raw;
   DCHECK(raw->IsWeakCell());
   return WeakCell::cast(raw)->value();
 }
 
-bool WeakFixedArray::IsEmptySlot(int index) const {
+bool FixedArrayOfWeakCells::IsEmptySlot(int index) const {
   DCHECK(index < Length());
   return Get(index)->IsSmi();
 }
 
-void WeakFixedArray::Clear(int index) {
+void FixedArrayOfWeakCells::Clear(int index) {
   FixedArray::cast(this)->set(index + kFirstIndex, Smi::kZero);
 }
 
-int WeakFixedArray::Length() const {
+int FixedArrayOfWeakCells::Length() const {
   return FixedArray::cast(this)->length() - kFirstIndex;
 }
 
-int WeakFixedArray::last_used_index() const {
+int FixedArrayOfWeakCells::last_used_index() const {
   return Smi::ToInt(FixedArray::cast(this)->get(kLastUsedIndexIndex));
 }
 
-void WeakFixedArray::set_last_used_index(int index) {
+void FixedArrayOfWeakCells::set_last_used_index(int index) {
   FixedArray::cast(this)->set(kLastUsedIndexIndex, Smi::FromInt(index));
 }
 
 template <class T>
-T* WeakFixedArray::Iterator::Next() {
+T* FixedArrayOfWeakCells::Iterator::Next() {
   if (list_ != nullptr) {
     // Assert that list did not change during iteration.
     DCHECK_EQ(last_used_index_, list_->last_used_index());
@@ -496,6 +517,16 @@ inline uint8_t FixedTypedArray<Uint8ClampedArrayTraits>::from(int value) {
   return static_cast<uint8_t>(value);
 }
 
+template <>
+inline int64_t FixedTypedArray<BigInt64ArrayTraits>::from(int value) {
+  UNREACHABLE();
+}
+
+template <>
+inline uint64_t FixedTypedArray<BigUint64ArrayTraits>::from(int value) {
+  UNREACHABLE();
+}
+
 template <class Traits>
 typename Traits::ElementType FixedTypedArray<Traits>::from(uint32_t value) {
   return static_cast<ElementType>(value);
@@ -509,6 +540,16 @@ inline uint8_t FixedTypedArray<Uint8ClampedArrayTraits>::from(uint32_t value) {
   return static_cast<uint8_t>(value);
 }
 
+template <>
+inline int64_t FixedTypedArray<BigInt64ArrayTraits>::from(uint32_t value) {
+  UNREACHABLE();
+}
+
+template <>
+inline uint64_t FixedTypedArray<BigUint64ArrayTraits>::from(uint32_t value) {
+  UNREACHABLE();
+}
+
 template <class Traits>
 typename Traits::ElementType FixedTypedArray<Traits>::from(double value) {
   return static_cast<ElementType>(DoubleToInt32(value));
@@ -522,6 +563,16 @@ inline uint8_t FixedTypedArray<Uint8ClampedArrayTraits>::from(double value) {
   return static_cast<uint8_t>(lrint(value));
 }
 
+template <>
+inline int64_t FixedTypedArray<BigInt64ArrayTraits>::from(double value) {
+  UNREACHABLE();
+}
+
+template <>
+inline uint64_t FixedTypedArray<BigUint64ArrayTraits>::from(double value) {
+  UNREACHABLE();
+}
+
 template <>
 inline float FixedTypedArray<Float32ArrayTraits>::from(double value) {
   return static_cast<float>(value);
@@ -532,6 +583,60 @@ inline double FixedTypedArray<Float64ArrayTraits>::from(double value) {
   return value;
 }
 
+template <class Traits>
+typename Traits::ElementType FixedTypedArray<Traits>::from(int64_t value) {
+  UNREACHABLE();
+}
+
+template <class Traits>
+typename Traits::ElementType FixedTypedArray<Traits>::from(uint64_t value) {
+  UNREACHABLE();
+}
+
+template <>
+inline int64_t FixedTypedArray<BigInt64ArrayTraits>::from(int64_t value) {
+  return value;
+}
+
+template <>
+inline uint64_t FixedTypedArray<BigUint64ArrayTraits>::from(uint64_t value) {
+  return value;
+}
+
+template <>
+inline uint64_t FixedTypedArray<BigUint64ArrayTraits>::from(int64_t value) {
+  return static_cast<uint64_t>(value);
+}
+
+template <>
+inline int64_t FixedTypedArray<BigInt64ArrayTraits>::from(uint64_t value) {
+  return static_cast<int64_t>(value);
+}
+
+template <class Traits>
+typename Traits::ElementType FixedTypedArray<Traits>::FromHandle(
+    Handle<Object> value, bool* lossless) {
+  if (value->IsSmi()) {
+    return from(Smi::ToInt(*value));
+  }
+  DCHECK(value->IsHeapNumber());
+  return from(HeapNumber::cast(*value)->value());
+}
+
+template <>
+inline int64_t FixedTypedArray<BigInt64ArrayTraits>::FromHandle(
+    Handle<Object> value, bool* lossless) {
+  DCHECK(value->IsBigInt());
+  return BigInt::cast(*value)->AsInt64(lossless);
+}
+
+template <>
+inline uint64_t FixedTypedArray<BigUint64ArrayTraits>::FromHandle(
+    Handle<Object> value, bool* lossless) {
+  DCHECK(value->IsBigInt());
+  return BigInt::cast(*value)->AsUint64(lossless);
+}
+
 template <class Traits>
 Handle<Object> FixedTypedArray<Traits>::get(FixedTypedArray<Traits>* array,
                                             int index) {
@@ -555,6 +660,20 @@ void FixedTypedArray<Traits>::SetValue(uint32_t index, Object* value) {
   set(index, cast_value);
 }
 
+template <>
+inline void FixedTypedArray<BigInt64ArrayTraits>::SetValue(uint32_t index,
+                                                           Object* value) {
+  DCHECK(value->IsBigInt());
+  set(index, BigInt::cast(value)->AsInt64());
+}
+
+template <>
+inline void FixedTypedArray<BigUint64ArrayTraits>::SetValue(uint32_t index,
+                                                            Object* value) {
+  DCHECK(value->IsBigInt());
+  set(index, BigInt::cast(value)->AsUint64());
+}
+
 Handle<Object> Uint8ArrayTraits::ToHandle(Isolate* isolate, uint8_t scalar) {
   return handle(Smi::FromInt(scalar), isolate);
 }
@@ -592,6 +711,15 @@ Handle<Object> Float64ArrayTraits::ToHandle(Isolate* isolate, double scalar) {
   return isolate->factory()->NewNumber(scalar);
 }
 
+Handle<Object> BigInt64ArrayTraits::ToHandle(Isolate* isolate, int64_t scalar) {
+  return BigInt::FromInt64(isolate, scalar);
+}
+
+Handle<Object> BigUint64ArrayTraits::ToHandle(Isolate* isolate,
+                                              uint64_t scalar) {
+  return BigInt::FromUint64(isolate, scalar);
+}
+
 // static
 template <class Traits>
 STATIC_CONST_MEMBER_DEFINITION const InstanceType
diff --git a/deps/v8/src/objects/fixed-array.h b/deps/v8/src/objects/fixed-array.h
index 5d78af8799f..0c53b2e8bab 100644
--- a/deps/v8/src/objects/fixed-array.h
+++ b/deps/v8/src/objects/fixed-array.h
@@ -103,7 +103,8 @@ class FixedArray : public FixedArrayBase {
 
   // Return a grown copy if the index is bigger than the array's length.
   static Handle<FixedArray> SetAndGrow(Handle<FixedArray> array, int index,
-                                       Handle<Object> value);
+                                       Handle<Object> value,
+                                       PretenureFlag pretenure = NOT_TENURED);
 
   // Setter that uses write barrier.
   inline void set(int index, Object* value);
@@ -242,14 +243,62 @@ class FixedDoubleArray : public FixedArrayBase {
   DISALLOW_IMPLICIT_CONSTRUCTORS(FixedDoubleArray);
 };
 
-class WeakFixedArray : public FixedArray {
+// WeakFixedArray describes fixed-sized arrays with element type
+// MaybeObject*.
+class WeakFixedArray : public HeapObject {
  public:
-  // If |maybe_array| is not a WeakFixedArray, a fresh one will be allocated.
-  // This function does not check if the value exists already, callers must
-  // ensure this themselves if necessary.
-  static Handle<WeakFixedArray> Add(Handle<Object> maybe_array,
-                                    Handle<HeapObject> value,
-                                    int* assigned_index = nullptr);
+  DECL_CAST(WeakFixedArray)
+
+  inline MaybeObject* Get(int index) const;
+
+  // Setter that uses write barrier.
+  inline void Set(int index, MaybeObject* value);
+
+  static constexpr int SizeFor(int length) {
+    return kHeaderSize + length * kPointerSize;
+  }
+
+  DECL_INT_ACCESSORS(length)
+
+  // Get and set the length using acquire loads and release stores.
+  inline int synchronized_length() const;
+  inline void synchronized_set_length(int value);
+
+  // Gives access to raw memory which stores the array's data.
+  inline MaybeObject** data_start();
+
+  DECL_VERIFIER(WeakFixedArray)
+
+  class BodyDescriptor;
+  typedef BodyDescriptor BodyDescriptorWeak;
+
+  static const int kLengthOffset = HeapObject::kHeaderSize;
+  static const int kHeaderSize = kLengthOffset + kPointerSize;
+
+  static const int kMaxLength =
+      (FixedArray::kMaxSize - kHeaderSize) / kPointerSize;
+
+ private:
+  static int OffsetOfElementAt(int index) {
+    return kHeaderSize + index * kPointerSize;
+  }
+
+  friend class Heap;
+
+  static const int kFirstIndex = 1;
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(WeakFixedArray);
+};
+
+// Deprecated. Use WeakFixedArray instead.
+class FixedArrayOfWeakCells : public FixedArray {
+ public:
+  // If |maybe_array| is not a FixedArrayOfWeakCells, a fresh one will be
+  // allocated. This function does not check if the value exists already,
+  // callers must ensure this themselves if necessary.
+  static Handle<FixedArrayOfWeakCells> Add(Handle<Object> maybe_array,
+                                           Handle<HeapObject> value,
+                                           int* assigned_index = nullptr);
 
   // Returns true if an entry was found and removed.
   bool Remove(Handle<HeapObject> value);
@@ -281,7 +330,7 @@ class WeakFixedArray : public FixedArray {
 
    private:
     int index_;
-    WeakFixedArray* list_;
+    FixedArrayOfWeakCells* list_;
 #ifdef DEBUG
     int last_used_index_;
     DisallowHeapAllocation no_gc_;
@@ -289,16 +338,17 @@ class WeakFixedArray : public FixedArray {
     DISALLOW_COPY_AND_ASSIGN(Iterator);
   };
 
-  DECL_CAST(WeakFixedArray)
+  DECL_CAST(FixedArrayOfWeakCells)
 
  private:
   static const int kLastUsedIndexIndex = 0;
   static const int kFirstIndex = 1;
 
-  static Handle<WeakFixedArray> Allocate(
-      Isolate* isolate, int size, Handle<WeakFixedArray> initialize_from);
+  static Handle<FixedArrayOfWeakCells> Allocate(
+      Isolate* isolate, int size,
+      Handle<FixedArrayOfWeakCells> initialize_from);
 
-  static void Set(Handle<WeakFixedArray> array, int index,
+  static void Set(Handle<FixedArrayOfWeakCells> array, int index,
                   Handle<HeapObject> value);
   inline void clear(int index);
 
@@ -309,7 +359,7 @@ class WeakFixedArray : public FixedArray {
   void set(int index, Smi* value);
   void set(int index, Object* value);
   void set(int index, Object* value, WriteBarrierMode mode);
-  DISALLOW_IMPLICIT_CONSTRUCTORS(WeakFixedArray);
+  DISALLOW_IMPLICIT_CONSTRUCTORS(FixedArrayOfWeakCells);
 };
 
 // Generic array grows dynamically with O(1) amortized insertion.
@@ -466,16 +516,18 @@ class PodArray : public ByteArray {
 };
 
 // V has parameters (Type, type, TYPE, C type, element_size)
-#define TYPED_ARRAYS(V)                   \
-  V(Uint8, uint8, UINT8, uint8_t, 1)      \
-  V(Int8, int8, INT8, int8_t, 1)          \
-  V(Uint16, uint16, UINT16, uint16_t, 2)  \
-  V(Int16, int16, INT16, int16_t, 2)      \
-  V(Uint32, uint32, UINT32, uint32_t, 4)  \
-  V(Int32, int32, INT32, int32_t, 4)      \
-  V(Float32, float32, FLOAT32, float, 4)  \
-  V(Float64, float64, FLOAT64, double, 8) \
-  V(Uint8Clamped, uint8_clamped, UINT8_CLAMPED, uint8_t, 1)
+#define TYPED_ARRAYS(V)                                     \
+  V(Uint8, uint8, UINT8, uint8_t, 1)                        \
+  V(Int8, int8, INT8, int8_t, 1)                            \
+  V(Uint16, uint16, UINT16, uint16_t, 2)                    \
+  V(Int16, int16, INT16, int16_t, 2)                        \
+  V(Uint32, uint32, UINT32, uint32_t, 4)                    \
+  V(Int32, int32, INT32, int32_t, 4)                        \
+  V(Float32, float32, FLOAT32, float, 4)                    \
+  V(Float64, float64, FLOAT64, double, 8)                   \
+  V(Uint8Clamped, uint8_clamped, UINT8_CLAMPED, uint8_t, 1) \
+  V(BigUint64, biguint64, BIGUINT64, uint64_t, 8)           \
+  V(BigInt64, bigint64, BIGINT64, int64_t, 8)
 
 class FixedTypedArrayBase : public FixedArrayBase {
  public:
@@ -548,6 +600,11 @@ class FixedTypedArray : public FixedTypedArrayBase {
   static inline ElementType from(int value);
   static inline ElementType from(uint32_t value);
   static inline ElementType from(double value);
+  static inline ElementType from(int64_t value);
+  static inline ElementType from(uint64_t value);
+
+  static inline ElementType FromHandle(Handle<Object> value,
+                                       bool* lossless = nullptr);
 
   // This accessor applies the correct conversion from Smi, HeapNumber
   // and undefined.
diff --git a/deps/v8/src/objects/frame-array.h b/deps/v8/src/objects/frame-array.h
index 59bbfc2b631..55b78384841 100644
--- a/deps/v8/src/objects/frame-array.h
+++ b/deps/v8/src/objects/frame-array.h
@@ -60,7 +60,7 @@ class FrameArray : public FixedArray {
                                           int flags);
   static Handle<FrameArray> AppendWasmFrame(
       Handle<FrameArray> in, Handle<WasmInstanceObject> wasm_instance,
-      int wasm_function_index, WasmCodeWrapper code, int offset, int flags);
+      int wasm_function_index, wasm::WasmCode* code, int offset, int flags);
 
   DECL_CAST(FrameArray)
 
diff --git a/deps/v8/src/objects/hash-table.h b/deps/v8/src/objects/hash-table.h
index a058b7df392..e2180fd8611 100644
--- a/deps/v8/src/objects/hash-table.h
+++ b/deps/v8/src/objects/hash-table.h
@@ -181,6 +181,9 @@ class HashTable : public HashTableBase {
   static const int kMaxCapacity =
       (FixedArray::kMaxLength - kElementsStartIndex) / kEntrySize;
 
+  // Don't shrink a HashTable below this capacity.
+  static const int kMinShrinkCapacity = 16;
+
   // Maximum length to create a regular HashTable (aka. non large object).
   static const int kMaxRegularCapacity = 16384;
 
@@ -208,7 +211,8 @@ class HashTable : public HashTableBase {
   uint32_t FindInsertionEntry(uint32_t hash);
 
   // Attempt to shrink hash table after removal of key.
-  MUST_USE_RESULT static Handle<Derived> Shrink(Handle<Derived> table);
+  MUST_USE_RESULT static Handle<Derived> Shrink(Handle<Derived> table,
+                                                int additionalCapacity = 0);
 
  private:
   // Ensure that kMaxRegularCapacity yields a non-large object dictionary.
@@ -574,48 +578,6 @@ class OrderedHashMap : public OrderedHashTable<OrderedHashMap, 2> {
   static const int kValueOffset = 1;
 };
 
-class WeakHashTableShape : public BaseShape<Handle<Object>> {
- public:
-  static inline bool IsMatch(Handle<Object> key, Object* other);
-  static inline uint32_t Hash(Isolate* isolate, Handle<Object> key);
-  static inline uint32_t HashForObject(Isolate* isolate, Object* object);
-  static inline Handle<Object> AsHandle(Isolate* isolate, Handle<Object> key);
-  static inline int GetMapRootIndex();
-  static const int kPrefixSize = 0;
-  static const int kEntrySize = 2;
-  static const bool kNeedsHoleCheck = false;
-};
-
-// WeakHashTable maps keys that are arbitrary heap objects to heap object
-// values. The table wraps the keys in weak cells and store values directly.
-// Thus it references keys weakly and values strongly.
-class WeakHashTable : public HashTable<WeakHashTable, WeakHashTableShape> {
-  typedef HashTable<WeakHashTable, WeakHashTableShape> DerivedHashTable;
-
- public:
-  DECL_CAST(WeakHashTable)
-
-  // Looks up the value associated with the given key. The hole value is
-  // returned in case the key is not present.
-  Object* Lookup(Handle<HeapObject> key);
-
-  // Adds (or overwrites) the value associated with the given key. Mapping a
-  // key to the hole value causes removal of the whole entry.
-  MUST_USE_RESULT static Handle<WeakHashTable> Put(Handle<WeakHashTable> table,
-                                                   Handle<HeapObject> key,
-                                                   Handle<HeapObject> value);
-
- private:
-  friend class MarkCompactCollector;
-
-  void AddEntry(int entry, Handle<WeakCell> key, Handle<HeapObject> value);
-
-  // Returns the index to the value of an entry.
-  static inline int EntryToValueIndex(int entry) {
-    return EntryToIndex(entry) + 1;
-  }
-};
-
 // This is similar to the OrderedHashTable, except for the memory
 // layout where we use byte instead of Smi. The max capacity of this
 // is only 254, we transition to an OrderedHashTable beyond that
diff --git a/deps/v8/src/objects/intl-objects.cc b/deps/v8/src/objects/intl-objects.cc
index 9688717e766..672cfe0ad7a 100644
--- a/deps/v8/src/objects/intl-objects.cc
+++ b/deps/v8/src/objects/intl-objects.cc
@@ -12,7 +12,9 @@
 
 #include "src/api.h"
 #include "src/factory.h"
+#include "src/global-handles.h"
 #include "src/isolate.h"
+#include "src/managed.h"
 #include "src/objects-inl.h"
 #include "src/property-descriptor.h"
 #include "unicode/brkiter.h"
@@ -900,10 +902,11 @@ void NumberFormat::DeleteNumberFormat(const v8::WeakCallbackInfo<void>& data) {
   GlobalHandles::Destroy(reinterpret_cast<Object**>(data.GetParameter()));
 }
 
-icu::Collator* Collator::InitializeCollator(Isolate* isolate,
-                                            Handle<String> locale,
-                                            Handle<JSObject> options,
-                                            Handle<JSObject> resolved) {
+bool Collator::InitializeCollator(Isolate* isolate,
+                                  Handle<JSObject> collator_holder,
+                                  Handle<String> locale,
+                                  Handle<JSObject> options,
+                                  Handle<JSObject> resolved) {
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
   // Convert BCP47 into ICU locale format.
   UErrorCode status = U_ZERO_ERROR;
@@ -915,7 +918,7 @@ icu::Collator* Collator::InitializeCollator(Isolate* isolate,
     uloc_forLanguageTag(*bcp47_locale, icu_result, ULOC_FULLNAME_CAPACITY,
                         &icu_length, &status);
     if (U_FAILURE(status) || icu_length == 0) {
-      return nullptr;
+      return false;
     }
     icu_locale = icu::Locale(icu_result);
   }
@@ -937,17 +940,16 @@ icu::Collator* Collator::InitializeCollator(Isolate* isolate,
     SetResolvedCollatorSettings(isolate, icu_locale, collator, resolved);
   }
 
-  return collator;
+  Handle<Managed<icu::Collator>> managed =
+      Managed<icu::Collator>::From(isolate, collator);
+  collator_holder->SetEmbedderField(0, *managed);
+
+  return true;
 }
 
 icu::Collator* Collator::UnpackCollator(Isolate* isolate,
                                         Handle<JSObject> obj) {
-  return reinterpret_cast<icu::Collator*>(obj->GetEmbedderField(0));
-}
-
-void Collator::DeleteCollator(const v8::WeakCallbackInfo<void>& data) {
-  delete reinterpret_cast<icu::Collator*>(data.GetInternalField(0));
-  GlobalHandles::Destroy(reinterpret_cast<Object**>(data.GetParameter()));
+  return Managed<icu::Collator>::cast(obj->GetEmbedderField(0))->get();
 }
 
 bool PluralRules::InitializePluralRules(Isolate* isolate, Handle<String> locale,
diff --git a/deps/v8/src/objects/intl-objects.h b/deps/v8/src/objects/intl-objects.h
index d4bdb1e0675..84cf85c6da3 100644
--- a/deps/v8/src/objects/intl-objects.h
+++ b/deps/v8/src/objects/intl-objects.h
@@ -77,20 +77,17 @@ class NumberFormat {
 
 class Collator {
  public:
-  // Create a collator for the specificied locale and options. Returns the
-  // resolved settings for the locale / options.
-  static icu::Collator* InitializeCollator(Isolate* isolate,
-                                           Handle<String> locale,
-                                           Handle<JSObject> options,
-                                           Handle<JSObject> resolved);
+  // Create a collator for the specificied locale and options. Stores the
+  // collator in the provided collator_holder.
+  static bool InitializeCollator(Isolate* isolate,
+                                 Handle<JSObject> collator_holder,
+                                 Handle<String> locale,
+                                 Handle<JSObject> options,
+                                 Handle<JSObject> resolved);
 
   // Unpacks collator object from corresponding JavaScript object.
   static icu::Collator* UnpackCollator(Isolate* isolate, Handle<JSObject> obj);
 
-  // Release memory we allocated for the Collator once the JS object that holds
-  // the pointer gets garbage collected.
-  static void DeleteCollator(const v8::WeakCallbackInfo<void>& data);
-
   // Layout description.
   static const int kCollator = JSObject::kHeaderSize;
   static const int kSize = kCollator + kPointerSize;
diff --git a/deps/v8/src/objects/js-array-inl.h b/deps/v8/src/objects/js-array-inl.h
index 1128e190b23..c65e9d29a30 100644
--- a/deps/v8/src/objects/js-array-inl.h
+++ b/deps/v8/src/objects/js-array-inl.h
@@ -6,6 +6,7 @@
 #define V8_OBJECTS_JS_ARRAY_INL_H_
 
 #include "src/objects/js-array.h"
+#include "src/wasm/wasm-engine.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -76,30 +77,48 @@ void JSArrayBuffer::set_backing_store(void* value, WriteBarrierMode mode) {
 
 ACCESSORS(JSArrayBuffer, byte_length, Object, kByteLengthOffset)
 
-void* JSArrayBuffer::allocation_base() const {
-  intptr_t ptr = READ_INTPTR_FIELD(this, kAllocationBaseOffset);
-  return reinterpret_cast<void*>(ptr);
-}
-
-void JSArrayBuffer::set_allocation_base(void* value, WriteBarrierMode mode) {
-  intptr_t ptr = reinterpret_cast<intptr_t>(value);
-  WRITE_INTPTR_FIELD(this, kAllocationBaseOffset, ptr);
-}
-
 size_t JSArrayBuffer::allocation_length() const {
-  return *reinterpret_cast<const size_t*>(
-      FIELD_ADDR_CONST(this, kAllocationLengthOffset));
+  if (backing_store() == nullptr) {
+    return 0;
+  }
+  // If this buffer is managed by the WasmMemoryTracker
+  if (is_wasm_memory()) {
+    const auto* data =
+        GetIsolate()->wasm_engine()->memory_tracker()->FindAllocationData(
+            backing_store());
+    DCHECK_NOT_NULL(data);
+    return data->allocation_length;
+  }
+  return byte_length()->Number();
 }
 
-void JSArrayBuffer::set_allocation_length(size_t value) {
-  (*reinterpret_cast<size_t*>(FIELD_ADDR(this, kAllocationLengthOffset))) =
-      value;
+void* JSArrayBuffer::allocation_base() const {
+  if (backing_store() == nullptr) {
+    return nullptr;
+  }
+  // If this buffer is managed by the WasmMemoryTracker
+  if (is_wasm_memory()) {
+    const auto* data =
+        GetIsolate()->wasm_engine()->memory_tracker()->FindAllocationData(
+            backing_store());
+    DCHECK_NOT_NULL(data);
+    return data->allocation_base;
+  }
+  return backing_store();
 }
 
 ArrayBuffer::Allocator::AllocationMode JSArrayBuffer::allocation_mode() const {
   using AllocationMode = ArrayBuffer::Allocator::AllocationMode;
-  return has_guard_region() ? AllocationMode::kReservation
-                            : AllocationMode::kNormal;
+  return is_wasm_memory() ? AllocationMode::kReservation
+                          : AllocationMode::kNormal;
+}
+
+bool JSArrayBuffer::is_wasm_memory() const {
+  bool const is_wasm_memory = IsWasmMemory::decode(bit_field());
+  DCHECK_EQ(is_wasm_memory,
+            GetIsolate()->wasm_engine()->memory_tracker()->IsWasmMemory(
+                backing_store()));
+  return is_wasm_memory;
 }
 
 void JSArrayBuffer::set_bit_field(uint32_t bits) {
@@ -143,14 +162,6 @@ void JSArrayBuffer::set_is_shared(bool value) {
   set_bit_field(IsShared::update(bit_field(), value));
 }
 
-bool JSArrayBuffer::has_guard_region() const {
-  return HasGuardRegion::decode(bit_field());
-}
-
-void JSArrayBuffer::set_has_guard_region(bool value) {
-  set_bit_field(HasGuardRegion::update(bit_field(), value));
-}
-
 bool JSArrayBuffer::is_growable() { return IsGrowable::decode(bit_field()); }
 
 void JSArrayBuffer::set_is_growable(bool value) {
@@ -204,15 +215,6 @@ void JSTypedArray::set_length(Object* value, WriteBarrierMode mode) {
   CONDITIONAL_WRITE_BARRIER(GetHeap(), this, kLengthOffset, value, mode);
 }
 
-bool JSTypedArray::HasJSTypedArrayPrototype(Isolate* isolate) {
-  DisallowHeapAllocation no_gc;
-  Object* proto = map()->prototype();
-  if (!proto->IsJSObject()) return false;
-
-  JSObject* proto_obj = JSObject::cast(proto);
-  return proto_obj->map()->prototype() == *isolate->typed_array_prototype();
-}
-
 // static
 MaybeHandle<JSTypedArray> JSTypedArray::Validate(Isolate* isolate,
                                                  Handle<Object> receiver,
@@ -236,33 +238,21 @@ MaybeHandle<JSTypedArray> JSTypedArray::Validate(Isolate* isolate,
   return array;
 }
 
-// static
-Handle<JSFunction> JSTypedArray::DefaultConstructor(
-    Isolate* isolate, Handle<JSTypedArray> exemplar) {
-  Handle<JSFunction> default_ctor = isolate->uint8_array_fun();
-  switch (exemplar->type()) {
-#define TYPED_ARRAY_CTOR(Type, type, TYPE, ctype, size) \
-  case kExternal##Type##Array: {                        \
-    default_ctor = isolate->type##_array_fun();         \
-    break;                                              \
-  }
-
-    TYPED_ARRAYS(TYPED_ARRAY_CTOR)
-#undef TYPED_ARRAY_CTOR
-    default:
-      UNREACHABLE();
-  }
-
-  return default_ctor;
-}
-
 #ifdef VERIFY_HEAP
 ACCESSORS(JSTypedArray, raw_length, Object, kLengthOffset)
 #endif
 
-ACCESSORS(JSArrayIterator, object, Object, kIteratedObjectOffset)
-ACCESSORS(JSArrayIterator, index, Object, kNextIndexOffset)
-ACCESSORS(JSArrayIterator, object_map, Object, kIteratedObjectMapOffset)
+ACCESSORS(JSArrayIterator, iterated_object, Object, kIteratedObjectOffset)
+ACCESSORS(JSArrayIterator, next_index, Object, kNextIndexOffset)
+
+IterationKind JSArrayIterator::kind() const {
+  return static_cast<IterationKind>(
+      Smi::cast(READ_FIELD(this, kKindOffset))->value());
+}
+
+void JSArrayIterator::set_kind(IterationKind kind) {
+  WRITE_FIELD(this, kKindOffset, Smi::FromInt(static_cast<int>(kind)));
+}
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/js-array.h b/deps/v8/src/objects/js-array.h
index 806c275c8f7..200a251e28d 100644
--- a/deps/v8/src/objects/js-array.h
+++ b/deps/v8/src/objects/js-array.h
@@ -100,6 +100,8 @@ class JSArray : public JSObject {
 Handle<Object> CacheInitialJSArrayMaps(Handle<Context> native_context,
                                        Handle<Map> initial_map);
 
+// The JSArrayIterator describes JavaScript Array Iterators Objects, as
+// defined in ES section #sec-array-iterator-objects.
 class JSArrayIterator : public JSObject {
  public:
   DECL_PRINTER(JSArrayIterator)
@@ -107,24 +109,20 @@ class JSArrayIterator : public JSObject {
 
   DECL_CAST(JSArrayIterator)
 
-  // [object]: the [[IteratedObject]] inobject property.
-  DECL_ACCESSORS(object, Object)
+  // [iterated_object]: the [[IteratedObject]] inobject property.
+  DECL_ACCESSORS(iterated_object, Object)
 
-  // [index]: The [[ArrayIteratorNextIndex]] inobject property.
-  DECL_ACCESSORS(index, Object)
+  // [next_index]: The [[ArrayIteratorNextIndex]] inobject property.
+  DECL_ACCESSORS(next_index, Object)
 
-  // [map]: The Map of the [[IteratedObject]] field at the time the iterator is
-  // allocated.
-  DECL_ACCESSORS(object_map, Object)
-
-  // Return the ElementsKind that a JSArrayIterator's [[IteratedObject]] is
-  // expected to have, based on its instance type.
-  static ElementsKind ElementsKindForInstanceType(InstanceType instance_type);
+  // [kind]: the [[ArrayIterationKind]] inobject property.
+  inline IterationKind kind() const;
+  inline void set_kind(IterationKind kind);
 
   static const int kIteratedObjectOffset = JSObject::kHeaderSize;
   static const int kNextIndexOffset = kIteratedObjectOffset + kPointerSize;
-  static const int kIteratedObjectMapOffset = kNextIndexOffset + kPointerSize;
-  static const int kSize = kIteratedObjectMapOffset + kPointerSize;
+  static const int kKindOffset = kNextIndexOffset + kPointerSize;
+  static const int kSize = kKindOffset + kPointerSize;
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSArrayIterator);
@@ -141,14 +139,8 @@ class JSArrayBuffer : public JSObject {
   // [backing_store]: backing memory for this array
   DECL_ACCESSORS(backing_store, void)
 
-  // [allocation_base]: the start of the memory allocation for this array,
-  // normally equal to backing_store
-  DECL_ACCESSORS(allocation_base, void)
-
-  // [allocation_length]: the size of the memory allocation for this array,
-  // normally equal to byte_length
   inline size_t allocation_length() const;
-  inline void set_allocation_length(size_t value);
+  inline void* allocation_base() const;
 
   inline uint32_t bit_field() const;
   inline void set_bit_field(uint32_t bits);
@@ -168,9 +160,6 @@ class JSArrayBuffer : public JSObject {
   inline bool is_shared();
   inline void set_is_shared(bool value);
 
-  inline bool has_guard_region() const;
-  inline void set_has_guard_region(bool value);
-
   inline bool is_growable();
   inline void set_is_growable(bool value);
 
@@ -183,26 +172,34 @@ class JSArrayBuffer : public JSObject {
   struct Allocation {
     using AllocationMode = ArrayBuffer::Allocator::AllocationMode;
 
-    Allocation(void* allocation_base, size_t length, AllocationMode mode)
-        : allocation_base(allocation_base), length(length), mode(mode) {}
+    Allocation(void* allocation_base, size_t length, void* backing_store,
+               AllocationMode mode, bool is_wasm_memory)
+        : allocation_base(allocation_base),
+          length(length),
+          backing_store(backing_store),
+          mode(mode),
+          is_wasm_memory(is_wasm_memory) {}
 
     void* allocation_base;
     size_t length;
+    void* backing_store;
     AllocationMode mode;
+    bool is_wasm_memory;
   };
 
+  // Returns whether the buffer is tracked by the WasmMemoryTracker.
+  inline bool is_wasm_memory() const;
+
+  // Sets whether the buffer is tracked by the WasmMemoryTracker.
+  void set_is_wasm_memory(bool is_wasm_memory);
+
   void FreeBackingStore();
   static void FreeBackingStore(Isolate* isolate, Allocation allocation);
 
   V8_EXPORT_PRIVATE static void Setup(
       Handle<JSArrayBuffer> array_buffer, Isolate* isolate, bool is_external,
       void* data, size_t allocated_length,
-      SharedFlag shared = SharedFlag::kNotShared);
-
-  V8_EXPORT_PRIVATE static void Setup(
-      Handle<JSArrayBuffer> array_buffer, Isolate* isolate, bool is_external,
-      void* allocation_base, size_t allocation_length, void* data,
-      size_t byte_length, SharedFlag shared = SharedFlag::kNotShared);
+      SharedFlag shared = SharedFlag::kNotShared, bool is_wasm_memory = false);
 
   // Returns false if array buffer contents could not be allocated.
   // In this case, |array_buffer| will not be set up.
@@ -219,10 +216,7 @@ class JSArrayBuffer : public JSObject {
   // The rest of the fields are not JSObjects, so they are not iterated over in
   // objects-body-descriptors-inl.h.
   static const int kBackingStoreOffset = kByteLengthOffset + kPointerSize;
-  static const int kAllocationBaseOffset = kBackingStoreOffset + kPointerSize;
-  static const int kAllocationLengthOffset =
-      kAllocationBaseOffset + kPointerSize;
-  static const int kBitFieldSlot = kAllocationLengthOffset + kSizetSize;
+  static const int kBitFieldSlot = kBackingStoreOffset + kPointerSize;
 #if V8_TARGET_LITTLE_ENDIAN || !V8_HOST_ARCH_64_BIT
   static const int kBitFieldOffset = kBitFieldSlot;
 #else
@@ -243,8 +237,8 @@ class JSArrayBuffer : public JSObject {
   class IsNeuterable : public BitField<bool, 2, 1> {};
   class WasNeutered : public BitField<bool, 3, 1> {};
   class IsShared : public BitField<bool, 4, 1> {};
-  class HasGuardRegion : public BitField<bool, 5, 1> {};
-  class IsGrowable : public BitField<bool, 6, 1> {};
+  class IsGrowable : public BitField<bool, 5, 1> {};
+  class IsWasmMemory : public BitField<bool, 6, 1> {};
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSArrayBuffer);
@@ -299,22 +293,9 @@ class JSTypedArray : public JSArrayBufferView {
 
   Handle<JSArrayBuffer> GetBuffer();
 
-  inline bool HasJSTypedArrayPrototype(Isolate* isolate);
   static inline MaybeHandle<JSTypedArray> Validate(Isolate* isolate,
                                                    Handle<Object> receiver,
                                                    const char* method_name);
-  static inline Handle<JSFunction> DefaultConstructor(
-      Isolate* isolate, Handle<JSTypedArray> exemplar);
-  // ES7 section 22.2.4.6 Create ( constructor, argumentList )
-  static MaybeHandle<JSTypedArray> Create(Isolate* isolate,
-                                          Handle<Object> default_ctor, int argc,
-                                          Handle<Object>* argv,
-                                          const char* method_name);
-  // ES7 section 22.2.4.7 TypedArraySpeciesCreate ( exemplar, argumentList )
-  static MaybeHandle<JSTypedArray> SpeciesCreate(Isolate* isolate,
-                                                 Handle<JSTypedArray> exemplar,
-                                                 int argc, Handle<Object>* argv,
-                                                 const char* method_name);
 
   // Dispatched behavior.
   DECL_PRINTER(JSTypedArray)
diff --git a/deps/v8/src/objects/js-promise-inl.h b/deps/v8/src/objects/js-promise-inl.h
new file mode 100644
index 00000000000..afe297b8800
--- /dev/null
+++ b/deps/v8/src/objects/js-promise-inl.h
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_JS_PROMISE_INL_H_
+#define V8_OBJECTS_JS_PROMISE_INL_H_
+
+#include "src/objects.h"
+#include "src/objects/js-promise.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+TYPE_CHECKER(JSPromise, JS_PROMISE_TYPE)
+CAST_ACCESSOR(JSPromise)
+
+ACCESSORS(JSPromise, reactions_or_result, Object, kReactionsOrResultOffset)
+SMI_ACCESSORS(JSPromise, flags, kFlagsOffset)
+BOOL_ACCESSORS(JSPromise, flags, has_handler, kHasHandlerBit)
+BOOL_ACCESSORS(JSPromise, flags, handled_hint, kHandledHintBit)
+
+Object* JSPromise::result() const {
+  DCHECK_NE(Promise::kPending, status());
+  return reactions_or_result();
+}
+
+Object* JSPromise::reactions() const {
+  DCHECK_EQ(Promise::kPending, status());
+  return reactions_or_result();
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_JS_PROMISE_INL_H_
diff --git a/deps/v8/src/objects/js-promise.h b/deps/v8/src/objects/js-promise.h
new file mode 100644
index 00000000000..b454084b8e4
--- /dev/null
+++ b/deps/v8/src/objects/js-promise.h
@@ -0,0 +1,105 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_JS_PROMISE_H_
+#define V8_OBJECTS_JS_PROMISE_H_
+
+#include "src/objects.h"
+#include "src/objects/promise.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+// Representation of promise objects in the specification. Our layout of
+// JSPromise differs a bit from the layout in the specification, for example
+// there's only a single list of PromiseReaction objects, instead of separate
+// lists for fulfill and reject reactions. The PromiseReaction carries both
+// callbacks from the start, and is eventually morphed into the proper kind of
+// PromiseReactionJobTask when the JSPromise is settled.
+//
+// We also overlay the result and reactions fields on the JSPromise, since
+// the reactions are only necessary for pending promises, whereas the result
+// is only meaningful for settled promises.
+class JSPromise : public JSObject {
+ public:
+  // [reactions_or_result]: Smi 0 terminated list of PromiseReaction objects
+  // in case the JSPromise was not settled yet, otherwise the result.
+  DECL_ACCESSORS(reactions_or_result, Object)
+
+  // [result]: Checks that the promise is settled and returns the result.
+  inline Object* result() const;
+
+  // [reactions]: Checks that the promise is pending and returns the reactions.
+  inline Object* reactions() const;
+
+  DECL_INT_ACCESSORS(flags)
+
+  // [has_handler]: Whether this promise has a reject handler or not.
+  DECL_BOOLEAN_ACCESSORS(has_handler)
+
+  // [handled_hint]: Whether this promise will be handled by a catch
+  // block in an async function.
+  DECL_BOOLEAN_ACCESSORS(handled_hint)
+
+  static const char* Status(Promise::PromiseState status);
+  Promise::PromiseState status() const;
+  void set_status(Promise::PromiseState status);
+
+  // ES section #sec-fulfillpromise
+  static Handle<Object> Fulfill(Handle<JSPromise> promise,
+                                Handle<Object> value);
+  // ES section #sec-rejectpromise
+  static Handle<Object> Reject(Handle<JSPromise> promise, Handle<Object> reason,
+                               bool debug_event = true);
+  // ES section #sec-promise-resolve-functions
+  MUST_USE_RESULT static MaybeHandle<Object> Resolve(Handle<JSPromise> promise,
+                                                     Handle<Object> resolution);
+
+  // This is a helper that extracts the JSPromise from the input
+  // {object}, which is used as a payload for PromiseReaction and
+  // PromiseReactionJobTask.
+  MUST_USE_RESULT static MaybeHandle<JSPromise> From(Handle<HeapObject> object);
+
+  DECL_CAST(JSPromise)
+
+  // Dispatched behavior.
+  DECL_PRINTER(JSPromise)
+  DECL_VERIFIER(JSPromise)
+
+  // Layout description.
+  static const int kReactionsOrResultOffset = JSObject::kHeaderSize;
+  static const int kFlagsOffset = kReactionsOrResultOffset + kPointerSize;
+  static const int kSize = kFlagsOffset + kPointerSize;
+  static const int kSizeWithEmbedderFields =
+      kSize + v8::Promise::kEmbedderFieldCount * kPointerSize;
+
+  // Flags layout.
+  // The first two bits store the v8::Promise::PromiseState.
+  static const int kStatusBits = 2;
+  static const int kHasHandlerBit = 2;
+  static const int kHandledHintBit = 3;
+
+  static const int kStatusShift = 0;
+  static const int kStatusMask = 0x3;
+  STATIC_ASSERT(v8::Promise::kPending == 0);
+  STATIC_ASSERT(v8::Promise::kFulfilled == 1);
+  STATIC_ASSERT(v8::Promise::kRejected == 2);
+
+ private:
+  // ES section #sec-triggerpromisereactions
+  static Handle<Object> TriggerPromiseReactions(Isolate* isolate,
+                                                Handle<Object> reactions,
+                                                Handle<Object> argument,
+                                                PromiseReaction::Type type);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_JS_PROMISE_H_
diff --git a/deps/v8/src/objects/js-regexp.h b/deps/v8/src/objects/js-regexp.h
index 69cd5c3104b..6a0c4e3391b 100644
--- a/deps/v8/src/objects/js-regexp.h
+++ b/deps/v8/src/objects/js-regexp.h
@@ -48,7 +48,7 @@ class JSRegExp : public JSObject {
   };
   typedef base::Flags<Flag> Flags;
 
-  static int FlagCount() { return 6; }
+  static constexpr int FlagCount() { return 6; }
 
   DECL_ACCESSORS(data, Object)
   DECL_ACCESSORS(flags, Object)
diff --git a/deps/v8/src/objects/literal-objects-inl.h b/deps/v8/src/objects/literal-objects-inl.h
index 34a427c67bb..fa9fcedaab7 100644
--- a/deps/v8/src/objects/literal-objects-inl.h
+++ b/deps/v8/src/objects/literal-objects-inl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_LITERAL_OBJECTS_INL_H_
-#define V8_LITERAL_OBJECTS_INL_H_
+#ifndef V8_OBJECTS_LITERAL_OBJECTS_INL_H_
+#define V8_OBJECTS_LITERAL_OBJECTS_INL_H_
 
 #include "src/objects-inl.h"
 #include "src/objects/literal-objects.h"
@@ -48,4 +48,4 @@ ACCESSORS(ClassBoilerplate, instance_computed_properties, FixedArray,
 
 #include "src/objects/object-macros-undef.h"
 
-#endif  // V8_LITERAL_OBJECTS_INL_H_
+#endif  // V8_OBJECTS_LITERAL_OBJECTS_INL_H_
diff --git a/deps/v8/src/objects/literal-objects.cc b/deps/v8/src/objects/literal-objects.cc
index 13f8b008789..ab673aad801 100644
--- a/deps/v8/src/objects/literal-objects.cc
+++ b/deps/v8/src/objects/literal-objects.cc
@@ -423,6 +423,10 @@ void ClassBoilerplate::AddToElementsTemplate(
 
 Handle<ClassBoilerplate> ClassBoilerplate::BuildClassBoilerplate(
     Isolate* isolate, ClassLiteral* expr) {
+  // Create a non-caching handle scope to ensure that the temporary handle used
+  // by ObjectDescriptor for passing Smis around does not corrupt handle cache
+  // in CanonicalHandleScope.
+  HandleScope scope(isolate);
   Factory* factory = isolate->factory();
   ObjectDescriptor static_desc;
   ObjectDescriptor instance_desc;
@@ -509,11 +513,14 @@ Handle<ClassBoilerplate> ClassBoilerplate::BuildClassBoilerplate(
       case ClassLiteral::Property::SETTER:
         value_kind = ClassBoilerplate::kSetter;
         break;
-      case ClassLiteral::Property::FIELD:
+      case ClassLiteral::Property::PUBLIC_FIELD:
         if (property->is_computed_name()) {
           ++dynamic_argument_index;
         }
         continue;
+      case ClassLiteral::Property::PRIVATE_FIELD:
+        DCHECK(!property->is_computed_name());
+        continue;
     }
 
     ObjectDescriptor& desc =
@@ -580,7 +587,7 @@ Handle<ClassBoilerplate> ClassBoilerplate::BuildClassBoilerplate(
   class_boilerplate->set_instance_computed_properties(
       *instance_desc.computed_properties());
 
-  return class_boilerplate;
+  return scope.CloseAndEscape(class_boilerplate);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/literal-objects.h b/deps/v8/src/objects/literal-objects.h
index 7fb0c712f24..c5c2c765c9c 100644
--- a/deps/v8/src/objects/literal-objects.h
+++ b/deps/v8/src/objects/literal-objects.h
@@ -35,6 +35,7 @@ class BoilerplateDescription : public FixedArray {
   void set_backing_store_size(Isolate* isolate, int backing_store_size);
 
   DECL_CAST(BoilerplateDescription)
+  DECL_PRINTER(BoilerplateDescription)
 
  private:
   bool has_number_of_properties() const;
diff --git a/deps/v8/src/objects/map-inl.h b/deps/v8/src/objects/map-inl.h
index c78f947b3a8..11c73c1da62 100644
--- a/deps/v8/src/objects/map-inl.h
+++ b/deps/v8/src/objects/map-inl.h
@@ -49,6 +49,8 @@ BIT_FIELD_ACCESSORS(Map, bit_field, has_prototype_slot,
 // |bit_field2| fields.
 BIT_FIELD_ACCESSORS(Map, bit_field2, is_extensible, Map::IsExtensibleBit)
 BIT_FIELD_ACCESSORS(Map, bit_field2, is_prototype_map, Map::IsPrototypeMapBit)
+BIT_FIELD_ACCESSORS(Map, bit_field2, is_in_retained_map_list,
+                    Map::IsInRetainedMapListBit)
 
 // |bit_field3| fields.
 BIT_FIELD_ACCESSORS(Map, bit_field3, owns_descriptors, Map::OwnsDescriptorsBit)
@@ -503,6 +505,7 @@ bool Map::IsJSObjectMap() const {
   STATIC_ASSERT(LAST_JS_OBJECT_TYPE == LAST_TYPE);
   return instance_type() >= FIRST_JS_OBJECT_TYPE;
 }
+bool Map::IsJSPromiseMap() const { return instance_type() == JS_PROMISE_TYPE; }
 bool Map::IsJSArrayMap() const { return instance_type() == JS_ARRAY_TYPE; }
 bool Map::IsJSFunctionMap() const {
   return instance_type() == JS_FUNCTION_TYPE;
@@ -659,9 +662,17 @@ void Map::SetBackPointer(Object* value, WriteBarrierMode mode) {
 
 ACCESSORS(Map, dependent_code, DependentCode, kDependentCodeOffset)
 ACCESSORS(Map, weak_cell_cache, Object, kWeakCellCacheOffset)
+ACCESSORS(Map, prototype_validity_cell, Object, kPrototypeValidityCellOffset)
 ACCESSORS(Map, constructor_or_backpointer, Object,
           kConstructorOrBackPointerOffset)
 
+bool Map::IsPrototypeValidityCellValid() const {
+  Object* validity_cell = prototype_validity_cell();
+  Object* value = validity_cell->IsSmi() ? Smi::cast(validity_cell)
+                                         : Cell::cast(validity_cell)->value();
+  return value == Smi::FromInt(Map::kPrototypeChainValid);
+}
+
 Object* Map::GetConstructor() const {
   Object* maybe_constructor = constructor_or_backpointer();
   // Follow any back pointers.
diff --git a/deps/v8/src/objects/map.h b/deps/v8/src/objects/map.h
index bf0d8438842..16d66243e6e 100644
--- a/deps/v8/src/objects/map.h
+++ b/deps/v8/src/objects/map.h
@@ -26,6 +26,7 @@ namespace internal {
   V(CodeDataContainer)     \
   V(ConsString)            \
   V(DataObject)            \
+  V(FeedbackCell)          \
   V(FeedbackVector)        \
   V(FixedArray)            \
   V(FixedDoubleArray)      \
@@ -37,7 +38,6 @@ namespace internal {
   V(JSFunction)            \
   V(JSObject)              \
   V(JSObjectFast)          \
-  V(JSRegExp)              \
   V(JSWeakCollection)      \
   V(Map)                   \
   V(NativeContext)         \
@@ -55,7 +55,9 @@ namespace internal {
   V(Symbol)                \
   V(ThinString)            \
   V(TransitionArray)       \
-  V(WeakCell)
+  V(WasmInstanceObject)    \
+  V(WeakCell)              \
+  V(WeakFixedArray)
 
 // For data objects, JS objects and structs along with generic visitor which
 // can visit object of any size we provide visitors specialized by
@@ -115,11 +117,12 @@ typedef std::vector<Handle<Map>> MapHandles;
 //      |          |   - is_undetectable (bit 4)                 |
 //      |          |   - is_access_check_needed (bit 5)          |
 //      |          |   - is_constructor (bit 6)                  |
-//      |          |   - unused (bit 7)                          |
+//      |          |   - has_prototype_slot (bit 7)              |
 //      +----------+---------------------------------------------+
 //      | Byte     | [bit_field2]                                |
 //      |          |   - is_extensible (bit 0)                   |
-//      |          |   - is_prototype_map (bit 2)                |
+//      |          |   - is_prototype_map (bit 1)                |
+//      |          |   - is_in_retained_map_list (bit 2)         |
 //      |          |   - elements_kind (bits 3..7)               |
 // +----+----------+---------------------------------------------+
 // | Int           | [bit_field3]                                |
@@ -238,10 +241,10 @@ class Map : public HeapObject {
   DECL_PRIMITIVE_ACCESSORS(bit_field2, byte)
 
 // Bit positions for |bit_field2|.
-#define MAP_BIT_FIELD2_FIELDS(V, _) \
-  /* One bit is still free here. */ \
-  V(IsExtensibleBit, bool, 1, _)    \
-  V(IsPrototypeMapBit, bool, 1, _)  \
+#define MAP_BIT_FIELD2_FIELDS(V, _)     \
+  V(IsExtensibleBit, bool, 1, _)        \
+  V(IsPrototypeMapBit, bool, 1, _)      \
+  V(IsInRetainedMapListBit, bool, 1, _) \
   V(ElementsKindBits, ElementsKind, 5, _)
 
   DEFINE_BIT_FIELDS(MAP_BIT_FIELD2_FIELDS)
@@ -368,6 +371,10 @@ class Map : public HeapObject {
   DECL_BOOLEAN_ACCESSORS(is_prototype_map)
   inline bool is_abandoned_prototype_map() const;
 
+  // Whether the instance has been added to the retained map list by
+  // Heap::AddRetainedMap.
+  DECL_BOOLEAN_ACCESSORS(is_in_retained_map_list)
+
   DECL_PRIMITIVE_ACCESSORS(elements_kind, ElementsKind)
 
   // Tells whether the instance has fast elements that are only Smis.
@@ -558,6 +565,24 @@ class Map : public HeapObject {
   // [weak cell cache]: cache that stores a weak cell pointing to this map.
   DECL_ACCESSORS(weak_cell_cache, Object)
 
+  // [prototype_validity_cell]: Cell containing the validity bit for prototype
+  // chains or Smi(0) if uninitialized.
+  // The meaning of this validity cell is different for prototype maps and
+  // non-prototype maps.
+  // For prototype maps the validity bit "guards" modifications of prototype
+  // chains going through this object. When a prototype object changes, both its
+  // own validity cell and those of all "downstream" prototypes are invalidated;
+  // handlers for a given receiver embed the currently valid cell for that
+  // receiver's prototype during their creation and check it on execution.
+  // For non-prototype maps which are used as transitioning store handlers this
+  // field contains the validity cell which guards modifications of this map's
+  // prototype.
+  DECL_ACCESSORS(prototype_validity_cell, Object)
+
+  // Returns true if prototype validity cell value represents "valid" prototype
+  // chain state.
+  inline bool IsPrototypeValidityCellValid() const;
+
   inline PropertyDetails GetLastDescriptorDetails() const;
 
   inline int LastAdded() const;
@@ -713,6 +738,7 @@ class Map : public HeapObject {
   inline bool IsPrimitiveMap() const;
   inline bool IsJSReceiverMap() const;
   inline bool IsJSObjectMap() const;
+  inline bool IsJSPromiseMap() const;
   inline bool IsJSArrayMap() const;
   inline bool IsJSFunctionMap() const;
   inline bool IsStringMap() const;
@@ -771,6 +797,7 @@ class Map : public HeapObject {
   V(kLayoutDescriptorOffset, FLAG_unbox_double_fields ? kPointerSize : 0)   \
   V(kDependentCodeOffset, kPointerSize)                                     \
   V(kWeakCellCacheOffset, kPointerSize)                                     \
+  V(kPrototypeValidityCellOffset, kPointerSize)                             \
   V(kPointerFieldsEndOffset, 0)                                             \
   /* Total size. */                                                         \
   V(kSize, 0)
diff --git a/deps/v8/src/objects/maybe-object-inl.h b/deps/v8/src/objects/maybe-object-inl.h
new file mode 100644
index 00000000000..053fb3fb0bc
--- /dev/null
+++ b/deps/v8/src/objects/maybe-object-inl.h
@@ -0,0 +1,82 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_MAYBE_OBJECT_INL_H_
+#define V8_OBJECTS_MAYBE_OBJECT_INL_H_
+
+#include "include/v8.h"
+#include "src/globals.h"
+
+namespace v8 {
+namespace internal {
+
+bool MaybeObject::ToSmi(Smi** value) {
+  if (HAS_SMI_TAG(this)) {
+    *value = Smi::cast(reinterpret_cast<Object*>(this));
+    return true;
+  }
+  return false;
+}
+
+bool MaybeObject::IsStrongOrWeakHeapObject() {
+  if (IsSmi() || IsClearedWeakHeapObject()) {
+    return false;
+  }
+  return true;
+}
+
+bool MaybeObject::ToStrongOrWeakHeapObject(HeapObject** result) {
+  if (IsSmi() || IsClearedWeakHeapObject()) {
+    return false;
+  }
+  *result = GetHeapObject();
+  return true;
+}
+
+bool MaybeObject::ToStrongOrWeakHeapObject(
+    HeapObject** result, HeapObjectReferenceType* reference_type) {
+  if (IsSmi() || IsClearedWeakHeapObject()) {
+    return false;
+  }
+  *reference_type = HasWeakHeapObjectTag(this)
+                        ? HeapObjectReferenceType::WEAK
+                        : HeapObjectReferenceType::STRONG;
+  *result = GetHeapObject();
+  return true;
+}
+
+bool MaybeObject::IsStrongHeapObject() {
+  return !HasWeakHeapObjectTag(this) && !IsSmi();
+}
+
+bool MaybeObject::ToStrongHeapObject(HeapObject** result) {
+  if (!HasWeakHeapObjectTag(this) && !IsSmi()) {
+    *result = reinterpret_cast<HeapObject*>(this);
+    return true;
+  }
+  return false;
+}
+
+bool MaybeObject::IsWeakHeapObject() {
+  return HasWeakHeapObjectTag(this) && !IsClearedWeakHeapObject();
+}
+
+bool MaybeObject::ToWeakHeapObject(HeapObject** result) {
+  if (HasWeakHeapObjectTag(this) && !IsClearedWeakHeapObject()) {
+    *result = GetHeapObject();
+    return true;
+  }
+  return false;
+}
+
+HeapObject* MaybeObject::GetHeapObject() {
+  DCHECK(!IsSmi());
+  DCHECK(!IsClearedWeakHeapObject());
+  return RemoveWeakHeapObjectMask(reinterpret_cast<HeapObjectReference*>(this));
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_OBJECTS_MAYBE_OBJECT_INL_H_
diff --git a/deps/v8/src/objects/maybe-object.h b/deps/v8/src/objects/maybe-object.h
new file mode 100644
index 00000000000..98d46fed9df
--- /dev/null
+++ b/deps/v8/src/objects/maybe-object.h
@@ -0,0 +1,106 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_MAYBE_OBJECT_H_
+#define V8_OBJECTS_MAYBE_OBJECT_H_
+
+#include "include/v8.h"
+#include "src/globals.h"
+
+namespace v8 {
+namespace internal {
+
+class HeapObject;
+class Smi;
+
+// A MaybeObject is either a SMI, a strong reference to a HeapObject, a weak
+// reference to a HeapObject, or a cleared weak reference. It's used for
+// implementing in-place weak references (see design doc: goo.gl/j6SdcK )
+class MaybeObject {
+ public:
+  bool IsSmi() const { return HAS_SMI_TAG(this); }
+  inline bool ToSmi(Smi** value);
+
+  bool IsClearedWeakHeapObject() {
+    return ::v8::internal::IsClearedWeakHeapObject(this);
+  }
+
+  inline bool IsStrongOrWeakHeapObject();
+  inline bool ToStrongOrWeakHeapObject(HeapObject** result);
+  inline bool ToStrongOrWeakHeapObject(HeapObject** result,
+                                       HeapObjectReferenceType* reference_type);
+  inline bool IsStrongHeapObject();
+  inline bool ToStrongHeapObject(HeapObject** result);
+  inline bool IsWeakHeapObject();
+  inline bool ToWeakHeapObject(HeapObject** result);
+
+  inline HeapObject* GetHeapObject();
+
+  static MaybeObject* FromSmi(Smi* smi) {
+    DCHECK(HAS_SMI_TAG(smi));
+    return reinterpret_cast<MaybeObject*>(smi);
+  }
+
+  static MaybeObject* FromObject(Object* object) {
+    DCHECK(!HasWeakHeapObjectTag(object));
+    return reinterpret_cast<MaybeObject*>(object);
+  }
+
+  static MaybeObject* MakeWeak(MaybeObject* object) {
+    DCHECK(object->IsStrongOrWeakHeapObject());
+    return AddWeakHeapObjectMask(object);
+  }
+
+#ifdef VERIFY_HEAP
+  static void VerifyMaybeObjectPointer(MaybeObject* p);
+#endif
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(MaybeObject);
+};
+
+// A HeapObjectReference is either a strong reference to a HeapObject, a weak
+// reference to a HeapObject, or a cleared weak reference.
+class HeapObjectReference : public MaybeObject {
+ public:
+  static HeapObjectReference* Strong(HeapObject* object) {
+    DCHECK(!HasWeakHeapObjectTag(object));
+    return reinterpret_cast<HeapObjectReference*>(object);
+  }
+
+  static HeapObjectReference* Weak(HeapObject* object) {
+    DCHECK(!HasWeakHeapObjectTag(object));
+    return AddWeakHeapObjectMask(object);
+  }
+
+  static HeapObjectReference* ClearedValue() {
+    return reinterpret_cast<HeapObjectReference*>(kClearedWeakHeapObject);
+  }
+
+  static void Update(HeapObjectReference** slot, HeapObject* value) {
+    DCHECK(!HAS_SMI_TAG(*slot));
+    DCHECK(Internals::HasHeapObjectTag(value));
+
+#ifdef DEBUG
+    bool weak_before = HasWeakHeapObjectTag(*slot);
+#endif
+
+    *slot = reinterpret_cast<HeapObjectReference*>(
+        reinterpret_cast<intptr_t>(value) |
+        (reinterpret_cast<intptr_t>(*slot) & kWeakHeapObjectMask));
+
+#ifdef DEBUG
+    bool weak_after = HasWeakHeapObjectTag(*slot);
+    DCHECK_EQ(weak_before, weak_after);
+#endif
+  }
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(HeapObjectReference);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_OBJECTS_MAYBE_OBJECT_H_
diff --git a/deps/v8/src/objects/microtask-inl.h b/deps/v8/src/objects/microtask-inl.h
new file mode 100644
index 00000000000..71a9ea20ece
--- /dev/null
+++ b/deps/v8/src/objects/microtask-inl.h
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_MICROTASK_INL_H_
+#define V8_OBJECTS_MICROTASK_INL_H_
+
+#include "src/objects/microtask.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+CAST_ACCESSOR(Microtask)
+CAST_ACCESSOR(CallbackTask)
+CAST_ACCESSOR(CallableTask)
+
+ACCESSORS(CallableTask, callable, JSReceiver, kCallableOffset)
+ACCESSORS(CallableTask, context, Context, kContextOffset)
+
+ACCESSORS(CallbackTask, callback, Foreign, kCallbackOffset)
+ACCESSORS(CallbackTask, data, Foreign, kDataOffset)
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_MICROTASK_INL_H_
diff --git a/deps/v8/src/objects/microtask.h b/deps/v8/src/objects/microtask.h
new file mode 100644
index 00000000000..33f121aa2c1
--- /dev/null
+++ b/deps/v8/src/objects/microtask.h
@@ -0,0 +1,77 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_MICROTASK_H_
+#define V8_OBJECTS_MICROTASK_H_
+
+#include "src/objects.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+// Abstract base class for all microtasks that can be scheduled on the
+// microtask queue. This class merely serves the purpose of a marker
+// interface.
+class Microtask : public Struct {
+ public:
+  // Dispatched behavior.
+  DECL_CAST(Microtask)
+  DECL_VERIFIER(Microtask)
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(Microtask);
+};
+
+// A CallbackTask is a special Microtask that allows us to schedule
+// C++ microtask callbacks on the microtask queue. This is heavily
+// used by Blink for example.
+class CallbackTask : public Microtask {
+ public:
+  DECL_ACCESSORS(callback, Foreign)
+  DECL_ACCESSORS(data, Foreign)
+
+  static const int kCallbackOffset = Microtask::kHeaderSize;
+  static const int kDataOffset = kCallbackOffset + kPointerSize;
+  static const int kSize = kDataOffset + kPointerSize;
+
+  // Dispatched behavior.
+  DECL_CAST(CallbackTask)
+  DECL_PRINTER(CallbackTask)
+  DECL_VERIFIER(CallbackTask)
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(CallbackTask)
+};
+
+// A CallableTask is a special (internal) Microtask that allows us to
+// schedule arbitrary callables on the microtask queue. We use this
+// for various tests of the microtask queue.
+class CallableTask : public Microtask {
+ public:
+  DECL_ACCESSORS(callable, JSReceiver)
+  DECL_ACCESSORS(context, Context)
+
+  static const int kCallableOffset = Microtask::kHeaderSize;
+  static const int kContextOffset = kCallableOffset + kPointerSize;
+  static const int kSize = kContextOffset + kPointerSize;
+
+  // Dispatched behavior.
+  DECL_CAST(CallableTask)
+  DECL_PRINTER(CallableTask)
+  DECL_VERIFIER(CallableTask)
+  void BriefPrintDetails(std::ostream& os);
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(CallableTask);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_MICROTASK_H_
diff --git a/deps/v8/src/objects/module.cc b/deps/v8/src/objects/module.cc
index b9d7697fb58..e2472616f6d 100644
--- a/deps/v8/src/objects/module.cc
+++ b/deps/v8/src/objects/module.cc
@@ -900,5 +900,28 @@ MaybeHandle<Object> JSModuleNamespace::GetExport(Handle<String> name) {
   return value;
 }
 
+Maybe<PropertyAttributes> JSModuleNamespace::GetPropertyAttributes(
+    LookupIterator* it) {
+  Handle<JSModuleNamespace> object = it->GetHolder<JSModuleNamespace>();
+  Handle<String> name = Handle<String>::cast(it->GetName());
+  DCHECK_EQ(it->state(), LookupIterator::ACCESSOR);
+
+  Isolate* isolate = name->GetIsolate();
+
+  Handle<Object> lookup(object->module()->exports()->Lookup(name), isolate);
+  if (lookup->IsTheHole(isolate)) {
+    return Just(ABSENT);
+  }
+
+  Handle<Object> value(Handle<Cell>::cast(lookup)->value(), isolate);
+  if (value->IsTheHole(isolate)) {
+    isolate->Throw(*isolate->factory()->NewReferenceError(
+        MessageTemplate::kNotDefined, name));
+    return Nothing<PropertyAttributes>();
+  }
+
+  return Just(it->property_attributes());
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/module.h b/deps/v8/src/objects/module.h
index fe374d3fc63..d037b1a07d0 100644
--- a/deps/v8/src/objects/module.h
+++ b/deps/v8/src/objects/module.h
@@ -24,17 +24,16 @@ class ModuleInfoEntry;
 class String;
 class Zone;
 
-// A Module object is a mapping from export names to cells
-// This is still very much in flux.
+// The runtime representation of an ECMAScript module.
 class Module : public Struct {
  public:
   DECL_CAST(Module)
   DECL_VERIFIER(Module)
   DECL_PRINTER(Module)
 
-  // The code representing this Module, or an abstraction thereof.
-  // This is either a SharedFunctionInfo or a JSFunction or a ModuleInfo
-  // depending on whether the module has been instantiated and evaluated.  See
+  // The code representing this module, or an abstraction thereof.
+  // This is either a SharedFunctionInfo, a JSFunction, a JSGeneratorObject, or
+  // a ModuleInfo, depending on the state (status) the module is in. See
   // Module::ModuleVerify() for the precise invariant.
   DECL_ACCESSORS(code, Object)
 
@@ -216,6 +215,12 @@ class JSModuleNamespace : public JSObject {
   // schedule an exception and return Nothing.
   MUST_USE_RESULT MaybeHandle<Object> GetExport(Handle<String> name);
 
+  // Return the (constant) property attributes for the referenced property,
+  // which is assumed to correspond to an export. If the export is
+  // uninitialized, schedule an exception and return Nothing.
+  static MUST_USE_RESULT Maybe<PropertyAttributes> GetPropertyAttributes(
+      LookupIterator* it);
+
   // In-object fields.
   enum {
     kToStringTagFieldIndex,
diff --git a/deps/v8/src/objects/name-inl.h b/deps/v8/src/objects/name-inl.h
index d59a3f54a32..b4ebeb632b3 100644
--- a/deps/v8/src/objects/name-inl.h
+++ b/deps/v8/src/objects/name-inl.h
@@ -27,6 +27,20 @@ BOOL_ACCESSORS(Symbol, flags, is_interesting_symbol, kInterestingSymbolBit)
 
 TYPE_CHECKER(Symbol, SYMBOL_TYPE)
 
+bool Symbol::is_private_field() const {
+  bool value = BooleanBit::get(flags(), kPrivateFieldBit);
+  DCHECK_IMPLIES(value, is_private());
+  return value;
+}
+
+void Symbol::set_is_private_field() {
+  int old_value = flags();
+  // TODO(gsathya): Re-order the bits to have these next to each other
+  // and just do the bit shifts once.
+  set_flags(BooleanBit::set(old_value, kPrivateBit, true) |
+            BooleanBit::set(old_value, kPrivateFieldBit, true));
+}
+
 bool Name::IsUniqueName() const {
   uint32_t type = map()->instance_type();
   return (type & (kIsNotStringMask | kIsNotInternalizedMask)) !=
@@ -89,6 +103,13 @@ bool Name::IsPrivate() {
   return this->IsSymbol() && Symbol::cast(this)->is_private();
 }
 
+bool Name::IsPrivateField() {
+  bool is_private_field =
+      this->IsSymbol() && Symbol::cast(this)->is_private_field();
+  DCHECK_IMPLIES(is_private_field, IsPrivate());
+  return is_private_field;
+}
+
 bool Name::AsArrayIndex(uint32_t* index) {
   return IsString() && String::cast(this)->AsArrayIndex(index);
 }
diff --git a/deps/v8/src/objects/name.h b/deps/v8/src/objects/name.h
index dd5b3692f9d..e5cfe7733b3 100644
--- a/deps/v8/src/objects/name.h
+++ b/deps/v8/src/objects/name.h
@@ -44,6 +44,10 @@ class Name : public HeapObject {
   // If the name is private, it can only name own properties.
   inline bool IsPrivate();
 
+  // If the name is a private field, it should behave like a private
+  // symbol but also throw on property access miss.
+  inline bool IsPrivateField();
+
   inline bool IsUniqueName() const;
 
   static inline bool ContainsCachedArrayIndex(uint32_t hash);
@@ -160,6 +164,14 @@ class Symbol : public Name {
   // Symbol.keyFor on such a symbol simply needs to return the attached name.
   DECL_BOOLEAN_ACCESSORS(is_public)
 
+  // [is_private_field]: Whether this is a private field.  Private fields
+  // are the same as private symbols except they throw on missing
+  // property access.
+  //
+  // This also sets the is_private bit.
+  inline bool is_private_field() const;
+  inline void set_is_private_field();
+
   DECL_CAST(Symbol)
 
   // Dispatched behavior.
@@ -176,6 +188,7 @@ class Symbol : public Name {
   static const int kWellKnownSymbolBit = 1;
   static const int kPublicBit = 2;
   static const int kInterestingSymbolBit = 3;
+  static const int kPrivateFieldBit = 4;
 
   typedef FixedBodyDescriptor<kNameOffset, kFlagsOffset, kSize> BodyDescriptor;
   // No weak fields.
diff --git a/deps/v8/src/objects/object-macros-undef.h b/deps/v8/src/objects/object-macros-undef.h
index f81dc295042..ea515b61ed3 100644
--- a/deps/v8/src/objects/object-macros-undef.h
+++ b/deps/v8/src/objects/object-macros-undef.h
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// PRESUBMIT_INTENTIONALLY_MISSING_INCLUDE_GUARD
+
 #undef DECL_PRIMITIVE_ACCESSORS
 #undef DECL_BOOLEAN_ACCESSORS
 #undef DECL_INT_ACCESSORS
@@ -12,6 +14,9 @@
 #undef ACCESSORS_CHECKED2
 #undef ACCESSORS_CHECKED
 #undef ACCESSORS
+#undef WEAK_ACCESSORS_CHECKED
+#undef WEAK_ACCESSORS_CHECKED2
+#undef WEAK_ACCESSORS
 #undef SMI_ACCESSORS_CHECKED
 #undef SMI_ACCESSORS
 #undef SYNCHRONIZED_SMI_ACCESSORS
@@ -23,13 +28,16 @@
 #undef FIELD_ADDR
 #undef FIELD_ADDR_CONST
 #undef READ_FIELD
+#undef READ_WEAK_FIELD
 #undef ACQUIRE_READ_FIELD
 #undef RELAXED_READ_FIELD
 #undef WRITE_FIELD
+#undef WRITE_WEAK_FIELD
 #undef RELEASE_WRITE_FIELD
 #undef RELAXED_WRITE_FIELD
 #undef WRITE_BARRIER
 #undef CONDITIONAL_WRITE_BARRIER
+#undef CONDITIONAL_WEAK_WRITE_BARRIER
 #undef READ_DOUBLE_FIELD
 #undef WRITE_DOUBLE_FIELD
 #undef READ_INT_FIELD
diff --git a/deps/v8/src/objects/object-macros.h b/deps/v8/src/objects/object-macros.h
index 604942a2726..03a11967034 100644
--- a/deps/v8/src/objects/object-macros.h
+++ b/deps/v8/src/objects/object-macros.h
@@ -7,6 +7,8 @@
 
 // Note 2: This file is deliberately missing the include guards (the undeffing
 // approach wouldn't work otherwise).
+//
+// PRESUBMIT_INTENTIONALLY_MISSING_INCLUDE_GUARD
 
 // The accessors with RELAXED_, ACQUIRE_, and RELEASE_ prefixes should be used
 // for fields that can be written to and read from multiple threads at the same
@@ -69,6 +71,25 @@
 #define ACCESSORS(holder, name, type, offset) \
   ACCESSORS_CHECKED(holder, name, type, offset, true)
 
+#define WEAK_ACCESSORS_CHECKED2(holder, name, offset, get_condition,      \
+                                set_condition)                            \
+  MaybeObject* holder::name() const {                                     \
+    MaybeObject* value = READ_WEAK_FIELD(this, offset);                   \
+    DCHECK(get_condition);                                                \
+    return value;                                                         \
+  }                                                                       \
+  void holder::set_##name(MaybeObject* value, WriteBarrierMode mode) {    \
+    DCHECK(set_condition);                                                \
+    WRITE_WEAK_FIELD(this, offset, value);                                \
+    CONDITIONAL_WEAK_WRITE_BARRIER(GetHeap(), this, offset, value, mode); \
+  }
+
+#define WEAK_ACCESSORS_CHECKED(holder, name, offset, condition) \
+  WEAK_ACCESSORS_CHECKED2(holder, name, offset, condition, condition)
+
+#define WEAK_ACCESSORS(holder, name, offset) \
+  WEAK_ACCESSORS_CHECKED(holder, name, offset, true)
+
 // Getter that returns a Smi as an int and writes an int as a Smi.
 #define SMI_ACCESSORS_CHECKED(holder, name, offset, condition) \
   int holder::name() const {                                   \
@@ -133,6 +154,9 @@
 #define READ_FIELD(p, offset) \
   (*reinterpret_cast<Object* const*>(FIELD_ADDR_CONST(p, offset)))
 
+#define READ_WEAK_FIELD(p, offset) \
+  (*reinterpret_cast<MaybeObject* const*>(FIELD_ADDR_CONST(p, offset)))
+
 #define ACQUIRE_READ_FIELD(p, offset)           \
   reinterpret_cast<Object*>(base::Acquire_Load( \
       reinterpret_cast<const base::AtomicWord*>(FIELD_ADDR_CONST(p, offset))))
@@ -141,14 +165,24 @@
   reinterpret_cast<Object*>(base::Relaxed_Load( \
       reinterpret_cast<const base::AtomicWord*>(FIELD_ADDR_CONST(p, offset))))
 
+#define RELAXED_READ_WEAK_FIELD(p, offset)           \
+  reinterpret_cast<MaybeObject*>(base::Relaxed_Load( \
+      reinterpret_cast<const base::AtomicWord*>(FIELD_ADDR_CONST(p, offset))))
+
 #ifdef V8_CONCURRENT_MARKING
 #define WRITE_FIELD(p, offset, value)                             \
   base::Relaxed_Store(                                            \
       reinterpret_cast<base::AtomicWord*>(FIELD_ADDR(p, offset)), \
       reinterpret_cast<base::AtomicWord>(value));
+#define WRITE_WEAK_FIELD(p, offset, value)                        \
+  base::Relaxed_Store(                                            \
+      reinterpret_cast<base::AtomicWord*>(FIELD_ADDR(p, offset)), \
+      reinterpret_cast<base::AtomicWord>(value));
 #else
 #define WRITE_FIELD(p, offset, value) \
   (*reinterpret_cast<Object**>(FIELD_ADDR(p, offset)) = value)
+#define WRITE_WEAK_FIELD(p, offset, value) \
+  (*reinterpret_cast<MaybeObject**>(FIELD_ADDR(p, offset)) = value)
 #endif
 
 #define RELEASE_WRITE_FIELD(p, offset, value)                     \
@@ -166,6 +200,12 @@
       object, HeapObject::RawField(object, offset), value); \
   heap->RecordWrite(object, HeapObject::RawField(object, offset), value);
 
+#define WEAK_WRITE_BARRIER(heap, object, offset, value)                    \
+  heap->incremental_marking()->RecordMaybeWeakWrite(                       \
+      object, HeapObject::RawMaybeWeakField(object, offset), value);       \
+  heap->RecordWrite(object, HeapObject::RawMaybeWeakField(object, offset), \
+                    value);
+
 #define CONDITIONAL_WRITE_BARRIER(heap, object, offset, value, mode)        \
   if (mode != SKIP_WRITE_BARRIER) {                                         \
     if (mode == UPDATE_WRITE_BARRIER) {                                     \
@@ -175,6 +215,16 @@
     heap->RecordWrite(object, HeapObject::RawField(object, offset), value); \
   }
 
+#define CONDITIONAL_WEAK_WRITE_BARRIER(heap, object, offset, value, mode)    \
+  if (mode != SKIP_WRITE_BARRIER) {                                          \
+    if (mode == UPDATE_WRITE_BARRIER) {                                      \
+      heap->incremental_marking()->RecordMaybeWeakWrite(                     \
+          object, HeapObject::RawMaybeWeakField(object, offset), value);     \
+    }                                                                        \
+    heap->RecordWrite(object, HeapObject::RawMaybeWeakField(object, offset), \
+                      value);                                                \
+  }
+
 #define READ_DOUBLE_FIELD(p, offset) \
   ReadDoubleValue(FIELD_ADDR_CONST(p, offset))
 
diff --git a/deps/v8/src/objects/promise-inl.h b/deps/v8/src/objects/promise-inl.h
new file mode 100644
index 00000000000..4283f0aa194
--- /dev/null
+++ b/deps/v8/src/objects/promise-inl.h
@@ -0,0 +1,48 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_PROMISE_INL_H_
+#define V8_OBJECTS_PROMISE_INL_H_
+
+#include "src/objects/promise.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+CAST_ACCESSOR(PromiseCapability)
+CAST_ACCESSOR(PromiseReaction)
+CAST_ACCESSOR(PromiseReactionJobTask)
+CAST_ACCESSOR(PromiseFulfillReactionJobTask)
+CAST_ACCESSOR(PromiseRejectReactionJobTask)
+CAST_ACCESSOR(PromiseResolveThenableJobTask)
+
+ACCESSORS(PromiseReaction, next, Object, kNextOffset)
+ACCESSORS(PromiseReaction, reject_handler, HeapObject, kRejectHandlerOffset)
+ACCESSORS(PromiseReaction, fulfill_handler, HeapObject, kFulfillHandlerOffset)
+ACCESSORS(PromiseReaction, payload, HeapObject, kPayloadOffset)
+
+ACCESSORS(PromiseResolveThenableJobTask, context, Context, kContextOffset)
+ACCESSORS(PromiseResolveThenableJobTask, promise_to_resolve, JSPromise,
+          kPromiseToResolveOffset)
+ACCESSORS(PromiseResolveThenableJobTask, then, JSReceiver, kThenOffset)
+ACCESSORS(PromiseResolveThenableJobTask, thenable, JSReceiver, kThenableOffset)
+
+ACCESSORS(PromiseReactionJobTask, context, Context, kContextOffset)
+ACCESSORS(PromiseReactionJobTask, argument, Object, kArgumentOffset);
+ACCESSORS(PromiseReactionJobTask, handler, HeapObject, kHandlerOffset);
+ACCESSORS(PromiseReactionJobTask, payload, HeapObject, kPayloadOffset);
+
+ACCESSORS(PromiseCapability, promise, HeapObject, kPromiseOffset)
+ACCESSORS(PromiseCapability, resolve, Object, kResolveOffset)
+ACCESSORS(PromiseCapability, reject, Object, kRejectOffset)
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_PROMISE_INL_H_
diff --git a/deps/v8/src/objects/promise.h b/deps/v8/src/objects/promise.h
new file mode 100644
index 00000000000..36ef4afe1d6
--- /dev/null
+++ b/deps/v8/src/objects/promise.h
@@ -0,0 +1,168 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_PROMISE_H_
+#define V8_OBJECTS_PROMISE_H_
+
+#include "src/objects/microtask.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+// Struct to hold state required for PromiseReactionJob. See the comment on the
+// PromiseReaction below for details on how this is being managed to reduce the
+// memory and allocation overhead. This is the base class for the concrete
+//
+//   - PromiseFulfillReactionJobTask
+//   - PromiseRejectReactionJobTask
+//
+// classes, which are used to represent either reactions, and we distinguish
+// them by their instance types.
+class PromiseReactionJobTask : public Microtask {
+ public:
+  DECL_ACCESSORS(argument, Object)
+  DECL_ACCESSORS(context, Context)
+  // [handler]: This is either a Code object, a Callable or Undefined.
+  DECL_ACCESSORS(handler, HeapObject)
+  // [payload]: Usually a JSPromise or a PromiseCapability.
+  DECL_ACCESSORS(payload, HeapObject)
+
+  static const int kArgumentOffset = Microtask::kHeaderSize;
+  static const int kContextOffset = kArgumentOffset + kPointerSize;
+  static const int kHandlerOffset = kContextOffset + kPointerSize;
+  static const int kPayloadOffset = kHandlerOffset + kPointerSize;
+  static const int kSize = kPayloadOffset + kPointerSize;
+
+  // Dispatched behavior.
+  DECL_CAST(PromiseReactionJobTask)
+  DECL_VERIFIER(PromiseReactionJobTask)
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(PromiseReactionJobTask);
+};
+
+// Struct to hold state required for a PromiseReactionJob of type "Fulfill".
+class PromiseFulfillReactionJobTask : public PromiseReactionJobTask {
+ public:
+  // Dispatched behavior.
+  DECL_CAST(PromiseFulfillReactionJobTask)
+  DECL_PRINTER(PromiseFulfillReactionJobTask)
+  DECL_VERIFIER(PromiseFulfillReactionJobTask)
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(PromiseFulfillReactionJobTask);
+};
+
+// Struct to hold state required for a PromiseReactionJob of type "Reject".
+class PromiseRejectReactionJobTask : public PromiseReactionJobTask {
+ public:
+  // Dispatched behavior.
+  DECL_CAST(PromiseRejectReactionJobTask)
+  DECL_PRINTER(PromiseRejectReactionJobTask)
+  DECL_VERIFIER(PromiseRejectReactionJobTask)
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(PromiseRejectReactionJobTask);
+};
+
+// A container struct to hold state required for PromiseResolveThenableJob.
+class PromiseResolveThenableJobTask : public Microtask {
+ public:
+  DECL_ACCESSORS(context, Context)
+  DECL_ACCESSORS(promise_to_resolve, JSPromise)
+  DECL_ACCESSORS(then, JSReceiver)
+  DECL_ACCESSORS(thenable, JSReceiver)
+
+  static const int kContextOffset = Microtask::kHeaderSize;
+  static const int kPromiseToResolveOffset = kContextOffset + kPointerSize;
+  static const int kThenOffset = kPromiseToResolveOffset + kPointerSize;
+  static const int kThenableOffset = kThenOffset + kPointerSize;
+  static const int kSize = kThenableOffset + kPointerSize;
+
+  // Dispatched behavior.
+  DECL_CAST(PromiseResolveThenableJobTask)
+  DECL_PRINTER(PromiseResolveThenableJobTask)
+  DECL_VERIFIER(PromiseResolveThenableJobTask)
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(PromiseResolveThenableJobTask);
+};
+
+// Struct to hold the state of a PromiseCapability.
+class PromiseCapability : public Struct {
+ public:
+  DECL_ACCESSORS(promise, HeapObject)
+  DECL_ACCESSORS(resolve, Object)
+  DECL_ACCESSORS(reject, Object)
+
+  static const int kPromiseOffset = Struct::kHeaderSize;
+  static const int kResolveOffset = kPromiseOffset + kPointerSize;
+  static const int kRejectOffset = kResolveOffset + kPointerSize;
+  static const int kSize = kRejectOffset + kPointerSize;
+
+  // Dispatched behavior.
+  DECL_CAST(PromiseCapability)
+  DECL_PRINTER(PromiseCapability)
+  DECL_VERIFIER(PromiseCapability)
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(PromiseCapability);
+};
+
+// A representation of promise reaction. This differs from the specification
+// in that the PromiseReaction here holds both handlers for the fulfill and
+// the reject case. When a JSPromise is eventually resolved (either via
+// fulfilling it or rejecting it), we morph this PromiseReaction object in
+// memory into a proper PromiseReactionJobTask and schedule it on the queue
+// of microtasks. So the size of PromiseReaction and the size of the
+// PromiseReactionJobTask has to be same for this to work.
+//
+// The PromiseReaction::payload field usually holds a JSPromise
+// instance (in the fast case of a native promise) or a PromiseCapability
+// in case of a custom promise. For await we store the JSGeneratorObject
+// here and use custom Code handlers.
+//
+// We need to keep the context in the PromiseReaction so that we can run
+// the default handlers (in case they are undefined) in the proper context.
+//
+// The PromiseReaction objects form a singly-linked list, terminated by
+// Smi 0. On the JSPromise instance they are linked in reverse order,
+// and are turned into the proper order again when scheduling them on
+// the microtask queue.
+class PromiseReaction : public Struct {
+ public:
+  enum Type { kFulfill, kReject };
+
+  DECL_ACCESSORS(next, Object)
+  // [reject_handler]: This is either a Code object, a Callable or Undefined.
+  DECL_ACCESSORS(reject_handler, HeapObject)
+  // [fulfill_handler]: This is either a Code object, a Callable or Undefined.
+  DECL_ACCESSORS(fulfill_handler, HeapObject)
+  // [payload]: Usually a JSPromise or a PromiseCapability.
+  DECL_ACCESSORS(payload, HeapObject)
+
+  static const int kNextOffset = Struct::kHeaderSize;
+  static const int kRejectHandlerOffset = kNextOffset + kPointerSize;
+  static const int kFulfillHandlerOffset = kRejectHandlerOffset + kPointerSize;
+  static const int kPayloadOffset = kFulfillHandlerOffset + kPointerSize;
+  static const int kSize = kPayloadOffset + kPointerSize;
+
+  // Dispatched behavior.
+  DECL_CAST(PromiseReaction)
+  DECL_PRINTER(PromiseReaction)
+  DECL_VERIFIER(PromiseReaction)
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(PromiseReaction);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_PROMISE_H_
diff --git a/deps/v8/src/objects/scope-info.cc b/deps/v8/src/objects/scope-info.cc
index 82f835ff0c2..7fe8aeffa36 100644
--- a/deps/v8/src/objects/scope-info.cc
+++ b/deps/v8/src/objects/scope-info.cc
@@ -112,28 +112,39 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
 
   // Determine use and location of the function variable if it is present.
   VariableAllocationInfo function_name_info;
-  if (scope->is_function_scope() &&
-      scope->AsDeclarationScope()->function_var() != nullptr) {
-    Variable* var = scope->AsDeclarationScope()->function_var();
-    if (!var->is_used()) {
-      function_name_info = UNUSED;
-    } else if (var->IsContextSlot()) {
-      function_name_info = CONTEXT;
+  if (scope->is_function_scope()) {
+    if (scope->AsDeclarationScope()->function_var() != nullptr) {
+      Variable* var = scope->AsDeclarationScope()->function_var();
+      if (!var->is_used()) {
+        function_name_info = UNUSED;
+      } else if (var->IsContextSlot()) {
+        function_name_info = CONTEXT;
+      } else {
+        DCHECK(var->IsStackLocal());
+        function_name_info = STACK;
+      }
     } else {
-      DCHECK(var->IsStackLocal());
-      function_name_info = STACK;
+      // Always reserve space for the debug name in the scope info.
+      function_name_info = UNUSED;
     }
+  } else if (scope->is_module_scope() || scope->is_script_scope() ||
+             scope->is_eval_scope()) {
+    // Always reserve space for the debug name in the scope info.
+    function_name_info = UNUSED;
   } else {
     function_name_info = NONE;
   }
 
   const bool has_function_name = function_name_info != NONE;
+  const bool has_position_info = NeedsPositionInfo(scope->scope_type());
   const bool has_receiver = receiver_info == STACK || receiver_info == CONTEXT;
   const int parameter_count = scope->num_parameters();
   const bool has_outer_scope_info = !outer_scope.is_null();
   const int length = kVariablePartIndex + parameter_count +
                      (1 + stack_local_count) + 2 * context_local_count +
-                     (has_receiver ? 1 : 0) + (has_function_name ? 2 : 0) +
+                     (has_receiver ? 1 : 0) +
+                     (has_function_name ? kFunctionNameEntries : 0) +
+                     (has_position_info ? kPositionInfoEntries : 0) +
                      (has_outer_scope_info ? 1 : 0) +
                      (scope->is_module_scope()
                           ? 2 + kModuleVariableEntryLength * module_vars_count
@@ -255,14 +266,26 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
   // If present, add the function variable name and its index.
   DCHECK_EQ(index, scope_info->FunctionNameInfoIndex());
   if (has_function_name) {
-    int var_index = scope->AsDeclarationScope()->function_var()->index();
-    scope_info->set(index++,
-                    *scope->AsDeclarationScope()->function_var()->name());
+    DisallowHeapAllocation no_gc;
+    Variable* var = scope->AsDeclarationScope()->function_var();
+    int var_index = -1;
+    Object* name = Smi::kZero;
+    if (var != nullptr) {
+      var_index = var->index();
+      name = *var->name();
+    }
+    scope_info->set(index++, name);
     scope_info->set(index++, Smi::FromInt(var_index));
     DCHECK(function_name_info != CONTEXT ||
            var_index == scope_info->ContextLength() - 1);
   }
 
+  DCHECK_EQ(index, scope_info->PositionInfoIndex());
+  if (has_position_info) {
+    scope_info->set(index++, Smi::FromInt(scope->start_position()));
+    scope_info->set(index++, Smi::FromInt(scope->end_position()));
+  }
+
   // If present, add the outer scope info.
   DCHECK(index == scope_info->OuterScopeInfoIndex());
   if (has_outer_scope_info) {
@@ -320,6 +343,7 @@ Handle<ScopeInfo> ScopeInfo::CreateForWithScope(
   DCHECK_EQ(index, scope_info->StackLocalNamesIndex());
   DCHECK_EQ(index, scope_info->ReceiverInfoIndex());
   DCHECK_EQ(index, scope_info->FunctionNameInfoIndex());
+  DCHECK_EQ(index, scope_info->PositionInfoIndex());
   DCHECK(index == scope_info->OuterScopeInfoIndex());
   if (has_outer_scope_info) {
     scope_info->set(index++, *outer_scope.ToHandleChecked());
@@ -335,17 +359,15 @@ Handle<ScopeInfo> ScopeInfo::CreateGlobalThisBinding(Isolate* isolate) {
 
   const int stack_local_count = 0;
   const int context_local_count = 1;
-  const bool has_simple_parameters = true;
   const VariableAllocationInfo receiver_info = CONTEXT;
   const VariableAllocationInfo function_name_info = NONE;
-  const bool has_function_name = false;
   const bool has_receiver = true;
-  const bool has_outer_scope_info = false;
+  const bool has_position_info = true;
   const int parameter_count = 0;
   const int length = kVariablePartIndex + parameter_count +
                      (1 + stack_local_count) + 2 * context_local_count +
-                     (has_receiver ? 1 : 0) + (has_function_name ? 2 : 0) +
-                     (has_outer_scope_info ? 1 : 0);
+                     (has_receiver ? 1 : 0) +
+                     (has_position_info ? kPositionInfoEntries : 0);
 
   Factory* factory = isolate->factory();
   Handle<ScopeInfo> scope_info = factory->NewScopeInfo(length);
@@ -358,9 +380,9 @@ Handle<ScopeInfo> ScopeInfo::CreateGlobalThisBinding(Isolate* isolate) {
               ReceiverVariableField::encode(receiver_info) |
               FunctionVariableField::encode(function_name_info) |
               AsmModuleField::encode(false) |
-              HasSimpleParametersField::encode(has_simple_parameters) |
+              HasSimpleParametersField::encode(true) |
               FunctionKindField::encode(FunctionKind::kNormalFunction) |
-              HasOuterScopeInfoField::encode(has_outer_scope_info) |
+              HasOuterScopeInfoField::encode(false) |
               IsDebugEvaluateScopeField::encode(false);
   scope_info->SetFlags(flags);
   scope_info->SetParameterCount(parameter_count);
@@ -388,6 +410,10 @@ Handle<ScopeInfo> ScopeInfo::CreateGlobalThisBinding(Isolate* isolate) {
   scope_info->set(index++, Smi::FromInt(receiver_index));
 
   DCHECK_EQ(index, scope_info->FunctionNameInfoIndex());
+  DCHECK_EQ(index, scope_info->PositionInfoIndex());
+  // Store dummy position to be in sync with the {scope_type}.
+  scope_info->set(index++, Smi::kZero);
+  scope_info->set(index++, Smi::kZero);
   DCHECK_EQ(index, scope_info->OuterScopeInfoIndex());
   DCHECK_EQ(index, scope_info->length());
   DCHECK_EQ(scope_info->ParameterCount(), 0);
@@ -400,12 +426,12 @@ ScopeInfo* ScopeInfo::Empty(Isolate* isolate) {
   return isolate->heap()->empty_scope_info();
 }
 
-ScopeType ScopeInfo::scope_type() {
+ScopeType ScopeInfo::scope_type() const {
   DCHECK_LT(0, length());
   return ScopeTypeField::decode(Flags());
 }
 
-bool ScopeInfo::CallsSloppyEval() {
+bool ScopeInfo::CallsSloppyEval() const {
   bool calls_sloppy_eval =
       length() > 0 && CallsSloppyEvalField::decode(Flags());
   DCHECK_IMPLIES(calls_sloppy_eval, is_sloppy(language_mode()));
@@ -413,18 +439,20 @@ bool ScopeInfo::CallsSloppyEval() {
   return calls_sloppy_eval;
 }
 
-LanguageMode ScopeInfo::language_mode() {
+LanguageMode ScopeInfo::language_mode() const {
   return length() > 0 ? LanguageModeField::decode(Flags())
                       : LanguageMode::kSloppy;
 }
 
-bool ScopeInfo::is_declaration_scope() {
+bool ScopeInfo::is_declaration_scope() const {
   return DeclarationScopeField::decode(Flags());
 }
 
-int ScopeInfo::LocalCount() { return StackLocalCount() + ContextLocalCount(); }
+int ScopeInfo::LocalCount() const {
+  return StackLocalCount() + ContextLocalCount();
+}
 
-int ScopeInfo::StackSlotCount() {
+int ScopeInfo::StackSlotCount() const {
   if (length() > 0) {
     bool function_name_stack_slot =
         FunctionVariableField::decode(Flags()) == STACK;
@@ -433,7 +461,7 @@ int ScopeInfo::StackSlotCount() {
   return 0;
 }
 
-int ScopeInfo::ContextLength() {
+int ScopeInfo::ContextLength() const {
   if (length() > 0) {
     int context_locals = ContextLocalCount();
     bool function_name_context_slot =
@@ -454,47 +482,55 @@ int ScopeInfo::ContextLength() {
   return 0;
 }
 
-bool ScopeInfo::HasReceiver() {
-  if (length() > 0) {
-    return NONE != ReceiverVariableField::decode(Flags());
-  } else {
-    return false;
-  }
+bool ScopeInfo::HasReceiver() const {
+  if (length() == 0) return false;
+  return NONE != ReceiverVariableField::decode(Flags());
 }
 
-bool ScopeInfo::HasAllocatedReceiver() {
-  if (length() > 0) {
-    VariableAllocationInfo allocation = ReceiverVariableField::decode(Flags());
-    return allocation == STACK || allocation == CONTEXT;
-  } else {
-    return false;
-  }
+bool ScopeInfo::HasAllocatedReceiver() const {
+  if (length() == 0) return false;
+  VariableAllocationInfo allocation = ReceiverVariableField::decode(Flags());
+  return allocation == STACK || allocation == CONTEXT;
 }
 
-bool ScopeInfo::HasNewTarget() { return HasNewTargetField::decode(Flags()); }
+bool ScopeInfo::HasNewTarget() const {
+  return HasNewTargetField::decode(Flags());
+}
 
-bool ScopeInfo::HasFunctionName() {
-  if (length() > 0) {
-    return NONE != FunctionVariableField::decode(Flags());
-  } else {
-    return false;
-  }
+bool ScopeInfo::HasFunctionName() const {
+  if (length() == 0) return false;
+  return NONE != FunctionVariableField::decode(Flags());
 }
 
-bool ScopeInfo::HasOuterScopeInfo() {
-  if (length() > 0) {
-    return HasOuterScopeInfoField::decode(Flags());
-  } else {
-    return false;
-  }
+bool ScopeInfo::HasPositionInfo() const {
+  if (length() == 0) return false;
+  return NeedsPositionInfo(scope_type());
 }
 
-bool ScopeInfo::IsDebugEvaluateScope() {
-  if (length() > 0) {
-    return IsDebugEvaluateScopeField::decode(Flags());
-  } else {
-    return false;
-  }
+// static
+bool ScopeInfo::NeedsPositionInfo(ScopeType type) {
+  return type == FUNCTION_SCOPE || type == SCRIPT_SCOPE || type == EVAL_SCOPE ||
+         type == MODULE_SCOPE;
+}
+
+bool ScopeInfo::HasSharedFunctionName() const {
+  return FunctionName() != SharedFunctionInfo::kNoSharedNameSentinel;
+}
+
+void ScopeInfo::SetFunctionName(Object* name) {
+  DCHECK(HasFunctionName());
+  DCHECK(name->IsString() || name == SharedFunctionInfo::kNoSharedNameSentinel);
+  set(FunctionNameInfoIndex(), name);
+}
+
+bool ScopeInfo::HasOuterScopeInfo() const {
+  if (length() == 0) return false;
+  return HasOuterScopeInfoField::decode(Flags());
+}
+
+bool ScopeInfo::IsDebugEvaluateScope() const {
+  if (length() == 0) return false;
+  return IsDebugEvaluateScopeField::decode(Flags());
 }
 
 void ScopeInfo::SetIsDebugEvaluateScope() {
@@ -506,31 +542,48 @@ void ScopeInfo::SetIsDebugEvaluateScope() {
   }
 }
 
-bool ScopeInfo::HasContext() { return ContextLength() > 0; }
+bool ScopeInfo::HasContext() const { return ContextLength() > 0; }
 
-String* ScopeInfo::FunctionName() {
+Object* ScopeInfo::FunctionName() const {
   DCHECK(HasFunctionName());
-  return String::cast(get(FunctionNameInfoIndex()));
+  return get(FunctionNameInfoIndex());
+}
+
+int ScopeInfo::StartPosition() const {
+  DCHECK(HasPositionInfo());
+  return Smi::cast(get(PositionInfoIndex()))->value();
+}
+
+int ScopeInfo::EndPosition() const {
+  DCHECK(HasPositionInfo());
+  return Smi::cast(get(PositionInfoIndex() + 1))->value();
+}
+
+void ScopeInfo::SetPositionInfo(int start, int end) {
+  DCHECK(HasPositionInfo());
+  DCHECK_LE(start, end);
+  set(PositionInfoIndex(), Smi::FromInt(start));
+  set(PositionInfoIndex() + 1, Smi::FromInt(end));
 }
 
-ScopeInfo* ScopeInfo::OuterScopeInfo() {
+ScopeInfo* ScopeInfo::OuterScopeInfo() const {
   DCHECK(HasOuterScopeInfo());
   return ScopeInfo::cast(get(OuterScopeInfoIndex()));
 }
 
-ModuleInfo* ScopeInfo::ModuleDescriptorInfo() {
+ModuleInfo* ScopeInfo::ModuleDescriptorInfo() const {
   DCHECK(scope_type() == MODULE_SCOPE);
   return ModuleInfo::cast(get(ModuleInfoIndex()));
 }
 
-String* ScopeInfo::ParameterName(int var) {
+String* ScopeInfo::ParameterName(int var) const {
   DCHECK_LE(0, var);
   DCHECK_LT(var, ParameterCount());
   int info_index = ParameterNamesIndex() + var;
   return String::cast(get(info_index));
 }
 
-String* ScopeInfo::LocalName(int var) {
+String* ScopeInfo::LocalName(int var) const {
   DCHECK_LE(0, var);
   DCHECK_LT(var, LocalCount());
   DCHECK(StackLocalNamesIndex() + StackLocalCount() ==
@@ -539,28 +592,28 @@ String* ScopeInfo::LocalName(int var) {
   return String::cast(get(info_index));
 }
 
-String* ScopeInfo::StackLocalName(int var) {
+String* ScopeInfo::StackLocalName(int var) const {
   DCHECK_LE(0, var);
   DCHECK_LT(var, StackLocalCount());
   int info_index = StackLocalNamesIndex() + var;
   return String::cast(get(info_index));
 }
 
-int ScopeInfo::StackLocalIndex(int var) {
+int ScopeInfo::StackLocalIndex(int var) const {
   DCHECK_LE(0, var);
   DCHECK_LT(var, StackLocalCount());
   int first_slot_index = Smi::ToInt(get(StackLocalFirstSlotIndex()));
   return first_slot_index + var;
 }
 
-String* ScopeInfo::ContextLocalName(int var) {
+String* ScopeInfo::ContextLocalName(int var) const {
   DCHECK_LE(0, var);
   DCHECK_LT(var, ContextLocalCount());
   int info_index = ContextLocalNamesIndex() + var;
   return String::cast(get(info_index));
 }
 
-VariableMode ScopeInfo::ContextLocalMode(int var) {
+VariableMode ScopeInfo::ContextLocalMode(int var) const {
   DCHECK_LE(0, var);
   DCHECK_LT(var, ContextLocalCount());
   int info_index = ContextLocalInfosIndex() + var;
@@ -568,7 +621,7 @@ VariableMode ScopeInfo::ContextLocalMode(int var) {
   return VariableModeField::decode(value);
 }
 
-InitializationFlag ScopeInfo::ContextLocalInitFlag(int var) {
+InitializationFlag ScopeInfo::ContextLocalInitFlag(int var) const {
   DCHECK_LE(0, var);
   DCHECK_LT(var, ContextLocalCount());
   int info_index = ContextLocalInfosIndex() + var;
@@ -576,7 +629,7 @@ InitializationFlag ScopeInfo::ContextLocalInitFlag(int var) {
   return InitFlagField::decode(value);
 }
 
-MaybeAssignedFlag ScopeInfo::ContextLocalMaybeAssignedFlag(int var) {
+MaybeAssignedFlag ScopeInfo::ContextLocalMaybeAssignedFlag(int var) const {
   DCHECK_LE(0, var);
   DCHECK_LT(var, ContextLocalCount());
   int info_index = ContextLocalInfosIndex() + var;
@@ -584,6 +637,7 @@ MaybeAssignedFlag ScopeInfo::ContextLocalMaybeAssignedFlag(int var) {
   return MaybeAssignedFlagField::decode(value);
 }
 
+// static
 bool ScopeInfo::VariableIsSynthetic(String* name) {
   // There's currently no flag stored on the ScopeInfo to indicate that a
   // variable is a compiler-introduced temporary. However, to avoid conflict
@@ -593,16 +647,15 @@ bool ScopeInfo::VariableIsSynthetic(String* name) {
          name->Equals(name->GetHeap()->this_string());
 }
 
-int ScopeInfo::StackSlotIndex(String* name) {
+int ScopeInfo::StackSlotIndex(String* name) const {
   DCHECK(name->IsInternalizedString());
-  if (length() > 0) {
-    int first_slot_index = Smi::ToInt(get(StackLocalFirstSlotIndex()));
-    int start = StackLocalNamesIndex();
-    int end = start + StackLocalCount();
-    for (int i = start; i < end; ++i) {
-      if (name == get(i)) {
-        return i - start + first_slot_index;
-      }
+  if (length() == 0) return -1;
+  int first_slot_index = Smi::ToInt(get(StackLocalFirstSlotIndex()));
+  int start = StackLocalNamesIndex();
+  int end = start + StackLocalCount();
+  for (int i = start; i < end; ++i) {
+    if (name == get(i)) {
+      return i - start + first_slot_index;
     }
   }
   return -1;
@@ -631,6 +684,7 @@ int ScopeInfo::ModuleIndex(Handle<String> name, VariableMode* mode,
   return 0;
 }
 
+// static
 int ScopeInfo::ContextSlotIndex(Handle<ScopeInfo> scope_info,
                                 Handle<String> name, VariableMode* mode,
                                 InitializationFlag* init_flag,
@@ -640,66 +694,66 @@ int ScopeInfo::ContextSlotIndex(Handle<ScopeInfo> scope_info,
   DCHECK_NOT_NULL(init_flag);
   DCHECK_NOT_NULL(maybe_assigned_flag);
 
-  if (scope_info->length() > 0) {
-    ContextSlotCache* context_slot_cache =
-        scope_info->GetIsolate()->context_slot_cache();
-    int result = context_slot_cache->Lookup(*scope_info, *name, mode, init_flag,
-                                            maybe_assigned_flag);
-    if (result != ContextSlotCache::kNotFound) {
+  if (scope_info->length() == 0) return -1;
+
+  ContextSlotCache* context_slot_cache =
+      scope_info->GetIsolate()->context_slot_cache();
+  int result = context_slot_cache->Lookup(*scope_info, *name, mode, init_flag,
+                                          maybe_assigned_flag);
+  if (result != ContextSlotCache::kNotFound) {
+    DCHECK_LT(result, scope_info->ContextLength());
+    return result;
+  }
+
+  int start = scope_info->ContextLocalNamesIndex();
+  int end = start + scope_info->ContextLocalCount();
+  for (int i = start; i < end; ++i) {
+    if (*name == scope_info->get(i)) {
+      int var = i - start;
+      *mode = scope_info->ContextLocalMode(var);
+      *init_flag = scope_info->ContextLocalInitFlag(var);
+      *maybe_assigned_flag = scope_info->ContextLocalMaybeAssignedFlag(var);
+      result = Context::MIN_CONTEXT_SLOTS + var;
+
+      context_slot_cache->Update(scope_info, name, *mode, *init_flag,
+                                 *maybe_assigned_flag, result);
       DCHECK_LT(result, scope_info->ContextLength());
       return result;
     }
-
-    int start = scope_info->ContextLocalNamesIndex();
-    int end = start + scope_info->ContextLocalCount();
-    for (int i = start; i < end; ++i) {
-      if (*name == scope_info->get(i)) {
-        int var = i - start;
-        *mode = scope_info->ContextLocalMode(var);
-        *init_flag = scope_info->ContextLocalInitFlag(var);
-        *maybe_assigned_flag = scope_info->ContextLocalMaybeAssignedFlag(var);
-        result = Context::MIN_CONTEXT_SLOTS + var;
-
-        context_slot_cache->Update(scope_info, name, *mode, *init_flag,
-                                   *maybe_assigned_flag, result);
-        DCHECK_LT(result, scope_info->ContextLength());
-        return result;
-      }
-    }
-    // Cache as not found. Mode, init flag and maybe assigned flag don't matter.
-    context_slot_cache->Update(scope_info, name, TEMPORARY,
-                               kNeedsInitialization, kNotAssigned, -1);
   }
+  // Cache as not found. Mode, init flag and maybe assigned flag don't matter.
+  context_slot_cache->Update(scope_info, name, TEMPORARY, kNeedsInitialization,
+                             kNotAssigned, -1);
 
   return -1;
 }
 
-int ScopeInfo::ParameterIndex(String* name) {
+int ScopeInfo::ParameterIndex(String* name) const {
   DCHECK(name->IsInternalizedString());
-  if (length() > 0) {
-    // We must read parameters from the end since for
-    // multiply declared parameters the value of the
-    // last declaration of that parameter is used
-    // inside a function (and thus we need to look
-    // at the last index). Was bug# 1110337.
-    int start = ParameterNamesIndex();
-    int end = start + ParameterCount();
-    for (int i = end - 1; i >= start; --i) {
-      if (name == get(i)) {
-        return i - start;
-      }
+  if (length() == 0) return -1;
+  // We must read parameters from the end since for
+  // multiply declared parameters the value of the
+  // last declaration of that parameter is used
+  // inside a function (and thus we need to look
+  // at the last index). Was bug# 1110337.
+  int start = ParameterNamesIndex();
+  int end = start + ParameterCount();
+  for (int i = end - 1; i >= start; --i) {
+    if (name == get(i)) {
+      return i - start;
     }
   }
   return -1;
 }
 
-int ScopeInfo::ReceiverContextSlotIndex() {
-  if (length() > 0 && ReceiverVariableField::decode(Flags()) == CONTEXT)
+int ScopeInfo::ReceiverContextSlotIndex() const {
+  if (length() > 0 && ReceiverVariableField::decode(Flags()) == CONTEXT) {
     return Smi::ToInt(get(ReceiverInfoIndex()));
+  }
   return -1;
 }
 
-int ScopeInfo::FunctionContextSlotIndex(String* name) {
+int ScopeInfo::FunctionContextSlotIndex(String* name) const {
   DCHECK(name->IsInternalizedString());
   if (length() > 0) {
     if (FunctionVariableField::decode(Flags()) == CONTEXT &&
@@ -710,48 +764,59 @@ int ScopeInfo::FunctionContextSlotIndex(String* name) {
   return -1;
 }
 
-FunctionKind ScopeInfo::function_kind() {
+FunctionKind ScopeInfo::function_kind() const {
   return FunctionKindField::decode(Flags());
 }
 
-int ScopeInfo::ParameterNamesIndex() {
+int ScopeInfo::ParameterNamesIndex() const {
   DCHECK_LT(0, length());
   return kVariablePartIndex;
 }
 
-int ScopeInfo::StackLocalFirstSlotIndex() {
+int ScopeInfo::StackLocalFirstSlotIndex() const {
   return ParameterNamesIndex() + ParameterCount();
 }
 
-int ScopeInfo::StackLocalNamesIndex() { return StackLocalFirstSlotIndex() + 1; }
+int ScopeInfo::StackLocalNamesIndex() const {
+  return StackLocalFirstSlotIndex() + 1;
+}
 
-int ScopeInfo::ContextLocalNamesIndex() {
+int ScopeInfo::ContextLocalNamesIndex() const {
   return StackLocalNamesIndex() + StackLocalCount();
 }
 
-int ScopeInfo::ContextLocalInfosIndex() {
+int ScopeInfo::ContextLocalInfosIndex() const {
   return ContextLocalNamesIndex() + ContextLocalCount();
 }
 
-int ScopeInfo::ReceiverInfoIndex() {
+int ScopeInfo::ReceiverInfoIndex() const {
   return ContextLocalInfosIndex() + ContextLocalCount();
 }
 
-int ScopeInfo::FunctionNameInfoIndex() {
+int ScopeInfo::FunctionNameInfoIndex() const {
   return ReceiverInfoIndex() + (HasAllocatedReceiver() ? 1 : 0);
 }
 
-int ScopeInfo::OuterScopeInfoIndex() {
-  return FunctionNameInfoIndex() + (HasFunctionName() ? 2 : 0);
+int ScopeInfo::PositionInfoIndex() const {
+  return FunctionNameInfoIndex() +
+         (HasFunctionName() ? kFunctionNameEntries : 0);
 }
 
-int ScopeInfo::ModuleInfoIndex() {
+int ScopeInfo::OuterScopeInfoIndex() const {
+  return PositionInfoIndex() + (HasPositionInfo() ? kPositionInfoEntries : 0);
+}
+
+int ScopeInfo::ModuleInfoIndex() const {
   return OuterScopeInfoIndex() + (HasOuterScopeInfo() ? 1 : 0);
 }
 
-int ScopeInfo::ModuleVariableCountIndex() { return ModuleInfoIndex() + 1; }
+int ScopeInfo::ModuleVariableCountIndex() const {
+  return ModuleInfoIndex() + 1;
+}
 
-int ScopeInfo::ModuleVariablesIndex() { return ModuleVariableCountIndex() + 1; }
+int ScopeInfo::ModuleVariablesIndex() const {
+  return ModuleVariableCountIndex() + 1;
+}
 
 void ScopeInfo::ModuleVariable(int i, String** name, int* index,
                                VariableMode* mode,
@@ -781,47 +846,6 @@ void ScopeInfo::ModuleVariable(int i, String** name, int* index,
   }
 }
 
-#ifdef DEBUG
-
-static void PrintList(const char* list_name, int nof_internal_slots, int start,
-                      int end, ScopeInfo* scope_info) {
-  if (start < end) {
-    PrintF("\n  // %s\n", list_name);
-    if (nof_internal_slots > 0) {
-      PrintF("  %2d - %2d [internal slots]\n", 0, nof_internal_slots - 1);
-    }
-    for (int i = nof_internal_slots; start < end; ++i, ++start) {
-      PrintF("  %2d ", i);
-      String::cast(scope_info->get(start))->ShortPrint();
-      PrintF("\n");
-    }
-  }
-}
-
-void ScopeInfo::Print() {
-  PrintF("ScopeInfo ");
-  if (HasFunctionName()) {
-    FunctionName()->ShortPrint();
-  } else {
-    PrintF("/* no function name */");
-  }
-  PrintF("{");
-
-  if (length() > 0) {
-    PrintList("parameters", 0, ParameterNamesIndex(),
-              ParameterNamesIndex() + ParameterCount(), this);
-    PrintList("stack slots", 0, StackLocalNamesIndex(),
-              StackLocalNamesIndex() + StackLocalCount(), this);
-    PrintList("context slots", Context::MIN_CONTEXT_SLOTS,
-              ContextLocalNamesIndex(),
-              ContextLocalNamesIndex() + ContextLocalCount(), this);
-    // TODO(neis): Print module stuff if present.
-  }
-
-  PrintF("}\n");
-}
-#endif  // DEBUG
-
 Handle<ModuleInfoEntry> ModuleInfoEntry::New(Isolate* isolate,
                                              Handle<Object> export_name,
                                              Handle<Object> local_name,
diff --git a/deps/v8/src/objects/scope-info.h b/deps/v8/src/objects/scope-info.h
index 3a8459a204e..bb25cd6d766 100644
--- a/deps/v8/src/objects/scope-info.h
+++ b/deps/v8/src/objects/scope-info.h
@@ -35,28 +35,29 @@ class Zone;
 class ScopeInfo : public FixedArray {
  public:
   DECL_CAST(ScopeInfo)
+  DECL_PRINTER(ScopeInfo)
 
   // Return the type of this scope.
-  ScopeType scope_type();
+  ScopeType scope_type() const;
 
   // Return the language mode of this scope.
-  LanguageMode language_mode();
+  LanguageMode language_mode() const;
 
   // True if this scope is a (var) declaration scope.
-  bool is_declaration_scope();
+  bool is_declaration_scope() const;
 
   // Does this scope make a sloppy eval call?
-  bool CallsSloppyEval();
+  bool CallsSloppyEval() const;
 
   // Return the total number of locals allocated on the stack and in the
   // context. This includes the parameters that are allocated in the context.
-  int LocalCount();
+  int LocalCount() const;
 
   // Return the number of stack slots for code. This number consists of two
   // parts:
   //  1. One stack slot per stack allocated local.
   //  2. One stack slot for the function name if it is stack allocated.
-  int StackSlotCount();
+  int StackSlotCount() const;
 
   // Return the number of context slots for code if a context is allocated. This
   // number consists of three parts:
@@ -65,57 +66,70 @@ class ScopeInfo : public FixedArray {
   //  3. One context slot for the function name if it is context allocated.
   // Parameters allocated in the context count as context allocated locals. If
   // no contexts are allocated for this scope ContextLength returns 0.
-  int ContextLength();
+  int ContextLength() const;
 
   // Does this scope declare a "this" binding?
-  bool HasReceiver();
+  bool HasReceiver() const;
 
   // Does this scope declare a "this" binding, and the "this" binding is stack-
   // or context-allocated?
-  bool HasAllocatedReceiver();
+  bool HasAllocatedReceiver() const;
 
   // Does this scope declare a "new.target" binding?
-  bool HasNewTarget();
+  bool HasNewTarget() const;
 
   // Is this scope the scope of a named function expression?
-  bool HasFunctionName();
+  bool HasFunctionName() const;
+
+  // See SharedFunctionInfo::HasSharedName.
+  bool HasSharedFunctionName() const;
+
+  void SetFunctionName(Object* name);
+
+  // Does this scope belong to a function?
+  bool HasPositionInfo() const;
 
   // Return if contexts are allocated for this scope.
-  bool HasContext();
+  bool HasContext() const;
 
   // Return if this is a function scope with "use asm".
-  inline bool IsAsmModule();
+  inline bool IsAsmModule() const;
 
-  inline bool HasSimpleParameters();
+  inline bool HasSimpleParameters() const;
 
   // Return the function_name if present.
-  String* FunctionName();
+  Object* FunctionName() const;
+
+  // Position information accessors.
+  int StartPosition() const;
+  int EndPosition() const;
+  void SetPositionInfo(int start, int end);
 
-  ModuleInfo* ModuleDescriptorInfo();
+  ModuleInfo* ModuleDescriptorInfo() const;
 
   // Return the name of the given parameter.
-  String* ParameterName(int var);
+  String* ParameterName(int var) const;
 
   // Return the name of the given local.
-  String* LocalName(int var);
+  String* LocalName(int var) const;
 
   // Return the name of the given stack local.
-  String* StackLocalName(int var);
+  String* StackLocalName(int var) const;
 
   // Return the name of the given stack local.
-  int StackLocalIndex(int var);
+  int StackLocalIndex(int var) const;
 
   // Return the name of the given context local.
-  String* ContextLocalName(int var);
+  String* ContextLocalName(int var) const;
 
   // Return the mode of the given context local.
-  VariableMode ContextLocalMode(int var);
+  VariableMode ContextLocalMode(int var) const;
 
   // Return the initialization flag of the given context local.
-  InitializationFlag ContextLocalInitFlag(int var);
+  InitializationFlag ContextLocalInitFlag(int var) const;
 
   // Return the initialization flag of the given context local.
-  MaybeAssignedFlag ContextLocalMaybeAssignedFlag(int var);
+  MaybeAssignedFlag ContextLocalMaybeAssignedFlag(int var) const;
 
   // Return true if this local was introduced by the compiler, and should not be
   // exposed to the user in a debugger.
@@ -125,7 +139,7 @@ class ScopeInfo : public FixedArray {
   // the stack slot index for a given slot name if the slot is
   // present; otherwise returns a value < 0. The name must be an internalized
   // string.
-  int StackSlotIndex(String* name);
+  int StackSlotIndex(String* name) const;
 
   // Lookup support for serialized scope info. Returns the local context slot
   // index for a given slot name if the slot is present; otherwise
@@ -146,33 +160,33 @@ class ScopeInfo : public FixedArray {
   // Lookup support for serialized scope info. Returns the
   // parameter index for a given parameter name if the parameter is present;
   // otherwise returns a value < 0. The name must be an internalized string.
-  int ParameterIndex(String* name);
+  int ParameterIndex(String* name) const;
 
   // Lookup support for serialized scope info. Returns the function context
   // slot index if the function name is present and context-allocated (named
   // function expressions, only), otherwise returns a value < 0. The name
   // must be an internalized string.
-  int FunctionContextSlotIndex(String* name);
+  int FunctionContextSlotIndex(String* name) const;
 
   // Lookup support for serialized scope info.  Returns the receiver context
   // slot index if scope has a "this" binding, and the binding is
   // context-allocated.  Otherwise returns a value < 0.
-  int ReceiverContextSlotIndex();
+  int ReceiverContextSlotIndex() const;
 
-  FunctionKind function_kind();
+  FunctionKind function_kind() const;
 
   // Returns true if this ScopeInfo is linked to a outer ScopeInfo.
-  bool HasOuterScopeInfo();
+  bool HasOuterScopeInfo() const;
 
   // Returns true if this ScopeInfo was created for a debug-evaluate scope.
-  bool IsDebugEvaluateScope();
+  bool IsDebugEvaluateScope() const;
 
   // Can be used to mark a ScopeInfo that looks like a with-scope as actually
   // being a debug-evaluate scope.
   void SetIsDebugEvaluateScope();
 
   // Return the outer ScopeInfo if present.
-  ScopeInfo* OuterScopeInfo();
+  ScopeInfo* OuterScopeInfo() const;
 
 #ifdef DEBUG
   bool Equals(ScopeInfo* other) const;
@@ -187,10 +201,6 @@ class ScopeInfo : public FixedArray {
   // Serializes empty scope info.
   V8_EXPORT_PRIVATE static ScopeInfo* Empty(Isolate* isolate);
 
-#ifdef DEBUG
-  void Print();
-#endif
-
 // The layout of the static part of a ScopeInfo is as follows. Each entry is
 // numeric and occupies one array slot.
 // 1. A set of properties of the scope.
@@ -206,7 +216,7 @@ class ScopeInfo : public FixedArray {
 
 #define FIELD_ACCESSORS(name)       \
   inline void Set##name(int value); \
-  inline int name();
+  inline int name() const;
   FOR_EACH_SCOPE_INFO_NUMERIC_FIELD(FIELD_ACCESSORS)
 #undef FIELD_ACCESSORS
 
@@ -252,23 +262,29 @@ class ScopeInfo : public FixedArray {
   //    information about the function variable. It always occupies two array
   //    slots:  a. The name of the function variable.
   //            b. The context or stack slot index for the variable.
-  // 8. OuterScopeInfoIndex:
+  // 8. SourcePosition:
+  //    Contains two slots with a) the startPosition and b) the endPosition if
+  //    the scope belongs to a function or script.
+  // 9. OuterScopeInfoIndex:
   //    The outer scope's ScopeInfo or the hole if there's none.
-  // 9. ModuleInfo, ModuleVariableCount, and ModuleVariables:
+  // 10. ModuleInfo, ModuleVariableCount, and ModuleVariables:
   //    For a module scope, this part contains the ModuleInfo, the number of
   //    MODULE-allocated variables, and the metadata of those variables.  For
   //    non-module scopes it is empty.
-  int ParameterNamesIndex();
-  int StackLocalFirstSlotIndex();
-  int StackLocalNamesIndex();
-  int ContextLocalNamesIndex();
-  int ContextLocalInfosIndex();
-  int ReceiverInfoIndex();
-  int FunctionNameInfoIndex();
-  int OuterScopeInfoIndex();
-  int ModuleInfoIndex();
-  int ModuleVariableCountIndex();
-  int ModuleVariablesIndex();
+  int ParameterNamesIndex() const;
+  int StackLocalFirstSlotIndex() const;
+  int StackLocalNamesIndex() const;
+  int ContextLocalNamesIndex() const;
+  int ContextLocalInfosIndex() const;
+  int ReceiverInfoIndex() const;
+  int FunctionNameInfoIndex() const;
+  int PositionInfoIndex() const;
+  int OuterScopeInfoIndex() const;
+  int ModuleInfoIndex() const;
+  int ModuleVariableCountIndex() const;
+  int ModuleVariablesIndex() const;
+
+  static bool NeedsPositionInfo(ScopeType type);
 
   int Lookup(Handle<String> name, int start, int end, VariableMode* mode,
              VariableLocation* location, InitializationFlag* init_flag,
@@ -286,6 +302,9 @@ class ScopeInfo : public FixedArray {
   // the receiver.
   enum VariableAllocationInfo { NONE, STACK, CONTEXT, UNUSED };
 
+  static const int kFunctionNameEntries = 2;
+  static const int kPositionInfoEntries = 2;
+
   // Properties of scopes.
   class ScopeTypeField : public BitField<ScopeType, 0, 4> {};
   class CallsSloppyEvalField : public BitField<bool, ScopeTypeField::kNext, 1> {
@@ -307,7 +326,7 @@ class ScopeInfo : public FixedArray {
   class HasSimpleParametersField
       : public BitField<bool, AsmModuleField::kNext, 1> {};
   class FunctionKindField
-      : public BitField<FunctionKind, HasSimpleParametersField::kNext, 11> {};
+      : public BitField<FunctionKind, HasSimpleParametersField::kNext, 5> {};
   class HasOuterScopeInfoField
       : public BitField<bool, FunctionKindField::kNext, 1> {};
   class IsDebugEvaluateScopeField
diff --git a/deps/v8/src/objects/script-inl.h b/deps/v8/src/objects/script-inl.h
index c5bd407628f..c8779cf9ee3 100644
--- a/deps/v8/src/objects/script-inl.h
+++ b/deps/v8/src/objects/script-inl.h
@@ -31,7 +31,8 @@ ACCESSORS_CHECKED(Script, eval_from_shared_or_wrapped_arguments, Object,
                   this->type() != TYPE_WASM)
 SMI_ACCESSORS_CHECKED(Script, eval_from_position, kEvalFromPositionOffset,
                       this->type() != TYPE_WASM)
-ACCESSORS(Script, shared_function_infos, FixedArray, kSharedFunctionInfosOffset)
+ACCESSORS(Script, shared_function_infos, WeakFixedArray,
+          kSharedFunctionInfosOffset)
 SMI_ACCESSORS(Script, flags, kFlagsOffset)
 ACCESSORS(Script, source_url, Object, kSourceUrlOffset)
 ACCESSORS(Script, source_mapping_url, Object, kSourceMappingUrlOffset)
diff --git a/deps/v8/src/objects/script.h b/deps/v8/src/objects/script.h
index 4d84be22625..2e0f16d26df 100644
--- a/deps/v8/src/objects/script.h
+++ b/deps/v8/src/objects/script.h
@@ -86,7 +86,7 @@ class Script : public Struct {
 
   // [shared_function_infos]: weak fixed array containing all shared
   // function infos created from this script.
-  DECL_ACCESSORS(shared_function_infos, FixedArray)
+  DECL_ACCESSORS(shared_function_infos, WeakFixedArray)
 
   // [flags]: Holds an exciting bitfield.
   DECL_INT_ACCESSORS(flags)
@@ -185,7 +185,7 @@ class Script : public Struct {
     Script* Next();
 
    private:
-    WeakFixedArray::Iterator iterator_;
+    FixedArrayOfWeakCells::Iterator iterator_;
     DISALLOW_COPY_AND_ASSIGN(Iterator);
   };
 
diff --git a/deps/v8/src/objects/shared-function-info-inl.h b/deps/v8/src/objects/shared-function-info-inl.h
index 57a72754b54..8ca51e0915b 100644
--- a/deps/v8/src/objects/shared-function-info-inl.h
+++ b/deps/v8/src/objects/shared-function-info-inl.h
@@ -23,23 +23,22 @@ TYPE_CHECKER(SharedFunctionInfo, SHARED_FUNCTION_INFO_TYPE)
 CAST_ACCESSOR(SharedFunctionInfo)
 DEFINE_DEOPT_ELEMENT_ACCESSORS(SharedFunctionInfo, Object)
 
-ACCESSORS(SharedFunctionInfo, raw_name, Object, kNameOffset)
+ACCESSORS(SharedFunctionInfo, name_or_scope_info, Object,
+          kNameOrScopeInfoOffset)
 ACCESSORS(SharedFunctionInfo, construct_stub, Code, kConstructStubOffset)
 ACCESSORS(SharedFunctionInfo, feedback_metadata, FeedbackMetadata,
           kFeedbackMetadataOffset)
-ACCESSORS(SharedFunctionInfo, instance_class_name, String,
-          kInstanceClassNameOffset)
 ACCESSORS(SharedFunctionInfo, function_data, Object, kFunctionDataOffset)
 ACCESSORS(SharedFunctionInfo, script, Object, kScriptOffset)
 ACCESSORS(SharedFunctionInfo, debug_info, Object, kDebugInfoOffset)
 ACCESSORS(SharedFunctionInfo, function_identifier, Object,
           kFunctionIdentifierOffset)
 
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, start_position_and_type,
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, raw_start_position_and_type,
                     is_named_expression,
                     SharedFunctionInfo::IsNamedExpressionBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, start_position_and_type, is_toplevel,
-                    SharedFunctionInfo::IsTopLevelBit)
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, raw_start_position_and_type,
+                    is_toplevel, SharedFunctionInfo::IsTopLevelBit)
 
 INT_ACCESSORS(SharedFunctionInfo, function_literal_id, kFunctionLiteralIdOffset)
 #if V8_SFI_HAS_UNIQUE_ID
@@ -50,25 +49,42 @@ INT_ACCESSORS(SharedFunctionInfo, internal_formal_parameter_count,
               kFormalParameterCountOffset)
 INT_ACCESSORS(SharedFunctionInfo, expected_nof_properties,
               kExpectedNofPropertiesOffset)
-INT_ACCESSORS(SharedFunctionInfo, end_position, kEndPositionOffset)
-INT_ACCESSORS(SharedFunctionInfo, start_position_and_type,
+INT_ACCESSORS(SharedFunctionInfo, raw_end_position, kEndPositionOffset)
+INT_ACCESSORS(SharedFunctionInfo, raw_start_position_and_type,
               kStartPositionAndTypeOffset)
 INT_ACCESSORS(SharedFunctionInfo, function_token_position,
               kFunctionTokenPositionOffset)
-INT_ACCESSORS(SharedFunctionInfo, compiler_hints, kCompilerHintsOffset)
+INT_ACCESSORS(SharedFunctionInfo, flags, kFlagsOffset)
 
-bool SharedFunctionInfo::has_shared_name() const {
-  return raw_name() != kNoSharedNameSentinel;
+bool SharedFunctionInfo::HasSharedName() const {
+  Object* value = name_or_scope_info();
+  if (value->IsScopeInfo()) {
+    return ScopeInfo::cast(value)->HasSharedFunctionName();
+  }
+  return value != kNoSharedNameSentinel;
 }
 
-String* SharedFunctionInfo::name() const {
-  if (!has_shared_name()) return GetHeap()->empty_string();
-  DCHECK(raw_name()->IsString());
-  return String::cast(raw_name());
+String* SharedFunctionInfo::Name() const {
+  if (!HasSharedName()) return GetHeap()->empty_string();
+  Object* value = name_or_scope_info();
+  if (value->IsScopeInfo()) {
+    if (ScopeInfo::cast(value)->HasFunctionName()) {
+      return String::cast(ScopeInfo::cast(value)->FunctionName());
+    }
+    return GetHeap()->empty_string();
+  }
+  return String::cast(value);
 }
 
-void SharedFunctionInfo::set_name(String* name) {
-  set_raw_name(name);
+void SharedFunctionInfo::SetName(String* name) {
+  Object* maybe_scope_info = name_or_scope_info();
+  if (maybe_scope_info->IsScopeInfo()) {
+    ScopeInfo::cast(maybe_scope_info)->SetFunctionName(name);
+  } else {
+    DCHECK(maybe_scope_info->IsString() ||
+           maybe_scope_info == kNoSharedNameSentinel);
+    set_name_or_scope_info(name);
+  }
   UpdateFunctionMapIndex();
 }
 
@@ -76,25 +92,24 @@ AbstractCode* SharedFunctionInfo::abstract_code() {
   if (HasBytecodeArray()) {
     return AbstractCode::cast(bytecode_array());
   } else {
-    return AbstractCode::cast(code());
+    return AbstractCode::cast(GetCode());
   }
 }
 
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, compiler_hints, is_wrapped,
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, is_wrapped,
                     SharedFunctionInfo::IsWrappedBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, compiler_hints, allows_lazy_compilation,
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, allows_lazy_compilation,
                     SharedFunctionInfo::AllowLazyCompilationBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, compiler_hints,
-                    has_duplicate_parameters,
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, has_duplicate_parameters,
                     SharedFunctionInfo::HasDuplicateParametersBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, compiler_hints, is_declaration,
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, is_declaration,
                     SharedFunctionInfo::IsDeclarationBit)
 
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, compiler_hints, native,
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, native,
                     SharedFunctionInfo::IsNativeBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, compiler_hints, is_asm_wasm_broken,
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, is_asm_wasm_broken,
                     SharedFunctionInfo::IsAsmWasmBrokenBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, compiler_hints,
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags,
                     requires_instance_fields_initializer,
                     SharedFunctionInfo::RequiresInstanceFieldsInitializer)
 
@@ -103,12 +118,12 @@ bool SharedFunctionInfo::optimization_disabled() const {
 }
 
 BailoutReason SharedFunctionInfo::disable_optimization_reason() const {
-  return DisabledOptimizationReasonBits::decode(compiler_hints());
+  return DisabledOptimizationReasonBits::decode(flags());
 }
 
 LanguageMode SharedFunctionInfo::language_mode() {
   STATIC_ASSERT(LanguageModeSize == 2);
-  return construct_language_mode(IsStrictBit::decode(compiler_hints()));
+  return construct_language_mode(IsStrictBit::decode(flags()));
 }
 
 void SharedFunctionInfo::set_language_mode(LanguageMode language_mode) {
@@ -116,39 +131,40 @@ void SharedFunctionInfo::set_language_mode(LanguageMode language_mode) {
   // We only allow language mode transitions that set the same language mode
   // again or go up in the chain:
   DCHECK(is_sloppy(this->language_mode()) || is_strict(language_mode));
-  int hints = compiler_hints();
+  int hints = flags();
   hints = IsStrictBit::update(hints, is_strict(language_mode));
-  set_compiler_hints(hints);
+  set_flags(hints);
   UpdateFunctionMapIndex();
 }
 
 FunctionKind SharedFunctionInfo::kind() const {
-  return FunctionKindBits::decode(compiler_hints());
+  return FunctionKindBits::decode(flags());
 }
 
 void SharedFunctionInfo::set_kind(FunctionKind kind) {
-  DCHECK(IsValidFunctionKind(kind));
-  int hints = compiler_hints();
+  int hints = flags();
   hints = FunctionKindBits::update(hints, kind);
-  set_compiler_hints(hints);
+  hints = IsClassConstructorBit::update(hints, IsClassConstructor(kind));
+  hints = IsDerivedConstructorBit::update(hints, IsDerivedConstructor(kind));
+  set_flags(hints);
   UpdateFunctionMapIndex();
 }
 
 bool SharedFunctionInfo::needs_home_object() const {
-  return NeedsHomeObjectBit::decode(compiler_hints());
+  return NeedsHomeObjectBit::decode(flags());
 }
 
 void SharedFunctionInfo::set_needs_home_object(bool value) {
-  int hints = compiler_hints();
+  int hints = flags();
   hints = NeedsHomeObjectBit::update(hints, value);
-  set_compiler_hints(hints);
+  set_flags(hints);
   UpdateFunctionMapIndex();
 }
 
 int SharedFunctionInfo::function_map_index() const {
   // Note: Must be kept in sync with the FastNewClosure builtin.
-  int index = Context::FIRST_FUNCTION_MAP_INDEX +
-              FunctionMapIndexBits::decode(compiler_hints());
+  int index =
+      Context::FIRST_FUNCTION_MAP_INDEX + FunctionMapIndexBits::decode(flags());
   DCHECK_LE(index, Context::LAST_FUNCTION_MAP_INDEX);
   return index;
 }
@@ -159,7 +175,7 @@ void SharedFunctionInfo::set_function_map_index(int index) {
   DCHECK_LE(Context::FIRST_FUNCTION_MAP_INDEX, index);
   DCHECK_LE(index, Context::LAST_FUNCTION_MAP_INDEX);
   index -= Context::FIRST_FUNCTION_MAP_INDEX;
-  set_compiler_hints(FunctionMapIndexBits::update(compiler_hints(), index));
+  set_flags(FunctionMapIndexBits::update(flags(), index));
 }
 
 void SharedFunctionInfo::clear_padding() {
@@ -168,7 +184,7 @@ void SharedFunctionInfo::clear_padding() {
 
 void SharedFunctionInfo::UpdateFunctionMapIndex() {
   int map_index = Context::FunctionMapIndex(
-      language_mode(), kind(), true, has_shared_name(), needs_home_object());
+      language_mode(), kind(), true, HasSharedName(), needs_home_object());
   set_function_map_index(map_index);
 }
 
@@ -192,51 +208,111 @@ BIT_FIELD_ACCESSORS(SharedFunctionInfo, debugger_hints,
 BIT_FIELD_ACCESSORS(SharedFunctionInfo, debugger_hints,
                     has_reported_binary_coverage,
                     SharedFunctionInfo::HasReportedBinaryCoverageBit)
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, debugger_hints, debugging_id,
+                    SharedFunctionInfo::DebuggingIdBits)
 
 void SharedFunctionInfo::DontAdaptArguments() {
-  DCHECK(code()->kind() == Code::BUILTIN || code()->kind() == Code::STUB);
+  // TODO(leszeks): Revise this DCHECK now that the code field is gone.
+  DCHECK(!HasCodeObject());
   set_internal_formal_parameter_count(kDontAdaptArgumentsSentinel);
 }
 
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, start_position_and_type, start_position,
-                    SharedFunctionInfo::StartPositionBits)
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, raw_start_position_and_type,
+                    raw_start_position, SharedFunctionInfo::StartPositionBits)
 
-Code* SharedFunctionInfo::code() const {
-  return Code::cast(READ_FIELD(this, kCodeOffset));
+int SharedFunctionInfo::StartPosition() const {
+  ScopeInfo* info = scope_info();
+  if (!info->HasPositionInfo()) {
+    // TODO(cbruni): use preparsed_scope_data
+    return raw_start_position();
+  }
+  return info->StartPosition();
 }
 
-void SharedFunctionInfo::set_code(Code* value, WriteBarrierMode mode) {
-  DCHECK(value->kind() != Code::OPTIMIZED_FUNCTION);
-  // If the SharedFunctionInfo has bytecode we should never mark it for lazy
-  // compile, since the bytecode is never flushed.
-  DCHECK(value != GetIsolate()->builtins()->builtin(Builtins::kCompileLazy) ||
-         !HasBytecodeArray());
-  WRITE_FIELD(this, kCodeOffset, value);
-  CONDITIONAL_WRITE_BARRIER(value->GetHeap(), this, kCodeOffset, value, mode);
+int SharedFunctionInfo::EndPosition() const {
+  ScopeInfo* info = scope_info();
+  if (!info->HasPositionInfo()) {
+    // TODO(cbruni): use preparsed_scope_data
+    return raw_end_position();
+  }
+  return info->EndPosition();
+}
+
+Code* SharedFunctionInfo::GetCode() const {
+  // ======
+  // NOTE: This chain of checks MUST be kept in sync with the equivalent CSA
+  // GetSharedFunctionInfoCode method in code-stub-assembler.cc, and the
+  // architecture-specific GetSharedFunctionInfoCode methods in builtins-*.cc.
+  // ======
+
+  Isolate* isolate = GetIsolate();
+  Object* data = function_data();
+  if (data->IsSmi()) {
+    // Holding a Smi means we are a builtin.
+    DCHECK(HasBuiltinId());
+    return isolate->builtins()->builtin(builtin_id());
+  } else if (data->IsBytecodeArray()) {
+    // Having a bytecode array means we are a compiled, interpreted function.
+    DCHECK(HasBytecodeArray());
+    return isolate->builtins()->builtin(Builtins::kInterpreterEntryTrampoline);
+  } else if (data->IsFixedArray()) {
+    // Having a fixed array means we are an asm.js/wasm function.
+    DCHECK(HasAsmWasmData());
+    return isolate->builtins()->builtin(Builtins::kInstantiateAsmJs);
+  } else if (data->IsPreParsedScopeData()) {
+    // Having pre-parsed scope data means we need to compile.
+    DCHECK(HasPreParsedScopeData());
+    return isolate->builtins()->builtin(Builtins::kCompileLazy);
+  } else if (data->IsFunctionTemplateInfo()) {
+    // Having a function template info means we are an API function.
+    DCHECK(IsApiFunction());
+    return isolate->builtins()->builtin(Builtins::kHandleApiCall);
+  } else if (data->IsCode()) {
+    // Having a code object means we should run it.
+    DCHECK(HasCodeObject());
+    return Code::cast(data);
+  }
+  UNREACHABLE();
 }
 
-bool SharedFunctionInfo::IsInterpreted() const {
-  return code()->is_interpreter_trampoline_builtin();
-}
+bool SharedFunctionInfo::IsInterpreted() const { return HasBytecodeArray(); }
 
 ScopeInfo* SharedFunctionInfo::scope_info() const {
-  return reinterpret_cast<ScopeInfo*>(READ_FIELD(this, kScopeInfoOffset));
+  Object* maybe_scope_info = name_or_scope_info();
+  if (maybe_scope_info->IsScopeInfo()) {
+    return ScopeInfo::cast(maybe_scope_info);
+  }
+  return ScopeInfo::Empty(GetIsolate());
 }
 
-void SharedFunctionInfo::set_scope_info(ScopeInfo* value,
+void SharedFunctionInfo::set_scope_info(ScopeInfo* scope_info,
                                         WriteBarrierMode mode) {
-  WRITE_FIELD(this, kScopeInfoOffset, reinterpret_cast<Object*>(value));
-  CONDITIONAL_WRITE_BARRIER(GetHeap(), this, kScopeInfoOffset,
-                            reinterpret_cast<Object*>(value), mode);
+  // TODO(cbruni): this code is no longer necessary once we store the positon
+  // only on the ScopeInfo.
+  if (scope_info->HasPositionInfo()) {
+    scope_info->SetPositionInfo(raw_start_position(), raw_end_position());
+  }
+  // Move the existing name onto the ScopeInfo.
+  Object* name = name_or_scope_info();
+  if (name->IsScopeInfo()) {
+    name = ScopeInfo::cast(name)->FunctionName();
+  }
+  DCHECK(name->IsString() || name == kNoSharedNameSentinel);
+  // Only set the function name for function scopes.
+  scope_info->SetFunctionName(name);
+  WRITE_FIELD(this, kNameOrScopeInfoOffset,
+              reinterpret_cast<Object*>(scope_info));
+  CONDITIONAL_WRITE_BARRIER(GetHeap(), this, kNameOrScopeInfoOffset,
+                            reinterpret_cast<Object*>(scope_info), mode);
 }
 
 ACCESSORS(SharedFunctionInfo, outer_scope_info, HeapObject,
           kOuterScopeInfoOffset)
 
 bool SharedFunctionInfo::is_compiled() const {
-  Builtins* builtins = GetIsolate()->builtins();
-  DCHECK(code() != builtins->builtin(Builtins::kCheckOptimizationMarker));
-  return code() != builtins->builtin(Builtins::kCompileLazy);
+  Object* data = function_data();
+  return data != Smi::FromEnum(Builtins::kCompileLazy) &&
+         !data->IsPreParsedScopeData();
 }
 
 int SharedFunctionInfo::GetLength() const {
@@ -260,7 +336,7 @@ bool SharedFunctionInfo::HasDebugInfo() const {
   return has_debug_info;
 }
 
-bool SharedFunctionInfo::IsApiFunction() {
+bool SharedFunctionInfo::IsApiFunction() const {
   return function_data()->IsFunctionTemplateInfo();
 }
 
@@ -269,11 +345,6 @@ FunctionTemplateInfo* SharedFunctionInfo::get_api_func_data() {
   return FunctionTemplateInfo::cast(function_data());
 }
 
-void SharedFunctionInfo::set_api_func_data(FunctionTemplateInfo* data) {
-  DCHECK(function_data()->IsUndefined(GetIsolate()));
-  set_function_data(data);
-}
-
 bool SharedFunctionInfo::HasBytecodeArray() const {
   return function_data()->IsBytecodeArray();
 }
@@ -284,13 +355,14 @@ BytecodeArray* SharedFunctionInfo::bytecode_array() const {
 }
 
 void SharedFunctionInfo::set_bytecode_array(BytecodeArray* bytecode) {
-  DCHECK(function_data()->IsUndefined(GetIsolate()));
+  DCHECK(function_data() == Smi::FromEnum(Builtins::kCompileLazy));
   set_function_data(bytecode);
 }
 
 void SharedFunctionInfo::ClearBytecodeArray() {
-  DCHECK(function_data()->IsUndefined(GetIsolate()) || HasBytecodeArray());
-  set_function_data(GetHeap()->undefined_value());
+  DCHECK(function_data() == Smi::FromEnum(Builtins::kCompileLazy) ||
+         HasBytecodeArray());
+  set_builtin_id(Builtins::kCompileLazy);
 }
 
 bool SharedFunctionInfo::HasAsmWasmData() const {
@@ -303,26 +375,33 @@ FixedArray* SharedFunctionInfo::asm_wasm_data() const {
 }
 
 void SharedFunctionInfo::set_asm_wasm_data(FixedArray* data) {
-  DCHECK(function_data()->IsUndefined(GetIsolate()) || HasAsmWasmData());
+  DCHECK(function_data() == Smi::FromEnum(Builtins::kCompileLazy) ||
+         HasAsmWasmData());
   set_function_data(data);
 }
 
 void SharedFunctionInfo::ClearAsmWasmData() {
-  DCHECK(function_data()->IsUndefined(GetIsolate()) || HasAsmWasmData());
-  set_function_data(GetHeap()->undefined_value());
+  DCHECK(HasAsmWasmData());
+  set_builtin_id(Builtins::kCompileLazy);
 }
 
-bool SharedFunctionInfo::HasLazyDeserializationBuiltinId() const {
+bool SharedFunctionInfo::HasBuiltinId() const {
   return function_data()->IsSmi();
 }
 
-int SharedFunctionInfo::lazy_deserialization_builtin_id() const {
-  DCHECK(HasLazyDeserializationBuiltinId());
+int SharedFunctionInfo::builtin_id() const {
+  DCHECK(HasBuiltinId());
   int id = Smi::ToInt(function_data());
   DCHECK(Builtins::IsBuiltinId(id));
   return id;
 }
 
+void SharedFunctionInfo::set_builtin_id(int builtin_id) {
+  DCHECK(Builtins::IsBuiltinId(builtin_id));
+  DCHECK_NE(builtin_id, Builtins::kDeserializeLazy);
+  set_function_data(Smi::FromInt(builtin_id), SKIP_WRITE_BARRIER);
+}
+
 bool SharedFunctionInfo::HasPreParsedScopeData() const {
   return function_data()->IsPreParsedScopeData();
 }
@@ -334,13 +413,18 @@ PreParsedScopeData* SharedFunctionInfo::preparsed_scope_data() const {
 
 void SharedFunctionInfo::set_preparsed_scope_data(
     PreParsedScopeData* preparsed_scope_data) {
-  DCHECK(function_data()->IsUndefined(GetIsolate()));
+  DCHECK(function_data() == Smi::FromEnum(Builtins::kCompileLazy));
   set_function_data(preparsed_scope_data);
 }
 
 void SharedFunctionInfo::ClearPreParsedScopeData() {
-  DCHECK(function_data()->IsUndefined(GetIsolate()) || HasPreParsedScopeData());
-  set_function_data(GetHeap()->undefined_value());
+  DCHECK(function_data() == Smi::FromEnum(Builtins::kCompileLazy) ||
+         HasPreParsedScopeData());
+  set_builtin_id(Builtins::kCompileLazy);
+}
+
+bool SharedFunctionInfo::HasCodeObject() const {
+  return function_data()->IsCode();
 }
 
 bool SharedFunctionInfo::HasBuiltinFunctionId() {
diff --git a/deps/v8/src/objects/shared-function-info.h b/deps/v8/src/objects/shared-function-info.h
index 8e996042c03..45a090c4877 100644
--- a/deps/v8/src/objects/shared-function-info.h
+++ b/deps/v8/src/objects/shared-function-info.h
@@ -42,11 +42,11 @@ class SharedFunctionInfo : public HeapObject {
   static constexpr Object* const kNoSharedNameSentinel = Smi::kZero;
 
   // [name]: Returns shared name if it exists or an empty string otherwise.
-  inline String* name() const;
-  inline void set_name(String* name);
+  inline String* Name() const;
+  inline void SetName(String* name);
 
-  // [code]: Function code.
-  DECL_ACCESSORS(code, Code)
+  // Get the code object which represents the execution of this function.
+  inline Code* GetCode() const;
 
   // Get the abstract code associated with the function, which will either be
   // a Code object or a BytecodeArray.
@@ -86,6 +86,12 @@ class SharedFunctionInfo : public HeapObject {
   // [scope_info]: Scope info.
   DECL_ACCESSORS(scope_info, ScopeInfo)
 
+  // End position of this function in the script source.
+  inline int EndPosition() const;
+
+  // Start position of this function in the script source.
+  inline int StartPosition() const;
+
   // The outer scope info for the purpose of parsing this function, or the hole
   // value if it isn't yet known.
   DECL_ACCESSORS(outer_scope_info, HeapObject)
@@ -136,19 +142,17 @@ class SharedFunctionInfo : public HeapObject {
   DECL_INT_ACCESSORS(unique_id)
 #endif
 
-  // [instance class name]: class name for instances.
-  DECL_ACCESSORS(instance_class_name, String)
-
   // [function data]: This field holds some additional data for function.
   // Currently it has one of:
   //  - a FunctionTemplateInfo to make benefit the API [IsApiFunction()].
   //  - a BytecodeArray for the interpreter [HasBytecodeArray()].
   //  - a FixedArray with Asm->Wasm conversion [HasAsmWasmData()].
-  //  - a Smi containing the builtin id [HasLazyDeserializationBuiltinId()]
+  //  - a Smi containing the builtin id [HasBuiltinId()]
   //  - a PreParsedScopeData for the parser [HasPreParsedScopeData()]
+  //  - a Code object otherwise [HasCodeObject()]
   DECL_ACCESSORS(function_data, Object)
 
-  inline bool IsApiFunction();
+  inline bool IsApiFunction() const;
   inline FunctionTemplateInfo* get_api_func_data();
   inline void set_api_func_data(FunctionTemplateInfo* data);
   inline bool HasBytecodeArray() const;
@@ -160,16 +164,20 @@ class SharedFunctionInfo : public HeapObject {
   inline void set_asm_wasm_data(FixedArray* data);
   inline void ClearAsmWasmData();
   // A brief note to clear up possible confusion:
-  // lazy_deserialization_builtin_id corresponds to the auto-generated
+  // builtin_id corresponds to the auto-generated
   // Builtins::Name id, while builtin_function_id corresponds to
   // BuiltinFunctionId (a manually maintained list of 'interesting' functions
   // mainly used during optimization).
-  inline bool HasLazyDeserializationBuiltinId() const;
-  inline int lazy_deserialization_builtin_id() const;
+  inline bool HasBuiltinId() const;
+  inline int builtin_id() const;
+  inline void set_builtin_id(int builtin_id);
   inline bool HasPreParsedScopeData() const;
   inline PreParsedScopeData* preparsed_scope_data() const;
   inline void set_preparsed_scope_data(PreParsedScopeData* data);
   inline void ClearPreParsedScopeData();
+  inline bool HasCodeObject() const;
+  inline Code* code_object() const;
+  inline void set_code_object();
 
   // [function identifier]: This field holds an additional identifier for the
   // function.
@@ -192,13 +200,6 @@ class SharedFunctionInfo : public HeapObject {
   // [script]: Script from which the function originates.
   DECL_ACCESSORS(script, Object)
 
-  // [start_position_and_type]: Field used to store both the source code
-  // position, whether or not the function is a function expression,
-  // and whether or not the function is a toplevel function. The two
-  // least significants bit indicates whether the function is an
-  // expression and the rest contains the source code position.
-  DECL_INT_ACCESSORS(start_position_and_type)
-
   // The function is subject to debugging if a debug info is attached.
   inline bool HasDebugInfo() const;
   DebugInfo* GetDebugInfo() const;
@@ -206,6 +207,7 @@ class SharedFunctionInfo : public HeapObject {
   // Break infos are contained in DebugInfo, this is a convenience method
   // to simplify access.
   bool HasBreakInfo() const;
+  bool BreakAtEntry() const;
 
   // Coverage infos are contained in DebugInfo, this is a convenience method
   // to simplify access.
@@ -250,6 +252,11 @@ class SharedFunctionInfo : public HeapObject {
   // Indicates that the function has been reported for binary code coverage.
   DECL_BOOLEAN_ACCESSORS(has_reported_binary_coverage)
 
+  // Id assigned to the function for debugging.
+  // This could also be implemented as a weak hash table.
+  inline int debugging_id() const;
+  inline void set_debugging_id(int value);
+
   // The function's name if it is non-empty, otherwise the inferred name.
   String* DebugName();
 
@@ -262,14 +269,24 @@ class SharedFunctionInfo : public HeapObject {
   // Position of the 'function' token in the script source.
   DECL_INT_ACCESSORS(function_token_position)
 
+  // [raw_start_position_and_type]: Field used to store both the source code
+  // position, whether or not the function is a function expression,
+  // and whether or not the function is a toplevel function. The two
+  // least significants bit indicates whether the function is an
+  // expression and the rest contains the source code position.
+  // TODO(cbruni): start_position should be removed from SFI.
+  DECL_INT_ACCESSORS(raw_start_position_and_type)
+
   // Position of this function in the script source.
-  DECL_INT_ACCESSORS(start_position)
+  // TODO(cbruni): start_position should be removed from SFI.
+  DECL_INT_ACCESSORS(raw_start_position)
 
   // End position of this function in the script source.
-  DECL_INT_ACCESSORS(end_position)
+  // TODO(cbruni): end_position should be removed from SFI.
+  DECL_INT_ACCESSORS(raw_end_position)
 
   // Returns true if the function has shared name.
-  inline bool has_shared_name() const;
+  inline bool HasSharedName() const;
 
   // Is this function a named function expression in the source code.
   DECL_BOOLEAN_ACCESSORS(is_named_expression)
@@ -277,9 +294,8 @@ class SharedFunctionInfo : public HeapObject {
   // Is this function a top-level function (scripts, evals).
   DECL_BOOLEAN_ACCESSORS(is_toplevel)
 
-  // Bit field containing various information collected by the compiler to
-  // drive optimization.
-  DECL_INT_ACCESSORS(compiler_hints)
+  // [flags] Bit field containing various flags about the function.
+  DECL_INT_ACCESSORS(flags)
 
   // Indicates if this function can be lazy compiled.
   DECL_BOOLEAN_ACCESSORS(allows_lazy_compilation)
@@ -342,7 +358,11 @@ class SharedFunctionInfo : public HeapObject {
   static Handle<Object> GetSourceCode(Handle<SharedFunctionInfo> shared);
   static Handle<Object> GetSourceCodeHarmony(Handle<SharedFunctionInfo> shared);
 
-  // Tells whether this function should be subject to debugging.
+  // Tells whether this function should be subject to debugging, e.g. for
+  // - scope inspection
+  // - internal break points
+  // - coverage and type profile
+  // - error stack trace
   inline bool IsSubjectToDebugging();
 
   // Whether this function is defined in user-provided JavaScript code.
@@ -377,7 +397,8 @@ class SharedFunctionInfo : public HeapObject {
   class ScriptIterator {
    public:
     explicit ScriptIterator(Handle<Script> script);
-    ScriptIterator(Isolate* isolate, Handle<FixedArray> shared_function_infos);
+    ScriptIterator(Isolate* isolate,
+                   Handle<WeakFixedArray> shared_function_infos);
     SharedFunctionInfo* Next();
 
     // Reset the iterator to run on |script|.
@@ -385,7 +406,7 @@ class SharedFunctionInfo : public HeapObject {
 
    private:
     Isolate* isolate_;
-    Handle<FixedArray> shared_function_infos_;
+    Handle<WeakFixedArray> shared_function_infos_;
     int index_;
     DISALLOW_COPY_AND_ASSIGN(ScriptIterator);
   };
@@ -398,7 +419,7 @@ class SharedFunctionInfo : public HeapObject {
 
    private:
     Script::Iterator script_iterator_;
-    WeakFixedArray::Iterator noscript_sfi_iterator_;
+    FixedArrayOfWeakCells::Iterator noscript_sfi_iterator_;
     SharedFunctionInfo::ScriptIterator sfi_iterator_;
     DisallowHeapAllocation no_gc_;
     DISALLOW_COPY_AND_ASSIGN(GlobalIterator);
@@ -419,13 +440,11 @@ class SharedFunctionInfo : public HeapObject {
 // Layout description.
 #define SHARED_FUNCTION_INFO_FIELDS(V)        \
   /* Pointer fields. */                       \
-  V(kCodeOffset, kPointerSize)                \
-  V(kNameOffset, kPointerSize)                \
-  V(kScopeInfoOffset, kPointerSize)           \
+  V(kStartOfPointerFieldsOffset, 0)           \
+  V(kFunctionDataOffset, kPointerSize)        \
+  V(kNameOrScopeInfoOffset, kPointerSize)     \
   V(kOuterScopeInfoOffset, kPointerSize)      \
   V(kConstructStubOffset, kPointerSize)       \
-  V(kInstanceClassNameOffset, kPointerSize)   \
-  V(kFunctionDataOffset, kPointerSize)        \
   V(kScriptOffset, kPointerSize)              \
   V(kDebugInfoOffset, kPointerSize)           \
   V(kFunctionIdentifierOffset, kPointerSize)  \
@@ -440,7 +459,7 @@ class SharedFunctionInfo : public HeapObject {
   V(kStartPositionAndTypeOffset, kInt32Size)  \
   V(kEndPositionOffset, kInt32Size)           \
   V(kFunctionTokenPositionOffset, kInt32Size) \
-  V(kCompilerHintsOffset, kInt32Size)         \
+  V(kFlagsOffset, kInt32Size)                 \
   /* Total size. */                           \
   V(kSize, 0)
 
@@ -450,12 +469,13 @@ class SharedFunctionInfo : public HeapObject {
 
   static const int kAlignedSize = POINTER_SIZE_ALIGN(kSize);
 
-  typedef FixedBodyDescriptor<kCodeOffset, kEndOfPointerFieldsOffset, kSize>
+  typedef FixedBodyDescriptor<kStartOfPointerFieldsOffset,
+                              kEndOfPointerFieldsOffset, kSize>
       BodyDescriptor;
   // No weak fields.
   typedef BodyDescriptor BodyDescriptorWeak;
 
-// Bit fields in |start_position_and_type|.
+// Bit fields in |raw_start_position_and_type|.
 #define START_POSITION_AND_TYPE_BIT_FIELDS(V, _) \
   V(IsNamedExpressionBit, bool, 1, _)            \
   V(IsTopLevelBit, bool, 1, _)                   \
@@ -464,12 +484,14 @@ class SharedFunctionInfo : public HeapObject {
   DEFINE_BIT_FIELDS(START_POSITION_AND_TYPE_BIT_FIELDS)
 #undef START_POSITION_AND_TYPE_BIT_FIELDS
 
-// Bit positions in |compiler_hints|.
-#define COMPILER_HINTS_BIT_FIELDS(V, _)                  \
+// Bit positions in |flags|.
+#define FLAGS_BIT_FIELDS(V, _)                           \
   V(IsNativeBit, bool, 1, _)                             \
   V(IsStrictBit, bool, 1, _)                             \
   V(IsWrappedBit, bool, 1, _)                            \
-  V(FunctionKindBits, FunctionKind, 11, _)               \
+  V(IsClassConstructorBit, bool, 1, _)                   \
+  V(IsDerivedConstructorBit, bool, 1, _)                 \
+  V(FunctionKindBits, FunctionKind, 5, _)                \
   V(HasDuplicateParametersBit, bool, 1, _)               \
   V(AllowLazyCompilationBit, bool, 1, _)                 \
   V(NeedsHomeObjectBit, bool, 1, _)                      \
@@ -479,20 +501,14 @@ class SharedFunctionInfo : public HeapObject {
   V(DisabledOptimizationReasonBits, BailoutReason, 4, _) \
   V(RequiresInstanceFieldsInitializer, bool, 1, _)
 
-  DEFINE_BIT_FIELDS(COMPILER_HINTS_BIT_FIELDS)
-#undef COMPILER_HINTS_BIT_FIELDS
+  DEFINE_BIT_FIELDS(FLAGS_BIT_FIELDS)
+#undef FLAGS_BIT_FIELDS
 
   // Bailout reasons must fit in the DisabledOptimizationReason bitfield.
   STATIC_ASSERT(BailoutReason::kLastErrorMessage <=
                 DisabledOptimizationReasonBits::kMax);
 
   STATIC_ASSERT(kLastFunctionKind <= FunctionKindBits::kMax);
-  // Masks for checking if certain FunctionKind bits are set without fully
-  // decoding of the FunctionKind bit field.
-  static const int kClassConstructorMask = FunctionKind::kClassConstructor
-                                           << FunctionKindBits::kShift;
-  static const int kDerivedConstructorMask = FunctionKind::kDerivedConstructor
-                                             << FunctionKindBits::kShift;
 
 // Bit positions in |debugger_hints|.
 #define DEBUGGER_HINTS_BIT_FIELDS(V, _)        \
@@ -503,19 +519,23 @@ class SharedFunctionInfo : public HeapObject {
   V(ComputedHasNoSideEffectBit, bool, 1, _)    \
   V(DebugIsBlackboxedBit, bool, 1, _)          \
   V(ComputedDebugIsBlackboxedBit, bool, 1, _)  \
-  V(HasReportedBinaryCoverageBit, bool, 1, _)
+  V(HasReportedBinaryCoverageBit, bool, 1, _)  \
+  V(DebuggingIdBits, int, 20, _)
 
   DEFINE_BIT_FIELDS(DEBUGGER_HINTS_BIT_FIELDS)
 #undef DEBUGGER_HINTS_BIT_FIELDS
 
+  static const int kNoDebuggingId = 0;
+
   // Indicates that this function uses a super property (or an eval that may
   // use a super property).
   // This is needed to set up the [[HomeObject]] on the function instance.
   inline bool needs_home_object() const;
 
  private:
-  // [raw_name]: Function name string or kNoSharedNameSentinel.
-  DECL_ACCESSORS(raw_name, Object)
+  // [name_or_scope_info]: Function name string, kNoSharedNameSentinel or
+  // ScopeInfo.
+  DECL_ACCESSORS(name_or_scope_info, Object)
 
   inline void set_kind(FunctionKind kind);
 
diff --git a/deps/v8/src/objects/string-table.h b/deps/v8/src/objects/string-table.h
index 382fe06bf48..daa09a3eb66 100644
--- a/deps/v8/src/objects/string-table.h
+++ b/deps/v8/src/objects/string-table.h
@@ -61,9 +61,14 @@ class StringTable : public HashTable<StringTable, StringTableShape> {
   V8_EXPORT_PRIVATE static Handle<String> LookupString(Isolate* isolate,
                                                        Handle<String> key);
   static Handle<String> LookupKey(Isolate* isolate, StringTableKey* key);
+  static Handle<String> AddKeyNoResize(Isolate* isolate, StringTableKey* key);
   static String* ForwardStringIfExists(Isolate* isolate, StringTableKey* key,
                                        String* string);
 
+  // Shink the StringTable if it's very empty (kMaxEmptyFactor) to avoid the
+  // performance overhead of re-allocating the StringTable over and over again.
+  static Handle<StringTable> CautiousShrink(Handle<StringTable> table);
+
   // Looks up a string that is equal to the given string and returns
   // string handle if it is found, or an empty handle otherwise.
   MUST_USE_RESULT static MaybeHandle<String> LookupTwoCharsStringIfExists(
@@ -74,6 +79,10 @@ class StringTable : public HashTable<StringTable, StringTableShape> {
 
   DECL_CAST(StringTable)
 
+  static const int kMaxEmptyFactor = 8;
+  static const int kMinCapacity = 2048;
+  static const int kMinShrinkCapacity = kMinCapacity;
+
  private:
   template <bool seq_one_byte>
   friend class JsonParser;
diff --git a/deps/v8/src/objects/string.h b/deps/v8/src/objects/string.h
index 066fc6d8794..dee56fb7f7e 100644
--- a/deps/v8/src/objects/string.h
+++ b/deps/v8/src/objects/string.h
@@ -314,7 +314,7 @@ class String : public Name {
   uint32_t inline ToValidIndex(Object* number);
 
   // Trimming.
-  enum TrimMode { kTrim, kTrimLeft, kTrimRight };
+  enum TrimMode { kTrim, kTrimStart, kTrimEnd };
   static Handle<String> Trim(Handle<String> string, TrimMode mode);
 
   DECL_CAST(String)
diff --git a/deps/v8/src/objects/template-objects.cc b/deps/v8/src/objects/template-objects.cc
index 24f306aa685..e35f3f137b5 100644
--- a/deps/v8/src/objects/template-objects.cc
+++ b/deps/v8/src/objects/template-objects.cc
@@ -12,117 +12,41 @@
 namespace v8 {
 namespace internal {
 
-bool TemplateObjectDescription::Equals(
-    TemplateObjectDescription const* that) const {
-  if (this->raw_strings()->length() == that->raw_strings()->length()) {
-    for (int i = this->raw_strings()->length(); --i >= 0;) {
-      if (this->raw_strings()->get(i) != that->raw_strings()->get(i)) {
-        return false;
-      }
-    }
-    return true;
-  }
-  return false;
-}
-
 // static
-Handle<JSArray> TemplateObjectDescription::GetTemplateObject(
-    Handle<TemplateObjectDescription> description,
-    Handle<Context> native_context) {
-  DCHECK(native_context->IsNativeContext());
-  Isolate* const isolate = native_context->GetIsolate();
-
-  // Check if we already have a [[TemplateMap]] for the {native_context},
-  // and if not, just allocate one on the fly (which will be set below).
-  Handle<TemplateMap> template_map =
-      native_context->template_map()->IsUndefined(isolate)
-          ? TemplateMap::New(isolate)
-          : handle(TemplateMap::cast(native_context->template_map()), isolate);
-
-  // Check if we already have an appropriate entry.
-  Handle<JSArray> template_object;
-  if (!TemplateMap::Lookup(template_map, description)
-           .ToHandle(&template_object)) {
-    // Create the raw object from the {raw_strings}.
-    Handle<FixedArray> raw_strings(description->raw_strings(), isolate);
-    Handle<JSArray> raw_object = isolate->factory()->NewJSArrayWithElements(
-        raw_strings, PACKED_ELEMENTS, raw_strings->length(), TENURED);
-
-    // Create the template object from the {cooked_strings}.
-    Handle<FixedArray> cooked_strings(description->cooked_strings(), isolate);
-    template_object = isolate->factory()->NewJSArrayWithElements(
-        cooked_strings, PACKED_ELEMENTS, cooked_strings->length(), TENURED);
-
-    // Freeze the {raw_object}.
-    JSObject::SetIntegrityLevel(raw_object, FROZEN, kThrowOnError).ToChecked();
-
-    // Install a "raw" data property for {raw_object} on {template_object}.
-    PropertyDescriptor raw_desc;
-    raw_desc.set_value(raw_object);
-    raw_desc.set_configurable(false);
-    raw_desc.set_enumerable(false);
-    raw_desc.set_writable(false);
-    JSArray::DefineOwnProperty(isolate, template_object,
-                               isolate->factory()->raw_string(), &raw_desc,
-                               kThrowOnError)
-        .ToChecked();
-
-    // Freeze the {template_object} as well.
-    JSObject::SetIntegrityLevel(template_object, FROZEN, kThrowOnError)
-        .ToChecked();
-
-    // Remember the {template_object} in the {template_map}.
-    template_map = TemplateMap::Add(template_map, description, template_object);
-    native_context->set_template_map(*template_map);
-  }
+Handle<JSArray> TemplateObjectDescription::CreateTemplateObject(
+    Handle<TemplateObjectDescription> description) {
+  Isolate* const isolate = description->GetIsolate();
+
+  // Create the raw object from the {raw_strings}.
+  Handle<FixedArray> raw_strings(description->raw_strings(), isolate);
+  Handle<JSArray> raw_object = isolate->factory()->NewJSArrayWithElements(
+      raw_strings, PACKED_ELEMENTS, raw_strings->length(), TENURED);
+
+  // Create the template object from the {cooked_strings}.
+  Handle<FixedArray> cooked_strings(description->cooked_strings(), isolate);
+  Handle<JSArray> template_object = isolate->factory()->NewJSArrayWithElements(
+      cooked_strings, PACKED_ELEMENTS, cooked_strings->length(), TENURED);
+
+  // Freeze the {raw_object}.
+  JSObject::SetIntegrityLevel(raw_object, FROZEN, kThrowOnError).ToChecked();
+
+  // Install a "raw" data property for {raw_object} on {template_object}.
+  PropertyDescriptor raw_desc;
+  raw_desc.set_value(raw_object);
+  raw_desc.set_configurable(false);
+  raw_desc.set_enumerable(false);
+  raw_desc.set_writable(false);
+  JSArray::DefineOwnProperty(isolate, template_object,
+                             isolate->factory()->raw_string(), &raw_desc,
+                             kThrowOnError)
+      .ToChecked();
+
+  // Freeze the {template_object} as well.
+  JSObject::SetIntegrityLevel(template_object, FROZEN, kThrowOnError)
+      .ToChecked();
 
   return template_object;
 }
 
-// static
-bool TemplateMapShape::IsMatch(TemplateObjectDescription* key, Object* value) {
-  return key->Equals(TemplateObjectDescription::cast(value));
-}
-
-// static
-uint32_t TemplateMapShape::Hash(Isolate* isolate,
-                                TemplateObjectDescription* key) {
-  return key->hash();
-}
-
-// static
-uint32_t TemplateMapShape::HashForObject(Isolate* isolate, Object* object) {
-  return Hash(isolate, TemplateObjectDescription::cast(object));
-}
-
-// static
-Handle<TemplateMap> TemplateMap::New(Isolate* isolate) {
-  return HashTable::New(isolate, 0);
-}
-
-// static
-MaybeHandle<JSArray> TemplateMap::Lookup(
-    Handle<TemplateMap> template_map, Handle<TemplateObjectDescription> key) {
-  int const entry = template_map->FindEntry(*key);
-  if (entry == kNotFound) return MaybeHandle<JSArray>();
-  int const index = EntryToIndex(entry);
-  return handle(JSArray::cast(template_map->get(index + 1)));
-}
-
-// static
-Handle<TemplateMap> TemplateMap::Add(Handle<TemplateMap> template_map,
-                                     Handle<TemplateObjectDescription> key,
-                                     Handle<JSArray> value) {
-  DCHECK_EQ(kNotFound, template_map->FindEntry(*key));
-  template_map = EnsureCapacity(template_map, 1);
-  uint32_t const hash = ShapeT::Hash(key->GetIsolate(), *key);
-  int const entry = template_map->FindInsertionEntry(hash);
-  int const index = EntryToIndex(entry);
-  template_map->set(index + 0, *key);
-  template_map->set(index + 1, *value);
-  template_map->ElementAdded();
-  return template_map;
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/template-objects.h b/deps/v8/src/objects/template-objects.h
index cac29a3530a..6c1a99831a4 100644
--- a/deps/v8/src/objects/template-objects.h
+++ b/deps/v8/src/objects/template-objects.h
@@ -16,61 +16,25 @@ namespace internal {
 
 // TemplateObjectDescription is a triple of hash, raw strings and cooked
 // strings for tagged template literals. Used to communicate with the runtime
-// for template object creation within the {Runtime_GetTemplateObject} method.
-class TemplateObjectDescription final : public Tuple3 {
+// for template object creation within the {Runtime_CreateTemplateObject}
+// method.
+class TemplateObjectDescription final : public Tuple2 {
  public:
-  DECL_INT_ACCESSORS(hash)
   DECL_ACCESSORS(raw_strings, FixedArray)
   DECL_ACCESSORS(cooked_strings, FixedArray)
 
-  bool Equals(TemplateObjectDescription const* that) const;
-
-  static Handle<JSArray> GetTemplateObject(
-      Handle<TemplateObjectDescription> description,
-      Handle<Context> native_context);
+  static Handle<JSArray> CreateTemplateObject(
+      Handle<TemplateObjectDescription> description);
 
   DECL_CAST(TemplateObjectDescription)
 
-  static constexpr int kHashOffset = kValue1Offset;
-  static constexpr int kRawStringsOffset = kValue2Offset;
-  static constexpr int kCookedStringsOffset = kValue3Offset;
+  static constexpr int kRawStringsOffset = kValue1Offset;
+  static constexpr int kCookedStringsOffset = kValue2Offset;
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(TemplateObjectDescription);
 };
 
-class TemplateMapShape final : public BaseShape<TemplateObjectDescription*> {
- public:
-  static bool IsMatch(TemplateObjectDescription* key, Object* value);
-  static uint32_t Hash(Isolate* isolate, TemplateObjectDescription* key);
-  static uint32_t HashForObject(Isolate* isolate, Object* object);
-
-  static constexpr int kPrefixSize = 0;
-  static constexpr int kEntrySize = 2;
-};
-
-class TemplateMap final : public HashTable<TemplateMap, TemplateMapShape> {
- public:
-  static Handle<TemplateMap> New(Isolate* isolate);
-
-  // Tries to lookup the given {key} in the {template_map}. Returns the
-  // value if it's found, otherwise returns an empty MaybeHandle.
-  WARN_UNUSED_RESULT static MaybeHandle<JSArray> Lookup(
-      Handle<TemplateMap> template_map, Handle<TemplateObjectDescription> key);
-
-  // Adds the {key} / {value} pair to the {template_map} and returns the
-  // new TemplateMap (we might need to re-allocate). This assumes that
-  // there's no entry for {key} in the {template_map} already.
-  static Handle<TemplateMap> Add(Handle<TemplateMap> template_map,
-                                 Handle<TemplateObjectDescription> key,
-                                 Handle<JSArray> value);
-
-  DECL_CAST(TemplateMap)
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(TemplateMap);
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/parsing/OWNERS b/deps/v8/src/parsing/OWNERS
index fbbdd8b7158..24218df1997 100644
--- a/deps/v8/src/parsing/OWNERS
+++ b/deps/v8/src/parsing/OWNERS
@@ -5,7 +5,6 @@ gsathya@chromium.org
 littledan@chromium.org
 marja@chromium.org
 neis@chromium.org
-rossberg@chromium.org
 verwaest@chromium.org
 
 # COMPONENT: Blink>JavaScript>Parser
diff --git a/deps/v8/src/parsing/background-parsing-task.cc b/deps/v8/src/parsing/background-parsing-task.cc
deleted file mode 100644
index cb811566df6..00000000000
--- a/deps/v8/src/parsing/background-parsing-task.cc
+++ /dev/null
@@ -1,112 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/parsing/background-parsing-task.h"
-
-#include "src/counters.h"
-#include "src/objects-inl.h"
-#include "src/parsing/parser.h"
-#include "src/parsing/scanner-character-streams.h"
-#include "src/vm-state-inl.h"
-
-namespace v8 {
-namespace internal {
-
-void StreamedSource::Release() {
-  parser.reset();
-  info.reset();
-}
-
-BackgroundParsingTask::BackgroundParsingTask(
-    StreamedSource* source, ScriptCompiler::CompileOptions options,
-    int stack_size, Isolate* isolate)
-    : source_(source),
-      stack_size_(stack_size),
-      script_data_(nullptr),
-      timer_(isolate->counters()->compile_script_on_background()) {
-  // We don't set the context to the CompilationInfo yet, because the background
-  // thread cannot do anything with it anyway. We set it just before compilation
-  // on the foreground thread.
-  DCHECK(options == ScriptCompiler::kProduceParserCache ||
-         options == ScriptCompiler::kProduceCodeCache ||
-         options == ScriptCompiler::kProduceFullCodeCache ||
-         options == ScriptCompiler::kNoCompileOptions ||
-         options == ScriptCompiler::kEagerCompile);
-
-  VMState<PARSER> state(isolate);
-
-  // Prepare the data for the internalization phase and compilation phase, which
-  // will happen in the main thread after parsing.
-  ParseInfo* info = new ParseInfo(isolate->allocator());
-  info->InitFromIsolate(isolate);
-  if (V8_UNLIKELY(FLAG_runtime_stats)) {
-    info->set_runtime_call_stats(new (info->zone()) RuntimeCallStats());
-  } else {
-    info->set_runtime_call_stats(nullptr);
-  }
-  info->set_toplevel();
-  std::unique_ptr<Utf16CharacterStream> stream(
-      ScannerStream::For(source->source_stream.get(), source->encoding,
-                         info->runtime_call_stats()));
-  info->set_character_stream(std::move(stream));
-  info->set_unicode_cache(&source_->unicode_cache);
-  info->set_compile_options(options);
-  info->set_allow_lazy_parsing();
-  if (V8_UNLIKELY(info->block_coverage_enabled())) {
-    info->AllocateSourceRangeMap();
-  }
-  info->set_cached_data(&script_data_);
-  LanguageMode language_mode = construct_language_mode(FLAG_use_strict);
-  info->set_language_mode(
-      stricter_language_mode(info->language_mode(), language_mode));
-
-  source->info.reset(info);
-  allocator_ = isolate->allocator();
-
-  // Parser needs to stay alive for finalizing the parsing on the main
-  // thread.
-  source_->parser.reset(new Parser(source_->info.get()));
-  source_->parser->DeserializeScopeChain(source_->info.get(),
-                                         MaybeHandle<ScopeInfo>());
-}
-
-void BackgroundParsingTask::Run() {
-  TimedHistogramScope timer(timer_);
-  DisallowHeapAllocation no_allocation;
-  DisallowHandleAllocation no_handles;
-  DisallowHandleDereference no_deref;
-
-  source_->info->set_on_background_thread(true);
-
-  // Reset the stack limit of the parser to reflect correctly that we're on a
-  // background thread.
-  uintptr_t old_stack_limit = source_->info->stack_limit();
-  uintptr_t stack_limit = GetCurrentStackPosition() - stack_size_ * KB;
-  source_->info->set_stack_limit(stack_limit);
-  source_->parser->set_stack_limit(stack_limit);
-
-  source_->parser->ParseOnBackground(source_->info.get());
-  if (FLAG_background_compile && source_->info->literal() != nullptr) {
-    // Parsing has succeeded, compile.
-    source_->outer_function_job = Compiler::CompileTopLevelOnBackgroundThread(
-        source_->info.get(), allocator_, &source_->inner_function_jobs);
-  }
-
-  if (script_data_ != nullptr) {
-    source_->cached_data.reset(new ScriptCompiler::CachedData(
-        script_data_->data(), script_data_->length(),
-        ScriptCompiler::CachedData::BufferOwned));
-    script_data_->ReleaseDataOwnership();
-    delete script_data_;
-    script_data_ = nullptr;
-  }
-
-  source_->info->EmitBackgroundParseStatisticsOnBackgroundThread();
-
-  source_->info->set_on_background_thread(false);
-  source_->info->set_stack_limit(old_stack_limit);
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/parsing/background-parsing-task.h b/deps/v8/src/parsing/background-parsing-task.h
deleted file mode 100644
index eb3ed61e2ee..00000000000
--- a/deps/v8/src/parsing/background-parsing-task.h
+++ /dev/null
@@ -1,74 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_PARSING_BACKGROUND_PARSING_TASK_H_
-#define V8_PARSING_BACKGROUND_PARSING_TASK_H_
-
-#include <memory>
-
-#include "include/v8.h"
-#include "src/base/platform/platform.h"
-#include "src/base/platform/semaphore.h"
-#include "src/compiler.h"
-#include "src/parsing/parse-info.h"
-#include "src/unicode-cache.h"
-
-namespace v8 {
-namespace internal {
-
-class Parser;
-class ScriptData;
-class TimedHistogram;
-
-// Internal representation of v8::ScriptCompiler::StreamedSource. Contains all
-// data which needs to be transmitted between threads for background parsing,
-// finalizing it on the main thread, and compiling on the main thread.
-struct StreamedSource {
-  StreamedSource(ScriptCompiler::ExternalSourceStream* source_stream,
-                 ScriptCompiler::StreamedSource::Encoding encoding)
-      : source_stream(source_stream), encoding(encoding) {}
-
-  void Release();
-
-  // Internal implementation of v8::ScriptCompiler::StreamedSource.
-  std::unique_ptr<ScriptCompiler::ExternalSourceStream> source_stream;
-  ScriptCompiler::StreamedSource::Encoding encoding;
-  std::unique_ptr<ScriptCompiler::CachedData> cached_data;
-
-  // Data needed for parsing, and data needed to to be passed between thread
-  // between parsing and compilation. These need to be initialized before the
-  // compilation starts.
-  UnicodeCache unicode_cache;
-  std::unique_ptr<ParseInfo> info;
-  std::unique_ptr<Parser> parser;
-
-  // Data needed for finalizing compilation after background compilation.
-  std::unique_ptr<CompilationJob> outer_function_job;
-  CompilationJobList inner_function_jobs;
-
-  // Prevent copying.
-  StreamedSource(const StreamedSource&) = delete;
-  StreamedSource& operator=(const StreamedSource&) = delete;
-};
-
-class BackgroundParsingTask : public ScriptCompiler::ScriptStreamingTask {
- public:
-  BackgroundParsingTask(StreamedSource* source,
-                        ScriptCompiler::CompileOptions options, int stack_size,
-                        Isolate* isolate);
-
-  virtual void Run();
-
- private:
-  StreamedSource* source_;  // Not owned.
-  int stack_size_;
-  ScriptData* script_data_;
-  AccountingAllocator* allocator_;
-  TimedHistogram* timer_;
-};
-
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_PARSING_BACKGROUND_PARSING_TASK_H_
diff --git a/deps/v8/src/parsing/expression-classifier.h b/deps/v8/src/parsing/expression-classifier.h
index 709d5736b50..522b650be73 100644
--- a/deps/v8/src/parsing/expression-classifier.h
+++ b/deps/v8/src/parsing/expression-classifier.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_PARSING_EXPRESSION_CLASSIFIER_H
-#define V8_PARSING_EXPRESSION_CLASSIFIER_H
+#ifndef V8_PARSING_EXPRESSION_CLASSIFIER_H_
+#define V8_PARSING_EXPRESSION_CLASSIFIER_H_
 
 #include "src/messages.h"
 #include "src/parsing/scanner.h"
@@ -433,4 +433,4 @@ class ExpressionClassifier {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_PARSING_EXPRESSION_CLASSIFIER_H
+#endif  // V8_PARSING_EXPRESSION_CLASSIFIER_H_
diff --git a/deps/v8/src/parsing/parse-info.cc b/deps/v8/src/parsing/parse-info.cc
index b8f191dd5a1..a2c0ddd4e21 100644
--- a/deps/v8/src/parsing/parse-info.cc
+++ b/deps/v8/src/parsing/parse-info.cc
@@ -20,19 +20,17 @@ ParseInfo::ParseInfo(AccountingAllocator* zone_allocator)
     : zone_(std::make_shared<Zone>(zone_allocator, ZONE_NAME)),
       flags_(0),
       extension_(nullptr),
-      compile_options_(ScriptCompiler::kNoCompileOptions),
       script_scope_(nullptr),
       unicode_cache_(nullptr),
       stack_limit_(0),
       hash_seed_(0),
-      compiler_hints_(0),
+      function_flags_(0),
       start_position_(0),
       end_position_(0),
       parameters_end_pos_(kNoSourcePosition),
       function_literal_id_(FunctionLiteral::kIdTypeInvalid),
       max_function_literal_id_(FunctionLiteral::kIdTypeInvalid),
       character_stream_(nullptr),
-      cached_data_(nullptr),
       ast_value_factory_(nullptr),
       ast_string_constants_(nullptr),
       function_name_(nullptr),
@@ -54,9 +52,9 @@ ParseInfo::ParseInfo(Handle<SharedFunctionInfo> shared)
   set_wrapped_as_function(shared->is_wrapped());
   set_allow_lazy_parsing(FLAG_lazy_inner_functions);
   set_is_named_expression(shared->is_named_expression());
-  set_compiler_hints(shared->compiler_hints());
-  set_start_position(shared->start_position());
-  set_end_position(shared->end_position());
+  set_function_flags(shared->flags());
+  set_start_position(shared->StartPosition());
+  set_end_position(shared->EndPosition());
   function_literal_id_ = shared->function_literal_id();
   set_language_mode(shared->language_mode());
   set_asm_wasm_broken(shared->is_asm_wasm_broken());
@@ -79,7 +77,7 @@ ParseInfo::ParseInfo(Handle<SharedFunctionInfo> shared)
   // has the appropriate slots.
   set_collect_type_profile(
       isolate->is_collecting_type_profile() &&
-      (shared->feedback_metadata()->length() == 0
+      (shared->feedback_metadata()->is_empty()
            ? script->IsUserJavaScript()
            : shared->feedback_metadata()->HasTypeProfileSlot()));
   if (block_coverage_enabled() && script->IsUserJavaScript()) {
@@ -119,9 +117,9 @@ ParseInfo* ParseInfo::AllocateWithoutScript(Handle<SharedFunctionInfo> shared) {
   p->set_toplevel(shared->is_toplevel());
   p->set_allow_lazy_parsing(FLAG_lazy_inner_functions);
   p->set_is_named_expression(shared->is_named_expression());
-  p->set_compiler_hints(shared->compiler_hints());
-  p->set_start_position(shared->start_position());
-  p->set_end_position(shared->end_position());
+  p->set_function_flags(shared->flags());
+  p->set_start_position(shared->StartPosition());
+  p->set_end_position(shared->EndPosition());
   p->function_literal_id_ = shared->function_literal_id();
   p->set_language_mode(shared->language_mode());
 
@@ -149,16 +147,16 @@ ParseInfo* ParseInfo::AllocateWithoutScript(Handle<SharedFunctionInfo> shared) {
 DeclarationScope* ParseInfo::scope() const { return literal()->scope(); }
 
 bool ParseInfo::is_declaration() const {
-  return SharedFunctionInfo::IsDeclarationBit::decode(compiler_hints_);
+  return SharedFunctionInfo::IsDeclarationBit::decode(function_flags_);
 }
 
 FunctionKind ParseInfo::function_kind() const {
-  return SharedFunctionInfo::FunctionKindBits::decode(compiler_hints_);
+  return SharedFunctionInfo::FunctionKindBits::decode(function_flags_);
 }
 
 bool ParseInfo::requires_instance_fields_initializer() const {
   return SharedFunctionInfo::RequiresInstanceFieldsInitializer::decode(
-      compiler_hints_);
+      function_flags_);
 }
 
 void ParseInfo::InitFromIsolate(Isolate* isolate) {
diff --git a/deps/v8/src/parsing/parse-info.h b/deps/v8/src/parsing/parse-info.h
index e93c7137ca9..08f15c865c9 100644
--- a/deps/v8/src/parsing/parse-info.h
+++ b/deps/v8/src/parsing/parse-info.h
@@ -29,7 +29,6 @@ class DeclarationScope;
 class FunctionLiteral;
 class RuntimeCallStats;
 class Logger;
-class ScriptData;
 class SourceRangeMap;
 class UnicodeCache;
 class Utf16CharacterStream;
@@ -85,6 +84,7 @@ class V8_EXPORT_PRIVATE ParseInfo {
                 set_on_background_thread)
   FLAG_ACCESSOR(kWrappedAsFunction, is_wrapped_as_function,
                 set_wrapped_as_function)
+  FLAG_ACCESSOR(kAllowEvalCache, allow_eval_cache, set_allow_eval_cache)
 #undef FLAG_ACCESSOR
 
   void set_parse_restriction(ParseRestriction restriction) {
@@ -106,20 +106,11 @@ class V8_EXPORT_PRIVATE ParseInfo {
   v8::Extension* extension() const { return extension_; }
   void set_extension(v8::Extension* extension) { extension_ = extension; }
 
-  ScriptData** cached_data() const { return cached_data_; }
-  void set_cached_data(ScriptData** cached_data) { cached_data_ = cached_data; }
 
   ConsumedPreParsedScopeData* consumed_preparsed_scope_data() {
     return &consumed_preparsed_scope_data_;
   }
 
-  ScriptCompiler::CompileOptions compile_options() const {
-    return compile_options_;
-  }
-  void set_compile_options(ScriptCompiler::CompileOptions compile_options) {
-    compile_options_ = compile_options;
-  }
-
   DeclarationScope* script_scope() const { return script_scope_; }
   void set_script_scope(DeclarationScope* script_scope) {
     script_scope_ = script_scope;
@@ -151,9 +142,9 @@ class V8_EXPORT_PRIVATE ParseInfo {
   uint32_t hash_seed() const { return hash_seed_; }
   void set_hash_seed(uint32_t hash_seed) { hash_seed_ = hash_seed; }
 
-  int compiler_hints() const { return compiler_hints_; }
-  void set_compiler_hints(int compiler_hints) {
-    compiler_hints_ = compiler_hints;
+  int function_flags() const { return function_flags_; }
+  void set_function_flags(int function_flags) {
+    function_flags_ = function_flags;
   }
 
   int start_position() const { return start_position_; }
@@ -204,7 +195,7 @@ class V8_EXPORT_PRIVATE ParseInfo {
     return &pending_error_handler_;
   }
 
-  // Getters for individual compiler hints.
+  // Getters for individual function flags.
   bool is_declaration() const;
   FunctionKind function_kind() const;
   bool requires_instance_fields_initializer() const;
@@ -263,18 +254,20 @@ class V8_EXPORT_PRIVATE ParseInfo {
     kIsAsmWasmBroken = 1 << 12,
     kOnBackgroundThread = 1 << 13,
     kWrappedAsFunction = 1 << 14,  // Implicitly wrapped as function.
+    kAllowEvalCache = 1 << 15,
   };
 
   //------------- Inputs to parsing and scope analysis -----------------------
   std::shared_ptr<Zone> zone_;
   unsigned flags_;
   v8::Extension* extension_;
-  ScriptCompiler::CompileOptions compile_options_;
   DeclarationScope* script_scope_;
   UnicodeCache* unicode_cache_;
   uintptr_t stack_limit_;
   uint32_t hash_seed_;
-  int compiler_hints_;
+  // TODO(leszeks): Move any remaining flags used here either to the flags_
+  // field or to other fields.
+  int function_flags_;
   int start_position_;
   int end_position_;
   int parameters_end_pos_;
@@ -287,7 +280,6 @@ class V8_EXPORT_PRIVATE ParseInfo {
 
   //----------- Inputs+Outputs of parsing and scope analysis -----------------
   std::unique_ptr<Utf16CharacterStream> character_stream_;
-  ScriptData** cached_data_;  // used if available, populated if requested.
   ConsumedPreParsedScopeData consumed_preparsed_scope_data_;
   std::shared_ptr<AstValueFactory> ast_value_factory_;
   const class AstStringConstants* ast_string_constants_;
diff --git a/deps/v8/src/parsing/parser-base.h b/deps/v8/src/parsing/parser-base.h
index faefe44011e..1a6df330836 100644
--- a/deps/v8/src/parsing/parser-base.h
+++ b/deps/v8/src/parsing/parser-base.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_PARSING_PARSER_BASE_H
-#define V8_PARSING_PARSER_BASE_H
+#ifndef V8_PARSING_PARSER_BASE_H_
+#define V8_PARSING_PARSER_BASE_H_
 
 #include <vector>
 
@@ -12,6 +12,7 @@
 #include "src/ast/scopes.h"
 #include "src/bailout-reason.h"
 #include "src/base/hashmap.h"
+#include "src/base/v8-fallthrough.h"
 #include "src/counters.h"
 #include "src/globals.h"
 #include "src/log.h"
@@ -277,13 +278,13 @@ class ParserBase {
         script_id_(script_id),
         allow_natives_(false),
         allow_harmony_do_expressions_(false),
-        allow_harmony_function_sent_(false),
         allow_harmony_public_fields_(false),
         allow_harmony_static_fields_(false),
         allow_harmony_dynamic_import_(false),
         allow_harmony_import_meta_(false),
         allow_harmony_optional_catch_binding_(false),
-        allow_harmony_private_fields_(false) {}
+        allow_harmony_private_fields_(false),
+        allow_eval_cache_(true) {}
 
 #define ALLOW_ACCESSORS(name)                           \
   bool allow_##name() const { return allow_##name##_; } \
@@ -291,12 +292,12 @@ class ParserBase {
 
   ALLOW_ACCESSORS(natives);
   ALLOW_ACCESSORS(harmony_do_expressions);
-  ALLOW_ACCESSORS(harmony_function_sent);
   ALLOW_ACCESSORS(harmony_public_fields);
   ALLOW_ACCESSORS(harmony_static_fields);
   ALLOW_ACCESSORS(harmony_dynamic_import);
   ALLOW_ACCESSORS(harmony_import_meta);
   ALLOW_ACCESSORS(harmony_optional_catch_binding);
+  ALLOW_ACCESSORS(eval_cache);
 
 #undef ALLOW_ACCESSORS
 
@@ -306,6 +307,12 @@ class ParserBase {
   void set_allow_harmony_bigint(bool allow) {
     scanner()->set_allow_harmony_bigint(allow);
   }
+  bool allow_harmony_numeric_separator() const {
+    return scanner()->allow_harmony_numeric_separator();
+  }
+  void set_allow_harmony_numeric_separator(bool allow) {
+    scanner()->set_allow_harmony_numeric_separator(allow);
+  }
 
   bool allow_harmony_private_fields() const {
     return scanner()->allow_harmony_private_fields();
@@ -398,6 +405,9 @@ class ParserBase {
     }
     BailoutReason dont_optimize_reason() { return dont_optimize_reason_; }
 
+    void AddSuspend() { suspend_count_++; }
+    int suspend_count() const { return suspend_count_; }
+
     FunctionKind kind() const { return scope()->function_kind(); }
 
     void RewindDestructuringAssignments(int pos) {
@@ -425,10 +435,6 @@ class ParserBase {
       return &reported_errors_;
     }
 
-    ZoneList<RewritableExpressionT>* non_patterns_to_rewrite() {
-      return &non_patterns_to_rewrite_;
-    }
-
     bool next_function_is_likely_called() const {
       return next_function_is_likely_called_;
     }
@@ -478,13 +484,15 @@ class ParserBase {
     DeclarationScope* scope_;
 
     ZoneList<RewritableExpressionT> destructuring_assignments_to_rewrite_;
-    ZoneList<RewritableExpressionT> non_patterns_to_rewrite_;
 
     ZoneList<typename ExpressionClassifier::Error> reported_errors_;
 
     // A reason, if any, why this function should not be optimized.
     BailoutReason dont_optimize_reason_;
 
+    // How many suspends are needed for this function.
+    int suspend_count_;
+
     // Record whether the next (=== immediately following) function literal is
     // preceded by a parenthesis / exclamation mark. Also record the previous
     // state.
@@ -1084,6 +1092,8 @@ class ParserBase {
 
   IdentifierT ParseIdentifierName(bool* ok);
 
+  ExpressionT ParseIdentifierNameOrPrivateName(bool* ok);
+
   ExpressionT ParseRegExpLiteral(bool* ok);
 
   ExpressionT ParsePrimaryExpression(bool* is_async, bool* ok);
@@ -1124,10 +1134,10 @@ class ParserBase {
                                 bool* ok);
   ExpressionT ParseObjectLiteral(bool* ok);
   ClassLiteralPropertyT ParseClassPropertyDefinition(
-      ClassLiteralChecker* checker, ClassInfo* class_info, bool has_extends,
-      bool* is_computed_name, bool* has_seen_constructor,
-      ClassLiteralProperty::Kind* property_kind, bool* is_static,
-      bool* has_name_static_property, bool* ok);
+      ClassLiteralChecker* checker, ClassInfo* class_info,
+      IdentifierT* property_name, bool has_extends, bool* is_computed_name,
+      bool* has_seen_constructor, ClassLiteralProperty::Kind* property_kind,
+      bool* is_static, bool* has_name_static_property, bool* ok);
   ExpressionT ParseClassFieldInitializer(ClassInfo* class_info, bool is_static,
                                          bool* ok);
   ObjectLiteralPropertyT ParseObjectPropertyDefinition(
@@ -1407,6 +1417,7 @@ class ParserBase {
       // In async generators, if there is an explicit operand to the return
       // statement, await the operand.
       expr = factory()->NewAwait(expr, kNoSourcePosition);
+      function_state_->AddSuspend();
     }
     if (is_async_function()) {
       return factory()->NewAsyncReturnStatement(expr, pos, end_pos);
@@ -1451,6 +1462,10 @@ class ParserBase {
       return this->scanner()->CurrentMatchesContextualEscaped(
           Token::CONSTRUCTOR);
     }
+    bool IsPrivateConstructor() {
+      return this->scanner()->CurrentMatchesContextualEscaped(
+          Token::PRIVATE_CONSTRUCTOR);
+    }
     bool IsPrototype() {
       return this->scanner()->CurrentMatchesContextualEscaped(Token::PROTOTYPE);
     }
@@ -1542,13 +1557,13 @@ class ParserBase {
 
   bool allow_natives_;
   bool allow_harmony_do_expressions_;
-  bool allow_harmony_function_sent_;
   bool allow_harmony_public_fields_;
   bool allow_harmony_static_fields_;
   bool allow_harmony_dynamic_import_;
   bool allow_harmony_import_meta_;
   bool allow_harmony_optional_catch_binding_;
   bool allow_harmony_private_fields_;
+  bool allow_eval_cache_;
 
   friend class DiscardableZoneScope;
 };
@@ -1563,9 +1578,9 @@ ParserBase<Impl>::FunctionState::FunctionState(
       outer_function_state_(*function_state_stack),
       scope_(scope),
       destructuring_assignments_to_rewrite_(16, scope->zone()),
-      non_patterns_to_rewrite_(0, scope->zone()),
       reported_errors_(16, scope->zone()),
       dont_optimize_reason_(BailoutReason::kNoReason),
+      suspend_count_(0),
       next_function_is_likely_called_(false),
       previous_function_was_likely_called_(false),
       contains_function_or_eval_(false) {
@@ -1777,6 +1792,27 @@ typename ParserBase<Impl>::IdentifierT ParserBase<Impl>::ParseIdentifierName(
   return impl()->GetSymbol();
 }
 
+template <typename Impl>
+typename ParserBase<Impl>::ExpressionT
+ParserBase<Impl>::ParseIdentifierNameOrPrivateName(bool* ok) {
+  int pos = position();
+  IdentifierT name;
+  ExpressionT key;
+  if (allow_harmony_private_fields() && peek() == Token::PRIVATE_NAME) {
+    Consume(Token::PRIVATE_NAME);
+    name = impl()->GetSymbol();
+    auto key_proxy =
+        impl()->ExpressionFromIdentifier(name, pos, InferName::kNo);
+    key_proxy->set_is_private_field();
+    key = key_proxy;
+  } else {
+    name = ParseIdentifierName(CHECK_OK);
+    key = factory()->NewStringLiteral(name, pos);
+  }
+  impl()->PushLiteralName(name);
+  return key;
+}
+
 template <typename Impl>
 typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseRegExpLiteral(
     bool* ok) {
@@ -1847,7 +1883,7 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParsePrimaryExpression(
       }
       // CoverCallExpressionAndAsyncArrowHead
       *is_async = true;
-    /* falls through */
+      V8_FALLTHROUGH;
     case Token::IDENTIFIER:
     case Token::LET:
     case Token::STATIC:
@@ -2237,7 +2273,7 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParsePropertyName(
         }
         return expression;
       }
-    // Fall-through.
+      V8_FALLTHROUGH;
 
     default:
       *name = ParseIdentifierName(CHECK_OK);
@@ -2263,8 +2299,8 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParsePropertyName(
 template <typename Impl>
 typename ParserBase<Impl>::ClassLiteralPropertyT
 ParserBase<Impl>::ParseClassPropertyDefinition(
-    ClassLiteralChecker* checker, ClassInfo* class_info, bool has_extends,
-    bool* is_computed_name, bool* has_seen_constructor,
+    ClassLiteralChecker* checker, ClassInfo* class_info, IdentifierT* name,
+    bool has_extends, bool* is_computed_name, bool* has_seen_constructor,
     ClassLiteralProperty::Kind* property_kind, bool* is_static,
     bool* has_name_static_property, bool* ok) {
   DCHECK_NOT_NULL(has_seen_constructor);
@@ -2282,19 +2318,19 @@ ParserBase<Impl>::ParseClassPropertyDefinition(
                  allow_harmony_private_fields());
 
   int name_token_position = scanner()->peek_location().beg_pos;
-  IdentifierT name = impl()->NullIdentifier();
+  *name = impl()->NullIdentifier();
   ExpressionT name_expression;
   if (name_token == Token::STATIC) {
     Consume(Token::STATIC);
     name_token_position = scanner()->peek_location().beg_pos;
     if (peek() == Token::LPAREN) {
       kind = PropertyKind::kMethodProperty;
-      name = impl()->GetSymbol();  // TODO(bakkot) specialize on 'static'
-      name_expression = factory()->NewStringLiteral(name, position());
+      *name = impl()->GetSymbol();  // TODO(bakkot) specialize on 'static'
+      name_expression = factory()->NewStringLiteral(*name, position());
     } else if (peek() == Token::ASSIGN || peek() == Token::SEMICOLON ||
                peek() == Token::RBRACE) {
-      name = impl()->GetSymbol();  // TODO(bakkot) specialize on 'static'
-      name_expression = factory()->NewStringLiteral(name, position());
+      *name = impl()->GetSymbol();  // TODO(bakkot) specialize on 'static'
+      name_expression = factory()->NewStringLiteral(*name, position());
     } else if (peek() == Token::PRIVATE_NAME) {
       DCHECK(allow_harmony_private_fields());
       // TODO(gsathya): Make a better error message for this.
@@ -2303,21 +2339,21 @@ ParserBase<Impl>::ParseClassPropertyDefinition(
       return impl()->NullLiteralProperty();
     } else {
       *is_static = true;
-      name_expression = ParsePropertyName(&name, &kind, &is_generator, &is_get,
+      name_expression = ParsePropertyName(name, &kind, &is_generator, &is_get,
                                           &is_set, &is_async, is_computed_name,
                                           CHECK_OK_CUSTOM(NullLiteralProperty));
     }
   } else if (name_token == Token::PRIVATE_NAME) {
     Consume(Token::PRIVATE_NAME);
-    name = impl()->GetSymbol();
-    name_expression = factory()->NewStringLiteral(name, position());
+    *name = impl()->GetSymbol();
+    name_expression = factory()->NewStringLiteral(*name, position());
   } else {
-    name_expression = ParsePropertyName(&name, &kind, &is_generator, &is_get,
+    name_expression = ParsePropertyName(name, &kind, &is_generator, &is_get,
                                         &is_set, &is_async, is_computed_name,
                                         CHECK_OK_CUSTOM(NullLiteralProperty));
   }
 
-  if (!*has_name_static_property && *is_static && impl()->IsName(name)) {
+  if (!*has_name_static_property && *is_static && impl()->IsName(*name)) {
     *has_name_static_property = true;
   }
 
@@ -2333,13 +2369,15 @@ ParserBase<Impl>::ParseClassPropertyDefinition(
     case PropertyKind::kShorthandProperty:
     case PropertyKind::kValueProperty:
       if (allow_harmony_public_fields() || allow_harmony_private_fields()) {
-        *property_kind = ClassLiteralProperty::FIELD;
+        *property_kind = name_token == Token::PRIVATE_NAME
+                             ? ClassLiteralProperty::PRIVATE_FIELD
+                             : ClassLiteralProperty::PUBLIC_FIELD;
         if (*is_static && !allow_harmony_static_fields()) {
           ReportUnexpectedToken(Next());
           *ok = false;
           return impl()->NullLiteralProperty();
         }
-        if (!*is_computed_name && name_token != Token::PRIVATE_NAME) {
+        if (!*is_computed_name) {
           checker->CheckClassFieldName(*is_static,
                                        CHECK_OK_CUSTOM(NullLiteralProperty));
         }
@@ -2349,7 +2387,7 @@ ParserBase<Impl>::ParseClassPropertyDefinition(
         ClassLiteralPropertyT result = factory()->NewClassLiteralProperty(
             name_expression, initializer, *property_kind, *is_static,
             *is_computed_name);
-        impl()->SetFunctionNameFromPropertyName(result, name);
+        impl()->SetFunctionNameFromPropertyName(result, *name);
         return result;
 
       } else {
@@ -2377,14 +2415,14 @@ ParserBase<Impl>::ParseClassPropertyDefinition(
 
       FunctionKind kind = MethodKindFor(is_generator, is_async);
 
-      if (!*is_static && impl()->IsConstructor(name)) {
+      if (!*is_static && impl()->IsConstructor(*name)) {
         *has_seen_constructor = true;
         kind = has_extends ? FunctionKind::kDerivedConstructor
                            : FunctionKind::kBaseConstructor;
       }
 
       ExpressionT value = impl()->ParseFunctionLiteral(
-          name, scanner()->location(), kSkipFunctionNameCheck, kind,
+          *name, scanner()->location(), kSkipFunctionNameCheck, kind,
           FLAG_harmony_function_tostring ? name_token_position
                                          : kNoSourcePosition,
           FunctionLiteral::kAccessorOrMethod, language_mode(), nullptr,
@@ -2394,7 +2432,7 @@ ParserBase<Impl>::ParseClassPropertyDefinition(
       ClassLiteralPropertyT result = factory()->NewClassLiteralProperty(
           name_expression, value, *property_kind, *is_static,
           *is_computed_name);
-      impl()->SetFunctionNameFromPropertyName(result, name);
+      impl()->SetFunctionNameFromPropertyName(result, *name);
       return result;
     }
 
@@ -2409,14 +2447,14 @@ ParserBase<Impl>::ParseClassPropertyDefinition(
         // Runtime_DefineAccessorPropertyUnchecked and since we can determine
         // this statically we can skip the extra runtime check.
         name_expression =
-            factory()->NewStringLiteral(name, name_expression->position());
+            factory()->NewStringLiteral(*name, name_expression->position());
       }
 
       FunctionKind kind = is_get ? FunctionKind::kGetterFunction
                                  : FunctionKind::kSetterFunction;
 
       FunctionLiteralT value = impl()->ParseFunctionLiteral(
-          name, scanner()->location(), kSkipFunctionNameCheck, kind,
+          *name, scanner()->location(), kSkipFunctionNameCheck, kind,
           FLAG_harmony_function_tostring ? name_token_position
                                          : kNoSourcePosition,
           FunctionLiteral::kAccessorOrMethod, language_mode(), nullptr,
@@ -2430,7 +2468,7 @@ ParserBase<Impl>::ParseClassPropertyDefinition(
       const AstRawString* prefix =
           is_get ? ast_value_factory()->get_space_string()
                  : ast_value_factory()->set_space_string();
-      impl()->SetFunctionNameFromPropertyName(result, name, prefix);
+      impl()->SetFunctionNameFromPropertyName(result, *name, prefix);
       return result;
     }
     case PropertyKind::kSpreadProperty:
@@ -3035,6 +3073,7 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseYieldExpression(
         // a regular yield, given only one look-ahead token.
         if (!delegating) break;
         // Delegating yields require an RHS; fall through.
+        V8_FALLTHROUGH;
       default:
         expression = ParseAssignmentExpression(accept_IN, CHECK_OK);
         ValidateExpression(CHECK_OK);
@@ -3045,6 +3084,12 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseYieldExpression(
   if (delegating) {
     ExpressionT yieldstar = factory()->NewYieldStar(expression, pos);
     impl()->RecordSuspendSourceRange(yieldstar, PositionAfterSemicolon());
+    function_state_->AddSuspend();
+    if (IsAsyncGeneratorFunction(function_state_->kind())) {
+      // iterator_close and delegated_iterator_output suspend ids.
+      function_state_->AddSuspend();
+      function_state_->AddSuspend();
+    }
     return yieldstar;
   }
 
@@ -3053,6 +3098,7 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseYieldExpression(
   ExpressionT yield =
       factory()->NewYield(expression, pos, Suspend::kOnExceptionThrow);
   impl()->RecordSuspendSourceRange(yield, PositionAfterSemicolon());
+  function_state_->AddSuspend();
   return yield;
 }
 
@@ -3191,13 +3237,19 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseUnaryExpression(
     ExpressionT expression = ParseUnaryExpression(CHECK_OK);
     ValidateExpression(CHECK_OK);
 
-    if (op == Token::DELETE && is_strict(language_mode())) {
-      if (impl()->IsIdentifier(expression)) {
+    if (op == Token::DELETE) {
+      if (impl()->IsIdentifier(expression) && is_strict(language_mode())) {
         // "delete identifier" is a syntax error in strict mode.
         ReportMessage(MessageTemplate::kStrictDelete);
         *ok = false;
         return impl()->NullExpression();
       }
+
+      if (impl()->IsPropertyWithPrivateFieldKey(expression)) {
+        ReportMessage(MessageTemplate::kDeletePrivateField);
+        *ok = false;
+        return impl()->NullExpression();
+      }
     }
 
     if (peek() == Token::EXP) {
@@ -3239,6 +3291,7 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseUnaryExpression(
         MessageTemplate::kInvalidDestructuringTarget);
 
     ExpressionT expr = factory()->NewAwait(value, await_pos);
+    function_state_->AddSuspend();
     impl()->RecordSuspendSourceRange(expr, PositionAfterSemicolon());
     return expr;
   } else {
@@ -3399,10 +3452,8 @@ ParserBase<Impl>::ParseLeftHandSideExpression(bool* ok) {
         ArrowFormalParametersUnexpectedToken();
         Consume(Token::PERIOD);
         int pos = position();
-        IdentifierT name = ParseIdentifierName(CHECK_OK);
-        result = factory()->NewProperty(
-            result, factory()->NewStringLiteral(name, pos), pos);
-        impl()->PushLiteralName(name);
+        ExpressionT key = ParseIdentifierNameOrPrivateName(CHECK_OK);
+        result = factory()->NewProperty(result, key, pos);
         break;
       }
 
@@ -3513,22 +3564,6 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseMemberExpression(
     Consume(Token::FUNCTION);
     int function_token_position = position();
 
-    if (allow_harmony_function_sent() && peek() == Token::PERIOD) {
-      // function.sent
-      int pos = position();
-      ExpectMetaProperty(Token::SENT, "function.sent", pos, CHECK_OK);
-
-      if (!is_generator()) {
-        // TODO(neis): allow escaping into closures?
-        impl()->ReportMessageAt(scanner()->location(),
-                                MessageTemplate::kUnexpectedFunctionSent);
-        *ok = false;
-        return impl()->NullExpression();
-      }
-
-      return impl()->FunctionSentExpression(pos);
-    }
-
     FunctionKind function_kind = Check(Token::MUL)
                                      ? FunctionKind::kGeneratorFunction
                                      : FunctionKind::kNormalFunction;
@@ -3699,16 +3734,8 @@ ParserBase<Impl>::ParseMemberExpressionContinuation(ExpressionT expression,
 
         Consume(Token::PERIOD);
         int pos = peek_position();
-        IdentifierT name;
-        if (allow_harmony_private_fields() && peek() == Token::PRIVATE_NAME) {
-          Consume(Token::PRIVATE_NAME);
-          name = impl()->GetSymbol();
-        } else {
-          name = ParseIdentifierName(CHECK_OK);
-        }
-        expression = factory()->NewProperty(
-            expression, factory()->NewStringLiteral(name, pos), pos);
-        impl()->PushLiteralName(name);
+        ExpressionT key = ParseIdentifierNameOrPrivateName(CHECK_OK);
+        expression = factory()->NewProperty(expression, key, pos);
         break;
       }
       case Token::TEMPLATE_SPAN:
@@ -4354,6 +4381,7 @@ ParserBase<Impl>::ParseArrowFunctionLiteral(
 
   StatementListT body = impl()->NullStatementList();
   int expected_property_count = -1;
+  int suspend_count = 0;
   int function_literal_id = GetNextFunctionLiteralId();
 
   FunctionKind kind = formal_parameters.scope->function_kind();
@@ -4440,6 +4468,7 @@ ParserBase<Impl>::ParseArrowFunctionLiteral(
     impl()->CheckConflictingVarDeclarations(formal_parameters.scope, CHECK_OK);
 
     impl()->RewriteDestructuringAssignments();
+    suspend_count = function_state.suspend_count();
   }
 
   FunctionLiteralT function_literal = factory()->NewFunctionLiteral(
@@ -4451,6 +4480,7 @@ ParserBase<Impl>::ParseArrowFunctionLiteral(
       formal_parameters.scope->start_position(), has_braces,
       function_literal_id, produced_preparsed_scope_data);
 
+  function_literal->set_suspend_count(suspend_count);
   function_literal->set_function_token_position(
       formal_parameters.scope->start_position());
 
@@ -4522,27 +4552,29 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseClassLiteral(
     bool is_static;
     ClassLiteralProperty::Kind property_kind;
     ExpressionClassifier property_classifier(this);
+    IdentifierT property_name;
     // If we haven't seen the constructor yet, it potentially is the next
     // property.
     bool is_constructor = !class_info.has_seen_constructor;
     ClassLiteralPropertyT property = ParseClassPropertyDefinition(
-        &checker, &class_info, has_extends, &is_computed_name,
+        &checker, &class_info, &property_name, has_extends, &is_computed_name,
         &class_info.has_seen_constructor, &property_kind, &is_static,
         &class_info.has_name_static_property, CHECK_OK);
     if (!class_info.has_static_computed_names && is_static &&
         is_computed_name) {
       class_info.has_static_computed_names = true;
     }
-    if (is_computed_name && property_kind == ClassLiteralProperty::FIELD) {
+    if (is_computed_name &&
+        property_kind == ClassLiteralProperty::PUBLIC_FIELD) {
       class_info.computed_field_count++;
     }
     is_constructor &= class_info.has_seen_constructor;
     ValidateExpression(CHECK_OK);
     AccumulateFormalParameterContainmentErrors();
 
-    impl()->DeclareClassProperty(name, property, property_kind, is_static,
-                                 is_constructor, is_computed_name, &class_info,
-                                 CHECK_OK);
+    impl()->DeclareClassProperty(name, property, property_name, property_kind,
+                                 is_static, is_constructor, is_computed_name,
+                                 &class_info, CHECK_OK);
     impl()->InferFunctionName();
   }
 
@@ -4644,6 +4676,12 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseTemplateLiteral(
   // TEMPLATE_SPAN, or a TEMPLATE_TAIL.
   DCHECK(peek() == Token::TEMPLATE_SPAN || peek() == Token::TEMPLATE_TAIL);
 
+  if (tagged) {
+    // TaggedTemplate expressions prevent the eval compilation cache from being
+    // used. This flag is only used if an eval is being parsed.
+    set_allow_eval_cache(false);
+  }
+
   bool forbid_illegal_escapes = !tagged;
 
   // If we reach a TEMPLATE_TAIL first, we are parsing a NoSubstitutionTemplate.
@@ -4794,7 +4832,12 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseV8Intrinsic(
   ExpressionClassifier classifier(this);
   ExpressionListT args = ParseArguments(&spread_pos, CHECK_OK);
 
-  DCHECK(!spread_pos.IsValid());
+  if (spread_pos.IsValid()) {
+    *ok = false;
+    ReportMessageAt(spread_pos, MessageTemplate::kIntrinsicWithSpread,
+                    kSyntaxError);
+    return impl()->NullExpression();
+  }
 
   return impl()->NewV8Intrinsic(name, args, pos, ok);
 }
@@ -4943,7 +4986,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseStatementListItem(
         Consume(Token::ASYNC);
         return ParseAsyncFunctionDeclaration(nullptr, false, ok);
       }
-    /* falls through */
+      break;
     default:
       break;
   }
@@ -5044,7 +5087,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseStatement(
         *ok = false;
         return impl()->NullStatement();
       }
-    // Falls through
+      V8_FALLTHROUGH;
     default:
       return ParseExpressionOrLabelledStatement(labels, allow_function, ok);
   }
@@ -5653,6 +5696,14 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseTryStatement(
 template <typename Impl>
 typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseForStatement(
     ZoneList<const AstRawString*>* labels, bool* ok) {
+  // Either a standard for loop
+  //   for (<init>; <cond>; <next>) { ... }
+  // or a for-each loop
+  //   for (<each> of|in <iterable>) { ... }
+  //
+  // We parse a declaration/expression after the 'for (' and then read the first
+  // expression/declaration before we know if this is a for or a for-each.
+
   int stmt_pos = peek_position();
   ForInfo for_info(this);
 
@@ -6187,7 +6238,7 @@ void ParserBase<Impl>::ClassLiteralChecker::CheckClassFieldName(bool is_static,
     return;
   }
 
-  if (IsConstructor()) {
+  if (IsConstructor() || IsPrivateConstructor()) {
     this->parser()->ReportMessage(MessageTemplate::kConstructorClassField);
     *ok = false;
     return;
@@ -6201,4 +6252,4 @@ void ParserBase<Impl>::ClassLiteralChecker::CheckClassFieldName(bool is_static,
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_PARSING_PARSER_BASE_H
+#endif  // V8_PARSING_PARSER_BASE_H_
diff --git a/deps/v8/src/parsing/parser.cc b/deps/v8/src/parsing/parser.cc
index 0497958c82b..8b4d346f5a1 100644
--- a/deps/v8/src/parsing/parser.cc
+++ b/deps/v8/src/parsing/parser.cc
@@ -29,82 +29,8 @@
 namespace v8 {
 namespace internal {
 
-ScriptData::ScriptData(const byte* data, int length)
-    : owns_data_(false), rejected_(false), data_(data), length_(length) {
-  if (!IsAligned(reinterpret_cast<intptr_t>(data), kPointerAlignment)) {
-    byte* copy = NewArray<byte>(length);
-    DCHECK(IsAligned(reinterpret_cast<intptr_t>(copy), kPointerAlignment));
-    CopyBytes(copy, data, length);
-    data_ = copy;
-    AcquireDataOwnership();
-  }
-}
-
-FunctionEntry ParseData::GetFunctionEntry(int start) {
-  // The current pre-data entry must be a FunctionEntry with the given
-  // start position.
-  if ((function_index_ + FunctionEntry::kSize <= Length()) &&
-      (static_cast<int>(Data()[function_index_]) == start)) {
-    int index = function_index_;
-    function_index_ += FunctionEntry::kSize;
-    Vector<unsigned> subvector(&(Data()[index]), FunctionEntry::kSize);
-    return FunctionEntry(subvector);
-  }
-  return FunctionEntry();
-}
-
-
-int ParseData::FunctionCount() {
-  int functions_size = FunctionsSize();
-  if (functions_size < 0) return 0;
-  if (functions_size % FunctionEntry::kSize != 0) return 0;
-  return functions_size / FunctionEntry::kSize;
-}
-
-
-bool ParseData::IsSane() {
-  if (!IsAligned(script_data_->length(), sizeof(unsigned))) return false;
-  // Check that the header data is valid and doesn't specify
-  // point to positions outside the store.
-  int data_length = Length();
-  if (data_length < PreparseDataConstants::kHeaderSize) return false;
-  if (Magic() != PreparseDataConstants::kMagicNumber) return false;
-  if (Version() != PreparseDataConstants::kCurrentVersion) return false;
-  // Check that the space allocated for function entries is sane.
-  int functions_size = FunctionsSize();
-  if (functions_size < 0) return false;
-  if (functions_size % FunctionEntry::kSize != 0) return false;
-  // Check that the total size has room for header and function entries.
-  int minimum_size =
-      PreparseDataConstants::kHeaderSize + functions_size;
-  if (data_length < minimum_size) return false;
-  return true;
-}
-
-
-void ParseData::Initialize() {
-  // Prepares state for use.
-  int data_length = Length();
-  if (data_length >= PreparseDataConstants::kHeaderSize) {
-    function_index_ = PreparseDataConstants::kHeaderSize;
-  }
-}
-
-
-unsigned ParseData::Magic() {
-  return Data()[PreparseDataConstants::kMagicOffset];
-}
 
 
-unsigned ParseData::Version() {
-  return Data()[PreparseDataConstants::kVersionOffset];
-}
-
-
-int ParseData::FunctionsSize() {
-  return static_cast<int>(Data()[PreparseDataConstants::kFunctionsSizeOffset]);
-}
-
 // Helper for putting parts of the parse results into a temporary zone when
 // parsing inner function bodies.
 class DiscardableZoneScope {
@@ -153,17 +79,6 @@ class DiscardableZoneScope {
   DISALLOW_COPY_AND_ASSIGN(DiscardableZoneScope);
 };
 
-void Parser::SetCachedData(ParseInfo* info) {
-  DCHECK_NULL(cached_parse_data_);
-  if (consume_cached_parse_data()) {
-    if (allow_lazy_) {
-      cached_parse_data_ = ParseData::FromCachedData(*info->cached_data());
-      if (cached_parse_data_ != nullptr) return;
-    }
-    compile_options_ = ScriptCompiler::kNoCompileOptions;
-  }
-}
-
 FunctionLiteral* Parser::DefaultConstructor(const AstRawString* name,
                                             bool call_super, int pos,
                                             int end_pos) {
@@ -403,16 +318,6 @@ Expression* Parser::NewTargetExpression(int pos) {
   return proxy;
 }
 
-Expression* Parser::FunctionSentExpression(int pos) {
-  // We desugar function.sent into %_GeneratorGetInputOrDebugPos(generator).
-  ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(1, zone());
-  VariableProxy* generator = factory()->NewVariableProxy(
-      function_state_->scope()->generator_object_var());
-  args->Add(generator, zone());
-  return factory()->NewCallRuntime(Runtime::kInlineGeneratorGetInputOrDebugPos,
-                                   args, pos);
-}
-
 Expression* Parser::ImportMetaExpression(int pos) {
   return factory()->NewCallRuntime(
       Runtime::kInlineGetImportMetaObject,
@@ -511,11 +416,8 @@ Parser::Parser(ParseInfo* info)
       mode_(PARSE_EAGERLY),  // Lazy mode must be set explicitly.
       source_range_map_(info->source_range_map()),
       target_stack_(nullptr),
-      compile_options_(info->compile_options()),
-      cached_parse_data_(nullptr),
       total_preparse_skipped_(0),
       temp_zoned_(false),
-      log_(nullptr),
       consumed_preparsed_scope_data_(info->consumed_preparsed_scope_data()),
       parameters_end_pos_(info->parameters_end_pos()) {
   // Even though we were passed ParseInfo, we should not store it in
@@ -541,12 +443,12 @@ Parser::Parser(ParseInfo* info)
                 info->extension() == nullptr && can_compile_lazily;
   set_allow_natives(FLAG_allow_natives_syntax || info->is_native());
   set_allow_harmony_do_expressions(FLAG_harmony_do_expressions);
-  set_allow_harmony_function_sent(FLAG_harmony_function_sent);
   set_allow_harmony_public_fields(FLAG_harmony_public_fields);
   set_allow_harmony_static_fields(FLAG_harmony_static_fields);
   set_allow_harmony_dynamic_import(FLAG_harmony_dynamic_import);
   set_allow_harmony_import_meta(FLAG_harmony_import_meta);
   set_allow_harmony_bigint(FLAG_harmony_bigint);
+  set_allow_harmony_numeric_separator(FLAG_harmony_numeric_separator);
   set_allow_harmony_optional_catch_binding(FLAG_harmony_optional_catch_binding);
   set_allow_harmony_private_fields(FLAG_harmony_private_fields);
   for (int feature = 0; feature < v8::Isolate::kUseCounterFeatureCount;
@@ -603,18 +505,6 @@ FunctionLiteral* Parser::ParseProgram(Isolate* isolate, ParseInfo* info) {
   fni_ = new (zone()) FuncNameInferrer(ast_value_factory(), zone());
 
   // Initialize parser state.
-  ParserLogger logger;
-
-  if (produce_cached_parse_data()) {
-    if (allow_lazy_) {
-      log_ = &logger;
-    } else {
-      compile_options_ = ScriptCompiler::kNoCompileOptions;
-    }
-  } else if (consume_cached_parse_data()) {
-    cached_parse_data_->Initialize();
-  }
-
   DeserializeScopeChain(info, info->maybe_outer_scope_info());
 
   scanner_.Initialize(info->character_stream(), info->is_module());
@@ -623,11 +513,6 @@ FunctionLiteral* Parser::ParseProgram(Isolate* isolate, ParseInfo* info) {
 
   HandleSourceURLComments(isolate, info->script());
 
-  if (produce_cached_parse_data() && result != nullptr) {
-    *info->cached_data() = logger.GetScriptData();
-  }
-  log_ = nullptr;
-
   if (V8_UNLIKELY(FLAG_log_function_events) && result != nullptr) {
     double ms = timer.Elapsed().InMillisecondsF();
     const char* event_name = "parse-eval";
@@ -742,6 +627,7 @@ FunctionLiteral* Parser::DoParseProgram(ParseInfo* info) {
       result = factory()->NewScriptOrEvalFunctionLiteral(
           scope, body, function_state.expected_property_count(),
           parameter_count);
+      result->set_suspend_count(function_state.suspend_count());
     }
   }
 
@@ -808,7 +694,7 @@ FunctionLiteral* Parser::ParseFunction(Isolate* isolate, ParseInfo* info,
   DCHECK_EQ(factory()->zone(), info->zone());
 
   // Initialize parser state.
-  Handle<String> name(shared_info->name());
+  Handle<String> name(shared_info->Name());
   info->set_function_name(ast_value_factory()->GetString(name));
   scanner_.Initialize(info->character_stream(), info->is_module());
 
@@ -904,8 +790,9 @@ FunctionLiteral* Parser::DoParseFunction(ParseInfo* info,
       scope->set_start_position(info->start_position());
       ExpressionClassifier formals_classifier(this);
       ParserFormalParameters formals(scope);
-      int rewritable_length =
-          function_state.destructuring_assignments_to_rewrite().length();
+      // The outer FunctionState should not contain destructuring assignments.
+      DCHECK_EQ(0,
+                function_state.destructuring_assignments_to_rewrite().length());
       {
         // Parsing patterns as variable reference expression creates
         // NewUnresolved references in current scope. Enter arrow function
@@ -943,8 +830,12 @@ FunctionLiteral* Parser::DoParseFunction(ParseInfo* info,
 
         // Pass `accept_IN=true` to ParseArrowFunctionLiteral --- This should
         // not be observable, or else the preparser would have failed.
-        Expression* expression =
-            ParseArrowFunctionLiteral(true, formals, rewritable_length, &ok);
+        const bool accept_IN = true;
+        // Any destructuring assignments in the current FunctionState
+        // actually belong to the arrow function itself.
+        const int rewritable_length = 0;
+        Expression* expression = ParseArrowFunctionLiteral(
+            accept_IN, formals, rewritable_length, &ok);
         if (ok) {
           // Scanning must end at the same position that was recorded
           // previously. If not, parsing has been interrupted due to a stack
@@ -957,10 +848,6 @@ FunctionLiteral* Parser::DoParseFunction(ParseInfo* info,
             // must produce a FunctionLiteral.
             DCHECK(expression->IsFunctionLiteral());
             result = expression->AsFunctionLiteral();
-            // Rewrite destructuring assignments in the parameters. (The ones
-            // inside the function body are rewritten by
-            // ParseArrowFunctionLiteral.)
-            RewriteDestructuringAssignments();
           } else {
             ok = false;
           }
@@ -1293,7 +1180,7 @@ Statement* Parser::ParseExportDefault(bool* ok) {
         result = ParseAsyncFunctionDeclaration(&local_names, true, CHECK_OK);
         break;
       }
-    /* falls through */
+      V8_FALLTHROUGH;
 
     default: {
       int pos = position();
@@ -1531,8 +1418,7 @@ Statement* Parser::DeclareFunction(const AstRawString* variable_name,
                                    ZoneList<const AstRawString*>* names,
                                    bool* ok) {
   VariableProxy* proxy =
-      factory()->NewVariableProxy(variable_name, NORMAL_VARIABLE);
-
+      factory()->NewVariableProxy(variable_name, NORMAL_VARIABLE, pos);
   Declaration* declaration =
       factory()->NewFunctionDeclaration(proxy, function, pos);
   Declare(declaration, DeclarationDescriptor::NORMAL, mode, kCreatedInitialized,
@@ -1831,6 +1717,8 @@ void Parser::ParseAndRewriteAsyncGeneratorFunctionBody(
 
   // Don't create iterator result for async generators, as the resume methods
   // will create it.
+  // TODO(leszeks): This will create another suspend point, which is unnecessary
+  // if there is already an unconditional return in the body.
   Statement* final_return = BuildReturnStatement(
       factory()->NewUndefinedLiteral(kNoSourcePosition), kNoSourcePosition);
   try_block->statements()->Add(final_return, zone());
@@ -1900,6 +1788,7 @@ Expression* Parser::BuildIteratorNextResult(VariableProxy* iterator,
   Expression* next_call =
       factory()->NewCall(next_property, next_arguments, kNoSourcePosition);
   if (type == IteratorType::kAsync) {
+    function_state_->AddSuspend();
     next_call = factory()->NewAwait(next_call, pos);
   }
   Expression* result_proxy = factory()->NewVariableProxy(result);
@@ -2681,6 +2570,7 @@ FunctionLiteral* Parser::ParseFunctionLiteral(
 
   ZoneList<Statement*>* body = nullptr;
   int expected_property_count = -1;
+  int suspend_count = -1;
   int num_parameters = -1;
   int function_length = -1;
   bool has_duplicate_parameters = false;
@@ -2747,10 +2637,10 @@ FunctionLiteral* Parser::ParseFunctionLiteral(
     if (should_preparse) {
       scope->AnalyzePartially(&previous_zone_ast_node_factory);
     } else {
-      body = ParseFunction(function_name, pos, kind, function_type, scope,
-                           &num_parameters, &function_length,
-                           &has_duplicate_parameters, &expected_property_count,
-                           arguments_for_wrapped_function, CHECK_OK);
+      body = ParseFunction(
+          function_name, pos, kind, function_type, scope, &num_parameters,
+          &function_length, &has_duplicate_parameters, &expected_property_count,
+          &suspend_count, arguments_for_wrapped_function, CHECK_OK);
     }
 
     DCHECK_EQ(should_preparse, temp_zoned_);
@@ -2808,6 +2698,7 @@ FunctionLiteral* Parser::ParseFunctionLiteral(
       function_length, duplicate_parameters, function_type, eager_compile_hint,
       pos, true, function_literal_id, produced_preparsed_scope_data);
   function_literal->set_function_token_position(function_token_pos);
+  function_literal->set_suspend_count(suspend_count);
 
   if (should_infer_name) {
     DCHECK_NOT_NULL(fni_);
@@ -2826,38 +2717,11 @@ Parser::LazyParsingResult Parser::SkipFunction(
 
   DCHECK_NE(kNoSourcePosition, function_scope->start_position());
   DCHECK_EQ(kNoSourcePosition, parameters_end_pos_);
-  if (produce_cached_parse_data()) CHECK(log_);
 
   DCHECK_IMPLIES(IsArrowFunction(kind),
                  scanner()->current_token() == Token::ARROW);
 
-  // Inner functions are not part of the cached data.
-  if (!is_inner_function && consume_cached_parse_data() &&
-      !cached_parse_data_->rejected()) {
-    // If we have cached data, we use it to skip parsing the function. The data
-    // contains the information we need to construct the lazy function.
-    FunctionEntry entry =
-        cached_parse_data_->GetFunctionEntry(function_scope->start_position());
-    // Check that cached data is valid. If not, mark it as invalid (the embedder
-    // handles it). Note that end position greater than end of stream is safe,
-    // and hard to check.
-    if (entry.is_valid() &&
-        entry.end_pos() > function_scope->start_position()) {
-      total_preparse_skipped_ += entry.end_pos() - position();
-      function_scope->set_end_position(entry.end_pos());
-      scanner()->SeekForward(entry.end_pos() - 1);
-      Expect(Token::RBRACE, CHECK_OK_VALUE(kLazyParsingComplete));
-      *num_parameters = entry.num_parameters();
-      SetLanguageMode(function_scope, entry.language_mode());
-      if (entry.uses_super_property())
-        function_scope->RecordSuperPropertyUsage();
-      SkipFunctionLiterals(entry.num_inner_functions());
-      return kLazyParsingComplete;
-    }
-    cached_parse_data_->Reject();
-  }
-
-  // FIXME(marja): There are 3 ways to skip functions now. Unify them.
+  // FIXME(marja): There are 2 ways to skip functions now. Unify them.
   DCHECK_NOT_NULL(consumed_preparsed_scope_data_);
   if (consumed_preparsed_scope_data_->HasData()) {
     DCHECK(FLAG_preparser_scope_analysis);
@@ -2908,6 +2772,9 @@ Parser::LazyParsingResult Parser::SkipFunction(
     *ok = false;
     return kLazyParsingComplete;
   }
+
+  set_allow_eval_cache(reusable_preparser()->allow_eval_cache());
+
   PreParserLogger* logger = reusable_preparser()->logger();
   function_scope->set_end_position(logger->end());
   Expect(Token::RBRACE, CHECK_OK_VALUE(kLazyParsingComplete));
@@ -2915,13 +2782,6 @@ Parser::LazyParsingResult Parser::SkipFunction(
       function_scope->end_position() - function_scope->start_position();
   *num_parameters = logger->num_parameters();
   SkipFunctionLiterals(logger->num_inner_functions());
-  if (!is_inner_function && produce_cached_parse_data()) {
-    DCHECK(log_);
-    log_->LogFunction(function_scope->start_position(),
-                      function_scope->end_position(), *num_parameters,
-                      language_mode(), function_scope->NeedsHomeObject(),
-                      logger->num_inner_functions());
-  }
   return kLazyParsingComplete;
 }
 
@@ -3136,7 +2996,7 @@ Expression* Parser::BuildResolvePromise(Expression* value, int pos) {
   args->Add(factory()->NewVariableProxy(PromiseVariable()), zone());
   args->Add(value, zone());
   Expression* call_runtime =
-      factory()->NewCallRuntime(Context::PROMISE_RESOLVE_INDEX, args, pos);
+      factory()->NewCallRuntime(Runtime::kInlineResolvePromise, args, pos);
   return factory()->NewBinaryOperation(
       Token::COMMA, call_runtime,
       factory()->NewVariableProxy(PromiseVariable()), pos);
@@ -3150,8 +3010,8 @@ Expression* Parser::BuildRejectPromise(Expression* value, int pos) {
   args->Add(factory()->NewVariableProxy(PromiseVariable()), zone());
   args->Add(value, zone());
   args->Add(factory()->NewBooleanLiteral(false, pos), zone());
-  Expression* call_runtime = factory()->NewCallRuntime(
-      Context::PROMISE_INTERNAL_REJECT_INDEX, args, pos);
+  Expression* call_runtime =
+      factory()->NewCallRuntime(Runtime::kInlineRejectPromise, args, pos);
   return factory()->NewBinaryOperation(
       Token::COMMA, call_runtime,
       factory()->NewVariableProxy(PromiseVariable()), pos);
@@ -3175,6 +3035,7 @@ Expression* Parser::BuildInitialYield(int pos, FunctionKind kind) {
   // The position of the yield is important for reporting the exception
   // caused by calling the .throw method on a generator suspended at the
   // initial yield (i.e. right after generator instantiation).
+  function_state_->AddSuspend();
   return factory()->NewYield(yield_result, scope()->start_position(),
                              Suspend::kOnExceptionThrow);
 }
@@ -3184,6 +3045,7 @@ ZoneList<Statement*>* Parser::ParseFunction(
     FunctionLiteral::FunctionType function_type,
     DeclarationScope* function_scope, int* num_parameters, int* function_length,
     bool* has_duplicate_parameters, int* expected_property_count,
+    int* suspend_count,
     ZoneList<const AstRawString*>* arguments_for_wrapped_function, bool* ok) {
   ParsingModeScope mode(this, allow_lazy_ ? PARSE_LAZILY : PARSE_EAGERLY);
 
@@ -3268,6 +3130,7 @@ ZoneList<Statement*>* Parser::ParseFunction(
       !classifier()->is_valid_formal_parameter_list_without_duplicates();
 
   *expected_property_count = function_state.expected_property_count();
+  *suspend_count = function_state.suspend_count();
   return body;
 }
 
@@ -3308,6 +3171,7 @@ Variable* Parser::CreateSyntheticContextVariable(const AstRawString* name,
 //   - properties
 void Parser::DeclareClassProperty(const AstRawString* class_name,
                                   ClassLiteralProperty* property,
+                                  const AstRawString* property_name,
                                   ClassLiteralProperty::Kind kind,
                                   bool is_static, bool is_constructor,
                                   bool is_computed_name, ClassInfo* class_info,
@@ -3322,7 +3186,8 @@ void Parser::DeclareClassProperty(const AstRawString* class_name,
     return;
   }
 
-  if (kind != ClassLiteralProperty::FIELD) {
+  if (kind != ClassLiteralProperty::PUBLIC_FIELD &&
+      kind != ClassLiteralProperty::PRIVATE_FIELD) {
     class_info->properties->Add(property, zone());
     return;
   }
@@ -3331,12 +3196,14 @@ void Parser::DeclareClassProperty(const AstRawString* class_name,
 
   if (is_static) {
     DCHECK(allow_harmony_static_fields());
+    DCHECK_EQ(kind, ClassLiteralProperty::PUBLIC_FIELD);
     class_info->static_fields->Add(property, zone());
   } else {
     class_info->instance_fields->Add(property, zone());
   }
 
   if (is_computed_name) {
+    DCHECK_EQ(kind, ClassLiteralProperty::PUBLIC_FIELD);
     // We create a synthetic variable name here so that scope
     // analysis doesn't dedupe the vars.
     Variable* computed_name_var = CreateSyntheticContextVariable(
@@ -3346,6 +3213,13 @@ void Parser::DeclareClassProperty(const AstRawString* class_name,
     property->set_computed_name_var(computed_name_var);
     class_info->properties->Add(property, zone());
   }
+
+  if (kind == ClassLiteralProperty::PRIVATE_FIELD) {
+    Variable* private_field_name_var =
+        CreateSyntheticContextVariable(property_name, CHECK_OK_VOID);
+    property->set_private_field_name_var(private_field_name_var);
+    class_info->properties->Add(property, zone());
+  }
 }
 
 FunctionLiteral* Parser::CreateInitializerFunction(
@@ -3432,6 +3306,15 @@ void Parser::CheckConflictingVarDeclarations(Scope* scope, bool* ok) {
   }
 }
 
+bool Parser::IsPropertyWithPrivateFieldKey(Expression* expression) {
+  if (!expression->IsProperty()) return false;
+  Property* property = expression->AsProperty();
+
+  if (!property->key()->IsVariableProxy()) return false;
+  VariableProxy* key = property->key()->AsVariableProxy();
+
+  return key->is_private_field();
+}
 
 void Parser::InsertShadowingVarBindingInitializers(Block* inner_block) {
   // For each var-binding that shadows a parameter, insert an assignment
@@ -3550,15 +3433,6 @@ void Parser::ParseOnBackground(ParseInfo* info) {
   DCHECK_NULL(info->literal());
   FunctionLiteral* result = nullptr;
 
-  ParserLogger logger;
-  if (produce_cached_parse_data()) {
-    if (allow_lazy_) {
-      log_ = &logger;
-    } else {
-      compile_options_ = ScriptCompiler::kNoCompileOptions;
-    }
-  }
-
   scanner_.Initialize(info->character_stream(), info->is_module());
   DCHECK(info->maybe_outer_scope_info().is_null());
 
@@ -3582,11 +3456,6 @@ void Parser::ParseOnBackground(ParseInfo* info) {
 
   // We cannot internalize on a background thread; a foreground task will take
   // care of calling AstValueFactory::Internalize just before compilation.
-
-  if (produce_cached_parse_data()) {
-    if (result != nullptr) *info->cached_data() = logger.GetScriptData();
-    log_ = nullptr;
-  }
 }
 
 Parser::TemplateLiteralState Parser::OpenTemplateLiteral(int pos) {
@@ -3623,40 +3492,14 @@ Expression* Parser::CloseTemplateLiteral(TemplateLiteralState* state, int start,
   DCHECK_EQ(cooked_strings->length(), expressions->length() + 1);
 
   if (!tag) {
-    Expression* first_string =
-        factory()->NewStringLiteral(cooked_strings->at(0), kNoSourcePosition);
-    if (expressions->length() == 0) return first_string;
-
-    // Build N-ary addition op to simplify code-generation.
-    // TODO(leszeks): Could we just store this expression in the
-    // TemplateLiteralState and build it as we go?
-    NaryOperation* expr = factory()->NewNaryOperation(
-        Token::ADD, first_string, 2 * expressions->length());
-
-    int i = 0;
-    while (i < expressions->length()) {
-      Expression* sub = expressions->at(i++);
-      const AstRawString* cooked_str = cooked_strings->at(i);
-      DCHECK_NOT_NULL(cooked_str);
-
-      // Let middle be ToString(sub).
-      ZoneList<Expression*>* args =
-          new (zone()) ZoneList<Expression*>(1, zone());
-      args->Add(sub, zone());
-      Expression* sub_to_string = factory()->NewCallRuntime(
-          Runtime::kInlineToString, args, sub->position());
-
-      expr->AddSubsequent(sub_to_string, sub->position());
-      expr->AddSubsequent(
-          factory()->NewStringLiteral(cooked_str, kNoSourcePosition),
-          sub->position());
+    if (cooked_strings->length() == 1) {
+      return factory()->NewStringLiteral(cooked_strings->first(), pos);
     }
-    return expr;
+    return factory()->NewTemplateLiteral(cooked_strings, expressions, pos);
   } else {
     // GetTemplateObject
-    const int32_t hash = ComputeTemplateLiteralHash(lit);
     Expression* template_object =
-        factory()->NewGetTemplateObject(cooked_strings, raw_strings, hash, pos);
+        factory()->NewGetTemplateObject(cooked_strings, raw_strings, pos);
 
     // Call TagFn
     ZoneList<Expression*>* call_args =
@@ -3669,51 +3512,6 @@ Expression* Parser::CloseTemplateLiteral(TemplateLiteralState* state, int start,
 
 namespace {
 
-// http://burtleburtle.net/bob/hash/integer.html
-uint32_t HalfAvalance(uint32_t a) {
-  a = (a + 0x479AB41D) + (a << 8);
-  a = (a ^ 0xE4AA10CE) ^ (a >> 5);
-  a = (a + 0x9942F0A6) - (a << 14);
-  a = (a ^ 0x5AEDD67D) ^ (a >> 3);
-  a = (a + 0x17BEA992) + (a << 7);
-  return a;
-}
-
-}  // namespace
-
-int32_t Parser::ComputeTemplateLiteralHash(const TemplateLiteral* lit) {
-  const ZoneList<const AstRawString*>* raw_strings = lit->raw();
-  int total = raw_strings->length();
-  DCHECK_GT(total, 0);
-
-  uint32_t running_hash = 0;
-
-  for (int index = 0; index < total; ++index) {
-    if (index) {
-      running_hash = StringHasher::ComputeRunningHashOneByte(
-          running_hash, "${}", 3);
-    }
-
-    const AstRawString* raw_string = raw_strings->at(index);
-    if (raw_string->is_one_byte()) {
-      const char* data = reinterpret_cast<const char*>(raw_string->raw_data());
-      running_hash = StringHasher::ComputeRunningHashOneByte(
-          running_hash, data, raw_string->length());
-    } else {
-      const uc16* data = reinterpret_cast<const uc16*>(raw_string->raw_data());
-      running_hash = StringHasher::ComputeRunningHash(running_hash, data,
-                                                      raw_string->length());
-    }
-  }
-
-  // Pass {running_hash} throught a decent 'half avalance' hash function
-  // and take the most significant bits (in Smi range).
-  return static_cast<int32_t>(HalfAvalance(running_hash)) >>
-         (sizeof(int32_t) * CHAR_BIT - kSmiValueSize);
-}
-
-namespace {
-
 bool OnlyLastArgIsSpread(ZoneList<Expression*>* args) {
   for (int i = 0; i < args->length() - 1; i++) {
     if (args->at(i)->IsSpread()) {
@@ -3725,96 +3523,52 @@ bool OnlyLastArgIsSpread(ZoneList<Expression*>* args) {
 
 }  // namespace
 
-ZoneList<Expression*>* Parser::PrepareSpreadArguments(
+ArrayLiteral* Parser::ArrayLiteralFromListWithSpread(
     ZoneList<Expression*>* list) {
-  ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(1, zone());
-  if (list->length() == 1) {
-    // Spread-call with single spread argument produces an InternalArray
-    // containing the values from the array.
-    //
-    // Function is called or constructed with the produced array of arguments
-    //
-    // EG: Apply(Func, Spread(spread0))
-    ZoneList<Expression*>* spread_list =
-        new (zone()) ZoneList<Expression*>(0, zone());
-    spread_list->Add(list->at(0)->AsSpread()->expression(), zone());
-    args->Add(factory()->NewCallRuntime(Runtime::kSpreadIterablePrepare,
-                                        spread_list, kNoSourcePosition),
-              zone());
-    return args;
-  } else {
-    // Spread-call with multiple arguments produces array literals for each
-    // sequences of unspread arguments, and converts each spread iterable to
-    // an Internal array. Finally, all of these produced arrays are flattened
-    // into a single InternalArray, containing the arguments for the call.
-    //
-    // EG: Apply(Func, Flatten([unspread0, unspread1], Spread(spread0),
-    //                         Spread(spread1), [unspread2, unspread3]))
-    int i = 0;
-    int n = list->length();
-    while (i < n) {
-      if (!list->at(i)->IsSpread()) {
-        ZoneList<Expression*>* unspread =
-            new (zone()) ZoneList<Expression*>(1, zone());
-
-        // Push array of unspread parameters
-        while (i < n && !list->at(i)->IsSpread()) {
-          unspread->Add(list->at(i++), zone());
-        }
-        args->Add(factory()->NewArrayLiteral(unspread, kNoSourcePosition),
-                  zone());
+  // If there's only a single spread argument, a fast path using CallWithSpread
+  // is taken.
+  DCHECK_LT(1, list->length());
 
-        if (i == n) break;
-      }
-
-      // Push eagerly spread argument
-      ZoneList<Expression*>* spread_list =
-          new (zone()) ZoneList<Expression*>(1, zone());
-      spread_list->Add(list->at(i++)->AsSpread()->expression(), zone());
-      args->Add(factory()->NewCallRuntime(Context::SPREAD_ITERABLE_INDEX,
-                                          spread_list, kNoSourcePosition),
-                zone());
-    }
-
-    list = new (zone()) ZoneList<Expression*>(1, zone());
-    list->Add(factory()->NewCallRuntime(Context::SPREAD_ARGUMENTS_INDEX, args,
-                                        kNoSourcePosition),
-              zone());
-    return list;
+  // The arguments of the spread call become a single ArrayLiteral.
+  int first_spread = 0;
+  for (; first_spread < list->length() && !list->at(first_spread)->IsSpread();
+       ++first_spread) {
   }
-  UNREACHABLE();
+
+  DCHECK_LT(first_spread, list->length());
+  return factory()->NewArrayLiteral(list, first_spread, kNoSourcePosition);
 }
 
 Expression* Parser::SpreadCall(Expression* function,
-                               ZoneList<Expression*>* args, int pos,
+                               ZoneList<Expression*>* args_list, int pos,
                                Call::PossiblyEval is_possibly_eval) {
   // Handle this case in BytecodeGenerator.
-  if (OnlyLastArgIsSpread(args)) {
-    return factory()->NewCall(function, args, pos);
+  if (OnlyLastArgIsSpread(args_list)) {
+    return factory()->NewCall(function, args_list, pos);
   }
 
   if (function->IsSuperCallReference()) {
     // Super calls
     // $super_constructor = %_GetSuperConstructor(<this-function>)
     // %reflect_construct($super_constructor, args, new.target)
-
-    args = PrepareSpreadArguments(args);
+    ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(3, zone());
     ZoneList<Expression*>* tmp = new (zone()) ZoneList<Expression*>(1, zone());
     tmp->Add(function->AsSuperCallReference()->this_function_var(), zone());
-    Expression* super_constructor = factory()->NewCallRuntime(
-        Runtime::kInlineGetSuperConstructor, tmp, pos);
-    args->InsertAt(0, super_constructor, zone());
+    args->Add(factory()->NewCallRuntime(Runtime::kInlineGetSuperConstructor,
+                                        tmp, pos),
+              zone());
+    args->Add(ArrayLiteralFromListWithSpread(args_list), zone());
     args->Add(function->AsSuperCallReference()->new_target_var(), zone());
     return factory()->NewCallRuntime(Context::REFLECT_CONSTRUCT_INDEX, args,
                                      pos);
   } else {
-    args = PrepareSpreadArguments(args);
+    ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(3, zone());
     if (function->IsProperty()) {
       // Method calls
       if (function->AsProperty()->IsSuperAccess()) {
         Expression* home = ThisExpression(kNoSourcePosition);
-        args->InsertAt(0, function, zone());
-        args->InsertAt(1, home, zone());
+        args->Add(function, zone());
+        args->Add(home, zone());
       } else {
         Variable* temp = NewTemporary(ast_value_factory()->empty_string());
         VariableProxy* obj = factory()->NewVariableProxy(temp);
@@ -3823,28 +3577,29 @@ Expression* Parser::SpreadCall(Expression* function,
             kNoSourcePosition);
         function = factory()->NewProperty(
             assign_obj, function->AsProperty()->key(), kNoSourcePosition);
-        args->InsertAt(0, function, zone());
+        args->Add(function, zone());
         obj = factory()->NewVariableProxy(temp);
-        args->InsertAt(1, obj, zone());
+        args->Add(obj, zone());
       }
     } else {
       // Non-method calls
-      args->InsertAt(0, function, zone());
-      args->InsertAt(1, factory()->NewUndefinedLiteral(kNoSourcePosition),
-                     zone());
+      args->Add(function, zone());
+      args->Add(factory()->NewUndefinedLiteral(kNoSourcePosition), zone());
     }
+    args->Add(ArrayLiteralFromListWithSpread(args_list), zone());
     return factory()->NewCallRuntime(Context::REFLECT_APPLY_INDEX, args, pos);
   }
 }
 
 Expression* Parser::SpreadCallNew(Expression* function,
-                                  ZoneList<Expression*>* args, int pos) {
-  if (OnlyLastArgIsSpread(args)) {
+                                  ZoneList<Expression*>* args_list, int pos) {
+  if (OnlyLastArgIsSpread(args_list)) {
     // Handle in BytecodeGenerator.
-    return factory()->NewCallNew(function, args, pos);
+    return factory()->NewCallNew(function, args_list, pos);
   }
-  args = PrepareSpreadArguments(args);
-  args->InsertAt(0, function, zone());
+  ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(2, zone());
+  args->Add(function, zone());
+  args->Add(ArrayLiteralFromListWithSpread(args_list), zone());
 
   return factory()->NewCallRuntime(Context::REFLECT_CONSTRUCT_INDEX, args, pos);
 }
@@ -3911,6 +3666,9 @@ void Parser::RewriteDestructuringAssignments() {
       // pair.scope may already have been removed by FinalizeBlockScope in the
       // meantime.
       Scope* scope = to_rewrite->scope()->GetUnremovedScope();
+      // Scope at the time of the rewriting and the original parsing
+      // should be in the same function.
+      DCHECK(scope->GetClosureScope() == scope_->GetClosureScope());
       BlockState block_state(&scope_, scope);
       RewriteDestructuringAssignment(to_rewrite);
     }
@@ -4070,6 +3828,7 @@ void Parser::BuildIteratorClose(ZoneList<Statement*>* statements,
     Expression* call =
         factory()->NewCallRuntime(Runtime::kInlineCall, args, nopos);
     if (type == IteratorType::kAsync) {
+      function_state_->AddSuspend();
       call = factory()->NewAwait(call, nopos);
     }
     Expression* output_proxy = factory()->NewVariableProxy(var_output);
@@ -4288,6 +4047,7 @@ void Parser::BuildIteratorCloseForCompletion(ZoneList<Statement*>* statements,
         factory()->NewCallRuntime(Runtime::kInlineCall, args, nopos);
 
     if (type == IteratorType::kAsync) {
+      function_state_->AddSuspend();
       call = factory()->NewAwait(call, nopos);
     }
 
@@ -4315,6 +4075,7 @@ void Parser::BuildIteratorCloseForCompletion(ZoneList<Statement*>* statements,
       Expression* call =
           factory()->NewCallRuntime(Runtime::kInlineCall, args, nopos);
       if (type == IteratorType::kAsync) {
+        function_state_->AddSuspend();
         call = factory()->NewAwait(call, nopos);
       }
 
diff --git a/deps/v8/src/parsing/parser.h b/deps/v8/src/parsing/parser.h
index f92eddcd9dc..2da4490906a 100644
--- a/deps/v8/src/parsing/parser.h
+++ b/deps/v8/src/parsing/parser.h
@@ -14,7 +14,6 @@
 #include "src/globals.h"
 #include "src/parsing/parser-base.h"
 #include "src/parsing/parsing.h"
-#include "src/parsing/preparse-data-format.h"
 #include "src/parsing/preparse-data.h"
 #include "src/parsing/preparser.h"
 #include "src/utils.h"
@@ -27,7 +26,6 @@ namespace internal {
 
 class ConsumedPreParsedScopeData;
 class ParseInfo;
-class ScriptData;
 class ParserTarget;
 class ParserTargetScope;
 class PendingCompilationErrorHandler;
@@ -77,47 +75,6 @@ class FunctionEntry BASE_EMBEDDED {
 };
 
 
-// Wrapper around ScriptData to provide parser-specific functionality.
-class ParseData {
- public:
-  static ParseData* FromCachedData(ScriptData* cached_data) {
-    ParseData* pd = new ParseData(cached_data);
-    if (pd->IsSane()) return pd;
-    cached_data->Reject();
-    delete pd;
-    return nullptr;
-  }
-
-  void Initialize();
-  FunctionEntry GetFunctionEntry(int start);
-  int FunctionCount();
-
-  unsigned* Data() {  // Writable data as unsigned int array.
-    return reinterpret_cast<unsigned*>(const_cast<byte*>(script_data_->data()));
-  }
-
-  void Reject() { script_data_->Reject(); }
-
-  bool rejected() const { return script_data_->rejected(); }
-
- private:
-  explicit ParseData(ScriptData* script_data) : script_data_(script_data) {}
-
-  bool IsSane();
-  unsigned Magic();
-  unsigned Version();
-  int FunctionsSize();
-  int Length() const {
-    // Script data length is already checked to be a multiple of unsigned size.
-    return script_data_->length() / sizeof(unsigned);
-  }
-
-  ScriptData* script_data_;
-  int function_index_;
-
-  DISALLOW_COPY_AND_ASSIGN(ParseData);
-};
-
 // ----------------------------------------------------------------------------
 // JAVASCRIPT PARSING
 
@@ -192,8 +149,6 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   ~Parser() {
     delete reusable_preparser_;
     reusable_preparser_ = nullptr;
-    delete cached_parse_data_;
-    cached_parse_data_ = nullptr;
   }
 
   static bool IsPreParser() { return false; }
@@ -276,20 +231,8 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   ZoneList<const AstRawString*>* PrepareWrappedArguments(ParseInfo* info,
                                                          Zone* zone);
 
-  void SetCachedData(ParseInfo* info);
-
   void StitchAst(ParseInfo* top_level_parse_info, Isolate* isolate);
 
-  ScriptCompiler::CompileOptions compile_options() const {
-    return compile_options_;
-  }
-  bool consume_cached_parse_data() const {
-    return compile_options_ == ScriptCompiler::kConsumeParserCache;
-  }
-  bool produce_cached_parse_data() const {
-    return compile_options_ == ScriptCompiler::kProduceParserCache;
-  }
-
   PreParser* reusable_preparser() {
     if (reusable_preparser_ == nullptr) {
       reusable_preparser_ =
@@ -299,7 +242,6 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
 #define SET_ALLOW(name) reusable_preparser_->set_allow_##name(allow_##name());
       SET_ALLOW(natives);
       SET_ALLOW(harmony_do_expressions);
-      SET_ALLOW(harmony_function_sent);
       SET_ALLOW(harmony_public_fields);
       SET_ALLOW(harmony_static_fields);
       SET_ALLOW(harmony_dynamic_import);
@@ -307,6 +249,7 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
       SET_ALLOW(harmony_bigint);
       SET_ALLOW(harmony_optional_catch_binding);
       SET_ALLOW(harmony_private_fields);
+      SET_ALLOW(eval_cache);
 #undef SET_ALLOW
     }
     return reusable_preparser_;
@@ -377,6 +320,7 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
                                       int class_token_pos, bool* ok);
   V8_INLINE void DeclareClassProperty(const AstRawString* class_name,
                                       ClassLiteralProperty* property,
+                                      const AstRawString* property_name,
                                       ClassLiteralProperty::Kind kind,
                                       bool is_static, bool is_constructor,
                                       bool is_computed_name,
@@ -456,6 +400,8 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   // hoisted over such a scope.
   void CheckConflictingVarDeclarations(Scope* scope, bool* ok);
 
+  bool IsPropertyWithPrivateFieldKey(Expression* property);
+
   // Insert initializer statements for var-bindings shadowing parameter bindings
   // from a non-simple parameter list.
   void InsertShadowingVarBindingInitializers(Block* block);
@@ -506,7 +452,7 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
       FunctionLiteral::FunctionType function_type,
       DeclarationScope* function_scope, int* num_parameters,
       int* function_length, bool* has_duplicate_parameters,
-      int* expected_property_count,
+      int* expected_property_count, int* suspend_count,
       ZoneList<const AstRawString*>* arguments_for_wrapped_function, bool* ok);
 
   void ThrowPendingError(Isolate* isolate, Handle<Script> script);
@@ -555,9 +501,8 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
                              Expression* expression);
   Expression* CloseTemplateLiteral(TemplateLiteralState* state, int start,
                                    Expression* tag);
-  int32_t ComputeTemplateLiteralHash(const TemplateLiteral* lit);
 
-  ZoneList<Expression*>* PrepareSpreadArguments(ZoneList<Expression*>* list);
+  ArrayLiteral* ArrayLiteralFromListWithSpread(ZoneList<Expression*>* list);
   Expression* SpreadCall(Expression* function, ZoneList<Expression*>* args,
                          int pos, Call::PossiblyEval is_possibly_eval);
   Expression* SpreadCallNew(Expression* function, ZoneList<Expression*>* args,
@@ -761,6 +706,15 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
     }
   }
 
+  // A shortcut for performing a ToString operation
+  V8_INLINE Expression* ToString(Expression* expr) {
+    if (expr->IsStringLiteral()) return expr;
+    ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(1, zone());
+    args->Add(expr, zone());
+    return factory()->NewCallRuntime(Runtime::kInlineToString, args,
+                                     expr->position());
+  }
+
   // Returns true if we have a binary expression between two numeric
   // literals. In that case, *x will be changed to an expression which is the
   // computed value.
@@ -883,12 +837,11 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   Expression* NewSuperPropertyReference(int pos);
   Expression* NewSuperCallReference(int pos);
   Expression* NewTargetExpression(int pos);
-  Expression* FunctionSentExpression(int pos);
   Expression* ImportMetaExpression(int pos);
 
   Literal* ExpressionFromLiteral(Token::Value token, int pos);
 
-  V8_INLINE Expression* ExpressionFromIdentifier(
+  V8_INLINE VariableProxy* ExpressionFromIdentifier(
       const AstRawString* name, int start_position,
       InferName infer = InferName::kYes) {
     if (infer == InferName::kYes) {
@@ -1144,7 +1097,6 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   ParserTarget* target_stack_;  // for break, continue statements
 
   ScriptCompiler::CompileOptions compile_options_;
-  ParseData* cached_parse_data_;
 
   // Other information which will be stored in Parser and moved to Isolate after
   // parsing.
@@ -1152,7 +1104,6 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   int total_preparse_skipped_;
   bool allow_lazy_;
   bool temp_zoned_;
-  ParserLogger* log_;
   ConsumedPreParsedScopeData* consumed_preparsed_scope_data_;
 
   // If not kNoSourcePosition, indicates that the first function literal
diff --git a/deps/v8/src/parsing/parsing.cc b/deps/v8/src/parsing/parsing.cc
index bc3c6dec7b7..dc66876e7d2 100644
--- a/deps/v8/src/parsing/parsing.cc
+++ b/deps/v8/src/parsing/parsing.cc
@@ -36,7 +36,6 @@ bool ParseProgram(ParseInfo* info, Isolate* isolate) {
   // Ok to use Isolate here; this function is only called in the main thread.
   DCHECK(parser.parsing_on_main_thread_);
 
-  parser.SetCachedData(info);
   result = parser.ParseProgram(isolate, info);
   info->set_literal(result);
   if (result == nullptr) {
@@ -45,6 +44,9 @@ bool ParseProgram(ParseInfo* info, Isolate* isolate) {
   } else {
     result->scope()->AttachOuterScopeInfo(info, isolate);
     info->set_language_mode(info->literal()->language_mode());
+    if (info->is_eval()) {
+      info->set_allow_eval_cache(parser.allow_eval_cache());
+    }
   }
   parser.UpdateStatistics(isolate, info->script());
   return (result != nullptr);
@@ -61,7 +63,7 @@ bool ParseFunction(ParseInfo* info, Handle<SharedFunctionInfo> shared_info,
   source = String::Flatten(source);
   isolate->counters()->total_parse_size()->Increment(source->length());
   std::unique_ptr<Utf16CharacterStream> stream(ScannerStream::For(
-      source, shared_info->start_position(), shared_info->end_position()));
+      source, shared_info->StartPosition(), shared_info->EndPosition()));
   info->set_character_stream(std::move(stream));
 
   VMState<PARSER> state(isolate);
@@ -79,6 +81,9 @@ bool ParseFunction(ParseInfo* info, Handle<SharedFunctionInfo> shared_info,
                                                 info->ast_value_factory());
   } else {
     result->scope()->AttachOuterScopeInfo(info, isolate);
+    if (info->is_eval()) {
+      info->set_allow_eval_cache(parser.allow_eval_cache());
+    }
   }
   parser.UpdateStatistics(isolate, info->script());
   return (result != nullptr);
diff --git a/deps/v8/src/parsing/pattern-rewriter.cc b/deps/v8/src/parsing/pattern-rewriter.cc
index daa126d4431..b0dfe0a66f9 100644
--- a/deps/v8/src/parsing/pattern-rewriter.cc
+++ b/deps/v8/src/parsing/pattern-rewriter.cc
@@ -578,13 +578,15 @@ void PatternRewriter::VisitArrayLiteral(ArrayLiteral* node,
     // RecurseIntoSubpattern above.
 
     // let array = [];
+    // let index = 0;
     // while (!done) {
     //   done = true;  // If .next, .done or .value throws, don't close.
     //   result = IteratorNext(iterator);
     //   if (!result.done) {
-    //     %AppendElement(array, result.value);
+    //     StoreInArrayLiteral(array, index, result.value);
     //     done = false;
     //   }
+    //   index++;
     // }
 
     // let array = [];
@@ -595,6 +597,10 @@ void PatternRewriter::VisitArrayLiteral(ArrayLiteral* node,
           factory()->NewArrayLiteral(empty_exprs, kNoSourcePosition));
     }
 
+    // let index = 0;
+    Variable* index =
+        CreateTempVar(factory()->NewSmiLiteral(0, kNoSourcePosition));
+
     // done = true;
     Statement* set_done = factory()->NewExpressionStatement(
         factory()->NewAssignment(
@@ -609,19 +615,18 @@ void PatternRewriter::VisitArrayLiteral(ArrayLiteral* node,
                                          result, IteratorType::kNormal, nopos),
         nopos);
 
-    // %AppendElement(array, result.value);
-    Statement* append_element;
+    // StoreInArrayLiteral(array, index, result.value);
+    Statement* store;
     {
-      auto args = new (zone()) ZoneList<Expression*>(2, zone());
-      args->Add(factory()->NewVariableProxy(array), zone());
-      args->Add(factory()->NewProperty(
-                    factory()->NewVariableProxy(result),
-                    factory()->NewStringLiteral(
-                        ast_value_factory()->value_string(), nopos),
-                    nopos),
-                zone());
-      append_element = factory()->NewExpressionStatement(
-          factory()->NewCallRuntime(Runtime::kAppendElement, args, nopos),
+      auto value = factory()->NewProperty(
+          factory()->NewVariableProxy(result),
+          factory()->NewStringLiteral(ast_value_factory()->value_string(),
+                                      nopos),
+          nopos);
+      store = factory()->NewExpressionStatement(
+          factory()->NewStoreInArrayLiteral(factory()->NewVariableProxy(array),
+                                            factory()->NewVariableProxy(index),
+                                            value, nopos),
           nopos);
     }
 
@@ -632,8 +637,8 @@ void PatternRewriter::VisitArrayLiteral(ArrayLiteral* node,
             factory()->NewBooleanLiteral(false, nopos), nopos),
         nopos);
 
-    // if (!result.done) { #append_element; #unset_done }
-    Statement* maybe_append_and_unset_done;
+    // if (!result.done) { #store; #unset_done }
+    Statement* maybe_store_and_unset_done;
     {
       Expression* result_done =
           factory()->NewProperty(factory()->NewVariableProxy(result),
@@ -642,27 +647,38 @@ void PatternRewriter::VisitArrayLiteral(ArrayLiteral* node,
                                  nopos);
 
       Block* then = factory()->NewBlock(2, true);
-      then->statements()->Add(append_element, zone());
+      then->statements()->Add(store, zone());
       then->statements()->Add(unset_done, zone());
 
-      maybe_append_and_unset_done = factory()->NewIfStatement(
+      maybe_store_and_unset_done = factory()->NewIfStatement(
           factory()->NewUnaryOperation(Token::NOT, result_done, nopos), then,
           factory()->NewEmptyStatement(nopos), nopos);
     }
 
+    // index++;
+    Statement* increment_index;
+    {
+      increment_index = factory()->NewExpressionStatement(
+          factory()->NewCountOperation(
+              Token::INC, false, factory()->NewVariableProxy(index), nopos),
+          nopos);
+    }
+
     // while (!done) {
     //   #set_done;
     //   #get_next;
-    //   #maybe_append_and_unset_done;
+    //   #maybe_store_and_unset_done;
+    //   #increment_index;
     // }
     WhileStatement* loop = factory()->NewWhileStatement(nullptr, nopos);
     {
       Expression* condition = factory()->NewUnaryOperation(
           Token::NOT, factory()->NewVariableProxy(done), nopos);
-      Block* body = factory()->NewBlock(3, true);
+      Block* body = factory()->NewBlock(4, true);
       body->statements()->Add(set_done, zone());
       body->statements()->Add(get_next, zone());
-      body->statements()->Add(maybe_append_and_unset_done, zone());
+      body->statements()->Add(maybe_store_and_unset_done, zone());
+      body->statements()->Add(increment_index, zone());
       loop->Initialize(condition, body);
     }
 
@@ -767,9 +783,11 @@ NOT_A_PATTERN(ResolvedProperty)
 NOT_A_PATTERN(ReturnStatement)
 NOT_A_PATTERN(SloppyBlockFunctionStatement)
 NOT_A_PATTERN(Spread)
+NOT_A_PATTERN(StoreInArrayLiteral)
 NOT_A_PATTERN(SuperPropertyReference)
 NOT_A_PATTERN(SuperCallReference)
 NOT_A_PATTERN(SwitchStatement)
+NOT_A_PATTERN(TemplateLiteral)
 NOT_A_PATTERN(ThisFunction)
 NOT_A_PATTERN(Throw)
 NOT_A_PATTERN(TryCatchStatement)
diff --git a/deps/v8/src/parsing/preparse-data-format.h b/deps/v8/src/parsing/preparse-data-format.h
deleted file mode 100644
index 2f317ce75f4..00000000000
--- a/deps/v8/src/parsing/preparse-data-format.h
+++ /dev/null
@@ -1,32 +0,0 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_PARSING_PREPARSE_DATA_FORMAT_H_
-#define V8_PARSING_PREPARSE_DATA_FORMAT_H_
-
-namespace v8 {
-namespace internal {
-
-// Generic and general data used by preparse data recorders and readers.
-
-struct PreparseDataConstants {
- public:
-  // Layout and constants of the preparse data exchange format.
-  static const unsigned kMagicNumber = 0xBadDead;
-  static const unsigned kCurrentVersion = 17;
-
-  static const int kMagicOffset = 0;
-  static const int kVersionOffset = 1;
-  static const int kFunctionsSizeOffset = 2;
-  static const int kSizeOffset = 3;
-  static const int kHeaderSize = 4;
-
-  static const unsigned char kNumberTerminator = 0x80u;
-};
-
-
-}  // namespace internal
-}  // namespace v8.
-
-#endif  // V8_PARSING_PREPARSE_DATA_FORMAT_H_
diff --git a/deps/v8/src/parsing/preparse-data.cc b/deps/v8/src/parsing/preparse-data.cc
index f11eb7b21ea..e39218111da 100644
--- a/deps/v8/src/parsing/preparse-data.cc
+++ b/deps/v8/src/parsing/preparse-data.cc
@@ -8,53 +8,10 @@
 #include "src/globals.h"
 #include "src/objects-inl.h"
 #include "src/parsing/parser.h"
-#include "src/parsing/preparse-data-format.h"
 
 namespace v8 {
 namespace internal {
 
-void ParserLogger::LogFunction(int start, int end, int num_parameters,
-                               LanguageMode language_mode,
-                               bool uses_super_property,
-                               int num_inner_functions) {
-  function_store_.Add(start);
-  function_store_.Add(end);
-  function_store_.Add(num_parameters);
-  function_store_.Add(
-      FunctionEntry::EncodeFlags(language_mode, uses_super_property));
-  function_store_.Add(num_inner_functions);
-}
-
-ParserLogger::ParserLogger() {
-  preamble_[PreparseDataConstants::kMagicOffset] =
-      PreparseDataConstants::kMagicNumber;
-  preamble_[PreparseDataConstants::kVersionOffset] =
-      PreparseDataConstants::kCurrentVersion;
-  preamble_[PreparseDataConstants::kFunctionsSizeOffset] = 0;
-  preamble_[PreparseDataConstants::kSizeOffset] = 0;
-  DCHECK_EQ(4, PreparseDataConstants::kHeaderSize);
-#ifdef DEBUG
-  prev_start_ = -1;
-#endif
-}
-
-ScriptData* ParserLogger::GetScriptData() {
-  int function_size = function_store_.size();
-  int total_size = PreparseDataConstants::kHeaderSize + function_size;
-  unsigned* data = NewArray<unsigned>(total_size);
-  preamble_[PreparseDataConstants::kFunctionsSizeOffset] = function_size;
-  MemCopy(data, preamble_, sizeof(preamble_));
-  if (function_size > 0) {
-    function_store_.WriteTo(Vector<unsigned>(
-        data + PreparseDataConstants::kHeaderSize, function_size));
-  }
-  DCHECK(IsAligned(reinterpret_cast<intptr_t>(data), kPointerAlignment));
-  ScriptData* result = new ScriptData(reinterpret_cast<byte*>(data),
-                                      total_size * sizeof(unsigned));
-  result->AcquireDataOwnership();
-  return result;
-}
-
 PreParseData::FunctionData PreParseData::GetFunctionData(int start) const {
   auto it = functions_.find(start);
   if (it != functions_.end()) {
diff --git a/deps/v8/src/parsing/preparse-data.h b/deps/v8/src/parsing/preparse-data.h
index b5db652c9cc..0e40c769278 100644
--- a/deps/v8/src/parsing/preparse-data.h
+++ b/deps/v8/src/parsing/preparse-data.h
@@ -11,43 +11,9 @@
 #include "src/base/hashmap.h"
 #include "src/collector.h"
 #include "src/messages.h"
-#include "src/parsing/preparse-data-format.h"
-
 namespace v8 {
 namespace internal {
 
-class ScriptData {
- public:
-  ScriptData(const byte* data, int length);
-  ~ScriptData() {
-    if (owns_data_) DeleteArray(data_);
-  }
-
-  const byte* data() const { return data_; }
-  int length() const { return length_; }
-  bool rejected() const { return rejected_; }
-
-  void Reject() { rejected_ = true; }
-
-  void AcquireDataOwnership() {
-    DCHECK(!owns_data_);
-    owns_data_ = true;
-  }
-
-  void ReleaseDataOwnership() {
-    DCHECK(owns_data_);
-    owns_data_ = false;
-  }
-
- private:
-  bool owns_data_ : 1;
-  bool rejected_ : 1;
-  const byte* data_;
-  int length_;
-
-  DISALLOW_COPY_AND_ASSIGN(ScriptData);
-};
-
 class PreParserLogger final {
  public:
   PreParserLogger()
@@ -74,25 +40,6 @@ class PreParserLogger final {
   int num_inner_functions_;
 };
 
-class ParserLogger final {
- public:
-  ParserLogger();
-
-  void LogFunction(int start, int end, int num_parameters,
-                   LanguageMode language_mode, bool uses_super_property,
-                   int num_inner_functions);
-
-  ScriptData* GetScriptData();
-
- private:
-  Collector<unsigned> function_store_;
-  unsigned preamble_[PreparseDataConstants::kHeaderSize];
-
-#ifdef DEBUG
-  int prev_start_;
-#endif
-};
-
 class PreParseData final {
  public:
   struct FunctionData {
diff --git a/deps/v8/src/parsing/preparsed-scope-data.cc b/deps/v8/src/parsing/preparsed-scope-data.cc
index 786be3f0e5c..70880f55c48 100644
--- a/deps/v8/src/parsing/preparsed-scope-data.cc
+++ b/deps/v8/src/parsing/preparsed-scope-data.cc
@@ -396,6 +396,7 @@ void ProducedPreParsedScopeData::SaveDataForVariable(Variable* var) {
   // Store the variable name in debug mode; this way we can check that we
   // restore data to the correct variable.
   const AstRawString* name = var->raw_name();
+  byte_data_->WriteUint8(name->is_one_byte());
   byte_data_->WriteUint32(name->length());
   for (int i = 0; i < name->length(); ++i) {
     byte_data_->WriteUint8(name->raw_data()[i]);
@@ -571,8 +572,7 @@ void ConsumedPreParsedScopeData::RestoreData(Scope* scope) {
   if (scope_data_->RemainingBytes() < kUint8Size) {
     // Temporary debugging code for detecting inconsistent data. Write debug
     // information on the stack, then crash.
-    data_->GetIsolate()->PushStackTraceAndDie(0xC0DEFEE, nullptr, nullptr,
-                                              0xC0DEFEE);
+    data_->GetIsolate()->PushStackTraceAndDie();
   }
 
   // scope_type is stored only in debug mode.
@@ -606,9 +606,20 @@ void ConsumedPreParsedScopeData::RestoreData(Scope* scope) {
 void ConsumedPreParsedScopeData::RestoreDataForVariable(Variable* var) {
 #ifdef DEBUG
   const AstRawString* name = var->raw_name();
+  bool data_one_byte = scope_data_->ReadUint8();
+  DCHECK_IMPLIES(name->is_one_byte(), data_one_byte);
   DCHECK_EQ(scope_data_->ReadUint32(), static_cast<uint32_t>(name->length()));
-  for (int i = 0; i < name->length(); ++i) {
-    DCHECK_EQ(scope_data_->ReadUint8(), name->raw_data()[i]);
+  if (!name->is_one_byte() && data_one_byte) {
+    // It's possible that "name" is a two-byte representation of the string
+    // stored in the data.
+    for (int i = 0; i < 2 * name->length(); i += 2) {
+      DCHECK_EQ(scope_data_->ReadUint8(), name->raw_data()[i]);
+      DCHECK_EQ(0, name->raw_data()[i + 1]);
+    }
+  } else {
+    for (int i = 0; i < name->length(); ++i) {
+      DCHECK_EQ(scope_data_->ReadUint8(), name->raw_data()[i]);
+    }
   }
 #endif
   uint8_t variable_data = scope_data_->ReadQuarter();
diff --git a/deps/v8/src/parsing/preparser.cc b/deps/v8/src/parsing/preparser.cc
index b28eab2e751..5bb58a03aa9 100644
--- a/deps/v8/src/parsing/preparser.cc
+++ b/deps/v8/src/parsing/preparser.cc
@@ -11,7 +11,6 @@
 #include "src/globals.h"
 #include "src/parsing/duplicate-finder.h"
 #include "src/parsing/parser-base.h"
-#include "src/parsing/preparse-data-format.h"
 #include "src/parsing/preparse-data.h"
 #include "src/parsing/preparsed-scope-data.h"
 #include "src/parsing/preparser.h"
@@ -50,6 +49,8 @@ PreParserIdentifier GetSymbolHelper(Scanner* scanner) {
       return PreParserIdentifier::Await();
     case Token::ASYNC:
       return PreParserIdentifier::Async();
+    case Token::PRIVATE_NAME:
+      return PreParserIdentifier::PrivateName();
     default:
       break;
   }
diff --git a/deps/v8/src/parsing/preparser.h b/deps/v8/src/parsing/preparser.h
index 705cd011eec..86fa7d11501 100644
--- a/deps/v8/src/parsing/preparser.h
+++ b/deps/v8/src/parsing/preparser.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_PARSING_PREPARSER_H
-#define V8_PARSING_PREPARSER_H
+#ifndef V8_PARSING_PREPARSER_H_
+#define V8_PARSING_PREPARSER_H_
 
 #include "src/ast/ast.h"
 #include "src/ast/scopes.h"
@@ -51,6 +51,9 @@ class PreParserIdentifier {
   static PreParserIdentifier Name() {
     return PreParserIdentifier(kNameIdentifier);
   }
+  static PreParserIdentifier PrivateName() {
+    return PreParserIdentifier(kPrivateNameIdentifier);
+  }
   bool IsNull() const { return type_ == kNullIdentifier; }
   bool IsEval() const { return type_ == kEvalIdentifier; }
   bool IsArguments() const { return type_ == kArgumentsIdentifier; }
@@ -58,6 +61,7 @@ class PreParserIdentifier {
   bool IsConstructor() const { return type_ == kConstructorIdentifier; }
   bool IsAwait() const { return type_ == kAwaitIdentifier; }
   bool IsName() const { return type_ == kNameIdentifier; }
+  bool IsPrivateName() const { return type_ == kPrivateNameIdentifier; }
 
  private:
   enum Type {
@@ -68,7 +72,8 @@ class PreParserIdentifier {
     kConstructorIdentifier,
     kAwaitIdentifier,
     kAsyncIdentifier,
-    kNameIdentifier
+    kNameIdentifier,
+    kPrivateNameIdentifier
   };
 
   explicit PreParserIdentifier(Type type) : type_(type), string_(nullptr) {}
@@ -169,6 +174,12 @@ class PreParserExpression {
                                variables);
   }
 
+  static PreParserExpression ThisPropertyWithPrivateFieldKey() {
+    return PreParserExpression(TypeField::encode(kExpression) |
+                               ExpressionTypeField::encode(
+                                   kThisPropertyExpressionWithPrivateFieldKey));
+  }
+
   static PreParserExpression ThisProperty() {
     return PreParserExpression(
         TypeField::encode(kExpression) |
@@ -181,6 +192,12 @@ class PreParserExpression {
         ExpressionTypeField::encode(kPropertyExpression));
   }
 
+  static PreParserExpression PropertyWithPrivateFieldKey() {
+    return PreParserExpression(
+        TypeField::encode(kExpression) |
+        ExpressionTypeField::encode(kPropertyExpressionWithPrivateFieldKey));
+  }
+
   static PreParserExpression Call() {
     return PreParserExpression(TypeField::encode(kExpression) |
                                ExpressionTypeField::encode(kCallExpression));
@@ -254,13 +271,27 @@ class PreParserExpression {
 
   bool IsThisProperty() const {
     return TypeField::decode(code_) == kExpression &&
-           ExpressionTypeField::decode(code_) == kThisPropertyExpression;
+           (ExpressionTypeField::decode(code_) == kThisPropertyExpression ||
+            ExpressionTypeField::decode(code_) ==
+                kThisPropertyExpressionWithPrivateFieldKey);
   }
 
   bool IsProperty() const {
     return TypeField::decode(code_) == kExpression &&
            (ExpressionTypeField::decode(code_) == kPropertyExpression ||
-            ExpressionTypeField::decode(code_) == kThisPropertyExpression);
+            ExpressionTypeField::decode(code_) == kThisPropertyExpression ||
+            ExpressionTypeField::decode(code_) ==
+                kPropertyExpressionWithPrivateFieldKey ||
+            ExpressionTypeField::decode(code_) ==
+                kThisPropertyExpressionWithPrivateFieldKey);
+  }
+
+  bool IsPropertyWithPrivateFieldKey() const {
+    return TypeField::decode(code_) == kExpression &&
+           (ExpressionTypeField::decode(code_) ==
+                kPropertyExpressionWithPrivateFieldKey ||
+            ExpressionTypeField::decode(code_) ==
+                kThisPropertyExpressionWithPrivateFieldKey);
   }
 
   bool IsCall() const {
@@ -298,12 +329,22 @@ class PreParserExpression {
   // and PreParser.
   PreParserExpression* operator->() { return this; }
 
+  void set_is_private_field() {
+    if (variables_ != nullptr) {
+      DCHECK(IsIdentifier());
+      DCHECK(AsIdentifier().IsPrivateName());
+      DCHECK_EQ(1, variables_->length());
+      variables_->first()->set_is_private_field();
+    }
+  }
+
   // More dummy implementations of things PreParser doesn't need to track:
   void SetShouldEagerCompile() {}
 
   int position() const { return kNoSourcePosition; }
   void set_function_token_position(int position) {}
   void set_scope(Scope* scope) {}
+  void set_suspend_count(int suspend_count) {}
 
  private:
   enum Type {
@@ -319,7 +360,9 @@ class PreParserExpression {
   enum ExpressionType {
     kThisExpression,
     kThisPropertyExpression,
+    kThisPropertyExpressionWithPrivateFieldKey,
     kPropertyExpression,
+    kPropertyExpressionWithPrivateFieldKey,
     kCallExpression,
     kCallEvalExpression,
     kCallTaggedTemplateExpression,
@@ -580,8 +623,16 @@ class PreParserFactory {
   PreParserExpression NewVariableProxy(void* variable) {
     return PreParserExpression::Default();
   }
+
   PreParserExpression NewProperty(const PreParserExpression& obj,
                                   const PreParserExpression& key, int pos) {
+    if (key.IsIdentifier() && key.AsIdentifier().IsPrivateName()) {
+      if (obj.IsThis()) {
+        return PreParserExpression::ThisPropertyWithPrivateFieldKey();
+      }
+      return PreParserExpression::PropertyWithPrivateFieldKey();
+    }
+
     if (obj.IsThis()) {
       return PreParserExpression::ThisProperty();
     }
@@ -984,6 +1035,10 @@ class PreParser : public ParserBase<PreParser> {
       TemplateLiteralState* state, int start, const PreParserExpression& tag) {
     return PreParserExpression::Default();
   }
+  V8_INLINE bool IsPropertyWithPrivateFieldKey(
+      const PreParserExpression& expression) {
+    return expression.IsPropertyWithPrivateFieldKey();
+  }
   V8_INLINE void CheckConflictingVarDeclarations(Scope* scope, bool* ok) {}
 
   V8_INLINE void SetLanguageMode(Scope* scope, LanguageMode mode) {
@@ -1142,16 +1197,23 @@ class PreParser : public ParserBase<PreParser> {
   }
   V8_INLINE void DeclareClassProperty(const PreParserIdentifier& class_name,
                                       const PreParserExpression& property,
+                                      const PreParserIdentifier& property_name,
                                       ClassLiteralProperty::Kind kind,
                                       bool is_static, bool is_constructor,
                                       bool is_computed_name,
                                       ClassInfo* class_info, bool* ok) {
-    if (kind == ClassLiteralProperty::FIELD && is_computed_name) {
+    if (kind == ClassLiteralProperty::PUBLIC_FIELD && is_computed_name) {
       scope()->DeclareVariableName(
           ClassFieldVariableName(ast_value_factory(),
                                  class_info->computed_field_count),
           CONST);
     }
+
+    if (kind == ClassLiteralProperty::PRIVATE_FIELD &&
+        property_name.string_ != nullptr) {
+      DCHECK(track_unresolved_variables_);
+      scope()->DeclareVariableName(property_name.string_, CONST);
+    }
   }
 
   V8_INLINE PreParserExpression
@@ -1528,10 +1590,6 @@ class PreParser : public ParserBase<PreParser> {
     return PreParserExpression::NewTargetExpression();
   }
 
-  V8_INLINE PreParserExpression FunctionSentExpression(int pos) {
-    return PreParserExpression::Default();
-  }
-
   V8_INLINE PreParserExpression ImportMetaExpression(int pos) {
     return PreParserExpression::Default();
   }
@@ -1707,4 +1765,4 @@ PreParserExpression PreParser::SpreadCallNew(
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_PARSING_PREPARSER_H
+#endif  // V8_PARSING_PREPARSER_H_
diff --git a/deps/v8/src/parsing/scanner.cc b/deps/v8/src/parsing/scanner.cc
index 3152ab184eb..942e5aecc57 100644
--- a/deps/v8/src/parsing/scanner.cc
+++ b/deps/v8/src/parsing/scanner.cc
@@ -182,7 +182,8 @@ Scanner::Scanner(UnicodeCache* unicode_cache)
       octal_pos_(Location::invalid()),
       octal_message_(MessageTemplate::kNone),
       found_html_comment_(false),
-      allow_harmony_bigint_(false) {}
+      allow_harmony_bigint_(false),
+      allow_harmony_numeric_separator_(false) {}
 
 void Scanner::Initialize(Utf16CharacterStream* source, bool is_module) {
   DCHECK_NOT_NULL(source);
@@ -1014,7 +1015,7 @@ bool Scanner::ScanEscape() {
     case '5':  // fall through
     case '6':  // fall through
     case '7':
-      c = ScanOctalEscape<capture_raw>(c, 2);
+      c = ScanOctalEscape<capture_raw>(c, 2, in_template_literal);
       break;
   }
 
@@ -1023,9 +1024,8 @@ bool Scanner::ScanEscape() {
   return true;
 }
 
-
 template <bool capture_raw>
-uc32 Scanner::ScanOctalEscape(uc32 c, int length) {
+uc32 Scanner::ScanOctalEscape(uc32 c, int length, bool in_template_literal) {
   uc32 x = c - '0';
   int i = 0;
   for (; i < length; i++) {
@@ -1043,7 +1043,9 @@ uc32 Scanner::ScanOctalEscape(uc32 c, int length) {
   // occur before the "use strict" directive.
   if (c != '0' || i > 0 || c0_ == '8' || c0_ == '9') {
     octal_pos_ = Location(source_pos() - i - 1, source_pos() - 1);
-    octal_message_ = MessageTemplate::kStrictOctalEscape;
+    octal_message_ = in_template_literal
+                         ? MessageTemplate::kTemplateOctalLiteral
+                         : MessageTemplate::kStrictOctalEscape;
   }
   return x;
 }
@@ -1071,8 +1073,11 @@ Token::Value Scanner::ScanString() {
     AddLiteralChar(c);
   }
 
-  while (c0_ != quote && c0_ != kEndOfInput &&
-         !unibrow::IsLineTerminator(c0_)) {
+  bool (*line_terminator_func)(unsigned int) =
+      FLAG_harmony_subsume_json ? unibrow::IsStringLiteralLineTerminator
+                                : unibrow::IsLineTerminator;
+
+  while (c0_ != quote && c0_ != kEndOfInput && !line_terminator_func(c0_)) {
     uc32 c = c0_;
     Advance();
     if (c == '\\') {
@@ -1220,23 +1225,168 @@ Handle<String> Scanner::SourceMappingUrl(Isolate* isolate) const {
   return tmp;
 }
 
-void Scanner::ScanDecimalDigits() {
-  while (IsDecimalDigit(c0_))
+bool Scanner::ScanDigitsWithNumericSeparators(bool (*predicate)(uc32 ch),
+                                              bool is_check_first_digit) {
+  // we must have at least one digit after 'x'/'b'/'o'
+  if (is_check_first_digit && !predicate(c0_)) return false;
+
+  bool separator_seen = false;
+  while (predicate(c0_) || c0_ == '_') {
+    if (c0_ == '_') {
+      Advance<false, false>();
+      if (c0_ == '_') {
+        ReportScannerError(Location(source_pos(), source_pos() + 1),
+                           MessageTemplate::kContinuousNumericSeparator);
+        return false;
+      }
+      separator_seen = true;
+      continue;
+    }
+    separator_seen = false;
     AddLiteralCharAdvance();
+  }
+
+  if (separator_seen) {
+    ReportScannerError(Location(source_pos(), source_pos() + 1),
+                       MessageTemplate::kTrailingNumericSeparator);
+    return false;
+  }
+
+  return true;
 }
 
+bool Scanner::ScanDecimalDigits() {
+  if (allow_harmony_numeric_separator()) {
+    return ScanDigitsWithNumericSeparators(&IsDecimalDigit, false);
+  }
+  while (IsDecimalDigit(c0_)) {
+    AddLiteralCharAdvance();
+  }
+  return true;
+}
+
+bool Scanner::ScanDecimalAsSmiWithNumericSeparators(uint64_t* value) {
+  bool separator_seen = false;
+  while (IsDecimalDigit(c0_) || c0_ == '_') {
+    if (c0_ == '_') {
+      Advance<false, false>();
+      if (c0_ == '_') {
+        ReportScannerError(Location(source_pos(), source_pos() + 1),
+                           MessageTemplate::kContinuousNumericSeparator);
+        return false;
+      }
+      separator_seen = true;
+      continue;
+    }
+    separator_seen = false;
+    *value = 10 * *value + (c0_ - '0');
+    uc32 first_char = c0_;
+    Advance<false, false>();
+    AddLiteralChar(first_char);
+  }
+
+  if (separator_seen) {
+    ReportScannerError(Location(source_pos(), source_pos() + 1),
+                       MessageTemplate::kTrailingNumericSeparator);
+    return false;
+  }
+
+  return true;
+}
+
+bool Scanner::ScanDecimalAsSmi(uint64_t* value) {
+  if (allow_harmony_numeric_separator()) {
+    return ScanDecimalAsSmiWithNumericSeparators(value);
+  }
+
+  while (IsDecimalDigit(c0_)) {
+    *value = 10 * *value + (c0_ - '0');
+    uc32 first_char = c0_;
+    Advance<false, false>();
+    AddLiteralChar(first_char);
+  }
+  return true;
+}
+
+bool Scanner::ScanBinaryDigits() {
+  if (allow_harmony_numeric_separator()) {
+    return ScanDigitsWithNumericSeparators(&IsBinaryDigit, true);
+  }
+
+  // we must have at least one binary digit after 'b'/'B'
+  if (!IsBinaryDigit(c0_)) {
+    return false;
+  }
+
+  while (IsBinaryDigit(c0_)) {
+    AddLiteralCharAdvance();
+  }
+  return true;
+}
+
+bool Scanner::ScanOctalDigits() {
+  if (allow_harmony_numeric_separator()) {
+    return ScanDigitsWithNumericSeparators(&IsOctalDigit, true);
+  }
+
+  // we must have at least one octal digit after 'o'/'O'
+  if (!IsOctalDigit(c0_)) {
+    return false;
+  }
+
+  while (IsOctalDigit(c0_)) {
+    AddLiteralCharAdvance();
+  }
+  return true;
+}
+
+bool Scanner::ScanImplicitOctalDigits(int start_pos,
+                                      Scanner::NumberKind* kind) {
+  *kind = IMPLICIT_OCTAL;
+
+  while (true) {
+    // (possible) octal number
+    if (c0_ == '8' || c0_ == '9') {
+      *kind = DECIMAL_WITH_LEADING_ZERO;
+      return true;
+    }
+    if (c0_ < '0' || '7' < c0_) {
+      // Octal literal finished.
+      octal_pos_ = Location(start_pos, source_pos());
+      octal_message_ = MessageTemplate::kStrictOctalLiteral;
+      return true;
+    }
+    AddLiteralCharAdvance();
+  }
+}
+
+bool Scanner::ScanHexDigits() {
+  if (allow_harmony_numeric_separator()) {
+    return ScanDigitsWithNumericSeparators(&IsHexDigit, true);
+  }
+
+  // we must have at least one hex digit after 'x'/'X'
+  if (!IsHexDigit(c0_)) {
+    return false;
+  }
+
+  while (IsHexDigit(c0_)) {
+    AddLiteralCharAdvance();
+  }
+  return true;
+}
+
+bool Scanner::ScanSignedInteger() {
+  if (c0_ == '+' || c0_ == '-') AddLiteralCharAdvance();
+  // we must have at least one decimal digit after 'e'/'E'
+  if (!IsDecimalDigit(c0_)) return false;
+  return ScanDecimalDigits();
+}
 
 Token::Value Scanner::ScanNumber(bool seen_period) {
   DCHECK(IsDecimalDigit(c0_));  // the first digit of the number or the fraction
 
-  enum {
-    DECIMAL,
-    DECIMAL_WITH_LEADING_ZERO,
-    HEX,
-    OCTAL,
-    IMPLICIT_OCTAL,
-    BINARY
-  } kind = DECIMAL;
+  NumberKind kind = DECIMAL;
 
   LiteralScope literal(this);
   bool at_start = !seen_period;
@@ -1244,8 +1394,11 @@ Token::Value Scanner::ScanNumber(bool seen_period) {
   if (seen_period) {
     // we have already seen a decimal point of the float
     AddLiteralChar('.');
-    ScanDecimalDigits();  // we know we have at least one digit
-
+    if (allow_harmony_numeric_separator() && c0_ == '_') {
+      return Token::ILLEGAL;
+    }
+    // we know we have at least one digit
+    if (!ScanDecimalDigits()) return Token::ILLEGAL;
   } else {
     // if the first character is '0' we must check for octals and hex
     if (c0_ == '0') {
@@ -1254,68 +1407,42 @@ Token::Value Scanner::ScanNumber(bool seen_period) {
       // either 0, 0exxx, 0Exxx, 0.xxx, a hex number, a binary number or
       // an octal number.
       if (c0_ == 'x' || c0_ == 'X') {
-        // hex number
-        kind = HEX;
         AddLiteralCharAdvance();
-        if (!IsHexDigit(c0_)) {
-          // we must have at least one hex digit after 'x'/'X'
-          return Token::ILLEGAL;
-        }
-        while (IsHexDigit(c0_)) {
-          AddLiteralCharAdvance();
-        }
+        kind = HEX;
+        if (!ScanHexDigits()) return Token::ILLEGAL;
       } else if (c0_ == 'o' || c0_ == 'O') {
-        kind = OCTAL;
         AddLiteralCharAdvance();
-        if (!IsOctalDigit(c0_)) {
-          // we must have at least one octal digit after 'o'/'O'
-          return Token::ILLEGAL;
-        }
-        while (IsOctalDigit(c0_)) {
-          AddLiteralCharAdvance();
-        }
+        kind = OCTAL;
+        if (!ScanOctalDigits()) return Token::ILLEGAL;
       } else if (c0_ == 'b' || c0_ == 'B') {
-        kind = BINARY;
         AddLiteralCharAdvance();
-        if (!IsBinaryDigit(c0_)) {
-          // we must have at least one binary digit after 'b'/'B'
-          return Token::ILLEGAL;
-        }
-        while (IsBinaryDigit(c0_)) {
-          AddLiteralCharAdvance();
-        }
+        kind = BINARY;
+        if (!ScanBinaryDigits()) return Token::ILLEGAL;
       } else if ('0' <= c0_ && c0_ <= '7') {
-        // (possible) octal number
         kind = IMPLICIT_OCTAL;
-        while (true) {
-          if (c0_ == '8' || c0_ == '9') {
-            at_start = false;
-            kind = DECIMAL_WITH_LEADING_ZERO;
-            break;
-          }
-          if (c0_  < '0' || '7'  < c0_) {
-            // Octal literal finished.
-            octal_pos_ = Location(start_pos, source_pos());
-            octal_message_ = MessageTemplate::kStrictOctalLiteral;
-            break;
-          }
-          AddLiteralCharAdvance();
+        if (!ScanImplicitOctalDigits(start_pos, &kind)) {
+          return Token::ILLEGAL;
+        }
+        if (kind == DECIMAL_WITH_LEADING_ZERO) {
+          at_start = false;
         }
       } else if (c0_ == '8' || c0_ == '9') {
         kind = DECIMAL_WITH_LEADING_ZERO;
+      } else if (allow_harmony_numeric_separator() && c0_ == '_') {
+        ReportScannerError(Location(source_pos(), source_pos() + 1),
+                           MessageTemplate::kZeroDigitNumericSeparator);
+        return Token::ILLEGAL;
       }
     }
 
     // Parse decimal digits and allow trailing fractional part.
     if (kind == DECIMAL || kind == DECIMAL_WITH_LEADING_ZERO) {
+      // This is an optimization for parsing Decimal numbers as Smi's.
       if (at_start) {
         uint64_t value = 0;
-        while (IsDecimalDigit(c0_)) {
-          value = 10 * value + (c0_ - '0');
-
-          uc32 first_char = c0_;
-          Advance<false, false>();
-          AddLiteralChar(first_char);
+        // scan subsequent decimal digits
+        if (!ScanDecimalAsSmi(&value)) {
+          return Token::ILLEGAL;
         }
 
         if (next_.literal_chars->one_byte_literal().length() <= 10 &&
@@ -1334,11 +1461,14 @@ Token::Value Scanner::ScanNumber(bool seen_period) {
         HandleLeadSurrogate();
       }
 
-      ScanDecimalDigits();  // optional
+      if (!ScanDecimalDigits()) return Token::ILLEGAL;
       if (c0_ == '.') {
         seen_period = true;
         AddLiteralCharAdvance();
-        ScanDecimalDigits();  // optional
+        if (allow_harmony_numeric_separator() && c0_ == '_') {
+          return Token::ILLEGAL;
+        }
+        if (!ScanDecimalDigits()) return Token::ILLEGAL;
       }
     }
   }
@@ -1362,17 +1492,14 @@ Token::Value Scanner::ScanNumber(bool seen_period) {
   } else if (c0_ == 'e' || c0_ == 'E') {
     // scan exponent, if any
     DCHECK(kind != HEX);  // 'e'/'E' must be scanned as part of the hex number
+
     if (!(kind == DECIMAL || kind == DECIMAL_WITH_LEADING_ZERO))
       return Token::ILLEGAL;
+
     // scan exponent
     AddLiteralCharAdvance();
-    if (c0_ == '+' || c0_ == '-')
-      AddLiteralCharAdvance();
-    if (!IsDecimalDigit(c0_)) {
-      // we must have at least one decimal digit after 'e'/'E'
-      return Token::ILLEGAL;
-    }
-    ScanDecimalDigits();
+
+    if (!ScanSignedInteger()) return Token::ILLEGAL;
   }
 
   // The source character immediately following a numeric literal must
@@ -1487,7 +1614,6 @@ uc32 Scanner::ScanUnicodeEscape() {
   KEYWORD_GROUP('r')                                        \
   KEYWORD("return", Token::RETURN)                          \
   KEYWORD_GROUP('s')                                        \
-  KEYWORD("sent", Token::SENT)                              \
   KEYWORD("set", Token::SET)                                \
   KEYWORD("static", Token::STATIC)                          \
   KEYWORD("super", Token::SUPER)                            \
@@ -1510,13 +1636,15 @@ uc32 Scanner::ScanUnicodeEscape() {
   KEYWORD_GROUP('y')                                        \
   KEYWORD("yield", Token::YIELD)                            \
   KEYWORD_GROUP('_')                                        \
-  KEYWORD("__proto__", Token::PROTO_UNDERSCORED)
+  KEYWORD("__proto__", Token::PROTO_UNDERSCORED)            \
+  KEYWORD_GROUP('#')                                        \
+  KEYWORD("#constructor", Token::PRIVATE_CONSTRUCTOR)
 
 static Token::Value KeywordOrIdentifierToken(const uint8_t* input,
                                              int input_length) {
   DCHECK_GE(input_length, 1);
   const int kMinLength = 2;
-  const int kMaxLength = 11;
+  const int kMaxLength = 12;
   if (input_length < kMinLength || input_length > kMaxLength) {
     return Token::IDENTIFIER;
   }
@@ -1551,6 +1679,9 @@ static Token::Value KeywordOrIdentifierToken(const uint8_t* input,
       KEYWORDS(KEYWORD_GROUP_CASE, KEYWORD)
   }
   return Token::IDENTIFIER;
+#undef KEYWORDS
+#undef KEYWORD
+#undef KEYWORD_GROUP_CASE
 }
 
 Token::Value Scanner::ScanIdentifierOrKeyword() {
diff --git a/deps/v8/src/parsing/scanner.h b/deps/v8/src/parsing/scanner.h
index f5106990ffe..77ea4d3272f 100644
--- a/deps/v8/src/parsing/scanner.h
+++ b/deps/v8/src/parsing/scanner.h
@@ -366,6 +366,12 @@ class Scanner {
   void set_allow_harmony_private_fields(bool allow) {
     allow_harmony_private_fields_ = allow;
   }
+  bool allow_harmony_numeric_separator() const {
+    return allow_harmony_numeric_separator_;
+  }
+  void set_allow_harmony_numeric_separator(bool allow) {
+    allow_harmony_numeric_separator_ = allow;
+  }
 
  private:
   // Scoped helper for saving & restoring scanner error state.
@@ -490,12 +496,21 @@ class Scanner {
     Token::Value contextual_token;
   };
 
+  enum NumberKind {
+    BINARY,
+    OCTAL,
+    IMPLICIT_OCTAL,
+    HEX,
+    DECIMAL,
+    DECIMAL_WITH_LEADING_ZERO
+  };
+
   static const int kCharacterLookaheadBufferSize = 1;
   const int kMaxAscii = 127;
 
   // Scans octal escape sequence. Also accepts "\0" decimal escape sequence.
   template <bool capture_raw>
-  uc32 ScanOctalEscape(uc32 c, int length);
+  uc32 ScanOctalEscape(uc32 c, int length, bool in_template_literal);
 
   // Call this after setting source_ to the input.
   void Init() {
@@ -720,7 +735,18 @@ class Scanner {
   // Scans a possible HTML comment -- begins with '<!'.
   Token::Value ScanHtmlComment();
 
-  void ScanDecimalDigits();
+  bool ScanDigitsWithNumericSeparators(bool (*predicate)(uc32 ch),
+                                       bool is_check_first_digit);
+  bool ScanDecimalDigits();
+  // Optimized function to scan decimal number as Smi.
+  bool ScanDecimalAsSmi(uint64_t* value);
+  bool ScanDecimalAsSmiWithNumericSeparators(uint64_t* value);
+  bool ScanHexDigits();
+  bool ScanBinaryDigits();
+  bool ScanSignedInteger();
+  bool ScanOctalDigits();
+  bool ScanImplicitOctalDigits(int start_pos, NumberKind* kind);
+
   Token::Value ScanNumber(bool seen_period);
   Token::Value ScanIdentifierOrKeyword();
   Token::Value ScanIdentifierOrKeywordInner(LiteralScope* literal);
@@ -811,6 +837,7 @@ class Scanner {
   // Harmony flags to allow ESNext features.
   bool allow_harmony_bigint_;
   bool allow_harmony_private_fields_;
+  bool allow_harmony_numeric_separator_;
 
   MessageTemplate::Template scanner_error_;
   Location scanner_error_location_;
diff --git a/deps/v8/src/parsing/token.h b/deps/v8/src/parsing/token.h
index 07974edf41b..660f24361c0 100644
--- a/deps/v8/src/parsing/token.h
+++ b/deps/v8/src/parsing/token.h
@@ -188,13 +188,13 @@ namespace internal {
   C(SET, "set", 0)                                                 \
   C(OF, "of", 0)                                                   \
   C(TARGET, "target", 0)                                           \
-  C(SENT, "sent", 0)                                               \
   C(META, "meta", 0)                                               \
   C(AS, "as", 0)                                                   \
   C(FROM, "from", 0)                                               \
   C(NAME, "name", 0)                                               \
   C(PROTO_UNDERSCORED, "__proto__", 0)                             \
   C(CONSTRUCTOR, "constructor", 0)                                 \
+  C(PRIVATE_CONSTRUCTOR, "#constructor", 0)                        \
   C(PROTOTYPE, "prototype", 0)                                     \
   C(EVAL, "eval", 0)                                               \
   C(ARGUMENTS, "arguments", 0)                                     \
diff --git a/deps/v8/src/perf-jit.cc b/deps/v8/src/perf-jit.cc
index 7ccd02ef9b6..65232eb42ca 100644
--- a/deps/v8/src/perf-jit.cc
+++ b/deps/v8/src/perf-jit.cc
@@ -31,8 +31,10 @@
 
 #include "src/assembler.h"
 #include "src/eh-frame.h"
+#include "src/instruction-stream.h"
 #include "src/objects-inl.h"
 #include "src/source-position-table.h"
+#include "src/wasm/wasm-code-manager.h"
 
 #if V8_OS_LINUX
 #include <fcntl.h>
@@ -213,7 +215,11 @@ void PerfJitLogger::LogRecordedBuffer(AbstractCode* abstract_code,
 
   // Debug info has to be emitted first.
   if (FLAG_perf_prof && shared != nullptr) {
-    LogWriteDebugInfo(code, shared);
+    // TODO(herhut): This currently breaks for js2wasm/wasm2js functions.
+    if (code->kind() != Code::JS_TO_WASM_FUNCTION &&
+        code->kind() != Code::WASM_TO_JS_FUNCTION) {
+      LogWriteDebugInfo(code, shared);
+    }
   }
 
   const char* code_name = name;
@@ -226,16 +232,32 @@ void PerfJitLogger::LogRecordedBuffer(AbstractCode* abstract_code,
   // Unwinding info comes right after debug info.
   if (FLAG_perf_prof_unwinding_info) LogWriteUnwindingInfo(code);
 
+  WriteJitCodeLoadEntry(code_pointer, code_size, code_name, length);
+}
+
+void PerfJitLogger::LogRecordedBuffer(const wasm::WasmCode* code,
+                                      const char* name, int length) {
+  base::LockGuard<base::RecursiveMutex> guard_file(file_mutex_.Pointer());
+
+  if (perf_output_handle_ == nullptr) return;
+
+  WriteJitCodeLoadEntry(code->instructions().start(),
+                        code->instructions().length(), name, length);
+}
+
+void PerfJitLogger::WriteJitCodeLoadEntry(const uint8_t* code_pointer,
+                                          uint32_t code_size, const char* name,
+                                          int name_length) {
   static const char string_terminator[] = "\0";
 
   PerfJitCodeLoad code_load;
   code_load.event_ = PerfJitCodeLoad::kLoad;
-  code_load.size_ = sizeof(code_load) + length + 1 + code_size;
+  code_load.size_ = sizeof(code_load) + name_length + 1 + code_size;
   code_load.time_stamp_ = GetTimestamp();
   code_load.process_id_ =
       static_cast<uint32_t>(base::OS::GetCurrentProcessId());
   code_load.thread_id_ = static_cast<uint32_t>(base::OS::GetCurrentThreadId());
-  code_load.vma_ = 0x0;  //  Our addresses are absolute.
+  code_load.vma_ = reinterpret_cast<uint64_t>(code_pointer);
   code_load.code_address_ = reinterpret_cast<uint64_t>(code_pointer);
   code_load.code_size_ = code_size;
   code_load.code_id_ = code_index_;
@@ -243,7 +265,7 @@ void PerfJitLogger::LogRecordedBuffer(AbstractCode* abstract_code,
   code_index_++;
 
   LogWriteBytes(reinterpret_cast<const char*>(&code_load), sizeof(code_load));
-  LogWriteBytes(code_name, length);
+  LogWriteBytes(name, name_length);
   LogWriteBytes(string_terminator, 1);
   LogWriteBytes(reinterpret_cast<const char*>(code_pointer), code_size);
 }
@@ -288,6 +310,8 @@ void PerfJitLogger::LogWriteDebugInfo(Code* code, SharedFunctionInfo* shared) {
     entry_count++;
   }
   if (entry_count == 0) return;
+  // The WasmToJS wrapper stubs have source position entries.
+  if (!shared->HasSourceCode()) return;
   Handle<Script> script(Script::cast(shared->script()));
 
   PerfJitCodeDebugInfo debug_info;
diff --git a/deps/v8/src/perf-jit.h b/deps/v8/src/perf-jit.h
index 2b0b4831e0c..ef83e9423d1 100644
--- a/deps/v8/src/perf-jit.h
+++ b/deps/v8/src/perf-jit.h
@@ -54,6 +54,8 @@ class PerfJitLogger : public CodeEventLogger {
   uint64_t GetTimestamp();
   void LogRecordedBuffer(AbstractCode* code, SharedFunctionInfo* shared,
                          const char* name, int length) override;
+  void LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
+                         int length) override;
 
   // Extension added to V8 log file name to get the low-level log name.
   static const char kFilenameFormatString[];
@@ -63,6 +65,9 @@ class PerfJitLogger : public CodeEventLogger {
   // minimize the associated overhead.
   static const int kLogBufferSize = 2 * MB;
 
+  void WriteJitCodeLoadEntry(const uint8_t* code_pointer, uint32_t code_size,
+                             const char* name, int name_length);
+
   void LogWriteBytes(const char* bytes, int size);
   void LogWriteHeader();
   void LogWriteDebugInfo(Code* code, SharedFunctionInfo* shared);
@@ -126,9 +131,15 @@ class PerfJitLogger : public CodeEventLogger {
                          const char* name, int length) override {
     UNIMPLEMENTED();
   }
+
+  void LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
+                         int length) override {
+    UNIMPLEMENTED();
+  }
 };
 
 #endif  // V8_OS_LINUX
 }  // namespace internal
 }  // namespace v8
-#endif
+
+#endif  // V8_PERF_JIT_H_
diff --git a/deps/v8/src/ppc/assembler-ppc-inl.h b/deps/v8/src/ppc/assembler-ppc-inl.h
index 451a1afa465..996f06bfbdd 100644
--- a/deps/v8/src/ppc/assembler-ppc-inl.h
+++ b/deps/v8/src/ppc/assembler-ppc-inl.h
@@ -46,8 +46,7 @@
 namespace v8 {
 namespace internal {
 
-
-bool CpuFeatures::SupportsCrankshaft() { return true; }
+bool CpuFeatures::SupportsOptimizer() { return true; }
 
 bool CpuFeatures::SupportsWasmSimd128() { return false; }
 
@@ -61,8 +60,8 @@ void RelocInfo::apply(intptr_t delta) {
     // mov sequence
     DCHECK(IsInternalReferenceEncoded(rmode_));
     Address target = Assembler::target_address_at(pc_, constant_pool_);
-    Assembler::set_target_address_at(nullptr, pc_, constant_pool_,
-                                     target + delta, SKIP_ICACHE_FLUSH);
+    Assembler::set_target_address_at(pc_, constant_pool_, target + delta,
+                                     SKIP_ICACHE_FLUSH);
   }
 }
 
@@ -92,7 +91,8 @@ Address RelocInfo::target_address() {
 
 Address RelocInfo::target_address_address() {
   DCHECK(IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_) || IsWasmCall(rmode_) ||
-         rmode_ == EMBEDDED_OBJECT || rmode_ == EXTERNAL_REFERENCE);
+         IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
+         IsOffHeapTarget(rmode_));
 
   if (FLAG_enable_embedded_constant_pool &&
       Assembler::IsConstantPoolLoadStart(pc_)) {
@@ -177,7 +177,7 @@ void RelocInfo::set_target_object(HeapObject* target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
-  Assembler::set_target_address_at(target->GetIsolate(), pc_, constant_pool_,
+  Assembler::set_target_address_at(pc_, constant_pool_,
                                    reinterpret_cast<Address>(target),
                                    icache_flush_mode);
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr) {
@@ -199,15 +199,20 @@ Address RelocInfo::target_runtime_entry(Assembler* origin) {
   return target_address();
 }
 
-void RelocInfo::set_target_runtime_entry(Isolate* isolate, Address target,
+void RelocInfo::set_target_runtime_entry(Address target,
                                          WriteBarrierMode write_barrier_mode,
                                          ICacheFlushMode icache_flush_mode) {
   DCHECK(IsRuntimeEntry(rmode_));
   if (target_address() != target)
-    set_target_address(isolate, target, write_barrier_mode, icache_flush_mode);
+    set_target_address(target, write_barrier_mode, icache_flush_mode);
 }
 
-void RelocInfo::WipeOut(Isolate* isolate) {
+Address RelocInfo::target_off_heap_target() {
+  DCHECK(IsOffHeapTarget(rmode_));
+  return Assembler::target_address_at(pc_, constant_pool_);
+}
+
+void RelocInfo::WipeOut() {
   DCHECK(IsEmbeddedObject(rmode_) || IsCodeTarget(rmode_) ||
          IsRuntimeEntry(rmode_) || IsExternalReference(rmode_) ||
          IsInternalReference(rmode_) || IsInternalReferenceEncoded(rmode_));
@@ -217,15 +222,15 @@ void RelocInfo::WipeOut(Isolate* isolate) {
   } else if (IsInternalReferenceEncoded(rmode_)) {
     // mov sequence
     // Currently used only by deserializer, no need to flush.
-    Assembler::set_target_address_at(isolate, pc_, constant_pool_, nullptr,
+    Assembler::set_target_address_at(pc_, constant_pool_, nullptr,
                                      SKIP_ICACHE_FLUSH);
   } else {
-    Assembler::set_target_address_at(isolate, pc_, constant_pool_, nullptr);
+    Assembler::set_target_address_at(pc_, constant_pool_, nullptr);
   }
 }
 
 template <typename ObjectVisitor>
-void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
+void RelocInfo::Visit(ObjectVisitor* visitor) {
   RelocInfo::Mode mode = rmode();
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
@@ -238,10 +243,12 @@ void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
     visitor->VisitInternalReference(host(), this);
   } else if (IsRuntimeEntry(mode)) {
     visitor->VisitRuntimeEntry(host(), this);
+  } else if (RelocInfo::IsOffHeapTarget(mode)) {
+    visitor->VisitOffHeapTarget(host(), this);
   }
 }
 
-Operand::Operand(Register rm) : rm_(rm), rmode_(kRelocInfo_NONEPTR) {}
+Operand::Operand(Register rm) : rm_(rm), rmode_(RelocInfo::NONE) {}
 
 void Assembler::UntrackBranch() {
   DCHECK(!trampoline_emitted_);
@@ -414,16 +421,15 @@ Address Assembler::target_constant_pool_address_at(
 // has already deserialized the mov instructions etc.
 // There is a FIXED_SEQUENCE assumption here
 void Assembler::deserialization_set_special_target_at(
-    Isolate* isolate, Address instruction_payload, Code* code, Address target) {
-  set_target_address_at(isolate, instruction_payload,
+    Address instruction_payload, Code* code, Address target) {
+  set_target_address_at(instruction_payload,
                         code ? code->constant_pool() : nullptr, target);
 }
 
-
 void Assembler::deserialization_set_target_internal_reference_at(
-    Isolate* isolate, Address pc, Address target, RelocInfo::Mode mode) {
+    Address pc, Address target, RelocInfo::Mode mode) {
   if (RelocInfo::IsInternalReferenceEncoded(mode)) {
-    set_target_address_at(isolate, pc, nullptr, target, SKIP_ICACHE_FLUSH);
+    set_target_address_at(pc, nullptr, target, SKIP_ICACHE_FLUSH);
   } else {
     Memory::Address_at(pc) = target;
   }
@@ -431,11 +437,9 @@ void Assembler::deserialization_set_target_internal_reference_at(
 
 
 // This code assumes the FIXED_SEQUENCE of lis/ori
-void Assembler::set_target_address_at(Isolate* isolate, Address pc,
-                                      Address constant_pool, Address target,
+void Assembler::set_target_address_at(Address pc, Address constant_pool,
+                                      Address target,
                                       ICacheFlushMode icache_flush_mode) {
-  DCHECK_IMPLIES(isolate == nullptr, icache_flush_mode == SKIP_ICACHE_FLUSH);
-
   if (FLAG_enable_embedded_constant_pool && constant_pool) {
     ConstantPoolEntry::Access access;
     if (IsConstantPoolLoadStart(pc, &access)) {
@@ -477,7 +481,7 @@ void Assembler::set_target_address_at(Isolate* isolate, Address pc,
     *(p + 3) = instr4;
     *(p + 4) = instr5;
     if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-      Assembler::FlushICache(isolate, p, 5 * kInstrSize);
+      Assembler::FlushICache(p, 5 * kInstrSize);
     }
 #else
     uint32_t* p = reinterpret_cast<uint32_t*>(pc);
@@ -492,7 +496,7 @@ void Assembler::set_target_address_at(Isolate* isolate, Address pc,
     *p = instr1;
     *(p + 1) = instr2;
     if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-      Assembler::FlushICache(isolate, p, 2 * kInstrSize);
+      Assembler::FlushICache(p, 2 * kInstrSize);
     }
 #endif
     return;
diff --git a/deps/v8/src/ppc/assembler-ppc.cc b/deps/v8/src/ppc/assembler-ppc.cc
index 90b18b02bad..4c59c9584da 100644
--- a/deps/v8/src/ppc/assembler-ppc.cc
+++ b/deps/v8/src/ppc/assembler-ppc.cc
@@ -170,22 +170,20 @@ uint32_t RelocInfo::embedded_size() const {
       Assembler::target_address_at(pc_, constant_pool_)));
 }
 
-void RelocInfo::set_embedded_address(Isolate* isolate, Address address,
+void RelocInfo::set_embedded_address(Address address,
                                      ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(isolate, pc_, constant_pool_, address,
-                                   flush_mode);
+  Assembler::set_target_address_at(pc_, constant_pool_, address, flush_mode);
 }
 
-void RelocInfo::set_embedded_size(Isolate* isolate, uint32_t size,
-                                  ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(isolate, pc_, constant_pool_,
+void RelocInfo::set_embedded_size(uint32_t size, ICacheFlushMode flush_mode) {
+  Assembler::set_target_address_at(pc_, constant_pool_,
                                    reinterpret_cast<Address>(size), flush_mode);
 }
 
-void RelocInfo::set_js_to_wasm_address(Isolate* isolate, Address address,
+void RelocInfo::set_js_to_wasm_address(Address address,
                                        ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  set_embedded_address(isolate, address, icache_flush_mode);
+  set_embedded_address(address, icache_flush_mode);
 }
 
 Address RelocInfo::js_to_wasm_address() const {
@@ -240,7 +238,7 @@ void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
     }
     Address pc = buffer_ + request.offset();
     Address constant_pool = nullptr;
-    set_target_address_at(nullptr, pc, constant_pool,
+    set_target_address_at(pc, constant_pool,
                           reinterpret_cast<Address>(object.location()),
                           SKIP_ICACHE_FLUSH);
   }
@@ -2004,7 +2002,7 @@ void Assembler::GrowBuffer(int needed) {
   // Some internal data structures overflow for very large buffers,
   // they must ensure that kMaximalBufferSize is not too large.
   if (desc.buffer_size > kMaximalBufferSize) {
-    V8::FatalProcessOutOfMemory("Assembler::GrowBuffer");
+    V8::FatalProcessOutOfMemory(nullptr, "Assembler::GrowBuffer");
   }
 
   // Set up new buffer.
@@ -2093,8 +2091,7 @@ void Assembler::EmitRelocations() {
     } else if (RelocInfo::IsInternalReferenceEncoded(rmode)) {
       // mov sequence
       intptr_t pos = reinterpret_cast<intptr_t>(target_address_at(pc, nullptr));
-      set_target_address_at(nullptr, pc, nullptr, buffer_ + pos,
-                            SKIP_ICACHE_FLUSH);
+      set_target_address_at(pc, nullptr, buffer_ + pos, SKIP_ICACHE_FLUSH);
     }
 
     reloc_info_writer.Write(&rinfo);
@@ -2150,10 +2147,6 @@ PatchingAssembler::~PatchingAssembler() {
   DCHECK_EQ(reloc_info_writer.pos(), buffer_ + buffer_size_);
 }
 
-void PatchingAssembler::FlushICache(Isolate* isolate) {
-  Assembler::FlushICache(isolate, buffer_, buffer_size_ - kGap);
-}
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/ppc/assembler-ppc.h b/deps/v8/src/ppc/assembler-ppc.h
index 0204d65fa57..2ba8e387957 100644
--- a/deps/v8/src/ppc/assembler-ppc.h
+++ b/deps/v8/src/ppc/assembler-ppc.h
@@ -287,8 +287,8 @@ class Register : public RegisterBase<Register, kRegAfterLast> {
   explicit constexpr Register(int code) : RegisterBase(code) {}
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(Register) &&
-                  sizeof(Register) == sizeof(int),
+ASSERT_TRIVIALLY_COPYABLE(Register);
+static_assert(sizeof(Register) == sizeof(int),
               "Register can efficiently be passed by value");
 
 #define DEFINE_REGISTER(R) \
@@ -329,8 +329,8 @@ class DoubleRegister : public RegisterBase<DoubleRegister, kDoubleAfterLast> {
   explicit constexpr DoubleRegister(int code) : RegisterBase(code) {}
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(DoubleRegister) &&
-                  sizeof(DoubleRegister) == sizeof(int),
+ASSERT_TRIVIALLY_COPYABLE(DoubleRegister);
+static_assert(sizeof(DoubleRegister) == sizeof(int),
               "DoubleRegister can efficiently be passed by value");
 
 typedef DoubleRegister FloatRegister;
@@ -373,18 +373,12 @@ C_REGISTERS(DECLARE_C_REGISTER)
 // -----------------------------------------------------------------------------
 // Machine instruction Operands
 
-#if V8_TARGET_ARCH_PPC64
-constexpr RelocInfo::Mode kRelocInfo_NONEPTR = RelocInfo::NONE64;
-#else
-constexpr RelocInfo::Mode kRelocInfo_NONEPTR = RelocInfo::NONE32;
-#endif
-
 // Class Operand represents a shifter operand in data processing instructions
 class Operand BASE_EMBEDDED {
  public:
   // immediate
   INLINE(explicit Operand(intptr_t immediate,
-                          RelocInfo::Mode rmode = kRelocInfo_NONEPTR)
+                          RelocInfo::Mode rmode = RelocInfo::NONE)
          : rmode_(rmode)) {
     value_.immediate = immediate;
   }
@@ -394,7 +388,7 @@ class Operand BASE_EMBEDDED {
     value_.immediate = reinterpret_cast<intptr_t>(f.address());
   }
   explicit Operand(Handle<HeapObject> handle);
-  INLINE(explicit Operand(Smi* value) : rmode_(kRelocInfo_NONEPTR)) {
+  INLINE(explicit Operand(Smi* value) : rmode_(RelocInfo::NONE)) {
     value_.immediate = reinterpret_cast<intptr_t>(value);
   }
   // rm
@@ -456,7 +450,6 @@ class MemOperand BASE_EMBEDDED {
   explicit MemOperand(Register ra, Register rb);
 
   int32_t offset() const {
-    DCHECK(rb_ == no_reg);
     return offset_;
   }
 
@@ -581,7 +574,7 @@ class Assembler : public AssemblerBase {
   // The isolate argument is unused (and may be nullptr) when skipping flushing.
   INLINE(static Address target_address_at(Address pc, Address constant_pool));
   INLINE(static void set_target_address_at(
-      Isolate* isolate, Address pc, Address constant_pool, Address target,
+      Address pc, Address constant_pool, Address target,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED));
 
   // Return the code target address at a call site from the return address
@@ -595,12 +588,11 @@ class Assembler : public AssemblerBase {
   // This sets the branch destination.
   // This is for calls and branches within generated code.
   inline static void deserialization_set_special_target_at(
-      Isolate* isolate, Address instruction_payload, Code* code,
-      Address target);
+      Address instruction_payload, Code* code, Address target);
 
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
-      Isolate* isolate, Address pc, Address target,
+      Address pc, Address target,
       RelocInfo::Mode mode = RelocInfo::INTERNAL_REFERENCE);
 
   // Size of an instruction.
@@ -1664,8 +1656,6 @@ class PatchingAssembler : public Assembler {
  public:
   PatchingAssembler(IsolateData isolate_data, byte* address, int instructions);
   ~PatchingAssembler();
-
-  void FlushICache(Isolate* isolate);
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/ppc/code-stubs-ppc.cc b/deps/v8/src/ppc/code-stubs-ppc.cc
index 5c3d38786f8..742d89a5900 100644
--- a/deps/v8/src/ppc/code-stubs-ppc.cc
+++ b/deps/v8/src/ppc/code-stubs-ppc.cc
@@ -449,6 +449,11 @@ void CEntryStub::Generate(MacroAssembler* masm) {
   __ StoreP(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
   __ bind(&skip);
 
+  // Reset the masking register.
+  if (FLAG_branch_load_poisoning) {
+    __ ResetSpeculationPoisonRegister();
+  }
+
   // Compute the handler entry address and jump to it.
   ConstantPoolUnavailableScope constant_pool_unavailable(masm);
   __ mov(ip, Operand(pending_handler_entrypoint_address));
diff --git a/deps/v8/src/ppc/codegen-ppc.cc b/deps/v8/src/ppc/codegen-ppc.cc
index 4641dc260c6..a2a9013b1ca 100644
--- a/deps/v8/src/ppc/codegen-ppc.cc
+++ b/deps/v8/src/ppc/codegen-ppc.cc
@@ -7,6 +7,7 @@
 #include <memory>
 
 #include "src/codegen.h"
+#include "src/isolate.h"
 #include "src/macro-assembler.h"
 #include "src/ppc/simulator-ppc.h"
 
@@ -36,10 +37,9 @@ UnaryMathFunctionWithIsolate CreateSqrtFunction(Isolate* isolate) {
 
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
-  DCHECK(ABI_USES_FUNCTION_DESCRIPTORS ||
-         !RelocInfo::RequiresRelocation(isolate, desc));
+  DCHECK(ABI_USES_FUNCTION_DESCRIPTORS || !RelocInfo::RequiresRelocation(desc));
 
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   CHECK(SetPermissions(buffer, allocated, PageAllocator::kReadExecute));
   return FUNCTION_CAST<UnaryMathFunctionWithIsolate>(buffer);
 #endif
diff --git a/deps/v8/src/ppc/disasm-ppc.cc b/deps/v8/src/ppc/disasm-ppc.cc
index 7e962e7849e..5564fd9c329 100644
--- a/deps/v8/src/ppc/disasm-ppc.cc
+++ b/deps/v8/src/ppc/disasm-ppc.cc
@@ -269,6 +269,7 @@ int Decoder::FormatOption(Instruction* instr, const char* format) {
             converter_.NameOfAddress(reinterpret_cast<byte*>(instr) + off));
         return 8;
       }
+      break;
       case 's': {
         DCHECK_EQ(format[1], 'h');
         int32_t value = 0;
diff --git a/deps/v8/src/ppc/frame-constants-ppc.h b/deps/v8/src/ppc/frame-constants-ppc.h
index ee7f29937bf..c822de877b5 100644
--- a/deps/v8/src/ppc/frame-constants-ppc.h
+++ b/deps/v8/src/ppc/frame-constants-ppc.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_PPC_FRAMES_PPC_H_
-#define V8_PPC_FRAMES_PPC_H_
+#ifndef V8_PPC_FRAME_CONSTANTS_PPC_H_
+#define V8_PPC_FRAME_CONSTANTS_PPC_H_
 
 #include "src/frame-constants.h"
 
@@ -47,4 +47,4 @@ class JavaScriptFrameConstants : public AllStatic {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_PPC_FRAMES_PPC_H_
+#endif  // V8_PPC_FRAME_CONSTANTS_PPC_H_
diff --git a/deps/v8/src/ppc/interface-descriptors-ppc.cc b/deps/v8/src/ppc/interface-descriptors-ppc.cc
index 069fcb26ada..23245b153be 100644
--- a/deps/v8/src/ppc/interface-descriptors-ppc.cc
+++ b/deps/v8/src/ppc/interface-descriptors-ppc.cc
@@ -67,12 +67,6 @@ const Register MathPowIntegerDescriptor::exponent() {
 const Register GrowArrayElementsDescriptor::ObjectRegister() { return r3; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return r6; }
 
-void FastNewClosureDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {r4, r5, r6};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
 
 // static
 const Register TypeConversionDescriptor::ArgumentRegister() { return r3; }
@@ -290,8 +284,8 @@ void ApiCallbackDescriptor::InitializePlatformSpecific(
 void InterpreterDispatchDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
-  kInterpreterAccumulatorRegister, kInterpreterBytecodeOffsetRegister,
-  kInterpreterBytecodeArrayRegister, kInterpreterDispatchTableRegister};
+      kInterpreterAccumulatorRegister, kInterpreterBytecodeOffsetRegister,
+      kInterpreterBytecodeArrayRegister, kInterpreterDispatchTableRegister};
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
diff --git a/deps/v8/src/ppc/macro-assembler-ppc.cc b/deps/v8/src/ppc/macro-assembler-ppc.cc
index 8d7c3d05b4a..be7151c4705 100644
--- a/deps/v8/src/ppc/macro-assembler-ppc.cc
+++ b/deps/v8/src/ppc/macro-assembler-ppc.cc
@@ -15,6 +15,7 @@
 #include "src/debug/debug.h"
 #include "src/external-reference-table.h"
 #include "src/frames-inl.h"
+#include "src/instruction-stream.h"
 #include "src/register-configuration.h"
 #include "src/runtime/runtime.h"
 
@@ -167,7 +168,7 @@ void TurboAssembler::Call(Register target) {
 }
 
 void MacroAssembler::CallJSEntry(Register target) {
-  DCHECK(target == ip);
+  CHECK(target == r5);
   Call(target);
 }
 
@@ -824,7 +825,7 @@ void TurboAssembler::ShiftRightAlgPair(Register dst_low, Register dst_high,
 }
 #endif
 
-void MacroAssembler::LoadConstantPoolPointerRegisterFromCodeTargetAddress(
+void TurboAssembler::LoadConstantPoolPointerRegisterFromCodeTargetAddress(
     Register code_target_address) {
   lwz(kConstantPoolRegister,
       MemOperand(code_target_address,
@@ -832,40 +833,34 @@ void MacroAssembler::LoadConstantPoolPointerRegisterFromCodeTargetAddress(
   add(kConstantPoolRegister, kConstantPoolRegister, code_target_address);
 }
 
-void TurboAssembler::LoadConstantPoolPointerRegister(Register base,
-                                                     int code_start_delta) {
-  add_label_offset(kConstantPoolRegister, base, ConstantPoolPosition(),
-                   code_start_delta);
+void TurboAssembler::LoadPC(Register dst) {
+  b(4, SetLK);
+  mflr(dst);
 }
 
 void TurboAssembler::LoadConstantPoolPointerRegister() {
-  mov_label_addr(kConstantPoolRegister, ConstantPoolPosition());
+  LoadPC(kConstantPoolRegister);
+  add_label_offset(kConstantPoolRegister, kConstantPoolRegister,
+                   ConstantPoolPosition(), -pc_offset() + 4);
 }
 
-void TurboAssembler::StubPrologue(StackFrame::Type type, Register base,
-                                  int prologue_offset) {
+void TurboAssembler::StubPrologue(StackFrame::Type type) {
   {
     ConstantPoolUnavailableScope constant_pool_unavailable(this);
     mov(r11, Operand(StackFrame::TypeToMarker(type)));
     PushCommonFrame(r11);
   }
   if (FLAG_enable_embedded_constant_pool) {
-    if (base != no_reg) {
-      // base contains prologue address
-      LoadConstantPoolPointerRegister(base, -prologue_offset);
-    } else {
-      LoadConstantPoolPointerRegister();
-    }
+    LoadConstantPoolPointerRegister();
     set_constant_pool_available(true);
   }
 }
 
-void TurboAssembler::Prologue(Register base, int prologue_offset) {
-  DCHECK(base != no_reg);
+void TurboAssembler::Prologue() {
   PushStandardFrame(r4);
   if (FLAG_enable_embedded_constant_pool) {
     // base contains prologue address
-    LoadConstantPoolPointerRegister(base, -prologue_offset);
+    LoadConstantPoolPointerRegister();
     set_constant_pool_available(true);
   }
 }
@@ -1190,6 +1185,7 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
                                     const ParameterCount& expected,
                                     const ParameterCount& actual) {
   Label skip_hook;
+
   ExternalReference debug_hook_avtive =
       ExternalReference::debug_hook_on_function_call_address(isolate());
   mov(r7, Operand(debug_hook_avtive));
@@ -1197,6 +1193,7 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
   extsb(r7, r7);
   CmpSmiLiteral(r7, Smi::kZero, r0);
   beq(&skip_hook);
+
   {
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
@@ -1253,7 +1250,7 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
     // We call indirectly through the code field in the function to
     // allow recompilation to take effect without changing any of the
     // call sites.
-    Register code = ip;
+    Register code = kJavaScriptCallCodeStartRegister;
     LoadP(code, FieldMemOperand(function, JSFunction::kCodeOffset));
     addi(code, code, Operand(Code::kHeaderSize - kHeapObjectTag));
     if (flag == CALL_FUNCTION) {
@@ -1307,14 +1304,6 @@ void MacroAssembler::InvokeFunction(Register function,
   InvokeFunctionCode(r4, no_reg, expected, actual, flag);
 }
 
-void MacroAssembler::InvokeFunction(Handle<JSFunction> function,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual,
-                                    InvokeFlag flag) {
-  Move(r4, function);
-  InvokeFunction(r4, expected, actual, flag);
-}
-
 void MacroAssembler::MaybeDropFrames() {
   // Check whether we need to drop frames to restart a function on the stack.
   ExternalReference restart_fp =
@@ -1626,6 +1615,20 @@ void MacroAssembler::JumpToExternalReference(const ExternalReference& builtin,
   Jump(stub.GetCode(), RelocInfo::CODE_TARGET);
 }
 
+void MacroAssembler::JumpToInstructionStream(Address entry) {
+  mov(kOffHeapTrampolineRegister,
+      Operand(reinterpret_cast<intptr_t>(entry), RelocInfo::OFF_HEAP_TARGET));
+  Jump(kOffHeapTrampolineRegister);
+}
+
+void MacroAssembler::LoadWeakValue(Register out, Register in,
+                                   Label* target_if_cleared) {
+  cmpi(in, Operand(kClearedWeakHeapObject));
+  beq(target_if_cleared);
+
+  mov(r0, Operand(~kWeakHeapObjectMask));
+  and_(out, in, r0);
+}
 
 void MacroAssembler::IncrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
@@ -1667,7 +1670,7 @@ void TurboAssembler::Abort(AbortReason reason) {
   Label abort_start;
   bind(&abort_start);
 #ifdef DEBUG
-  const char* msg = GetBailoutReason(reason);
+  const char* msg = GetAbortReason(reason);
   if (msg != nullptr) {
     RecordComment("Abort message: ");
     RecordComment(msg);
@@ -1743,6 +1746,20 @@ void MacroAssembler::AssertFixedArray(Register object) {
   }
 }
 
+void MacroAssembler::AssertConstructor(Register object) {
+  if (emit_debug_code()) {
+    STATIC_ASSERT(kSmiTag == 0);
+    TestIfSmi(object, r0);
+    Check(ne, AbortReason::kOperandIsASmiAndNotAConstructor);
+    push(object);
+    LoadP(object, FieldMemOperand(object, HeapObject::kMapOffset));
+    lbz(object, FieldMemOperand(object, Map::kBitFieldOffset));
+    andi(object, object, Operand(Map::IsConstructorBit::kMask));
+    pop(object);
+    Check(ne, AbortReason::kOperandIsNotAConstructor, cr0);
+  }
+}
+
 void MacroAssembler::AssertFunction(Register object) {
   if (emit_debug_code()) {
     STATIC_ASSERT(kSmiTag == 0);
@@ -2388,11 +2405,12 @@ void MacroAssembler::AndSmiLiteral(Register dst, Register src, Smi* smi,
 // Load a "pointer" sized value from the memory location
 void TurboAssembler::LoadP(Register dst, const MemOperand& mem,
                            Register scratch) {
+  DCHECK_EQ(mem.rb(), no_reg);
   int offset = mem.offset();
 
   if (!is_int16(offset)) {
     /* cannot use d-form */
-    DCHECK(scratch != no_reg);
+    DCHECK_EQ(scratch, no_reg);
     mov(scratch, Operand(offset));
     LoadPX(dst, MemOperand(mem.ra(), scratch));
   } else {
@@ -2922,6 +2940,9 @@ bool AreAliased(DoubleRegister reg1, DoubleRegister reg2, DoubleRegister reg3,
 }
 #endif
 
+void TurboAssembler::ResetSpeculationPoisonRegister() {
+  mov(kSpeculationPoisonRegister, Operand(-1));
+}
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/ppc/macro-assembler-ppc.h b/deps/v8/src/ppc/macro-assembler-ppc.h
index c67ef4ab90b..d6e68c5385f 100644
--- a/deps/v8/src/ppc/macro-assembler-ppc.h
+++ b/deps/v8/src/ppc/macro-assembler-ppc.h
@@ -15,20 +15,23 @@ namespace v8 {
 namespace internal {
 
 // Give alias names to registers for calling conventions.
-const Register kReturnRegister0 = r3;
-const Register kReturnRegister1 = r4;
-const Register kReturnRegister2 = r5;
-const Register kJSFunctionRegister = r4;
-const Register kContextRegister = r30;
-const Register kAllocateSizeRegister = r4;
-const Register kInterpreterAccumulatorRegister = r3;
-const Register kInterpreterBytecodeOffsetRegister = r15;
-const Register kInterpreterBytecodeArrayRegister = r16;
-const Register kInterpreterDispatchTableRegister = r17;
-const Register kJavaScriptCallArgCountRegister = r3;
-const Register kJavaScriptCallNewTargetRegister = r6;
-const Register kRuntimeCallFunctionRegister = r4;
-const Register kRuntimeCallArgCountRegister = r3;
+constexpr Register kReturnRegister0 = r3;
+constexpr Register kReturnRegister1 = r4;
+constexpr Register kReturnRegister2 = r5;
+constexpr Register kJSFunctionRegister = r4;
+constexpr Register kContextRegister = r30;
+constexpr Register kAllocateSizeRegister = r4;
+constexpr Register kSpeculationPoisonRegister = r14;
+constexpr Register kInterpreterAccumulatorRegister = r3;
+constexpr Register kInterpreterBytecodeOffsetRegister = r15;
+constexpr Register kInterpreterBytecodeArrayRegister = r16;
+constexpr Register kInterpreterDispatchTableRegister = r17;
+constexpr Register kJavaScriptCallArgCountRegister = r3;
+constexpr Register kJavaScriptCallNewTargetRegister = r6;
+constexpr Register kJavaScriptCallCodeStartRegister = r5;
+constexpr Register kOffHeapTrampolineRegister = ip;
+constexpr Register kRuntimeCallFunctionRegister = r4;
+constexpr Register kRuntimeCallArgCountRegister = r3;
 
 // ----------------------------------------------------------------------------
 // Static helper functions
@@ -172,9 +175,8 @@ class TurboAssembler : public Assembler {
   void PushCommonFrame(Register marker_reg = no_reg);
 
   // Generates function and stub prologue code.
-  void StubPrologue(StackFrame::Type type, Register base = no_reg,
-                    int prologue_offset = 0);
-  void Prologue(Register base, int prologue_offset = 0);
+  void StubPrologue(StackFrame::Type type);
+  void Prologue();
 
   // Push a standard frame, consisting of lr, fp, constant pool,
   // context and JS function
@@ -214,6 +216,7 @@ class TurboAssembler : public Assembler {
                   Register scratch = no_reg);
   void LoadSingleU(DoubleRegister dst, const MemOperand& mem,
                    Register scratch = no_reg);
+  void LoadPC(Register dst);
 
   void StoreDouble(DoubleRegister src, const MemOperand& mem,
                    Register scratch = no_reg);
@@ -502,10 +505,18 @@ class TurboAssembler : public Assembler {
   void Move(Register dst, Register src, Condition cond = al);
   void Move(DoubleRegister dst, DoubleRegister src);
 
-  void SmiUntag(Register reg, RCBit rc = LeaveRC) { SmiUntag(reg, reg, rc); }
+  void SmiUntag(Register reg, RCBit rc = LeaveRC, int scale = 0) {
+    SmiUntag(reg, reg, rc, scale);
+  }
 
-  void SmiUntag(Register dst, Register src, RCBit rc = LeaveRC) {
-    ShiftRightArithImm(dst, src, kSmiShift, rc);
+  void SmiUntag(Register dst, Register src, RCBit rc = LeaveRC, int scale = 0) {
+    if (scale > kSmiShift) {
+      ShiftLeftImm(dst, src, Operand(scale - kSmiShift), rc);
+    } else if (scale < kSmiShift) {
+      ShiftRightArithImm(dst, src, kSmiShift - scale, rc);
+    } else {
+      // do nothing
+    }
   }
   // ---------------------------------------------------------------------------
   // Bit testing/extraction
@@ -639,7 +650,10 @@ class TurboAssembler : public Assembler {
   void CallStubDelayed(CodeStub* stub);
 
   void LoadConstantPoolPointerRegister();
-  void LoadConstantPoolPointerRegister(Register base, int code_entry_delta = 0);
+
+  // Loads the constant pool pointer (kConstantPoolRegister).
+  void LoadConstantPoolPointerRegisterFromCodeTargetAddress(
+      Register code_target_address);
   void AbortConstantPoolBuilding() {
 #ifdef DEBUG
     // Avoid DCHECK(!is_linked()) failure in ~Label()
@@ -647,6 +661,8 @@ class TurboAssembler : public Assembler {
 #endif
   }
 
+  void ResetSpeculationPoisonRegister();
+
  private:
   static const int kSmiShift = kSmiTagSize + kSmiShiftSize;
 
@@ -732,10 +748,6 @@ class MacroAssembler : public TurboAssembler {
   void PushSafepointRegisters();
   void PopSafepointRegisters();
 
-  // Loads the constant pool pointer (kConstantPoolRegister).
-  void LoadConstantPoolPointerRegisterFromCodeTargetAddress(
-      Register code_target_address);
-
   // Flush the I-cache from asm code. You should use CpuFeatures::FlushICache
   // from C.
   // Does not handle errors.
@@ -829,10 +841,6 @@ class MacroAssembler : public TurboAssembler {
   void InvokeFunction(Register function, const ParameterCount& expected,
                       const ParameterCount& actual, InvokeFlag flag);
 
-  void InvokeFunction(Handle<JSFunction> function,
-                      const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
-
   void DebugBreak();
   // Frame restart support
   void MaybeDropFrames();
@@ -933,6 +941,13 @@ class MacroAssembler : public TurboAssembler {
   void JumpToExternalReference(const ExternalReference& builtin,
                                bool builtin_exit_frame = false);
 
+  // Generates a trampoline to jump to the off-heap instruction stream.
+  void JumpToInstructionStream(Address entry);
+
+  // ---------------------------------------------------------------------------
+  // In-place weak references.
+  void LoadWeakValue(Register out, Register in, Label* target_if_cleared);
+
   // ---------------------------------------------------------------------------
   // StatsCounter support
 
@@ -993,6 +1008,10 @@ class MacroAssembler : public TurboAssembler {
   // Abort execution if argument is not a FixedArray, enabled via --debug-code.
   void AssertFixedArray(Register object);
 
+  // Abort execution if argument is not a Constructor, enabled via --debug-code.
+  void AssertConstructor(Register object);
+
+  // Abort execution if argument is not a JSFunction, enabled via --debug-code.
   void AssertFunction(Register object);
 
   // Abort execution if argument is not a JSBoundFunction,
diff --git a/deps/v8/src/ppc/simulator-ppc.cc b/deps/v8/src/ppc/simulator-ppc.cc
index a92e5363ea3..6c517038bb5 100644
--- a/deps/v8/src/ppc/simulator-ppc.cc
+++ b/deps/v8/src/ppc/simulator-ppc.cc
@@ -639,8 +639,7 @@ void PPCDebugger::Debug() {
 #undef XSTR
 }
 
-
-static bool ICacheMatch(void* one, void* two) {
+bool Simulator::ICacheMatch(void* one, void* two) {
   DCHECK_EQ(reinterpret_cast<intptr_t>(one) & CachePage::kPageMask, 0);
   DCHECK_EQ(reinterpret_cast<intptr_t>(two) & CachePage::kPageMask, 0);
   return one == two;
@@ -738,11 +737,6 @@ void Simulator::CheckICache(base::CustomMatcherHashMap* i_cache,
 
 
 Simulator::Simulator(Isolate* isolate) : isolate_(isolate) {
-  i_cache_ = isolate_->simulator_i_cache();
-  if (i_cache_ == nullptr) {
-    i_cache_ = new base::CustomMatcherHashMap(&ICacheMatch);
-    isolate_->set_simulator_i_cache(i_cache_);
-  }
 // Set up simulator support first. Some of this information is needed to
 // setup the architecture state.
 #if V8_TARGET_ARCH_PPC64
@@ -2161,50 +2155,50 @@ void Simulator::ExecuteGeneric(Instruction* instr) {
       }
       break;
     }
-    case STFSUX: {
-      case STFSX:
-        int frs = instr->RSValue();
-        int ra = instr->RAValue();
-        int rb = instr->RBValue();
-        intptr_t ra_val = ra == 0 ? 0 : get_register(ra);
-        intptr_t rb_val = get_register(rb);
-        float frs_val = static_cast<float>(get_double_from_d_register(frs));
-        int32_t* p = reinterpret_cast<int32_t*>(&frs_val);
+    case STFSUX: V8_FALLTHROUGH;
+    case STFSX: {
+      int frs = instr->RSValue();
+      int ra = instr->RAValue();
+      int rb = instr->RBValue();
+      intptr_t ra_val = ra == 0 ? 0 : get_register(ra);
+      intptr_t rb_val = get_register(rb);
+      float frs_val = static_cast<float>(get_double_from_d_register(frs));
+      int32_t* p = reinterpret_cast<int32_t*>(&frs_val);
 #if V8_HOST_ARCH_IA32 || V8_HOST_ARCH_X64
-        // Conversion using double changes sNan to qNan on ia32/x64
-        int32_t sval = 0;
-        int64_t dval = get_d_register(frs);
-        if ((dval & 0x7FF0000000000000) == 0x7FF0000000000000) {
-          sval = ((dval & 0xC000000000000000) >> 32) |
-                 ((dval & 0x07FFFFFFE0000000) >> 29);
-          p = &sval;
-        } else {
-          p = reinterpret_cast<int32_t*>(&frs_val);
-        }
-#else
+      // Conversion using double changes sNan to qNan on ia32/x64
+      int32_t sval = 0;
+      int64_t dval = get_d_register(frs);
+      if ((dval & 0x7FF0000000000000) == 0x7FF0000000000000) {
+        sval = ((dval & 0xC000000000000000) >> 32) |
+               ((dval & 0x07FFFFFFE0000000) >> 29);
+        p = &sval;
+      } else {
         p = reinterpret_cast<int32_t*>(&frs_val);
+      }
+#else
+      p = reinterpret_cast<int32_t*>(&frs_val);
 #endif
-        WriteW(ra_val + rb_val, *p, instr);
-        if (opcode == STFSUX) {
-          DCHECK_NE(ra, 0);
-          set_register(ra, ra_val + rb_val);
-        }
-        break;
+      WriteW(ra_val + rb_val, *p, instr);
+      if (opcode == STFSUX) {
+        DCHECK_NE(ra, 0);
+        set_register(ra, ra_val + rb_val);
+      }
+      break;
     }
-    case STFDUX: {
-      case STFDX:
-        int frs = instr->RSValue();
-        int ra = instr->RAValue();
-        int rb = instr->RBValue();
-        intptr_t ra_val = ra == 0 ? 0 : get_register(ra);
-        intptr_t rb_val = get_register(rb);
-        int64_t frs_val = get_d_register(frs);
-        WriteDW(ra_val + rb_val, frs_val);
-        if (opcode == STFDUX) {
-          DCHECK_NE(ra, 0);
-          set_register(ra, ra_val + rb_val);
-        }
-        break;
+    case STFDUX: V8_FALLTHROUGH;
+    case STFDX: {
+      int frs = instr->RSValue();
+      int ra = instr->RAValue();
+      int rb = instr->RBValue();
+      intptr_t ra_val = ra == 0 ? 0 : get_register(ra);
+      intptr_t rb_val = get_register(rb);
+      int64_t frs_val = get_d_register(frs);
+      WriteDW(ra_val + rb_val, frs_val);
+      if (opcode == STFDUX) {
+        DCHECK_NE(ra, 0);
+        set_register(ra, ra_val + rb_val);
+      }
+      break;
     }
     case POPCNTW: {
       int rs = instr->RSValue();
@@ -3220,36 +3214,35 @@ void Simulator::ExecuteGeneric(Instruction* instr) {
       break;
     }
 
-    case STFSU: {
-      case STFS:
-        int frs = instr->RSValue();
-        int ra = instr->RAValue();
-        int32_t offset = SIGN_EXT_IMM16(instr->Bits(15, 0));
-        intptr_t ra_val = ra == 0 ? 0 : get_register(ra);
-        float frs_val = static_cast<float>(get_double_from_d_register(frs));
-        int32_t* p;
+    case STFSU: V8_FALLTHROUGH;
+    case STFS: {
+      int frs = instr->RSValue();
+      int ra = instr->RAValue();
+      int32_t offset = SIGN_EXT_IMM16(instr->Bits(15, 0));
+      intptr_t ra_val = ra == 0 ? 0 : get_register(ra);
+      float frs_val = static_cast<float>(get_double_from_d_register(frs));
+      int32_t* p;
 #if V8_HOST_ARCH_IA32 || V8_HOST_ARCH_X64
-        // Conversion using double changes sNan to qNan on ia32/x64
-        int32_t sval = 0;
-        int64_t dval = get_d_register(frs);
-        if ((dval & 0x7FF0000000000000) == 0x7FF0000000000000) {
-          sval = ((dval & 0xC000000000000000) >> 32) |
-                 ((dval & 0x07FFFFFFE0000000) >> 29);
-          p = &sval;
-        } else {
-          p = reinterpret_cast<int32_t*>(&frs_val);
-        }
-#else
+      // Conversion using double changes sNan to qNan on ia32/x64
+      int32_t sval = 0;
+      int64_t dval = get_d_register(frs);
+      if ((dval & 0x7FF0000000000000) == 0x7FF0000000000000) {
+        sval = ((dval & 0xC000000000000000) >> 32) |
+               ((dval & 0x07FFFFFFE0000000) >> 29);
+        p = &sval;
+      } else {
         p = reinterpret_cast<int32_t*>(&frs_val);
+      }
+#else
+      p = reinterpret_cast<int32_t*>(&frs_val);
 #endif
-        WriteW(ra_val + offset, *p, instr);
-        if (opcode == STFSU) {
-          DCHECK_NE(ra, 0);
-          set_register(ra, ra_val + offset);
-        }
-        break;
+      WriteW(ra_val + offset, *p, instr);
+      if (opcode == STFSU) {
+        DCHECK_NE(ra, 0);
+        set_register(ra, ra_val + offset);
+      }
+      break;
     }
-
     case STFDU:
     case STFD: {
       int frs = instr->RSValue();
@@ -3916,7 +3909,7 @@ void Simulator::Trace(Instruction* instr) {
 // Executes the current instruction.
 void Simulator::ExecuteInstruction(Instruction* instr) {
   if (v8::internal::FLAG_check_icache) {
-    CheckICache(isolate_->simulator_i_cache(), instr);
+    CheckICache(i_cache(), instr);
   }
   pc_modified_ = false;
   if (::v8::internal::FLAG_trace_sim) {
diff --git a/deps/v8/src/ppc/simulator-ppc.h b/deps/v8/src/ppc/simulator-ppc.h
index 544b9d463e2..45b350b742b 100644
--- a/deps/v8/src/ppc/simulator-ppc.h
+++ b/deps/v8/src/ppc/simulator-ppc.h
@@ -190,6 +190,7 @@ class Simulator : public SimulatorBase {
   static void SetRedirectInstruction(Instruction* instruction);
 
   // ICache checking.
+  static bool ICacheMatch(void* one, void* two);
   static void FlushICache(base::CustomMatcherHashMap* i_cache, void* start,
                           size_t size);
 
@@ -328,9 +329,6 @@ class Simulator : public SimulatorBase {
   // Debugger input.
   char* last_debugger_input_;
 
-  // Icache simulation
-  base::CustomMatcherHashMap* i_cache_;
-
   // Registered breakpoints.
   Instruction* break_pc_;
   Instr break_instr_;
diff --git a/deps/v8/src/profiler/allocation-tracker.cc b/deps/v8/src/profiler/allocation-tracker.cc
index 8ee4527234e..3dad4ae208e 100644
--- a/deps/v8/src/profiler/allocation-tracker.cc
+++ b/deps/v8/src/profiler/allocation-tracker.cc
@@ -5,6 +5,7 @@
 #include "src/profiler/allocation-tracker.h"
 
 #include "src/frames-inl.h"
+#include "src/global-handles.h"
 #include "src/objects-inl.h"
 #include "src/profiler/heap-snapshot-generator-inl.h"
 
@@ -260,7 +261,7 @@ unsigned AllocationTracker::AddFunctionInfo(SharedFunctionInfo* shared,
       // Converting start offset into line and column may cause heap
       // allocations so we postpone them until snapshot serialization.
       unresolved_locations_.push_back(
-          new UnresolvedLocation(script, shared->start_position(), info));
+          new UnresolvedLocation(script, shared->StartPosition(), info));
     }
     entry->value = reinterpret_cast<void*>(function_info_list_.size());
     function_info_list_.push_back(info);
diff --git a/deps/v8/src/profiler/allocation-tracker.h b/deps/v8/src/profiler/allocation-tracker.h
index a84fd4a8fd2..cd9e120db21 100644
--- a/deps/v8/src/profiler/allocation-tracker.h
+++ b/deps/v8/src/profiler/allocation-tracker.h
@@ -154,4 +154,4 @@ class AllocationTracker {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_ALLOCATION_TRACKER_H_
+#endif  // V8_PROFILER_ALLOCATION_TRACKER_H_
diff --git a/deps/v8/src/profiler/cpu-profiler.cc b/deps/v8/src/profiler/cpu-profiler.cc
index a915ebd5119..841ce6000fe 100644
--- a/deps/v8/src/profiler/cpu-profiler.cc
+++ b/deps/v8/src/profiler/cpu-profiler.cc
@@ -208,7 +208,7 @@ int CpuProfiler::GetProfilesCount() {
 
 
 CpuProfile* CpuProfiler::GetProfile(int index) {
-  return profiles_->profiles()->at(index);
+  return profiles_->profiles()->at(index).get();
 }
 
 
@@ -220,7 +220,6 @@ void CpuProfiler::DeleteAllProfiles() {
 
 void CpuProfiler::DeleteProfile(CpuProfile* profile) {
   profiles_->RemoveProfile(profile);
-  delete profile;
   if (profiles_->profiles()->empty() && !is_profiling_) {
     // If this was the last profile, clean up all accessory data as well.
     ResetProfiles();
diff --git a/deps/v8/src/profiler/heap-profiler.cc b/deps/v8/src/profiler/heap-profiler.cc
index 8f0afdc771b..9dbe3ff5bde 100644
--- a/deps/v8/src/profiler/heap-profiler.cc
+++ b/deps/v8/src/profiler/heap-profiler.cc
@@ -17,28 +17,22 @@ namespace internal {
 HeapProfiler::HeapProfiler(Heap* heap)
     : ids_(new HeapObjectsMap(heap)),
       names_(new StringsStorage(heap)),
-      is_tracking_object_moves_(false),
-      get_retainer_infos_callback_(nullptr) {}
-
-static void DeleteHeapSnapshot(HeapSnapshot* snapshot_ptr) {
-  delete snapshot_ptr;
-}
-
-
-HeapProfiler::~HeapProfiler() {
-  std::for_each(snapshots_.begin(), snapshots_.end(), &DeleteHeapSnapshot);
-}
+      is_tracking_object_moves_(false) {}
 
+HeapProfiler::~HeapProfiler() = default;
 
 void HeapProfiler::DeleteAllSnapshots() {
-  std::for_each(snapshots_.begin(), snapshots_.end(), &DeleteHeapSnapshot);
   snapshots_.clear();
   names_.reset(new StringsStorage(heap()));
 }
 
 
 void HeapProfiler::RemoveSnapshot(HeapSnapshot* snapshot) {
-  snapshots_.erase(std::find(snapshots_.begin(), snapshots_.end(), snapshot));
+  snapshots_.erase(
+      std::find_if(snapshots_.begin(), snapshots_.end(),
+                   [&](const std::unique_ptr<HeapSnapshot>& entry) {
+                     return entry.get() == snapshot;
+                   }));
 }
 
 
@@ -75,6 +69,18 @@ v8::HeapProfiler::RetainerInfos HeapProfiler::GetRetainerInfos(
   return infos;
 }
 
+void HeapProfiler::SetBuildEmbedderGraphCallback(
+    v8::HeapProfiler::BuildEmbedderGraphCallback callback) {
+  build_embedder_graph_callback_ = callback;
+}
+
+void HeapProfiler::BuildEmbedderGraph(Isolate* isolate,
+                                      v8::EmbedderGraph* graph) {
+  if (build_embedder_graph_callback_ != nullptr)
+    build_embedder_graph_callback_(reinterpret_cast<v8::Isolate*>(isolate),
+                                   graph);
+}
+
 HeapSnapshot* HeapProfiler::TakeSnapshot(
     v8::ActivityControl* control,
     v8::HeapProfiler::ObjectNameResolver* resolver) {
@@ -85,7 +91,7 @@ HeapSnapshot* HeapProfiler::TakeSnapshot(
       delete result;
       result = nullptr;
     } else {
-      snapshots_.push_back(result);
+      snapshots_.emplace_back(result);
     }
   }
   ids_->RemoveDeadEntries();
@@ -153,7 +159,7 @@ int HeapProfiler::GetSnapshotsCount() {
 }
 
 HeapSnapshot* HeapProfiler::GetSnapshot(int index) {
-  return snapshots_.at(index);
+  return snapshots_.at(index).get();
 }
 
 SnapshotObjectId HeapProfiler::GetSnapshotObjectId(Handle<Object> obj) {
diff --git a/deps/v8/src/profiler/heap-profiler.h b/deps/v8/src/profiler/heap-profiler.h
index da6814ddcb1..d37a882805e 100644
--- a/deps/v8/src/profiler/heap-profiler.h
+++ b/deps/v8/src/profiler/heap-profiler.h
@@ -8,7 +8,11 @@
 #include <memory>
 #include <vector>
 
-#include "src/isolate.h"
+#include "include/v8-profiler.h"
+#include "src/base/platform/mutex.h"
+#include "src/debug/debug-interface.h"
+#include "src/globals.h"
+#include "src/heap/heap.h"
 
 namespace v8 {
 namespace internal {
@@ -65,9 +69,15 @@ class HeapProfiler {
 
   void SetGetRetainerInfosCallback(
       v8::HeapProfiler::GetRetainerInfosCallback callback);
-
   v8::HeapProfiler::RetainerInfos GetRetainerInfos(Isolate* isolate);
 
+  void SetBuildEmbedderGraphCallback(
+      v8::HeapProfiler::BuildEmbedderGraphCallback callback);
+  void BuildEmbedderGraph(Isolate* isolate, v8::EmbedderGraph* graph);
+  bool HasBuildEmbedderGraphCallback() {
+    return build_embedder_graph_callback_ != nullptr;
+  }
+
   bool is_tracking_object_moves() const { return is_tracking_object_moves_; }
   bool is_tracking_allocations() const { return !!allocation_tracker_; }
 
@@ -85,14 +95,17 @@ class HeapProfiler {
 
   // Mapping from HeapObject addresses to objects' uids.
   std::unique_ptr<HeapObjectsMap> ids_;
-  std::vector<HeapSnapshot*> snapshots_;
+  std::vector<std::unique_ptr<HeapSnapshot>> snapshots_;
   std::unique_ptr<StringsStorage> names_;
   std::vector<v8::HeapProfiler::WrapperInfoCallback> wrapper_callbacks_;
   std::unique_ptr<AllocationTracker> allocation_tracker_;
   bool is_tracking_object_moves_;
   base::Mutex profiler_mutex_;
   std::unique_ptr<SamplingHeapProfiler> sampling_heap_profiler_;
-  v8::HeapProfiler::GetRetainerInfosCallback get_retainer_infos_callback_;
+  v8::HeapProfiler::GetRetainerInfosCallback get_retainer_infos_callback_ =
+      nullptr;
+  v8::HeapProfiler::BuildEmbedderGraphCallback build_embedder_graph_callback_ =
+      nullptr;
 
   DISALLOW_COPY_AND_ASSIGN(HeapProfiler);
 };
diff --git a/deps/v8/src/profiler/heap-snapshot-generator.cc b/deps/v8/src/profiler/heap-snapshot-generator.cc
index 40779d9e5f1..fac0c388afc 100644
--- a/deps/v8/src/profiler/heap-snapshot-generator.cc
+++ b/deps/v8/src/profiler/heap-snapshot-generator.cc
@@ -10,6 +10,7 @@
 #include "src/code-stubs.h"
 #include "src/conversions.h"
 #include "src/debug/debug.h"
+#include "src/global-handles.h"
 #include "src/layout-descriptor.h"
 #include "src/objects-body-descriptors.h"
 #include "src/objects-inl.h"
@@ -160,6 +161,8 @@ const char* HeapEntry::TypeAsString() {
     case kConsString: return "/concatenated string/";
     case kSlicedString: return "/sliced string/";
     case kSymbol: return "/symbol/";
+    case kBigInt:
+      return "/bigint/";
     default: return "???";
   }
 }
@@ -176,7 +179,7 @@ HeapSnapshot::HeapSnapshot(HeapProfiler* profiler)
                 ((kPointerSize == 8) && (sizeof(HeapGraphEdge) == 24)));
   STATIC_ASSERT(((kPointerSize == 4) && (sizeof(HeapEntry) == 28)) ||
                 ((kPointerSize == 8) && (sizeof(HeapEntry) == 40)));
-  for (int i = 0; i < VisitorSynchronization::kNumberOfSyncTags; ++i) {
+  for (int i = 0; i < static_cast<int>(Root::kNumberOfRoots); ++i) {
     gc_subroot_indexes_[i] = HeapEntry::kNoEntry;
   }
 }
@@ -184,7 +187,6 @@ HeapSnapshot::HeapSnapshot(HeapProfiler* profiler)
 
 void HeapSnapshot::Delete() {
   profiler_->RemoveSnapshot(this);
-  delete this;
 }
 
 
@@ -197,8 +199,8 @@ void HeapSnapshot::AddSyntheticRootEntries() {
   AddRootEntry();
   AddGcRootsEntry();
   SnapshotObjectId id = HeapObjectsMap::kGcRootsFirstSubrootId;
-  for (int tag = 0; tag < VisitorSynchronization::kNumberOfSyncTags; tag++) {
-    AddGcSubrootEntry(tag, id);
+  for (int root = 0; root < static_cast<int>(Root::kNumberOfRoots); root++) {
+    AddGcSubrootEntry(static_cast<Root>(root), id);
     id += HeapObjectsMap::kObjectIdStep;
   }
   DCHECK_EQ(HeapObjectsMap::kFirstAvailableObjectId, id);
@@ -230,13 +232,11 @@ HeapEntry* HeapSnapshot::AddGcRootsEntry() {
   return entry;
 }
 
-
-HeapEntry* HeapSnapshot::AddGcSubrootEntry(int tag, SnapshotObjectId id) {
-  DCHECK_EQ(gc_subroot_indexes_[tag], HeapEntry::kNoEntry);
-  DCHECK(0 <= tag && tag < VisitorSynchronization::kNumberOfSyncTags);
-  HeapEntry* entry = AddEntry(HeapEntry::kSynthetic,
-                              VisitorSynchronization::kTagNames[tag], id, 0, 0);
-  gc_subroot_indexes_[tag] = entry->index();
+HeapEntry* HeapSnapshot::AddGcSubrootEntry(Root root, SnapshotObjectId id) {
+  DCHECK_EQ(gc_subroot_indexes_[static_cast<int>(root)], HeapEntry::kNoEntry);
+  HeapEntry* entry =
+      AddEntry(HeapEntry::kSynthetic, RootVisitor::RootName(root), id, 0, 0);
+  gc_subroot_indexes_[static_cast<int>(root)] = entry->index();
   return entry;
 }
 
@@ -307,7 +307,7 @@ const SnapshotObjectId HeapObjectsMap::kGcRootsFirstSubrootId =
     HeapObjectsMap::kGcRootsObjectId + HeapObjectsMap::kObjectIdStep;
 const SnapshotObjectId HeapObjectsMap::kFirstAvailableObjectId =
     HeapObjectsMap::kGcRootsFirstSubrootId +
-    VisitorSynchronization::kNumberOfSyncTags * HeapObjectsMap::kObjectIdStep;
+    static_cast<int>(Root::kNumberOfRoots) * HeapObjectsMap::kObjectIdStep;
 
 HeapObjectsMap::HeapObjectsMap(Heap* heap)
     : next_id_(kFirstAvailableObjectId), heap_(heap) {
@@ -604,7 +604,7 @@ HeapEntry* V8HeapExplorer::AddEntry(HeapObject* object) {
   if (object->IsJSFunction()) {
     JSFunction* func = JSFunction::cast(object);
     SharedFunctionInfo* shared = func->shared();
-    const char* name = names_->GetName(shared->name());
+    const char* name = names_->GetName(shared->Name());
     return AddEntry(object, HeapEntry::kClosure, name);
   } else if (object->IsJSBoundFunction()) {
     return AddEntry(object, HeapEntry::kClosure, "native_bind");
@@ -641,10 +641,12 @@ HeapEntry* V8HeapExplorer::AddEntry(HeapObject* object) {
       return AddEntry(object, HeapEntry::kHidden, "private symbol");
     else
       return AddEntry(object, HeapEntry::kSymbol, "symbol");
+  } else if (object->IsBigInt()) {
+    return AddEntry(object, HeapEntry::kBigInt, "bigint");
   } else if (object->IsCode()) {
     return AddEntry(object, HeapEntry::kCode, "");
   } else if (object->IsSharedFunctionInfo()) {
-    String* name = SharedFunctionInfo::cast(object)->name();
+    String* name = SharedFunctionInfo::cast(object)->Name();
     return AddEntry(object,
                     HeapEntry::kCode,
                     names_->GetName(name));
@@ -733,15 +735,15 @@ class SnapshotFiller {
     HeapEntry* parent_entry = &snapshot_->entries()[parent];
     parent_entry->SetNamedReference(type, reference_name, child_entry);
   }
-  void SetNamedAutoIndexReference(HeapGraphEdge::Type type,
-                                  int parent,
+  void SetNamedAutoIndexReference(HeapGraphEdge::Type type, int parent,
+                                  const char* description,
                                   HeapEntry* child_entry) {
     HeapEntry* parent_entry = &snapshot_->entries()[parent];
     int index = parent_entry->children_count() + 1;
-    parent_entry->SetNamedReference(
-        type,
-        names_->GetName(index),
-        child_entry);
+    const char* name = description
+                           ? names_->GetFormatted("%d / %s", index, description)
+                           : names_->GetName(index);
+    parent_entry->SetNamedReference(type, name, child_entry);
   }
 
  private:
@@ -792,20 +794,33 @@ class IndexedReferencesExtractor : public ObjectVisitor {
         parent_obj_(parent_obj),
         parent_start_(HeapObject::RawField(parent_obj_, 0)),
         parent_end_(HeapObject::RawField(parent_obj_, parent_obj_->Size())),
-        parent_(parent),
-        next_index_(0) {}
+        parent_(parent) {}
   void VisitPointers(HeapObject* host, Object** start, Object** end) override {
-    for (Object** p = start; p < end; p++) {
-      int index = static_cast<int>(p - HeapObject::RawField(parent_obj_, 0));
-      ++next_index_;
+    VisitPointers(host, reinterpret_cast<MaybeObject**>(start),
+                  reinterpret_cast<MaybeObject**>(end));
+  }
+  void VisitPointers(HeapObject* host, MaybeObject** start,
+                     MaybeObject** end) override {
+    int next_index = 0;
+    for (MaybeObject** p = start; p < end; p++) {
+      int index = static_cast<int>(reinterpret_cast<Object**>(p) -
+                                   HeapObject::RawField(parent_obj_, 0));
+      ++next_index;
       // |p| could be outside of the object, e.g., while visiting RelocInfo of
       // code objects.
-      if (p >= parent_start_ && p < parent_end_ && generator_->marks_[index]) {
-        generator_->marks_[index] = false;
+      if (reinterpret_cast<Object**>(p) >= parent_start_ &&
+          reinterpret_cast<Object**>(p) < parent_end_ &&
+          generator_->visited_fields_[index]) {
+        generator_->visited_fields_[index] = false;
         continue;
       }
-      generator_->SetHiddenReference(parent_obj_, parent_, next_index_, *p,
-                                     index * kPointerSize);
+      HeapObject* heap_object;
+      // Weak references have been handled explicitly.
+      DCHECK(!(*p)->ToWeakHeapObject(&heap_object));
+      if ((*p)->ToStrongHeapObject(&heap_object)) {
+        generator_->SetHiddenReference(parent_obj_, parent_, next_index,
+                                       heap_object, index * kPointerSize);
+      }
     }
   }
 
@@ -815,7 +830,6 @@ class IndexedReferencesExtractor : public ObjectVisitor {
   Object** parent_start_;
   Object** parent_end_;
   int parent_;
-  int next_index_;
 };
 
 
@@ -857,12 +871,18 @@ bool V8HeapExplorer::ExtractReferencesPass1(int entry, HeapObject* obj) {
     ExtractCodeReferences(entry, Code::cast(obj));
   } else if (obj->IsCell()) {
     ExtractCellReferences(entry, Cell::cast(obj));
+  } else if (obj->IsFeedbackCell()) {
+    ExtractFeedbackCellReferences(entry, FeedbackCell::cast(obj));
   } else if (obj->IsWeakCell()) {
     ExtractWeakCellReferences(entry, WeakCell::cast(obj));
   } else if (obj->IsPropertyCell()) {
     ExtractPropertyCellReferences(entry, PropertyCell::cast(obj));
   } else if (obj->IsAllocationSite()) {
     ExtractAllocationSiteReferences(entry, AllocationSite::cast(obj));
+  } else if (obj->IsFeedbackVector()) {
+    ExtractFeedbackVectorReferences(entry, FeedbackVector::cast(obj));
+  } else if (obj->IsWeakFixedArray()) {
+    ExtractWeakFixedArrayReferences(entry, WeakFixedArray::cast(obj));
   }
   return true;
 }
@@ -929,11 +949,10 @@ void V8HeapExplorer::ExtractJSObjectReferences(
       }
     }
     SharedFunctionInfo* shared_info = js_fun->shared();
-    TagObject(js_fun->feedback_vector_cell(),
-              "(function feedback vector cell)");
-    SetInternalReference(js_fun, entry, "feedback_vector_cell",
-                         js_fun->feedback_vector_cell(),
-                         JSFunction::kFeedbackVectorOffset);
+    TagObject(js_fun->feedback_cell(), "(function feedback cell)");
+    SetInternalReference(js_fun, entry, "feedback_cell",
+                         js_fun->feedback_cell(),
+                         JSFunction::kFeedbackCellOffset);
     TagObject(shared_info, "(shared function info)");
     SetInternalReference(js_fun, entry,
                          "shared", shared_info,
@@ -1016,8 +1035,8 @@ void V8HeapExplorer::ExtractJSWeakCollectionReferences(int entry,
 }
 
 void V8HeapExplorer::ExtractContextReferences(int entry, Context* context) {
-  if (context == context->declaration_context()) {
-    ScopeInfo* scope_info = context->closure()->shared()->scope_info();
+  if (!context->IsNativeContext() && context->is_declaration_context()) {
+    ScopeInfo* scope_info = context->scope_info();
     // Add context allocated locals.
     int context_locals = scope_info->ContextLocalCount();
     for (int i = 0; i < context_locals; ++i) {
@@ -1027,7 +1046,7 @@ void V8HeapExplorer::ExtractContextReferences(int entry, Context* context) {
                           Context::OffsetOfElementAt(idx));
     }
     if (scope_info->HasFunctionName()) {
-      String* name = scope_info->FunctionName();
+      String* name = String::cast(scope_info->FunctionName());
       int idx = scope_info->FunctionContextSlotIndex(name);
       if (idx >= 0) {
         SetContextReference(context, entry, name, context->get(idx),
@@ -1132,24 +1151,19 @@ void V8HeapExplorer::ExtractSharedFunctionInfoReferences(
   const char* name = nullptr;
   if (shared_name != heap_->empty_string()) {
     name = names_->GetName(shared_name);
-    TagObject(shared->code(), names_->GetFormatted("(code for %s)", name));
+    TagObject(shared->GetCode(), names_->GetFormatted("(code for %s)", name));
   } else {
-    TagObject(shared->code(), names_->GetFormatted("(%s code)",
-        Code::Kind2String(shared->code()->kind())));
+    TagObject(shared->GetCode(),
+              names_->GetFormatted(
+                  "(%s code)", Code::Kind2String(shared->GetCode()->kind())));
   }
 
-  SetInternalReference(obj, entry, "raw_name", shared->raw_name(),
-                       SharedFunctionInfo::kNameOffset);
-  SetInternalReference(obj, entry,
-                       "code", shared->code(),
-                       SharedFunctionInfo::kCodeOffset);
-  TagObject(shared->scope_info(), "(function scope info)");
-  SetInternalReference(obj, entry,
-                       "scope_info", shared->scope_info(),
-                       SharedFunctionInfo::kScopeInfoOffset);
-  SetInternalReference(obj, entry,
-                       "instance_class_name", shared->instance_class_name(),
-                       SharedFunctionInfo::kInstanceClassNameOffset);
+  if (shared->name_or_scope_info()->IsScopeInfo()) {
+    TagObject(shared->name_or_scope_info(), "(function scope info)");
+  }
+  SetInternalReference(obj, entry, "name_or_scope_info",
+                       shared->name_or_scope_info(),
+                       SharedFunctionInfo::kNameOrScopeInfoOffset);
   SetInternalReference(obj, entry,
                        "script", shared->script(),
                        SharedFunctionInfo::kScriptOffset);
@@ -1234,9 +1248,6 @@ void V8HeapExplorer::ExtractCodeReferences(int entry, Code* code) {
   SetInternalReference(code, entry,
                        "relocation_info", code->relocation_info(),
                        Code::kRelocationInfoOffset);
-  SetInternalReference(code, entry,
-                       "handler_table", code->handler_table(),
-                       Code::kHandlerTableOffset);
   TagObject(code->deoptimization_data(), "(code deopt data)");
   SetInternalReference(code, entry,
                        "deoptimization_data", code->deoptimization_data(),
@@ -1251,6 +1262,13 @@ void V8HeapExplorer::ExtractCellReferences(int entry, Cell* cell) {
   SetInternalReference(cell, entry, "value", cell->value(), Cell::kValueOffset);
 }
 
+void V8HeapExplorer::ExtractFeedbackCellReferences(
+    int entry, FeedbackCell* feedback_cell) {
+  TagObject(feedback_cell, "(feedback cell)");
+  SetInternalReference(feedback_cell, entry, "value", feedback_cell->value(),
+                       FeedbackCell::kValueOffset);
+}
+
 void V8HeapExplorer::ExtractWeakCellReferences(int entry, WeakCell* weak_cell) {
   TagObject(weak_cell, "(weak cell)");
   SetWeakReference(weak_cell, entry, "value", weak_cell->value(),
@@ -1312,23 +1330,9 @@ void V8HeapExplorer::ExtractJSArrayBufferReferences(
 }
 
 void V8HeapExplorer::ExtractJSPromiseReferences(int entry, JSPromise* promise) {
-  SetInternalReference(promise, entry, "result", promise->result(),
-                       JSPromise::kResultOffset);
-  SetInternalReference(promise, entry, "deferred_promise",
-                       promise->deferred_promise(),
-                       JSPromise::kDeferredPromiseOffset);
-  SetInternalReference(promise, entry, "deferred_on_resolve",
-                       promise->deferred_on_resolve(),
-                       JSPromise::kDeferredOnResolveOffset);
-  SetInternalReference(promise, entry, "deferred_on_reject",
-                       promise->deferred_on_reject(),
-                       JSPromise::kDeferredOnRejectOffset);
-  SetInternalReference(promise, entry, "fulfill_reactions",
-                       promise->fulfill_reactions(),
-                       JSPromise::kFulfillReactionsOffset);
-  SetInternalReference(promise, entry, "reject_reactions",
-                       promise->reject_reactions(),
-                       JSPromise::kRejectReactionsOffset);
+  SetInternalReference(promise, entry, "reactions_or_result",
+                       promise->reactions_or_result(),
+                       JSPromise::kReactionsOrResultOffset);
 }
 
 void V8HeapExplorer::ExtractFixedArrayReferences(int entry, FixedArray* array) {
@@ -1347,12 +1351,20 @@ void V8HeapExplorer::ExtractFixedArrayReferences(int entry, FixedArray* array) {
         int key_index =
             ObjectHashTable::EntryToIndex(i) + ObjectHashTable::kEntryKeyIndex;
         int value_index = ObjectHashTable::EntryToValueIndex(i);
-        SetWeakReference(table, entry, key_index, table->get(key_index),
+        Object* key = table->get(key_index);
+        Object* value = table->get(value_index);
+        SetWeakReference(table, entry, key_index, key,
                          table->OffsetOfElementAt(key_index));
-        SetInternalReference(table, entry, value_index, table->get(value_index),
+        SetInternalReference(table, entry, value_index, value,
                              table->OffsetOfElementAt(value_index));
-        // TODO(alph): Add a strong link (shortcut?) from key to value per
-        //             WeakMap the key was added to. See crbug.com/778739
+        HeapEntry* key_entry = GetEntry(key);
+        int key_entry_index = key_entry->index();
+        HeapEntry* value_entry = GetEntry(value);
+        if (key_entry && value_entry) {
+          filler_->SetNamedAutoIndexReference(HeapGraphEdge::kInternal,
+                                              key_entry_index, "WeakMap",
+                                              value_entry);
+        }
       }
       break;
     }
@@ -1368,6 +1380,28 @@ void V8HeapExplorer::ExtractFixedArrayReferences(int entry, FixedArray* array) {
   }
 }
 
+void V8HeapExplorer::ExtractFeedbackVectorReferences(
+    int entry, FeedbackVector* feedback_vector) {
+  MaybeObject* code = feedback_vector->optimized_code_weak_or_smi();
+  HeapObject* code_heap_object;
+  if (code->ToWeakHeapObject(&code_heap_object)) {
+    SetWeakReference(feedback_vector, entry, "optimized code", code_heap_object,
+                     FeedbackVector::kOptimizedCodeOffset);
+  }
+}
+
+void V8HeapExplorer::ExtractWeakFixedArrayReferences(int entry,
+                                                     WeakFixedArray* array) {
+  for (int i = 0; i < array->length(); ++i) {
+    MaybeObject* object = array->Get(i);
+    HeapObject* heap_object;
+    if (object->ToWeakHeapObject(&heap_object)) {
+      SetWeakReference(array, entry, i, heap_object,
+                       WeakFixedArray::kHeaderSize + i * kPointerSize);
+    }
+  }
+}
+
 void V8HeapExplorer::ExtractPropertyReferences(JSObject* js_obj, int entry) {
   Isolate* isolate = js_obj->GetIsolate();
   if (js_obj->HasFastProperties()) {
@@ -1498,73 +1532,30 @@ HeapEntry* V8HeapExplorer::GetEntry(Object* obj) {
 }
 
 class RootsReferencesExtractor : public RootVisitor {
- private:
-  struct IndexTag {
-    IndexTag(size_t index, VisitorSynchronization::SyncTag tag)
-        : index(index), tag(tag) {}
-    size_t index;
-    VisitorSynchronization::SyncTag tag;
-  };
-
  public:
-  explicit RootsReferencesExtractor(Heap* heap)
-      : collecting_all_references_(false),
-        previous_reference_count_(0),
-        heap_(heap) {
-  }
+  explicit RootsReferencesExtractor(V8HeapExplorer* explorer)
+      : explorer_(explorer), visiting_weak_roots_(false) {}
 
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
-    if (collecting_all_references_) {
-      for (Object** p = start; p < end; p++) all_references_.push_back(*p);
-    } else {
-      for (Object** p = start; p < end; p++) strong_references_.push_back(*p);
-    }
-  }
+  void SetVisitingWeakRoots() { visiting_weak_roots_ = true; }
 
-  void SetCollectingAllReferences() { collecting_all_references_ = true; }
-
-  void FillReferences(V8HeapExplorer* explorer) {
-    DCHECK_LE(strong_references_.size(), all_references_.size());
-    Builtins* builtins = heap_->isolate()->builtins();
-    USE(builtins);
-    size_t strong_index = 0, all_index = 0, tags_index = 0;
-    int builtin_index = 0;
-    while (all_index < all_references_.size()) {
-      bool is_strong =
-          strong_index < strong_references_.size() &&
-          strong_references_[strong_index] == all_references_[all_index];
-      explorer->SetGcSubrootReference(reference_tags_[tags_index].tag,
-                                      !is_strong,
-                                      all_references_[all_index]);
-      if (reference_tags_[tags_index].tag ==
-          VisitorSynchronization::kBuiltins) {
-        DCHECK(all_references_[all_index]->IsCode());
-        explorer->TagBuiltinCodeObject(
-            Code::cast(all_references_[all_index]),
-            builtins->name(builtin_index++));
-      }
-      ++all_index;
-      if (is_strong) ++strong_index;
-      if (reference_tags_[tags_index].index == all_index) ++tags_index;
+  void VisitRootPointer(Root root, const char* description,
+                        Object** object) override {
+    if (root == Root::kBuiltins) {
+      explorer_->TagBuiltinCodeObject(Code::cast(*object), description);
     }
-    CHECK_EQ(strong_index, strong_references_.size());
+    explorer_->SetGcSubrootReference(root, description, visiting_weak_roots_,
+                                     *object);
   }
 
-  void Synchronize(VisitorSynchronization::SyncTag tag) override {
-    if (collecting_all_references_ &&
-        previous_reference_count_ != all_references_.size()) {
-      previous_reference_count_ = all_references_.size();
-      reference_tags_.emplace_back(previous_reference_count_, tag);
-    }
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {
+    for (Object** p = start; p < end; p++)
+      VisitRootPointer(root, description, p);
   }
 
  private:
-  bool collecting_all_references_;
-  std::vector<Object*> strong_references_;
-  std::vector<Object*> all_references_;
-  size_t previous_reference_count_;
-  std::vector<IndexTag> reference_tags_;
-  Heap* heap_;
+  V8HeapExplorer* explorer_;
+  bool visiting_weak_roots_;
 };
 
 
@@ -1574,18 +1565,17 @@ bool V8HeapExplorer::IterateAndExtractReferences(
 
   // Create references to the synthetic roots.
   SetRootGcRootsReference();
-  for (int tag = 0; tag < VisitorSynchronization::kNumberOfSyncTags; tag++) {
-    SetGcRootsReference(static_cast<VisitorSynchronization::SyncTag>(tag));
+  for (int root = 0; root < static_cast<int>(Root::kNumberOfRoots); root++) {
+    SetGcRootsReference(static_cast<Root>(root));
   }
 
   // Make sure builtin code objects get their builtin tags
   // first. Otherwise a particular JSFunction object could set
   // its custom name to a generic builtin.
-  RootsReferencesExtractor extractor(heap_);
+  RootsReferencesExtractor extractor(this);
   heap_->IterateRoots(&extractor, VISIT_ONLY_STRONG);
-  extractor.SetCollectingAllReferences();
-  heap_->IterateRoots(&extractor, VISIT_ALL);
-  extractor.FillReferences(this);
+  extractor.SetVisitingWeakRoots();
+  heap_->IterateWeakGlobalHandles(&extractor);
 
   // We have to do two passes as sometimes FixedArrays are used
   // to weakly hold their items, and it's impossible to distinguish
@@ -1615,11 +1605,11 @@ bool V8HeapExplorer::IterateAndExtractSinglePass() {
     if (interrupted) continue;
 
     size_t max_pointer = obj->Size() / kPointerSize;
-    if (max_pointer > marks_.size()) {
+    if (max_pointer > visited_fields_.size()) {
       // Clear the current bits.
-      std::vector<bool>().swap(marks_);
+      std::vector<bool>().swap(visited_fields_);
       // Reallocate to right size.
-      marks_.resize(max_pointer, false);
+      visited_fields_.resize(max_pointer, false);
     }
 
     HeapEntry* heap_entry = GetEntry(obj);
@@ -1632,6 +1622,10 @@ bool V8HeapExplorer::IterateAndExtractSinglePass() {
       IndexedReferencesExtractor refs_extractor(this, obj, entry);
       obj->Iterate(&refs_extractor);
     }
+    // Ensure visited_fields_ doesn't leak to the next object.
+    for (size_t i = 0; i < max_pointer; ++i) {
+      DCHECK(!visited_fields_[i]);
+    }
 
     if (!progress_->ProgressReport(false)) interrupted = true;
   }
@@ -1643,6 +1637,7 @@ bool V8HeapExplorer::IsEssentialObject(Object* object) {
   return object->IsHeapObject() && !object->IsOddball() &&
          object != heap_->empty_byte_array() &&
          object != heap_->empty_fixed_array() &&
+         object != heap_->empty_weak_fixed_array() &&
          object != heap_->empty_descriptor_array() &&
          object != heap_->fixed_array_map() && object != heap_->cell_map() &&
          object != heap_->global_property_cell_map() &&
@@ -1676,15 +1671,14 @@ void V8HeapExplorer::SetContextReference(HeapObject* parent_obj,
   if (child_entry == nullptr) return;
   filler_->SetNamedReference(HeapGraphEdge::kContextVariable, parent_entry,
                              names_->GetName(reference_name), child_entry);
-  MarkVisitedField(parent_obj, field_offset);
+  MarkVisitedField(field_offset);
 }
 
-
-void V8HeapExplorer::MarkVisitedField(HeapObject* obj, int offset) {
+void V8HeapExplorer::MarkVisitedField(int offset) {
   if (offset < 0) return;
   int index = offset / kPointerSize;
-  DCHECK(!marks_[index]);
-  marks_[index] = true;
+  DCHECK(!visited_fields_[index]);
+  visited_fields_[index] = true;
 }
 
 
@@ -1726,7 +1720,7 @@ void V8HeapExplorer::SetInternalReference(HeapObject* parent_obj,
                                reference_name,
                                child_entry);
   }
-  MarkVisitedField(parent_obj, field_offset);
+  MarkVisitedField(field_offset);
 }
 
 
@@ -1744,7 +1738,7 @@ void V8HeapExplorer::SetInternalReference(HeapObject* parent_obj,
                                names_->GetName(index),
                                child_entry);
   }
-  MarkVisitedField(parent_obj, field_offset);
+  MarkVisitedField(field_offset);
 }
 
 void V8HeapExplorer::SetHiddenReference(HeapObject* parent_obj,
@@ -1774,7 +1768,7 @@ void V8HeapExplorer::SetWeakReference(HeapObject* parent_obj,
                                reference_name,
                                child_entry);
   }
-  MarkVisitedField(parent_obj, field_offset);
+  MarkVisitedField(field_offset);
 }
 
 
@@ -1792,7 +1786,7 @@ void V8HeapExplorer::SetWeakReference(HeapObject* parent_obj,
                                names_->GetFormatted("%d", index),
                                child_entry);
   }
-  MarkVisitedField(parent_obj, field_offset);
+  MarkVisitedField(field_offset);
 }
 
 
@@ -1833,7 +1827,7 @@ void V8HeapExplorer::SetPropertyReference(HeapObject* parent_obj,
           : names_->GetName(reference_name);
 
   filler_->SetNamedReference(type, parent_entry, name, child_entry);
-  MarkVisitedField(parent_obj, field_offset);
+  MarkVisitedField(field_offset);
 }
 
 void V8HeapExplorer::SetRootGcRootsReference() {
@@ -1846,39 +1840,31 @@ void V8HeapExplorer::SetRootGcRootsReference() {
 void V8HeapExplorer::SetUserGlobalReference(Object* child_obj) {
   HeapEntry* child_entry = GetEntry(child_obj);
   DCHECK_NOT_NULL(child_entry);
-  filler_->SetNamedAutoIndexReference(
-      HeapGraphEdge::kShortcut,
-      snapshot_->root()->index(),
-      child_entry);
+  filler_->SetNamedAutoIndexReference(HeapGraphEdge::kShortcut,
+                                      snapshot_->root()->index(), nullptr,
+                                      child_entry);
 }
 
-void V8HeapExplorer::SetGcRootsReference(VisitorSynchronization::SyncTag tag) {
-  filler_->SetIndexedAutoIndexReference(
-      HeapGraphEdge::kElement,
-      snapshot_->gc_roots()->index(),
-      snapshot_->gc_subroot(tag));
+void V8HeapExplorer::SetGcRootsReference(Root root) {
+  filler_->SetIndexedAutoIndexReference(HeapGraphEdge::kElement,
+                                        snapshot_->gc_roots()->index(),
+                                        snapshot_->gc_subroot(root));
 }
 
-void V8HeapExplorer::SetGcSubrootReference(
-    VisitorSynchronization::SyncTag tag, bool is_weak, Object* child_obj) {
+void V8HeapExplorer::SetGcSubrootReference(Root root, const char* description,
+                                           bool is_weak, Object* child_obj) {
   HeapEntry* child_entry = GetEntry(child_obj);
   if (child_entry == nullptr) return;
   const char* name = GetStrongGcSubrootName(child_obj);
+  HeapGraphEdge::Type edge_type =
+      is_weak ? HeapGraphEdge::kWeak : HeapGraphEdge::kInternal;
   if (name != nullptr) {
-    DCHECK(!is_weak);
-    filler_->SetNamedReference(HeapGraphEdge::kInternal,
-                               snapshot_->gc_subroot(tag)->index(), name,
-                               child_entry);
+    filler_->SetNamedReference(edge_type, snapshot_->gc_subroot(root)->index(),
+                               name, child_entry);
   } else {
-    if (is_weak) {
-      filler_->SetNamedAutoIndexReference(HeapGraphEdge::kWeak,
-                                          snapshot_->gc_subroot(tag)->index(),
-                                          child_entry);
-    } else {
-      filler_->SetIndexedAutoIndexReference(HeapGraphEdge::kElement,
-                                            snapshot_->gc_subroot(tag)->index(),
-                                            child_entry);
-    }
+    filler_->SetNamedAutoIndexReference(edge_type,
+                                        snapshot_->gc_subroot(root)->index(),
+                                        description, child_entry);
   }
 
   // Add a shortcut to JS global object reference at snapshot root.
@@ -1945,7 +1931,8 @@ void V8HeapExplorer::TagFixedArraySubType(const FixedArray* array,
 
 class GlobalObjectsEnumerator : public RootVisitor {
  public:
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {
     for (Object** p = start; p < end; p++) {
       if (!(*p)->IsNativeContext()) continue;
       JSObject* proxy = Context::cast(*p)->global_proxy();
@@ -1983,6 +1970,57 @@ void V8HeapExplorer::TagGlobalObjects() {
   }
 }
 
+class EmbedderGraphImpl : public EmbedderGraph {
+ public:
+  struct Edge {
+    Node* from;
+    Node* to;
+  };
+
+  class V8NodeImpl : public Node {
+   public:
+    explicit V8NodeImpl(Object* object) : object_(object) {}
+    Object* GetObject() { return object_; }
+
+    // Node overrides.
+    bool IsEmbedderNode() override { return false; }
+    const char* Name() override {
+      // The name should be retrieved via GetObject().
+      UNREACHABLE();
+      return "";
+    }
+    size_t SizeInBytes() override {
+      // The size should be retrieved via GetObject().
+      UNREACHABLE();
+      return 0;
+    }
+
+   private:
+    Object* object_;
+  };
+
+  Node* V8Node(const v8::Local<v8::Value>& value) final {
+    Handle<Object> object = v8::Utils::OpenHandle(*value);
+    DCHECK(!object.is_null());
+    return AddNode(std::unique_ptr<Node>(new V8NodeImpl(*object)));
+  }
+
+  Node* AddNode(std::unique_ptr<Node> node) final {
+    Node* result = node.get();
+    nodes_.push_back(std::move(node));
+    return result;
+  }
+
+  void AddEdge(Node* from, Node* to) final { edges_.push_back({from, to}); }
+
+  const std::vector<std::unique_ptr<Node>>& nodes() { return nodes_; }
+  const std::vector<Edge>& edges() { return edges_; }
+
+ private:
+  std::vector<std::unique_ptr<Node>> nodes_;
+  std::vector<Edge> edges_;
+};
+
 class GlobalHandlesExtractor : public PersistentHandleVisitor {
  public:
   explicit GlobalHandlesExtractor(NativeObjectsExplorer* explorer)
@@ -2034,6 +2072,60 @@ HeapEntry* BasicHeapEntriesAllocator::AllocateEntry(HeapThing ptr) {
       0);
 }
 
+class EmbedderGraphEntriesAllocator : public HeapEntriesAllocator {
+ public:
+  explicit EmbedderGraphEntriesAllocator(HeapSnapshot* snapshot)
+      : snapshot_(snapshot),
+        names_(snapshot_->profiler()->names()),
+        heap_object_map_(snapshot_->profiler()->heap_object_map()) {}
+  virtual HeapEntry* AllocateEntry(HeapThing ptr);
+
+ private:
+  HeapSnapshot* snapshot_;
+  StringsStorage* names_;
+  HeapObjectsMap* heap_object_map_;
+};
+
+namespace {
+
+const char* EmbedderGraphNodeName(StringsStorage* names,
+                                  EmbedderGraphImpl::Node* node) {
+  const char* prefix = node->NamePrefix();
+  return prefix ? names->GetFormatted("%s %s", prefix, node->Name())
+                : names->GetCopy(node->Name());
+}
+
+HeapEntry::Type EmbedderGraphNodeType(EmbedderGraphImpl::Node* node) {
+  return HeapEntry::kNative;
+}
+
+// Merges the names of an embedder node and its wrapper node.
+// If the wrapper node name contains a tag suffix (part after '/') then the
+// result is the embedder node name concatenated with the tag suffix.
+// Otherwise, the result is the embedder node name.
+const char* MergeNames(StringsStorage* names, const char* embedder_name,
+                       const char* wrapper_name) {
+  for (const char* suffix = wrapper_name; *suffix; suffix++) {
+    if (*suffix == '/') {
+      return names->GetFormatted("%s %s", embedder_name, suffix);
+    }
+  }
+  return embedder_name;
+}
+
+}  // anonymous namespace
+
+HeapEntry* EmbedderGraphEntriesAllocator::AllocateEntry(HeapThing ptr) {
+  EmbedderGraphImpl::Node* node =
+      reinterpret_cast<EmbedderGraphImpl::Node*>(ptr);
+  DCHECK(node->IsEmbedderNode());
+  size_t size = node->SizeInBytes();
+  return snapshot_->AddEntry(
+      EmbedderGraphNodeType(node), EmbedderGraphNodeName(names_, node),
+      static_cast<SnapshotObjectId>(reinterpret_cast<uintptr_t>(node) << 1),
+      static_cast<int>(size), 0);
+}
+
 NativeObjectsExplorer::NativeObjectsExplorer(
     HeapSnapshot* snapshot, SnapshottingProgressReportingInterface* progress)
     : isolate_(snapshot->profiler()->heap_object_map()->heap()->isolate()),
@@ -2042,13 +2134,13 @@ NativeObjectsExplorer::NativeObjectsExplorer(
       embedder_queried_(false),
       objects_by_info_(RetainedInfosMatch),
       native_groups_(StringsMatch),
-      filler_(nullptr) {
-  synthetic_entries_allocator_ =
-      new BasicHeapEntriesAllocator(snapshot, HeapEntry::kSynthetic);
-  native_entries_allocator_ =
-      new BasicHeapEntriesAllocator(snapshot, HeapEntry::kNative);
-}
-
+      synthetic_entries_allocator_(
+          new BasicHeapEntriesAllocator(snapshot, HeapEntry::kSynthetic)),
+      native_entries_allocator_(
+          new BasicHeapEntriesAllocator(snapshot, HeapEntry::kNative)),
+      embedder_graph_entries_allocator_(
+          new EmbedderGraphEntriesAllocator(snapshot)),
+      filler_(nullptr) {}
 
 NativeObjectsExplorer::~NativeObjectsExplorer() {
   for (base::HashMap::Entry* p = objects_by_info_.Start(); p != nullptr;
@@ -2066,8 +2158,6 @@ NativeObjectsExplorer::~NativeObjectsExplorer() {
         reinterpret_cast<v8::RetainedObjectInfo*>(p->value);
     info->Dispose();
   }
-  delete synthetic_entries_allocator_;
-  delete native_entries_allocator_;
 }
 
 
@@ -2114,13 +2204,14 @@ void NativeObjectsExplorer::FillEdges() {
         *pair.first->Get(reinterpret_cast<v8::Isolate*>(isolate_)));
     HeapObject* parent = HeapObject::cast(*parent_object);
     int parent_entry =
-        filler_->FindOrAddEntry(parent, native_entries_allocator_)->index();
+        filler_->FindOrAddEntry(parent, native_entries_allocator_.get())
+            ->index();
     DCHECK_NE(parent_entry, HeapEntry::kNoEntry);
     Handle<Object> child_object = v8::Utils::OpenHandle(
         *pair.second->Get(reinterpret_cast<v8::Isolate*>(isolate_)));
     HeapObject* child = HeapObject::cast(*child_object);
     HeapEntry* child_entry =
-        filler_->FindOrAddEntry(child, native_entries_allocator_);
+        filler_->FindOrAddEntry(child, native_entries_allocator_.get());
     filler_->SetNamedReference(HeapGraphEdge::kInternal, parent_entry, "native",
                                child_entry);
   }
@@ -2139,25 +2230,83 @@ std::vector<HeapObject*>* NativeObjectsExplorer::GetVectorMaybeDisposeInfo(
   return reinterpret_cast<std::vector<HeapObject*>*>(entry->value);
 }
 
+HeapEntry* NativeObjectsExplorer::EntryForEmbedderGraphNode(
+    EmbedderGraphImpl::Node* node) {
+  EmbedderGraphImpl::Node* wrapper = node->WrapperNode();
+  if (wrapper) {
+    node = wrapper;
+  }
+  if (node->IsEmbedderNode()) {
+    return filler_->FindOrAddEntry(node,
+                                   embedder_graph_entries_allocator_.get());
+  } else {
+    EmbedderGraphImpl::V8NodeImpl* v8_node =
+        static_cast<EmbedderGraphImpl::V8NodeImpl*>(node);
+    Object* object = v8_node->GetObject();
+    if (object->IsSmi()) return nullptr;
+    HeapEntry* entry = filler_->FindEntry(HeapObject::cast(object));
+    return entry;
+  }
+}
 
 bool NativeObjectsExplorer::IterateAndExtractReferences(
     SnapshotFiller* filler) {
   filler_ = filler;
-  FillRetainedObjects();
-  FillEdges();
-  if (EstimateObjectsCount() > 0) {
-    for (base::HashMap::Entry* p = objects_by_info_.Start(); p != nullptr;
-         p = objects_by_info_.Next(p)) {
-      v8::RetainedObjectInfo* info =
-          reinterpret_cast<v8::RetainedObjectInfo*>(p->key);
-      SetNativeRootReference(info);
-      std::vector<HeapObject*>* objects =
-          reinterpret_cast<std::vector<HeapObject*>*>(p->value);
-      for (HeapObject* object : *objects) {
-        SetWrapperNativeReferences(object, info);
+
+  if (FLAG_heap_profiler_use_embedder_graph &&
+      snapshot_->profiler()->HasBuildEmbedderGraphCallback()) {
+    v8::HandleScope scope(reinterpret_cast<v8::Isolate*>(isolate_));
+    DisallowHeapAllocation no_allocation;
+    EmbedderGraphImpl graph;
+    snapshot_->profiler()->BuildEmbedderGraph(isolate_, &graph);
+    for (const auto& node : graph.nodes()) {
+      if (node->IsRootNode()) {
+        filler_->SetIndexedAutoIndexReference(
+            HeapGraphEdge::kElement, snapshot_->root()->index(),
+            EntryForEmbedderGraphNode(node.get()));
+      }
+      // Adjust the name and the type of the V8 wrapper node.
+      auto wrapper = node->WrapperNode();
+      if (wrapper) {
+        HeapEntry* wrapper_entry = EntryForEmbedderGraphNode(wrapper);
+        wrapper_entry->set_name(
+            MergeNames(names_, EmbedderGraphNodeName(names_, node.get()),
+                       wrapper_entry->name()));
+        wrapper_entry->set_type(EmbedderGraphNodeType(node.get()));
+      }
+    }
+    // Fill edges of the graph.
+    for (const auto& edge : graph.edges()) {
+      HeapEntry* from = EntryForEmbedderGraphNode(edge.from);
+      // The |from| and |to| can nullptr if the corrsponding node is a V8 node
+      // pointing to a Smi.
+      if (!from) continue;
+      // Adding an entry for |edge.to| can invalidate the |from| entry because
+      // it is an address in std::vector. Use index instead of pointer.
+      int from_index = from->index();
+      HeapEntry* to = EntryForEmbedderGraphNode(edge.to);
+      if (to) {
+        filler_->SetIndexedAutoIndexReference(HeapGraphEdge::kElement,
+                                              from_index, to);
+      }
+    }
+  } else {
+    FillRetainedObjects();
+    FillEdges();
+    if (EstimateObjectsCount() > 0) {
+      for (base::HashMap::Entry* p = objects_by_info_.Start(); p != nullptr;
+           p = objects_by_info_.Next(p)) {
+        v8::RetainedObjectInfo* info =
+            reinterpret_cast<v8::RetainedObjectInfo*>(p->key);
+        SetNativeRootReference(info);
+        std::vector<HeapObject*>* objects =
+            reinterpret_cast<std::vector<HeapObject*>*>(p->value);
+        for (HeapObject* object : *objects) {
+          SetWrapperNativeReferences(object, info);
+        }
       }
+      SetRootNativeRootsReference();
     }
-    SetRootNativeRootsReference();
   }
   filler_ = nullptr;
   return true;
@@ -2210,19 +2359,17 @@ NativeGroupRetainedObjectInfo* NativeObjectsExplorer::FindOrAddGroupInfo(
 void NativeObjectsExplorer::SetNativeRootReference(
     v8::RetainedObjectInfo* info) {
   HeapEntry* child_entry =
-      filler_->FindOrAddEntry(info, native_entries_allocator_);
+      filler_->FindOrAddEntry(info, native_entries_allocator_.get());
   DCHECK_NOT_NULL(child_entry);
   NativeGroupRetainedObjectInfo* group_info =
       FindOrAddGroupInfo(info->GetGroupLabel());
   HeapEntry* group_entry =
-      filler_->FindOrAddEntry(group_info, synthetic_entries_allocator_);
+      filler_->FindOrAddEntry(group_info, synthetic_entries_allocator_.get());
   // |FindOrAddEntry| can move and resize the entries backing store. Reload
   // potentially-stale pointer.
   child_entry = filler_->FindEntry(info);
   filler_->SetNamedAutoIndexReference(
-      HeapGraphEdge::kInternal,
-      group_entry->index(),
-      child_entry);
+      HeapGraphEdge::kInternal, group_entry->index(), nullptr, child_entry);
 }
 
 
@@ -2231,7 +2378,7 @@ void NativeObjectsExplorer::SetWrapperNativeReferences(
   HeapEntry* wrapper_entry = filler_->FindEntry(wrapper);
   DCHECK_NOT_NULL(wrapper_entry);
   HeapEntry* info_entry =
-      filler_->FindOrAddEntry(info, native_entries_allocator_);
+      filler_->FindOrAddEntry(info, native_entries_allocator_.get());
   DCHECK_NOT_NULL(info_entry);
   filler_->SetNamedReference(HeapGraphEdge::kInternal,
                              wrapper_entry->index(),
@@ -2249,7 +2396,7 @@ void NativeObjectsExplorer::SetRootNativeRootsReference() {
     NativeGroupRetainedObjectInfo* group_info =
         static_cast<NativeGroupRetainedObjectInfo*>(entry->value);
     HeapEntry* group_entry =
-        filler_->FindOrAddEntry(group_info, native_entries_allocator_);
+        filler_->FindOrAddEntry(group_info, native_entries_allocator_.get());
     DCHECK_NOT_NULL(group_entry);
     filler_->SetIndexedAutoIndexReference(
         HeapGraphEdge::kElement,
@@ -2357,9 +2504,15 @@ bool HeapSnapshotGenerator::ProgressReport(bool force) {
 void HeapSnapshotGenerator::SetProgressTotal(int iterations_count) {
   if (control_ == nullptr) return;
   HeapIterator iterator(heap_, HeapIterator::kFilterUnreachable);
-  progress_total_ = iterations_count * (
-      v8_heap_explorer_.EstimateObjectsCount(&iterator) +
-      dom_explorer_.EstimateObjectsCount());
+  // The +1 ensures that intermediate ProgressReport calls will never signal
+  // that the work is finished (i.e. progress_counter_ == progress_total_).
+  // Only the forced ProgressReport() at the end of GenerateSnapshot()
+  // should signal that the work is finished because signalling finished twice
+  // breaks the DevTools frontend.
+  progress_total_ =
+      iterations_count * (v8_heap_explorer_.EstimateObjectsCount(&iterator) +
+                          dom_explorer_.EstimateObjectsCount()) +
+      1;
   progress_counter_ = 0;
 }
 
@@ -2677,7 +2830,8 @@ void HeapSnapshotJSONSerializer::SerializeSnapshot() {
             JSON_S("synthetic") ","
             JSON_S("concatenated string") ","
             JSON_S("sliced string") ","
-            JSON_S("symbol")) ","
+            JSON_S("symbol") ","
+            JSON_S("bigint")) ","
         JSON_S("string") ","
         JSON_S("number") ","
         JSON_S("number") ","
diff --git a/deps/v8/src/profiler/heap-snapshot-generator.h b/deps/v8/src/profiler/heap-snapshot-generator.h
index 2dacd5a9fee..8e492807e92 100644
--- a/deps/v8/src/profiler/heap-snapshot-generator.h
+++ b/deps/v8/src/profiler/heap-snapshot-generator.h
@@ -99,7 +99,8 @@ class HeapEntry BASE_EMBEDDED {
     kSynthetic = v8::HeapGraphNode::kSynthetic,
     kConsString = v8::HeapGraphNode::kConsString,
     kSlicedString = v8::HeapGraphNode::kSlicedString,
-    kSymbol = v8::HeapGraphNode::kSymbol
+    kSymbol = v8::HeapGraphNode::kSymbol,
+    kBigInt = v8::HeapGraphNode::kBigInt
   };
   static const int kNoEntry;
 
@@ -113,6 +114,7 @@ class HeapEntry BASE_EMBEDDED {
 
   HeapSnapshot* snapshot() { return snapshot_; }
   Type type() const { return static_cast<Type>(type_); }
+  void set_type(Type type) { type_ = type; }
   const char* name() const { return name_; }
   void set_name(const char* name) { name_ = name; }
   SnapshotObjectId id() const { return id_; }
@@ -165,8 +167,8 @@ class HeapSnapshot {
   HeapProfiler* profiler() { return profiler_; }
   HeapEntry* root() { return &entries_[root_index_]; }
   HeapEntry* gc_roots() { return &entries_[gc_roots_index_]; }
-  HeapEntry* gc_subroot(int index) {
-    return &entries_[gc_subroot_indexes_[index]];
+  HeapEntry* gc_subroot(Root root) {
+    return &entries_[gc_subroot_indexes_[static_cast<int>(root)]];
   }
   std::vector<HeapEntry>& entries() { return entries_; }
   std::deque<HeapGraphEdge>& edges() { return edges_; }
@@ -191,12 +193,12 @@ class HeapSnapshot {
  private:
   HeapEntry* AddRootEntry();
   HeapEntry* AddGcRootsEntry();
-  HeapEntry* AddGcSubrootEntry(int tag, SnapshotObjectId id);
+  HeapEntry* AddGcSubrootEntry(Root root, SnapshotObjectId id);
 
   HeapProfiler* profiler_;
   int root_index_;
   int gc_roots_index_;
-  int gc_subroot_indexes_[VisitorSynchronization::kNumberOfSyncTags];
+  int gc_subroot_indexes_[static_cast<int>(Root::kNumberOfRoots)];
   std::vector<HeapEntry> entries_;
   std::deque<HeapGraphEdge> edges_;
   std::deque<HeapGraphEdge*> children_;
@@ -354,7 +356,7 @@ class V8HeapExplorer : public HeapEntriesAllocator {
   typedef bool (V8HeapExplorer::*ExtractReferencesMethod)(int entry,
                                                           HeapObject* object);
 
-  void MarkVisitedField(HeapObject* obj, int offset);
+  void MarkVisitedField(int offset);
 
   HeapEntry* AddEntry(HeapObject* object);
   HeapEntry* AddEntry(HeapObject* object,
@@ -384,12 +386,16 @@ class V8HeapExplorer : public HeapEntriesAllocator {
   void ExtractAccessorPairReferences(int entry, AccessorPair* accessors);
   void ExtractCodeReferences(int entry, Code* code);
   void ExtractCellReferences(int entry, Cell* cell);
+  void ExtractFeedbackCellReferences(int entry, FeedbackCell* feedback_cell);
   void ExtractWeakCellReferences(int entry, WeakCell* weak_cell);
   void ExtractPropertyCellReferences(int entry, PropertyCell* cell);
   void ExtractAllocationSiteReferences(int entry, AllocationSite* site);
   void ExtractJSArrayBufferReferences(int entry, JSArrayBuffer* buffer);
   void ExtractJSPromiseReferences(int entry, JSPromise* promise);
   void ExtractFixedArrayReferences(int entry, FixedArray* array);
+  void ExtractFeedbackVectorReferences(int entry,
+                                       FeedbackVector* feedback_vector);
+  void ExtractWeakFixedArrayReferences(int entry, WeakFixedArray* array);
   void ExtractPropertyReferences(JSObject* js_obj, int entry);
   void ExtractAccessorPairProperty(JSObject* js_obj, int entry, Name* key,
                                    Object* callback_obj, int field_offset = -1);
@@ -445,9 +451,9 @@ class V8HeapExplorer : public HeapEntriesAllocator {
 
   void SetUserGlobalReference(Object* user_global);
   void SetRootGcRootsReference();
-  void SetGcRootsReference(VisitorSynchronization::SyncTag tag);
-  void SetGcSubrootReference(
-      VisitorSynchronization::SyncTag tag, bool is_weak, Object* child);
+  void SetGcRootsReference(Root root);
+  void SetGcSubrootReference(Root root, const char* description, bool is_weak,
+                             Object* child);
   const char* GetStrongGcSubrootName(Object* object);
   void TagObject(Object* obj, const char* tag);
   void TagFixedArraySubType(const FixedArray* array,
@@ -467,7 +473,7 @@ class V8HeapExplorer : public HeapEntriesAllocator {
   std::unordered_map<const FixedArray*, FixedArraySubInstanceType> array_types_;
   v8::HeapProfiler::ObjectNameResolver* global_object_name_resolver_;
 
-  std::vector<bool> marks_;
+  std::vector<bool> visited_fields_;
 
   friend class IndexedReferencesExtractor;
   friend class RootsReferencesExtractor;
@@ -514,6 +520,8 @@ class NativeObjectsExplorer {
 
   NativeGroupRetainedObjectInfo* FindOrAddGroupInfo(const char* label);
 
+  HeapEntry* EntryForEmbedderGraphNode(EmbedderGraph::Node* node);
+
   Isolate* isolate_;
   HeapSnapshot* snapshot_;
   StringsStorage* names_;
@@ -522,8 +530,9 @@ class NativeObjectsExplorer {
   // RetainedObjectInfo* -> std::vector<HeapObject*>*
   base::CustomMatcherHashMap objects_by_info_;
   base::CustomMatcherHashMap native_groups_;
-  HeapEntriesAllocator* synthetic_entries_allocator_;
-  HeapEntriesAllocator* native_entries_allocator_;
+  std::unique_ptr<HeapEntriesAllocator> synthetic_entries_allocator_;
+  std::unique_ptr<HeapEntriesAllocator> native_entries_allocator_;
+  std::unique_ptr<HeapEntriesAllocator> embedder_graph_entries_allocator_;
   // Used during references extraction.
   SnapshotFiller* filler_;
   v8::HeapProfiler::RetainerEdges edges_;
diff --git a/deps/v8/src/profiler/profile-generator-inl.h b/deps/v8/src/profiler/profile-generator-inl.h
index 5a7017ad490..970d462937f 100644
--- a/deps/v8/src/profiler/profile-generator-inl.h
+++ b/deps/v8/src/profiler/profile-generator-inl.h
@@ -13,7 +13,8 @@ namespace internal {
 CodeEntry::CodeEntry(CodeEventListener::LogEventsAndTags tag, const char* name,
                      const char* name_prefix, const char* resource_name,
                      int line_number, int column_number,
-                     JITLineInfoTable* line_info, Address instruction_start)
+                     std::unique_ptr<JITLineInfoTable> line_info,
+                     Address instruction_start)
     : bit_field_(TagField::encode(tag) |
                  BuiltinIdField::encode(Builtins::builtin_count)),
       name_prefix_(name_prefix),
@@ -26,7 +27,7 @@ CodeEntry::CodeEntry(CodeEventListener::LogEventsAndTags tag, const char* name,
       bailout_reason_(kEmptyBailoutReason),
       deopt_reason_(kNoDeoptReason),
       deopt_id_(kNoDeoptimizationId),
-      line_info_(line_info),
+      line_info_(std::move(line_info)),
       instruction_start_(instruction_start) {}
 
 ProfileNode::ProfileNode(ProfileTree* tree, CodeEntry* entry,
diff --git a/deps/v8/src/profiler/profile-generator.cc b/deps/v8/src/profiler/profile-generator.cc
index bb6ede6d958..db957189367 100644
--- a/deps/v8/src/profiler/profile-generator.cc
+++ b/deps/v8/src/profiler/profile-generator.cc
@@ -85,16 +85,6 @@ CodeEntry* CodeEntry::UnresolvedEntryCreateTrait::Create() {
                        CodeEntry::kUnresolvedFunctionName);
 }
 
-CodeEntry::~CodeEntry() {
-  delete line_info_;
-  for (auto location : inline_locations_) {
-    for (auto entry : location.second) {
-      delete entry;
-    }
-  }
-}
-
-
 uint32_t CodeEntry::GetHash() const {
   uint32_t hash = ComputeIntegerHash(tag());
   if (script_id_ != v8::UnboundScript::kNoScriptId) {
@@ -137,12 +127,13 @@ int CodeEntry::GetSourceLine(int pc_offset) const {
   return v8::CpuProfileNode::kNoLineNumberInfo;
 }
 
-void CodeEntry::AddInlineStack(int pc_offset,
-                               std::vector<CodeEntry*> inline_stack) {
+void CodeEntry::AddInlineStack(
+    int pc_offset, std::vector<std::unique_ptr<CodeEntry>> inline_stack) {
   inline_locations_.insert(std::make_pair(pc_offset, std::move(inline_stack)));
 }
 
-const std::vector<CodeEntry*>* CodeEntry::GetInlineStack(int pc_offset) const {
+const std::vector<std::unique_ptr<CodeEntry>>* CodeEntry::GetInlineStack(
+    int pc_offset) const {
   auto it = inline_locations_.find(pc_offset);
   return it != inline_locations_.end() ? &it->second : nullptr;
 }
@@ -161,7 +152,7 @@ void CodeEntry::FillFunctionInfo(SharedFunctionInfo* shared) {
   if (!shared->script()->IsScript()) return;
   Script* script = Script::cast(shared->script());
   set_script_id(script->id());
-  set_position(shared->start_position());
+  set_position(shared->StartPosition());
   set_bailout_reason(GetBailoutReason(shared->disable_optimization_reason()));
 }
 
@@ -528,9 +519,9 @@ void CodeMap::MoveCode(Address from, Address to) {
 }
 
 void CodeMap::Print() {
-  for (auto it = code_map_.begin(); it != code_map_.end(); ++it) {
-    base::OS::Print("%p %5d %s\n", static_cast<void*>(it->first),
-                    it->second.size, it->second.entry->name());
+  for (const auto& pair : code_map_) {
+    base::OS::Print("%p %5d %s\n", static_cast<void*>(pair.first),
+                    pair.second.size, pair.second.entry->name());
   }
 }
 
@@ -539,12 +530,6 @@ CpuProfilesCollection::CpuProfilesCollection(Isolate* isolate)
       profiler_(nullptr),
       current_profiles_semaphore_(1) {}
 
-CpuProfilesCollection::~CpuProfilesCollection() {
-  for (CpuProfile* profile : finished_profiles_) delete profile;
-  for (CpuProfile* profile : current_profiles_) delete profile;
-}
-
-
 bool CpuProfilesCollection::StartProfiling(const char* title,
                                            bool record_samples) {
   current_profiles_semaphore_.Wait();
@@ -552,7 +537,7 @@ bool CpuProfilesCollection::StartProfiling(const char* title,
     current_profiles_semaphore_.Signal();
     return false;
   }
-  for (CpuProfile* profile : current_profiles_) {
+  for (const std::unique_ptr<CpuProfile>& profile : current_profiles_) {
     if (strcmp(profile->title(), title) == 0) {
       // Ignore attempts to start profile with the same title...
       current_profiles_semaphore_.Signal();
@@ -560,7 +545,8 @@ bool CpuProfilesCollection::StartProfiling(const char* title,
       return true;
     }
   }
-  current_profiles_.push_back(new CpuProfile(profiler_, title, record_samples));
+  current_profiles_.emplace_back(
+      new CpuProfile(profiler_, title, record_samples));
   current_profiles_semaphore_.Signal();
   return true;
 }
@@ -570,19 +556,22 @@ CpuProfile* CpuProfilesCollection::StopProfiling(const char* title) {
   const int title_len = StrLength(title);
   CpuProfile* profile = nullptr;
   current_profiles_semaphore_.Wait();
-  for (size_t i = current_profiles_.size(); i != 0; --i) {
-    CpuProfile* current_profile = current_profiles_[i - 1];
-    if (title_len == 0 || strcmp(current_profile->title(), title) == 0) {
-      profile = current_profile;
-      current_profiles_.erase(current_profiles_.begin() + i - 1);
-      break;
-    }
+
+  auto it =
+      std::find_if(current_profiles_.rbegin(), current_profiles_.rend(),
+                   [&](const std::unique_ptr<CpuProfile>& p) {
+                     return title_len == 0 || strcmp(p->title(), title) == 0;
+                   });
+
+  if (it != current_profiles_.rend()) {
+    (*it)->FinishProfile();
+    profile = it->get();
+    finished_profiles_.push_back(std::move(*it));
+    // Convert reverse iterator to matching forward iterator.
+    current_profiles_.erase(--(it.base()));
   }
-  current_profiles_semaphore_.Signal();
 
-  if (!profile) return nullptr;
-  profile->FinishProfile();
-  finished_profiles_.push_back(profile);
+  current_profiles_semaphore_.Signal();
   return profile;
 }
 
@@ -599,7 +588,10 @@ bool CpuProfilesCollection::IsLastProfile(const char* title) {
 void CpuProfilesCollection::RemoveProfile(CpuProfile* profile) {
   // Called from VM thread for a completed profile.
   auto pos =
-      std::find(finished_profiles_.begin(), finished_profiles_.end(), profile);
+      std::find_if(finished_profiles_.begin(), finished_profiles_.end(),
+                   [&](const std::unique_ptr<CpuProfile>& finished_profile) {
+                     return finished_profile.get() == profile;
+                   });
   DCHECK(pos != finished_profiles_.end());
   finished_profiles_.erase(pos);
 }
@@ -611,7 +603,7 @@ void CpuProfilesCollection::AddPathToCurrentProfiles(
   // method, we don't bother minimizing the duration of lock holding,
   // e.g. copying contents of the list to a local vector.
   current_profiles_semaphore_.Wait();
-  for (CpuProfile* profile : current_profiles_) {
+  for (const std::unique_ptr<CpuProfile>& profile : current_profiles_) {
     profile->AddPath(timestamp, path, src_line, update_stats);
   }
   current_profiles_semaphore_.Signal();
@@ -684,11 +676,13 @@ void ProfileGenerator::RecordTickSample(const TickSample& sample) {
         // Find out if the entry has an inlining stack associated.
         int pc_offset =
             static_cast<int>(stack_pos - entry->instruction_start());
-        const std::vector<CodeEntry*>* inline_stack =
+        const std::vector<std::unique_ptr<CodeEntry>>* inline_stack =
             entry->GetInlineStack(pc_offset);
         if (inline_stack) {
-          entries.insert(entries.end(), inline_stack->rbegin(),
-                         inline_stack->rend());
+          std::transform(
+              inline_stack->rbegin(), inline_stack->rend(),
+              std::back_inserter(entries),
+              [](const std::unique_ptr<CodeEntry>& ptr) { return ptr.get(); });
         }
         // Skip unresolved frames (e.g. internal frame) and get source line of
         // the first JS caller.
diff --git a/deps/v8/src/profiler/profile-generator.h b/deps/v8/src/profiler/profile-generator.h
index 819800ae6bc..5abb955a461 100644
--- a/deps/v8/src/profiler/profile-generator.h
+++ b/deps/v8/src/profiler/profile-generator.h
@@ -8,6 +8,7 @@
 #include <map>
 #include <vector>
 
+#include "include/v8-profiler.h"
 #include "src/allocation.h"
 #include "src/base/hashmap.h"
 #include "src/log.h"
@@ -47,9 +48,8 @@ class CodeEntry {
                    const char* resource_name = CodeEntry::kEmptyResourceName,
                    int line_number = v8::CpuProfileNode::kNoLineNumberInfo,
                    int column_number = v8::CpuProfileNode::kNoColumnNumberInfo,
-                   JITLineInfoTable* line_info = nullptr,
+                   std::unique_ptr<JITLineInfoTable> line_info = nullptr,
                    Address instruction_start = nullptr);
-  ~CodeEntry();
 
   const char* name_prefix() const { return name_prefix_; }
   bool has_name_prefix() const { return name_prefix_[0] != '\0'; }
@@ -57,7 +57,7 @@ class CodeEntry {
   const char* resource_name() const { return resource_name_; }
   int line_number() const { return line_number_; }
   int column_number() const { return column_number_; }
-  const JITLineInfoTable* line_info() const { return line_info_; }
+  const JITLineInfoTable* line_info() const { return line_info_.get(); }
   int script_id() const { return script_id_; }
   void set_script_id(int script_id) { script_id_ = script_id; }
   int position() const { return position_; }
@@ -91,8 +91,10 @@ class CodeEntry {
 
   int GetSourceLine(int pc_offset) const;
 
-  void AddInlineStack(int pc_offset, std::vector<CodeEntry*> inline_stack);
-  const std::vector<CodeEntry*>* GetInlineStack(int pc_offset) const;
+  void AddInlineStack(int pc_offset,
+                      std::vector<std::unique_ptr<CodeEntry>> inline_stack);
+  const std::vector<std::unique_ptr<CodeEntry>>* GetInlineStack(
+      int pc_offset) const;
 
   void AddDeoptInlinedFrames(int deopt_id, std::vector<CpuProfileDeoptFrame>);
   bool HasDeoptInlinedFramesFor(int deopt_id) const;
@@ -160,10 +162,10 @@ class CodeEntry {
   const char* bailout_reason_;
   const char* deopt_reason_;
   int deopt_id_;
-  JITLineInfoTable* line_info_;
+  std::unique_ptr<JITLineInfoTable> line_info_;
   Address instruction_start_;
   // Should be an unordered_map, but it doesn't currently work on Win & MacOS.
-  std::map<int, std::vector<CodeEntry*>> inline_locations_;
+  std::map<int, std::vector<std::unique_ptr<CodeEntry>>> inline_locations_;
   std::map<int, std::vector<CpuProfileDeoptFrame>> deopt_inlined_frames_;
 
   DISALLOW_COPY_AND_ASSIGN(CodeEntry);
@@ -337,12 +339,13 @@ class CodeMap {
 class CpuProfilesCollection {
  public:
   explicit CpuProfilesCollection(Isolate* isolate);
-  ~CpuProfilesCollection();
 
   void set_cpu_profiler(CpuProfiler* profiler) { profiler_ = profiler; }
   bool StartProfiling(const char* title, bool record_samples);
   CpuProfile* StopProfiling(const char* title);
-  std::vector<CpuProfile*>* profiles() { return &finished_profiles_; }
+  std::vector<std::unique_ptr<CpuProfile>>* profiles() {
+    return &finished_profiles_;
+  }
   const char* GetName(Name* name) { return resource_names_.GetName(name); }
   bool IsLastProfile(const char* title);
   void RemoveProfile(CpuProfile* profile);
@@ -357,11 +360,11 @@ class CpuProfilesCollection {
 
  private:
   StringsStorage resource_names_;
-  std::vector<CpuProfile*> finished_profiles_;
+  std::vector<std::unique_ptr<CpuProfile>> finished_profiles_;
   CpuProfiler* profiler_;
 
   // Accessed by VM thread and profile generator thread.
-  std::vector<CpuProfile*> current_profiles_;
+  std::vector<std::unique_ptr<CpuProfile>> current_profiles_;
   base::Semaphore current_profiles_semaphore_;
 
   DISALLOW_COPY_AND_ASSIGN(CpuProfilesCollection);
diff --git a/deps/v8/src/profiler/profiler-listener.cc b/deps/v8/src/profiler/profiler-listener.cc
index bd2f158e607..52160fce71d 100644
--- a/deps/v8/src/profiler/profiler-listener.cc
+++ b/deps/v8/src/profiler/profiler-listener.cc
@@ -5,10 +5,12 @@
 #include "src/profiler/profiler-listener.h"
 
 #include "src/deoptimizer.h"
+#include "src/instruction-stream.h"
 #include "src/objects-inl.h"
 #include "src/profiler/cpu-profiler.h"
 #include "src/profiler/profile-generator-inl.h"
 #include "src/source-position-table.h"
+#include "src/wasm/wasm-code-manager.h"
 
 namespace v8 {
 namespace internal {
@@ -81,10 +83,10 @@ void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
   rec->start = abstract_code->address();
-  JITLineInfoTable* line_table = nullptr;
+  std::unique_ptr<JITLineInfoTable> line_table;
   if (shared->script()->IsScript()) {
     Script* script = Script::cast(shared->script());
-    line_table = new JITLineInfoTable();
+    line_table.reset(new JITLineInfoTable());
     int offset = abstract_code->IsCode() ? Code::kHeaderSize
                                          : BytecodeArray::kHeaderSize;
     for (SourcePositionTableIterator it(abstract_code->source_position_table());
@@ -101,8 +103,8 @@ void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   }
   rec->entry = NewCodeEntry(
       tag, GetFunctionName(shared->DebugName()), CodeEntry::kEmptyNamePrefix,
-      GetName(InferScriptName(script_name, shared)), line, column, line_table,
-      abstract_code->instruction_start());
+      GetName(InferScriptName(script_name, shared)), line, column,
+      std::move(line_table), abstract_code->instruction_start());
   RecordInliningInfo(rec->entry, abstract_code);
   RecordDeoptInlinedFrames(rec->entry, abstract_code);
   rec->entry->FillFunctionInfo(shared);
@@ -110,6 +112,24 @@ void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   DispatchCodeEvent(evt_rec);
 }
 
+void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
+                                       const wasm::WasmCode* code,
+                                       wasm::WasmName name) {
+  CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
+  CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
+  rec->start = code->instructions().start();
+  // TODO(herhut): Instead of sanitizing here, make sure all wasm functions
+  //               have names.
+  const char* name_ptr =
+      name.start() == nullptr ? "<anonymous>" : GetFunctionName(name.start());
+  rec->entry = NewCodeEntry(
+      tag, name_ptr, CodeEntry::kEmptyNamePrefix, CodeEntry::kEmptyResourceName,
+      CpuProfileNode::kNoLineNumberInfo, CpuProfileNode::kNoColumnNumberInfo,
+      nullptr, code->instructions().start());
+  rec->size = code->instructions().length();
+  DispatchCodeEvent(evt_rec);
+}
+
 void ProfilerListener::CodeMoveEvent(AbstractCode* from, Address to) {
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_MOVE);
   CodeMoveEventRecord* rec = &evt_rec.CodeMoveEventRecord_;
@@ -199,7 +219,7 @@ void ProfilerListener::RecordInliningInfo(CodeEntry* entry,
     DCHECK_EQ(Translation::BEGIN, opcode);
     it.Skip(Translation::NumberOfOperandsFor(opcode));
     int depth = 0;
-    std::vector<CodeEntry*> inline_stack;
+    std::vector<std::unique_ptr<CodeEntry>> inline_stack;
     while (it.HasNext() &&
            Translation::BEGIN !=
                (opcode = static_cast<Translation::Opcode>(it.Next()))) {
@@ -227,7 +247,7 @@ void ProfilerListener::RecordInliningInfo(CodeEntry* entry,
                         CpuProfileNode::kNoColumnNumberInfo, nullptr,
                         code->instruction_start());
       inline_entry->FillFunctionInfo(shared_info);
-      inline_stack.push_back(inline_entry);
+      inline_stack.emplace_back(inline_entry);
     }
     if (!inline_stack.empty()) {
       entry->AddInlineStack(pc_offset, std::move(inline_stack));
@@ -276,10 +296,11 @@ void ProfilerListener::RecordDeoptInlinedFrames(CodeEntry* entry,
 CodeEntry* ProfilerListener::NewCodeEntry(
     CodeEventListener::LogEventsAndTags tag, const char* name,
     const char* name_prefix, const char* resource_name, int line_number,
-    int column_number, JITLineInfoTable* line_info, Address instruction_start) {
+    int column_number, std::unique_ptr<JITLineInfoTable> line_info,
+    Address instruction_start) {
   std::unique_ptr<CodeEntry> code_entry = base::make_unique<CodeEntry>(
       tag, name, name_prefix, resource_name, line_number, column_number,
-      line_info, instruction_start);
+      std::move(line_info), instruction_start);
   CodeEntry* raw_code_entry = code_entry.get();
   code_entries_.push_back(std::move(code_entry));
   return raw_code_entry;
diff --git a/deps/v8/src/profiler/profiler-listener.h b/deps/v8/src/profiler/profiler-listener.h
index c111bf81c4b..791b66f3ed0 100644
--- a/deps/v8/src/profiler/profiler-listener.h
+++ b/deps/v8/src/profiler/profiler-listener.h
@@ -37,6 +37,10 @@ class ProfilerListener : public CodeEventListener {
   void CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
                        AbstractCode* code, SharedFunctionInfo* shared,
                        Name* script_name, int line, int column) override;
+  void CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
+                       const wasm::WasmCode* code,
+                       wasm::WasmName name) override;
+
   void CodeMovingGCEvent() override {}
   void CodeMoveEvent(AbstractCode* from, Address to) override;
   void CodeDisableOptEvent(AbstractCode* code,
@@ -54,7 +58,7 @@ class ProfilerListener : public CodeEventListener {
       const char* resource_name = CodeEntry::kEmptyResourceName,
       int line_number = v8::CpuProfileNode::kNoLineNumberInfo,
       int column_number = v8::CpuProfileNode::kNoColumnNumberInfo,
-      JITLineInfoTable* line_info = nullptr,
+      std::unique_ptr<JITLineInfoTable> line_info = nullptr,
       Address instruction_start = nullptr);
 
   void AddObserver(CodeEventObserver* observer);
diff --git a/deps/v8/src/profiler/sampling-heap-profiler.cc b/deps/v8/src/profiler/sampling-heap-profiler.cc
index fef21550ec1..6912f3eba11 100644
--- a/deps/v8/src/profiler/sampling-heap-profiler.cc
+++ b/deps/v8/src/profiler/sampling-heap-profiler.cc
@@ -76,11 +76,7 @@ SamplingHeapProfiler::~SamplingHeapProfiler() {
   heap_->RemoveAllocationObserversFromAllSpaces(other_spaces_observer_.get(),
                                                 new_space_observer_.get());
 
-  for (auto sample : samples_) {
-    delete sample;
-  }
-  std::set<Sample*> empty;
-  samples_.swap(empty);
+  samples_.clear();
 }
 
 
@@ -101,7 +97,7 @@ void SamplingHeapProfiler::SampleObject(Address soon_object, size_t size) {
   AllocationNode* node = AddStack();
   node->allocations_[size]++;
   Sample* sample = new Sample(size, node, loc, this);
-  samples_.insert(sample);
+  samples_.emplace(sample);
   sample->global.SetWeak(sample, OnWeakCallback, WeakCallbackType::kParameter);
 }
 
@@ -123,8 +119,14 @@ void SamplingHeapProfiler::OnWeakCallback(
       node = parent;
     }
   }
-  sample->profiler->samples_.erase(sample);
-  delete sample;
+  auto it = std::find_if(sample->profiler->samples_.begin(),
+                         sample->profiler->samples_.end(),
+                         [&sample](const std::unique_ptr<Sample>& s) {
+                           return s.get() == sample;
+                         });
+
+  sample->profiler->samples_.erase(it);
+  // sample is deleted because its unique ptr was erased from samples_.
 }
 
 SamplingHeapProfiler::AllocationNode*
@@ -207,7 +209,7 @@ SamplingHeapProfiler::AllocationNode* SamplingHeapProfiler::AddStack() {
       Script* script = Script::cast(shared->script());
       script_id = script->id();
     }
-    node = node->FindOrAddChildNode(name, script_id, shared->start_position());
+    node = node->FindOrAddChildNode(name, script_id, shared->StartPosition());
   }
 
   if (found_arguments_marker_frames) {
diff --git a/deps/v8/src/profiler/sampling-heap-profiler.h b/deps/v8/src/profiler/sampling-heap-profiler.h
index 3a347dd54ea..46fa4052796 100644
--- a/deps/v8/src/profiler/sampling-heap-profiler.h
+++ b/deps/v8/src/profiler/sampling-heap-profiler.h
@@ -146,7 +146,7 @@ class SamplingHeapProfiler {
   std::unique_ptr<SamplingAllocationObserver> other_spaces_observer_;
   StringsStorage* const names_;
   AllocationNode profile_root_;
-  std::set<Sample*> samples_;
+  std::set<std::unique_ptr<Sample>> samples_;
   const int stack_depth_;
   const uint64_t rate_;
   v8::HeapProfiler::SamplingFlags flags_;
diff --git a/deps/v8/src/profiler/strings-storage.cc b/deps/v8/src/profiler/strings-storage.cc
index 2e8ad779fd0..9ea7770b4b0 100644
--- a/deps/v8/src/profiler/strings-storage.cc
+++ b/deps/v8/src/profiler/strings-storage.cc
@@ -80,7 +80,7 @@ const char* StringsStorage::GetVFormatted(const char* format, va_list args) {
 const char* StringsStorage::GetName(Name* name) {
   if (name->IsString()) {
     String* str = String::cast(name);
-    int length = Min(kMaxNameSize, str->length());
+    int length = Min(FLAG_heap_snapshot_string_limit, str->length());
     int actual_length = 0;
     std::unique_ptr<char[]> data = str->ToCString(
         DISALLOW_NULLS, ROBUST_STRING_TRAVERSAL, 0, length, &actual_length);
diff --git a/deps/v8/src/profiler/strings-storage.h b/deps/v8/src/profiler/strings-storage.h
index d73a9dd208a..834b5a33350 100644
--- a/deps/v8/src/profiler/strings-storage.h
+++ b/deps/v8/src/profiler/strings-storage.h
@@ -31,8 +31,6 @@ class StringsStorage {
   const char* GetFunctionName(const char* name);
 
  private:
-  static const int kMaxNameSize = 1024;
-
   static bool StringsMatch(void* key1, void* key2);
   const char* AddOrDisposeString(char* str, int len);
   base::CustomMatcherHashMap::Entry* GetEntry(const char* str, int len);
diff --git a/deps/v8/src/profiler/tick-sample.cc b/deps/v8/src/profiler/tick-sample.cc
index 44bf9af3d1e..a6b8b26d00e 100644
--- a/deps/v8/src/profiler/tick-sample.cc
+++ b/deps/v8/src/profiler/tick-sample.cc
@@ -204,7 +204,12 @@ bool TickSample::GetStackSample(Isolate* v8_isolate, RegisterState* regs,
 #endif
   DCHECK(regs->sp);
 
-  if (regs->pc && IsNoFrameRegion(static_cast<i::Address>(regs->pc))) {
+  // Check whether we interrupted setup/teardown of a stack frame in JS code.
+  // Avoid this check for C++ code, as that would trigger false positives.
+  if (regs->pc &&
+      isolate->heap()->memory_allocator()->code_range()->contains(
+          static_cast<i::Address>(regs->pc)) &&
+      IsNoFrameRegion(static_cast<i::Address>(regs->pc))) {
     // The frame is not setup, so it'd be hard to iterate the stack. Bailout.
     return false;
   }
diff --git a/deps/v8/src/profiler/tracing-cpu-profiler.h b/deps/v8/src/profiler/tracing-cpu-profiler.h
index e654f2be9d6..ccd1fa42a2d 100644
--- a/deps/v8/src/profiler/tracing-cpu-profiler.h
+++ b/deps/v8/src/profiler/tracing-cpu-profiler.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_PROFILER_TRACING_CPU_PROFILER_H
-#define V8_PROFILER_TRACING_CPU_PROFILER_H
+#ifndef V8_PROFILER_TRACING_CPU_PROFILER_H_
+#define V8_PROFILER_TRACING_CPU_PROFILER_H_
 
 #include "include/v8-platform.h"
 #include "include/v8-profiler.h"
@@ -43,4 +43,4 @@ class TracingCpuProfilerImpl final
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_PROFILER_TRACING_CPU_PROFILER_H
+#endif  // V8_PROFILER_TRACING_CPU_PROFILER_H_
diff --git a/deps/v8/src/profiler/unbound-queue.h b/deps/v8/src/profiler/unbound-queue.h
index c53b35a8edb..062f1ce6093 100644
--- a/deps/v8/src/profiler/unbound-queue.h
+++ b/deps/v8/src/profiler/unbound-queue.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_PROFILER_UNBOUND_QUEUE_
-#define V8_PROFILER_UNBOUND_QUEUE_
+#ifndef V8_PROFILER_UNBOUND_QUEUE_H_
+#define V8_PROFILER_UNBOUND_QUEUE_H_
 
 #include "src/allocation.h"
 #include "src/base/atomicops.h"
@@ -45,4 +45,4 @@ class UnboundQueue BASE_EMBEDDED {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_PROFILER_UNBOUND_QUEUE_
+#endif  // V8_PROFILER_UNBOUND_QUEUE_H_
diff --git a/deps/v8/src/property.h b/deps/v8/src/property.h
index 5c744a1bd73..eccaeb006f9 100644
--- a/deps/v8/src/property.h
+++ b/deps/v8/src/property.h
@@ -7,7 +7,11 @@
 
 #include <iosfwd>
 
-#include "src/factory.h"
+#include "src/globals.h"
+#include "src/handles.h"
+#include "src/objects.h"
+#include "src/objects/name.h"
+#include "src/property-details.h"
 
 namespace v8 {
 namespace internal {
diff --git a/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.cc b/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.cc
index 5f9d3905a31..efe854efdd4 100644
--- a/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.cc
+++ b/deps/v8/src/regexp/arm/regexp-macro-assembler-arm.cc
@@ -575,7 +575,7 @@ bool RegExpMacroAssemblerARM::CheckSpecialCharacterClass(uc16 type,
       __ cmp(current_character(), Operand('z'));
       BranchOrBacktrack(hi, on_no_match);
     }
-    ExternalReference map = ExternalReference::re_word_character_map();
+    ExternalReference map = ExternalReference::re_word_character_map(isolate());
     __ mov(r0, Operand(map));
     __ ldrb(r0, MemOperand(r0, current_character()));
     __ cmp(r0, Operand::Zero());
@@ -589,7 +589,7 @@ bool RegExpMacroAssemblerARM::CheckSpecialCharacterClass(uc16 type,
       __ cmp(current_character(), Operand('z'));
       __ b(hi, &done);
     }
-    ExternalReference map = ExternalReference::re_word_character_map();
+    ExternalReference map = ExternalReference::re_word_character_map(isolate());
     __ mov(r0, Operand(map));
     __ ldrb(r0, MemOperand(r0, current_character()));
     __ cmp(r0, Operand::Zero());
diff --git a/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.cc b/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.cc
index 5f77ff4021d..bf68d8061ee 100644
--- a/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.cc
+++ b/deps/v8/src/regexp/arm64/regexp-macro-assembler-arm64.cc
@@ -41,7 +41,7 @@ namespace internal {
  * - x29/fp  : Frame pointer. Used to access arguments, local variables and
  *             RegExp registers.
  * - x16/x17 : IP registers, used by assembler. Very volatile.
- * - csp     : Points to tip of C stack.
+ * - sp      : Points to tip of C stack.
  *
  * - x0-x7   : Used as a cache to store 32 bit capture registers. These
  *             registers need to be retained every time a call to C code
@@ -57,7 +57,7 @@ namespace internal {
  *              the code)
  *
  *  - fp[96]   isolate            Address of the current isolate.
- *  ^^^ csp when called ^^^
+ *  ^^^ sp when called ^^^
  *  - fp[88]    lr                 Return from the RegExp code.
  *  - fp[80]    r29                Old frame pointer (CalleeSaved).
  *  - fp[0..72] r19-r28            Backup of CalleeSaved registers.
@@ -77,7 +77,7 @@ namespace internal {
  *  -           ...                num_saved_registers_ registers.
  *  -           ...
  *  -           register N + num_registers - 1
- *  ^^^^^^^^^ csp ^^^^^^^^^
+ *  ^^^^^^^^^ sp ^^^^^^^^^
  *
  * The first num_saved_registers_ registers are initialized to point to
  * "character -1" in the string (i.e., char_size() bytes before the first
@@ -650,7 +650,7 @@ bool RegExpMacroAssemblerARM64::CheckSpecialCharacterClass(uc16 type,
       // Table is 256 entries, so all Latin1 characters can be tested.
       CompareAndBranchOrBacktrack(current_character(), 'z', hi, on_no_match);
     }
-    ExternalReference map = ExternalReference::re_word_character_map();
+    ExternalReference map = ExternalReference::re_word_character_map(isolate());
     __ Mov(x10, map);
     __ Ldrb(w10, MemOperand(x10, current_character(), UXTW));
     CompareAndBranchOrBacktrack(w10, 0, eq, on_no_match);
@@ -663,7 +663,7 @@ bool RegExpMacroAssemblerARM64::CheckSpecialCharacterClass(uc16 type,
       __ Cmp(current_character(), 'z');
       __ B(hi, &done);
     }
-    ExternalReference map = ExternalReference::re_word_character_map();
+    ExternalReference map = ExternalReference::re_word_character_map(isolate());
     __ Mov(x10, map);
     __ Ldrb(w10, MemOperand(x10, current_character(), UXTW));
     CompareAndBranchOrBacktrack(w10, 0, ne, on_no_match);
@@ -704,9 +704,8 @@ Handle<HeapObject> RegExpMacroAssemblerARM64::GetCode(Handle<String> source) {
   // x6:  Address  stack_base
   // x7:  int      direct_call
 
-  // The stack pointer should be csp on entry.
-  //  csp[8]:  address of the current isolate
-  //  csp[0]:  secondary link/return address used by native call
+  //  sp[8]:  address of the current isolate
+  //  sp[0]:  secondary link/return address used by native call
 
   // Tell the system that we have a stack frame.  Because the type is MANUAL, no
   // code is generated.
@@ -719,12 +718,11 @@ Handle<HeapObject> RegExpMacroAssemblerARM64::GetCode(Handle<String> source) {
   DCHECK_EQ(11, kCalleeSaved.Count());
   registers_to_retain.Combine(lr);
 
-  DCHECK(csp.Is(__ StackPointer()));
   __ PushCPURegList(registers_to_retain);
   __ PushCPURegList(argument_registers);
 
   // Set frame pointer in place.
-  __ Add(frame_pointer(), csp, argument_registers.Count() * kPointerSize);
+  __ Add(frame_pointer(), sp, argument_registers.Count() * kPointerSize);
 
   // Initialize callee-saved registers.
   __ Mov(start_offset(), w1);
@@ -755,7 +753,7 @@ Handle<HeapObject> RegExpMacroAssemblerARM64::GetCode(Handle<String> source) {
       ExternalReference::address_of_stack_limit(isolate());
   __ Mov(x10, stack_limit);
   __ Ldr(x10, MemOperand(x10));
-  __ Subs(x10, csp, x10);
+  __ Subs(x10, sp, x10);
 
   // Handle it if the stack pointer is already below the stack limit.
   __ B(ls, &stack_limit_hit);
@@ -1015,9 +1013,7 @@ Handle<HeapObject> RegExpMacroAssemblerARM64::GetCode(Handle<String> source) {
   __ Bind(&return_w0);
 
   // Set stack pointer back to first register to retain
-  DCHECK(csp.Is(__ StackPointer()));
-  __ Mov(csp, fp);
-  __ AssertStackConsistency();
+  __ Mov(sp, fp);
 
   // Restore registers.
   __ PopCPURegList(registers_to_retain);
@@ -1036,7 +1032,7 @@ Handle<HeapObject> RegExpMacroAssemblerARM64::GetCode(Handle<String> source) {
     // The cached registers need to be retained.
     __ PushCPURegList(cached_registers);
     CallCheckStackGuardState(x10);
-    // Returning from the regexp code restores the stack (csp <- fp)
+    // Returning from the regexp code restores the stack (sp <- fp)
     // so we don't need to drop the link register from it before exiting.
     __ Cbnz(w0, &return_w0);
     // Reset the cached registers.
@@ -1059,7 +1055,7 @@ Handle<HeapObject> RegExpMacroAssemblerARM64::GetCode(Handle<String> source) {
     __ CallCFunction(grow_stack, 3);
     // If return nullptr, we have failed to grow the stack, and
     // must exit with a stack-overflow exception.
-    // Returning from the regexp code restores the stack (csp <- fp)
+    // Returning from the regexp code restores the stack (sp <- fp)
     // so we don't need to drop the link register from it before exiting.
     __ Cbz(w0, &exit_with_exception);
     // Otherwise use return value as new stack pointer.
@@ -1366,14 +1362,13 @@ void RegExpMacroAssemblerARM64::CallCheckStackGuardState(Register scratch) {
   int align_mask = (alignment / kXRegSize) - 1;
   int xreg_to_claim = (3 + align_mask) & ~align_mask;
 
-  DCHECK(csp.Is(__ StackPointer()));
   __ Claim(xreg_to_claim);
 
   // CheckStackGuardState needs the end and start addresses of the input string.
   __ Poke(input_end(), 2 * kPointerSize);
-  __ Add(x5, csp, 2 * kPointerSize);
+  __ Add(x5, sp, 2 * kPointerSize);
   __ Poke(input_start(), kPointerSize);
-  __ Add(x4, csp, kPointerSize);
+  __ Add(x4, sp, kPointerSize);
 
   __ Mov(w3, start_offset());
   // RegExp code frame pointer.
@@ -1384,7 +1379,7 @@ void RegExpMacroAssemblerARM64::CallCheckStackGuardState(Register scratch) {
   // We need to pass a pointer to the return address as first argument.
   // The DirectCEntry stub will place the return address on the stack before
   // calling so the stack pointer will point to it.
-  __ Mov(x0, csp);
+  __ Mov(x0, sp);
 
   ExternalReference check_stack_guard_state =
       ExternalReference::re_check_stack_guard_state(isolate());
@@ -1396,7 +1391,6 @@ void RegExpMacroAssemblerARM64::CallCheckStackGuardState(Register scratch) {
   __ Peek(input_start(), kPointerSize);
   __ Peek(input_end(), 2 * kPointerSize);
 
-  DCHECK(csp.Is(__ StackPointer()));
   __ Drop(xreg_to_claim);
 
   // Reload the Code pointer.
@@ -1445,8 +1439,7 @@ void RegExpMacroAssemblerARM64::CheckPreemption() {
       ExternalReference::address_of_stack_limit(isolate());
   __ Mov(x10, stack_limit);
   __ Ldr(x10, MemOperand(x10));
-  DCHECK(csp.Is(__ StackPointer()));
-  __ Cmp(csp, x10);
+  __ Cmp(sp, x10);
   CallIf(&check_preempt_label_, ls);
 }
 
@@ -1557,14 +1550,12 @@ void RegExpMacroAssemblerARM64::CallIf(Label* to, Condition condition) {
 
 
 void RegExpMacroAssemblerARM64::RestoreLinkRegister() {
-  DCHECK(csp.Is(__ StackPointer()));
   __ Pop(lr, xzr);
   __ Add(lr, lr, Operand(masm_->CodeObject()));
 }
 
 
 void RegExpMacroAssemblerARM64::SaveLinkRegister() {
-  DCHECK(csp.Is(__ StackPointer()));
   __ Sub(lr, lr, Operand(masm_->CodeObject()));
   __ Push(xzr, lr);
 }
diff --git a/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.cc b/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.cc
index cb240d6c672..cd84329a78b 100644
--- a/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.cc
+++ b/deps/v8/src/regexp/ia32/regexp-macro-assembler-ia32.cc
@@ -582,7 +582,8 @@ bool RegExpMacroAssemblerIA32::CheckSpecialCharacterClass(uc16 type,
       BranchOrBacktrack(above, on_no_match);
     }
     DCHECK_EQ(0, word_character_map[0]);  // Character '\0' is not a word char.
-    ExternalReference word_map = ExternalReference::re_word_character_map();
+    ExternalReference word_map =
+        ExternalReference::re_word_character_map(isolate());
     __ test_b(current_character(),
               Operand::StaticArray(current_character(), times_1, word_map));
     BranchOrBacktrack(zero, on_no_match);
@@ -596,7 +597,8 @@ bool RegExpMacroAssemblerIA32::CheckSpecialCharacterClass(uc16 type,
       __ j(above, &done);
     }
     DCHECK_EQ(0, word_character_map[0]);  // Character '\0' is not a word char.
-    ExternalReference word_map = ExternalReference::re_word_character_map();
+    ExternalReference word_map =
+        ExternalReference::re_word_character_map(isolate());
     __ test_b(current_character(),
               Operand::StaticArray(current_character(), times_1, word_map));
     BranchOrBacktrack(not_zero, on_no_match);
diff --git a/deps/v8/src/regexp/interpreter-irregexp.cc b/deps/v8/src/regexp/interpreter-irregexp.cc
index 7ba028020b9..2c1b890c4fb 100644
--- a/deps/v8/src/regexp/interpreter-irregexp.cc
+++ b/deps/v8/src/regexp/interpreter-irregexp.cc
@@ -519,6 +519,7 @@ static RegExpImpl::IrregexpResult RawMatch(Isolate* isolate,
         break;
       }
       BYTECODE(CHECK_NOT_BACK_REF_NO_CASE_UNICODE)
+      V8_FALLTHROUGH;
       BYTECODE(CHECK_NOT_BACK_REF_NO_CASE) {
         bool unicode =
             (insn & BYTECODE_MASK) == BC_CHECK_NOT_BACK_REF_NO_CASE_UNICODE;
@@ -537,6 +538,7 @@ static RegExpImpl::IrregexpResult RawMatch(Isolate* isolate,
         break;
       }
       BYTECODE(CHECK_NOT_BACK_REF_NO_CASE_UNICODE_BACKWARD)
+      V8_FALLTHROUGH;
       BYTECODE(CHECK_NOT_BACK_REF_NO_CASE_BACKWARD) {
         bool unicode = (insn & BYTECODE_MASK) ==
                        BC_CHECK_NOT_BACK_REF_NO_CASE_UNICODE_BACKWARD;
diff --git a/deps/v8/src/regexp/jsregexp.cc b/deps/v8/src/regexp/jsregexp.cc
index a26a1d77ce7..b90b0a51a62 100644
--- a/deps/v8/src/regexp/jsregexp.cc
+++ b/deps/v8/src/regexp/jsregexp.cc
@@ -1732,7 +1732,7 @@ static inline bool EmitAtomLetter(Isolate* isolate,
     }
     case 4:
       macro_assembler->CheckCharacter(chars[3], &ok);
-      // Fall through!
+      V8_FALLTHROUGH;
     case 3:
       macro_assembler->CheckCharacter(chars[0], &ok);
       macro_assembler->CheckCharacter(chars[1], &ok);
@@ -2768,16 +2768,13 @@ RegExpNode* TextNode::FilterOneByte(int depth) {
       Vector<const uc16> quarks = elm.atom()->data();
       for (int j = 0; j < quarks.length(); j++) {
         uint16_t c = quarks[j];
-        if (c <= String::kMaxOneByteCharCode) continue;
-        if (!IgnoreCase(elm.atom()->flags())) return set_replacement(nullptr);
-        // Here, we need to check for characters whose upper and lower cases
-        // are outside the Latin-1 range.
-        uint16_t converted = unibrow::Latin1::ConvertNonLatin1ToLatin1(c);
-        // Character is outside Latin-1 completely
-        if (converted == 0) return set_replacement(nullptr);
-        // Convert quark to Latin-1 in place.
-        uint16_t* copy = const_cast<uint16_t*>(quarks.start());
-        copy[j] = converted;
+        if (elm.atom()->ignore_case()) {
+          c = unibrow::Latin1::TryConvertToLatin1(c);
+        }
+        if (c > unibrow::Latin1::kMaxChar) return set_replacement(nullptr);
+        // Replace quark in case we converted to Latin-1.
+        uint16_t* writable_quarks = const_cast<uint16_t*>(quarks.start());
+        writable_quarks[j] = c;
       }
     } else {
       DCHECK(elm.text_type() == TextElement::CHAR_CLASS);
@@ -3209,10 +3206,17 @@ void TextNode::TextEmitPass(RegExpCompiler* compiler,
         if (first_element_checked && i == 0 && j == 0) continue;
         if (DeterminedAlready(quick_check, elm.cp_offset() + j)) continue;
         EmitCharacterFunction* emit_function = nullptr;
+        uc16 quark = quarks[j];
+        if (elm.atom()->ignore_case()) {
+          // Everywhere else we assume that a non-Latin-1 character cannot match
+          // a Latin-1 character. Avoid the cases where this is assumption is
+          // invalid by using the Latin1 equivalent instead.
+          quark = unibrow::Latin1::TryConvertToLatin1(quark);
+        }
         switch (pass) {
           case NON_LATIN1_MATCH:
             DCHECK(one_byte);
-            if (quarks[j] > String::kMaxOneByteCharCode) {
+            if (quark > String::kMaxOneByteCharCode) {
               assembler->GoTo(backtrack);
               return;
             }
@@ -3232,8 +3236,8 @@ void TextNode::TextEmitPass(RegExpCompiler* compiler,
         if (emit_function != nullptr) {
           bool bounds_check = *checked_up_to < cp_offset + j || read_backward();
           bool bound_checked =
-              emit_function(isolate, compiler, quarks[j], backtrack,
-                            cp_offset + j, bounds_check, preloaded);
+              emit_function(isolate, compiler, quark, backtrack, cp_offset + j,
+                            bounds_check, preloaded);
           if (bound_checked) UpdateBoundsCheck(cp_offset + j, checked_up_to);
         }
       }
diff --git a/deps/v8/src/regexp/jsregexp.h b/deps/v8/src/regexp/jsregexp.h
index 021c59d3e46..5a386f8fe0d 100644
--- a/deps/v8/src/regexp/jsregexp.h
+++ b/deps/v8/src/regexp/jsregexp.h
@@ -7,6 +7,7 @@
 
 #include "src/allocation.h"
 #include "src/assembler.h"
+#include "src/isolate.h"
 #include "src/objects/js-regexp.h"
 #include "src/regexp/regexp-ast.h"
 #include "src/regexp/regexp-macro-assembler.h"
diff --git a/deps/v8/src/regexp/mips/OWNERS b/deps/v8/src/regexp/mips/OWNERS
index 3fce7dd6883..4ce9d7f91da 100644
--- a/deps/v8/src/regexp/mips/OWNERS
+++ b/deps/v8/src/regexp/mips/OWNERS
@@ -1,2 +1,3 @@
 ivica.bogosavljevic@mips.com
-Miran.Karic@mips.com
\ No newline at end of file
+Miran.Karic@mips.com
+sreten.kovacevic@mips.com
\ No newline at end of file
diff --git a/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.cc b/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.cc
index 89046a56f34..e16fbd65681 100644
--- a/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.cc
+++ b/deps/v8/src/regexp/mips/regexp-macro-assembler-mips.cc
@@ -569,7 +569,7 @@ bool RegExpMacroAssemblerMIPS::CheckSpecialCharacterClass(uc16 type,
       // Table is 256 entries, so all Latin1 characters can be tested.
       BranchOrBacktrack(on_no_match, hi, current_character(), Operand('z'));
     }
-    ExternalReference map = ExternalReference::re_word_character_map();
+    ExternalReference map = ExternalReference::re_word_character_map(isolate());
     __ li(a0, Operand(map));
     __ Addu(a0, a0, current_character());
     __ lbu(a0, MemOperand(a0, 0));
@@ -582,7 +582,7 @@ bool RegExpMacroAssemblerMIPS::CheckSpecialCharacterClass(uc16 type,
       // Table is 256 entries, so all Latin1 characters can be tested.
       __ Branch(&done, hi, current_character(), Operand('z'));
     }
-    ExternalReference map = ExternalReference::re_word_character_map();
+    ExternalReference map = ExternalReference::re_word_character_map(isolate());
     __ li(a0, Operand(map));
     __ Addu(a0, a0, current_character());
     __ lbu(a0, MemOperand(a0, 0));
diff --git a/deps/v8/src/regexp/mips64/OWNERS b/deps/v8/src/regexp/mips64/OWNERS
index 978563cab5e..4ce9d7f91da 100644
--- a/deps/v8/src/regexp/mips64/OWNERS
+++ b/deps/v8/src/regexp/mips64/OWNERS
@@ -1,2 +1,3 @@
 ivica.bogosavljevic@mips.com
 Miran.Karic@mips.com
+sreten.kovacevic@mips.com
\ No newline at end of file
diff --git a/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.cc b/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.cc
index 841b2931fe9..40ac387c4e1 100644
--- a/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.cc
+++ b/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.cc
@@ -600,7 +600,7 @@ bool RegExpMacroAssemblerMIPS::CheckSpecialCharacterClass(uc16 type,
       // Table is 256 entries, so all Latin1 characters can be tested.
       BranchOrBacktrack(on_no_match, hi, current_character(), Operand('z'));
     }
-    ExternalReference map = ExternalReference::re_word_character_map();
+    ExternalReference map = ExternalReference::re_word_character_map(isolate());
     __ li(a0, Operand(map));
     __ Daddu(a0, a0, current_character());
     __ Lbu(a0, MemOperand(a0, 0));
@@ -613,7 +613,7 @@ bool RegExpMacroAssemblerMIPS::CheckSpecialCharacterClass(uc16 type,
       // Table is 256 entries, so all Latin1 characters can be tested.
       __ Branch(&done, hi, current_character(), Operand('z'));
     }
-    ExternalReference map = ExternalReference::re_word_character_map();
+    ExternalReference map = ExternalReference::re_word_character_map(isolate());
     __ li(a0, Operand(map));
     __ Daddu(a0, a0, current_character());
     __ Lbu(a0, MemOperand(a0, 0));
diff --git a/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.h b/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.h
index c0023f409b8..37c1d3fbb6b 100644
--- a/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.h
+++ b/deps/v8/src/regexp/mips64/regexp-macro-assembler-mips64.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_REGEXP_MIPS_REGEXP_MACRO_ASSEMBLER_MIPS_H_
-#define V8_REGEXP_MIPS_REGEXP_MACRO_ASSEMBLER_MIPS_H_
+#ifndef V8_REGEXP_MIPS64_REGEXP_MACRO_ASSEMBLER_MIPS64_H_
+#define V8_REGEXP_MIPS64_REGEXP_MACRO_ASSEMBLER_MIPS64_H_
 
 #include "src/macro-assembler.h"
 #include "src/mips64/assembler-mips64.h"
@@ -228,4 +228,4 @@ class RegExpMacroAssemblerMIPS: public NativeRegExpMacroAssembler {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_REGEXP_MIPS_REGEXP_MACRO_ASSEMBLER_MIPS_H_
+#endif  // V8_REGEXP_MIPS64_REGEXP_MACRO_ASSEMBLER_MIPS64_H_
diff --git a/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.cc b/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.cc
index 1187fc04b8c..fdda46424ea 100644
--- a/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.cc
+++ b/deps/v8/src/regexp/ppc/regexp-macro-assembler-ppc.cc
@@ -591,7 +591,8 @@ bool RegExpMacroAssemblerPPC::CheckSpecialCharacterClass(uc16 type,
         __ cmpi(current_character(), Operand('z'));
         BranchOrBacktrack(gt, on_no_match);
       }
-      ExternalReference map = ExternalReference::re_word_character_map();
+      ExternalReference map =
+          ExternalReference::re_word_character_map(isolate());
       __ mov(r3, Operand(map));
       __ lbzx(r3, MemOperand(r3, current_character()));
       __ cmpli(r3, Operand::Zero());
@@ -605,7 +606,8 @@ bool RegExpMacroAssemblerPPC::CheckSpecialCharacterClass(uc16 type,
         __ cmpli(current_character(), Operand('z'));
         __ bgt(&done);
       }
-      ExternalReference map = ExternalReference::re_word_character_map();
+      ExternalReference map =
+          ExternalReference::re_word_character_map(isolate());
       __ mov(r3, Operand(map));
       __ lbzx(r3, MemOperand(r3, current_character()));
       __ cmpli(r3, Operand::Zero());
diff --git a/deps/v8/src/regexp/regexp-parser.cc b/deps/v8/src/regexp/regexp-parser.cc
index a7724c5d42e..72ed5b8d697 100644
--- a/deps/v8/src/regexp/regexp-parser.cc
+++ b/deps/v8/src/regexp/regexp-parser.cc
@@ -399,8 +399,8 @@ RegExpTree* RegExpParser::ParseDisjunction() {
               Advance(2);
               break;
             }
+            V8_FALLTHROUGH;
           }
-          // Fall through.
           case '0': {
             Advance();
             if (unicode() && Next() >= '0' && Next() <= '9') {
@@ -493,7 +493,7 @@ RegExpTree* RegExpParser::ParseDisjunction() {
               ParseNamedBackReference(builder, state CHECK_FAILED);
               break;
             }
-          // Fall through.
+            V8_FALLTHROUGH;
           default:
             Advance();
             // With /u, no identity escapes except for syntax characters
@@ -511,14 +511,14 @@ RegExpTree* RegExpParser::ParseDisjunction() {
         int dummy;
         bool parsed = ParseIntervalQuantifier(&dummy, &dummy CHECK_FAILED);
         if (parsed) return ReportError(CStrVector("Nothing to repeat"));
-        // Fall through.
+        V8_FALLTHROUGH;
       }
       case '}':
       case ']':
         if (unicode()) {
           return ReportError(CStrVector("Lone quantifier brackets"));
         }
-      // Fall through.
+        V8_FALLTHROUGH;
       default:
         builder->AddUnicodeCharacter(current());
         Advance();
@@ -684,7 +684,7 @@ RegExpParser::RegExpParserState* RegExpParser::ParseOpenParenthesis(
           Advance();
           break;
         }
-      // Fall through.
+        V8_FALLTHROUGH;
       default:
         ReportError(CStrVector("Invalid group"));
         return nullptr;
@@ -1515,7 +1515,7 @@ uc32 RegExpParser::ParseClassCharacterEscape() {
         Advance();
         return 0;
       }
-    // Fall through.
+      V8_FALLTHROUGH;
     case '1':
     case '2':
     case '3':
@@ -1986,8 +1986,14 @@ bool RegExpBuilder::AddQuantifierToAtom(
   } else if (terms_.length() > 0) {
     DCHECK(last_added_ == ADD_ATOM);
     atom = terms_.RemoveLast();
-    // With /u, lookarounds are not quantifiable.
-    if (unicode() && atom->IsLookaround()) return false;
+    if (atom->IsLookaround()) {
+      // With /u, lookarounds are not quantifiable.
+      if (unicode()) return false;
+      // Lookbehinds are not quantifiable.
+      if (atom->AsLookaround()->type() == RegExpLookaround::LOOKBEHIND) {
+        return false;
+      }
+    }
     if (atom->max_match() == 0) {
       // Guaranteed to only match an empty string.
       LAST(ADD_TERM);
diff --git a/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.cc b/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.cc
index 4f8f2341713..837d5639cc0 100644
--- a/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.cc
+++ b/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.cc
@@ -562,7 +562,8 @@ bool RegExpMacroAssemblerS390::CheckSpecialCharacterClass(uc16 type,
         __ CmpP(current_character(), Operand('z'));
         BranchOrBacktrack(gt, on_no_match);
       }
-      ExternalReference map = ExternalReference::re_word_character_map();
+      ExternalReference map =
+          ExternalReference::re_word_character_map(isolate());
       __ mov(r2, Operand(map));
       __ LoadlB(r2, MemOperand(r2, current_character()));
       __ CmpLogicalP(r2, Operand::Zero());
@@ -576,7 +577,8 @@ bool RegExpMacroAssemblerS390::CheckSpecialCharacterClass(uc16 type,
         __ CmpLogicalP(current_character(), Operand('z'));
         __ bgt(&done);
       }
-      ExternalReference map = ExternalReference::re_word_character_map();
+      ExternalReference map =
+          ExternalReference::re_word_character_map(isolate());
       __ mov(r2, Operand(map));
       __ LoadlB(r2, MemOperand(r2, current_character()));
       __ CmpLogicalP(r2, Operand::Zero());
diff --git a/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.h b/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.h
index 94603cd7c95..40ba5ece25b 100644
--- a/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.h
+++ b/deps/v8/src/regexp/s390/regexp-macro-assembler-s390.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_S390_REGEXP_MACRO_ASSEMBLER_S390_H_
-#define V8_S390_REGEXP_MACRO_ASSEMBLER_S390_H_
+#ifndef V8_REGEXP_S390_REGEXP_MACRO_ASSEMBLER_S390_H_
+#define V8_REGEXP_S390_REGEXP_MACRO_ASSEMBLER_S390_H_
 
 #include "src/macro-assembler.h"
 #include "src/regexp/regexp-macro-assembler.h"
@@ -210,4 +210,4 @@ const RegList kRegExpCalleeSaved =
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_S390_REGEXP_MACRO_ASSEMBLER_S390_H_
+#endif  // V8_REGEXP_S390_REGEXP_MACRO_ASSEMBLER_S390_H_
diff --git a/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.cc b/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.cc
index eb57b29602e..11949be3dd9 100644
--- a/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.cc
+++ b/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.cc
@@ -623,7 +623,7 @@ bool RegExpMacroAssemblerX64::CheckSpecialCharacterClass(uc16 type,
       __ cmpl(current_character(), Immediate('z'));
       BranchOrBacktrack(above, on_no_match);
     }
-    __ Move(rbx, ExternalReference::re_word_character_map());
+    __ Move(rbx, ExternalReference::re_word_character_map(isolate()));
     DCHECK_EQ(0, word_character_map[0]);  // Character '\0' is not a word char.
     __ testb(Operand(rbx, current_character(), times_1, 0),
              current_character());
@@ -637,7 +637,7 @@ bool RegExpMacroAssemblerX64::CheckSpecialCharacterClass(uc16 type,
       __ cmpl(current_character(), Immediate('z'));
       __ j(above, &done);
     }
-    __ Move(rbx, ExternalReference::re_word_character_map());
+    __ Move(rbx, ExternalReference::re_word_character_map(isolate()));
     DCHECK_EQ(0, word_character_map[0]);  // Character '\0' is not a word char.
     __ testb(Operand(rbx, current_character(), times_1, 0),
              current_character());
diff --git a/deps/v8/src/register-configuration.cc b/deps/v8/src/register-configuration.cc
index 6ecc5519f37..f71423d26e4 100644
--- a/deps/v8/src/register-configuration.cc
+++ b/deps/v8/src/register-configuration.cc
@@ -64,29 +64,6 @@ STATIC_ASSERT(RegisterConfiguration::kMaxFPRegisters >=
 STATIC_ASSERT(RegisterConfiguration::kMaxFPRegisters >=
               Simd128Register::kNumRegisters);
 
-static int get_num_allocatable_general_registers() {
-  return
-#if V8_TARGET_ARCH_IA32
-      kMaxAllocatableGeneralRegisterCount;
-#elif V8_TARGET_ARCH_X64
-      kMaxAllocatableGeneralRegisterCount;
-#elif V8_TARGET_ARCH_ARM
-      kMaxAllocatableGeneralRegisterCount;
-#elif V8_TARGET_ARCH_ARM64
-      kMaxAllocatableGeneralRegisterCount;
-#elif V8_TARGET_ARCH_MIPS
-      kMaxAllocatableGeneralRegisterCount;
-#elif V8_TARGET_ARCH_MIPS64
-      kMaxAllocatableGeneralRegisterCount;
-#elif V8_TARGET_ARCH_PPC
-      kMaxAllocatableGeneralRegisterCount;
-#elif V8_TARGET_ARCH_S390
-      kMaxAllocatableGeneralRegisterCount;
-#else
-#error Unsupported target architecture.
-#endif
-}
-
 static int get_num_allocatable_double_registers() {
   return
 #if V8_TARGET_ARCH_IA32
@@ -127,7 +104,7 @@ class ArchDefaultRegisterConfiguration : public RegisterConfiguration {
   ArchDefaultRegisterConfiguration()
       : RegisterConfiguration(
             Register::kNumRegisters, DoubleRegister::kNumRegisters,
-            get_num_allocatable_general_registers(),
+            kMaxAllocatableGeneralRegisterCount,
             get_num_allocatable_double_registers(), kAllocatableGeneralCodes,
             get_allocatable_double_codes(),
             kSimpleFPAliasing ? AliasingKind::OVERLAP : AliasingKind::COMBINE,
@@ -145,6 +122,50 @@ static base::LazyInstance<ArchDefaultRegisterConfiguration,
                           RegisterConfigurationInitializer>::type
     kDefaultRegisterConfiguration = LAZY_INSTANCE_INITIALIZER;
 
+// Allocatable registers with the masking register removed.
+class ArchDefaultPoisoningRegisterConfiguration : public RegisterConfiguration {
+ public:
+  ArchDefaultPoisoningRegisterConfiguration()
+      : RegisterConfiguration(
+            Register::kNumRegisters, DoubleRegister::kNumRegisters,
+            kMaxAllocatableGeneralRegisterCount - 1,
+            get_num_allocatable_double_registers(),
+            InitializeGeneralRegisterCodes(), get_allocatable_double_codes(),
+            kSimpleFPAliasing ? AliasingKind::OVERLAP : AliasingKind::COMBINE,
+            kGeneralRegisterNames, kFloatRegisterNames, kDoubleRegisterNames,
+            kSimd128RegisterNames) {}
+
+ private:
+  static const int* InitializeGeneralRegisterCodes() {
+    int filtered_index = 0;
+    for (int i = 0; i < kMaxAllocatableGeneralRegisterCount; ++i) {
+      if (kAllocatableGeneralCodes[i] != kSpeculationPoisonRegister.code()) {
+        allocatable_general_codes_[filtered_index] =
+            kAllocatableGeneralCodes[i];
+        filtered_index++;
+      }
+    }
+    DCHECK_EQ(filtered_index, kMaxAllocatableGeneralRegisterCount - 1);
+    return allocatable_general_codes_;
+  }
+
+  static int
+      allocatable_general_codes_[kMaxAllocatableGeneralRegisterCount - 1];
+};
+
+int ArchDefaultPoisoningRegisterConfiguration::allocatable_general_codes_
+    [kMaxAllocatableGeneralRegisterCount - 1];
+
+struct PoisoningRegisterConfigurationInitializer {
+  static void Construct(void* config) {
+    new (config) ArchDefaultPoisoningRegisterConfiguration();
+  }
+};
+
+static base::LazyInstance<ArchDefaultPoisoningRegisterConfiguration,
+                          PoisoningRegisterConfigurationInitializer>::type
+    kDefaultPoisoningRegisterConfiguration = LAZY_INSTANCE_INITIALIZER;
+
 // RestrictedRegisterConfiguration uses the subset of allocatable general
 // registers the architecture support, which results into generating assembly
 // to use less registers. Currently, it's only used by RecordWrite code stub.
@@ -193,6 +214,10 @@ const RegisterConfiguration* RegisterConfiguration::Default() {
   return &kDefaultRegisterConfiguration.Get();
 }
 
+const RegisterConfiguration* RegisterConfiguration::Poisoning() {
+  return &kDefaultPoisoningRegisterConfiguration.Get();
+}
+
 const RegisterConfiguration* RegisterConfiguration::RestrictGeneralRegisters(
     RegList registers) {
   int num = NumRegs(registers);
diff --git a/deps/v8/src/register-configuration.h b/deps/v8/src/register-configuration.h
index 59aeab87424..1299baac69e 100644
--- a/deps/v8/src/register-configuration.h
+++ b/deps/v8/src/register-configuration.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_COMPILER_REGISTER_CONFIGURATION_H_
-#define V8_COMPILER_REGISTER_CONFIGURATION_H_
+#ifndef V8_REGISTER_CONFIGURATION_H_
+#define V8_REGISTER_CONFIGURATION_H_
 
 #include "src/base/macros.h"
 #include "src/globals.h"
@@ -31,6 +31,9 @@ class V8_EXPORT_PRIVATE RegisterConfiguration {
   // Default RegisterConfigurations for the target architecture.
   static const RegisterConfiguration* Default();
 
+  // Register configuration with reserved masking register.
+  static const RegisterConfiguration* Poisoning();
+
   static const RegisterConfiguration* RestrictGeneralRegisters(
       RegList registers);
 
@@ -165,4 +168,4 @@ class V8_EXPORT_PRIVATE RegisterConfiguration {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_COMPILER_REGISTER_CONFIGURATION_H_
+#endif  // V8_REGISTER_CONFIGURATION_H_
diff --git a/deps/v8/src/runtime/runtime-array.cc b/deps/v8/src/runtime/runtime-array.cc
index f07c842baec..44a3e68defd 100644
--- a/deps/v8/src/runtime/runtime-array.cc
+++ b/deps/v8/src/runtime/runtime-array.cc
@@ -149,7 +149,8 @@ Object* PrepareElementsForSort(Handle<JSObject> object, uint32_t limit) {
     JSObject::ValidateElements(*object);
   } else if (object->HasFixedTypedArrayElements()) {
     // Typed arrays cannot have holes or undefined elements.
-    return Smi::FromInt(FixedArrayBase::cast(object->elements())->length());
+    int array_length = FixedArrayBase::cast(object->elements())->length();
+    return Smi::FromInt(Min(limit, static_cast<uint32_t>(array_length)));
   } else if (!object->HasDoubleElements()) {
     JSObject::EnsureWritableFastElements(object);
   }
@@ -390,7 +391,7 @@ RUNTIME_FUNCTION(Runtime_TrySliceSimpleNonFastElements) {
   // implementation.
   if (receiver->IsJSArray()) {
     // This "fastish" path must make sure the destination array is a JSArray.
-    if (!isolate->IsArraySpeciesLookupChainIntact() ||
+    if (!isolate->IsSpeciesLookupChainIntact() ||
         !JSArray::cast(*receiver)->HasArrayPrototype(isolate)) {
       return Smi::FromInt(0);
     }
@@ -532,17 +533,15 @@ RUNTIME_FUNCTION(Runtime_NormalizeElements) {
   return *array;
 }
 
-
-// GrowArrayElements returns a sentinel Smi if the object was normalized.
+// GrowArrayElements returns a sentinel Smi if the object was normalized or if
+// the key is negative.
 RUNTIME_FUNCTION(Runtime_GrowArrayElements) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
   CONVERT_NUMBER_CHECKED(int, key, Int32, args[1]);
 
-  if (key < 0) {
-    return object->elements();
-  }
+  if (key < 0) return Smi::kZero;
 
   uint32_t capacity = static_cast<uint32_t>(object->elements()->length());
   uint32_t index = static_cast<uint32_t>(key);
@@ -553,7 +552,6 @@ RUNTIME_FUNCTION(Runtime_GrowArrayElements) {
     }
   }
 
-  // On success, return the fixed array elements.
   return object->elements();
 }
 
@@ -796,23 +794,5 @@ RUNTIME_FUNCTION(Runtime_ArrayIndexOf) {
   return Smi::FromInt(-1);
 }
 
-
-RUNTIME_FUNCTION(Runtime_SpreadIterablePrepare) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, spread, 0);
-
-  // Iterate over the spread if we need to.
-  if (spread->IterationHasObservableEffects()) {
-    Handle<JSFunction> spread_iterable_function = isolate->spread_iterable();
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, spread,
-        Execution::Call(isolate, spread_iterable_function,
-                        isolate->factory()->undefined_value(), 1, &spread));
-  }
-
-  return *spread;
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-atomics.cc b/deps/v8/src/runtime/runtime-atomics.cc
index 68a7b413b5a..9849c694dc4 100644
--- a/deps/v8/src/runtime/runtime-atomics.cc
+++ b/deps/v8/src/runtime/runtime-atomics.cc
@@ -249,30 +249,6 @@ inline Object* DoXor(Isolate* isolate, void* buffer, size_t index,
   V(Uint32, uint32, UINT32, uint32_t, 4) \
   V(Int32, int32, INT32, int32_t, 4)
 
-RUNTIME_FUNCTION(Runtime_ThrowNotIntegerSharedTypedArrayError) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, value, 0);
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate,
-      NewTypeError(MessageTemplate::kNotIntegerSharedTypedArray, value));
-}
-
-RUNTIME_FUNCTION(Runtime_ThrowNotInt32SharedTypedArrayError) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, value, 0);
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate, NewTypeError(MessageTemplate::kNotInt32SharedTypedArray, value));
-}
-
-RUNTIME_FUNCTION(Runtime_ThrowInvalidAtomicAccessIndexError) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(0, args.length());
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate, NewRangeError(MessageTemplate::kInvalidAtomicAccessIndex));
-}
-
 RUNTIME_FUNCTION(Runtime_AtomicsExchange) {
   HandleScope scope(isolate);
   DCHECK_EQ(3, args.length());
diff --git a/deps/v8/src/runtime/runtime-bigint.cc b/deps/v8/src/runtime/runtime-bigint.cc
index 47f644f6195..ce0d8990a18 100644
--- a/deps/v8/src/runtime/runtime-bigint.cc
+++ b/deps/v8/src/runtime/runtime-bigint.cc
@@ -75,6 +75,13 @@ RUNTIME_FUNCTION(Runtime_BigIntToNumber) {
   return *BigInt::ToNumber(x);
 }
 
+RUNTIME_FUNCTION(Runtime_ToBigInt) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(Object, x, 0);
+  RETURN_RESULT_OR_FAILURE(isolate, BigInt::FromObject(isolate, x));
+}
+
 RUNTIME_FUNCTION(Runtime_BigIntBinaryOp) {
   HandleScope scope(isolate);
   DCHECK_EQ(3, args.length());
diff --git a/deps/v8/src/runtime/runtime-classes.cc b/deps/v8/src/runtime/runtime-classes.cc
index 7869e32dd13..7b1379cf32a 100644
--- a/deps/v8/src/runtime/runtime-classes.cc
+++ b/deps/v8/src/runtime/runtime-classes.cc
@@ -32,7 +32,7 @@ RUNTIME_FUNCTION(Runtime_ThrowConstructorNonCallableError) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, constructor, 0);
-  Handle<String> name(constructor->shared()->name(), isolate);
+  Handle<String> name(constructor->shared()->Name(), isolate);
   THROW_NEW_ERROR_RETURN_FAILURE(
       isolate, NewTypeError(MessageTemplate::kConstructorNonCallable, name));
 }
@@ -65,7 +65,7 @@ Object* ThrowNotSuperConstructor(Isolate* isolate, Handle<Object> constructor,
                                  Handle<JSFunction> function) {
   Handle<String> super_name;
   if (constructor->IsJSFunction()) {
-    super_name = handle(Handle<JSFunction>::cast(constructor)->shared()->name(),
+    super_name = handle(Handle<JSFunction>::cast(constructor)->shared()->Name(),
                         isolate);
   } else if (constructor->IsOddball()) {
     DCHECK(constructor->IsNull(isolate));
@@ -77,7 +77,7 @@ Object* ThrowNotSuperConstructor(Isolate* isolate, Handle<Object> constructor,
   if (super_name->length() == 0) {
     super_name = isolate->factory()->null_string();
   }
-  Handle<String> function_name(function->shared()->name(), isolate);
+  Handle<String> function_name(function->shared()->Name(), isolate);
   // anonymous class
   if (function_name->length() == 0) {
     THROW_NEW_ERROR_RETURN_FAILURE(
@@ -158,7 +158,7 @@ MaybeHandle<Object> GetMethodAndSetHomeObjectAndName(
 
   SetHomeObject(isolate, *method, *home_object);
 
-  if (!method->shared()->has_shared_name()) {
+  if (!method->shared()->HasSharedName()) {
     // TODO(ishell): method does not have a shared name at this point only if
     // the key is a computed property name. However, the bytecode generator
     // explicitly generates ToName bytecodes to ensure that the computed
@@ -195,7 +195,7 @@ Object* GetMethodWithSharedNameAndSetHomeObject(Isolate* isolate,
 
   SetHomeObject(isolate, *method, home_object);
 
-  DCHECK(method->shared()->has_shared_name());
+  DCHECK(method->shared()->HasSharedName());
   return *method;
 }
 
diff --git a/deps/v8/src/runtime/runtime-collections.cc b/deps/v8/src/runtime/runtime-collections.cc
index 44e947aafee..efe4f455b17 100644
--- a/deps/v8/src/runtime/runtime-collections.cc
+++ b/deps/v8/src/runtime/runtime-collections.cc
@@ -11,24 +11,22 @@
 namespace v8 {
 namespace internal {
 
-RUNTIME_FUNCTION(Runtime_TheHole) {
+RUNTIME_FUNCTION(Runtime_IsJSMapIterator) {
   SealHandleScope shs(isolate);
-  DCHECK_EQ(0, args.length());
-  return isolate->heap()->the_hole_value();
+  DCHECK_EQ(1, args.length());
+  return isolate->heap()->ToBoolean(args[0]->IsJSMapIterator());
 }
 
-RUNTIME_FUNCTION(Runtime_GetExistingHash) {
+RUNTIME_FUNCTION(Runtime_IsJSSetIterator) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
-  return object->GetHash();
+  return isolate->heap()->ToBoolean(args[0]->IsJSSetIterator());
 }
 
-RUNTIME_FUNCTION(Runtime_GenericHash) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
-  return object->GetOrCreateHash(isolate);
+RUNTIME_FUNCTION(Runtime_TheHole) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(0, args.length());
+  return isolate->heap()->the_hole_value();
 }
 
 RUNTIME_FUNCTION(Runtime_SetGrow) {
@@ -101,15 +99,6 @@ RUNTIME_FUNCTION(Runtime_GetWeakMapEntries) {
   return *JSWeakCollection::GetEntries(holder, max_entries);
 }
 
-RUNTIME_FUNCTION(Runtime_WeakCollectionInitialize) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSWeakCollection, weak_collection, 0);
-  JSWeakCollection::Initialize(weak_collection, isolate);
-  return *weak_collection;
-}
-
-
 RUNTIME_FUNCTION(Runtime_WeakCollectionDelete) {
   HandleScope scope(isolate);
   DCHECK_EQ(3, args.length());
diff --git a/deps/v8/src/runtime/runtime-compiler.cc b/deps/v8/src/runtime/runtime-compiler.cc
index 14b61b0ac68..db2c43656eb 100644
--- a/deps/v8/src/runtime/runtime-compiler.cc
+++ b/deps/v8/src/runtime/runtime-compiler.cc
@@ -68,7 +68,7 @@ RUNTIME_FUNCTION(Runtime_FunctionFirstExecution) {
   DCHECK(FLAG_log_function_events);
   Handle<SharedFunctionInfo> sfi(function->shared());
   LOG(isolate, FunctionEvent("first-execution", Script::cast(sfi->script()), -1,
-                             0, sfi->start_position(), sfi->end_position(),
+                             0, sfi->StartPosition(), sfi->EndPosition(),
                              sfi->DebugName()));
   function->feedback_vector()->ClearOptimizationMarker();
   // Return the code to continue execution, we don't care at this point whether
@@ -129,8 +129,8 @@ RUNTIME_FUNCTION(Runtime_InstantiateAsmJs) {
       return *result.ToHandleChecked();
     }
   }
-  // Remove wasm data, mark as broken for asm->wasm,
-  // replace code with CompileLazy, and return a smi 0 to indicate failure.
+  // Remove wasm data, mark as broken for asm->wasm, replace function code with
+  // CompileLazy, and return a smi 0 to indicate failure.
   if (function->shared()->HasAsmWasmData()) {
     function->shared()->ClearAsmWasmData();
   }
@@ -138,11 +138,6 @@ RUNTIME_FUNCTION(Runtime_InstantiateAsmJs) {
   DCHECK(function->code() ==
          isolate->builtins()->builtin(Builtins::kInstantiateAsmJs));
   function->set_code(isolate->builtins()->builtin(Builtins::kCompileLazy));
-  if (function->shared()->code() ==
-      isolate->builtins()->builtin(Builtins::kInstantiateAsmJs)) {
-    function->shared()->set_code(
-        isolate->builtins()->builtin(Builtins::kCompileLazy));
-  }
   return Smi::kZero;
 }
 
@@ -290,7 +285,7 @@ RUNTIME_FUNCTION(Runtime_CompileForOnStackReplacement) {
   }
 
   if (!function->IsOptimized()) {
-    function->set_code(function->shared()->code());
+    function->set_code(function->shared()->GetCode());
   }
   return nullptr;
 }
diff --git a/deps/v8/src/runtime/runtime-date.cc b/deps/v8/src/runtime/runtime-date.cc
index 96292ad1c5f..d149af652b5 100644
--- a/deps/v8/src/runtime/runtime-date.cc
+++ b/deps/v8/src/runtime/runtime-date.cc
@@ -21,15 +21,6 @@ RUNTIME_FUNCTION(Runtime_IsDate) {
   return isolate->heap()->ToBoolean(obj->IsJSDate());
 }
 
-
-RUNTIME_FUNCTION(Runtime_ThrowNotDateError) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(0, args.length());
-  THROW_NEW_ERROR_RETURN_FAILURE(isolate,
-                                 NewTypeError(MessageTemplate::kNotDateObject));
-}
-
-
 RUNTIME_FUNCTION(Runtime_DateCurrentTime) {
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
diff --git a/deps/v8/src/runtime/runtime-debug.cc b/deps/v8/src/runtime/runtime-debug.cc
index d6e028b41e0..67227379b22 100644
--- a/deps/v8/src/runtime/runtime-debug.cc
+++ b/deps/v8/src/runtime/runtime-debug.cc
@@ -43,7 +43,7 @@ RUNTIME_FUNCTION_RETURN_PAIR(Runtime_DebugBreakOnBytecode) {
 
   // Get the top-most JavaScript frame.
   JavaScriptFrameIterator it(isolate);
-  isolate->debug()->Break(it.frame());
+  isolate->debug()->Break(it.frame(), handle(it.frame()->function()));
 
   // Return the handler from the original bytecode array.
   DCHECK(it.frame()->is_interpreted());
@@ -53,23 +53,43 @@ RUNTIME_FUNCTION_RETURN_PAIR(Runtime_DebugBreakOnBytecode) {
   BytecodeArray* bytecode_array = shared->bytecode_array();
   int bytecode_offset = interpreted_frame->GetBytecodeOffset();
   Bytecode bytecode = Bytecodes::FromByte(bytecode_array->get(bytecode_offset));
-  if (bytecode == Bytecode::kReturn) {
-    // If we are returning, reset the bytecode array on the interpreted stack
-    // frame to the non-debug variant so that the interpreter entry trampoline
-    // sees the return bytecode rather than the DebugBreak.
+  if (Bytecodes::Returns(bytecode)) {
+    // If we are returning (or suspending), reset the bytecode array on the
+    // interpreted stack frame to the non-debug variant so that the interpreter
+    // entry trampoline sees the return/suspend bytecode rather than the
+    // DebugBreak.
     interpreted_frame->PatchBytecodeArray(bytecode_array);
   }
 
   // We do not have to deal with operand scale here. If the bytecode at the
   // break is prefixed by operand scaling, we would have patched over the
   // scaling prefix. We now simply dispatch to the handler for the prefix.
+  // We need to deserialize now to ensure we don't hit the debug break again
+  // after deserializing.
   OperandScale operand_scale = OperandScale::kSingle;
-  Code* code = isolate->interpreter()->GetAndMaybeDeserializeBytecodeHandler(
-      bytecode, operand_scale);
+  isolate->interpreter()->GetAndMaybeDeserializeBytecodeHandler(bytecode,
+                                                                operand_scale);
 
-  return MakePair(isolate->debug()->return_value(), code);
+  return MakePair(isolate->debug()->return_value(),
+                  Smi::FromInt(static_cast<uint8_t>(bytecode)));
 }
 
+RUNTIME_FUNCTION(Runtime_DebugBreakAtEntry) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
+  USE(function);
+
+  DCHECK(function->shared()->HasDebugInfo());
+  DCHECK(function->shared()->GetDebugInfo()->BreakAtEntry());
+
+  // Get the top-most JavaScript frame.
+  JavaScriptFrameIterator it(isolate);
+  DCHECK_EQ(*function, it.frame()->function());
+  isolate->debug()->Break(it.frame(), function);
+
+  return isolate->heap()->undefined_value();
+}
 
 RUNTIME_FUNCTION(Runtime_HandleDebuggerStatement) {
   SealHandleScope shs(isolate);
@@ -81,27 +101,6 @@ RUNTIME_FUNCTION(Runtime_HandleDebuggerStatement) {
 }
 
 
-// Adds a JavaScript function as a debug event listener.
-// args[0]: debug event listener function to set or null or undefined for
-//          clearing the event listener function
-// args[1]: object supplied during callback
-RUNTIME_FUNCTION(Runtime_SetDebugEventListener) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(2, args.length());
-  CHECK(args[0]->IsJSFunction() || args[0]->IsNullOrUndefined(isolate));
-  CONVERT_ARG_HANDLE_CHECKED(Object, callback, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, data, 1);
-  if (callback->IsJSFunction()) {
-    JavaScriptDebugDelegate* delegate = new JavaScriptDebugDelegate(
-        isolate, Handle<JSFunction>::cast(callback), data);
-    isolate->debug()->SetDebugDelegate(delegate, true);
-  } else {
-    isolate->debug()->SetDebugDelegate(nullptr, false);
-  }
-  return isolate->heap()->undefined_value();
-}
-
-
 RUNTIME_FUNCTION(Runtime_ScheduleBreak) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(0, args.length());
@@ -261,7 +260,10 @@ MaybeHandle<JSArray> Runtime::GetInternalProperties(Isolate* isolate,
     Handle<String> status_str = factory->NewStringFromAsciiChecked(status);
     result->set(1, *status_str);
 
-    Handle<Object> value_obj(promise->result(), isolate);
+    Handle<Object> value_obj(promise->status() == Promise::kPending
+                                 ? isolate->heap()->undefined_value()
+                                 : promise->result(),
+                             isolate);
     Handle<String> promise_value =
         factory->NewStringFromAsciiChecked("[[PromiseValue]]");
     result->set(2, *promise_value);
@@ -855,8 +857,7 @@ RUNTIME_FUNCTION(Runtime_GetAllScopesDetails) {
   // local).
   if (frame->is_wasm_interpreter_entry()) {
     Handle<WasmDebugInfo> debug_info(
-        WasmInterpreterEntryFrame::cast(frame)->wasm_instance()->debug_info(),
-        isolate);
+        WasmInterpreterEntryFrame::cast(frame)->debug_info(), isolate);
     return *WasmDebugInfo::GetScopeDetails(debug_info, frame->fp(),
                                            inlined_frame_index);
   }
@@ -1036,36 +1037,6 @@ RUNTIME_FUNCTION(Runtime_SetScopeVariableValue) {
 }
 
 
-RUNTIME_FUNCTION(Runtime_DebugPrintScopes) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(0, args.length());
-
-#ifdef DEBUG
-  // Print the scopes for the top frame.
-  JavaScriptFrameIterator it(isolate);
-  if (!it.done()) {
-    JavaScriptFrame* frame = it.frame();
-    FrameInspector frame_inspector(frame, 0, isolate);
-    for (ScopeIterator si(isolate, &frame_inspector); !si.Done(); si.Next()) {
-      si.DebugPrint();
-    }
-  }
-#endif
-  return isolate->heap()->undefined_value();
-}
-
-
-// Sets the disable break state
-// args[0]: disable break state
-RUNTIME_FUNCTION(Runtime_SetBreakPointsActive) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_BOOLEAN_ARG_CHECKED(active, 0);
-  isolate->debug()->set_break_points_active(active);
-  return isolate->heap()->undefined_value();
-}
-
-
 RUNTIME_FUNCTION(Runtime_GetBreakLocations) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -1084,71 +1055,6 @@ RUNTIME_FUNCTION(Runtime_GetBreakLocations) {
 }
 
 
-// Set a break point in a function.
-// args[0]: function
-// args[1]: number: break source position (within the function source)
-// args[2]: number: break point object
-RUNTIME_FUNCTION(Runtime_SetFunctionBreakPoint) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
-  CHECK(isolate->debug()->is_active());
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
-  CONVERT_NUMBER_CHECKED(int32_t, source_position, Int32, args[1]);
-  CHECK(source_position >= function->shared()->start_position() &&
-        source_position <= function->shared()->end_position());
-  CONVERT_ARG_HANDLE_CHECKED(Object, break_point_object_arg, 2);
-
-  // Set break point.
-  CHECK(isolate->debug()->SetBreakPoint(function, break_point_object_arg,
-                                        &source_position));
-
-  return Smi::FromInt(source_position);
-}
-
-// Changes the state of a break point in a script and returns source position
-// where break point was set. NOTE: Regarding performance see the NOTE for
-// GetScriptFromScriptData.
-// args[0]: script to set break point in
-// args[1]: number: break source position (within the script source)
-// args[2]: number: break point object
-RUNTIME_FUNCTION(Runtime_SetScriptBreakPoint) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
-  CHECK(isolate->debug()->is_active());
-  CONVERT_ARG_HANDLE_CHECKED(JSValue, wrapper, 0);
-  CONVERT_NUMBER_CHECKED(int32_t, source_position, Int32, args[1]);
-  CHECK_GE(source_position, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, break_point_object_arg, 2);
-
-  // Get the script from the script wrapper.
-  CHECK(wrapper->value()->IsScript());
-  Handle<Script> script(Script::cast(wrapper->value()));
-
-  // Set break point.
-  if (!isolate->debug()->SetBreakPointForScript(script, break_point_object_arg,
-                                                &source_position)) {
-    return isolate->heap()->undefined_value();
-  }
-
-  return Smi::FromInt(source_position);
-}
-
-
-// Clear a break point
-// args[0]: number: break point object
-RUNTIME_FUNCTION(Runtime_ClearBreakPoint) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CHECK(isolate->debug()->is_active());
-  CONVERT_ARG_HANDLE_CHECKED(Object, break_point_object_arg, 0);
-
-  // Clear break point.
-  isolate->debug()->ClearBreakPoint(break_point_object_arg);
-
-  return isolate->heap()->undefined_value();
-}
-
-
 // Change the state of break on exceptions.
 // args[0]: Enum value indicating whether to affect caught/uncaught exceptions.
 // args[1]: Boolean indicating on/off.
@@ -1253,7 +1159,8 @@ RUNTIME_FUNCTION(Runtime_DebugEvaluateGlobal) {
 
   CONVERT_ARG_HANDLE_CHECKED(String, source, 1);
 
-  RETURN_RESULT_OR_FAILURE(isolate, DebugEvaluate::Global(isolate, source));
+  RETURN_RESULT_OR_FAILURE(isolate,
+                           DebugEvaluate::Global(isolate, source, false));
 }
 
 
@@ -1572,46 +1479,6 @@ int ScriptLinePosition(Handle<Script> script, int line) {
 
 }  // namespace
 
-// TODO(5530): Remove once uses in debug.js are gone.
-RUNTIME_FUNCTION(Runtime_ScriptLineStartPosition) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_CHECKED(JSValue, script, 0);
-  CONVERT_NUMBER_CHECKED(int32_t, line, Int32, args[1]);
-
-  CHECK(script->value()->IsScript());
-  Handle<Script> script_handle = Handle<Script>(Script::cast(script->value()));
-
-  return Smi::FromInt(ScriptLinePosition(script_handle, line));
-}
-
-// TODO(5530): Remove once uses in debug.js are gone.
-RUNTIME_FUNCTION(Runtime_ScriptLineEndPosition) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_CHECKED(JSValue, script, 0);
-  CONVERT_NUMBER_CHECKED(int32_t, line, Int32, args[1]);
-
-  CHECK(script->value()->IsScript());
-  Handle<Script> script_handle = Handle<Script>(Script::cast(script->value()));
-
-  if (script_handle->type() == Script::TYPE_WASM) {
-    // Return zero for now; this function will disappear soon anyway.
-    return Smi::FromInt(0);
-  }
-
-  Script::InitLineEnds(script_handle);
-
-  FixedArray* line_ends_array = FixedArray::cast(script_handle->line_ends());
-  const int line_count = line_ends_array->length();
-
-  if (line < 0 || line >= line_count) {
-    return Smi::FromInt(-1);
-  } else {
-    return Smi::cast(line_ends_array->get(line));
-  }
-}
-
 static Handle<Object> GetJSPositionInfo(Handle<Script> script, int position,
                                         Script::OffsetFlag offset_flag,
                                         Isolate* isolate) {
@@ -1774,56 +1641,22 @@ RUNTIME_FUNCTION(Runtime_ScriptPositionInfo2) {
   return *GetJSPositionInfo(script, position, offset_flag, isolate);
 }
 
-// Returns the given line as a string, or null if line is out of bounds.
-// The parameter line is expected to include the script's line offset.
-// TODO(5530): Remove once uses in debug.js are gone.
-RUNTIME_FUNCTION(Runtime_ScriptSourceLine) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_CHECKED(JSValue, script, 0);
-  CONVERT_NUMBER_CHECKED(int32_t, line, Int32, args[1]);
-
-  CHECK(script->value()->IsScript());
-  Handle<Script> script_handle = Handle<Script>(Script::cast(script->value()));
-
-  if (script_handle->type() == Script::TYPE_WASM) {
-    // Return null for now; this function will disappear soon anyway.
-    return isolate->heap()->null_value();
-  }
-
-  Script::InitLineEnds(script_handle);
-
-  FixedArray* line_ends_array = FixedArray::cast(script_handle->line_ends());
-  const int line_count = line_ends_array->length();
-
-  line -= script_handle->line_offset();
-  if (line < 0 || line_count <= line) {
-    return isolate->heap()->null_value();
-  }
-
-  const int start =
-      (line == 0) ? 0 : Smi::ToInt(line_ends_array->get(line - 1)) + 1;
-  const int end = Smi::ToInt(line_ends_array->get(line));
-
-  Handle<String> source =
-      handle(String::cast(script_handle->source()), isolate);
-  Handle<String> str = isolate->factory()->NewSubString(source, start, end);
-
-  return *str;
-}
-
 // On function call, depending on circumstances, prepare for stepping in,
 // or perform a side effect check.
 RUNTIME_FUNCTION(Runtime_DebugOnFunctionCall) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, fun, 0);
-  if (isolate->debug()->last_step_action() >= StepIn) {
-    isolate->debug()->PrepareStepIn(fun);
-  }
-  if (isolate->needs_side_effect_check() &&
-      !isolate->debug()->PerformSideEffectCheck(fun)) {
-    return isolate->heap()->exception();
+  if (isolate->debug()->needs_check_on_function_call()) {
+    // Ensure that the callee will perform debug check on function call too.
+    Deoptimizer::DeoptimizeFunction(*fun);
+    if (isolate->debug()->last_step_action() >= StepIn) {
+      isolate->debug()->PrepareStepIn(fun);
+    }
+    if (isolate->needs_side_effect_check() &&
+        !isolate->debug()->PerformSideEffectCheck(fun)) {
+      return isolate->heap()->exception();
+    }
   }
   return isolate->heap()->undefined_value();
 }
@@ -1836,15 +1669,6 @@ RUNTIME_FUNCTION(Runtime_DebugPrepareStepInSuspendedGenerator) {
   return isolate->heap()->undefined_value();
 }
 
-RUNTIME_FUNCTION(Runtime_DebugRecordGenerator) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSGeneratorObject, generator, 0);
-  CHECK(isolate->debug()->last_step_action() >= StepNext);
-  isolate->debug()->RecordGenerator(generator);
-  return isolate->heap()->undefined_value();
-}
-
 RUNTIME_FUNCTION(Runtime_DebugPushPromise) {
   DCHECK_EQ(1, args.length());
   HandleScope scope(isolate);
@@ -1876,26 +1700,11 @@ RUNTIME_FUNCTION(Runtime_DebugAsyncFunctionPromiseCreated) {
   return isolate->heap()->undefined_value();
 }
 
-RUNTIME_FUNCTION(Runtime_DebugPromiseReject) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSPromise, rejected_promise, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
-
-  isolate->debug()->OnPromiseReject(rejected_promise, value);
-  return isolate->heap()->undefined_value();
-}
-
 RUNTIME_FUNCTION(Runtime_DebugIsActive) {
   SealHandleScope shs(isolate);
   return Smi::FromInt(isolate->debug()->is_active());
 }
 
-RUNTIME_FUNCTION(Runtime_DebugBreakInOptimizedCode) {
-  UNIMPLEMENTED();
-  return nullptr;
-}
-
 namespace {
 Handle<JSObject> MakeRangeObject(Isolate* isolate, const CoverageBlock& range) {
   Factory* factory = isolate->factory();
diff --git a/deps/v8/src/runtime/runtime-error.cc b/deps/v8/src/runtime/runtime-error.cc
index 6ded550d04c..7cd98f223b9 100644
--- a/deps/v8/src/runtime/runtime-error.cc
+++ b/deps/v8/src/runtime/runtime-error.cc
@@ -20,5 +20,11 @@ RUNTIME_FUNCTION(Runtime_ErrorToString) {
   RETURN_RESULT_OR_FAILURE(isolate, ErrorUtils::ToString(isolate, recv));
 }
 
+RUNTIME_FUNCTION(Runtime_IsJSError) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(1, args.length());
+  return isolate->heap()->ToBoolean(args[0]->IsJSError());
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-forin.cc b/deps/v8/src/runtime/runtime-forin.cc
index 5c673728019..71f45e95497 100644
--- a/deps/v8/src/runtime/runtime-forin.cc
+++ b/deps/v8/src/runtime/runtime-forin.cc
@@ -36,11 +36,12 @@ MaybeHandle<HeapObject> Enumerate(Handle<JSReceiver> receiver) {
     // Test again, since cache may have been built by GetKeys() calls above.
     if (!accumulator.is_receiver_simple_enum()) return keys;
   }
+  DCHECK(!receiver->IsJSModuleNamespace());
   return handle(receiver->map(), isolate);
 }
 
 // This is a slight modifcation of JSReceiver::HasProperty, dealing with
-// the oddities of JSProxy in for-in filter.
+// the oddities of JSProxy and JSModuleNamespace in for-in filter.
 MaybeHandle<Object> HasEnumerableProperty(Isolate* isolate,
                                           Handle<JSReceiver> receiver,
                                           Handle<Object> key) {
@@ -92,7 +93,14 @@ MaybeHandle<Object> HasEnumerableProperty(Isolate* isolate,
       case LookupIterator::INTEGER_INDEXED_EXOTIC:
         // TypedArray out-of-bounds access.
         return isolate->factory()->undefined_value();
-      case LookupIterator::ACCESSOR:
+      case LookupIterator::ACCESSOR: {
+        if (it.GetHolder<Object>()->IsJSModuleNamespace()) {
+          result = JSModuleNamespace::GetPropertyAttributes(&it);
+          if (result.IsNothing()) return MaybeHandle<Object>();
+          DCHECK_EQ(0, result.FromJust() & DONT_ENUM);
+        }
+        return it.GetName();
+      }
       case LookupIterator::DATA:
         return it.GetName();
     }
diff --git a/deps/v8/src/runtime/runtime-function.cc b/deps/v8/src/runtime/runtime-function.cc
index e9433d2041a..37f005bad9b 100644
--- a/deps/v8/src/runtime/runtime-function.cc
+++ b/deps/v8/src/runtime/runtime-function.cc
@@ -76,7 +76,7 @@ RUNTIME_FUNCTION(Runtime_FunctionGetScriptSourcePosition) {
   DCHECK_EQ(1, args.length());
 
   CONVERT_ARG_CHECKED(JSFunction, fun, 0);
-  int pos = fun->shared()->start_position();
+  int pos = fun->shared()->StartPosition();
   return Smi::FromInt(pos);
 }
 
@@ -88,17 +88,6 @@ RUNTIME_FUNCTION(Runtime_FunctionGetContextData) {
   return fun->native_context()->debug_context_id();
 }
 
-RUNTIME_FUNCTION(Runtime_FunctionSetLength) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(2, args.length());
-
-  CONVERT_ARG_CHECKED(JSFunction, fun, 0);
-  CONVERT_SMI_ARG_CHECKED(length, 1);
-  fun->shared()->set_length(length);
-  return isolate->heap()->undefined_value();
-}
-
-
 RUNTIME_FUNCTION(Runtime_FunctionIsAPIFunction) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
@@ -123,26 +112,24 @@ RUNTIME_FUNCTION(Runtime_SetCode) {
     return isolate->heap()->exception();
   }
 
-  // Set the code, scope info, formal parameter count, and the length
+  // Set the function data, scope info, formal parameter count, and the length
   // of the target shared function info.
-  target_shared->set_code(source_shared->code());
-  if (source_shared->HasBytecodeArray()) {
-    target_shared->set_bytecode_array(source_shared->bytecode_array());
-  }
-  target_shared->set_scope_info(source_shared->scope_info());
-  target_shared->set_outer_scope_info(source_shared->outer_scope_info());
+  target_shared->set_function_data(source_shared->function_data());
   target_shared->set_length(source_shared->GetLength());
   target_shared->set_feedback_metadata(source_shared->feedback_metadata());
   target_shared->set_internal_formal_parameter_count(
       source_shared->internal_formal_parameter_count());
-  target_shared->set_start_position_and_type(
-      source_shared->start_position_and_type());
-  target_shared->set_end_position(source_shared->end_position());
+  target_shared->set_raw_start_position_and_type(
+      source_shared->raw_start_position_and_type());
+  target_shared->set_raw_end_position(source_shared->raw_end_position());
   bool was_native = target_shared->native();
-  target_shared->set_compiler_hints(source_shared->compiler_hints());
+  target_shared->set_flags(source_shared->flags());
   target_shared->set_native(was_native);
   target_shared->set_function_literal_id(source_shared->function_literal_id());
 
+  target_shared->set_scope_info(source_shared->scope_info());
+  target_shared->set_outer_scope_info(source_shared->outer_scope_info());
+
   Handle<Object> source_script(source_shared->script(), isolate);
   if (source_script->IsScript()) {
     SharedFunctionInfo::SetScript(source_shared,
@@ -151,15 +138,14 @@ RUNTIME_FUNCTION(Runtime_SetCode) {
   SharedFunctionInfo::SetScript(target_shared, source_script);
 
   // Set the code of the target function.
-  target->set_code(source_shared->code());
-
+  target->set_code(source_shared->GetCode());
   Handle<Context> context(source->context());
   target->set_context(*context);
 
-  // Make sure we get a fresh copy of the literal vector to avoid cross
-  // context contamination, and that the literal vector makes it's way into
+  // Make sure we get a fresh copy of the feedback vector to avoid cross
+  // context contamination, and that the feedback vector makes it's way into
   // the target_shared optimized code map.
-  JSFunction::EnsureLiterals(target);
+  JSFunction::EnsureFeedbackVector(target);
 
   if (isolate->logger()->is_logging_code_events() || isolate->is_profiling()) {
     isolate->logger()->LogExistingFunction(
diff --git a/deps/v8/src/runtime/runtime-generator.cc b/deps/v8/src/runtime/runtime-generator.cc
index 9323d236bc2..a7d14b839e2 100644
--- a/deps/v8/src/runtime/runtime-generator.cc
+++ b/deps/v8/src/runtime/runtime-generator.cc
@@ -11,6 +11,12 @@
 namespace v8 {
 namespace internal {
 
+RUNTIME_FUNCTION(Runtime_IsJSGeneratorObject) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(1, args.length());
+  return isolate->heap()->ToBoolean(args[0]->IsJSGeneratorObject());
+}
+
 RUNTIME_FUNCTION(Runtime_CreateJSGeneratorObject) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
@@ -30,6 +36,9 @@ RUNTIME_FUNCTION(Runtime_CreateJSGeneratorObject) {
   generator->set_receiver(*receiver);
   generator->set_register_file(*register_file);
   generator->set_continuation(JSGeneratorObject::kGeneratorExecuting);
+  if (generator->IsJSAsyncGeneratorObject()) {
+    Handle<JSAsyncGeneratorObject>::cast(generator)->set_is_awaiting(0);
+  }
   return *generator;
 }
 
@@ -55,13 +64,31 @@ RUNTIME_FUNCTION(Runtime_GeneratorGetReceiver) {
   return generator->receiver();
 }
 
-RUNTIME_FUNCTION(Runtime_GeneratorGetContext) {
+RUNTIME_FUNCTION(Runtime_GeneratorGetInputOrDebugPos) {
   // Runtime call is implemented in InterpreterIntrinsics and lowered in
   // JSIntrinsicLowering
   UNREACHABLE();
 }
 
-RUNTIME_FUNCTION(Runtime_GeneratorGetInputOrDebugPos) {
+RUNTIME_FUNCTION(Runtime_AsyncFunctionAwaitCaught) {
+  // Runtime call is implemented in InterpreterIntrinsics and lowered in
+  // JSIntrinsicLowering
+  UNREACHABLE();
+}
+
+RUNTIME_FUNCTION(Runtime_AsyncFunctionAwaitUncaught) {
+  // Runtime call is implemented in InterpreterIntrinsics and lowered in
+  // JSIntrinsicLowering
+  UNREACHABLE();
+}
+
+RUNTIME_FUNCTION(Runtime_AsyncGeneratorAwaitCaught) {
+  // Runtime call is implemented in InterpreterIntrinsics and lowered in
+  // JSIntrinsicLowering
+  UNREACHABLE();
+}
+
+RUNTIME_FUNCTION(Runtime_AsyncGeneratorAwaitUncaught) {
   // Runtime call is implemented in InterpreterIntrinsics and lowered in
   // JSIntrinsicLowering
   UNREACHABLE();
@@ -126,12 +153,11 @@ RUNTIME_FUNCTION(Runtime_AsyncGeneratorHasCatchHandlerForPC) {
 
   SharedFunctionInfo* shared = generator->function()->shared();
   DCHECK(shared->HasBytecodeArray());
-  HandlerTable* handler_table =
-      HandlerTable::cast(shared->bytecode_array()->handler_table());
+  HandlerTable handler_table(shared->bytecode_array());
 
   int pc = Smi::cast(generator->input_or_debug_pos())->value();
   HandlerTable::CatchPrediction catch_prediction = HandlerTable::ASYNC_AWAIT;
-  handler_table->LookupRange(pc, nullptr, &catch_prediction);
+  handler_table.LookupRange(pc, nullptr, &catch_prediction);
   return isolate->heap()->ToBoolean(catch_prediction == HandlerTable::CAUGHT);
 }
 
diff --git a/deps/v8/src/runtime/runtime-internal.cc b/deps/v8/src/runtime/runtime-internal.cc
index f9e93755430..cf7e34d0575 100644
--- a/deps/v8/src/runtime/runtime-internal.cc
+++ b/deps/v8/src/runtime/runtime-internal.cc
@@ -30,6 +30,12 @@ RUNTIME_FUNCTION(Runtime_CheckIsBootstrapping) {
   return isolate->heap()->undefined_value();
 }
 
+RUNTIME_FUNCTION(Runtime_IsScriptWrapper) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(1, args.length());
+  return isolate->heap()->ToBoolean(args[0]->IsScriptWrapper());
+}
+
 RUNTIME_FUNCTION(Runtime_ExportFromRuntime) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -206,30 +212,6 @@ RUNTIME_FUNCTION(Runtime_NewSyntaxError) {
   return *isolate->factory()->NewSyntaxError(message_template, arg0);
 }
 
-RUNTIME_FUNCTION(Runtime_ThrowCannotConvertToPrimitive) {
-  HandleScope scope(isolate);
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate, NewTypeError(MessageTemplate::kCannotConvertToPrimitive));
-}
-
-RUNTIME_FUNCTION(Runtime_ThrowIncompatibleMethodReceiver) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, arg0, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, arg1, 1);
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate,
-      NewTypeError(MessageTemplate::kIncompatibleMethodReceiver, arg0, arg1));
-}
-
-RUNTIME_FUNCTION(Runtime_ThrowInvalidHint) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, hint, 0);
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate, NewTypeError(MessageTemplate::kInvalidHint, hint));
-}
-
 RUNTIME_FUNCTION(Runtime_ThrowInvalidStringLength) {
   HandleScope scope(isolate);
   THROW_NEW_ERROR_RETURN_FAILURE(isolate, NewInvalidStringLengthError());
@@ -258,18 +240,6 @@ RUNTIME_FUNCTION(Runtime_ThrowSymbolIteratorInvalid) {
       isolate, NewTypeError(MessageTemplate::kSymbolIteratorInvalid));
 }
 
-RUNTIME_FUNCTION(Runtime_ThrowNonCallableInInstanceOfCheck) {
-  HandleScope scope(isolate);
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate, NewTypeError(MessageTemplate::kNonCallableInInstanceOfCheck));
-}
-
-RUNTIME_FUNCTION(Runtime_ThrowNonObjectInInstanceOfCheck) {
-  HandleScope scope(isolate);
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate, NewTypeError(MessageTemplate::kNonObjectInInstanceOfCheck));
-}
-
 RUNTIME_FUNCTION(Runtime_ThrowNotConstructor) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -278,13 +248,6 @@ RUNTIME_FUNCTION(Runtime_ThrowNotConstructor) {
       isolate, NewTypeError(MessageTemplate::kNotConstructor, object));
 }
 
-RUNTIME_FUNCTION(Runtime_ThrowGeneratorRunning) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(0, args.length());
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate, NewTypeError(MessageTemplate::kGeneratorRunning));
-}
-
 RUNTIME_FUNCTION(Runtime_ThrowApplyNonFunction) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -454,14 +417,6 @@ RUNTIME_FUNCTION(Runtime_ThrowCalledNonCallable) {
   THROW_NEW_ERROR_RETURN_FAILURE(isolate, NewTypeError(id, callsite));
 }
 
-RUNTIME_FUNCTION(Runtime_ThrowCalledOnNullOrUndefined) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(String, name, 0);
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate, NewTypeError(MessageTemplate::kCalledOnNullOrUndefined, name));
-}
-
 RUNTIME_FUNCTION(Runtime_ThrowConstructedNonConstructable) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -486,14 +441,6 @@ RUNTIME_FUNCTION(Runtime_ThrowConstructorReturnedNonObject) {
       NewTypeError(MessageTemplate::kDerivedConstructorReturnedNonObject));
 }
 
-RUNTIME_FUNCTION(Runtime_ThrowUndefinedOrNullToObject) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(String, name, 0);
-  THROW_NEW_ERROR_RETURN_FAILURE(
-      isolate, NewTypeError(MessageTemplate::kUndefinedOrNullToObject, name));
-}
-
 // ES6 section 7.3.17 CreateListFromArrayLike (obj)
 RUNTIME_FUNCTION(Runtime_CreateListFromArrayLike) {
   HandleScope scope(isolate);
@@ -511,31 +458,22 @@ RUNTIME_FUNCTION(Runtime_DeserializeLazy) {
   DCHECK(FLAG_lazy_deserialization);
 
   Handle<SharedFunctionInfo> shared(function->shared(), isolate);
-  int builtin_id = shared->lazy_deserialization_builtin_id();
 
+#ifdef DEBUG
+  int builtin_id = shared->builtin_id();
   // At this point, the builtins table should definitely have DeserializeLazy
-  // set at the position of the target builtin. Also, we should never lazily
-  // deserialize DeserializeLazy.
-
-  DCHECK_NE(Builtins::kDeserializeLazy, builtin_id);
-  DCHECK_EQ(Builtins::kDeserializeLazy,
-            isolate->builtins()->builtin(builtin_id)->builtin_index());
-
+  // set at the position of the target builtin.
+  CHECK_EQ(Builtins::kDeserializeLazy,
+           isolate->builtins()->builtin(builtin_id)->builtin_index());
   // The DeserializeLazy builtin tail-calls the deserialized builtin. This only
   // works with JS-linkage.
-  DCHECK(Builtins::IsLazy(builtin_id));
-  DCHECK_EQ(Builtins::TFJ, Builtins::KindOf(builtin_id));
+  CHECK(Builtins::IsLazy(builtin_id));
+  CHECK_EQ(Builtins::TFJ, Builtins::KindOf(builtin_id));
+#endif  // DEBUG
 
-  if (FLAG_trace_lazy_deserialization) {
-    PrintF("Lazy-deserializing builtin %s\n", Builtins::name(builtin_id));
-  }
+  Code* code = Snapshot::EnsureBuiltinIsDeserialized(isolate, shared);
 
-  Code* code = Snapshot::DeserializeBuiltin(isolate, builtin_id);
-  DCHECK_EQ(builtin_id, code->builtin_index());
-  DCHECK_EQ(code, isolate->builtins()->builtin(builtin_id));
-  shared->set_code(code);
   function->set_code(code);
-
   return code;
 }
 
@@ -638,17 +576,21 @@ RUNTIME_FUNCTION(Runtime_CreateAsyncFromSyncIterator) {
         isolate, NewTypeError(MessageTemplate::kSymbolIteratorInvalid));
   }
 
+  Handle<Object> next;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, next,
+      Object::GetProperty(sync_iterator, isolate->factory()->next_string()));
+
   return *isolate->factory()->NewJSAsyncFromSyncIterator(
-      Handle<JSReceiver>::cast(sync_iterator));
+      Handle<JSReceiver>::cast(sync_iterator), next);
 }
 
-RUNTIME_FUNCTION(Runtime_GetTemplateObject) {
+RUNTIME_FUNCTION(Runtime_CreateTemplateObject) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(TemplateObjectDescription, description, 0);
 
-  return *TemplateObjectDescription::GetTemplateObject(
-      description, isolate->native_context());
+  return *TemplateObjectDescription::CreateTemplateObject(description);
 }
 
 RUNTIME_FUNCTION(Runtime_ReportMessage) {
diff --git a/deps/v8/src/runtime/runtime-interpreter.cc b/deps/v8/src/runtime/runtime-interpreter.cc
index b65a2327a35..836bf4d5f6b 100644
--- a/deps/v8/src/runtime/runtime-interpreter.cc
+++ b/deps/v8/src/runtime/runtime-interpreter.cc
@@ -41,21 +41,6 @@ RUNTIME_FUNCTION(Runtime_InterpreterDeserializeLazy) {
       bytecode, operand_scale);
 }
 
-RUNTIME_FUNCTION(Runtime_InterpreterNewClosure) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(4, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(SharedFunctionInfo, shared, 0);
-  CONVERT_ARG_HANDLE_CHECKED(FeedbackVector, vector, 1);
-  CONVERT_SMI_ARG_CHECKED(index, 2);
-  CONVERT_SMI_ARG_CHECKED(pretenured_flag, 3);
-  Handle<Context> context(isolate->context(), isolate);
-  FeedbackSlot slot = FeedbackVector::ToSlot(index);
-  Handle<Cell> vector_cell(Cell::cast(vector->Get(slot)), isolate);
-  return *isolate->factory()->NewFunctionFromSharedFunctionInfo(
-      shared, context, vector_cell,
-      static_cast<PretenureFlag>(pretenured_flag));
-}
-
 #ifdef V8_TRACE_IGNITION
 
 namespace {
diff --git a/deps/v8/src/runtime/runtime-intl.cc b/deps/v8/src/runtime/runtime-intl.cc
index c4f132b1340..c359a1e5a10 100644
--- a/deps/v8/src/runtime/runtime-intl.cc
+++ b/deps/v8/src/runtime/runtime-intl.cc
@@ -15,6 +15,7 @@
 #include "src/api.h"
 #include "src/arguments.h"
 #include "src/factory.h"
+#include "src/global-handles.h"
 #include "src/intl.h"
 #include "src/isolate-inl.h"
 #include "src/messages.h"
@@ -500,23 +501,16 @@ RUNTIME_FUNCTION(Runtime_CreateCollator) {
   Handle<JSFunction> constructor(
       isolate->native_context()->intl_collator_function());
 
-  Handle<JSObject> local_object;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, local_object,
+  Handle<JSObject> collator_holder;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, collator_holder,
                                      JSObject::New(constructor, constructor));
 
-  // Set collator as embedder field of the resulting JS object.
-  icu::Collator* collator =
-      Collator::InitializeCollator(isolate, locale, options, resolved);
-
-  if (!collator) return isolate->ThrowIllegalOperation();
-
-  local_object->SetEmbedderField(0, reinterpret_cast<Smi*>(collator));
+  if (!Collator::InitializeCollator(isolate, collator_holder, locale, options,
+                                    resolved)) {
+    return isolate->ThrowIllegalOperation();
+  }
 
-  Handle<Object> wrapper = isolate->global_handles()->Create(*local_object);
-  GlobalHandles::MakeWeak(wrapper.location(), wrapper.location(),
-                          Collator::DeleteCollator,
-                          WeakCallbackType::kInternalFields);
-  return *local_object;
+  return *collator_holder;
 }
 
 RUNTIME_FUNCTION(Runtime_InternalCompare) {
diff --git a/deps/v8/src/runtime/runtime-liveedit.cc b/deps/v8/src/runtime/runtime-liveedit.cc
index 4ed2071c7bb..ee1602b712f 100644
--- a/deps/v8/src/runtime/runtime-liveedit.cc
+++ b/deps/v8/src/runtime/runtime-liveedit.cc
@@ -45,9 +45,9 @@ RUNTIME_FUNCTION(Runtime_LiveEditFindSharedFunctionInfosForScript) {
   for (int i = 0; i < found_size; ++i) {
     Handle<SharedFunctionInfo> shared = found[i];
     SharedInfoWrapper info_wrapper = SharedInfoWrapper::Create(isolate);
-    Handle<String> name(shared->name(), isolate);
-    info_wrapper.SetProperties(name, shared->start_position(),
-                               shared->end_position(), shared);
+    Handle<String> name(shared->Name(), isolate);
+    info_wrapper.SetProperties(name, shared->StartPosition(),
+                               shared->EndPosition(), shared);
     result->set(i, *info_wrapper.GetJSArray());
   }
   return *isolate->factory()->NewJSArrayWithElements(result);
diff --git a/deps/v8/src/runtime/runtime-module.cc b/deps/v8/src/runtime/runtime-module.cc
index a9fb48f8872..a7580503061 100644
--- a/deps/v8/src/runtime/runtime-module.cc
+++ b/deps/v8/src/runtime/runtime-module.cc
@@ -37,24 +37,6 @@ RUNTIME_FUNCTION(Runtime_GetModuleNamespace) {
   return *Module::GetModuleNamespace(module, module_request);
 }
 
-RUNTIME_FUNCTION(Runtime_LoadModuleVariable) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_SMI_ARG_CHECKED(index, 0);
-  Handle<Module> module(isolate->context()->module());
-  return *Module::LoadVariable(module, index);
-}
-
-RUNTIME_FUNCTION(Runtime_StoreModuleVariable) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_SMI_ARG_CHECKED(index, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
-  Handle<Module> module(isolate->context()->module());
-  Module::StoreVariable(module, index, value);
-  return isolate->heap()->undefined_value();
-}
-
 RUNTIME_FUNCTION(Runtime_GetImportMetaObject) {
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
diff --git a/deps/v8/src/runtime/runtime-object.cc b/deps/v8/src/runtime/runtime-object.cc
index 057ead94078..b68315f2863 100644
--- a/deps/v8/src/runtime/runtime-object.cc
+++ b/deps/v8/src/runtime/runtime-object.cc
@@ -34,6 +34,14 @@ MaybeHandle<Object> Runtime::GetObjectProperty(Isolate* isolate,
 
   MaybeHandle<Object> result = Object::GetProperty(&it);
   if (is_found_out) *is_found_out = it.IsFound();
+
+  if (!it.IsFound() && key->IsSymbol() &&
+      Symbol::cast(*key)->is_private_field()) {
+    THROW_NEW_ERROR(
+        isolate,
+        NewTypeError(MessageTemplate::kInvalidPrivateFieldAccess, key, object),
+        Object);
+  }
   return result;
 }
 
@@ -390,6 +398,14 @@ MaybeHandle<Object> Runtime::SetObjectProperty(Isolate* isolate,
       LookupIterator::PropertyOrElement(isolate, object, key, &success);
   if (!success) return MaybeHandle<Object>();
 
+  if (!it.IsFound() && key->IsSymbol() &&
+      Symbol::cast(*key)->is_private_field()) {
+    THROW_NEW_ERROR(
+        isolate,
+        NewTypeError(MessageTemplate::kInvalidPrivateFieldAccess, key, object),
+        Object);
+  }
+
   MAYBE_RETURN_NULL(Object::SetProperty(&it, value, language_mode,
                                         Object::MAY_BE_STORE_FROM_KEYED));
   return value;
@@ -411,7 +427,7 @@ RUNTIME_FUNCTION(Runtime_InternalSetPrototype) {
   CONVERT_ARG_HANDLE_CHECKED(Object, prototype, 1);
   if (prototype->IsJSFunction()) {
     Handle<JSFunction> function = Handle<JSFunction>::cast(prototype);
-    if (!function->shared()->has_shared_name()) {
+    if (!function->shared()->HasSharedName()) {
       Handle<Map> function_map(function->map(), isolate);
       if (!JSFunction::SetName(function, isolate->factory()->proto_string(),
                                isolate->factory()->empty_string())) {
@@ -439,6 +455,61 @@ RUNTIME_FUNCTION(Runtime_OptimizeObjectForAddingMultipleProperties) {
   return *object;
 }
 
+RUNTIME_FUNCTION(Runtime_ObjectValues) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, receiver, 0);
+
+  Handle<FixedArray> values;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, values,
+      JSReceiver::GetOwnValues(receiver, PropertyFilter::ENUMERABLE_STRINGS,
+                               true));
+  return *isolate->factory()->NewJSArrayWithElements(values);
+}
+
+RUNTIME_FUNCTION(Runtime_ObjectValuesSkipFastPath) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, receiver, 0);
+
+  Handle<FixedArray> value;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, value,
+      JSReceiver::GetOwnValues(receiver, PropertyFilter::ENUMERABLE_STRINGS,
+                               false));
+  return *isolate->factory()->NewJSArrayWithElements(value);
+}
+
+RUNTIME_FUNCTION(Runtime_ObjectEntries) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, receiver, 0);
+
+  Handle<FixedArray> entries;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, entries,
+      JSReceiver::GetOwnEntries(receiver, PropertyFilter::ENUMERABLE_STRINGS,
+                                true));
+  return *isolate->factory()->NewJSArrayWithElements(entries);
+}
+
+RUNTIME_FUNCTION(Runtime_ObjectEntriesSkipFastPath) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, receiver, 0);
+
+  Handle<FixedArray> entries;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, entries,
+      JSReceiver::GetOwnEntries(receiver, PropertyFilter::ENUMERABLE_STRINGS,
+                                false));
+  return *isolate->factory()->NewJSArrayWithElements(entries);
+}
 
 RUNTIME_FUNCTION(Runtime_GetProperty) {
   HandleScope scope(isolate);
@@ -517,24 +588,6 @@ RUNTIME_FUNCTION(Runtime_AddElement) {
 }
 
 
-RUNTIME_FUNCTION(Runtime_AppendElement) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-
-  CONVERT_ARG_HANDLE_CHECKED(JSArray, array, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
-  CHECK(!value->IsTheHole(isolate));
-
-  uint32_t index;
-  CHECK(array->length()->ToArrayIndex(&index));
-
-  RETURN_FAILURE_ON_EXCEPTION(
-      isolate, JSObject::AddDataElement(array, index, value, NONE));
-  JSObject::ValidateElements(*array);
-  return *array;
-}
-
-
 RUNTIME_FUNCTION(Runtime_SetProperty) {
   HandleScope scope(isolate);
   DCHECK_EQ(4, args.length());
@@ -687,26 +740,6 @@ RUNTIME_FUNCTION(Runtime_CompleteInobjectSlackTrackingForMap) {
 }
 
 
-RUNTIME_FUNCTION(Runtime_LoadMutableDouble) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Smi, index, 1);
-  CHECK_EQ(index->value() & 1, 1);
-  FieldIndex field_index =
-      FieldIndex::ForLoadByFieldIndex(object->map(), index->value());
-  if (field_index.is_inobject()) {
-    CHECK(field_index.property_index() <
-          object->map()->GetInObjectProperties());
-  } else {
-    CHECK(field_index.outobject_array_index() <
-          object->property_dictionary()->length());
-  }
-  return *JSObject::FastPropertyAt(object, Representation::Double(),
-                                   field_index);
-}
-
-
 RUNTIME_FUNCTION(Runtime_TryMigrateInstance) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -724,13 +757,6 @@ RUNTIME_FUNCTION(Runtime_TryMigrateInstance) {
 }
 
 
-RUNTIME_FUNCTION(Runtime_IsJSGlobalProxy) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_CHECKED(Object, obj, 0);
-  return isolate->heap()->ToBoolean(obj->IsJSGlobalProxy());
-}
-
 static bool IsValidAccessor(Isolate* isolate, Handle<Object> obj) {
   return obj->IsNullOrUndefined(isolate) || obj->IsCallable();
 }
@@ -770,10 +796,11 @@ RUNTIME_FUNCTION(Runtime_DefineDataPropertyInLiteral) {
   CONVERT_ARG_HANDLE_CHECKED(FeedbackVector, vector, 4);
   CONVERT_SMI_ARG_CHECKED(index, 5);
 
-  StoreDataPropertyInLiteralICNexus nexus(vector, vector->ToSlot(index));
+  FeedbackNexus nexus(vector, FeedbackVector::ToSlot(index));
   if (nexus.ic_state() == UNINITIALIZED) {
     if (name->IsUniqueName()) {
-      nexus.ConfigureMonomorphic(name, handle(object->map()));
+      nexus.ConfigureMonomorphic(name, handle(object->map()),
+                                 Handle<Code>::null());
     } else {
       nexus.ConfigureMegamorphic(PROPERTY);
     }
@@ -794,7 +821,7 @@ RUNTIME_FUNCTION(Runtime_DefineDataPropertyInLiteral) {
   if (flags & DataPropertyInLiteralFlag::kSetFunctionName) {
     DCHECK(value->IsJSFunction());
     Handle<JSFunction> function = Handle<JSFunction>::cast(value);
-    DCHECK(!function->shared()->has_shared_name());
+    DCHECK(!function->shared()->HasSharedName());
     Handle<Map> function_map(function->map(), isolate);
     if (!JSFunction::SetName(function, name,
                              isolate->factory()->empty_string())) {
@@ -833,31 +860,12 @@ RUNTIME_FUNCTION(Runtime_CollectTypeProfile) {
   }
 
   DCHECK(vector->metadata()->HasTypeProfileSlot());
-  CollectTypeProfileNexus nexus(vector, vector->GetTypeProfileSlot());
+  FeedbackNexus nexus(vector, vector->GetTypeProfileSlot());
   nexus.Collect(type, position->value());
 
   return isolate->heap()->undefined_value();
 }
 
-// Return property without being observable by accessors or interceptors.
-RUNTIME_FUNCTION(Runtime_GetDataProperty) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, object, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
-  return *JSReceiver::GetDataProperty(object, name);
-}
-
-RUNTIME_FUNCTION(Runtime_GetConstructorName) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
-
-  CHECK(!object->IsNullOrUndefined(isolate));
-  Handle<JSReceiver> recv = Object::ToObject(isolate, object).ToHandleChecked();
-  return *JSReceiver::GetConstructorName(recv);
-}
-
 RUNTIME_FUNCTION(Runtime_HasFastPackedElements) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
@@ -892,6 +900,12 @@ RUNTIME_FUNCTION(Runtime_ClassOf) {
   return JSReceiver::cast(obj)->class_name();
 }
 
+RUNTIME_FUNCTION(Runtime_GetFunctionName) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
+  return *JSFunction::GetName(isolate, function);
+}
 
 RUNTIME_FUNCTION(Runtime_DefineGetterPropertyUnchecked) {
   HandleScope scope(isolate);
@@ -901,7 +915,7 @@ RUNTIME_FUNCTION(Runtime_DefineGetterPropertyUnchecked) {
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, getter, 2);
   CONVERT_PROPERTY_ATTRIBUTES_CHECKED(attrs, 3);
 
-  if (String::cast(getter->shared()->name())->length() == 0) {
+  if (String::cast(getter->shared()->Name())->length() == 0) {
     Handle<Map> getter_map(getter->map(), isolate);
     if (!JSFunction::SetName(getter, name, isolate->factory()->get_string())) {
       return isolate->heap()->exception();
@@ -1033,7 +1047,7 @@ RUNTIME_FUNCTION(Runtime_DefineSetterPropertyUnchecked) {
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, setter, 2);
   CONVERT_PROPERTY_ATTRIBUTES_CHECKED(attrs, 3);
 
-  if (String::cast(setter->shared()->name())->length() == 0) {
+  if (String::cast(setter->shared()->Name())->length() == 0) {
     Handle<Map> setter_map(setter->map(), isolate);
     if (!JSFunction::SetName(setter, name, isolate->factory()->set_string())) {
       return isolate->heap()->exception();
@@ -1175,9 +1189,13 @@ RUNTIME_FUNCTION(Runtime_CreateDataProperty) {
 RUNTIME_FUNCTION(Runtime_IterableToListCanBeElided) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, obj, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, obj, 0);
 
-  if (!obj->IsJSObject()) return isolate->heap()->ToBoolean(false);
+  // If an iterator symbol is added to the Number prototype, we could see a Smi.
+  if (obj->IsSmi()) return isolate->heap()->ToBoolean(false);
+  if (!HeapObject::cast(*obj)->IsJSObject()) {
+    return isolate->heap()->ToBoolean(false);
+  }
 
   // While iteration alone may not have observable side-effects, calling
   // toNumber on an object will. Make sure the arg is not an array of objects.
@@ -1203,5 +1221,27 @@ RUNTIME_FUNCTION(Runtime_GetOwnPropertyDescriptor) {
   return *desc.ToPropertyDescriptorObject(isolate);
 }
 
+RUNTIME_FUNCTION(Runtime_AddPrivateField) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(3, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, o, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Symbol, key, 1);
+  CONVERT_ARG_HANDLE_CHECKED(Object, value, 2);
+  DCHECK(key->is_private_field());
+
+  LookupIterator it =
+      LookupIterator::PropertyOrElement(isolate, o, key, LookupIterator::OWN);
+
+  if (it.IsFound()) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kVarRedeclaration, key));
+  }
+
+  CHECK(Object::AddDataProperty(&it, value, NONE, kDontThrow,
+                                Object::MAY_BE_STORE_FROM_KEYED)
+            .FromJust());
+  return isolate->heap()->undefined_value();
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-operators.cc b/deps/v8/src/runtime/runtime-operators.cc
index 42a7e21b828..d01d1158924 100644
--- a/deps/v8/src/runtime/runtime-operators.cc
+++ b/deps/v8/src/runtime/runtime-operators.cc
@@ -9,33 +9,6 @@
 namespace v8 {
 namespace internal {
 
-RUNTIME_FUNCTION(Runtime_Multiply) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, lhs, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, rhs, 1);
-  RETURN_RESULT_OR_FAILURE(isolate, Object::Multiply(isolate, lhs, rhs));
-}
-
-
-RUNTIME_FUNCTION(Runtime_Divide) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, lhs, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, rhs, 1);
-  RETURN_RESULT_OR_FAILURE(isolate, Object::Divide(isolate, lhs, rhs));
-}
-
-
-RUNTIME_FUNCTION(Runtime_Modulus) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, lhs, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, rhs, 1);
-  RETURN_RESULT_OR_FAILURE(isolate, Object::Modulus(isolate, lhs, rhs));
-}
-
-
 RUNTIME_FUNCTION(Runtime_Add) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
@@ -45,69 +18,6 @@ RUNTIME_FUNCTION(Runtime_Add) {
 }
 
 
-RUNTIME_FUNCTION(Runtime_Subtract) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, lhs, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, rhs, 1);
-  RETURN_RESULT_OR_FAILURE(isolate, Object::Subtract(isolate, lhs, rhs));
-}
-
-
-RUNTIME_FUNCTION(Runtime_ShiftLeft) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, lhs, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, rhs, 1);
-  RETURN_RESULT_OR_FAILURE(isolate, Object::ShiftLeft(isolate, lhs, rhs));
-}
-
-
-RUNTIME_FUNCTION(Runtime_ShiftRight) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, lhs, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, rhs, 1);
-  RETURN_RESULT_OR_FAILURE(isolate, Object::ShiftRight(isolate, lhs, rhs));
-}
-
-
-RUNTIME_FUNCTION(Runtime_ShiftRightLogical) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, lhs, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, rhs, 1);
-  RETURN_RESULT_OR_FAILURE(isolate,
-                           Object::ShiftRightLogical(isolate, lhs, rhs));
-}
-
-
-RUNTIME_FUNCTION(Runtime_BitwiseAnd) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, lhs, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, rhs, 1);
-  RETURN_RESULT_OR_FAILURE(isolate, Object::BitwiseAnd(isolate, lhs, rhs));
-}
-
-
-RUNTIME_FUNCTION(Runtime_BitwiseOr) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, lhs, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, rhs, 1);
-  RETURN_RESULT_OR_FAILURE(isolate, Object::BitwiseOr(isolate, lhs, rhs));
-}
-
-
-RUNTIME_FUNCTION(Runtime_BitwiseXor) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, lhs, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, rhs, 1);
-  RETURN_RESULT_OR_FAILURE(isolate, Object::BitwiseXor(isolate, lhs, rhs));
-}
-
 RUNTIME_FUNCTION(Runtime_Equal) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
@@ -184,14 +94,5 @@ RUNTIME_FUNCTION(Runtime_GreaterThanOrEqual) {
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
-RUNTIME_FUNCTION(Runtime_InstanceOf) {
-  HandleScope shs(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, callable, 1);
-  RETURN_RESULT_OR_FAILURE(isolate,
-                           Object::InstanceOf(isolate, object, callable));
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-promise.cc b/deps/v8/src/runtime/runtime-promise.cc
index 2c28cd3c983..b2a7e8bae1b 100644
--- a/deps/v8/src/runtime/runtime-promise.cc
+++ b/deps/v8/src/runtime/runtime-promise.cc
@@ -1,8 +1,10 @@
 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+
 #include "src/runtime/runtime-utils.h"
 
+#include "src/api.h"
 #include "src/arguments.h"
 #include "src/counters.h"
 #include "src/debug/debug.h"
@@ -12,27 +14,6 @@
 namespace v8 {
 namespace internal {
 
-namespace {
-
-void PromiseRejectEvent(Isolate* isolate, Handle<JSPromise> promise,
-                        Handle<Object> rejected_promise, Handle<Object> value,
-                        bool debug_event) {
-  isolate->RunPromiseHook(PromiseHookType::kResolve, promise,
-                          isolate->factory()->undefined_value());
-
-  if (isolate->debug()->is_active() && debug_event) {
-    isolate->debug()->OnPromiseReject(rejected_promise, value);
-  }
-
-  // Report only if we don't actually have a handler.
-  if (!promise->has_handler()) {
-    isolate->ReportPromiseReject(promise, value,
-                                 v8::kPromiseRejectWithNoHandler);
-  }
-}
-
-}  // namespace
-
 RUNTIME_FUNCTION(Runtime_PromiseRejectEventFromStack) {
   DCHECK_EQ(2, args.length());
   HandleScope scope(isolate);
@@ -41,21 +22,19 @@ RUNTIME_FUNCTION(Runtime_PromiseRejectEventFromStack) {
 
   Handle<Object> rejected_promise = promise;
   if (isolate->debug()->is_active()) {
-    // If the Promise.reject call is caught, then this will return
-    // undefined, which will be interpreted by PromiseRejectEvent
-    // as being a caught exception event.
+    // If the Promise.reject() call is caught, then this will return
+    // undefined, which we interpret as being a caught exception event.
     rejected_promise = isolate->GetPromiseOnStackOnThrow();
   }
-  PromiseRejectEvent(isolate, promise, rejected_promise, value, true);
-  return isolate->heap()->undefined_value();
-}
+  isolate->RunPromiseHook(PromiseHookType::kResolve, promise,
+                          isolate->factory()->undefined_value());
+  isolate->debug()->OnPromiseReject(rejected_promise, value);
 
-RUNTIME_FUNCTION(Runtime_ReportPromiseReject) {
-  DCHECK_EQ(2, args.length());
-  HandleScope scope(isolate);
-  CONVERT_ARG_HANDLE_CHECKED(JSPromise, promise, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
-  isolate->ReportPromiseReject(promise, value, v8::kPromiseRejectWithNoHandler);
+  // Report only if we don't actually have a handler.
+  if (!promise->has_handler()) {
+    isolate->ReportPromiseReject(promise, value,
+                                 v8::kPromiseRejectWithNoHandler);
+  }
   return isolate->heap()->undefined_value();
 }
 
@@ -73,7 +52,9 @@ RUNTIME_FUNCTION(Runtime_PromiseRevokeReject) {
 RUNTIME_FUNCTION(Runtime_EnqueueMicrotask) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, microtask, 0);
+  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
+  Handle<CallableTask> microtask =
+      isolate->factory()->NewCallableTask(function, isolate->native_context());
   isolate->EnqueueMicrotask(microtask);
   return isolate->heap()->undefined_value();
 }
@@ -85,6 +66,18 @@ RUNTIME_FUNCTION(Runtime_RunMicrotasks) {
   return isolate->heap()->undefined_value();
 }
 
+RUNTIME_FUNCTION(Runtime_RunMicrotaskCallback) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(2, args.length());
+  CONVERT_ARG_CHECKED(Object, microtask_callback, 0);
+  CONVERT_ARG_CHECKED(Object, microtask_data, 1);
+  MicrotaskCallback callback = ToCData<MicrotaskCallback>(microtask_callback);
+  void* data = ToCData<void*>(microtask_data);
+  callback(data);
+  RETURN_FAILURE_IF_SCHEDULED_EXCEPTION(isolate);
+  return isolate->heap()->undefined_value();
+}
+
 RUNTIME_FUNCTION(Runtime_PromiseStatus) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -118,23 +111,17 @@ RUNTIME_FUNCTION(Runtime_PromiseHookInit) {
   return isolate->heap()->undefined_value();
 }
 
-RUNTIME_FUNCTION(Runtime_PromiseHookResolve) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSPromise, promise, 0);
-  isolate->RunPromiseHook(PromiseHookType::kResolve, promise,
-                          isolate->factory()->undefined_value());
-  return isolate->heap()->undefined_value();
-}
-
 RUNTIME_FUNCTION(Runtime_PromiseHookBefore) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSObject, promise, 0);
-  if (promise->IsJSPromise()) {
-    isolate->RunPromiseHook(PromiseHookType::kBefore,
-                            Handle<JSPromise>::cast(promise),
-                            isolate->factory()->undefined_value());
+  CONVERT_ARG_HANDLE_CHECKED(HeapObject, payload, 0);
+  Handle<JSPromise> promise;
+  if (JSPromise::From(payload).ToHandle(&promise)) {
+    if (isolate->debug()->is_active()) isolate->PushPromise(promise);
+    if (promise->IsJSPromise()) {
+      isolate->RunPromiseHook(PromiseHookType::kBefore, promise,
+                              isolate->factory()->undefined_value());
+    }
   }
   return isolate->heap()->undefined_value();
 }
@@ -142,14 +129,37 @@ RUNTIME_FUNCTION(Runtime_PromiseHookBefore) {
 RUNTIME_FUNCTION(Runtime_PromiseHookAfter) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSObject, promise, 0);
-  if (promise->IsJSPromise()) {
-    isolate->RunPromiseHook(PromiseHookType::kAfter,
-                            Handle<JSPromise>::cast(promise),
-                            isolate->factory()->undefined_value());
+  CONVERT_ARG_HANDLE_CHECKED(HeapObject, payload, 0);
+  Handle<JSPromise> promise;
+  if (JSPromise::From(payload).ToHandle(&promise)) {
+    if (isolate->debug()->is_active()) isolate->PopPromise();
+    if (promise->IsJSPromise()) {
+      isolate->RunPromiseHook(PromiseHookType::kAfter, promise,
+                              isolate->factory()->undefined_value());
+    }
   }
   return isolate->heap()->undefined_value();
 }
 
+RUNTIME_FUNCTION(Runtime_RejectPromise) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(3, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSPromise, promise, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, reason, 1);
+  CONVERT_ARG_HANDLE_CHECKED(Oddball, debug_event, 2);
+  return *JSPromise::Reject(promise, reason, debug_event->BooleanValue());
+}
+
+RUNTIME_FUNCTION(Runtime_ResolvePromise) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(2, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSPromise, promise, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, resolution, 1);
+  Handle<Object> result;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
+                                     JSPromise::Resolve(promise, resolution));
+  return *result;
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-regexp.cc b/deps/v8/src/runtime/runtime-regexp.cc
index d0afcd26360..920f37cf98d 100644
--- a/deps/v8/src/runtime/runtime-regexp.cc
+++ b/deps/v8/src/runtime/runtime-regexp.cc
@@ -1920,14 +1920,6 @@ RUNTIME_FUNCTION(Runtime_RegExpReplace) {
   RETURN_RESULT_OR_FAILURE(isolate, builder.Finish());
 }
 
-RUNTIME_FUNCTION(Runtime_RegExpExecReThrow) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(0, args.length());
-  Object* exception = isolate->pending_exception();
-  isolate->clear_pending_exception();
-  return isolate->ReThrow(exception);
-}
-
 RUNTIME_FUNCTION(Runtime_RegExpInitializeAndCompile) {
   HandleScope scope(isolate);
   DCHECK_EQ(3, args.length());
diff --git a/deps/v8/src/runtime/runtime-scopes.cc b/deps/v8/src/runtime/runtime-scopes.cc
index 76f291f90f8..9483949674b 100644
--- a/deps/v8/src/runtime/runtime-scopes.cc
+++ b/deps/v8/src/runtime/runtime-scopes.cc
@@ -123,7 +123,7 @@ Object* DeclareGlobal(
     // named interceptor or the interceptor is not masking.
     if (!global->HasNamedInterceptor() ||
         global->GetNamedInterceptor()->non_masking()) {
-      LoadGlobalICNexus nexus(feedback_vector, slot);
+      FeedbackNexus nexus(feedback_vector, slot);
       nexus.ConfigurePropertyCellMode(it.GetPropertyCell());
     }
   }
@@ -141,7 +141,8 @@ Object* DeclareGlobals(Isolate* isolate, Handle<FixedArray> declarations,
   FOR_WITH_HANDLE_SCOPE(isolate, int, i = 0, i, i < length, i += 4, {
     Handle<String> name(String::cast(declarations->get(i)), isolate);
     FeedbackSlot slot(Smi::ToInt(declarations->get(i + 1)));
-    Handle<Object> possibly_literal_slot(declarations->get(i + 2), isolate);
+    Handle<Object> possibly_feedback_cell_slot(declarations->get(i + 2),
+                                               isolate);
     Handle<Object> initial_value(declarations->get(i + 3), isolate);
 
     bool is_var = initial_value->IsUndefined(isolate);
@@ -150,16 +151,18 @@ Object* DeclareGlobals(Isolate* isolate, Handle<FixedArray> declarations,
 
     Handle<Object> value;
     if (is_function) {
-      DCHECK(possibly_literal_slot->IsSmi());
+      DCHECK(possibly_feedback_cell_slot->IsSmi());
       // Copy the function and update its context. Use it as value.
       Handle<SharedFunctionInfo> shared =
           Handle<SharedFunctionInfo>::cast(initial_value);
-      FeedbackSlot literals_slot(Smi::ToInt(*possibly_literal_slot));
-      Handle<Cell> literals(Cell::cast(feedback_vector->Get(literals_slot)),
-                            isolate);
+      FeedbackSlot feedback_cells_slot(
+          Smi::ToInt(*possibly_feedback_cell_slot));
+      Handle<FeedbackCell> feedback_cell(
+          FeedbackCell::cast(feedback_vector->Get(feedback_cells_slot)),
+          isolate);
       Handle<JSFunction> function =
           isolate->factory()->NewFunctionFromSharedFunctionInfo(
-              shared, context, literals, TENURED);
+              shared, context, feedback_cell, TENURED);
       value = function;
     } else {
       value = isolate->factory()->undefined_value();
@@ -191,19 +194,6 @@ RUNTIME_FUNCTION(Runtime_DeclareGlobals) {
   HandleScope scope(isolate);
   DCHECK_EQ(3, args.length());
 
-  CONVERT_ARG_HANDLE_CHECKED(FixedArray, declarations, 0);
-  CONVERT_SMI_ARG_CHECKED(flags, 1);
-  CONVERT_ARG_HANDLE_CHECKED(FeedbackVector, feedback_vector, 2);
-
-  return DeclareGlobals(isolate, declarations, flags, feedback_vector);
-}
-
-// TODO(ishell): merge this with Runtime::kDeclareGlobals once interpreter
-// is able to pass feedback vector.
-RUNTIME_FUNCTION(Runtime_DeclareGlobalsForInterpreter) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
-
   CONVERT_ARG_HANDLE_CHECKED(FixedArray, declarations, 0);
   CONVERT_SMI_ARG_CHECKED(flags, 1);
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, closure, 2);
@@ -635,34 +625,27 @@ RUNTIME_FUNCTION(Runtime_NewArgumentsElements) {
 
 RUNTIME_FUNCTION(Runtime_NewClosure) {
   HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
+  DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(SharedFunctionInfo, shared, 0);
-  CONVERT_ARG_HANDLE_CHECKED(FeedbackVector, vector, 1);
-  CONVERT_SMI_ARG_CHECKED(index, 2);
+  CONVERT_ARG_HANDLE_CHECKED(FeedbackCell, feedback_cell, 1);
   Handle<Context> context(isolate->context(), isolate);
-  FeedbackSlot slot = FeedbackVector::ToSlot(index);
-  Handle<Cell> vector_cell(Cell::cast(vector->Get(slot)), isolate);
   Handle<JSFunction> function =
       isolate->factory()->NewFunctionFromSharedFunctionInfo(
-          shared, context, vector_cell, NOT_TENURED);
+          shared, context, feedback_cell, NOT_TENURED);
   return *function;
 }
 
-
 RUNTIME_FUNCTION(Runtime_NewClosure_Tenured) {
   HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
+  DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(SharedFunctionInfo, shared, 0);
-  CONVERT_ARG_HANDLE_CHECKED(FeedbackVector, vector, 1);
-  CONVERT_SMI_ARG_CHECKED(index, 2);
+  CONVERT_ARG_HANDLE_CHECKED(FeedbackCell, feedback_cell, 1);
   Handle<Context> context(isolate->context(), isolate);
-  FeedbackSlot slot = FeedbackVector::ToSlot(index);
-  Handle<Cell> vector_cell(Cell::cast(vector->Get(slot)), isolate);
   // The caller ensures that we pretenure closures that are assigned
   // directly to properties.
   Handle<JSFunction> function =
       isolate->factory()->NewFunctionFromSharedFunctionInfo(
-          shared, context, vector_cell, TENURED);
+          shared, context, feedback_cell, TENURED);
   return *function;
 }
 
diff --git a/deps/v8/src/runtime/runtime-strings.cc b/deps/v8/src/runtime/runtime-strings.cc
index 8f6b887f62b..6f203b3d012 100644
--- a/deps/v8/src/runtime/runtime-strings.cc
+++ b/deps/v8/src/runtime/runtime-strings.cc
@@ -216,35 +216,16 @@ RUNTIME_FUNCTION(Runtime_StringLastIndexOf) {
                              isolate->factory()->undefined_value());
 }
 
-RUNTIME_FUNCTION(Runtime_SubString) {
+RUNTIME_FUNCTION(Runtime_StringSubstring) {
   HandleScope scope(isolate);
   DCHECK_EQ(3, args.length());
-
   CONVERT_ARG_HANDLE_CHECKED(String, string, 0);
-  int start, end;
-  // We have a fast integer-only case here to avoid a conversion to double in
-  // the common case where from and to are Smis.
-  if (args[1]->IsSmi() && args[2]->IsSmi()) {
-    CONVERT_SMI_ARG_CHECKED(from_number, 1);
-    CONVERT_SMI_ARG_CHECKED(to_number, 2);
-    start = from_number;
-    end = to_number;
-  } else if (args[1]->IsNumber() && args[2]->IsNumber()) {
-    CONVERT_DOUBLE_ARG_CHECKED(from_number, 1);
-    CONVERT_DOUBLE_ARG_CHECKED(to_number, 2);
-    start = FastD2IChecked(from_number);
-    end = FastD2IChecked(to_number);
-  } else {
-    return isolate->ThrowIllegalOperation();
-  }
-  // The following condition is intentionally robust because the SubString
-  // builtin delegates here and we test this in
-  // cctest/test-strings/RobustSubStringStub.
-  if (end < start || start < 0 || end > string->length()) {
-    return isolate->ThrowIllegalOperation();
-  }
+  CONVERT_INT32_ARG_CHECKED(start, 1);
+  CONVERT_INT32_ARG_CHECKED(end, 2);
+  DCHECK_LE(0, start);
+  DCHECK_LE(start, end);
+  DCHECK_LE(end, string->length());
   isolate->counters()->sub_string_runtime()->Increment();
-
   return *isolate->factory()->NewSubString(string, start, end);
 }
 
diff --git a/deps/v8/src/runtime/runtime-symbol.cc b/deps/v8/src/runtime/runtime-symbol.cc
index 2eaef63bbf2..488aa756c6e 100644
--- a/deps/v8/src/runtime/runtime-symbol.cc
+++ b/deps/v8/src/runtime/runtime-symbol.cc
@@ -12,28 +12,25 @@
 namespace v8 {
 namespace internal {
 
-RUNTIME_FUNCTION(Runtime_CreateSymbol) {
+RUNTIME_FUNCTION(Runtime_CreatePrivateSymbol) {
   HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, name, 0);
-  CHECK(name->IsString() || name->IsUndefined(isolate));
-  Handle<Symbol> symbol = isolate->factory()->NewSymbol();
-  if (name->IsString()) symbol->set_name(*name);
+  DCHECK_GE(1, args.length());
+  Handle<Symbol> symbol = isolate->factory()->NewPrivateSymbol();
+  if (args.length() == 1) {
+    CONVERT_ARG_HANDLE_CHECKED(Object, name, 0);
+    CHECK(name->IsString() || name->IsUndefined(isolate));
+    if (name->IsString()) symbol->set_name(*name);
+  }
   return *symbol;
 }
 
-
-RUNTIME_FUNCTION(Runtime_CreatePrivateSymbol) {
+RUNTIME_FUNCTION(Runtime_CreatePrivateFieldSymbol) {
   HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, name, 0);
-  CHECK(name->IsString() || name->IsUndefined(isolate));
-  Handle<Symbol> symbol = isolate->factory()->NewPrivateSymbol();
-  if (name->IsString()) symbol->set_name(*name);
+  DCHECK_EQ(0, args.length());
+  Handle<Symbol> symbol = isolate->factory()->NewPrivateFieldSymbol();
   return *symbol;
 }
 
-
 RUNTIME_FUNCTION(Runtime_SymbolDescription) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
diff --git a/deps/v8/src/runtime/runtime-test.cc b/deps/v8/src/runtime/runtime-test.cc
index 01e2b198a64..020576a3b07 100644
--- a/deps/v8/src/runtime/runtime-test.cc
+++ b/deps/v8/src/runtime/runtime-test.cc
@@ -175,22 +175,6 @@ RUNTIME_FUNCTION(Runtime_IsConcurrentRecompilationSupported) {
       isolate->concurrent_recompilation_enabled());
 }
 
-RUNTIME_FUNCTION(Runtime_TypeProfile) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
-  if (function->has_feedback_vector()) {
-    FeedbackVector* vector = function->feedback_vector();
-    if (vector->metadata()->HasTypeProfileSlot()) {
-      FeedbackSlot slot = vector->GetTypeProfileSlot();
-      CollectTypeProfileNexus nexus(vector, slot);
-      return nexus.GetTypeProfile();
-    }
-  }
-  return *isolate->factory()->NewJSObject(isolate->object_function());
-}
-
 RUNTIME_FUNCTION(Runtime_OptimizeFunctionOnNextCall) {
   HandleScope scope(isolate);
 
@@ -227,11 +211,6 @@ RUNTIME_FUNCTION(Runtime_OptimizeFunctionOnNextCall) {
 
   // If the function has optimized code, ensure that we check for it and return.
   if (function->HasOptimizedCode()) {
-    if (!function->IsInterpreted()) {
-      // For non I+TF path, install a shim which checks the optimization marker.
-      function->set_code(
-          isolate->builtins()->builtin(Builtins::kCheckOptimizationMarker));
-    }
     DCHECK(function->ChecksOptimizationMarker());
     return isolate->heap()->undefined_value();
   }
@@ -252,9 +231,14 @@ RUNTIME_FUNCTION(Runtime_OptimizeFunctionOnNextCall) {
                                                             : "non-concurrent");
   }
 
-  // TODO(mvstanton): pass pretenure flag to EnsureLiterals.
-  JSFunction::EnsureLiterals(function);
+  // This function may not have been lazily compiled yet, even though its shared
+  // function has.
+  if (!function->is_compiled()) {
+    DCHECK(function->shared()->IsInterpreted());
+    function->set_code(*BUILTIN_CODE(isolate, InterpreterEntryTrampoline));
+  }
 
+  JSFunction::EnsureFeedbackVector(function);
   function->MarkForOptimization(concurrency_mode);
 
   return isolate->heap()->undefined_value();
@@ -470,121 +454,6 @@ RUNTIME_FUNCTION(Runtime_ClearFunctionFeedback) {
   return isolate->heap()->undefined_value();
 }
 
-RUNTIME_FUNCTION(Runtime_CheckWasmWrapperElision) {
-  // This only supports the case where the function being exported
-  // calls an intermediate function, and the intermediate function
-  // calls exactly one imported function
-  HandleScope scope(isolate);
-  CHECK_EQ(args.length(), 2);
-  // It takes two parameters, the first one is the JSFunction,
-  // The second one is the type
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
-  // If type is 0, it means that it is supposed to be a direct call into a wasm
-  // function.
-  // If type is 1, it means that it is supposed to have wrappers.
-  CONVERT_ARG_HANDLE_CHECKED(Smi, type, 1);
-  Handle<Code> export_code = handle(function->code());
-  CHECK(export_code->kind() == Code::JS_TO_WASM_FUNCTION);
-  int const mask =
-      RelocInfo::ModeMask(FLAG_wasm_jit_to_native ? RelocInfo::JS_TO_WASM_CALL
-                                                  : RelocInfo::CODE_TARGET);
-  // check the type of the $export_fct
-  wasm::WasmCode* export_fct = nullptr;
-  Handle<Code> export_fct_handle;
-  wasm::WasmCode* intermediate_fct = nullptr;
-  Handle<Code> intermediate_fct_handle;
-
-  int count = 0;
-  for (RelocIterator it(*export_code, mask); !it.done(); it.next()) {
-    RelocInfo* rinfo = it.rinfo();
-    Address target_address = FLAG_wasm_jit_to_native
-                                 ? rinfo->js_to_wasm_address()
-                                 : rinfo->target_address();
-    if (FLAG_wasm_jit_to_native) {
-      wasm::WasmCode* target =
-          isolate->wasm_engine()->code_manager()->LookupCode(target_address);
-      if (target->kind() == wasm::WasmCode::kFunction) {
-        ++count;
-        export_fct = target;
-      }
-    } else {
-      Code* target = Code::GetCodeFromTargetAddress(target_address);
-      if (target->kind() == Code::WASM_FUNCTION) {
-        ++count;
-        export_fct_handle = handle(target);
-      }
-    }
-  }
-  CHECK_EQ(count, 1);
-  // check the type of the intermediate_fct
-  count = 0;
-  if (FLAG_wasm_jit_to_native) {
-    for (RelocIterator it(export_fct->instructions(), export_fct->reloc_info(),
-                          export_fct->constant_pool(),
-                          RelocInfo::ModeMask(RelocInfo::WASM_CALL));
-         !it.done(); it.next()) {
-      RelocInfo* rinfo = it.rinfo();
-      Address target_address = rinfo->target_address();
-      wasm::WasmCode* target =
-          isolate->wasm_engine()->code_manager()->LookupCode(target_address);
-      if (target->kind() == wasm::WasmCode::kFunction) {
-        ++count;
-        intermediate_fct = target;
-      }
-    }
-  } else {
-    count = 0;
-    for (RelocIterator it(*export_fct_handle, mask); !it.done(); it.next()) {
-      RelocInfo* rinfo = it.rinfo();
-      Address target_address = rinfo->target_address();
-      Code* target = Code::GetCodeFromTargetAddress(target_address);
-      if (target->kind() == Code::WASM_FUNCTION) {
-        ++count;
-        intermediate_fct_handle = handle(target);
-      }
-    }
-  }
-  CHECK_EQ(count, 1);
-  // Check the type of the imported exported function, it should be also a wasm
-  // function in our case.
-  CHECK(type->value() == 0 || type->value() == 1);
-
-  count = 0;
-  if (FLAG_wasm_jit_to_native) {
-    wasm::WasmCode::Kind target_kind = type->value() == 0
-                                           ? wasm::WasmCode::kWasmToWasmWrapper
-                                           : wasm::WasmCode::kWasmToJsWrapper;
-    for (RelocIterator it(intermediate_fct->instructions(),
-                          intermediate_fct->reloc_info(),
-                          intermediate_fct->constant_pool(),
-                          RelocInfo::ModeMask(RelocInfo::WASM_CALL));
-         !it.done(); it.next()) {
-      RelocInfo* rinfo = it.rinfo();
-      Address target_address = rinfo->target_address();
-      wasm::WasmCode* target =
-          isolate->wasm_engine()->code_manager()->LookupCode(target_address);
-      if (target->kind() == target_kind) {
-        ++count;
-      }
-    }
-  } else {
-    Code::Kind target_kind = type->value() == 0 ? Code::WASM_TO_WASM_FUNCTION
-                                                : Code::WASM_TO_JS_FUNCTION;
-    count = 0;
-    for (RelocIterator it(*intermediate_fct_handle, mask); !it.done();
-         it.next()) {
-      RelocInfo* rinfo = it.rinfo();
-      Address target_address = rinfo->target_address();
-      Code* target = Code::GetCodeFromTargetAddress(target_address);
-      if (target->kind() == target_kind) {
-        ++count;
-      }
-    }
-  }
-  CHECK_LE(count, 1);
-  return isolate->heap()->ToBoolean(count == 1);
-}
-
 RUNTIME_FUNCTION(Runtime_SetWasmCompileControls) {
   HandleScope scope(isolate);
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
@@ -757,6 +626,18 @@ RUNTIME_FUNCTION(Runtime_SetFlags) {
   return isolate->heap()->undefined_value();
 }
 
+RUNTIME_FUNCTION(Runtime_SetForceSlowPath) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_CHECKED(Object, arg, 0);
+  if (arg->IsTrue(isolate)) {
+    isolate->set_force_slow_path(true);
+  } else {
+    DCHECK(arg->IsFalse(isolate));
+    isolate->set_force_slow_path(false);
+  }
+  return isolate->heap()->undefined_value();
+}
 
 RUNTIME_FUNCTION(Runtime_Abort) {
   SealHandleScope shs(isolate);
@@ -774,6 +655,10 @@ RUNTIME_FUNCTION(Runtime_AbortJS) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, message, 0);
+  if (FLAG_disable_abortjs) {
+    base::OS::PrintError("[disabled] abort: %s\n", message->ToCString().get());
+    return nullptr;
+  }
   base::OS::PrintError("abort: %s\n", message->ToCString().get());
   isolate->PrintStack(stderr);
   base::OS::Abort();
@@ -845,31 +730,6 @@ RUNTIME_FUNCTION(Runtime_TraceExit) {
   return obj;  // return TOS
 }
 
-RUNTIME_FUNCTION(Runtime_GetExceptionDetails) {
-  HandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSObject, exception_obj, 0);
-
-  Factory* factory = isolate->factory();
-  Handle<JSMessageObject> message_obj =
-      isolate->CreateMessage(exception_obj, nullptr);
-
-  Handle<JSObject> message = factory->NewJSObject(isolate->object_function());
-
-  Handle<String> key;
-  Handle<Object> value;
-
-  key = factory->NewStringFromAsciiChecked("start_pos");
-  value = handle(Smi::FromInt(message_obj->start_position()), isolate);
-  JSObject::SetProperty(message, key, value, LanguageMode::kStrict).Assert();
-
-  key = factory->NewStringFromAsciiChecked("end_pos");
-  value = handle(Smi::FromInt(message_obj->end_position()), isolate);
-  JSObject::SetProperty(message, key, value, LanguageMode::kStrict).Assert();
-
-  return *message;
-}
-
 RUNTIME_FUNCTION(Runtime_HaveSameMap) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(2, args.length());
@@ -894,8 +754,8 @@ RUNTIME_FUNCTION(Runtime_IsAsmWasmCode) {
     // Doesn't have wasm data.
     return isolate->heap()->false_value();
   }
-  if (function->shared()->code() !=
-      isolate->builtins()->builtin(Builtins::kInstantiateAsmJs)) {
+  if (function->shared()->HasBuiltinId() &&
+      function->shared()->builtin_id() == Builtins::kInstantiateAsmJs) {
     // Hasn't been compiled yet.
     return isolate->heap()->false_value();
   }
@@ -964,7 +824,6 @@ ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(DoubleElements)
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(HoleyElements)
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(DictionaryElements)
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(SloppyArgumentsElements)
-ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(FixedTypedArrayElements)
 // Properties test sitting with elements tests - not fooling anyone.
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(FastProperties)
 
@@ -985,7 +844,7 @@ TYPED_ARRAYS(FIXED_TYPED_ARRAYS_CHECK_RUNTIME_FUNCTION)
 RUNTIME_FUNCTION(Runtime_SpeciesProtector) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(0, args.length());
-  return isolate->heap()->ToBoolean(isolate->IsArraySpeciesLookupChainIntact());
+  return isolate->heap()->ToBoolean(isolate->IsSpeciesLookupChainIntact());
 }
 
 // Take a compiled wasm module, serialize it and copy the buffer into an array
@@ -1119,16 +978,14 @@ RUNTIME_FUNCTION(Runtime_WasmTraceMemory) {
   DCHECK(it.is_wasm());
   WasmCompiledFrame* frame = WasmCompiledFrame::cast(it.frame());
 
-  uint8_t* mem_start = reinterpret_cast<uint8_t*>(frame->wasm_instance()
-                                                      ->memory_object()
-                                                      ->array_buffer()
-                                                      ->allocation_base());
+  uint8_t* mem_start = reinterpret_cast<uint8_t*>(
+      frame->wasm_instance()->memory_object()->array_buffer()->backing_store());
   int func_index = frame->function_index();
   int pos = frame->position();
   // TODO(titzer): eliminate dependency on WasmModule definition here.
   int func_start =
       frame->wasm_instance()->module()->functions[func_index].code.offset();
-  wasm::ExecutionEngine eng = frame->wasm_code().is_liftoff()
+  wasm::ExecutionEngine eng = frame->wasm_code()->is_liftoff()
                                   ? wasm::ExecutionEngine::kLiftoff
                                   : wasm::ExecutionEngine::kTurbofan;
   wasm::TraceMemoryOperation(eng, info, func_index, pos - func_start,
@@ -1141,15 +998,9 @@ RUNTIME_FUNCTION(Runtime_IsLiftoffFunction) {
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
   CHECK(WasmExportedFunction::IsWasmExportedFunction(*function));
-  WasmCodeWrapper wrapper =
+  wasm::WasmCode* wasm_code =
       WasmExportedFunction::cast(*function)->GetWasmCode();
-  if (!wrapper.IsCodeObject()) {
-    const wasm::WasmCode* wasm_code = wrapper.GetWasmCode();
-    return isolate->heap()->ToBoolean(wasm_code->is_liftoff());
-  } else {
-    Handle<Code> wasm_code = wrapper.GetCode();
-    return isolate->heap()->ToBoolean(!wasm_code->is_turbofanned());
-  }
+  return isolate->heap()->ToBoolean(wasm_code->is_liftoff());
 }
 
 RUNTIME_FUNCTION(Runtime_CompleteInobjectSlackTracking) {
diff --git a/deps/v8/src/runtime/runtime-typedarray.cc b/deps/v8/src/runtime/runtime-typedarray.cc
index 85fb2d21739..f8fd3cc6220 100644
--- a/deps/v8/src/runtime/runtime-typedarray.cc
+++ b/deps/v8/src/runtime/runtime-typedarray.cc
@@ -14,14 +14,6 @@
 namespace v8 {
 namespace internal {
 
-RUNTIME_FUNCTION(Runtime_ArrayBufferGetByteLength) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_CHECKED(JSArrayBuffer, holder, 0);
-  return holder->byte_length();
-}
-
-
 RUNTIME_FUNCTION(Runtime_ArrayBufferNeuter) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -56,7 +48,7 @@ RUNTIME_FUNCTION(Runtime_TypedArrayCopyElements) {
   HandleScope scope(isolate);
   DCHECK_EQ(3, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSTypedArray, target, 0);
-  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, source, 1);
+  CONVERT_ARG_HANDLE_CHECKED(Object, source, 1);
   CONVERT_NUMBER_ARG_HANDLE_CHECKED(length_obj, 2);
 
   size_t length;
@@ -66,19 +58,12 @@ RUNTIME_FUNCTION(Runtime_TypedArrayCopyElements) {
   return accessor->CopyElements(source, target, length);
 }
 
-#define BUFFER_VIEW_GETTER(Type, getter, accessor)   \
-  RUNTIME_FUNCTION(Runtime_##Type##Get##getter) {    \
-    HandleScope scope(isolate);                      \
-    DCHECK_EQ(1, args.length());                     \
-    CONVERT_ARG_HANDLE_CHECKED(JS##Type, holder, 0); \
-    return holder->accessor();                       \
-  }
-
-BUFFER_VIEW_GETTER(ArrayBufferView, ByteLength, byte_length)
-BUFFER_VIEW_GETTER(ArrayBufferView, ByteOffset, byte_offset)
-BUFFER_VIEW_GETTER(TypedArray, Length, length)
-
-#undef BUFFER_VIEW_GETTER
+RUNTIME_FUNCTION(Runtime_TypedArrayGetLength) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSTypedArray, holder, 0);
+  return holder->length();
+}
 
 RUNTIME_FUNCTION(Runtime_ArrayBufferViewWasNeutered) {
   HandleScope scope(isolate);
@@ -162,58 +147,6 @@ RUNTIME_FUNCTION(Runtime_IsTypedArray) {
   return isolate->heap()->ToBoolean(args[0]->IsJSTypedArray());
 }
 
-RUNTIME_FUNCTION(Runtime_IsSharedTypedArray) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  return isolate->heap()->ToBoolean(
-      args[0]->IsJSTypedArray() &&
-      JSTypedArray::cast(args[0])->GetBuffer()->is_shared());
-}
-
-
-RUNTIME_FUNCTION(Runtime_IsSharedIntegerTypedArray) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  if (!args[0]->IsJSTypedArray()) {
-    return isolate->heap()->false_value();
-  }
-
-  Handle<JSTypedArray> obj(JSTypedArray::cast(args[0]));
-  return isolate->heap()->ToBoolean(obj->GetBuffer()->is_shared() &&
-                                    obj->type() != kExternalFloat32Array &&
-                                    obj->type() != kExternalFloat64Array &&
-                                    obj->type() != kExternalUint8ClampedArray);
-}
-
-
-RUNTIME_FUNCTION(Runtime_IsSharedInteger32TypedArray) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  if (!args[0]->IsJSTypedArray()) {
-    return isolate->heap()->false_value();
-  }
-
-  Handle<JSTypedArray> obj(JSTypedArray::cast(args[0]));
-  return isolate->heap()->ToBoolean(obj->GetBuffer()->is_shared() &&
-                                    obj->type() == kExternalInt32Array);
-}
-
-RUNTIME_FUNCTION(Runtime_TypedArraySpeciesCreateByLength) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(args.length(), 2);
-  Handle<JSTypedArray> exemplar = args.at<JSTypedArray>(0);
-  Handle<Object> length = args.at(1);
-  int argc = 1;
-  ScopedVector<Handle<Object>> argv(argc);
-  argv[0] = length;
-  Handle<JSTypedArray> result_array;
-  // TODO(tebbi): Pass correct method name.
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, result_array,
-      JSTypedArray::SpeciesCreate(isolate, exemplar, argc, argv.start(), ""));
-  return *result_array;
-}
-
 // 22.2.3.23 %TypedArray%.prototype.set ( overloaded [ , offset ] )
 RUNTIME_FUNCTION(Runtime_TypedArraySet) {
   HandleScope scope(isolate);
diff --git a/deps/v8/src/runtime/runtime-wasm.cc b/deps/v8/src/runtime/runtime-wasm.cc
index 0b002d0ec67..06e0dfe6c86 100644
--- a/deps/v8/src/runtime/runtime-wasm.cc
+++ b/deps/v8/src/runtime/runtime-wasm.cc
@@ -31,14 +31,8 @@ WasmInstanceObject* GetWasmInstanceOnStackTop(Isolate* isolate) {
   const Address entry = Isolate::c_entry_fp(isolate->thread_local_top());
   Address pc =
       Memory::Address_at(entry + StandardFrameConstants::kCallerPCOffset);
-  WasmInstanceObject* owning_instance = nullptr;
-  if (FLAG_wasm_jit_to_native) {
-    owning_instance = WasmInstanceObject::GetOwningInstance(
-        isolate->wasm_engine()->code_manager()->LookupCode(pc));
-  } else {
-    owning_instance = WasmInstanceObject::GetOwningInstanceGC(
-        isolate->inner_pointer_to_code_cache()->GetCacheEntry(pc)->code);
-  }
+  WasmInstanceObject* owning_instance = WasmInstanceObject::GetOwningInstance(
+      isolate->wasm_engine()->code_manager()->LookupCode(pc));
   CHECK_NOT_NULL(owning_instance);
   return owning_instance;
 }
@@ -82,8 +76,8 @@ RUNTIME_FUNCTION(Runtime_WasmGrowMemory) {
   DCHECK_NULL(isolate->context());
   isolate->set_context(instance->compiled_module()->native_context());
 
-  return *isolate->factory()->NewNumberFromInt(
-      WasmInstanceObject::GrowMemory(isolate, instance, delta_pages));
+  return *isolate->factory()->NewNumberFromInt(WasmMemoryObject::Grow(
+      isolate, handle(instance->memory_object(), isolate), delta_pages));
 }
 
 RUNTIME_FUNCTION(Runtime_ThrowWasmError) {
@@ -223,7 +217,7 @@ RUNTIME_FUNCTION(Runtime_WasmExceptionSetElement) {
         CHECK_LT(index, Smi::ToInt(values->length()));
         CONVERT_SMI_ARG_CHECKED(value, 1);
         auto* vals =
-            reinterpret_cast<uint16_t*>(values->GetBuffer()->allocation_base());
+            reinterpret_cast<uint16_t*>(values->GetBuffer()->backing_store());
         vals[index] = static_cast<uint16_t>(value);
       }
     }
@@ -296,15 +290,11 @@ RUNTIME_FUNCTION(Runtime_WasmCompileLazy) {
   DCHECK_EQ(0, args.length());
   HandleScope scope(isolate);
 
-  if (FLAG_wasm_jit_to_native) {
-    Address new_func = wasm::CompileLazy(isolate);
-    // The alternative to this is having 2 lazy compile builtins. The builtins
-    // are part of the snapshot, so the flag has no impact on the codegen there.
-    return reinterpret_cast<Object*>(new_func - Code::kHeaderSize +
-                                     kHeapObjectTag);
-  } else {
-    return *wasm::CompileLazyOnGCHeap(isolate);
-  }
+  Address new_func = wasm::CompileLazy(isolate);
+  // The alternative to this is having 2 lazy compile builtins. The builtins
+  // are part of the snapshot, so the flag has no impact on the codegen there.
+  return reinterpret_cast<Object*>(new_func - Code::kHeaderSize +
+                                   kHeapObjectTag);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/runtime/runtime.cc b/deps/v8/src/runtime/runtime.cc
index 26880cdafa4..3ae82d41c53 100644
--- a/deps/v8/src/runtime/runtime.cc
+++ b/deps/v8/src/runtime/runtime.cc
@@ -98,6 +98,39 @@ void InitializeIntrinsicFunctionNames() {
 
 }  // namespace
 
+bool Runtime::IsNonReturning(FunctionId id) {
+  switch (id) {
+    case Runtime::kThrowUnsupportedSuperError:
+    case Runtime::kThrowConstructorNonCallableError:
+    case Runtime::kThrowStaticPrototypeError:
+    case Runtime::kThrowSuperAlreadyCalledError:
+    case Runtime::kThrowSuperNotCalled:
+    case Runtime::kReThrow:
+    case Runtime::kThrow:
+    case Runtime::kThrowApplyNonFunction:
+    case Runtime::kThrowCalledNonCallable:
+    case Runtime::kThrowConstructedNonConstructable:
+    case Runtime::kThrowConstructorReturnedNonObject:
+    case Runtime::kThrowInvalidStringLength:
+    case Runtime::kThrowInvalidTypedArrayAlignment:
+    case Runtime::kThrowIteratorResultNotAnObject:
+    case Runtime::kThrowThrowMethodMissing:
+    case Runtime::kThrowSymbolIteratorInvalid:
+    case Runtime::kThrowNotConstructor:
+    case Runtime::kThrowRangeError:
+    case Runtime::kThrowReferenceError:
+    case Runtime::kThrowStackOverflow:
+    case Runtime::kThrowSymbolAsyncIteratorInvalid:
+    case Runtime::kThrowTypeError:
+    case Runtime::kThrowConstAssignError:
+    case Runtime::kThrowWasmError:
+    case Runtime::kThrowWasmStackOverflow:
+      return true;
+    default:
+      return false;
+  }
+}
+
 const Runtime::Function* Runtime::FunctionForName(const unsigned char* name,
                                                   int length) {
   base::CallOnce(&initialize_function_name_map_once,
diff --git a/deps/v8/src/runtime/runtime.h b/deps/v8/src/runtime/runtime.h
index d05f4984c6a..efd9e2c873c 100644
--- a/deps/v8/src/runtime/runtime.h
+++ b/deps/v8/src/runtime/runtime.h
@@ -36,37 +36,32 @@ namespace internal {
 // A variable number of arguments is specified by a -1, additional restrictions
 // are specified by inline comments
 
-#define FOR_EACH_INTRINSIC_ARRAY(F)      \
-  F(TransitionElementsKind, 2, 1)        \
-  F(RemoveArrayHoles, 2, 1)              \
-  F(MoveArrayContents, 2, 1)             \
-  F(EstimateNumberOfElements, 1, 1)      \
-  F(GetArrayKeys, 2, 1)                  \
-  F(TrySliceSimpleNonFastElements, 3, 1) \
-  F(NewArray, -1 /* >= 3 */, 1)          \
-  F(FunctionBind, -1, 1)                 \
-  F(NormalizeElements, 1, 1)             \
-  F(GrowArrayElements, 2, 1)             \
-  F(HasComplexElements, 1, 1)            \
-  F(IsArray, 1, 1)                       \
-  F(ArrayIsArray, 1, 1)                  \
-  F(ArraySpeciesConstructor, 1, 1)       \
-  F(ArrayIncludes_Slow, 3, 1)            \
-  F(ArrayIndexOf, 3, 1)                  \
-  F(SpreadIterablePrepare, 1, 1)
-
-#define FOR_EACH_INTRINSIC_ATOMICS(F)           \
-  F(ThrowNotIntegerSharedTypedArrayError, 1, 1) \
-  F(ThrowNotInt32SharedTypedArrayError, 1, 1)   \
-  F(ThrowInvalidAtomicAccessIndexError, 0, 1)   \
-  F(AtomicsExchange, 3, 1)                      \
-  F(AtomicsCompareExchange, 4, 1)               \
-  F(AtomicsAdd, 3, 1)                           \
-  F(AtomicsSub, 3, 1)                           \
-  F(AtomicsAnd, 3, 1)                           \
-  F(AtomicsOr, 3, 1)                            \
-  F(AtomicsXor, 3, 1)                           \
-  F(AtomicsNumWaitersForTesting, 2, 1)          \
+#define FOR_EACH_INTRINSIC_ARRAY(F) \
+  F(ArrayIncludes_Slow, 3, 1)       \
+  F(ArrayIndexOf, 3, 1)             \
+  F(ArrayIsArray, 1, 1)             \
+  F(ArraySpeciesConstructor, 1, 1)  \
+  F(EstimateNumberOfElements, 1, 1) \
+  F(GetArrayKeys, 2, 1)             \
+  F(GrowArrayElements, 2, 1)        \
+  F(HasComplexElements, 1, 1)       \
+  F(IsArray, 1, 1)                  \
+  F(MoveArrayContents, 2, 1)        \
+  F(NewArray, -1 /* >= 3 */, 1)     \
+  F(NormalizeElements, 1, 1)        \
+  F(RemoveArrayHoles, 2, 1)         \
+  F(TransitionElementsKind, 2, 1)   \
+  F(TrySliceSimpleNonFastElements, 3, 1)
+
+#define FOR_EACH_INTRINSIC_ATOMICS(F)  \
+  F(AtomicsAdd, 3, 1)                  \
+  F(AtomicsAnd, 3, 1)                  \
+  F(AtomicsCompareExchange, 4, 1)      \
+  F(AtomicsExchange, 3, 1)             \
+  F(AtomicsNumWaitersForTesting, 2, 1) \
+  F(AtomicsOr, 3, 1)                   \
+  F(AtomicsSub, 3, 1)                  \
+  F(AtomicsXor, 3, 1)                  \
   F(SetAllowAtomicsWait, 1, 1)
 
 #define FOR_EACH_INTRINSIC_BIGINT(F) \
@@ -78,125 +73,111 @@ namespace internal {
   F(BigIntEqualToString, 2, 1)       \
   F(BigIntToBoolean, 1, 1)           \
   F(BigIntToNumber, 1, 1)            \
-  F(BigIntUnaryOp, 2, 1)
+  F(BigIntUnaryOp, 2, 1)             \
+  F(ToBigInt, 1, 1)
 
 #define FOR_EACH_INTRINSIC_CLASSES(F)       \
-  F(ThrowUnsupportedSuperError, 0, 1)       \
-  F(ThrowConstructorNonCallableError, 1, 1) \
-  F(ThrowStaticPrototypeError, 0, 1)        \
-  F(ThrowSuperAlreadyCalledError, 0, 1)     \
-  F(ThrowSuperNotCalled, 0, 1)              \
-  F(ThrowNotSuperConstructor, 2, 1)         \
-  F(HomeObjectSymbol, 0, 1)                 \
   F(DefineClass, -1 /* >= 3 */, 1)          \
+  F(GetSuperConstructor, 1, 1)              \
+  F(HomeObjectSymbol, 0, 1)                 \
   F(LoadFromSuper, 3, 1)                    \
   F(LoadKeyedFromSuper, 3, 1)               \
-  F(StoreToSuper_Strict, 4, 1)              \
-  F(StoreToSuper_Sloppy, 4, 1)              \
-  F(StoreKeyedToSuper_Strict, 4, 1)         \
   F(StoreKeyedToSuper_Sloppy, 4, 1)         \
-  F(GetSuperConstructor, 1, 1)
+  F(StoreKeyedToSuper_Strict, 4, 1)         \
+  F(StoreToSuper_Sloppy, 4, 1)              \
+  F(StoreToSuper_Strict, 4, 1)              \
+  F(ThrowConstructorNonCallableError, 1, 1) \
+  F(ThrowNotSuperConstructor, 2, 1)         \
+  F(ThrowStaticPrototypeError, 0, 1)        \
+  F(ThrowSuperAlreadyCalledError, 0, 1)     \
+  F(ThrowSuperNotCalled, 0, 1)              \
+  F(ThrowUnsupportedSuperError, 0, 1)
 
 #define FOR_EACH_INTRINSIC_COLLECTIONS(F) \
-  F(TheHole, 0, 1)                        \
-  F(GenericHash, 1, 1)                    \
-  F(GetExistingHash, 1, 1)                \
-  F(SetGrow, 1, 1)                        \
-  F(SetShrink, 1, 1)                      \
-  F(SetIteratorClone, 1, 1)               \
-  F(MapShrink, 1, 1)                      \
-  F(MapGrow, 1, 1)                        \
-  F(MapIteratorClone, 1, 1)               \
   F(GetWeakMapEntries, 2, 1)              \
-  F(WeakCollectionInitialize, 1, 1)       \
-  F(WeakCollectionDelete, 3, 1)           \
-  F(WeakCollectionSet, 4, 1)              \
   F(GetWeakSetValues, 2, 1)               \
   F(IsJSMap, 1, 1)                        \
   F(IsJSSet, 1, 1)                        \
   F(IsJSWeakMap, 1, 1)                    \
-  F(IsJSWeakSet, 1, 1)
+  F(IsJSWeakSet, 1, 1)                    \
+  F(MapGrow, 1, 1)                        \
+  F(MapIteratorClone, 1, 1)               \
+  F(MapShrink, 1, 1)                      \
+  F(SetGrow, 1, 1)                        \
+  F(SetIteratorClone, 1, 1)               \
+  F(SetShrink, 1, 1)                      \
+  F(TheHole, 0, 1)                        \
+  F(WeakCollectionDelete, 3, 1)           \
+  F(WeakCollectionSet, 4, 1)
 
 #define FOR_EACH_INTRINSIC_COMPILER(F)    \
+  F(CompileForOnStackReplacement, 1, 1)   \
   F(CompileLazy, 1, 1)                    \
   F(CompileOptimized_Concurrent, 1, 1)    \
-  F(FunctionFirstExecution, 1, 1)         \
   F(CompileOptimized_NotConcurrent, 1, 1) \
   F(EvictOptimizedCodeSlot, 1, 1)         \
+  F(FunctionFirstExecution, 1, 1)         \
+  F(InstantiateAsmJs, 4, 1)               \
   F(NotifyDeoptimized, 0, 1)              \
-  F(CompileForOnStackReplacement, 1, 1)   \
-  F(ResolvePossiblyDirectEval, 6, 1)      \
-  F(InstantiateAsmJs, 4, 1)
+  F(ResolvePossiblyDirectEval, 6, 1)
 
 #define FOR_EACH_INTRINSIC_DATE(F) \
-  F(IsDate, 1, 1)                  \
   F(DateCurrentTime, 0, 1)         \
-  F(ThrowNotDateError, 0, 1)
+  F(IsDate, 1, 1)
 
 #define FOR_EACH_INTRINSIC_DEBUG(F)             \
-  F(HandleDebuggerStatement, 0, 1)              \
-  F(SetDebugEventListener, 2, 1)                \
-  F(ScheduleBreak, 0, 1)                        \
-  F(DebugGetInternalProperties, 1, 1)           \
-  F(DebugGetPropertyDetails, 2, 1)              \
-  F(DebugGetProperty, 2, 1)                     \
-  F(DebugPropertyKindFromDetails, 1, 1)         \
-  F(DebugPropertyAttributesFromDetails, 1, 1)   \
-  F(CheckExecutionState, 1, 1)                  \
-  F(GetFrameCount, 1, 1)                        \
-  F(GetFrameDetails, 2, 1)                      \
-  F(GetScopeCount, 2, 1)                        \
-  F(GetScopeDetails, 4, 1)                      \
-  F(GetAllScopesDetails, 4, 1)                  \
-  F(GetFunctionScopeCount, 1, 1)                \
-  F(GetFunctionScopeDetails, 2, 1)              \
-  F(GetGeneratorScopeCount, 1, 1)               \
-  F(GetGeneratorScopeDetails, 2, 1)             \
-  F(SetScopeVariableValue, 6, 1)                \
-  F(DebugPrintScopes, 0, 1)                     \
-  F(SetBreakPointsActive, 1, 1)                 \
-  F(GetBreakLocations, 1, 1)                    \
-  F(SetFunctionBreakPoint, 3, 1)                \
-  F(SetScriptBreakPoint, 3, 1)                  \
-  F(ClearBreakPoint, 1, 1)                      \
   F(ChangeBreakOnException, 2, 1)               \
-  F(IsBreakOnException, 1, 1)                   \
-  F(PrepareStep, 2, 1)                          \
+  F(CheckExecutionState, 1, 1)                  \
   F(ClearStepping, 0, 1)                        \
+  F(CollectGarbage, 1, 1)                       \
+  F(DebugAsyncFunctionPromiseCreated, 1, 1)     \
+  F(DebugBreakAtEntry, 1, 1)                    \
+  F(DebugCollectCoverage, 0, 1)                 \
+  F(DebugConstructedBy, 2, 1)                   \
   F(DebugEvaluate, 5, 1)                        \
   F(DebugEvaluateGlobal, 2, 1)                  \
+  F(DebugGetInternalProperties, 1, 1)           \
   F(DebugGetLoadedScripts, 0, 1)                \
-  F(DebugReferencedBy, 3, 1)                    \
-  F(DebugConstructedBy, 2, 1)                   \
+  F(DebugGetProperty, 2, 1)                     \
+  F(DebugGetPropertyDetails, 2, 1)              \
   F(DebugGetPrototype, 1, 1)                    \
+  F(DebugIsActive, 0, 1)                        \
+  F(DebugOnFunctionCall, 1, 1)                  \
+  F(DebugPopPromise, 0, 1)                      \
+  F(DebugPrepareStepInSuspendedGenerator, 0, 1) \
+  F(DebugPropertyAttributesFromDetails, 1, 1)   \
+  F(DebugPropertyKindFromDetails, 1, 1)         \
+  F(DebugPushPromise, 1, 1)                     \
+  F(DebugReferencedBy, 3, 1)                    \
   F(DebugSetScriptSource, 2, 1)                 \
-  F(FunctionGetInferredName, 1, 1)              \
+  F(DebugToggleBlockCoverage, 1, 1)             \
+  F(DebugTogglePreciseCoverage, 1, 1)           \
   F(FunctionGetDebugName, 1, 1)                 \
+  F(FunctionGetInferredName, 1, 1)              \
+  F(GetAllScopesDetails, 4, 1)                  \
+  F(GetBreakLocations, 1, 1)                    \
   F(GetDebugContext, 0, 1)                      \
-  F(CollectGarbage, 1, 1)                       \
+  F(GetFrameCount, 1, 1)                        \
+  F(GetFrameDetails, 2, 1)                      \
+  F(GetFunctionScopeCount, 1, 1)                \
+  F(GetFunctionScopeDetails, 2, 1)              \
+  F(GetGeneratorScopeCount, 1, 1)               \
+  F(GetGeneratorScopeDetails, 2, 1)             \
   F(GetHeapUsage, 0, 1)                         \
+  F(GetScopeCount, 2, 1)                        \
+  F(GetScopeDetails, 4, 1)                      \
   F(GetScript, 1, 1)                            \
+  F(HandleDebuggerStatement, 0, 1)              \
+  F(IncBlockCounter, 2, 1)                      \
+  F(IsBreakOnException, 1, 1)                   \
+  F(PrepareStep, 2, 1)                          \
+  F(ScheduleBreak, 0, 1)                        \
   F(ScriptLineCount, 1, 1)                      \
-  F(ScriptLineStartPosition, 2, 1)              \
-  F(ScriptLineEndPosition, 2, 1)                \
-  F(ScriptLocationFromLine, 4, 1)               \
   F(ScriptLocationFromLine2, 4, 1)              \
-  F(ScriptPositionInfo, 3, 1)                   \
+  F(ScriptLocationFromLine, 4, 1)               \
   F(ScriptPositionInfo2, 3, 1)                  \
-  F(ScriptSourceLine, 2, 1)                     \
-  F(DebugOnFunctionCall, 1, 1)                  \
-  F(DebugPrepareStepInSuspendedGenerator, 0, 1) \
-  F(DebugRecordGenerator, 1, 1)                 \
-  F(DebugPushPromise, 1, 1)                     \
-  F(DebugPopPromise, 0, 1)                      \
-  F(DebugPromiseReject, 2, 1)                   \
-  F(DebugAsyncFunctionPromiseCreated, 1, 1)     \
-  F(DebugIsActive, 0, 1)                        \
-  F(DebugBreakInOptimizedCode, 0, 1)            \
-  F(DebugCollectCoverage, 0, 1)                 \
-  F(DebugTogglePreciseCoverage, 1, 1)           \
-  F(DebugToggleBlockCoverage, 1, 1)             \
-  F(IncBlockCounter, 2, 1)
+  F(ScriptPositionInfo, 3, 1)                   \
+  F(SetScopeVariableValue, 6, 1)
 
 #define FOR_EACH_INTRINSIC_ERROR(F) F(ErrorToString, 1, 1)
 
@@ -222,68 +203,69 @@ namespace internal {
 #define FOR_EACH_INTRINSIC_INTERPRETER(F)          \
   FOR_EACH_INTRINSIC_INTERPRETER_TRACE(F)          \
   FOR_EACH_INTRINSIC_INTERPRETER_TRACE_FEEDBACK(F) \
-  F(InterpreterDeserializeLazy, 2, 1)              \
-  F(InterpreterNewClosure, 4, 1)
+  F(InterpreterDeserializeLazy, 2, 1)
 
 #define FOR_EACH_INTRINSIC_FUNCTION(F)     \
+  F(Call, -1 /* >= 2 */, 1)                \
+  F(FunctionGetContextData, 1, 1)          \
   F(FunctionGetName, 1, 1)                 \
   F(FunctionGetScript, 1, 1)               \
   F(FunctionGetScriptId, 1, 1)             \
-  F(FunctionGetSourceCode, 1, 1)           \
   F(FunctionGetScriptSourcePosition, 1, 1) \
-  F(FunctionGetContextData, 1, 1)          \
-  F(FunctionSetLength, 2, 1)               \
+  F(FunctionGetSourceCode, 1, 1)           \
   F(FunctionIsAPIFunction, 1, 1)           \
-  F(SetCode, 2, 1)                         \
-  F(SetNativeFlag, 1, 1)                   \
+  F(FunctionToString, 1, 1)                \
   F(IsConstructor, 1, 1)                   \
-  F(Call, -1 /* >= 2 */, 1)                \
   F(IsFunction, 1, 1)                      \
-  F(FunctionToString, 1, 1)
-
-#define FOR_EACH_INTRINSIC_GENERATOR(F) \
-  F(CreateJSGeneratorObject, 2, 1)      \
-  F(GeneratorClose, 1, 1)               \
-  F(GeneratorGetFunction, 1, 1)         \
-  F(GeneratorGetReceiver, 1, 1)         \
-  F(GeneratorGetContext, 1, 1)          \
-  F(GeneratorGetInputOrDebugPos, 1, 1)  \
-  F(AsyncGeneratorResolve, 3, 1)        \
-  F(AsyncGeneratorReject, 2, 1)         \
-  F(AsyncGeneratorYield, 3, 1)          \
-  F(GeneratorGetContinuation, 1, 1)     \
-  F(GeneratorGetSourcePosition, 1, 1)   \
-  F(GeneratorGetResumeMode, 1, 1)       \
-  F(AsyncGeneratorHasCatchHandlerForPC, 1, 1)
+  F(SetCode, 2, 1)                         \
+  F(SetNativeFlag, 1, 1)
+
+#define FOR_EACH_INTRINSIC_GENERATOR(F)       \
+  F(AsyncFunctionAwaitCaught, 3, 1)           \
+  F(AsyncFunctionAwaitUncaught, 3, 1)         \
+  F(AsyncGeneratorAwaitCaught, 2, 1)          \
+  F(AsyncGeneratorAwaitUncaught, 2, 1)        \
+  F(AsyncGeneratorHasCatchHandlerForPC, 1, 1) \
+  F(AsyncGeneratorReject, 2, 1)               \
+  F(AsyncGeneratorResolve, 3, 1)              \
+  F(AsyncGeneratorYield, 3, 1)                \
+  F(CreateJSGeneratorObject, 2, 1)            \
+  F(GeneratorClose, 1, 1)                     \
+  F(GeneratorGetContinuation, 1, 1)           \
+  F(GeneratorGetFunction, 1, 1)               \
+  F(GeneratorGetInputOrDebugPos, 1, 1)        \
+  F(GeneratorGetReceiver, 1, 1)               \
+  F(GeneratorGetResumeMode, 1, 1)             \
+  F(GeneratorGetSourcePosition, 1, 1)
 
 #ifdef V8_INTL_SUPPORT
 #define FOR_EACH_INTRINSIC_INTL(F)           \
-  F(CanonicalizeLanguageTag, 1, 1)           \
   F(AvailableLocalesOf, 1, 1)                \
-  F(GetDefaultICULocale, 0, 1)               \
-  F(IsInitializedIntlObject, 1, 1)           \
-  F(IsInitializedIntlObjectOfType, 2, 1)     \
-  F(MarkAsInitializedIntlObjectOfType, 2, 1) \
+  F(BreakIteratorAdoptText, 2, 1)            \
+  F(BreakIteratorBreakType, 1, 1)            \
+  F(BreakIteratorCurrent, 1, 1)              \
+  F(BreakIteratorFirst, 1, 1)                \
+  F(BreakIteratorNext, 1, 1)                 \
+  F(CanonicalizeLanguageTag, 1, 1)           \
+  F(CreateBreakIterator, 3, 1)               \
+  F(CreateCollator, 3, 1)                    \
   F(CreateDateTimeFormat, 3, 1)              \
-  F(InternalDateFormat, 2, 1)                \
-  F(InternalDateFormatToParts, 2, 1)         \
   F(CreateNumberFormat, 3, 1)                \
-  F(InternalNumberFormat, 2, 1)              \
+  F(CreatePluralRules, 3, 1)                 \
   F(CurrencyDigits, 1, 1)                    \
-  F(CreateCollator, 3, 1)                    \
+  F(DateCacheVersion, 0, 1)                  \
+  F(GetDefaultICULocale, 0, 1)               \
   F(InternalCompare, 3, 1)                   \
-  F(CreatePluralRules, 3, 1)                 \
+  F(InternalDateFormat, 2, 1)                \
+  F(InternalDateFormatToParts, 2, 1)         \
+  F(InternalNumberFormat, 2, 1)              \
+  F(IsInitializedIntlObject, 1, 1)           \
+  F(IsInitializedIntlObjectOfType, 2, 1)     \
+  F(MarkAsInitializedIntlObjectOfType, 2, 1) \
   F(PluralRulesSelect, 2, 1)                 \
-  F(CreateBreakIterator, 3, 1)               \
-  F(BreakIteratorAdoptText, 2, 1)            \
-  F(BreakIteratorFirst, 1, 1)                \
-  F(BreakIteratorNext, 1, 1)                 \
-  F(BreakIteratorCurrent, 1, 1)              \
-  F(BreakIteratorBreakType, 1, 1)            \
-  F(StringToLowerCaseIntl, 1, 1)             \
-  F(StringToUpperCaseIntl, 1, 1)             \
   F(StringLocaleConvertCase, 3, 1)           \
-  F(DateCacheVersion, 0, 1)
+  F(StringToLowerCaseIntl, 1, 1)             \
+  F(StringToUpperCaseIntl, 1, 1)
 #else
 #define FOR_EACH_INTRINSIC_INTL(F)
 #endif
@@ -293,12 +275,14 @@ namespace internal {
   F(AllocateInTargetSpace, 2, 1)                                     \
   F(AllocateSeqOneByteString, 1, 1)                                  \
   F(AllocateSeqTwoByteString, 1, 1)                                  \
+  F(AllowDynamicFunction, 1, 1)                                      \
   F(CheckIsBootstrapping, 0, 1)                                      \
   F(CreateAsyncFromSyncIterator, 1, 1)                               \
   F(CreateListFromArrayLike, 1, 1)                                   \
+  F(CreateTemplateObject, 1, 1)                                      \
   F(DeserializeLazy, 1, 1)                                           \
-  F(GetAndResetRuntimeCallStats, -1 /* <= 2 */, 1)                   \
   F(ExportFromRuntime, 1, 1)                                         \
+  F(GetAndResetRuntimeCallStats, -1 /* <= 2 */, 1)                   \
   F(IncrementUseCounter, 1, 1)                                       \
   F(IncrementUseCounterConstructorReturnNonUndefinedPrimitive, 0, 1) \
   F(InstallToContext, 1, 1)                                          \
@@ -309,56 +293,47 @@ namespace internal {
   F(NewTypeError, 2, 1)                                              \
   F(OrdinaryHasInstance, 2, 1)                                       \
   F(PromoteScheduledException, 0, 1)                                 \
+  F(ReportMessage, 1, 1)                                             \
   F(ReThrow, 1, 1)                                                   \
+  F(RunMicrotaskCallback, 2, 1)                                      \
   F(RunMicrotasks, 0, 1)                                             \
   F(StackGuard, 0, 1)                                                \
   F(Throw, 1, 1)                                                     \
   F(ThrowApplyNonFunction, 1, 1)                                     \
-  F(ThrowCannotConvertToPrimitive, 0, 1)                             \
   F(ThrowCalledNonCallable, 1, 1)                                    \
-  F(ThrowCalledOnNullOrUndefined, 1, 1)                              \
   F(ThrowConstructedNonConstructable, 1, 1)                          \
   F(ThrowConstructorReturnedNonObject, 0, 1)                         \
-  F(ThrowGeneratorRunning, 0, 1)                                     \
-  F(ThrowIncompatibleMethodReceiver, 2, 1)                           \
-  F(ThrowInvalidHint, 1, 1)                                          \
   F(ThrowInvalidStringLength, 0, 1)                                  \
   F(ThrowInvalidTypedArrayAlignment, 2, 1)                           \
   F(ThrowIteratorResultNotAnObject, 1, 1)                            \
-  F(ThrowThrowMethodMissing, 0, 1)                                   \
-  F(ThrowSymbolIteratorInvalid, 0, 1)                                \
-  F(ThrowNonCallableInInstanceOfCheck, 0, 1)                         \
-  F(ThrowNonObjectInInstanceOfCheck, 0, 1)                           \
   F(ThrowNotConstructor, 1, 1)                                       \
   F(ThrowRangeError, -1 /* >= 1 */, 1)                               \
   F(ThrowReferenceError, 1, 1)                                       \
   F(ThrowStackOverflow, 0, 1)                                        \
   F(ThrowSymbolAsyncIteratorInvalid, 0, 1)                           \
+  F(ThrowSymbolIteratorInvalid, 0, 1)                                \
+  F(ThrowThrowMethodMissing, 0, 1)                                   \
   F(ThrowTypeError, -1 /* >= 1 */, 1)                                \
-  F(ThrowUndefinedOrNullToObject, 1, 1)                              \
   F(Typeof, 1, 1)                                                    \
-  F(UnwindAndFindExceptionHandler, 0, 1)                             \
-  F(AllowDynamicFunction, 1, 1)                                      \
-  F(GetTemplateObject, 1, 1)                                         \
-  F(ReportMessage, 1, 1)
+  F(UnwindAndFindExceptionHandler, 0, 1)
 
 #define FOR_EACH_INTRINSIC_LITERALS(F) \
-  F(CreateRegExpLiteral, 4, 1)         \
+  F(CreateArrayLiteral, 4, 1)          \
   F(CreateObjectLiteral, 4, 1)         \
-  F(CreateArrayLiteral, 4, 1)
+  F(CreateRegExpLiteral, 4, 1)
 
 #define FOR_EACH_INTRINSIC_LIVEEDIT(F)              \
+  F(LiveEditCheckAndDropActivations, 3, 1)          \
+  F(LiveEditCompareStrings, 2, 1)                   \
   F(LiveEditFindSharedFunctionInfosForScript, 1, 1) \
-  F(LiveEditGatherCompileInfo, 2, 1)                \
-  F(LiveEditReplaceScript, 3, 1)                    \
-  F(LiveEditFunctionSourceUpdated, 2, 1)            \
-  F(LiveEditReplaceFunctionCode, 2, 1)              \
   F(LiveEditFixupScript, 2, 1)                      \
   F(LiveEditFunctionSetScript, 2, 1)                \
-  F(LiveEditReplaceRefToNestedFunction, 3, 1)       \
+  F(LiveEditFunctionSourceUpdated, 2, 1)            \
+  F(LiveEditGatherCompileInfo, 2, 1)                \
   F(LiveEditPatchFunctionPositions, 2, 1)           \
-  F(LiveEditCheckAndDropActivations, 3, 1)          \
-  F(LiveEditCompareStrings, 2, 1)                   \
+  F(LiveEditReplaceFunctionCode, 2, 1)              \
+  F(LiveEditReplaceRefToNestedFunction, 3, 1)       \
+  F(LiveEditReplaceScript, 3, 1)                    \
   F(LiveEditRestartFrame, 2, 1)
 
 #define FOR_EACH_INTRINSIC_MATHS(F) F(GenerateRandomNumbers, 0, 1)
@@ -366,129 +341,116 @@ namespace internal {
 #define FOR_EACH_INTRINSIC_MODULE(F) \
   F(DynamicImportCall, 2, 1)         \
   F(GetImportMetaObject, 0, 1)       \
-  F(GetModuleNamespace, 1, 1)        \
-  F(LoadModuleVariable, 1, 1)        \
-  F(StoreModuleVariable, 2, 1)
-
-#define FOR_EACH_INTRINSIC_NUMBERS(F)  \
-  F(IsValidSmi, 1, 1)                  \
-  F(StringToNumber, 1, 1)              \
-  F(StringParseInt, 2, 1)              \
-  F(StringParseFloat, 1, 1)            \
-  F(NumberToStringSkipCache, 1, 1)     \
-  F(NumberToSmi, 1, 1)                 \
-  F(SmiLexicographicCompare, 2, 1)     \
-  F(MaxSmi, 0, 1)                      \
-  F(IsSmi, 1, 1)                       \
-  F(GetHoleNaNUpper, 0, 1)             \
-  F(GetHoleNaNLower, 0, 1)
+  F(GetModuleNamespace, 1, 1)
+
+#define FOR_EACH_INTRINSIC_NUMBERS(F) \
+  F(GetHoleNaNLower, 0, 1)            \
+  F(GetHoleNaNUpper, 0, 1)            \
+  F(IsSmi, 1, 1)                      \
+  F(IsValidSmi, 1, 1)                 \
+  F(MaxSmi, 0, 1)                     \
+  F(NumberToSmi, 1, 1)                \
+  F(NumberToStringSkipCache, 1, 1)    \
+  F(SmiLexicographicCompare, 2, 1)    \
+  F(StringParseFloat, 1, 1)           \
+  F(StringParseInt, 2, 1)             \
+  F(StringToNumber, 1, 1)
 
 #define FOR_EACH_INTRINSIC_OBJECT(F)                            \
   F(AddDictionaryProperty, 3, 1)                                \
-  F(GetPrototype, 1, 1)                                         \
-  F(ObjectKeys, 1, 1)                                           \
-  F(ObjectHasOwnProperty, 2, 1)                                 \
-  F(ObjectCreate, 2, 1)                                         \
-  F(InternalSetPrototype, 2, 1)                                 \
-  F(OptimizeObjectForAddingMultipleProperties, 2, 1)            \
-  F(GetProperty, 2, 1)                                          \
-  F(KeyedGetProperty, 2, 1)                                     \
-  F(AddNamedProperty, 4, 1)                                     \
-  F(SetProperty, 4, 1)                                          \
   F(AddElement, 3, 1)                                           \
-  F(AppendElement, 2, 1)                                        \
-  F(DeleteProperty, 3, 1)                                       \
-  F(ShrinkPropertyDictionary, 1, 1)                             \
-  F(HasProperty, 2, 1)                                          \
-  F(GetOwnPropertyKeys, 2, 1)                                   \
-  F(GetInterceptorInfo, 1, 1)                                   \
-  F(ToFastProperties, 1, 1)                                     \
+  F(AddNamedProperty, 4, 1)                                     \
+  F(AddPrivateField, 3, 1)                                      \
   F(AllocateHeapNumber, 0, 1)                                   \
-  F(NewObject, 2, 1)                                            \
-  F(CompleteInobjectSlackTrackingForMap, 1, 1)                  \
-  F(LoadMutableDouble, 2, 1)                                    \
-  F(TryMigrateInstance, 1, 1)                                   \
-  F(IsJSGlobalProxy, 1, 1)                                      \
-  F(DefineAccessorPropertyUnchecked, 5, 1)                      \
-  F(DefineDataPropertyInLiteral, 6, 1)                          \
-  F(CollectTypeProfile, 3, 1)                                   \
-  F(GetDataProperty, 2, 1)                                      \
-  F(GetConstructorName, 1, 1)                                   \
-  F(HasFastPackedElements, 1, 1)                                \
-  F(ValueOf, 1, 1)                                              \
-  F(IsJSReceiver, 1, 1)                                         \
   F(ClassOf, 1, 1)                                              \
+  F(CollectTypeProfile, 3, 1)                                   \
+  F(CompleteInobjectSlackTrackingForMap, 1, 1)                  \
   F(CopyDataProperties, 2, 1)                                   \
   F(CopyDataPropertiesWithExcludedProperties, -1 /* >= 1 */, 1) \
+  F(CreateDataProperty, 3, 1)                                   \
+  F(CreateIterResultObject, 2, 1)                               \
+  F(DefineAccessorPropertyUnchecked, 5, 1)                      \
+  F(DefineDataPropertyInLiteral, 6, 1)                          \
   F(DefineGetterPropertyUnchecked, 4, 1)                        \
-  F(DefineSetterPropertyUnchecked, 4, 1)                        \
   F(DefineMethodsInternal, 3, 1)                                \
+  F(DefineSetterPropertyUnchecked, 4, 1)                        \
+  F(DeleteProperty, 3, 1)                                       \
+  F(GetFunctionName, 1, 1)                                      \
+  F(GetInterceptorInfo, 1, 1)                                   \
+  F(GetOwnPropertyDescriptor, 2, 1)                             \
+  F(GetOwnPropertyKeys, 2, 1)                                   \
+  F(GetProperty, 2, 1)                                          \
+  F(GetPrototype, 1, 1)                                         \
+  F(HasFastPackedElements, 1, 1)                                \
+  F(HasInPrototypeChain, 2, 1)                                  \
+  F(HasProperty, 2, 1)                                          \
+  F(InternalSetPrototype, 2, 1)                                 \
+  F(IsJSReceiver, 1, 1)                                         \
+  F(IterableToListCanBeElided, 1, 1)                            \
+  F(KeyedGetProperty, 2, 1)                                     \
+  F(NewObject, 2, 1)                                            \
+  F(ObjectCreate, 2, 1)                                         \
+  F(ObjectEntries, 1, 1)                                        \
+  F(ObjectEntriesSkipFastPath, 1, 1)                            \
+  F(ObjectHasOwnProperty, 2, 1)                                 \
+  F(ObjectKeys, 1, 1)                                           \
+  F(ObjectValues, 1, 1)                                         \
+  F(ObjectValuesSkipFastPath, 1, 1)                             \
+  F(OptimizeObjectForAddingMultipleProperties, 2, 1)            \
+  F(SameValue, 2, 1)                                            \
+  F(SameValueZero, 2, 1)                                        \
+  F(SetProperty, 4, 1)                                          \
+  F(ShrinkPropertyDictionary, 1, 1)                             \
+  F(ToFastProperties, 1, 1)                                     \
+  F(ToInteger, 1, 1)                                            \
+  F(ToLength, 1, 1)                                             \
+  F(ToName, 1, 1)                                               \
+  F(ToNumber, 1, 1)                                             \
+  F(ToNumeric, 1, 1)                                            \
   F(ToObject, 1, 1)                                             \
   F(ToPrimitive, 1, 1)                                          \
   F(ToPrimitive_Number, 1, 1)                                   \
-  F(ToNumber, 1, 1)                                             \
-  F(ToNumeric, 1, 1)                                            \
-  F(ToInteger, 1, 1)                                            \
-  F(ToLength, 1, 1)                                             \
   F(ToString, 1, 1)                                             \
-  F(ToName, 1, 1)                                               \
-  F(SameValue, 2, 1)                                            \
-  F(SameValueZero, 2, 1)                                        \
-  F(HasInPrototypeChain, 2, 1)                                  \
-  F(CreateIterResultObject, 2, 1)                               \
-  F(CreateDataProperty, 3, 1)                                   \
-  F(IterableToListCanBeElided, 1, 1)                            \
-  F(GetOwnPropertyDescriptor, 2, 1)
+  F(TryMigrateInstance, 1, 1)                                   \
+  F(ValueOf, 1, 1)
 
 #define FOR_EACH_INTRINSIC_OPERATORS(F) \
-  F(Multiply, 2, 1)                     \
-  F(Divide, 2, 1)                       \
-  F(Modulus, 2, 1)                      \
   F(Add, 2, 1)                          \
-  F(Subtract, 2, 1)                     \
-  F(ShiftLeft, 2, 1)                    \
-  F(ShiftRight, 2, 1)                   \
-  F(ShiftRightLogical, 2, 1)            \
-  F(BitwiseAnd, 2, 1)                   \
-  F(BitwiseOr, 2, 1)                    \
-  F(BitwiseXor, 2, 1)                   \
   F(Equal, 2, 1)                        \
-  F(NotEqual, 2, 1)                     \
-  F(StrictEqual, 2, 1)                  \
-  F(StrictNotEqual, 2, 1)               \
-  F(LessThan, 2, 1)                     \
   F(GreaterThan, 2, 1)                  \
-  F(LessThanOrEqual, 2, 1)              \
   F(GreaterThanOrEqual, 2, 1)           \
-  F(InstanceOf, 2, 1)
+  F(LessThan, 2, 1)                     \
+  F(LessThanOrEqual, 2, 1)              \
+  F(NotEqual, 2, 1)                     \
+  F(StrictEqual, 2, 1)                  \
+  F(StrictNotEqual, 2, 1)
 
 #define FOR_EACH_INTRINSIC_PROMISE(F)  \
   F(EnqueueMicrotask, 1, 1)            \
-  F(PromiseHookInit, 2, 1)             \
-  F(PromiseHookResolve, 1, 1)          \
-  F(PromiseHookBefore, 1, 1)           \
   F(PromiseHookAfter, 1, 1)            \
+  F(PromiseHookBefore, 1, 1)           \
+  F(PromiseHookInit, 2, 1)             \
   F(PromiseMarkAsHandled, 1, 1)        \
   F(PromiseRejectEventFromStack, 2, 1) \
-  F(PromiseRevokeReject, 1, 1)         \
   F(PromiseResult, 1, 1)               \
+  F(PromiseRevokeReject, 1, 1)         \
   F(PromiseStatus, 1, 1)               \
-  F(ReportPromiseReject, 2, 1)
-
-#define FOR_EACH_INTRINSIC_PROXY(F) \
-  F(IsJSProxy, 1, 1)                \
-  F(JSProxyGetTarget, 1, 1)         \
-  F(JSProxyGetHandler, 1, 1)        \
-  F(GetPropertyWithReceiver, 2, 1)  \
-  F(CheckProxyHasTrap, 2, 1)        \
-  F(SetPropertyWithReceiver, 5, 1)  \
-  F(CheckProxyGetSetTrapResult, 2, 1)
+  F(RejectPromise, 3, 1)               \
+  F(ResolvePromise, 2, 1)
+
+#define FOR_EACH_INTRINSIC_PROXY(F)   \
+  F(CheckProxyGetSetTrapResult, 2, 1) \
+  F(CheckProxyHasTrap, 2, 1)          \
+  F(GetPropertyWithReceiver, 2, 1)    \
+  F(IsJSProxy, 1, 1)                  \
+  F(JSProxyGetHandler, 1, 1)          \
+  F(JSProxyGetTarget, 1, 1)           \
+  F(SetPropertyWithReceiver, 5, 1)
 
 #define FOR_EACH_INTRINSIC_REGEXP(F)                \
   F(IsRegExp, 1, 1)                                 \
   F(RegExpExec, 4, 1)                               \
   F(RegExpExecMultiple, 4, 1)                       \
-  F(RegExpExecReThrow, 0, 1)                        \
   F(RegExpInitializeAndCompile, 3, 1)               \
   F(RegExpInternalReplace, 3, 1)                    \
   F(RegExpReplace, 3, 1)                            \
@@ -497,175 +459,171 @@ namespace internal {
   F(StringSplit, 3, 1)
 
 #define FOR_EACH_INTRINSIC_SCOPES(F)      \
-  F(ThrowConstAssignError, 0, 1)          \
-  F(DeclareGlobals, 3, 1)                 \
-  F(DeclareGlobalsForInterpreter, 3, 1)   \
   F(DeclareEvalFunction, 2, 1)            \
   F(DeclareEvalVar, 1, 1)                 \
-  F(NewSloppyArguments_Generic, 1, 1)     \
-  F(NewStrictArguments, 1, 1)             \
-  F(NewRestParameter, 1, 1)               \
-  F(NewSloppyArguments, 3, 1)             \
+  F(DeclareGlobals, 3, 1)                 \
+  F(DeleteLookupSlot, 1, 1)               \
+  F(LoadLookupSlot, 1, 1)                 \
+  F(LoadLookupSlotInsideTypeof, 1, 1)     \
   F(NewArgumentsElements, 3, 1)           \
-  F(NewClosure, 3, 1)                     \
-  F(NewClosure_Tenured, 3, 1)             \
-  F(NewScriptContext, 2, 1)               \
+  F(NewClosure, 2, 1)                     \
+  F(NewClosure_Tenured, 2, 1)             \
   F(NewFunctionContext, 2, 1)             \
+  F(NewRestParameter, 1, 1)               \
+  F(NewScriptContext, 2, 1)               \
+  F(NewSloppyArguments, 3, 1)             \
+  F(NewSloppyArguments_Generic, 1, 1)     \
+  F(NewStrictArguments, 1, 1)             \
+  F(PushBlockContext, 2, 1)               \
+  F(PushCatchContext, 4, 1)               \
   F(PushModuleContext, 3, 1)              \
   F(PushWithContext, 3, 1)                \
-  F(PushCatchContext, 4, 1)               \
-  F(PushBlockContext, 2, 1)               \
-  F(DeleteLookupSlot, 1, 1)               \
-  F(LoadLookupSlot, 1, 1)                 \
-  F(LoadLookupSlotInsideTypeof, 1, 1)     \
   F(StoreLookupSlot_Sloppy, 2, 1)         \
   F(StoreLookupSlot_SloppyHoisting, 2, 1) \
-  F(StoreLookupSlot_Strict, 2, 1)
+  F(StoreLookupSlot_Strict, 2, 1)         \
+  F(ThrowConstAssignError, 0, 1)
 
 #define FOR_EACH_INTRINSIC_STRINGS(F)     \
+  F(FlattenString, 1, 1)                  \
   F(GetSubstitution, 5, 1)                \
-  F(StringReplaceOneCharWithString, 3, 1) \
+  F(InternalizeString, 1, 1)              \
+  F(SparseJoinWithSeparator, 3, 1)        \
+  F(StringAdd, 2, 1)                      \
+  F(StringBuilderConcat, 3, 1)            \
+  F(StringBuilderJoin, 3, 1)              \
+  F(StringCharCodeAt, 2, 1)               \
+  F(StringCharFromCode, 1, 1)             \
+  F(StringEqual, 2, 1)                    \
+  F(StringGreaterThan, 2, 1)              \
+  F(StringGreaterThanOrEqual, 2, 1)       \
   F(StringIncludes, 3, 1)                 \
-  F(StringTrim, 2, 1)                     \
   F(StringIndexOf, 3, 1)                  \
   F(StringIndexOfUnchecked, 3, 1)         \
   F(StringLastIndexOf, 2, 1)              \
-  F(SubString, 3, 1)                      \
-  F(StringAdd, 2, 1)                      \
-  F(InternalizeString, 1, 1)              \
-  F(StringCharCodeAt, 2, 1)               \
-  F(StringBuilderConcat, 3, 1)            \
-  F(StringBuilderJoin, 3, 1)              \
-  F(SparseJoinWithSeparator, 3, 1)        \
-  F(StringToArray, 2, 1)                  \
   F(StringLessThan, 2, 1)                 \
   F(StringLessThanOrEqual, 2, 1)          \
-  F(StringGreaterThan, 2, 1)              \
-  F(StringGreaterThanOrEqual, 2, 1)       \
-  F(StringEqual, 2, 1)                    \
+  F(StringMaxLength, 0, 1)                \
   F(StringNotEqual, 2, 1)                 \
-  F(FlattenString, 1, 1)                  \
-  F(StringCharFromCode, 1, 1)             \
-  F(StringMaxLength, 0, 1)
+  F(StringReplaceOneCharWithString, 3, 1) \
+  F(StringSubstring, 3, 1)                \
+  F(StringToArray, 2, 1)                  \
+  F(StringTrim, 2, 1)
 
-#define FOR_EACH_INTRINSIC_SYMBOL(F) \
-  F(CreateSymbol, 1, 1)              \
-  F(CreatePrivateSymbol, 1, 1)       \
-  F(SymbolDescription, 1, 1)         \
-  F(SymbolDescriptiveString, 1, 1)   \
+#define FOR_EACH_INTRINSIC_SYMBOL(F)       \
+  F(CreatePrivateFieldSymbol, 0, 1)        \
+  F(CreatePrivateSymbol, -1 /* <= 1 */, 1) \
+  F(SymbolDescription, 1, 1)               \
+  F(SymbolDescriptiveString, 1, 1)         \
   F(SymbolIsPrivate, 1, 1)
 
 #define FOR_EACH_INTRINSIC_TEST(F)            \
-  F(ConstructDouble, 2, 1)                    \
+  F(Abort, 1, 1)                              \
+  F(AbortJS, 1, 1)                            \
+  F(ClearFunctionFeedback, 1, 1)              \
+  F(CompleteInobjectSlackTracking, 1, 1)      \
   F(ConstructConsString, 2, 1)                \
+  F(ConstructDouble, 2, 1)                    \
+  F(DebugPrint, 1, 1)                         \
+  F(DebugTrace, 0, 1)                         \
+  F(DebugTrackRetainingPath, -1, 1)           \
   F(DeoptimizeFunction, 1, 1)                 \
   F(DeoptimizeNow, 0, 1)                      \
-  F(RunningInSimulator, 0, 1)                 \
-  F(IsConcurrentRecompilationSupported, 0, 1) \
-  F(OptimizeFunctionOnNextCall, -1, 1)        \
-  F(TypeProfile, 1, 1)                        \
-  F(OptimizeOsr, -1, 1)                       \
-  F(NeverOptimizeFunction, 1, 1)              \
-  F(GetOptimizationStatus, -1, 1)             \
-  F(UnblockConcurrentRecompilation, 0, 1)     \
+  F(DeserializeWasmModule, 2, 1)              \
+  F(DisallowCodegenFromStrings, 1, 1)         \
+  F(DisallowWasmCodegen, 1, 1)                \
+  F(DisassembleFunction, 1, 1)                \
+  F(FreezeWasmLazyCompilation, 1, 1)          \
+  F(GetCallable, 0, 1)                        \
   F(GetDeoptCount, 1, 1)                      \
+  F(GetOptimizationStatus, -1, 1)             \
   F(GetUndetectable, 0, 1)                    \
-  F(GetCallable, 0, 1)                        \
-  F(ClearFunctionFeedback, 1, 1)              \
-  F(CheckWasmWrapperElision, 2, 1)            \
-  F(NotifyContextDisposed, 0, 1)              \
-  F(SetAllocationTimeout, -1 /* 2 || 3 */, 1) \
-  F(DebugPrint, 1, 1)                         \
-  F(DebugTrace, 0, 1)                         \
-  F(DebugTrackRetainingPath, -1, 1)           \
-  F(PrintWithNameForAssert, 2, 1)             \
-  F(GetExceptionDetails, 1, 1)                \
+  F(GetWasmRecoveredTrapCount, 0, 1)          \
   F(GlobalPrint, 1, 1)                        \
-  F(SystemBreak, 0, 1)                        \
-  F(SetFlags, 1, 1)                           \
-  F(Abort, 1, 1)                              \
-  F(AbortJS, 1, 1)                            \
-  F(NativeScriptsCount, 0, 1)                 \
-  F(DisassembleFunction, 1, 1)                \
-  F(TraceEnter, 0, 1)                         \
-  F(TraceExit, 1, 1)                          \
-  F(HaveSameMap, 2, 1)                        \
-  F(InNewSpace, 1, 1)                         \
-  F(HasFastElements, 1, 1)                    \
-  F(HasSmiElements, 1, 1)                     \
-  F(HasObjectElements, 1, 1)                  \
-  F(HasSmiOrObjectElements, 1, 1)             \
-  F(HasDoubleElements, 1, 1)                  \
-  F(HasHoleyElements, 1, 1)                   \
   F(HasDictionaryElements, 1, 1)              \
-  F(HasSloppyArgumentsElements, 1, 1)         \
-  F(HasFixedTypedArrayElements, 1, 1)         \
+  F(HasDoubleElements, 1, 1)                  \
+  F(HasFastElements, 1, 1)                    \
   F(HasFastProperties, 1, 1)                  \
-  F(HasFixedUint8Elements, 1, 1)              \
+  F(HasFixedBigInt64Elements, 1, 1)           \
+  F(HasFixedBigUint64Elements, 1, 1)          \
+  F(HasFixedFloat32Elements, 1, 1)            \
+  F(HasFixedFloat64Elements, 1, 1)            \
+  F(HasFixedInt16Elements, 1, 1)              \
+  F(HasFixedInt32Elements, 1, 1)              \
   F(HasFixedInt8Elements, 1, 1)               \
   F(HasFixedUint16Elements, 1, 1)             \
-  F(HasFixedInt16Elements, 1, 1)              \
   F(HasFixedUint32Elements, 1, 1)             \
-  F(HasFixedInt32Elements, 1, 1)              \
-  F(HasFixedFloat32Elements, 1, 1)            \
-  F(HasFixedFloat64Elements, 1, 1)            \
   F(HasFixedUint8ClampedElements, 1, 1)       \
-  F(SpeciesProtector, 0, 1)                   \
-  F(SerializeWasmModule, 1, 1)                \
-  F(DeserializeWasmModule, 2, 1)              \
+  F(HasFixedUint8Elements, 1, 1)              \
+  F(HasHoleyElements, 1, 1)                   \
+  F(HasObjectElements, 1, 1)                  \
+  F(HasSloppyArgumentsElements, 1, 1)         \
+  F(HasSmiElements, 1, 1)                     \
+  F(HasSmiOrObjectElements, 1, 1)             \
+  F(HaveSameMap, 2, 1)                        \
+  F(HeapObjectVerify, 1, 1)                   \
+  F(InNewSpace, 1, 1)                         \
   F(IsAsmWasmCode, 1, 1)                      \
+  F(IsConcurrentRecompilationSupported, 0, 1) \
+  F(IsJSError, 1, 1)                          \
+  F(IsJSGeneratorObject, 1, 1)                \
+  F(IsJSMapIterator, 1, 1)                    \
+  F(IsJSSetIterator, 1, 1)                    \
+  F(IsLiftoffFunction, 1, 1)                  \
+  F(IsScriptWrapper, 1, 1)                    \
   F(IsWasmCode, 1, 1)                         \
   F(IsWasmTrapHandlerEnabled, 0, 1)           \
-  F(GetWasmRecoveredTrapCount, 0, 1)          \
-  F(DisallowCodegenFromStrings, 1, 1)         \
-  F(DisallowWasmCodegen, 1, 1)                \
+  F(NativeScriptsCount, 0, 1)                 \
+  F(NeverOptimizeFunction, 1, 1)              \
+  F(NotifyContextDisposed, 0, 1)              \
+  F(OptimizeFunctionOnNextCall, -1, 1)        \
+  F(OptimizeOsr, -1, 1)                       \
+  F(PrintWithNameForAssert, 2, 1)             \
+  F(RedirectToWasmInterpreter, 2, 1)          \
+  F(RunningInSimulator, 0, 1)                 \
+  F(SerializeWasmModule, 1, 1)                \
+  F(SetAllocationTimeout, -1 /* 2 || 3 */, 1) \
+  F(SetFlags, 1, 1)                           \
+  F(SetForceSlowPath, 1, 1)                   \
+  F(SetWasmCompileControls, 2, 1)             \
+  F(SetWasmInstantiateControls, 0, 1)         \
+  F(SpeciesProtector, 0, 1)                   \
+  F(SystemBreak, 0, 1)                        \
+  F(TraceEnter, 0, 1)                         \
+  F(TraceExit, 1, 1)                          \
+  F(UnblockConcurrentRecompilation, 0, 1)     \
   F(ValidateWasmInstancesChain, 2, 1)         \
   F(ValidateWasmModuleState, 1, 1)            \
   F(ValidateWasmOrphanedInstance, 1, 1)       \
-  F(SetWasmCompileControls, 2, 1)             \
-  F(SetWasmInstantiateControls, 0, 1)         \
-  F(HeapObjectVerify, 1, 1)                   \
   F(WasmNumInterpretedCalls, 1, 1)            \
-  F(RedirectToWasmInterpreter, 2, 1)          \
-  F(WasmTraceMemory, 1, 1)                    \
-  F(CompleteInobjectSlackTracking, 1, 1)      \
-  F(IsLiftoffFunction, 1, 1)                  \
-  F(FreezeWasmLazyCompilation, 1, 1)
+  F(WasmTraceMemory, 1, 1)
 
 #define FOR_EACH_INTRINSIC_TYPEDARRAY(F) \
-  F(ArrayBufferGetByteLength, 1, 1)      \
   F(ArrayBufferNeuter, 1, 1)             \
-  F(TypedArrayCopyElements, 3, 1)        \
-  F(ArrayBufferViewGetByteLength, 1, 1)  \
-  F(ArrayBufferViewGetByteOffset, 1, 1)  \
   F(ArrayBufferViewWasNeutered, 1, 1)    \
-  F(TypedArrayGetLength, 1, 1)           \
+  F(IsTypedArray, 1, 1)                  \
+  F(TypedArrayCopyElements, 3, 1)        \
   F(TypedArrayGetBuffer, 1, 1)           \
-  F(TypedArraySortFast, 1, 1)            \
+  F(TypedArrayGetLength, 1, 1)           \
   F(TypedArraySet, 2, 1)                 \
-  F(IsTypedArray, 1, 1)                  \
-  F(IsSharedTypedArray, 1, 1)            \
-  F(IsSharedIntegerTypedArray, 1, 1)     \
-  F(IsSharedInteger32TypedArray, 1, 1)   \
-  F(TypedArraySpeciesCreateByLength, 2, 1)
+  F(TypedArraySortFast, 1, 1)
 
 #define FOR_EACH_INTRINSIC_WASM(F)   \
-  F(WasmGrowMemory, 1, 1)            \
   F(ThrowWasmError, 1, 1)            \
   F(ThrowWasmStackOverflow, 0, 1)    \
-  F(WasmThrowTypeError, 0, 1)        \
-  F(WasmThrowCreate, 2, 1)           \
-  F(WasmThrow, 0, 1)                 \
-  F(WasmGetExceptionRuntimeId, 0, 1) \
-  F(WasmExceptionSetElement, 2, 1)   \
+  F(WasmCompileLazy, 0, 1)           \
   F(WasmExceptionGetElement, 1, 1)   \
+  F(WasmExceptionSetElement, 2, 1)   \
+  F(WasmGetExceptionRuntimeId, 0, 1) \
+  F(WasmGrowMemory, 1, 1)            \
   F(WasmRunInterpreter, 2, 1)        \
   F(WasmStackGuard, 0, 1)            \
-  F(WasmCompileLazy, 0, 1)
+  F(WasmThrow, 0, 1)                 \
+  F(WasmThrowCreate, 2, 1)           \
+  F(WasmThrowTypeError, 0, 1)
 
 #define FOR_EACH_INTRINSIC_RETURN_PAIR(F) \
-  F(LoadLookupSlotForCall, 1, 2)          \
-  F(DebugBreakOnBytecode, 1, 2)
+  F(DebugBreakOnBytecode, 1, 2)           \
+  F(LoadLookupSlotForCall, 1, 2)
 
 // Most intrinsics are implemented in the runtime/ directory, but ICs are
 // implemented in ic.cc for now.
@@ -683,11 +641,10 @@ namespace internal {
   F(StoreGlobalIC_Miss, 4, 1)                \
   F(StoreGlobalIC_Slow, 5, 1)                \
   F(StoreIC_Miss, 5, 1)                      \
-  F(StorePropertyWithInterceptor, 5, 1)      \
-  F(Unreachable, 0, 1)
+  F(StoreInArrayLiteralIC_Slow, 5, 1)        \
+  F(StorePropertyWithInterceptor, 5, 1)
 
 #define FOR_EACH_INTRINSIC_RETURN_OBJECT(F) \
-  FOR_EACH_INTRINSIC_IC(F)                  \
   FOR_EACH_INTRINSIC_ARRAY(F)               \
   FOR_EACH_INTRINSIC_ATOMICS(F)             \
   FOR_EACH_INTRINSIC_BIGINT(F)              \
@@ -698,11 +655,12 @@ namespace internal {
   FOR_EACH_INTRINSIC_DEBUG(F)               \
   FOR_EACH_INTRINSIC_ERROR(F)               \
   FOR_EACH_INTRINSIC_FORIN(F)               \
-  FOR_EACH_INTRINSIC_INTERPRETER(F)         \
   FOR_EACH_INTRINSIC_FUNCTION(F)            \
   FOR_EACH_INTRINSIC_GENERATOR(F)           \
-  FOR_EACH_INTRINSIC_INTL(F)                \
+  FOR_EACH_INTRINSIC_IC(F)                  \
   FOR_EACH_INTRINSIC_INTERNAL(F)            \
+  FOR_EACH_INTRINSIC_INTERPRETER(F)         \
+  FOR_EACH_INTRINSIC_INTL(F)                \
   FOR_EACH_INTRINSIC_LITERALS(F)            \
   FOR_EACH_INTRINSIC_LIVEEDIT(F)            \
   FOR_EACH_INTRINSIC_MATHS(F)               \
@@ -769,6 +727,12 @@ class Runtime : public AllStatic {
 
   static const int kNotFound = -1;
 
+  // Checks whether the runtime function with the given {id} never returns
+  // to it's caller normally, i.e. whether it'll always raise an exception.
+  // More specifically: The C++ implementation returns the Heap::exception
+  // sentinel, always.
+  static bool IsNonReturning(FunctionId id);
+
   // Get the intrinsic function with the given name.
   static const Function* FunctionForName(const unsigned char* name, int length);
 
diff --git a/deps/v8/src/s390/assembler-s390-inl.h b/deps/v8/src/s390/assembler-s390-inl.h
index 6323730b99d..08fb6750276 100644
--- a/deps/v8/src/s390/assembler-s390-inl.h
+++ b/deps/v8/src/s390/assembler-s390-inl.h
@@ -46,7 +46,7 @@
 namespace v8 {
 namespace internal {
 
-bool CpuFeatures::SupportsCrankshaft() { return true; }
+bool CpuFeatures::SupportsOptimizer() { return true; }
 
 bool CpuFeatures::SupportsWasmSimd128() { return false; }
 
@@ -70,8 +70,8 @@ void RelocInfo::apply(intptr_t delta) {
     // mov sequence
     DCHECK(IsInternalReferenceEncoded(rmode_));
     Address target = Assembler::target_address_at(pc_, constant_pool_);
-    Assembler::set_target_address_at(nullptr, pc_, constant_pool_,
-                                     target + delta, SKIP_ICACHE_FLUSH);
+    Assembler::set_target_address_at(pc_, constant_pool_, target + delta,
+                                     SKIP_ICACHE_FLUSH);
   }
 }
 
@@ -98,7 +98,8 @@ Address RelocInfo::target_address() {
 
 Address RelocInfo::target_address_address() {
   DCHECK(IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_) || IsWasmCall(rmode_) ||
-         rmode_ == EMBEDDED_OBJECT || rmode_ == EXTERNAL_REFERENCE);
+         IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
+         IsOffHeapTarget(rmode_));
 
   // Read the address of the word containing the target_address in an
   // instruction stream.
@@ -159,7 +160,7 @@ void RelocInfo::set_target_object(HeapObject* target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
-  Assembler::set_target_address_at(target->GetIsolate(), pc_, constant_pool_,
+  Assembler::set_target_address_at(pc_, constant_pool_,
                                    reinterpret_cast<Address>(target),
                                    icache_flush_mode);
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr) {
@@ -179,15 +180,20 @@ Address RelocInfo::target_runtime_entry(Assembler* origin) {
   return target_address();
 }
 
-void RelocInfo::set_target_runtime_entry(Isolate* isolate, Address target,
+Address RelocInfo::target_off_heap_target() {
+  DCHECK(IsOffHeapTarget(rmode_));
+  return Assembler::target_address_at(pc_, constant_pool_);
+}
+
+void RelocInfo::set_target_runtime_entry(Address target,
                                          WriteBarrierMode write_barrier_mode,
                                          ICacheFlushMode icache_flush_mode) {
   DCHECK(IsRuntimeEntry(rmode_));
   if (target_address() != target)
-    set_target_address(isolate, target, write_barrier_mode, icache_flush_mode);
+    set_target_address(target, write_barrier_mode, icache_flush_mode);
 }
 
-void RelocInfo::WipeOut(Isolate* isolate) {
+void RelocInfo::WipeOut() {
   DCHECK(IsEmbeddedObject(rmode_) || IsCodeTarget(rmode_) ||
          IsRuntimeEntry(rmode_) || IsExternalReference(rmode_) ||
          IsInternalReference(rmode_) || IsInternalReferenceEncoded(rmode_));
@@ -197,15 +203,15 @@ void RelocInfo::WipeOut(Isolate* isolate) {
   } else if (IsInternalReferenceEncoded(rmode_)) {
     // mov sequence
     // Currently used only by deserializer, no need to flush.
-    Assembler::set_target_address_at(isolate, pc_, constant_pool_, nullptr,
+    Assembler::set_target_address_at(pc_, constant_pool_, nullptr,
                                      SKIP_ICACHE_FLUSH);
   } else {
-    Assembler::set_target_address_at(isolate, pc_, constant_pool_, nullptr);
+    Assembler::set_target_address_at(pc_, constant_pool_, nullptr);
   }
 }
 
 template <typename ObjectVisitor>
-void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
+void RelocInfo::Visit(ObjectVisitor* visitor) {
   RelocInfo::Mode mode = rmode();
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
@@ -217,11 +223,13 @@ void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
     visitor->VisitInternalReference(host(), this);
   } else if (IsRuntimeEntry(mode)) {
     visitor->VisitRuntimeEntry(host(), this);
+  } else if (RelocInfo::IsOffHeapTarget(mode)) {
+    visitor->VisitOffHeapTarget(host(), this);
   }
 }
 
 // Operand constructors
-Operand::Operand(Register rm) : rm_(rm), rmode_(kRelocInfo_NONEPTR) {}
+Operand::Operand(Register rm) : rm_(rm), rmode_(RelocInfo::NONE) {}
 
 int32_t Assembler::emit_code_target(Handle<Code> target,
                                     RelocInfo::Mode rmode) {
@@ -281,26 +289,24 @@ Address Assembler::target_address_at(Address pc, Address constant_pool) {
 // has already deserialized the mov instructions etc.
 // There is a FIXED_SEQUENCE assumption here
 void Assembler::deserialization_set_special_target_at(
-    Isolate* isolate, Address instruction_payload, Code* code, Address target) {
-  set_target_address_at(isolate, instruction_payload,
+    Address instruction_payload, Code* code, Address target) {
+  set_target_address_at(instruction_payload,
                         code ? code->constant_pool() : nullptr, target);
 }
 
 void Assembler::deserialization_set_target_internal_reference_at(
-    Isolate* isolate, Address pc, Address target, RelocInfo::Mode mode) {
+    Address pc, Address target, RelocInfo::Mode mode) {
   if (RelocInfo::IsInternalReferenceEncoded(mode)) {
-    set_target_address_at(isolate, pc, nullptr, target, SKIP_ICACHE_FLUSH);
+    set_target_address_at(pc, nullptr, target, SKIP_ICACHE_FLUSH);
   } else {
     Memory::Address_at(pc) = target;
   }
 }
 
 // This code assumes the FIXED_SEQUENCE of IIHF/IILF
-void Assembler::set_target_address_at(Isolate* isolate, Address pc,
-                                      Address constant_pool, Address target,
+void Assembler::set_target_address_at(Address pc, Address constant_pool,
+                                      Address target,
                                       ICacheFlushMode icache_flush_mode) {
-  DCHECK_IMPLIES(isolate == nullptr, icache_flush_mode == SKIP_ICACHE_FLUSH);
-
   // Check for instructions generated by Asm::mov()
   Opcode op1 = Instruction::S390OpcodeValue(reinterpret_cast<const byte*>(pc));
   SixByteInstr instr_1 =
@@ -315,7 +321,7 @@ void Assembler::set_target_address_at(Isolate* isolate, Address pc,
     Instruction::SetInstructionBits<SixByteInstr>(reinterpret_cast<byte*>(pc),
                                                   instr_1);
     if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-      Assembler::FlushICache(isolate, pc, 6);
+      Assembler::FlushICache(pc, 6);
     }
     patched = true;
   } else {
@@ -344,7 +350,7 @@ void Assembler::set_target_address_at(Isolate* isolate, Address pc,
       Instruction::SetInstructionBits<SixByteInstr>(
           reinterpret_cast<byte*>(pc + instr1_length), instr_2);
       if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-        Assembler::FlushICache(isolate, pc, 12);
+        Assembler::FlushICache(pc, 12);
       }
       patched = true;
     }
@@ -358,7 +364,7 @@ void Assembler::set_target_address_at(Isolate* isolate, Address pc,
       Instruction::SetInstructionBits<SixByteInstr>(reinterpret_cast<byte*>(pc),
                                                     instr_1);
       if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-        Assembler::FlushICache(isolate, pc, 6);
+        Assembler::FlushICache(pc, 6);
       }
       patched = true;
     }
diff --git a/deps/v8/src/s390/assembler-s390.cc b/deps/v8/src/s390/assembler-s390.cc
index 166da1c451c..d0b1afa8014 100644
--- a/deps/v8/src/s390/assembler-s390.cc
+++ b/deps/v8/src/s390/assembler-s390.cc
@@ -279,22 +279,20 @@ uint32_t RelocInfo::embedded_size() const {
       Assembler::target_address_at(pc_, constant_pool_)));
 }
 
-void RelocInfo::set_embedded_address(Isolate* isolate, Address address,
+void RelocInfo::set_embedded_address(Address address,
                                      ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(isolate, pc_, constant_pool_, address,
-                                   flush_mode);
+  Assembler::set_target_address_at(pc_, constant_pool_, address, flush_mode);
 }
 
-void RelocInfo::set_embedded_size(Isolate* isolate, uint32_t size,
-                                  ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(isolate, pc_, constant_pool_,
+void RelocInfo::set_embedded_size(uint32_t size, ICacheFlushMode flush_mode) {
+  Assembler::set_target_address_at(pc_, constant_pool_,
                                    reinterpret_cast<Address>(size), flush_mode);
 }
 
-void RelocInfo::set_js_to_wasm_address(Isolate* isolate, Address address,
+void RelocInfo::set_js_to_wasm_address(Address address,
                                        ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  set_embedded_address(isolate, address, icache_flush_mode);
+  set_embedded_address(address, icache_flush_mode);
 }
 
 Address RelocInfo::js_to_wasm_address() const {
@@ -336,7 +334,7 @@ void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
       case HeapObjectRequest::kHeapNumber:
         object = isolate->factory()->NewHeapNumber(request.heap_number(),
                                                    IMMUTABLE, TENURED);
-        set_target_address_at(nullptr, pc, static_cast<Address>(nullptr),
+        set_target_address_at(pc, static_cast<Address>(nullptr),
                               reinterpret_cast<Address>(object.location()),
                               SKIP_ICACHE_FLUSH);
         break;
@@ -373,6 +371,7 @@ void Assembler::GetCode(Isolate* isolate, CodeDesc* desc) {
   desc->buffer_size = buffer_size_;
   desc->instr_size = pc_offset();
   desc->reloc_size = (buffer_ + buffer_size_) - reloc_info_writer.pos();
+  desc->constant_pool_size = 0;
   desc->origin = this;
   desc->unwinding_info_size = 0;
   desc->unwinding_info = nullptr;
@@ -2132,7 +2131,7 @@ void Assembler::GrowBuffer(int needed) {
   // Some internal data structures overflow for very large buffers,
   // they must ensure that kMaximalBufferSize is not too large.
   if (desc.buffer_size > kMaximalBufferSize) {
-    V8::FatalProcessOutOfMemory("Assembler::GrowBuffer");
+    V8::FatalProcessOutOfMemory(nullptr, "Assembler::GrowBuffer");
   }
 
   // Set up new buffer.
@@ -2224,8 +2223,7 @@ void Assembler::EmitRelocations() {
     } else if (RelocInfo::IsInternalReferenceEncoded(rmode)) {
       // mov sequence
       intptr_t pos = reinterpret_cast<intptr_t>(target_address_at(pc, nullptr));
-      set_target_address_at(nullptr, pc, nullptr, buffer_ + pos,
-                            SKIP_ICACHE_FLUSH);
+      set_target_address_at(pc, nullptr, buffer_ + pos, SKIP_ICACHE_FLUSH);
     }
 
     reloc_info_writer.Write(&rinfo);
diff --git a/deps/v8/src/s390/assembler-s390.h b/deps/v8/src/s390/assembler-s390.h
index 4a5945de876..ce3f04c9963 100644
--- a/deps/v8/src/s390/assembler-s390.h
+++ b/deps/v8/src/s390/assembler-s390.h
@@ -261,8 +261,8 @@ class Register : public RegisterBase<Register, kRegAfterLast> {
   explicit constexpr Register(int code) : RegisterBase(code) {}
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(Register) &&
-                  sizeof(Register) == sizeof(int),
+ASSERT_TRIVIALLY_COPYABLE(Register);
+static_assert(sizeof(Register) == sizeof(int),
               "Register can efficiently be passed by value");
 
 #define DEFINE_REGISTER(R) \
@@ -303,8 +303,8 @@ class DoubleRegister : public RegisterBase<DoubleRegister, kDoubleAfterLast> {
   explicit constexpr DoubleRegister(int code) : RegisterBase(code) {}
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(DoubleRegister) &&
-                  sizeof(DoubleRegister) == sizeof(int),
+ASSERT_TRIVIALLY_COPYABLE(DoubleRegister);
+static_assert(sizeof(DoubleRegister) == sizeof(int),
               "DoubleRegister can efficiently be passed by value");
 
 typedef DoubleRegister FloatRegister;
@@ -345,12 +345,6 @@ C_REGISTERS(DECLARE_C_REGISTER)
 // -----------------------------------------------------------------------------
 // Machine instruction Operands
 
-#if V8_TARGET_ARCH_S390X
-constexpr RelocInfo::Mode kRelocInfo_NONEPTR = RelocInfo::NONE64;
-#else
-constexpr RelocInfo::Mode kRelocInfo_NONEPTR = RelocInfo::NONE32;
-#endif
-
 // Class Operand represents a shifter operand in data processing instructions
 // defining immediate numbers and masks
 typedef uint8_t Length;
@@ -369,7 +363,7 @@ class Operand BASE_EMBEDDED {
  public:
   // immediate
   INLINE(explicit Operand(intptr_t immediate,
-                          RelocInfo::Mode rmode = kRelocInfo_NONEPTR)
+                          RelocInfo::Mode rmode = RelocInfo::NONE)
          : rmode_(rmode)) {
     value_.immediate = immediate;
   }
@@ -379,7 +373,7 @@ class Operand BASE_EMBEDDED {
     value_.immediate = reinterpret_cast<intptr_t>(f.address());
   }
   explicit Operand(Handle<HeapObject> handle);
-  INLINE(explicit Operand(Smi* value) : rmode_(kRelocInfo_NONEPTR)) {
+  INLINE(explicit Operand(Smi* value) : rmode_(RelocInfo::NONE)) {
     value_.immediate = reinterpret_cast<intptr_t>(value);
   }
 
@@ -555,7 +549,7 @@ class Assembler : public AssemblerBase {
   // The isolate argument is unused (and may be nullptr) when skipping flushing.
   INLINE(static Address target_address_at(Address pc, Address constant_pool));
   INLINE(static void set_target_address_at(
-      Isolate* isolate, Address pc, Address constant_pool, Address target,
+      Address pc, Address constant_pool, Address target,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED));
 
   // Return the code target address at a call site from the return address
@@ -570,12 +564,11 @@ class Assembler : public AssemblerBase {
   // This sets the branch destination.
   // This is for calls and branches within generated code.
   inline static void deserialization_set_special_target_at(
-      Isolate* isolate, Address instruction_payload, Code* code,
-      Address target);
+      Address instruction_payload, Code* code, Address target);
 
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
-      Isolate* isolate, Address pc, Address target,
+      Address pc, Address target,
       RelocInfo::Mode mode = RelocInfo::INTERNAL_REFERENCE);
 
   // Here we are patching the address in the IIHF/IILF instruction pair.
diff --git a/deps/v8/src/s390/code-stubs-s390.cc b/deps/v8/src/s390/code-stubs-s390.cc
index 783b995c726..91396bb597b 100644
--- a/deps/v8/src/s390/code-stubs-s390.cc
+++ b/deps/v8/src/s390/code-stubs-s390.cc
@@ -435,6 +435,11 @@ void CEntryStub::Generate(MacroAssembler* masm) {
   __ StoreP(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
   __ bind(&skip);
 
+  // Reset the masking register.
+  if (FLAG_branch_load_poisoning) {
+    __ ResetSpeculationPoisonRegister();
+  }
+
   // Compute the handler entry address and jump to it.
   __ mov(r3, Operand(pending_handler_entrypoint_address));
   __ LoadP(r3, MemOperand(r3));
diff --git a/deps/v8/src/s390/codegen-s390.cc b/deps/v8/src/s390/codegen-s390.cc
index df025707838..badecb461e8 100644
--- a/deps/v8/src/s390/codegen-s390.cc
+++ b/deps/v8/src/s390/codegen-s390.cc
@@ -7,6 +7,7 @@
 #include <memory>
 
 #include "src/codegen.h"
+#include "src/isolate.h"
 #include "src/macro-assembler.h"
 #include "src/s390/simulator-s390.h"
 
@@ -33,10 +34,9 @@ UnaryMathFunctionWithIsolate CreateSqrtFunction(Isolate* isolate) {
 
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
-  DCHECK(ABI_USES_FUNCTION_DESCRIPTORS ||
-         !RelocInfo::RequiresRelocation(isolate, desc));
+  DCHECK(ABI_USES_FUNCTION_DESCRIPTORS || !RelocInfo::RequiresRelocation(desc));
 
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   CHECK(SetPermissions(buffer, allocated, PageAllocator::kReadExecute));
   return FUNCTION_CAST<UnaryMathFunctionWithIsolate>(buffer);
 #endif
diff --git a/deps/v8/src/s390/disasm-s390.cc b/deps/v8/src/s390/disasm-s390.cc
index de4db00cf10..66d77d12504 100644
--- a/deps/v8/src/s390/disasm-s390.cc
+++ b/deps/v8/src/s390/disasm-s390.cc
@@ -288,6 +288,7 @@ int Decoder::FormatOption(Instruction* instr, const char* format) {
             converter_.NameOfAddress(reinterpret_cast<byte*>(instr) + off));
         return 8;
       }
+      break;
       case 'm': {
         return FormatMask(instr, format);
       }
diff --git a/deps/v8/src/s390/frame-constants-s390.h b/deps/v8/src/s390/frame-constants-s390.h
index 3c2a4c89d31..54638f56bca 100644
--- a/deps/v8/src/s390/frame-constants-s390.h
+++ b/deps/v8/src/s390/frame-constants-s390.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_S390_FRAMES_S390_H_
-#define V8_S390_FRAMES_S390_H_
+#ifndef V8_S390_FRAME_CONSTANTS_S390_H_
+#define V8_S390_FRAME_CONSTANTS_S390_H_
 
 namespace v8 {
 namespace internal {
@@ -45,4 +45,4 @@ class JavaScriptFrameConstants : public AllStatic {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_S390_FRAMES_S390_H_
+#endif  // V8_S390_FRAME_CONSTANTS_S390_H_
diff --git a/deps/v8/src/s390/interface-descriptors-s390.cc b/deps/v8/src/s390/interface-descriptors-s390.cc
index 3cb4f2e375e..eae07393614 100644
--- a/deps/v8/src/s390/interface-descriptors-s390.cc
+++ b/deps/v8/src/s390/interface-descriptors-s390.cc
@@ -66,12 +66,6 @@ const Register MathPowIntegerDescriptor::exponent() {
 const Register GrowArrayElementsDescriptor::ObjectRegister() { return r2; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return r5; }
 
-void FastNewClosureDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {r3, r4, r5};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
 // static
 const Register TypeConversionDescriptor::ArgumentRegister() { return r2; }
 
diff --git a/deps/v8/src/s390/macro-assembler-s390.cc b/deps/v8/src/s390/macro-assembler-s390.cc
index fe248843786..51fabde76c1 100644
--- a/deps/v8/src/s390/macro-assembler-s390.cc
+++ b/deps/v8/src/s390/macro-assembler-s390.cc
@@ -15,6 +15,7 @@
 #include "src/debug/debug.h"
 #include "src/external-reference-table.h"
 #include "src/frames-inl.h"
+#include "src/instruction-stream.h"
 #include "src/register-configuration.h"
 #include "src/runtime/runtime.h"
 
@@ -160,7 +161,7 @@ void TurboAssembler::Call(Register target) {
 }
 
 void MacroAssembler::CallJSEntry(Register target) {
-  DCHECK(target == ip);
+  DCHECK(target == r4);
   Call(target);
 }
 
@@ -1049,7 +1050,7 @@ void MacroAssembler::LeaveExitFrame(bool save_doubles, Register argument_count,
   // Clear top frame.
   mov(ip, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
                                     isolate())));
-  StoreP(MemOperand(ip), Operand(0, kRelocInfo_NONEPTR), r0);
+  StoreP(MemOperand(ip), Operand(0, RelocInfo::NONE), r0);
 
   // Restore current context from top and clear it in debug mode.
   mov(ip,
@@ -1216,12 +1217,13 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
                                     const ParameterCount& expected,
                                     const ParameterCount& actual) {
   Label skip_hook;
+
   ExternalReference debug_hook_avtive =
       ExternalReference::debug_hook_on_function_call_address(isolate());
   mov(r6, Operand(debug_hook_avtive));
-  LoadB(r6, MemOperand(r6));
-  CmpP(r6, Operand::Zero());
-  beq(&skip_hook);
+  tm(MemOperand(r6), Operand::Zero());
+  bne(&skip_hook);
+
   {
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
@@ -1279,7 +1281,7 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
     // We call indirectly through the code field in the function to
     // allow recompilation to take effect without changing any of the
     // call sites.
-    Register code = ip;
+    Register code = kJavaScriptCallCodeStartRegister;
     LoadP(code, FieldMemOperand(function, JSFunction::kCodeOffset));
     AddP(code, code, Operand(Code::kHeaderSize - kHeapObjectTag));
     if (flag == CALL_FUNCTION) {
@@ -1332,14 +1334,6 @@ void MacroAssembler::InvokeFunction(Register function,
   InvokeFunctionCode(r3, no_reg, expected, actual, flag);
 }
 
-void MacroAssembler::InvokeFunction(Handle<JSFunction> function,
-                                    const ParameterCount& expected,
-                                    const ParameterCount& actual,
-                                    InvokeFlag flag) {
-  Move(r3, function);
-  InvokeFunction(r3, expected, actual, flag);
-}
-
 void MacroAssembler::MaybeDropFrames() {
   // Check whether we need to drop frames to restart a function on the stack.
   ExternalReference restart_fp =
@@ -1529,6 +1523,20 @@ void MacroAssembler::JumpToExternalReference(const ExternalReference& builtin,
   Jump(stub.GetCode(), RelocInfo::CODE_TARGET);
 }
 
+void MacroAssembler::JumpToInstructionStream(Address entry) {
+  mov(kOffHeapTrampolineRegister,
+      Operand(reinterpret_cast<intptr_t>(entry), RelocInfo::OFF_HEAP_TARGET));
+  Jump(kOffHeapTrampolineRegister);
+}
+
+void MacroAssembler::LoadWeakValue(Register out, Register in,
+                                   Label* target_if_cleared) {
+  CmpP(in, Operand(kClearedWeakHeapObject));
+  beq(target_if_cleared);
+
+  AndP(out, in, Operand(~kWeakHeapObjectMask));
+}
+
 void MacroAssembler::IncrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK(value > 0 && is_int8(value));
@@ -1646,6 +1654,18 @@ void MacroAssembler::AssertFixedArray(Register object) {
   }
 }
 
+void MacroAssembler::AssertConstructor(Register object, Register scratch) {
+  if (emit_debug_code()) {
+    STATIC_ASSERT(kSmiTag == 0);
+    TestIfSmi(object);
+    Check(ne, AbortReason::kOperandIsASmiAndNotAConstructor);
+    LoadP(scratch, FieldMemOperand(object, HeapObject::kMapOffset));
+    tm(FieldMemOperand(scratch, Map::kBitFieldOffset),
+       Operand(Map::IsConstructorBit::kMask));
+    Check(ne, AbortReason::kOperandIsNotAConstructor);
+  }
+}
+
 void MacroAssembler::AssertFunction(Register object) {
   if (emit_debug_code()) {
     STATIC_ASSERT(kSmiTag == 0);
@@ -1947,7 +1967,7 @@ void TurboAssembler::mov(Register dst, const Operand& src) {
     value = src.immediate();
   }
 
-  if (src.rmode() != kRelocInfo_NONEPTR) {
+  if (src.rmode() != RelocInfo::NONE) {
     // some form of relocation needed
     RecordRelocInfo(src.rmode(), value);
   }
@@ -3166,7 +3186,7 @@ void TurboAssembler::CmpP(Register src1, Register src2) {
 // Compare 32-bit Register vs Immediate
 // This helper will set up proper relocation entries if required.
 void TurboAssembler::Cmp32(Register dst, const Operand& opnd) {
-  if (opnd.rmode() == kRelocInfo_NONEPTR) {
+  if (opnd.rmode() == RelocInfo::NONE) {
     intptr_t value = opnd.immediate();
     if (is_int16(value))
       chi(dst, opnd);
@@ -3183,7 +3203,7 @@ void TurboAssembler::Cmp32(Register dst, const Operand& opnd) {
 // This helper will set up proper relocation entries if required.
 void TurboAssembler::CmpP(Register dst, const Operand& opnd) {
 #if V8_TARGET_ARCH_S390X
-  if (opnd.rmode() == kRelocInfo_NONEPTR) {
+  if (opnd.rmode() == RelocInfo::NONE) {
     cgfi(dst, opnd);
   } else {
     mov(r0, opnd);  // Need to generate 64-bit relocation
@@ -3470,7 +3490,7 @@ void TurboAssembler::StoreP(Register src, const MemOperand& mem,
 void TurboAssembler::StoreP(const MemOperand& mem, const Operand& opnd,
                             Register scratch) {
   // Relocations not supported
-  DCHECK_EQ(opnd.rmode(), kRelocInfo_NONEPTR);
+  DCHECK_EQ(opnd.rmode(), RelocInfo::NONE);
 
   // Try to use MVGHI/MVHI
   if (CpuFeatures::IsSupported(GENERAL_INSTR_EXT) && is_uint12(mem.offset()) &&
@@ -4269,6 +4289,10 @@ bool AreAliased(DoubleRegister reg1, DoubleRegister reg2, DoubleRegister reg3,
 }
 #endif
 
+void TurboAssembler::ResetSpeculationPoisonRegister() {
+  mov(kSpeculationPoisonRegister, Operand(-1));
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/s390/macro-assembler-s390.h b/deps/v8/src/s390/macro-assembler-s390.h
index fcc62f21a98..2e68dab5466 100644
--- a/deps/v8/src/s390/macro-assembler-s390.h
+++ b/deps/v8/src/s390/macro-assembler-s390.h
@@ -14,20 +14,23 @@ namespace v8 {
 namespace internal {
 
 // Give alias names to registers for calling conventions.
-const Register kReturnRegister0 = r2;
-const Register kReturnRegister1 = r3;
-const Register kReturnRegister2 = r4;
-const Register kJSFunctionRegister = r3;
-const Register kContextRegister = r13;
-const Register kAllocateSizeRegister = r3;
-const Register kInterpreterAccumulatorRegister = r2;
-const Register kInterpreterBytecodeOffsetRegister = r6;
-const Register kInterpreterBytecodeArrayRegister = r7;
-const Register kInterpreterDispatchTableRegister = r8;
-const Register kJavaScriptCallArgCountRegister = r2;
-const Register kJavaScriptCallNewTargetRegister = r5;
-const Register kRuntimeCallFunctionRegister = r3;
-const Register kRuntimeCallArgCountRegister = r2;
+constexpr Register kReturnRegister0 = r2;
+constexpr Register kReturnRegister1 = r3;
+constexpr Register kReturnRegister2 = r4;
+constexpr Register kJSFunctionRegister = r3;
+constexpr Register kContextRegister = r13;
+constexpr Register kAllocateSizeRegister = r3;
+constexpr Register kSpeculationPoisonRegister = r9;
+constexpr Register kInterpreterAccumulatorRegister = r2;
+constexpr Register kInterpreterBytecodeOffsetRegister = r6;
+constexpr Register kInterpreterBytecodeArrayRegister = r7;
+constexpr Register kInterpreterDispatchTableRegister = r8;
+constexpr Register kJavaScriptCallArgCountRegister = r2;
+constexpr Register kJavaScriptCallNewTargetRegister = r5;
+constexpr Register kJavaScriptCallCodeStartRegister = r4;
+constexpr Register kOffHeapTrampolineRegister = ip;
+constexpr Register kRuntimeCallFunctionRegister = r3;
+constexpr Register kRuntimeCallArgCountRegister = r2;
 
 // ----------------------------------------------------------------------------
 // Static helper functions
@@ -986,10 +989,16 @@ class TurboAssembler : public Assembler {
     // High bits must be identical to fit into an 32-bit integer
     cgfr(value, value);
   }
-  void SmiUntag(Register reg) { SmiUntag(reg, reg); }
+  void SmiUntag(Register reg, int scale = 0) { SmiUntag(reg, reg, scale); }
 
-  void SmiUntag(Register dst, Register src) {
-    ShiftRightArithP(dst, src, Operand(kSmiShift));
+  void SmiUntag(Register dst, Register src, int scale = 0) {
+    if (scale > kSmiShift) {
+      ShiftLeftP(dst, src, Operand(scale - kSmiShift));
+    } else if (scale < kSmiShift) {
+      ShiftRightArithP(dst, src, Operand(kSmiShift - scale));
+    } else {
+      // do nothing
+    }
   }
 
   // Activation support.
@@ -1001,6 +1010,8 @@ class TurboAssembler : public Assembler {
   void CheckPageFlag(Register object, Register scratch, int mask, Condition cc,
                      Label* condition_met);
 
+  void ResetSpeculationPoisonRegister();
+
  private:
   static const int kSmiShift = kSmiTagSize + kSmiShiftSize;
 
@@ -1082,6 +1093,9 @@ class MacroAssembler : public TurboAssembler {
   void JumpToExternalReference(const ExternalReference& builtin,
                                bool builtin_exit_frame = false);
 
+  // Generates a trampoline to jump to the off-heap instruction stream.
+  void JumpToInstructionStream(Address entry);
+
   // Compare the object in a register to a value and jump if they are equal.
   void JumpIfRoot(Register with, Heap::RootListIndex index, Label* if_equal) {
     CompareRoot(with, index);
@@ -1100,6 +1114,10 @@ class MacroAssembler : public TurboAssembler {
   void TryDoubleToInt32Exact(Register result, DoubleRegister double_input,
                              Register scratch, DoubleRegister double_scratch);
 
+  // ---------------------------------------------------------------------------
+  // In-place weak references.
+  void LoadWeakValue(Register out, Register in, Label* target_if_cleared);
+
   // ---------------------------------------------------------------------------
   // StatsCounter support
 
@@ -1139,10 +1157,6 @@ class MacroAssembler : public TurboAssembler {
   void InvokeFunction(Register function, const ParameterCount& expected,
                       const ParameterCount& actual, InvokeFlag flag);
 
-  void InvokeFunction(Handle<JSFunction> function,
-                      const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
-
   // Frame restart support
   void MaybeDropFrames();
 
@@ -1224,6 +1238,10 @@ class MacroAssembler : public TurboAssembler {
   // Abort execution if argument is not a FixedArray, enabled via --debug-code.
   void AssertFixedArray(Register object);
 
+  // Abort execution if argument is not a Constructor, enabled via --debug-code.
+  void AssertConstructor(Register object, Register scratch);
+
+  // Abort execution if argument is not a JSFunction, enabled via --debug-code.
   void AssertFunction(Register object);
 
   // Abort execution if argument is not a JSBoundFunction,
diff --git a/deps/v8/src/s390/simulator-s390.cc b/deps/v8/src/s390/simulator-s390.cc
index f6754bdd4b7..73ca0d5a8ac 100644
--- a/deps/v8/src/s390/simulator-s390.cc
+++ b/deps/v8/src/s390/simulator-s390.cc
@@ -640,7 +640,7 @@ void S390Debugger::Debug() {
 #undef XSTR
 }
 
-static bool ICacheMatch(void* one, void* two) {
+bool Simulator::ICacheMatch(void* one, void* two) {
   DCHECK_EQ(reinterpret_cast<intptr_t>(one) & CachePage::kPageMask, 0);
   DCHECK_EQ(reinterpret_cast<intptr_t>(two) & CachePage::kPageMask, 0);
   return one == two;
@@ -1488,11 +1488,6 @@ void Simulator::EvalTableInit() {
 }  // NOLINT
 
 Simulator::Simulator(Isolate* isolate) : isolate_(isolate) {
-  i_cache_ = isolate_->simulator_i_cache();
-  if (i_cache_ == nullptr) {
-    i_cache_ = new base::CustomMatcherHashMap(&ICacheMatch);
-    isolate_->set_simulator_i_cache(i_cache_);
-  }
   static base::OnceType once = V8_ONCE_INIT;
   base::CallOnce(&once, &Simulator::EvalTableInit);
 // Set up simulator support first. Some of this information is needed to
@@ -2332,7 +2327,7 @@ void Simulator::ExecuteInstruction(Instruction* instr, bool auto_incr_pc) {
   icount_++;
 
   if (v8::internal::FLAG_check_icache) {
-    CheckICache(isolate_->simulator_i_cache(), instr);
+    CheckICache(i_cache(), instr);
   }
 
   pc_modified_ = false;
diff --git a/deps/v8/src/s390/simulator-s390.h b/deps/v8/src/s390/simulator-s390.h
index 1ff8020e6a7..7c4eb74b6c0 100644
--- a/deps/v8/src/s390/simulator-s390.h
+++ b/deps/v8/src/s390/simulator-s390.h
@@ -187,6 +187,7 @@ class Simulator : public SimulatorBase {
   static void SetRedirectInstruction(Instruction* instruction);
 
   // ICache checking.
+  static bool ICacheMatch(void* one, void* two);
   static void FlushICache(base::CustomMatcherHashMap* i_cache, void* start,
                           size_t size);
 
@@ -425,9 +426,6 @@ class Simulator : public SimulatorBase {
   // Debugger input.
   char* last_debugger_input_;
 
-  // Icache simulation
-  base::CustomMatcherHashMap* i_cache_;
-
   // Registered breakpoints.
   Instruction* break_pc_;
   Instr break_instr_;
diff --git a/deps/v8/src/safepoint-table.cc b/deps/v8/src/safepoint-table.cc
index 83031a2f36c..176693d2aa5 100644
--- a/deps/v8/src/safepoint-table.cc
+++ b/deps/v8/src/safepoint-table.cc
@@ -51,7 +51,7 @@ SafepointTable::SafepointTable(Address instruction_start,
 }
 
 SafepointTable::SafepointTable(Code* code)
-    : SafepointTable(code->instruction_start(), code->safepoint_table_offset(),
+    : SafepointTable(code->InstructionStart(), code->safepoint_table_offset(),
                      code->stack_slots(), true) {}
 
 unsigned SafepointTable::find_return_pc(unsigned pc_offset) {
diff --git a/deps/v8/src/simulator-base.cc b/deps/v8/src/simulator-base.cc
index 72a5daefce1..f075ad72ac2 100644
--- a/deps/v8/src/simulator-base.cc
+++ b/deps/v8/src/simulator-base.cc
@@ -19,10 +19,22 @@ base::Mutex* SimulatorBase::redirection_mutex_ = nullptr;
 // static
 Redirection* SimulatorBase::redirection_ = nullptr;
 
+// static
+base::Mutex* SimulatorBase::i_cache_mutex_ = nullptr;
+
+// static
+base::CustomMatcherHashMap* SimulatorBase::i_cache_ = nullptr;
+
 // static
 void SimulatorBase::InitializeOncePerProcess() {
   DCHECK_NULL(redirection_mutex_);
   redirection_mutex_ = new base::Mutex();
+
+  DCHECK_NULL(i_cache_mutex_);
+  i_cache_mutex_ = new base::Mutex();
+
+  DCHECK_NULL(i_cache_);
+  i_cache_ = new base::CustomMatcherHashMap(&Simulator::ICacheMatch);
 }
 
 // static
@@ -32,40 +44,40 @@ void SimulatorBase::GlobalTearDown() {
 
   Redirection::DeleteChain(redirection_);
   redirection_ = nullptr;
-}
 
-// static
-void SimulatorBase::Initialize(Isolate* isolate) {
-  ExternalReference::set_redirector(isolate, &RedirectExternalReference);
-}
+  delete i_cache_mutex_;
+  i_cache_mutex_ = nullptr;
 
-// static
-void SimulatorBase::TearDown(base::CustomMatcherHashMap* i_cache) {
-  if (i_cache != nullptr) {
-    for (base::HashMap::Entry* entry = i_cache->Start(); entry != nullptr;
-         entry = i_cache->Next(entry)) {
+  if (i_cache_ != nullptr) {
+    for (base::HashMap::Entry* entry = i_cache_->Start(); entry != nullptr;
+         entry = i_cache_->Next(entry)) {
       delete static_cast<CachePage*>(entry->value);
     }
-    delete i_cache;
   }
+  delete i_cache_;
+  i_cache_ = nullptr;
+}
+
+// static
+void SimulatorBase::Initialize(Isolate* isolate) {
+  ExternalReference::set_redirector(isolate, &RedirectExternalReference);
 }
 
 // static
-void* SimulatorBase::RedirectExternalReference(Isolate* isolate,
-                                               void* external_function,
+void* SimulatorBase::RedirectExternalReference(void* external_function,
                                                ExternalReference::Type type) {
   base::LockGuard<base::Mutex> lock_guard(Simulator::redirection_mutex());
-  Redirection* redirection = Redirection::Get(isolate, external_function, type);
+  Redirection* redirection = Redirection::Get(external_function, type);
   return redirection->address_of_instruction();
 }
 
-Redirection::Redirection(Isolate* isolate, void* external_function,
-                         ExternalReference::Type type)
+Redirection::Redirection(void* external_function, ExternalReference::Type type)
     : external_function_(external_function), type_(type), next_(nullptr) {
   next_ = Simulator::redirection();
+  base::LockGuard<base::Mutex> lock_guard(Simulator::i_cache_mutex());
   Simulator::SetRedirectInstruction(
       reinterpret_cast<Instruction*>(address_of_instruction()));
-  Simulator::FlushICache(isolate->simulator_i_cache(),
+  Simulator::FlushICache(Simulator::i_cache(),
                          reinterpret_cast<void*>(&instruction_),
                          sizeof(instruction_));
   Simulator::set_redirection(this);
@@ -77,7 +89,7 @@ Redirection::Redirection(Isolate* isolate, void* external_function,
 }
 
 // static
-Redirection* Redirection::Get(Isolate* isolate, void* external_function,
+Redirection* Redirection::Get(void* external_function,
                               ExternalReference::Type type) {
   Redirection* current = Simulator::redirection();
   for (; current != nullptr; current = current->next_) {
@@ -86,7 +98,7 @@ Redirection* Redirection::Get(Isolate* isolate, void* external_function,
       return current;
     }
   }
-  return new Redirection(isolate, external_function, type);
+  return new Redirection(external_function, type);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/simulator-base.h b/deps/v8/src/simulator-base.h
index 84c1f2fd5b8..9564af8a2e7 100644
--- a/deps/v8/src/simulator-base.h
+++ b/deps/v8/src/simulator-base.h
@@ -9,6 +9,7 @@
 
 #include "src/assembler.h"
 #include "src/globals.h"
+#include "src/isolate.h"
 
 #if defined(USE_SIMULATOR)
 
@@ -24,26 +25,28 @@ class SimulatorBase {
   static void InitializeOncePerProcess();
   static void GlobalTearDown();
 
-  // Call on isolate initialization and teardown.
+  // Call on isolate initialization.
   static void Initialize(Isolate* isolate);
-  static void TearDown(base::CustomMatcherHashMap* i_cache);
 
   static base::Mutex* redirection_mutex() { return redirection_mutex_; }
   static Redirection* redirection() { return redirection_; }
   static void set_redirection(Redirection* r) { redirection_ = r; }
 
+  static base::Mutex* i_cache_mutex() { return i_cache_mutex_; }
+  static base::CustomMatcherHashMap* i_cache() { return i_cache_; }
+
  protected:
   template <typename Return, typename SimT, typename CallImpl, typename... Args>
   static Return VariadicCall(SimT* sim, CallImpl call, byte* entry,
                              Args... args) {
     // Convert all arguments to intptr_t. Fails if any argument is not integral
     // or pointer.
-    std::array<intptr_t, sizeof...(args)> args_arr{ConvertArg(args)...};
+    std::array<intptr_t, sizeof...(args)> args_arr{{ConvertArg(args)...}};
     intptr_t ret = (sim->*call)(entry, args_arr.size(), args_arr.data());
     return ConvertReturn<Return>(ret);
   }
 
-  // Convert back integral return types.
+  // Convert back integral return types. This is always a narrowing conversion.
   template <typename T>
   static typename std::enable_if<std::is_integral<T>::value, T>::type
   ConvertReturn(intptr_t ret) {
@@ -64,14 +67,16 @@ class SimulatorBase {
       intptr_t ret) {}
 
  private:
-  // Runtime call support. Uses the isolate in a thread-safe way.
-  static void* RedirectExternalReference(Isolate* isolate,
-                                         void* external_function,
+  // Runtime call support.
+  static void* RedirectExternalReference(void* external_function,
                                          ExternalReference::Type type);
 
   static base::Mutex* redirection_mutex_;
   static Redirection* redirection_;
 
+  static base::Mutex* i_cache_mutex_;
+  static base::CustomMatcherHashMap* i_cache_;
+
   // Helper methods to convert arbitrary integer or pointer arguments to the
   // needed generic argument type intptr_t.
 
@@ -80,7 +85,16 @@ class SimulatorBase {
   static typename std::enable_if<std::is_integral<T>::value, intptr_t>::type
   ConvertArg(T arg) {
     static_assert(sizeof(T) <= sizeof(intptr_t), "type bigger than ptrsize");
+#if V8_TARGET_ARCH_MIPS64
+    // The MIPS64 calling convention is to sign extend all values, even unsigned
+    // ones.
+    using signed_t = typename std::make_signed<T>::type;
+    return static_cast<intptr_t>(static_cast<signed_t>(arg));
+#else
+    // Standard C++ convertion: Sign-extend signed values, zero-extend unsigned
+    // values.
     return static_cast<intptr_t>(arg);
+#endif
   }
 
   // Convert pointer-typed argument to intptr_t.
@@ -108,8 +122,7 @@ class SimulatorBase {
 //  - V8_TARGET_ARCH_S390: svc (Supervisor Call)
 class Redirection {
  public:
-  Redirection(Isolate* isolate, void* external_function,
-              ExternalReference::Type type);
+  Redirection(void* external_function, ExternalReference::Type type);
 
   Address address_of_instruction() {
 #if ABI_USES_FUNCTION_DESCRIPTORS
@@ -122,7 +135,7 @@ class Redirection {
   void* external_function() { return external_function_; }
   ExternalReference::Type type() { return type_; }
 
-  static Redirection* Get(Isolate* isolate, void* external_function,
+  static Redirection* Get(void* external_function,
                           ExternalReference::Type type);
 
   static Redirection* FromInstruction(Instruction* instruction) {
diff --git a/deps/v8/src/snapshot/builtin-deserializer-allocator.h b/deps/v8/src/snapshot/builtin-deserializer-allocator.h
index eb04b54025a..207f02811af 100644
--- a/deps/v8/src/snapshot/builtin-deserializer-allocator.h
+++ b/deps/v8/src/snapshot/builtin-deserializer-allocator.h
@@ -57,6 +57,20 @@ class BuiltinDeserializerAllocator final {
   void MoveToNextChunk(AllocationSpace space) { UNREACHABLE(); }
   void SetAlignment(AllocationAlignment alignment) { UNREACHABLE(); }
 
+  void set_next_reference_is_weak(bool next_reference_is_weak) {
+    next_reference_is_weak_ = next_reference_is_weak;
+  }
+
+  bool GetAndClearNextReferenceIsWeak() {
+    bool saved = next_reference_is_weak_;
+    next_reference_is_weak_ = false;
+    return saved;
+  }
+
+#ifdef DEBUG
+  bool next_reference_is_weak() const { return next_reference_is_weak_; }
+#endif
+
   HeapObject* GetMap(uint32_t index) { UNREACHABLE(); }
   HeapObject* GetLargeObject(uint32_t index) { UNREACHABLE(); }
   HeapObject* GetObject(AllocationSpace space, uint32_t chunk_index,
@@ -123,6 +137,8 @@ class BuiltinDeserializerAllocator final {
   // deserialization.
   Address handler_allocation_ = nullptr;
 
+  bool next_reference_is_weak_ = false;
+
   DISALLOW_COPY_AND_ASSIGN(BuiltinDeserializerAllocator)
 };
 
diff --git a/deps/v8/src/snapshot/builtin-deserializer.cc b/deps/v8/src/snapshot/builtin-deserializer.cc
index 53a0f30612d..aa9eb7dbf87 100644
--- a/deps/v8/src/snapshot/builtin-deserializer.cc
+++ b/deps/v8/src/snapshot/builtin-deserializer.cc
@@ -109,14 +109,39 @@ void BuiltinDeserializer::DeserializeEagerBuiltinsAndHandlers() {
 Code* BuiltinDeserializer::DeserializeBuiltin(int builtin_id) {
   allocator()->ReserveAndInitializeBuiltinsTableForBuiltin(builtin_id);
   DisallowHeapAllocation no_gc;
-  return DeserializeBuiltinRaw(builtin_id);
+  Code* code = DeserializeBuiltinRaw(builtin_id);
+
+#ifdef ENABLE_DISASSEMBLER
+  if (FLAG_print_builtin_code) {
+    CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
+    OFStream os(tracing_scope.file());
+
+    DCHECK(isolate()->builtins()->is_initialized());
+    code->Disassemble(Builtins::name(builtin_id), os);
+    os << std::flush;
+  }
+#endif  // ENABLE_DISASSEMBLER
+
+  return code;
 }
 
 Code* BuiltinDeserializer::DeserializeHandler(Bytecode bytecode,
                                               OperandScale operand_scale) {
   allocator()->ReserveForHandler(bytecode, operand_scale);
   DisallowHeapAllocation no_gc;
-  return DeserializeHandlerRaw(bytecode, operand_scale);
+  Code* code = DeserializeHandlerRaw(bytecode, operand_scale);
+
+#ifdef ENABLE_DISASSEMBLER
+  if (FLAG_print_builtin_code) {
+    CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
+    OFStream os(tracing_scope.file());
+
+    code->Disassemble(Bytecodes::ToString(bytecode), os);
+    os << std::flush;
+  }
+#endif  // ENABLE_DISASSEMBLER
+
+  return code;
 }
 
 Code* BuiltinDeserializer::DeserializeBuiltinRaw(int builtin_id) {
@@ -136,9 +161,15 @@ Code* BuiltinDeserializer::DeserializeBuiltinRaw(int builtin_id) {
 
   // Flush the instruction cache.
   Code* code = Code::cast(o);
-  Assembler::FlushICache(isolate(), code->instruction_start(),
-                         code->instruction_size());
-
+  Assembler::FlushICache(code->instruction_start(), code->instruction_size());
+
+  PROFILE(isolate(), CodeCreateEvent(CodeEventListener::BUILTIN_TAG,
+                                     AbstractCode::cast(code),
+                                     Builtins::name(builtin_id)));
+  LOG_CODE_EVENT(isolate(),
+                 CodeLinePosInfoRecordEvent(
+                     code->instruction_start(),
+                     ByteArray::cast(code->source_position_table())));
   return code;
 }
 
@@ -161,9 +192,15 @@ Code* BuiltinDeserializer::DeserializeHandlerRaw(Bytecode bytecode,
 
   // Flush the instruction cache.
   Code* code = Code::cast(o);
-  Assembler::FlushICache(isolate(), code->instruction_start(),
-                         code->instruction_size());
+  Assembler::FlushICache(code->instruction_start(), code->instruction_size());
 
+  const char* handler_name =
+      isolate()->interpreter()->LookupNameOfBytecodeHandler(code);
+  if (handler_name == nullptr) {
+    handler_name = "UnknownBytecodeHadler";
+  }
+  PROFILE(isolate(), CodeCreateEvent(CodeEventListener::HANDLER_TAG,
+                                     AbstractCode::cast(code), handler_name));
   return code;
 }
 
diff --git a/deps/v8/src/snapshot/builtin-deserializer.h b/deps/v8/src/snapshot/builtin-deserializer.h
index 38ba2fecea4..1ae49686b8b 100644
--- a/deps/v8/src/snapshot/builtin-deserializer.h
+++ b/deps/v8/src/snapshot/builtin-deserializer.h
@@ -56,7 +56,8 @@ class BuiltinDeserializer final
 
   // BuiltinDeserializer implements its own builtin iteration logic. Make sure
   // the RootVisitor API is not used accidentally.
-  void VisitRootPointers(Root root, Object** start, Object** end) override {
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {
     UNREACHABLE();
   }
 
diff --git a/deps/v8/src/snapshot/builtin-serializer-allocator.cc b/deps/v8/src/snapshot/builtin-serializer-allocator.cc
index dbb5789721e..af33e1ee498 100644
--- a/deps/v8/src/snapshot/builtin-serializer-allocator.cc
+++ b/deps/v8/src/snapshot/builtin-serializer-allocator.cc
@@ -49,14 +49,12 @@ void BuiltinSerializerAllocator::OutputStatistics() {
 
   PrintF("  Spaces (bytes):\n");
 
-  STATIC_ASSERT(NEW_SPACE == 0);
-  for (int space = 0; space < kNumberOfSpaces; space++) {
+  for (int space = FIRST_SPACE; space < kNumberOfSpaces; space++) {
     PrintF("%16s", AllocationSpaceName(static_cast<AllocationSpace>(space)));
   }
   PrintF("\n");
 
-  STATIC_ASSERT(NEW_SPACE == 0);
-  for (int space = 0; space < kNumberOfSpaces; space++) {
+  for (int space = FIRST_SPACE; space < kNumberOfSpaces; space++) {
     uint32_t space_size = (space == CODE_SPACE) ? virtual_chunk_size_ : 0;
     PrintF("%16d", space_size);
   }
diff --git a/deps/v8/src/snapshot/builtin-serializer.cc b/deps/v8/src/snapshot/builtin-serializer.cc
index 893c79c05e6..0109a85b6b0 100644
--- a/deps/v8/src/snapshot/builtin-serializer.cc
+++ b/deps/v8/src/snapshot/builtin-serializer.cc
@@ -65,8 +65,8 @@ void BuiltinSerializer::SerializeBuiltinsAndHandlers() {
   sink_.PutRaw(data, data_length, "BuiltinOffsets");
 }
 
-void BuiltinSerializer::VisitRootPointers(Root root, Object** start,
-                                          Object** end) {
+void BuiltinSerializer::VisitRootPointers(Root root, const char* description,
+                                          Object** start, Object** end) {
   UNREACHABLE();  // We iterate manually in SerializeBuiltins.
 }
 
diff --git a/deps/v8/src/snapshot/builtin-serializer.h b/deps/v8/src/snapshot/builtin-serializer.h
index bb8bbdebfad..abc8be74e5a 100644
--- a/deps/v8/src/snapshot/builtin-serializer.h
+++ b/deps/v8/src/snapshot/builtin-serializer.h
@@ -28,7 +28,8 @@ class BuiltinSerializer : public Serializer<BuiltinSerializerAllocator> {
   void SerializeBuiltinsAndHandlers();
 
  private:
-  void VisitRootPointers(Root root, Object** start, Object** end) override;
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override;
 
   void SerializeBuiltin(Code* code);
   void SerializeHandler(Code* code);
diff --git a/deps/v8/src/snapshot/code-serializer.cc b/deps/v8/src/snapshot/code-serializer.cc
index 42108455734..e3182d5e77b 100644
--- a/deps/v8/src/snapshot/code-serializer.cc
+++ b/deps/v8/src/snapshot/code-serializer.cc
@@ -13,46 +13,73 @@
 #include "src/objects-inl.h"
 #include "src/snapshot/object-deserializer.h"
 #include "src/snapshot/snapshot.h"
-#include "src/trap-handler/trap-handler.h"
 #include "src/version.h"
 #include "src/visitors.h"
-#include "src/wasm/wasm-module.h"
-#include "src/wasm/wasm-objects-inl.h"
 
 namespace v8 {
 namespace internal {
 
-ScriptData* CodeSerializer::Serialize(Isolate* isolate,
-                                      Handle<SharedFunctionInfo> info,
-                                      Handle<String> source) {
+ScriptData::ScriptData(const byte* data, int length)
+    : owns_data_(false), rejected_(false), data_(data), length_(length) {
+  if (!IsAligned(reinterpret_cast<intptr_t>(data), kPointerAlignment)) {
+    byte* copy = NewArray<byte>(length);
+    DCHECK(IsAligned(reinterpret_cast<intptr_t>(copy), kPointerAlignment));
+    CopyBytes(copy, data, length);
+    data_ = copy;
+    AcquireDataOwnership();
+  }
+}
+
+// static
+ScriptCompiler::CachedData* CodeSerializer::Serialize(
+    Handle<SharedFunctionInfo> info, Handle<String> source) {
+  Isolate* isolate = info->GetIsolate();
+  TRACE_EVENT_CALL_STATS_SCOPED(isolate, "v8", "V8.Execute");
+  HistogramTimerScope histogram_timer(isolate->counters()->compile_serialize());
+  RuntimeCallTimerScope runtimeTimer(isolate,
+                                     RuntimeCallCounterId::kCompileSerialize);
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"), "V8.CompileSerialize");
+
   base::ElapsedTimer timer;
   if (FLAG_profile_deserialization) timer.Start();
+  Handle<Script> script(Script::cast(info->script()), isolate);
   if (FLAG_trace_serializer) {
     PrintF("[Serializing from");
     Object* script = info->script();
-    if (script->IsScript()) Script::cast(script)->name()->ShortPrint();
+    Script::cast(script)->name()->ShortPrint();
     PrintF("]\n");
   }
+  // TODO(7110): Enable serialization of Asm modules once the AsmWasmData is
+  // context independent.
+  if (script->ContainsAsmModule()) return nullptr;
+  if (isolate->debug()->is_loaded()) return nullptr;
 
   // Serialize code object.
   CodeSerializer cs(isolate, SerializedCodeData::SourceHash(source));
   DisallowHeapAllocation no_gc;
   cs.reference_map()->AddAttachedReference(*source);
-  ScriptData* ret = cs.Serialize(info);
+  ScriptData* script_data = cs.Serialize(info);
 
   if (FLAG_profile_deserialization) {
     double ms = timer.Elapsed().InMillisecondsF();
-    int length = ret->length();
+    int length = script_data->length();
     PrintF("[Serializing to %d bytes took %0.3f ms]\n", length, ms);
   }
 
-  return ret;
+  ScriptCompiler::CachedData* result =
+      new ScriptCompiler::CachedData(script_data->data(), script_data->length(),
+                                     ScriptCompiler::CachedData::BufferOwned);
+  script_data->ReleaseDataOwnership();
+  delete script_data;
+
+  return result;
 }
 
 ScriptData* CodeSerializer::Serialize(Handle<HeapObject> obj) {
   DisallowHeapAllocation no_gc;
 
-  VisitRootPointer(Root::kHandleScope, Handle<Object>::cast(obj).location());
+  VisitRootPointer(Root::kHandleScope, nullptr,
+                   Handle<Object>::cast(obj).location());
   SerializeDeferredObjects();
   Pad();
 
@@ -134,14 +161,16 @@ void CodeSerializer::SerializeObject(HeapObject* obj, HowToCode how_to_code,
     // TODO(7110): Enable serializing of Asm modules once the AsmWasmData
     // is context independent.
     DCHECK(!sfi->IsApiFunction() && !sfi->HasAsmWasmData());
-    // Do not serialize when a debugger is active.
-    DCHECK(sfi->debug_info()->IsSmi());
+    // Clear debug info.
+    Object* debug_info = sfi->debug_info();
+    sfi->set_debug_info(Smi::kZero);
 
     // Mark SFI to indicate whether the code is cached.
     bool was_deserialized = sfi->deserialized();
     sfi->set_deserialized(sfi->is_compiled());
     SerializeGeneric(obj, how_to_code, where_to_point);
     sfi->set_deserialized(was_deserialized);
+    sfi->set_debug_info(debug_info);
     return;
   }
 
@@ -236,95 +265,12 @@ MaybeHandle<SharedFunctionInfo> CodeSerializer::Deserialize(
     PROFILE(isolate, CodeCreateEvent(CodeEventListener::SCRIPT_TAG,
                                      result->abstract_code(), *result, name));
   }
-  return scope.CloseAndEscape(result);
-}
-
-WasmCompiledModuleSerializer::WasmCompiledModuleSerializer(
-    Isolate* isolate, uint32_t source_hash, Handle<Context> native_context,
-    Handle<SeqOneByteString> module_bytes)
-    : CodeSerializer(isolate, source_hash) {
-  reference_map()->AddAttachedReference(*isolate->native_context());
-  reference_map()->AddAttachedReference(*module_bytes);
-}
-
-std::unique_ptr<ScriptData> WasmCompiledModuleSerializer::SerializeWasmModule(
-    Isolate* isolate, Handle<FixedArray> input) {
-  Handle<WasmCompiledModule> compiled_module =
-      Handle<WasmCompiledModule>::cast(input);
-  WasmCompiledModuleSerializer wasm_cs(
-      isolate, 0, isolate->native_context(),
-      handle(compiled_module->shared()->module_bytes()));
-  ScriptData* data = wasm_cs.Serialize(compiled_module);
-  return std::unique_ptr<ScriptData>(data);
-}
-
-MaybeHandle<FixedArray> WasmCompiledModuleSerializer::DeserializeWasmModule(
-    Isolate* isolate, ScriptData* data, Vector<const byte> wire_bytes) {
-  MaybeHandle<FixedArray> nothing;
-  if (!wasm::IsWasmCodegenAllowed(isolate, isolate->native_context())) {
-    return nothing;
-  }
-  SerializedCodeData::SanityCheckResult sanity_check_result =
-      SerializedCodeData::CHECK_SUCCESS;
-
-  const SerializedCodeData scd = SerializedCodeData::FromCachedData(
-      isolate, data, 0, &sanity_check_result);
-
-  if (sanity_check_result != SerializedCodeData::CHECK_SUCCESS) {
-    return nothing;
-  }
-
-  // TODO(6792): No longer needed once WebAssembly code is off heap.
-  CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
-  MaybeHandle<WasmCompiledModule> maybe_result =
-      ObjectDeserializer::DeserializeWasmCompiledModule(isolate, &scd,
-                                                        wire_bytes);
-
-  Handle<WasmCompiledModule> result;
-  if (!maybe_result.ToHandle(&result)) return nothing;
 
-  WasmCompiledModule::ReinitializeAfterDeserialization(isolate, result);
-  DCHECK(WasmCompiledModule::IsWasmCompiledModule(*result));
-  return result;
-}
-
-void WasmCompiledModuleSerializer::SerializeCodeObject(
-    Code* code_object, HowToCode how_to_code, WhereToPoint where_to_point) {
-  Code::Kind kind = code_object->kind();
-  switch (kind) {
-    case Code::WASM_FUNCTION:
-    case Code::JS_TO_WASM_FUNCTION: {
-      // TODO(6792): No longer needed once WebAssembly code is off heap.
-      CodeSpaceMemoryModificationScope modification_scope(isolate()->heap());
-      // Because the trap handler index is not meaningful across copies and
-      // serializations, we need to serialize it as kInvalidIndex. We do this by
-      // saving the old value, setting the index to kInvalidIndex and then
-      // restoring the old value.
-      const int old_trap_handler_index =
-          code_object->trap_handler_index()->value();
-      code_object->set_trap_handler_index(
-          Smi::FromInt(trap_handler::kInvalidIndex));
-
-      // Just serialize the code_object.
-      SerializeGeneric(code_object, how_to_code, where_to_point);
-      code_object->set_trap_handler_index(Smi::FromInt(old_trap_handler_index));
-      break;
-    }
-    case Code::WASM_INTERPRETER_ENTRY:
-    case Code::WASM_TO_JS_FUNCTION:
-    case Code::WASM_TO_WASM_FUNCTION:
-      // Serialize the illegal builtin instead. On instantiation of a
-      // deserialized module, these will be replaced again.
-      SerializeBuiltinReference(*BUILTIN_CODE(isolate(), Illegal), how_to_code,
-                                where_to_point, 0);
-      break;
-    default:
-      UNREACHABLE();
+  if (isolate->NeedsSourcePositionsForProfiling()) {
+    Handle<Script> script(Script::cast(result->script()), isolate);
+    Script::InitLineEnds(script);
   }
-}
-
-bool WasmCompiledModuleSerializer::ElideObject(Object* obj) {
-  return obj->IsWeakCell() || obj->IsForeign() || obj->IsBreakPointInfo();
+  return scope.CloseAndEscape(result);
 }
 
 class Checksum {
diff --git a/deps/v8/src/snapshot/code-serializer.h b/deps/v8/src/snapshot/code-serializer.h
index edc1c2bf1d6..9d8132344ce 100644
--- a/deps/v8/src/snapshot/code-serializer.h
+++ b/deps/v8/src/snapshot/code-serializer.h
@@ -11,11 +11,42 @@
 namespace v8 {
 namespace internal {
 
+class ScriptData {
+ public:
+  ScriptData(const byte* data, int length);
+  ~ScriptData() {
+    if (owns_data_) DeleteArray(data_);
+  }
+
+  const byte* data() const { return data_; }
+  int length() const { return length_; }
+  bool rejected() const { return rejected_; }
+
+  void Reject() { rejected_ = true; }
+
+  void AcquireDataOwnership() {
+    DCHECK(!owns_data_);
+    owns_data_ = true;
+  }
+
+  void ReleaseDataOwnership() {
+    DCHECK(owns_data_);
+    owns_data_ = false;
+  }
+
+ private:
+  bool owns_data_ : 1;
+  bool rejected_ : 1;
+  const byte* data_;
+  int length_;
+
+  DISALLOW_COPY_AND_ASSIGN(ScriptData);
+};
+
 class CodeSerializer : public Serializer<> {
  public:
-  static ScriptData* Serialize(Isolate* isolate,
-                               Handle<SharedFunctionInfo> info,
-                               Handle<String> source);
+  static ScriptCompiler::CachedData* Serialize(Handle<SharedFunctionInfo> info,
+                                               Handle<String> source);
 
   ScriptData* Serialize(Handle<HeapObject> obj);
 
@@ -53,25 +84,6 @@ class CodeSerializer : public Serializer<> {
   DISALLOW_COPY_AND_ASSIGN(CodeSerializer);
 };
 
-class WasmCompiledModuleSerializer : public CodeSerializer {
- public:
-  static std::unique_ptr<ScriptData> SerializeWasmModule(
-      Isolate* isolate, Handle<FixedArray> compiled_module);
-  static MaybeHandle<FixedArray> DeserializeWasmModule(
-      Isolate* isolate, ScriptData* data, Vector<const byte> wire_bytes);
-
- protected:
-  void SerializeCodeObject(Code* code_object, HowToCode how_to_code,
-                           WhereToPoint where_to_point) override;
-  bool ElideObject(Object* obj) override;
-
- private:
-  WasmCompiledModuleSerializer(Isolate* isolate, uint32_t source_hash,
-                               Handle<Context> native_context,
-                               Handle<SeqOneByteString> module_bytes);
-  DISALLOW_COPY_AND_ASSIGN(WasmCompiledModuleSerializer);
-};
-
 // Wrapper around ScriptData to provide code-serializer-specific functionality.
 class SerializedCodeData : public SerializedData {
  public:
diff --git a/deps/v8/src/snapshot/default-deserializer-allocator.cc b/deps/v8/src/snapshot/default-deserializer-allocator.cc
index 5b34bfa540e..37d57286bc4 100644
--- a/deps/v8/src/snapshot/default-deserializer-allocator.cc
+++ b/deps/v8/src/snapshot/default-deserializer-allocator.cc
@@ -122,9 +122,8 @@ HeapObject* DefaultDeserializerAllocator::GetObject(AllocationSpace space,
 
 void DefaultDeserializerAllocator::DecodeReservation(
     std::vector<SerializedData::Reservation> res) {
-  DCHECK_EQ(0, reservations_[NEW_SPACE].size());
-  STATIC_ASSERT(NEW_SPACE == 0);
-  int current_space = NEW_SPACE;
+  DCHECK_EQ(0, reservations_[FIRST_SPACE].size());
+  int current_space = FIRST_SPACE;
   for (auto& r : res) {
     reservations_[current_space].push_back({r.chunk_size(), NULL, NULL});
     if (r.is_last()) current_space++;
@@ -135,7 +134,7 @@ void DefaultDeserializerAllocator::DecodeReservation(
 
 bool DefaultDeserializerAllocator::ReserveSpace() {
 #ifdef DEBUG
-  for (int i = NEW_SPACE; i < kNumberOfSpaces; ++i) {
+  for (int i = FIRST_SPACE; i < kNumberOfSpaces; ++i) {
     DCHECK_GT(reservations_[i].size(), 0);
   }
 #endif  // DEBUG
@@ -153,8 +152,6 @@ bool DefaultDeserializerAllocator::ReserveSpace() {
 bool DefaultDeserializerAllocator::ReserveSpace(
     StartupDeserializer* startup_deserializer,
     BuiltinDeserializer* builtin_deserializer) {
-  const int first_space = NEW_SPACE;
-  const int last_space = SerializerDeserializer::kNumberOfSpaces;
   Isolate* isolate = startup_deserializer->isolate();
 
   // Create a set of merged reservations to reserve space in one go.
@@ -163,7 +160,7 @@ bool DefaultDeserializerAllocator::ReserveSpace(
   // Instead, we manually determine the required code-space.
 
   Heap::Reservation merged_reservations[kNumberOfSpaces];
-  for (int i = first_space; i < last_space; i++) {
+  for (int i = FIRST_SPACE; i < kNumberOfSpaces; i++) {
     merged_reservations[i] =
         startup_deserializer->allocator()->reservations_[i];
   }
@@ -206,12 +203,12 @@ bool DefaultDeserializerAllocator::ReserveSpace(
 
   // Write back startup reservations.
 
-  for (int i = first_space; i < last_space; i++) {
+  for (int i = FIRST_SPACE; i < kNumberOfSpaces; i++) {
     startup_deserializer->allocator()->reservations_[i].swap(
         merged_reservations[i]);
   }
 
-  for (int i = first_space; i < kNumberOfPreallocatedSpaces; i++) {
+  for (int i = FIRST_SPACE; i < kNumberOfPreallocatedSpaces; i++) {
     startup_deserializer->allocator()->high_water_[i] =
         startup_deserializer->allocator()->reservations_[i][0].start;
   }
diff --git a/deps/v8/src/snapshot/default-deserializer-allocator.h b/deps/v8/src/snapshot/default-deserializer-allocator.h
index 124c637fc69..e6a5ba3fdcc 100644
--- a/deps/v8/src/snapshot/default-deserializer-allocator.h
+++ b/deps/v8/src/snapshot/default-deserializer-allocator.h
@@ -36,6 +36,20 @@ class DefaultDeserializerAllocator final {
     next_alignment_ = static_cast<AllocationAlignment>(alignment);
   }
 
+  void set_next_reference_is_weak(bool next_reference_is_weak) {
+    next_reference_is_weak_ = next_reference_is_weak;
+  }
+
+  bool GetAndClearNextReferenceIsWeak() {
+    bool saved = next_reference_is_weak_;
+    next_reference_is_weak_ = false;
+    return saved;
+  }
+
+#ifdef DEBUG
+  bool next_reference_is_weak() const { return next_reference_is_weak_; }
+#endif
+
   HeapObject* GetMap(uint32_t index);
   HeapObject* GetLargeObject(uint32_t index);
   HeapObject* GetObject(AllocationSpace space, uint32_t chunk_index,
@@ -80,6 +94,7 @@ class DefaultDeserializerAllocator final {
 
   // The alignment of the next allocation.
   AllocationAlignment next_alignment_ = kWordAligned;
+  bool next_reference_is_weak_ = false;
 
   // All required maps are pre-allocated during reservation. {next_map_index_}
   // stores the index of the next map to return from allocation.
diff --git a/deps/v8/src/snapshot/default-serializer-allocator.cc b/deps/v8/src/snapshot/default-serializer-allocator.cc
index b8cc55ff2b4..290d9c07239 100644
--- a/deps/v8/src/snapshot/default-serializer-allocator.cc
+++ b/deps/v8/src/snapshot/default-serializer-allocator.cc
@@ -86,8 +86,7 @@ std::vector<SerializedData::Reservation>
 DefaultSerializerAllocator::EncodeReservations() const {
   std::vector<SerializedData::Reservation> out;
 
-  STATIC_ASSERT(NEW_SPACE == 0);
-  for (int i = 0; i < kNumberOfPreallocatedSpaces; i++) {
+  for (int i = FIRST_SPACE; i < kNumberOfPreallocatedSpaces; i++) {
     for (size_t j = 0; j < completed_chunks_[i].size(); j++) {
       out.emplace_back(completed_chunks_[i][j]);
     }
@@ -114,14 +113,12 @@ void DefaultSerializerAllocator::OutputStatistics() {
 
   PrintF("  Spaces (bytes):\n");
 
-  STATIC_ASSERT(NEW_SPACE == 0);
-  for (int space = 0; space < kNumberOfSpaces; space++) {
+  for (int space = FIRST_SPACE; space < kNumberOfSpaces; space++) {
     PrintF("%16s", AllocationSpaceName(static_cast<AllocationSpace>(space)));
   }
   PrintF("\n");
 
-  STATIC_ASSERT(NEW_SPACE == 0);
-  for (int space = 0; space < kNumberOfPreallocatedSpaces; space++) {
+  for (int space = FIRST_SPACE; space < kNumberOfPreallocatedSpaces; space++) {
     size_t s = pending_chunk_[space];
     for (uint32_t chunk_size : completed_chunks_[space]) s += chunk_size;
     PrintF("%16" PRIuS, s);
diff --git a/deps/v8/src/snapshot/deserializer.cc b/deps/v8/src/snapshot/deserializer.cc
index 4b51e89e850..a322d8a23cc 100644
--- a/deps/v8/src/snapshot/deserializer.cc
+++ b/deps/v8/src/snapshot/deserializer.cc
@@ -7,9 +7,11 @@
 #include "src/assembler-inl.h"
 #include "src/isolate.h"
 #include "src/objects/hash-table.h"
+#include "src/objects/maybe-object.h"
 #include "src/objects/string.h"
 #include "src/snapshot/builtin-deserializer-allocator.h"
 #include "src/snapshot/natives.h"
+#include "src/snapshot/snapshot.h"
 
 namespace v8 {
 namespace internal {
@@ -20,7 +22,7 @@ void Deserializer<AllocatorT>::Initialize(Isolate* isolate) {
   DCHECK_NOT_NULL(isolate);
   isolate_ = isolate;
   DCHECK_NULL(external_reference_table_);
-  external_reference_table_ = ExternalReferenceTable::instance(isolate);
+  external_reference_table_ = isolate->heap()->external_reference_table();
 #ifdef DEBUG
   // Count the number of external references registered through the API.
   num_api_references_ = 0;
@@ -60,15 +62,17 @@ Deserializer<AllocatorT>::~Deserializer() {
 // This is called on the roots.  It is the driver of the deserialization
 // process.  It is also called on the body of each function.
 template <class AllocatorT>
-void Deserializer<AllocatorT>::VisitRootPointers(Root root, Object** start,
-                                                 Object** end) {
+void Deserializer<AllocatorT>::VisitRootPointers(Root root,
+                                                 const char* description,
+                                                 Object** start, Object** end) {
   // Builtins and bytecode handlers are deserialized in a separate pass by the
   // BuiltinDeserializer.
   if (root == Root::kBuiltins || root == Root::kDispatchTable) return;
 
   // The space must be new space.  Any other space would cause ReadChunk to try
   // to update the remembered using nullptr as the address.
-  ReadData(start, end, NEW_SPACE, nullptr);
+  ReadData(reinterpret_cast<MaybeObject**>(start),
+           reinterpret_cast<MaybeObject**>(end), NEW_SPACE, nullptr);
 }
 
 template <class AllocatorT>
@@ -96,8 +100,9 @@ void Deserializer<AllocatorT>::DeserializeDeferredObjects() {
         HeapObject* object = GetBackReferencedObject(space);
         int size = source_.GetInt() << kPointerSizeLog2;
         Address obj_address = object->address();
-        Object** start = reinterpret_cast<Object**>(obj_address + kPointerSize);
-        Object** end = reinterpret_cast<Object**>(obj_address + size);
+        MaybeObject** start =
+            reinterpret_cast<MaybeObject**>(obj_address + kPointerSize);
+        MaybeObject** end = reinterpret_cast<MaybeObject**>(obj_address + size);
         bool filled = ReadData(start, end, space, obj_address);
         CHECK(filled);
         DCHECK(CanBeDeferred(object));
@@ -230,7 +235,6 @@ HeapObject* Deserializer<AllocatorT>::PostProcessNewObject(HeapObject* obj,
       void* backing_store = off_heap_backing_stores_[store_index->value()];
 
       buffer->set_backing_store(backing_store);
-      buffer->set_allocation_base(backing_store);
       isolate_->heap()->RegisterNewArrayBuffer(buffer);
     }
   } else if (obj->IsFixedTypedArrayBase()) {
@@ -246,11 +250,13 @@ HeapObject* Deserializer<AllocatorT>::PostProcessNewObject(HeapObject* obj,
     // fields in the serializer.
     BytecodeArray* bytecode_array = BytecodeArray::cast(obj);
     bytecode_array->set_interrupt_budget(
-        interpreter::Interpreter::kInterruptBudget);
+        interpreter::Interpreter::InterruptBudget());
     bytecode_array->set_osr_loop_nesting_level(0);
   }
+
   // Check alignment.
-  DCHECK_EQ(0, Heap::GetFillToAlign(obj->address(), obj->RequiredAlignment()));
+  DCHECK_EQ(0, Heap::GetFillToAlign(obj->address(),
+                                    HeapObject::RequiredAlignment(obj->map())));
   return obj;
 }
 
@@ -287,6 +293,7 @@ HeapObject* Deserializer<AllocatorT>::GetBackReferencedObject(int space) {
   }
 
   hot_objects_.Add(obj);
+  DCHECK(!HasWeakHeapObjectTag(obj));
   return obj;
 }
 
@@ -296,8 +303,9 @@ HeapObject* Deserializer<AllocatorT>::GetBackReferencedObject(int space) {
 // written very late, which means the FreeSpace map is not set up by the
 // time we need to use it to mark the space at the end of a page free.
 template <class AllocatorT>
-void Deserializer<AllocatorT>::ReadObject(int space_number,
-                                          Object** write_back) {
+void Deserializer<AllocatorT>::ReadObject(
+    int space_number, MaybeObject** write_back,
+    HeapObjectReferenceType reference_type) {
   const int size = source_.GetInt() << kObjectAlignmentBits;
 
   Address address =
@@ -305,15 +313,18 @@ void Deserializer<AllocatorT>::ReadObject(int space_number,
   HeapObject* obj = HeapObject::FromAddress(address);
 
   isolate_->heap()->OnAllocationEvent(obj, size);
-  Object** current = reinterpret_cast<Object**>(address);
-  Object** limit = current + (size >> kPointerSizeLog2);
+  MaybeObject** current = reinterpret_cast<MaybeObject**>(address);
+  MaybeObject** limit = current + (size >> kPointerSizeLog2);
 
   if (ReadData(current, limit, space_number, address)) {
     // Only post process if object content has not been deferred.
     obj = PostProcessNewObject(obj, space_number);
   }
 
-  Object* write_back_obj = obj;
+  MaybeObject* write_back_obj =
+      reference_type == HeapObjectReferenceType::STRONG
+          ? HeapObjectReference::Strong(obj)
+          : HeapObjectReference::Weak(obj);
   UnalignedCopy(write_back, &write_back_obj);
 #ifdef DEBUG
   if (obj->IsCode()) {
@@ -326,15 +337,18 @@ void Deserializer<AllocatorT>::ReadObject(int space_number,
 
 template <class AllocatorT>
 Object* Deserializer<AllocatorT>::ReadDataSingle() {
-  Object* o;
-  Object** start = &o;
-  Object** end = start + 1;
+  MaybeObject* o;
+  MaybeObject** start = &o;
+  MaybeObject** end = start + 1;
   int source_space = NEW_SPACE;
   Address current_object = nullptr;
 
   CHECK(ReadData(start, end, source_space, current_object));
-
-  return o;
+  HeapObject* heap_object;
+  bool success = o->ToStrongHeapObject(&heap_object);
+  DCHECK(success);
+  USE(success);
+  return heap_object;
 }
 
 static void NoExternalReferencesCallback() {
@@ -346,8 +360,8 @@ static void NoExternalReferencesCallback() {
 }
 
 template <class AllocatorT>
-bool Deserializer<AllocatorT>::ReadData(Object** current, Object** limit,
-                                        int source_space,
+bool Deserializer<AllocatorT>::ReadData(MaybeObject** current,
+                                        MaybeObject** limit, int source_space,
                                         Address current_object_address) {
   Isolate* const isolate = isolate_;
   // Write barrier support costs around 1% in startup time.  In fact there
@@ -378,9 +392,14 @@ bool Deserializer<AllocatorT>::ReadData(Object** current, Object** limit,
   CASE_STATEMENT(where, how, within, NEW_SPACE)  \
   CASE_BODY(where, how, within, NEW_SPACE)       \
   CASE_STATEMENT(where, how, within, OLD_SPACE)  \
+  V8_FALLTHROUGH;                                \
   CASE_STATEMENT(where, how, within, CODE_SPACE) \
+  V8_FALLTHROUGH;                                \
   CASE_STATEMENT(where, how, within, MAP_SPACE)  \
+  V8_FALLTHROUGH;                                \
   CASE_STATEMENT(where, how, within, LO_SPACE)   \
+  V8_FALLTHROUGH;                                \
+  CASE_STATEMENT(where, how, within, RO_SPACE)   \
   CASE_BODY(where, how, within, kAnyOldSpace)
 
 #define FOUR_CASES(byte_code) \
@@ -440,12 +459,6 @@ bool Deserializer<AllocatorT>::ReadData(Object** current, Object** limit,
       SINGLE_CASE(kPartialSnapshotCache, kPlain, kStartOfObject, 0)
       SINGLE_CASE(kPartialSnapshotCache, kFromCode, kStartOfObject, 0)
       SINGLE_CASE(kPartialSnapshotCache, kFromCode, kInnerPointer, 0)
-      // Find an external reference and write a pointer to it to the current
-      // object.
-      SINGLE_CASE(kExternalReference, kPlain, kStartOfObject, 0)
-      // Find an external reference and write a pointer to it in the current
-      // code object.
-      SINGLE_CASE(kExternalReference, kFromCode, kStartOfObject, 0)
       // Find an object in the attached references and write a pointer to it to
       // the current object.
       SINGLE_CASE(kAttachedReference, kPlain, kStartOfObject, 0)
@@ -462,11 +475,26 @@ bool Deserializer<AllocatorT>::ReadData(Object** current, Object** limit,
 
       case kSkip: {
         int size = source_.GetInt();
-        current = reinterpret_cast<Object**>(
+        current = reinterpret_cast<MaybeObject**>(
             reinterpret_cast<intptr_t>(current) + size);
         break;
       }
 
+      // Find an external reference and write a pointer to it to the current
+      // object.
+      case kExternalReference + kPlain + kStartOfObject:
+        current = reinterpret_cast<MaybeObject**>(ReadExternalReferenceCase(
+            kPlain, isolate, reinterpret_cast<void**>(current),
+            current_object_address));
+        break;
+      // Find an external reference and write a pointer to it in the current
+      // code object.
+      case kExternalReference + kFromCode + kStartOfObject:
+        current = reinterpret_cast<MaybeObject**>(ReadExternalReferenceCase(
+            kFromCode, isolate, reinterpret_cast<void**>(current),
+            current_object_address));
+        break;
+
       case kInternalReferenceEncoded:
       case kInternalReference: {
         // Internal reference address is not encoded via skip, but by offset
@@ -480,9 +508,43 @@ bool Deserializer<AllocatorT>::ReadData(Object** current, Object** limit,
         Address pc = code->entry() + pc_offset;
         Address target = code->entry() + target_offset;
         Assembler::deserialization_set_target_internal_reference_at(
-            isolate, pc, target, data == kInternalReference
-                                     ? RelocInfo::INTERNAL_REFERENCE
-                                     : RelocInfo::INTERNAL_REFERENCE_ENCODED);
+            pc, target,
+            data == kInternalReference ? RelocInfo::INTERNAL_REFERENCE
+                                       : RelocInfo::INTERNAL_REFERENCE_ENCODED);
+        break;
+      }
+
+      case kOffHeapTarget: {
+#ifdef V8_EMBEDDED_BUILTINS
+        int skip = source_.GetInt();
+        int builtin_index = source_.GetInt();
+        DCHECK(Builtins::IsBuiltinId(builtin_index));
+
+        current = reinterpret_cast<MaybeObject**>(
+            reinterpret_cast<Address>(current) + skip);
+
+        CHECK_NOT_NULL(isolate->embedded_blob());
+        EmbeddedData d = EmbeddedData::FromBlob();
+        const uint8_t* address = d.InstructionStartOfBuiltin(builtin_index);
+        CHECK_NOT_NULL(address);
+
+        if (RelocInfo::OffHeapTargetIsCodedSpecially()) {
+          Address location_of_branch_data = reinterpret_cast<Address>(current);
+          Assembler::deserialization_set_special_target_at(
+              location_of_branch_data,
+              Code::cast(HeapObject::FromAddress(current_object_address)),
+              const_cast<Address>(address));
+          location_of_branch_data += Assembler::kSpecialTargetSize;
+          current = reinterpret_cast<MaybeObject**>(location_of_branch_data);
+        } else {
+          MaybeObject* o =
+              reinterpret_cast<MaybeObject*>(const_cast<uint8_t*>(address));
+          UnalignedCopy(current, &o);
+          current++;
+        }
+#else
+        UNREACHABLE();
+#endif
         break;
       }
 
@@ -497,8 +559,8 @@ bool Deserializer<AllocatorT>::ReadData(Object** current, Object** limit,
 
       case kDeferred: {
         // Deferred can only occur right after the heap object header.
-        DCHECK(current == reinterpret_cast<Object**>(current_object_address +
-                                                     kPointerSize));
+        DCHECK_EQ(current, reinterpret_cast<MaybeObject**>(
+                               current_object_address + kPointerSize));
         HeapObject* obj = HeapObject::FromAddress(current_object_address);
         // If the deferred object is a map, its instance type may be used
         // during deserialization. Initialize it with a temporary value.
@@ -517,7 +579,7 @@ bool Deserializer<AllocatorT>::ReadData(Object** current, Object** limit,
         int size_in_bytes = source_.GetInt();
         byte* raw_data_out = reinterpret_cast<byte*>(current);
         source_.CopyRaw(raw_data_out, size_in_bytes);
-        current = reinterpret_cast<Object**>(
+        current = reinterpret_cast<MaybeObject**>(
             reinterpret_cast<intptr_t>(current) + size_in_bytes);
         break;
       }
@@ -533,8 +595,9 @@ bool Deserializer<AllocatorT>::ReadData(Object** current, Object** limit,
 
       case kVariableRepeat: {
         int repeats = source_.GetInt();
-        Object* object = current[-1];
+        MaybeObject* object = current[-1];
         DCHECK(!isolate->heap()->InNewSpace(object));
+        DCHECK(!allocator()->next_reference_is_weak());
         for (int i = 0; i < repeats; i++) UnalignedCopy(current++, &object);
         break;
       }
@@ -552,7 +615,7 @@ bool Deserializer<AllocatorT>::ReadData(Object** current, Object** limit,
 
       case kApiReference: {
         int skip = source_.GetInt();
-        current = reinterpret_cast<Object**>(
+        current = reinterpret_cast<MaybeObject**>(
             reinterpret_cast<Address>(current) + skip);
         uint32_t reference_id = static_cast<uint32_t>(source_.GetInt());
         Address address;
@@ -570,6 +633,11 @@ bool Deserializer<AllocatorT>::ReadData(Object** current, Object** limit,
         break;
       }
 
+      case kWeakPrefix:
+        DCHECK(!allocator()->next_reference_is_weak());
+        allocator()->set_next_reference_is_weak(true);
+        break;
+
       case kAlignmentPrefix:
       case kAlignmentPrefix + 1:
       case kAlignmentPrefix + 2: {
@@ -583,17 +651,19 @@ bool Deserializer<AllocatorT>::ReadData(Object** current, Object** limit,
       SIXTEEN_CASES(kRootArrayConstantsWithSkip)
       SIXTEEN_CASES(kRootArrayConstantsWithSkip + 16) {
         int skip = source_.GetInt();
-        current = reinterpret_cast<Object**>(
+        current = reinterpret_cast<MaybeObject**>(
             reinterpret_cast<intptr_t>(current) + skip);
-        // Fall through.
+        V8_FALLTHROUGH;
       }
 
       SIXTEEN_CASES(kRootArrayConstants)
       SIXTEEN_CASES(kRootArrayConstants + 16) {
         int id = data & kRootArrayConstantsMask;
         Heap::RootListIndex root_index = static_cast<Heap::RootListIndex>(id);
-        Object* object = isolate->heap()->root(root_index);
+        MaybeObject* object =
+            MaybeObject::FromObject(isolate->heap()->root(root_index));
         DCHECK(!isolate->heap()->InNewSpace(object));
+        DCHECK(!allocator()->next_reference_is_weak());
         UnalignedCopy(current++, &object);
         break;
       }
@@ -602,21 +672,27 @@ bool Deserializer<AllocatorT>::ReadData(Object** current, Object** limit,
       FOUR_CASES(kHotObjectWithSkip)
       FOUR_CASES(kHotObjectWithSkip + 4) {
         int skip = source_.GetInt();
-        current = reinterpret_cast<Object**>(
+        current = reinterpret_cast<MaybeObject**>(
             reinterpret_cast<Address>(current) + skip);
-        // Fall through.
+        V8_FALLTHROUGH;
       }
 
       FOUR_CASES(kHotObject)
       FOUR_CASES(kHotObject + 4) {
         int index = data & kHotObjectMask;
         Object* hot_object = hot_objects_.Get(index);
-        UnalignedCopy(current, &hot_object);
+        MaybeObject* hot_maybe_object = MaybeObject::FromObject(hot_object);
+        if (allocator()->GetAndClearNextReferenceIsWeak()) {
+          hot_maybe_object = MaybeObject::MakeWeak(hot_maybe_object);
+        }
+
+        UnalignedCopy(current, &hot_maybe_object);
         if (write_barrier_needed && isolate->heap()->InNewSpace(hot_object)) {
           Address current_address = reinterpret_cast<Address>(current);
           isolate->heap()->RecordWrite(
               HeapObject::FromAddress(current_object_address),
-              reinterpret_cast<Object**>(current_address), hot_object);
+              reinterpret_cast<MaybeObject**>(current_address),
+              hot_maybe_object);
         }
         current++;
         break;
@@ -629,26 +705,32 @@ bool Deserializer<AllocatorT>::ReadData(Object** current, Object** limit,
         byte* raw_data_out = reinterpret_cast<byte*>(current);
         int size_in_bytes = (data - kFixedRawDataStart) << kPointerSizeLog2;
         source_.CopyRaw(raw_data_out, size_in_bytes);
-        current = reinterpret_cast<Object**>(raw_data_out + size_in_bytes);
+        current = reinterpret_cast<MaybeObject**>(raw_data_out + size_in_bytes);
         break;
       }
 
       STATIC_ASSERT(kNumberOfFixedRepeat == 16);
       SIXTEEN_CASES(kFixedRepeat) {
         int repeats = data - kFixedRepeatStart;
-        Object* object;
+        MaybeObject* object;
+        DCHECK(!allocator()->next_reference_is_weak());
         UnalignedCopy(&object, current - 1);
         DCHECK(!isolate->heap()->InNewSpace(object));
         for (int i = 0; i < repeats; i++) UnalignedCopy(current++, &object);
         break;
       }
 
+#ifdef DEBUG
+#define UNUSED_CASE(byte_code) \
+  case byte_code:              \
+    UNREACHABLE();
+      UNUSED_SERIALIZER_BYTE_CODES(UNUSED_CASE)
+#endif
+#undef UNUSED_CASE
+
 #undef SIXTEEN_CASES
 #undef FOUR_CASES
 #undef SINGLE_CASE
-
-      default:
-        UNREACHABLE();
     }
   }
   CHECK_EQ(limit, current);
@@ -673,31 +755,58 @@ int FixupJSConstructStub(Isolate* isolate, int builtin_id) {
 
 }  // namespace
 
+template <class AllocatorT>
+void** Deserializer<AllocatorT>::ReadExternalReferenceCase(
+    HowToCode how, Isolate* isolate, void** current,
+    Address current_object_address) {
+  int skip = source_.GetInt();
+  current = reinterpret_cast<void**>(reinterpret_cast<Address>(current) + skip);
+  uint32_t reference_id = static_cast<uint32_t>(source_.GetInt());
+  Address address = external_reference_table_->address(reference_id);
+
+  if (how == kFromCode) {
+    Address location_of_branch_data = reinterpret_cast<Address>(current);
+    Assembler::deserialization_set_special_target_at(
+        location_of_branch_data,
+        Code::cast(HeapObject::FromAddress(current_object_address)), address);
+    location_of_branch_data += Assembler::kSpecialTargetSize;
+    current = reinterpret_cast<void**>(location_of_branch_data);
+  } else {
+    void* new_current = reinterpret_cast<void**>(address);
+    UnalignedCopy(current, &new_current);
+    ++current;
+  }
+  return current;
+}
+
 template <class AllocatorT>
 template <int where, int how, int within, int space_number_if_any>
-Object** Deserializer<AllocatorT>::ReadDataCase(Isolate* isolate,
-                                                Object** current,
-                                                Address current_object_address,
-                                                byte data,
-                                                bool write_barrier_needed) {
+MaybeObject** Deserializer<AllocatorT>::ReadDataCase(
+    Isolate* isolate, MaybeObject** current, Address current_object_address,
+    byte data, bool write_barrier_needed) {
   bool emit_write_barrier = false;
   bool current_was_incremented = false;
   int space_number = space_number_if_any == kAnyOldSpace ? (data & kSpaceMask)
                                                          : space_number_if_any;
+  HeapObjectReferenceType reference_type = HeapObjectReferenceType::STRONG;
   if (where == kNewObject && how == kPlain && within == kStartOfObject) {
-    ReadObject(space_number, current);
+    if (allocator()->GetAndClearNextReferenceIsWeak()) {
+      reference_type = HeapObjectReferenceType::WEAK;
+    }
+    ReadObject(space_number, current, reference_type);
     emit_write_barrier = (space_number == NEW_SPACE);
   } else {
     Object* new_object = nullptr; /* May not be a real Object pointer. */
     if (where == kNewObject) {
-      ReadObject(space_number, &new_object);
+      ReadObject(space_number, reinterpret_cast<MaybeObject**>(&new_object),
+                 HeapObjectReferenceType::STRONG);
     } else if (where == kBackref) {
       emit_write_barrier = (space_number == NEW_SPACE);
       new_object = GetBackReferencedObject(data & kSpaceMask);
     } else if (where == kBackrefWithSkip) {
       int skip = source_.GetInt();
-      current =
-          reinterpret_cast<Object**>(reinterpret_cast<Address>(current) + skip);
+      current = reinterpret_cast<MaybeObject**>(
+          reinterpret_cast<Address>(current) + skip);
       emit_write_barrier = (space_number == NEW_SPACE);
       new_object = GetBackReferencedObject(data & kSpaceMask);
     } else if (where == kRootArray) {
@@ -710,13 +819,6 @@ Object** Deserializer<AllocatorT>::ReadDataCase(Isolate* isolate,
       int cache_index = source_.GetInt();
       new_object = isolate->partial_snapshot_cache()->at(cache_index);
       emit_write_barrier = isolate->heap()->InNewSpace(new_object);
-    } else if (where == kExternalReference) {
-      int skip = source_.GetInt();
-      current =
-          reinterpret_cast<Object**>(reinterpret_cast<Address>(current) + skip);
-      uint32_t reference_id = static_cast<uint32_t>(source_.GetInt());
-      Address address = external_reference_table_->address(reference_id);
-      new_object = reinterpret_cast<Object*>(address);
     } else if (where == kAttachedReference) {
       int index = source_.GetInt();
       new_object = *attached_objects_[index];
@@ -744,16 +846,21 @@ Object** Deserializer<AllocatorT>::ReadDataCase(Isolate* isolate,
       }
     }
     if (how == kFromCode) {
+      DCHECK(!allocator()->next_reference_is_weak());
       Address location_of_branch_data = reinterpret_cast<Address>(current);
       Assembler::deserialization_set_special_target_at(
-          isolate, location_of_branch_data,
+          location_of_branch_data,
           Code::cast(HeapObject::FromAddress(current_object_address)),
           reinterpret_cast<Address>(new_object));
       location_of_branch_data += Assembler::kSpecialTargetSize;
-      current = reinterpret_cast<Object**>(location_of_branch_data);
+      current = reinterpret_cast<MaybeObject**>(location_of_branch_data);
       current_was_incremented = true;
     } else {
-      UnalignedCopy(current, &new_object);
+      MaybeObject* new_maybe_object = MaybeObject::FromObject(new_object);
+      if (allocator()->GetAndClearNextReferenceIsWeak()) {
+        new_maybe_object = MaybeObject::MakeWeak(new_maybe_object);
+      }
+      UnalignedCopy(current, &new_maybe_object);
     }
   }
   if (emit_write_barrier && write_barrier_needed) {
@@ -761,8 +868,8 @@ Object** Deserializer<AllocatorT>::ReadDataCase(Isolate* isolate,
     SLOW_DCHECK(isolate->heap()->ContainsSlow(current_object_address));
     isolate->heap()->RecordWrite(
         HeapObject::FromAddress(current_object_address),
-        reinterpret_cast<Object**>(current_address),
-        *reinterpret_cast<Object**>(current_address));
+        reinterpret_cast<MaybeObject**>(current_address),
+        *reinterpret_cast<MaybeObject**>(current_address));
   }
   if (!current_was_incremented) {
     current++;
diff --git a/deps/v8/src/snapshot/deserializer.h b/deps/v8/src/snapshot/deserializer.h
index 5c9bda43acc..3df764cf061 100644
--- a/deps/v8/src/snapshot/deserializer.h
+++ b/deps/v8/src/snapshot/deserializer.h
@@ -96,11 +96,14 @@ class Deserializer : public SerializerDeserializer {
   void Rehash();
 
  private:
-  void VisitRootPointers(Root root, Object** start, Object** end) override;
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override;
 
   void Synchronize(VisitorSynchronization::SyncTag tag) override;
 
-  void UnalignedCopy(Object** dest, Object** src) {
+  template <typename T>
+  void UnalignedCopy(T** dest, T** src) {
+    DCHECK(!allocator()->next_reference_is_weak());
     memcpy(dest, src, sizeof(*src));
   }
 
@@ -109,17 +112,24 @@ class Deserializer : public SerializerDeserializer {
   // of the object we are writing into, or nullptr if we are not writing into an
   // object, i.e. if we are writing a series of tagged values that are not on
   // the heap. Return false if the object content has been deferred.
-  bool ReadData(Object** start, Object** end, int space,
+  bool ReadData(MaybeObject** start, MaybeObject** end, int space,
                 Address object_address);
 
   // A helper function for ReadData, templatized on the bytecode for efficiency.
   // Returns the new value of {current}.
   template <int where, int how, int within, int space_number_if_any>
-  inline Object** ReadDataCase(Isolate* isolate, Object** current,
-                               Address current_object_address, byte data,
-                               bool write_barrier_needed);
+  inline MaybeObject** ReadDataCase(Isolate* isolate, MaybeObject** current,
+                                    Address current_object_address, byte data,
+                                    bool write_barrier_needed);
 
-  void ReadObject(int space_number, Object** write_back);
+  // A helper function for ReadData for reading external references.
+  // Returns the new value of {current}.
+  inline void** ReadExternalReferenceCase(HowToCode how, Isolate* isolate,
+                                          void** current,
+                                          Address current_object_address);
+
+  void ReadObject(int space_number, MaybeObject** write_back,
+                  HeapObjectReferenceType reference_type);
 
   // Special handling for serialized code like hooking up internalized strings.
   HeapObject* PostProcessNewObject(HeapObject* obj, int space);
diff --git a/deps/v8/src/snapshot/embedded-empty.cc b/deps/v8/src/snapshot/embedded-empty.cc
new file mode 100644
index 00000000000..3294a6788ec
--- /dev/null
+++ b/deps/v8/src/snapshot/embedded-empty.cc
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Used for building without embedded data.
+
+#include <cstdint>
+
+namespace v8 {
+namespace internal {
+
+#ifdef V8_EMBEDDED_BUILTINS
+const uint8_t* DefaultEmbeddedBlob() { return nullptr; }
+uint32_t DefaultEmbeddedBlobSize() { return 0; }
+
+#ifdef V8_MULTI_SNAPSHOTS
+const uint8_t* TrustedEmbeddedBlob() { return nullptr; }
+uint32_t TrustedEmbeddedBlobSize() { return 0; }
+#endif
+
+#endif
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/snapshot/macros.h b/deps/v8/src/snapshot/macros.h
new file mode 100644
index 00000000000..5ea6917c168
--- /dev/null
+++ b/deps/v8/src/snapshot/macros.h
@@ -0,0 +1,78 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_SNAPSHOT_MACROS_H_
+#define V8_SNAPSHOT_MACROS_H_
+
+#include "include/v8config.h"
+
+// .byte portability macros.
+
+#if defined(V8_OS_MACOSX)  // MACOSX
+#define V8_ASM_MANGLE_LABEL "_"
+#define V8_ASM_RODATA_SECTION ".const_data\n"
+#define V8_ASM_TEXT_SECTION ".text\n"
+#define V8_ASM_DECLARE(NAME) ".private_extern " V8_ASM_MANGLE_LABEL NAME "\n"
+#elif defined(V8_OS_AIX)  // AIX
+#define V8_ASM_RODATA_SECTION ".csect[RO]\n"
+#define V8_ASM_TEXT_SECTION ".csect .text[PR]\n"
+#define V8_ASM_MANGLE_LABEL ""
+#define V8_ASM_DECLARE(NAME) ".globl " V8_ASM_MANGLE_LABEL NAME "\n"
+#elif defined(V8_OS_WIN)  // WIN
+#if defined(V8_TARGET_ARCH_X64)
+#define V8_ASM_MANGLE_LABEL ""
+#else
+#define V8_ASM_MANGLE_LABEL "_"
+#endif
+#define V8_ASM_RODATA_SECTION ".section .rodata\n"
+#define V8_ASM_TEXT_SECTION ".section .text\n"
+#define V8_ASM_DECLARE(NAME)
+#else  // !MACOSX && !WIN && !AIX
+#define V8_ASM_MANGLE_LABEL ""
+#define V8_ASM_RODATA_SECTION ".section .rodata\n"
+#define V8_ASM_TEXT_SECTION ".section .text\n"
+#if defined(V8_TARGET_ARCH_MIPS) || defined(V8_TARGET_ARCH_MIPS64)
+#define V8_ASM_DECLARE(NAME) ".global " V8_ASM_MANGLE_LABEL NAME "\n"
+#else
+#define V8_ASM_DECLARE(NAME) ".local " V8_ASM_MANGLE_LABEL NAME "\n"
+#endif
+#endif
+
+// Align to kCodeAlignment.
+#define V8_ASM_BALIGN32 ".balign 32\n"
+#define V8_ASM_LABEL(NAME) V8_ASM_MANGLE_LABEL NAME ":\n"
+
+// clang-format off
+#if defined(V8_OS_AIX)
+
+#define V8_EMBEDDED_TEXT_HEADER(LABEL)         \
+  __asm__(V8_ASM_DECLARE(#LABEL)               \
+          ".csect " #LABEL "[DS]\n"            \
+          #LABEL ":\n"                         \
+          ".llong ." #LABEL ", TOC[tc0], 0\n"  \
+          V8_ASM_TEXT_SECTION                  \
+          "." #LABEL ":\n");
+
+#define V8_EMBEDDED_RODATA_HEADER(LABEL)    \
+  __asm__(V8_ASM_RODATA_SECTION             \
+          V8_ASM_DECLARE(#LABEL)            \
+          ".align 5\n"                      \
+          V8_ASM_LABEL(#LABEL));
+
+#else
+
+#define V8_EMBEDDED_TEXT_HEADER(LABEL) \
+  __asm__(V8_ASM_TEXT_SECTION          \
+          V8_ASM_DECLARE(#LABEL)       \
+          V8_ASM_BALIGN32              \
+          V8_ASM_LABEL(#LABEL));
+
+#define V8_EMBEDDED_RODATA_HEADER(LABEL) \
+  __asm__(V8_ASM_RODATA_SECTION          \
+          V8_ASM_DECLARE(#LABEL)         \
+          V8_ASM_BALIGN32                \
+          V8_ASM_LABEL(#LABEL));
+
+#endif  // #if defined(V8_OS_AIX)
+#endif  // V8_SNAPSHOT_MACROS_H_
diff --git a/deps/v8/src/snapshot/mksnapshot.cc b/deps/v8/src/snapshot/mksnapshot.cc
index 33c6c4a115f..c862d63090c 100644
--- a/deps/v8/src/snapshot/mksnapshot.cc
+++ b/deps/v8/src/snapshot/mksnapshot.cc
@@ -13,13 +13,25 @@
 #include "src/msan.h"
 #include "src/snapshot/natives.h"
 #include "src/snapshot/partial-serializer.h"
+#include "src/snapshot/snapshot.h"
 #include "src/snapshot/startup-serializer.h"
 
+namespace {
 class SnapshotWriter {
  public:
   SnapshotWriter()
       : snapshot_cpp_path_(nullptr), snapshot_blob_path_(nullptr) {}
 
+#ifdef V8_EMBEDDED_BUILTINS
+  void SetEmbeddedFile(const char* embedded_cpp_file) {
+    embedded_cpp_path_ = embedded_cpp_file;
+  }
+
+  void SetEmbeddedVariant(const char* embedded_variant) {
+    embedded_variant_ = embedded_variant;
+  }
+#endif
+
   void SetSnapshotFile(const char* snapshot_cpp_file) {
     snapshot_cpp_path_ = snapshot_cpp_file;
   }
@@ -39,6 +51,12 @@ class SnapshotWriter {
     MaybeWriteStartupBlob(blob_vector);
   }
 
+#ifdef V8_EMBEDDED_BUILTINS
+  void WriteEmbedded(const i::EmbeddedData* blob) const {
+    MaybeWriteEmbeddedFile(blob);
+  }
+#endif
+
  private:
   void MaybeWriteStartupBlob(const i::Vector<const i::byte>& blob) const {
     if (!snapshot_blob_path_) return;
@@ -58,14 +76,14 @@ class SnapshotWriter {
 
     FILE* fp = GetFileDescriptorOrDie(snapshot_cpp_path_);
 
-    WriteFilePrefix(fp);
-    WriteData(fp, blob);
-    WriteFileSuffix(fp);
+    WriteSnapshotFilePrefix(fp);
+    WriteSnapshotFileData(fp, blob);
+    WriteSnapshotFileSuffix(fp);
 
     fclose(fp);
   }
 
-  static void WriteFilePrefix(FILE* fp) {
+  static void WriteSnapshotFilePrefix(FILE* fp) {
     fprintf(fp, "// Autogenerated snapshot file. Do not edit.\n\n");
     fprintf(fp, "#include \"src/v8.h\"\n");
     fprintf(fp, "#include \"src/base/platform/platform.h\"\n\n");
@@ -74,7 +92,7 @@ class SnapshotWriter {
     fprintf(fp, "namespace internal {\n\n");
   }
 
-  static void WriteFileSuffix(FILE* fp) {
+  static void WriteSnapshotFileSuffix(FILE* fp) {
     fprintf(fp, "const v8::StartupData* Snapshot::DefaultSnapshotBlob() {\n");
     fprintf(fp, "  return &blob;\n");
     fprintf(fp, "}\n\n");
@@ -82,17 +100,18 @@ class SnapshotWriter {
     fprintf(fp, "}  // namespace v8\n");
   }
 
-  static void WriteData(FILE* fp, const i::Vector<const i::byte>& blob) {
+  static void WriteSnapshotFileData(FILE* fp,
+                                    const i::Vector<const i::byte>& blob) {
     fprintf(fp, "static const byte blob_data[] = {\n");
-    WriteSnapshotData(fp, blob);
+    WriteBinaryContentsAsCArray(fp, blob);
     fprintf(fp, "};\n");
     fprintf(fp, "static const int blob_size = %d;\n", blob.length());
     fprintf(fp, "static const v8::StartupData blob =\n");
     fprintf(fp, "{ (const char*) blob_data, blob_size };\n");
   }
 
-  static void WriteSnapshotData(FILE* fp,
-                                const i::Vector<const i::byte>& blob) {
+  static void WriteBinaryContentsAsCArray(
+      FILE* fp, const i::Vector<const i::byte>& blob) {
     for (int i = 0; i < blob.length(); i++) {
       if ((i & 0x1F) == 0x1F) fprintf(fp, "\n");
       if (i > 0) fprintf(fp, ",");
@@ -101,6 +120,95 @@ class SnapshotWriter {
     fprintf(fp, "\n");
   }
 
+#ifdef V8_EMBEDDED_BUILTINS
+  void MaybeWriteEmbeddedFile(const i::EmbeddedData* blob) const {
+    if (embedded_cpp_path_ == nullptr) return;
+
+    FILE* fp = GetFileDescriptorOrDie(embedded_cpp_path_);
+
+    WriteEmbeddedFilePrefix(fp);
+    WriteEmbeddedFileData(fp, blob, embedded_variant_);
+    WriteEmbeddedFileSuffix(fp, embedded_variant_);
+
+    fclose(fp);
+  }
+
+  static void WriteEmbeddedFilePrefix(FILE* fp) {
+    fprintf(fp, "// Autogenerated file. Do not edit.\n\n");
+    fprintf(fp, "#include <cstdint>\n\n");
+    fprintf(fp, "#include \"src/snapshot/macros.h\"\n\n");
+    fprintf(fp, "namespace v8 {\n");
+    fprintf(fp, "namespace internal {\n\n");
+    fprintf(fp, "namespace {\n\n");
+  }
+
+  static void WriteEmbeddedFileSuffix(FILE* fp, const char* embedded_variant) {
+    fprintf(fp, "}  // namespace\n\n");
+    fprintf(fp,
+            "const uint8_t* %sEmbeddedBlob() { return "
+            "v8_%s_embedded_blob_; }\n",
+            embedded_variant, embedded_variant);
+    fprintf(fp,
+            "uint32_t %sEmbeddedBlobSize() { return "
+            "v8_embedded_blob_size_; }\n\n",
+            embedded_variant);
+    fprintf(fp, "}  // namespace internal\n");
+    fprintf(fp, "}  // namespace v8\n");
+  }
+
+  static void WriteEmbeddedFileData(FILE* fp, const i::EmbeddedData* blob,
+                                    const char* embedded_variant) {
+    // Note: On some platforms (observed on mac64), inserting labels into the
+    // .byte stream causes the compiler to reorder symbols, invalidating stored
+    // offsets.
+    // We either need to avoid doing so, or stop relying on our own offset table
+    // and directly reference symbols instead. But there is another complication
+    // there since the chrome build process on mac verifies the order of symbols
+    // present in the binary.
+    // For now, the straight-forward solution seems to be to just emit a pure
+    // .byte stream.
+    fprintf(fp, "V8_EMBEDDED_TEXT_HEADER(v8_%s_embedded_blob_)\n",
+            embedded_variant);
+    WriteBinaryContentsAsByteDirective(fp, blob->data(), blob->size());
+    fprintf(fp, "extern \"C\" const uint8_t v8_%s_embedded_blob_[];\n",
+            embedded_variant);
+    fprintf(fp, "static const uint32_t v8_embedded_blob_size_ = %d;\n\n",
+            blob->size());
+  }
+
+  static void WriteBinaryContentsAsByteDirective(FILE* fp, const uint8_t* data,
+                                                 uint32_t size) {
+    static const int kTextWidth = 80;
+    int current_line_length = 0;
+    int printed_chars;
+
+    fprintf(fp, "__asm__(\n");
+    for (uint32_t i = 0; i < size; i++) {
+      if (current_line_length == 0) {
+        printed_chars = fprintf(fp, "%s", "  \".byte ");
+        DCHECK_LT(0, printed_chars);
+        current_line_length += printed_chars;
+      } else {
+        printed_chars = fprintf(fp, ",");
+        DCHECK_EQ(1, printed_chars);
+        current_line_length += printed_chars;
+      }
+
+      printed_chars = fprintf(fp, "0x%02x", data[i]);
+      DCHECK_LT(0, printed_chars);
+      current_line_length += printed_chars;
+
+      if (current_line_length + strlen(",0xFF\\n\"") > kTextWidth) {
+        fprintf(fp, "\\n\"\n");
+        current_line_length = 0;
+      }
+    }
+
+    if (current_line_length != 0) fprintf(fp, "\\n\"\n");
+    fprintf(fp, ");\n");
+  }
+#endif
+
   static FILE* GetFileDescriptorOrDie(const char* filename) {
     FILE* fp = v8::base::OS::FOpen(filename, "wb");
     if (fp == nullptr) {
@@ -110,6 +218,10 @@ class SnapshotWriter {
     return fp;
   }
 
+#ifdef V8_EMBEDDED_BUILTINS
+  const char* embedded_cpp_path_ = nullptr;
+  const char* embedded_variant_ = "Default";
+#endif
   const char* snapshot_cpp_path_;
   const char* snapshot_blob_path_;
 };
@@ -139,8 +251,117 @@ char* GetExtraCode(char* filename, const char* description) {
   return chars;
 }
 
+bool RunExtraCode(v8::Isolate* isolate, v8::Local<v8::Context> context,
+                  const char* utf8_source, const char* name) {
+  v8::base::ElapsedTimer timer;
+  timer.Start();
+  v8::Context::Scope context_scope(context);
+  v8::TryCatch try_catch(isolate);
+  v8::Local<v8::String> source_string;
+  if (!v8::String::NewFromUtf8(isolate, utf8_source, v8::NewStringType::kNormal)
+           .ToLocal(&source_string)) {
+    return false;
+  }
+  v8::Local<v8::String> resource_name =
+      v8::String::NewFromUtf8(isolate, name, v8::NewStringType::kNormal)
+          .ToLocalChecked();
+  v8::ScriptOrigin origin(resource_name);
+  v8::ScriptCompiler::Source source(source_string, origin);
+  v8::Local<v8::Script> script;
+  if (!v8::ScriptCompiler::Compile(context, &source).ToLocal(&script))
+    return false;
+  if (script->Run(context).IsEmpty()) return false;
+  if (i::FLAG_profile_deserialization) {
+    i::PrintF("Executing custom snapshot script %s took %0.3f ms\n", name,
+              timer.Elapsed().InMillisecondsF());
+  }
+  timer.Stop();
+  CHECK(!try_catch.HasCaught());
+  return true;
+}
+
+v8::StartupData CreateSnapshotDataBlob(v8::SnapshotCreator* snapshot_creator,
+                                       const char* script_source = NULL) {
+  // Create a new isolate and a new context from scratch, optionally run
+  // a script to embed, and serialize to create a snapshot blob.
+  v8::StartupData result = {nullptr, 0};
+  v8::base::ElapsedTimer timer;
+  timer.Start();
+  {
+    v8::Isolate* isolate = snapshot_creator->GetIsolate();
+    {
+      v8::HandleScope scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      if (script_source != nullptr &&
+          !RunExtraCode(isolate, context, script_source, "<embedded>")) {
+        return result;
+      }
+      snapshot_creator->SetDefaultContext(context);
+    }
+    result = snapshot_creator->CreateBlob(
+        v8::SnapshotCreator::FunctionCodeHandling::kClear);
+  }
+
+  if (i::FLAG_profile_deserialization) {
+    i::PrintF("Creating snapshot took %0.3f ms\n",
+              timer.Elapsed().InMillisecondsF());
+  }
+  timer.Stop();
+  return result;
+}
+
+v8::StartupData WarmUpSnapshotDataBlob(v8::SnapshotCreator* snapshot_creator,
+                                       const char* warmup_source) {
+  CHECK_NOT_NULL(warmup_source);
+  // Use following steps to create a warmed up snapshot blob from a cold one:
+  //  - Create a new isolate from the cold snapshot.
+  //  - Create a new context to run the warmup script. This will trigger
+  //    compilation of executed functions.
+  //  - Create a new context. This context will be unpolluted.
+  //  - Serialize the isolate and the second context into a new snapshot blob.
+  v8::StartupData result = {nullptr, 0};
+  v8::base::ElapsedTimer timer;
+  timer.Start();
+  {
+    v8::Isolate* isolate = snapshot_creator->GetIsolate();
+    {
+      v8::HandleScope scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      if (!RunExtraCode(isolate, context, warmup_source, "<warm-up>")) {
+        return result;
+      }
+    }
+    {
+      v8::HandleScope handle_scope(isolate);
+      isolate->ContextDisposedNotification(false);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      snapshot_creator->SetDefaultContext(context);
+    }
+    result = snapshot_creator->CreateBlob(
+        v8::SnapshotCreator::FunctionCodeHandling::kKeep);
+  }
+
+  if (i::FLAG_profile_deserialization) {
+    i::PrintF("Warming up snapshot took %0.3f ms\n",
+              timer.Elapsed().InMillisecondsF());
+  }
+  timer.Stop();
+  return result;
+}
+
+#ifdef V8_EMBEDDED_BUILTINS
+void WriteEmbeddedFile(v8::SnapshotCreator* creator, SnapshotWriter* writer) {
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(creator->GetIsolate());
+  isolate->PrepareEmbeddedBlobForSerialization();
+  i::EmbeddedData embedded_blob = i::EmbeddedData::FromBlob();
+  writer->WriteEmbedded(&embedded_blob);
+}
+#endif  // V8_EMBEDDED_BUILTINS
+}  // namespace
 
 int main(int argc, char** argv) {
+  v8::base::EnsureConsoleOutput();
+
   // Make mksnapshot runs predictable to create reproducible snapshots.
   i::FLAG_predictable = true;
 
@@ -164,19 +385,39 @@ int main(int argc, char** argv) {
     SnapshotWriter writer;
     if (i::FLAG_startup_src) writer.SetSnapshotFile(i::FLAG_startup_src);
     if (i::FLAG_startup_blob) writer.SetStartupBlobFile(i::FLAG_startup_blob);
+#ifdef V8_EMBEDDED_BUILTINS
+    if (i::FLAG_embedded_src) writer.SetEmbeddedFile(i::FLAG_embedded_src);
+    if (i::FLAG_embedded_variant)
+      writer.SetEmbeddedVariant(i::FLAG_embedded_variant);
+#endif
+
+    std::unique_ptr<char> embed_script(
+        GetExtraCode(argc >= 2 ? argv[1] : nullptr, "embedding"));
+    std::unique_ptr<char> warmup_script(
+        GetExtraCode(argc >= 3 ? argv[2] : nullptr, "warm up"));
 
-    char* embed_script =
-        GetExtraCode(argc >= 2 ? argv[1] : nullptr, "embedding");
-    v8::StartupData blob = v8::V8::CreateSnapshotDataBlob(embed_script);
-    delete[] embed_script;
+    v8::StartupData blob;
+    {
+      v8::SnapshotCreator snapshot_creator;
+#ifdef V8_EMBEDDED_BUILTINS
+      // This process is a bit tricky since we might go on to make a second
+      // snapshot if a warmup script is passed. In that case, create the first
+      // snapshot without off-heap trampolines and only move code off-heap for
+      // the warmed-up snapshot.
+      if (!warmup_script) WriteEmbeddedFile(&snapshot_creator, &writer);
+#endif
+      blob = CreateSnapshotDataBlob(&snapshot_creator, embed_script.get());
+    }
 
-    char* warmup_script =
-        GetExtraCode(argc >= 3 ? argv[2] : nullptr, "warm up");
     if (warmup_script) {
+      CHECK(blob.raw_size > 0 && blob.data != nullptr);
       v8::StartupData cold = blob;
-      blob = v8::V8::WarmUpSnapshotDataBlob(cold, warmup_script);
+      v8::SnapshotCreator snapshot_creator(nullptr, &cold);
+#ifdef V8_EMBEDDED_BUILTINS
+      WriteEmbeddedFile(&snapshot_creator, &writer);
+#endif
+      blob = WarmUpSnapshotDataBlob(&snapshot_creator, warmup_script.get());
       delete[] cold.data;
-      delete[] warmup_script;
     }
 
     CHECK(blob.data);
diff --git a/deps/v8/src/snapshot/object-deserializer.cc b/deps/v8/src/snapshot/object-deserializer.cc
index 3f92e7757fb..eebd8e24f8c 100644
--- a/deps/v8/src/snapshot/object-deserializer.cc
+++ b/deps/v8/src/snapshot/object-deserializer.cc
@@ -59,7 +59,7 @@ ObjectDeserializer::DeserializeWasmCompiledModule(
   if (!d.Deserialize(isolate).ToHandle(&result))
     return MaybeHandle<WasmCompiledModule>();
 
-  if (!result->IsFixedArray()) return MaybeHandle<WasmCompiledModule>();
+  if (!result->IsWasmCompiledModule()) return MaybeHandle<WasmCompiledModule>();
 
   // Cast without type checks, as the module wrapper is not there yet.
   return handle(static_cast<WasmCompiledModule*>(*result), isolate);
@@ -76,7 +76,7 @@ MaybeHandle<HeapObject> ObjectDeserializer::Deserialize(Isolate* isolate) {
   {
     DisallowHeapAllocation no_gc;
     Object* root;
-    VisitRootPointer(Root::kPartialSnapshotCache, &root);
+    VisitRootPointer(Root::kPartialSnapshotCache, nullptr, &root);
     DeserializeDeferredObjects();
     FlushICacheForNewCodeObjectsAndRecordEmbeddedObjects();
     result = Handle<HeapObject>(HeapObject::cast(root));
@@ -93,8 +93,7 @@ void ObjectDeserializer::
   for (Code* code : new_code_objects()) {
     // Record all references to embedded objects in the new code object.
     isolate()->heap()->RecordWritesIntoCode(code);
-    Assembler::FlushICache(isolate(), code->instruction_start(),
-                           code->instruction_size());
+    Assembler::FlushICache(code->instruction_start(), code->instruction_size());
   }
 }
 
@@ -103,9 +102,10 @@ void ObjectDeserializer::CommitPostProcessedObjects() {
   StringTable::EnsureCapacityForDeserialization(
       isolate(), static_cast<int>(new_internalized_strings().size()));
   for (Handle<String> string : new_internalized_strings()) {
+    DisallowHeapAllocation no_gc;
     StringTableInsertionKey key(*string);
     DCHECK_NULL(StringTable::ForwardStringIfExists(isolate(), &key, *string));
-    StringTable::LookupKey(isolate(), &key);
+    StringTable::AddKeyNoResize(isolate(), &key);
   }
 
   Heap* heap = isolate()->heap();
@@ -114,7 +114,8 @@ void ObjectDeserializer::CommitPostProcessedObjects() {
     // Assign a new script id to avoid collision.
     script->set_id(isolate()->heap()->NextScriptId());
     // Add script to list.
-    Handle<Object> list = WeakFixedArray::Add(factory->script_list(), script);
+    Handle<Object> list =
+        FixedArrayOfWeakCells::Add(factory->script_list(), script);
     heap->SetRootScriptList(*list);
   }
 }
diff --git a/deps/v8/src/snapshot/partial-deserializer.cc b/deps/v8/src/snapshot/partial-deserializer.cc
index 41df5dbba7e..afa6aa5fc5e 100644
--- a/deps/v8/src/snapshot/partial-deserializer.cc
+++ b/deps/v8/src/snapshot/partial-deserializer.cc
@@ -31,7 +31,7 @@ MaybeHandle<Object> PartialDeserializer::Deserialize(
     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer) {
   Initialize(isolate);
   if (!allocator()->ReserveSpace()) {
-    V8::FatalProcessOutOfMemory("PartialDeserializer");
+    V8::FatalProcessOutOfMemory(isolate, "PartialDeserializer");
   }
 
   AddAttachedObject(global_proxy);
@@ -42,7 +42,7 @@ MaybeHandle<Object> PartialDeserializer::Deserialize(
   OldSpace* code_space = isolate->heap()->code_space();
   Address start_address = code_space->top();
   Object* root;
-  VisitRootPointer(Root::kPartialSnapshotCache, &root);
+  VisitRootPointer(Root::kPartialSnapshotCache, nullptr, &root);
   DeserializeDeferredObjects();
   DeserializeEmbedderFields(embedder_fields_deserializer);
 
diff --git a/deps/v8/src/snapshot/partial-serializer.cc b/deps/v8/src/snapshot/partial-serializer.cc
index baac565a117..8b4c9d8d922 100644
--- a/deps/v8/src/snapshot/partial-serializer.cc
+++ b/deps/v8/src/snapshot/partial-serializer.cc
@@ -42,7 +42,8 @@ void PartialSerializer::Serialize(Context** o, bool include_global_proxy) {
   context_->set_math_random_index(Smi::kZero);
   context_->set_math_random_cache(isolate()->heap()->undefined_value());
 
-  VisitRootPointer(Root::kPartialSnapshotCache, reinterpret_cast<Object**>(o));
+  VisitRootPointer(Root::kPartialSnapshotCache, nullptr,
+                   reinterpret_cast<Object**>(o));
   SerializeDeferredObjects();
   SerializeEmbedderFields();
   Pad();
@@ -52,10 +53,7 @@ void PartialSerializer::SerializeObject(HeapObject* obj, HowToCode how_to_code,
                                         WhereToPoint where_to_point, int skip) {
   DCHECK(!ObjectIsBytecodeHandler(obj));  // Only referenced in dispatch table.
 
-  BuiltinReferenceSerializationMode mode =
-      startup_serializer_->clear_function_code() ? kCanonicalizeCompileLazy
-                                                 : kDefault;
-  if (SerializeBuiltinReference(obj, how_to_code, where_to_point, skip, mode)) {
+  if (SerializeBuiltinReference(obj, how_to_code, where_to_point, skip)) {
     return;
   }
   if (SerializeHotObject(obj, how_to_code, where_to_point, skip)) return;
@@ -103,6 +101,13 @@ void PartialSerializer::SerializeObject(HeapObject* obj, HowToCode how_to_code,
     }
   }
 
+  if (obj->IsJSFunction()) {
+    // Unconditionally reset the JSFunction to its SFI's code, since we can't
+    // serialize optimized code anyway.
+    JSFunction* closure = JSFunction::cast(obj);
+    closure->set_code(closure->shared()->GetCode());
+  }
+
   CheckRehashability(obj);
 
   // Object has not yet been serialized.  Serialize it here.
diff --git a/deps/v8/src/snapshot/serializer-common.cc b/deps/v8/src/snapshot/serializer-common.cc
index 71436fe8fd5..d4f0c9eff72 100644
--- a/deps/v8/src/snapshot/serializer-common.cc
+++ b/deps/v8/src/snapshot/serializer-common.cc
@@ -22,7 +22,7 @@ ExternalReferenceEncoder::ExternalReferenceEncoder(Isolate* isolate) {
   map_ = new AddressToIndexHashMap();
   isolate->set_external_reference_map(map_);
   // Add V8's external references.
-  ExternalReferenceTable* table = ExternalReferenceTable::instance(isolate);
+  ExternalReferenceTable* table = isolate->heap()->external_reference_table();
   for (uint32_t i = 0; i < table->size(); ++i) {
     Address addr = table->address(i);
     // Ignore duplicate references.
@@ -86,7 +86,7 @@ const char* ExternalReferenceEncoder::NameOfAddress(Isolate* isolate,
                                                     Address address) const {
   Maybe<uint32_t> maybe_index = map_->Get(address);
   if (maybe_index.IsNothing()) return "<unknown>";
-  return ExternalReferenceTable::instance(isolate)->name(
+  return isolate->heap()->external_reference_table()->name(
       maybe_index.FromJust());
 }
 
@@ -98,6 +98,11 @@ void SerializedData::AllocateData(uint32_t size) {
   DCHECK(IsAligned(reinterpret_cast<intptr_t>(data_), kPointerAlignment));
 }
 
+// static
+uint32_t SerializedData::ComputeMagicNumber(Isolate* isolate) {
+  return ComputeMagicNumber(isolate->heap()->external_reference_table());
+}
+
 // The partial snapshot cache is terminated by undefined. We visit the
 // partial snapshot...
 //  - during deserialization to populate it.
@@ -111,7 +116,8 @@ void SerializerDeserializer::Iterate(Isolate* isolate, RootVisitor* visitor) {
     if (cache->size() <= i) cache->push_back(Smi::kZero);
     // During deserialization, the visitor populates the partial snapshot cache
     // and eventually terminates the cache with undefined.
-    visitor->VisitRootPointer(Root::kPartialSnapshotCache, &cache->at(i));
+    visitor->VisitRootPointer(Root::kPartialSnapshotCache, nullptr,
+                              &cache->at(i));
     if (cache->at(i)->IsUndefined(isolate)) break;
   }
 }
diff --git a/deps/v8/src/snapshot/serializer-common.h b/deps/v8/src/snapshot/serializer-common.h
index 7d3d66a08d5..26c2da2247a 100644
--- a/deps/v8/src/snapshot/serializer-common.h
+++ b/deps/v8/src/snapshot/serializer-common.h
@@ -116,34 +116,56 @@ class SerializerDeserializer : public RootVisitor {
   void RestoreExternalReferenceRedirectors(
       const std::vector<CallHandlerInfo*>& call_handler_infos);
 
+#define UNUSED_SERIALIZER_BYTE_CODES(V) \
+  V(0x18)                               \
+  V(0x3d)                               \
+  V(0x3e)                               \
+  V(0x3f)                               \
+  V(0x58)                               \
+  V(0x59)                               \
+  V(0x5a)                               \
+  V(0x5b)                               \
+  V(0x5c)                               \
+  V(0x5d)                               \
+  V(0x5e)                               \
+  V(0x5f)                               \
+  V(0x67)                               \
+  V(0x76)                               \
+  V(0x78)                               \
+  V(0x79)                               \
+  V(0x7a)                               \
+  V(0x7b)                               \
+  V(0x7c)                               \
+  V(0x7d)
+
   // ---------- byte code range 0x00..0x7f ----------
   // Byte codes in this range represent Where, HowToCode and WhereToPoint.
   // Where the pointed-to object can be found:
   // The static assert below will trigger when the number of preallocated spaces
   // changed. If that happens, update the bytecode ranges in the comments below.
-  STATIC_ASSERT(5 == kNumberOfSpaces);
+  STATIC_ASSERT(6 == kNumberOfSpaces);
   enum Where {
-    // 0x00..0x04  Allocate new object, in specified space.
+    // 0x00..0x05  Allocate new object, in specified space.
     kNewObject = 0x00,
-    // 0x08..0x0c  Reference to previous object from space.
+    // 0x08..0x0d  Reference to previous object from space.
     kBackref = 0x08,
-    // 0x10..0x14  Reference to previous object from space after skip.
+    // 0x10..0x15  Reference to previous object from space after skip.
     kBackrefWithSkip = 0x10,
 
-    // 0x05       Root array item.
-    kRootArray = 0x05,
     // 0x06        Object in the partial snapshot cache.
     kPartialSnapshotCache = 0x06,
     // 0x07        External reference referenced by id.
     kExternalReference = 0x07,
 
-    // 0x0d        Object provided in the attached list.
-    kAttachedReference = 0x0d,
     // 0x0e        Builtin code referenced by index.
     kBuiltin = 0x0e,
+    // 0x16       Root array item.
+    kRootArray = 0x16,
+    // 0x17        Object provided in the attached list.
+    kAttachedReference = 0x17,
 
     // 0x0f        Misc, see below (incl. 0x2f, 0x4f, 0x6f).
-    // 0x15..0x1f  Misc, see below (incl. 0x35..0x3f, 0x55..0x5f, 0x75..0x7f).
+    // 0x18..0x1f  Misc, see below (incl. 0x38..0x3f, 0x58..0x5f, 0x78..0x7f).
   };
 
   static const int kWhereMask = 0x1f;
@@ -179,45 +201,38 @@ class SerializerDeserializer : public RootVisitor {
   static const int kNextChunk = 0x4f;
   // Deferring object content.
   static const int kDeferred = 0x6f;
-  // Alignment prefixes 0x15..0x17
-  static const int kAlignmentPrefix = 0x15;
+  // Alignment prefixes 0x19..0x1b
+  static const int kAlignmentPrefix = 0x19;
   // A tag emitted at strategic points in the snapshot to delineate sections.
   // If the deserializer does not find these at the expected moments then it
   // is an indication that the snapshot and the VM do not fit together.
   // Examine the build process for architecture, version or configuration
   // mismatches.
-  static const int kSynchronize = 0x18;
+  static const int kSynchronize = 0x1c;
   // Repeats of variable length.
-  static const int kVariableRepeat = 0x19;
+  static const int kVariableRepeat = 0x1d;
   // Raw data of variable length.
-  static const int kVariableRawCode = 0x1a;
-  static const int kVariableRawData = 0x1b;
 
   // Used for embedder-allocated backing stores for TypedArrays.
-  static const int kOffHeapBackingStore = 0x1c;
-
-  // 0x1d, 0x1e unused.
+  static const int kOffHeapBackingStore = 0x1e;
 
   // Used for embedder-provided serialization data for embedder fields.
   static const int kEmbedderFieldsData = 0x1f;
 
-  // Internal reference encoded as offsets of pc and target from code entry.
-  static const int kInternalReference = 0x35;
-  static const int kInternalReferenceEncoded = 0x36;
-
   // Used to encode external referenced provided through the API.
-  static const int kApiReference = 0x37;
+  static const int kApiReference = 0x38;
 
-  // 8 hot (recently seen or back-referenced) objects with optional skip.
-  static const int kNumberOfHotObjects = 8;
-  STATIC_ASSERT(kNumberOfHotObjects == HotObjectsList::kSize);
-  // 0x38..0x3f
-  static const int kHotObject = 0x38;
-  // 0x58..0x5f
-  static const int kHotObjectWithSkip = 0x58;
-  static const int kHotObjectMask = 0x07;
+  static const int kVariableRawCode = 0x39;
+  static const int kVariableRawData = 0x3a;
 
-  // 0x55..0x57, 0x75..0x7f unused.
+  static const int kInternalReference = 0x3b;
+  static const int kInternalReferenceEncoded = 0x3c;
+
+  // In-place weak references
+  static const int kWeakPrefix = 0x7e;
+
+  // Encodes an off-heap instruction stream target.
+  static const int kOffHeapTarget = 0x7f;
 
   // ---------- byte code range 0x80..0xff ----------
   // First 32 root array items.
@@ -241,7 +256,14 @@ class SerializerDeserializer : public RootVisitor {
   static const int kFixedRepeat = 0xe0;
   static const int kFixedRepeatStart = kFixedRepeat - 1;
 
-  // 0xf0..0xff unused.
+  // 8 hot (recently seen or back-referenced) objects with optional skip.
+  static const int kNumberOfHotObjects = 8;
+  STATIC_ASSERT(kNumberOfHotObjects == HotObjectsList::kSize);
+  // 0xf0..0xf7
+  static const int kHotObject = 0xf0;
+  // 0xf8..0xff
+  static const int kHotObjectWithSkip = 0xf8;
+  static const int kHotObjectMask = 0x07;
 
   // ---------- special values ----------
   static const int kAnyOldSpace = -1;
@@ -306,9 +328,7 @@ class SerializedData {
 
   void AllocateData(uint32_t size);
 
-  static uint32_t ComputeMagicNumber(Isolate* isolate) {
-    return ComputeMagicNumber(ExternalReferenceTable::instance(isolate));
-  }
+  static uint32_t ComputeMagicNumber(Isolate* isolate);
 
   void SetMagicNumber(Isolate* isolate) {
     SetHeaderValue(kMagicNumberOffset, ComputeMagicNumber(isolate));
diff --git a/deps/v8/src/snapshot/serializer.cc b/deps/v8/src/snapshot/serializer.cc
index 87e4fe8fdcf..a8547aeae2c 100644
--- a/deps/v8/src/snapshot/serializer.cc
+++ b/deps/v8/src/snapshot/serializer.cc
@@ -10,6 +10,7 @@
 #include "src/objects/map.h"
 #include "src/snapshot/builtin-serializer-allocator.h"
 #include "src/snapshot/natives.h"
+#include "src/snapshot/snapshot.h"
 
 namespace v8 {
 namespace internal {
@@ -92,8 +93,9 @@ bool Serializer<AllocatorT>::MustBeDeferred(HeapObject* object) {
 }
 
 template <class AllocatorT>
-void Serializer<AllocatorT>::VisitRootPointers(Root root, Object** start,
-                                               Object** end) {
+void Serializer<AllocatorT>::VisitRootPointers(Root root,
+                                               const char* description,
+                                               Object** start, Object** end) {
   // Builtins and bytecode handlers are serialized in a separate pass by the
   // BuiltinSerializer.
   if (root == Root::kBuiltins || root == Root::kDispatchTable) return;
@@ -184,7 +186,7 @@ bool Serializer<AllocatorT>::SerializeBackReference(HeapObject* obj,
 template <class AllocatorT>
 bool Serializer<AllocatorT>::SerializeBuiltinReference(
     HeapObject* obj, HowToCode how_to_code, WhereToPoint where_to_point,
-    int skip, BuiltinReferenceSerializationMode mode) {
+    int skip) {
   if (!obj->IsCode()) return false;
 
   Code* code = Code::cast(obj);
@@ -196,11 +198,6 @@ bool Serializer<AllocatorT>::SerializeBuiltinReference(
   DCHECK_LT(builtin_index, Builtins::builtin_count);
   DCHECK_LE(0, builtin_index);
 
-  if (mode == kCanonicalizeCompileLazy &&
-      code->is_interpreter_trampoline_builtin()) {
-    builtin_index = static_cast<int>(Builtins::kCompileLazy);
-  }
-
   if (FLAG_trace_serializer) {
     PrintF(" Encoding builtin reference: %s\n",
            isolate()->builtins()->name(builtin_index));
@@ -283,7 +280,7 @@ void Serializer<AllocatorT>::PutAttachedReference(SerializerReference reference,
 
 template <class AllocatorT>
 int Serializer<AllocatorT>::PutAlignmentPrefix(HeapObject* object) {
-  AllocationAlignment alignment = object->RequiredAlignment();
+  AllocationAlignment alignment = HeapObject::RequiredAlignment(object->map());
   if (alignment != kWordAligned) {
     DCHECK(1 <= alignment && alignment <= 3);
     byte prefix = (kAlignmentPrefix - 1) + alignment;
@@ -449,6 +446,7 @@ void Serializer<AllocatorT>::ObjectSerializer::SerializeJSArrayBuffer() {
     buffer->set_backing_store(Smi::FromInt(ref));
   }
   SerializeObject();
+  buffer->set_backing_store(backing_store);
 }
 
 template <class AllocatorT>
@@ -669,12 +667,12 @@ void Serializer<AllocatorT>::ObjectSerializer::SerializeContent(Map* map,
     // For code objects, output raw bytes first.
     OutputCode(size);
     // Then iterate references via reloc info.
-    object_->IterateBody(map->instance_type(), size, this);
+    object_->IterateBody(map, size, this);
     // Finally skip to the end.
     serializer_->FlushSkip(SkipTo(object_->address() + size));
   } else {
     // For other objects, iterate references first.
-    object_->IterateBody(map->instance_type(), size, this);
+    object_->IterateBody(map, size, this);
     // Then output data payload, if any.
     OutputRawData(object_->address() + size);
   }
@@ -684,23 +682,37 @@ template <class AllocatorT>
 void Serializer<AllocatorT>::ObjectSerializer::VisitPointers(HeapObject* host,
                                                              Object** start,
                                                              Object** end) {
-  Object** current = start;
-  while (current < end) {
-    while (current < end && (*current)->IsSmi()) current++;
-    if (current < end) OutputRawData(reinterpret_cast<Address>(current));
+  VisitPointers(host, reinterpret_cast<MaybeObject**>(start),
+                reinterpret_cast<MaybeObject**>(end));
+}
 
-    while (current < end && !(*current)->IsSmi()) {
-      HeapObject* current_contents = HeapObject::cast(*current);
+template <class AllocatorT>
+void Serializer<AllocatorT>::ObjectSerializer::VisitPointers(
+    HeapObject* host, MaybeObject** start, MaybeObject** end) {
+  MaybeObject** current = start;
+  while (current < end) {
+    while (current < end &&
+           ((*current)->IsSmi() || (*current)->IsClearedWeakHeapObject())) {
+      current++;
+    }
+    if (current < end) {
+      OutputRawData(reinterpret_cast<Address>(current));
+    }
+    HeapObject* current_contents;
+    HeapObjectReferenceType reference_type;
+    while (current < end && (*current)->ToStrongOrWeakHeapObject(
+                                &current_contents, &reference_type)) {
       int root_index = serializer_->root_index_map()->Lookup(current_contents);
       // Repeats are not subject to the write barrier so we can only use
       // immortal immovable root members. They are never in new space.
       if (current != start && root_index != RootIndexMap::kInvalidRootIndex &&
           Heap::RootIsImmortalImmovable(root_index) &&
-          current_contents == current[-1]) {
+          *current == current[-1]) {
+        DCHECK_EQ(reference_type, HeapObjectReferenceType::STRONG);
         DCHECK(!serializer_->isolate()->heap()->InNewSpace(current_contents));
         int repeat_count = 1;
         while (&current[repeat_count] < end - 1 &&
-               current[repeat_count] == current_contents) {
+               current[repeat_count] == *current) {
           repeat_count++;
         }
         current += repeat_count;
@@ -712,6 +724,9 @@ void Serializer<AllocatorT>::ObjectSerializer::VisitPointers(HeapObject* host,
           sink_->Put(kFixedRepeatStart + repeat_count, "FixedRepeat");
         }
       } else {
+        if (reference_type == HeapObjectReferenceType::WEAK) {
+          sink_->Put(kWeakPrefix, "WeakReference");
+        }
         serializer_->SerializeObject(current_contents, kPlain, kStartOfObject,
                                      0);
         bytes_processed_so_far_ += kPointerSize;
@@ -806,6 +821,29 @@ void Serializer<AllocatorT>::ObjectSerializer::VisitRuntimeEntry(
   bytes_processed_so_far_ += rinfo->target_address_size();
 }
 
+template <class AllocatorT>
+void Serializer<AllocatorT>::ObjectSerializer::VisitOffHeapTarget(
+    Code* host, RelocInfo* rinfo) {
+#ifdef V8_EMBEDDED_BUILTINS
+  {
+    STATIC_ASSERT(EmbeddedData::kTableSize == Builtins::builtin_count);
+    CHECK(Builtins::IsOffHeapBuiltin(host));
+    Address addr = rinfo->target_off_heap_target();
+    CHECK_NOT_NULL(addr);
+    CHECK_NOT_NULL(
+        InstructionStream::TryLookupCode(serializer_->isolate(), addr));
+  }
+
+  int skip = SkipTo(rinfo->target_address_address());
+  sink_->Put(kOffHeapTarget, "OffHeapTarget");
+  sink_->PutInt(skip, "SkipB4OffHeapTarget");
+  sink_->PutInt(host->builtin_index(), "builtin index");
+  bytes_processed_so_far_ += rinfo->target_address_size();
+#else
+  UNREACHABLE();
+#endif
+}
+
 template <class AllocatorT>
 void Serializer<AllocatorT>::ObjectSerializer::VisitCodeTarget(
     Code* host, RelocInfo* rinfo) {
@@ -885,7 +923,7 @@ void Serializer<AllocatorT>::ObjectSerializer::OutputCode(int size) {
                     RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED);
     for (RelocIterator it(code, mode_mask); !it.done(); it.next()) {
       RelocInfo* rinfo = it.rinfo();
-      rinfo->WipeOut(serializer_->isolate());
+      rinfo->WipeOut();
     }
     // We need to wipe out the header fields *after* wiping out the
     // relocations, because some of these fields are needed for the latter.
diff --git a/deps/v8/src/snapshot/serializer.h b/deps/v8/src/snapshot/serializer.h
index 22dcb26c8c8..9f8db6ccfe2 100644
--- a/deps/v8/src/snapshot/serializer.h
+++ b/deps/v8/src/snapshot/serializer.h
@@ -7,6 +7,7 @@
 
 #include <map>
 
+#include "src/instruction-stream.h"
 #include "src/isolate.h"
 #include "src/log.h"
 #include "src/objects.h"
@@ -117,6 +118,11 @@ class CodeAddressMap : public CodeEventLogger {
     address_to_name_map_.Insert(code->address(), name, length);
   }
 
+  void LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
+                         int length) override {
+    UNREACHABLE();
+  }
+
   NameMap address_to_name_map_;
   Isolate* isolate_;
 };
@@ -162,7 +168,8 @@ class Serializer : public SerializerDeserializer {
 
   virtual bool MustBeDeferred(HeapObject* object);
 
-  void VisitRootPointers(Root root, Object** start, Object** end) override;
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override;
 
   void PutRoot(int index, HeapObject* object, HowToCode how, WhereToPoint where,
                int skip);
@@ -182,17 +189,10 @@ class Serializer : public SerializerDeserializer {
   bool SerializeBackReference(HeapObject* obj, HowToCode how_to_code,
                               WhereToPoint where_to_point, int skip);
 
-  // Determines whether the interpreter trampoline is replaced by CompileLazy.
-  enum BuiltinReferenceSerializationMode {
-    kDefault,
-    kCanonicalizeCompileLazy,
-  };
-
   // Returns true if the object was successfully serialized as a builtin
   // reference.
-  bool SerializeBuiltinReference(
-      HeapObject* obj, HowToCode how_to_code, WhereToPoint where_to_point,
-      int skip, BuiltinReferenceSerializationMode mode = kDefault);
+  bool SerializeBuiltinReference(HeapObject* obj, HowToCode how_to_code,
+                                 WhereToPoint where_to_point, int skip);
 
   // Returns true if the given heap object is a bytecode handler code object.
   bool ObjectIsBytecodeHandler(HeapObject* obj) const;
@@ -290,12 +290,15 @@ class Serializer<AllocatorT>::ObjectSerializer : public ObjectVisitor {
   void SerializeObject();
   void SerializeDeferred();
   void VisitPointers(HeapObject* host, Object** start, Object** end) override;
+  void VisitPointers(HeapObject* host, MaybeObject** start,
+                     MaybeObject** end) override;
   void VisitEmbeddedPointer(Code* host, RelocInfo* target) override;
   void VisitExternalReference(Foreign* host, Address* p) override;
   void VisitExternalReference(Code* host, RelocInfo* rinfo) override;
   void VisitInternalReference(Code* host, RelocInfo* rinfo) override;
   void VisitCodeTarget(Code* host, RelocInfo* target) override;
   void VisitRuntimeEntry(Code* host, RelocInfo* reloc) override;
+  void VisitOffHeapTarget(Code* host, RelocInfo* target) override;
 
  private:
   void SerializePrologue(AllocationSpace space, int size, Map* map);
diff --git a/deps/v8/src/snapshot/snapshot-common.cc b/deps/v8/src/snapshot/snapshot-common.cc
index 2bf50cc7483..4a0949f97e9 100644
--- a/deps/v8/src/snapshot/snapshot-common.cc
+++ b/deps/v8/src/snapshot/snapshot-common.cc
@@ -8,6 +8,8 @@
 
 #include "src/api.h"
 #include "src/base/platform/platform.h"
+#include "src/callable.h"
+#include "src/interface-descriptors.h"
 #include "src/objects-inl.h"
 #include "src/snapshot/builtin-deserializer.h"
 #include "src/snapshot/builtin-serializer.h"
@@ -89,6 +91,10 @@ MaybeHandle<Context> Snapshot::NewContextFromSnapshot(
 
 // static
 Code* Snapshot::DeserializeBuiltin(Isolate* isolate, int builtin_id) {
+  if (FLAG_trace_lazy_deserialization) {
+    PrintF("Lazy-deserializing builtin %s\n", Builtins::name(builtin_id));
+  }
+
   base::ElapsedTimer timer;
   if (FLAG_profile_deserialization) timer.Start();
 
@@ -115,10 +121,61 @@ Code* Snapshot::DeserializeBuiltin(Isolate* isolate, int builtin_id) {
   return code;
 }
 
+// static
+void Snapshot::EnsureAllBuiltinsAreDeserialized(Isolate* isolate) {
+  if (!FLAG_lazy_deserialization) return;
+
+  if (FLAG_trace_lazy_deserialization) {
+    PrintF("Forcing eager builtin deserialization\n");
+  }
+
+  Builtins* builtins = isolate->builtins();
+  for (int i = 0; i < Builtins::builtin_count; i++) {
+    if (!Builtins::IsLazy(i)) continue;
+
+    DCHECK_NE(Builtins::kDeserializeLazy, i);
+    Code* code = builtins->builtin(i);
+    if (code->builtin_index() == Builtins::kDeserializeLazy) {
+      code = Snapshot::DeserializeBuiltin(isolate, i);
+    }
+
+    DCHECK_EQ(i, code->builtin_index());
+    DCHECK_EQ(code, builtins->builtin(i));
+  }
+}
+
+// static
+Code* Snapshot::EnsureBuiltinIsDeserialized(Isolate* isolate,
+                                            Handle<SharedFunctionInfo> shared) {
+  DCHECK(FLAG_lazy_deserialization);
+
+  int builtin_id = shared->builtin_id();
+
+  // We should never lazily deserialize DeserializeLazy.
+  DCHECK_NE(Builtins::kDeserializeLazy, builtin_id);
+
+  // Look up code from builtins list.
+  Code* code = isolate->builtins()->builtin(builtin_id);
+
+  // Deserialize if builtin is not on the list.
+  if (code->builtin_index() != builtin_id) {
+    DCHECK_EQ(code->builtin_index(), Builtins::kDeserializeLazy);
+    code = Snapshot::DeserializeBuiltin(isolate, builtin_id);
+    DCHECK_EQ(builtin_id, code->builtin_index());
+    DCHECK_EQ(code, isolate->builtins()->builtin(builtin_id));
+  }
+  return code;
+}
+
 // static
 Code* Snapshot::DeserializeHandler(Isolate* isolate,
                                    interpreter::Bytecode bytecode,
                                    interpreter::OperandScale operand_scale) {
+  if (FLAG_trace_lazy_deserialization) {
+    PrintF("Lazy-deserializing handler %s\n",
+           interpreter::Bytecodes::ToString(bytecode, operand_scale).c_str());
+  }
+
   base::ElapsedTimer timer;
   if (FLAG_profile_deserialization) timer.Start();
 
@@ -236,6 +293,131 @@ v8::StartupData Snapshot::CreateSnapshotBlob(
   return result;
 }
 
+#ifdef V8_EMBEDDED_BUILTINS
+namespace {
+bool BuiltinAliasesOffHeapTrampolineRegister(Isolate* isolate, Code* code) {
+  DCHECK(Builtins::IsOffHeapSafe(code->builtin_index()));
+  switch (Builtins::KindOf(code->builtin_index())) {
+    case Builtins::CPP:
+    case Builtins::TFC:
+    case Builtins::TFH:
+    case Builtins::TFJ:
+    case Builtins::TFS:
+      break;
+    case Builtins::API:
+    case Builtins::ASM:
+      // TODO(jgruber): Extend checks to remaining kinds.
+      return false;
+  }
+
+  Callable callable = Builtins::CallableFor(
+      isolate, static_cast<Builtins::Name>(code->builtin_index()));
+  CallInterfaceDescriptor descriptor = callable.descriptor();
+
+  if (descriptor.ContextRegister() == kOffHeapTrampolineRegister) {
+    return true;
+  }
+
+  for (int i = 0; i < descriptor.GetRegisterParameterCount(); i++) {
+    Register reg = descriptor.GetRegisterParameter(i);
+    if (reg == kOffHeapTrampolineRegister) return true;
+  }
+
+  return false;
+}
+}  // namespace
+
+// static
+EmbeddedData EmbeddedData::FromIsolate(Isolate* isolate) {
+  Builtins* builtins = isolate->builtins();
+
+  // Store instruction stream lengths and offsets.
+  std::vector<uint32_t> lengths(kTableSize);
+  std::vector<uint32_t> offsets(kTableSize);
+
+  bool saw_unsafe_builtin = false;
+  uint32_t raw_data_size = 0;
+  for (int i = 0; i < Builtins::builtin_count; i++) {
+    Code* code = builtins->builtin(i);
+
+    if (Builtins::IsOffHeapSafe(i)) {
+      DCHECK(!Builtins::IsLazy(i));
+
+      // Sanity-check that the given builtin is process-independent and does not
+      // use the trampoline register in its calling convention.
+      if (!code->IsProcessIndependent()) {
+        saw_unsafe_builtin = true;
+        fprintf(stderr, "%s is not process-independent.\n", Builtins::name(i));
+      }
+      if (BuiltinAliasesOffHeapTrampolineRegister(isolate, code)) {
+        saw_unsafe_builtin = true;
+        fprintf(stderr, "%s aliases the off-heap trampoline register.\n",
+                Builtins::name(i));
+      }
+
+      uint32_t length = static_cast<uint32_t>(code->instruction_size());
+
+      DCHECK_EQ(0, raw_data_size % kCodeAlignment);
+      offsets[i] = raw_data_size;
+      lengths[i] = length;
+
+      // Align the start of each instruction stream.
+      raw_data_size += RoundUp<kCodeAlignment>(length);
+    } else {
+      offsets[i] = raw_data_size;
+      lengths[i] = 0;
+    }
+  }
+  CHECK(!saw_unsafe_builtin);
+
+  const uint32_t blob_size = RawDataOffset() + raw_data_size;
+  uint8_t* blob = new uint8_t[blob_size];
+  std::memset(blob, 0, blob_size);
+
+  // Write the offsets and length tables.
+  DCHECK_EQ(OffsetsSize(), sizeof(offsets[0]) * offsets.size());
+  std::memcpy(blob + OffsetsOffset(), offsets.data(), OffsetsSize());
+
+  DCHECK_EQ(LengthsSize(), sizeof(lengths[0]) * lengths.size());
+  std::memcpy(blob + LengthsOffset(), lengths.data(), LengthsSize());
+
+  // Write the raw data section.
+  for (int i = 0; i < Builtins::builtin_count; i++) {
+    if (!Builtins::IsOffHeapSafe(i)) continue;
+    Code* code = builtins->builtin(i);
+    uint32_t offset = offsets[i];
+    uint8_t* dst = blob + RawDataOffset() + offset;
+    DCHECK_LE(RawDataOffset() + offset + code->instruction_size(), blob_size);
+    std::memcpy(dst, code->instruction_start(), code->instruction_size());
+  }
+
+  return {blob, blob_size};
+}
+
+EmbeddedData EmbeddedData::FromBlob() {
+  const uint8_t* data = Isolate::CurrentEmbeddedBlob();
+  uint32_t size = Isolate::CurrentEmbeddedBlobSize();
+  DCHECK_NOT_NULL(data);
+  DCHECK_LT(0, size);
+  return {data, size};
+}
+
+const uint8_t* EmbeddedData::InstructionStartOfBuiltin(int i) const {
+  DCHECK(Builtins::IsBuiltinId(i));
+
+  const uint32_t* offsets = Offsets();
+  const uint8_t* result = RawData() + offsets[i];
+  DCHECK_LT(result, data_ + size_);
+  return result;
+}
+
+uint32_t EmbeddedData::InstructionSizeOfBuiltin(int i) const {
+  DCHECK(Builtins::IsBuiltinId(i));
+  const uint32_t* lengths = Lengths();
+  return lengths[i];
+}
+#endif
+
 uint32_t Snapshot::ExtractNumContexts(const v8::StartupData* data) {
   CHECK_LT(kNumberOfContextsOffset, data->raw_size);
   uint32_t num_contexts = GetHeaderValue(data, kNumberOfContextsOffset);
@@ -312,16 +494,16 @@ void Snapshot::CheckVersion(const v8::StartupData* data) {
   CHECK_LT(kVersionStringOffset + kVersionStringLength,
            static_cast<uint32_t>(data->raw_size));
   Version::GetString(Vector<char>(version, kVersionStringLength));
-  if (memcmp(version, data->data + kVersionStringOffset,
-             kVersionStringLength) != 0) {
-    V8_Fatal(__FILE__, __LINE__,
-             "Version mismatch between V8 binary and snapshot.\n"
-             "#   V8 binary version: %.*s\n"
-             "#    Snapshot version: %.*s\n"
-             "# The snapshot consists of %d bytes and contains %d context(s).",
-             kVersionStringLength, version, kVersionStringLength,
-             data->data + kVersionStringOffset, data->raw_size,
-             ExtractNumContexts(data));
+  if (strncmp(version, data->data + kVersionStringOffset,
+              kVersionStringLength) != 0) {
+    FATAL(
+        "Version mismatch between V8 binary and snapshot.\n"
+        "#   V8 binary version: %.*s\n"
+        "#    Snapshot version: %.*s\n"
+        "# The snapshot consists of %d bytes and contains %d context(s).",
+        kVersionStringLength, version, kVersionStringLength,
+        data->data + kVersionStringOffset, data->raw_size,
+        ExtractNumContexts(data));
   }
 }
 
diff --git a/deps/v8/src/snapshot/snapshot.h b/deps/v8/src/snapshot/snapshot.h
index 8f37e00c4ae..b86a4ac9f90 100644
--- a/deps/v8/src/snapshot/snapshot.h
+++ b/deps/v8/src/snapshot/snapshot.h
@@ -79,6 +79,62 @@ class BuiltinSnapshotData final : public SnapshotData {
   // ... list of builtins offsets
 };
 
+#ifdef V8_EMBEDDED_BUILTINS
+class EmbeddedData final {
+ public:
+  static EmbeddedData FromIsolate(Isolate* isolate);
+  static EmbeddedData FromBlob();
+
+  const uint8_t* data() const { return data_; }
+  uint32_t size() const { return size_; }
+
+  void Dispose() { delete[] data_; }
+
+  const uint8_t* InstructionStartOfBuiltin(int i) const;
+  uint32_t InstructionSizeOfBuiltin(int i) const;
+
+  bool ContainsBuiltin(int i) const { return InstructionSizeOfBuiltin(i) > 0; }
+
+  // Padded with kCodeAlignment.
+  uint32_t PaddedInstructionSizeOfBuiltin(int i) const {
+    return RoundUp<kCodeAlignment>(InstructionSizeOfBuiltin(i));
+  }
+
+  // The layout of the blob is as follows:
+  //
+  // [0] offset of instruction stream 0
+  // ... offsets
+  // [N] length of instruction stream 0
+  // ... lengths
+  // ... instruction streams
+
+  static constexpr uint32_t kTableSize = Builtins::builtin_count;
+  static constexpr uint32_t OffsetsOffset() { return 0; }
+  static constexpr uint32_t OffsetsSize() { return kUInt32Size * kTableSize; }
+  static constexpr uint32_t LengthsOffset() {
+    return OffsetsOffset() + OffsetsSize();
+  }
+  static constexpr uint32_t LengthsSize() { return kUInt32Size * kTableSize; }
+  static constexpr uint32_t RawDataOffset() {
+    return RoundUp<kCodeAlignment>(LengthsOffset() + LengthsSize());
+  }
+
+ private:
+  EmbeddedData(const uint8_t* data, uint32_t size) : data_(data), size_(size) {}
+
+  const uint32_t* Offsets() const {
+    return reinterpret_cast<const uint32_t*>(data_ + OffsetsOffset());
+  }
+  const uint32_t* Lengths() const {
+    return reinterpret_cast<const uint32_t*>(data_ + LengthsOffset());
+  }
+  const uint8_t* RawData() const { return data_ + RawDataOffset(); }
+
+  const uint8_t* data_;
+  uint32_t size_;
+};
+#endif
+
 class Snapshot : public AllStatic {
  public:
   // ---------------- Deserialization ----------------
@@ -97,6 +153,9 @@ class Snapshot : public AllStatic {
   // runtime after the isolate (and the builtins table) has been fully
   // initialized.
   static Code* DeserializeBuiltin(Isolate* isolate, int builtin_id);
+  static void EnsureAllBuiltinsAreDeserialized(Isolate* isolate);
+  static Code* EnsureBuiltinIsDeserialized(Isolate* isolate,
+                                           Handle<SharedFunctionInfo> shared);
 
   // Deserializes a single given handler code object. Intended to be called at
   // runtime after the isolate has been fully initialized.
diff --git a/deps/v8/src/snapshot/startup-deserializer.cc b/deps/v8/src/snapshot/startup-deserializer.cc
index e6f853fe0e0..16d731493de 100644
--- a/deps/v8/src/snapshot/startup-deserializer.cc
+++ b/deps/v8/src/snapshot/startup-deserializer.cc
@@ -20,7 +20,7 @@ void StartupDeserializer::DeserializeInto(Isolate* isolate) {
 
   if (!DefaultDeserializerAllocator::ReserveSpace(this,
                                                   &builtin_deserializer)) {
-    V8::FatalProcessOutOfMemory("StartupDeserializer");
+    V8::FatalProcessOutOfMemory(isolate, "StartupDeserializer");
   }
 
   // No active threads.
@@ -78,8 +78,7 @@ void StartupDeserializer::FlushICacheForNewIsolate() {
   DCHECK(!deserializing_user_code());
   // The entire isolate is newly deserialized. Simply flush all code pages.
   for (Page* p : *isolate()->heap()->code_space()) {
-    Assembler::FlushICache(isolate(), p->area_start(),
-                           p->area_end() - p->area_start());
+    Assembler::FlushICache(p->area_start(), p->area_end() - p->area_start());
   }
 }
 
diff --git a/deps/v8/src/snapshot/startup-serializer.cc b/deps/v8/src/snapshot/startup-serializer.cc
index 5ae6e33b87d..dc85a57e11a 100644
--- a/deps/v8/src/snapshot/startup-serializer.cc
+++ b/deps/v8/src/snapshot/startup-serializer.cc
@@ -5,19 +5,15 @@
 #include "src/snapshot/startup-serializer.h"
 
 #include "src/api.h"
+#include "src/global-handles.h"
 #include "src/objects-inl.h"
 #include "src/v8threads.h"
 
 namespace v8 {
 namespace internal {
 
-StartupSerializer::StartupSerializer(
-    Isolate* isolate,
-    v8::SnapshotCreator::FunctionCodeHandling function_code_handling)
-    : Serializer(isolate),
-      clear_function_code_(function_code_handling ==
-                           v8::SnapshotCreator::FunctionCodeHandling::kClear),
-      can_be_rehashed_(true) {
+StartupSerializer::StartupSerializer(Isolate* isolate)
+    : Serializer(isolate), can_be_rehashed_(true) {
   InitializeCodeAddressMap();
 }
 
@@ -32,13 +28,7 @@ void StartupSerializer::SerializeObject(HeapObject* obj, HowToCode how_to_code,
   DCHECK(!ObjectIsBytecodeHandler(obj));  // Only referenced in dispatch table.
   DCHECK(!obj->IsJSFunction());
 
-  if (clear_function_code() && obj->IsBytecodeArray()) {
-    obj = isolate()->heap()->undefined_value();
-  }
-
-  BuiltinReferenceSerializationMode mode =
-      clear_function_code() ? kCanonicalizeCompileLazy : kDefault;
-  if (SerializeBuiltinReference(obj, how_to_code, where_to_point, skip, mode)) {
+  if (SerializeBuiltinReference(obj, how_to_code, where_to_point, skip)) {
     return;
   }
   if (SerializeHotObject(obj, how_to_code, where_to_point, skip)) return;
@@ -94,7 +84,7 @@ void StartupSerializer::SerializeWeakReferencesAndDeferred() {
   // add entries to the partial snapshot cache of the startup snapshot. Add
   // one entry with 'undefined' to terminate the partial snapshot cache.
   Object* undefined = isolate()->heap()->undefined_value();
-  VisitRootPointer(Root::kPartialSnapshotCache, &undefined);
+  VisitRootPointer(Root::kPartialSnapshotCache, nullptr, &undefined);
   isolate()->heap()->IterateWeakRoots(this, VISIT_FOR_SERIALIZATION);
   SerializeDeferredObjects();
   Pad();
@@ -106,7 +96,7 @@ int StartupSerializer::PartialSnapshotCacheIndex(HeapObject* heap_object) {
     // This object is not part of the partial snapshot cache yet. Add it to the
     // startup snapshot so we can refer to it via partial snapshot index from
     // the partial snapshot.
-    VisitRootPointer(Root::kPartialSnapshotCache,
+    VisitRootPointer(Root::kPartialSnapshotCache, nullptr,
                      reinterpret_cast<Object**>(&heap_object));
   }
   return index;
@@ -133,8 +123,8 @@ void StartupSerializer::SerializeStrongReferences() {
   isolate->heap()->IterateStrongRoots(this, VISIT_FOR_SERIALIZATION);
 }
 
-void StartupSerializer::VisitRootPointers(Root root, Object** start,
-                                          Object** end) {
+void StartupSerializer::VisitRootPointers(Root root, const char* description,
+                                          Object** start, Object** end) {
   if (start == isolate()->heap()->roots_array_start()) {
     // Serializing the root list needs special handling:
     // - The first pass over the root list only serializes immortal immovables.
@@ -156,7 +146,7 @@ void StartupSerializer::VisitRootPointers(Root root, Object** start,
     }
     FlushSkip(skip);
   } else {
-    Serializer::VisitRootPointers(root, start, end);
+    Serializer::VisitRootPointers(root, description, start, end);
   }
 }
 
@@ -197,8 +187,9 @@ void SerializedHandleChecker::AddToSet(FixedArray* serialized) {
   for (int i = 0; i < length; i++) serialized_.insert(serialized->get(i));
 }
 
-void SerializedHandleChecker::VisitRootPointers(Root root, Object** start,
-                                                Object** end) {
+void SerializedHandleChecker::VisitRootPointers(Root root,
+                                                const char* description,
+                                                Object** start, Object** end) {
   for (Object** p = start; p < end; p++) {
     if (serialized_.find(*p) != serialized_.end()) continue;
     PrintF("%s handle not serialized: ",
diff --git a/deps/v8/src/snapshot/startup-serializer.h b/deps/v8/src/snapshot/startup-serializer.h
index ae2a9f49df0..190cc595291 100644
--- a/deps/v8/src/snapshot/startup-serializer.h
+++ b/deps/v8/src/snapshot/startup-serializer.h
@@ -14,9 +14,7 @@ namespace internal {
 
 class StartupSerializer : public Serializer<> {
  public:
-  StartupSerializer(
-      Isolate* isolate,
-      v8::SnapshotCreator::FunctionCodeHandling function_code_handling);
+  explicit StartupSerializer(Isolate* isolate);
   ~StartupSerializer() override;
 
   // Serialize the current state of the heap.  The order is:
@@ -30,7 +28,6 @@ class StartupSerializer : public Serializer<> {
   int PartialSnapshotCacheIndex(HeapObject* o);
 
   bool can_be_rehashed() const { return can_be_rehashed_; }
-  bool clear_function_code() const { return clear_function_code_; }
   bool root_has_been_serialized(int root_index) const {
     return root_has_been_serialized_.test(root_index);
   }
@@ -63,7 +60,8 @@ class StartupSerializer : public Serializer<> {
 
   // The StartupSerializer has to serialize the root array, which is slightly
   // different.
-  void VisitRootPointers(Root root, Object** start, Object** end) override;
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override;
   void SerializeObject(HeapObject* o, HowToCode how_to_code,
                        WhereToPoint where_to_point, int skip) override;
   void Synchronize(VisitorSynchronization::SyncTag tag) override;
@@ -71,7 +69,6 @@ class StartupSerializer : public Serializer<> {
 
   void CheckRehashability(HeapObject* obj);
 
-  const bool clear_function_code_;
   std::bitset<Heap::kStrongRootListLength> root_has_been_serialized_;
   PartialCacheIndexMap partial_cache_index_map_;
   std::vector<AccessorInfo*> accessor_infos_;
@@ -86,7 +83,8 @@ class StartupSerializer : public Serializer<> {
 class SerializedHandleChecker : public RootVisitor {
  public:
   SerializedHandleChecker(Isolate* isolate, std::vector<Context*>* contexts);
-  virtual void VisitRootPointers(Root root, Object** start, Object** end);
+  virtual void VisitRootPointers(Root root, const char* description,
+                                 Object** start, Object** end);
   bool CheckGlobalAndEternalHandles();
 
  private:
diff --git a/deps/v8/src/source-position-table.cc b/deps/v8/src/source-position-table.cc
index f7306c82ced..1057aba08c6 100644
--- a/deps/v8/src/source-position-table.cc
+++ b/deps/v8/src/source-position-table.cc
@@ -75,13 +75,13 @@ void EncodeEntry(std::vector<byte>& bytes, const PositionTableEntry& entry) {
 
 // Helper: Decode an integer.
 template <typename T>
-T DecodeInt(ByteArray* bytes, int* index) {
+T DecodeInt(Vector<const byte> bytes, int* index) {
   byte current;
   int shift = 0;
   T decoded = 0;
   bool more;
   do {
-    current = bytes->get((*index)++);
+    current = bytes[(*index)++];
     decoded |= static_cast<typename std::make_unsigned<T>::type>(
                    ValueBits::decode(current))
                << shift;
@@ -93,7 +93,8 @@ T DecodeInt(ByteArray* bytes, int* index) {
   return decoded;
 }
 
-void DecodeEntry(ByteArray* bytes, int* index, PositionTableEntry* entry) {
+void DecodeEntry(Vector<const byte> bytes, int* index,
+                 PositionTableEntry* entry) {
   int tmp = DecodeInt<int>(bytes, index);
   if (tmp >= 0) {
     entry->is_statement = true;
@@ -105,6 +106,11 @@ void DecodeEntry(ByteArray* bytes, int* index, PositionTableEntry* entry) {
   entry->source_position = DecodeInt<int64_t>(bytes, index);
 }
 
+Vector<const byte> VectorFromByteArray(ByteArray* byte_array) {
+  return Vector<const byte>(byte_array->GetDataStartAddress(),
+                            byte_array->length());
+}
+
 }  // namespace
 
 SourcePositionTableBuilder::SourcePositionTableBuilder(
@@ -159,7 +165,7 @@ Handle<ByteArray> SourcePositionTableBuilder::ToSourcePositionTable(
 }
 
 SourcePositionTableIterator::SourcePositionTableIterator(ByteArray* byte_array)
-    : raw_table_(byte_array) {
+    : raw_table_(VectorFromByteArray(byte_array)) {
   Advance();
 }
 
@@ -171,15 +177,24 @@ SourcePositionTableIterator::SourcePositionTableIterator(
   no_gc.Release();
 }
 
+SourcePositionTableIterator::SourcePositionTableIterator(
+    Vector<const byte> bytes)
+    : raw_table_(bytes) {
+  Advance();
+  // We can enable allocation because the underlying vector does not move.
+  no_gc.Release();
+}
+
 void SourcePositionTableIterator::Advance() {
-  ByteArray* table = raw_table_ ? raw_table_ : *table_;
+  Vector<const byte> bytes =
+      table_.is_null() ? raw_table_ : VectorFromByteArray(*table_);
   DCHECK(!done());
-  DCHECK(index_ >= 0 && index_ <= table->length());
-  if (index_ >= table->length()) {
+  DCHECK(index_ >= 0 && index_ <= bytes.length());
+  if (index_ >= bytes.length()) {
     index_ = kDone;
   } else {
     PositionTableEntry tmp;
-    DecodeEntry(table, &index_, &tmp);
+    DecodeEntry(bytes, &index_, &tmp);
     AddAndSetEntry(current_, tmp);
   }
 }
diff --git a/deps/v8/src/source-position-table.h b/deps/v8/src/source-position-table.h
index 9028e50f798..652f5aa34a0 100644
--- a/deps/v8/src/source-position-table.h
+++ b/deps/v8/src/source-position-table.h
@@ -64,7 +64,7 @@ class V8_EXPORT_PRIVATE SourcePositionTableIterator {
     PositionTableEntry position_;
   };
 
-  // We expose two flavours of the iterator, depending on the argument passed
+  // We expose three flavours of the iterator, depending on the argument passed
   // to the constructor:
 
   // Handlified iterator allows allocation, but it needs a handle (and thus
@@ -76,6 +76,10 @@ class V8_EXPORT_PRIVATE SourcePositionTableIterator {
   // scope around.
   explicit SourcePositionTableIterator(ByteArray* byte_array);
 
+  // Handle-safe iterator based on an a vector located outside the garbage
+  // collected heap, allows allocation during its lifetime.
+  explicit SourcePositionTableIterator(Vector<const byte> bytes);
+
   void Advance();
 
   int code_offset() const {
@@ -102,7 +106,7 @@ class V8_EXPORT_PRIVATE SourcePositionTableIterator {
  private:
   static const int kDone = -1;
 
-  ByteArray* raw_table_ = nullptr;
+  Vector<const byte> raw_table_;
   Handle<ByteArray> table_;
   int index_ = 0;
   PositionTableEntry current_;
diff --git a/deps/v8/src/startup-data-util.cc b/deps/v8/src/startup-data-util.cc
index 5f5472f0afc..e9b6f6ef538 100644
--- a/deps/v8/src/startup-data-util.cc
+++ b/deps/v8/src/startup-data-util.cc
@@ -10,6 +10,7 @@
 #include "src/base/file-utils.h"
 #include "src/base/logging.h"
 #include "src/base/platform/platform.h"
+#include "src/flags.h"
 #include "src/utils.h"
 
 
@@ -86,9 +87,15 @@ void InitializeExternalStartupData(const char* directory_path) {
 #ifdef V8_USE_EXTERNAL_STARTUP_DATA
   char* natives;
   char* snapshot;
+  const char* snapshot_name = "snapshot_blob.bin";
+#ifdef V8_MULTI_SNAPSHOTS
+  if (!FLAG_untrusted_code_mitigations) {
+    snapshot_name = "snapshot_blob_trusted.bin";
+  }
+#endif
   LoadFromFiles(
       base::RelativePath(&natives, directory_path, "natives_blob.bin"),
-      base::RelativePath(&snapshot, directory_path, "snapshot_blob.bin"));
+      base::RelativePath(&snapshot, directory_path, snapshot_name));
   free(natives);
   free(snapshot);
 #endif  // V8_USE_EXTERNAL_STARTUP_DATA
diff --git a/deps/v8/src/string-case.h b/deps/v8/src/string-case.h
index 3fe3bc2b819..f57bae494f8 100644
--- a/deps/v8/src/string-case.h
+++ b/deps/v8/src/string-case.h
@@ -14,4 +14,4 @@ int FastAsciiConvert(char* dst, const char* src, int length, bool* changed_out);
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_STRING_CASE_H__
+#endif  // V8_STRING_CASE_H_
diff --git a/deps/v8/src/string-stream.cc b/deps/v8/src/string-stream.cc
index 7693a229bfb..272b2a354d3 100644
--- a/deps/v8/src/string-stream.cc
+++ b/deps/v8/src/string-stream.cc
@@ -481,7 +481,7 @@ void StringStream::PrintFunction(Object* f, Object* receiver, Code** code) {
 
 
 void StringStream::PrintPrototype(JSFunction* fun, Object* receiver) {
-  Object* name = fun->shared()->name();
+  Object* name = fun->shared()->Name();
   bool print_name = false;
   Isolate* isolate = fun->GetIsolate();
   if (receiver->IsNullOrUndefined(isolate) || receiver->IsTheHole(isolate) ||
@@ -516,7 +516,7 @@ void StringStream::PrintPrototype(JSFunction* fun, Object* receiver) {
   // which it was looked up.
   if (print_name) {
     Add("(aka ");
-    PrintName(fun->shared()->name());
+    PrintName(fun->shared()->Name());
     Put(')');
   }
 }
diff --git a/deps/v8/src/third_party/vtune/BUILD.gn b/deps/v8/src/third_party/vtune/BUILD.gn
index 33e8443b988..a2163ebaf1b 100644
--- a/deps/v8/src/third_party/vtune/BUILD.gn
+++ b/deps/v8/src/third_party/vtune/BUILD.gn
@@ -15,6 +15,6 @@ static_library("v8_vtune") {
     "vtune-jit.h",
   ]
   deps = [
-    "//:v8",
+    "../../..:v8",
   ]
 }
diff --git a/deps/v8/src/third_party/vtune/v8vtune.gyp b/deps/v8/src/third_party/vtune/v8vtune.gyp
deleted file mode 100644
index aaf521f3102..00000000000
--- a/deps/v8/src/third_party/vtune/v8vtune.gyp
+++ /dev/null
@@ -1,59 +0,0 @@
-# Copyright 2012 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-{
-  'variables': {
-    'v8_code': 1,
-  },
-  'includes': ['../../../gypfiles/toolchain.gypi', '../../../gypfiles/features.gypi'],
-  'targets': [
-    {
-      'target_name': 'v8_vtune',
-      'type': 'static_library',
-      'dependencies': [
-        '../../v8.gyp:v8',
-      ],
-      'sources': [
-        'ittnotify_config.h',
-        'ittnotify_types.h',
-        'jitprofiling.cc',
-        'jitprofiling.h',
-        'v8-vtune.h',
-        'vtune-jit.cc',
-        'vtune-jit.h',
-      ],
-      'direct_dependent_settings': {
-        'defines': ['ENABLE_VTUNE_JIT_INTERFACE',],
-        'conditions': [
-          ['OS != "win"', {
-            'libraries': ['-ldl',],
-          }],   
-        ],
-      },
-    },
-  ],
-}
diff --git a/deps/v8/src/tracing/trace-event.h b/deps/v8/src/tracing/trace-event.h
index bc73996be93..bd56f8a5552 100644
--- a/deps/v8/src/tracing/trace-event.h
+++ b/deps/v8/src/tracing/trace-event.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SRC_TRACING_TRACE_EVENT_H_
-#define SRC_TRACING_TRACE_EVENT_H_
+#ifndef V8_TRACING_TRACE_EVENT_H_
+#define V8_TRACING_TRACE_EVENT_H_
 
 #include <stddef.h>
 #include <memory>
@@ -686,4 +686,4 @@ class CallStatsScopedTracer {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // SRC_TRACING_TRACE_EVENT_H_
+#endif  // V8_TRACING_TRACE_EVENT_H_
diff --git a/deps/v8/src/transitions.cc b/deps/v8/src/transitions.cc
index 1d6f9a05be6..5cc76bf8350 100644
--- a/deps/v8/src/transitions.cc
+++ b/deps/v8/src/transitions.cc
@@ -205,62 +205,6 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
   ReplaceTransitions(*result);
 }
 
-void TransitionsAccessor::UpdateHandler(Name* name, Object* handler) {
-  if (map_->is_dictionary_map()) return;
-  switch (encoding()) {
-    case kPrototypeInfo:
-    case kUninitialized:
-      UNREACHABLE();
-      return;
-    case kWeakCell:
-    case kHandler:
-      DCHECK_EQ(GetSimpleTransition(), GetTargetFromRaw(handler));
-      ReplaceTransitions(handler);
-      return;
-    case kFullTransitionArray: {
-      PropertyAttributes attributes = name->IsPrivate() ? DONT_ENUM : NONE;
-      int transition = transitions()->Search(kData, name, attributes);
-      DCHECK_NE(kNotFound, transition);
-      DCHECK_EQ(transitions()->GetTarget(transition),
-                GetTargetFromRaw(handler));
-      transitions()->SetTarget(transition, handler);
-      return;
-    }
-  }
-}
-
-Object* TransitionsAccessor::SearchHandler(Name* name,
-                                           Handle<Map>* out_transition) {
-  switch (encoding()) {
-    case kPrototypeInfo:
-    case kUninitialized:
-    case kWeakCell:
-      return nullptr;
-    case kHandler: {
-      Object* raw_handler = StoreHandler::ValidHandlerOrNull(
-          raw_transitions_, name, out_transition);
-      if (raw_handler == nullptr) return raw_handler;
-      // Check transition key.
-      WeakCell* target_cell = StoreHandler::GetTransitionCell(raw_handler);
-      if (!IsMatchingMap(target_cell, name, kData, NONE)) return nullptr;
-      return raw_handler;
-    }
-
-    case kFullTransitionArray: {
-      int transition = transitions()->Search(kData, name, NONE);
-      if (transition == kNotFound) return nullptr;
-      Object* raw_handler = transitions()->GetRawTarget(transition);
-      if (raw_handler->IsStoreHandler()) {
-        return StoreHandler::ValidHandlerOrNull(raw_handler, name,
-                                                out_transition);
-      }
-      return nullptr;
-    }
-  }
-  UNREACHABLE();
-  return nullptr;  // Make GCC happy.
-}
-
 Map* TransitionsAccessor::SearchTransition(Name* name, PropertyKind kind,
                                            PropertyAttributes attributes) {
   DCHECK(name->IsUniqueName());
@@ -303,15 +247,19 @@ bool TransitionsAccessor::IsSpecialTransition(Name* name) {
          name == heap->strict_function_transition_symbol();
 }
 
-Handle<Map> TransitionsAccessor::FindTransitionToField(Handle<Name> name) {
+MaybeHandle<Map> TransitionsAccessor::FindTransitionToDataProperty(
+    Handle<Name> name, RequestedLocation requested_location) {
   DCHECK(name->IsUniqueName());
   DisallowHeapAllocation no_gc;
-  Map* target = SearchTransition(*name, kData, NONE);
-  if (target == nullptr) return Handle<Map>::null();
+  PropertyAttributes attributes = name->IsPrivate() ? DONT_ENUM : NONE;
+  Map* target = SearchTransition(*name, kData, attributes);
+  if (target == nullptr) return MaybeHandle<Map>();
   PropertyDetails details = target->GetLastDescriptorDetails();
-  DCHECK_EQ(NONE, details.attributes());
-  if (details.location() != kField) return Handle<Map>::null();
+  DCHECK_EQ(attributes, details.attributes());
   DCHECK_EQ(kData, details.kind());
+  if (requested_location == kFieldOnly && details.location() != kField) {
+    return MaybeHandle<Map>();
+  }
   return Handle<Map>(target);
 }
 
diff --git a/deps/v8/src/transitions.h b/deps/v8/src/transitions.h
index 62a8bb50d4c..6148220b0fd 100644
--- a/deps/v8/src/transitions.h
+++ b/deps/v8/src/transitions.h
@@ -55,19 +55,18 @@ class TransitionsAccessor {
   Map* SearchTransition(Name* name, PropertyKind kind,
                         PropertyAttributes attributes);
 
-  // This TransitionsAccessor instance is unusable after this operation.
-  void UpdateHandler(Name* name, Object* handler);
-
-  // If a valid handler is found, returns the transition target in
-  // |out_transition|.
-  Object* SearchHandler(Name* name, Handle<Map>* out_transition);
-
   Map* SearchSpecial(Symbol* name);
   // Returns true for non-property transitions like elements kind, or
   // or frozen/sealed transitions.
   static bool IsSpecialTransition(Name* name);
 
-  Handle<Map> FindTransitionToField(Handle<Name> name);
+  enum RequestedLocation { kAnyLocation, kFieldOnly };
+  MaybeHandle<Map> FindTransitionToDataProperty(
+      Handle<Name> name, RequestedLocation requested_location = kAnyLocation);
+
+  MaybeHandle<Map> FindTransitionToField(Handle<Name> name) {
+    return FindTransitionToDataProperty(name, kFieldOnly);
+  }
 
   Handle<String> ExpectedTransitionKey();
   Handle<Map> ExpectedTransitionTarget();
@@ -127,6 +126,8 @@ class TransitionsAccessor {
     kPrototypeInfo,
     kUninitialized,
     kWeakCell,
+    // TODO(ishell): drop support for kHandler encoding since we use maps
+    // as transition handlers.
     kHandler,
     kFullTransitionArray,
   };
diff --git a/deps/v8/src/trap-handler/handler-outside.cc b/deps/v8/src/trap-handler/handler-outside.cc
index 2c9225d4857..aac6ef6a111 100644
--- a/deps/v8/src/trap-handler/handler-outside.cc
+++ b/deps/v8/src/trap-handler/handler-outside.cc
@@ -34,10 +34,10 @@
 namespace {
 size_t gNextCodeObject = 0;
 
-#if defined(DEBUG)
-const bool kEnableDebug = true;
+#ifdef DEBUG
+constexpr bool kEnableDebug = true;
 #else
-const bool kEnableDebug = false;
+constexpr bool kEnableDebug = false;
 #endif
 }
 
@@ -45,8 +45,8 @@ namespace v8 {
 namespace internal {
 namespace trap_handler {
 
-const size_t kInitialCodeObjectSize = 1024;
-const size_t kCodeObjectGrowthFactor = 2;
+constexpr size_t kInitialCodeObjectSize = 1024;
+constexpr size_t kCodeObjectGrowthFactor = 2;
 
 constexpr size_t HandlerDataSize(size_t num_protected_instructions) {
   return offsetof(CodeProtectionInfo, instructions) +
@@ -54,7 +54,7 @@ constexpr size_t HandlerDataSize(size_t num_protected_instructions) {
 }
 
 namespace {
-template <typename = std::enable_if<kEnableDebug>>
+#ifdef DEBUG
 bool IsDisjoint(const CodeProtectionInfo* a, const CodeProtectionInfo* b) {
   if (a == nullptr || b == nullptr) {
     return true;
@@ -65,6 +65,7 @@ bool IsDisjoint(const CodeProtectionInfo* a, const CodeProtectionInfo* b) {
 
   return a_base >= b_base + b->size || b_base >= a_base + a->size;
 }
+#endif
 
 // Verify that the code range does not overlap any that have already been
 // registered.
@@ -134,15 +135,6 @@ CodeProtectionInfo* CreateHandlerData(
   return data;
 }
 
-void UpdateHandlerDataCodePointer(int index, void* base) {
-  MetadataLock lock;
-  if (static_cast<size_t>(index) >= gNumCodeObjects) {
-    abort();
-  }
-  CodeProtectionInfo* data = gCodeObjects[index].code_info;
-  data->base = base;
-}
-
 int RegisterHandlerData(
     void* base, size_t size, size_t num_protected_instructions,
     const ProtectedInstructionData* protected_instructions) {
@@ -181,6 +173,7 @@ int RegisterHandlerData(
       new_size = int_max;
     }
     if (new_size == gNumCodeObjects) {
+      free(data);
       return kInvalidIndex;
     }
 
@@ -215,6 +208,7 @@ int RegisterHandlerData(
 
     return static_cast<int>(i);
   } else {
+    free(data);
     return kInvalidIndex;
   }
 }
@@ -272,6 +266,20 @@ size_t GetRecoveredTrapCount() {
   return gRecoveredTrapCount.load(std::memory_order_relaxed);
 }
 
+bool g_is_trap_handler_enabled;
+
+bool EnableTrapHandler(bool use_v8_signal_handler) {
+  if (!V8_TRAP_HANDLER_SUPPORTED) {
+    return false;
+  }
+  if (use_v8_signal_handler) {
+    g_is_trap_handler_enabled = RegisterDefaultSignalHandler();
+    return g_is_trap_handler_enabled;
+  }
+  g_is_trap_handler_enabled = true;
+  return true;
+}
+
 }  // namespace trap_handler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/trap-handler/trap-handler-internal.h b/deps/v8/src/trap-handler/trap-handler-internal.h
index 1476eb844bf..a8cc371c362 100644
--- a/deps/v8/src/trap-handler/trap-handler-internal.h
+++ b/deps/v8/src/trap-handler/trap-handler-internal.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef TRAP_HANDLER_INTERNAL_H_
-#define TRAP_HANDLER_INTERNAL_H_
+#ifndef V8_TRAP_HANDLER_TRAP_HANDLER_INTERNAL_H_
+#define V8_TRAP_HANDLER_TRAP_HANDLER_INTERNAL_H_
 
 // This file should not be included (even transitively) by files outside of
 // src/trap-handler.
@@ -79,4 +79,4 @@ extern bool g_is_default_signal_handler_registered;
 }  // namespace internal
 }  // namespace v8
 
-#endif  // TRAP_HANDLER_INTERNAL_H_
+#endif  // V8_TRAP_HANDLER_TRAP_HANDLER_INTERNAL_H_
diff --git a/deps/v8/src/trap-handler/trap-handler.h b/deps/v8/src/trap-handler/trap-handler.h
index 1e02eeb34cd..60b6d31f280 100644
--- a/deps/v8/src/trap-handler/trap-handler.h
+++ b/deps/v8/src/trap-handler/trap-handler.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_TRAP_HANDLER_H_
-#define V8_TRAP_HANDLER_H_
+#ifndef V8_TRAP_HANDLER_TRAP_HANDLER_H_
+#define V8_TRAP_HANDLER_TRAP_HANDLER_H_
 
 #include <signal.h>
 #include <stdint.h>
@@ -41,20 +41,17 @@ struct ProtectedInstructionData {
 
 const int kInvalidIndex = -1;
 
-/// Adjusts the base code pointer.
-void UpdateHandlerDataCodePointer(int index, void* base);
-
 /// Adds the handler data to the place where the signal handler will find it.
 ///
 /// This returns a number that can be used to identify the handler data to
-/// UpdateHandlerDataCodePointer and ReleaseHandlerData, or -1 on failure.
+/// ReleaseHandlerData, or -1 on failure.
 int RegisterHandlerData(void* base, size_t size,
                         size_t num_protected_instructions,
                         const ProtectedInstructionData* protected_instructions);
 
 /// Removes the data from the master list and frees any memory, if necessary.
-/// TODO(mtrofin): once FLAG_wasm_jit_to_native is not needed, we can switch
-/// to using size_t for index and not need kInvalidIndex.
+/// TODO(mtrofin): We can switch to using size_t for index and not need
+/// kInvalidIndex.
 void ReleaseHandlerData(int index);
 
 #if V8_OS_WIN
@@ -66,8 +63,16 @@ void ReleaseHandlerData(int index);
 #define THREAD_LOCAL __thread
 #endif
 
+extern bool g_is_trap_handler_enabled;
+// Enables trap handling for WebAssembly bounds checks.
+//
+// use_v8_signal_handler indicates that V8 should install its own signal handler
+// rather than relying on the embedder to do it.
+bool EnableTrapHandler(bool use_v8_signal_handler);
+
 inline bool IsTrapHandlerEnabled() {
-  return FLAG_wasm_trap_handler && V8_TRAP_HANDLER_SUPPORTED;
+  DCHECK_IMPLIES(g_is_trap_handler_enabled, V8_TRAP_HANDLER_SUPPORTED);
+  return g_is_trap_handler_enabled;
 }
 
 extern THREAD_LOCAL int g_thread_in_wasm_code;
@@ -101,4 +106,4 @@ size_t GetRecoveredTrapCount();
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_TRAP_HANDLER_H_
+#endif  // V8_TRAP_HANDLER_TRAP_HANDLER_H_
diff --git a/deps/v8/src/unicode-decoder.cc b/deps/v8/src/unicode-decoder.cc
index d2360b6c681..6074bae81d1 100644
--- a/deps/v8/src/unicode-decoder.cc
+++ b/deps/v8/src/unicode-decoder.cc
@@ -10,74 +10,78 @@
 
 namespace unibrow {
 
+uint16_t Utf8Iterator::operator*() {
+  if (V8_UNLIKELY(char_ > Utf16::kMaxNonSurrogateCharCode)) {
+    return trailing_ ? Utf16::TrailSurrogate(char_)
+                     : Utf16::LeadSurrogate(char_);
+  }
+
+  DCHECK_EQ(trailing_, false);
+  return char_;
+}
+
+Utf8Iterator& Utf8Iterator::operator++() {
+  if (V8_UNLIKELY(this->Done())) {
+    char_ = Utf8::kBufferEmpty;
+    return *this;
+  }
+
+  if (V8_UNLIKELY(char_ > Utf16::kMaxNonSurrogateCharCode && !trailing_)) {
+    trailing_ = true;
+    return *this;
+  }
+
+  trailing_ = false;
+  offset_ = cursor_;
+
+  char_ =
+      Utf8::ValueOf(reinterpret_cast<const uint8_t*>(stream_.begin()) + cursor_,
+                    stream_.length() - cursor_, &cursor_);
+  return *this;
+}
+
+Utf8Iterator Utf8Iterator::operator++(int) {
+  Utf8Iterator old(*this);
+  ++*this;
+  return old;
+}
+
+bool Utf8Iterator::Done() {
+  return offset_ == static_cast<size_t>(stream_.length());
+}
+
 void Utf8DecoderBase::Reset(uint16_t* buffer, size_t buffer_length,
-                            const uint8_t* stream, size_t stream_length) {
-  // Assume everything will fit in the buffer and stream won't be needed.
-  last_byte_of_buffer_unused_ = false;
-  unbuffered_start_ = nullptr;
-  unbuffered_length_ = 0;
-  bool writing_to_buffer = true;
-  // Loop until stream is read, writing to buffer as long as buffer has space.
+                            const v8::internal::Vector<const char>& stream) {
   size_t utf16_length = 0;
-  while (stream_length != 0) {
-    size_t cursor = 0;
-    uint32_t character = Utf8::ValueOf(stream, stream_length, &cursor);
-    DCHECK(cursor > 0 && cursor <= stream_length);
-    stream += cursor;
-    stream_length -= cursor;
-    bool is_two_characters = character > Utf16::kMaxNonSurrogateCharCode;
-    utf16_length += is_two_characters ? 2 : 1;
-    // Don't need to write to the buffer, but still need utf16_length.
-    if (!writing_to_buffer) continue;
-    // Write out the characters to the buffer.
-    // Must check for equality with buffer_length as we've already updated it.
-    if (utf16_length <= buffer_length) {
-      if (is_two_characters) {
-        *buffer++ = Utf16::LeadSurrogate(character);
-        *buffer++ = Utf16::TrailSurrogate(character);
-      } else {
-        *buffer++ = character;
-      }
-      if (utf16_length == buffer_length) {
-        // Just wrote last character of buffer
-        writing_to_buffer = false;
-        unbuffered_start_ = stream;
-        unbuffered_length_ = stream_length;
-      }
-      continue;
-    }
-    // Have gone over buffer.
-    // Last char of buffer is unused, set cursor back.
-    DCHECK(is_two_characters);
-    writing_to_buffer = false;
-    last_byte_of_buffer_unused_ = true;
-    unbuffered_start_ = stream - cursor;
-    unbuffered_length_ = stream_length + cursor;
+
+  Utf8Iterator it = Utf8Iterator(stream);
+  // Loop until stream is read, writing to buffer as long as buffer has space.
+  while (utf16_length < buffer_length && !it.Done()) {
+    *buffer++ = *it;
+    ++it;
+    utf16_length++;
+  }
+  bytes_read_ = it.Offset();
+  trailing_ = it.Trailing();
+  chars_written_ = utf16_length;
+
+  // Now that writing to buffer is done, we just need to calculate utf16_length
+  while (!it.Done()) {
+    ++it;
+    utf16_length++;
   }
   utf16_length_ = utf16_length;
 }
 
-
-void Utf8DecoderBase::WriteUtf16Slow(const uint8_t* stream,
-                                     size_t stream_length, uint16_t* data,
-                                     size_t data_length) {
-  while (data_length != 0) {
-    size_t cursor = 0;
-    uint32_t character = Utf8::ValueOf(stream, stream_length, &cursor);
-    // There's a total lack of bounds checking for stream
-    // as it was already done in Reset.
-    stream += cursor;
-    DCHECK(stream_length >= cursor);
-    stream_length -= cursor;
-    if (character > unibrow::Utf16::kMaxNonSurrogateCharCode) {
-      *data++ = Utf16::LeadSurrogate(character);
-      *data++ = Utf16::TrailSurrogate(character);
-      DCHECK_GT(data_length, 1);
-      data_length -= 2;
-    } else {
-      *data++ = character;
-      data_length -= 1;
-    }
+void Utf8DecoderBase::WriteUtf16Slow(
+    uint16_t* data, size_t length,
+    const v8::internal::Vector<const char>& stream, size_t offset,
+    bool trailing) {
+  Utf8Iterator it = Utf8Iterator(stream, offset, trailing);
+  while (!it.Done()) {
+    DCHECK_GT(length--, 0);
+    *data++ = *it;
+    ++it;
   }
 }
 
diff --git a/deps/v8/src/unicode-decoder.h b/deps/v8/src/unicode-decoder.h
index 38a1837af39..ab69d0d390c 100644
--- a/deps/v8/src/unicode-decoder.h
+++ b/deps/v8/src/unicode-decoder.h
@@ -6,30 +6,73 @@
 #define V8_UNICODE_DECODER_H_
 
 #include <sys/types.h>
+#include <algorithm>
 #include "src/globals.h"
+#include "src/unicode.h"
 #include "src/utils.h"
+#include "src/vector.h"
 
 namespace unibrow {
 
+class Utf8Iterator {
+ public:
+  explicit Utf8Iterator(const v8::internal::Vector<const char>& stream)
+      : Utf8Iterator(stream, 0, false) {}
+  Utf8Iterator(const v8::internal::Vector<const char>& stream, size_t offset,
+               bool trailing)
+      : stream_(stream),
+        cursor_(offset),
+        offset_(0),
+        char_(0),
+        trailing_(false) {
+    DCHECK_LE(offset, stream.length());
+    // Read the first char, setting offset_ to offset in the process.
+    ++*this;
+
+    // This must be set after reading the first char, since the offset marks
+    // the start of the octet sequence that the trailing char is part of.
+    trailing_ = trailing;
+    if (trailing) {
+      DCHECK_GT(char_, Utf16::kMaxNonSurrogateCharCode);
+    }
+  }
+
+  uint16_t operator*();
+  Utf8Iterator& operator++();
+  Utf8Iterator operator++(int);
+  bool Done();
+  bool Trailing() { return trailing_; }
+  size_t Offset() { return offset_; }
+
+ private:
+  const v8::internal::Vector<const char>& stream_;
+  size_t cursor_;
+  size_t offset_;
+  uint32_t char_;
+  bool trailing_;
+};
+
 class V8_EXPORT_PRIVATE Utf8DecoderBase {
  public:
   // Initialization done in subclass.
   inline Utf8DecoderBase();
   inline Utf8DecoderBase(uint16_t* buffer, size_t buffer_length,
-                         const uint8_t* stream, size_t stream_length);
+                         const v8::internal::Vector<const char>& stream);
   inline size_t Utf16Length() const { return utf16_length_; }
 
  protected:
   // This reads all characters and sets the utf16_length_.
   // The first buffer_length utf16 chars are cached in the buffer.
-  void Reset(uint16_t* buffer, size_t buffer_length, const uint8_t* stream,
-             size_t stream_length);
-  static void WriteUtf16Slow(const uint8_t* stream, size_t stream_length,
-                             uint16_t* data, size_t length);
-  const uint8_t* unbuffered_start_;
-  size_t unbuffered_length_;
+  void Reset(uint16_t* buffer, size_t buffer_length,
+             const v8::internal::Vector<const char>& vector);
+  static void WriteUtf16Slow(uint16_t* data, size_t length,
+                             const v8::internal::Vector<const char>& stream,
+                             size_t offset, bool trailing);
+
+  size_t bytes_read_;
+  size_t chars_written_;
   size_t utf16_length_;
-  bool last_byte_of_buffer_unused_;
+  bool trailing_;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(Utf8DecoderBase);
@@ -39,69 +82,63 @@ template <size_t kBufferSize>
 class Utf8Decoder : public Utf8DecoderBase {
  public:
   inline Utf8Decoder() {}
-  inline Utf8Decoder(const char* stream, size_t length);
-  inline void Reset(const char* stream, size_t length);
-  inline size_t WriteUtf16(uint16_t* data, size_t length) const;
+  explicit inline Utf8Decoder(const v8::internal::Vector<const char>& stream);
+  inline void Reset(const v8::internal::Vector<const char>& stream);
+  inline size_t WriteUtf16(
+      uint16_t* data, size_t length,
+      const v8::internal::Vector<const char>& stream) const;
 
  private:
   uint16_t buffer_[kBufferSize];
 };
 
 Utf8DecoderBase::Utf8DecoderBase()
-    : unbuffered_start_(nullptr),
-      unbuffered_length_(0),
-      utf16_length_(0),
-      last_byte_of_buffer_unused_(false) {}
-
-Utf8DecoderBase::Utf8DecoderBase(uint16_t* buffer, size_t buffer_length,
-                                 const uint8_t* stream, size_t stream_length) {
-  Reset(buffer, buffer_length, stream, stream_length);
-}
+    : bytes_read_(0), chars_written_(0), utf16_length_(0), trailing_(false) {}
 
+Utf8DecoderBase::Utf8DecoderBase(
+    uint16_t* buffer, size_t buffer_length,
+    const v8::internal::Vector<const char>& stream) {
+  Reset(buffer, buffer_length, stream);
+}
 
 template <size_t kBufferSize>
-Utf8Decoder<kBufferSize>::Utf8Decoder(const char* stream, size_t length)
-    : Utf8DecoderBase(buffer_, kBufferSize,
-                      reinterpret_cast<const uint8_t*>(stream), length) {}
-
+Utf8Decoder<kBufferSize>::Utf8Decoder(
+    const v8::internal::Vector<const char>& stream)
+    : Utf8DecoderBase(buffer_, kBufferSize, stream) {}
 
 template <size_t kBufferSize>
-void Utf8Decoder<kBufferSize>::Reset(const char* stream, size_t length) {
-  Utf8DecoderBase::Reset(buffer_, kBufferSize,
-                         reinterpret_cast<const uint8_t*>(stream), length);
+void Utf8Decoder<kBufferSize>::Reset(
+    const v8::internal::Vector<const char>& stream) {
+  Utf8DecoderBase::Reset(buffer_, kBufferSize, stream);
 }
 
-
 template <size_t kBufferSize>
-size_t Utf8Decoder<kBufferSize>::WriteUtf16(uint16_t* data,
-                                            size_t length) const {
-  DCHECK_GT(length, 0);
-  if (length > utf16_length_) length = utf16_length_;
+size_t Utf8Decoder<kBufferSize>::WriteUtf16(
+    uint16_t* data, size_t data_length,
+    const v8::internal::Vector<const char>& stream) const {
+  DCHECK_GT(data_length, 0);
+  data_length = std::min(data_length, utf16_length_);
+
   // memcpy everything in buffer.
-  size_t buffer_length =
-      last_byte_of_buffer_unused_ ? kBufferSize - 1 : kBufferSize;
-  size_t memcpy_length = length <= buffer_length ? length : buffer_length;
+  size_t memcpy_length = std::min(data_length, chars_written_);
   v8::internal::MemCopy(data, buffer_, memcpy_length * sizeof(uint16_t));
-  if (length <= buffer_length) return length;
-  DCHECK_NOT_NULL(unbuffered_start_);
+
+  if (data_length <= chars_written_) return data_length;
+
   // Copy the rest the slow way.
-  WriteUtf16Slow(unbuffered_start_, unbuffered_length_, data + buffer_length,
-                 length - buffer_length);
-  return length;
+  WriteUtf16Slow(data + chars_written_, data_length - chars_written_, stream,
+                 bytes_read_, trailing_);
+  return data_length;
 }
 
 class Latin1 {
  public:
   static const unsigned kMaxChar = 0xff;
-  // Returns 0 if character does not convert to single latin-1 character
-  // or if the character doesn't not convert back to latin-1 via inverse
-  // operation (upper to lower, etc).
-  static inline uint16_t ConvertNonLatin1ToLatin1(uint16_t);
+  // Convert the character to Latin-1 case equivalent if possible.
+  static inline uint16_t TryConvertToLatin1(uint16_t);
 };
 
-
-uint16_t Latin1::ConvertNonLatin1ToLatin1(uint16_t c) {
-  DCHECK_GT(c, Latin1::kMaxChar);
+uint16_t Latin1::TryConvertToLatin1(uint16_t c) {
   switch (c) {
     // This are equivalent characters in unicode.
     case 0x39c:
@@ -112,7 +149,7 @@ uint16_t Latin1::ConvertNonLatin1ToLatin1(uint16_t c) {
     case 0x178:
       return 0xff;
   }
-  return 0;
+  return c;
 }
 
 
diff --git a/deps/v8/src/unicode.h b/deps/v8/src/unicode.h
index c6ce9a8eb2d..75f53e22d19 100644
--- a/deps/v8/src/unicode.h
+++ b/deps/v8/src/unicode.h
@@ -204,6 +204,10 @@ V8_INLINE bool IsLineTerminator(uchar c) {
   return c == 0x000A || c == 0x000D || c == 0x2028 || c == 0x2029;
 }
 
+V8_INLINE bool IsStringLiteralLineTerminator(uchar c) {
+  return c == 0x000A || c == 0x000D;
+}
+
 #ifndef V8_INTL_SUPPORT
 struct ToLowercase {
   static const int kMaxWidth = 3;
diff --git a/deps/v8/src/utils.h b/deps/v8/src/utils.h
index 5b5d95ce9a7..31dc24deceb 100644
--- a/deps/v8/src/utils.h
+++ b/deps/v8/src/utils.h
@@ -18,6 +18,7 @@
 #include "src/base/logging.h"
 #include "src/base/macros.h"
 #include "src/base/platform/platform.h"
+#include "src/base/v8-fallthrough.h"
 #include "src/globals.h"
 #include "src/vector.h"
 #include "src/zone/zone.h"
@@ -79,9 +80,15 @@ inline int WhichPowerOf2(T x) {
 #undef CHECK_BIGGER
   switch (x) {
     default: UNREACHABLE();
-    case 8: bits++;  // Fall through.
-    case 4: bits++;  // Fall through.
-    case 2: bits++;  // Fall through.
+    case 8:
+      bits++;
+      V8_FALLTHROUGH;
+    case 4:
+      bits++;
+      V8_FALLTHROUGH;
+    case 2:
+      bits++;
+      V8_FALLTHROUGH;
     case 1: break;
   }
   DCHECK_EQ(T{1} << bits, original_x);
@@ -1572,6 +1579,7 @@ inline uintptr_t GetCurrentStackPosition() {
 
 template <typename V>
 static inline V ReadUnalignedValue(const void* p) {
+  ASSERT_TRIVIALLY_COPYABLE(V);
 #if !(V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_ARM)
   return *reinterpret_cast<const V*>(p);
 #else   // V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_ARM
@@ -1583,6 +1591,7 @@ static inline V ReadUnalignedValue(const void* p) {
 
 template <typename V>
 static inline void WriteUnalignedValue(void* p, V value) {
+  ASSERT_TRIVIALLY_COPYABLE(V);
 #if !(V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_ARM)
   *(reinterpret_cast<V*>(p)) = value;
 #else   // V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_ARM
diff --git a/deps/v8/src/v8.cc b/deps/v8/src/v8.cc
index a6d97e8ff14..ab4918efec2 100644
--- a/deps/v8/src/v8.cc
+++ b/deps/v8/src/v8.cc
@@ -81,7 +81,6 @@ void V8::InitializeOncePerProcessImpl() {
   sampler::Sampler::SetUp();
   CpuFeatures::Probe(false);
   ElementsAccessor::InitializeOncePerProcess();
-  SetUpJSCallerSavedCodeData();
   ExternalReference::SetUp();
   Bootstrapper::InitializeOncePerProcess();
 }
diff --git a/deps/v8/src/v8.gyp b/deps/v8/src/v8.gyp
deleted file mode 100644
index 1f0ad0a4670..00000000000
--- a/deps/v8/src/v8.gyp
+++ /dev/null
@@ -1,2630 +0,0 @@
-# Copyright 2012 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-{
-  'variables': {
-    'v8_code': 1,
-    'v8_random_seed%': 314159265,
-    'v8_vector_stores%': 0,
-    'embed_script%': "",
-    'warmup_script%': "",
-    'v8_extra_library_files%': [],
-    'v8_experimental_extra_library_files%': [],
-    'mksnapshot_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mksnapshot<(EXECUTABLE_SUFFIX)',
-    'v8_os_page_size%': 0,
-  },
-  'includes': ['../gypfiles/toolchain.gypi', '../gypfiles/features.gypi', 'inspector/inspector.gypi'],
-  'targets': [
-    {
-      'target_name': 'v8',
-      'dependencies_traverse': 1,
-      'dependencies': ['v8_maybe_snapshot', 'v8_dump_build_config#target'],
-      'conditions': [
-        ['want_separate_host_toolset==1', {
-          'toolsets': ['host', 'target'],
-        }, {
-          'toolsets': ['target'],
-        }],
-        ['component=="shared_library"', {
-          'type': '<(component)',
-          'sources': [
-            # Note: on non-Windows we still build this file so that gyp
-            # has some sources to link into the component.
-            'v8dll-main.cc',
-          ],
-          'include_dirs': [
-            '..',
-          ],
-          'defines': [
-            'BUILDING_V8_SHARED',
-          ],
-          'direct_dependent_settings': {
-            'defines': [
-              'USING_V8_SHARED',
-            ],
-          },
-          'conditions': [
-            ['OS=="mac"', {
-              'xcode_settings': {
-                'OTHER_LDFLAGS': ['-dynamiclib', '-all_load']
-              },
-            }],
-            ['soname_version!=""', {
-              'product_extension': 'so.<(soname_version)',
-            }],
-          ],
-        },
-        {
-          'type': 'none',
-        }],
-      ],
-      'direct_dependent_settings': {
-        'include_dirs': [
-          '../include',
-        ],
-      },
-    },
-    {
-      # This rule delegates to either v8_snapshot, v8_nosnapshot, or
-      # v8_external_snapshot, depending on the current variables.
-      # The intention is to make the 'calling' rules a bit simpler.
-      'target_name': 'v8_maybe_snapshot',
-      'type': 'none',
-      'conditions': [
-        ['v8_use_snapshot!="true"', {
-          # The dependency on v8_base should come from a transitive
-          # dependency however the Android toolchain requires libv8_base.a
-          # to appear before libv8_snapshot.a so it's listed explicitly.
-          'dependencies': ['v8_base', 'v8_init', 'v8_nosnapshot'],
-        }],
-        ['v8_use_snapshot=="true" and v8_use_external_startup_data==0', {
-          # The dependency on v8_base should come from a transitive
-          # dependency however the Android toolchain requires libv8_base.a
-          # to appear before libv8_snapshot.a so it's listed explicitly.
-          'dependencies': ['v8_base', 'v8_snapshot'],
-        }],
-        ['v8_use_snapshot=="true" and v8_use_external_startup_data==1 and want_separate_host_toolset==0', {
-          'dependencies': ['v8_base', 'v8_external_snapshot'],
-          'inputs': [ '<(PRODUCT_DIR)/snapshot_blob.bin', ],
-        }],
-        ['v8_use_snapshot=="true" and v8_use_external_startup_data==1 and want_separate_host_toolset==1', {
-          'dependencies': ['v8_base', 'v8_external_snapshot'],
-          'target_conditions': [
-            ['_toolset=="host"', {
-              'inputs': [
-                '<(PRODUCT_DIR)/snapshot_blob_host.bin',
-              ],
-            }, {
-              'inputs': [
-                '<(PRODUCT_DIR)/snapshot_blob.bin',
-              ],
-            }],
-          ],
-        }],
-        ['want_separate_host_toolset==1', {
-          'toolsets': ['host', 'target'],
-        }, {
-          'toolsets': ['target'],
-        }],
-      ]
-    },
-    {
-      'target_name': 'v8_init',
-      'type': 'static_library',
-      'dependencies': [
-        'v8_initializers',
-      ],
-      'variables': {
-        'optimize': 'max',
-      },
-      'include_dirs+': [
-        '..',
-        '../include',
-      ],
-      'sources': [  ### gcmole(all) ###
-        'setup-isolate-full.cc',
-      ],
-      'conditions': [
-        ['want_separate_host_toolset==1', {
-          'toolsets': ['host', 'target'],
-        }, {
-          'toolsets': ['target'],
-        }],
-      ],
-    },
-    {
-      'target_name': 'v8_initializers',
-      'type': 'static_library',
-      'dependencies': [
-        'v8_base',
-      ],
-       'variables': {
-        'optimize': 'max',
-      },
-      'include_dirs+': [
-        '..',
-        '../include',
-      ],
-      'sources': [  ### gcmole(all) ###
-        'builtins/builtins-arguments-gen.cc',
-        'builtins/builtins-arguments-gen.h',
-        'builtins/builtins-array-gen.cc',
-        'builtins/builtins-async-function-gen.cc',
-        'builtins/builtins-async-gen.cc',
-        'builtins/builtins-async-gen.h',
-        'builtins/builtins-async-generator-gen.cc',
-        'builtins/builtins-async-iterator-gen.cc',
-        'builtins/builtins-boolean-gen.cc',
-        'builtins/builtins-call-gen.cc',
-        'builtins/builtins-call-gen.h',
-        'builtins/builtins-collections-gen.cc',
-        'builtins/builtins-console-gen.cc',
-        'builtins/builtins-constructor-gen.cc',
-        'builtins/builtins-constructor-gen.h',
-        'builtins/builtins-constructor.h',
-        'builtins/builtins-conversion-gen.cc',
-        'builtins/builtins-date-gen.cc',
-        'builtins/builtins-debug-gen.cc',
-        'builtins/builtins-function-gen.cc',
-        'builtins/builtins-generator-gen.cc',
-        'builtins/builtins-global-gen.cc',
-        'builtins/builtins-handler-gen.cc',
-        'builtins/builtins-ic-gen.cc',
-        'builtins/builtins-internal-gen.cc',
-        'builtins/builtins-interpreter-gen.cc',
-        'builtins/builtins-intl-gen.cc',
-        'builtins/builtins-iterator-gen.h',
-        'builtins/builtins-iterator-gen.cc',
-        'builtins/builtins-math-gen.cc',
-        'builtins/builtins-math-gen.h',
-        'builtins/builtins-number-gen.cc',
-        'builtins/builtins-object-gen.cc',
-        'builtins/builtins-promise-gen.cc',
-        'builtins/builtins-promise-gen.h',
-        'builtins/builtins-proxy-gen.cc',
-        'builtins/builtins-proxy-gen.h',
-        'builtins/builtins-reflect-gen.cc',
-        'builtins/builtins-regexp-gen.cc',
-        'builtins/builtins-regexp-gen.h',
-        'builtins/builtins-sharedarraybuffer-gen.cc',
-        'builtins/builtins-string-gen.cc',
-        'builtins/builtins-string-gen.h',
-        'builtins/builtins-symbol-gen.cc',
-        'builtins/builtins-typedarray-gen.cc',
-        'builtins/builtins-utils-gen.h',
-        'builtins/builtins-wasm-gen.cc',
-        'builtins/setup-builtins-internal.cc',
-        'heap/setup-heap-internal.cc',
-        'ic/accessor-assembler.cc',
-        'ic/accessor-assembler.h',
-        'ic/binary-op-assembler.cc',
-        'ic/binary-op-assembler.h',
-        'ic/keyed-store-generic.cc',
-        'ic/keyed-store-generic.h',
-        'interpreter/interpreter-assembler.cc',
-        'interpreter/interpreter-assembler.h',
-        'interpreter/interpreter-generator.cc',
-        'interpreter/interpreter-generator.h',
-        'interpreter/interpreter-intrinsics-generator.cc',
-        'interpreter/interpreter-intrinsics-generator.h',
-        'interpreter/setup-interpreter-internal.cc',
-        'interpreter/setup-interpreter.h',
-      ],
-      'conditions': [
-        ['want_separate_host_toolset==1', {
-          'toolsets': ['host', 'target'],
-        }, {
-          'toolsets': ['target'],
-        }],
-        ['v8_target_arch=="ia32"', {
-          'sources': [  ### gcmole(arch:ia32) ###
-            'builtins/ia32/builtins-ia32.cc',
-          ],
-        }],
-        ['v8_target_arch=="x64"', {
-          'sources': [  ### gcmole(arch:x64) ###
-            'builtins/x64/builtins-x64.cc',
-          ],
-        }],
-        ['v8_target_arch=="arm"', {
-          'sources': [  ### gcmole(arch:arm) ###
-            'builtins/arm/builtins-arm.cc',
-          ],
-        }],
-        ['v8_target_arch=="arm64"', {
-          'sources': [  ### gcmole(arch:arm64) ###
-            'builtins/arm64/builtins-arm64.cc',
-          ],
-        }],
-        ['v8_target_arch=="mips" or v8_target_arch=="mipsel"', {
-          'sources': [  ### gcmole(arch:mipsel) ###
-            'builtins/mips/builtins-mips.cc',
-          ],
-        }],
-        ['v8_target_arch=="mips64" or v8_target_arch=="mips64el"', {
-          'sources': [  ### gcmole(arch:mips64el) ###
-            'builtins/mips64/builtins-mips64.cc',
-          ],
-        }],
-        ['v8_target_arch=="ppc" or v8_target_arch=="ppc64"', {
-          'sources': [  ### gcmole(arch:ppc) ###
-            'builtins/ppc/builtins-ppc.cc',
-          ],
-        }],
-        ['v8_target_arch=="s390" or v8_target_arch=="s390x"', {
-          'sources': [  ### gcmole(arch:s390) ###
-            'builtins/s390/builtins-s390.cc',
-          ],
-        }],
-        ['v8_enable_i18n_support==0', {
-          'sources!': [
-            'builtins/builtins-intl-gen.cc',
-          ],
-        }],
-      ],
-    },
-    {
-      'target_name': 'v8_snapshot',
-      'type': 'static_library',
-      'conditions': [
-        ['want_separate_host_toolset==1', {
-          'toolsets': ['host', 'target'],
-          'dependencies': [
-            'mksnapshot#host',
-            'js2c#host',
-          ],
-        }, {
-          'toolsets': ['target'],
-          'dependencies': [
-            'mksnapshot',
-            'js2c',
-          ],
-        }],
-        ['component=="shared_library"', {
-          'defines': [
-            'BUILDING_V8_SHARED',
-          ],
-          'direct_dependent_settings': {
-            'defines': [
-              'USING_V8_SHARED',
-            ],
-          },
-        }],
-      ],
-      'dependencies': [
-        'v8_base',
-      ],
-      'include_dirs+': [
-        '..',
-        '<(DEPTH)',
-      ],
-      'sources': [
-        '<(SHARED_INTERMEDIATE_DIR)/libraries.cc',
-        '<(SHARED_INTERMEDIATE_DIR)/extras-libraries.cc',
-        '<(SHARED_INTERMEDIATE_DIR)/experimental-extras-libraries.cc',
-        '<(INTERMEDIATE_DIR)/snapshot.cc',
-        'setup-isolate-deserialize.cc',
-      ],
-      'actions': [
-        {
-          'action_name': 'run_mksnapshot',
-          'inputs': [
-            '<(mksnapshot_exec)',
-          ],
-          'conditions': [
-            ['embed_script!=""', {
-              'inputs': [
-                '<(embed_script)',
-              ],
-            }],
-            ['warmup_script!=""', {
-              'inputs': [
-                '<(warmup_script)',
-              ],
-            }],
-          ],
-          'outputs': [
-            '<(INTERMEDIATE_DIR)/snapshot.cc',
-          ],
-          'variables': {
-            'mksnapshot_flags': [],
-            'conditions': [
-              ['v8_random_seed!=0', {
-                'mksnapshot_flags': ['--random-seed', '<(v8_random_seed)'],
-              }],
-              ['v8_vector_stores!=0', {
-                'mksnapshot_flags': ['--vector-stores'],
-              }],
-            ],
-          },
-          'action': [
-            '<(mksnapshot_exec)',
-            '<@(mksnapshot_flags)',
-            '--startup_src', '<@(INTERMEDIATE_DIR)/snapshot.cc',
-            '<(embed_script)',
-            '<(warmup_script)',
-          ],
-        },
-      ],
-    },
-    {
-      'target_name': 'v8_nosnapshot',
-      'type': 'static_library',
-      'dependencies': [
-        'v8_base',
-      ],
-      'include_dirs+': [
-        '..',
-        '<(DEPTH)',
-      ],
-      'sources': [
-        '<(SHARED_INTERMEDIATE_DIR)/libraries.cc',
-        '<(SHARED_INTERMEDIATE_DIR)/extras-libraries.cc',
-        '<(SHARED_INTERMEDIATE_DIR)/experimental-extras-libraries.cc',
-        'snapshot/snapshot-empty.cc',
-      ],
-      'conditions': [
-        ['want_separate_host_toolset==1', {
-          'toolsets': ['host', 'target'],
-          'dependencies': ['js2c#host'],
-        }, {
-          'toolsets': ['target'],
-          'dependencies': ['js2c'],
-        }],
-        ['component=="shared_library"', {
-          'defines': [
-            'BUILDING_V8_SHARED',
-          ],
-        }],
-      ]
-    },
-    {
-      'target_name': 'v8_external_snapshot',
-      'type': 'static_library',
-      'conditions': [
-        [ 'v8_use_external_startup_data==1', {
-          'conditions': [
-            ['want_separate_host_toolset==1', {
-              'toolsets': ['host', 'target'],
-              'dependencies': [
-                'mksnapshot#host',
-                'js2c#host',
-                'natives_blob',
-            ]}, {
-              'toolsets': ['target'],
-              'dependencies': [
-                'mksnapshot',
-                'js2c',
-                'natives_blob',
-              ],
-            }],
-            ['component=="shared_library"', {
-              'defines': [
-                'BUILDING_V8_SHARED',
-              ],
-              'direct_dependent_settings': {
-                'defines': [
-                  'USING_V8_SHARED',
-                ],
-              },
-            }],
-          ],
-          'dependencies': [
-            'v8_base',
-          ],
-          'include_dirs+': [
-            '..',
-            '<(DEPTH)',
-          ],
-          'sources': [
-            'setup-isolate-deserialize.cc',
-            'snapshot/natives-external.cc',
-            'snapshot/snapshot-external.cc',
-          ],
-          'actions': [
-            {
-              'action_name': 'run_mksnapshot (external)',
-              'inputs': [
-                '<(mksnapshot_exec)',
-              ],
-              'variables': {
-                'mksnapshot_flags': [],
-                'conditions': [
-                  ['v8_random_seed!=0', {
-                    'mksnapshot_flags': ['--random-seed', '<(v8_random_seed)'],
-                  }],
-                  ['v8_vector_stores!=0', {
-                    'mksnapshot_flags': ['--vector-stores'],
-                  }],
-                  ['v8_os_page_size!=0', {
-                    'mksnapshot_flags': ['--v8_os_page_size', '<(v8_os_page_size)'],
-                  }],
-                ],
-              },
-              'conditions': [
-                ['embed_script!=""', {
-                  'inputs': [
-                    '<(embed_script)',
-                  ],
-                }],
-                ['warmup_script!=""', {
-                  'inputs': [
-                    '<(warmup_script)',
-                  ],
-                }],
-                ['want_separate_host_toolset==1', {
-                  'target_conditions': [
-                    ['_toolset=="host"', {
-                      'outputs': [
-                        '<(PRODUCT_DIR)/snapshot_blob_host.bin',
-                      ],
-                      'action': [
-                        '<(mksnapshot_exec)',
-                        '<@(mksnapshot_flags)',
-                        '--startup_blob', '<(PRODUCT_DIR)/snapshot_blob_host.bin',
-                        '<(embed_script)',
-                        '<(warmup_script)',
-                      ],
-                    }, {
-                      'outputs': [
-                        '<(PRODUCT_DIR)/snapshot_blob.bin',
-                      ],
-                      'action': [
-                        '<(mksnapshot_exec)',
-                        '<@(mksnapshot_flags)',
-                        '--startup_blob', '<(PRODUCT_DIR)/snapshot_blob.bin',
-                        '<(embed_script)',
-                        '<(warmup_script)',
-                      ],
-                    }],
-                  ],
-                }, {
-                  'outputs': [
-                    '<(PRODUCT_DIR)/snapshot_blob.bin',
-                  ],
-                  'action': [
-                    '<(mksnapshot_exec)',
-                    '<@(mksnapshot_flags)',
-                    '--startup_blob', '<(PRODUCT_DIR)/snapshot_blob.bin',
-                    '<(embed_script)',
-                    '<(warmup_script)',
-                  ],
-                }],
-              ],
-            },
-          ],
-        }],
-      ],
-    },
-    {
-      'target_name': 'v8_base',
-      'type': 'static_library',
-      'dependencies': [
-        'v8_libbase',
-        'v8_libsampler',
-        'inspector/inspector.gyp:protocol_generated_sources#target',
-        'inspector/inspector.gyp:inspector_injected_script#target',
-      ],
-      'objs': ['foo.o'],
-      'variables': {
-        'optimize': 'max',
-      },
-      'include_dirs+': [
-        '..',
-        '<(DEPTH)',
-        '<(SHARED_INTERMEDIATE_DIR)'
-      ],
-      'sources': [  ### gcmole(all) ###
-        '<@(inspector_all_sources)',
-        '../include/v8-debug.h',
-        '../include/v8-platform.h',
-        '../include/v8-profiler.h',
-        '../include/v8-testing.h',
-        '../include/v8-util.h',
-        '../include/v8-value-serializer-version.h',
-        '../include/v8-version-string.h',
-        '../include/v8-version.h',
-        '../include/v8.h',
-        '../include/v8config.h',
-        'accessors.cc',
-        'accessors.h',
-        'address-map.cc',
-        'address-map.h',
-        'allocation.cc',
-        'allocation.h',
-        'allocation-site-scopes.h',
-        'api.cc',
-        'api.h',
-        'api-arguments-inl.h',
-        'api-arguments.cc',
-        'api-arguments.h',
-        'api-natives.cc',
-        'api-natives.h',
-        'arguments.cc',
-        'arguments.h',
-        'asmjs/asm-js.cc',
-        'asmjs/asm-js.h',
-        'asmjs/asm-names.h',
-        'asmjs/asm-parser.cc',
-        'asmjs/asm-parser.h',
-        'asmjs/asm-scanner.cc',
-        'asmjs/asm-scanner.h',
-        'asmjs/asm-types.cc',
-        'asmjs/asm-types.h',
-        'asmjs/switch-logic.h',
-        'asmjs/switch-logic.cc',
-        'assembler.cc',
-        'assembler.h',
-        'assembler-inl.h',
-        'assert-scope.h',
-        'assert-scope.cc',
-        'ast/ast-function-literal-id-reindexer.cc',
-        'ast/ast-function-literal-id-reindexer.h',
-        'ast/ast-numbering.cc',
-        'ast/ast-numbering.h',
-        'ast/ast-source-ranges.h',
-        'ast/ast-traversal-visitor.h',
-        'ast/ast-value-factory.cc',
-        'ast/ast-value-factory.h',
-        'ast/ast.cc',
-        'ast/ast.h',
-        'ast/compile-time-value.cc',
-        'ast/compile-time-value.h',
-        'ast/context-slot-cache.cc',
-        'ast/context-slot-cache.h',
-        'ast/modules.cc',
-        'ast/modules.h',
-        'ast/prettyprinter.cc',
-        'ast/prettyprinter.h',
-        'ast/scopes.cc',
-        'ast/scopes.h',
-        'ast/variables.cc',
-        'ast/variables.h',
-        'bailout-reason.cc',
-        'bailout-reason.h',
-        'basic-block-profiler.cc',
-        'basic-block-profiler.h',
-        'bignum-dtoa.cc',
-        'bignum-dtoa.h',
-        'bignum.cc',
-        'bignum.h',
-        'bit-vector.cc',
-        'bit-vector.h',
-        'bootstrapper.cc',
-        'bootstrapper.h',
-        'boxed-float.h',
-        'builtins/builtins-api.cc',
-        'builtins/builtins-arraybuffer.cc',
-        'builtins/builtins-array.cc',
-        'builtins/builtins-bigint.cc',
-        'builtins/builtins-boolean.cc',
-        'builtins/builtins-call.cc',
-        'builtins/builtins-callsite.cc',
-        'builtins/builtins-collections.cc',
-        'builtins/builtins-console.cc',
-        'builtins/builtins-constructor.h',
-        'builtins/builtins-dataview.cc',
-        'builtins/builtins-date.cc',
-        'builtins/builtins-definitions.h',
-        'builtins/builtins-descriptors.h',
-        'builtins/builtins-error.cc',
-        'builtins/builtins-function.cc',
-        'builtins/builtins-global.cc',
-        'builtins/builtins-internal.cc',
-        'builtins/builtins-interpreter.cc',
-        'builtins/builtins-json.cc',
-        'builtins/builtins-math.cc',
-        'builtins/builtins-number.cc',
-        'builtins/builtins-object.cc',
-        'builtins/builtins-promise.cc',
-        'builtins/builtins-reflect.cc',
-        'builtins/builtins-regexp.cc',
-        'builtins/builtins-sharedarraybuffer.cc',
-        'builtins/builtins-string.cc',
-        'builtins/builtins-intl.cc',
-        'builtins/builtins-intl.h',
-        'builtins/builtins-symbol.cc',
-        'builtins/builtins-typedarray.cc',
-        'builtins/builtins-utils.h',
-        'builtins/builtins.cc',
-        'builtins/builtins.h',
-        'cached-powers.cc',
-        'cached-powers.h',
-        'callable.h',
-        'cancelable-task.cc',
-        'cancelable-task.h',
-        'char-predicates.cc',
-        'char-predicates-inl.h',
-        'char-predicates.h',
-        'checks.h',
-        'code-events.h',
-        'code-factory.cc',
-        'code-factory.h',
-        'code-stub-assembler.cc',
-        'code-stub-assembler.h',
-        'code-stubs.cc',
-        'code-stubs.h',
-        'code-stubs-utils.h',
-        'codegen.cc',
-        'codegen.h',
-        'collector.h',
-        'compilation-cache.cc',
-        'compilation-cache.h',
-        'compilation-dependencies.cc',
-        'compilation-dependencies.h',
-        'compilation-info.cc',
-        'compilation-info.h',
-        'compilation-statistics.cc',
-        'compilation-statistics.h',
-        'compiler/access-builder.cc',
-        'compiler/access-builder.h',
-        'compiler/access-info.cc',
-        'compiler/access-info.h',
-        'compiler/all-nodes.cc',
-        'compiler/all-nodes.h',
-        'compiler/allocation-builder.h',
-        'compiler/basic-block-instrumentor.cc',
-        'compiler/basic-block-instrumentor.h',
-        'compiler/branch-elimination.cc',
-        'compiler/branch-elimination.h',
-        'compiler/bytecode-analysis.cc',
-        'compiler/bytecode-analysis.h',
-        'compiler/bytecode-graph-builder.cc',
-        'compiler/bytecode-graph-builder.h',
-        'compiler/bytecode-liveness-map.cc',
-        'compiler/bytecode-liveness-map.h',
-        'compiler/c-linkage.cc',
-        'compiler/checkpoint-elimination.cc',
-        'compiler/checkpoint-elimination.h',
-        'compiler/code-generator-impl.h',
-        'compiler/code-generator.cc',
-        'compiler/code-generator.h',
-        'compiler/code-assembler.cc',
-        'compiler/code-assembler.h',
-        'compiler/common-node-cache.cc',
-        'compiler/common-node-cache.h',
-        'compiler/common-operator-reducer.cc',
-        'compiler/common-operator-reducer.h',
-        'compiler/common-operator.cc',
-        'compiler/common-operator.h',
-        'compiler/control-equivalence.cc',
-        'compiler/control-equivalence.h',
-        'compiler/control-flow-optimizer.cc',
-        'compiler/control-flow-optimizer.h',
-        'compiler/dead-code-elimination.cc',
-        'compiler/dead-code-elimination.h',
-        'compiler/diamond.h',
-        'compiler/effect-control-linearizer.cc',
-        'compiler/effect-control-linearizer.h',
-        'compiler/escape-analysis.cc',
-        'compiler/escape-analysis.h',
-        'compiler/escape-analysis-reducer.cc',
-        'compiler/escape-analysis-reducer.h',
-        'compiler/frame.cc',
-        'compiler/frame.h',
-        'compiler/frame-elider.cc',
-        'compiler/frame-elider.h',
-        'compiler/frame-states.cc',
-        'compiler/frame-states.h',
-        'compiler/gap-resolver.cc',
-        'compiler/gap-resolver.h',
-        'compiler/graph-assembler.cc',
-        'compiler/graph-assembler.h',
-        'compiler/graph-reducer.cc',
-        'compiler/graph-reducer.h',
-        'compiler/graph-trimmer.cc',
-        'compiler/graph-trimmer.h',
-        'compiler/graph-visualizer.cc',
-        'compiler/graph-visualizer.h',
-        'compiler/graph.cc',
-        'compiler/graph.h',
-        'compiler/instruction-codes.h',
-        'compiler/instruction-selector-impl.h',
-        'compiler/instruction-selector.cc',
-        'compiler/instruction-selector.h',
-        'compiler/instruction-scheduler.cc',
-        'compiler/instruction-scheduler.h',
-        'compiler/instruction.cc',
-        'compiler/instruction.h',
-        'compiler/int64-lowering.cc',
-        'compiler/int64-lowering.h',
-        'compiler/js-builtin-reducer.cc',
-        'compiler/js-builtin-reducer.h',
-        'compiler/js-call-reducer.cc',
-        'compiler/js-call-reducer.h',
-        'compiler/js-context-specialization.cc',
-        'compiler/js-context-specialization.h',
-        'compiler/js-create-lowering.cc',
-        'compiler/js-create-lowering.h',
-        'compiler/js-generic-lowering.cc',
-        'compiler/js-generic-lowering.h',
-        'compiler/js-graph.cc',
-        'compiler/js-graph.h',
-        'compiler/js-inlining.cc',
-        'compiler/js-inlining.h',
-        'compiler/js-inlining-heuristic.cc',
-        'compiler/js-inlining-heuristic.h',
-        'compiler/js-intrinsic-lowering.cc',
-        'compiler/js-intrinsic-lowering.h',
-        'compiler/js-native-context-specialization.cc',
-        'compiler/js-native-context-specialization.h',
-        'compiler/js-operator.cc',
-        'compiler/js-operator.h',
-        'compiler/js-type-hint-lowering.cc',
-        'compiler/js-type-hint-lowering.h',
-        'compiler/js-typed-lowering.cc',
-        'compiler/js-typed-lowering.h',
-        'compiler/jump-threading.cc',
-        'compiler/jump-threading.h',
-        'compiler/linkage.cc',
-        'compiler/linkage.h',
-        'compiler/live-range-separator.cc',
-        'compiler/live-range-separator.h',
-        'compiler/load-elimination.cc',
-        'compiler/load-elimination.h',
-        'compiler/loop-analysis.cc',
-        'compiler/loop-analysis.h',
-        'compiler/loop-peeling.cc',
-        'compiler/loop-peeling.h',
-        'compiler/loop-variable-optimizer.cc',
-        'compiler/loop-variable-optimizer.h',
-        'compiler/machine-operator-reducer.cc',
-        'compiler/machine-operator-reducer.h',
-        'compiler/machine-operator.cc',
-        'compiler/machine-operator.h',
-        'compiler/machine-graph-verifier.cc',
-        'compiler/machine-graph-verifier.h',
-        'compiler/memory-optimizer.cc',
-        'compiler/memory-optimizer.h',
-        'compiler/move-optimizer.cc',
-        'compiler/move-optimizer.h',
-        'compiler/node-aux-data.h',
-        'compiler/node-cache.cc',
-        'compiler/node-cache.h',
-        'compiler/node-marker.cc',
-        'compiler/node-marker.h',
-        'compiler/node-matchers.cc',
-        'compiler/node-matchers.h',
-        'compiler/node-properties.cc',
-        'compiler/node-properties.h',
-        'compiler/node.cc',
-        'compiler/node.h',
-        'compiler/opcodes.cc',
-        'compiler/opcodes.h',
-        'compiler/operation-typer.cc',
-        'compiler/operation-typer.h',
-        'compiler/operator-properties.cc',
-        'compiler/operator-properties.h',
-        'compiler/operator.cc',
-        'compiler/operator.h',
-        'compiler/osr.cc',
-        'compiler/osr.h',
-        'compiler/persistent-map.h',
-        'compiler/pipeline.cc',
-        'compiler/pipeline.h',
-        'compiler/pipeline-statistics.cc',
-        'compiler/pipeline-statistics.h',
-        'compiler/property-access-builder.cc',
-        'compiler/property-access-builder.h',
-        'compiler/raw-machine-assembler.cc',
-        'compiler/raw-machine-assembler.h',
-        'compiler/redundancy-elimination.cc',
-        'compiler/redundancy-elimination.h',
-        'compiler/register-allocator.cc',
-        'compiler/register-allocator.h',
-        'compiler/register-allocator-verifier.cc',
-        'compiler/register-allocator-verifier.h',
-        'compiler/representation-change.cc',
-        'compiler/representation-change.h',
-        'compiler/schedule.cc',
-        'compiler/schedule.h',
-        'compiler/scheduler.cc',
-        'compiler/scheduler.h',
-        'compiler/select-lowering.cc',
-        'compiler/select-lowering.h',
-        'compiler/simd-scalar-lowering.cc',
-        'compiler/simd-scalar-lowering.h',
-        'compiler/simplified-lowering.cc',
-        'compiler/simplified-lowering.h',
-        'compiler/simplified-operator-reducer.cc',
-        'compiler/simplified-operator-reducer.h',
-        'compiler/simplified-operator.cc',
-        'compiler/simplified-operator.h',
-        'compiler/compiler-source-position-table.cc',
-        'compiler/compiler-source-position-table.h',
-        'compiler/state-values-utils.cc',
-        'compiler/state-values-utils.h',
-        'compiler/store-store-elimination.cc',
-        'compiler/store-store-elimination.h',
-        'compiler/types.cc',
-        'compiler/types.h',
-        'compiler/type-cache.cc',
-        'compiler/type-cache.h',
-        'compiler/typed-optimization.cc',
-        'compiler/typed-optimization.h',
-        'compiler/typer.cc',
-        'compiler/typer.h',
-        'compiler/unwinding-info-writer.h',
-        'compiler/value-numbering-reducer.cc',
-        'compiler/value-numbering-reducer.h',
-        'compiler/verifier.cc',
-        'compiler/verifier.h',
-        'compiler/wasm-compiler.cc',
-        'compiler/wasm-compiler.h',
-        'compiler/wasm-linkage.cc',
-        'compiler/zone-stats.cc',
-        'compiler/zone-stats.h',
-        'compiler-dispatcher/compiler-dispatcher.cc',
-        'compiler-dispatcher/compiler-dispatcher.h',
-        'compiler-dispatcher/compiler-dispatcher-job.cc',
-        'compiler-dispatcher/compiler-dispatcher-job.h',
-        'compiler-dispatcher/compiler-dispatcher-tracer.cc',
-        'compiler-dispatcher/compiler-dispatcher-tracer.h',
-        'compiler-dispatcher/optimizing-compile-dispatcher.cc',
-        'compiler-dispatcher/optimizing-compile-dispatcher.h',
-        'compiler-dispatcher/unoptimized-compile-job.cc',
-        'compiler-dispatcher/unoptimized-compile-job.h',
-        'compiler.cc',
-        'compiler.h',
-        'contexts-inl.h',
-        'contexts.cc',
-        'contexts.h',
-        'conversions-inl.h',
-        'conversions.cc',
-        'conversions.h',
-        'counters-inl.h',
-        'counters.cc',
-        'counters.h',
-        'date.cc',
-        'date.h',
-        'dateparser-inl.h',
-        'dateparser.cc',
-        'dateparser.h',
-        'debug/debug-coverage.cc',
-        'debug/debug-coverage.h',
-        'debug/debug-evaluate.cc',
-        'debug/debug-evaluate.h',
-        'debug/debug-interface.h',
-        'debug/debug-frames.cc',
-        'debug/debug-frames.h',
-        'debug/debug-scope-iterator.cc',
-        'debug/debug-scope-iterator.h',
-        'debug/debug-scopes.cc',
-        'debug/debug-scopes.h',
-        'debug/debug-stack-trace-iterator.cc',
-        'debug/debug-stack-trace-iterator.h',
-        'debug/debug-type-profile.cc',
-        'debug/debug-type-profile.h',
-        'debug/debug.cc',
-        'debug/debug.h',
-        'debug/interface-types.h',
-        'debug/liveedit.cc',
-        'debug/liveedit.h',
-        'deoptimize-reason.cc',
-        'deoptimize-reason.h',
-        'deoptimizer.cc',
-        'deoptimizer.h',
-        'detachable-vector.h',
-        'disasm.h',
-        'disassembler.cc',
-        'disassembler.h',
-        'diy-fp.cc',
-        'diy-fp.h',
-        'double.h',
-        'dtoa.cc',
-        'dtoa.h',
-        'eh-frame.cc',
-        'eh-frame.h',
-        'elements-kind.cc',
-        'elements-kind.h',
-        'elements.cc',
-        'elements.h',
-        'execution.cc',
-        'execution.h',
-        'extensions/externalize-string-extension.cc',
-        'extensions/externalize-string-extension.h',
-        'extensions/free-buffer-extension.cc',
-        'extensions/free-buffer-extension.h',
-        'extensions/gc-extension.cc',
-        'extensions/gc-extension.h',
-        'extensions/ignition-statistics-extension.cc',
-        'extensions/ignition-statistics-extension.h',
-        'extensions/statistics-extension.cc',
-        'extensions/statistics-extension.h',
-        'extensions/trigger-failure-extension.cc',
-        'extensions/trigger-failure-extension.h',
-        'external-reference-table.cc',
-        'external-reference-table.h',
-        'factory-inl.h',
-        'factory.cc',
-        'factory.h',
-        'fast-dtoa.cc',
-        'fast-dtoa.h',
-        'feedback-vector-inl.h',
-        'feedback-vector.cc',
-        'feedback-vector.h',
-        'field-index.h',
-        'field-index-inl.h',
-        'field-type.cc',
-        'field-type.h',
-        'fixed-dtoa.cc',
-        'fixed-dtoa.h',
-        'flag-definitions.h',
-        'flags.cc',
-        'flags.h',
-        'frame-constants.h',
-        'frames-inl.h',
-        'frames.cc',
-        'frames.h',
-        'futex-emulation.cc',
-        'futex-emulation.h',
-        'gdb-jit.cc',
-        'gdb-jit.h',
-        'global-handles.cc',
-        'global-handles.h',
-        'globals.h',
-        'handles-inl.h',
-        'handles.cc',
-        'handles.h',
-        'heap-symbols.h',
-        'heap/array-buffer-collector.cc',
-        'heap/array-buffer-collector.h',
-        'heap/array-buffer-tracker-inl.h',
-        'heap/array-buffer-tracker.cc',
-        'heap/array-buffer-tracker.h',
-        'heap/barrier.h',
-        'heap/code-stats.cc',
-        'heap/code-stats.h',
-        'heap/concurrent-marking.cc',
-        'heap/concurrent-marking.h',
-        'heap/embedder-tracing.cc',
-        'heap/embedder-tracing.h',
-        'heap/memory-reducer.cc',
-        'heap/memory-reducer.h',
-        'heap/gc-idle-time-handler.cc',
-        'heap/gc-idle-time-handler.h',
-        'heap/gc-tracer.cc',
-        'heap/gc-tracer.h',
-        'heap/heap-inl.h',
-        'heap/heap.cc',
-        'heap/heap.h',
-        'heap/incremental-marking-inl.h',
-        'heap/incremental-marking-job.cc',
-        'heap/incremental-marking-job.h',
-        'heap/incremental-marking.cc',
-        'heap/incremental-marking.h',
-        'heap/invalidated-slots-inl.h',
-        'heap/invalidated-slots.cc',
-        'heap/invalidated-slots.h',
-        'heap/item-parallel-job.h',
-        'heap/local-allocator.h',
-        'heap/mark-compact-inl.h',
-        'heap/mark-compact.cc',
-        'heap/mark-compact.h',
-        'heap/marking.cc',
-        'heap/marking.h',
-        'heap/object-stats.cc',
-        'heap/object-stats.h',
-        'heap/objects-visiting-inl.h',
-        'heap/objects-visiting.cc',
-        'heap/objects-visiting.h',
-        'heap/remembered-set.h',
-        'heap/scavenge-job.h',
-        'heap/scavenge-job.cc',
-        'heap/scavenger-inl.h',
-        'heap/scavenger.cc',
-        'heap/scavenger.h',
-        'heap/slot-set.h',
-        'heap/spaces-inl.h',
-        'heap/spaces.cc',
-        'heap/spaces.h',
-        'heap/store-buffer.cc',
-        'heap/store-buffer.h',
-        'heap/stress-marking-observer.cc',
-        'heap/stress-marking-observer.h',
-        'heap/stress-scavenge-observer.cc',
-        'heap/stress-scavenge-observer.h',
-        'heap/sweeper.cc',
-        'heap/sweeper.h',
-        'heap/worklist.h',
-        'intl.cc',
-        'intl.h',
-        'icu_util.cc',
-        'icu_util.h',
-        'ic/call-optimization.cc',
-        'ic/call-optimization.h',
-        'ic/handler-configuration.cc',
-        'ic/handler-configuration-inl.h',
-        'ic/handler-configuration.h',
-        'ic/ic-inl.h',
-        'ic/ic-stats.cc',
-        'ic/ic-stats.h',
-        'ic/ic.cc',
-        'ic/ic.h',
-        'identity-map.cc',
-        'identity-map.h',
-        'interface-descriptors.cc',
-        'interface-descriptors.h',
-        'interpreter/block-coverage-builder.h',
-        'interpreter/bytecodes.cc',
-        'interpreter/bytecodes.h',
-        'interpreter/bytecode-array-accessor.cc',
-        'interpreter/bytecode-array-accessor.h',
-        'interpreter/bytecode-array-builder.cc',
-        'interpreter/bytecode-array-builder.h',
-        'interpreter/bytecode-array-iterator.cc',
-        'interpreter/bytecode-array-iterator.h',
-        'interpreter/bytecode-array-random-iterator.cc',
-        'interpreter/bytecode-array-random-iterator.h',
-        'interpreter/bytecode-array-writer.cc',
-        'interpreter/bytecode-array-writer.h',
-        'interpreter/bytecode-decoder.cc',
-        'interpreter/bytecode-decoder.h',
-        'interpreter/bytecode-flags.cc',
-        'interpreter/bytecode-flags.h',
-        'interpreter/bytecode-generator.cc',
-        'interpreter/bytecode-generator.h',
-        'interpreter/bytecode-label.cc',
-        'interpreter/bytecode-label.h',
-        'interpreter/bytecode-node.cc',
-        'interpreter/bytecode-node.h',
-        'interpreter/bytecode-operands.cc',
-        'interpreter/bytecode-operands.h',
-        'interpreter/bytecode-register.cc',
-        'interpreter/bytecode-register.h',
-        'interpreter/bytecode-register-allocator.h',
-        'interpreter/bytecode-register-optimizer.cc',
-        'interpreter/bytecode-register-optimizer.h',
-        'interpreter/bytecode-source-info.cc',
-        'interpreter/bytecode-source-info.h',
-        'interpreter/bytecode-jump-table.h',
-        'interpreter/bytecode-traits.h',
-        'interpreter/constant-array-builder.cc',
-        'interpreter/constant-array-builder.h',
-        'interpreter/control-flow-builders.cc',
-        'interpreter/control-flow-builders.h',
-        'interpreter/handler-table-builder.cc',
-        'interpreter/handler-table-builder.h',
-        'interpreter/interpreter.cc',
-        'interpreter/interpreter.h',
-        'interpreter/interpreter-generator.h',
-        'interpreter/interpreter-intrinsics.cc',
-        'interpreter/interpreter-intrinsics.h',
-        'isolate-inl.h',
-        'isolate.cc',
-        'isolate.h',
-        'json-parser.cc',
-        'json-parser.h',
-        'json-stringifier.cc',
-        'json-stringifier.h',
-        'keys.h',
-        'keys.cc',
-        'label.h',
-        'layout-descriptor-inl.h',
-        'layout-descriptor.cc',
-        'layout-descriptor.h',
-        'locked-queue-inl.h',
-        'locked-queue.h',
-        'log-inl.h',
-        'log-utils.cc',
-        'log-utils.h',
-        'log.cc',
-        'log.h',
-        'lookup-cache-inl.h',
-        'lookup-cache.cc',
-        'lookup-cache.h',
-        'lookup.cc',
-        'lookup.h',
-        'map-updater.cc',
-        'map-updater.h',
-        'macro-assembler-inl.h',
-        'macro-assembler.h',
-        'machine-type.cc',
-        'machine-type.h',
-        'managed.h',
-        'messages.cc',
-        'messages.h',
-        'msan.h',
-        'objects-body-descriptors-inl.h',
-        'objects-body-descriptors.h',
-        'objects-debug.cc',
-        'objects-inl.h',
-        'objects-printer.cc',
-        'objects.cc',
-        'objects.h',
-        'objects/arguments-inl.h',
-        'objects/arguments.h',
-        'objects/bigint.cc',
-        'objects/bigint.h',
-        'objects/code-inl.h',
-        'objects/code.h',
-        'objects/compilation-cache.h',
-        'objects/compilation-cache-inl.h',
-        'objects/data-handler.h',
-        'objects/data-handler-inl.h',
-        'objects/debug-objects-inl.h',
-        'objects/debug-objects.cc',
-        'objects/debug-objects.h',
-        'objects/descriptor-array.h',
-        'objects/dictionary.h',
-        'objects/fixed-array.h',
-        'objects/fixed-array-inl.h',
-        'objects/frame-array.h',
-        'objects/frame-array-inl.h',
-        'objects/hash-table-inl.h',
-        'objects/hash-table.h',
-        'objects/intl-objects.cc',
-        'objects/intl-objects.h',
-        'objects/js-array.h',
-        'objects/js-array-inl.h',
-        'objects/js-collection.h',
-        'objects/js-collection-inl.h',
-        'objects/js-regexp.h',
-        'objects/js-regexp-inl.h',
-        'objects/literal-objects.cc',
-        'objects/literal-objects-inl.h',
-        'objects/literal-objects.h',
-        'objects/map-inl.h',
-        'objects/map.h',
-        'objects/name-inl.h',
-        'objects/name.h',
-        'objects/module-inl.h',
-        'objects/module.cc',
-        'objects/module.h',
-        'objects/object-macros.h',
-        'objects/object-macros-undef.h',
-        'objects/property-descriptor-object.h',
-        'objects/property-descriptor-object-inl.h',
-        'objects/regexp-match-info.h',
-        'objects/scope-info.cc',
-        'objects/scope-info.h',
-        'objects/script.h',
-        'objects/script-inl.h',
-        'objects/shared-function-info-inl.h',
-        'objects/shared-function-info.h',
-        'objects/string-inl.h',
-        'objects/string.h',
-        'objects/string-table.h',
-        'objects/template-objects.cc',
-        'objects/template-objects.h',
-        'ostreams.cc',
-        'ostreams.h',
-        'parsing/background-parsing-task.cc',
-        'parsing/background-parsing-task.h',
-        'parsing/duplicate-finder.h',
-        'parsing/expression-classifier.h',
-        'parsing/expression-scope-reparenter.cc',
-        'parsing/expression-scope-reparenter.h',
-        'parsing/func-name-inferrer.cc',
-        'parsing/func-name-inferrer.h',
-        'parsing/parse-info.cc',
-        'parsing/parse-info.h',
-        'parsing/parser-base.h',
-        'parsing/parser.cc',
-        'parsing/parser.h',
-        'parsing/parsing.cc',
-        'parsing/parsing.h',
-        'parsing/pattern-rewriter.cc',
-        'parsing/preparse-data-format.h',
-        'parsing/preparse-data.cc',
-        'parsing/preparse-data.h',
-        'parsing/preparsed-scope-data.cc',
-        'parsing/preparsed-scope-data.h',
-        'parsing/preparser.cc',
-        'parsing/preparser.h',
-        'parsing/rewriter.cc',
-        'parsing/rewriter.h',
-        'parsing/scanner-character-streams.cc',
-        'parsing/scanner-character-streams.h',
-        'parsing/scanner.cc',
-        'parsing/scanner.h',
-        'parsing/token.cc',
-        'parsing/token.h',
-        'pending-compilation-error-handler.cc',
-        'pending-compilation-error-handler.h',
-        'perf-jit.cc',
-        'perf-jit.h',
-        'profiler/allocation-tracker.cc',
-        'profiler/allocation-tracker.h',
-        'profiler/circular-queue-inl.h',
-        'profiler/circular-queue.h',
-        'profiler/cpu-profiler-inl.h',
-        'profiler/cpu-profiler.cc',
-        'profiler/cpu-profiler.h',
-        'profiler/heap-profiler.cc',
-        'profiler/heap-profiler.h',
-        'profiler/heap-snapshot-generator-inl.h',
-        'profiler/heap-snapshot-generator.cc',
-        'profiler/heap-snapshot-generator.h',
-        'profiler/profiler-listener.cc',
-        'profiler/profiler-listener.h',
-        'profiler/profile-generator-inl.h',
-        'profiler/profile-generator.cc',
-        'profiler/profile-generator.h',
-        'profiler/sampling-heap-profiler.cc',
-        'profiler/sampling-heap-profiler.h',
-        'profiler/strings-storage.cc',
-        'profiler/strings-storage.h',
-        'profiler/tick-sample.cc',
-        'profiler/tick-sample.h',
-        'profiler/tracing-cpu-profiler.cc',
-        'profiler/tracing-cpu-profiler.h',
-        'profiler/unbound-queue-inl.h',
-        'profiler/unbound-queue.h',
-        'property-descriptor.cc',
-        'property-descriptor.h',
-        'property-details.h',
-        'property.cc',
-        'property.h',
-        'prototype.h',
-        'regexp/bytecodes-irregexp.h',
-        'regexp/interpreter-irregexp.cc',
-        'regexp/interpreter-irregexp.h',
-        'regexp/jsregexp-inl.h',
-        'regexp/jsregexp.cc',
-        'regexp/jsregexp.h',
-        'regexp/regexp-ast.cc',
-        'regexp/regexp-ast.h',
-        'regexp/regexp-macro-assembler-irregexp-inl.h',
-        'regexp/regexp-macro-assembler-irregexp.cc',
-        'regexp/regexp-macro-assembler-irregexp.h',
-        'regexp/regexp-macro-assembler-tracer.cc',
-        'regexp/regexp-macro-assembler-tracer.h',
-        'regexp/regexp-macro-assembler.cc',
-        'regexp/regexp-macro-assembler.h',
-        'regexp/regexp-parser.cc',
-        'regexp/regexp-parser.h',
-        'regexp/regexp-stack.cc',
-        'regexp/regexp-stack.h',
-        'regexp/regexp-utils.cc',
-        'regexp/regexp-utils.h',
-        'register-configuration.cc',
-        'register-configuration.h',
-        'reglist.h',
-        'runtime-profiler.cc',
-        'runtime-profiler.h',
-        'runtime/runtime-array.cc',
-        'runtime/runtime-atomics.cc',
-        'runtime/runtime-bigint.cc',
-        'runtime/runtime-classes.cc',
-        'runtime/runtime-collections.cc',
-        'runtime/runtime-compiler.cc',
-        'runtime/runtime-date.cc',
-        'runtime/runtime-debug.cc',
-        'runtime/runtime-forin.cc',
-        'runtime/runtime-function.cc',
-        'runtime/runtime-error.cc',
-        'runtime/runtime-futex.cc',
-        'runtime/runtime-generator.cc',
-        'runtime/runtime-intl.cc',
-        'runtime/runtime-internal.cc',
-        'runtime/runtime-interpreter.cc',
-        'runtime/runtime-literals.cc',
-        'runtime/runtime-liveedit.cc',
-        'runtime/runtime-maths.cc',
-        'runtime/runtime-module.cc',
-        'runtime/runtime-numbers.cc',
-        'runtime/runtime-object.cc',
-        'runtime/runtime-operators.cc',
-        'runtime/runtime-promise.cc',
-        'runtime/runtime-proxy.cc',
-        'runtime/runtime-regexp.cc',
-        'runtime/runtime-scopes.cc',
-        'runtime/runtime-strings.cc',
-        'runtime/runtime-symbol.cc',
-        'runtime/runtime-test.cc',
-        'runtime/runtime-typedarray.cc',
-        'runtime/runtime-utils.h',
-        'runtime/runtime-wasm.cc',
-        'runtime/runtime.cc',
-        'runtime/runtime.h',
-        'safepoint-table.cc',
-        'safepoint-table.h',
-        'setup-isolate.h',
-        'signature.h',
-        'simulator-base.cc',
-        'simulator-base.h',
-        'simulator.h',
-        'snapshot/builtin-deserializer-allocator.cc',
-        'snapshot/builtin-deserializer-allocator.h',
-        'snapshot/builtin-deserializer.cc',
-        'snapshot/builtin-deserializer.h',
-        'snapshot/builtin-serializer-allocator.cc',
-        'snapshot/builtin-serializer-allocator.h',
-        'snapshot/builtin-serializer.cc',
-        'snapshot/builtin-serializer.h',
-        'snapshot/builtin-snapshot-utils.cc',
-        'snapshot/builtin-snapshot-utils.h',
-        'snapshot/code-serializer.cc',
-        'snapshot/code-serializer.h',
-        'snapshot/default-deserializer-allocator.cc',
-        'snapshot/default-deserializer-allocator.h',
-        'snapshot/default-serializer-allocator.cc',
-        'snapshot/default-serializer-allocator.h',
-        'snapshot/deserializer.cc',
-        'snapshot/deserializer.h',
-        'snapshot/natives-common.cc',
-        'snapshot/natives.h',
-        'snapshot/object-deserializer.cc',
-        'snapshot/object-deserializer.h',
-        'snapshot/partial-deserializer.cc',
-        'snapshot/partial-deserializer.h',
-        'snapshot/partial-serializer.cc',
-        'snapshot/partial-serializer.h',
-        'snapshot/serializer.cc',
-        'snapshot/serializer-common.cc',
-        'snapshot/serializer-common.h',
-        'snapshot/serializer.h',
-        'snapshot/snapshot-common.cc',
-        'snapshot/snapshot.h',
-        'snapshot/snapshot-source-sink.cc',
-        'snapshot/snapshot-source-sink.h',
-        'snapshot/startup-deserializer.cc',
-        'snapshot/startup-deserializer.h',
-        'snapshot/startup-serializer.cc',
-        'snapshot/startup-serializer.h',
-        'source-position-table.cc',
-        'source-position-table.h',
-        'source-position.cc',
-        'source-position.h',
-        'splay-tree.h',
-        'splay-tree-inl.h',
-        'startup-data-util.cc',
-        'startup-data-util.h',
-        'string-builder.cc',
-        'string-builder.h',
-        'string-case.cc',
-        'string-case.h',
-        'string-hasher-inl.h',
-        'string-hasher.h',
-        'string-search.h',
-        'string-stream.cc',
-        'string-stream.h',
-        'strtod.cc',
-        'strtod.h',
-        'ic/stub-cache.cc',
-        'ic/stub-cache.h',
-        'third_party/utf8-decoder/utf8-decoder.h',
-        'tracing/trace-event.cc',
-        'tracing/trace-event.h',
-        'tracing/traced-value.cc',
-        'tracing/traced-value.h',
-        'tracing/tracing-category-observer.cc',
-        'tracing/tracing-category-observer.h',
-        'transitions-inl.h',
-        'transitions.cc',
-        'transitions.h',
-        'trap-handler/handler-outside.cc',
-        'trap-handler/handler-shared.cc',
-        'trap-handler/trap-handler.h',
-        'trap-handler/trap-handler-internal.h',
-        'type-hints.cc',
-        'type-hints.h',
-        'unicode-inl.h',
-        'unicode.cc',
-        'unicode.h',
-        'unicode-cache-inl.h',
-        'unicode-cache.h',
-        'unicode-decoder.cc',
-        'unicode-decoder.h',
-        'uri.cc',
-        'uri.h',
-        'utils-inl.h',
-        'utils.cc',
-        'utils.h',
-        'v8.cc',
-        'v8.h',
-        'v8memory.h',
-        'v8threads.cc',
-        'v8threads.h',
-        'value-serializer.cc',
-        'value-serializer.h',
-        'vector-slot-pair.cc',
-        'vector-slot-pair.h',
-        'vector.h',
-        'version.cc',
-        'version.h',
-        'visitors.cc',
-        'visitors.h',
-        'vm-state-inl.h',
-        'vm-state.h',
-        'wasm/baseline/liftoff-assembler-defs.h',
-        'wasm/baseline/liftoff-assembler.cc',
-        'wasm/baseline/liftoff-assembler.h',
-        'wasm/baseline/liftoff-compiler.cc',
-        'wasm/baseline/liftoff-register.h',
-        'wasm/compilation-manager.cc',
-        'wasm/compilation-manager.h',
-        'wasm/decoder.h',
-        'wasm/function-body-decoder.cc',
-        'wasm/function-body-decoder.h',
-        'wasm/function-body-decoder-impl.h',
-        'wasm/leb-helper.h',
-        'wasm/local-decl-encoder.cc',
-        'wasm/local-decl-encoder.h',
-        'wasm/memory-tracing.cc',
-        'wasm/memory-tracing.h',
-        'wasm/module-compiler.cc',
-        'wasm/module-compiler.h',
-        'wasm/module-decoder.cc',
-        'wasm/module-decoder.h',
-        'wasm/signature-map.cc',
-        'wasm/signature-map.h',
-        'wasm/streaming-decoder.cc',
-        'wasm/streaming-decoder.h',
-        'wasm/wasm-api.cc',
-        'wasm/wasm-api.h',
-        'wasm/wasm-code-manager.cc',
-        'wasm/wasm-code-manager.h',
-        'wasm/wasm-code-specialization.cc',
-        'wasm/wasm-code-specialization.h',
-        'wasm/wasm-code-wrapper.cc',
-        'wasm/wasm-code-wrapper.h',
-        'wasm/wasm-constants.h',
-        'wasm/wasm-debug.cc',
-        'wasm/wasm-engine.cc',
-        'wasm/wasm-engine.h',
-        'wasm/wasm-external-refs.cc',
-        'wasm/wasm-external-refs.h',
-        'wasm/wasm-js.cc',
-        'wasm/wasm-js.h',
-        'wasm/wasm-limits.h',
-        'wasm/wasm-memory.cc',
-        'wasm/wasm-memory.h',
-        'wasm/wasm-module.cc',
-        'wasm/wasm-module.h',
-        'wasm/wasm-module-builder.cc',
-        'wasm/wasm-module-builder.h',
-        'wasm/wasm-interpreter.cc',
-        'wasm/wasm-interpreter.h',
-        'wasm/wasm-objects-inl.h',
-        'wasm/wasm-objects.cc',
-        'wasm/wasm-objects.h',
-        'wasm/wasm-opcodes.cc',
-        'wasm/wasm-opcodes.h',
-        'wasm/wasm-result.cc',
-        'wasm/wasm-result.h',
-        'wasm/wasm-serialization.cc',
-        'wasm/wasm-serialization.h',
-        'wasm/wasm-text.cc',
-        'wasm/wasm-text.h',
-        'wasm/wasm-value.h',
-        'zone/accounting-allocator.cc',
-        'zone/accounting-allocator.h',
-        'zone/zone-segment.cc',
-        'zone/zone-segment.h',
-        'zone/zone.cc',
-        'zone/zone.h',
-        'zone/zone-chunk-list.h',
-        'zone/zone-segment.cc',
-        'zone/zone-segment.h',
-        'zone/zone-allocator.h',
-        'zone/zone-containers.h',
-        'zone/zone-handle-set.h',
-        'zone/zone-list-inl.h',
-      ],
-      'conditions': [
-        ['want_separate_host_toolset==1', {
-          'toolsets': ['host', 'target'],
-        }, {
-          'toolsets': ['target'],
-        }],
-        ['v8_target_arch=="arm"', {
-          'sources': [  ### gcmole(arch:arm) ###
-            'arm/assembler-arm-inl.h',
-            'arm/assembler-arm.cc',
-            'arm/assembler-arm.h',
-            'arm/code-stubs-arm.cc',
-            'arm/code-stubs-arm.h',
-            'arm/codegen-arm.cc',
-            'arm/constants-arm.h',
-            'arm/constants-arm.cc',
-            'arm/cpu-arm.cc',
-            'arm/deoptimizer-arm.cc',
-            'arm/disasm-arm.cc',
-            'arm/frame-constants-arm.cc',
-            'arm/frame-constants-arm.h',
-            'arm/interface-descriptors-arm.cc',
-            'arm/interface-descriptors-arm.h',
-            'arm/macro-assembler-arm.cc',
-            'arm/macro-assembler-arm.h',
-            'arm/simulator-arm.cc',
-            'arm/simulator-arm.h',
-            'arm/eh-frame-arm.cc',
-            'compiler/arm/code-generator-arm.cc',
-            'compiler/arm/instruction-codes-arm.h',
-            'compiler/arm/instruction-scheduler-arm.cc',
-            'compiler/arm/instruction-selector-arm.cc',
-            'compiler/arm/unwinding-info-writer-arm.cc',
-            'compiler/arm/unwinding-info-writer-arm.h',
-            'debug/arm/debug-arm.cc',
-            'regexp/arm/regexp-macro-assembler-arm.cc',
-            'regexp/arm/regexp-macro-assembler-arm.h',
-            'wasm/baseline/arm/liftoff-assembler-arm-defs.h',
-            'wasm/baseline/arm/liftoff-assembler-arm.h',
-          ],
-        }],
-        ['v8_target_arch=="arm64"', {
-          'sources': [  ### gcmole(arch:arm64) ###
-            'arm64/assembler-arm64.cc',
-            'arm64/assembler-arm64.h',
-            'arm64/assembler-arm64-inl.h',
-            'arm64/codegen-arm64.cc',
-            'arm64/code-stubs-arm64.cc',
-            'arm64/code-stubs-arm64.h',
-            'arm64/constants-arm64.h',
-            'arm64/cpu-arm64.cc',
-            'arm64/decoder-arm64.cc',
-            'arm64/decoder-arm64.h',
-            'arm64/decoder-arm64-inl.h',
-            'arm64/deoptimizer-arm64.cc',
-            'arm64/disasm-arm64.cc',
-            'arm64/disasm-arm64.h',
-            'arm64/frame-constants-arm64.cc',
-            'arm64/frame-constants-arm64.h',
-            'arm64/instructions-arm64-constants.cc',
-            'arm64/instructions-arm64.cc',
-            'arm64/instructions-arm64.h',
-            'arm64/instrument-arm64.cc',
-            'arm64/instrument-arm64.h',
-            'arm64/interface-descriptors-arm64.cc',
-            'arm64/interface-descriptors-arm64.h',
-            'arm64/macro-assembler-arm64.cc',
-            'arm64/macro-assembler-arm64.h',
-            'arm64/macro-assembler-arm64-inl.h',
-            'arm64/simulator-arm64.cc',
-            'arm64/simulator-arm64.h',
-            'arm64/simulator-logic-arm64.cc',
-            'arm64/utils-arm64.cc',
-            'arm64/utils-arm64.h',
-            'arm64/eh-frame-arm64.cc',
-            'compiler/arm64/code-generator-arm64.cc',
-            'compiler/arm64/instruction-codes-arm64.h',
-            'compiler/arm64/instruction-scheduler-arm64.cc',
-            'compiler/arm64/instruction-selector-arm64.cc',
-            'compiler/arm64/unwinding-info-writer-arm64.cc',
-            'compiler/arm64/unwinding-info-writer-arm64.h',
-            'debug/arm64/debug-arm64.cc',
-            'regexp/arm64/regexp-macro-assembler-arm64.cc',
-            'regexp/arm64/regexp-macro-assembler-arm64.h',
-            'wasm/baseline/arm64/liftoff-assembler-arm64-defs.h',
-            'wasm/baseline/arm64/liftoff-assembler-arm64.h',
-          ],
-        }],
-        ['v8_target_arch=="ia32"', {
-          'sources': [  ### gcmole(arch:ia32) ###
-            'ia32/assembler-ia32-inl.h',
-            'ia32/assembler-ia32.cc',
-            'ia32/assembler-ia32.h',
-            'ia32/code-stubs-ia32.cc',
-            'ia32/codegen-ia32.cc',
-            'ia32/cpu-ia32.cc',
-            'ia32/deoptimizer-ia32.cc',
-            'ia32/disasm-ia32.cc',
-            'ia32/frame-constants-ia32.cc',
-            'ia32/frame-constants-ia32.h',
-            'ia32/interface-descriptors-ia32.cc',
-            'ia32/macro-assembler-ia32.cc',
-            'ia32/macro-assembler-ia32.h',
-            'ia32/simulator-ia32.cc',
-            'ia32/simulator-ia32.h',
-            'ia32/sse-instr.h',
-            'compiler/ia32/code-generator-ia32.cc',
-            'compiler/ia32/instruction-codes-ia32.h',
-            'compiler/ia32/instruction-scheduler-ia32.cc',
-            'compiler/ia32/instruction-selector-ia32.cc',
-            'debug/ia32/debug-ia32.cc',
-            'regexp/ia32/regexp-macro-assembler-ia32.cc',
-            'regexp/ia32/regexp-macro-assembler-ia32.h',
-            'wasm/baseline/ia32/liftoff-assembler-ia32-defs.h',
-            'wasm/baseline/ia32/liftoff-assembler-ia32.h',
-          ],
-        }],
-        ['v8_target_arch=="mips" or v8_target_arch=="mipsel"', {
-          'sources': [  ### gcmole(arch:mipsel) ###
-            'mips/assembler-mips.cc',
-            'mips/assembler-mips.h',
-            'mips/assembler-mips-inl.h',
-            'mips/codegen-mips.cc',
-            'mips/code-stubs-mips.cc',
-            'mips/code-stubs-mips.h',
-            'mips/constants-mips.cc',
-            'mips/constants-mips.h',
-            'mips/cpu-mips.cc',
-            'mips/deoptimizer-mips.cc',
-            'mips/disasm-mips.cc',
-            'mips/frame-constants-mips.cc',
-            'mips/frame-constants-mips.h',
-            'mips/interface-descriptors-mips.cc',
-            'mips/macro-assembler-mips.cc',
-            'mips/macro-assembler-mips.h',
-            'mips/simulator-mips.cc',
-            'mips/simulator-mips.h',
-            'compiler/mips/code-generator-mips.cc',
-            'compiler/mips/instruction-codes-mips.h',
-            'compiler/mips/instruction-scheduler-mips.cc',
-            'compiler/mips/instruction-selector-mips.cc',
-            'debug/mips/debug-mips.cc',
-            'regexp/mips/regexp-macro-assembler-mips.cc',
-            'regexp/mips/regexp-macro-assembler-mips.h',
-            'wasm/baseline/mips/liftoff-assembler-mips-defs.h',
-            'wasm/baseline/mips/liftoff-assembler-mips.h',
-          ],
-        }],
-        ['v8_target_arch=="mips64" or v8_target_arch=="mips64el"', {
-          'sources': [  ### gcmole(arch:mips64el) ###
-            'mips64/assembler-mips64.cc',
-            'mips64/assembler-mips64.h',
-            'mips64/assembler-mips64-inl.h',
-            'mips64/codegen-mips64.cc',
-            'mips64/code-stubs-mips64.cc',
-            'mips64/code-stubs-mips64.h',
-            'mips64/constants-mips64.cc',
-            'mips64/constants-mips64.h',
-            'mips64/cpu-mips64.cc',
-            'mips64/deoptimizer-mips64.cc',
-            'mips64/disasm-mips64.cc',
-            'mips64/frame-constants-mips64.cc',
-            'mips64/frame-constants-mips64.h',
-            'mips64/interface-descriptors-mips64.cc',
-            'mips64/macro-assembler-mips64.cc',
-            'mips64/macro-assembler-mips64.h',
-            'mips64/simulator-mips64.cc',
-            'mips64/simulator-mips64.h',
-            'compiler/mips64/code-generator-mips64.cc',
-            'compiler/mips64/instruction-codes-mips64.h',
-            'compiler/mips64/instruction-scheduler-mips64.cc',
-            'compiler/mips64/instruction-selector-mips64.cc',
-            'debug/mips64/debug-mips64.cc',
-            'regexp/mips64/regexp-macro-assembler-mips64.cc',
-            'regexp/mips64/regexp-macro-assembler-mips64.h',
-            'wasm/baseline/mips64/liftoff-assembler-mips64-defs.h',
-            'wasm/baseline/mips64/liftoff-assembler-mips64.h',
-          ],
-        }],
-        ['v8_target_arch=="x64"', {
-          'sources': [  ### gcmole(arch:x64) ###
-            'compiler/x64/code-generator-x64.cc',
-            'compiler/x64/instruction-codes-x64.h',
-            'compiler/x64/instruction-scheduler-x64.cc',
-            'compiler/x64/instruction-selector-x64.cc',
-            'compiler/x64/unwinding-info-writer-x64.cc',
-            'compiler/x64/unwinding-info-writer-x64.h',
-            'x64/assembler-x64-inl.h',
-            'x64/assembler-x64.cc',
-            'x64/assembler-x64.h',
-            'x64/code-stubs-x64.cc',
-            'x64/codegen-x64.cc',
-            'x64/cpu-x64.cc',
-            'x64/deoptimizer-x64.cc',
-            'x64/disasm-x64.cc',
-            'x64/eh-frame-x64.cc',
-            'x64/frame-constants-x64.cc',
-            'x64/frame-constants-x64.h',
-            'x64/interface-descriptors-x64.cc',
-            'x64/macro-assembler-x64.cc',
-            'x64/macro-assembler-x64.h',
-            'x64/simulator-x64.cc',
-            'x64/simulator-x64.h',
-            'x64/sse-instr.h',
-            'debug/x64/debug-x64.cc',
-            'regexp/x64/regexp-macro-assembler-x64.cc',
-            'regexp/x64/regexp-macro-assembler-x64.h',
-            'third_party/valgrind/valgrind.h',
-            'wasm/baseline/x64/liftoff-assembler-x64-defs.h',
-            'wasm/baseline/x64/liftoff-assembler-x64.h',
-          ],
-        }],
-        ['v8_target_arch=="x64" and OS=="linux"', {
-            'sources': ['trap-handler/handler-inside.cc']
-        }],
-        ['v8_target_arch=="ppc" or v8_target_arch=="ppc64"', {
-          'sources': [  ### gcmole(arch:ppc) ###
-            'compiler/ppc/code-generator-ppc.cc',
-            'compiler/ppc/instruction-codes-ppc.h',
-            'compiler/ppc/instruction-scheduler-ppc.cc',
-            'compiler/ppc/instruction-selector-ppc.cc',
-            'debug/ppc/debug-ppc.cc',
-            'ppc/assembler-ppc-inl.h',
-            'ppc/assembler-ppc.cc',
-            'ppc/assembler-ppc.h',
-            'ppc/code-stubs-ppc.cc',
-            'ppc/code-stubs-ppc.h',
-            'ppc/codegen-ppc.cc',
-            'ppc/constants-ppc.h',
-            'ppc/constants-ppc.cc',
-            'ppc/cpu-ppc.cc',
-            'ppc/deoptimizer-ppc.cc',
-            'ppc/disasm-ppc.cc',
-            'ppc/frame-constants-ppc.cc',
-            'ppc/frame-constants-ppc.h',
-            'ppc/interface-descriptors-ppc.cc',
-            'ppc/macro-assembler-ppc.cc',
-            'ppc/macro-assembler-ppc.h',
-            'ppc/simulator-ppc.cc',
-            'ppc/simulator-ppc.h',
-            'regexp/ppc/regexp-macro-assembler-ppc.cc',
-            'regexp/ppc/regexp-macro-assembler-ppc.h',
-            'wasm/baseline/ppc/liftoff-assembler-ppc-defs.h',
-            'wasm/baseline/ppc/liftoff-assembler-ppc.h',
-          ],
-        }],
-        ['v8_target_arch=="s390" or v8_target_arch=="s390x"', {
-          'sources': [  ### gcmole(arch:s390) ###
-            'compiler/s390/code-generator-s390.cc',
-            'compiler/s390/instruction-codes-s390.h',
-            'compiler/s390/instruction-scheduler-s390.cc',
-            'compiler/s390/instruction-selector-s390.cc',
-            'debug/s390/debug-s390.cc',
-            'regexp/s390/regexp-macro-assembler-s390.cc',
-            'regexp/s390/regexp-macro-assembler-s390.h',
-            's390/assembler-s390.cc',
-            's390/assembler-s390.h',
-            's390/assembler-s390-inl.h',
-            's390/codegen-s390.cc',
-            's390/code-stubs-s390.cc',
-            's390/code-stubs-s390.h',
-            's390/constants-s390.cc',
-            's390/constants-s390.h',
-            's390/cpu-s390.cc',
-            's390/deoptimizer-s390.cc',
-            's390/disasm-s390.cc',
-            's390/frame-constants-s390.cc',
-            's390/frame-constants-s390.h',
-            's390/interface-descriptors-s390.cc',
-            's390/macro-assembler-s390.cc',
-            's390/macro-assembler-s390.h',
-            's390/simulator-s390.cc',
-            's390/simulator-s390.h',
-            'wasm/baseline/s390/liftoff-assembler-s390-defs.h',
-            'wasm/baseline/s390/liftoff-assembler-s390.h',
-          ],
-        }],
-        ['OS=="win"', {
-          'variables': {
-            'gyp_generators': '<!(echo $GYP_GENERATORS)',
-          },
-          'msvs_disabled_warnings': [4351, 4355, 4800],
-          # When building Official, the .lib is too large and exceeds the 2G
-          # limit. This breaks it into multiple pieces to avoid the limit.
-          # See http://crbug.com/485155.
-          'msvs_shard': 4,
-          # This will prevent V8's .cc files conflicting with the inspector's
-          # .cpp files in the same shard.
-          'msvs_settings': {
-            'VCCLCompilerTool': {
-              'ObjectFile':'$(IntDir)%(Extension)\\',
-            },
-          },
-        }],
-        ['component=="shared_library"', {
-          'defines': [
-            'BUILDING_V8_SHARED',
-          ],
-        }],
-        ['v8_postmortem_support=="true"', {
-          'sources': [
-            '<(SHARED_INTERMEDIATE_DIR)/debug-support.cc',
-          ]
-        }],
-        ['v8_enable_i18n_support==1', {
-          'dependencies': [
-            '<(icu_gyp_path):icui18n',
-            '<(icu_gyp_path):icuuc',
-          ],
-          'conditions': [
-            ['icu_use_data_file_flag==1', {
-              'defines': ['ICU_UTIL_DATA_IMPL=ICU_UTIL_DATA_FILE'],
-            }, { # else icu_use_data_file_flag !=1
-              'conditions': [
-                ['OS=="win"', {
-                  'defines': ['ICU_UTIL_DATA_IMPL=ICU_UTIL_DATA_SHARED'],
-                }, {
-                  'defines': ['ICU_UTIL_DATA_IMPL=ICU_UTIL_DATA_STATIC'],
-                }],
-              ],
-            }],
-          ],
-        }, {  # v8_enable_i18n_support==0
-          'sources!': [
-            'builtins/builtins-intl.cc',
-            'builtins/builtins-intl.h',
-            'char-predicates.cc',
-            'intl.cc',
-            'intl.h',
-            'objects/intl-objects.cc',
-            'objects/intl-objects.h',
-            'runtime/runtime-intl.cc',
-          ],
-        }],
-        ['OS=="win" and v8_enable_i18n_support==1', {
-          'dependencies': [
-            '<(icu_gyp_path):icudata',
-          ],
-        }],
-      ],
-    },
-    {
-      'target_name': 'v8_libbase',
-      'type': '<(component)',
-      'variables': {
-        'optimize': 'max',
-      },
-      'include_dirs+': [
-        '..',
-      ],
-      'sources': [
-        'base/adapters.h',
-        'base/atomic-utils.h',
-        'base/atomicops.h',
-        'base/atomicops_internals_atomicword_compat.h',
-        'base/atomicops_internals_portable.h',
-        'base/atomicops_internals_std.h',
-        'base/base-export.h',
-        'base/bits.cc',
-        'base/bits.h',
-        'base/build_config.h',
-        'base/compiler-specific.h',
-        'base/cpu.cc',
-        'base/cpu.h',
-        'base/division-by-constant.cc',
-        'base/division-by-constant.h',
-        'base/debug/stack_trace.cc',
-        'base/debug/stack_trace.h',
-        'base/export-template.h',
-        'base/file-utils.cc',
-        'base/file-utils.h',
-        'base/flags.h',
-        'base/format-macros.h',
-        'base/free_deleter.h',
-        'base/functional.cc',
-        'base/functional.h',
-        'base/hashmap.h',
-        'base/hashmap-entry.h',
-        'base/ieee754.cc',
-        'base/ieee754.h',
-        'base/iterator.h',
-        'base/lazy-instance.h',
-        'base/logging.cc',
-        'base/logging.h',
-        'base/macros.h',
-        'base/once.cc',
-        'base/once.h',
-        'base/optional.h',
-        'base/page-allocator.cc',
-        'base/page-allocator.h',
-        'base/platform/elapsed-timer.h',
-        'base/platform/time.cc',
-        'base/platform/time.h',
-        'base/platform/condition-variable.cc',
-        'base/platform/condition-variable.h',
-        'base/platform/mutex.cc',
-        'base/platform/mutex.h',
-        'base/platform/platform.h',
-        'base/platform/semaphore.cc',
-        'base/platform/semaphore.h',
-        'base/ring-buffer.h',
-        'base/safe_conversions.h',
-        'base/safe_conversions_impl.h',
-        'base/safe_math.h',
-        'base/safe_math_impl.h',
-        'base/sys-info.cc',
-        'base/sys-info.h',
-        'base/template-utils.h',
-        'base/timezone-cache.h',
-        'base/tsan.h',
-        'base/utils/random-number-generator.cc',
-        'base/utils/random-number-generator.h',
-      ],
-      'target_conditions': [
-        ['OS=="android" and _toolset=="target"', {
-          'libraries': [
-            '-llog',
-          ],
-          'include_dirs': [
-            'src/common/android/include',
-          ],
-        }],
-      ],
-      'conditions': [
-        ['want_separate_host_toolset==1', {
-          'toolsets': ['host', 'target'],
-        }, {
-          'toolsets': ['target'],
-        }],
-        ['component=="shared_library"', {
-          'defines': [
-            'BUILDING_V8_BASE_SHARED',
-          ],
-          'direct_dependent_settings': {
-            'defines': [
-              'USING_V8_BASE_SHARED',
-            ],
-          },
-        }],
-        ['OS=="linux"', {
-            'link_settings': {
-              'libraries': [
-                '-ldl',
-                '-lrt'
-              ],
-            },
-            'sources': [
-              'base/debug/stack_trace_posix.cc',
-              'base/platform/platform-linux.cc',
-              'base/platform/platform-posix.h',
-              'base/platform/platform-posix.cc',
-              'base/platform/platform-posix-time.h',
-              'base/platform/platform-posix-time.cc',
-            ],
-          }
-        ],
-        ['OS=="android"', {
-            'sources': [
-              'base/debug/stack_trace_android.cc',
-              'base/platform/platform-posix.h',
-              'base/platform/platform-posix.cc',
-              'base/platform/platform-posix-time.h',
-              'base/platform/platform-posix-time.cc',
-            ],
-            'link_settings': {
-              'target_conditions': [
-                ['_toolset=="host" and host_os!="mac"', {
-                  # Only include libdl and librt on host builds because they
-                  # are included by default on Android target builds, and we
-                  # don't want to re-include them here since this will change
-                  # library order and break (see crbug.com/469973).
-                  # These libraries do not exist on Mac hosted builds.
-                  'libraries': [
-                    '-ldl',
-                    '-lrt'
-                  ]
-                }]
-              ]
-            },
-            'conditions': [
-              ['host_os=="mac"', {
-                'target_conditions': [
-                  ['_toolset=="host"', {
-                    'sources': [
-                      'base/platform/platform-macos.cc'
-                    ]
-                  }, {
-                    'sources': [
-                      'base/platform/platform-linux.cc'
-                    ]
-                  }],
-                ],
-              }, {
-                'sources': [
-                  'base/platform/platform-linux.cc'
-                ]
-              }],
-            ],
-          },
-        ],
-        ['OS=="qnx"', {
-            'link_settings': {
-              'target_conditions': [
-                ['_toolset=="host" and host_os=="linux"', {
-                  'libraries': [
-                    '-lrt'
-                  ],
-                }],
-                ['_toolset=="target"', {
-                  'libraries': [
-                    '-lbacktrace'
-                  ],
-                }],
-              ],
-            },
-            'sources': [
-              'base/debug/stack_trace_posix.cc',
-              'base/platform/platform-posix.h',
-              'base/platform/platform-posix.cc',
-              'base/platform/platform-posix-time.h',
-              'base/platform/platform-posix-time.cc',
-              'base/qnx-math.h'
-            ],
-            'target_conditions': [
-              ['_toolset=="host" and host_os=="linux"', {
-                'sources': [
-                  'base/platform/platform-linux.cc'
-                ],
-              }],
-              ['_toolset=="host" and host_os=="mac"', {
-                'sources': [
-                  'base/platform/platform-macos.cc'
-                ],
-              }],
-              ['_toolset=="target"', {
-                'sources': [
-                  'base/platform/platform-qnx.cc'
-                ],
-              }],
-            ],
-          },
-        ],
-        ['OS=="freebsd"', {
-            'link_settings': {
-              'libraries': [
-                '-L/usr/local/lib -lexecinfo',
-            ]},
-            'sources': [
-              'base/debug/stack_trace_posix.cc',
-              'base/platform/platform-freebsd.cc',
-              'base/platform/platform-posix.h',
-              'base/platform/platform-posix.cc',
-              'base/platform/platform-posix-time.h',
-              'base/platform/platform-posix-time.cc',
-            ],
-          }
-        ],
-        ['OS=="openbsd"', {
-            'link_settings': {
-              'libraries': [
-                '-L/usr/local/lib -lexecinfo',
-            ]},
-            'sources': [
-              'base/debug/stack_trace_posix.cc',
-              'base/platform/platform-openbsd.cc',
-              'base/platform/platform-posix.h',
-              'base/platform/platform-posix.cc',
-              'base/platform/platform-posix-time.h',
-              'base/platform/platform-posix-time.cc',
-            ],
-          }
-        ],
-        ['OS=="netbsd"', {
-            'link_settings': {
-              'libraries': [
-                '-L/usr/pkg/lib -Wl,-R/usr/pkg/lib -lexecinfo',
-            ]},
-            'sources': [
-              'base/debug/stack_trace_posix.cc',
-              'base/platform/platform-openbsd.cc',
-              'base/platform/platform-posix.h',
-              'base/platform/platform-posix.cc',
-              'base/platform/platform-posix-time.h',
-              'base/platform/platform-posix-time.cc',
-            ],
-          }
-        ],
-        ['OS=="aix"', {
-          'sources': [
-            'base/debug/stack_trace_posix.cc',
-            'base/platform/platform-aix.cc',
-            'base/platform/platform-posix.h',
-            'base/platform/platform-posix.cc'
-          ]},
-        ],
-        ['OS=="fuchsia"', {
-          'sources': [
-            'base/debug/stack_trace_fuchsia.cc',
-            'base/platform/platform-fuchsia.cc',
-          ]},
-        ],
-        ['OS=="solaris"', {
-            'link_settings': {
-              'libraries': [
-                '-lnsl -lrt',
-            ]},
-            'sources': [
-              'base/debug/stack_trace_posix.cc',
-              'base/platform/platform-solaris.cc',
-              'base/platform/platform-posix.h',
-              'base/platform/platform-posix.cc',
-            ],
-          }
-        ],
-        ['OS=="mac"', {
-          'sources': [
-            'base/debug/stack_trace_posix.cc',
-            'base/platform/platform-macos.cc',
-            'base/platform/platform-posix.h',
-            'base/platform/platform-posix.cc',
-            'base/platform/platform-posix-time.h',
-            'base/platform/platform-posix-time.cc',
-          ]},
-        ],
-        ['OS=="win"', {
-          'defines': [
-            '_CRT_RAND_S'  # for rand_s()
-          ],
-          'variables': {
-            'gyp_generators': '<!(echo $GYP_GENERATORS)',
-          },
-          'conditions': [
-            ['gyp_generators=="make"', {
-              'variables': {
-                'build_env': '<!(uname -o)',
-              },
-              'conditions': [
-                ['build_env=="Cygwin"', {
-                  'sources': [
-                    'base/debug/stack_trace_posix.cc',
-                    'base/platform/platform-cygwin.cc',
-                    'base/platform/platform-posix.h',
-                    'base/platform/platform-posix.cc',
-                  ],
-                }, {
-                  'sources': [
-                    'base/debug/stack_trace_win.cc',
-                    'base/platform/platform-win32.cc',
-                    'base/win32-headers.h',
-                  ],
-                }],
-              ],
-              'link_settings':  {
-                'libraries': [ '-lwinmm', '-lws2_32' ],
-              },
-            }, {
-              'sources': [
-                'base/debug/stack_trace_win.cc',
-                'base/platform/platform-win32.cc',
-                'base/win32-headers.h',
-              ],
-              'msvs_disabled_warnings': [4351, 4355, 4800],
-              'link_settings':  {
-                'libraries': [
-                  '-ldbghelp.lib',
-                  '-lshlwapi.lib',
-                  '-lwinmm.lib',
-                  '-lws2_32.lib'
-                ],
-              },
-            }],
-          ],
-        }],
-      ],
-    },
-    {
-      'target_name': 'v8_libplatform',
-      'type': '<(component)',
-      'variables': {
-        'optimize': 'max',
-      },
-      'dependencies': [
-        'v8_libbase',
-      ],
-      'include_dirs+': [
-        '..',
-        '<(DEPTH)',
-        '../include',
-      ],
-      'sources': [
-        '../include/libplatform/libplatform.h',
-        '../include/libplatform/libplatform-export.h',
-        '../include/libplatform/v8-tracing.h',
-        'libplatform/default-background-task-runner.cc',
-        'libplatform/default-background-task-runner.h',
-        'libplatform/default-foreground-task-runner.cc',
-        'libplatform/default-foreground-task-runner.h',
-        'libplatform/default-platform.cc',
-        'libplatform/default-platform.h',
-        'libplatform/task-queue.cc',
-        'libplatform/task-queue.h',
-        'libplatform/tracing/trace-buffer.cc',
-        'libplatform/tracing/trace-buffer.h',
-        'libplatform/tracing/trace-config.cc',
-        'libplatform/tracing/trace-object.cc',
-        'libplatform/tracing/trace-writer.cc',
-        'libplatform/tracing/trace-writer.h',
-        'libplatform/tracing/tracing-controller.cc',
-        'libplatform/worker-thread.cc',
-        'libplatform/worker-thread.h',
-      ],
-      'conditions': [
-        ['want_separate_host_toolset==1', {
-          'toolsets': ['host', 'target'],
-        }, {
-          'toolsets': ['target'],
-        }],
-        ['component=="shared_library"', {
-          'direct_dependent_settings': {
-            'defines': [ 'USING_V8_PLATFORM_SHARED' ],
-          },
-          'defines': [ 'BUILDING_V8_PLATFORM_SHARED' ],
-        }]
-      ],
-      'direct_dependent_settings': {
-        'include_dirs': [
-          '../include',
-        ],
-      },
-    },
-    {
-      'target_name': 'v8_libsampler',
-      'type': 'static_library',
-      'variables': {
-        'optimize': 'max',
-      },
-      'dependencies': [
-        'v8_libbase',
-      ],
-      'include_dirs+': [
-        '..',
-        '../include',
-      ],
-      'sources': [
-        'libsampler/sampler.cc',
-        'libsampler/sampler.h'
-      ],
-      'conditions': [
-        ['want_separate_host_toolset==1', {
-          'toolsets': ['host', 'target'],
-        }, {
-          'toolsets': ['target'],
-        }],
-      ],
-      'direct_dependent_settings': {
-        'include_dirs': [
-          '../include',
-        ],
-      },
-    },
-    {
-      'target_name': 'natives_blob',
-      'type': 'none',
-      'conditions': [
-        [ 'v8_use_external_startup_data==1', {
-          'conditions': [
-            ['want_separate_host_toolset==1', {
-              'dependencies': ['js2c#host'],
-            }, {
-              'dependencies': ['js2c'],
-            }],
-          ],
-          'actions': [{
-            'action_name': 'concatenate_natives_blob',
-            'inputs': [
-              '../tools/concatenate-files.py',
-              '<(SHARED_INTERMEDIATE_DIR)/libraries.bin',
-              '<(SHARED_INTERMEDIATE_DIR)/libraries-extras.bin',
-              '<(SHARED_INTERMEDIATE_DIR)/libraries-experimental-extras.bin',
-            ],
-            'conditions': [
-              ['want_separate_host_toolset==1', {
-                'target_conditions': [
-                  ['_toolset=="host"', {
-                    'outputs': [
-                      '<(PRODUCT_DIR)/natives_blob_host.bin',
-                    ],
-                    'action': [
-                      'python', '<@(_inputs)', '<(PRODUCT_DIR)/natives_blob_host.bin'
-                    ],
-                  }, {
-                    'outputs': [
-                      '<(PRODUCT_DIR)/natives_blob.bin',
-                    ],
-                    'action': [
-                      'python', '<@(_inputs)', '<(PRODUCT_DIR)/natives_blob.bin'
-                    ],
-                  }],
-                ],
-              }, {
-                'outputs': [
-                  '<(PRODUCT_DIR)/natives_blob.bin',
-                ],
-                'action': [
-                  'python', '<@(_inputs)', '<(PRODUCT_DIR)/natives_blob.bin'
-                ],
-              }],
-            ],
-          }],
-        }],
-        ['want_separate_host_toolset==1', {
-          'toolsets': ['host', 'target'],
-        }, {
-          'toolsets': ['target'],
-        }],
-      ]
-    },
-    {
-      'target_name': 'js2c',
-      'type': 'none',
-      'conditions': [
-        ['want_separate_host_toolset==1', {
-          'toolsets': ['host'],
-        }, {
-          'toolsets': ['target'],
-        }],
-      ],
-      'variables': {
-        'library_files': [
-          'js/macros.py',
-          'messages.h',
-          'js/prologue.js',
-          'js/array.js',
-          'js/typedarray.js',
-          'js/messages.js',
-          'js/spread.js',
-          'debug/mirrors.js',
-          'debug/debug.js',
-          'debug/liveedit.js',
-        ],
-        'libraries_bin_file': '<(SHARED_INTERMEDIATE_DIR)/libraries.bin',
-        'libraries_extras_bin_file': '<(SHARED_INTERMEDIATE_DIR)/libraries-extras.bin',
-        'libraries_experimental_extras_bin_file': '<(SHARED_INTERMEDIATE_DIR)/libraries-experimental-extras.bin',
-        'conditions': [
-          ['v8_enable_i18n_support==1', {
-            'library_files': ['js/intl.js'],
-          }],
-        ],
-      },
-      'actions': [
-        {
-          'action_name': 'js2c',
-          'inputs': [
-            '../tools/js2c.py',
-            '<@(library_files)',
-          ],
-          'outputs': ['<(SHARED_INTERMEDIATE_DIR)/libraries.cc'],
-          'action': [
-            'python',
-            '../tools/js2c.py',
-            '<(SHARED_INTERMEDIATE_DIR)/libraries.cc',
-            'CORE',
-            '<@(library_files)',
-          ],
-        },
-        {
-          'action_name': 'js2c_bin',
-          'inputs': [
-            '../tools/js2c.py',
-            '<@(library_files)',
-          ],
-          'outputs': ['<@(libraries_bin_file)'],
-          'action': [
-            'python',
-            '../tools/js2c.py',
-            '<(SHARED_INTERMEDIATE_DIR)/libraries.cc',
-            'CORE',
-            '<@(library_files)',
-            '--startup_blob', '<@(libraries_bin_file)',
-            '--nojs',
-          ],
-        },
-        {
-          'action_name': 'js2c_extras',
-          'inputs': [
-            '../tools/js2c.py',
-            '<@(v8_extra_library_files)',
-          ],
-          'outputs': ['<(SHARED_INTERMEDIATE_DIR)/extras-libraries.cc'],
-          'action': [
-            'python',
-            '../tools/js2c.py',
-            '<(SHARED_INTERMEDIATE_DIR)/extras-libraries.cc',
-            'EXTRAS',
-            '<@(v8_extra_library_files)',
-          ],
-        },
-        {
-          'action_name': 'js2c_extras_bin',
-          'inputs': [
-            '../tools/js2c.py',
-            '<@(v8_extra_library_files)',
-          ],
-          'outputs': ['<@(libraries_extras_bin_file)'],
-          'action': [
-            'python',
-            '../tools/js2c.py',
-            '<(SHARED_INTERMEDIATE_DIR)/extras-libraries.cc',
-            'EXTRAS',
-            '<@(v8_extra_library_files)',
-            '--startup_blob', '<@(libraries_extras_bin_file)',
-            '--nojs',
-          ],
-        },
-        {
-          'action_name': 'js2c_experimental_extras',
-          'inputs': [
-            '../tools/js2c.py',
-            '<@(v8_experimental_extra_library_files)',
-          ],
-          'outputs': [
-            '<(SHARED_INTERMEDIATE_DIR)/experimental-extras-libraries.cc',
-          ],
-          'action': [
-            'python',
-            '../tools/js2c.py',
-            '<(SHARED_INTERMEDIATE_DIR)/experimental-extras-libraries.cc',
-            'EXPERIMENTAL_EXTRAS',
-            '<@(v8_experimental_extra_library_files)',
-          ],
-        },
-        {
-          'action_name': 'js2c_experimental_extras_bin',
-          'inputs': [
-            '../tools/js2c.py',
-            '<@(v8_experimental_extra_library_files)',
-          ],
-          'outputs': ['<@(libraries_experimental_extras_bin_file)'],
-          'action': [
-            'python',
-            '../tools/js2c.py',
-            '<(SHARED_INTERMEDIATE_DIR)/experimental-extras-libraries.cc',
-            'EXPERIMENTAL_EXTRAS',
-            '<@(v8_experimental_extra_library_files)',
-            '--startup_blob', '<@(libraries_experimental_extras_bin_file)',
-            '--nojs',
-          ],
-        },
-      ],
-    },
-    {
-      'target_name': 'postmortem-metadata',
-      'type': 'none',
-      'variables': {
-        'heapobject_files': [
-            'objects.h',
-            'objects-inl.h',
-            'objects/code.h',
-            'objects/code-inl.h',
-            'objects/fixed-array.h',
-            'objects/fixed-array-inl.h',
-            'objects/js-array.h',
-            'objects/js-array-inl.h',
-            'objects/js-regexp.h',
-            'objects/js-regexp-inl.h',
-            'objects/map.h',
-            'objects/map-inl.h',
-            'objects/script.h',
-            'objects/script-inl.h',
-            'objects/shared-function-info.h',
-            'objects/shared-function-info-inl.h',
-            'objects/string.h',
-            'objects/string-inl.h',
-        ],
-      },
-      'actions': [
-          {
-            'action_name': 'gen-postmortem-metadata',
-            'inputs': [
-              '../tools/gen-postmortem-metadata.py',
-              '<@(heapobject_files)',
-            ],
-            'outputs': [
-              '<(SHARED_INTERMEDIATE_DIR)/debug-support.cc',
-            ],
-            'action': [
-              'python',
-              '../tools/gen-postmortem-metadata.py',
-              '<@(_outputs)',
-              '<@(heapobject_files)'
-            ]
-          }
-        ]
-    },
-    {
-      'target_name': 'mksnapshot',
-      'type': 'executable',
-      'dependencies': [
-        'v8_base',
-        'v8_init',
-        'v8_libbase',
-        'v8_libplatform',
-        'v8_nosnapshot',
-      ],
-      'include_dirs+': [
-        '..',
-        '<(DEPTH)',
-      ],
-      'sources': [
-        'snapshot/mksnapshot.cc',
-      ],
-      'conditions': [
-        ['v8_enable_i18n_support==1', {
-          'dependencies': [
-            '<(icu_gyp_path):icui18n',
-            '<(icu_gyp_path):icuuc',
-          ]
-        }],
-        ['want_separate_host_toolset==1', {
-          'toolsets': ['host'],
-        }, {
-          'toolsets': ['target'],
-        }],
-      ],
-    },
-    {
-      'target_name': 'v8_dump_build_config',
-      'type': 'none',
-      'variables': {
-      },
-      'actions': [
-        {
-          'action_name': 'v8_dump_build_config',
-          'inputs': [
-            '../tools/testrunner/utils/dump_build_config_gyp.py',
-          ],
-          'outputs': [
-            '<(PRODUCT_DIR)/v8_build_config.json',
-          ],
-          'action': [
-            'python',
-            '../tools/testrunner/utils/dump_build_config_gyp.py',
-            '<(PRODUCT_DIR)/v8_build_config.json',
-            'dcheck_always_on=<(dcheck_always_on)',
-            'is_asan=<(asan)',
-            'is_cfi=<(cfi_vptr)',
-            'is_component_build=<(component)',
-            'is_debug=<(CONFIGURATION_NAME)',
-            # Not available in gyp.
-            'is_gcov_coverage=0',
-            'is_msan=<(msan)',
-            'is_tsan=<(tsan)',
-            # Not available in gyp.
-            'is_ubsan_vptr=0',
-            'target_cpu=<(target_arch)',
-            'v8_enable_i18n_support=<(v8_enable_i18n_support)',
-            'v8_enable_verify_predictable=<(v8_enable_verify_predictable)',
-            'v8_target_cpu=<(v8_target_arch)',
-            'v8_use_snapshot=<(v8_use_snapshot)',
-          ],
-        },
-      ],
-    },
-    {
-      'target_name': 'v8_monolith',
-      'type': 'static_library',
-      'direct_dependent_settings': {
-        'include_dirs': [
-          '../include',
-        ],
-      },
-      'actions': [
-        {
-          'action_name': 'build_with_gn',
-          'inputs': [
-            '../tools/node/build_gn.py',
-          ],
-          'outputs': [
-            '<(INTERMEDIATE_DIR)/obj/libv8_monolith.a',
-            '<(INTERMEDIATE_DIR)/args.gn',
-          ],
-          'action': [
-            '../tools/node/build_gn.py',
-            '<(CONFIGURATION_NAME)',
-            '../',
-            '<(INTERMEDIATE_DIR)',
-            'v8_promise_internal_field_count=<(v8_promise_internal_field_count)',
-            'target_cpu="<(target_arch)"',
-            'target_os="<(OS)"',
-            'v8_target_cpu="<(v8_target_arch)"',
-            'v8_embedder_string="<(v8_embedder_string)"',
-            'v8_use_snapshot=<(v8_use_snapshot)',
-            'v8_optimized_debug=<(v8_optimized_debug)',
-            'v8_enable_disassembler=<(v8_enable_disassembler)',
-            'v8_postmortem_support=<(v8_postmortem_support)',
-          ],
-        },
-      ],
-    },
-  ],
-}
diff --git a/deps/v8/src/v8.h b/deps/v8/src/v8.h
index db561b9918d..e5a40cb51fa 100644
--- a/deps/v8/src/v8.h
+++ b/deps/v8/src/v8.h
@@ -5,12 +5,17 @@
 #ifndef V8_V8_H_
 #define V8_V8_H_
 
-#include "include/v8.h"
 #include "src/globals.h"
 
 namespace v8 {
+
+class Platform;
+class StartupData;
+
 namespace internal {
 
+class Isolate;
+
 class V8 : public AllStatic {
  public:
   // Global actions.
@@ -20,8 +25,9 @@ class V8 : public AllStatic {
 
   // Report process out of memory. Implementation found in api.cc.
   // This function will not return, but will terminate the execution.
-  static void FatalProcessOutOfMemory(const char* location,
-                                      bool is_heap_oom = false);
+  [[noreturn]] static void FatalProcessOutOfMemory(Isolate* isolate,
+                                                   const char* location,
+                                                   bool is_heap_oom = false);
 
   static void InitializePlatform(v8::Platform* platform);
   static void ShutdownPlatform();
diff --git a/deps/v8/src/v8memory.h b/deps/v8/src/v8memory.h
index d34bce77464..528de5836c6 100644
--- a/deps/v8/src/v8memory.h
+++ b/deps/v8/src/v8memory.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_MEMORY_H_
-#define V8_MEMORY_H_
+#ifndef V8_V8MEMORY_H_
+#define V8_V8MEMORY_H_
 
 namespace v8 {
 namespace internal {
@@ -76,4 +76,4 @@ class Memory {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_MEMORY_H_
+#endif  // V8_V8MEMORY_H_
diff --git a/deps/v8/src/value-serializer.cc b/deps/v8/src/value-serializer.cc
index 5e2ab19877e..9e84ebd2e1d 100644
--- a/deps/v8/src/value-serializer.cc
+++ b/deps/v8/src/value-serializer.cc
@@ -18,7 +18,7 @@
 #include "src/objects.h"
 #include "src/snapshot/code-serializer.h"
 #include "src/transitions.h"
-#include "src/wasm/module-compiler.h"
+#include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-objects-inl.h"
 #include "src/wasm/wasm-result.h"
 #include "src/wasm/wasm-serialization.h"
@@ -58,6 +58,9 @@ static size_t BytesNeededForVarint(T value) {
   return result;
 }
 
+// Note that some additional tag values are defined in Blink's
+// Source/bindings/core/v8/serialization/SerializationTag.h, which must
+// not clash with values defined here.
 enum class SerializationTag : uint8_t {
   // version:uint32_t (if at beginning of data, sets version > 0)
   kVersion = 0xFF,
@@ -80,6 +83,8 @@ enum class SerializationTag : uint8_t {
   // Number represented as a 64-bit double.
   // Host byte order is used (N.B. this makes the format non-portable).
   kDouble = 'N',
+  // BigInt. Bitfield:uint32_t, then raw digits storage.
+  kBigInt = 'Z',
   // byteLength:uint32_t, then raw data
   kUtf8String = 'S',
   kOneByteString = '"',
@@ -107,6 +112,8 @@ enum class SerializationTag : uint8_t {
   kFalseObject = 'x',
   // Number object. value:double
   kNumberObject = 'n',
+  // BigInt object. Bitfield:uint32_t, then raw digits storage.
+  kBigIntObject = 'z',
   // String object, UTF-8 encoding. byteLength:uint32_t, then raw data.
   kStringObject = 's',
   // Regular expression, UTF-8 encoding. byteLength:uint32_t, raw data,
@@ -161,6 +168,8 @@ enum class ArrayBufferViewTag : uint8_t {
   kUint32Array = 'D',
   kFloat32Array = 'f',
   kFloat64Array = 'F',
+  kBigInt64Array = 'q',
+  kBigUint64Array = 'Q',
   kDataView = '?',
 };
 
@@ -251,6 +260,16 @@ void ValueSerializer::WriteTwoByteString(Vector<const uc16> chars) {
   WriteRawBytes(chars.begin(), chars.length() * sizeof(uc16));
 }
 
+void ValueSerializer::WriteBigIntContents(BigInt* bigint) {
+  uint32_t bitfield = bigint->GetBitfieldForSerialization();
+  int bytelength = BigInt::DigitsByteLengthForBitfield(bitfield);
+  WriteVarint<uint32_t>(bitfield);
+  uint8_t* dest;
+  if (ReserveRawBytes(bytelength).To(&dest)) {
+    bigint->SerializeDigits(dest);
+  }
+}
+
 void ValueSerializer::WriteRawBytes(const void* source, size_t length) {
   uint8_t* dest;
   if (ReserveRawBytes(length).To(&dest)) {
@@ -338,6 +357,9 @@ Maybe<bool> ValueSerializer::WriteObject(Handle<Object> object) {
     case MUTABLE_HEAP_NUMBER_TYPE:
       WriteHeapNumber(HeapNumber::cast(*object));
       return ThrowIfOutOfMemory();
+    case BIGINT_TYPE:
+      WriteBigInt(BigInt::cast(*object));
+      return ThrowIfOutOfMemory();
     case JS_TYPED_ARRAY_TYPE:
     case JS_DATA_VIEW_TYPE: {
       // Despite being JSReceivers, these have their wrapped buffer serialized
@@ -401,6 +423,11 @@ void ValueSerializer::WriteHeapNumber(HeapNumber* number) {
   WriteDouble(number->value());
 }
 
+void ValueSerializer::WriteBigInt(BigInt* bigint) {
+  WriteTag(SerializationTag::kBigInt);
+  WriteBigIntContents(bigint);
+}
+
 void ValueSerializer::WriteString(Handle<String> string) {
   string = String::Flatten(string);
   DisallowHeapAllocation no_gc;
@@ -685,6 +712,9 @@ Maybe<bool> ValueSerializer::WriteJSValue(Handle<JSValue> value) {
   } else if (inner_value->IsNumber()) {
     WriteTag(SerializationTag::kNumberObject);
     WriteDouble(inner_value->Number());
+  } else if (inner_value->IsBigInt()) {
+    WriteTag(SerializationTag::kBigIntObject);
+    WriteBigIntContents(BigInt::cast(inner_value));
   } else if (inner_value->IsString()) {
     WriteTag(SerializationTag::kStringObject);
     WriteString(handle(String::cast(inner_value), isolate_));
@@ -1084,13 +1114,13 @@ bool ValueDeserializer::ReadRawBytes(size_t length, const void** data) {
 void ValueDeserializer::TransferArrayBuffer(
     uint32_t transfer_id, Handle<JSArrayBuffer> array_buffer) {
   if (array_buffer_transfer_map_.is_null()) {
-    array_buffer_transfer_map_ =
-        isolate_->global_handles()->Create(*NumberDictionary::New(isolate_, 0));
+    array_buffer_transfer_map_ = isolate_->global_handles()->Create(
+        *SimpleNumberDictionary::New(isolate_, 0));
   }
-  Handle<NumberDictionary> dictionary =
+  Handle<SimpleNumberDictionary> dictionary =
       array_buffer_transfer_map_.ToHandleChecked();
-  Handle<NumberDictionary> new_dictionary =
-      NumberDictionary::Set(dictionary, transfer_id, array_buffer);
+  Handle<SimpleNumberDictionary> new_dictionary =
+      SimpleNumberDictionary::Set(dictionary, transfer_id, array_buffer);
   if (!new_dictionary.is_identical_to(dictionary)) {
     GlobalHandles::Destroy(Handle<Object>::cast(dictionary).location());
     array_buffer_transfer_map_ =
@@ -1152,6 +1182,8 @@ MaybeHandle<Object> ValueDeserializer::ReadObjectInternal() {
       if (number.IsNothing()) return MaybeHandle<Object>();
       return isolate_->factory()->NewNumber(number.FromJust(), pretenure_);
     }
+    case SerializationTag::kBigInt:
+      return ReadBigInt();
     case SerializationTag::kUtf8String:
       return ReadUtf8String();
     case SerializationTag::kOneByteString:
@@ -1174,6 +1206,7 @@ MaybeHandle<Object> ValueDeserializer::ReadObjectInternal() {
     case SerializationTag::kTrueObject:
     case SerializationTag::kFalseObject:
     case SerializationTag::kNumberObject:
+    case SerializationTag::kBigIntObject:
     case SerializationTag::kStringObject:
       return ReadJSValue(tag);
     case SerializationTag::kRegExp:
@@ -1182,15 +1215,16 @@ MaybeHandle<Object> ValueDeserializer::ReadObjectInternal() {
       return ReadJSMap();
     case SerializationTag::kBeginJSSet:
       return ReadJSSet();
-    case SerializationTag::kArrayBuffer:
-      return ReadJSArrayBuffer();
-    case SerializationTag::kArrayBufferTransfer: {
+    case SerializationTag::kArrayBuffer: {
       const bool is_shared = false;
-      return ReadTransferredJSArrayBuffer(is_shared);
+      return ReadJSArrayBuffer(is_shared);
+    }
+    case SerializationTag::kArrayBufferTransfer: {
+      return ReadTransferredJSArrayBuffer();
     }
     case SerializationTag::kSharedArrayBuffer: {
       const bool is_shared = true;
-      return ReadTransferredJSArrayBuffer(is_shared);
+      return ReadJSArrayBuffer(is_shared);
     }
     case SerializationTag::kWasmModule:
       return ReadWasmModule();
@@ -1220,6 +1254,19 @@ MaybeHandle<String> ValueDeserializer::ReadString() {
   return Handle<String>::cast(object);
 }
 
+MaybeHandle<BigInt> ValueDeserializer::ReadBigInt() {
+  if (!FLAG_harmony_bigint) return MaybeHandle<BigInt>();
+  uint32_t bitfield;
+  if (!ReadVarint<uint32_t>().To(&bitfield)) return MaybeHandle<BigInt>();
+  int bytelength = BigInt::DigitsByteLengthForBitfield(bitfield);
+  Vector<const uint8_t> digits_storage;
+  if (!ReadRawBytes(bytelength).To(&digits_storage)) {
+    return MaybeHandle<BigInt>();
+  }
+  return BigInt::FromSerializedDigits(isolate_, bitfield, digits_storage,
+                                      pretenure_);
+}
+
 MaybeHandle<String> ValueDeserializer::ReadUtf8String() {
   uint32_t utf8_length;
   Vector<const uint8_t> utf8_bytes;
@@ -1461,6 +1508,14 @@ MaybeHandle<JSValue> ValueDeserializer::ReadJSValue(SerializationTag tag) {
       value->set_value(*number_object);
       break;
     }
+    case SerializationTag::kBigIntObject: {
+      Handle<BigInt> bigint;
+      if (!ReadBigInt().ToHandle(&bigint)) return MaybeHandle<JSValue>();
+      value = Handle<JSValue>::cast(isolate_->factory()->NewJSObject(
+          isolate_->bigint_function(), pretenure_));
+      value->set_value(*bigint);
+      break;
+    }
     case SerializationTag::kStringObject: {
       Handle<String> string;
       if (!ReadString().ToHandle(&string)) return MaybeHandle<JSValue>();
@@ -1572,8 +1627,25 @@ MaybeHandle<JSSet> ValueDeserializer::ReadJSSet() {
   return scope.CloseAndEscape(set);
 }
 
-MaybeHandle<JSArrayBuffer> ValueDeserializer::ReadJSArrayBuffer() {
+MaybeHandle<JSArrayBuffer> ValueDeserializer::ReadJSArrayBuffer(
+    bool is_shared) {
   uint32_t id = next_id_++;
+  if (is_shared) {
+    uint32_t clone_id;
+    Local<SharedArrayBuffer> sab_value;
+    if (!ReadVarint<uint32_t>().To(&clone_id) || delegate_ == nullptr ||
+        !delegate_
+             ->GetSharedArrayBufferFromId(
+                 reinterpret_cast<v8::Isolate*>(isolate_), clone_id)
+             .ToLocal(&sab_value)) {
+      RETURN_EXCEPTION_IF_SCHEDULED_EXCEPTION(isolate_, JSArrayBuffer);
+      return MaybeHandle<JSArrayBuffer>();
+    }
+    Handle<JSArrayBuffer> array_buffer = Utils::OpenHandle(*sab_value);
+    DCHECK_EQ(is_shared, array_buffer->is_shared());
+    AddObjectWithID(id, array_buffer);
+    return array_buffer;
+  }
   uint32_t byte_length;
   if (!ReadVarint<uint32_t>().To(&byte_length) ||
       byte_length > static_cast<size_t>(end_ - position_)) {
@@ -1592,22 +1664,20 @@ MaybeHandle<JSArrayBuffer> ValueDeserializer::ReadJSArrayBuffer() {
   return array_buffer;
 }
 
-MaybeHandle<JSArrayBuffer> ValueDeserializer::ReadTransferredJSArrayBuffer(
-    bool is_shared) {
+MaybeHandle<JSArrayBuffer> ValueDeserializer::ReadTransferredJSArrayBuffer() {
   uint32_t id = next_id_++;
   uint32_t transfer_id;
-  Handle<NumberDictionary> transfer_map;
+  Handle<SimpleNumberDictionary> transfer_map;
   if (!ReadVarint<uint32_t>().To(&transfer_id) ||
       !array_buffer_transfer_map_.ToHandle(&transfer_map)) {
     return MaybeHandle<JSArrayBuffer>();
   }
   int index = transfer_map->FindEntry(isolate_, transfer_id);
-  if (index == NumberDictionary::kNotFound) {
+  if (index == SimpleNumberDictionary::kNotFound) {
     return MaybeHandle<JSArrayBuffer>();
   }
   Handle<JSArrayBuffer> array_buffer(
       JSArrayBuffer::cast(transfer_map->ValueAt(index)), isolate_);
-  DCHECK_EQ(is_shared, array_buffer->is_shared());
   AddObjectWithID(id, array_buffer);
   return array_buffer;
 }
@@ -1628,6 +1698,16 @@ MaybeHandle<JSArrayBufferView> ValueDeserializer::ReadJSArrayBufferView(
   uint32_t id = next_id_++;
   ExternalArrayType external_array_type = kExternalInt8Array;
   unsigned element_size = 0;
+
+  if (!FLAG_harmony_bigint) {
+    // Refuse to construct BigInt64Arrays unless the flag is on.
+    ArrayBufferViewTag cast_tag = static_cast<ArrayBufferViewTag>(tag);
+    if (cast_tag == ArrayBufferViewTag::kBigInt64Array ||
+        cast_tag == ArrayBufferViewTag::kBigUint64Array) {
+      return MaybeHandle<JSArrayBufferView>();
+    }
+  }
+
   switch (static_cast<ArrayBufferViewTag>(tag)) {
     case ArrayBufferViewTag::kDataView: {
       Handle<JSDataView> data_view =
@@ -1714,8 +1794,8 @@ MaybeHandle<JSObject> ValueDeserializer::ReadWasmModule() {
   }
   if (result.is_null()) {
     wasm::ErrorThrower thrower(isolate_, "ValueDeserializer::ReadWasmModule");
-    result = wasm::SyncCompile(isolate_, &thrower,
-                               wasm::ModuleWireBytes(wire_bytes));
+    result = isolate_->wasm_engine()->SyncCompile(
+        isolate_, &thrower, wasm::ModuleWireBytes(wire_bytes));
   }
   RETURN_EXCEPTION_IF_SCHEDULED_EXCEPTION(isolate_, JSObject);
   uint32_t id = next_id_++;
@@ -1744,7 +1824,7 @@ MaybeHandle<WasmMemoryObject> ValueDeserializer::ReadWasmMemory() {
 
   const bool is_shared = true;
   Handle<JSArrayBuffer> buffer;
-  if (!ReadTransferredJSArrayBuffer(is_shared).ToHandle(&buffer)) {
+  if (!ReadJSArrayBuffer(is_shared).ToHandle(&buffer)) {
     return MaybeHandle<WasmMemoryObject>();
   }
 
@@ -1833,9 +1913,9 @@ Maybe<uint32_t> ValueDeserializer::ReadJSObjectProperties(
           key =
               isolate_->factory()->InternalizeString(Handle<String>::cast(key));
           // Don't reuse |transitions| because it could be stale.
-          target = TransitionsAccessor(map).FindTransitionToField(
-              Handle<String>::cast(key));
-          transitioning = !target.is_null();
+          transitioning = TransitionsAccessor(map)
+                              .FindTransitionToField(Handle<String>::cast(key))
+                              .ToHandle(&target);
         } else {
           transitioning = false;
         }
diff --git a/deps/v8/src/value-serializer.h b/deps/v8/src/value-serializer.h
index a272fa0945a..4078ef05580 100644
--- a/deps/v8/src/value-serializer.h
+++ b/deps/v8/src/value-serializer.h
@@ -19,6 +19,7 @@
 namespace v8 {
 namespace internal {
 
+class BigInt;
 class HeapNumber;
 class Isolate;
 class JSArrayBuffer;
@@ -107,12 +108,14 @@ class ValueSerializer {
   void WriteZigZag(T value);
   void WriteOneByteString(Vector<const uint8_t> chars);
   void WriteTwoByteString(Vector<const uc16> chars);
+  void WriteBigIntContents(BigInt* bigint);
   Maybe<uint8_t*> ReserveRawBytes(size_t bytes);
 
   // Writing V8 objects of various kinds.
   void WriteOddball(Oddball* oddball);
   void WriteSmi(Smi* smi);
   void WriteHeapNumber(HeapNumber* number);
+  void WriteBigInt(BigInt* bigint);
   void WriteString(Handle<String> string);
   Maybe<bool> WriteJSReceiver(Handle<JSReceiver> receiver) WARN_UNUSED_RESULT;
   Maybe<bool> WriteJSObject(Handle<JSObject> object) WARN_UNUSED_RESULT;
@@ -255,6 +258,7 @@ class ValueDeserializer {
 
   // Reading V8 objects of specific kinds.
   // The tag is assumed to have already been read.
+  MaybeHandle<BigInt> ReadBigInt() WARN_UNUSED_RESULT;
   MaybeHandle<String> ReadUtf8String() WARN_UNUSED_RESULT;
   MaybeHandle<String> ReadOneByteString() WARN_UNUSED_RESULT;
   MaybeHandle<String> ReadTwoByteString() WARN_UNUSED_RESULT;
@@ -266,8 +270,9 @@ class ValueDeserializer {
   MaybeHandle<JSRegExp> ReadJSRegExp() WARN_UNUSED_RESULT;
   MaybeHandle<JSMap> ReadJSMap() WARN_UNUSED_RESULT;
   MaybeHandle<JSSet> ReadJSSet() WARN_UNUSED_RESULT;
-  MaybeHandle<JSArrayBuffer> ReadJSArrayBuffer() WARN_UNUSED_RESULT;
-  MaybeHandle<JSArrayBuffer> ReadTransferredJSArrayBuffer(bool is_shared)
+  MaybeHandle<JSArrayBuffer> ReadJSArrayBuffer(bool is_shared)
+      WARN_UNUSED_RESULT;
+  MaybeHandle<JSArrayBuffer> ReadTransferredJSArrayBuffer()
       WARN_UNUSED_RESULT;
   MaybeHandle<JSArrayBufferView> ReadJSArrayBufferView(
       Handle<JSArrayBuffer> buffer) WARN_UNUSED_RESULT;
@@ -300,7 +305,7 @@ class ValueDeserializer {
 
   // Always global handles.
   Handle<FixedArray> id_map_;
-  MaybeHandle<NumberDictionary> array_buffer_transfer_map_;
+  MaybeHandle<SimpleNumberDictionary> array_buffer_transfer_map_;
 
   DISALLOW_COPY_AND_ASSIGN(ValueDeserializer);
 };
diff --git a/deps/v8/src/version.h b/deps/v8/src/version.h
index 20d9c71fe76..93b3eb902dc 100644
--- a/deps/v8/src/version.h
+++ b/deps/v8/src/version.h
@@ -5,12 +5,16 @@
 #ifndef V8_VERSION_H_
 #define V8_VERSION_H_
 
+#include <cstdint>
+
 #include "src/base/functional.h"
-#include "src/vector.h"
 
 namespace v8 {
 namespace internal {
 
+template <typename T>
+class Vector;
+
 class Version {
  public:
   // Return the various version components.
diff --git a/deps/v8/src/visitors.cc b/deps/v8/src/visitors.cc
index 98911f1c283..a877fc30ef0 100644
--- a/deps/v8/src/visitors.cc
+++ b/deps/v8/src/visitors.cc
@@ -9,16 +9,19 @@
 namespace v8 {
 namespace internal {
 
-#define DECLARE_TAG(ignore1, name, ignore2) name,
-const char* const
-    VisitorSynchronization::kTags[VisitorSynchronization::kNumberOfSyncTags] = {
-        ROOT_ID_LIST(DECLARE_TAG)};
-#undef DECLARE_TAG
-
-#define DECLARE_TAG(ignore1, ignore2, name) name,
-const char* const VisitorSynchronization::kTagNames
-    [VisitorSynchronization::kNumberOfSyncTags] = {ROOT_ID_LIST(DECLARE_TAG)};
-#undef DECLARE_TAG
+const char* RootVisitor::RootName(Root root) {
+  switch (root) {
+#define ROOT_CASE(root_id, description) \
+  case Root::root_id:                   \
+    return description;
+    ROOT_ID_LIST(ROOT_CASE)
+#undef ROOT_CASE
+    case Root::kNumberOfRoots:
+      break;
+  }
+  UNREACHABLE();
+  return nullptr;
+}
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/visitors.h b/deps/v8/src/visitors.h
index 7696df8faf9..f242f3c044f 100644
--- a/deps/v8/src/visitors.h
+++ b/deps/v8/src/visitors.h
@@ -11,47 +11,45 @@ namespace v8 {
 namespace internal {
 
 class CodeDataContainer;
+class MaybeObject;
 class Object;
 
-#define ROOT_ID_LIST(V)                                                    \
-  V(kStringTable, "string_table", "(Internalized strings)")                \
-  V(kExternalStringsTable, "external_strings_table", "(External strings)") \
-  V(kStrongRootList, "strong_root_list", "(Strong roots)")                 \
-  V(kSmiRootList, "smi_root_list", "(Smi roots)")                          \
-  V(kBootstrapper, "bootstrapper", "(Bootstrapper)")                       \
-  V(kTop, "top", "(Isolate)")                                              \
-  V(kRelocatable, "relocatable", "(Relocatable)")                          \
-  V(kDebug, "debug", "(Debugger)")                                         \
-  V(kCompilationCache, "compilationcache", "(Compilation cache)")          \
-  V(kHandleScope, "handlescope", "(Handle scope)")                         \
-  V(kDispatchTable, "dispatchtable", "(Dispatch table)")                   \
-  V(kBuiltins, "builtins", "(Builtins)")                                   \
-  V(kGlobalHandles, "globalhandles", "(Global handles)")                   \
-  V(kEternalHandles, "eternalhandles", "(Eternal handles)")                \
-  V(kThreadManager, "threadmanager", "(Thread manager)")                   \
-  V(kStrongRoots, "strong roots", "(Strong roots)")                        \
-  V(kExtensions, "Extensions", "(Extensions)")
+#define ROOT_ID_LIST(V)                                \
+  V(kStringTable, "(Internalized strings)")            \
+  V(kExternalStringsTable, "(External strings)")       \
+  V(kStrongRootList, "(Strong roots)")                 \
+  V(kSmiRootList, "(Smi roots)")                       \
+  V(kBootstrapper, "(Bootstrapper)")                   \
+  V(kTop, "(Isolate)")                                 \
+  V(kRelocatable, "(Relocatable)")                     \
+  V(kDebug, "(Debugger)")                              \
+  V(kCompilationCache, "(Compilation cache)")          \
+  V(kHandleScope, "(Handle scope)")                    \
+  V(kDispatchTable, "(Dispatch table)")                \
+  V(kBuiltins, "(Builtins)")                           \
+  V(kGlobalHandles, "(Global handles)")                \
+  V(kEternalHandles, "(Eternal handles)")              \
+  V(kThreadManager, "(Thread manager)")                \
+  V(kStrongRoots, "(Strong roots)")                    \
+  V(kExtensions, "(Extensions)")                       \
+  V(kCodeFlusher, "(Code flusher)")                    \
+  V(kPartialSnapshotCache, "(Partial snapshot cache)") \
+  V(kWeakCollections, "(Weak collections)")            \
+  V(kWrapperTracing, "(Wrapper tracing)")              \
+  V(kUnknown, "(Unknown)")
 
 class VisitorSynchronization : public AllStatic {
  public:
-#define DECLARE_ENUM(enum_item, ignore1, ignore2) enum_item,
+#define DECLARE_ENUM(enum_item, ignore) enum_item,
   enum SyncTag { ROOT_ID_LIST(DECLARE_ENUM) kNumberOfSyncTags };
 #undef DECLARE_ENUM
-
-  static const char* const kTags[kNumberOfSyncTags];
-  static const char* const kTagNames[kNumberOfSyncTags];
 };
 
 enum class Root {
-#define DECLARE_ENUM(enum_item, ignore1, ignore2) enum_item,
+#define DECLARE_ENUM(enum_item, ignore) enum_item,
   ROOT_ID_LIST(DECLARE_ENUM)
 #undef DECLARE_ENUM
-  // TODO(ulan): Merge with the ROOT_ID_LIST.
-  kCodeFlusher,
-  kPartialSnapshotCache,
-  kWeakCollections,
-  kWrapperTracing,
-  kUnknown
+      kNumberOfRoots
 };
 
 // Abstract base class for visiting, and optionally modifying, the
@@ -62,11 +60,13 @@ class RootVisitor BASE_EMBEDDED {
 
   // Visits a contiguous arrays of pointers in the half-open range
   // [start, end). Any or all of the values may be modified on return.
-  virtual void VisitRootPointers(Root root, Object** start, Object** end) = 0;
+  virtual void VisitRootPointers(Root root, const char* description,
+                                 Object** start, Object** end) = 0;
 
   // Handy shorthand for visiting a single pointer.
-  virtual void VisitRootPointer(Root root, Object** p) {
-    VisitRootPointers(root, p, p + 1);
+  virtual void VisitRootPointer(Root root, const char* description,
+                                Object** p) {
+    VisitRootPointers(root, description, p, p + 1);
   }
 
   // Intended for serialization/deserialization checking: insert, or
@@ -74,6 +74,8 @@ class RootVisitor BASE_EMBEDDED {
   // Also used for marking up GC roots in heap snapshots.
   // TODO(ulan): Remove this.
   virtual void Synchronize(VisitorSynchronization::SyncTag tag) {}
+
+  static const char* RootName(Root root);
 };
 
 // Abstract base class for visiting, and optionally modifying, the
@@ -86,11 +88,16 @@ class ObjectVisitor BASE_EMBEDDED {
   // [start, end). Any or all of the values may be modified on return.
   virtual void VisitPointers(HeapObject* host, Object** start,
                              Object** end) = 0;
+  virtual void VisitPointers(HeapObject* host, MaybeObject** start,
+                             MaybeObject** end) = 0;
 
   // Handy shorthand for visiting a single pointer.
   virtual void VisitPointer(HeapObject* host, Object** p) {
     VisitPointers(host, p, p + 1);
   }
+  virtual void VisitPointer(HeapObject* host, MaybeObject** p) {
+    VisitPointers(host, p, p + 1);
+  }
 
   // To allow lazy clearing of inline caches the visitor has
   // a rich interface for iterating over Code objects ...
@@ -112,6 +119,9 @@ class ObjectVisitor BASE_EMBEDDED {
 
   // Visits an (encoded) internal reference.
   virtual void VisitInternalReference(Code* host, RelocInfo* rinfo) {}
+
+  // Visits an off-heap target in the instruction stream.
+  virtual void VisitOffHeapTarget(Code* host, RelocInfo* rinfo) {}
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/wasm/OWNERS b/deps/v8/src/wasm/OWNERS
index e68fb0847d6..5e51225ab02 100644
--- a/deps/v8/src/wasm/OWNERS
+++ b/deps/v8/src/wasm/OWNERS
@@ -2,12 +2,13 @@ set noparent
 
 ahaas@chromium.org
 bbudge@chromium.org
+binji@chromium.org
 bradnelson@chromium.org
 clemensh@chromium.org
-gdeepti@chromium.org
 eholk@chromium.org
-mtrofin@chromium.org
-rossberg@chromium.org
+gdeepti@chromium.org
+kschimpf@chromium.org
+mstarzinger@chromium.org
 titzer@chromium.org
 
 # COMPONENT: Blink>JavaScript>WebAssembly
diff --git a/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h b/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h
index 7f7993d34fb..6ea4253cd35 100644
--- a/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h
+++ b/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h
@@ -2,86 +2,130 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_ARM_H_
-#define V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_ARM_H_
+#ifndef V8_WASM_BASELINE_ARM_LIFTOFF_ASSEMBLER_ARM_H_
+#define V8_WASM_BASELINE_ARM_LIFTOFF_ASSEMBLER_ARM_H_
 
 #include "src/wasm/baseline/liftoff-assembler.h"
 
+#define BAILOUT(reason) bailout("arm " reason)
+
 namespace v8 {
 namespace internal {
 namespace wasm {
 
-void LiftoffAssembler::ReserveStackSpace(uint32_t bytes) { UNIMPLEMENTED(); }
+uint32_t LiftoffAssembler::PrepareStackFrame() {
+  BAILOUT("PrepareStackFrame");
+  return 0;
+}
+
+void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+                                              uint32_t stack_slots) {
+  BAILOUT("PatchPrepareStackFrame");
+}
 
-void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
+                                    RelocInfo::Mode rmode) {
+  BAILOUT("LoadConstant");
 }
 
 void LiftoffAssembler::LoadFromContext(Register dst, uint32_t offset,
                                        int size) {
-  UNIMPLEMENTED();
+  BAILOUT("LoadFromContext");
 }
 
-void LiftoffAssembler::SpillContext(Register context) { UNIMPLEMENTED(); }
+void LiftoffAssembler::SpillContext(Register context) {
+  BAILOUT("SpillContext");
+}
 
-void LiftoffAssembler::FillContextInto(Register dst) { UNIMPLEMENTED(); }
+void LiftoffAssembler::FillContextInto(Register dst) {
+  BAILOUT("FillContextInto");
+}
 
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
                             uint32_t* protected_load_pc) {
-  UNIMPLEMENTED();
+  BAILOUT("Load");
 }
 
 void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
                              uint32_t* protected_store_pc) {
-  UNIMPLEMENTED();
+  BAILOUT("Store");
 }
 
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
-                                           uint32_t caller_slot_idx) {
-  UNIMPLEMENTED();
+                                           uint32_t caller_slot_idx,
+                                           ValueType type) {
+  BAILOUT("LoadCallerFrameSlot");
+}
+
+void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+                                      ValueType type) {
+  BAILOUT("MoveStackValue");
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
+                                            ValueType type) {
+  BAILOUT("MoveToReturnRegister");
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
+  BAILOUT("Move Register");
 }
 
-void LiftoffAssembler::Move(LiftoffRegister dst, LiftoffRegister src) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
+                            ValueType type) {
+  BAILOUT("Move DoubleRegister");
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
+                             ValueType type) {
+  BAILOUT("Spill register");
 }
 
 void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
-  UNIMPLEMENTED();
+  BAILOUT("Spill value");
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
+                            ValueType type) {
+  BAILOUT("Fill");
+}
+
+void LiftoffAssembler::FillI64Half(Register, uint32_t half_index) {
+  BAILOUT("FillI64Half");
 }
 
 #define UNIMPLEMENTED_GP_BINOP(name)                             \
   void LiftoffAssembler::emit_##name(Register dst, Register lhs, \
                                      Register rhs) {             \
-    UNIMPLEMENTED();                                             \
+    BAILOUT("gp binop: " #name);                                 \
   }
 #define UNIMPLEMENTED_GP_UNOP(name)                                \
   bool LiftoffAssembler::emit_##name(Register dst, Register src) { \
-    UNIMPLEMENTED();                                               \
+    BAILOUT("gp unop: " #name);                                    \
+    return true;                                                   \
   }
 #define UNIMPLEMENTED_FP_BINOP(name)                                         \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister lhs, \
                                      DoubleRegister rhs) {                   \
-    UNIMPLEMENTED();                                                         \
+    BAILOUT("fp binop: " #name);                                             \
+  }
+#define UNIMPLEMENTED_FP_UNOP(name)                                            \
+  void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
+    BAILOUT("fp unop: " #name);                                                \
+  }
+#define UNIMPLEMENTED_I32_SHIFTOP(name)                                        \
+  void LiftoffAssembler::emit_##name(Register dst, Register src,               \
+                                     Register amount, LiftoffRegList pinned) { \
+    BAILOUT("i32 shiftop: " #name);                                            \
+  }
+#define UNIMPLEMENTED_I64_SHIFTOP(name)                                        \
+  void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
+                                     Register amount, LiftoffRegList pinned) { \
+    BAILOUT("i64 shiftop: " #name);                                            \
   }
 
 UNIMPLEMENTED_GP_BINOP(i32_add)
@@ -90,10 +134,12 @@ UNIMPLEMENTED_GP_BINOP(i32_mul)
 UNIMPLEMENTED_GP_BINOP(i32_and)
 UNIMPLEMENTED_GP_BINOP(i32_or)
 UNIMPLEMENTED_GP_BINOP(i32_xor)
-UNIMPLEMENTED_GP_BINOP(i32_shl)
-UNIMPLEMENTED_GP_BINOP(i32_sar)
-UNIMPLEMENTED_GP_BINOP(i32_shr)
-UNIMPLEMENTED_GP_UNOP(i32_eqz)
+UNIMPLEMENTED_I32_SHIFTOP(i32_shl)
+UNIMPLEMENTED_I32_SHIFTOP(i32_sar)
+UNIMPLEMENTED_I32_SHIFTOP(i32_shr)
+UNIMPLEMENTED_I64_SHIFTOP(i64_shl)
+UNIMPLEMENTED_I64_SHIFTOP(i64_sar)
+UNIMPLEMENTED_I64_SHIFTOP(i64_shr)
 UNIMPLEMENTED_GP_UNOP(i32_clz)
 UNIMPLEMENTED_GP_UNOP(i32_ctz)
 UNIMPLEMENTED_GP_UNOP(i32_popcnt)
@@ -101,81 +147,152 @@ UNIMPLEMENTED_GP_BINOP(ptrsize_add)
 UNIMPLEMENTED_FP_BINOP(f32_add)
 UNIMPLEMENTED_FP_BINOP(f32_sub)
 UNIMPLEMENTED_FP_BINOP(f32_mul)
+UNIMPLEMENTED_FP_BINOP(f32_div)
+UNIMPLEMENTED_FP_UNOP(f32_abs)
+UNIMPLEMENTED_FP_UNOP(f32_neg)
+UNIMPLEMENTED_FP_UNOP(f32_sqrt)
+UNIMPLEMENTED_FP_BINOP(f64_add)
+UNIMPLEMENTED_FP_BINOP(f64_sub)
+UNIMPLEMENTED_FP_BINOP(f64_mul)
+UNIMPLEMENTED_FP_BINOP(f64_div)
+UNIMPLEMENTED_FP_UNOP(f64_abs)
+UNIMPLEMENTED_FP_UNOP(f64_neg)
+UNIMPLEMENTED_FP_UNOP(f64_sqrt)
 
 #undef UNIMPLEMENTED_GP_BINOP
 #undef UNIMPLEMENTED_GP_UNOP
 #undef UNIMPLEMENTED_FP_BINOP
+#undef UNIMPLEMENTED_FP_UNOP
+#undef UNIMPLEMENTED_I32_SHIFTOP
+#undef UNIMPLEMENTED_I64_SHIFTOP
+
+bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
+                                            LiftoffRegister dst,
+                                            LiftoffRegister src) {
+  BAILOUT("emit_type_conversion");
+  return true;
+}
+
+void LiftoffAssembler::emit_jump(Label* label) { BAILOUT("emit_jump"); }
+
+void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label,
+                                      ValueType type, Register lhs,
+                                      Register rhs) {
+  BAILOUT("emit_cond_jump");
+}
+
+void LiftoffAssembler::emit_i32_eqz(Register dst, Register src) {
+  BAILOUT("emit_i32_eqz");
+}
 
-void LiftoffAssembler::emit_i32_test(Register reg) { UNIMPLEMENTED(); }
+void LiftoffAssembler::emit_i32_set_cond(Condition cond, Register dst,
+                                         Register lhs, Register rhs) {
+  BAILOUT("emit_i32_set_cond");
+}
 
-void LiftoffAssembler::emit_i32_compare(Register lhs, Register rhs) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::emit_i64_eqz(Register dst, LiftoffRegister src) {
+  BAILOUT("emit_i64_eqz");
 }
 
-void LiftoffAssembler::emit_jump(Label* label) { UNIMPLEMENTED(); }
+void LiftoffAssembler::emit_i64_set_cond(Condition cond, Register dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  BAILOUT("emit_i64_set_cond");
+}
 
-void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::emit_f32_set_cond(Condition cond, Register dst,
+                                         DoubleRegister lhs,
+                                         DoubleRegister rhs) {
+  BAILOUT("emit_f32_set_cond");
 }
 
-void LiftoffAssembler::StackCheck(Label* ool_code) { UNIMPLEMENTED(); }
+void LiftoffAssembler::StackCheck(Label* ool_code) { BAILOUT("StackCheck"); }
 
-void LiftoffAssembler::CallTrapCallbackForTesting() { UNIMPLEMENTED(); }
+void LiftoffAssembler::CallTrapCallbackForTesting() {
+  BAILOUT("CallTrapCallbackForTesting");
+}
 
 void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
-  UNIMPLEMENTED();
+  BAILOUT("AssertUnreachable");
 }
 
 void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index) {
-  UNIMPLEMENTED();
+                                           uint32_t src_index,
+                                           RegPairHalf half) {
+  BAILOUT("PushCallerFrameSlot");
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
+                                           ValueType type) {
+  BAILOUT("PushCallerFrameSlot reg");
 }
 
-void LiftoffAssembler::PushRegisters(LiftoffRegList regs) { UNIMPLEMENTED(); }
+void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
+  BAILOUT("PushRegisters");
+}
 
-void LiftoffAssembler::PopRegisters(LiftoffRegList regs) { UNIMPLEMENTED(); }
+void LiftoffAssembler::PopRegisters(LiftoffRegList regs) {
+  BAILOUT("PopRegisters");
+}
 
 void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
-  UNIMPLEMENTED();
+  BAILOUT("DropStackSlotsAndRet");
 }
 
-void LiftoffAssembler::PrepareCCall(uint32_t num_params, const Register* args) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
+                                    const LiftoffRegister* args,
+                                    ValueType out_argument_type) {
+  BAILOUT("PrepareCCall");
 }
 
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, uint32_t param_idx,
-                                            uint32_t num_params) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
+                                            ValueType type) {
+  BAILOUT("SetCCallRegParamAddr");
 }
 
-void LiftoffAssembler::SetCCallStackParamAddr(uint32_t stack_param_idx,
-                                              uint32_t param_idx,
-                                              uint32_t num_params) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
+                                              int param_byte_offset,
+                                              ValueType type) {
+  BAILOUT("SetCCallStackParamAddr");
+}
+
+void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
+                                            int param_byte_offset) {
+  BAILOUT("LoadCCallOutArgument");
 }
 
 void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
-  UNIMPLEMENTED();
+  BAILOUT("CallC");
 }
 
-void LiftoffAssembler::CallNativeWasmCode(Address addr) { UNIMPLEMENTED(); }
+void LiftoffAssembler::FinishCCall() { BAILOUT("FinishCCall"); }
+
+void LiftoffAssembler::CallNativeWasmCode(Address addr) {
+  BAILOUT("CallNativeWasmCode");
+}
 
 void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
-  UNIMPLEMENTED();
+  BAILOUT("CallRuntime");
+}
+
+void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
+                                    compiler::CallDescriptor* call_descriptor,
+                                    Register target) {
+  BAILOUT("CallIndirect");
 }
 
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
-  UNIMPLEMENTED();
+  BAILOUT("AllocateStackSlot");
 }
 
-void LiftoffAssembler::DeallocateStackSlot(uint32_t size) { UNIMPLEMENTED(); }
+void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
+  BAILOUT("DeallocateStackSlot");
+}
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_ARM_H_
+#undef BAILOUT
+
+#endif  // V8_WASM_BASELINE_ARM_LIFTOFF_ASSEMBLER_ARM_H_
diff --git a/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h b/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
index 8d28c2b21c2..9a479f7a631 100644
--- a/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
+++ b/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
@@ -2,86 +2,130 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_ARM64_H_
-#define V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_ARM64_H_
+#ifndef V8_WASM_BASELINE_ARM64_LIFTOFF_ASSEMBLER_ARM64_H_
+#define V8_WASM_BASELINE_ARM64_LIFTOFF_ASSEMBLER_ARM64_H_
 
 #include "src/wasm/baseline/liftoff-assembler.h"
 
+#define BAILOUT(reason) bailout("arm64 " reason)
+
 namespace v8 {
 namespace internal {
 namespace wasm {
 
-void LiftoffAssembler::ReserveStackSpace(uint32_t bytes) { UNIMPLEMENTED(); }
+uint32_t LiftoffAssembler::PrepareStackFrame() {
+  BAILOUT("PrepareStackFrame");
+  return 0;
+}
+
+void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+                                              uint32_t stack_slots) {
+  BAILOUT("PatchPrepareStackFrame");
+}
 
-void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
+                                    RelocInfo::Mode rmode) {
+  BAILOUT("LoadConstant");
 }
 
 void LiftoffAssembler::LoadFromContext(Register dst, uint32_t offset,
                                        int size) {
-  UNIMPLEMENTED();
+  BAILOUT("LoadFromContext");
 }
 
-void LiftoffAssembler::SpillContext(Register context) { UNIMPLEMENTED(); }
+void LiftoffAssembler::SpillContext(Register context) {
+  BAILOUT("SpillContext");
+}
 
-void LiftoffAssembler::FillContextInto(Register dst) { UNIMPLEMENTED(); }
+void LiftoffAssembler::FillContextInto(Register dst) {
+  BAILOUT("FillContextInto");
+}
 
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
                             uint32_t* protected_load_pc) {
-  UNIMPLEMENTED();
+  BAILOUT("Load");
 }
 
 void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
                              uint32_t* protected_store_pc) {
-  UNIMPLEMENTED();
+  BAILOUT("Store");
 }
 
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
-                                           uint32_t caller_slot_idx) {
-  UNIMPLEMENTED();
+                                           uint32_t caller_slot_idx,
+                                           ValueType type) {
+  BAILOUT("LoadCallerFrameSlot");
+}
+
+void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+                                      ValueType type) {
+  BAILOUT("MoveStackValue");
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
+                                            ValueType type) {
+  BAILOUT("MoveToReturnRegister");
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
+  BAILOUT("Move Register");
 }
 
-void LiftoffAssembler::Move(LiftoffRegister dst, LiftoffRegister src) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
+                            ValueType type) {
+  BAILOUT("Move DoubleRegister");
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
+                             ValueType type) {
+  BAILOUT("Spill register");
 }
 
 void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
-  UNIMPLEMENTED();
+  BAILOUT("Spill value");
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
+                            ValueType type) {
+  BAILOUT("Fill");
+}
+
+void LiftoffAssembler::FillI64Half(Register, uint32_t half_index) {
+  BAILOUT("FillI64Half");
 }
 
 #define UNIMPLEMENTED_GP_BINOP(name)                             \
   void LiftoffAssembler::emit_##name(Register dst, Register lhs, \
                                      Register rhs) {             \
-    UNIMPLEMENTED();                                             \
+    BAILOUT("gp binop: " #name);                                 \
   }
 #define UNIMPLEMENTED_GP_UNOP(name)                                \
   bool LiftoffAssembler::emit_##name(Register dst, Register src) { \
-    UNIMPLEMENTED();                                               \
+    BAILOUT("gp unop: " #name);                                    \
+    return true;                                                   \
   }
 #define UNIMPLEMENTED_FP_BINOP(name)                                         \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister lhs, \
                                      DoubleRegister rhs) {                   \
-    UNIMPLEMENTED();                                                         \
+    BAILOUT("fp binop: " #name);                                             \
+  }
+#define UNIMPLEMENTED_FP_UNOP(name)                                            \
+  void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
+    BAILOUT("fp unop: " #name);                                                \
+  }
+#define UNIMPLEMENTED_I32_SHIFTOP(name)                                        \
+  void LiftoffAssembler::emit_##name(Register dst, Register src,               \
+                                     Register amount, LiftoffRegList pinned) { \
+    BAILOUT("i32 shiftop: " #name);                                            \
+  }
+#define UNIMPLEMENTED_I64_SHIFTOP(name)                                        \
+  void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
+                                     Register amount, LiftoffRegList pinned) { \
+    BAILOUT("i64 shiftop: " #name);                                            \
   }
 
 UNIMPLEMENTED_GP_BINOP(i32_add)
@@ -90,10 +134,12 @@ UNIMPLEMENTED_GP_BINOP(i32_mul)
 UNIMPLEMENTED_GP_BINOP(i32_and)
 UNIMPLEMENTED_GP_BINOP(i32_or)
 UNIMPLEMENTED_GP_BINOP(i32_xor)
-UNIMPLEMENTED_GP_BINOP(i32_shl)
-UNIMPLEMENTED_GP_BINOP(i32_sar)
-UNIMPLEMENTED_GP_BINOP(i32_shr)
-UNIMPLEMENTED_GP_UNOP(i32_eqz)
+UNIMPLEMENTED_I32_SHIFTOP(i32_shl)
+UNIMPLEMENTED_I32_SHIFTOP(i32_sar)
+UNIMPLEMENTED_I32_SHIFTOP(i32_shr)
+UNIMPLEMENTED_I64_SHIFTOP(i64_shl)
+UNIMPLEMENTED_I64_SHIFTOP(i64_sar)
+UNIMPLEMENTED_I64_SHIFTOP(i64_shr)
 UNIMPLEMENTED_GP_UNOP(i32_clz)
 UNIMPLEMENTED_GP_UNOP(i32_ctz)
 UNIMPLEMENTED_GP_UNOP(i32_popcnt)
@@ -101,81 +147,152 @@ UNIMPLEMENTED_GP_BINOP(ptrsize_add)
 UNIMPLEMENTED_FP_BINOP(f32_add)
 UNIMPLEMENTED_FP_BINOP(f32_sub)
 UNIMPLEMENTED_FP_BINOP(f32_mul)
+UNIMPLEMENTED_FP_BINOP(f32_div)
+UNIMPLEMENTED_FP_UNOP(f32_abs)
+UNIMPLEMENTED_FP_UNOP(f32_neg)
+UNIMPLEMENTED_FP_UNOP(f32_sqrt)
+UNIMPLEMENTED_FP_BINOP(f64_add)
+UNIMPLEMENTED_FP_BINOP(f64_sub)
+UNIMPLEMENTED_FP_BINOP(f64_mul)
+UNIMPLEMENTED_FP_BINOP(f64_div)
+UNIMPLEMENTED_FP_UNOP(f64_abs)
+UNIMPLEMENTED_FP_UNOP(f64_neg)
+UNIMPLEMENTED_FP_UNOP(f64_sqrt)
 
 #undef UNIMPLEMENTED_GP_BINOP
 #undef UNIMPLEMENTED_GP_UNOP
 #undef UNIMPLEMENTED_FP_BINOP
+#undef UNIMPLEMENTED_FP_UNOP
+#undef UNIMPLEMENTED_I32_SHIFTOP
+#undef UNIMPLEMENTED_I64_SHIFTOP
+
+bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
+                                            LiftoffRegister dst,
+                                            LiftoffRegister src) {
+  BAILOUT("emit_type_conversion");
+  return true;
+}
+
+void LiftoffAssembler::emit_jump(Label* label) { BAILOUT("emit_jump"); }
+
+void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label,
+                                      ValueType type, Register lhs,
+                                      Register rhs) {
+  BAILOUT("emit_cond_jump");
+}
+
+void LiftoffAssembler::emit_i32_eqz(Register dst, Register src) {
+  BAILOUT("emit_i32_eqz");
+}
 
-void LiftoffAssembler::emit_i32_test(Register reg) { UNIMPLEMENTED(); }
+void LiftoffAssembler::emit_i32_set_cond(Condition cond, Register dst,
+                                         Register lhs, Register rhs) {
+  BAILOUT("emit_i32_set_cond");
+}
 
-void LiftoffAssembler::emit_i32_compare(Register lhs, Register rhs) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::emit_i64_eqz(Register dst, LiftoffRegister src) {
+  BAILOUT("emit_i64_eqz");
 }
 
-void LiftoffAssembler::emit_jump(Label* label) { UNIMPLEMENTED(); }
+void LiftoffAssembler::emit_i64_set_cond(Condition cond, Register dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  BAILOUT("emit_i64_set_cond");
+}
 
-void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::emit_f32_set_cond(Condition cond, Register dst,
+                                         DoubleRegister lhs,
+                                         DoubleRegister rhs) {
+  BAILOUT("emit_f32_set_cond");
 }
 
-void LiftoffAssembler::StackCheck(Label* ool_code) { UNIMPLEMENTED(); }
+void LiftoffAssembler::StackCheck(Label* ool_code) { BAILOUT("StackCheck"); }
 
-void LiftoffAssembler::CallTrapCallbackForTesting() { UNIMPLEMENTED(); }
+void LiftoffAssembler::CallTrapCallbackForTesting() {
+  BAILOUT("CallTrapCallbackForTesting");
+}
 
 void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
-  UNIMPLEMENTED();
+  BAILOUT("AssertUnreachable");
 }
 
 void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index) {
-  UNIMPLEMENTED();
+                                           uint32_t src_index,
+                                           RegPairHalf half) {
+  BAILOUT("PushCallerFrameSlot");
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
+                                           ValueType type) {
+  BAILOUT("PushCallerFrameSlot reg");
 }
 
-void LiftoffAssembler::PushRegisters(LiftoffRegList regs) { UNIMPLEMENTED(); }
+void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
+  BAILOUT("PushRegisters");
+}
 
-void LiftoffAssembler::PopRegisters(LiftoffRegList regs) { UNIMPLEMENTED(); }
+void LiftoffAssembler::PopRegisters(LiftoffRegList regs) {
+  BAILOUT("PopRegisters");
+}
 
 void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
-  UNIMPLEMENTED();
+  BAILOUT("DropStackSlotsAndRet");
 }
 
-void LiftoffAssembler::PrepareCCall(uint32_t num_params, const Register* args) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
+                                    const LiftoffRegister* args,
+                                    ValueType out_argument_type) {
+  BAILOUT("PrepareCCall");
 }
 
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, uint32_t param_idx,
-                                            uint32_t num_params) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
+                                            ValueType type) {
+  BAILOUT("SetCCallRegParamAddr");
 }
 
-void LiftoffAssembler::SetCCallStackParamAddr(uint32_t stack_param_idx,
-                                              uint32_t param_idx,
-                                              uint32_t num_params) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
+                                              int param_byte_offset,
+                                              ValueType type) {
+  BAILOUT("SetCCallStackParamAddr");
+}
+
+void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
+                                            int param_byte_offset) {
+  BAILOUT("LoadCCallOutArgument");
 }
 
 void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
-  UNIMPLEMENTED();
+  BAILOUT("CallC");
 }
 
-void LiftoffAssembler::CallNativeWasmCode(Address addr) { UNIMPLEMENTED(); }
+void LiftoffAssembler::FinishCCall() { BAILOUT("FinishCCall"); }
+
+void LiftoffAssembler::CallNativeWasmCode(Address addr) {
+  BAILOUT("CallNativeWasmCode");
+}
 
 void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
-  UNIMPLEMENTED();
+  BAILOUT("CallRuntime");
+}
+
+void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
+                                    compiler::CallDescriptor* call_descriptor,
+                                    Register target) {
+  BAILOUT("CallIndirect");
 }
 
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
-  UNIMPLEMENTED();
+  BAILOUT("AllocateStackSlot");
 }
 
-void LiftoffAssembler::DeallocateStackSlot(uint32_t size) { UNIMPLEMENTED(); }
+void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
+  BAILOUT("DeallocateStackSlot");
+}
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_ARM64_H_
+#undef BAILOUT
+
+#endif  // V8_WASM_BASELINE_ARM64_LIFTOFF_ASSEMBLER_ARM64_H_
diff --git a/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h b/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h
index a8b5b32bdcf..94249eb3776 100644
--- a/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h
+++ b/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_IA32_H_
-#define V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_IA32_H_
+#ifndef V8_WASM_BASELINE_IA32_LIFTOFF_ASSEMBLER_IA32_H_
+#define V8_WASM_BASELINE_IA32_LIFTOFF_ASSEMBLER_IA32_H_
 
 #include "src/wasm/baseline/liftoff-assembler.h"
 
@@ -16,12 +16,20 @@ namespace wasm {
 
 namespace liftoff {
 
+// ebp-8 holds the stack marker, ebp-16 is the wasm context, first stack slot
+// is located at ebp-24.
+constexpr int32_t kConstantStackSpace = 16;
+constexpr int32_t kFirstStackSlotOffset =
+    kConstantStackSpace + LiftoffAssembler::kStackSlotSize;
+
 inline Operand GetStackSlot(uint32_t index) {
-  // ebp-8 holds the stack marker, ebp-16 is the wasm context, first stack slot
-  // is located at ebp-24.
-  constexpr int32_t kFirstStackSlotOffset = -24;
-  return Operand(
-      ebp, kFirstStackSlotOffset - index * LiftoffAssembler::kStackSlotSize);
+  int32_t offset = index * LiftoffAssembler::kStackSlotSize;
+  return Operand(ebp, -kFirstStackSlotOffset - offset);
+}
+
+inline Operand GetHalfStackSlot(uint32_t half_index) {
+  int32_t offset = half_index * (LiftoffAssembler::kStackSlotSize / 2);
+  return Operand(ebp, -kFirstStackSlotOffset - offset);
 }
 
 // TODO(clemensh): Make this a constexpr variable once Operand is constexpr.
@@ -34,33 +42,92 @@ static_assert((kByteRegs & kGpCacheRegList) == kByteRegs,
               "kByteRegs only contains gp cache registers");
 
 // Use this register to store the address of the last argument pushed on the
-// stack for a call to C.
-static constexpr Register kCCallLastArgAddrReg = eax;
+// stack for a call to C. This register must be callee saved according to the c
+// calling convention.
+static constexpr Register kCCallLastArgAddrReg = ebx;
+
+inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, Operand src,
+                 ValueType type) {
+  switch (type) {
+    case kWasmI32:
+      assm->mov(dst.gp(), src);
+      break;
+    case kWasmF32:
+      assm->movss(dst.fp(), src);
+      break;
+    case kWasmF64:
+      assm->movsd(dst.fp(), src);
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
+  switch (type) {
+    case kWasmI32:
+      assm->push(reg.gp());
+      break;
+    case kWasmI64:
+      assm->push(reg.high_gp());
+      assm->push(reg.low_gp());
+      break;
+    case kWasmF32:
+      assm->sub(esp, Immediate(sizeof(float)));
+      assm->movss(Operand(esp, 0), reg.fp());
+      break;
+    case kWasmF64:
+      assm->sub(esp, Immediate(sizeof(double)));
+      assm->movsd(Operand(esp, 0), reg.fp());
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
 
 }  // namespace liftoff
 
 static constexpr DoubleRegister kScratchDoubleReg = xmm7;
 
-void LiftoffAssembler::ReserveStackSpace(uint32_t bytes) {
+uint32_t LiftoffAssembler::PrepareStackFrame() {
+  uint32_t offset = static_cast<uint32_t>(pc_offset());
+  sub_sp_32(0);
+  return offset;
+}
+
+void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+                                              uint32_t stack_slots) {
+  uint32_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
   DCHECK_LE(bytes, kMaxInt);
-  sub(esp, Immediate(bytes));
+  // We can't run out of space, just pass anything big enough to not cause the
+  // assembler to try to grow the buffer.
+  constexpr int kAvailableSpace = 64;
+  Assembler patching_assembler(isolate(), buffer_ + offset, kAvailableSpace);
+  patching_assembler.sub_sp_32(bytes);
 }
 
-void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value) {
+void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
+                                    RelocInfo::Mode rmode) {
   switch (value.type()) {
     case kWasmI32:
-      if (value.to_i32() == 0) {
-        xor_(reg.gp(), reg.gp());
-      } else {
-        mov(reg.gp(), Immediate(value.to_i32()));
-      }
+      TurboAssembler::Move(
+          reg.gp(),
+          Immediate(reinterpret_cast<Address>(value.to_i32()), rmode));
       break;
-    case kWasmF32: {
-      Register tmp = GetUnusedRegister(kGpReg).gp();
-      mov(tmp, Immediate(value.to_f32_boxed().get_bits()));
-      movd(reg.fp(), tmp);
+    case kWasmI64: {
+      DCHECK(RelocInfo::IsNone(rmode));
+      int32_t low_word = value.to_i64();
+      int32_t high_word = value.to_i64() >> 32;
+      TurboAssembler::Move(reg.low_gp(), Immediate(low_word));
+      TurboAssembler::Move(reg.high_gp(), Immediate(high_word));
       break;
     }
+    case kWasmF32:
+      TurboAssembler::Move(reg.fp(), value.to_f32_boxed().get_bits());
+      break;
+    case kWasmF64:
+      TurboAssembler::Move(reg.fp(), value.to_f64_boxed().get_bits());
+      break;
     default:
       UNREACHABLE();
   }
@@ -86,20 +153,16 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
                             uint32_t* protected_load_pc) {
+  DCHECK_EQ(type.value_type() == kWasmI64, dst.is_pair());
+  // Wasm memory is limited to a size <2GB, so all offsets can be encoded as
+  // immediate value (in 31 bits, interpreted as signed value).
+  // If the offset is bigger, we always trap and this code is not reached.
+  DCHECK(is_uint31(offset_imm));
   Operand src_op = offset_reg == no_reg
                        ? Operand(src_addr, offset_imm)
                        : Operand(src_addr, offset_reg, times_1, offset_imm);
-  if (offset_imm > kMaxInt) {
-    // The immediate can not be encoded in the operand. Load it to a register
-    // first.
-    Register src = GetUnusedRegister(kGpReg, pinned).gp();
-    mov(src, Immediate(offset_imm));
-    if (offset_reg != no_reg) {
-      emit_ptrsize_add(src, src, offset_reg);
-    }
-    src_op = Operand(src_addr, src, times_1, 0);
-  }
   if (protected_load_pc) *protected_load_pc = pc_offset();
+
   switch (type.value()) {
     case LoadType::kI32Load8U:
       movzx_b(dst.gp(), src_op);
@@ -107,18 +170,61 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
     case LoadType::kI32Load8S:
       movsx_b(dst.gp(), src_op);
       break;
+    case LoadType::kI64Load8U:
+      movzx_b(dst.low_gp(), src_op);
+      xor_(dst.high_gp(), dst.high_gp());
+      break;
+    case LoadType::kI64Load8S:
+      movsx_b(dst.low_gp(), src_op);
+      mov(dst.high_gp(), dst.low_gp());
+      sar(dst.high_gp(), 31);
+      break;
     case LoadType::kI32Load16U:
       movzx_w(dst.gp(), src_op);
       break;
     case LoadType::kI32Load16S:
       movsx_w(dst.gp(), src_op);
       break;
+    case LoadType::kI64Load16U:
+      movzx_w(dst.low_gp(), src_op);
+      xor_(dst.high_gp(), dst.high_gp());
+      break;
+    case LoadType::kI64Load16S:
+      movsx_w(dst.low_gp(), src_op);
+      mov(dst.high_gp(), dst.low_gp());
+      sar(dst.high_gp(), 31);
+      break;
     case LoadType::kI32Load:
       mov(dst.gp(), src_op);
       break;
+    case LoadType::kI64Load32U:
+      mov(dst.low_gp(), src_op);
+      xor_(dst.high_gp(), dst.high_gp());
+      break;
+    case LoadType::kI64Load32S:
+      mov(dst.low_gp(), src_op);
+      mov(dst.high_gp(), dst.low_gp());
+      sar(dst.high_gp(), 31);
+      break;
+    case LoadType::kI64Load: {
+      // Compute the operand for the load of the upper half.
+      DCHECK(is_uint31(offset_imm + 4));
+      Operand upper_src_op =
+          offset_reg == no_reg
+              ? Operand(src_addr, offset_imm + 4)
+              : Operand(src_addr, offset_reg, times_1, offset_imm + 4);
+      // The high word has to be mov'ed first, such that this is the protected
+      // instruction. The mov of the low word cannot segfault.
+      mov(dst.high_gp(), upper_src_op);
+      mov(dst.low_gp(), src_op);
+      break;
+    }
     case LoadType::kF32Load:
       movss(dst.fp(), src_op);
       break;
+    case LoadType::kF64Load:
+      movsd(dst.fp(), src_op);
+      break;
     default:
       UNREACHABLE();
   }
@@ -128,21 +234,20 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
                              uint32_t* protected_store_pc) {
+  DCHECK_EQ(type.value_type() == kWasmI64, src.is_pair());
+  // Wasm memory is limited to a size <2GB, so all offsets can be encoded as
+  // immediate value (in 31 bits, interpreted as signed value).
+  // If the offset is bigger, we always trap and this code is not reached.
+  DCHECK(is_uint31(offset_imm));
   Operand dst_op = offset_reg == no_reg
                        ? Operand(dst_addr, offset_imm)
                        : Operand(dst_addr, offset_reg, times_1, offset_imm);
-  if (offset_imm > kMaxInt) {
-    // The immediate can not be encoded in the operand. Load it to a register
-    // first.
-    Register dst = pinned.set(GetUnusedRegister(kGpReg, pinned).gp());
-    mov(dst, Immediate(offset_imm));
-    if (offset_reg != no_reg) {
-      emit_ptrsize_add(dst, dst, offset_reg);
-    }
-    dst_op = Operand(dst_addr, dst, times_1, 0);
-  }
   if (protected_store_pc) *protected_store_pc = pc_offset();
+
   switch (type.value()) {
+    case StoreType::kI64Store8:
+      src = src.low();
+      V8_FALLTHROUGH;
     case StoreType::kI32Store8:
       // Only the lower 4 registers can be addressed as 8-bit registers.
       if (src.gp().is_byte_register()) {
@@ -153,98 +258,158 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
         mov_b(dst_op, byte_src);
       }
       break;
+    case StoreType::kI64Store16:
+      src = src.low();
+      V8_FALLTHROUGH;
     case StoreType::kI32Store16:
       mov_w(dst_op, src.gp());
       break;
+    case StoreType::kI64Store32:
+      src = src.low();
+      V8_FALLTHROUGH;
     case StoreType::kI32Store:
       mov(dst_op, src.gp());
       break;
+    case StoreType::kI64Store: {
+      // Compute the operand for the store of the upper half.
+      DCHECK(is_uint31(offset_imm + 4));
+      Operand upper_dst_op =
+          offset_reg == no_reg
+              ? Operand(dst_addr, offset_imm + 4)
+              : Operand(dst_addr, offset_reg, times_1, offset_imm + 4);
+      // The high word has to be mov'ed first, such that this is the protected
+      // instruction. The mov of the low word cannot segfault.
+      mov(upper_dst_op, src.high_gp());
+      mov(dst_op, src.low_gp());
+      break;
+    }
     case StoreType::kF32Store:
       movss(dst_op, src.fp());
       break;
+    case StoreType::kF64Store:
+      movsd(dst_op, src.fp());
+      break;
     default:
       UNREACHABLE();
   }
 }
 
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
-                                           uint32_t caller_slot_idx) {
+                                           uint32_t caller_slot_idx,
+                                           ValueType type) {
   Operand src(ebp, kPointerSize * (caller_slot_idx + 1));
-  if (dst.is_gp()) {
-    mov(dst.gp(), src);
-  } else {
-    movss(dst.fp(), src);
-  }
+  liftoff::Load(this, dst, src, type);
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index) {
+void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+                                      ValueType type) {
   DCHECK_NE(dst_index, src_index);
   if (cache_state_.has_unused_register(kGpReg)) {
     LiftoffRegister reg = GetUnusedRegister(kGpReg);
-    Fill(reg, src_index);
-    Spill(dst_index, reg);
+    Fill(reg, src_index, type);
+    Spill(dst_index, reg, type);
   } else {
     push(liftoff::GetStackSlot(src_index));
     pop(liftoff::GetStackSlot(dst_index));
   }
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg) {
+void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
+                                            ValueType type) {
   // TODO(wasm): Extract the destination register from the CallDescriptor.
   // TODO(wasm): Add multi-return support.
-  LiftoffRegister dst =
-      reg.is_gp() ? LiftoffRegister(eax) : LiftoffRegister(xmm1);
-  if (reg != dst) Move(dst, reg);
+  LiftoffRegister dst = reg.is_pair() ? LiftoffRegister::ForPair(eax, edx)
+                                      : reg.is_gp() ? LiftoffRegister(eax)
+                                                    : LiftoffRegister(xmm1);
+  if (reg != dst) Move(dst, reg, type);
+}
+
+void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
+  DCHECK_NE(dst, src);
+  DCHECK_EQ(kWasmI32, type);
+  mov(dst, src);
 }
 
-void LiftoffAssembler::Move(LiftoffRegister dst, LiftoffRegister src) {
-  // The caller should check that the registers are not equal. For most
-  // occurences, this is already guaranteed, so no need to check within this
-  // method.
+void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
+                            ValueType type) {
   DCHECK_NE(dst, src);
-  DCHECK_EQ(dst.reg_class(), src.reg_class());
-  // TODO(clemensh): Handle different sizes here.
-  if (dst.is_gp()) {
-    mov(dst.gp(), src.gp());
+  if (type == kWasmF32) {
+    movss(dst, src);
   } else {
-    movsd(dst.fp(), src.fp());
+    DCHECK_EQ(kWasmF64, type);
+    movsd(dst, src);
   }
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg) {
+void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
+                             ValueType type) {
+  RecordUsedSpillSlot(index);
   Operand dst = liftoff::GetStackSlot(index);
-  // TODO(clemensh): Handle different sizes here.
-  if (reg.is_gp()) {
-    mov(dst, reg.gp());
-  } else {
-    movsd(dst, reg.fp());
+  switch (type) {
+    case kWasmI32:
+      mov(dst, reg.gp());
+      break;
+    case kWasmI64:
+      mov(dst, reg.low_gp());
+      mov(liftoff::GetHalfStackSlot(2 * index - 1), reg.high_gp());
+      break;
+    case kWasmF32:
+      movss(dst, reg.fp());
+      break;
+    case kWasmF64:
+      movsd(dst, reg.fp());
+      break;
+    default:
+      UNREACHABLE();
   }
 }
 
 void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
+  RecordUsedSpillSlot(index);
   Operand dst = liftoff::GetStackSlot(index);
   switch (value.type()) {
     case kWasmI32:
       mov(dst, Immediate(value.to_i32()));
       break;
-    case kWasmF32:
-      mov(dst, Immediate(value.to_f32_boxed().get_bits()));
+    case kWasmI64: {
+      int32_t low_word = value.to_i64();
+      int32_t high_word = value.to_i64() >> 32;
+      mov(dst, Immediate(low_word));
+      mov(liftoff::GetHalfStackSlot(2 * index - 1), Immediate(high_word));
       break;
+    }
     default:
+      // We do not track f32 and f64 constants, hence they are unreachable.
       UNREACHABLE();
   }
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index) {
+void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
+                            ValueType type) {
   Operand src = liftoff::GetStackSlot(index);
-  // TODO(clemensh): Handle different sizes here.
-  if (reg.is_gp()) {
-    mov(reg.gp(), src);
-  } else {
-    movsd(reg.fp(), src);
+  switch (type) {
+    case kWasmI32:
+      mov(reg.gp(), src);
+      break;
+    case kWasmI64:
+      mov(reg.low_gp(), src);
+      mov(reg.high_gp(), liftoff::GetHalfStackSlot(2 * index - 1));
+      break;
+    case kWasmF32:
+      movss(reg.fp(), src);
+      break;
+    case kWasmF64:
+      movsd(reg.fp(), src);
+      break;
+    default:
+      UNREACHABLE();
   }
 }
 
+void LiftoffAssembler::FillI64Half(Register reg, uint32_t half_index) {
+  mov(reg, liftoff::GetHalfStackSlot(half_index));
+}
+
 void LiftoffAssembler::emit_i32_add(Register dst, Register lhs, Register rhs) {
   if (lhs != dst) {
     lea(dst, Operand(lhs, rhs, times_1, 0));
@@ -285,33 +450,37 @@ COMMUTATIVE_I32_BINOP(xor, xor_)
 
 namespace liftoff {
 inline void EmitShiftOperation(LiftoffAssembler* assm, Register dst,
-                               Register lhs, Register rhs,
-                               void (Assembler::*emit_shift)(Register)) {
-  LiftoffRegList pinned = LiftoffRegList::ForRegs(dst, lhs, rhs);
+                               Register src, Register amount,
+                               void (Assembler::*emit_shift)(Register),
+                               LiftoffRegList pinned) {
+  pinned.set(dst);
+  pinned.set(src);
+  pinned.set(amount);
   // If dst is ecx, compute into a tmp register first, then move to ecx.
   if (dst == ecx) {
     Register tmp = assm->GetUnusedRegister(kGpReg, pinned).gp();
-    assm->mov(tmp, lhs);
-    if (rhs != ecx) assm->mov(ecx, rhs);
+    assm->mov(tmp, src);
+    if (amount != ecx) assm->mov(ecx, amount);
     (assm->*emit_shift)(tmp);
     assm->mov(ecx, tmp);
     return;
   }
 
-  // Move rhs into ecx. If ecx is in use, move its content to a tmp register
-  // first. If lhs is ecx, lhs is now the tmp register.
+  // Move amount into ecx. If ecx is in use, move its content to a tmp register
+  // first. If src is ecx, src is now the tmp register.
   Register tmp_reg = no_reg;
-  if (rhs != ecx) {
-    if (lhs == ecx || assm->cache_state()->is_used(LiftoffRegister(ecx))) {
+  if (amount != ecx) {
+    if (assm->cache_state()->is_used(LiftoffRegister(ecx)) ||
+        pinned.has(LiftoffRegister(ecx))) {
       tmp_reg = assm->GetUnusedRegister(kGpReg, pinned).gp();
       assm->mov(tmp_reg, ecx);
-      if (lhs == ecx) lhs = tmp_reg;
+      if (src == ecx) src = tmp_reg;
     }
-    assm->mov(ecx, rhs);
+    assm->mov(ecx, amount);
   }
 
   // Do the actual shift.
-  if (dst != lhs) assm->mov(dst, lhs);
+  if (dst != src) assm->mov(dst, src);
   (assm->*emit_shift)(dst);
 
   // Restore ecx if needed.
@@ -319,30 +488,22 @@ inline void EmitShiftOperation(LiftoffAssembler* assm, Register dst,
 }
 }  // namespace liftoff
 
-void LiftoffAssembler::emit_i32_shl(Register dst, Register lhs, Register rhs) {
-  liftoff::EmitShiftOperation(this, dst, lhs, rhs, &Assembler::shl_cl);
+void LiftoffAssembler::emit_i32_shl(Register dst, Register src, Register amount,
+                                    LiftoffRegList pinned) {
+  liftoff::EmitShiftOperation(this, dst, src, amount, &Assembler::shl_cl,
+                              pinned);
 }
 
-void LiftoffAssembler::emit_i32_sar(Register dst, Register lhs, Register rhs) {
-  liftoff::EmitShiftOperation(this, dst, lhs, rhs, &Assembler::sar_cl);
+void LiftoffAssembler::emit_i32_sar(Register dst, Register src, Register amount,
+                                    LiftoffRegList pinned) {
+  liftoff::EmitShiftOperation(this, dst, src, amount, &Assembler::sar_cl,
+                              pinned);
 }
 
-void LiftoffAssembler::emit_i32_shr(Register dst, Register lhs, Register rhs) {
-  liftoff::EmitShiftOperation(this, dst, lhs, rhs, &Assembler::shr_cl);
-}
-
-bool LiftoffAssembler::emit_i32_eqz(Register dst, Register src) {
-  Register tmp_byte_reg = dst;
-  // Only the lower 4 registers can be addressed as 8-bit registers.
-  if (!dst.is_byte_register()) {
-    LiftoffRegList pinned = LiftoffRegList::ForRegs(src);
-    tmp_byte_reg = GetUnusedRegister(liftoff::kByteRegs, pinned).gp();
-  }
-
-  test(src, src);
-  setcc(zero, tmp_byte_reg);
-  movzx_b(dst, tmp_byte_reg);
-  return true;
+void LiftoffAssembler::emit_i32_shr(Register dst, Register src, Register amount,
+                                    LiftoffRegList pinned) {
+  liftoff::EmitShiftOperation(this, dst, src, amount, &Assembler::shr_cl,
+                              pinned);
 }
 
 bool LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
@@ -386,6 +547,77 @@ bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
   return true;
 }
 
+namespace liftoff {
+inline bool PairContains(LiftoffRegister pair, Register reg) {
+  return pair.low_gp() == reg || pair.high_gp() == reg;
+}
+
+inline LiftoffRegister ReplaceInPair(LiftoffRegister pair, Register old_reg,
+                                     Register new_reg) {
+  if (pair.low_gp() == old_reg) {
+    return LiftoffRegister::ForPair(new_reg, pair.high_gp());
+  }
+  if (pair.high_gp() == old_reg) {
+    return LiftoffRegister::ForPair(pair.low_gp(), new_reg);
+  }
+  return pair;
+}
+
+inline void Emit64BitShiftOperation(
+    LiftoffAssembler* assm, LiftoffRegister dst, LiftoffRegister src,
+    Register amount, void (TurboAssembler::*emit_shift)(Register, Register),
+    LiftoffRegList pinned) {
+  pinned.set(dst);
+  pinned.set(src);
+  pinned.set(amount);
+  // If dst contains ecx, replace it by an unused register, which is then moved
+  // to ecx in the end.
+  Register ecx_replace = no_reg;
+  if (PairContains(dst, ecx)) {
+    ecx_replace = pinned.set(assm->GetUnusedRegister(kGpReg, pinned)).gp();
+    dst = ReplaceInPair(dst, ecx, ecx_replace);
+  }
+
+  // Move src to dst.
+  if (dst != src) assm->Move(dst, src, kWasmI64);
+
+  // Move amount into ecx. If ecx is in use and not part of dst, move its
+  // content to a tmp register first.
+  if (amount != ecx) {
+    if (assm->cache_state()->is_used(LiftoffRegister(ecx)) &&
+        ecx_replace == no_reg) {
+      ecx_replace = assm->GetUnusedRegister(kGpReg, pinned).gp();
+      assm->mov(ecx_replace, ecx);
+    }
+    assm->mov(ecx, amount);
+  }
+
+  // Do the actual shift.
+  (assm->*emit_shift)(dst.high_gp(), dst.low_gp());
+
+  // Restore ecx if needed.
+  if (ecx_replace != no_reg) assm->mov(ecx, ecx_replace);
+}
+}  // namespace liftoff
+
+void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
+                                    Register amount, LiftoffRegList pinned) {
+  liftoff::Emit64BitShiftOperation(this, dst, src, amount,
+                                   &TurboAssembler::ShlPair_cl, pinned);
+}
+
+void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
+                                    Register amount, LiftoffRegList pinned) {
+  liftoff::Emit64BitShiftOperation(this, dst, src, amount,
+                                   &TurboAssembler::SarPair_cl, pinned);
+}
+
+void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
+                                    Register amount, LiftoffRegList pinned) {
+  liftoff::Emit64BitShiftOperation(this, dst, src, amount,
+                                   &TurboAssembler::ShrPair_cl, pinned);
+}
+
 void LiftoffAssembler::emit_ptrsize_add(Register dst, Register lhs,
                                         Register rhs) {
   emit_i32_add(dst, lhs, rhs);
@@ -432,22 +664,340 @@ void LiftoffAssembler::emit_f32_mul(DoubleRegister dst, DoubleRegister lhs,
   }
 }
 
-void LiftoffAssembler::emit_i32_test(Register reg) { test(reg, reg); }
+void LiftoffAssembler::emit_f32_div(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vdivss(dst, lhs, rhs);
+  } else if (dst == rhs) {
+    movss(kScratchDoubleReg, rhs);
+    movss(dst, lhs);
+    divss(dst, kScratchDoubleReg);
+  } else {
+    if (dst != lhs) movss(dst, lhs);
+    divss(dst, rhs);
+  }
+}
 
-void LiftoffAssembler::emit_i32_compare(Register lhs, Register rhs) {
-  cmp(lhs, rhs);
+void LiftoffAssembler::emit_f32_abs(DoubleRegister dst, DoubleRegister src) {
+  static constexpr uint32_t kSignBit = uint32_t{1} << 31;
+  if (dst == src) {
+    TurboAssembler::Move(kScratchDoubleReg, kSignBit - 1);
+    Andps(dst, kScratchDoubleReg);
+  } else {
+    TurboAssembler::Move(dst, kSignBit - 1);
+    Andps(dst, src);
+  }
+}
+
+void LiftoffAssembler::emit_f32_neg(DoubleRegister dst, DoubleRegister src) {
+  static constexpr uint32_t kSignBit = uint32_t{1} << 31;
+  if (dst == src) {
+    TurboAssembler::Move(kScratchDoubleReg, kSignBit);
+    Xorps(dst, kScratchDoubleReg);
+  } else {
+    TurboAssembler::Move(dst, kSignBit);
+    Xorps(dst, src);
+  }
+}
+
+void LiftoffAssembler::emit_f32_sqrt(DoubleRegister dst, DoubleRegister src) {
+  Sqrtss(dst, src);
+}
+
+void LiftoffAssembler::emit_f64_add(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vaddsd(dst, lhs, rhs);
+  } else if (dst == rhs) {
+    addsd(dst, lhs);
+  } else {
+    if (dst != lhs) movsd(dst, lhs);
+    addsd(dst, rhs);
+  }
+}
+
+void LiftoffAssembler::emit_f64_sub(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vsubsd(dst, lhs, rhs);
+  } else if (dst == rhs) {
+    movsd(kScratchDoubleReg, rhs);
+    movsd(dst, lhs);
+    subsd(dst, kScratchDoubleReg);
+  } else {
+    if (dst != lhs) movsd(dst, lhs);
+    subsd(dst, rhs);
+  }
+}
+
+void LiftoffAssembler::emit_f64_mul(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vmulsd(dst, lhs, rhs);
+  } else if (dst == rhs) {
+    mulsd(dst, lhs);
+  } else {
+    if (dst != lhs) movsd(dst, lhs);
+    mulsd(dst, rhs);
+  }
+}
+
+void LiftoffAssembler::emit_f64_div(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vdivsd(dst, lhs, rhs);
+  } else if (dst == rhs) {
+    movsd(kScratchDoubleReg, rhs);
+    movsd(dst, lhs);
+    divsd(dst, kScratchDoubleReg);
+  } else {
+    if (dst != lhs) movsd(dst, lhs);
+    divsd(dst, rhs);
+  }
+}
+
+void LiftoffAssembler::emit_f64_abs(DoubleRegister dst, DoubleRegister src) {
+  static constexpr uint64_t kSignBit = uint64_t{1} << 63;
+  if (dst == src) {
+    TurboAssembler::Move(kScratchDoubleReg, kSignBit - 1);
+    Andpd(dst, kScratchDoubleReg);
+  } else {
+    TurboAssembler::Move(dst, kSignBit - 1);
+    Andpd(dst, src);
+  }
+}
+
+void LiftoffAssembler::emit_f64_neg(DoubleRegister dst, DoubleRegister src) {
+  static constexpr uint64_t kSignBit = uint64_t{1} << 63;
+  if (dst == src) {
+    TurboAssembler::Move(kScratchDoubleReg, kSignBit);
+    Xorpd(dst, kScratchDoubleReg);
+  } else {
+    TurboAssembler::Move(dst, kSignBit);
+    Xorpd(dst, src);
+  }
+}
+
+void LiftoffAssembler::emit_f64_sqrt(DoubleRegister dst, DoubleRegister src) {
+  Sqrtsd(dst, src);
+}
+
+bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
+                                            LiftoffRegister dst,
+                                            LiftoffRegister src) {
+  switch (opcode) {
+    case kExprI32ConvertI64:
+      if (dst.gp() != src.low_gp()) mov(dst.gp(), src.low_gp());
+      return true;
+    case kExprI32ReinterpretF32:
+      Movd(dst.gp(), src.fp());
+      return true;
+    case kExprI64SConvertI32:
+      if (dst.low_gp() != src.gp()) mov(dst.low_gp(), src.gp());
+      mov(dst.high_gp(), src.gp());
+      sar(dst.high_gp(), 31);
+      return true;
+    case kExprI64UConvertI32:
+      if (dst.low_gp() != src.gp()) mov(dst.low_gp(), src.gp());
+      xor_(dst.high_gp(), dst.high_gp());
+      return true;
+    case kExprI64ReinterpretF64:
+      // Push src to the stack.
+      sub(esp, Immediate(8));
+      movsd(Operand(esp, 0), src.fp());
+      // Pop to dst.
+      pop(dst.low_gp());
+      pop(dst.high_gp());
+      return true;
+    case kExprF32SConvertI32:
+      cvtsi2ss(dst.fp(), src.gp());
+      return true;
+    case kExprF32UConvertI32: {
+      LiftoffRegList pinned = LiftoffRegList::ForRegs(dst, src);
+      Register scratch = GetUnusedRegister(kGpReg, pinned).gp();
+      Cvtui2ss(dst.fp(), src.gp(), scratch);
+      return true;
+    }
+    case kExprF32ConvertF64:
+      cvtsd2ss(dst.fp(), src.fp());
+      return true;
+    case kExprF32ReinterpretI32:
+      Movd(dst.fp(), src.gp());
+      return true;
+    case kExprF64SConvertI32:
+      Cvtsi2sd(dst.fp(), src.gp());
+      return true;
+    case kExprF64UConvertI32:
+      LoadUint32(dst.fp(), src.gp());
+      return true;
+    case kExprF64ConvertF32:
+      cvtss2sd(dst.fp(), src.fp());
+      return true;
+    case kExprF64ReinterpretI64:
+      // Push src to the stack.
+      push(src.high_gp());
+      push(src.low_gp());
+      // Pop to dst.
+      movsd(dst.fp(), Operand(esp, 0));
+      add(esp, Immediate(8));
+      return true;
+    default:
+      return false;
+  }
 }
 
 void LiftoffAssembler::emit_jump(Label* label) { jmp(label); }
 
-void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label) {
+void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label,
+                                      ValueType type, Register lhs,
+                                      Register rhs) {
+  if (rhs != no_reg) {
+    switch (type) {
+      case kWasmI32:
+        cmp(lhs, rhs);
+        break;
+      default:
+        UNREACHABLE();
+    }
+  } else {
+    DCHECK_EQ(type, kWasmI32);
+    test(lhs, lhs);
+  }
+
   j(cond, label);
 }
 
+namespace liftoff {
+
+// Get a temporary byte register, using {candidate} if possible.
+// Might spill, but always keeps status flags intact.
+inline Register GetTmpByteRegister(LiftoffAssembler* assm, Register candidate) {
+  if (candidate.is_byte_register()) return candidate;
+  LiftoffRegList pinned = LiftoffRegList::ForRegs(candidate);
+  // {GetUnusedRegister()} may insert move instructions to spill registers to
+  // the stack. This is OK because {mov} does not change the status flags.
+  return assm->GetUnusedRegister(liftoff::kByteRegs, pinned).gp();
+}
+
+// Setcc into dst register, given a scratch byte register (might be the same as
+// dst). Never spills.
+inline void setcc_32_no_spill(LiftoffAssembler* assm, Condition cond,
+                              Register dst, Register tmp_byte_reg) {
+  assm->setcc(cond, tmp_byte_reg);
+  assm->movzx_b(dst, tmp_byte_reg);
+}
+
+// Setcc into dst register (no contraints). Might spill.
+inline void setcc_32(LiftoffAssembler* assm, Condition cond, Register dst) {
+  Register tmp_byte_reg = GetTmpByteRegister(assm, dst);
+  setcc_32_no_spill(assm, cond, dst, tmp_byte_reg);
+}
+
+}  // namespace liftoff
+
+void LiftoffAssembler::emit_i32_eqz(Register dst, Register src) {
+  test(src, src);
+  liftoff::setcc_32(this, equal, dst);
+}
+
+void LiftoffAssembler::emit_i32_set_cond(Condition cond, Register dst,
+                                         Register lhs, Register rhs) {
+  cmp(lhs, rhs);
+  liftoff::setcc_32(this, cond, dst);
+}
+
+void LiftoffAssembler::emit_i64_eqz(Register dst, LiftoffRegister src) {
+  // Compute the OR of both registers in the src pair, using dst as scratch
+  // register. Then check whether the result is equal to zero.
+  if (src.low_gp() == dst) {
+    or_(dst, src.high_gp());
+  } else {
+    if (src.high_gp() != dst) mov(dst, src.high_gp());
+    or_(dst, src.low_gp());
+  }
+  liftoff::setcc_32(this, equal, dst);
+}
+
+namespace liftoff {
+inline Condition cond_make_unsigned(Condition cond) {
+  switch (cond) {
+    case kSignedLessThan:
+      return kUnsignedLessThan;
+    case kSignedLessEqual:
+      return kUnsignedLessEqual;
+    case kSignedGreaterThan:
+      return kUnsignedGreaterThan;
+    case kSignedGreaterEqual:
+      return kUnsignedGreaterEqual;
+    default:
+      return cond;
+  }
+}
+}  // namespace liftoff
+
+void LiftoffAssembler::emit_i64_set_cond(Condition cond, Register dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  // Get the tmp byte register out here, such that we don't conditionally spill
+  // (this cannot be reflected in the cache state).
+  Register tmp_byte_reg = liftoff::GetTmpByteRegister(this, dst);
+
+  // For signed i64 comparisons, we still need to use unsigned comparison for
+  // the low word (the only bit carrying signedness information is the MSB in
+  // the high word).
+  Condition unsigned_cond = liftoff::cond_make_unsigned(cond);
+  Label setcc;
+  Label cont;
+  // Compare high word first. If it differs, use if for the setcc. If it's
+  // equal, compare the low word and use that for setcc.
+  cmp(lhs.high_gp(), rhs.high_gp());
+  j(not_equal, &setcc, Label::kNear);
+  cmp(lhs.low_gp(), rhs.low_gp());
+  if (unsigned_cond != cond) {
+    // If the condition predicate for the low differs from that for the high
+    // word, emit a separete setcc sequence for the low word.
+    liftoff::setcc_32_no_spill(this, unsigned_cond, dst, tmp_byte_reg);
+    jmp(&cont);
+  }
+  bind(&setcc);
+  liftoff::setcc_32_no_spill(this, cond, dst, tmp_byte_reg);
+  bind(&cont);
+}
+
+void LiftoffAssembler::emit_f32_set_cond(Condition cond, Register dst,
+                                         DoubleRegister lhs,
+                                         DoubleRegister rhs) {
+  Label cont;
+  Label not_nan;
+
+  // Get the tmp byte register out here, such that we don't conditionally spill
+  // (this cannot be reflected in the cache state).
+  Register tmp_byte_reg = liftoff::GetTmpByteRegister(this, dst);
+
+  ucomiss(lhs, rhs);
+  // If PF is one, one of the operands was Nan. This needs special handling.
+  j(parity_odd, &not_nan, Label::kNear);
+  // Return 1 for f32.ne, 0 for all other cases.
+  if (cond == not_equal) {
+    mov(dst, Immediate(1));
+  } else {
+    xor_(dst, dst);
+  }
+  jmp(&cont, Label::kNear);
+  bind(&not_nan);
+
+  liftoff::setcc_32_no_spill(this, cond, dst, tmp_byte_reg);
+  bind(&cont);
+}
+
 void LiftoffAssembler::StackCheck(Label* ool_code) {
-  Register limit = GetUnusedRegister(kGpReg).gp();
-  mov(limit, Immediate(ExternalReference::address_of_stack_limit(isolate())));
-  cmp(esp, Operand(limit, 0));
+  cmp(esp,
+      Operand(Immediate(ExternalReference::address_of_stack_limit(isolate()))));
   j(below_equal, ool_code);
 }
 
@@ -462,28 +1012,36 @@ void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
 }
 
 void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index) {
+                                           uint32_t src_index,
+                                           RegPairHalf half) {
   switch (src.loc()) {
     case VarState::kStack:
-      DCHECK_NE(kWasmF64, src.type());  // TODO(clemensh): Implement this.
-      push(liftoff::GetStackSlot(src_index));
+      if (src.type() == kWasmF64) {
+        DCHECK_EQ(kLowWord, half);
+        push(liftoff::GetHalfStackSlot(2 * src_index - 1));
+      }
+      push(liftoff::GetHalfStackSlot(2 * src_index -
+                                     (half == kLowWord ? 0 : 1)));
       break;
     case VarState::kRegister:
-      PushCallerFrameSlot(src.reg());
+      if (src.type() == kWasmI64) {
+        PushCallerFrameSlot(
+            half == kLowWord ? src.reg().low() : src.reg().high(), kWasmI32);
+      } else {
+        PushCallerFrameSlot(src.reg(), src.type());
+      }
       break;
-    case VarState::kI32Const:
-      push(Immediate(src.i32_const()));
+    case VarState::KIntConst:
+      // The high word is the sign extension of the low word.
+      push(Immediate(half == kLowWord ? src.i32_const()
+                                      : src.i32_const() >> 31));
       break;
   }
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg) {
-  if (reg.is_gp()) {
-    push(reg.gp());
-  } else {
-    sub(esp, Immediate(kPointerSize));
-    movss(Operand(esp, 0), reg.fp());
-  }
+void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
+                                           ValueType type) {
+  liftoff::push(this, reg, type);
 }
 
 void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
@@ -531,36 +1089,61 @@ void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
   ret(static_cast<int>(num_stack_slots * kPointerSize));
 }
 
-void LiftoffAssembler::PrepareCCall(uint32_t num_params, const Register* args) {
-  for (size_t param = 0; param < num_params; ++param) {
-    push(args[param]);
+void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
+                                    const LiftoffRegister* args,
+                                    ValueType out_argument_type) {
+  int pushed_bytes = 0;
+  for (ValueType param_type : sig->parameters()) {
+    pushed_bytes += RoundUp<kPointerSize>(WasmOpcodes::MemSize(param_type));
+    liftoff::push(this, *args++, param_type);
   }
-  mov(liftoff::kCCallLastArgAddrReg, esp);
-  constexpr Register kScratch = ebx;
+  if (out_argument_type != kWasmStmt) {
+    int size = RoundUp<kPointerSize>(WasmOpcodes::MemSize(out_argument_type));
+    sub(esp, Immediate(size));
+    pushed_bytes += size;
+  }
+  // Save the original sp (before the first push), such that we can later
+  // compute pointers to the pushed values. Do this only *after* pushing the
+  // values, because {kCCallLastArgAddrReg} might collide with an arg register.
+  lea(liftoff::kCCallLastArgAddrReg, Operand(esp, pushed_bytes));
+  constexpr Register kScratch = ecx;
   static_assert(kScratch != liftoff::kCCallLastArgAddrReg, "collision");
-  PrepareCallCFunction(num_params, kScratch);
+  int num_c_call_arguments = static_cast<int>(sig->parameter_count()) +
+                             (out_argument_type != kWasmStmt);
+  PrepareCallCFunction(num_c_call_arguments, kScratch);
 }
 
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, uint32_t param_idx,
-                                            uint32_t num_params) {
-  int offset = kPointerSize * static_cast<int>(num_params - 1 - param_idx);
-  lea(dst, Operand(liftoff::kCCallLastArgAddrReg, offset));
+void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
+                                            ValueType type) {
+  // Check that we don't accidentally override kCCallLastArgAddrReg.
+  DCHECK_NE(liftoff::kCCallLastArgAddrReg, dst);
+  lea(dst, Operand(liftoff::kCCallLastArgAddrReg, -param_byte_offset));
 }
 
-void LiftoffAssembler::SetCCallStackParamAddr(uint32_t stack_param_idx,
-                                              uint32_t param_idx,
-                                              uint32_t num_params) {
-  constexpr Register kScratch = ebx;
-  static_assert(kScratch != liftoff::kCCallLastArgAddrReg, "collision");
-  int offset = kPointerSize * static_cast<int>(num_params - 1 - param_idx);
-  lea(kScratch, Operand(liftoff::kCCallLastArgAddrReg, offset));
-  mov(Operand(esp, param_idx * kPointerSize), kScratch);
+void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
+                                              int param_byte_offset,
+                                              ValueType type) {
+  static constexpr Register kScratch = ecx;
+  SetCCallRegParamAddr(kScratch, param_byte_offset, type);
+  mov(Operand(esp, stack_param_idx * kPointerSize), kScratch);
+}
+
+void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
+                                            int param_byte_offset) {
+  // Check that we don't accidentally override kCCallLastArgAddrReg.
+  DCHECK_NE(LiftoffRegister(liftoff::kCCallLastArgAddrReg), dst);
+  Operand src(liftoff::kCCallLastArgAddrReg, -param_byte_offset);
+  liftoff::Load(this, dst, src, type);
 }
 
 void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
   CallCFunction(ext_ref, static_cast<int>(num_params));
 }
 
+void LiftoffAssembler::FinishCCall() {
+  mov(esp, liftoff::kCCallLastArgAddrReg);
+}
+
 void LiftoffAssembler::CallNativeWasmCode(Address addr) {
   wasm_call(addr, RelocInfo::WASM_CALL);
 }
@@ -571,6 +1154,17 @@ void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
   CallRuntimeDelayed(zone, fid);
 }
 
+void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
+                                    compiler::CallDescriptor* call_descriptor,
+                                    Register target) {
+  if (target == no_reg) {
+    add(esp, Immediate(kPointerSize));
+    call(Operand(esp, -4));
+  } else {
+    call(target);
+  }
+}
+
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
   sub(esp, Immediate(size));
   mov(addr, esp);
@@ -584,4 +1178,4 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_IA32_H_
+#endif  // V8_WASM_BASELINE_IA32_LIFTOFF_ASSEMBLER_IA32_H_
diff --git a/deps/v8/src/wasm/baseline/liftoff-assembler-defs.h b/deps/v8/src/wasm/baseline/liftoff-assembler-defs.h
index 3eef1e1960f..26f59c68be3 100644
--- a/deps/v8/src/wasm/baseline/liftoff-assembler-defs.h
+++ b/deps/v8/src/wasm/baseline/liftoff-assembler-defs.h
@@ -11,6 +11,10 @@
 #include "src/ia32/assembler-ia32.h"
 #elif V8_TARGET_ARCH_X64
 #include "src/x64/assembler-x64.h"
+#elif V8_TARGET_ARCH_MIPS
+#include "src/mips/assembler-mips.h"
+#elif V8_TARGET_ARCH_MIPS64
+#include "src/mips64/assembler-mips64.h"
 #endif
 
 namespace v8 {
@@ -19,8 +23,6 @@ namespace wasm {
 
 #if V8_TARGET_ARCH_IA32
 
-constexpr bool kLiftoffAssemblerImplementedOnThisPlatform = true;
-
 constexpr RegList kLiftoffAssemblerGpCacheRegs =
     Register::ListOf<eax, ecx, edx, ebx, esi, edi>();
 
@@ -30,17 +32,31 @@ constexpr RegList kLiftoffAssemblerFpCacheRegs =
 
 #elif V8_TARGET_ARCH_X64
 
-constexpr bool kLiftoffAssemblerImplementedOnThisPlatform = true;
-
 constexpr RegList kLiftoffAssemblerGpCacheRegs =
     Register::ListOf<rax, rcx, rdx, rbx, rsi, rdi>();
 
 constexpr RegList kLiftoffAssemblerFpCacheRegs =
     DoubleRegister::ListOf<xmm0, xmm1, xmm2, xmm3, xmm4, xmm5, xmm6, xmm7>();
 
-#else
+#elif V8_TARGET_ARCH_MIPS
+
+constexpr RegList kLiftoffAssemblerGpCacheRegs =
+    Register::ListOf<a0, a1, a2, a3, t0, t1, t2, t3, t4, t5, t6, s7, v0, v1>();
 
-constexpr bool kLiftoffAssemblerImplementedOnThisPlatform = false;
+constexpr RegList kLiftoffAssemblerFpCacheRegs =
+    DoubleRegister::ListOf<f0, f2, f4, f6, f8, f10, f12, f14, f16, f18, f20,
+                           f22, f24>();
+
+#elif V8_TARGET_ARCH_MIPS64
+
+constexpr RegList kLiftoffAssemblerGpCacheRegs =
+    Register::ListOf<a0, a1, a2, a3, a4, a5, a6, a7, t0, t1, t2, s7, v0, v1>();
+
+constexpr RegList kLiftoffAssemblerFpCacheRegs =
+    DoubleRegister::ListOf<f0, f2, f4, f6, f8, f10, f12, f14, f16, f18, f20,
+                           f22, f24, f26>();
+
+#else
 
 constexpr RegList kLiftoffAssemblerGpCacheRegs = 0xff;
 
@@ -49,12 +65,45 @@ constexpr RegList kLiftoffAssemblerFpCacheRegs = 0xff;
 #endif
 
 #if V8_TARGET_ARCH_IA32 || V8_TARGET_ARCH_X64
+
 constexpr Condition kEqual = equal;
+constexpr Condition kUnequal = not_equal;
+constexpr Condition kSignedLessThan = less;
+constexpr Condition kSignedLessEqual = less_equal;
+constexpr Condition kSignedGreaterThan = greater;
+constexpr Condition kSignedGreaterEqual = greater_equal;
+constexpr Condition kUnsignedLessThan = below;
+constexpr Condition kUnsignedLessEqual = below_equal;
+constexpr Condition kUnsignedGreaterThan = above;
 constexpr Condition kUnsignedGreaterEqual = above_equal;
+
+#elif V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64
+
+constexpr Condition kEqual = eq;
+constexpr Condition kUnequal = ne;
+constexpr Condition kSignedLessThan = lt;
+constexpr Condition kSignedLessEqual = le;
+constexpr Condition kSignedGreaterThan = gt;
+constexpr Condition kSignedGreaterEqual = ge;
+constexpr Condition kUnsignedLessThan = ult;
+constexpr Condition kUnsignedLessEqual = ule;
+constexpr Condition kUnsignedGreaterThan = ugt;
+constexpr Condition kUnsignedGreaterEqual = uge;
+
 #else
+
 // On unimplemented platforms, just make this compile.
 constexpr Condition kEqual = static_cast<Condition>(0);
+constexpr Condition kUnequal = static_cast<Condition>(0);
+constexpr Condition kSignedLessThan = static_cast<Condition>(0);
+constexpr Condition kSignedLessEqual = static_cast<Condition>(0);
+constexpr Condition kSignedGreaterThan = static_cast<Condition>(0);
+constexpr Condition kSignedGreaterEqual = static_cast<Condition>(0);
+constexpr Condition kUnsignedLessThan = static_cast<Condition>(0);
+constexpr Condition kUnsignedLessEqual = static_cast<Condition>(0);
+constexpr Condition kUnsignedGreaterThan = static_cast<Condition>(0);
 constexpr Condition kUnsignedGreaterEqual = static_cast<Condition>(0);
+
 #endif
 
 }  // namespace wasm
diff --git a/deps/v8/src/wasm/baseline/liftoff-assembler.cc b/deps/v8/src/wasm/baseline/liftoff-assembler.cc
index 121cfeea6ab..b79171fc83a 100644
--- a/deps/v8/src/wasm/baseline/liftoff-assembler.cc
+++ b/deps/v8/src/wasm/baseline/liftoff-assembler.cc
@@ -31,20 +31,45 @@ class StackTransferRecipe {
   struct RegisterMove {
     LiftoffRegister dst;
     LiftoffRegister src;
-    constexpr RegisterMove(LiftoffRegister dst, LiftoffRegister src)
-        : dst(dst), src(src) {}
+    ValueType type;
+    constexpr RegisterMove(LiftoffRegister dst, LiftoffRegister src,
+                           ValueType type)
+        : dst(dst), src(src), type(type) {}
   };
   struct RegisterLoad {
-    LiftoffRegister dst;
-    bool is_constant_load;  // otherwise load it from the stack.
-    union {
-      uint32_t stack_slot;
-      WasmValue constant;
+    enum LoadKind : uint8_t {
+      kConstant,  // load a constant value into a register.
+      kStack,     // fill a register from a stack slot.
+      kHalfStack  // fill one half of a register pair from half a stack slot.
     };
-    RegisterLoad(LiftoffRegister dst, WasmValue constant)
-        : dst(dst), is_constant_load(true), constant(constant) {}
-    RegisterLoad(LiftoffRegister dst, uint32_t stack_slot)
-        : dst(dst), is_constant_load(false), stack_slot(stack_slot) {}
+
+    LiftoffRegister dst;
+    LoadKind kind;
+    ValueType type;
+    int32_t value;  // i32 constant value or stack index, depending on kind.
+
+    // Named constructors.
+    static RegisterLoad Const(LiftoffRegister dst, WasmValue constant) {
+      if (constant.type() == kWasmI32) {
+        return {dst, kConstant, kWasmI32, constant.to_i32()};
+      }
+      DCHECK_EQ(kWasmI64, constant.type());
+      DCHECK_EQ(constant.to_i32_unchecked(), constant.to_i64_unchecked());
+      return {dst, kConstant, kWasmI64, constant.to_i32_unchecked()};
+    }
+    static RegisterLoad Stack(LiftoffRegister dst, int32_t stack_index,
+                              ValueType type) {
+      return {dst, kStack, type, stack_index};
+    }
+    static RegisterLoad HalfStack(LiftoffRegister dst,
+                                  int32_t half_stack_index) {
+      return {dst, kHalfStack, kWasmI32, half_stack_index};
+    }
+
+   private:
+    RegisterLoad(LiftoffRegister dst, LoadKind kind, ValueType type,
+                 int32_t value)
+        : dst(dst), kind(kind), type(type), value(value) {}
   };
 
  public:
@@ -55,15 +80,17 @@ class StackTransferRecipe {
     // First, execute register moves. Then load constants and stack values into
     // registers.
 
-    if ((move_dst_regs & move_src_regs).is_empty()) {
+    if ((move_dst_regs_ & move_src_regs_).is_empty()) {
       // No overlap in src and dst registers. Just execute the moves in any
       // order.
-      for (RegisterMove& rm : register_moves) asm_->Move(rm.dst, rm.src);
-      register_moves.clear();
+      for (RegisterMove& rm : register_moves_) {
+        asm_->Move(rm.dst, rm.src, rm.type);
+      }
+      register_moves_.clear();
     } else {
       // Keep use counters of src registers.
       uint32_t src_reg_use_count[kAfterMaxLiftoffRegCode] = {0};
-      for (RegisterMove& rm : register_moves) {
+      for (RegisterMove& rm : register_moves_) {
         ++src_reg_use_count[rm.src.liftoff_code()];
       }
       // Now repeatedly iterate the list of register moves, and execute those
@@ -73,11 +100,11 @@ class StackTransferRecipe {
       // register to the stack, add a RegisterLoad to reload it later, and
       // continue.
       uint32_t next_spill_slot = asm_->cache_state()->stack_height();
-      while (!register_moves.empty()) {
+      while (!register_moves_.empty()) {
         int executed_moves = 0;
-        for (auto& rm : register_moves) {
+        for (auto& rm : register_moves_) {
           if (src_reg_use_count[rm.dst.liftoff_code()] == 0) {
-            asm_->Move(rm.dst, rm.src);
+            asm_->Move(rm.dst, rm.src, rm.type);
             ++executed_moves;
             DCHECK_LT(0, src_reg_use_count[rm.src.liftoff_code()]);
             --src_reg_use_count[rm.src.liftoff_code()];
@@ -89,53 +116,64 @@ class StackTransferRecipe {
         if (executed_moves == 0) {
           // There is a cycle. Spill one register, then continue.
           // TODO(clemensh): Use an unused register if available.
-          LiftoffRegister spill_reg = register_moves.back().src;
-          asm_->Spill(next_spill_slot, spill_reg);
+          RegisterMove& rm = register_moves_.back();
+          LiftoffRegister spill_reg = rm.src;
+          asm_->Spill(next_spill_slot, spill_reg, rm.type);
           // Remember to reload into the destination register later.
-          LoadStackSlot(register_moves.back().dst, next_spill_slot);
+          LoadStackSlot(register_moves_.back().dst, next_spill_slot, rm.type);
           DCHECK_EQ(1, src_reg_use_count[spill_reg.liftoff_code()]);
           src_reg_use_count[spill_reg.liftoff_code()] = 0;
           ++next_spill_slot;
           executed_moves = 1;
         }
-        register_moves.erase(register_moves.end() - executed_moves,
-                             register_moves.end());
+        register_moves_.erase(register_moves_.end() - executed_moves,
+                              register_moves_.end());
       }
     }
 
-    for (RegisterLoad& rl : register_loads) {
-      if (rl.is_constant_load) {
-        asm_->LoadConstant(rl.dst, rl.constant);
-      } else {
-        asm_->Fill(rl.dst, rl.stack_slot);
+    for (RegisterLoad& rl : register_loads_) {
+      switch (rl.kind) {
+        case RegisterLoad::kConstant:
+          asm_->LoadConstant(rl.dst, rl.type == kWasmI64
+                                         ? WasmValue(int64_t{rl.value})
+                                         : WasmValue(int32_t{rl.value}));
+          break;
+        case RegisterLoad::kStack:
+          asm_->Fill(rl.dst, rl.value, rl.type);
+          break;
+        case RegisterLoad::kHalfStack:
+          // As half of a register pair, {rl.dst} must be a gp register.
+          asm_->FillI64Half(rl.dst.gp(), rl.value);
+          break;
       }
     }
-    register_loads.clear();
+    register_loads_.clear();
   }
 
   void TransferStackSlot(const LiftoffAssembler::CacheState& dst_state,
                          uint32_t dst_index, uint32_t src_index) {
     const VarState& dst = dst_state.stack_state[dst_index];
     const VarState& src = __ cache_state()->stack_state[src_index];
+    DCHECK_EQ(dst.type(), src.type());
     switch (dst.loc()) {
       case VarState::kStack:
         switch (src.loc()) {
           case VarState::kStack:
             if (src_index == dst_index) break;
-            asm_->MoveStackValue(dst_index, src_index);
+            asm_->MoveStackValue(dst_index, src_index, src.type());
             break;
           case VarState::kRegister:
-            asm_->Spill(dst_index, src.reg());
+            asm_->Spill(dst_index, src.reg(), src.type());
             break;
-          case VarState::kI32Const:
-            asm_->Spill(dst_index, WasmValue(src.i32_const()));
+          case VarState::KIntConst:
+            asm_->Spill(dst_index, src.constant());
             break;
         }
         break;
       case VarState::kRegister:
         LoadIntoRegister(dst.reg(), src, src_index);
         break;
-      case VarState::kI32Const:
+      case VarState::KIntConst:
         DCHECK_EQ(dst, src);
         break;
     }
@@ -146,40 +184,80 @@ class StackTransferRecipe {
                         uint32_t src_index) {
     switch (src.loc()) {
       case VarState::kStack:
-        LoadStackSlot(dst, src_index);
+        LoadStackSlot(dst, src_index, src.type());
         break;
       case VarState::kRegister:
         DCHECK_EQ(dst.reg_class(), src.reg_class());
-        if (dst != src.reg()) MoveRegister(dst, src.reg());
+        if (dst != src.reg()) MoveRegister(dst, src.reg(), src.type());
+        break;
+      case VarState::KIntConst:
+        LoadConstant(dst, src.constant());
+        break;
+    }
+  }
+
+  void LoadI64HalfIntoRegister(LiftoffRegister dst,
+                               const LiftoffAssembler::VarState& src,
+                               uint32_t index, RegPairHalf half) {
+    // Use CHECK such that the remaining code is statically dead if
+    // {kNeedI64RegPair} is false.
+    CHECK(kNeedI64RegPair);
+    DCHECK_EQ(kWasmI64, src.type());
+    switch (src.loc()) {
+      case VarState::kStack:
+        LoadI64HalfStackSlot(dst, 2 * index - (half == kLowWord ? 0 : 1));
         break;
-      case VarState::kI32Const:
-        LoadConstant(dst, WasmValue(src.i32_const()));
+      case VarState::kRegister: {
+        LiftoffRegister src_half =
+            half == kLowWord ? src.reg().low() : src.reg().high();
+        if (dst != src_half) MoveRegister(dst, src_half, kWasmI32);
+        break;
+      }
+      case VarState::KIntConst:
+        int32_t value = src.i32_const();
+        // The high word is the sign extension of the low word.
+        if (half == kHighWord) value = value >> 31;
+        LoadConstant(dst, WasmValue(value));
         break;
     }
   }
 
-  void MoveRegister(LiftoffRegister dst, LiftoffRegister src) {
+  void MoveRegister(LiftoffRegister dst, LiftoffRegister src, ValueType type) {
     DCHECK_NE(dst, src);
-    DCHECK(!move_dst_regs.has(dst));
-    move_dst_regs.set(dst);
-    move_src_regs.set(src);
-    register_moves.emplace_back(dst, src);
+    DCHECK_EQ(dst.reg_class(), src.reg_class());
+    DCHECK_EQ(reg_class_for(type), src.reg_class());
+    if (src.is_pair()) {
+      DCHECK_EQ(kWasmI64, type);
+      if (dst.low() != src.low()) MoveRegister(dst.low(), src.low(), kWasmI32);
+      if (dst.high() != src.high())
+        MoveRegister(dst.high(), src.high(), kWasmI32);
+      return;
+    }
+    DCHECK(!move_dst_regs_.has(dst));
+    move_dst_regs_.set(dst);
+    move_src_regs_.set(src);
+    register_moves_.emplace_back(dst, src, type);
   }
 
   void LoadConstant(LiftoffRegister dst, WasmValue value) {
-    register_loads.emplace_back(dst, value);
+    register_loads_.push_back(RegisterLoad::Const(dst, value));
+  }
+
+  void LoadStackSlot(LiftoffRegister dst, uint32_t stack_index,
+                     ValueType type) {
+    register_loads_.push_back(RegisterLoad::Stack(dst, stack_index, type));
   }
 
-  void LoadStackSlot(LiftoffRegister dst, uint32_t stack_index) {
-    register_loads.emplace_back(dst, stack_index);
+  void LoadI64HalfStackSlot(LiftoffRegister dst, uint32_t half_stack_index) {
+    register_loads_.push_back(RegisterLoad::HalfStack(dst, half_stack_index));
   }
 
  private:
   // TODO(clemensh): Avoid unconditionally allocating on the heap.
-  std::vector<RegisterMove> register_moves;
-  std::vector<RegisterLoad> register_loads;
-  LiftoffRegList move_dst_regs;
-  LiftoffRegList move_src_regs;
+  std::vector<RegisterMove> register_moves_;
+  std::vector<RegisterLoad> register_loads_;
+  LiftoffRegList move_dst_regs_;
+  LiftoffRegList move_src_regs_;
   LiftoffAssembler* const asm_;
 };
 
@@ -260,7 +338,7 @@ void LiftoffAssembler::CacheState::Split(const CacheState& source) {
 // TODO(clemensh): Provide a reasonably sized buffer, based on wasm function
 // size.
 LiftoffAssembler::LiftoffAssembler(Isolate* isolate)
-    : TurboAssembler(isolate, nullptr, 0, CodeObjectRequired::kYes) {}
+    : TurboAssembler(isolate, nullptr, 0, CodeObjectRequired::kNo) {}
 
 LiftoffAssembler::~LiftoffAssembler() {
   if (num_locals_ > kInlineLocalTypes) {
@@ -268,49 +346,25 @@ LiftoffAssembler::~LiftoffAssembler() {
   }
 }
 
-LiftoffRegister LiftoffAssembler::GetBinaryOpTargetRegister(
-    RegClass rc, LiftoffRegList pinned) {
-  auto& slot_lhs = *(cache_state_.stack_state.end() - 2);
-  if (slot_lhs.is_reg() && GetNumUses(slot_lhs.reg()) == 1) {
-    DCHECK_EQ(rc, slot_lhs.reg().reg_class());
-    return slot_lhs.reg();
-  }
-  auto& slot_rhs = *(cache_state_.stack_state.end() - 1);
-  if (slot_rhs.is_reg() && GetNumUses(slot_rhs.reg()) == 1) {
-    DCHECK_EQ(rc, slot_rhs.reg().reg_class());
-    return slot_rhs.reg();
-  }
-  return GetUnusedRegister(rc, pinned);
-}
-
-LiftoffRegister LiftoffAssembler::GetUnaryOpTargetRegister(
-    RegClass rc, LiftoffRegList pinned) {
-  auto& slot_src = cache_state_.stack_state.back();
-  if (slot_src.is_reg() && GetNumUses(slot_src.reg()) == 1) {
-    DCHECK_EQ(rc, slot_src.reg().reg_class());
-    return slot_src.reg();
-  }
-  return GetUnusedRegister(rc, pinned);
-}
-
-LiftoffRegister LiftoffAssembler::PopToRegister(RegClass rc,
-                                                LiftoffRegList pinned) {
+LiftoffRegister LiftoffAssembler::PopToRegister(LiftoffRegList pinned) {
   DCHECK(!cache_state_.stack_state.empty());
   VarState slot = cache_state_.stack_state.back();
   cache_state_.stack_state.pop_back();
   switch (slot.loc()) {
     case VarState::kStack: {
-      LiftoffRegister reg = GetUnusedRegister(rc, pinned);
-      Fill(reg, cache_state_.stack_height());
+      LiftoffRegister reg =
+          GetUnusedRegister(reg_class_for(slot.type()), pinned);
+      Fill(reg, cache_state_.stack_height(), slot.type());
       return reg;
     }
     case VarState::kRegister:
-      DCHECK_EQ(rc, slot.reg_class());
       cache_state_.dec_used(slot.reg());
       return slot.reg();
-    case VarState::kI32Const: {
+    case VarState::KIntConst: {
+      RegClass rc =
+          kNeedI64RegPair && slot.type() == kWasmI64 ? kGpRegPair : kGpReg;
       LiftoffRegister reg = GetUnusedRegister(rc, pinned);
-      LoadConstant(reg, WasmValue(slot.i32_const()));
+      LoadConstant(reg, slot.constant());
       return reg;
     }
   }
@@ -335,6 +389,8 @@ void LiftoffAssembler::MergeStackWith(CacheState& target, uint32_t arity) {
   //             ^target_stack_base
   uint32_t stack_height = cache_state_.stack_height();
   uint32_t target_stack_height = target.stack_height();
+  DCHECK_LE(target_stack_height, stack_height);
+  DCHECK_LE(arity, target_stack_height);
   uint32_t stack_base = stack_height - arity;
   uint32_t target_stack_base = target_stack_height - arity;
   StackTransferRecipe transfers(this);
@@ -352,11 +408,11 @@ void LiftoffAssembler::Spill(uint32_t index) {
     case VarState::kStack:
       return;
     case VarState::kRegister:
-      Spill(index, slot.reg());
+      Spill(index, slot.reg(), slot.type());
       cache_state_.dec_used(slot.reg());
       break;
-    case VarState::kI32Const:
-      Spill(index, WasmValue(slot.i32_const()));
+    case VarState::KIntConst:
+      Spill(index, slot.constant());
       break;
   }
   slot.MakeStack();
@@ -372,19 +428,17 @@ void LiftoffAssembler::SpillAllRegisters() {
   for (uint32_t i = 0, e = cache_state_.stack_height(); i < e; ++i) {
     auto& slot = cache_state_.stack_state[i];
     if (!slot.is_reg()) continue;
-    Spill(i, slot.reg());
+    Spill(i, slot.reg(), slot.type());
     slot.MakeStack();
   }
   cache_state_.reset_used_registers();
 }
 
 void LiftoffAssembler::PrepareCall(wasm::FunctionSig* sig,
-                                   compiler::CallDescriptor* call_desc) {
+                                   compiler::CallDescriptor* call_descriptor,
+                                   Register* target,
+                                   LiftoffRegister* explicit_context) {
   uint32_t num_params = static_cast<uint32_t>(sig->parameter_count());
-  // Parameter 0 is the wasm context.
-  constexpr size_t kFirstActualParameter = 1;
-  DCHECK_EQ(kFirstActualParameter + num_params, call_desc->ParameterCount());
-
   // Input 0 is the call target.
   constexpr size_t kInputShift = 1;
 
@@ -394,66 +448,135 @@ void LiftoffAssembler::PrepareCall(wasm::FunctionSig* sig,
        idx < end; ++idx) {
     VarState& slot = cache_state_.stack_state[idx];
     if (!slot.is_reg()) continue;
-    Spill(idx, slot.reg());
+    Spill(idx, slot.reg(), slot.type());
     slot.MakeStack();
   }
 
   StackTransferRecipe stack_transfers(this);
+  LiftoffRegList param_regs;
+
+  // Move the explicit context (if any) into the correct context register.
+  compiler::LinkageLocation context_loc =
+      call_descriptor->GetInputLocation(kInputShift);
+  DCHECK(context_loc.IsRegister() && !context_loc.IsAnyRegister());
+  LiftoffRegister context_reg(Register::from_code(context_loc.AsRegister()));
+  param_regs.set(context_reg);
+  if (explicit_context && *explicit_context != context_reg) {
+    stack_transfers.MoveRegister(context_reg, *explicit_context, kWasmIntPtr);
+  }
 
   // Now move all parameter values into the right slot for the call.
-  // Process parameters backward, such that we can just pop values from the
-  // stack.
+  // Don't pop values yet, such that the stack height is still correct when
+  // executing the {stack_transfers}.
+  // Process parameters backwards, such that pushes of caller frame slots are
+  // in the correct order.
+  uint32_t param_base = cache_state_.stack_height() - num_params;
+  uint32_t call_desc_input_idx =
+      static_cast<uint32_t>(call_descriptor->InputCount());
   for (uint32_t i = num_params; i > 0; --i) {
-    uint32_t param = i - 1;
+    const uint32_t param = i - 1;
     ValueType type = sig->GetParam(param);
-    RegClass rc = reg_class_for(type);
-    compiler::LinkageLocation loc = call_desc->GetInputLocation(
-        param + kFirstActualParameter + kInputShift);
-    const VarState& slot = cache_state_.stack_state.back();
-    uint32_t stack_idx = cache_state_.stack_height() - 1;
-    if (loc.IsRegister()) {
-      DCHECK(!loc.IsAnyRegister());
-      int reg_code = loc.AsRegister();
-      LiftoffRegister reg = LiftoffRegister::from_code(rc, reg_code);
-      stack_transfers.LoadIntoRegister(reg, slot, stack_idx);
+    const bool is_pair = kNeedI64RegPair && type == kWasmI64;
+    const int num_lowered_params = is_pair ? 2 : 1;
+    const uint32_t stack_idx = param_base + param;
+    const VarState& slot = cache_state_.stack_state[stack_idx];
+    // Process both halfs of register pair separately, because they are passed
+    // as separate parameters. One or both of them could end up on the stack.
+    for (int lowered_idx = 0; lowered_idx < num_lowered_params; ++lowered_idx) {
+      const RegPairHalf half =
+          is_pair && lowered_idx == 0 ? kHighWord : kLowWord;
+      --call_desc_input_idx;
+      compiler::LinkageLocation loc =
+          call_descriptor->GetInputLocation(call_desc_input_idx);
+      if (loc.IsRegister()) {
+        DCHECK(!loc.IsAnyRegister());
+        RegClass rc = is_pair ? kGpReg : reg_class_for(type);
+        LiftoffRegister reg = LiftoffRegister::from_code(rc, loc.AsRegister());
+        param_regs.set(reg);
+        if (is_pair) {
+          stack_transfers.LoadI64HalfIntoRegister(reg, slot, stack_idx, half);
+        } else {
+          stack_transfers.LoadIntoRegister(reg, slot, stack_idx);
+        }
+      } else {
+        DCHECK(loc.IsCallerFrameSlot());
+        PushCallerFrameSlot(slot, stack_idx, half);
+      }
+    }
+  }
+  // {call_desc_input_idx} should point after the context parameter now.
+  DCHECK_EQ(call_desc_input_idx, kInputShift + 1);
+
+  // If the target register overlaps with a parameter register, then move the
+  // target to another free register, or spill to the stack.
+  if (target && param_regs.has(LiftoffRegister(*target))) {
+    // Try to find another free register.
+    LiftoffRegList free_regs = kGpCacheRegList.MaskOut(param_regs);
+    if (!free_regs.is_empty()) {
+      LiftoffRegister new_target = free_regs.GetFirstRegSet();
+      stack_transfers.MoveRegister(new_target, LiftoffRegister(*target),
+                                   kWasmIntPtr);
+      *target = new_target.gp();
     } else {
-      DCHECK(loc.IsCallerFrameSlot());
-      PushCallerFrameSlot(slot, stack_idx);
+      PushCallerFrameSlot(LiftoffRegister(*target), kWasmIntPtr);
+      *target = no_reg;
     }
-    cache_state_.stack_state.pop_back();
   }
 
   // Execute the stack transfers before filling the context register.
   stack_transfers.Execute();
 
+  // Pop parameters from the value stack.
+  auto stack_end = cache_state_.stack_state.end();
+  cache_state_.stack_state.erase(stack_end - num_params, stack_end);
+
   // Reset register use counters.
   cache_state_.reset_used_registers();
 
-  // Fill the wasm context into the right register.
-  compiler::LinkageLocation context_loc =
-      call_desc->GetInputLocation(kInputShift);
-  DCHECK(context_loc.IsRegister() && !context_loc.IsAnyRegister());
-  int context_reg_code = context_loc.AsRegister();
-  LiftoffRegister context_reg(Register::from_code(context_reg_code));
-  FillContextInto(context_reg.gp());
+  // Reload the context from the stack.
+  if (!explicit_context) {
+    FillContextInto(context_reg.gp());
+  }
 }
 
 void LiftoffAssembler::FinishCall(wasm::FunctionSig* sig,
-                                  compiler::CallDescriptor* call_desc) {
-  size_t return_count = call_desc->ReturnCount();
-  DCHECK_EQ(return_count, sig->return_count());
+                                  compiler::CallDescriptor* call_descriptor) {
+  const size_t return_count = sig->return_count();
   if (return_count != 0) {
     DCHECK_EQ(1, return_count);
-    compiler::LinkageLocation return_loc = call_desc->GetReturnLocation(0);
-    int return_reg_code = return_loc.AsRegister();
     ValueType return_type = sig->GetReturn(0);
-    LiftoffRegister return_reg =
-        LiftoffRegister::from_code(reg_class_for(return_type), return_reg_code);
+    const bool need_pair = kNeedI64RegPair && return_type == kWasmI64;
+    DCHECK_EQ(need_pair ? 2 : 1, call_descriptor->ReturnCount());
+    RegClass rc = need_pair ? kGpReg : reg_class_for(return_type);
+    LiftoffRegister return_reg = LiftoffRegister::from_code(
+        rc, call_descriptor->GetReturnLocation(0).AsRegister());
+    DCHECK(GetCacheRegList(rc).has(return_reg));
+    if (need_pair) {
+      LiftoffRegister high_reg = LiftoffRegister::from_code(
+          rc, call_descriptor->GetReturnLocation(1).AsRegister());
+      DCHECK(GetCacheRegList(rc).has(high_reg));
+      return_reg = LiftoffRegister::ForPair(return_reg.gp(), high_reg.gp());
+    }
     DCHECK(!cache_state_.is_used(return_reg));
     PushRegister(return_type, return_reg);
   }
 }
 
+void LiftoffAssembler::Move(LiftoffRegister dst, LiftoffRegister src,
+                            ValueType type) {
+  DCHECK_EQ(dst.reg_class(), src.reg_class());
+  DCHECK_NE(dst, src);
+  if (kNeedI64RegPair && dst.is_pair()) {
+    // Use the {StackTransferRecipe} to move pairs, as the registers in the
+    // pairs might overlap.
+    StackTransferRecipe(this).MoveRegister(dst, src, type);
+  } else if (dst.is_gp()) {
+    Move(dst.gp(), src.gp(), type);
+  } else {
+    Move(dst.fp(), src.fp(), type);
+  }
+}
+
 LiftoffRegister LiftoffAssembler::SpillOneRegister(LiftoffRegList candidates,
                                                    LiftoffRegList pinned) {
   // Spill one cached value to free a register.
@@ -468,8 +591,14 @@ void LiftoffAssembler::SpillRegister(LiftoffRegister reg) {
   for (uint32_t idx = cache_state_.stack_height() - 1;; --idx) {
     DCHECK_GT(cache_state_.stack_height(), idx);
     auto* slot = &cache_state_.stack_state[idx];
-    if (!slot->is_reg() || slot->reg() != reg) continue;
-    Spill(idx, reg);
+    if (!slot->is_reg() || !slot->reg().overlaps(reg)) continue;
+    if (slot->reg().is_pair()) {
+      // Make sure to decrement *both* registers in a pair, because the
+      // {clear_used} call below only clears one of them.
+      cache_state_.dec_used(slot->reg().low());
+      cache_state_.dec_used(slot->reg().high());
+    }
+    Spill(idx, slot->reg(), slot->type());
     slot->MakeStack();
     if (--remaining_uses == 0) break;
   }
@@ -486,10 +615,6 @@ void LiftoffAssembler::set_num_locals(uint32_t num_locals) {
   }
 }
 
-uint32_t LiftoffAssembler::GetTotalFrameSlotCount() const {
-  return num_locals() + kMaxValueStackHeight;
-}
-
 std::ostream& operator<<(std::ostream& os, VarState slot) {
   os << WasmOpcodes::TypeName(slot.type()) << ":";
   switch (slot.loc()) {
@@ -497,7 +622,7 @@ std::ostream& operator<<(std::ostream& os, VarState slot) {
       return os << "s";
     case VarState::kRegister:
       return os << slot.reg();
-    case VarState::kI32Const:
+    case VarState::KIntConst:
       return os << "c" << slot.i32_const();
   }
   UNREACHABLE();
diff --git a/deps/v8/src/wasm/baseline/liftoff-assembler.h b/deps/v8/src/wasm/baseline/liftoff-assembler.h
index b91f6d7c880..104344daa88 100644
--- a/deps/v8/src/wasm/baseline/liftoff-assembler.h
+++ b/deps/v8/src/wasm/baseline/liftoff-assembler.h
@@ -8,8 +8,6 @@
 #include <iosfwd>
 #include <memory>
 
-// Clients of this interface shouldn't depend on lots of compiler internals.
-// Do not include anything from src/compiler here!
 #include "src/base/bits.h"
 #include "src/frames.h"
 #include "src/macro-assembler.h"
@@ -29,35 +27,35 @@ struct ModuleEnv;
 
 class LiftoffAssembler : public TurboAssembler {
  public:
-  // TODO(clemensh): Remove this limitation by allocating more stack space if
-  // needed.
-  static constexpr int kMaxValueStackHeight = 8;
-
   // Each slot in our stack frame currently has exactly 8 bytes.
   static constexpr uint32_t kStackSlotSize = 8;
 
+  static constexpr ValueType kWasmIntPtr =
+      kPointerSize == 8 ? kWasmI64 : kWasmI32;
+
   class VarState {
    public:
-    enum Location : uint8_t { kStack, kRegister, kI32Const };
+    enum Location : uint8_t { kStack, kRegister, KIntConst };
 
     explicit VarState(ValueType type) : loc_(kStack), type_(type) {}
     explicit VarState(ValueType type, LiftoffRegister r)
         : loc_(kRegister), type_(type), reg_(r) {
       DCHECK_EQ(r.reg_class(), reg_class_for(type));
     }
-    explicit VarState(ValueType type, uint32_t i32_const)
-        : loc_(kI32Const), type_(type), i32_const_(i32_const) {
+    explicit VarState(ValueType type, int32_t i32_const)
+        : loc_(KIntConst), type_(type), i32_const_(i32_const) {
       DCHECK(type_ == kWasmI32 || type_ == kWasmI64);
     }
 
     bool operator==(const VarState& other) const {
       if (loc_ != other.loc_) return false;
+      if (type_ != other.type_) return false;
       switch (loc_) {
         case kStack:
           return true;
         case kRegister:
           return reg_ == other.reg_;
-        case kI32Const:
+        case KIntConst:
           return i32_const_ == other.i32_const_;
       }
       UNREACHABLE();
@@ -67,16 +65,23 @@ class LiftoffAssembler : public TurboAssembler {
     bool is_gp_reg() const { return loc_ == kRegister && reg_.is_gp(); }
     bool is_fp_reg() const { return loc_ == kRegister && reg_.is_fp(); }
     bool is_reg() const { return loc_ == kRegister; }
-    bool is_const() const { return loc_ == kI32Const; }
+    bool is_const() const { return loc_ == KIntConst; }
 
     ValueType type() const { return type_; }
 
     Location loc() const { return loc_; }
 
-    uint32_t i32_const() const {
-      DCHECK_EQ(loc_, kI32Const);
+    int32_t i32_const() const {
+      DCHECK_EQ(loc_, KIntConst);
       return i32_const_;
     }
+    WasmValue constant() const {
+      DCHECK(type_ == kWasmI32 || type_ == kWasmI64);
+      DCHECK_EQ(loc_, KIntConst);
+      return type_ == kWasmI32 ? WasmValue(i32_const_)
+                               : WasmValue(int64_t{i32_const_});
+    }
+
     Register gp_reg() const { return reg().gp(); }
     DoubleRegister fp_reg() const { return reg().fp(); }
     LiftoffRegister reg() const {
@@ -95,12 +100,11 @@ class LiftoffAssembler : public TurboAssembler {
 
     union {
       LiftoffRegister reg_;  // used if loc_ == kRegister
-      uint32_t i32_const_;   // used if loc_ == kI32Const
+      int32_t i32_const_;    // used if loc_ == KIntConst
     };
   };
 
-  static_assert(IS_TRIVIALLY_COPYABLE(VarState),
-                "VarState should be trivially copyable");
+  ASSERT_TRIVIALLY_COPYABLE(VarState);
 
   struct CacheState {
     // Allow default construction, move construction, and move assignment.
@@ -117,6 +121,11 @@ class LiftoffAssembler : public TurboAssembler {
     uint32_t stack_base = 0;
 
     bool has_unused_register(RegClass rc, LiftoffRegList pinned = {}) const {
+      if (kNeedI64RegPair && rc == kGpRegPair) {
+        LiftoffRegList available_regs =
+            kGpCacheRegList & ~used_registers & ~pinned;
+        return available_regs.GetNumRegsSet() >= 2;
+      }
       DCHECK(rc == kGpReg || rc == kFpReg);
       LiftoffRegList candidates = GetCacheRegList(rc);
       return has_unused_register(candidates, pinned);
@@ -130,9 +139,14 @@ class LiftoffAssembler : public TurboAssembler {
 
     LiftoffRegister unused_register(RegClass rc,
                                     LiftoffRegList pinned = {}) const {
+      if (kNeedI64RegPair && rc == kGpRegPair) {
+        Register low = pinned.set(unused_register(kGpReg, pinned)).gp();
+        Register high = unused_register(kGpReg, pinned).gp();
+        return LiftoffRegister::ForPair(low, high);
+      }
       DCHECK(rc == kGpReg || rc == kFpReg);
       LiftoffRegList candidates = GetCacheRegList(rc);
-      return unused_register(candidates);
+      return unused_register(candidates, pinned);
     }
 
     LiftoffRegister unused_register(LiftoffRegList candidates,
@@ -142,28 +156,42 @@ class LiftoffAssembler : public TurboAssembler {
     }
 
     void inc_used(LiftoffRegister reg) {
+      if (reg.is_pair()) {
+        inc_used(reg.low());
+        inc_used(reg.high());
+        return;
+      }
       used_registers.set(reg);
       DCHECK_GT(kMaxInt, register_use_count[reg.liftoff_code()]);
       ++register_use_count[reg.liftoff_code()];
     }
 
     // Returns whether this was the last use.
-    bool dec_used(LiftoffRegister reg) {
+    void dec_used(LiftoffRegister reg) {
       DCHECK(is_used(reg));
+      if (reg.is_pair()) {
+        dec_used(reg.low());
+        dec_used(reg.high());
+        return;
+      }
       int code = reg.liftoff_code();
       DCHECK_LT(0, register_use_count[code]);
-      if (--register_use_count[code] != 0) return false;
-      used_registers.clear(reg);
-      return true;
+      if (--register_use_count[code] == 0) used_registers.clear(reg);
     }
 
     bool is_used(LiftoffRegister reg) const {
+      if (reg.is_pair()) return is_used(reg.low()) || is_used(reg.high());
       bool used = used_registers.has(reg);
       DCHECK_EQ(used, register_use_count[reg.liftoff_code()] != 0);
       return used;
     }
 
     uint32_t get_use_count(LiftoffRegister reg) const {
+      if (reg.is_pair()) {
+        DCHECK_EQ(register_use_count[reg.low().liftoff_code()],
+                  register_use_count[reg.high().liftoff_code()]);
+        reg = reg.low();
+      }
       DCHECK_GT(arraysize(register_use_count), reg.liftoff_code());
       return register_use_count[reg.liftoff_code()];
     }
@@ -218,12 +246,7 @@ class LiftoffAssembler : public TurboAssembler {
   explicit LiftoffAssembler(Isolate* isolate);
   ~LiftoffAssembler();
 
-  LiftoffRegister GetBinaryOpTargetRegister(RegClass,
-                                            LiftoffRegList pinned = {});
-  LiftoffRegister GetUnaryOpTargetRegister(RegClass,
-                                           LiftoffRegList pinned = {});
-
-  LiftoffRegister PopToRegister(RegClass, LiftoffRegList pinned = {});
+  LiftoffRegister PopToRegister(LiftoffRegList pinned = {});
 
   void PushRegister(ValueType type, LiftoffRegister reg) {
     DCHECK_EQ(reg_class_for(type), reg.reg_class());
@@ -237,8 +260,26 @@ class LiftoffAssembler : public TurboAssembler {
     return cache_state_.get_use_count(reg);
   }
 
+  // Get an unused register for class {rc}, reusing one of {try_first} if
+  // possible.
+  LiftoffRegister GetUnusedRegister(
+      RegClass rc, std::initializer_list<LiftoffRegister> try_first,
+      LiftoffRegList pinned = {}) {
+    for (LiftoffRegister reg : try_first) {
+      DCHECK_EQ(reg.reg_class(), rc);
+      if (cache_state_.is_free(reg)) return reg;
+    }
+    return GetUnusedRegister(rc, pinned);
+  }
+
   // Get an unused register for class {rc}, potentially spilling to free one.
   LiftoffRegister GetUnusedRegister(RegClass rc, LiftoffRegList pinned = {}) {
+    if (kNeedI64RegPair && rc == kGpRegPair) {
+      LiftoffRegList candidates = kGpCacheRegList;
+      Register low = pinned.set(GetUnusedRegister(candidates, pinned)).gp();
+      Register high = GetUnusedRegister(candidates, pinned).gp();
+      return LiftoffRegister::ForPair(low, high);
+    }
     DCHECK(rc == kGpReg || rc == kFpReg);
     LiftoffRegList candidates = GetCacheRegList(rc);
     return GetUnusedRegister(candidates, pinned);
@@ -270,18 +311,36 @@ class LiftoffAssembler : public TurboAssembler {
   void SpillLocals();
   void SpillAllRegisters();
 
+  // Call this method whenever spilling something, such that the number of used
+  // spill slot can be tracked and the stack frame will be allocated big enough.
+  void RecordUsedSpillSlot(uint32_t index) {
+    if (index >= num_used_spill_slots_) num_used_spill_slots_ = index + 1;
+  }
+
   // Load parameters into the right registers / stack slots for the call.
-  void PrepareCall(wasm::FunctionSig*, compiler::CallDescriptor*);
+  // Move {*target} into another register if needed and update {*target} to that
+  // register, or {no_reg} if target was spilled to the stack.
+  void PrepareCall(wasm::FunctionSig*, compiler::CallDescriptor*,
+                   Register* target = nullptr,
+                   LiftoffRegister* explicit_context = nullptr);
   // Process return values of the call.
   void FinishCall(wasm::FunctionSig*, compiler::CallDescriptor*);
 
+  void Move(LiftoffRegister dst, LiftoffRegister src, ValueType);
+
   ////////////////////////////////////
   // Platform-specific part.        //
   ////////////////////////////////////
 
-  inline void ReserveStackSpace(uint32_t bytes);
+  // This function emits machine code to prepare the stack frame, before the
+  // size of the stack frame is known. It returns an offset in the machine code
+  // which can later be patched (via {PatchPrepareStackFrame)} when the size of
+  // the frame is known.
+  inline uint32_t PrepareStackFrame();
+  inline void PatchPrepareStackFrame(uint32_t offset, uint32_t stack_slots);
 
-  inline void LoadConstant(LiftoffRegister, WasmValue);
+  inline void LoadConstant(LiftoffRegister, WasmValue,
+                           RelocInfo::Mode rmode = RelocInfo::NONE);
   inline void LoadFromContext(Register dst, uint32_t offset, int size);
   inline void SpillContext(Register context);
   inline void FillContextInto(Register dst);
@@ -291,16 +350,21 @@ class LiftoffAssembler : public TurboAssembler {
   inline void Store(Register dst_addr, Register offset_reg, uint32_t offset_imm,
                     LiftoffRegister src, StoreType type, LiftoffRegList pinned,
                     uint32_t* protected_store_pc = nullptr);
-  inline void LoadCallerFrameSlot(LiftoffRegister, uint32_t caller_slot_idx);
-  inline void MoveStackValue(uint32_t dst_index, uint32_t src_index);
+  inline void LoadCallerFrameSlot(LiftoffRegister, uint32_t caller_slot_idx,
+                                  ValueType);
+  inline void MoveStackValue(uint32_t dst_index, uint32_t src_index, ValueType);
 
-  inline void MoveToReturnRegister(LiftoffRegister);
-  // TODO(clemensh): Pass the type to {Move}, to emit more efficient code.
-  inline void Move(LiftoffRegister dst, LiftoffRegister src);
+  inline void MoveToReturnRegister(LiftoffRegister src, ValueType);
+  inline void Move(Register dst, Register src, ValueType);
+  inline void Move(DoubleRegister dst, DoubleRegister src, ValueType);
 
-  inline void Spill(uint32_t index, LiftoffRegister);
+  inline void Spill(uint32_t index, LiftoffRegister, ValueType);
   inline void Spill(uint32_t index, WasmValue);
-  inline void Fill(LiftoffRegister, uint32_t index);
+  inline void Fill(LiftoffRegister, uint32_t index, ValueType);
+  // Only used on 32-bit systems: Fill a register from a "half stack slot", i.e.
+  // 4 bytes on the stack holding half of a 64-bit value. The two half_indexes
+  // corresponding to slot {index} are {2*index} and {2*index-1}.
+  inline void FillI64Half(Register, uint32_t half_index);
 
   // i32 binops.
   inline void emit_i32_add(Register dst, Register lhs, Register rhs);
@@ -309,29 +373,73 @@ class LiftoffAssembler : public TurboAssembler {
   inline void emit_i32_and(Register dst, Register lhs, Register rhs);
   inline void emit_i32_or(Register dst, Register lhs, Register rhs);
   inline void emit_i32_xor(Register dst, Register lhs, Register rhs);
-  inline void emit_i32_shl(Register dst, Register lhs, Register rhs);
-  inline void emit_i32_sar(Register dst, Register lhs, Register rhs);
-  inline void emit_i32_shr(Register dst, Register lhs, Register rhs);
+  inline void emit_i32_shl(Register dst, Register src, Register amount,
+                           LiftoffRegList pinned = {});
+  inline void emit_i32_sar(Register dst, Register src, Register amount,
+                           LiftoffRegList pinned = {});
+  inline void emit_i32_shr(Register dst, Register src, Register amount,
+                           LiftoffRegList pinned = {});
 
   // i32 unops.
-  inline bool emit_i32_eqz(Register dst, Register src);
   inline bool emit_i32_clz(Register dst, Register src);
   inline bool emit_i32_ctz(Register dst, Register src);
   inline bool emit_i32_popcnt(Register dst, Register src);
 
+  // i64 binops.
+  inline void emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
+                           Register amount, LiftoffRegList pinned = {});
+  inline void emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
+                           Register amount, LiftoffRegList pinned = {});
+  inline void emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
+                           Register amount, LiftoffRegList pinned = {});
+
   inline void emit_ptrsize_add(Register dst, Register lhs, Register rhs);
 
+  // f32 binops.
   inline void emit_f32_add(DoubleRegister dst, DoubleRegister lhs,
                            DoubleRegister rhs);
   inline void emit_f32_sub(DoubleRegister dst, DoubleRegister lhs,
                            DoubleRegister rhs);
   inline void emit_f32_mul(DoubleRegister dst, DoubleRegister lhs,
                            DoubleRegister rhs);
+  inline void emit_f32_div(DoubleRegister dst, DoubleRegister lhs,
+                           DoubleRegister rhs);
+  // f32 unops.
+  inline void emit_f32_abs(DoubleRegister dst, DoubleRegister src);
+  inline void emit_f32_neg(DoubleRegister dst, DoubleRegister src);
+  inline void emit_f32_sqrt(DoubleRegister dst, DoubleRegister src);
+
+  // f64 binops.
+  inline void emit_f64_add(DoubleRegister dst, DoubleRegister lhs,
+                           DoubleRegister rhs);
+  inline void emit_f64_sub(DoubleRegister dst, DoubleRegister lhs,
+                           DoubleRegister rhs);
+  inline void emit_f64_mul(DoubleRegister dst, DoubleRegister lhs,
+                           DoubleRegister rhs);
+  inline void emit_f64_div(DoubleRegister dst, DoubleRegister lhs,
+                           DoubleRegister rhs);
+
+  // f64 unops.
+  inline void emit_f64_abs(DoubleRegister dst, DoubleRegister src);
+  inline void emit_f64_neg(DoubleRegister dst, DoubleRegister src);
+  inline void emit_f64_sqrt(DoubleRegister dst, DoubleRegister src);
+
+  // type conversions.
+  inline bool emit_type_conversion(WasmOpcode opcode, LiftoffRegister dst,
+                                   LiftoffRegister src);
 
-  inline void emit_i32_test(Register);
-  inline void emit_i32_compare(Register, Register);
   inline void emit_jump(Label*);
-  inline void emit_cond_jump(Condition, Label*);
+  inline void emit_cond_jump(Condition, Label*, ValueType value, Register lhs,
+                             Register rhs = no_reg);
+  // Set {dst} to 1 if condition holds, 0 otherwise.
+  inline void emit_i32_eqz(Register dst, Register src);
+  inline void emit_i32_set_cond(Condition, Register dst, Register lhs,
+                                Register rhs);
+  inline void emit_i64_eqz(Register dst, LiftoffRegister src);
+  inline void emit_i64_set_cond(Condition condition, Register dst,
+                                LiftoffRegister lhs, LiftoffRegister rhs);
+  inline void emit_f32_set_cond(Condition condition, Register dst,
+                                DoubleRegister lhs, DoubleRegister rhs);
 
   inline void StackCheck(Label* ool_code);
 
@@ -340,26 +448,40 @@ class LiftoffAssembler : public TurboAssembler {
   inline void AssertUnreachable(AbortReason reason);
 
   // Push a value to the stack (will become a caller frame slot).
-  inline void PushCallerFrameSlot(const VarState& src, uint32_t src_index);
-  inline void PushCallerFrameSlot(LiftoffRegister reg);
+  inline void PushCallerFrameSlot(const VarState& src, uint32_t src_index,
+                                  RegPairHalf half);
+  inline void PushCallerFrameSlot(LiftoffRegister reg, ValueType type);
   inline void PushRegisters(LiftoffRegList);
   inline void PopRegisters(LiftoffRegList);
 
   inline void DropStackSlotsAndRet(uint32_t num_stack_slots);
 
-  // Push arguments on the stack (in the caller frame), then align the stack.
-  // The address of the last argument will be stored to {arg_addr_dst}. Previous
-  // arguments will be located at pointer sized buckets above that address.
-  inline void PrepareCCall(uint32_t num_params, const Register* args);
-  inline void SetCCallRegParamAddr(Register dst, uint32_t param_idx,
-                                   uint32_t num_params);
-  inline void SetCCallStackParamAddr(uint32_t stack_param_idx,
-                                     uint32_t param_idx, uint32_t num_params);
+  // {PrepareCCall} pushes the arguments on the stack (in the caller frame),
+  // then aligns the stack to do a c call. Pointers to the pushed arguments are
+  // later loaded to registers or stack slots via {SetCCall*ParamAddr}. After
+  // the c call, the output parameter (if it exists) can be loaded via
+  // {LoadCCallOutArgument}. {FinishCCall} resets the stack pointer to the state
+  // before {PrepareCCall}.
+  // The {FunctionSig} passed to {PrepareCCall} describes the types of
+  // parameters which are then passed ot the C function via pointers, excluding
+  // the out argument.
+  inline void PrepareCCall(wasm::FunctionSig* sig, const LiftoffRegister* args,
+                           ValueType out_argument_type);
+  inline void SetCCallRegParamAddr(Register dst, int param_byte_offset,
+                                   ValueType type);
+  inline void SetCCallStackParamAddr(int stack_param_idx, int param_byte_offset,
+                                     ValueType type);
+  inline void LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
+                                   int param_byte_offset);
   inline void CallC(ExternalReference ext_ref, uint32_t num_params);
+  inline void FinishCCall();
 
   inline void CallNativeWasmCode(Address addr);
-
   inline void CallRuntime(Zone* zone, Runtime::FunctionId fid);
+  // Indirect call: If {target == no_reg}, then pop the target from the stack.
+  inline void CallIndirect(wasm::FunctionSig* sig,
+                           compiler::CallDescriptor* call_descriptor,
+                           Register target);
 
   // Reserve space in the current frame, store address to space in {addr}.
   inline void AllocateStackSlot(Register addr, uint32_t size);
@@ -372,7 +494,9 @@ class LiftoffAssembler : public TurboAssembler {
   uint32_t num_locals() const { return num_locals_; }
   void set_num_locals(uint32_t num_locals);
 
-  uint32_t GetTotalFrameSlotCount() const;
+  uint32_t GetTotalFrameSlotCount() const {
+    return num_locals_ + num_used_spill_slots_;
+  }
 
   ValueType local_type(uint32_t index) {
     DCHECK_GT(num_locals_, index);
@@ -389,6 +513,9 @@ class LiftoffAssembler : public TurboAssembler {
 
   CacheState* cache_state() { return &cache_state_; }
 
+  bool did_bailout() { return bailout_reason_ != nullptr; }
+  const char* bailout_reason() const { return bailout_reason_; }
+
  private:
   uint32_t num_locals_ = 0;
   static constexpr uint32_t kInlineLocalTypes = 8;
@@ -399,9 +526,15 @@ class LiftoffAssembler : public TurboAssembler {
   static_assert(sizeof(ValueType) == 1,
                 "Reconsider this inlining if ValueType gets bigger");
   CacheState cache_state_;
+  uint32_t num_used_spill_slots_ = 0;
+  const char* bailout_reason_ = nullptr;
 
   LiftoffRegister SpillOneRegister(LiftoffRegList candidates,
                                    LiftoffRegList pinned);
+
+  void bailout(const char* reason) {
+    if (bailout_reason_ == nullptr) bailout_reason_ = reason;
+  }
 };
 
 std::ostream& operator<<(std::ostream& os, LiftoffAssembler::VarState);
diff --git a/deps/v8/src/wasm/baseline/liftoff-compiler.cc b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
index 255ee0347e1..52f30ff6e84 100644
--- a/deps/v8/src/wasm/baseline/liftoff-compiler.cc
+++ b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
@@ -20,7 +20,7 @@ namespace internal {
 namespace wasm {
 
 constexpr auto kRegister = LiftoffAssembler::VarState::kRegister;
-constexpr auto kI32Const = LiftoffAssembler::VarState::kI32Const;
+constexpr auto KIntConst = LiftoffAssembler::VarState::KIntConst;
 constexpr auto kStack = LiftoffAssembler::VarState::kStack;
 
 namespace {
@@ -41,6 +41,8 @@ class MovableLabel {
   Label* get() { return label_.get(); }
   MovableLabel() : MovableLabel(new Label()) {}
 
+  operator bool() const { return label_ != nullptr; }
+
   static MovableLabel None() { return MovableLabel(nullptr); }
 
  private:
@@ -53,6 +55,8 @@ class MovableLabel {
  public:
   Label* get() { return &label_; }
 
+  operator bool() const { return true; }
+
   static MovableLabel None() { return MovableLabel(); }
 
  private:
@@ -60,6 +64,15 @@ class MovableLabel {
 };
 #endif
 
+compiler::CallDescriptor* GetLoweredCallDescriptor(
+    Zone* zone, compiler::CallDescriptor* call_desc) {
+  return kPointerSize == 4 ? compiler::GetI32WasmCallDescriptor(zone, call_desc)
+                           : call_desc;
+}
+
+constexpr ValueType kTypesArr_ilfd[] = {kWasmI32, kWasmI64, kWasmF32, kWasmF64};
+constexpr Vector<const ValueType> kTypes_ilfd = ArrayVector(kTypesArr_ilfd);
+
 class LiftoffCompiler {
  public:
   MOVE_ONLY_NO_DEFAULT_CONSTRUCTOR(LiftoffCompiler);
@@ -106,32 +119,30 @@ class LiftoffCompiler {
   };
 
   LiftoffCompiler(LiftoffAssembler* liftoff_asm,
-                  compiler::CallDescriptor* call_desc, compiler::ModuleEnv* env,
+                  compiler::CallDescriptor* call_descriptor,
+                  compiler::ModuleEnv* env,
                   compiler::RuntimeExceptionSupport runtime_exception_support,
                   SourcePositionTableBuilder* source_position_table_builder,
                   std::vector<trap_handler::ProtectedInstructionData>*
                       protected_instructions,
                   Zone* compilation_zone, std::unique_ptr<Zone>* codegen_zone)
       : asm_(liftoff_asm),
-        call_desc_(call_desc),
+        descriptor_(
+            GetLoweredCallDescriptor(compilation_zone, call_descriptor)),
         env_(env),
-        min_size_(env_->module->initial_pages * wasm::kWasmPageSize),
-        max_size_((env_->module->has_maximum_pages
-                       ? env_->module->maximum_pages
-                       : wasm::kV8MaxWasmMemoryPages) *
+        min_size_(uint64_t{env_->module->initial_pages} * wasm::kWasmPageSize),
+        max_size_(uint64_t{env_->module->has_maximum_pages
+                               ? env_->module->maximum_pages
+                               : wasm::kV8MaxWasmMemoryPages} *
                   wasm::kWasmPageSize),
         runtime_exception_support_(runtime_exception_support),
         source_position_table_builder_(source_position_table_builder),
         protected_instructions_(protected_instructions),
         compilation_zone_(compilation_zone),
         codegen_zone_(codegen_zone),
-        safepoint_table_builder_(compilation_zone_) {
-    // Check for overflow in max_size_.
-    DCHECK_EQ(max_size_, uint64_t{env_->module->has_maximum_pages
-                                      ? env_->module->maximum_pages
-                                      : wasm::kV8MaxWasmMemoryPages} *
-                             wasm::kWasmPageSize);
-  }
+        safepoint_table_builder_(compilation_zone_) {}
+
+  ~LiftoffCompiler() { BindUnboundLabels(nullptr); }
 
   bool ok() const { return ok_; }
 
@@ -142,6 +153,26 @@ class LiftoffCompiler {
     BindUnboundLabels(decoder);
   }
 
+  bool DidAssemblerBailout(Decoder* decoder) {
+    if (decoder->failed() || !asm_->did_bailout()) return false;
+    unsupported(decoder, asm_->bailout_reason());
+    return true;
+  }
+
+  bool CheckSupportedType(Decoder* decoder,
+                          Vector<const ValueType> supported_types,
+                          ValueType type, const char* context) {
+    char buffer[128];
+    // Check supported types.
+    for (ValueType supported : supported_types) {
+      if (type == supported) return true;
+    }
+    SNPrintF(ArrayVector(buffer), "%s %s", WasmOpcodes::TypeName(type),
+             context);
+    unsupported(decoder, buffer);
+    return false;
+  }
+
   int GetSafepointTableOffset() const {
     return safepoint_table_builder_.GetCodeOffset();
   }
@@ -150,7 +181,8 @@ class LiftoffCompiler {
 #ifdef DEBUG
     // Bind all labels now, otherwise their destructor will fire a DCHECK error
     // if they where referenced before.
-    for (uint32_t i = 0, e = decoder->control_depth(); i < e; ++i) {
+    uint32_t control_depth = decoder ? decoder->control_depth() : 0;
+    for (uint32_t i = 0; i < control_depth; ++i) {
       Control* c = decoder->control_at(i);
       Label* label = c->label.get();
       if (!label->is_bound()) __ bind(label);
@@ -165,14 +197,6 @@ class LiftoffCompiler {
 #endif
   }
 
-  void CheckStackSizeLimit(Decoder* decoder) {
-    DCHECK_GE(__ cache_state()->stack_height(), __ num_locals());
-    int stack_height = __ cache_state()->stack_height() - __ num_locals();
-    if (stack_height > LiftoffAssembler::kMaxValueStackHeight) {
-      unsupported(decoder, "value stack grows too large");
-    }
-  }
-
   void StartFunction(Decoder* decoder) {
     int num_locals = decoder->NumLocals();
     __ set_num_locals(num_locals);
@@ -181,37 +205,49 @@ class LiftoffCompiler {
     }
   }
 
-  void ProcessParameter(uint32_t param_idx, uint32_t input_location) {
-    ValueType type = __ local_type(param_idx);
-    RegClass rc = reg_class_for(type);
-    compiler::LinkageLocation param_loc =
-        call_desc_->GetInputLocation(input_location);
-    if (param_loc.IsRegister()) {
-      DCHECK(!param_loc.IsAnyRegister());
-      int reg_code = param_loc.AsRegister();
-      LiftoffRegister reg =
-          rc == kGpReg ? LiftoffRegister(Register::from_code(reg_code))
-                       : LiftoffRegister(DoubleRegister::from_code(reg_code));
-      LiftoffRegList cache_regs =
-          rc == kGpReg ? kGpCacheRegList : kFpCacheRegList;
-      if (cache_regs.has(reg)) {
-        // This is a cache register, just use it.
-        __ PushRegister(type, reg);
-        return;
+  // Returns the number of inputs processed (1 or 2).
+  uint32_t ProcessParameter(ValueType type, uint32_t input_idx) {
+    const int num_lowered_params = 1 + needs_reg_pair(type);
+    // Initialize to anything, will be set in the loop and used afterwards.
+    LiftoffRegister reg = LiftoffRegister::from_code(kGpReg, 0);
+    RegClass rc = num_lowered_params == 1 ? reg_class_for(type) : kGpReg;
+    LiftoffRegList pinned;
+    for (int pair_idx = 0; pair_idx < num_lowered_params; ++pair_idx) {
+      compiler::LinkageLocation param_loc =
+          descriptor_->GetInputLocation(input_idx + pair_idx);
+      // Initialize to anything, will be set in both arms of the if.
+      LiftoffRegister in_reg = LiftoffRegister::from_code(kGpReg, 0);
+      if (param_loc.IsRegister()) {
+        DCHECK(!param_loc.IsAnyRegister());
+        int reg_code = param_loc.AsRegister();
+        RegList cache_regs = rc == kGpReg ? kLiftoffAssemblerGpCacheRegs
+                                          : kLiftoffAssemblerFpCacheRegs;
+        if (cache_regs & (1 << reg_code)) {
+          // This is a cache register, just use it.
+          in_reg = LiftoffRegister::from_code(rc, reg_code);
+        } else {
+          // Move to a cache register (spill one if necessary).
+          // Note that we cannot create a {LiftoffRegister} for reg_code, since
+          // {LiftoffRegister} can only store cache regs.
+          LiftoffRegister in_reg = __ GetUnusedRegister(rc, pinned);
+          if (rc == kGpReg) {
+            __ Move(in_reg.gp(), Register::from_code(reg_code), type);
+          } else {
+            __ Move(in_reg.fp(), DoubleRegister::from_code(reg_code), type);
+          }
+        }
+      } else if (param_loc.IsCallerFrameSlot()) {
+        in_reg = __ GetUnusedRegister(rc, pinned);
+        ValueType lowered_type = num_lowered_params == 1 ? type : kWasmI32;
+        __ LoadCallerFrameSlot(in_reg, -param_loc.AsCallerFrameSlot(),
+                               lowered_type);
       }
-      // Move to a cache register.
-      LiftoffRegister cache_reg = __ GetUnusedRegister(rc);
-      __ Move(cache_reg, reg);
-      __ PushRegister(type, reg);
-      return;
+      reg = pair_idx == 0 ? in_reg
+                          : LiftoffRegister::ForPair(reg.gp(), in_reg.gp());
+      pinned.set(reg);
     }
-    if (param_loc.IsCallerFrameSlot()) {
-      LiftoffRegister tmp_reg = __ GetUnusedRegister(rc);
-      __ LoadCallerFrameSlot(tmp_reg, -param_loc.AsCallerFrameSlot());
-      __ PushRegister(type, tmp_reg);
-      return;
-    }
-    UNREACHABLE();
+    __ PushRegister(type, reg);
+    return num_lowered_params;
   }
 
   void StackCheck(wasm::WasmCodePosition position) {
@@ -220,69 +256,65 @@ class LiftoffCompiler {
         OutOfLineCode::StackCheck(position, __ cache_state()->used_registers));
     OutOfLineCode& ool = out_of_line_code_.back();
     __ StackCheck(ool.label.get());
-    __ bind(ool.continuation.get());
+    if (ool.continuation) __ bind(ool.continuation.get());
   }
 
   void StartFunctionBody(Decoder* decoder, Control* block) {
-    if (!kLiftoffAssemblerImplementedOnThisPlatform) {
-      unsupported(decoder, "platform");
-      return;
-    }
     __ EnterFrame(StackFrame::WASM_COMPILED);
     __ set_has_frame(true);
-    __ ReserveStackSpace(LiftoffAssembler::kStackSlotSize *
-                         __ GetTotalFrameSlotCount());
+    pc_offset_stack_frame_construction_ = __ PrepareStackFrame();
+    // {PrepareStackFrame} is the first platform-specific assembler method.
+    // If this failed, we can bail out immediately, avoiding runtime overhead
+    // and potential failures because of other unimplemented methods.
+    // A platform implementing {PrepareStackFrame} must ensure that we can
+    // finish compilation without errors even if we hit unimplemented
+    // LiftoffAssembler methods.
+    if (DidAssemblerBailout(decoder)) return;
     // Parameter 0 is the wasm context.
     uint32_t num_params =
-        static_cast<uint32_t>(call_desc_->ParameterCount()) - 1;
+        static_cast<uint32_t>(decoder->sig_->parameter_count());
     for (uint32_t i = 0; i < __ num_locals(); ++i) {
-      switch (__ local_type(i)) {
-        case kWasmI32:
-        case kWasmF32:
-          // supported.
-          break;
-        case kWasmI64:
-          unsupported(decoder, "i64 param/local");
-          return;
-        case kWasmF64:
-          unsupported(decoder, "f64 param/local");
-          return;
-        default:
-          unsupported(decoder, "exotic param/local");
-          return;
-      }
+      if (!CheckSupportedType(decoder, kTypes_ilfd, __ local_type(i), "param"))
+        return;
     }
     // Input 0 is the call target, the context is at 1.
     constexpr int kContextParameterIndex = 1;
     // Store the context parameter to a special stack slot.
     compiler::LinkageLocation context_loc =
-        call_desc_->GetInputLocation(kContextParameterIndex);
+        descriptor_->GetInputLocation(kContextParameterIndex);
     DCHECK(context_loc.IsRegister());
     DCHECK(!context_loc.IsAnyRegister());
     Register context_reg = Register::from_code(context_loc.AsRegister());
     __ SpillContext(context_reg);
-    uint32_t param_idx = 0;
-    for (; param_idx < num_params; ++param_idx) {
-      constexpr int kFirstActualParameterIndex = kContextParameterIndex + 1;
-      ProcessParameter(param_idx, param_idx + kFirstActualParameterIndex);
+    // Input 0 is the code target, 1 is the context. First parameter at 2.
+    uint32_t input_idx = kContextParameterIndex + 1;
+    for (uint32_t param_idx = 0; param_idx < num_params; ++param_idx) {
+      input_idx += ProcessParameter(__ local_type(param_idx), input_idx);
     }
+    DCHECK_EQ(input_idx, descriptor_->InputCount());
     // Set to a gp register, to mark this uninitialized.
     LiftoffRegister zero_double_reg(Register::from_code<0>());
     DCHECK(zero_double_reg.is_gp());
-    for (; param_idx < __ num_locals(); ++param_idx) {
+    for (uint32_t param_idx = num_params; param_idx < __ num_locals();
+         ++param_idx) {
       ValueType type = decoder->GetLocalType(param_idx);
       switch (type) {
         case kWasmI32:
           __ cache_state()->stack_state.emplace_back(kWasmI32, uint32_t{0});
           break;
+        case kWasmI64:
+          __ cache_state()->stack_state.emplace_back(kWasmI64, uint32_t{0});
+          break;
         case kWasmF32:
+        case kWasmF64:
           if (zero_double_reg.is_gp()) {
             // Note: This might spill one of the registers used to hold
             // parameters.
             zero_double_reg = __ GetUnusedRegister(kFpReg);
-            __ LoadConstant(zero_double_reg, WasmValue(0.f));
+            // Zero is represented by the bit pattern 0 for both f32 and f64.
+            __ LoadConstant(zero_double_reg, WasmValue(0.));
           }
-          __ PushRegister(kWasmF32, zero_double_reg);
+          __ PushRegister(type, zero_double_reg);
           break;
         default:
           UNIMPLEMENTED();
@@ -294,9 +326,7 @@ class LiftoffCompiler {
     // is never a position of any instruction in the function.
     StackCheck(0);
 
-    DCHECK_EQ(__ num_locals(), param_idx);
     DCHECK_EQ(__ num_locals(), __ cache_state()->stack_height());
-    CheckStackSizeLimit(decoder);
   }
 
   void GenerateOutOfLineCode(OutOfLineCode& ool) {
@@ -338,10 +368,13 @@ class LiftoffCompiler {
   }
 
   void FinishFunction(Decoder* decoder) {
+    if (DidAssemblerBailout(decoder)) return;
     for (OutOfLineCode& ool : out_of_line_code_) {
       GenerateOutOfLineCode(ool);
     }
     safepoint_table_builder_.Emit(asm_, __ GetTotalFrameSlotCount());
+    __ PatchPrepareStackFrame(pc_offset_stack_frame_construction_,
+                              __ GetTotalFrameSlotCount());
   }
 
   void OnFirstError(Decoder* decoder) {
@@ -390,9 +423,9 @@ class LiftoffCompiler {
     if_block->else_state = base::make_unique<ElseState>();
 
     // Test the condition, jump to else if zero.
-    Register value = __ PopToRegister(kGpReg).gp();
-    __ emit_i32_test(value);
-    __ emit_cond_jump(kEqual, if_block->else_state->label.get());
+    Register value = __ PopToRegister().gp();
+    __ emit_cond_jump(kEqual, if_block->else_state->label.get(), kWasmI32,
+                      value);
 
     if_block->label_state.stack_base = __ cache_state()->stack_height();
     // Store the state (after popping the value) for executing the else branch.
@@ -423,170 +456,380 @@ class LiftoffCompiler {
 
   void EndControl(Decoder* decoder, Control* c) {}
 
-  void GenerateCCall(Register res_reg, uint32_t num_args,
-                     const Register* arg_regs, ExternalReference ext_ref) {
-    static constexpr int kNumReturns = 1;
+  enum CCallReturn : bool { kHasReturn = true, kNoReturn = false };
+
+  void GenerateCCall(const LiftoffRegister* result_regs, FunctionSig* sig,
+                     ValueType out_argument_type,
+                     const LiftoffRegister* arg_regs,
+                     ExternalReference ext_ref) {
+    static constexpr int kMaxReturns = 1;
     static constexpr int kMaxArgs = 2;
     static constexpr MachineType kReps[]{
         MachineType::Uint32(), MachineType::Pointer(), MachineType::Pointer()};
-    static_assert(arraysize(kReps) == kNumReturns + kMaxArgs, "mismatch");
+    static_assert(arraysize(kReps) == kMaxReturns + kMaxArgs, "mismatch");
+
+    const bool has_out_argument = out_argument_type != kWasmStmt;
+    const uint32_t num_returns = static_cast<uint32_t>(sig->return_count());
+    // {total_num_args} is {num_args + 1} if the return value is stored in an
+    // out parameter, or {num_args} otherwise.
+    const uint32_t num_args = static_cast<uint32_t>(sig->parameter_count());
+    const uint32_t total_num_args = num_args + has_out_argument;
     DCHECK_LE(num_args, kMaxArgs);
+    DCHECK_LE(num_returns, kMaxReturns);
 
-    MachineSignature sig(kNumReturns, num_args, kReps);
-    compiler::CallDescriptor* desc =
-        compiler::Linkage::GetSimplifiedCDescriptor(compilation_zone_, &sig);
+    MachineSignature machine_sig(num_returns, total_num_args,
+                                 kReps + (kMaxReturns - num_returns));
+    auto* call_descriptor = compiler::Linkage::GetSimplifiedCDescriptor(
+        compilation_zone_, &machine_sig);
 
     // Before making a call, spill all cache registers.
     __ SpillAllRegisters();
 
     // Store arguments on our stack, then align the stack for calling to C.
-    uint32_t num_params = static_cast<uint32_t>(desc->ParameterCount());
-    __ PrepareCCall(num_params, arg_regs);
-
-    // Set parameters (in sp[0], sp[8], ...).
-    uint32_t num_stack_params = 0;
-    for (uint32_t param = 0; param < num_params; ++param) {
-      constexpr size_t kInputShift = 1;  // Input 0 is the call target.
-
+    __ PrepareCCall(sig, arg_regs, out_argument_type);
+
+    // The arguments to the c function are pointers to the stack slots we just
+    // pushed.
+    int num_stack_params = 0;   // Number of stack parameters.
+    int input_idx = 1;          // Input 0 is the call target.
+    int param_byte_offset = 0;  // Byte offset into the pushed arguments.
+    auto add_argument = [&](ValueType arg_type) {
       compiler::LinkageLocation loc =
-          desc->GetInputLocation(param + kInputShift);
+          call_descriptor->GetInputLocation(input_idx);
+      param_byte_offset +=
+          RoundUp<kPointerSize>(WasmOpcodes::MemSize(arg_type));
+      ++input_idx;
       if (loc.IsRegister()) {
         Register reg = Register::from_code(loc.AsRegister());
         // Load address of that parameter to the register.
-        __ SetCCallRegParamAddr(reg, param, num_params);
+        __ SetCCallRegParamAddr(reg, param_byte_offset, arg_type);
       } else {
         DCHECK(loc.IsCallerFrameSlot());
-        __ SetCCallStackParamAddr(num_stack_params, param, num_params);
+        __ SetCCallStackParamAddr(num_stack_params, param_byte_offset,
+                                  arg_type);
         ++num_stack_params;
       }
+    };
+    for (ValueType arg_type : sig->parameters()) {
+      add_argument(arg_type);
+    }
+    if (has_out_argument) {
+      add_argument(out_argument_type);
     }
+    DCHECK_EQ(input_idx, call_descriptor->InputCount());
 
     // Now execute the call.
-    __ CallC(ext_ref, num_params);
+    uint32_t c_call_arg_count =
+        static_cast<uint32_t>(sig->parameter_count()) + has_out_argument;
+    __ CallC(ext_ref, c_call_arg_count);
+
+    // Reset the stack pointer.
+    __ FinishCCall();
 
     // Load return value.
-    compiler::LinkageLocation return_loc = desc->GetReturnLocation(0);
-    DCHECK(return_loc.IsRegister());
-    Register return_reg = Register::from_code(return_loc.AsRegister());
-    if (return_reg != res_reg) {
-      __ Move(LiftoffRegister(res_reg), LiftoffRegister(return_reg));
+    const LiftoffRegister* next_result_reg = result_regs;
+    if (sig->return_count() > 0) {
+      DCHECK_EQ(1, sig->return_count());
+      compiler::LinkageLocation return_loc =
+          call_descriptor->GetReturnLocation(0);
+      DCHECK(return_loc.IsRegister());
+      Register return_reg = Register::from_code(return_loc.AsRegister());
+      if (return_reg != next_result_reg->gp()) {
+        __ Move(*next_result_reg, LiftoffRegister(return_reg),
+                sig->GetReturn(0));
+      }
+      ++next_result_reg;
+    }
+
+    // Load potential return value from output argument.
+    if (has_out_argument) {
+      __ LoadCCallOutArgument(*next_result_reg, out_argument_type,
+                              param_byte_offset);
     }
   }
 
-  void I32UnOp(bool (LiftoffAssembler::*emit_fn)(Register, Register),
-               ExternalReference (*fallback_fn)(Isolate*)) {
+  template <ValueType src_type, ValueType result_type, class EmitFn>
+  void EmitUnOp(EmitFn fn) {
+    static RegClass src_rc = reg_class_for(src_type);
+    static RegClass result_rc = reg_class_for(result_type);
+    LiftoffRegList pinned;
+    LiftoffRegister src = pinned.set(__ PopToRegister(pinned));
+    LiftoffRegister dst = src_rc == result_rc
+                              ? __ GetUnusedRegister(result_rc, {src}, pinned)
+                              : __ GetUnusedRegister(result_rc, pinned);
+    fn(dst, src);
+    __ PushRegister(result_type, dst);
+  }
+
+  void EmitI32UnOpWithCFallback(bool (LiftoffAssembler::*emit_fn)(Register,
+                                                                  Register),
+                                ExternalReference (*fallback_fn)(Isolate*)) {
+    auto emit_with_c_fallback = [=](LiftoffRegister dst, LiftoffRegister src) {
+      if (emit_fn && (asm_->*emit_fn)(dst.gp(), src.gp())) return;
+      ExternalReference ext_ref = fallback_fn(asm_->isolate());
+      ValueType sig_i_i_reps[] = {kWasmI32, kWasmI32};
+      FunctionSig sig_i_i(1, 1, sig_i_i_reps);
+      GenerateCCall(&dst, &sig_i_i, kWasmStmt, &src, ext_ref);
+    };
+    EmitUnOp<kWasmI32, kWasmI32>(emit_with_c_fallback);
+  }
+
+  void EmitTypeConversion(WasmOpcode opcode, ValueType dst_type,
+                          ValueType src_type,
+                          ExternalReference (*fallback_fn)(Isolate*)) {
+    RegClass src_rc = reg_class_for(src_type);
+    RegClass dst_rc = reg_class_for(dst_type);
     LiftoffRegList pinned;
-    LiftoffRegister dst_reg = pinned.set(__ GetUnaryOpTargetRegister(kGpReg));
-    LiftoffRegister src_reg = pinned.set(__ PopToRegister(kGpReg, pinned));
-    if (!emit_fn || !(asm_->*emit_fn)(dst_reg.gp(), src_reg.gp())) {
+    LiftoffRegister src = pinned.set(__ PopToRegister());
+    LiftoffRegister dst = src_rc == dst_rc
+                              ? __ GetUnusedRegister(dst_rc, {src}, pinned)
+                              : __ GetUnusedRegister(dst_rc, pinned);
+    if (!__ emit_type_conversion(opcode, dst, src)) {
+      DCHECK_NOT_NULL(fallback_fn);
       ExternalReference ext_ref = fallback_fn(asm_->isolate());
-      Register args[] = {src_reg.gp()};
-      GenerateCCall(dst_reg.gp(), arraysize(args), args, ext_ref);
+      ValueType sig_reps[] = {src_type};
+      FunctionSig sig(0, 1, sig_reps);
+      GenerateCCall(&dst, &sig, dst_type, &src, ext_ref);
     }
-    __ PushRegister(kWasmI32, dst_reg);
+    __ PushRegister(dst_type, dst);
   }
 
   void UnOp(Decoder* decoder, WasmOpcode opcode, FunctionSig*,
             const Value& value, Value* result) {
-#define CASE_UNOP(opcode, type, fn, ext_ref_fn)           \
-  case WasmOpcode::kExpr##opcode:                         \
-    type##UnOp(&LiftoffAssembler::emit_##fn, ext_ref_fn); \
+#define CASE_I32_UNOP(opcode, fn)                       \
+  case WasmOpcode::kExpr##opcode:                       \
+    EmitUnOp<kWasmI32, kWasmI32>(                       \
+        [=](LiftoffRegister dst, LiftoffRegister src) { \
+          __ emit_##fn(dst.gp(), src.gp());             \
+        });                                             \
+    break;
+#define CASE_FLOAT_UNOP(opcode, type, fn)               \
+  case WasmOpcode::kExpr##opcode:                       \
+    EmitUnOp<kWasm##type, kWasm##type>(                 \
+        [=](LiftoffRegister dst, LiftoffRegister src) { \
+          __ emit_##fn(dst.fp(), src.fp());             \
+        });                                             \
+    break;
+#define CASE_TYPE_CONVERSION(opcode, dst_type, src_type, ext_ref)       \
+  case WasmOpcode::kExpr##opcode:                                       \
+    EmitTypeConversion(kExpr##opcode, kWasm##dst_type, kWasm##src_type, \
+                       ext_ref);                                        \
     break;
     switch (opcode) {
-      CASE_UNOP(I32Eqz, I32, i32_eqz, nullptr)
-      CASE_UNOP(I32Clz, I32, i32_clz, nullptr)
-      CASE_UNOP(I32Ctz, I32, i32_ctz, nullptr)
-      CASE_UNOP(I32Popcnt, I32, i32_popcnt,
-                &ExternalReference::wasm_word32_popcnt)
+      CASE_I32_UNOP(I32Eqz, i32_eqz)
+      CASE_I32_UNOP(I32Clz, i32_clz)
+      CASE_I32_UNOP(I32Ctz, i32_ctz)
+      CASE_FLOAT_UNOP(F32Abs, F32, f32_abs)
+      CASE_FLOAT_UNOP(F32Neg, F32, f32_neg)
+      CASE_FLOAT_UNOP(F32Sqrt, F32, f32_sqrt)
+      CASE_FLOAT_UNOP(F64Abs, F64, f64_abs)
+      CASE_FLOAT_UNOP(F64Neg, F64, f64_neg)
+      CASE_FLOAT_UNOP(F64Sqrt, F64, f64_sqrt)
+      CASE_TYPE_CONVERSION(I32ConvertI64, I32, I64, nullptr)
+      CASE_TYPE_CONVERSION(I32ReinterpretF32, I32, F32, nullptr)
+      CASE_TYPE_CONVERSION(I64SConvertI32, I64, I32, nullptr)
+      CASE_TYPE_CONVERSION(I64UConvertI32, I64, I32, nullptr)
+      CASE_TYPE_CONVERSION(I64ReinterpretF64, I64, F64, nullptr)
+      CASE_TYPE_CONVERSION(F32SConvertI32, F32, I32, nullptr)
+      CASE_TYPE_CONVERSION(F32UConvertI32, F32, I32, nullptr)
+      CASE_TYPE_CONVERSION(F32SConvertI64, F32, I64,
+                           &ExternalReference::wasm_int64_to_float32)
+      CASE_TYPE_CONVERSION(F32UConvertI64, F32, I64,
+                           &ExternalReference::wasm_uint64_to_float32)
+      CASE_TYPE_CONVERSION(F32ConvertF64, F32, F64, nullptr)
+      CASE_TYPE_CONVERSION(F32ReinterpretI32, F32, I32, nullptr)
+      CASE_TYPE_CONVERSION(F64SConvertI32, F64, I32, nullptr)
+      CASE_TYPE_CONVERSION(F64UConvertI32, F64, I32, nullptr)
+      CASE_TYPE_CONVERSION(F64SConvertI64, F64, I64,
+                           &ExternalReference::wasm_int64_to_float64)
+      CASE_TYPE_CONVERSION(F64UConvertI64, F64, I64,
+                           &ExternalReference::wasm_uint64_to_float64)
+      CASE_TYPE_CONVERSION(F64ConvertF32, F64, F32, nullptr)
+      CASE_TYPE_CONVERSION(F64ReinterpretI64, F64, I64, nullptr)
+      case kExprI32Popcnt:
+        EmitI32UnOpWithCFallback(&LiftoffAssembler::emit_i32_popcnt,
+                                 &ExternalReference::wasm_word32_popcnt);
+        break;
+      case WasmOpcode::kExprI64Eqz:
+        EmitUnOp<kWasmI64, kWasmI32>(
+            [=](LiftoffRegister dst, LiftoffRegister src) {
+              __ emit_i64_eqz(dst.gp(), src);
+            });
+        break;
       default:
         return unsupported(decoder, WasmOpcodes::OpcodeName(opcode));
     }
-#undef CASE_UNOP
+#undef CASE_I32_UNOP
+#undef CASE_FLOAT_UNOP
+#undef CASE_TYPE_CONVERSION
   }
 
-  void I32BinOp(void (LiftoffAssembler::*emit_fn)(Register, Register,
-                                                  Register)) {
+  template <ValueType src_type, ValueType result_type, typename EmitFn>
+  void EmitBinOp(EmitFn fn) {
+    static constexpr RegClass src_rc = reg_class_for(src_type);
+    static constexpr RegClass result_rc = reg_class_for(result_type);
     LiftoffRegList pinned;
-    LiftoffRegister dst_reg = pinned.set(__ GetBinaryOpTargetRegister(kGpReg));
-    LiftoffRegister rhs_reg = pinned.set(__ PopToRegister(kGpReg, pinned));
-    LiftoffRegister lhs_reg = __ PopToRegister(kGpReg, pinned);
-    (asm_->*emit_fn)(dst_reg.gp(), lhs_reg.gp(), rhs_reg.gp());
-    __ PushRegister(kWasmI32, dst_reg);
-  }
-
-  void I32CCallBinOp(ExternalReference ext_ref) {
-    LiftoffRegList pinned;
-    LiftoffRegister dst_reg = pinned.set(__ GetBinaryOpTargetRegister(kGpReg));
-    LiftoffRegister rhs_reg = pinned.set(__ PopToRegister(kGpReg, pinned));
-    LiftoffRegister lhs_reg = __ PopToRegister(kGpReg, pinned);
-    Register args[] = {lhs_reg.gp(), rhs_reg.gp()};
-    GenerateCCall(dst_reg.gp(), arraysize(args), args, ext_ref);
-    __ PushRegister(kWasmI32, dst_reg);
-  }
-
-  void F32BinOp(void (LiftoffAssembler::*emit_fn)(DoubleRegister,
-                                                  DoubleRegister,
-                                                  DoubleRegister)) {
-    LiftoffRegList pinned;
-    LiftoffRegister target_reg =
-        pinned.set(__ GetBinaryOpTargetRegister(kFpReg));
-    LiftoffRegister rhs_reg = pinned.set(__ PopToRegister(kFpReg, pinned));
-    LiftoffRegister lhs_reg = __ PopToRegister(kFpReg, pinned);
-    (asm_->*emit_fn)(target_reg.fp(), lhs_reg.fp(), rhs_reg.fp());
-    __ PushRegister(kWasmF32, target_reg);
+    LiftoffRegister rhs = pinned.set(__ PopToRegister(pinned));
+    LiftoffRegister lhs = pinned.set(__ PopToRegister(pinned));
+    LiftoffRegister dst =
+        src_rc == result_rc
+            ? __ GetUnusedRegister(result_rc, {lhs, rhs}, pinned)
+            : __ GetUnusedRegister(result_rc);
+    fn(dst, lhs, rhs);
+    __ PushRegister(result_type, dst);
   }
 
   void BinOp(Decoder* decoder, WasmOpcode opcode, FunctionSig*,
              const Value& lhs, const Value& rhs, Value* result) {
-#define CASE_BINOP(opcode, type, fn) \
-  case WasmOpcode::kExpr##opcode:    \
-    return type##BinOp(&LiftoffAssembler::emit_##fn);
-#define CASE_CCALL_BINOP(opcode, type, ext_ref_fn)                    \
-  case WasmOpcode::kExpr##opcode:                                     \
-    type##CCallBinOp(ExternalReference::ext_ref_fn(asm_->isolate())); \
-    break;
+#define CASE_I32_BINOP(opcode, fn)                                           \
+  case WasmOpcode::kExpr##opcode:                                            \
+    return EmitBinOp<kWasmI32, kWasmI32>(                                    \
+        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
+          __ emit_##fn(dst.gp(), lhs.gp(), rhs.gp());                        \
+        });
+#define CASE_FLOAT_BINOP(opcode, type, fn)                                   \
+  case WasmOpcode::kExpr##opcode:                                            \
+    return EmitBinOp<kWasm##type, kWasm##type>(                              \
+        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
+          __ emit_##fn(dst.fp(), lhs.fp(), rhs.fp());                        \
+        });
+#define CASE_I32_CMPOP(opcode, cond)                                         \
+  case WasmOpcode::kExpr##opcode:                                            \
+    return EmitBinOp<kWasmI32, kWasmI32>(                                    \
+        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
+          __ emit_i32_set_cond(cond, dst.gp(), lhs.gp(), rhs.gp());          \
+        });
+#define CASE_I64_CMPOP(opcode, cond)                                         \
+  case WasmOpcode::kExpr##opcode:                                            \
+    return EmitBinOp<kWasmI64, kWasmI32>(                                    \
+        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
+          __ emit_i64_set_cond(cond, dst.gp(), lhs, rhs);                    \
+        });
+#define CASE_F32_CMPOP(opcode, cond)                                         \
+  case WasmOpcode::kExpr##opcode:                                            \
+    return EmitBinOp<kWasmF32, kWasmI32>(                                    \
+        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
+          __ emit_f32_set_cond(cond, dst.gp(), lhs.fp(), rhs.fp());          \
+        });
+#define CASE_I32_SHIFTOP(opcode, fn)                                         \
+  case WasmOpcode::kExpr##opcode:                                            \
+    return EmitBinOp<kWasmI32, kWasmI32>(                                    \
+        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
+          __ emit_##fn(dst.gp(), lhs.gp(), rhs.gp(), {});                    \
+        });
+#define CASE_I64_SHIFTOP(opcode, fn)                                           \
+  case WasmOpcode::kExpr##opcode:                                              \
+    return EmitBinOp<kWasmI64, kWasmI64>([=](LiftoffRegister dst,              \
+                                             LiftoffRegister src,              \
+                                             LiftoffRegister amount) {         \
+      __ emit_##fn(dst, src, amount.is_pair() ? amount.low_gp() : amount.gp(), \
+                   {});                                                        \
+    });
+#define CASE_CCALL_BINOP(opcode, type, ext_ref_fn)                           \
+  case WasmOpcode::kExpr##opcode:                                            \
+    return EmitBinOp<kWasmI32, kWasmI32>(                                    \
+        [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
+          LiftoffRegister args[] = {lhs, rhs};                               \
+          auto ext_ref = ExternalReference::ext_ref_fn(__ isolate());        \
+          ValueType sig_i_ii_reps[] = {kWasmI32, kWasmI32, kWasmI32};        \
+          FunctionSig sig_i_ii(1, 2, sig_i_ii_reps);                         \
+          GenerateCCall(&dst, &sig_i_ii, kWasmStmt, args, ext_ref);          \
+        });
     switch (opcode) {
-      CASE_BINOP(I32Add, I32, i32_add)
-      CASE_BINOP(I32Sub, I32, i32_sub)
-      CASE_BINOP(I32Mul, I32, i32_mul)
-      CASE_BINOP(I32And, I32, i32_and)
-      CASE_BINOP(I32Ior, I32, i32_or)
-      CASE_BINOP(I32Xor, I32, i32_xor)
-      CASE_BINOP(I32Shl, I32, i32_shl)
-      CASE_BINOP(I32ShrS, I32, i32_sar)
-      CASE_BINOP(I32ShrU, I32, i32_shr)
+      CASE_I32_BINOP(I32Add, i32_add)
+      CASE_I32_BINOP(I32Sub, i32_sub)
+      CASE_I32_BINOP(I32Mul, i32_mul)
+      CASE_I32_BINOP(I32And, i32_and)
+      CASE_I32_BINOP(I32Ior, i32_or)
+      CASE_I32_BINOP(I32Xor, i32_xor)
+      CASE_I32_CMPOP(I32Eq, kEqual)
+      CASE_I32_CMPOP(I32Ne, kUnequal)
+      CASE_I32_CMPOP(I32LtS, kSignedLessThan)
+      CASE_I32_CMPOP(I32LtU, kUnsignedLessThan)
+      CASE_I32_CMPOP(I32GtS, kSignedGreaterThan)
+      CASE_I32_CMPOP(I32GtU, kUnsignedGreaterThan)
+      CASE_I32_CMPOP(I32LeS, kSignedLessEqual)
+      CASE_I32_CMPOP(I32LeU, kUnsignedLessEqual)
+      CASE_I32_CMPOP(I32GeS, kSignedGreaterEqual)
+      CASE_I32_CMPOP(I32GeU, kUnsignedGreaterEqual)
+      CASE_I64_CMPOP(I64Eq, kEqual)
+      CASE_I64_CMPOP(I64Ne, kUnequal)
+      CASE_I64_CMPOP(I64LtS, kSignedLessThan)
+      CASE_I64_CMPOP(I64LtU, kUnsignedLessThan)
+      CASE_I64_CMPOP(I64GtS, kSignedGreaterThan)
+      CASE_I64_CMPOP(I64GtU, kUnsignedGreaterThan)
+      CASE_I64_CMPOP(I64LeS, kSignedLessEqual)
+      CASE_I64_CMPOP(I64LeU, kUnsignedLessEqual)
+      CASE_I64_CMPOP(I64GeS, kSignedGreaterEqual)
+      CASE_I64_CMPOP(I64GeU, kUnsignedGreaterEqual)
+      CASE_F32_CMPOP(F32Eq, kEqual)
+      CASE_F32_CMPOP(F32Ne, kUnequal)
+      CASE_F32_CMPOP(F32Lt, kUnsignedLessThan)
+      CASE_F32_CMPOP(F32Gt, kUnsignedGreaterThan)
+      CASE_F32_CMPOP(F32Le, kUnsignedLessEqual)
+      CASE_F32_CMPOP(F32Ge, kUnsignedGreaterEqual)
+      CASE_I32_SHIFTOP(I32Shl, i32_shl)
+      CASE_I32_SHIFTOP(I32ShrS, i32_sar)
+      CASE_I32_SHIFTOP(I32ShrU, i32_shr)
+      CASE_I64_SHIFTOP(I64Shl, i64_shl)
+      CASE_I64_SHIFTOP(I64ShrS, i64_sar)
+      CASE_I64_SHIFTOP(I64ShrU, i64_shr)
       CASE_CCALL_BINOP(I32Rol, I32, wasm_word32_rol)
       CASE_CCALL_BINOP(I32Ror, I32, wasm_word32_ror)
-      CASE_BINOP(F32Add, F32, f32_add)
-      CASE_BINOP(F32Sub, F32, f32_sub)
-      CASE_BINOP(F32Mul, F32, f32_mul)
+      CASE_FLOAT_BINOP(F32Add, F32, f32_add)
+      CASE_FLOAT_BINOP(F32Sub, F32, f32_sub)
+      CASE_FLOAT_BINOP(F32Mul, F32, f32_mul)
+      CASE_FLOAT_BINOP(F32Div, F32, f32_div)
+      CASE_FLOAT_BINOP(F64Add, F64, f64_add)
+      CASE_FLOAT_BINOP(F64Sub, F64, f64_sub)
+      CASE_FLOAT_BINOP(F64Mul, F64, f64_mul)
+      CASE_FLOAT_BINOP(F64Div, F64, f64_div)
       default:
         return unsupported(decoder, WasmOpcodes::OpcodeName(opcode));
     }
-#undef CASE_BINOP
+#undef CASE_I32_BINOP
+#undef CASE_FLOAT_BINOP
+#undef CASE_I32_CMPOP
+#undef CASE_I64_CMPOP
+#undef CASE_F32_CMPOP
+#undef CASE_I32_SHIFTOP
+#undef CASE_I64_SHIFTOP
 #undef CASE_CCALL_BINOP
   }
 
   void I32Const(Decoder* decoder, Value* result, int32_t value) {
     __ cache_state()->stack_state.emplace_back(kWasmI32, value);
-    CheckStackSizeLimit(decoder);
   }
 
   void I64Const(Decoder* decoder, Value* result, int64_t value) {
-    unsupported(decoder, "i64.const");
+    // The {VarState} stores constant values as int32_t, thus we only store
+    // 64-bit constants in this field if it fits in an int32_t. Larger values
+    // cannot be used as immediate value anyway, so we can also just put them in
+    // a register immediately.
+    int32_t value_i32 = static_cast<int32_t>(value);
+    if (value_i32 == value) {
+      __ cache_state()->stack_state.emplace_back(kWasmI64, value_i32);
+    } else {
+      LiftoffRegister reg = __ GetUnusedRegister(reg_class_for(kWasmI64));
+      __ LoadConstant(reg, WasmValue(value));
+      __ PushRegister(kWasmI64, reg);
+    }
   }
 
   void F32Const(Decoder* decoder, Value* result, float value) {
     LiftoffRegister reg = __ GetUnusedRegister(kFpReg);
     __ LoadConstant(reg, WasmValue(value));
     __ PushRegister(kWasmF32, reg);
-    CheckStackSizeLimit(decoder);
   }
 
   void F64Const(Decoder* decoder, Value* result, double value) {
-    unsupported(decoder, "f64.const");
+    LiftoffRegister reg = __ GetUnusedRegister(kFpReg);
+    __ LoadConstant(reg, WasmValue(value));
+    __ PushRegister(kWasmF64, reg);
   }
 
+  void RefNull(Decoder* decoder, Value* result) { UNIMPLEMENTED(); }
+
   void Drop(Decoder* decoder, const Value& value) {
     __ DropStackSlot(&__ cache_state()->stack_state.back());
     __ cache_state()->stack_state.pop_back();
@@ -601,13 +844,12 @@ class LiftoffCompiler {
     }
     if (!values.is_empty()) {
       if (values.size() > 1) return unsupported(decoder, "multi-return");
-      RegClass rc = reg_class_for(values[0].type);
-      LiftoffRegister reg = __ PopToRegister(rc);
-      __ MoveToReturnRegister(reg);
+      LiftoffRegister reg = __ PopToRegister();
+      __ MoveToReturnRegister(reg, values[0].type);
     }
     __ LeaveFrame(StackFrame::WASM_COMPILED);
     __ DropStackSlotsAndRet(
-        static_cast<uint32_t>(call_desc_->StackParameterCount()));
+        static_cast<uint32_t>(descriptor_->StackParameterCount()));
   }
 
   void GetLocal(Decoder* decoder, Value* result,
@@ -618,37 +860,36 @@ class LiftoffCompiler {
       case kRegister:
         __ PushRegister(slot.type(), slot.reg());
         break;
-      case kI32Const:
+      case KIntConst:
         __ cache_state()->stack_state.emplace_back(operand.type,
                                                    slot.i32_const());
         break;
       case kStack: {
         auto rc = reg_class_for(operand.type);
         LiftoffRegister reg = __ GetUnusedRegister(rc);
-        __ Fill(reg, operand.index);
+        __ Fill(reg, operand.index, operand.type);
         __ PushRegister(slot.type(), reg);
         break;
       }
     }
-    CheckStackSizeLimit(decoder);
   }
 
   void SetLocalFromStackSlot(LiftoffAssembler::VarState& dst_slot,
                              uint32_t local_index) {
     auto& state = *__ cache_state();
+    ValueType type = dst_slot.type();
     if (dst_slot.is_reg()) {
       LiftoffRegister slot_reg = dst_slot.reg();
       if (state.get_use_count(slot_reg) == 1) {
-        __ Fill(dst_slot.reg(), state.stack_height() - 1);
+        __ Fill(dst_slot.reg(), state.stack_height() - 1, type);
         return;
       }
       state.dec_used(slot_reg);
     }
-    ValueType type = dst_slot.type();
     DCHECK_EQ(type, __ local_type(local_index));
     RegClass rc = reg_class_for(type);
     LiftoffRegister dst_reg = __ GetUnusedRegister(rc);
-    __ Fill(dst_reg, __ cache_state()->stack_height() - 1);
+    __ Fill(dst_reg, __ cache_state()->stack_height() - 1, type);
     dst_slot = LiftoffAssembler::VarState(type, dst_reg);
     __ cache_state()->inc_used(dst_reg);
   }
@@ -663,7 +904,7 @@ class LiftoffCompiler {
         target_slot = source_slot;
         if (is_tee) state.inc_used(target_slot.reg());
         break;
-      case kI32Const:
+      case KIntConst:
         __ DropStackSlot(&target_slot);
         target_slot = source_slot;
         break;
@@ -687,35 +928,30 @@ class LiftoffCompiler {
   void GetGlobal(Decoder* decoder, Value* result,
                  const GlobalIndexOperand<validate>& operand) {
     const auto* global = &env_->module->globals[operand.index];
-    if (global->type != kWasmI32 && global->type != kWasmI64)
-      return unsupported(decoder, "non-int global");
+    if (!CheckSupportedType(decoder, kTypes_ilfd, global->type, "global"))
+      return;
     LiftoffRegList pinned;
     Register addr = pinned.set(__ GetUnusedRegister(kGpReg)).gp();
     __ LoadFromContext(addr, offsetof(WasmContext, globals_start),
                        kPointerSize);
     LiftoffRegister value =
         pinned.set(__ GetUnusedRegister(reg_class_for(global->type), pinned));
-    LoadType type =
-        global->type == kWasmI32 ? LoadType::kI32Load : LoadType::kI64Load;
-    if (type.size() > kPointerSize)
-      return unsupported(decoder, "global > kPointerSize");
+    LoadType type = LoadType::ForValueType(global->type);
     __ Load(value, addr, no_reg, global->offset, type, pinned);
     __ PushRegister(global->type, value);
-    CheckStackSizeLimit(decoder);
   }
 
   void SetGlobal(Decoder* decoder, const Value& value,
                  const GlobalIndexOperand<validate>& operand) {
     auto* global = &env_->module->globals[operand.index];
-    if (global->type != kWasmI32) return unsupported(decoder, "non-i32 global");
+    if (!CheckSupportedType(decoder, kTypes_ilfd, global->type, "global"))
+      return;
     LiftoffRegList pinned;
     Register addr = pinned.set(__ GetUnusedRegister(kGpReg)).gp();
     __ LoadFromContext(addr, offsetof(WasmContext, globals_start),
                        kPointerSize);
-    LiftoffRegister reg =
-        pinned.set(__ PopToRegister(reg_class_for(global->type), pinned));
-    StoreType type =
-        global->type == kWasmI32 ? StoreType::kI32Store : StoreType::kI64Store;
+    LiftoffRegister reg = pinned.set(__ PopToRegister(pinned));
+    StoreType type = StoreType::ForValueType(global->type);
     __ Store(addr, no_reg, global->offset, reg, type, pinned);
   }
 
@@ -741,17 +977,77 @@ class LiftoffCompiler {
 
   void BrIf(Decoder* decoder, const Value& cond, Control* target) {
     Label cont_false;
-    Register value = __ PopToRegister(kGpReg).gp();
-    __ emit_i32_test(value);
-    __ emit_cond_jump(kEqual, &cont_false);
+    Register value = __ PopToRegister().gp();
+    __ emit_cond_jump(kEqual, &cont_false, kWasmI32, value);
 
     Br(target);
     __ bind(&cont_false);
   }
 
+  // Generate a branch table case, potentially reusing previously generated
+  // stack transfer code.
+  void GenerateBrCase(Decoder* decoder, uint32_t br_depth,
+                      std::map<uint32_t, MovableLabel>& br_targets) {
+    MovableLabel& label = br_targets[br_depth];
+    if (label.get()->is_bound()) {
+      __ jmp(label.get());
+    } else {
+      __ bind(label.get());
+      Br(decoder->control_at(br_depth));
+    }
+  }
+
+  // Generate a branch table for input in [min, max).
+  // TODO(wasm): Generate a real branch table (like TF TableSwitch).
+  void GenerateBrTable(Decoder* decoder, LiftoffRegister tmp,
+                       LiftoffRegister value, uint32_t min, uint32_t max,
+                       BranchTableIterator<validate>& table_iterator,
+                       std::map<uint32_t, MovableLabel>& br_targets) {
+    DCHECK_LT(min, max);
+    // Check base case.
+    if (max == min + 1) {
+      DCHECK_EQ(min, table_iterator.cur_index());
+      GenerateBrCase(decoder, table_iterator.next(), br_targets);
+      return;
+    }
+
+    uint32_t split = min + (max - min) / 2;
+    Label upper_half;
+    __ LoadConstant(tmp, WasmValue(split));
+    __ emit_cond_jump(kUnsignedGreaterEqual, &upper_half, kWasmI32, value.gp(),
+                      tmp.gp());
+    // Emit br table for lower half:
+    GenerateBrTable(decoder, tmp, value, min, split, table_iterator,
+                    br_targets);
+    __ bind(&upper_half);
+    // Emit br table for upper half:
+    GenerateBrTable(decoder, tmp, value, split, max, table_iterator,
+                    br_targets);
+  }
+
   void BrTable(Decoder* decoder, const BranchTableOperand<validate>& operand,
                const Value& key) {
-    unsupported(decoder, "br_table");
+    LiftoffRegList pinned;
+    LiftoffRegister value = pinned.set(__ PopToRegister());
+    BranchTableIterator<validate> table_iterator(decoder, operand);
+    std::map<uint32_t, MovableLabel> br_targets;
+
+    if (operand.table_count > 0) {
+      LiftoffRegister tmp = __ GetUnusedRegister(kGpReg, pinned);
+      __ LoadConstant(tmp, WasmValue(uint32_t{operand.table_count}));
+      Label case_default;
+      __ emit_cond_jump(kUnsignedGreaterEqual, &case_default, kWasmI32,
+                        value.gp(), tmp.gp());
+
+      GenerateBrTable(decoder, tmp, value, 0, operand.table_count,
+                      table_iterator, br_targets);
+
+      __ bind(&case_default);
+    }
+
+    // Generate the default case.
+    GenerateBrCase(decoder, table_iterator.next(), br_targets);
+    DCHECK(!table_iterator.has_next());
   }
 
   void Else(Decoder* decoder, Control* if_block) {
@@ -760,28 +1056,49 @@ class LiftoffCompiler {
     __ cache_state()->Steal(if_block->else_state->state);
   }
 
-  Label* AddOutOfLineTrap(wasm::WasmCodePosition position, uint32_t pc = 0) {
+  Label* AddOutOfLineTrap(wasm::WasmCodePosition position,
+                          Builtins::Name builtin, uint32_t pc = 0) {
     DCHECK(!FLAG_wasm_no_bounds_checks);
-    // The pc is needed exactly if trap handlers are enabled.
-    DCHECK_EQ(pc != 0, env_->use_trap_handler);
+    // The pc is needed for memory OOB trap with trap handler enabled. Other
+    // callers should not even compute it.
+    DCHECK_EQ(pc != 0, builtin == Builtins::kThrowWasmTrapMemOutOfBounds &&
+                           env_->use_trap_handler);
 
-    out_of_line_code_.push_back(OutOfLineCode::Trap(
-        Builtins::kThrowWasmTrapMemOutOfBounds, position, pc));
+    out_of_line_code_.push_back(OutOfLineCode::Trap(builtin, position, pc));
     return out_of_line_code_.back().label.get();
   }
 
-  void BoundsCheckMem(uint32_t access_size, uint32_t offset, Register index,
-                      wasm::WasmCodePosition position, LiftoffRegList pinned) {
-    DCHECK(!env_->use_trap_handler);
-    if (FLAG_wasm_no_bounds_checks) return;
+  // Returns true if the memory access is statically known to be out of bounds
+  // (a jump to the trap was generated then); return false otherwise.
+  bool BoundsCheckMem(Decoder* decoder, uint32_t access_size, uint32_t offset,
+                      Register index, LiftoffRegList pinned) {
+    const bool statically_oob =
+        access_size > max_size_ || offset > max_size_ - access_size;
+
+    if (!statically_oob &&
+        (FLAG_wasm_no_bounds_checks || env_->use_trap_handler)) {
+      return false;
+    }
 
-    Label* trap_label = AddOutOfLineTrap(position);
+    // TODO(eholk): This adds protected instruction information for the jump
+    // instruction we are about to generate. It would be better to just not add
+    // protected instruction info when the pc is 0.
+    Label* trap_label = AddOutOfLineTrap(
+        decoder->position(), Builtins::kThrowWasmTrapMemOutOfBounds,
+        env_->use_trap_handler ? __ pc_offset() : 0);
 
-    if (access_size > max_size_ || offset > max_size_ - access_size) {
-      // The access will be out of bounds, even for the largest memory.
+    if (statically_oob) {
       __ emit_jump(trap_label);
-      return;
+      Control* current_block = decoder->control_at(0);
+      if (current_block->reachable()) {
+        current_block->reachability = kSpecOnlyReachable;
+      }
+      return true;
     }
+
+    DCHECK(!env_->use_trap_handler);
+    DCHECK(!FLAG_wasm_no_bounds_checks);
+
     uint32_t end_offset = offset + access_size - 1;
 
     // If the end offset is larger than the smallest memory, dynamically check
@@ -793,8 +1110,8 @@ class LiftoffCompiler {
     __ LoadFromContext(mem_size.gp(), offsetof(WasmContext, mem_size), 4);
     __ LoadConstant(end_offset_reg, WasmValue(end_offset));
     if (end_offset >= min_size_) {
-      __ emit_i32_compare(end_offset_reg.gp(), mem_size.gp());
-      __ emit_cond_jump(kUnsignedGreaterEqual, trap_label);
+      __ emit_cond_jump(kUnsignedGreaterEqual, trap_label, kWasmI32,
+                        end_offset_reg.gp(), mem_size.gp());
     }
 
     // Just reuse the end_offset register for computing the effective size.
@@ -802,8 +1119,9 @@ class LiftoffCompiler {
     __ emit_i32_sub(effective_size_reg.gp(), mem_size.gp(),
                     end_offset_reg.gp());
 
-    __ emit_i32_compare(index, effective_size_reg.gp());
-    __ emit_cond_jump(kUnsignedGreaterEqual, trap_label);
+    __ emit_cond_jump(kUnsignedGreaterEqual, trap_label, kWasmI32, index,
+                      effective_size_reg.gp());
+    return false;
   }
 
   void TraceMemoryOperation(bool is_store, MachineRepresentation rep,
@@ -842,22 +1160,23 @@ class LiftoffCompiler {
   }
 
   void GenerateRuntimeCall(int num_args, Register* args) {
-    compiler::CallDescriptor* desc =
-        compiler::Linkage::GetRuntimeCallDescriptor(
-            compilation_zone_, Runtime::kWasmTraceMemory, num_args,
-            compiler::Operator::kNoProperties,
-            compiler::CallDescriptor::kNoFlags);
+    auto call_descriptor = compiler::Linkage::GetRuntimeCallDescriptor(
+        compilation_zone_, Runtime::kWasmTraceMemory, num_args,
+        compiler::Operator::kNoProperties, compiler::CallDescriptor::kNoFlags);
     // Currently, only one argument is supported. More arguments require some
     // caution for the parallel register moves (reuse StackTransferRecipe).
     DCHECK_EQ(1, num_args);
     constexpr size_t kInputShift = 1;  // Input 0 is the call target.
-    compiler::LinkageLocation param_loc = desc->GetInputLocation(kInputShift);
+    compiler::LinkageLocation param_loc =
+        call_descriptor->GetInputLocation(kInputShift);
     if (param_loc.IsRegister()) {
       Register reg = Register::from_code(param_loc.AsRegister());
-      __ Move(LiftoffRegister(reg), LiftoffRegister(args[0]));
+      __ Move(LiftoffRegister(reg), LiftoffRegister(args[0]),
+              LiftoffAssembler::kWasmIntPtr);
     } else {
       DCHECK(param_loc.IsCallerFrameSlot());
-      __ PushCallerFrameSlot(LiftoffRegister(args[0]));
+      __ PushCallerFrameSlot(LiftoffRegister(args[0]),
+                             LiftoffAssembler::kWasmIntPtr);
     }
 
     // Allocate the codegen zone if not done before.
@@ -873,14 +1192,11 @@ class LiftoffCompiler {
                const MemoryAccessOperand<validate>& operand,
                const Value& index_val, Value* result) {
     ValueType value_type = type.value_type();
-    if (value_type != kWasmI32 && value_type != kWasmF32)
-      return unsupported(decoder, "unsupported load type");
+    if (!CheckSupportedType(decoder, kTypes_ilfd, value_type, "load")) return;
     LiftoffRegList pinned;
-    Register index = pinned.set(__ PopToRegister(kGpReg)).gp();
-    if (!env_->use_trap_handler) {
-      // Emit an explicit bounds check.
-      BoundsCheckMem(type.size(), operand.offset, index, decoder->position(),
-                     pinned);
+    Register index = pinned.set(__ PopToRegister()).gp();
+    if (BoundsCheckMem(decoder, type.size(), operand.offset, index, pinned)) {
+      return;
     }
     Register addr = pinned.set(__ GetUnusedRegister(kGpReg, pinned)).gp();
     __ LoadFromContext(addr, offsetof(WasmContext, mem_start), kPointerSize);
@@ -890,10 +1206,11 @@ class LiftoffCompiler {
     __ Load(value, addr, index, operand.offset, type, pinned,
             &protected_load_pc);
     if (env_->use_trap_handler) {
-      AddOutOfLineTrap(decoder->position(), protected_load_pc);
+      AddOutOfLineTrap(decoder->position(),
+                       Builtins::kThrowWasmTrapMemOutOfBounds,
+                       protected_load_pc);
     }
     __ PushRegister(value_type, value);
-    CheckStackSizeLimit(decoder);
 
     if (FLAG_wasm_trace_memory) {
       TraceMemoryOperation(false, type.mem_type().representation(), index,
@@ -905,16 +1222,12 @@ class LiftoffCompiler {
                 const MemoryAccessOperand<validate>& operand,
                 const Value& index_val, const Value& value_val) {
     ValueType value_type = type.value_type();
-    if (value_type != kWasmI32 && value_type != kWasmF32)
-      return unsupported(decoder, "unsupported store type");
-    RegClass rc = reg_class_for(value_type);
+    if (!CheckSupportedType(decoder, kTypes_ilfd, value_type, "store")) return;
     LiftoffRegList pinned;
-    LiftoffRegister value = pinned.set(__ PopToRegister(rc));
-    Register index = pinned.set(__ PopToRegister(kGpReg, pinned)).gp();
-    if (!env_->use_trap_handler) {
-      // Emit an explicit bounds check.
-      BoundsCheckMem(type.size(), operand.offset, index, decoder->position(),
-                     pinned);
+    LiftoffRegister value = pinned.set(__ PopToRegister());
+    Register index = pinned.set(__ PopToRegister(pinned)).gp();
+    if (BoundsCheckMem(decoder, type.size(), operand.offset, index, pinned)) {
+      return;
     }
     Register addr = pinned.set(__ GetUnusedRegister(kGpReg, pinned)).gp();
     __ LoadFromContext(addr, offsetof(WasmContext, mem_start), kPointerSize);
@@ -922,7 +1235,9 @@ class LiftoffCompiler {
     __ Store(addr, index, operand.offset, value, type, pinned,
              &protected_store_pc);
     if (env_->use_trap_handler) {
-      AddOutOfLineTrap(decoder->position(), protected_store_pc);
+      AddOutOfLineTrap(decoder->position(),
+                       Builtins::kThrowWasmTrapMemOutOfBounds,
+                       protected_store_pc);
     }
     if (FLAG_wasm_trace_memory) {
       TraceMemoryOperation(true, type.mem_rep(), index, operand.offset,
@@ -942,37 +1257,131 @@ class LiftoffCompiler {
                   const Value args[], Value returns[]) {
     if (operand.sig->return_count() > 1)
       return unsupported(decoder, "multi-return");
+    if (operand.sig->return_count() == 1 &&
+        !CheckSupportedType(decoder, kTypes_ilfd, operand.sig->GetReturn(0),
+                            "return"))
+      return;
 
-    compiler::CallDescriptor* call_desc =
+    auto call_descriptor =
         compiler::GetWasmCallDescriptor(compilation_zone_, operand.sig);
+    call_descriptor =
+        GetLoweredCallDescriptor(compilation_zone_, call_descriptor);
 
-    __ PrepareCall(operand.sig, call_desc);
+    __ PrepareCall(operand.sig, call_descriptor);
 
     source_position_table_builder_->AddPosition(
         __ pc_offset(), SourcePosition(decoder->position()), false);
 
-    if (FLAG_wasm_jit_to_native) {
-      // Just encode the function index. This will be patched at instantiation.
-      Address addr = reinterpret_cast<Address>(operand.index);
-      __ CallNativeWasmCode(addr);
-    } else {
-      Handle<Code> target = operand.index < env_->function_code.size()
-                                ? env_->function_code[operand.index]
-                                : env_->default_function_code;
-      __ Call(target, RelocInfo::CODE_TARGET);
-    }
+    // Just encode the function index. This will be patched at instantiation.
+    Address addr = reinterpret_cast<Address>(operand.index);
+    __ CallNativeWasmCode(addr);
 
     safepoint_table_builder_.DefineSafepoint(asm_, Safepoint::kSimple, 0,
                                              Safepoint::kNoLazyDeopt);
 
-    __ FinishCall(operand.sig, call_desc);
+    __ FinishCall(operand.sig, call_descriptor);
   }
 
-  void CallIndirect(Decoder* decoder, const Value& index,
+  void CallIndirect(Decoder* decoder, const Value& index_val,
                     const CallIndirectOperand<validate>& operand,
                     const Value args[], Value returns[]) {
-    unsupported(decoder, "call_indirect");
+    if (operand.sig->return_count() > 1) {
+      return unsupported(decoder, "multi-return");
+    }
+    if (operand.sig->return_count() == 1 &&
+        !CheckSupportedType(decoder, kTypes_ilfd, operand.sig->GetReturn(0),
+                            "return")) {
+      return;
+    }
+
+    // Pop the index.
+    LiftoffRegister index = __ PopToRegister();
+    // If that register is still being used after popping, we move it to another
+    // register, because we want to modify that register.
+    if (__ cache_state()->is_used(index)) {
+      LiftoffRegister new_index =
+          __ GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(index));
+      __ Move(new_index, index, kWasmI32);
+      index = new_index;
+    }
+
+    LiftoffRegList pinned = LiftoffRegList::ForRegs(index);
+    // Get three temporary registers.
+    LiftoffRegister table = pinned.set(__ GetUnusedRegister(kGpReg, pinned));
+    LiftoffRegister tmp_const =
+        pinned.set(__ GetUnusedRegister(kGpReg, pinned));
+    LiftoffRegister scratch = pinned.set(__ GetUnusedRegister(kGpReg, pinned));
+
+    LiftoffRegister* explicit_context = nullptr;
+
+    // Bounds check against the table size.
+    Label* invalid_func_label = AddOutOfLineTrap(
+        decoder->position(), Builtins::kThrowWasmTrapFuncInvalid);
+
+    static constexpr LoadType kPointerLoadType =
+        kPointerSize == 8 ? LoadType::kI64Load : LoadType::kI32Load;
+
+    uint32_t canonical_sig_num = env_->module->signature_ids[operand.sig_index];
+    DCHECK_GE(canonical_sig_num, 0);
+    DCHECK_GE(kMaxInt, canonical_sig_num);
+
+    // Compare against table size stored in {wasm_context->table_size}.
+    __ LoadFromContext(tmp_const.gp(), offsetof(WasmContext, table_size),
+                       sizeof(uint32_t));
+    __ emit_cond_jump(kUnsignedGreaterEqual, invalid_func_label, kWasmI32,
+                      index.gp(), tmp_const.gp());
+    // Load the table from {wasm_context->table}
+    __ LoadFromContext(table.gp(), offsetof(WasmContext, table), kPointerSize);
+    // Load the signature from {wasm_context->table[$index].sig_id}
+    // == wasm_context.table + $index * #sizeof(IndirectionFunctionTableEntry)
+    //    + #offsetof(sig_id)
+    __ LoadConstant(
+        tmp_const,
+        WasmValue(static_cast<uint32_t>(sizeof(IndirectFunctionTableEntry))));
+    __ emit_i32_mul(index.gp(), index.gp(), tmp_const.gp());
+    __ Load(scratch, table.gp(), index.gp(),
+            offsetof(IndirectFunctionTableEntry, sig_id), LoadType::kI32Load,
+            pinned);
+
+    __ LoadConstant(tmp_const, WasmValue(canonical_sig_num));
+
+    Label* sig_mismatch_label = AddOutOfLineTrap(
+        decoder->position(), Builtins::kThrowWasmTrapFuncSigMismatch);
+    __ emit_cond_jump(kUnequal, sig_mismatch_label,
+                      LiftoffAssembler::kWasmIntPtr, scratch.gp(),
+                      tmp_const.gp());
+
+    // Load the target address from {wasm_context->table[$index].target}
+    __ Load(scratch, table.gp(), index.gp(),
+            offsetof(IndirectFunctionTableEntry, target), kPointerLoadType,
+            pinned);
+
+    // Load the context from {wasm_context->table[$index].context}
+    // TODO(wasm): directly allocate the correct context register to avoid
+    // any potential moves.
+    __ Load(tmp_const, table.gp(), index.gp(),
+            offsetof(IndirectFunctionTableEntry, context), kPointerLoadType,
+            pinned);
+    explicit_context = &tmp_const;
+
+    source_position_table_builder_->AddPosition(
+        __ pc_offset(), SourcePosition(decoder->position()), false);
+
+    auto call_descriptor =
+        compiler::GetWasmCallDescriptor(compilation_zone_, operand.sig);
+    call_descriptor =
+        GetLoweredCallDescriptor(compilation_zone_, call_descriptor);
+
+    Register target = scratch.gp();
+    __ PrepareCall(operand.sig, call_descriptor, &target, explicit_context);
+    __ CallIndirect(operand.sig, call_descriptor, target);
+
+    safepoint_table_builder_.DefineSafepoint(asm_, Safepoint::kSimple, 0,
+                                             Safepoint::kNoLazyDeopt);
+
+    __ FinishCall(operand.sig, call_descriptor);
   }
+
   void SimdOp(Decoder* decoder, WasmOpcode opcode, Vector<Value> args,
               Value* result) {
     unsupported(decoder, "simd");
@@ -1009,11 +1418,11 @@ class LiftoffCompiler {
 
  private:
   LiftoffAssembler* const asm_;
-  compiler::CallDescriptor* const call_desc_;
+  compiler::CallDescriptor* const descriptor_;
   compiler::ModuleEnv* const env_;
   // {min_size_} and {max_size_} are cached values computed from the ModuleEnv.
-  const uint32_t min_size_;
-  const uint32_t max_size_;
+  const uint64_t min_size_;
+  const uint64_t max_size_;
   const compiler::RuntimeExceptionSupport runtime_exception_support_;
   bool ok_ = true;
   std::vector<OutOfLineCode> out_of_line_code_;
@@ -1027,6 +1436,9 @@ class LiftoffCompiler {
   // code generation (in FinishCompilation).
   std::unique_ptr<Zone>* codegen_zone_;
   SafepointTableBuilder safepoint_table_builder_;
+  // The pc offset of the instructions to reserve the stack frame. Needed to
+  // patch the actually needed stack size in the end.
+  uint32_t pc_offset_stack_frame_construction_ = 0;
 
   void TraceCacheState(Decoder* decoder) const {
 #ifdef DEBUG
@@ -1061,11 +1473,11 @@ bool compiler::WasmCompilationUnit::ExecuteLiftoffCompilation() {
 
   Zone zone(isolate_->allocator(), "LiftoffCompilationZone");
   const wasm::WasmModule* module = env_ ? env_->module : nullptr;
-  auto* call_desc = compiler::GetWasmCallDescriptor(&zone, func_body_.sig);
+  auto call_descriptor = compiler::GetWasmCallDescriptor(&zone, func_body_.sig);
   base::Optional<TimedHistogramScope> liftoff_compile_time_scope(
       base::in_place, counters()->liftoff_compile_time());
   wasm::WasmFullDecoder<wasm::Decoder::kValidate, wasm::LiftoffCompiler>
-      decoder(&zone, module, func_body_, &liftoff_.asm_, call_desc, env_,
+      decoder(&zone, module, func_body_, &liftoff_.asm_, call_descriptor, env_,
               runtime_exception_support_,
               &liftoff_.source_position_table_builder_,
               protected_instructions_.get(), &zone, &liftoff_.codegen_zone_);
diff --git a/deps/v8/src/wasm/baseline/liftoff-register.h b/deps/v8/src/wasm/baseline/liftoff-register.h
index bb5ef5be4ae..94a6c19e817 100644
--- a/deps/v8/src/wasm/baseline/liftoff-register.h
+++ b/deps/v8/src/wasm/baseline/liftoff-register.h
@@ -8,8 +8,6 @@
 #include <iosfwd>
 #include <memory>
 
-// Clients of this interface shouldn't depend on lots of compiler internals.
-// Do not include anything from src/compiler here!
 #include "src/base/bits.h"
 #include "src/wasm/baseline/liftoff-assembler-defs.h"
 #include "src/wasm/wasm-opcodes.h"
@@ -18,24 +16,33 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-enum RegClass { kNoReg, kGpReg, kFpReg };
+static constexpr bool kNeedI64RegPair = kPointerSize == 4;
+
+enum RegClass : uint8_t {
+  kGpReg,
+  kFpReg,
+  // {kGpRegPair} equals {kNoReg} if {kNeedI64RegPair} is false.
+  kGpRegPair,
+  kNoReg = kGpRegPair + kNeedI64RegPair
+};
+
+enum RegPairHalf : uint8_t { kLowWord, kHighWord };
+
+static inline constexpr bool needs_reg_pair(ValueType type) {
+  return kNeedI64RegPair && type == kWasmI64;
+}
 
 // TODO(clemensh): Use a switch once we require C++14 support.
 static inline constexpr RegClass reg_class_for(ValueType type) {
-  return type == kWasmI32 || type == kWasmI64  // int types
-             ? kGpReg
-             : type == kWasmF32 || type == kWasmF64  // float types
-                   ? kFpReg
-                   : kNoReg;  // other (unsupported) types
+  return needs_reg_pair(type)  // i64 on 32 bit
+             ? kGpRegPair
+             : type == kWasmI32 || type == kWasmI64  // int types
+                   ? kGpReg
+                   : type == kWasmF32 || type == kWasmF64  // float types
+                         ? kFpReg
+                         : kNoReg;  // other (unsupported) types
 }
 
-// RegForClass<rc>: Register for rc==kGpReg, DoubleRegister for rc==kFpReg, void
-// for all other values of rc.
-template <RegClass rc>
-using RegForClass = typename std::conditional<
-    rc == kGpReg, Register,
-    typename std::conditional<rc == kFpReg, DoubleRegister, void>::type>::type;
-
 // Maximum code of a gp cache register.
 static constexpr int kMaxGpRegCode =
     8 * sizeof(kLiftoffAssemblerGpCacheRegs) -
@@ -47,14 +54,28 @@ static constexpr int kMaxFpRegCode =
 // LiftoffRegister encodes both gp and fp in a unified index space.
 // [0 .. kMaxGpRegCode] encodes gp registers,
 // [kMaxGpRegCode+1 .. kMaxGpRegCode + kMaxFpRegCode] encodes fp registers.
+// I64 values on 32 bit platforms are stored in two registers, both encoded in
+// the same LiftoffRegister value.
 static constexpr int kAfterMaxLiftoffGpRegCode = kMaxGpRegCode + 1;
 static constexpr int kAfterMaxLiftoffFpRegCode =
     kAfterMaxLiftoffGpRegCode + kMaxFpRegCode + 1;
 static constexpr int kAfterMaxLiftoffRegCode = kAfterMaxLiftoffFpRegCode;
-static_assert(kAfterMaxLiftoffRegCode < 256,
-              "liftoff register codes can be stored in one uint8_t");
+static constexpr int kBitsPerLiftoffRegCode =
+    32 - base::bits::CountLeadingZeros<uint32_t>(kAfterMaxLiftoffRegCode - 1);
+static constexpr int kBitsPerGpRegCode =
+    32 - base::bits::CountLeadingZeros<uint32_t>(kMaxGpRegCode);
+static constexpr int kBitsPerGpRegPair = 1 + 2 * kBitsPerGpRegCode;
 
 class LiftoffRegister {
+  static constexpr int needed_bits =
+      Max(kNeedI64RegPair ? kBitsPerGpRegPair : 0, kBitsPerLiftoffRegCode);
+  using storage_t = std::conditional<
+      needed_bits <= 8, uint8_t,
+      std::conditional<needed_bits <= 16, uint16_t, uint32_t>::type>::type;
+  static_assert(8 * sizeof(storage_t) >= needed_bits &&
+                    8 * sizeof(storage_t) < 2 * needed_bits,
+                "right type has been chosen");
+
  public:
   explicit LiftoffRegister(Register reg) : LiftoffRegister(reg.code()) {
     DCHECK_EQ(reg, gp());
@@ -67,6 +88,7 @@ class LiftoffRegister {
   static LiftoffRegister from_liftoff_code(int code) {
     DCHECK_LE(0, code);
     DCHECK_GT(kAfterMaxLiftoffRegCode, code);
+    DCHECK_EQ(code, static_cast<storage_t>(code));
     return LiftoffRegister(code);
   }
 
@@ -81,12 +103,39 @@ class LiftoffRegister {
     }
   }
 
+  static LiftoffRegister ForPair(Register low, Register high) {
+    DCHECK(kNeedI64RegPair);
+    DCHECK_NE(low, high);
+    storage_t combined_code = low.code() | high.code() << kBitsPerGpRegCode |
+                              1 << (2 * kBitsPerGpRegCode);
+    return LiftoffRegister(combined_code);
+  }
+
+  constexpr bool is_pair() const {
+    return kNeedI64RegPair && (code_ & (1 << (2 * kBitsPerGpRegCode))) != 0;
+  }
   constexpr bool is_gp() const { return code_ < kAfterMaxLiftoffGpRegCode; }
   constexpr bool is_fp() const {
     return code_ >= kAfterMaxLiftoffGpRegCode &&
            code_ < kAfterMaxLiftoffFpRegCode;
   }
 
+  LiftoffRegister low() const { return LiftoffRegister(low_gp()); }
+
+  LiftoffRegister high() const { return LiftoffRegister(high_gp()); }
+
+  Register low_gp() const {
+    DCHECK(is_pair());
+    static constexpr storage_t kCodeMask = (1 << kBitsPerGpRegCode) - 1;
+    return Register::from_code(code_ & kCodeMask);
+  }
+
+  Register high_gp() const {
+    DCHECK(is_pair());
+    static constexpr storage_t kCodeMask = (1 << kBitsPerGpRegCode) - 1;
+    return Register::from_code((code_ >> kBitsPerGpRegCode) & kCodeMask);
+  }
+
   Register gp() const {
     DCHECK(is_gp());
     return Register::from_code(code_);
@@ -97,31 +146,45 @@ class LiftoffRegister {
     return DoubleRegister::from_code(code_ - kAfterMaxLiftoffGpRegCode);
   }
 
-  int liftoff_code() const { return code_; }
+  uint32_t liftoff_code() const {
+    DCHECK(is_gp() || is_fp());
+    return code_;
+  }
 
   RegClass reg_class() const {
-    DCHECK(is_gp() || is_fp());
-    return is_gp() ? kGpReg : kFpReg;
+    return is_pair() ? kGpRegPair : is_gp() ? kGpReg : kFpReg;
   }
 
   bool operator==(const LiftoffRegister other) const {
+    DCHECK_EQ(is_pair(), other.is_pair());
     return code_ == other.code_;
   }
   bool operator!=(const LiftoffRegister other) const {
+    DCHECK_EQ(is_pair(), other.is_pair());
     return code_ != other.code_;
   }
+  bool overlaps(const LiftoffRegister other) const {
+    if (is_pair()) return low().overlaps(other) || high().overlaps(other);
+    if (other.is_pair()) return *this == other.low() || *this == other.high();
+    return *this == other;
+  }
 
  private:
-  uint8_t code_;
+  storage_t code_;
 
-  explicit constexpr LiftoffRegister(uint8_t code) : code_(code) {}
+  explicit constexpr LiftoffRegister(storage_t code) : code_(code) {}
 };
-static_assert(IS_TRIVIALLY_COPYABLE(LiftoffRegister),
-              "LiftoffRegister can efficiently be passed by value");
+ASSERT_TRIVIALLY_COPYABLE(LiftoffRegister);
 
 inline std::ostream& operator<<(std::ostream& os, LiftoffRegister reg) {
-  return reg.is_gp() ? os << "gp" << reg.gp().code()
-                     : os << "fp" << reg.fp().code();
+  if (reg.is_pair()) {
+    return os << "<gp" << reg.low_gp().code() << "+" << reg.high_gp().code()
+              << ">";
+  } else if (reg.is_gp()) {
+    return os << "gp" << reg.gp().code();
+  } else {
+    return os << "fp" << reg.fp().code();
+  }
 }
 
 class LiftoffRegList {
@@ -144,16 +207,30 @@ class LiftoffRegList {
   }
 
   LiftoffRegister set(LiftoffRegister reg) {
-    regs_ |= storage_t{1} << reg.liftoff_code();
+    if (reg.is_pair()) {
+      regs_ |= storage_t{1} << reg.low().liftoff_code();
+      regs_ |= storage_t{1} << reg.high().liftoff_code();
+    } else {
+      regs_ |= storage_t{1} << reg.liftoff_code();
+    }
     return reg;
   }
 
   LiftoffRegister clear(LiftoffRegister reg) {
-    regs_ &= ~(storage_t{1} << reg.liftoff_code());
+    if (reg.is_pair()) {
+      regs_ &= ~(storage_t{1} << reg.low().liftoff_code());
+      regs_ &= ~(storage_t{1} << reg.high().liftoff_code());
+    } else {
+      regs_ &= ~(storage_t{1} << reg.liftoff_code());
+    }
     return reg;
   }
 
   bool has(LiftoffRegister reg) const {
+    if (reg.is_pair()) {
+      DCHECK_EQ(has(reg.low()), has(reg.high()));
+      reg = reg.low();
+    }
     return (regs_ & (storage_t{1} << reg.liftoff_code())) != 0;
   }
 
@@ -211,7 +288,7 @@ class LiftoffRegList {
   template <typename... Regs>
   static LiftoffRegList ForRegs(Regs... regs) {
     std::array<LiftoffRegister, sizeof...(regs)> regs_arr{
-        LiftoffRegister(regs)...};
+        {LiftoffRegister(regs)...}};
     LiftoffRegList list;
     for (LiftoffRegister reg : regs_arr) list.set(reg);
     return list;
@@ -223,8 +300,7 @@ class LiftoffRegList {
   // Unchecked constructor. Only use for valid bits.
   explicit constexpr LiftoffRegList(storage_t bits) : regs_(bits) {}
 };
-static_assert(IS_TRIVIALLY_COPYABLE(LiftoffRegList),
-              "LiftoffRegList can be passed by value");
+ASSERT_TRIVIALLY_COPYABLE(LiftoffRegList);
 
 static constexpr LiftoffRegList kGpCacheRegList =
     LiftoffRegList::FromBits<LiftoffRegList::kGpMask>();
diff --git a/deps/v8/src/wasm/baseline/mips/OWNERS b/deps/v8/src/wasm/baseline/mips/OWNERS
new file mode 100644
index 00000000000..cf2df277c96
--- /dev/null
+++ b/deps/v8/src/wasm/baseline/mips/OWNERS
@@ -0,0 +1,3 @@
+ivica.bogosavljevic@mips.com
+Miran.Karic@mips.com
+sreten.kovacevic@mips.com
diff --git a/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h b/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h
index 50ab1e82c87..0b61e649cab 100644
--- a/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h
+++ b/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h
@@ -2,180 +2,907 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_MIPS_H_
-#define V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_MIPS_H_
+#ifndef V8_WASM_BASELINE_MIPS_LIFTOFF_ASSEMBLER_MIPS_H_
+#define V8_WASM_BASELINE_MIPS_LIFTOFF_ASSEMBLER_MIPS_H_
 
 #include "src/wasm/baseline/liftoff-assembler.h"
 
+#define BAILOUT(reason) bailout("mips " reason)
+
 namespace v8 {
 namespace internal {
 namespace wasm {
 
-void LiftoffAssembler::ReserveStackSpace(uint32_t bytes) { UNIMPLEMENTED(); }
+namespace liftoff {
+
+// fp-8 holds the stack marker, fp-16 is the wasm context, first stack slot
+// is located at fp-24.
+constexpr int32_t kConstantStackSpace = 16;
+constexpr int32_t kFirstStackSlotOffset =
+    kConstantStackSpace + LiftoffAssembler::kStackSlotSize;
+
+inline MemOperand GetStackSlot(uint32_t index) {
+  int32_t offset = index * LiftoffAssembler::kStackSlotSize;
+  return MemOperand(fp, -kFirstStackSlotOffset - offset);
+}
+
+inline MemOperand GetHalfStackSlot(uint32_t half_index) {
+  int32_t offset = half_index * (LiftoffAssembler::kStackSlotSize / 2);
+  return MemOperand(fp, -kFirstStackSlotOffset - offset);
+}
+
+inline MemOperand GetContextOperand() { return MemOperand(fp, -16); }
+
+// Use this register to store the address of the last argument pushed on the
+// stack for a call to C. This register must be callee saved according to the c
+// calling convention.
+static constexpr Register kCCallLastArgAddrReg = s1;
+
+inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, MemOperand src,
+                 ValueType type) {
+  switch (type) {
+    case kWasmI32:
+      assm->lw(dst.gp(), src);
+      break;
+    case kWasmF32:
+      assm->lwc1(dst.fp(), src);
+      break;
+    case kWasmF64:
+      assm->Ldc1(dst.fp(), src);
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
+  switch (type) {
+    case kWasmI32:
+      assm->push(reg.gp());
+      break;
+    case kWasmI64:
+      assm->Push(reg.high_gp(), reg.low_gp());
+      break;
+    case kWasmF32:
+      assm->addiu(sp, sp, -sizeof(float));
+      assm->swc1(reg.fp(), MemOperand(sp, 0));
+      break;
+    case kWasmF64:
+      assm->addiu(sp, sp, -sizeof(double));
+      assm->Sdc1(reg.fp(), MemOperand(sp, 0));
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+}  // namespace liftoff
+
+uint32_t LiftoffAssembler::PrepareStackFrame() {
+  uint32_t offset = static_cast<uint32_t>(pc_offset());
+  // When constant that represents size of stack frame can't be represented
+  // as 16bit we need three instructions to add it to sp, so we reserve space
+  // for this case.
+  addiu(sp, sp, 0);
+  nop();
+  nop();
+  return offset;
+}
+
+void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+                                              uint32_t stack_slots) {
+  uint32_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
+  DCHECK_LE(bytes, kMaxInt);
+  // We can't run out of space, just pass anything big enough to not cause the
+  // assembler to try to grow the buffer.
+  constexpr int kAvailableSpace = 256;
+  TurboAssembler patching_assembler(isolate(), buffer_ + offset,
+                                    kAvailableSpace, CodeObjectRequired::kNo);
+  // If bytes can be represented as 16bit, addiu will be generated and two
+  // nops will stay untouched. Otherwise, lui-ori sequence will load it to
+  // register and, as third instruction, addu will be generated.
+  patching_assembler.Addu(sp, sp, Operand(-bytes));
+}
 
-void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
+                                    RelocInfo::Mode rmode) {
+  switch (value.type()) {
+    case kWasmI32:
+      TurboAssembler::li(reg.gp(), Operand(value.to_i32(), rmode));
+      break;
+    case kWasmI64: {
+      DCHECK(RelocInfo::IsNone(rmode));
+      int32_t low_word = value.to_i64();
+      int32_t high_word = value.to_i64() >> 32;
+      TurboAssembler::li(reg.low_gp(), Operand(low_word));
+      TurboAssembler::li(reg.high_gp(), Operand(high_word));
+      break;
+    }
+    case kWasmF32:
+      TurboAssembler::Move(reg.fp(), value.to_f32_boxed().get_bits());
+      break;
+    case kWasmF64:
+      TurboAssembler::Move(reg.fp(), value.to_f64_boxed().get_bits());
+      break;
+    default:
+      UNREACHABLE();
+  }
 }
 
 void LiftoffAssembler::LoadFromContext(Register dst, uint32_t offset,
                                        int size) {
-  UNIMPLEMENTED();
+  DCHECK_LE(offset, kMaxInt);
+  lw(dst, liftoff::GetContextOperand());
+  DCHECK_EQ(4, size);
+  lw(dst, MemOperand(dst, offset));
 }
 
-void LiftoffAssembler::SpillContext(Register context) { UNIMPLEMENTED(); }
+void LiftoffAssembler::SpillContext(Register context) {
+  sw(context, liftoff::GetContextOperand());
+}
 
-void LiftoffAssembler::FillContextInto(Register dst) { UNIMPLEMENTED(); }
+void LiftoffAssembler::FillContextInto(Register dst) {
+  lw(dst, liftoff::GetContextOperand());
+}
 
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
                             uint32_t* protected_load_pc) {
-  UNIMPLEMENTED();
+  // TODO(ksreten): Add check if unaligned memory access
+  Register src = no_reg;
+  if (offset_reg != no_reg) {
+    src = GetUnusedRegister(kGpReg, pinned).gp();
+    emit_ptrsize_add(src, src_addr, offset_reg);
+  }
+  MemOperand src_op = (offset_reg != no_reg) ? MemOperand(src, offset_imm)
+                                             : MemOperand(src_addr, offset_imm);
+
+  if (protected_load_pc) *protected_load_pc = pc_offset();
+  switch (type.value()) {
+    case LoadType::kI32Load8U:
+      lbu(dst.gp(), src_op);
+      break;
+    case LoadType::kI64Load8U:
+      lbu(dst.low_gp(), src_op);
+      xor_(dst.high_gp(), dst.high_gp(), dst.high_gp());
+      break;
+    case LoadType::kI32Load8S:
+      lb(dst.gp(), src_op);
+      break;
+    case LoadType::kI64Load8S:
+      lb(dst.low_gp(), src_op);
+      TurboAssembler::Move(dst.high_gp(), dst.low_gp());
+      sra(dst.high_gp(), dst.high_gp(), 31);
+      break;
+    case LoadType::kI32Load16U:
+      TurboAssembler::Ulhu(dst.gp(), src_op);
+      break;
+    case LoadType::kI64Load16U:
+      TurboAssembler::Ulhu(dst.low_gp(), src_op);
+      xor_(dst.high_gp(), dst.high_gp(), dst.high_gp());
+      break;
+    case LoadType::kI32Load16S:
+      TurboAssembler::Ulh(dst.gp(), src_op);
+      break;
+    case LoadType::kI64Load16S:
+      TurboAssembler::Ulh(dst.low_gp(), src_op);
+      TurboAssembler::Move(dst.high_gp(), dst.low_gp());
+      sra(dst.high_gp(), dst.high_gp(), 31);
+      break;
+    case LoadType::kI32Load:
+      TurboAssembler::Ulw(dst.gp(), src_op);
+      break;
+    case LoadType::kI64Load32U:
+      TurboAssembler::Ulw(dst.low_gp(), src_op);
+      xor_(dst.high_gp(), dst.high_gp(), dst.high_gp());
+      break;
+    case LoadType::kI64Load32S:
+      TurboAssembler::Ulw(dst.low_gp(), src_op);
+      TurboAssembler::Move(dst.high_gp(), dst.low_gp());
+      sra(dst.high_gp(), dst.high_gp(), 31);
+      break;
+    case LoadType::kI64Load: {
+      MemOperand src_op_upper = (offset_reg != no_reg)
+                                    ? MemOperand(src, offset_imm + 4)
+                                    : MemOperand(src_addr, offset_imm + 4);
+      TurboAssembler::Ulw(dst.high_gp(), src_op_upper);
+      TurboAssembler::Ulw(dst.low_gp(), src_op);
+      break;
+    }
+    case LoadType::kF32Load:
+      TurboAssembler::Ulwc1(dst.fp(), src_op, t8);
+      break;
+    case LoadType::kF64Load:
+      TurboAssembler::Uldc1(dst.fp(), src_op, t8);
+      break;
+    default:
+      UNREACHABLE();
+  }
 }
 
 void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
                              uint32_t* protected_store_pc) {
-  UNIMPLEMENTED();
+  // TODO(ksreten): Add check if unaligned memory access
+  Register dst = no_reg;
+  if (offset_reg != no_reg) {
+    dst = GetUnusedRegister(kGpReg, pinned).gp();
+    emit_ptrsize_add(dst, dst_addr, offset_reg);
+  }
+  MemOperand dst_op = (offset_reg != no_reg) ? MemOperand(dst, offset_imm)
+                                             : MemOperand(dst_addr, offset_imm);
+
+  if (protected_store_pc) *protected_store_pc = pc_offset();
+  switch (type.value()) {
+    case StoreType::kI64Store8:
+      src = src.low();
+      V8_FALLTHROUGH;
+    case StoreType::kI32Store8:
+      sb(src.gp(), dst_op);
+      break;
+    case StoreType::kI64Store16:
+      src = src.low();
+      V8_FALLTHROUGH;
+    case StoreType::kI32Store16:
+      TurboAssembler::Ush(src.gp(), dst_op, t8);
+      break;
+    case StoreType::kI64Store32:
+      src = src.low();
+      V8_FALLTHROUGH;
+    case StoreType::kI32Store:
+      TurboAssembler::Usw(src.gp(), dst_op);
+      break;
+    case StoreType::kI64Store: {
+      MemOperand dst_op_upper = (offset_reg != no_reg)
+                                    ? MemOperand(dst, offset_imm + 4)
+                                    : MemOperand(dst_addr, offset_imm + 4);
+      TurboAssembler::Usw(src.high_gp(), dst_op_upper);
+      TurboAssembler::Usw(src.low_gp(), dst_op);
+      break;
+    }
+    case StoreType::kF32Store:
+      TurboAssembler::Uswc1(src.fp(), dst_op, t8);
+      break;
+    case StoreType::kF64Store:
+      TurboAssembler::Usdc1(src.fp(), dst_op, t8);
+      break;
+    default:
+      UNREACHABLE();
+  }
 }
 
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
-                                           uint32_t caller_slot_idx) {
-  UNIMPLEMENTED();
+                                           uint32_t caller_slot_idx,
+                                           ValueType type) {
+  MemOperand src(fp, kPointerSize * (caller_slot_idx + 1));
+  liftoff::Load(this, dst, src, type);
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+                                      ValueType type) {
+  DCHECK_NE(dst_index, src_index);
+  LiftoffRegister reg = GetUnusedRegister(reg_class_for(type));
+  Fill(reg, src_index, type);
+  Spill(dst_index, reg, type);
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
+                                            ValueType type) {
+  // TODO(wasm): Extract the destination register from the CallDescriptor.
+  // TODO(wasm): Add multi-return support.
+  LiftoffRegister dst =
+      reg.is_pair() ? LiftoffRegister::ForPair(v0, v1)
+                    : reg.is_gp() ? LiftoffRegister(v0) : LiftoffRegister(f2);
+  if (reg != dst) Move(dst, reg, type);
 }
 
-void LiftoffAssembler::Move(LiftoffRegister dst, LiftoffRegister src) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
+  DCHECK_NE(dst, src);
+  TurboAssembler::mov(dst, src);
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
+                            ValueType type) {
+  DCHECK_NE(dst, src);
+  TurboAssembler::Move(dst, src);
+}
+
+void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
+                             ValueType type) {
+  RecordUsedSpillSlot(index);
+  MemOperand dst = liftoff::GetStackSlot(index);
+  switch (type) {
+    case kWasmI32:
+      sw(reg.gp(), dst);
+      break;
+    case kWasmI64:
+      sw(reg.low_gp(), dst);
+      sw(reg.high_gp(), liftoff::GetHalfStackSlot(2 * index + 1));
+      break;
+    case kWasmF32:
+      swc1(reg.fp(), dst);
+      break;
+    case kWasmF64:
+      TurboAssembler::Sdc1(reg.fp(), dst);
+      break;
+    default:
+      UNREACHABLE();
+  }
 }
 
 void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
-  UNIMPLEMENTED();
+  RecordUsedSpillSlot(index);
+  MemOperand dst = liftoff::GetStackSlot(index);
+  switch (value.type()) {
+    case kWasmI32: {
+      LiftoffRegister tmp = GetUnusedRegister(kGpReg);
+      TurboAssembler::li(tmp.gp(), Operand(value.to_i32()));
+      sw(tmp.gp(), dst);
+      break;
+    }
+    case kWasmI64: {
+      LiftoffRegister low = GetUnusedRegister(kGpReg);
+      LiftoffRegister high = GetUnusedRegister(kGpReg);
+
+      int32_t low_word = value.to_i64();
+      int32_t high_word = value.to_i64() >> 32;
+      TurboAssembler::li(low.gp(), Operand(low_word));
+      TurboAssembler::li(high.gp(), Operand(high_word));
+
+      sw(low.gp(), dst);
+      sw(high.gp(), liftoff::GetHalfStackSlot(2 * index + 1));
+      break;
+    }
+    default:
+      // kWasmF32 and kWasmF64 are unreachable, since those
+      // constants are not tracked.
+      UNREACHABLE();
+  }
+}
+
+void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
+                            ValueType type) {
+  MemOperand src = liftoff::GetStackSlot(index);
+  switch (type) {
+    case kWasmI32:
+      lw(reg.gp(), src);
+      break;
+    case kWasmI64:
+      lw(reg.low_gp(), src);
+      lw(reg.high_gp(), liftoff::GetHalfStackSlot(2 * index + 1));
+      break;
+    case kWasmF32:
+      lwc1(reg.fp(), src);
+      break;
+    case kWasmF64:
+      TurboAssembler::Ldc1(reg.fp(), src);
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+void LiftoffAssembler::FillI64Half(Register reg, uint32_t half_index) {
+  lw(reg, liftoff::GetHalfStackSlot(half_index));
+}
+
+void LiftoffAssembler::emit_i32_mul(Register dst, Register lhs, Register rhs) {
+  TurboAssembler::Mul(dst, lhs, rhs);
+}
+
+#define I32_BINOP(name, instruction)                                 \
+  void LiftoffAssembler::emit_i32_##name(Register dst, Register lhs, \
+                                         Register rhs) {             \
+    instruction(dst, lhs, rhs);                                      \
+  }
+
+// clang-format off
+I32_BINOP(add, addu)
+I32_BINOP(sub, subu)
+I32_BINOP(and, and_)
+I32_BINOP(or, or_)
+I32_BINOP(xor, xor_)
+// clang-format on
+
+#undef I32_BINOP
+
+void LiftoffAssembler::emit_ptrsize_add(Register dst, Register lhs,
+                                        Register rhs) {
+  emit_i32_add(dst, lhs, rhs);
+}
+
+bool LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
+  TurboAssembler::Clz(dst, src);
+  return true;
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index) {
-  UNIMPLEMENTED();
+bool LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
+  TurboAssembler::Ctz(dst, src);
+  return true;
 }
 
-#define UNIMPLEMENTED_GP_BINOP(name)                             \
-  void LiftoffAssembler::emit_##name(Register dst, Register lhs, \
-                                     Register rhs) {             \
-    UNIMPLEMENTED();                                             \
+bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
+  TurboAssembler::Popcnt(dst, src);
+  return true;
+}
+
+#define I32_SHIFTOP(name, instruction)                                      \
+  void LiftoffAssembler::emit_i32_##name(                                   \
+      Register dst, Register src, Register amount, LiftoffRegList pinned) { \
+    instruction(dst, src, amount);                                          \
   }
-#define UNIMPLEMENTED_GP_UNOP(name)                                \
-  bool LiftoffAssembler::emit_##name(Register dst, Register src) { \
-    UNIMPLEMENTED();                                               \
+
+I32_SHIFTOP(shl, sllv)
+I32_SHIFTOP(sar, srav)
+I32_SHIFTOP(shr, srlv)
+
+#undef I32_SHIFTOP
+
+namespace liftoff {
+
+inline bool IsRegInRegPair(LiftoffRegister pair, Register reg) {
+  DCHECK(pair.is_pair());
+  return pair.low_gp() == reg || pair.high_gp() == reg;
+}
+
+inline void Emit64BitShiftOperation(
+    LiftoffAssembler* assm, LiftoffRegister dst, LiftoffRegister src,
+    Register amount,
+    void (TurboAssembler::*emit_shift)(Register, Register, Register, Register,
+                                       Register),
+    LiftoffRegList pinned) {
+  Label move, done;
+  pinned.set(dst);
+  pinned.set(src);
+  pinned.set(amount);
+
+  // If shift amount is 0, don't do the shifting.
+  assm->TurboAssembler::Branch(&move, eq, amount, Operand(zero_reg));
+
+  if (liftoff::IsRegInRegPair(dst, amount) || dst.overlaps(src)) {
+    // If some of destination registers are in use, get another, unused pair.
+    // That way we prevent overwriting some input registers while shifting.
+    LiftoffRegister tmp = assm->GetUnusedRegister(kGpRegPair, pinned);
+
+    // Do the actual shift.
+    (assm->*emit_shift)(tmp.low_gp(), tmp.high_gp(), src.low_gp(),
+                        src.high_gp(), amount);
+
+    // Place result in destination register.
+    assm->TurboAssembler::Move(dst.high_gp(), tmp.high_gp());
+    assm->TurboAssembler::Move(dst.low_gp(), tmp.low_gp());
+  } else {
+    (assm->*emit_shift)(dst.low_gp(), dst.high_gp(), src.low_gp(),
+                        src.high_gp(), amount);
   }
-#define UNIMPLEMENTED_FP_BINOP(name)                                         \
+  assm->TurboAssembler::Branch(&done);
+
+  // If shift amount is 0, move src to dst.
+  assm->bind(&move);
+  assm->TurboAssembler::Move(dst.high_gp(), src.high_gp());
+  assm->TurboAssembler::Move(dst.low_gp(), src.low_gp());
+
+  assm->bind(&done);
+}
+}  // namespace liftoff
+
+void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
+                                    Register amount, LiftoffRegList pinned) {
+  liftoff::Emit64BitShiftOperation(this, dst, src, amount,
+                                   &TurboAssembler::ShlPair, pinned);
+}
+
+void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
+                                    Register amount, LiftoffRegList pinned) {
+  liftoff::Emit64BitShiftOperation(this, dst, src, amount,
+                                   &TurboAssembler::SarPair, pinned);
+}
+
+void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
+                                    Register amount, LiftoffRegList pinned) {
+  liftoff::Emit64BitShiftOperation(this, dst, src, amount,
+                                   &TurboAssembler::ShrPair, pinned);
+}
+
+#define FP_BINOP(name, instruction)                                          \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister lhs, \
                                      DoubleRegister rhs) {                   \
-    UNIMPLEMENTED();                                                         \
+    instruction(dst, lhs, rhs);                                              \
+  }
+#define FP_UNOP(name, instruction)                                             \
+  void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
+    instruction(dst, src);                                                     \
+  }
+
+FP_BINOP(f32_add, add_s)
+FP_BINOP(f32_sub, sub_s)
+FP_BINOP(f32_mul, mul_s)
+FP_BINOP(f32_div, div_s)
+FP_UNOP(f32_abs, abs_s)
+FP_UNOP(f32_neg, neg_s)
+FP_UNOP(f32_sqrt, sqrt_s)
+FP_BINOP(f64_add, add_d)
+FP_BINOP(f64_sub, sub_d)
+FP_BINOP(f64_mul, mul_d)
+FP_BINOP(f64_div, div_d)
+FP_UNOP(f64_abs, abs_d)
+FP_UNOP(f64_neg, neg_d)
+FP_UNOP(f64_sqrt, sqrt_d)
+
+#undef FP_BINOP
+#undef FP_UNOP
+
+bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
+                                            LiftoffRegister dst,
+                                            LiftoffRegister src) {
+  switch (opcode) {
+    case kExprI32ConvertI64:
+      TurboAssembler::Move(dst.gp(), src.low_gp());
+      return true;
+    case kExprI32ReinterpretF32:
+      mfc1(dst.gp(), src.fp());
+      return true;
+    case kExprI64SConvertI32:
+      TurboAssembler::Move(dst.low_gp(), src.gp());
+      TurboAssembler::Move(dst.high_gp(), src.gp());
+      sra(dst.high_gp(), dst.high_gp(), 31);
+      return true;
+    case kExprI64UConvertI32:
+      TurboAssembler::Move(dst.low_gp(), src.gp());
+      TurboAssembler::Move(dst.high_gp(), zero_reg);
+      return true;
+    case kExprI64ReinterpretF64:
+      mfc1(dst.low_gp(), src.fp());
+      TurboAssembler::Mfhc1(dst.high_gp(), src.fp());
+      return true;
+    case kExprF32SConvertI32: {
+      LiftoffRegister scratch =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(dst));
+      mtc1(src.gp(), scratch.fp());
+      cvt_s_w(dst.fp(), scratch.fp());
+      return true;
+    }
+    case kExprF32UConvertI32: {
+      LiftoffRegister scratch =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(dst));
+      TurboAssembler::Cvt_d_uw(dst.fp(), src.gp(), scratch.fp());
+      cvt_s_d(dst.fp(), dst.fp());
+      return true;
+    }
+    case kExprF32ConvertF64:
+      cvt_s_d(dst.fp(), src.fp());
+      return true;
+    case kExprF32ReinterpretI32:
+      TurboAssembler::FmoveLow(dst.fp(), src.gp());
+      return true;
+    case kExprF64SConvertI32: {
+      LiftoffRegister scratch =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(dst));
+      mtc1(src.gp(), scratch.fp());
+      cvt_d_w(dst.fp(), scratch.fp());
+      return true;
+    }
+    case kExprF64UConvertI32: {
+      LiftoffRegister scratch =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(dst));
+      TurboAssembler::Cvt_d_uw(dst.fp(), src.gp(), scratch.fp());
+      return true;
+    }
+    case kExprF64ConvertF32:
+      cvt_d_s(dst.fp(), src.fp());
+      return true;
+    case kExprF64ReinterpretI64:
+      mtc1(src.low_gp(), dst.fp());
+      TurboAssembler::Mthc1(src.high_gp(), dst.fp());
+      return true;
+    default:
+      return false;
+  }
+}
+
+void LiftoffAssembler::emit_jump(Label* label) {
+  TurboAssembler::Branch(label);
+}
+
+void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label,
+                                      ValueType type, Register lhs,
+                                      Register rhs) {
+  if (rhs != no_reg) {
+    TurboAssembler::Branch(label, cond, lhs, Operand(rhs));
+  } else {
+    TurboAssembler::Branch(label, cond, lhs, Operand(zero_reg));
   }
+}
 
-UNIMPLEMENTED_GP_BINOP(i32_add)
-UNIMPLEMENTED_GP_BINOP(i32_sub)
-UNIMPLEMENTED_GP_BINOP(i32_mul)
-UNIMPLEMENTED_GP_BINOP(i32_and)
-UNIMPLEMENTED_GP_BINOP(i32_or)
-UNIMPLEMENTED_GP_BINOP(i32_xor)
-UNIMPLEMENTED_GP_BINOP(i32_shl)
-UNIMPLEMENTED_GP_BINOP(i32_sar)
-UNIMPLEMENTED_GP_BINOP(i32_shr)
-UNIMPLEMENTED_GP_UNOP(i32_eqz)
-UNIMPLEMENTED_GP_UNOP(i32_clz)
-UNIMPLEMENTED_GP_UNOP(i32_ctz)
-UNIMPLEMENTED_GP_UNOP(i32_popcnt)
-UNIMPLEMENTED_GP_BINOP(ptrsize_add)
-UNIMPLEMENTED_FP_BINOP(f32_add)
-UNIMPLEMENTED_FP_BINOP(f32_sub)
-UNIMPLEMENTED_FP_BINOP(f32_mul)
+void LiftoffAssembler::emit_i32_eqz(Register dst, Register src) {
+  sltiu(dst, src, 1);
+}
 
-#undef UNIMPLEMENTED_GP_BINOP
-#undef UNIMPLEMENTED_GP_UNOP
-#undef UNIMPLEMENTED_FP_BINOP
+void LiftoffAssembler::emit_i32_set_cond(Condition cond, Register dst,
+                                         Register lhs, Register rhs) {
+  Register tmp = dst;
+  if (dst == lhs || dst == rhs) {
+    tmp = GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(lhs, rhs)).gp();
+  }
+  // Write 1 as result.
+  TurboAssembler::li(tmp, 1);
 
-void LiftoffAssembler::emit_i32_test(Register reg) { UNIMPLEMENTED(); }
+  // If negative condition is true, write 0 as result.
+  Condition neg_cond = NegateCondition(cond);
+  TurboAssembler::LoadZeroOnCondition(tmp, lhs, Operand(rhs), neg_cond);
 
-void LiftoffAssembler::emit_i32_compare(Register lhs, Register rhs) {
-  UNIMPLEMENTED();
+  // If tmp != dst, result will be moved.
+  TurboAssembler::Move(dst, tmp);
 }
 
-void LiftoffAssembler::emit_jump(Label* label) { UNIMPLEMENTED(); }
+void LiftoffAssembler::emit_i64_eqz(Register dst, LiftoffRegister src) {
+  Register tmp =
+      GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(src, dst)).gp();
+  sltiu(tmp, src.low_gp(), 1);
+  sltiu(dst, src.high_gp(), 1);
+  and_(dst, dst, tmp);
+}
 
-void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label) {
-  UNIMPLEMENTED();
+namespace liftoff {
+inline Condition cond_make_unsigned(Condition cond) {
+  switch (cond) {
+    case kSignedLessThan:
+      return kUnsignedLessThan;
+    case kSignedLessEqual:
+      return kUnsignedLessEqual;
+    case kSignedGreaterThan:
+      return kUnsignedGreaterThan;
+    case kSignedGreaterEqual:
+      return kUnsignedGreaterEqual;
+    default:
+      return cond;
+  }
 }
+}  // namespace liftoff
+
+void LiftoffAssembler::emit_i64_set_cond(Condition cond, Register dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  Label low, cont;
+
+  // For signed i64 comparisons, we still need to use unsigned comparison for
+  // the low word (the only bit carrying signedness information is the MSB in
+  // the high word).
+  Condition unsigned_cond = liftoff::cond_make_unsigned(cond);
+
+  Register tmp = dst;
+  if (liftoff::IsRegInRegPair(lhs, dst) || liftoff::IsRegInRegPair(rhs, dst)) {
+    tmp =
+        GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(dst, lhs, rhs)).gp();
+  }
+
+  // Write 1 initially in tmp register.
+  TurboAssembler::li(tmp, 1);
 
-void LiftoffAssembler::StackCheck(Label* ool_code) { UNIMPLEMENTED(); }
+  // If high words are equal, then compare low words, else compare high.
+  Branch(&low, eq, lhs.high_gp(), Operand(rhs.high_gp()));
 
-void LiftoffAssembler::CallTrapCallbackForTesting() { UNIMPLEMENTED(); }
+  TurboAssembler::LoadZeroOnCondition(
+      tmp, lhs.high_gp(), Operand(rhs.high_gp()), NegateCondition(cond));
+  Branch(&cont);
+
+  bind(&low);
+  TurboAssembler::LoadZeroOnCondition(tmp, lhs.low_gp(), Operand(rhs.low_gp()),
+                                      NegateCondition(unsigned_cond));
+
+  bind(&cont);
+  // Move result to dst register if needed.
+  TurboAssembler::Move(dst, tmp);
+}
+
+void LiftoffAssembler::emit_f32_set_cond(Condition cond, Register dst,
+                                         DoubleRegister lhs,
+                                         DoubleRegister rhs) {
+  BAILOUT("emit_f32_set_cond");
+}
+
+void LiftoffAssembler::StackCheck(Label* ool_code) {
+  LiftoffRegister tmp = GetUnusedRegister(kGpReg);
+  TurboAssembler::li(
+      tmp.gp(), Operand(ExternalReference::address_of_stack_limit(isolate())));
+  TurboAssembler::Ulw(tmp.gp(), MemOperand(tmp.gp()));
+  TurboAssembler::Branch(ool_code, ule, sp, Operand(tmp.gp()));
+}
+
+void LiftoffAssembler::CallTrapCallbackForTesting() {
+  PrepareCallCFunction(0, GetUnusedRegister(kGpReg).gp());
+  CallCFunction(
+      ExternalReference::wasm_call_trap_callback_for_testing(isolate()), 0);
+}
 
 void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
-  UNIMPLEMENTED();
+  if (emit_debug_code()) Abort(reason);
 }
 
 void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index) {
-  UNIMPLEMENTED();
+                                           uint32_t src_index,
+                                           RegPairHalf half) {
+  switch (src.loc()) {
+    case VarState::kStack: {
+      if (src.type() == kWasmF64) {
+        DCHECK_EQ(kLowWord, half);
+        lw(at, liftoff::GetHalfStackSlot(2 * src_index - 1));
+        push(at);
+      }
+      lw(at,
+         liftoff::GetHalfStackSlot(2 * src_index + (half == kLowWord ? 0 : 1)));
+      push(at);
+      break;
+    }
+    case VarState::kRegister:
+      if (src.type() == kWasmI64) {
+        PushCallerFrameSlot(
+            half == kLowWord ? src.reg().low() : src.reg().high(), kWasmI32);
+      } else {
+        PushCallerFrameSlot(src.reg(), src.type());
+      }
+      break;
+    case VarState::KIntConst: {
+      // The high word is the sign extension of the low word.
+      li(at,
+         Operand(half == kLowWord ? src.i32_const() : src.i32_const() >> 31));
+      push(at);
+      break;
+    }
+  }
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
+                                           ValueType type) {
+  liftoff::push(this, reg, type);
 }
 
-void LiftoffAssembler::PushRegisters(LiftoffRegList regs) { UNIMPLEMENTED(); }
+void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
+  LiftoffRegList gp_regs = regs & kGpCacheRegList;
+  unsigned num_gp_regs = gp_regs.GetNumRegsSet();
+  if (num_gp_regs) {
+    unsigned offset = num_gp_regs * kPointerSize;
+    addiu(sp, sp, -offset);
+    while (!gp_regs.is_empty()) {
+      LiftoffRegister reg = gp_regs.GetFirstRegSet();
+      offset -= kPointerSize;
+      sw(reg.gp(), MemOperand(sp, offset));
+      gp_regs.clear(reg);
+    }
+    DCHECK_EQ(offset, 0);
+  }
+  LiftoffRegList fp_regs = regs & kFpCacheRegList;
+  unsigned num_fp_regs = fp_regs.GetNumRegsSet();
+  if (num_fp_regs) {
+    addiu(sp, sp, -(num_fp_regs * kStackSlotSize));
+    unsigned offset = 0;
+    while (!fp_regs.is_empty()) {
+      LiftoffRegister reg = fp_regs.GetFirstRegSet();
+      TurboAssembler::Sdc1(reg.fp(), MemOperand(sp, offset));
+      fp_regs.clear(reg);
+      offset += sizeof(double);
+    }
+    DCHECK_EQ(offset, num_fp_regs * sizeof(double));
+  }
+}
 
-void LiftoffAssembler::PopRegisters(LiftoffRegList regs) { UNIMPLEMENTED(); }
+void LiftoffAssembler::PopRegisters(LiftoffRegList regs) {
+  LiftoffRegList fp_regs = regs & kFpCacheRegList;
+  unsigned fp_offset = 0;
+  while (!fp_regs.is_empty()) {
+    LiftoffRegister reg = fp_regs.GetFirstRegSet();
+    TurboAssembler::Ldc1(reg.fp(), MemOperand(sp, fp_offset));
+    fp_regs.clear(reg);
+    fp_offset += sizeof(double);
+  }
+  if (fp_offset) addiu(sp, sp, fp_offset);
+  LiftoffRegList gp_regs = regs & kGpCacheRegList;
+  unsigned gp_offset = 0;
+  while (!gp_regs.is_empty()) {
+    LiftoffRegister reg = gp_regs.GetLastRegSet();
+    lw(reg.gp(), MemOperand(sp, gp_offset));
+    gp_regs.clear(reg);
+    gp_offset += kPointerSize;
+  }
+  addiu(sp, sp, gp_offset);
+}
 
 void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
-  UNIMPLEMENTED();
+  DCHECK_LT(num_stack_slots, (1 << 16) / kPointerSize);  // 16 bit immediate
+  TurboAssembler::DropAndRet(static_cast<int>(num_stack_slots));
 }
 
-void LiftoffAssembler::PrepareCCall(uint32_t num_params, const Register* args) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
+                                    const LiftoffRegister* args,
+                                    ValueType out_argument_type) {
+  int pushed_bytes = 0;
+  for (ValueType param_type : sig->parameters()) {
+    pushed_bytes += RoundUp<kPointerSize>(WasmOpcodes::MemSize(param_type));
+    liftoff::push(this, *args++, param_type);
+  }
+  if (out_argument_type != kWasmStmt) {
+    int size = RoundUp<kPointerSize>(WasmOpcodes::MemSize(out_argument_type));
+    addiu(sp, sp, -size);
+    pushed_bytes += size;
+  }
+  // Save the original sp (before the first push), such that we can later
+  // compute pointers to the pushed values. Do this only *after* pushing the
+  // values, because {kCCallLastArgAddrReg} might collide with an arg register.
+  addiu(liftoff::kCCallLastArgAddrReg, sp, pushed_bytes);
+  constexpr Register kScratch = at;
+  static_assert(kScratch != liftoff::kCCallLastArgAddrReg, "collision");
+  int num_c_call_arguments = static_cast<int>(sig->parameter_count()) +
+                             (out_argument_type != kWasmStmt);
+  PrepareCallCFunction(num_c_call_arguments, kScratch);
+}
+
+void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
+                                            ValueType type) {
+  // Check that we don't accidentally override kCCallLastArgAddrReg.
+  DCHECK_NE(liftoff::kCCallLastArgAddrReg, dst);
+  addiu(dst, liftoff::kCCallLastArgAddrReg, -param_byte_offset);
 }
 
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, uint32_t param_idx,
-                                            uint32_t num_params) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
+                                              int param_byte_offset,
+                                              ValueType type) {
+  static constexpr Register kScratch = at;
+  SetCCallRegParamAddr(kScratch, param_byte_offset, type);
+  sw(kScratch, MemOperand(sp, stack_param_idx * kPointerSize));
 }
 
-void LiftoffAssembler::SetCCallStackParamAddr(uint32_t stack_param_idx,
-                                              uint32_t param_idx,
-                                              uint32_t num_params) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
+                                            int param_byte_offset) {
+  // Check that we don't accidentally override kCCallLastArgAddrReg.
+  DCHECK_NE(LiftoffRegister(liftoff::kCCallLastArgAddrReg), dst);
+  MemOperand src(liftoff::kCCallLastArgAddrReg, -param_byte_offset);
+  liftoff::Load(this, dst, src, type);
 }
 
 void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
-  UNIMPLEMENTED();
+  CallCFunction(ext_ref, static_cast<int>(num_params));
+}
+
+void LiftoffAssembler::FinishCCall() {
+  TurboAssembler::Move(sp, liftoff::kCCallLastArgAddrReg);
 }
 
-void LiftoffAssembler::CallNativeWasmCode(Address addr) { UNIMPLEMENTED(); }
+void LiftoffAssembler::CallNativeWasmCode(Address addr) {
+  Call(addr, RelocInfo::WASM_CALL);
+}
 
 void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
-  UNIMPLEMENTED();
+  // Set context to zero.
+  TurboAssembler::Move(cp, zero_reg);
+  CallRuntimeDelayed(zone, fid);
+}
+
+void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
+                                    compiler::CallDescriptor* call_descriptor,
+                                    Register target) {
+  if (target == no_reg) {
+    pop(at);
+    Call(at);
+  } else {
+    Call(target);
+  }
 }
 
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
-  UNIMPLEMENTED();
+  addiu(sp, sp, -size);
+  TurboAssembler::Move(addr, sp);
 }
 
-void LiftoffAssembler::DeallocateStackSlot(uint32_t size) { UNIMPLEMENTED(); }
+void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
+  addiu(sp, sp, size);
+}
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_MIPS_H_
+#undef BAILOUT
+
+#endif  // V8_WASM_BASELINE_MIPS_LIFTOFF_ASSEMBLER_MIPS_H_
diff --git a/deps/v8/src/wasm/baseline/mips64/OWNERS b/deps/v8/src/wasm/baseline/mips64/OWNERS
new file mode 100644
index 00000000000..cf2df277c96
--- /dev/null
+++ b/deps/v8/src/wasm/baseline/mips64/OWNERS
@@ -0,0 +1,3 @@
+ivica.bogosavljevic@mips.com
+Miran.Karic@mips.com
+sreten.kovacevic@mips.com
diff --git a/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h b/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h
index fd63198e249..beac6b37507 100644
--- a/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h
+++ b/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h
@@ -2,180 +2,735 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_MIPS64_H_
-#define V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_MIPS64_H_
+#ifndef V8_WASM_BASELINE_MIPS64_LIFTOFF_ASSEMBLER_MIPS64_H_
+#define V8_WASM_BASELINE_MIPS64_LIFTOFF_ASSEMBLER_MIPS64_H_
 
 #include "src/wasm/baseline/liftoff-assembler.h"
 
+#define BAILOUT(reason) bailout("mips64 " reason)
+
 namespace v8 {
 namespace internal {
 namespace wasm {
 
-void LiftoffAssembler::ReserveStackSpace(uint32_t bytes) { UNIMPLEMENTED(); }
+namespace liftoff {
+
+// fp-8 holds the stack marker, fp-16 is the wasm context, first stack slot
+// is located at fp-24.
+constexpr int32_t kConstantStackSpace = 16;
+constexpr int32_t kFirstStackSlotOffset =
+    kConstantStackSpace + LiftoffAssembler::kStackSlotSize;
+
+inline MemOperand GetStackSlot(uint32_t index) {
+  int32_t offset = index * LiftoffAssembler::kStackSlotSize;
+  return MemOperand(fp, -kFirstStackSlotOffset - offset);
+}
+
+inline MemOperand GetContextOperand() { return MemOperand(fp, -16); }
+
+// Use this register to store the address of the last argument pushed on the
+// stack for a call to C. This register must be callee saved according to the c
+// calling convention.
+static constexpr Register kCCallLastArgAddrReg = s1;
+
+inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, MemOperand src,
+                 ValueType type) {
+  switch (type) {
+    case kWasmI32:
+      assm->lw(dst.gp(), src);
+      break;
+    case kWasmI64:
+      assm->ld(dst.gp(), src);
+      break;
+    case kWasmF32:
+      assm->lwc1(dst.fp(), src);
+      break;
+    case kWasmF64:
+      assm->Ldc1(dst.fp(), src);
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
+  switch (type) {
+    case kWasmI32:
+    case kWasmI64:
+      assm->push(reg.gp());
+      break;
+    case kWasmF32:
+      assm->daddiu(sp, sp, -kPointerSize);
+      assm->swc1(reg.fp(), MemOperand(sp, 0));
+      break;
+    case kWasmF64:
+      assm->daddiu(sp, sp, -kPointerSize);
+      assm->Sdc1(reg.fp(), MemOperand(sp, 0));
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+}  // namespace liftoff
+
+uint32_t LiftoffAssembler::PrepareStackFrame() {
+  uint32_t offset = static_cast<uint32_t>(pc_offset());
+  // When constant that represents size of stack frame can't be represented
+  // as 16bit we need three instructions to add it to sp, so we reserve space
+  // for this case.
+  daddiu(sp, sp, 0);
+  nop();
+  nop();
+  return offset;
+}
+
+void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+                                              uint32_t stack_slots) {
+  uint64_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
+  DCHECK_LE(bytes, kMaxInt);
+  // We can't run out of space, just pass anything big enough to not cause the
+  // assembler to try to grow the buffer.
+  constexpr int kAvailableSpace = 256;
+  TurboAssembler patching_assembler(isolate(), buffer_ + offset,
+                                    kAvailableSpace, CodeObjectRequired::kNo);
+  // If bytes can be represented as 16bit, daddiu will be generated and two
+  // nops will stay untouched. Otherwise, lui-ori sequence will load it to
+  // register and, as third instruction, daddu will be generated.
+  patching_assembler.Daddu(sp, sp, Operand(-bytes));
+}
 
-void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
+                                    RelocInfo::Mode rmode) {
+  switch (value.type()) {
+    case kWasmI32:
+      TurboAssembler::li(reg.gp(), Operand(value.to_i32(), rmode));
+      break;
+    case kWasmI64:
+      TurboAssembler::li(reg.gp(), Operand(value.to_i64(), rmode));
+      break;
+    case kWasmF32:
+      TurboAssembler::Move(reg.fp(), value.to_f32_boxed().get_bits());
+      break;
+    case kWasmF64:
+      TurboAssembler::Move(reg.fp(), value.to_f64_boxed().get_bits());
+      break;
+    default:
+      UNREACHABLE();
+  }
 }
 
 void LiftoffAssembler::LoadFromContext(Register dst, uint32_t offset,
                                        int size) {
-  UNIMPLEMENTED();
+  DCHECK_LE(offset, kMaxInt);
+  ld(dst, liftoff::GetContextOperand());
+  DCHECK(size == 4 || size == 8);
+  if (size == 4) {
+    lw(dst, MemOperand(dst, offset));
+  } else {
+    ld(dst, MemOperand(dst, offset));
+  }
 }
 
-void LiftoffAssembler::SpillContext(Register context) { UNIMPLEMENTED(); }
+void LiftoffAssembler::SpillContext(Register context) {
+  sd(context, liftoff::GetContextOperand());
+}
 
-void LiftoffAssembler::FillContextInto(Register dst) { UNIMPLEMENTED(); }
+void LiftoffAssembler::FillContextInto(Register dst) {
+  ld(dst, liftoff::GetContextOperand());
+}
 
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
                             uint32_t* protected_load_pc) {
-  UNIMPLEMENTED();
+  // TODO(ksreten): Add check if unaligned memory access
+  MemOperand src_op(src_addr, offset_imm);
+  if (offset_reg != no_reg) {
+    Register src = GetUnusedRegister(kGpReg, pinned).gp();
+    emit_ptrsize_add(src, src_addr, offset_reg);
+    src_op = MemOperand(src, offset_imm);
+  }
+
+  if (protected_load_pc) *protected_load_pc = pc_offset();
+  switch (type.value()) {
+    case LoadType::kI32Load8U:
+    case LoadType::kI64Load8U:
+      lbu(dst.gp(), src_op);
+      break;
+    case LoadType::kI32Load8S:
+    case LoadType::kI64Load8S:
+      lb(dst.gp(), src_op);
+      break;
+    case LoadType::kI32Load16U:
+    case LoadType::kI64Load16U:
+      TurboAssembler::Ulhu(dst.gp(), src_op);
+      break;
+    case LoadType::kI32Load16S:
+    case LoadType::kI64Load16S:
+      TurboAssembler::Ulh(dst.gp(), src_op);
+      break;
+    case LoadType::kI32Load:
+    case LoadType::kI64Load32U:
+      TurboAssembler::Ulwu(dst.gp(), src_op);
+      break;
+    case LoadType::kI64Load32S:
+      TurboAssembler::Ulw(dst.gp(), src_op);
+      break;
+    case LoadType::kI64Load:
+      TurboAssembler::Uld(dst.gp(), src_op);
+      break;
+    case LoadType::kF32Load:
+      TurboAssembler::Ulwc1(dst.fp(), src_op, t8);
+      break;
+    case LoadType::kF64Load:
+      TurboAssembler::Uldc1(dst.fp(), src_op, t8);
+      break;
+    default:
+      UNREACHABLE();
+  }
 }
 
 void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
                              uint32_t* protected_store_pc) {
-  UNIMPLEMENTED();
+  // TODO(ksreten): Add check if unaligned memory access
+  Register dst = no_reg;
+  if (offset_reg != no_reg) {
+    dst = GetUnusedRegister(kGpReg, pinned).gp();
+    emit_ptrsize_add(dst, dst_addr, offset_reg);
+  }
+  MemOperand dst_op = (offset_reg != no_reg) ? MemOperand(dst, offset_imm)
+                                             : MemOperand(dst_addr, offset_imm);
+
+  if (protected_store_pc) *protected_store_pc = pc_offset();
+  switch (type.value()) {
+    case StoreType::kI32Store8:
+    case StoreType::kI64Store8:
+      sb(src.gp(), dst_op);
+      break;
+    case StoreType::kI32Store16:
+    case StoreType::kI64Store16:
+      TurboAssembler::Ush(src.gp(), dst_op, t8);
+      break;
+    case StoreType::kI32Store:
+    case StoreType::kI64Store32:
+      TurboAssembler::Usw(src.gp(), dst_op);
+      break;
+    case StoreType::kI64Store:
+      TurboAssembler::Usd(src.gp(), dst_op);
+      break;
+    case StoreType::kF32Store:
+      TurboAssembler::Uswc1(src.fp(), dst_op, t8);
+      break;
+    case StoreType::kF64Store:
+      TurboAssembler::Usdc1(src.fp(), dst_op, t8);
+      break;
+    default:
+      UNREACHABLE();
+  }
 }
 
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
-                                           uint32_t caller_slot_idx) {
-  UNIMPLEMENTED();
+                                           uint32_t caller_slot_idx,
+                                           ValueType type) {
+  MemOperand src(fp, kPointerSize * (caller_slot_idx + 1));
+  liftoff::Load(this, dst, src, type);
+}
+
+void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+                                      ValueType type) {
+  DCHECK_NE(dst_index, src_index);
+  LiftoffRegister reg = GetUnusedRegister(reg_class_for(type));
+  Fill(reg, src_index, type);
+  Spill(dst_index, reg, type);
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
+                                            ValueType type) {
+  LiftoffRegister dst = reg.is_gp() ? LiftoffRegister(v0) : LiftoffRegister(f2);
+  if (reg != dst) Move(dst, reg, type);
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
+  DCHECK_NE(dst, src);
+  // TODO(ksreten): Handle different sizes here.
+  TurboAssembler::Move(dst, src);
 }
 
-void LiftoffAssembler::Move(LiftoffRegister dst, LiftoffRegister src) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
+                            ValueType type) {
+  DCHECK_NE(dst, src);
+  TurboAssembler::Move(dst, src);
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
+                             ValueType type) {
+  RecordUsedSpillSlot(index);
+  MemOperand dst = liftoff::GetStackSlot(index);
+  switch (type) {
+    case kWasmI32:
+      sw(reg.gp(), dst);
+      break;
+    case kWasmI64:
+      sd(reg.gp(), dst);
+      break;
+    case kWasmF32:
+      swc1(reg.fp(), dst);
+      break;
+    case kWasmF64:
+      TurboAssembler::Sdc1(reg.fp(), dst);
+      break;
+    default:
+      UNREACHABLE();
+  }
 }
 
 void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
-  UNIMPLEMENTED();
+  RecordUsedSpillSlot(index);
+  MemOperand dst = liftoff::GetStackSlot(index);
+  switch (value.type()) {
+    case kWasmI32: {
+      LiftoffRegister tmp = GetUnusedRegister(kGpReg);
+      TurboAssembler::li(tmp.gp(), Operand(value.to_i32()));
+      sw(tmp.gp(), dst);
+      break;
+    }
+    case kWasmI64: {
+      LiftoffRegister tmp = GetUnusedRegister(kGpReg);
+      TurboAssembler::li(tmp.gp(), value.to_i64());
+      sd(tmp.gp(), dst);
+      break;
+    }
+    default:
+      // kWasmF32 and kWasmF64 are unreachable, since those
+      // constants are not tracked.
+      UNREACHABLE();
+  }
+}
+
+void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
+                            ValueType type) {
+  MemOperand src = liftoff::GetStackSlot(index);
+  switch (type) {
+    case kWasmI32:
+      lw(reg.gp(), src);
+      break;
+    case kWasmI64:
+      ld(reg.gp(), src);
+      break;
+    case kWasmF32:
+      lwc1(reg.fp(), src);
+      break;
+    case kWasmF64:
+      TurboAssembler::Ldc1(reg.fp(), src);
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+void LiftoffAssembler::FillI64Half(Register, uint32_t half_index) {
+  UNREACHABLE();
+}
+
+void LiftoffAssembler::emit_i32_mul(Register dst, Register lhs, Register rhs) {
+  TurboAssembler::Mul(dst, lhs, rhs);
+}
+
+#define I32_BINOP(name, instruction)                                 \
+  void LiftoffAssembler::emit_i32_##name(Register dst, Register lhs, \
+                                         Register rhs) {             \
+    instruction(dst, lhs, rhs);                                      \
+  }
+
+// clang-format off
+I32_BINOP(add, addu)
+I32_BINOP(sub, subu)
+I32_BINOP(and, and_)
+I32_BINOP(or, or_)
+I32_BINOP(xor, xor_)
+// clang-format on
+
+#undef I32_BINOP
+
+void LiftoffAssembler::emit_ptrsize_add(Register dst, Register lhs,
+                                        Register rhs) {
+  TurboAssembler::Daddu(dst, lhs, rhs);
+}
+
+bool LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
+  TurboAssembler::Clz(dst, src);
+  return true;
+}
+
+bool LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
+  TurboAssembler::Ctz(dst, src);
+  return true;
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index) {
-  UNIMPLEMENTED();
+bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
+  TurboAssembler::Popcnt(dst, src);
+  return true;
 }
 
-#define UNIMPLEMENTED_GP_BINOP(name)                             \
-  void LiftoffAssembler::emit_##name(Register dst, Register lhs, \
-                                     Register rhs) {             \
-    UNIMPLEMENTED();                                             \
+#define I32_SHIFTOP(name, instruction)                                      \
+  void LiftoffAssembler::emit_i32_##name(                                   \
+      Register dst, Register src, Register amount, LiftoffRegList pinned) { \
+    instruction(dst, src, amount);                                          \
   }
-#define UNIMPLEMENTED_GP_UNOP(name)                                \
-  bool LiftoffAssembler::emit_##name(Register dst, Register src) { \
-    UNIMPLEMENTED();                                               \
+
+I32_SHIFTOP(shl, sllv)
+I32_SHIFTOP(sar, srav)
+I32_SHIFTOP(shr, srlv)
+
+#undef I32_SHIFTOP
+
+#define I64_SHIFTOP(name, instruction)                                         \
+  void LiftoffAssembler::emit_i64_##name(LiftoffRegister dst,                  \
+                                         LiftoffRegister src, Register amount, \
+                                         LiftoffRegList pinned) {              \
+    instruction(dst.gp(), src.gp(), amount);                                   \
   }
-#define UNIMPLEMENTED_FP_BINOP(name)                                         \
+
+I64_SHIFTOP(shl, dsllv)
+I64_SHIFTOP(sar, dsrav)
+I64_SHIFTOP(shr, dsrlv)
+
+#undef I32_SHIFTOP
+
+#define FP_BINOP(name, instruction)                                          \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister lhs, \
                                      DoubleRegister rhs) {                   \
-    UNIMPLEMENTED();                                                         \
+    instruction(dst, lhs, rhs);                                              \
+  }
+#define FP_UNOP(name, instruction)                                             \
+  void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
+    instruction(dst, src);                                                     \
+  }
+
+FP_BINOP(f32_add, add_s)
+FP_BINOP(f32_sub, sub_s)
+FP_BINOP(f32_mul, mul_s)
+FP_BINOP(f32_div, div_s)
+FP_UNOP(f32_abs, abs_s)
+FP_UNOP(f32_neg, neg_s)
+FP_UNOP(f32_sqrt, sqrt_s)
+FP_BINOP(f64_add, add_d)
+FP_BINOP(f64_sub, sub_d)
+FP_BINOP(f64_mul, mul_d)
+FP_BINOP(f64_div, div_d)
+FP_UNOP(f64_abs, abs_d)
+FP_UNOP(f64_neg, neg_d)
+FP_UNOP(f64_sqrt, sqrt_d)
+
+#undef FP_BINOP
+#undef FP_UNOP
+
+bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
+                                            LiftoffRegister dst,
+                                            LiftoffRegister src) {
+  switch (opcode) {
+    case kExprI32ConvertI64:
+      TurboAssembler::Ext(dst.gp(), src.gp(), 0, 32);
+      return true;
+    case kExprI32ReinterpretF32:
+      TurboAssembler::FmoveLow(dst.gp(), src.fp());
+      return true;
+    case kExprI64SConvertI32:
+      sll(dst.gp(), src.gp(), 0);
+      return true;
+    case kExprI64UConvertI32:
+      TurboAssembler::Dext(dst.gp(), src.gp(), 0, 32);
+      return true;
+    case kExprI64ReinterpretF64:
+      dmfc1(dst.gp(), src.fp());
+      return true;
+    case kExprF32SConvertI32: {
+      LiftoffRegister scratch =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(dst));
+      mtc1(src.gp(), scratch.fp());
+      cvt_s_w(dst.fp(), scratch.fp());
+      return true;
+    }
+    case kExprF32UConvertI32:
+      TurboAssembler::Cvt_s_uw(dst.fp(), src.gp());
+      return true;
+    case kExprF32ConvertF64:
+      cvt_s_d(dst.fp(), src.fp());
+      return true;
+    case kExprF32ReinterpretI32:
+      TurboAssembler::FmoveLow(dst.fp(), src.gp());
+      return true;
+    case kExprF64SConvertI32: {
+      LiftoffRegister scratch =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(dst));
+      mtc1(src.gp(), scratch.fp());
+      cvt_d_w(dst.fp(), scratch.fp());
+      return true;
+    }
+    case kExprF64UConvertI32:
+      TurboAssembler::Cvt_d_uw(dst.fp(), src.gp());
+      return true;
+    case kExprF64ConvertF32:
+      cvt_d_s(dst.fp(), src.fp());
+      return true;
+    case kExprF64ReinterpretI64:
+      dmtc1(src.gp(), dst.fp());
+      return true;
+    default:
+      return false;
+  }
+}
+
+void LiftoffAssembler::emit_jump(Label* label) {
+  TurboAssembler::Branch(label);
+}
+
+void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label,
+                                      ValueType type, Register lhs,
+                                      Register rhs) {
+  if (rhs != no_reg) {
+    TurboAssembler::Branch(label, cond, lhs, Operand(rhs));
+  } else {
+    TurboAssembler::Branch(label, cond, lhs, Operand(zero_reg));
   }
+}
 
-UNIMPLEMENTED_GP_BINOP(i32_add)
-UNIMPLEMENTED_GP_BINOP(i32_sub)
-UNIMPLEMENTED_GP_BINOP(i32_mul)
-UNIMPLEMENTED_GP_BINOP(i32_and)
-UNIMPLEMENTED_GP_BINOP(i32_or)
-UNIMPLEMENTED_GP_BINOP(i32_xor)
-UNIMPLEMENTED_GP_BINOP(i32_shl)
-UNIMPLEMENTED_GP_BINOP(i32_sar)
-UNIMPLEMENTED_GP_BINOP(i32_shr)
-UNIMPLEMENTED_GP_UNOP(i32_eqz)
-UNIMPLEMENTED_GP_UNOP(i32_clz)
-UNIMPLEMENTED_GP_UNOP(i32_ctz)
-UNIMPLEMENTED_GP_UNOP(i32_popcnt)
-UNIMPLEMENTED_GP_BINOP(ptrsize_add)
-UNIMPLEMENTED_FP_BINOP(f32_add)
-UNIMPLEMENTED_FP_BINOP(f32_sub)
-UNIMPLEMENTED_FP_BINOP(f32_mul)
+void LiftoffAssembler::emit_i32_eqz(Register dst, Register src) {
+  sltiu(dst, src, 1);
+}
 
-#undef UNIMPLEMENTED_GP_BINOP
-#undef UNIMPLEMENTED_GP_UNOP
-#undef UNIMPLEMENTED_FP_BINOP
+void LiftoffAssembler::emit_i32_set_cond(Condition cond, Register dst,
+                                         Register lhs, Register rhs) {
+  Register tmp = dst;
+  if (dst == lhs || dst == rhs) {
+    tmp = GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(lhs, rhs)).gp();
+  }
+  // Write 1 as result.
+  TurboAssembler::li(tmp, 1);
 
-void LiftoffAssembler::emit_i32_test(Register reg) { UNIMPLEMENTED(); }
+  // If negative condition is true, write 0 as result.
+  Condition neg_cond = NegateCondition(cond);
+  TurboAssembler::LoadZeroOnCondition(tmp, lhs, Operand(rhs), neg_cond);
 
-void LiftoffAssembler::emit_i32_compare(Register lhs, Register rhs) {
-  UNIMPLEMENTED();
+  // If tmp != dst, result will be moved.
+  TurboAssembler::Move(dst, tmp);
 }
 
-void LiftoffAssembler::emit_jump(Label* label) { UNIMPLEMENTED(); }
+void LiftoffAssembler::emit_i64_eqz(Register dst, LiftoffRegister src) {
+  sltiu(dst, src.gp(), 1);
+}
+
+void LiftoffAssembler::emit_i64_set_cond(Condition cond, Register dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  Register tmp = dst;
+  if (dst == lhs.gp() || dst == rhs.gp()) {
+    tmp = GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(lhs, rhs)).gp();
+  }
+  // Write 1 as result.
+  TurboAssembler::li(tmp, 1);
+
+  // If negative condition is true, write 0 as result.
+  Condition neg_cond = NegateCondition(cond);
+  TurboAssembler::LoadZeroOnCondition(tmp, lhs.gp(), Operand(rhs.gp()),
+                                      neg_cond);
+
+  // If tmp != dst, result will be moved.
+  TurboAssembler::Move(dst, tmp);
+}
 
-void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::emit_f32_set_cond(Condition cond, Register dst,
+                                         DoubleRegister lhs,
+                                         DoubleRegister rhs) {
+  BAILOUT("emit_f32_set_cond");
 }
 
-void LiftoffAssembler::StackCheck(Label* ool_code) { UNIMPLEMENTED(); }
+void LiftoffAssembler::StackCheck(Label* ool_code) {
+  LiftoffRegister tmp = GetUnusedRegister(kGpReg);
+  TurboAssembler::li(
+      tmp.gp(), Operand(ExternalReference::address_of_stack_limit(isolate())));
+  TurboAssembler::Uld(tmp.gp(), MemOperand(tmp.gp()));
+  TurboAssembler::Branch(ool_code, ule, sp, Operand(tmp.gp()));
+}
 
-void LiftoffAssembler::CallTrapCallbackForTesting() { UNIMPLEMENTED(); }
+void LiftoffAssembler::CallTrapCallbackForTesting() {
+  PrepareCallCFunction(0, GetUnusedRegister(kGpReg).gp());
+  CallCFunction(
+      ExternalReference::wasm_call_trap_callback_for_testing(isolate()), 0);
+}
 
 void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
-  UNIMPLEMENTED();
+  if (emit_debug_code()) Abort(reason);
 }
 
 void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index) {
-  UNIMPLEMENTED();
+                                           uint32_t src_index,
+                                           RegPairHalf half) {
+  switch (src.loc()) {
+    case VarState::kStack:
+      ld(at, liftoff::GetStackSlot(src_index));
+      push(at);
+      break;
+    case VarState::kRegister:
+      PushCallerFrameSlot(src.reg(), src.type());
+      break;
+    case VarState::KIntConst: {
+      li(at, Operand(src.i32_const()));
+      push(at);
+      break;
+    }
+  }
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
+                                           ValueType type) {
+  liftoff::push(this, reg, type);
 }
 
-void LiftoffAssembler::PushRegisters(LiftoffRegList regs) { UNIMPLEMENTED(); }
+void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
+  LiftoffRegList gp_regs = regs & kGpCacheRegList;
+  unsigned num_gp_regs = gp_regs.GetNumRegsSet();
+  if (num_gp_regs) {
+    unsigned offset = num_gp_regs * kPointerSize;
+    daddiu(sp, sp, -offset);
+    while (!gp_regs.is_empty()) {
+      LiftoffRegister reg = gp_regs.GetFirstRegSet();
+      offset -= kPointerSize;
+      sd(reg.gp(), MemOperand(sp, offset));
+      gp_regs.clear(reg);
+    }
+    DCHECK_EQ(offset, 0);
+  }
+  LiftoffRegList fp_regs = regs & kFpCacheRegList;
+  unsigned num_fp_regs = fp_regs.GetNumRegsSet();
+  if (num_fp_regs) {
+    daddiu(sp, sp, -(num_fp_regs * kStackSlotSize));
+    unsigned offset = 0;
+    while (!fp_regs.is_empty()) {
+      LiftoffRegister reg = fp_regs.GetFirstRegSet();
+      TurboAssembler::Sdc1(reg.fp(), MemOperand(sp, offset));
+      fp_regs.clear(reg);
+      offset += sizeof(double);
+    }
+    DCHECK_EQ(offset, num_fp_regs * sizeof(double));
+  }
+}
 
-void LiftoffAssembler::PopRegisters(LiftoffRegList regs) { UNIMPLEMENTED(); }
+void LiftoffAssembler::PopRegisters(LiftoffRegList regs) {
+  LiftoffRegList fp_regs = regs & kFpCacheRegList;
+  unsigned fp_offset = 0;
+  while (!fp_regs.is_empty()) {
+    LiftoffRegister reg = fp_regs.GetFirstRegSet();
+    TurboAssembler::Ldc1(reg.fp(), MemOperand(sp, fp_offset));
+    fp_regs.clear(reg);
+    fp_offset += sizeof(double);
+  }
+  if (fp_offset) daddiu(sp, sp, fp_offset);
+  LiftoffRegList gp_regs = regs & kGpCacheRegList;
+  unsigned gp_offset = 0;
+  while (!gp_regs.is_empty()) {
+    LiftoffRegister reg = gp_regs.GetLastRegSet();
+    ld(reg.gp(), MemOperand(sp, gp_offset));
+    gp_regs.clear(reg);
+    gp_offset += kPointerSize;
+  }
+  daddiu(sp, sp, gp_offset);
+}
 
 void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
-  UNIMPLEMENTED();
+  DCHECK_LT(num_stack_slots, (1 << 16) / kPointerSize);  // 16 bit immediate
+  TurboAssembler::DropAndRet(static_cast<int>(num_stack_slots));
+}
+
+void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
+                                    const LiftoffRegister* args,
+                                    ValueType out_argument_type) {
+  for (ValueType param_type : sig->parameters()) {
+    liftoff::push(this, *args++, param_type);
+  }
+  if (out_argument_type != kWasmStmt) {
+    daddiu(sp, sp, -kPointerSize);
+  }
+  // Save the original sp (before the first push), such that we can later
+  // compute pointers to the pushed values. Do this only *after* pushing the
+  // values, because {kCCallLastArgAddrReg} might collide with an arg register.
+  int num_c_call_arguments = static_cast<int>(sig->parameter_count()) +
+                             (out_argument_type != kWasmStmt);
+  int pushed_bytes = kPointerSize * num_c_call_arguments;
+  daddiu(liftoff::kCCallLastArgAddrReg, sp, pushed_bytes);
+  constexpr Register kScratch = at;
+  static_assert(kScratch != liftoff::kCCallLastArgAddrReg, "collision");
+  PrepareCallCFunction(num_c_call_arguments, kScratch);
 }
 
-void LiftoffAssembler::PrepareCCall(uint32_t num_params, const Register* args) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
+                                            ValueType type) {
+  // Check that we don't accidentally override kCCallLastArgAddrReg.
+  DCHECK_NE(liftoff::kCCallLastArgAddrReg, dst);
+  daddiu(dst, liftoff::kCCallLastArgAddrReg, -param_byte_offset);
 }
 
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, uint32_t param_idx,
-                                            uint32_t num_params) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
+                                              int param_byte_offset,
+                                              ValueType type) {
+  static constexpr Register kScratch = at;
+  SetCCallRegParamAddr(kScratch, param_byte_offset, type);
+  sd(kScratch, MemOperand(sp, stack_param_idx * kPointerSize));
 }
 
-void LiftoffAssembler::SetCCallStackParamAddr(uint32_t stack_param_idx,
-                                              uint32_t param_idx,
-                                              uint32_t num_params) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
+                                            int param_byte_offset) {
+  // Check that we don't accidentally override kCCallLastArgAddrReg.
+  DCHECK_NE(LiftoffRegister(liftoff::kCCallLastArgAddrReg), dst);
+  MemOperand src(liftoff::kCCallLastArgAddrReg, -param_byte_offset);
+  liftoff::Load(this, dst, src, type);
 }
 
 void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
-  UNIMPLEMENTED();
+  CallCFunction(ext_ref, static_cast<int>(num_params));
 }
 
-void LiftoffAssembler::CallNativeWasmCode(Address addr) { UNIMPLEMENTED(); }
+void LiftoffAssembler::FinishCCall() {
+  TurboAssembler::Move(sp, liftoff::kCCallLastArgAddrReg);
+}
+
+void LiftoffAssembler::CallNativeWasmCode(Address addr) {
+  Call(addr, RelocInfo::WASM_CALL);
+}
 
 void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
-  UNIMPLEMENTED();
+  // Set context to zero.
+  TurboAssembler::Move(cp, zero_reg);
+  CallRuntimeDelayed(zone, fid);
+}
+
+void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
+                                    compiler::CallDescriptor* call_descriptor,
+                                    Register target) {
+  if (target == no_reg) {
+    pop(at);
+    Call(at);
+  } else {
+    Call(target);
+  }
 }
 
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
-  UNIMPLEMENTED();
+  daddiu(sp, sp, -size);
+  TurboAssembler::Move(addr, sp);
 }
 
-void LiftoffAssembler::DeallocateStackSlot(uint32_t size) { UNIMPLEMENTED(); }
+void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
+  daddiu(sp, sp, size);
+}
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_MIPS64_H_
+#undef BAILOUT
+
+#endif  // V8_WASM_BASELINE_MIPS64_LIFTOFF_ASSEMBLER_MIPS64_H_
diff --git a/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h b/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h
index 2d62d88decf..df54fd0e627 100644
--- a/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h
+++ b/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h
@@ -2,86 +2,130 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_PPC_H_
-#define V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_PPC_H_
+#ifndef V8_WASM_BASELINE_PPC_LIFTOFF_ASSEMBLER_PPC_H_
+#define V8_WASM_BASELINE_PPC_LIFTOFF_ASSEMBLER_PPC_H_
 
 #include "src/wasm/baseline/liftoff-assembler.h"
 
+#define BAILOUT(reason) bailout("ppc " reason)
+
 namespace v8 {
 namespace internal {
 namespace wasm {
 
-void LiftoffAssembler::ReserveStackSpace(uint32_t bytes) { UNIMPLEMENTED(); }
+uint32_t LiftoffAssembler::PrepareStackFrame() {
+  BAILOUT("PrepareStackFrame");
+  return 0;
+}
+
+void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+                                              uint32_t stack_slots) {
+  BAILOUT("PatchPrepareStackFrame");
+}
 
-void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
+                                    RelocInfo::Mode rmode) {
+  BAILOUT("LoadConstant");
 }
 
 void LiftoffAssembler::LoadFromContext(Register dst, uint32_t offset,
                                        int size) {
-  UNIMPLEMENTED();
+  BAILOUT("LoadFromContext");
 }
 
-void LiftoffAssembler::SpillContext(Register context) { UNIMPLEMENTED(); }
+void LiftoffAssembler::SpillContext(Register context) {
+  BAILOUT("SpillContext");
+}
 
-void LiftoffAssembler::FillContextInto(Register dst) { UNIMPLEMENTED(); }
+void LiftoffAssembler::FillContextInto(Register dst) {
+  BAILOUT("FillContextInto");
+}
 
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
                             uint32_t* protected_load_pc) {
-  UNIMPLEMENTED();
+  BAILOUT("Load");
 }
 
 void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
                              uint32_t* protected_store_pc) {
-  UNIMPLEMENTED();
+  BAILOUT("Store");
 }
 
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
-                                           uint32_t caller_slot_idx) {
-  UNIMPLEMENTED();
+                                           uint32_t caller_slot_idx,
+                                           ValueType type) {
+  BAILOUT("LoadCallerFrameSlot");
+}
+
+void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+                                      ValueType type) {
+  BAILOUT("MoveStackValue");
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
+                                            ValueType type) {
+  BAILOUT("MoveToReturnRegister");
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
+  BAILOUT("Move Register");
 }
 
-void LiftoffAssembler::Move(LiftoffRegister dst, LiftoffRegister src) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
+                            ValueType type) {
+  BAILOUT("Move DoubleRegister");
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
+                             ValueType type) {
+  BAILOUT("Spill register");
 }
 
 void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
-  UNIMPLEMENTED();
+  BAILOUT("Spill value");
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
+                            ValueType type) {
+  BAILOUT("Fill");
+}
+
+void LiftoffAssembler::FillI64Half(Register, uint32_t half_index) {
+  BAILOUT("FillI64Half");
 }
 
 #define UNIMPLEMENTED_GP_BINOP(name)                             \
   void LiftoffAssembler::emit_##name(Register dst, Register lhs, \
                                      Register rhs) {             \
-    UNIMPLEMENTED();                                             \
+    BAILOUT("gp binop: " #name);                                 \
   }
 #define UNIMPLEMENTED_GP_UNOP(name)                                \
   bool LiftoffAssembler::emit_##name(Register dst, Register src) { \
-    UNIMPLEMENTED();                                               \
+    BAILOUT("gp unop: " #name);                                    \
+    return true;                                                   \
   }
 #define UNIMPLEMENTED_FP_BINOP(name)                                         \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister lhs, \
                                      DoubleRegister rhs) {                   \
-    UNIMPLEMENTED();                                                         \
+    BAILOUT("fp binop: " #name);                                             \
+  }
+#define UNIMPLEMENTED_FP_UNOP(name)                                            \
+  void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
+    BAILOUT("fp unop: " #name);                                                \
+  }
+#define UNIMPLEMENTED_I32_SHIFTOP(name)                                        \
+  void LiftoffAssembler::emit_##name(Register dst, Register src,               \
+                                     Register amount, LiftoffRegList pinned) { \
+    BAILOUT("i32 shiftop: " #name);                                            \
+  }
+#define UNIMPLEMENTED_I64_SHIFTOP(name)                                        \
+  void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
+                                     Register amount, LiftoffRegList pinned) { \
+    BAILOUT("i64 shiftop: " #name);                                            \
   }
 
 UNIMPLEMENTED_GP_BINOP(i32_add)
@@ -90,10 +134,12 @@ UNIMPLEMENTED_GP_BINOP(i32_mul)
 UNIMPLEMENTED_GP_BINOP(i32_and)
 UNIMPLEMENTED_GP_BINOP(i32_or)
 UNIMPLEMENTED_GP_BINOP(i32_xor)
-UNIMPLEMENTED_GP_BINOP(i32_shl)
-UNIMPLEMENTED_GP_BINOP(i32_sar)
-UNIMPLEMENTED_GP_BINOP(i32_shr)
-UNIMPLEMENTED_GP_UNOP(i32_eqz)
+UNIMPLEMENTED_I32_SHIFTOP(i32_shl)
+UNIMPLEMENTED_I32_SHIFTOP(i32_sar)
+UNIMPLEMENTED_I32_SHIFTOP(i32_shr)
+UNIMPLEMENTED_I64_SHIFTOP(i64_shl)
+UNIMPLEMENTED_I64_SHIFTOP(i64_sar)
+UNIMPLEMENTED_I64_SHIFTOP(i64_shr)
 UNIMPLEMENTED_GP_UNOP(i32_clz)
 UNIMPLEMENTED_GP_UNOP(i32_ctz)
 UNIMPLEMENTED_GP_UNOP(i32_popcnt)
@@ -101,81 +147,152 @@ UNIMPLEMENTED_GP_BINOP(ptrsize_add)
 UNIMPLEMENTED_FP_BINOP(f32_add)
 UNIMPLEMENTED_FP_BINOP(f32_sub)
 UNIMPLEMENTED_FP_BINOP(f32_mul)
+UNIMPLEMENTED_FP_BINOP(f32_div)
+UNIMPLEMENTED_FP_UNOP(f32_abs)
+UNIMPLEMENTED_FP_UNOP(f32_neg)
+UNIMPLEMENTED_FP_UNOP(f32_sqrt)
+UNIMPLEMENTED_FP_BINOP(f64_add)
+UNIMPLEMENTED_FP_BINOP(f64_sub)
+UNIMPLEMENTED_FP_BINOP(f64_mul)
+UNIMPLEMENTED_FP_BINOP(f64_div)
+UNIMPLEMENTED_FP_UNOP(f64_abs)
+UNIMPLEMENTED_FP_UNOP(f64_neg)
+UNIMPLEMENTED_FP_UNOP(f64_sqrt)
 
 #undef UNIMPLEMENTED_GP_BINOP
 #undef UNIMPLEMENTED_GP_UNOP
 #undef UNIMPLEMENTED_FP_BINOP
+#undef UNIMPLEMENTED_FP_UNOP
+#undef UNIMPLEMENTED_I32_SHIFTOP
+#undef UNIMPLEMENTED_I64_SHIFTOP
+
+bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
+                                            LiftoffRegister dst,
+                                            LiftoffRegister src) {
+  BAILOUT("emit_type_conversion");
+  return true;
+}
+
+void LiftoffAssembler::emit_jump(Label* label) { BAILOUT("emit_jump"); }
+
+void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label,
+                                      ValueType type, Register lhs,
+                                      Register rhs) {
+  BAILOUT("emit_cond_jump");
+}
+
+void LiftoffAssembler::emit_i32_eqz(Register dst, Register src) {
+  BAILOUT("emit_i32_eqz");
+}
 
-void LiftoffAssembler::emit_i32_test(Register reg) { UNIMPLEMENTED(); }
+void LiftoffAssembler::emit_i32_set_cond(Condition cond, Register dst,
+                                         Register lhs, Register rhs) {
+  BAILOUT("emit_i32_set_cond");
+}
 
-void LiftoffAssembler::emit_i32_compare(Register lhs, Register rhs) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::emit_i64_eqz(Register dst, LiftoffRegister src) {
+  BAILOUT("emit_i64_eqz");
 }
 
-void LiftoffAssembler::emit_jump(Label* label) { UNIMPLEMENTED(); }
+void LiftoffAssembler::emit_i64_set_cond(Condition cond, Register dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  BAILOUT("emit_i64_set_cond");
+}
 
-void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::emit_f32_set_cond(Condition cond, Register dst,
+                                         DoubleRegister lhs,
+                                         DoubleRegister rhs) {
+  BAILOUT("emit_f32_set_cond");
 }
 
-void LiftoffAssembler::StackCheck(Label* ool_code) { UNIMPLEMENTED(); }
+void LiftoffAssembler::StackCheck(Label* ool_code) { BAILOUT("StackCheck"); }
 
-void LiftoffAssembler::CallTrapCallbackForTesting() { UNIMPLEMENTED(); }
+void LiftoffAssembler::CallTrapCallbackForTesting() {
+  BAILOUT("CallTrapCallbackForTesting");
+}
 
 void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
-  UNIMPLEMENTED();
+  BAILOUT("AssertUnreachable");
 }
 
 void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index) {
-  UNIMPLEMENTED();
+                                           uint32_t src_index,
+                                           RegPairHalf half) {
+  BAILOUT("PushCallerFrameSlot");
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
+                                           ValueType type) {
+  BAILOUT("PushCallerFrameSlot reg");
 }
 
-void LiftoffAssembler::PushRegisters(LiftoffRegList regs) { UNIMPLEMENTED(); }
+void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
+  BAILOUT("PushRegisters");
+}
 
-void LiftoffAssembler::PopRegisters(LiftoffRegList regs) { UNIMPLEMENTED(); }
+void LiftoffAssembler::PopRegisters(LiftoffRegList regs) {
+  BAILOUT("PopRegisters");
+}
 
 void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
-  UNIMPLEMENTED();
+  BAILOUT("DropStackSlotsAndRet");
 }
 
-void LiftoffAssembler::PrepareCCall(uint32_t num_params, const Register* args) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
+                                    const LiftoffRegister* args,
+                                    ValueType out_argument_type) {
+  BAILOUT("PrepareCCall");
 }
 
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, uint32_t param_idx,
-                                            uint32_t num_params) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
+                                            ValueType type) {
+  BAILOUT("SetCCallRegParamAddr");
 }
 
-void LiftoffAssembler::SetCCallStackParamAddr(uint32_t stack_param_idx,
-                                              uint32_t param_idx,
-                                              uint32_t num_params) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
+                                              int param_byte_offset,
+                                              ValueType type) {
+  BAILOUT("SetCCallStackParamAddr");
+}
+
+void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
+                                            int param_byte_offset) {
+  BAILOUT("LoadCCallOutArgument");
 }
 
 void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
-  UNIMPLEMENTED();
+  BAILOUT("CallC");
 }
 
-void LiftoffAssembler::CallNativeWasmCode(Address addr) { UNIMPLEMENTED(); }
+void LiftoffAssembler::FinishCCall() { BAILOUT("FinishCCall"); }
+
+void LiftoffAssembler::CallNativeWasmCode(Address addr) {
+  BAILOUT("CallNativeWasmCode");
+}
 
 void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
-  UNIMPLEMENTED();
+  BAILOUT("CallRuntime");
+}
+
+void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
+                                    compiler::CallDescriptor* call_descriptor,
+                                    Register target) {
+  BAILOUT("CallIndirect");
 }
 
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
-  UNIMPLEMENTED();
+  BAILOUT("AllocateStackSlot");
 }
 
-void LiftoffAssembler::DeallocateStackSlot(uint32_t size) { UNIMPLEMENTED(); }
+void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
+  BAILOUT("DeallocateStackSlot");
+}
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_PPC_H_
+#undef BAILOUT
+
+#endif  // V8_WASM_BASELINE_PPC_LIFTOFF_ASSEMBLER_PPC_H_
diff --git a/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h b/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h
index eebb8e4720e..53ffe128cb7 100644
--- a/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h
+++ b/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h
@@ -2,86 +2,130 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_S390_H_
-#define V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_S390_H_
+#ifndef V8_WASM_BASELINE_S390_LIFTOFF_ASSEMBLER_S390_H_
+#define V8_WASM_BASELINE_S390_LIFTOFF_ASSEMBLER_S390_H_
 
 #include "src/wasm/baseline/liftoff-assembler.h"
 
+#define BAILOUT(reason) bailout("s390 " reason)
+
 namespace v8 {
 namespace internal {
 namespace wasm {
 
-void LiftoffAssembler::ReserveStackSpace(uint32_t bytes) { UNIMPLEMENTED(); }
+uint32_t LiftoffAssembler::PrepareStackFrame() {
+  BAILOUT("PrepareStackFrame");
+  return 0;
+}
+
+void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+                                              uint32_t stack_slots) {
+  BAILOUT("PatchPrepareStackFrame");
+}
 
-void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
+                                    RelocInfo::Mode rmode) {
+  BAILOUT("LoadConstant");
 }
 
 void LiftoffAssembler::LoadFromContext(Register dst, uint32_t offset,
                                        int size) {
-  UNIMPLEMENTED();
+  BAILOUT("LoadFromContext");
 }
 
-void LiftoffAssembler::SpillContext(Register context) { UNIMPLEMENTED(); }
+void LiftoffAssembler::SpillContext(Register context) {
+  BAILOUT("SpillContext");
+}
 
-void LiftoffAssembler::FillContextInto(Register dst) { UNIMPLEMENTED(); }
+void LiftoffAssembler::FillContextInto(Register dst) {
+  BAILOUT("FillContextInto");
+}
 
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
                             uint32_t* protected_load_pc) {
-  UNIMPLEMENTED();
+  BAILOUT("Load");
 }
 
 void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
                              uint32_t* protected_store_pc) {
-  UNIMPLEMENTED();
+  BAILOUT("Store");
 }
 
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
-                                           uint32_t caller_slot_idx) {
-  UNIMPLEMENTED();
+                                           uint32_t caller_slot_idx,
+                                           ValueType type) {
+  BAILOUT("LoadCallerFrameSlot");
+}
+
+void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+                                      ValueType type) {
+  BAILOUT("MoveStackValue");
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
+                                            ValueType type) {
+  BAILOUT("MoveToReturnRegister");
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
+  BAILOUT("Move Register");
 }
 
-void LiftoffAssembler::Move(LiftoffRegister dst, LiftoffRegister src) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
+                            ValueType type) {
+  BAILOUT("Move DoubleRegister");
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
+                             ValueType type) {
+  BAILOUT("Spill register");
 }
 
 void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
-  UNIMPLEMENTED();
+  BAILOUT("Spill value");
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
+                            ValueType type) {
+  BAILOUT("Fill");
+}
+
+void LiftoffAssembler::FillI64Half(Register, uint32_t half_index) {
+  BAILOUT("FillI64Half");
 }
 
 #define UNIMPLEMENTED_GP_BINOP(name)                             \
   void LiftoffAssembler::emit_##name(Register dst, Register lhs, \
                                      Register rhs) {             \
-    UNIMPLEMENTED();                                             \
+    BAILOUT("gp binop: " #name);                                 \
   }
 #define UNIMPLEMENTED_GP_UNOP(name)                                \
   bool LiftoffAssembler::emit_##name(Register dst, Register src) { \
-    UNIMPLEMENTED();                                               \
+    BAILOUT("gp unop: " #name);                                    \
+    return true;                                                   \
   }
 #define UNIMPLEMENTED_FP_BINOP(name)                                         \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister lhs, \
                                      DoubleRegister rhs) {                   \
-    UNIMPLEMENTED();                                                         \
+    BAILOUT("fp binop: " #name);                                             \
+  }
+#define UNIMPLEMENTED_FP_UNOP(name)                                            \
+  void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
+    BAILOUT("fp unop: " #name);                                                \
+  }
+#define UNIMPLEMENTED_I32_SHIFTOP(name)                                        \
+  void LiftoffAssembler::emit_##name(Register dst, Register src,               \
+                                     Register amount, LiftoffRegList pinned) { \
+    BAILOUT("i32 shiftop: " #name);                                            \
+  }
+#define UNIMPLEMENTED_I64_SHIFTOP(name)                                        \
+  void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
+                                     Register amount, LiftoffRegList pinned) { \
+    BAILOUT("i64 shiftop: " #name);                                            \
   }
 
 UNIMPLEMENTED_GP_BINOP(i32_add)
@@ -90,10 +134,12 @@ UNIMPLEMENTED_GP_BINOP(i32_mul)
 UNIMPLEMENTED_GP_BINOP(i32_and)
 UNIMPLEMENTED_GP_BINOP(i32_or)
 UNIMPLEMENTED_GP_BINOP(i32_xor)
-UNIMPLEMENTED_GP_BINOP(i32_shl)
-UNIMPLEMENTED_GP_BINOP(i32_sar)
-UNIMPLEMENTED_GP_BINOP(i32_shr)
-UNIMPLEMENTED_GP_UNOP(i32_eqz)
+UNIMPLEMENTED_I32_SHIFTOP(i32_shl)
+UNIMPLEMENTED_I32_SHIFTOP(i32_sar)
+UNIMPLEMENTED_I32_SHIFTOP(i32_shr)
+UNIMPLEMENTED_I64_SHIFTOP(i64_shl)
+UNIMPLEMENTED_I64_SHIFTOP(i64_sar)
+UNIMPLEMENTED_I64_SHIFTOP(i64_shr)
 UNIMPLEMENTED_GP_UNOP(i32_clz)
 UNIMPLEMENTED_GP_UNOP(i32_ctz)
 UNIMPLEMENTED_GP_UNOP(i32_popcnt)
@@ -101,81 +147,152 @@ UNIMPLEMENTED_GP_BINOP(ptrsize_add)
 UNIMPLEMENTED_FP_BINOP(f32_add)
 UNIMPLEMENTED_FP_BINOP(f32_sub)
 UNIMPLEMENTED_FP_BINOP(f32_mul)
+UNIMPLEMENTED_FP_BINOP(f32_div)
+UNIMPLEMENTED_FP_UNOP(f32_abs)
+UNIMPLEMENTED_FP_UNOP(f32_neg)
+UNIMPLEMENTED_FP_UNOP(f32_sqrt)
+UNIMPLEMENTED_FP_BINOP(f64_add)
+UNIMPLEMENTED_FP_BINOP(f64_sub)
+UNIMPLEMENTED_FP_BINOP(f64_mul)
+UNIMPLEMENTED_FP_BINOP(f64_div)
+UNIMPLEMENTED_FP_UNOP(f64_abs)
+UNIMPLEMENTED_FP_UNOP(f64_neg)
+UNIMPLEMENTED_FP_UNOP(f64_sqrt)
 
 #undef UNIMPLEMENTED_GP_BINOP
 #undef UNIMPLEMENTED_GP_UNOP
 #undef UNIMPLEMENTED_FP_BINOP
+#undef UNIMPLEMENTED_FP_UNOP
+#undef UNIMPLEMENTED_I32_SHIFTOP
+#undef UNIMPLEMENTED_I64_SHIFTOP
+
+bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
+                                            LiftoffRegister dst,
+                                            LiftoffRegister src) {
+  BAILOUT("emit_type_conversion");
+  return true;
+}
+
+void LiftoffAssembler::emit_jump(Label* label) { BAILOUT("emit_jump"); }
+
+void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label,
+                                      ValueType type, Register lhs,
+                                      Register rhs) {
+  BAILOUT("emit_cond_jump");
+}
+
+void LiftoffAssembler::emit_i32_eqz(Register dst, Register src) {
+  BAILOUT("emit_i32_eqz");
+}
 
-void LiftoffAssembler::emit_i32_test(Register reg) { UNIMPLEMENTED(); }
+void LiftoffAssembler::emit_i32_set_cond(Condition cond, Register dst,
+                                         Register lhs, Register rhs) {
+  BAILOUT("emit_i32_set_cond");
+}
 
-void LiftoffAssembler::emit_i32_compare(Register lhs, Register rhs) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::emit_i64_eqz(Register dst, LiftoffRegister src) {
+  BAILOUT("emit_i64_eqz");
 }
 
-void LiftoffAssembler::emit_jump(Label* label) { UNIMPLEMENTED(); }
+void LiftoffAssembler::emit_i64_set_cond(Condition cond, Register dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  BAILOUT("emit_i64_set_cond");
+}
 
-void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::emit_f32_set_cond(Condition cond, Register dst,
+                                         DoubleRegister lhs,
+                                         DoubleRegister rhs) {
+  BAILOUT("emit_f32_set_cond");
 }
 
-void LiftoffAssembler::StackCheck(Label* ool_code) { UNIMPLEMENTED(); }
+void LiftoffAssembler::StackCheck(Label* ool_code) { BAILOUT("StackCheck"); }
 
-void LiftoffAssembler::CallTrapCallbackForTesting() { UNIMPLEMENTED(); }
+void LiftoffAssembler::CallTrapCallbackForTesting() {
+  BAILOUT("CallTrapCallbackForTesting");
+}
 
 void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
-  UNIMPLEMENTED();
+  BAILOUT("AssertUnreachable");
 }
 
 void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index) {
-  UNIMPLEMENTED();
+                                           uint32_t src_index,
+                                           RegPairHalf half) {
+  BAILOUT("PushCallerFrameSlot");
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
+                                           ValueType type) {
+  BAILOUT("PushCallerFrameSlot reg");
 }
 
-void LiftoffAssembler::PushRegisters(LiftoffRegList regs) { UNIMPLEMENTED(); }
+void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
+  BAILOUT("PushRegisters");
+}
 
-void LiftoffAssembler::PopRegisters(LiftoffRegList regs) { UNIMPLEMENTED(); }
+void LiftoffAssembler::PopRegisters(LiftoffRegList regs) {
+  BAILOUT("PopRegisters");
+}
 
 void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
-  UNIMPLEMENTED();
+  BAILOUT("DropStackSlotsAndRet");
 }
 
-void LiftoffAssembler::PrepareCCall(uint32_t num_params, const Register* args) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
+                                    const LiftoffRegister* args,
+                                    ValueType out_argument_type) {
+  BAILOUT("PrepareCCall");
 }
 
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, uint32_t param_idx,
-                                            uint32_t num_params) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
+                                            ValueType type) {
+  BAILOUT("SetCCallRegParamAddr");
 }
 
-void LiftoffAssembler::SetCCallStackParamAddr(uint32_t stack_param_idx,
-                                              uint32_t param_idx,
-                                              uint32_t num_params) {
-  UNIMPLEMENTED();
+void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
+                                              int param_byte_offset,
+                                              ValueType type) {
+  BAILOUT("SetCCallStackParamAddr");
+}
+
+void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
+                                            int param_byte_offset) {
+  BAILOUT("LoadCCallOutArgument");
 }
 
 void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
-  UNIMPLEMENTED();
+  BAILOUT("CallC");
 }
 
-void LiftoffAssembler::CallNativeWasmCode(Address addr) { UNIMPLEMENTED(); }
+void LiftoffAssembler::FinishCCall() { BAILOUT("FinishCCall"); }
+
+void LiftoffAssembler::CallNativeWasmCode(Address addr) {
+  BAILOUT("CallNativeWasmCode");
+}
 
 void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
-  UNIMPLEMENTED();
+  BAILOUT("CallRuntime");
+}
+
+void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
+                                    compiler::CallDescriptor* call_descriptor,
+                                    Register target) {
+  BAILOUT("CallIndirect");
 }
 
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
-  UNIMPLEMENTED();
+  BAILOUT("AllocateStackSlot");
 }
 
-void LiftoffAssembler::DeallocateStackSlot(uint32_t size) { UNIMPLEMENTED(); }
+void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
+  BAILOUT("DeallocateStackSlot");
+}
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_S390_H_
+#undef BAILOUT
+
+#endif  // V8_WASM_BASELINE_S390_LIFTOFF_ASSEMBLER_S390_H_
diff --git a/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h b/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
index 2b3b750fc47..0ba0ba5f865 100644
--- a/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
+++ b/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_X64_H_
-#define V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_X64_H_
+#ifndef V8_WASM_BASELINE_X64_LIFTOFF_ASSEMBLER_X64_H_
+#define V8_WASM_BASELINE_X64_LIFTOFF_ASSEMBLER_X64_H_
 
 #include "src/wasm/baseline/liftoff-assembler.h"
 
@@ -16,40 +16,116 @@ namespace wasm {
 
 namespace liftoff {
 
+// rbp-8 holds the stack marker, rbp-16 is the wasm context, first stack slot
+// is located at rbp-24.
+constexpr int32_t kConstantStackSpace = 16;
+constexpr int32_t kFirstStackSlotOffset =
+    kConstantStackSpace + LiftoffAssembler::kStackSlotSize;
+
 inline Operand GetStackSlot(uint32_t index) {
-  // rbp-8 holds the stack marker, rbp-16 is the wasm context, first stack slot
-  // is located at rbp-24.
-  constexpr int32_t kFirstStackSlotOffset = -24;
-  return Operand(
-      rbp, kFirstStackSlotOffset - index * LiftoffAssembler::kStackSlotSize);
+  int32_t offset = index * LiftoffAssembler::kStackSlotSize;
+  return Operand(rbp, -kFirstStackSlotOffset - offset);
 }
 
 // TODO(clemensh): Make this a constexpr variable once Operand is constexpr.
 inline Operand GetContextOperand() { return Operand(rbp, -16); }
 
 // Use this register to store the address of the last argument pushed on the
-// stack for a call to C.
-static constexpr Register kCCallLastArgAddrReg = rax;
+// stack for a call to C. This register must be callee saved according to the c
+// calling convention.
+static constexpr Register kCCallLastArgAddrReg = rbx;
+
+inline Operand GetMemOp(LiftoffAssembler* assm, Register addr, Register offset,
+                        uint32_t offset_imm, LiftoffRegList pinned) {
+  // Wasm memory is limited to a size <2GB, so all offsets can be encoded as
+  // immediate value (in 31 bits, interpreted as signed value).
+  // If the offset is bigger, we always trap and this code is not reached.
+  DCHECK(is_uint31(offset_imm));
+  if (offset == no_reg) return Operand(addr, offset_imm);
+  return Operand(addr, offset, times_1, offset_imm);
+}
+
+inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, Operand src,
+                 ValueType type) {
+  switch (type) {
+    case kWasmI32:
+      assm->movl(dst.gp(), src);
+      break;
+    case kWasmI64:
+      assm->movq(dst.gp(), src);
+      break;
+    case kWasmF32:
+      assm->Movss(dst.fp(), src);
+      break;
+    case kWasmF64:
+      assm->Movsd(dst.fp(), src);
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
+  switch (type) {
+    case kWasmI32:
+    case kWasmI64:
+      assm->pushq(reg.gp());
+      break;
+    case kWasmF32:
+      assm->subp(rsp, Immediate(kPointerSize));
+      assm->Movss(Operand(rsp, 0), reg.fp());
+      break;
+    case kWasmF64:
+      assm->subp(rsp, Immediate(kPointerSize));
+      assm->Movsd(Operand(rsp, 0), reg.fp());
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
 
 }  // namespace liftoff
 
-void LiftoffAssembler::ReserveStackSpace(uint32_t bytes) {
+uint32_t LiftoffAssembler::PrepareStackFrame() {
+  uint32_t offset = static_cast<uint32_t>(pc_offset());
+  sub_sp_32(0);
+  return offset;
+}
+
+void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+                                              uint32_t stack_slots) {
+  uint32_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
   DCHECK_LE(bytes, kMaxInt);
-  subp(rsp, Immediate(bytes));
+  // We can't run out of space, just pass anything big enough to not cause the
+  // assembler to try to grow the buffer.
+  constexpr int kAvailableSpace = 64;
+  Assembler patching_assembler(isolate(), buffer_ + offset, kAvailableSpace);
+  patching_assembler.sub_sp_32(bytes);
 }
 
-void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value) {
+void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
+                                    RelocInfo::Mode rmode) {
   switch (value.type()) {
     case kWasmI32:
-      if (value.to_i32() == 0) {
+      if (value.to_i32() == 0 && RelocInfo::IsNone(rmode)) {
         xorl(reg.gp(), reg.gp());
       } else {
-        movl(reg.gp(), Immediate(value.to_i32()));
+        movl(reg.gp(), Immediate(value.to_i32(), rmode));
+      }
+      break;
+    case kWasmI64:
+      if (RelocInfo::IsNone(rmode)) {
+        TurboAssembler::Set(reg.gp(), value.to_i64());
+      } else {
+        movq(reg.gp(), value.to_i64(), rmode);
       }
       break;
     case kWasmF32:
       TurboAssembler::Move(reg.fp(), value.to_f32_boxed().get_bits());
       break;
+    case kWasmF64:
+      TurboAssembler::Move(reg.fp(), value.to_f64_boxed().get_bits());
+      break;
     default:
       UNREACHABLE();
   }
@@ -79,42 +155,49 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
                             uint32_t* protected_load_pc) {
-  Operand src_op = offset_reg == no_reg
-                       ? Operand(src_addr, offset_imm)
-                       : Operand(src_addr, offset_reg, times_1, offset_imm);
-  if (offset_imm > kMaxInt) {
-    // The immediate can not be encoded in the operand. Load it to a register
-    // first.
-    Register src = GetUnusedRegister(kGpReg, pinned).gp();
-    movl(src, Immediate(offset_imm));
-    if (offset_reg != no_reg) {
-      emit_ptrsize_add(src, src, offset_reg);
-    }
-    src_op = Operand(src_addr, src, times_1, 0);
+  if (emit_debug_code() && offset_reg != no_reg) {
+    AssertZeroExtended(offset_reg);
   }
+  Operand src_op =
+      liftoff::GetMemOp(this, src_addr, offset_reg, offset_imm, pinned);
   if (protected_load_pc) *protected_load_pc = pc_offset();
   switch (type.value()) {
     case LoadType::kI32Load8U:
+    case LoadType::kI64Load8U:
       movzxbl(dst.gp(), src_op);
       break;
     case LoadType::kI32Load8S:
       movsxbl(dst.gp(), src_op);
       break;
+    case LoadType::kI64Load8S:
+      movsxbq(dst.gp(), src_op);
+      break;
     case LoadType::kI32Load16U:
+    case LoadType::kI64Load16U:
       movzxwl(dst.gp(), src_op);
       break;
     case LoadType::kI32Load16S:
       movsxwl(dst.gp(), src_op);
       break;
+    case LoadType::kI64Load16S:
+      movsxwq(dst.gp(), src_op);
+      break;
     case LoadType::kI32Load:
+    case LoadType::kI64Load32U:
       movl(dst.gp(), src_op);
       break;
+    case LoadType::kI64Load32S:
+      movsxlq(dst.gp(), src_op);
+      break;
     case LoadType::kI64Load:
       movq(dst.gp(), src_op);
       break;
     case LoadType::kF32Load:
       Movss(dst.fp(), src_op);
       break;
+    case LoadType::kF64Load:
+      Movsd(dst.fp(), src_op);
+      break;
     default:
       UNREACHABLE();
   }
@@ -124,28 +207,23 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
                              uint32_t* protected_store_pc) {
-  Operand dst_op = offset_reg == no_reg
-                       ? Operand(dst_addr, offset_imm)
-                       : Operand(dst_addr, offset_reg, times_1, offset_imm);
-  if (offset_imm > kMaxInt) {
-    // The immediate can not be encoded in the operand. Load it to a register
-    // first.
-    Register dst = GetUnusedRegister(kGpReg, pinned).gp();
-    movl(dst, Immediate(offset_imm));
-    if (offset_reg != no_reg) {
-      emit_ptrsize_add(dst, dst, offset_reg);
-    }
-    dst_op = Operand(dst_addr, dst, times_1, 0);
+  if (emit_debug_code() && offset_reg != no_reg) {
+    AssertZeroExtended(offset_reg);
   }
+  Operand dst_op =
+      liftoff::GetMemOp(this, dst_addr, offset_reg, offset_imm, pinned);
   if (protected_store_pc) *protected_store_pc = pc_offset();
   switch (type.value()) {
     case StoreType::kI32Store8:
+    case StoreType::kI64Store8:
       movb(dst_op, src.gp());
       break;
     case StoreType::kI32Store16:
+    case StoreType::kI64Store16:
       movw(dst_op, src.gp());
       break;
     case StoreType::kI32Store:
+    case StoreType::kI64Store32:
       movl(dst_op, src.gp());
       break;
     case StoreType::kI64Store:
@@ -154,90 +232,138 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
     case StoreType::kF32Store:
       Movss(dst_op, src.fp());
       break;
+    case StoreType::kF64Store:
+      Movsd(dst_op, src.fp());
+      break;
     default:
       UNREACHABLE();
   }
 }
 
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
-                                           uint32_t caller_slot_idx) {
+                                           uint32_t caller_slot_idx,
+                                           ValueType type) {
   Operand src(rbp, kPointerSize * (caller_slot_idx + 1));
-  // TODO(clemensh): Handle different sizes here.
-  if (dst.is_gp()) {
-    movq(dst.gp(), src);
-  } else {
-    Movsd(dst.fp(), src);
-  }
+  liftoff::Load(this, dst, src, type);
 }
 
-void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index) {
+void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
+                                      ValueType type) {
   DCHECK_NE(dst_index, src_index);
   if (cache_state_.has_unused_register(kGpReg)) {
     LiftoffRegister reg = GetUnusedRegister(kGpReg);
-    Fill(reg, src_index);
-    Spill(dst_index, reg);
+    Fill(reg, src_index, type);
+    Spill(dst_index, reg, type);
   } else {
     pushq(liftoff::GetStackSlot(src_index));
     popq(liftoff::GetStackSlot(dst_index));
   }
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg) {
+void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
+                                            ValueType type) {
   // TODO(wasm): Extract the destination register from the CallDescriptor.
   // TODO(wasm): Add multi-return support.
   LiftoffRegister dst =
       reg.is_gp() ? LiftoffRegister(rax) : LiftoffRegister(xmm1);
-  if (reg != dst) Move(dst, reg);
+  if (reg != dst) Move(dst, reg, type);
 }
 
-void LiftoffAssembler::Move(LiftoffRegister dst, LiftoffRegister src) {
-  // The caller should check that the registers are not equal. For most
-  // occurences, this is already guaranteed, so no need to check within this
-  // method.
+void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
   DCHECK_NE(dst, src);
-  DCHECK_EQ(dst.reg_class(), src.reg_class());
-  // TODO(clemensh): Handle different sizes here.
-  if (dst.is_gp()) {
-    movq(dst.gp(), src.gp());
+  if (type == kWasmI32) {
+    movl(dst, src);
   } else {
-    Movsd(dst.fp(), src.fp());
+    DCHECK_EQ(kWasmI64, type);
+    movq(dst, src);
   }
 }
 
-void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg) {
-  Operand dst = liftoff::GetStackSlot(index);
-  // TODO(clemensh): Handle different sizes here.
-  if (reg.is_gp()) {
-    movq(dst, reg.gp());
+void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
+                            ValueType type) {
+  DCHECK_NE(dst, src);
+  if (type == kWasmF32) {
+    Movss(dst, src);
   } else {
-    Movsd(dst, reg.fp());
+    DCHECK_EQ(kWasmF64, type);
+    Movsd(dst, src);
+  }
+}
+
+void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
+                             ValueType type) {
+  RecordUsedSpillSlot(index);
+  Operand dst = liftoff::GetStackSlot(index);
+  switch (type) {
+    case kWasmI32:
+      movl(dst, reg.gp());
+      break;
+    case kWasmI64:
+      movq(dst, reg.gp());
+      break;
+    case kWasmF32:
+      Movss(dst, reg.fp());
+      break;
+    case kWasmF64:
+      Movsd(dst, reg.fp());
+      break;
+    default:
+      UNREACHABLE();
   }
 }
 
 void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
+  RecordUsedSpillSlot(index);
   Operand dst = liftoff::GetStackSlot(index);
   switch (value.type()) {
     case kWasmI32:
       movl(dst, Immediate(value.to_i32()));
       break;
-    case kWasmF32:
-      movl(dst, Immediate(value.to_f32_boxed().get_bits()));
+    case kWasmI64: {
+      if (is_int32(value.to_i64())) {
+        // Sign extend low word.
+        movq(dst, Immediate(static_cast<int32_t>(value.to_i64())));
+      } else if (is_uint32(value.to_i64())) {
+        // Zero extend low word.
+        movl(kScratchRegister, Immediate(static_cast<int32_t>(value.to_i64())));
+        movq(dst, kScratchRegister);
+      } else {
+        movq(kScratchRegister, value.to_i64());
+        movq(dst, kScratchRegister);
+      }
       break;
+    }
     default:
+      // We do not track f32 and f64 constants, hence they are unreachable.
       UNREACHABLE();
   }
 }
 
-void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index) {
+void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
+                            ValueType type) {
   Operand src = liftoff::GetStackSlot(index);
-  // TODO(clemensh): Handle different sizes here.
-  if (reg.is_gp()) {
-    movq(reg.gp(), src);
-  } else {
-    Movsd(reg.fp(), src);
+  switch (type) {
+    case kWasmI32:
+      movl(reg.gp(), src);
+      break;
+    case kWasmI64:
+      movq(reg.gp(), src);
+      break;
+    case kWasmF32:
+      Movss(reg.fp(), src);
+      break;
+    case kWasmF64:
+      Movsd(reg.fp(), src);
+      break;
+    default:
+      UNREACHABLE();
   }
 }
 
+void LiftoffAssembler::FillI64Half(Register, uint32_t half_index) {
+  UNREACHABLE();
+}
+
 void LiftoffAssembler::emit_i32_add(Register dst, Register lhs, Register rhs) {
   if (lhs != dst) {
     leal(dst, Operand(lhs, rhs, times_1, 0));
@@ -277,55 +403,57 @@ COMMUTATIVE_I32_BINOP(xor, xor)
 #undef COMMUTATIVE_I32_BINOP
 
 namespace liftoff {
+template <ValueType type>
 inline void EmitShiftOperation(LiftoffAssembler* assm, Register dst,
-                               Register lhs, Register rhs,
-                               void (Assembler::*emit_shift)(Register)) {
+                               Register src, Register amount,
+                               void (Assembler::*emit_shift)(Register),
+                               LiftoffRegList pinned) {
   // If dst is rcx, compute into the scratch register first, then move to rcx.
   if (dst == rcx) {
-    assm->movl(kScratchRegister, lhs);
-    if (rhs != rcx) assm->movl(rcx, rhs);
+    assm->Move(kScratchRegister, src, type);
+    if (amount != rcx) assm->Move(rcx, amount, type);
     (assm->*emit_shift)(kScratchRegister);
-    assm->movl(rcx, kScratchRegister);
+    assm->Move(rcx, kScratchRegister, type);
     return;
   }
 
-  // Move rhs into rcx. If rcx is in use, move its content into the scratch
-  // register. If lhs is rcx, lhs is now the scratch register.
+  // Move amount into rcx. If rcx is in use, move its content into the scratch
+  // register. If src is rcx, src is now the scratch register.
   bool use_scratch = false;
-  if (rhs != rcx) {
-    use_scratch =
-        lhs == rcx || assm->cache_state()->is_used(LiftoffRegister(rcx));
-    if (use_scratch) assm->movl(kScratchRegister, rcx);
-    if (lhs == rcx) lhs = kScratchRegister;
-    assm->movl(rcx, rhs);
+  if (amount != rcx) {
+    use_scratch = src == rcx ||
+                  assm->cache_state()->is_used(LiftoffRegister(rcx)) ||
+                  pinned.has(LiftoffRegister(rcx));
+    if (use_scratch) assm->movq(kScratchRegister, rcx);
+    if (src == rcx) src = kScratchRegister;
+    assm->Move(rcx, amount, type);
   }
 
   // Do the actual shift.
-  if (dst != lhs) assm->movl(dst, lhs);
+  if (dst != src) assm->Move(dst, src, type);
   (assm->*emit_shift)(dst);
 
   // Restore rcx if needed.
-  if (use_scratch) assm->movl(rcx, kScratchRegister);
+  if (use_scratch) assm->movq(rcx, kScratchRegister);
 }
 }  // namespace liftoff
 
-void LiftoffAssembler::emit_i32_shl(Register dst, Register lhs, Register rhs) {
-  liftoff::EmitShiftOperation(this, dst, lhs, rhs, &Assembler::shll_cl);
+void LiftoffAssembler::emit_i32_shl(Register dst, Register src, Register amount,
+                                    LiftoffRegList pinned) {
+  liftoff::EmitShiftOperation<kWasmI32>(this, dst, src, amount,
+                                        &Assembler::shll_cl, pinned);
 }
 
-void LiftoffAssembler::emit_i32_sar(Register dst, Register lhs, Register rhs) {
-  liftoff::EmitShiftOperation(this, dst, lhs, rhs, &Assembler::sarl_cl);
+void LiftoffAssembler::emit_i32_sar(Register dst, Register src, Register amount,
+                                    LiftoffRegList pinned) {
+  liftoff::EmitShiftOperation<kWasmI32>(this, dst, src, amount,
+                                        &Assembler::sarl_cl, pinned);
 }
 
-void LiftoffAssembler::emit_i32_shr(Register dst, Register lhs, Register rhs) {
-  liftoff::EmitShiftOperation(this, dst, lhs, rhs, &Assembler::shrl_cl);
-}
-
-bool LiftoffAssembler::emit_i32_eqz(Register dst, Register src) {
-  testl(src, src);
-  setcc(zero, dst);
-  movzxbl(dst, dst);
-  return true;
+void LiftoffAssembler::emit_i32_shr(Register dst, Register src, Register amount,
+                                    LiftoffRegList pinned) {
+  liftoff::EmitShiftOperation<kWasmI32>(this, dst, src, amount,
+                                        &Assembler::shrl_cl, pinned);
 }
 
 bool LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
@@ -369,6 +497,24 @@ bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
   return true;
 }
 
+void LiftoffAssembler::emit_i64_shl(LiftoffRegister dst, LiftoffRegister src,
+                                    Register amount, LiftoffRegList pinned) {
+  liftoff::EmitShiftOperation<kWasmI64>(this, dst.gp(), src.gp(), amount,
+                                        &Assembler::shlq_cl, pinned);
+}
+
+void LiftoffAssembler::emit_i64_sar(LiftoffRegister dst, LiftoffRegister src,
+                                    Register amount, LiftoffRegList pinned) {
+  liftoff::EmitShiftOperation<kWasmI64>(this, dst.gp(), src.gp(), amount,
+                                        &Assembler::sarq_cl, pinned);
+}
+
+void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
+                                    Register amount, LiftoffRegList pinned) {
+  liftoff::EmitShiftOperation<kWasmI64>(this, dst.gp(), src.gp(), amount,
+                                        &Assembler::shrq_cl, pinned);
+}
+
 void LiftoffAssembler::emit_ptrsize_add(Register dst, Register lhs,
                                         Register rhs) {
   if (lhs != dst) {
@@ -419,22 +565,270 @@ void LiftoffAssembler::emit_f32_mul(DoubleRegister dst, DoubleRegister lhs,
   }
 }
 
-void LiftoffAssembler::emit_i32_test(Register reg) { testl(reg, reg); }
+void LiftoffAssembler::emit_f32_div(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vdivss(dst, lhs, rhs);
+  } else if (dst == rhs) {
+    movss(kScratchDoubleReg, rhs);
+    movss(dst, lhs);
+    divss(dst, kScratchDoubleReg);
+  } else {
+    if (dst != lhs) movss(dst, lhs);
+    divss(dst, rhs);
+  }
+}
 
-void LiftoffAssembler::emit_i32_compare(Register lhs, Register rhs) {
-  cmpl(lhs, rhs);
+void LiftoffAssembler::emit_f32_abs(DoubleRegister dst, DoubleRegister src) {
+  static constexpr uint32_t kSignBit = uint32_t{1} << 31;
+  if (dst == src) {
+    TurboAssembler::Move(kScratchDoubleReg, kSignBit - 1);
+    Andps(dst, kScratchDoubleReg);
+  } else {
+    TurboAssembler::Move(dst, kSignBit - 1);
+    Andps(dst, src);
+  }
+}
+
+void LiftoffAssembler::emit_f32_neg(DoubleRegister dst, DoubleRegister src) {
+  static constexpr uint32_t kSignBit = uint32_t{1} << 31;
+  if (dst == src) {
+    TurboAssembler::Move(kScratchDoubleReg, kSignBit);
+    Xorps(dst, kScratchDoubleReg);
+  } else {
+    TurboAssembler::Move(dst, kSignBit);
+    Xorps(dst, src);
+  }
+}
+
+void LiftoffAssembler::emit_f32_sqrt(DoubleRegister dst, DoubleRegister src) {
+  Sqrtss(dst, src);
+}
+
+void LiftoffAssembler::emit_f64_add(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vaddsd(dst, lhs, rhs);
+  } else if (dst == rhs) {
+    addsd(dst, lhs);
+  } else {
+    if (dst != lhs) movsd(dst, lhs);
+    addsd(dst, rhs);
+  }
+}
+
+void LiftoffAssembler::emit_f64_sub(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vsubsd(dst, lhs, rhs);
+  } else if (dst == rhs) {
+    movsd(kScratchDoubleReg, rhs);
+    movsd(dst, lhs);
+    subsd(dst, kScratchDoubleReg);
+  } else {
+    if (dst != lhs) movsd(dst, lhs);
+    subsd(dst, rhs);
+  }
+}
+
+void LiftoffAssembler::emit_f64_mul(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vmulsd(dst, lhs, rhs);
+  } else if (dst == rhs) {
+    mulsd(dst, lhs);
+  } else {
+    if (dst != lhs) movsd(dst, lhs);
+    mulsd(dst, rhs);
+  }
+}
+
+void LiftoffAssembler::emit_f64_div(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vdivsd(dst, lhs, rhs);
+  } else if (dst == rhs) {
+    movsd(kScratchDoubleReg, rhs);
+    movsd(dst, lhs);
+    divsd(dst, kScratchDoubleReg);
+  } else {
+    if (dst != lhs) movsd(dst, lhs);
+    divsd(dst, rhs);
+  }
+}
+
+void LiftoffAssembler::emit_f64_abs(DoubleRegister dst, DoubleRegister src) {
+  static constexpr uint64_t kSignBit = uint64_t{1} << 63;
+  if (dst == src) {
+    TurboAssembler::Move(kScratchDoubleReg, kSignBit - 1);
+    Andpd(dst, kScratchDoubleReg);
+  } else {
+    TurboAssembler::Move(dst, kSignBit - 1);
+    Andpd(dst, src);
+  }
+}
+
+void LiftoffAssembler::emit_f64_neg(DoubleRegister dst, DoubleRegister src) {
+  static constexpr uint64_t kSignBit = uint64_t{1} << 63;
+  if (dst == src) {
+    TurboAssembler::Move(kScratchDoubleReg, kSignBit);
+    Xorpd(dst, kScratchDoubleReg);
+  } else {
+    TurboAssembler::Move(dst, kSignBit);
+    Xorpd(dst, src);
+  }
+}
+
+void LiftoffAssembler::emit_f64_sqrt(DoubleRegister dst, DoubleRegister src) {
+  Sqrtsd(dst, src);
+}
+
+bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
+                                            LiftoffRegister dst,
+                                            LiftoffRegister src) {
+  switch (opcode) {
+    case kExprI32ConvertI64:
+      movl(dst.gp(), src.gp());
+      return true;
+    case kExprI32ReinterpretF32:
+      Movd(dst.gp(), src.fp());
+      return true;
+    case kExprI64SConvertI32:
+      movsxlq(dst.gp(), src.gp());
+      return true;
+    case kExprI64UConvertI32:
+      AssertZeroExtended(src.gp());
+      if (dst.gp() != src.gp()) movl(dst.gp(), src.gp());
+      return true;
+    case kExprI64ReinterpretF64:
+      Movq(dst.gp(), src.fp());
+      return true;
+    case kExprF32SConvertI32:
+      Cvtlsi2ss(dst.fp(), src.gp());
+      return true;
+    case kExprF32UConvertI32:
+      movl(kScratchRegister, src.gp());
+      Cvtqsi2ss(dst.fp(), kScratchRegister);
+      return true;
+    case kExprF32SConvertI64:
+      Cvtqsi2ss(dst.fp(), src.gp());
+      return true;
+    case kExprF32UConvertI64:
+      Cvtqui2ss(dst.fp(), src.gp(), kScratchRegister);
+      return true;
+    case kExprF32ConvertF64:
+      Cvtsd2ss(dst.fp(), src.fp());
+      return true;
+    case kExprF32ReinterpretI32:
+      Movd(dst.fp(), src.gp());
+      return true;
+    case kExprF64SConvertI32:
+      Cvtlsi2sd(dst.fp(), src.gp());
+      return true;
+    case kExprF64UConvertI32:
+      movl(kScratchRegister, src.gp());
+      Cvtqsi2sd(dst.fp(), kScratchRegister);
+      return true;
+    case kExprF64SConvertI64:
+      Cvtqsi2sd(dst.fp(), src.gp());
+      return true;
+    case kExprF64UConvertI64:
+      Cvtqui2sd(dst.fp(), src.gp(), kScratchRegister);
+      return true;
+    case kExprF64ConvertF32:
+      Cvtss2sd(dst.fp(), src.fp());
+      return true;
+    case kExprF64ReinterpretI64:
+      Movq(dst.fp(), src.gp());
+      return true;
+    default:
+      UNREACHABLE();
+  }
 }
 
 void LiftoffAssembler::emit_jump(Label* label) { jmp(label); }
 
-void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label) {
+void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label,
+                                      ValueType type, Register lhs,
+                                      Register rhs) {
+  if (rhs != no_reg) {
+    switch (type) {
+      case kWasmI32:
+        cmpl(lhs, rhs);
+        break;
+      case kWasmI64:
+        cmpq(lhs, rhs);
+        break;
+      default:
+        UNREACHABLE();
+    }
+  } else {
+    DCHECK_EQ(type, kWasmI32);
+    testl(lhs, lhs);
+  }
+
   j(cond, label);
 }
 
+void LiftoffAssembler::emit_i32_eqz(Register dst, Register src) {
+  testl(src, src);
+  setcc(equal, dst);
+  movzxbl(dst, dst);
+}
+
+void LiftoffAssembler::emit_i32_set_cond(Condition cond, Register dst,
+                                         Register lhs, Register rhs) {
+  cmpl(lhs, rhs);
+  setcc(cond, dst);
+  movzxbl(dst, dst);
+}
+
+void LiftoffAssembler::emit_i64_eqz(Register dst, LiftoffRegister src) {
+  testq(src.gp(), src.gp());
+  setcc(equal, dst);
+  movzxbl(dst, dst);
+}
+
+void LiftoffAssembler::emit_i64_set_cond(Condition cond, Register dst,
+                                         LiftoffRegister lhs,
+                                         LiftoffRegister rhs) {
+  cmpq(lhs.gp(), rhs.gp());
+  setcc(cond, dst);
+  movzxbl(dst, dst);
+}
+
+void LiftoffAssembler::emit_f32_set_cond(Condition cond, Register dst,
+                                         DoubleRegister lhs,
+                                         DoubleRegister rhs) {
+  Label cont;
+  Label not_nan;
+
+  Ucomiss(lhs, rhs);
+  // IF PF is one, one of the operands was Nan. This needs special handling.
+  j(parity_odd, &not_nan, Label::kNear);
+  // Return 1 for f32.ne, 0 for all other cases.
+  if (cond == not_equal) {
+    movl(dst, Immediate(1));
+  } else {
+    xorl(dst, dst);
+  }
+  jmp(&cont, Label::kNear);
+  bind(&not_nan);
+
+  setcc(cond, dst);
+  movzxbl(dst, dst);
+  bind(&cont);
+}
+
 void LiftoffAssembler::StackCheck(Label* ool_code) {
-  Register limit = GetUnusedRegister(kGpReg).gp();
-  LoadAddress(limit, ExternalReference::address_of_stack_limit(isolate()));
-  cmpp(rsp, Operand(limit, 0));
+  Operand stack_limit = ExternalOperand(
+      ExternalReference::address_of_stack_limit(isolate()), kScratchRegister);
+  cmpp(rsp, stack_limit);
   j(below_equal, ool_code);
 }
 
@@ -449,27 +843,23 @@ void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
 }
 
 void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index) {
+                                           uint32_t src_index, RegPairHalf) {
   switch (src.loc()) {
     case VarState::kStack:
       pushq(liftoff::GetStackSlot(src_index));
       break;
     case VarState::kRegister:
-      PushCallerFrameSlot(src.reg());
+      PushCallerFrameSlot(src.reg(), src.type());
       break;
-    case VarState::kI32Const:
+    case VarState::KIntConst:
       pushq(Immediate(src.i32_const()));
       break;
   }
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg) {
-  if (reg.is_gp()) {
-    pushq(reg.gp());
-  } else {
-    subp(rsp, Immediate(kPointerSize));
-    Movsd(Operand(rsp, 0), reg.fp());
-  }
+void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
+                                           ValueType type) {
+  liftoff::push(this, reg, type);
 }
 
 void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
@@ -517,31 +907,55 @@ void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
   ret(static_cast<int>(num_stack_slots * kPointerSize));
 }
 
-void LiftoffAssembler::PrepareCCall(uint32_t num_params, const Register* args) {
-  for (size_t param = 0; param < num_params; ++param) {
-    pushq(args[param]);
+void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
+                                    const LiftoffRegister* args,
+                                    ValueType out_argument_type) {
+  for (ValueType param_type : sig->parameters()) {
+    liftoff::push(this, *args++, param_type);
   }
-  movq(liftoff::kCCallLastArgAddrReg, rsp);
-  PrepareCallCFunction(num_params);
-}
-
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, uint32_t param_idx,
-                                            uint32_t num_params) {
-  int offset = kPointerSize * static_cast<int>(num_params - 1 - param_idx);
-  leaq(dst, Operand(liftoff::kCCallLastArgAddrReg, offset));
-}
-
-void LiftoffAssembler::SetCCallStackParamAddr(uint32_t stack_param_idx,
-                                              uint32_t param_idx,
-                                              uint32_t num_params) {
+  if (out_argument_type != kWasmStmt) {
+    subq(rsp, Immediate(kPointerSize));
+  }
+  // Save the original sp (before the first push), such that we can later
+  // compute pointers to the pushed values. Do this only *after* pushing the
+  // values, because {kCCallLastArgAddrReg} might collide with an arg register.
+  int num_c_call_arguments = static_cast<int>(sig->parameter_count()) +
+                             (out_argument_type != kWasmStmt);
+  int pushed_bytes = kPointerSize * num_c_call_arguments;
+  leaq(liftoff::kCCallLastArgAddrReg, Operand(rsp, pushed_bytes));
+  PrepareCallCFunction(num_c_call_arguments);
+}
+
+void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
+                                            ValueType type) {
+  // Check that we don't accidentally override kCCallLastArgAddrReg.
+  DCHECK_NE(liftoff::kCCallLastArgAddrReg, dst);
+  leaq(dst, Operand(liftoff::kCCallLastArgAddrReg, -param_byte_offset));
+}
+
+void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
+                                              int param_byte_offset,
+                                              ValueType type) {
   // On x64, all C call arguments fit in registers.
   UNREACHABLE();
 }
 
+void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
+                                            int param_byte_offset) {
+  // Check that we don't accidentally override kCCallLastArgAddrReg.
+  DCHECK_NE(LiftoffRegister(liftoff::kCCallLastArgAddrReg), dst);
+  Operand src(liftoff::kCCallLastArgAddrReg, -param_byte_offset);
+  liftoff::Load(this, dst, src, type);
+}
+
 void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
   CallCFunction(ext_ref, static_cast<int>(num_params));
 }
 
+void LiftoffAssembler::FinishCCall() {
+  movp(rsp, liftoff::kCCallLastArgAddrReg);
+}
+
 void LiftoffAssembler::CallNativeWasmCode(Address addr) {
   near_call(addr, RelocInfo::WASM_CALL);
 }
@@ -552,6 +966,16 @@ void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
   CallRuntimeDelayed(zone, fid);
 }
 
+void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
+                                    compiler::CallDescriptor* call_descriptor,
+                                    Register target) {
+  if (target == no_reg) {
+    popq(kScratchRegister);
+    target = kScratchRegister;
+  }
+  call(target);
+}
+
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
   subp(rsp, Immediate(size));
   movp(addr, rsp);
@@ -565,4 +989,4 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_BASELINE_LIFTOFF_ASSEMBLER_X64_H_
+#endif  // V8_WASM_BASELINE_X64_LIFTOFF_ASSEMBLER_X64_H_
diff --git a/deps/v8/src/wasm/compilation-manager.cc b/deps/v8/src/wasm/compilation-manager.cc
index a19a228f1fe..b94e88feeea 100644
--- a/deps/v8/src/wasm/compilation-manager.cc
+++ b/deps/v8/src/wasm/compilation-manager.cc
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 #include "src/wasm/compilation-manager.h"
-#include "src/base/template-utils.h"
+#include "src/wasm/module-compiler.h"
 
 #include "src/objects-inl.h"
 
@@ -14,10 +14,11 @@ namespace wasm {
 AsyncCompileJob* CompilationManager::CreateAsyncCompileJob(
     Isolate* isolate, std::unique_ptr<byte[]> bytes_copy, size_t length,
     Handle<Context> context, Handle<JSPromise> promise) {
-  std::shared_ptr<AsyncCompileJob> job(new AsyncCompileJob(
-      isolate, std::move(bytes_copy), length, context, promise));
-  jobs_.insert({job.get(), job});
-  return job.get();
+  AsyncCompileJob* job = new AsyncCompileJob(isolate, std::move(bytes_copy),
+                                             length, context, promise);
+  // Pass ownership to the unique_ptr in {jobs_}.
+  jobs_[job] = std::unique_ptr<AsyncCompileJob>(job);
+  return job;
 }
 
 void CompilationManager::StartAsyncCompileJob(
@@ -35,17 +36,27 @@ std::shared_ptr<StreamingDecoder> CompilationManager::StartStreamingCompilation(
   return job->CreateStreamingDecoder();
 }
 
-std::shared_ptr<AsyncCompileJob> CompilationManager::RemoveJob(
+std::unique_ptr<AsyncCompileJob> CompilationManager::RemoveJob(
     AsyncCompileJob* job) {
   auto item = jobs_.find(job);
   DCHECK(item != jobs_.end());
-  std::shared_ptr<AsyncCompileJob> result = std::move(item->second);
+  std::unique_ptr<AsyncCompileJob> result = std::move(item->second);
   jobs_.erase(item);
   return result;
 }
 
 void CompilationManager::TearDown() { jobs_.clear(); }
 
+void CompilationManager::AbortAllJobs() {
+  // Iterate over a copy of {jobs_}, because {job->Abort} modifies {jobs_}.
+  std::vector<AsyncCompileJob*> copy;
+  copy.reserve(jobs_.size());
+
+  for (auto& entry : jobs_) copy.push_back(entry.first);
+
+  for (auto* job : copy) job->Abort();
+}
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/compilation-manager.h b/deps/v8/src/wasm/compilation-manager.h
index e359b11c265..38e80c6c2d8 100644
--- a/deps/v8/src/wasm/compilation-manager.h
+++ b/deps/v8/src/wasm/compilation-manager.h
@@ -5,16 +5,17 @@
 #ifndef V8_WASM_COMPILATION_MANAGER_H_
 #define V8_WASM_COMPILATION_MANAGER_H_
 
-#include <vector>
+#include <unordered_map>
 
 #include "src/handles.h"
 #include "src/isolate.h"
-#include "src/wasm/module-compiler.h"
 
 namespace v8 {
 namespace internal {
 namespace wasm {
 
+class AsyncCompileJob;
+
 // The CompilationManager manages a list of active WebAssembly compile jobs. The
 // manager owns the memory of the compile jobs and can trigger the abortion of
 // compile jobs. If the isolate tears down, the CompilationManager makes sure
@@ -29,11 +30,20 @@ class CompilationManager {
   std::shared_ptr<StreamingDecoder> StartStreamingCompilation(
       Isolate* isolate, Handle<Context> context, Handle<JSPromise> promise);
 
-  // Removes {job} from the list of active compile jobs.
-  std::shared_ptr<AsyncCompileJob> RemoveJob(AsyncCompileJob* job);
+  // Remove {job} from the list of active compile jobs.
+  std::unique_ptr<AsyncCompileJob> RemoveJob(AsyncCompileJob* job);
 
+  // Cancel all AsyncCompileJobs and delete their state immediately.
   void TearDown();
 
+  // Cancel all AsyncCompileJobs so that they are not processed any further,
+  // but delay the deletion of their state until all tasks accessing the
+  // AsyncCompileJob finish their execution.
+  void AbortAllJobs();
+
+  // Returns true if at lease one AsyncCompileJob is currently running.
+  bool HasRunningCompileJob() const { return !jobs_.empty(); }
+
  private:
   AsyncCompileJob* CreateAsyncCompileJob(Isolate* isolate,
                                          std::unique_ptr<byte[]> bytes_copy,
@@ -42,7 +52,7 @@ class CompilationManager {
 
   // We use an AsyncCompileJob as the key for itself so that we can delete the
   // job from the map when it is finished.
-  std::unordered_map<AsyncCompileJob*, std::shared_ptr<AsyncCompileJob>> jobs_;
+  std::unordered_map<AsyncCompileJob*, std::unique_ptr<AsyncCompileJob>> jobs_;
 };
 
 }  // namespace wasm
diff --git a/deps/v8/src/wasm/decoder.h b/deps/v8/src/wasm/decoder.h
index 242130b0357..d7e76e4a77c 100644
--- a/deps/v8/src/wasm/decoder.h
+++ b/deps/v8/src/wasm/decoder.h
@@ -46,6 +46,8 @@ class Decoder {
 
   Decoder(const byte* start, const byte* end, uint32_t buffer_offset = 0)
       : Decoder(start, start, end, buffer_offset) {}
+  explicit Decoder(const Vector<const byte> bytes, uint32_t buffer_offset = 0)
+      : Decoder(bytes.start(), bytes.start() + bytes.length(), buffer_offset) {}
   Decoder(const byte* start, const byte* pc, const byte* end,
           uint32_t buffer_offset = 0)
       : start_(start), pc_(pc), end_(end), buffer_offset_(buffer_offset) {
@@ -248,6 +250,7 @@ class Decoder {
 
   const byte* start() const { return start_; }
   const byte* pc() const { return pc_; }
+  uint32_t position() const { return static_cast<uint32_t>(pc_ - start_); }
   uint32_t pc_offset() const {
     return static_cast<uint32_t>(pc_ - start_) + buffer_offset_;
   }
diff --git a/deps/v8/src/wasm/function-body-decoder-impl.h b/deps/v8/src/wasm/function-body-decoder-impl.h
index 04d918b0a4f..3d333fbcf2e 100644
--- a/deps/v8/src/wasm/function-body-decoder-impl.h
+++ b/deps/v8/src/wasm/function-body-decoder-impl.h
@@ -37,6 +37,12 @@ struct WasmException;
     return true;                  \
   }())
 
+#define RET_ON_PROTOTYPE_OPCODE(flag)                                          \
+  DCHECK(!this->module_ || !this->module_->is_asm_js());                       \
+  if (!FLAG_experimental_wasm_##flag) {                                        \
+    this->error("Invalid opcode (enable with --experimental-wasm-" #flag ")"); \
+  }
+
 #define CHECK_PROTOTYPE_OPCODE(flag)                                           \
   DCHECK(!this->module_ || !this->module_->is_asm_js());                       \
   if (!FLAG_experimental_wasm_##flag) {                                        \
@@ -48,36 +54,72 @@ struct WasmException;
   (this->errorf(this->pc_, "%s: %s", WasmOpcodes::OpcodeName(opcode), \
                 (message)))
 
-#define ATOMIC_OP_LIST(V)              \
-  V(I32AtomicLoad, Uint32)             \
-  V(I32AtomicAdd, Uint32)              \
-  V(I32AtomicSub, Uint32)              \
-  V(I32AtomicAnd, Uint32)              \
-  V(I32AtomicOr, Uint32)               \
-  V(I32AtomicXor, Uint32)              \
-  V(I32AtomicExchange, Uint32)         \
-  V(I32AtomicLoad8U, Uint8)            \
-  V(I32AtomicAdd8U, Uint8)             \
-  V(I32AtomicSub8U, Uint8)             \
-  V(I32AtomicAnd8U, Uint8)             \
-  V(I32AtomicOr8U, Uint8)              \
-  V(I32AtomicXor8U, Uint8)             \
-  V(I32AtomicExchange8U, Uint8)        \
-  V(I32AtomicLoad16U, Uint16)          \
-  V(I32AtomicAdd16U, Uint16)           \
-  V(I32AtomicSub16U, Uint16)           \
-  V(I32AtomicAnd16U, Uint16)           \
-  V(I32AtomicOr16U, Uint16)            \
-  V(I32AtomicXor16U, Uint16)           \
-  V(I32AtomicExchange16U, Uint16)      \
-  V(I32AtomicCompareExchange, Uint32)  \
-  V(I32AtomicCompareExchange8U, Uint8) \
-  V(I32AtomicCompareExchange16U, Uint16)
+#define ATOMIC_OP_LIST(V)                \
+  V(I32AtomicLoad, Uint32)               \
+  V(I64AtomicLoad, Uint64)               \
+  V(I32AtomicLoad8U, Uint8)              \
+  V(I32AtomicLoad16U, Uint16)            \
+  V(I64AtomicLoad8U, Uint8)              \
+  V(I64AtomicLoad16U, Uint16)            \
+  V(I64AtomicLoad32U, Uint32)            \
+  V(I32AtomicAdd, Uint32)                \
+  V(I32AtomicAdd8U, Uint8)               \
+  V(I32AtomicAdd16U, Uint16)             \
+  V(I64AtomicAdd, Uint64)                \
+  V(I64AtomicAdd8U, Uint8)               \
+  V(I64AtomicAdd16U, Uint16)             \
+  V(I64AtomicAdd32U, Uint32)             \
+  V(I32AtomicSub, Uint32)                \
+  V(I64AtomicSub, Uint64)                \
+  V(I32AtomicSub8U, Uint8)               \
+  V(I32AtomicSub16U, Uint16)             \
+  V(I64AtomicSub8U, Uint8)               \
+  V(I64AtomicSub16U, Uint16)             \
+  V(I64AtomicSub32U, Uint32)             \
+  V(I32AtomicAnd, Uint32)                \
+  V(I64AtomicAnd, Uint64)                \
+  V(I32AtomicAnd8U, Uint8)               \
+  V(I32AtomicAnd16U, Uint16)             \
+  V(I64AtomicAnd8U, Uint8)               \
+  V(I64AtomicAnd16U, Uint16)             \
+  V(I64AtomicAnd32U, Uint32)             \
+  V(I32AtomicOr, Uint32)                 \
+  V(I64AtomicOr, Uint64)                 \
+  V(I32AtomicOr8U, Uint8)                \
+  V(I32AtomicOr16U, Uint16)              \
+  V(I64AtomicOr8U, Uint8)                \
+  V(I64AtomicOr16U, Uint16)              \
+  V(I64AtomicOr32U, Uint32)              \
+  V(I32AtomicXor, Uint32)                \
+  V(I64AtomicXor, Uint64)                \
+  V(I32AtomicXor8U, Uint8)               \
+  V(I32AtomicXor16U, Uint16)             \
+  V(I64AtomicXor8U, Uint8)               \
+  V(I64AtomicXor16U, Uint16)             \
+  V(I64AtomicXor32U, Uint32)             \
+  V(I32AtomicExchange, Uint32)           \
+  V(I64AtomicExchange, Uint64)           \
+  V(I32AtomicExchange8U, Uint8)          \
+  V(I32AtomicExchange16U, Uint16)        \
+  V(I64AtomicExchange8U, Uint8)          \
+  V(I64AtomicExchange16U, Uint16)        \
+  V(I64AtomicExchange32U, Uint32)        \
+  V(I32AtomicCompareExchange, Uint32)    \
+  V(I64AtomicCompareExchange, Uint64)    \
+  V(I32AtomicCompareExchange8U, Uint8)   \
+  V(I32AtomicCompareExchange16U, Uint16) \
+  V(I64AtomicCompareExchange8U, Uint8)   \
+  V(I64AtomicCompareExchange16U, Uint16) \
+  V(I64AtomicCompareExchange32U, Uint32)
 
 #define ATOMIC_STORE_OP_LIST(V) \
   V(I32AtomicStore, Uint32)     \
+  V(I64AtomicStore, Uint64)     \
   V(I32AtomicStore8U, Uint8)    \
-  V(I32AtomicStore16U, Uint16)
+  V(I32AtomicStore16U, Uint16)  \
+  V(I64AtomicStore8U, Uint8)    \
+  V(I64AtomicStore16U, Uint16)  \
+  V(I64AtomicStore32U, Uint32)
 
 template <typename T, typename Allocator>
 Vector<T> vec2vec(std::vector<T, Allocator>& vec) {
@@ -207,6 +249,9 @@ struct BlockTypeOperand {
       case kLocalS128:
         *result = kWasmS128;
         return true;
+      case kLocalAnyRef:
+        *result = kWasmAnyRef;
+        return true;
       default:
         *result = kWasmVar;
         return false;
@@ -246,12 +291,12 @@ struct BreakDepthOperand {
 template <Decoder::ValidateFlag validate>
 struct CallIndirectOperand {
   uint32_t table_index;
-  uint32_t index;
+  uint32_t sig_index;
   FunctionSig* sig = nullptr;
   unsigned length = 0;
   inline CallIndirectOperand(Decoder* decoder, const byte* pc) {
     unsigned len = 0;
-    index = decoder->read_u32v<validate>(pc + 1, &len, "signature index");
+    sig_index = decoder->read_u32v<validate>(pc + 1, &len, "signature index");
     if (!VALIDATE(decoder->ok())) return;
     table_index = decoder->read_u8<validate>(pc + 1 + len, "table index");
     if (!VALIDATE(table_index == 0)) {
@@ -568,6 +613,7 @@ struct ControlWithNamedConstructors : public ControlBase<Value> {
   F(I64Const, Value* result, int64_t value)                                    \
   F(F32Const, Value* result, float value)                                      \
   F(F64Const, Value* result, double value)                                     \
+  F(RefNull, Value* result)                                                    \
   F(Drop, const Value& value)                                                  \
   F(DoReturn, Vector<Value> values, bool implicit)                             \
   F(GetLocal, Value* result, const LocalIndexOperand<validate>& operand)       \
@@ -648,7 +694,8 @@ class WasmDecoder : public Decoder {
       uint32_t count = decoder->consume_u32v("local count");
       if (decoder->failed()) return false;
 
-      if ((count + type_list->size()) > kV8MaxWasmFunctionLocals) {
+      DCHECK_LE(type_list->size(), kV8MaxWasmFunctionLocals);
+      if (count > kV8MaxWasmFunctionLocals - type_list->size()) {
         decoder->error(decoder->pc() - 1, "local count too large");
         return false;
       }
@@ -669,12 +716,19 @@ class WasmDecoder : public Decoder {
         case kLocalF64:
           type = kWasmF64;
           break;
+        case kLocalAnyRef:
+          if (FLAG_experimental_wasm_anyref) {
+            type = kWasmAnyRef;
+            break;
+          }
+          decoder->error(decoder->pc() - 1, "invalid local type");
+          return false;
         case kLocalS128:
           if (FLAG_experimental_wasm_simd) {
             type = kWasmS128;
             break;
           }
-        // else fall through to default.
+          V8_FALLTHROUGH;
         default:
           decoder->error(decoder->pc() - 1, "invalid local type");
           return false;
@@ -789,10 +843,10 @@ class WasmDecoder : public Decoder {
 
   inline bool Complete(const byte* pc, CallIndirectOperand<validate>& operand) {
     if (!VALIDATE(module_ != nullptr &&
-                  operand.index < module_->signatures.size())) {
+                  operand.sig_index < module_->signatures.size())) {
       return false;
     }
-    operand.sig = module_->signatures[operand.index];
+    operand.sig = module_->signatures[operand.sig_index];
     return true;
   }
 
@@ -802,7 +856,7 @@ class WasmDecoder : public Decoder {
       return false;
     }
     if (!Complete(pc, operand)) {
-      errorf(pc + 1, "invalid signature index: #%u", operand.index);
+      errorf(pc + 1, "invalid signature index: #%u", operand.sig_index);
       return false;
     }
     return true;
@@ -965,6 +1019,9 @@ class WasmDecoder : public Decoder {
         ImmI64Operand<validate> operand(decoder, pc);
         return 1 + operand.length;
       }
+      case kExprRefNull: {
+        return 1;
+      }
       case kExprGrowMemory:
       case kExprMemorySize: {
         MemoryIndexOperand<validate> operand(decoder, pc);
@@ -1057,6 +1114,7 @@ class WasmDecoder : public Decoder {
       case kExprI64Const:
       case kExprF32Const:
       case kExprF64Const:
+      case kExprRefNull:
       case kExprMemorySize:
         return {0, 1};
       case kExprCallFunction: {
@@ -1097,6 +1155,7 @@ class WasmDecoder : public Decoder {
             }
           }
         }
+        V8_FALLTHROUGH;
       }
       default:
         V8_Fatal(__FILE__, __LINE__, "unimplemented opcode: %x (%s)", opcode,
@@ -1132,8 +1191,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
 
   // All Value types should be trivially copyable for performance. We push, pop,
   // and store them in local variables.
-  static_assert(IS_TRIVIALLY_COPYABLE(Value),
-                "all Value<...> types should be trivially copyable");
+  ASSERT_TRIVIALLY_COPYABLE(Value);
 
  public:
   template <typename... InterfaceArgs>
@@ -1534,8 +1592,10 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             if (!this->Validate(this->pc_, operand, control_.size())) break;
             Control* c = control_at(operand.depth);
             if (!TypeCheckBreak(c)) break;
-            CALL_INTERFACE_IF_REACHABLE(Br, c);
-            BreakTo(c);
+            if (control_.back().reachable()) {
+              CALL_INTERFACE(Br, c);
+              c->br_merge()->reached = true;
+            }
             len = 1 + operand.length;
             EndControl();
             break;
@@ -1543,28 +1603,38 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           case kExprBrIf: {
             BreakDepthOperand<validate> operand(this, this->pc_);
             auto cond = Pop(0, kWasmI32);
+            if (this->failed()) break;
             if (!this->Validate(this->pc_, operand, control_.size())) break;
             Control* c = control_at(operand.depth);
             if (!TypeCheckBreak(c)) break;
-            CALL_INTERFACE_IF_REACHABLE(BrIf, cond, c);
-            BreakTo(c);
+            if (control_.back().reachable()) {
+              CALL_INTERFACE(BrIf, cond, c);
+              c->br_merge()->reached = true;
+            }
             len = 1 + operand.length;
             break;
           }
           case kExprBrTable: {
             BranchTableOperand<validate> operand(this, this->pc_);
             BranchTableIterator<validate> iterator(this, operand);
-            if (!this->Validate(this->pc_, operand, control_.size())) break;
             auto key = Pop(0, kWasmI32);
+            if (this->failed()) break;
+            if (!this->Validate(this->pc_, operand, control_.size())) break;
             uint32_t br_arity = 0;
+            std::vector<bool> br_targets(control_.size());
             while (iterator.has_next()) {
               const uint32_t i = iterator.cur_index();
               const byte* pos = iterator.pc();
               uint32_t target = iterator.next();
               if (!VALIDATE(target < control_.size())) {
-                this->error(pos, "improper branch in br_table");
+                this->errorf(pos,
+                             "improper branch in br_table target %u (depth %u)",
+                             i, target);
                 break;
               }
+              // Avoid redundant break target checks.
+              if (br_targets[target]) continue;
+              br_targets[target] = true;
               // Check that label types match up.
               Control* c = control_at(target);
               uint32_t arity = c->br_merge()->arity;
@@ -1572,15 +1642,22 @@ class WasmFullDecoder : public WasmDecoder<validate> {
                 br_arity = arity;
               } else if (!VALIDATE(br_arity == arity)) {
                 this->errorf(pos,
-                             "inconsistent arity in br_table target %d"
+                             "inconsistent arity in br_table target %u"
                              " (previous was %u, this one %u)",
                              i, br_arity, arity);
               }
               if (!TypeCheckBreak(c)) break;
-              BreakTo(c);
             }
+            if (this->failed()) break;
 
-            CALL_INTERFACE_IF_REACHABLE(BrTable, operand, key);
+            if (control_.back().reachable()) {
+              CALL_INTERFACE(BrTable, operand, key);
+
+              for (uint32_t depth = control_depth(); depth-- > 0;) {
+                if (!br_targets[depth]) continue;
+                control_at(depth)->br_merge()->reached = true;
+              }
+            }
 
             len = 1 + iterator.length();
             EndControl();
@@ -1623,6 +1700,13 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             len = 1 + operand.length;
             break;
           }
+          case kExprRefNull: {
+            CHECK_PROTOTYPE_OPCODE(anyref);
+            auto* value = Push(kWasmAnyRef);
+            CALL_INTERFACE_IF_REACHABLE(RefNull, value);
+            len = 1;
+            break;
+          }
           case kExprGetLocal: {
             LocalIndexOperand<Decoder::kValidate> operand(this, this->pc_);
             if (!this->Validate(this->pc_, operand)) break;
@@ -2249,10 +2333,6 @@ class WasmFullDecoder : public WasmDecoder<validate> {
 
   int startrel(const byte* ptr) { return static_cast<int>(ptr - this->start_); }
 
-  inline void BreakTo(Control* c) {
-    if (control_.back().reachable()) c->br_merge()->reached = true;
-  }
-
   void FallThruTo(Control* c) {
     DCHECK_EQ(c, &control_.back());
     if (!TypeCheckFallThru(c)) return;
@@ -2344,6 +2424,13 @@ class WasmFullDecoder : public WasmDecoder<validate> {
   }
 
   inline void BuildSimpleOperator(WasmOpcode opcode, FunctionSig* sig) {
+    if (WasmOpcodes::IsSignExtensionOpcode(opcode)) {
+      RET_ON_PROTOTYPE_OPCODE(se);
+    }
+    if (WasmOpcodes::IsAnyRefOpcode(opcode)) {
+      RET_ON_PROTOTYPE_OPCODE(anyref);
+    }
+
     switch (sig->parameter_count()) {
       case 1: {
         auto val = Pop(0, sig->GetParam(0));
diff --git a/deps/v8/src/wasm/function-body-decoder.cc b/deps/v8/src/wasm/function-body-decoder.cc
index 57ee78f91cf..b25b0701f46 100644
--- a/deps/v8/src/wasm/function-body-decoder.cc
+++ b/deps/v8/src/wasm/function-body-decoder.cc
@@ -46,7 +46,7 @@ struct SsaEnv {
     locals = nullptr;
     control = nullptr;
     effect = nullptr;
-    context_cache = {0};
+    context_cache = {};
   }
   void SetNotMerged() {
     if (state == kMerged) state = kReached;
@@ -235,6 +235,10 @@ class WasmGraphBuildingInterface {
     result->node = builder_->Float64Constant(value);
   }
 
+  void RefNull(Decoder* decoder, Value* result) {
+    result->node = builder_->HeapConstant(Handle<HeapObject>::null());
+  }
+
   void Drop(Decoder* decoder, const Value& value) {}
 
   void DoReturn(Decoder* decoder, Vector<Value> values, bool implicit) {
@@ -369,13 +373,13 @@ class WasmGraphBuildingInterface {
   void CallDirect(Decoder* decoder,
                   const CallFunctionOperand<validate>& operand,
                   const Value args[], Value returns[]) {
-    DoCall(decoder, nullptr, operand, args, returns, false);
+    DoCall(decoder, nullptr, operand.sig, operand.index, args, returns);
   }
 
   void CallIndirect(Decoder* decoder, const Value& index,
                     const CallIndirectOperand<validate>& operand,
                     const Value args[], Value returns[]) {
-    DoCall(decoder, index.node, operand, args, returns, true);
+    DoCall(decoder, index.node, operand.sig, operand.sig_index, args, returns);
   }
 
   void SimdOp(Decoder* decoder, WasmOpcode opcode, Vector<Value> args,
@@ -750,7 +754,7 @@ class WasmGraphBuildingInterface {
     } else {
       result->state = SsaEnv::kUnreachable;
       result->locals = nullptr;
-      result->context_cache = {0};
+      result->context_cache = {};
     }
 
     return result;
@@ -778,34 +782,33 @@ class WasmGraphBuildingInterface {
     result->control = nullptr;
     result->effect = nullptr;
     result->locals = nullptr;
-    result->context_cache = {0};
+    result->context_cache = {};
     return result;
   }
 
-  template <typename Operand>
   void DoCall(WasmFullDecoder<validate, WasmGraphBuildingInterface>* decoder,
-              TFNode* index_node, const Operand& operand, const Value args[],
-              Value returns[], bool is_indirect) {
-    int param_count = static_cast<int>(operand.sig->parameter_count());
+              TFNode* index_node, FunctionSig* sig, uint32_t index,
+              const Value args[], Value returns[]) {
+    int param_count = static_cast<int>(sig->parameter_count());
     TFNode** arg_nodes = builder_->Buffer(param_count + 1);
     TFNode** return_nodes = nullptr;
     arg_nodes[0] = index_node;
     for (int i = 0; i < param_count; ++i) {
       arg_nodes[i + 1] = args[i].node;
     }
-    if (is_indirect) {
-      builder_->CallIndirect(operand.index, arg_nodes, &return_nodes,
+    if (index_node) {
+      builder_->CallIndirect(index, arg_nodes, &return_nodes,
                              decoder->position());
     } else {
-      builder_->CallDirect(operand.index, arg_nodes, &return_nodes,
+      builder_->CallDirect(index, arg_nodes, &return_nodes,
                            decoder->position());
     }
-    int return_count = static_cast<int>(operand.sig->return_count());
+    int return_count = static_cast<int>(sig->return_count());
     for (int i = 0; i < return_count; ++i) {
       returns[i].node = return_nodes[i];
     }
     // The invoked function could have used grow_memory, so we need to
-    // reload mem_size and mem_start
+    // reload mem_size and mem_start.
     LoadContextIntoSsa(ssa_env_);
   }
 };
@@ -960,8 +963,31 @@ bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
 
     os << RawOpcodeName(opcode) << ",";
 
-    for (unsigned j = 1; j < length; ++j) {
-      os << " 0x" << AsHex(i.pc()[j], 2) << ",";
+    if (opcode == kExprLoop || opcode == kExprIf || opcode == kExprBlock ||
+        opcode == kExprTry) {
+      DCHECK_EQ(2, length);
+
+      switch (i.pc()[1]) {
+#define CASE_LOCAL_TYPE(local_name, type_name) \
+  case kLocal##local_name:                     \
+    os << " kWasm" #type_name ",";             \
+    break;
+
+        CASE_LOCAL_TYPE(I32, I32)
+        CASE_LOCAL_TYPE(I64, I64)
+        CASE_LOCAL_TYPE(F32, F32)
+        CASE_LOCAL_TYPE(F64, F64)
+        CASE_LOCAL_TYPE(S128, S128)
+        CASE_LOCAL_TYPE(Void, Stmt)
+        default:
+          os << " 0x" << AsHex(i.pc()[1], 2) << ",";
+          break;
+      }
+#undef CASE_LOCAL_TYPE
+    } else {
+      for (unsigned j = 1; j < length; ++j) {
+        os << " 0x" << AsHex(i.pc()[j], 2) << ",";
+      }
     }
 
     switch (opcode) {
@@ -1002,7 +1028,7 @@ bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
       }
       case kExprCallIndirect: {
         CallIndirectOperand<Decoder::kNoValidate> operand(&i, i.pc());
-        os << "   // sig #" << operand.index;
+        os << "   // sig #" << operand.sig_index;
         if (decoder.Complete(i.pc(), operand)) {
           os << ": " << *operand.sig;
         }
diff --git a/deps/v8/src/wasm/module-compiler.cc b/deps/v8/src/wasm/module-compiler.cc
index 4a2e610b99b..b8e04770d98 100644
--- a/deps/v8/src/wasm/module-compiler.cc
+++ b/deps/v8/src/wasm/module-compiler.cc
@@ -58,74 +58,19 @@ namespace wasm {
 
 static constexpr int kInvalidSigIndex = -1;
 
-// A class compiling an entire module.
-class ModuleCompiler {
- public:
-  ModuleCompiler(Isolate* isolate, WasmModule* module, Handle<Code> centry_stub,
-                 wasm::NativeModule* native_module);
-
-  // The actual runnable task that performs compilations in the background.
-  class CompilationTask : public CancelableTask {
-   public:
-    ModuleCompiler* compiler_;
-    explicit CompilationTask(ModuleCompiler* compiler)
-        : CancelableTask(&compiler->background_task_manager_),
-          compiler_(compiler) {}
-
-    void RunInternal() override {
-      while (compiler_->executed_units_.CanAcceptWork() &&
-             compiler_->FetchAndExecuteCompilationUnit()) {
-      }
-
-      compiler_->OnBackgroundTaskStopped();
-    }
-  };
-
-  // The CompilationUnitBuilder builds compilation units and stores them in an
-  // internal buffer. The buffer is moved into the working queue of the
-  // ModuleCompiler when {Commit} is called.
-  class CompilationUnitBuilder {
-   public:
-    explicit CompilationUnitBuilder(ModuleCompiler* compiler)
-        : compiler_(compiler) {}
-
-    ~CompilationUnitBuilder() { DCHECK(units_.empty()); }
-
-    void AddUnit(compiler::ModuleEnv* module_env,
-                 wasm::NativeModule* native_module,
-                 const WasmFunction* function, uint32_t buffer_offset,
-                 Vector<const uint8_t> bytes, WasmName name) {
-      units_.emplace_back(new compiler::WasmCompilationUnit(
-          compiler_->isolate_, module_env, native_module,
-          wasm::FunctionBody{function->sig, buffer_offset, bytes.begin(),
-                             bytes.end()},
-          name, function->func_index, compiler_->centry_stub_,
-          compiler::WasmCompilationUnit::GetDefaultCompilationMode(),
-          compiler_->counters()));
-    }
-
-    bool Commit() {
-      if (units_.empty()) return false;
-
-      {
-        base::LockGuard<base::Mutex> guard(
-            &compiler_->compilation_units_mutex_);
-        compiler_->compilation_units_.insert(
-            compiler_->compilation_units_.end(),
-            std::make_move_iterator(units_.begin()),
-            std::make_move_iterator(units_.end()));
-      }
-      units_.clear();
-      return true;
-    }
-
-    void Clear() { units_.clear(); }
+enum class CompilationEvent : uint8_t {
+  kFinishedBaselineCompilation,
+  kFailedCompilation
+};
 
-   private:
-    ModuleCompiler* compiler_;
-    std::vector<std::unique_ptr<compiler::WasmCompilationUnit>> units_;
-  };
+enum class NotifyCompilationCallback : uint8_t { kNotify, kNoNotify };
 
+// The CompilationState keeps track of the compilation state of the
+// owning NativeModule, i.e. which functions are left to be compiled.
+// It contains a task manager to allow parallel and asynchronous background
+// compilation of functions.
+class CompilationState {
+ public:
   class CodeGenerationSchedule {
    public:
     explicit CodeGenerationSchedule(
@@ -154,21 +99,37 @@ class ModuleCompiler {
     base::AtomicNumber<size_t> allocated_memory_{0};
   };
 
-  Counters* counters() const { return async_counters_.get(); }
+  explicit CompilationState(internal::Isolate* isolate);
+  ~CompilationState();
 
-  // Run by each compilation task and by the main thread (i.e. in both
-  // foreground and background threads). The no_finisher_callback is called
-  // within the result_mutex_ lock when no finishing task is running, i.e. when
-  // the finisher_is_running_ flag is not set.
-  bool FetchAndExecuteCompilationUnit(
-      std::function<void()> no_finisher_callback = nullptr);
+  // Needs to be set before {AddCompilationUnits} is run, which triggers
+  // {StartCompilation}.
+  void SetNumberOfFunctionsToCompile(size_t num_functions);
+  void AddCallback(
+      std::function<void(CompilationEvent, Handle<Object>)> callback);
 
-  void OnBackgroundTaskStopped();
+  // Inserts new functions to compile and kicks off compilation.
+  void AddCompilationUnits(
+      std::vector<std::unique_ptr<compiler::WasmCompilationUnit>>& units);
+  std::unique_ptr<compiler::WasmCompilationUnit> GetNextCompilationUnit();
+  std::unique_ptr<compiler::WasmCompilationUnit> GetNextExecutedUnit();
+  bool HasCompilationUnitToFinish();
 
-  void EnableThrottling() { executed_units_.EnableThrottling(); }
+  void OnError(Handle<Object> error, NotifyCompilationCallback notify);
+  void OnFinishedUnit(NotifyCompilationCallback notify);
+  void ScheduleUnitForFinishing(
+      std::unique_ptr<compiler::WasmCompilationUnit>& unit);
 
-  bool CanAcceptWork() const { return executed_units_.CanAcceptWork(); }
+  void CancelAndWait();
+  void OnBackgroundTaskStopped();
+  void RestartBackgroundTasks();
+  // Only one foreground thread (finisher) is allowed to run at a time.
+  // {SetFinisherIsRunning} returns whether the flag changed its state.
+  bool SetFinisherIsRunning(bool value);
+  void ScheduleFinisherTask();
 
+  bool CanAcceptWork() const { return executed_units_.CanAcceptWork(); }
+  void EnableThrottling() { executed_units_.EnableThrottling(); }
   bool ShouldIncreaseWorkload() {
     if (executed_units_.ShouldIncreaseWorkload()) {
       // Check if it actually makes sense to increase the workload.
@@ -178,63 +139,59 @@ class ModuleCompiler {
     return false;
   }
 
-  size_t InitializeCompilationUnits(const std::vector<WasmFunction>& functions,
-                                    const ModuleWireBytes& wire_bytes,
-                                    compiler::ModuleEnv* module_env);
-
-  void RestartCompilationTasks();
-
-  size_t FinishCompilationUnits(std::vector<Handle<Code>>& results,
-                                ErrorThrower* thrower);
+  void Abort();
 
-  bool IsFinisherRunning() const { return finisher_is_running_; }
+  Isolate* isolate() { return isolate_; }
 
-  void SetFinisherIsRunning(bool value);
+  WasmCompiledModule* compiled_module() const {
+    DCHECK_NOT_NULL(compiled_module_);
+    return *compiled_module_;
+  }
 
-  WasmCodeWrapper FinishCompilationUnit(ErrorThrower* thrower, int* func_index);
+  void SetCompiledModule(Handle<WasmCompiledModule> compiled_module) {
+    compiled_module_ =
+        isolate_->global_handles()->Create(*compiled_module).location();
+    GlobalHandles::MakeWeak(reinterpret_cast<Object***>(&compiled_module_));
+  }
 
-  void CompileInParallel(const ModuleWireBytes& wire_bytes,
-                         compiler::ModuleEnv* module_env,
-                         std::vector<Handle<Code>>& results,
-                         ErrorThrower* thrower);
+  bool failed() { return failed_; }
 
-  void CompileSequentially(const ModuleWireBytes& wire_bytes,
-                           compiler::ModuleEnv* module_env,
-                           std::vector<Handle<Code>>& results,
-                           ErrorThrower* thrower);
+ private:
+  void StartCompilation(size_t num_functions);
 
-  void ValidateSequentially(const ModuleWireBytes& wire_bytes,
-                            compiler::ModuleEnv* module_env,
-                            ErrorThrower* thrower);
+  void NotifyOnEvent(CompilationEvent event, Handle<Object> error);
 
-  static MaybeHandle<WasmModuleObject> CompileToModuleObject(
-      Isolate* isolate, ErrorThrower* thrower,
-      std::unique_ptr<WasmModule> module, const ModuleWireBytes& wire_bytes,
-      Handle<Script> asm_js_script,
-      Vector<const byte> asm_js_offset_table_bytes);
+  Isolate* isolate_;
 
- private:
-  MaybeHandle<WasmModuleObject> CompileToModuleObjectInternal(
-      ErrorThrower* thrower, std::unique_ptr<WasmModule> module,
-      const ModuleWireBytes& wire_bytes, Handle<Script> asm_js_script,
-      Vector<const byte> asm_js_offset_table_bytes);
+  // A phantom reference to the {WasmCompiledModule}. It is intentionally not
+  // typed {Handle<WasmCompiledModule>} because this location will be cleared
+  // when the phantom reference is cleared.
+  WasmCompiledModule** compiled_module_ = nullptr;
 
-  Isolate* isolate_;
-  WasmModule* module_;
-  const std::shared_ptr<Counters> async_counters_;
   std::vector<std::unique_ptr<compiler::WasmCompilationUnit>>
       compilation_units_;
+  std::vector<std::function<void(CompilationEvent, Handle<Object>)>> callbacks_;
   base::Mutex compilation_units_mutex_;
+
   CodeGenerationSchedule executed_units_;
-  base::Mutex result_mutex_;
-  const size_t num_background_tasks_;
-  // This flag should only be set while holding result_mutex_.
+  // Should only be set when result_mutex_ is taken.
   bool finisher_is_running_ = false;
+  base::Mutex result_mutex_;
+
+  // When canceling the background_task_manager_, use {CancelAndWait} on
+  // the CompilationState in order to cleanly clean up.
   CancelableTaskManager background_task_manager_;
+  CancelableTaskManager foreground_task_manager_;
+  std::shared_ptr<v8::TaskRunner> background_task_runner_;
+  std::shared_ptr<v8::TaskRunner> foreground_task_runner_;
+
+  size_t num_background_tasks_ = 0;
   size_t stopped_compilation_tasks_ = 0;
   base::Mutex tasks_mutex_;
-  Handle<Code> centry_stub_;
-  wasm::NativeModule* native_module_;
+
+  std::atomic<bool> failed_{false};
+
+  size_t outstanding_units_ = 0;
 };
 
 namespace {
@@ -249,7 +206,7 @@ class JSToWasmWrapperCache {
 
   Handle<Code> CloneOrCompileJSToWasmWrapper(Isolate* isolate,
                                              wasm::WasmModule* module,
-                                             WasmCodeWrapper wasm_code,
+                                             wasm::WasmCode* wasm_code,
                                              uint32_t index,
                                              bool use_trap_handler) {
     const wasm::WasmFunction* func = &module->functions[index];
@@ -257,30 +214,10 @@ class JSToWasmWrapperCache {
     if (cached_idx >= 0) {
       Handle<Code> code = isolate->factory()->CopyCode(code_cache_[cached_idx]);
       // Now patch the call to wasm code.
-      if (wasm_code.IsCodeObject()) {
-        for (RelocIterator it(*code, RelocInfo::kCodeTargetMask);; it.next()) {
-          DCHECK(!it.done());
-          Code* target =
-              Code::GetCodeFromTargetAddress(it.rinfo()->target_address());
-          if (target->kind() == Code::WASM_FUNCTION ||
-              target->kind() == Code::WASM_TO_JS_FUNCTION ||
-              target->kind() == Code::WASM_TO_WASM_FUNCTION ||
-              target->builtin_index() == Builtins::kIllegal ||
-              target->builtin_index() == Builtins::kWasmCompileLazy) {
-            it.rinfo()->set_target_address(
-                isolate, wasm_code.GetCode()->instruction_start());
-            break;
-          }
-        }
-      } else {
-        RelocIterator it(*code,
-                         RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL));
-        DCHECK(!it.done());
-        it.rinfo()->set_js_to_wasm_address(
-            isolate, wasm_code.is_null()
-                         ? nullptr
-                         : wasm_code.GetWasmCode()->instructions().start());
-      }
+      RelocIterator it(*code, RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL));
+      DCHECK(!it.done());
+      it.rinfo()->set_js_to_wasm_address(
+          wasm_code == nullptr ? nullptr : wasm_code->instructions().start());
       return code;
     }
 
@@ -308,11 +245,12 @@ class InstanceBuilder {
   InstanceBuilder(Isolate* isolate, ErrorThrower* thrower,
                   Handle<WasmModuleObject> module_object,
                   MaybeHandle<JSReceiver> ffi,
-                  MaybeHandle<JSArrayBuffer> memory,
-                  WeakCallbackInfo<void>::Callback instance_finalizer_callback);
+                  MaybeHandle<JSArrayBuffer> memory);
 
   // Build an instance, in all of its glory.
   MaybeHandle<WasmInstanceObject> Build();
+  // Run the start function, if any.
+  bool ExecuteStartFunction();
 
  private:
   // Represents the initialized state of a table.
@@ -340,8 +278,8 @@ class InstanceBuilder {
   Handle<WasmCompiledModule> compiled_module_;
   std::vector<TableInstance> table_instances_;
   std::vector<Handle<JSFunction>> js_wrappers_;
+  Handle<WasmExportedFunction> start_function_;
   JSToWasmWrapperCache js_to_wasm_cache_;
-  WeakCallbackInfo<void>::Callback instance_finalizer_callback_;
   std::vector<SanitizedImport> sanitized_imports_;
 
   const std::shared_ptr<Counters>& async_counters() const {
@@ -398,8 +336,7 @@ class InstanceBuilder {
   // Process the imports, including functions, tables, globals, and memory, in
   // order, loading them from the {ffi_} object. Returns the number of imported
   // functions.
-  int ProcessImports(Handle<FixedArray> code_table,
-                     Handle<WasmInstanceObject> instance);
+  int ProcessImports(Handle<WasmInstanceObject> instance);
 
   template <typename T>
   T* GetRawGlobalPtr(WasmGlobal& global);
@@ -420,95 +357,9 @@ class InstanceBuilder {
   void InitializeTables(Handle<WasmInstanceObject> instance,
                         CodeSpecialization* code_specialization);
 
-  void LoadTableSegments(Handle<FixedArray> code_table,
-                         Handle<WasmInstanceObject> instance);
+  void LoadTableSegments(Handle<WasmInstanceObject> instance);
 };
 
-// TODO(titzer): move to wasm-objects.cc
-void InstanceFinalizer(const v8::WeakCallbackInfo<void>& data) {
-  DisallowHeapAllocation no_gc;
-  JSObject** p = reinterpret_cast<JSObject**>(data.GetParameter());
-  WasmInstanceObject* owner = reinterpret_cast<WasmInstanceObject*>(*p);
-  Isolate* isolate = reinterpret_cast<Isolate*>(data.GetIsolate());
-  // If a link to shared memory instances exists, update the list of memory
-  // instances before the instance is destroyed.
-  WasmCompiledModule* compiled_module = owner->compiled_module();
-  wasm::NativeModule* native_module = compiled_module->GetNativeModule();
-  if (FLAG_wasm_jit_to_native) {
-    if (native_module) {
-      TRACE("Finalizing %zu {\n", native_module->instance_id);
-    } else {
-      TRACE("Finalized already cleaned up compiled module\n");
-    }
-  } else {
-    TRACE("Finalizing %d {\n", compiled_module->instance_id());
-
-    if (compiled_module->use_trap_handler()) {
-      // TODO(6792): No longer needed once WebAssembly code is off heap.
-      CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
-      DisallowHeapAllocation no_gc;
-      FixedArray* code_table = compiled_module->code_table();
-      for (int i = 0; i < code_table->length(); ++i) {
-        Code* code = Code::cast(code_table->get(i));
-        int index = code->trap_handler_index()->value();
-        if (index >= 0) {
-          trap_handler::ReleaseHandlerData(index);
-          code->set_trap_handler_index(
-              Smi::FromInt(trap_handler::kInvalidIndex));
-        }
-      }
-    }
-  }
-  WeakCell* weak_wasm_module = compiled_module->weak_wasm_module();
-
-  // Since the order of finalizers is not guaranteed, it can be the case
-  // that {instance->compiled_module()->module()}, which is a
-  // {Managed<WasmModule>} has been collected earlier in this GC cycle.
-  // Weak references to this instance won't be cleared until
-  // the next GC cycle, so we need to manually break some links (such as
-  // the weak references from {WasmMemoryObject::instances}.
-  if (owner->has_memory_object()) {
-    Handle<WasmMemoryObject> memory(owner->memory_object(), isolate);
-    Handle<WasmInstanceObject> instance(owner, isolate);
-    WasmMemoryObject::RemoveInstance(isolate, memory, instance);
-  }
-
-  // weak_wasm_module may have been cleared, meaning the module object
-  // was GC-ed. We still want to maintain the links between instances, to
-  // release the WasmCompiledModule corresponding to the WasmModuleInstance
-  // being finalized here.
-  WasmModuleObject* wasm_module = nullptr;
-  if (!weak_wasm_module->cleared()) {
-    wasm_module = WasmModuleObject::cast(weak_wasm_module->value());
-    WasmCompiledModule* current_template = wasm_module->compiled_module();
-
-    TRACE("chain before {\n");
-    TRACE_CHAIN(current_template);
-    TRACE("}\n");
-
-    DCHECK(!current_template->has_prev_instance());
-    if (current_template == compiled_module) {
-      if (!compiled_module->has_next_instance()) {
-        WasmCompiledModule::Reset(isolate, compiled_module);
-      } else {
-        WasmModuleObject::cast(wasm_module)
-            ->set_compiled_module(compiled_module->next_instance());
-      }
-    }
-  }
-
-  compiled_module->RemoveFromChain();
-
-  if (wasm_module != nullptr) {
-    TRACE("chain after {\n");
-    TRACE_CHAIN(wasm_module->compiled_module());
-    TRACE("}\n");
-  }
-  compiled_module->reset_weak_owning_instance();
-  GlobalHandles::Destroy(reinterpret_cast<Object**>(p));
-  TRACE("}\n");
-}
-
 // This is used in ProcessImports.
 // When importing other modules' exports, we need to ask
 // the exporter for a WasmToWasm wrapper. To do that, we need to
@@ -517,8 +368,9 @@ void InstanceFinalizer(const v8::WeakCallbackInfo<void>& data) {
 class SetOfNativeModuleModificationScopes final {
  public:
   void Add(NativeModule* module) {
-    module->SetExecutable(false);
-    native_modules_.insert(module);
+    if (native_modules_.insert(module).second) {
+      module->SetExecutable(false);
+    }
   }
 
   ~SetOfNativeModuleModificationScopes() {
@@ -531,227 +383,28 @@ class SetOfNativeModuleModificationScopes final {
   std::unordered_set<NativeModule*> native_modules_;
 };
 
-}  // namespace
-
-MaybeHandle<WasmModuleObject> SyncCompileTranslatedAsmJs(
-    Isolate* isolate, ErrorThrower* thrower, const ModuleWireBytes& bytes,
-    Handle<Script> asm_js_script,
-    Vector<const byte> asm_js_offset_table_bytes) {
-  ModuleResult result = SyncDecodeWasmModule(isolate, bytes.start(),
-                                             bytes.end(), false, kAsmJsOrigin);
-  if (result.failed()) {
-    thrower->CompileFailed("Wasm decoding failed", result);
-    return {};
+void EnsureWasmContextTable(WasmContext* wasm_context, int table_size) {
+  if (wasm_context->table) return;
+  wasm_context->table_size = table_size;
+  wasm_context->table = reinterpret_cast<IndirectFunctionTableEntry*>(
+      calloc(table_size, sizeof(IndirectFunctionTableEntry)));
+  for (int i = 0; i < table_size; i++) {
+    wasm_context->table[i].sig_id = kInvalidSigIndex;
   }
-
-  // Transfer ownership of the WasmModule to the {WasmModuleWrapper} generated
-  // in {CompileToModuleObject}.
-  return ModuleCompiler::CompileToModuleObject(
-      isolate, thrower, std::move(result.val), bytes, asm_js_script,
-      asm_js_offset_table_bytes);
 }
 
-MaybeHandle<WasmModuleObject> SyncCompile(Isolate* isolate,
-                                          ErrorThrower* thrower,
-                                          const ModuleWireBytes& bytes) {
-  ModuleResult result = SyncDecodeWasmModule(isolate, bytes.start(),
-                                             bytes.end(), false, kWasmOrigin);
-  if (result.failed()) {
-    thrower->CompileFailed("Wasm decoding failed", result);
-    return {};
-  }
-
-  // Transfer ownership of the WasmModule to the {WasmModuleWrapper} generated
-  // in {CompileToModuleObject}.
-  return ModuleCompiler::CompileToModuleObject(
-      isolate, thrower, std::move(result.val), bytes, Handle<Script>(),
-      Vector<const byte>());
-}
+}  // namespace
 
-MaybeHandle<WasmInstanceObject> SyncInstantiate(
+MaybeHandle<WasmInstanceObject> InstantiateToInstanceObject(
     Isolate* isolate, ErrorThrower* thrower,
     Handle<WasmModuleObject> module_object, MaybeHandle<JSReceiver> imports,
     MaybeHandle<JSArrayBuffer> memory) {
-  InstanceBuilder builder(isolate, thrower, module_object, imports, memory,
-                          &InstanceFinalizer);
-  return builder.Build();
-}
-
-MaybeHandle<WasmInstanceObject> SyncCompileAndInstantiate(
-    Isolate* isolate, ErrorThrower* thrower, const ModuleWireBytes& bytes,
-    MaybeHandle<JSReceiver> imports, MaybeHandle<JSArrayBuffer> memory) {
-  MaybeHandle<WasmModuleObject> module = SyncCompile(isolate, thrower, bytes);
-  DCHECK_EQ(thrower->error(), module.is_null());
-  if (module.is_null()) return {};
-
-  return SyncInstantiate(isolate, thrower, module.ToHandleChecked(), imports,
-                         memory);
-}
-
-void RejectPromise(Isolate* isolate, Handle<Context> context,
-                   ErrorThrower& thrower, Handle<JSPromise> promise) {
-  Local<Promise::Resolver> resolver =
-      Utils::PromiseToLocal(promise).As<Promise::Resolver>();
-  auto maybe = resolver->Reject(Utils::ToLocal(context),
-                                Utils::ToLocal(thrower.Reify()));
-  CHECK_IMPLIES(!maybe.FromMaybe(false), isolate->has_scheduled_exception());
-}
-
-void ResolvePromise(Isolate* isolate, Handle<Context> context,
-                    Handle<JSPromise> promise, Handle<Object> result) {
-  Local<Promise::Resolver> resolver =
-      Utils::PromiseToLocal(promise).As<Promise::Resolver>();
-  auto maybe =
-      resolver->Resolve(Utils::ToLocal(context), Utils::ToLocal(result));
-  CHECK_IMPLIES(!maybe.FromMaybe(false), isolate->has_scheduled_exception());
-}
-
-void AsyncInstantiate(Isolate* isolate, Handle<JSPromise> promise,
-                      Handle<WasmModuleObject> module_object,
-                      MaybeHandle<JSReceiver> imports) {
-  ErrorThrower thrower(isolate, nullptr);
-  MaybeHandle<WasmInstanceObject> instance_object = SyncInstantiate(
-      isolate, &thrower, module_object, imports, Handle<JSArrayBuffer>::null());
-  if (thrower.error()) {
-    RejectPromise(isolate, handle(isolate->context()), thrower, promise);
-    return;
-  }
-  ResolvePromise(isolate, handle(isolate->context()), promise,
-                 instance_object.ToHandleChecked());
-}
-
-void AsyncCompile(Isolate* isolate, Handle<JSPromise> promise,
-                  const ModuleWireBytes& bytes, bool is_shared) {
-  if (!FLAG_wasm_async_compilation) {
-    // Asynchronous compilation disabled; fall back on synchronous compilation.
-    ErrorThrower thrower(isolate, "WasmCompile");
-    MaybeHandle<WasmModuleObject> module_object;
-    if (is_shared) {
-      // Make a copy of the wire bytes to avoid concurrent modification.
-      std::unique_ptr<uint8_t[]> copy(new uint8_t[bytes.length()]);
-      memcpy(copy.get(), bytes.start(), bytes.length());
-      i::wasm::ModuleWireBytes bytes_copy(copy.get(),
-                                          copy.get() + bytes.length());
-      module_object = SyncCompile(isolate, &thrower, bytes_copy);
-    } else {
-      // The wire bytes are not shared, OK to use them directly.
-      module_object = SyncCompile(isolate, &thrower, bytes);
-    }
-    if (thrower.error()) {
-      RejectPromise(isolate, handle(isolate->context()), thrower, promise);
-      return;
-    }
-    Handle<WasmModuleObject> module = module_object.ToHandleChecked();
-    ResolvePromise(isolate, handle(isolate->context()), promise, module);
-    return;
-  }
-
-  if (FLAG_wasm_test_streaming) {
-    std::shared_ptr<StreamingDecoder> streaming_decoder =
-        isolate->wasm_engine()
-            ->compilation_manager()
-            ->StartStreamingCompilation(isolate, handle(isolate->context()),
-                                        promise);
-    streaming_decoder->OnBytesReceived(bytes.module_bytes());
-    streaming_decoder->Finish();
-    return;
-  }
-  // Make a copy of the wire bytes in case the user program changes them
-  // during asynchronous compilation.
-  std::unique_ptr<byte[]> copy(new byte[bytes.length()]);
-  memcpy(copy.get(), bytes.start(), bytes.length());
-  isolate->wasm_engine()->compilation_manager()->StartAsyncCompileJob(
-      isolate, std::move(copy), bytes.length(), handle(isolate->context()),
-      promise);
-}
-
-Handle<Code> CompileLazyOnGCHeap(Isolate* isolate) {
-  HistogramTimerScope lazy_time_scope(
-      isolate->counters()->wasm_lazy_compilation_time());
-
-  // Find the wasm frame which triggered the lazy compile, to get the wasm
-  // instance.
-  StackFrameIterator it(isolate);
-  // First frame: C entry stub.
-  DCHECK(!it.done());
-  DCHECK_EQ(StackFrame::EXIT, it.frame()->type());
-  it.Advance();
-  // Second frame: WasmCompileLazy builtin.
-  DCHECK(!it.done());
-  Handle<Code> lazy_compile_code(it.frame()->LookupCode(), isolate);
-  DCHECK_EQ(Builtins::kWasmCompileLazy, lazy_compile_code->builtin_index());
-  Handle<WasmInstanceObject> instance;
-  Handle<FixedArray> exp_deopt_data;
-  int func_index = -1;
-  // If the lazy compile stub has deopt data, use that to determine the
-  // instance and function index. Otherwise this must be a wasm->wasm call
-  // within one instance, so extract the information from the caller.
-  if (lazy_compile_code->deoptimization_data()->length() > 0) {
-    exp_deopt_data = handle(lazy_compile_code->deoptimization_data(), isolate);
-    auto func_info = GetWasmFunctionInfo(isolate, lazy_compile_code);
-    instance = func_info.instance.ToHandleChecked();
-    func_index = func_info.func_index;
-  }
-  it.Advance();
-  // Third frame: The calling wasm code or js-to-wasm wrapper.
-  DCHECK(!it.done());
-  DCHECK(it.frame()->is_js_to_wasm() || it.frame()->is_wasm_compiled());
-  Handle<Code> caller_code = handle(it.frame()->LookupCode(), isolate);
-  if (it.frame()->is_js_to_wasm()) {
-    DCHECK(!instance.is_null());
-  } else if (instance.is_null()) {
-    // Then this is a direct call (otherwise we would have attached the instance
-    // via deopt data to the lazy compile stub). Just use the instance of the
-    // caller.
-    instance =
-        handle(WasmInstanceObject::GetOwningInstanceGC(*caller_code), isolate);
-  }
-  int offset =
-      static_cast<int>(it.frame()->pc() - caller_code->instruction_start());
-  // Only patch the caller code if this is *no* indirect call.
-  // exp_deopt_data will be null if the called function is not exported at all,
-  // and its length will be <= 2 if all entries in tables were already patched.
-  // Note that this check is conservative: If the first call to an exported
-  // function is direct, we will just patch the export tables, and only on the
-  // second call we will patch the caller.
-  bool patch_caller = caller_code->kind() == Code::JS_TO_WASM_FUNCTION ||
-                      exp_deopt_data.is_null() || exp_deopt_data->length() <= 2;
-
-  wasm::LazyCompilationOrchestrator* orchestrator =
-      Managed<wasm::LazyCompilationOrchestrator>::cast(
-          instance->compiled_module()
-              ->shared()
-              ->lazy_compilation_orchestrator())
-          ->get();
-  DCHECK(!orchestrator->IsFrozenForTesting());
-
-  Handle<Code> compiled_code = orchestrator->CompileLazyOnGCHeap(
-      isolate, instance, caller_code, offset, func_index, patch_caller);
-  if (!exp_deopt_data.is_null() && exp_deopt_data->length() > 2) {
-    TRACE_LAZY("Patching %d position(s) in function tables.\n",
-               (exp_deopt_data->length() - 2) / 2);
-    // See EnsureExportedLazyDeoptData: exp_deopt_data[2...(len-1)] are pairs of
-    // <export_table, index> followed by undefined values.
-    // Use this information here to patch all export tables.
-    DCHECK_EQ(0, exp_deopt_data->length() % 2);
-    for (int idx = 2, end = exp_deopt_data->length(); idx < end; idx += 2) {
-      if (exp_deopt_data->get(idx)->IsUndefined(isolate)) break;
-      FixedArray* exp_table = FixedArray::cast(exp_deopt_data->get(idx));
-      int exp_index = Smi::ToInt(exp_deopt_data->get(idx + 1));
-      int table_index = compiler::FunctionTableCodeOffset(exp_index);
-      DCHECK(exp_table->get(table_index) == *lazy_compile_code);
-      exp_table->set(table_index, *compiled_code);
-    }
-    // TODO(6792): No longer needed once WebAssembly code is off heap.
-    CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
-    // After processing, remove the list of exported entries, such that we don't
-    // do the patching redundantly.
-    Handle<FixedArray> new_deopt_data =
-        isolate->factory()->CopyFixedArrayUpTo(exp_deopt_data, 2, TENURED);
-    lazy_compile_code->set_deoptimization_data(*new_deopt_data);
+  InstanceBuilder builder(isolate, thrower, module_object, imports, memory);
+  auto instance = builder.Build();
+  if (!instance.is_null() && builder.ExecuteStartFunction()) {
+    return instance;
   }
-
-  return compiled_code;
+  return {};
 }
 
 Address CompileLazy(Isolate* isolate) {
@@ -775,9 +428,10 @@ Address CompileLazy(Isolate* isolate) {
   DCHECK_EQ(wasm::WasmCode::kLazyStub, lazy_stub_or_copy->kind());
   if (!lazy_stub_or_copy->IsAnonymous()) {
     // Then it's an indirect call or via JS->wasm wrapper.
-    instance =
-        handle(lazy_stub_or_copy->owner()->compiled_module()->owning_instance(),
-               isolate);
+    instance = handle(lazy_stub_or_copy->native_module()
+                          ->compiled_module()
+                          ->owning_instance(),
+                      isolate);
     func_index_to_compile = Just(lazy_stub_or_copy->index());
     exp_deopt_data_entry =
         handle(instance->compiled_module()->lazy_compile_data()->get(
@@ -804,9 +458,10 @@ Address CompileLazy(Isolate* isolate) {
       // Then this is a direct call (otherwise we would have attached the
       // instance via deopt data to the lazy compile stub). Just use the
       // instance of the caller.
-      instance = handle(
-          wasm_caller_code->owner()->compiled_module()->owning_instance(),
-          isolate);
+      instance = handle(wasm_caller_code->native_module()
+                            ->compiled_module()
+                            ->owning_instance(),
+                        isolate);
     }
   }
 
@@ -854,18 +509,16 @@ Address CompileLazy(Isolate* isolate) {
     // See EnsureExportedLazyDeoptData: exp_deopt_data[0...(len-1)] are pairs
     // of <export_table, index> followed by undefined values. Use this
     // information here to patch all export tables.
-    Handle<Foreign> foreign_holder =
-        isolate->factory()->NewForeign(result->instructions().start(), TENURED);
+    Address target = result->instructions().start();
     for (int idx = 0, end = exp_deopt_data->length(); idx < end; idx += 2) {
       if (exp_deopt_data->get(idx)->IsUndefined(isolate)) break;
       DisallowHeapAllocation no_gc;
       int exp_index = Smi::ToInt(exp_deopt_data->get(idx + 1));
-      FixedArray* exp_table = FixedArray::cast(exp_deopt_data->get(idx));
-      exp_table->set(compiler::FunctionTableCodeOffset(exp_index),
-                     *foreign_holder);
+
+      // TODO(titzer): patching of function tables for lazy compilation
+      // only works for a single instance.
+      instance->wasm_context()->get()->table[exp_index].target = target;
     }
-    // TODO(6792): No longer needed once WebAssembly code is off heap.
-    CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
     // After processing, remove the list of exported entries, such that we don't
     // do the patching redundantly.
     compiled_module->lazy_compile_data()->set(
@@ -879,28 +532,7 @@ compiler::ModuleEnv CreateModuleEnvFromCompiledModule(
     Isolate* isolate, Handle<WasmCompiledModule> compiled_module) {
   DisallowHeapAllocation no_gc;
   WasmModule* module = compiled_module->shared()->module();
-  if (FLAG_wasm_jit_to_native) {
-    NativeModule* native_module = compiled_module->GetNativeModule();
-    compiler::ModuleEnv result(module, native_module->function_tables(),
-                               std::vector<Handle<Code>>{},
-                               BUILTIN_CODE(isolate, WasmCompileLazy),
-                               compiled_module->use_trap_handler());
-    return result;
-  }
-
-  std::vector<GlobalHandleAddress> function_tables;
-
-  int num_function_tables = static_cast<int>(module->function_tables.size());
-  FixedArray* ft =
-      num_function_tables == 0 ? nullptr : compiled_module->function_tables();
-  for (int i = 0; i < num_function_tables; ++i) {
-    // TODO(clemensh): defer these handles for concurrent compilation.
-    function_tables.push_back(WasmCompiledModule::GetTableValue(ft, i));
-  }
-
-  compiler::ModuleEnv result(module, std::move(function_tables),
-                             std::vector<Handle<Code>>{},
-                             BUILTIN_CODE(isolate, WasmCompileLazy),
+  compiler::ModuleEnv result(module, std::vector<Address>{},
                              compiled_module->use_trap_handler());
   return result;
 }
@@ -911,20 +543,26 @@ const wasm::WasmCode* LazyCompilationOrchestrator::CompileFunction(
   compilation_timer.Start();
   Handle<WasmCompiledModule> compiled_module(instance->compiled_module(),
                                              isolate);
-  if (FLAG_wasm_jit_to_native) {
-    wasm::WasmCode* existing_code = compiled_module->GetNativeModule()->GetCode(
-        static_cast<uint32_t>(func_index));
-    if (existing_code != nullptr &&
-        existing_code->kind() == wasm::WasmCode::kFunction) {
-      TRACE_LAZY("Function %d already compiled.\n", func_index);
-      return existing_code;
-    }
-  } else {
-    if (Code::cast(compiled_module->code_table()->get(func_index))->kind() ==
-        Code::WASM_FUNCTION) {
-      TRACE_LAZY("Function %d already compiled.\n", func_index);
-      return nullptr;
-    }
+
+  // TODO(wasm): Refactor this to only get the name if it is really needed for
+  // tracing / debugging.
+  std::string func_name;
+  {
+    WasmName name = Vector<const char>::cast(
+        compiled_module->shared()->GetRawFunctionName(func_index));
+    // Copy to std::string, because the underlying string object might move on
+    // the heap.
+    func_name.assign(name.start(), static_cast<size_t>(name.length()));
+  }
+
+  TRACE_LAZY("Compiling function %s, %d.\n", func_name.c_str(), func_index);
+
+  wasm::WasmCode* existing_code = compiled_module->GetNativeModule()->GetCode(
+      static_cast<uint32_t>(func_index));
+  if (existing_code != nullptr &&
+      existing_code->kind() == wasm::WasmCode::kFunction) {
+    TRACE_LAZY("Function %d already compiled.\n", func_index);
+    return existing_code;
   }
 
   compiler::ModuleEnv module_env =
@@ -937,25 +575,16 @@ const wasm::WasmCode* LazyCompilationOrchestrator::CompileFunction(
   FunctionBody body{func->sig, func->code.offset(),
                     module_start + func->code.offset(),
                     module_start + func->code.end_offset()};
-  // TODO(wasm): Refactor this to only get the name if it is really needed for
-  // tracing / debugging.
-  std::string func_name;
-  {
-    WasmName name = Vector<const char>::cast(
-        compiled_module->shared()->GetRawFunctionName(func_index));
-    // Copy to std::string, because the underlying string object might move on
-    // the heap.
-    func_name.assign(name.start(), static_cast<size_t>(name.length()));
-  }
+
   ErrorThrower thrower(isolate, "WasmLazyCompile");
   compiler::WasmCompilationUnit unit(isolate, &module_env,
                                      compiled_module->GetNativeModule(), body,
                                      CStrVector(func_name.c_str()), func_index,
                                      CEntryStub(isolate, 1).GetCode());
   unit.ExecuteCompilation();
-  // TODO(6792): No longer needed once WebAssembly code is off heap.
-  CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
-  WasmCodeWrapper code_wrapper = unit.FinishCompilation(&thrower);
+  wasm::WasmCode* wasm_code = unit.FinishCompilation(&thrower);
+
+  if (wasm::WasmCode::ShouldBeLogged(isolate)) wasm_code->LogCode(isolate);
 
   // If there is a pending error, something really went wrong. The module was
   // verified before starting execution with lazy compilation.
@@ -963,23 +592,12 @@ const wasm::WasmCode* LazyCompilationOrchestrator::CompileFunction(
   // TODO(clemensh): According to the spec, we can actually skip validation at
   // module creation time, and return a function that always traps here.
   CHECK(!thrower.error());
-  // Now specialize the generated code for this instance.
 
-  // {code} is used only when !FLAG_wasm_jit_to_native, so it may be removed
-  // when that flag is removed.
-  Handle<Code> code;
-  if (code_wrapper.IsCodeObject()) {
-    code = code_wrapper.GetCode();
-    AttachWasmFunctionInfo(isolate, code, instance, func_index);
-    DCHECK_EQ(Builtins::kWasmCompileLazy,
-              Code::cast(compiled_module->code_table()->get(func_index))
-                  ->builtin_index());
-    compiled_module->code_table()->set(func_index, *code);
-  }
+  // Now specialize the generated code for this instance.
   Zone specialization_zone(isolate->allocator(), ZONE_NAME);
   CodeSpecialization code_specialization(isolate, &specialization_zone);
-  code_specialization.RelocateDirectCalls(instance);
-  code_specialization.ApplyToWasmCode(code_wrapper, SKIP_ICACHE_FLUSH);
+  code_specialization.RelocateDirectCalls(compiled_module->GetNativeModule());
+  code_specialization.ApplyToWasmCode(wasm_code, SKIP_ICACHE_FLUSH);
   int64_t func_size =
       static_cast<int64_t>(func->code.end_offset() - func->code.offset());
   int64_t compilation_time = compilation_timer.Elapsed().InMicroseconds();
@@ -987,25 +605,17 @@ const wasm::WasmCode* LazyCompilationOrchestrator::CompileFunction(
   auto counters = isolate->counters();
   counters->wasm_lazily_compiled_functions()->Increment();
 
-  if (!code_wrapper.IsCodeObject()) {
-    const wasm::WasmCode* wasm_code = code_wrapper.GetWasmCode();
-    Assembler::FlushICache(isolate, wasm_code->instructions().start(),
-                           wasm_code->instructions().size());
-    counters->wasm_generated_code_size()->Increment(
-        static_cast<int>(wasm_code->instructions().size()));
-    counters->wasm_reloc_size()->Increment(
-        static_cast<int>(wasm_code->reloc_info().size()));
+  Assembler::FlushICache(wasm_code->instructions().start(),
+                         wasm_code->instructions().size());
+  counters->wasm_generated_code_size()->Increment(
+      static_cast<int>(wasm_code->instructions().size()));
+  counters->wasm_reloc_size()->Increment(
+      static_cast<int>(wasm_code->reloc_info().size()));
 
-  } else {
-    Assembler::FlushICache(isolate, code->instruction_start(),
-                           code->instruction_size());
-    counters->wasm_generated_code_size()->Increment(code->body_size());
-    counters->wasm_reloc_size()->Increment(code->relocation_info()->length());
-  }
   counters->wasm_lazy_compilation_throughput()->AddSample(
       compilation_time != 0 ? static_cast<int>(func_size / compilation_time)
                             : 0);
-  return !code_wrapper.IsCodeObject() ? code_wrapper.GetWasmCode() : nullptr;
+  return wasm_code;
 }
 
 namespace {
@@ -1021,19 +631,6 @@ int AdvanceSourcePositionTableIterator(SourcePositionTableIterator& iterator,
   return byte_pos;
 }
 
-Code* ExtractWasmToWasmCallee(Code* wasm_to_wasm) {
-  DCHECK_EQ(Code::WASM_TO_WASM_FUNCTION, wasm_to_wasm->kind());
-  // Find the one code target in this wrapper.
-  RelocIterator it(wasm_to_wasm, RelocInfo::kCodeTargetMask);
-  DCHECK(!it.done());
-  Code* callee = Code::GetCodeFromTargetAddress(it.rinfo()->target_address());
-#ifdef DEBUG
-  it.next();
-  DCHECK(it.done());
-#endif
-  return callee;
-}
-
 const WasmCode* WasmExtractWasmToWasmCallee(const WasmCodeManager* code_manager,
                                             const WasmCode* wasm_to_wasm) {
   DCHECK_EQ(WasmCode::kWasmToWasmWrapper, wasm_to_wasm->kind());
@@ -1057,186 +654,23 @@ const WasmCode* WasmExtractWasmToWasmCallee(const WasmCodeManager* code_manager,
   do {                                                                         \
     TRACE_LAZY("Patching wasm-to-wasm wrapper.\n");                            \
     DCHECK_EQ(WasmCode::kWasmToWasmWrapper, wasm_to_wasm->kind());             \
-    NativeModuleModificationScope scope(wasm_to_wasm->owner());                \
+    NativeModuleModificationScope scope(wasm_to_wasm->native_module());        \
     RelocIterator it(wasm_to_wasm->instructions(), wasm_to_wasm->reloc_info(), \
                      wasm_to_wasm->constant_pool(),                            \
                      RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL));         \
     DCHECK(!it.done());                                                        \
-    it.rinfo()->set_js_to_wasm_address(isolate,                                \
-                                       new_target->instructions().start());    \
+    DCHECK_EQ(WasmCode::kLazyStub,                                             \
+              isolate->wasm_engine()                                           \
+                  ->code_manager()                                             \
+                  ->GetCodeFromStartAddress(it.rinfo()->js_to_wasm_address())  \
+                  ->kind());                                                   \
+    it.rinfo()->set_js_to_wasm_address(new_target->instructions().start());    \
     it.next();                                                                 \
     DCHECK(it.done());                                                         \
   } while (0)
 
-void PatchWasmToWasmWrapper(Isolate* isolate, Code* wasm_to_wasm,
-                            Code* new_target) {
-  DCHECK_EQ(Code::WASM_TO_WASM_FUNCTION, wasm_to_wasm->kind());
-  // Find the one code target in this wrapper.
-  RelocIterator it(wasm_to_wasm, RelocInfo::kCodeTargetMask);
-  DCHECK(!it.done());
-  DCHECK_EQ(Builtins::kWasmCompileLazy,
-            Code::GetCodeFromTargetAddress(it.rinfo()->target_address())
-                ->builtin_index());
-  it.rinfo()->set_target_address(isolate, new_target->instruction_start());
-#ifdef DEBUG
-  it.next();
-  DCHECK(it.done());
-#endif
-}
-
 }  // namespace
 
-Handle<Code> LazyCompilationOrchestrator::CompileLazyOnGCHeap(
-    Isolate* isolate, Handle<WasmInstanceObject> instance, Handle<Code> caller,
-    int call_offset, int exported_func_index, bool patch_caller) {
-  struct NonCompiledFunction {
-    int offset;
-    int func_index;
-  };
-  std::vector<NonCompiledFunction> non_compiled_functions;
-  int func_to_return_idx = exported_func_index;
-  Decoder decoder(nullptr, nullptr);
-  bool is_js_to_wasm = caller->kind() == Code::JS_TO_WASM_FUNCTION;
-  Handle<WasmCompiledModule> compiled_module(instance->compiled_module(),
-                                             isolate);
-
-  TRACE_LAZY(
-      "Starting lazy compilation (func %d @%d, js-to-wasm: %d, "
-      "patch caller: %d).\n",
-      exported_func_index, call_offset, is_js_to_wasm, patch_caller);
-
-  // If this lazy compile stub is being called through a wasm-to-wasm wrapper,
-  // remember that code object.
-  Handle<Code> wasm_to_wasm_callee;
-
-  // For js-to-wasm wrappers, don't iterate the reloc info. There is just one
-  // call site in there anyway.
-  if (patch_caller && !is_js_to_wasm) {
-    DisallowHeapAllocation no_gc;
-    SourcePositionTableIterator source_pos_iterator(
-        caller->SourcePositionTable());
-    auto caller_func_info = GetWasmFunctionInfo(isolate, caller);
-    Handle<WasmCompiledModule> caller_module(
-        caller_func_info.instance.ToHandleChecked()->compiled_module(),
-        isolate);
-    SeqOneByteString* module_bytes = caller_module->shared()->module_bytes();
-    const byte* func_bytes =
-        module_bytes->GetChars() + caller_module->shared()
-                                       ->module()
-                                       ->functions[caller_func_info.func_index]
-                                       .code.offset();
-    Code* lazy_callee = nullptr;
-    for (RelocIterator it(*caller, RelocInfo::kCodeTargetMask); !it.done();
-         it.next()) {
-      Code* callee =
-          Code::GetCodeFromTargetAddress(it.rinfo()->target_address());
-      // TODO(clemensh): Introduce safe_cast<T, bool> which (D)CHECKS
-      // (depending on the bool) against limits of T and then static_casts.
-      size_t offset_l = it.rinfo()->pc() - caller->instruction_start();
-      DCHECK_GE(kMaxInt, offset_l);
-      int offset = static_cast<int>(offset_l);
-      // Call offset points to the instruction after the call. Remember the last
-      // called code object before that offset.
-      if (offset < call_offset) lazy_callee = callee;
-      if (callee->builtin_index() != Builtins::kWasmCompileLazy) continue;
-      int byte_pos =
-          AdvanceSourcePositionTableIterator(source_pos_iterator, offset);
-      int called_func_index =
-          ExtractDirectCallIndex(decoder, func_bytes + byte_pos);
-      non_compiled_functions.push_back({offset, called_func_index});
-      if (offset < call_offset) func_to_return_idx = called_func_index;
-    }
-    TRACE_LAZY("Found %zu non-compiled functions in caller.\n",
-               non_compiled_functions.size());
-    DCHECK_NOT_NULL(lazy_callee);
-    if (lazy_callee->kind() == Code::WASM_TO_WASM_FUNCTION) {
-      TRACE_LAZY("Callee is a wasm-to-wasm.\n");
-      wasm_to_wasm_callee = handle(lazy_callee, isolate);
-      // If we call a wasm-to-wasm wrapper, then this wrapper actually
-      // tail-called the lazy compile stub. Find it in the wrapper.
-      lazy_callee = ExtractWasmToWasmCallee(lazy_callee);
-      // This lazy compile stub belongs to the instance that was passed.
-      DCHECK_EQ(*instance,
-                *GetWasmFunctionInfo(isolate, handle(lazy_callee, isolate))
-                     .instance.ToHandleChecked());
-      DCHECK_LE(2, lazy_callee->deoptimization_data()->length());
-      func_to_return_idx =
-          Smi::ToInt(lazy_callee->deoptimization_data()->get(1));
-    }
-    DCHECK_EQ(Builtins::kWasmCompileLazy, lazy_callee->builtin_index());
-    // There must be at least one call to patch (the one that lead to calling
-    // the lazy compile stub).
-    DCHECK(!non_compiled_functions.empty() || !wasm_to_wasm_callee.is_null());
-  }
-
-  TRACE_LAZY("Compiling function %d.\n", func_to_return_idx);
-
-  // TODO(clemensh): compile all functions in non_compiled_functions in
-  // background, wait for func_to_return_idx.
-  CompileFunction(isolate, instance, func_to_return_idx);
-
-  Handle<Code> compiled_function(
-      Code::cast(compiled_module->code_table()->get(func_to_return_idx)),
-      isolate);
-  DCHECK_EQ(Code::WASM_FUNCTION, compiled_function->kind());
-
-  if (patch_caller || is_js_to_wasm) {
-    DisallowHeapAllocation no_gc;
-    // TODO(6792): No longer needed once WebAssembly code is off heap.
-    CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
-    // Now patch the code object with all functions which are now compiled.
-    int idx = 0;
-    int patched = 0;
-    for (RelocIterator it(*caller, RelocInfo::kCodeTargetMask); !it.done();
-         it.next()) {
-      Code* callee =
-          Code::GetCodeFromTargetAddress(it.rinfo()->target_address());
-      if (callee->builtin_index() != Builtins::kWasmCompileLazy) {
-        // If the callee is the wasm-to-wasm wrapper triggering this lazy
-        // compilation, patch it. If is_js_to_wasm is set, we did not set the
-        // wasm_to_wasm_callee, so just check the code kind (this is the only
-        // call in that wrapper anyway).
-        if ((is_js_to_wasm && callee->kind() == Code::WASM_TO_WASM_FUNCTION) ||
-            (!wasm_to_wasm_callee.is_null() &&
-             callee == *wasm_to_wasm_callee)) {
-          TRACE_LAZY("Patching wasm-to-wasm wrapper.\n");
-          PatchWasmToWasmWrapper(isolate, callee, *compiled_function);
-          ++patched;
-        }
-        continue;
-      }
-      int called_func_index = func_to_return_idx;
-      if (!is_js_to_wasm) {
-        DCHECK_GT(non_compiled_functions.size(), idx);
-        called_func_index = non_compiled_functions[idx].func_index;
-        DCHECK_EQ(non_compiled_functions[idx].offset,
-                  it.rinfo()->pc() - caller->instruction_start());
-        ++idx;
-      }
-      // Check that the callee agrees with our assumed called_func_index.
-      DCHECK_IMPLIES(callee->deoptimization_data()->length() > 0,
-                     Smi::ToInt(callee->deoptimization_data()->get(1)) ==
-                         called_func_index);
-      Handle<Code> callee_compiled(
-          Code::cast(compiled_module->code_table()->get(called_func_index)));
-      if (callee_compiled->builtin_index() == Builtins::kWasmCompileLazy) {
-        DCHECK_NE(func_to_return_idx, called_func_index);
-        continue;
-      }
-      DCHECK_EQ(Code::WASM_FUNCTION, callee_compiled->kind());
-      it.rinfo()->set_target_address(isolate,
-                                     callee_compiled->instruction_start());
-      ++patched;
-    }
-    DCHECK_EQ(non_compiled_functions.size(), idx);
-    TRACE_LAZY("Patched %d location(s) in the caller.\n", patched);
-    DCHECK_LT(0, patched);
-    USE(patched);
-  }
-
-  return compiled_function;
-}
-
 const wasm::WasmCode* LazyCompilationOrchestrator::CompileFromJsToWasm(
     Isolate* isolate, Handle<WasmInstanceObject> instance,
     Handle<Code> js_to_wasm_caller, uint32_t exported_func_index) {
@@ -1251,6 +685,7 @@ const wasm::WasmCode* LazyCompilationOrchestrator::CompileFromJsToWasm(
   CompileFunction(isolate, instance, exported_func_index);
   {
     DisallowHeapAllocation no_gc;
+    int patched = 0;
     CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
     RelocIterator it(*js_to_wasm_caller,
                      RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL));
@@ -1263,10 +698,21 @@ const wasm::WasmCode* LazyCompilationOrchestrator::CompileFromJsToWasm(
     DCHECK_NOT_NULL(callee_compiled);
     if (current_callee->kind() == WasmCode::kWasmToWasmWrapper) {
       WasmPatchWasmToWasmWrapper(isolate, current_callee, callee_compiled);
+      ++patched;
     } else {
+      DCHECK_EQ(WasmCode::kLazyStub,
+                isolate->wasm_engine()
+                    ->code_manager()
+                    ->GetCodeFromStartAddress(it.rinfo()->js_to_wasm_address())
+                    ->kind());
       it.rinfo()->set_js_to_wasm_address(
-          isolate, callee_compiled->instructions().start());
+          callee_compiled->instructions().start());
+      ++patched;
     }
+    DCHECK_LT(0, patched);
+    TRACE_LAZY("Patched %d location(s) in the caller.\n", patched);
+    USE(patched);
+
 #ifdef DEBUG
     it.next();
     DCHECK(it.done());
@@ -1301,18 +747,18 @@ const wasm::WasmCode* LazyCompilationOrchestrator::CompileDirectCall(
   {
     DisallowHeapAllocation no_gc;
     Handle<WasmCompiledModule> caller_module(
-        wasm_caller->owner()->compiled_module(), isolate);
+        wasm_caller->native_module()->compiled_module(), isolate);
     SeqOneByteString* module_bytes = caller_module->shared()->module_bytes();
     uint32_t caller_func_index = wasm_caller->index();
     SourcePositionTableIterator source_pos_iterator(
-        Handle<ByteArray>(ByteArray::cast(
-            caller_module->source_positions()->get(caller_func_index))));
+        wasm_caller->source_positions());
 
     const byte* func_bytes =
         module_bytes->GetChars() + caller_module->shared()
                                        ->module()
                                        ->functions[caller_func_index]
                                        .code.offset();
+    int num_non_compiled_functions = 0;
     for (RelocIterator it(wasm_caller->instructions(),
                           wasm_caller->reloc_info(),
                           wasm_caller->constant_pool(),
@@ -1333,6 +779,8 @@ const wasm::WasmCode* LazyCompilationOrchestrator::CompileDirectCall(
         non_compiled_functions.push_back(Nothing<uint32_t>());
         continue;
       }
+      ++num_non_compiled_functions;
+
       uint32_t called_func_index =
           ExtractDirectCallIndex(decoder, func_bytes + byte_pos);
       DCHECK_LT(called_func_index,
@@ -1344,6 +792,10 @@ const wasm::WasmCode* LazyCompilationOrchestrator::CompileDirectCall(
         maybe_func_to_return_idx = Just(called_func_index);
       }
     }
+
+    TRACE_LAZY("Found %d non-compiled functions in caller.\n",
+               num_non_compiled_functions);
+    USE(num_non_compiled_functions);
   }
   uint32_t func_to_return_idx = 0;
 
@@ -1365,10 +817,12 @@ const wasm::WasmCode* LazyCompilationOrchestrator::CompileDirectCall(
   const WasmCode* ret = CompileFunction(isolate, instance, func_to_return_idx);
   DCHECK_NOT_NULL(ret);
 
+  int patched = 0;
   if (last_callee->kind() == WasmCode::kWasmToWasmWrapper) {
     // We can finish it all here by compiling the target wasm function and
     // patching the wasm_to_wasm caller.
     WasmPatchWasmToWasmWrapper(isolate, last_callee, ret);
+    ++patched;
   } else {
     Handle<WasmCompiledModule> compiled_module(instance->compiled_module(),
                                                isolate);
@@ -1376,7 +830,6 @@ const wasm::WasmCode* LazyCompilationOrchestrator::CompileDirectCall(
     // Now patch the code object with all functions which are now compiled. This
     // will pick up any other compiled functions, not only {ret}.
     size_t idx = 0;
-    size_t patched = 0;
     for (RelocIterator
              it(wasm_caller->instructions(), wasm_caller->reloc_info(),
                 wasm_caller->constant_pool(),
@@ -1388,336 +841,45 @@ const wasm::WasmCode* LazyCompilationOrchestrator::CompileDirectCall(
       const WasmCode* callee_compiled =
           compiled_module->GetNativeModule()->GetCode(lookup);
       if (callee_compiled->kind() != WasmCode::kFunction) continue;
+      DCHECK_EQ(WasmCode::kLazyStub,
+                isolate->wasm_engine()
+                    ->code_manager()
+                    ->GetCodeFromStartAddress(it.rinfo()->wasm_call_address())
+                    ->kind());
       it.rinfo()->set_wasm_call_address(
-          isolate, callee_compiled->instructions().start());
+          callee_compiled->instructions().start());
       ++patched;
     }
     DCHECK_EQ(non_compiled_functions.size(), idx);
-    TRACE_LAZY("Patched %zu location(s) in the caller.\n", patched);
   }
-  return ret;
-}
 
-ModuleCompiler::CodeGenerationSchedule::CodeGenerationSchedule(
-    base::RandomNumberGenerator* random_number_generator, size_t max_memory)
-    : random_number_generator_(random_number_generator),
-      max_memory_(max_memory) {
-  DCHECK_NOT_NULL(random_number_generator_);
-  DCHECK_GT(max_memory_, 0);
-}
+  DCHECK_LT(0, patched);
+  TRACE_LAZY("Patched %d location(s) in the caller.\n", patched);
+  USE(patched);
 
-void ModuleCompiler::CodeGenerationSchedule::Schedule(
-    std::unique_ptr<compiler::WasmCompilationUnit>&& item) {
-  size_t cost = item->memory_cost();
-  schedule_.push_back(std::move(item));
-  allocated_memory_.Increment(cost);
-}
-
-bool ModuleCompiler::CodeGenerationSchedule::CanAcceptWork() const {
-  return (!throttle_ || allocated_memory_.Value() <= max_memory_);
-}
-
-bool ModuleCompiler::CodeGenerationSchedule::ShouldIncreaseWorkload() const {
-  // Half the memory is unused again, we can increase the workload again.
-  return (!throttle_ || allocated_memory_.Value() <= max_memory_ / 2);
-}
-
-std::unique_ptr<compiler::WasmCompilationUnit>
-ModuleCompiler::CodeGenerationSchedule::GetNext() {
-  DCHECK(!IsEmpty());
-  size_t index = GetRandomIndexInSchedule();
-  auto ret = std::move(schedule_[index]);
-  std::swap(schedule_[schedule_.size() - 1], schedule_[index]);
-  schedule_.pop_back();
-  allocated_memory_.Decrement(ret->memory_cost());
   return ret;
 }
 
-size_t ModuleCompiler::CodeGenerationSchedule::GetRandomIndexInSchedule() {
-  double factor = random_number_generator_->NextDouble();
-  size_t index = (size_t)(factor * schedule_.size());
-  DCHECK_GE(index, 0);
-  DCHECK_LT(index, schedule_.size());
-  return index;
-}
-
-ModuleCompiler::ModuleCompiler(Isolate* isolate, WasmModule* module,
-                               Handle<Code> centry_stub,
-                               wasm::NativeModule* native_module)
-    : isolate_(isolate),
-      module_(module),
-      async_counters_(isolate->async_counters()),
-      executed_units_(
-          isolate->random_number_generator(),
-          (isolate->heap()->memory_allocator()->code_range()->valid()
-               ? isolate->heap()->memory_allocator()->code_range()->size()
-               : isolate->heap()->code_space()->Capacity()) /
-              2),
-      num_background_tasks_(
-          Min(static_cast<size_t>(FLAG_wasm_num_compilation_tasks),
-              V8::GetCurrentPlatform()->NumberOfAvailableBackgroundThreads())),
-      stopped_compilation_tasks_(num_background_tasks_),
-      centry_stub_(centry_stub),
-      native_module_(native_module) {}
-
-// The actual runnable task that performs compilations in the background.
-void ModuleCompiler::OnBackgroundTaskStopped() {
-  base::LockGuard<base::Mutex> guard(&tasks_mutex_);
-  ++stopped_compilation_tasks_;
-  DCHECK_LE(stopped_compilation_tasks_, num_background_tasks_);
-}
-
-// Run by each compilation task. The no_finisher_callback is called
-// within the result_mutex_ lock when no finishing task is running,
-// i.e. when the finisher_is_running_ flag is not set.
-bool ModuleCompiler::FetchAndExecuteCompilationUnit(
-    std::function<void()> no_finisher_callback) {
-  DisallowHeapAllocation no_allocation;
-  DisallowHandleAllocation no_handles;
-  DisallowHandleDereference no_deref;
-  DisallowCodeDependencyChange no_dependency_change;
-
-  std::unique_ptr<compiler::WasmCompilationUnit> unit;
-  {
-    base::LockGuard<base::Mutex> guard(&compilation_units_mutex_);
-    if (compilation_units_.empty()) return false;
-    unit = std::move(compilation_units_.back());
-    compilation_units_.pop_back();
-  }
-  unit->ExecuteCompilation();
-  {
-    base::LockGuard<base::Mutex> guard(&result_mutex_);
-    executed_units_.Schedule(std::move(unit));
-    if (no_finisher_callback != nullptr && !finisher_is_running_) {
-      no_finisher_callback();
-      // We set the flag here so that not more than one finisher is started.
-      finisher_is_running_ = true;
-    }
-  }
-  return true;
-}
-
-size_t ModuleCompiler::InitializeCompilationUnits(
-    const std::vector<WasmFunction>& functions,
-    const ModuleWireBytes& wire_bytes, compiler::ModuleEnv* module_env) {
-  uint32_t start = module_env->module->num_imported_functions +
-                   FLAG_skip_compiling_wasm_funcs;
-  uint32_t num_funcs = static_cast<uint32_t>(functions.size());
-  uint32_t funcs_to_compile = start > num_funcs ? 0 : num_funcs - start;
-  CompilationUnitBuilder builder(this);
-  for (uint32_t i = start; i < num_funcs; ++i) {
-    const WasmFunction* func = &functions[i];
-    uint32_t buffer_offset = func->code.offset();
-    Vector<const uint8_t> bytes(wire_bytes.start() + func->code.offset(),
-                                func->code.end_offset() - func->code.offset());
-    WasmName name = wire_bytes.GetName(func);
-    DCHECK_IMPLIES(FLAG_wasm_jit_to_native, native_module_ != nullptr);
-    builder.AddUnit(module_env, native_module_, func, buffer_offset, bytes,
-                    name);
-  }
-  builder.Commit();
-  return funcs_to_compile;
-}
-
-void ModuleCompiler::RestartCompilationTasks() {
-  v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate_);
-  std::shared_ptr<v8::TaskRunner> task_runner =
-      V8::GetCurrentPlatform()->GetBackgroundTaskRunner(v8_isolate);
-
-  base::LockGuard<base::Mutex> guard(&tasks_mutex_);
-  for (; stopped_compilation_tasks_ > 0; --stopped_compilation_tasks_) {
-    task_runner->PostTask(base::make_unique<CompilationTask>(this));
-  }
-}
-
-size_t ModuleCompiler::FinishCompilationUnits(
-    std::vector<Handle<Code>>& results, ErrorThrower* thrower) {
-  size_t finished = 0;
-  while (true) {
-    int func_index = -1;
-    WasmCodeWrapper result = FinishCompilationUnit(thrower, &func_index);
-    if (func_index < 0) break;
-    ++finished;
-    DCHECK_IMPLIES(result.is_null(), thrower->error());
-    if (result.is_null()) break;
-    if (result.IsCodeObject()) {
-      results[func_index] = result.GetCode();
-    }
-  }
-  bool do_restart;
-  {
-    base::LockGuard<base::Mutex> guard(&compilation_units_mutex_);
-    do_restart = !compilation_units_.empty();
-  }
-  if (do_restart) RestartCompilationTasks();
-  return finished;
-}
-
-void ModuleCompiler::SetFinisherIsRunning(bool value) {
-  base::LockGuard<base::Mutex> guard(&result_mutex_);
-  finisher_is_running_ = value;
-}
-
-WasmCodeWrapper ModuleCompiler::FinishCompilationUnit(ErrorThrower* thrower,
-                                                      int* func_index) {
-  std::unique_ptr<compiler::WasmCompilationUnit> unit;
-  {
-    base::LockGuard<base::Mutex> guard(&result_mutex_);
-    if (executed_units_.IsEmpty()) return {};
-    unit = executed_units_.GetNext();
-  }
-  *func_index = unit->func_index();
-  return unit->FinishCompilation(thrower);
-}
-
-void ModuleCompiler::CompileInParallel(const ModuleWireBytes& wire_bytes,
-                                       compiler::ModuleEnv* module_env,
-                                       std::vector<Handle<Code>>& results,
-                                       ErrorThrower* thrower) {
-  const WasmModule* module = module_env->module;
-  // Data structures for the parallel compilation.
-
-  //-----------------------------------------------------------------------
-  // For parallel compilation:
-  // 1) The main thread allocates a compilation unit for each wasm function
-  //    and stores them in the vector {compilation_units}.
-  // 2) The main thread spawns {CompilationTask} instances which run on
-  //    the background threads.
-  // 3.a) The background threads and the main thread pick one compilation
-  //      unit at a time and execute the parallel phase of the compilation
-  //      unit. After finishing the execution of the parallel phase, the
-  //      result is enqueued in {executed_units}.
-  // 3.b) If {executed_units} contains a compilation unit, the main thread
-  //      dequeues it and finishes the compilation.
-  // 4) After the parallel phase of all compilation units has started, the
-  //    main thread waits for all {CompilationTask} instances to finish.
-  // 5) The main thread finishes the compilation.
-
-  // Turn on the {CanonicalHandleScope} so that the background threads can
-  // use the node cache.
-  CanonicalHandleScope canonical(isolate_);
-
-  // 1) The main thread allocates a compilation unit for each wasm function
-  //    and stores them in the vector {compilation_units}.
-  InitializeCompilationUnits(module->functions, wire_bytes, module_env);
-  executed_units_.EnableThrottling();
-
-  // 2) The main thread spawns {CompilationTask} instances which run on
-  //    the background threads.
-  RestartCompilationTasks();
-
-  // 3.a) The background threads and the main thread pick one compilation
-  //      unit at a time and execute the parallel phase of the compilation
-  //      unit. After finishing the execution of the parallel phase, the
-  //      result is enqueued in {executed_units}.
-  //      The foreground task bypasses waiting on memory threshold, because
-  //      its results will immediately be converted to code (below).
-  while (FetchAndExecuteCompilationUnit()) {
-    // 3.b) If {executed_units} contains a compilation unit, the main thread
-    //      dequeues it and finishes the compilation unit. Compilation units
-    //      are finished concurrently to the background threads to save
-    //      memory.
-    FinishCompilationUnits(results, thrower);
-  }
-  // 4) After the parallel phase of all compilation units has started, the
-  //    main thread waits for all {CompilationTask} instances to finish - which
-  //    happens once they all realize there's no next work item to process.
-  background_task_manager_.CancelAndWait();
-  // Finish all compilation units which have been executed while we waited.
-  FinishCompilationUnits(results, thrower);
-}
-
-void ModuleCompiler::CompileSequentially(const ModuleWireBytes& wire_bytes,
-                                         compiler::ModuleEnv* module_env,
-                                         std::vector<Handle<Code>>& results,
-                                         ErrorThrower* thrower) {
-  DCHECK(!thrower->error());
-
-  const WasmModule* module = module_env->module;
-  for (uint32_t i = FLAG_skip_compiling_wasm_funcs;
-       i < module->functions.size(); ++i) {
-    const WasmFunction& func = module->functions[i];
-    if (func.imported) continue;  // Imports are compiled at instantiation time.
-
-    // Compile the function.
-    WasmCodeWrapper code = compiler::WasmCompilationUnit::CompileWasmFunction(
-        native_module_, thrower, isolate_, wire_bytes, module_env, &func);
-    if (code.is_null()) {
-      TruncatedUserString<> name(wire_bytes.GetName(&func));
-      thrower->CompileError("Compilation of #%d:%.*s failed.", i, name.length(),
-                            name.start());
-      break;
-    }
-    if (code.IsCodeObject()) {
-      results[i] = code.GetCode();
-    }
-  }
-}
-
-void ModuleCompiler::ValidateSequentially(const ModuleWireBytes& wire_bytes,
-                                          compiler::ModuleEnv* module_env,
-                                          ErrorThrower* thrower) {
-  DCHECK(!thrower->error());
-
-  const WasmModule* module = module_env->module;
-  for (uint32_t i = 0; i < module->functions.size(); ++i) {
-    const WasmFunction& func = module->functions[i];
-    if (func.imported) continue;
-
-    const byte* base = wire_bytes.start();
-    FunctionBody body{func.sig, func.code.offset(), base + func.code.offset(),
-                      base + func.code.end_offset()};
-    DecodeResult result = VerifyWasmCodeWithStats(
-        isolate_->allocator(), module, body, module->is_wasm(), counters());
-    if (result.failed()) {
-      TruncatedUserString<> name(wire_bytes.GetName(&func));
-      thrower->CompileError("Compiling function #%d:%.*s failed: %s @+%u", i,
-                            name.length(), name.start(),
-                            result.error_msg().c_str(), result.error_offset());
-      break;
-    }
-  }
-}
-
-// static
-MaybeHandle<WasmModuleObject> ModuleCompiler::CompileToModuleObject(
-    Isolate* isolate, ErrorThrower* thrower, std::unique_ptr<WasmModule> module,
-    const ModuleWireBytes& wire_bytes, Handle<Script> asm_js_script,
-    Vector<const byte> asm_js_offset_table_bytes) {
-  Handle<Code> centry_stub = CEntryStub(isolate, 1).GetCode();
-  // TODO(mtrofin): the wasm::NativeModule parameter to the ModuleCompiler
-  // constructor is null here, and initialized in CompileToModuleObjectInternal.
-  // This is a point-in-time, until we remove the FLAG_wasm_jit_to_native flag,
-  // and stop needing a FixedArray for code for the non-native case. Otherwise,
-  // we end up moving quite a bit of initialization logic here that is also
-  // needed in CompileToModuleObjectInternal, complicating the change.
-  ModuleCompiler compiler(isolate, module.get(), centry_stub, nullptr);
-  return compiler.CompileToModuleObjectInternal(thrower, std::move(module),
-                                                wire_bytes, asm_js_script,
-                                                asm_js_offset_table_bytes);
-}
-
 namespace {
 bool compile_lazy(const WasmModule* module) {
   return FLAG_wasm_lazy_compilation ||
          (FLAG_asm_wasm_lazy_compilation && module->is_asm_js());
 }
 
-void FlushICache(Isolate* isolate, const wasm::NativeModule* native_module) {
+void FlushICache(const wasm::NativeModule* native_module) {
   for (uint32_t i = 0, e = native_module->FunctionCount(); i < e; ++i) {
     const wasm::WasmCode* code = native_module->GetCode(i);
     if (code == nullptr) continue;
-    Assembler::FlushICache(isolate, code->instructions().start(),
+    Assembler::FlushICache(code->instructions().start(),
                            code->instructions().size());
   }
 }
 
-void FlushICache(Isolate* isolate, Handle<FixedArray> functions) {
+void FlushICache(Handle<FixedArray> functions) {
   for (int i = 0, e = functions->length(); i < e; ++i) {
     if (!functions->get(i)->IsCode()) continue;
     Code* code = Code::cast(functions->get(i));
-    Assembler::FlushICache(isolate, code->instruction_start(),
-                           code->instruction_size());
+    Assembler::FlushICache(code->instruction_start(), code->instruction_size());
   }
 }
 
@@ -1737,14 +899,6 @@ void RecordStats(const wasm::WasmCode* code, Counters* counters) {
       static_cast<int>(code->reloc_info().size()));
 }
 
-void RecordStats(WasmCodeWrapper wrapper, Counters* counters) {
-  if (wrapper.IsCodeObject()) {
-    RecordStats(*wrapper.GetCode(), counters);
-  } else {
-    RecordStats(wrapper.GetWasmCode(), counters);
-  }
-}
-
 void RecordStats(Handle<FixedArray> functions, Counters* counters) {
   DisallowHeapAllocation no_gc;
   for (int i = 0; i < functions->length(); ++i) {
@@ -1764,151 +918,65 @@ void RecordStats(const wasm::NativeModule* native_module, Counters* counters) {
 // deoptimization data attached. This is needed for lazy compile stubs which are
 // called from JS_TO_WASM functions or via exported function tables. The deopt
 // data is used to determine which function this lazy compile stub belongs to.
-// TODO(mtrofin): remove the instance and code_table members once we remove the
-// FLAG_wasm_jit_to_native
-WasmCodeWrapper EnsureExportedLazyDeoptData(Isolate* isolate,
-                                            Handle<WasmInstanceObject> instance,
-                                            Handle<FixedArray> code_table,
+wasm::WasmCode* EnsureExportedLazyDeoptData(Isolate* isolate,
                                             wasm::NativeModule* native_module,
                                             uint32_t func_index) {
-  if (!FLAG_wasm_jit_to_native) {
-    Handle<Code> code(Code::cast(code_table->get(func_index)), isolate);
-    if (code->builtin_index() != Builtins::kWasmCompileLazy) {
-      // No special deopt data needed for compiled functions, and imported
-      // functions, which map to Illegal at this point (they get compiled at
-      // instantiation time).
-      DCHECK(code->kind() == Code::WASM_FUNCTION ||
-             code->kind() == Code::WASM_TO_JS_FUNCTION ||
-             code->kind() == Code::WASM_TO_WASM_FUNCTION ||
-             code->builtin_index() == Builtins::kIllegal);
-      return WasmCodeWrapper(code);
-    }
-
-    // deopt_data:
-    //   #0: weak instance
-    //   #1: func_index
-    // might be extended later for table exports (see
-    // EnsureTableExportLazyDeoptData).
-    Handle<FixedArray> deopt_data(code->deoptimization_data());
-    DCHECK_EQ(0, deopt_data->length() % 2);
-    if (deopt_data->length() == 0) {
-      code = isolate->factory()->CopyCode(code);
-      code_table->set(func_index, *code);
-      AttachWasmFunctionInfo(isolate, code, instance, func_index);
-    }
-#ifdef DEBUG
-    auto func_info = GetWasmFunctionInfo(isolate, code);
-    DCHECK_IMPLIES(!instance.is_null(),
-                   *func_info.instance.ToHandleChecked() == *instance);
-    DCHECK_EQ(func_index, func_info.func_index);
-#endif
-    return WasmCodeWrapper(code);
-  } else {
-    wasm::WasmCode* code = native_module->GetCode(func_index);
-    // {code} will be nullptr when exporting imports.
-    if (code == nullptr || code->kind() != wasm::WasmCode::kLazyStub ||
-        !code->IsAnonymous()) {
-      return WasmCodeWrapper(code);
-    }
-    // Clone the lazy builtin into the native module.
-    return WasmCodeWrapper(native_module->CloneLazyBuiltinInto(func_index));
+  wasm::WasmCode* code = native_module->GetCode(func_index);
+  // {code} will be nullptr when exporting imports.
+  if (code == nullptr || code->kind() != wasm::WasmCode::kLazyStub ||
+      !code->IsAnonymous()) {
+    return code;
   }
+  // Clone the lazy builtin into the native module.
+  return native_module->CloneLazyBuiltinInto(code, func_index,
+                                             WasmCode::kFlushICache);
 }
 
 // Ensure that the code object in <code_table> at offset <func_index> has
 // deoptimization data attached. This is needed for lazy compile stubs which are
 // called from JS_TO_WASM functions or via exported function tables. The deopt
 // data is used to determine which function this lazy compile stub belongs to.
-// TODO(mtrofin): remove the instance and code_table members once we remove the
-// FLAG_wasm_jit_to_native
-WasmCodeWrapper EnsureTableExportLazyDeoptData(
-    Isolate* isolate, Handle<WasmInstanceObject> instance,
-    Handle<FixedArray> code_table, wasm::NativeModule* native_module,
-    uint32_t func_index, Handle<FixedArray> export_table, int export_index,
-    std::unordered_map<uint32_t, uint32_t>* table_export_count) {
-  if (!FLAG_wasm_jit_to_native) {
-    Handle<Code> code =
-        EnsureExportedLazyDeoptData(isolate, instance, code_table,
-                                    native_module, func_index)
-            .GetCode();
-    if (code->builtin_index() != Builtins::kWasmCompileLazy)
-      return WasmCodeWrapper(code);
-
-    // TODO(6792): No longer needed once WebAssembly code is off heap.
-    CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
-
-    // deopt_data:
-    // #0: weak instance
-    // #1: func_index
-    // [#2: export table
-    //  #3: export table index]
-    // [#4: export table
-    //  #5: export table index]
-    // ...
-    // table_export_count counts down and determines the index for the new
-    // export table entry.
-    auto table_export_entry = table_export_count->find(func_index);
-    DCHECK(table_export_entry != table_export_count->end());
-    DCHECK_LT(0, table_export_entry->second);
-    uint32_t this_idx = 2 * table_export_entry->second;
-    --table_export_entry->second;
-    Handle<FixedArray> deopt_data(code->deoptimization_data());
-    DCHECK_EQ(0, deopt_data->length() % 2);
-    if (deopt_data->length() == 2) {
-      // Then only the "header" (#0 and #1) exists. Extend for the export table
-      // entries (make space for this_idx + 2 elements).
-      deopt_data = isolate->factory()->CopyFixedArrayAndGrow(deopt_data,
-                                                             this_idx, TENURED);
-      code->set_deoptimization_data(*deopt_data);
-    }
-    DCHECK_LE(this_idx + 2, deopt_data->length());
-    DCHECK(deopt_data->get(this_idx)->IsUndefined(isolate));
-    DCHECK(deopt_data->get(this_idx + 1)->IsUndefined(isolate));
-    deopt_data->set(this_idx, *export_table);
-    deopt_data->set(this_idx + 1, Smi::FromInt(export_index));
-    return WasmCodeWrapper(code);
+wasm::WasmCode* EnsureTableExportLazyDeoptData(
+    Isolate* isolate, wasm::NativeModule* native_module, uint32_t func_index,
+    Handle<FixedArray> export_table, int export_index,
+    std::unordered_map<uint32_t, uint32_t>* num_table_exports) {
+  wasm::WasmCode* code =
+      EnsureExportedLazyDeoptData(isolate, native_module, func_index);
+  if (code == nullptr || code->kind() != wasm::WasmCode::kLazyStub) return code;
+
+  // deopt_data:
+  // [#0: export table
+  //  #1: export table index]
+  // [#2: export table
+  //  #3: export table index]
+  // ...
+  // num_table_exports counts down and determines the index for the new
+  // export table entry.
+  auto table_export_entry = num_table_exports->find(func_index);
+  DCHECK(table_export_entry != num_table_exports->end());
+  DCHECK_LT(0, table_export_entry->second);
+  --table_export_entry->second;
+  uint32_t this_idx = 2 * table_export_entry->second;
+  int int_func_index = static_cast<int>(func_index);
+  Object* deopt_entry =
+      native_module->compiled_module()->lazy_compile_data()->get(
+          int_func_index);
+  FixedArray* deopt_data = nullptr;
+  if (!deopt_entry->IsFixedArray()) {
+    // we count indices down, so we enter here first for the
+    // largest index.
+    deopt_data = *isolate->factory()->NewFixedArray(this_idx + 2, TENURED);
+    native_module->compiled_module()->lazy_compile_data()->set(int_func_index,
+                                                               deopt_data);
   } else {
-    const wasm::WasmCode* code =
-        EnsureExportedLazyDeoptData(isolate, instance, code_table,
-                                    native_module, func_index)
-            .GetWasmCode();
-    if (code == nullptr || code->kind() != wasm::WasmCode::kLazyStub)
-      return WasmCodeWrapper(code);
-
-    // deopt_data:
-    // [#0: export table
-    //  #1: export table index]
-    // [#2: export table
-    //  #3: export table index]
-    // ...
-    // table_export_count counts down and determines the index for the new
-    // export table entry.
-    auto table_export_entry = table_export_count->find(func_index);
-    DCHECK(table_export_entry != table_export_count->end());
-    DCHECK_LT(0, table_export_entry->second);
-    --table_export_entry->second;
-    uint32_t this_idx = 2 * table_export_entry->second;
-    int int_func_index = static_cast<int>(func_index);
-    Object* deopt_entry =
-        native_module->compiled_module()->lazy_compile_data()->get(
-            int_func_index);
-    FixedArray* deopt_data = nullptr;
-    if (!deopt_entry->IsFixedArray()) {
-      // we count indices down, so we enter here first for the
-      // largest index.
-      deopt_data = *isolate->factory()->NewFixedArray(this_idx + 2, TENURED);
-      native_module->compiled_module()->lazy_compile_data()->set(int_func_index,
-                                                                 deopt_data);
-    } else {
-      deopt_data = FixedArray::cast(deopt_entry);
-      DCHECK_LE(this_idx + 2, deopt_data->length());
-    }
-    DCHECK(deopt_data->get(this_idx)->IsUndefined(isolate));
-    DCHECK(deopt_data->get(this_idx + 1)->IsUndefined(isolate));
-    deopt_data->set(this_idx, *export_table);
-    deopt_data->set(this_idx + 1, Smi::FromInt(export_index));
-    return WasmCodeWrapper(code);
+    deopt_data = FixedArray::cast(deopt_entry);
+    DCHECK_LE(this_idx + 2, deopt_data->length());
   }
+  DCHECK(deopt_data->get(this_idx)->IsUndefined(isolate));
+  DCHECK(deopt_data->get(this_idx + 1)->IsUndefined(isolate));
+  deopt_data->set(this_idx, *export_table);
+  deopt_data->set(this_idx + 1, Smi::FromInt(export_index));
+  return code;
 }
 
 bool in_bounds(uint32_t offset, uint32_t size, uint32_t upper) {
@@ -1918,7 +986,7 @@ bool in_bounds(uint32_t offset, uint32_t size, uint32_t upper) {
 using WasmInstanceMap =
     IdentityMap<Handle<WasmInstanceObject>, FreeStoreAllocationPolicy>;
 
-WasmCodeWrapper MakeWasmToWasmWrapper(
+wasm::WasmCode* MakeWasmToWasmWrapper(
     Isolate* isolate, Handle<WasmExportedFunction> imported_function,
     FunctionSig* expected_sig, FunctionSig** sig,
     WasmInstanceMap* imported_instances, Handle<WasmInstanceObject> instance,
@@ -1935,27 +1003,14 @@ WasmCodeWrapper MakeWasmToWasmWrapper(
              .sig;
   if (expected_sig && !expected_sig->Equals(*sig)) return {};
 
-  if (!FLAG_wasm_jit_to_native) {
-    Handle<Code> wrapper_code = compiler::CompileWasmToWasmWrapper(
-        isolate, imported_function->GetWasmCode(), *sig,
-        new_wasm_context_address);
-    // Set the deoptimization data for the WasmToWasm wrapper. This is
-    // needed by the interpreter to find the imported instance for
-    // a cross-instance call.
-    AttachWasmFunctionInfo(isolate, wrapper_code, imported_instance,
-                           imported_function->function_index());
-    return WasmCodeWrapper(wrapper_code);
-  } else {
-    Handle<Code> code = compiler::CompileWasmToWasmWrapper(
-        isolate, imported_function->GetWasmCode(), *sig,
-        new_wasm_context_address);
-    return WasmCodeWrapper(
-        instance->compiled_module()->GetNativeModule()->AddCodeCopy(
-            code, wasm::WasmCode::kWasmToWasmWrapper, index));
-  }
+  Handle<Code> code = compiler::CompileWasmToWasmWrapper(
+      isolate, imported_function->GetWasmCode(), *sig,
+      new_wasm_context_address);
+  return instance->compiled_module()->GetNativeModule()->AddCodeCopy(
+      code, wasm::WasmCode::kWasmToWasmWrapper, index);
 }
 
-WasmCodeWrapper UnwrapExportOrCompileImportWrapper(
+wasm::WasmCode* UnwrapExportOrCompileImportWrapper(
     Isolate* isolate, FunctionSig* sig, Handle<JSReceiver> target,
     uint32_t import_index, ModuleOrigin origin,
     WasmInstanceMap* imported_instances, Handle<FixedArray> js_imports_table,
@@ -1968,23 +1023,11 @@ WasmCodeWrapper UnwrapExportOrCompileImportWrapper(
   }
   // No wasm function or being debugged. Compile a new wrapper for the new
   // signature.
-  if (FLAG_wasm_jit_to_native) {
-    Handle<Code> temp_code = compiler::CompileWasmToJSWrapper(
-        isolate, target, sig, import_index, origin,
-        instance->compiled_module()->use_trap_handler(), js_imports_table);
-    return WasmCodeWrapper(
-        instance->compiled_module()->GetNativeModule()->AddCodeCopy(
-            temp_code, wasm::WasmCode::kWasmToJsWrapper, import_index));
-  } else {
-    return WasmCodeWrapper(compiler::CompileWasmToJSWrapper(
-        isolate, target, sig, import_index, origin,
-        instance->compiled_module()->use_trap_handler(), js_imports_table));
-  }
-}
-
-double MonotonicallyIncreasingTimeInMs() {
-  return V8::GetCurrentPlatform()->MonotonicallyIncreasingTime() *
-         base::Time::kMillisecondsPerSecond;
+  Handle<Code> temp_code = compiler::CompileWasmToJSWrapper(
+      isolate, target, sig, import_index, origin,
+      instance->compiled_module()->use_trap_handler(), js_imports_table);
+  return instance->compiled_module()->GetNativeModule()->AddCodeCopy(
+      temp_code, wasm::WasmCode::kWasmToJsWrapper, import_index);
 }
 
 void FunctionTableFinalizer(const v8::WeakCallbackInfo<void>& data) {
@@ -1993,7 +1036,7 @@ void FunctionTableFinalizer(const v8::WeakCallbackInfo<void>& data) {
 }
 
 std::unique_ptr<compiler::ModuleEnv> CreateDefaultModuleEnv(
-    Isolate* isolate, WasmModule* module, Handle<Code> illegal_builtin) {
+    Isolate* isolate, WasmModule* module) {
   std::vector<GlobalHandleAddress> function_tables;
 
   for (size_t i = module->function_tables.size(); i > 0; --i) {
@@ -2007,63 +1050,316 @@ std::unique_ptr<compiler::ModuleEnv> CreateDefaultModuleEnv(
 
   // TODO(kschimpf): Add module-specific policy handling here (see v8:7143)?
   bool use_trap_handler = trap_handler::IsTrapHandlerEnabled();
-  return base::make_unique<compiler::ModuleEnv>(
-      module, function_tables, std::vector<Handle<Code>>{}, illegal_builtin,
-      use_trap_handler);
+  return base::make_unique<compiler::ModuleEnv>(module, function_tables,
+                                                use_trap_handler);
 }
 
-// TODO(mtrofin): remove code_table when we don't need FLAG_wasm_jit_to_native
 Handle<WasmCompiledModule> NewCompiledModule(Isolate* isolate,
                                              WasmModule* module,
-                                             Handle<FixedArray> code_table,
                                              Handle<FixedArray> export_wrappers,
                                              compiler::ModuleEnv* env) {
   Handle<WasmCompiledModule> compiled_module =
-      WasmCompiledModule::New(isolate, module, code_table, export_wrappers,
+      WasmCompiledModule::New(isolate, module, export_wrappers,
                               env->function_tables, env->use_trap_handler);
   return compiled_module;
 }
 
-template <typename T>
-void ReopenHandles(Isolate* isolate, const std::vector<Handle<T>>& vec) {
-  auto& mut = const_cast<std::vector<Handle<T>>&>(vec);
-  for (size_t i = 0; i < mut.size(); i++) {
-    mut[i] = Handle<T>(*mut[i], isolate);
+}  // namespace
+
+namespace {
+
+size_t GetMaxUsableMemorySize(Isolate* isolate) {
+  return isolate->heap()->memory_allocator()->code_range()->valid()
+             ? isolate->heap()->memory_allocator()->code_range()->size()
+             : isolate->heap()->code_space()->Capacity();
+}
+
+double MonotonicallyIncreasingTimeInMs() {
+  return V8::GetCurrentPlatform()->MonotonicallyIncreasingTime() *
+         base::Time::kMillisecondsPerSecond;
+}
+
+// The CompilationUnitBuilder builds compilation units and stores them in an
+// internal buffer. The buffer is moved into the working queue of the
+// CompilationState when {Commit} is called.
+class CompilationUnitBuilder {
+ public:
+  explicit CompilationUnitBuilder(NativeModule* native_module,
+                                  compiler::ModuleEnv* module_env,
+                                  Handle<Code> centry_stub)
+      : native_module_(native_module),
+        compilation_state_(native_module->compilation_state()),
+        module_env_(module_env),
+        centry_stub_(centry_stub) {}
+
+  void AddUnit(const WasmFunction* function, uint32_t buffer_offset,
+               Vector<const uint8_t> bytes, WasmName name) {
+    units_.emplace_back(new compiler::WasmCompilationUnit(
+        compilation_state_->isolate(), module_env_, native_module_,
+        wasm::FunctionBody{function->sig, buffer_offset, bytes.begin(),
+                           bytes.end()},
+        name, function->func_index, centry_stub_,
+        compiler::WasmCompilationUnit::GetDefaultCompilationMode(),
+        compilation_state_->isolate()->async_counters().get()));
+  }
+
+  bool Commit() {
+    if (units_.empty()) return false;
+    compilation_state_->AddCompilationUnits(units_);
+    units_.clear();
+    return true;
   }
+
+  void Clear() { units_.clear(); }
+
+ private:
+  NativeModule* native_module_;
+  CompilationState* compilation_state_;
+  compiler::ModuleEnv* module_env_;
+  Handle<Code> centry_stub_;
+  std::vector<std::unique_ptr<compiler::WasmCompilationUnit>> units_;
+};
+
+// Run by each compilation task and by the main thread (i.e. in both
+// foreground and background threads). The no_finisher_callback is called
+// within the result_mutex_ lock when no finishing task is running, i.e. when
+// the finisher_is_running_ flag is not set.
+bool FetchAndExecuteCompilationUnit(CompilationState* compilation_state) {
+  DisallowHeapAllocation no_allocation;
+  DisallowHandleAllocation no_handles;
+  DisallowHandleDereference no_deref;
+  DisallowCodeDependencyChange no_dependency_change;
+
+  std::unique_ptr<compiler::WasmCompilationUnit> unit =
+      compilation_state->GetNextCompilationUnit();
+  if (unit == nullptr) return false;
+
+  unit->ExecuteCompilation();
+  compilation_state->ScheduleUnitForFinishing(unit);
+
+  return true;
 }
 
-}  // namespace
+size_t GetNumFunctionsToCompile(const std::vector<WasmFunction>& functions,
+                                compiler::ModuleEnv* module_env) {
+  // TODO(kimanh): Remove, FLAG_skip_compiling_wasm_funcs: previously used for
+  // debugging, and now not necessarily working anymore.
+  uint32_t start = module_env->module->num_imported_functions +
+                   FLAG_skip_compiling_wasm_funcs;
+  uint32_t num_funcs = static_cast<uint32_t>(functions.size());
+  uint32_t funcs_to_compile = start > num_funcs ? 0 : num_funcs - start;
+  return funcs_to_compile;
+}
+
+void InitializeCompilationUnits(const std::vector<WasmFunction>& functions,
+                                const ModuleWireBytes& wire_bytes,
+                                compiler::ModuleEnv* module_env,
+                                Handle<Code> centry_stub,
+                                NativeModule* native_module) {
+  uint32_t start = module_env->module->num_imported_functions +
+                   FLAG_skip_compiling_wasm_funcs;
+  uint32_t num_funcs = static_cast<uint32_t>(functions.size());
+
+  CompilationUnitBuilder builder(native_module, module_env, centry_stub);
+  for (uint32_t i = start; i < num_funcs; ++i) {
+    const WasmFunction* func = &functions[i];
+    uint32_t buffer_offset = func->code.offset();
+    Vector<const uint8_t> bytes(wire_bytes.start() + func->code.offset(),
+                                func->code.end_offset() - func->code.offset());
+
+    WasmName name = wire_bytes.GetName(func, module_env->module);
+    DCHECK_NOT_NULL(native_module);
+    builder.AddUnit(func, buffer_offset, bytes, name);
+  }
+  builder.Commit();
+}
+
+wasm::WasmCode* FinishCompilationUnit(CompilationState* compilation_state,
+                                      ErrorThrower* thrower, int* func_index) {
+  std::unique_ptr<compiler::WasmCompilationUnit> unit =
+      compilation_state->GetNextExecutedUnit();
+  if (unit == nullptr) return {};
+  *func_index = unit->func_index();
+  DCHECK_LE(0, *func_index);
+  return unit->FinishCompilation(thrower);
+}
+
+void FinishCompilationUnits(CompilationState* compilation_state,
+                            ErrorThrower* thrower) {
+  while (true) {
+    if (compilation_state->failed()) break;
+    int func_index = -1;
+    wasm::WasmCode* result =
+        FinishCompilationUnit(compilation_state, thrower, &func_index);
+
+    if (func_index < 0) break;
+
+    // Update the compilation state.
+    compilation_state->OnFinishedUnit(NotifyCompilationCallback::kNoNotify);
+    DCHECK_IMPLIES(result == nullptr, thrower->error());
+    if (result == nullptr) break;
+  }
+  if (compilation_state->ShouldIncreaseWorkload() &&
+      !compilation_state->failed()) {
+    compilation_state->RestartBackgroundTasks();
+  }
+}
+
+void CompileInParallel(Isolate* isolate, NativeModule* native_module,
+                       const ModuleWireBytes& wire_bytes,
+                       compiler::ModuleEnv* module_env,
+                       Handle<Code> centry_stub, ErrorThrower* thrower) {
+  const WasmModule* module = module_env->module;
+  // Data structures for the parallel compilation.
+
+  //-----------------------------------------------------------------------
+  // For parallel compilation:
+  // 1) The main thread allocates a compilation unit for each wasm function
+  //    and stores them in the vector {compilation_units} within the
+  //    {compilation_state}. By adding units to the {compilation_state}, new
+  //    {BackgroundCompileTasks} instances are spawned which run on
+  //    the background threads.
+  // 2.a) The background threads and the main thread pick one compilation
+  //      unit at a time and execute the parallel phase of the compilation
+  //      unit. After finishing the execution of the parallel phase, the
+  //      result is enqueued in {executed_units}.
+  // 2.b) If {executed_units} contains a compilation unit, the main thread
+  //      dequeues it and finishes the compilation.
+  // 3) After the parallel phase of all compilation units has started, the
+  //    main thread waits for all {BackgroundCompileTasks} instances to finish.
+  // 4) The main thread finishes the compilation.
+
+  // Turn on the {CanonicalHandleScope} so that the background threads can
+  // use the node cache.
+  CanonicalHandleScope canonical(isolate);
+
+  CompilationState* compilation_state = native_module->compilation_state();
+  compilation_state->EnableThrottling();
+  // Make sure that no foreground task is spawned for finishing
+  // the compilation units. This foreground thread will be
+  // responsible for finishing compilation.
+  compilation_state->SetFinisherIsRunning(true);
+  size_t functions_count =
+      GetNumFunctionsToCompile(module->functions, module_env);
+  compilation_state->SetNumberOfFunctionsToCompile(functions_count);
+
+  // 1) The main thread allocates a compilation unit for each wasm function
+  //    and stores them in the vector {compilation_units} within the
+  //    {compilation_state}. By adding units to the {compilation_state}, new
+  //    {BackgroundCompileTask} instances are spawned which run on
+  //    background threads.
+  InitializeCompilationUnits(module->functions, wire_bytes, module_env,
+                             centry_stub, native_module);
+
+  // 2.a) The background threads and the main thread pick one compilation
+  //      unit at a time and execute the parallel phase of the compilation
+  //      unit. After finishing the execution of the parallel phase, the
+  //      result is enqueued in {executed_units}.
+  //      The foreground task bypasses waiting on memory threshold, because
+  //      its results will immediately be converted to code (below).
+  while (FetchAndExecuteCompilationUnit(compilation_state)) {
+    // 2.b) If {executed_units} contains a compilation unit, the main thread
+    //      dequeues it and finishes the compilation unit. Compilation units
+    //      are finished concurrently to the background threads to save
+    //      memory.
+    FinishCompilationUnits(compilation_state, thrower);
+
+    if (compilation_state->failed()) break;
+  }
+
+  // 3) After the parallel phase of all compilation units has started, the
+  //    main thread waits for all {BackgroundCompileTasks} instances to finish -
+  //    which happens once they all realize there's no next work item to
+  //    process. If compilation already failed, all background tasks have
+  //    already been canceled in {FinishCompilationUnits}, and there are
+  //    no units to finish.
+  if (!compilation_state->failed()) {
+    compilation_state->CancelAndWait();
+
+    // 4) Finish all compilation units which have been executed while we waited.
+    FinishCompilationUnits(compilation_state, thrower);
+  }
+}
+
+void CompileSequentially(Isolate* isolate, NativeModule* native_module,
+                         const ModuleWireBytes& wire_bytes,
+                         compiler::ModuleEnv* module_env,
+                         ErrorThrower* thrower) {
+  DCHECK(!thrower->error());
+
+  const WasmModule* module = module_env->module;
+  for (uint32_t i = FLAG_skip_compiling_wasm_funcs;
+       i < module->functions.size(); ++i) {
+    const WasmFunction& func = module->functions[i];
+    if (func.imported) continue;  // Imports are compiled at instantiation time.
+
+    // Compile the function.
+    wasm::WasmCode* code = compiler::WasmCompilationUnit::CompileWasmFunction(
+        native_module, thrower, isolate, wire_bytes, module_env, &func);
+    if (code == nullptr) {
+      TruncatedUserString<> name(wire_bytes.GetName(&func, module));
+      thrower->CompileError("Compilation of #%d:%.*s failed.", i, name.length(),
+                            name.start());
+      break;
+    }
+  }
+}
+
+void ValidateSequentially(Isolate* isolate, const ModuleWireBytes& wire_bytes,
+                          compiler::ModuleEnv* module_env,
+                          ErrorThrower* thrower) {
+  DCHECK(!thrower->error());
+
+  const WasmModule* module = module_env->module;
+  for (uint32_t i = 0; i < module->functions.size(); ++i) {
+    const WasmFunction& func = module->functions[i];
+    if (func.imported) continue;
 
-MaybeHandle<WasmModuleObject> ModuleCompiler::CompileToModuleObjectInternal(
-    ErrorThrower* thrower, std::unique_ptr<WasmModule> module,
+    const byte* base = wire_bytes.start();
+    FunctionBody body{func.sig, func.code.offset(), base + func.code.offset(),
+                      base + func.code.end_offset()};
+    DecodeResult result = VerifyWasmCodeWithStats(
+        isolate->allocator(), module, body, module->is_wasm(),
+        isolate->async_counters().get());
+    if (result.failed()) {
+      TruncatedUserString<> name(wire_bytes.GetName(&func, module));
+      thrower->CompileError("Compiling function #%d:%.*s failed: %s @+%u", i,
+                            name.length(), name.start(),
+                            result.error_msg().c_str(), result.error_offset());
+      break;
+    }
+  }
+}
+
+MaybeHandle<WasmModuleObject> CompileToModuleObjectInternal(
+    Isolate* isolate, ErrorThrower* thrower, std::unique_ptr<WasmModule> module,
     const ModuleWireBytes& wire_bytes, Handle<Script> asm_js_script,
     Vector<const byte> asm_js_offset_table_bytes) {
+  WasmModule* wasm_module = module.get();
+  Handle<Code> centry_stub = CEntryStub(isolate, 1).GetCode();
   TimedHistogramScope wasm_compile_module_time_scope(
-      module_->is_wasm() ? counters()->wasm_compile_wasm_module_time()
-                         : counters()->wasm_compile_asm_module_time());
+      wasm_module->is_wasm()
+          ? isolate->async_counters()->wasm_compile_wasm_module_time()
+          : isolate->async_counters()->wasm_compile_asm_module_time());
   // TODO(6792): No longer needed once WebAssembly code is off heap. Use
   // base::Optional to be able to close the scope before notifying the debugger.
   base::Optional<CodeSpaceMemoryModificationScope> modification_scope(
-      base::in_place_t(), isolate_->heap());
-  // The {module} parameter is passed in to transfer ownership of the WasmModule
-  // to this function. The WasmModule itself existed already as an instance
-  // variable of the ModuleCompiler. We check here that the parameter and the
-  // instance variable actually point to the same object.
-  DCHECK_EQ(module.get(), module_);
+      base::in_place_t(), isolate->heap());
+
   // Check whether lazy compilation is enabled for this module.
-  bool lazy_compile = compile_lazy(module_);
+  bool lazy_compile = compile_lazy(wasm_module);
 
-  Factory* factory = isolate_->factory();
+  Factory* factory = isolate->factory();
   // Create heap objects for script, module bytes and asm.js offset table to
   // be stored in the shared module data.
   Handle<Script> script;
   Handle<ByteArray> asm_js_offset_table;
   if (asm_js_script.is_null()) {
-    script = CreateWasmScript(isolate_, wire_bytes);
+    script = CreateWasmScript(isolate, wire_bytes);
   } else {
     script = asm_js_script;
     asm_js_offset_table =
-        isolate_->factory()->NewByteArray(asm_js_offset_table_bytes.length());
+        isolate->factory()->NewByteArray(asm_js_offset_table_bytes.length());
     asm_js_offset_table->copy_in(0, asm_js_offset_table_bytes.start(),
                                  asm_js_offset_table_bytes.length());
   }
@@ -2079,7 +1375,7 @@ MaybeHandle<WasmModuleObject> ModuleCompiler::CompileToModuleObjectInternal(
   // The {module_wrapper} will take ownership of the {WasmModule} object,
   // and it will be destroyed when the GC reclaims the wrapper object.
   Handle<WasmModuleWrapper> module_wrapper =
-      WasmModuleWrapper::From(isolate_, module.release());
+      WasmModuleWrapper::From(isolate, module.release());
 
   // Create the shared module data.
   // TODO(clemensh): For the same module (same bytes / same hash), we should
@@ -2087,97 +1383,76 @@ MaybeHandle<WasmModuleObject> ModuleCompiler::CompileToModuleObjectInternal(
   // breakpoints on a (potentially empty) subset of the instances.
 
   Handle<WasmSharedModuleData> shared = WasmSharedModuleData::New(
-      isolate_, module_wrapper, Handle<SeqOneByteString>::cast(module_bytes),
+      isolate, module_wrapper, Handle<SeqOneByteString>::cast(module_bytes),
       script, asm_js_offset_table);
   if (lazy_compile) WasmSharedModuleData::PrepareForLazyCompilation(shared);
 
   Handle<Code> init_builtin = lazy_compile
-                                  ? BUILTIN_CODE(isolate_, WasmCompileLazy)
-                                  : BUILTIN_CODE(isolate_, Illegal);
-
-  // TODO(mtrofin): remove code_table and code_table_size when we don't
-  // need FLAG_wasm_jit_to_native anymore. Keep export_wrappers.
-  int code_table_size = static_cast<int>(module_->functions.size());
-  int export_wrappers_size = static_cast<int>(module_->num_exported_functions);
-  Handle<FixedArray> code_table =
-      factory->NewFixedArray(static_cast<int>(code_table_size), TENURED);
+                                  ? BUILTIN_CODE(isolate, WasmCompileLazy)
+                                  : BUILTIN_CODE(isolate, Illegal);
+
+  int export_wrappers_size =
+      static_cast<int>(wasm_module->num_exported_functions);
   Handle<FixedArray> export_wrappers =
       factory->NewFixedArray(static_cast<int>(export_wrappers_size), TENURED);
-  // Initialize the code table.
-  for (int i = 0, e = code_table->length(); i < e; ++i) {
-    code_table->set(i, *init_builtin);
-  }
-
   for (int i = 0, e = export_wrappers->length(); i < e; ++i) {
     export_wrappers->set(i, *init_builtin);
   }
-  auto env = CreateDefaultModuleEnv(isolate_, module_, init_builtin);
+  auto env = CreateDefaultModuleEnv(isolate, wasm_module);
 
   // Create the compiled module object and populate with compiled functions
   // and information needed at instantiation time. This object needs to be
   // serializable. Instantiation may occur off a deserialized version of this
   // object.
-  Handle<WasmCompiledModule> compiled_module = NewCompiledModule(
-      isolate_, shared->module(), code_table, export_wrappers, env.get());
-  native_module_ = compiled_module->GetNativeModule();
-  compiled_module->OnWasmModuleDecodingComplete(shared);
-  if (lazy_compile && FLAG_wasm_jit_to_native) {
-    Handle<FixedArray> lazy_compile_data = isolate_->factory()->NewFixedArray(
-        static_cast<int>(module_->functions.size()), TENURED);
+  Handle<WasmCompiledModule> compiled_module =
+      NewCompiledModule(isolate, shared->module(), export_wrappers, env.get());
+  NativeModule* native_module = compiled_module->GetNativeModule();
+  compiled_module->set_shared(*shared);
+  if (lazy_compile) {
+    Handle<FixedArray> lazy_compile_data = isolate->factory()->NewFixedArray(
+        static_cast<int>(wasm_module->functions.size()), TENURED);
     compiled_module->set_lazy_compile_data(*lazy_compile_data);
   }
 
   if (!lazy_compile) {
     size_t funcs_to_compile =
-        module_->functions.size() - module_->num_imported_functions;
+        wasm_module->functions.size() - wasm_module->num_imported_functions;
     bool compile_parallel =
         !FLAG_trace_wasm_decoder && FLAG_wasm_num_compilation_tasks > 0 &&
         funcs_to_compile > 1 &&
-        V8::GetCurrentPlatform()->NumberOfAvailableBackgroundThreads() > 0;
-    // Avoid a race condition by collecting results into a second vector.
-    std::vector<Handle<Code>> results(
-        FLAG_wasm_jit_to_native ? 0 : env->module->functions.size());
+        V8::GetCurrentPlatform()->NumberOfWorkerThreads() > 0;
 
     if (compile_parallel) {
-      CompileInParallel(wire_bytes, env.get(), results, thrower);
+      CompileInParallel(isolate, native_module, wire_bytes, env.get(),
+                        centry_stub, thrower);
     } else {
-      CompileSequentially(wire_bytes, env.get(), results, thrower);
+      CompileSequentially(isolate, native_module, wire_bytes, env.get(),
+                          thrower);
     }
     if (thrower->error()) return {};
 
-    if (!FLAG_wasm_jit_to_native) {
-      // At this point, compilation has completed. Update the code table.
-      for (size_t i =
-               module_->num_imported_functions + FLAG_skip_compiling_wasm_funcs;
-           i < results.size(); ++i) {
-        Code* code = *results[i];
-        code_table->set(static_cast<int>(i), code);
-        RecordStats(code, counters());
-      }
-    } else {
-      RecordStats(native_module_, counters());
-    }
+    RecordStats(native_module, isolate->async_counters().get());
   } else {
-    if (module_->is_wasm()) {
+    if (wasm_module->is_wasm()) {
       // Validate wasm modules for lazy compilation. Don't validate asm.js
       // modules, they are valid by construction (otherwise a CHECK will fail
       // during lazy compilation).
       // TODO(clemensh): According to the spec, we can actually skip validation
       // at module creation time, and return a function that always traps at
       // (lazy) compilation time.
-      ValidateSequentially(wire_bytes, env.get(), thrower);
-    }
-    if (FLAG_wasm_jit_to_native) {
-      native_module_->SetLazyBuiltin(BUILTIN_CODE(isolate_, WasmCompileLazy));
+      ValidateSequentially(isolate, wire_bytes, env.get(), thrower);
     }
+
+    native_module->SetLazyBuiltin(BUILTIN_CODE(isolate, WasmCompileLazy));
   }
   if (thrower->error()) return {};
 
   // Compile JS->wasm wrappers for exported functions.
-  CompileJsToWasmWrappers(isolate_, compiled_module, counters());
+  CompileJsToWasmWrappers(isolate, compiled_module,
+                          isolate->async_counters().get());
 
   Handle<WasmModuleObject> result =
-      WasmModuleObject::New(isolate_, compiled_module);
+      WasmModuleObject::New(isolate, compiled_module);
 
   // If we created a wasm script, finish it now and make it public to the
   // debugger.
@@ -2186,25 +1461,132 @@ MaybeHandle<WasmModuleObject> ModuleCompiler::CompileToModuleObjectInternal(
     // debugger.
     modification_scope.reset();
     script->set_wasm_compiled_module(*compiled_module);
-    isolate_->debug()->OnAfterCompile(script);
+    isolate->debug()->OnAfterCompile(script);
   }
 
   return result;
 }
 
-InstanceBuilder::InstanceBuilder(
-    Isolate* isolate, ErrorThrower* thrower,
-    Handle<WasmModuleObject> module_object, MaybeHandle<JSReceiver> ffi,
-    MaybeHandle<JSArrayBuffer> memory,
-    WeakCallbackInfo<void>::Callback instance_finalizer_callback)
+// The runnable task that finishes compilation in foreground (e.g. updating
+// the NativeModule, the code table, etc.).
+class FinishCompileTask : public CancelableTask {
+ public:
+  explicit FinishCompileTask(CompilationState* compilation_state,
+                             CancelableTaskManager* task_manager)
+      : CancelableTask(task_manager), compilation_state_(compilation_state) {}
+
+  void RunInternal() override {
+    Isolate* isolate = compilation_state_->isolate();
+    HandleScope scope(isolate);
+    SaveContext saved_context(isolate);
+    isolate->set_context(
+        compilation_state_->compiled_module()->native_context());
+
+    TRACE_COMPILE("(4a) Finishing compilation units...\n");
+    if (compilation_state_->failed()) {
+      compilation_state_->SetFinisherIsRunning(false);
+      return;
+    }
+
+    ErrorThrower thrower(compilation_state_->isolate(), "AsyncCompile");
+
+    // We execute for 1 ms and then reschedule the task, same as the GC.
+    double deadline = MonotonicallyIncreasingTimeInMs() + 1.0;
+    while (true) {
+      if (compilation_state_->ShouldIncreaseWorkload()) {
+        compilation_state_->RestartBackgroundTasks();
+      }
+
+      int func_index = -1;
+      wasm::WasmCode* result =
+          FinishCompilationUnit(compilation_state_, &thrower, &func_index);
+
+      if (thrower.error()) {
+        DCHECK_NULL(result);
+        USE(result);
+        Handle<Object> error = thrower.Reify();
+        compilation_state_->OnError(error, NotifyCompilationCallback::kNotify);
+        compilation_state_->SetFinisherIsRunning(false);
+        break;
+      }
+
+      if (func_index < 0) {
+        // It might happen that a background task just scheduled a unit to be
+        // finished, but did not start a finisher task since the flag was still
+        // set. Check for this case, and continue if there is more work.
+        compilation_state_->SetFinisherIsRunning(false);
+        if (compilation_state_->HasCompilationUnitToFinish() &&
+            compilation_state_->SetFinisherIsRunning(true)) {
+          continue;
+        }
+        break;
+      }
+
+      // Update the compilation state, and possibly notify
+      // threads waiting for events.
+      compilation_state_->OnFinishedUnit(NotifyCompilationCallback::kNotify);
+
+      if (deadline < MonotonicallyIncreasingTimeInMs()) {
+        // We reached the deadline. We reschedule this task and return
+        // immediately. Since we rescheduled this task already, we do not set
+        // the FinisherIsRunning flag to false.
+        compilation_state_->ScheduleFinisherTask();
+        return;
+      }
+    }
+  }
+
+ private:
+  CompilationState* compilation_state_;
+};
+
+// The runnable task that performs compilations in the background.
+class BackgroundCompileTask : public CancelableTask {
+ public:
+  explicit BackgroundCompileTask(CompilationState* compilation_state,
+                                 CancelableTaskManager* task_manager)
+      : CancelableTask(task_manager), compilation_state_(compilation_state) {}
+
+  void RunInternal() override {
+    TRACE_COMPILE("(3b) Compiling...\n");
+    while (compilation_state_->CanAcceptWork()) {
+      if (compilation_state_->failed()) break;
+      DisallowHandleAllocation no_handle;
+      DisallowHeapAllocation no_allocation;
+
+      if (!FetchAndExecuteCompilationUnit(compilation_state_)) {
+        break;
+      }
+    }
+
+    compilation_state_->OnBackgroundTaskStopped();
+  }
+
+ private:
+  CompilationState* compilation_state_;
+};
+}  // namespace
+
+MaybeHandle<WasmModuleObject> CompileToModuleObject(
+    Isolate* isolate, ErrorThrower* thrower, std::unique_ptr<WasmModule> module,
+    const ModuleWireBytes& wire_bytes, Handle<Script> asm_js_script,
+    Vector<const byte> asm_js_offset_table_bytes) {
+  return CompileToModuleObjectInternal(isolate, thrower, std::move(module),
+                                       wire_bytes, asm_js_script,
+                                       asm_js_offset_table_bytes);
+}
+
+InstanceBuilder::InstanceBuilder(Isolate* isolate, ErrorThrower* thrower,
+                                 Handle<WasmModuleObject> module_object,
+                                 MaybeHandle<JSReceiver> ffi,
+                                 MaybeHandle<JSArrayBuffer> memory)
     : isolate_(isolate),
       module_(module_object->compiled_module()->shared()->module()),
       async_counters_(isolate->async_counters()),
       thrower_(thrower),
       module_object_(module_object),
       ffi_(ffi),
-      memory_(memory),
-      instance_finalizer_callback_(instance_finalizer_callback) {
+      memory_(memory) {
   sanitized_imports_.reserve(module_->import_table.size());
 }
 
@@ -2222,12 +1604,8 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   if (thrower_->error()) return {};
 
   // TODO(6792): No longer needed once WebAssembly code is off heap.
-  // Use base::Optional to be able to close the scope before executing the start
-  // function.
-  base::Optional<CodeSpaceMemoryModificationScope> modification_scope(
-      base::in_place_t(), isolate_->heap());
+  CodeSpaceMemoryModificationScope modification_scope(isolate_->heap());
   // From here on, we expect the build pipeline to run without exiting to JS.
-  // Exception is when we run the startup function.
   DisallowJavascriptExecution no_js(isolate_);
   // Record build time into correct bucket, then build instance.
   TimedHistogramScope wasm_instantiate_module_time_scope(
@@ -2238,117 +1616,41 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   //--------------------------------------------------------------------------
   // Reuse the compiled module (if no owner), otherwise clone.
   //--------------------------------------------------------------------------
-  // TODO(mtrofin): remove code_table and old_code_table
-  // when FLAG_wasm_jit_to_native is not needed
-  Handle<FixedArray> code_table;
   Handle<FixedArray> wrapper_table;
-  // We keep around a copy of the old code table, because we'll be replacing
-  // imports for the new instance, and then we need the old imports to be
-  // able to relocate.
-  Handle<FixedArray> old_code_table;
-  MaybeHandle<WasmInstanceObject> owner;
-  // native_module is the one we're building now, old_module
-  // is the one we clone from. They point to the same place if
-  // we don't need to clone.
   wasm::NativeModule* native_module = nullptr;
-  wasm::NativeModule* old_module = nullptr;
+  // Root the old instance, if any, in case later allocation causes GC,
+  // to prevent the finalizer running for the old instance.
+  MaybeHandle<WasmInstanceObject> old_instance;
 
   TRACE("Starting new module instantiation\n");
   {
-    // Root the owner, if any, before doing any allocations, which
-    // may trigger GC.
-    // Both owner and original template need to be in sync. Even
-    // after we lose the original template handle, the code
-    // objects we copied from it have data relative to the
-    // instance - such as globals addresses.
-    Handle<WasmCompiledModule> original;
-    {
-      DisallowHeapAllocation no_gc;
-      original = handle(module_object_->compiled_module());
-      if (original->has_weak_owning_instance()) {
-        owner = handle(WasmInstanceObject::cast(
-            original->weak_owning_instance()->value()));
-      }
-    }
-    DCHECK(!original.is_null());
+    Handle<WasmCompiledModule> original =
+        handle(module_object_->compiled_module());
     if (original->has_weak_owning_instance()) {
+      old_instance = handle(original->owning_instance());
       // Clone, but don't insert yet the clone in the instances chain.
-      // We do that last. Since we are holding on to the owner instance,
-      // the owner + original state used for cloning and patching
-      // won't be mutated by possible finalizer runs.
-      DCHECK(!owner.is_null());
-      if (FLAG_wasm_jit_to_native) {
-        TRACE("Cloning from %zu\n", original->GetNativeModule()->instance_id);
-        compiled_module_ = WasmCompiledModule::Clone(isolate_, original);
-        native_module = compiled_module_->GetNativeModule();
-        wrapper_table = handle(compiled_module_->export_wrappers(), isolate_);
-      } else {
-        TRACE("Cloning from %d\n", original->instance_id());
-        old_code_table = handle(original->code_table(), isolate_);
-        compiled_module_ = WasmCompiledModule::Clone(isolate_, original);
-        code_table = handle(compiled_module_->code_table(), isolate_);
-        wrapper_table = handle(compiled_module_->export_wrappers(), isolate_);
-        // Avoid creating too many handles in the outer scope.
-        HandleScope scope(isolate_);
-
-        // Clone the code for wasm functions and exports.
-        for (int i = 0; i < code_table->length(); ++i) {
-          Handle<Code> orig_code(Code::cast(code_table->get(i)), isolate_);
-          switch (orig_code->kind()) {
-            case Code::WASM_TO_JS_FUNCTION:
-            case Code::WASM_TO_WASM_FUNCTION:
-              // Imports will be overwritten with newly compiled wrappers.
-              break;
-            case Code::BUILTIN:
-              DCHECK_EQ(Builtins::kWasmCompileLazy, orig_code->builtin_index());
-              // If this code object has deoptimization data, then we need a
-              // unique copy to attach updated deoptimization data.
-              if (orig_code->deoptimization_data()->length() > 0) {
-                Handle<Code> code = factory->CopyCode(orig_code);
-                AttachWasmFunctionInfo(isolate_, code,
-                                       Handle<WasmInstanceObject>(), i);
-                code_table->set(i, *code);
-              }
-              break;
-            case Code::WASM_FUNCTION: {
-              Handle<Code> code = factory->CopyCode(orig_code);
-              AttachWasmFunctionInfo(isolate_, code,
-                                     Handle<WasmInstanceObject>(), i);
-              code_table->set(i, *code);
-              break;
-            }
-            default:
-              UNREACHABLE();
-          }
-        }
-      }
+      // We do that last. Since we are holding on to the old instance,
+      // the owner + original state used for cloning and patching
+      // won't be mutated by possible finalizer runs.
+      TRACE("Cloning from %zu\n", original->GetNativeModule()->instance_id);
+      compiled_module_ = WasmCompiledModule::Clone(isolate_, original);
+      native_module = compiled_module_->GetNativeModule();
+      wrapper_table = handle(compiled_module_->export_wrappers(), isolate_);
       for (int i = 0; i < wrapper_table->length(); ++i) {
         Handle<Code> orig_code(Code::cast(wrapper_table->get(i)), isolate_);
         DCHECK_EQ(orig_code->kind(), Code::JS_TO_WASM_FUNCTION);
         Handle<Code> code = factory->CopyCode(orig_code);
         wrapper_table->set(i, *code);
       }
-      if (FLAG_wasm_jit_to_native) {
-        RecordStats(native_module, counters());
-      } else {
-        RecordStats(code_table, counters());
-      }
+      RecordStats(native_module, counters());
       RecordStats(wrapper_table, counters());
     } else {
-      // There was no owner, so we can reuse the original.
+      // No instance owned the original compiled module.
       compiled_module_ = original;
       wrapper_table = handle(compiled_module_->export_wrappers(), isolate_);
-      if (FLAG_wasm_jit_to_native) {
-        old_module = compiled_module_->GetNativeModule();
-        native_module = old_module;
-        TRACE("Reusing existing instance %zu\n",
-              compiled_module_->GetNativeModule()->instance_id);
-      } else {
-        code_table = handle(compiled_module_->code_table(), isolate_);
-        old_code_table = factory->CopyFixedArray(code_table);
-        TRACE("Reusing existing instance %d\n",
-              compiled_module_->instance_id());
-      }
+      native_module = compiled_module_->GetNativeModule();
+      TRACE("Reusing existing instance %zu\n",
+            compiled_module_->GetNativeModule()->instance_id);
     }
     Handle<WeakCell> weak_native_context =
         isolate_->factory()->NewWeakCell(isolate_->native_context());
@@ -2372,10 +1674,9 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   // Set up the globals for the new instance.
   //--------------------------------------------------------------------------
   WasmContext* wasm_context = instance->wasm_context()->get();
-  MaybeHandle<JSArrayBuffer> old_globals;
   uint32_t globals_size = module_->globals_size;
   if (globals_size > 0) {
-    const bool enable_guard_regions = false;
+    constexpr bool enable_guard_regions = false;
     Handle<JSArrayBuffer> global_buffer =
         NewArrayBuffer(isolate_, globals_size, enable_guard_regions);
     globals_ = global_buffer;
@@ -2400,7 +1701,7 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   //--------------------------------------------------------------------------
   // Process the imports for the module.
   //--------------------------------------------------------------------------
-  int num_imported_functions = ProcessImports(code_table, instance);
+  int num_imported_functions = ProcessImports(instance);
   if (num_imported_functions < 0) return {};
 
   //--------------------------------------------------------------------------
@@ -2428,9 +1729,13 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
     Handle<JSArrayBuffer> memory = memory_.ToHandleChecked();
     memory->set_is_neuterable(false);
 
-    DCHECK_IMPLIES(use_trap_handler(),
-                   module_->is_asm_js() || memory->has_guard_region());
-  } else if (initial_pages > 0) {
+    DCHECK_IMPLIES(use_trap_handler(), module_->is_asm_js() ||
+                                           memory->is_wasm_memory() ||
+                                           memory->backing_store() == nullptr);
+  } else if (initial_pages > 0 || use_trap_handler()) {
+    // We need to unconditionally create a guard region if using trap handlers,
+    // even when the size is zero to prevent null-derefence issues
+    // (e.g. https://crbug.com/769637).
     // Allocate memory if the initial size is more than 0 pages.
     memory_ = AllocateMemory(initial_pages);
     if (memory_.is_null()) return {};  // failed to allocate memory
@@ -2496,34 +1801,6 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   code_specialization.RelocateWasmContextReferences(wasm_context_address);
   js_to_wasm_cache_.SetContextAddress(wasm_context_address);
 
-  if (!FLAG_wasm_jit_to_native) {
-    //--------------------------------------------------------------------------
-    // Set up the runtime support for the new instance.
-    //--------------------------------------------------------------------------
-    Handle<WeakCell> weak_link = factory->NewWeakCell(instance);
-
-    for (int i = num_imported_functions + FLAG_skip_compiling_wasm_funcs,
-             num_functions = static_cast<int>(module_->functions.size());
-         i < num_functions; ++i) {
-      Handle<Code> code = handle(Code::cast(code_table->get(i)), isolate_);
-      if (code->kind() == Code::WASM_FUNCTION) {
-        AttachWasmFunctionInfo(isolate_, code, weak_link, i);
-        continue;
-      }
-      DCHECK_EQ(Builtins::kWasmCompileLazy, code->builtin_index());
-      int deopt_len = code->deoptimization_data()->length();
-      if (deopt_len == 0) continue;
-      DCHECK_LE(2, deopt_len);
-      DCHECK_EQ(i, Smi::ToInt(code->deoptimization_data()->get(1)));
-      code->deoptimization_data()->set(0, *weak_link);
-      // Entries [2, deopt_len) encode information about table exports of this
-      // function. This is rebuilt in {LoadTableSegments}, so reset it here.
-      for (int i = 2; i < deopt_len; ++i) {
-        code->deoptimization_data()->set_undefined(isolate_, i);
-      }
-    }
-  }
-
   //--------------------------------------------------------------------------
   // Set up the exports object for the new instance.
   //--------------------------------------------------------------------------
@@ -2534,7 +1811,7 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   // Initialize the indirect function tables.
   //--------------------------------------------------------------------------
   if (function_table_count > 0) {
-    LoadTableSegments(code_table, instance);
+    LoadTableSegments(instance);
   }
 
   //--------------------------------------------------------------------------
@@ -2545,44 +1822,32 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   }
 
   // Patch all code with the relocations registered in code_specialization.
-  code_specialization.RelocateDirectCalls(instance);
-  code_specialization.ApplyToWholeInstance(*instance, SKIP_ICACHE_FLUSH);
+  code_specialization.RelocateDirectCalls(native_module);
+  code_specialization.ApplyToWholeModule(native_module, SKIP_ICACHE_FLUSH);
 
-  if (FLAG_wasm_jit_to_native) {
-    FlushICache(isolate_, native_module);
-  } else {
-    FlushICache(isolate_, code_table);
-  }
-  FlushICache(isolate_, wrapper_table);
+  FlushICache(native_module);
+  FlushICache(wrapper_table);
 
   //--------------------------------------------------------------------------
   // Unpack and notify signal handler of protected instructions.
   //--------------------------------------------------------------------------
   if (use_trap_handler()) {
-    if (FLAG_wasm_jit_to_native) {
-      UnpackAndRegisterProtectedInstructions(isolate_, native_module);
-    } else {
-      UnpackAndRegisterProtectedInstructionsGC(isolate_, code_table);
-    }
+    UnpackAndRegisterProtectedInstructions(isolate_, native_module);
   }
 
   //--------------------------------------------------------------------------
   // Insert the compiled module into the weak list of compiled modules.
   //--------------------------------------------------------------------------
   {
-    Handle<Object> global_handle =
-        isolate_->global_handles()->Create(*instance);
     Handle<WeakCell> link_to_owning_instance = factory->NewWeakCell(instance);
-    if (!owner.is_null()) {
+    if (!old_instance.is_null()) {
       // Publish the new instance to the instances chain.
       DisallowHeapAllocation no_gc;
       compiled_module_->InsertInChain(*module_object_);
     }
     module_object_->set_compiled_module(*compiled_module_);
     compiled_module_->set_weak_owning_instance(*link_to_owning_instance);
-    GlobalHandles::MakeWeak(global_handle.location(), global_handle.location(),
-                            instance_finalizer_callback_,
-                            v8::WeakCallbackType::kFinalizer);
+    WasmInstanceObject::InstallFinalizer(isolate_, instance);
   }
 
   //--------------------------------------------------------------------------
@@ -2607,54 +1872,45 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   }
 
   //--------------------------------------------------------------------------
-  // Execute the start function if one was specified.
+  // Create a wrapper for the start function.
   //--------------------------------------------------------------------------
   if (module_->start_function_index >= 0) {
-    HandleScope scope(isolate_);
     int start_index = module_->start_function_index;
-    WasmCodeWrapper startup_code = EnsureExportedLazyDeoptData(
-        isolate_, instance, code_table, native_module, start_index);
+    wasm::WasmCode* start_code =
+        EnsureExportedLazyDeoptData(isolate_, native_module, start_index);
     FunctionSig* sig = module_->functions[start_index].sig;
     Handle<Code> wrapper_code = js_to_wasm_cache_.CloneOrCompileJSToWasmWrapper(
-        isolate_, module_, startup_code, start_index,
+        isolate_, module_, start_code, start_index,
         compiled_module_->use_trap_handler());
-    Handle<WasmExportedFunction> startup_fct = WasmExportedFunction::New(
+    start_function_ = WasmExportedFunction::New(
         isolate_, instance, MaybeHandle<String>(), start_index,
         static_cast<int>(sig->parameter_count()), wrapper_code);
-    RecordStats(startup_code, counters());
-    // Call the JS function.
-    Handle<Object> undefined = factory->undefined_value();
-    // Close the modification scopes, so we can execute the start function.
-    modification_scope.reset();
-    native_module_modification_scope.reset();
-    {
-      // We're OK with JS execution here. The instance is fully setup.
-      AllowJavascriptExecution allow_js(isolate_);
-      MaybeHandle<Object> retval =
-          Execution::Call(isolate_, startup_fct, undefined, 0, nullptr);
-
-      if (retval.is_null()) {
-        DCHECK(isolate_->has_pending_exception());
-        // It's unfortunate that the new instance is already linked in the
-        // chain. However, we need to set up everything before executing the
-        // startup unction, such that stack trace information can be generated
-        // correctly already in the start function.
-        return {};
-      }
-    }
+    RecordStats(start_code, counters());
   }
 
   DCHECK(!isolate_->has_pending_exception());
-  if (FLAG_wasm_jit_to_native) {
-    TRACE("Successfully built instance %zu\n",
-          compiled_module_->GetNativeModule()->instance_id);
-  } else {
-    TRACE("Finishing instance %d\n", compiled_module_->instance_id());
-  }
+  TRACE("Successfully built instance %zu\n",
+        compiled_module_->GetNativeModule()->instance_id);
   TRACE_CHAIN(module_object_->compiled_module());
   return instance;
 }
 
+bool InstanceBuilder::ExecuteStartFunction() {
+  if (start_function_.is_null()) return true;  // No start function.
+
+  HandleScope scope(isolate_);
+  // Call the JS function.
+  Handle<Object> undefined = isolate_->factory()->undefined_value();
+  MaybeHandle<Object> retval =
+      Execution::Call(isolate_, start_function_, undefined, 0, nullptr);
+
+  if (retval.is_null()) {
+    DCHECK(isolate_->has_pending_exception());
+    return false;
+  }
+  return true;
+}
+
 // Look up an import value in the {ffi_} object.
 MaybeHandle<Object> InstanceBuilder::LookupImport(uint32_t index,
                                                   Handle<String> module_name,
@@ -2845,8 +2101,7 @@ Handle<FixedArray> InstanceBuilder::SetupWasmToJSImportsTable(
 // Process the imports, including functions, tables, globals, and memory, in
 // order, loading them from the {ffi_} object. Returns the number of imported
 // functions.
-int InstanceBuilder::ProcessImports(Handle<FixedArray> code_table,
-                                    Handle<WasmInstanceObject> instance) {
+int InstanceBuilder::ProcessImports(Handle<WasmInstanceObject> instance) {
   using compiler::kFunctionTableSignatureOffset;
   using compiler::kFunctionTableCodeOffset;
   using compiler::kFunctionTableEntrySize;
@@ -2873,19 +2128,16 @@ int InstanceBuilder::ProcessImports(Handle<FixedArray> code_table,
                           module_name, import_name);
           return -1;
         }
-        WasmCodeWrapper import_code = UnwrapExportOrCompileImportWrapper(
+        wasm::WasmCode* import_code = UnwrapExportOrCompileImportWrapper(
             isolate_, module_->functions[import.index].sig,
             Handle<JSReceiver>::cast(value), num_imported_functions,
             module_->origin(), &imported_wasm_instances, js_imports_table,
             instance);
-        if (import_code.is_null()) {
+        if (import_code == nullptr) {
           ReportLinkError("imported function does not match the expected type",
                           index, module_name, import_name);
           return -1;
         }
-        if (!FLAG_wasm_jit_to_native) {
-          code_table->set(num_imported_functions, *import_code.GetCode());
-        }
         RecordStats(import_code, counters());
         num_imported_functions++;
         break;
@@ -2939,6 +2191,8 @@ int InstanceBuilder::ProcessImports(Handle<FixedArray> code_table,
              i += kFunctionTableEntrySize) {
           table_instance.function_table->set(i, Smi::FromInt(kInvalidSigIndex));
         }
+        WasmContext* wasm_context = instance->wasm_context()->get();
+        EnsureWasmContextTable(wasm_context, imported_cur_size);
         // Initialize the dispatch table with the (foreign) JS functions
         // that are already in the table.
         for (int i = 0; i < imported_cur_size; ++i) {
@@ -2956,47 +2210,16 @@ int InstanceBuilder::ProcessImports(Handle<FixedArray> code_table,
           // id, then the signature does not appear at all in this module,
           // so putting {-1} in the table will cause checks to always fail.
           auto target = Handle<WasmExportedFunction>::cast(val);
-          if (!FLAG_wasm_jit_to_native) {
-            FunctionSig* sig = nullptr;
-            Handle<Code> code =
-                MakeWasmToWasmWrapper(isolate_, target, nullptr, &sig,
-                                      &imported_wasm_instances, instance, 0)
-                    .GetCode();
-            int sig_index = module_->signature_map.Find(sig);
-            table_instance.function_table->set(
-                compiler::FunctionTableSigOffset(i), Smi::FromInt(sig_index));
-            table_instance.function_table->set(
-                compiler::FunctionTableCodeOffset(i), *code);
-          } else {
-            const wasm::WasmCode* exported_code =
-                target->GetWasmCode().GetWasmCode();
-            wasm::NativeModule* exporting_module = exported_code->owner();
-            Handle<WasmInstanceObject> imported_instance =
-                handle(target->instance());
-            imported_wasm_instances.Set(imported_instance, imported_instance);
-            FunctionSig* sig = imported_instance->module()
-                                   ->functions[exported_code->index()]
-                                   .sig;
-            wasm::WasmCode* wrapper_code =
-                exporting_module->GetExportedWrapper(exported_code->index());
-            if (wrapper_code == nullptr) {
-              WasmContext* other_context =
-                  imported_instance->wasm_context()->get();
-              Handle<Code> wrapper = compiler::CompileWasmToWasmWrapper(
-                  isolate_, target->GetWasmCode(), sig,
-                  reinterpret_cast<Address>(other_context));
-              set_of_native_module_scopes.Add(exporting_module);
-              wrapper_code = exporting_module->AddExportedWrapper(
-                  wrapper, exported_code->index());
-            }
-            int sig_index = module_->signature_map.Find(sig);
-            Handle<Foreign> foreign_holder = isolate_->factory()->NewForeign(
-                wrapper_code->instructions().start(), TENURED);
-            table_instance.function_table->set(
-                compiler::FunctionTableSigOffset(i), Smi::FromInt(sig_index));
-            table_instance.function_table->set(
-                compiler::FunctionTableCodeOffset(i), *foreign_holder);
-          }
+          Handle<WasmInstanceObject> imported_instance =
+              handle(target->instance());
+          const wasm::WasmCode* exported_code = target->GetWasmCode();
+          FunctionSig* sig = imported_instance->module()
+                                 ->functions[exported_code->index()]
+                                 .sig;
+          auto& entry = wasm_context->table[i];
+          entry.context = imported_instance->wasm_context()->get();
+          entry.sig_id = module_->signature_map.Find(sig);
+          entry.target = exported_code->instructions().start();
         }
 
         num_imported_tables++;
@@ -3187,6 +2410,20 @@ void InstanceBuilder::ProcessExports(
     // Fill the table to cache the exported JSFunction wrappers.
     js_wrappers_.insert(js_wrappers_.begin(), module_->functions.size(),
                         Handle<JSFunction>::null());
+
+    // If an imported WebAssembly function gets exported, the exported function
+    // has to be identical to to imported function. Therefore we put all
+    // imported WebAssembly functions into the js_wrappers_ list.
+    for (int index = 0, end = static_cast<int>(module_->import_table.size());
+         index < end; ++index) {
+      WasmImport& import = module_->import_table[index];
+      if (import.kind == kExternalFunction) {
+        Handle<Object> value = sanitized_imports_[index].value;
+        if (WasmExportedFunction::IsWasmExportedFunction(*value)) {
+          js_wrappers_[import.index] = Handle<JSFunction>::cast(value);
+        }
+      }
+    }
   }
 
   Handle<JSObject> exports_object;
@@ -3251,10 +2488,13 @@ void InstanceBuilder::ProcessExports(
           MaybeHandle<String> func_name;
           if (module_->is_asm_js()) {
             // For modules arising from asm.js, honor the names section.
+            WireBytesRef func_name_ref =
+                module_->LookupName(compiled_module_->shared()->module_bytes(),
+                                    function.func_index);
             func_name =
                 WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(
                     isolate_, handle(compiled_module_->shared(), isolate_),
-                    function.name)
+                    func_name_ref)
                     .ToHandleChecked();
           }
           js_function = WasmExportedFunction::New(
@@ -3345,25 +2585,9 @@ void InstanceBuilder::InitializeTables(
     Handle<WasmInstanceObject> instance,
     CodeSpecialization* code_specialization) {
   size_t function_table_count = module_->function_tables.size();
-  std::vector<GlobalHandleAddress> new_function_tables(function_table_count);
-
-  wasm::NativeModule* native_module = compiled_module_->GetNativeModule();
-  std::vector<GlobalHandleAddress> empty;
-  std::vector<GlobalHandleAddress>& old_function_tables =
-      FLAG_wasm_jit_to_native ? native_module->function_tables() : empty;
-
-  Handle<FixedArray> old_function_tables_gc =
-      FLAG_wasm_jit_to_native
-          ? Handle<FixedArray>::null()
-          : handle(compiled_module_->function_tables(), isolate_);
 
   // function_table_count is 0 or 1, so we just create these objects even if not
   // needed for native wasm.
-  // TODO(mtrofin): remove the {..}_gc variables when we don't need
-  // FLAG_wasm_jit_to_native
-  Handle<FixedArray> new_function_tables_gc =
-      isolate_->factory()->NewFixedArray(static_cast<int>(function_table_count),
-                                         TENURED);
 
   // These go on the instance.
   Handle<FixedArray> rooted_function_tables =
@@ -3372,12 +2596,6 @@ void InstanceBuilder::InitializeTables(
 
   instance->set_function_tables(*rooted_function_tables);
 
-  if (FLAG_wasm_jit_to_native) {
-    DCHECK_EQ(old_function_tables.size(), new_function_tables.size());
-  } else {
-    DCHECK_EQ(old_function_tables_gc->length(),
-              new_function_tables_gc->length());
-  }
   for (size_t index = 0; index < function_table_count; ++index) {
     WasmIndirectFunctionTable& table = module_->function_tables[index];
     TableInstance& table_instance = table_instances_[index];
@@ -3386,6 +2604,9 @@ void InstanceBuilder::InitializeTables(
     int num_table_entries = static_cast<int>(table.initial_size);
     int table_size = compiler::kFunctionTableEntrySize * num_table_entries;
 
+    WasmContext* wasm_context = instance->wasm_context()->get();
+    EnsureWasmContextTable(wasm_context, num_table_entries);
+
     if (table_instance.function_table.is_null()) {
       // Create a new dispatch table if necessary.
       table_instance.function_table =
@@ -3396,15 +2617,6 @@ void InstanceBuilder::InitializeTables(
         // uninitialized entries will always fail the signature check.
         table_instance.function_table->set(i, Smi::FromInt(kInvalidSigIndex));
       }
-    } else {
-      // Table is imported, patch table bounds check
-      int existing_table_size = table_instance.function_table->length();
-      DCHECK_EQ(0, existing_table_size % compiler::kFunctionTableEntrySize);
-      int existing_num_table_entries =
-          existing_table_size / compiler::kFunctionTableEntrySize;
-      DCHECK_LE(num_table_entries, existing_num_table_entries);
-      code_specialization->PatchTableSize(num_table_entries,
-                                          existing_num_table_entries);
     }
     int int_index = static_cast<int>(index);
 
@@ -3424,33 +2636,10 @@ void InstanceBuilder::InitializeTables(
         v8::WeakCallbackType::kFinalizer);
 
     rooted_function_tables->set(int_index, *global_func_table);
-
-    GlobalHandleAddress new_func_table_addr = global_func_table.address();
-    GlobalHandleAddress old_func_table_addr;
-    if (!FLAG_wasm_jit_to_native) {
-      WasmCompiledModule::SetTableValue(isolate_, new_function_tables_gc,
-                                        int_index, new_func_table_addr);
-
-      old_func_table_addr =
-          WasmCompiledModule::GetTableValue(*old_function_tables_gc, int_index);
-    } else {
-      new_function_tables[int_index] = new_func_table_addr;
-
-      old_func_table_addr = old_function_tables[int_index];
-    }
-    code_specialization->RelocatePointer(old_func_table_addr,
-                                         new_func_table_addr);
-  }
-
-  if (FLAG_wasm_jit_to_native) {
-    native_module->function_tables() = new_function_tables;
-  } else {
-    compiled_module_->set_function_tables(*new_function_tables_gc);
   }
 }
 
-void InstanceBuilder::LoadTableSegments(Handle<FixedArray> code_table,
-                                        Handle<WasmInstanceObject> instance) {
+void InstanceBuilder::LoadTableSegments(Handle<WasmInstanceObject> instance) {
   wasm::NativeModule* native_module = compiled_module_->GetNativeModule();
   int function_table_count = static_cast<int>(module_->function_tables.size());
   for (int index = 0; index < function_table_count; ++index) {
@@ -3462,25 +2651,14 @@ void InstanceBuilder::LoadTableSegments(Handle<FixedArray> code_table,
     if (compile_lazy(module_)) {
       for (auto& table_init : module_->table_inits) {
         for (uint32_t func_index : table_init.entries) {
-          if (!FLAG_wasm_jit_to_native) {
-            Code* code =
-                Code::cast(code_table->get(static_cast<int>(func_index)));
-            // Only increase the counter for lazy compile builtins (it's not
-            // needed otherwise).
-            if (code->builtin_index() != Builtins::kWasmCompileLazy) {
-              DCHECK(code->kind() == Code::WASM_FUNCTION ||
-                     code->kind() == Code::WASM_TO_JS_FUNCTION);
-              continue;
-            }
-          } else {
-            const wasm::WasmCode* code = native_module->GetCode(func_index);
-            // Only increase the counter for lazy compile builtins (it's not
-            // needed otherwise).
-            if (code->kind() != wasm::WasmCode::kLazyStub) {
-              DCHECK(code->kind() == wasm::WasmCode::kFunction ||
-                     code->kind() == wasm::WasmCode::kWasmToJsWrapper);
-              continue;
-            }
+          const wasm::WasmCode* code = native_module->GetCode(func_index);
+          // Only increase the counter for lazy compile builtins (it's not
+          // needed otherwise).
+          if (code->kind() != wasm::WasmCode::kLazyStub) {
+            DCHECK(code->kind() == wasm::WasmCode::kFunction ||
+                   code->kind() == wasm::WasmCode::kWasmToJsWrapper ||
+                   code->kind() == wasm::WasmCode::kWasmToWasmWrapper);
+            continue;
           }
           ++num_table_exports[func_index];
         }
@@ -3499,25 +2677,28 @@ void InstanceBuilder::LoadTableSegments(Handle<FixedArray> code_table,
         uint32_t func_index = table_init.entries[i];
         WasmFunction* function = &module_->functions[func_index];
         int table_index = static_cast<int>(i + base);
-        uint32_t sig_index = module_->signature_ids[function->sig_index];
+
+        // Update the local dispatch table first.
+        uint32_t sig_id = module_->signature_ids[function->sig_index];
         table_instance.function_table->set(
             compiler::FunctionTableSigOffset(table_index),
-            Smi::FromInt(sig_index));
-        WasmCodeWrapper wasm_code = EnsureTableExportLazyDeoptData(
-            isolate_, instance, code_table, native_module, func_index,
-            table_instance.function_table, table_index, &num_table_exports);
-        Handle<Object> value_to_update_with;
-        if (!wasm_code.IsCodeObject()) {
-          Handle<Foreign> as_foreign = isolate_->factory()->NewForeign(
-              wasm_code.GetWasmCode()->instructions().start(), TENURED);
-          value_to_update_with = as_foreign;
-        } else {
-          value_to_update_with = wasm_code.GetCode();
-        }
+            Smi::FromInt(sig_id));
+        wasm::WasmCode* wasm_code = EnsureTableExportLazyDeoptData(
+            isolate_, native_module, func_index, table_instance.function_table,
+            table_index, &num_table_exports);
+        Handle<Foreign> as_foreign = isolate_->factory()->NewForeign(
+            wasm_code->instructions().start(), TENURED);
         table_instance.function_table->set(
-            compiler::FunctionTableCodeOffset(table_index),
-            *value_to_update_with);
+            compiler::FunctionTableCodeOffset(table_index), *as_foreign);
+
+        WasmContext* wasm_context = instance->wasm_context()->get();
+        auto& entry = wasm_context->table[table_index];
+        entry.sig_id = sig_id;
+        entry.context = wasm_context;
+        entry.target = wasm_code->instructions().start();
+
         if (!table_instance.table_object.is_null()) {
+          // Update the table object's other dispatch tables.
           if (js_wrappers_[func_index].is_null()) {
             // No JSFunction entry yet exists for this function. Create one.
             // TODO(titzer): We compile JS->wasm wrappers for functions are
@@ -3531,10 +2712,12 @@ void InstanceBuilder::LoadTableSegments(Handle<FixedArray> code_table,
             MaybeHandle<String> func_name;
             if (module_->is_asm_js()) {
               // For modules arising from asm.js, honor the names section.
+              WireBytesRef func_name_ref = module_->LookupName(
+                  compiled_module_->shared()->module_bytes(), func_index);
               func_name =
                   WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(
                       isolate_, handle(compiled_module_->shared(), isolate_),
-                      function->name)
+                      func_name_ref)
                       .ToHandleChecked();
             }
             Handle<WasmExportedFunction> js_function =
@@ -3546,31 +2729,10 @@ void InstanceBuilder::LoadTableSegments(Handle<FixedArray> code_table,
           }
           table_instance.js_wrappers->set(table_index,
                                           *js_wrappers_[func_index]);
-          // When updating dispatch tables, we need to provide a wasm-to-wasm
-          // wrapper for wasm_code - unless wasm_code is already a wrapper. If
-          // it's a wasm-to-js wrapper, we don't need to construct a
-          // wasm-to-wasm wrapper because there's no context switching required.
-          // The remaining case is that it's a wasm-to-wasm wrapper, in which
-          // case it's already doing "the right thing", and wrapping it again
-          // would be redundant.
-          if (func_index >= module_->num_imported_functions) {
-            value_to_update_with = GetOrCreateIndirectCallWrapper(
-                isolate_, instance, wasm_code, func_index, function->sig);
-          } else {
-            if (wasm_code.IsCodeObject()) {
-              DCHECK(wasm_code.GetCode()->kind() == Code::WASM_TO_JS_FUNCTION ||
-                     wasm_code.GetCode()->kind() ==
-                         Code::WASM_TO_WASM_FUNCTION);
-            } else {
-              DCHECK(wasm_code.GetWasmCode()->kind() ==
-                         WasmCode::kWasmToJsWrapper ||
-                     wasm_code.GetWasmCode()->kind() ==
-                         WasmCode::kWasmToWasmWrapper);
-            }
-          }
-          WasmTableObject::UpdateDispatchTables(table_instance.table_object,
-                                                table_index, function->sig,
-                                                value_to_update_with);
+          // UpdateDispatchTables() should update this instance as well.
+          WasmTableObject::UpdateDispatchTables(
+              isolate_, table_instance.table_object, table_index, function->sig,
+              instance, wasm_code, func_index);
         }
       }
     }
@@ -3606,7 +2768,7 @@ AsyncCompileJob::AsyncCompileJob(Isolate* isolate,
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
   v8::Platform* platform = V8::GetCurrentPlatform();
   foreground_task_runner_ = platform->GetForegroundTaskRunner(v8_isolate);
-  background_task_runner_ = platform->GetBackgroundTaskRunner(v8_isolate);
+  background_task_runner_ = platform->GetWorkerThreadsTaskRunner(v8_isolate);
   // The handles for the context and promise must be deferred.
   DeferredHandleScope deferred(isolate);
   context_ = Handle<Context>(*context);
@@ -3620,6 +2782,9 @@ void AsyncCompileJob::Start() {
 
 void AsyncCompileJob::Abort() {
   background_task_manager_.CancelAndWait();
+  if (!compiled_module_.is_null()) {
+    compiled_module_->GetNativeModule()->compilation_state()->Abort();
+  }
   if (num_pending_foreground_tasks_ == 0) {
     // No task is pending, we can just remove the AsyncCompileJob.
     isolate_->wasm_engine()->compilation_manager()->RemoveJob(this);
@@ -3664,8 +2829,7 @@ class AsyncStreamingProcessor final : public StreamingProcessor {
 
   ModuleDecoder decoder_;
   AsyncCompileJob* job_;
-  std::unique_ptr<ModuleCompiler::CompilationUnitBuilder>
-      compilation_unit_builder_;
+  std::unique_ptr<CompilationUnitBuilder> compilation_unit_builder_;
   uint32_t next_function_ = 0;
 };
 
@@ -3681,26 +2845,30 @@ AsyncCompileJob::~AsyncCompileJob() {
   for (auto d : deferred_handles_) delete d;
 }
 
-void AsyncCompileJob::AsyncCompileFailed(ErrorThrower& thrower) {
+void AsyncCompileJob::AsyncCompileFailed(Handle<Object> error_reason) {
   if (stream_) stream_->NotifyError();
   // {job} keeps the {this} pointer alive.
   std::shared_ptr<AsyncCompileJob> job =
       isolate_->wasm_engine()->compilation_manager()->RemoveJob(this);
-  RejectPromise(isolate_, context_, thrower, module_promise_);
+  MaybeHandle<Object> promise_result =
+      JSPromise::Reject(module_promise_, error_reason);
+  CHECK_EQ(promise_result.is_null(), isolate_->has_pending_exception());
 }
 
 void AsyncCompileJob::AsyncCompileSucceeded(Handle<Object> result) {
   // {job} keeps the {this} pointer alive.
   std::shared_ptr<AsyncCompileJob> job =
       isolate_->wasm_engine()->compilation_manager()->RemoveJob(this);
-  ResolvePromise(isolate_, context_, module_promise_, result);
+  MaybeHandle<Object> promise_result =
+      JSPromise::Resolve(module_promise_, result);
+  CHECK_EQ(promise_result.is_null(), isolate_->has_pending_exception());
 }
 
 // A closure to run a compilation step (either as foreground or background
 // task) and schedule the next step(s), if any.
 class AsyncCompileJob::CompileStep {
  public:
-  explicit CompileStep(size_t num_background_tasks = 0)
+  explicit CompileStep(int num_background_tasks = 0)
       : num_background_tasks_(num_background_tasks) {}
 
   virtual ~CompileStep() {}
@@ -3721,10 +2889,10 @@ class AsyncCompileJob::CompileStep {
   virtual void RunInForeground() { UNREACHABLE(); }
   virtual void RunInBackground() { UNREACHABLE(); }
 
-  size_t NumberOfBackgroundTasks() { return num_background_tasks_; }
+  int NumberOfBackgroundTasks() { return num_background_tasks_; }
 
   AsyncCompileJob* job_ = nullptr;
-  const size_t num_background_tasks_;
+  const int num_background_tasks_;
 };
 
 class AsyncCompileJob::CompileTask : public CancelableTask {
@@ -3764,20 +2932,11 @@ void AsyncCompileJob::StartBackgroundTask() {
       base::make_unique<CompileTask>(this, false));
 }
 
-void AsyncCompileJob::RestartBackgroundTasks() {
-  size_t num_restarts = stopped_tasks_.Value();
-  stopped_tasks_.Decrement(num_restarts);
-
-  for (size_t i = 0; i < num_restarts; ++i) {
-    StartBackgroundTask();
-  }
-}
-
 template <typename Step, typename... Args>
 void AsyncCompileJob::DoAsync(Args&&... args) {
   NextStep<Step>(std::forward<Args>(args)...);
-  size_t end = step_->NumberOfBackgroundTasks();
-  for (size_t i = 0; i < end; ++i) {
+  int end = step_->NumberOfBackgroundTasks();
+  for (int i = 0; i < end; ++i) {
     StartBackgroundTask();
   }
 }
@@ -3831,7 +2990,7 @@ class AsyncCompileJob::DecodeFail : public CompileStep {
     ErrorThrower thrower(job_->isolate_, "AsyncCompile");
     thrower.CompileFailed("Wasm decoding failed", result_);
     // {job_} is deleted in AsyncCompileFailed, therefore the {return}.
-    return job_->AsyncCompileFailed(thrower);
+    return job_->AsyncCompileFailed(thrower.Reify());
   }
 };
 
@@ -3849,47 +3008,21 @@ class AsyncCompileJob::PrepareAndStartCompile : public CompileStep {
 
   void RunInForeground() override {
     TRACE_COMPILE("(2) Prepare and start compile...\n");
+
+    // Make sure all compilation tasks stopped running. Decoding (async step)
+    // is done.
+    job_->background_task_manager_.CancelAndWait();
+
     Isolate* isolate = job_->isolate_;
-    Factory* factory = isolate->factory();
-
-    Handle<Code> illegal_builtin = BUILTIN_CODE(isolate, Illegal);
-    if (!FLAG_wasm_jit_to_native) {
-      // The {code_table} array contains import wrappers and functions (which
-      // are both included in {functions.size()}.
-      // The results of compilation will be written into it.
-      // Initialize {code_table_} with the illegal builtin. All call sites
-      // will be patched at instantiation.
-      int code_table_size = static_cast<int>(module_->functions.size());
-      job_->code_table_ = factory->NewFixedArray(code_table_size, TENURED);
-
-      for (int i = 0, e = module_->num_imported_functions; i < e; ++i) {
-        job_->code_table_->set(i, *illegal_builtin);
-      }
-    } else {
-      // Just makes it easier to deal with code that wants code_table, while
-      // we have FLAG_wasm_jit_to_native around.
-      job_->code_table_ = factory->NewFixedArray(0, TENURED);
-    }
 
-    job_->module_env_ =
-        CreateDefaultModuleEnv(isolate, module_, illegal_builtin);
+    job_->module_env_ = CreateDefaultModuleEnv(isolate, module_);
 
-    // Transfer ownership of the {WasmModule} to the {ModuleCompiler}, but
-    // keep a pointer.
     Handle<Code> centry_stub = CEntryStub(isolate, 1).GetCode();
     {
       // Now reopen the handles in a deferred scope in order to use
       // them in the concurrent steps.
       DeferredHandleScope deferred(isolate);
-
-      centry_stub = Handle<Code>(*centry_stub, isolate);
-      job_->code_table_ = Handle<FixedArray>(*job_->code_table_, isolate);
-      compiler::ModuleEnv* env = job_->module_env_.get();
-      ReopenHandles(isolate, env->function_code);
-      Handle<Code>* mut =
-          const_cast<Handle<Code>*>(&env->default_function_code);
-      *mut = Handle<Code>(**mut, isolate);
-
+      job_->centry_stub_ = Handle<Code>(*centry_stub, isolate);
       job_->deferred_handles_.push_back(deferred.Detach());
     }
 
@@ -3902,14 +3035,11 @@ class AsyncCompileJob::PrepareAndStartCompile : public CompileStep {
     Handle<FixedArray> export_wrappers =
         job_->isolate_->factory()->NewFixedArray(export_wrapper_size, TENURED);
 
-    job_->compiled_module_ =
-        NewCompiledModule(job_->isolate_, module_, job_->code_table_,
-                          export_wrappers, job_->module_env_.get());
-
-    job_->compiler_.reset(
-        new ModuleCompiler(isolate, module_, centry_stub,
-                           job_->compiled_module_->GetNativeModule()));
-    job_->compiler_->EnableThrottling();
+    job_->compiled_module_ = NewCompiledModule(
+        job_->isolate_, module_, export_wrappers, job_->module_env_.get());
+    job_->compiled_module_->GetNativeModule()
+        ->compilation_state()
+        ->EnableThrottling();
 
     {
       DeferredHandleScope deferred(job_->isolate_);
@@ -3925,129 +3055,64 @@ class AsyncCompileJob::PrepareAndStartCompile : public CompileStep {
       return;
     }
 
-    // Start asynchronous compilation tasks.
-    size_t num_background_tasks =
-        Max(static_cast<size_t>(1),
-            Min(num_functions,
-                Min(static_cast<size_t>(FLAG_wasm_num_compilation_tasks),
-                    V8::GetCurrentPlatform()
-                        ->NumberOfAvailableBackgroundThreads())));
+    CompilationState* compilation_state =
+        job_->compiled_module_->GetNativeModule()->compilation_state();
+    {
+      // Instance field {job_} cannot be captured by copy, therefore
+      // we need to add a local helper variable {job}. We want to
+      // capture the {job} pointer by copy, as it otherwise is dependent
+      // on the current step we are in.
+      AsyncCompileJob* job = job_;
+      compilation_state->AddCallback(
+          [job](CompilationEvent event, Handle<Object> error) {
+            switch (event) {
+              case CompilationEvent::kFinishedBaselineCompilation:
+                if (job->DecrementAndCheckFinisherCount()) {
+                  job->DoSync<FinishCompile>();
+                }
+                return;
+              case CompilationEvent::kFailedCompilation:
+                DeferredHandleScope deferred(job->isolate());
+                error = handle(*error, job->isolate());
+                job->deferred_handles_.push_back(deferred.Detach());
+                job->DoSync<CompileFailed>(error);
+                return;
+            }
+            UNREACHABLE();
+          });
+    }
     if (start_compilation_) {
       // TODO(ahaas): Try to remove the {start_compilation_} check when
       // streaming decoding is done in the background. If
       // InitializeCompilationUnits always returns 0 for streaming compilation,
       // then DoAsync would do the same as NextStep already.
-      job_->outstanding_units_ = job_->compiler_->InitializeCompilationUnits(
-          module_->functions, job_->wire_bytes_, job_->module_env_.get());
 
-      job_->DoAsync<ExecuteAndFinishCompilationUnits>(num_background_tasks);
-    } else {
-      job_->stopped_tasks_ = num_background_tasks;
-      job_->NextStep<ExecuteAndFinishCompilationUnits>(num_background_tasks);
+      size_t functions_count =
+          GetNumFunctionsToCompile(module_->functions, job_->module_env_.get());
+      compilation_state->SetNumberOfFunctionsToCompile(functions_count);
+      // Add compilation units and kick off compilation.
+      InitializeCompilationUnits(module_->functions, job_->wire_bytes_,
+                                 job_->module_env_.get(), job_->centry_stub_,
+                                 job_->compiled_module_->GetNativeModule());
     }
   }
 };
 
 //==========================================================================
-// Step 3 (async x K tasks): Execute compilation units.
+// Step 4b (sync): Compilation failed. Reject Promise.
 //==========================================================================
-class AsyncCompileJob::ExecuteAndFinishCompilationUnits : public CompileStep {
+class AsyncCompileJob::CompileFailed : public CompileStep {
  public:
-  explicit ExecuteAndFinishCompilationUnits(size_t num_compile_tasks)
-      : CompileStep(num_compile_tasks) {}
-
-  void RunInBackground() override {
-    std::function<void()> StartFinishCompilationUnit = [this]() {
-      if (!failed_) job_->StartForegroundTask();
-    };
-
-    TRACE_COMPILE("(3) Compiling...\n");
-    while (job_->compiler_->CanAcceptWork()) {
-      if (failed_) break;
-      DisallowHandleAllocation no_handle;
-      DisallowHeapAllocation no_allocation;
-      if (!job_->compiler_->FetchAndExecuteCompilationUnit(
-              StartFinishCompilationUnit)) {
-        break;
-      }
-    }
-    job_->stopped_tasks_.Increment(1);
-  }
+  explicit CompileFailed(Handle<Object> error_reason)
+      : error_reason_(error_reason) {}
 
   void RunInForeground() override {
-    // TODO(6792): No longer needed once WebAssembly code is off heap.
-    // Use base::Optional to be able to close the scope before we resolve or
-    // reject the promise.
-    base::Optional<CodeSpaceMemoryModificationScope> modification_scope(
-        base::in_place_t(), job_->isolate_->heap());
-    TRACE_COMPILE("(4a) Finishing compilation units...\n");
-    if (failed_) {
-      // The job failed already, no need to do more work.
-      job_->compiler_->SetFinisherIsRunning(false);
-      return;
-    }
-    ErrorThrower thrower(job_->isolate_, "AsyncCompile");
-
-    // We execute for 1 ms and then reschedule the task, same as the GC.
-    double deadline = MonotonicallyIncreasingTimeInMs() + 1.0;
-
-    while (true) {
-      if (job_->compiler_->ShouldIncreaseWorkload()) {
-        job_->RestartBackgroundTasks();
-      }
-
-      int func_index = -1;
-
-      WasmCodeWrapper result =
-          job_->compiler_->FinishCompilationUnit(&thrower, &func_index);
-
-      if (thrower.error()) {
-        // An error was detected, we stop compiling and wait for the
-        // background tasks to finish.
-        failed_ = true;
-        break;
-      } else if (result.is_null()) {
-        // The working queue was empty, we break the loop. If new work units
-        // are enqueued, the background task will start this
-        // FinishCompilationUnits task again.
-        break;
-      } else {
-        DCHECK_LE(0, func_index);
-        if (result.IsCodeObject()) {
-          job_->code_table_->set(func_index, *result.GetCode());
-        }
-        --job_->outstanding_units_;
-      }
-
-      if (deadline < MonotonicallyIncreasingTimeInMs()) {
-        // We reached the deadline. We reschedule this task and return
-        // immediately. Since we rescheduled this task already, we do not set
-        // the FinisherIsRunning flat to false.
-        job_->StartForegroundTask();
-        return;
-      }
-    }
-    // This task finishes without being rescheduled. Therefore we set the
-    // FinisherIsRunning flag to false.
-    job_->compiler_->SetFinisherIsRunning(false);
-    if (thrower.error()) {
-      // Make sure all compilation tasks stopped running.
-      job_->background_task_manager_.CancelAndWait();
-
-      // Close the CodeSpaceMemoryModificationScope before we reject the promise
-      // in AsyncCompileFailed. Promise::Reject calls directly into JavaScript.
-      modification_scope.reset();
-      return job_->AsyncCompileFailed(thrower);
-    }
-    if (job_->outstanding_units_ == 0) {
-      // Make sure all compilation tasks stopped running.
-      job_->background_task_manager_.CancelAndWait();
-      if (job_->DecrementAndCheckFinisherCount()) job_->DoSync<FinishCompile>();
-    }
+    TRACE_COMPILE("(4b) Compilation Failed...\n");
+    return job_->AsyncCompileFailed(error_reason_);
   }
 
  private:
-  std::atomic<bool> failed_{false};
+  Handle<Object> error_reason_;
 };
 
 //==========================================================================
@@ -4056,17 +3121,7 @@ class AsyncCompileJob::ExecuteAndFinishCompilationUnits : public CompileStep {
 class AsyncCompileJob::FinishCompile : public CompileStep {
   void RunInForeground() override {
     TRACE_COMPILE("(5b) Finish compile...\n");
-    if (FLAG_wasm_jit_to_native) {
-      RecordStats(job_->compiled_module_->GetNativeModule(), job_->counters());
-    } else {
-      // At this point, compilation has completed. Update the code table.
-      for (int i = FLAG_skip_compiling_wasm_funcs,
-               e = job_->code_table_->length();
-           i < e; ++i) {
-        Object* val = job_->code_table_->get(i);
-        if (val->IsCode()) RecordStats(Code::cast(val), job_->counters());
-      }
-    }
+    RecordStats(job_->compiled_module_->GetNativeModule(), job_->counters());
 
     // Create heap objects for script and module bytes to be stored in the
     // shared module data. Asm.js is not compiled asynchronously.
@@ -4099,7 +3154,7 @@ class AsyncCompileJob::FinishCompile : public CompileStep {
         WasmSharedModuleData::New(job_->isolate_, module_wrapper,
                                   Handle<SeqOneByteString>::cast(module_bytes),
                                   script, asm_js_offset_table);
-    job_->compiled_module_->OnWasmModuleDecodingComplete(shared);
+    job_->compiled_module_->set_shared(*shared);
     script->set_wasm_compiled_module(*job_->compiled_module_);
 
     // Finish the wasm script now and make it public to the debugger.
@@ -4161,16 +3216,15 @@ void AsyncStreamingProcessor::FinishAsyncCompileJobWithError(ResultBase error) {
   ModuleResult result(nullptr);
   result.MoveErrorFrom(error);
 
-  // Check if there is already a ModuleCompiler, in which case we have to clean
-  // it up as well.
-  if (job_->compiler_) {
-    // If {IsFinisherRunning} is true, then there is already a foreground task
-    // in the task queue to execute the DecodeFail step. We do not have to start
-    // a new task ourselves with DoSync.
-    if (job_->compiler_->IsFinisherRunning()) {
-      job_->NextStep<AsyncCompileJob::DecodeFail>(std::move(result));
-    } else {
+  // Check if there is already a CompiledModule, in which case we have to clean
+  // up the CompilationState as well.
+  if (!job_->compiled_module_.is_null()) {
+    job_->compiled_module_->GetNativeModule()->compilation_state()->Abort();
+
+    if (job_->num_pending_foreground_tasks_ == 0) {
       job_->DoSync<AsyncCompileJob::DecodeFail>(std::move(result));
+    } else {
+      job_->NextStep<AsyncCompileJob::DecodeFail>(std::move(result));
     }
 
     // Clear the {compilation_unit_builder_} if it exists. This is needed
@@ -4201,17 +3255,22 @@ bool AsyncStreamingProcessor::ProcessSection(SectionCode section_code,
                                              uint32_t offset) {
   TRACE_STREAMING("Process section %d ...\n", section_code);
   if (compilation_unit_builder_) {
-    // We reached a section after the code section, we do not need the the
+    // We reached a section after the code section, we do not need the
     // compilation_unit_builder_ anymore.
     CommitCompilationUnits();
     compilation_unit_builder_.reset();
   }
   if (section_code == SectionCode::kUnknownSectionCode) {
-    // No need to decode unknown sections, even the names section. If decoding
-    // of the unknown section fails, compilation should succeed anyways, and
-    // even decoding the names section is unnecessary because the result comes
-    // too late for streaming compilation.
-    return true;
+    Decoder decoder(bytes, offset);
+    section_code = ModuleDecoder::IdentifyUnknownSection(
+        decoder, bytes.start() + bytes.length());
+    if (section_code == SectionCode::kUnknownSectionCode) {
+      // Skip unknown sections that we do not know how to handle.
+      return true;
+    }
+    // Remove the unknown section tag from the payload bytes.
+    offset += decoder.position();
+    bytes = bytes.SubVector(decoder.position(), bytes.size());
   }
   constexpr bool verify_functions = false;
   decoder_.DecodeSection(section_code, bytes, offset, verify_functions);
@@ -4242,12 +3301,15 @@ bool AsyncStreamingProcessor::ProcessCodeSectionHeader(size_t functions_count,
   constexpr bool on_foreground = true;
   job_->step_->Run(on_foreground);
 
-  job_->outstanding_units_ = functions_count;
+  NativeModule* native_module = job_->compiled_module_->GetNativeModule();
+  native_module->compilation_state()->SetNumberOfFunctionsToCompile(
+      functions_count);
+
   // Set outstanding_finishers_ to 2, because both the AsyncCompileJob and the
   // AsyncStreamingProcessor have to finish.
   job_->outstanding_finishers_.SetValue(2);
-  compilation_unit_builder_.reset(
-      new ModuleCompiler::CompilationUnitBuilder(job_->compiler_.get()));
+  compilation_unit_builder_.reset(new CompilationUnitBuilder(
+      native_module, job_->module_env_.get(), job_->centry_stub_));
   return true;
 }
 
@@ -4263,9 +3325,7 @@ bool AsyncStreamingProcessor::ProcessFunctionBody(Vector<const uint8_t> bytes,
     uint32_t index = next_function_ + decoder_.module()->num_imported_functions;
     const WasmFunction* func = &decoder_.module()->functions[index];
     WasmName name = {nullptr, 0};
-    compilation_unit_builder_->AddUnit(
-        job_->module_env_.get(), job_->compiled_module_->GetNativeModule(),
-        func, offset, bytes, name);
+    compilation_unit_builder_->AddUnit(func, offset, bytes, name);
   }
   ++next_function_;
   // This method always succeeds. The return value is necessary to comply with
@@ -4275,10 +3335,7 @@ bool AsyncStreamingProcessor::ProcessFunctionBody(Vector<const uint8_t> bytes,
 
 void AsyncStreamingProcessor::CommitCompilationUnits() {
   DCHECK(compilation_unit_builder_);
-  if (compilation_unit_builder_->Commit()) {
-    // Only restart background tasks when compilation units were committed.
-    job_->RestartBackgroundTasks();
-  }
+  compilation_unit_builder_->Commit();
 }
 
 void AsyncStreamingProcessor::OnFinishedChunk() {
@@ -4297,7 +3354,7 @@ void AsyncStreamingProcessor::OnFinishedStream(std::unique_ptr<uint8_t[]> bytes,
   DCHECK(result.ok());
   job_->module_ = std::move(result.val);
   if (job_->DecrementAndCheckFinisherCount()) {
-    if (!job_->compiler_) {
+    if (job_->compiled_module_.is_null()) {
       // We are processing a WebAssembly module without code section. We need to
       // prepare compilation first before we can finish it.
       // {PrepareAndStartCompile} will call {FinishCompile} by itself if there
@@ -4321,6 +3378,240 @@ void AsyncStreamingProcessor::OnAbort() {
   job_->Abort();
 }
 
+CompilationState::CodeGenerationSchedule::CodeGenerationSchedule(
+    base::RandomNumberGenerator* random_number_generator, size_t max_memory)
+    : random_number_generator_(random_number_generator),
+      max_memory_(max_memory) {
+  DCHECK_NOT_NULL(random_number_generator_);
+  DCHECK_GT(max_memory_, 0);
+}
+
+void CompilationState::CodeGenerationSchedule::Schedule(
+    std::unique_ptr<compiler::WasmCompilationUnit>&& item) {
+  size_t cost = item->memory_cost();
+  schedule_.push_back(std::move(item));
+  allocated_memory_.Increment(cost);
+}
+
+bool CompilationState::CodeGenerationSchedule::CanAcceptWork() const {
+  return !throttle_ || allocated_memory_.Value() <= max_memory_;
+}
+
+bool CompilationState::CodeGenerationSchedule::ShouldIncreaseWorkload() const {
+  // Half the memory is unused again, we can increase the workload again.
+  return !throttle_ || allocated_memory_.Value() <= max_memory_ / 2;
+}
+
+std::unique_ptr<compiler::WasmCompilationUnit>
+CompilationState::CodeGenerationSchedule::GetNext() {
+  DCHECK(!IsEmpty());
+  size_t index = GetRandomIndexInSchedule();
+  auto ret = std::move(schedule_[index]);
+  std::swap(schedule_[schedule_.size() - 1], schedule_[index]);
+  schedule_.pop_back();
+  allocated_memory_.Decrement(ret->memory_cost());
+  return ret;
+}
+
+size_t CompilationState::CodeGenerationSchedule::GetRandomIndexInSchedule() {
+  double factor = random_number_generator_->NextDouble();
+  size_t index = (size_t)(factor * schedule_.size());
+  DCHECK_GE(index, 0);
+  DCHECK_LT(index, schedule_.size());
+  return index;
+}
+
+void CompilationStateDeleter::operator()(
+    CompilationState* compilation_state) const {
+  delete compilation_state;
+}
+
+std::unique_ptr<CompilationState, CompilationStateDeleter> NewCompilationState(
+    Isolate* isolate) {
+  return std::unique_ptr<CompilationState, CompilationStateDeleter>(
+      new CompilationState(isolate));
+}
+
+void SetCompiledModule(CompilationState* compilation_state,
+                       Handle<WasmCompiledModule> compiled_module) {
+  compilation_state->SetCompiledModule(compiled_module);
+}
+
+CompilationState::CompilationState(internal::Isolate* isolate)
+    : isolate_(isolate),
+      executed_units_(isolate->random_number_generator(),
+                      GetMaxUsableMemorySize(isolate) / 2) {
+  v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate_);
+  v8::Platform* platform = V8::GetCurrentPlatform();
+  foreground_task_runner_ = platform->GetForegroundTaskRunner(v8_isolate);
+  background_task_runner_ = platform->GetWorkerThreadsTaskRunner(v8_isolate);
+
+  // Register task manager for clean shutdown in case of an isolate shutdown.
+  isolate_->wasm_engine()->Register(&background_task_manager_);
+}
+
+CompilationState::~CompilationState() {
+  CancelAndWait();
+  foreground_task_manager_.CancelAndWait();
+
+  if (compiled_module_ != nullptr) {
+    isolate_->global_handles()->Destroy(
+        reinterpret_cast<Object**>(compiled_module_));
+    compiled_module_ = nullptr;
+  }
+}
+
+void CompilationState::SetNumberOfFunctionsToCompile(size_t num_functions) {
+  if (!failed_) {
+    outstanding_units_ = num_functions;
+  }
+}
+
+void CompilationState::AddCallback(
+    std::function<void(CompilationEvent, Handle<Object>)> callback) {
+  callbacks_.push_back(callback);
+}
+
+void CompilationState::AddCompilationUnits(
+    std::vector<std::unique_ptr<compiler::WasmCompilationUnit>>& units) {
+  {
+    base::LockGuard<base::Mutex> guard(&compilation_units_mutex_);
+    compilation_units_.insert(compilation_units_.end(),
+                              std::make_move_iterator(units.begin()),
+                              std::make_move_iterator(units.end()));
+  }
+  StartCompilation(units.size());
+}
+
+std::unique_ptr<compiler::WasmCompilationUnit>
+CompilationState::GetNextCompilationUnit() {
+  base::LockGuard<base::Mutex> guard(&compilation_units_mutex_);
+  if (!compilation_units_.empty()) {
+    std::unique_ptr<compiler::WasmCompilationUnit> unit =
+        std::move(compilation_units_.back());
+    compilation_units_.pop_back();
+    return unit;
+  }
+
+  return std::unique_ptr<compiler::WasmCompilationUnit>();
+}
+
+std::unique_ptr<compiler::WasmCompilationUnit>
+CompilationState::GetNextExecutedUnit() {
+  base::LockGuard<base::Mutex> guard(&result_mutex_);
+  if (!executed_units_.IsEmpty()) {
+    return executed_units_.GetNext();
+  }
+
+  return std::unique_ptr<compiler::WasmCompilationUnit>();
+}
+
+bool CompilationState::HasCompilationUnitToFinish() {
+  base::LockGuard<base::Mutex> guard(&result_mutex_);
+  return !executed_units_.IsEmpty();
+}
+
+void CompilationState::OnError(Handle<Object> error,
+                               NotifyCompilationCallback notify) {
+  failed_ = true;
+  CancelAndWait();
+  if (notify == NotifyCompilationCallback::kNotify) {
+    NotifyOnEvent(CompilationEvent::kFailedCompilation, error);
+  }
+}
+
+void CompilationState::OnFinishedUnit(NotifyCompilationCallback notify) {
+  DCHECK_GT(outstanding_units_, 0);
+  --outstanding_units_;
+
+  if (outstanding_units_ == 0) {
+    CancelAndWait();
+    if (notify == NotifyCompilationCallback::kNotify) {
+      NotifyOnEvent(CompilationEvent::kFinishedBaselineCompilation,
+                    Handle<Object>::null());
+    }
+  }
+}
+
+void CompilationState::ScheduleUnitForFinishing(
+    std::unique_ptr<compiler::WasmCompilationUnit>& unit) {
+  base::LockGuard<base::Mutex> guard(&result_mutex_);
+  executed_units_.Schedule(std::move(unit));
+
+  if (!finisher_is_running_ && !failed_) {
+    ScheduleFinisherTask();
+    // We set the flag here so that not more than one finisher is started.
+    finisher_is_running_ = true;
+  }
+}
+
+void CompilationState::CancelAndWait() {
+  background_task_manager_.CancelAndWait();
+  isolate_->wasm_engine()->Unregister(&background_task_manager_);
+}
+
+void CompilationState::OnBackgroundTaskStopped() {
+  base::LockGuard<base::Mutex> guard(&tasks_mutex_);
+  ++stopped_compilation_tasks_;
+  DCHECK_LE(stopped_compilation_tasks_, num_background_tasks_);
+}
+
+void CompilationState::RestartBackgroundTasks() {
+  base::LockGuard<base::Mutex> guard(&tasks_mutex_);
+  // TODO(wasm): Do not start more background tasks than the number of available
+  // units in {compilation_units_}.
+  for (; stopped_compilation_tasks_ > 0; --stopped_compilation_tasks_) {
+    background_task_runner_->PostTask(base::make_unique<BackgroundCompileTask>(
+        this, &background_task_manager_));
+  }
+}
+
+bool CompilationState::SetFinisherIsRunning(bool value) {
+  base::LockGuard<base::Mutex> guard(&result_mutex_);
+  if (finisher_is_running_ == value) return false;
+  finisher_is_running_ = value;
+  return true;
+}
+
+void CompilationState::ScheduleFinisherTask() {
+  foreground_task_runner_->PostTask(
+      base::make_unique<FinishCompileTask>(this, &foreground_task_manager_));
+}
+
+void CompilationState::Abort() {
+  CancelAndWait();
+  failed_ = true;
+}
+
+void CompilationState::StartCompilation(size_t num_functions) {
+  if (num_background_tasks_ == 0) {
+    DCHECK_EQ(stopped_compilation_tasks_, num_background_tasks_);
+
+    // {outstanding_units_} has to be initialized before entering.
+    DCHECK_LE(num_functions, outstanding_units_);
+
+    // First set up. Initialize {num_background_tasks_} and
+    // {stopped_compilation_tasks_}
+    num_background_tasks_ =
+        Max(1, Min(static_cast<int>(outstanding_units_),
+                   Min(FLAG_wasm_num_compilation_tasks,
+                       V8::GetCurrentPlatform()->NumberOfWorkerThreads())));
+    {
+      base::LockGuard<base::Mutex> guard(&tasks_mutex_);
+      stopped_compilation_tasks_ = num_background_tasks_;
+    }
+  }
+
+  RestartBackgroundTasks();
+}
+
+void CompilationState::NotifyOnEvent(CompilationEvent event,
+                                     Handle<Object> error) {
+  for (auto& callback_function : callbacks_) {
+    callback_function(event, error);
+  }
+}
+
 void CompileJsToWasmWrappers(Isolate* isolate,
                              Handle<WasmCompiledModule> compiled_module,
                              Counters* counters) {
@@ -4328,13 +3619,11 @@ void CompileJsToWasmWrappers(Isolate* isolate,
   int wrapper_index = 0;
   Handle<FixedArray> export_wrappers(compiled_module->export_wrappers(),
                                      isolate);
-  Handle<FixedArray> code_table(compiled_module->code_table(), isolate);
   NativeModule* native_module = compiled_module->GetNativeModule();
   for (auto exp : compiled_module->shared()->module()->export_table) {
     if (exp.kind != kExternalFunction) continue;
-    WasmCodeWrapper wasm_code =
-        EnsureExportedLazyDeoptData(isolate, Handle<WasmInstanceObject>::null(),
-                                    code_table, native_module, exp.index);
+    wasm::WasmCode* wasm_code =
+        EnsureExportedLazyDeoptData(isolate, native_module, exp.index);
     Handle<Code> wrapper_code = js_to_wasm_cache.CloneOrCompileJSToWasmWrapper(
         isolate, compiled_module->shared()->module(), wasm_code, exp.index,
         compiled_module->use_trap_handler());
diff --git a/deps/v8/src/wasm/module-compiler.h b/deps/v8/src/wasm/module-compiler.h
index 3a8b1972d67..3314142ee7a 100644
--- a/deps/v8/src/wasm/module-compiler.h
+++ b/deps/v8/src/wasm/module-compiler.h
@@ -22,35 +22,34 @@ namespace wasm {
 
 class ModuleCompiler;
 class WasmCode;
+class CompilationState;
 
-V8_EXPORT_PRIVATE MaybeHandle<WasmModuleObject> SyncCompileTranslatedAsmJs(
-    Isolate* isolate, ErrorThrower* thrower, const ModuleWireBytes& bytes,
-    Handle<Script> asm_js_script, Vector<const byte> asm_js_offset_table_bytes);
+struct CompilationStateDeleter {
+  void operator()(CompilationState* compilation_state) const;
+};
+
+// Wrapper to create a CompilationState exists in order to avoid having
+// the the CompilationState in the header file.
+std::unique_ptr<CompilationState, CompilationStateDeleter> NewCompilationState(
+    Isolate* isolate);
+
+void SetCompiledModule(CompilationState* compilation_state,
+                       Handle<WasmCompiledModule> compiled_module);
 
-V8_EXPORT_PRIVATE MaybeHandle<WasmModuleObject> SyncCompile(
-    Isolate* isolate, ErrorThrower* thrower, const ModuleWireBytes& bytes);
+MaybeHandle<WasmModuleObject> CompileToModuleObject(
+    Isolate* isolate, ErrorThrower* thrower, std::unique_ptr<WasmModule> module,
+    const ModuleWireBytes& wire_bytes, Handle<Script> asm_js_script,
+    Vector<const byte> asm_js_offset_table_bytes);
 
-V8_EXPORT_PRIVATE MaybeHandle<WasmInstanceObject> SyncInstantiate(
+MaybeHandle<WasmInstanceObject> InstantiateToInstanceObject(
     Isolate* isolate, ErrorThrower* thrower,
     Handle<WasmModuleObject> module_object, MaybeHandle<JSReceiver> imports,
     MaybeHandle<JSArrayBuffer> memory);
 
-V8_EXPORT_PRIVATE MaybeHandle<WasmInstanceObject> SyncCompileAndInstantiate(
-    Isolate* isolate, ErrorThrower* thrower, const ModuleWireBytes& bytes,
-    MaybeHandle<JSReceiver> imports, MaybeHandle<JSArrayBuffer> memory);
-
-V8_EXPORT_PRIVATE void AsyncCompile(Isolate* isolate, Handle<JSPromise> promise,
-                                    const ModuleWireBytes& bytes,
-                                    bool is_shared);
-
-V8_EXPORT_PRIVATE void AsyncInstantiate(Isolate* isolate,
-                                        Handle<JSPromise> promise,
-                                        Handle<WasmModuleObject> module_object,
-                                        MaybeHandle<JSReceiver> imports);
-
-V8_EXPORT_PRIVATE void CompileJsToWasmWrappers(
-    Isolate* isolate, Handle<WasmCompiledModule> compiled_module,
-    Counters* counters);
+V8_EXPORT_PRIVATE
+void CompileJsToWasmWrappers(Isolate* isolate,
+                             Handle<WasmCompiledModule> compiled_module,
+                             Counters* counters);
 
 V8_EXPORT_PRIVATE Handle<Script> CreateWasmScript(
     Isolate* isolate, const ModuleWireBytes& wire_bytes);
@@ -65,7 +64,6 @@ V8_EXPORT_PRIVATE Handle<Script> CreateWasmScript(
 // which will be triggered when returning from the runtime function, i.e. the
 // Illegal builtin will never be called.
 Address CompileLazy(Isolate* isolate);
-Handle<Code> CompileLazyOnGCHeap(Isolate* isolate);
 
 // This class orchestrates the lazy compilation of wasm functions. It is
 // triggered by the WasmCompileLazy builtin.
@@ -79,9 +77,6 @@ class LazyCompilationOrchestrator {
                                   int func_index);
 
  public:
-  Handle<Code> CompileLazyOnGCHeap(Isolate*, Handle<WasmInstanceObject>,
-                                   Handle<Code> caller, int call_offset,
-                                   int exported_func_index, bool patch_caller);
   const wasm::WasmCode* CompileFromJsToWasm(Isolate*,
                                             Handle<WasmInstanceObject>,
                                             Handle<Code> caller,
@@ -138,7 +133,7 @@ class AsyncCompileJob {
   class DecodeModule;
   class DecodeFail;
   class PrepareAndStartCompile;
-  class ExecuteAndFinishCompilationUnits;
+  class CompileFailed;
   class WaitForBackgroundTasks;
   class FinishCompilationUnits;
   class FinishCompile;
@@ -151,7 +146,7 @@ class AsyncCompileJob {
   }
   Counters* counters() const { return async_counters().get(); }
 
-  void AsyncCompileFailed(ErrorThrower& thrower);
+  void AsyncCompileFailed(Handle<Object> error_reason);
 
   void AsyncCompileSucceeded(Handle<Object> result);
 
@@ -159,8 +154,6 @@ class AsyncCompileJob {
 
   void StartBackgroundTask();
 
-  void RestartBackgroundTasks();
-
   // Switches to the compilation step {Step} and starts a foreground task to
   // execute it.
   template <typename Step, typename... Args>
@@ -186,22 +179,19 @@ class AsyncCompileJob {
   ModuleWireBytes wire_bytes_;
   Handle<Context> context_;
   Handle<JSPromise> module_promise_;
-  std::unique_ptr<ModuleCompiler> compiler_;
   std::unique_ptr<compiler::ModuleEnv> module_env_;
   std::unique_ptr<WasmModule> module_;
 
   std::vector<DeferredHandles*> deferred_handles_;
   Handle<WasmModuleObject> module_object_;
   Handle<WasmCompiledModule> compiled_module_;
-  Handle<FixedArray> code_table_;
-  size_t outstanding_units_ = 0;
+
   std::unique_ptr<CompileStep> step_;
   CancelableTaskManager background_task_manager_;
+  Handle<Code> centry_stub_;
 
   std::shared_ptr<v8::TaskRunner> foreground_task_runner_;
   std::shared_ptr<v8::TaskRunner> background_task_runner_;
-  // The number of background tasks which stopped executing within a step.
-  base::AtomicNumber<size_t> stopped_tasks_{0};
 
   // For async compilation the AsyncCompileJob is the only finisher. For
   // streaming compilation also the AsyncStreamingProcessor has to finish before
@@ -224,7 +214,6 @@ class AsyncCompileJob {
   // StreamingDecoder.
   std::shared_ptr<StreamingDecoder> stream_;
 };
-
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/module-decoder.cc b/deps/v8/src/wasm/module-decoder.cc
index 010f1912630..b033dae18b3 100644
--- a/deps/v8/src/wasm/module-decoder.cc
+++ b/deps/v8/src/wasm/module-decoder.cc
@@ -91,6 +91,12 @@ const char* SectionName(SectionCode code) {
 
 namespace {
 
+bool validate_utf8(Decoder* decoder, WireBytesRef string) {
+  return unibrow::Utf8::ValidateEncoding(
+      decoder->start() + decoder->GetBufferRelativeOffset(string.offset()),
+      string.length());
+}
+
 ValueType TypeOf(const WasmModule* module, const WasmInitExpr& expr) {
   switch (expr.kind) {
     case WasmInitExpr::kNone:
@@ -212,25 +218,11 @@ class WasmSectionIterator {
 
     if (section_code == kUnknownSectionCode) {
       // Check for the known "name" section.
-      WireBytesRef string =
-          wasm::consume_string(decoder_, true, "section name");
-      if (decoder_.failed() || decoder_.pc() > section_end_) {
-        section_code_ = kUnknownSectionCode;
-        return;
-      }
-      const byte* section_name_start =
-          decoder_.start() + decoder_.GetBufferRelativeOffset(string.offset());
+      section_code =
+          ModuleDecoder::IdentifyUnknownSection(decoder_, section_end_);
+      // As a side effect, the above function will forward the decoder to after
+      // the identifier string.
       payload_start_ = decoder_.pc();
-
-      TRACE("  +%d  section name        : \"%.*s\"\n",
-            static_cast<int>(section_name_start - decoder_.start()),
-            string.length() < 20 ? string.length() : 20, section_name_start);
-
-      if (string.length() == num_chars(kNameString) &&
-          strncmp(reinterpret_cast<const char*>(section_name_start),
-                  kNameString, num_chars(kNameString)) == 0) {
-        section_code = kNameSectionCode;
-      }
     } else if (!IsValidSectionCode(section_code)) {
       decoder_.errorf(decoder_.pc(), "unknown section code #0x%02x",
                       section_code);
@@ -270,7 +262,7 @@ class ModuleDecoderImpl : public Decoder {
     pc_ = end_;  // On error, terminate section decoding loop.
   }
 
-  void DumpModule(const ModuleResult& result) {
+  void DumpModule(const Vector<const byte> module_bytes) {
     std::string path;
     if (FLAG_dump_wasm_module_path) {
       path = FLAG_dump_wasm_module_path;
@@ -280,12 +272,13 @@ class ModuleDecoderImpl : public Decoder {
       }
     }
     // File are named `HASH.{ok,failed}.wasm`.
-    size_t hash = base::hash_range(start_, end_);
+    size_t hash = base::hash_range(module_bytes.start(), module_bytes.end());
     EmbeddedVector<char, 32> buf;
-    SNPrintF(buf, "%016zx.%s.wasm", hash, result.ok() ? "ok" : "failed");
+    SNPrintF(buf, "%016zx.%s.wasm", hash, ok() ? "ok" : "failed");
     std::string name(buf.start());
     if (FILE* wasm_file = base::OS::FOpen((path + name).c_str(), "wb")) {
-      if (fwrite(start_, end_ - start_, 1, wasm_file) != 1) {
+      if (fwrite(module_bytes.start(), module_bytes.length(), 1, wasm_file) !=
+          1) {
         OFStream os(stderr);
         os << "Error while dumping wasm file" << std::endl;
       }
@@ -467,7 +460,6 @@ class ModuleDecoderImpl : public Decoder {
           module_->functions.push_back({nullptr,        // sig
                                         import->index,  // func_index
                                         0,              // sig_index
-                                        {0, 0},         // name_offset
                                         {0, 0},         // code
                                         true,           // imported
                                         false});        // exported
@@ -534,7 +526,6 @@ class ModuleDecoderImpl : public Decoder {
       module_->functions.push_back({nullptr,     // sig
                                     func_index,  // func_index
                                     0,           // sig_index
-                                    {0, 0},      // name
                                     {0, 0},      // code
                                     false,       // imported
                                     false});     // exported
@@ -793,35 +784,13 @@ class ModuleDecoderImpl : public Decoder {
       uint32_t name_payload_len = inner.consume_u32v("name payload length");
       if (!inner.checkAvailable(name_payload_len)) break;
 
-      // Decode function names, ignore the rest.
-      // Local names will be decoded when needed.
-      switch (name_type) {
-        case NameSectionKindCode::kModule: {
-          WireBytesRef name = wasm::consume_string(inner, false, "module name");
-          if (inner.ok() && validate_utf8(&inner, name)) module_->name = name;
-          break;
-        }
-        case NameSectionKindCode::kFunction: {
-          uint32_t functions_count = inner.consume_u32v("functions count");
-
-          for (; inner.ok() && functions_count > 0; --functions_count) {
-            uint32_t function_index = inner.consume_u32v("function index");
-            WireBytesRef name =
-                wasm::consume_string(inner, false, "function name");
-
-            // Be lenient with errors in the name section: Ignore illegal
-            // or out-of-order indexes and non-UTF8 names. You can even assign
-            // to the same function multiple times (last valid one wins).
-            if (inner.ok() && function_index < module_->functions.size() &&
-                validate_utf8(&inner, name)) {
-              module_->functions[function_index].name = name;
-            }
-          }
-          break;
-        }
-        default:
-          inner.consume_bytes(name_payload_len, "name subsection payload");
-          break;
+      // Decode module name, ignore the rest.
+      // Function and local names will be decoded when needed.
+      if (name_type == NameSectionKindCode::kModule) {
+        WireBytesRef name = wasm::consume_string(inner, false, "module name");
+        if (inner.ok() && validate_utf8(&inner, name)) module_->name = name;
+      } else {
+        inner.consume_bytes(name_payload_len, "name subsection payload");
       }
     }
     // Skip the whole names section in the outer decoder.
@@ -848,7 +817,6 @@ class ModuleDecoderImpl : public Decoder {
       // Copy error code and location.
       result.MoveErrorFrom(intermediate_result_);
     }
-    if (FLAG_dump_wasm_module) DumpModule(result);
     return result;
   }
 
@@ -856,6 +824,7 @@ class ModuleDecoderImpl : public Decoder {
   ModuleResult DecodeModule(Isolate* isolate, bool verify_functions = true) {
     StartDecoding(isolate);
     uint32_t offset = 0;
+    Vector<const byte> orig_bytes(start(), end() - start());
     DecodeModuleHeader(Vector<const uint8_t>(start(), end() - start()), offset);
     if (failed()) {
       return FinishDecoding(verify_functions);
@@ -878,6 +847,8 @@ class ModuleDecoderImpl : public Decoder {
       section_iter.advance(true);
     }
 
+    if (FLAG_dump_wasm_module) DumpModule(orig_bytes);
+
     if (decoder.failed()) {
       return decoder.toResult<std::unique_ptr<WasmModule>>(nullptr);
     }
@@ -892,7 +863,6 @@ class ModuleDecoderImpl : public Decoder {
                                       std::unique_ptr<WasmFunction> function) {
     pc_ = start_;
     function->sig = consume_sig(zone);
-    function->name = {0, 0};
     function->code = {off(pc_), static_cast<uint32_t>(end_ - pc_)};
 
     if (ok())
@@ -1036,7 +1006,8 @@ class ModuleDecoderImpl : public Decoder {
   void VerifyFunctionBody(AccountingAllocator* allocator, uint32_t func_num,
                           const ModuleWireBytes& wire_bytes,
                           const WasmModule* module, WasmFunction* function) {
-    WasmFunctionName func_name(function, wire_bytes.GetNameOrNull(function));
+    WasmFunctionName func_name(function,
+                               wire_bytes.GetNameOrNull(function, module));
     if (FLAG_trace_wasm_decoder || FLAG_trace_wasm_decode_time) {
       OFStream os(stdout);
       os << "Verifying wasm function " << func_name << std::endl;
@@ -1064,12 +1035,6 @@ class ModuleDecoderImpl : public Decoder {
     return wasm::consume_string(*this, validate_utf8, name);
   }
 
-  bool validate_utf8(Decoder* decoder, WireBytesRef string) {
-    return unibrow::Utf8::ValidateEncoding(
-        decoder->start() + decoder->GetBufferRelativeOffset(string.offset()),
-        string.length());
-  }
-
   uint32_t consume_sig_index(WasmModule* module, FunctionSig** sig) {
     const byte* pos = pc_;
     uint32_t sig_index = consume_u32v("signature index");
@@ -1279,10 +1244,14 @@ class ModuleDecoderImpl : public Decoder {
       case kLocalF64:
         return kWasmF64;
       default:
-        if (IsWasm() && FLAG_experimental_wasm_simd) {
+        if (IsWasm()) {
           switch (t) {
             case kLocalS128:
-              return kWasmS128;
+              if (FLAG_experimental_wasm_simd) return kWasmS128;
+              break;
+            case kLocalAnyRef:
+              if (FLAG_experimental_wasm_anyref) return kWasmAnyRef;
+              break;
             default:
               break;
           }
@@ -1413,6 +1382,27 @@ ModuleResult ModuleDecoder::FinishDecoding(bool verify_functions) {
   return impl_->FinishDecoding(verify_functions);
 }
 
+SectionCode ModuleDecoder::IdentifyUnknownSection(Decoder& decoder,
+                                                  const byte* end) {
+  WireBytesRef string = wasm::consume_string(decoder, true, "section name");
+  if (decoder.failed() || decoder.pc() > end) {
+    return kUnknownSectionCode;
+  }
+  const byte* section_name_start =
+      decoder.start() + decoder.GetBufferRelativeOffset(string.offset());
+
+  TRACE("  +%d  section name        : \"%.*s\"\n",
+        static_cast<int>(section_name_start - decoder.start()),
+        string.length() < 20 ? string.length() : 20, section_name_start);
+
+  if (string.length() == num_chars(kNameString) &&
+      strncmp(reinterpret_cast<const char*>(section_name_start), kNameString,
+              num_chars(kNameString)) == 0) {
+    return kNameSectionCode;
+  }
+  return kUnknownSectionCode;
+}
+
 bool ModuleDecoder::ok() { return impl_->ok(); }
 
 ModuleResult SyncDecodeWasmModule(Isolate* isolate, const byte* module_start,
@@ -1571,13 +1561,10 @@ std::vector<CustomSectionOffset> DecodeCustomSections(const byte* start,
   return result;
 }
 
-void DecodeLocalNames(const byte* module_start, const byte* module_end,
-                      LocalNames* result) {
-  DCHECK_NOT_NULL(result);
-  DCHECK(result->names.empty());
+namespace {
 
+bool FindSection(Decoder& decoder, SectionCode section_code) {
   static constexpr int kModuleHeaderSize = 8;
-  Decoder decoder(module_start, module_end);
   decoder.consume_bytes(kModuleHeaderSize, "module header");
 
   WasmSectionIterator section_iter(decoder);
@@ -1586,10 +1573,57 @@ void DecodeLocalNames(const byte* module_start, const byte* module_end,
          section_iter.section_code() != kNameSectionCode) {
     section_iter.advance(true);
   }
-  if (!section_iter.more()) return;
+  if (!section_iter.more()) return false;
 
   // Reset the decoder to not read beyond the name section end.
   decoder.Reset(section_iter.payload(), decoder.pc_offset());
+  return true;
+}
+
+}  // namespace
+
+void DecodeFunctionNames(const byte* module_start, const byte* module_end,
+                         std::unordered_map<uint32_t, WireBytesRef>* names) {
+  DCHECK_NOT_NULL(names);
+  DCHECK(names->empty());
+
+  Decoder decoder(module_start, module_end);
+  if (!FindSection(decoder, kNameSectionCode)) return;
+
+  while (decoder.ok() && decoder.more()) {
+    uint8_t name_type = decoder.consume_u8("name type");
+    if (name_type & 0x80) break;  // no varuint7
+
+    uint32_t name_payload_len = decoder.consume_u32v("name payload length");
+    if (!decoder.checkAvailable(name_payload_len)) break;
+
+    if (name_type != NameSectionKindCode::kFunction) {
+      decoder.consume_bytes(name_payload_len, "name subsection payload");
+      continue;
+    }
+    uint32_t functions_count = decoder.consume_u32v("functions count");
+
+    for (; decoder.ok() && functions_count > 0; --functions_count) {
+      uint32_t function_index = decoder.consume_u32v("function index");
+      WireBytesRef name = wasm::consume_string(decoder, false, "function name");
+
+      // Be lenient with errors in the name section: Ignore non-UTF8 names. You
+      // can even assign to the same function multiple times (last valid one
+      // wins).
+      if (decoder.ok() && validate_utf8(&decoder, name)) {
+        names->insert(std::make_pair(function_index, name));
+      }
+    }
+  }
+}
+
+void DecodeLocalNames(const byte* module_start, const byte* module_end,
+                      LocalNames* result) {
+  DCHECK_NOT_NULL(result);
+  DCHECK(result->names.empty());
+
+  Decoder decoder(module_start, module_end);
+  if (!FindSection(decoder, kNameSectionCode)) return;
 
   while (decoder.ok() && decoder.more()) {
     uint8_t name_type = decoder.consume_u8("name type");
diff --git a/deps/v8/src/wasm/module-decoder.h b/deps/v8/src/wasm/module-decoder.h
index f98a5ed66df..d7ce2c679a7 100644
--- a/deps/v8/src/wasm/module-decoder.h
+++ b/deps/v8/src/wasm/module-decoder.h
@@ -107,6 +107,12 @@ V8_EXPORT_PRIVATE std::vector<CustomSectionOffset> DecodeCustomSections(
 AsmJsOffsetsResult DecodeAsmJsOffsets(const byte* module_start,
                                       const byte* module_end);
 
+// Decode the function names from the name section.
+// Returns the result as an unordered map. Only names with valid utf8 encoding
+// are stored and conflicts are resolved by choosing the last name read.
+void DecodeFunctionNames(const byte* module_start, const byte* module_end,
+                         std::unordered_map<uint32_t, WireBytesRef>* names);
+
 // Decode the local names assignment from the name section.
 // Stores the result in the given {LocalNames} structure. The result will be
 // empty if no name section is present. On encountering an error in the name
@@ -140,6 +146,16 @@ class ModuleDecoder {
 
   bool ok();
 
+  // Translates the unknown section that decoder is pointing to to an extended
+  // SectionCode if the unknown section is known to decoder. Currently this only
+  // handles the name section.
+  // The decoder is expected to point after the section lenght and just before
+  // the identifier string of the unknown section.
+  // If a SectionCode other than kUnknownSectionCode is returned, the decoder
+  // will point right after the identifier string. Otherwise, the position is
+  // undefined.
+  static SectionCode IdentifyUnknownSection(Decoder& decoder, const byte* end);
+
  private:
   std::unique_ptr<ModuleDecoderImpl> impl_;
 };
diff --git a/deps/v8/src/wasm/wasm-api.cc b/deps/v8/src/wasm/wasm-api.cc
deleted file mode 100644
index 4c51dc54cdc..00000000000
--- a/deps/v8/src/wasm/wasm-api.cc
+++ /dev/null
@@ -1,31 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/wasm/wasm-api.h"
-
-#include "src/isolate-inl.h"
-#include "src/isolate.h"
-
-namespace v8 {
-namespace internal {
-namespace wasm {
-
-ScheduledErrorThrower::~ScheduledErrorThrower() {
-  // There should never be both a pending and a scheduled exception.
-  DCHECK(!isolate()->has_scheduled_exception() ||
-         !isolate()->has_pending_exception());
-  // Don't throw another error if there is already a scheduled error.
-  if (isolate()->has_scheduled_exception()) {
-    Reset();
-  } else if (isolate()->has_pending_exception()) {
-    Reset();
-    isolate()->OptionalRescheduleException(false);
-  } else if (error()) {
-    isolate()->ScheduleThrow(*Reify());
-  }
-}
-
-}  // namespace wasm
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/wasm/wasm-api.h b/deps/v8/src/wasm/wasm-api.h
deleted file mode 100644
index 464cdfa6f1d..00000000000
--- a/deps/v8/src/wasm/wasm-api.h
+++ /dev/null
@@ -1,35 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_WASM_API_H_
-#define V8_WASM_API_H_
-
-#include "src/wasm/wasm-result.h"
-
-namespace v8 {
-namespace internal {
-namespace wasm {
-
-// Like an ErrorThrower, but turns all pending exceptions into scheduled
-// exceptions when going out of scope. Use this in API methods.
-// Note that pending exceptions are not necessarily created by the ErrorThrower,
-// but e.g. by the wasm start function. There might also be a scheduled
-// exception, created by another API call (e.g. v8::Object::Get). But there
-// should never be both pending and scheduled exceptions.
-class V8_EXPORT_PRIVATE ScheduledErrorThrower : public ErrorThrower {
- public:
-  ScheduledErrorThrower(v8::Isolate* isolate, const char* context)
-      : ScheduledErrorThrower(reinterpret_cast<Isolate*>(isolate), context) {}
-
-  ScheduledErrorThrower(Isolate* isolate, const char* context)
-      : ErrorThrower(isolate, context) {}
-
-  ~ScheduledErrorThrower();
-};
-
-}  // namespace wasm
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_WASM_API_H_
diff --git a/deps/v8/src/wasm/wasm-code-manager.cc b/deps/v8/src/wasm/wasm-code-manager.cc
index 2b8f3097339..7fe703cbc19 100644
--- a/deps/v8/src/wasm/wasm-code-manager.cc
+++ b/deps/v8/src/wasm/wasm-code-manager.cc
@@ -30,7 +30,16 @@ namespace internal {
 namespace wasm {
 
 namespace {
-size_t native_module_ids = 0;
+
+// Binary predicate to perform lookups in {NativeModule::owned_code_} with a
+// given address into a code object. Use with {std::upper_bound} for example.
+struct WasmCodeUniquePtrComparator {
+  bool operator()(Address pc, const std::unique_ptr<WasmCode>& code) const {
+    DCHECK_NOT_NULL(pc);
+    DCHECK_NOT_NULL(code);
+    return pc < code->instructions().start();
+  }
+};
 
 #if V8_TARGET_ARCH_X64
 #define __ masm->
@@ -56,25 +65,50 @@ const bool kModuleCanAllocateMoreMemory = true;
 
 void PatchTrampolineAndStubCalls(
     const WasmCode* original_code, const WasmCode* new_code,
-    const std::unordered_map<Address, Address, AddressHasher>& reverse_lookup) {
-  RelocIterator orig_it(
-      original_code->instructions(), original_code->reloc_info(),
-      original_code->constant_pool(), RelocInfo::kCodeTargetMask);
+    const std::unordered_map<Address, Address, AddressHasher>& reverse_lookup,
+    WasmCode::FlushICache flush_icache) {
+  // Relocate everything in kApplyMask using this delta, and patch all code
+  // targets to call the new trampolines and stubs.
+  intptr_t delta =
+      new_code->instructions().start() - original_code->instructions().start();
   for (RelocIterator it(new_code->instructions(), new_code->reloc_info(),
-                        new_code->constant_pool(), RelocInfo::kCodeTargetMask);
-       !it.done(); it.next(), orig_it.next()) {
-    Address old_target = orig_it.rinfo()->target_address();
+                        new_code->constant_pool(),
+                        RelocInfo::kCodeTargetMask | RelocInfo::kApplyMask);
+       !it.done(); it.next()) {
+    bool relocate =
+        RelocInfo::ModeMask(it.rinfo()->rmode()) & RelocInfo::kApplyMask;
+    if (RelocInfo::IsCodeTarget(it.rinfo()->rmode())) {
+      Address target = it.rinfo()->target_address() - (relocate ? delta : 0);
 #if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_S390X
-    auto found = reverse_lookup.find(old_target);
-    DCHECK(found != reverse_lookup.end());
-    Address new_target = found->second;
-#else
-    Address new_target = old_target;
+      auto found = reverse_lookup.find(target);
+      DCHECK(found != reverse_lookup.end());
+      target = found->second;
 #endif
-    it.rinfo()->set_target_address(nullptr, new_target, SKIP_WRITE_BARRIER,
-                                   SKIP_ICACHE_FLUSH);
+      it.rinfo()->set_target_address(target, SKIP_WRITE_BARRIER);
+    } else {
+      it.rinfo()->apply(delta);
+    }
+  }
+  if (flush_icache) {
+    Assembler::FlushICache(new_code->instructions().start(),
+                           new_code->instructions().size());
+  }
+}
+
+void RelocateCode(WasmCode* code, const WasmCode* orig,
+                  WasmCode::FlushICache flush_icache) {
+  intptr_t delta = code->instructions().start() - orig->instructions().start();
+  for (RelocIterator it(code->instructions(), code->reloc_info(),
+                        code->constant_pool(), RelocInfo::kApplyMask);
+       !it.done(); it.next()) {
+    it.rinfo()->apply(delta);
+  }
+  if (flush_icache) {
+    Assembler::FlushICache(code->instructions().start(),
+                           code->instructions().size());
   }
 }
+
 }  // namespace
 
 DisjointAllocationPool::DisjointAllocationPool(Address start, Address end) {
@@ -187,6 +221,45 @@ bool WasmCode::HasTrapHandlerIndex() const { return trap_handler_index_ >= 0; }
 
 void WasmCode::ResetTrapHandlerIndex() { trap_handler_index_ = -1; }
 
+bool WasmCode::ShouldBeLogged(Isolate* isolate) {
+  return isolate->logger()->is_logging_code_events() ||
+         isolate->is_profiling() || FLAG_print_wasm_code || FLAG_print_code;
+}
+
+void WasmCode::LogCode(Isolate* isolate) const {
+  DCHECK(ShouldBeLogged(isolate));
+  if (native_module()->compiled_module()->has_shared() && index_.IsJust()) {
+    uint32_t index = this->index();
+    Handle<WasmSharedModuleData> shared_handle(
+        native_module()->compiled_module()->shared(), isolate);
+    int name_length;
+    Handle<String> name(
+        WasmSharedModuleData::GetFunctionName(isolate, shared_handle, index));
+    auto cname =
+        name->ToCString(AllowNullsFlag::DISALLOW_NULLS,
+                        RobustnessFlag::ROBUST_STRING_TRAVERSAL, &name_length);
+    PROFILE(isolate,
+            CodeCreateEvent(CodeEventListener::FUNCTION_TAG, this,
+                            {cname.get(), static_cast<size_t>(name_length)}));
+
+#ifdef ENABLE_DISASSEMBLER
+    if (FLAG_print_code || FLAG_print_wasm_code) {
+      // TODO(wasm): Use proper log files, here and elsewhere.
+      OFStream os(stdout);
+      os << "--- Wasm " << (is_liftoff() ? "liftoff" : "turbofan")
+         << " code ---\n";
+      this->Disassemble(cname.get(), isolate, os);
+      os << "--- End code ---\n";
+    }
+#endif
+
+    if (!source_positions().is_empty()) {
+      LOG_CODE_EVENT(isolate, CodeLinePosInfoRecordEvent(instructions().start(),
+                                                         source_positions()));
+    }
+  }
+}
+
 void WasmCode::Print(Isolate* isolate) const {
   OFStream os(stdout);
   Disassemble(nullptr, isolate, os);
@@ -203,8 +276,14 @@ void WasmCode::Disassemble(const char* name, Isolate* isolate,
 
 #ifdef ENABLE_DISASSEMBLER
 
-  size_t instruction_size =
-      std::min(constant_pool_offset_, safepoint_table_offset_);
+  size_t instruction_size = body_size;
+  if (constant_pool_offset_ && constant_pool_offset_ < instruction_size) {
+    instruction_size = constant_pool_offset_;
+  }
+  if (safepoint_table_offset_ && safepoint_table_offset_ < instruction_size) {
+    instruction_size = safepoint_table_offset_;
+  }
+  DCHECK_LT(0, instruction_size);
   os << "Instructions (size = " << instruction_size << ")\n";
   // TODO(mtrofin): rework the dependency on isolate and code in
   // Disassembler::Decode.
@@ -212,13 +291,10 @@ void WasmCode::Disassemble(const char* name, Isolate* isolate,
                        instructions().start() + instruction_size, nullptr);
   os << "\n";
 
-  Object* source_positions_or_undef =
-      owner_->compiled_module()->source_positions()->get(index());
-  if (!source_positions_or_undef->IsUndefined(isolate)) {
+  if (!source_positions().is_empty()) {
     os << "Source positions:\n pc offset  position\n";
-    for (SourcePositionTableIterator it(
-             ByteArray::cast(source_positions_or_undef));
-         !it.done(); it.Advance()) {
+    for (SourcePositionTableIterator it(source_positions()); !it.done();
+         it.Advance()) {
       os << std::setw(10) << std::hex << it.code_offset() << std::dec
          << std::setw(10) << it.source_position().ScriptOffset()
          << (it.is_statement() ? "  statement" : "") << "\n";
@@ -268,12 +344,93 @@ WasmCode::~WasmCode() {
   }
 }
 
+NativeModule::CloneCodeHelper::CloneCodeHelper(
+    NativeModule* source_native_module, NativeModule* cloning_native_module)
+    : source_native_module_(source_native_module),
+      cloning_native_module_(cloning_native_module) {
+  for (auto& pair : source_native_module_->trampolines_) {
+    Address old_dest = pair.second;
+    auto local = cloning_native_module_->trampolines_.find(pair.first);
+    DCHECK(local != cloning_native_module_->trampolines_.end());
+    Address new_dest = local->second;
+    reverse_lookup_.emplace(old_dest, new_dest);
+  }
+
+  for (auto& pair : source_native_module_->stubs_) {
+    Address old_dest = pair.second->instructions().start();
+    auto local = cloning_native_module_->stubs_.find(pair.first);
+    DCHECK(local != cloning_native_module_->stubs_.end());
+    Address new_dest = local->second->instructions().start();
+    reverse_lookup_.emplace(old_dest, new_dest);
+  }
+}
+
+void NativeModule::CloneCodeHelper::SelectForCloning(int32_t code_index) {
+  selection_.emplace_back(code_index);
+}
+
+void NativeModule::CloneCodeHelper::CloneAndPatchCode(
+    bool patch_stub_to_stub_calls) {
+  if (patch_stub_to_stub_calls) {
+    PatchStubToStubCalls();
+  }
+
+  WasmCode* anonymous_lazy_builtin = nullptr;
+  for (uint32_t index : selection_) {
+    const WasmCode* original_code = source_native_module_->GetCode(index);
+    switch (original_code->kind()) {
+      case WasmCode::kLazyStub: {
+        // Use the first anonymous lazy compile stub hit in this loop as the
+        // canonical copy for all further ones by remembering it locally via
+        // the {anonymous_lazy_builtin} variable. All non-anonymous such stubs
+        // are just cloned directly via {CloneLazyBuiltinInto} below.
+        if (!original_code->IsAnonymous()) {
+          WasmCode* new_code = cloning_native_module_->CloneCode(
+              original_code, WasmCode::kNoFlushICache);
+          PatchTrampolineAndStubCalls(original_code, new_code, reverse_lookup_,
+                                      WasmCode::kFlushICache);
+          break;
+        }
+        if (anonymous_lazy_builtin == nullptr) {
+          WasmCode* new_code = cloning_native_module_->CloneCode(
+              original_code, WasmCode::kNoFlushICache);
+          PatchTrampolineAndStubCalls(original_code, new_code, reverse_lookup_,
+                                      WasmCode::kFlushICache);
+          anonymous_lazy_builtin = new_code;
+        }
+        cloning_native_module_->code_table_[index] = anonymous_lazy_builtin;
+      } break;
+      case WasmCode::kFunction: {
+        WasmCode* new_code = cloning_native_module_->CloneCode(
+            original_code, WasmCode::kNoFlushICache);
+        PatchTrampolineAndStubCalls(original_code, new_code, reverse_lookup_,
+                                    WasmCode::kFlushICache);
+      } break;
+      default:
+        UNREACHABLE();
+    }
+  }
+}
+
+void NativeModule::CloneCodeHelper::PatchStubToStubCalls() {
+  for (auto& pair : cloning_native_module_->stubs_) {
+    WasmCode* new_stub = pair.second;
+    WasmCode* old_stub = source_native_module_->stubs_.find(pair.first)->second;
+    PatchTrampolineAndStubCalls(old_stub, new_stub, reverse_lookup_,
+                                WasmCode::kFlushICache);
+  }
+}
+
+base::AtomicNumber<size_t> NativeModule::next_id_;
+
 NativeModule::NativeModule(uint32_t num_functions, uint32_t num_imports,
                            bool can_request_more, VirtualMemory* mem,
                            WasmCodeManager* code_manager)
-    : instance_id(native_module_ids++),
+    : instance_id(next_id_.Increment(1)),
       code_table_(num_functions),
       num_imported_functions_(num_imports),
+      compilation_state_(NewCompilationState(
+          reinterpret_cast<Isolate*>(code_manager->isolate_))),
       free_memory_(reinterpret_cast<Address>(mem->address()),
                    reinterpret_cast<Address>(mem->end())),
       wasm_code_manager_(code_manager),
@@ -287,20 +444,7 @@ NativeModule::NativeModule(uint32_t num_functions, uint32_t num_imports,
 void NativeModule::ResizeCodeTableForTest(size_t last_index) {
   size_t new_size = last_index + 1;
   if (new_size > FunctionCount()) {
-    Isolate* isolate = compiled_module()->GetIsolate();
     code_table_.resize(new_size);
-    int grow_by = static_cast<int>(new_size) -
-                  compiled_module()->source_positions()->length();
-    Handle<FixedArray> source_positions(compiled_module()->source_positions(),
-                                        isolate);
-    source_positions = isolate->factory()->CopyFixedArrayAndGrow(
-        source_positions, grow_by, TENURED);
-    compiled_module()->set_source_positions(*source_positions);
-    Handle<FixedArray> handler_table(compiled_module()->handler_table(),
-                                     isolate);
-    handler_table = isolate->factory()->CopyFixedArrayAndGrow(handler_table,
-                                                              grow_by, TENURED);
-    compiled_module()->set_handler_table(*handler_table);
   }
 }
 
@@ -316,44 +460,48 @@ uint32_t NativeModule::FunctionCount() const {
 WasmCode* NativeModule::AddOwnedCode(
     Vector<const byte> orig_instructions,
     std::unique_ptr<const byte[]> reloc_info, size_t reloc_size,
+    std::unique_ptr<const byte[]> source_pos, size_t source_pos_size,
     Maybe<uint32_t> index, WasmCode::Kind kind, size_t constant_pool_offset,
     uint32_t stack_slots, size_t safepoint_table_offset,
+    size_t handler_table_offset,
     std::shared_ptr<ProtectedInstructions> protected_instructions,
-    bool is_liftoff) {
+    WasmCode::Tier tier, WasmCode::FlushICache flush_icache) {
   // both allocation and insertion in owned_code_ happen in the same critical
   // section, thus ensuring owned_code_'s elements are rarely if ever moved.
   base::LockGuard<base::Mutex> lock(&allocation_mutex_);
   Address executable_buffer = AllocateForCode(orig_instructions.size());
-  if (executable_buffer == nullptr) return nullptr;
+  if (executable_buffer == nullptr) {
+    V8::FatalProcessOutOfMemory(nullptr, "NativeModule::AddOwnedCode");
+    UNREACHABLE();
+  }
   memcpy(executable_buffer, orig_instructions.start(),
          orig_instructions.size());
   std::unique_ptr<WasmCode> code(new WasmCode(
       {executable_buffer, orig_instructions.size()}, std::move(reloc_info),
-      reloc_size, this, index, kind, constant_pool_offset, stack_slots,
-      safepoint_table_offset, std::move(protected_instructions), is_liftoff));
+      reloc_size, std::move(source_pos), source_pos_size, this, index, kind,
+      constant_pool_offset, stack_slots, safepoint_table_offset,
+      handler_table_offset, std::move(protected_instructions), tier));
   WasmCode* ret = code.get();
 
   // TODO(mtrofin): We allocate in increasing address order, and
   // even if we end up with segmented memory, we may end up only with a few
   // large moves - if, for example, a new segment is below the current ones.
   auto insert_before = std::upper_bound(owned_code_.begin(), owned_code_.end(),
-                                        code, owned_code_comparer_);
+                                        ret->instructions().start(),
+                                        WasmCodeUniquePtrComparator());
   owned_code_.insert(insert_before, std::move(code));
-  wasm_code_manager_->FlushICache(ret->instructions().start(),
-                                  ret->instructions().size());
-
+  if (flush_icache) {
+    Assembler::FlushICache(ret->instructions().start(),
+                           ret->instructions().size());
+  }
   return ret;
 }
 
 WasmCode* NativeModule::AddCodeCopy(Handle<Code> code, WasmCode::Kind kind,
                                     uint32_t index) {
   WasmCode* ret = AddAnonymousCode(code, kind);
-  SetCodeTable(index, ret);
+  code_table_[index] = ret;
   ret->index_ = Just(index);
-  compiled_module()->source_positions()->set(static_cast<int>(index),
-                                             code->source_position_table());
-  compiled_module()->handler_table()->set(static_cast<int>(index),
-                                          code->handler_table());
   return ret;
 }
 
@@ -364,25 +512,27 @@ WasmCode* NativeModule::AddInterpreterWrapper(Handle<Code> code,
   return ret;
 }
 
-WasmCode* NativeModule::SetLazyBuiltin(Handle<Code> code) {
-  DCHECK_NULL(lazy_builtin_);
-  lazy_builtin_ = AddAnonymousCode(code, WasmCode::kLazyStub);
-
+void NativeModule::SetLazyBuiltin(Handle<Code> code) {
+  WasmCode* lazy_builtin = AddAnonymousCode(code, WasmCode::kLazyStub);
   for (uint32_t i = num_imported_functions(), e = FunctionCount(); i < e; ++i) {
-    SetCodeTable(i, lazy_builtin_);
+    code_table_[i] = lazy_builtin;
   }
-
-  return lazy_builtin_;
 }
 
 WasmCompiledModule* NativeModule::compiled_module() const {
+  DCHECK_NOT_NULL(compiled_module_);
   return *compiled_module_;
 }
 
 void NativeModule::SetCompiledModule(
     Handle<WasmCompiledModule> compiled_module) {
-  DCHECK(compiled_module_.is_null());
-  compiled_module_ = compiled_module;
+  DCHECK_NULL(compiled_module_);
+  compiled_module_ = compiled_module->GetIsolate()
+                         ->global_handles()
+                         ->Create(*compiled_module)
+                         .location();
+  GlobalHandles::MakeWeak(reinterpret_cast<Object***>(&compiled_module_));
+  wasm::SetCompiledModule(compilation_state_.get(), compiled_module);
 }
 
 WasmCode* NativeModule::AddAnonymousCode(Handle<Code> code,
@@ -392,14 +542,34 @@ WasmCode* NativeModule::AddAnonymousCode(Handle<Code> code,
     reloc_info.reset(new byte[code->relocation_size()]);
     memcpy(reloc_info.get(), code->relocation_start(), code->relocation_size());
   }
-  WasmCode* ret = AddOwnedCode(
-      {code->instruction_start(),
-       static_cast<size_t>(code->instruction_size())},
-      std::move(reloc_info), static_cast<size_t>(code->relocation_size()),
-      Nothing<uint32_t>(), kind, code->constant_pool_offset(),
-      (code->has_safepoint_info() ? code->stack_slots() : 0),
-      (code->has_safepoint_info() ? code->safepoint_table_offset() : 0), {});
-  if (ret == nullptr) return nullptr;
+  std::unique_ptr<byte[]> source_pos;
+  Handle<ByteArray> source_pos_table(code->SourcePositionTable());
+  if (source_pos_table->length() > 0) {
+    source_pos.reset(new byte[source_pos_table->length()]);
+    source_pos_table->copy_out(0, source_pos.get(), source_pos_table->length());
+  }
+  std::shared_ptr<ProtectedInstructions> protected_instructions(
+      new ProtectedInstructions(0));
+  Vector<const byte> orig_instructions(
+      code->instruction_start(), static_cast<size_t>(code->instruction_size()));
+  int stack_slots = code->has_safepoint_info() ? code->stack_slots() : 0;
+  int safepoint_table_offset =
+      code->has_safepoint_info() ? code->safepoint_table_offset() : 0;
+  WasmCode* ret =
+      AddOwnedCode(orig_instructions,      // instructions
+                   std::move(reloc_info),  // reloc_info
+                   static_cast<size_t>(code->relocation_size()),  // reloc_size
+                   std::move(source_pos),  // source positions
+                   static_cast<size_t>(source_pos_table->length()),
+                   Nothing<uint32_t>(),           // index
+                   kind,                          // kind
+                   code->constant_pool_offset(),  // constant_pool_offset
+                   stack_slots,                   // stack_slots
+                   safepoint_table_offset,        // safepoint_table_offset
+                   code->handler_table_offset(),  // handler_table_offset
+                   protected_instructions,        // protected_instructions
+                   WasmCode::kOther,              // kind
+                   WasmCode::kNoFlushICache);     // flush_icache
   intptr_t delta = ret->instructions().start() - code->instruction_start();
   int mask = RelocInfo::kApplyMask | RelocInfo::kCodeTargetMask |
              RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
@@ -411,8 +581,7 @@ WasmCode* NativeModule::AddAnonymousCode(Handle<Code> code,
     if (RelocInfo::IsCodeTarget(it.rinfo()->rmode())) {
       Code* call_target =
           Code::GetCodeFromTargetAddress(orig_it.rinfo()->target_address());
-      it.rinfo()->set_target_address(nullptr,
-                                     GetLocalAddressFor(handle(call_target)),
+      it.rinfo()->set_target_address(GetLocalAddressFor(handle(call_target)),
                                      SKIP_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
     } else {
       if (RelocInfo::IsEmbeddedObject(it.rinfo()->rmode())) {
@@ -422,30 +591,40 @@ WasmCode* NativeModule::AddAnonymousCode(Handle<Code> code,
       }
     }
   }
+  // Flush the i-cache here instead of in AddOwnedCode, to include the changes
+  // made while iterating over the RelocInfo above.
+  Assembler::FlushICache(ret->instructions().start(),
+                         ret->instructions().size());
   return ret;
 }
 
 WasmCode* NativeModule::AddCode(
     const CodeDesc& desc, uint32_t frame_slots, uint32_t index,
-    size_t safepoint_table_offset,
+    size_t safepoint_table_offset, size_t handler_table_offset,
     std::unique_ptr<ProtectedInstructions> protected_instructions,
-    bool is_liftoff) {
+    Handle<ByteArray> source_pos_table, WasmCode::Tier tier) {
   std::unique_ptr<byte[]> reloc_info;
   if (desc.reloc_size) {
     reloc_info.reset(new byte[desc.reloc_size]);
     memcpy(reloc_info.get(), desc.buffer + desc.buffer_size - desc.reloc_size,
            desc.reloc_size);
   }
+  std::unique_ptr<byte[]> source_pos;
+  if (source_pos_table->length() > 0) {
+    source_pos.reset(new byte[source_pos_table->length()]);
+    source_pos_table->copy_out(0, source_pos.get(), source_pos_table->length());
+  }
   TurboAssembler* origin = reinterpret_cast<TurboAssembler*>(desc.origin);
   WasmCode* ret = AddOwnedCode(
       {desc.buffer, static_cast<size_t>(desc.instr_size)},
-      std::move(reloc_info), static_cast<size_t>(desc.reloc_size), Just(index),
-      WasmCode::kFunction, desc.instr_size - desc.constant_pool_size,
-      frame_slots, safepoint_table_offset, std::move(protected_instructions),
-      is_liftoff);
-  if (ret == nullptr) return nullptr;
-
-  SetCodeTable(index, ret);
+      std::move(reloc_info), static_cast<size_t>(desc.reloc_size),
+      std::move(source_pos), static_cast<size_t>(source_pos_table->length()),
+      Just(index), WasmCode::kFunction,
+      desc.instr_size - desc.constant_pool_size, frame_slots,
+      safepoint_table_offset, handler_table_offset,
+      std::move(protected_instructions), tier, WasmCode::kNoFlushICache);
+
+  code_table_[index] = ret;
   // TODO(mtrofin): this is a copy and paste from Code::CopyFrom.
   int mode_mask = RelocInfo::kCodeTargetMask |
                   RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
@@ -467,17 +646,21 @@ WasmCode* NativeModule::AddCode(
       // code object
       Handle<Object> p = it.rinfo()->target_object_handle(origin);
       Code* code = Code::cast(*p);
-      it.rinfo()->set_target_address(nullptr, GetLocalAddressFor(handle(code)),
+      it.rinfo()->set_target_address(GetLocalAddressFor(handle(code)),
                                      SKIP_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
     } else if (RelocInfo::IsRuntimeEntry(mode)) {
       Address p = it.rinfo()->target_runtime_entry(origin);
-      it.rinfo()->set_target_runtime_entry(
-          origin->isolate(), p, SKIP_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
+      it.rinfo()->set_target_runtime_entry(p, SKIP_WRITE_BARRIER,
+                                           SKIP_ICACHE_FLUSH);
     } else {
       intptr_t delta = ret->instructions().start() - desc.buffer;
       it.rinfo()->apply(delta);
     }
   }
+  // Flush the i-cache here instead of in AddOwnedCode, to include the changes
+  // made while iterating over the RelocInfo above.
+  Assembler::FlushICache(ret->instructions().start(),
+                         ret->instructions().size());
   return ret;
 }
 
@@ -488,10 +671,22 @@ Address NativeModule::CreateTrampolineTo(Handle<Code> code) {
   GenerateJumpTrampoline(&masm, dest);
   CodeDesc code_desc;
   masm.GetCode(nullptr, &code_desc);
-  WasmCode* wasm_code = AddOwnedCode(
-      {code_desc.buffer, static_cast<size_t>(code_desc.instr_size)}, nullptr, 0,
-      Nothing<uint32_t>(), WasmCode::kTrampoline, 0, 0, 0, {});
-  if (wasm_code == nullptr) return nullptr;
+  Vector<const byte> instructions(code_desc.buffer,
+                                  static_cast<size_t>(code_desc.instr_size));
+  WasmCode* wasm_code = AddOwnedCode(instructions,           // instructions
+                                     nullptr,                // reloc_info
+                                     0,                      // reloc_size
+                                     nullptr,                // source_pos
+                                     0,                      // source_pos_size
+                                     Nothing<uint32_t>(),    // index
+                                     WasmCode::kTrampoline,  // kind
+                                     0,   // constant_pool_offset
+                                     0,   // stack_slots
+                                     0,   // safepoint_table_offset
+                                     0,   // handler_table_offset
+                                     {},  // protected_instructions
+                                     WasmCode::kOther,         // tier
+                                     WasmCode::kFlushICache);  // flush_icache
   Address ret = wasm_code->instructions().start();
   trampolines_.emplace(std::make_pair(dest, ret));
   return ret;
@@ -526,45 +721,6 @@ Address NativeModule::GetLocalAddressFor(Handle<Code> code) {
   }
 }
 
-WasmCode* NativeModule::GetExportedWrapper(uint32_t index) {
-  auto found = exported_wasm_to_wasm_wrappers_.find(index);
-  if (found != exported_wasm_to_wasm_wrappers_.end()) {
-    return found->second;
-  }
-  return nullptr;
-}
-
-WasmCode* NativeModule::AddExportedWrapper(Handle<Code> code, uint32_t index) {
-  WasmCode* ret = AddAnonymousCode(code, WasmCode::kWasmToWasmWrapper);
-  ret->index_ = Just(index);
-  exported_wasm_to_wasm_wrappers_.insert(std::make_pair(index, ret));
-  return ret;
-}
-
-void NativeModule::LinkAll() {
-  for (uint32_t index = 0; index < code_table_.size(); ++index) {
-    Link(index);
-  }
-}
-
-void NativeModule::Link(uint32_t index) {
-  WasmCode* code = code_table_[index];
-  // skip imports
-  if (!code) return;
-  int mode_mask = RelocInfo::ModeMask(RelocInfo::WASM_CALL);
-  for (RelocIterator it(code->instructions(), code->reloc_info(),
-                        code->constant_pool(), mode_mask);
-       !it.done(); it.next()) {
-    uint32_t index = GetWasmCalleeTag(it.rinfo());
-    const WasmCode* target = GetCode(index);
-    if (target == nullptr) continue;
-    Address target_addr = target->instructions().start();
-    DCHECK_NOT_NULL(target);
-    it.rinfo()->set_wasm_call_address(nullptr, target_addr,
-                                      ICacheFlushMode::SKIP_ICACHE_FLUSH);
-  }
-}
-
 Address NativeModule::AllocateForCode(size_t size) {
   // this happens under a lock assumed by the caller.
   size = RoundUp(size, kCodeAlignment);
@@ -639,10 +795,8 @@ Address NativeModule::AllocateForCode(size_t size) {
 
 WasmCode* NativeModule::Lookup(Address pc) {
   if (owned_code_.empty()) return nullptr;
-  // Make a fake WasmCode temp, to look into owned_code_
-  std::unique_ptr<WasmCode> temp(new WasmCode(pc));
-  auto iter = std::upper_bound(owned_code_.begin(), owned_code_.end(), temp,
-                               owned_code_comparer_);
+  auto iter = std::upper_bound(owned_code_.begin(), owned_code_.end(), pc,
+                               WasmCodeUniquePtrComparator());
   if (iter == owned_code_.begin()) return nullptr;
   --iter;
   WasmCode* candidate = (*iter).get();
@@ -655,65 +809,71 @@ WasmCode* NativeModule::Lookup(Address pc) {
   return nullptr;
 }
 
-WasmCode* NativeModule::CloneLazyBuiltinInto(uint32_t index) {
-  DCHECK_NOT_NULL(lazy_builtin());
-  WasmCode* ret = CloneCode(lazy_builtin());
-  SetCodeTable(index, ret);
+WasmCode* NativeModule::CloneLazyBuiltinInto(
+    const WasmCode* code, uint32_t index, WasmCode::FlushICache flush_icache) {
+  DCHECK_EQ(wasm::WasmCode::kLazyStub, code->kind());
+  DCHECK(code->IsAnonymous());
+  WasmCode* ret = CloneCode(code, WasmCode::kNoFlushICache);
+  RelocateCode(ret, code, flush_icache);
+  code_table_[index] = ret;
   ret->index_ = Just(index);
   return ret;
 }
 
-bool NativeModule::CloneTrampolinesAndStubs(const NativeModule* other) {
+void NativeModule::CloneTrampolinesAndStubs(
+    const NativeModule* other, WasmCode::FlushICache flush_icache) {
   for (auto& pair : other->trampolines_) {
     Address key = pair.first;
     Address local =
         GetLocalAddressFor(handle(Code::GetCodeFromTargetAddress(key)));
-    if (local == nullptr) return false;
+    DCHECK_NOT_NULL(local);
     trampolines_.emplace(std::make_pair(key, local));
   }
   for (auto& pair : other->stubs_) {
     uint32_t key = pair.first;
-    WasmCode* clone = CloneCode(pair.second);
-    if (!clone) return false;
+    WasmCode* clone = CloneCode(pair.second, flush_icache);
     stubs_.emplace(std::make_pair(key, clone));
   }
-  return true;
 }
 
-WasmCode* NativeModule::CloneCode(const WasmCode* original_code) {
+WasmCode* NativeModule::CloneCode(const WasmCode* original_code,
+                                  WasmCode::FlushICache flush_icache) {
   std::unique_ptr<byte[]> reloc_info;
   if (original_code->reloc_info().size() > 0) {
     reloc_info.reset(new byte[original_code->reloc_info().size()]);
     memcpy(reloc_info.get(), original_code->reloc_info().start(),
            original_code->reloc_info().size());
   }
+  std::unique_ptr<byte[]> source_pos;
+  if (original_code->source_positions().size() > 0) {
+    source_pos.reset(new byte[original_code->source_positions().size()]);
+    memcpy(source_pos.get(), original_code->source_positions().start(),
+           original_code->source_positions().size());
+  }
   WasmCode* ret = AddOwnedCode(
       original_code->instructions(), std::move(reloc_info),
-      original_code->reloc_info().size(), original_code->index_,
+      original_code->reloc_info().size(), std::move(source_pos),
+      original_code->source_positions().size(), original_code->index_,
       original_code->kind(), original_code->constant_pool_offset_,
       original_code->stack_slots(), original_code->safepoint_table_offset_,
-      original_code->protected_instructions_);
-  if (ret == nullptr) return nullptr;
+      original_code->handler_table_offset_,
+      original_code->protected_instructions_, original_code->tier(),
+      flush_icache);
   if (!ret->IsAnonymous()) {
-    SetCodeTable(ret->index(), ret);
-  }
-  intptr_t delta =
-      ret->instructions().start() - original_code->instructions().start();
-  for (RelocIterator it(ret->instructions(), ret->reloc_info(),
-                        ret->constant_pool(), RelocInfo::kApplyMask);
-       !it.done(); it.next()) {
-    it.rinfo()->apply(delta);
+    code_table_[ret->index()] = ret;
   }
   return ret;
 }
 
-void NativeModule::SetCodeTable(uint32_t index, wasm::WasmCode* code) {
-  code_table_[index] = code;
-}
-
 NativeModule::~NativeModule() {
   TRACE_HEAP("Deleting native module: %p\n", reinterpret_cast<void*>(this));
   wasm_code_manager_->FreeNativeModuleMemories(this);
+  if (compiled_module_ != nullptr) {
+    Isolate* isolate = compiled_module()->GetIsolate();
+    isolate->global_handles()->Destroy(
+        reinterpret_cast<Object**>(compiled_module_));
+    compiled_module_ = nullptr;
+  }
 }
 
 WasmCodeManager::WasmCodeManager(v8::Isolate* isolate, size_t max_committed)
@@ -832,7 +992,8 @@ std::unique_ptr<NativeModule> WasmCodeManager::NewNativeModule(
     return ret;
   }
 
-  V8::FatalProcessOutOfMemory("WasmCodeManager::NewNativeModule");
+  V8::FatalProcessOutOfMemory(reinterpret_cast<Isolate*>(isolate_),
+                              "WasmCodeManager::NewNativeModule");
   return nullptr;
 }
 
@@ -889,59 +1050,17 @@ std::unique_ptr<NativeModule> NativeModule::Clone() {
   TRACE_HEAP("%zu cloned from %zu\n", ret->instance_id, instance_id);
   if (!ret) return ret;
 
-  if (lazy_builtin() != nullptr) {
-    ret->lazy_builtin_ = ret->CloneCode(lazy_builtin());
-  }
-
-  if (!ret->CloneTrampolinesAndStubs(this)) return nullptr;
-
-  std::unordered_map<Address, Address, AddressHasher> reverse_lookup;
-  for (auto& pair : trampolines_) {
-    Address old_dest = pair.second;
-    auto local = ret->trampolines_.find(pair.first);
-    DCHECK(local != ret->trampolines_.end());
-    Address new_dest = local->second;
-    reverse_lookup.emplace(old_dest, new_dest);
-  }
-
-  for (auto& pair : stubs_) {
-    Address old_dest = pair.second->instructions().start();
-    auto local = ret->stubs_.find(pair.first);
-    DCHECK(local != ret->stubs_.end());
-    Address new_dest = local->second->instructions().start();
-    reverse_lookup.emplace(old_dest, new_dest);
-  }
-
-  for (auto& pair : ret->stubs_) {
-    WasmCode* new_stub = pair.second;
-    WasmCode* old_stub = stubs_.find(pair.first)->second;
-    PatchTrampolineAndStubCalls(old_stub, new_stub, reverse_lookup);
-  }
-  if (lazy_builtin_ != nullptr) {
-    PatchTrampolineAndStubCalls(lazy_builtin_, ret->lazy_builtin_,
-                                reverse_lookup);
-  }
+  // Clone trampolines and stubs. They are later patched, so no icache flush
+  // needed yet.
+  ret->CloneTrampolinesAndStubs(this, WasmCode::kNoFlushICache);
 
+  // Create a helper for cloning and patching code.
+  CloneCodeHelper helper(this, ret.get());
   for (uint32_t i = num_imported_functions(), e = FunctionCount(); i < e; ++i) {
-    const WasmCode* original_code = GetCode(i);
-    switch (original_code->kind()) {
-      case WasmCode::kLazyStub: {
-        if (original_code->IsAnonymous()) {
-          ret->SetCodeTable(i, ret->lazy_builtin());
-        } else {
-          if (!ret->CloneLazyBuiltinInto(i)) return nullptr;
-        }
-      } break;
-      case WasmCode::kFunction: {
-        WasmCode* new_code = ret->CloneCode(original_code);
-        if (new_code == nullptr) return nullptr;
-        PatchTrampolineAndStubCalls(original_code, new_code, reverse_lookup);
-      } break;
-      default:
-        UNREACHABLE();
-    }
+    helper.SelectForCloning(i);
   }
-  ret->specialization_data_ = specialization_data_;
+  helper.CloneAndPatchCode(true);
+
   return ret;
 }
 
@@ -1009,50 +1128,22 @@ intptr_t WasmCodeManager::remaining_uncommitted() const {
   return remaining_uncommitted_.Value();
 }
 
-void WasmCodeManager::FlushICache(Address start, size_t size) {
-  Assembler::FlushICache(reinterpret_cast<internal::Isolate*>(isolate_), start,
-                         size);
-}
-
 NativeModuleModificationScope::NativeModuleModificationScope(
     NativeModule* native_module)
     : native_module_(native_module) {
-  if (native_module_) {
+  if (native_module_ && (native_module_->modification_scope_depth_++) == 0) {
     bool success = native_module_->SetExecutable(false);
     CHECK(success);
   }
 }
 
 NativeModuleModificationScope::~NativeModuleModificationScope() {
-  if (native_module_) {
+  if (native_module_ && (native_module_->modification_scope_depth_--) == 1) {
     bool success = native_module_->SetExecutable(true);
     CHECK(success);
   }
 }
 
-// On Intel, call sites are encoded as a displacement. For linking
-// and for serialization/deserialization, we want to store/retrieve
-// a tag (the function index). On Intel, that means accessing the
-// raw displacement. Everywhere else, that simply means accessing
-// the target address.
-void SetWasmCalleeTag(RelocInfo* rinfo, uint32_t tag) {
-#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32
-  *(reinterpret_cast<uint32_t*>(rinfo->target_address_address())) = tag;
-#else
-  rinfo->set_target_address(nullptr, reinterpret_cast<Address>(tag),
-                            SKIP_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
-#endif
-}
-
-uint32_t GetWasmCalleeTag(RelocInfo* rinfo) {
-#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32
-  return *(reinterpret_cast<uint32_t*>(rinfo->target_address_address()));
-#else
-  return static_cast<uint32_t>(
-      reinterpret_cast<size_t>(rinfo->target_address()));
-#endif
-}
-
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/wasm-code-manager.h b/deps/v8/src/wasm/wasm-code-manager.h
index 3e2a0918fb8..bec8d9dc307 100644
--- a/deps/v8/src/wasm/wasm-code-manager.h
+++ b/deps/v8/src/wasm/wasm-code-manager.h
@@ -2,19 +2,19 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_HEAP_H_
-#define V8_WASM_HEAP_H_
+#ifndef V8_WASM_WASM_CODE_MANAGER_H_
+#define V8_WASM_WASM_CODE_MANAGER_H_
 
 #include <functional>
 #include <list>
 #include <map>
 #include <unordered_map>
-#include <unordered_set>
 
 #include "src/base/macros.h"
 #include "src/handles.h"
 #include "src/trap-handler/trap-handler.h"
 #include "src/vector.h"
+#include "src/wasm/module-compiler.h"
 
 namespace v8 {
 class Isolate;
@@ -97,22 +97,32 @@ class V8_EXPORT_PRIVATE WasmCode final {
     kTrampoline
   };
 
+  // kOther is used if we have WasmCode that is neither
+  // liftoff- nor turbofan-compiled, i.e. if Kind is
+  // not a kFunction.
+  enum Tier : int8_t { kLiftoff, kTurbofan, kOther };
+
   Vector<byte> instructions() const { return instructions_; }
   Vector<const byte> reloc_info() const {
     return {reloc_info_.get(), reloc_size_};
   }
+  Vector<const byte> source_positions() const {
+    return {source_position_table_.get(), source_position_size_};
+  }
 
   uint32_t index() const { return index_.ToChecked(); }
   // Anonymous functions are functions that don't carry an index, like
   // trampolines.
   bool IsAnonymous() const { return index_.IsNothing(); }
   Kind kind() const { return kind_; }
-  NativeModule* owner() const { return owner_; }
+  NativeModule* native_module() const { return native_module_; }
+  Tier tier() const { return tier_; }
   Address constant_pool() const;
   size_t constant_pool_offset() const { return constant_pool_offset_; }
   size_t safepoint_table_offset() const { return safepoint_table_offset_; }
+  size_t handler_table_offset() const { return handler_table_offset_; }
   uint32_t stack_slots() const { return stack_slots_; }
-  bool is_liftoff() const { return is_liftoff_; }
+  bool is_liftoff() const { return tier_ == kLiftoff; }
 
   size_t trap_handler_index() const;
   void set_trap_handler_index(size_t);
@@ -120,47 +130,58 @@ class V8_EXPORT_PRIVATE WasmCode final {
   void ResetTrapHandlerIndex();
 
   const ProtectedInstructions& protected_instructions() const {
+    // TODO(mstarzinger): Code that doesn't have trapping instruction should
+    // not be required to have this vector, make it possible to be null.
+    DCHECK_NOT_NULL(protected_instructions_);
     return *protected_instructions_.get();
   }
 
   void Print(Isolate* isolate) const;
   void Disassemble(const char* name, Isolate* isolate, std::ostream& os) const;
 
+  static bool ShouldBeLogged(Isolate* isolate);
+  void LogCode(Isolate* isolate) const;
+
   ~WasmCode();
 
+  enum FlushICache : bool { kFlushICache = true, kNoFlushICache = false };
+
  private:
   friend class NativeModule;
-  friend class NativeModuleDeserializer;
-
-  // A constructor used just for implementing Lookup.
-  WasmCode(Address pc) : instructions_(pc, 0), index_(Nothing<uint32_t>()) {}
 
   WasmCode(Vector<byte> instructions,
            std::unique_ptr<const byte[]>&& reloc_info, size_t reloc_size,
-           NativeModule* owner, Maybe<uint32_t> index, Kind kind,
+           std::unique_ptr<const byte[]>&& source_pos, size_t source_pos_size,
+           NativeModule* native_module, Maybe<uint32_t> index, Kind kind,
            size_t constant_pool_offset, uint32_t stack_slots,
-           size_t safepoint_table_offset,
+           size_t safepoint_table_offset, size_t handler_table_offset,
            std::shared_ptr<ProtectedInstructions> protected_instructions,
-           bool is_liftoff = false)
+           Tier tier)
       : instructions_(instructions),
         reloc_info_(std::move(reloc_info)),
         reloc_size_(reloc_size),
-        owner_(owner),
+        source_position_table_(std::move(source_pos)),
+        source_position_size_(source_pos_size),
+        native_module_(native_module),
         index_(index),
         kind_(kind),
         constant_pool_offset_(constant_pool_offset),
         stack_slots_(stack_slots),
         safepoint_table_offset_(safepoint_table_offset),
+        handler_table_offset_(handler_table_offset),
         protected_instructions_(std::move(protected_instructions)),
-        is_liftoff_(is_liftoff) {}
-
-  WasmCode(const WasmCode&) = delete;
-  WasmCode& operator=(const WasmCode&) = delete;
+        tier_(tier) {
+    DCHECK_LE(safepoint_table_offset, instructions.size());
+    DCHECK_LE(constant_pool_offset, instructions.size());
+    DCHECK_LE(handler_table_offset, instructions.size());
+  }
 
   Vector<byte> instructions_;
   std::unique_ptr<const byte[]> reloc_info_;
   size_t reloc_size_ = 0;
-  NativeModule* owner_ = nullptr;
+  std::unique_ptr<const byte[]> source_position_table_;
+  size_t source_position_size_ = 0;
+  NativeModule* native_module_ = nullptr;
   Maybe<uint32_t> index_;
   Kind kind_;
   size_t constant_pool_offset_ = 0;
@@ -169,9 +190,12 @@ class V8_EXPORT_PRIVATE WasmCode final {
   // since there may be stack/register tagged values for large number
   // conversions.
   size_t safepoint_table_offset_ = 0;
+  size_t handler_table_offset_ = 0;
   intptr_t trap_handler_index_ = -1;
   std::shared_ptr<ProtectedInstructions> protected_instructions_;
-  bool is_liftoff_;
+  Tier tier_;
+
+  DISALLOW_COPY_AND_ASSIGN(WasmCode);
 };
 
 // Return a textual description of the kind.
@@ -186,12 +210,33 @@ class WasmCodeManager;
 // WasmCodeManager::Commit.
 class V8_EXPORT_PRIVATE NativeModule final {
  public:
+  // Helper class to selectively clone and patch code from a
+  // {source_native_module} into a {cloning_native_module}.
+  class CloneCodeHelper {
+   public:
+    explicit CloneCodeHelper(NativeModule* source_native_module,
+                             NativeModule* cloning_native_module);
+
+    void SelectForCloning(int32_t code_index);
+
+    void CloneAndPatchCode(bool patch_stub_to_stub_calls);
+
+   private:
+    void PatchStubToStubCalls();
+
+    NativeModule* source_native_module_;
+    NativeModule* cloning_native_module_;
+    std::vector<uint32_t> selection_;
+    std::unordered_map<Address, Address, AddressHasher> reverse_lookup_;
+  };
+
   std::unique_ptr<NativeModule> Clone();
 
   WasmCode* AddCode(const CodeDesc& desc, uint32_t frame_count, uint32_t index,
-                    size_t safepoint_table_offset,
+                    size_t safepoint_table_offset, size_t handler_table_offset,
                     std::unique_ptr<ProtectedInstructions>,
-                    bool is_liftoff = false);
+                    Handle<ByteArray> source_position_table,
+                    WasmCode::Tier tier);
 
   // A way to copy over JS-allocated code. This is because we compile
   // certain wrappers using a different pipeline.
@@ -204,23 +249,16 @@ class V8_EXPORT_PRIVATE NativeModule final {
   WasmCode* AddInterpreterWrapper(Handle<Code> code, uint32_t index);
 
   // When starting lazy compilation, provide the WasmLazyCompile builtin by
-  // calling SetLazyBuiltin. It will initialize the code table with it, and the
-  // lazy_builtin_ field. The latter is used when creating entries for exported
+  // calling SetLazyBuiltin. It will initialize the code table with it. Copies
+  // of it might be cloned from them later when creating entries for exported
   // functions and indirect callable functions, so that they may be identified
   // by the runtime.
-  WasmCode* SetLazyBuiltin(Handle<Code> code);
-
-  // ExportedWrappers are WasmToWasmWrappers for functions placed on import
-  // tables. We construct them as-needed.
-  WasmCode* GetExportedWrapper(uint32_t index);
-  WasmCode* AddExportedWrapper(Handle<Code> code, uint32_t index);
+  void SetLazyBuiltin(Handle<Code> code);
 
   // FunctionCount is WasmModule::functions.size().
   uint32_t FunctionCount() const;
   WasmCode* GetCode(uint32_t index) const;
 
-  WasmCode* lazy_builtin() const { return lazy_builtin_; }
-
   // We special-case lazy cloning because we currently rely on making copies
   // of the lazy builtin, to be able to identify, in the runtime, which function
   // the lazy builtin is a placeholder of. If we used trampolines, we would call
@@ -229,34 +267,23 @@ class V8_EXPORT_PRIVATE NativeModule final {
   // builtin. The logic for seeking though frames would change, though.
   // TODO(mtrofin): perhaps we can do exactly that - either before or after
   // this change.
-  WasmCode* CloneLazyBuiltinInto(uint32_t);
+  WasmCode* CloneLazyBuiltinInto(const WasmCode* code, uint32_t index,
+                                 WasmCode::FlushICache);
 
   bool SetExecutable(bool executable);
 
   // For cctests, where we build both WasmModule and the runtime objects
   // on the fly, and bypass the instance builder pipeline.
   void ResizeCodeTableForTest(size_t);
-  void LinkAll();
-  void Link(uint32_t index);
 
-  // TODO(mtrofin): needed until we sort out exception handlers and
-  // source positions, which are still on the  GC-heap.
+  CompilationState* compilation_state() { return compilation_state_.get(); }
+
+  // TODO(mstarzinger): The link to the {compiled_module} is deprecated and all
+  // uses should vanish to make {NativeModule} independent of the Isolate.
   WasmCompiledModule* compiled_module() const;
   void SetCompiledModule(Handle<WasmCompiledModule>);
 
-  // Shorthand accessors to the specialization data content.
-  std::vector<wasm::GlobalHandleAddress>& function_tables() {
-    return specialization_data_.function_tables;
-  }
-
-  std::vector<wasm::GlobalHandleAddress>& empty_function_tables() {
-    return specialization_data_.empty_function_tables;
-  }
-
   uint32_t num_imported_functions() const { return num_imported_functions_; }
-  size_t num_function_tables() const {
-    return specialization_data_.empty_function_tables.size();
-  }
 
   size_t committed_memory() const { return committed_memory_; }
   const size_t instance_id = 0;
@@ -266,19 +293,9 @@ class V8_EXPORT_PRIVATE NativeModule final {
   friend class WasmCodeManager;
   friend class NativeModuleSerializer;
   friend class NativeModuleDeserializer;
+  friend class NativeModuleModificationScope;
 
-  struct WasmCodeUniquePtrComparer {
-    bool operator()(const std::unique_ptr<WasmCode>& a,
-                    const std::unique_ptr<WasmCode>& b) {
-      DCHECK(a);
-      DCHECK(b);
-      return a->instructions().start() < b->instructions().start();
-    }
-  };
-
-  static base::AtomicNumber<uint32_t> next_id_;
-  NativeModule(const NativeModule&) = delete;
-  NativeModule& operator=(const NativeModule&) = delete;
+  static base::AtomicNumber<size_t> next_id_;
   NativeModule(uint32_t num_functions, uint32_t num_imports,
                bool can_request_more, VirtualMemory* vmem,
                WasmCodeManager* code_manager);
@@ -292,47 +309,53 @@ class V8_EXPORT_PRIVATE NativeModule final {
   // whether it has an index or is anonymous, etc.
   WasmCode* AddOwnedCode(Vector<const byte> orig_instructions,
                          std::unique_ptr<const byte[]> reloc_info,
-                         size_t reloc_size, Maybe<uint32_t> index,
+                         size_t reloc_size,
+                         std::unique_ptr<const byte[]> source_pos,
+                         size_t source_pos_size, Maybe<uint32_t> index,
                          WasmCode::Kind kind, size_t constant_pool_offset,
                          uint32_t stack_slots, size_t safepoint_table_offset,
-                         std::shared_ptr<ProtectedInstructions>,
-                         bool is_liftoff = false);
-  void SetCodeTable(uint32_t, wasm::WasmCode*);
-  WasmCode* CloneCode(const WasmCode*);
-  bool CloneTrampolinesAndStubs(const NativeModule* other);
+                         size_t handler_table_offset,
+                         std::shared_ptr<ProtectedInstructions>, WasmCode::Tier,
+                         WasmCode::FlushICache);
+  WasmCode* CloneCode(const WasmCode*, WasmCode::FlushICache);
+  void CloneTrampolinesAndStubs(const NativeModule* other,
+                                WasmCode::FlushICache);
   WasmCode* Lookup(Address);
   Address GetLocalAddressFor(Handle<Code>);
   Address CreateTrampolineTo(Handle<Code>);
 
+  // Holds all allocated code objects, is maintained to be in ascending order
+  // according to the codes instruction start address to allow lookups.
   std::vector<std::unique_ptr<WasmCode>> owned_code_;
-  std::unordered_map<uint32_t, WasmCode*> exported_wasm_to_wasm_wrappers_;
-
-  WasmCodeUniquePtrComparer owned_code_comparer_;
 
   std::vector<WasmCode*> code_table_;
   uint32_t num_imported_functions_;
 
+  // Maps from instruction start of an immovable code object to instruction
+  // start of the trampoline.
   std::unordered_map<Address, Address, AddressHasher> trampolines_;
+
+  // Maps from stub key to wasm code (containing a copy of that stub).
   std::unordered_map<uint32_t, WasmCode*> stubs_;
 
+  std::unique_ptr<CompilationState, CompilationStateDeleter> compilation_state_;
+
+  // A phantom reference to the {WasmCompiledModule}. It is intentionally not
+  // typed {Handle<WasmCompiledModule>} because this location will be cleared
+  // when the phantom reference is cleared.
+  WasmCompiledModule** compiled_module_ = nullptr;
+
   DisjointAllocationPool free_memory_;
   DisjointAllocationPool allocated_memory_;
   std::list<VirtualMemory> owned_memory_;
   WasmCodeManager* wasm_code_manager_;
-  wasm::WasmCode* lazy_builtin_ = nullptr;
   base::Mutex allocation_mutex_;
-  Handle<WasmCompiledModule> compiled_module_;
   size_t committed_memory_ = 0;
   bool can_request_more_memory_;
   bool is_executable_ = false;
+  int modification_scope_depth_ = 0;
 
-  // Specialization data that needs to be serialized and cloned.
-  // Keeping it groupped together because it makes cloning of all these
-  // elements a 1 line copy.
-  struct {
-    std::vector<wasm::GlobalHandleAddress> function_tables;
-    std::vector<wasm::GlobalHandleAddress> empty_function_tables;
-  } specialization_data_;
+  DISALLOW_COPY_AND_ASSIGN(NativeModule);
 };
 
 class V8_EXPORT_PRIVATE WasmCodeManager final {
@@ -356,15 +379,9 @@ class V8_EXPORT_PRIVATE WasmCodeManager final {
   WasmCode* GetCodeFromStartAddress(Address pc) const;
   intptr_t remaining_uncommitted() const;
 
-  // TODO(mtrofin): replace this API with an alternative that is Isolate-
-  // independent.
-  void FlushICache(Address start, size_t size);
-
  private:
   friend class NativeModule;
 
-  WasmCodeManager(const WasmCodeManager&) = delete;
-  WasmCodeManager& operator=(const WasmCodeManager&) = delete;
   void TryAllocate(size_t size, VirtualMemory*, void* hint = nullptr);
   bool Commit(Address, size_t);
   // Currently, we uncommit a whole module, so all we need is account
@@ -385,6 +402,8 @@ class V8_EXPORT_PRIVATE WasmCodeManager final {
 
   // TODO(mtrofin): remove the dependency on isolate.
   v8::Isolate* isolate_;
+
+  DISALLOW_COPY_AND_ASSIGN(WasmCodeManager);
 };
 
 // Within the scope, the native_module is writable and not executable.
@@ -406,14 +425,8 @@ class NativeModuleModificationScope final {
   NativeModule* native_module_;
 };
 
-// Utilities specific to wasm code generation. We embed a tag for call sites -
-// the index of the called function - when serializing and when creating the
-// code, initially. These APIs offer accessors. The implementation has platform
-// specific nuances.
-void SetWasmCalleeTag(RelocInfo* rinfo, uint32_t tag);
-uint32_t GetWasmCalleeTag(RelocInfo* rinfo);
-
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
-#endif
+
+#endif  // V8_WASM_WASM_CODE_MANAGER_H_
diff --git a/deps/v8/src/wasm/wasm-code-specialization.cc b/deps/v8/src/wasm/wasm-code-specialization.cc
index 416d1d600ab..746cae01b02 100644
--- a/deps/v8/src/wasm/wasm-code-specialization.cc
+++ b/deps/v8/src/wasm/wasm-code-specialization.cc
@@ -43,80 +43,42 @@ int AdvanceSourcePositionTableIterator(SourcePositionTableIterator& iterator,
 
 class PatchDirectCallsHelper {
  public:
-  PatchDirectCallsHelper(WasmInstanceObject* instance, const WasmCode* code)
-      : source_pos_it(ByteArray::cast(
-            instance->compiled_module()->source_positions()->get(
-                static_cast<int>(code->index())))),
-        decoder(nullptr, nullptr) {
+  PatchDirectCallsHelper(NativeModule* native_module, const WasmCode* code)
+      : source_pos_it(code->source_positions()), decoder(nullptr, nullptr) {
     uint32_t func_index = code->index();
-    WasmCompiledModule* comp_mod = instance->compiled_module();
+    WasmCompiledModule* comp_mod = native_module->compiled_module();
     func_bytes =
         comp_mod->shared()->module_bytes()->GetChars() +
         comp_mod->shared()->module()->functions[func_index].code.offset();
   }
 
-  PatchDirectCallsHelper(WasmInstanceObject* instance, Code* code)
-      : source_pos_it(code->SourcePositionTable()), decoder(nullptr, nullptr) {
-    FixedArray* deopt_data = code->deoptimization_data();
-    DCHECK_EQ(2, deopt_data->length());
-    WasmSharedModuleData* shared = instance->compiled_module()->shared();
-    int func_index = Smi::ToInt(deopt_data->get(1));
-    func_bytes = shared->module_bytes()->GetChars() +
-                 shared->module()->functions[func_index].code.offset();
-  }
-
   SourcePositionTableIterator source_pos_it;
   Decoder decoder;
   const byte* func_bytes;
 };
 
-bool IsAtWasmDirectCallTarget(RelocIterator& it) {
-  DCHECK(RelocInfo::IsCodeTarget(it.rinfo()->rmode()));
-  Code* code = Code::GetCodeFromTargetAddress(it.rinfo()->target_address());
-  return code->kind() == Code::WASM_FUNCTION ||
-         code->kind() == Code::WASM_TO_JS_FUNCTION ||
-         code->kind() == Code::WASM_TO_WASM_FUNCTION ||
-         code->kind() == Code::WASM_INTERPRETER_ENTRY ||
-         code->builtin_index() == Builtins::kIllegal ||
-         code->builtin_index() == Builtins::kWasmCompileLazy;
-}
-
 }  // namespace
 
-CodeSpecialization::CodeSpecialization(Isolate* isolate, Zone* zone)
-    : isolate_(isolate) {}
+CodeSpecialization::CodeSpecialization(Isolate* isolate, Zone* zone) {}
 
 CodeSpecialization::~CodeSpecialization() {}
 
 void CodeSpecialization::RelocateWasmContextReferences(Address new_context) {
   DCHECK_NOT_NULL(new_context);
-  DCHECK_NULL(new_wasm_context_address);
-  new_wasm_context_address = new_context;
-}
-
-void CodeSpecialization::PatchTableSize(uint32_t old_size, uint32_t new_size) {
-  DCHECK(old_function_table_size == 0 && new_function_table_size == 0);
-  old_function_table_size = old_size;
-  new_function_table_size = new_size;
-}
-
-void CodeSpecialization::RelocateDirectCalls(
-    Handle<WasmInstanceObject> instance) {
-  DCHECK(relocate_direct_calls_instance.is_null());
-  DCHECK(!instance.is_null());
-  relocate_direct_calls_instance = instance;
+  DCHECK_NULL(new_wasm_context_address_);
+  new_wasm_context_address_ = new_context;
 }
 
-void CodeSpecialization::RelocatePointer(Address old_ptr, Address new_ptr) {
-  pointers_to_relocate.insert(std::make_pair(old_ptr, new_ptr));
+void CodeSpecialization::RelocateDirectCalls(NativeModule* native_module) {
+  DCHECK_NULL(relocate_direct_calls_module_);
+  DCHECK_NOT_NULL(native_module);
+  relocate_direct_calls_module_ = native_module;
 }
 
-bool CodeSpecialization::ApplyToWholeInstance(
-    WasmInstanceObject* instance, ICacheFlushMode icache_flush_mode) {
+bool CodeSpecialization::ApplyToWholeModule(NativeModule* native_module,
+                                            ICacheFlushMode icache_flush_mode) {
   DisallowHeapAllocation no_gc;
-  WasmCompiledModule* compiled_module = instance->compiled_module();
-  NativeModule* native_module = compiled_module->GetNativeModule();
-  FixedArray* code_table = compiled_module->code_table();
+  WasmCompiledModule* compiled_module = native_module->compiled_module();
   WasmSharedModuleData* shared = compiled_module->shared();
   WasmModule* module = shared->module();
   std::vector<WasmFunction>* wasm_functions = &shared->module()->functions;
@@ -129,159 +91,92 @@ bool CodeSpecialization::ApplyToWholeInstance(
   // Patch all wasm functions.
   for (int num_wasm_functions = static_cast<int>(wasm_functions->size());
        func_index < num_wasm_functions; ++func_index) {
-    WasmCodeWrapper wrapper;
-    if (FLAG_wasm_jit_to_native) {
-      const WasmCode* wasm_function = native_module->GetCode(func_index);
-      if (wasm_function->kind() != WasmCode::kFunction) {
-        continue;
-      }
-      wrapper = WasmCodeWrapper(wasm_function);
-    } else {
-      Code* wasm_function = Code::cast(code_table->get(func_index));
-      if (wasm_function->kind() != Code::WASM_FUNCTION) continue;
-      wrapper = WasmCodeWrapper(handle(wasm_function));
+    WasmCode* wasm_function = native_module->GetCode(func_index);
+    // TODO(clemensh): Get rid of this nullptr check
+    if (wasm_function == nullptr ||
+        wasm_function->kind() != WasmCode::kFunction) {
+      continue;
     }
-    changed |= ApplyToWasmCode(wrapper, icache_flush_mode);
+    changed |= ApplyToWasmCode(wasm_function, icache_flush_mode);
   }
 
   // Patch all exported functions (JS_TO_WASM_FUNCTION).
   int reloc_mode = 0;
   // We need to patch WASM_CONTEXT_REFERENCE to put the correct address.
-  if (new_wasm_context_address) {
+  if (new_wasm_context_address_) {
     reloc_mode |= RelocInfo::ModeMask(RelocInfo::WASM_CONTEXT_REFERENCE);
   }
   // Patch CODE_TARGET if we shall relocate direct calls. If we patch direct
-  // calls, the instance registered for that (relocate_direct_calls_instance)
+  // calls, the instance registered for that (relocate_direct_calls_module_)
   // should match the instance we currently patch (instance).
-  if (!relocate_direct_calls_instance.is_null()) {
-    DCHECK_EQ(instance, *relocate_direct_calls_instance);
-    reloc_mode |=
-        RelocInfo::ModeMask(FLAG_wasm_jit_to_native ? RelocInfo::JS_TO_WASM_CALL
-                                                    : RelocInfo::CODE_TARGET);
+  if (relocate_direct_calls_module_ != nullptr) {
+    DCHECK_EQ(native_module, relocate_direct_calls_module_);
+    reloc_mode |= RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL);
   }
   if (!reloc_mode) return changed;
   int wrapper_index = 0;
   for (auto exp : module->export_table) {
     if (exp.kind != kExternalFunction) continue;
     Code* export_wrapper =
-        Code::cast(compiled_module->export_wrappers()->get(wrapper_index));
-    DCHECK_EQ(Code::JS_TO_WASM_FUNCTION, export_wrapper->kind());
+        Code::cast(compiled_module->export_wrappers()->get(wrapper_index++));
+    if (export_wrapper->kind() != Code::JS_TO_WASM_FUNCTION) continue;
     for (RelocIterator it(export_wrapper, reloc_mode); !it.done(); it.next()) {
       RelocInfo::Mode mode = it.rinfo()->rmode();
       switch (mode) {
         case RelocInfo::WASM_CONTEXT_REFERENCE:
-          it.rinfo()->set_wasm_context_reference(export_wrapper->GetIsolate(),
-                                                 new_wasm_context_address,
+          it.rinfo()->set_wasm_context_reference(new_wasm_context_address_,
                                                  icache_flush_mode);
           break;
         case RelocInfo::JS_TO_WASM_CALL: {
-          DCHECK(FLAG_wasm_jit_to_native);
           const WasmCode* new_code = native_module->GetCode(exp.index);
-          it.rinfo()->set_js_to_wasm_address(
-              nullptr, new_code->instructions().start(), SKIP_ICACHE_FLUSH);
-        } break;
-        case RelocInfo::CODE_TARGET: {
-          DCHECK(!FLAG_wasm_jit_to_native);
-          // Ignore calls to other builtins like ToNumber.
-          if (!IsAtWasmDirectCallTarget(it)) continue;
-          Code* new_code = Code::cast(code_table->get(exp.index));
-          it.rinfo()->set_target_address(
-              new_code->GetIsolate(), new_code->instruction_start(),
-              UPDATE_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
+          it.rinfo()->set_js_to_wasm_address(new_code->instructions().start(),
+                                             icache_flush_mode);
         } break;
         default:
           UNREACHABLE();
       }
     }
     changed = true;
-    ++wrapper_index;
   }
   DCHECK_EQ(module->functions.size(), func_index);
   DCHECK_EQ(compiled_module->export_wrappers()->length(), wrapper_index);
   return changed;
 }
 
-bool CodeSpecialization::ApplyToWasmCode(WasmCodeWrapper code,
+bool CodeSpecialization::ApplyToWasmCode(wasm::WasmCode* code,
                                          ICacheFlushMode icache_flush_mode) {
   DisallowHeapAllocation no_gc;
-  if (code.IsCodeObject()) {
-    DCHECK_EQ(Code::WASM_FUNCTION, code.GetCode()->kind());
-  } else {
-    DCHECK_EQ(wasm::WasmCode::kFunction, code.GetWasmCode()->kind());
-  }
+  DCHECK_EQ(wasm::WasmCode::kFunction, code->kind());
 
-  bool patch_table_size = old_function_table_size || new_function_table_size;
-  bool reloc_direct_calls = !relocate_direct_calls_instance.is_null();
-  bool reloc_pointers = pointers_to_relocate.size() > 0;
+  bool reloc_direct_calls = relocate_direct_calls_module_ != nullptr;
 
   int reloc_mode = 0;
   auto add_mode = [&reloc_mode](bool cond, RelocInfo::Mode mode) {
     if (cond) reloc_mode |= RelocInfo::ModeMask(mode);
   };
-  add_mode(patch_table_size, RelocInfo::WASM_FUNCTION_TABLE_SIZE_REFERENCE);
-  if (code.IsCodeObject()) {
-    add_mode(reloc_direct_calls, RelocInfo::CODE_TARGET);
-  } else {
-    add_mode(reloc_direct_calls, RelocInfo::WASM_CALL);
-  }
-  add_mode(reloc_pointers, RelocInfo::WASM_GLOBAL_HANDLE);
+  add_mode(reloc_direct_calls, RelocInfo::WASM_CALL);
 
   base::Optional<PatchDirectCallsHelper> patch_direct_calls_helper;
   bool changed = false;
 
-  NativeModule* native_module =
-      code.IsCodeObject() ? nullptr : code.GetWasmCode()->owner();
+  NativeModule* native_module = code->native_module();
 
-  RelocIterator it =
-      code.IsCodeObject()
-          ? RelocIterator(*code.GetCode(), reloc_mode)
-          : RelocIterator(code.GetWasmCode()->instructions(),
-                          code.GetWasmCode()->reloc_info(),
-                          code.GetWasmCode()->constant_pool(), reloc_mode);
+  RelocIterator it(code->instructions(), code->reloc_info(),
+                   code->constant_pool(), reloc_mode);
   for (; !it.done(); it.next()) {
     RelocInfo::Mode mode = it.rinfo()->rmode();
     switch (mode) {
-      case RelocInfo::CODE_TARGET: {
-        DCHECK(!FLAG_wasm_jit_to_native);
-        DCHECK(reloc_direct_calls);
-        // Skip everything which is not a wasm call (stack checks, traps, ...).
-        if (!IsAtWasmDirectCallTarget(it)) continue;
-        // Iterate simultaneously over the relocation information and the source
-        // position table. For each call in the reloc info, move the source
-        // position iterator forward to that position to find the byte offset of
-        // the respective call. Then extract the call index from the module wire
-        // bytes to find the new compiled function.
-        size_t offset = it.rinfo()->pc() - code.GetCode()->instruction_start();
-        if (!patch_direct_calls_helper) {
-          patch_direct_calls_helper.emplace(*relocate_direct_calls_instance,
-                                            *code.GetCode());
-        }
-        int byte_pos = AdvanceSourcePositionTableIterator(
-            patch_direct_calls_helper->source_pos_it, offset);
-        int called_func_index = ExtractDirectCallIndex(
-            patch_direct_calls_helper->decoder,
-            patch_direct_calls_helper->func_bytes + byte_pos);
-        FixedArray* code_table =
-            relocate_direct_calls_instance->compiled_module()->code_table();
-        Code* new_code = Code::cast(code_table->get(called_func_index));
-        it.rinfo()->set_target_address(new_code->GetIsolate(),
-                                       new_code->instruction_start(),
-                                       UPDATE_WRITE_BARRIER, icache_flush_mode);
-        changed = true;
-      } break;
       case RelocInfo::WASM_CALL: {
-        DCHECK(FLAG_wasm_jit_to_native);
         DCHECK(reloc_direct_calls);
         // Iterate simultaneously over the relocation information and the source
         // position table. For each call in the reloc info, move the source
         // position iterator forward to that position to find the byte offset of
         // the respective call. Then extract the call index from the module wire
         // bytes to find the new compiled function.
-        size_t offset =
-            it.rinfo()->pc() - code.GetWasmCode()->instructions().start();
+        size_t offset = it.rinfo()->pc() - code->instructions().start();
         if (!patch_direct_calls_helper) {
-          patch_direct_calls_helper.emplace(*relocate_direct_calls_instance,
-                                            code.GetWasmCode());
+          patch_direct_calls_helper.emplace(relocate_direct_calls_module_,
+                                            code);
         }
         int byte_pos = AdvanceSourcePositionTableIterator(
             patch_direct_calls_helper->source_pos_it, offset);
@@ -289,26 +184,10 @@ bool CodeSpecialization::ApplyToWasmCode(WasmCodeWrapper code,
             patch_direct_calls_helper->decoder,
             patch_direct_calls_helper->func_bytes + byte_pos);
         const WasmCode* new_code = native_module->GetCode(called_func_index);
-        it.rinfo()->set_wasm_call_address(
-            isolate_, new_code->instructions().start(), icache_flush_mode);
+        it.rinfo()->set_wasm_call_address(new_code->instructions().start(),
+                                          icache_flush_mode);
         changed = true;
       } break;
-      case RelocInfo::WASM_GLOBAL_HANDLE: {
-        DCHECK(reloc_pointers);
-        Address old_ptr = it.rinfo()->global_handle();
-        if (pointers_to_relocate.count(old_ptr) == 1) {
-          Address new_ptr = pointers_to_relocate[old_ptr];
-          it.rinfo()->set_global_handle(isolate_, new_ptr, icache_flush_mode);
-          changed = true;
-        }
-      } break;
-      case RelocInfo::WASM_FUNCTION_TABLE_SIZE_REFERENCE:
-        DCHECK(patch_table_size);
-        it.rinfo()->update_wasm_function_table_size_reference(
-            isolate_, old_function_table_size, new_function_table_size,
-            icache_flush_mode);
-        changed = true;
-        break;
       default:
         UNREACHABLE();
     }
diff --git a/deps/v8/src/wasm/wasm-code-specialization.h b/deps/v8/src/wasm/wasm-code-specialization.h
index 8f68677fbf8..927e3ed800c 100644
--- a/deps/v8/src/wasm/wasm-code-specialization.h
+++ b/deps/v8/src/wasm/wasm-code-specialization.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_CODE_SPECIALIZATION_H_
-#define V8_WASM_CODE_SPECIALIZATION_H_
+#ifndef V8_WASM_WASM_CODE_SPECIALIZATION_H_
+#define V8_WASM_WASM_CODE_SPECIALIZATION_H_
 
 #include "src/assembler.h"
 #include "src/identity-map.h"
@@ -30,36 +30,24 @@ class CodeSpecialization {
 
   // Update WasmContext references.
   void RelocateWasmContextReferences(Address new_context);
-  // Update function table size.
-  // TODO(wasm): Prepare this for more than one indirect function table.
-  void PatchTableSize(uint32_t old_size, uint32_t new_size);
   // Update all direct call sites based on the code table in the given instance.
-  void RelocateDirectCalls(Handle<WasmInstanceObject> instance);
-  // Relocate an arbitrary object (e.g. function table).
-  void RelocatePointer(Address old_obj, Address new_obj);
-
+  void RelocateDirectCalls(NativeModule* module);
   // Apply all relocations and patching to all code in the instance (wasm code
   // and exported functions).
-  bool ApplyToWholeInstance(WasmInstanceObject*,
-                            ICacheFlushMode = FLUSH_ICACHE_IF_NEEDED);
+  bool ApplyToWholeModule(NativeModule*,
+                          ICacheFlushMode = FLUSH_ICACHE_IF_NEEDED);
   // Apply all relocations and patching to one wasm code object.
-  bool ApplyToWasmCode(WasmCodeWrapper,
+  bool ApplyToWasmCode(wasm::WasmCode*,
                        ICacheFlushMode = FLUSH_ICACHE_IF_NEEDED);
 
  private:
-  Isolate* isolate_;
-  Address new_wasm_context_address = 0;
-
-  uint32_t old_function_table_size = 0;
-  uint32_t new_function_table_size = 0;
-
-  Handle<WasmInstanceObject> relocate_direct_calls_instance;
+  Address new_wasm_context_address_ = 0;
 
-  std::map<Address, Address> pointers_to_relocate;
+  NativeModule* relocate_direct_calls_module_ = nullptr;
 };
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_CODE_SPECIALIZATION_H_
+#endif  // V8_WASM_WASM_CODE_SPECIALIZATION_H_
diff --git a/deps/v8/src/wasm/wasm-code-wrapper.cc b/deps/v8/src/wasm/wasm-code-wrapper.cc
deleted file mode 100644
index 9256391543f..00000000000
--- a/deps/v8/src/wasm/wasm-code-wrapper.cc
+++ /dev/null
@@ -1,69 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/wasm/wasm-code-wrapper.h"
-
-#include "src/objects-inl.h"
-#include "src/objects/code.h"
-#include "src/wasm/wasm-code-manager.h"
-#include "src/wasm/wasm-objects.h"
-
-namespace v8 {
-namespace internal {
-
-// When constructing, we check the flag. After that, we just
-// check using the member.
-WasmCodeWrapper::WasmCodeWrapper(Handle<Code> code) {
-  DCHECK(!FLAG_wasm_jit_to_native);
-  code_ptr_.code_handle_ = code.location();
-}
-
-WasmCodeWrapper::WasmCodeWrapper(const wasm::WasmCode* code) {
-  DCHECK(FLAG_wasm_jit_to_native);
-  code_ptr_.wasm_code_ = code;
-}
-
-Handle<Code> WasmCodeWrapper::GetCode() const {
-  DCHECK(IsCodeObject());
-  return Handle<Code>(code_ptr_.code_handle_);
-}
-
-const wasm::WasmCode* WasmCodeWrapper::GetWasmCode() const {
-  DCHECK(!IsCodeObject());
-  return code_ptr_.wasm_code_;
-}
-
-bool WasmCodeWrapper::IsCodeObject() const { return !FLAG_wasm_jit_to_native; }
-
-#ifdef ENABLE_DISASSEMBLER
-void WasmCodeWrapper::Disassemble(const char* name, Isolate* isolate,
-                                  std::ostream& os) const {
-  if (IsCodeObject()) {
-    GetCode()->Disassemble(name, os);
-  } else {
-    GetWasmCode()->Disassemble(name, isolate, os);
-  }
-}
-#endif
-
-bool WasmCodeWrapper::is_liftoff() const {
-  return IsCodeObject() ? !GetCode()->is_turbofanned()
-                        : GetWasmCode()->is_liftoff();
-}
-
-Vector<uint8_t> WasmCodeWrapper::instructions() const {
-  if (!IsCodeObject()) return GetWasmCode()->instructions();
-  Handle<Code> code = GetCode();
-  return {code->instruction_start(),
-          static_cast<size_t>(code->instruction_size())};
-}
-
-Handle<WasmInstanceObject> WasmCodeWrapper::wasm_instance() const {
-  return IsCodeObject()
-             ? handle(WasmInstanceObject::GetOwningInstanceGC(*GetCode()))
-             : handle(WasmInstanceObject::GetOwningInstance(GetWasmCode()));
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/wasm/wasm-code-wrapper.h b/deps/v8/src/wasm/wasm-code-wrapper.h
deleted file mode 100644
index 7d978152f1c..00000000000
--- a/deps/v8/src/wasm/wasm-code-wrapper.h
+++ /dev/null
@@ -1,48 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-#ifndef V8_WASM_CODE_WRAPPER_H_
-#define V8_WASM_CODE_WRAPPER_H_
-
-#include "src/handles.h"
-
-namespace v8 {
-namespace internal {
-namespace wasm {
-class WasmCode;
-}  // namespace wasm
-
-class Code;
-class WasmInstanceObject;
-
-// TODO(mtrofin): remove once we remove FLAG_wasm_jit_to_native
-class WasmCodeWrapper {
- public:
-  WasmCodeWrapper() {}
-
-  explicit WasmCodeWrapper(Handle<Code> code);
-  explicit WasmCodeWrapper(const wasm::WasmCode* code);
-  Handle<Code> GetCode() const;
-  const wasm::WasmCode* GetWasmCode() const;
-  bool is_null() const { return code_ptr_.wasm_code_ == nullptr; }
-  bool IsCodeObject() const;
-  bool is_liftoff() const;
-
-  Vector<uint8_t> instructions() const;
-
-  Handle<WasmInstanceObject> wasm_instance() const;
-
-#ifdef ENABLE_DISASSEMBLER
-  void Disassemble(const char* name, Isolate* isolate, std::ostream& os) const;
-#endif
-
- private:
-  union {
-    const wasm::WasmCode* wasm_code_;
-    Code** code_handle_;
-  } code_ptr_ = {};
-};
-
-}  // namespace internal
-}  // namespace v8
-#endif  // V8_WASM_CODE_WRAPPER_H_
diff --git a/deps/v8/src/wasm/wasm-constants.h b/deps/v8/src/wasm/wasm-constants.h
index 5e7ce1e4f58..dc6f1ee6755 100644
--- a/deps/v8/src/wasm/wasm-constants.h
+++ b/deps/v8/src/wasm/wasm-constants.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_CONSTANTS_H_
-#define V8_WASM_CONSTANTS_H_
+#ifndef V8_WASM_WASM_CONSTANTS_H_
+#define V8_WASM_WASM_CONSTANTS_H_
 
 namespace v8 {
 namespace internal {
@@ -20,7 +20,8 @@ enum ValueTypeCode : uint8_t {
   kLocalI64 = 0x7e,
   kLocalF32 = 0x7d,
   kLocalF64 = 0x7c,
-  kLocalS128 = 0x7b
+  kLocalS128 = 0x7b,
+  kLocalAnyRef = 0x6f
 };
 // Binary encoding of other types.
 constexpr uint8_t kWasmFunctionTypeCode = 0x60;
@@ -80,4 +81,4 @@ constexpr WasmCodePosition kNoCodePosition = -1;
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_CONSTANTS_H_
+#endif  // V8_WASM_WASM_CONSTANTS_H_
diff --git a/deps/v8/src/wasm/wasm-debug.cc b/deps/v8/src/wasm/wasm-debug.cc
index 87995df4e6d..d7f7ed9576a 100644
--- a/deps/v8/src/wasm/wasm-debug.cc
+++ b/deps/v8/src/wasm/wasm-debug.cc
@@ -293,8 +293,7 @@ class InterpreterHandle {
     // Check that this is indeed the instance which is connected to this
     // interpreter.
     DCHECK_EQ(this, Managed<wasm::InterpreterHandle>::cast(
-                        instance_obj->debug_info()->get(
-                            WasmDebugInfo::kInterpreterHandleIndex))
+                        instance_obj->debug_info()->interpreter_handle())
                         ->get());
     return instance_obj;
   }
@@ -438,7 +437,6 @@ class InterpreterHandle {
   Handle<JSObject> GetLocalScopeObject(wasm::InterpretedFrame* frame,
                                        Handle<WasmDebugInfo> debug_info) {
     Isolate* isolate = debug_info->GetIsolate();
-    Handle<WasmInstanceObject> instance(debug_info->wasm_instance(), isolate);
 
     Handle<JSObject> local_scope_object =
         isolate_->factory()->NewJSObjectWithNullProto();
@@ -497,8 +495,6 @@ class InterpreterHandle {
   Handle<JSArray> GetScopeDetails(Address frame_pointer, int frame_index,
                                   Handle<WasmDebugInfo> debug_info) {
     auto frame = GetInterpretedFrame(frame_pointer, frame_index);
-    Isolate* isolate = debug_info->GetIsolate();
-    Handle<WasmInstanceObject> instance(debug_info->wasm_instance(), isolate);
 
     Handle<FixedArray> global_scope =
         isolate_->factory()->NewFixedArray(ScopeIterator::kScopeDetailsSize);
@@ -537,25 +533,24 @@ namespace {
 
 wasm::InterpreterHandle* GetOrCreateInterpreterHandle(
     Isolate* isolate, Handle<WasmDebugInfo> debug_info) {
-  Handle<Object> handle(debug_info->get(WasmDebugInfo::kInterpreterHandleIndex),
-                        isolate);
+  Handle<Object> handle(debug_info->interpreter_handle(), isolate);
   if (handle->IsUndefined(isolate)) {
     handle = Managed<wasm::InterpreterHandle>::Allocate(isolate, isolate,
                                                         *debug_info);
-    debug_info->set(WasmDebugInfo::kInterpreterHandleIndex, *handle);
+    debug_info->set_interpreter_handle(*handle);
   }
 
   return Handle<Managed<wasm::InterpreterHandle>>::cast(handle)->get();
 }
 
 wasm::InterpreterHandle* GetInterpreterHandle(WasmDebugInfo* debug_info) {
-  Object* handle_obj = debug_info->get(WasmDebugInfo::kInterpreterHandleIndex);
+  Object* handle_obj = debug_info->interpreter_handle();
   DCHECK(!handle_obj->IsUndefined(debug_info->GetIsolate()));
   return Managed<wasm::InterpreterHandle>::cast(handle_obj)->get();
 }
 
 wasm::InterpreterHandle* GetInterpreterHandleOrNull(WasmDebugInfo* debug_info) {
-  Object* handle_obj = debug_info->get(WasmDebugInfo::kInterpreterHandleIndex);
+  Object* handle_obj = debug_info->interpreter_handle();
   if (handle_obj->IsUndefined(debug_info->GetIsolate())) return nullptr;
   return Managed<wasm::InterpreterHandle>::cast(handle_obj)->get();
 }
@@ -569,32 +564,16 @@ int GetNumFunctions(WasmInstanceObject* instance) {
 
 Handle<FixedArray> GetOrCreateInterpretedFunctions(
     Isolate* isolate, Handle<WasmDebugInfo> debug_info) {
-  Handle<Object> obj(debug_info->get(WasmDebugInfo::kInterpretedFunctionsIndex),
-                     isolate);
+  Handle<Object> obj(debug_info->interpreted_functions(), isolate);
   if (!obj->IsUndefined(isolate)) return Handle<FixedArray>::cast(obj);
 
   Handle<FixedArray> new_arr = isolate->factory()->NewFixedArray(
       GetNumFunctions(debug_info->wasm_instance()));
-  debug_info->set(WasmDebugInfo::kInterpretedFunctionsIndex, *new_arr);
+  debug_info->set_interpreted_functions(*new_arr);
   return new_arr;
 }
 
 using CodeRelocationMap = std::map<Address, Address>;
-using CodeRelocationMapGC =
-    IdentityMap<Handle<Code>, FreeStoreAllocationPolicy>;
-
-void RedirectCallsitesInCodeGC(Code* code, CodeRelocationMapGC& map) {
-  DisallowHeapAllocation no_gc;
-  for (RelocIterator it(code, RelocInfo::kCodeTargetMask); !it.done();
-       it.next()) {
-    DCHECK(RelocInfo::IsCodeTarget(it.rinfo()->rmode()));
-    Code* target = Code::GetCodeFromTargetAddress(it.rinfo()->target_address());
-    Handle<Code>* new_target = map.Find(target);
-    if (!new_target) continue;
-    it.rinfo()->set_target_address(code->GetIsolate(),
-                                   (*new_target)->instruction_start());
-  }
-}
 
 void RedirectCallsitesInCode(Isolate* isolate, const wasm::WasmCode* code,
                              CodeRelocationMap* map) {
@@ -606,7 +585,7 @@ void RedirectCallsitesInCode(Isolate* isolate, const wasm::WasmCode* code,
     Address target = it.rinfo()->target_address();
     auto new_target = map->find(target);
     if (new_target == map->end()) continue;
-    it.rinfo()->set_wasm_call_address(isolate, new_target->second);
+    it.rinfo()->set_wasm_call_address(new_target->second);
   }
 }
 
@@ -618,29 +597,7 @@ void RedirectCallsitesInJSWrapperCode(Isolate* isolate, Code* code,
     Address target = it.rinfo()->js_to_wasm_address();
     auto new_target = map->find(target);
     if (new_target == map->end()) continue;
-    it.rinfo()->set_js_to_wasm_address(isolate, new_target->second);
-  }
-}
-
-void RedirectCallsitesInInstanceGC(Isolate* isolate,
-                                   WasmInstanceObject* instance,
-                                   CodeRelocationMapGC& map) {
-  DisallowHeapAllocation no_gc;
-  // Redirect all calls in wasm functions.
-  FixedArray* code_table = instance->compiled_module()->code_table();
-  for (int i = 0, e = GetNumFunctions(instance); i < e; ++i) {
-    RedirectCallsitesInCodeGC(Code::cast(code_table->get(i)), map);
-  }
-  // TODO(6668): Find instances that imported our code and also patch those.
-
-  // Redirect all calls in exported functions.
-  FixedArray* weak_exported_functions =
-      instance->compiled_module()->weak_exported_functions();
-  for (int i = 0, e = weak_exported_functions->length(); i != e; ++i) {
-    WeakCell* weak_function = WeakCell::cast(weak_exported_functions->get(i));
-    if (weak_function->cleared()) continue;
-    Code* code = JSFunction::cast(weak_function->value())->code();
-    RedirectCallsitesInCodeGC(code, map);
+    it.rinfo()->set_js_to_wasm_address(new_target->second);
   }
 }
 
@@ -671,9 +628,9 @@ void RedirectCallsitesInInstance(Isolate* isolate, WasmInstanceObject* instance,
 Handle<WasmDebugInfo> WasmDebugInfo::New(Handle<WasmInstanceObject> instance) {
   DCHECK(!instance->has_debug_info());
   Factory* factory = instance->GetIsolate()->factory();
-  Handle<FixedArray> arr = factory->NewFixedArray(kFieldCount, TENURED);
-  arr->set(kInstanceIndex, *instance);
-  Handle<WasmDebugInfo> debug_info = Handle<WasmDebugInfo>::cast(arr);
+  Handle<WasmDebugInfo> debug_info = Handle<WasmDebugInfo>::cast(
+      factory->NewStruct(WASM_DEBUG_INFO_TYPE, TENURED));
+  debug_info->set_wasm_instance(*instance);
   instance->set_debug_info(*debug_info);
   return debug_info;
 }
@@ -684,29 +641,10 @@ wasm::WasmInterpreter* WasmDebugInfo::SetupForTesting(
   Isolate* isolate = instance_obj->GetIsolate();
   auto interp_handle =
       Managed<wasm::InterpreterHandle>::Allocate(isolate, isolate, *debug_info);
-  debug_info->set(kInterpreterHandleIndex, *interp_handle);
-  return interp_handle->get()->interpreter();
-}
-
-bool WasmDebugInfo::IsWasmDebugInfo(Object* object) {
-  if (!object->IsFixedArray()) return false;
-  FixedArray* arr = FixedArray::cast(object);
-  if (arr->length() != kFieldCount) return false;
-  if (!arr->get(kInstanceIndex)->IsWasmInstanceObject()) return false;
-  Isolate* isolate = arr->GetIsolate();
-  if (!arr->get(kInterpreterHandleIndex)->IsUndefined(isolate) &&
-      !arr->get(kInterpreterHandleIndex)->IsForeign())
-    return false;
-  return true;
-}
-
-WasmDebugInfo* WasmDebugInfo::cast(Object* object) {
-  DCHECK(IsWasmDebugInfo(object));
-  return reinterpret_cast<WasmDebugInfo*>(object);
-}
-
-WasmInstanceObject* WasmDebugInfo::wasm_instance() {
-  return WasmInstanceObject::cast(get(kInstanceIndex));
+  debug_info->set_interpreter_handle(*interp_handle);
+  auto ret = interp_handle->get()->interpreter();
+  ret->SetCallIndirectTestMode();
+  return ret;
 }
 
 void WasmDebugInfo::SetBreakpoint(Handle<WasmDebugInfo> debug_info,
@@ -731,9 +669,6 @@ void WasmDebugInfo::RedirectToInterpreter(Handle<WasmDebugInfo> debug_info,
   wasm::WasmModule* module = instance->module();
   CodeRelocationMap code_to_relocate;
 
-  Handle<FixedArray> code_table(instance->compiled_module()->code_table(),
-                                isolate);
-  CodeRelocationMapGC code_to_relocate_gc(isolate->heap());
   // We may modify js wrappers, as well as wasm functions. Hence the 2
   // modification scopes.
   CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
@@ -747,30 +682,19 @@ void WasmDebugInfo::RedirectToInterpreter(Handle<WasmDebugInfo> debug_info,
 
     Handle<Code> new_code = compiler::CompileWasmInterpreterEntry(
         isolate, func_index, module->functions[func_index].sig, instance);
-    if (FLAG_wasm_jit_to_native) {
-      const wasm::WasmCode* wasm_new_code =
-          native_module->AddInterpreterWrapper(new_code, func_index);
-      const wasm::WasmCode* old_code =
-          native_module->GetCode(static_cast<uint32_t>(func_index));
-      Handle<Foreign> foreign_holder = isolate->factory()->NewForeign(
-          wasm_new_code->instructions().start(), TENURED);
-      interpreted_functions->set(func_index, *foreign_holder);
-      DCHECK_EQ(0, code_to_relocate.count(old_code->instructions().start()));
-      code_to_relocate.insert(
-          std::make_pair(old_code->instructions().start(),
-                         wasm_new_code->instructions().start()));
-    } else {
-      Code* old_code = Code::cast(code_table->get(func_index));
-      interpreted_functions->set(func_index, *new_code);
-      DCHECK_NULL(code_to_relocate_gc.Find(old_code));
-      code_to_relocate_gc.Set(old_code, new_code);
-    }
-  }
-  if (FLAG_wasm_jit_to_native) {
-    RedirectCallsitesInInstance(isolate, *instance, &code_to_relocate);
-  } else {
-    RedirectCallsitesInInstanceGC(isolate, *instance, code_to_relocate_gc);
-  }
+    const wasm::WasmCode* wasm_new_code =
+        native_module->AddInterpreterWrapper(new_code, func_index);
+    const wasm::WasmCode* old_code =
+        native_module->GetCode(static_cast<uint32_t>(func_index));
+    Handle<Foreign> foreign_holder = isolate->factory()->NewForeign(
+        wasm_new_code->instructions().start(), TENURED);
+    interpreted_functions->set(func_index, *foreign_holder);
+    DCHECK_EQ(0, code_to_relocate.count(old_code->instructions().start()));
+    code_to_relocate.insert(
+        std::make_pair(old_code->instructions().start(),
+                       wasm_new_code->instructions().start()));
+  }
+  RedirectCallsitesInInstance(isolate, *instance, &code_to_relocate);
 }
 
 void WasmDebugInfo::PrepareStep(StepAction step_action) {
@@ -850,24 +774,16 @@ Handle<JSFunction> WasmDebugInfo::GetCWasmEntry(
       debug_info->set_c_wasm_entries(*entries);
     }
     DCHECK(entries->get(index)->IsUndefined(isolate));
-    Address context_address = reinterpret_cast<Address>(
-        debug_info->wasm_instance()->has_memory_object()
-            ? debug_info->wasm_instance()->wasm_context()
-            : nullptr);
-    Handle<Code> new_entry_code =
-        compiler::CompileCWasmEntry(isolate, sig, context_address);
+    Handle<Code> new_entry_code = compiler::CompileCWasmEntry(isolate, sig);
     Handle<String> name = isolate->factory()->InternalizeOneByteString(
         STATIC_CHAR_VECTOR("c-wasm-entry"));
-    Handle<SharedFunctionInfo> shared =
-        isolate->factory()->NewSharedFunctionInfo(name, new_entry_code, false);
-    shared->set_internal_formal_parameter_count(
-        compiler::CWasmEntryParameters::kNumParameters);
     NewFunctionArgs args = NewFunctionArgs::ForWasm(
         name, new_entry_code, isolate->sloppy_function_map());
     Handle<JSFunction> new_entry = isolate->factory()->NewFunction(args);
     new_entry->set_context(
         debug_info->wasm_instance()->compiled_module()->native_context());
-    new_entry->set_shared(*shared);
+    new_entry->shared()->set_internal_formal_parameter_count(
+        compiler::CWasmEntryParameters::kNumParameters);
     entries->set(index, *new_entry);
   }
   return handle(JSFunction::cast(entries->get(index)));
diff --git a/deps/v8/src/wasm/wasm-engine.cc b/deps/v8/src/wasm/wasm-engine.cc
index 4c84b70dbd7..ad50765a38e 100644
--- a/deps/v8/src/wasm/wasm-engine.cc
+++ b/deps/v8/src/wasm/wasm-engine.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "src/wasm/wasm-engine.h"
+
 #include "src/objects-inl.h"
 #include "src/wasm/module-compiler.h"
 
@@ -18,6 +19,124 @@ bool WasmEngine::SyncValidate(Isolate* isolate, const ModuleWireBytes& bytes) {
   return result.ok();
 }
 
+MaybeHandle<WasmModuleObject> WasmEngine::SyncCompileTranslatedAsmJs(
+    Isolate* isolate, ErrorThrower* thrower, const ModuleWireBytes& bytes,
+    Handle<Script> asm_js_script,
+    Vector<const byte> asm_js_offset_table_bytes) {
+  ModuleResult result = SyncDecodeWasmModule(isolate, bytes.start(),
+                                             bytes.end(), false, kAsmJsOrigin);
+  CHECK(!result.failed());
+
+  // Transfer ownership of the WasmModule to the {WasmModuleWrapper} generated
+  // in {CompileToModuleObject}.
+  return CompileToModuleObject(isolate, thrower, std::move(result.val), bytes,
+                               asm_js_script, asm_js_offset_table_bytes);
+}
+
+MaybeHandle<WasmModuleObject> WasmEngine::SyncCompile(
+    Isolate* isolate, ErrorThrower* thrower, const ModuleWireBytes& bytes) {
+  ModuleResult result = SyncDecodeWasmModule(isolate, bytes.start(),
+                                             bytes.end(), false, kWasmOrigin);
+  if (result.failed()) {
+    thrower->CompileFailed("Wasm decoding failed", result);
+    return {};
+  }
+
+  // Transfer ownership of the WasmModule to the {WasmModuleWrapper} generated
+  // in {CompileToModuleObject}.
+  return CompileToModuleObject(isolate, thrower, std::move(result.val), bytes,
+                               Handle<Script>(), Vector<const byte>());
+}
+
+MaybeHandle<WasmInstanceObject> WasmEngine::SyncInstantiate(
+    Isolate* isolate, ErrorThrower* thrower,
+    Handle<WasmModuleObject> module_object, MaybeHandle<JSReceiver> imports,
+    MaybeHandle<JSArrayBuffer> memory) {
+  return InstantiateToInstanceObject(isolate, thrower, module_object, imports,
+                                     memory);
+}
+
+void WasmEngine::AsyncInstantiate(Isolate* isolate, Handle<JSPromise> promise,
+                                  Handle<WasmModuleObject> module_object,
+                                  MaybeHandle<JSReceiver> imports) {
+  ErrorThrower thrower(isolate, nullptr);
+  MaybeHandle<WasmInstanceObject> instance_object = SyncInstantiate(
+      isolate, &thrower, module_object, imports, Handle<JSArrayBuffer>::null());
+  if (thrower.error()) {
+    MaybeHandle<Object> result = JSPromise::Reject(promise, thrower.Reify());
+    CHECK_EQ(result.is_null(), isolate->has_pending_exception());
+    return;
+  }
+  Handle<WasmInstanceObject> instance = instance_object.ToHandleChecked();
+  MaybeHandle<Object> result = JSPromise::Resolve(promise, instance);
+  CHECK_EQ(result.is_null(), isolate->has_pending_exception());
+}
+
+void WasmEngine::AsyncCompile(Isolate* isolate, Handle<JSPromise> promise,
+                              const ModuleWireBytes& bytes, bool is_shared) {
+  if (!FLAG_wasm_async_compilation) {
+    // Asynchronous compilation disabled; fall back on synchronous compilation.
+    ErrorThrower thrower(isolate, "WasmCompile");
+    MaybeHandle<WasmModuleObject> module_object;
+    if (is_shared) {
+      // Make a copy of the wire bytes to avoid concurrent modification.
+      std::unique_ptr<uint8_t[]> copy(new uint8_t[bytes.length()]);
+      memcpy(copy.get(), bytes.start(), bytes.length());
+      i::wasm::ModuleWireBytes bytes_copy(copy.get(),
+                                          copy.get() + bytes.length());
+      module_object = SyncCompile(isolate, &thrower, bytes_copy);
+    } else {
+      // The wire bytes are not shared, OK to use them directly.
+      module_object = SyncCompile(isolate, &thrower, bytes);
+    }
+    if (thrower.error()) {
+      MaybeHandle<Object> result = JSPromise::Reject(promise, thrower.Reify());
+      CHECK_EQ(result.is_null(), isolate->has_pending_exception());
+      return;
+    }
+    Handle<WasmModuleObject> module = module_object.ToHandleChecked();
+    MaybeHandle<Object> result = JSPromise::Resolve(promise, module);
+    CHECK_EQ(result.is_null(), isolate->has_pending_exception());
+    return;
+  }
+
+  if (FLAG_wasm_test_streaming) {
+    std::shared_ptr<StreamingDecoder> streaming_decoder =
+        isolate->wasm_engine()
+            ->compilation_manager()
+            ->StartStreamingCompilation(isolate, handle(isolate->context()),
+                                        promise);
+    streaming_decoder->OnBytesReceived(bytes.module_bytes());
+    streaming_decoder->Finish();
+    return;
+  }
+  // Make a copy of the wire bytes in case the user program changes them
+  // during asynchronous compilation.
+  std::unique_ptr<byte[]> copy(new byte[bytes.length()]);
+  memcpy(copy.get(), bytes.start(), bytes.length());
+  isolate->wasm_engine()->compilation_manager()->StartAsyncCompileJob(
+      isolate, std::move(copy), bytes.length(), handle(isolate->context()),
+      promise);
+}
+
+void WasmEngine::Register(CancelableTaskManager* task_manager) {
+  task_managers_.emplace_back(task_manager);
+}
+
+void WasmEngine::Unregister(CancelableTaskManager* task_manager) {
+  task_managers_.remove(task_manager);
+}
+
+void WasmEngine::TearDown() {
+  // Cancel all registered task managers.
+  for (auto task_manager : task_managers_) {
+    task_manager->CancelAndWait();
+  }
+
+  // Cancel all AsyncCompileJobs.
+  compilation_manager_.TearDown();
+}
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/wasm-engine.h b/deps/v8/src/wasm/wasm-engine.h
index bf06b47ed7b..b1a5a0a9b95 100644
--- a/deps/v8/src/wasm/wasm-engine.h
+++ b/deps/v8/src/wasm/wasm-engine.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef WASM_ENGINE_H_
-#define WASM_ENGINE_H_
+#ifndef V8_WASM_WASM_ENGINE_H_
+#define V8_WASM_WASM_ENGINE_H_
 
 #include <memory>
 
@@ -14,8 +14,14 @@
 namespace v8 {
 namespace internal {
 
+class WasmModuleObject;
+class WasmInstanceObject;
+
 namespace wasm {
 
+class ErrorThrower;
+struct ModuleWireBytes;
+
 // The central data structure that represents an engine instance capable of
 // loading, instantiating, and executing WASM code.
 class V8_EXPORT_PRIVATE WasmEngine {
@@ -23,18 +29,66 @@ class V8_EXPORT_PRIVATE WasmEngine {
   explicit WasmEngine(std::unique_ptr<WasmCodeManager> code_manager)
       : code_manager_(std::move(code_manager)) {}
 
+  // Synchronously validates the given bytes that represent an encoded WASM
+  // module.
   bool SyncValidate(Isolate* isolate, const ModuleWireBytes& bytes);
 
+  // Synchronously compiles the given bytes that represent a translated
+  // asm.js module.
+  MaybeHandle<WasmModuleObject> SyncCompileTranslatedAsmJs(
+      Isolate* isolate, ErrorThrower* thrower, const ModuleWireBytes& bytes,
+      Handle<Script> asm_js_script,
+      Vector<const byte> asm_js_offset_table_bytes);
+
+  // Synchronously compiles the given bytes that represent an encoded WASM
+  // module.
+  MaybeHandle<WasmModuleObject> SyncCompile(Isolate* isolate,
+                                            ErrorThrower* thrower,
+                                            const ModuleWireBytes& bytes);
+
+  // Synchronously instantiate the given WASM module with the given imports.
+  // If the module represents an asm.js module, then the supplied {memory}
+  // should be used as the memory of the instance.
+  MaybeHandle<WasmInstanceObject> SyncInstantiate(
+      Isolate* isolate, ErrorThrower* thrower,
+      Handle<WasmModuleObject> module_object, MaybeHandle<JSReceiver> imports,
+      MaybeHandle<JSArrayBuffer> memory);
+
+  // Begin an asynchronous compilation of the given bytes that represent an
+  // encoded WASM module, placing the result in the supplied {promise}.
+  // The {is_shared} flag indicates if the bytes backing the module could
+  // be shared across threads, i.e. could be concurrently modified.
+  void AsyncCompile(Isolate* isolate, Handle<JSPromise> promise,
+                    const ModuleWireBytes& bytes, bool is_shared);
+
+  // Begin an asynchronous instantiation of the given WASM module, placing the
+  // result in the supplied {promise}.
+  void AsyncInstantiate(Isolate* isolate, Handle<JSPromise> promise,
+                        Handle<WasmModuleObject> module_object,
+                        MaybeHandle<JSReceiver> imports);
+
   CompilationManager* compilation_manager() { return &compilation_manager_; }
 
   WasmCodeManager* code_manager() const { return code_manager_.get(); }
 
-  WasmAllocationTracker* allocation_tracker() { return &allocation_tracker_; }
+  WasmMemoryTracker* memory_tracker() { return &memory_tracker_; }
+
+  // We register and unregister CancelableTaskManagers that run
+  // isolate-dependent tasks. These tasks need to be shutdown if the isolate is
+  // shut down.
+  void Register(CancelableTaskManager* task_manager);
+  void Unregister(CancelableTaskManager* task_manager);
+
+  void TearDown();
 
  private:
   CompilationManager compilation_manager_;
   std::unique_ptr<WasmCodeManager> code_manager_;
-  WasmAllocationTracker allocation_tracker_;
+  WasmMemoryTracker memory_tracker_;
+
+  // Contains all CancelableTaskManagers that run tasks that are dependent
+  // on the isolate.
+  std::list<CancelableTaskManager*> task_managers_;
 
   DISALLOW_COPY_AND_ASSIGN(WasmEngine);
 };
@@ -43,4 +97,4 @@ class V8_EXPORT_PRIVATE WasmEngine {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_WASM_WASM_ENGINE_H_
diff --git a/deps/v8/src/wasm/wasm-external-refs.h b/deps/v8/src/wasm/wasm-external-refs.h
index dea620338a0..d44f5b242f4 100644
--- a/deps/v8/src/wasm/wasm-external-refs.h
+++ b/deps/v8/src/wasm/wasm-external-refs.h
@@ -4,8 +4,8 @@
 
 #include <stdint.h>
 
-#ifndef WASM_EXTERNAL_REFS_H
-#define WASM_EXTERNAL_REFS_H
+#ifndef V8_WASM_WASM_EXTERNAL_REFS_H_
+#define V8_WASM_WASM_EXTERNAL_REFS_H_
 
 namespace v8 {
 namespace internal {
@@ -77,4 +77,5 @@ void call_trap_callback_for_testing();
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
-#endif
+
+#endif  // V8_WASM_WASM_EXTERNAL_REFS_H_
diff --git a/deps/v8/src/wasm/wasm-interpreter.cc b/deps/v8/src/wasm/wasm-interpreter.cc
index 2f8fb0bf4a6..b993b857f9f 100644
--- a/deps/v8/src/wasm/wasm-interpreter.cc
+++ b/deps/v8/src/wasm/wasm-interpreter.cc
@@ -477,6 +477,17 @@ int64_t ExecuteI64SConvertF32(float a, TrapReason* trap) {
   return output;
 }
 
+int64_t ExecuteI64SConvertSatF32(float a) {
+  TrapReason base_trap = kTrapCount;
+  int64_t val = ExecuteI64SConvertF32(a, &base_trap);
+  if (base_trap == kTrapCount) {
+    return val;
+  }
+  return std::isnan(a) ? 0
+                       : (a < 0.0 ? std::numeric_limits<int64_t>::min()
+                                  : std::numeric_limits<int64_t>::max());
+}
+
 int64_t ExecuteI64SConvertF64(double a, TrapReason* trap) {
   int64_t output;
   if (!float64_to_int64_wrapper(&a, &output)) {
@@ -485,6 +496,17 @@ int64_t ExecuteI64SConvertF64(double a, TrapReason* trap) {
   return output;
 }
 
+int64_t ExecuteI64SConvertSatF64(double a) {
+  TrapReason base_trap = kTrapCount;
+  int64_t val = ExecuteI64SConvertF64(a, &base_trap);
+  if (base_trap == kTrapCount) {
+    return val;
+  }
+  return std::isnan(a) ? 0
+                       : (a < 0.0 ? std::numeric_limits<int64_t>::min()
+                                  : std::numeric_limits<int64_t>::max());
+}
+
 uint64_t ExecuteI64UConvertF32(float a, TrapReason* trap) {
   uint64_t output;
   if (!float32_to_uint64_wrapper(&a, &output)) {
@@ -493,6 +515,17 @@ uint64_t ExecuteI64UConvertF32(float a, TrapReason* trap) {
   return output;
 }
 
+uint64_t ExecuteI64UConvertSatF32(float a) {
+  TrapReason base_trap = kTrapCount;
+  uint64_t val = ExecuteI64UConvertF32(a, &base_trap);
+  if (base_trap == kTrapCount) {
+    return val;
+  }
+  return std::isnan(a) ? 0
+                       : (a < 0.0 ? std::numeric_limits<uint64_t>::min()
+                                  : std::numeric_limits<uint64_t>::max());
+}
+
 uint64_t ExecuteI64UConvertF64(double a, TrapReason* trap) {
   uint64_t output;
   if (!float64_to_uint64_wrapper(&a, &output)) {
@@ -501,6 +534,17 @@ uint64_t ExecuteI64UConvertF64(double a, TrapReason* trap) {
   return output;
 }
 
+uint64_t ExecuteI64UConvertSatF64(double a) {
+  TrapReason base_trap = kTrapCount;
+  int64_t val = ExecuteI64UConvertF64(a, &base_trap);
+  if (base_trap == kTrapCount) {
+    return val;
+  }
+  return std::isnan(a) ? 0
+                       : (a < 0.0 ? std::numeric_limits<uint64_t>::min()
+                                  : std::numeric_limits<uint64_t>::max());
+}
+
 inline int64_t ExecuteI64SConvertI32(int32_t a, TrapReason* trap) {
   return static_cast<int64_t>(a);
 }
@@ -593,29 +637,15 @@ const char* OpcodeName(uint32_t val) {
 // Unwrap a wasm to js wrapper, return the callable heap object.
 // If the wrapper would throw a TypeError, return a null handle.
 Handle<HeapObject> UnwrapWasmToJSWrapper(Isolate* isolate,
-                                         WasmCodeWrapper wrapper) {
+                                         const wasm::WasmCode* wasm_code) {
   Handle<FixedArray> js_imports_table;
   int index = 0;
-  if (wrapper.IsCodeObject()) {
-    Handle<Code> js_wrapper = wrapper.GetCode();
-    DCHECK(Code::WASM_TO_JS_FUNCTION == js_wrapper->kind());
-    Handle<FixedArray> deopt_data(js_wrapper->deoptimization_data(), isolate);
-    DCHECK_EQ(2, deopt_data->length());
-    intptr_t js_imports_table_loc = static_cast<intptr_t>(
-        HeapNumber::cast(deopt_data->get(0))->value_as_bits());
-    js_imports_table = Handle<FixedArray>(
-        reinterpret_cast<FixedArray**>(js_imports_table_loc));
-    CHECK(deopt_data->get(1)->ToInt32(&index));
-    DCHECK_GT(js_imports_table->length(), index);
-  } else {
-    const wasm::WasmCode* wasm_code = wrapper.GetWasmCode();
-    DCHECK_EQ(wasm::WasmCode::kWasmToJsWrapper, wasm_code->kind());
-    js_imports_table = Handle<FixedArray>(wasm_code->owner()
-                                              ->compiled_module()
-                                              ->owning_instance()
-                                              ->js_imports_table());
-    index = 1 + 3 * static_cast<int>(wasm_code->index());
-  }
+  DCHECK_EQ(wasm::WasmCode::kWasmToJsWrapper, wasm_code->kind());
+  js_imports_table = Handle<FixedArray>(wasm_code->native_module()
+                                            ->compiled_module()
+                                            ->owning_instance()
+                                            ->js_imports_table());
+  index = 1 + 3 * static_cast<int>(wasm_code->index());
   Handle<Object> obj(js_imports_table->get(index), isolate);
   if (obj->IsCallable()) {
     return Handle<HeapObject>::cast(obj);
@@ -924,6 +954,9 @@ class CodeMap {
   // This handle is set and reset by the SetInstanceObject() /
   // ClearInstanceObject() method, which is used by the HeapObjectsScope.
   Handle<WasmInstanceObject> instance_;
+  // TODO(wasm): Remove this testing wart. It is needed because interpreter
+  // entry stubs are not generated in testing the interpreter in cctests.
+  bool call_indirect_through_module_ = false;
 
  public:
   CodeMap(Isolate* isolate, const WasmModule* module,
@@ -942,6 +975,12 @@ class CodeMap {
     }
   }
 
+  bool call_indirect_through_module() { return call_indirect_through_module_; }
+
+  void set_call_indirect_through_module(bool val) {
+    call_indirect_through_module_ = val;
+  }
+
   void SetInstanceObject(Handle<WasmInstanceObject> instance) {
     DCHECK(instance_.is_null());
     instance_ = instance;
@@ -955,10 +994,6 @@ class CodeMap {
     DCHECK(has_instance());
     return *instance_;
   }
-  MaybeHandle<WasmInstanceObject> maybe_instance() const {
-    return has_instance() ? handle(instance())
-                          : MaybeHandle<WasmInstanceObject>();
-  }
 
   const wasm::WasmCode* GetImportedFunction(uint32_t function_index) {
     DCHECK(has_instance());
@@ -968,13 +1003,6 @@ class CodeMap {
     return native_module->GetCode(function_index);
   }
 
-  Code* GetImportedFunctionGC(uint32_t function_index) {
-    DCHECK(has_instance());
-    DCHECK_GT(module_->num_imported_functions, function_index);
-    FixedArray* code_table = instance()->compiled_module()->code_table();
-    return Code::cast(code_table->get(static_cast<int>(function_index)));
-  }
-
   InterpreterCode* GetCode(const WasmFunction* function) {
     InterpreterCode* code = GetCode(function->func_index);
     DCHECK_EQ(function, code->function);
@@ -987,12 +1015,34 @@ class CodeMap {
   }
 
   InterpreterCode* GetIndirectCode(uint32_t table_index, uint32_t entry_index) {
+    uint32_t saved_index;
+    USE(saved_index);
     if (table_index >= module_->function_tables.size()) return nullptr;
+    // Mask table index for SSCA mitigation.
+    saved_index = table_index;
+    table_index &=
+        static_cast<int32_t>((table_index - module_->function_tables.size()) &
+                             ~static_cast<int32_t>(table_index)) >>
+        31;
+    DCHECK_EQ(table_index, saved_index);
     const WasmIndirectFunctionTable* table =
         &module_->function_tables[table_index];
     if (entry_index >= table->values.size()) return nullptr;
+    // Mask entry_index for SSCA mitigation.
+    saved_index = entry_index;
+    entry_index &= static_cast<int32_t>((entry_index - table->values.size()) &
+                                        ~static_cast<int32_t>(entry_index)) >>
+                   31;
+    DCHECK_EQ(entry_index, saved_index);
     uint32_t index = table->values[entry_index];
     if (index >= interpreter_code_.size()) return nullptr;
+    // Mask index for SSCA mitigation.
+    saved_index = index;
+    index &= static_cast<int32_t>((index - interpreter_code_.size()) &
+                                  ~static_cast<int32_t>(index)) >>
+             31;
+    DCHECK_EQ(index, saved_index);
+
     return GetCode(index);
   }
 
@@ -1543,9 +1593,21 @@ class ThreadImpl {
       case kExprI32UConvertSatF64:
         Push(WasmValue(ExecuteConvertSaturate<uint32_t>(Pop().to<double>())));
         return true;
+      case kExprI64SConvertSatF32:
+        Push(WasmValue(ExecuteI64SConvertSatF32(Pop().to<float>())));
+        return true;
+      case kExprI64UConvertSatF32:
+        Push(WasmValue(ExecuteI64UConvertSatF32(Pop().to<float>())));
+        return true;
+      case kExprI64SConvertSatF64:
+        Push(WasmValue(ExecuteI64SConvertSatF64(Pop().to<double>())));
+        return true;
+      case kExprI64UConvertSatF64:
+        Push(WasmValue(ExecuteI64UConvertSatF64(Pop().to<double>())));
+        return true;
       default:
-        V8_Fatal(__FILE__, __LINE__, "Unknown or unimplemented opcode #%d:%s",
-                 code->start[pc], OpcodeName(code->start[pc]));
+        FATAL("Unknown or unimplemented opcode #%d:%s", code->start[pc],
+              OpcodeName(code->start[pc]));
         UNREACHABLE();
     }
     return false;
@@ -1912,7 +1974,7 @@ class ThreadImpl {
           // Assume only one table for now.
           DCHECK_LE(module()->function_tables.size(), 1u);
           ExternalCallResult result =
-              CallIndirectFunction(0, entry_index, operand.index);
+              CallIndirectFunction(0, entry_index, operand.sig_index);
           switch (result.type) {
             case ExternalCallResult::INTERNAL:
               // The import is a function of this instance. Call it directly.
@@ -2063,14 +2125,17 @@ class ThreadImpl {
           MemoryIndexOperand<Decoder::kNoValidate> operand(&decoder,
                                                            code->at(pc));
           uint32_t delta_pages = Pop().to<uint32_t>();
-          Handle<WasmInstanceObject> instance =
-              codemap()->maybe_instance().ToHandleChecked();
-          DCHECK_EQ(wasm_context_, instance->wasm_context()->get());
-          Isolate* isolate = instance->GetIsolate();
-          int32_t result =
-              WasmInstanceObject::GrowMemory(isolate, instance, delta_pages);
+          Handle<WasmMemoryObject> memory(
+              codemap()->instance()->memory_object());
+          DCHECK_EQ(wasm_context_,
+                    codemap()->instance()->wasm_context()->get());
+          Isolate* isolate = memory->GetIsolate();
+          int32_t result = WasmMemoryObject::Grow(isolate, memory, delta_pages);
           Push(WasmValue(result));
           len = 1 + operand.length;
+          // Treat one grow_memory instruction like 1000 other instructions,
+          // because it is a really expensive operation.
+          if (max > 0) max = std::max(0, max - 1000);
           break;
         }
         case kExprMemorySize: {
@@ -2152,8 +2217,8 @@ class ThreadImpl {
 #undef EXECUTE_UNOP
 
         default:
-          V8_Fatal(__FILE__, __LINE__, "Unknown or unimplemented opcode #%d:%s",
-                   code->start[pc], OpcodeName(code->start[pc]));
+          FATAL("Unknown or unimplemented opcode #%d:%s", code->start[pc],
+                OpcodeName(code->start[pc]));
           UNREACHABLE();
       }
 
@@ -2277,7 +2342,7 @@ class ThreadImpl {
   }
 
   ExternalCallResult CallExternalJSFunction(Isolate* isolate,
-                                            WasmCodeWrapper code,
+                                            const wasm::WasmCode* code,
                                             FunctionSig* signature) {
     Handle<HeapObject> target = UnwrapWasmToJSWrapper(isolate, code);
 
@@ -2332,7 +2397,7 @@ class ThreadImpl {
   }
 
   ExternalCallResult CallExternalWasmFunction(Isolate* isolate,
-                                              WasmCodeWrapper code,
+                                              const wasm::WasmCode* code,
                                               FunctionSig* sig) {
     Handle<WasmDebugInfo> debug_info(codemap()->instance()->debug_info(),
                                      isolate);
@@ -2386,18 +2451,25 @@ class ThreadImpl {
       arg_buffer.resize(return_size);
     }
 
-    // Wrap the arg_buffer data pointer in a handle. As this is an aligned
-    // pointer, to the GC it will look like a Smi.
+    // Wrap the arg_buffer data pointer and the WasmContext* in a handle. As
+    // this is an aligned pointer, to the GC it will look like a Smi.
     Handle<Object> arg_buffer_obj(reinterpret_cast<Object*>(arg_buffer.data()),
                                   isolate);
     DCHECK(!arg_buffer_obj->IsHeapObject());
 
+    static_assert(compiler::CWasmEntryParameters::kNumParameters == 3,
+                  "code below needs adaption");
     Handle<Object> args[compiler::CWasmEntryParameters::kNumParameters];
-    args[compiler::CWasmEntryParameters::kCodeObject] =
-        code.IsCodeObject()
-            ? Handle<Object>::cast(code.GetCode())
-            : Handle<Object>::cast(isolate->factory()->NewForeign(
-                  code.GetWasmCode()->instructions().start(), TENURED));
+    WasmContext* context = code->native_module()
+                               ->compiled_module()
+                               ->owning_instance()
+                               ->wasm_context()
+                               ->get();
+    Handle<Object> context_obj(reinterpret_cast<Object*>(context), isolate);
+    DCHECK(!context_obj->IsHeapObject());
+    args[compiler::CWasmEntryParameters::kCodeObject] = Handle<Object>::cast(
+        isolate->factory()->NewForeign(code->instructions().start(), TENURED));
+    args[compiler::CWasmEntryParameters::kWasmContext] = context_obj;
     args[compiler::CWasmEntryParameters::kArgumentsBuffer] = arg_buffer_obj;
 
     Handle<Object> receiver = isolate->factory()->undefined_value();
@@ -2440,41 +2512,25 @@ class ThreadImpl {
     return {ExternalCallResult::EXTERNAL_RETURNED};
   }
 
-  ExternalCallResult CallCodeObject(Isolate* isolate, Handle<Code> code,
-                                    FunctionSig* signature) {
-    DCHECK(AllowHandleAllocation::IsAllowed());
-    DCHECK(AllowHeapAllocation::IsAllowed());
-
-    if (code->kind() == Code::WASM_FUNCTION ||
-        code->kind() == Code::WASM_TO_WASM_FUNCTION) {
-      auto func_info = GetWasmFunctionInfo(isolate, code);
-      if (*func_info.instance.ToHandleChecked() != codemap()->instance()) {
-        return CallExternalWasmFunction(isolate, WasmCodeWrapper(code),
-                                        signature);
-      }
-      DCHECK_LE(0, func_info.func_index);
-      return {ExternalCallResult::INTERNAL,
-              codemap()->GetCode(func_info.func_index)};
-    }
-
-    return CallExternalJSFunction(isolate, WasmCodeWrapper(code), signature);
-  }
-
   ExternalCallResult CallWasmCode(Isolate* isolate, const wasm::WasmCode* code,
                                   FunctionSig* signature) {
     DCHECK(AllowHandleAllocation::IsAllowed());
     DCHECK(AllowHeapAllocation::IsAllowed());
 
     if (code->kind() == wasm::WasmCode::kFunction) {
-      DCHECK_EQ(code->owner()->compiled_module()->owning_instance(),
-                codemap()->instance());
+      if (code->native_module()->compiled_module()->owning_instance() !=
+          codemap()->instance()) {
+        return CallExternalWasmFunction(isolate, code, signature);
+      }
       return {ExternalCallResult::INTERNAL, codemap()->GetCode(code->index())};
     }
+
     if (code->kind() == wasm::WasmCode::kWasmToJsWrapper) {
-      return CallExternalJSFunction(isolate, WasmCodeWrapper(code), signature);
-    } else if (code->kind() == wasm::WasmCode::kWasmToWasmWrapper) {
-      return CallExternalWasmFunction(isolate, WasmCodeWrapper(code),
-                                      signature);
+      return CallExternalJSFunction(isolate, code, signature);
+    }
+    if (code->kind() == wasm::WasmCode::kWasmToWasmWrapper ||
+        code->kind() == wasm::WasmCode::kInterpreterStub) {
+      return CallExternalWasmFunction(isolate, code, signature);
     }
     return {ExternalCallResult::INVALID_FUNC};
   }
@@ -2485,39 +2541,17 @@ class ThreadImpl {
     Isolate* isolate = codemap()->instance()->GetIsolate();
     HandleScope handle_scope(isolate);
 
-    if (FLAG_wasm_jit_to_native) {
-      const wasm::WasmCode* target =
-          codemap()->GetImportedFunction(function_index);
-      return CallWasmCode(isolate, target,
-                          codemap()->module()->functions[function_index].sig);
-    } else {
-      Handle<Code> target(codemap()->GetImportedFunctionGC(function_index),
-                          isolate);
-      return CallCodeObject(isolate, target,
-                            codemap()->module()->functions[function_index].sig);
-    }
+    const wasm::WasmCode* target =
+        codemap()->GetImportedFunction(function_index);
+    return CallWasmCode(isolate, target,
+                        codemap()->module()->functions[function_index].sig);
   }
 
   ExternalCallResult CallIndirectFunction(uint32_t table_index,
                                           uint32_t entry_index,
                                           uint32_t sig_index) {
-    bool no_func_tables = !codemap()->has_instance();
-    if (FLAG_wasm_jit_to_native) {
-      no_func_tables = no_func_tables || codemap()
-                                             ->instance()
-                                             ->compiled_module()
-                                             ->GetNativeModule()
-                                             ->function_tables()
-                                             .empty();
-    } else {
-      no_func_tables =
-          no_func_tables ||
-          !codemap()->instance()->compiled_module()->has_function_tables();
-    }
-    if (no_func_tables) {
-      // No instance. Rely on the information stored in the WasmModule.
-      // TODO(wasm): This is only needed for testing. Refactor testing to use
-      // the same paths as production.
+    if (codemap()->call_indirect_through_module()) {
+      // Rely on the information stored in the WasmModule.
       InterpreterCode* code =
           codemap()->GetIndirectCode(table_index, entry_index);
       if (!code) return {ExternalCallResult::INVALID_FUNC};
@@ -2540,7 +2574,6 @@ class ThreadImpl {
     Isolate* isolate = compiled_module->GetIsolate();
 
     const wasm::WasmCode* target = nullptr;
-    Code* target_gc = nullptr;
     {
       DisallowHeapAllocation no_gc;
       // Get function to be called directly from the live instance to see latest
@@ -2551,75 +2584,32 @@ class ThreadImpl {
       DCHECK_EQ(canonical_sig_index,
                 module()->signature_map.Find(module()->signatures[sig_index]));
 
-      if (!FLAG_wasm_jit_to_native) {
-        // Check signature.
-        FixedArray* fun_tables = compiled_module->function_tables();
-        if (table_index >= static_cast<uint32_t>(fun_tables->length())) {
-          return {ExternalCallResult::INVALID_FUNC};
-        }
-        // Reconstitute the global handle to the function table, from the
-        // address stored in the respective table of tables.
-        int table_index_as_int = static_cast<int>(table_index);
-        FixedArray* fun_table = *reinterpret_cast<FixedArray**>(
-            WasmCompiledModule::GetTableValue(fun_tables, table_index_as_int));
-        // Function tables store <smi, code> pairs.
-        int num_funcs_in_table =
-            fun_table->length() / compiler::kFunctionTableEntrySize;
-        if (entry_index >= static_cast<uint32_t>(num_funcs_in_table)) {
-          return {ExternalCallResult::INVALID_FUNC};
-        }
-        int found_sig = Smi::ToInt(fun_table->get(
-            compiler::FunctionTableSigOffset(static_cast<int>(entry_index))));
-        if (static_cast<uint32_t>(found_sig) != canonical_sig_index) {
-          return {ExternalCallResult::SIGNATURE_MISMATCH};
-        }
-
-        // Get code object.
-        target_gc = Code::cast(fun_table->get(
-            compiler::FunctionTableCodeOffset(static_cast<int>(entry_index))));
-      } else {
-        // Check signature.
-        std::vector<GlobalHandleAddress>& fun_tables =
-            compiled_module->GetNativeModule()->function_tables();
-        if (table_index >= fun_tables.size()) {
-          return {ExternalCallResult::INVALID_FUNC};
-        }
-        // Reconstitute the global handle to the function table, from the
-        // address stored in the respective table of tables.
-        FixedArray* fun_table =
-            *reinterpret_cast<FixedArray**>(fun_tables[table_index]);
-        // Function tables store <smi, code> pairs.
-        int num_funcs_in_table =
-            fun_table->length() / compiler::kFunctionTableEntrySize;
-        if (entry_index >= static_cast<uint32_t>(num_funcs_in_table)) {
-          return {ExternalCallResult::INVALID_FUNC};
-        }
-        int found_sig = Smi::ToInt(fun_table->get(
-            compiler::FunctionTableSigOffset(static_cast<int>(entry_index))));
-        if (static_cast<uint32_t>(found_sig) != canonical_sig_index) {
-          return {ExternalCallResult::SIGNATURE_MISMATCH};
-        }
-
-        // Get code object.
-        Address first_instr =
-            Foreign::cast(fun_table->get(compiler::FunctionTableCodeOffset(
-                              static_cast<int>(entry_index))))
-                ->foreign_address();
-        target =
-            isolate->wasm_engine()->code_manager()->GetCodeFromStartAddress(
-                first_instr);
+      // The function table is stored in the wasm context.
+      // TODO(wasm): the wasm interpreter currently supports only one table.
+      CHECK_EQ(0, table_index);
+      // Bounds check against table size.
+      if (entry_index >= wasm_context_->table_size) {
+        return {ExternalCallResult::INVALID_FUNC};
+      }
+      // Signature check.
+      int32_t entry_sig = wasm_context_->table[entry_index].sig_id;
+      if (entry_sig != static_cast<int32_t>(canonical_sig_index)) {
+        return {ExternalCallResult::SIGNATURE_MISMATCH};
       }
+      // Load the target address (first instruction of code).
+      Address first_instr = wasm_context_->table[entry_index].target;
+      // TODO(titzer): load the wasm context instead of relying on the
+      // target code being specialized to the target instance.
+      // Get code object.
+      target = isolate->wasm_engine()->code_manager()->GetCodeFromStartAddress(
+          first_instr);
     }
 
     // Call the code object. Use a new HandleScope to avoid leaking /
     // accumulating handles in the outer scope.
     HandleScope handle_scope(isolate);
     FunctionSig* signature = module()->signatures[sig_index];
-    if (FLAG_wasm_jit_to_native) {
-      return CallWasmCode(isolate, target, signature);
-    } else {
-      return CallCodeObject(isolate, handle(target_gc, isolate), signature);
-    }
+    return CallWasmCode(isolate, target, signature);
   }
 
   inline Activation current_activation() {
@@ -2897,12 +2887,16 @@ void WasmInterpreter::SetFunctionCodeForTesting(const WasmFunction* function,
   internals_->codemap_.SetFunctionCode(function, start, end);
 }
 
+void WasmInterpreter::SetCallIndirectTestMode() {
+  internals_->codemap_.set_call_indirect_through_module(true);
+}
+
 ControlTransferMap WasmInterpreter::ComputeControlTransfersForTesting(
     Zone* zone, const WasmModule* module, const byte* start, const byte* end) {
   // Create some dummy structures, to avoid special-casing the implementation
   // just for testing.
   FunctionSig sig(0, 0, nullptr);
-  WasmFunction function{&sig, 0, 0, {0, 0}, {0, 0}, false, false};
+  WasmFunction function{&sig, 0, 0, {0, 0}, false, false};
   InterpreterCode code{
       &function, BodyLocalDecls(zone), start, end, nullptr, nullptr, nullptr};
 
diff --git a/deps/v8/src/wasm/wasm-interpreter.h b/deps/v8/src/wasm/wasm-interpreter.h
index b0c100b5a94..88d21c37d14 100644
--- a/deps/v8/src/wasm/wasm-interpreter.h
+++ b/deps/v8/src/wasm/wasm-interpreter.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_INTERPRETER_H_
-#define V8_WASM_INTERPRETER_H_
+#ifndef V8_WASM_WASM_INTERPRETER_H_
+#define V8_WASM_WASM_INTERPRETER_H_
 
 #include "src/wasm/wasm-opcodes.h"
 #include "src/wasm/wasm-value.h"
@@ -215,6 +215,7 @@ class V8_EXPORT_PRIVATE WasmInterpreter {
   // Manually adds code to the interpreter for the given function.
   void SetFunctionCodeForTesting(const WasmFunction* function,
                                  const byte* start, const byte* end);
+  void SetCallIndirectTestMode();
 
   // Computes the control transfers for the given bytecode. Used internally in
   // the interpreter, but exposed for testing.
@@ -230,4 +231,4 @@ class V8_EXPORT_PRIVATE WasmInterpreter {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_INTERPRETER_H_
+#endif  // V8_WASM_WASM_INTERPRETER_H_
diff --git a/deps/v8/src/wasm/wasm-js.cc b/deps/v8/src/wasm/wasm-js.cc
index ce2bf42455b..b1d21da1fd7 100644
--- a/deps/v8/src/wasm/wasm-js.cc
+++ b/deps/v8/src/wasm/wasm-js.cc
@@ -16,8 +16,6 @@
 #include "src/objects.h"
 #include "src/parsing/parse-info.h"
 #include "src/trap-handler/trap-handler.h"
-#include "src/wasm/module-compiler.h"
-#include "src/wasm/wasm-api.h"
 #include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-limits.h"
 #include "src/wasm/wasm-memory.h"
@@ -40,6 +38,35 @@ namespace {
     }                                                \
   } while (false)
 
+// Like an ErrorThrower, but turns all pending exceptions into scheduled
+// exceptions when going out of scope. Use this in API methods.
+// Note that pending exceptions are not necessarily created by the ErrorThrower,
+// but e.g. by the wasm start function. There might also be a scheduled
+// exception, created by another API call (e.g. v8::Object::Get). But there
+// should never be both pending and scheduled exceptions.
+class ScheduledErrorThrower : public ErrorThrower {
+ public:
+  ScheduledErrorThrower(i::Isolate* isolate, const char* context)
+      : ErrorThrower(isolate, context) {}
+
+  ~ScheduledErrorThrower();
+};
+
+ScheduledErrorThrower::~ScheduledErrorThrower() {
+  // There should never be both a pending and a scheduled exception.
+  DCHECK(!isolate()->has_scheduled_exception() ||
+         !isolate()->has_pending_exception());
+  // Don't throw another error if there is already a scheduled error.
+  if (isolate()->has_scheduled_exception()) {
+    Reset();
+  } else if (isolate()->has_pending_exception()) {
+    Reset();
+    isolate()->OptionalRescheduleException(false);
+  } else if (error()) {
+    isolate()->ScheduleThrow(*Reify());
+  }
+}
+
 i::Handle<i::String> v8_str(i::Isolate* isolate, const char* str) {
   return isolate->factory()->NewStringFromAsciiChecked(str);
 }
@@ -123,8 +150,7 @@ void WebAssemblyCompileStreaming(
     ASSIGN(Promise::Resolver, resolver, Promise::Resolver::New(context));
     v8::ReturnValue<v8::Value> return_value = args.GetReturnValue();
     return_value.Set(resolver->GetPromise());
-    i::wasm::ScheduledErrorThrower thrower(i_isolate,
-                                           "WebAssembly.compileStreaming()");
+    ScheduledErrorThrower thrower(i_isolate, "WebAssembly.compileStreaming()");
     thrower.CompileError("Wasm code generation disallowed by embedder");
     auto maybe = resolver->Reject(context, Utils::ToLocal(thrower.Reify()));
     CHECK_IMPLIES(!maybe.FromMaybe(false),
@@ -144,7 +170,7 @@ void WebAssemblyCompile(const v8::FunctionCallbackInfo<v8::Value>& args) {
   MicrotasksScope runs_microtasks(isolate, MicrotasksScope::kRunMicrotasks);
 
   HandleScope scope(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate, "WebAssembly.compile()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.compile()");
 
   if (!i::wasm::IsWasmCodegenAllowed(i_isolate, i_isolate->native_context())) {
     thrower.CompileError("Wasm code generation disallowed by embedder");
@@ -165,7 +191,7 @@ void WebAssemblyCompile(const v8::FunctionCallbackInfo<v8::Value>& args) {
   }
   i::Handle<i::JSPromise> promise = Utils::OpenHandle(*resolver->GetPromise());
   // Asynchronous compilation handles copying wire bytes if necessary.
-  i::wasm::AsyncCompile(i_isolate, promise, bytes, is_shared);
+  i_isolate->wasm_engine()->AsyncCompile(i_isolate, promise, bytes, is_shared);
 }
 
 // WebAssembly.validate(bytes) -> bool
@@ -173,7 +199,7 @@ void WebAssemblyValidate(const v8::FunctionCallbackInfo<v8::Value>& args) {
   v8::Isolate* isolate = args.GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   HandleScope scope(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate, "WebAssembly.validate()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.validate()");
 
   bool is_shared = false;
   auto bytes = GetFirstArgumentAsBytes(args, &thrower, &is_shared);
@@ -209,7 +235,7 @@ void WebAssemblyModule(const v8::FunctionCallbackInfo<v8::Value>& args) {
   if (i_isolate->wasm_module_callback()(args)) return;
 
   HandleScope scope(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Module()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Module()");
 
   if (!args.IsConstructCall()) {
     thrower.TypeError("WebAssembly.Module must be invoked with 'new'");
@@ -233,10 +259,12 @@ void WebAssemblyModule(const v8::FunctionCallbackInfo<v8::Value>& args) {
     memcpy(copy.get(), bytes.start(), bytes.length());
     i::wasm::ModuleWireBytes bytes_copy(copy.get(),
                                         copy.get() + bytes.length());
-    module_obj = i::wasm::SyncCompile(i_isolate, &thrower, bytes_copy);
+    module_obj =
+        i_isolate->wasm_engine()->SyncCompile(i_isolate, &thrower, bytes_copy);
   } else {
     // The wire bytes are not shared, OK to use them directly.
-    module_obj = i::wasm::SyncCompile(i_isolate, &thrower, bytes);
+    module_obj =
+        i_isolate->wasm_engine()->SyncCompile(i_isolate, &thrower, bytes);
   }
 
   if (module_obj.is_null()) return;
@@ -250,8 +278,7 @@ void WebAssemblyModuleImports(const v8::FunctionCallbackInfo<v8::Value>& args) {
   HandleScope scope(args.GetIsolate());
   v8::Isolate* isolate = args.GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate,
-                                         "WebAssembly.Module.imports()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Module.imports()");
 
   auto maybe_module = GetFirstArgumentAsModule(args, &thrower);
   if (thrower.error()) return;
@@ -264,8 +291,7 @@ void WebAssemblyModuleExports(const v8::FunctionCallbackInfo<v8::Value>& args) {
   HandleScope scope(args.GetIsolate());
   v8::Isolate* isolate = args.GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate,
-                                         "WebAssembly.Module.exports()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Module.exports()");
 
   auto maybe_module = GetFirstArgumentAsModule(args, &thrower);
   if (thrower.error()) return;
@@ -279,8 +305,8 @@ void WebAssemblyModuleCustomSections(
   HandleScope scope(args.GetIsolate());
   v8::Isolate* isolate = args.GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate,
-                                         "WebAssembly.Module.customSections()");
+  ScheduledErrorThrower thrower(i_isolate,
+                                "WebAssembly.Module.customSections()");
 
   auto maybe_module = GetFirstArgumentAsModule(args, &thrower);
   if (thrower.error()) return;
@@ -303,8 +329,7 @@ MaybeLocal<Value> WebAssemblyInstantiateImpl(Isolate* isolate,
 
   i::MaybeHandle<i::Object> instance_object;
   {
-    i::wasm::ScheduledErrorThrower thrower(i_isolate,
-                                           "WebAssembly Instantiation");
+    ScheduledErrorThrower thrower(i_isolate, "WebAssembly Instantiation");
     i::MaybeHandle<i::JSReceiver> maybe_imports =
         GetValueAsImports(ffi, &thrower);
     if (thrower.error()) return {};
@@ -312,9 +337,9 @@ MaybeLocal<Value> WebAssemblyInstantiateImpl(Isolate* isolate,
     i::Handle<i::WasmModuleObject> module_obj =
         i::Handle<i::WasmModuleObject>::cast(
             Utils::OpenHandle(Object::Cast(*module)));
-    instance_object =
-        i::wasm::SyncInstantiate(i_isolate, &thrower, module_obj, maybe_imports,
-                                 i::MaybeHandle<i::JSArrayBuffer>());
+    instance_object = i_isolate->wasm_engine()->SyncInstantiate(
+        i_isolate, &thrower, module_obj, maybe_imports,
+        i::MaybeHandle<i::JSArrayBuffer>());
   }
 
   DCHECK_EQ(instance_object.is_null(), i_isolate->has_scheduled_exception());
@@ -386,7 +411,7 @@ void WebAssemblyInstance(const v8::FunctionCallbackInfo<v8::Value>& args) {
   HandleScope scope(args.GetIsolate());
   if (i_isolate->wasm_instance_callback()(args)) return;
 
-  i::wasm::ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Instance()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Instance()");
   if (!args.IsConstructCall()) {
     thrower.TypeError("WebAssembly.Instance must be invoked with 'new'");
     return;
@@ -444,8 +469,7 @@ void WebAssemblyInstantiate(const v8::FunctionCallbackInfo<v8::Value>& args) {
       v8::Isolate::UseCounterFeature::kWebAssemblyInstantiation);
   MicrotasksScope runs_microtasks(isolate, MicrotasksScope::kRunMicrotasks);
 
-  i::wasm::ScheduledErrorThrower thrower(i_isolate,
-                                         "WebAssembly.instantiate()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.instantiate()");
 
   HandleScope scope(isolate);
 
@@ -521,7 +545,7 @@ void WebAssemblyTable(const v8::FunctionCallbackInfo<v8::Value>& args) {
   v8::Isolate* isolate = args.GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   HandleScope scope(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Module()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Module()");
   if (!args.IsConstructCall()) {
     thrower.TypeError("WebAssembly.Table must be invoked with 'new'");
     return;
@@ -578,7 +602,7 @@ void WebAssemblyMemory(const v8::FunctionCallbackInfo<v8::Value>& args) {
   v8::Isolate* isolate = args.GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   HandleScope scope(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Memory()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Memory()");
   if (!args.IsConstructCall()) {
     thrower.TypeError("WebAssembly.Memory must be invoked with 'new'");
     return;
@@ -672,8 +696,7 @@ void WebAssemblyInstanceGetExports(
   v8::Isolate* isolate = args.GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   HandleScope scope(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate,
-                                         "WebAssembly.Instance.exports()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Instance.exports()");
   EXTRACT_THIS(receiver, WasmInstanceObject);
   i::Handle<i::JSObject> exports_object(receiver->exports_object());
   args.GetReturnValue().Set(Utils::ToLocal(exports_object));
@@ -684,8 +707,7 @@ void WebAssemblyTableGetLength(
   v8::Isolate* isolate = args.GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   HandleScope scope(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate,
-                                         "WebAssembly.Table.length()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Table.length()");
   EXTRACT_THIS(receiver, WasmTableObject);
   args.GetReturnValue().Set(
       v8::Number::New(isolate, receiver->current_length()));
@@ -696,7 +718,7 @@ void WebAssemblyTableGrow(const v8::FunctionCallbackInfo<v8::Value>& args) {
   v8::Isolate* isolate = args.GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   HandleScope scope(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Table.grow()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Table.grow()");
   Local<Context> context = isolate->GetCurrentContext();
   EXTRACT_THIS(receiver, WasmTableObject);
 
@@ -738,7 +760,7 @@ void WebAssemblyTableGet(const v8::FunctionCallbackInfo<v8::Value>& args) {
   v8::Isolate* isolate = args.GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   HandleScope scope(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Table.get()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Table.get()");
   Local<Context> context = isolate->GetCurrentContext();
   EXTRACT_THIS(receiver, WasmTableObject);
   i::Handle<i::FixedArray> array(receiver->functions(), i_isolate);
@@ -759,7 +781,7 @@ void WebAssemblyTableSet(const v8::FunctionCallbackInfo<v8::Value>& args) {
   v8::Isolate* isolate = args.GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   HandleScope scope(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Table.set()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Table.set()");
   Local<Context> context = isolate->GetCurrentContext();
   EXTRACT_THIS(receiver, WasmTableObject);
 
@@ -807,8 +829,7 @@ void WebAssemblyMemoryGrow(const v8::FunctionCallbackInfo<v8::Value>& args) {
   v8::Isolate* isolate = args.GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   HandleScope scope(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate,
-                                         "WebAssembly.Memory.grow()");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Memory.grow()");
   Local<Context> context = isolate->GetCurrentContext();
   EXTRACT_THIS(receiver, WasmMemoryObject);
 
@@ -826,7 +847,7 @@ void WebAssemblyMemoryGrow(const v8::FunctionCallbackInfo<v8::Value>& args) {
     return;
   }
   uint32_t old_size =
-      old_buffer->byte_length()->Number() / i::wasm::kSpecMaxWasmMemoryPages;
+      old_buffer->byte_length()->Number() / i::wasm::kWasmPageSize;
   int64_t new_size64 = old_size + delta_size;
   if (delta_size < 0 || max_size64 < new_size64 || new_size64 < old_size) {
     thrower.RangeError(new_size64 < old_size ? "trying to shrink memory"
@@ -849,8 +870,7 @@ void WebAssemblyMemoryGetBuffer(
   v8::Isolate* isolate = args.GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   HandleScope scope(isolate);
-  i::wasm::ScheduledErrorThrower thrower(i_isolate,
-                                         "WebAssembly.Memory.buffer");
+  ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Memory.buffer");
   EXTRACT_THIS(receiver, WasmMemoryObject);
 
   i::Handle<i::Object> buffer_obj(receiver->array_buffer(), i_isolate);
@@ -891,7 +911,7 @@ Handle<JSFunction> InstallFunc(Isolate* isolate, Handle<JSObject> object,
   Handle<FunctionTemplateInfo> temp = NewTemplate(isolate, func);
   Handle<JSFunction> function =
       ApiNatives::InstantiateFunction(temp, name).ToHandleChecked();
-  DCHECK(function->shared()->has_shared_name());
+  DCHECK(function->shared()->HasSharedName());
   function->shared()->set_length(length);
   PropertyAttributes attributes = static_cast<PropertyAttributes>(DONT_ENUM);
   JSObject::AddProperty(object, name, function, attributes);
@@ -905,7 +925,7 @@ void InstallGetter(Isolate* isolate, Handle<JSObject> object,
   // TODO(ishell): shouldn't we set "get "+name as getter's name?
   Handle<JSFunction> function =
       ApiNatives::InstantiateFunction(temp).ToHandleChecked();
-  DCHECK(function->shared()->has_shared_name());
+  DCHECK(function->shared()->HasSharedName());
   v8::PropertyAttribute attributes =
       static_cast<v8::PropertyAttribute>(v8::DontEnum);
   Utils::ToLocal(object)->SetAccessorProperty(Utils::ToLocal(name),
@@ -931,7 +951,6 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
       name, isolate->strict_function_map(), LanguageMode::kStrict);
   Handle<JSFunction> cons = factory->NewFunction(args);
   JSFunction::SetPrototype(cons, isolate->initial_object_prototype());
-  cons->shared()->set_instance_class_name(*name);
   Handle<JSObject> webassembly = factory->NewJSObject(cons, TENURED);
   PropertyAttributes attributes = static_cast<PropertyAttributes>(DONT_ENUM);
 
@@ -962,9 +981,8 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
   JSFunction::EnsureHasInitialMap(module_constructor);
   Handle<JSObject> module_proto(
       JSObject::cast(module_constructor->instance_prototype()));
-  i::Handle<i::Map> module_map = isolate->factory()->NewMap(
-      i::WASM_MODULE_TYPE, i::JSObject::kHeaderSize +
-                               WasmModuleObject::kFieldCount * i::kPointerSize);
+  i::Handle<i::Map> module_map =
+      isolate->factory()->NewMap(i::WASM_MODULE_TYPE, WasmModuleObject::kSize);
   JSFunction::SetInitialMap(module_constructor, module_map, module_proto);
   InstallFunc(isolate, module_constructor, "imports", WebAssemblyModuleImports,
               1);
diff --git a/deps/v8/src/wasm/wasm-js.h b/deps/v8/src/wasm/wasm-js.h
index 926bd7647ac..bdcc1f061ec 100644
--- a/deps/v8/src/wasm/wasm-js.h
+++ b/deps/v8/src/wasm/wasm-js.h
@@ -2,11 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_JS_H_
-#define V8_WASM_JS_H_
+#ifndef V8_WASM_WASM_JS_H_
+#define V8_WASM_WASM_JS_H_
 
-#include "src/allocation.h"
-#include "src/base/hashmap.h"
+#include "src/globals.h"
 
 namespace v8 {
 namespace internal {
@@ -16,14 +15,9 @@ class WasmJs {
  public:
   V8_EXPORT_PRIVATE static void Install(Isolate* isolate,
                                         bool exposed_on_global_object);
-
-  // WebAssembly.Table.
-  static bool IsWasmTableObject(Isolate* isolate, Handle<Object> value);
-
-  // WebAssembly.Memory
-  static bool IsWasmMemoryObject(Isolate* isolate, Handle<Object> value);
 };
 
 }  // namespace internal
 }  // namespace v8
-#endif
+
+#endif  // V8_WASM_WASM_JS_H_
diff --git a/deps/v8/src/wasm/wasm-limits.h b/deps/v8/src/wasm/wasm-limits.h
index 184b6329baf..c1011c3f89a 100644
--- a/deps/v8/src/wasm/wasm-limits.h
+++ b/deps/v8/src/wasm/wasm-limits.h
@@ -48,6 +48,8 @@ static_assert(kV8MaxWasmMemoryPages <= kSpecMaxWasmMemoryPages,
 constexpr size_t kSpecMaxWasmTableSize = 0xFFFFFFFFu;
 
 constexpr size_t kV8MaxWasmMemoryBytes = kV8MaxWasmMemoryPages * kWasmPageSize;
+static_assert(kV8MaxWasmMemoryBytes <= std::numeric_limits<int32_t>::max(),
+              "max memory bytes should fit in int32_t");
 
 constexpr uint64_t kWasmMaxHeapOffset =
     static_cast<uint64_t>(
diff --git a/deps/v8/src/wasm/wasm-memory.cc b/deps/v8/src/wasm/wasm-memory.cc
index fcbe60ae0e8..dad53425103 100644
--- a/deps/v8/src/wasm/wasm-memory.cc
+++ b/deps/v8/src/wasm/wasm-memory.cc
@@ -12,109 +12,210 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-WasmAllocationTracker::~WasmAllocationTracker() {
+namespace {
+void* TryAllocateBackingStore(WasmMemoryTracker* memory_tracker, Heap* heap,
+                              size_t size, bool require_guard_regions,
+                              void** allocation_base,
+                              size_t* allocation_length) {
+#if V8_TARGET_ARCH_32_BIT
+  DCHECK(!require_guard_regions);
+#endif
+  // We always allocate the largest possible offset into the heap, so the
+  // addressable memory after the guard page can be made inaccessible.
+  *allocation_length =
+      require_guard_regions
+          ? RoundUp(kWasmMaxHeapOffset, CommitPageSize())
+          : RoundUp(
+                base::bits::RoundUpToPowerOfTwo32(static_cast<uint32_t>(size)),
+                kWasmPageSize);
+  DCHECK_GE(*allocation_length, size);
+  DCHECK_GE(*allocation_length, kWasmPageSize);
+
+  // Let the WasmMemoryTracker know we are going to reserve a bunch of
+  // address space.
+  if (!memory_tracker->ReserveAddressSpace(*allocation_length)) {
+    // If we fail the first time, collect garbage and retry.
+    heap->MemoryPressureNotification(MemoryPressureLevel::kCritical, true);
+    if (!memory_tracker->ReserveAddressSpace(*allocation_length)) {
+      // If we are over the address space limit, fail.
+      return nullptr;
+    }
+  }
+
+  // The Reserve makes the whole region inaccessible by default.
+  *allocation_base = AllocatePages(nullptr, *allocation_length, kWasmPageSize,
+                                   PageAllocator::kNoAccess);
+  if (*allocation_base == nullptr) {
+    memory_tracker->ReleaseReservation(*allocation_length);
+    return nullptr;
+  }
+  void* memory = *allocation_base;
+
+  // Make the part we care about accessible.
+  if (size > 0) {
+    CHECK(SetPermissions(memory, RoundUp(size, kWasmPageSize),
+                         PageAllocator::kReadWrite));
+  }
+
+  memory_tracker->RegisterAllocation(*allocation_base, *allocation_length,
+                                     memory, size);
+  return memory;
+}
+}  // namespace
+
+WasmMemoryTracker::~WasmMemoryTracker() {
+  if (empty_backing_store_.allocation_base != nullptr) {
+    CHECK(FreePages(empty_backing_store_.allocation_base,
+                    empty_backing_store_.allocation_length));
+    InternalReleaseAllocation(empty_backing_store_.buffer_start);
+  }
+
   // All reserved address space should be released before the allocation tracker
   // is destroyed.
+  DCHECK_EQ(reserved_address_space_, 0u);
   DCHECK_EQ(allocated_address_space_, 0u);
 }
 
-bool WasmAllocationTracker::ReserveAddressSpace(size_t num_bytes) {
+bool WasmMemoryTracker::ReserveAddressSpace(size_t num_bytes) {
 // Address space reservations are currently only meaningful using guard
 // regions, which is currently only supported on 64-bit systems. On other
 // platforms, we always fall back on bounds checks.
 #if V8_TARGET_ARCH_64_BIT
-  static constexpr size_t kAddressSpaceLimit = 0x10000000000L;  // 1 TiB
+  constexpr size_t kAddressSpaceLimit = 0x10000000000L;  // 1 TiB
+#else
+  constexpr size_t kAddressSpaceLimit = 0x80000000;  // 2 GiB
+#endif
 
-  size_t const old_count = allocated_address_space_.fetch_add(num_bytes);
+  size_t const old_count = reserved_address_space_.fetch_add(num_bytes);
   DCHECK_GE(old_count + num_bytes, old_count);
   if (old_count + num_bytes <= kAddressSpaceLimit) {
     return true;
   }
-  allocated_address_space_ -= num_bytes;
-#endif
+  reserved_address_space_ -= num_bytes;
   return false;
 }
 
-void WasmAllocationTracker::ReleaseAddressSpace(size_t num_bytes) {
-  DCHECK_LE(num_bytes, allocated_address_space_);
-  allocated_address_space_ -= num_bytes;
+void WasmMemoryTracker::ReleaseReservation(size_t num_bytes) {
+  size_t const old_reserved = reserved_address_space_.fetch_sub(num_bytes);
+  USE(old_reserved);
+  DCHECK_LE(num_bytes, old_reserved);
+  DCHECK_GE(old_reserved - num_bytes, allocated_address_space_);
 }
 
-void* TryAllocateBackingStore(Isolate* isolate, size_t size,
-                              bool require_guard_regions,
-                              void** allocation_base,
-                              size_t* allocation_length) {
-  // TODO(eholk): Right now require_guard_regions has no effect on 32-bit
-  // systems. It may be safer to fail instead, given that other code might do
-  // things that would be unsafe if they expected guard pages where there
-  // weren't any.
-  if (require_guard_regions) {
-    // TODO(eholk): On Windows we want to make sure we don't commit the guard
-    // pages yet.
-
-    // We always allocate the largest possible offset into the heap, so the
-    // addressable memory after the guard page can be made inaccessible.
-    *allocation_length = RoundUp(kWasmMaxHeapOffset, CommitPageSize());
-    DCHECK_EQ(0, size % CommitPageSize());
-
-    WasmAllocationTracker* const allocation_tracker =
-        isolate->wasm_engine()->allocation_tracker();
-
-    // Let the WasmAllocationTracker know we are going to reserve a bunch of
-    // address space.
-    if (!allocation_tracker->ReserveAddressSpace(*allocation_length)) {
-      // If we are over the address space limit, fail.
-      return nullptr;
-    }
+void WasmMemoryTracker::RegisterAllocation(void* allocation_base,
+                                           size_t allocation_length,
+                                           void* buffer_start,
+                                           size_t buffer_length) {
+  // Make sure the caller has reserved the address space before registering the
+  // allocation.
+  DCHECK_LE(allocated_address_space_ + allocation_length,
+            reserved_address_space_);
 
-    // The Reserve makes the whole region inaccessible by default.
-    *allocation_base =
-        isolate->array_buffer_allocator()->Reserve(*allocation_length);
-    if (*allocation_base == nullptr) {
-      allocation_tracker->ReleaseAddressSpace(*allocation_length);
-      return nullptr;
-    }
+  base::LockGuard<base::Mutex> scope_lock(&mutex_);
+
+  allocated_address_space_ += allocation_length;
+
+  allocations_.emplace(buffer_start,
+                       AllocationData{allocation_base, allocation_length,
+                                      buffer_start, buffer_length});
+}
+
+WasmMemoryTracker::AllocationData WasmMemoryTracker::ReleaseAllocation(
+    const void* buffer_start) {
+  if (IsEmptyBackingStore(buffer_start)) {
+    return AllocationData();
+  }
+  return InternalReleaseAllocation(buffer_start);
+}
+
+WasmMemoryTracker::AllocationData WasmMemoryTracker::InternalReleaseAllocation(
+    const void* buffer_start) {
+  base::LockGuard<base::Mutex> scope_lock(&mutex_);
+
+  auto find_result = allocations_.find(buffer_start);
+  CHECK_NE(find_result, allocations_.end());
+
+  if (find_result != allocations_.end()) {
+    size_t num_bytes = find_result->second.allocation_length;
+    DCHECK_LE(num_bytes, reserved_address_space_);
+    DCHECK_LE(num_bytes, allocated_address_space_);
+    reserved_address_space_ -= num_bytes;
+    allocated_address_space_ -= num_bytes;
+
+    AllocationData allocation_data = find_result->second;
+    allocations_.erase(find_result);
+    return allocation_data;
+  }
+  UNREACHABLE();
+}
+
+const WasmMemoryTracker::AllocationData* WasmMemoryTracker::FindAllocationData(
+    const void* buffer_start) {
+  base::LockGuard<base::Mutex> scope_lock(&mutex_);
+  const auto& result = allocations_.find(buffer_start);
+  if (result != allocations_.end()) {
+    return &result->second;
+  }
+  return nullptr;
+}
+
+bool WasmMemoryTracker::IsWasmMemory(const void* buffer_start) {
+  base::LockGuard<base::Mutex> scope_lock(&mutex_);
+  return allocations_.find(buffer_start) != allocations_.end();
+}
+
+void* WasmMemoryTracker::GetEmptyBackingStore(void** allocation_base,
+                                              size_t* allocation_length,
+                                              Heap* heap) {
+  if (empty_backing_store_.allocation_base == nullptr) {
+    constexpr size_t buffer_length = 0;
+    const bool require_guard_regions = trap_handler::IsTrapHandlerEnabled();
+    void* local_allocation_base;
+    size_t local_allocation_length;
+    void* buffer_start = TryAllocateBackingStore(
+        this, heap, buffer_length, require_guard_regions,
+        &local_allocation_base, &local_allocation_length);
+
+    empty_backing_store_ =
+        AllocationData(local_allocation_base, local_allocation_length,
+                       buffer_start, buffer_length);
+  }
+  *allocation_base = empty_backing_store_.allocation_base;
+  *allocation_length = empty_backing_store_.allocation_length;
+  return empty_backing_store_.buffer_start;
+}
+
+bool WasmMemoryTracker::IsEmptyBackingStore(const void* buffer_start) const {
+  return buffer_start == empty_backing_store_.buffer_start;
+}
 
-    void* memory = *allocation_base;
-
-    // Make the part we care about accessible.
-    isolate->array_buffer_allocator()->SetProtection(
-        memory, size, v8::ArrayBuffer::Allocator::Protection::kReadWrite);
-
-    reinterpret_cast<v8::Isolate*>(isolate)
-        ->AdjustAmountOfExternalAllocatedMemory(size);
-
-    return memory;
-  } else {
-    // TODO(titzer): use guard regions for minicage and merge with above code.
-    CHECK_LE(size, kV8MaxWasmMemoryBytes);
-    *allocation_length =
-        base::bits::RoundUpToPowerOfTwo32(static_cast<uint32_t>(size));
-    void* memory =
-        size == 0
-            ? nullptr
-            : isolate->array_buffer_allocator()->Allocate(*allocation_length);
-    *allocation_base = memory;
-    return memory;
+bool WasmMemoryTracker::FreeMemoryIfIsWasmMemory(const void* buffer_start) {
+  if (IsEmptyBackingStore(buffer_start)) {
+    // We don't need to do anything for the empty backing store, because this
+    // will be freed when WasmMemoryTracker shuts down. Return true so callers
+    // will not try to free the buffer on their own.
+    return true;
+  }
+  if (IsWasmMemory(buffer_start)) {
+    const AllocationData allocation = ReleaseAllocation(buffer_start);
+    CHECK(FreePages(allocation.allocation_base, allocation.allocation_length));
+    return true;
   }
+  return false;
 }
 
-Handle<JSArrayBuffer> SetupArrayBuffer(Isolate* isolate, void* allocation_base,
-                                       size_t allocation_length,
-                                       void* backing_store, size_t size,
-                                       bool is_external,
-                                       bool enable_guard_regions,
+Handle<JSArrayBuffer> SetupArrayBuffer(Isolate* isolate, void* backing_store,
+                                       size_t size, bool is_external,
                                        SharedFlag shared) {
   Handle<JSArrayBuffer> buffer =
       isolate->factory()->NewJSArrayBuffer(shared, TENURED);
   DCHECK_GE(kMaxInt, size);
   if (shared == SharedFlag::kShared) DCHECK(FLAG_experimental_wasm_threads);
-  JSArrayBuffer::Setup(buffer, isolate, is_external, allocation_base,
-                       allocation_length, backing_store, static_cast<int>(size),
-                       shared);
+  constexpr bool is_wasm_memory = true;
+  JSArrayBuffer::Setup(buffer, isolate, is_external, backing_store,
+                       static_cast<int>(size), shared, is_wasm_memory);
   buffer->set_is_neuterable(false);
   buffer->set_is_growable(true);
-  buffer->set_has_guard_region(enable_guard_regions);
   return buffer;
 }
 
@@ -129,13 +230,19 @@ Handle<JSArrayBuffer> NewArrayBuffer(Isolate* isolate, size_t size,
     return Handle<JSArrayBuffer>::null();
   }
 
-  void* allocation_base = nullptr;  // Set by TryAllocateBackingStore
-  size_t allocation_length = 0;     // Set by TryAllocateBackingStore
-  // Do not reserve memory till non zero memory is encountered.
-  void* memory = (size == 0) ? nullptr
-                             : TryAllocateBackingStore(
-                                   isolate, size, require_guard_regions,
-                                   &allocation_base, &allocation_length);
+  WasmMemoryTracker* memory_tracker = isolate->wasm_engine()->memory_tracker();
+
+  // Set by TryAllocateBackingStore or GetEmptyBackingStore
+  void* allocation_base = nullptr;
+  size_t allocation_length = 0;
+
+  void* memory =
+      (size == 0)
+          ? memory_tracker->GetEmptyBackingStore(
+                &allocation_base, &allocation_length, isolate->heap())
+          : TryAllocateBackingStore(memory_tracker, isolate->heap(), size,
+                                    require_guard_regions, &allocation_base,
+                                    &allocation_length);
 
   if (size > 0 && memory == nullptr) {
     return Handle<JSArrayBuffer>::null();
@@ -149,9 +256,11 @@ Handle<JSArrayBuffer> NewArrayBuffer(Isolate* isolate, size_t size,
   }
 #endif
 
+  reinterpret_cast<v8::Isolate*>(isolate)
+      ->AdjustAmountOfExternalAllocatedMemory(size);
+
   constexpr bool is_external = false;
-  return SetupArrayBuffer(isolate, allocation_base, allocation_length, memory,
-                          size, is_external, require_guard_regions, shared);
+  return SetupArrayBuffer(isolate, memory, size, is_external, shared);
 }
 
 void DetachMemoryBuffer(Isolate* isolate, Handle<JSArrayBuffer> buffer,
@@ -175,6 +284,7 @@ void DetachMemoryBuffer(Isolate* isolate, Handle<JSArrayBuffer> buffer,
   }
 
   DCHECK(buffer->is_external());
+  buffer->set_is_wasm_memory(false);
   buffer->set_is_neuterable(true);
   buffer->Neuter();
 }
diff --git a/deps/v8/src/wasm/wasm-memory.h b/deps/v8/src/wasm/wasm-memory.h
index c5d6ef51547..4be09e484c9 100644
--- a/deps/v8/src/wasm/wasm-memory.h
+++ b/deps/v8/src/wasm/wasm-memory.h
@@ -2,9 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_MEMORY_H_
-#define V8_WASM_MEMORY_H_
+#ifndef V8_WASM_WASM_MEMORY_H_
+#define V8_WASM_WASM_MEMORY_H_
 
+#include <unordered_map>
+
+#include "src/base/platform/mutex.h"
 #include "src/flags.h"
 #include "src/handles.h"
 #include "src/objects/js-array.h"
@@ -13,10 +16,10 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-class WasmAllocationTracker {
+class WasmMemoryTracker {
  public:
-  WasmAllocationTracker() {}
-  ~WasmAllocationTracker();
+  WasmMemoryTracker() {}
+  ~WasmMemoryTracker();
 
   // ReserveAddressSpace attempts to increase the reserved address space counter
   // to determine whether there is enough headroom to allocate another guarded
@@ -24,13 +27,90 @@ class WasmAllocationTracker {
   // allocate the buffer), false otherwise.
   bool ReserveAddressSpace(size_t num_bytes);
 
-  // Reduces the address space counter so that the space can be reused.
-  void ReleaseAddressSpace(size_t num_bytes);
+  void RegisterAllocation(void* allocation_base, size_t allocation_length,
+                          void* buffer_start, size_t buffer_length);
+
+  struct AllocationData {
+    void* allocation_base = nullptr;
+    size_t allocation_length = 0;
+    void* buffer_start = nullptr;
+    size_t buffer_length = 0;
+
+   private:
+    AllocationData() = default;
+    AllocationData(void* allocation_base, size_t allocation_length,
+                   void* buffer_start, size_t buffer_length)
+        : allocation_base(allocation_base),
+          allocation_length(allocation_length),
+          buffer_start(buffer_start),
+          buffer_length(buffer_length) {
+      DCHECK_LE(reinterpret_cast<uintptr_t>(allocation_base),
+                reinterpret_cast<uintptr_t>(buffer_start));
+      DCHECK_GE(
+          reinterpret_cast<uintptr_t>(allocation_base) + allocation_length,
+          reinterpret_cast<uintptr_t>(buffer_start));
+      DCHECK_GE(
+          reinterpret_cast<uintptr_t>(allocation_base) + allocation_length,
+          reinterpret_cast<uintptr_t>(buffer_start) + buffer_length);
+    }
+
+    friend WasmMemoryTracker;
+  };
+
+  // Decreases the amount of reserved address space
+  void ReleaseReservation(size_t num_bytes);
+
+  // Removes an allocation from the tracker
+  AllocationData ReleaseAllocation(const void* buffer_start);
+
+  bool IsWasmMemory(const void* buffer_start);
+
+  // Returns a pointer to a Wasm buffer's allocation data, or nullptr if the
+  // buffer is not tracked.
+  const AllocationData* FindAllocationData(const void* buffer_start);
+
+  // Empty WebAssembly memories are all backed by a shared inaccessible
+  // reservation. This method creates this store or returns the existing one if
+  // already created.
+  void* GetEmptyBackingStore(void** allocation_base, size_t* allocation_length,
+                             Heap* heap);
+
+  bool IsEmptyBackingStore(const void* buffer_start) const;
+
+  // Checks if a buffer points to a Wasm memory and if so does any necessary
+  // work to reclaim the buffer. If this function returns false, the caller must
+  // free the buffer manually.
+  bool FreeMemoryIfIsWasmMemory(const void* buffer_start);
 
  private:
-  std::atomic_size_t allocated_address_space_{0};
+  AllocationData InternalReleaseAllocation(const void* buffer_start);
+
+  // Clients use a two-part process. First they "reserve" the address space,
+  // which signifies an intent to actually allocate it. This determines whether
+  // doing the allocation would put us over our limit. Once there is a
+  // reservation, clients can do the allocation and register the result.
+  //
+  // We should always have:
+  // allocated_address_space_ <= reserved_address_space_ <= kAddressSpaceLimit
+  std::atomic_size_t reserved_address_space_{0};
+
+  // Used to protect access to the allocated address space counter and
+  // allocation map. This is needed because Wasm memories can be freed on
+  // another thread by the ArrayBufferTracker.
+  base::Mutex mutex_;
 
-  DISALLOW_COPY_AND_ASSIGN(WasmAllocationTracker);
+  size_t allocated_address_space_{0};
+
+  // Track Wasm memory allocation information. This is keyed by the start of the
+  // buffer, rather than by the start of the allocation.
+  std::unordered_map<const void*, AllocationData> allocations_;
+
+  // Empty backing stores still need to be backed by mapped pages when using
+  // trap handlers. Because this could eat up address space quickly, we keep a
+  // shared backing store here.
+  AllocationData empty_backing_store_;
+
+  DISALLOW_COPY_AND_ASSIGN(WasmMemoryTracker);
 };
 
 Handle<JSArrayBuffer> NewArrayBuffer(
@@ -38,9 +118,8 @@ Handle<JSArrayBuffer> NewArrayBuffer(
     SharedFlag shared = SharedFlag::kNotShared);
 
 Handle<JSArrayBuffer> SetupArrayBuffer(
-    Isolate*, void* allocation_base, size_t allocation_length,
-    void* backing_store, size_t size, bool is_external,
-    bool enable_guard_regions, SharedFlag shared = SharedFlag::kNotShared);
+    Isolate*, void* backing_store, size_t size, bool is_external,
+    SharedFlag shared = SharedFlag::kNotShared);
 
 void DetachMemoryBuffer(Isolate* isolate, Handle<JSArrayBuffer> buffer,
                         bool free_memory);
@@ -49,4 +128,4 @@ void DetachMemoryBuffer(Isolate* isolate, Handle<JSArrayBuffer> buffer,
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_MODULE_H_
+#endif  // V8_WASM_WASM_MEMORY_H_
diff --git a/deps/v8/src/wasm/wasm-module.cc b/deps/v8/src/wasm/wasm-module.cc
index b6b9117ae55..669d5b79aa7 100644
--- a/deps/v8/src/wasm/wasm-module.cc
+++ b/deps/v8/src/wasm/wasm-module.cc
@@ -18,7 +18,6 @@
 #include "src/trap-handler/trap-handler.h"
 #include "src/v8.h"
 #include "src/wasm/compilation-manager.h"
-#include "src/wasm/module-compiler.h"
 #include "src/wasm/module-decoder.h"
 #include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-code-specialization.h"
@@ -40,60 +39,6 @@ constexpr const char* WasmException::kRuntimeIdStr;
 // static
 constexpr const char* WasmException::kRuntimeValuesStr;
 
-void UnpackAndRegisterProtectedInstructionsGC(Isolate* isolate,
-                                              Handle<FixedArray> code_table) {
-  DisallowHeapAllocation no_gc;
-  std::vector<trap_handler::ProtectedInstructionData> unpacked;
-
-  for (int i = 0; i < code_table->length(); ++i) {
-    Object* maybe_code = code_table->get(i);
-    // This is sometimes undefined when we're called from cctests.
-    if (maybe_code->IsUndefined(isolate)) continue;
-    Code* code = Code::cast(maybe_code);
-
-    if (code->kind() != Code::WASM_FUNCTION) {
-      continue;
-    }
-
-    if (code->trap_handler_index()->value() != trap_handler::kInvalidIndex) {
-      // This function has already been registered.
-      continue;
-    }
-
-    byte* base = code->entry();
-
-    FixedArray* protected_instructions = code->protected_instructions();
-    DCHECK(protected_instructions != nullptr);
-    for (int i = 0; i < protected_instructions->length();
-         i += Code::kTrapDataSize) {
-      trap_handler::ProtectedInstructionData data;
-      data.instr_offset =
-          protected_instructions
-              ->GetValueChecked<Smi>(isolate, i + Code::kTrapCodeOffset)
-              ->value();
-      data.landing_offset =
-          protected_instructions
-              ->GetValueChecked<Smi>(isolate, i + Code::kTrapLandingOffset)
-              ->value();
-      unpacked.emplace_back(data);
-    }
-
-    if (unpacked.empty()) continue;
-
-    const int index = RegisterHandlerData(base, code->instruction_size(),
-                                          unpacked.size(), &unpacked[0]);
-
-    unpacked.clear();
-
-    // TODO(6792): No longer needed once WebAssembly code is off heap.
-    CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
-
-    // TODO(eholk): if index is negative, fail.
-    DCHECK_LE(0, index);
-    code->set_trap_handler_index(Smi::FromInt(index));
-  }
-}
-
 void UnpackAndRegisterProtectedInstructions(
     Isolate* isolate, const wasm::NativeModule* native_module) {
   DisallowHeapAllocation no_gc;
@@ -116,18 +61,70 @@ void UnpackAndRegisterProtectedInstructions(
         RegisterHandlerData(base, size, code->protected_instructions().size(),
                             code->protected_instructions().data());
 
-    // TODO(6792): No longer needed once WebAssembly code is off heap.
-    CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
-
     // TODO(eholk): if index is negative, fail.
     CHECK_LE(0, index);
     code->set_trap_handler_index(static_cast<size_t>(index));
   }
 }
 
+WireBytesRef WasmModule::LookupName(const ModuleWireBytes* wire_bytes,
+                                    uint32_t function_index) const {
+  if (!names_) {
+    names_.reset(new std::unordered_map<uint32_t, WireBytesRef>());
+    wasm::DecodeFunctionNames(wire_bytes->start(), wire_bytes->end(),
+                              names_.get());
+  }
+  auto it = names_->find(function_index);
+  if (it == names_->end()) return WireBytesRef();
+  return it->second;
+}
+
+WireBytesRef WasmModule::LookupName(SeqOneByteString* wire_bytes,
+                                    uint32_t function_index) const {
+  DisallowHeapAllocation no_gc;
+  uint8_t* chars = wire_bytes->GetChars();
+  ModuleWireBytes module_wire_bytes(chars, chars + wire_bytes->length());
+  return LookupName(&module_wire_bytes, function_index);
+}
+
+void WasmModule::AddNameForTesting(int function_index, WireBytesRef name) {
+  if (!names_) {
+    names_.reset(new std::unordered_map<uint32_t, WireBytesRef>());
+  }
+  names_->insert(std::make_pair(function_index, name));
+}
+
+// Get a string stored in the module bytes representing a name.
+WasmName ModuleWireBytes::GetName(WireBytesRef ref) const {
+  if (ref.is_empty()) return {"<?>", 3};  // no name.
+  CHECK(BoundsCheck(ref.offset(), ref.length()));
+  return Vector<const char>::cast(
+      module_bytes_.SubVector(ref.offset(), ref.end_offset()));
+}
+
+// Get a string stored in the module bytes representing a function name.
+WasmName ModuleWireBytes::GetName(const WasmFunction* function,
+                                  const WasmModule* module) const {
+  return GetName(module->LookupName(this, function->func_index));
+}
+
+// Get a string stored in the module bytes representing a name.
+WasmName ModuleWireBytes::GetNameOrNull(WireBytesRef ref) const {
+  if (!ref.is_set()) return {nullptr, 0};  // no name.
+  CHECK(BoundsCheck(ref.offset(), ref.length()));
+  return Vector<const char>::cast(
+      module_bytes_.SubVector(ref.offset(), ref.end_offset()));
+}
+
+// Get a string stored in the module bytes representing a function name.
+WasmName ModuleWireBytes::GetNameOrNull(const WasmFunction* function,
+                                        const WasmModule* module) const {
+  return GetNameOrNull(module->LookupName(this, function->func_index));
+}
+
 std::ostream& operator<<(std::ostream& os, const WasmFunctionName& name) {
   os << "#" << name.function_->func_index;
-  if (name.function_->name.is_set()) {
+  if (!name.name_.is_empty()) {
     if (name.name_.start()) {
       os << ":";
       os.write(name.name_.start(), name.name_.length());
@@ -155,39 +152,6 @@ WasmFunction* GetWasmFunctionForExport(Isolate* isolate,
   return nullptr;
 }
 
-Handle<Object> GetOrCreateIndirectCallWrapper(
-    Isolate* isolate, Handle<WasmInstanceObject> owning_instance,
-    WasmCodeWrapper wasm_code, uint32_t index, FunctionSig* sig) {
-  Address new_context_address =
-      reinterpret_cast<Address>(owning_instance->wasm_context()->get());
-  if (!wasm_code.IsCodeObject()) {
-    DCHECK_NE(wasm_code.GetWasmCode()->kind(),
-              wasm::WasmCode::kWasmToWasmWrapper);
-    wasm::NativeModule* native_module = wasm_code.GetWasmCode()->owner();
-    // The only reason we pass owning_instance is for the GC case. Check
-    // that the values match.
-    DCHECK_EQ(owning_instance->compiled_module()->GetNativeModule(),
-              native_module);
-    // We create the wrapper on the module exporting the function. This
-    // wrapper will only be called as indirect call.
-    wasm::WasmCode* exported_wrapper =
-        native_module->GetExportedWrapper(wasm_code.GetWasmCode()->index());
-    if (exported_wrapper == nullptr) {
-      Handle<Code> new_wrapper = compiler::CompileWasmToWasmWrapper(
-          isolate, wasm_code, sig, new_context_address);
-      exported_wrapper = native_module->AddExportedWrapper(
-          new_wrapper, wasm_code.GetWasmCode()->index());
-    }
-    Address target = exported_wrapper->instructions().start();
-    return isolate->factory()->NewForeign(target, TENURED);
-  }
-  Handle<Code> code = compiler::CompileWasmToWasmWrapper(
-      isolate, wasm_code, sig, new_context_address);
-  AttachWasmFunctionInfo(isolate, code, owning_instance,
-                         static_cast<int>(index));
-  return code;
-}
-
 bool IsWasmCodegenAllowed(Isolate* isolate, Handle<Context> context) {
   // TODO(wasm): Once wasm has its own CSP policy, we should introduce a
   // separate callback that includes information about the module about to be
@@ -376,8 +340,7 @@ Handle<JSArray> GetCustomSections(Isolate* isolate,
     }
     Handle<JSArrayBuffer> buffer = isolate->factory()->NewJSArrayBuffer();
     constexpr bool is_external = false;
-    JSArrayBuffer::Setup(buffer, isolate, is_external, memory, size, memory,
-                         size);
+    JSArrayBuffer::Setup(buffer, isolate, is_external, memory, size);
     DisallowHeapAllocation no_gc;  // for raw access to string bytes.
     Handle<SeqOneByteString> module_bytes(shared->module_bytes(), isolate);
     const byte* start =
diff --git a/deps/v8/src/wasm/wasm-module.h b/deps/v8/src/wasm/wasm-module.h
index 492c51487fd..fd238d4d635 100644
--- a/deps/v8/src/wasm/wasm-module.h
+++ b/deps/v8/src/wasm/wasm-module.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_MODULE_H_
-#define V8_WASM_MODULE_H_
+#ifndef V8_WASM_WASM_MODULE_H_
+#define V8_WASM_WASM_MODULE_H_
 
 #include <memory>
 
@@ -35,13 +35,13 @@ class CallDescriptor;
 namespace wasm {
 class ErrorThrower;
 class NativeModule;
+class TestingModuleBuilder;
 
 // Static representation of a wasm function.
 struct WasmFunction {
   FunctionSig* sig;      // signature of the function.
   uint32_t func_index;   // index into the function table.
   uint32_t sig_index;    // index into the signature table.
-  WireBytesRef name;     // function name, if any.
   WireBytesRef code;     // code of this function.
   bool imported;
   bool exported;
@@ -165,9 +165,16 @@ struct V8_EXPORT_PRIVATE WasmModule {
   bool is_wasm() const { return origin_ == kWasmOrigin; }
   bool is_asm_js() const { return origin_ == kAsmJsOrigin; }
 
+  WireBytesRef LookupName(const ModuleWireBytes* wire_bytes,
+                          uint32_t function_index) const;
+  WireBytesRef LookupName(SeqOneByteString* wire_bytes,
+                          uint32_t function_index) const;
+  void AddNameForTesting(int function_index, WireBytesRef name);
+
  private:
   // TODO(kschimpf) - Encapsulate more fields.
   ModuleOrigin origin_ = kWasmOrigin;  // origin of the module
+  mutable std::unique_ptr<std::unordered_map<uint32_t, WireBytesRef>> names_;
 };
 
 typedef Managed<WasmModule> WasmModuleWrapper;
@@ -185,30 +192,18 @@ struct V8_EXPORT_PRIVATE ModuleWireBytes {
   }
 
   // Get a string stored in the module bytes representing a name.
-  WasmName GetName(WireBytesRef ref) const {
-    if (ref.is_empty()) return {"<?>", 3};  // no name.
-    CHECK(BoundsCheck(ref.offset(), ref.length()));
-    return Vector<const char>::cast(
-        module_bytes_.SubVector(ref.offset(), ref.end_offset()));
-  }
+  WasmName GetName(WireBytesRef ref) const;
 
   // Get a string stored in the module bytes representing a function name.
-  WasmName GetName(const WasmFunction* function) const {
-    return GetName(function->name);
-  }
+  WasmName GetName(const WasmFunction* function,
+                   const WasmModule* module) const;
 
   // Get a string stored in the module bytes representing a name.
-  WasmName GetNameOrNull(WireBytesRef ref) const {
-    if (!ref.is_set()) return {nullptr, 0};  // no name.
-    CHECK(BoundsCheck(ref.offset(), ref.length()));
-    return Vector<const char>::cast(
-        module_bytes_.SubVector(ref.offset(), ref.end_offset()));
-  }
+  WasmName GetNameOrNull(WireBytesRef ref) const;
 
   // Get a string stored in the module bytes representing a function name.
-  WasmName GetNameOrNull(const WasmFunction* function) const {
-    return GetNameOrNull(function->name);
-  }
+  WasmName GetNameOrNull(const WasmFunction* function,
+                         const WasmModule* module) const;
 
   // Checks the given offset range is contained within the module bytes.
   bool BoundsCheck(uint32_t offset, uint32_t length) const {
@@ -273,13 +268,6 @@ Handle<FixedArray> DecodeLocalNames(Isolate*, Handle<WasmSharedModuleData>);
 // TODO(titzer): move this to WasmExportedFunction.
 WasmFunction* GetWasmFunctionForExport(Isolate* isolate, Handle<Object> target);
 
-Handle<Object> GetOrCreateIndirectCallWrapper(
-    Isolate* isolate, Handle<WasmInstanceObject> owning_instance,
-    WasmCodeWrapper wasm_code, uint32_t index, FunctionSig* sig);
-
-void UnpackAndRegisterProtectedInstructionsGC(Isolate* isolate,
-                                              Handle<FixedArray> code_table);
-
 void UnpackAndRegisterProtectedInstructions(
     Isolate* isolate, const wasm::NativeModule* native_module);
 
@@ -323,4 +311,4 @@ class TruncatedUserString {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_MODULE_H_
+#endif  // V8_WASM_WASM_MODULE_H_
diff --git a/deps/v8/src/wasm/wasm-objects-inl.h b/deps/v8/src/wasm/wasm-objects-inl.h
index 0a858621741..1c398193660 100644
--- a/deps/v8/src/wasm/wasm-objects-inl.h
+++ b/deps/v8/src/wasm/wasm-objects-inl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_OBJECTS_INL_H_
-#define V8_WASM_OBJECTS_INL_H_
+#ifndef V8_WASM_WASM_OBJECTS_INL_H_
+#define V8_WASM_WASM_OBJECTS_INL_H_
 
 #include "src/heap/heap-inl.h"
 #include "src/wasm/wasm-objects.h"
@@ -14,9 +14,12 @@ namespace internal {
 // Has to be the last include (doesn't have include guards)
 #include "src/objects/object-macros.h"
 
+CAST_ACCESSOR(WasmCompiledModule)
+CAST_ACCESSOR(WasmDebugInfo)
 CAST_ACCESSOR(WasmInstanceObject)
 CAST_ACCESSOR(WasmMemoryObject)
 CAST_ACCESSOR(WasmModuleObject)
+CAST_ACCESSOR(WasmSharedModuleData)
 CAST_ACCESSOR(WasmTableObject)
 
 #define OPTIONAL_ACCESSORS(holder, name, type, offset)           \
@@ -25,6 +28,20 @@ CAST_ACCESSOR(WasmTableObject)
   }                                                              \
   ACCESSORS(holder, name, type, offset)
 
+#define READ_PRIMITIVE_FIELD(p, type, offset) \
+  (*reinterpret_cast<type const*>(FIELD_ADDR_CONST(p, offset)))
+
+#define WRITE_PRIMITIVE_FIELD(p, type, offset, value) \
+  (*reinterpret_cast<type*>(FIELD_ADDR(p, offset)) = value)
+
+#define PRIMITIVE_ACCESSORS(holder, name, type, offset) \
+  type holder::name() const {                           \
+    return READ_PRIMITIVE_FIELD(this, type, offset);    \
+  }                                                     \
+  void holder::set_##name(type value) {                 \
+    WRITE_PRIMITIVE_FIELD(this, type, offset, value);   \
+  }
+
 // WasmModuleObject
 ACCESSORS(WasmModuleObject, compiled_module, WasmCompiledModule,
           kCompiledModuleOffset)
@@ -37,12 +54,24 @@ ACCESSORS(WasmTableObject, dispatch_tables, FixedArray, kDispatchTablesOffset)
 // WasmMemoryObject
 ACCESSORS(WasmMemoryObject, array_buffer, JSArrayBuffer, kArrayBufferOffset)
 SMI_ACCESSORS(WasmMemoryObject, maximum_pages, kMaximumPagesOffset)
-OPTIONAL_ACCESSORS(WasmMemoryObject, instances, WeakFixedArray,
+OPTIONAL_ACCESSORS(WasmMemoryObject, instances, FixedArrayOfWeakCells,
                    kInstancesOffset)
 
 // WasmInstanceObject
 ACCESSORS(WasmInstanceObject, wasm_context, Managed<WasmContext>,
           kWasmContextOffset)
+PRIMITIVE_ACCESSORS(WasmInstanceObject, memory_start, byte*, kMemoryStartOffset)
+PRIMITIVE_ACCESSORS(WasmInstanceObject, memory_size, uintptr_t,
+                    kMemorySizeOffset)
+PRIMITIVE_ACCESSORS(WasmInstanceObject, memory_mask, uintptr_t,
+                    kMemoryMaskOffset)
+PRIMITIVE_ACCESSORS(WasmInstanceObject, globals_start, byte*,
+                    kGlobalsStartOffset)
+PRIMITIVE_ACCESSORS(WasmInstanceObject, indirect_function_table,
+                    IndirectFunctionTableEntry*, kIndirectFunctionTableOffset)
+PRIMITIVE_ACCESSORS(WasmInstanceObject, indirect_function_table_size, uintptr_t,
+                    kIndirectFunctionTableSizeOffset)
+
 ACCESSORS(WasmInstanceObject, compiled_module, WasmCompiledModule,
           kCompiledModuleOffset)
 ACCESSORS(WasmInstanceObject, exports_object, JSObject, kExportsObjectOffset)
@@ -62,6 +91,7 @@ ACCESSORS(WasmInstanceObject, js_imports_table, FixedArray,
           kJsImportsTableOffset)
 
 // WasmSharedModuleData
+ACCESSORS(WasmSharedModuleData, module_wrapper, Object, kModuleWrapperOffset)
 ACCESSORS(WasmSharedModuleData, module_bytes, SeqOneByteString,
           kModuleBytesOffset)
 ACCESSORS(WasmSharedModuleData, script, Script, kScriptOffset)
@@ -69,10 +99,18 @@ OPTIONAL_ACCESSORS(WasmSharedModuleData, asm_js_offset_table, ByteArray,
                    kAsmJsOffsetTableOffset)
 OPTIONAL_ACCESSORS(WasmSharedModuleData, breakpoint_infos, FixedArray,
                    kBreakPointInfosOffset)
-
 OPTIONAL_ACCESSORS(WasmSharedModuleData, lazy_compilation_orchestrator, Foreign,
                    kLazyCompilationOrchestratorOffset)
+void WasmSharedModuleData::reset_breakpoint_infos() {
+  DCHECK(IsWasmSharedModuleData());
+  WRITE_FIELD(this, kBreakPointInfosOffset, GetHeap()->undefined_value());
+}
 
+// WasmDebugInfo
+ACCESSORS(WasmDebugInfo, wasm_instance, WasmInstanceObject, kInstanceOffset)
+ACCESSORS(WasmDebugInfo, interpreter_handle, Object, kInterpreterHandleOffset)
+ACCESSORS(WasmDebugInfo, interpreted_functions, Object,
+          kInterpretedFunctionsOffset)
 OPTIONAL_ACCESSORS(WasmDebugInfo, locals_names, FixedArray, kLocalsNamesOffset)
 OPTIONAL_ACCESSORS(WasmDebugInfo, c_wasm_entries, FixedArray,
                    kCWasmEntriesOffset)
@@ -81,81 +119,68 @@ OPTIONAL_ACCESSORS(WasmDebugInfo, c_wasm_entry_map, Managed<wasm::SignatureMap>,
 
 #undef OPTIONAL_ACCESSORS
 
-#define WCM_OBJECT_OR_WEAK(TYPE, NAME, ID, TYPE_CHECK, SETTER_MODIFIER) \
-  TYPE* WasmCompiledModule::maybe_##NAME() const {                      \
-    Object* obj = get(ID);                                              \
-    if (!(TYPE_CHECK)) return nullptr;                                  \
-    return TYPE::cast(obj);                                             \
-  }                                                                     \
-                                                                        \
-  TYPE* WasmCompiledModule::NAME() const {                              \
-    Object* obj = get(ID);                                              \
-    DCHECK(TYPE_CHECK);                                                 \
-    return TYPE::cast(obj);                                             \
-  }                                                                     \
-                                                                        \
-  bool WasmCompiledModule::has_##NAME() const {                         \
-    Object* obj = get(ID);                                              \
-    return TYPE_CHECK;                                                  \
-  }                                                                     \
-                                                                        \
-  void WasmCompiledModule::reset_##NAME() { set_undefined(ID); }        \
-                                                                        \
-  void WasmCompiledModule::set_##NAME(TYPE* value) { set(ID, value); }
-
-#define WCM_OBJECT(TYPE, NAME) \
-  WCM_OBJECT_OR_WEAK(TYPE, NAME, kID_##NAME, obj->Is##TYPE(), public)
-
-#define WCM_CONST_OBJECT(TYPE, NAME) \
-  WCM_OBJECT_OR_WEAK(TYPE, NAME, kID_##NAME, obj->Is##TYPE(), private)
-
-#define WCM_WASM_OBJECT(TYPE, NAME) \
-  WCM_OBJECT_OR_WEAK(TYPE, NAME, kID_##NAME, TYPE::Is##TYPE(obj), private)
-
-#define WCM_SMALL_CONST_NUMBER(TYPE, NAME)                 \
-  TYPE WasmCompiledModule::NAME() const {                  \
-    return static_cast<TYPE>(Smi::ToInt(get(kID_##NAME))); \
-  }                                                        \
-                                                           \
-  void WasmCompiledModule::set_##NAME(TYPE value) {        \
-    set(kID_##NAME, Smi::FromInt(value));                  \
+#define WCM_OBJECT_OR_WEAK(TYPE, NAME, OFFSET, TYPE_CHECK)   \
+  bool WasmCompiledModule::has_##NAME() const {              \
+    Object* value = READ_FIELD(this, OFFSET);                \
+    return TYPE_CHECK;                                       \
+  }                                                          \
+                                                             \
+  void WasmCompiledModule::reset_##NAME() {                  \
+    WRITE_FIELD(this, OFFSET, GetHeap()->undefined_value()); \
+  }                                                          \
+                                                             \
+  ACCESSORS_CHECKED2(WasmCompiledModule, NAME, TYPE, OFFSET, TYPE_CHECK, true)
+
+#define WCM_OBJECT(TYPE, NAME, OFFSET) \
+  WCM_OBJECT_OR_WEAK(TYPE, NAME, OFFSET, value->Is##TYPE())
+
+#define WCM_SMALL_CONST_NUMBER(TYPE, NAME, OFFSET)                  \
+  TYPE WasmCompiledModule::NAME() const {                           \
+    return static_cast<TYPE>(Smi::ToInt(READ_FIELD(this, OFFSET))); \
+  }                                                                 \
+                                                                    \
+  void WasmCompiledModule::set_##NAME(TYPE value) {                 \
+    WRITE_FIELD(this, OFFSET, Smi::FromInt(value));                 \
   }
 
-#define WCM_WEAK_LINK(TYPE, NAME)                                          \
-  WCM_OBJECT_OR_WEAK(WeakCell, weak_##NAME, kID_##NAME, obj->IsWeakCell(), \
-                     public)                                               \
-                                                                           \
-  TYPE* WasmCompiledModule::NAME() const {                                 \
-    DCHECK(!weak_##NAME()->cleared());                                     \
-    return TYPE::cast(weak_##NAME()->value());                             \
+#define WCM_WEAK_LINK(TYPE, NAME, OFFSET)                                \
+  WCM_OBJECT_OR_WEAK(WeakCell, weak_##NAME, OFFSET, value->IsWeakCell()) \
+                                                                         \
+  TYPE* WasmCompiledModule::NAME() const {                               \
+    DCHECK(!weak_##NAME()->cleared());                                   \
+    return TYPE::cast(weak_##NAME()->value());                           \
   }
 
-#define DEFINITION(KIND, TYPE, NAME) WCM_##KIND(TYPE, NAME)
-WCM_PROPERTY_TABLE(DEFINITION)
-#undef DECLARATION
+// WasmCompiledModule
+WCM_OBJECT(WasmSharedModuleData, shared, kSharedOffset)
+WCM_WEAK_LINK(Context, native_context, kNativeContextOffset)
+WCM_OBJECT(FixedArray, export_wrappers, kExportWrappersOffset)
+WCM_OBJECT(FixedArray, weak_exported_functions, kWeakExportedFunctionsOffset)
+WCM_OBJECT(WasmCompiledModule, next_instance, kNextInstanceOffset)
+WCM_OBJECT(WasmCompiledModule, prev_instance, kPrevInstanceOffset)
+WCM_WEAK_LINK(WasmInstanceObject, owning_instance, kOwningInstanceOffset)
+WCM_WEAK_LINK(WasmModuleObject, wasm_module, kWasmModuleOffset)
+WCM_OBJECT(Foreign, native_module, kNativeModuleOffset)
+WCM_OBJECT(FixedArray, lazy_compile_data, kLazyCompileDataOffset)
+WCM_SMALL_CONST_NUMBER(bool, use_trap_handler, kUseTrapHandlerOffset)
+ACCESSORS(WasmCompiledModule, raw_next_instance, Object, kNextInstanceOffset);
+ACCESSORS(WasmCompiledModule, raw_prev_instance, Object, kPrevInstanceOffset);
 
-#undef WCM_CONST_OBJECT
-#undef WCM_LARGE_NUMBER
 #undef WCM_OBJECT_OR_WEAK
+#undef WCM_OBJECT
 #undef WCM_SMALL_CONST_NUMBER
 #undef WCM_WEAK_LINK
+#undef READ_PRIMITIVE_FIELD
+#undef WRITE_PRIMITIVE_FIELD
+#undef PRIMITIVE_ACCESSORS
 
 uint32_t WasmTableObject::current_length() { return functions()->length(); }
 
-bool WasmTableObject::has_maximum_length() {
-  return maximum_length()->Number() >= 0;
-}
-
 bool WasmMemoryObject::has_maximum_pages() { return maximum_pages() >= 0; }
 
-void WasmCompiledModule::ReplaceCodeTableForTesting(
-    Handle<FixedArray> testing_table) {
-  set_code_table(*testing_table);
-}
-
 #include "src/objects/object-macros-undef.h"
 
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_OBJECTS_INL_H_
+#endif  // V8_WASM_WASM_OBJECTS_INL_H_
diff --git a/deps/v8/src/wasm/wasm-objects.cc b/deps/v8/src/wasm/wasm-objects.cc
index c92a51716ab..c9774a42d1c 100644
--- a/deps/v8/src/wasm/wasm-objects.cc
+++ b/deps/v8/src/wasm/wasm-objects.cc
@@ -155,14 +155,6 @@ bool IsBreakablePosition(WasmSharedModuleData* shared, int func_index,
 }
 #endif  // DEBUG
 
-void CompiledModuleFinalizer(const v8::WeakCallbackInfo<void>& data) {
-  DisallowHeapAllocation no_gc;
-  JSObject** p = reinterpret_cast<JSObject**>(data.GetParameter());
-  WasmCompiledModule* compiled_module = WasmCompiledModule::cast(*p);
-  compiled_module->reset_native_module();
-  GlobalHandles::Destroy(reinterpret_cast<Object**>(p));
-}
-
 enum DispatchTableElements : int {
   kDispatchTableInstanceOffset,
   kDispatchTableIndexOffset,
@@ -183,6 +175,8 @@ Handle<WasmModuleObject> WasmModuleObject::New(
   Handle<WeakCell> link_to_module =
       isolate->factory()->NewWeakCell(module_object);
   compiled_module->set_weak_wasm_module(*link_to_module);
+
+  compiled_module->LogWasmCodes(isolate);
   return module_object;
 }
 
@@ -248,133 +242,103 @@ void WasmTableObject::AddDispatchTable(Isolate* isolate,
 }
 
 void WasmTableObject::Grow(Isolate* isolate, uint32_t count) {
-  // TODO(6792): No longer needed once WebAssembly code is off heap.
-  CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
+  if (count == 0) return;  // Degenerate case: nothing to do.
+
   Handle<FixedArray> dispatch_tables(this->dispatch_tables());
   DCHECK_EQ(0, dispatch_tables->length() % kDispatchTableNumElements);
   uint32_t old_size = functions()->length();
+  constexpr int kInvalidSigIndex = -1;
 
-  Zone specialization_zone(isolate->allocator(), ZONE_NAME);
+  // The tables are stored in the WASM context, no code patching is
+  // necessary. We simply have to grow the raw tables in the WasmContext
+  // for each instance that has imported this table.
+
+  // TODO(titzer): replace the dispatch table with a weak list of all
+  // the instances that import a given table.
   for (int i = 0; i < dispatch_tables->length();
        i += kDispatchTableNumElements) {
-    Handle<FixedArray> old_function_table(FixedArray::cast(
-        dispatch_tables->get(i + kDispatchTableFunctionTableOffset)));
-    Handle<FixedArray> new_function_table = isolate->global_handles()->Create(
-        *isolate->factory()->CopyFixedArrayAndGrow(
-            old_function_table, count * compiler::kFunctionTableEntrySize));
-
-    GlobalHandleAddress new_function_table_addr = new_function_table.address();
-
-    int table_index =
-        Smi::cast(dispatch_tables->get(i + kDispatchTableIndexOffset))->value();
-    // Update dispatch tables with new function tables.
-    dispatch_tables->set(i + kDispatchTableFunctionTableOffset,
-                         *new_function_table);
-
-    // Patch the code of the respective instance.
-    if (FLAG_wasm_jit_to_native) {
-      DisallowHeapAllocation no_gc;
-      wasm::CodeSpecialization code_specialization(isolate,
-                                                   &specialization_zone);
-      WasmInstanceObject* instance =
-          WasmInstanceObject::cast(dispatch_tables->get(i));
-      WasmCompiledModule* compiled_module = instance->compiled_module();
-      wasm::NativeModule* native_module = compiled_module->GetNativeModule();
-      wasm::NativeModuleModificationScope native_module_modification_scope(
-          native_module);
-      GlobalHandleAddress old_function_table_addr =
-          native_module->function_tables()[table_index];
-      code_specialization.PatchTableSize(old_size, old_size + count);
-      code_specialization.RelocatePointer(old_function_table_addr,
-                                          new_function_table_addr);
-      code_specialization.ApplyToWholeInstance(instance);
-      native_module->function_tables()[table_index] = new_function_table_addr;
-    } else {
-      DisallowHeapAllocation no_gc;
-      wasm::CodeSpecialization code_specialization(isolate,
-                                                   &specialization_zone);
-      WasmInstanceObject* instance =
-          WasmInstanceObject::cast(dispatch_tables->get(i));
-      WasmCompiledModule* compiled_module = instance->compiled_module();
-      GlobalHandleAddress old_function_table_addr =
-          WasmCompiledModule::GetTableValue(compiled_module->function_tables(),
-                                            table_index);
-      code_specialization.PatchTableSize(old_size, old_size + count);
-      code_specialization.RelocatePointer(old_function_table_addr,
-                                          new_function_table_addr);
-      code_specialization.ApplyToWholeInstance(instance);
-      WasmCompiledModule::UpdateTableValue(compiled_module->function_tables(),
-                                           table_index,
-                                           new_function_table_addr);
+    // TODO(titzer): potentially racy update of WasmContext::table
+    WasmContext* wasm_context =
+        WasmInstanceObject::cast(dispatch_tables->get(i))
+            ->wasm_context()
+            ->get();
+    DCHECK_EQ(old_size, wasm_context->table_size);
+    uint32_t new_size = old_size + count;
+    wasm_context->table = reinterpret_cast<IndirectFunctionTableEntry*>(realloc(
+        wasm_context->table, new_size * sizeof(IndirectFunctionTableEntry)));
+    for (uint32_t j = old_size; j < new_size; j++) {
+      wasm_context->table[j].sig_id = kInvalidSigIndex;
+      wasm_context->table[j].context = nullptr;
+      wasm_context->table[j].target = nullptr;
     }
+    wasm_context->table_size = new_size;
   }
 }
 
 void WasmTableObject::Set(Isolate* isolate, Handle<WasmTableObject> table,
-                          int32_t index, Handle<JSFunction> function) {
+                          int32_t table_index, Handle<JSFunction> function) {
   Handle<FixedArray> array(table->functions(), isolate);
+  if (function.is_null()) {
+    ClearDispatchTables(table, table_index);  // Degenerate case of null value.
+    array->set(table_index, isolate->heap()->null_value());
+    return;
+  }
+
+  // TODO(titzer): Change this to MaybeHandle<WasmExportedFunction>
+  auto exported_function = Handle<WasmExportedFunction>::cast(function);
+  auto* wasm_function = wasm::GetWasmFunctionForExport(isolate, function);
+  DCHECK_NOT_NULL(wasm_function);
+  DCHECK_NOT_NULL(wasm_function->sig);
+  wasm::WasmCode* wasm_code = exported_function->GetWasmCode();
+  UpdateDispatchTables(isolate, table, table_index, wasm_function->sig,
+                       handle(exported_function->instance()), wasm_code,
+                       exported_function->function_index());
+  array->set(table_index, *function);
+}
+
+void WasmTableObject::UpdateDispatchTables(
+    Isolate* isolate, Handle<WasmTableObject> table, int table_index,
+    wasm::FunctionSig* sig, Handle<WasmInstanceObject> from_instance,
+    wasm::WasmCode* wasm_code, int func_index) {
+  // We simply need to update the WASM contexts for each instance
+  // that imports this table.
+  DisallowHeapAllocation no_gc;
+  FixedArray* dispatch_tables = table->dispatch_tables();
+  DCHECK_EQ(0, dispatch_tables->length() % kDispatchTableNumElements);
 
-  Handle<FixedArray> dispatch_tables(table->dispatch_tables(), isolate);
-
-  wasm::FunctionSig* sig = nullptr;
-  Handle<Object> code = Handle<Object>::null();
-  Handle<Object> value = isolate->factory()->null_value();
-
-  if (!function.is_null()) {
-    auto exported_function = Handle<WasmExportedFunction>::cast(function);
-    auto* wasm_function = wasm::GetWasmFunctionForExport(isolate, function);
-    // The verification that {function} is an export was done
-    // by the caller.
-    DCHECK(wasm_function != nullptr && wasm_function->sig != nullptr);
-    sig = wasm_function->sig;
-    value = function;
-    // TODO(titzer): Make JSToWasm wrappers just call the WASM to WASM wrapper,
-    // and then we can just reuse the WASM to WASM wrapper.
-    WasmCodeWrapper wasm_code = exported_function->GetWasmCode();
-    wasm::NativeModule* native_module =
-        wasm_code.IsCodeObject() ? nullptr : wasm_code.GetWasmCode()->owner();
-    CodeSpaceMemoryModificationScope gc_modification_scope(isolate->heap());
-    wasm::NativeModuleModificationScope native_modification_scope(
-        native_module);
-    code = wasm::GetOrCreateIndirectCallWrapper(
-        isolate, handle(exported_function->instance()), wasm_code,
-        exported_function->function_index(), sig);
+  for (int i = 0; i < dispatch_tables->length();
+       i += kDispatchTableNumElements) {
+    // Note that {SignatureMap::Find} may return {-1} if the signature is
+    // not found; it will simply never match any check.
+    WasmInstanceObject* to_instance = WasmInstanceObject::cast(
+        dispatch_tables->get(i + kDispatchTableInstanceOffset));
+    auto sig_id = to_instance->module()->signature_map.Find(sig);
+    auto& entry = to_instance->wasm_context()->get()->table[table_index];
+    entry.sig_id = sig_id;
+    entry.context = from_instance->wasm_context()->get();
+    entry.target = wasm_code->instructions().start();
   }
-  UpdateDispatchTables(table, index, sig, code);
-  array->set(index, *value);
 }
 
-void WasmTableObject::UpdateDispatchTables(Handle<WasmTableObject> table,
-                                           int index, wasm::FunctionSig* sig,
-                                           Handle<Object> code_or_foreign) {
+void WasmTableObject::ClearDispatchTables(Handle<WasmTableObject> table,
+                                          int index) {
   DisallowHeapAllocation no_gc;
   FixedArray* dispatch_tables = table->dispatch_tables();
   DCHECK_EQ(0, dispatch_tables->length() % kDispatchTableNumElements);
   for (int i = 0; i < dispatch_tables->length();
        i += kDispatchTableNumElements) {
-    FixedArray* function_table = FixedArray::cast(
-        dispatch_tables->get(i + kDispatchTableFunctionTableOffset));
-    Smi* sig_smi = Smi::FromInt(-1);
-    Object* code = Smi::kZero;
-    if (sig) {
-      DCHECK(code_or_foreign->IsCode() || code_or_foreign->IsForeign());
-      WasmInstanceObject* instance = WasmInstanceObject::cast(
-          dispatch_tables->get(i + kDispatchTableInstanceOffset));
-      // Note that {SignatureMap::Find} may return {-1} if the signature is
-      // not found; it will simply never match any check.
-      auto sig_index = instance->module()->signature_map.Find(sig);
-      sig_smi = Smi::FromInt(sig_index);
-      code = *code_or_foreign;
-    } else {
-      DCHECK(code_or_foreign.is_null());
-    }
-    function_table->set(compiler::FunctionTableSigOffset(index), sig_smi);
-    function_table->set(compiler::FunctionTableCodeOffset(index), code);
+    constexpr int kInvalidSigIndex = -1;  // TODO(titzer): move to header.
+    WasmInstanceObject* to_instance = WasmInstanceObject::cast(
+        dispatch_tables->get(i + kDispatchTableInstanceOffset));
+    DCHECK_LT(index, to_instance->wasm_context()->get()->table_size);
+    auto& entry = to_instance->wasm_context()->get()->table[index];
+    entry.sig_id = kInvalidSigIndex;
+    entry.context = nullptr;
+    entry.target = nullptr;
   }
 }
 
 namespace {
-
 Handle<JSArrayBuffer> GrowMemoryBuffer(Isolate* isolate,
                                        Handle<JSArrayBuffer> old_buffer,
                                        uint32_t pages, uint32_t maximum_pages,
@@ -393,56 +357,50 @@ Handle<JSArrayBuffer> GrowMemoryBuffer(Isolate* isolate,
   if (old_pages > maximum_pages || pages > maximum_pages - old_pages) {
     return Handle<JSArrayBuffer>::null();
   }
-  const bool enable_guard_regions =
-      old_buffer.is_null() ? use_trap_handler : old_buffer->has_guard_region();
   size_t new_size =
       static_cast<size_t>(old_pages + pages) * wasm::kWasmPageSize;
   if (new_size > FLAG_wasm_max_mem_pages * wasm::kWasmPageSize ||
       new_size > kMaxInt) {
     return Handle<JSArrayBuffer>::null();
   }
-  if ((enable_guard_regions || old_size == new_size) && old_size != 0) {
+  // Reusing the backing store from externalized buffers causes problems with
+  // Blink's array buffers. The connection between the two is lost, which can
+  // lead to Blink not knowing about the other reference to the buffer and
+  // freeing it too early.
+  if (!old_buffer->is_external() && old_size != 0 &&
+      ((new_size < old_buffer->allocation_length()) || old_size == new_size)) {
     DCHECK_NOT_NULL(old_buffer->backing_store());
     if (old_size != new_size) {
-      isolate->array_buffer_allocator()->SetProtection(
-          old_mem_start, new_size,
-          v8::ArrayBuffer::Allocator::Protection::kReadWrite);
+      // If adjusting permissions fails, propagate error back to return
+      // failure to grow.
+      DCHECK(!isolate->wasm_engine()->memory_tracker()->IsEmptyBackingStore(
+          old_mem_start));
+      if (!i::SetPermissions(old_mem_start, new_size,
+                             PageAllocator::kReadWrite)) {
+        return Handle<JSArrayBuffer>::null();
+      }
       reinterpret_cast<v8::Isolate*>(isolate)
           ->AdjustAmountOfExternalAllocatedMemory(pages * wasm::kWasmPageSize);
     }
     // NOTE: We must allocate a new array buffer here because the spec
     // assumes that ArrayBuffers do not change size.
-    void* allocation_base = old_buffer->allocation_base();
-    size_t allocation_length = old_buffer->allocation_length();
     void* backing_store = old_buffer->backing_store();
-    bool has_guard_region = old_buffer->has_guard_region();
     bool is_external = old_buffer->is_external();
     // Disconnect buffer early so GC won't free it.
     i::wasm::DetachMemoryBuffer(isolate, old_buffer, false);
-    Handle<JSArrayBuffer> new_buffer = wasm::SetupArrayBuffer(
-        isolate, allocation_base, allocation_length, backing_store, new_size,
-        is_external, has_guard_region);
+    Handle<JSArrayBuffer> new_buffer =
+        wasm::SetupArrayBuffer(isolate, backing_store, new_size, is_external);
     return new_buffer;
   } else {
-    bool free_memory = false;
+    // We couldn't reuse the old backing store, so create a new one and copy the
+    // old contents in.
     Handle<JSArrayBuffer> new_buffer;
-    if (pages != 0) {
-      // Allocate a new buffer and memcpy the old contents.
-      free_memory = true;
-      new_buffer =
-          wasm::NewArrayBuffer(isolate, new_size, enable_guard_regions);
-      if (new_buffer.is_null() || old_size == 0) return new_buffer;
-      Address new_mem_start = static_cast<Address>(new_buffer->backing_store());
-      memcpy(new_mem_start, old_mem_start, old_size);
-      DCHECK(old_buffer.is_null() || !old_buffer->is_shared());
-      DCHECK(old_buffer.is_null() || !old_buffer->has_guard_region());
-    } else {
-      // Reuse the prior backing store, but allocate a new array buffer.
-      new_buffer = wasm::SetupArrayBuffer(
-          isolate, old_buffer->allocation_base(),
-          old_buffer->allocation_length(), old_buffer->backing_store(),
-          new_size, old_buffer->is_external(), old_buffer->has_guard_region());
-    }
+    new_buffer = wasm::NewArrayBuffer(isolate, new_size, use_trap_handler);
+    if (new_buffer.is_null() || old_size == 0) return new_buffer;
+    Address new_mem_start = static_cast<Address>(new_buffer->backing_store());
+    memcpy(new_mem_start, old_mem_start, old_size);
+    DCHECK(old_buffer.is_null() || !old_buffer->is_shared());
+    constexpr bool free_memory = true;
     i::wasm::DetachMemoryBuffer(isolate, old_buffer, free_memory);
     return new_buffer;
   }
@@ -482,11 +440,7 @@ Handle<WasmMemoryObject> WasmMemoryObject::New(
   Handle<JSArrayBuffer> buffer;
   if (maybe_buffer.is_null()) {
     // If no buffer was provided, create a 0-length one.
-
-    // TODO(kschimpf): Modify to use argument defining style of
-    // memory.  (see above).
-    buffer = wasm::SetupArrayBuffer(isolate, nullptr, 0, nullptr, 0, false,
-                                    trap_handler::IsTrapHandlerEnabled());
+    buffer = wasm::SetupArrayBuffer(isolate, nullptr, 0, false);
   } else {
     buffer = maybe_buffer.ToHandleChecked();
     // Paranoid check that the buffer size makes sense.
@@ -508,12 +462,12 @@ uint32_t WasmMemoryObject::current_pages() {
 void WasmMemoryObject::AddInstance(Isolate* isolate,
                                    Handle<WasmMemoryObject> memory,
                                    Handle<WasmInstanceObject> instance) {
-  Handle<WeakFixedArray> old_instances =
+  Handle<FixedArrayOfWeakCells> old_instances =
       memory->has_instances()
-          ? Handle<WeakFixedArray>(memory->instances(), isolate)
-          : Handle<WeakFixedArray>::null();
-  Handle<WeakFixedArray> new_instances =
-      WeakFixedArray::Add(old_instances, instance);
+          ? Handle<FixedArrayOfWeakCells>(memory->instances(), isolate)
+          : Handle<FixedArrayOfWeakCells>::null();
+  Handle<FixedArrayOfWeakCells> new_instances =
+      FixedArrayOfWeakCells::Add(old_instances, instance);
   memory->set_instances(*new_instances);
   Handle<JSArrayBuffer> buffer(memory->array_buffer(), isolate);
   SetInstanceMemory(isolate, instance, buffer);
@@ -550,7 +504,8 @@ int32_t WasmMemoryObject::Grow(Isolate* isolate,
   if (new_buffer.is_null()) return -1;
 
   if (memory_object->has_instances()) {
-    Handle<WeakFixedArray> instances(memory_object->instances(), isolate);
+    Handle<FixedArrayOfWeakCells> instances(memory_object->instances(),
+                                            isolate);
     for (int i = 0; i < instances->Length(); i++) {
       Object* elem = instances->Get(i);
       if (!elem->IsWasmInstanceObject()) continue;
@@ -563,6 +518,53 @@ int32_t WasmMemoryObject::Grow(Isolate* isolate,
   return old_size / wasm::kWasmPageSize;
 }
 
+bool WasmInstanceObject::EnsureIndirectFunctionTableWithMinimumSize(
+    size_t minimum_size) {
+  constexpr int kInvalidSigIndex = -1;
+  uintptr_t old_size = indirect_function_table_size();
+  if (old_size >= minimum_size) return false;  // Nothing to do.
+
+  size_t new_size = minimum_size;
+  IndirectFunctionTableEntry* new_storage;
+  if (indirect_function_table()) {
+    // Reallocate the old storage.
+    new_storage = reinterpret_cast<IndirectFunctionTableEntry*>(
+        realloc(indirect_function_table(),
+                new_size * sizeof(IndirectFunctionTableEntry)));
+  } else {
+    // Allocate new storage.
+    new_storage = reinterpret_cast<IndirectFunctionTableEntry*>(
+        calloc(new_size, sizeof(IndirectFunctionTableEntry)));
+  }
+  // Initialize new entries.
+  for (size_t j = old_size; j < new_size; j++) {
+    auto entry = indirect_function_table_entry_at(static_cast<int>(j));
+    entry->sig_id = kInvalidSigIndex;
+    entry->context = nullptr;
+    entry->target = nullptr;
+  }
+  set_indirect_function_table_size(new_size);
+  set_indirect_function_table(new_storage);
+  return true;
+}
+
+IndirectFunctionTableEntry*
+WasmInstanceObject::indirect_function_table_entry_at(int i) {
+  DCHECK_GE(i, 0);
+  DCHECK_LT(i, indirect_function_table_size());
+  return &indirect_function_table()[i];
+}
+
+void WasmInstanceObject::SetRawMemory(byte* mem_start, size_t mem_size) {
+  DCHECK_LE(mem_size, wasm::kV8MaxWasmMemoryPages * wasm::kWasmPageSize);
+  uint64_t mem_size64 = mem_size;
+  uint64_t mem_mask64 = base::bits::RoundUpToPowerOfTwo64(mem_size) - 1;
+  DCHECK_LE(mem_size, mem_mask64 + 1);
+  set_memory_start(mem_start);
+  set_memory_size(static_cast<uintptr_t>(mem_size64));
+  set_memory_mask(static_cast<uintptr_t>(mem_mask64));
+}
+
 WasmModuleObject* WasmInstanceObject::module_object() {
   return compiled_module()->wasm_module();
 }
@@ -595,15 +597,19 @@ Handle<WasmInstanceObject> WasmInstanceObject::New(
   instance->set_wasm_context(*wasm_context);
 
   instance->set_compiled_module(*compiled_module);
-  return instance;
-}
 
-int32_t WasmInstanceObject::GrowMemory(Isolate* isolate,
-                                       Handle<WasmInstanceObject> instance,
-                                       uint32_t pages) {
-  DCHECK(instance->has_memory_object());
-  return WasmMemoryObject::Grow(
-      isolate, handle(instance->memory_object(), isolate), pages);
+  // TODO(titzer): ensure that untagged fields are not visited by the GC.
+  // (if they are, the GC will crash).
+  uintptr_t invalid = static_cast<uintptr_t>(kHeapObjectTag);
+  instance->set_memory_start(reinterpret_cast<byte*>(invalid));
+  instance->set_memory_size(invalid);
+  instance->set_memory_mask(invalid);
+  instance->set_globals_start(reinterpret_cast<byte*>(invalid));
+  instance->set_indirect_function_table(
+      reinterpret_cast<IndirectFunctionTableEntry*>(invalid));
+  instance->set_indirect_function_table_size(invalid);
+
+  return instance;
 }
 
 WasmInstanceObject* WasmInstanceObject::GetOwningInstance(
@@ -612,21 +618,7 @@ WasmInstanceObject* WasmInstanceObject::GetOwningInstance(
   Object* weak_link = nullptr;
   DCHECK(code->kind() == wasm::WasmCode::kFunction ||
          code->kind() == wasm::WasmCode::kInterpreterStub);
-  weak_link = code->owner()->compiled_module()->weak_owning_instance();
-  DCHECK(weak_link->IsWeakCell());
-  WeakCell* cell = WeakCell::cast(weak_link);
-  if (cell->cleared()) return nullptr;
-  return WasmInstanceObject::cast(cell->value());
-}
-
-WasmInstanceObject* WasmInstanceObject::GetOwningInstanceGC(Code* code) {
-  DisallowHeapAllocation no_gc;
-  DCHECK(code->kind() == Code::WASM_FUNCTION ||
-         code->kind() == Code::WASM_INTERPRETER_ENTRY);
-  FixedArray* deopt_data = code->deoptimization_data();
-  DCHECK_EQ(code->kind() == Code::WASM_INTERPRETER_ENTRY ? 1 : 2,
-            deopt_data->length());
-  Object* weak_link = deopt_data->get(0);
+  weak_link = code->native_module()->compiled_module()->weak_owning_instance();
   DCHECK(weak_link->IsWeakCell());
   WeakCell* cell = WeakCell::cast(weak_link);
   if (cell->cleared()) return nullptr;
@@ -667,18 +659,95 @@ void WasmInstanceObject::ValidateOrphanedInstanceForTesting(
   CHECK(compiled_module->weak_wasm_module()->cleared());
 }
 
+namespace {
+void InstanceFinalizer(const v8::WeakCallbackInfo<void>& data) {
+  DisallowHeapAllocation no_gc;
+  JSObject** p = reinterpret_cast<JSObject**>(data.GetParameter());
+  WasmInstanceObject* instance = reinterpret_cast<WasmInstanceObject*>(*p);
+  Isolate* isolate = reinterpret_cast<Isolate*>(data.GetIsolate());
+  // If a link to shared memory instances exists, update the list of memory
+  // instances before the instance is destroyed.
+  WasmCompiledModule* compiled_module = instance->compiled_module();
+  wasm::NativeModule* native_module = compiled_module->GetNativeModule();
+  if (native_module) {
+    TRACE("Finalizing %zu {\n", native_module->instance_id);
+  } else {
+    TRACE("Finalized already cleaned up compiled module\n");
+  }
+  WeakCell* weak_wasm_module = compiled_module->weak_wasm_module();
+
+  // Since the order of finalizers is not guaranteed, it can be the case
+  // that {instance->compiled_module()->module()}, which is a
+  // {Managed<WasmModule>} has been collected earlier in this GC cycle.
+  // Weak references to this instance won't be cleared until
+  // the next GC cycle, so we need to manually break some links (such as
+  // the weak references from {WasmMemoryObject::instances}.
+  if (instance->has_memory_object()) {
+    WasmMemoryObject::RemoveInstance(isolate, handle(instance->memory_object()),
+                                     handle(instance));
+  }
+
+  // weak_wasm_module may have been cleared, meaning the module object
+  // was GC-ed. We still want to maintain the links between instances, to
+  // release the WasmCompiledModule corresponding to the WasmModuleInstance
+  // being finalized here.
+  WasmModuleObject* wasm_module = nullptr;
+  if (!weak_wasm_module->cleared()) {
+    wasm_module = WasmModuleObject::cast(weak_wasm_module->value());
+    WasmCompiledModule* current_template = wasm_module->compiled_module();
+
+    DCHECK(!current_template->has_prev_instance());
+    if (current_template == compiled_module) {
+      if (!compiled_module->has_next_instance()) {
+        WasmCompiledModule::Reset(isolate, compiled_module);
+      } else {
+        WasmModuleObject::cast(wasm_module)
+            ->set_compiled_module(compiled_module->next_instance());
+      }
+    }
+  }
+
+  void* invalid =
+      reinterpret_cast<void*>(static_cast<uintptr_t>(kHeapObjectTag));
+  if (instance->indirect_function_table() &&
+      instance->indirect_function_table() != invalid) {
+    // The indirect function table is C++ memory and needs to be explicitly
+    // freed.
+    free(instance->indirect_function_table());
+  }
+
+  compiled_module->RemoveFromChain();
+
+  compiled_module->reset_weak_owning_instance();
+  GlobalHandles::Destroy(reinterpret_cast<Object**>(p));
+  TRACE("}\n");
+}
+
+}  // namespace
+
+void WasmInstanceObject::InstallFinalizer(Isolate* isolate,
+                                          Handle<WasmInstanceObject> instance) {
+  Handle<Object> global_handle = isolate->global_handles()->Create(*instance);
+  GlobalHandles::MakeWeak(global_handle.location(), global_handle.location(),
+                          InstanceFinalizer, v8::WeakCallbackType::kFinalizer);
+}
+
 bool WasmExportedFunction::IsWasmExportedFunction(Object* object) {
   if (!object->IsJSFunction()) return false;
   Handle<JSFunction> js_function(JSFunction::cast(object));
   if (Code::JS_TO_WASM_FUNCTION != js_function->code()->kind()) return false;
 
+#ifdef DEBUG
+  // Any function having code of {JS_TO_WASM_FUNCTION} kind must be an exported
+  // function and hence will have a property holding the instance object.
   Handle<Symbol> symbol(
       js_function->GetIsolate()->factory()->wasm_instance_symbol());
-  MaybeHandle<Object> maybe_result =
+  MaybeHandle<Object> result =
       JSObject::GetPropertyOrElement(js_function, symbol);
-  Handle<Object> result;
-  if (!maybe_result.ToHandle(&result)) return false;
-  return result->IsWasmInstanceObject();
+  DCHECK(result.ToHandleChecked()->IsWasmInstanceObject());
+#endif
+
+  return true;
 }
 
 WasmExportedFunction* WasmExportedFunction::cast(Object* object) {
@@ -716,15 +785,15 @@ Handle<WasmExportedFunction> WasmExportedFunction::New(
                    Vector<uint8_t>::cast(buffer.SubVector(0, length)))
                .ToHandleChecked();
   }
-  Handle<SharedFunctionInfo> shared =
-      isolate->factory()->NewSharedFunctionInfo(name, export_wrapper, false);
-  shared->set_length(arity);
-  shared->set_internal_formal_parameter_count(arity);
   NewFunctionArgs args = NewFunctionArgs::ForWasm(
-      name, export_wrapper, isolate->sloppy_function_map());
+      name, export_wrapper, isolate->sloppy_function_without_prototype_map());
   Handle<JSFunction> js_function = isolate->factory()->NewFunction(args);
+  // According to the spec, exported functions should not have a [[Construct]]
+  // method.
+  DCHECK(!js_function->IsConstructor());
+  js_function->shared()->set_length(arity);
+  js_function->shared()->set_internal_formal_parameter_count(arity);
 
-  js_function->set_shared(*shared);
   Handle<Symbol> instance_symbol(isolate->factory()->wasm_instance_symbol());
   JSObject::AddProperty(js_function, instance_symbol, instance, DONT_ENUM);
 
@@ -736,103 +805,51 @@ Handle<WasmExportedFunction> WasmExportedFunction::New(
   return Handle<WasmExportedFunction>::cast(js_function);
 }
 
-WasmCodeWrapper WasmExportedFunction::GetWasmCode() {
+wasm::WasmCode* WasmExportedFunction::GetWasmCode() {
   DisallowHeapAllocation no_gc;
   Handle<Code> export_wrapper_code = handle(this->code());
   DCHECK_EQ(export_wrapper_code->kind(), Code::JS_TO_WASM_FUNCTION);
-  int mask =
-      RelocInfo::ModeMask(FLAG_wasm_jit_to_native ? RelocInfo::JS_TO_WASM_CALL
-                                                  : RelocInfo::CODE_TARGET);
-  auto IsWasmFunctionCode = [](Code* code) {
-    return code->kind() == Code::WASM_FUNCTION ||
-           code->kind() == Code::WASM_TO_JS_FUNCTION ||
-           code->kind() == Code::WASM_TO_WASM_FUNCTION ||
-           code->kind() == Code::WASM_INTERPRETER_ENTRY ||
-           code->builtin_index() == Builtins::kWasmCompileLazy;
-  };
-
-  for (RelocIterator it(*export_wrapper_code, mask);; it.next()) {
-    DCHECK(!it.done());
-    WasmCodeWrapper target;
-    if (FLAG_wasm_jit_to_native) {
-      target = WasmCodeWrapper(
-          GetIsolate()->wasm_engine()->code_manager()->LookupCode(
-              it.rinfo()->js_to_wasm_address()));
-    } else {
-      Code* code = Code::GetCodeFromTargetAddress(it.rinfo()->target_address());
-      if (!IsWasmFunctionCode(code)) continue;
-      target = WasmCodeWrapper(handle(code));
-    }
-// There should only be this one call to wasm code.
+  int mask = RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL);
+  RelocIterator it(*export_wrapper_code, mask);
+  DCHECK(!it.done());
+  wasm::WasmCode* target =
+      GetIsolate()->wasm_engine()->code_manager()->LookupCode(
+          it.rinfo()->js_to_wasm_address());
 #ifdef DEBUG
-    for (it.next(); !it.done(); it.next()) {
-      if (FLAG_wasm_jit_to_native) {
-        UNREACHABLE();
-      } else {
-        Code* code =
-            Code::GetCodeFromTargetAddress(it.rinfo()->target_address());
-        DCHECK(!IsWasmFunctionCode(code));
-      }
-    }
+  // There should only be this one call to wasm code.
+  it.next();
+  DCHECK(it.done());
 #endif
-    return target;
-  }
-  UNREACHABLE();
+  return target;
 }
 
-bool WasmSharedModuleData::IsWasmSharedModuleData(Object* object) {
-  if (!object->IsFixedArray()) return false;
-  FixedArray* arr = FixedArray::cast(object);
-  if (arr->length() != kFieldCount) return false;
-  Isolate* isolate = arr->GetIsolate();
-  if (!arr->get(kModuleWrapperIndex)->IsForeign()) return false;
-  if (!arr->get(kModuleBytesIndex)->IsUndefined(isolate) &&
-      !arr->get(kModuleBytesIndex)->IsSeqOneByteString())
-    return false;
-  if (!arr->get(kScriptIndex)->IsScript()) return false;
-  if (!arr->get(kAsmJsOffsetTableIndex)->IsUndefined(isolate) &&
-      !arr->get(kAsmJsOffsetTableIndex)->IsByteArray())
-    return false;
-  if (!arr->get(kBreakPointInfosIndex)->IsUndefined(isolate) &&
-      !arr->get(kBreakPointInfosIndex)->IsFixedArray())
-    return false;
-  return true;
-}
-
-WasmSharedModuleData* WasmSharedModuleData::cast(Object* object) {
-  DCHECK(IsWasmSharedModuleData(object));
-  return reinterpret_cast<WasmSharedModuleData*>(object);
-}
-
-WasmModule* WasmSharedModuleData::module() {
+WasmModule* WasmSharedModuleData::module() const {
   // We populate the kModuleWrapper field with a Foreign holding the
   // address to the address of a WasmModule. This is because we can
   // handle both cases when the WasmModule's lifetime is managed through
   // a Managed<WasmModule> object, as well as cases when it's managed
   // by the embedder. CcTests fall into the latter case.
   return *(reinterpret_cast<WasmModule**>(
-      Foreign::cast(get(kModuleWrapperIndex))->foreign_address()));
+      Foreign::cast(module_wrapper())->foreign_address()));
 }
 
 Handle<WasmSharedModuleData> WasmSharedModuleData::New(
     Isolate* isolate, Handle<Foreign> module_wrapper,
     Handle<SeqOneByteString> module_bytes, Handle<Script> script,
     Handle<ByteArray> asm_js_offset_table) {
-  Handle<FixedArray> arr =
-      isolate->factory()->NewFixedArray(kFieldCount, TENURED);
-  arr->set(kModuleWrapperIndex, *module_wrapper);
+  Handle<WasmSharedModuleData> data = Handle<WasmSharedModuleData>::cast(
+      isolate->factory()->NewStruct(WASM_SHARED_MODULE_DATA_TYPE, TENURED));
+  data->set_module_wrapper(*module_wrapper);
   if (!module_bytes.is_null()) {
-    arr->set(kModuleBytesIndex, *module_bytes);
+    data->set_module_bytes(*module_bytes);
   }
   if (!script.is_null()) {
-    arr->set(kScriptIndex, *script);
+    data->set_script(*script);
   }
   if (!asm_js_offset_table.is_null()) {
-    arr->set(kAsmJsOffsetTableIndex, *asm_js_offset_table);
+    data->set_asm_js_offset_table(*asm_js_offset_table);
   }
-
-  DCHECK(WasmSharedModuleData::IsWasmSharedModuleData(*arr));
-  return Handle<WasmSharedModuleData>::cast(arr);
+  return data;
 }
 
 bool WasmSharedModuleData::is_asm_js() {
@@ -842,47 +859,6 @@ bool WasmSharedModuleData::is_asm_js() {
   return asm_js;
 }
 
-void WasmSharedModuleData::ReinitializeAfterDeserialization(
-    Isolate* isolate, Handle<WasmSharedModuleData> shared) {
-  DCHECK(shared->get(kModuleWrapperIndex)->IsUndefined(isolate));
-#ifdef DEBUG
-  // No BreakpointInfo objects should survive deserialization.
-  if (shared->has_breakpoint_infos()) {
-    for (int i = 0, e = shared->breakpoint_infos()->length(); i < e; ++i) {
-      DCHECK(shared->breakpoint_infos()->get(i)->IsUndefined(isolate));
-    }
-  }
-#endif
-
-  shared->set(kBreakPointInfosIndex, isolate->heap()->undefined_value());
-
-  WasmModule* module = nullptr;
-  {
-    // We parse the module again directly from the module bytes, so
-    // the underlying storage must not be moved meanwhile.
-    DisallowHeapAllocation no_allocation;
-    SeqOneByteString* module_bytes = shared->module_bytes();
-    const byte* start =
-        reinterpret_cast<const byte*>(module_bytes->GetCharsAddress());
-    const byte* end = start + module_bytes->length();
-    // TODO(titzer): remember the module origin in the compiled_module
-    // For now, we assume serialized modules did not originate from asm.js.
-    wasm::ModuleResult result =
-        SyncDecodeWasmModule(isolate, start, end, false, wasm::kWasmOrigin);
-    CHECK(result.ok());
-    CHECK_NOT_NULL(result.val);
-    // Take ownership of the WasmModule and immediately transfer it to the
-    // WasmModuleWrapper below.
-    module = result.val.release();
-  }
-
-  Handle<wasm::WasmModuleWrapper> module_wrapper =
-      wasm::WasmModuleWrapper::From(isolate, module);
-
-  shared->set(kModuleWrapperIndex, *module_wrapper);
-  DCHECK(WasmSharedModuleData::IsWasmSharedModuleData(*shared));
-}
-
 namespace {
 
 int GetBreakpointPos(Isolate* isolate, Object* break_point_info_or_undef) {
@@ -917,14 +893,14 @@ int FindBreakpointInfoInsertPos(Isolate* isolate,
 
 void WasmSharedModuleData::AddBreakpoint(Handle<WasmSharedModuleData> shared,
                                          int position,
-                                         Handle<Object> break_point_object) {
+                                         Handle<BreakPoint> break_point) {
   Isolate* isolate = shared->GetIsolate();
   Handle<FixedArray> breakpoint_infos;
   if (shared->has_breakpoint_infos()) {
     breakpoint_infos = handle(shared->breakpoint_infos(), isolate);
   } else {
     breakpoint_infos = isolate->factory()->NewFixedArray(4, TENURED);
-    shared->set(kBreakPointInfosIndex, *breakpoint_infos);
+    shared->set_breakpoint_infos(*breakpoint_infos);
   }
 
   int insert_pos =
@@ -937,7 +913,7 @@ void WasmSharedModuleData::AddBreakpoint(Handle<WasmSharedModuleData> shared,
           position) {
     Handle<BreakPointInfo> old_info(
         BreakPointInfo::cast(breakpoint_infos->get(insert_pos)), isolate);
-    BreakPointInfo::SetBreakPoint(old_info, break_point_object);
+    BreakPointInfo::SetBreakPoint(old_info, break_point);
     return;
   }
 
@@ -948,7 +924,7 @@ void WasmSharedModuleData::AddBreakpoint(Handle<WasmSharedModuleData> shared,
   if (need_realloc) {
     new_breakpoint_infos = isolate->factory()->NewFixedArray(
         2 * breakpoint_infos->length(), TENURED);
-    shared->set(kBreakPointInfosIndex, *new_breakpoint_infos);
+    shared->set_breakpoint_infos(*new_breakpoint_infos);
     // Copy over the entries [0, insert_pos).
     for (int i = 0; i < insert_pos; ++i)
       new_breakpoint_infos->set(i, breakpoint_infos->get(i));
@@ -964,7 +940,7 @@ void WasmSharedModuleData::AddBreakpoint(Handle<WasmSharedModuleData> shared,
   // Generate new BreakpointInfo.
   Handle<BreakPointInfo> breakpoint_info =
       isolate->factory()->NewBreakPointInfo(position);
-  BreakPointInfo::SetBreakPoint(breakpoint_info, break_point_object);
+  BreakPointInfo::SetBreakPoint(breakpoint_info, break_point);
 
   // Now insert new position at insert_pos.
   new_breakpoint_infos->set(insert_pos, *breakpoint_info);
@@ -1005,6 +981,7 @@ void WasmSharedModuleData::PrepareForLazyCompilation(
     Handle<WasmSharedModuleData> shared) {
   if (shared->has_lazy_compilation_orchestrator()) return;
   Isolate* isolate = shared->GetIsolate();
+  // TODO(titzer): remove dependency on module-compiler.h
   auto orch_handle =
       Managed<wasm::LazyCompilationOrchestrator>::Allocate(isolate);
   shared->set_lazy_compilation_orchestrator(*orch_handle);
@@ -1235,85 +1212,41 @@ MaybeHandle<FixedArray> WasmSharedModuleData::CheckBreakPoints(
       Handle<BreakPointInfo>::cast(maybe_breakpoint_info);
   if (breakpoint_info->source_position() != position) return {};
 
-  Handle<Object> breakpoint_objects(breakpoint_info->break_point_objects(),
-                                    isolate);
-  return isolate->debug()->GetHitBreakPointObjects(breakpoint_objects);
+  // There is no support for conditional break points. Just assume that every
+  // break point always hits.
+  Handle<Object> break_points(breakpoint_info->break_points(), isolate);
+  if (break_points->IsFixedArray()) {
+    return Handle<FixedArray>::cast(break_points);
+  }
+  Handle<FixedArray> break_points_hit = isolate->factory()->NewFixedArray(1);
+  break_points_hit->set(0, *break_points);
+  return break_points_hit;
 }
 
 Handle<WasmCompiledModule> WasmCompiledModule::New(
-    Isolate* isolate, WasmModule* module, Handle<FixedArray> code_table,
-    Handle<FixedArray> export_wrappers,
+    Isolate* isolate, WasmModule* module, Handle<FixedArray> export_wrappers,
     const std::vector<GlobalHandleAddress>& function_tables,
     bool use_trap_handler) {
-  Handle<FixedArray> ret =
-      isolate->factory()->NewFixedArray(PropertyIndices::Count, TENURED);
-  // WasmCompiledModule::cast would fail since fields are not set yet.
-  Handle<WasmCompiledModule> compiled_module(
-      reinterpret_cast<WasmCompiledModule*>(*ret), isolate);
+  Handle<WasmCompiledModule> compiled_module = Handle<WasmCompiledModule>::cast(
+      isolate->factory()->NewStruct(WASM_COMPILED_MODULE_TYPE, TENURED));
   Handle<WeakCell> weak_native_context =
       isolate->factory()->NewWeakCell(isolate->native_context());
   compiled_module->set_weak_native_context(*weak_native_context);
   compiled_module->set_use_trap_handler(use_trap_handler);
-  if (!FLAG_wasm_jit_to_native) {
-    compiled_module->InitId();
-    compiled_module->set_code_table(*code_table);
+  if (!export_wrappers.is_null()) {
     compiled_module->set_export_wrappers(*export_wrappers);
-    // TODO(mtrofin): we copy these because the order of finalization isn't
-    // reliable, and we need these at Reset (which is called at
-    // finalization). If the order were reliable, and top-down, we could instead
-    // just get them from shared().
-    compiled_module->set_num_imported_functions(module->num_imported_functions);
-
-    int num_function_tables = static_cast<int>(function_tables.size());
-    if (num_function_tables > 0) {
-      Handle<FixedArray> ft =
-          isolate->factory()->NewFixedArray(num_function_tables, TENURED);
-      for (int i = 0; i < num_function_tables; ++i) {
-        SetTableValue(isolate, ft, i, function_tables[i]);
-      }
-      // TODO(wasm): setting the empty tables here this way is OK under the
-      // assumption that we compile and then instantiate. It needs rework if we
-      // do direct instantiation. The empty tables are used as a default when
-      // resetting the compiled module.
-      compiled_module->set_function_tables(*ft);
-      compiled_module->set_empty_function_tables(*ft);
-    }
-  } else {
-    if (!export_wrappers.is_null()) {
-      compiled_module->set_export_wrappers(*export_wrappers);
-    }
-    wasm::NativeModule* native_module = nullptr;
-    {
-      std::unique_ptr<wasm::NativeModule> native_module_ptr =
-          isolate->wasm_engine()->code_manager()->NewNativeModule(*module);
-      native_module = native_module_ptr.release();
-      Handle<Foreign> native_module_wrapper =
-          Managed<wasm::NativeModule>::From(isolate, native_module);
-      compiled_module->set_native_module(*native_module_wrapper);
-      Handle<WasmCompiledModule> weak_link =
-          isolate->global_handles()->Create(*compiled_module);
-      GlobalHandles::MakeWeak(Handle<Object>::cast(weak_link).location(),
-                              Handle<Object>::cast(weak_link).location(),
-                              &CompiledModuleFinalizer,
-                              v8::WeakCallbackType::kFinalizer);
-      compiled_module->GetNativeModule()->SetCompiledModule(weak_link);
-    }
-    // This is here just because it's easier for APIs that need to work with
-    // either code_table or native_module. Otherwise we need to check if
-    // has_code_table and pass undefined.
-    compiled_module->set_code_table(*code_table);
-
-    native_module->function_tables() = function_tables;
-    native_module->empty_function_tables() = function_tables;
-
-    int function_count = static_cast<int>(module->functions.size());
-    Handle<FixedArray> handler_table =
-        isolate->factory()->NewFixedArray(function_count, TENURED);
-    compiled_module->set_handler_table(*handler_table);
-    Handle<FixedArray> source_positions =
-        isolate->factory()->NewFixedArray(function_count, TENURED);
-    compiled_module->set_source_positions(*source_positions);
   }
+  wasm::NativeModule* native_module = nullptr;
+  {
+    std::unique_ptr<wasm::NativeModule> native_module_ptr =
+        isolate->wasm_engine()->code_manager()->NewNativeModule(*module);
+    native_module = native_module_ptr.release();
+    Handle<Foreign> native_module_wrapper =
+        Managed<wasm::NativeModule>::From(isolate, native_module);
+    compiled_module->set_native_module(*native_module_wrapper);
+    compiled_module->GetNativeModule()->SetCompiledModule(compiled_module);
+  }
+
   // TODO(mtrofin): copy the rest of the specialization parameters over.
   // We're currently OK because we're only using defaults.
   return compiled_module;
@@ -1322,21 +1255,21 @@ Handle<WasmCompiledModule> WasmCompiledModule::New(
 Handle<WasmCompiledModule> WasmCompiledModule::Clone(
     Isolate* isolate, Handle<WasmCompiledModule> module) {
   Handle<FixedArray> code_copy;
-  if (!FLAG_wasm_jit_to_native) {
-    code_copy = isolate->factory()->CopyFixedArray(
-        handle(module->code_table(), isolate));
-  }
   Handle<WasmCompiledModule> ret = Handle<WasmCompiledModule>::cast(
-      isolate->factory()->CopyFixedArray(module));
-  ret->reset_weak_owning_instance();
-  ret->reset_next_instance();
-  ret->reset_prev_instance();
-  ret->reset_weak_exported_functions();
-  if (!FLAG_wasm_jit_to_native) {
-    ret->InitId();
-    ret->set_code_table(*code_copy);
-    return ret;
+      isolate->factory()->NewStruct(WASM_COMPILED_MODULE_TYPE, TENURED));
+  ret->set_shared(module->shared());
+  ret->set_weak_native_context(module->weak_native_context());
+  ret->set_export_wrappers(module->export_wrappers());
+  ret->set_weak_wasm_module(module->weak_wasm_module());
+  ret->set_native_module(module->native_module());
+  if (module->has_lazy_compile_data()) {
+    ret->set_lazy_compile_data(module->lazy_compile_data());
   }
+  ret->set_use_trap_handler(module->use_trap_handler());
+
+  Handle<FixedArray> export_copy = isolate->factory()->CopyFixedArray(
+      handle(module->export_wrappers(), isolate));
+  ret->set_export_wrappers(*export_copy);
 
   std::unique_ptr<wasm::NativeModule> native_module =
       module->GetNativeModule()->Clone();
@@ -1345,13 +1278,7 @@ Handle<WasmCompiledModule> WasmCompiledModule::Clone(
   Handle<Foreign> native_module_wrapper =
       Managed<wasm::NativeModule>::From(isolate, native_module.release());
   ret->set_native_module(*native_module_wrapper);
-  Handle<WasmCompiledModule> weak_link =
-      isolate->global_handles()->Create(*ret);
-  GlobalHandles::MakeWeak(Handle<Object>::cast(weak_link).location(),
-                          Handle<Object>::cast(weak_link).location(),
-                          &CompiledModuleFinalizer,
-                          v8::WeakCallbackType::kFinalizer);
-  ret->GetNativeModule()->SetCompiledModule(weak_link);
+  ret->GetNativeModule()->SetCompiledModule(ret);
 
   if (module->has_lazy_compile_data()) {
     Handle<FixedArray> lazy_comp_data = isolate->factory()->NewFixedArray(
@@ -1361,99 +1288,11 @@ Handle<WasmCompiledModule> WasmCompiledModule::Clone(
   return ret;
 }
 
-void WasmCompiledModule::SetTableValue(Isolate* isolate,
-                                       Handle<FixedArray> table, int index,
-                                       Address value) {
-  Handle<HeapNumber> number = isolate->factory()->NewHeapNumber(
-      static_cast<double>(reinterpret_cast<size_t>(value)), MUTABLE, TENURED);
-  table->set(index, *number);
-}
-
-void WasmCompiledModule::UpdateTableValue(FixedArray* table, int index,
-                                          Address value) {
-  DisallowHeapAllocation no_gc;
-  HeapNumber::cast(table->get(index))
-      ->set_value(static_cast<double>(reinterpret_cast<size_t>(value)));
-}
-
-Address WasmCompiledModule::GetTableValue(FixedArray* table, int index) {
-  DisallowHeapAllocation no_gc;
-  double value = HeapNumber::cast(table->get(index))->value();
-  return reinterpret_cast<Address>(static_cast<size_t>(value));
-}
-
 wasm::NativeModule* WasmCompiledModule::GetNativeModule() const {
   if (!has_native_module()) return nullptr;
   return Managed<wasm::NativeModule>::cast(native_module())->get();
 }
 
-void WasmCompiledModule::ResetGCModel(Isolate* isolate,
-                                      WasmCompiledModule* compiled_module) {
-  DisallowHeapAllocation no_gc;
-  TRACE("Resetting %d\n", compiled_module->instance_id());
-  Object* undefined = *isolate->factory()->undefined_value();
-  Object* fct_obj = compiled_module->code_table();
-  if (fct_obj != nullptr && fct_obj != undefined) {
-    // Patch code to update memory references, global references, and function
-    // table references.
-    Zone specialization_zone(isolate->allocator(), ZONE_NAME);
-    wasm::CodeSpecialization code_specialization(isolate, &specialization_zone);
-
-    // Reset function tables.
-    if (compiled_module->has_function_tables()) {
-      FixedArray* function_tables = compiled_module->function_tables();
-      FixedArray* empty_function_tables =
-          compiled_module->empty_function_tables();
-      if (function_tables != empty_function_tables) {
-        DCHECK_EQ(function_tables->length(), empty_function_tables->length());
-        for (int i = 0, e = function_tables->length(); i < e; ++i) {
-          GlobalHandleAddress func_addr =
-              WasmCompiledModule::GetTableValue(function_tables, i);
-          code_specialization.RelocatePointer(
-              func_addr,
-              WasmCompiledModule::GetTableValue(empty_function_tables, i));
-        }
-        compiled_module->set_function_tables(empty_function_tables);
-      }
-    }
-
-    // TODO(6792): No longer needed once WebAssembly code is off heap.
-    CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
-    FixedArray* functions = FixedArray::cast(fct_obj);
-    for (int i = compiled_module->num_imported_functions(),
-             end = functions->length();
-         i < end; ++i) {
-      Code* code = Code::cast(functions->get(i));
-      // Skip lazy compile stubs.
-      if (code->builtin_index() == Builtins::kWasmCompileLazy) continue;
-      if (code->kind() != Code::WASM_FUNCTION) {
-        // From here on, there should only be wrappers for exported functions.
-        for (; i < end; ++i) {
-          DCHECK_EQ(Code::JS_TO_WASM_FUNCTION,
-                    Code::cast(functions->get(i))->kind());
-        }
-        break;
-      }
-      bool changed = code_specialization.ApplyToWasmCode(
-          WasmCodeWrapper(handle(code)), SKIP_ICACHE_FLUSH);
-      // TODO(wasm): Check if this is faster than passing FLUSH_ICACHE_IF_NEEDED
-      // above.
-      if (changed) {
-        Assembler::FlushICache(isolate, code->instruction_start(),
-                               code->instruction_size());
-      }
-    }
-  }
-}
-
-void WasmCompiledModule::InitId() {
-#if DEBUG
-  static uint32_t instance_id_counter = 0;
-  set(kID_instance_id, Smi::FromInt(instance_id_counter++));
-  TRACE("New compiled module id: %d\n", instance_id());
-#endif
-}
-
 void WasmCompiledModule::Reset(Isolate* isolate,
                                WasmCompiledModule* compiled_module) {
   DisallowHeapAllocation no_gc;
@@ -1491,22 +1330,6 @@ void WasmCompiledModule::Reset(Isolate* isolate,
           i, isolate->heap()->undefined_value());
     }
   }
-  // Reset function tables.
-  if (native_module->function_tables().size() > 0) {
-    std::vector<GlobalHandleAddress>& function_tables =
-        native_module->function_tables();
-    std::vector<GlobalHandleAddress>& empty_function_tables =
-        native_module->empty_function_tables();
-
-    if (function_tables != empty_function_tables) {
-      DCHECK_EQ(function_tables.size(), empty_function_tables.size());
-      for (size_t i = 0, e = function_tables.size(); i < e; ++i) {
-        code_specialization.RelocatePointer(function_tables[i],
-                                            empty_function_tables[i]);
-      }
-      native_module->function_tables() = empty_function_tables;
-    }
-  }
 
   for (uint32_t i = native_module->num_imported_functions(),
                 end = native_module->FunctionCount();
@@ -1514,12 +1337,11 @@ void WasmCompiledModule::Reset(Isolate* isolate,
     wasm::WasmCode* code = native_module->GetCode(i);
     // Skip lazy compile stubs.
     if (code == nullptr || code->kind() != wasm::WasmCode::kFunction) continue;
-    bool changed = code_specialization.ApplyToWasmCode(WasmCodeWrapper(code),
-                                                       SKIP_ICACHE_FLUSH);
+    bool changed = code_specialization.ApplyToWasmCode(code, SKIP_ICACHE_FLUSH);
     // TODO(wasm): Check if this is faster than passing FLUSH_ICACHE_IF_NEEDED
     // above.
     if (changed) {
-      Assembler::FlushICache(isolate, code->instructions().start(),
+      Assembler::FlushICache(code->instructions().start(),
                              code->instructions().size());
     }
   }
@@ -1549,54 +1371,11 @@ MaybeHandle<String> WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(
       static_cast<int>(ref.length()));
 }
 
-bool WasmCompiledModule::IsWasmCompiledModule(Object* obj) {
-  if (!obj->IsFixedArray()) return false;
-  FixedArray* arr = FixedArray::cast(obj);
-  if (arr->length() != PropertyIndices::Count) return false;
-#define WCM_CHECK_TYPE(NAME, TYPE_CHECK) \
-  do {                                   \
-    Object* obj = arr->get(kID_##NAME);  \
-    if (!(TYPE_CHECK)) return false;     \
-  } while (false);
-// We're OK with undefined, generally, because maybe we don't
-// have a value for that item. For example, we may not have a
-// memory, or globals.
-// We're not OK with the const numbers being undefined. They are
-// expected to be initialized at construction.
-#define WCM_CHECK_OBJECT(TYPE, NAME) \
-  WCM_CHECK_TYPE(NAME, obj->IsUndefined(isolate) || obj->Is##TYPE())
-#define WCM_CHECK_CONST_OBJECT(TYPE, NAME) \
-  WCM_CHECK_TYPE(NAME, obj->IsUndefined(isolate) || obj->Is##TYPE())
-#define WCM_CHECK_WASM_OBJECT(TYPE, NAME) \
-  WCM_CHECK_TYPE(NAME, obj->IsFixedArray() || obj->IsUndefined(isolate))
-#define WCM_CHECK_WEAK_LINK(TYPE, NAME) WCM_CHECK_OBJECT(WeakCell, NAME)
-#define WCM_CHECK_SMALL_NUMBER(TYPE, NAME) \
-  WCM_CHECK_TYPE(NAME, obj->IsUndefined(isolate) || obj->IsSmi())
-#define WCM_CHECK(KIND, TYPE, NAME) WCM_CHECK_##KIND(TYPE, NAME)
-#define WCM_CHECK_SMALL_CONST_NUMBER(TYPE, NAME) \
-  WCM_CHECK_TYPE(NAME, obj->IsSmi())
-#undef WCM_CHECK_TYPE
-#undef WCM_CHECK_OBJECT
-#undef WCM_CHECK_CONST_OBJECT
-#undef WCM_CHECK_WASM_OBJECT
-#undef WCM_CHECK_WEAK_LINK
-#undef WCM_CHECK_SMALL_NUMBER
-#undef WCM_CHECK
-#undef WCM_CHECK_SMALL_CONST_NUMBER
-
-  // All checks passed.
-  return true;
-}
-
 void WasmCompiledModule::PrintInstancesChain() {
 #if DEBUG
   if (!FLAG_trace_wasm_instances) return;
   for (WasmCompiledModule* current = this; current != nullptr;) {
-    if (FLAG_wasm_jit_to_native) {
-      PrintF("->%zu", current->GetNativeModule()->instance_id);
-    } else {
-      PrintF("->%d", current->instance_id());
-    }
+    PrintF("->%zu", current->GetNativeModule()->instance_id);
     if (!current->has_next_instance()) break;
     current = current->next_instance();
   }
@@ -1616,68 +1395,22 @@ void WasmCompiledModule::RemoveFromChain() {
   DisallowHeapAllocation no_gc;
   Isolate* isolate = GetIsolate();
 
-  Object* next = get(kID_next_instance);
-  Object* prev = get(kID_prev_instance);
+  Object* next = raw_next_instance();
+  Object* prev = raw_prev_instance();
 
   if (!prev->IsUndefined(isolate)) {
-    WasmCompiledModule::cast(prev)->set(kID_next_instance, next);
+    WasmCompiledModule::cast(prev)->set_raw_next_instance(next);
   }
   if (!next->IsUndefined(isolate)) {
-    WasmCompiledModule::cast(next)->set(kID_prev_instance, prev);
+    WasmCompiledModule::cast(next)->set_raw_prev_instance(prev);
   }
 }
 
-void WasmCompiledModule::OnWasmModuleDecodingComplete(
-    Handle<WasmSharedModuleData> shared) {
-  set_shared(*shared);
-}
-
 void WasmCompiledModule::ReinitializeAfterDeserialization(
     Isolate* isolate, Handle<WasmCompiledModule> compiled_module) {
-  // This method must only be called immediately after deserialization.
-  // At this point, no module wrapper exists, so the shared module data is
-  // incomplete.
-  Handle<WasmSharedModuleData> shared(
-      static_cast<WasmSharedModuleData*>(compiled_module->get(kID_shared)),
-      isolate);
-  if (!FLAG_wasm_jit_to_native) {
-    DCHECK(!WasmSharedModuleData::IsWasmSharedModuleData(*shared));
-    WasmSharedModuleData::ReinitializeAfterDeserialization(isolate, shared);
-  }
-  size_t function_table_count =
-      compiled_module->shared()->module()->function_tables.size();
-  wasm::NativeModule* native_module = compiled_module->GetNativeModule();
-
-  if (function_table_count > 0) {
-    // The tables are of the right size, but contain bogus global handle
-    // addresses. Produce new global handles for the empty tables, then reset,
-    // which will relocate the code. We end up with a WasmCompiledModule as-if
-    // it were just compiled.
-    Handle<FixedArray> function_tables;
-    if (!FLAG_wasm_jit_to_native) {
-      DCHECK(compiled_module->has_function_tables());
-      function_tables =
-          handle(compiled_module->empty_function_tables(), isolate);
-    } else {
-      DCHECK_GT(native_module->function_tables().size(), 0);
-    }
-    for (size_t i = 0; i < function_table_count; ++i) {
-      Handle<Object> global_func_table_handle =
-          isolate->global_handles()->Create(isolate->heap()->undefined_value());
-      GlobalHandleAddress new_func_table = global_func_table_handle.address();
-      if (!FLAG_wasm_jit_to_native) {
-        SetTableValue(isolate, function_tables, static_cast<int>(i),
-                      new_func_table);
-      } else {
-        native_module->empty_function_tables()[i] = new_func_table;
-      }
-    }
-  }
-
   // Reset, but don't delete any global handles, because their owning instance
   // may still be active.
   WasmCompiledModule::Reset(isolate, *compiled_module);
-  DCHECK(WasmSharedModuleData::IsWasmSharedModuleData(*shared));
 }
 
 MaybeHandle<String> WasmSharedModuleData::GetModuleNameOrNull(
@@ -1691,9 +1424,10 @@ MaybeHandle<String> WasmSharedModuleData::GetFunctionNameOrNull(
     Isolate* isolate, Handle<WasmSharedModuleData> shared,
     uint32_t func_index) {
   DCHECK_LT(func_index, shared->module()->functions.size());
-  WasmFunction& function = shared->module()->functions[func_index];
-  if (!function.name.is_set()) return {};
-  return ExtractUtf8StringFromModuleBytes(isolate, shared, function.name);
+  wasm::WireBytesRef name =
+      shared->module()->LookupName(shared->module_bytes(), func_index);
+  if (!name.is_set()) return {};
+  return ExtractUtf8StringFromModuleBytes(isolate, shared, name);
 }
 
 Handle<String> WasmSharedModuleData::GetFunctionName(
@@ -1707,12 +1441,11 @@ Handle<String> WasmSharedModuleData::GetFunctionName(
 Vector<const uint8_t> WasmSharedModuleData::GetRawFunctionName(
     uint32_t func_index) {
   DCHECK_GT(module()->functions.size(), func_index);
-  WasmFunction& function = module()->functions[func_index];
   SeqOneByteString* bytes = module_bytes();
-  DCHECK_GE(bytes->length(), function.name.end_offset());
-  return Vector<const uint8_t>(
-      bytes->GetCharsAddress() + function.name.offset(),
-      function.name.length());
+  wasm::WireBytesRef name = module()->LookupName(bytes, func_index);
+  DCHECK_GE(bytes->length(), name.end_offset());
+  return Vector<const uint8_t>(bytes->GetCharsAddress() + name.offset(),
+                               name.length());
 }
 
 int WasmSharedModuleData::GetFunctionOffset(uint32_t func_index) {
@@ -1761,10 +1494,9 @@ bool WasmSharedModuleData::GetPositionInfo(uint32_t position,
   return true;
 }
 
-
 bool WasmCompiledModule::SetBreakPoint(
     Handle<WasmCompiledModule> compiled_module, int* position,
-    Handle<Object> break_point_object) {
+    Handle<BreakPoint> break_point) {
   Isolate* isolate = compiled_module->GetIsolate();
   Handle<WasmSharedModuleData> shared(compiled_module->shared(), isolate);
 
@@ -1779,7 +1511,7 @@ bool WasmCompiledModule::SetBreakPoint(
   DCHECK(IsBreakablePosition(*shared, func_index, offset_in_func));
 
   // Insert new break point into break_positions of shared module data.
-  WasmSharedModuleData::AddBreakpoint(shared, *position, break_point_object);
+  WasmSharedModuleData::AddBreakpoint(shared, *position, break_point);
 
   // Iterate over all instances of this module and tell them to set this new
   // breakpoint.
@@ -1793,44 +1525,20 @@ bool WasmCompiledModule::SetBreakPoint(
   return true;
 }
 
-void AttachWasmFunctionInfo(Isolate* isolate, Handle<Code> code,
-                            MaybeHandle<WeakCell> weak_instance,
-                            int func_index) {
-  DCHECK(weak_instance.is_null() ||
-         weak_instance.ToHandleChecked()->value()->IsWasmInstanceObject());
-  Handle<FixedArray> deopt_data = isolate->factory()->NewFixedArray(2, TENURED);
-  if (!weak_instance.is_null()) {
-    // TODO(wasm): Introduce constants for the indexes in wasm deopt data.
-    deopt_data->set(0, *weak_instance.ToHandleChecked());
-  }
-  deopt_data->set(1, Smi::FromInt(func_index));
-
-  code->set_deoptimization_data(*deopt_data);
-}
+void WasmCompiledModule::LogWasmCodes(Isolate* isolate) {
+  if (!wasm::WasmCode::ShouldBeLogged(isolate)) return;
 
-void AttachWasmFunctionInfo(Isolate* isolate, Handle<Code> code,
-                            MaybeHandle<WasmInstanceObject> instance,
-                            int func_index) {
-  MaybeHandle<WeakCell> weak_instance;
-  if (!instance.is_null()) {
-    weak_instance = isolate->factory()->NewWeakCell(instance.ToHandleChecked());
-  }
-  AttachWasmFunctionInfo(isolate, code, weak_instance, func_index);
-}
-
-WasmFunctionInfo GetWasmFunctionInfo(Isolate* isolate, Handle<Code> code) {
-  FixedArray* deopt_data = code->deoptimization_data();
-  DCHECK_LE(2, deopt_data->length());
-  MaybeHandle<WasmInstanceObject> instance;
-  Object* maybe_weak_instance = deopt_data->get(0);
-  if (maybe_weak_instance->IsWeakCell()) {
-    Object* maybe_instance = WeakCell::cast(maybe_weak_instance)->value();
-    if (maybe_instance) {
-      instance = handle(WasmInstanceObject::cast(maybe_instance), isolate);
+  wasm::NativeModule* native_module = GetNativeModule();
+  if (native_module == nullptr) return;
+  const uint32_t number_of_codes = native_module->FunctionCount();
+  if (has_shared()) {
+    Handle<WasmSharedModuleData> shared_handle(shared(), isolate);
+    for (uint32_t i = 0; i < number_of_codes; i++) {
+      wasm::WasmCode* code = native_module->GetCode(i);
+      if (code == nullptr) continue;
+      code->LogCode(isolate);
     }
   }
-  int func_index = Smi::ToInt(deopt_data->get(1));
-  return {instance, func_index};
 }
 
 #undef TRACE
diff --git a/deps/v8/src/wasm/wasm-objects.h b/deps/v8/src/wasm/wasm-objects.h
index cecc11f83f4..963de474588 100644
--- a/deps/v8/src/wasm/wasm-objects.h
+++ b/deps/v8/src/wasm/wasm-objects.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_OBJECTS_H_
-#define V8_WASM_OBJECTS_H_
+#ifndef V8_WASM_WASM_OBJECTS_H_
+#define V8_WASM_WASM_OBJECTS_H_
 
 #include "src/base/bits.h"
 #include "src/debug/debug.h"
@@ -38,22 +38,18 @@ class WasmCompiledModule;
 class WasmDebugInfo;
 class WasmInstanceObject;
 
-#define DECL_OOL_QUERY(type) static bool Is##type(Object* object);
-#define DECL_OOL_CAST(type) static type* cast(Object* object);
-
-#define DECL_GETTER(name, type) type* name();
-
 #define DECL_OPTIONAL_ACCESSORS(name, type) \
   INLINE(bool has_##name());                \
   DECL_ACCESSORS(name, type)
 
-#define DEF_SIZE(parent)                                                     \
-  static const int kSize = parent::kHeaderSize + kFieldCount * kPointerSize; \
-  static const int kParentSize = parent::kHeaderSize;                        \
-  static const int kHeaderSize = kSize;
-#define DEF_OFFSET(name)             \
-  static const int k##name##Offset = \
-      kSize + (k##name##Index - kFieldCount) * kPointerSize;
+// An entry in an indirect dispatch table.
+struct IndirectFunctionTableEntry {
+  int32_t sig_id = 0;
+  WasmContext* context = nullptr;
+  Address target = nullptr;
+
+  MOVE_ONLY_WITH_DEFAULT_CONSTRUCTORS(IndirectFunctionTableEntry)
+};
 
 // Wasm context used to store the mem_size and mem_start address of the linear
 // memory. These variables can be accessed at C++ level at graph build time
@@ -67,14 +63,27 @@ struct WasmContext {
   uint32_t mem_size = 0;  // TODO(titzer): uintptr_t?
   uint32_t mem_mask = 0;  // TODO(titzer): uintptr_t?
   byte* globals_start = nullptr;
+  // TODO(wasm): pad these entries to a power of two.
+  IndirectFunctionTableEntry* table = nullptr;
+  uint32_t table_size = 0;
 
-  inline void SetRawMemory(void* mem_start, size_t mem_size) {
+  void SetRawMemory(void* mem_start, size_t mem_size) {
     DCHECK_LE(mem_size, wasm::kV8MaxWasmMemoryPages * wasm::kWasmPageSize);
     this->mem_start = static_cast<byte*>(mem_start);
     this->mem_size = static_cast<uint32_t>(mem_size);
     this->mem_mask = base::bits::RoundUpToPowerOfTwo32(this->mem_size) - 1;
     DCHECK_LE(mem_size, this->mem_mask + 1);
   }
+
+  ~WasmContext() {
+    if (table) free(table);
+    mem_start = nullptr;
+    mem_size = 0;
+    mem_mask = 0;
+    globals_start = nullptr;
+    table = nullptr;
+    table_size = 0;
+  }
 };
 
 // Representation of a WebAssembly.Module JavaScript-level object.
@@ -85,13 +94,14 @@ class WasmModuleObject : public JSObject {
   // Shared compiled code between multiple WebAssembly.Module objects.
   DECL_ACCESSORS(compiled_module, WasmCompiledModule)
 
-  enum {  // --
-    kCompiledModuleIndex,
-    kFieldCount
-  };
+// Layout description.
+#define WASM_MODULE_OBJECT_FIELDS(V)     \
+  V(kCompiledModuleOffset, kPointerSize) \
+  V(kSize, 0)
 
-  DEF_SIZE(JSObject)
-  DEF_OFFSET(CompiledModule)
+  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
+                                WASM_MODULE_OBJECT_FIELDS)
+#undef WASM_MODULE_OBJECT_FIELDS
 
   static Handle<WasmModuleObject> New(
       Isolate* isolate, Handle<WasmCompiledModule> compiled_module);
@@ -110,20 +120,17 @@ class WasmTableObject : public JSObject {
   DECL_ACCESSORS(maximum_length, Object)
   DECL_ACCESSORS(dispatch_tables, FixedArray)
 
-  enum {  // --
-    kFunctionsIndex,
-    kMaximumLengthIndex,
-    kDispatchTablesIndex,
-    kFieldCount
-  };
+// Layout description.
+#define WASM_TABLE_OBJECT_FIELDS(V)      \
+  V(kFunctionsOffset, kPointerSize)      \
+  V(kMaximumLengthOffset, kPointerSize)  \
+  V(kDispatchTablesOffset, kPointerSize) \
+  V(kSize, 0)
 
-  DEF_SIZE(JSObject)
-  DEF_OFFSET(Functions)
-  DEF_OFFSET(MaximumLength)
-  DEF_OFFSET(DispatchTables)
+  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize, WASM_TABLE_OBJECT_FIELDS)
+#undef WASM_TABLE_OBJECT_FIELDS
 
   inline uint32_t current_length();
-  inline bool has_maximum_length();
   void Grow(Isolate* isolate, uint32_t count);
 
   static Handle<WasmTableObject> New(Isolate* isolate, uint32_t initial,
@@ -137,9 +144,13 @@ class WasmTableObject : public JSObject {
   static void Set(Isolate* isolate, Handle<WasmTableObject> table,
                   int32_t index, Handle<JSFunction> function);
 
-  static void UpdateDispatchTables(Handle<WasmTableObject> table, int index,
-                                   wasm::FunctionSig* sig,
-                                   Handle<Object> code_or_foreign);
+  static void UpdateDispatchTables(Isolate* isolate,
+                                   Handle<WasmTableObject> table,
+                                   int table_index, wasm::FunctionSig* sig,
+                                   Handle<WasmInstanceObject> from_instance,
+                                   wasm::WasmCode* wasm_code, int func_index);
+
+  static void ClearDispatchTables(Handle<WasmTableObject> table, int index);
 };
 
 // Representation of a WebAssembly.Memory JavaScript-level object.
@@ -149,22 +160,20 @@ class WasmMemoryObject : public JSObject {
 
   DECL_ACCESSORS(array_buffer, JSArrayBuffer)
   DECL_INT_ACCESSORS(maximum_pages)
-  DECL_OPTIONAL_ACCESSORS(instances, WeakFixedArray)
+  DECL_OPTIONAL_ACCESSORS(instances, FixedArrayOfWeakCells)
   DECL_ACCESSORS(wasm_context, Managed<WasmContext>)
 
-  enum {  // --
-    kArrayBufferIndex,
-    kMaximumPagesIndex,
-    kInstancesIndex,
-    kWasmContextIndex,
-    kFieldCount
-  };
+// Layout description.
+#define WASM_MEMORY_OBJECT_FIELDS(V)   \
+  V(kArrayBufferOffset, kPointerSize)  \
+  V(kMaximumPagesOffset, kPointerSize) \
+  V(kInstancesOffset, kPointerSize)    \
+  V(kWasmContextOffset, kPointerSize)  \
+  V(kSize, 0)
 
-  DEF_SIZE(JSObject)
-  DEF_OFFSET(ArrayBuffer)
-  DEF_OFFSET(MaximumPages)
-  DEF_OFFSET(Instances)
-  DEF_OFFSET(WasmContext)
+  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
+                                WASM_MEMORY_OBJECT_FIELDS)
+#undef WASM_MEMORY_OBJECT_FIELDS
 
   // Add an instance to the internal (weak) list. amortized O(n).
   static void AddInstance(Isolate* isolate, Handle<WasmMemoryObject> memory,
@@ -194,54 +203,61 @@ class WasmInstanceObject : public JSObject {
   DECL_OPTIONAL_ACCESSORS(debug_info, WasmDebugInfo)
   DECL_OPTIONAL_ACCESSORS(table_object, WasmTableObject)
   DECL_OPTIONAL_ACCESSORS(function_tables, FixedArray)
+  DECL_PRIMITIVE_ACCESSORS(memory_start, byte*)
+  DECL_PRIMITIVE_ACCESSORS(memory_size, uintptr_t)
+  DECL_PRIMITIVE_ACCESSORS(memory_mask, uintptr_t)
+  DECL_PRIMITIVE_ACCESSORS(globals_start, byte*)
+  DECL_PRIMITIVE_ACCESSORS(indirect_function_table, IndirectFunctionTableEntry*)
+  DECL_PRIMITIVE_ACCESSORS(indirect_function_table_size, uintptr_t)
 
   // FixedArray of all instances whose code was imported
-  DECL_OPTIONAL_ACCESSORS(directly_called_instances, FixedArray)
+  DECL_ACCESSORS(directly_called_instances, FixedArray)
   DECL_ACCESSORS(js_imports_table, FixedArray)
 
-  enum {  // --
-    kWasmContextIndex,
-    kCompiledModuleIndex,
-    kExportsObjectIndex,
-    kMemoryObjectIndex,
-    kGlobalsBufferIndex,
-    kDebugInfoIndex,
-    kTableObjectIndex,
-    kFunctionTablesIndex,
-    kDirectlyCalledInstancesIndex,
-    kJsImportsTableIndex,
-    kFieldCount
-  };
-
-  DEF_SIZE(JSObject)
-  DEF_OFFSET(WasmContext)
-  DEF_OFFSET(CompiledModule)
-  DEF_OFFSET(ExportsObject)
-  DEF_OFFSET(MemoryObject)
-  DEF_OFFSET(GlobalsBuffer)
-  DEF_OFFSET(DebugInfo)
-  DEF_OFFSET(TableObject)
-  DEF_OFFSET(FunctionTables)
-  DEF_OFFSET(DirectlyCalledInstances)
-  DEF_OFFSET(JsImportsTable)
+// Layout description.
+#define WASM_INSTANCE_OBJECT_FIELDS(V)                             \
+  V(kWasmContextOffset, kPointerSize)                              \
+  V(kCompiledModuleOffset, kPointerSize)                           \
+  V(kExportsObjectOffset, kPointerSize)                            \
+  V(kMemoryObjectOffset, kPointerSize)                             \
+  V(kGlobalsBufferOffset, kPointerSize)                            \
+  V(kDebugInfoOffset, kPointerSize)                                \
+  V(kTableObjectOffset, kPointerSize)                              \
+  V(kFunctionTablesOffset, kPointerSize)                           \
+  V(kDirectlyCalledInstancesOffset, kPointerSize)                  \
+  V(kJsImportsTableOffset, kPointerSize)                           \
+  V(kFirstUntaggedOffset, 0)                        /* marker */   \
+  V(kMemoryStartOffset, kPointerSize)               /* untagged */ \
+  V(kMemorySizeOffset, kPointerSize)                /* untagged */ \
+  V(kMemoryMaskOffset, kPointerSize)                /* untagged */ \
+  V(kGlobalsStartOffset, kPointerSize)              /* untagged */ \
+  V(kIndirectFunctionTableOffset, kPointerSize)     /* untagged */ \
+  V(kIndirectFunctionTableSizeOffset, kPointerSize) /* untagged */ \
+  V(kSize, 0)
+
+  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
+                                WASM_INSTANCE_OBJECT_FIELDS)
+#undef WASM_INSTANCE_OBJECT_FIELDS
 
   WasmModuleObject* module_object();
   V8_EXPORT_PRIVATE wasm::WasmModule* module();
 
+  bool EnsureIndirectFunctionTableWithMinimumSize(size_t minimum_size);
+
+  IndirectFunctionTableEntry* indirect_function_table_entry_at(int index);
+
+  void SetRawMemory(byte* mem_start, size_t mem_size);
+
   // Get the debug info associated with the given wasm object.
   // If no debug info exists yet, it is created automatically.
   static Handle<WasmDebugInfo> GetOrCreateDebugInfo(Handle<WasmInstanceObject>);
 
   static Handle<WasmInstanceObject> New(Isolate*, Handle<WasmCompiledModule>);
 
-  static int32_t GrowMemory(Isolate*, Handle<WasmInstanceObject>,
-                            uint32_t pages);
-
   // Assumed to be called with a code object associated to a wasm module
   // instance. Intended to be called from runtime functions. Returns nullptr on
   // failing to get owning instance.
   static WasmInstanceObject* GetOwningInstance(const wasm::WasmCode* code);
-  static WasmInstanceObject* GetOwningInstanceGC(Code* code);
 
   static void ValidateInstancesChainForTesting(
       Isolate* isolate, Handle<WasmModuleObject> module_obj,
@@ -249,6 +265,14 @@ class WasmInstanceObject : public JSObject {
 
   static void ValidateOrphanedInstanceForTesting(
       Isolate* isolate, Handle<WasmInstanceObject> instance);
+
+  static void InstallFinalizer(Isolate* isolate,
+                               Handle<WasmInstanceObject> instance);
+
+  // Iterates all fields in the object except the untagged fields.
+  class BodyDescriptor;
+  // No weak fields.
+  typedef BodyDescriptor BodyDescriptorWeak;
 };
 
 // A WASM function that is wrapped and exported to JavaScript.
@@ -266,47 +290,45 @@ class WasmExportedFunction : public JSFunction {
                                           int func_index, int arity,
                                           Handle<Code> export_wrapper);
 
-  WasmCodeWrapper GetWasmCode();
+  wasm::WasmCode* GetWasmCode();
 };
 
 // Information shared by all WasmCompiledModule objects for the same module.
-class WasmSharedModuleData : public FixedArray {
+class WasmSharedModuleData : public Struct {
  public:
-  DECL_OOL_QUERY(WasmSharedModuleData)
-  DECL_OOL_CAST(WasmSharedModuleData)
-
-  DECL_GETTER(module, wasm::WasmModule)
-  DECL_OPTIONAL_ACCESSORS(module_bytes, SeqOneByteString)
+  DECL_ACCESSORS(module_wrapper, Object)
+  wasm::WasmModule* module() const;
+  DECL_ACCESSORS(module_bytes, SeqOneByteString)
   DECL_ACCESSORS(script, Script)
   DECL_OPTIONAL_ACCESSORS(asm_js_offset_table, ByteArray)
   DECL_OPTIONAL_ACCESSORS(breakpoint_infos, FixedArray)
+  inline void reset_breakpoint_infos();
+
+  DECL_CAST(WasmSharedModuleData)
+
+  // Dispatched behavior.
+  DECL_PRINTER(WasmSharedModuleData)
+  DECL_VERIFIER(WasmSharedModuleData)
 
-  enum {  // --
-    kModuleWrapperIndex,
-    kModuleBytesIndex,
-    kScriptIndex,
-    kAsmJsOffsetTableIndex,
-    kBreakPointInfosIndex,
-    kLazyCompilationOrchestratorIndex,
-    kFieldCount
-  };
-
-  DEF_SIZE(FixedArray)
-  DEF_OFFSET(ModuleWrapper)
-  DEF_OFFSET(ModuleBytes)
-  DEF_OFFSET(Script)
-  DEF_OFFSET(AsmJsOffsetTable)
-  DEF_OFFSET(BreakPointInfos)
-  DEF_OFFSET(LazyCompilationOrchestrator)
+// Layout description.
+#define WASM_SHARED_MODULE_DATA_FIELDS(V)             \
+  V(kModuleWrapperOffset, kPointerSize)               \
+  V(kModuleBytesOffset, kPointerSize)                 \
+  V(kScriptOffset, kPointerSize)                      \
+  V(kAsmJsOffsetTableOffset, kPointerSize)            \
+  V(kBreakPointInfosOffset, kPointerSize)             \
+  V(kLazyCompilationOrchestratorOffset, kPointerSize) \
+  V(kSize, 0)
+
+  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
+                                WASM_SHARED_MODULE_DATA_FIELDS)
+#undef WASM_SHARED_MODULE_DATA_FIELDS
 
   // Check whether this module was generated from asm.js source.
   bool is_asm_js();
 
-  static void ReinitializeAfterDeserialization(Isolate*,
-                                               Handle<WasmSharedModuleData>);
-
   static void AddBreakpoint(Handle<WasmSharedModuleData>, int position,
-                            Handle<Object> break_point_object);
+                            Handle<BreakPoint> break_point);
 
   static void SetBreakpointsOnNewInstance(Handle<WasmSharedModuleData>,
                                           Handle<WasmInstanceObject>);
@@ -411,35 +433,46 @@ class WasmSharedModuleData : public FixedArray {
 // the tables (signature and functions).
 // For tables, we need to hold a reference to the JS Heap object, because
 // we embed them as objects, and they may move.
-class WasmCompiledModule : public FixedArray {
+class WasmCompiledModule : public Struct {
  public:
-  enum {  // --
-    kFieldCount
-  };
-
-  static WasmCompiledModule* cast(Object* fixed_array) {
-    SLOW_DCHECK(IsWasmCompiledModule(fixed_array));
-    return reinterpret_cast<WasmCompiledModule*>(fixed_array);
-  }
-
-#define WCM_OBJECT_OR_WEAK(TYPE, NAME, ID, TYPE_CHECK, SETTER_MODIFIER) \
- public:                                                                \
-  inline TYPE* maybe_##NAME() const;                                    \
-  inline TYPE* NAME() const;                                            \
-  inline bool has_##NAME() const;                                       \
-  inline void reset_##NAME();                                           \
-                                                                        \
-  SETTER_MODIFIER:                                                      \
-  inline void set_##NAME(TYPE* value);
-
-#define WCM_OBJECT(TYPE, NAME) \
-  WCM_OBJECT_OR_WEAK(TYPE, NAME, kID_##NAME, obj->Is##TYPE(), public)
-
-#define WCM_CONST_OBJECT(TYPE, NAME) \
-  WCM_OBJECT_OR_WEAK(TYPE, NAME, kID_##NAME, obj->Is##TYPE(), private)
-
-#define WCM_WASM_OBJECT(TYPE, NAME) \
-  WCM_OBJECT_OR_WEAK(TYPE, NAME, kID_##NAME, TYPE::Is##TYPE(obj), private)
+  DECL_CAST(WasmCompiledModule)
+
+  // Dispatched behavior.
+  DECL_PRINTER(WasmCompiledModule)
+  DECL_VERIFIER(WasmCompiledModule)
+
+// Layout description.
+#define WASM_COMPILED_MODULE_FIELDS(V)          \
+  V(kSharedOffset, kPointerSize)                \
+  V(kNativeContextOffset, kPointerSize)         \
+  V(kExportWrappersOffset, kPointerSize)        \
+  V(kWeakExportedFunctionsOffset, kPointerSize) \
+  V(kNextInstanceOffset, kPointerSize)          \
+  V(kPrevInstanceOffset, kPointerSize)          \
+  V(kOwningInstanceOffset, kPointerSize)        \
+  V(kWasmModuleOffset, kPointerSize)            \
+  V(kNativeModuleOffset, kPointerSize)          \
+  V(kLazyCompileDataOffset, kPointerSize)       \
+  V(kUseTrapHandlerOffset, kPointerSize)        \
+  V(kSize, 0)
+
+  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
+                                WASM_COMPILED_MODULE_FIELDS)
+#undef WASM_COMPILED_MODULE_FIELDS
+
+#define WCM_OBJECT_OR_WEAK(TYPE, NAME, SETTER_MODIFIER) \
+ public:                                                \
+  inline TYPE* NAME() const;                            \
+  inline bool has_##NAME() const;                       \
+  inline void reset_##NAME();                           \
+                                                        \
+  SETTER_MODIFIER:                                      \
+  inline void set_##NAME(TYPE* value,                   \
+                         WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+#define WCM_OBJECT(TYPE, NAME) WCM_OBJECT_OR_WEAK(TYPE, NAME, public)
+
+#define WCM_CONST_OBJECT(TYPE, NAME) WCM_OBJECT_OR_WEAK(TYPE, NAME, private)
 
 #define WCM_SMALL_CONST_NUMBER(TYPE, NAME) \
  public:                                   \
@@ -448,66 +481,32 @@ class WasmCompiledModule : public FixedArray {
  private:                                  \
   inline void set_##NAME(TYPE value);
 
-#define WCM_WEAK_LINK(TYPE, NAME)                                          \
-  WCM_OBJECT_OR_WEAK(WeakCell, weak_##NAME, kID_##NAME, obj->IsWeakCell(), \
-                     public)                                               \
-                                                                           \
- public:                                                                   \
+#define WCM_WEAK_LINK(TYPE, NAME)                   \
+  WCM_OBJECT_OR_WEAK(WeakCell, weak_##NAME, public) \
+                                                    \
+ public:                                            \
   inline TYPE* NAME() const;
 
-// Add values here if they are required for creating new instances or
-// for deserialization, and if they are serializable.
-// By default, instance values go to WasmInstanceObject, however, if
-// we embed the generated code with a value, then we track that value here.
-#define CORE_WCM_PROPERTY_TABLE(MACRO)                  \
-  MACRO(WASM_OBJECT, WasmSharedModuleData, shared)      \
-  MACRO(WEAK_LINK, Context, native_context)             \
-  MACRO(CONST_OBJECT, FixedArray, export_wrappers)      \
-  MACRO(OBJECT, FixedArray, weak_exported_functions)    \
-  MACRO(WASM_OBJECT, WasmCompiledModule, next_instance) \
-  MACRO(WASM_OBJECT, WasmCompiledModule, prev_instance) \
-  MACRO(WEAK_LINK, WasmInstanceObject, owning_instance) \
-  MACRO(WEAK_LINK, WasmModuleObject, wasm_module)       \
-  MACRO(OBJECT, FixedArray, handler_table)              \
-  MACRO(OBJECT, FixedArray, source_positions)           \
-  MACRO(OBJECT, Foreign, native_module)                 \
-  MACRO(OBJECT, FixedArray, lazy_compile_data)          \
-  MACRO(SMALL_CONST_NUMBER, bool, use_trap_handler)
-
-#define GC_WCM_PROPERTY_TABLE(MACRO)                          \
-  MACRO(SMALL_CONST_NUMBER, uint32_t, num_imported_functions) \
-  MACRO(CONST_OBJECT, FixedArray, code_table)                 \
-  MACRO(OBJECT, FixedArray, function_tables)                  \
-  MACRO(OBJECT, FixedArray, signature_tables)                 \
-  MACRO(CONST_OBJECT, FixedArray, empty_function_tables)      \
-  MACRO(CONST_OBJECT, FixedArray, empty_signature_tables)
-
-// TODO(mtrofin): this is unnecessary when we stop needing
-// FLAG_wasm_jit_to_native, because we have instance_id on NativeModule.
-#if DEBUG
-#define DEBUG_ONLY_TABLE(MACRO) MACRO(SMALL_CONST_NUMBER, uint32_t, instance_id)
-#else
-#define DEBUG_ONLY_TABLE(IGNORE)
-
- public:
-  uint32_t instance_id() const { return static_cast<uint32_t>(-1); }
-#endif
-
-#define WCM_PROPERTY_TABLE(MACRO) \
-  CORE_WCM_PROPERTY_TABLE(MACRO)  \
-  GC_WCM_PROPERTY_TABLE(MACRO)    \
-  DEBUG_ONLY_TABLE(MACRO)
-
- private:
-  enum PropertyIndices {
-#define INDICES(IGNORE1, IGNORE2, NAME) kID_##NAME,
-    WCM_PROPERTY_TABLE(INDICES) Count
-#undef INDICES
-  };
+  // Add values here if they are required for creating new instances or
+  // for deserialization, and if they are serializable.
+  // By default, instance values go to WasmInstanceObject, however, if
+  // we embed the generated code with a value, then we track that value here.
+  WCM_OBJECT(WasmSharedModuleData, shared)
+  WCM_WEAK_LINK(Context, native_context)
+  WCM_CONST_OBJECT(FixedArray, export_wrappers)
+  WCM_OBJECT(FixedArray, weak_exported_functions)
+  WCM_CONST_OBJECT(WasmCompiledModule, next_instance)
+  WCM_CONST_OBJECT(WasmCompiledModule, prev_instance)
+  WCM_WEAK_LINK(WasmInstanceObject, owning_instance)
+  WCM_WEAK_LINK(WasmModuleObject, wasm_module)
+  WCM_OBJECT(Foreign, native_module)
+  WCM_OBJECT(FixedArray, lazy_compile_data)
+  // TODO(mstarzinger): Make {use_trap_handler} smaller.
+  WCM_SMALL_CONST_NUMBER(bool, use_trap_handler)
 
  public:
   static Handle<WasmCompiledModule> New(
-      Isolate* isolate, wasm::WasmModule* module, Handle<FixedArray> code_table,
+      Isolate* isolate, wasm::WasmModule* module,
       Handle<FixedArray> export_wrappers,
       const std::vector<wasm::GlobalHandleAddress>& function_tables,
       bool use_trap_hander);
@@ -516,20 +515,12 @@ class WasmCompiledModule : public FixedArray {
                                           Handle<WasmCompiledModule> module);
   static void Reset(Isolate* isolate, WasmCompiledModule* module);
 
-  // TODO(mtrofin): delete this when we don't need FLAG_wasm_jit_to_native
-  static void ResetGCModel(Isolate* isolate, WasmCompiledModule* module);
-
   wasm::NativeModule* GetNativeModule() const;
   void InsertInChain(WasmModuleObject*);
   void RemoveFromChain();
-  void OnWasmModuleDecodingComplete(Handle<WasmSharedModuleData>);
 
-#define DECLARATION(KIND, TYPE, NAME) WCM_##KIND(TYPE, NAME)
-  WCM_PROPERTY_TABLE(DECLARATION)
-#undef DECLARATION
-
- public:
-  static bool IsWasmCompiledModule(Object* obj);
+  DECL_ACCESSORS(raw_next_instance, Object);
+  DECL_ACCESSORS(raw_prev_instance, Object);
 
   void PrintInstancesChain();
 
@@ -543,52 +534,41 @@ class WasmCompiledModule : public FixedArray {
   // If it points outside a function, or behind the last breakable location,
   // this function returns false and does not set any breakpoint.
   static bool SetBreakPoint(Handle<WasmCompiledModule>, int* position,
-                            Handle<Object> break_point_object);
-
-  inline void ReplaceCodeTableForTesting(
-      std::vector<wasm::WasmCode*>&& testing_table);
+                            Handle<BreakPoint> break_point);
 
-  // TODO(mtrofin): following 4 unnecessary after we're done with
-  // FLAG_wasm_jit_to_native
-  static void SetTableValue(Isolate* isolate, Handle<FixedArray> table,
-                            int index, Address value);
-  static void UpdateTableValue(FixedArray* table, int index, Address value);
-  static Address GetTableValue(FixedArray* table, int index);
-  inline void ReplaceCodeTableForTesting(Handle<FixedArray> testing_table);
+  void LogWasmCodes(Isolate* isolate);
 
  private:
-  void InitId();
-
   DISALLOW_IMPLICIT_CONSTRUCTORS(WasmCompiledModule);
 };
 
-class WasmDebugInfo : public FixedArray {
+class WasmDebugInfo : public Struct {
  public:
-  DECL_OOL_QUERY(WasmDebugInfo)
-  DECL_OOL_CAST(WasmDebugInfo)
-
-  DECL_GETTER(wasm_instance, WasmInstanceObject)
+  DECL_ACCESSORS(wasm_instance, WasmInstanceObject)
+  DECL_ACCESSORS(interpreter_handle, Object);
+  DECL_ACCESSORS(interpreted_functions, Object);
   DECL_OPTIONAL_ACCESSORS(locals_names, FixedArray)
   DECL_OPTIONAL_ACCESSORS(c_wasm_entries, FixedArray)
   DECL_OPTIONAL_ACCESSORS(c_wasm_entry_map, Managed<wasm::SignatureMap>)
 
-  enum {
-    kInstanceIndex,              // instance object.
-    kInterpreterHandleIndex,     // managed object containing the interpreter.
-    kInterpretedFunctionsIndex,  // array of interpreter entry code objects.
-    kLocalsNamesIndex,           // array of array of local names.
-    kCWasmEntriesIndex,          // array of C_WASM_ENTRY stubs.
-    kCWasmEntryMapIndex,         // maps signature to index into CWasmEntries.
-    kFieldCount
-  };
-
-  DEF_SIZE(FixedArray)
-  DEF_OFFSET(Instance)
-  DEF_OFFSET(InterpreterHandle)
-  DEF_OFFSET(InterpretedFunctions)
-  DEF_OFFSET(LocalsNames)
-  DEF_OFFSET(CWasmEntries)
-  DEF_OFFSET(CWasmEntryMap)
+  DECL_CAST(WasmDebugInfo)
+
+  // Dispatched behavior.
+  DECL_PRINTER(WasmDebugInfo)
+  DECL_VERIFIER(WasmDebugInfo)
+
+// Layout description.
+#define WASM_DEBUG_INFO_FIELDS(V)              \
+  V(kInstanceOffset, kPointerSize)             \
+  V(kInterpreterHandleOffset, kPointerSize)    \
+  V(kInterpretedFunctionsOffset, kPointerSize) \
+  V(kLocalsNamesOffset, kPointerSize)          \
+  V(kCWasmEntriesOffset, kPointerSize)         \
+  V(kCWasmEntryMapOffset, kPointerSize)        \
+  V(kSize, 0)
+
+  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize, WASM_DEBUG_INFO_FIELDS)
+#undef WASM_DEBUG_INFO_FIELDS
 
   static Handle<WasmDebugInfo> New(Handle<WasmInstanceObject>);
 
@@ -656,33 +636,10 @@ class WasmDebugInfo : public FixedArray {
                                           wasm::FunctionSig*);
 };
 
-// Attach function information in the form of deoptimization data to the given
-// code object. This information will be used for generating stack traces,
-// calling imported functions in the interpreter, knowing which function to
-// compile in a lazy compile stub, and more. The deopt data will be a newly
-// allocated FixedArray of length 2, where the first element is a WeakCell
-// containing the WasmInstanceObject, and the second element is the function
-// index.
-// If calling this method repeatedly for the same instance, pass a WeakCell
-// directly in order to avoid creating many cells pointing to the same instance.
-void AttachWasmFunctionInfo(Isolate*, Handle<Code>,
-                            MaybeHandle<WeakCell> weak_instance,
-                            int func_index);
-void AttachWasmFunctionInfo(Isolate*, Handle<Code>,
-                            MaybeHandle<WasmInstanceObject>, int func_index);
-
-struct WasmFunctionInfo {
-  MaybeHandle<WasmInstanceObject> instance;
-  int func_index;
-};
-WasmFunctionInfo GetWasmFunctionInfo(Isolate*, Handle<Code>);
-
-#undef DECL_OOL_QUERY
-#undef DECL_OOL_CAST
-#undef DECL_GETTER
 #undef DECL_OPTIONAL_ACCESSORS
 #undef WCM_CONST_OBJECT
 #undef WCM_LARGE_NUMBER
+#undef WCM_OBJECT
 #undef WCM_OBJECT_OR_WEAK
 #undef WCM_SMALL_CONST_NUMBER
 #undef WCM_WEAK_LINK
@@ -692,4 +649,4 @@ WasmFunctionInfo GetWasmFunctionInfo(Isolate*, Handle<Code>);
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_OBJECTS_H_
+#endif  // V8_WASM_WASM_OBJECTS_H_
diff --git a/deps/v8/src/wasm/wasm-opcodes.cc b/deps/v8/src/wasm/wasm-opcodes.cc
index b503aa1a5e7..6e3b3e4daf3 100644
--- a/deps/v8/src/wasm/wasm-opcodes.cc
+++ b/deps/v8/src/wasm/wasm-opcodes.cc
@@ -22,6 +22,7 @@ namespace wasm {
 #define CASE_I64_OP(name, str) CASE_OP(I64##name, "i64." str)
 #define CASE_F32_OP(name, str) CASE_OP(F32##name, "f32." str)
 #define CASE_F64_OP(name, str) CASE_OP(F64##name, "f64." str)
+#define CASE_REF_OP(name, str) CASE_OP(Ref##name, "ref." str)
 #define CASE_F32x4_OP(name, str) CASE_OP(F32x4##name, "f32x4." str)
 #define CASE_I32x4_OP(name, str) CASE_OP(I32x4##name, "i32x4." str)
 #define CASE_I16x8_OP(name, str) CASE_OP(I16x8##name, "i16x8." str)
@@ -60,6 +61,12 @@ namespace wasm {
   CASE_I32_OP(name, str "32")             \
   CASE_UNSIGNED_OP(I32, name##8, str "8") \
   CASE_UNSIGNED_OP(I32, name##16, str "16")
+#define CASE_UNSIGNED_ALL_OP(name, str)     \
+  CASE_U32_OP(name, str)                    \
+  CASE_I64_OP(name, str "64")               \
+  CASE_UNSIGNED_OP(I64, name##8, str "8")   \
+  CASE_UNSIGNED_OP(I64, name##16, str "16") \
+  CASE_UNSIGNED_OP(I64, name##32, str "32")
 
 const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
   switch (opcode) {
@@ -98,12 +105,17 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
     CASE_FLOAT_OP(Min, "min")
     CASE_FLOAT_OP(Max, "max")
     CASE_FLOAT_OP(CopySign, "copysign")
+    CASE_REF_OP(Null, "null")
+    CASE_REF_OP(IsNull, "is_null")
+    CASE_REF_OP(Eq, "eq")
     CASE_I32_OP(ConvertI64, "wrap/i64")
     CASE_CONVERT_OP(Convert, INT, F32, "f32", "trunc")
     CASE_CONVERT_OP(Convert, INT, F64, "f64", "trunc")
-    // TODO(kschimpf): Add I64 versions of saturating conversions.
+    // TODO(kschimpf): Simplify after filling in other saturating operations.
     CASE_CONVERT_SAT_OP(Convert, I32, F32, "f32", "trunc")
     CASE_CONVERT_SAT_OP(Convert, I32, F64, "f64", "trunc")
+    CASE_CONVERT_SAT_OP(Convert, I64, F32, "f32", "trunc")
+    CASE_CONVERT_SAT_OP(Convert, I64, F64, "f64", "trunc")
 
     CASE_CONVERT_OP(Convert, I64, I32, "i32", "extend")
     CASE_CONVERT_OP(Convert, F32, I32, "i32", "convert")
@@ -116,6 +128,9 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
     CASE_I64_OP(ReinterpretF64, "reinterpret/f64")
     CASE_F32_OP(ReinterpretI32, "reinterpret/i32")
     CASE_F64_OP(ReinterpretI64, "reinterpret/i64")
+    CASE_INT_OP(SExtendI8, "sign_extend8")
+    CASE_INT_OP(SExtendI16, "sign_extend16")
+    CASE_I64_OP(SExtendI32, "sign_extend32")
     CASE_OP(Unreachable, "unreachable")
     CASE_OP(Nop, "nop")
     CASE_OP(Block, "block")
@@ -242,15 +257,15 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
     CASE_S1x16_OP(AllTrue, "all_true")
 
     // Atomic operations.
-    CASE_U32_OP(AtomicLoad, "atomic_load")
-    CASE_U32_OP(AtomicStore, "atomic_store")
-    CASE_U32_OP(AtomicAdd, "atomic_add")
-    CASE_U32_OP(AtomicSub, "atomic_sub")
-    CASE_U32_OP(AtomicAnd, "atomic_and")
-    CASE_U32_OP(AtomicOr, "atomic_or")
-    CASE_U32_OP(AtomicXor, "atomic_xor")
-    CASE_U32_OP(AtomicExchange, "atomic_xchng")
-    CASE_U32_OP(AtomicCompareExchange, "atomic_cmpxchng")
+    CASE_UNSIGNED_ALL_OP(AtomicLoad, "atomic_load")
+    CASE_UNSIGNED_ALL_OP(AtomicStore, "atomic_store")
+    CASE_UNSIGNED_ALL_OP(AtomicAdd, "atomic_add")
+    CASE_UNSIGNED_ALL_OP(AtomicSub, "atomic_sub")
+    CASE_UNSIGNED_ALL_OP(AtomicAnd, "atomic_and")
+    CASE_UNSIGNED_ALL_OP(AtomicOr, "atomic_or")
+    CASE_UNSIGNED_ALL_OP(AtomicXor, "atomic_xor")
+    CASE_UNSIGNED_ALL_OP(AtomicExchange, "atomic_xchng")
+    CASE_UNSIGNED_ALL_OP(AtomicCompareExchange, "atomic_cmpxchng")
 
     default : return "unknown";
     // clang-format on
@@ -262,6 +277,7 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
 #undef CASE_I64_OP
 #undef CASE_F32_OP
 #undef CASE_F64_OP
+#undef CASE_REF_OP
 #undef CASE_F32x4_OP
 #undef CASE_I32x4_OP
 #undef CASE_I16x8_OP
@@ -280,6 +296,7 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
 #undef CASE_SIMDI_OP
 #undef CASE_SIGN_OP
 #undef CASE_UNSIGNED_OP
+#undef CASE_UNSIGNED_ALL_OP
 #undef CASE_ALL_SIGN_OP
 #undef CASE_CONVERT_OP
 #undef CASE_CONVERT_SAT_OP
@@ -320,6 +337,29 @@ bool WasmOpcodes::IsUnconditionalJump(WasmOpcode opcode) {
   }
 }
 
+bool WasmOpcodes::IsSignExtensionOpcode(WasmOpcode opcode) {
+  switch (opcode) {
+    case kExprI32SExtendI8:
+    case kExprI32SExtendI16:
+    case kExprI64SExtendI8:
+    case kExprI64SExtendI16:
+    case kExprI64SExtendI32:
+      return true;
+    default:
+      return false;
+  }
+}
+
+bool WasmOpcodes::IsAnyRefOpcode(WasmOpcode opcode) {
+  switch (opcode) {
+    case kExprRefNull:
+    case kExprRefIsNull:
+    case kExprRefEq:
+      return true;
+    default:
+      return false;
+  }
+}
 std::ostream& operator<<(std::ostream& os, const FunctionSig& sig) {
   if (sig.return_count() == 0) os << "v";
   for (auto ret : sig.returns()) {
diff --git a/deps/v8/src/wasm/wasm-opcodes.h b/deps/v8/src/wasm/wasm-opcodes.h
index 9f8232c9022..e0d779d6230 100644
--- a/deps/v8/src/wasm/wasm-opcodes.h
+++ b/deps/v8/src/wasm/wasm-opcodes.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_OPCODES_H_
-#define V8_WASM_OPCODES_H_
+#ifndef V8_WASM_WASM_OPCODES_H_
+#define V8_WASM_WASM_OPCODES_H_
 
 #include "src/globals.h"
 #include "src/machine-type.h"
@@ -23,6 +23,7 @@ constexpr ValueType kWasmI32 = MachineRepresentation::kWord32;
 constexpr ValueType kWasmI64 = MachineRepresentation::kWord64;
 constexpr ValueType kWasmF32 = MachineRepresentation::kFloat32;
 constexpr ValueType kWasmF64 = MachineRepresentation::kFloat64;
+constexpr ValueType kWasmAnyRef = MachineRepresentation::kTaggedPointer;
 constexpr ValueType kWasmS128 = MachineRepresentation::kSimd128;
 constexpr ValueType kWasmVar = MachineRepresentation::kTagged;
 
@@ -65,7 +66,8 @@ using WasmName = Vector<const char>;
   V(I32Const, 0x41, _)         \
   V(I64Const, 0x42, _)         \
   V(F32Const, 0x43, _)         \
-  V(F64Const, 0x44, _)
+  V(F64Const, 0x44, _)         \
+  V(RefNull, 0xd0, _)
 
 // Load memory expressions.
 #define FOREACH_LOAD_MEM_OPCODE(V) \
@@ -225,41 +227,48 @@ using WasmName = Vector<const char>;
   V(I32ReinterpretF32, 0xbc, i_f) \
   V(I64ReinterpretF64, 0xbd, l_d) \
   V(F32ReinterpretI32, 0xbe, f_i) \
-  V(F64ReinterpretI64, 0xbf, d_l)
+  V(F64ReinterpretI64, 0xbf, d_l) \
+  V(I32SExtendI8, 0xc0, i_i)      \
+  V(I32SExtendI16, 0xc1, i_i)     \
+  V(I64SExtendI8, 0xc2, l_l)      \
+  V(I64SExtendI16, 0xc3, l_l)     \
+  V(I64SExtendI32, 0xc4, l_l)     \
+  V(RefIsNull, 0xd1, i_r)         \
+  V(RefEq, 0xd2, i_rr)
 
 // For compatibility with Asm.js.
 #define FOREACH_ASMJS_COMPAT_OPCODE(V) \
-  V(F64Acos, 0xc2, d_d)                \
-  V(F64Asin, 0xc3, d_d)                \
-  V(F64Atan, 0xc4, d_d)                \
-  V(F64Cos, 0xc5, d_d)                 \
-  V(F64Sin, 0xc6, d_d)                 \
-  V(F64Tan, 0xc7, d_d)                 \
-  V(F64Exp, 0xc8, d_d)                 \
-  V(F64Log, 0xc9, d_d)                 \
-  V(F64Atan2, 0xca, d_dd)              \
-  V(F64Pow, 0xcb, d_dd)                \
-  V(F64Mod, 0xcc, d_dd)                \
-  V(I32AsmjsDivS, 0xd0, i_ii)          \
-  V(I32AsmjsDivU, 0xd1, i_ii)          \
-  V(I32AsmjsRemS, 0xd2, i_ii)          \
-  V(I32AsmjsRemU, 0xd3, i_ii)          \
-  V(I32AsmjsLoadMem8S, 0xd4, i_i)      \
-  V(I32AsmjsLoadMem8U, 0xd5, i_i)      \
-  V(I32AsmjsLoadMem16S, 0xd6, i_i)     \
-  V(I32AsmjsLoadMem16U, 0xd7, i_i)     \
-  V(I32AsmjsLoadMem, 0xd8, i_i)        \
-  V(F32AsmjsLoadMem, 0xd9, f_i)        \
-  V(F64AsmjsLoadMem, 0xda, d_i)        \
-  V(I32AsmjsStoreMem8, 0xdb, i_ii)     \
-  V(I32AsmjsStoreMem16, 0xdc, i_ii)    \
-  V(I32AsmjsStoreMem, 0xdd, i_ii)      \
-  V(F32AsmjsStoreMem, 0xde, f_if)      \
-  V(F64AsmjsStoreMem, 0xdf, d_id)      \
-  V(I32AsmjsSConvertF32, 0xe0, i_f)    \
-  V(I32AsmjsUConvertF32, 0xe1, i_f)    \
-  V(I32AsmjsSConvertF64, 0xe2, i_d)    \
-  V(I32AsmjsUConvertF64, 0xe3, i_d)
+  V(F64Acos, 0xc5, d_d)                \
+  V(F64Asin, 0xc6, d_d)                \
+  V(F64Atan, 0xc7, d_d)                \
+  V(F64Cos, 0xc8, d_d)                 \
+  V(F64Sin, 0xc9, d_d)                 \
+  V(F64Tan, 0xca, d_d)                 \
+  V(F64Exp, 0xcb, d_d)                 \
+  V(F64Log, 0xcc, d_d)                 \
+  V(F64Atan2, 0xcd, d_dd)              \
+  V(F64Pow, 0xce, d_dd)                \
+  V(F64Mod, 0xcf, d_dd)                \
+  V(I32AsmjsDivS, 0xd3, i_ii)          \
+  V(I32AsmjsDivU, 0xd4, i_ii)          \
+  V(I32AsmjsRemS, 0xd5, i_ii)          \
+  V(I32AsmjsRemU, 0xd6, i_ii)          \
+  V(I32AsmjsLoadMem8S, 0xd7, i_i)      \
+  V(I32AsmjsLoadMem8U, 0xd8, i_i)      \
+  V(I32AsmjsLoadMem16S, 0xd9, i_i)     \
+  V(I32AsmjsLoadMem16U, 0xda, i_i)     \
+  V(I32AsmjsLoadMem, 0xdb, i_i)        \
+  V(F32AsmjsLoadMem, 0xdc, f_i)        \
+  V(F64AsmjsLoadMem, 0xdd, d_i)        \
+  V(I32AsmjsStoreMem8, 0xde, i_ii)     \
+  V(I32AsmjsStoreMem16, 0xdf, i_ii)    \
+  V(I32AsmjsStoreMem, 0xe0, i_ii)      \
+  V(F32AsmjsStoreMem, 0xe1, f_if)      \
+  V(F64AsmjsStoreMem, 0xe2, d_id)      \
+  V(I32AsmjsSConvertF32, 0xe3, i_f)    \
+  V(I32AsmjsUConvertF32, 0xe4, i_f)    \
+  V(I32AsmjsSConvertF64, 0xe5, i_d)    \
+  V(I32AsmjsUConvertF64, 0xe6, i_d)
 
 #define FOREACH_SIMD_0_OPERAND_OPCODE(V) \
   V(F32x4Splat, 0xfd00, s_f)             \
@@ -403,37 +412,76 @@ using WasmName = Vector<const char>;
   V(I32SConvertSatF32, 0xfc00, i_f) \
   V(I32UConvertSatF32, 0xfc01, i_f) \
   V(I32SConvertSatF64, 0xfc02, i_d) \
-  V(I32UConvertSatF64, 0xfc03, i_d)
-// TODO(kschimpf): Add remaining i64 numeric opcodes.
-
-#define FOREACH_ATOMIC_OPCODE(V)               \
-  V(I32AtomicLoad, 0xfe10, i_i)                \
-  V(I32AtomicLoad8U, 0xfe12, i_i)              \
-  V(I32AtomicLoad16U, 0xfe13, i_i)             \
-  V(I32AtomicStore, 0xfe17, v_ii)              \
-  V(I32AtomicStore8U, 0xfe19, v_ii)            \
-  V(I32AtomicStore16U, 0xfe1a, v_ii)           \
-  V(I32AtomicAdd, 0xfe1e, i_ii)                \
-  V(I32AtomicAdd8U, 0xfe20, i_ii)              \
-  V(I32AtomicAdd16U, 0xfe21, i_ii)             \
-  V(I32AtomicSub, 0xfe25, i_ii)                \
-  V(I32AtomicSub8U, 0xfe27, i_ii)              \
-  V(I32AtomicSub16U, 0xfe28, i_ii)             \
-  V(I32AtomicAnd, 0xfe2c, i_ii)                \
-  V(I32AtomicAnd8U, 0xfe2e, i_ii)              \
-  V(I32AtomicAnd16U, 0xfe2f, i_ii)             \
-  V(I32AtomicOr, 0xfe33, i_ii)                 \
-  V(I32AtomicOr8U, 0xfe35, i_ii)               \
-  V(I32AtomicOr16U, 0xfe36, i_ii)              \
-  V(I32AtomicXor, 0xfe3a, i_ii)                \
-  V(I32AtomicXor8U, 0xfe3c, i_ii)              \
-  V(I32AtomicXor16U, 0xfe3d, i_ii)             \
-  V(I32AtomicExchange, 0xfe41, i_ii)           \
-  V(I32AtomicExchange8U, 0xfe43, i_ii)         \
-  V(I32AtomicExchange16U, 0xfe44, i_ii)        \
-  V(I32AtomicCompareExchange, 0xfe48, i_iii)   \
-  V(I32AtomicCompareExchange8U, 0xfe4a, i_iii) \
-  V(I32AtomicCompareExchange16U, 0xfe4b, i_iii)
+  V(I32UConvertSatF64, 0xfc03, i_d) \
+  V(I64SConvertSatF32, 0xfc04, l_f) \
+  V(I64UConvertSatF32, 0xfc05, l_f) \
+  V(I64SConvertSatF64, 0xfc06, l_d) \
+  V(I64UConvertSatF64, 0xfc07, l_d)
+
+#define FOREACH_ATOMIC_OPCODE(V)                \
+  V(I32AtomicLoad, 0xfe10, i_i)                 \
+  V(I64AtomicLoad, 0xfe11, l_i)                 \
+  V(I32AtomicLoad8U, 0xfe12, i_i)               \
+  V(I32AtomicLoad16U, 0xfe13, i_i)              \
+  V(I64AtomicLoad8U, 0xfe14, l_i)               \
+  V(I64AtomicLoad16U, 0xfe15, l_i)              \
+  V(I64AtomicLoad32U, 0xfe16, l_i)              \
+  V(I32AtomicStore, 0xfe17, v_ii)               \
+  V(I64AtomicStore, 0xfe18, v_il)               \
+  V(I32AtomicStore8U, 0xfe19, v_ii)             \
+  V(I32AtomicStore16U, 0xfe1a, v_ii)            \
+  V(I64AtomicStore8U, 0xfe1b, v_il)             \
+  V(I64AtomicStore16U, 0xfe1c, v_il)            \
+  V(I64AtomicStore32U, 0xfe1d, v_il)            \
+  V(I32AtomicAdd, 0xfe1e, i_ii)                 \
+  V(I64AtomicAdd, 0xfe1f, l_il)                 \
+  V(I32AtomicAdd8U, 0xfe20, i_ii)               \
+  V(I32AtomicAdd16U, 0xfe21, i_ii)              \
+  V(I64AtomicAdd8U, 0xfe22, l_il)               \
+  V(I64AtomicAdd16U, 0xfe23, l_il)              \
+  V(I64AtomicAdd32U, 0xfe24, l_il)              \
+  V(I32AtomicSub, 0xfe25, i_ii)                 \
+  V(I64AtomicSub, 0xfe26, l_il)                 \
+  V(I32AtomicSub8U, 0xfe27, i_ii)               \
+  V(I32AtomicSub16U, 0xfe28, i_ii)              \
+  V(I64AtomicSub8U, 0xfe29, l_il)               \
+  V(I64AtomicSub16U, 0xfe2a, l_il)              \
+  V(I64AtomicSub32U, 0xfe2b, l_il)              \
+  V(I32AtomicAnd, 0xfe2c, i_ii)                 \
+  V(I64AtomicAnd, 0xfe2d, l_il)                 \
+  V(I32AtomicAnd8U, 0xfe2e, i_ii)               \
+  V(I32AtomicAnd16U, 0xfe2f, i_ii)              \
+  V(I64AtomicAnd8U, 0xfe30, l_il)               \
+  V(I64AtomicAnd16U, 0xfe31, l_il)              \
+  V(I64AtomicAnd32U, 0xfe32, l_il)              \
+  V(I32AtomicOr, 0xfe33, i_ii)                  \
+  V(I64AtomicOr, 0xfe34, l_il)                  \
+  V(I32AtomicOr8U, 0xfe35, i_ii)                \
+  V(I32AtomicOr16U, 0xfe36, i_ii)               \
+  V(I64AtomicOr8U, 0xfe37, l_il)                \
+  V(I64AtomicOr16U, 0xfe38, l_il)               \
+  V(I64AtomicOr32U, 0xfe39, l_il)               \
+  V(I32AtomicXor, 0xfe3a, i_ii)                 \
+  V(I64AtomicXor, 0xfe3b, l_il)                 \
+  V(I32AtomicXor8U, 0xfe3c, i_ii)               \
+  V(I32AtomicXor16U, 0xfe3d, i_ii)              \
+  V(I64AtomicXor8U, 0xfe3e, l_il)               \
+  V(I64AtomicXor16U, 0xfe3f, l_il)              \
+  V(I64AtomicXor32U, 0xfe40, l_il)              \
+  V(I32AtomicExchange, 0xfe41, i_ii)            \
+  V(I64AtomicExchange, 0xfe42, l_il)            \
+  V(I32AtomicExchange8U, 0xfe43, i_ii)          \
+  V(I32AtomicExchange16U, 0xfe44, i_ii)         \
+  V(I64AtomicExchange8U, 0xfe45, l_il)          \
+  V(I64AtomicExchange16U, 0xfe46, l_il)         \
+  V(I64AtomicExchange32U, 0xfe47, l_il)         \
+  V(I32AtomicCompareExchange, 0xfe48, i_iii)    \
+  V(I64AtomicCompareExchange, 0xfe49, l_ill)    \
+  V(I32AtomicCompareExchange8U, 0xfe4a, i_iii)  \
+  V(I32AtomicCompareExchange16U, 0xfe4b, i_iii) \
+  V(I64AtomicCompareExchange8U, 0xfe4c, l_ill)  \
+  V(I64AtomicCompareExchange16U, 0xfe4d, l_ill) \
+  V(I64AtomicCompareExchange32U, 0xfe4e, l_ill)
 
 // All opcodes.
 #define FOREACH_OPCODE(V)             \
@@ -452,39 +500,43 @@ using WasmName = Vector<const char>;
   FOREACH_NUMERIC_OPCODE(V)
 
 // All signatures.
-#define FOREACH_SIGNATURE(V)             \
-  FOREACH_SIMD_SIGNATURE(V)              \
-  V(i_ii, kWasmI32, kWasmI32, kWasmI32)  \
-  V(i_i, kWasmI32, kWasmI32)             \
-  V(i_v, kWasmI32)                       \
-  V(i_ff, kWasmI32, kWasmF32, kWasmF32)  \
-  V(i_f, kWasmI32, kWasmF32)             \
-  V(i_dd, kWasmI32, kWasmF64, kWasmF64)  \
-  V(i_d, kWasmI32, kWasmF64)             \
-  V(i_l, kWasmI32, kWasmI64)             \
-  V(l_ll, kWasmI64, kWasmI64, kWasmI64)  \
-  V(i_ll, kWasmI32, kWasmI64, kWasmI64)  \
-  V(l_l, kWasmI64, kWasmI64)             \
-  V(l_i, kWasmI64, kWasmI32)             \
-  V(l_f, kWasmI64, kWasmF32)             \
-  V(l_d, kWasmI64, kWasmF64)             \
-  V(f_ff, kWasmF32, kWasmF32, kWasmF32)  \
-  V(f_f, kWasmF32, kWasmF32)             \
-  V(f_d, kWasmF32, kWasmF64)             \
-  V(f_i, kWasmF32, kWasmI32)             \
-  V(f_l, kWasmF32, kWasmI64)             \
-  V(d_dd, kWasmF64, kWasmF64, kWasmF64)  \
-  V(d_d, kWasmF64, kWasmF64)             \
-  V(d_f, kWasmF64, kWasmF32)             \
-  V(d_i, kWasmF64, kWasmI32)             \
-  V(d_l, kWasmF64, kWasmI64)             \
-  V(v_ii, kWasmStmt, kWasmI32, kWasmI32) \
-  V(v_id, kWasmStmt, kWasmI32, kWasmF64) \
-  V(d_id, kWasmF64, kWasmI32, kWasmF64)  \
-  V(v_if, kWasmStmt, kWasmI32, kWasmF32) \
-  V(f_if, kWasmF32, kWasmI32, kWasmF32)  \
-  V(v_il, kWasmI64, kWasmI32, kWasmI64)  \
-  V(i_iii, kWasmI32, kWasmI32, kWasmI32, kWasmI32)
+#define FOREACH_SIGNATURE(V)                       \
+  FOREACH_SIMD_SIGNATURE(V)                        \
+  V(i_ii, kWasmI32, kWasmI32, kWasmI32)            \
+  V(i_i, kWasmI32, kWasmI32)                       \
+  V(i_v, kWasmI32)                                 \
+  V(i_ff, kWasmI32, kWasmF32, kWasmF32)            \
+  V(i_f, kWasmI32, kWasmF32)                       \
+  V(i_dd, kWasmI32, kWasmF64, kWasmF64)            \
+  V(i_d, kWasmI32, kWasmF64)                       \
+  V(i_l, kWasmI32, kWasmI64)                       \
+  V(l_ll, kWasmI64, kWasmI64, kWasmI64)            \
+  V(i_ll, kWasmI32, kWasmI64, kWasmI64)            \
+  V(l_l, kWasmI64, kWasmI64)                       \
+  V(l_i, kWasmI64, kWasmI32)                       \
+  V(l_f, kWasmI64, kWasmF32)                       \
+  V(l_d, kWasmI64, kWasmF64)                       \
+  V(f_ff, kWasmF32, kWasmF32, kWasmF32)            \
+  V(f_f, kWasmF32, kWasmF32)                       \
+  V(f_d, kWasmF32, kWasmF64)                       \
+  V(f_i, kWasmF32, kWasmI32)                       \
+  V(f_l, kWasmF32, kWasmI64)                       \
+  V(d_dd, kWasmF64, kWasmF64, kWasmF64)            \
+  V(d_d, kWasmF64, kWasmF64)                       \
+  V(d_f, kWasmF64, kWasmF32)                       \
+  V(d_i, kWasmF64, kWasmI32)                       \
+  V(d_l, kWasmF64, kWasmI64)                       \
+  V(v_ii, kWasmStmt, kWasmI32, kWasmI32)           \
+  V(v_id, kWasmStmt, kWasmI32, kWasmF64)           \
+  V(d_id, kWasmF64, kWasmI32, kWasmF64)            \
+  V(v_if, kWasmStmt, kWasmI32, kWasmF32)           \
+  V(f_if, kWasmF32, kWasmI32, kWasmF32)            \
+  V(v_il, kWasmStmt, kWasmI32, kWasmI64)           \
+  V(l_il, kWasmI64, kWasmI32, kWasmI64)            \
+  V(i_iii, kWasmI32, kWasmI32, kWasmI32, kWasmI32) \
+  V(l_ill, kWasmI64, kWasmI32, kWasmI64, kWasmI64) \
+  V(i_r, kWasmI32, kWasmAnyRef)                    \
+  V(i_rr, kWasmI32, kWasmAnyRef, kWasmAnyRef)
 
 #define FOREACH_SIMD_SIGNATURE(V)          \
   V(s_s, kWasmS128, kWasmS128)             \
@@ -565,6 +617,21 @@ class LoadType {
   constexpr ValueType value_type() const { return kValueType[val_]; }
   constexpr MachineType mem_type() const { return kMemType[val_]; }
 
+  static LoadType ForValueType(ValueType type) {
+    switch (type) {
+      case kWasmI32:
+        return kI32Load;
+      case kWasmI64:
+        return kI64Load;
+      case kWasmF32:
+        return kF32Load;
+      case kWasmF64:
+        return kF64Load;
+      default:
+        UNREACHABLE();
+    }
+  }
+
  private:
   const LoadTypeValue val_;
 
@@ -617,6 +684,21 @@ class StoreType {
   constexpr ValueType value_type() const { return kValueType[val_]; }
   constexpr ValueType mem_rep() const { return kMemRep[val_]; }
 
+  static StoreType ForValueType(ValueType type) {
+    switch (type) {
+      case kWasmI32:
+        return kI32Store;
+      case kWasmI64:
+        return kI64Store;
+      case kWasmF32:
+        return kF32Store;
+      case kWasmF64:
+        return kF64Store;
+      default:
+        UNREACHABLE();
+    }
+  }
+
  private:
   const StoreTypeValue val_;
 
@@ -647,6 +729,8 @@ class V8_EXPORT_PRIVATE WasmOpcodes {
   static FunctionSig* AsmjsSignature(WasmOpcode opcode);
   static bool IsPrefixOpcode(WasmOpcode opcode);
   static bool IsControlOpcode(WasmOpcode opcode);
+  static bool IsSignExtensionOpcode(WasmOpcode opcode);
+  static bool IsAnyRefOpcode(WasmOpcode opcode);
   // Check whether the given opcode always jumps, i.e. all instructions after
   // this one in the current block are dead. Returns false for |end|.
   static bool IsUnconditionalJump(WasmOpcode opcode);
@@ -672,6 +756,8 @@ class V8_EXPORT_PRIVATE WasmOpcodes {
         return kLocalF64;
       case kWasmS128:
         return kLocalS128;
+      case kWasmAnyRef:
+        return kLocalAnyRef;
       case kWasmStmt:
         return kLocalVoid;
       default:
@@ -689,6 +775,8 @@ class V8_EXPORT_PRIVATE WasmOpcodes {
         return MachineType::Float32();
       case kWasmF64:
         return MachineType::Float64();
+      case kWasmAnyRef:
+        return MachineType::TaggedPointer();
       case kWasmS128:
         return MachineType::Simd128();
       case kWasmStmt:
@@ -710,6 +798,8 @@ class V8_EXPORT_PRIVATE WasmOpcodes {
         return kWasmF32;
       case MachineRepresentation::kFloat64:
         return kWasmF64;
+      case MachineRepresentation::kTaggedPointer:
+        return kWasmAnyRef;
       case MachineRepresentation::kSimd128:
         return kWasmS128;
       default:
@@ -727,6 +817,8 @@ class V8_EXPORT_PRIVATE WasmOpcodes {
         return 'f';
       case kWasmF64:
         return 'd';
+      case kWasmAnyRef:
+        return 'r';
       case kWasmS128:
         return 's';
       case kWasmStmt:
@@ -748,6 +840,8 @@ class V8_EXPORT_PRIVATE WasmOpcodes {
         return "f32";
       case kWasmF64:
         return "f64";
+      case kWasmAnyRef:
+        return "ref";
       case kWasmS128:
         return "s128";
       case kWasmStmt:
@@ -793,4 +887,4 @@ struct WasmInitExpr {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_OPCODES_H_
+#endif  // V8_WASM_WASM_OPCODES_H_
diff --git a/deps/v8/src/wasm/wasm-result.h b/deps/v8/src/wasm/wasm-result.h
index 7744b42923f..8250db90406 100644
--- a/deps/v8/src/wasm/wasm-result.h
+++ b/deps/v8/src/wasm/wasm-result.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_RESULT_H_
-#define V8_WASM_RESULT_H_
+#ifndef V8_WASM_WASM_RESULT_H_
+#define V8_WASM_WASM_RESULT_H_
 
 #include <cstdarg>
 #include <memory>
@@ -158,4 +158,4 @@ class V8_EXPORT_PRIVATE ErrorThrower {
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_WASM_WASM_RESULT_H_
diff --git a/deps/v8/src/wasm/wasm-serialization.cc b/deps/v8/src/wasm/wasm-serialization.cc
index 4466672f37d..6214becaa43 100644
--- a/deps/v8/src/wasm/wasm-serialization.cc
+++ b/deps/v8/src/wasm/wasm-serialization.cc
@@ -11,6 +11,7 @@
 #include "src/objects.h"
 #include "src/snapshot/code-serializer.h"
 #include "src/snapshot/serializer-common.h"
+#include "src/utils.h"
 #include "src/version.h"
 #include "src/wasm/module-compiler.h"
 #include "src/wasm/module-decoder.h"
@@ -23,6 +24,7 @@
 namespace v8 {
 namespace internal {
 namespace wasm {
+
 namespace {
 
 class Writer {
@@ -35,7 +37,7 @@ class Writer {
       os << "wrote: " << (size_t)value << " sized: " << sizeof(T) << std::endl;
     }
     DCHECK_GE(buffer_.size(), sizeof(T));
-    memcpy(buffer_.start(), reinterpret_cast<const byte*>(&value), sizeof(T));
+    WriteUnalignedValue(buffer_.start(), value);
     buffer_ = buffer_ + sizeof(T);
   }
 
@@ -63,8 +65,7 @@ class Reader {
   template <typename T>
   T Read() {
     DCHECK_GE(buffer_.size(), sizeof(T));
-    T ret;
-    memcpy(reinterpret_cast<byte*>(&ret), buffer_.start(), sizeof(T));
+    T ret = ReadUnalignedValue<T>(buffer_.start());
     buffer_ = buffer_ + sizeof(T);
     if (FLAG_wasm_trace_serialization) {
       OFStream os(stdout);
@@ -99,11 +100,14 @@ class Reader {
 
 constexpr size_t kVersionSize = 4 * sizeof(uint32_t);
 
+// Start from 1 so an encoded stub id is not confused with an encoded builtin.
+constexpr int kFirstStubId = 1;
+
 void WriteVersion(Isolate* isolate, Vector<byte> buffer) {
   DCHECK_GE(buffer.size(), kVersionSize);
   Writer writer(buffer);
   writer.Write(SerializedData::ComputeMagicNumber(
-      ExternalReferenceTable::instance(isolate)));
+      isolate->heap()->external_reference_table()));
   writer.Write(Version::Hash());
   writer.Write(static_cast<uint32_t>(CpuFeatures::SupportedFeatures()));
   writer.Write(FlagList::Hash());
@@ -117,6 +121,29 @@ bool IsSupportedVersion(Isolate* isolate, const Vector<const byte> buffer) {
   return false;
 }
 
+// On Intel, call sites are encoded as a displacement. For linking
+// and for serialization/deserialization, we want to store/retrieve
+// a tag (the function index). On Intel, that means accessing the
+// raw displacement. Everywhere else, that simply means accessing
+// the target address.
+void SetWasmCalleeTag(RelocInfo* rinfo, uint32_t tag) {
+#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32
+  *(reinterpret_cast<uint32_t*>(rinfo->target_address_address())) = tag;
+#else
+  rinfo->set_target_address(reinterpret_cast<Address>(tag), SKIP_WRITE_BARRIER,
+                            SKIP_ICACHE_FLUSH);
+#endif
+}
+
+uint32_t GetWasmCalleeTag(RelocInfo* rinfo) {
+#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32
+  return *(reinterpret_cast<uint32_t*>(rinfo->target_address_address()));
+#else
+  return static_cast<uint32_t>(
+      reinterpret_cast<size_t>(rinfo->target_address()));
+#endif
+}
+
 }  // namespace
 
 enum SerializationSection { Init, Metadata, Stubs, CodeSection, Done };
@@ -133,8 +160,6 @@ class V8_EXPORT_PRIVATE NativeModuleSerializer {
   static size_t GetCodeHeaderSize();
   size_t MeasureCode(const WasmCode*) const;
   size_t MeasureCopiedStubs() const;
-  FixedArray* GetHandlerTable(const WasmCode*) const;
-  ByteArray* GetSourcePositions(const WasmCode*) const;
 
   void BufferHeader();
   // we buffer all the stubs because they are small
@@ -187,10 +212,9 @@ NativeModuleSerializer::NativeModuleSerializer(Isolate* isolate,
     : isolate_(isolate), native_module_(module) {
   DCHECK_NOT_NULL(isolate_);
   DCHECK_NOT_NULL(native_module_);
-  DCHECK_NULL(native_module_->lazy_builtin_);
   // TODO(mtrofin): persist the export wrappers. Ideally, we'd only persist
   // the unique ones, i.e. the cache.
-  ExternalReferenceTable* table = ExternalReferenceTable::instance(isolate_);
+  ExternalReferenceTable* table = isolate_->heap()->external_reference_table();
   for (uint32_t i = 0; i < table->size(); ++i) {
     Address addr = table->address(i);
     reference_table_lookup_.insert(std::make_pair(addr, i));
@@ -210,12 +234,7 @@ NativeModuleSerializer::NativeModuleSerializer(Isolate* isolate,
 
 size_t NativeModuleSerializer::MeasureHeader() const {
   return sizeof(uint32_t) +  // total wasm fct count
-         sizeof(
-             uint32_t) +  // imported fcts - i.e. index of first wasm function
-         sizeof(uint32_t) +  // table count
-         native_module_->specialization_data_.function_tables.size()
-             // function table, containing pointers
-             * sizeof(GlobalHandleAddress);
+         sizeof(uint32_t);  // imported fcts - i.e. index of first wasm function
 }
 
 void NativeModuleSerializer::BufferHeader() {
@@ -225,42 +244,26 @@ void NativeModuleSerializer::BufferHeader() {
   Writer writer(remaining_);
   writer.Write(native_module_->FunctionCount());
   writer.Write(native_module_->num_imported_functions());
-  writer.Write(static_cast<uint32_t>(
-      native_module_->specialization_data_.function_tables.size()));
-  for (size_t i = 0,
-              e = native_module_->specialization_data_.function_tables.size();
-       i < e; ++i) {
-    writer.Write(native_module_->specialization_data_.function_tables[i]);
-  }
 }
 
 size_t NativeModuleSerializer::GetCodeHeaderSize() {
-  return sizeof(size_t) +    // size of this section
-         sizeof(size_t) +    // offset of constant pool
-         sizeof(size_t) +    // offset of safepoint table
-         sizeof(uint32_t) +  // stack slots
-         sizeof(size_t) +    // code size
-         sizeof(size_t) +    // reloc size
-         sizeof(uint32_t) +  // handler size
-         sizeof(uint32_t) +  // source positions size
-         sizeof(size_t) +    // protected instructions size
-         sizeof(bool);       // is_liftoff
+  return sizeof(size_t) +         // size of this section
+         sizeof(size_t) +         // offset of constant pool
+         sizeof(size_t) +         // offset of safepoint table
+         sizeof(size_t) +         // offset of handler table
+         sizeof(uint32_t) +       // stack slots
+         sizeof(size_t) +         // code size
+         sizeof(size_t) +         // reloc size
+         sizeof(size_t) +         // source positions size
+         sizeof(size_t) +         // protected instructions size
+         sizeof(WasmCode::Tier);  // tier
 }
 
 size_t NativeModuleSerializer::MeasureCode(const WasmCode* code) const {
-  FixedArray* handler_table = GetHandlerTable(code);
-  ByteArray* source_positions = GetSourcePositions(code);
   return GetCodeHeaderSize() + code->instructions().size() +  // code
          code->reloc_info().size() +                          // reloc info
-         (handler_table == nullptr
-              ? 0
-              : static_cast<uint32_t>(
-                    handler_table->length())) +  // handler table
-         (source_positions == nullptr
-              ? 0
-              : static_cast<uint32_t>(
-                    source_positions->length())) +  // source positions
-         code->protected_instructions().size() *
+         code->source_positions().size() +                    // source pos.
+         code->protected_instructions().size() *              // protected inst.
              sizeof(trap_handler::ProtectedInstructionData);
 }
 
@@ -304,7 +307,7 @@ void NativeModuleSerializer::BufferCopiedStubs() {
   Writer writer(remaining_);
   writer.Write(
       static_cast<uint32_t>((buff_size - sizeof(uint32_t)) / sizeof(uint32_t)));
-  uint32_t stub_id = 0;
+  uint32_t stub_id = kFirstStubId;
 
   for (auto pair : native_module_->stubs_) {
     uint32_t key = pair.first;
@@ -325,34 +328,6 @@ void NativeModuleSerializer::BufferCopiedStubs() {
   }
 }
 
-FixedArray* NativeModuleSerializer::GetHandlerTable(
-    const WasmCode* code) const {
-  if (code->kind() != WasmCode::kFunction) return nullptr;
-  uint32_t index = code->index();
-  // We write the address, the size, and then copy the code as-is, followed
-  // by reloc info, followed by handler table and source positions.
-  Object* handler_table_entry =
-      native_module_->compiled_module()->handler_table()->get(
-          static_cast<int>(index));
-  if (handler_table_entry->IsFixedArray()) {
-    return FixedArray::cast(handler_table_entry);
-  }
-  return nullptr;
-}
-
-ByteArray* NativeModuleSerializer::GetSourcePositions(
-    const WasmCode* code) const {
-  if (code->kind() != WasmCode::kFunction) return nullptr;
-  uint32_t index = code->index();
-  Object* source_positions_entry =
-      native_module_->compiled_module()->source_positions()->get(
-          static_cast<int>(index));
-  if (source_positions_entry->IsByteArray()) {
-    return ByteArray::cast(source_positions_entry);
-  }
-  return nullptr;
-}
-
 void NativeModuleSerializer::BufferCurrentWasmCode() {
   const WasmCode* code = native_module_->GetCode(index_);
   size_t size = MeasureCode(code);
@@ -364,42 +339,25 @@ void NativeModuleSerializer::BufferCurrentWasmCode() {
 void NativeModuleSerializer::BufferCodeInAllocatedScratch(
     const WasmCode* code) {
   // We write the address, the size, and then copy the code as-is, followed
-  // by reloc info, followed by handler table and source positions.
-  FixedArray* handler_table_entry = GetHandlerTable(code);
-  uint32_t handler_table_size = 0;
-  Address handler_table = nullptr;
-  if (handler_table_entry != nullptr) {
-    handler_table_size = static_cast<uint32_t>(handler_table_entry->length());
-    handler_table = reinterpret_cast<Address>(
-        handler_table_entry->GetFirstElementAddress());
-  }
-  ByteArray* source_positions_entry = GetSourcePositions(code);
-  Address source_positions = nullptr;
-  uint32_t source_positions_size = 0;
-  if (source_positions_entry != nullptr) {
-    source_positions = source_positions_entry->GetDataStartAddress();
-    source_positions_size =
-        static_cast<uint32_t>(source_positions_entry->length());
-  }
+  // by reloc info, followed by source positions.
   Writer writer(remaining_);
   // write the header
   writer.Write(MeasureCode(code));
   writer.Write(code->constant_pool_offset());
   writer.Write(code->safepoint_table_offset());
+  writer.Write(code->handler_table_offset());
   writer.Write(code->stack_slots());
   writer.Write(code->instructions().size());
   writer.Write(code->reloc_info().size());
-  writer.Write(handler_table_size);
-  writer.Write(source_positions_size);
+  writer.Write(code->source_positions().size());
   writer.Write(code->protected_instructions().size());
-  writer.Write(code->is_liftoff());
+  writer.Write(code->tier());
   // next is the code, which we have to reloc.
   Address serialized_code_start = writer.current_buffer().start();
   // write the code and everything else
   writer.WriteVector(code->instructions());
   writer.WriteVector(code->reloc_info());
-  writer.WriteVector({handler_table, handler_table_size});
-  writer.WriteVector({source_positions, source_positions_size});
+  writer.WriteVector(code->source_positions());
   writer.WriteVector(
       {reinterpret_cast<const byte*>(code->protected_instructions().data()),
        sizeof(trap_handler::ProtectedInstructionData) *
@@ -503,14 +461,6 @@ size_t NativeModuleSerializer::Write(Vector<byte> dest) {
 // static
 std::pair<std::unique_ptr<const byte[]>, size_t> SerializeNativeModule(
     Isolate* isolate, Handle<WasmCompiledModule> compiled_module) {
-  if (!FLAG_wasm_jit_to_native) {
-    std::unique_ptr<ScriptData> script_data =
-        WasmCompiledModuleSerializer::SerializeWasmModule(isolate,
-                                                          compiled_module);
-    script_data->ReleaseDataOwnership();
-    size_t size = static_cast<size_t>(script_data->length());
-    return {std::unique_ptr<const byte[]>(script_data->data()), size};
-  }
   NativeModule* native_module = compiled_module->GetNativeModule();
   NativeModuleSerializer serializer(isolate, native_module);
   size_t version_size = kVersionSize;
@@ -543,7 +493,6 @@ bool NativeModuleDeserializer::Read(Vector<const byte> data) {
   for (; index_ < native_module_->FunctionCount(); ++index_) {
     if (!ReadCode()) return false;
   }
-  native_module_->LinkAll();
   return data.size() - unread_.size();
 }
 
@@ -555,16 +504,6 @@ bool NativeModuleDeserializer::ReadHeader() {
   bool ok = functions == native_module_->FunctionCount() &&
             imports == native_module_->num_imported_functions();
   if (!ok) return false;
-  size_t table_count = reader.Read<uint32_t>();
-
-  std::vector<GlobalHandleAddress> funcs(table_count);
-  for (size_t i = 0; i < table_count; ++i) {
-    funcs[i] = reader.Read<GlobalHandleAddress>();
-  }
-  native_module_->function_tables() = funcs;
-  // resize, so that from here on the native module can be
-  // asked about num_function_tables().
-  native_module_->empty_function_tables().resize(table_count);
 
   unread_ = unread_ + (start_size - reader.current_buffer().size());
   return true;
@@ -592,13 +531,14 @@ bool NativeModuleDeserializer::ReadCode() {
   USE(code_section_size);
   size_t constant_pool_offset = reader.Read<size_t>();
   size_t safepoint_table_offset = reader.Read<size_t>();
+  size_t handler_table_offset = reader.Read<size_t>();
   uint32_t stack_slot_count = reader.Read<uint32_t>();
   size_t code_size = reader.Read<size_t>();
   size_t reloc_size = reader.Read<size_t>();
-  uint32_t handler_size = reader.Read<uint32_t>();
-  uint32_t source_position_size = reader.Read<uint32_t>();
+  size_t source_position_size = reader.Read<size_t>();
   size_t protected_instructions_size = reader.Read<size_t>();
-  bool is_liftoff = reader.Read<bool>();
+  WasmCode::Tier tier = reader.Read<WasmCode::Tier>();
+
   std::shared_ptr<ProtectedInstructions> protected_instructions(
       new ProtectedInstructions(protected_instructions_size));
   DCHECK_EQ(protected_instructions_size, protected_instructions->size());
@@ -609,12 +549,18 @@ bool NativeModuleDeserializer::ReadCode() {
     reloc_info.reset(new byte[reloc_size]);
     reader.ReadIntoVector({reloc_info.get(), reloc_size});
   }
+  std::unique_ptr<byte[]> source_pos;
+  if (source_position_size > 0) {
+    source_pos.reset(new byte[source_position_size]);
+    reader.ReadIntoVector({source_pos.get(), source_position_size});
+  }
   WasmCode* ret = native_module_->AddOwnedCode(
-      code_buffer, std::move(reloc_info), reloc_size, Just(index_),
-      WasmCode::kFunction, constant_pool_offset, stack_slot_count,
-      safepoint_table_offset, protected_instructions, is_liftoff);
-  if (ret == nullptr) return false;
-  native_module_->SetCodeTable(index_, ret);
+      code_buffer, std::move(reloc_info), reloc_size, std::move(source_pos),
+      source_position_size, Just(index_), WasmCode::kFunction,
+      constant_pool_offset, stack_slot_count, safepoint_table_offset,
+      handler_table_offset, protected_instructions, tier,
+      WasmCode::kNoFlushICache);
+  native_module_->code_table_[index_] = ret;
 
   // now relocate the code
   int mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
@@ -628,46 +574,33 @@ bool NativeModuleDeserializer::ReadCode() {
       case RelocInfo::EMBEDDED_OBJECT: {
         // We only expect {undefined}. We check for that when we add code.
         iter.rinfo()->set_target_object(isolate_->heap()->undefined_value(),
-                                        SKIP_WRITE_BARRIER);
+                                        SKIP_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
         break;
       }
       case RelocInfo::CODE_TARGET: {
         uint32_t tag = GetWasmCalleeTag(iter.rinfo());
         Address target = GetTrampolineOrStubFromTag(tag);
-        iter.rinfo()->set_target_address(nullptr, target, SKIP_WRITE_BARRIER,
+        iter.rinfo()->set_target_address(target, SKIP_WRITE_BARRIER,
                                          SKIP_ICACHE_FLUSH);
         break;
       }
       case RelocInfo::RUNTIME_ENTRY: {
-        uint32_t orig_target = static_cast<uint32_t>(
-            reinterpret_cast<intptr_t>(iter.rinfo()->target_address()));
+        uint32_t tag = GetWasmCalleeTag(iter.rinfo());
         Address address =
-            ExternalReferenceTable::instance(isolate_)->address(orig_target);
-        iter.rinfo()->set_target_runtime_entry(
-            nullptr, address, SKIP_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
+            isolate_->heap()->external_reference_table()->address(tag);
+        iter.rinfo()->set_target_runtime_entry(address, SKIP_WRITE_BARRIER,
+                                               SKIP_ICACHE_FLUSH);
         break;
       }
       default:
         break;
     }
   }
-  if (handler_size > 0) {
-    Handle<FixedArray> handler_table = isolate_->factory()->NewFixedArray(
-        static_cast<int>(handler_size), TENURED);
-    reader.ReadIntoVector(
-        {reinterpret_cast<Address>(handler_table->GetFirstElementAddress()),
-         handler_size});
-    native_module_->compiled_module()->handler_table()->set(
-        static_cast<int>(index_), *handler_table);
-  }
-  if (source_position_size > 0) {
-    Handle<ByteArray> source_positions = isolate_->factory()->NewByteArray(
-        static_cast<int>(source_position_size), TENURED);
-    reader.ReadIntoVector(
-        {source_positions->GetDataStartAddress(), source_position_size});
-    native_module_->compiled_module()->source_positions()->set(
-        static_cast<int>(index_), *source_positions);
-  }
+  // Flush the i-cache here instead of in AddOwnedCode, to include the changes
+  // made while iterating over the RelocInfo above.
+  Assembler::FlushICache(ret->instructions().start(),
+                         ret->instructions().size());
+
   if (protected_instructions_size > 0) {
     reader.ReadIntoVector(
         {reinterpret_cast<byte*>(protected_instructions->data()),
@@ -685,22 +618,12 @@ Address NativeModuleDeserializer::GetTrampolineOrStubFromTag(uint32_t tag) {
     return native_module_->GetLocalAddressFor(handle(builtin));
   } else {
     DCHECK_EQ(tag & 0xFFFF0000, 0);
-    return stubs_[tag];
+    return stubs_[tag - kFirstStubId];
   }
 }
 
 MaybeHandle<WasmCompiledModule> DeserializeNativeModule(
     Isolate* isolate, Vector<const byte> data, Vector<const byte> wire_bytes) {
-  if (!FLAG_wasm_jit_to_native) {
-    ScriptData script_data(data.start(), data.length());
-    Handle<FixedArray> compiled_module;
-    if (!WasmCompiledModuleSerializer::DeserializeWasmModule(
-             isolate, &script_data, wire_bytes)
-             .ToHandle(&compiled_module)) {
-      return {};
-    }
-    return Handle<WasmCompiledModule>::cast(compiled_module);
-  }
   if (!IsWasmCodegenAllowed(isolate, isolate->native_context())) {
     return {};
   }
@@ -733,16 +656,20 @@ MaybeHandle<WasmCompiledModule> DeserializeNativeModule(
   Handle<FixedArray> export_wrappers = isolate->factory()->NewFixedArray(
       static_cast<int>(export_wrappers_size), TENURED);
 
-  Handle<WasmCompiledModule> compiled_module = WasmCompiledModule::New(
-      isolate, shared->module(), isolate->factory()->empty_fixed_array(),
-      export_wrappers, std::vector<wasm::GlobalHandleAddress>(),
-      trap_handler::IsTrapHandlerEnabled());
-  compiled_module->OnWasmModuleDecodingComplete(shared);
+  Handle<WasmCompiledModule> compiled_module =
+      WasmCompiledModule::New(isolate, shared->module(), export_wrappers,
+                              std::vector<wasm::GlobalHandleAddress>(),
+                              trap_handler::IsTrapHandlerEnabled());
+  compiled_module->set_shared(*shared);
   script->set_wasm_compiled_module(*compiled_module);
   NativeModuleDeserializer deserializer(isolate,
                                         compiled_module->GetNativeModule());
   if (!deserializer.Read(data)) return {};
 
+  // TODO(6792): Wrappers below might be cloned using {Factory::CopyCode}. This
+  // requires unlocking the code space here. This should be moved into the
+  // allocator eventually.
+  CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
   CompileJsToWasmWrappers(isolate, compiled_module, isolate->counters());
   WasmCompiledModule::ReinitializeAfterDeserialization(isolate,
                                                        compiled_module);
diff --git a/deps/v8/src/wasm/wasm-serialization.h b/deps/v8/src/wasm/wasm-serialization.h
index 9c0e9ce10ae..5bb49bfdce6 100644
--- a/deps/v8/src/wasm/wasm-serialization.h
+++ b/deps/v8/src/wasm/wasm-serialization.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_SERIALIZATION_H_
-#define V8_WASM_SERIALIZATION_H_
+#ifndef V8_WASM_WASM_SERIALIZATION_H_
+#define V8_WASM_WASM_SERIALIZATION_H_
 
 #include "src/wasm/wasm-objects.h"
 
@@ -21,4 +21,4 @@ MaybeHandle<WasmCompiledModule> DeserializeNativeModule(
 }  // namespace internal
 }  // namespace v8
 
-#endif
+#endif  // V8_WASM_WASM_SERIALIZATION_H_
diff --git a/deps/v8/src/wasm/wasm-text.cc b/deps/v8/src/wasm/wasm-text.cc
index 81c8e418134..15ee678f93f 100644
--- a/deps/v8/src/wasm/wasm-text.cc
+++ b/deps/v8/src/wasm/wasm-text.cc
@@ -46,7 +46,7 @@ void PrintWasmText(const WasmModule* module, const ModuleWireBytes& wire_bytes,
 
   // Print the function signature.
   os << "func";
-  WasmName fun_name = wire_bytes.GetNameOrNull(fun);
+  WasmName fun_name = wire_bytes.GetNameOrNull(fun, module);
   if (IsValidFunctionName(fun_name)) {
     os << " $";
     os.write(fun_name.start(), fun_name.length());
@@ -134,7 +134,7 @@ void PrintWasmText(const WasmModule* module, const ModuleWireBytes& wire_bytes,
       case kExprCallIndirect: {
         CallIndirectOperand<Decoder::kNoValidate> operand(&i, i.pc());
         DCHECK_EQ(0, operand.table_index);
-        os << "call_indirect " << operand.index;
+        os << "call_indirect " << operand.sig_index;
         break;
       }
       case kExprCallFunction: {
@@ -208,6 +208,7 @@ void PrintWasmText(const WasmModule* module, const ModuleWireBytes& wire_bytes,
             UNREACHABLE();
             break;
         }
+        break;
       }
 
         // This group is just printed by their internal opcode name, as they
diff --git a/deps/v8/src/wasm/wasm-text.h b/deps/v8/src/wasm/wasm-text.h
index 1608ea9a2dd..60957966abe 100644
--- a/deps/v8/src/wasm/wasm-text.h
+++ b/deps/v8/src/wasm/wasm-text.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_S_EXPR_H_
-#define V8_WASM_S_EXPR_H_
+#ifndef V8_WASM_WASM_TEXT_H_
+#define V8_WASM_WASM_TEXT_H_
 
 #include <cstdint>
 #include <ostream>
@@ -35,4 +35,4 @@ void PrintWasmText(
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_S_EXPR_H_
+#endif  // V8_WASM_WASM_TEXT_H_
diff --git a/deps/v8/src/wasm/wasm-value.h b/deps/v8/src/wasm/wasm-value.h
index a30657aee0d..22fd13c219b 100644
--- a/deps/v8/src/wasm/wasm-value.h
+++ b/deps/v8/src/wasm/wasm-value.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_WASM_VALUE_H_
-#define V8_WASM_VALUE_H_
+#ifndef V8_WASM_WASM_VALUE_H_
+#define V8_WASM_WASM_VALUE_H_
 
 #include "src/boxed-float.h"
 #include "src/wasm/wasm-opcodes.h"
@@ -84,4 +84,4 @@ FOREACH_WASMVAL_TYPE(DECLARE_CAST)
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_WASM_VALUE_H_
+#endif  // V8_WASM_WASM_VALUE_H_
diff --git a/deps/v8/src/x64/assembler-x64-inl.h b/deps/v8/src/x64/assembler-x64-inl.h
index a75a8ddd746..dbb28c8fcc4 100644
--- a/deps/v8/src/x64/assembler-x64-inl.h
+++ b/deps/v8/src/x64/assembler-x64-inl.h
@@ -15,7 +15,7 @@
 namespace v8 {
 namespace internal {
 
-bool CpuFeatures::SupportsCrankshaft() { return true; }
+bool CpuFeatures::SupportsOptimizer() { return true; }
 
 bool CpuFeatures::SupportsWasmSimd128() { return IsSupported(SSE4_1); }
 
@@ -23,9 +23,6 @@ bool CpuFeatures::SupportsWasmSimd128() { return IsSupported(SSE4_1); }
 // Implementation of Assembler
 
 
-static const byte kCallOpcode = 0xE8;
-
-
 void Assembler::emitl(uint32_t x) {
   Memory::uint32_at(pc_) = x;
   pc_ += sizeof(uint32_t);
@@ -95,14 +92,12 @@ void Assembler::emit_rex_64(Register reg, XMMRegister rm_reg) {
   emit(0x48 | (reg.code() & 0x8) >> 1 | rm_reg.code() >> 3);
 }
 
-
-void Assembler::emit_rex_64(Register reg, const Operand& op) {
-  emit(0x48 | reg.high_bit() << 2 | op.rex_);
+void Assembler::emit_rex_64(Register reg, Operand op) {
+  emit(0x48 | reg.high_bit() << 2 | op.data().rex);
 }
 
-
-void Assembler::emit_rex_64(XMMRegister reg, const Operand& op) {
-  emit(0x48 | (reg.code() & 0x8) >> 1 | op.rex_);
+void Assembler::emit_rex_64(XMMRegister reg, Operand op) {
+  emit(0x48 | (reg.code() & 0x8) >> 1 | op.data().rex);
 }
 
 
@@ -111,19 +106,14 @@ void Assembler::emit_rex_64(Register rm_reg) {
   emit(0x48 | rm_reg.high_bit());
 }
 
-
-void Assembler::emit_rex_64(const Operand& op) {
-  emit(0x48 | op.rex_);
-}
-
+void Assembler::emit_rex_64(Operand op) { emit(0x48 | op.data().rex); }
 
 void Assembler::emit_rex_32(Register reg, Register rm_reg) {
   emit(0x40 | reg.high_bit() << 2 | rm_reg.high_bit());
 }
 
-
-void Assembler::emit_rex_32(Register reg, const Operand& op) {
-  emit(0x40 | reg.high_bit() << 2  | op.rex_);
+void Assembler::emit_rex_32(Register reg, Operand op) {
+  emit(0x40 | reg.high_bit() << 2 | op.data().rex);
 }
 
 
@@ -131,26 +121,20 @@ void Assembler::emit_rex_32(Register rm_reg) {
   emit(0x40 | rm_reg.high_bit());
 }
 
-
-void Assembler::emit_rex_32(const Operand& op) {
-  emit(0x40 | op.rex_);
-}
-
+void Assembler::emit_rex_32(Operand op) { emit(0x40 | op.data().rex); }
 
 void Assembler::emit_optional_rex_32(Register reg, Register rm_reg) {
   byte rex_bits = reg.high_bit() << 2 | rm_reg.high_bit();
   if (rex_bits != 0) emit(0x40 | rex_bits);
 }
 
-
-void Assembler::emit_optional_rex_32(Register reg, const Operand& op) {
-  byte rex_bits =  reg.high_bit() << 2 | op.rex_;
+void Assembler::emit_optional_rex_32(Register reg, Operand op) {
+  byte rex_bits = reg.high_bit() << 2 | op.data().rex;
   if (rex_bits != 0) emit(0x40 | rex_bits);
 }
 
-
-void Assembler::emit_optional_rex_32(XMMRegister reg, const Operand& op) {
-  byte rex_bits =  (reg.code() & 0x8) >> 1 | op.rex_;
+void Assembler::emit_optional_rex_32(XMMRegister reg, Operand op) {
+  byte rex_bits = (reg.code() & 0x8) >> 1 | op.data().rex;
   if (rex_bits != 0) emit(0x40 | rex_bits);
 }
 
@@ -181,8 +165,8 @@ void Assembler::emit_optional_rex_32(XMMRegister rm_reg) {
   if (rm_reg.high_bit()) emit(0x41);
 }
 
-void Assembler::emit_optional_rex_32(const Operand& op) {
-  if (op.rex_ != 0) emit(0x40 | op.rex_);
+void Assembler::emit_optional_rex_32(Operand op) {
+  if (op.data().rex != 0) emit(0x40 | op.data().rex);
 }
 
 
@@ -195,9 +179,8 @@ void Assembler::emit_vex3_byte1(XMMRegister reg, XMMRegister rm,
 
 
 // byte 1 of 3-byte VEX
-void Assembler::emit_vex3_byte1(XMMRegister reg, const Operand& rm,
-                                LeadingOpcode m) {
-  byte rxb = ~((reg.high_bit() << 2) | rm.rex_) << 5;
+void Assembler::emit_vex3_byte1(XMMRegister reg, Operand rm, LeadingOpcode m) {
+  byte rxb = ~((reg.high_bit() << 2) | rm.data().rex) << 5;
   emit(rxb | m);
 }
 
@@ -240,11 +223,10 @@ void Assembler::emit_vex_prefix(Register reg, Register vreg, Register rm,
   emit_vex_prefix(ireg, ivreg, irm, l, pp, mm, w);
 }
 
-
-void Assembler::emit_vex_prefix(XMMRegister reg, XMMRegister vreg,
-                                const Operand& rm, VectorLength l,
-                                SIMDPrefix pp, LeadingOpcode mm, VexW w) {
-  if (rm.rex_ || mm != k0F || w != kW0) {
+void Assembler::emit_vex_prefix(XMMRegister reg, XMMRegister vreg, Operand rm,
+                                VectorLength l, SIMDPrefix pp, LeadingOpcode mm,
+                                VexW w) {
+  if (rm.data().rex || mm != k0F || w != kW0) {
     emit_vex3_byte0();
     emit_vex3_byte1(reg, rm, mm);
     emit_vex3_byte2(w, vreg, l, pp);
@@ -254,8 +236,7 @@ void Assembler::emit_vex_prefix(XMMRegister reg, XMMRegister vreg,
   }
 }
 
-
-void Assembler::emit_vex_prefix(Register reg, Register vreg, const Operand& rm,
+void Assembler::emit_vex_prefix(Register reg, Register vreg, Operand rm,
                                 VectorLength l, SIMDPrefix pp, LeadingOpcode mm,
                                 VexW w) {
   XMMRegister ireg = XMMRegister::from_code(reg.code());
@@ -268,19 +249,17 @@ Address Assembler::target_address_at(Address pc, Address constant_pool) {
   return Memory::int32_at(pc) + pc + 4;
 }
 
-
-void Assembler::set_target_address_at(Isolate* isolate, Address pc,
-                                      Address constant_pool, Address target,
+void Assembler::set_target_address_at(Address pc, Address constant_pool,
+                                      Address target,
                                       ICacheFlushMode icache_flush_mode) {
-  DCHECK_IMPLIES(isolate == nullptr, icache_flush_mode == SKIP_ICACHE_FLUSH);
   Memory::int32_at(pc) = static_cast<int32_t>(target - pc - 4);
   if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(isolate, pc, sizeof(int32_t));
+    Assembler::FlushICache(pc, sizeof(int32_t));
   }
 }
 
 void Assembler::deserialization_set_target_internal_reference_at(
-    Isolate* isolate, Address pc, Address target, RelocInfo::Mode mode) {
+    Address pc, Address target, RelocInfo::Mode mode) {
   Memory::Address_at(pc) = target;
 }
 
@@ -290,8 +269,8 @@ Address Assembler::target_address_from_return_address(Address pc) {
 }
 
 void Assembler::deserialization_set_special_target_at(
-    Isolate* isolate, Address instruction_payload, Code* code, Address target) {
-  set_target_address_at(isolate, instruction_payload,
+    Address instruction_payload, Code* code, Address target) {
+  set_target_address_at(instruction_payload,
                         code ? code->constant_pool() : nullptr, target);
 }
 
@@ -324,7 +303,8 @@ Address RelocInfo::target_address() {
 
 Address RelocInfo::target_address_address() {
   DCHECK(IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_) || IsWasmCall(rmode_) ||
-         rmode_ == EMBEDDED_OBJECT || rmode_ == EXTERNAL_REFERENCE);
+         IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
+         IsOffHeapTarget(rmode_));
   return reinterpret_cast<Address>(pc_);
 }
 
@@ -380,7 +360,7 @@ void RelocInfo::set_target_object(HeapObject* target,
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
   Memory::Object_at(pc_) = target;
   if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(target->GetIsolate(), pc_, sizeof(Address));
+    Assembler::FlushICache(pc_, sizeof(Address));
   }
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr) {
     host()->GetHeap()->incremental_marking()->RecordWriteIntoCode(host(), this,
@@ -395,22 +375,27 @@ Address RelocInfo::target_runtime_entry(Assembler* origin) {
   return origin->runtime_entry_at(pc_);
 }
 
-void RelocInfo::set_target_runtime_entry(Isolate* isolate, Address target,
+void RelocInfo::set_target_runtime_entry(Address target,
                                          WriteBarrierMode write_barrier_mode,
                                          ICacheFlushMode icache_flush_mode) {
   DCHECK(IsRuntimeEntry(rmode_));
   if (target_address() != target) {
-    set_target_address(isolate, target, write_barrier_mode, icache_flush_mode);
+    set_target_address(target, write_barrier_mode, icache_flush_mode);
   }
 }
 
-void RelocInfo::WipeOut(Isolate* isolate) {
+Address RelocInfo::target_off_heap_target() {
+  DCHECK(IsOffHeapTarget(rmode_));
+  return Memory::Address_at(pc_);
+}
+
+void RelocInfo::WipeOut() {
   if (IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
       IsInternalReference(rmode_)) {
     Memory::Address_at(pc_) = nullptr;
   } else if (IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_)) {
     // Effectively write zero into the relocation.
-    Assembler::set_target_address_at(isolate, pc_, constant_pool_,
+    Assembler::set_target_address_at(pc_, constant_pool_,
                                      pc_ + sizeof(int32_t));
   } else {
     UNREACHABLE();
@@ -418,11 +403,11 @@ void RelocInfo::WipeOut(Isolate* isolate) {
 }
 
 template <typename ObjectVisitor>
-void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
+void RelocInfo::Visit(ObjectVisitor* visitor) {
   RelocInfo::Mode mode = rmode();
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
-    Assembler::FlushICache(isolate, pc_, sizeof(Address));
+    Assembler::FlushICache(pc_, sizeof(Address));
   } else if (RelocInfo::IsCodeTarget(mode)) {
     visitor->VisitCodeTarget(host(), this);
   } else if (mode == RelocInfo::EXTERNAL_REFERENCE) {
@@ -431,52 +416,11 @@ void RelocInfo::Visit(Isolate* isolate, ObjectVisitor* visitor) {
     visitor->VisitInternalReference(host(), this);
   } else if (RelocInfo::IsRuntimeEntry(mode)) {
     visitor->VisitRuntimeEntry(host(), this);
+  } else if (RelocInfo::IsOffHeapTarget(mode)) {
+    visitor->VisitOffHeapTarget(host(), this);
   }
 }
 
-// -----------------------------------------------------------------------------
-// Implementation of Operand
-
-void Operand::set_modrm(int mod, Register rm_reg) {
-  DCHECK(is_uint2(mod));
-  buf_[0] = mod << 6 | rm_reg.low_bits();
-  // Set REX.B to the high bit of rm.code().
-  rex_ |= rm_reg.high_bit();
-}
-
-
-void Operand::set_sib(ScaleFactor scale, Register index, Register base) {
-  DCHECK_EQ(len_, 1);
-  DCHECK(is_uint2(scale));
-  // Use SIB with no index register only for base rsp or r12. Otherwise we
-  // would skip the SIB byte entirely.
-  DCHECK(index != rsp || base == rsp || base == r12);
-  buf_[1] = (scale << 6) | (index.low_bits() << 3) | base.low_bits();
-  rex_ |= index.high_bit() << 1 | base.high_bit();
-  len_ = 2;
-}
-
-void Operand::set_disp8(int disp) {
-  DCHECK(is_int8(disp));
-  DCHECK(len_ == 1 || len_ == 2);
-  int8_t* p = reinterpret_cast<int8_t*>(&buf_[len_]);
-  *p = disp;
-  len_ += sizeof(int8_t);
-}
-
-void Operand::set_disp32(int disp) {
-  DCHECK(len_ == 1 || len_ == 2);
-  int32_t* p = reinterpret_cast<int32_t*>(&buf_[len_]);
-  *p = disp;
-  len_ += sizeof(int32_t);
-}
-
-void Operand::set_disp64(int64_t disp) {
-  DCHECK_EQ(1, len_);
-  int64_t* p = reinterpret_cast<int64_t*>(&buf_[len_]);
-  *p = disp;
-  len_ += sizeof(disp);
-}
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/x64/assembler-x64.cc b/deps/v8/src/x64/assembler-x64.cc
index 38cbfc78d92..6f1eaab9ed9 100644
--- a/deps/v8/src/x64/assembler-x64.cc
+++ b/deps/v8/src/x64/assembler-x64.cc
@@ -55,7 +55,7 @@ bool OSHasAVXSupport() {
   size_t buffer_size = arraysize(buffer);
   int ctl_name[] = {CTL_KERN, KERN_OSRELEASE};
   if (sysctl(ctl_name, 2, buffer, &buffer_size, nullptr, 0) != 0) {
-    V8_Fatal(__FILE__, __LINE__, "V8 failed to get kernel version");
+    FATAL("V8 failed to get kernel version");
   }
   // The buffer now contains a string of the form XX.YY.ZZ, where
   // XX is the major kernel version component.
@@ -127,26 +127,26 @@ Address RelocInfo::embedded_address() const { return Memory::Address_at(pc_); }
 
 uint32_t RelocInfo::embedded_size() const { return Memory::uint32_at(pc_); }
 
-void RelocInfo::set_embedded_address(Isolate* isolate, Address address,
+void RelocInfo::set_embedded_address(Address address,
                                      ICacheFlushMode icache_flush_mode) {
   Memory::Address_at(pc_) = address;
   if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(isolate, pc_, sizeof(Address));
+    Assembler::FlushICache(pc_, sizeof(Address));
   }
 }
 
-void RelocInfo::set_embedded_size(Isolate* isolate, uint32_t size,
+void RelocInfo::set_embedded_size(uint32_t size,
                                   ICacheFlushMode icache_flush_mode) {
   Memory::uint32_at(pc_) = size;
   if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(isolate, pc_, sizeof(uint32_t));
+    Assembler::FlushICache(pc_, sizeof(uint32_t));
   }
 }
 
-void RelocInfo::set_js_to_wasm_address(Isolate* isolate, Address address,
+void RelocInfo::set_js_to_wasm_address(Address address,
                                        ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  set_embedded_address(isolate, address, icache_flush_mode);
+  set_embedded_address(address, icache_flush_mode);
 }
 
 Address RelocInfo::js_to_wasm_address() const {
@@ -157,133 +157,189 @@ Address RelocInfo::js_to_wasm_address() const {
 // -----------------------------------------------------------------------------
 // Implementation of Operand
 
-Operand::Operand(Register base, int32_t disp) : rex_(0) {
-  len_ = 1;
-  if (base == rsp || base == r12) {
-    // SIB byte is needed to encode (rsp + offset) or (r12 + offset).
-    set_sib(times_1, rsp, base);
-  }
+namespace {
+class OperandBuilder {
+ public:
+  OperandBuilder(Register base, int32_t disp) {
+    if (base == rsp || base == r12) {
+      // SIB byte is needed to encode (rsp + offset) or (r12 + offset).
+      set_sib(times_1, rsp, base);
+    }
 
-  if (disp == 0 && base != rbp && base != r13) {
-    set_modrm(0, base);
-  } else if (is_int8(disp)) {
-    set_modrm(1, base);
-    set_disp8(disp);
-  } else {
-    set_modrm(2, base);
-    set_disp32(disp);
+    if (disp == 0 && base != rbp && base != r13) {
+      set_modrm(0, base);
+    } else if (is_int8(disp)) {
+      set_modrm(1, base);
+      set_disp8(disp);
+    } else {
+      set_modrm(2, base);
+      set_disp32(disp);
+    }
   }
-}
 
+  OperandBuilder(Register base, Register index, ScaleFactor scale,
+                 int32_t disp) {
+    DCHECK(index != rsp);
+    set_sib(scale, index, base);
+    if (disp == 0 && base != rbp && base != r13) {
+      // This call to set_modrm doesn't overwrite the REX.B (or REX.X) bits
+      // possibly set by set_sib.
+      set_modrm(0, rsp);
+    } else if (is_int8(disp)) {
+      set_modrm(1, rsp);
+      set_disp8(disp);
+    } else {
+      set_modrm(2, rsp);
+      set_disp32(disp);
+    }
+  }
 
-Operand::Operand(Register base,
-                 Register index,
-                 ScaleFactor scale,
-                 int32_t disp) : rex_(0) {
-  DCHECK(index != rsp);
-  len_ = 1;
-  set_sib(scale, index, base);
-  if (disp == 0 && base != rbp && base != r13) {
-    // This call to set_modrm doesn't overwrite the REX.B (or REX.X) bits
-    // possibly set by set_sib.
+  OperandBuilder(Register index, ScaleFactor scale, int32_t disp) {
+    DCHECK(index != rsp);
     set_modrm(0, rsp);
-  } else if (is_int8(disp)) {
-    set_modrm(1, rsp);
-    set_disp8(disp);
-  } else {
-    set_modrm(2, rsp);
+    set_sib(scale, index, rbp);
     set_disp32(disp);
   }
-}
 
+  OperandBuilder(Label* label, int addend) {
+    data_.addend = addend;
+    DCHECK_NOT_NULL(label);
+    DCHECK(addend == 0 || (is_int8(addend) && label->is_bound()));
+    set_modrm(0, rbp);
+    set_disp64(reinterpret_cast<intptr_t>(label));
+  }
+
+  OperandBuilder(Operand operand, int32_t offset) {
+    DCHECK_GE(operand.data().len, 1);
+    // Operand encodes REX ModR/M [SIB] [Disp].
+    byte modrm = operand.data().buf[0];
+    DCHECK_LT(modrm, 0xC0);  // Disallow mode 3 (register target).
+    bool has_sib = ((modrm & 0x07) == 0x04);
+    byte mode = modrm & 0xC0;
+    int disp_offset = has_sib ? 2 : 1;
+    int base_reg = (has_sib ? operand.data().buf[1] : modrm) & 0x07;
+    // Mode 0 with rbp/r13 as ModR/M or SIB base register always has a 32-bit
+    // displacement.
+    bool is_baseless =
+        (mode == 0) && (base_reg == 0x05);  // No base or RIP base.
+    int32_t disp_value = 0;
+    if (mode == 0x80 || is_baseless) {
+      // Mode 2 or mode 0 with rbp/r13 as base: Word displacement.
+      disp_value = *bit_cast<const int32_t*>(&operand.data().buf[disp_offset]);
+    } else if (mode == 0x40) {
+      // Mode 1: Byte displacement.
+      disp_value = static_cast<signed char>(operand.data().buf[disp_offset]);
+    }
 
-Operand::Operand(Register index,
-                 ScaleFactor scale,
-                 int32_t disp) : rex_(0) {
-  DCHECK(index != rsp);
-  len_ = 1;
-  set_modrm(0, rsp);
-  set_sib(scale, index, rbp);
-  set_disp32(disp);
-}
-
-
-Operand::Operand(Label* label) : rex_(0), len_(1) {
-  DCHECK_NOT_NULL(label);
-  set_modrm(0, rbp);
-  set_disp64(reinterpret_cast<intptr_t>(label));
-}
-
-
-Operand::Operand(const Operand& operand, int32_t offset) {
-  DCHECK_GE(operand.len_, 1);
-  // Operand encodes REX ModR/M [SIB] [Disp].
-  byte modrm = operand.buf_[0];
-  DCHECK_LT(modrm, 0xC0);  // Disallow mode 3 (register target).
-  bool has_sib = ((modrm & 0x07) == 0x04);
-  byte mode = modrm & 0xC0;
-  int disp_offset = has_sib ? 2 : 1;
-  int base_reg = (has_sib ? operand.buf_[1] : modrm) & 0x07;
-  // Mode 0 with rbp/r13 as ModR/M or SIB base register always has a 32-bit
-  // displacement.
-  bool is_baseless = (mode == 0) && (base_reg == 0x05);  // No base or RIP base.
-  int32_t disp_value = 0;
-  if (mode == 0x80 || is_baseless) {
-    // Mode 2 or mode 0 with rbp/r13 as base: Word displacement.
-    disp_value = *bit_cast<const int32_t*>(&operand.buf_[disp_offset]);
-  } else if (mode == 0x40) {
-    // Mode 1: Byte displacement.
-    disp_value = static_cast<signed char>(operand.buf_[disp_offset]);
+    // Write new operand with same registers, but with modified displacement.
+    DCHECK(offset >= 0 ? disp_value + offset > disp_value
+                       : disp_value + offset < disp_value);  // No overflow.
+    disp_value += offset;
+    data_.rex = operand.data().rex;
+    if (!is_int8(disp_value) || is_baseless) {
+      // Need 32 bits of displacement, mode 2 or mode 1 with register rbp/r13.
+      data_.buf[0] = (modrm & 0x3F) | (is_baseless ? 0x00 : 0x80);
+      data_.len = disp_offset + 4;
+      Memory::int32_at(&data_.buf[disp_offset]) = disp_value;
+    } else if (disp_value != 0 || (base_reg == 0x05)) {
+      // Need 8 bits of displacement.
+      data_.buf[0] = (modrm & 0x3F) | 0x40;  // Mode 1.
+      data_.len = disp_offset + 1;
+      data_.buf[disp_offset] = static_cast<byte>(disp_value);
+    } else {
+      // Need no displacement.
+      data_.buf[0] = (modrm & 0x3F);  // Mode 0.
+      data_.len = disp_offset;
+    }
+    if (has_sib) {
+      data_.buf[1] = operand.data().buf[1];
+    }
   }
 
-  // Write new operand with same registers, but with modified displacement.
-  DCHECK(offset >= 0 ? disp_value + offset > disp_value
-                     : disp_value + offset < disp_value);  // No overflow.
-  disp_value += offset;
-  rex_ = operand.rex_;
-  if (!is_int8(disp_value) || is_baseless) {
-    // Need 32 bits of displacement, mode 2 or mode 1 with register rbp/r13.
-    buf_[0] = (modrm & 0x3F) | (is_baseless ? 0x00 : 0x80);
-    len_ = disp_offset + 4;
-    Memory::int32_at(&buf_[disp_offset]) = disp_value;
-  } else if (disp_value != 0 || (base_reg == 0x05)) {
-    // Need 8 bits of displacement.
-    buf_[0] = (modrm & 0x3F) | 0x40;  // Mode 1.
-    len_ = disp_offset + 1;
-    buf_[disp_offset] = static_cast<byte>(disp_value);
-  } else {
-    // Need no displacement.
-    buf_[0] = (modrm & 0x3F);  // Mode 0.
-    len_ = disp_offset;
+  void set_modrm(int mod, Register rm_reg) {
+    DCHECK(is_uint2(mod));
+    data_.buf[0] = mod << 6 | rm_reg.low_bits();
+    // Set REX.B to the high bit of rm.code().
+    data_.rex |= rm_reg.high_bit();
   }
-  if (has_sib) {
-    buf_[1] = operand.buf_[1];
+
+  void set_sib(ScaleFactor scale, Register index, Register base) {
+    DCHECK_EQ(data_.len, 1);
+    DCHECK(is_uint2(scale));
+    // Use SIB with no index register only for base rsp or r12. Otherwise we
+    // would skip the SIB byte entirely.
+    DCHECK(index != rsp || base == rsp || base == r12);
+    data_.buf[1] = (scale << 6) | (index.low_bits() << 3) | base.low_bits();
+    data_.rex |= index.high_bit() << 1 | base.high_bit();
+    data_.len = 2;
   }
-}
 
+  void set_disp8(int disp) {
+    DCHECK(is_int8(disp));
+    DCHECK(data_.len == 1 || data_.len == 2);
+    int8_t* p = reinterpret_cast<int8_t*>(&data_.buf[data_.len]);
+    *p = disp;
+    data_.len += sizeof(int8_t);
+  }
+
+  void set_disp32(int disp) {
+    DCHECK(data_.len == 1 || data_.len == 2);
+    int32_t* p = reinterpret_cast<int32_t*>(&data_.buf[data_.len]);
+    *p = disp;
+    data_.len += sizeof(int32_t);
+  }
+
+  void set_disp64(int64_t disp) {
+    DCHECK_EQ(1, data_.len);
+    int64_t* p = reinterpret_cast<int64_t*>(&data_.buf[data_.len]);
+    *p = disp;
+    data_.len += sizeof(disp);
+  }
+
+  const Operand::Data& data() const { return data_; }
+
+ private:
+  Operand::Data data_;
+};
+}  // namespace
+
+Operand::Operand(Register base, int32_t disp)
+    : data_(OperandBuilder(base, disp).data()) {}
+
+Operand::Operand(Register base, Register index, ScaleFactor scale, int32_t disp)
+    : data_(OperandBuilder(base, index, scale, disp).data()) {}
+
+Operand::Operand(Register index, ScaleFactor scale, int32_t disp)
+    : data_(OperandBuilder(index, scale, disp).data()) {}
+
+Operand::Operand(Label* label, int addend)
+    : data_(OperandBuilder(label, addend).data()) {}
+
+Operand::Operand(Operand operand, int32_t offset)
+    : data_(OperandBuilder(operand, offset).data()) {}
 
 bool Operand::AddressUsesRegister(Register reg) const {
   int code = reg.code();
-  DCHECK_NE(buf_[0] & 0xC0, 0xC0);  // Always a memory operand.
-  // Start with only low three bits of base register. Initial decoding doesn't
-  // distinguish on the REX.B bit.
-  int base_code = buf_[0] & 0x07;
+  DCHECK_NE(data_.buf[0] & 0xC0, 0xC0);  // Always a memory operand.
+  // Start with only low three bits of base register. Initial decoding
+  // doesn't distinguish on the REX.B bit.
+  int base_code = data_.buf[0] & 0x07;
   if (base_code == rsp.code()) {
     // SIB byte present in buf_[1].
     // Check the index register from the SIB byte + REX.X prefix.
-    int index_code = ((buf_[1] >> 3) & 0x07) | ((rex_ & 0x02) << 2);
+    int index_code = ((data_.buf[1] >> 3) & 0x07) | ((data_.rex & 0x02) << 2);
     // Index code (including REX.X) of 0x04 (rsp) means no index register.
     if (index_code != rsp.code() && index_code == code) return true;
     // Add REX.B to get the full base register code.
-    base_code = (buf_[1] & 0x07) | ((rex_ & 0x01) << 3);
+    base_code = (data_.buf[1] & 0x07) | ((data_.rex & 0x01) << 3);
     // A base register of 0x05 (rbp) with mod = 0 means no base register.
-    if (base_code == rbp.code() && ((buf_[0] & 0xC0) == 0)) return false;
+    if (base_code == rbp.code() && ((data_.buf[0] & 0xC0) == 0)) return false;
     return code == base_code;
   } else {
     // A base register with low bits of 0x05 (rbp or r13) and mod = 0 means
     // no base register.
-    if (base_code == rbp.code() && ((buf_[0] & 0xC0) == 0)) return false;
-    base_code |= ((rex_ & 0x01) << 3);
+    if (base_code == rbp.code() && ((data_.buf[0] & 0xC0) == 0)) return false;
+    base_code |= ((data_.rex & 0x01) << 3);
     return code == base_code;
   }
 }
@@ -486,7 +542,7 @@ void Assembler::GrowBuffer() {
   // Some internal data structures overflow for very large buffers,
   // they must ensure that kMaximalBufferSize is not too large.
   if (desc.buffer_size > kMaximalBufferSize) {
-    V8::FatalProcessOutOfMemory("Assembler::GrowBuffer");
+    V8::FatalProcessOutOfMemory(nullptr, "Assembler::GrowBuffer");
   }
 
   // Set up new buffer.
@@ -527,22 +583,22 @@ void Assembler::GrowBuffer() {
   DCHECK(!buffer_overflow());
 }
 
-
-void Assembler::emit_operand(int code, const Operand& adr) {
+void Assembler::emit_operand(int code, Operand adr) {
   DCHECK(is_uint3(code));
-  const unsigned length = adr.len_;
+  const unsigned length = adr.data().len;
   DCHECK_GT(length, 0);
 
   // Emit updated ModR/M byte containing the given register.
-  DCHECK_EQ(adr.buf_[0] & 0x38, 0);
-  *pc_++ = adr.buf_[0] | code << 3;
+  DCHECK_EQ(adr.data().buf[0] & 0x38, 0);
+  *pc_++ = adr.data().buf[0] | code << 3;
 
   // Recognize RIP relative addressing.
-  if (adr.buf_[0] == 5) {
+  if (adr.data().buf[0] == 5) {
     DCHECK_EQ(9u, length);
-    Label* label = *bit_cast<Label* const*>(&adr.buf_[1]);
+    Label* label = *bit_cast<Label* const*>(&adr.data().buf[1]);
     if (label->is_bound()) {
-      int offset = label->pos() - pc_offset() - sizeof(int32_t);
+      int offset =
+          label->pos() - pc_offset() - sizeof(int32_t) + adr.data().addend;
       DCHECK_GE(0, offset);
       emitl(offset);
     } else if (label->is_linked()) {
@@ -556,17 +612,14 @@ void Assembler::emit_operand(int code, const Operand& adr) {
     }
   } else {
     // Emit the rest of the encoded operand.
-    for (unsigned i = 1; i < length; i++) *pc_++ = adr.buf_[i];
+    for (unsigned i = 1; i < length; i++) *pc_++ = adr.data().buf[i];
   }
 }
 
 
 // Assembler Instruction implementations.
 
-void Assembler::arithmetic_op(byte opcode,
-                              Register reg,
-                              const Operand& op,
-                              int size) {
+void Assembler::arithmetic_op(byte opcode, Register reg, Operand op, int size) {
   EnsureSpace ensure_space(this);
   emit_rex(reg, op, size);
   emit(opcode);
@@ -610,10 +663,7 @@ void Assembler::arithmetic_op_16(byte opcode, Register reg, Register rm_reg) {
   }
 }
 
-
-void Assembler::arithmetic_op_16(byte opcode,
-                                 Register reg,
-                                 const Operand& rm_reg) {
+void Assembler::arithmetic_op_16(byte opcode, Register reg, Operand rm_reg) {
   EnsureSpace ensure_space(this);
   emit(0x66);
   emit_optional_rex_32(reg, rm_reg);
@@ -621,8 +671,7 @@ void Assembler::arithmetic_op_16(byte opcode,
   emit_operand(reg, rm_reg);
 }
 
-
-void Assembler::arithmetic_op_8(byte opcode, Register reg, const Operand& op) {
+void Assembler::arithmetic_op_8(byte opcode, Register reg, Operand op) {
   EnsureSpace ensure_space(this);
   if (!reg.is_byte_register()) {
     emit_rex_32(reg, op);
@@ -676,10 +725,8 @@ void Assembler::immediate_arithmetic_op(byte subcode,
   }
 }
 
-void Assembler::immediate_arithmetic_op(byte subcode,
-                                        const Operand& dst,
-                                        Immediate src,
-                                        int size) {
+void Assembler::immediate_arithmetic_op(byte subcode, Operand dst,
+                                        Immediate src, int size) {
   EnsureSpace ensure_space(this);
   emit_rex(dst, size);
   if (is_int8(src.value_) && RelocInfo::IsNone(src.rmode_)) {
@@ -714,9 +761,7 @@ void Assembler::immediate_arithmetic_op_16(byte subcode,
   }
 }
 
-
-void Assembler::immediate_arithmetic_op_16(byte subcode,
-                                           const Operand& dst,
+void Assembler::immediate_arithmetic_op_16(byte subcode, Operand dst,
                                            Immediate src) {
   EnsureSpace ensure_space(this);
   emit(0x66);  // Operand size override prefix.
@@ -732,9 +777,7 @@ void Assembler::immediate_arithmetic_op_16(byte subcode,
   }
 }
 
-
-void Assembler::immediate_arithmetic_op_8(byte subcode,
-                                          const Operand& dst,
+void Assembler::immediate_arithmetic_op_8(byte subcode, Operand dst,
                                           Immediate src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst);
@@ -813,8 +856,7 @@ void Assembler::shift(Operand dst, int subcode, int size) {
   emit_operand(subcode, dst);
 }
 
-
-void Assembler::bt(const Operand& dst, Register src) {
+void Assembler::bt(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   emit_rex_64(src, dst);
   emit(0x0F);
@@ -822,8 +864,7 @@ void Assembler::bt(const Operand& dst, Register src) {
   emit_operand(src, dst);
 }
 
-
-void Assembler::bts(const Operand& dst, Register src) {
+void Assembler::bts(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   emit_rex_64(src, dst);
   emit(0x0F);
@@ -840,8 +881,7 @@ void Assembler::bsrl(Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::bsrl(Register dst, const Operand& src) {
+void Assembler::bsrl(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -858,8 +898,7 @@ void Assembler::bsrq(Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::bsrq(Register dst, const Operand& src) {
+void Assembler::bsrq(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_rex_64(dst, src);
   emit(0x0F);
@@ -876,8 +915,7 @@ void Assembler::bsfl(Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::bsfl(Register dst, const Operand& src) {
+void Assembler::bsfl(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -894,8 +932,7 @@ void Assembler::bsfq(Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::bsfq(Register dst, const Operand& src) {
+void Assembler::bsfq(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_rex_64(dst, src);
   emit(0x0F);
@@ -912,7 +949,7 @@ void Assembler::pshufw(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
   emit(shuffle);
 }
 
-void Assembler::pshufw(XMMRegister dst, const Operand& src, uint8_t shuffle) {
+void Assembler::pshufw(XMMRegister dst, Operand src, uint8_t shuffle) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -990,8 +1027,7 @@ void Assembler::call(Register adr) {
   emit_modrm(0x2, adr);
 }
 
-
-void Assembler::call(const Operand& op) {
+void Assembler::call(Operand op) {
   EnsureSpace ensure_space(this);
   // Opcode: FF /2 m64.
   emit_optional_rex_32(op);
@@ -1049,8 +1085,7 @@ void Assembler::cmovq(Condition cc, Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::cmovq(Condition cc, Register dst, const Operand& src) {
+void Assembler::cmovq(Condition cc, Register dst, Operand src) {
   if (cc == always) {
     movq(dst, src);
   } else if (cc == never) {
@@ -1081,8 +1116,7 @@ void Assembler::cmovl(Condition cc, Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::cmovl(Condition cc, Register dst, const Operand& src) {
+void Assembler::cmovl(Condition cc, Register dst, Operand src) {
   if (cc == always) {
     movl(dst, src);
   } else if (cc == never) {
@@ -1110,7 +1144,7 @@ void Assembler::lock() {
   emit(0xF0);
 }
 
-void Assembler::cmpxchgb(const Operand& dst, Register src) {
+void Assembler::cmpxchgb(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   if (!src.is_byte_register()) {
     // Register is not one of al, bl, cl, dl.  Its encoding needs REX.
@@ -1123,7 +1157,7 @@ void Assembler::cmpxchgb(const Operand& dst, Register src) {
   emit_operand(src, dst);
 }
 
-void Assembler::cmpxchgw(const Operand& dst, Register src) {
+void Assembler::cmpxchgw(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   emit(0x66);
   emit_optional_rex_32(src, dst);
@@ -1132,7 +1166,7 @@ void Assembler::cmpxchgw(const Operand& dst, Register src) {
   emit_operand(src, dst);
 }
 
-void Assembler::emit_cmpxchg(const Operand& dst, Register src, int size) {
+void Assembler::emit_cmpxchg(Operand dst, Register src, int size) {
   EnsureSpace ensure_space(this);
   emit_rex(src, dst, size);
   emit(0x0F);
@@ -1168,8 +1202,7 @@ void Assembler::emit_dec(Register dst, int size) {
   emit_modrm(0x1, dst);
 }
 
-
-void Assembler::emit_dec(const Operand& dst, int size) {
+void Assembler::emit_dec(Operand dst, int size) {
   EnsureSpace ensure_space(this);
   emit_rex(dst, size);
   emit(0xFF);
@@ -1187,8 +1220,7 @@ void Assembler::decb(Register dst) {
   emit_modrm(0x1, dst);
 }
 
-
-void Assembler::decb(const Operand& dst) {
+void Assembler::decb(Operand dst) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst);
   emit(0xFE);
@@ -1233,8 +1265,7 @@ void Assembler::emit_imul(Register src, int size) {
   emit_modrm(0x5, src);
 }
 
-
-void Assembler::emit_imul(const Operand& src, int size) {
+void Assembler::emit_imul(Operand src, int size) {
   EnsureSpace ensure_space(this);
   emit_rex(src, size);
   emit(0xF7);
@@ -1250,8 +1281,7 @@ void Assembler::emit_imul(Register dst, Register src, int size) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::emit_imul(Register dst, const Operand& src, int size) {
+void Assembler::emit_imul(Register dst, Operand src, int size) {
   EnsureSpace ensure_space(this);
   emit_rex(dst, src, size);
   emit(0x0F);
@@ -1274,9 +1304,7 @@ void Assembler::emit_imul(Register dst, Register src, Immediate imm, int size) {
   }
 }
 
-
-void Assembler::emit_imul(Register dst, const Operand& src, Immediate imm,
-                          int size) {
+void Assembler::emit_imul(Register dst, Operand src, Immediate imm, int size) {
   EnsureSpace ensure_space(this);
   emit_rex(dst, src, size);
   if (is_int8(imm.value_)) {
@@ -1298,8 +1326,7 @@ void Assembler::emit_inc(Register dst, int size) {
   emit_modrm(0x0, dst);
 }
 
-
-void Assembler::emit_inc(const Operand& dst, int size) {
+void Assembler::emit_inc(Operand dst, int size) {
   EnsureSpace ensure_space(this);
   emit_rex(dst, size);
   emit(0xFF);
@@ -1483,8 +1510,7 @@ void Assembler::jmp(Register target) {
   emit_modrm(0x4, target);
 }
 
-
-void Assembler::jmp(const Operand& src) {
+void Assembler::jmp(Operand src) {
   EnsureSpace ensure_space(this);
   // Opcode FF/4 m64.
   emit_optional_rex_32(src);
@@ -1492,8 +1518,7 @@ void Assembler::jmp(const Operand& src) {
   emit_operand(0x4, src);
 }
 
-
-void Assembler::emit_lea(Register dst, const Operand& src, int size) {
+void Assembler::emit_lea(Register dst, Operand src, int size) {
   EnsureSpace ensure_space(this);
   emit_rex(dst, src, size);
   emit(0x8D);
@@ -1529,8 +1554,7 @@ void Assembler::leave() {
   emit(0xC9);
 }
 
-
-void Assembler::movb(Register dst, const Operand& src) {
+void Assembler::movb(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   if (!dst.is_byte_register()) {
     // Register is not one of al, bl, cl, dl.  Its encoding needs REX.
@@ -1553,8 +1577,7 @@ void Assembler::movb(Register dst, Immediate imm) {
   emit(imm.value_);
 }
 
-
-void Assembler::movb(const Operand& dst, Register src) {
+void Assembler::movb(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   if (!src.is_byte_register()) {
     // Register is not one of al, bl, cl, dl.  Its encoding needs REX.
@@ -1566,8 +1589,7 @@ void Assembler::movb(const Operand& dst, Register src) {
   emit_operand(src, dst);
 }
 
-
-void Assembler::movb(const Operand& dst, Immediate imm) {
+void Assembler::movb(Operand dst, Immediate imm) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst);
   emit(0xC6);
@@ -1575,8 +1597,7 @@ void Assembler::movb(const Operand& dst, Immediate imm) {
   emit(static_cast<byte>(imm.value_));
 }
 
-
-void Assembler::movw(Register dst, const Operand& src) {
+void Assembler::movw(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0x66);
   emit_optional_rex_32(dst, src);
@@ -1584,8 +1605,7 @@ void Assembler::movw(Register dst, const Operand& src) {
   emit_operand(dst, src);
 }
 
-
-void Assembler::movw(const Operand& dst, Register src) {
+void Assembler::movw(Operand dst, Register src) {
   EnsureSpace ensure_space(this);
   emit(0x66);
   emit_optional_rex_32(src, dst);
@@ -1593,8 +1613,7 @@ void Assembler::movw(const Operand& dst, Register src) {
   emit_operand(src, dst);
 }
 
-
-void Assembler::movw(const Operand& dst, Immediate imm) {
+void Assembler::movw(Operand dst, Immediate imm) {
   EnsureSpace ensure_space(this);
   emit(0x66);
   emit_optional_rex_32(dst);
@@ -1604,8 +1623,7 @@ void Assembler::movw(const Operand& dst, Immediate imm) {
   emit(static_cast<byte>(imm.value_ >> 8));
 }
 
-
-void Assembler::emit_mov(Register dst, const Operand& src, int size) {
+void Assembler::emit_mov(Register dst, Operand src, int size) {
   EnsureSpace ensure_space(this);
   emit_rex(dst, src, size);
   emit(0x8B);
@@ -1626,8 +1644,7 @@ void Assembler::emit_mov(Register dst, Register src, int size) {
   }
 }
 
-
-void Assembler::emit_mov(const Operand& dst, Register src, int size) {
+void Assembler::emit_mov(Operand dst, Register src, int size) {
   EnsureSpace ensure_space(this);
   emit_rex(src, dst, size);
   emit(0x89);
@@ -1648,8 +1665,7 @@ void Assembler::emit_mov(Register dst, Immediate value, int size) {
   emit(value);
 }
 
-
-void Assembler::emit_mov(const Operand& dst, Immediate value, int size) {
+void Assembler::emit_mov(Operand dst, Immediate value, int size) {
   EnsureSpace ensure_space(this);
   emit_rex(dst, size);
   emit(0xC7);
@@ -1689,7 +1705,7 @@ void Assembler::movq(Register dst, uint64_t value, RelocInfo::Mode rmode) {
 
 // Loads the ip-relative location of the src label into the target location
 // (as a 32-bit offset sign extended to 64-bit).
-void Assembler::movl(const Operand& dst, Label* src) {
+void Assembler::movl(Operand dst, Label* src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst);
   emit(0xC7);
@@ -1723,8 +1739,7 @@ void Assembler::movsxbl(Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::movsxbl(Register dst, const Operand& src) {
+void Assembler::movsxbl(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -1732,8 +1747,7 @@ void Assembler::movsxbl(Register dst, const Operand& src) {
   emit_operand(dst, src);
 }
 
-
-void Assembler::movsxbq(Register dst, const Operand& src) {
+void Assembler::movsxbq(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_rex_64(dst, src);
   emit(0x0F);
@@ -1757,8 +1771,7 @@ void Assembler::movsxwl(Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::movsxwl(Register dst, const Operand& src) {
+void Assembler::movsxwl(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -1766,8 +1779,7 @@ void Assembler::movsxwl(Register dst, const Operand& src) {
   emit_operand(dst, src);
 }
 
-
-void Assembler::movsxwq(Register dst, const Operand& src) {
+void Assembler::movsxwq(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_rex_64(dst, src);
   emit(0x0F);
@@ -1790,16 +1802,14 @@ void Assembler::movsxlq(Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::movsxlq(Register dst, const Operand& src) {
+void Assembler::movsxlq(Register dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_rex_64(dst, src);
   emit(0x63);
   emit_operand(dst, src);
 }
 
-
-void Assembler::emit_movzxb(Register dst, const Operand& src, int size) {
+void Assembler::emit_movzxb(Register dst, Operand src, int size) {
   EnsureSpace ensure_space(this);
   // 32 bit operations zero the top 32 bits of 64 bit registers.  Therefore
   // there is no need to make this a 64 bit operation.
@@ -1825,8 +1835,7 @@ void Assembler::emit_movzxb(Register dst, Register src, int size) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::emit_movzxw(Register dst, const Operand& src, int size) {
+void Assembler::emit_movzxw(Register dst, Operand src, int size) {
   EnsureSpace ensure_space(this);
   // 32 bit operations zero the top 32 bits of 64 bit registers.  Therefore
   // there is no need to make this a 64 bit operation.
@@ -1878,8 +1887,7 @@ void Assembler::mull(Register src) {
   emit_modrm(0x4, src);
 }
 
-
-void Assembler::mull(const Operand& src) {
+void Assembler::mull(Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(src);
   emit(0xF7);
@@ -1902,8 +1910,7 @@ void Assembler::emit_neg(Register dst, int size) {
   emit_modrm(0x3, dst);
 }
 
-
-void Assembler::emit_neg(const Operand& dst, int size) {
+void Assembler::emit_neg(Operand dst, int size) {
   EnsureSpace ensure_space(this);
   emit_rex_64(dst);
   emit(0xF7);
@@ -1924,8 +1931,7 @@ void Assembler::emit_not(Register dst, int size) {
   emit_modrm(0x2, dst);
 }
 
-
-void Assembler::emit_not(const Operand& dst, int size) {
+void Assembler::emit_not(Operand dst, int size) {
   EnsureSpace ensure_space(this);
   emit_rex(dst, size);
   emit(0xF7);
@@ -1953,6 +1959,7 @@ void Assembler::Nop(int n) {
     switch (n) {
       case 2:
         emit(0x66);
+        V8_FALLTHROUGH;
       case 1:
         emit(0x90);
         return;
@@ -1969,6 +1976,7 @@ void Assembler::Nop(int n) {
         return;
       case 6:
         emit(0x66);
+        V8_FALLTHROUGH;
       case 5:
         emit(0x0F);
         emit(0x1F);
@@ -1989,12 +1997,15 @@ void Assembler::Nop(int n) {
       case 11:
         emit(0x66);
         n--;
+        V8_FALLTHROUGH;
       case 10:
         emit(0x66);
         n--;
+        V8_FALLTHROUGH;
       case 9:
         emit(0x66);
         n--;
+        V8_FALLTHROUGH;
       case 8:
         emit(0x0F);
         emit(0x1F);
@@ -2016,8 +2027,7 @@ void Assembler::popq(Register dst) {
   emit(0x58 | dst.low_bits());
 }
 
-
-void Assembler::popq(const Operand& dst) {
+void Assembler::popq(Operand dst) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst);
   emit(0x8F);
@@ -2037,8 +2047,7 @@ void Assembler::pushq(Register src) {
   emit(0x50 | src.low_bits());
 }
 
-
-void Assembler::pushq(const Operand& src) {
+void Assembler::pushq(Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(src);
   emit(0xFF);
@@ -2125,7 +2134,7 @@ void Assembler::shrd(Register dst, Register src) {
   emit_modrm(src, dst);
 }
 
-void Assembler::xchgb(Register reg, const Operand& op) {
+void Assembler::xchgb(Register reg, Operand op) {
   EnsureSpace ensure_space(this);
   if (!reg.is_byte_register()) {
     // Register is not one of al, bl, cl, dl.  Its encoding needs REX.
@@ -2137,7 +2146,7 @@ void Assembler::xchgb(Register reg, const Operand& op) {
   emit_operand(reg, op);
 }
 
-void Assembler::xchgw(Register reg, const Operand& op) {
+void Assembler::xchgw(Register reg, Operand op) {
   EnsureSpace ensure_space(this);
   emit(0x66);
   emit_optional_rex_32(reg, op);
@@ -2162,8 +2171,7 @@ void Assembler::emit_xchg(Register dst, Register src, int size) {
   }
 }
 
-
-void Assembler::emit_xchg(Register dst, const Operand& src, int size) {
+void Assembler::emit_xchg(Register dst, Operand src, int size) {
   EnsureSpace ensure_space(this);
   emit_rex(dst, src, size);
   emit(0x87);
@@ -2193,6 +2201,12 @@ void Assembler::store_rax(ExternalReference ref) {
   store_rax(ref.address(), RelocInfo::EXTERNAL_REFERENCE);
 }
 
+void Assembler::sub_sp_32(uint32_t imm) {
+  emit_rex_64();
+  emit(0x81);  // using a literal 32-bit immediate.
+  emit_modrm(0x5, rsp);
+  emitl(imm);
+}
 
 void Assembler::testb(Register dst, Register src) {
   EnsureSpace ensure_space(this);
@@ -2204,13 +2218,12 @@ void Assembler::testb(Register reg, Immediate mask) {
   emit_test(reg, mask, sizeof(int8_t));
 }
 
-void Assembler::testb(const Operand& op, Immediate mask) {
+void Assembler::testb(Operand op, Immediate mask) {
   DCHECK(is_int8(mask.value_) || is_uint8(mask.value_));
   emit_test(op, mask, sizeof(int8_t));
 }
 
-
-void Assembler::testb(const Operand& op, Register reg) {
+void Assembler::testb(Operand op, Register reg) {
   emit_test(op, reg, sizeof(int8_t));
 }
 
@@ -2222,11 +2235,11 @@ void Assembler::testw(Register reg, Immediate mask) {
   emit_test(reg, mask, sizeof(int16_t));
 }
 
-void Assembler::testw(const Operand& op, Immediate mask) {
+void Assembler::testw(Operand op, Immediate mask) {
   emit_test(op, mask, sizeof(int16_t));
 }
 
-void Assembler::testw(const Operand& op, Register reg) {
+void Assembler::testw(Operand op, Register reg) {
   emit_test(op, reg, sizeof(int16_t));
 }
 
@@ -2285,7 +2298,7 @@ void Assembler::emit_test(Register reg, Immediate mask, int size) {
   }
 }
 
-void Assembler::emit_test(const Operand& op, Immediate mask, int size) {
+void Assembler::emit_test(Operand op, Immediate mask, int size) {
   if (is_uint8(mask.value_)) {
     size = sizeof(int8_t);
   } else if (is_uint16(mask.value_)) {
@@ -2313,7 +2326,7 @@ void Assembler::emit_test(const Operand& op, Immediate mask, int size) {
   }
 }
 
-void Assembler::emit_test(const Operand& op, Register reg, int size) {
+void Assembler::emit_test(Operand op, Register reg, int size) {
   EnsureSpace ensure_space(this);
   if (size == sizeof(int16_t)) {
     emit(0x66);
@@ -2372,32 +2385,28 @@ void Assembler::fldln2() {
   emit(0xED);
 }
 
-
-void Assembler::fld_s(const Operand& adr) {
+void Assembler::fld_s(Operand adr) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(adr);
   emit(0xD9);
   emit_operand(0, adr);
 }
 
-
-void Assembler::fld_d(const Operand& adr) {
+void Assembler::fld_d(Operand adr) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(adr);
   emit(0xDD);
   emit_operand(0, adr);
 }
 
-
-void Assembler::fstp_s(const Operand& adr) {
+void Assembler::fstp_s(Operand adr) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(adr);
   emit(0xD9);
   emit_operand(3, adr);
 }
 
-
-void Assembler::fstp_d(const Operand& adr) {
+void Assembler::fstp_d(Operand adr) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(adr);
   emit(0xDD);
@@ -2411,32 +2420,28 @@ void Assembler::fstp(int index) {
   emit_farith(0xDD, 0xD8, index);
 }
 
-
-void Assembler::fild_s(const Operand& adr) {
+void Assembler::fild_s(Operand adr) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(adr);
   emit(0xDB);
   emit_operand(0, adr);
 }
 
-
-void Assembler::fild_d(const Operand& adr) {
+void Assembler::fild_d(Operand adr) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(adr);
   emit(0xDF);
   emit_operand(5, adr);
 }
 
-
-void Assembler::fistp_s(const Operand& adr) {
+void Assembler::fistp_s(Operand adr) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(adr);
   emit(0xDB);
   emit_operand(3, adr);
 }
 
-
-void Assembler::fisttp_s(const Operand& adr) {
+void Assembler::fisttp_s(Operand adr) {
   DCHECK(IsEnabled(SSE3));
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(adr);
@@ -2444,8 +2449,7 @@ void Assembler::fisttp_s(const Operand& adr) {
   emit_operand(1, adr);
 }
 
-
-void Assembler::fisttp_d(const Operand& adr) {
+void Assembler::fisttp_d(Operand adr) {
   DCHECK(IsEnabled(SSE3));
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(adr);
@@ -2453,16 +2457,14 @@ void Assembler::fisttp_d(const Operand& adr) {
   emit_operand(1, adr);
 }
 
-
-void Assembler::fist_s(const Operand& adr) {
+void Assembler::fist_s(Operand adr) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(adr);
   emit(0xDB);
   emit_operand(2, adr);
 }
 
-
-void Assembler::fistp_d(const Operand& adr) {
+void Assembler::fistp_d(Operand adr) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(adr);
   emit(0xDF);
@@ -2544,8 +2546,7 @@ void Assembler::fsub(int i) {
   emit_farith(0xDC, 0xE8, i);
 }
 
-
-void Assembler::fisub_s(const Operand& adr) {
+void Assembler::fisub_s(Operand adr) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(adr);
   emit(0xDA);
@@ -2723,8 +2724,7 @@ void Assembler::andps(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::andps(XMMRegister dst, const Operand& src) {
+void Assembler::andps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -2741,8 +2741,7 @@ void Assembler::orps(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::orps(XMMRegister dst, const Operand& src) {
+void Assembler::orps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -2760,8 +2759,7 @@ void Assembler::xorps(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::xorps(XMMRegister dst, const Operand& src) {
+void Assembler::xorps(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
@@ -2779,8 +2777,7 @@ void Assembler::addps(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::addps(XMMRegister dst, const Operand& src) {
+void Assembler::addps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -2797,8 +2794,7 @@ void Assembler::subps(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::subps(XMMRegister dst, const Operand& src) {
+void Assembler::subps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -2815,8 +2811,7 @@ void Assembler::mulps(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::mulps(XMMRegister dst, const Operand& src) {
+void Assembler::mulps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -2833,8 +2828,7 @@ void Assembler::divps(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::divps(XMMRegister dst, const Operand& src) {
+void Assembler::divps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -2855,8 +2849,7 @@ void Assembler::movd(XMMRegister dst, Register src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::movd(XMMRegister dst, const Operand& src) {
+void Assembler::movd(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0x66);
@@ -2919,8 +2912,7 @@ void Assembler::movq(XMMRegister dst, XMMRegister src) {
   }
 }
 
-
-void Assembler::movdqa(const Operand& dst, XMMRegister src) {
+void Assembler::movdqa(Operand dst, XMMRegister src) {
   EnsureSpace ensure_space(this);
   emit(0x66);
   emit_rex_64(src, dst);
@@ -2929,8 +2921,7 @@ void Assembler::movdqa(const Operand& dst, XMMRegister src) {
   emit_sse_operand(src, dst);
 }
 
-
-void Assembler::movdqa(XMMRegister dst, const Operand& src) {
+void Assembler::movdqa(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0x66);
   emit_rex_64(dst, src);
@@ -2939,8 +2930,7 @@ void Assembler::movdqa(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::movdqu(const Operand& dst, XMMRegister src) {
+void Assembler::movdqu(Operand dst, XMMRegister src) {
   EnsureSpace ensure_space(this);
   emit(0xF3);
   emit_rex_64(src, dst);
@@ -2949,8 +2939,7 @@ void Assembler::movdqu(const Operand& dst, XMMRegister src) {
   emit_sse_operand(src, dst);
 }
 
-
-void Assembler::movdqu(XMMRegister dst, const Operand& src) {
+void Assembler::movdqu(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0xF3);
   emit_rex_64(dst, src);
@@ -2986,7 +2975,7 @@ void Assembler::pextrb(Register dst, XMMRegister src, int8_t imm8) {
   emit(imm8);
 }
 
-void Assembler::pextrb(const Operand& dst, XMMRegister src, int8_t imm8) {
+void Assembler::pextrb(Operand dst, XMMRegister src, int8_t imm8) {
   DCHECK(IsEnabled(SSE4_1));
   DCHECK(is_uint8(imm8));
   EnsureSpace ensure_space(this);
@@ -3010,7 +2999,7 @@ void Assembler::pinsrw(XMMRegister dst, Register src, int8_t imm8) {
   emit(imm8);
 }
 
-void Assembler::pinsrw(XMMRegister dst, const Operand& src, int8_t imm8) {
+void Assembler::pinsrw(XMMRegister dst, Operand src, int8_t imm8) {
   DCHECK(is_uint8(imm8));
   EnsureSpace ensure_space(this);
   emit(0x66);
@@ -3034,7 +3023,7 @@ void Assembler::pextrw(Register dst, XMMRegister src, int8_t imm8) {
   emit(imm8);
 }
 
-void Assembler::pextrw(const Operand& dst, XMMRegister src, int8_t imm8) {
+void Assembler::pextrw(Operand dst, XMMRegister src, int8_t imm8) {
   DCHECK(IsEnabled(SSE4_1));
   DCHECK(is_uint8(imm8));
   EnsureSpace ensure_space(this);
@@ -3059,7 +3048,7 @@ void Assembler::pextrd(Register dst, XMMRegister src, int8_t imm8) {
   emit(imm8);
 }
 
-void Assembler::pextrd(const Operand& dst, XMMRegister src, int8_t imm8) {
+void Assembler::pextrd(Operand dst, XMMRegister src, int8_t imm8) {
   DCHECK(IsEnabled(SSE4_1));
   EnsureSpace ensure_space(this);
   emit(0x66);
@@ -3083,8 +3072,7 @@ void Assembler::pinsrd(XMMRegister dst, Register src, int8_t imm8) {
   emit(imm8);
 }
 
-
-void Assembler::pinsrd(XMMRegister dst, const Operand& src, int8_t imm8) {
+void Assembler::pinsrd(XMMRegister dst, Operand src, int8_t imm8) {
   DCHECK(IsEnabled(SSE4_1));
   EnsureSpace ensure_space(this);
   emit(0x66);
@@ -3108,7 +3096,7 @@ void Assembler::pinsrb(XMMRegister dst, Register src, int8_t imm8) {
   emit(imm8);
 }
 
-void Assembler::pinsrb(XMMRegister dst, const Operand& src, int8_t imm8) {
+void Assembler::pinsrb(XMMRegister dst, Operand src, int8_t imm8) {
   DCHECK(IsEnabled(SSE4_1));
   EnsureSpace ensure_space(this);
   emit(0x66);
@@ -3133,7 +3121,7 @@ void Assembler::insertps(XMMRegister dst, XMMRegister src, byte imm8) {
   emit(imm8);
 }
 
-void Assembler::movsd(const Operand& dst, XMMRegister src) {
+void Assembler::movsd(Operand dst, XMMRegister src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF2);  // double
@@ -3154,8 +3142,7 @@ void Assembler::movsd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::movsd(XMMRegister dst, const Operand& src) {
+void Assembler::movsd(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF2);  // double
@@ -3214,8 +3201,7 @@ void Assembler::movapd(XMMRegister dst, XMMRegister src) {
   }
 }
 
-
-void Assembler::movupd(XMMRegister dst, const Operand& src) {
+void Assembler::movupd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0x66);
   emit_optional_rex_32(dst, src);
@@ -3224,7 +3210,7 @@ void Assembler::movupd(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::movupd(const Operand& dst, XMMRegister src) {
+void Assembler::movupd(Operand dst, XMMRegister src) {
   EnsureSpace ensure_space(this);
   emit(0x66);
   emit_optional_rex_32(src, dst);
@@ -3242,8 +3228,7 @@ void Assembler::addss(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::addss(XMMRegister dst, const Operand& src) {
+void Assembler::addss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0xF3);
   emit_optional_rex_32(dst, src);
@@ -3262,8 +3247,7 @@ void Assembler::subss(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::subss(XMMRegister dst, const Operand& src) {
+void Assembler::subss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0xF3);
   emit_optional_rex_32(dst, src);
@@ -3282,8 +3266,7 @@ void Assembler::mulss(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::mulss(XMMRegister dst, const Operand& src) {
+void Assembler::mulss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0xF3);
   emit_optional_rex_32(dst, src);
@@ -3302,8 +3285,7 @@ void Assembler::divss(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::divss(XMMRegister dst, const Operand& src) {
+void Assembler::divss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0xF3);
   emit_optional_rex_32(dst, src);
@@ -3322,8 +3304,7 @@ void Assembler::maxss(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::maxss(XMMRegister dst, const Operand& src) {
+void Assembler::maxss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0xF3);
   emit_optional_rex_32(dst, src);
@@ -3342,8 +3323,7 @@ void Assembler::minss(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::minss(XMMRegister dst, const Operand& src) {
+void Assembler::minss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0xF3);
   emit_optional_rex_32(dst, src);
@@ -3362,8 +3342,7 @@ void Assembler::sqrtss(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::sqrtss(XMMRegister dst, const Operand& src) {
+void Assembler::sqrtss(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0xF3);
   emit_optional_rex_32(dst, src);
@@ -3382,8 +3361,7 @@ void Assembler::ucomiss(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::ucomiss(XMMRegister dst, const Operand& src) {
+void Assembler::ucomiss(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
@@ -3403,8 +3381,7 @@ void Assembler::movss(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::movss(XMMRegister dst, const Operand& src) {
+void Assembler::movss(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF3);  // single
@@ -3414,8 +3391,7 @@ void Assembler::movss(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::movss(const Operand& src, XMMRegister dst) {
+void Assembler::movss(Operand src, XMMRegister dst) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF3);  // single
@@ -3518,7 +3494,7 @@ void Assembler::cmpps(XMMRegister dst, XMMRegister src, int8_t cmp) {
   emit(cmp);
 }
 
-void Assembler::cmpps(XMMRegister dst, const Operand& src, int8_t cmp) {
+void Assembler::cmpps(XMMRegister dst, Operand src, int8_t cmp) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -3537,7 +3513,7 @@ void Assembler::cmppd(XMMRegister dst, XMMRegister src, int8_t cmp) {
   emit(cmp);
 }
 
-void Assembler::cmppd(XMMRegister dst, const Operand& src, int8_t cmp) {
+void Assembler::cmppd(XMMRegister dst, Operand src, int8_t cmp) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x66);
@@ -3547,7 +3523,7 @@ void Assembler::cmppd(XMMRegister dst, const Operand& src, int8_t cmp) {
   emit(cmp);
 }
 
-void Assembler::cvttss2si(Register dst, const Operand& src) {
+void Assembler::cvttss2si(Register dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF3);
@@ -3568,8 +3544,7 @@ void Assembler::cvttss2si(Register dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::cvttsd2si(Register dst, const Operand& src) {
+void Assembler::cvttsd2si(Register dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF2);
@@ -3601,8 +3576,7 @@ void Assembler::cvttss2siq(Register dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::cvttss2siq(Register dst, const Operand& src) {
+void Assembler::cvttss2siq(Register dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF3);
@@ -3623,8 +3597,7 @@ void Assembler::cvttsd2siq(Register dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::cvttsd2siq(Register dst, const Operand& src) {
+void Assembler::cvttsd2siq(Register dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF2);
@@ -3634,8 +3607,7 @@ void Assembler::cvttsd2siq(Register dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::cvtlsi2sd(XMMRegister dst, const Operand& src) {
+void Assembler::cvtlsi2sd(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF2);
@@ -3656,8 +3628,7 @@ void Assembler::cvtlsi2sd(XMMRegister dst, Register src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::cvtlsi2ss(XMMRegister dst, const Operand& src) {
+void Assembler::cvtlsi2ss(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF3);
@@ -3677,8 +3648,7 @@ void Assembler::cvtlsi2ss(XMMRegister dst, Register src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::cvtqsi2ss(XMMRegister dst, const Operand& src) {
+void Assembler::cvtqsi2ss(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF3);
@@ -3699,8 +3669,7 @@ void Assembler::cvtqsi2ss(XMMRegister dst, Register src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::cvtqsi2sd(XMMRegister dst, const Operand& src) {
+void Assembler::cvtqsi2sd(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF2);
@@ -3732,8 +3701,7 @@ void Assembler::cvtss2sd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::cvtss2sd(XMMRegister dst, const Operand& src) {
+void Assembler::cvtss2sd(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF3);
@@ -3754,8 +3722,7 @@ void Assembler::cvtsd2ss(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::cvtsd2ss(XMMRegister dst, const Operand& src) {
+void Assembler::cvtsd2ss(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF2);
@@ -3797,8 +3764,7 @@ void Assembler::addsd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::addsd(XMMRegister dst, const Operand& src) {
+void Assembler::addsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0xF2);
   emit_optional_rex_32(dst, src);
@@ -3817,8 +3783,7 @@ void Assembler::mulsd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::mulsd(XMMRegister dst, const Operand& src) {
+void Assembler::mulsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0xF2);
   emit_optional_rex_32(dst, src);
@@ -3837,8 +3802,7 @@ void Assembler::subsd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::subsd(XMMRegister dst, const Operand& src) {
+void Assembler::subsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0xF2);
   emit_optional_rex_32(dst, src);
@@ -3857,8 +3821,7 @@ void Assembler::divsd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::divsd(XMMRegister dst, const Operand& src) {
+void Assembler::divsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0xF2);
   emit_optional_rex_32(dst, src);
@@ -3877,8 +3840,7 @@ void Assembler::maxsd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::maxsd(XMMRegister dst, const Operand& src) {
+void Assembler::maxsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0xF2);
   emit_optional_rex_32(dst, src);
@@ -3897,8 +3859,7 @@ void Assembler::minsd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::minsd(XMMRegister dst, const Operand& src) {
+void Assembler::minsd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0xF2);
   emit_optional_rex_32(dst, src);
@@ -3917,8 +3878,7 @@ void Assembler::andpd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::andpd(XMMRegister dst, const Operand& src) {
+void Assembler::andpd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0x66);
   emit_optional_rex_32(dst, src);
@@ -3937,8 +3897,7 @@ void Assembler::orpd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::orpd(XMMRegister dst, const Operand& src) {
+void Assembler::orpd(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0x66);
   emit_optional_rex_32(dst, src);
@@ -3958,8 +3917,7 @@ void Assembler::xorpd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::xorpd(XMMRegister dst, const Operand& src) {
+void Assembler::xorpd(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0x66);
@@ -3980,8 +3938,7 @@ void Assembler::sqrtsd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::sqrtsd(XMMRegister dst, const Operand& src) {
+void Assembler::sqrtsd(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0xF2);
@@ -3992,6 +3949,7 @@ void Assembler::sqrtsd(XMMRegister dst, const Operand& src) {
 }
 
 void Assembler::haddps(XMMRegister dst, XMMRegister src) {
+  DCHECK(IsEnabled(SSE3));
   EnsureSpace ensure_space(this);
   emit(0xF2);
   emit_optional_rex_32(dst, src);
@@ -4000,7 +3958,8 @@ void Assembler::haddps(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::haddps(XMMRegister dst, const Operand& src) {
+void Assembler::haddps(XMMRegister dst, Operand src) {
+  DCHECK(IsEnabled(SSE3));
   EnsureSpace ensure_space(this);
   emit(0xF2);
   emit_optional_rex_32(dst, src);
@@ -4019,8 +3978,7 @@ void Assembler::ucomisd(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::ucomisd(XMMRegister dst, const Operand& src) {
+void Assembler::ucomisd(XMMRegister dst, Operand src) {
   DCHECK(!IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit(0x66);
@@ -4100,7 +4058,7 @@ void Assembler::punpckldq(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::punpckldq(XMMRegister dst, const Operand& src) {
+void Assembler::punpckldq(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit(0x66);
   emit_optional_rex_32(dst, src);
@@ -4129,9 +4087,8 @@ void Assembler::vfmasd(byte op, XMMRegister dst, XMMRegister src1,
   emit_sse_operand(dst, src2);
 }
 
-
 void Assembler::vfmasd(byte op, XMMRegister dst, XMMRegister src1,
-                       const Operand& src2) {
+                       Operand src2) {
   DCHECK(IsEnabled(FMA3));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(dst, src1, src2, kLIG, k66, k0F38, kW1);
@@ -4149,9 +4106,8 @@ void Assembler::vfmass(byte op, XMMRegister dst, XMMRegister src1,
   emit_sse_operand(dst, src2);
 }
 
-
 void Assembler::vfmass(byte op, XMMRegister dst, XMMRegister src1,
-                       const Operand& src2) {
+                       Operand src2) {
   DCHECK(IsEnabled(FMA3));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(dst, src1, src2, kLIG, k66, k0F38, kW0);
@@ -4169,8 +4125,7 @@ void Assembler::vmovd(XMMRegister dst, Register src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::vmovd(XMMRegister dst, const Operand& src) {
+void Assembler::vmovd(XMMRegister dst, Operand src) {
   DCHECK(IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(dst, xmm0, src, kL128, k66, k0F, kW0);
@@ -4198,8 +4153,7 @@ void Assembler::vmovq(XMMRegister dst, Register src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::vmovq(XMMRegister dst, const Operand& src) {
+void Assembler::vmovq(XMMRegister dst, Operand src) {
   DCHECK(IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(dst, xmm0, src, kL128, k66, k0F, kW1);
@@ -4227,9 +4181,8 @@ void Assembler::vinstr(byte op, XMMRegister dst, XMMRegister src1,
   emit_sse_operand(dst, src2);
 }
 
-void Assembler::vinstr(byte op, XMMRegister dst, XMMRegister src1,
-                       const Operand& src2, SIMDPrefix pp, LeadingOpcode m,
-                       VexW w) {
+void Assembler::vinstr(byte op, XMMRegister dst, XMMRegister src1, Operand src2,
+                       SIMDPrefix pp, LeadingOpcode m, VexW w) {
   DCHECK(IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(dst, src1, src2, kLIG, pp, m, w);
@@ -4247,9 +4200,7 @@ void Assembler::vps(byte op, XMMRegister dst, XMMRegister src1,
   emit_sse_operand(dst, src2);
 }
 
-
-void Assembler::vps(byte op, XMMRegister dst, XMMRegister src1,
-                    const Operand& src2) {
+void Assembler::vps(byte op, XMMRegister dst, XMMRegister src1, Operand src2) {
   DCHECK(IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(dst, src1, src2, kL128, kNone, k0F, kWIG);
@@ -4267,9 +4218,7 @@ void Assembler::vpd(byte op, XMMRegister dst, XMMRegister src1,
   emit_sse_operand(dst, src2);
 }
 
-
-void Assembler::vpd(byte op, XMMRegister dst, XMMRegister src1,
-                    const Operand& src2) {
+void Assembler::vpd(byte op, XMMRegister dst, XMMRegister src1, Operand src2) {
   DCHECK(IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(dst, src1, src2, kL128, k66, k0F, kWIG);
@@ -4286,8 +4235,7 @@ void Assembler::vucomiss(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-
-void Assembler::vucomiss(XMMRegister dst, const Operand& src) {
+void Assembler::vucomiss(XMMRegister dst, Operand src) {
   DCHECK(IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(dst, xmm0, src, kLIG, kNone, k0F, kWIG);
@@ -4305,9 +4253,7 @@ void Assembler::vss(byte op, XMMRegister dst, XMMRegister src1,
   emit_sse_operand(dst, src2);
 }
 
-
-void Assembler::vss(byte op, XMMRegister dst, XMMRegister src1,
-                    const Operand& src2) {
+void Assembler::vss(byte op, XMMRegister dst, XMMRegister src1, Operand src2) {
   DCHECK(IsEnabled(AVX));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(dst, src1, src2, kLIG, kF3, k0F, kWIG);
@@ -4324,8 +4270,7 @@ void Assembler::bmi1q(byte op, Register reg, Register vreg, Register rm) {
   emit_modrm(reg, rm);
 }
 
-
-void Assembler::bmi1q(byte op, Register reg, Register vreg, const Operand& rm) {
+void Assembler::bmi1q(byte op, Register reg, Register vreg, Operand rm) {
   DCHECK(IsEnabled(BMI1));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(reg, vreg, rm, kLZ, kNone, k0F38, kW1);
@@ -4342,8 +4287,7 @@ void Assembler::bmi1l(byte op, Register reg, Register vreg, Register rm) {
   emit_modrm(reg, rm);
 }
 
-
-void Assembler::bmi1l(byte op, Register reg, Register vreg, const Operand& rm) {
+void Assembler::bmi1l(byte op, Register reg, Register vreg, Operand rm) {
   DCHECK(IsEnabled(BMI1));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(reg, vreg, rm, kLZ, kNone, k0F38, kW0);
@@ -4362,8 +4306,7 @@ void Assembler::tzcntq(Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::tzcntq(Register dst, const Operand& src) {
+void Assembler::tzcntq(Register dst, Operand src) {
   DCHECK(IsEnabled(BMI1));
   EnsureSpace ensure_space(this);
   emit(0xF3);
@@ -4384,8 +4327,7 @@ void Assembler::tzcntl(Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::tzcntl(Register dst, const Operand& src) {
+void Assembler::tzcntl(Register dst, Operand src) {
   DCHECK(IsEnabled(BMI1));
   EnsureSpace ensure_space(this);
   emit(0xF3);
@@ -4406,8 +4348,7 @@ void Assembler::lzcntq(Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::lzcntq(Register dst, const Operand& src) {
+void Assembler::lzcntq(Register dst, Operand src) {
   DCHECK(IsEnabled(LZCNT));
   EnsureSpace ensure_space(this);
   emit(0xF3);
@@ -4428,8 +4369,7 @@ void Assembler::lzcntl(Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::lzcntl(Register dst, const Operand& src) {
+void Assembler::lzcntl(Register dst, Operand src) {
   DCHECK(IsEnabled(LZCNT));
   EnsureSpace ensure_space(this);
   emit(0xF3);
@@ -4450,8 +4390,7 @@ void Assembler::popcntq(Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::popcntq(Register dst, const Operand& src) {
+void Assembler::popcntq(Register dst, Operand src) {
   DCHECK(IsEnabled(POPCNT));
   EnsureSpace ensure_space(this);
   emit(0xF3);
@@ -4472,8 +4411,7 @@ void Assembler::popcntl(Register dst, Register src) {
   emit_modrm(dst, src);
 }
 
-
-void Assembler::popcntl(Register dst, const Operand& src) {
+void Assembler::popcntl(Register dst, Operand src) {
   DCHECK(IsEnabled(POPCNT));
   EnsureSpace ensure_space(this);
   emit(0xF3);
@@ -4493,9 +4431,8 @@ void Assembler::bmi2q(SIMDPrefix pp, byte op, Register reg, Register vreg,
   emit_modrm(reg, rm);
 }
 
-
 void Assembler::bmi2q(SIMDPrefix pp, byte op, Register reg, Register vreg,
-                      const Operand& rm) {
+                      Operand rm) {
   DCHECK(IsEnabled(BMI2));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(reg, vreg, rm, kLZ, pp, k0F38, kW1);
@@ -4513,9 +4450,8 @@ void Assembler::bmi2l(SIMDPrefix pp, byte op, Register reg, Register vreg,
   emit_modrm(reg, rm);
 }
 
-
 void Assembler::bmi2l(SIMDPrefix pp, byte op, Register reg, Register vreg,
-                      const Operand& rm) {
+                      Operand rm) {
   DCHECK(IsEnabled(BMI2));
   EnsureSpace ensure_space(this);
   emit_vex_prefix(reg, vreg, rm, kLZ, pp, k0F38, kW0);
@@ -4535,8 +4471,7 @@ void Assembler::rorxq(Register dst, Register src, byte imm8) {
   emit(imm8);
 }
 
-
-void Assembler::rorxq(Register dst, const Operand& src, byte imm8) {
+void Assembler::rorxq(Register dst, Operand src, byte imm8) {
   DCHECK(IsEnabled(BMI2));
   DCHECK(is_uint8(imm8));
   Register vreg = Register::from_code<0>();  // VEX.vvvv unused
@@ -4559,8 +4494,7 @@ void Assembler::rorxl(Register dst, Register src, byte imm8) {
   emit(imm8);
 }
 
-
-void Assembler::rorxl(Register dst, const Operand& src, byte imm8) {
+void Assembler::rorxl(Register dst, Operand src, byte imm8) {
   DCHECK(IsEnabled(BMI2));
   DCHECK(is_uint8(imm8));
   Register vreg = Register::from_code<0>();  // VEX.vvvv unused
@@ -4584,7 +4518,7 @@ void Assembler::minps(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::minps(XMMRegister dst, const Operand& src) {
+void Assembler::minps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -4600,7 +4534,7 @@ void Assembler::maxps(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::maxps(XMMRegister dst, const Operand& src) {
+void Assembler::maxps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -4616,7 +4550,7 @@ void Assembler::rcpps(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::rcpps(XMMRegister dst, const Operand& src) {
+void Assembler::rcpps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -4632,7 +4566,7 @@ void Assembler::rsqrtps(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::rsqrtps(XMMRegister dst, const Operand& src) {
+void Assembler::rsqrtps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -4648,7 +4582,7 @@ void Assembler::sqrtps(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::sqrtps(XMMRegister dst, const Operand& src) {
+void Assembler::sqrtps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -4664,7 +4598,7 @@ void Assembler::cvtdq2ps(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::cvtdq2ps(XMMRegister dst, const Operand& src) {
+void Assembler::cvtdq2ps(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -4688,7 +4622,7 @@ void Assembler::movups(XMMRegister dst, XMMRegister src) {
   }
 }
 
-void Assembler::movups(XMMRegister dst, const Operand& src) {
+void Assembler::movups(XMMRegister dst, Operand src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(dst, src);
   emit(0x0F);
@@ -4696,7 +4630,7 @@ void Assembler::movups(XMMRegister dst, const Operand& src) {
   emit_sse_operand(dst, src);
 }
 
-void Assembler::movups(const Operand& dst, XMMRegister src) {
+void Assembler::movups(Operand dst, XMMRegister src) {
   EnsureSpace ensure_space(this);
   emit_optional_rex_32(src, dst);
   emit(0x0F);
@@ -4714,7 +4648,7 @@ void Assembler::sse2_instr(XMMRegister dst, XMMRegister src, byte prefix,
   emit_sse_operand(dst, src);
 }
 
-void Assembler::sse2_instr(XMMRegister dst, const Operand& src, byte prefix,
+void Assembler::sse2_instr(XMMRegister dst, Operand src, byte prefix,
                            byte escape, byte opcode) {
   EnsureSpace ensure_space(this);
   emit(prefix);
@@ -4736,7 +4670,7 @@ void Assembler::ssse3_instr(XMMRegister dst, XMMRegister src, byte prefix,
   emit_sse_operand(dst, src);
 }
 
-void Assembler::ssse3_instr(XMMRegister dst, const Operand& src, byte prefix,
+void Assembler::ssse3_instr(XMMRegister dst, Operand src, byte prefix,
                             byte escape1, byte escape2, byte opcode) {
   DCHECK(IsEnabled(SSSE3));
   EnsureSpace ensure_space(this);
@@ -4760,7 +4694,7 @@ void Assembler::sse4_instr(XMMRegister dst, XMMRegister src, byte prefix,
   emit_sse_operand(dst, src);
 }
 
-void Assembler::sse4_instr(XMMRegister dst, const Operand& src, byte prefix,
+void Assembler::sse4_instr(XMMRegister dst, Operand src, byte prefix,
                            byte escape1, byte escape2, byte opcode) {
   DCHECK(IsEnabled(SSE4_1));
   EnsureSpace ensure_space(this);
@@ -4772,7 +4706,7 @@ void Assembler::sse4_instr(XMMRegister dst, const Operand& src, byte prefix,
   emit_sse_operand(dst, src);
 }
 
-void Assembler::lddqu(XMMRegister dst, const Operand& src) {
+void Assembler::lddqu(XMMRegister dst, Operand src) {
   DCHECK(IsEnabled(SSE3));
   EnsureSpace ensure_space(this);
   emit(0xF2);
@@ -4822,7 +4756,7 @@ void Assembler::pshufd(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
   emit(shuffle);
 }
 
-void Assembler::pshufd(XMMRegister dst, const Operand& src, uint8_t shuffle) {
+void Assembler::pshufd(XMMRegister dst, Operand src, uint8_t shuffle) {
   EnsureSpace ensure_space(this);
   emit(0x66);
   emit_optional_rex_32(dst, src);
@@ -4832,13 +4766,12 @@ void Assembler::pshufd(XMMRegister dst, const Operand& src, uint8_t shuffle) {
   emit(shuffle);
 }
 
-void Assembler::emit_sse_operand(XMMRegister reg, const Operand& adr) {
+void Assembler::emit_sse_operand(XMMRegister reg, Operand adr) {
   Register ireg = Register::from_code(reg.code());
   emit_operand(ireg, adr);
 }
 
-
-void Assembler::emit_sse_operand(Register reg, const Operand& adr) {
+void Assembler::emit_sse_operand(Register reg, Operand adr) {
   emit_operand(reg, adr);
 }
 
diff --git a/deps/v8/src/x64/assembler-x64.h b/deps/v8/src/x64/assembler-x64.h
index 1c838b964b3..9e00e682e5f 100644
--- a/deps/v8/src/x64/assembler-x64.h
+++ b/deps/v8/src/x64/assembler-x64.h
@@ -81,9 +81,6 @@ namespace internal {
   V(r14)                                 \
   V(r15)
 
-// The length of pushq(rbp), movp(rbp, rsp), Push(rsi) and Push(rdi).
-constexpr int kNoCodeAgeSequenceLength = kPointerSize == kInt64Size ? 6 : 17;
-
 enum RegisterCode {
 #define REGISTER_CODE(R) kRegCode_##R,
   GENERAL_REGISTERS(REGISTER_CODE)
@@ -106,8 +103,8 @@ class Register : public RegisterBase<Register, kRegAfterLast> {
   explicit constexpr Register(int code) : RegisterBase(code) {}
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(Register) &&
-                  sizeof(Register) == sizeof(int),
+ASSERT_TRIVIALLY_COPYABLE(Register);
+static_assert(sizeof(Register) == sizeof(int),
               "Register can efficiently be passed by value");
 
 #define DECLARE_REGISTER(R) \
@@ -207,8 +204,8 @@ class XMMRegister : public RegisterBase<XMMRegister, kDoubleAfterLast> {
   explicit constexpr XMMRegister(int code) : RegisterBase(code) {}
 };
 
-static_assert(IS_TRIVIALLY_COPYABLE(XMMRegister) &&
-                  sizeof(XMMRegister) == sizeof(int),
+ASSERT_TRIVIALLY_COPYABLE(XMMRegister);
+static_assert(sizeof(XMMRegister) == sizeof(int),
               "XMMRegister can efficiently be passed by value");
 
 typedef XMMRegister FloatRegister;
@@ -304,28 +301,30 @@ enum RoundingMode {
 // -----------------------------------------------------------------------------
 // Machine instruction Immediates
 
-class Immediate BASE_EMBEDDED {
+class Immediate {
  public:
-  explicit Immediate(int32_t value) : value_(value) {}
-  explicit Immediate(int32_t value, RelocInfo::Mode rmode)
+  explicit constexpr Immediate(int32_t value) : value_(value) {}
+  explicit constexpr Immediate(int32_t value, RelocInfo::Mode rmode)
       : value_(value), rmode_(rmode) {}
-  explicit Immediate(Smi* value) {
+  explicit Immediate(Smi* value)
+      : value_(static_cast<int32_t>(reinterpret_cast<intptr_t>(value))) {
     DCHECK(SmiValuesAre31Bits());  // Only available for 31-bit SMI.
-    value_ = static_cast<int32_t>(reinterpret_cast<intptr_t>(value));
   }
 
  private:
-  int32_t value_;
-  RelocInfo::Mode rmode_ = RelocInfo::NONE32;
+  const int32_t value_;
+  const RelocInfo::Mode rmode_ = RelocInfo::NONE;
 
   friend class Assembler;
 };
-
+ASSERT_TRIVIALLY_COPYABLE(Immediate);
+static_assert(sizeof(Immediate) <= kPointerSize,
+              "Immediate must be small enough to pass it by value");
 
 // -----------------------------------------------------------------------------
 // Machine instruction Operands
 
-enum ScaleFactor {
+enum ScaleFactor : int8_t {
   times_1 = 0,
   times_2 = 1,
   times_4 = 2,
@@ -334,9 +333,15 @@ enum ScaleFactor {
   times_pointer_size = (kPointerSize == 8) ? times_8 : times_4
 };
 
-
-class Operand BASE_EMBEDDED {
+class Operand {
  public:
+  struct Data {
+    byte rex = 0;
+    byte buf[9];
+    byte len = 1;   // number of bytes of buf_ in use.
+    int8_t addend;  // for rip + offset + addend.
+  };
+
   // [base + disp/r]
   Operand(Register base, int32_t disp);
 
@@ -354,10 +359,12 @@ class Operand BASE_EMBEDDED {
   // Offset from existing memory operand.
   // Offset is added to existing displacement as 32-bit signed values and
   // this must not overflow.
-  Operand(const Operand& base, int32_t offset);
+  Operand(Operand base, int32_t offset);
 
   // [rip + disp/r]
-  explicit Operand(Label* label);
+  explicit Operand(Label* label, int addend = 0);
+
+  Operand(const Operand&) = default;
 
   // Checks whether either base or index register is the given register.
   // Does not check the "reg" part of the Operand.
@@ -365,33 +372,19 @@ class Operand BASE_EMBEDDED {
 
   // Queries related to the size of the generated instruction.
   // Whether the generated instruction will have a REX prefix.
-  bool requires_rex() const { return rex_ != 0; }
+  bool requires_rex() const { return data_.rex != 0; }
   // Size of the ModR/M, SIB and displacement parts of the generated
   // instruction.
-  int operand_size() const { return len_; }
+  int operand_size() const { return data_.len; }
 
- private:
-  byte rex_;
-  byte buf_[9];
-  // The number of bytes of buf_ in use.
-  byte len_;
-
-  // Set the ModR/M byte without an encoded 'reg' register. The
-  // register is encoded later as part of the emit_operand operation.
-  // set_modrm can be called before or after set_sib and set_disp*.
-  inline void set_modrm(int mod, Register rm);
-
-  // Set the SIB byte if one is needed. Sets the length to 2 rather than 1.
-  inline void set_sib(ScaleFactor scale, Register index, Register base);
+  const Data& data() const { return data_; }
 
-  // Adds operand displacement fields (offsets added to the memory address).
-  // Needs to be called after set_sib, not before it.
-  inline void set_disp8(int disp);
-  inline void set_disp32(int disp);
-  inline void set_disp64(int64_t disp);  // for labels.
-
-  friend class Assembler;
+ private:
+  const Data data_;
 };
+ASSERT_TRIVIALLY_COPYABLE(Operand);
+static_assert(sizeof(Operand) <= 2 * kPointerSize,
+              "Operand must be small enough to pass it by value");
 
 #define ASSEMBLER_INSTRUCTION_LIST(V) \
   V(add)                              \
@@ -476,7 +469,7 @@ class Assembler : public AssemblerBase {
   // The isolate argument is unused (and may be nullptr) when skipping flushing.
   static inline Address target_address_at(Address pc, Address constant_pool);
   static inline void set_target_address_at(
-      Isolate* isolate, Address pc, Address constant_pool, Address target,
+      Address pc, Address constant_pool, Address target,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
   // Return the code target address at a call site from the return address
@@ -486,23 +479,13 @@ class Assembler : public AssemblerBase {
   // This sets the branch destination (which is in the instruction on x64).
   // This is for calls and branches within generated code.
   inline static void deserialization_set_special_target_at(
-      Isolate* isolate, Address instruction_payload, Code* code,
-      Address target);
+      Address instruction_payload, Code* code, Address target);
 
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
-      Isolate* isolate, Address pc, Address target,
+      Address pc, Address target,
       RelocInfo::Mode mode = RelocInfo::INTERNAL_REFERENCE);
 
-  static inline RelocInfo::Mode RelocInfoNone() {
-    if (kPointerSize == kInt64Size) {
-      return RelocInfo::NONE64;
-    } else {
-      DCHECK_EQ(kPointerSize, kInt32Size);
-      return RelocInfo::NONE32;
-    }
-  }
-
   inline Handle<Code> code_target_object_handle_at(Address pc);
   inline Address runtime_entry_at(Address pc);
   // Number of bytes taken up by the branch target in the code.
@@ -629,29 +612,29 @@ class Assembler : public AssemblerBase {
   // 32 bit value, the normal push will optimize the 8 bit case.
   void pushq_imm32(int32_t imm32);
   void pushq(Register src);
-  void pushq(const Operand& src);
+  void pushq(Operand src);
 
   void popq(Register dst);
-  void popq(const Operand& dst);
+  void popq(Operand dst);
 
   void enter(Immediate size);
   void leave();
 
   // Moves
-  void movb(Register dst, const Operand& src);
+  void movb(Register dst, Operand src);
   void movb(Register dst, Immediate imm);
-  void movb(const Operand& dst, Register src);
-  void movb(const Operand& dst, Immediate imm);
+  void movb(Operand dst, Register src);
+  void movb(Operand dst, Immediate imm);
 
   // Move the low 16 bits of a 64-bit register value to a 16-bit
   // memory location.
-  void movw(Register dst, const Operand& src);
-  void movw(const Operand& dst, Register src);
-  void movw(const Operand& dst, Immediate imm);
+  void movw(Register dst, Operand src);
+  void movw(Operand dst, Register src);
+  void movw(Operand dst, Immediate imm);
 
   // Move the offset of the label location relative to the current
   // position (after the move) to the destination.
-  void movl(const Operand& dst, Label* src);
+  void movl(Operand dst, Label* src);
 
   // Loads a pointer into a register with a relocation mode.
   void movp(Register dst, void* ptr, RelocInfo::Mode rmode);
@@ -667,20 +650,20 @@ class Assembler : public AssemblerBase {
 
   // Loads a 64-bit immediate into a register.
   void movq(Register dst, int64_t value,
-            RelocInfo::Mode rmode = RelocInfo::NONE64);
+            RelocInfo::Mode rmode = RelocInfo::NONE);
   void movq(Register dst, uint64_t value,
-            RelocInfo::Mode rmode = RelocInfo::NONE64);
+            RelocInfo::Mode rmode = RelocInfo::NONE);
 
   void movsxbl(Register dst, Register src);
-  void movsxbl(Register dst, const Operand& src);
+  void movsxbl(Register dst, Operand src);
   void movsxbq(Register dst, Register src);
-  void movsxbq(Register dst, const Operand& src);
+  void movsxbq(Register dst, Operand src);
   void movsxwl(Register dst, Register src);
-  void movsxwl(Register dst, const Operand& src);
+  void movsxwl(Register dst, Operand src);
   void movsxwq(Register dst, Register src);
-  void movsxwq(Register dst, const Operand& src);
+  void movsxwq(Register dst, Operand src);
   void movsxlq(Register dst, Register src);
-  void movsxlq(Register dst, const Operand& src);
+  void movsxlq(Register dst, Operand src);
 
   // Repeated moves.
 
@@ -696,9 +679,9 @@ class Assembler : public AssemblerBase {
 
   // Conditional moves.
   void cmovq(Condition cc, Register dst, Register src);
-  void cmovq(Condition cc, Register dst, const Operand& src);
+  void cmovq(Condition cc, Register dst, Operand src);
   void cmovl(Condition cc, Register dst, Register src);
-  void cmovl(Condition cc, Register dst, const Operand& src);
+  void cmovl(Condition cc, Register dst, Operand src);
 
   void cmpb(Register dst, Immediate src) {
     immediate_arithmetic_op_8(0x7, dst, src);
@@ -710,19 +693,15 @@ class Assembler : public AssemblerBase {
     arithmetic_op_8(0x3A, dst, src);
   }
 
-  void cmpb(Register dst, const Operand& src) {
-    arithmetic_op_8(0x3A, dst, src);
-  }
+  void cmpb(Register dst, Operand src) { arithmetic_op_8(0x3A, dst, src); }
 
-  void cmpb(const Operand& dst, Register src) {
-    arithmetic_op_8(0x38, src, dst);
-  }
+  void cmpb(Operand dst, Register src) { arithmetic_op_8(0x38, src, dst); }
 
-  void cmpb(const Operand& dst, Immediate src) {
+  void cmpb(Operand dst, Immediate src) {
     immediate_arithmetic_op_8(0x7, dst, src);
   }
 
-  void cmpw(const Operand& dst, Immediate src) {
+  void cmpw(Operand dst, Immediate src) {
     immediate_arithmetic_op_16(0x7, dst, src);
   }
 
@@ -730,37 +709,33 @@ class Assembler : public AssemblerBase {
     immediate_arithmetic_op_16(0x7, dst, src);
   }
 
-  void cmpw(Register dst, const Operand& src) {
-    arithmetic_op_16(0x3B, dst, src);
-  }
+  void cmpw(Register dst, Operand src) { arithmetic_op_16(0x3B, dst, src); }
 
   void cmpw(Register dst, Register src) {
     arithmetic_op_16(0x3B, dst, src);
   }
 
-  void cmpw(const Operand& dst, Register src) {
-    arithmetic_op_16(0x39, src, dst);
-  }
+  void cmpw(Operand dst, Register src) { arithmetic_op_16(0x39, src, dst); }
 
-  void testb(Register reg, const Operand& op) { testb(op, reg); }
+  void testb(Register reg, Operand op) { testb(op, reg); }
 
-  void testw(Register reg, const Operand& op) { testw(op, reg); }
+  void testw(Register reg, Operand op) { testw(op, reg); }
 
   void andb(Register dst, Immediate src) {
     immediate_arithmetic_op_8(0x4, dst, src);
   }
 
   void decb(Register dst);
-  void decb(const Operand& dst);
+  void decb(Operand dst);
 
   // Lock prefix.
   void lock();
 
-  void xchgb(Register reg, const Operand& op);
-  void xchgw(Register reg, const Operand& op);
+  void xchgb(Register reg, Operand op);
+  void xchgw(Register reg, Operand op);
 
-  void cmpxchgb(const Operand& dst, Register src);
-  void cmpxchgw(const Operand& dst, Register src);
+  void cmpxchgb(Operand dst, Register src);
+  void cmpxchgw(Operand dst, Register src);
 
   // Sign-extends rax into rdx:rax.
   void cqo();
@@ -769,7 +744,7 @@ class Assembler : public AssemblerBase {
 
   // Multiply eax by src, put the result in edx:eax.
   void mull(Register src);
-  void mull(const Operand& src);
+  void mull(Operand src);
   // Multiply rax by src, put the result in rdx:rax.
   void mulq(Register src);
 
@@ -825,27 +800,29 @@ class Assembler : public AssemblerBase {
     immediate_arithmetic_op_8(0x5, dst, src);
   }
 
+  void sub_sp_32(uint32_t imm);
+
   void testb(Register dst, Register src);
   void testb(Register reg, Immediate mask);
-  void testb(const Operand& op, Immediate mask);
-  void testb(const Operand& op, Register reg);
+  void testb(Operand op, Immediate mask);
+  void testb(Operand op, Register reg);
 
   void testw(Register dst, Register src);
   void testw(Register reg, Immediate mask);
-  void testw(const Operand& op, Immediate mask);
-  void testw(const Operand& op, Register reg);
+  void testw(Operand op, Immediate mask);
+  void testw(Operand op, Register reg);
 
   // Bit operations.
-  void bt(const Operand& dst, Register src);
-  void bts(const Operand& dst, Register src);
+  void bt(Operand dst, Register src);
+  void bts(Operand dst, Register src);
   void bsrq(Register dst, Register src);
-  void bsrq(Register dst, const Operand& src);
+  void bsrq(Register dst, Operand src);
   void bsrl(Register dst, Register src);
-  void bsrl(Register dst, const Operand& src);
+  void bsrl(Register dst, Operand src);
   void bsfq(Register dst, Register src);
-  void bsfq(Register dst, const Operand& src);
+  void bsfq(Register dst, Operand src);
   void bsfl(Register dst, Register src);
-  void bsfl(Register dst, const Operand& src);
+  void bsfl(Register dst, Operand src);
 
   // Miscellaneous
   void clc();
@@ -859,7 +836,7 @@ class Assembler : public AssemblerBase {
   void setcc(Condition cc, Register reg);
 
   void pshufw(XMMRegister dst, XMMRegister src, uint8_t shuffle);
-  void pshufw(XMMRegister dst, const Operand& src, uint8_t shuffle);
+  void pshufw(XMMRegister dst, Operand src, uint8_t shuffle);
 
   // Label operations & relative jumps (PPUM Appendix D)
   //
@@ -906,7 +883,7 @@ class Assembler : public AssemblerBase {
 
   // Jump near absolute indirect (r64)
   void jmp(Register adr);
-  void jmp(const Operand& src);
+  void jmp(Operand src);
 
   // Conditional jumps
   void j(Condition cc,
@@ -923,23 +900,23 @@ class Assembler : public AssemblerBase {
   void fldpi();
   void fldln2();
 
-  void fld_s(const Operand& adr);
-  void fld_d(const Operand& adr);
+  void fld_s(Operand adr);
+  void fld_d(Operand adr);
 
-  void fstp_s(const Operand& adr);
-  void fstp_d(const Operand& adr);
+  void fstp_s(Operand adr);
+  void fstp_d(Operand adr);
   void fstp(int index);
 
-  void fild_s(const Operand& adr);
-  void fild_d(const Operand& adr);
+  void fild_s(Operand adr);
+  void fild_d(Operand adr);
 
-  void fist_s(const Operand& adr);
+  void fist_s(Operand adr);
 
-  void fistp_s(const Operand& adr);
-  void fistp_d(const Operand& adr);
+  void fistp_s(Operand adr);
+  void fistp_d(Operand adr);
 
-  void fisttp_s(const Operand& adr);
-  void fisttp_d(const Operand& adr);
+  void fisttp_s(Operand adr);
+  void fisttp_d(Operand adr);
 
   void fabs();
   void fchs();
@@ -949,7 +926,7 @@ class Assembler : public AssemblerBase {
   void fmul(int i);
   void fdiv(int i);
 
-  void fisub_s(const Operand& adr);
+  void fisub_s(Operand adr);
 
   void faddp(int i = 1);
   void fsubp(int i = 1);
@@ -988,24 +965,24 @@ class Assembler : public AssemblerBase {
 
   // SSE instructions
   void addss(XMMRegister dst, XMMRegister src);
-  void addss(XMMRegister dst, const Operand& src);
+  void addss(XMMRegister dst, Operand src);
   void subss(XMMRegister dst, XMMRegister src);
-  void subss(XMMRegister dst, const Operand& src);
+  void subss(XMMRegister dst, Operand src);
   void mulss(XMMRegister dst, XMMRegister src);
-  void mulss(XMMRegister dst, const Operand& src);
+  void mulss(XMMRegister dst, Operand src);
   void divss(XMMRegister dst, XMMRegister src);
-  void divss(XMMRegister dst, const Operand& src);
+  void divss(XMMRegister dst, Operand src);
 
   void maxss(XMMRegister dst, XMMRegister src);
-  void maxss(XMMRegister dst, const Operand& src);
+  void maxss(XMMRegister dst, Operand src);
   void minss(XMMRegister dst, XMMRegister src);
-  void minss(XMMRegister dst, const Operand& src);
+  void minss(XMMRegister dst, Operand src);
 
   void sqrtss(XMMRegister dst, XMMRegister src);
-  void sqrtss(XMMRegister dst, const Operand& src);
+  void sqrtss(XMMRegister dst, Operand src);
 
   void ucomiss(XMMRegister dst, XMMRegister src);
-  void ucomiss(XMMRegister dst, const Operand& src);
+  void ucomiss(XMMRegister dst, Operand src);
   void movaps(XMMRegister dst, XMMRegister src);
 
   // Don't use this unless it's important to keep the
@@ -1014,48 +991,48 @@ class Assembler : public AssemblerBase {
   // values in xmm registers.
   void movss(XMMRegister dst, XMMRegister src);
 
-  void movss(XMMRegister dst, const Operand& src);
-  void movss(const Operand& dst, XMMRegister src);
+  void movss(XMMRegister dst, Operand src);
+  void movss(Operand dst, XMMRegister src);
   void shufps(XMMRegister dst, XMMRegister src, byte imm8);
 
-  void cvttss2si(Register dst, const Operand& src);
+  void cvttss2si(Register dst, Operand src);
   void cvttss2si(Register dst, XMMRegister src);
-  void cvtlsi2ss(XMMRegister dst, const Operand& src);
+  void cvtlsi2ss(XMMRegister dst, Operand src);
   void cvtlsi2ss(XMMRegister dst, Register src);
 
   void andps(XMMRegister dst, XMMRegister src);
-  void andps(XMMRegister dst, const Operand& src);
+  void andps(XMMRegister dst, Operand src);
   void orps(XMMRegister dst, XMMRegister src);
-  void orps(XMMRegister dst, const Operand& src);
+  void orps(XMMRegister dst, Operand src);
   void xorps(XMMRegister dst, XMMRegister src);
-  void xorps(XMMRegister dst, const Operand& src);
+  void xorps(XMMRegister dst, Operand src);
 
   void addps(XMMRegister dst, XMMRegister src);
-  void addps(XMMRegister dst, const Operand& src);
+  void addps(XMMRegister dst, Operand src);
   void subps(XMMRegister dst, XMMRegister src);
-  void subps(XMMRegister dst, const Operand& src);
+  void subps(XMMRegister dst, Operand src);
   void mulps(XMMRegister dst, XMMRegister src);
-  void mulps(XMMRegister dst, const Operand& src);
+  void mulps(XMMRegister dst, Operand src);
   void divps(XMMRegister dst, XMMRegister src);
-  void divps(XMMRegister dst, const Operand& src);
+  void divps(XMMRegister dst, Operand src);
 
   void movmskps(Register dst, XMMRegister src);
 
   void vinstr(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2,
               SIMDPrefix pp, LeadingOpcode m, VexW w);
-  void vinstr(byte op, XMMRegister dst, XMMRegister src1, const Operand& src2,
+  void vinstr(byte op, XMMRegister dst, XMMRegister src1, Operand src2,
               SIMDPrefix pp, LeadingOpcode m, VexW w);
 
   // SSE2 instructions
   void sse2_instr(XMMRegister dst, XMMRegister src, byte prefix, byte escape,
                   byte opcode);
-  void sse2_instr(XMMRegister dst, const Operand& src, byte prefix, byte escape,
+  void sse2_instr(XMMRegister dst, Operand src, byte prefix, byte escape,
                   byte opcode);
 #define DECLARE_SSE2_INSTRUCTION(instruction, prefix, escape, opcode) \
   void instruction(XMMRegister dst, XMMRegister src) {                \
     sse2_instr(dst, src, 0x##prefix, 0x##escape, 0x##opcode);         \
   }                                                                   \
-  void instruction(XMMRegister dst, const Operand& src) {             \
+  void instruction(XMMRegister dst, Operand src) {                    \
     sse2_instr(dst, src, 0x##prefix, 0x##escape, 0x##opcode);         \
   }
 
@@ -1066,8 +1043,7 @@ class Assembler : public AssemblerBase {
   void v##instruction(XMMRegister dst, XMMRegister src1, XMMRegister src2) { \
     vinstr(0x##opcode, dst, src1, src2, k##prefix, k##escape, kW0);          \
   }                                                                          \
-  void v##instruction(XMMRegister dst, XMMRegister src1,                     \
-                      const Operand& src2) {                                 \
+  void v##instruction(XMMRegister dst, XMMRegister src1, Operand src2) {     \
     vinstr(0x##opcode, dst, src1, src2, k##prefix, k##escape, kW0);          \
   }
 
@@ -1075,20 +1051,20 @@ class Assembler : public AssemblerBase {
 #undef DECLARE_SSE2_AVX_INSTRUCTION
 
   // SSE3
-  void lddqu(XMMRegister dst, const Operand& src);
+  void lddqu(XMMRegister dst, Operand src);
 
   // SSSE3
   void ssse3_instr(XMMRegister dst, XMMRegister src, byte prefix, byte escape1,
                    byte escape2, byte opcode);
-  void ssse3_instr(XMMRegister dst, const Operand& src, byte prefix,
-                   byte escape1, byte escape2, byte opcode);
+  void ssse3_instr(XMMRegister dst, Operand src, byte prefix, byte escape1,
+                   byte escape2, byte opcode);
 
 #define DECLARE_SSSE3_INSTRUCTION(instruction, prefix, escape1, escape2,     \
                                   opcode)                                    \
   void instruction(XMMRegister dst, XMMRegister src) {                       \
     ssse3_instr(dst, src, 0x##prefix, 0x##escape1, 0x##escape2, 0x##opcode); \
   }                                                                          \
-  void instruction(XMMRegister dst, const Operand& src) {                    \
+  void instruction(XMMRegister dst, Operand src) {                           \
     ssse3_instr(dst, src, 0x##prefix, 0x##escape1, 0x##escape2, 0x##opcode); \
   }
 
@@ -1098,14 +1074,14 @@ class Assembler : public AssemblerBase {
   // SSE4
   void sse4_instr(XMMRegister dst, XMMRegister src, byte prefix, byte escape1,
                   byte escape2, byte opcode);
-  void sse4_instr(XMMRegister dst, const Operand& src, byte prefix,
-                  byte escape1, byte escape2, byte opcode);
+  void sse4_instr(XMMRegister dst, Operand src, byte prefix, byte escape1,
+                  byte escape2, byte opcode);
 #define DECLARE_SSE4_INSTRUCTION(instruction, prefix, escape1, escape2,     \
                                  opcode)                                    \
   void instruction(XMMRegister dst, XMMRegister src) {                      \
     sse4_instr(dst, src, 0x##prefix, 0x##escape1, 0x##escape2, 0x##opcode); \
   }                                                                         \
-  void instruction(XMMRegister dst, const Operand& src) {                   \
+  void instruction(XMMRegister dst, Operand src) {                          \
     sse4_instr(dst, src, 0x##prefix, 0x##escape1, 0x##escape2, 0x##opcode); \
   }
 
@@ -1117,8 +1093,7 @@ class Assembler : public AssemblerBase {
   void v##instruction(XMMRegister dst, XMMRegister src1, XMMRegister src2) {  \
     vinstr(0x##opcode, dst, src1, src2, k##prefix, k##escape1##escape2, kW0); \
   }                                                                           \
-  void v##instruction(XMMRegister dst, XMMRegister src1,                      \
-                      const Operand& src2) {                                  \
+  void v##instruction(XMMRegister dst, XMMRegister src1, Operand src2) {      \
     vinstr(0x##opcode, dst, src1, src2, k##prefix, k##escape1##escape2, kW0); \
   }
 
@@ -1127,7 +1102,7 @@ class Assembler : public AssemblerBase {
 #undef DECLARE_SSE34_AVX_INSTRUCTION
 
   void movd(XMMRegister dst, Register src);
-  void movd(XMMRegister dst, const Operand& src);
+  void movd(XMMRegister dst, Operand src);
   void movd(Register dst, XMMRegister src);
   void movq(XMMRegister dst, Register src);
   void movq(Register dst, XMMRegister src);
@@ -1139,18 +1114,18 @@ class Assembler : public AssemblerBase {
   // values in xmm registers.
   void movsd(XMMRegister dst, XMMRegister src);
 
-  void movsd(const Operand& dst, XMMRegister src);
-  void movsd(XMMRegister dst, const Operand& src);
+  void movsd(Operand dst, XMMRegister src);
+  void movsd(XMMRegister dst, Operand src);
 
-  void movdqa(const Operand& dst, XMMRegister src);
-  void movdqa(XMMRegister dst, const Operand& src);
+  void movdqa(Operand dst, XMMRegister src);
+  void movdqa(XMMRegister dst, Operand src);
 
-  void movdqu(const Operand& dst, XMMRegister src);
-  void movdqu(XMMRegister dst, const Operand& src);
+  void movdqu(Operand dst, XMMRegister src);
+  void movdqu(XMMRegister dst, Operand src);
 
   void movapd(XMMRegister dst, XMMRegister src);
-  void movupd(XMMRegister dst, const Operand& src);
-  void movupd(const Operand& dst, XMMRegister src);
+  void movupd(XMMRegister dst, Operand src);
+  void movupd(Operand dst, XMMRegister src);
 
   void psllq(XMMRegister reg, byte imm8);
   void psrlq(XMMRegister reg, byte imm8);
@@ -1161,98 +1136,96 @@ class Assembler : public AssemblerBase {
   void psraw(XMMRegister reg, byte imm8);
   void psrad(XMMRegister reg, byte imm8);
 
-  void cvttsd2si(Register dst, const Operand& src);
+  void cvttsd2si(Register dst, Operand src);
   void cvttsd2si(Register dst, XMMRegister src);
   void cvttss2siq(Register dst, XMMRegister src);
-  void cvttss2siq(Register dst, const Operand& src);
+  void cvttss2siq(Register dst, Operand src);
   void cvttsd2siq(Register dst, XMMRegister src);
-  void cvttsd2siq(Register dst, const Operand& src);
+  void cvttsd2siq(Register dst, Operand src);
 
-  void cvtlsi2sd(XMMRegister dst, const Operand& src);
+  void cvtlsi2sd(XMMRegister dst, Operand src);
   void cvtlsi2sd(XMMRegister dst, Register src);
 
-  void cvtqsi2ss(XMMRegister dst, const Operand& src);
+  void cvtqsi2ss(XMMRegister dst, Operand src);
   void cvtqsi2ss(XMMRegister dst, Register src);
 
-  void cvtqsi2sd(XMMRegister dst, const Operand& src);
+  void cvtqsi2sd(XMMRegister dst, Operand src);
   void cvtqsi2sd(XMMRegister dst, Register src);
 
 
   void cvtss2sd(XMMRegister dst, XMMRegister src);
-  void cvtss2sd(XMMRegister dst, const Operand& src);
+  void cvtss2sd(XMMRegister dst, Operand src);
   void cvtsd2ss(XMMRegister dst, XMMRegister src);
-  void cvtsd2ss(XMMRegister dst, const Operand& src);
+  void cvtsd2ss(XMMRegister dst, Operand src);
 
   void cvtsd2si(Register dst, XMMRegister src);
   void cvtsd2siq(Register dst, XMMRegister src);
 
   void addsd(XMMRegister dst, XMMRegister src);
-  void addsd(XMMRegister dst, const Operand& src);
+  void addsd(XMMRegister dst, Operand src);
   void subsd(XMMRegister dst, XMMRegister src);
-  void subsd(XMMRegister dst, const Operand& src);
+  void subsd(XMMRegister dst, Operand src);
   void mulsd(XMMRegister dst, XMMRegister src);
-  void mulsd(XMMRegister dst, const Operand& src);
+  void mulsd(XMMRegister dst, Operand src);
   void divsd(XMMRegister dst, XMMRegister src);
-  void divsd(XMMRegister dst, const Operand& src);
+  void divsd(XMMRegister dst, Operand src);
 
   void maxsd(XMMRegister dst, XMMRegister src);
-  void maxsd(XMMRegister dst, const Operand& src);
+  void maxsd(XMMRegister dst, Operand src);
   void minsd(XMMRegister dst, XMMRegister src);
-  void minsd(XMMRegister dst, const Operand& src);
+  void minsd(XMMRegister dst, Operand src);
 
   void andpd(XMMRegister dst, XMMRegister src);
-  void andpd(XMMRegister dst, const Operand& src);
+  void andpd(XMMRegister dst, Operand src);
   void orpd(XMMRegister dst, XMMRegister src);
-  void orpd(XMMRegister dst, const Operand& src);
+  void orpd(XMMRegister dst, Operand src);
   void xorpd(XMMRegister dst, XMMRegister src);
-  void xorpd(XMMRegister dst, const Operand& src);
+  void xorpd(XMMRegister dst, Operand src);
   void sqrtsd(XMMRegister dst, XMMRegister src);
-  void sqrtsd(XMMRegister dst, const Operand& src);
+  void sqrtsd(XMMRegister dst, Operand src);
 
   void haddps(XMMRegister dst, XMMRegister src);
-  void haddps(XMMRegister dst, const Operand& src);
+  void haddps(XMMRegister dst, Operand src);
 
   void ucomisd(XMMRegister dst, XMMRegister src);
-  void ucomisd(XMMRegister dst, const Operand& src);
+  void ucomisd(XMMRegister dst, Operand src);
   void cmpltsd(XMMRegister dst, XMMRegister src);
 
   void movmskpd(Register dst, XMMRegister src);
 
   void punpckldq(XMMRegister dst, XMMRegister src);
-  void punpckldq(XMMRegister dst, const Operand& src);
+  void punpckldq(XMMRegister dst, Operand src);
   void punpckhdq(XMMRegister dst, XMMRegister src);
 
   // SSE 4.1 instruction
   void insertps(XMMRegister dst, XMMRegister src, byte imm8);
   void extractps(Register dst, XMMRegister src, byte imm8);
   void pextrb(Register dst, XMMRegister src, int8_t imm8);
-  void pextrb(const Operand& dst, XMMRegister src, int8_t imm8);
+  void pextrb(Operand dst, XMMRegister src, int8_t imm8);
   void pextrw(Register dst, XMMRegister src, int8_t imm8);
-  void pextrw(const Operand& dst, XMMRegister src, int8_t imm8);
+  void pextrw(Operand dst, XMMRegister src, int8_t imm8);
   void pextrd(Register dst, XMMRegister src, int8_t imm8);
-  void pextrd(const Operand& dst, XMMRegister src, int8_t imm8);
+  void pextrd(Operand dst, XMMRegister src, int8_t imm8);
   void pinsrb(XMMRegister dst, Register src, int8_t imm8);
-  void pinsrb(XMMRegister dst, const Operand& src, int8_t imm8);
+  void pinsrb(XMMRegister dst, Operand src, int8_t imm8);
   void pinsrw(XMMRegister dst, Register src, int8_t imm8);
-  void pinsrw(XMMRegister dst, const Operand& src, int8_t imm8);
+  void pinsrw(XMMRegister dst, Operand src, int8_t imm8);
   void pinsrd(XMMRegister dst, Register src, int8_t imm8);
-  void pinsrd(XMMRegister dst, const Operand& src, int8_t imm8);
+  void pinsrd(XMMRegister dst, Operand src, int8_t imm8);
 
   void roundss(XMMRegister dst, XMMRegister src, RoundingMode mode);
   void roundsd(XMMRegister dst, XMMRegister src, RoundingMode mode);
 
   void cmpps(XMMRegister dst, XMMRegister src, int8_t cmp);
-  void cmpps(XMMRegister dst, const Operand& src, int8_t cmp);
+  void cmpps(XMMRegister dst, Operand src, int8_t cmp);
   void cmppd(XMMRegister dst, XMMRegister src, int8_t cmp);
-  void cmppd(XMMRegister dst, const Operand& src, int8_t cmp);
+  void cmppd(XMMRegister dst, Operand src, int8_t cmp);
 
 #define SSE_CMP_P(instr, imm8)                                                \
   void instr##ps(XMMRegister dst, XMMRegister src) { cmpps(dst, src, imm8); } \
-  void instr##ps(XMMRegister dst, const Operand& src) {                       \
-    cmpps(dst, src, imm8);                                                    \
-  }                                                                           \
+  void instr##ps(XMMRegister dst, Operand src) { cmpps(dst, src, imm8); }     \
   void instr##pd(XMMRegister dst, XMMRegister src) { cmppd(dst, src, imm8); } \
-  void instr##pd(XMMRegister dst, const Operand& src) { cmppd(dst, src, imm8); }
+  void instr##pd(XMMRegister dst, Operand src) { cmppd(dst, src, imm8); }
 
   SSE_CMP_P(cmpeq, 0x0);
   SSE_CMP_P(cmplt, 0x1);
@@ -1264,25 +1237,25 @@ class Assembler : public AssemblerBase {
 #undef SSE_CMP_P
 
   void minps(XMMRegister dst, XMMRegister src);
-  void minps(XMMRegister dst, const Operand& src);
+  void minps(XMMRegister dst, Operand src);
   void maxps(XMMRegister dst, XMMRegister src);
-  void maxps(XMMRegister dst, const Operand& src);
+  void maxps(XMMRegister dst, Operand src);
   void rcpps(XMMRegister dst, XMMRegister src);
-  void rcpps(XMMRegister dst, const Operand& src);
+  void rcpps(XMMRegister dst, Operand src);
   void rsqrtps(XMMRegister dst, XMMRegister src);
-  void rsqrtps(XMMRegister dst, const Operand& src);
+  void rsqrtps(XMMRegister dst, Operand src);
   void sqrtps(XMMRegister dst, XMMRegister src);
-  void sqrtps(XMMRegister dst, const Operand& src);
+  void sqrtps(XMMRegister dst, Operand src);
   void movups(XMMRegister dst, XMMRegister src);
-  void movups(XMMRegister dst, const Operand& src);
-  void movups(const Operand& dst, XMMRegister src);
+  void movups(XMMRegister dst, Operand src);
+  void movups(Operand dst, XMMRegister src);
   void psrldq(XMMRegister dst, uint8_t shift);
   void pshufd(XMMRegister dst, XMMRegister src, uint8_t shuffle);
-  void pshufd(XMMRegister dst, const Operand& src, uint8_t shuffle);
+  void pshufd(XMMRegister dst, Operand src, uint8_t shuffle);
   void pshufhw(XMMRegister dst, XMMRegister src, uint8_t shuffle);
   void pshuflw(XMMRegister dst, XMMRegister src, uint8_t shuffle);
   void cvtdq2ps(XMMRegister dst, XMMRegister src);
-  void cvtdq2ps(XMMRegister dst, const Operand& src);
+  void cvtdq2ps(XMMRegister dst, Operand src);
 
   // AVX instruction
   void vfmadd132sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
@@ -1294,13 +1267,13 @@ class Assembler : public AssemblerBase {
   void vfmadd231sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfmasd(0xb9, dst, src1, src2);
   }
-  void vfmadd132sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmadd132sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0x99, dst, src1, src2);
   }
-  void vfmadd213sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmadd213sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xa9, dst, src1, src2);
   }
-  void vfmadd231sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmadd231sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xb9, dst, src1, src2);
   }
   void vfmsub132sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
@@ -1312,13 +1285,13 @@ class Assembler : public AssemblerBase {
   void vfmsub231sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfmasd(0xbb, dst, src1, src2);
   }
-  void vfmsub132sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmsub132sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0x9b, dst, src1, src2);
   }
-  void vfmsub213sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmsub213sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xab, dst, src1, src2);
   }
-  void vfmsub231sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmsub231sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xbb, dst, src1, src2);
   }
   void vfnmadd132sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
@@ -1330,13 +1303,13 @@ class Assembler : public AssemblerBase {
   void vfnmadd231sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfmasd(0xbd, dst, src1, src2);
   }
-  void vfnmadd132sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmadd132sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0x9d, dst, src1, src2);
   }
-  void vfnmadd213sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmadd213sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xad, dst, src1, src2);
   }
-  void vfnmadd231sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmadd231sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xbd, dst, src1, src2);
   }
   void vfnmsub132sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
@@ -1348,17 +1321,17 @@ class Assembler : public AssemblerBase {
   void vfnmsub231sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfmasd(0xbf, dst, src1, src2);
   }
-  void vfnmsub132sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmsub132sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0x9f, dst, src1, src2);
   }
-  void vfnmsub213sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmsub213sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xaf, dst, src1, src2);
   }
-  void vfnmsub231sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmsub231sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmasd(0xbf, dst, src1, src2);
   }
   void vfmasd(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2);
-  void vfmasd(byte op, XMMRegister dst, XMMRegister src1, const Operand& src2);
+  void vfmasd(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
 
   void vfmadd132ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfmass(0x99, dst, src1, src2);
@@ -1369,13 +1342,13 @@ class Assembler : public AssemblerBase {
   void vfmadd231ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfmass(0xb9, dst, src1, src2);
   }
-  void vfmadd132ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmadd132ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0x99, dst, src1, src2);
   }
-  void vfmadd213ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmadd213ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xa9, dst, src1, src2);
   }
-  void vfmadd231ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmadd231ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xb9, dst, src1, src2);
   }
   void vfmsub132ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
@@ -1387,13 +1360,13 @@ class Assembler : public AssemblerBase {
   void vfmsub231ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfmass(0xbb, dst, src1, src2);
   }
-  void vfmsub132ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmsub132ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0x9b, dst, src1, src2);
   }
-  void vfmsub213ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmsub213ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xab, dst, src1, src2);
   }
-  void vfmsub231ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfmsub231ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xbb, dst, src1, src2);
   }
   void vfnmadd132ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
@@ -1405,13 +1378,13 @@ class Assembler : public AssemblerBase {
   void vfnmadd231ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfmass(0xbd, dst, src1, src2);
   }
-  void vfnmadd132ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmadd132ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0x9d, dst, src1, src2);
   }
-  void vfnmadd213ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmadd213ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xad, dst, src1, src2);
   }
-  void vfnmadd231ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmadd231ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xbd, dst, src1, src2);
   }
   void vfnmsub132ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
@@ -1423,34 +1396,30 @@ class Assembler : public AssemblerBase {
   void vfnmsub231ss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vfmass(0xbf, dst, src1, src2);
   }
-  void vfnmsub132ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmsub132ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0x9f, dst, src1, src2);
   }
-  void vfnmsub213ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmsub213ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xaf, dst, src1, src2);
   }
-  void vfnmsub231ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vfnmsub231ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vfmass(0xbf, dst, src1, src2);
   }
   void vfmass(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2);
-  void vfmass(byte op, XMMRegister dst, XMMRegister src1, const Operand& src2);
+  void vfmass(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
 
   void vmovd(XMMRegister dst, Register src);
-  void vmovd(XMMRegister dst, const Operand& src);
+  void vmovd(XMMRegister dst, Operand src);
   void vmovd(Register dst, XMMRegister src);
   void vmovq(XMMRegister dst, Register src);
-  void vmovq(XMMRegister dst, const Operand& src);
+  void vmovq(XMMRegister dst, Operand src);
   void vmovq(Register dst, XMMRegister src);
 
   void vmovsd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vsd(0x10, dst, src1, src2);
   }
-  void vmovsd(XMMRegister dst, const Operand& src) {
-    vsd(0x10, dst, xmm0, src);
-  }
-  void vmovsd(const Operand& dst, XMMRegister src) {
-    vsd(0x11, src, xmm0, dst);
-  }
+  void vmovsd(XMMRegister dst, Operand src) { vsd(0x10, dst, xmm0, src); }
+  void vmovsd(Operand dst, XMMRegister src) { vsd(0x11, src, xmm0, dst); }
 
 #define AVX_SP_3(instr, opcode) \
   AVX_S_3(instr, opcode)        \
@@ -1464,12 +1433,12 @@ class Assembler : public AssemblerBase {
   AVX_3(instr##ps, opcode, vps) \
   AVX_3(instr##pd, opcode, vpd)
 
-#define AVX_3(instr, opcode, impl)                                     \
-  void instr(XMMRegister dst, XMMRegister src1, XMMRegister src2) {    \
-    impl(opcode, dst, src1, src2);                                     \
-  }                                                                    \
-  void instr(XMMRegister dst, XMMRegister src1, const Operand& src2) { \
-    impl(opcode, dst, src1, src2);                                     \
+#define AVX_3(instr, opcode, impl)                                  \
+  void instr(XMMRegister dst, XMMRegister src1, XMMRegister src2) { \
+    impl(opcode, dst, src1, src2);                                  \
+  }                                                                 \
+  void instr(XMMRegister dst, XMMRegister src1, Operand src2) {     \
+    impl(opcode, dst, src1, src2);                                  \
   }
 
   AVX_SP_3(vsqrt, 0x51);
@@ -1483,6 +1452,7 @@ class Assembler : public AssemblerBase {
   AVX_P_3(vor, 0x56);
   AVX_P_3(vxor, 0x57);
   AVX_3(vcvtsd2ss, 0x5a, vsd);
+  AVX_3(vhaddps, 0x7c, vsd);
 
 #undef AVX_3
 #undef AVX_S_3
@@ -1500,42 +1470,42 @@ class Assembler : public AssemblerBase {
   void vcvtss2sd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vinstr(0x5a, dst, src1, src2, kF3, k0F, kWIG);
   }
-  void vcvtss2sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vcvtss2sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vinstr(0x5a, dst, src1, src2, kF3, k0F, kWIG);
   }
   void vcvtlsi2sd(XMMRegister dst, XMMRegister src1, Register src2) {
     XMMRegister isrc2 = XMMRegister::from_code(src2.code());
     vinstr(0x2a, dst, src1, isrc2, kF2, k0F, kW0);
   }
-  void vcvtlsi2sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vcvtlsi2sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vinstr(0x2a, dst, src1, src2, kF2, k0F, kW0);
   }
   void vcvtlsi2ss(XMMRegister dst, XMMRegister src1, Register src2) {
     XMMRegister isrc2 = XMMRegister::from_code(src2.code());
     vinstr(0x2a, dst, src1, isrc2, kF3, k0F, kW0);
   }
-  void vcvtlsi2ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vcvtlsi2ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vinstr(0x2a, dst, src1, src2, kF3, k0F, kW0);
   }
   void vcvtqsi2ss(XMMRegister dst, XMMRegister src1, Register src2) {
     XMMRegister isrc2 = XMMRegister::from_code(src2.code());
     vinstr(0x2a, dst, src1, isrc2, kF3, k0F, kW1);
   }
-  void vcvtqsi2ss(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vcvtqsi2ss(XMMRegister dst, XMMRegister src1, Operand src2) {
     vinstr(0x2a, dst, src1, src2, kF3, k0F, kW1);
   }
   void vcvtqsi2sd(XMMRegister dst, XMMRegister src1, Register src2) {
     XMMRegister isrc2 = XMMRegister::from_code(src2.code());
     vinstr(0x2a, dst, src1, isrc2, kF2, k0F, kW1);
   }
-  void vcvtqsi2sd(XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vcvtqsi2sd(XMMRegister dst, XMMRegister src1, Operand src2) {
     vinstr(0x2a, dst, src1, src2, kF2, k0F, kW1);
   }
   void vcvttss2si(Register dst, XMMRegister src) {
     XMMRegister idst = XMMRegister::from_code(dst.code());
     vinstr(0x2c, idst, xmm0, src, kF3, k0F, kW0);
   }
-  void vcvttss2si(Register dst, const Operand& src) {
+  void vcvttss2si(Register dst, Operand src) {
     XMMRegister idst = XMMRegister::from_code(dst.code());
     vinstr(0x2c, idst, xmm0, src, kF3, k0F, kW0);
   }
@@ -1543,7 +1513,7 @@ class Assembler : public AssemblerBase {
     XMMRegister idst = XMMRegister::from_code(dst.code());
     vinstr(0x2c, idst, xmm0, src, kF2, k0F, kW0);
   }
-  void vcvttsd2si(Register dst, const Operand& src) {
+  void vcvttsd2si(Register dst, Operand src) {
     XMMRegister idst = XMMRegister::from_code(dst.code());
     vinstr(0x2c, idst, xmm0, src, kF2, k0F, kW0);
   }
@@ -1551,7 +1521,7 @@ class Assembler : public AssemblerBase {
     XMMRegister idst = XMMRegister::from_code(dst.code());
     vinstr(0x2c, idst, xmm0, src, kF3, k0F, kW1);
   }
-  void vcvttss2siq(Register dst, const Operand& src) {
+  void vcvttss2siq(Register dst, Operand src) {
     XMMRegister idst = XMMRegister::from_code(dst.code());
     vinstr(0x2c, idst, xmm0, src, kF3, k0F, kW1);
   }
@@ -1559,7 +1529,7 @@ class Assembler : public AssemblerBase {
     XMMRegister idst = XMMRegister::from_code(dst.code());
     vinstr(0x2c, idst, xmm0, src, kF2, k0F, kW1);
   }
-  void vcvttsd2siq(Register dst, const Operand& src) {
+  void vcvttsd2siq(Register dst, Operand src) {
     XMMRegister idst = XMMRegister::from_code(dst.code());
     vinstr(0x2c, idst, xmm0, src, kF2, k0F, kW1);
   }
@@ -1570,7 +1540,7 @@ class Assembler : public AssemblerBase {
   void vucomisd(XMMRegister dst, XMMRegister src) {
     vinstr(0x2e, dst, xmm0, src, k66, k0F, kWIG);
   }
-  void vucomisd(XMMRegister dst, const Operand& src) {
+  void vucomisd(XMMRegister dst, Operand src) {
     vinstr(0x2e, dst, xmm0, src, k66, k0F, kWIG);
   }
   void vroundss(XMMRegister dst, XMMRegister src1, XMMRegister src2,
@@ -1587,39 +1557,27 @@ class Assembler : public AssemblerBase {
   void vsd(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vinstr(op, dst, src1, src2, kF2, k0F, kWIG);
   }
-  void vsd(byte op, XMMRegister dst, XMMRegister src1, const Operand& src2) {
+  void vsd(byte op, XMMRegister dst, XMMRegister src1, Operand src2) {
     vinstr(op, dst, src1, src2, kF2, k0F, kWIG);
   }
 
   void vmovss(XMMRegister dst, XMMRegister src1, XMMRegister src2) {
     vss(0x10, dst, src1, src2);
   }
-  void vmovss(XMMRegister dst, const Operand& src) {
-    vss(0x10, dst, xmm0, src);
-  }
-  void vmovss(const Operand& dst, XMMRegister src) {
-    vss(0x11, src, xmm0, dst);
-  }
+  void vmovss(XMMRegister dst, Operand src) { vss(0x10, dst, xmm0, src); }
+  void vmovss(Operand dst, XMMRegister src) { vss(0x11, src, xmm0, dst); }
   void vucomiss(XMMRegister dst, XMMRegister src);
-  void vucomiss(XMMRegister dst, const Operand& src);
+  void vucomiss(XMMRegister dst, Operand src);
   void vss(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2);
-  void vss(byte op, XMMRegister dst, XMMRegister src1, const Operand& src2);
+  void vss(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
 
   void vmovaps(XMMRegister dst, XMMRegister src) { vps(0x28, dst, xmm0, src); }
   void vmovups(XMMRegister dst, XMMRegister src) { vps(0x10, dst, xmm0, src); }
-  void vmovups(XMMRegister dst, const Operand& src) {
-    vps(0x10, dst, xmm0, src);
-  }
-  void vmovups(const Operand& dst, XMMRegister src) {
-    vps(0x11, src, xmm0, dst);
-  }
+  void vmovups(XMMRegister dst, Operand src) { vps(0x10, dst, xmm0, src); }
+  void vmovups(Operand dst, XMMRegister src) { vps(0x11, src, xmm0, dst); }
   void vmovapd(XMMRegister dst, XMMRegister src) { vpd(0x28, dst, xmm0, src); }
-  void vmovupd(XMMRegister dst, const Operand& src) {
-    vpd(0x10, dst, xmm0, src);
-  }
-  void vmovupd(const Operand& dst, XMMRegister src) {
-    vpd(0x11, src, xmm0, dst);
-  }
+  void vmovupd(XMMRegister dst, Operand src) { vpd(0x10, dst, xmm0, src); }
+  void vmovupd(Operand dst, XMMRegister src) { vpd(0x11, src, xmm0, dst); }
   void vmovmskps(Register dst, XMMRegister src) {
     XMMRegister idst = XMMRegister::from_code(dst.code());
     vps(0x50, idst, xmm0, src);
@@ -1632,8 +1590,7 @@ class Assembler : public AssemblerBase {
     vps(0xC2, dst, src1, src2);
     emit(cmp);
   }
-  void vcmpps(XMMRegister dst, XMMRegister src1, const Operand& src2,
-              int8_t cmp) {
+  void vcmpps(XMMRegister dst, XMMRegister src1, Operand src2, int8_t cmp) {
     vps(0xC2, dst, src1, src2);
     emit(cmp);
   }
@@ -1641,24 +1598,23 @@ class Assembler : public AssemblerBase {
     vpd(0xC2, dst, src1, src2);
     emit(cmp);
   }
-  void vcmppd(XMMRegister dst, XMMRegister src1, const Operand& src2,
-              int8_t cmp) {
+  void vcmppd(XMMRegister dst, XMMRegister src1, Operand src2, int8_t cmp) {
     vpd(0xC2, dst, src1, src2);
     emit(cmp);
   }
 
-#define AVX_CMP_P(instr, imm8)                                             \
-  void instr##ps(XMMRegister dst, XMMRegister src1, XMMRegister src2) {    \
-    vcmpps(dst, src1, src2, imm8);                                         \
-  }                                                                        \
-  void instr##ps(XMMRegister dst, XMMRegister src1, const Operand& src2) { \
-    vcmpps(dst, src1, src2, imm8);                                         \
-  }                                                                        \
-  void instr##pd(XMMRegister dst, XMMRegister src1, XMMRegister src2) {    \
-    vcmppd(dst, src1, src2, imm8);                                         \
-  }                                                                        \
-  void instr##pd(XMMRegister dst, XMMRegister src1, const Operand& src2) { \
-    vcmppd(dst, src1, src2, imm8);                                         \
+#define AVX_CMP_P(instr, imm8)                                          \
+  void instr##ps(XMMRegister dst, XMMRegister src1, XMMRegister src2) { \
+    vcmpps(dst, src1, src2, imm8);                                      \
+  }                                                                     \
+  void instr##ps(XMMRegister dst, XMMRegister src1, Operand src2) {     \
+    vcmpps(dst, src1, src2, imm8);                                      \
+  }                                                                     \
+  void instr##pd(XMMRegister dst, XMMRegister src1, XMMRegister src2) { \
+    vcmppd(dst, src1, src2, imm8);                                      \
+  }                                                                     \
+  void instr##pd(XMMRegister dst, XMMRegister src1, Operand src2) {     \
+    vcmppd(dst, src1, src2, imm8);                                      \
   }
 
   AVX_CMP_P(vcmpeq, 0x0);
@@ -1670,240 +1626,237 @@ class Assembler : public AssemblerBase {
 
 #undef AVX_CMP_P
 
-  void vlddqu(XMMRegister dst, const Operand& src) {
+  void vlddqu(XMMRegister dst, Operand src) {
     vinstr(0xF0, dst, xmm0, src, kF2, k0F, kWIG);
   }
-  void vpsllw(XMMRegister dst, XMMRegister src, int8_t imm8) {
+  void vpsllw(XMMRegister dst, XMMRegister src, uint8_t imm8) {
     vinstr(0x71, xmm6, dst, src, k66, k0F, kWIG);
     emit(imm8);
   }
-  void vpsrlw(XMMRegister dst, XMMRegister src, int8_t imm8) {
+  void vpsrlw(XMMRegister dst, XMMRegister src, uint8_t imm8) {
     vinstr(0x71, xmm2, dst, src, k66, k0F, kWIG);
     emit(imm8);
   }
-  void vpsraw(XMMRegister dst, XMMRegister src, int8_t imm8) {
+  void vpsraw(XMMRegister dst, XMMRegister src, uint8_t imm8) {
     vinstr(0x71, xmm4, dst, src, k66, k0F, kWIG);
     emit(imm8);
   }
-  void vpslld(XMMRegister dst, XMMRegister src, int8_t imm8) {
+  void vpslld(XMMRegister dst, XMMRegister src, uint8_t imm8) {
     vinstr(0x72, xmm6, dst, src, k66, k0F, kWIG);
     emit(imm8);
   }
-  void vpsrld(XMMRegister dst, XMMRegister src, int8_t imm8) {
+  void vpsrld(XMMRegister dst, XMMRegister src, uint8_t imm8) {
     vinstr(0x72, xmm2, dst, src, k66, k0F, kWIG);
     emit(imm8);
   }
-  void vpsrad(XMMRegister dst, XMMRegister src, int8_t imm8) {
+  void vpsrad(XMMRegister dst, XMMRegister src, uint8_t imm8) {
     vinstr(0x72, xmm4, dst, src, k66, k0F, kWIG);
     emit(imm8);
   }
-  void vpextrb(Register dst, XMMRegister src, int8_t imm8) {
+  void vpextrb(Register dst, XMMRegister src, uint8_t imm8) {
     XMMRegister idst = XMMRegister::from_code(dst.code());
     vinstr(0x14, src, xmm0, idst, k66, k0F3A, kW0);
     emit(imm8);
   }
-  void vpextrb(const Operand& dst, XMMRegister src, int8_t imm8) {
+  void vpextrb(Operand dst, XMMRegister src, uint8_t imm8) {
     vinstr(0x14, src, xmm0, dst, k66, k0F3A, kW0);
     emit(imm8);
   }
-  void vpextrw(Register dst, XMMRegister src, int8_t imm8) {
+  void vpextrw(Register dst, XMMRegister src, uint8_t imm8) {
     XMMRegister idst = XMMRegister::from_code(dst.code());
     vinstr(0xc5, idst, xmm0, src, k66, k0F, kW0);
     emit(imm8);
   }
-  void vpextrw(const Operand& dst, XMMRegister src, int8_t imm8) {
+  void vpextrw(Operand dst, XMMRegister src, uint8_t imm8) {
     vinstr(0x15, src, xmm0, dst, k66, k0F3A, kW0);
     emit(imm8);
   }
-  void vpextrd(Register dst, XMMRegister src, int8_t imm8) {
+  void vpextrd(Register dst, XMMRegister src, uint8_t imm8) {
     XMMRegister idst = XMMRegister::from_code(dst.code());
     vinstr(0x16, src, xmm0, idst, k66, k0F3A, kW0);
     emit(imm8);
   }
-  void vpextrd(const Operand& dst, XMMRegister src, int8_t imm8) {
+  void vpextrd(Operand dst, XMMRegister src, uint8_t imm8) {
     vinstr(0x16, src, xmm0, dst, k66, k0F3A, kW0);
     emit(imm8);
   }
-  void vpinsrb(XMMRegister dst, XMMRegister src1, Register src2, int8_t imm8) {
+  void vpinsrb(XMMRegister dst, XMMRegister src1, Register src2, uint8_t imm8) {
     XMMRegister isrc = XMMRegister::from_code(src2.code());
     vinstr(0x20, dst, src1, isrc, k66, k0F3A, kW0);
     emit(imm8);
   }
-  void vpinsrb(XMMRegister dst, XMMRegister src1, const Operand& src2,
-               int8_t imm8) {
+  void vpinsrb(XMMRegister dst, XMMRegister src1, Operand src2, uint8_t imm8) {
     vinstr(0x20, dst, src1, src2, k66, k0F3A, kW0);
     emit(imm8);
   }
-  void vpinsrw(XMMRegister dst, XMMRegister src1, Register src2, int8_t imm8) {
+  void vpinsrw(XMMRegister dst, XMMRegister src1, Register src2, uint8_t imm8) {
     XMMRegister isrc = XMMRegister::from_code(src2.code());
     vinstr(0xc4, dst, src1, isrc, k66, k0F, kW0);
     emit(imm8);
   }
-  void vpinsrw(XMMRegister dst, XMMRegister src1, const Operand& src2,
-               int8_t imm8) {
+  void vpinsrw(XMMRegister dst, XMMRegister src1, Operand src2, uint8_t imm8) {
     vinstr(0xc4, dst, src1, src2, k66, k0F, kW0);
     emit(imm8);
   }
-  void vpinsrd(XMMRegister dst, XMMRegister src1, Register src2, int8_t imm8) {
+  void vpinsrd(XMMRegister dst, XMMRegister src1, Register src2, uint8_t imm8) {
     XMMRegister isrc = XMMRegister::from_code(src2.code());
     vinstr(0x22, dst, src1, isrc, k66, k0F3A, kW0);
     emit(imm8);
   }
-  void vpinsrd(XMMRegister dst, XMMRegister src1, const Operand& src2,
-               int8_t imm8) {
+  void vpinsrd(XMMRegister dst, XMMRegister src1, Operand src2, uint8_t imm8) {
     vinstr(0x22, dst, src1, src2, k66, k0F3A, kW0);
     emit(imm8);
   }
-  void vpshufd(XMMRegister dst, XMMRegister src, int8_t imm8) {
+  void vpshufd(XMMRegister dst, XMMRegister src, uint8_t imm8) {
     vinstr(0x70, dst, xmm0, src, k66, k0F, kWIG);
     emit(imm8);
   }
 
   void vps(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2);
-  void vps(byte op, XMMRegister dst, XMMRegister src1, const Operand& src2);
+  void vps(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
   void vpd(byte op, XMMRegister dst, XMMRegister src1, XMMRegister src2);
-  void vpd(byte op, XMMRegister dst, XMMRegister src1, const Operand& src2);
+  void vpd(byte op, XMMRegister dst, XMMRegister src1, Operand src2);
 
   // BMI instruction
   void andnq(Register dst, Register src1, Register src2) {
     bmi1q(0xf2, dst, src1, src2);
   }
-  void andnq(Register dst, Register src1, const Operand& src2) {
+  void andnq(Register dst, Register src1, Operand src2) {
     bmi1q(0xf2, dst, src1, src2);
   }
   void andnl(Register dst, Register src1, Register src2) {
     bmi1l(0xf2, dst, src1, src2);
   }
-  void andnl(Register dst, Register src1, const Operand& src2) {
+  void andnl(Register dst, Register src1, Operand src2) {
     bmi1l(0xf2, dst, src1, src2);
   }
   void bextrq(Register dst, Register src1, Register src2) {
     bmi1q(0xf7, dst, src2, src1);
   }
-  void bextrq(Register dst, const Operand& src1, Register src2) {
+  void bextrq(Register dst, Operand src1, Register src2) {
     bmi1q(0xf7, dst, src2, src1);
   }
   void bextrl(Register dst, Register src1, Register src2) {
     bmi1l(0xf7, dst, src2, src1);
   }
-  void bextrl(Register dst, const Operand& src1, Register src2) {
+  void bextrl(Register dst, Operand src1, Register src2) {
     bmi1l(0xf7, dst, src2, src1);
   }
   void blsiq(Register dst, Register src) { bmi1q(0xf3, rbx, dst, src); }
-  void blsiq(Register dst, const Operand& src) { bmi1q(0xf3, rbx, dst, src); }
+  void blsiq(Register dst, Operand src) { bmi1q(0xf3, rbx, dst, src); }
   void blsil(Register dst, Register src) { bmi1l(0xf3, rbx, dst, src); }
-  void blsil(Register dst, const Operand& src) { bmi1l(0xf3, rbx, dst, src); }
+  void blsil(Register dst, Operand src) { bmi1l(0xf3, rbx, dst, src); }
   void blsmskq(Register dst, Register src) { bmi1q(0xf3, rdx, dst, src); }
-  void blsmskq(Register dst, const Operand& src) { bmi1q(0xf3, rdx, dst, src); }
+  void blsmskq(Register dst, Operand src) { bmi1q(0xf3, rdx, dst, src); }
   void blsmskl(Register dst, Register src) { bmi1l(0xf3, rdx, dst, src); }
-  void blsmskl(Register dst, const Operand& src) { bmi1l(0xf3, rdx, dst, src); }
+  void blsmskl(Register dst, Operand src) { bmi1l(0xf3, rdx, dst, src); }
   void blsrq(Register dst, Register src) { bmi1q(0xf3, rcx, dst, src); }
-  void blsrq(Register dst, const Operand& src) { bmi1q(0xf3, rcx, dst, src); }
+  void blsrq(Register dst, Operand src) { bmi1q(0xf3, rcx, dst, src); }
   void blsrl(Register dst, Register src) { bmi1l(0xf3, rcx, dst, src); }
-  void blsrl(Register dst, const Operand& src) { bmi1l(0xf3, rcx, dst, src); }
+  void blsrl(Register dst, Operand src) { bmi1l(0xf3, rcx, dst, src); }
   void tzcntq(Register dst, Register src);
-  void tzcntq(Register dst, const Operand& src);
+  void tzcntq(Register dst, Operand src);
   void tzcntl(Register dst, Register src);
-  void tzcntl(Register dst, const Operand& src);
+  void tzcntl(Register dst, Operand src);
 
   void lzcntq(Register dst, Register src);
-  void lzcntq(Register dst, const Operand& src);
+  void lzcntq(Register dst, Operand src);
   void lzcntl(Register dst, Register src);
-  void lzcntl(Register dst, const Operand& src);
+  void lzcntl(Register dst, Operand src);
 
   void popcntq(Register dst, Register src);
-  void popcntq(Register dst, const Operand& src);
+  void popcntq(Register dst, Operand src);
   void popcntl(Register dst, Register src);
-  void popcntl(Register dst, const Operand& src);
+  void popcntl(Register dst, Operand src);
 
   void bzhiq(Register dst, Register src1, Register src2) {
     bmi2q(kNone, 0xf5, dst, src2, src1);
   }
-  void bzhiq(Register dst, const Operand& src1, Register src2) {
+  void bzhiq(Register dst, Operand src1, Register src2) {
     bmi2q(kNone, 0xf5, dst, src2, src1);
   }
   void bzhil(Register dst, Register src1, Register src2) {
     bmi2l(kNone, 0xf5, dst, src2, src1);
   }
-  void bzhil(Register dst, const Operand& src1, Register src2) {
+  void bzhil(Register dst, Operand src1, Register src2) {
     bmi2l(kNone, 0xf5, dst, src2, src1);
   }
   void mulxq(Register dst1, Register dst2, Register src) {
     bmi2q(kF2, 0xf6, dst1, dst2, src);
   }
-  void mulxq(Register dst1, Register dst2, const Operand& src) {
+  void mulxq(Register dst1, Register dst2, Operand src) {
     bmi2q(kF2, 0xf6, dst1, dst2, src);
   }
   void mulxl(Register dst1, Register dst2, Register src) {
     bmi2l(kF2, 0xf6, dst1, dst2, src);
   }
-  void mulxl(Register dst1, Register dst2, const Operand& src) {
+  void mulxl(Register dst1, Register dst2, Operand src) {
     bmi2l(kF2, 0xf6, dst1, dst2, src);
   }
   void pdepq(Register dst, Register src1, Register src2) {
     bmi2q(kF2, 0xf5, dst, src1, src2);
   }
-  void pdepq(Register dst, Register src1, const Operand& src2) {
+  void pdepq(Register dst, Register src1, Operand src2) {
     bmi2q(kF2, 0xf5, dst, src1, src2);
   }
   void pdepl(Register dst, Register src1, Register src2) {
     bmi2l(kF2, 0xf5, dst, src1, src2);
   }
-  void pdepl(Register dst, Register src1, const Operand& src2) {
+  void pdepl(Register dst, Register src1, Operand src2) {
     bmi2l(kF2, 0xf5, dst, src1, src2);
   }
   void pextq(Register dst, Register src1, Register src2) {
     bmi2q(kF3, 0xf5, dst, src1, src2);
   }
-  void pextq(Register dst, Register src1, const Operand& src2) {
+  void pextq(Register dst, Register src1, Operand src2) {
     bmi2q(kF3, 0xf5, dst, src1, src2);
   }
   void pextl(Register dst, Register src1, Register src2) {
     bmi2l(kF3, 0xf5, dst, src1, src2);
   }
-  void pextl(Register dst, Register src1, const Operand& src2) {
+  void pextl(Register dst, Register src1, Operand src2) {
     bmi2l(kF3, 0xf5, dst, src1, src2);
   }
   void sarxq(Register dst, Register src1, Register src2) {
     bmi2q(kF3, 0xf7, dst, src2, src1);
   }
-  void sarxq(Register dst, const Operand& src1, Register src2) {
+  void sarxq(Register dst, Operand src1, Register src2) {
     bmi2q(kF3, 0xf7, dst, src2, src1);
   }
   void sarxl(Register dst, Register src1, Register src2) {
     bmi2l(kF3, 0xf7, dst, src2, src1);
   }
-  void sarxl(Register dst, const Operand& src1, Register src2) {
+  void sarxl(Register dst, Operand src1, Register src2) {
     bmi2l(kF3, 0xf7, dst, src2, src1);
   }
   void shlxq(Register dst, Register src1, Register src2) {
     bmi2q(k66, 0xf7, dst, src2, src1);
   }
-  void shlxq(Register dst, const Operand& src1, Register src2) {
+  void shlxq(Register dst, Operand src1, Register src2) {
     bmi2q(k66, 0xf7, dst, src2, src1);
   }
   void shlxl(Register dst, Register src1, Register src2) {
     bmi2l(k66, 0xf7, dst, src2, src1);
   }
-  void shlxl(Register dst, const Operand& src1, Register src2) {
+  void shlxl(Register dst, Operand src1, Register src2) {
     bmi2l(k66, 0xf7, dst, src2, src1);
   }
   void shrxq(Register dst, Register src1, Register src2) {
     bmi2q(kF2, 0xf7, dst, src2, src1);
   }
-  void shrxq(Register dst, const Operand& src1, Register src2) {
+  void shrxq(Register dst, Operand src1, Register src2) {
     bmi2q(kF2, 0xf7, dst, src2, src1);
   }
   void shrxl(Register dst, Register src1, Register src2) {
     bmi2l(kF2, 0xf7, dst, src2, src1);
   }
-  void shrxl(Register dst, const Operand& src1, Register src2) {
+  void shrxl(Register dst, Operand src1, Register src2) {
     bmi2l(kF2, 0xf7, dst, src2, src1);
   }
   void rorxq(Register dst, Register src, byte imm8);
-  void rorxq(Register dst, const Operand& src, byte imm8);
+  void rorxq(Register dst, Operand src, byte imm8);
   void rorxl(Register dst, Register src, byte imm8);
-  void rorxl(Register dst, const Operand& src, byte imm8);
+  void rorxl(Register dst, Operand src, byte imm8);
 
   void lfence();
   void pause();
@@ -1961,7 +1914,7 @@ class Assembler : public AssemblerBase {
 
  protected:
   // Call near indirect
-  void call(const Operand& operand);
+  void call(Operand operand);
 
  private:
   byte* addr_at(int pos)  { return buffer_ + pos; }
@@ -1997,8 +1950,8 @@ class Assembler : public AssemblerBase {
   // The high bit of reg is used for REX.R, the high bit of op's base
   // register is used for REX.B, and the high bit of op's index register
   // is used for REX.X.  REX.W is set.
-  inline void emit_rex_64(Register reg, const Operand& op);
-  inline void emit_rex_64(XMMRegister reg, const Operand& op);
+  inline void emit_rex_64(Register reg, Operand op);
+  inline void emit_rex_64(XMMRegister reg, Operand op);
 
   // Emits a REX prefix that encodes a 64-bit operand size and
   // the top bit of the register code.
@@ -2011,7 +1964,7 @@ class Assembler : public AssemblerBase {
   // The high bit of op's base register is used for REX.B, and the high
   // bit of op's index register is used for REX.X.
   // REX.W is set and REX.R clear.
-  inline void emit_rex_64(const Operand& op);
+  inline void emit_rex_64(Operand op);
 
   // Emit a REX prefix that only sets REX.W to choose a 64-bit operand size.
   void emit_rex_64() { emit(0x48); }
@@ -2023,7 +1976,7 @@ class Assembler : public AssemblerBase {
   // The high bit of reg is used for REX.R, the high bit of op's base
   // register is used for REX.B, and the high bit of op's index register
   // is used for REX.X.  REX.W is cleared.
-  inline void emit_rex_32(Register reg, const Operand& op);
+  inline void emit_rex_32(Register reg, Operand op);
 
   // High bit of rm_reg goes to REX.B.
   // REX.W, REX.R and REX.X are clear.
@@ -2031,7 +1984,7 @@ class Assembler : public AssemblerBase {
 
   // High bit of base goes to REX.B and high bit of index to REX.X.
   // REX.W and REX.R are clear.
-  inline void emit_rex_32(const Operand& op);
+  inline void emit_rex_32(Operand op);
 
   // High bit of reg goes to REX.R, high bit of rm_reg goes to REX.B.
   // REX.W is cleared.  If no REX bits are set, no byte is emitted.
@@ -2041,7 +1994,7 @@ class Assembler : public AssemblerBase {
   // register is used for REX.B, and the high bit of op's index register
   // is used for REX.X.  REX.W is cleared.  If no REX bits are set, nothing
   // is emitted.
-  inline void emit_optional_rex_32(Register reg, const Operand& op);
+  inline void emit_optional_rex_32(Register reg, Operand op);
 
   // As for emit_optional_rex_32(Register, Register), except that
   // the registers are XMM registers.
@@ -2055,18 +2008,18 @@ class Assembler : public AssemblerBase {
   // one of the registers is an XMM registers.
   inline void emit_optional_rex_32(Register reg, XMMRegister base);
 
-  // As for emit_optional_rex_32(Register, const Operand&), except that
+  // As for emit_optional_rex_32(Register, Operand), except that
   // the register is an XMM register.
-  inline void emit_optional_rex_32(XMMRegister reg, const Operand& op);
+  inline void emit_optional_rex_32(XMMRegister reg, Operand op);
 
   // Optionally do as emit_rex_32(Register) if the register number has
   // the high bit set.
   inline void emit_optional_rex_32(Register rm_reg);
   inline void emit_optional_rex_32(XMMRegister rm_reg);
 
-  // Optionally do as emit_rex_32(const Operand&) if the operand register
+  // Optionally do as emit_rex_32(Operand) if the operand register
   // numbers have a high bit set.
-  inline void emit_optional_rex_32(const Operand& op);
+  inline void emit_optional_rex_32(Operand op);
 
   void emit_rex(int size) {
     if (size == kInt64Size) {
@@ -2102,8 +2055,7 @@ class Assembler : public AssemblerBase {
                               SIMDPrefix pp);
   void emit_vex3_byte0() { emit(0xc4); }
   inline void emit_vex3_byte1(XMMRegister reg, XMMRegister rm, LeadingOpcode m);
-  inline void emit_vex3_byte1(XMMRegister reg, const Operand& rm,
-                              LeadingOpcode m);
+  inline void emit_vex3_byte1(XMMRegister reg, Operand rm, LeadingOpcode m);
   inline void emit_vex3_byte2(VexW w, XMMRegister v, VectorLength l,
                               SIMDPrefix pp);
   inline void emit_vex_prefix(XMMRegister reg, XMMRegister v, XMMRegister rm,
@@ -2112,10 +2064,10 @@ class Assembler : public AssemblerBase {
   inline void emit_vex_prefix(Register reg, Register v, Register rm,
                               VectorLength l, SIMDPrefix pp, LeadingOpcode m,
                               VexW w);
-  inline void emit_vex_prefix(XMMRegister reg, XMMRegister v, const Operand& rm,
+  inline void emit_vex_prefix(XMMRegister reg, XMMRegister v, Operand rm,
                               VectorLength l, SIMDPrefix pp, LeadingOpcode m,
                               VexW w);
-  inline void emit_vex_prefix(Register reg, Register v, const Operand& rm,
+  inline void emit_vex_prefix(Register reg, Register v, Operand rm,
                               VectorLength l, SIMDPrefix pp, LeadingOpcode m,
                               VexW w);
 
@@ -2123,14 +2075,14 @@ class Assembler : public AssemblerBase {
   // 1- or 4-byte offset for a memory operand.  Also encodes
   // the second operand of the operation, a register or operation
   // subcode, into the reg field of the ModR/M byte.
-  void emit_operand(Register reg, const Operand& adr) {
+  void emit_operand(Register reg, Operand adr) {
     emit_operand(reg.low_bits(), adr);
   }
 
   // Emit the ModR/M byte, and optionally the SIB byte and
   // 1- or 4-byte offset for a memory operand.  Also used to encode
   // a three-bit opcode extension into the ModR/M byte.
-  void emit_operand(int rm, const Operand& adr);
+  void emit_operand(int rm, Operand adr);
 
   // Emit a ModR/M byte with registers coded in the reg and rm_reg fields.
   void emit_modrm(Register reg, Register rm_reg) {
@@ -2149,8 +2101,8 @@ class Assembler : public AssemblerBase {
 
   // The first argument is the reg field, the second argument is the r/m field.
   void emit_sse_operand(XMMRegister dst, XMMRegister src);
-  void emit_sse_operand(XMMRegister reg, const Operand& adr);
-  void emit_sse_operand(Register reg, const Operand& adr);
+  void emit_sse_operand(XMMRegister reg, Operand adr);
+  void emit_sse_operand(Register reg, Operand adr);
   void emit_sse_operand(XMMRegister dst, Register src);
   void emit_sse_operand(Register dst, XMMRegister src);
   void emit_sse_operand(XMMRegister dst);
@@ -2160,37 +2112,28 @@ class Assembler : public AssemblerBase {
   // similar, differing just in the opcode or in the reg field of the
   // ModR/M byte.
   void arithmetic_op_8(byte opcode, Register reg, Register rm_reg);
-  void arithmetic_op_8(byte opcode, Register reg, const Operand& rm_reg);
+  void arithmetic_op_8(byte opcode, Register reg, Operand rm_reg);
   void arithmetic_op_16(byte opcode, Register reg, Register rm_reg);
-  void arithmetic_op_16(byte opcode, Register reg, const Operand& rm_reg);
+  void arithmetic_op_16(byte opcode, Register reg, Operand rm_reg);
   // Operate on operands/registers with pointer size, 32-bit or 64-bit size.
   void arithmetic_op(byte opcode, Register reg, Register rm_reg, int size);
-  void arithmetic_op(byte opcode,
-                     Register reg,
-                     const Operand& rm_reg,
-                     int size);
+  void arithmetic_op(byte opcode, Register reg, Operand rm_reg, int size);
   // Operate on a byte in memory or register.
   void immediate_arithmetic_op_8(byte subcode,
                                  Register dst,
                                  Immediate src);
-  void immediate_arithmetic_op_8(byte subcode,
-                                 const Operand& dst,
-                                 Immediate src);
+  void immediate_arithmetic_op_8(byte subcode, Operand dst, Immediate src);
   // Operate on a word in memory or register.
   void immediate_arithmetic_op_16(byte subcode,
                                   Register dst,
                                   Immediate src);
-  void immediate_arithmetic_op_16(byte subcode,
-                                  const Operand& dst,
-                                  Immediate src);
+  void immediate_arithmetic_op_16(byte subcode, Operand dst, Immediate src);
   // Operate on operands/registers with pointer size, 32-bit or 64-bit size.
   void immediate_arithmetic_op(byte subcode,
                                Register dst,
                                Immediate src,
                                int size);
-  void immediate_arithmetic_op(byte subcode,
-                               const Operand& dst,
-                               Immediate src,
+  void immediate_arithmetic_op(byte subcode, Operand dst, Immediate src,
                                int size);
 
   // Emit machine code for a shift operation.
@@ -2218,15 +2161,15 @@ class Assembler : public AssemblerBase {
     immediate_arithmetic_op(0x0, dst, src, size);
   }
 
-  void emit_add(Register dst, const Operand& src, int size) {
+  void emit_add(Register dst, Operand src, int size) {
     arithmetic_op(0x03, dst, src, size);
   }
 
-  void emit_add(const Operand& dst, Register src, int size) {
+  void emit_add(Operand dst, Register src, int size) {
     arithmetic_op(0x1, src, dst, size);
   }
 
-  void emit_add(const Operand& dst, Immediate src, int size) {
+  void emit_add(Operand dst, Immediate src, int size) {
     immediate_arithmetic_op(0x0, dst, src, size);
   }
 
@@ -2234,11 +2177,11 @@ class Assembler : public AssemblerBase {
     arithmetic_op(0x23, dst, src, size);
   }
 
-  void emit_and(Register dst, const Operand& src, int size) {
+  void emit_and(Register dst, Operand src, int size) {
     arithmetic_op(0x23, dst, src, size);
   }
 
-  void emit_and(const Operand& dst, Register src, int size) {
+  void emit_and(Operand dst, Register src, int size) {
     arithmetic_op(0x21, src, dst, size);
   }
 
@@ -2246,7 +2189,7 @@ class Assembler : public AssemblerBase {
     immediate_arithmetic_op(0x4, dst, src, size);
   }
 
-  void emit_and(const Operand& dst, Immediate src, int size) {
+  void emit_and(Operand dst, Immediate src, int size) {
     immediate_arithmetic_op(0x4, dst, src, size);
   }
 
@@ -2254,11 +2197,11 @@ class Assembler : public AssemblerBase {
     arithmetic_op(0x3B, dst, src, size);
   }
 
-  void emit_cmp(Register dst, const Operand& src, int size) {
+  void emit_cmp(Register dst, Operand src, int size) {
     arithmetic_op(0x3B, dst, src, size);
   }
 
-  void emit_cmp(const Operand& dst, Register src, int size) {
+  void emit_cmp(Operand dst, Register src, int size) {
     arithmetic_op(0x39, src, dst, size);
   }
 
@@ -2266,17 +2209,17 @@ class Assembler : public AssemblerBase {
     immediate_arithmetic_op(0x7, dst, src, size);
   }
 
-  void emit_cmp(const Operand& dst, Immediate src, int size) {
+  void emit_cmp(Operand dst, Immediate src, int size) {
     immediate_arithmetic_op(0x7, dst, src, size);
   }
 
   // Compare {al,ax,eax,rax} with src.  If equal, set ZF and write dst into
   // src. Otherwise clear ZF and write src into {al,ax,eax,rax}.  This
   // operation is only atomic if prefixed by the lock instruction.
-  void emit_cmpxchg(const Operand& dst, Register src, int size);
+  void emit_cmpxchg(Operand dst, Register src, int size);
 
   void emit_dec(Register dst, int size);
-  void emit_dec(const Operand& dst, int size);
+  void emit_dec(Operand dst, int size);
 
   // Divide rdx:rax by src.  Quotient in rax, remainder in rdx when size is 64.
   // Divide edx:eax by lower 32 bits of src.  Quotient in eax, remainder in edx
@@ -2287,43 +2230,43 @@ class Assembler : public AssemblerBase {
   // Signed multiply instructions.
   // rdx:rax = rax * src when size is 64 or edx:eax = eax * src when size is 32.
   void emit_imul(Register src, int size);
-  void emit_imul(const Operand& src, int size);
+  void emit_imul(Operand src, int size);
   void emit_imul(Register dst, Register src, int size);
-  void emit_imul(Register dst, const Operand& src, int size);
+  void emit_imul(Register dst, Operand src, int size);
   void emit_imul(Register dst, Register src, Immediate imm, int size);
-  void emit_imul(Register dst, const Operand& src, Immediate imm, int size);
+  void emit_imul(Register dst, Operand src, Immediate imm, int size);
 
   void emit_inc(Register dst, int size);
-  void emit_inc(const Operand& dst, int size);
+  void emit_inc(Operand dst, int size);
 
-  void emit_lea(Register dst, const Operand& src, int size);
+  void emit_lea(Register dst, Operand src, int size);
 
-  void emit_mov(Register dst, const Operand& src, int size);
+  void emit_mov(Register dst, Operand src, int size);
   void emit_mov(Register dst, Register src, int size);
-  void emit_mov(const Operand& dst, Register src, int size);
+  void emit_mov(Operand dst, Register src, int size);
   void emit_mov(Register dst, Immediate value, int size);
-  void emit_mov(const Operand& dst, Immediate value, int size);
+  void emit_mov(Operand dst, Immediate value, int size);
 
-  void emit_movzxb(Register dst, const Operand& src, int size);
+  void emit_movzxb(Register dst, Operand src, int size);
   void emit_movzxb(Register dst, Register src, int size);
-  void emit_movzxw(Register dst, const Operand& src, int size);
+  void emit_movzxw(Register dst, Operand src, int size);
   void emit_movzxw(Register dst, Register src, int size);
 
   void emit_neg(Register dst, int size);
-  void emit_neg(const Operand& dst, int size);
+  void emit_neg(Operand dst, int size);
 
   void emit_not(Register dst, int size);
-  void emit_not(const Operand& dst, int size);
+  void emit_not(Operand dst, int size);
 
   void emit_or(Register dst, Register src, int size) {
     arithmetic_op(0x0B, dst, src, size);
   }
 
-  void emit_or(Register dst, const Operand& src, int size) {
+  void emit_or(Register dst, Operand src, int size) {
     arithmetic_op(0x0B, dst, src, size);
   }
 
-  void emit_or(const Operand& dst, Register src, int size) {
+  void emit_or(Operand dst, Register src, int size) {
     arithmetic_op(0x9, src, dst, size);
   }
 
@@ -2331,7 +2274,7 @@ class Assembler : public AssemblerBase {
     immediate_arithmetic_op(0x1, dst, src, size);
   }
 
-  void emit_or(const Operand& dst, Immediate src, int size) {
+  void emit_or(Operand dst, Immediate src, int size) {
     immediate_arithmetic_op(0x1, dst, src, size);
   }
 
@@ -2349,28 +2292,28 @@ class Assembler : public AssemblerBase {
     immediate_arithmetic_op(0x5, dst, src, size);
   }
 
-  void emit_sub(Register dst, const Operand& src, int size) {
+  void emit_sub(Register dst, Operand src, int size) {
     arithmetic_op(0x2B, dst, src, size);
   }
 
-  void emit_sub(const Operand& dst, Register src, int size) {
+  void emit_sub(Operand dst, Register src, int size) {
     arithmetic_op(0x29, src, dst, size);
   }
 
-  void emit_sub(const Operand& dst, Immediate src, int size) {
+  void emit_sub(Operand dst, Immediate src, int size) {
     immediate_arithmetic_op(0x5, dst, src, size);
   }
 
   void emit_test(Register dst, Register src, int size);
   void emit_test(Register reg, Immediate mask, int size);
-  void emit_test(const Operand& op, Register reg, int size);
-  void emit_test(const Operand& op, Immediate mask, int size);
-  void emit_test(Register reg, const Operand& op, int size) {
+  void emit_test(Operand op, Register reg, int size);
+  void emit_test(Operand op, Immediate mask, int size);
+  void emit_test(Register reg, Operand op, int size) {
     return emit_test(op, reg, size);
   }
 
   void emit_xchg(Register dst, Register src, int size);
-  void emit_xchg(Register dst, const Operand& src, int size);
+  void emit_xchg(Register dst, Operand src, int size);
 
   void emit_xor(Register dst, Register src, int size) {
     if (size == kInt64Size && dst.code() == src.code()) {
@@ -2382,7 +2325,7 @@ class Assembler : public AssemblerBase {
     }
   }
 
-  void emit_xor(Register dst, const Operand& src, int size) {
+  void emit_xor(Register dst, Operand src, int size) {
     arithmetic_op(0x33, dst, src, size);
   }
 
@@ -2390,25 +2333,23 @@ class Assembler : public AssemblerBase {
     immediate_arithmetic_op(0x6, dst, src, size);
   }
 
-  void emit_xor(const Operand& dst, Immediate src, int size) {
+  void emit_xor(Operand dst, Immediate src, int size) {
     immediate_arithmetic_op(0x6, dst, src, size);
   }
 
-  void emit_xor(const Operand& dst, Register src, int size) {
+  void emit_xor(Operand dst, Register src, int size) {
     arithmetic_op(0x31, src, dst, size);
   }
 
   // Most BMI instructions are similar.
   void bmi1q(byte op, Register reg, Register vreg, Register rm);
-  void bmi1q(byte op, Register reg, Register vreg, const Operand& rm);
+  void bmi1q(byte op, Register reg, Register vreg, Operand rm);
   void bmi1l(byte op, Register reg, Register vreg, Register rm);
-  void bmi1l(byte op, Register reg, Register vreg, const Operand& rm);
+  void bmi1l(byte op, Register reg, Register vreg, Operand rm);
   void bmi2q(SIMDPrefix pp, byte op, Register reg, Register vreg, Register rm);
-  void bmi2q(SIMDPrefix pp, byte op, Register reg, Register vreg,
-             const Operand& rm);
+  void bmi2q(SIMDPrefix pp, byte op, Register reg, Register vreg, Operand rm);
   void bmi2l(SIMDPrefix pp, byte op, Register reg, Register vreg, Register rm);
-  void bmi2l(SIMDPrefix pp, byte op, Register reg, Register vreg,
-             const Operand& rm);
+  void bmi2l(SIMDPrefix pp, byte op, Register reg, Register vreg, Operand rm);
 
   // record the position of jmp/jcc instruction
   void record_farjmp_position(Label* L, int pos);
diff --git a/deps/v8/src/x64/code-stubs-x64.cc b/deps/v8/src/x64/code-stubs-x64.cc
index 27061c1e2b5..ca4f14457d5 100644
--- a/deps/v8/src/x64/code-stubs-x64.cc
+++ b/deps/v8/src/x64/code-stubs-x64.cc
@@ -135,7 +135,6 @@ void MathPowStub::Generate(MacroAssembler* masm) {
     Label fast_power, try_arithmetic_simplification;
     // Detect integer exponents stored as double.
     __ DoubleToI(exponent, double_exponent, double_scratch,
-                 TREAT_MINUS_ZERO_AS_ZERO, &try_arithmetic_simplification,
                  &try_arithmetic_simplification,
                  &try_arithmetic_simplification);
     __ jmp(&int_exponent);
@@ -406,16 +405,20 @@ void CEntryStub::Generate(MacroAssembler* masm) {
                                  isolate());
   {
     FrameScope scope(masm, StackFrame::MANUAL);
-    __ movp(arg_reg_1, Immediate(0));  // argc.
-    __ movp(arg_reg_2, Immediate(0));  // argv.
+    __ xorp(arg_reg_1, arg_reg_1);  // argc.
+    __ xorp(arg_reg_2, arg_reg_2);  // argv.
     __ Move(arg_reg_3, ExternalReference::isolate_address(isolate()));
     __ PrepareCallCFunction(3);
     __ CallCFunction(find_handler, 3);
   }
   // Retrieve the handler context, SP and FP.
   __ movp(rsi, masm->ExternalOperand(pending_handler_context_address));
-  __ movp(rsp, masm->ExternalOperand(pending_handler_sp_address));
-  __ movp(rbp, masm->ExternalOperand(pending_handler_fp_address));
+  __ movp(rsp,
+          masm->ExternalOperandReuseScratchRegister(
+              pending_handler_sp_address, pending_handler_context_address));
+  __ movp(rbp,
+          masm->ExternalOperandReuseScratchRegister(
+              pending_handler_fp_address, pending_handler_context_address));
 
   // If the handler is a JS frame, restore the context to the frame. Note that
   // the context will be set to (rsi == 0) for non-JS frames.
@@ -425,8 +428,16 @@ void CEntryStub::Generate(MacroAssembler* masm) {
   __ movp(Operand(rbp, StandardFrameConstants::kContextOffset), rsi);
   __ bind(&skip);
 
+  // Reset the masking register. This is done independent of the underlying
+  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
+  // both configurations. It is safe to always do this, because the underlying
+  // register is caller-saved and can be arbitrarily clobbered.
+  __ ResetSpeculationPoisonRegister();
+
   // Compute the handler entry address and jump to it.
-  __ movp(rdi, masm->ExternalOperand(pending_handler_entrypoint_address));
+  __ movp(rdi, masm->ExternalOperandReuseScratchRegister(
+                   pending_handler_entrypoint_address,
+                   pending_handler_context_address));
   __ jmp(rdi);
 }
 
@@ -609,7 +620,7 @@ void ProfileEntryHookStub::Generate(MacroAssembler* masm) {
 
   // Call the entry hook function.
   __ Move(rax, FUNCTION_ADDR(isolate()->function_entry_hook()),
-          Assembler::RelocInfoNone());
+          RelocInfo::NONE);
 
   AllowExternalCallThatCantCauseGC scope(masm);
 
diff --git a/deps/v8/src/x64/codegen-x64.cc b/deps/v8/src/x64/codegen-x64.cc
index 25a74b98fcb..056d3d01f6b 100644
--- a/deps/v8/src/x64/codegen-x64.cc
+++ b/deps/v8/src/x64/codegen-x64.cc
@@ -5,6 +5,7 @@
 #if V8_TARGET_ARCH_X64
 
 #include "src/codegen.h"
+#include "src/isolate.h"
 #include "src/macro-assembler.h"
 #include "src/x64/assembler-x64-inl.h"
 
@@ -28,9 +29,9 @@ UnaryMathFunctionWithIsolate CreateSqrtFunction(Isolate* isolate) {
 
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
-  DCHECK(!RelocInfo::RequiresRelocation(isolate, desc));
+  DCHECK(!RelocInfo::RequiresRelocation(desc));
 
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   CHECK(SetPermissions(buffer, allocated, PageAllocator::kReadExecute));
   return FUNCTION_CAST<UnaryMathFunctionWithIsolate>(buffer);
 }
diff --git a/deps/v8/src/x64/disasm-x64.cc b/deps/v8/src/x64/disasm-x64.cc
index 247f5e889e4..104f46889e3 100644
--- a/deps/v8/src/x64/disasm-x64.cc
+++ b/deps/v8/src/x64/disasm-x64.cc
@@ -10,6 +10,7 @@
 
 #include "src/base/compiler-specific.h"
 #include "src/base/lazy-instance.h"
+#include "src/base/v8-fallthrough.h"
 #include "src/disasm.h"
 #include "src/x64/sse-instr.h"
 
@@ -1039,6 +1040,11 @@ int DisassemblerX64::AVXInstruction(byte* data) {
                        NameOfCPURegister(regop));
         current += PrintRightXMMOperand(current);
         break;
+      case 0x51:
+        AppendToBuffer("vsqrtss %s,%s,", NameOfXMMRegister(regop),
+                       NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        break;
       case 0x58:
         AppendToBuffer("vaddss %s,%s,", NameOfXMMRegister(regop),
                        NameOfXMMRegister(vvvv));
@@ -1155,6 +1161,11 @@ int DisassemblerX64::AVXInstruction(byte* data) {
         AppendToBuffer("vlddqu %s,", NameOfXMMRegister(regop));
         current += PrintRightXMMOperand(current);
         break;
+      case 0x7C:
+        AppendToBuffer("vhaddps %s,%s,", NameOfXMMRegister(regop),
+                       NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        break;
       default:
         UnimplementedInstruction();
     }
@@ -1840,6 +1851,8 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
         } else if (opcode == 0xD9) {
           mnemonic = "psubusw";
         } else if (opcode == 0xDA) {
+          mnemonic = "pand";
+        } else if (opcode == 0xDB) {
           mnemonic = "pminub";
         } else if (opcode == 0xDC) {
           mnemonic = "paddusb";
@@ -1857,6 +1870,8 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
           mnemonic = "psubsw";
         } else if (opcode == 0xEA) {
           mnemonic = "pminsw";
+        } else if (opcode == 0xEB) {
+          mnemonic = "por";
         } else if (opcode == 0xEC) {
           mnemonic = "paddsb";
         } else if (opcode == 0xED) {
@@ -1975,7 +1990,7 @@ int DisassemblerX64::TwoByteOpcodeInstruction(byte* data) {
       int mod, regop, rm;
       get_modrm(*current, &mod, &regop, &rm);
       AppendToBuffer("haddps %s,", NameOfXMMRegister(regop));
-      current += PrintRightOperand(current);
+      current += PrintRightXMMOperand(current);
     } else {
       UnimplementedInstruction();
     }
@@ -2703,7 +2718,8 @@ int DisassemblerX64::InstructionDecode(v8::internal::Vector<char> out_buffer,
         break;
 
       case 0xF6:
-        byte_size_operand_ = true;  // fall through
+        byte_size_operand_ = true;
+        V8_FALLTHROUGH;
       case 0xF7:
         data += F6F7Instruction(data);
         break;
@@ -2814,6 +2830,11 @@ int Disassembler::InstructionDecode(v8::internal::Vector<char> buffer,
   return d.InstructionDecode(buffer, instruction);
 }
 
+int Disassembler::InstructionDecodeForTesting(v8::internal::Vector<char> buffer,
+                                              byte* instruction) {
+  DisassemblerX64 d(converter_, ABORT_ON_UNIMPLEMENTED_OPCODE);
+  return d.InstructionDecode(buffer, instruction);
+}
 
 // The X64 assembler does not use constant pools.
 int Disassembler::ConstantPoolSizeAt(byte* instruction) {
diff --git a/deps/v8/src/x64/frame-constants-x64.h b/deps/v8/src/x64/frame-constants-x64.h
index 95bad4c01a2..07d2d1a8b18 100644
--- a/deps/v8/src/x64/frame-constants-x64.h
+++ b/deps/v8/src/x64/frame-constants-x64.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_X64_FRAMES_X64_H_
-#define V8_X64_FRAMES_X64_H_
+#ifndef V8_X64_FRAME_CONSTANTS_X64_H_
+#define V8_X64_FRAME_CONSTANTS_X64_H_
 
 namespace v8 {
 namespace internal {
@@ -55,4 +55,4 @@ class JavaScriptFrameConstants : public AllStatic {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_X64_FRAMES_X64_H_
+#endif  // V8_X64_FRAME_CONSTANTS_X64_H_
diff --git a/deps/v8/src/x64/interface-descriptors-x64.cc b/deps/v8/src/x64/interface-descriptors-x64.cc
index 22bad696d2c..be32df3164b 100644
--- a/deps/v8/src/x64/interface-descriptors-x64.cc
+++ b/deps/v8/src/x64/interface-descriptors-x64.cc
@@ -69,13 +69,6 @@ const Register GrowArrayElementsDescriptor::ObjectRegister() { return rax; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return rbx; }
 
 
-void FastNewClosureDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // SharedFunctionInfo, vector, slot index.
-  Register registers[] = {rbx, rcx, rdx};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
 void TypeofDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {rbx};
diff --git a/deps/v8/src/x64/macro-assembler-x64.cc b/deps/v8/src/x64/macro-assembler-x64.cc
index 5019be3727e..b134d668429 100644
--- a/deps/v8/src/x64/macro-assembler-x64.cc
+++ b/deps/v8/src/x64/macro-assembler-x64.cc
@@ -15,6 +15,7 @@
 #include "src/external-reference-table.h"
 #include "src/frames-inl.h"
 #include "src/heap/heap-inl.h"
+#include "src/instruction-stream.h"
 #include "src/objects-inl.h"
 #include "src/register-configuration.h"
 #include "src/x64/assembler-x64.h"
@@ -99,20 +100,6 @@ int64_t TurboAssembler::RootRegisterDelta(ExternalReference other) {
   return delta;
 }
 
-
-Operand MacroAssembler::ExternalOperand(ExternalReference target,
-                                        Register scratch) {
-  if (root_array_available_ && !serializer_enabled()) {
-    int64_t delta = RootRegisterDelta(target);
-    if (delta != kInvalidRootRegisterDelta && is_int32(delta)) {
-      return Operand(kRootRegister, static_cast<int32_t>(delta));
-    }
-  }
-  Move(scratch, target);
-  return Operand(scratch, 0);
-}
-
-
 void MacroAssembler::Load(Register destination, ExternalReference source) {
   if (root_array_available_ && !serializer_enabled()) {
     int64_t delta = RootRegisterDelta(source);
@@ -161,6 +148,31 @@ void TurboAssembler::LoadAddress(Register destination,
   Move(destination, source);
 }
 
+Operand TurboAssembler::ExternalOperand(ExternalReference target,
+                                        Register scratch) {
+  if (root_array_available_ && !serializer_enabled()) {
+    int64_t delta = RootRegisterDelta(target);
+    if (delta != kInvalidRootRegisterDelta && is_int32(delta)) {
+      return Operand(kRootRegister, static_cast<int32_t>(delta));
+    }
+  }
+  Move(scratch, target);
+  return Operand(scratch, 0);
+}
+
+Operand TurboAssembler::ExternalOperandReuseScratchRegister(
+    ExternalReference target, ExternalReference previous, Register scratch) {
+  if (root_array_available_ && !serializer_enabled()) {
+    int64_t delta = RootRegisterDelta(target);
+    if (delta != kInvalidRootRegisterDelta && is_int32(delta)) {
+      return Operand(kRootRegister, static_cast<int32_t>(delta));
+    }
+  }
+  int64_t delta = target.address() - previous.address();
+  DCHECK(is_int32(delta));
+  return Operand(scratch, static_cast<int32_t>(delta));
+}
+
 int TurboAssembler::LoadAddressSize(ExternalReference source) {
   if (root_array_available_ && !serializer_enabled()) {
     // This calculation depends on the internals of LoadAddress.
@@ -187,7 +199,7 @@ void MacroAssembler::PushAddress(ExternalReference source) {
   if (is_int32(address) && !serializer_enabled()) {
     if (emit_debug_code()) {
       Move(kScratchRegister, reinterpret_cast<Address>(kZapValue),
-           Assembler::RelocInfoNone());
+           RelocInfo::NONE);
     }
     Push(Immediate(static_cast<int32_t>(address)));
     return;
@@ -213,8 +225,7 @@ void TurboAssembler::CompareRoot(Register with, Heap::RootListIndex index) {
                      (index << kPointerSizeLog2) - kRootRegisterBias));
 }
 
-void TurboAssembler::CompareRoot(const Operand& with,
-                                 Heap::RootListIndex index) {
+void TurboAssembler::CompareRoot(Operand with, Heap::RootListIndex index) {
   DCHECK(root_array_available_);
   DCHECK(!with.AddressUsesRegister(kScratchRegister));
   LoadRoot(kScratchRegister, index);
@@ -256,9 +267,8 @@ void MacroAssembler::RecordWriteField(Register object, int offset,
   // Clobber clobbered input registers when running with the debug-code flag
   // turned on to provoke errors.
   if (emit_debug_code()) {
-    Move(value, reinterpret_cast<Address>(kZapValue),
-         Assembler::RelocInfoNone());
-    Move(dst, reinterpret_cast<Address>(kZapValue), Assembler::RelocInfoNone());
+    Move(value, reinterpret_cast<Address>(kZapValue), RelocInfo::NONE);
+    Move(dst, reinterpret_cast<Address>(kZapValue), RelocInfo::NONE);
   }
 }
 
@@ -388,10 +398,8 @@ void MacroAssembler::RecordWrite(Register object, Register address,
   // Clobber clobbered registers when running with the debug-code flag
   // turned on to provoke errors.
   if (emit_debug_code()) {
-    Move(address, reinterpret_cast<Address>(kZapValue),
-         Assembler::RelocInfoNone());
-    Move(value, reinterpret_cast<Address>(kZapValue),
-         Assembler::RelocInfoNone());
+    Move(address, reinterpret_cast<Address>(kZapValue), RelocInfo::NONE);
+    Move(value, reinterpret_cast<Address>(kZapValue), RelocInfo::NONE);
   }
 }
 
@@ -616,7 +624,7 @@ void TurboAssembler::Cvtss2sd(XMMRegister dst, XMMRegister src) {
   }
 }
 
-void TurboAssembler::Cvtss2sd(XMMRegister dst, const Operand& src) {
+void TurboAssembler::Cvtss2sd(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vcvtss2sd(dst, dst, src);
@@ -634,7 +642,7 @@ void TurboAssembler::Cvtsd2ss(XMMRegister dst, XMMRegister src) {
   }
 }
 
-void TurboAssembler::Cvtsd2ss(XMMRegister dst, const Operand& src) {
+void TurboAssembler::Cvtsd2ss(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vcvtsd2ss(dst, dst, src);
@@ -654,7 +662,7 @@ void TurboAssembler::Cvtlsi2sd(XMMRegister dst, Register src) {
   }
 }
 
-void TurboAssembler::Cvtlsi2sd(XMMRegister dst, const Operand& src) {
+void TurboAssembler::Cvtlsi2sd(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vxorpd(dst, dst, dst);
@@ -676,7 +684,7 @@ void TurboAssembler::Cvtlsi2ss(XMMRegister dst, Register src) {
   }
 }
 
-void TurboAssembler::Cvtlsi2ss(XMMRegister dst, const Operand& src) {
+void TurboAssembler::Cvtlsi2ss(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vxorps(dst, dst, dst);
@@ -698,7 +706,7 @@ void TurboAssembler::Cvtqsi2ss(XMMRegister dst, Register src) {
   }
 }
 
-void TurboAssembler::Cvtqsi2ss(XMMRegister dst, const Operand& src) {
+void TurboAssembler::Cvtqsi2ss(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vxorps(dst, dst, dst);
@@ -720,7 +728,7 @@ void TurboAssembler::Cvtqsi2sd(XMMRegister dst, Register src) {
   }
 }
 
-void TurboAssembler::Cvtqsi2sd(XMMRegister dst, const Operand& src) {
+void TurboAssembler::Cvtqsi2sd(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vxorpd(dst, dst, dst);
@@ -775,7 +783,7 @@ void TurboAssembler::Cvttss2si(Register dst, XMMRegister src) {
   }
 }
 
-void TurboAssembler::Cvttss2si(Register dst, const Operand& src) {
+void TurboAssembler::Cvttss2si(Register dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vcvttss2si(dst, src);
@@ -793,7 +801,7 @@ void TurboAssembler::Cvttsd2si(Register dst, XMMRegister src) {
   }
 }
 
-void TurboAssembler::Cvttsd2si(Register dst, const Operand& src) {
+void TurboAssembler::Cvttsd2si(Register dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vcvttsd2si(dst, src);
@@ -811,7 +819,7 @@ void TurboAssembler::Cvttss2siq(Register dst, XMMRegister src) {
   }
 }
 
-void TurboAssembler::Cvttss2siq(Register dst, const Operand& src) {
+void TurboAssembler::Cvttss2siq(Register dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vcvttss2siq(dst, src);
@@ -829,7 +837,7 @@ void TurboAssembler::Cvttsd2siq(Register dst, XMMRegister src) {
   }
 }
 
-void TurboAssembler::Cvttsd2siq(Register dst, const Operand& src) {
+void TurboAssembler::Cvttsd2siq(Register dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
     vcvttsd2siq(dst, src);
@@ -838,8 +846,7 @@ void TurboAssembler::Cvttsd2siq(Register dst, const Operand& src) {
   }
 }
 
-
-void MacroAssembler::Load(Register dst, const Operand& src, Representation r) {
+void MacroAssembler::Load(Register dst, Operand src, Representation r) {
   DCHECK(!r.IsDouble());
   if (r.IsInteger8()) {
     movsxbq(dst, src);
@@ -856,8 +863,7 @@ void MacroAssembler::Load(Register dst, const Operand& src, Representation r) {
   }
 }
 
-
-void MacroAssembler::Store(const Operand& dst, Register src, Representation r) {
+void MacroAssembler::Store(Operand dst, Register src, Representation r) {
   DCHECK(!r.IsDouble());
   if (r.IsInteger8() || r.IsUInteger8()) {
     movb(dst, src);
@@ -887,7 +893,7 @@ void TurboAssembler::Set(Register dst, int64_t x) {
   }
 }
 
-void TurboAssembler::Set(const Operand& dst, intptr_t x) {
+void TurboAssembler::Set(Operand dst, intptr_t x) {
   if (kPointerSize == kInt64Size) {
     if (is_int32(x)) {
       movp(dst, Immediate(static_cast<int32_t>(x)));
@@ -921,7 +927,7 @@ void TurboAssembler::Move(Register dst, Smi* source) {
   if (value == 0) {
     xorl(dst, dst);
   } else {
-    Move(dst, source, Assembler::RelocInfoNone());
+    Move(dst, source, RelocInfo::NONE);
   }
 }
 
@@ -947,7 +953,7 @@ void TurboAssembler::SmiToInteger32(Register dst, Register src) {
   }
 }
 
-void TurboAssembler::SmiToInteger32(Register dst, const Operand& src) {
+void TurboAssembler::SmiToInteger32(Register dst, Operand src) {
   if (SmiValuesAre32Bits()) {
     movl(dst, Operand(src, kSmiShift / kBitsPerByte));
   } else {
@@ -993,22 +999,19 @@ void MacroAssembler::Cmp(Register dst, Smi* src) {
   }
 }
 
-
-void MacroAssembler::SmiCompare(Register dst, const Operand& src) {
+void MacroAssembler::SmiCompare(Register dst, Operand src) {
   AssertSmi(dst);
   AssertSmi(src);
   cmpp(dst, src);
 }
 
-
-void MacroAssembler::SmiCompare(const Operand& dst, Register src) {
+void MacroAssembler::SmiCompare(Operand dst, Register src) {
   AssertSmi(dst);
   AssertSmi(src);
   cmpp(dst, src);
 }
 
-
-void MacroAssembler::SmiCompare(const Operand& dst, Smi* src) {
+void MacroAssembler::SmiCompare(Operand dst, Smi* src) {
   AssertSmi(dst);
   if (SmiValuesAre32Bits()) {
     cmpl(Operand(dst, kSmiShift / kBitsPerByte), Immediate(src->value()));
@@ -1018,8 +1021,7 @@ void MacroAssembler::SmiCompare(const Operand& dst, Smi* src) {
   }
 }
 
-
-void MacroAssembler::Cmp(const Operand& dst, Smi* src) {
+void MacroAssembler::Cmp(Operand dst, Smi* src) {
   // The Operand cannot use the smi register.
   Register smi_reg = GetSmiConstant(src);
   DCHECK(!dst.AddressUsesRegister(smi_reg));
@@ -1033,7 +1035,7 @@ Condition TurboAssembler::CheckSmi(Register src) {
   return zero;
 }
 
-Condition TurboAssembler::CheckSmi(const Operand& src) {
+Condition TurboAssembler::CheckSmi(Operand src) {
   STATIC_ASSERT(kSmiTag == 0);
   testb(src, Immediate(kSmiTagMask));
   return zero;
@@ -1059,7 +1061,7 @@ void MacroAssembler::JumpIfNotSmi(Operand src, Label* on_not_smi,
   j(NegateCondition(smi), on_not_smi, near_jump);
 }
 
-void MacroAssembler::SmiAddConstant(const Operand& dst, Smi* constant) {
+void MacroAssembler::SmiAddConstant(Operand dst, Smi* constant) {
   if (constant->value() != 0) {
     if (SmiValuesAre32Bits()) {
       addl(Operand(dst, kSmiShift / kBitsPerByte),
@@ -1142,15 +1144,19 @@ void TurboAssembler::MoveNumber(Register dst, double value) {
 
 void TurboAssembler::Move(XMMRegister dst, uint32_t src) {
   if (src == 0) {
-    Xorpd(dst, dst);
+    Xorps(dst, dst);
   } else {
+    unsigned nlz = base::bits::CountLeadingZeros(src);
+    unsigned ntz = base::bits::CountTrailingZeros(src);
     unsigned pop = base::bits::CountPopulation(src);
     DCHECK_NE(0u, pop);
-    if (pop == 32) {
+    if (pop + ntz + nlz == 32) {
       Pcmpeqd(dst, dst);
+      if (ntz) Pslld(dst, static_cast<byte>(ntz + nlz));
+      if (nlz) Psrld(dst, static_cast<byte>(nlz));
     } else {
       movl(kScratchRegister, Immediate(src));
-      Movq(dst, kScratchRegister);
+      Movd(dst, kScratchRegister);
     }
   }
 }
@@ -1163,14 +1169,10 @@ void TurboAssembler::Move(XMMRegister dst, uint64_t src) {
     unsigned ntz = base::bits::CountTrailingZeros(src);
     unsigned pop = base::bits::CountPopulation(src);
     DCHECK_NE(0u, pop);
-    if (pop == 64) {
-      Pcmpeqd(dst, dst);
-    } else if (pop + ntz == 64) {
-      Pcmpeqd(dst, dst);
-      Psllq(dst, ntz);
-    } else if (pop + nlz == 64) {
+    if (pop + ntz + nlz == 64) {
       Pcmpeqd(dst, dst);
-      Psrlq(dst, nlz);
+      if (ntz) Psllq(dst, static_cast<byte>(ntz + nlz));
+      if (nlz) Psrlq(dst, static_cast<byte>(nlz));
     } else {
       uint32_t lower = static_cast<uint32_t>(src);
       uint32_t upper = static_cast<uint32_t>(src >> 32);
@@ -1184,280 +1186,26 @@ void TurboAssembler::Move(XMMRegister dst, uint64_t src) {
   }
 }
 
-void TurboAssembler::Movaps(XMMRegister dst, XMMRegister src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovaps(dst, src);
-  } else {
-    movaps(dst, src);
-  }
-}
-
-void TurboAssembler::Movups(XMMRegister dst, XMMRegister src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovups(dst, src);
-  } else {
-    movups(dst, src);
-  }
-}
-
-void TurboAssembler::Movups(XMMRegister dst, const Operand& src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovups(dst, src);
-  } else {
-    movups(dst, src);
-  }
-}
-
-void TurboAssembler::Movups(const Operand& dst, XMMRegister src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovups(dst, src);
-  } else {
-    movups(dst, src);
-  }
-}
-
-void TurboAssembler::Movapd(XMMRegister dst, XMMRegister src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovapd(dst, src);
-  } else {
-    movapd(dst, src);
-  }
-}
-
-void TurboAssembler::Movsd(XMMRegister dst, XMMRegister src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovsd(dst, dst, src);
-  } else {
-    movsd(dst, src);
-  }
-}
-
-void TurboAssembler::Movsd(XMMRegister dst, const Operand& src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovsd(dst, src);
-  } else {
-    movsd(dst, src);
-  }
-}
-
-void TurboAssembler::Movsd(const Operand& dst, XMMRegister src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovsd(dst, src);
-  } else {
-    movsd(dst, src);
-  }
-}
-
-void TurboAssembler::Movss(XMMRegister dst, XMMRegister src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovss(dst, dst, src);
-  } else {
-    movss(dst, src);
-  }
-}
-
-void TurboAssembler::Movss(XMMRegister dst, const Operand& src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovss(dst, src);
-  } else {
-    movss(dst, src);
-  }
-}
-
-void TurboAssembler::Movss(const Operand& dst, XMMRegister src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovss(dst, src);
-  } else {
-    movss(dst, src);
-  }
-}
-
-void TurboAssembler::Movd(XMMRegister dst, Register src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovd(dst, src);
-  } else {
-    movd(dst, src);
-  }
-}
-
-void TurboAssembler::Movd(XMMRegister dst, const Operand& src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovd(dst, src);
-  } else {
-    movd(dst, src);
-  }
-}
-
-void TurboAssembler::Movd(Register dst, XMMRegister src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovd(dst, src);
-  } else {
-    movd(dst, src);
-  }
-}
-
-void TurboAssembler::Movq(XMMRegister dst, Register src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovq(dst, src);
-  } else {
-    movq(dst, src);
-  }
-}
-
-void TurboAssembler::Movq(Register dst, XMMRegister src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovq(dst, src);
-  } else {
-    movq(dst, src);
-  }
-}
-
-void TurboAssembler::Movmskps(Register dst, XMMRegister src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovmskps(dst, src);
-  } else {
-    movmskps(dst, src);
-  }
-}
-
-void TurboAssembler::Movmskpd(Register dst, XMMRegister src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vmovmskpd(dst, src);
-  } else {
-    movmskpd(dst, src);
-  }
-}
-
-void TurboAssembler::Xorps(XMMRegister dst, XMMRegister src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vxorps(dst, dst, src);
-  } else {
-    xorps(dst, src);
-  }
-}
-
-void TurboAssembler::Xorps(XMMRegister dst, const Operand& src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vxorps(dst, dst, src);
-  } else {
-    xorps(dst, src);
-  }
-}
-
-void TurboAssembler::Roundss(XMMRegister dst, XMMRegister src,
-                             RoundingMode mode) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vroundss(dst, dst, src, mode);
-  } else {
-    roundss(dst, src, mode);
-  }
-}
-
-void TurboAssembler::Roundsd(XMMRegister dst, XMMRegister src,
-                             RoundingMode mode) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vroundsd(dst, dst, src, mode);
-  } else {
-    roundsd(dst, src, mode);
-  }
-}
-
-void TurboAssembler::Sqrtsd(XMMRegister dst, XMMRegister src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vsqrtsd(dst, dst, src);
-  } else {
-    sqrtsd(dst, src);
-  }
-}
-
-void TurboAssembler::Sqrtsd(XMMRegister dst, const Operand& src) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vsqrtsd(dst, dst, src);
-  } else {
-    sqrtsd(dst, src);
-  }
-}
-
-void TurboAssembler::Ucomiss(XMMRegister src1, XMMRegister src2) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vucomiss(src1, src2);
-  } else {
-    ucomiss(src1, src2);
-  }
-}
-
-void TurboAssembler::Ucomiss(XMMRegister src1, const Operand& src2) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vucomiss(src1, src2);
-  } else {
-    ucomiss(src1, src2);
-  }
-}
-
-void TurboAssembler::Ucomisd(XMMRegister src1, XMMRegister src2) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vucomisd(src1, src2);
-  } else {
-    ucomisd(src1, src2);
-  }
-}
-
-void TurboAssembler::Ucomisd(XMMRegister src1, const Operand& src2) {
-  if (CpuFeatures::IsSupported(AVX)) {
-    CpuFeatureScope scope(this, AVX);
-    vucomisd(src1, src2);
-  } else {
-    ucomisd(src1, src2);
-  }
-}
-
 // ----------------------------------------------------------------------------
 
 void MacroAssembler::Absps(XMMRegister dst) {
-  Andps(dst,
-        ExternalOperand(ExternalReference::address_of_float_abs_constant()));
+  Andps(dst, ExternalOperand(
+                 ExternalReference::address_of_float_abs_constant(isolate())));
 }
 
 void MacroAssembler::Negps(XMMRegister dst) {
-  Xorps(dst,
-        ExternalOperand(ExternalReference::address_of_float_neg_constant()));
+  Xorps(dst, ExternalOperand(
+                 ExternalReference::address_of_float_neg_constant(isolate())));
 }
 
 void MacroAssembler::Abspd(XMMRegister dst) {
-  Andps(dst,
-        ExternalOperand(ExternalReference::address_of_double_abs_constant()));
+  Andps(dst, ExternalOperand(
+                 ExternalReference::address_of_double_abs_constant(isolate())));
 }
 
 void MacroAssembler::Negpd(XMMRegister dst) {
-  Xorps(dst,
-        ExternalOperand(ExternalReference::address_of_double_neg_constant()));
+  Xorps(dst, ExternalOperand(
+                 ExternalReference::address_of_double_neg_constant(isolate())));
 }
 
 void MacroAssembler::Cmp(Register dst, Handle<Object> source) {
@@ -1470,8 +1218,7 @@ void MacroAssembler::Cmp(Register dst, Handle<Object> source) {
   }
 }
 
-
-void MacroAssembler::Cmp(const Operand& dst, Handle<Object> source) {
+void MacroAssembler::Cmp(Operand dst, Handle<Object> source) {
   AllowDeferredHandleDereference smi_check;
   if (source->IsSmi()) {
     Cmp(dst, Smi::cast(*source));
@@ -1491,7 +1238,7 @@ void TurboAssembler::Move(Register result, Handle<HeapObject> object,
   movp(result, reinterpret_cast<void*>(object.address()), rmode);
 }
 
-void TurboAssembler::Move(const Operand& dst, Handle<HeapObject> object,
+void TurboAssembler::Move(Operand dst, Handle<HeapObject> object,
                           RelocInfo::Mode rmode) {
   Move(kScratchRegister, object, rmode);
   movp(dst, kScratchRegister);
@@ -1528,7 +1275,7 @@ void TurboAssembler::Push(Register src) {
   }
 }
 
-void TurboAssembler::Push(const Operand& src) {
+void TurboAssembler::Push(Operand src) {
   if (kPointerSize == kInt64Size) {
     pushq(src);
   } else {
@@ -1538,8 +1285,7 @@ void TurboAssembler::Push(const Operand& src) {
   }
 }
 
-
-void MacroAssembler::PushQuad(const Operand& src) {
+void MacroAssembler::PushQuad(Operand src) {
   if (kPointerSize == kInt64Size) {
     pushq(src);
   } else {
@@ -1579,8 +1325,7 @@ void MacroAssembler::Pop(Register dst) {
   }
 }
 
-
-void MacroAssembler::Pop(const Operand& dst) {
+void MacroAssembler::Pop(Operand dst) {
   if (kPointerSize == kInt64Size) {
     popq(dst);
   } else {
@@ -1596,8 +1341,7 @@ void MacroAssembler::Pop(const Operand& dst) {
   }
 }
 
-
-void MacroAssembler::PopQuad(const Operand& dst) {
+void MacroAssembler::PopQuad(Operand dst) {
   if (kPointerSize == kInt64Size) {
     popq(dst);
   } else {
@@ -1612,8 +1356,7 @@ void MacroAssembler::Jump(ExternalReference ext) {
   jmp(kScratchRegister);
 }
 
-
-void MacroAssembler::Jump(const Operand& op) {
+void MacroAssembler::Jump(Operand op) {
   if (kPointerSize == kInt64Size) {
     jmp(op);
   } else {
@@ -1634,6 +1377,11 @@ void MacroAssembler::Jump(Handle<Code> code_object, RelocInfo::Mode rmode) {
   jmp(code_object, rmode);
 }
 
+void MacroAssembler::JumpToInstructionStream(Address entry) {
+  Move(kOffHeapTrampolineRegister, entry, RelocInfo::OFF_HEAP_TARGET);
+  jmp(kOffHeapTrampolineRegister);
+}
+
 int TurboAssembler::CallSize(ExternalReference ext) {
   // Opcode for call kScratchRegister is: Rex.B FF D4 (three bytes).
   return LoadAddressSize(ext) +
@@ -1649,7 +1397,7 @@ void TurboAssembler::Call(ExternalReference ext) {
   DCHECK_EQ(end_position, pc_offset());
 }
 
-void TurboAssembler::Call(const Operand& op) {
+void TurboAssembler::Call(Operand op) {
   if (kPointerSize == kInt64Size && !CpuFeatures::IsSupported(ATOM)) {
     call(op);
   } else {
@@ -1751,7 +1499,7 @@ void TurboAssembler::Pinsrd(XMMRegister dst, Register src, int8_t imm8) {
   }
 }
 
-void TurboAssembler::Pinsrd(XMMRegister dst, const Operand& src, int8_t imm8) {
+void TurboAssembler::Pinsrd(XMMRegister dst, Operand src, int8_t imm8) {
   DCHECK(imm8 == 0 || imm8 == 1);
   if (CpuFeatures::IsSupported(SSE4_1)) {
     CpuFeatureScope sse_scope(this, SSE4_1);
@@ -1781,7 +1529,7 @@ void TurboAssembler::Lzcntl(Register dst, Register src) {
   xorl(dst, Immediate(31));  // for x in [0..31], 31^x == 31 - x
 }
 
-void TurboAssembler::Lzcntl(Register dst, const Operand& src) {
+void TurboAssembler::Lzcntl(Register dst, Operand src) {
   if (CpuFeatures::IsSupported(LZCNT)) {
     CpuFeatureScope scope(this, LZCNT);
     lzcntl(dst, src);
@@ -1809,7 +1557,7 @@ void TurboAssembler::Lzcntq(Register dst, Register src) {
   xorl(dst, Immediate(63));  // for x in [0..63], 63^x == 63 - x
 }
 
-void TurboAssembler::Lzcntq(Register dst, const Operand& src) {
+void TurboAssembler::Lzcntq(Register dst, Operand src) {
   if (CpuFeatures::IsSupported(LZCNT)) {
     CpuFeatureScope scope(this, LZCNT);
     lzcntq(dst, src);
@@ -1837,7 +1585,7 @@ void TurboAssembler::Tzcntq(Register dst, Register src) {
   bind(&not_zero_src);
 }
 
-void TurboAssembler::Tzcntq(Register dst, const Operand& src) {
+void TurboAssembler::Tzcntq(Register dst, Operand src) {
   if (CpuFeatures::IsSupported(BMI1)) {
     CpuFeatureScope scope(this, BMI1);
     tzcntq(dst, src);
@@ -1864,7 +1612,7 @@ void TurboAssembler::Tzcntl(Register dst, Register src) {
   bind(&not_zero_src);
 }
 
-void TurboAssembler::Tzcntl(Register dst, const Operand& src) {
+void TurboAssembler::Tzcntl(Register dst, Operand src) {
   if (CpuFeatures::IsSupported(BMI1)) {
     CpuFeatureScope scope(this, BMI1);
     tzcntl(dst, src);
@@ -1886,7 +1634,7 @@ void TurboAssembler::Popcntl(Register dst, Register src) {
   UNREACHABLE();
 }
 
-void TurboAssembler::Popcntl(Register dst, const Operand& src) {
+void TurboAssembler::Popcntl(Register dst, Operand src) {
   if (CpuFeatures::IsSupported(POPCNT)) {
     CpuFeatureScope scope(this, POPCNT);
     popcntl(dst, src);
@@ -1904,7 +1652,7 @@ void TurboAssembler::Popcntq(Register dst, Register src) {
   UNREACHABLE();
 }
 
-void TurboAssembler::Popcntq(Register dst, const Operand& src) {
+void TurboAssembler::Popcntq(Register dst, Operand src) {
   if (CpuFeatures::IsSupported(POPCNT)) {
     CpuFeatureScope scope(this, POPCNT);
     popcntq(dst, src);
@@ -2035,29 +1783,13 @@ void TurboAssembler::SlowTruncateToIDelayed(Zone* zone, Register result_reg) {
 }
 
 void MacroAssembler::DoubleToI(Register result_reg, XMMRegister input_reg,
-                               XMMRegister scratch,
-                               MinusZeroMode minus_zero_mode,
-                               Label* lost_precision, Label* is_nan,
-                               Label* minus_zero, Label::Distance dst) {
+                               XMMRegister scratch, Label* lost_precision,
+                               Label* is_nan, Label::Distance dst) {
   Cvttsd2si(result_reg, input_reg);
   Cvtlsi2sd(kScratchDoubleReg, result_reg);
   Ucomisd(kScratchDoubleReg, input_reg);
   j(not_equal, lost_precision, dst);
   j(parity_even, is_nan, dst);  // NaN.
-  if (minus_zero_mode == FAIL_ON_MINUS_ZERO) {
-    Label done;
-    // The integer converted back is equal to the original. We
-    // only have to test if we got -0 as an input.
-    testl(result_reg, result_reg);
-    j(not_zero, &done, Label::kNear);
-    Movmskpd(result_reg, input_reg);
-    // Bit 0 contains the sign of the double in input_reg.
-    // If input was positive, we are ok and return 0, otherwise
-    // jump to minus_zero.
-    andl(result_reg, Immediate(1));
-    j(not_zero, minus_zero, dst);
-    bind(&done);
-  }
 }
 
 
@@ -2076,8 +1808,7 @@ void MacroAssembler::AssertSmi(Register object) {
   }
 }
 
-
-void MacroAssembler::AssertSmi(const Operand& object) {
+void MacroAssembler::AssertSmi(Operand object) {
   if (emit_debug_code()) {
     Condition is_smi = CheckSmi(object);
     Check(is_smi, AbortReason::kOperandIsNotASmi);
@@ -2104,6 +1835,18 @@ void TurboAssembler::AssertZeroExtended(Register int32_register) {
   }
 }
 
+void MacroAssembler::AssertConstructor(Register object) {
+  if (emit_debug_code()) {
+    testb(object, Immediate(kSmiTagMask));
+    Check(not_equal, AbortReason::kOperandIsASmiAndNotAConstructor);
+    Push(object);
+    movq(object, FieldOperand(object, HeapObject::kMapOffset));
+    testb(FieldOperand(object, Map::kBitFieldOffset),
+          Immediate(Map::IsConstructorBit::kMask));
+    Pop(object);
+    Check(not_zero, AbortReason::kOperandIsNotAConstructor);
+  }
+}
 
 void MacroAssembler::AssertFunction(Register object) {
   if (emit_debug_code()) {
@@ -2164,6 +1907,13 @@ void MacroAssembler::AssertUndefinedOrAllocationSite(Register object) {
   }
 }
 
+void MacroAssembler::LoadWeakValue(Register in_out, Label* target_if_cleared) {
+  cmpp(in_out, Immediate(kClearedWeakHeapObject));
+  j(equal, target_if_cleared);
+
+  andp(in_out, Immediate(~kWeakHeapObjectMask));
+}
+
 void MacroAssembler::IncrementCounter(StatsCounter* counter, int value) {
   DCHECK_GT(value, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
@@ -2310,6 +2060,7 @@ void MacroAssembler::InvokeFunctionCode(Register function, Register new_target,
     // We call indirectly through the code field in the function to
     // allow recompilation to take effect without changing any of the
     // call sites.
+    static_assert(kJavaScriptCallCodeStartRegister == rcx, "ABI mismatch");
     movp(rcx, FieldOperand(function, JSFunction::kCodeOffset));
     addp(rcx, Immediate(Code::kHeaderSize - kHeapObjectTag));
     if (flag == CALL_FUNCTION) {
@@ -2393,6 +2144,7 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
   Operand debug_hook_active_operand = ExternalOperand(debug_hook_active);
   cmpb(debug_hook_active_operand, Immediate(0));
   j(equal, &skip_hook);
+
   {
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
@@ -2446,13 +2198,13 @@ void TurboAssembler::EnterFrame(StackFrame::Type type) {
   if (type == StackFrame::INTERNAL) {
     Move(kScratchRegister, CodeObject(), RelocInfo::EMBEDDED_OBJECT);
     Push(kScratchRegister);
-  }
-  if (emit_debug_code()) {
-    Move(kScratchRegister,
-         isolate()->factory()->undefined_value(),
-         RelocInfo::EMBEDDED_OBJECT);
-    cmpp(Operand(rsp, 0), kScratchRegister);
-    Check(not_equal, AbortReason::kCodeObjectNotProperlyPatched);
+    // Check at runtime that this code object was patched correctly.
+    if (emit_debug_code()) {
+      Move(kScratchRegister, isolate()->factory()->undefined_value(),
+           RelocInfo::EMBEDDED_OBJECT);
+      cmpp(Operand(rsp, 0), kScratchRegister);
+      Check(not_equal, AbortReason::kCodeObjectNotProperlyPatched);
+    }
   }
 }
 
@@ -2509,9 +2261,12 @@ void MacroAssembler::EnterExitFramePrologue(bool save_rax,
     movp(r14, rax);  // Backup rax in callee-save register.
   }
 
-  Store(ExternalReference(IsolateAddressId::kCEntryFPAddress, isolate()), rbp);
-  Store(ExternalReference(IsolateAddressId::kContextAddress, isolate()), rsi);
-  Store(ExternalReference(IsolateAddressId::kCFunctionAddress, isolate()), rbx);
+  ExternalReference fp_address(IsolateAddressId::kCEntryFPAddress, isolate()),
+      context_address(IsolateAddressId::kContextAddress, isolate()),
+      function_address(IsolateAddressId::kCFunctionAddress, isolate());
+  movp(ExternalOperand(fp_address), rbp);
+  movp(ExternalOperandReuseScratchRegister(context_address, fp_address), rsi);
+  movp(ExternalOperandReuseScratchRegister(function_address, fp_address), rbx);
 }
 
 
@@ -2619,7 +2374,8 @@ void MacroAssembler::LeaveExitFrameEpilogue() {
   // Clear the top frame.
   ExternalReference c_entry_fp_address(IsolateAddressId::kCEntryFPAddress,
                                        isolate());
-  Operand c_entry_fp_operand = ExternalOperand(c_entry_fp_address);
+  Operand c_entry_fp_operand =
+      ExternalOperandReuseScratchRegister(c_entry_fp_address, context_address);
   movp(c_entry_fp_operand, Immediate(0));
 }
 
@@ -2739,6 +2495,23 @@ void TurboAssembler::CheckPageFlag(Register object, Register scratch, int mask,
   }
   j(cc, condition_met, condition_met_distance);
 }
+
+void TurboAssembler::ComputeCodeStartAddress(Register dst) {
+  Label current;
+  bind(&current);
+  int pc = pc_offset();
+  // Load effective address to get the address of the current instruction.
+  leaq(dst, Operand(&current));
+  if (pc != 0) {
+    subq(dst, Immediate(pc));
+  }
+}
+
+void TurboAssembler::ResetSpeculationPoisonRegister() {
+  // TODO(tebbi): Perhaps, we want to put an lfence here.
+  Set(kSpeculationPoisonRegister, -1);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/x64/macro-assembler-x64.h b/deps/v8/src/x64/macro-assembler-x64.h
index 4ceab2cf9c7..8777d5a8466 100644
--- a/deps/v8/src/x64/macro-assembler-x64.h
+++ b/deps/v8/src/x64/macro-assembler-x64.h
@@ -20,11 +20,13 @@ constexpr Register kReturnRegister2 = r8;
 constexpr Register kJSFunctionRegister = rdi;
 constexpr Register kContextRegister = rsi;
 constexpr Register kAllocateSizeRegister = rdx;
+constexpr Register kSpeculationPoisonRegister = r12;
 constexpr Register kInterpreterAccumulatorRegister = rax;
-constexpr Register kInterpreterBytecodeOffsetRegister = r12;
+constexpr Register kInterpreterBytecodeOffsetRegister = r9;
 constexpr Register kInterpreterBytecodeArrayRegister = r14;
 constexpr Register kInterpreterDispatchTableRegister = r15;
 constexpr Register kJavaScriptCallArgCountRegister = rax;
+constexpr Register kJavaScriptCallCodeStartRegister = rcx;
 constexpr Register kJavaScriptCallNewTargetRegister = rdx;
 constexpr Register kRuntimeCallFunctionRegister = rbx;
 constexpr Register kRuntimeCallArgCountRegister = rax;
@@ -38,6 +40,7 @@ constexpr Register kRootRegister = r13;  // callee save
 // Actual value of root register is offset from the root array's start
 // to take advantage of negitive 8-bit displacement values.
 constexpr int kRootRegisterBias = 128;
+constexpr Register kOffHeapTrampolineRegister = kScratchRegister;
 
 // Convenience for platform-independent signatures.
 typedef Operand MemOperand;
@@ -133,51 +136,86 @@ class TurboAssembler : public Assembler {
     return code_object_;
   }
 
-#define AVX_OP2_WITH_TYPE(macro_name, name, src_type) \
-  void macro_name(XMMRegister dst, src_type src) {    \
-    if (CpuFeatures::IsSupported(AVX)) {              \
-      CpuFeatureScope scope(this, AVX);               \
-      v##name(dst, dst, src);                         \
-    } else {                                          \
-      name(dst, src);                                 \
-    }                                                 \
+  template <typename Dst, typename... Args>
+  struct AvxHelper {
+    Assembler* assm;
+    // Call an method where the AVX version expects the dst argument to be
+    // duplicated.
+    template <void (Assembler::*avx)(Dst, Dst, Args...),
+              void (Assembler::*no_avx)(Dst, Args...)>
+    void emit(Dst dst, Args... args) {
+      if (CpuFeatures::IsSupported(AVX)) {
+        CpuFeatureScope scope(assm, AVX);
+        (assm->*avx)(dst, dst, args...);
+      } else {
+        (assm->*no_avx)(dst, args...);
+      }
+    }
+
+    // Call an method where the AVX version expects no duplicated dst argument.
+    template <void (Assembler::*avx)(Dst, Args...),
+              void (Assembler::*no_avx)(Dst, Args...)>
+    void emit(Dst dst, Args... args) {
+      if (CpuFeatures::IsSupported(AVX)) {
+        CpuFeatureScope scope(assm, AVX);
+        (assm->*avx)(dst, args...);
+      } else {
+        (assm->*no_avx)(dst, args...);
+      }
+    }
+  };
+
+#define AVX_OP(macro_name, name)                                             \
+  template <typename Dst, typename... Args>                                  \
+  void macro_name(Dst dst, Args... args) {                                   \
+    AvxHelper<Dst, Args...>{this}                                            \
+        .template emit<&Assembler::v##name, &Assembler::name>(dst, args...); \
   }
-#define AVX_OP2_X(macro_name, name) \
-  AVX_OP2_WITH_TYPE(macro_name, name, XMMRegister)
-#define AVX_OP2_O(macro_name, name) \
-  AVX_OP2_WITH_TYPE(macro_name, name, const Operand&)
-#define AVX_OP2_XO(macro_name, name) \
-  AVX_OP2_X(macro_name, name)        \
-  AVX_OP2_O(macro_name, name)
-
-  AVX_OP2_XO(Subsd, subsd)
-  AVX_OP2_XO(Divss, divss)
-  AVX_OP2_XO(Divsd, divsd)
-  AVX_OP2_XO(Xorpd, xorpd)
-  AVX_OP2_X(Pcmpeqd, pcmpeqd)
-  AVX_OP2_WITH_TYPE(Psllq, psllq, byte)
-  AVX_OP2_WITH_TYPE(Psrlq, psrlq, byte)
-
-#undef AVX_OP2_O
-#undef AVX_OP2_X
-#undef AVX_OP2_XO
-#undef AVX_OP2_WITH_TYPE
-
-  void Xorps(XMMRegister dst, XMMRegister src);
-  void Xorps(XMMRegister dst, const Operand& src);
-
-  void Movd(XMMRegister dst, Register src);
-  void Movd(XMMRegister dst, const Operand& src);
-  void Movd(Register dst, XMMRegister src);
-  void Movq(XMMRegister dst, Register src);
-  void Movq(Register dst, XMMRegister src);
-
-  void Movsd(XMMRegister dst, XMMRegister src);
-  void Movsd(XMMRegister dst, const Operand& src);
-  void Movsd(const Operand& dst, XMMRegister src);
-  void Movss(XMMRegister dst, XMMRegister src);
-  void Movss(XMMRegister dst, const Operand& src);
-  void Movss(const Operand& dst, XMMRegister src);
+
+  AVX_OP(Subsd, subsd)
+  AVX_OP(Divss, divss)
+  AVX_OP(Divsd, divsd)
+  AVX_OP(Xorps, xorps)
+  AVX_OP(Xorpd, xorpd)
+  AVX_OP(Movd, movd)
+  AVX_OP(Movq, movq)
+  AVX_OP(Movaps, movaps)
+  AVX_OP(Movapd, movapd)
+  AVX_OP(Movups, movups)
+  AVX_OP(Movmskps, movmskps)
+  AVX_OP(Movmskpd, movmskpd)
+  AVX_OP(Movss, movss)
+  AVX_OP(Movsd, movsd)
+  AVX_OP(Pcmpeqd, pcmpeqd)
+  AVX_OP(Pslld, pslld)
+  AVX_OP(Psllq, psllq)
+  AVX_OP(Psrld, psrld)
+  AVX_OP(Psrlq, psrlq)
+  AVX_OP(Addsd, addsd)
+  AVX_OP(Mulsd, mulsd)
+  AVX_OP(Andps, andps)
+  AVX_OP(Andpd, andpd)
+  AVX_OP(Orpd, orpd)
+  AVX_OP(Cmpeqps, cmpeqps)
+  AVX_OP(Cmpltps, cmpltps)
+  AVX_OP(Cmpleps, cmpleps)
+  AVX_OP(Cmpneqps, cmpneqps)
+  AVX_OP(Cmpnltps, cmpnltps)
+  AVX_OP(Cmpnleps, cmpnleps)
+  AVX_OP(Cmpeqpd, cmpeqpd)
+  AVX_OP(Cmpltpd, cmpltpd)
+  AVX_OP(Cmplepd, cmplepd)
+  AVX_OP(Cmpneqpd, cmpneqpd)
+  AVX_OP(Cmpnltpd, cmpnltpd)
+  AVX_OP(Cmpnlepd, cmpnlepd)
+  AVX_OP(Roundss, roundss)
+  AVX_OP(Roundsd, roundsd)
+  AVX_OP(Sqrtss, sqrtss)
+  AVX_OP(Sqrtsd, sqrtsd)
+  AVX_OP(Ucomiss, ucomiss)
+  AVX_OP(Ucomisd, ucomisd)
+
+#undef AVX_OP
 
   void PushReturnAddressFrom(Register src) { pushq(src); }
   void PopReturnAddressTo(Register dst) { popq(dst); }
@@ -190,25 +228,17 @@ class TurboAssembler : public Assembler {
 
   // Load a register with a long value as efficiently as possible.
   void Set(Register dst, int64_t x);
-  void Set(const Operand& dst, intptr_t x);
+  void Set(Operand dst, intptr_t x);
 
   // Operations on roots in the root-array.
   void LoadRoot(Register destination, Heap::RootListIndex index);
-  void LoadRoot(const Operand& destination, Heap::RootListIndex index) {
+  void LoadRoot(Operand destination, Heap::RootListIndex index) {
     LoadRoot(kScratchRegister, index);
     movp(destination, kScratchRegister);
   }
 
-  void Movups(XMMRegister dst, XMMRegister src);
-  void Movups(XMMRegister dst, const Operand& src);
-  void Movups(const Operand& dst, XMMRegister src);
-  void Movapd(XMMRegister dst, XMMRegister src);
-  void Movaps(XMMRegister dst, XMMRegister src);
-  void Movmskpd(Register dst, XMMRegister src);
-  void Movmskps(Register dst, XMMRegister src);
-
   void Push(Register src);
-  void Push(const Operand& src);
+  void Push(Operand src);
   void Push(Immediate value);
   void Push(Smi* smi);
   void Push(Handle<HeapObject> source);
@@ -239,23 +269,23 @@ class TurboAssembler : public Assembler {
                      Label::Distance condition_met_distance = Label::kFar);
 
   void Cvtss2sd(XMMRegister dst, XMMRegister src);
-  void Cvtss2sd(XMMRegister dst, const Operand& src);
+  void Cvtss2sd(XMMRegister dst, Operand src);
   void Cvtsd2ss(XMMRegister dst, XMMRegister src);
-  void Cvtsd2ss(XMMRegister dst, const Operand& src);
+  void Cvtsd2ss(XMMRegister dst, Operand src);
   void Cvttsd2si(Register dst, XMMRegister src);
-  void Cvttsd2si(Register dst, const Operand& src);
+  void Cvttsd2si(Register dst, Operand src);
   void Cvttsd2siq(Register dst, XMMRegister src);
-  void Cvttsd2siq(Register dst, const Operand& src);
+  void Cvttsd2siq(Register dst, Operand src);
   void Cvttss2si(Register dst, XMMRegister src);
-  void Cvttss2si(Register dst, const Operand& src);
+  void Cvttss2si(Register dst, Operand src);
   void Cvttss2siq(Register dst, XMMRegister src);
-  void Cvttss2siq(Register dst, const Operand& src);
+  void Cvttss2siq(Register dst, Operand src);
   void Cvtqsi2ss(XMMRegister dst, Register src);
-  void Cvtqsi2ss(XMMRegister dst, const Operand& src);
+  void Cvtqsi2ss(XMMRegister dst, Operand src);
   void Cvtqsi2sd(XMMRegister dst, Register src);
-  void Cvtqsi2sd(XMMRegister dst, const Operand& src);
+  void Cvtqsi2sd(XMMRegister dst, Operand src);
   void Cvtlsi2ss(XMMRegister dst, Register src);
-  void Cvtlsi2ss(XMMRegister dst, const Operand& src);
+  void Cvtlsi2ss(XMMRegister dst, Operand src);
   void Cvtqui2ss(XMMRegister dst, Register src, Register tmp);
   void Cvtqui2sd(XMMRegister dst, Register src, Register tmp);
 
@@ -263,35 +293,24 @@ class TurboAssembler : public Assembler {
   // hinders register renaming and makes dependence chains longer. So we use
   // xorpd to clear the dst register before cvtsi2sd to solve this issue.
   void Cvtlsi2sd(XMMRegister dst, Register src);
-  void Cvtlsi2sd(XMMRegister dst, const Operand& src);
-
-  void Roundss(XMMRegister dst, XMMRegister src, RoundingMode mode);
-  void Roundsd(XMMRegister dst, XMMRegister src, RoundingMode mode);
-
-  void Sqrtsd(XMMRegister dst, XMMRegister src);
-  void Sqrtsd(XMMRegister dst, const Operand& src);
-
-  void Ucomiss(XMMRegister src1, XMMRegister src2);
-  void Ucomiss(XMMRegister src1, const Operand& src2);
-  void Ucomisd(XMMRegister src1, XMMRegister src2);
-  void Ucomisd(XMMRegister src1, const Operand& src2);
+  void Cvtlsi2sd(XMMRegister dst, Operand src);
 
   void Lzcntq(Register dst, Register src);
-  void Lzcntq(Register dst, const Operand& src);
+  void Lzcntq(Register dst, Operand src);
   void Lzcntl(Register dst, Register src);
-  void Lzcntl(Register dst, const Operand& src);
+  void Lzcntl(Register dst, Operand src);
   void Tzcntq(Register dst, Register src);
-  void Tzcntq(Register dst, const Operand& src);
+  void Tzcntq(Register dst, Operand src);
   void Tzcntl(Register dst, Register src);
-  void Tzcntl(Register dst, const Operand& src);
+  void Tzcntl(Register dst, Operand src);
   void Popcntl(Register dst, Register src);
-  void Popcntl(Register dst, const Operand& src);
+  void Popcntl(Register dst, Operand src);
   void Popcntq(Register dst, Register src);
-  void Popcntq(Register dst, const Operand& src);
+  void Popcntq(Register dst, Operand src);
 
   // Is the value a tagged smi.
   Condition CheckSmi(Register src);
-  Condition CheckSmi(const Operand& src);
+  Condition CheckSmi(Operand src);
 
   // Jump to label if the value is a tagged smi.
   void JumpIfSmi(Register src, Label* on_smi,
@@ -299,7 +318,7 @@ class TurboAssembler : public Assembler {
 
   void Move(Register dst, Smi* source);
 
-  void Move(const Operand& dst, Smi* source) {
+  void Move(Operand dst, Smi* source) {
     Register constant = GetSmiConstant(source);
     movp(dst, constant);
   }
@@ -319,7 +338,7 @@ class TurboAssembler : public Assembler {
 
   void Move(Register dst, Handle<HeapObject> source,
             RelocInfo::Mode rmode = RelocInfo::EMBEDDED_OBJECT);
-  void Move(const Operand& dst, Handle<HeapObject> source,
+  void Move(Operand dst, Handle<HeapObject> source,
             RelocInfo::Mode rmode = RelocInfo::EMBEDDED_OBJECT);
 
   // Loads a pointer into a register with a relocation mode.
@@ -333,13 +352,25 @@ class TurboAssembler : public Assembler {
   // Convert smi to 32-bit integer. I.e., not sign extended into
   // high 32 bits of destination.
   void SmiToInteger32(Register dst, Register src);
-  void SmiToInteger32(Register dst, const Operand& src);
+  void SmiToInteger32(Register dst, Operand src);
 
   // Loads the address of the external reference into the destination
   // register.
   void LoadAddress(Register destination, ExternalReference source);
 
-  void Call(const Operand& op);
+  // Operand pointing to an external reference.
+  // May emit code to set up the scratch register. The operand is
+  // only guaranteed to be correct as long as the scratch register
+  // isn't changed.
+  // If the operand is used more than once, use a scratch register
+  // that is guaranteed not to be clobbered.
+  Operand ExternalOperand(ExternalReference reference,
+                          Register scratch = kScratchRegister);
+  Operand ExternalOperandReuseScratchRegister(
+      ExternalReference target, ExternalReference previous,
+      Register scratch = kScratchRegister);
+
+  void Call(Operand op);
   void Call(Handle<Code> code_object, RelocInfo::Mode rmode);
   void Call(Address destination, RelocInfo::Mode rmode);
   void Call(ExternalReference ext);
@@ -365,7 +396,7 @@ class TurboAssembler : public Assembler {
     // Opcode: REX_opt FF /2 m64
     return (target.high_bit() != 0) ? 3 : 2;
   }
-  int CallSize(const Operand& target) {
+  int CallSize(Operand target) {
     // Opcode: REX_opt FF /2 m64
     return (target.requires_rex() ? 2 : 1) + target.operand_size();
   }
@@ -377,10 +408,10 @@ class TurboAssembler : public Assembler {
   // Non-SSE2 instructions.
   void Pextrd(Register dst, XMMRegister src, int8_t imm8);
   void Pinsrd(XMMRegister dst, Register src, int8_t imm8);
-  void Pinsrd(XMMRegister dst, const Operand& src, int8_t imm8);
+  void Pinsrd(XMMRegister dst, Operand src, int8_t imm8);
 
   void CompareRoot(Register with, Heap::RootListIndex index);
-  void CompareRoot(const Operand& with, Heap::RootListIndex index);
+  void CompareRoot(Operand with, Heap::RootListIndex index);
 
   // Generates function and stub prologue code.
   void StubPrologue(StackFrame::Type type);
@@ -476,6 +507,12 @@ class TurboAssembler : public Assembler {
                      Register exclusion2 = no_reg,
                      Register exclusion3 = no_reg);
 
+  // Compute the start of the generated instruction stream from the current PC.
+  // This is an alternative to embedding the {CodeObject} handle as a reference.
+  void ComputeCodeStartAddress(Register dst);
+
+  void ResetSpeculationPoisonRegister();
+
  protected:
   static const int kSmiShift = kSmiTagSize + kSmiShiftSize;
   int smi_count = 0;
@@ -519,14 +556,6 @@ class MacroAssembler : public TurboAssembler {
     bool old_value_;
   };
 
-  // Operand pointing to an external reference.
-  // May emit code to set up the scratch register. The operand is
-  // only guaranteed to be correct as long as the scratch register
-  // isn't changed.
-  // If the operand is used more than once, use a scratch register
-  // that is guaranteed not to be clobbered.
-  Operand ExternalOperand(ExternalReference reference,
-                          Register scratch = kScratchRegister);
   // Loads and stores the value of an external reference.
   // Special case code for load and store to take advantage of
   // load_rax/store_rax if possible/necessary.
@@ -551,8 +580,7 @@ class MacroAssembler : public TurboAssembler {
     CompareRoot(with, index);
     j(equal, if_equal, if_equal_distance);
   }
-  void JumpIfRoot(const Operand& with, Heap::RootListIndex index,
-                  Label* if_equal,
+  void JumpIfRoot(Operand with, Heap::RootListIndex index, Label* if_equal,
                   Label::Distance if_equal_distance = Label::kFar) {
     CompareRoot(with, index);
     j(equal, if_equal, if_equal_distance);
@@ -565,7 +593,7 @@ class MacroAssembler : public TurboAssembler {
     CompareRoot(with, index);
     j(not_equal, if_not_equal, if_not_equal_distance);
   }
-  void JumpIfNotRoot(const Operand& with, Heap::RootListIndex index,
+  void JumpIfNotRoot(Operand with, Heap::RootListIndex index,
                      Label* if_not_equal,
                      Label::Distance if_not_equal_distance = Label::kFar) {
     CompareRoot(with, index);
@@ -649,10 +677,6 @@ class MacroAssembler : public TurboAssembler {
                       const ParameterCount& expected,
                       const ParameterCount& actual, InvokeFlag flag);
 
-  void InvokeFunction(Handle<JSFunction> function,
-                      const ParameterCount& expected,
-                      const ParameterCount& actual, InvokeFlag flag);
-
   // ---------------------------------------------------------------------------
   // Conversions between tagged smi values and non-tagged integer values.
 
@@ -668,9 +692,9 @@ class MacroAssembler : public TurboAssembler {
   // otherwise use Cmp.
   void SmiCompare(Register smi1, Register smi2);
   void SmiCompare(Register dst, Smi* src);
-  void SmiCompare(Register dst, const Operand& src);
-  void SmiCompare(const Operand& dst, Register src);
-  void SmiCompare(const Operand& dst, Smi* src);
+  void SmiCompare(Register dst, Operand src);
+  void SmiCompare(Operand dst, Register src);
+  void SmiCompare(Operand dst, Smi* src);
 
   // Functions performing a check on a known or potential smi. Returns
   // a condition that is satisfied if the check is successful.
@@ -694,7 +718,7 @@ class MacroAssembler : public TurboAssembler {
 
   // Add an integer constant to a tagged smi, giving a tagged smi as result.
   // No overflow testing on the result is done.
-  void SmiAddConstant(const Operand& dst, Smi* constant);
+  void SmiAddConstant(Operand dst, Smi* constant);
 
   // Specialized operations
 
@@ -712,13 +736,13 @@ class MacroAssembler : public TurboAssembler {
   // Macro instructions.
 
   // Load/store with specific representation.
-  void Load(Register dst, const Operand& src, Representation r);
-  void Store(const Operand& dst, Register src, Representation r);
+  void Load(Register dst, Operand src, Representation r);
+  void Store(Operand dst, Register src, Representation r);
 
   void Cmp(Register dst, Handle<Object> source);
-  void Cmp(const Operand& dst, Handle<Object> source);
+  void Cmp(Operand dst, Handle<Object> source);
   void Cmp(Register dst, Smi* src);
-  void Cmp(const Operand& dst, Smi* src);
+  void Cmp(Operand dst, Smi* src);
 
   // Emit code to discard a non-negative number of pointer-sized elements
   // from the stack, clobbering only the rsp register.
@@ -729,51 +753,11 @@ class MacroAssembler : public TurboAssembler {
   void DropUnderReturnAddress(int stack_elements,
                               Register scratch = kScratchRegister);
 
-  void PushQuad(const Operand& src);
+  void PushQuad(Operand src);
   void PushImm32(int32_t imm32);
   void Pop(Register dst);
-  void Pop(const Operand& dst);
-  void PopQuad(const Operand& dst);
-
-#define AVX_OP2_WITH_TYPE(macro_name, name, src_type) \
-  void macro_name(XMMRegister dst, src_type src) {    \
-    if (CpuFeatures::IsSupported(AVX)) {              \
-      CpuFeatureScope scope(this, AVX);               \
-      v##name(dst, dst, src);                         \
-    } else {                                          \
-      name(dst, src);                                 \
-    }                                                 \
-  }
-#define AVX_OP2_X(macro_name, name) \
-  AVX_OP2_WITH_TYPE(macro_name, name, XMMRegister)
-#define AVX_OP2_O(macro_name, name) \
-  AVX_OP2_WITH_TYPE(macro_name, name, const Operand&)
-#define AVX_OP2_XO(macro_name, name) \
-  AVX_OP2_X(macro_name, name)        \
-  AVX_OP2_O(macro_name, name)
-
-  AVX_OP2_XO(Addsd, addsd)
-  AVX_OP2_XO(Mulsd, mulsd)
-  AVX_OP2_XO(Andps, andps)
-  AVX_OP2_XO(Andpd, andpd)
-  AVX_OP2_XO(Orpd, orpd)
-  AVX_OP2_XO(Cmpeqps, cmpeqps)
-  AVX_OP2_XO(Cmpltps, cmpltps)
-  AVX_OP2_XO(Cmpleps, cmpleps)
-  AVX_OP2_XO(Cmpneqps, cmpneqps)
-  AVX_OP2_XO(Cmpnltps, cmpnltps)
-  AVX_OP2_XO(Cmpnleps, cmpnleps)
-  AVX_OP2_XO(Cmpeqpd, cmpeqpd)
-  AVX_OP2_XO(Cmpltpd, cmpltpd)
-  AVX_OP2_XO(Cmplepd, cmplepd)
-  AVX_OP2_XO(Cmpneqpd, cmpneqpd)
-  AVX_OP2_XO(Cmpnltpd, cmpnltpd)
-  AVX_OP2_XO(Cmpnlepd, cmpnlepd)
-
-#undef AVX_OP2_O
-#undef AVX_OP2_X
-#undef AVX_OP2_XO
-#undef AVX_OP2_WITH_TYPE
+  void Pop(Operand dst);
+  void PopQuad(Operand dst);
 
   // ---------------------------------------------------------------------------
   // SIMD macros.
@@ -785,9 +769,12 @@ class MacroAssembler : public TurboAssembler {
   // Control Flow
   void Jump(Address destination, RelocInfo::Mode rmode);
   void Jump(ExternalReference ext);
-  void Jump(const Operand& op);
+  void Jump(Operand op);
   void Jump(Handle<Code> code_object, RelocInfo::Mode rmode);
 
+  // Generates a trampoline to jump to the off-heap instruction stream.
+  void JumpToInstructionStream(Address entry);
+
   // Non-x64 instructions.
   // Push/pop all general purpose registers.
   // Does not push rsp/rbp nor any of the assembler's special purpose registers
@@ -806,8 +793,7 @@ class MacroAssembler : public TurboAssembler {
   void CmpInstanceType(Register map, InstanceType type);
 
   void DoubleToI(Register result_reg, XMMRegister input_reg,
-                 XMMRegister scratch, MinusZeroMode minus_zero_mode,
-                 Label* lost_precision, Label* is_nan, Label* minus_zero,
+                 XMMRegister scratch, Label* lost_precision, Label* is_nan,
                  Label::Distance dst = Label::kFar);
 
   template<typename Field>
@@ -825,11 +811,14 @@ class MacroAssembler : public TurboAssembler {
 
   // Abort execution if argument is not a smi, enabled via --debug-code.
   void AssertSmi(Register object);
-  void AssertSmi(const Operand& object);
+  void AssertSmi(Operand object);
 
   // Abort execution if argument is not a FixedArray, enabled via --debug-code.
   void AssertFixedArray(Register object);
 
+  // Abort execution if argument is not a Constructor, enabled via --debug-code.
+  void AssertConstructor(Register object);
+
   // Abort execution if argument is not a JSFunction, enabled via --debug-code.
   void AssertFunction(Register object);
 
@@ -906,6 +895,9 @@ class MacroAssembler : public TurboAssembler {
   void IncrementCounter(StatsCounter* counter, int value);
   void DecrementCounter(StatsCounter* counter, int value);
 
+  // ---------------------------------------------------------------------------
+  // In-place weak references.
+  void LoadWeakValue(Register in_out, Label* target_if_cleared);
 
   // ---------------------------------------------------------------------------
   // Debugging
diff --git a/deps/v8/src/x64/sse-instr.h b/deps/v8/src/x64/sse-instr.h
index 235aa75fcf2..a6614c2346d 100644
--- a/deps/v8/src/x64/sse-instr.h
+++ b/deps/v8/src/x64/sse-instr.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_SSE_INSTR_H_
-#define V8_SSE_INSTR_H_
+#ifndef V8_X64_SSE_INSTR_H_
+#define V8_X64_SSE_INSTR_H_
 
 #define SSE2_INSTRUCTION_LIST(V) \
   V(packsswb, 66, 0F, 63)        \
@@ -70,4 +70,4 @@
   V(pmulld, 66, 0F, 38, 40)      \
   V(ptest, 66, 0F, 38, 17)
 
-#endif  // V8_SSE_INSTR_H_
+#endif  // V8_X64_SSE_INSTR_H_
diff --git a/deps/v8/src/zone/accounting-allocator.h b/deps/v8/src/zone/accounting-allocator.h
index 53d30b38269..bf36a7ff952 100644
--- a/deps/v8/src/zone/accounting-allocator.h
+++ b/deps/v8/src/zone/accounting-allocator.h
@@ -6,6 +6,7 @@
 #define V8_ZONE_ACCOUNTING_ALLOCATOR_H_
 
 #include "include/v8-platform.h"
+#include "include/v8.h"
 #include "src/base/atomic-utils.h"
 #include "src/base/atomicops.h"
 #include "src/base/macros.h"
diff --git a/deps/v8/src/zone/zone-chunk-list.h b/deps/v8/src/zone/zone-chunk-list.h
index a0aaca8b09a..229a3f3f40a 100644
--- a/deps/v8/src/zone/zone-chunk-list.h
+++ b/deps/v8/src/zone/zone-chunk-list.h
@@ -8,18 +8,14 @@
 #include "src/utils.h"
 #include "src/zone/zone.h"
 
-#ifndef V8_SRC_ZONE_ZONE_CHUNK_LIST_H_
-#define V8_SRC_ZONE_ZONE_CHUNK_LIST_H_
+#ifndef V8_ZONE_ZONE_CHUNK_LIST_H_
+#define V8_ZONE_ZONE_CHUNK_LIST_H_
 
 namespace v8 {
 namespace internal {
 
-template <typename T>
+template <typename T, bool backwards, bool modifiable>
 class ZoneChunkListIterator;
-template <typename T>
-class ForwardZoneChunkListIterator;
-template <typename T>
-class ReverseZoneChunkListIterator;
 
 // A zone-backed hybrid of a vector and a linked list. Use it if you need a
 // collection that
@@ -38,6 +34,11 @@ class ReverseZoneChunkListIterator;
 template <typename T>
 class ZoneChunkList : public ZoneObject {
  public:
+  using iterator = ZoneChunkListIterator<T, false, true>;
+  using const_iterator = ZoneChunkListIterator<T, false, false>;
+  using reverse_iterator = ZoneChunkListIterator<T, true, true>;
+  using const_reverse_iterator = ZoneChunkListIterator<T, true, false>;
+
   enum class StartMode {
     // The list will not allocate a starting chunk. Use if you expect your
     // list to remain empty in many cases.
@@ -58,7 +59,7 @@ class ZoneChunkList : public ZoneObject {
     }
   }
 
-  size_t size() const;
+  size_t size() const { return size_; }
 
   T& front() const;
   T& back() const;
@@ -78,27 +79,31 @@ class ZoneChunkList : public ZoneObject {
 
   // Quickly scans the list to retrieve the element at the given index. Will
   // *not* check bounds.
-  ForwardZoneChunkListIterator<T> Find(const size_t index);
-  ForwardZoneChunkListIterator<const T> Find(const size_t index) const;
+  iterator Find(const size_t index);
+  const_iterator Find(const size_t index) const;
   // TODO(heimbuef): Add 'rFind', seeking from the end and returning a
   // reverse iterator.
 
   void CopyTo(T* ptr);
 
-  ForwardZoneChunkListIterator<T> begin();
-  ForwardZoneChunkListIterator<T> end();
-  ReverseZoneChunkListIterator<T> rbegin();
-  ReverseZoneChunkListIterator<T> rend();
-  ForwardZoneChunkListIterator<const T> begin() const;
-  ForwardZoneChunkListIterator<const T> end() const;
-  ReverseZoneChunkListIterator<const T> rbegin() const;
-  ReverseZoneChunkListIterator<const T> rend() const;
+  iterator begin() { return iterator::Begin(this); }
+  iterator end() { return iterator::End(this); }
+  reverse_iterator rbegin() { return reverse_iterator::Begin(this); }
+  reverse_iterator rend() { return reverse_iterator::End(this); }
+  const_iterator begin() const { return const_iterator::Begin(this); }
+  const_iterator end() const { return const_iterator::End(this); }
+  const_reverse_iterator rbegin() const {
+    return const_reverse_iterator::Begin(this);
+  }
+  const_reverse_iterator rend() const {
+    return const_reverse_iterator::End(this);
+  }
 
  private:
-  friend class ZoneChunkListIterator<T>;
-  friend class ForwardZoneChunkListIterator<T>;
-  friend class ReverseZoneChunkListIterator<T>;
-  static const uint32_t kMaxChunkCapacity = 256u;
+  template <typename S, bool backwards, bool modifiable>
+  friend class ZoneChunkListIterator;
+
+  static constexpr uint32_t kMaxChunkCapacity = 256u;
 
   STATIC_ASSERT(kMaxChunkCapacity == static_cast<uint32_t>(StartMode::kBig));
 
@@ -108,6 +113,7 @@ class ZoneChunkList : public ZoneObject {
     Chunk* next_ = nullptr;
     Chunk* previous_ = nullptr;
     T* items() { return reinterpret_cast<T*>(this + 1); }
+    const T* items() const { return reinterpret_cast<const T*>(this + 1); }
   };
 
   Chunk* NewChunk(const uint32_t capacity) {
@@ -135,152 +141,108 @@ class ZoneChunkList : public ZoneObject {
   DISALLOW_COPY_AND_ASSIGN(ZoneChunkList);
 };
 
-template <typename T>
+template <typename T, bool backwards, bool modifiable>
 class ZoneChunkListIterator {
+ private:
+  template <typename S>
+  using maybe_const =
+      typename std::conditional<modifiable, S,
+                                typename std::add_const<S>::type>::type;
+  using Chunk = maybe_const<typename ZoneChunkList<T>::Chunk>;
+  using ChunkList = maybe_const<ZoneChunkList<T>>;
+
  public:
-  T& operator*() { return current_->items()[position_]; }
-  bool operator==(const ZoneChunkListIterator& other) {
+  maybe_const<T>& operator*() { return current_->items()[position_]; }
+  bool operator==(const ZoneChunkListIterator& other) const {
     return other.current_ == current_ && other.position_ == position_;
   }
-  bool operator!=(const ZoneChunkListIterator& other) {
+  bool operator!=(const ZoneChunkListIterator& other) const {
     return !operator==(other);
   }
 
- protected:
-  ZoneChunkListIterator(typename ZoneChunkList<T>::Chunk* current,
-                        size_t position)
-      : current_(current), position_(position) {}
-
-  void MoveNext() {
-    ++position_;
-    if (position_ >= current_->capacity_) {
-      current_ = current_->next_;
-      position_ = 0;
-    }
-  }
-
-  void MoveRNext() {
-    if (position_ == 0) {
-      current_ = current_->previous_;
-      position_ = current_ ? current_->capacity_ - 1 : 0;
-    } else {
-      --position_;
-    }
-  }
-
-  typename ZoneChunkList<T>::Chunk* current_;
-  size_t position_;
-};
-
-template <typename T>
-class ForwardZoneChunkListIterator : public ZoneChunkListIterator<T> {
-  using ZoneChunkListIterator<T>::current_;
-  using ZoneChunkListIterator<T>::position_;
-  using ZoneChunkListIterator<T>::MoveNext;
-  using ZoneChunkListIterator<T>::MoveRNext;
-
- public:
-  ForwardZoneChunkListIterator(typename ZoneChunkList<T>::Chunk* current,
-                               size_t position)
-      : ZoneChunkListIterator<T>(current, position) {}
-
-  ForwardZoneChunkListIterator& operator++() {
-    MoveNext();
+  ZoneChunkListIterator& operator++() {
+    Move<backwards>();
     return *this;
   }
 
-  ForwardZoneChunkListIterator operator++(int) {
-    ForwardZoneChunkListIterator<T> clone(*this);
-    MoveNext();
+  ZoneChunkListIterator operator++(int) {
+    ZoneChunkListIterator clone(*this);
+    Move<backwards>();
     return clone;
   }
 
-  ForwardZoneChunkListIterator& operator--() {
-    MoveRNext();
+  ZoneChunkListIterator& operator--() {
+    Move<!backwards>();
     return *this;
   }
 
-  ForwardZoneChunkListIterator operator--(int) {
-    ForwardZoneChunkListIterator<T> clone(*this);
-    MoveRNext();
+  ZoneChunkListIterator operator--(int) {
+    ZoneChunkListIterator clone(*this);
+    Move<!backwards>();
     return clone;
   }
 
  private:
   friend class ZoneChunkList<T>;
-  static ForwardZoneChunkListIterator<T> Begin(ZoneChunkList<T>* list) {
-    return ForwardZoneChunkListIterator<T>(list->front_, 0);
-  }
-  static ForwardZoneChunkListIterator<T> End(ZoneChunkList<T>* list) {
-    if (list->back_ == nullptr) return Begin(list);
 
-    DCHECK_LE(list->back_->position_, list->back_->capacity_);
-    if (list->back_->position_ == list->back_->capacity_) {
-      return ForwardZoneChunkListIterator<T>(nullptr, 0);
-    }
+  static ZoneChunkListIterator Begin(ChunkList* list) {
+    // Forward iterator:
+    if (!backwards) return ZoneChunkListIterator(list->front_, 0);
 
-    return ForwardZoneChunkListIterator<T>(list->back_, list->back_->position_);
+    // Backward iterator:
+    if (list->back_ == nullptr) return End(list);
+    if (list->back_->position_ == 0) {
+      if (list->back_->previous_ != nullptr) {
+        return ZoneChunkListIterator(list->back_->previous_,
+                                     list->back_->previous_->capacity_ - 1);
+      } else {
+        return End(list);
+      }
+    }
+    return ZoneChunkListIterator(list->back_, list->back_->position_ - 1);
   }
-};
 
-template <typename T>
-class ReverseZoneChunkListIterator : public ZoneChunkListIterator<T> {
-  using ZoneChunkListIterator<T>::current_;
-  using ZoneChunkListIterator<T>::position_;
-  using ZoneChunkListIterator<T>::MoveNext;
-  using ZoneChunkListIterator<T>::MoveRNext;
+  static ZoneChunkListIterator End(ChunkList* list) {
+    // Backward iterator:
+    if (backwards) return ZoneChunkListIterator(nullptr, 0);
 
- public:
-  ReverseZoneChunkListIterator(typename ZoneChunkList<T>::Chunk* current,
-                               size_t position)
-      : ZoneChunkListIterator<T>(current, position) {}
-
-  ReverseZoneChunkListIterator& operator++() {
-    MoveRNext();
-    return *this;
-  }
+    // Forward iterator:
+    if (list->back_ == nullptr) return Begin(list);
 
-  ReverseZoneChunkListIterator operator++(int) {
-    ReverseZoneChunkListIterator<T> clone(*this);
-    MoveRNext();
-    return clone;
-  }
+    DCHECK_LE(list->back_->position_, list->back_->capacity_);
+    if (list->back_->position_ == list->back_->capacity_) {
+      return ZoneChunkListIterator(list->back_->next_, 0);
+    }
 
-  ReverseZoneChunkListIterator& operator--() {
-    MoveNext();
-    return *this;
+    return ZoneChunkListIterator(list->back_, list->back_->position_);
   }
 
-  ReverseZoneChunkListIterator operator--(int) {
-    ForwardZoneChunkListIterator<T> clone(*this);
-    MoveNext();
-    return clone;
-  }
+  ZoneChunkListIterator(Chunk* current, size_t position)
+      : current_(current), position_(position) {}
 
- private:
-  friend class ZoneChunkList<T>;
-  static ReverseZoneChunkListIterator<T> Begin(ZoneChunkList<T>* list) {
-    if (list->back_ == nullptr) return End(list);
-    if (list->back_->position_ == 0) {
-      if (list->back_->previous_ != nullptr) {
-        return ReverseZoneChunkListIterator<T>(
-            list->back_->previous_, list->back_->previous_->capacity_ - 1);
+  template <bool move_backward>
+  void Move() {
+    if (move_backward) {
+      // Move backwards.
+      if (position_ == 0) {
+        current_ = current_->previous_;
+        position_ = current_ ? current_->capacity_ - 1 : 0;
       } else {
-        return End(list);
+        --position_;
+      }
+    } else {
+      // Move forwards.
+      ++position_;
+      if (position_ >= current_->capacity_) {
+        current_ = current_->next_;
+        position_ = 0;
       }
     }
-    return ReverseZoneChunkListIterator<T>(list->back_,
-                                           list->back_->position_ - 1);
-  }
-  static ReverseZoneChunkListIterator<T> End(ZoneChunkList<T>* list) {
-    return ReverseZoneChunkListIterator<T>(nullptr, 0);
   }
-};
 
-template <typename T>
-size_t ZoneChunkList<T>::size() const {
-  return size_;
-}
+  Chunk* current_;
+  size_t position_;
+};
 
 template <typename T>
 T& ZoneChunkList<T>::front() const {
@@ -327,6 +289,7 @@ void ZoneChunkList<T>::pop_back() {
     back_ = back_->previous_;
   }
   --back_->position_;
+  --size_;
 }
 
 template <typename T>
@@ -380,18 +343,18 @@ void ZoneChunkList<T>::Rewind(const size_t limit) {
 }
 
 template <typename T>
-ForwardZoneChunkListIterator<T> ZoneChunkList<T>::Find(const size_t index) {
+typename ZoneChunkList<T>::iterator ZoneChunkList<T>::Find(const size_t index) {
   SeekResult seek_result = SeekIndex(index);
-  return ForwardZoneChunkListIterator<T>(seek_result.chunk_,
-                                         seek_result.chunk_index_);
+  return typename ZoneChunkList<T>::iterator(seek_result.chunk_,
+                                             seek_result.chunk_index_);
 }
 
 template <typename T>
-ForwardZoneChunkListIterator<const T> ZoneChunkList<T>::Find(
+typename ZoneChunkList<T>::const_iterator ZoneChunkList<T>::Find(
     const size_t index) const {
   SeekResult seek_result = SeekIndex(index);
-  return ForwardZoneChunkListIterator<const T>(seek_result.chunk_,
-                                               seek_result.chunk_index_);
+  return typename ZoneChunkList<T>::const_iterator(seek_result.chunk_,
+                                                   seek_result.chunk_index_);
 }
 
 template <typename T>
@@ -407,47 +370,7 @@ void ZoneChunkList<T>::CopyTo(T* ptr) {
   }
 }
 
-template <typename T>
-ForwardZoneChunkListIterator<T> ZoneChunkList<T>::begin() {
-  return ForwardZoneChunkListIterator<T>::Begin(this);
-}
-
-template <typename T>
-ForwardZoneChunkListIterator<T> ZoneChunkList<T>::end() {
-  return ForwardZoneChunkListIterator<T>::End(this);
-}
-
-template <typename T>
-ReverseZoneChunkListIterator<T> ZoneChunkList<T>::rbegin() {
-  return ReverseZoneChunkListIterator<T>::Begin(this);
-}
-
-template <typename T>
-ReverseZoneChunkListIterator<T> ZoneChunkList<T>::rend() {
-  return ReverseZoneChunkListIterator<T>::End(this);
-}
-
-template <typename T>
-ForwardZoneChunkListIterator<const T> ZoneChunkList<T>::begin() const {
-  return ForwardZoneChunkListIterator<const T>::Begin(this);
-}
-
-template <typename T>
-ForwardZoneChunkListIterator<const T> ZoneChunkList<T>::end() const {
-  return ForwardZoneChunkListIterator<const T>::End(this);
-}
-
-template <typename T>
-ReverseZoneChunkListIterator<const T> ZoneChunkList<T>::rbegin() const {
-  return ReverseZoneChunkListIterator<const T>::Begin(this);
-}
-
-template <typename T>
-ReverseZoneChunkListIterator<const T> ZoneChunkList<T>::rend() const {
-  return ReverseZoneChunkListIterator<const T>::End(this);
-}
-
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_SRC_ZONE_ZONE_CHUNK_LIST_H_
+#endif  // V8_ZONE_ZONE_CHUNK_LIST_H_
diff --git a/deps/v8/src/zone/zone-containers.h b/deps/v8/src/zone/zone-containers.h
index 5e9fd0440a5..c899bf340d7 100644
--- a/deps/v8/src/zone/zone-containers.h
+++ b/deps/v8/src/zone/zone-containers.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_SRC_ZONE_ZONE_CONTAINERS_H_
-#define V8_SRC_ZONE_ZONE_CONTAINERS_H_
+#ifndef V8_ZONE_ZONE_CONTAINERS_H_
+#define V8_ZONE_ZONE_CONTAINERS_H_
 
 #include <deque>
 #include <forward_list>
@@ -190,4 +190,4 @@ typedef ZoneVector<int> IntVector;
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_SRC_ZONE_ZONE_CONTAINERS_H_
+#endif  // V8_ZONE_ZONE_CONTAINERS_H_
diff --git a/deps/v8/src/zone/zone-handle-set.h b/deps/v8/src/zone/zone-handle-set.h
index 9abc89a30e6..c5297902d87 100644
--- a/deps/v8/src/zone/zone-handle-set.h
+++ b/deps/v8/src/zone/zone-handle-set.h
@@ -195,11 +195,13 @@ class ZoneHandleSet<T>::const_iterator {
   typedef std::forward_iterator_tag iterator_category;
   typedef std::ptrdiff_t difference_type;
   typedef Handle<T> value_type;
+  typedef value_type reference;
+  typedef value_type* pointer;
 
   const_iterator(const const_iterator& other)
       : set_(other.set_), current_(other.current_) {}
 
-  Handle<T> operator*() const { return (*set_)[current_]; }
+  reference operator*() const { return (*set_)[current_]; }
   bool operator==(const const_iterator& other) const {
     return set_ == other.set_ && current_ == other.current_;
   }
diff --git a/deps/v8/src/zone/zone.cc b/deps/v8/src/zone/zone.cc
index 470f4c4177f..c11973250c7 100644
--- a/deps/v8/src/zone/zone.cc
+++ b/deps/v8/src/zone/zone.cc
@@ -147,7 +147,7 @@ Address Zone::NewExpand(size_t size) {
   const size_t min_new_size = kSegmentOverhead + size;
   // Guard against integer overflow.
   if (new_size_no_overhead < size || new_size < kSegmentOverhead) {
-    V8::FatalProcessOutOfMemory("Zone");
+    V8::FatalProcessOutOfMemory(nullptr, "Zone");
     return nullptr;
   }
   if (segment_size_ == SegmentSize::kLarge) {
@@ -163,12 +163,12 @@ Address Zone::NewExpand(size_t size) {
     new_size = Max(min_new_size, kMaximumSegmentSize);
   }
   if (new_size > INT_MAX) {
-    V8::FatalProcessOutOfMemory("Zone");
+    V8::FatalProcessOutOfMemory(nullptr, "Zone");
     return nullptr;
   }
   Segment* segment = NewSegment(new_size);
   if (segment == nullptr) {
-    V8::FatalProcessOutOfMemory("Zone");
+    V8::FatalProcessOutOfMemory(nullptr, "Zone");
     return nullptr;
   }
 
diff --git a/deps/v8/test/BUILD.gn b/deps/v8/test/BUILD.gn
index 532a3ddaa26..c15413675e2 100644
--- a/deps/v8/test/BUILD.gn
+++ b/deps/v8/test/BUILD.gn
@@ -2,14 +2,25 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-import("../gni/isolate.gni")
 import("../gni/v8.gni")
 
 group("gn_all") {
   testonly = true
 
+  data_deps = [
+    "benchmarks:v8_benchmarks",
+    "intl:v8_intl",
+    "fuzzer:v8_fuzzer",
+    "message:v8_message",
+    "mjsunit:v8_mjsunit",
+    "mozilla:v8_mozilla",
+    "preparser:v8_preparser",
+    "test262:v8_test262",
+    "wasm-spec-tests:v8_wasm_spec_tests",
+    "webkit:v8_webkit",
+  ]
+
   deps = [
-    ":default_tests",
     "inspector:inspector-test",
     "mkgrokdump:mkgrokdump",
   ]
@@ -22,217 +33,104 @@ group("gn_all") {
       "unittests:unittests",
     ]
   }
-
-  if (v8_test_isolation_mode != "noop") {
-    deps += [
-      ":benchmarks_run",
-      ":bot_default_run",
-      ":default_run",
-      ":d8_default_run",
-      ":mozilla_run",
-      "test262:test262_run",
-    ]
-  }
 }
 
 ###############################################################################
 # Test groups
 #
 
-group("default_tests") {
+group("v8_perf") {
   testonly = true
 
-  if (v8_test_isolation_mode != "noop") {
-    deps = [
-      ":cctest_run",
-      ":debugger_run",
-      ":fuzzer_run",
-      ":inspector-test_run",
-      ":intl_run",
-      ":message_run",
-      ":mjsunit_run",
-      ":mkgrokdump_run",
-      ":preparser_run",
-      ":unittests_run",
-      ":wasm_spec_tests_run",
-    ]
-  }
-}
-
-v8_isolate_run("bot_default") {
-  deps = [
-    ":default_tests",
-    ":webkit_run",
-  ]
-
-  isolate = "bot_default.isolate"
-}
-
-v8_isolate_run("default") {
-  deps = [
-    ":default_tests",
-  ]
-
-  isolate = "default.isolate"
-}
-
-v8_isolate_run("d8_default") {
-  deps = [
-    ":debugger_run",
-    ":intl_run",
-    ":message_run",
-    ":mjsunit_run",
-    ":preparser_run",
-    ":webkit_run",
-  ]
-
-  isolate = "d8_default.isolate"
-}
-
-v8_isolate_run("optimize_for_size") {
-  deps = [
-    ":cctest_run",
-    ":inspector-test_run",
-    ":intl_run",
-    ":mjsunit_run",
-    ":webkit_run",
-  ]
-
-  isolate = "optimize_for_size.isolate"
-}
-
-v8_isolate_run("perf") {
-  deps = [
-    ":cctest_exe_run",
-    "..:d8_run",
-  ]
-
-  isolate = "perf.isolate"
-}
-
-###############################################################################
-# Subtests
-#
-
-v8_isolate_run("benchmarks") {
-  deps = [
-    "..:d8_run",
-  ]
-
-  isolate = "benchmarks/benchmarks.isolate"
-}
-
-v8_isolate_run("cctest") {
-  deps = [
-    ":cctest_exe_run",
-  ]
-
-  isolate = "cctest/cctest.isolate"
-}
-
-v8_isolate_run("cctest_exe") {
-  deps = [
+  data_deps = [
     "cctest:cctest",
+    "..:d8",
   ]
 
-  isolate = "cctest/cctest_exe.isolate"
-}
-
-v8_isolate_run("debugger") {
-  deps = [
-    "..:d8_run",
+  data = [
+    "../tools/run_perf.py",
+    # TODO(machenbach): These files are referenced by the perf runner.
+    # They should be transformed into a proper python module.
+    "../tools/testrunner/local/command.py",
+    "../tools/testrunner/local/utils.py",
+    "../tools/testrunner/objects/output.py",
+    # This is often used to trigger performance bots. We include it in the
+    # isolate to not get these builds deduped.
+    "../tools/whitespace.txt",
+    "js-perf-test/",
+    "memory/",
   ]
-
-  isolate = "debugger/debugger.isolate"
 }
 
-v8_isolate_run("fuzzer") {
-  deps = [
-    "..:v8_simple_json_fuzzer",
-    "..:v8_simple_parser_fuzzer",
-    "..:v8_simple_regexp_fuzzer",
-    "..:v8_simple_wasm_fuzzer",
-  ]
-
-  isolate = "fuzzer/fuzzer.isolate"
-}
+group("v8_bot_default") {
+  testonly = true
 
-v8_isolate_run("inspector-test") {
-  deps = [
+  data_deps = [
+    "cctest:cctest",
+    "debugger:v8_debugger",
+    "fuzzer:v8_fuzzer",
     "inspector:inspector-test",
+    "intl:v8_intl",
+    "message:v8_message",
+    "mjsunit:v8_mjsunit",
+    "mkgrokdump:mkgrokdump",
+    "preparser:v8_preparser",
+    "unittests:unittests",
+    "wasm-spec-tests:v8_wasm_spec_tests",
+    "webkit:v8_webkit",
   ]
-
-  isolate = "inspector/inspector.isolate"
-}
-
-v8_isolate_run("intl") {
-  deps = [
-    "..:d8_run",
-  ]
-
-  isolate = "intl/intl.isolate"
 }
 
-v8_isolate_run("message") {
-  deps = [
-    "..:d8_run",
-  ]
-
-  isolate = "message/message.isolate"
-}
-
-v8_isolate_run("mjsunit") {
-  deps = [
-    "..:d8_run",
-  ]
-
-  isolate = "mjsunit/mjsunit.isolate"
-}
+group("v8_default") {
+  testonly = true
 
-v8_isolate_run("mkgrokdump") {
-  deps = [
+  data_deps = [
+    "cctest:cctest",
+    "debugger:v8_debugger",
+    "fuzzer:v8_fuzzer",
+    "inspector:inspector-test",
+    "intl:v8_intl",
+    "message:v8_message",
+    "mjsunit:v8_mjsunit",
     "mkgrokdump:mkgrokdump",
+    "preparser:v8_preparser",
+    "unittests:unittests",
+    "wasm-spec-tests:v8_wasm_spec_tests",
   ]
-
-  isolate = "mkgrokdump/mkgrokdump.isolate"
 }
 
-v8_isolate_run("mozilla") {
-  deps = [
-    "..:d8_run",
-  ]
-
-  isolate = "mozilla/mozilla.isolate"
-}
+group("v8_optimize_for_size") {
+  testonly = true
 
-v8_isolate_run("preparser") {
-  deps = [
-    "..:d8_run",
+  data_deps = [
+    "cctest:cctest",
+    "debugger:v8_debugger",
+    "inspector:inspector-test",
+    "intl:v8_intl",
+    "mjsunit:v8_mjsunit",
+    "webkit:v8_webkit",
   ]
-
-  isolate = "preparser/preparser.isolate"
 }
 
-v8_isolate_run("unittests") {
-  deps = [
-    "unittests:unittests",
-  ]
-
-  isolate = "unittests/unittests.isolate"
-}
+group("v8_d8_default") {
+  testonly = true
 
-v8_isolate_run("wasm_spec_tests") {
-  deps = [
-    "..:d8_run",
+  data_deps = [
+    "debugger:v8_debugger",
+    "intl:v8_intl",
+    "message:v8_message",
+    "mjsunit:v8_mjsunit",
+    "preparser:v8_preparser",
+    "webkit:v8_webkit",
   ]
-
-  isolate = "wasm-spec-tests/wasm-spec-tests.isolate"
 }
 
-v8_isolate_run("webkit") {
-  deps = [
-    "..:d8_run",
-  ]
+group("v8_run_num_fuzzer") {
+  testonly = true
 
-  isolate = "webkit/webkit.isolate"
+  data_deps = [
+    "benchmarks:v8_benchmarks",
+    "mjsunit:v8_mjsunit",
+    "webkit:v8_webkit",
+  ]
 }
diff --git a/deps/v8/test/benchmarks/BUILD.gn b/deps/v8/test/benchmarks/BUILD.gn
new file mode 100644
index 00000000000..1fd2670e0b0
--- /dev/null
+++ b/deps/v8/test/benchmarks/BUILD.gn
@@ -0,0 +1,16 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+group("v8_benchmarks") {
+  testonly = true
+
+  data_deps = [
+    "../..:d8",
+    "../../tools:v8_testrunner",
+  ]
+
+  data = [
+    "./",
+  ]
+}
diff --git a/deps/v8/test/benchmarks/benchmarks.gyp b/deps/v8/test/benchmarks/benchmarks.gyp
deleted file mode 100644
index 0822ee4ecb7..00000000000
--- a/deps/v8/test/benchmarks/benchmarks.gyp
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'benchmarks_run',
-          'type': 'none',
-          'dependencies': [
-            '../../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../../gypfiles/features.gypi',
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'benchmarks.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/benchmarks/benchmarks.isolate b/deps/v8/test/benchmarks/benchmarks.isolate
deleted file mode 100644
index dbeca5e55cf..00000000000
--- a/deps/v8/test/benchmarks/benchmarks.isolate
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'files': [
-      './',
-    ],
-  },
-  'includes': [
-    '../../src/d8.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
\ No newline at end of file
diff --git a/deps/v8/test/benchmarks/benchmarks.status b/deps/v8/test/benchmarks/benchmarks.status
index 9db4a277d6a..53acd19be45 100644
--- a/deps/v8/test/benchmarks/benchmarks.status
+++ b/deps/v8/test/benchmarks/benchmarks.status
@@ -36,4 +36,17 @@
   'kraken/imaging-gaussian-blur': [PASS, SLOW],
   'octane/typescript': [PASS, SLOW],
 }],  # ALWAYS
+
+['variant == stress', {
+  # Too slow for stress mode.
+  'octane/mandreel': [SKIP],
+  'octane/typescript': [SKIP],
+}],
+
+['gc_fuzzer', {
+  # Too slow for gc fuzzing.
+  'octane/earley-boyer' : [PASS, SLOW, ['mode == debug', SKIP]],
+  'octane/splay': [SKIP],
+  'octane/typescript': [SKIP],
+}],  # 'gc_fuzzer'
 ]
diff --git a/deps/v8/test/benchmarks/testcfg.py b/deps/v8/test/benchmarks/testcfg.py
index fd956aa7657..dbae4e62161 100644
--- a/deps/v8/test/benchmarks/testcfg.py
+++ b/deps/v8/test/benchmarks/testcfg.py
@@ -34,17 +34,12 @@
 from testrunner.objects import testcase
 
 
-class VariantsGenerator(testsuite.VariantsGenerator):
-  def _get_variants(self, test):
-    return self._standard_variant
-
-
 class TestSuite(testsuite.TestSuite):
-  def __init__(self, name, root):
-    super(TestSuite, self).__init__(name, root)
-    self.testroot = os.path.join(root, "data")
+  def __init__(self, *args, **kwargs):
+    super(TestSuite, self).__init__(*args, **kwargs)
+    self.testroot = os.path.join(self.root, "data")
 
-  def ListTests(self, context):
+  def ListTests(self):
     tests = map(self._create_test, [
         "kraken/ai-astar",
         "kraken/audio-beat-detection",
@@ -109,15 +104,9 @@ def ListTests(self, context):
   def _test_class(self):
     return TestCase
 
-  def _variants_gen_class(self):
-    return VariantsGenerator
-
-  def _LegacyVariantsGeneratorFactory(self):
-    return testsuite.StandardLegacyVariantsGenerator
-
 
 class TestCase(testcase.TestCase):
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     path = self.path
     testroot = self.suite.testroot
     files = []
@@ -144,5 +133,5 @@ def _get_source_path(self):
     return os.path.join(self.suite.testroot, self.path + self._get_suffix())
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/bot_default.gyp b/deps/v8/test/bot_default.gyp
deleted file mode 100644
index 11223e068f3..00000000000
--- a/deps/v8/test/bot_default.gyp
+++ /dev/null
@@ -1,36 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'bot_default_run',
-          'type': 'none',
-          'dependencies': [
-            'cctest/cctest.gyp:cctest_run',
-            'debugger/debugger.gyp:debugger_run',
-            'fuzzer/fuzzer.gyp:fuzzer_run',
-            'inspector/inspector.gyp:inspector-test_run',
-            'intl/intl.gyp:intl_run',
-            'message/message.gyp:message_run',
-            'mjsunit/mjsunit.gyp:mjsunit_run',
-            'preparser/preparser.gyp:preparser_run',
-            'unittests/unittests.gyp:unittests_run',
-            'wasm-spec-tests/wasm-spec-tests.gyp:wasm_spec_tests_run',
-            'webkit/webkit.gyp:webkit_run',
-          ],
-          'includes': [
-            '../gypfiles/features.gypi',
-            '../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'bot_default.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/bot_default.isolate b/deps/v8/test/bot_default.isolate
deleted file mode 100644
index c4db291cc03..00000000000
--- a/deps/v8/test/bot_default.isolate
+++ /dev/null
@@ -1,24 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'command': [
-      '../tools/run-tests.py',
-    ],
-  },
-  'includes': [
-    'cctest/cctest.isolate',
-    'debugger/debugger.isolate',
-    'fuzzer/fuzzer.isolate',
-    'inspector/inspector.isolate',
-    'intl/intl.isolate',
-    'message/message.isolate',
-    'mjsunit/mjsunit.isolate',
-    'mkgrokdump/mkgrokdump.isolate',
-    'preparser/preparser.isolate',
-    'unittests/unittests.isolate',
-    'wasm-spec-tests/wasm-spec-tests.isolate',
-    'webkit/webkit.isolate',
-  ],
-}
diff --git a/deps/v8/test/cctest/BUILD.gn b/deps/v8/test/cctest/BUILD.gn
index b6c9109d750..d2d6cdcf254 100644
--- a/deps/v8/test/cctest/BUILD.gn
+++ b/deps/v8/test/cctest/BUILD.gn
@@ -9,6 +9,17 @@ v8_executable("cctest") {
   deps = [
     ":cctest_sources",
   ]
+
+  data_deps = [
+    "../../tools:v8_testrunner",
+  ]
+
+  data = [
+    "testcfg.py",
+    "cctest.status",
+    "interpreter/bytecode_expectations/",
+  ]
+
   configs = [
     "../..:external_config",
     "../..:internal_config_base",
@@ -58,6 +69,7 @@ v8_source_set("cctest_sources") {
     "compiler/test-code-generator.cc",
     "compiler/test-gap-resolver.cc",
     "compiler/test-graph-visualizer.cc",
+    "compiler/test-instruction-scheduler.cc",
     "compiler/test-instruction.cc",
     "compiler/test-js-constant-cache.cc",
     "compiler/test-js-context-specialization.cc",
@@ -113,6 +125,7 @@ v8_source_set("cctest_sources") {
     "heap/test-mark-compact.cc",
     "heap/test-page-promotion.cc",
     "heap/test-spaces.cc",
+    "heap/test-weak-references.cc",
     "interpreter/bytecode-expectations-printer.cc",
     "interpreter/bytecode-expectations-printer.h",
     "interpreter/interpreter-tester.cc",
@@ -180,6 +193,7 @@ v8_source_set("cctest_sources") {
     "test-identity-map.cc",
     "test-inobject-slack-tracking.cc",
     "test-intl.cc",
+    "test-isolate-independent-builtins.cc",
     "test-liveedit.cc",
     "test-lockers.cc",
     "test-log.cc",
@@ -227,6 +241,7 @@ v8_source_set("cctest_sources") {
     "wasm/test-run-wasm-js.cc",
     "wasm/test-run-wasm-module.cc",
     "wasm/test-run-wasm-relocation.cc",
+    "wasm/test-run-wasm-sign-extension.cc",
     "wasm/test-run-wasm-simd.cc",
     "wasm/test-run-wasm.cc",
     "wasm/test-streaming-compilation.cc",
@@ -235,6 +250,7 @@ v8_source_set("cctest_sources") {
     "wasm/test-wasm-interpreter-entry.cc",
     "wasm/test-wasm-stack.cc",
     "wasm/test-wasm-trap-position.cc",
+    "wasm/wasm-atomics-utils.h",
     "wasm/wasm-run-utils.cc",
     "wasm/wasm-run-utils.h",
   ]
@@ -335,6 +351,7 @@ v8_source_set("cctest_sources") {
       "test-log-stack-tracer.cc",
       "test-macro-assembler-x64.cc",
       "test-run-wasm-relocation-x64.cc",
+      "wasm/test-run-wasm-atomics64.cc",
     ]
   } else if (v8_current_cpu == "ppc" || v8_current_cpu == "ppc64") {
     sources += [  ### gcmole(arch:ppc) ###
diff --git a/deps/v8/test/cctest/OWNERS b/deps/v8/test/cctest/OWNERS
index a5bb7db64ab..87396a0535e 100644
--- a/deps/v8/test/cctest/OWNERS
+++ b/deps/v8/test/cctest/OWNERS
@@ -1,5 +1,6 @@
 per-file *-mips*=ivica.bogosavljevic@mips.com
 per-file *-mips*=Miran.Karic@mips.com
+per-file *-mips*=sreten.kovacevic@mips.com
 per-file *-ppc*=dstence@us.ibm.com
 per-file *-ppc*=joransiu@ca.ibm.com
 per-file *-ppc*=jyan@ca.ibm.com
diff --git a/deps/v8/test/cctest/cctest.cc b/deps/v8/test/cctest/cctest.cc
index 5daef0425bb..0919f39efe7 100644
--- a/deps/v8/test/cctest/cctest.cc
+++ b/deps/v8/test/cctest/cctest.cc
@@ -269,8 +269,9 @@ int main(int argc, char* argv[]) {
   v8::V8::Initialize();
   v8::V8::InitializeExternalStartupData(argv[0]);
 
-  if (i::trap_handler::IsTrapHandlerEnabled()) {
-    v8::V8::RegisterDefaultSignalHandler();
+  if (V8_TRAP_HANDLER_SUPPORTED && i::FLAG_wasm_trap_handler) {
+    constexpr bool use_default_signal_handler = true;
+    CHECK(v8::V8::EnableWebAssemblyTrapHandler(use_default_signal_handler));
   }
 
   CcTest::set_array_buffer_allocator(
diff --git a/deps/v8/test/cctest/cctest.gyp b/deps/v8/test/cctest/cctest.gyp
deleted file mode 100644
index 5124495ee85..00000000000
--- a/deps/v8/test/cctest/cctest.gyp
+++ /dev/null
@@ -1,523 +0,0 @@
-# Copyright 2012 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-# The sources are kept automatically in sync with BUILD.gn.
-
-{
-  'variables': {
-    'v8_code': 1,
-    'generated_file': '<(SHARED_INTERMEDIATE_DIR)/resources.cc',
-    'cctest_sources': [  ### gcmole(all) ###
-      'compiler/c-signature.h',
-      'compiler/call-tester.h',
-      'compiler/codegen-tester.cc',
-      'compiler/codegen-tester.h',
-      'compiler/code-assembler-tester.h',
-      'compiler/function-tester.cc',
-      'compiler/function-tester.h',
-      'compiler/graph-builder-tester.h',
-      'compiler/test-basic-block-profiler.cc',
-      'compiler/test-branch-combine.cc',
-      'compiler/test-run-unwinding-info.cc',
-      'compiler/test-gap-resolver.cc',
-      'compiler/test-graph-visualizer.cc',
-      'compiler/test-code-generator.cc',
-      'compiler/test-code-assembler.cc',
-      'compiler/test-instruction.cc',
-      'compiler/test-js-context-specialization.cc',
-      'compiler/test-js-constant-cache.cc',
-      'compiler/test-js-typed-lowering.cc',
-      'compiler/test-jump-threading.cc',
-      'compiler/test-linkage.cc',
-      'compiler/test-loop-analysis.cc',
-      'compiler/test-machine-operator-reducer.cc',
-      'compiler/test-multiple-return.cc',
-      'compiler/test-node.cc',
-      'compiler/test-operator.cc',
-      'compiler/test-representation-change.cc',
-      'compiler/test-run-bytecode-graph-builder.cc',
-      'compiler/test-run-calls-to-external-references.cc',
-      'compiler/test-run-deopt.cc',
-      'compiler/test-run-intrinsics.cc',
-      'compiler/test-run-jsbranches.cc',
-      'compiler/test-run-jscalls.cc',
-      'compiler/test-run-jsexceptions.cc',
-      'compiler/test-run-jsobjects.cc',
-      'compiler/test-run-jsops.cc',
-      'compiler/test-run-load-store.cc',
-      'compiler/test-run-machops.cc',
-      'compiler/test-run-native-calls.cc',
-      'compiler/test-run-retpoline.cc',
-      'compiler/test-run-stackcheck.cc',
-      'compiler/test-run-stubs.cc',
-      'compiler/test-run-tail-calls.cc',
-      'compiler/test-run-variables.cc',
-      'compiler/test-run-wasm-machops.cc',
-      'compiler/value-helper.cc',
-      'compiler/value-helper.h',
-      'cctest.cc',
-      'cctest.h',
-      'expression-type-collector-macros.h',
-      'gay-fixed.cc',
-      'gay-fixed.h',
-      'gay-precision.cc',
-      'gay-precision.h',
-      'gay-shortest.cc',
-      'gay-shortest.h',
-      'heap/heap-tester.h',
-      'heap/heap-utils.cc',
-      'heap/heap-utils.h',
-      'heap/test-alloc.cc',
-      'heap/test-array-buffer-tracker.cc',
-      'heap/test-compaction.cc',
-      'heap/test-concurrent-marking.cc',
-      'heap/test-embedder-tracing.cc',
-      'heap/test-heap.cc',
-      'heap/test-incremental-marking.cc',
-      'heap/test-invalidated-slots.cc',
-      'heap/test-lab.cc',
-      'heap/test-mark-compact.cc',
-      'heap/test-page-promotion.cc',
-      'heap/test-spaces.cc',
-      'interpreter/interpreter-tester.cc',
-      'interpreter/interpreter-tester.h',
-      'interpreter/source-position-matcher.cc',
-      'interpreter/source-position-matcher.h',
-      'interpreter/test-bytecode-generator.cc',
-      'interpreter/test-interpreter.cc',
-      'interpreter/test-interpreter-intrinsics.cc',
-      'interpreter/test-source-positions.cc',
-      'interpreter/bytecode-expectations-printer.cc',
-      'interpreter/bytecode-expectations-printer.h',
-      'libplatform/test-tracing.cc',
-      'libsampler/test-sampler.cc',
-      'parsing/test-parse-decision.cc',
-      'parsing/test-preparser.cc',
-      'parsing/test-scanner-streams.cc',
-      'parsing/test-scanner.cc',
-      'print-extension.cc',
-      'print-extension.h',
-      'profiler-extension.cc',
-      'profiler-extension.h',
-      'scope-test-helper.h',
-      'setup-isolate-for-tests.cc',
-      'setup-isolate-for-tests.h',
-      'test-access-checks.cc',
-      'test-accessor-assembler.cc',
-      'test-accessors.cc',
-      'test-allocation.cc',
-      'test-api.cc',
-      'test-api.h',
-      'test-api-accessors.cc',
-      'test-api-interceptors.cc',
-      'test-array-list.cc',
-      'test-atomicops.cc',
-      'test-bignum.cc',
-      'test-bignum-dtoa.cc',
-      'test-bit-vector.cc',
-      'test-circular-queue.cc',
-      'test-code-layout.cc',
-      'test-code-stub-assembler.cc',
-      'test-compiler.cc',
-      'test-constantpool.cc',
-      'test-conversions.cc',
-      'test-cpu-profiler.cc',
-      'test-date.cc',
-      'test-debug.cc',
-      'test-decls.cc',
-      'test-deoptimization.cc',
-      'test-dictionary.cc',
-      'test-diy-fp.cc',
-      'test-double.cc',
-      'test-dtoa.cc',
-      'test-elements-kind.cc',
-      'test-fast-dtoa.cc',
-      'test-feedback-vector.cc',
-      'test-feedback-vector.h',
-      'test-field-type-tracking.cc',
-      'test-fixed-dtoa.cc',
-      'test-flags.cc',
-      'test-func-name-inference.cc',
-      'test-global-handles.cc',
-      'test-global-object.cc',
-      'test-hashcode.cc',
-      'test-hashmap.cc',
-      'test-heap-profiler.cc',
-      'test-identity-map.cc',
-      'test-intl.cc',
-      'test-inobject-slack-tracking.cc',
-      'test-liveedit.cc',
-      'test-lockers.cc',
-      'test-log.cc',
-      'test-managed.cc',
-      'test-mementos.cc',
-      'test-modules.cc',
-      'test-object.cc',
-      'test-orderedhashtable.cc',
-      'test-parsing.cc',
-      'test-platform.cc',
-      'test-profile-generator.cc',
-      'test-random-number-generator.cc',
-      'test-regexp.cc',
-      'test-representation.cc',
-      'test-sampler-api.cc',
-      'test-serialize.cc',
-      'test-strings.cc',
-      'test-symbols.cc',
-      'test-strtod.cc',
-      'test-thread-termination.cc',
-      'test-threads.cc',
-      'test-trace-event.cc',
-      'test-traced-value.cc',
-      'test-transitions.cc',
-      'test-transitions.h',
-      'test-typedarrays.cc',
-      'test-types.cc',
-      'test-unbound-queue.cc',
-      'test-unboxed-doubles.cc',
-      'test-unscopables-hidden-prototype.cc',
-      'test-usecounters.cc',
-      'test-utils.cc',
-      'test-version.cc',
-      'test-weakmaps.cc',
-      'test-weaksets.cc',
-      'trace-extension.cc',
-      'trace-extension.h',
-      'types-fuzz.h',
-      'unicode-helpers.h',
-      'wasm/test-c-wasm-entry.cc',
-      'wasm/test-streaming-compilation.cc',
-      'wasm/test-run-wasm.cc',
-      'wasm/test-run-wasm-64.cc',
-      'wasm/test-run-wasm-asmjs.cc',
-      'wasm/test-run-wasm-atomics.cc',
-      'wasm/test-run-wasm-interpreter.cc',
-      'wasm/test-run-wasm-js.cc',
-      'wasm/test-run-wasm-module.cc',
-      'wasm/test-run-wasm-relocation.cc',
-      'wasm/test-run-wasm-simd.cc',
-      'wasm/test-wasm-breakpoints.cc',
-      "wasm/test-wasm-codegen.cc",
-      'wasm/test-wasm-interpreter-entry.cc',
-      'wasm/test-wasm-stack.cc',
-      'wasm/test-wasm-trap-position.cc',
-      'wasm/wasm-run-utils.cc',
-      'wasm/wasm-run-utils.h',
-    ],
-    'cctest_sources_ia32': [  ### gcmole(arch:ia32) ###
-      'test-assembler-ia32.cc',
-      'test-code-stubs.cc',
-      'test-code-stubs.h',
-      'test-code-stubs-ia32.cc',
-      'test-disasm-ia32.cc',
-      'test-log-stack-tracer.cc',
-      'test-run-wasm-relocation-ia32.cc',
-    ],
-    'cctest_sources_x64': [  ### gcmole(arch:x64) ###
-      'test-assembler-x64.cc',
-      'test-code-stubs.cc',
-      'test-code-stubs.h',
-      'test-code-stubs-x64.cc',
-      'test-disasm-x64.cc',
-      'test-macro-assembler-x64.cc',
-      'test-log-stack-tracer.cc',
-      'test-run-wasm-relocation-x64.cc',
-    ],
-    'cctest_sources_arm': [  ### gcmole(arch:arm) ###
-      'assembler-helper-arm.cc',
-      'assembler-helper-arm.h',
-      'test-assembler-arm.cc',
-      'test-code-stubs.cc',
-      'test-code-stubs.h',
-      'test-code-stubs-arm.cc',
-      'test-disasm-arm.cc',
-      'test-macro-assembler-arm.cc',
-      'test-run-wasm-relocation-arm.cc',
-      'test-sync-primitives-arm.cc',
-    ],
-    'cctest_sources_arm64': [  ### gcmole(arch:arm64) ###
-      'test-utils-arm64.cc',
-      'test-utils-arm64.h',
-      'test-assembler-arm64.cc',
-      'test-code-stubs.cc',
-      'test-code-stubs.h',
-      'test-code-stubs-arm64.cc',
-      'test-disasm-arm64.cc',
-      'test-fuzz-arm64.cc',
-      'test-javascript-arm64.cc',
-      'test-js-arm64-variables.cc',
-      'test-run-wasm-relocation-arm64.cc',
-      'test-sync-primitives-arm64.cc',
-    ],
-    'cctest_sources_s390': [  ### gcmole(arch:s390) ###
-      'test-assembler-s390.cc',
-      'test-code-stubs.cc',
-      'test-code-stubs.h',
-      'test-disasm-s390.cc',
-    ],
-    'cctest_sources_ppc': [  ### gcmole(arch:ppc) ###
-      'test-assembler-ppc.cc',
-      'test-code-stubs.cc',
-      'test-code-stubs.h',
-      'test-disasm-ppc.cc',
-    ],
-    'cctest_sources_mips': [  ### gcmole(arch:mips) ###
-      'test-assembler-mips.cc',
-      'test-code-stubs.cc',
-      'test-code-stubs.h',
-      'test-code-stubs-mips.cc',
-      'test-disasm-mips.cc',
-      'test-macro-assembler-mips.cc',
-    ],
-    'cctest_sources_mipsel': [  ### gcmole(arch:mipsel) ###
-      'test-assembler-mips.cc',
-      'test-code-stubs.cc',
-      'test-code-stubs.h',
-      'test-code-stubs-mips.cc',
-      'test-disasm-mips.cc',
-      'test-macro-assembler-mips.cc',
-    ],
-    'cctest_sources_mips64': [  ### gcmole(arch:mips64) ###
-      'test-assembler-mips64.cc',
-      'test-code-stubs.cc',
-      'test-code-stubs.h',
-      'test-code-stubs-mips64.cc',
-      'test-disasm-mips64.cc',
-      'test-macro-assembler-mips64.cc',
-    ],
-    'cctest_sources_mips64el': [  ### gcmole(arch:mips64el) ###
-      'test-assembler-mips64.cc',
-      'test-code-stubs.cc',
-      'test-code-stubs.h',
-      'test-code-stubs-mips64.cc',
-      'test-disasm-mips64.cc',
-      'test-macro-assembler-mips64.cc',
-    ],
-  },
-  'includes': ['../../gypfiles/toolchain.gypi', '../../gypfiles/features.gypi'],
-  'targets': [
-    {
-      'target_name': 'cctest',
-      'type': 'executable',
-      'dependencies': [
-        'resources',
-        '../../src/v8.gyp:v8_libbase',
-        '../../src/v8.gyp:v8_libplatform',
-      ],
-      'include_dirs': [
-        '../..',
-      ],
-      'sources': [
-        '../common/wasm/flag-utils.h',
-        '../common/wasm/test-signatures.h',
-        '../common/wasm/wasm-macro-gen.h',
-        '../common/wasm/wasm-module-runner.cc',
-        '../common/wasm/wasm-module-runner.h',
-        '<@(cctest_sources)',
-        '<(generated_file)',
-      ],
-      'conditions': [
-        ['v8_target_arch=="ia32"', {
-          'sources': [
-            '<@(cctest_sources_ia32)',
-          ],
-        }],
-        ['v8_target_arch=="x64"', {
-          'sources': [
-            '<@(cctest_sources_x64)',
-          ],
-        }],
-        ['v8_target_arch=="arm"', {
-          'sources': [
-            '<@(cctest_sources_arm)',
-          ],
-        }],
-        ['v8_target_arch=="arm64"', {
-          'sources': [
-            '<@(cctest_sources_arm64)',
-          ],
-        }],
-        ['v8_target_arch=="s390"', {
-          'sources': [
-            '<@(cctest_sources_s390)',
-          ],
-        }],
-        ['v8_target_arch=="s390x"', {
-          'sources': [
-            '<@(cctest_sources_s390)',
-          ],
-        }],
-        ['v8_target_arch=="ppc"', {
-          'sources': [
-            '<@(cctest_sources_ppc)',
-          ],
-        }],
-        ['v8_target_arch=="ppc64"', {
-          'sources': [
-            '<@(cctest_sources_ppc)',
-          ],
-        }],
-        ['v8_target_arch=="mips"', {
-          'sources': [
-            '<@(cctest_sources_mips)',
-          ],
-        }],
-        ['v8_target_arch=="mipsel"', {
-          'sources': [
-            '<@(cctest_sources_mipsel)',
-          ],
-        }],
-        ['v8_target_arch=="mips64"', {
-          'sources': [
-            '<@(cctest_sources_mips64)',
-          ],
-        }],
-        ['v8_target_arch=="mips64el"', {
-          'sources': [
-            '<@(cctest_sources_mips64el)',
-          ],
-        }],
-        [ 'OS=="win"', {
-          'msvs_settings': {
-            'VCCLCompilerTool': {
-              # MSVS wants this for gay-{precision,shortest}.cc.
-              'AdditionalOptions': ['/bigobj'],
-            },
-          },
-        }],
-        ['v8_target_arch=="ppc" or v8_target_arch=="ppc64" \
-          or v8_target_arch=="arm" or v8_target_arch=="arm64" \
-          or v8_target_arch=="s390" or v8_target_arch=="s390x" \
-          or v8_target_arch=="mips" or v8_target_arch=="mips64" \
-          or v8_target_arch=="mipsel" or v8_target_arch=="mips64el"', {
-          # disable fmadd/fmsub so that expected results match generated code in
-          # RunFloat64MulAndFloat64Add1 and friends.
-          'cflags': ['-ffp-contract=off'],
-        }],
-        ['OS=="aix"', {
-          'ldflags': [ '-Wl,-bbigtoc' ],
-        }],
-        ['component=="shared_library"', {
-          # cctest can't be built against a shared library, so we need to
-          # depend on the underlying static target in that case.
-          'dependencies': ['../../src/v8.gyp:v8_maybe_snapshot'],
-          'defines': [ 'BUILDING_V8_SHARED', ]
-        }, {
-          'dependencies': ['../../src/v8.gyp:v8'],
-        }],
-        ['v8_use_snapshot=="true"', {
-          'dependencies': ['../../src/v8.gyp:v8_initializers'],
-        }],
-      ],
-    },
-    {
-      'target_name': 'resources',
-      'type': 'none',
-      'variables': {
-        'file_list': [
-           '../../tools/splaytree.js',
-           '../../tools/codemap.js',
-           '../../tools/csvparser.js',
-           '../../tools/consarray.js',
-           '../../tools/profile.js',
-           '../../tools/profile_view.js',
-           '../../tools/arguments.js',
-           '../../tools/logreader.js',
-           'log-eq-of-logging-and-traversal.js',
-        ],
-      },
-      'actions': [
-        {
-          'action_name': 'js2c',
-          'inputs': [
-            '../../tools/js2c.py',
-            '<@(file_list)',
-          ],
-          'outputs': [
-            '<(generated_file)',
-          ],
-          'action': [
-            'python',
-            '../../tools/js2c.py',
-            '<@(_outputs)',
-            'TEST',  # type
-            '<@(file_list)',
-          ],
-        }
-      ],
-    },
-    {
-      'target_name': 'generate-bytecode-expectations',
-      'type': 'executable',
-      'dependencies': [
-        '../../src/v8.gyp:v8',
-        '../../src/v8.gyp:v8_libbase',
-        '../../src/v8.gyp:v8_libplatform',
-      ],
-      'include_dirs+': [
-        '../..',
-      ],
-      'sources': [
-        'interpreter/bytecode-expectations-printer.cc',
-        'interpreter/bytecode-expectations-printer.h',
-        'interpreter/generate-bytecode-expectations.cc',
-      ],
-    },
-  ],
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'cctest_exe_run',
-          'type': 'none',
-          'dependencies': [
-            'cctest',
-          ],
-          'includes': [
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'cctest_exe.isolate',
-          ],
-        },
-        {
-          'target_name': 'cctest_run',
-          'type': 'none',
-          'dependencies': [
-            'cctest_exe_run',
-          ],
-          'includes': [
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'cctest.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/cctest/cctest.h b/deps/v8/test/cctest/cctest.h
index 37c4c0cfac4..31f8ba9e390 100644
--- a/deps/v8/test/cctest/cctest.h
+++ b/deps/v8/test/cctest/cctest.h
@@ -454,25 +454,6 @@ static inline v8::Local<v8::Value> CompileRun(
 }
 
 
-static inline v8::Local<v8::Value> ParserCacheCompileRun(const char* source) {
-  // Compile once just to get the preparse data, then compile the second time
-  // using the data.
-  v8::Isolate* isolate = v8::Isolate::GetCurrent();
-  v8::Local<v8::Context> context = isolate->GetCurrentContext();
-  v8::ScriptCompiler::Source script_source(v8_str(source));
-  v8::ScriptCompiler::Compile(context, &script_source,
-                              v8::ScriptCompiler::kProduceParserCache)
-      .ToLocalChecked();
-
-  // Check whether we received cached data, and if so use it.
-  v8::ScriptCompiler::CompileOptions options =
-      script_source.GetCachedData() ? v8::ScriptCompiler::kConsumeParserCache
-                                    : v8::ScriptCompiler::kNoCompileOptions;
-
-  return CompileRun(context, &script_source, options);
-}
-
-
 // Helper functions that compile and run the source with given origin.
 static inline v8::Local<v8::Value> CompileRunWithOrigin(const char* source,
                                                         const char* origin_url,
@@ -587,6 +568,13 @@ static inline void MakeAssemblerBufferExecutable(uint8_t* buffer,
   CHECK(result);
 }
 
+static inline void MakeAssemblerBufferWritable(uint8_t* buffer,
+                                               size_t allocated) {
+  bool result = v8::internal::SetPermissions(buffer, allocated,
+                                             v8::PageAllocator::kReadWrite);
+  CHECK(result);
+}
+
 static v8::debug::DebugDelegate dummy_delegate;
 
 static inline void EnableDebugger(v8::Isolate* isolate) {
@@ -697,14 +685,13 @@ class TestPlatform : public v8::Platform {
     return old_platform_->GetForegroundTaskRunner(isolate);
   }
 
-  std::shared_ptr<v8::TaskRunner> GetBackgroundTaskRunner(
+  std::shared_ptr<v8::TaskRunner> GetWorkerThreadsTaskRunner(
       v8::Isolate* isolate) override {
-    return old_platform_->GetBackgroundTaskRunner(isolate);
+    return old_platform_->GetWorkerThreadsTaskRunner(isolate);
   }
 
-  void CallOnBackgroundThread(v8::Task* task,
-                              ExpectedRuntime expected_runtime) override {
-    old_platform_->CallOnBackgroundThread(task, expected_runtime);
+  void CallOnWorkerThread(std::unique_ptr<v8::Task> task) override {
+    old_platform_->CallOnWorkerThread(std::move(task));
   }
 
   void CallOnForegroundThread(v8::Isolate* isolate, v8::Task* task) override {
diff --git a/deps/v8/test/cctest/cctest.isolate b/deps/v8/test/cctest/cctest.isolate
deleted file mode 100644
index dd03ab8384a..00000000000
--- a/deps/v8/test/cctest/cctest.isolate
+++ /dev/null
@@ -1,16 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'files': [
-      './cctest.status',
-      './testcfg.py',
-      './interpreter/bytecode_expectations/',
-    ],
-  },
-  'includes': [
-    'cctest_exe.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
diff --git a/deps/v8/test/cctest/cctest.status b/deps/v8/test/cctest/cctest.status
index 2840bccf8c8..a010f84e9a7 100644
--- a/deps/v8/test/cctest/cctest.status
+++ b/deps/v8/test/cctest/cctest.status
@@ -85,6 +85,7 @@
   'test-cpu-profiler/JsNativeJsSample': [SKIP],
   'test-cpu-profiler/NativeAccessorUninitializedIC': [SKIP],
   'test-cpu-profiler/SampleWhenFrameIsNotSetup': [SKIP],
+  'test-cpu-profiler/TracingCpuProfiler': [SKIP],
   'test-sampler/LibSamplerCollectSample': [SKIP],
 
   # BUG(7202). The test is flaky.
@@ -123,6 +124,15 @@
   'test-serialize/CustomSnapshotDataBlobImmortalImmovableRoots': [PASS, ['mode == debug', SKIP]],
   'test-parsing/ObjectRestNegativeTestSlow': [PASS, ['mode == debug', SKIP]],
 
+  # Temporary for https://crrev.com/c/947969 until https://crrev.com/c/950775
+  # lands. Tests build a new snapshot, in which the constants list doesn't
+  # match what's expected by embedded builtins. This will become irrelevant
+  # once the serialization process changes to pack trampolines into the
+  # snapshot iff explicitly requested.
+  'test-serialize/StartupSerializerOnce': [SKIP],
+  'test-serialize/StartupSerializerTwice': [SKIP],
+  'test-serialize/StartupSerializerOnceRunScript': [SKIP],
+  'test-serialize/StartupSerializerTwiceRunScript': [SKIP],
 }],  # ALWAYS
 
 ##############################################################################
@@ -172,10 +182,6 @@
 ['arch == s390 or arch == s390x or arch == ppc or arch == ppc64', {
   'test-multiple-return/*': [SKIP],
 }],
-# TODO(ahaas): Port multiple return values to ARM, MIPS, S390 and PPC
-['arch == mips or arch == mips64 or arch == mipsel or arch == mips64el or arch == s390 or arch == s390x or arch == ppc or arch == ppc64', {
-  'test-multiple-return/ReturnLastValue*': [SKIP],
-}],
 ##############################################################################
 ['asan == True', {
   # Skip tests not suitable for ASAN.
@@ -183,6 +189,9 @@
 
   # BUG(v8:5193): Flaky.
   'test-cpu-profiler/TickEvents': [SKIP],
+
+  # BUG(v8:7587): Strange breakage on Mac.
+  'test-log-stack-tracer/PureJSStackTrace': [SKIP],
 }],  # 'asan == True'
 
 ##############################################################################
@@ -197,9 +206,6 @@
   'test-cpu-profiler/TickEvents': [SKIP],
   # BUG(v8:6924). The test allocates a lot of memory.
   'test-api/NewStringRangeError': [PASS, NO_VARIANTS],
-
-  # BUG(chromium:794911).
-  'test-cpu-profiler/TracingCpuProfiler': [SKIP],
 }],  # 'tsan == True'
 
 ##############################################################################
@@ -237,10 +243,6 @@
 
 ##############################################################################
 ['system == windows', {
-
-  # BUG(3331). Fails on windows.
-  'test-heap/NoWeakHashTableLeakWithIncrementalMarking': [SKIP],
-
   # BUG(v8:4573).
   'test-api/MultipleIsolatesOnIndividualThreads': [PASS, NO_VARIANTS],
 
@@ -295,6 +297,11 @@
   'test-serialize/StartupSerializerTwiceRunScript': [SKIP],
 }],  # 'arch == mipsel or arch == mips'
 
+['(arch == mipsel or arch == mips64el or arch == mips or arch == mips64)', {
+  # Instruction scheduler not supported on MIPS.
+  'test-instruction-scheduler/DeoptInMiddleOfBasicBlock': [SKIP]
+}],  # 'arch == mipsel or arch == mips64el or arch == mips or arch == mips64'
+
 ##############################################################################
 ['arch == mips', {
   # Too slow with TF.
@@ -306,6 +313,13 @@
   'test-api/Threading6': [SKIP],
 }],  # 'arch == mips'
 
+##############################################################################
+['arch == mips or arch == mips64', {
+   # TODO(mips-team): Implement LiftOff on big-endian
+   'test-run-wasm/RunWasmLiftoff*': [SKIP],
+   'test-run-wasm-64/RunWasmLiftoff*': [SKIP],
+}],  # 'arch == mips or arch == mips64'
+
 ##############################################################################
 ['arch == mips64el or arch == mips64', {
   # BUG(v8:3154).
@@ -322,12 +336,69 @@
 }],  # 'arch == mips64el or arch == mips64'
 
 ##############################################################################
-['arch == mips or arch == mipsel or arch == mips64 or arch == mips64el', {
-  # For now skip wasm SIMD tests that fail when MSA instr. extension is not
-  # available (currently simd-scalar-lowering mechanism doesn't work properly
-  # for all SIMD operations)
-  'test-run-wasm-simd/*': [SKIP],
-}],  # 'arch == mips or arch == mipsel or arch == mips64 or arch == mips64el'
+['(arch == mipsel or arch == mips64el or arch == mips or arch == mips64) and not simd_mips', {
+  # Skip tests that fail on MIPS architectures which don't support SIMD,
+  # because lowering mechanism doesn't work properly
+  'test-run-wasm-simd/RunWasm_F32x4RecipApprox_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_F32x4RecipSqrtApprox_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_I32x4ConvertI16x8_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_I16x8ConvertI8x16_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_I16x8ConvertI32x4_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_I8x16ConvertI16x8_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4Select_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8Select_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16Select_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4NonCanonicalSelect_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8NonCanonicalSelect_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16NonCanonicalSelect_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_I16x8AddHoriz_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_F32x4AddHoriz_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4Dup_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4ZipLeft_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4ZipRight_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4UnzipLeft_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4UnzipRight_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4TransposeLeft_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4TransposeRight_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x2Reverse_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4Irregular_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8Dup_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8ZipLeft_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8ZipRight_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8UnzipLeft_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8UnzipRight_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8TransposeLeft_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8TransposeRight_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x4Reverse_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x2Reverse_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8Irregular_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16Dup_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16ZipLeft_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16ZipRight_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16UnzipLeft_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16UnzipRight_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16TransposeLeft_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16TransposeRight_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x8Reverse_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x4Reverse_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x2Reverse_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16Irregular_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16Concat_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_ReductionTest4_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_ReductionTest8_compiled': [SKIP],
+  'test-run-wasm-simd/RunWasm_ReductionTest16_compiled': [SKIP],
+}],  # '(arch == mipsel or arch == mips64el or arch == mips or arch == mips64) and not simd_mips'
+
+##############################################################################
+['mips_arch_variant == r6', {
+  # For MIPS[64] architecture release 6, fusion multiply-accumulate instructions
+  # will cause failures on several tests that expect exact floating-point
+  # results.
+  'test-run-machops/RunFloat64MulAndFloat64Add1': [SKIP],
+  'test-run-machops/RunFloat64MulAndFloat64Add2': [SKIP],
+  'test-run-machops/RunFloat64MulAndFloat64Sub1': [SKIP],
+  'test-run-machops/RunFloat64MulAndFloat64Sub2': [SKIP],
+}],  # 'mips_arch_variant == r6'
 
 ##############################################################################
 ['arch == android_arm or arch == android_ia32', {
diff --git a/deps/v8/test/cctest/cctest_exe.isolate b/deps/v8/test/cctest/cctest_exe.isolate
deleted file mode 100644
index da5327846e7..00000000000
--- a/deps/v8/test/cctest/cctest_exe.isolate
+++ /dev/null
@@ -1,13 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'files': [
-      '<(PRODUCT_DIR)/cctest<(EXECUTABLE_SUFFIX)',
-    ],
-  },
-  'includes': [
-    '../../src/base.isolate',
-  ],
-}
diff --git a/deps/v8/test/cctest/compiler/code-assembler-tester.h b/deps/v8/test/cctest/compiler/code-assembler-tester.h
index 20029809b49..c8284d2d479 100644
--- a/deps/v8/test/cctest/compiler/code-assembler-tester.h
+++ b/deps/v8/test/cctest/compiler/code-assembler-tester.h
@@ -22,25 +22,29 @@ class CodeAssemblerTester {
   explicit CodeAssemblerTester(Isolate* isolate)
       : zone_(isolate->allocator(), ZONE_NAME),
         scope_(isolate),
-        state_(isolate, &zone_, VoidDescriptor(isolate), Code::STUB, "test") {}
+        state_(isolate, &zone_, VoidDescriptor(isolate), Code::STUB, "test",
+               PoisoningMitigationLevel::kOff) {}
 
   // Test generating code for a JS function (e.g. builtins).
   CodeAssemblerTester(Isolate* isolate, int parameter_count,
                       Code::Kind kind = Code::BUILTIN)
       : zone_(isolate->allocator(), ZONE_NAME),
         scope_(isolate),
-        state_(isolate, &zone_, parameter_count, kind, "test") {}
+        state_(isolate, &zone_, parameter_count, kind, "test",
+               PoisoningMitigationLevel::kOff) {}
 
   CodeAssemblerTester(Isolate* isolate, Code::Kind kind)
       : zone_(isolate->allocator(), ZONE_NAME),
         scope_(isolate),
-        state_(isolate, &zone_, 0, kind, "test") {}
+        state_(isolate, &zone_, 0, kind, "test",
+               PoisoningMitigationLevel::kOff) {}
 
   CodeAssemblerTester(Isolate* isolate, CallDescriptor* call_descriptor,
                       const char* name = "test")
       : zone_(isolate->allocator(), ZONE_NAME),
         scope_(isolate),
-        state_(isolate, &zone_, call_descriptor, Code::STUB, name, 0, -1) {}
+        state_(isolate, &zone_, call_descriptor, Code::STUB, name,
+               PoisoningMitigationLevel::kOff, 0, -1) {}
 
   CodeAssemblerState* state() { return &state_; }
 
diff --git a/deps/v8/test/cctest/compiler/codegen-tester.h b/deps/v8/test/cctest/compiler/codegen-tester.h
index 7e7e4be0b19..b44c9fca3e9 100644
--- a/deps/v8/test/cctest/compiler/codegen-tester.h
+++ b/deps/v8/test/cctest/compiler/codegen-tester.h
@@ -62,7 +62,7 @@ class RawMachineAssemblerTester : public HandleAndZoneScope,
   virtual byte* Generate() {
     if (code_.is_null()) {
       Schedule* schedule = this->Export();
-      CallDescriptor* call_descriptor = this->call_descriptor();
+      auto call_descriptor = this->call_descriptor();
       Graph* graph = this->graph();
       CompilationInfo info(ArrayVector("testing"), main_zone(), Code::STUB);
       code_ = Pipeline::GenerateCodeForTesting(
diff --git a/deps/v8/test/cctest/compiler/function-tester.cc b/deps/v8/test/cctest/compiler/function-tester.cc
index 2455d9f5b92..db50fa7f1ca 100644
--- a/deps/v8/test/cctest/compiler/function-tester.cc
+++ b/deps/v8/test/cctest/compiler/function-tester.cc
@@ -5,7 +5,6 @@
 #include "test/cctest/compiler/function-tester.h"
 
 #include "src/api.h"
-#include "src/ast/ast-numbering.h"
 #include "src/compilation-info.h"
 #include "src/compiler.h"
 #include "src/compiler/linkage.h"
@@ -150,7 +149,7 @@ Handle<JSFunction> FunctionTester::Compile(Handle<JSFunction> function) {
   CHECK(function->is_compiled() ||
         Compiler::Compile(function, Compiler::CLEAR_EXCEPTION));
   CHECK(info.shared_info()->HasBytecodeArray());
-  JSFunction::EnsureLiterals(function);
+  JSFunction::EnsureFeedbackVector(function);
 
   Handle<Code> code =
       Pipeline::GenerateCodeForTesting(&info, function->GetIsolate());
diff --git a/deps/v8/test/cctest/compiler/graph-builder-tester.h b/deps/v8/test/cctest/compiler/graph-builder-tester.h
index 24c2877938b..66cdc8613a5 100644
--- a/deps/v8/test/cctest/compiler/graph-builder-tester.h
+++ b/deps/v8/test/cctest/compiler/graph-builder-tester.h
@@ -247,11 +247,11 @@ class GraphBuilderTester : public HandleAndZoneScope,
   virtual byte* Generate() {
     if (code_.is_null()) {
       Zone* zone = graph()->zone();
-      CallDescriptor* desc =
+      auto call_descriptor =
           Linkage::GetSimplifiedCDescriptor(zone, this->csig_);
       CompilationInfo info(ArrayVector("testing"), main_zone(), Code::STUB);
-      code_ = Pipeline::GenerateCodeForTesting(&info, main_isolate(), desc,
-                                               graph());
+      code_ = Pipeline::GenerateCodeForTesting(&info, main_isolate(),
+                                               call_descriptor, graph());
 #ifdef ENABLE_DISASSEMBLER
       if (!code_.is_null() && FLAG_print_opt_code) {
         OFStream os(stdout);
diff --git a/deps/v8/test/cctest/compiler/test-code-assembler.cc b/deps/v8/test/cctest/compiler/test-code-assembler.cc
index 8661a5eb5c2..32548601ec8 100644
--- a/deps/v8/test/cctest/compiler/test-code-assembler.cc
+++ b/deps/v8/test/cctest/compiler/test-code-assembler.cc
@@ -33,7 +33,7 @@ Node* UndefinedConstant(CodeAssembler& m) {
   return m.LoadRoot(Heap::kUndefinedValueRootIndex);
 }
 
-Node* SmiFromWord32(CodeAssembler& m, Node* value) {
+Node* SmiFromInt32(CodeAssembler& m, Node* value) {
   value = m.ChangeInt32ToIntPtr(value);
   return m.BitcastWordToTaggedSigned(
       m.WordShl(value, kSmiShiftSize + kSmiTagSize));
@@ -505,7 +505,7 @@ TEST(GotoIfExceptionMultiple) {
   error.Bind(UndefinedConstant(m));
   string = m.CallStub(to_string, context, second_value);
   m.GotoIfException(string, &exception_handler2, &error);
-  m.Return(SmiFromWord32(m, return_value.value()));
+  m.Return(SmiFromInt32(m, return_value.value()));
 
   // try { ToString(param3); return 7 & ~2; } catch (e) { return e; }
   m.Bind(&exception_handler2);
@@ -513,7 +513,7 @@ TEST(GotoIfExceptionMultiple) {
   error.Bind(UndefinedConstant(m));
   string = m.CallStub(to_string, context, third_value);
   m.GotoIfException(string, &exception_handler3, &error);
-  m.Return(SmiFromWord32(
+  m.Return(SmiFromInt32(
       m, m.Word32And(return_value.value(),
                      m.Word32Xor(m.Int32Constant(2), m.Int32Constant(-1)))));
 
diff --git a/deps/v8/test/cctest/compiler/test-code-generator.cc b/deps/v8/test/cctest/compiler/test-code-generator.cc
index 10158c27414..6a6f8c9e092 100644
--- a/deps/v8/test/cctest/compiler/test-code-generator.cc
+++ b/deps/v8/test/cctest/compiler/test-code-generator.cc
@@ -41,7 +41,8 @@ int GetSlotSizeInBytes(MachineRepresentation rep) {
 }
 
 // Forward declaration.
-Handle<Code> BuildTeardownFunction(Isolate* isolate, CallDescriptor* descriptor,
+Handle<Code> BuildTeardownFunction(Isolate* isolate,
+                                   CallDescriptor* call_descriptor,
                                    std::vector<AllocatedOperand> parameters);
 
 // Build the `setup` function. It takes a code object and a FixedArray as
@@ -69,15 +70,16 @@ Handle<Code> BuildTeardownFunction(Isolate* isolate, CallDescriptor* descriptor,
 // |                |                     | results into lanes of a new        |
 // |                |                     | 128-bit vector.                    |
 //
-Handle<Code> BuildSetupFunction(Isolate* isolate, CallDescriptor* descriptor,
+Handle<Code> BuildSetupFunction(Isolate* isolate,
+                                CallDescriptor* call_descriptor,
                                 std::vector<AllocatedOperand> parameters) {
   CodeAssemblerTester tester(isolate, 2);
   CodeStubAssembler assembler(tester.state());
   std::vector<Node*> params;
   // The first parameter is always the callee.
   params.push_back(__ Parameter(0));
-  params.push_back(
-      __ HeapConstant(BuildTeardownFunction(isolate, descriptor, parameters)));
+  params.push_back(__ HeapConstant(
+      BuildTeardownFunction(isolate, call_descriptor, parameters)));
   // First allocate the FixedArray which will hold the final results. Here we
   // should take care of all allocations, meaning we allocate HeapNumbers and
   // FixedArrays representing Simd128 values.
@@ -123,8 +125,8 @@ Handle<Code> BuildSetupFunction(Isolate* isolate, CallDescriptor* descriptor,
             tester.raw_assembler_for_testing()->machine()->I32x4Splat(),
             __ Int32Constant(0));
         for (int lane = 0; lane < 4; lane++) {
-          Node* lane_value = __ SmiToWord32(
-              __ LoadFixedArrayElement(element, __ IntPtrConstant(lane)));
+          TNode<Int32T> lane_value = __ LoadAndUntagToWord32FixedArrayElement(
+              element, __ IntPtrConstant(lane));
           vector = tester.raw_assembler_for_testing()->AddNode(
               tester.raw_assembler_for_testing()->machine()->I32x4ReplaceLane(
                   lane),
@@ -140,7 +142,7 @@ Handle<Code> BuildSetupFunction(Isolate* isolate, CallDescriptor* descriptor,
     params.push_back(element);
   }
   __ Return(tester.raw_assembler_for_testing()->AddNode(
-      tester.raw_assembler_for_testing()->common()->Call(descriptor),
+      tester.raw_assembler_for_testing()->common()->Call(call_descriptor),
       static_cast<int>(params.size()), params.data()));
   return tester.GenerateCodeCloseAndEscape();
 }
@@ -187,9 +189,10 @@ Handle<Code> BuildSetupFunction(Isolate* isolate, CallDescriptor* descriptor,
 // SKIP_WRITE_BARRIER. The reason for this is that `RecordWrite` may clobber the
 // top 64 bits of Simd128 registers. This is the case on x64, ia32 and Arm64 for
 // example.
-Handle<Code> BuildTeardownFunction(Isolate* isolate, CallDescriptor* descriptor,
+Handle<Code> BuildTeardownFunction(Isolate* isolate,
+                                   CallDescriptor* call_descriptor,
                                    std::vector<AllocatedOperand> parameters) {
-  CodeAssemblerTester tester(isolate, descriptor);
+  CodeAssemblerTester tester(isolate, call_descriptor);
   CodeStubAssembler assembler(tester.state());
   Node* result_array = __ Parameter(1);
   for (int i = 0; i < static_cast<int>(parameters.size()); i++) {
@@ -203,7 +206,7 @@ Handle<Code> BuildTeardownFunction(Isolate* isolate, CallDescriptor* descriptor,
       case MachineRepresentation::kFloat32:
         param =
             tester.raw_assembler_for_testing()->ChangeFloat32ToFloat64(param);
-      // Fallthrough
+        V8_FALLTHROUGH;
       case MachineRepresentation::kFloat64:
         __ StoreObjectFieldNoWriteBarrier(
             __ LoadFixedArrayElement(result_array, i), HeapNumber::kValueOffset,
@@ -213,7 +216,7 @@ Handle<Code> BuildTeardownFunction(Isolate* isolate, CallDescriptor* descriptor,
         Node* vector = __ LoadFixedArrayElement(result_array, i);
         for (int lane = 0; lane < 4; lane++) {
           Node* lane_value =
-              __ SmiFromWord32(tester.raw_assembler_for_testing()->AddNode(
+              __ SmiFromInt32(tester.raw_assembler_for_testing()->AddNode(
                   tester.raw_assembler_for_testing()
                       ->machine()
                       ->I32x4ExtractLane(lane),
@@ -275,13 +278,7 @@ void PrintStateValue(std::ostream& os, Isolate* isolate, Handle<Object> value,
 }
 
 bool TestSimd128Moves() {
-#if defined(V8_TARGET_ARCH_MIPS) || defined(V8_TARGET_ARCH_MIPS64)
-  // TODO(mips): Implement support for the kSimd128 representation in
-  // AssembleMove and AssembleSwap on MIPS.
-  return false;
-#else
   return CpuFeatures::SupportsWasmSimd128();
-#endif
 }
 
 }  // namespace
@@ -962,7 +959,7 @@ class CodeGeneratorTester {
         generator_(environment->main_zone(), &frame_, &linkage_,
                    environment->code(), &info_, environment->main_isolate(),
                    base::Optional<OsrHelper>(), kNoSourcePosition, nullptr,
-                   nullptr) {
+                   nullptr, PoisoningMitigationLevel::kOff) {
     // Force a frame to be created.
     generator_.frame_access_state()->MarkHasFrame(true);
     generator_.AssembleConstructFrame();
@@ -973,10 +970,15 @@ class CodeGeneratorTester {
   Instruction* CreateTailCall(int stack_slot_delta) {
     int optional_padding_slot = stack_slot_delta;
     InstructionOperand callee[] = {
+        AllocatedOperand(LocationOperand::REGISTER,
+                         MachineRepresentation::kTagged,
+                         kReturnRegister0.code()),
+        ImmediateOperand(ImmediateOperand::INLINE, -1),  // poison index.
         ImmediateOperand(ImmediateOperand::INLINE, optional_padding_slot),
         ImmediateOperand(ImmediateOperand::INLINE, stack_slot_delta)};
-    Instruction* tail_call = Instruction::New(zone_, kArchTailCallCodeObject, 0,
-                                              nullptr, 2, callee, 0, nullptr);
+    Instruction* tail_call =
+        Instruction::New(zone_, kArchTailCallCodeObject, 0, nullptr,
+                         arraysize(callee), callee, 0, nullptr);
     return tail_call;
   }
 
@@ -1049,10 +1051,12 @@ class CodeGeneratorTester {
         AllocatedOperand(LocationOperand::REGISTER,
                          MachineRepresentation::kTagged,
                          kReturnRegister0.code()),
+        ImmediateOperand(ImmediateOperand::INLINE, -1),  // poison index.
         ImmediateOperand(ImmediateOperand::INLINE, optional_padding_slot),
         ImmediateOperand(ImmediateOperand::INLINE, first_unused_stack_slot)};
-    Instruction* tail_call = Instruction::New(zone_, kArchTailCallCodeObject, 0,
-                                              nullptr, 3, callee, 0, nullptr);
+    Instruction* tail_call =
+        Instruction::New(zone_, kArchTailCallCodeObject, 0, nullptr,
+                         arraysize(callee), callee, 0, nullptr);
     sequence->AddInstruction(tail_call);
     sequence->EndBlock(RpoNumber::FromInt(0));
 
diff --git a/deps/v8/test/cctest/compiler/test-instruction-scheduler.cc b/deps/v8/test/cctest/compiler/test-instruction-scheduler.cc
new file mode 100644
index 00000000000..6ff68fbda35
--- /dev/null
+++ b/deps/v8/test/cctest/compiler/test-instruction-scheduler.cc
@@ -0,0 +1,115 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/instruction-scheduler.h"
+#include "src/compiler/instruction-selector-impl.h"
+#include "src/compiler/instruction.h"
+
+#include "test/cctest/cctest.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+// Create InstructionBlocks with a single block.
+InstructionBlocks* CreateSingleBlock(Zone* zone) {
+  InstructionBlocks* blocks = zone->NewArray<InstructionBlocks>(1);
+  new (blocks) InstructionBlocks(1, nullptr, zone);
+  InstructionBlock* block = new (zone)
+      InstructionBlock(zone, RpoNumber::FromInt(0), RpoNumber::Invalid(),
+                       RpoNumber::Invalid(), false, false);
+  block->set_ao_number(RpoNumber::FromInt(0));
+  (*blocks)[0] = block;
+  return blocks;
+}
+
+// Wrapper around the InstructionScheduler.
+class InstructionSchedulerTester {
+ public:
+  InstructionSchedulerTester()
+      : scope_(),
+        blocks_(CreateSingleBlock(scope_.main_zone())),
+        sequence_(scope_.main_isolate(), scope_.main_zone(), blocks_),
+        scheduler_(scope_.main_zone(), &sequence_) {}
+
+  void StartBlock() { scheduler_.StartBlock(RpoNumber::FromInt(0)); }
+  void EndBlock() { scheduler_.EndBlock(RpoNumber::FromInt(0)); }
+  void AddInstruction(Instruction* instr) { scheduler_.AddInstruction(instr); }
+  void AddTerminator(Instruction* instr) { scheduler_.AddTerminator(instr); }
+
+  void CheckHasSideEffect(Instruction* instr) {
+    CHECK(scheduler_.HasSideEffect(instr));
+  }
+  void CheckIsDeopt(Instruction* instr) { CHECK(instr->IsDeoptimizeCall()); }
+
+  void CheckInSuccessors(Instruction* instr, Instruction* successor) {
+    InstructionScheduler::ScheduleGraphNode* node = GetNode(instr);
+    InstructionScheduler::ScheduleGraphNode* succ_node = GetNode(successor);
+
+    ZoneDeque<InstructionScheduler::ScheduleGraphNode*>& successors =
+        node->successors();
+    CHECK_NE(std::find(successors.begin(), successors.end(), succ_node),
+             successors.end());
+  }
+
+  Zone* zone() { return scope_.main_zone(); }
+
+ private:
+  InstructionScheduler::ScheduleGraphNode* GetNode(Instruction* instr) {
+    for (auto node : scheduler_.graph_) {
+      if (node->instruction() == instr) return node;
+    }
+    return nullptr;
+  }
+
+  HandleAndZoneScope scope_;
+  InstructionBlocks* blocks_;
+  InstructionSequence sequence_;
+  InstructionScheduler scheduler_;
+};
+
+TEST(DeoptInMiddleOfBasicBlock) {
+  InstructionSchedulerTester tester;
+  Zone* zone = tester.zone();
+
+  tester.StartBlock();
+  InstructionCode jmp_opcode = kArchJmp;
+  // Dummy node for FlagsContinuation::ForDeoptimize (which won't accept
+  // nullptr).
+  Node* node = Node::New(zone, 0, nullptr, 0, nullptr, false);
+  VectorSlotPair feedback;
+  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
+      kEqual, DeoptimizeKind::kEager, DeoptimizeReason::kUnknown, feedback,
+      node, true);
+  jmp_opcode = cont.Encode(jmp_opcode);
+  Instruction* jmp_inst = Instruction::New(zone, jmp_opcode);
+  tester.CheckIsDeopt(jmp_inst);
+  tester.AddInstruction(jmp_inst);
+  Instruction* side_effect_inst = Instruction::New(zone, kArchPrepareTailCall);
+  tester.CheckHasSideEffect(side_effect_inst);
+  tester.AddInstruction(side_effect_inst);
+  Instruction* other_jmp_inst = Instruction::New(zone, jmp_opcode);
+  tester.CheckIsDeopt(other_jmp_inst);
+  tester.AddInstruction(other_jmp_inst);
+  Instruction* ret_inst = Instruction::New(zone, kArchRet);
+  tester.AddTerminator(ret_inst);
+
+  // Check that an instruction with a side effect is a successor of the deopt.
+  tester.CheckInSuccessors(jmp_inst, side_effect_inst);
+  // Check that the second deopt is a successor of the first deopt.
+  tester.CheckInSuccessors(jmp_inst, other_jmp_inst);
+  // Check that the second deopt is a successor of the side-effect instruction.
+  tester.CheckInSuccessors(side_effect_inst, other_jmp_inst);
+  // Check that the block terminator is a successor of all other instructions.
+  tester.CheckInSuccessors(jmp_inst, ret_inst);
+  tester.CheckInSuccessors(side_effect_inst, ret_inst);
+  tester.CheckInSuccessors(other_jmp_inst, ret_inst);
+
+  // Schedule block.
+  tester.EndBlock();
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/compiler/test-instruction.cc b/deps/v8/test/cctest/compiler/test-instruction.cc
index d0addad6600..0e664aefff7 100644
--- a/deps/v8/test/cctest/compiler/test-instruction.cc
+++ b/deps/v8/test/cctest/compiler/test-instruction.cc
@@ -83,7 +83,7 @@ class InstructionTester : public HandleAndZoneScope {
   }
 
   UnallocatedOperand Unallocated(int vreg) {
-    return UnallocatedOperand(UnallocatedOperand::ANY, vreg);
+    return UnallocatedOperand(UnallocatedOperand::REGISTER_OR_SLOT, vreg);
   }
 
   RpoNumber RpoFor(BasicBlock* block) {
diff --git a/deps/v8/test/cctest/compiler/test-js-constant-cache.cc b/deps/v8/test/cctest/compiler/test-js-constant-cache.cc
index ee53f262459..ee9d8949028 100644
--- a/deps/v8/test/cctest/compiler/test-js-constant-cache.cc
+++ b/deps/v8/test/cctest/compiler/test-js-constant-cache.cc
@@ -43,7 +43,7 @@ class JSConstantCacheTester : public HandleAndZoneScope,
 
   Handle<HeapObject> handle(Node* node) {
     CHECK_EQ(IrOpcode::kHeapConstant, node->opcode());
-    return OpParameter<Handle<HeapObject>>(node);
+    return HeapConstantOf(node->op());
   }
 
   Factory* factory() { return main_isolate()->factory(); }
@@ -75,8 +75,8 @@ TEST(MinusZeroConstant) {
   CHECK_EQ(minus_zero, T.Constant(-0.0));
   CHECK_NE(zero, minus_zero);
 
-  double zero_value = OpParameter<double>(zero);
-  double minus_zero_value = OpParameter<double>(minus_zero);
+  double zero_value = OpParameter<double>(zero->op());
+  double minus_zero_value = OpParameter<double>(minus_zero->op());
 
   CHECK(bit_cast<uint64_t>(0.0) == bit_cast<uint64_t>(zero_value));
   CHECK(bit_cast<uint64_t>(-0.0) != bit_cast<uint64_t>(zero_value));
@@ -339,15 +339,17 @@ TEST(JSGraph_GetCachedNodes_number) {
 
 TEST(JSGraph_GetCachedNodes_external) {
   JSConstantCacheTester T;
-
-  ExternalReference constants[] = {ExternalReference::address_of_min_int(),
-                                   ExternalReference::address_of_min_int(),
-                                   ExternalReference::address_of_min_int(),
-                                   ExternalReference::address_of_one_half(),
-                                   ExternalReference::address_of_one_half(),
-                                   ExternalReference::address_of_min_int(),
-                                   ExternalReference::address_of_the_hole_nan(),
-                                   ExternalReference::address_of_one_half()};
+  Isolate* isolate = T.main_isolate();
+
+  ExternalReference constants[] = {
+      ExternalReference::address_of_min_int(isolate),
+      ExternalReference::address_of_min_int(isolate),
+      ExternalReference::address_of_min_int(isolate),
+      ExternalReference::address_of_one_half(isolate),
+      ExternalReference::address_of_one_half(isolate),
+      ExternalReference::address_of_min_int(isolate),
+      ExternalReference::address_of_the_hole_nan(isolate),
+      ExternalReference::address_of_one_half(isolate)};
 
   for (size_t i = 0; i < arraysize(constants); i++) {
     size_t count_before = T.graph()->NodeCount();
@@ -366,6 +368,7 @@ TEST(JSGraph_GetCachedNodes_external) {
 
 TEST(JSGraph_GetCachedNodes_together) {
   JSConstantCacheTester T;
+  Isolate* isolate = T.main_isolate();
 
   Node* constants[] = {
       T.TrueConstant(),
@@ -385,7 +388,7 @@ TEST(JSGraph_GetCachedNodes_together) {
       T.Float64Constant(V8_INFINITY),
       T.Constant(0.99),
       T.Constant(1.11),
-      T.ExternalConstant(ExternalReference::address_of_one_half())};
+      T.ExternalConstant(ExternalReference::address_of_one_half(isolate))};
 
   NodeVector nodes(T.main_zone());
   T.GetCachedNodes(&nodes);
diff --git a/deps/v8/test/cctest/compiler/test-js-context-specialization.cc b/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
index ba4f7638f2a..2f01932eced 100644
--- a/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
+++ b/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
@@ -70,7 +70,7 @@ void ContextSpecializationTester::CheckChangesToValue(
 void ContextSpecializationTester::CheckContextInputAndDepthChanges(
     Node* node, Handle<Context> expected_new_context_object,
     size_t expected_new_depth) {
-  ContextAccess access = OpParameter<ContextAccess>(node);
+  ContextAccess access = ContextAccessOf(node->op());
   Reduction r = spec()->Reduce(node);
   CHECK(r.Changed());
 
@@ -79,7 +79,7 @@ void ContextSpecializationTester::CheckContextInputAndDepthChanges(
   HeapObjectMatcher match(new_context);
   CHECK_EQ(*match.Value(), *expected_new_context_object);
 
-  ContextAccess new_access = OpParameter<ContextAccess>(r.replacement());
+  ContextAccess new_access = ContextAccessOf(r.replacement()->op());
   CHECK_EQ(new_access.depth(), expected_new_depth);
   CHECK_EQ(new_access.index(), access.index());
   CHECK_EQ(new_access.immutable(), access.immutable());
@@ -87,14 +87,14 @@ void ContextSpecializationTester::CheckContextInputAndDepthChanges(
 
 void ContextSpecializationTester::CheckContextInputAndDepthChanges(
     Node* node, Node* expected_new_context, size_t expected_new_depth) {
-  ContextAccess access = OpParameter<ContextAccess>(node);
+  ContextAccess access = ContextAccessOf(node->op());
   Reduction r = spec()->Reduce(node);
   CHECK(r.Changed());
 
   Node* new_context = NodeProperties::GetContextInput(r.replacement());
   CHECK_EQ(new_context, expected_new_context);
 
-  ContextAccess new_access = OpParameter<ContextAccess>(r.replacement());
+  ContextAccess new_access = ContextAccessOf(r.replacement()->op());
   CHECK_EQ(new_access.depth(), expected_new_depth);
   CHECK_EQ(new_access.index(), access.index());
   CHECK_EQ(new_access.immutable(), access.immutable());
@@ -149,7 +149,7 @@ TEST(ReduceJSLoadContext0) {
     CHECK_EQ(IrOpcode::kHeapConstant, new_context_input->opcode());
     HeapObjectMatcher match(new_context_input);
     CHECK_EQ(*native, *match.Value());
-    ContextAccess access = OpParameter<ContextAccess>(r.replacement());
+    ContextAccess access = ContextAccessOf(r.replacement()->op());
     CHECK_EQ(Context::GLOBAL_EVAL_FUN_INDEX, static_cast<int>(access.index()));
     CHECK_EQ(0, static_cast<int>(access.depth()));
     CHECK_EQ(false, access.immutable());
@@ -453,7 +453,7 @@ TEST(ReduceJSStoreContext0) {
     CHECK_EQ(IrOpcode::kHeapConstant, new_context_input->opcode());
     HeapObjectMatcher match(new_context_input);
     CHECK_EQ(*native, *match.Value());
-    ContextAccess access = OpParameter<ContextAccess>(r.replacement());
+    ContextAccess access = ContextAccessOf(r.replacement()->op());
     CHECK_EQ(Context::GLOBAL_EVAL_FUN_INDEX, static_cast<int>(access.index()));
     CHECK_EQ(0, static_cast<int>(access.depth()));
     CHECK_EQ(false, access.immutable());
diff --git a/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc b/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
index 3ae652e8699..c3c614fbb53 100644
--- a/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
+++ b/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
@@ -162,12 +162,12 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
 
   void CheckNumberConstant(double expected, Node* result) {
     CHECK_EQ(IrOpcode::kNumberConstant, result->opcode());
-    CHECK_EQ(expected, OpParameter<double>(result));
+    CHECK_EQ(expected, OpParameter<double>(result->op()));
   }
 
   void CheckNaN(Node* result) {
     CHECK_EQ(IrOpcode::kNumberConstant, result->opcode());
-    double value = OpParameter<double>(result);
+    double value = OpParameter<double>(result->op());
     CHECK(std::isnan(value));
   }
 
@@ -181,14 +181,12 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
 
   void CheckHandle(Handle<HeapObject> expected, Node* result) {
     CHECK_EQ(IrOpcode::kHeapConstant, result->opcode());
-    Handle<HeapObject> value = OpParameter<Handle<HeapObject>>(result);
+    Handle<HeapObject> value = HeapConstantOf(result->op());
     CHECK_EQ(*expected, *value);
   }
 };
 
-static Type* kStringTypes[] = {Type::InternalizedString(), Type::OtherString(),
-                               Type::String()};
-
+static Type* kStringTypes[] = {Type::InternalizedString(), Type::String()};
 
 static Type* kInt32Types[] = {Type::UnsignedSmall(), Type::Negative32(),
                               Type::Unsigned31(),    Type::SignedSmall(),
@@ -286,7 +284,7 @@ static void CheckToI32(Node* old_input, Node* new_input, bool is_signed) {
   if (old_type->Is(expected_type)) {
     CHECK_EQ(old_input, new_input);
   } else if (new_input->opcode() == IrOpcode::kNumberConstant) {
-    double v = OpParameter<double>(new_input);
+    double v = OpParameter<double>(new_input->op());
     double e = static_cast<double>(is_signed ? FastD2I(v) : FastD2UI(v));
     CHECK_EQ(e, v);
   }
@@ -702,6 +700,7 @@ TEST(RemoveToNumberEffects) {
         break;
       case 2:
         effect_use = R.graph.NewNode(R.common.EffectPhi(1), ton, R.start());
+        break;
       case 3:
         effect_use = R.graph.NewNode(R.javascript.Add(R.binop_hints), ton, ton,
                                      R.context(), frame_state, ton, R.start());
diff --git a/deps/v8/test/cctest/compiler/test-linkage.cc b/deps/v8/test/cctest/compiler/test-linkage.cc
index 13f493e82df..f3f09a99e8b 100644
--- a/deps/v8/test/cctest/compiler/test-linkage.cc
+++ b/deps/v8/test/cctest/compiler/test-linkage.cc
@@ -35,11 +35,9 @@ static Handle<JSFunction> Compile(const char* source) {
                                    .ToHandleChecked();
   Handle<SharedFunctionInfo> shared =
       Compiler::GetSharedFunctionInfoForScript(
-          source_code, MaybeHandle<String>(), 0, 0, v8::ScriptOriginOptions(),
-          MaybeHandle<Object>(), Handle<Context>(isolate->native_context()),
+          source_code, Compiler::ScriptDetails(), v8::ScriptOriginOptions(),
           nullptr, nullptr, v8::ScriptCompiler::kNoCompileOptions,
-          ScriptCompiler::kNoCacheNoReason, NOT_NATIVES_CODE,
-          MaybeHandle<FixedArray>())
+          ScriptCompiler::kNoCacheNoReason, NOT_NATIVES_CODE)
           .ToHandleChecked();
   return isolate->factory()->NewFunctionFromSharedFunctionInfo(
       shared, isolate->native_context());
@@ -52,8 +50,8 @@ TEST(TestLinkageCreate) {
   Handle<SharedFunctionInfo> shared(function->shared());
   CompilationInfo info(handles.main_zone(), function->GetIsolate(), shared,
                        function);
-  CallDescriptor* descriptor = Linkage::ComputeIncoming(info.zone(), &info);
-  CHECK(descriptor);
+  auto call_descriptor = Linkage::ComputeIncoming(info.zone(), &info);
+  CHECK(call_descriptor);
 }
 
 
@@ -69,13 +67,13 @@ TEST(TestLinkageJSFunctionIncoming) {
     Handle<SharedFunctionInfo> shared(function->shared());
     CompilationInfo info(handles.main_zone(), function->GetIsolate(), shared,
                          function);
-    CallDescriptor* descriptor = Linkage::ComputeIncoming(info.zone(), &info);
-    CHECK(descriptor);
+    auto call_descriptor = Linkage::ComputeIncoming(info.zone(), &info);
+    CHECK(call_descriptor);
 
-    CHECK_EQ(1 + i, static_cast<int>(descriptor->JSParameterCount()));
-    CHECK_EQ(1, static_cast<int>(descriptor->ReturnCount()));
-    CHECK_EQ(Operator::kNoProperties, descriptor->properties());
-    CHECK_EQ(true, descriptor->IsJSFunctionCall());
+    CHECK_EQ(1 + i, static_cast<int>(call_descriptor->JSParameterCount()));
+    CHECK_EQ(1, static_cast<int>(call_descriptor->ReturnCount()));
+    CHECK_EQ(Operator::kNoProperties, call_descriptor->properties());
+    CHECK_EQ(true, call_descriptor->IsJSFunctionCall());
   }
 }
 
@@ -88,13 +86,13 @@ TEST(TestLinkageJSCall) {
                        function);
 
   for (int i = 0; i < 32; i++) {
-    CallDescriptor* descriptor = Linkage::GetJSCallDescriptor(
+    auto call_descriptor = Linkage::GetJSCallDescriptor(
         info.zone(), false, i, CallDescriptor::kNoFlags);
-    CHECK(descriptor);
-    CHECK_EQ(i, static_cast<int>(descriptor->JSParameterCount()));
-    CHECK_EQ(1, static_cast<int>(descriptor->ReturnCount()));
-    CHECK_EQ(Operator::kNoProperties, descriptor->properties());
-    CHECK_EQ(true, descriptor->IsJSFunctionCall());
+    CHECK(call_descriptor);
+    CHECK_EQ(i, static_cast<int>(call_descriptor->JSParameterCount()));
+    CHECK_EQ(1, static_cast<int>(call_descriptor->ReturnCount()));
+    CHECK_EQ(Operator::kNoProperties, call_descriptor->properties());
+    CHECK_EQ(true, call_descriptor->IsJSFunctionCall());
   }
 }
 
@@ -109,14 +107,14 @@ TEST(TestLinkageStubCall) {
   Zone zone(isolate->allocator(), ZONE_NAME);
   Callable callable = Builtins::CallableFor(isolate, Builtins::kToNumber);
   CompilationInfo info(ArrayVector("test"), &zone, Code::STUB);
-  CallDescriptor* descriptor = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate, &zone, callable.descriptor(), 0, CallDescriptor::kNoFlags,
       Operator::kNoProperties);
-  CHECK(descriptor);
-  CHECK_EQ(0, static_cast<int>(descriptor->StackParameterCount()));
-  CHECK_EQ(1, static_cast<int>(descriptor->ReturnCount()));
-  CHECK_EQ(Operator::kNoProperties, descriptor->properties());
-  CHECK_EQ(false, descriptor->IsJSFunctionCall());
+  CHECK(call_descriptor);
+  CHECK_EQ(0, static_cast<int>(call_descriptor->StackParameterCount()));
+  CHECK_EQ(1, static_cast<int>(call_descriptor->ReturnCount()));
+  CHECK_EQ(Operator::kNoProperties, call_descriptor->properties());
+  CHECK_EQ(false, call_descriptor->IsJSFunctionCall());
   // TODO(titzer): test linkage creation for outgoing stub calls.
 }
 
diff --git a/deps/v8/test/cctest/compiler/test-multiple-return.cc b/deps/v8/test/cctest/compiler/test-multiple-return.cc
index 1f46e870774..b17187d01ee 100644
--- a/deps/v8/test/cctest/compiler/test-multiple-return.cc
+++ b/deps/v8/test/cctest/compiler/test-multiple-return.cc
@@ -12,9 +12,13 @@
 #include "src/codegen.h"
 #include "src/compiler.h"
 #include "src/compiler/linkage.h"
+#include "src/compiler/wasm-compiler.h"
 #include "src/machine-type.h"
 #include "src/macro-assembler.h"
 #include "src/objects-inl.h"
+#include "src/wasm/wasm-engine.h"
+#include "src/wasm/wasm-objects-inl.h"
+#include "src/wasm/wasm-opcodes.h"
 #include "test/cctest/cctest.h"
 #include "test/cctest/compiler/codegen-tester.h"
 #include "test/cctest/compiler/value-helper.h"
@@ -25,89 +29,18 @@ namespace compiler {
 
 namespace {
 
-int size(MachineType type) {
-  return 1 << ElementSizeLog2Of(type.representation());
-}
-
-int num_registers(MachineType type) {
-  const RegisterConfiguration* config = RegisterConfiguration::Default();
-  switch (type.representation()) {
-    case MachineRepresentation::kWord32:
-    case MachineRepresentation::kWord64:
-      return config->num_allocatable_general_registers();
-    case MachineRepresentation::kFloat32:
-      return config->num_allocatable_float_registers();
-    case MachineRepresentation::kFloat64:
-      return config->num_allocatable_double_registers();
-    default:
-      UNREACHABLE();
-  }
-}
-
-const int* codes(MachineType type) {
-  const RegisterConfiguration* config = RegisterConfiguration::Default();
-  switch (type.representation()) {
-    case MachineRepresentation::kWord32:
-    case MachineRepresentation::kWord64:
-      return config->allocatable_general_codes();
-    case MachineRepresentation::kFloat32:
-      return config->allocatable_float_codes();
-    case MachineRepresentation::kFloat64:
-      return config->allocatable_double_codes();
-    default:
-      UNREACHABLE();
-  }
-}
+CallDescriptor* CreateCallDescriptor(Zone* zone, int return_count,
+                                     int param_count, MachineType type) {
+  wasm::FunctionSig::Builder builder(zone, return_count, param_count);
 
-CallDescriptor* CreateMonoCallDescriptor(Zone* zone, int return_count,
-                                         int param_count, MachineType type) {
-  LocationSignature::Builder locations(zone, return_count, param_count);
-
-  int span = std::max(1, size(type) / kPointerSize);
-  int stack_params = 0;
   for (int i = 0; i < param_count; i++) {
-    LinkageLocation location = LinkageLocation::ForAnyRegister();
-    if (i < num_registers(type)) {
-      location = LinkageLocation::ForRegister(codes(type)[i], type);
-    } else {
-      int slot = span * (i - param_count);
-      location = LinkageLocation::ForCallerFrameSlot(slot, type);
-      stack_params += span;
-    }
-    locations.AddParam(location);
+    builder.AddParam(type.representation());
   }
 
-  int stack_returns = 0;
   for (int i = 0; i < return_count; i++) {
-    LinkageLocation location = LinkageLocation::ForAnyRegister();
-    if (i < num_registers(type)) {
-      location = LinkageLocation::ForRegister(codes(type)[i], type);
-    } else {
-      int slot = span * (num_registers(type) - i) - stack_params - 1;
-      location = LinkageLocation::ForCallerFrameSlot(slot, type);
-      stack_returns += span;
-    }
-    locations.AddReturn(location);
+    builder.AddReturn(type.representation());
   }
-
-  const RegList kCalleeSaveRegisters = 0;
-  const RegList kCalleeSaveFPRegisters = 0;
-
-  MachineType target_type = MachineType::AnyTagged();
-  LinkageLocation target_loc = LinkageLocation::ForAnyRegister(target_type);
-  return new (zone) CallDescriptor(       // --
-      CallDescriptor::kCallCodeObject,    // kind
-      target_type,                        // target MachineType
-      target_loc,                         // target location
-      locations.Build(),                  // location_sig
-      stack_params,                       // on-stack parameter count
-      compiler::Operator::kNoProperties,  // properties
-      kCalleeSaveRegisters,               // callee-saved registers
-      kCalleeSaveFPRegisters,             // callee-saved fp regs
-      CallDescriptor::kNoFlags,           // flags
-      "c-call",                           // debug name
-      0,                                  // allocatable registers
-      stack_returns);                     // on-stack return count
+  return compiler::GetWasmCallDescriptor(zone, builder.Build());
 }
 
 }  // namespace
@@ -187,6 +120,17 @@ Node* ToInt32(RawMachineAssembler& m, MachineType type, Node* a) {
   }
 }
 
+std::unique_ptr<wasm::NativeModule> AllocateNativeModule(Isolate* isolate,
+                                                         size_t code_size) {
+  // We have to add the code object to a NativeModule, because the
+  // WasmCallDescriptor assumes that code is on the native heap and not
+  // within a code object.
+  std::unique_ptr<wasm::NativeModule> module =
+      isolate->wasm_engine()->code_manager()->NewNativeModule(code_size, 1, 0,
+                                                              false);
+  return module;
+}
+
 void TestReturnMultipleValues(MachineType type) {
   const int kMaxCount = 20;
   for (int count = 0; count < kMaxCount; ++count) {
@@ -194,15 +138,16 @@ void TestReturnMultipleValues(MachineType type) {
            MachineReprToString(type.representation()), count);
     v8::internal::AccountingAllocator allocator;
     Zone zone(&allocator, ZONE_NAME);
-    CallDescriptor* desc = CreateMonoCallDescriptor(&zone, count, 2, type);
+    CallDescriptor* desc = CreateCallDescriptor(&zone, count, 2, type);
     HandleAndZoneScope handles;
     RawMachineAssembler m(handles.main_isolate(),
                           new (handles.main_zone()) Graph(handles.main_zone()),
                           desc, MachineType::PointerRepresentation(),
                           InstructionSelector::SupportedMachineOperatorFlags());
 
-    Node* p0 = m.Parameter(0);
-    Node* p1 = m.Parameter(1);
+    // m.Parameter(0) is the WasmContext.
+    Node* p0 = m.Parameter(1);
+    Node* p1 = m.Parameter(2);
     typedef Node* Node_ptr;
     std::unique_ptr<Node_ptr[]> returns(new Node_ptr[count]);
     for (int i = 0; i < count; ++i) {
@@ -232,11 +177,21 @@ void TestReturnMultipleValues(MachineType type) {
       if (i % 4 == 0) sign = -sign;
     }
 
+    std::unique_ptr<wasm::NativeModule> module =
+        AllocateNativeModule(handles.main_isolate(), code->instruction_size());
+    byte* code_start = module->AddCodeCopy(code, wasm::WasmCode::kFunction, 0)
+                           ->instructions()
+                           .start();
+
     RawMachineAssemblerTester<int32_t> mt;
-    Node* na = Constant(mt, type, a);
-    Node* nb = Constant(mt, type, b);
-    Node* ret_multi =
-        mt.AddNode(mt.common()->Call(desc), mt.HeapConstant(code), na, nb);
+    Node* call_inputs[] = {mt.PointerConstant(code_start),
+                           // WasmContext dummy
+                           mt.PointerConstant(nullptr),
+                           // Inputs
+                           Constant(mt, type, a), Constant(mt, type, b)};
+
+    Node* ret_multi = mt.AddNode(mt.common()->Call(desc),
+                                 arraysize(call_inputs), call_inputs);
     Node* ret = Constant(mt, type, 0);
     bool sign = false;
     for (int i = 0; i < count; ++i) {
@@ -275,10 +230,11 @@ void ReturnLastValue(MachineType type) {
   for (auto slot_count : slot_counts) {
     v8::internal::AccountingAllocator allocator;
     Zone zone(&allocator, ZONE_NAME);
-    const int return_count = num_registers(type) + slot_count;
+    // The wasm-linkage provides 2 return registers at the moment, on all
+    // platforms.
+    const int return_count = 2 + slot_count;
 
-    CallDescriptor* desc =
-        CreateMonoCallDescriptor(&zone, return_count, 0, type);
+    CallDescriptor* desc = CreateCallDescriptor(&zone, return_count, 0, type);
 
     HandleAndZoneScope handles;
     RawMachineAssembler m(handles.main_isolate(),
@@ -299,12 +255,20 @@ void ReturnLastValue(MachineType type) {
     Handle<Code> code = Pipeline::GenerateCodeForTesting(
         &info, handles.main_isolate(), desc, m.graph(), m.Export());
 
+    std::unique_ptr<wasm::NativeModule> module =
+        AllocateNativeModule(handles.main_isolate(), code->instruction_size());
+    byte* code_start = module->AddCodeCopy(code, wasm::WasmCode::kFunction, 0)
+                           ->instructions()
+                           .start();
+
     // Generate caller.
     int expect = return_count - 1;
     RawMachineAssemblerTester<int32_t> mt;
-    Node* code_node = mt.HeapConstant(code);
+    Node* inputs[] = {mt.PointerConstant(code_start),
+                      // WasmContext dummy
+                      mt.PointerConstant(nullptr)};
 
-    Node* call = mt.AddNode(mt.common()->Call(desc), 1, &code_node);
+    Node* call = mt.AddNode(mt.common()->Call(desc), 2, inputs);
 
     mt.Return(ToInt32(
         mt, type, mt.AddNode(mt.common()->Projection(return_count - 1), call)));
@@ -326,10 +290,11 @@ void ReturnSumOfReturns(MachineType type) {
     v8::internal::AccountingAllocator allocator;
     Zone zone(&allocator, ZONE_NAME);
     // Let {unused_stack_slots + 1} returns be on the stack.
-    const int return_count = num_registers(type) + unused_stack_slots + 1;
+    // The wasm-linkage provides 2 return registers at the moment, on all
+    // platforms.
+    const int return_count = 2 + unused_stack_slots + 1;
 
-    CallDescriptor* desc =
-        CreateMonoCallDescriptor(&zone, return_count, 0, type);
+    CallDescriptor* desc = CreateCallDescriptor(&zone, return_count, 0, type);
 
     HandleAndZoneScope handles;
     RawMachineAssembler m(handles.main_isolate(),
@@ -350,11 +315,19 @@ void ReturnSumOfReturns(MachineType type) {
     Handle<Code> code = Pipeline::GenerateCodeForTesting(
         &info, handles.main_isolate(), desc, m.graph(), m.Export());
 
+    std::unique_ptr<wasm::NativeModule> module =
+        AllocateNativeModule(handles.main_isolate(), code->instruction_size());
+    byte* code_start = module->AddCodeCopy(code, wasm::WasmCode::kFunction, 0)
+                           ->instructions()
+                           .start();
+
     // Generate caller.
     RawMachineAssemblerTester<int32_t> mt;
-    Node* code_node = mt.HeapConstant(code);
+    Node* call_inputs[] = {mt.PointerConstant(code_start),
+                           // WasmContext dummy
+                           mt.PointerConstant(nullptr)};
 
-    Node* call = mt.AddNode(mt.common()->Call(desc), 1, &code_node);
+    Node* call = mt.AddNode(mt.common()->Call(desc), 2, call_inputs);
 
     uint32_t expect = 0;
     Node* result = mt.Int32Constant(0);
diff --git a/deps/v8/test/cctest/compiler/test-representation-change.cc b/deps/v8/test/cctest/compiler/test-representation-change.cc
index 08cd73f4ce6..4f663ed6587 100644
--- a/deps/v8/test/cctest/compiler/test-representation-change.cc
+++ b/deps/v8/test/cctest/compiler/test-representation-change.cc
@@ -429,7 +429,7 @@ TEST(SignednessInWord32) {
   CheckChange(IrOpcode::kCheckedTruncateTaggedToWord32,
               MachineRepresentation::kTagged, Type::NonInternal(),
               MachineRepresentation::kWord32,
-              UseInfo::CheckedNumberOrOddballAsWord32());
+              UseInfo::CheckedNumberOrOddballAsWord32(VectorSlotPair()));
 
   CheckTwoChanges(IrOpcode::kChangeInt32ToFloat64,
                   IrOpcode::kTruncateFloat64ToFloat32,
@@ -452,11 +452,13 @@ static void TestMinusZeroCheck(IrOpcode::Value expected, Type* from_type) {
       expected, MachineRepresentation::kFloat64, from_type,
       UseInfo::CheckedSignedSmallAsWord32(kIdentifyZeros, VectorSlotPair()));
 
-  CheckChange(expected, MachineRepresentation::kFloat64, from_type,
-              UseInfo::CheckedSigned32AsWord32(kDistinguishZeros));
+  CheckChange(
+      expected, MachineRepresentation::kFloat64, from_type,
+      UseInfo::CheckedSigned32AsWord32(kDistinguishZeros, VectorSlotPair()));
 
-  CheckChange(expected, MachineRepresentation::kFloat64, from_type,
-              UseInfo::CheckedSigned32AsWord32(kDistinguishZeros));
+  CheckChange(
+      expected, MachineRepresentation::kFloat64, from_type,
+      UseInfo::CheckedSigned32AsWord32(kDistinguishZeros, VectorSlotPair()));
 }
 
 TEST(MinusZeroCheck) {
diff --git a/deps/v8/test/cctest/compiler/test-run-bytecode-graph-builder.cc b/deps/v8/test/cctest/compiler/test-run-bytecode-graph-builder.cc
index ffcf0527a88..14c6dcc7e2c 100644
--- a/deps/v8/test/cctest/compiler/test-run-bytecode-graph-builder.cc
+++ b/deps/v8/test/cctest/compiler/test-run-bytecode-graph-builder.cc
@@ -618,9 +618,6 @@ TEST(BytecodeGraphBuilderCallRuntime) {
        {factory->true_value(), BytecodeGraphTester::NewObject("[1, 2, 3]")}},
       {"function f(arg0) { return %Add(arg0, 2) }\nf(1)",
        {factory->NewNumberFromInt(5), factory->NewNumberFromInt(3)}},
-      {"function f(arg0) { return %spread_arguments(arg0).length }\nf([])",
-       {factory->NewNumberFromInt(3),
-        BytecodeGraphTester::NewObject("[1, 2, 3]")}},
   };
 
   for (size_t i = 0; i < arraysize(snippets); i++) {
@@ -2971,7 +2968,6 @@ class CountBreakDebugDelegate : public v8::debug::DebugDelegate {
  public:
   void BreakProgramRequested(v8::Local<v8::Context> paused_context,
                              v8::Local<v8::Object> exec_state,
-                             v8::Local<v8::Value> break_points_hit,
                              const std::vector<int>&) override {
     debug_break_count++;
   }
diff --git a/deps/v8/test/cctest/compiler/test-run-machops.cc b/deps/v8/test/cctest/compiler/test-run-machops.cc
index 7f752b8872e..1af038a6661 100644
--- a/deps/v8/test/cctest/compiler/test-run-machops.cc
+++ b/deps/v8/test/cctest/compiler/test-run-machops.cc
@@ -6742,7 +6742,7 @@ TEST(RunComputedCodeObject) {
   CallDescriptor* c = Linkage::GetSimplifiedCDescriptor(r.zone(), &sig);
   LinkageLocation ret[] = {c->GetReturnLocation(0)};
   Signature<LinkageLocation> loc(1, 0, ret);
-  CallDescriptor* desc = new (r.zone()) CallDescriptor(  // --
+  auto call_descriptor = new (r.zone()) CallDescriptor(  // --
       CallDescriptor::kCallCodeObject,                   // kind
       MachineType::AnyTagged(),                          // target_type
       c->GetInputLocation(0),                            // target_loc
@@ -6753,7 +6753,7 @@ TEST(RunComputedCodeObject) {
       c->CalleeSavedFPRegisters(),                       // callee saved FP
       CallDescriptor::kNoFlags,                          // flags
       "c-call-as-code");
-  Node* call = r.AddNode(r.common()->Call(desc), phi);
+  Node* call = r.AddNode(r.common()->Call(call_descriptor), phi);
   r.Return(call);
 
   CHECK_EQ(33, r.Call(1));
@@ -6899,29 +6899,6 @@ TEST(Regression738952) {
   CHECK_EQ(sentinel, m.Call());
 }
 
-TEST(Regression6640) {
-  RawMachineAssemblerTester<int32_t> m;
-
-  int32_t old_value = 0;
-  int32_t new_value = 1;
-  Node* c = m.RelocatableInt32Constant(
-      old_value, RelocInfo::WASM_FUNCTION_TABLE_SIZE_REFERENCE);
-  m.Return(m.Word32Equal(c, c));
-
-  // Patch the code.
-  Handle<Code> code = m.GetCode();
-  for (RelocIterator it(*code,
-                        1 << RelocInfo::WASM_FUNCTION_TABLE_SIZE_REFERENCE);
-       !it.done(); it.next()) {
-    // TODO(6792): No longer needed once WebAssembly code is off heap.
-    CodeSpaceMemoryModificationScope modification_scope(code->GetHeap());
-    it.rinfo()->update_wasm_function_table_size_reference(
-        code->GetIsolate(), old_value, new_value, FLUSH_ICACHE_IF_NEEDED);
-  }
-
-  CHECK(m.Call());
-}
-
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/compiler/test-run-native-calls.cc b/deps/v8/test/cctest/compiler/test-run-native-calls.cc
index 42196e6454b..c9c327553cc 100644
--- a/deps/v8/test/cctest/compiler/test-run-native-calls.cc
+++ b/deps/v8/test/cctest/compiler/test-run-native-calls.cc
@@ -252,13 +252,12 @@ class Int32Signature : public MachineSignature {
   }
 };
 
-
-Handle<Code> CompileGraph(const char* name, CallDescriptor* desc, Graph* graph,
-                          Schedule* schedule = nullptr) {
+Handle<Code> CompileGraph(const char* name, CallDescriptor* call_descriptor,
+                          Graph* graph, Schedule* schedule = nullptr) {
   Isolate* isolate = CcTest::InitIsolateOnce();
   CompilationInfo info(ArrayVector("testing"), graph->zone(), Code::STUB);
-  Handle<Code> code =
-      Pipeline::GenerateCodeForTesting(&info, isolate, desc, graph, schedule);
+  Handle<Code> code = Pipeline::GenerateCodeForTesting(
+      &info, isolate, call_descriptor, graph, schedule);
   CHECK(!code.is_null());
 #ifdef ENABLE_DISASSEMBLER
   if (FLAG_print_opt_code) {
@@ -269,10 +268,10 @@ Handle<Code> CompileGraph(const char* name, CallDescriptor* desc, Graph* graph,
   return code;
 }
 
-
-Handle<Code> WrapWithCFunction(Handle<Code> inner, CallDescriptor* desc) {
+Handle<Code> WrapWithCFunction(Handle<Code> inner,
+                               CallDescriptor* call_descriptor) {
   Zone zone(inner->GetIsolate()->allocator(), ZONE_NAME);
-  int param_count = static_cast<int>(desc->ParameterCount());
+  int param_count = static_cast<int>(call_descriptor->ParameterCount());
   GraphAndBuilders caller(&zone);
   {
     GraphAndBuilders& b = caller;
@@ -292,15 +291,15 @@ Handle<Code> WrapWithCFunction(Handle<Code> inner, CallDescriptor* desc) {
     args[index++] = start;  // control.
 
     // Build the call and return nodes.
-    Node* call =
-        b.graph()->NewNode(b.common()->Call(desc), param_count + 3, args);
+    Node* call = b.graph()->NewNode(b.common()->Call(call_descriptor),
+                                    param_count + 3, args);
     Node* zero = b.graph()->NewNode(b.common()->Int32Constant(0));
     Node* ret =
         b.graph()->NewNode(b.common()->Return(), zero, call, call, start);
     b.graph()->SetEnd(ret);
   }
 
-  MachineSignature* msig = desc->GetMachineSignature(&zone);
+  MachineSignature* msig = call_descriptor->GetMachineSignature(&zone);
   CallDescriptor* cdesc = Linkage::GetSimplifiedCDescriptor(&zone, msig);
 
   return CompileGraph("wrapper", cdesc, caller.graph());
@@ -419,9 +418,8 @@ void ArgsBuffer<float64>::Mutate() {
   seed_++;
 }
 
-
-int ParamCount(CallDescriptor* desc) {
-  return static_cast<int>(desc->ParameterCount());
+int ParamCount(CallDescriptor* call_descriptor) {
+  return static_cast<int>(call_descriptor->ParameterCount());
 }
 
 
@@ -638,8 +636,7 @@ static void Test_RunInt32SubWithRet(int retreg) {
     Allocator params(parray, 2, nullptr, 0);
     Allocator rets(rarray, 1, nullptr, 0);
     RegisterConfig config(params, rets);
-    CallDescriptor* desc = config.Create(&zone, &sig);
-    TestInt32Sub(desc);
+    TestInt32Sub(config.Create(&zone, &sig));
   }
 }
 
@@ -687,8 +684,7 @@ TEST(Run_Int32Sub_all_allocatable_single) {
     Allocator params(parray, 1, nullptr, 0);
     Allocator rets(rarray, 1, nullptr, 0);
     RegisterConfig config(params, rets);
-    CallDescriptor* desc = config.Create(&zone, &sig);
-    TestInt32Sub(desc);
+    TestInt32Sub(config.Create(&zone, &sig));
   }
 }
 
@@ -705,8 +701,7 @@ TEST(Run_CopyTwentyInt32_all_allocatable_pairs) {
     Allocator params(parray, 2, nullptr, 0);
     Allocator rets(rarray, 1, nullptr, 0);
     RegisterConfig config(params, rets);
-    CallDescriptor* desc = config.Create(&zone, &sig);
-    CopyTwentyInt32(desc);
+    CopyTwentyInt32(config.Create(&zone, &sig));
   }
 }
 
diff --git a/deps/v8/test/cctest/compiler/test-run-retpoline.cc b/deps/v8/test/cctest/compiler/test-run-retpoline.cc
index 152ed448efd..4e5f99f4136 100644
--- a/deps/v8/test/cctest/compiler/test-run-retpoline.cc
+++ b/deps/v8/test/cctest/compiler/test-run-retpoline.cc
@@ -20,10 +20,10 @@ namespace {
 
 // Function that takes a number of pointer-sized integer arguments, calculates a
 // weighted sum of them and returns it.
-Handle<Code> BuildCallee(Isolate* isolate, CallDescriptor* descriptor) {
-  CodeAssemblerTester tester(isolate, descriptor, "callee");
+Handle<Code> BuildCallee(Isolate* isolate, CallDescriptor* call_descriptor) {
+  CodeAssemblerTester tester(isolate, call_descriptor, "callee");
   CodeStubAssembler assembler(tester.state());
-  int param_count = static_cast<int>(descriptor->StackParameterCount());
+  int param_count = static_cast<int>(call_descriptor->StackParameterCount());
   Node* sum = __ IntPtrConstant(0);
   for (int i = 0; i < param_count; ++i) {
     Node* product = __ IntPtrMul(__ Parameter(i), __ IntPtrConstant(i + 1));
@@ -35,9 +35,9 @@ Handle<Code> BuildCallee(Isolate* isolate, CallDescriptor* descriptor) {
 
 // Function that tail-calls another function with a number of pointer-sized
 // integer arguments.
-Handle<Code> BuildCaller(Isolate* isolate, CallDescriptor* descriptor,
+Handle<Code> BuildCaller(Isolate* isolate, CallDescriptor* call_descriptor,
                          CallDescriptor* callee_descriptor, bool tail) {
-  CodeAssemblerTester tester(isolate, descriptor, "caller");
+  CodeAssemblerTester tester(isolate, call_descriptor, "caller");
   CodeStubAssembler assembler(tester.state());
   std::vector<Node*> params;
   // The first parameter is always the callee.
diff --git a/deps/v8/test/cctest/compiler/test-run-tail-calls.cc b/deps/v8/test/cctest/compiler/test-run-tail-calls.cc
index 2fbc90d46da..34d6212d737 100644
--- a/deps/v8/test/cctest/compiler/test-run-tail-calls.cc
+++ b/deps/v8/test/cctest/compiler/test-run-tail-calls.cc
@@ -21,10 +21,10 @@ namespace {
 
 // Function that takes a number of pointer-sized integer arguments, calculates a
 // weighted sum of them and returns it.
-Handle<Code> BuildCallee(Isolate* isolate, CallDescriptor* descriptor) {
-  CodeAssemblerTester tester(isolate, descriptor, "callee");
+Handle<Code> BuildCallee(Isolate* isolate, CallDescriptor* call_descriptor) {
+  CodeAssemblerTester tester(isolate, call_descriptor, "callee");
   CodeStubAssembler assembler(tester.state());
-  int param_count = static_cast<int>(descriptor->StackParameterCount());
+  int param_count = static_cast<int>(call_descriptor->StackParameterCount());
   Node* sum = __ IntPtrConstant(0);
   for (int i = 0; i < param_count; ++i) {
     Node* product = __ IntPtrMul(__ Parameter(i), __ IntPtrConstant(i + 1));
@@ -36,9 +36,9 @@ Handle<Code> BuildCallee(Isolate* isolate, CallDescriptor* descriptor) {
 
 // Function that tail-calls another function with a number of pointer-sized
 // integer arguments.
-Handle<Code> BuildCaller(Isolate* isolate, CallDescriptor* descriptor,
+Handle<Code> BuildCaller(Isolate* isolate, CallDescriptor* call_descriptor,
                          CallDescriptor* callee_descriptor) {
-  CodeAssemblerTester tester(isolate, descriptor, "caller");
+  CodeAssemblerTester tester(isolate, call_descriptor, "caller");
   CodeStubAssembler assembler(tester.state());
   std::vector<Node*> params;
   // The first parameter is always the callee.
diff --git a/deps/v8/test/cctest/compiler/test-run-wasm-machops.cc b/deps/v8/test/cctest/compiler/test-run-wasm-machops.cc
index 2f1536433fa..8311c2e0018 100644
--- a/deps/v8/test/cctest/compiler/test-run-wasm-machops.cc
+++ b/deps/v8/test/cctest/compiler/test-run-wasm-machops.cc
@@ -20,29 +20,6 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-static void UpdateFunctionTableSizeReferences(Handle<Code> code,
-                                              uint32_t old_size,
-                                              uint32_t new_size) {
-  Isolate* isolate = CcTest::i_isolate();
-  // TODO(6792): No longer needed once WebAssembly code is off heap.
-  CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
-  bool modified = false;
-  int mode_mask =
-      RelocInfo::ModeMask(RelocInfo::WASM_FUNCTION_TABLE_SIZE_REFERENCE);
-  for (RelocIterator it(*code, mode_mask); !it.done(); it.next()) {
-    RelocInfo::Mode mode = it.rinfo()->rmode();
-    if (RelocInfo::IsWasmFunctionTableSizeReference(mode)) {
-      it.rinfo()->update_wasm_function_table_size_reference(isolate, old_size,
-                                                            new_size);
-      modified = true;
-    }
-  }
-  if (modified) {
-    Assembler::FlushICache(isolate, code->instruction_start(),
-                           code->instruction_size());
-  }
-}
-
 template <typename CType>
 static void RunLoadStoreRelocation(MachineType rep) {
   const int kNumElems = 2;
@@ -174,28 +151,6 @@ TEST(Uint32LessThanMemoryRelocation) {
   CHECK_EQ(0xACEDu, m.Call());
 }
 
-TEST(Uint32LessThanFunctionTableRelocation) {
-  RawMachineAssemblerTester<uint32_t> m;
-  RawMachineLabel within_bounds, out_of_bounds;
-  Node* index = m.Int32Constant(0x200);
-  Node* limit = m.RelocatableInt32Constant(
-      0x200, RelocInfo::WASM_FUNCTION_TABLE_SIZE_REFERENCE);
-  Node* cond = m.AddNode(m.machine()->Uint32LessThan(), index, limit);
-  m.Branch(cond, &within_bounds, &out_of_bounds);
-  m.Bind(&within_bounds);
-  m.Return(m.Int32Constant(0xACED));
-  m.Bind(&out_of_bounds);
-  m.Return(m.Int32Constant(0xDEADBEEF));
-  // Check that index is out of bounds with current size
-  CHECK_EQ(0xDEADBEEF, m.Call());
-  m.GenerateCode();
-
-  Handle<Code> code = m.GetCode();
-  UpdateFunctionTableSizeReferences(code, 0x200, 0x400);
-  // Check that after limit is increased, index is within bounds.
-  CHECK_EQ(0xACED, m.Call());
-}
-
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/compiler/value-helper.h b/deps/v8/test/cctest/compiler/value-helper.h
index a69a371e369..9350a98a70d 100644
--- a/deps/v8/test/cctest/compiler/value-helper.h
+++ b/deps/v8/test/cctest/compiler/value-helper.h
@@ -31,27 +31,27 @@ class ValueHelper {
 
   void CheckFloat64Constant(double expected, Node* node) {
     CHECK_EQ(IrOpcode::kFloat64Constant, node->opcode());
-    CHECK_EQ(expected, OpParameter<double>(node));
+    CHECK_EQ(expected, OpParameter<double>(node->op()));
   }
 
   void CheckNumberConstant(double expected, Node* node) {
     CHECK_EQ(IrOpcode::kNumberConstant, node->opcode());
-    CHECK_EQ(expected, OpParameter<double>(node));
+    CHECK_EQ(expected, OpParameter<double>(node->op()));
   }
 
   void CheckInt32Constant(int32_t expected, Node* node) {
     CHECK_EQ(IrOpcode::kInt32Constant, node->opcode());
-    CHECK_EQ(expected, OpParameter<int32_t>(node));
+    CHECK_EQ(expected, OpParameter<int32_t>(node->op()));
   }
 
   void CheckUint32Constant(int32_t expected, Node* node) {
     CHECK_EQ(IrOpcode::kInt32Constant, node->opcode());
-    CHECK_EQ(expected, OpParameter<int32_t>(node));
+    CHECK_EQ(expected, OpParameter<int32_t>(node->op()));
   }
 
   void CheckHeapConstant(HeapObject* expected, Node* node) {
     CHECK_EQ(IrOpcode::kHeapConstant, node->opcode());
-    CHECK_EQ(expected, *OpParameter<Handle<HeapObject>>(node));
+    CHECK_EQ(expected, *HeapConstantOf(node->op()));
   }
 
   void CheckTrue(Node* node) {
diff --git a/deps/v8/test/cctest/heap/test-concurrent-marking.cc b/deps/v8/test/cctest/heap/test-concurrent-marking.cc
index 5ee99c63204..d90d13cac5e 100644
--- a/deps/v8/test/cctest/heap/test-concurrent-marking.cc
+++ b/deps/v8/test/cctest/heap/test-concurrent-marking.cc
@@ -44,8 +44,8 @@ TEST(ConcurrentMarking) {
       new ConcurrentMarking(heap, &shared, &bailout, &on_hold, &weak_objects);
   PublishSegment(&shared, heap->undefined_value());
   concurrent_marking->ScheduleTasks();
-  concurrent_marking->WaitForTasks();
-  concurrent_marking->EnsureCompleted();
+  concurrent_marking->Stop(
+      ConcurrentMarking::StopRequest::COMPLETE_TASKS_FOR_TESTING);
   delete concurrent_marking;
 }
 
@@ -66,12 +66,39 @@ TEST(ConcurrentMarkingReschedule) {
       new ConcurrentMarking(heap, &shared, &bailout, &on_hold, &weak_objects);
   PublishSegment(&shared, heap->undefined_value());
   concurrent_marking->ScheduleTasks();
-  concurrent_marking->WaitForTasks();
-  concurrent_marking->EnsureCompleted();
+  concurrent_marking->Stop(
+      ConcurrentMarking::StopRequest::COMPLETE_ONGOING_TASKS);
   PublishSegment(&shared, heap->undefined_value());
   concurrent_marking->RescheduleTasksIfNeeded();
-  concurrent_marking->WaitForTasks();
-  concurrent_marking->EnsureCompleted();
+  concurrent_marking->Stop(
+      ConcurrentMarking::StopRequest::COMPLETE_TASKS_FOR_TESTING);
+  delete concurrent_marking;
+}
+
+TEST(ConcurrentMarkingPreemptAndReschedule) {
+  if (!i::FLAG_concurrent_marking) return;
+  CcTest::InitializeVM();
+  Heap* heap = CcTest::heap();
+  CcTest::CollectAllGarbage();
+  if (!heap->incremental_marking()->IsStopped()) return;
+  MarkCompactCollector* collector = CcTest::heap()->mark_compact_collector();
+  if (collector->sweeping_in_progress()) {
+    collector->EnsureSweepingCompleted();
+  }
+
+  ConcurrentMarking::MarkingWorklist shared, bailout, on_hold;
+  WeakObjects weak_objects;
+  ConcurrentMarking* concurrent_marking =
+      new ConcurrentMarking(heap, &shared, &bailout, &on_hold, &weak_objects);
+  for (int i = 0; i < 5000; i++)
+    PublishSegment(&shared, heap->undefined_value());
+  concurrent_marking->ScheduleTasks();
+  concurrent_marking->Stop(ConcurrentMarking::StopRequest::PREEMPT_TASKS);
+  for (int i = 0; i < 5000; i++)
+    PublishSegment(&shared, heap->undefined_value());
+  concurrent_marking->RescheduleTasksIfNeeded();
+  concurrent_marking->Stop(
+      ConcurrentMarking::StopRequest::COMPLETE_TASKS_FOR_TESTING);
   delete concurrent_marking;
 }
 
@@ -85,8 +112,8 @@ TEST(ConcurrentMarkingMarkedBytes) {
   CcTest::CollectAllGarbage();
   if (!heap->incremental_marking()->IsStopped()) return;
   heap::SimulateIncrementalMarking(heap, false);
-  heap->concurrent_marking()->WaitForTasks();
-  heap->concurrent_marking()->EnsureCompleted();
+  heap->concurrent_marking()->Stop(
+      ConcurrentMarking::StopRequest::COMPLETE_TASKS_FOR_TESTING);
   CHECK_GE(heap->concurrent_marking()->TotalMarkedBytes(), root->Size());
 }
 
diff --git a/deps/v8/test/cctest/heap/test-heap.cc b/deps/v8/test/cctest/heap/test-heap.cc
index d14d39b9ee5..28b97be8738 100644
--- a/deps/v8/test/cctest/heap/test-heap.cc
+++ b/deps/v8/test/cctest/heap/test-heap.cc
@@ -112,8 +112,6 @@ TEST(ContextMaps) {
                            Context::STRING_FUNCTION_INDEX);
   VerifyStoredPrototypeMap(isolate, Context::REGEXP_PROTOTYPE_MAP_INDEX,
                            Context::REGEXP_FUNCTION_INDEX);
-  VerifyStoredPrototypeMap(isolate, Context::PROMISE_PROTOTYPE_MAP_INDEX,
-                           Context::PROMISE_FUNCTION_INDEX);
 }
 
 TEST(InitialObjects) {
@@ -124,9 +122,6 @@ TEST(InitialObjects) {
   CHECK_EQ(
       context->initial_array_iterator_prototype(),
       *v8::Utils::OpenHandle(*CompileRun("[][Symbol.iterator]().__proto__")));
-  // Initial ArrayIterator prototype map.
-  CHECK_EQ(context->initial_array_iterator_prototype_map(),
-           context->initial_array_iterator_prototype()->map());
   // Initial Array prototype.
   CHECK_EQ(context->initial_array_prototype(),
            *v8::Utils::OpenHandle(*CompileRun("Array.prototype")));
@@ -1333,35 +1328,45 @@ TEST(CompilationCacheCachingBehavior) {
   }
 
   // The script should be in the cache now.
-  InfoVectorPair pair = compilation_cache->LookupScript(
-      source, Handle<Object>(), 0, 0, v8::ScriptOriginOptions(true, false),
-      native_context, language_mode);
-  CHECK(pair.has_shared());
-
-  // Check that the code cache entry survives at least on GC.
-  // (Unless --optimize-for-size, in which case it might get collected
-  // immediately.)
-  if (!FLAG_optimize_for_size) {
-    CcTest::CollectAllGarbage();
-    pair = compilation_cache->LookupScript(source, Handle<Object>(), 0, 0,
-                                           v8::ScriptOriginOptions(true, false),
-                                           native_context, language_mode);
-    CHECK(pair.has_shared());
+  {
+    v8::HandleScope scope(CcTest::isolate());
+    MaybeHandle<SharedFunctionInfo> cached_script =
+        compilation_cache->LookupScript(source, Handle<Object>(), 0, 0,
+                                        v8::ScriptOriginOptions(true, false),
+                                        native_context, language_mode);
+    CHECK(!cached_script.is_null());
   }
 
-  // Progress code age until it's old and ready for GC.
-  const int kAgingThreshold = 6;
-  for (int i = 0; i < kAgingThreshold; i++) {
-    CHECK(pair.shared()->HasBytecodeArray());
-    pair.shared()->bytecode_array()->MakeOlder();
+  // Check that the code cache entry survives at least one GC.
+  {
+    CcTest::CollectAllGarbage();
+    v8::HandleScope scope(CcTest::isolate());
+    MaybeHandle<SharedFunctionInfo> cached_script =
+        compilation_cache->LookupScript(source, Handle<Object>(), 0, 0,
+                                        v8::ScriptOriginOptions(true, false),
+                                        native_context, language_mode);
+    CHECK(!cached_script.is_null());
+
+    // Progress code age until it's old and ready for GC.
+    Handle<SharedFunctionInfo> shared = cached_script.ToHandleChecked();
+    CHECK(shared->HasBytecodeArray());
+    const int kAgingThreshold = 6;
+    for (int i = 0; i < kAgingThreshold; i++) {
+      shared->bytecode_array()->MakeOlder();
+    }
   }
 
   CcTest::CollectAllGarbage();
-  // Ensure code aging cleared the entry from the cache.
-  pair = compilation_cache->LookupScript(source, Handle<Object>(), 0, 0,
-                                         v8::ScriptOriginOptions(true, false),
-                                         native_context, language_mode);
-  CHECK(!pair.has_shared());
+
+  {
+    v8::HandleScope scope(CcTest::isolate());
+    // Ensure code aging cleared the entry from the cache.
+    MaybeHandle<SharedFunctionInfo> cached_script =
+        compilation_cache->LookupScript(source, Handle<Object>(), 0, 0,
+                                        v8::ScriptOriginOptions(true, false),
+                                        native_context, language_mode);
+    CHECK(cached_script.is_null());
+  }
 }
 
 
@@ -3031,14 +3036,8 @@ static void CheckVectorIC(Handle<JSFunction> f, int slot_index,
   Handle<FeedbackVector> vector = Handle<FeedbackVector>(f->feedback_vector());
   FeedbackVectorHelper helper(vector);
   FeedbackSlot slot = helper.slot(slot_index);
-  if (vector->IsLoadIC(slot)) {
-    LoadICNexus nexus(vector, slot);
-    CHECK(nexus.StateFromFeedback() == desired_state);
-  } else {
-    CHECK(vector->IsKeyedLoadIC(slot));
-    KeyedLoadICNexus nexus(vector, slot);
-    CHECK(nexus.StateFromFeedback() == desired_state);
-  }
+  FeedbackNexus nexus(vector, slot);
+  CHECK(nexus.StateFromFeedback() == desired_state);
 }
 
 TEST(IncrementalMarkingPreservesMonomorphicConstructor) {
@@ -3408,7 +3407,8 @@ TEST(LargeObjectSlotRecording) {
 
 class DummyVisitor : public RootVisitor {
  public:
-  void VisitRootPointers(Root root, Object** start, Object** end) override {}
+  void VisitRootPointers(Root root, const char* description, Object** start,
+                         Object** end) override {}
 };
 
 
@@ -3803,57 +3803,6 @@ TEST(NewSpaceObjectsInOptimizedCode) {
   CHECK(code->marked_for_deoptimization());
 }
 
-TEST(NoWeakHashTableLeakWithIncrementalMarking) {
-  if (FLAG_always_opt || !FLAG_opt) return;
-  if (!FLAG_incremental_marking) return;
-  FLAG_allow_natives_syntax = true;
-  FLAG_compilation_cache = false;
-  FLAG_retain_maps_for_n_gc = 0;
-  CcTest::InitializeVM();
-  Isolate* isolate = CcTest::i_isolate();
-
-  // Do not run for no-snap builds.
-  if (!i::Snapshot::HasContextSnapshot(isolate, 0)) return;
-
-  v8::internal::Heap* heap = CcTest::heap();
-
-  // Get a clean slate regarding optimized functions on the heap.
-  i::Deoptimizer::DeoptimizeAll(isolate);
-  CcTest::CollectAllGarbage();
-
-  if (!isolate->use_optimizer()) return;
-  HandleScope outer_scope(heap->isolate());
-  for (int i = 0; i < 3; i++) {
-    heap::SimulateIncrementalMarking(heap);
-    {
-      LocalContext context;
-      HandleScope scope(heap->isolate());
-      EmbeddedVector<char, 256> source;
-      SNPrintF(source,
-               "function bar%d() {"
-               "  return foo%d(1);"
-               "};"
-               "function foo%d(x) { with (x) { return 1 + x; } };"
-               "bar%d();"
-               "bar%d();"
-               "bar%d();"
-               "%%OptimizeFunctionOnNextCall(bar%d);"
-               "bar%d();",
-               i, i, i, i, i, i, i, i);
-      CompileRun(source.start());
-    }
-    // We have to abort incremental marking here to abandon black pages.
-    CcTest::CollectAllGarbage(Heap::kAbortIncrementalMarkingMask);
-  }
-  int elements = 0;
-  if (heap->weak_object_to_code_table()->IsHashTable()) {
-    WeakHashTable* t = WeakHashTable::cast(heap->weak_object_to_code_table());
-    elements = t->NumberOfElements();
-  }
-  CHECK_EQ(0, elements);
-}
-
-
 static Handle<JSFunction> OptimizeDummyFunction(v8::Isolate* isolate,
                                                 const char* name) {
   EmbeddedVector<char, 256> source;
@@ -4238,7 +4187,7 @@ void CheckIC(Handle<JSFunction> function, int slot_index,
              InlineCacheState state) {
   FeedbackVector* vector = function->feedback_vector();
   FeedbackSlot slot(slot_index);
-  LoadICNexus nexus(vector, slot);
+  FeedbackNexus nexus(vector, slot);
   CHECK_EQ(nexus.StateFromFeedback(), state);
 }
 
@@ -4772,15 +4721,16 @@ TEST(WritableVsImmortalRoots) {
   }
 }
 
-TEST(WeakFixedArray) {
+TEST(FixedArrayOfWeakCells) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
 
   Handle<HeapNumber> number = CcTest::i_isolate()->factory()->NewHeapNumber(1);
-  Handle<WeakFixedArray> array = WeakFixedArray::Add(Handle<Object>(), number);
+  Handle<FixedArrayOfWeakCells> array =
+      FixedArrayOfWeakCells::Add(Handle<Object>(), number);
   array->Remove(number);
-  array->Compact<WeakFixedArray::NullCallback>();
-  WeakFixedArray::Add(array, number);
+  array->Compact<FixedArrayOfWeakCells::NullCallback>();
+  FixedArrayOfWeakCells::Add(array, number);
 }
 
 
@@ -5026,7 +4976,6 @@ static void RemoveCodeAndGC(const v8::FunctionCallbackInfo<v8::Value>& args) {
   Handle<JSFunction> fun = Handle<JSFunction>::cast(obj);
   fun->shared()->ClearBytecodeArray();  // Bytecode is code too.
   fun->set_code(*BUILTIN_CODE(isolate, CompileLazy));
-  fun->shared()->set_code(*BUILTIN_CODE(isolate, CompileLazy));
   CcTest::CollectAllAvailableGarbage();
 }
 
@@ -5803,8 +5752,7 @@ Handle<Code> GenerateDummyImmovableCode(Isolate* isolate) {
   assm.GetCode(isolate, &desc);
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>(), Builtins::kNoBuiltinId,
-      HandlerTable::Empty(isolate), MaybeHandle<ByteArray>(),
-      DeoptimizationData::Empty(isolate), kImmovable);
+      MaybeHandle<ByteArray>(), DeoptimizationData::Empty(isolate), kImmovable);
   CHECK(code->IsCode());
 
   return code;
@@ -5954,6 +5902,73 @@ UNINITIALIZED_TEST(ReinitializeStringHashSeed) {
   }
 }
 
+const int kHeapLimit = 100 * MB;
+Isolate* oom_isolate = nullptr;
+
+void OOMCallback(const char* location, bool is_heap_oom) {
+  Heap* heap = oom_isolate->heap();
+  size_t kSlack = heap->new_space()->Capacity();
+  CHECK_LE(heap->OldGenerationCapacity(), kHeapLimit + kSlack);
+  CHECK_LE(heap->memory_allocator()->Size(), heap->MaxReserved() + kSlack);
+  base::OS::ExitProcess(0);
+}
+
+UNINITIALIZED_TEST(OutOfMemory) {
+  if (FLAG_stress_incremental_marking) return;
+#ifdef VERIFY_HEAP
+  if (FLAG_verify_heap) return;
+#endif
+  FLAG_max_old_space_size = kHeapLimit / MB;
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  v8::Isolate* isolate = v8::Isolate::New(create_params);
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+  oom_isolate = i_isolate;
+  isolate->SetOOMErrorHandler(OOMCallback);
+  {
+    Factory* factory = i_isolate->factory();
+    HandleScope handle_scope(i_isolate);
+    while (true) {
+      factory->NewFixedArray(100);
+    }
+  }
+}
+
+UNINITIALIZED_TEST(OutOfMemoryIneffectiveGC) {
+  if (!FLAG_detect_ineffective_gcs_near_heap_limit) return;
+  if (FLAG_stress_incremental_marking) return;
+#ifdef VERIFY_HEAP
+  if (FLAG_verify_heap) return;
+#endif
+
+  FLAG_max_old_space_size = kHeapLimit / MB;
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  v8::Isolate* isolate = v8::Isolate::New(create_params);
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+  oom_isolate = i_isolate;
+  isolate->SetOOMErrorHandler(OOMCallback);
+  Factory* factory = i_isolate->factory();
+  Heap* heap = i_isolate->heap();
+  heap->CollectAllGarbage(Heap::kNoGCFlags, GarbageCollectionReason::kTesting);
+  {
+    HandleScope scope(i_isolate);
+    while (heap->PromotedSpaceSizeOfObjects() <
+           heap->MaxOldGenerationSize() * 0.9) {
+      factory->NewFixedArray(100, TENURED);
+    }
+    {
+      int initial_ms_count = heap->ms_count();
+      while (heap->ms_count() < initial_ms_count + 10) {
+        HandleScope inner_scope(i_isolate);
+        factory->NewFixedArray(30000, TENURED);
+      }
+      CHECK_GE(heap->tracer()->AverageMarkCompactMutatorUtilization(), 0.09);
+    }
+  }
+  isolate->Dispose();
+}
+
 HEAP_TEST(Regress779503) {
   // The following regression test ensures that the Scavenger does not allocate
   // over invalid slots. More specific, the Scavenger should not sweep a page
@@ -5996,6 +6011,100 @@ HEAP_TEST(Regress779503) {
   CcTest::heap()->delay_sweeper_tasks_for_testing_ = false;
 }
 
+struct OutOfMemoryState {
+  Heap* heap;
+  bool oom_triggered;
+  size_t old_generation_capacity_at_oom;
+  size_t memory_allocator_size_at_oom;
+};
+
+size_t NearHeapLimitCallback(void* raw_state, size_t current_heap_limit,
+                             size_t initial_heap_limit) {
+  OutOfMemoryState* state = static_cast<OutOfMemoryState*>(raw_state);
+  Heap* heap = state->heap;
+  state->oom_triggered = true;
+  state->old_generation_capacity_at_oom = heap->OldGenerationCapacity();
+  state->memory_allocator_size_at_oom = heap->memory_allocator()->Size();
+  return initial_heap_limit + 100 * MB;
+}
+
+size_t MemoryAllocatorSizeFromHeapCapacity(size_t capacity) {
+  // Size to capacity factor.
+  double factor = Page::kPageSize * 1.0 / Page::kAllocatableMemory;
+  // Some tables (e.g. deoptimization table) are allocated directly with the
+  // memory allocator. Allow some slack to account for them.
+  size_t slack = 1 * MB;
+  return static_cast<size_t>(capacity * factor) + slack;
+}
+
+UNINITIALIZED_TEST(OutOfMemorySmallObjects) {
+  if (FLAG_stress_incremental_marking) return;
+#ifdef VERIFY_HEAP
+  if (FLAG_verify_heap) return;
+#endif
+  const size_t kOldGenerationLimit = 300 * MB;
+  FLAG_max_old_space_size = kOldGenerationLimit / MB;
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  Isolate* isolate =
+      reinterpret_cast<Isolate*>(v8::Isolate::New(create_params));
+  Heap* heap = isolate->heap();
+  Factory* factory = isolate->factory();
+  OutOfMemoryState state;
+  state.heap = heap;
+  state.oom_triggered = false;
+  heap->AddNearHeapLimitCallback(NearHeapLimitCallback, &state);
+  {
+    HandleScope handle_scope(isolate);
+    while (!state.oom_triggered) {
+      factory->NewFixedArray(100);
+    }
+  }
+  CHECK_LE(state.old_generation_capacity_at_oom,
+           kOldGenerationLimit + heap->new_space()->Capacity());
+  CHECK_LE(kOldGenerationLimit, state.old_generation_capacity_at_oom +
+                                    heap->new_space()->Capacity());
+  CHECK_LE(
+      state.memory_allocator_size_at_oom,
+      MemoryAllocatorSizeFromHeapCapacity(state.old_generation_capacity_at_oom +
+                                          2 * heap->new_space()->Capacity()));
+  reinterpret_cast<v8::Isolate*>(isolate)->Dispose();
+}
+
+UNINITIALIZED_TEST(OutOfMemoryLargeObjects) {
+  if (FLAG_stress_incremental_marking) return;
+#ifdef VERIFY_HEAP
+  if (FLAG_verify_heap) return;
+#endif
+  const size_t kOldGenerationLimit = 300 * MB;
+  FLAG_max_old_space_size = kOldGenerationLimit / MB;
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  Isolate* isolate =
+      reinterpret_cast<Isolate*>(v8::Isolate::New(create_params));
+  Heap* heap = isolate->heap();
+  Factory* factory = isolate->factory();
+  OutOfMemoryState state;
+  state.heap = heap;
+  state.oom_triggered = false;
+  heap->AddNearHeapLimitCallback(NearHeapLimitCallback, &state);
+  const int kFixedArrayLength = 1000000;
+  {
+    HandleScope handle_scope(isolate);
+    while (!state.oom_triggered) {
+      factory->NewFixedArray(kFixedArrayLength);
+    }
+  }
+  CHECK_LE(state.old_generation_capacity_at_oom, kOldGenerationLimit);
+  CHECK_LE(kOldGenerationLimit, state.old_generation_capacity_at_oom +
+                                    FixedArray::SizeFor(kFixedArrayLength));
+  CHECK_LE(
+      state.memory_allocator_size_at_oom,
+      MemoryAllocatorSizeFromHeapCapacity(state.old_generation_capacity_at_oom +
+                                          2 * heap->new_space()->Capacity()));
+  reinterpret_cast<v8::Isolate*>(isolate)->Dispose();
+}
+
 }  // namespace heap
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/heap/test-incremental-marking.cc b/deps/v8/test/cctest/heap/test-incremental-marking.cc
index 0548ba4ba4a..bbf630f0ba0 100644
--- a/deps/v8/test/cctest/heap/test-incremental-marking.cc
+++ b/deps/v8/test/cctest/heap/test-incremental-marking.cc
@@ -40,12 +40,20 @@ class MockPlatform : public TestPlatform {
   virtual ~MockPlatform() {
     delete task_;
     i::V8::SetPlatformForTesting(old_platform_);
+    for (auto& task : worker_tasks_) {
+      old_platform_->CallOnWorkerThread(std::move(task));
+    }
+    worker_tasks_.clear();
   }
 
   void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override {
     task_ = task;
   }
 
+  void CallOnWorkerThread(std::unique_ptr<Task> task) override {
+    worker_tasks_.push_back(std::move(task));
+  }
+
   bool IdleTasksEnabled(v8::Isolate* isolate) override { return false; }
 
   bool PendingTask() { return task_ != nullptr; }
@@ -59,6 +67,7 @@ class MockPlatform : public TestPlatform {
 
  private:
   Task* task_;
+  std::vector<std::unique_ptr<Task>> worker_tasks_;
   v8::Platform* old_platform_;
 };
 
diff --git a/deps/v8/test/cctest/heap/test-spaces.cc b/deps/v8/test/cctest/heap/test-spaces.cc
index bec9f978e8f..0040e9d77f2 100644
--- a/deps/v8/test/cctest/heap/test-spaces.cc
+++ b/deps/v8/test/cctest/heap/test-spaces.cc
@@ -80,12 +80,10 @@ class TestCodeRangeScope {
   DISALLOW_COPY_AND_ASSIGN(TestCodeRangeScope);
 };
 
-static void VerifyMemoryChunk(Isolate* isolate,
-                              Heap* heap,
-                              CodeRange* code_range,
-                              size_t reserve_area_size,
-                              size_t commit_area_size,
-                              Executability executable) {
+static void VerifyMemoryChunk(Isolate* isolate, Heap* heap,
+                              CodeRange* code_range, size_t reserve_area_size,
+                              size_t commit_area_size, Executability executable,
+                              Space* space) {
   MemoryAllocator* memory_allocator = new MemoryAllocator(isolate);
   CHECK(memory_allocator->SetUp(heap->MaxReserved(), 0));
   {
@@ -99,7 +97,7 @@ static void VerifyMemoryChunk(Isolate* isolate,
         (executable == EXECUTABLE) ? MemoryAllocator::CodePageGuardSize() : 0;
 
     MemoryChunk* memory_chunk = memory_allocator->AllocateChunk(
-        reserve_area_size, commit_area_size, executable, nullptr);
+        reserve_area_size, commit_area_size, executable, space);
     size_t alignment = code_range != nullptr && code_range->valid()
                            ? MemoryChunk::kAlignment
                            : CommitPageSize();
@@ -178,36 +176,22 @@ TEST(MemoryChunk) {
     const size_t code_range_size = 32 * MB;
     if (!code_range->SetUp(code_range_size)) return;
 
-    VerifyMemoryChunk(isolate,
-                      heap,
-                      code_range,
-                      reserve_area_size,
-                      initial_commit_area_size,
-                      EXECUTABLE);
-
-    VerifyMemoryChunk(isolate,
-                      heap,
-                      code_range,
-                      reserve_area_size,
-                      initial_commit_area_size,
-                      NOT_EXECUTABLE);
+    VerifyMemoryChunk(isolate, heap, code_range, reserve_area_size,
+                      initial_commit_area_size, EXECUTABLE, heap->code_space());
+
+    VerifyMemoryChunk(isolate, heap, code_range, reserve_area_size,
+                      initial_commit_area_size, NOT_EXECUTABLE,
+                      heap->old_space());
     delete code_range;
 
     // Without a valid CodeRange, i.e., omitting SetUp.
     code_range = new CodeRange(isolate);
-    VerifyMemoryChunk(isolate,
-                      heap,
-                      code_range,
-                      reserve_area_size,
-                      initial_commit_area_size,
-                      EXECUTABLE);
-
-    VerifyMemoryChunk(isolate,
-                      heap,
-                      code_range,
-                      reserve_area_size,
-                      initial_commit_area_size,
-                      NOT_EXECUTABLE);
+    VerifyMemoryChunk(isolate, heap, code_range, reserve_area_size,
+                      initial_commit_area_size, EXECUTABLE, heap->code_space());
+
+    VerifyMemoryChunk(isolate, heap, code_range, reserve_area_size,
+                      initial_commit_area_size, NOT_EXECUTABLE,
+                      heap->old_space());
     delete code_range;
   }
 }
@@ -381,8 +365,9 @@ TEST(SizeOfInitialHeap) {
   // Freshly initialized VM gets by with the snapshot size (which is below
   // kMaxInitialSizePerSpace per space).
   Heap* heap = isolate->heap();
-  int page_count[LAST_PAGED_SPACE + 1] = {0, 0, 0, 0};
-  for (int i = FIRST_PAGED_SPACE; i <= LAST_PAGED_SPACE; i++) {
+  int page_count[LAST_GROWABLE_PAGED_SPACE + 1] = {0, 0, 0, 0};
+  for (int i = FIRST_GROWABLE_PAGED_SPACE; i <= LAST_GROWABLE_PAGED_SPACE;
+       i++) {
     // Debug code can be very large, so skip CODE_SPACE if we are generating it.
     if (i == CODE_SPACE && i::FLAG_debug_code) continue;
 
@@ -394,7 +379,8 @@ TEST(SizeOfInitialHeap) {
   // Executing the empty script gets by with the same number of pages, i.e.,
   // requires no extra space.
   CompileRun("/*empty*/");
-  for (int i = FIRST_PAGED_SPACE; i <= LAST_PAGED_SPACE; i++) {
+  for (int i = FIRST_GROWABLE_PAGED_SPACE; i <= LAST_GROWABLE_PAGED_SPACE;
+       i++) {
     // Skip CODE_SPACE, since we had to generate code even for an empty script.
     if (i == CODE_SPACE) continue;
     CHECK_EQ(page_count[i], isolate->heap()->paged_space(i)->CountTotalPages());
diff --git a/deps/v8/test/cctest/heap/test-weak-references.cc b/deps/v8/test/cctest/heap/test-weak-references.cc
new file mode 100644
index 00000000000..eaffa9ced76
--- /dev/null
+++ b/deps/v8/test/cctest/heap/test-weak-references.cc
@@ -0,0 +1,392 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/api.h"
+#include "src/assembler-inl.h"
+#include "src/factory.h"
+#include "src/isolate.h"
+#include "test/cctest/cctest.h"
+#include "test/cctest/heap/heap-utils.h"
+
+namespace v8 {
+namespace internal {
+namespace heap {
+
+Handle<FeedbackVector> CreateFeedbackVectorForTest(
+    v8::Isolate* isolate, Factory* factory,
+    PretenureFlag pretenure_flag = NOT_TENURED) {
+  v8::Local<v8::Script> script =
+      v8::Script::Compile(isolate->GetCurrentContext(),
+                          v8::String::NewFromUtf8(isolate, "function foo() {}",
+                                                  v8::NewStringType::kNormal)
+                              .ToLocalChecked())
+          .ToLocalChecked();
+  Handle<Object> obj = v8::Utils::OpenHandle(*script);
+  Handle<SharedFunctionInfo> shared_function =
+      Handle<SharedFunctionInfo>(JSFunction::cast(*obj)->shared());
+  Handle<FeedbackVector> fv =
+      factory->NewFeedbackVector(shared_function, pretenure_flag);
+  return fv;
+}
+
+TEST(WeakReferencesBasic) {
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  Heap* heap = isolate->heap();
+  HandleScope outer_scope(isolate);
+
+  Handle<FeedbackVector> fv =
+      CreateFeedbackVectorForTest(CcTest::isolate(), factory);
+  CHECK(heap->InNewSpace(*fv));
+
+  MaybeObject* code_object = fv->optimized_code_weak_or_smi();
+  CHECK(code_object->IsSmi());
+  CcTest::CollectAllGarbage();
+  CHECK(heap->InNewSpace(*fv));
+  CHECK_EQ(code_object, fv->optimized_code_weak_or_smi());
+
+  {
+    HandleScope inner_scope(isolate);
+
+    // Create a new Code.
+    Assembler assm(isolate, nullptr, 0);
+    assm.nop();  // supported on all architectures
+    CodeDesc desc;
+    assm.GetCode(isolate, &desc);
+    Handle<Code> code =
+        isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
+    CHECK(code->IsCode());
+
+    fv->set_optimized_code_weak_or_smi(HeapObjectReference::Weak(*code));
+    HeapObject* code_heap_object;
+    CHECK(
+        fv->optimized_code_weak_or_smi()->ToWeakHeapObject(&code_heap_object));
+    CHECK_EQ(*code, code_heap_object);
+
+    CcTest::CollectAllGarbage();
+
+    CHECK(
+        fv->optimized_code_weak_or_smi()->ToWeakHeapObject(&code_heap_object));
+    CHECK_EQ(*code, code_heap_object);
+  }  // code will go out of scope.
+
+  CcTest::CollectAllGarbage();
+  CHECK(fv->optimized_code_weak_or_smi()->IsClearedWeakHeapObject());
+}
+
+TEST(WeakReferencesOldToOld) {
+  // Like WeakReferencesBasic, but the updated weak slot is in the old space,
+  // and referring to an old space object.
+  ManualGCScope manual_gc_scope;
+  FLAG_manual_evacuation_candidates_selection = true;
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  Heap* heap = isolate->heap();
+
+  HandleScope outer_scope(isolate);
+  Handle<FeedbackVector> fv =
+      CreateFeedbackVectorForTest(CcTest::isolate(), factory, TENURED);
+  CHECK(heap->InOldSpace(*fv));
+
+  // Create a new FixedArray which the FeedbackVector will point to.
+  Handle<FixedArray> fixed_array = factory->NewFixedArray(1, TENURED);
+  CHECK(heap->InOldSpace(*fixed_array));
+  fv->set_optimized_code_weak_or_smi(HeapObjectReference::Weak(*fixed_array));
+
+  Page* page_before_gc = Page::FromAddress(fixed_array->address());
+  heap::ForceEvacuationCandidate(page_before_gc);
+  CcTest::CollectAllGarbage();
+  CHECK(heap->InOldSpace(*fixed_array));
+
+  HeapObject* heap_object;
+  CHECK(fv->optimized_code_weak_or_smi()->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(heap_object, *fixed_array);
+}
+
+TEST(WeakReferencesOldToNew) {
+  // Like WeakReferencesBasic, but the updated weak slot is in the old space,
+  // and referring to an new space object.
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  Heap* heap = isolate->heap();
+
+  HandleScope outer_scope(isolate);
+  Handle<FeedbackVector> fv =
+      CreateFeedbackVectorForTest(CcTest::isolate(), factory, TENURED);
+  CHECK(heap->InOldSpace(*fv));
+
+  // Create a new FixedArray which the FeedbackVector will point to.
+  Handle<FixedArray> fixed_array = factory->NewFixedArray(1);
+  CHECK(heap->InNewSpace(*fixed_array));
+  fv->set_optimized_code_weak_or_smi(HeapObjectReference::Weak(*fixed_array));
+
+  CcTest::CollectAllGarbage();
+
+  HeapObject* heap_object;
+  CHECK(fv->optimized_code_weak_or_smi()->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(heap_object, *fixed_array);
+}
+
+TEST(WeakReferencesOldToNewScavenged) {
+  // Like WeakReferencesBasic, but the updated weak slot is in the old space,
+  // and referring to an new space object, which is then scavenged.
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  Heap* heap = isolate->heap();
+
+  HandleScope outer_scope(isolate);
+  Handle<FeedbackVector> fv =
+      CreateFeedbackVectorForTest(CcTest::isolate(), factory, TENURED);
+  CHECK(heap->InOldSpace(*fv));
+
+  // Create a new FixedArray which the FeedbackVector will point to.
+  Handle<FixedArray> fixed_array = factory->NewFixedArray(1);
+  CHECK(heap->InNewSpace(*fixed_array));
+  fv->set_optimized_code_weak_or_smi(HeapObjectReference::Weak(*fixed_array));
+
+  CcTest::CollectGarbage(NEW_SPACE);
+
+  HeapObject* heap_object;
+  CHECK(fv->optimized_code_weak_or_smi()->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(heap_object, *fixed_array);
+}
+
+TEST(WeakReferencesOldToCleared) {
+  // Like WeakReferencesBasic, but the updated weak slot is in the old space,
+  // and is cleared.
+  ManualGCScope manual_gc_scope;
+  FLAG_manual_evacuation_candidates_selection = true;
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  Heap* heap = isolate->heap();
+
+  HandleScope outer_scope(isolate);
+  Handle<FeedbackVector> fv =
+      CreateFeedbackVectorForTest(CcTest::isolate(), factory, TENURED);
+  CHECK(heap->InOldSpace(*fv));
+  fv->set_optimized_code_weak_or_smi(HeapObjectReference::ClearedValue());
+
+  CcTest::CollectAllGarbage();
+  CHECK(fv->optimized_code_weak_or_smi()->IsClearedWeakHeapObject());
+}
+
+TEST(ObjectMovesBeforeClearingWeakField) {
+  if (!FLAG_incremental_marking) {
+    return;
+  }
+  ManualGCScope manual_gc_scope;
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  Heap* heap = isolate->heap();
+
+  HandleScope outer_scope(isolate);
+  Handle<FeedbackVector> fv =
+      CreateFeedbackVectorForTest(CcTest::isolate(), factory);
+  CHECK(heap->InNewSpace(*fv));
+  FeedbackVector* fv_location = *fv;
+  {
+    HandleScope inner_scope(isolate);
+    // Create a new FixedArray which the FeedbackVector will point to.
+    Handle<FixedArray> fixed_array = factory->NewFixedArray(1);
+    CHECK(heap->InNewSpace(*fixed_array));
+    fv->set_optimized_code_weak_or_smi(HeapObjectReference::Weak(*fixed_array));
+    // inner_scope will go out of scope, so when marking the next time,
+    // *fixed_array will stay white.
+  }
+
+  // Do marking steps; this will store *fv into the list for later processing
+  // (since it points to a white object).
+  SimulateIncrementalMarking(heap, true);
+
+  // Scavenger will move *fv.
+  CcTest::CollectGarbage(NEW_SPACE);
+  FeedbackVector* new_fv_location = *fv;
+  CHECK_NE(fv_location, new_fv_location);
+  CHECK(fv->optimized_code_weak_or_smi()->IsWeakHeapObject());
+
+  // Now we try to clear *fv.
+  CcTest::CollectAllGarbage();
+  CHECK(fv->optimized_code_weak_or_smi()->IsClearedWeakHeapObject());
+}
+
+TEST(ObjectWithWeakReferencePromoted) {
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  Heap* heap = isolate->heap();
+
+  HandleScope outer_scope(isolate);
+  Handle<FeedbackVector> fv =
+      CreateFeedbackVectorForTest(CcTest::isolate(), factory);
+  CHECK(heap->InNewSpace(*fv));
+
+  // Create a new FixedArray which the FeedbackVector will point to.
+  Handle<FixedArray> fixed_array = factory->NewFixedArray(1);
+  CHECK(heap->InNewSpace(*fixed_array));
+  fv->set_optimized_code_weak_or_smi(HeapObjectReference::Weak(*fixed_array));
+
+  CcTest::CollectGarbage(NEW_SPACE);
+  CcTest::CollectGarbage(NEW_SPACE);
+  CHECK(heap->InOldSpace(*fv));
+  CHECK(heap->InOldSpace(*fixed_array));
+
+  HeapObject* heap_object;
+  CHECK(fv->optimized_code_weak_or_smi()->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(heap_object, *fixed_array);
+}
+
+TEST(ObjectWithClearedWeakReferencePromoted) {
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  Heap* heap = isolate->heap();
+
+  HandleScope outer_scope(isolate);
+  Handle<FeedbackVector> fv =
+      CreateFeedbackVectorForTest(CcTest::isolate(), factory);
+  CHECK(heap->InNewSpace(*fv));
+
+  fv->set_optimized_code_weak_or_smi(HeapObjectReference::ClearedValue());
+
+  CcTest::CollectGarbage(NEW_SPACE);
+  CHECK(heap->InNewSpace(*fv));
+  CHECK(fv->optimized_code_weak_or_smi()->IsClearedWeakHeapObject());
+
+  CcTest::CollectGarbage(NEW_SPACE);
+  CHECK(heap->InOldSpace(*fv));
+  CHECK(fv->optimized_code_weak_or_smi()->IsClearedWeakHeapObject());
+
+  CcTest::CollectAllGarbage();
+  CHECK(fv->optimized_code_weak_or_smi()->IsClearedWeakHeapObject());
+}
+
+TEST(WeakReferenceWriteBarrier) {
+  if (!FLAG_incremental_marking) {
+    return;
+  }
+
+  ManualGCScope manual_gc_scope;
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  Heap* heap = isolate->heap();
+
+  HandleScope outer_scope(isolate);
+  Handle<FeedbackVector> fv =
+      CreateFeedbackVectorForTest(CcTest::isolate(), factory);
+  CHECK(heap->InNewSpace(*fv));
+
+  {
+    HandleScope inner_scope(isolate);
+
+    // Create a new FixedArray which the FeedbackVector will point to.
+    Handle<FixedArray> fixed_array1 = factory->NewFixedArray(1);
+    CHECK(heap->InNewSpace(*fixed_array1));
+    fv->set_optimized_code_weak_or_smi(
+        HeapObjectReference::Weak(*fixed_array1));
+
+    SimulateIncrementalMarking(heap, true);
+
+    Handle<FixedArray> fixed_array2 = factory->NewFixedArray(1);
+    CHECK(heap->InNewSpace(*fixed_array2));
+    // This write will trigger the write barrier.
+    fv->set_optimized_code_weak_or_smi(
+        HeapObjectReference::Weak(*fixed_array2));
+  }
+
+  CcTest::CollectAllGarbage();
+
+  // Check that the write barrier treated the weak reference as strong.
+  CHECK(fv->optimized_code_weak_or_smi()->IsWeakHeapObject());
+}
+
+TEST(EmptyWeakArray) {
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  HandleScope outer_scope(isolate);
+
+  Handle<WeakFixedArray> array = factory->empty_weak_fixed_array();
+  CHECK(array->IsWeakFixedArray());
+  CHECK(!array->IsFixedArray());
+  CHECK_EQ(array->length(), 0);
+}
+
+TEST(WeakArraysBasic) {
+  ManualGCScope manual_gc_scope;
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  Heap* heap = isolate->heap();
+  HandleScope outer_scope(isolate);
+
+  const int length = 4;
+  Handle<WeakFixedArray> array = factory->NewWeakFixedArray(length);
+  CHECK(array->IsWeakFixedArray());
+  CHECK(!array->IsFixedArray());
+  CHECK_EQ(array->length(), length);
+  CHECK(heap->InNewSpace(*array));
+
+  for (int i = 0; i < length; ++i) {
+    HeapObject* heap_object;
+    CHECK(array->Get(i)->ToStrongHeapObject(&heap_object));
+    CHECK_EQ(heap_object, heap->undefined_value());
+  }
+
+  Handle<HeapObject> saved;
+  {
+    HandleScope inner_scope(isolate);
+    Handle<FixedArray> index0 = factory->NewFixedArray(1);
+    index0->set(0, Smi::FromInt(2016));
+    Handle<FixedArray> index1 = factory->NewFixedArray(1);
+    index1->set(0, Smi::FromInt(2017));
+
+    Handle<FixedArray> index2 = factory->NewFixedArray(1);
+    index2->set(0, Smi::FromInt(2018));
+    Handle<FixedArray> index3 = factory->NewFixedArray(1);
+    index3->set(0, Smi::FromInt(2019));
+
+    array->Set(0, HeapObjectReference::Weak(*index0));
+    array->Set(1, HeapObjectReference::Weak(*index1));
+    array->Set(2, HeapObjectReference::Strong(*index2));
+    array->Set(3, HeapObjectReference::Weak(*index3));
+    saved = inner_scope.CloseAndEscape(index1);
+  }  // inner_scope goes out of scope.
+
+  // The references are only cleared by the mark-compact (scavenger treats weak
+  // references as strong). Thus we need to GC until the array reaches old
+  // space.
+
+  // TODO(marja): update this when/if we do handle weak references in the new
+  // space.
+  CcTest::CollectGarbage(NEW_SPACE);
+  HeapObject* heap_object;
+  CHECK(array->Get(0)->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(Smi::cast(FixedArray::cast(heap_object)->get(0))->value(), 2016);
+  CHECK(array->Get(1)->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(Smi::cast(FixedArray::cast(heap_object)->get(0))->value(), 2017);
+  CHECK(array->Get(2)->ToStrongHeapObject(&heap_object));
+  CHECK_EQ(Smi::cast(FixedArray::cast(heap_object)->get(0))->value(), 2018);
+  CHECK(array->Get(3)->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(Smi::cast(FixedArray::cast(heap_object)->get(0))->value(), 2019);
+
+  CcTest::CollectAllGarbage();
+  CHECK(heap->InOldSpace(*array));
+  CHECK(array->Get(0)->IsClearedWeakHeapObject());
+  CHECK(array->Get(1)->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(Smi::cast(FixedArray::cast(heap_object)->get(0))->value(), 2017);
+  CHECK(array->Get(2)->ToStrongHeapObject(&heap_object));
+  CHECK_EQ(Smi::cast(FixedArray::cast(heap_object)->get(0))->value(), 2018);
+  CHECK(array->Get(3)->IsClearedWeakHeapObject());
+}
+
+}  // namespace heap
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/interpreter/bytecode-expectations-printer.cc b/deps/v8/test/cctest/interpreter/bytecode-expectations-printer.cc
index d6a93fdda20..802b588a1a1 100644
--- a/deps/v8/test/cctest/interpreter/bytecode-expectations-printer.cc
+++ b/deps/v8/test/cctest/interpreter/bytecode-expectations-printer.cc
@@ -348,11 +348,11 @@ void BytecodeExpectationsPrinter::PrintCodeSnippet(
 void BytecodeExpectationsPrinter::PrintHandlers(
     std::ostream& stream, i::Handle<i::BytecodeArray> bytecode_array) const {
   stream << "handlers: [\n";
-  HandlerTable* table = HandlerTable::cast(bytecode_array->handler_table());
-  for (int i = 0, num_entries = table->NumberOfRangeEntries(); i < num_entries;
+  HandlerTable table(*bytecode_array);
+  for (int i = 0, num_entries = table.NumberOfRangeEntries(); i < num_entries;
        ++i) {
-    stream << "  [" << table->GetRangeStart(i) << ", " << table->GetRangeEnd(i)
-           << ", " << table->GetRangeHandler(i) << "],\n";
+    stream << "  [" << table.GetRangeStart(i) << ", " << table.GetRangeEnd(i)
+           << ", " << table.GetRangeHandler(i) << "],\n";
   }
   stream << "]\n";
 }
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ArrayLiterals.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ArrayLiterals.golden
index 56878047c8f..d97780a4522 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ArrayLiterals.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ArrayLiterals.golden
@@ -35,17 +35,17 @@ bytecodes: [
   /*   42 S> */ B(LdaSmi), I8(1),
                 B(Star), R(0),
   /*   45 S> */ B(CreateArrayLiteral), U8(0), U8(0), U8(37),
-                B(Star), R(2),
-                B(LdaZero),
                 B(Star), R(1),
+                B(LdaZero),
+                B(Star), R(2),
                 B(Ldar), R(0),
-  /*   54 E> */ B(StaKeyedProperty), R(2), R(1), U8(1),
+  /*   54 E> */ B(StaKeyedProperty), R(1), R(2), U8(1),
                 B(LdaSmi), I8(1),
-                B(Star), R(1),
+                B(Star), R(2),
                 B(Ldar), R(0),
   /*   59 E> */ B(AddSmi), I8(1), U8(3),
-                B(StaKeyedProperty), R(2), R(1), U8(1),
-                B(Ldar), R(2),
+                B(StaKeyedProperty), R(1), R(2), U8(1),
+                B(Ldar), R(1),
   /*   65 S> */ B(Return),
 ]
 constant pool: [
@@ -84,29 +84,29 @@ bytecodes: [
   /*   42 S> */ B(LdaSmi), I8(1),
                 B(Star), R(0),
   /*   45 S> */ B(CreateArrayLiteral), U8(0), U8(0), U8(4),
-                B(Star), R(2),
-                B(LdaZero),
                 B(Star), R(1),
-                B(CreateArrayLiteral), U8(1), U8(3), U8(37),
-                B(Star), R(4),
                 B(LdaZero),
+                B(Star), R(2),
+                B(CreateArrayLiteral), U8(1), U8(3), U8(37),
                 B(Star), R(3),
+                B(LdaZero),
+                B(Star), R(4),
                 B(Ldar), R(0),
-  /*   56 E> */ B(StaKeyedProperty), R(4), R(3), U8(4),
-                B(Ldar), R(4),
-                B(StaKeyedProperty), R(2), R(1), U8(1),
+  /*   56 E> */ B(StaKeyedProperty), R(3), R(4), U8(4),
+                B(Ldar), R(3),
+                B(StaKeyedProperty), R(1), R(2), U8(1),
                 B(LdaSmi), I8(1),
-                B(Star), R(1),
+                B(Star), R(2),
                 B(CreateArrayLiteral), U8(2), U8(6), U8(37),
-                B(Star), R(4),
-                B(LdaZero),
                 B(Star), R(3),
+                B(LdaZero),
+                B(Star), R(4),
                 B(Ldar), R(0),
   /*   68 E> */ B(AddSmi), I8(2), U8(9),
-                B(StaKeyedProperty), R(4), R(3), U8(7),
-                B(Ldar), R(4),
-                B(StaKeyedProperty), R(2), R(1), U8(1),
-                B(Ldar), R(2),
+                B(StaKeyedProperty), R(3), R(4), U8(7),
+                B(Ldar), R(3),
+                B(StaKeyedProperty), R(1), R(2), U8(1),
+                B(Ldar), R(1),
   /*   76 S> */ B(Return),
 ]
 constant pool: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
index 50d084fbc16..df6b3723586 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
@@ -12,120 +12,109 @@ snippet: "
   async function* f() { }
   f();
 "
-frame size: 9
+frame size: 8
 parameter count: 1
-bytecode array length: 216
+bytecode array length: 192
 bytecodes: [
-                B(Ldar), R(0),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(0), U8(1),
-                B(PushContext), R(2),
-                B(RestoreGeneratorState), R(0),
-                B(Star), R(1),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(2), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(1),
-                B(Mov), R(closure), R(2),
-                B(Mov), R(this), R(3),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(2), U8(2),
+                B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
+                B(Mov), R(closure), R(1),
+                B(Mov), R(this), R(2),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(1), U8(2),
                 B(Star), R(0),
   /*   17 E> */ B(StackCheck),
+                B(Mov), R(context), R(3),
                 B(Mov), R(context), R(4),
-                B(Mov), R(context), R(5),
                 B(Ldar), R(0),
-  /*   17 E> */ B(SuspendGenerator), R(0), R(0), U8(6), U8(0),
-  /*   22 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(6),
-                B(Star), R(6),
+  /*   17 E> */ B(SuspendGenerator), R(0), R(0), U8(5), U8(0),
+                B(ResumeGenerator), R(0), R(0), U8(5),
+                B(Star), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(6),
+                B(Ldar), R(5),
   /*   17 E> */ B(Throw),
                 B(LdaZero),
-                B(Star), R(2),
-                B(Mov), R(6), R(3),
-                B(Jump), U8(100),
+                B(Star), R(1),
+                B(Mov), R(5), R(2),
+                B(Jump), U8(98),
                 B(LdaUndefined),
-                B(Star), R(7),
-                B(Mov), R(0), R(6),
-                B(CallJSRuntime), U8(%async_generator_await_uncaught), R(6), U8(2),
-                B(SuspendGenerator), R(0), R(0), U8(6), U8(1),
-  /*   22 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(6),
                 B(Star), R(6),
+                B(Mov), R(0), R(5),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorAwaitUncaught), R(5), U8(2),
+                B(SuspendGenerator), R(0), R(0), U8(5), U8(1),
+                B(ResumeGenerator), R(0), R(0), U8(5),
+                B(Star), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
-                B(Star), R(7),
+                B(Star), R(6),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(7),
+                B(TestEqualStrictNoFeedback), R(6),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(6),
+                B(Ldar), R(5),
                 B(ReThrow),
                 B(LdaZero),
-                B(Star), R(2),
-                B(Mov), R(6), R(3),
+                B(Star), R(1),
+                B(Mov), R(5), R(2),
                 B(Jump), U8(55),
                 B(Jump), U8(39),
-                B(Star), R(6),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(6), U8(4), U8(5),
                 B(Star), R(5),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(5), U8(4), U8(5),
+                B(Star), R(4),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(5),
-                B(PushContext), R(6),
+                B(Ldar), R(4),
+                B(PushContext), R(5),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(8),
-                B(Mov), R(0), R(7),
-                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorReject), R(7), U8(2),
-                B(PopContext), R(6),
-                B(Star), R(3),
-                B(LdaSmi), I8(1),
+                B(Star), R(7),
+                B(Mov), R(0), R(6),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorReject), R(6), U8(2),
+                B(PopContext), R(5),
                 B(Star), R(2),
+                B(LdaSmi), I8(1),
+                B(Star), R(1),
                 B(Jump), U8(16),
                 B(LdaSmi), I8(-1),
-                B(Star), R(3),
                 B(Star), R(2),
+                B(Star), R(1),
                 B(Jump), U8(8),
-                B(Star), R(3),
-                B(LdaSmi), I8(2),
                 B(Star), R(2),
+                B(LdaSmi), I8(2),
+                B(Star), R(1),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(4),
+                B(Star), R(3),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorClose), R(0), U8(1),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
                 B(SetPendingMessage),
-                B(Ldar), R(2),
+                B(Ldar), R(1),
                 B(SwitchOnSmiNoFeedback), U8(6), U8(3), I8(0),
                 B(Jump), U8(22),
                 B(LdaTrue),
-                B(Star), R(7),
-                B(Mov), R(0), R(5),
-                B(Mov), R(3), R(6),
-                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorResolve), R(5), U8(3),
+                B(Star), R(6),
+                B(Mov), R(0), R(4),
+                B(Mov), R(2), R(5),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorResolve), R(4), U8(3),
   /*   22 S> */ B(Return),
-                B(Ldar), R(3),
+                B(Ldar), R(2),
   /*   22 S> */ B(Return),
-                B(Ldar), R(3),
+                B(Ldar), R(2),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   22 S> */ B(Return),
 ]
 constant pool: [
-  Smi [37],
-  Smi [79],
+  Smi [30],
+  Smi [70],
   Smi [15],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   Smi [6],
   Smi [20],
   Smi [23],
 ]
 handlers: [
-  [40, 161, 169],
-  [43, 122, 124],
+  [20, 137, 145],
+  [23, 98, 100],
 ]
 
 ---
@@ -133,141 +122,129 @@ snippet: "
   async function* f() { yield 42 }
   f();
 "
-frame size: 9
+frame size: 8
 parameter count: 1
-bytecode array length: 262
+bytecode array length: 236
 bytecodes: [
-                B(Ldar), R(0),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(0), U8(1),
-                B(PushContext), R(2),
-                B(RestoreGeneratorState), R(0),
-                B(Star), R(1),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(3), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(1),
-                B(Mov), R(closure), R(2),
-                B(Mov), R(this), R(3),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(2), U8(2),
+                B(SwitchOnGeneratorState), R(0), U8(0), U8(3),
+                B(Mov), R(closure), R(1),
+                B(Mov), R(this), R(2),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(1), U8(2),
                 B(Star), R(0),
   /*   17 E> */ B(StackCheck),
+                B(Mov), R(context), R(3),
                 B(Mov), R(context), R(4),
-                B(Mov), R(context), R(5),
                 B(Ldar), R(0),
-  /*   17 E> */ B(SuspendGenerator), R(0), R(0), U8(6), U8(0),
-  /*   31 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(6),
-                B(Star), R(6),
+  /*   17 E> */ B(SuspendGenerator), R(0), R(0), U8(5), U8(0),
+                B(ResumeGenerator), R(0), R(0), U8(5),
+                B(Star), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(3), U8(2), I8(0),
-                B(Ldar), R(6),
+                B(Ldar), R(5),
   /*   17 E> */ B(Throw),
                 B(LdaZero),
-                B(Star), R(2),
-                B(Mov), R(6), R(3),
-                B(Jump), U8(146),
+                B(Star), R(1),
+                B(Mov), R(5), R(2),
+                B(Jump), U8(142),
   /*   22 S> */ B(LdaSmi), I8(42),
-                B(Star), R(7),
-                B(LdaFalse),
-                B(Star), R(8),
-                B(Mov), R(0), R(6),
-                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorYield), R(6), U8(3),
-                B(SuspendGenerator), R(0), R(0), U8(6), U8(1),
-  /*   31 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(6),
                 B(Star), R(6),
+                B(LdaFalse),
+                B(Star), R(7),
+                B(Mov), R(0), R(5),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorYield), R(5), U8(3),
+  /*   22 E> */ B(SuspendGenerator), R(0), R(0), U8(5), U8(1),
+                B(ResumeGenerator), R(0), R(0), U8(5),
+                B(Star), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(5), U8(2), I8(0),
-                B(Ldar), R(6),
+                B(Ldar), R(5),
   /*   22 E> */ B(Throw),
                 B(LdaZero),
-                B(Star), R(2),
-                B(Mov), R(6), R(3),
-                B(Jump), U8(100),
+                B(Star), R(1),
+                B(Mov), R(5), R(2),
+                B(Jump), U8(98),
                 B(LdaUndefined),
-                B(Star), R(7),
-                B(Mov), R(0), R(6),
-                B(CallJSRuntime), U8(%async_generator_await_uncaught), R(6), U8(2),
-                B(SuspendGenerator), R(0), R(0), U8(6), U8(2),
-  /*   31 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(6),
                 B(Star), R(6),
+                B(Mov), R(0), R(5),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorAwaitUncaught), R(5), U8(2),
+                B(SuspendGenerator), R(0), R(0), U8(5), U8(2),
+                B(ResumeGenerator), R(0), R(0), U8(5),
+                B(Star), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
-                B(Star), R(7),
+                B(Star), R(6),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(7),
+                B(TestEqualStrictNoFeedback), R(6),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(6),
+                B(Ldar), R(5),
                 B(ReThrow),
                 B(LdaZero),
-                B(Star), R(2),
-                B(Mov), R(6), R(3),
+                B(Star), R(1),
+                B(Mov), R(5), R(2),
                 B(Jump), U8(55),
                 B(Jump), U8(39),
-                B(Star), R(6),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(6), U8(7), U8(8),
                 B(Star), R(5),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(5), U8(7), U8(8),
+                B(Star), R(4),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(5),
-                B(PushContext), R(6),
+                B(Ldar), R(4),
+                B(PushContext), R(5),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(8),
-                B(Mov), R(0), R(7),
-                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorReject), R(7), U8(2),
-                B(PopContext), R(6),
-                B(Star), R(3),
-                B(LdaSmi), I8(1),
+                B(Star), R(7),
+                B(Mov), R(0), R(6),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorReject), R(6), U8(2),
+                B(PopContext), R(5),
                 B(Star), R(2),
+                B(LdaSmi), I8(1),
+                B(Star), R(1),
                 B(Jump), U8(16),
                 B(LdaSmi), I8(-1),
-                B(Star), R(3),
                 B(Star), R(2),
+                B(Star), R(1),
                 B(Jump), U8(8),
-                B(Star), R(3),
-                B(LdaSmi), I8(2),
                 B(Star), R(2),
+                B(LdaSmi), I8(2),
+                B(Star), R(1),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(4),
+                B(Star), R(3),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorClose), R(0), U8(1),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
                 B(SetPendingMessage),
-                B(Ldar), R(2),
+                B(Ldar), R(1),
                 B(SwitchOnSmiNoFeedback), U8(9), U8(3), I8(0),
                 B(Jump), U8(22),
                 B(LdaTrue),
-                B(Star), R(7),
-                B(Mov), R(0), R(5),
-                B(Mov), R(3), R(6),
-                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorResolve), R(5), U8(3),
+                B(Star), R(6),
+                B(Mov), R(0), R(4),
+                B(Mov), R(2), R(5),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorResolve), R(4), U8(3),
   /*   31 S> */ B(Return),
-                B(Ldar), R(3),
+                B(Ldar), R(2),
   /*   31 S> */ B(Return),
-                B(Ldar), R(3),
+                B(Ldar), R(2),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   31 S> */ B(Return),
 ]
 constant pool: [
-  Smi [37],
-  Smi [83],
-  Smi [125],
+  Smi [30],
+  Smi [74],
+  Smi [114],
   Smi [15],
   Smi [7],
   Smi [15],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   Smi [6],
   Smi [20],
   Smi [23],
 ]
 handlers: [
-  [40, 207, 215],
-  [43, 168, 170],
+  [20, 181, 189],
+  [23, 142, 144],
 ]
 
 ---
@@ -275,69 +252,53 @@ snippet: "
   async function* f() { for (let x of [42]) yield x }
   f();
 "
-frame size: 23
+frame size: 22
 parameter count: 1
-bytecode array length: 536
+bytecode array length: 496
 bytecodes: [
-                B(Ldar), R(2),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(2), U8(1),
-                B(PushContext), R(12),
-                B(RestoreGeneratorState), R(2),
-                B(Star), R(11),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(3), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(11),
-                B(Mov), R(closure), R(12),
-                B(Mov), R(this), R(13),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(12), U8(2),
+                B(SwitchOnGeneratorState), R(2), U8(0), U8(3),
+                B(Mov), R(closure), R(11),
+                B(Mov), R(this), R(12),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(11), U8(2),
                 B(Star), R(2),
   /*   17 E> */ B(StackCheck),
+                B(Mov), R(context), R(13),
                 B(Mov), R(context), R(14),
-                B(Mov), R(context), R(15),
                 B(Ldar), R(2),
-  /*   17 E> */ B(SuspendGenerator), R(2), R(0), U8(16), U8(0),
-  /*   50 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(11), R(0), U8(16),
-                B(Star), R(16),
+  /*   17 E> */ B(SuspendGenerator), R(2), R(0), U8(15), U8(0),
+                B(ResumeGenerator), R(2), R(0), U8(15),
+                B(Star), R(15),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(3), U8(2), I8(0),
-                B(Ldar), R(16),
+                B(Ldar), R(15),
   /*   17 E> */ B(Throw),
                 B(LdaZero),
-                B(Star), R(12),
-                B(Mov), R(16), R(13),
-                B(JumpConstant), U8(20),
+                B(Star), R(11),
+                B(Mov), R(15), R(12),
+                B(JumpConstant), U8(19),
                 B(LdaZero),
                 B(Star), R(7),
+                B(Mov), R(context), R(17),
                 B(Mov), R(context), R(18),
-                B(Mov), R(context), R(19),
   /*   36 S> */ B(CreateArrayLiteral), U8(5), U8(0), U8(37),
+                B(Star), R(19),
+                B(LdaNamedProperty), R(19), U8(6), U8(1),
                 B(Star), R(20),
-                B(LdaNamedProperty), R(20), U8(6), U8(1),
-                B(Star), R(21),
-                B(CallProperty0), R(21), R(20), U8(3),
+                B(CallProperty0), R(20), R(19), U8(3),
                 B(JumpIfJSReceiver), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(4),
   /*   36 E> */ B(LdaNamedProperty), R(4), U8(7), U8(5),
                 B(Star), R(5),
-                B(Ldar), R(11),
-                B(SwitchOnSmiNoFeedback), U8(8), U8(1), I8(1),
-                B(LdaSmi), I8(-2),
-                B(TestEqualStrictNoFeedback), R(11),
-                B(JumpIfTrue), U8(4),
-                B(Abort), U8(15),
   /*   31 S> */ B(CallProperty0), R(5), R(4), U8(7),
                 B(Star), R(6),
   /*   31 E> */ B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(6), U8(1),
                 B(ToBooleanLogicalNot),
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(6), U8(1),
-                B(LdaNamedProperty), R(6), U8(9), U8(9),
-                B(JumpIfToBooleanTrue), U8(70),
-                B(LdaNamedProperty), R(6), U8(10), U8(11),
+                B(LdaNamedProperty), R(6), U8(8), U8(9),
+                B(JumpIfToBooleanTrue), U8(68),
+                B(LdaNamedProperty), R(6), U8(9), U8(11),
                 B(Star), R(8),
                 B(LdaSmi), I8(2),
                 B(Star), R(7),
@@ -345,57 +306,56 @@ bytecodes: [
   /*   22 E> */ B(StackCheck),
                 B(Mov), R(3), R(0),
   /*   42 S> */ B(LdaFalse),
-                B(Star), R(22),
-                B(Mov), R(2), R(20),
-                B(Mov), R(0), R(21),
-                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorYield), R(20), U8(3),
-                B(SuspendGenerator), R(2), R(0), U8(20), U8(1),
-  /*   50 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(11), R(0), U8(20),
-                B(Star), R(20),
+                B(Star), R(21),
+                B(Mov), R(2), R(19),
+                B(Mov), R(0), R(20),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorYield), R(19), U8(3),
+  /*   42 E> */ B(SuspendGenerator), R(2), R(0), U8(19), U8(1),
+                B(ResumeGenerator), R(2), R(0), U8(19),
+                B(Star), R(19),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
-                B(SwitchOnSmiNoFeedback), U8(11), U8(2), I8(0),
-                B(Ldar), R(20),
+                B(SwitchOnSmiNoFeedback), U8(10), U8(2), I8(0),
+                B(Ldar), R(19),
   /*   42 E> */ B(Throw),
                 B(LdaZero),
-                B(Star), R(16),
-                B(Mov), R(20), R(17),
+                B(Star), R(15),
+                B(Mov), R(19), R(16),
                 B(Jump), U8(62),
                 B(LdaZero),
                 B(Star), R(7),
-                B(JumpLoop), U8(103), I8(0),
+                B(JumpLoop), U8(87), I8(0),
                 B(Jump), U8(40),
-                B(Star), R(20),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(20), U8(13), U8(14),
                 B(Star), R(19),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(19), U8(12), U8(13),
+                B(Star), R(18),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(19),
-                B(PushContext), R(20),
+                B(Ldar), R(18),
+                B(PushContext), R(19),
                 B(LdaSmi), I8(2),
                 B(TestEqualStrict), R(7), U8(13),
                 B(JumpIfFalse), U8(6),
                 B(LdaSmi), I8(1),
                 B(Star), R(7),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(21),
-                B(CallRuntime), U16(Runtime::kReThrow), R(21), U8(1),
-                B(PopContext), R(20),
+                B(Star), R(20),
+                B(CallRuntime), U16(Runtime::kReThrow), R(20), U8(1),
+                B(PopContext), R(19),
                 B(LdaSmi), I8(-1),
-                B(Star), R(17),
                 B(Star), R(16),
+                B(Star), R(15),
                 B(Jump), U8(8),
-                B(Star), R(17),
-                B(LdaSmi), I8(1),
                 B(Star), R(16),
+                B(LdaSmi), I8(1),
+                B(Star), R(15),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(18),
+                B(Star), R(17),
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(14),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(4), U8(15), U8(15),
+                B(LdaNamedProperty), R(4), U8(14), U8(15),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -407,138 +367,136 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
+                B(Star), R(18),
+                B(LdaConstant), U8(15),
                 B(Star), R(19),
-                B(LdaConstant), U8(16),
-                B(Star), R(20),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(19), U8(2),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(18), U8(2),
                 B(Throw),
-                B(Mov), R(context), R(19),
-                B(Mov), R(9), R(20),
-                B(Mov), R(4), R(21),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(20), U8(2),
+                B(Mov), R(context), R(18),
+                B(Mov), R(9), R(19),
+                B(Mov), R(4), R(20),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(19), U8(2),
                 B(Jump), U8(6),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(19),
+                B(Ldar), R(18),
                 B(Jump), U8(27),
-                B(Mov), R(9), R(19),
-                B(Mov), R(4), R(20),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(19), U8(2),
+                B(Mov), R(9), R(18),
+                B(Mov), R(4), R(19),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(18), U8(2),
                 B(Star), R(10),
                 B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(10), U8(1),
                 B(JumpIfToBooleanFalse), U8(4),
                 B(Jump), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(10), U8(1),
-                B(Ldar), R(18),
+                B(Ldar), R(17),
                 B(SetPendingMessage),
-                B(Ldar), R(16),
-                B(SwitchOnSmiNoFeedback), U8(17), U8(2), I8(0),
+                B(Ldar), R(15),
+                B(SwitchOnSmiNoFeedback), U8(16), U8(2), I8(0),
                 B(Jump), U8(13),
                 B(LdaZero),
-                B(Star), R(12),
-                B(Mov), R(17), R(13),
-                B(Jump), U8(103),
-                B(Ldar), R(17),
+                B(Star), R(11),
+                B(Mov), R(16), R(12),
+                B(Jump), U8(101),
+                B(Ldar), R(16),
                 B(ReThrow),
                 B(LdaUndefined),
-                B(Star), R(17),
-                B(Mov), R(2), R(16),
-                B(CallJSRuntime), U8(%async_generator_await_uncaught), R(16), U8(2),
-                B(SuspendGenerator), R(2), R(0), U8(16), U8(2),
-  /*   50 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(11), R(0), U8(16),
                 B(Star), R(16),
+                B(Mov), R(2), R(15),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorAwaitUncaught), R(15), U8(2),
+                B(SuspendGenerator), R(2), R(0), U8(15), U8(2),
+                B(ResumeGenerator), R(2), R(0), U8(15),
+                B(Star), R(15),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
-                B(Star), R(17),
+                B(Star), R(16),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(17),
+                B(TestEqualStrictNoFeedback), R(16),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(16),
+                B(Ldar), R(15),
                 B(ReThrow),
                 B(LdaZero),
-                B(Star), R(12),
-                B(Mov), R(16), R(13),
+                B(Star), R(11),
+                B(Mov), R(15), R(12),
                 B(Jump), U8(55),
                 B(Jump), U8(39),
-                B(Star), R(16),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(16), U8(13), U8(19),
                 B(Star), R(15),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(15), U8(12), U8(18),
+                B(Star), R(14),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(15),
-                B(PushContext), R(16),
+                B(Ldar), R(14),
+                B(PushContext), R(15),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(18),
-                B(Mov), R(2), R(17),
-                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorReject), R(17), U8(2),
-                B(PopContext), R(16),
-                B(Star), R(13),
-                B(LdaSmi), I8(1),
+                B(Star), R(17),
+                B(Mov), R(2), R(16),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorReject), R(16), U8(2),
+                B(PopContext), R(15),
                 B(Star), R(12),
+                B(LdaSmi), I8(1),
+                B(Star), R(11),
                 B(Jump), U8(16),
                 B(LdaSmi), I8(-1),
-                B(Star), R(13),
                 B(Star), R(12),
+                B(Star), R(11),
                 B(Jump), U8(8),
-                B(Star), R(13),
-                B(LdaSmi), I8(2),
                 B(Star), R(12),
+                B(LdaSmi), I8(2),
+                B(Star), R(11),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(14),
+                B(Star), R(13),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorClose), R(2), U8(1),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
                 B(SetPendingMessage),
-                B(Ldar), R(12),
-                B(SwitchOnSmiNoFeedback), U8(21), U8(3), I8(0),
+                B(Ldar), R(11),
+                B(SwitchOnSmiNoFeedback), U8(20), U8(3), I8(0),
                 B(Jump), U8(22),
                 B(LdaTrue),
-                B(Star), R(17),
-                B(Mov), R(2), R(15),
-                B(Mov), R(13), R(16),
-                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorResolve), R(15), U8(3),
+                B(Star), R(16),
+                B(Mov), R(2), R(14),
+                B(Mov), R(12), R(15),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorResolve), R(14), U8(3),
   /*   50 S> */ B(Return),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
   /*   50 S> */ B(Return),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   50 S> */ B(Return),
 ]
 constant pool: [
-  Smi [37],
-  Smi [103],
-  Smi [399],
+  Smi [30],
+  Smi [154],
+  Smi [374],
   Smi [15],
   Smi [7],
   TUPLE2_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
-  Smi [72],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   Smi [15],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
   Smi [14],
-  FIXED_ARRAY_TYPE,
-  Smi [420],
+  SCOPE_INFO_TYPE,
+  Smi [402],
   Smi [6],
   Smi [20],
   Smi [23],
 ]
 handlers: [
-  [40, 481, 489],
-  [43, 442, 444],
-  [83, 263, 271],
-  [86, 223, 225],
-  [332, 342, 344],
+  [20, 441, 449],
+  [23, 402, 404],
+  [61, 225, 233],
+  [64, 185, 187],
+  [294, 304, 306],
 ]
 
 ---
@@ -547,237 +505,214 @@ snippet: "
   async function* f() { yield* g() }
   f();
 "
-frame size: 18
+frame size: 17
 parameter count: 1
-bytecode array length: 526
+bytecode array length: 482
 bytecodes: [
-                B(Ldar), R(0),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(0), U8(1),
-                B(PushContext), R(2),
-                B(RestoreGeneratorState), R(0),
-                B(Star), R(1),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(5), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(1),
-                B(Mov), R(closure), R(2),
-                B(Mov), R(this), R(3),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(2), U8(2),
+                B(SwitchOnGeneratorState), R(0), U8(0), U8(5),
+                B(Mov), R(closure), R(1),
+                B(Mov), R(this), R(2),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(1), U8(2),
                 B(Star), R(0),
   /*   44 E> */ B(StackCheck),
+                B(Mov), R(context), R(3),
                 B(Mov), R(context), R(4),
-                B(Mov), R(context), R(5),
                 B(Ldar), R(0),
-  /*   44 E> */ B(SuspendGenerator), R(0), R(0), U8(6), U8(0),
-  /*   60 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(6),
-                B(Star), R(6),
+  /*   44 E> */ B(SuspendGenerator), R(0), R(0), U8(5), U8(0),
+                B(ResumeGenerator), R(0), R(0), U8(5),
+                B(Star), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(5), U8(2), I8(0),
-                B(Ldar), R(6),
+                B(Ldar), R(5),
   /*   44 E> */ B(Throw),
                 B(LdaZero),
-                B(Star), R(2),
-                B(Mov), R(6), R(3),
-                B(JumpConstant), U8(22),
+                B(Star), R(1),
+                B(Mov), R(5), R(2),
+                B(JumpConstant), U8(19),
   /*   49 S> */ B(LdaGlobal), U8(7), U8(0),
-                B(Star), R(13),
-  /*   56 E> */ B(CallUndefinedReceiver0), R(13), U8(2),
-                B(Star), R(11),
-                B(LdaNamedProperty), R(11), U8(8), U8(4),
+                B(Star), R(12),
+  /*   56 E> */ B(CallUndefinedReceiver0), R(12), U8(2),
+                B(Star), R(10),
+                B(LdaNamedProperty), R(10), U8(8), U8(4),
                 B(JumpIfUndefined), U8(17),
                 B(JumpIfNull), U8(15),
-                B(Star), R(12),
-                B(CallProperty0), R(12), R(11), U8(6),
+                B(Star), R(11),
+                B(CallProperty0), R(11), R(10), U8(6),
                 B(JumpIfJSReceiver), U8(23),
                 B(CallRuntime), U16(Runtime::kThrowSymbolAsyncIteratorInvalid), R(0), U8(0),
-                B(LdaNamedProperty), R(11), U8(9), U8(8),
-                B(Star), R(12),
-                B(CallProperty0), R(12), R(11), U8(10),
-                B(Star), R(12),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateAsyncFromSyncIterator), R(12), U8(1),
-                B(Star), R(8),
-                B(LdaNamedProperty), R(8), U8(10), U8(12),
-                B(Star), R(10),
-                B(LdaUndefined),
+                B(LdaNamedProperty), R(10), U8(9), U8(8),
+                B(Star), R(11),
+                B(CallProperty0), R(11), R(10), U8(10),
+                B(Star), R(11),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateAsyncFromSyncIterator), R(11), U8(1),
+                B(Star), R(7),
+                B(LdaNamedProperty), R(7), U8(10), U8(12),
                 B(Star), R(9),
+                B(LdaUndefined),
+                B(Star), R(8),
                 B(LdaZero),
-                B(Star), R(7),
-                B(Ldar), R(1),
-                B(SwitchOnSmiNoFeedback), U8(11), U8(3), I8(1),
-                B(LdaSmi), I8(-2),
-                B(TestEqualStrictNoFeedback), R(1),
-                B(JumpIfTrue), U8(4),
-                B(Abort), U8(15),
-                B(Ldar), R(7),
-                B(SwitchOnSmiNoFeedback), U8(14), U8(2), I8(1),
-                B(CallProperty1), R(10), R(8), R(9), U8(14),
-                B(Jump), U8(112),
-                B(LdaNamedProperty), R(8), U8(16), U8(16),
+                B(Star), R(6),
+                B(Ldar), R(6),
+                B(SwitchOnSmiNoFeedback), U8(11), U8(2), I8(1),
+                B(CallProperty1), R(9), R(7), R(8), U8(14),
+                B(Jump), U8(110),
+                B(LdaNamedProperty), R(7), U8(13), U8(16),
                 B(JumpIfUndefined), U8(13),
                 B(JumpIfNull), U8(11),
-                B(Star), R(13),
-                B(CallProperty1), R(13), R(8), R(9), U8(18),
-                B(Jump), U8(95),
+                B(Star), R(12),
+                B(CallProperty1), R(12), R(7), R(8), U8(18),
+                B(Jump), U8(93),
                 B(LdaZero),
-                B(Star), R(2),
-                B(Mov), R(9), R(3),
-                B(JumpConstant), U8(23),
-                B(LdaNamedProperty), R(8), U8(17), U8(20),
+                B(Star), R(1),
+                B(Mov), R(8), R(2),
+                B(JumpConstant), U8(20),
+                B(LdaNamedProperty), R(7), U8(14), U8(20),
                 B(JumpIfUndefined), U8(13),
                 B(JumpIfNull), U8(11),
-                B(Star), R(13),
-                B(CallProperty1), R(13), R(8), R(9), U8(22),
-                B(Jump), U8(70),
-                B(LdaNamedProperty), R(8), U8(16), U8(24),
-                B(JumpIfUndefined), U8(59),
-                B(JumpIfNull), U8(57),
-                B(Star), R(13),
-                B(CallProperty0), R(13), R(8), U8(26),
+                B(Star), R(12),
+                B(CallProperty1), R(12), R(7), R(8), U8(22),
+                B(Jump), U8(68),
+                B(LdaNamedProperty), R(7), U8(13), U8(24),
+                B(JumpIfUndefined), U8(57),
+                B(JumpIfNull), U8(55),
+                B(Star), R(12),
+                B(CallProperty0), R(12), R(7), U8(26),
                 B(Jump), U8(2),
-                B(Star), R(14),
-                B(Mov), R(0), R(13),
-                B(CallJSRuntime), U8(%async_generator_await_uncaught), R(13), U8(2),
-                B(SuspendGenerator), R(0), R(0), U8(13), U8(2),
-  /*   60 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(13),
                 B(Star), R(13),
+                B(Mov), R(0), R(12),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorAwaitUncaught), R(12), U8(2),
+  /*   49 E> */ B(SuspendGenerator), R(0), R(0), U8(12), U8(1),
+                B(ResumeGenerator), R(0), R(0), U8(12),
+                B(Star), R(12),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
-                B(Star), R(14),
+                B(Star), R(13),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(14),
+                B(TestEqualStrictNoFeedback), R(13),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
                 B(ReThrow),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
                 B(JumpIfJSReceiver), U8(9),
-                B(Star), R(15),
-                B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(15), U8(1),
-                B(CallRuntime), U16(Runtime::kThrowThrowMethodMissing), R(0), U8(0),
                 B(Star), R(14),
-                B(Mov), R(0), R(13),
-                B(CallJSRuntime), U8(%async_generator_await_uncaught), R(13), U8(2),
-                B(SuspendGenerator), R(0), R(0), U8(13), U8(3),
-  /*   60 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(13),
+                B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(14), U8(1),
+                B(CallRuntime), U16(Runtime::kThrowThrowMethodMissing), R(0), U8(0),
                 B(Star), R(13),
+                B(Mov), R(0), R(12),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorAwaitUncaught), R(12), U8(2),
+  /*   49 E> */ B(SuspendGenerator), R(0), R(0), U8(12), U8(2),
+                B(ResumeGenerator), R(0), R(0), U8(12),
+                B(Star), R(12),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
-                B(Star), R(14),
+                B(Star), R(13),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(14),
+                B(TestEqualStrictNoFeedback), R(13),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
                 B(ReThrow),
-                B(Ldar), R(13),
-                B(Mov), R(13), R(6),
+                B(Ldar), R(12),
+                B(Mov), R(12), R(5),
                 B(JumpIfJSReceiver), U8(7),
-                B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(6), U8(1),
-                B(LdaNamedProperty), R(6), U8(18), U8(28),
-                B(JumpIfToBooleanTrue), U8(40),
-                B(LdaNamedProperty), R(6), U8(19), U8(30),
-                B(Star), R(16),
+                B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(5), U8(1),
+                B(LdaNamedProperty), R(5), U8(15), U8(28),
+                B(JumpIfToBooleanTrue), U8(38),
+                B(LdaNamedProperty), R(5), U8(16), U8(30),
+                B(Star), R(15),
                 B(LdaFalse),
-                B(Star), R(17),
-                B(Mov), R(0), R(15),
-                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorYield), R(15), U8(3),
-                B(SuspendGenerator), R(0), R(0), U8(15), U8(1),
-  /*   60 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(15),
-                B(Star), R(9),
+                B(Star), R(16),
+                B(Mov), R(0), R(14),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorYield), R(14), U8(3),
+  /*   49 E> */ B(SuspendGenerator), R(0), R(0), U8(14), U8(3),
+                B(ResumeGenerator), R(0), R(0), U8(14),
+                B(Star), R(8),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
+                B(Star), R(6),
+                B(JumpLoop), U8(206), I8(0),
+                B(LdaNamedProperty), R(5), U8(16), U8(32),
                 B(Star), R(7),
-                B(JumpLoop), U8(226), I8(0),
-                B(LdaNamedProperty), R(6), U8(19), U8(32),
-                B(Star), R(8),
                 B(LdaSmi), I8(1),
-                B(TestEqualStrictNoFeedback), R(7),
+                B(TestEqualStrictNoFeedback), R(6),
                 B(JumpIfFalse), U8(10),
                 B(LdaZero),
-                B(Star), R(2),
-                B(Mov), R(8), R(3),
-                B(Jump), U8(100),
+                B(Star), R(1),
+                B(Mov), R(7), R(2),
+                B(Jump), U8(98),
                 B(LdaUndefined),
-                B(Star), R(7),
-                B(Mov), R(0), R(6),
-                B(CallJSRuntime), U8(%async_generator_await_uncaught), R(6), U8(2),
-                B(SuspendGenerator), R(0), R(0), U8(6), U8(4),
-  /*   60 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(6),
                 B(Star), R(6),
+                B(Mov), R(0), R(5),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorAwaitUncaught), R(5), U8(2),
+                B(SuspendGenerator), R(0), R(0), U8(5), U8(4),
+                B(ResumeGenerator), R(0), R(0), U8(5),
+                B(Star), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
-                B(Star), R(7),
+                B(Star), R(6),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(7),
+                B(TestEqualStrictNoFeedback), R(6),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(6),
+                B(Ldar), R(5),
                 B(ReThrow),
                 B(LdaZero),
-                B(Star), R(2),
-                B(Mov), R(6), R(3),
+                B(Star), R(1),
+                B(Mov), R(5), R(2),
                 B(Jump), U8(55),
                 B(Jump), U8(39),
-                B(Star), R(6),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(6), U8(20), U8(21),
                 B(Star), R(5),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(5), U8(17), U8(18),
+                B(Star), R(4),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(5),
-                B(PushContext), R(6),
+                B(Ldar), R(4),
+                B(PushContext), R(5),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(8),
-                B(Mov), R(0), R(7),
-                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorReject), R(7), U8(2),
-                B(PopContext), R(6),
-                B(Star), R(3),
-                B(LdaSmi), I8(1),
+                B(Star), R(7),
+                B(Mov), R(0), R(6),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorReject), R(6), U8(2),
+                B(PopContext), R(5),
                 B(Star), R(2),
+                B(LdaSmi), I8(1),
+                B(Star), R(1),
                 B(Jump), U8(16),
                 B(LdaSmi), I8(-1),
-                B(Star), R(3),
                 B(Star), R(2),
+                B(Star), R(1),
                 B(Jump), U8(8),
-                B(Star), R(3),
-                B(LdaSmi), I8(2),
                 B(Star), R(2),
+                B(LdaSmi), I8(2),
+                B(Star), R(1),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(4),
+                B(Star), R(3),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorClose), R(0), U8(1),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
                 B(SetPendingMessage),
-                B(Ldar), R(2),
-                B(SwitchOnSmiNoFeedback), U8(24), U8(3), I8(0),
+                B(Ldar), R(1),
+                B(SwitchOnSmiNoFeedback), U8(21), U8(3), I8(0),
                 B(Jump), U8(22),
                 B(LdaTrue),
-                B(Star), R(7),
-                B(Mov), R(0), R(5),
-                B(Mov), R(3), R(6),
-                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorResolve), R(5), U8(3),
+                B(Star), R(6),
+                B(Mov), R(0), R(4),
+                B(Mov), R(2), R(5),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncGeneratorResolve), R(4), U8(3),
   /*   60 S> */ B(Return),
-                B(Ldar), R(3),
+                B(Ldar), R(2),
   /*   60 S> */ B(Return),
-                B(Ldar), R(3),
+                B(Ldar), R(2),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   60 S> */ B(Return),
 ]
 constant pool: [
-  Smi [37],
-  Smi [124],
-  Smi [124],
-  Smi [124],
-  Smi [389],
+  Smi [30],
+  Smi [201],
+  Smi [251],
+  Smi [310],
+  Smi [360],
   Smi [15],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["g"],
   SYMBOL_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
-  Smi [211],
-  Smi [98],
-  Smi [150],
   Smi [11],
   Smi [36],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
@@ -785,15 +720,15 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
-  Smi [410],
-  Smi [297],
+  SCOPE_INFO_TYPE,
+  Smi [388],
+  Smi [289],
   Smi [6],
   Smi [20],
   Smi [23],
 ]
 handlers: [
-  [40, 471, 479],
-  [43, 432, 434],
+  [20, 427, 435],
+  [23, 388, 390],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/BasicLoops.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/BasicLoops.golden
index 951e4b5408e..e4185c11786 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/BasicLoops.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/BasicLoops.golden
@@ -723,7 +723,7 @@ bytecodes: [
   /*  137 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/BreakableBlocks.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/BreakableBlocks.golden
index 2ddfd5512d1..cd9416495eb 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/BreakableBlocks.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/BreakableBlocks.golden
@@ -121,7 +121,7 @@ bytecodes: [
   /*  103 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -174,7 +174,7 @@ bytecodes: [
   /*  162 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CallAndSpread.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CallAndSpread.golden
index 9c1b26da83c..8606b2acc35 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CallAndSpread.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CallAndSpread.golden
@@ -65,9 +65,9 @@ handlers: [
 snippet: "
   Math.max(0, ...[1, 2, 3], 4);
 "
-frame size: 6
+frame size: 10
 parameter count: 1
-bytecode array length: 51
+bytecode array length: 112
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   34 S> */ B(LdaGlobal), U8(0), U8(0),
@@ -76,15 +76,37 @@ bytecodes: [
                 B(Star), R(1),
                 B(CreateArrayLiteral), U8(2), U8(4), U8(37),
                 B(Star), R(3),
-                B(CreateArrayLiteral), U8(3), U8(5), U8(37),
+                B(LdaConstant), U8(3),
                 B(Star), R(4),
-                B(CallJSRuntime), U8(%spread_iterable), R(4), U8(1),
-                B(Star), R(4),
-                B(CreateArrayLiteral), U8(4), U8(6), U8(37),
-                B(Star), R(5),
-                B(CallJSRuntime), U8(%spread_arguments), R(3), U8(3),
-                B(Star), R(3),
+  /*   49 S> */ B(CreateArrayLiteral), U8(4), U8(10), U8(37),
+                B(Star), R(8),
+                B(LdaNamedProperty), R(8), U8(5), U8(11),
+                B(Star), R(9),
+                B(CallProperty0), R(9), R(8), U8(13),
                 B(Mov), R(0), R(2),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
+                B(Star), R(7),
+                B(LdaNamedProperty), R(7), U8(6), U8(15),
+                B(Star), R(6),
+                B(CallProperty0), R(6), R(7), U8(17),
+                B(Star), R(5),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(5), U8(1),
+                B(LdaNamedProperty), R(5), U8(7), U8(19),
+                B(JumpIfToBooleanTrue), U8(21),
+                B(LdaNamedProperty), R(5), U8(8), U8(21),
+                B(Star), R(5),
+                B(StaInArrayLiteral), R(3), R(4), U8(5),
+                B(Ldar), R(4),
+                B(Inc), U8(7),
+                B(Star), R(4),
+                B(JumpLoop), U8(35), I8(0),
+                B(LdaSmi), I8(4),
+                B(StaInArrayLiteral), R(3), R(4), U8(5),
+                B(Ldar), R(4),
+                B(Inc), U8(7),
+                B(Star), R(4),
                 B(CallJSRuntime), U8(%reflect_apply), R(1), U8(3),
                 B(LdaUndefined),
   /*   64 S> */ B(Return),
@@ -93,8 +115,12 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["Math"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["max"],
   TUPLE2_TYPE,
+  Smi [1],
   TUPLE2_TYPE,
-  TUPLE2_TYPE,
+  SYMBOL_TYPE,
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
 ]
 handlers: [
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CallRuntime.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CallRuntime.golden
index cb201ed8e6f..761436decbc 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CallRuntime.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CallRuntime.golden
@@ -65,24 +65,3 @@ constant pool: [
 handlers: [
 ]
 
----
-snippet: "
-  function f() { return %spread_iterable([1]) }
-  f();
-"
-frame size: 1
-parameter count: 1
-bytecode array length: 12
-bytecodes: [
-  /*   10 E> */ B(StackCheck),
-  /*   15 S> */ B(CreateArrayLiteral), U8(0), U8(0), U8(37),
-                B(Star), R(0),
-                B(CallJSRuntime), U8(%spread_iterable), R(0), U8(1),
-  /*   43 S> */ B(Return),
-]
-constant pool: [
-  TUPLE2_TYPE,
-]
-handlers: [
-]
-
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CompoundExpressions.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CompoundExpressions.golden
index f2d00b28e1e..fe645f1ea38 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CompoundExpressions.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CompoundExpressions.golden
@@ -65,7 +65,7 @@ bytecodes: [
   /*   67 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["name"],
 ]
 handlers: [
@@ -91,7 +91,7 @@ bytecodes: [
   /*   63 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextVariables.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextVariables.golden
index 3d262e4b830..1664f865c3a 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextVariables.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextVariables.golden
@@ -122,7 +122,7 @@ bytecodes: [
   /*  101 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CountOperators.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CountOperators.golden
index 50a25c63a5a..70fbf16215b 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CountOperators.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CountOperators.golden
@@ -112,7 +112,7 @@ bytecodes: [
   /*   69 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["val"],
 ]
 handlers: [
@@ -137,7 +137,7 @@ bytecodes: [
   /*   69 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["val"],
 ]
 handlers: [
@@ -168,7 +168,7 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["var"],
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -196,7 +196,7 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["var"],
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/DeclareGlobals.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/DeclareGlobals.golden
index 0d1edb6424e..dd4cc41b007 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/DeclareGlobals.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/DeclareGlobals.golden
@@ -19,7 +19,7 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(2),
                 B(Mov), R(closure), R(3),
-                B(CallRuntime), U16(Runtime::kDeclareGlobalsForInterpreter), R(1), U8(3),
+                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(1), U8(3),
   /*    0 E> */ B(StackCheck),
   /*    8 S> */ B(LdaSmi), I8(1),
   /*    8 E> */ B(StaGlobal), U8(1), U8(2),
@@ -46,7 +46,7 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(1),
                 B(Mov), R(closure), R(2),
-                B(CallRuntime), U16(Runtime::kDeclareGlobalsForInterpreter), R(0), U8(3),
+                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(0), U8(3),
   /*    0 E> */ B(StackCheck),
                 B(LdaUndefined),
   /*   15 S> */ B(Return),
@@ -71,12 +71,12 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(2),
                 B(Mov), R(closure), R(3),
-                B(CallRuntime), U16(Runtime::kDeclareGlobalsForInterpreter), R(1), U8(3),
+                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(1), U8(3),
   /*    0 E> */ B(StackCheck),
   /*    8 S> */ B(LdaSmi), I8(1),
   /*    8 E> */ B(StaGlobal), U8(1), U8(2),
   /*   11 S> */ B(LdaSmi), I8(2),
-  /*   12 E> */ B(StaGlobal), U8(1), U8(4),
+  /*   12 E> */ B(StaGlobal), U8(1), U8(2),
                 B(Star), R(0),
   /*   15 S> */ B(Return),
 ]
@@ -101,7 +101,7 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(2),
                 B(Mov), R(closure), R(3),
-                B(CallRuntime), U16(Runtime::kDeclareGlobalsForInterpreter), R(1), U8(3),
+                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(1), U8(3),
   /*    0 E> */ B(StackCheck),
   /*   16 S> */ B(LdaGlobal), U8(1), U8(0),
                 B(Star), R(1),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/Delete.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/Delete.golden
index fbf478de261..22b33d96c9b 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/Delete.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/Delete.golden
@@ -21,7 +21,7 @@ bytecodes: [
   /*   74 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
 ]
 handlers: [
@@ -43,7 +43,7 @@ bytecodes: [
   /*   88 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
 ]
 handlers: [
@@ -65,7 +65,7 @@ bytecodes: [
   /*   75 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -114,7 +114,7 @@ bytecodes: [
   /*  112 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
index fd83a29fd9b..95400dacf80 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
@@ -14,80 +14,64 @@ snippet: "
   }
   f();
 "
-frame size: 24
+frame size: 23
 parameter count: 1
-bytecode array length: 554
+bytecode array length: 514
 bytecodes: [
-                B(Ldar), R(2),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(2), U8(1),
-                B(PushContext), R(13),
-                B(RestoreGeneratorState), R(2),
-                B(Star), R(12),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(3), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(12),
-                B(Mov), R(closure), R(13),
-                B(Mov), R(this), R(14),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(13), U8(2),
+                B(SwitchOnGeneratorState), R(2), U8(0), U8(3),
+                B(Mov), R(closure), R(12),
+                B(Mov), R(this), R(13),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(12), U8(2),
                 B(Star), R(2),
   /*   16 E> */ B(StackCheck),
                 B(CallJSRuntime), U8(%async_function_promise_create), R(0), U8(0),
                 B(Star), R(11),
+                B(Mov), R(context), R(14),
                 B(Mov), R(context), R(15),
-                B(Mov), R(context), R(16),
                 B(LdaZero),
                 B(Star), R(7),
+                B(Mov), R(context), R(18),
                 B(Mov), R(context), R(19),
-                B(Mov), R(context), R(20),
   /*   43 S> */ B(CreateArrayLiteral), U8(3), U8(0), U8(37),
-                B(Star), R(21),
-                B(LdaNamedProperty), R(21), U8(4), U8(1),
+                B(Star), R(20),
+                B(LdaNamedProperty), R(20), U8(4), U8(1),
                 B(JumpIfUndefined), U8(17),
                 B(JumpIfNull), U8(15),
-                B(Star), R(22),
-                B(CallProperty0), R(22), R(21), U8(3),
+                B(Star), R(21),
+                B(CallProperty0), R(21), R(20), U8(3),
                 B(JumpIfJSReceiver), U8(23),
                 B(CallRuntime), U16(Runtime::kThrowSymbolAsyncIteratorInvalid), R(0), U8(0),
-                B(LdaNamedProperty), R(21), U8(5), U8(5),
-                B(Star), R(22),
-                B(CallProperty0), R(22), R(21), U8(7),
-                B(Star), R(22),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateAsyncFromSyncIterator), R(22), U8(1),
+                B(LdaNamedProperty), R(20), U8(5), U8(5),
+                B(Star), R(21),
+                B(CallProperty0), R(21), R(20), U8(7),
+                B(Star), R(21),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateAsyncFromSyncIterator), R(21), U8(1),
                 B(Star), R(4),
   /*   43 E> */ B(LdaNamedProperty), R(4), U8(6), U8(9),
                 B(Star), R(5),
-                B(Ldar), R(12),
-                B(SwitchOnSmiNoFeedback), U8(7), U8(1), I8(0),
-                B(LdaSmi), I8(-2),
-                B(TestEqualStrictNoFeedback), R(12),
-                B(JumpIfTrue), U8(4),
-                B(Abort), U8(15),
   /*   40 S> */ B(CallProperty0), R(5), R(4), U8(11),
-                B(Star), R(22),
-                B(Mov), R(2), R(21),
-                B(Mov), R(11), R(23),
-                B(CallJSRuntime), U8(%async_function_await_uncaught), R(21), U8(3),
-                B(SuspendGenerator), R(2), R(0), U8(21), U8(0),
-  /*   57 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(12), R(0), U8(21),
                 B(Star), R(21),
+                B(Mov), R(2), R(20),
+                B(Mov), R(11), R(22),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionAwaitUncaught), R(20), U8(3),
+  /*   40 E> */ B(SuspendGenerator), R(2), R(0), U8(20), U8(0),
+                B(ResumeGenerator), R(2), R(0), U8(20),
+                B(Star), R(20),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
-                B(Star), R(22),
+                B(Star), R(21),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(22),
+                B(TestEqualStrictNoFeedback), R(21),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(21),
+                B(Ldar), R(20),
                 B(ReThrow),
-                B(Mov), R(21), R(6),
-  /*   40 E> */ B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(21), U8(1),
+                B(Mov), R(20), R(6),
+  /*   40 E> */ B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(20), U8(1),
                 B(ToBooleanLogicalNot),
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(6), U8(1),
-                B(LdaNamedProperty), R(6), U8(8), U8(13),
+                B(LdaNamedProperty), R(6), U8(7), U8(13),
                 B(JumpIfToBooleanTrue), U8(25),
-                B(LdaNamedProperty), R(6), U8(9), U8(15),
+                B(LdaNamedProperty), R(6), U8(8), U8(15),
                 B(Star), R(8),
                 B(LdaSmi), I8(2),
                 B(Star), R(7),
@@ -96,91 +80,66 @@ bytecodes: [
                 B(Mov), R(3), R(0),
                 B(LdaZero),
                 B(Star), R(7),
-                B(JumpLoop), U8(98), I8(0),
+                B(JumpLoop), U8(82), I8(0),
                 B(Jump), U8(40),
-                B(Star), R(21),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(21), U8(10), U8(11),
                 B(Star), R(20),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(20), U8(9), U8(10),
+                B(Star), R(19),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(20),
-                B(PushContext), R(21),
+                B(Ldar), R(19),
+                B(PushContext), R(20),
                 B(LdaSmi), I8(2),
                 B(TestEqualStrict), R(7), U8(17),
                 B(JumpIfFalse), U8(6),
                 B(LdaSmi), I8(1),
                 B(Star), R(7),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(22),
-                B(CallRuntime), U16(Runtime::kReThrow), R(22), U8(1),
-                B(PopContext), R(21),
+                B(Star), R(21),
+                B(CallRuntime), U16(Runtime::kReThrow), R(21), U8(1),
+                B(PopContext), R(20),
                 B(LdaSmi), I8(-1),
-                B(Star), R(18),
                 B(Star), R(17),
+                B(Star), R(16),
                 B(Jump), U8(7),
-                B(Star), R(18),
-                B(LdaZero),
                 B(Star), R(17),
+                B(LdaZero),
+                B(Star), R(16),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(19),
+                B(Star), R(18),
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(18),
-                B(JumpIfTrue), U8(171),
-                B(LdaNamedProperty), R(4), U8(12), U8(19),
+                B(JumpIfTrue), U8(167),
+                B(LdaNamedProperty), R(4), U8(11), U8(19),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
-                B(Jump), U8(160),
+                B(Jump), U8(156),
                 B(LdaSmi), I8(1),
                 B(TestEqualStrict), R(7), U8(21),
-                B(JumpIfFalse), U8(88),
+                B(JumpIfFalse), U8(86),
                 B(Ldar), R(9),
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
+                B(Star), R(19),
+                B(LdaConstant), U8(12),
                 B(Star), R(20),
-                B(LdaConstant), U8(13),
-                B(Star), R(21),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(20), U8(2),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(19), U8(2),
                 B(Throw),
-                B(Mov), R(context), R(20),
-                B(Mov), R(9), R(21),
-                B(Mov), R(4), R(22),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(21), U8(2),
-                B(Star), R(22),
-                B(Mov), R(2), R(21),
-                B(Mov), R(11), R(23),
-                B(CallJSRuntime), U8(%async_function_await_caught), R(21), U8(3),
-                B(SuspendGenerator), R(2), R(0), U8(21), U8(1),
-  /*   57 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(12), R(0), U8(21),
-                B(Star), R(21),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
-                B(Star), R(22),
-                B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(22),
-                B(JumpIfTrue), U8(5),
-                B(Ldar), R(21),
-                B(ReThrow),
-                B(Ldar), R(21),
-                B(Jump), U8(6),
-                B(LdaTheHole),
-                B(SetPendingMessage),
-                B(Ldar), R(20),
-                B(Jump), U8(67),
+                B(Mov), R(context), R(19),
                 B(Mov), R(9), R(20),
                 B(Mov), R(4), R(21),
                 B(InvokeIntrinsic), U8(Runtime::k_Call), R(20), U8(2),
                 B(Star), R(21),
                 B(Mov), R(2), R(20),
                 B(Mov), R(11), R(22),
-                B(CallJSRuntime), U8(%async_function_await_uncaught), R(20), U8(3),
-                B(SuspendGenerator), R(2), R(0), U8(20), U8(2),
-  /*   57 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(12), R(0), U8(20),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionAwaitCaught), R(20), U8(3),
+                B(SuspendGenerator), R(2), R(0), U8(20), U8(1),
+                B(ResumeGenerator), R(2), R(0), U8(20),
                 B(Star), R(20),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(Star), R(21),
@@ -189,94 +148,116 @@ bytecodes: [
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(20),
                 B(ReThrow),
-                B(Mov), R(20), R(10),
-                B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(20), U8(1),
+                B(Ldar), R(20),
+                B(Jump), U8(6),
+                B(LdaTheHole),
+                B(SetPendingMessage),
+                B(Ldar), R(19),
+                B(Jump), U8(65),
+                B(Mov), R(9), R(19),
+                B(Mov), R(4), R(20),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(19), U8(2),
+                B(Star), R(20),
+                B(Mov), R(2), R(19),
+                B(Mov), R(11), R(21),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionAwaitUncaught), R(19), U8(3),
+                B(SuspendGenerator), R(2), R(0), U8(19), U8(2),
+                B(ResumeGenerator), R(2), R(0), U8(19),
+                B(Star), R(19),
+                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
+                B(Star), R(20),
+                B(LdaZero),
+                B(TestEqualStrictNoFeedback), R(20),
+                B(JumpIfTrue), U8(5),
+                B(Ldar), R(19),
+                B(ReThrow),
+                B(Mov), R(19), R(10),
+                B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(19), U8(1),
                 B(JumpIfToBooleanFalse), U8(4),
                 B(Jump), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(10), U8(1),
-                B(Ldar), R(19),
+                B(Ldar), R(18),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(17),
+                B(TestEqualStrictNoFeedback), R(16),
                 B(JumpIfFalse), U8(5),
-                B(Ldar), R(18),
+                B(Ldar), R(17),
                 B(ReThrow),
                 B(LdaUndefined),
-                B(Star), R(18),
-                B(Mov), R(11), R(17),
-                B(CallJSRuntime), U8(%promise_resolve), R(17), U8(2),
+                B(Star), R(17),
+                B(Mov), R(11), R(16),
+                B(InvokeIntrinsic), U8(Runtime::k_ResolvePromise), R(16), U8(2),
                 B(LdaZero),
-                B(Star), R(13),
-                B(Mov), R(11), R(14),
+                B(Star), R(12),
+                B(Mov), R(11), R(13),
                 B(Jump), U8(58),
                 B(Jump), U8(42),
-                B(Star), R(17),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(17), U8(10), U8(14),
                 B(Star), R(16),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(16), U8(9), U8(13),
+                B(Star), R(15),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(16),
-                B(PushContext), R(17),
+                B(Ldar), R(15),
+                B(PushContext), R(16),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(19),
+                B(Star), R(18),
                 B(LdaFalse),
-                B(Star), R(20),
-                B(Mov), R(11), R(18),
-                B(CallJSRuntime), U8(%promise_internal_reject), R(18), U8(3),
-                B(PopContext), R(17),
+                B(Star), R(19),
+                B(Mov), R(11), R(17),
+                B(InvokeIntrinsic), U8(Runtime::k_RejectPromise), R(17), U8(3),
+                B(PopContext), R(16),
                 B(LdaZero),
-                B(Star), R(13),
-                B(Mov), R(11), R(14),
+                B(Star), R(12),
+                B(Mov), R(11), R(13),
                 B(Jump), U8(16),
                 B(LdaSmi), I8(-1),
-                B(Star), R(14),
                 B(Star), R(13),
+                B(Star), R(12),
                 B(Jump), U8(8),
-                B(Star), R(14),
-                B(LdaSmi), I8(1),
                 B(Star), R(13),
+                B(LdaSmi), I8(1),
+                B(Star), R(12),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(15),
+                B(Star), R(14),
                 B(CallJSRuntime), U8(%async_function_promise_release), R(11), U8(1),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
                 B(SetPendingMessage),
-                B(Ldar), R(13),
-                B(SwitchOnSmiNoFeedback), U8(15), U8(2), I8(0),
+                B(Ldar), R(12),
+                B(SwitchOnSmiNoFeedback), U8(14), U8(2), I8(0),
                 B(Jump), U8(8),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
   /*   57 S> */ B(Return),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   57 S> */ B(Return),
 ]
 constant pool: [
-  Smi [95],
-  Smi [332],
-  Smi [391],
+  Smi [110],
+  Smi [309],
+  Smi [366],
   TUPLE2_TYPE,
   SYMBOL_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
-  Smi [34],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   Smi [6],
   Smi [9],
 ]
 handlers: [
-  [46, 513, 521],
-  [49, 471, 473],
-  [55, 250, 258],
-  [58, 210, 212],
-  [318, 369, 371],
+  [26, 473, 481],
+  [29, 431, 433],
+  [35, 214, 222],
+  [38, 174, 176],
+  [282, 331, 333],
 ]
 
 ---
@@ -286,80 +267,64 @@ snippet: "
   }
   f();
 "
-frame size: 24
+frame size: 23
 parameter count: 1
-bytecode array length: 583
+bytecode array length: 543
 bytecodes: [
-                B(Ldar), R(2),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(2), U8(1),
-                B(PushContext), R(13),
-                B(RestoreGeneratorState), R(2),
-                B(Star), R(12),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(3), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(12),
-                B(Mov), R(closure), R(13),
-                B(Mov), R(this), R(14),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(13), U8(2),
+                B(SwitchOnGeneratorState), R(2), U8(0), U8(3),
+                B(Mov), R(closure), R(12),
+                B(Mov), R(this), R(13),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(12), U8(2),
                 B(Star), R(2),
   /*   16 E> */ B(StackCheck),
                 B(CallJSRuntime), U8(%async_function_promise_create), R(0), U8(0),
                 B(Star), R(11),
+                B(Mov), R(context), R(14),
                 B(Mov), R(context), R(15),
-                B(Mov), R(context), R(16),
                 B(LdaZero),
                 B(Star), R(7),
+                B(Mov), R(context), R(18),
                 B(Mov), R(context), R(19),
-                B(Mov), R(context), R(20),
   /*   43 S> */ B(CreateArrayLiteral), U8(3), U8(0), U8(37),
-                B(Star), R(21),
-                B(LdaNamedProperty), R(21), U8(4), U8(1),
+                B(Star), R(20),
+                B(LdaNamedProperty), R(20), U8(4), U8(1),
                 B(JumpIfUndefined), U8(17),
                 B(JumpIfNull), U8(15),
-                B(Star), R(22),
-                B(CallProperty0), R(22), R(21), U8(3),
+                B(Star), R(21),
+                B(CallProperty0), R(21), R(20), U8(3),
                 B(JumpIfJSReceiver), U8(23),
                 B(CallRuntime), U16(Runtime::kThrowSymbolAsyncIteratorInvalid), R(0), U8(0),
-                B(LdaNamedProperty), R(21), U8(5), U8(5),
-                B(Star), R(22),
-                B(CallProperty0), R(22), R(21), U8(7),
-                B(Star), R(22),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateAsyncFromSyncIterator), R(22), U8(1),
+                B(LdaNamedProperty), R(20), U8(5), U8(5),
+                B(Star), R(21),
+                B(CallProperty0), R(21), R(20), U8(7),
+                B(Star), R(21),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateAsyncFromSyncIterator), R(21), U8(1),
                 B(Star), R(4),
   /*   43 E> */ B(LdaNamedProperty), R(4), U8(6), U8(9),
                 B(Star), R(5),
-                B(Ldar), R(12),
-                B(SwitchOnSmiNoFeedback), U8(7), U8(1), I8(0),
-                B(LdaSmi), I8(-2),
-                B(TestEqualStrictNoFeedback), R(12),
-                B(JumpIfTrue), U8(4),
-                B(Abort), U8(15),
   /*   40 S> */ B(CallProperty0), R(5), R(4), U8(11),
-                B(Star), R(22),
-                B(Mov), R(2), R(21),
-                B(Mov), R(11), R(23),
-                B(CallJSRuntime), U8(%async_function_await_uncaught), R(21), U8(3),
-                B(SuspendGenerator), R(2), R(0), U8(21), U8(0),
-  /*   68 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(12), R(0), U8(21),
                 B(Star), R(21),
+                B(Mov), R(2), R(20),
+                B(Mov), R(11), R(22),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionAwaitUncaught), R(20), U8(3),
+  /*   40 E> */ B(SuspendGenerator), R(2), R(0), U8(20), U8(0),
+                B(ResumeGenerator), R(2), R(0), U8(20),
+                B(Star), R(20),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
-                B(Star), R(22),
+                B(Star), R(21),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(22),
+                B(TestEqualStrictNoFeedback), R(21),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(21),
+                B(Ldar), R(20),
                 B(ReThrow),
-                B(Mov), R(21), R(6),
-  /*   40 E> */ B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(21), U8(1),
+                B(Mov), R(20), R(6),
+  /*   40 E> */ B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(20), U8(1),
                 B(ToBooleanLogicalNot),
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(6), U8(1),
-                B(LdaNamedProperty), R(6), U8(8), U8(13),
+                B(LdaNamedProperty), R(6), U8(7), U8(13),
                 B(JumpIfToBooleanTrue), U8(27),
-                B(LdaNamedProperty), R(6), U8(9), U8(15),
+                B(LdaNamedProperty), R(6), U8(8), U8(15),
                 B(Star), R(8),
                 B(LdaSmi), I8(2),
                 B(Star), R(7),
@@ -367,93 +332,68 @@ bytecodes: [
   /*   23 E> */ B(StackCheck),
                 B(Mov), R(3), R(0),
   /*   56 S> */ B(LdaZero),
-                B(Star), R(17),
-                B(Mov), R(8), R(18),
+                B(Star), R(16),
+                B(Mov), R(8), R(17),
                 B(Jump), U8(56),
                 B(Jump), U8(40),
-                B(Star), R(21),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(21), U8(10), U8(11),
                 B(Star), R(20),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(20), U8(9), U8(10),
+                B(Star), R(19),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(20),
-                B(PushContext), R(21),
+                B(Ldar), R(19),
+                B(PushContext), R(20),
                 B(LdaSmi), I8(2),
                 B(TestEqualStrict), R(7), U8(17),
                 B(JumpIfFalse), U8(6),
                 B(LdaSmi), I8(1),
                 B(Star), R(7),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(22),
-                B(CallRuntime), U16(Runtime::kReThrow), R(22), U8(1),
-                B(PopContext), R(21),
+                B(Star), R(21),
+                B(CallRuntime), U16(Runtime::kReThrow), R(21), U8(1),
+                B(PopContext), R(20),
                 B(LdaSmi), I8(-1),
-                B(Star), R(18),
                 B(Star), R(17),
+                B(Star), R(16),
                 B(Jump), U8(8),
-                B(Star), R(18),
-                B(LdaSmi), I8(1),
                 B(Star), R(17),
+                B(LdaSmi), I8(1),
+                B(Star), R(16),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(19),
+                B(Star), R(18),
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(18),
-                B(JumpIfTrue), U8(171),
-                B(LdaNamedProperty), R(4), U8(12), U8(19),
+                B(JumpIfTrue), U8(167),
+                B(LdaNamedProperty), R(4), U8(11), U8(19),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
-                B(Jump), U8(160),
+                B(Jump), U8(156),
                 B(LdaSmi), I8(1),
                 B(TestEqualStrict), R(7), U8(21),
-                B(JumpIfFalse), U8(88),
+                B(JumpIfFalse), U8(86),
                 B(Ldar), R(9),
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
+                B(Star), R(19),
+                B(LdaConstant), U8(12),
                 B(Star), R(20),
-                B(LdaConstant), U8(13),
-                B(Star), R(21),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(20), U8(2),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(19), U8(2),
                 B(Throw),
-                B(Mov), R(context), R(20),
-                B(Mov), R(9), R(21),
-                B(Mov), R(4), R(22),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(21), U8(2),
-                B(Star), R(22),
-                B(Mov), R(2), R(21),
-                B(Mov), R(11), R(23),
-                B(CallJSRuntime), U8(%async_function_await_caught), R(21), U8(3),
-                B(SuspendGenerator), R(2), R(0), U8(21), U8(1),
-  /*   68 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(12), R(0), U8(21),
-                B(Star), R(21),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
-                B(Star), R(22),
-                B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(22),
-                B(JumpIfTrue), U8(5),
-                B(Ldar), R(21),
-                B(ReThrow),
-                B(Ldar), R(21),
-                B(Jump), U8(6),
-                B(LdaTheHole),
-                B(SetPendingMessage),
-                B(Ldar), R(20),
-                B(Jump), U8(67),
+                B(Mov), R(context), R(19),
                 B(Mov), R(9), R(20),
                 B(Mov), R(4), R(21),
                 B(InvokeIntrinsic), U8(Runtime::k_Call), R(20), U8(2),
                 B(Star), R(21),
                 B(Mov), R(2), R(20),
                 B(Mov), R(11), R(22),
-                B(CallJSRuntime), U8(%async_function_await_uncaught), R(20), U8(3),
-                B(SuspendGenerator), R(2), R(0), U8(20), U8(2),
-  /*   68 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(12), R(0), U8(20),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionAwaitCaught), R(20), U8(3),
+                B(SuspendGenerator), R(2), R(0), U8(20), U8(1),
+                B(ResumeGenerator), R(2), R(0), U8(20),
                 B(Star), R(20),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(Star), R(21),
@@ -462,106 +402,128 @@ bytecodes: [
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(20),
                 B(ReThrow),
-                B(Mov), R(20), R(10),
-                B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(20), U8(1),
+                B(Ldar), R(20),
+                B(Jump), U8(6),
+                B(LdaTheHole),
+                B(SetPendingMessage),
+                B(Ldar), R(19),
+                B(Jump), U8(65),
+                B(Mov), R(9), R(19),
+                B(Mov), R(4), R(20),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(19), U8(2),
+                B(Star), R(20),
+                B(Mov), R(2), R(19),
+                B(Mov), R(11), R(21),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionAwaitUncaught), R(19), U8(3),
+                B(SuspendGenerator), R(2), R(0), U8(19), U8(2),
+                B(ResumeGenerator), R(2), R(0), U8(19),
+                B(Star), R(19),
+                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
+                B(Star), R(20),
+                B(LdaZero),
+                B(TestEqualStrictNoFeedback), R(20),
+                B(JumpIfTrue), U8(5),
+                B(Ldar), R(19),
+                B(ReThrow),
+                B(Mov), R(19), R(10),
+                B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(19), U8(1),
                 B(JumpIfToBooleanFalse), U8(4),
                 B(Jump), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(10), U8(1),
-                B(Ldar), R(19),
+                B(Ldar), R(18),
                 B(SetPendingMessage),
-                B(Ldar), R(17),
-                B(SwitchOnSmiNoFeedback), U8(14), U8(2), I8(0),
+                B(Ldar), R(16),
+                B(SwitchOnSmiNoFeedback), U8(13), U8(2), I8(0),
                 B(Jump), U8(13),
                 B(LdaZero),
-                B(Star), R(13),
-                B(Mov), R(18), R(14),
+                B(Star), R(12),
+                B(Mov), R(17), R(13),
                 B(Jump), U8(81),
-                B(Ldar), R(18),
+                B(Ldar), R(17),
                 B(ReThrow),
                 B(LdaUndefined),
-                B(Star), R(18),
-                B(Mov), R(11), R(17),
-                B(CallJSRuntime), U8(%promise_resolve), R(17), U8(2),
+                B(Star), R(17),
+                B(Mov), R(11), R(16),
+                B(InvokeIntrinsic), U8(Runtime::k_ResolvePromise), R(16), U8(2),
                 B(LdaSmi), I8(1),
-                B(Star), R(13),
-                B(Mov), R(11), R(14),
+                B(Star), R(12),
+                B(Mov), R(11), R(13),
                 B(Jump), U8(59),
                 B(Jump), U8(43),
-                B(Star), R(17),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(17), U8(10), U8(16),
                 B(Star), R(16),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(16), U8(9), U8(15),
+                B(Star), R(15),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(16),
-                B(PushContext), R(17),
+                B(Ldar), R(15),
+                B(PushContext), R(16),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(19),
+                B(Star), R(18),
                 B(LdaFalse),
-                B(Star), R(20),
-                B(Mov), R(11), R(18),
-                B(CallJSRuntime), U8(%promise_internal_reject), R(18), U8(3),
-                B(PopContext), R(17),
+                B(Star), R(19),
+                B(Mov), R(11), R(17),
+                B(InvokeIntrinsic), U8(Runtime::k_RejectPromise), R(17), U8(3),
+                B(PopContext), R(16),
                 B(LdaSmi), I8(1),
-                B(Star), R(13),
-                B(Mov), R(11), R(14),
+                B(Star), R(12),
+                B(Mov), R(11), R(13),
                 B(Jump), U8(16),
                 B(LdaSmi), I8(-1),
-                B(Star), R(14),
                 B(Star), R(13),
+                B(Star), R(12),
                 B(Jump), U8(8),
-                B(Star), R(14),
-                B(LdaSmi), I8(2),
                 B(Star), R(13),
+                B(LdaSmi), I8(2),
+                B(Star), R(12),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(15),
+                B(Star), R(14),
                 B(CallJSRuntime), U8(%async_function_promise_release), R(11), U8(1),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
                 B(SetPendingMessage),
-                B(Ldar), R(13),
-                B(SwitchOnSmiNoFeedback), U8(17), U8(3), I8(0),
+                B(Ldar), R(12),
+                B(SwitchOnSmiNoFeedback), U8(16), U8(3), I8(0),
                 B(Jump), U8(21),
-                B(Mov), R(11), R(16),
-                B(Mov), R(14), R(17),
-                B(CallJSRuntime), U8(%promise_resolve), R(16), U8(2),
+                B(Mov), R(11), R(15),
+                B(Mov), R(13), R(16),
+                B(InvokeIntrinsic), U8(Runtime::k_ResolvePromise), R(15), U8(2),
                 B(Ldar), R(11),
   /*   68 S> */ B(Return),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
   /*   68 S> */ B(Return),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   68 S> */ B(Return),
 ]
 constant pool: [
-  Smi [95],
-  Smi [335],
-  Smi [394],
+  Smi [110],
+  Smi [312],
+  Smi [369],
   TUPLE2_TYPE,
   SYMBOL_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
-  Smi [34],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
   Smi [14],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   Smi [6],
   Smi [19],
   Smi [22],
 ]
 handlers: [
-  [46, 529, 537],
-  [49, 486, 488],
-  [55, 252, 260],
-  [58, 212, 214],
-  [321, 372, 374],
+  [26, 489, 497],
+  [29, 446, 448],
+  [35, 216, 224],
+  [38, 176, 178],
+  [285, 334, 336],
 ]
 
 ---
@@ -574,80 +536,64 @@ snippet: "
   }
   f();
 "
-frame size: 24
+frame size: 23
 parameter count: 1
-bytecode array length: 572
+bytecode array length: 532
 bytecodes: [
-                B(Ldar), R(2),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(2), U8(1),
-                B(PushContext), R(13),
-                B(RestoreGeneratorState), R(2),
-                B(Star), R(12),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(3), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(12),
-                B(Mov), R(closure), R(13),
-                B(Mov), R(this), R(14),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(13), U8(2),
+                B(SwitchOnGeneratorState), R(2), U8(0), U8(3),
+                B(Mov), R(closure), R(12),
+                B(Mov), R(this), R(13),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(12), U8(2),
                 B(Star), R(2),
   /*   16 E> */ B(StackCheck),
                 B(CallJSRuntime), U8(%async_function_promise_create), R(0), U8(0),
                 B(Star), R(11),
+                B(Mov), R(context), R(14),
                 B(Mov), R(context), R(15),
-                B(Mov), R(context), R(16),
                 B(LdaZero),
                 B(Star), R(7),
+                B(Mov), R(context), R(18),
                 B(Mov), R(context), R(19),
-                B(Mov), R(context), R(20),
   /*   43 S> */ B(CreateArrayLiteral), U8(3), U8(0), U8(37),
-                B(Star), R(21),
-                B(LdaNamedProperty), R(21), U8(4), U8(1),
+                B(Star), R(20),
+                B(LdaNamedProperty), R(20), U8(4), U8(1),
                 B(JumpIfUndefined), U8(17),
                 B(JumpIfNull), U8(15),
-                B(Star), R(22),
-                B(CallProperty0), R(22), R(21), U8(3),
+                B(Star), R(21),
+                B(CallProperty0), R(21), R(20), U8(3),
                 B(JumpIfJSReceiver), U8(23),
                 B(CallRuntime), U16(Runtime::kThrowSymbolAsyncIteratorInvalid), R(0), U8(0),
-                B(LdaNamedProperty), R(21), U8(5), U8(5),
-                B(Star), R(22),
-                B(CallProperty0), R(22), R(21), U8(7),
-                B(Star), R(22),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateAsyncFromSyncIterator), R(22), U8(1),
+                B(LdaNamedProperty), R(20), U8(5), U8(5),
+                B(Star), R(21),
+                B(CallProperty0), R(21), R(20), U8(7),
+                B(Star), R(21),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateAsyncFromSyncIterator), R(21), U8(1),
                 B(Star), R(4),
   /*   43 E> */ B(LdaNamedProperty), R(4), U8(6), U8(9),
                 B(Star), R(5),
-                B(Ldar), R(12),
-                B(SwitchOnSmiNoFeedback), U8(7), U8(1), I8(0),
-                B(LdaSmi), I8(-2),
-                B(TestEqualStrictNoFeedback), R(12),
-                B(JumpIfTrue), U8(4),
-                B(Abort), U8(15),
   /*   40 S> */ B(CallProperty0), R(5), R(4), U8(11),
-                B(Star), R(22),
-                B(Mov), R(2), R(21),
-                B(Mov), R(11), R(23),
-                B(CallJSRuntime), U8(%async_function_await_uncaught), R(21), U8(3),
-                B(SuspendGenerator), R(2), R(0), U8(21), U8(0),
-  /*  114 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(12), R(0), U8(21),
                 B(Star), R(21),
+                B(Mov), R(2), R(20),
+                B(Mov), R(11), R(22),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionAwaitUncaught), R(20), U8(3),
+  /*   40 E> */ B(SuspendGenerator), R(2), R(0), U8(20), U8(0),
+                B(ResumeGenerator), R(2), R(0), U8(20),
+                B(Star), R(20),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
-                B(Star), R(22),
+                B(Star), R(21),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(22),
+                B(TestEqualStrictNoFeedback), R(21),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(21),
+                B(Ldar), R(20),
                 B(ReThrow),
-                B(Mov), R(21), R(6),
-  /*   40 E> */ B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(21), U8(1),
+                B(Mov), R(20), R(6),
+  /*   40 E> */ B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(20), U8(1),
                 B(ToBooleanLogicalNot),
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(6), U8(1),
-                B(LdaNamedProperty), R(6), U8(8), U8(13),
+                B(LdaNamedProperty), R(6), U8(7), U8(13),
                 B(JumpIfToBooleanTrue), U8(43),
-                B(LdaNamedProperty), R(6), U8(9), U8(15),
+                B(LdaNamedProperty), R(6), U8(8), U8(15),
                 B(Star), R(8),
                 B(LdaSmi), I8(2),
                 B(Star), R(7),
@@ -664,91 +610,66 @@ bytecodes: [
   /*  103 S> */ B(Jump), U8(8),
                 B(LdaZero),
                 B(Star), R(7),
-                B(JumpLoop), U8(116), I8(0),
+                B(JumpLoop), U8(100), I8(0),
                 B(Jump), U8(40),
-                B(Star), R(21),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(21), U8(10), U8(11),
                 B(Star), R(20),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(20), U8(9), U8(10),
+                B(Star), R(19),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(20),
-                B(PushContext), R(21),
+                B(Ldar), R(19),
+                B(PushContext), R(20),
                 B(LdaSmi), I8(2),
                 B(TestEqualStrict), R(7), U8(19),
                 B(JumpIfFalse), U8(6),
                 B(LdaSmi), I8(1),
                 B(Star), R(7),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(22),
-                B(CallRuntime), U16(Runtime::kReThrow), R(22), U8(1),
-                B(PopContext), R(21),
+                B(Star), R(21),
+                B(CallRuntime), U16(Runtime::kReThrow), R(21), U8(1),
+                B(PopContext), R(20),
                 B(LdaSmi), I8(-1),
-                B(Star), R(18),
                 B(Star), R(17),
+                B(Star), R(16),
                 B(Jump), U8(7),
-                B(Star), R(18),
-                B(LdaZero),
                 B(Star), R(17),
+                B(LdaZero),
+                B(Star), R(16),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(19),
+                B(Star), R(18),
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(20),
-                B(JumpIfTrue), U8(171),
-                B(LdaNamedProperty), R(4), U8(12), U8(21),
+                B(JumpIfTrue), U8(167),
+                B(LdaNamedProperty), R(4), U8(11), U8(21),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
-                B(Jump), U8(160),
+                B(Jump), U8(156),
                 B(LdaSmi), I8(1),
                 B(TestEqualStrict), R(7), U8(23),
-                B(JumpIfFalse), U8(88),
+                B(JumpIfFalse), U8(86),
                 B(Ldar), R(9),
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
+                B(Star), R(19),
+                B(LdaConstant), U8(12),
                 B(Star), R(20),
-                B(LdaConstant), U8(13),
-                B(Star), R(21),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(20), U8(2),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(19), U8(2),
                 B(Throw),
-                B(Mov), R(context), R(20),
-                B(Mov), R(9), R(21),
-                B(Mov), R(4), R(22),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(21), U8(2),
-                B(Star), R(22),
-                B(Mov), R(2), R(21),
-                B(Mov), R(11), R(23),
-                B(CallJSRuntime), U8(%async_function_await_caught), R(21), U8(3),
-                B(SuspendGenerator), R(2), R(0), U8(21), U8(1),
-  /*  114 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(12), R(0), U8(21),
-                B(Star), R(21),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
-                B(Star), R(22),
-                B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(22),
-                B(JumpIfTrue), U8(5),
-                B(Ldar), R(21),
-                B(ReThrow),
-                B(Ldar), R(21),
-                B(Jump), U8(6),
-                B(LdaTheHole),
-                B(SetPendingMessage),
-                B(Ldar), R(20),
-                B(Jump), U8(67),
+                B(Mov), R(context), R(19),
                 B(Mov), R(9), R(20),
                 B(Mov), R(4), R(21),
                 B(InvokeIntrinsic), U8(Runtime::k_Call), R(20), U8(2),
                 B(Star), R(21),
                 B(Mov), R(2), R(20),
                 B(Mov), R(11), R(22),
-                B(CallJSRuntime), U8(%async_function_await_uncaught), R(20), U8(3),
-                B(SuspendGenerator), R(2), R(0), U8(20), U8(2),
-  /*  114 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(12), R(0), U8(20),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionAwaitCaught), R(20), U8(3),
+                B(SuspendGenerator), R(2), R(0), U8(20), U8(1),
+                B(ResumeGenerator), R(2), R(0), U8(20),
                 B(Star), R(20),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(Star), R(21),
@@ -757,94 +678,116 @@ bytecodes: [
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(20),
                 B(ReThrow),
-                B(Mov), R(20), R(10),
-                B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(20), U8(1),
+                B(Ldar), R(20),
+                B(Jump), U8(6),
+                B(LdaTheHole),
+                B(SetPendingMessage),
+                B(Ldar), R(19),
+                B(Jump), U8(65),
+                B(Mov), R(9), R(19),
+                B(Mov), R(4), R(20),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(19), U8(2),
+                B(Star), R(20),
+                B(Mov), R(2), R(19),
+                B(Mov), R(11), R(21),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionAwaitUncaught), R(19), U8(3),
+                B(SuspendGenerator), R(2), R(0), U8(19), U8(2),
+                B(ResumeGenerator), R(2), R(0), U8(19),
+                B(Star), R(19),
+                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
+                B(Star), R(20),
+                B(LdaZero),
+                B(TestEqualStrictNoFeedback), R(20),
+                B(JumpIfTrue), U8(5),
+                B(Ldar), R(19),
+                B(ReThrow),
+                B(Mov), R(19), R(10),
+                B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(19), U8(1),
                 B(JumpIfToBooleanFalse), U8(4),
                 B(Jump), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(10), U8(1),
-                B(Ldar), R(19),
+                B(Ldar), R(18),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(17),
+                B(TestEqualStrictNoFeedback), R(16),
                 B(JumpIfFalse), U8(5),
-                B(Ldar), R(18),
+                B(Ldar), R(17),
                 B(ReThrow),
                 B(LdaUndefined),
-                B(Star), R(18),
-                B(Mov), R(11), R(17),
-                B(CallJSRuntime), U8(%promise_resolve), R(17), U8(2),
+                B(Star), R(17),
+                B(Mov), R(11), R(16),
+                B(InvokeIntrinsic), U8(Runtime::k_ResolvePromise), R(16), U8(2),
                 B(LdaZero),
-                B(Star), R(13),
-                B(Mov), R(11), R(14),
+                B(Star), R(12),
+                B(Mov), R(11), R(13),
                 B(Jump), U8(58),
                 B(Jump), U8(42),
-                B(Star), R(17),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(17), U8(10), U8(14),
                 B(Star), R(16),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(16), U8(9), U8(13),
+                B(Star), R(15),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(16),
-                B(PushContext), R(17),
+                B(Ldar), R(15),
+                B(PushContext), R(16),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(19),
+                B(Star), R(18),
                 B(LdaFalse),
-                B(Star), R(20),
-                B(Mov), R(11), R(18),
-                B(CallJSRuntime), U8(%promise_internal_reject), R(18), U8(3),
-                B(PopContext), R(17),
+                B(Star), R(19),
+                B(Mov), R(11), R(17),
+                B(InvokeIntrinsic), U8(Runtime::k_RejectPromise), R(17), U8(3),
+                B(PopContext), R(16),
                 B(LdaZero),
-                B(Star), R(13),
-                B(Mov), R(11), R(14),
+                B(Star), R(12),
+                B(Mov), R(11), R(13),
                 B(Jump), U8(16),
                 B(LdaSmi), I8(-1),
-                B(Star), R(14),
                 B(Star), R(13),
+                B(Star), R(12),
                 B(Jump), U8(8),
-                B(Star), R(14),
-                B(LdaSmi), I8(1),
                 B(Star), R(13),
+                B(LdaSmi), I8(1),
+                B(Star), R(12),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(15),
+                B(Star), R(14),
                 B(CallJSRuntime), U8(%async_function_promise_release), R(11), U8(1),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
                 B(SetPendingMessage),
-                B(Ldar), R(13),
-                B(SwitchOnSmiNoFeedback), U8(15), U8(2), I8(0),
+                B(Ldar), R(12),
+                B(SwitchOnSmiNoFeedback), U8(14), U8(2), I8(0),
                 B(Jump), U8(8),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
   /*  114 S> */ B(Return),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
                 B(ReThrow),
                 B(LdaUndefined),
   /*  114 S> */ B(Return),
 ]
 constant pool: [
-  Smi [95],
-  Smi [350],
-  Smi [409],
+  Smi [110],
+  Smi [327],
+  Smi [384],
   TUPLE2_TYPE,
   SYMBOL_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
-  Smi [34],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   Smi [6],
   Smi [9],
 ]
 handlers: [
-  [46, 531, 539],
-  [49, 489, 491],
-  [55, 268, 276],
-  [58, 228, 230],
-  [336, 387, 389],
+  [26, 491, 499],
+  [29, 449, 451],
+  [35, 232, 240],
+  [38, 192, 194],
+  [300, 349, 351],
 ]
 
 ---
@@ -943,7 +886,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
                 B(Star), R(17),
                 B(LdaConstant), U8(10),
                 B(Star), R(18),
@@ -980,7 +923,7 @@ bytecodes: [
                 B(LdaUndefined),
                 B(Star), R(15),
                 B(Mov), R(9), R(14),
-                B(CallJSRuntime), U8(%promise_resolve), R(14), U8(2),
+                B(InvokeIntrinsic), U8(Runtime::k_ResolvePromise), R(14), U8(2),
                 B(LdaSmi), I8(1),
                 B(Star), R(10),
                 B(Mov), R(9), R(11),
@@ -999,7 +942,7 @@ bytecodes: [
                 B(LdaFalse),
                 B(Star), R(17),
                 B(Mov), R(9), R(15),
-                B(CallJSRuntime), U8(%promise_internal_reject), R(15), U8(3),
+                B(InvokeIntrinsic), U8(Runtime::k_RejectPromise), R(15), U8(3),
                 B(PopContext), R(14),
                 B(LdaSmi), I8(1),
                 B(Star), R(10),
@@ -1023,7 +966,7 @@ bytecodes: [
                 B(Jump), U8(21),
                 B(Mov), R(9), R(13),
                 B(Mov), R(11), R(14),
-                B(CallJSRuntime), U8(%promise_resolve), R(13), U8(2),
+                B(InvokeIntrinsic), U8(Runtime::k_ResolvePromise), R(13), U8(2),
                 B(Ldar), R(9),
   /*   96 S> */ B(Return),
                 B(Ldar), R(11),
@@ -1034,7 +977,7 @@ bytecodes: [
   /*   96 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   TUPLE2_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
@@ -1042,12 +985,12 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
   Smi [14],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   Smi [6],
   Smi [19],
   Smi [22],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForIn.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForIn.golden
index 579cf70e3de..6b8f4d7bdae 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForIn.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForIn.golden
@@ -188,7 +188,7 @@ bytecodes: [
   /*  152 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   TUPLE2_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
index 46e62ed8911..00f90714d3a 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
@@ -86,7 +86,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
                 B(Star), R(12),
                 B(LdaConstant), U8(8),
                 B(Star), R(13),
@@ -126,7 +126,7 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
@@ -220,7 +220,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
                 B(Star), R(13),
                 B(LdaConstant), U8(8),
                 B(Star), R(14),
@@ -262,7 +262,7 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
@@ -366,7 +366,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
                 B(Star), R(12),
                 B(LdaConstant), U8(8),
                 B(Star), R(13),
@@ -406,7 +406,7 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
@@ -502,7 +502,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
                 B(Star), R(11),
                 B(LdaConstant), U8(10),
                 B(Star), R(12),
@@ -538,7 +538,7 @@ bytecodes: [
   /*  105 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   TUPLE2_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
@@ -546,7 +546,7 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
index 1ea568ac211..1a0155da79c 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
@@ -90,7 +90,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
                 B(Star), R(14),
                 B(LdaConstant), U8(7),
                 B(Star), R(15),
@@ -129,7 +129,7 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
@@ -261,7 +261,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
                 B(Star), R(14),
                 B(LdaConstant), U8(11),
                 B(Star), R(15),
@@ -296,16 +296,16 @@ bytecodes: [
   /*   54 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["eval"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["1"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
@@ -408,7 +408,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
                 B(Star), R(12),
                 B(LdaConstant), U8(9),
                 B(Star), R(13),
@@ -446,10 +446,10 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
@@ -503,7 +503,7 @@ bytecodes: [
                 B(JumpIfUndefined), U8(6),
                 B(Ldar), R(6),
                 B(JumpIfNotNull), U8(16),
-                B(LdaSmi), I8(74),
+                B(LdaSmi), I8(77),
                 B(Star), R(18),
                 B(LdaConstant), U8(4),
                 B(Star), R(19),
@@ -559,7 +559,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
                 B(Star), R(17),
                 B(LdaConstant), U8(9),
                 B(Star), R(18),
@@ -600,7 +600,7 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["y"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
@@ -617,48 +617,38 @@ snippet: "
   }
   f([1, 2, 3]);
 "
-frame size: 20
+frame size: 19
 parameter count: 2
-bytecode array length: 320
+bytecode array length: 298
 bytecodes: [
-                B(Ldar), R(3),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(3), U8(1),
-                B(PushContext), R(13),
-                B(RestoreGeneratorState), R(3),
-                B(Star), R(12),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(12),
+                B(SwitchOnGeneratorState), R(3), U8(0), U8(1),
                 B(CreateFunctionContext), U8(1),
-                B(PushContext), R(13),
+                B(PushContext), R(12),
                 B(Ldar), R(arg0),
                 B(StaCurrentContextSlot), U8(4),
-                B(Mov), R(closure), R(14),
-                B(Mov), R(this), R(15),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(14), U8(2),
+                B(Mov), R(closure), R(13),
+                B(Mov), R(this), R(14),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(13), U8(2),
                 B(Star), R(3),
   /*   11 E> */ B(StackCheck),
-  /*   11 E> */ B(SuspendGenerator), R(3), R(0), U8(14), U8(0),
-  /*   55 S> */ B(Return),
-                B(ResumeGenerator), R(3), R(12), R(0), U8(14),
-                B(Star), R(14),
+  /*   11 E> */ B(SuspendGenerator), R(3), R(0), U8(13), U8(0),
+                B(ResumeGenerator), R(3), R(0), U8(13),
+                B(Star), R(13),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(3), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(1), U8(2), I8(0),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
   /*   11 E> */ B(Throw),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
   /*   55 S> */ B(Return),
                 B(LdaZero),
                 B(Star), R(8),
+                B(Mov), R(context), R(15),
                 B(Mov), R(context), R(16),
-                B(Mov), R(context), R(17),
   /*   35 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
+                B(Star), R(17),
+                B(LdaNamedProperty), R(17), U8(3), U8(0),
                 B(Star), R(18),
-                B(LdaNamedProperty), R(18), U8(3), U8(0),
-                B(Star), R(19),
-                B(CallProperty0), R(19), R(18), U8(2),
+                B(CallProperty0), R(18), R(17), U8(2),
                 B(JumpIfJSReceiver), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(5),
@@ -684,30 +674,30 @@ bytecodes: [
                 B(Star), R(8),
                 B(JumpLoop), U8(47), I8(0),
                 B(Jump), U8(36),
-                B(Star), R(18),
-                B(Ldar), R(closure),
-  /*   50 E> */ B(CreateCatchContext), R(18), U8(7), U8(8),
-                B(PushContext), R(18),
                 B(Star), R(17),
+                B(Ldar), R(closure),
+  /*   50 E> */ B(CreateCatchContext), R(17), U8(7), U8(8),
+                B(PushContext), R(17),
+                B(Star), R(16),
                 B(LdaSmi), I8(2),
                 B(TestEqualStrict), R(8), U8(12),
                 B(JumpIfFalse), U8(6),
                 B(LdaSmi), I8(1),
                 B(Star), R(8),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(19),
-                B(CallRuntime), U16(Runtime::kReThrow), R(19), U8(1),
-                B(PopContext), R(18),
+                B(Star), R(18),
+                B(CallRuntime), U16(Runtime::kReThrow), R(18), U8(1),
+                B(PopContext), R(17),
                 B(LdaSmi), I8(-1),
-                B(Star), R(15),
                 B(Star), R(14),
+                B(Star), R(13),
                 B(Jump), U8(7),
-                B(Star), R(15),
-                B(LdaZero),
                 B(Star), R(14),
+                B(LdaZero),
+                B(Star), R(13),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(16),
+                B(Star), R(15),
                 B(LdaZero),
                 B(TestEqualStrict), R(8), U8(13),
                 B(JumpIfTrue), U8(90),
@@ -723,41 +713,41 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
-                B(Star), R(17),
+                B(Wide), B(LdaSmi), I16(147),
+                B(Star), R(16),
                 B(LdaConstant), U8(10),
-                B(Star), R(18),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(17), U8(2),
+                B(Star), R(17),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(16), U8(2),
                 B(Throw),
-                B(Mov), R(context), R(17),
-                B(Mov), R(10), R(18),
-                B(Mov), R(5), R(19),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(18), U8(2),
+                B(Mov), R(context), R(16),
+                B(Mov), R(10), R(17),
+                B(Mov), R(5), R(18),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(17), U8(2),
                 B(Jump), U8(6),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(17),
+                B(Ldar), R(16),
                 B(Jump), U8(27),
-                B(Mov), R(10), R(17),
-                B(Mov), R(5), R(18),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(17), U8(2),
+                B(Mov), R(10), R(16),
+                B(Mov), R(5), R(17),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(16), U8(2),
                 B(Star), R(11),
                 B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(11), U8(1),
                 B(JumpIfToBooleanFalse), U8(4),
                 B(Jump), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(11), U8(1),
-                B(Ldar), R(16),
+                B(Ldar), R(15),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(14),
+                B(TestEqualStrictNoFeedback), R(13),
                 B(JumpIfFalse), U8(5),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   55 S> */ B(Return),
 ]
 constant pool: [
-  Smi [37],
+  Smi [30],
   Smi [10],
   Smi [7],
   SYMBOL_TYPE,
@@ -765,14 +755,14 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [78, 196, 204],
-  [81, 160, 162],
-  [264, 274, 276],
+  [56, 174, 182],
+  [59, 138, 140],
+  [242, 252, 254],
 ]
 
 ---
@@ -782,68 +772,52 @@ snippet: "
   }
   f([1, 2, 3]);
 "
-frame size: 19
+frame size: 18
 parameter count: 2
-bytecode array length: 380
+bytecode array length: 342
 bytecodes: [
-                B(Ldar), R(2),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(2), U8(1),
-                B(PushContext), R(12),
-                B(RestoreGeneratorState), R(2),
-                B(Star), R(11),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(2), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(11),
+                B(SwitchOnGeneratorState), R(2), U8(0), U8(2),
                 B(CreateFunctionContext), U8(1),
-                B(PushContext), R(12),
+                B(PushContext), R(11),
                 B(Ldar), R(arg0),
                 B(StaCurrentContextSlot), U8(4),
-                B(Mov), R(closure), R(13),
-                B(Mov), R(this), R(14),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(13), U8(2),
+                B(Mov), R(closure), R(12),
+                B(Mov), R(this), R(13),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(12), U8(2),
                 B(Star), R(2),
   /*   11 E> */ B(StackCheck),
-  /*   11 E> */ B(SuspendGenerator), R(2), R(0), U8(13), U8(0),
-  /*   49 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(11), R(0), U8(13),
-                B(Star), R(13),
+  /*   11 E> */ B(SuspendGenerator), R(2), R(0), U8(12), U8(0),
+                B(ResumeGenerator), R(2), R(0), U8(12),
+                B(Star), R(12),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
   /*   11 E> */ B(Throw),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
   /*   49 S> */ B(Return),
                 B(LdaZero),
                 B(Star), R(7),
+                B(Mov), R(context), R(14),
                 B(Mov), R(context), R(15),
-                B(Mov), R(context), R(16),
   /*   35 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
+                B(Star), R(16),
+                B(LdaNamedProperty), R(16), U8(4), U8(0),
                 B(Star), R(17),
-                B(LdaNamedProperty), R(17), U8(4), U8(0),
-                B(Star), R(18),
-                B(CallProperty0), R(18), R(17), U8(2),
+                B(CallProperty0), R(17), R(16), U8(2),
                 B(JumpIfJSReceiver), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(4),
   /*   35 E> */ B(LdaNamedProperty), R(4), U8(5), U8(4),
                 B(Star), R(5),
-                B(Ldar), R(11),
-                B(SwitchOnSmiNoFeedback), U8(6), U8(1), I8(1),
-                B(LdaSmi), I8(-2),
-                B(TestEqualStrictNoFeedback), R(11),
-                B(JumpIfTrue), U8(4),
-                B(Abort), U8(15),
   /*   30 S> */ B(CallProperty0), R(5), R(4), U8(6),
                 B(Star), R(6),
   /*   30 E> */ B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(6), U8(1),
                 B(ToBooleanLogicalNot),
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(6), U8(1),
-                B(LdaNamedProperty), R(6), U8(7), U8(8),
-                B(JumpIfToBooleanTrue), U8(67),
-                B(LdaNamedProperty), R(6), U8(8), U8(10),
+                B(LdaNamedProperty), R(6), U8(6), U8(8),
+                B(JumpIfToBooleanTrue), U8(65),
+                B(LdaNamedProperty), R(6), U8(7), U8(10),
                 B(Star), R(8),
                 B(LdaSmi), I8(2),
                 B(Star), R(7),
@@ -851,53 +825,52 @@ bytecodes: [
   /*   21 E> */ B(StackCheck),
                 B(Mov), R(3), R(0),
   /*   40 S> */ B(LdaFalse),
-                B(Star), R(18),
-                B(Mov), R(0), R(17),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateIterResultObject), R(17), U8(2),
-                B(SuspendGenerator), R(2), R(0), U8(17), U8(1),
-  /*   49 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(11), R(0), U8(17),
                 B(Star), R(17),
+                B(Mov), R(0), R(16),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateIterResultObject), R(16), U8(2),
+  /*   40 E> */ B(SuspendGenerator), R(2), R(0), U8(16), U8(1),
+                B(ResumeGenerator), R(2), R(0), U8(16),
+                B(Star), R(16),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
-                B(SwitchOnSmiNoFeedback), U8(9), U8(2), I8(0),
-                B(Ldar), R(17),
+                B(SwitchOnSmiNoFeedback), U8(8), U8(2), I8(0),
+                B(Ldar), R(16),
   /*   40 E> */ B(Throw),
                 B(LdaZero),
-                B(Star), R(13),
-                B(Mov), R(17), R(14),
+                B(Star), R(12),
+                B(Mov), R(16), R(13),
                 B(Jump), U8(58),
                 B(LdaZero),
                 B(Star), R(7),
-                B(JumpLoop), U8(100), I8(0),
+                B(JumpLoop), U8(84), I8(0),
                 B(Jump), U8(36),
-                B(Star), R(17),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(17), U8(11), U8(12),
-                B(PushContext), R(17),
                 B(Star), R(16),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(16), U8(10), U8(11),
+                B(PushContext), R(16),
+                B(Star), R(15),
                 B(LdaSmi), I8(2),
                 B(TestEqualStrict), R(7), U8(12),
                 B(JumpIfFalse), U8(6),
                 B(LdaSmi), I8(1),
                 B(Star), R(7),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(18),
-                B(CallRuntime), U16(Runtime::kReThrow), R(18), U8(1),
-                B(PopContext), R(17),
+                B(Star), R(17),
+                B(CallRuntime), U16(Runtime::kReThrow), R(17), U8(1),
+                B(PopContext), R(16),
                 B(LdaSmi), I8(-1),
-                B(Star), R(14),
                 B(Star), R(13),
+                B(Star), R(12),
                 B(Jump), U8(8),
-                B(Star), R(14),
-                B(LdaSmi), I8(1),
                 B(Star), R(13),
+                B(LdaSmi), I8(1),
+                B(Star), R(12),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(15),
+                B(Star), R(14),
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(13),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(4), U8(13), U8(14),
+                B(LdaNamedProperty), R(4), U8(12), U8(14),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -909,64 +882,63 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
+                B(Star), R(15),
+                B(LdaConstant), U8(13),
                 B(Star), R(16),
-                B(LdaConstant), U8(14),
-                B(Star), R(17),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(16), U8(2),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(15), U8(2),
                 B(Throw),
-                B(Mov), R(context), R(16),
-                B(Mov), R(9), R(17),
-                B(Mov), R(4), R(18),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(17), U8(2),
+                B(Mov), R(context), R(15),
+                B(Mov), R(9), R(16),
+                B(Mov), R(4), R(17),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(16), U8(2),
                 B(Jump), U8(6),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(16),
+                B(Ldar), R(15),
                 B(Jump), U8(27),
-                B(Mov), R(9), R(16),
-                B(Mov), R(4), R(17),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(16), U8(2),
+                B(Mov), R(9), R(15),
+                B(Mov), R(4), R(16),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(15), U8(2),
                 B(Star), R(10),
                 B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(10), U8(1),
                 B(JumpIfToBooleanFalse), U8(4),
                 B(Jump), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(10), U8(1),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
                 B(SetPendingMessage),
-                B(Ldar), R(13),
-                B(SwitchOnSmiNoFeedback), U8(15), U8(2), I8(0),
+                B(Ldar), R(12),
+                B(SwitchOnSmiNoFeedback), U8(14), U8(2), I8(0),
                 B(Jump), U8(8),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
   /*   49 S> */ B(Return),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   49 S> */ B(Return),
 ]
 constant pool: [
-  Smi [37],
-  Smi [96],
+  Smi [30],
+  Smi [144],
   Smi [10],
   Smi [7],
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
-  Smi [69],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   Smi [15],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
   Smi [9],
 ]
 handlers: [
-  [78, 249, 257],
-  [81, 213, 215],
-  [318, 328, 330],
+  [56, 211, 219],
+  [59, 175, 177],
+  [280, 290, 292],
 ]
 
 ---
@@ -1065,7 +1037,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
                 B(Star), R(21),
                 B(LdaConstant), U8(7),
                 B(Star), R(22),
@@ -1098,7 +1070,7 @@ bytecodes: [
                 B(LdaUndefined),
                 B(Star), R(19),
                 B(Mov), R(12), R(18),
-                B(CallJSRuntime), U8(%promise_resolve), R(18), U8(2),
+                B(InvokeIntrinsic), U8(Runtime::k_ResolvePromise), R(18), U8(2),
                 B(LdaZero),
                 B(Star), R(14),
                 B(Mov), R(12), R(15),
@@ -1117,7 +1089,7 @@ bytecodes: [
                 B(LdaFalse),
                 B(Star), R(21),
                 B(Mov), R(12), R(19),
-                B(CallJSRuntime), U8(%promise_internal_reject), R(19), U8(3),
+                B(InvokeIntrinsic), U8(Runtime::k_RejectPromise), R(19), U8(3),
                 B(PopContext), R(18),
                 B(LdaZero),
                 B(Star), R(14),
@@ -1152,10 +1124,10 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   Smi [6],
   Smi [9],
 ]
@@ -1174,118 +1146,102 @@ snippet: "
   }
   f([1, 2, 3]);
 "
-frame size: 25
+frame size: 24
 parameter count: 2
-bytecode array length: 459
+bytecode array length: 423
 bytecodes: [
-                B(Ldar), R(2),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(2), U8(1),
-                B(PushContext), R(13),
-                B(RestoreGeneratorState), R(2),
-                B(Star), R(12),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(12),
+                B(SwitchOnGeneratorState), R(2), U8(0), U8(1),
                 B(CreateFunctionContext), U8(1),
-                B(PushContext), R(13),
+                B(PushContext), R(12),
                 B(Ldar), R(arg0),
                 B(StaCurrentContextSlot), U8(4),
-                B(Mov), R(closure), R(14),
-                B(Mov), R(this), R(15),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(14), U8(2),
+                B(Mov), R(closure), R(13),
+                B(Mov), R(this), R(14),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(13), U8(2),
                 B(Star), R(2),
   /*   16 E> */ B(StackCheck),
                 B(CallJSRuntime), U8(%async_function_promise_create), R(0), U8(0),
                 B(Star), R(11),
+                B(Mov), R(context), R(15),
                 B(Mov), R(context), R(16),
-                B(Mov), R(context), R(17),
                 B(LdaZero),
                 B(Star), R(7),
+                B(Mov), R(context), R(19),
                 B(Mov), R(context), R(20),
-                B(Mov), R(context), R(21),
   /*   40 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
+                B(Star), R(21),
+                B(LdaNamedProperty), R(21), U8(1), U8(0),
                 B(Star), R(22),
-                B(LdaNamedProperty), R(22), U8(1), U8(0),
-                B(Star), R(23),
-                B(CallProperty0), R(23), R(22), U8(2),
+                B(CallProperty0), R(22), R(21), U8(2),
                 B(JumpIfJSReceiver), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(4),
   /*   40 E> */ B(LdaNamedProperty), R(4), U8(2), U8(4),
                 B(Star), R(5),
-                B(Ldar), R(12),
-                B(SwitchOnSmiNoFeedback), U8(3), U8(1), I8(0),
-                B(LdaSmi), I8(-2),
-                B(TestEqualStrictNoFeedback), R(12),
-                B(JumpIfTrue), U8(4),
-                B(Abort), U8(15),
   /*   35 S> */ B(CallProperty0), R(5), R(4), U8(6),
                 B(Star), R(6),
   /*   35 E> */ B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(6), U8(1),
                 B(ToBooleanLogicalNot),
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(6), U8(1),
-                B(LdaNamedProperty), R(6), U8(4), U8(8),
-                B(JumpIfToBooleanTrue), U8(65),
-                B(LdaNamedProperty), R(6), U8(5), U8(10),
+                B(LdaNamedProperty), R(6), U8(3), U8(8),
+                B(JumpIfToBooleanTrue), U8(63),
+                B(LdaNamedProperty), R(6), U8(4), U8(10),
                 B(Star), R(8),
                 B(LdaSmi), I8(2),
                 B(Star), R(7),
                 B(Mov), R(8), R(3),
   /*   26 E> */ B(StackCheck),
                 B(Mov), R(3), R(0),
-  /*   45 S> */ B(Mov), R(2), R(22),
-                B(Mov), R(0), R(23),
-                B(Mov), R(11), R(24),
-                B(CallJSRuntime), U8(%async_function_await_uncaught), R(22), U8(3),
-                B(SuspendGenerator), R(2), R(0), U8(22), U8(0),
-  /*   54 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(12), R(0), U8(22),
-                B(Star), R(22),
+  /*   45 S> */ B(Mov), R(2), R(21),
+                B(Mov), R(0), R(22),
+                B(Mov), R(11), R(23),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionAwaitUncaught), R(21), U8(3),
+  /*   45 E> */ B(SuspendGenerator), R(2), R(0), U8(21), U8(0),
+                B(ResumeGenerator), R(2), R(0), U8(21),
+                B(Star), R(21),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
-                B(Star), R(23),
+                B(Star), R(22),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(23),
+                B(TestEqualStrictNoFeedback), R(22),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(22),
+                B(Ldar), R(21),
                 B(ReThrow),
                 B(LdaZero),
                 B(Star), R(7),
-                B(JumpLoop), U8(98), I8(0),
+                B(JumpLoop), U8(82), I8(0),
                 B(Jump), U8(40),
-                B(Star), R(22),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(22), U8(6), U8(7),
                 B(Star), R(21),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(21), U8(5), U8(6),
+                B(Star), R(20),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(21),
-                B(PushContext), R(22),
+                B(Ldar), R(20),
+                B(PushContext), R(21),
                 B(LdaSmi), I8(2),
                 B(TestEqualStrict), R(7), U8(12),
                 B(JumpIfFalse), U8(6),
                 B(LdaSmi), I8(1),
                 B(Star), R(7),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(23),
-                B(CallRuntime), U16(Runtime::kReThrow), R(23), U8(1),
-                B(PopContext), R(22),
+                B(Star), R(22),
+                B(CallRuntime), U16(Runtime::kReThrow), R(22), U8(1),
+                B(PopContext), R(21),
                 B(LdaSmi), I8(-1),
-                B(Star), R(19),
                 B(Star), R(18),
+                B(Star), R(17),
                 B(Jump), U8(7),
-                B(Star), R(19),
-                B(LdaZero),
                 B(Star), R(18),
+                B(LdaZero),
+                B(Star), R(17),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(20),
+                B(Star), R(19),
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(13),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(4), U8(8), U8(14),
+                B(LdaNamedProperty), R(4), U8(7), U8(14),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -1297,107 +1253,106 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
+                B(Star), R(20),
+                B(LdaConstant), U8(8),
                 B(Star), R(21),
-                B(LdaConstant), U8(9),
-                B(Star), R(22),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(21), U8(2),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(20), U8(2),
                 B(Throw),
-                B(Mov), R(context), R(21),
-                B(Mov), R(9), R(22),
-                B(Mov), R(4), R(23),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(22), U8(2),
+                B(Mov), R(context), R(20),
+                B(Mov), R(9), R(21),
+                B(Mov), R(4), R(22),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(21), U8(2),
                 B(Jump), U8(6),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(21),
+                B(Ldar), R(20),
                 B(Jump), U8(27),
-                B(Mov), R(9), R(21),
-                B(Mov), R(4), R(22),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(21), U8(2),
+                B(Mov), R(9), R(20),
+                B(Mov), R(4), R(21),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(20), U8(2),
                 B(Star), R(10),
                 B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(10), U8(1),
                 B(JumpIfToBooleanFalse), U8(4),
                 B(Jump), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(10), U8(1),
-                B(Ldar), R(20),
+                B(Ldar), R(19),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(18),
+                B(TestEqualStrictNoFeedback), R(17),
                 B(JumpIfFalse), U8(5),
-                B(Ldar), R(19),
+                B(Ldar), R(18),
                 B(ReThrow),
                 B(LdaUndefined),
-                B(Star), R(19),
-                B(Mov), R(11), R(18),
-                B(CallJSRuntime), U8(%promise_resolve), R(18), U8(2),
+                B(Star), R(18),
+                B(Mov), R(11), R(17),
+                B(InvokeIntrinsic), U8(Runtime::k_ResolvePromise), R(17), U8(2),
                 B(LdaZero),
-                B(Star), R(14),
-                B(Mov), R(11), R(15),
+                B(Star), R(13),
+                B(Mov), R(11), R(14),
                 B(Jump), U8(58),
                 B(Jump), U8(42),
-                B(Star), R(18),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(18), U8(6), U8(10),
                 B(Star), R(17),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(17), U8(5), U8(9),
+                B(Star), R(16),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(17),
-                B(PushContext), R(18),
+                B(Ldar), R(16),
+                B(PushContext), R(17),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(20),
+                B(Star), R(19),
                 B(LdaFalse),
-                B(Star), R(21),
-                B(Mov), R(11), R(19),
-                B(CallJSRuntime), U8(%promise_internal_reject), R(19), U8(3),
-                B(PopContext), R(18),
+                B(Star), R(20),
+                B(Mov), R(11), R(18),
+                B(InvokeIntrinsic), U8(Runtime::k_RejectPromise), R(18), U8(3),
+                B(PopContext), R(17),
                 B(LdaZero),
-                B(Star), R(14),
-                B(Mov), R(11), R(15),
+                B(Star), R(13),
+                B(Mov), R(11), R(14),
                 B(Jump), U8(16),
                 B(LdaSmi), I8(-1),
-                B(Star), R(15),
                 B(Star), R(14),
+                B(Star), R(13),
                 B(Jump), U8(8),
-                B(Star), R(15),
-                B(LdaSmi), I8(1),
                 B(Star), R(14),
+                B(LdaSmi), I8(1),
+                B(Star), R(13),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(16),
+                B(Star), R(15),
                 B(CallJSRuntime), U8(%async_function_promise_release), R(11), U8(1),
-                B(Ldar), R(16),
+                B(Ldar), R(15),
                 B(SetPendingMessage),
-                B(Ldar), R(14),
-                B(SwitchOnSmiNoFeedback), U8(11), U8(2), I8(0),
+                B(Ldar), R(13),
+                B(SwitchOnSmiNoFeedback), U8(10), U8(2), I8(0),
                 B(Jump), U8(8),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
   /*   54 S> */ B(Return),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   54 S> */ B(Return),
 ]
 constant pool: [
-  Smi [81],
+  Smi [134],
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
-  Smi [72],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   Smi [6],
   Smi [9],
 ]
 handlers: [
-  [54, 418, 426],
-  [57, 376, 378],
-  [63, 236, 244],
-  [66, 196, 198],
-  [304, 314, 316],
+  [34, 382, 390],
+  [37, 340, 342],
+  [43, 200, 208],
+  [46, 160, 162],
+  [268, 278, 280],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/GenerateTestUndetectable.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/GenerateTestUndetectable.golden
index 20d3e10c569..ee3e21e1eb3 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/GenerateTestUndetectable.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/GenerateTestUndetectable.golden
@@ -30,7 +30,7 @@ bytecodes: [
   /*  106 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -60,7 +60,7 @@ bytecodes: [
   /*  111 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -90,7 +90,7 @@ bytecodes: [
   /*  106 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -120,7 +120,7 @@ bytecodes: [
   /*  111 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -149,7 +149,7 @@ bytecodes: [
   /*  107 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -178,7 +178,7 @@ bytecodes: [
   /*  112 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -207,7 +207,7 @@ bytecodes: [
   /*  107 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -236,7 +236,7 @@ bytecodes: [
   /*  112 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
index f09cd9fd00b..2dc77a7986b 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
@@ -11,40 +11,30 @@ snippet: "
   function* f() { }
   f();
 "
-frame size: 4
+frame size: 3
 parameter count: 1
-bytecode array length: 66
+bytecode array length: 44
 bytecodes: [
-                B(Ldar), R(0),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(0), U8(1),
-                B(PushContext), R(2),
-                B(RestoreGeneratorState), R(0),
-                B(Star), R(1),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(1),
-                B(Mov), R(closure), R(2),
-                B(Mov), R(this), R(3),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(2), U8(2),
+                B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
+                B(Mov), R(closure), R(1),
+                B(Mov), R(this), R(2),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(1), U8(2),
                 B(Star), R(0),
   /*   11 E> */ B(StackCheck),
-  /*   11 E> */ B(SuspendGenerator), R(0), R(0), U8(2), U8(0),
-  /*   16 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(2),
-                B(Star), R(2),
+  /*   11 E> */ B(SuspendGenerator), R(0), R(0), U8(1), U8(0),
+                B(ResumeGenerator), R(0), R(0), U8(1),
+                B(Star), R(1),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(1), U8(2), I8(0),
-                B(Ldar), R(2),
+                B(Ldar), R(1),
   /*   11 E> */ B(Throw),
-                B(Ldar), R(2),
+                B(Ldar), R(1),
   /*   16 S> */ B(Return),
                 B(LdaUndefined),
   /*   16 S> */ B(Return),
 ]
 constant pool: [
-  Smi [29],
+  Smi [22],
   Smi [10],
   Smi [7],
 ]
@@ -56,56 +46,45 @@ snippet: "
   function* f() { yield 42 }
   f();
 "
-frame size: 4
+frame size: 3
 parameter count: 1
-bytecode array length: 104
+bytecode array length: 80
 bytecodes: [
-                B(Ldar), R(0),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(0), U8(1),
-                B(PushContext), R(2),
-                B(RestoreGeneratorState), R(0),
-                B(Star), R(1),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(2), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(1),
-                B(Mov), R(closure), R(2),
-                B(Mov), R(this), R(3),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(2), U8(2),
+                B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
+                B(Mov), R(closure), R(1),
+                B(Mov), R(this), R(2),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(1), U8(2),
                 B(Star), R(0),
   /*   11 E> */ B(StackCheck),
-  /*   11 E> */ B(SuspendGenerator), R(0), R(0), U8(2), U8(0),
-  /*   25 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(2),
-                B(Star), R(2),
+  /*   11 E> */ B(SuspendGenerator), R(0), R(0), U8(1), U8(0),
+                B(ResumeGenerator), R(0), R(0), U8(1),
+                B(Star), R(1),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(2),
+                B(Ldar), R(1),
   /*   11 E> */ B(Throw),
-                B(Ldar), R(2),
+                B(Ldar), R(1),
   /*   25 S> */ B(Return),
   /*   16 S> */ B(LdaSmi), I8(42),
-                B(Star), R(2),
+                B(Star), R(1),
                 B(LdaFalse),
-                B(Star), R(3),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateIterResultObject), R(2), U8(2),
-                B(SuspendGenerator), R(0), R(0), U8(2), U8(1),
-  /*   25 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(2),
                 B(Star), R(2),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateIterResultObject), R(1), U8(2),
+  /*   16 E> */ B(SuspendGenerator), R(0), R(0), U8(1), U8(1),
+                B(ResumeGenerator), R(0), R(0), U8(1),
+                B(Star), R(1),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(4), U8(2), I8(0),
-                B(Ldar), R(2),
+                B(Ldar), R(1),
   /*   16 E> */ B(Throw),
-                B(Ldar), R(2),
+                B(Ldar), R(1),
   /*   25 S> */ B(Return),
                 B(LdaUndefined),
   /*   25 S> */ B(Return),
 ]
 constant pool: [
-  Smi [29],
-  Smi [67],
+  Smi [22],
+  Smi [58],
   Smi [10],
   Smi [7],
   Smi [10],
@@ -119,64 +98,48 @@ snippet: "
   function* f() { for (let x of [42]) yield x }
   f();
 "
-frame size: 18
+frame size: 17
 parameter count: 1
-bytecode array length: 374
+bytecode array length: 336
 bytecodes: [
-                B(Ldar), R(2),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(2), U8(1),
-                B(PushContext), R(12),
-                B(RestoreGeneratorState), R(2),
-                B(Star), R(11),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(2), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(11),
-                B(Mov), R(closure), R(12),
-                B(Mov), R(this), R(13),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(12), U8(2),
+                B(SwitchOnGeneratorState), R(2), U8(0), U8(2),
+                B(Mov), R(closure), R(11),
+                B(Mov), R(this), R(12),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(11), U8(2),
                 B(Star), R(2),
   /*   11 E> */ B(StackCheck),
-  /*   11 E> */ B(SuspendGenerator), R(2), R(0), U8(12), U8(0),
-  /*   44 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(11), R(0), U8(12),
-                B(Star), R(12),
+  /*   11 E> */ B(SuspendGenerator), R(2), R(0), U8(11), U8(0),
+                B(ResumeGenerator), R(2), R(0), U8(11),
+                B(Star), R(11),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(12),
+                B(Ldar), R(11),
   /*   11 E> */ B(Throw),
-                B(Ldar), R(12),
+                B(Ldar), R(11),
   /*   44 S> */ B(Return),
                 B(LdaZero),
                 B(Star), R(7),
+                B(Mov), R(context), R(13),
                 B(Mov), R(context), R(14),
-                B(Mov), R(context), R(15),
   /*   30 S> */ B(CreateArrayLiteral), U8(4), U8(0), U8(37),
+                B(Star), R(15),
+                B(LdaNamedProperty), R(15), U8(5), U8(1),
                 B(Star), R(16),
-                B(LdaNamedProperty), R(16), U8(5), U8(1),
-                B(Star), R(17),
-                B(CallProperty0), R(17), R(16), U8(3),
+                B(CallProperty0), R(16), R(15), U8(3),
                 B(JumpIfJSReceiver), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(4),
   /*   30 E> */ B(LdaNamedProperty), R(4), U8(6), U8(5),
                 B(Star), R(5),
-                B(Ldar), R(11),
-                B(SwitchOnSmiNoFeedback), U8(7), U8(1), I8(1),
-                B(LdaSmi), I8(-2),
-                B(TestEqualStrictNoFeedback), R(11),
-                B(JumpIfTrue), U8(4),
-                B(Abort), U8(15),
   /*   25 S> */ B(CallProperty0), R(5), R(4), U8(7),
                 B(Star), R(6),
   /*   25 E> */ B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(6), U8(1),
                 B(ToBooleanLogicalNot),
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(6), U8(1),
-                B(LdaNamedProperty), R(6), U8(8), U8(9),
-                B(JumpIfToBooleanTrue), U8(67),
-                B(LdaNamedProperty), R(6), U8(9), U8(11),
+                B(LdaNamedProperty), R(6), U8(7), U8(9),
+                B(JumpIfToBooleanTrue), U8(65),
+                B(LdaNamedProperty), R(6), U8(8), U8(11),
                 B(Star), R(8),
                 B(LdaSmi), I8(2),
                 B(Star), R(7),
@@ -184,53 +147,52 @@ bytecodes: [
   /*   16 E> */ B(StackCheck),
                 B(Mov), R(3), R(0),
   /*   36 S> */ B(LdaFalse),
-                B(Star), R(17),
-                B(Mov), R(0), R(16),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateIterResultObject), R(16), U8(2),
-                B(SuspendGenerator), R(2), R(0), U8(16), U8(1),
-  /*   44 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(11), R(0), U8(16),
                 B(Star), R(16),
+                B(Mov), R(0), R(15),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateIterResultObject), R(15), U8(2),
+  /*   36 E> */ B(SuspendGenerator), R(2), R(0), U8(15), U8(1),
+                B(ResumeGenerator), R(2), R(0), U8(15),
+                B(Star), R(15),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
-                B(SwitchOnSmiNoFeedback), U8(10), U8(2), I8(0),
-                B(Ldar), R(16),
+                B(SwitchOnSmiNoFeedback), U8(9), U8(2), I8(0),
+                B(Ldar), R(15),
   /*   36 E> */ B(Throw),
                 B(LdaZero),
-                B(Star), R(12),
-                B(Mov), R(16), R(13),
+                B(Star), R(11),
+                B(Mov), R(15), R(12),
                 B(Jump), U8(58),
                 B(LdaZero),
                 B(Star), R(7),
-                B(JumpLoop), U8(100), I8(0),
+                B(JumpLoop), U8(84), I8(0),
                 B(Jump), U8(36),
-                B(Star), R(16),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(16), U8(12), U8(13),
-                B(PushContext), R(16),
                 B(Star), R(15),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(15), U8(11), U8(12),
+                B(PushContext), R(15),
+                B(Star), R(14),
                 B(LdaSmi), I8(2),
                 B(TestEqualStrict), R(7), U8(13),
                 B(JumpIfFalse), U8(6),
                 B(LdaSmi), I8(1),
                 B(Star), R(7),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(17),
-                B(CallRuntime), U16(Runtime::kReThrow), R(17), U8(1),
-                B(PopContext), R(16),
+                B(Star), R(16),
+                B(CallRuntime), U16(Runtime::kReThrow), R(16), U8(1),
+                B(PopContext), R(15),
                 B(LdaSmi), I8(-1),
-                B(Star), R(13),
                 B(Star), R(12),
+                B(Star), R(11),
                 B(Jump), U8(8),
-                B(Star), R(13),
-                B(LdaSmi), I8(1),
                 B(Star), R(12),
+                B(LdaSmi), I8(1),
+                B(Star), R(11),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(14),
+                B(Star), R(13),
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(14),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(4), U8(14), U8(15),
+                B(LdaNamedProperty), R(4), U8(13), U8(15),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -242,65 +204,64 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(144),
+                B(Wide), B(LdaSmi), I16(147),
+                B(Star), R(14),
+                B(LdaConstant), U8(14),
                 B(Star), R(15),
-                B(LdaConstant), U8(15),
-                B(Star), R(16),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(15), U8(2),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(14), U8(2),
                 B(Throw),
-                B(Mov), R(context), R(15),
-                B(Mov), R(9), R(16),
-                B(Mov), R(4), R(17),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(16), U8(2),
+                B(Mov), R(context), R(14),
+                B(Mov), R(9), R(15),
+                B(Mov), R(4), R(16),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(15), U8(2),
                 B(Jump), U8(6),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
                 B(Jump), U8(27),
-                B(Mov), R(9), R(15),
-                B(Mov), R(4), R(16),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(15), U8(2),
+                B(Mov), R(9), R(14),
+                B(Mov), R(4), R(15),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(14), U8(2),
                 B(Star), R(10),
                 B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(10), U8(1),
                 B(JumpIfToBooleanFalse), U8(4),
                 B(Jump), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(10), U8(1),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
                 B(SetPendingMessage),
-                B(Ldar), R(12),
-                B(SwitchOnSmiNoFeedback), U8(16), U8(2), I8(0),
+                B(Ldar), R(11),
+                B(SwitchOnSmiNoFeedback), U8(15), U8(2), I8(0),
                 B(Jump), U8(8),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
   /*   44 S> */ B(Return),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   44 S> */ B(Return),
 ]
 constant pool: [
-  Smi [29],
-  Smi [90],
+  Smi [22],
+  Smi [138],
   Smi [10],
   Smi [7],
   TUPLE2_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
-  Smi [69],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   Smi [15],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
   Smi [9],
 ]
 handlers: [
-  [70, 243, 251],
-  [73, 207, 209],
-  [312, 322, 324],
+  [48, 205, 213],
+  [51, 169, 171],
+  [274, 284, 286],
 ]
 
 ---
@@ -309,117 +270,99 @@ snippet: "
   function* f() { yield* g() }
   f();
 "
-frame size: 10
+frame size: 9
 parameter count: 1
-bytecode array length: 255
+bytecode array length: 217
 bytecodes: [
-                B(Ldar), R(0),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(0), U8(1),
-                B(PushContext), R(2),
-                B(RestoreGeneratorState), R(0),
-                B(Star), R(1),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(2), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(1),
-                B(Mov), R(closure), R(2),
-                B(Mov), R(this), R(3),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(2), U8(2),
+                B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
+                B(Mov), R(closure), R(1),
+                B(Mov), R(this), R(2),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(1), U8(2),
                 B(Star), R(0),
   /*   38 E> */ B(StackCheck),
-  /*   38 E> */ B(SuspendGenerator), R(0), R(0), U8(2), U8(0),
-  /*   54 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(2),
-                B(Star), R(2),
+  /*   38 E> */ B(SuspendGenerator), R(0), R(0), U8(1), U8(0),
+                B(ResumeGenerator), R(0), R(0), U8(1),
+                B(Star), R(1),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(2),
+                B(Ldar), R(1),
   /*   38 E> */ B(Throw),
-                B(Ldar), R(2),
+                B(Ldar), R(1),
   /*   54 S> */ B(Return),
   /*   43 S> */ B(LdaGlobal), U8(4), U8(0),
-                B(Star), R(9),
-  /*   50 E> */ B(CallUndefinedReceiver0), R(9), U8(2),
-                B(Star), R(7),
-                B(LdaNamedProperty), R(7), U8(5), U8(4),
                 B(Star), R(8),
-                B(CallProperty0), R(8), R(7), U8(6),
+  /*   50 E> */ B(CallUndefinedReceiver0), R(8), U8(2),
+                B(Star), R(6),
+                B(LdaNamedProperty), R(6), U8(5), U8(4),
+                B(Star), R(7),
+                B(CallProperty0), R(7), R(6), U8(6),
                 B(JumpIfJSReceiver), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
-                B(Star), R(4),
-                B(LdaNamedProperty), R(4), U8(6), U8(8),
-                B(Star), R(6),
-                B(LdaUndefined),
+                B(Star), R(3),
+                B(LdaNamedProperty), R(3), U8(6), U8(8),
                 B(Star), R(5),
+                B(LdaUndefined),
+                B(Star), R(4),
                 B(LdaZero),
-                B(Star), R(3),
-                B(Ldar), R(1),
-                B(SwitchOnSmiNoFeedback), U8(7), U8(1), I8(1),
-                B(LdaSmi), I8(-2),
-                B(TestEqualStrictNoFeedback), R(1),
-                B(JumpIfTrue), U8(4),
-                B(Abort), U8(15),
-                B(Ldar), R(3),
-                B(SwitchOnSmiNoFeedback), U8(8), U8(2), I8(1),
-                B(CallProperty1), R(6), R(4), R(5), U8(10),
+                B(Star), R(2),
+                B(Ldar), R(2),
+                B(SwitchOnSmiNoFeedback), U8(7), U8(2), I8(1),
+                B(CallProperty1), R(5), R(3), R(4), U8(10),
                 B(Jump), U8(69),
-                B(LdaNamedProperty), R(4), U8(10), U8(12),
+                B(LdaNamedProperty), R(3), U8(9), U8(12),
                 B(JumpIfUndefined), U8(13),
                 B(JumpIfNull), U8(11),
-                B(Star), R(9),
-                B(CallProperty1), R(9), R(4), R(5), U8(14),
+                B(Star), R(8),
+                B(CallProperty1), R(8), R(3), R(4), U8(14),
                 B(Jump), U8(52),
-                B(Ldar), R(5),
+                B(Ldar), R(4),
   /*   54 S> */ B(Return),
-                B(LdaNamedProperty), R(4), U8(11), U8(16),
+                B(LdaNamedProperty), R(3), U8(10), U8(16),
                 B(JumpIfUndefined), U8(13),
                 B(JumpIfNull), U8(11),
-                B(Star), R(9),
-                B(CallProperty1), R(9), R(4), R(5), U8(18),
+                B(Star), R(8),
+                B(CallProperty1), R(8), R(3), R(4), U8(18),
                 B(Jump), U8(32),
-                B(LdaNamedProperty), R(4), U8(10), U8(20),
+                B(LdaNamedProperty), R(3), U8(9), U8(20),
                 B(JumpIfUndefined), U8(21),
                 B(JumpIfNull), U8(19),
-                B(Star), R(9),
-                B(CallProperty0), R(9), R(4), U8(22),
+                B(Star), R(8),
+                B(CallProperty0), R(8), R(3), U8(22),
                 B(Jump), U8(2),
                 B(JumpIfJSReceiver), U8(9),
-                B(Star), R(9),
-                B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(9), U8(1),
+                B(Star), R(8),
+                B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(8), U8(1),
                 B(CallRuntime), U16(Runtime::kThrowThrowMethodMissing), R(0), U8(0),
-                B(Star), R(2),
+                B(Star), R(1),
                 B(JumpIfJSReceiver), U8(7),
-                B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(2), U8(1),
-                B(LdaNamedProperty), R(2), U8(12), U8(24),
-                B(JumpIfToBooleanTrue), U8(26),
-                B(Ldar), R(2),
-                B(SuspendGenerator), R(0), R(0), U8(9), U8(1),
-  /*   54 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(1), R(0), U8(9),
-                B(Star), R(5),
+                B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(1), U8(1),
+                B(LdaNamedProperty), R(1), U8(11), U8(24),
+                B(JumpIfToBooleanTrue), U8(24),
+                B(Ldar), R(1),
+  /*   43 E> */ B(SuspendGenerator), R(0), R(0), U8(8), U8(1),
+                B(ResumeGenerator), R(0), R(0), U8(8),
+                B(Star), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
+                B(Star), R(2),
+                B(JumpLoop), U8(114), I8(0),
+                B(LdaNamedProperty), R(1), U8(12), U8(26),
                 B(Star), R(3),
-                B(JumpLoop), U8(130), I8(0),
-                B(LdaNamedProperty), R(2), U8(13), U8(26),
-                B(Star), R(4),
                 B(LdaSmi), I8(1),
-                B(TestEqualStrictNoFeedback), R(3),
+                B(TestEqualStrictNoFeedback), R(2),
                 B(JumpIfFalse), U8(5),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*   54 S> */ B(Return),
                 B(LdaUndefined),
   /*   54 S> */ B(Return),
 ]
 constant pool: [
-  Smi [29],
-  Smi [91],
+  Smi [22],
+  Smi [185],
   Smi [10],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["g"],
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
-  Smi [115],
   Smi [11],
   Smi [31],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/Modules.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/Modules.golden
index 9c876157ad8..d6db2f43c30 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/Modules.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/Modules.golden
@@ -11,47 +11,37 @@ top level: yes
 snippet: "
   import \"bar\";
 "
-frame size: 6
+frame size: 5
 parameter count: 2
-bytecode array length: 84
+bytecode array length: 62
 bytecodes: [
-                B(Ldar), R(0),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(0), U8(1),
-                B(PushContext), R(3),
-                B(RestoreGeneratorState), R(0),
-                B(Star), R(2),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(2),
+                B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(5),
-                B(Mov), R(arg0), R(3),
-                B(Mov), R(closure), R(4),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
-                B(PushContext), R(3),
-                B(Mov), R(this), R(5),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
+                B(Star), R(4),
+                B(Mov), R(arg0), R(2),
+                B(Mov), R(closure), R(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(3),
+                B(PushContext), R(2),
+                B(Mov), R(this), R(4),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
   /*    0 E> */ B(StackCheck),
-  /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
-  /*   13 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(2), R(0), U8(4),
-                B(Star), R(4),
+  /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
+                B(ResumeGenerator), R(0), R(0), U8(3),
+                B(Star), R(3),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*    0 E> */ B(Throw),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*   13 S> */ B(Return),
-                B(Mov), R(4), R(1),
+                B(Mov), R(3), R(1),
                 B(Ldar), R(1),
   /*   13 S> */ B(Return),
 ]
 constant pool: [
-  Smi [43],
-  FIXED_ARRAY_TYPE,
+  Smi [36],
+  SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
 ]
@@ -62,47 +52,37 @@ handlers: [
 snippet: "
   import {foo} from \"bar\";
 "
-frame size: 6
+frame size: 5
 parameter count: 2
-bytecode array length: 84
+bytecode array length: 62
 bytecodes: [
-                B(Ldar), R(0),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(0), U8(1),
-                B(PushContext), R(3),
-                B(RestoreGeneratorState), R(0),
-                B(Star), R(2),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(2),
+                B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(5),
-                B(Mov), R(arg0), R(3),
-                B(Mov), R(closure), R(4),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
-                B(PushContext), R(3),
-                B(Mov), R(this), R(5),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
+                B(Star), R(4),
+                B(Mov), R(arg0), R(2),
+                B(Mov), R(closure), R(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(3),
+                B(PushContext), R(2),
+                B(Mov), R(this), R(4),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
   /*    0 E> */ B(StackCheck),
-  /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
-  /*   24 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(2), R(0), U8(4),
-                B(Star), R(4),
+  /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
+                B(ResumeGenerator), R(0), R(0), U8(3),
+                B(Star), R(3),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*    0 E> */ B(Throw),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*   24 S> */ B(Return),
-                B(Mov), R(4), R(1),
+                B(Mov), R(3), R(1),
                 B(Ldar), R(1),
   /*   24 S> */ B(Return),
 ]
 constant pool: [
-  Smi [43],
-  FIXED_ARRAY_TYPE,
+  Smi [36],
+  SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
 ]
@@ -115,60 +95,50 @@ snippet: "
   goo(42);
   { let x; { goo(42) } };
 "
-frame size: 7
+frame size: 6
 parameter count: 2
-bytecode array length: 114
+bytecode array length: 92
 bytecodes: [
-                B(Ldar), R(1),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(1), U8(1),
-                B(PushContext), R(4),
-                B(RestoreGeneratorState), R(1),
-                B(Star), R(3),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(3),
+                B(SwitchOnGeneratorState), R(1), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(6),
-                B(Mov), R(arg0), R(4),
-                B(Mov), R(closure), R(5),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(4), U8(3),
-                B(PushContext), R(4),
-                B(Mov), R(this), R(6),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(5), U8(2),
+                B(Star), R(5),
+                B(Mov), R(arg0), R(3),
+                B(Mov), R(closure), R(4),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
+                B(PushContext), R(3),
+                B(Mov), R(this), R(5),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(1),
   /*    0 E> */ B(StackCheck),
-  /*    0 E> */ B(SuspendGenerator), R(1), R(0), U8(5), U8(0),
-  /*   64 S> */ B(Return),
-                B(ResumeGenerator), R(1), R(3), R(0), U8(5),
-                B(Star), R(5),
+  /*    0 E> */ B(SuspendGenerator), R(1), R(0), U8(4), U8(0),
+                B(ResumeGenerator), R(1), R(0), U8(4),
+                B(Star), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(1), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(5),
+                B(Ldar), R(4),
   /*    0 E> */ B(Throw),
-                B(Ldar), R(5),
+                B(Ldar), R(4),
   /*   64 S> */ B(Return),
   /*   32 S> */ B(LdaModuleVariable), I8(-1), U8(0),
                 B(ThrowReferenceErrorIfHole), U8(4),
-                B(Star), R(5),
+                B(Star), R(4),
                 B(LdaSmi), I8(42),
-                B(Star), R(6),
-  /*   32 E> */ B(CallUndefinedReceiver1), R(5), R(6), U8(0),
+                B(Star), R(5),
+  /*   32 E> */ B(CallUndefinedReceiver1), R(4), R(5), U8(0),
   /*   47 S> */ B(LdaUndefined),
                 B(Star), R(0),
   /*   52 S> */ B(LdaModuleVariable), I8(-1), U8(0),
                 B(ThrowReferenceErrorIfHole), U8(4),
-                B(Star), R(5),
+                B(Star), R(4),
                 B(LdaSmi), I8(42),
-                B(Star), R(6),
-  /*   52 E> */ B(CallUndefinedReceiver1), R(5), R(6), U8(2),
+                B(Star), R(5),
+  /*   52 E> */ B(CallUndefinedReceiver1), R(4), R(5), U8(2),
                 B(Star), R(2),
   /*   64 S> */ B(Return),
 ]
 constant pool: [
-  Smi [43],
-  FIXED_ARRAY_TYPE,
+  Smi [36],
+  SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["goo"],
@@ -182,39 +152,29 @@ snippet: "
   foo++;
   { let x; { foo++ } };
 "
-frame size: 7
+frame size: 6
 parameter count: 2
-bytecode array length: 112
+bytecode array length: 90
 bytecodes: [
-                B(Ldar), R(1),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(1), U8(1),
-                B(PushContext), R(4),
-                B(RestoreGeneratorState), R(1),
-                B(Star), R(3),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(3),
+                B(SwitchOnGeneratorState), R(1), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(6),
-                B(Mov), R(arg0), R(4),
-                B(Mov), R(closure), R(5),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(4), U8(3),
-                B(PushContext), R(4),
-                B(Mov), R(this), R(6),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(5), U8(2),
+                B(Star), R(5),
+                B(Mov), R(arg0), R(3),
+                B(Mov), R(closure), R(4),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
+                B(PushContext), R(3),
+                B(Mov), R(this), R(5),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(1),
   /*    0 E> */ B(StackCheck),
-  /*    0 E> */ B(SuspendGenerator), R(1), R(0), U8(5), U8(0),
-  /*   49 S> */ B(Return),
-                B(ResumeGenerator), R(1), R(3), R(0), U8(5),
-                B(Star), R(5),
+  /*    0 E> */ B(SuspendGenerator), R(1), R(0), U8(4), U8(0),
+                B(ResumeGenerator), R(1), R(0), U8(4),
+                B(Star), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(1), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(5),
+                B(Ldar), R(4),
   /*    0 E> */ B(Throw),
-                B(Ldar), R(5),
+                B(Ldar), R(4),
   /*   49 S> */ B(Return),
   /*   17 S> */ B(LdaSmi), I8(42),
   /*   17 E> */ B(StaModuleVariable), I8(1), U8(0),
@@ -225,16 +185,16 @@ bytecodes: [
                 B(Star), R(0),
   /*   39 S> */ B(LdaModuleVariable), I8(1), U8(0),
                 B(ToNumeric), U8(1),
-                B(Star), R(5),
+                B(Star), R(4),
                 B(Inc), U8(1),
   /*   42 E> */ B(StaModuleVariable), I8(1), U8(0),
-                B(Mov), R(5), R(2),
+                B(Mov), R(4), R(2),
                 B(Ldar), R(2),
   /*   49 S> */ B(Return),
 ]
 constant pool: [
-  Smi [43],
-  FIXED_ARRAY_TYPE,
+  Smi [36],
+  SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
 ]
@@ -247,42 +207,32 @@ snippet: "
   foo++;
   { let x; { foo++ } };
 "
-frame size: 7
+frame size: 6
 parameter count: 2
-bytecode array length: 118
+bytecode array length: 96
 bytecodes: [
-                B(Ldar), R(1),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(1), U8(1),
-                B(PushContext), R(4),
-                B(RestoreGeneratorState), R(1),
-                B(Star), R(3),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(3),
+                B(SwitchOnGeneratorState), R(1), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(6),
-                B(Mov), R(arg0), R(4),
-                B(Mov), R(closure), R(5),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(4), U8(3),
-                B(PushContext), R(4),
-                B(Mov), R(this), R(6),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(5), U8(2),
+                B(Star), R(5),
+                B(Mov), R(arg0), R(3),
+                B(Mov), R(closure), R(4),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
+                B(PushContext), R(3),
+                B(Mov), R(this), R(5),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(1),
                 B(LdaTheHole),
                 B(StaModuleVariable), I8(1), U8(0),
   /*    0 E> */ B(StackCheck),
                 B(Ldar), R(1),
-  /*    0 E> */ B(SuspendGenerator), R(1), R(0), U8(5), U8(0),
-  /*   49 S> */ B(Return),
-                B(ResumeGenerator), R(1), R(3), R(0), U8(5),
-                B(Star), R(5),
+  /*    0 E> */ B(SuspendGenerator), R(1), R(0), U8(4), U8(0),
+                B(ResumeGenerator), R(1), R(0), U8(4),
+                B(Star), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(1), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(5),
+                B(Ldar), R(4),
   /*    0 E> */ B(Throw),
-                B(Ldar), R(5),
+                B(Ldar), R(4),
   /*   49 S> */ B(Return),
   /*   17 S> */ B(LdaSmi), I8(42),
   /*   17 E> */ B(StaModuleVariable), I8(1), U8(0),
@@ -293,16 +243,16 @@ bytecodes: [
                 B(Star), R(0),
   /*   39 S> */ B(LdaModuleVariable), I8(1), U8(0),
                 B(ToNumeric), U8(1),
-                B(Star), R(5),
+                B(Star), R(4),
                 B(Inc), U8(1),
   /*   42 E> */ B(StaModuleVariable), I8(1), U8(0),
-                B(Mov), R(5), R(2),
+                B(Mov), R(4), R(2),
                 B(Ldar), R(2),
   /*   49 S> */ B(Return),
 ]
 constant pool: [
-  Smi [49],
-  FIXED_ARRAY_TYPE,
+  Smi [42],
+  SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
 ]
@@ -315,42 +265,32 @@ snippet: "
   foo++;
   { let x; { foo++ } };
 "
-frame size: 7
+frame size: 6
 parameter count: 2
-bytecode array length: 122
+bytecode array length: 100
 bytecodes: [
-                B(Ldar), R(1),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(1), U8(1),
-                B(PushContext), R(4),
-                B(RestoreGeneratorState), R(1),
-                B(Star), R(3),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(3),
+                B(SwitchOnGeneratorState), R(1), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(6),
-                B(Mov), R(arg0), R(4),
-                B(Mov), R(closure), R(5),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(4), U8(3),
-                B(PushContext), R(4),
-                B(Mov), R(this), R(6),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(5), U8(2),
+                B(Star), R(5),
+                B(Mov), R(arg0), R(3),
+                B(Mov), R(closure), R(4),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
+                B(PushContext), R(3),
+                B(Mov), R(this), R(5),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(1),
                 B(LdaTheHole),
                 B(StaModuleVariable), I8(1), U8(0),
   /*    0 E> */ B(StackCheck),
                 B(Ldar), R(1),
-  /*    0 E> */ B(SuspendGenerator), R(1), R(0), U8(5), U8(0),
-  /*   51 S> */ B(Return),
-                B(ResumeGenerator), R(1), R(3), R(0), U8(5),
-                B(Star), R(5),
+  /*    0 E> */ B(SuspendGenerator), R(1), R(0), U8(4), U8(0),
+                B(ResumeGenerator), R(1), R(0), U8(4),
+                B(Star), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(1), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(5),
+                B(Ldar), R(4),
   /*    0 E> */ B(Throw),
-                B(Ldar), R(5),
+                B(Ldar), R(4),
   /*   51 S> */ B(Return),
   /*   19 S> */ B(LdaSmi), I8(42),
   /*   19 E> */ B(StaModuleVariable), I8(1), U8(0),
@@ -361,16 +301,16 @@ bytecodes: [
                 B(Star), R(0),
   /*   41 S> */ B(LdaModuleVariable), I8(1), U8(0),
                 B(ToNumeric), U8(1),
-                B(Star), R(5),
+                B(Star), R(4),
                 B(Inc), U8(1),
   /*   44 E> */ B(CallRuntime), U16(Runtime::kThrowConstAssignError), R(0), U8(0),
-                B(Mov), R(5), R(2),
+                B(Mov), R(4), R(2),
                 B(Ldar), R(2),
   /*   51 S> */ B(Return),
 ]
 constant pool: [
-  Smi [49],
-  FIXED_ARRAY_TYPE,
+  Smi [42],
+  SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
 ]
@@ -381,52 +321,42 @@ handlers: [
 snippet: "
   export default (function () {});
 "
-frame size: 6
+frame size: 5
 parameter count: 2
-bytecode array length: 97
+bytecode array length: 75
 bytecodes: [
-                B(Ldar), R(0),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(0), U8(1),
-                B(PushContext), R(3),
-                B(RestoreGeneratorState), R(0),
-                B(Star), R(2),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(2),
+                B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(5),
-                B(Mov), R(arg0), R(3),
-                B(Mov), R(closure), R(4),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
-                B(PushContext), R(3),
-                B(Mov), R(this), R(5),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
+                B(Star), R(4),
+                B(Mov), R(arg0), R(2),
+                B(Mov), R(closure), R(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(3),
+                B(PushContext), R(2),
+                B(Mov), R(this), R(4),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
                 B(LdaTheHole),
                 B(StaModuleVariable), I8(1), U8(0),
   /*    0 E> */ B(StackCheck),
                 B(Ldar), R(0),
-  /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
-  /*   32 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(2), R(0), U8(4),
-                B(Star), R(4),
+  /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
+                B(ResumeGenerator), R(0), R(0), U8(3),
+                B(Star), R(3),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*    0 E> */ B(Throw),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*   32 S> */ B(Return),
-                B(Mov), R(4), R(1),
+                B(Mov), R(3), R(1),
                 B(CreateClosure), U8(4), U8(0), U8(0),
                 B(StaModuleVariable), I8(1), U8(0),
                 B(Ldar), R(1),
   /*   32 S> */ B(Return),
 ]
 constant pool: [
-  Smi [49],
-  FIXED_ARRAY_TYPE,
+  Smi [42],
+  SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
   SHARED_FUNCTION_INFO_TYPE,
@@ -438,61 +368,51 @@ handlers: [
 snippet: "
   export default (class {});
 "
-frame size: 8
+frame size: 7
 parameter count: 2
-bytecode array length: 118
+bytecode array length: 96
 bytecodes: [
-                B(Ldar), R(0),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(0), U8(1),
-                B(PushContext), R(3),
-                B(RestoreGeneratorState), R(0),
-                B(Star), R(2),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(2),
+                B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(5),
-                B(Mov), R(arg0), R(3),
-                B(Mov), R(closure), R(4),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
-                B(PushContext), R(3),
-                B(Mov), R(this), R(5),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
+                B(Star), R(4),
+                B(Mov), R(arg0), R(2),
+                B(Mov), R(closure), R(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(3),
+                B(PushContext), R(2),
+                B(Mov), R(this), R(4),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
                 B(LdaTheHole),
                 B(StaModuleVariable), I8(1), U8(0),
   /*    0 E> */ B(StackCheck),
                 B(Ldar), R(0),
-  /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
-  /*   26 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(2), R(0), U8(4),
-                B(Star), R(4),
+  /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
+                B(ResumeGenerator), R(0), R(0), U8(3),
+                B(Star), R(3),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*    0 E> */ B(Throw),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*   26 S> */ B(Return),
-                B(Mov), R(4), R(1),
+                B(Mov), R(3), R(1),
                 B(LdaTheHole),
-                B(Star), R(7),
+                B(Star), R(6),
                 B(CreateClosure), U8(5), U8(0), U8(0),
-                B(Star), R(4),
+                B(Star), R(3),
                 B(LdaConstant), U8(4),
-                B(Star), R(5),
-                B(Mov), R(4), R(6),
-                B(CallRuntime), U16(Runtime::kDefineClass), R(5), U8(3),
-                B(Star), R(5),
-                B(Ldar), R(6),
+                B(Star), R(4),
+                B(Mov), R(3), R(5),
+                B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(3),
+                B(Star), R(4),
+                B(Ldar), R(5),
                 B(StaModuleVariable), I8(1), U8(0),
                 B(Ldar), R(1),
   /*   26 S> */ B(Return),
 ]
 constant pool: [
-  Smi [49],
-  FIXED_ARRAY_TYPE,
+  Smi [42],
+  SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
   FIXED_ARRAY_TYPE,
@@ -505,47 +425,37 @@ handlers: [
 snippet: "
   export {foo as goo} from \"bar\"
 "
-frame size: 6
+frame size: 5
 parameter count: 2
-bytecode array length: 84
+bytecode array length: 62
 bytecodes: [
-                B(Ldar), R(0),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(0), U8(1),
-                B(PushContext), R(3),
-                B(RestoreGeneratorState), R(0),
-                B(Star), R(2),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(2),
+                B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(5),
-                B(Mov), R(arg0), R(3),
-                B(Mov), R(closure), R(4),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
-                B(PushContext), R(3),
-                B(Mov), R(this), R(5),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
+                B(Star), R(4),
+                B(Mov), R(arg0), R(2),
+                B(Mov), R(closure), R(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(3),
+                B(PushContext), R(2),
+                B(Mov), R(this), R(4),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
   /*    0 E> */ B(StackCheck),
-  /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
-  /*   30 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(2), R(0), U8(4),
-                B(Star), R(4),
+  /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
+                B(ResumeGenerator), R(0), R(0), U8(3),
+                B(Star), R(3),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*    0 E> */ B(Throw),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*   30 S> */ B(Return),
-                B(Mov), R(4), R(1),
+                B(Mov), R(3), R(1),
                 B(Ldar), R(1),
   /*   30 S> */ B(Return),
 ]
 constant pool: [
-  Smi [43],
-  FIXED_ARRAY_TYPE,
+  Smi [36],
+  SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
 ]
@@ -556,47 +466,37 @@ handlers: [
 snippet: "
   export * from \"bar\"
 "
-frame size: 6
+frame size: 5
 parameter count: 2
-bytecode array length: 84
+bytecode array length: 62
 bytecodes: [
-                B(Ldar), R(0),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(0), U8(1),
-                B(PushContext), R(3),
-                B(RestoreGeneratorState), R(0),
-                B(Star), R(2),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(2),
+                B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(5),
-                B(Mov), R(arg0), R(3),
-                B(Mov), R(closure), R(4),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
-                B(PushContext), R(3),
-                B(Mov), R(this), R(5),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
+                B(Star), R(4),
+                B(Mov), R(arg0), R(2),
+                B(Mov), R(closure), R(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(3),
+                B(PushContext), R(2),
+                B(Mov), R(this), R(4),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
   /*    0 E> */ B(StackCheck),
-  /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
-  /*   19 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(2), R(0), U8(4),
-                B(Star), R(4),
+  /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(3), U8(0),
+                B(ResumeGenerator), R(0), R(0), U8(3),
+                B(Star), R(3),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*    0 E> */ B(Throw),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*   19 S> */ B(Return),
-                B(Mov), R(4), R(1),
+                B(Mov), R(3), R(1),
                 B(Ldar), R(1),
   /*   19 S> */ B(Return),
 ]
 constant pool: [
-  Smi [43],
-  FIXED_ARRAY_TYPE,
+  Smi [36],
+  SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
 ]
@@ -608,56 +508,46 @@ snippet: "
   import * as foo from \"bar\"
   foo.f(foo, foo.x);
 "
-frame size: 9
+frame size: 8
 parameter count: 2
-bytecode array length: 111
+bytecode array length: 89
 bytecodes: [
-                B(Ldar), R(0),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(0), U8(1),
-                B(PushContext), R(4),
-                B(RestoreGeneratorState), R(0),
-                B(Star), R(3),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(3),
+                B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(6),
-                B(Mov), R(arg0), R(4),
-                B(Mov), R(closure), R(5),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(4), U8(3),
-                B(PushContext), R(4),
-                B(Mov), R(this), R(6),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(5), U8(2),
+                B(Star), R(5),
+                B(Mov), R(arg0), R(3),
+                B(Mov), R(closure), R(4),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
+                B(PushContext), R(3),
+                B(Mov), R(this), R(5),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(0),
                 B(LdaZero),
-                B(Star), R(5),
-                B(CallRuntime), U16(Runtime::kGetModuleNamespace), R(5), U8(1),
+                B(Star), R(4),
+                B(CallRuntime), U16(Runtime::kGetModuleNamespace), R(4), U8(1),
                 B(Star), R(1),
   /*    0 E> */ B(StackCheck),
                 B(Ldar), R(0),
-  /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(5), U8(0),
-  /*   45 S> */ B(Return),
-                B(ResumeGenerator), R(0), R(3), R(0), U8(5),
-                B(Star), R(5),
+  /*    0 E> */ B(SuspendGenerator), R(0), R(0), U8(4), U8(0),
+                B(ResumeGenerator), R(0), R(0), U8(4),
+                B(Star), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(5),
+                B(Ldar), R(4),
   /*    0 E> */ B(Throw),
-                B(Ldar), R(5),
+                B(Ldar), R(4),
   /*   45 S> */ B(Return),
   /*   31 S> */ B(LdaNamedProperty), R(1), U8(4), U8(0),
-                B(Star), R(5),
+                B(Star), R(4),
   /*   42 E> */ B(LdaNamedProperty), R(1), U8(5), U8(2),
-                B(Star), R(8),
-  /*   31 E> */ B(CallProperty2), R(5), R(1), R(1), R(8), U8(4),
+                B(Star), R(7),
+  /*   31 E> */ B(CallProperty2), R(4), R(1), R(1), R(7), U8(4),
                 B(Star), R(2),
   /*   45 S> */ B(Return),
 ]
 constant pool: [
-  Smi [55],
-  FIXED_ARRAY_TYPE,
+  Smi [48],
+  SCOPE_INFO_TYPE,
   Smi [10],
   Smi [7],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["f"],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/NewAndSpread.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/NewAndSpread.golden
index 6a2e1a8c7f7..7cfebf4858b 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/NewAndSpread.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/NewAndSpread.golden
@@ -84,9 +84,9 @@ snippet: "
   class A { constructor(...args) { this.args = args; } }
   new A(0, ...[1, 2, 3], 4);
 "
-frame size: 6
+frame size: 10
 parameter count: 1
-bytecode array length: 66
+bytecode array length: 127
 bytecodes: [
   /*   30 E> */ B(StackCheck),
                 B(LdaTheHole),
@@ -102,14 +102,36 @@ bytecodes: [
                 B(Mov), R(0), R(1),
   /*   89 S> */ B(CreateArrayLiteral), U8(2), U8(1), U8(37),
                 B(Star), R(3),
-                B(CreateArrayLiteral), U8(3), U8(2), U8(37),
-                B(Star), R(4),
-                B(CallJSRuntime), U8(%spread_iterable), R(4), U8(1),
+                B(LdaConstant), U8(3),
                 B(Star), R(4),
-                B(CreateArrayLiteral), U8(4), U8(3), U8(37),
+  /*  101 S> */ B(CreateArrayLiteral), U8(4), U8(7), U8(37),
+                B(Star), R(8),
+                B(LdaNamedProperty), R(8), U8(5), U8(8),
+                B(Star), R(9),
+                B(CallProperty0), R(9), R(8), U8(10),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
+                B(Star), R(7),
+                B(LdaNamedProperty), R(7), U8(6), U8(12),
+                B(Star), R(6),
+                B(CallProperty0), R(6), R(7), U8(14),
                 B(Star), R(5),
-                B(CallJSRuntime), U8(%spread_arguments), R(3), U8(3),
-                B(Star), R(3),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(5), U8(1),
+                B(LdaNamedProperty), R(5), U8(7), U8(16),
+                B(JumpIfToBooleanTrue), U8(21),
+                B(LdaNamedProperty), R(5), U8(8), U8(18),
+                B(Star), R(5),
+                B(StaInArrayLiteral), R(3), R(4), U8(2),
+                B(Ldar), R(4),
+                B(Inc), U8(4),
+                B(Star), R(4),
+                B(JumpLoop), U8(35), I8(0),
+                B(LdaSmi), I8(4),
+                B(StaInArrayLiteral), R(3), R(4), U8(2),
+                B(Ldar), R(4),
+                B(Inc), U8(4),
+                B(Star), R(4),
                 B(CallJSRuntime), U8(%reflect_construct), R(2), U8(2),
                 B(LdaUndefined),
   /*  116 S> */ B(Return),
@@ -118,8 +140,12 @@ constant pool: [
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   TUPLE2_TYPE,
+  Smi [1],
   TUPLE2_TYPE,
-  TUPLE2_TYPE,
+  SYMBOL_TYPE,
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
 ]
 handlers: [
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ObjectLiterals.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ObjectLiterals.golden
index 63014f70dc2..779788b88e9 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ObjectLiterals.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ObjectLiterals.golden
@@ -36,7 +36,7 @@ bytecodes: [
   /*   70 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -58,7 +58,7 @@ bytecodes: [
   /*   79 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["val"],
 ]
 handlers: [
@@ -82,7 +82,7 @@ bytecodes: [
   /*   75 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["val"],
 ]
 handlers: [
@@ -98,13 +98,13 @@ bytecode array length: 17
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   34 S> */ B(CreateObjectLiteral), U8(0), U8(0), U8(41), R(0),
-                B(CreateClosure), U8(1), U8(1), U8(2),
+  /*   49 E> */ B(CreateClosure), U8(1), U8(1), U8(2),
                 B(StaNamedOwnProperty), R(0), U8(2), U8(2),
                 B(Ldar), R(0),
   /*   66 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["func"],
 ]
@@ -121,13 +121,13 @@ bytecode array length: 17
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   34 S> */ B(CreateObjectLiteral), U8(0), U8(0), U8(41), R(0),
-                B(CreateClosure), U8(1), U8(1), U8(2),
+  /*   43 E> */ B(CreateClosure), U8(1), U8(1), U8(2),
                 B(StaNamedOwnProperty), R(0), U8(2), U8(2),
                 B(Ldar), R(0),
   /*   67 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["func"],
 ]
@@ -158,7 +158,7 @@ bytecodes: [
   /*   67 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
   SHARED_FUNCTION_INFO_TYPE,
 ]
@@ -189,7 +189,7 @@ bytecodes: [
   /*  101 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
   SHARED_FUNCTION_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
@@ -221,7 +221,7 @@ bytecodes: [
   /*   73 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["b"],
   SHARED_FUNCTION_INFO_TYPE,
 ]
@@ -251,7 +251,7 @@ bytecodes: [
   /*   61 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -270,7 +270,7 @@ bytecodes: [
   /*   61 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -289,13 +289,13 @@ bytecodes: [
   /*   50 S> */ B(CreateObjectLiteral), U8(1), U8(0), U8(41), R(1),
   /*   60 E> */ B(ToName), R(2),
                 B(LdaSmi), I8(1),
-                B(StaDataPropertyInLiteral), R(1), R(2), U8(0), U8(1),
+  /*   64 E> */ B(StaDataPropertyInLiteral), R(1), R(2), U8(0), U8(1),
                 B(Ldar), R(1),
   /*   68 S> */ B(Return),
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["test"],
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -316,13 +316,13 @@ bytecodes: [
                 B(Ldar), R(0),
   /*   68 E> */ B(ToName), R(2),
                 B(LdaSmi), I8(1),
-                B(StaDataPropertyInLiteral), R(1), R(2), U8(0), U8(3),
+  /*   72 E> */ B(StaDataPropertyInLiteral), R(1), R(2), U8(0), U8(3),
                 B(Ldar), R(1),
   /*   76 S> */ B(Return),
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["test"],
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["val"],
 ]
 handlers: [
@@ -342,8 +342,8 @@ bytecodes: [
   /*   50 S> */ B(CreateObjectLiteral), U8(1), U8(0), U8(41), R(1),
   /*   60 E> */ B(ToName), R(2),
                 B(LdaSmi), I8(1),
-                B(StaDataPropertyInLiteral), R(1), R(2), U8(0), U8(1),
-                B(CreateEmptyObjectLiteral),
+  /*   64 E> */ B(StaDataPropertyInLiteral), R(1), R(2), U8(0), U8(1),
+  /*   78 E> */ B(CreateEmptyObjectLiteral),
                 B(Star), R(3),
                 B(Mov), R(1), R(2),
                 B(CallRuntime), U16(Runtime::kInternalSetPrototype), R(2), U8(2),
@@ -352,7 +352,7 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["test"],
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -371,10 +371,10 @@ bytecodes: [
   /*   50 S> */ B(CreateObjectLiteral), U8(1), U8(0), U8(41), R(1),
   /*   60 E> */ B(ToName), R(2),
                 B(LdaConstant), U8(2),
-                B(StaDataPropertyInLiteral), R(1), R(2), U8(0), U8(1),
+  /*   64 E> */ B(StaDataPropertyInLiteral), R(1), R(2), U8(0), U8(1),
                 B(LdaConstant), U8(3),
                 B(Star), R(3),
-                B(CreateClosure), U8(4), U8(3), U8(2),
+  /*   71 E> */ B(CreateClosure), U8(4), U8(3), U8(2),
                 B(Star), R(4),
                 B(LdaZero),
                 B(Star), R(5),
@@ -382,7 +382,7 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kDefineGetterPropertyUnchecked), R(2), U8(4),
                 B(LdaConstant), U8(3),
                 B(Star), R(3),
-                B(CreateClosure), U8(5), U8(4), U8(2),
+  /*   84 E> */ B(CreateClosure), U8(5), U8(4), U8(2),
                 B(Star), R(4),
                 B(LdaZero),
                 B(Star), R(5),
@@ -392,7 +392,7 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["name"],
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["val"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
   SHARED_FUNCTION_INFO_TYPE,
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateClassFields.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateClassFields.golden
new file mode 100644
index 00000000000..c6c446556b2
--- /dev/null
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateClassFields.golden
@@ -0,0 +1,257 @@
+#
+# Autogenerated by generate-bytecode-expectations.
+#
+
+---
+wrap: yes
+private fields: yes
+
+---
+snippet: "
+  {
+    class A {
+      #a;
+      constructor() {
+        this.#a = 1;
+      }
+    }
+  
+    class B {
+      #a = 1;
+    }
+    new A;
+    new B;
+  }
+"
+frame size: 9
+parameter count: 1
+bytecode array length: 131
+bytecodes: [
+  /*   30 E> */ B(StackCheck),
+                B(Ldar), R(closure),
+                B(CreateBlockContext), U8(0),
+                B(PushContext), R(4),
+                B(LdaTheHole),
+                B(StaCurrentContextSlot), U8(4),
+                B(LdaTheHole),
+                B(Star), R(8),
+                B(CreateClosure), U8(2), U8(0), U8(2),
+                B(Star), R(5),
+                B(LdaConstant), U8(1),
+                B(Star), R(6),
+                B(CallRuntime), U16(Runtime::kCreatePrivateFieldSymbol), R(0), U8(0),
+                B(StaCurrentContextSlot), U8(4),
+                B(Mov), R(5), R(7),
+                B(CallRuntime), U16(Runtime::kDefineClass), R(6), U8(3),
+                B(Star), R(6),
+                B(Mov), R(7), R(1),
+                B(CreateClosure), U8(3), U8(1), U8(2),
+                B(Star), R(7),
+                B(StaNamedProperty), R(5), U8(4), U8(2),
+                B(PopContext), R(4),
+                B(Mov), R(1), R(2),
+                B(Ldar), R(closure),
+  /*   38 E> */ B(CreateBlockContext), U8(5),
+                B(PushContext), R(4),
+                B(LdaTheHole),
+                B(StaCurrentContextSlot), U8(4),
+                B(LdaTheHole),
+                B(Star), R(8),
+                B(CreateClosure), U8(7), U8(4), U8(2),
+                B(Star), R(5),
+                B(LdaConstant), U8(6),
+                B(Star), R(6),
+                B(CallRuntime), U16(Runtime::kCreatePrivateFieldSymbol), R(0), U8(0),
+                B(StaCurrentContextSlot), U8(4),
+                B(Mov), R(5), R(7),
+                B(CallRuntime), U16(Runtime::kDefineClass), R(6), U8(3),
+                B(Star), R(6),
+                B(Mov), R(7), R(0),
+                B(CreateClosure), U8(8), U8(5), U8(2),
+                B(Star), R(7),
+                B(StaNamedProperty), R(5), U8(4), U8(6),
+                B(PopContext), R(4),
+                B(Mov), R(0), R(3),
+  /*  136 S> */ B(Ldar), R(1),
+  /*  136 E> */ B(Construct), R(1), R(0), U8(0), U8(8),
+  /*  145 S> */ B(Ldar), R(0),
+  /*  145 E> */ B(Construct), R(0), R(0), U8(0), U8(10),
+                B(LdaUndefined),
+  /*  154 S> */ B(Return),
+]
+constant pool: [
+  SCOPE_INFO_TYPE,
+  FIXED_ARRAY_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+  SYMBOL_TYPE,
+  SCOPE_INFO_TYPE,
+  FIXED_ARRAY_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+]
+handlers: [
+]
+
+---
+snippet: "
+  {
+    class A extends class {} {
+      #a;
+      constructor() {
+        super();
+        this.#a = 1;
+      }
+    }
+  
+    class B extends class {} {
+      #a = 1;
+      #b = this.#a;
+      foo() { return this.#a; }
+      bar(v) { this.#b = v; }
+      constructor() {
+        super();
+        this.foo();
+        this.bar(3);
+      }
+    }
+  
+    class C extends B {
+      #a = 2;
+      constructor() {
+        (() => super())();
+      }
+    }
+  
+    new A;
+    new B;
+    new C;
+  };
+"
+frame size: 15
+parameter count: 1
+bytecode array length: 263
+bytecodes: [
+  /*   30 E> */ B(StackCheck),
+                B(Ldar), R(closure),
+                B(CreateBlockContext), U8(0),
+                B(PushContext), R(6),
+                B(LdaTheHole),
+                B(StaCurrentContextSlot), U8(4),
+                B(LdaTheHole),
+                B(Star), R(14),
+                B(CreateClosure), U8(3), U8(0), U8(2),
+                B(Star), R(11),
+                B(LdaConstant), U8(2),
+                B(Star), R(12),
+                B(Mov), R(11), R(13),
+                B(CallRuntime), U16(Runtime::kDefineClass), R(12), U8(3),
+                B(Star), R(12),
+                B(CreateClosure), U8(4), U8(1), U8(2),
+                B(Star), R(7),
+                B(LdaConstant), U8(1),
+                B(Star), R(8),
+                B(CallRuntime), U16(Runtime::kCreatePrivateFieldSymbol), R(0), U8(0),
+                B(StaCurrentContextSlot), U8(4),
+                B(Mov), R(7), R(9),
+                B(Mov), R(13), R(10),
+                B(CallRuntime), U16(Runtime::kDefineClass), R(8), U8(3),
+                B(Star), R(8),
+                B(Mov), R(9), R(2),
+                B(CreateClosure), U8(5), U8(2), U8(2),
+                B(Star), R(9),
+                B(StaNamedProperty), R(7), U8(6), U8(3),
+                B(PopContext), R(6),
+                B(Mov), R(2), R(3),
+                B(Ldar), R(closure),
+  /*   38 E> */ B(CreateBlockContext), U8(7),
+                B(PushContext), R(6),
+                B(LdaTheHole),
+                B(StaCurrentContextSlot), U8(4),
+                B(LdaTheHole),
+                B(StaCurrentContextSlot), U8(5),
+                B(LdaTheHole),
+                B(Star), R(14),
+                B(CreateClosure), U8(10), U8(5), U8(2),
+                B(Star), R(11),
+                B(LdaConstant), U8(9),
+                B(Star), R(12),
+                B(Mov), R(11), R(13),
+                B(CallRuntime), U16(Runtime::kDefineClass), R(12), U8(3),
+                B(Star), R(12),
+                B(CreateClosure), U8(11), U8(6), U8(2),
+                B(Star), R(7),
+                B(LdaConstant), U8(8),
+                B(Star), R(8),
+                B(CallRuntime), U16(Runtime::kCreatePrivateFieldSymbol), R(0), U8(0),
+                B(StaCurrentContextSlot), U8(4),
+                B(CallRuntime), U16(Runtime::kCreatePrivateFieldSymbol), R(0), U8(0),
+                B(StaCurrentContextSlot), U8(5),
+                B(CreateClosure), U8(12), U8(7), U8(2),
+                B(Star), R(11),
+                B(CreateClosure), U8(13), U8(8), U8(2),
+                B(Star), R(12),
+                B(Mov), R(7), R(9),
+                B(Mov), R(13), R(10),
+                B(CallRuntime), U16(Runtime::kDefineClass), R(8), U8(5),
+                B(Star), R(8),
+                B(Mov), R(9), R(1),
+                B(CreateClosure), U8(14), U8(9), U8(2),
+                B(Star), R(9),
+                B(StaNamedProperty), R(7), U8(6), U8(10),
+                B(PopContext), R(6),
+                B(Mov), R(1), R(4),
+                B(Ldar), R(closure),
+  /*  140 E> */ B(CreateBlockContext), U8(15),
+                B(PushContext), R(6),
+                B(LdaTheHole),
+                B(StaCurrentContextSlot), U8(4),
+  /*  356 E> */ B(CreateClosure), U8(17), U8(12), U8(2),
+                B(Star), R(7),
+                B(LdaConstant), U8(16),
+                B(Star), R(8),
+                B(CallRuntime), U16(Runtime::kCreatePrivateFieldSymbol), R(0), U8(0),
+                B(StaCurrentContextSlot), U8(4),
+                B(Mov), R(7), R(9),
+                B(Mov), R(1), R(10),
+                B(CallRuntime), U16(Runtime::kDefineClass), R(8), U8(3),
+                B(Star), R(8),
+                B(Mov), R(9), R(0),
+                B(CreateClosure), U8(18), U8(13), U8(2),
+                B(Star), R(9),
+                B(StaNamedProperty), R(7), U8(6), U8(14),
+                B(PopContext), R(6),
+                B(Mov), R(0), R(5),
+  /*  430 S> */ B(Ldar), R(2),
+  /*  430 E> */ B(Construct), R(2), R(0), U8(0), U8(16),
+  /*  439 S> */ B(Ldar), R(1),
+  /*  439 E> */ B(Construct), R(1), R(0), U8(0), U8(18),
+  /*  448 S> */ B(Ldar), R(0),
+  /*  448 E> */ B(Construct), R(0), R(0), U8(0), U8(20),
+                B(LdaUndefined),
+  /*  458 S> */ B(Return),
+]
+constant pool: [
+  SCOPE_INFO_TYPE,
+  FIXED_ARRAY_TYPE,
+  FIXED_ARRAY_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+  SYMBOL_TYPE,
+  SCOPE_INFO_TYPE,
+  FIXED_ARRAY_TYPE,
+  FIXED_ARRAY_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+  SCOPE_INFO_TYPE,
+  FIXED_ARRAY_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+  SHARED_FUNCTION_INFO_TYPE,
+]
+handlers: [
+]
+
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassFields.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PublicClassFields.golden
similarity index 98%
rename from deps/v8/test/cctest/interpreter/bytecode_expectations/ClassFields.golden
rename to deps/v8/test/cctest/interpreter/bytecode_expectations/PublicClassFields.golden
index b8b77107a7f..c6dafaec37f 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassFields.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PublicClassFields.golden
@@ -81,13 +81,13 @@ bytecodes: [
   /*  138 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["b"],
   SHARED_FUNCTION_INFO_TYPE,
   SYMBOL_TYPE,
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
@@ -226,7 +226,7 @@ bytecodes: [
   /*  356 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   FIXED_ARRAY_TYPE,
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
@@ -234,14 +234,14 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["b"],
   SHARED_FUNCTION_INFO_TYPE,
   SYMBOL_TYPE,
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   FIXED_ARRAY_TYPE,
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/StandardForLoop.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/StandardForLoop.golden
index e0567143b56..80609db7b80 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/StandardForLoop.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/StandardForLoop.golden
@@ -132,8 +132,8 @@ bytecodes: [
   /*   61 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["eval"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["1"],
 ]
@@ -207,7 +207,7 @@ bytecodes: [
   /*   80 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -231,7 +231,7 @@ bytecodes: [
                 B(JumpIfUndefined), U8(6),
                 B(Ldar), R(3),
                 B(JumpIfNotNull), U8(16),
-                B(LdaSmi), I8(74),
+                B(LdaSmi), I8(77),
                 B(Star), R(4),
                 B(LdaConstant), U8(1),
                 B(Star), R(5),
@@ -256,7 +256,7 @@ bytecodes: [
   /*   84 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["y"],
 ]
@@ -270,34 +270,24 @@ snippet: "
   }
   f();
 "
-frame size: 6
+frame size: 5
 parameter count: 1
-bytecode array length: 89
+bytecode array length: 67
 bytecodes: [
-                B(Ldar), R(2),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(2), U8(1),
-                B(PushContext), R(4),
-                B(RestoreGeneratorState), R(2),
-                B(Star), R(3),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(3),
-                B(Mov), R(closure), R(4),
-                B(Mov), R(this), R(5),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
+                B(SwitchOnGeneratorState), R(2), U8(0), U8(1),
+                B(Mov), R(closure), R(3),
+                B(Mov), R(this), R(4),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(2),
   /*   11 E> */ B(StackCheck),
-  /*   11 E> */ B(SuspendGenerator), R(2), R(0), U8(4), U8(0),
-  /*   62 S> */ B(Return),
-                B(ResumeGenerator), R(2), R(3), R(0), U8(4),
-                B(Star), R(4),
+  /*   11 E> */ B(SuspendGenerator), R(2), R(0), U8(3), U8(0),
+                B(ResumeGenerator), R(2), R(0), U8(3),
+                B(Star), R(3),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(1), U8(2), I8(0),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*   11 E> */ B(Throw),
-                B(Ldar), R(4),
+                B(Ldar), R(3),
   /*   62 S> */ B(Return),
   /*   31 S> */ B(LdaZero),
                 B(Star), R(1),
@@ -314,7 +304,7 @@ bytecodes: [
   /*   62 S> */ B(Return),
 ]
 constant pool: [
-  Smi [29],
+  Smi [22],
   Smi [10],
   Smi [7],
 ]
@@ -328,74 +318,56 @@ snippet: "
   }
   f();
 "
-frame size: 5
+frame size: 4
 parameter count: 1
-bytecode array length: 137
+bytecode array length: 99
 bytecodes: [
-                B(Ldar), R(1),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(1), U8(1),
-                B(PushContext), R(3),
-                B(RestoreGeneratorState), R(1),
-                B(Star), R(2),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(2), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(2),
-                B(Mov), R(closure), R(3),
-                B(Mov), R(this), R(4),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
+                B(SwitchOnGeneratorState), R(1), U8(0), U8(2),
+                B(Mov), R(closure), R(2),
+                B(Mov), R(this), R(3),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(2), U8(2),
                 B(Star), R(1),
   /*   11 E> */ B(StackCheck),
-  /*   11 E> */ B(SuspendGenerator), R(1), R(0), U8(3), U8(0),
-  /*   56 S> */ B(Return),
-                B(ResumeGenerator), R(1), R(2), R(0), U8(3),
-                B(Star), R(3),
+  /*   11 E> */ B(SuspendGenerator), R(1), R(0), U8(2), U8(0),
+                B(ResumeGenerator), R(1), R(0), U8(2),
+                B(Star), R(2),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(1), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(3),
+                B(Ldar), R(2),
   /*   11 E> */ B(Throw),
-                B(Ldar), R(3),
+                B(Ldar), R(2),
   /*   56 S> */ B(Return),
   /*   31 S> */ B(LdaZero),
                 B(Star), R(0),
-                B(Ldar), R(2),
-                B(SwitchOnSmiNoFeedback), U8(4), U8(1), I8(1),
-                B(LdaSmi), I8(-2),
-  /*   31 E> */ B(TestEqualStrictNoFeedback), R(2),
-                B(JumpIfTrue), U8(4),
-                B(Abort), U8(15),
   /*   36 S> */ B(LdaSmi), I8(10),
   /*   36 E> */ B(TestLessThan), R(0), U8(0),
-                B(JumpIfFalse), U8(49),
+                B(JumpIfFalse), U8(47),
   /*   18 E> */ B(StackCheck),
   /*   47 S> */ B(LdaFalse),
-                B(Star), R(4),
-                B(Mov), R(0), R(3),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateIterResultObject), R(3), U8(2),
-                B(SuspendGenerator), R(1), R(0), U8(3), U8(1),
-  /*   56 S> */ B(Return),
-                B(ResumeGenerator), R(1), R(2), R(0), U8(3),
                 B(Star), R(3),
+                B(Mov), R(0), R(2),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateIterResultObject), R(2), U8(2),
+  /*   47 E> */ B(SuspendGenerator), R(1), R(0), U8(2), U8(1),
+                B(ResumeGenerator), R(1), R(0), U8(2),
+                B(Star), R(2),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(1), U8(1),
-                B(SwitchOnSmiNoFeedback), U8(5), U8(2), I8(0),
-                B(Ldar), R(3),
+                B(SwitchOnSmiNoFeedback), U8(4), U8(2), I8(0),
+                B(Ldar), R(2),
   /*   47 E> */ B(Throw),
-                B(Ldar), R(3),
+                B(Ldar), R(2),
   /*   56 S> */ B(Return),
   /*   44 S> */ B(Ldar), R(0),
                 B(Inc), U8(1),
                 B(Star), R(0),
-                B(JumpLoop), U8(65), I8(0),
+                B(JumpLoop), U8(49), I8(0),
                 B(LdaUndefined),
   /*   56 S> */ B(Return),
 ]
 constant pool: [
-  Smi [29],
-  Smi [53],
+  Smi [22],
+  Smi [68],
   Smi [10],
   Smi [7],
-  Smi [36],
   Smi [10],
   Smi [7],
 ]
@@ -432,7 +404,7 @@ bytecodes: [
                 B(LdaUndefined),
                 B(Star), R(9),
                 B(Mov), R(3), R(8),
-  /*   49 E> */ B(CallJSRuntime), U8(%promise_resolve), R(8), U8(2),
+  /*   49 E> */ B(InvokeIntrinsic), U8(Runtime::k_ResolvePromise), R(8), U8(2),
                 B(LdaZero),
                 B(Star), R(4),
                 B(Mov), R(3), R(5),
@@ -451,7 +423,7 @@ bytecodes: [
                 B(LdaFalse),
                 B(Star), R(11),
                 B(Mov), R(3), R(9),
-                B(CallJSRuntime), U8(%promise_internal_reject), R(9), U8(3),
+                B(InvokeIntrinsic), U8(Runtime::k_RejectPromise), R(9), U8(3),
                 B(PopContext), R(8),
                 B(LdaZero),
                 B(Star), R(4),
@@ -482,7 +454,7 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   Smi [6],
   Smi [9],
 ]
@@ -498,121 +470,104 @@ snippet: "
   }
   f();
 "
-frame size: 12
+frame size: 11
 parameter count: 1
-bytecode array length: 224
+bytecode array length: 188
 bytecodes: [
-                B(Ldar), R(1),
-                B(JumpIfUndefined), U8(18),
-                B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetContext), R(1), U8(1),
-                B(PushContext), R(4),
-                B(RestoreGeneratorState), R(1),
-                B(Star), R(3),
-                B(SwitchOnSmiNoFeedback), U8(0), U8(1), I8(0),
-                B(Abort), U8(15),
-                B(LdaSmi), I8(-2),
-                B(Star), R(3),
-                B(Mov), R(closure), R(4),
-                B(Mov), R(this), R(5),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
+                B(SwitchOnGeneratorState), R(1), U8(0), U8(1),
+                B(Mov), R(closure), R(3),
+                B(Mov), R(this), R(4),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(1),
   /*   16 E> */ B(StackCheck),
                 B(CallJSRuntime), U8(%async_function_promise_create), R(0), U8(0),
                 B(Star), R(2),
+                B(Mov), R(context), R(5),
                 B(Mov), R(context), R(6),
-                B(Mov), R(context), R(7),
   /*   36 S> */ B(LdaZero),
                 B(Star), R(0),
-                B(Ldar), R(3),
-                B(SwitchOnSmiNoFeedback), U8(1), U8(1), I8(0),
-                B(LdaSmi), I8(-2),
-  /*   36 E> */ B(TestEqualStrictNoFeedback), R(3),
-                B(JumpIfTrue), U8(4),
-                B(Abort), U8(15),
   /*   41 S> */ B(LdaSmi), I8(10),
   /*   41 E> */ B(TestLessThan), R(0), U8(0),
-                B(JumpIfFalse), U8(52),
+                B(JumpIfFalse), U8(50),
   /*   23 E> */ B(StackCheck),
-  /*   52 S> */ B(Mov), R(1), R(8),
-                B(Mov), R(0), R(9),
-                B(Mov), R(2), R(10),
-                B(CallJSRuntime), U8(%async_function_await_uncaught), R(8), U8(3),
-                B(SuspendGenerator), R(1), R(0), U8(8), U8(0),
-  /*   61 S> */ B(Return),
-                B(ResumeGenerator), R(1), R(3), R(0), U8(8),
-                B(Star), R(8),
+  /*   52 S> */ B(Mov), R(1), R(7),
+                B(Mov), R(0), R(8),
+                B(Mov), R(2), R(9),
+                B(InvokeIntrinsic), U8(Runtime::k_AsyncFunctionAwaitUncaught), R(7), U8(3),
+  /*   52 E> */ B(SuspendGenerator), R(1), R(0), U8(7), U8(0),
+                B(ResumeGenerator), R(1), R(0), U8(7),
+                B(Star), R(7),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(1), U8(1),
-                B(Star), R(9),
+                B(Star), R(8),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(9),
+                B(TestEqualStrictNoFeedback), R(8),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(8),
+                B(Ldar), R(7),
                 B(ReThrow),
   /*   49 S> */ B(Ldar), R(0),
                 B(Inc), U8(1),
                 B(Star), R(0),
-                B(JumpLoop), U8(68), I8(0),
+                B(JumpLoop), U8(52), I8(0),
                 B(LdaUndefined),
-                B(Star), R(9),
-                B(Mov), R(2), R(8),
-  /*   49 E> */ B(CallJSRuntime), U8(%promise_resolve), R(8), U8(2),
+                B(Star), R(8),
+                B(Mov), R(2), R(7),
+  /*   49 E> */ B(InvokeIntrinsic), U8(Runtime::k_ResolvePromise), R(7), U8(2),
                 B(LdaZero),
-                B(Star), R(4),
-                B(Mov), R(2), R(5),
+                B(Star), R(3),
+                B(Mov), R(2), R(4),
                 B(Jump), U8(58),
                 B(Jump), U8(42),
-                B(Star), R(8),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(8), U8(2), U8(3),
                 B(Star), R(7),
+                B(Ldar), R(closure),
+                B(CreateCatchContext), R(7), U8(1), U8(2),
+                B(Star), R(6),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(7),
-                B(PushContext), R(8),
+                B(Ldar), R(6),
+                B(PushContext), R(7),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(10),
+                B(Star), R(9),
                 B(LdaFalse),
-                B(Star), R(11),
-                B(Mov), R(2), R(9),
-                B(CallJSRuntime), U8(%promise_internal_reject), R(9), U8(3),
-                B(PopContext), R(8),
+                B(Star), R(10),
+                B(Mov), R(2), R(8),
+                B(InvokeIntrinsic), U8(Runtime::k_RejectPromise), R(8), U8(3),
+                B(PopContext), R(7),
                 B(LdaZero),
-                B(Star), R(4),
-                B(Mov), R(2), R(5),
+                B(Star), R(3),
+                B(Mov), R(2), R(4),
                 B(Jump), U8(16),
                 B(LdaSmi), I8(-1),
-                B(Star), R(5),
                 B(Star), R(4),
+                B(Star), R(3),
                 B(Jump), U8(8),
-                B(Star), R(5),
-                B(LdaSmi), I8(1),
                 B(Star), R(4),
+                B(LdaSmi), I8(1),
+                B(Star), R(3),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(6),
+                B(Star), R(5),
                 B(CallJSRuntime), U8(%async_function_promise_release), R(2), U8(1),
-                B(Ldar), R(6),
+                B(Ldar), R(5),
                 B(SetPendingMessage),
-                B(Ldar), R(4),
-                B(SwitchOnSmiNoFeedback), U8(4), U8(2), I8(0),
+                B(Ldar), R(3),
+                B(SwitchOnSmiNoFeedback), U8(3), U8(2), I8(0),
                 B(Jump), U8(8),
-                B(Ldar), R(5),
+                B(Ldar), R(4),
   /*   61 S> */ B(Return),
-                B(Ldar), R(5),
+                B(Ldar), R(4),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   61 S> */ B(Return),
 ]
 constant pool: [
-  Smi [38],
-  Smi [39],
+  Smi [58],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   Smi [6],
   Smi [9],
 ]
 handlers: [
-  [46, 183, 191],
-  [49, 141, 143],
+  [26, 147, 155],
+  [29, 105, 107],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticClassFields.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticClassFields.golden
index 80a2e4fd493..342af2fe115 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticClassFields.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticClassFields.golden
@@ -112,7 +112,7 @@ bytecodes: [
   /*  215 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["b"],
@@ -121,7 +121,7 @@ constant pool: [
   SHARED_FUNCTION_INFO_TYPE,
   SYMBOL_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
@@ -308,7 +308,7 @@ bytecodes: [
   /*  483 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   FIXED_ARRAY_TYPE,
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
@@ -319,7 +319,7 @@ constant pool: [
   SHARED_FUNCTION_INFO_TYPE,
   SYMBOL_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   FIXED_ARRAY_TYPE,
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
@@ -327,7 +327,7 @@ constant pool: [
   SHARED_FUNCTION_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/SuperCallAndSpread.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/SuperCallAndSpread.golden
index cf04f8e0c2c..bb5a0da42eb 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/SuperCallAndSpread.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/SuperCallAndSpread.golden
@@ -91,9 +91,9 @@ snippet: "
     test = new B(1, 2, 3).constructor;
   })();
 "
-frame size: 8
+frame size: 12
 parameter count: 1
-bytecode array length: 60
+bytecode array length: 124
 bytecodes: [
                 B(CreateRestParameter),
                 B(Star), R(2),
@@ -104,12 +104,35 @@ bytecodes: [
                 B(Star), R(4),
                 B(CreateArrayLiteral), U8(0), U8(0), U8(37),
                 B(Star), R(5),
-  /*  152 E> */ B(CallJSRuntime), U8(%spread_iterable), R(2), U8(1),
-                B(Star), R(6),
-                B(CreateArrayLiteral), U8(1), U8(1), U8(37),
+                B(LdaConstant), U8(1),
+  /*  152 S> */ B(Star), R(6),
+                B(LdaNamedProperty), R(2), U8(2), U8(6),
+                B(Star), R(11),
+                B(CallProperty0), R(11), R(2), U8(8),
+                B(Mov), R(2), R(10),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
+                B(Star), R(9),
+                B(LdaNamedProperty), R(9), U8(3), U8(10),
+                B(Star), R(8),
+                B(CallProperty0), R(8), R(9), U8(12),
                 B(Star), R(7),
-                B(CallJSRuntime), U8(%spread_arguments), R(5), U8(3),
-                B(Star), R(5),
+                B(JumpIfJSReceiver), U8(7),
+                B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(7), U8(1),
+                B(LdaNamedProperty), R(7), U8(4), U8(14),
+                B(JumpIfToBooleanTrue), U8(21),
+                B(LdaNamedProperty), R(7), U8(5), U8(16),
+                B(Star), R(7),
+                B(StaInArrayLiteral), R(5), R(6), U8(1),
+                B(Ldar), R(6),
+                B(Inc), U8(3),
+                B(Star), R(6),
+                B(JumpLoop), U8(35), I8(0),
+                B(LdaSmi), I8(1),
+                B(StaInArrayLiteral), R(5), R(6), U8(1),
+                B(Ldar), R(6),
+                B(Inc), U8(3),
+                B(Star), R(6),
                 B(Mov), R(0), R(6),
   /*  140 E> */ B(CallJSRuntime), U8(%reflect_construct), R(4), U8(3),
                 B(Star), R(4),
@@ -122,7 +145,11 @@ bytecodes: [
 ]
 constant pool: [
   TUPLE2_TYPE,
-  TUPLE2_TYPE,
+  Smi [1],
+  SYMBOL_TYPE,
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
 ]
 handlers: [
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/TemplateLiterals.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/TemplateLiterals.golden
new file mode 100644
index 00000000000..6cfcf42472b
--- /dev/null
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/TemplateLiterals.golden
@@ -0,0 +1,222 @@
+#
+# Autogenerated by generate-bytecode-expectations.
+#
+
+---
+wrap: yes
+
+---
+snippet: "
+  var a = 1;
+  var b = 2;
+  return `${a}${b}string`;
+"
+frame size: 3
+parameter count: 1
+bytecode array length: 28
+bytecodes: [
+  /*   30 E> */ B(StackCheck),
+  /*   42 S> */ B(LdaSmi), I8(1),
+                B(Star), R(0),
+  /*   53 S> */ B(LdaSmi), I8(2),
+                B(Star), R(1),
+  /*   56 S> */ B(Ldar), R(0),
+                B(ToString),
+                B(Star), R(2),
+                B(Ldar), R(1),
+  /*   70 E> */ B(ToString),
+                B(Add), R(2), U8(0),
+                B(Star), R(2),
+                B(LdaConstant), U8(0),
+                B(Add), R(2), U8(0),
+  /*   80 S> */ B(Return),
+]
+constant pool: [
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["string"],
+]
+handlers: [
+]
+
+---
+snippet: "
+  var a = 1;
+  var b = 2;
+  return `string${a}${b}`;
+"
+frame size: 3
+parameter count: 1
+bytecode array length: 28
+bytecodes: [
+  /*   30 E> */ B(StackCheck),
+  /*   42 S> */ B(LdaSmi), I8(1),
+                B(Star), R(0),
+  /*   53 S> */ B(LdaSmi), I8(2),
+                B(Star), R(1),
+  /*   56 S> */ B(LdaConstant), U8(0),
+                B(Star), R(2),
+                B(Ldar), R(0),
+  /*   72 E> */ B(ToString),
+                B(Add), R(2), U8(0),
+                B(Star), R(2),
+                B(Ldar), R(1),
+  /*   76 E> */ B(ToString),
+                B(Add), R(2), U8(0),
+  /*   80 S> */ B(Return),
+]
+constant pool: [
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["string"],
+]
+handlers: [
+]
+
+---
+snippet: "
+  var a = 1;
+  var b = 2;
+  return `${a}string${b}`;
+"
+frame size: 3
+parameter count: 1
+bytecode array length: 28
+bytecodes: [
+  /*   30 E> */ B(StackCheck),
+  /*   42 S> */ B(LdaSmi), I8(1),
+                B(Star), R(0),
+  /*   53 S> */ B(LdaSmi), I8(2),
+                B(Star), R(1),
+  /*   56 S> */ B(Ldar), R(0),
+                B(ToString),
+                B(Star), R(2),
+                B(LdaConstant), U8(0),
+                B(Add), R(2), U8(0),
+                B(Star), R(2),
+                B(Ldar), R(1),
+  /*   76 E> */ B(ToString),
+                B(Add), R(2), U8(0),
+  /*   80 S> */ B(Return),
+]
+constant pool: [
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["string"],
+]
+handlers: [
+]
+
+---
+snippet: "
+  var a = 1;
+  var b = 2;
+  return `foo${a}bar${b}baz${1}`;
+"
+frame size: 3
+parameter count: 1
+bytecode array length: 50
+bytecodes: [
+  /*   30 E> */ B(StackCheck),
+  /*   42 S> */ B(LdaSmi), I8(1),
+                B(Star), R(0),
+  /*   53 S> */ B(LdaSmi), I8(2),
+                B(Star), R(1),
+  /*   56 S> */ B(LdaConstant), U8(0),
+                B(Star), R(2),
+                B(Ldar), R(0),
+  /*   69 E> */ B(ToString),
+                B(Add), R(2), U8(0),
+                B(Star), R(2),
+                B(LdaConstant), U8(1),
+                B(Add), R(2), U8(0),
+                B(Star), R(2),
+                B(Ldar), R(1),
+  /*   76 E> */ B(ToString),
+                B(Add), R(2), U8(0),
+                B(Star), R(2),
+                B(LdaConstant), U8(2),
+                B(Add), R(2), U8(0),
+                B(Star), R(2),
+                B(LdaSmi), I8(1),
+                B(ToString),
+                B(Add), R(2), U8(0),
+  /*   87 S> */ B(Return),
+]
+constant pool: [
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["foo"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["bar"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["baz"],
+]
+handlers: [
+]
+
+---
+snippet: "
+  var a = 1;
+  var b = 2;
+  return `${a}string` + `string${b}`;
+"
+frame size: 4
+parameter count: 1
+bytecode array length: 35
+bytecodes: [
+  /*   30 E> */ B(StackCheck),
+  /*   42 S> */ B(LdaSmi), I8(1),
+                B(Star), R(0),
+  /*   53 S> */ B(LdaSmi), I8(2),
+                B(Star), R(1),
+  /*   56 S> */ B(Ldar), R(0),
+                B(ToString),
+                B(Star), R(2),
+                B(LdaConstant), U8(0),
+                B(Add), R(2), U8(1),
+                B(Star), R(2),
+                B(LdaConstant), U8(0),
+                B(Star), R(3),
+                B(Ldar), R(1),
+  /*   87 E> */ B(ToString),
+                B(Add), R(3), U8(2),
+  /*   76 E> */ B(Add), R(2), U8(0),
+  /*   91 S> */ B(Return),
+]
+constant pool: [
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["string"],
+]
+handlers: [
+]
+
+---
+snippet: "
+  var a = 1;
+  var b = 2;
+  function foo(a, b) { };
+  return `string${foo(a, b)}${a}${b}`;
+"
+frame size: 4
+parameter count: 1
+bytecode array length: 45
+bytecodes: [
+                B(CreateClosure), U8(0), U8(0), U8(2),
+                B(Star), R(2),
+  /*   30 E> */ B(StackCheck),
+  /*   42 S> */ B(LdaSmi), I8(1),
+                B(Star), R(0),
+  /*   53 S> */ B(LdaSmi), I8(2),
+                B(Star), R(1),
+  /*   80 S> */ B(LdaConstant), U8(1),
+                B(Star), R(3),
+  /*   96 E> */ B(CallUndefinedReceiver2), R(2), R(0), R(1), U8(2),
+                B(ToString),
+                B(Add), R(3), U8(1),
+                B(Star), R(3),
+                B(Ldar), R(0),
+  /*  108 E> */ B(ToString),
+                B(Add), R(3), U8(1),
+                B(Star), R(3),
+                B(Ldar), R(1),
+  /*  112 E> */ B(ToString),
+                B(Add), R(3), U8(1),
+  /*  116 S> */ B(Return),
+]
+constant pool: [
+  SHARED_FUNCTION_INFO_TYPE,
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["string"],
+]
+handlers: [
+]
+
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/TopLevelObjectLiterals.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/TopLevelObjectLiterals.golden
index 07472289332..be78f1b0c9b 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/TopLevelObjectLiterals.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/TopLevelObjectLiterals.golden
@@ -19,10 +19,10 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(2),
                 B(Mov), R(closure), R(3),
-                B(CallRuntime), U16(Runtime::kDeclareGlobalsForInterpreter), R(1), U8(3),
+                B(CallRuntime), U16(Runtime::kDeclareGlobals), R(1), U8(3),
   /*    0 E> */ B(StackCheck),
   /*    8 S> */ B(CreateObjectLiteral), U8(1), U8(2), U8(41), R(1),
-                B(CreateClosure), U8(2), U8(3), U8(0),
+  /*   16 E> */ B(CreateClosure), U8(2), U8(3), U8(0),
                 B(StaNamedOwnProperty), R(1), U8(3), U8(4),
                 B(Ldar), R(1),
   /*    8 E> */ B(StaGlobal), U8(4), U8(6),
@@ -31,7 +31,7 @@ bytecodes: [
 ]
 constant pool: [
   FIXED_ARRAY_TYPE,
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["func"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/TryCatch.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/TryCatch.golden
index cad702e9a3a..52c1a919801 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/TryCatch.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/TryCatch.golden
@@ -33,7 +33,7 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["e"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
 ]
 handlers: [
   [4, 7, 9],
@@ -83,9 +83,9 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["e1"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["e2"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
 ]
 handlers: [
   [4, 8, 10],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/TryFinally.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/TryFinally.golden
index 21102174a50..3aa7006e382 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/TryFinally.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/TryFinally.golden
@@ -100,7 +100,7 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["e"],
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
 ]
 handlers: [
   [8, 39, 47],
@@ -171,8 +171,8 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["e"],
-  FIXED_ARRAY_TYPE,
-  FIXED_ARRAY_TYPE,
+  SCOPE_INFO_TYPE,
+  SCOPE_INFO_TYPE,
 ]
 handlers: [
   [4, 62, 70],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/WithStatement.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/WithStatement.golden
index 443235a3ebb..80c42cbc149 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/WithStatement.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/WithStatement.golden
@@ -24,8 +24,8 @@ bytecodes: [
   /*   59 S> */ B(Return),
 ]
 constant pool: [
-  FIXED_ARRAY_TYPE,
-  FIXED_ARRAY_TYPE,
+  BOILERPLATE_DESCRIPTION_TYPE,
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/generate-bytecode-expectations.cc b/deps/v8/test/cctest/interpreter/generate-bytecode-expectations.cc
index 4064ea1d8bf..4dad7d48ce1 100644
--- a/deps/v8/test/cctest/interpreter/generate-bytecode-expectations.cc
+++ b/deps/v8/test/cctest/interpreter/generate-bytecode-expectations.cc
@@ -45,6 +45,7 @@ class ProgramOptions final {
         do_expressions_(false),
         async_iteration_(false),
         public_fields_(false),
+        private_fields_(false),
         static_fields_(false),
         verbose_(false) {}
 
@@ -66,6 +67,7 @@ class ProgramOptions final {
   bool do_expressions() const { return do_expressions_; }
   bool async_iteration() const { return async_iteration_; }
   bool public_fields() const { return public_fields_; }
+  bool private_fields() const { return private_fields_; }
   bool static_fields() const { return static_fields_; }
   bool verbose() const { return verbose_; }
   bool suppress_runtime_errors() const { return rebaseline_ && !verbose_; }
@@ -85,6 +87,7 @@ class ProgramOptions final {
   bool do_expressions_;
   bool async_iteration_;
   bool public_fields_;
+  bool private_fields_;
   bool static_fields_;
   bool verbose_;
   std::vector<std::string> input_filenames_;
@@ -177,6 +180,8 @@ ProgramOptions ProgramOptions::FromCommandLine(int argc, char** argv) {
       options.async_iteration_ = true;
     } else if (strcmp(argv[i], "--public-fields") == 0) {
       options.public_fields_ = true;
+    } else if (strcmp(argv[i], "--private-fields") == 0) {
+      options.private_fields_ = true;
     } else if (strcmp(argv[i], "--static-fields") == 0) {
       options.static_fields_ = true;
     } else if (strcmp(argv[i], "--verbose") == 0) {
@@ -285,6 +290,8 @@ void ProgramOptions::UpdateFromHeader(std::istream& stream) {
       async_iteration_ = ParseBoolean(line.c_str() + 17);
     } else if (line.compare(0, 15, "public fields: ") == 0) {
       public_fields_ = ParseBoolean(line.c_str() + 15);
+    } else if (line.compare(0, 16, "private fields: ") == 0) {
+      private_fields_ = ParseBoolean(line.c_str() + 16);
     } else if (line.compare(0, 15, "static fields: ") == 0) {
       static_fields_ = ParseBoolean(line.c_str() + 15);
     } else if (line == "---") {
@@ -311,6 +318,7 @@ void ProgramOptions::PrintHeader(std::ostream& stream) const {  // NOLINT
   if (do_expressions_) stream << "\ndo expressions: yes";
   if (async_iteration_) stream << "\nasync iteration: yes";
   if (public_fields_) stream << "\npublic fields: yes";
+  if (private_fields_) stream << "\nprivate fields: yes";
   if (static_fields_) stream << "\nstatic fields: yes";
 
   stream << "\n\n";
@@ -416,6 +424,7 @@ void GenerateExpectationsFile(std::ostream& stream,  // NOLINT
 
   if (options.do_expressions()) i::FLAG_harmony_do_expressions = true;
   if (options.public_fields()) i::FLAG_harmony_public_fields = true;
+  if (options.private_fields()) i::FLAG_harmony_private_fields = true;
   if (options.static_fields()) i::FLAG_harmony_static_fields = true;
 
   stream << "#\n# Autogenerated by generate-bytecode-expectations.\n#\n\n";
@@ -426,6 +435,7 @@ void GenerateExpectationsFile(std::ostream& stream,  // NOLINT
 
   i::FLAG_harmony_do_expressions = false;
   i::FLAG_harmony_public_fields = false;
+  i::FLAG_harmony_private_fields = false;
   i::FLAG_harmony_static_fields = false;
 }
 
@@ -474,6 +484,7 @@ void PrintUsage(const char* exec_path) {
          "  --top-level   Process top level code, not the top-level function.\n"
          "  --do-expressions  Enable harmony_do_expressions flag.\n"
          "  --public-fields  Enable harmony_public_fields flag.\n"
+         "  --private-fields  Enable harmony_private_fields flag.\n"
          "  --static-fields  Enable harmony_static_fields flag.\n"
          "  --output=file.name\n"
          "      Specify the output file. If not specified, output goes to "
diff --git a/deps/v8/test/cctest/interpreter/interpreter-tester.h b/deps/v8/test/cctest/interpreter/interpreter-tester.h
index 93e1d930acf..f8567166605 100644
--- a/deps/v8/test/cctest/interpreter/interpreter-tester.h
+++ b/deps/v8/test/cctest/interpreter/interpreter-tester.h
@@ -122,10 +122,10 @@ class InterpreterTester {
       function->shared()->set_function_data(*bytecode_.ToHandleChecked());
     }
     if (!feedback_metadata_.is_null()) {
-      function->set_feedback_vector_cell(isolate_->heap()->undefined_cell());
+      function->set_feedback_cell(isolate_->heap()->many_closures_cell());
       function->shared()->set_feedback_metadata(
           *feedback_metadata_.ToHandleChecked());
-      JSFunction::EnsureLiterals(function);
+      JSFunction::EnsureFeedbackVector(function);
     }
     return function;
   }
diff --git a/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc b/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc
index 1db0f70ad7e..093a678c22c 100644
--- a/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc
+++ b/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc
@@ -601,9 +601,6 @@ TEST(CallRuntime) {
 
       "function f() { return %Add(1, 2) }\n"
       "f();\n",
-
-      "function f() { return %spread_iterable([1]) }\n"
-      "f();\n",
   };
 
   CHECK(CompareTexts(BuildActual(printer, snippets),
@@ -2233,7 +2230,7 @@ TEST(ClassAndSuperClass) {
                      LoadGolden("ClassAndSuperClass.golden")));
 }
 
-TEST(ClassFields) {
+TEST(PublicClassFields) {
   bool old_flag = i::FLAG_harmony_public_fields;
   i::FLAG_harmony_public_fields = true;
   InitializedIgnitionHandleScope scope;
@@ -2283,10 +2280,70 @@ TEST(ClassFields) {
       "}\n"};
 
   CHECK(CompareTexts(BuildActual(printer, snippets),
-                     LoadGolden("ClassFields.golden")));
+                     LoadGolden("PublicClassFields.golden")));
   i::FLAG_harmony_public_fields = old_flag;
 }
 
+TEST(PrivateClassFields) {
+  bool old_flag = i::FLAG_harmony_private_fields;
+  i::FLAG_harmony_private_fields = true;
+  InitializedIgnitionHandleScope scope;
+  BytecodeExpectationsPrinter printer(CcTest::isolate());
+
+  const char* snippets[] = {
+      "{\n"
+      "  class A {\n"
+      "    #a;\n"
+      "    constructor() {\n"
+      "      this.#a = 1;\n"
+      "    }\n"
+      "  }\n"
+      "\n"
+      "  class B {\n"
+      "    #a = 1;\n"
+      "  }\n"
+      "  new A;\n"
+      "  new B;\n"
+      "}\n",
+
+      "{\n"
+      "  class A extends class {} {\n"
+      "    #a;\n"
+      "    constructor() {\n"
+      "      super();\n"
+      "      this.#a = 1;\n"
+      "    }\n"
+      "  }\n"
+      "\n"
+      "  class B extends class {} {\n"
+      "    #a = 1;\n"
+      "    #b = this.#a;\n"
+      "    foo() { return this.#a; }\n"
+      "    bar(v) { this.#b = v; }\n"
+      "    constructor() {\n"
+      "      super();\n"
+      "      this.foo();\n"
+      "      this.bar(3);\n"
+      "    }\n"
+      "  }\n"
+      "\n"
+      "  class C extends B {\n"
+      "    #a = 2;\n"
+      "    constructor() {\n"
+      "      (() => super())();\n"
+      "    }\n"
+      "  }\n"
+      "\n"
+      "  new A;\n"
+      "  new B;\n"
+      "  new C;\n"
+      "};\n"};
+
+  CHECK(CompareTexts(BuildActual(printer, snippets),
+                     LoadGolden("PrivateClassFields.golden")));
+  i::FLAG_harmony_private_fields = old_flag;
+}
+
 TEST(StaticClassFields) {
   bool old_flag = i::FLAG_harmony_public_fields;
   bool old_static_flag = i::FLAG_harmony_static_fields;
@@ -2690,6 +2747,41 @@ TEST(StringConcat) {
                      LoadGolden("StringConcat.golden")));
 }
 
+TEST(TemplateLiterals) {
+  InitializedIgnitionHandleScope scope;
+  BytecodeExpectationsPrinter printer(CcTest::isolate());
+
+  const char* snippets[] = {
+      "var a = 1;\n"
+      "var b = 2;\n"
+      "return `${a}${b}string`;\n",
+
+      "var a = 1;\n"
+      "var b = 2;\n"
+      "return `string${a}${b}`;\n",
+
+      "var a = 1;\n"
+      "var b = 2;\n"
+      "return `${a}string${b}`;\n",
+
+      "var a = 1;\n"
+      "var b = 2;\n"
+      "return `foo${a}bar${b}baz${1}`;\n",
+
+      "var a = 1;\n"
+      "var b = 2;\n"
+      "return `${a}string` + `string${b}`;\n",
+
+      "var a = 1;\n"
+      "var b = 2;\n"
+      "function foo(a, b) { };\n"
+      "return `string${foo(a, b)}${a}${b}`;\n",
+  };
+
+  CHECK(CompareTexts(BuildActual(printer, snippets),
+                     LoadGolden("TemplateLiterals.golden")));
+}
+
 #undef XSTR
 #undef STR
 #undef UNIQUE_VAR
diff --git a/deps/v8/test/cctest/interpreter/test-interpreter-intrinsics.cc b/deps/v8/test/cctest/interpreter/test-interpreter-intrinsics.cc
index b8ebef3b281..7eb76ecb210 100644
--- a/deps/v8/test/cctest/interpreter/test-interpreter-intrinsics.cc
+++ b/deps/v8/test/cctest/interpreter/test-interpreter-intrinsics.cc
@@ -219,27 +219,6 @@ TEST(IntrinsicAsStubCall) {
                has_property_helper.NewObject("({ x: 20 })")));
 }
 
-TEST(ClassOf) {
-  HandleAndZoneScope handles;
-  Isolate* isolate = handles.main_isolate();
-  Factory* factory = isolate->factory();
-  InvokeIntrinsicHelper helper(handles.main_isolate(), handles.main_zone(),
-                               Runtime::kInlineClassOf);
-  CHECK_EQ(*helper.Invoke(helper.NewObject("123")), *factory->null_value());
-  CHECK_EQ(*helper.Invoke(helper.NewObject("'true'")), *factory->null_value());
-  CHECK_EQ(*helper.Invoke(helper.NewObject("'foo'")), *factory->null_value());
-  CHECK(helper.Invoke(helper.NewObject("({a:1})"))
-            ->SameValue(*helper.NewObject("'Object'")));
-  CHECK(helper.Invoke(helper.NewObject("(function foo() {})"))
-            ->SameValue(*helper.NewObject("'Function'")));
-  CHECK(helper.Invoke(helper.NewObject("new Date()"))
-            ->SameValue(*helper.NewObject("'Date'")));
-  CHECK(helper.Invoke(helper.NewObject("new Set"))
-            ->SameValue(*helper.NewObject("'Set'")));
-  CHECK(helper.Invoke(helper.NewObject("/x/"))
-            ->SameValue(*helper.NewObject("'RegExp'")));
-}
-
 }  // namespace interpreter
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/parsing/test-parse-decision.cc b/deps/v8/test/cctest/parsing/test-parse-decision.cc
index 3c488ca4bf4..26caeb59521 100644
--- a/deps/v8/test/cctest/parsing/test-parse-decision.cc
+++ b/deps/v8/test/cctest/parsing/test-parse-decision.cc
@@ -35,7 +35,7 @@ void GetTopLevelFunctionInfo(
   SharedFunctionInfo::ScriptIterator iterator(i_script);
 
   while (SharedFunctionInfo* shared = iterator.Next()) {
-    std::unique_ptr<char[]> name = String::cast(shared->name())->ToCString();
+    std::unique_ptr<char[]> name = String::cast(shared->Name())->ToCString();
     is_compiled->insert(std::make_pair(name.get(), shared->is_compiled()));
   }
 }
diff --git a/deps/v8/test/cctest/parsing/test-preparser.cc b/deps/v8/test/cctest/parsing/test-preparser.cc
index 48aa4826c96..852fc5f68cd 100644
--- a/deps/v8/test/cctest/parsing/test-preparser.cc
+++ b/deps/v8/test/cctest/parsing/test-preparser.cc
@@ -89,6 +89,11 @@ TEST(PreParserScopeAnalysis) {
        "get_method();",
        true, true, false},
 
+      // Corner case: function expression with name "arguments".
+      {"var test = function arguments(%s) { %s function skippable() { } };\n"
+       "test;\n",
+       false, false, false}
+
       // FIXME(marja): Generators and async functions
   };
 
@@ -677,6 +682,12 @@ TEST(PreParserScopeAnalysis) {
          i::FLAG_harmony_public_fields = false;
          i::FLAG_harmony_static_fields = false;
        }},
+      {"class X { #x = 1 }; new X;",
+       [] { i::FLAG_harmony_private_fields = true; },
+       [] { i::FLAG_harmony_private_fields = false; }},
+      {"function t() { return class { #x = 1 }; } new t();",
+       [] { i::FLAG_harmony_private_fields = true; },
+       [] { i::FLAG_harmony_private_fields = false; }},
   };
 
   for (unsigned outer_ix = 0; outer_ix < arraysize(outers); ++outer_ix) {
@@ -745,7 +756,7 @@ TEST(PreParserScopeAnalysis) {
           scope_with_skipped_functions));
 
       // Do scope allocation (based on the preparsed scope data).
-      i::DeclarationScope::Analyze(&using_scope_data);
+      CHECK(i::DeclarationScope::Analyze(&using_scope_data));
 
       // Parse the lazy function again eagerly to produce baseline data.
       i::ParseInfo not_using_scope_data(shared);
@@ -760,7 +771,7 @@ TEST(PreParserScopeAnalysis) {
           scope_without_skipped_functions));
 
       // Do normal scope allocation.
-      i::DeclarationScope::Analyze(&not_using_scope_data);
+      CHECK(i::DeclarationScope::Analyze(&not_using_scope_data));
 
       // Verify that scope allocation gave the same results when parsing w/ the
       // scope data (and skipping functions), and when parsing without.
diff --git a/deps/v8/test/cctest/print-extension.h b/deps/v8/test/cctest/print-extension.h
index 74d74ef81b5..922d116efd2 100644
--- a/deps/v8/test/cctest/print-extension.h
+++ b/deps/v8/test/cctest/print-extension.h
@@ -28,7 +28,7 @@
 #ifndef V8_TEST_CCTEST_PRINT_EXTENSION_H_
 #define V8_TEST_CCTEST_PRINT_EXTENSION_H_
 
-#include "src/v8.h"
+#include "include/v8.h"
 
 namespace v8 {
 namespace internal {
diff --git a/deps/v8/test/cctest/test-accessors.cc b/deps/v8/test/cctest/test-accessors.cc
index 24c10a0f6e7..6398c405e47 100644
--- a/deps/v8/test/cctest/test-accessors.cc
+++ b/deps/v8/test/cctest/test-accessors.cc
@@ -850,3 +850,38 @@ TEST(Regress609134) {
       "var a = 42;"
       "for (var i = 0; i<3; i++) { a.foo; }");
 }
+
+TEST(ObjectSetLazyDataProperty) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::Object> obj = v8::Object::New(isolate);
+  CHECK(env->Global()->Set(env.local(), v8_str("obj"), obj).FromJust());
+
+  // Despite getting the property multiple times, the getter should only be
+  // called once and data property reads should continue to produce the same
+  // value.
+  static int getter_call_count;
+  getter_call_count = 0;
+  auto result = obj->SetLazyDataProperty(
+      env.local(), v8_str("foo"),
+      [](Local<Name> name, const v8::PropertyCallbackInfo<v8::Value>& info) {
+        getter_call_count++;
+        info.GetReturnValue().Set(getter_call_count);
+      });
+  CHECK(result.FromJust());
+  CHECK_EQ(0, getter_call_count);
+  for (int i = 0; i < 2; i++) {
+    ExpectInt32("obj.foo", 1);
+    CHECK_EQ(1, getter_call_count);
+  }
+
+  // Setting should overwrite the data property.
+  result = obj->SetLazyDataProperty(
+      env.local(), v8_str("bar"),
+      [](Local<Name> name, const v8::PropertyCallbackInfo<v8::Value>& info) {
+        CHECK(false);
+      });
+  CHECK(result.FromJust());
+  ExpectInt32("obj.bar = -1; obj.bar;", -1);
+}
diff --git a/deps/v8/test/cctest/test-api-interceptors.cc b/deps/v8/test/cctest/test-api-interceptors.cc
index fd811abffed..8822e938b91 100644
--- a/deps/v8/test/cctest/test-api-interceptors.cc
+++ b/deps/v8/test/cctest/test-api-interceptors.cc
@@ -64,6 +64,14 @@ void EmptyInterceptorGetter(Local<Name> name,
 void EmptyInterceptorSetter(Local<Name> name, Local<Value> value,
                             const v8::PropertyCallbackInfo<v8::Value>& info) {}
 
+void EmptyInterceptorQuery(Local<Name> name,
+                           const v8::PropertyCallbackInfo<v8::Integer>& info) {}
+
+void EmptyInterceptorDeleter(
+    Local<Name> name, const v8::PropertyCallbackInfo<v8::Boolean>& info) {}
+
+void EmptyInterceptorEnumerator(
+    const v8::PropertyCallbackInfo<v8::Array>& info) {}
 
 void SimpleAccessorGetter(Local<String> name,
                           const v8::PropertyCallbackInfo<v8::Value>& info) {
@@ -2587,6 +2595,47 @@ static void InterceptorForHiddenProperties(
   interceptor_for_hidden_properties_called = true;
 }
 
+THREADED_TEST(NoSideEffectPropertyHandler) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope scope(isolate);
+  Local<ObjectTemplate> templ = ObjectTemplate::New(isolate);
+  templ->SetHandler(v8::NamedPropertyHandlerConfiguration(
+      EmptyInterceptorGetter, EmptyInterceptorSetter, EmptyInterceptorQuery,
+      EmptyInterceptorDeleter, EmptyInterceptorEnumerator));
+
+  LocalContext context;
+  v8::Local<v8::Object> object =
+      templ->NewInstance(context.local()).ToLocalChecked();
+  context->Global()->Set(context.local(), v8_str("obj"), object).FromJust();
+
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("obj.x"), true).IsEmpty());
+  CHECK(
+      v8::debug::EvaluateGlobal(isolate, v8_str("obj.x = 1"), true).IsEmpty());
+  CHECK(
+      v8::debug::EvaluateGlobal(isolate, v8_str("'x' in obj"), true).IsEmpty());
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("delete obj.x"), true)
+            .IsEmpty());
+  // Wrap the variable declaration since declaring globals is a side effect.
+  CHECK(v8::debug::EvaluateGlobal(
+            isolate, v8_str("(function() { for (var p in obj) ; })()"), true)
+            .IsEmpty());
+
+  // TODO(luoe): turn on has_no_side_effect flag from API once it is exposed.
+  i::Handle<i::JSObject> internal_object =
+      i::Handle<i::JSObject>::cast(v8::Utils::OpenHandle(*object));
+  internal_object->GetNamedInterceptor()->set_has_no_side_effect(true);
+
+  v8::debug::EvaluateGlobal(isolate, v8_str("obj.x"), true).ToLocalChecked();
+  CHECK(
+      v8::debug::EvaluateGlobal(isolate, v8_str("obj.x = 1"), true).IsEmpty());
+  v8::debug::EvaluateGlobal(isolate, v8_str("'x' in obj"), true)
+      .ToLocalChecked();
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("delete obj.x"), true)
+            .IsEmpty());
+  v8::debug::EvaluateGlobal(
+      isolate, v8_str("(function() { for (var p in obj) ; })()"), true)
+      .ToLocalChecked();
+}
 
 THREADED_TEST(HiddenPropertiesWithInterceptors) {
   LocalContext context;
diff --git a/deps/v8/test/cctest/test-api.cc b/deps/v8/test/cctest/test-api.cc
index b3937382da0..c9cd7f44dbc 100644
--- a/deps/v8/test/cctest/test-api.cc
+++ b/deps/v8/test/cctest/test-api.cc
@@ -46,6 +46,7 @@
 #include "src/debug/debug.h"
 #include "src/execution.h"
 #include "src/futex-emulation.h"
+#include "src/global-handles.h"
 #include "src/heap/incremental-marking.h"
 #include "src/heap/local-allocator.h"
 #include "src/lookup.h"
@@ -1768,6 +1769,36 @@ THREADED_TEST(NumberObject) {
   CHECK_EQ(43.0, the_number);
 }
 
+THREADED_TEST(BigIntObject) {
+  v8::internal::FLAG_harmony_bigint = true;
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::Context> context(env.local());
+  v8::Local<Value> boxed_bigint = CompileRun("new Object(42n)");
+  CHECK(!boxed_bigint->IsBigInt());
+  CHECK(boxed_bigint->IsBigIntObject());
+  v8::Local<Value> unboxed_bigint = CompileRun("42n");
+  CHECK(unboxed_bigint->IsBigInt());
+  CHECK(!unboxed_bigint->IsBigIntObject());
+  v8::Local<v8::BigIntObject> as_boxed = boxed_bigint.As<v8::BigIntObject>();
+  CHECK(!as_boxed.IsEmpty());
+  v8::Local<v8::BigInt> unpacked = as_boxed->ValueOf();
+  CHECK(!unpacked.IsEmpty());
+  v8::Local<v8::Value> new_boxed_bigint = v8::BigIntObject::New(isolate, 43);
+  CHECK(new_boxed_bigint->IsBigIntObject());
+  v8::Local<v8::Value> new_unboxed_bigint = v8::BigInt::New(isolate, 44);
+  CHECK(new_unboxed_bigint->IsBigInt());
+
+  // Test functionality inherited from v8::Value.
+  CHECK(unboxed_bigint->BooleanValue(context).ToChecked());
+  v8::Local<v8::String> string =
+      unboxed_bigint->ToString(context).ToLocalChecked();
+  CHECK_EQ(0, strcmp("42", *v8::String::Utf8Value(isolate, string)));
+
+  // IntegerValue throws.
+  CHECK(unboxed_bigint->IntegerValue(context).IsNothing());
+}
 
 THREADED_TEST(BooleanObject) {
   LocalContext env;
@@ -2934,16 +2965,20 @@ THREADED_TEST(EmbedderDataAlignedPointers) {
   v8::HandleScope scope(env->GetIsolate());
 
   CheckAlignedPointerInEmbedderData(&env, 0, nullptr);
+  CHECK_EQ(1, (*env)->GetNumberOfEmbedderDataFields());
 
   int* heap_allocated = new int[100];
   CheckAlignedPointerInEmbedderData(&env, 1, heap_allocated);
+  CHECK_EQ(2, (*env)->GetNumberOfEmbedderDataFields());
   delete[] heap_allocated;
 
   int stack_allocated[100];
   CheckAlignedPointerInEmbedderData(&env, 2, stack_allocated);
+  CHECK_EQ(3, (*env)->GetNumberOfEmbedderDataFields());
 
   void* huge = reinterpret_cast<void*>(~static_cast<uintptr_t>(1));
   CheckAlignedPointerInEmbedderData(&env, 3, huge);
+  CHECK_EQ(4, (*env)->GetNumberOfEmbedderDataFields());
 
   // Test growing of the embedder data's backing store.
   for (int i = 0; i < 100; i++) {
@@ -2967,10 +3002,17 @@ THREADED_TEST(EmbedderData) {
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
 
+  CHECK_EQ(0, (*env)->GetNumberOfEmbedderDataFields());
   CheckEmbedderData(&env, 3, v8_str("The quick brown fox jumps"));
+  CHECK_EQ(4, (*env)->GetNumberOfEmbedderDataFields());
   CheckEmbedderData(&env, 2, v8_str("over the lazy dog."));
+  CHECK_EQ(4, (*env)->GetNumberOfEmbedderDataFields());
   CheckEmbedderData(&env, 1, v8::Number::New(isolate, 1.2345));
+  CHECK_EQ(4, (*env)->GetNumberOfEmbedderDataFields());
   CheckEmbedderData(&env, 0, v8::Boolean::New(isolate, true));
+  CHECK_EQ(4, (*env)->GetNumberOfEmbedderDataFields());
+  CheckEmbedderData(&env, 211, v8::Boolean::New(isolate, true));
+  CHECK_EQ(212, (*env)->GetNumberOfEmbedderDataFields());
 }
 
 
@@ -10379,7 +10421,8 @@ THREADED_TEST(ObjectGetOwnPropertyNames) {
             ->GetOwnPropertyNames(context.local(),
                                   static_cast<v8::PropertyFilter>(
                                       v8::PropertyFilter::ALL_PROPERTIES |
-                                      v8::PropertyFilter::SKIP_SYMBOLS))
+                                      v8::PropertyFilter::SKIP_SYMBOLS),
+                                  v8::KeyConversionMode::kKeepNumbers)
             .ToLocal(&properties));
   CHECK_EQ(5u, properties->Length());
   v8::Local<v8::Value> property;
@@ -10395,14 +10438,34 @@ THREADED_TEST(ObjectGetOwnPropertyNames) {
     CHECK_EQ(property.As<v8::Int32>()->Value(), i);
   }
 
-  CHECK(value->GetOwnPropertyNames(context.local(), v8::ONLY_ENUMERABLE)
+  CHECK(value
+            ->GetOwnPropertyNames(context.local(),
+                                  v8::PropertyFilter::ONLY_ENUMERABLE,
+                                  v8::KeyConversionMode::kKeepNumbers)
             .ToLocal(&properties));
+  v8::Local<v8::Array> number_properties;
+  CHECK(value
+            ->GetOwnPropertyNames(context.local(),
+                                  v8::PropertyFilter::ONLY_ENUMERABLE,
+                                  v8::KeyConversionMode::kConvertToString)
+            .ToLocal(&number_properties));
   CHECK_EQ(4u, properties->Length());
   for (int i = 0; i < 4; ++i) {
-    v8::Local<v8::Value> property;
-    CHECK(properties->Get(context.local(), i).ToLocal(&property) &&
-          property->IsInt32());
-    CHECK_EQ(property.As<v8::Int32>()->Value(), i);
+    v8::Local<v8::Value> property_index;
+    v8::Local<v8::Value> property_name;
+
+    CHECK(number_properties->Get(context.local(), i).ToLocal(&property_name));
+    CHECK(property_name->IsString());
+
+    CHECK(properties->Get(context.local(), i).ToLocal(&property_index));
+    CHECK(property_index->IsInt32());
+
+    CHECK_EQ(property_index.As<v8::Int32>()->Value(), i);
+    CHECK_EQ(property_name->ToNumber(context.local())
+                 .ToLocalChecked()
+                 .As<v8::Int32>()
+                 ->Value(),
+             i);
   }
 
   value = value->GetPrototype().As<v8::Object>();
@@ -11134,264 +11197,6 @@ THREADED_TEST(Constructor) {
 }
 
 
-static void ConstructorCallback(
-    const v8::FunctionCallbackInfo<v8::Value>& args) {
-  ApiTestFuzzer::Fuzz();
-  Local<Object> This;
-
-  v8::Local<v8::Context> context = args.GetIsolate()->GetCurrentContext();
-  if (args.IsConstructCall()) {
-    Local<Object> Holder = args.Holder();
-    This = Object::New(args.GetIsolate());
-    Local<Value> proto = Holder->GetPrototype();
-    if (proto->IsObject()) {
-      This->SetPrototype(context, proto).FromJust();
-    }
-  } else {
-    This = args.This();
-  }
-
-  This->Set(context, v8_str("a"), args[0]).FromJust();
-  args.GetReturnValue().Set(This);
-}
-
-
-static void FakeConstructorCallback(
-    const v8::FunctionCallbackInfo<v8::Value>& args) {
-  ApiTestFuzzer::Fuzz();
-  args.GetReturnValue().Set(args[0]);
-}
-
-
-THREADED_TEST(ConstructorForObject) {
-  LocalContext context;
-  v8::Isolate* isolate = context->GetIsolate();
-  v8::HandleScope handle_scope(isolate);
-
-  {
-    Local<ObjectTemplate> instance_template = ObjectTemplate::New(isolate);
-    instance_template->SetCallAsFunctionHandler(ConstructorCallback);
-    Local<Object> instance =
-        instance_template->NewInstance(context.local()).ToLocalChecked();
-    CHECK(context->Global()
-              ->Set(context.local(), v8_str("obj"), instance)
-              .FromJust());
-    v8::TryCatch try_catch(isolate);
-    Local<Value> value;
-    CHECK(!try_catch.HasCaught());
-
-    // Call the Object's constructor with a 32-bit signed integer.
-    value = CompileRun("(function() { var o = new obj(28); return o.a; })()");
-    CHECK(!try_catch.HasCaught());
-    CHECK(value->IsInt32());
-    CHECK_EQ(28, value->Int32Value(context.local()).FromJust());
-
-    Local<Value> args1[] = {v8_num(28)};
-    Local<Value> value_obj1 =
-        instance->CallAsConstructor(context.local(), 1, args1).ToLocalChecked();
-    CHECK(value_obj1->IsObject());
-    Local<Object> object1 = Local<Object>::Cast(value_obj1);
-    value = object1->Get(context.local(), v8_str("a")).ToLocalChecked();
-    CHECK(value->IsInt32());
-    CHECK(!try_catch.HasCaught());
-    CHECK_EQ(28, value->Int32Value(context.local()).FromJust());
-
-    // Call the Object's constructor with a String.
-    value =
-        CompileRun("(function() { var o = new obj('tipli'); return o.a; })()");
-    CHECK(!try_catch.HasCaught());
-    CHECK(value->IsString());
-    String::Utf8Value string_value1(
-        isolate, value->ToString(context.local()).ToLocalChecked());
-    CHECK_EQ(0, strcmp("tipli", *string_value1));
-
-    Local<Value> args2[] = {v8_str("tipli")};
-    Local<Value> value_obj2 =
-        instance->CallAsConstructor(context.local(), 1, args2).ToLocalChecked();
-    CHECK(value_obj2->IsObject());
-    Local<Object> object2 = Local<Object>::Cast(value_obj2);
-    value = object2->Get(context.local(), v8_str("a")).ToLocalChecked();
-    CHECK(!try_catch.HasCaught());
-    CHECK(value->IsString());
-    String::Utf8Value string_value2(
-        isolate, value->ToString(context.local()).ToLocalChecked());
-    CHECK_EQ(0, strcmp("tipli", *string_value2));
-
-    // Call the Object's constructor with a Boolean.
-    value = CompileRun("(function() { var o = new obj(true); return o.a; })()");
-    CHECK(!try_catch.HasCaught());
-    CHECK(value->IsBoolean());
-    CHECK(value->BooleanValue(context.local()).FromJust());
-
-    Local<Value> args3[] = {v8::True(isolate)};
-    Local<Value> value_obj3 =
-        instance->CallAsConstructor(context.local(), 1, args3).ToLocalChecked();
-    CHECK(value_obj3->IsObject());
-    Local<Object> object3 = Local<Object>::Cast(value_obj3);
-    value = object3->Get(context.local(), v8_str("a")).ToLocalChecked();
-    CHECK(!try_catch.HasCaught());
-    CHECK(value->IsBoolean());
-    CHECK(value->BooleanValue(context.local()).FromJust());
-
-    // Call the Object's constructor with undefined.
-    Local<Value> args4[] = {v8::Undefined(isolate)};
-    Local<Value> value_obj4 =
-        instance->CallAsConstructor(context.local(), 1, args4).ToLocalChecked();
-    CHECK(value_obj4->IsObject());
-    Local<Object> object4 = Local<Object>::Cast(value_obj4);
-    value = object4->Get(context.local(), v8_str("a")).ToLocalChecked();
-    CHECK(!try_catch.HasCaught());
-    CHECK(value->IsUndefined());
-
-    // Call the Object's constructor with null.
-    Local<Value> args5[] = {v8::Null(isolate)};
-    Local<Value> value_obj5 =
-        instance->CallAsConstructor(context.local(), 1, args5).ToLocalChecked();
-    CHECK(value_obj5->IsObject());
-    Local<Object> object5 = Local<Object>::Cast(value_obj5);
-    value = object5->Get(context.local(), v8_str("a")).ToLocalChecked();
-    CHECK(!try_catch.HasCaught());
-    CHECK(value->IsNull());
-  }
-
-  // Check exception handling when there is no constructor set for the Object.
-  {
-    Local<ObjectTemplate> instance_template = ObjectTemplate::New(isolate);
-    Local<Object> instance =
-        instance_template->NewInstance(context.local()).ToLocalChecked();
-    CHECK(context->Global()
-              ->Set(context.local(), v8_str("obj2"), instance)
-              .FromJust());
-    v8::TryCatch try_catch(isolate);
-    Local<Value> value;
-    CHECK(!try_catch.HasCaught());
-
-    value = CompileRun("new obj2(28)");
-    CHECK(try_catch.HasCaught());
-    String::Utf8Value exception_value1(isolate, try_catch.Exception());
-    CHECK_EQ(0,
-             strcmp("TypeError: obj2 is not a constructor", *exception_value1));
-    try_catch.Reset();
-
-    Local<Value> args[] = {v8_num(29)};
-    CHECK(instance->CallAsConstructor(context.local(), 1, args).IsEmpty());
-    CHECK(try_catch.HasCaught());
-    String::Utf8Value exception_value2(isolate, try_catch.Exception());
-    CHECK_EQ(
-        0, strcmp("TypeError: object is not a constructor", *exception_value2));
-    try_catch.Reset();
-  }
-
-  // Check the case when constructor throws exception.
-  {
-    Local<ObjectTemplate> instance_template = ObjectTemplate::New(isolate);
-    instance_template->SetCallAsFunctionHandler(ThrowValue);
-    Local<Object> instance =
-        instance_template->NewInstance(context.local()).ToLocalChecked();
-    CHECK(context->Global()
-              ->Set(context.local(), v8_str("obj3"), instance)
-              .FromJust());
-    v8::TryCatch try_catch(isolate);
-    Local<Value> value;
-    CHECK(!try_catch.HasCaught());
-
-    value = CompileRun("new obj3(22)");
-    CHECK(try_catch.HasCaught());
-    String::Utf8Value exception_value1(isolate, try_catch.Exception());
-    CHECK_EQ(0, strcmp("22", *exception_value1));
-    try_catch.Reset();
-
-    Local<Value> args[] = {v8_num(23)};
-    CHECK(instance->CallAsConstructor(context.local(), 1, args).IsEmpty());
-    CHECK(try_catch.HasCaught());
-    String::Utf8Value exception_value2(isolate, try_catch.Exception());
-    CHECK_EQ(0, strcmp("23", *exception_value2));
-    try_catch.Reset();
-  }
-
-  // Check whether constructor returns with an object or non-object.
-  {
-    Local<FunctionTemplate> function_template =
-        FunctionTemplate::New(isolate, FakeConstructorCallback);
-    Local<Function> function =
-        function_template->GetFunction(context.local()).ToLocalChecked();
-    Local<Object> instance1 = function;
-    CHECK(instance1->IsObject());
-    CHECK(instance1->IsFunction());
-    CHECK(context->Global()
-              ->Set(context.local(), v8_str("obj4"), instance1)
-              .FromJust());
-    v8::TryCatch try_catch(isolate);
-    CHECK(!try_catch.HasCaught());
-
-    {
-      Local<Value> value = CompileRun("new obj4(28)");
-      CHECK(!try_catch.HasCaught());
-      CHECK(value->IsObject());
-
-      Local<Value> args[] = {v8_num(28)};
-      value = instance1->CallAsConstructor(context.local(), 1, args)
-                  .ToLocalChecked();
-      CHECK(!try_catch.HasCaught());
-      CHECK(value->IsObject());
-    }
-
-    Local<Value> proxy = CompileRun("proxy = new Proxy({},{})");
-    CHECK(!try_catch.HasCaught());
-    CHECK(proxy->IsProxy());
-
-    {
-      Local<Value> value = CompileRun("new obj4(proxy)");
-      CHECK(!try_catch.HasCaught());
-      CHECK(value->IsProxy());
-      CHECK(value->SameValue(proxy));
-
-      Local<Value> args[] = {proxy};
-      value = instance1->CallAsConstructor(context.local(), 1, args)
-                  .ToLocalChecked();
-      CHECK(!try_catch.HasCaught());
-      CHECK(value->SameValue(proxy));
-    }
-
-    Local<ObjectTemplate> instance_template = ObjectTemplate::New(isolate);
-    instance_template->SetCallAsFunctionHandler(FakeConstructorCallback);
-    Local<Object> instance2 =
-        instance_template->NewInstance(context.local()).ToLocalChecked();
-    CHECK(instance2->IsObject());
-    CHECK(instance2->IsFunction());
-    CHECK(context->Global()
-              ->Set(context.local(), v8_str("obj5"), instance2)
-              .FromJust());
-    CHECK(!try_catch.HasCaught());
-
-    {
-      Local<Value> value = CompileRun("new obj5(28)");
-      CHECK(!try_catch.HasCaught());
-      CHECK(!value->IsObject());
-
-      Local<Value> args[] = {v8_num(28)};
-      value = instance2->CallAsConstructor(context.local(), 1, args)
-                  .ToLocalChecked();
-      CHECK(!try_catch.HasCaught());
-      CHECK(!value->IsObject());
-    }
-
-    {
-      Local<Value> value = CompileRun("new obj5(proxy)");
-      CHECK(!try_catch.HasCaught());
-      CHECK(value->IsProxy());
-      CHECK(value->SameValue(proxy));
-
-      Local<Value> args[] = {proxy};
-      value = instance2->CallAsConstructor(context.local(), 1, args)
-                  .ToLocalChecked();
-      CHECK(!try_catch.HasCaught());
-      CHECK(value->SameValue(proxy));
-    }
-  }
-}
-
-
 THREADED_TEST(FunctionDescriptorException) {
   LocalContext context;
   v8::Isolate* isolate = context->GetIsolate();
@@ -11687,11 +11492,15 @@ THREADED_TEST(CallAsFunction) {
     CHECK(!try_catch.HasCaught());
     CHECK_EQ(17, value->Int32Value(context.local()).FromJust());
 
-    // Check that the call-as-function handler can be called through
+    // Check that the call-as-function handler cannot be called through
     // new.
     value = CompileRun("new obj(43)");
-    CHECK(!try_catch.HasCaught());
-    CHECK_EQ(-43, value->Int32Value(context.local()).FromJust());
+    CHECK(value.IsEmpty());
+    CHECK(try_catch.HasCaught());
+    String::Utf8Value exception_value(isolate, try_catch.Exception());
+    CHECK_EQ(0,
+             strcmp("TypeError: obj is not a constructor", *exception_value));
+    try_catch.Reset();
 
     // Check that the call-as-function handler can be called through
     // the API.
@@ -11727,7 +11536,6 @@ THREADED_TEST(CallAsFunction) {
     try_catch.Reset();
 
     // Call an object without call-as-function handler through the API
-    value = CompileRun("obj2(28)");
     v8::Local<Value> args[] = {v8_num(28)};
     CHECK(
         instance->CallAsFunction(context.local(), instance, 1, args).IsEmpty());
@@ -14269,6 +14077,7 @@ void SetFunctionEntryHookTest::OnJitEvent(const v8::JitCodeEvent* event) {
                          info);
         }
       }
+      break;
     default:
       break;
   }
@@ -14939,7 +14748,10 @@ void CheckIsSymbolAt(v8::Isolate* isolate, v8::Local<v8::Array> properties,
   CHECK(value->IsSymbol());
   v8::String::Utf8Value symbol_name(isolate,
                                     Local<Symbol>::Cast(value)->Name());
-  CHECK_EQ(0, strcmp(name, *symbol_name));
+  if (strcmp(name, *symbol_name) != 0) {
+    FATAL("properties[%u] was Symbol('%s') instead of Symbol('%s').", index,
+          name, *symbol_name);
+  }
 }
 
 void CheckStringArray(v8::Isolate* isolate, v8::Local<v8::Array> properties,
@@ -14953,7 +14765,9 @@ void CheckStringArray(v8::Isolate* isolate, v8::Local<v8::Array> properties,
       DCHECK(value->IsSymbol());
     } else {
       v8::String::Utf8Value elm(isolate, value);
-      CHECK_EQ(0, strcmp(names[i], *elm));
+      if (strcmp(names[i], *elm) != 0) {
+        FATAL("properties[%u] was '%s' instead of '%s'.", i, *elm, names[i]);
+      }
     }
   }
 }
@@ -14995,9 +14809,13 @@ THREADED_TEST(PropertyEnumeration) {
       "var proto = {x: 1, y: 2, z: 3};"
       "var x = { __proto__: proto, w: 0, z: 1 };"
       "result[3] = x;"
+      "result[4] = {21350:1};"
+      "x = Object.create(null);"
+      "x.a = 1; x[12345678] = 1;"
+      "result[5] = x;"
       "result;");
   v8::Local<v8::Array> elms = obj.As<v8::Array>();
-  CHECK_EQ(4u, elms->Length());
+  CHECK_EQ(6u, elms->Length());
   int elmc0 = 0;
   const char** elmv0 = nullptr;
   CheckProperties(
@@ -15040,6 +14858,20 @@ THREADED_TEST(PropertyEnumeration) {
       isolate,
       elms->Get(context.local(), v8::Integer::New(isolate, 3)).ToLocalChecked(),
       elmc4, elmv4);
+  // Dictionary elements.
+  int elmc5 = 1;
+  const char* elmv5[] = {"21350"};
+  CheckProperties(
+      isolate,
+      elms->Get(context.local(), v8::Integer::New(isolate, 4)).ToLocalChecked(),
+      elmc5, elmv5);
+  // Dictionary properties.
+  int elmc6 = 2;
+  const char* elmv6[] = {"12345678", "a"};
+  CheckProperties(
+      isolate,
+      elms->Get(context.local(), v8::Integer::New(isolate, 5)).ToLocalChecked(),
+      elmc6, elmv6);
 }
 
 
@@ -15210,38 +15042,6 @@ THREADED_TEST(AccessChecksReenabledCorrectly) {
 }
 
 
-// Tests that ScriptData can be serialized and deserialized.
-TEST(PreCompileSerialization) {
-  // Producing cached parser data while parsing eagerly is not supported.
-  if (!i::FLAG_lazy) return;
-
-  v8::V8::Initialize();
-  LocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  HandleScope handle_scope(isolate);
-
-  const char* script = "function foo(a) { return a+1; }";
-  v8::ScriptCompiler::Source source(v8_str(script));
-  v8::ScriptCompiler::Compile(env.local(), &source,
-                              v8::ScriptCompiler::kProduceParserCache)
-      .ToLocalChecked();
-  // Serialize.
-  const v8::ScriptCompiler::CachedData* cd = source.GetCachedData();
-  i::byte* serialized_data = i::NewArray<i::byte>(cd->length);
-  i::MemCopy(serialized_data, cd->data, cd->length);
-
-  // Deserialize.
-  i::ScriptData* deserialized = new i::ScriptData(serialized_data, cd->length);
-
-  // Verify that the original is the same as the deserialized.
-  CHECK_EQ(cd->length, deserialized->length());
-  CHECK_EQ(0, memcmp(cd->data, deserialized->data(), cd->length));
-
-  delete deserialized;
-  i::DeleteArray(serialized_data);
-}
-
-
 // This tests that we do not allow dictionary load/call inline caches
 // to use functions that have not yet been compiled.  The potential
 // problem of loading a function that has not yet been compiled can
@@ -18321,6 +18121,33 @@ TEST(PromiseHook) {
   // 6) resolve hook (p1)
   CHECK_EQ(6, promise_hook_data->promise_hook_count);
 
+  promise_hook_data->Reset();
+  source =
+      "class X extends Promise {\n"
+      "  static get [Symbol.species]() {\n"
+      "    return Y;\n"
+      "  }\n"
+      "}\n"
+      "class Y {\n"
+      "  constructor(executor) {\n"
+      "    return new Proxy(new Promise(executor), {});\n"
+      "  }\n"
+      "}\n"
+      "var x = X.resolve().then(() => {});\n";
+
+  CompileRun(source);
+
+  promise_hook_data->Reset();
+  source =
+      "var resolve, value = '';\n"
+      "var p = new Promise(r => resolve = r);\n";
+
+  CompileRun(source);
+  CHECK_EQ(v8::Promise::kPending, GetPromise("p")->State());
+  CompileRun("resolve(Promise.resolve(value));\n");
+  CHECK_EQ(v8::Promise::kFulfilled, GetPromise("p")->State());
+  CHECK_EQ(9, promise_hook_data->promise_hook_count);
+
   delete promise_hook_data;
   isolate->SetPromiseHook(nullptr);
 }
@@ -21897,6 +21724,31 @@ TEST(RunMicrotasksIgnoresThrownExceptions) {
            CompileRun("exception2Calls")->Int32Value(env.local()).FromJust());
 }
 
+static void ThrowExceptionMicrotask(void* data) {
+  CcTest::isolate()->ThrowException(v8_str("exception"));
+}
+
+int microtask_callback_count = 0;
+
+static void IncrementCounterMicrotask(void* data) {
+  microtask_callback_count++;
+}
+
+TEST(RunMicrotasksIgnoresThrownExceptionsFromApi) {
+  LocalContext env;
+  v8::Isolate* isolate = CcTest::isolate();
+  isolate->SetMicrotasksPolicy(v8::MicrotasksPolicy::kExplicit);
+  v8::HandleScope scope(isolate);
+  v8::TryCatch try_catch(isolate);
+  {
+    CHECK(!isolate->IsExecutionTerminating());
+    isolate->EnqueueMicrotask(ThrowExceptionMicrotask);
+    isolate->EnqueueMicrotask(IncrementCounterMicrotask);
+    isolate->RunMicrotasks();
+    CHECK_EQ(1, microtask_callback_count);
+    CHECK(!try_catch.HasCaught());
+  }
+}
 
 uint8_t microtasks_completed_callback_count = 0;
 
@@ -22006,6 +21858,42 @@ TEST(RunMicrotasksWithoutEnteringContext) {
   isolate->SetMicrotasksPolicy(v8::MicrotasksPolicy::kAuto);
 }
 
+static void Regress808911_MicrotaskCallback(void* data) {
+  // So here we expect "current context" to be context1 and
+  // "entered or microtask context" to be context2.
+  v8::Isolate* isolate = static_cast<v8::Isolate*>(data);
+  CHECK(isolate->GetCurrentContext() != isolate->GetEnteredContext());
+  CHECK(isolate->GetCurrentContext() !=
+        isolate->GetEnteredOrMicrotaskContext());
+}
+
+static void Regress808911_CurrentContextWrapper(
+    const v8::FunctionCallbackInfo<Value>& info) {
+  // So here we expect "current context" to be context1 and
+  // "entered or microtask context" to be context2.
+  v8::Isolate* isolate = info.GetIsolate();
+  CHECK(isolate->GetCurrentContext() != isolate->GetEnteredContext());
+  CHECK(isolate->GetCurrentContext() !=
+        isolate->GetEnteredOrMicrotaskContext());
+  isolate->EnqueueMicrotask(Regress808911_MicrotaskCallback, isolate);
+  isolate->RunMicrotasks();
+}
+
+THREADED_TEST(Regress808911) {
+  v8::Isolate* isolate = CcTest::isolate();
+  HandleScope handle_scope(isolate);
+  Local<Context> context1 = Context::New(isolate);
+  Local<Function> function;
+  {
+    Context::Scope context_scope(context1);
+    function = Function::New(context1, Regress808911_CurrentContextWrapper)
+                   .ToLocalChecked();
+  }
+  Local<Context> context2 = Context::New(isolate);
+  Context::Scope context_scope(context2);
+  function->CallAsFunction(context2, v8::Undefined(isolate), 0, nullptr)
+      .ToLocalChecked();
+}
 
 TEST(ScopedMicrotasks) {
   LocalContext env;
@@ -24420,6 +24308,60 @@ TEST(PromiseStateAndValue) {
   CHECK(v8_str("rejected")->SameValue(promise->Result()));
 }
 
+TEST(ResolvedPromiseReFulfill) {
+  LocalContext context;
+  v8::Isolate* isolate = context->GetIsolate();
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::String> value1 = v8::String::NewFromUtf8(isolate, "foo");
+  v8::Local<v8::String> value2 = v8::String::NewFromUtf8(isolate, "bar");
+
+  v8::Local<v8::Promise::Resolver> resolver =
+      v8::Promise::Resolver::New(context.local()).ToLocalChecked();
+  v8::Local<v8::Promise> promise = resolver->GetPromise();
+  CHECK_EQ(promise->State(), v8::Promise::PromiseState::kPending);
+
+  resolver->Resolve(context.local(), value1).ToChecked();
+  CHECK_EQ(promise->State(), v8::Promise::PromiseState::kFulfilled);
+  CHECK_EQ(promise->Result(), value1);
+
+  // This should be a no-op.
+  resolver->Resolve(context.local(), value2).ToChecked();
+  CHECK_EQ(promise->State(), v8::Promise::PromiseState::kFulfilled);
+  CHECK_EQ(promise->Result(), value1);
+
+  // This should be a no-op.
+  resolver->Reject(context.local(), value2).ToChecked();
+  CHECK_EQ(promise->State(), v8::Promise::PromiseState::kFulfilled);
+  CHECK_EQ(promise->Result(), value1);
+}
+
+TEST(RejectedPromiseReFulfill) {
+  LocalContext context;
+  v8::Isolate* isolate = context->GetIsolate();
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::String> value1 = v8::String::NewFromUtf8(isolate, "foo");
+  v8::Local<v8::String> value2 = v8::String::NewFromUtf8(isolate, "bar");
+
+  v8::Local<v8::Promise::Resolver> resolver =
+      v8::Promise::Resolver::New(context.local()).ToLocalChecked();
+  v8::Local<v8::Promise> promise = resolver->GetPromise();
+  CHECK_EQ(promise->State(), v8::Promise::PromiseState::kPending);
+
+  resolver->Reject(context.local(), value1).ToChecked();
+  CHECK_EQ(promise->State(), v8::Promise::PromiseState::kRejected);
+  CHECK_EQ(promise->Result(), value1);
+
+  // This should be a no-op.
+  resolver->Reject(context.local(), value2).ToChecked();
+  CHECK_EQ(promise->State(), v8::Promise::PromiseState::kRejected);
+  CHECK_EQ(promise->Result(), value1);
+
+  // This should be a no-op.
+  resolver->Resolve(context.local(), value2).ToChecked();
+  CHECK_EQ(promise->State(), v8::Promise::PromiseState::kRejected);
+  CHECK_EQ(promise->Result(), value1);
+}
+
 TEST(DisallowJavascriptExecutionScope) {
   LocalContext context;
   v8::Isolate* isolate = context->GetIsolate();
@@ -25157,33 +25099,6 @@ TEST(StreamingUtf8ScriptWithSplitCharactersInvalidEdgeCases) {
 }
 
 
-TEST(StreamingProducesParserCache) {
-  const char* chunks[] = {"function foo() { ret", "urn 13; } f", "oo(); ",
-                          nullptr};
-
-  LocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-
-  v8::ScriptCompiler::StreamedSource source(
-      new TestSourceStream(chunks),
-      v8::ScriptCompiler::StreamedSource::ONE_BYTE);
-  v8::ScriptCompiler::ScriptStreamingTask* task =
-      v8::ScriptCompiler::StartStreamingScript(
-          isolate, &source, v8::ScriptCompiler::kProduceParserCache);
-
-  // TestSourceStream::GetMoreData won't block, so it's OK to just run the
-  // task here in the main thread.
-  task->Run();
-  delete task;
-
-  const v8::ScriptCompiler::CachedData* cached_data = source.GetCachedData();
-  CHECK_NOT_NULL(cached_data);
-  CHECK_NOT_NULL(cached_data->data);
-  CHECK(!cached_data->rejected);
-  CHECK_GT(cached_data->length, 0);
-}
-
 
 TEST(StreamingWithDebuggingEnabledLate) {
   // The streaming parser can only parse lazily, i.e. inner functions are not
@@ -25357,13 +25272,11 @@ TEST(CodeCache) {
     v8::ScriptOrigin script_origin(v8_str(origin));
     v8::ScriptCompiler::Source source(source_string, script_origin);
     v8::ScriptCompiler::CompileOptions option =
-        v8::ScriptCompiler::kProduceCodeCache;
-    v8::ScriptCompiler::Compile(context, &source, option).ToLocalChecked();
-    int length = source.GetCachedData()->length;
-    uint8_t* cache_data = new uint8_t[length];
-    memcpy(cache_data, source.GetCachedData()->data, length);
-    cache = new v8::ScriptCompiler::CachedData(
-        cache_data, length, v8::ScriptCompiler::CachedData::BufferOwned);
+        v8::ScriptCompiler::kNoCompileOptions;
+    v8::Local<v8::Script> script =
+        v8::ScriptCompiler::Compile(context, &source, option).ToLocalChecked();
+    cache = v8::ScriptCompiler::CreateCodeCache(script->GetUnboundScript(),
+                                                source_string);
   }
   isolate1->Dispose();
 
@@ -25414,15 +25327,6 @@ void TestInvalidCacheData(v8::ScriptCompiler::CompileOptions option) {
       script->Run(context).ToLocalChecked()->Int32Value(context).FromJust());
 }
 
-TEST(InvalidParserCacheData) {
-  v8::V8::Initialize();
-  v8::HandleScope scope(CcTest::isolate());
-  LocalContext context;
-  if (i::FLAG_lazy) {
-    // Cached parser data is not consumed while parsing eagerly.
-    TestInvalidCacheData(v8::ScriptCompiler::kConsumeParserCache);
-  }
-}
 
 TEST(InvalidCodeCacheData) {
   v8::V8::Initialize();
@@ -25432,67 +25336,6 @@ TEST(InvalidCodeCacheData) {
 }
 
 
-TEST(ParserCacheRejectedGracefully) {
-  // Producing cached parser data while parsing eagerly is not supported.
-  if (!i::FLAG_lazy) return;
-
-  v8::V8::Initialize();
-  v8::HandleScope scope(CcTest::isolate());
-  LocalContext context;
-  // Produce valid cached data.
-  v8::ScriptOrigin origin(v8_str("origin"));
-  v8::Local<v8::String> source_str = v8_str("function foo() {}");
-  v8::ScriptCompiler::Source source(source_str, origin);
-  v8::Local<v8::Script> script =
-      v8::ScriptCompiler::Compile(context.local(), &source,
-                                  v8::ScriptCompiler::kProduceParserCache)
-          .ToLocalChecked();
-  USE(script);
-  const v8::ScriptCompiler::CachedData* original_cached_data =
-      source.GetCachedData();
-  CHECK_NOT_NULL(original_cached_data);
-  CHECK_NOT_NULL(original_cached_data->data);
-  CHECK(!original_cached_data->rejected);
-  CHECK_GT(original_cached_data->length, 0);
-  // Recompiling the same script with it won't reject the data.
-  {
-    v8::ScriptCompiler::Source source_with_cached_data(
-        source_str, origin,
-        new v8::ScriptCompiler::CachedData(original_cached_data->data,
-                                           original_cached_data->length));
-    v8::Local<v8::Script> script =
-        v8::ScriptCompiler::Compile(context.local(), &source_with_cached_data,
-                                    v8::ScriptCompiler::kConsumeParserCache)
-            .ToLocalChecked();
-    USE(script);
-    const v8::ScriptCompiler::CachedData* new_cached_data =
-        source_with_cached_data.GetCachedData();
-    CHECK_NOT_NULL(new_cached_data);
-    CHECK(!new_cached_data->rejected);
-  }
-  // Compile an incompatible script with the cached data. The new script doesn't
-  // have the same starting position for the function as the old one, so the old
-  // cached data will be incompatible with it and will be rejected.
-  {
-    v8::Local<v8::String> incompatible_source_str =
-        v8_str("   function foo() {}");
-    v8::ScriptCompiler::Source source_with_cached_data(
-        incompatible_source_str, origin,
-        new v8::ScriptCompiler::CachedData(original_cached_data->data,
-                                           original_cached_data->length));
-    v8::Local<v8::Script> script =
-        v8::ScriptCompiler::Compile(context.local(), &source_with_cached_data,
-                                    v8::ScriptCompiler::kConsumeParserCache)
-            .ToLocalChecked();
-    USE(script);
-    const v8::ScriptCompiler::CachedData* new_cached_data =
-        source_with_cached_data.GetCachedData();
-    CHECK_NOT_NULL(new_cached_data);
-    CHECK(new_cached_data->rejected);
-  }
-}
-
-
 TEST(StringConcatOverflow) {
   v8::V8::Initialize();
   v8::HandleScope scope(CcTest::isolate());
@@ -25814,6 +25657,123 @@ TEST(ExperimentalExtras) {
   CHECK_EQ(7, result->Int32Value(env.local()).FromJust());
 }
 
+TEST(ExtrasCreatePromise) {
+  i::FLAG_allow_natives_syntax = true;
+  LocalContext context;
+  v8::Isolate* isolate = context->GetIsolate();
+  v8::HandleScope handle_scope(isolate);
+
+  LocalContext env;
+  v8::Local<v8::Object> binding = env->GetExtrasBindingObject();
+
+  auto func = binding->Get(env.local(), v8_str("testCreatePromise"))
+                  .ToLocalChecked()
+                  .As<v8::Function>();
+  CHECK(env->Global()->Set(env.local(), v8_str("func"), func).FromJust());
+
+  auto promise = CompileRun(
+                     "func();\n"
+                     "func();\n"
+                     "%OptimizeFunctionOnNextCall(func);\n"
+                     "func()\n")
+                     .As<v8::Promise>();
+  CHECK_EQ(v8::Promise::kPending, promise->State());
+}
+
+TEST(ExtrasCreatePromiseWithParent) {
+  i::FLAG_allow_natives_syntax = true;
+  LocalContext context;
+  v8::Isolate* isolate = context->GetIsolate();
+  v8::HandleScope handle_scope(isolate);
+
+  LocalContext env;
+  v8::Local<v8::Object> binding = env->GetExtrasBindingObject();
+
+  auto func = binding->Get(env.local(), v8_str("testCreatePromiseWithParent"))
+                  .ToLocalChecked()
+                  .As<v8::Function>();
+  CHECK(env->Global()->Set(env.local(), v8_str("func"), func).FromJust());
+
+  auto promise = CompileRun(
+                     "var parent = new Promise((a, b) => {});\n"
+                     "func(parent);\n"
+                     "func(parent);\n"
+                     "%OptimizeFunctionOnNextCall(func);\n"
+                     "func(parent)\n")
+                     .As<v8::Promise>();
+  CHECK_EQ(v8::Promise::kPending, promise->State());
+}
+
+TEST(ExtrasRejectPromise) {
+  i::FLAG_allow_natives_syntax = true;
+  LocalContext context;
+  v8::Isolate* isolate = context->GetIsolate();
+  v8::HandleScope handle_scope(isolate);
+
+  LocalContext env;
+  v8::Local<v8::Object> binding = env->GetExtrasBindingObject();
+
+  auto func = binding->Get(env.local(), v8_str("testRejectPromise"))
+                  .ToLocalChecked()
+                  .As<v8::Function>();
+  CHECK(env->Global()->Set(env.local(), v8_str("func"), func).FromJust());
+
+  auto rejected_promise = CompileRun(
+                              "function newPromise() {\n"
+                              "  return new Promise((a, b) => {});\n"
+                              "}\n"
+                              "func(newPromise(), 1);\n"
+                              "func(newPromise(), 1);\n"
+                              "%OptimizeFunctionOnNextCall(func);\n"
+                              "var promise = newPromise();\n"
+                              "func(promise, 1);\n"
+                              "promise;\n")
+                              .As<v8::Promise>();
+  CHECK_EQ(v8::Promise::kRejected, rejected_promise->State());
+  CHECK_EQ(1, rejected_promise->Result()->Int32Value(env.local()).FromJust());
+}
+
+TEST(ExtrasResolvePromise) {
+  i::FLAG_allow_natives_syntax = true;
+  LocalContext context;
+  v8::Isolate* isolate = context->GetIsolate();
+  v8::HandleScope handle_scope(isolate);
+
+  LocalContext env;
+  v8::Local<v8::Object> binding = env->GetExtrasBindingObject();
+
+  auto func = binding->Get(env.local(), v8_str("testResolvePromise"))
+                  .ToLocalChecked()
+                  .As<v8::Function>();
+  CHECK(env->Global()->Set(env.local(), v8_str("func"), func).FromJust());
+
+  auto pending_promise = CompileRun(
+                             "function newPromise() {\n"
+                             "  return new Promise((a, b) => {});\n"
+                             "}\n"
+                             "func(newPromise(), newPromise());\n"
+                             "func(newPromise(), newPromise());\n"
+                             "%OptimizeFunctionOnNextCall(func);\n"
+                             "var promise = newPromise();\n"
+                             "func(promise, newPromise());\n"
+                             "promise;\n")
+                             .As<v8::Promise>();
+  CHECK_EQ(v8::Promise::kPending, pending_promise->State());
+
+  auto fulfilled_promise = CompileRun(
+                               "function newPromise() {\n"
+                               "  return new Promise((a, b) => {});\n"
+                               "}\n"
+                               "func(newPromise(), 1);\n"
+                               "func(newPromise(), 1);\n"
+                               "%OptimizeFunctionOnNextCall(func);\n"
+                               "var promise = newPromise();\n"
+                               "func(promise, 1);\n"
+                               "promise;\n")
+                               .As<v8::Promise>();
+  CHECK_EQ(v8::Promise::kFulfilled, fulfilled_promise->State());
+  CHECK_EQ(1, fulfilled_promise->Result()->Int32Value(env.local()).FromJust());
+}
 
 TEST(ExtrasUtilsObject) {
   LocalContext context;
@@ -26922,27 +26882,6 @@ THREADED_TEST(GlobalAccessorInfo) {
   CompileRun("for (var i = 0; i < 10; i++) prop");
 }
 
-UNINITIALIZED_TEST(IncreaseHeapLimitForDebugging) {
-  v8::Isolate::CreateParams create_params;
-  create_params.constraints.set_max_old_space_size(16);
-  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
-  v8::Isolate* isolate = v8::Isolate::New(create_params);
-  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  {
-    size_t limit_before = i_isolate->heap()->MaxOldGenerationSize();
-    CHECK_EQ(16 * i::MB, limit_before);
-    CHECK(!isolate->IsHeapLimitIncreasedForDebugging());
-    isolate->IncreaseHeapLimitForDebugging();
-    CHECK(isolate->IsHeapLimitIncreasedForDebugging());
-    size_t limit_after = i_isolate->heap()->MaxOldGenerationSize();
-    CHECK_EQ(4 * 16 * i::MB, limit_after);
-    isolate->RestoreOriginalHeapLimit();
-    CHECK(!isolate->IsHeapLimitIncreasedForDebugging());
-    CHECK_EQ(limit_before, i_isolate->heap()->MaxOldGenerationSize());
-  }
-  isolate->Dispose();
-}
-
 TEST(DeterministicRandomNumberGeneration) {
   v8::HandleScope scope(CcTest::isolate());
 
@@ -27225,3 +27164,21 @@ TEST(PersistentValueMap) {
           .ToLocalChecked();
   map.Set("key", value);
 }
+
+TEST(WasmStreamingAbort) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope scope(isolate);
+  v8::WasmModuleObjectBuilderStreaming streaming(isolate);
+  streaming.Abort(v8::Object::New(isolate));
+  CHECK_EQ(streaming.GetPromise()->State(), v8::Promise::kRejected);
+}
+
+TEST(WasmStreamingAbortNoReject) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope scope(isolate);
+  v8::WasmModuleObjectBuilderStreaming streaming(isolate);
+  streaming.Abort({});
+  CHECK_EQ(streaming.GetPromise()->State(), v8::Promise::kPending);
+}
diff --git a/deps/v8/test/cctest/test-assembler-arm.cc b/deps/v8/test/cctest/test-assembler-arm.cc
index 10a111c8df9..a5afc1e2f30 100644
--- a/deps/v8/test/cctest/test-assembler-arm.cc
+++ b/deps/v8/test/cctest/test-assembler-arm.cc
@@ -3923,6 +3923,101 @@ TEST(use_scratch_register_scope) {
   CHECK_EQ(*assm.GetScratchRegisterList(), ip.bit());
 }
 
+TEST(use_scratch_vfp_register_scope) {
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  HandleScope scope(isolate);
+
+  Assembler assm(isolate, nullptr, 0);
+
+  VfpRegList orig_scratches = *assm.GetScratchVfpRegisterList();
+
+  if (CpuFeatures::IsSupported(VFP32DREGS)) {
+    CHECK_EQ(orig_scratches, d14.ToVfpRegList() | d15.ToVfpRegList());
+  } else {
+    CHECK_EQ(orig_scratches, d14.ToVfpRegList());
+  }
+
+  // Test each configuration of scratch registers we can have at the same time.
+
+  {
+    UseScratchRegisterScope temps(&assm);
+
+    SwVfpRegister s1_scratch = temps.AcquireS();
+    CHECK_EQ(s1_scratch, s28);
+
+    SwVfpRegister s2_scratch = temps.AcquireS();
+    CHECK_EQ(s2_scratch, s29);
+
+    if (CpuFeatures::IsSupported(VFP32DREGS)) {
+      SwVfpRegister s3_scratch = temps.AcquireS();
+      CHECK_EQ(s3_scratch, s30);
+
+      SwVfpRegister s4_scratch = temps.AcquireS();
+      CHECK_EQ(s4_scratch, s31);
+    }
+  }
+
+  CHECK_EQ(*assm.GetScratchVfpRegisterList(), orig_scratches);
+
+  {
+    UseScratchRegisterScope temps(&assm);
+
+    SwVfpRegister s1_scratch = temps.AcquireS();
+    CHECK_EQ(s1_scratch, s28);
+
+    SwVfpRegister s2_scratch = temps.AcquireS();
+    CHECK_EQ(s2_scratch, s29);
+
+    if (CpuFeatures::IsSupported(VFP32DREGS)) {
+      DwVfpRegister d_scratch = temps.AcquireD();
+      CHECK_EQ(d_scratch, d15);
+    }
+  }
+
+  CHECK_EQ(*assm.GetScratchVfpRegisterList(), orig_scratches);
+
+  {
+    UseScratchRegisterScope temps(&assm);
+
+    DwVfpRegister d_scratch = temps.AcquireD();
+    CHECK_EQ(d_scratch, d14);
+
+    if (CpuFeatures::IsSupported(VFP32DREGS)) {
+      SwVfpRegister s1_scratch = temps.AcquireS();
+      CHECK_EQ(s1_scratch, s30);
+
+      SwVfpRegister s2_scratch = temps.AcquireS();
+      CHECK_EQ(s2_scratch, s31);
+    }
+  }
+
+  CHECK_EQ(*assm.GetScratchVfpRegisterList(), orig_scratches);
+
+  {
+    UseScratchRegisterScope temps(&assm);
+
+    DwVfpRegister d1_scratch = temps.AcquireD();
+    CHECK_EQ(d1_scratch, d14);
+
+    if (CpuFeatures::IsSupported(VFP32DREGS)) {
+      DwVfpRegister d2_scratch = temps.AcquireD();
+      CHECK_EQ(d2_scratch, d15);
+    }
+  }
+
+  CHECK_EQ(*assm.GetScratchVfpRegisterList(), orig_scratches);
+
+  if (CpuFeatures::IsSupported(NEON)) {
+    UseScratchRegisterScope temps(&assm);
+
+    QwNeonRegister q_scratch = temps.AcquireQ();
+    CHECK_EQ(q_scratch, q7);
+  }
+
+  CHECK_EQ(*assm.GetScratchVfpRegisterList(), orig_scratches);
+}
+
 TEST(split_add_immediate) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
diff --git a/deps/v8/test/cctest/test-assembler-arm64.cc b/deps/v8/test/cctest/test-assembler-arm64.cc
index 4fc80201d2a..77fb429d470 100644
--- a/deps/v8/test/cctest/test-assembler-arm64.cc
+++ b/deps/v8/test/cctest/test-assembler-arm64.cc
@@ -182,13 +182,13 @@ static void InitializeVM() {
                       v8::internal::CodeObjectRequired::kYes);   \
   RegisterDump core;
 
-#define RESET()                                                                \
-  __ Reset();                                                                  \
-  /* Reset the machine state (like simulator.ResetState()). */                 \
-  __ Msr(NZCV, xzr);                                                           \
+#define RESET()                                                \
+  MakeAssemblerBufferWritable(buf, allocated);                 \
+  __ Reset();                                                  \
+  /* Reset the machine state (like simulator.ResetState()). */ \
+  __ Msr(NZCV, xzr);                                           \
   __ Msr(FPCR, xzr);
 
-
 #define START_AFTER_RESET()                                                    \
   __ PushCalleeSavedRegisters();
 
@@ -196,13 +196,13 @@ static void InitializeVM() {
   RESET();                                                                     \
   START_AFTER_RESET();
 
-#define RUN()                                                       \
-  MakeAssemblerBufferExecutable(buf, allocated);                    \
-  Assembler::FlushICache(isolate, buf, masm.SizeOfGeneratedCode()); \
-  {                                                                 \
-    void (*test_function)(void);                                    \
-    memcpy(&test_function, &buf, sizeof(buf));                      \
-    test_function();                                                \
+#define RUN()                                              \
+  MakeAssemblerBufferExecutable(buf, allocated);           \
+  Assembler::FlushICache(buf, masm.SizeOfGeneratedCode()); \
+  {                                                        \
+    void (*test_function)(void);                           \
+    memcpy(&test_function, &buf, sizeof(buf));             \
+    test_function();                                       \
   }
 
 #define END()                   \
@@ -251,37 +251,37 @@ TEST(stack_ops) {
   SETUP();
 
   START();
-  // save csp.
-  __ Mov(x29, csp);
+  // save sp.
+  __ Mov(x29, sp);
 
-  // Set the csp to a known value.
+  // Set the sp to a known value.
   __ Mov(x16, 0x1000);
-  __ Mov(csp, x16);
-  __ Mov(x0, csp);
+  __ Mov(sp, x16);
+  __ Mov(x0, sp);
 
-  // Add immediate to the csp, and move the result to a normal register.
-  __ Add(csp, csp, Operand(0x50));
-  __ Mov(x1, csp);
+  // Add immediate to the sp, and move the result to a normal register.
+  __ Add(sp, sp, Operand(0x50));
+  __ Mov(x1, sp);
 
-  // Add extended to the csp, and move the result to a normal register.
+  // Add extended to the sp, and move the result to a normal register.
   __ Mov(x17, 0xFFF);
-  __ Add(csp, csp, Operand(x17, SXTB));
-  __ Mov(x2, csp);
+  __ Add(sp, sp, Operand(x17, SXTB));
+  __ Mov(x2, sp);
 
-  // Create an csp using a logical instruction, and move to normal register.
-  __ Orr(csp, xzr, Operand(0x1FFF));
-  __ Mov(x3, csp);
+  // Create an sp using a logical instruction, and move to normal register.
+  __ Orr(sp, xzr, Operand(0x1FFF));
+  __ Mov(x3, sp);
 
-  // Write wcsp using a logical instruction.
-  __ Orr(wcsp, wzr, Operand(0xFFFFFFF8L));
-  __ Mov(x4, csp);
+  // Write wsp using a logical instruction.
+  __ Orr(wsp, wzr, Operand(0xFFFFFFF8L));
+  __ Mov(x4, sp);
 
-  // Write csp, and read back wcsp.
-  __ Orr(csp, xzr, Operand(0xFFFFFFF8L));
-  __ Mov(w5, wcsp);
+  // Write sp, and read back wsp.
+  __ Orr(sp, xzr, Operand(0xFFFFFFF8L));
+  __ Mov(w5, wsp);
 
-  //  restore csp.
-  __ Mov(csp, x29);
+  //  restore sp.
+  __ Mov(sp, x29);
   END();
 
   RUN();
@@ -839,15 +839,15 @@ TEST(bic) {
   __ Bic(x10, x0, Operand(0x1F));
   __ Bic(x11, x0, Operand(0x100));
 
-  // Test bic into csp when the constant cannot be encoded in the immediate
+  // Test bic into sp when the constant cannot be encoded in the immediate
   // field.
-  // Use x20 to preserve csp. We check for the result via x21 because the
-  // test infrastructure requires that csp be restored to its original value.
-  __ Mov(x20, csp);
+  // Use x20 to preserve sp. We check for the result via x21 because the
+  // test infrastructure requires that sp be restored to its original value.
+  __ Mov(x20, sp);
   __ Mov(x0, 0xFFFFFF);
-  __ Bic(csp, x0, Operand(0xABCDEF));
-  __ Mov(x21, csp);
-  __ Mov(csp, x20);
+  __ Bic(sp, x0, Operand(0xABCDEF));
+  __ Mov(x21, sp);
+  __ Mov(sp, x20);
   END();
 
   RUN();
@@ -6686,13 +6686,23 @@ TEST(ldur_stur) {
   TEARDOWN();
 }
 
+namespace {
+
+void LoadLiteral(MacroAssembler* masm, Register reg, uint64_t imm) {
+  // Since we do not allow non-relocatable entries in the literal pool, we need
+  // to fake a relocation mode that is not NONE here.
+  masm->Ldr(reg, Immediate(imm, RelocInfo::RUNTIME_ENTRY));
+}
+
+}  // namespace
+
 TEST(ldr_pcrel_large_offset) {
   INIT_V8();
   SETUP_SIZE(1 * MB);
 
   START();
 
-  __ Ldr(x1, Immediate(0x1234567890ABCDEFUL));
+  LoadLiteral(&masm, x1, 0x1234567890ABCDEFUL);
 
   {
     v8::internal::PatchingAssembler::BlockPoolsScope scope(&masm);
@@ -6702,7 +6712,7 @@ TEST(ldr_pcrel_large_offset) {
     }
   }
 
-  __ Ldr(x2, Immediate(0x1234567890ABCDEFUL));
+  LoadLiteral(&masm, x2, 0x1234567890ABCDEFUL);
 
   END();
 
@@ -6719,14 +6729,13 @@ TEST(ldr_literal) {
   SETUP();
 
   START();
-  __ Ldr(x2, Immediate(0x1234567890ABCDEFUL));
-  __ Ldr(d13, 1.234);
+  LoadLiteral(&masm, x2, 0x1234567890ABCDEFUL);
+
   END();
 
   RUN();
 
   CHECK_EQUAL_64(0x1234567890ABCDEFUL, x2);
-  CHECK_EQUAL_FP64(1.234, d13);
 
   TEARDOWN();
 }
@@ -6758,8 +6767,8 @@ static void LdrLiteralRangeHelper(int range_, LiteralPoolEmitOption option,
   __ CheckConstPool(true, true);
   CHECK_CONSTANT_POOL_SIZE(0);
 
-  __ Ldr(x0, Immediate(0x1234567890ABCDEFUL));
-  __ Ldr(d0, 1.234);
+  LoadLiteral(&masm, x0, 0x1234567890ABCDEFUL);
+  LoadLiteral(&masm, x1, 0xABCDEF1234567890UL);
   CHECK_CONSTANT_POOL_SIZE(16);
 
   code_size += 2 * kInstructionSize;
@@ -6799,8 +6808,8 @@ static void LdrLiteralRangeHelper(int range_, LiteralPoolEmitOption option,
   CHECK_CONSTANT_POOL_SIZE(0);
 
   // These loads should be after the pool (and will require a new one).
-  __ Ldr(x4, Immediate(0x34567890ABCDEF12UL));
-  __ Ldr(d4, 123.4);
+  LoadLiteral(&masm, x4, 0x34567890ABCDEF12UL);
+  LoadLiteral(&masm, x5, 0xABCDEF0123456789UL);
   CHECK_CONSTANT_POOL_SIZE(16);
   END();
 
@@ -6808,9 +6817,9 @@ static void LdrLiteralRangeHelper(int range_, LiteralPoolEmitOption option,
 
   // Check that the literals loaded correctly.
   CHECK_EQUAL_64(0x1234567890ABCDEFUL, x0);
-  CHECK_EQUAL_FP64(1.234, d0);
+  CHECK_EQUAL_64(0xABCDEF1234567890UL, x1);
   CHECK_EQUAL_64(0x34567890ABCDEF12UL, x4);
-  CHECK_EQUAL_FP64(123.4, d4);
+  CHECK_EQUAL_64(0xABCDEF0123456789UL, x5);
 
   TEARDOWN();
 }
@@ -7158,12 +7167,12 @@ TEST(preshift_immediates) {
   // pre-shifted encodable immediate followed by a post-shift applied to
   // the arithmetic or logical operation.
 
-  // Save csp.
-  __ Mov(x29, csp);
+  // Save sp.
+  __ Mov(x29, sp);
 
   // Set the registers to known values.
   __ Mov(x0, 0x1000);
-  __ Mov(csp, 0x1000);
+  __ Mov(sp, 0x1000);
 
   // Arithmetic ops.
   __ Add(x1, x0, 0x1F7DE);
@@ -7181,21 +7190,21 @@ TEST(preshift_immediates) {
   __ Eor(x11, x0, 0x18001);
 
   // Ops using the stack pointer.
-  __ Add(csp, csp, 0x1F7F0);
-  __ Mov(x12, csp);
-  __ Mov(csp, 0x1000);
+  __ Add(sp, sp, 0x1F7F0);
+  __ Mov(x12, sp);
+  __ Mov(sp, 0x1000);
 
-  __ Adds(x13, csp, 0x1F7F0);
+  __ Adds(x13, sp, 0x1F7F0);
 
-  __ Orr(csp, x0, 0x1F7F0);
-  __ Mov(x14, csp);
-  __ Mov(csp, 0x1000);
+  __ Orr(sp, x0, 0x1F7F0);
+  __ Mov(x14, sp);
+  __ Mov(sp, 0x1000);
 
-  __ Add(csp, csp, 0x10100);
-  __ Mov(x15, csp);
+  __ Add(sp, sp, 0x10100);
+  __ Mov(x15, sp);
 
-  //  Restore csp.
-  __ Mov(csp, x29);
+  //  Restore sp.
+  __ Mov(sp, x29);
   END();
 
   RUN();
@@ -11840,8 +11849,7 @@ TEST(system_msr) {
   TEARDOWN();
 }
 
-
-TEST(system_nop) {
+TEST(system) {
   INIT_V8();
   SETUP();
   RegisterDump before;
@@ -11849,6 +11857,7 @@ TEST(system_nop) {
   START();
   before.Dump(&masm);
   __ Nop();
+  __ Csdb();
   END();
 
   RUN();
@@ -11867,7 +11876,7 @@ TEST(zero_dest) {
 
   START();
   // Preserve the system stack pointer, in case we clobber it.
-  __ Mov(x30, csp);
+  __ Mov(x30, sp);
   // Initialize the other registers used in this test.
   uint64_t literal_base = 0x0100001000100101UL;
   __ Mov(x0, 0);
@@ -11907,12 +11916,12 @@ TEST(zero_dest) {
   __ sub(xzr, x7, xzr);
   __ sub(xzr, xzr, x7);
 
-  // Swap the saved system stack pointer with the real one. If csp was written
+  // Swap the saved system stack pointer with the real one. If sp was written
   // during the test, it will show up in x30. This is done because the test
-  // framework assumes that csp will be valid at the end of the test.
+  // framework assumes that sp will be valid at the end of the test.
   __ Mov(x29, x30);
-  __ Mov(x30, csp);
-  __ Mov(csp, x29);
+  __ Mov(x30, sp);
+  __ Mov(sp, x29);
   // We used x29 as a scratch register, so reset it to make sure it doesn't
   // trigger a test failure.
   __ Add(x29, x28, x1);
@@ -11934,7 +11943,7 @@ TEST(zero_dest_setflags) {
 
   START();
   // Preserve the system stack pointer, in case we clobber it.
-  __ Mov(x30, csp);
+  __ Mov(x30, sp);
   // Initialize the other registers used in this test.
   uint64_t literal_base = 0x0100001000100101UL;
   __ Mov(x0, 0);
@@ -11972,12 +11981,12 @@ TEST(zero_dest_setflags) {
   __ subs(xzr, x3, xzr);
   __ subs(xzr, xzr, x3);
 
-  // Swap the saved system stack pointer with the real one. If csp was written
+  // Swap the saved system stack pointer with the real one. If sp was written
   // during the test, it will show up in x30. This is done because the test
-  // framework assumes that csp will be valid at the end of the test.
+  // framework assumes that sp will be valid at the end of the test.
   __ Mov(x29, x30);
-  __ Mov(x30, csp);
-  __ Mov(csp, x29);
+  __ Mov(x30, sp);
+  __ Mov(sp, x29);
   // We used x29 as a scratch register, so reset it to make sure it doesn't
   // trigger a test failure.
   __ Add(x29, x28, x1);
@@ -12008,15 +12017,15 @@ TEST(register_bit) {
   CHECK(xzr.bit() == (1UL << kZeroRegCode));
 
   // Internal ABI definitions.
-  CHECK(csp.bit() == (1UL << kSPRegInternalCode));
-  CHECK(csp.bit() != xzr.bit());
+  CHECK(sp.bit() == (1UL << kSPRegInternalCode));
+  CHECK(sp.bit() != xzr.bit());
 
   // xn.bit() == wn.bit() at all times, for the same n.
   CHECK(x0.bit() == w0.bit());
   CHECK(x1.bit() == w1.bit());
   CHECK(x10.bit() == w10.bit());
   CHECK(xzr.bit() == wzr.bit());
-  CHECK(csp.bit() == wcsp.bit());
+  CHECK(sp.bit() == wsp.bit());
 }
 
 
@@ -12478,7 +12487,6 @@ static void PushPopFPSimpleHelper(int reg_count, int reg_size,
   uint64_t literal_base = 0x0100001000100101UL;
 
   {
-    CHECK(__ StackPointer().Is(csp));
     int i;
 
     // Initialize the registers, using X registers to load the literal.
@@ -12637,8 +12645,6 @@ static void PushPopMixedMethodsHelper(int reg_size) {
 
   START();
   {
-    CHECK(__ StackPointer().Is(csp));
-
     __ Mov(x[3], literal_base * 3);
     __ Mov(x[2], literal_base * 2);
     __ Mov(x[1], literal_base * 1);
@@ -12681,15 +12687,11 @@ TEST(push_pop_mixed_methods_64) {
   PushPopMixedMethodsHelper(kXRegSizeInBits);
 }
 
-
-TEST(push_pop_csp) {
+TEST(push_pop) {
   INIT_V8();
   SETUP();
 
   START();
-
-  CHECK(csp.Is(__ StackPointer()));
-
   __ Mov(x3, 0x3333333333333333UL);
   __ Mov(x2, 0x2222222222222222UL);
   __ Mov(x1, 0x1111111111111111UL);
@@ -13863,8 +13865,8 @@ TEST(isvalid) {
   CHECK(xzr.IsValid());
   CHECK(wzr.IsValid());
 
-  CHECK(csp.IsValid());
-  CHECK(wcsp.IsValid());
+  CHECK(sp.IsValid());
+  CHECK(wsp.IsValid());
 
   CHECK(d0.IsValid());
   CHECK(s0.IsValid());
@@ -13875,14 +13877,14 @@ TEST(isvalid) {
   CHECK(w0.IsRegister());
   CHECK(xzr.IsRegister());
   CHECK(wzr.IsRegister());
-  CHECK(csp.IsRegister());
-  CHECK(wcsp.IsRegister());
+  CHECK(sp.IsRegister());
+  CHECK(wsp.IsRegister());
   CHECK(!x0.IsVRegister());
   CHECK(!w0.IsVRegister());
   CHECK(!xzr.IsVRegister());
   CHECK(!wzr.IsVRegister());
-  CHECK(!csp.IsVRegister());
-  CHECK(!wcsp.IsVRegister());
+  CHECK(!sp.IsVRegister());
+  CHECK(!wsp.IsVRegister());
 
   CHECK(d0.IsVRegister());
   CHECK(s0.IsVRegister());
@@ -13898,8 +13900,8 @@ TEST(isvalid) {
   CHECK(static_cast<CPURegister>(xzr).IsValid());
   CHECK(static_cast<CPURegister>(wzr).IsValid());
 
-  CHECK(static_cast<CPURegister>(csp).IsValid());
-  CHECK(static_cast<CPURegister>(wcsp).IsValid());
+  CHECK(static_cast<CPURegister>(sp).IsValid());
+  CHECK(static_cast<CPURegister>(wsp).IsValid());
 
   CHECK(static_cast<CPURegister>(d0).IsValid());
   CHECK(static_cast<CPURegister>(s0).IsValid());
@@ -13910,14 +13912,14 @@ TEST(isvalid) {
   CHECK(static_cast<CPURegister>(w0).IsRegister());
   CHECK(static_cast<CPURegister>(xzr).IsRegister());
   CHECK(static_cast<CPURegister>(wzr).IsRegister());
-  CHECK(static_cast<CPURegister>(csp).IsRegister());
-  CHECK(static_cast<CPURegister>(wcsp).IsRegister());
+  CHECK(static_cast<CPURegister>(sp).IsRegister());
+  CHECK(static_cast<CPURegister>(wsp).IsRegister());
   CHECK(!static_cast<CPURegister>(x0).IsVRegister());
   CHECK(!static_cast<CPURegister>(w0).IsVRegister());
   CHECK(!static_cast<CPURegister>(xzr).IsVRegister());
   CHECK(!static_cast<CPURegister>(wzr).IsVRegister());
-  CHECK(!static_cast<CPURegister>(csp).IsVRegister());
-  CHECK(!static_cast<CPURegister>(wcsp).IsVRegister());
+  CHECK(!static_cast<CPURegister>(sp).IsVRegister());
+  CHECK(!static_cast<CPURegister>(wsp).IsVRegister());
 
   CHECK(static_cast<CPURegister>(d0).IsVRegister());
   CHECK(static_cast<CPURegister>(s0).IsVRegister());
@@ -13995,11 +13997,11 @@ TEST(cpureglist_utils_x) {
   CHECK(!test.IncludesAliasOf(x4));
   CHECK(!test.IncludesAliasOf(x30));
   CHECK(!test.IncludesAliasOf(xzr));
-  CHECK(!test.IncludesAliasOf(csp));
+  CHECK(!test.IncludesAliasOf(sp));
   CHECK(!test.IncludesAliasOf(w4));
   CHECK(!test.IncludesAliasOf(w30));
   CHECK(!test.IncludesAliasOf(wzr));
-  CHECK(!test.IncludesAliasOf(wcsp));
+  CHECK(!test.IncludesAliasOf(wsp));
 
   CHECK(!test.IncludesAliasOf(d0));
   CHECK(!test.IncludesAliasOf(d1));
@@ -14059,13 +14061,13 @@ TEST(cpureglist_utils_w) {
   CHECK(!test.IncludesAliasOf(x14));
   CHECK(!test.IncludesAliasOf(x30));
   CHECK(!test.IncludesAliasOf(xzr));
-  CHECK(!test.IncludesAliasOf(csp));
+  CHECK(!test.IncludesAliasOf(sp));
   CHECK(!test.IncludesAliasOf(w0));
   CHECK(!test.IncludesAliasOf(w9));
   CHECK(!test.IncludesAliasOf(w14));
   CHECK(!test.IncludesAliasOf(w30));
   CHECK(!test.IncludesAliasOf(wzr));
-  CHECK(!test.IncludesAliasOf(wcsp));
+  CHECK(!test.IncludesAliasOf(wsp));
 
   CHECK(!test.IncludesAliasOf(d10));
   CHECK(!test.IncludesAliasOf(d11));
@@ -14140,8 +14142,8 @@ TEST(cpureglist_utils_d) {
 
   CHECK(!test.IncludesAliasOf(xzr));
   CHECK(!test.IncludesAliasOf(wzr));
-  CHECK(!test.IncludesAliasOf(csp));
-  CHECK(!test.IncludesAliasOf(wcsp));
+  CHECK(!test.IncludesAliasOf(sp));
+  CHECK(!test.IncludesAliasOf(wsp));
 
   CHECK(!test.IsEmpty());
 
@@ -14238,7 +14240,7 @@ TEST(printf) {
   // Initialize x29 to the value of the stack pointer. We will use x29 as a
   // temporary stack pointer later, and initializing it in this way allows the
   // RegisterDump check to pass.
-  __ Mov(x29, __ StackPointer());
+  __ Mov(x29, sp);
 
   // Test simple integer arguments.
   __ Mov(x0, 1234);
@@ -14288,10 +14290,8 @@ TEST(printf) {
   __ Printf("%g\n", d10);
   __ Printf("%%%%%s%%%c%%\n", x2, w13);
 
-  // Print the stack pointer (csp).
-  CHECK(csp.Is(__ StackPointer()));
-  __ Printf("StackPointer(csp): 0x%016" PRIx64 ", 0x%08" PRIx32 "\n",
-            __ StackPointer(), __ StackPointer().W());
+  // Print the stack pointer.
+  __ Printf("StackPointer(sp): 0x%016" PRIx64 ", 0x%08" PRIx32 "\n", sp, wsp);
 
   // Test with three arguments.
   __ Printf("3=%u, 4=%u, 5=%u\n", x10, x11, x12);
@@ -15089,7 +15089,7 @@ TEST(call_no_relocation) {
   {
     Assembler::BlockConstPoolScope scope(&masm);
     call_start = buf + __ pc_offset();
-    __ Call(buf + function.pos(), RelocInfo::NONE64);
+    __ Call(buf + function.pos(), RelocInfo::NONE);
     return_address = buf + __ pc_offset();
   }
   __ Pop(xzr, lr);
diff --git a/deps/v8/test/cctest/test-assembler-ia32.cc b/deps/v8/test/cctest/test-assembler-ia32.cc
index 5b79ff1fc15..226c512c1d9 100644
--- a/deps/v8/test/cctest/test-assembler-ia32.cc
+++ b/deps/v8/test/cctest/test-assembler-ia32.cc
@@ -220,7 +220,7 @@ TEST(AssemblerIa325) {
   v8::internal::byte buffer[256];
   Assembler assm(isolate, buffer, sizeof buffer);
 
-  __ mov(eax, Operand(reinterpret_cast<intptr_t>(&baz), RelocInfo::NONE32));
+  __ mov(eax, Operand(reinterpret_cast<intptr_t>(&baz), RelocInfo::NONE));
   __ ret(0);
 
   CodeDesc desc;
@@ -521,7 +521,6 @@ TEST(AssemblerIa32SSE) {
     __ mulps(xmm2, xmm1);
     __ subps(xmm2, xmm0);
     __ divps(xmm2, xmm1);
-    __ haddps(xmm1, xmm0);
     __ cvttss2si(eax, xmm2);
     __ ret(0);
   }
@@ -539,6 +538,38 @@ TEST(AssemblerIa32SSE) {
   CHECK_EQ(2, f(1.0, 2.0));
 }
 
+TEST(AssemblerIa32SSE3) {
+  CcTest::InitializeVM();
+  if (!CpuFeatures::IsSupported(SSE3)) return;
+
+  Isolate* isolate = reinterpret_cast<Isolate*>(CcTest::isolate());
+  HandleScope scope(isolate);
+  v8::internal::byte buffer[256];
+  MacroAssembler assm(isolate, buffer, sizeof(buffer),
+                      v8::internal::CodeObjectRequired::kYes);
+  {
+    CpuFeatureScope fscope(&assm, SSE3);
+    __ movss(xmm0, Operand(esp, kPointerSize));
+    __ movss(xmm1, Operand(esp, 2 * kPointerSize));
+    __ shufps(xmm0, xmm0, 0x0);
+    __ shufps(xmm1, xmm1, 0x0);
+    __ haddps(xmm1, xmm0);
+    __ cvttss2si(eax, xmm1);
+    __ ret(0);
+  }
+
+  CodeDesc desc;
+  assm.GetCode(isolate, &desc);
+  Handle<Code> code =
+      isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
+#ifdef OBJECT_PRINT
+  OFStream os(stdout);
+  code->Print(os);
+#endif
+
+  F8 f = FUNCTION_CAST<F8>(code->entry());
+  CHECK_EQ(4, f(1.0, 2.0));
+}
 
 typedef int (*F9)(double x, double y, double z);
 TEST(AssemblerX64FMA_sd) {
diff --git a/deps/v8/test/cctest/test-assembler-mips.cc b/deps/v8/test/cctest/test-assembler-mips.cc
index 1b337f525c0..4d24f49067c 100644
--- a/deps/v8/test/cctest/test-assembler-mips.cc
+++ b/deps/v8/test/cctest/test-assembler-mips.cc
@@ -7261,35 +7261,35 @@ TEST(MSA_fclass) {
   CcTest::InitializeVM();
 
 #define BIT(n) (0x1 << n)
-#define SNAN BIT(0)
-#define QNAN BIT(1)
-#define NEG_INFINITY BIT((2))
-#define NEG_NORMAL BIT(3)
-#define NEG_SUBNORMAL BIT(4)
-#define NEG_ZERO BIT(5)
-#define POS_INFINITY BIT(6)
-#define POS_NORMAL BIT(7)
-#define POS_SUBNORMAL BIT(8)
-#define POS_ZERO BIT(9)
+#define SNAN_BIT BIT(0)
+#define QNAN_BIT BIT(1)
+#define NEG_INFINITY_BIT BIT((2))
+#define NEG_NORMAL_BIT BIT(3)
+#define NEG_SUBNORMAL_BIT BIT(4)
+#define NEG_ZERO_BIT BIT(5)
+#define POS_INFINITY_BIT BIT(6)
+#define POS_NORMAL_BIT BIT(7)
+#define POS_SUBNORMAL_BIT BIT(8)
+#define POS_ZERO_BIT BIT(9)
 
   const float inf_float = std::numeric_limits<float>::infinity();
   const double inf_double = std::numeric_limits<double>::infinity();
 
   const struct TestCaseMsa2RF_F_U tc_s[] = {
-      {1.f, -0.00001, 208e10f, -34.8e-30f, POS_NORMAL, NEG_NORMAL, POS_NORMAL,
-       NEG_NORMAL},
-      {inf_float, -inf_float, 0, -0.f, POS_INFINITY, NEG_INFINITY, POS_ZERO,
-       NEG_ZERO},
-      {3.036e-40f, -6.392e-43f, 1.41e-45f, -1.17e-38f, POS_SUBNORMAL,
-       NEG_SUBNORMAL, POS_SUBNORMAL, NEG_SUBNORMAL}};
+      {1.f, -0.00001, 208e10f, -34.8e-30f, POS_NORMAL_BIT, NEG_NORMAL_BIT,
+       POS_NORMAL_BIT, NEG_NORMAL_BIT},
+      {inf_float, -inf_float, 0, -0.f, POS_INFINITY_BIT, NEG_INFINITY_BIT,
+       POS_ZERO_BIT, NEG_ZERO_BIT},
+      {3.036e-40f, -6.392e-43f, 1.41e-45f, -1.17e-38f, POS_SUBNORMAL_BIT,
+       NEG_SUBNORMAL_BIT, POS_SUBNORMAL_BIT, NEG_SUBNORMAL_BIT}};
 
   const struct TestCaseMsa2RF_D_U tc_d[] = {
-      {1., -0.00000001, POS_NORMAL, NEG_NORMAL},
-      {208e10, -34.8e-300, POS_NORMAL, NEG_NORMAL},
-      {inf_double, -inf_double, POS_INFINITY, NEG_INFINITY},
-      {0, -0., POS_ZERO, NEG_ZERO},
-      {1.036e-308, -6.392e-309, POS_SUBNORMAL, NEG_SUBNORMAL},
-      {1.41e-323, -3.17e208, POS_SUBNORMAL, NEG_NORMAL}};
+      {1., -0.00000001, POS_NORMAL_BIT, NEG_NORMAL_BIT},
+      {208e10, -34.8e-300, POS_NORMAL_BIT, NEG_NORMAL_BIT},
+      {inf_double, -inf_double, POS_INFINITY_BIT, NEG_INFINITY_BIT},
+      {0, -0., POS_ZERO_BIT, NEG_ZERO_BIT},
+      {1.036e-308, -6.392e-309, POS_SUBNORMAL_BIT, NEG_SUBNORMAL_BIT},
+      {1.41e-323, -3.17e208, POS_SUBNORMAL_BIT, NEG_NORMAL_BIT}};
 
   for (size_t i = 0; i < sizeof(tc_s) / sizeof(TestCaseMsa2RF_F_U); ++i) {
     run_msa_2r(reinterpret_cast<const TestCaseMsa2R*>(&tc_s[i]),
@@ -7301,16 +7301,16 @@ TEST(MSA_fclass) {
   }
 
 #undef BIT
-#undef SNAN
-#undef QNAN
-#undef NEG_INFINITY
-#undef NEG_NORMAL
-#undef NEG_SUBNORMAL
-#undef NEG_ZERO
-#undef POS_INFINITY
-#undef POS_NORMAL
-#undef POS_SUBNORMAL
-#undef POS_ZERO
+#undef SNAN_BIT
+#undef QNAN_BIT
+#undef NEG_INFINITY_BIT
+#undef NEG_NORMAL_BIT
+#undef NEG_SUBNORMAL_BIT
+#undef NEG_ZERO_BIT
+#undef POS_INFINITY_BIT
+#undef POS_NORMAL_BIT
+#undef POS_SUBNORMAL_BIT
+#undef POS_ZERO_BIT
 }
 
 struct TestCaseMsa2RF_F_I {
@@ -10335,7 +10335,8 @@ TEST(MSA_fexdo) {
        -inf_float, 0, 0, 0, 0},
       {-0.f, 0.f, 123.567f, -765.321f, -6e-8f, 5.9e-8f, 1e-7f, -1e-20f, 0, 0, 0,
        0},
-      {1e-36f, 1e20f, -1e20f, 2e-20f, 6e-8f, -2.9e-8f, -66505.f, -65504.f}};
+      {1e-36f, 1e20f, -1e20f, 2e-20f, 6e-8f, -2.9e-8f, -66505.f, -65504.f, 0, 0,
+       0, 0}};
 
   const struct TestCaseMsa3RF_D tc_d[] = {
       // ws_lo, ws_hi, wt_lo, wt_hi, wd_lo, wd_hi
diff --git a/deps/v8/test/cctest/test-assembler-mips64.cc b/deps/v8/test/cctest/test-assembler-mips64.cc
index c59f2af2dcc..4627017723b 100644
--- a/deps/v8/test/cctest/test-assembler-mips64.cc
+++ b/deps/v8/test/cctest/test-assembler-mips64.cc
@@ -8191,35 +8191,35 @@ TEST(MSA_fclass) {
   CcTest::InitializeVM();
 
 #define BIT(n) (0x1 << n)
-#define SNAN BIT(0)
-#define QNAN BIT(1)
-#define NEG_INFINITY BIT((2))
-#define NEG_NORMAL BIT(3)
-#define NEG_SUBNORMAL BIT(4)
-#define NEG_ZERO BIT(5)
-#define POS_INFINITY BIT(6)
-#define POS_NORMAL BIT(7)
-#define POS_SUBNORMAL BIT(8)
-#define POS_ZERO BIT(9)
+#define SNAN_BIT BIT(0)
+#define QNAN_BIT BIT(1)
+#define NEG_INFINITY_BIT BIT((2))
+#define NEG_NORMAL_BIT BIT(3)
+#define NEG_SUBNORMAL_BIT BIT(4)
+#define NEG_ZERO_BIT BIT(5)
+#define POS_INFINITY_BIT BIT(6)
+#define POS_NORMAL_BIT BIT(7)
+#define POS_SUBNORMAL_BIT BIT(8)
+#define POS_ZERO_BIT BIT(9)
 
   const float inf_float = std::numeric_limits<float>::infinity();
   const double inf_double = std::numeric_limits<double>::infinity();
 
   const struct TestCaseMsa2RF_F_U tc_s[] = {
-      {1.f, -0.00001, 208e10f, -34.8e-30f, POS_NORMAL, NEG_NORMAL, POS_NORMAL,
-       NEG_NORMAL},
-      {inf_float, -inf_float, 0, -0.f, POS_INFINITY, NEG_INFINITY, POS_ZERO,
-       NEG_ZERO},
-      {3.036e-40f, -6.392e-43f, 1.41e-45f, -1.17e-38f, POS_SUBNORMAL,
-       NEG_SUBNORMAL, POS_SUBNORMAL, NEG_SUBNORMAL}};
+      {1.f, -0.00001, 208e10f, -34.8e-30f, POS_NORMAL_BIT, NEG_NORMAL_BIT,
+       POS_NORMAL_BIT, NEG_NORMAL_BIT},
+      {inf_float, -inf_float, 0, -0.f, POS_INFINITY_BIT, NEG_INFINITY_BIT,
+       POS_ZERO_BIT, NEG_ZERO_BIT},
+      {3.036e-40f, -6.392e-43f, 1.41e-45f, -1.17e-38f, POS_SUBNORMAL_BIT,
+       NEG_SUBNORMAL_BIT, POS_SUBNORMAL_BIT, NEG_SUBNORMAL_BIT}};
 
   const struct TestCaseMsa2RF_D_U tc_d[] = {
-      {1., -0.00000001, POS_NORMAL, NEG_NORMAL},
-      {208e10, -34.8e-300, POS_NORMAL, NEG_NORMAL},
-      {inf_double, -inf_double, POS_INFINITY, NEG_INFINITY},
-      {0, -0., POS_ZERO, NEG_ZERO},
-      {1.036e-308, -6.392e-309, POS_SUBNORMAL, NEG_SUBNORMAL},
-      {1.41e-323, -3.17e208, POS_SUBNORMAL, NEG_NORMAL}};
+      {1., -0.00000001, POS_NORMAL_BIT, NEG_NORMAL_BIT},
+      {208e10, -34.8e-300, POS_NORMAL_BIT, NEG_NORMAL_BIT},
+      {inf_double, -inf_double, POS_INFINITY_BIT, NEG_INFINITY_BIT},
+      {0, -0., POS_ZERO_BIT, NEG_ZERO_BIT},
+      {1.036e-308, -6.392e-309, POS_SUBNORMAL_BIT, NEG_SUBNORMAL_BIT},
+      {1.41e-323, -3.17e208, POS_SUBNORMAL_BIT, NEG_NORMAL_BIT}};
 
   for (size_t i = 0; i < sizeof(tc_s) / sizeof(TestCaseMsa2RF_F_U); ++i) {
     run_msa_2r(reinterpret_cast<const TestCaseMsa2R*>(&tc_s[i]),
@@ -8231,16 +8231,16 @@ TEST(MSA_fclass) {
   }
 
 #undef BIT
-#undef SNAN
-#undef QNAN
-#undef NEG_INFINITY
-#undef NEG_NORMAL
-#undef NEG_SUBNORMAL
-#undef NEG_ZERO
-#undef POS_INFINITY
-#undef POS_NORMAL
-#undef POS_SUBNORMAL
-#undef POS_ZERO
+#undef SNAN_BIT
+#undef QNAN_BIT
+#undef NEG_INFINITY_BIT
+#undef NEG_NORMAL_BIT
+#undef NEG_SUBNORMAL_BIT
+#undef NEG_ZERO_BIT
+#undef POS_INFINITY_BIT
+#undef POS_NORMAL_BIT
+#undef POS_SUBNORMAL_BIT
+#undef POS_ZERO_BIT
 }
 
 struct TestCaseMsa2RF_F_I {
@@ -11265,7 +11265,8 @@ TEST(MSA_fexdo) {
        -inf_float, 0, 0, 0, 0},
       {-0.f, 0.f, 123.567f, -765.321f, -6e-8f, 5.9e-8f, 1e-7f, -1e-20f, 0, 0, 0,
        0},
-      {1e-36f, 1e20f, -1e20f, 2e-20f, 6e-8f, -2.9e-8f, -66505.f, -65504.f}};
+      {1e-36f, 1e20f, -1e20f, 2e-20f, 6e-8f, -2.9e-8f, -66505.f, -65504.f, 0, 0,
+       0, 0}};
 
   const struct TestCaseMsa3RF_D tc_d[] = {
       // ws_lo, ws_hi, wt_lo, wt_hi, wd_lo, wd_hi
diff --git a/deps/v8/test/cctest/test-assembler-s390.cc b/deps/v8/test/cctest/test-assembler-s390.cc
index d6bbe34e744..f120c9c4184 100644
--- a/deps/v8/test/cctest/test-assembler-s390.cc
+++ b/deps/v8/test/cctest/test-assembler-s390.cc
@@ -87,7 +87,7 @@ TEST(1) {
 #endif
 
   __ lr(r3, r2);
-  __ lhi(r2, Operand(0, kRelocInfo_NONEPTR));
+  __ lhi(r2, Operand(0, RelocInfo::NONE));
   __ b(&C);
 
   __ bind(&L);
@@ -95,7 +95,7 @@ TEST(1) {
   __ ahi(r3, Operand(-1 & 0xFFFF));
 
   __ bind(&C);
-  __ cfi(r3, Operand(0, kRelocInfo_NONEPTR));
+  __ cfi(r3, Operand(0, RelocInfo::NONE));
   __ bne(&L);
   __ b(r14);
 
@@ -137,7 +137,7 @@ TEST(2) {
   __ ahi(r3, Operand(-1 & 0xFFFF));
 
   __ bind(&C);
-  __ cfi(r3, Operand(0, kRelocInfo_NONEPTR));
+  __ cfi(r3, Operand(0, RelocInfo::NONE));
   __ bne(&L);
   __ b(r14);
 
diff --git a/deps/v8/test/cctest/test-assembler-x64.cc b/deps/v8/test/cctest/test-assembler-x64.cc
index 043743b40a9..c5313b3167c 100644
--- a/deps/v8/test/cctest/test-assembler-x64.cc
+++ b/deps/v8/test/cctest/test-assembler-x64.cc
@@ -167,21 +167,6 @@ TEST(AssemblerX64CmpbOperation) {
   CHECK_EQ(0, result);
 }
 
-TEST(Regression684407) {
-  CcTest::InitializeVM();
-  size_t allocated;
-  byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
-
-  Address before = masm.pc();
-  __ cmpl(Operand(arg1, 0),
-          Immediate(0, RelocInfo::WASM_FUNCTION_TABLE_SIZE_REFERENCE));
-  Address after = masm.pc();
-  size_t instruction_size = static_cast<size_t>(after - before);
-  // Check that the immediate is not encoded as uint8.
-  CHECK_LT(sizeof(uint32_t), instruction_size);
-}
-
 TEST(AssemblerX64ImulOperation) {
   CcTest::InitializeVM();
   size_t allocated;
@@ -908,7 +893,6 @@ TEST(AssemblerX64SSE) {
     __ subps(xmm2, xmm0);
     __ divps(xmm2, xmm1);
     __ cvttss2si(rax, xmm2);
-    __ haddps(xmm1, xmm0);
     __ ret(0);
   }
 
@@ -925,6 +909,36 @@ TEST(AssemblerX64SSE) {
   CHECK_EQ(2, f(1.0, 2.0));
 }
 
+TEST(AssemblerX64SSE3) {
+  CcTest::InitializeVM();
+  if (!CpuFeatures::IsSupported(SSE3)) return;
+
+  Isolate* isolate = reinterpret_cast<Isolate*>(CcTest::isolate());
+  HandleScope scope(isolate);
+  v8::internal::byte buffer[256];
+  MacroAssembler masm(isolate, buffer, sizeof(buffer),
+                      v8::internal::CodeObjectRequired::kYes);
+  {
+    CpuFeatureScope fscope(&masm, SSE3);
+    __ shufps(xmm0, xmm0, 0x0);  // brocast first argument
+    __ shufps(xmm1, xmm1, 0x0);  // brocast second argument
+    __ haddps(xmm1, xmm0);
+    __ cvttss2si(rax, xmm1);
+    __ ret(0);
+  }
+
+  CodeDesc desc;
+  masm.GetCode(isolate, &desc);
+  Handle<Code> code =
+      isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
+#ifdef OBJECT_PRINT
+  OFStream os(stdout);
+  code->Print(os);
+#endif
+
+  F6 f = FUNCTION_CAST<F6>(code->entry());
+  CHECK_EQ(4, f(1.0, 2.0));
+}
 
 typedef int (*F7)(double x, double y, double z);
 TEST(AssemblerX64FMA_sd) {
diff --git a/deps/v8/test/cctest/test-code-stub-assembler.cc b/deps/v8/test/cctest/test-code-stub-assembler.cc
index 7889a61a777..a6d4d52ecda 100644
--- a/deps/v8/test/cctest/test-code-stub-assembler.cc
+++ b/deps/v8/test/cctest/test-code-stub-assembler.cc
@@ -15,6 +15,7 @@
 #include "src/debug/debug.h"
 #include "src/isolate.h"
 #include "src/objects-inl.h"
+#include "src/objects/promise-inl.h"
 #include "test/cctest/compiler/code-assembler-tester.h"
 #include "test/cctest/compiler/function-tester.h"
 
@@ -212,7 +213,7 @@ TEST(LoadHeapNumberValue) {
   CodeAssemblerTester asm_tester(isolate);
   CodeStubAssembler m(asm_tester.state());
   Handle<HeapNumber> number = isolate->factory()->NewHeapNumber(1234);
-  m.Return(m.SmiFromWord32(m.Signed(
+  m.Return(m.SmiFromInt32(m.Signed(
       m.ChangeFloat64ToUint32(m.LoadHeapNumberValue(m.HeapConstant(number))))));
   FunctionTester ft(asm_tester.GenerateCode());
   MaybeHandle<Object> result = ft.Call();
@@ -224,7 +225,7 @@ TEST(LoadInstanceType) {
   CodeAssemblerTester asm_tester(isolate);
   CodeStubAssembler m(asm_tester.state());
   Handle<HeapObject> undefined = isolate->factory()->undefined_value();
-  m.Return(m.SmiFromWord32(m.LoadInstanceType(m.HeapConstant(undefined))));
+  m.Return(m.SmiFromInt32(m.LoadInstanceType(m.HeapConstant(undefined))));
   FunctionTester ft(asm_tester.GenerateCode());
   MaybeHandle<Object> result = ft.Call();
   CHECK_EQ(InstanceType::ODDBALL_TYPE,
@@ -252,8 +253,8 @@ TEST(JSFunction) {
   Isolate* isolate(CcTest::InitIsolateOnce());
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   CodeStubAssembler m(asm_tester.state());
-  m.Return(m.SmiFromWord32(m.Int32Add(m.SmiToWord32(m.Parameter(1)),
-                                      m.SmiToWord32(m.Parameter(2)))));
+  m.Return(m.SmiFromInt32(
+      m.Int32Add(m.SmiToInt32(m.Parameter(1)), m.SmiToInt32(m.Parameter(2)))));
 
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
 
@@ -268,8 +269,8 @@ TEST(ComputeIntegerHash) {
   const int kNumParams = 2;
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   CodeStubAssembler m(asm_tester.state());
-  m.Return(m.SmiFromWord32(m.ComputeIntegerHash(
-      m.SmiUntag(m.Parameter(0)), m.SmiToWord32(m.Parameter(1)))));
+  m.Return(m.SmiFromInt32(m.ComputeIntegerHash(m.SmiUntag(m.Parameter(0)),
+                                               m.SmiToInt32(m.Parameter(1)))));
 
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
 
@@ -1894,7 +1895,7 @@ class AppendJSArrayCodeStubAssembler : public CodeStubAssembler {
     Return(length);
 
     BIND(&bailout);
-    Return(SmiTag(IntPtrAdd(arg_index, IntPtrConstant(2))));
+    Return(SmiTag(IntPtrAdd(arg_index.value(), IntPtrConstant(2))));
 
     FunctionTester ft(csa_tester->GenerateCode(), kNumParams);
 
@@ -2069,74 +2070,6 @@ TEST(AllocateAndSetJSPromise) {
   CHECK(!js_promise->has_handler());
 }
 
-TEST(AllocatePromiseReactionJobInfo) {
-  Isolate* isolate(CcTest::InitIsolateOnce());
-
-  const int kNumParams = 1;
-  CodeAssemblerTester asm_tester(isolate, kNumParams);
-  CodeStubAssembler m(asm_tester.state());
-  PromiseBuiltinsAssembler p(asm_tester.state());
-
-  Node* const context = m.Parameter(kNumParams + 2);
-  Node* const tasks =
-      m.AllocateFixedArray(PACKED_ELEMENTS, m.IntPtrConstant(1));
-  m.StoreFixedArrayElement(tasks, 0, m.UndefinedConstant());
-  Node* const deferred_promise =
-      m.AllocateFixedArray(PACKED_ELEMENTS, m.IntPtrConstant(1));
-  m.StoreFixedArrayElement(deferred_promise, 0, m.UndefinedConstant());
-  Node* const info = m.AllocatePromiseReactionJobInfo(
-      m.SmiConstant(1), tasks, deferred_promise, m.UndefinedConstant(),
-      m.UndefinedConstant(), context);
-  m.Return(info);
-
-  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
-  Handle<Object> result =
-      ft.Call(isolate->factory()->undefined_value()).ToHandleChecked();
-  CHECK(result->IsPromiseReactionJobInfo());
-  Handle<PromiseReactionJobInfo> promise_info =
-      Handle<PromiseReactionJobInfo>::cast(result);
-  CHECK_EQ(Smi::FromInt(1), promise_info->value());
-  CHECK(promise_info->tasks()->IsFixedArray());
-  CHECK(promise_info->deferred_promise()->IsFixedArray());
-  CHECK(promise_info->deferred_on_resolve()->IsUndefined(isolate));
-  CHECK(promise_info->deferred_on_reject()->IsUndefined(isolate));
-  CHECK(promise_info->context()->IsContext());
-}
-
-TEST(AllocatePromiseResolveThenableJobInfo) {
-  Isolate* isolate(CcTest::InitIsolateOnce());
-
-  const int kNumParams = 1;
-  CodeAssemblerTester asm_tester(isolate, kNumParams);
-  PromiseBuiltinsAssembler p(asm_tester.state());
-
-  Node* const context = p.Parameter(kNumParams + 2);
-  Node* const native_context = p.LoadNativeContext(context);
-  Node* const thenable = p.AllocateAndInitJSPromise(context);
-  Node* const then =
-      p.GetProperty(context, thenable, isolate->factory()->then_string());
-  Node* resolve = nullptr;
-  Node* reject = nullptr;
-  std::tie(resolve, reject) = p.CreatePromiseResolvingFunctions(
-      thenable, p.FalseConstant(), native_context);
-
-  Node* const info = p.AllocatePromiseResolveThenableJobInfo(
-      thenable, then, resolve, reject, context);
-  p.Return(info);
-
-  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
-  Handle<Object> result =
-      ft.Call(isolate->factory()->undefined_value()).ToHandleChecked();
-  CHECK(result->IsPromiseResolveThenableJobInfo());
-  Handle<PromiseResolveThenableJobInfo> promise_info =
-      Handle<PromiseResolveThenableJobInfo>::cast(result);
-  CHECK(promise_info->thenable()->IsJSPromise());
-  CHECK(promise_info->then()->IsJSFunction());
-  CHECK(promise_info->resolve()->IsJSFunction());
-  CHECK(promise_info->reject()->IsJSFunction());
-  CHECK(promise_info->context()->IsContext());
-}
-
 TEST(IsSymbol) {
   Isolate* isolate(CcTest::InitIsolateOnce());
 
@@ -2326,8 +2259,9 @@ TEST(AllocateFunctionWithMapAndContext) {
       m.AllocateAndInitJSPromise(context, m.UndefinedConstant());
   Node* promise_context = m.CreatePromiseResolvingFunctionsContext(
       promise, m.BooleanConstant(false), native_context);
-  Node* resolve_info =
-      m.LoadContextElement(native_context, Context::PROMISE_RESOLVE_SHARED_FUN);
+  Node* resolve_info = m.LoadContextElement(
+      native_context,
+      Context::PROMISE_CAPABILITY_DEFAULT_RESOLVE_SHARED_FUN_INDEX);
   Node* const map = m.LoadContextElement(
       native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
   Node* const resolve =
@@ -2341,10 +2275,12 @@ TEST(AllocateFunctionWithMapAndContext) {
   Handle<JSFunction> fun = Handle<JSFunction>::cast(result_obj);
   CHECK_EQ(isolate->heap()->empty_property_array(), fun->property_array());
   CHECK_EQ(isolate->heap()->empty_fixed_array(), fun->elements());
-  CHECK_EQ(isolate->heap()->undefined_cell(), fun->feedback_vector_cell());
+  CHECK_EQ(isolate->heap()->many_closures_cell(), fun->feedback_cell());
   CHECK(!fun->has_prototype_slot());
-  CHECK_EQ(*isolate->promise_resolve_shared_fun(), fun->shared());
-  CHECK_EQ(isolate->promise_resolve_shared_fun()->code(), fun->code());
+  CHECK_EQ(*isolate->promise_capability_default_resolve_shared_fun(),
+           fun->shared());
+  CHECK_EQ(isolate->promise_capability_default_resolve_shared_fun()->GetCode(),
+           fun->code());
 }
 
 TEST(CreatePromiseGetCapabilitiesExecutorContext) {
@@ -2357,7 +2293,7 @@ TEST(CreatePromiseGetCapabilitiesExecutorContext) {
   Node* const context = m.Parameter(kNumParams + 2);
   Node* const native_context = m.LoadNativeContext(context);
 
-  Node* const map = m.LoadRoot(Heap::kTuple3MapRootIndex);
+  Node* const map = m.LoadRoot(Heap::kPromiseCapabilityMapRootIndex);
   Node* const capability = m.AllocateStruct(map);
   m.StoreObjectFieldNoWriteBarrier(
       capability, PromiseCapability::kPromiseOffset, m.UndefinedConstant());
@@ -2396,8 +2332,10 @@ TEST(NewPromiseCapability) {
     Node* const promise_constructor =
         m.LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
 
+    Node* const debug_event = m.TrueConstant();
     Node* const capability =
-        m.NewPromiseCapability(context, promise_constructor);
+        m.CallBuiltin(Builtins::kNewPromiseCapability, context,
+                      promise_constructor, debug_event);
     m.Return(capability);
 
     FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
@@ -2411,10 +2349,10 @@ TEST(NewPromiseCapability) {
     CHECK(result->promise()->IsJSPromise());
     CHECK(result->resolve()->IsJSFunction());
     CHECK(result->reject()->IsJSFunction());
-    CHECK_EQ(isolate->native_context()->promise_resolve_shared_fun(),
-             JSFunction::cast(result->resolve())->shared());
-    CHECK_EQ(isolate->native_context()->promise_reject_shared_fun(),
+    CHECK_EQ(*isolate->promise_capability_default_reject_shared_fun(),
              JSFunction::cast(result->reject())->shared());
+    CHECK_EQ(*isolate->promise_capability_default_resolve_shared_fun(),
+             JSFunction::cast(result->resolve())->shared());
 
     Handle<JSFunction> callbacks[] = {
         handle(JSFunction::cast(result->resolve())),
@@ -2440,7 +2378,9 @@ TEST(NewPromiseCapability) {
     Node* const context = m.Parameter(kNumParams + 2);
 
     Node* const constructor = m.Parameter(1);
-    Node* const capability = m.NewPromiseCapability(context, constructor);
+    Node* const debug_event = m.TrueConstant();
+    Node* const capability = m.CallBuiltin(Builtins::kNewPromiseCapability,
+                                           context, constructor, debug_event);
     m.Return(capability);
 
     FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
@@ -2672,7 +2612,7 @@ TEST(LoadJSArrayElementsMap) {
     CodeStubAssembler m(asm_tester.state());
     Node* context = m.Parameter(kNumParams + 2);
     Node* native_context = m.LoadNativeContext(context);
-    Node* kind = m.SmiToWord32(m.Parameter(0));
+    Node* kind = m.SmiToInt32(m.Parameter(0));
     m.Return(m.LoadJSArrayElementsMap(kind, native_context));
   }
 
@@ -2731,7 +2671,7 @@ TEST(GotoIfNotWhiteSpaceOrLineTerminator) {
   {  // Returns true if whitespace, false otherwise.
     Label if_not_whitespace(&m);
 
-    m.GotoIfNotWhiteSpaceOrLineTerminator(m.SmiToWord32(m.Parameter(0)),
+    m.GotoIfNotWhiteSpaceOrLineTerminator(m.SmiToInt32(m.Parameter(0)),
                                           &if_not_whitespace);
     m.Return(m.TrueConstant());
 
@@ -2787,7 +2727,8 @@ TEST(IsNumberArrayIndex) {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   {
     CodeStubAssembler m(asm_tester.state());
-    m.Return(m.SmiFromWord32(m.IsNumberArrayIndex(m.Parameter(0))));
+    m.Return(m.SmiFromInt32(
+        m.UncheckedCast<Int32T>(m.IsNumberArrayIndex(m.Parameter(0)))));
   }
 
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
@@ -3149,6 +3090,32 @@ TEST(ExtractFixedArraySimpleIntPtrParameters) {
   CHECK_EQ(double_result->get_scalar(1), 12);
 }
 
+TEST(SingleInputPhiElimination) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  const int kNumParams = 2;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  {
+    CodeStubAssembler m(asm_tester.state());
+    Variable temp1(&m, MachineRepresentation::kTagged);
+    Variable temp2(&m, MachineRepresentation::kTagged);
+    Label temp_label(&m, {&temp1, &temp2});
+    Label end_label(&m, {&temp1, &temp2});
+    temp1.Bind(m.Parameter(1));
+    temp2.Bind(m.Parameter(1));
+    m.Branch(m.WordEqual(m.Parameter(0), m.Parameter(1)), &end_label,
+             &temp_label);
+    temp1.Bind(m.Parameter(2));
+    temp2.Bind(m.Parameter(2));
+    m.BIND(&temp_label);
+    m.Goto(&end_label);
+    m.BIND(&end_label);
+    m.Return(temp1.value());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+  // Generating code without an assert is enough to make sure that the
+  // single-input phi is properly eliminated.
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-code-stubs-arm.cc b/deps/v8/test/cctest/test-code-stubs-arm.cc
index d042ea617b3..b80208668b6 100644
--- a/deps/v8/test/cctest/test-code-stubs-arm.cc
+++ b/deps/v8/test/cctest/test-code-stubs-arm.cc
@@ -116,7 +116,7 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   return (reinterpret_cast<ConvertDToIFunc>(
       reinterpret_cast<intptr_t>(buffer)));
 }
diff --git a/deps/v8/test/cctest/test-code-stubs-arm64.cc b/deps/v8/test/cctest/test-code-stubs-arm64.cc
index 1086bea7ce6..4b725e34e24 100644
--- a/deps/v8/test/cctest/test-code-stubs-arm64.cc
+++ b/deps/v8/test/cctest/test-code-stubs-arm64.cc
@@ -64,7 +64,6 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
   // Save registers make sure they don't get clobbered.
   int source_reg_offset = kDoubleSize;
   int reg_num = 0;
-  queue.Queue(xzr);  // Push xzr to maintain sp alignment.
   for (; reg_num < Register::kNumRegisters; ++reg_num) {
     if (RegisterConfiguration::Default()->IsAllocatableGeneralCode(reg_num)) {
       Register reg = Register::from_code(reg_num);
@@ -129,7 +128,7 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   return (reinterpret_cast<ConvertDToIFunc>(
       reinterpret_cast<intptr_t>(buffer)));
 }
diff --git a/deps/v8/test/cctest/test-code-stubs-mips.cc b/deps/v8/test/cctest/test-code-stubs-mips.cc
index b1df94feedd..4cbe0237301 100644
--- a/deps/v8/test/cctest/test-code-stubs-mips.cc
+++ b/deps/v8/test/cctest/test-code-stubs-mips.cc
@@ -129,7 +129,7 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   return (reinterpret_cast<ConvertDToIFunc>(
       reinterpret_cast<intptr_t>(buffer)));
 }
diff --git a/deps/v8/test/cctest/test-code-stubs-mips64.cc b/deps/v8/test/cctest/test-code-stubs-mips64.cc
index c09dac24eab..e7c393acb05 100644
--- a/deps/v8/test/cctest/test-code-stubs-mips64.cc
+++ b/deps/v8/test/cctest/test-code-stubs-mips64.cc
@@ -126,7 +126,7 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
-  Assembler::FlushICache(isolate, buffer, allocated);
+  Assembler::FlushICache(buffer, allocated);
   return (reinterpret_cast<ConvertDToIFunc>(
       reinterpret_cast<intptr_t>(buffer)));
 }
diff --git a/deps/v8/test/cctest/test-compiler.cc b/deps/v8/test/cctest/test-compiler.cc
index f9195c57fa4..9257c0aa6be 100644
--- a/deps/v8/test/cctest/test-compiler.cc
+++ b/deps/v8/test/cctest/test-compiler.cc
@@ -66,11 +66,9 @@ static Handle<JSFunction> Compile(const char* source) {
       CStrVector(source)).ToHandleChecked();
   Handle<SharedFunctionInfo> shared =
       Compiler::GetSharedFunctionInfoForScript(
-          source_code, MaybeHandle<String>(), 0, 0, v8::ScriptOriginOptions(),
-          MaybeHandle<Object>(), Handle<Context>(isolate->native_context()),
+          source_code, Compiler::ScriptDetails(), v8::ScriptOriginOptions(),
           nullptr, nullptr, v8::ScriptCompiler::kNoCompileOptions,
-          ScriptCompiler::kNoCacheNoReason, NOT_NATIVES_CODE,
-          MaybeHandle<FixedArray>())
+          ScriptCompiler::kNoCacheNoReason, NOT_NATIVES_CODE)
           .ToHandleChecked();
   return isolate->factory()->NewFunctionFromSharedFunctionInfo(
       shared, isolate->native_context());
diff --git a/deps/v8/test/cctest/test-cpu-profiler.cc b/deps/v8/test/cctest/test-cpu-profiler.cc
index cd847893b06..7ae2a90c754 100644
--- a/deps/v8/test/cctest/test-cpu-profiler.cc
+++ b/deps/v8/test/cctest/test-cpu-profiler.cc
@@ -1651,11 +1651,11 @@ TEST(IdleTime) {
       reinterpret_cast<i::CpuProfiler*>(cpu_profiler)->processor();
 
   processor->AddCurrentStack(isolate, true);
-  cpu_profiler->SetIdle(true);
+  isolate->SetIdle(true);
   for (int i = 0; i < 3; i++) {
     processor->AddCurrentStack(isolate, true);
   }
-  cpu_profiler->SetIdle(false);
+  isolate->SetIdle(false);
   processor->AddCurrentStack(isolate, true);
 
   v8::CpuProfile* profile = cpu_profiler->StopProfiling(profile_name);
diff --git a/deps/v8/test/cctest/test-debug.cc b/deps/v8/test/cctest/test-debug.cc
index dd93a7eaf8a..d21ec69fe6c 100644
--- a/deps/v8/test/cctest/test-debug.cc
+++ b/deps/v8/test/cctest/test-debug.cc
@@ -168,140 +168,30 @@ static bool HasBreakInfo(v8::Local<v8::Function> fun) {
 
 // Set a break point in a function with a position relative to function start,
 // and return the associated break point number.
-static int SetBreakPoint(v8::Local<v8::Function> fun, int position) {
+static i::Handle<i::BreakPoint> SetBreakPoint(v8::Local<v8::Function> fun,
+                                              int position,
+                                              const char* condition = nullptr) {
   i::Handle<i::JSFunction> function =
       i::Handle<i::JSFunction>::cast(v8::Utils::OpenHandle(*fun));
-  position += function->shared()->start_position();
-  static int break_point = 0;
-  v8::internal::Isolate* isolate = function->GetIsolate();
-  v8::internal::Debug* debug = isolate->debug();
-  debug->SetBreakPoint(
-      function,
-      Handle<Object>(v8::internal::Smi::FromInt(++break_point), isolate),
-      &position);
+  position += function->shared()->StartPosition();
+  static int break_point_index = 0;
+  i::Isolate* isolate = function->GetIsolate();
+  i::Handle<i::String> condition_string =
+      condition ? isolate->factory()->NewStringFromAsciiChecked(condition)
+                : isolate->factory()->empty_string();
+  i::Debug* debug = isolate->debug();
+  i::Handle<i::BreakPoint> break_point =
+      isolate->factory()->NewBreakPoint(++break_point_index, condition_string);
+
+  debug->SetBreakPoint(function, break_point, &position);
   return break_point;
 }
 
 
-// Set a break point in a function using the Debug object and return the
-// associated break point number.
-static int SetBreakPointFromJS(v8::Isolate* isolate,
-                               const char* function_name,
-                               int line, int position) {
-  EmbeddedVector<char, SMALL_STRING_BUFFER_SIZE> buffer;
-  SNPrintF(buffer,
-           "debug.Debug.setBreakPoint(%s,%d,%d)",
-           function_name, line, position);
-  buffer[SMALL_STRING_BUFFER_SIZE - 1] = '\0';
-  v8::Local<v8::Value> value = CompileRunChecked(isolate, buffer.start());
-  return value->Int32Value(isolate->GetCurrentContext()).FromJust();
-}
-
-
-// Set a break point in a script identified by id using the global Debug object.
-static int SetScriptBreakPointByIdFromJS(v8::Isolate* isolate, int script_id,
-                                         int line, int column) {
-  EmbeddedVector<char, SMALL_STRING_BUFFER_SIZE> buffer;
-  if (column >= 0) {
-    // Column specified set script break point on precise location.
-    SNPrintF(buffer,
-             "debug.Debug.setScriptBreakPointById(%d,%d,%d)",
-             script_id, line, column);
-  } else {
-    // Column not specified set script break point on line.
-    SNPrintF(buffer,
-             "debug.Debug.setScriptBreakPointById(%d,%d)",
-             script_id, line);
-  }
-  buffer[SMALL_STRING_BUFFER_SIZE - 1] = '\0';
-  {
-    v8::TryCatch try_catch(isolate);
-    v8::Local<v8::Value> value = CompileRunChecked(isolate, buffer.start());
-    CHECK(!try_catch.HasCaught());
-    return value->Int32Value(isolate->GetCurrentContext()).FromJust();
-  }
-}
-
-
-// Set a break point in a script identified by name using the global Debug
-// object.
-static int SetScriptBreakPointByNameFromJS(v8::Isolate* isolate,
-                                           const char* script_name, int line,
-                                           int column) {
-  EmbeddedVector<char, SMALL_STRING_BUFFER_SIZE> buffer;
-  if (column >= 0) {
-    // Column specified set script break point on precise location.
-    SNPrintF(buffer,
-             "debug.Debug.setScriptBreakPointByName(\"%s\",%d,%d)",
-             script_name, line, column);
-  } else {
-    // Column not specified set script break point on line.
-    SNPrintF(buffer,
-             "debug.Debug.setScriptBreakPointByName(\"%s\",%d)",
-             script_name, line);
-  }
-  buffer[SMALL_STRING_BUFFER_SIZE - 1] = '\0';
-  {
-    v8::TryCatch try_catch(isolate);
-    v8::Local<v8::Value> value = CompileRunChecked(isolate, buffer.start());
-    CHECK(!try_catch.HasCaught());
-    return value->Int32Value(isolate->GetCurrentContext()).FromJust();
-  }
-}
-
-
-// Clear a break point.
-static void ClearBreakPoint(int break_point) {
+static void ClearBreakPoint(i::Handle<i::BreakPoint> break_point) {
   v8::internal::Isolate* isolate = CcTest::i_isolate();
   v8::internal::Debug* debug = isolate->debug();
-  debug->ClearBreakPoint(
-      Handle<Object>(v8::internal::Smi::FromInt(break_point), isolate));
-}
-
-
-// Clear a break point using the global Debug object.
-static void ClearBreakPointFromJS(v8::Isolate* isolate,
-                                  int break_point_number) {
-  EmbeddedVector<char, SMALL_STRING_BUFFER_SIZE> buffer;
-  SNPrintF(buffer,
-           "debug.Debug.clearBreakPoint(%d)",
-           break_point_number);
-  buffer[SMALL_STRING_BUFFER_SIZE - 1] = '\0';
-  CompileRunChecked(isolate, buffer.start());
-}
-
-
-static void EnableScriptBreakPointFromJS(v8::Isolate* isolate,
-                                         int break_point_number) {
-  EmbeddedVector<char, SMALL_STRING_BUFFER_SIZE> buffer;
-  SNPrintF(buffer,
-           "debug.Debug.enableScriptBreakPoint(%d)",
-           break_point_number);
-  buffer[SMALL_STRING_BUFFER_SIZE - 1] = '\0';
-  CompileRunChecked(isolate, buffer.start());
-}
-
-
-static void DisableScriptBreakPointFromJS(v8::Isolate* isolate,
-                                          int break_point_number) {
-  EmbeddedVector<char, SMALL_STRING_BUFFER_SIZE> buffer;
-  SNPrintF(buffer,
-           "debug.Debug.disableScriptBreakPoint(%d)",
-           break_point_number);
-  buffer[SMALL_STRING_BUFFER_SIZE - 1] = '\0';
-  CompileRunChecked(isolate, buffer.start());
-}
-
-
-static void ChangeScriptBreakPointConditionFromJS(v8::Isolate* isolate,
-                                                  int break_point_number,
-                                                  const char* condition) {
-  EmbeddedVector<char, SMALL_STRING_BUFFER_SIZE> buffer;
-  SNPrintF(buffer,
-           "debug.Debug.changeScriptBreakPointCondition(%d, \"%s\")",
-           break_point_number, condition);
-  buffer[SMALL_STRING_BUFFER_SIZE - 1] = '\0';
-  CompileRunChecked(isolate, buffer.start());
+  debug->ClearBreakPoint(break_point);
 }
 
 
@@ -585,8 +475,6 @@ static void DebugEventBreakPointHitCount(
 int exception_hit_count = 0;
 int uncaught_exception_hit_count = 0;
 int last_js_stack_height = -1;
-v8::Local<v8::Function> debug_event_listener_callback;
-int debug_event_listener_callback_result;
 
 static void DebugEventCounterClear() {
   break_point_hit_count = 0;
@@ -633,16 +521,6 @@ static void DebugEventCounter(
         frame_count->Call(context, exec_state, kArgc, argv).ToLocalChecked();
     last_js_stack_height = result->Int32Value(context).FromJust();
   }
-
-  // Run callback from DebugEventListener and check the result.
-  if (!debug_event_listener_callback.IsEmpty()) {
-    v8::Local<v8::Value> result =
-        debug_event_listener_callback->Call(context, event_data, 0, nullptr)
-            .ToLocalChecked();
-    CHECK(!result.IsEmpty());
-    CHECK_EQ(debug_event_listener_callback_result,
-             result->Int32Value(context).FromJust());
-  }
 }
 
 
@@ -701,7 +579,7 @@ static void DebugEventEvaluate(
 
 
 // This debug event listener removes a breakpoint in a function
-int debug_event_remove_break_point = 0;
+i::Handle<i::BreakPoint> debug_event_remove_break_point;
 static void DebugEventRemoveBreakPoint(
     const v8::Debug::EventDetails& event_details) {
   v8::DebugEvent event = event_details.GetEvent();
@@ -896,12 +774,12 @@ TEST(DebugInfo) {
   CHECK(!HasBreakInfo(bar));
   EnableDebugger(env->GetIsolate());
   // One function (foo) is debugged.
-  int bp1 = SetBreakPoint(foo, 0);
+  i::Handle<i::BreakPoint> bp1 = SetBreakPoint(foo, 0);
   CHECK_EQ(1, v8::internal::GetDebuggedFunctions()->length());
   CHECK(HasBreakInfo(foo));
   CHECK(!HasBreakInfo(bar));
   // Two functions are debugged.
-  int bp2 = SetBreakPoint(bar, 0);
+  i::Handle<i::BreakPoint> bp2 = SetBreakPoint(bar, 0);
   CHECK_EQ(2, v8::internal::GetDebuggedFunctions()->length());
   CHECK(HasBreakInfo(foo));
   CHECK(HasBreakInfo(bar));
@@ -934,7 +812,7 @@ TEST(BreakPointICStore) {
   CHECK_EQ(0, break_point_hit_count);
 
   // Run with breakpoint
-  int bp = SetBreakPoint(foo, 0);
+  i::Handle<i::BreakPoint> bp = SetBreakPoint(foo, 0);
   foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(1, break_point_hit_count);
   foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
@@ -949,6 +827,37 @@ TEST(BreakPointICStore) {
   CheckDebuggerUnloaded();
 }
 
+// Test that a break point can be set at an IC store location.
+TEST(BreakPointCondition) {
+  break_point_hit_count = 0;
+  DebugLocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+
+  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  CompileRun("var a = false");
+  v8::Local<v8::Function> foo =
+      CompileFunction(&env, "function foo() { return 1 }", "foo");
+  // Run without breakpoints.
+  CompileRun("foo()");
+  CHECK_EQ(0, break_point_hit_count);
+
+  // Run with breakpoint
+  i::Handle<i::BreakPoint> bp = SetBreakPoint(foo, 0, "a == true");
+  CompileRun("foo()");
+  CHECK_EQ(0, break_point_hit_count);
+
+  CompileRun("a = true");
+  CompileRun("foo()");
+  CHECK_EQ(1, break_point_hit_count);
+
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("foo()");
+  CHECK_EQ(1, break_point_hit_count);
+
+  SetDebugEventListener(env->GetIsolate(), nullptr);
+  CheckDebuggerUnloaded();
+}
 
 // Test that a break point can be set at an IC load location.
 TEST(BreakPointICLoad) {
@@ -966,7 +875,7 @@ TEST(BreakPointICLoad) {
   CHECK_EQ(0, break_point_hit_count);
 
   // Run with breakpoint.
-  int bp = SetBreakPoint(foo, 0);
+  i::Handle<i::BreakPoint> bp = SetBreakPoint(foo, 0);
   foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(1, break_point_hit_count);
   foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
@@ -997,7 +906,7 @@ TEST(BreakPointICCall) {
   CHECK_EQ(0, break_point_hit_count);
 
   // Run with breakpoint
-  int bp = SetBreakPoint(foo, 0);
+  i::Handle<i::BreakPoint> bp = SetBreakPoint(foo, 0);
   foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(1, break_point_hit_count);
   foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
@@ -1032,7 +941,7 @@ TEST(BreakPointICCallWithGC) {
   CHECK_EQ(0, break_point_hit_count);
 
   // Run with breakpoint.
-  int bp = SetBreakPoint(foo, 0);
+  i::Handle<i::BreakPoint> bp = SetBreakPoint(foo, 0);
   CHECK_EQ(1, foo->Call(context, env->Global(), 0, nullptr)
                   .ToLocalChecked()
                   ->Int32Value(context)
@@ -1073,7 +982,7 @@ TEST(BreakPointConstructCallWithGC) {
   CHECK_EQ(0, break_point_hit_count);
 
   // Run with breakpoint.
-  int bp = SetBreakPoint(foo, 0);
+  i::Handle<i::BreakPoint> bp = SetBreakPoint(foo, 0);
   CHECK_EQ(1, foo->Call(context, env->Global(), 0, nullptr)
                   .ToLocalChecked()
                   ->Int32Value(context)
@@ -1120,7 +1029,7 @@ TEST(BreakPointReturn) {
   CHECK_EQ(0, break_point_hit_count);
 
   // Run with breakpoint
-  int bp = SetBreakPoint(foo, 0);
+  i::Handle<i::BreakPoint> bp = SetBreakPoint(foo, 0);
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(1, break_point_hit_count);
   CHECK_EQ(0, last_source_line);
@@ -1139,851 +1048,976 @@ TEST(BreakPointReturn) {
   CheckDebuggerUnloaded();
 }
 
-
-static void CallWithBreakPoints(v8::Local<v8::Context> context,
-                                v8::Local<v8::Object> recv,
-                                v8::Local<v8::Function> f,
-                                int break_point_count, int call_count) {
-  break_point_hit_count = 0;
-  for (int i = 0; i < call_count; i++) {
-    f->Call(context, recv, 0, nullptr).ToLocalChecked();
-    CHECK_EQ((i + 1) * break_point_count, break_point_hit_count);
-  }
-}
-
-
-// Test GC during break point processing.
-TEST(GCDuringBreakPointProcessing) {
-  break_point_hit_count = 0;
+TEST(BreakPointBuiltin) {
   DebugLocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  v8::Local<v8::Context> context = env.context();
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointCollectGarbage);
-  v8::Local<v8::Function> foo;
+  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
 
-  // Test IC store break point with garbage collection.
-  foo = CompileFunction(&env, "function foo(){bar=0;}", "foo");
-  SetBreakPoint(foo, 0);
-  CallWithBreakPoints(context, env->Global(), foo, 1, 10);
+  v8::Local<v8::Function> builtin;
+  i::Handle<i::BreakPoint> bp;
 
-  // Test IC load break point with garbage collection.
-  foo = CompileFunction(&env, "bar=1;function foo(){var x=bar;}", "foo");
-  SetBreakPoint(foo, 0);
-  CallWithBreakPoints(context, env->Global(), foo, 1, 10);
+  // === Test simple builtin ===
+  break_point_hit_count = 0;
+  builtin = CompileRun("String.prototype.repeat").As<v8::Function>();
 
-  // Test IC call break point with garbage collection.
-  foo = CompileFunction(&env, "function bar(){};function foo(){bar();}", "foo");
-  SetBreakPoint(foo, 0);
-  CallWithBreakPoints(context, env->Global(), foo, 1, 10);
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0);
+  ExpectString("'b'.repeat(10)", "bbbbbbbbbb");
+  CHECK_EQ(1, break_point_hit_count);
 
-  // Test return break point with garbage collection.
-  foo = CompileFunction(&env, "function foo(){}", "foo");
-  SetBreakPoint(foo, 0);
-  CallWithBreakPoints(context, env->Global(), foo, 1, 25);
+  ExpectString("'b'.repeat(10)", "bbbbbbbbbb");
+  CHECK_EQ(2, break_point_hit_count);
 
-  // Test debug break slot break point with garbage collection.
-  foo = CompileFunction(&env, "function foo(){var a;}", "foo");
-  SetBreakPoint(foo, 0);
-  CallWithBreakPoints(context, env->Global(), foo, 1, 25);
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  ExpectString("'b'.repeat(10)", "bbbbbbbbbb");
+  CHECK_EQ(2, break_point_hit_count);
 
   SetDebugEventListener(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
-
-// Call the function three times with different garbage collections in between
-// and make sure that the break point survives.
-static void CallAndGC(v8::Local<v8::Context> context,
-                      v8::Local<v8::Object> recv, v8::Local<v8::Function> f) {
-  break_point_hit_count = 0;
-
-  for (int i = 0; i < 3; i++) {
-    // Call function.
-    f->Call(context, recv, 0, nullptr).ToLocalChecked();
-    CHECK_EQ(1 + i * 3, break_point_hit_count);
-
-    // Scavenge and call function.
-    CcTest::CollectGarbage(v8::internal::NEW_SPACE);
-    f->Call(context, recv, 0, nullptr).ToLocalChecked();
-    CHECK_EQ(2 + i * 3, break_point_hit_count);
-
-    // Mark sweep (and perhaps compact) and call function.
-    CcTest::CollectAllGarbage();
-    f->Call(context, recv, 0, nullptr).ToLocalChecked();
-    CHECK_EQ(3 + i * 3, break_point_hit_count);
-  }
-}
-
-
-// Test that a break point can be set at a return store location.
-TEST(BreakPointSurviveGC) {
-  break_point_hit_count = 0;
+TEST(BreakPointJSBuiltin) {
   DebugLocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  v8::Local<v8::Context> context = env.context();
 
   SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
-  v8::Local<v8::Function> foo;
 
-  // Test IC store break point with garbage collection.
-  {
-    CompileFunction(&env, "function foo(){}", "foo");
-    foo = CompileFunction(&env, "function foo(){bar=0;}", "foo");
-    SetBreakPoint(foo, 0);
-  }
-  CallAndGC(context, env->Global(), foo);
+  v8::Local<v8::Function> builtin;
+  i::Handle<i::BreakPoint> bp;
 
-  // Test IC load break point with garbage collection.
-  {
-    CompileFunction(&env, "function foo(){}", "foo");
-    foo = CompileFunction(&env, "bar=1;function foo(){var x=bar;}", "foo");
-    SetBreakPoint(foo, 0);
-  }
-  CallAndGC(context, env->Global(), foo);
+  // === Test JS builtin ===
+  break_point_hit_count = 0;
+  builtin = CompileRun("Array.prototype.sort").As<v8::Function>();
 
-  // Test IC call break point with garbage collection.
-  {
-    CompileFunction(&env, "function foo(){}", "foo");
-    foo = CompileFunction(&env,
-                          "function bar(){};function foo(){bar();}",
-                          "foo");
-    SetBreakPoint(foo, 0);
-  }
-  CallAndGC(context, env->Global(), foo);
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0);
+  CompileRun("[1,2,3].sort()");
+  CHECK_EQ(1, break_point_hit_count);
 
-  // Test return break point with garbage collection.
-  {
-    CompileFunction(&env, "function foo(){}", "foo");
-    foo = CompileFunction(&env, "function foo(){}", "foo");
-    SetBreakPoint(foo, 0);
-  }
-  CallAndGC(context, env->Global(), foo);
+  CompileRun("[1,2,3].sort()");
+  CHECK_EQ(2, break_point_hit_count);
 
-  // Test non IC break point with garbage collection.
-  {
-    CompileFunction(&env, "function foo(){}", "foo");
-    foo = CompileFunction(&env, "function foo(){var bar=0;}", "foo");
-    SetBreakPoint(foo, 0);
-  }
-  CallAndGC(context, env->Global(), foo);
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("[1,2,3].sort()");
+  CHECK_EQ(2, break_point_hit_count);
 
   SetDebugEventListener(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
-
-// Test that break points can be set using the global Debug object.
-TEST(BreakPointThroughJavaScript) {
-  break_point_hit_count = 0;
+TEST(BreakPointBoundBuiltin) {
   DebugLocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-  v8::Local<v8::Context> context = env.context();
-  env.ExposeDebug();
+  v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(isolate, DebugEventBreakPointHitCount);
-  CompileRunChecked(isolate, "function bar(){}");
-  CompileFunction(isolate, "function foo(){bar();bar();}", "foo");
-  //                        012345678901234567890
-  //                                  1         2
-  // Break points are set at position 3 and 9
-  v8::Local<v8::String> source = v8_str(env->GetIsolate(), "foo()");
-  v8::Local<v8::Script> foo =
-      v8::Script::Compile(context, source).ToLocalChecked();
+  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
 
+  v8::Local<v8::Function> builtin;
+  i::Handle<i::BreakPoint> bp;
+
+  // === Test bound function from a builtin ===
+  break_point_hit_count = 0;
+  builtin = CompileRun(
+                "var boundrepeat = String.prototype.repeat.bind('a');"
+                "String.prototype.repeat")
+                .As<v8::Function>();
+  ExpectString("boundrepeat(10)", "aaaaaaaaaa");
   CHECK_EQ(0, break_point_hit_count);
 
-  // Run with one breakpoint
-  int bp1 = SetBreakPointFromJS(env->GetIsolate(), "foo", 0, 3);
-  foo->Run(context).ToLocalChecked();
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0);
+  ExpectString("boundrepeat(10)", "aaaaaaaaaa");
   CHECK_EQ(1, break_point_hit_count);
-  foo->Run(context).ToLocalChecked();
-  CHECK_EQ(2, break_point_hit_count);
-
-  // Run with two breakpoints
-  int bp2 = SetBreakPointFromJS(env->GetIsolate(), "foo", 0, 9);
-  foo->Run(context).ToLocalChecked();
-  CHECK_EQ(4, break_point_hit_count);
-  foo->Run(context).ToLocalChecked();
-  CHECK_EQ(6, break_point_hit_count);
-
-  // Run with one breakpoint
-  ClearBreakPointFromJS(env->GetIsolate(), bp2);
-  foo->Run(context).ToLocalChecked();
-  CHECK_EQ(7, break_point_hit_count);
-  foo->Run(context).ToLocalChecked();
-  CHECK_EQ(8, break_point_hit_count);
 
   // Run without breakpoints.
-  ClearBreakPointFromJS(env->GetIsolate(), bp1);
-  foo->Run(context).ToLocalChecked();
-  CHECK_EQ(8, break_point_hit_count);
+  ClearBreakPoint(bp);
+  ExpectString("boundrepeat(10)", "aaaaaaaaaa");
+  CHECK_EQ(1, break_point_hit_count);
 
-  SetDebugEventListener(isolate, nullptr);
+  SetDebugEventListener(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
-
-  // Make sure that the break point numbers are consecutive.
-  CHECK_EQ(1, bp1);
-  CHECK_EQ(2, bp2);
 }
 
-
-// Test that break points on scripts identified by name can be set using the
-// global Debug object.
-TEST(ScriptBreakPointByNameThroughJavaScript) {
-  break_point_hit_count = 0;
+TEST(BreakPointConstructorBuiltin) {
   DebugLocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-  v8::Local<v8::Context> context = env.context();
-  env.ExposeDebug();
+  v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(isolate, DebugEventBreakPointHitCount);
+  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
 
-  v8::Local<v8::String> script = v8_str(isolate,
-                                        "function f() {\n"
-                                        "  function h() {\n"
-                                        "    a = 0;  // line 2\n"
-                                        "  }\n"
-                                        "  b = 1;  // line 4\n"
-                                        "  return h();\n"
-                                        "}\n"
-                                        "\n"
-                                        "function g() {\n"
-                                        "  function h() {\n"
-                                        "    a = 0;\n"
-                                        "  }\n"
-                                        "  b = 2;  // line 12\n"
-                                        "  h();\n"
-                                        "  b = 3;  // line 14\n"
-                                        "  f();    // line 15\n"
-                                        "}");
-
-  // Compile the script and get the two functions.
-  v8::ScriptOrigin origin = v8::ScriptOrigin(v8_str(isolate, "test"));
-  v8::Script::Compile(context, script, &origin)
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  v8::Local<v8::Function> f = v8::Local<v8::Function>::Cast(
-      env->Global()->Get(context, v8_str(isolate, "f")).ToLocalChecked());
-  v8::Local<v8::Function> g = v8::Local<v8::Function>::Cast(
-      env->Global()->Get(context, v8_str(isolate, "g")).ToLocalChecked());
+  v8::Local<v8::Function> builtin;
+  i::Handle<i::BreakPoint> bp;
 
-  // Call f and g without break points.
+  // === Test Promise constructor ===
   break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(0, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  builtin = CompileRun("Promise").As<v8::Function>();
+  ExpectString("(new Promise(()=>{})).toString()", "[object Promise]");
   CHECK_EQ(0, break_point_hit_count);
 
-  // Call f and g with break point on line 12.
-  int sbp1 = SetScriptBreakPointByNameFromJS(isolate, "test", 12, 0);
-  break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(0, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0);
+  ExpectString("(new Promise(()=>{})).toString()", "[object Promise]");
+  CHECK_EQ(1, break_point_hit_count);
+
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  ExpectString("(new Promise(()=>{})).toString()", "[object Promise]");
   CHECK_EQ(1, break_point_hit_count);
 
-  // Remove the break point again.
+  // === Test Object constructor ===
   break_point_hit_count = 0;
-  ClearBreakPointFromJS(env->GetIsolate(), sbp1);
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(0, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  builtin = CompileRun("Object").As<v8::Function>();
+  CompileRun("new Object()");
   CHECK_EQ(0, break_point_hit_count);
 
-  // Call f and g with break point on line 2.
-  int sbp2 = SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test", 2, 0);
-  break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0);
+  CompileRun("new Object()");
   CHECK_EQ(1, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(2, break_point_hit_count);
 
-  // Call f and g with break point on line 2, 4, 12, 14 and 15.
-  int sbp3 = SetScriptBreakPointByNameFromJS(isolate, "test", 4, 0);
-  int sbp4 = SetScriptBreakPointByNameFromJS(isolate, "test", 12, 0);
-  int sbp5 = SetScriptBreakPointByNameFromJS(isolate, "test", 14, 0);
-  int sbp6 = SetScriptBreakPointByNameFromJS(isolate, "test", 15, 0);
-  break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(2, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(7, break_point_hit_count);
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("new Object()");
+  CHECK_EQ(1, break_point_hit_count);
 
-  // Remove all the break points again.
+  // === Test Number constructor ===
   break_point_hit_count = 0;
-  ClearBreakPointFromJS(isolate, sbp2);
-  ClearBreakPointFromJS(isolate, sbp3);
-  ClearBreakPointFromJS(isolate, sbp4);
-  ClearBreakPointFromJS(isolate, sbp5);
-  ClearBreakPointFromJS(isolate, sbp6);
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(0, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  builtin = CompileRun("Number").As<v8::Function>();
+  CompileRun("new Number()");
   CHECK_EQ(0, break_point_hit_count);
 
-  SetDebugEventListener(isolate, nullptr);
-  CheckDebuggerUnloaded();
-
-  // Make sure that the break point numbers are consecutive.
-  CHECK_EQ(1, sbp1);
-  CHECK_EQ(2, sbp2);
-  CHECK_EQ(3, sbp3);
-  CHECK_EQ(4, sbp4);
-  CHECK_EQ(5, sbp5);
-  CHECK_EQ(6, sbp6);
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0);
+  CompileRun("new Number()");
+  CHECK_EQ(1, break_point_hit_count);
+
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("new Number()");
+  CHECK_EQ(1, break_point_hit_count);
+
+  SetDebugEventListener(env->GetIsolate(), nullptr);
+  CheckDebuggerUnloaded();
 }
 
+TEST(BreakPointInlinedBuiltin) {
+  i::FLAG_allow_natives_syntax = true;
+  DebugLocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+
+  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+
+  v8::Local<v8::Function> builtin;
+  i::Handle<i::BreakPoint> bp;
 
-TEST(ScriptBreakPointByIdThroughJavaScript) {
+  // === Test inlined builtin ===
   break_point_hit_count = 0;
-  DebugLocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-  v8::Local<v8::Context> context = env.context();
-  env.ExposeDebug();
+  builtin = CompileRun("Math.sin").As<v8::Function>();
+  CompileRun("function test(x) { return 1 + Math.sin(x) }");
+  CompileRun(
+      "test(0.5); test(0.6);"
+      "%OptimizeFunctionOnNextCall(test); test(0.7);");
+  CHECK_EQ(0, break_point_hit_count);
 
-  SetDebugEventListener(isolate, DebugEventBreakPointHitCount);
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0);
+  CompileRun("Math.sin(0.1);");
+  CHECK_EQ(1, break_point_hit_count);
+  CompileRun("test(0.2);");
+  CHECK_EQ(2, break_point_hit_count);
 
-  v8::Local<v8::String> source = v8_str(isolate,
-                                        "function f() {\n"
-                                        "  function h() {\n"
-                                        "    a = 0;  // line 2\n"
-                                        "  }\n"
-                                        "  b = 1;  // line 4\n"
-                                        "  return h();\n"
-                                        "}\n"
-                                        "\n"
-                                        "function g() {\n"
-                                        "  function h() {\n"
-                                        "    a = 0;\n"
-                                        "  }\n"
-                                        "  b = 2;  // line 12\n"
-                                        "  h();\n"
-                                        "  b = 3;  // line 14\n"
-                                        "  f();    // line 15\n"
-                                        "}");
-
-  // Compile the script and get the two functions.
-  v8::ScriptOrigin origin = v8::ScriptOrigin(v8_str(isolate, "test"));
-  v8::Local<v8::Script> script =
-      v8::Script::Compile(context, source, &origin).ToLocalChecked();
-  script->Run(context).ToLocalChecked();
-  v8::Local<v8::Function> f = v8::Local<v8::Function>::Cast(
-      env->Global()->Get(context, v8_str(isolate, "f")).ToLocalChecked());
-  v8::Local<v8::Function> g = v8::Local<v8::Function>::Cast(
-      env->Global()->Get(context, v8_str(isolate, "g")).ToLocalChecked());
+  // Re-optimize.
+  CompileRun("%OptimizeFunctionOnNextCall(test);");
+  ExpectBoolean("test(0.3) < 2", true);
+  CHECK_EQ(3, break_point_hit_count);
 
-  // Get the script id knowing that internally it is a 32 integer.
-  int script_id = script->GetUnboundScript()->GetId();
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("test(0.3);");
+  CHECK_EQ(3, break_point_hit_count);
 
-  // Call f and g without break points.
+  SetDebugEventListener(env->GetIsolate(), nullptr);
+  CheckDebuggerUnloaded();
+}
+
+TEST(BreakPointInlineBoundBuiltin) {
+  i::FLAG_allow_natives_syntax = true;
+  DebugLocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+
+  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+
+  v8::Local<v8::Function> builtin;
+  i::Handle<i::BreakPoint> bp;
+
+  // === Test inlined bound builtin ===
   break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(0, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+
+  builtin = CompileRun(
+                "var boundrepeat = String.prototype.repeat.bind('a');"
+                "String.prototype.repeat")
+                .As<v8::Function>();
+  CompileRun("function test(x) { return 'a' + boundrepeat(x) }");
+  CompileRun(
+      "test(4); test(5);"
+      "%OptimizeFunctionOnNextCall(test); test(6);");
   CHECK_EQ(0, break_point_hit_count);
 
-  // Call f and g with break point on line 12.
-  int sbp1 = SetScriptBreakPointByIdFromJS(env->GetIsolate(), script_id, 12, 0);
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0);
+  CompileRun("'a'.repeat(2);");
+  CHECK_EQ(1, break_point_hit_count);
+  CompileRun("test(7);");
+  CHECK_EQ(2, break_point_hit_count);
+
+  // Re-optimize.
+  CompileRun("%OptimizeFunctionOnNextCall(test);");
+  CompileRun("test(8);");
+  CHECK_EQ(3, break_point_hit_count);
+
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("test(9);");
+  CHECK_EQ(3, break_point_hit_count);
+
+  SetDebugEventListener(env->GetIsolate(), nullptr);
+  CheckDebuggerUnloaded();
+}
+
+TEST(BreakPointInlinedConstructorBuiltin) {
+  i::FLAG_allow_natives_syntax = true;
+  i::FLAG_experimental_inline_promise_constructor = true;
+  DebugLocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+
+  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+
+  v8::Local<v8::Function> builtin;
+  i::Handle<i::BreakPoint> bp;
+
+  // === Test inlined constructor builtin (regular construct builtin) ===
   break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  builtin = CompileRun("Promise").As<v8::Function>();
+  CompileRun("function test(x) { return new Promise(()=>x); }");
+  CompileRun(
+      "test(4); test(5);"
+      "%OptimizeFunctionOnNextCall(test); test(6);");
   CHECK_EQ(0, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0);
+  CompileRun("new Promise(()=>{});");
   CHECK_EQ(1, break_point_hit_count);
+  CompileRun("test(7);");
+  CHECK_EQ(2, break_point_hit_count);
+
+  // Re-optimize.
+  CompileRun("%OptimizeFunctionOnNextCall(test);");
+  CompileRun("test(8);");
+  CHECK_EQ(3, break_point_hit_count);
+
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("test(9);");
+  CHECK_EQ(3, break_point_hit_count);
+
+  SetDebugEventListener(env->GetIsolate(), nullptr);
+  CheckDebuggerUnloaded();
+}
+
+TEST(BreakPointBuiltinConcurrentOpt) {
+  i::FLAG_allow_natives_syntax = true;
+  i::FLAG_block_concurrent_recompilation = true;
+  DebugLocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+
+  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+
+  v8::Local<v8::Function> builtin;
+  i::Handle<i::BreakPoint> bp;
 
-  // Remove the break point again.
+  // === Test concurrent optimization ===
   break_point_hit_count = 0;
-  ClearBreakPointFromJS(env->GetIsolate(), sbp1);
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(0, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  builtin = CompileRun("Math.sin").As<v8::Function>();
+  CompileRun("function test(x) { return 1 + Math.sin(x) }");
+  // Trigger concurrent compile job. It is suspended until unblock.
+  CompileRun(
+      "test(0.5); test(0.6);"
+      "%OptimizeFunctionOnNextCall(test, 'concurrent'); test(0.7);");
   CHECK_EQ(0, break_point_hit_count);
 
-  // Call f and g with break point on line 2.
-  int sbp2 = SetScriptBreakPointByIdFromJS(env->GetIsolate(), script_id, 2, 0);
-  break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0);
+  // Have the concurrent compile job finish now.
+  CompileRun(
+      "%UnblockConcurrentRecompilation();"
+      "%GetOptimizationStatus(test, 'sync');");
+  CompileRun("test(0.2);");
   CHECK_EQ(1, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(2, break_point_hit_count);
 
-  // Call f and g with break point on line 2, 4, 12, 14 and 15.
-  int sbp3 = SetScriptBreakPointByIdFromJS(env->GetIsolate(), script_id, 4, 0);
-  int sbp4 = SetScriptBreakPointByIdFromJS(env->GetIsolate(), script_id, 12, 0);
-  int sbp5 = SetScriptBreakPointByIdFromJS(env->GetIsolate(), script_id, 14, 0);
-  int sbp6 = SetScriptBreakPointByIdFromJS(env->GetIsolate(), script_id, 15, 0);
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("test(0.3);");
+  CHECK_EQ(1, break_point_hit_count);
+
+  SetDebugEventListener(env->GetIsolate(), nullptr);
+  CheckDebuggerUnloaded();
+}
+
+TEST(BreakPointBuiltinTFOperator) {
+  i::FLAG_allow_natives_syntax = true;
+  DebugLocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+
+  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+
+  v8::Local<v8::Function> builtin;
+  i::Handle<i::BreakPoint> bp;
+
+  // === Test builtin represented as operator ===
   break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  builtin = CompileRun("String.prototype.indexOf").As<v8::Function>();
+  CompileRun("function test(x) { return 1 + 'foo'.indexOf(x) }");
+  CompileRun(
+      "test('a'); test('b');"
+      "%OptimizeFunctionOnNextCall(test); test('c');");
+  CHECK_EQ(0, break_point_hit_count);
+
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0);
+  CompileRun("'bar'.indexOf('x');");
+  CHECK_EQ(1, break_point_hit_count);
+  CompileRun("test('d');");
   CHECK_EQ(2, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(7, break_point_hit_count);
 
-  // Remove all the break points again.
+  // Re-optimize.
+  CompileRun("%OptimizeFunctionOnNextCall(test);");
+  CompileRun("test('e');");
+  CHECK_EQ(3, break_point_hit_count);
+
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("test('f');");
+  CHECK_EQ(3, break_point_hit_count);
+
+  SetDebugEventListener(env->GetIsolate(), nullptr);
+  CheckDebuggerUnloaded();
+}
+
+TEST(BreakPointBuiltinNewContext) {
+  DebugLocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+
+  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+
+  v8::Local<v8::Function> builtin;
+  i::Handle<i::BreakPoint> bp;
+
+// === Test builtin from a new context ===
+// This does not work with no-snapshot build.
+#ifdef V8_USE_SNAPSHOT
   break_point_hit_count = 0;
-  ClearBreakPointFromJS(env->GetIsolate(), sbp2);
-  ClearBreakPointFromJS(env->GetIsolate(), sbp3);
-  ClearBreakPointFromJS(env->GetIsolate(), sbp4);
-  ClearBreakPointFromJS(env->GetIsolate(), sbp5);
-  ClearBreakPointFromJS(env->GetIsolate(), sbp6);
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(0, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  builtin = CompileRun("String.prototype.repeat").As<v8::Function>();
+  CompileRun("'a'.repeat(10)");
   CHECK_EQ(0, break_point_hit_count);
+  // Set breakpoint.
+  bp = SetBreakPoint(builtin, 0);
 
-  SetDebugEventListener(isolate, nullptr);
-  CheckDebuggerUnloaded();
+  {
+    // Create and use new context after breakpoint has been set.
+    v8::HandleScope handle_scope(env->GetIsolate());
+    v8::Local<v8::Context> new_context = v8::Context::New(env->GetIsolate());
+    v8::Context::Scope context_scope(new_context);
+
+    // Run with breakpoint.
+    CompileRun("'b'.repeat(10)");
+    CHECK_EQ(1, break_point_hit_count);
+
+    CompileRun("'b'.repeat(10)");
+    CHECK_EQ(2, break_point_hit_count);
 
-  // Make sure that the break point numbers are consecutive.
-  CHECK_EQ(1, sbp1);
-  CHECK_EQ(2, sbp2);
-  CHECK_EQ(3, sbp3);
-  CHECK_EQ(4, sbp4);
-  CHECK_EQ(5, sbp5);
-  CHECK_EQ(6, sbp6);
+    // Run without breakpoints.
+    ClearBreakPoint(bp);
+    CompileRun("'b'.repeat(10)");
+    CHECK_EQ(2, break_point_hit_count);
+  }
+#endif
+
+  SetDebugEventListener(env->GetIsolate(), nullptr);
+  CheckDebuggerUnloaded();
 }
 
+void NoOpFunctionCallback(const v8::FunctionCallbackInfo<v8::Value>& args) {
+  args.GetReturnValue().Set(v8_num(2));
+}
 
-// Test conditional script break points.
-TEST(EnableDisableScriptBreakPoint) {
-  break_point_hit_count = 0;
+TEST(BreakPointApiFunction) {
   DebugLocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-  v8::Local<v8::Context> context = env.context();
-  env.ExposeDebug();
+  v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(isolate, DebugEventBreakPointHitCount);
+  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
 
-  v8::Local<v8::String> script = v8_str(isolate,
-                                        "function f() {\n"
-                                        "  a = 0;  // line 1\n"
-                                        "};");
+  i::Handle<i::BreakPoint> bp;
 
-  // Compile the script and get function f.
-  v8::ScriptOrigin origin = v8::ScriptOrigin(v8_str(isolate, "test"));
-  v8::Script::Compile(context, script, &origin)
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  v8::Local<v8::Function> f = v8::Local<v8::Function>::Cast(
-      env->Global()->Get(context, v8_str(isolate, "f")).ToLocalChecked());
+  v8::Local<v8::FunctionTemplate> function_template =
+      v8::FunctionTemplate::New(env->GetIsolate(), NoOpFunctionCallback);
+
+  v8::Local<v8::Function> function =
+      function_template->GetFunction(env.context()).ToLocalChecked();
 
-  // Set script break point on line 1 (in function f).
-  int sbp = SetScriptBreakPointByNameFromJS(isolate, "test", 1, 0);
+  env->Global()->Set(env.context(), v8_str("f"), function).ToChecked();
 
-  // Call f while enabeling and disabling the script break point.
+  // === Test simple builtin ===
   break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(1, break_point_hit_count);
 
-  DisableScriptBreakPointFromJS(isolate, sbp);
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  // Run with breakpoint.
+  bp = SetBreakPoint(function, 0);
+  ExpectInt32("f()", 2);
   CHECK_EQ(1, break_point_hit_count);
 
-  EnableScriptBreakPointFromJS(isolate, sbp);
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  ExpectInt32("f()", 2);
   CHECK_EQ(2, break_point_hit_count);
 
-  DisableScriptBreakPointFromJS(isolate, sbp);
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  ExpectInt32("f()", 2);
   CHECK_EQ(2, break_point_hit_count);
 
-  SetDebugEventListener(isolate, nullptr);
+  SetDebugEventListener(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
+void GetWrapperCallback(const v8::FunctionCallbackInfo<v8::Value>& args) {
+  args.GetReturnValue().Set(
+      args[0]
+          .As<v8::Object>()
+          ->Get(args.GetIsolate()->GetCurrentContext(), args[1])
+          .ToLocalChecked());
+}
 
-// Test conditional script break points.
-TEST(ConditionalScriptBreakPoint) {
-  break_point_hit_count = 0;
+TEST(BreakPointApiGetter) {
   DebugLocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  env.ExposeDebug();
 
   SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
 
-  v8::Local<v8::String> script = v8_str(env->GetIsolate(),
-                                        "count = 0;\n"
-                                        "function f() {\n"
-                                        "  g(count++);  // line 2\n"
-                                        "};\n"
-                                        "function g(x) {\n"
-                                        "  var a=x;  // line 5\n"
-                                        "};");
+  i::Handle<i::BreakPoint> bp;
 
-  // Compile the script and get function f.
-  v8::Local<v8::Context> context = env.context();
-  v8::ScriptOrigin origin = v8::ScriptOrigin(v8_str(env->GetIsolate(), "test"));
-  v8::Script::Compile(context, script, &origin)
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  v8::Local<v8::Function> f = v8::Local<v8::Function>::Cast(
-      env->Global()
-          ->Get(context, v8_str(env->GetIsolate(), "f"))
-          .ToLocalChecked());
+  v8::Local<v8::FunctionTemplate> function_template =
+      v8::FunctionTemplate::New(env->GetIsolate(), NoOpFunctionCallback);
+  v8::Local<v8::FunctionTemplate> get_template =
+      v8::FunctionTemplate::New(env->GetIsolate(), GetWrapperCallback);
 
-  // Set script break point on line 5 (in function g).
-  int sbp1 = SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test", 5, 0);
+  v8::Local<v8::Function> function =
+      function_template->GetFunction(env.context()).ToLocalChecked();
+  v8::Local<v8::Function> get =
+      get_template->GetFunction(env.context()).ToLocalChecked();
 
-  // Call f with different conditions on the script break point.
-  break_point_hit_count = 0;
-  ChangeScriptBreakPointConditionFromJS(env->GetIsolate(), sbp1, "false");
-  f->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(0, break_point_hit_count);
+  env->Global()->Set(env.context(), v8_str("f"), function).ToChecked();
+  env->Global()->Set(env.context(), v8_str("get_wrapper"), get).ToChecked();
+  CompileRun(
+      "var o = {};"
+      "Object.defineProperty(o, 'f', { get: f, enumerable: true });");
 
-  ChangeScriptBreakPointConditionFromJS(env->GetIsolate(), sbp1, "true");
+  // === Test API builtin as getter ===
   break_point_hit_count = 0;
-  f->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
+
+  // Run with breakpoint.
+  bp = SetBreakPoint(function, 0);
+  CompileRun("get_wrapper(o, 'f')");
   CHECK_EQ(1, break_point_hit_count);
 
-  ChangeScriptBreakPointConditionFromJS(env->GetIsolate(), sbp1, "x % 2 == 0");
-  break_point_hit_count = 0;
-  for (int i = 0; i < 10; i++) {
-    f->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
-  }
-  CHECK_EQ(5, break_point_hit_count);
+  CompileRun("o.f");
+  CHECK_EQ(2, break_point_hit_count);
+
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("get_wrapper(o, 'f', 2)");
+  CHECK_EQ(2, break_point_hit_count);
 
   SetDebugEventListener(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
+void SetWrapperCallback(const v8::FunctionCallbackInfo<v8::Value>& args) {
+  CHECK(args[0]
+            .As<v8::Object>()
+            ->Set(args.GetIsolate()->GetCurrentContext(), args[1], args[2])
+            .FromJust());
+}
 
-// Test when several scripts has the same script data
-TEST(ScriptBreakPointMultiple) {
-  break_point_hit_count = 0;
+TEST(BreakPointApiSetter) {
   DebugLocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  env.ExposeDebug();
 
   SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
 
-  v8::Local<v8::Context> context = env.context();
-  v8::Local<v8::Function> f;
-  v8::Local<v8::String> script_f = v8_str(env->GetIsolate(),
-                                          "function f() {\n"
-                                          "  a = 0;  // line 1\n"
-                                          "}");
+  i::Handle<i::BreakPoint> bp;
 
-  v8::Local<v8::Function> g;
-  v8::Local<v8::String> script_g = v8_str(env->GetIsolate(),
-                                          "function g() {\n"
-                                          "  b = 0;  // line 1\n"
-                                          "}");
+  v8::Local<v8::FunctionTemplate> function_template =
+      v8::FunctionTemplate::New(env->GetIsolate(), NoOpFunctionCallback);
+  v8::Local<v8::FunctionTemplate> set_template =
+      v8::FunctionTemplate::New(env->GetIsolate(), SetWrapperCallback);
 
-  v8::ScriptOrigin origin = v8::ScriptOrigin(v8_str(env->GetIsolate(), "test"));
+  v8::Local<v8::Function> function =
+      function_template->GetFunction(env.context()).ToLocalChecked();
+  v8::Local<v8::Function> set =
+      set_template->GetFunction(env.context()).ToLocalChecked();
 
-  // Compile the scripts with same script data and get the functions.
-  v8::Script::Compile(context, script_f, &origin)
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  f = v8::Local<v8::Function>::Cast(
-      env->Global()
-          ->Get(context, v8_str(env->GetIsolate(), "f"))
-          .ToLocalChecked());
-  v8::Script::Compile(context, script_g, &origin)
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  g = v8::Local<v8::Function>::Cast(
-      env->Global()
-          ->Get(context, v8_str(env->GetIsolate(), "g"))
-          .ToLocalChecked());
+  env->Global()->Set(env.context(), v8_str("f"), function).ToChecked();
+  env->Global()->Set(env.context(), v8_str("set_wrapper"), set).ToChecked();
 
-  int sbp = SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test", 1, 0);
+  CompileRun(
+      "var o = {};"
+      "Object.defineProperty(o, 'f', { set: f, enumerable: true });");
 
-  // Call f and g and check that the script break point is active.
+  // === Test API builtin as setter ===
   break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+
+  // Run with breakpoint.
+  bp = SetBreakPoint(function, 0);
+
+  CompileRun("o.f = 3");
   CHECK_EQ(1, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+
+  CompileRun("set_wrapper(o, 'f', 2)");
   CHECK_EQ(2, break_point_hit_count);
 
-  // Clear the script break point.
-  ClearBreakPointFromJS(env->GetIsolate(), sbp);
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("o.f = 3");
+  CHECK_EQ(2, break_point_hit_count);
 
-  // Call f and g and check that the script break point is no longer active.
+  // === Test API builtin as setter, with condition ===
   break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(0, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+
+  // Run with breakpoint.
+  bp = SetBreakPoint(function, 0, "arguments[0] == 3");
+  CompileRun("set_wrapper(o, 'f', 2)");
   CHECK_EQ(0, break_point_hit_count);
 
-  // Set script break point with the scripts loaded.
-  sbp = SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test", 1, 0);
+  CompileRun("set_wrapper(o, 'f', 3)");
+  CHECK_EQ(1, break_point_hit_count);
+
+  CompileRun("o.f = 3");
+  CHECK_EQ(2, break_point_hit_count);
+
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("set_wrapper(o, 'f', 2)");
+  CHECK_EQ(2, break_point_hit_count);
+
+  SetDebugEventListener(env->GetIsolate(), nullptr);
+  CheckDebuggerUnloaded();
+}
 
-  // Call f and g and check that the script break point is active.
+TEST(BreakPointApiAccessor) {
+  DebugLocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+
+  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+
+  i::Handle<i::BreakPoint> bp;
+
+  // Create 'foo' class, with a hidden property.
+  v8::Local<v8::ObjectTemplate> obj_template =
+      v8::ObjectTemplate::New(env->GetIsolate());
+  v8::Local<v8::FunctionTemplate> accessor_template =
+      v8::FunctionTemplate::New(env->GetIsolate(), NoOpFunctionCallback);
+  obj_template->SetAccessorProperty(v8_str("f"), accessor_template,
+                                    accessor_template);
+  v8::Local<v8::Object> obj =
+      obj_template->NewInstance(env.context()).ToLocalChecked();
+  env->Global()->Set(env.context(), v8_str("o"), obj).ToChecked();
+
+  v8::Local<v8::Function> function =
+      CompileRun("Object.getOwnPropertyDescriptor(o, 'f').set")
+          .As<v8::Function>();
+
+  // === Test API accessor ===
   break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+
+  CompileRun("function get_loop() { for (var i = 0; i < 10; i++) o.f }");
+  CompileRun("function set_loop() { for (var i = 0; i < 10; i++) o.f = 2 }");
+
+  CompileRun("get_loop(); set_loop();");  // Initialize ICs.
+
+  // Run with breakpoint.
+  bp = SetBreakPoint(function, 0);
+
+  CompileRun("o.f = 3");
   CHECK_EQ(1, break_point_hit_count);
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+
+  CompileRun("o.f");
   CHECK_EQ(2, break_point_hit_count);
 
+  CompileRun("for (var i = 0; i < 10; i++) o.f");
+  CHECK_EQ(12, break_point_hit_count);
+
+  CompileRun("get_loop();");
+  CHECK_EQ(22, break_point_hit_count);
+
+  CompileRun("for (var i = 0; i < 10; i++) o.f = 2");
+  CHECK_EQ(32, break_point_hit_count);
+
+  CompileRun("set_loop();");
+  CHECK_EQ(42, break_point_hit_count);
+
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("o.f = 3");
+  CompileRun("o.f");
+  CHECK_EQ(42, break_point_hit_count);
+
   SetDebugEventListener(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
+TEST(BreakPointInlineApiFunction) {
+  i::FLAG_allow_natives_syntax = true;
+  DebugLocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+
+  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+
+  i::Handle<i::BreakPoint> bp;
+
+  v8::Local<v8::FunctionTemplate> function_template =
+      v8::FunctionTemplate::New(env->GetIsolate(), NoOpFunctionCallback);
+
+  v8::Local<v8::Function> function =
+      function_template->GetFunction(env.context()).ToLocalChecked();
 
-// Test the script origin which has both name and line offset.
-TEST(ScriptBreakPointLineOffset) {
+  env->Global()->Set(env.context(), v8_str("f"), function).ToChecked();
+  CompileRun("function g() { return 1 +  f(); }");
+
+  // === Test simple builtin ===
   break_point_hit_count = 0;
+
+  // Run with breakpoint.
+  bp = SetBreakPoint(function, 0);
+  ExpectInt32("g()", 3);
+  CHECK_EQ(1, break_point_hit_count);
+
+  ExpectInt32("g()", 3);
+  CHECK_EQ(2, break_point_hit_count);
+
+  CompileRun("%OptimizeFunctionOnNextCall(g)");
+  ExpectInt32("g()", 3);
+  CHECK_EQ(3, break_point_hit_count);
+
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  ExpectInt32("g()", 3);
+  CHECK_EQ(3, break_point_hit_count);
+
+  SetDebugEventListener(env->GetIsolate(), nullptr);
+  CheckDebuggerUnloaded();
+}
+
+// Test that a break point can be set at a return store location.
+TEST(BreakPointConditionBuiltin) {
+  i::FLAG_allow_natives_syntax = true;
+  i::FLAG_block_concurrent_recompilation = true;
   DebugLocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  env.ExposeDebug();
 
   SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  v8::Local<v8::Function> builtin;
+  i::Handle<i::BreakPoint> bp;
 
-  v8::Local<v8::Context> context = env.context();
-  v8::Local<v8::Function> f;
-  v8::Local<v8::String> script =
-      v8_str(env->GetIsolate(),
-             "function f() {\n"
-             "  a = 0;  // line 8 as this script has line offset 7\n"
-             "  b = 0;  // line 9 as this script has line offset 7\n"
-             "}");
+  // === Test global variable ===
+  break_point_hit_count = 0;
+  builtin = CompileRun("String.prototype.repeat").As<v8::Function>();
+  CompileRun("var condition = false");
+  CompileRun("'a'.repeat(10)");
+  CHECK_EQ(0, break_point_hit_count);
 
-  // Create script origin both name and line offset.
-  v8::ScriptOrigin origin(v8_str(env->GetIsolate(), "test.html"),
-                          v8::Integer::New(env->GetIsolate(), 7));
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0, "condition == true");
+  CompileRun("'b'.repeat(10)");
+  CHECK_EQ(0, break_point_hit_count);
 
-  // Compile the script and get the function.
-  v8::Script::Compile(context, script, &origin)
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
+  CompileRun("condition = true");
+  CompileRun("'b'.repeat(10)");
+  CHECK_EQ(1, break_point_hit_count);
 
-  int sbp1 =
-      SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test.html", 8, 0);
-  int sbp2 =
-      SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test.html", 9, 0);
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("'b'.repeat(10)");
+  CHECK_EQ(1, break_point_hit_count);
 
-  f = v8::Local<v8::Function>::Cast(
-      env->Global()
-          ->Get(context, v8_str(env->GetIsolate(), "f"))
-          .ToLocalChecked());
+  // === Test arguments ===
+  break_point_hit_count = 0;
+  builtin = CompileRun("String.prototype.repeat").As<v8::Function>();
+  CompileRun("function f(x) { return 'a'.repeat(x * 2); }");
+  CHECK_EQ(0, break_point_hit_count);
+
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0, "arguments[0] == 20");
+  ExpectString("f(5)", "aaaaaaaaaa");
+  CHECK_EQ(0, break_point_hit_count);
+
+  ExpectString("f(10)", "aaaaaaaaaaaaaaaaaaaa");
+  CHECK_EQ(1, break_point_hit_count);
+
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  ExpectString("f(10)", "aaaaaaaaaaaaaaaaaaaa");
+  CHECK_EQ(1, break_point_hit_count);
 
-  // Call f and check that the script break point is active.
+  // === Test adapted arguments ===
   break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(2, break_point_hit_count);
+  builtin = CompileRun("String.prototype.repeat").As<v8::Function>();
+  CompileRun("function f(x) { return 'a'.repeat(x * 2, x); }");
+  CHECK_EQ(0, break_point_hit_count);
+
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0,
+                     "arguments[1] == 10 && arguments[2] == undefined");
+  ExpectString("f(5)", "aaaaaaaaaa");
+  CHECK_EQ(0, break_point_hit_count);
+
+  ExpectString("f(10)", "aaaaaaaaaaaaaaaaaaaa");
+  CHECK_EQ(1, break_point_hit_count);
 
-  // Clear the script break points.
-  ClearBreakPointFromJS(env->GetIsolate(), sbp1);
-  ClearBreakPointFromJS(env->GetIsolate(), sbp2);
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  ExpectString("f(10)", "aaaaaaaaaaaaaaaaaaaa");
+  CHECK_EQ(1, break_point_hit_count);
 
-  // Call f and check that no script break points are active.
+  // === Test var-arg builtins ===
   break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  builtin = CompileRun("String.fromCharCode").As<v8::Function>();
+  CompileRun("function f() { return String.fromCharCode(1, 2, 3); }");
+  CHECK_EQ(0, break_point_hit_count);
+
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0, "arguments.length == 3 && arguments[1] == 2");
+  CompileRun("f(1, 2, 3)");
+  CHECK_EQ(1, break_point_hit_count);
+
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("f(1, 2, 3)");
+  CHECK_EQ(1, break_point_hit_count);
+
+  // === Test rest arguments ===
+  break_point_hit_count = 0;
+  builtin = CompileRun("String.fromCharCode").As<v8::Function>();
+  CompileRun("function f(...args) { return String.fromCharCode(...args); }");
+  CHECK_EQ(0, break_point_hit_count);
+
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0, "arguments.length == 3 && arguments[1] == 2");
+  CompileRun("f(1, 2, 3)");
+  CHECK_EQ(1, break_point_hit_count);
+
+  ClearBreakPoint(bp);
+  CompileRun("f(1, 3, 3)");
+  CHECK_EQ(1, break_point_hit_count);
+
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("f(1, 2, 3)");
+  CHECK_EQ(1, break_point_hit_count);
+
+  // === Test receiver ===
+  break_point_hit_count = 0;
+  builtin = CompileRun("String.prototype.repeat").As<v8::Function>();
+  CompileRun("function f(x) { return x.repeat(10); }");
+  CHECK_EQ(0, break_point_hit_count);
+
+  // Run with breakpoint.
+  bp = SetBreakPoint(builtin, 0, "this == 'a'");
+  ExpectString("f('b')", "bbbbbbbbbb");
   CHECK_EQ(0, break_point_hit_count);
 
-  // Set a script break point with the script loaded.
-  sbp1 = SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test.html", 9, 0);
+  ExpectString("f('a')", "aaaaaaaaaa");
+  CHECK_EQ(1, break_point_hit_count);
 
-  // Call f and check that the script break point is active.
-  break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  ExpectString("f('a')", "aaaaaaaaaa");
   CHECK_EQ(1, break_point_hit_count);
 
   SetDebugEventListener(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
-
-// Test script break points set on lines.
-TEST(ScriptBreakPointLine) {
+TEST(BreakPointInlining) {
+  i::FLAG_allow_natives_syntax = true;
+  break_point_hit_count = 0;
   DebugLocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  env.ExposeDebug();
-
-  // Create a function for checking the function when hitting a break point.
-  frame_function_name = CompileFunction(&env,
-                                        frame_function_name_source,
-                                        "frame_function_name");
 
   SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
 
-  v8::Local<v8::Context> context = env.context();
-  v8::Local<v8::Function> f;
-  v8::Local<v8::Function> g;
-  v8::Local<v8::String> script =
-      v8_str(env->GetIsolate(),
-             "a = 0                      // line 0\n"
-             "function f() {\n"
-             "  a = 1;                   // line 2\n"
-             "}\n"
-             " a = 2;                    // line 4\n"
-             "  /* xx */ function g() {  // line 5\n"
-             "    function h() {         // line 6\n"
-             "      a = 3;               // line 7\n"
-             "    }\n"
-             "    h();                   // line 9\n"
-             "    a = 4;                 // line 10\n"
-             "  }\n"
-             " a=5;                      // line 12");
-
-  // Compile the script and get the function.
   break_point_hit_count = 0;
-  v8::ScriptOrigin origin(v8_str(env->GetIsolate(), "test.html"),
-                          v8::Integer::New(env->GetIsolate(), 0));
-  v8::Local<v8::Script> compiled =
-      v8::Script::Compile(context, script, &origin).ToLocalChecked();
-
-  int sbp1 =
-      SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test.html", 0, -1);
-  int sbp2 =
-      SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test.html", 1, -1);
-  int sbp3 =
-      SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test.html", 5, -1);
-
-  compiled->Run(context).ToLocalChecked();
-
-  f = v8::Local<v8::Function>::Cast(
-      env->Global()
-          ->Get(context, v8_str(env->GetIsolate(), "f"))
-          .ToLocalChecked());
-  g = v8::Local<v8::Function>::Cast(
-      env->Global()
-          ->Get(context, v8_str(env->GetIsolate(), "g"))
-          .ToLocalChecked());
+  v8::Local<v8::Function> inlinee =
+      CompileRun("function f(x) { return x*2; } f").As<v8::Function>();
+  CompileRun("function test(x) { return 1 + f(x) }");
+  CompileRun(
+      "test(0.5); test(0.6);"
+      "%OptimizeFunctionOnNextCall(test); test(0.7);");
+  CHECK_EQ(0, break_point_hit_count);
 
-  // Check that a break point was hit when the script was run.
+  // Run with breakpoint.
+  i::Handle<i::BreakPoint> bp = SetBreakPoint(inlinee, 0);
+  CompileRun("f(0.1);");
   CHECK_EQ(1, break_point_hit_count);
-  CHECK_EQ(0, StrLength(last_function_hit));
-
-  // Call f and check that the script break point.
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  CompileRun("test(0.2);");
   CHECK_EQ(2, break_point_hit_count);
-  CHECK_EQ(0, strcmp("f", last_function_hit));
 
-  // Call g and check that the script break point.
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  // Re-optimize.
+  CompileRun("%OptimizeFunctionOnNextCall(test);");
+  CompileRun("test(0.3);");
   CHECK_EQ(3, break_point_hit_count);
-  CHECK_EQ(0, strcmp("g", last_function_hit));
-
-  // Clear the script break point on g and set one on h.
-  ClearBreakPointFromJS(env->GetIsolate(), sbp3);
-  int sbp4 =
-      SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test.html", 6, -1);
-
-  // Call g and check that the script break point in h is hit.
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(4, break_point_hit_count);
-  CHECK_EQ(0, strcmp("h", last_function_hit));
-
-  // Clear break points in f and h. Set a new one in the script between
-  // functions f and g and test that there is no break points in f and g any
-  // more.
-  ClearBreakPointFromJS(env->GetIsolate(), sbp2);
-  ClearBreakPointFromJS(env->GetIsolate(), sbp4);
-  int sbp5 =
-      SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test.html", 4, -1);
-  break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(0, break_point_hit_count);
-
-  // Set a break point in the code after the last function decleration.
-  int sbp6 =
-      SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test.html", 12, -1);
-
-  // Reloading the script should not hit any break points.
-  break_point_hit_count = 0;
-  v8::Script::Compile(context, script, &origin)
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  CHECK_EQ(0, break_point_hit_count);
 
-  ClearBreakPointFromJS(env->GetIsolate(), sbp1);
-  ClearBreakPointFromJS(env->GetIsolate(), sbp5);
-  ClearBreakPointFromJS(env->GetIsolate(), sbp6);
+  // Run without breakpoints.
+  ClearBreakPoint(bp);
+  CompileRun("test(0.3);");
+  CHECK_EQ(3, break_point_hit_count);
 
   SetDebugEventListener(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
+static void CallWithBreakPoints(v8::Local<v8::Context> context,
+                                v8::Local<v8::Object> recv,
+                                v8::Local<v8::Function> f,
+                                int break_point_count, int call_count) {
+  break_point_hit_count = 0;
+  for (int i = 0; i < call_count; i++) {
+    f->Call(context, recv, 0, nullptr).ToLocalChecked();
+    CHECK_EQ((i + 1) * break_point_count, break_point_hit_count);
+  }
+}
+
 
-// Test top level script break points set on lines.
-TEST(ScriptBreakPointLineTopLevel) {
+// Test GC during break point processing.
+TEST(GCDuringBreakPointProcessing) {
+  break_point_hit_count = 0;
   DebugLocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  env.ExposeDebug();
+  v8::Local<v8::Context> context = env.context();
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointCollectGarbage);
+  v8::Local<v8::Function> foo;
 
-  v8::Local<v8::Context> context = env.context();
-  v8::Local<v8::String> script =
-      v8_str(env->GetIsolate(),
-             "function f() {\n"
-             "  a = 1;                   // line 1\n"
-             "}\n"
-             "a = 2;                     // line 3\n");
-  v8::Local<v8::Function> f;
-  {
-    v8::HandleScope scope(env->GetIsolate());
-    CompileRunWithOrigin(script, "test.html");
-  }
-  f = v8::Local<v8::Function>::Cast(
-      env->Global()
-          ->Get(context, v8_str(env->GetIsolate(), "f"))
-          .ToLocalChecked());
+  // Test IC store break point with garbage collection.
+  foo = CompileFunction(&env, "function foo(){bar=0;}", "foo");
+  SetBreakPoint(foo, 0);
+  CallWithBreakPoints(context, env->Global(), foo, 1, 10);
 
-  CcTest::CollectAllGarbage();
+  // Test IC load break point with garbage collection.
+  foo = CompileFunction(&env, "bar=1;function foo(){var x=bar;}", "foo");
+  SetBreakPoint(foo, 0);
+  CallWithBreakPoints(context, env->Global(), foo, 1, 10);
 
-  SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test.html", 3, -1);
+  // Test IC call break point with garbage collection.
+  foo = CompileFunction(&env, "function bar(){};function foo(){bar();}", "foo");
+  SetBreakPoint(foo, 0);
+  CallWithBreakPoints(context, env->Global(), foo, 1, 10);
 
-  // Call f and check that there was no break points.
-  break_point_hit_count = 0;
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(0, break_point_hit_count);
+  // Test return break point with garbage collection.
+  foo = CompileFunction(&env, "function foo(){}", "foo");
+  SetBreakPoint(foo, 0);
+  CallWithBreakPoints(context, env->Global(), foo, 1, 25);
 
-  // Recompile and run script and check that break point was not reapplied.
-  break_point_hit_count = 0;
-  CompileRunWithOrigin(script, "test.html");
-  CHECK_EQ(0, break_point_hit_count);
+  // Test debug break slot break point with garbage collection.
+  foo = CompileFunction(&env, "function foo(){var a;}", "foo");
+  SetBreakPoint(foo, 0);
+  CallWithBreakPoints(context, env->Global(), foo, 1, 25);
 
   SetDebugEventListener(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
-// Test that it is possible to add and remove break points in a top level
-// function which has no references but has not been collected yet.
-TEST(ScriptBreakPointTopLevelCrash) {
+// Call the function three times with different garbage collections in between
+// and make sure that the break point survives.
+static void CallAndGC(v8::Local<v8::Context> context,
+                      v8::Local<v8::Object> recv, v8::Local<v8::Function> f) {
+  break_point_hit_count = 0;
+
+  for (int i = 0; i < 3; i++) {
+    // Call function.
+    f->Call(context, recv, 0, nullptr).ToLocalChecked();
+    CHECK_EQ(1 + i * 3, break_point_hit_count);
+
+    // Scavenge and call function.
+    CcTest::CollectGarbage(v8::internal::NEW_SPACE);
+    f->Call(context, recv, 0, nullptr).ToLocalChecked();
+    CHECK_EQ(2 + i * 3, break_point_hit_count);
+
+    // Mark sweep (and perhaps compact) and call function.
+    CcTest::CollectAllGarbage();
+    f->Call(context, recv, 0, nullptr).ToLocalChecked();
+    CHECK_EQ(3 + i * 3, break_point_hit_count);
+  }
+}
+
+
+// Test that a break point can be set at a return store location.
+TEST(BreakPointSurviveGC) {
+  break_point_hit_count = 0;
   DebugLocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  env.ExposeDebug();
+  v8::Local<v8::Context> context = env.context();
 
   SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  v8::Local<v8::Function> foo;
 
-  CompileRunWithOrigin(
-      "function f() {\n"
-      "  return 0;\n"
-      "}\n",
-      "test.html");
-  int sbp1 =
-      SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test.html", 1, -1);
-  break_point_hit_count = 0;
+  // Test IC store break point with garbage collection.
+  {
+    CompileFunction(&env, "function foo(){}", "foo");
+    foo = CompileFunction(&env, "function foo(){bar=0;}", "foo");
+    SetBreakPoint(foo, 0);
+  }
+  CallAndGC(context, env->Global(), foo);
 
-  CompileRun("f();");
+  // Test IC load break point with garbage collection.
+  {
+    CompileFunction(&env, "function foo(){}", "foo");
+    foo = CompileFunction(&env, "bar=1;function foo(){var x=bar;}", "foo");
+    SetBreakPoint(foo, 0);
+  }
+  CallAndGC(context, env->Global(), foo);
 
-  CHECK_EQ(1, break_point_hit_count);
+  // Test IC call break point with garbage collection.
+  {
+    CompileFunction(&env, "function foo(){}", "foo");
+    foo = CompileFunction(&env,
+                          "function bar(){};function foo(){bar();}",
+                          "foo");
+    SetBreakPoint(foo, 0);
+  }
+  CallAndGC(context, env->Global(), foo);
+
+  // Test return break point with garbage collection.
+  {
+    CompileFunction(&env, "function foo(){}", "foo");
+    foo = CompileFunction(&env, "function foo(){}", "foo");
+    SetBreakPoint(foo, 0);
+  }
+  CallAndGC(context, env->Global(), foo);
 
-  int sbp2 =
-      SetScriptBreakPointByNameFromJS(env->GetIsolate(), "test.html", 3, -1);
-  ClearBreakPointFromJS(env->GetIsolate(), sbp1);
-  ClearBreakPointFromJS(env->GetIsolate(), sbp2);
+  // Test non IC break point with garbage collection.
+  {
+    CompileFunction(&env, "function foo(){}", "foo");
+    foo = CompileFunction(&env, "function foo(){var bar=0;}", "foo");
+    SetBreakPoint(foo, 0);
+  }
+  CallAndGC(context, env->Global(), foo);
 
   SetDebugEventListener(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
+
 // Test that it is possible to remove the last break point for a function
 // inside the break handling of that break point.
 TEST(RemoveBreakPointInBreak) {
@@ -2072,7 +2106,7 @@ TEST(DebuggerStatementBreakpoint) {
     foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
     CHECK_EQ(1, break_point_hit_count);
 
-    int bp = SetBreakPoint(foo, 0);
+    i::Handle<i::BreakPoint> bp = SetBreakPoint(foo, 0);
 
     // Set breakpoint does not duplicate hits
     foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
@@ -2134,7 +2168,7 @@ TEST(DebugEvaluate) {
       v8_str(env->GetIsolate(), "Hello, world!")};
 
   // Call foo with breakpoint set before a=x and undefined as parameter.
-  int bp = SetBreakPoint(foo, foo_break_position_1);
+  i::Handle<i::BreakPoint> bp = SetBreakPoint(foo, foo_break_position_1);
   checks = checks_uu;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
 
@@ -2189,7 +2223,6 @@ TEST(DebugEvaluate) {
     "    y=0; /* To ensure break location.*/"
     "    a=x;"
     "  };"
-    "  debug.Debug.clearAllBreakPoints();"
     "  barbar();"
     "  y=0;a=x;"
     "}",
@@ -2248,79 +2281,13 @@ TEST(ConditionalBreakpointWithCodeGenerationDisallowed) {
     "foo");
 
   // Set conditional breakpoint with condition 'true'.
-  CompileRun("debug.Debug.setBreakPoint(foo, 2, 0, 'true')");
-
-  debugEventCount = 0;
-  env->AllowCodeGenerationFromStrings(false);
-  foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(1, debugEventCount);
-
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CheckDebuggerUnloaded();
-}
+  SetBreakPoint(foo, 4, "true");
 
-
-bool checkedDebugEvals = true;
-v8::Local<v8::Function> checkGlobalEvalFunction;
-v8::Local<v8::Function> checkFrameEvalFunction;
-static void CheckDebugEval(const v8::Debug::EventDetails& eventDetails) {
-  if (eventDetails.GetEvent() == v8::Break) {
-    ++debugEventCount;
-    v8::HandleScope handleScope(CcTest::isolate());
-
-    v8::Local<v8::Value> args[] = {eventDetails.GetExecutionState()};
-    CHECK(
-        checkGlobalEvalFunction->Call(eventDetails.GetEventContext(),
-                                      eventDetails.GetEventContext()->Global(),
-                                      1, args)
-            .ToLocalChecked()
-            ->IsTrue());
-    CHECK(checkFrameEvalFunction->Call(eventDetails.GetEventContext(),
-                                       eventDetails.GetEventContext()->Global(),
-                                       1, args)
-              .ToLocalChecked()
-              ->IsTrue());
-  }
-}
-
-
-// Test that the evaluation of expressions when a break point is hit generates
-// the correct results in case code generation from strings is disallowed in the
-// debugee context.
-TEST(DebugEvaluateWithCodeGenerationDisallowed) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-  env.ExposeDebug();
-
-  SetDebugEventListener(env->GetIsolate(), CheckDebugEval);
-
-  v8::Local<v8::Context> context = env.context();
-  v8::Local<v8::Function> foo = CompileFunction(&env,
-    "var global = 'Global';\n"
-    "function foo(x) {\n"
-    "  var local = 'Local';\n"
-    "  debugger;\n"
-    "  return local + x;\n"
-    "}",
-    "foo");
-  checkGlobalEvalFunction = CompileFunction(&env,
-    "function checkGlobalEval(exec_state) {\n"
-    "  return exec_state.evaluateGlobal('global').value() === 'Global';\n"
-    "}",
-    "checkGlobalEval");
-
-  checkFrameEvalFunction = CompileFunction(&env,
-    "function checkFrameEval(exec_state) {\n"
-    "  return exec_state.frame(0).evaluate('local').value() === 'Local';\n"
-    "}",
-    "checkFrameEval");
   debugEventCount = 0;
   env->AllowCodeGenerationFromStrings(false);
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(1, debugEventCount);
 
-  checkGlobalEvalFunction.Clear();
-  checkFrameEvalFunction.Clear();
   SetDebugEventListener(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
@@ -3470,6 +3437,7 @@ TEST(DebugStepFunctionCallApply) {
 TEST(PauseInScript) {
   DebugLocalContext env;
   v8::HandleScope scope(env->GetIsolate());
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(env->GetIsolate());
   env.ExposeDebug();
 
   // Register a debug event listener which counts.
@@ -3487,7 +3455,12 @@ TEST(PauseInScript) {
           .ToLocalChecked();
 
   // Set breakpoint in the script.
-  SetScriptBreakPointByNameFromJS(env->GetIsolate(), script_name, 0, -1);
+  i::Handle<i::Script> i_script(
+      i::Script::cast(v8::Utils::OpenHandle(*script)->shared()->script()));
+  i::Handle<i::String> condition = isolate->factory()->empty_string();
+  int position = 0;
+  int id;
+  isolate->debug()->SetBreakPointForScript(i_script, condition, &position, &id);
   break_point_hit_count = 0;
 
   v8::Local<v8::Value> r = script->Run(context).ToLocalChecked();
@@ -4666,6 +4639,7 @@ TEST(NoHiddenProperties) {
 
 
 TEST(SetDebugEventListenerOnUninitializedVM) {
+  v8::HandleScope scope(CcTest::isolate());
   EnableDebugger(CcTest::isolate());
 }
 
@@ -5127,8 +5101,8 @@ TEST(ContextData) {
   SetDebugEventListener(isolate, ContextCheckEventListener);
 
   // Default data value is undefined.
-  CHECK(context_1->GetEmbedderData(0)->IsUndefined());
-  CHECK(context_2->GetEmbedderData(0)->IsUndefined());
+  CHECK_EQ(0, context_1->GetNumberOfEmbedderDataFields());
+  CHECK_EQ(0, context_2->GetNumberOfEmbedderDataFields());
 
   // Set and check different data values.
   v8::Local<v8::String> data_1 = v8_str(isolate, "1");
@@ -5297,8 +5271,8 @@ TEST(EvalContextData) {
 
   SetDebugEventListener(CcTest::isolate(), ContextCheckEventListener);
 
-  // Default data value is undefined.
-  CHECK(context_1->GetEmbedderData(0)->IsUndefined());
+  // Contexts initially do not have embedder data fields.
+  CHECK_EQ(0, context_1->GetNumberOfEmbedderDataFields());
 
   // Set and check a data value.
   v8::Local<v8::String> data_1 = v8_str(CcTest::isolate(), "1");
@@ -5497,48 +5471,6 @@ TEST(ExceptionEventWhenEventListenerIsReset) {
 }
 
 
-// Tests after compile event is sent when there are some provisional
-// breakpoints out of the scripts lines range.
-TEST(ProvisionalBreakpointOnLineOutOfRange) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-  env.ExposeDebug();
-  const char* script = "function f() {};";
-  const char* resource_name = "test_resource";
-
-  SetDebugEventListener(env->GetIsolate(), AfterCompileEventListener);
-  v8::Local<v8::Context> context = env.context();
-
-  // Set a couple of provisional breakpoint on lines out of the script lines
-  // range.
-  int sbp1 = SetScriptBreakPointByNameFromJS(env->GetIsolate(), resource_name,
-                                             3, -1 /* no column */);
-  int sbp2 =
-      SetScriptBreakPointByNameFromJS(env->GetIsolate(), resource_name, 5, 5);
-
-  after_compile_event_count = 0;
-
-  v8::ScriptOrigin origin(v8_str(env->GetIsolate(), resource_name),
-                          v8::Integer::New(env->GetIsolate(), 10),
-                          v8::Integer::New(env->GetIsolate(), 1));
-  // Compile a script whose first line number is greater than the breakpoints'
-  // lines.
-  v8::Script::Compile(context, v8_str(env->GetIsolate(), script), &origin)
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-
-  // If the script is compiled successfully there is exactly one after compile
-  // event. In case of an exception in debugger code after compile event is not
-  // sent.
-  CHECK_EQ(1, after_compile_event_count);
-
-  ClearBreakPointFromJS(env->GetIsolate(), sbp1);
-  ClearBreakPointFromJS(env->GetIsolate(), sbp2);
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CheckDebuggerUnloaded();
-}
-
 static void BreakEventListener(const v8::Debug::EventDetails& details) {
   if (details.GetEvent() == v8::Break) break_point_hit_count++;
 }
@@ -6190,41 +6122,6 @@ TEST(LiveEditDisabled) {
 }
 
 
-TEST(PrecompiledFunction) {
-  // Regression test for crbug.com/346207. If we have preparse data, parsing the
-  // function in the presence of the debugger (and breakpoints) should still
-  // succeed. The bug was that preparsing was done lazily and parsing was done
-  // eagerly, so, the symbol streams didn't match.
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-  env.ExposeDebug();
-  SetDebugEventListener(env->GetIsolate(), DebugBreakInlineListener);
-
-  v8::Local<v8::Function> break_here =
-      CompileFunction(&env, "function break_here(){}", "break_here");
-  SetBreakPoint(break_here, 0);
-
-  const char* source =
-      "var a = b = c = 1;              \n"
-      "function this_is_lazy() {       \n"
-      // This symbol won't appear in the preparse data.
-      "  var a;                        \n"
-      "}                               \n"
-      "function bar() {                \n"
-      "  return \"bar\";               \n"
-      "};                              \n"
-      "a = b = c = 2;                  \n"
-      "bar();                          \n";
-  v8::Local<v8::Value> result = ParserCacheCompileRun(source);
-  CHECK(result->IsString());
-  v8::String::Utf8Value utf8(env->GetIsolate(), result);
-  CHECK_EQ(0, strcmp("bar", *utf8));
-
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CheckDebuggerUnloaded();
-}
-
-
 static void DebugBreakStackTraceListener(
     const v8::Debug::EventDetails& event_details) {
   v8::StackTrace::CurrentStackTrace(CcTest::isolate(), 10);
@@ -6543,10 +6440,11 @@ TEST(DebugStepOverFunctionWithCaughtException) {
   CHECK_EQ(4, break_point_hit_count);
 }
 
-bool out_of_memory_callback_called = false;
-void OutOfMemoryCallback(void* data) {
-  out_of_memory_callback_called = true;
-  reinterpret_cast<v8::Isolate*>(data)->IncreaseHeapLimitForDebugging();
+bool near_heap_limit_callback_called = false;
+size_t NearHeapLimitCallback(void* data, size_t current_heap_limit,
+                             size_t initial_heap_limit) {
+  near_heap_limit_callback_called = true;
+  return initial_heap_limit + 10u * i::MB;
 }
 
 UNINITIALIZED_TEST(DebugSetOutOfMemoryListener) {
@@ -6559,14 +6457,14 @@ UNINITIALIZED_TEST(DebugSetOutOfMemoryListener) {
     v8::Isolate::Scope i_scope(isolate);
     v8::HandleScope scope(isolate);
     LocalContext context(isolate);
-    v8::debug::SetOutOfMemoryCallback(isolate, OutOfMemoryCallback,
-                                      reinterpret_cast<void*>(isolate));
-    CHECK(!out_of_memory_callback_called);
+    isolate->AddNearHeapLimitCallback(NearHeapLimitCallback, nullptr);
+    CHECK(!near_heap_limit_callback_called);
     // The following allocation fails unless the out-of-memory callback
     // increases the heap limit.
     int length = 10 * i::MB / i::kPointerSize;
     i_isolate->factory()->NewFixedArray(length, i::TENURED);
-    CHECK(out_of_memory_callback_called);
+    CHECK(near_heap_limit_callback_called);
+    isolate->RemoveNearHeapLimitCallback(NearHeapLimitCallback, 0);
   }
   isolate->Dispose();
 }
@@ -6719,17 +6617,13 @@ TEST(BuiltinsExceptionPrediction) {
   v8::HandleScope handle_scope(isolate);
   v8::Context::New(isolate);
 
+  i::Snapshot::EnsureAllBuiltinsAreDeserialized(iisolate);
+
   i::Builtins* builtins = iisolate->builtins();
   bool fail = false;
   for (int i = 0; i < i::Builtins::builtin_count; i++) {
     Code* builtin = builtins->builtin(i);
-
     if (builtin->kind() != Code::BUILTIN) continue;
-    if (builtin->builtin_index() == i::Builtins::kDeserializeLazy &&
-        i::Builtins::IsLazy(i)) {
-      builtin = i::Snapshot::DeserializeBuiltin(iisolate, i);
-    }
-
     auto prediction = builtin->GetBuiltinCatchPrediction();
     USE(prediction);
   }
@@ -6767,8 +6661,9 @@ TEST(DebugGetPossibleBreakpointsReturnLocations) {
 
 TEST(DebugEvaluateNoSideEffect) {
   LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  EnableDebugger(env->GetIsolate());
   i::Isolate* isolate = CcTest::i_isolate();
-  i::HandleScope scope(isolate);
   std::vector<i::Handle<i::JSFunction>> all_functions;
   {
     i::HeapIterator iterator(isolate->heap());
@@ -6789,4 +6684,5 @@ TEST(DebugEvaluateNoSideEffect) {
     }
     if (failed) isolate->clear_pending_exception();
   }
+  DisableDebugger(env->GetIsolate());
 }
diff --git a/deps/v8/test/cctest/test-disasm-arm.cc b/deps/v8/test/cctest/test-disasm-arm.cc
index 300309244e3..52912b75913 100644
--- a/deps/v8/test/cctest/test-disasm-arm.cc
+++ b/deps/v8/test/cctest/test-disasm-arm.cc
@@ -1568,6 +1568,9 @@ TEST(Barrier) {
   COMPARE(mcr(p15, 0, r0, cr7, cr10, 4, ne), "1e070f9a       mcrne (CP15DSB)");
   COMPARE(mcr(p15, 0, r0, cr7, cr5, 4, mi), "4e070f95       mcrmi (CP15ISB)");
 
+  // Conditional speculation barrier.
+  COMPARE(csdb(), "e320f014       csdb");
+
   VERIFY_RUN();
 }
 
diff --git a/deps/v8/test/cctest/test-disasm-arm64.cc b/deps/v8/test/cctest/test-disasm-arm64.cc
index 13deeb534b1..3813408a2bb 100644
--- a/deps/v8/test/cctest/test-disasm-arm64.cc
+++ b/deps/v8/test/cctest/test-disasm-arm64.cc
@@ -121,8 +121,8 @@ TEST_(bootstrap) {
 
   // Instructions generated by C compiler, disassembled by objdump, and
   // reformatted to suit our disassembly style.
-  COMPARE(dci(0xa9ba7bfd), "stp fp, lr, [csp, #-96]!");
-  COMPARE(dci(0x910003fd), "mov fp, csp");
+  COMPARE(dci(0xa9ba7bfd), "stp fp, lr, [sp, #-96]!");
+  COMPARE(dci(0x910003fd), "mov fp, sp");
   COMPARE(dci(0x9100e3a0), "add x0, fp, #0x38 (56)");
   COMPARE(dci(0xb900001f), "str wzr, [x0]");
   COMPARE(dci(0x528000e1), "movz w1, #0x7");
@@ -140,7 +140,7 @@ TEST_(bootstrap) {
   COMPARE(dci(0x2a0103e0), "mov w0, w1");
   COMPARE(dci(0x93407c00), "sxtw x0, w0");
   COMPARE(dci(0x2a000020), "orr w0, w1, w0");
-  COMPARE(dci(0xa8c67bfd), "ldp fp, lr, [csp], #96");
+  COMPARE(dci(0xa8c67bfd), "ldp fp, lr, [sp], #96");
 
   CLEANUP();
 }
@@ -160,12 +160,12 @@ TEST_(mov_mvn) {
   COMPARE(Mov(w14, Operand(w15, SXTH, 2)), "sbfiz w14, w15, #2, #16");
   COMPARE(Mov(x16, Operand(x20, SXTW, 3)), "sbfiz x16, x20, #3, #32");
 
-  COMPARE(Mov(x0, csp), "mov x0, csp");
-  COMPARE(Mov(w0, wcsp), "mov w0, wcsp");
+  COMPARE(Mov(x0, sp), "mov x0, sp");
+  COMPARE(Mov(w0, wsp), "mov w0, wsp");
   COMPARE(Mov(x0, xzr), "mov x0, xzr");
   COMPARE(Mov(w0, wzr), "mov w0, wzr");
-  COMPARE(mov(x0, csp), "mov x0, csp");
-  COMPARE(mov(w0, wcsp), "mov w0, wcsp");
+  COMPARE(mov(x0, sp), "mov x0, sp");
+  COMPARE(mov(w0, wsp), "mov w0, wsp");
   COMPARE(mov(x0, xzr), "mov x0, xzr");
   COMPARE(mov(w0, wzr), "mov w0, wzr");
 
@@ -290,14 +290,14 @@ TEST_(add_immediate) {
           "adds x16, x17, #0xaa000 (696320)");
   COMPARE(cmn(w18, Operand(0xff)), "cmn w18, #0xff (255)");
   COMPARE(cmn(x19, Operand(0xff000)), "cmn x19, #0xff000 (1044480)");
-  COMPARE(add(w0, wcsp, Operand(0)), "mov w0, wcsp");
-  COMPARE(add(csp, x0, Operand(0)), "mov csp, x0");
+  COMPARE(add(w0, wsp, Operand(0)), "mov w0, wsp");
+  COMPARE(add(sp, x0, Operand(0)), "mov sp, x0");
 
-  COMPARE(add(w1, wcsp, Operand(8)), "add w1, wcsp, #0x8 (8)");
-  COMPARE(add(x2, csp, Operand(16)), "add x2, csp, #0x10 (16)");
-  COMPARE(add(wcsp, wcsp, Operand(42)), "add wcsp, wcsp, #0x2a (42)");
-  COMPARE(cmn(csp, Operand(24)), "cmn csp, #0x18 (24)");
-  COMPARE(adds(wzr, wcsp, Operand(9)), "cmn wcsp, #0x9 (9)");
+  COMPARE(add(w1, wsp, Operand(8)), "add w1, wsp, #0x8 (8)");
+  COMPARE(add(x2, sp, Operand(16)), "add x2, sp, #0x10 (16)");
+  COMPARE(add(wsp, wsp, Operand(42)), "add wsp, wsp, #0x2a (42)");
+  COMPARE(cmn(sp, Operand(24)), "cmn sp, #0x18 (24)");
+  COMPARE(adds(wzr, wsp, Operand(9)), "cmn wsp, #0x9 (9)");
 
   CLEANUP();
 }
@@ -321,11 +321,11 @@ TEST_(sub_immediate) {
   COMPARE(cmp(w18, Operand(0xff)), "cmp w18, #0xff (255)");
   COMPARE(cmp(x19, Operand(0xff000)), "cmp x19, #0xff000 (1044480)");
 
-  COMPARE(add(w1, wcsp, Operand(8)), "add w1, wcsp, #0x8 (8)");
-  COMPARE(add(x2, csp, Operand(16)), "add x2, csp, #0x10 (16)");
-  COMPARE(add(wcsp, wcsp, Operand(42)), "add wcsp, wcsp, #0x2a (42)");
-  COMPARE(cmn(csp, Operand(24)), "cmn csp, #0x18 (24)");
-  COMPARE(adds(wzr, wcsp, Operand(9)), "cmn wcsp, #0x9 (9)");
+  COMPARE(add(w1, wsp, Operand(8)), "add w1, wsp, #0x8 (8)");
+  COMPARE(add(x2, sp, Operand(16)), "add x2, sp, #0x10 (16)");
+  COMPARE(add(wsp, wsp, Operand(42)), "add wsp, wsp, #0x2a (42)");
+  COMPARE(cmn(sp, Operand(24)), "cmn sp, #0x18 (24)");
+  COMPARE(adds(wzr, wsp, Operand(9)), "cmn wsp, #0x9 (9)");
 
   CLEANUP();
 }
@@ -345,12 +345,12 @@ TEST_(add_shifted) {
   COMPARE(cmn(w24, Operand(w25)), "cmn w24, w25");
   COMPARE(cmn(x26, Operand(cp, LSL, 63)), "cmn x26, cp, lsl #63");
 
-  COMPARE(add(x0, csp, Operand(x1)), "add x0, csp, x1");
-  COMPARE(add(w2, wcsp, Operand(w3)), "add w2, wcsp, w3");
-  COMPARE(add(x4, csp, Operand(x5, LSL, 1)), "add x4, csp, x5, lsl #1");
+  COMPARE(add(x0, sp, Operand(x1)), "add x0, sp, x1");
+  COMPARE(add(w2, wsp, Operand(w3)), "add w2, wsp, w3");
+  COMPARE(add(x4, sp, Operand(x5, LSL, 1)), "add x4, sp, x5, lsl #1");
   COMPARE(add(x4, xzr, Operand(x5, LSL, 1)), "add x4, xzr, x5, lsl #1");
-  COMPARE(add(w6, wcsp, Operand(w7, LSL, 3)), "add w6, wcsp, w7, lsl #3");
-  COMPARE(adds(xzr, csp, Operand(x8, LSL, 4)), "cmn csp, x8, lsl #4");
+  COMPARE(add(w6, wsp, Operand(w7, LSL, 3)), "add w6, wsp, w7, lsl #3");
+  COMPARE(adds(xzr, sp, Operand(x8, LSL, 4)), "cmn sp, x8, lsl #4");
   COMPARE(adds(xzr, xzr, Operand(x8, LSL, 5)), "cmn xzr, x8, lsl #5");
 
   CLEANUP();
@@ -375,12 +375,12 @@ TEST_(sub_shifted) {
   COMPARE(negs(w1, Operand(w2)), "negs w1, w2");
   COMPARE(negs(x3, Operand(x4, ASR, 61)), "negs x3, x4, asr #61");
 
-  COMPARE(sub(x0, csp, Operand(x1)), "sub x0, csp, x1");
-  COMPARE(sub(w2, wcsp, Operand(w3)), "sub w2, wcsp, w3");
-  COMPARE(sub(x4, csp, Operand(x5, LSL, 1)), "sub x4, csp, x5, lsl #1");
+  COMPARE(sub(x0, sp, Operand(x1)), "sub x0, sp, x1");
+  COMPARE(sub(w2, wsp, Operand(w3)), "sub w2, wsp, w3");
+  COMPARE(sub(x4, sp, Operand(x5, LSL, 1)), "sub x4, sp, x5, lsl #1");
   COMPARE(sub(x4, xzr, Operand(x5, LSL, 1)), "neg x4, x5, lsl #1");
-  COMPARE(sub(w6, wcsp, Operand(w7, LSL, 3)), "sub w6, wcsp, w7, lsl #3");
-  COMPARE(subs(xzr, csp, Operand(x8, LSL, 4)), "cmp csp, x8, lsl #4");
+  COMPARE(sub(w6, wsp, Operand(w7, LSL, 3)), "sub w6, wsp, w7, lsl #3");
+  COMPARE(subs(xzr, sp, Operand(x8, LSL, 4)), "cmp sp, x8, lsl #4");
   COMPARE(subs(xzr, xzr, Operand(x8, LSL, 5)), "cmp xzr, x8, lsl #5");
 
   CLEANUP();
@@ -403,11 +403,11 @@ TEST_(add_extended) {
   COMPARE(cmn(w0, Operand(w1, UXTB, 2)), "cmn w0, w1, uxtb #2");
   COMPARE(cmn(x2, Operand(x3, SXTH, 4)), "cmn x2, w3, sxth #4");
 
-  COMPARE(add(w0, wcsp, Operand(w1, UXTB)), "add w0, wcsp, w1, uxtb");
-  COMPARE(add(x2, csp, Operand(x3, UXTH, 1)), "add x2, csp, w3, uxth #1");
-  COMPARE(add(wcsp, wcsp, Operand(w4, UXTW, 2)), "add wcsp, wcsp, w4, lsl #2");
-  COMPARE(cmn(csp, Operand(xzr, UXTX, 3)), "cmn csp, xzr, lsl #3");
-  COMPARE(cmn(csp, Operand(xzr, LSL, 4)), "cmn csp, xzr, lsl #4");
+  COMPARE(add(w0, wsp, Operand(w1, UXTB)), "add w0, wsp, w1, uxtb");
+  COMPARE(add(x2, sp, Operand(x3, UXTH, 1)), "add x2, sp, w3, uxth #1");
+  COMPARE(add(wsp, wsp, Operand(w4, UXTW, 2)), "add wsp, wsp, w4, lsl #2");
+  COMPARE(cmn(sp, Operand(xzr, UXTX, 3)), "cmn sp, xzr, lsl #3");
+  COMPARE(cmn(sp, Operand(xzr, LSL, 4)), "cmn sp, xzr, lsl #4");
 
   CLEANUP();
 }
@@ -429,11 +429,11 @@ TEST_(sub_extended) {
   COMPARE(cmp(w0, Operand(w1, SXTB, 1)), "cmp w0, w1, sxtb #1");
   COMPARE(cmp(x2, Operand(x3, UXTH, 3)), "cmp x2, w3, uxth #3");
 
-  COMPARE(sub(w0, wcsp, Operand(w1, UXTB)), "sub w0, wcsp, w1, uxtb");
-  COMPARE(sub(x2, csp, Operand(x3, UXTH, 1)), "sub x2, csp, w3, uxth #1");
-  COMPARE(sub(wcsp, wcsp, Operand(w4, UXTW, 2)), "sub wcsp, wcsp, w4, lsl #2");
-  COMPARE(cmp(csp, Operand(xzr, UXTX, 3)), "cmp csp, xzr, lsl #3");
-  COMPARE(cmp(csp, Operand(xzr, LSL, 4)), "cmp csp, xzr, lsl #4");
+  COMPARE(sub(w0, wsp, Operand(w1, UXTB)), "sub w0, wsp, w1, uxtb");
+  COMPARE(sub(x2, sp, Operand(x3, UXTH, 1)), "sub x2, sp, w3, uxth #1");
+  COMPARE(sub(wsp, wsp, Operand(w4, UXTW, 2)), "sub wsp, wsp, w4, lsl #2");
+  COMPARE(cmp(sp, Operand(xzr, UXTX, 3)), "cmp sp, xzr, lsl #3");
+  COMPARE(cmp(sp, Operand(xzr, LSL, 4)), "cmp sp, xzr, lsl #4");
 
   CLEANUP();
 }
@@ -684,10 +684,10 @@ TEST_(logical_immediate) {
           "ands fp, x0, #0x100000000");
 
   // Test stack pointer.
-  COMPARE(and_(wcsp, wzr, Operand(7)), "and wcsp, wzr, #0x7");
+  COMPARE(and_(wsp, wzr, Operand(7)), "and wsp, wzr, #0x7");
   COMPARE(ands(xzr, xzr, Operand(7)), "tst xzr, #0x7");
-  COMPARE(orr(csp, xzr, Operand(15)), "orr csp, xzr, #0xf");
-  COMPARE(eor(wcsp, w0, Operand(31)), "eor wcsp, w0, #0x1f");
+  COMPARE(orr(sp, xzr, Operand(15)), "orr sp, xzr, #0xf");
+  COMPARE(eor(wsp, w0, Operand(31)), "eor wsp, w0, #0x1f");
 
   // Test move aliases.
   COMPARE(orr(w0, wzr, Operand(0x00000780)), "orr w0, wzr, #0x780");
@@ -1089,11 +1089,11 @@ TEST(load_store_v_offset) {
   COMPARE(str(q31, MemOperand(x1, 16)), "str q31, [x1, #16]");
   COMPARE(str(q0, MemOperand(x3, 65520)), "str q0, [x3, #65520]");
 
-  COMPARE(ldr(s24, MemOperand(csp)), "ldr s24, [csp]");
-  COMPARE(ldr(d25, MemOperand(csp, 8)), "ldr d25, [csp, #8]");
-  COMPARE(ldr(b26, MemOperand(csp, 1)), "ldr b26, [csp, #1]");
-  COMPARE(ldr(h27, MemOperand(csp, 2)), "ldr h27, [csp, #2]");
-  COMPARE(ldr(q28, MemOperand(csp, 16)), "ldr q28, [csp, #16]");
+  COMPARE(ldr(s24, MemOperand(sp)), "ldr s24, [sp]");
+  COMPARE(ldr(d25, MemOperand(sp, 8)), "ldr d25, [sp, #8]");
+  COMPARE(ldr(b26, MemOperand(sp, 1)), "ldr b26, [sp, #1]");
+  COMPARE(ldr(h27, MemOperand(sp, 2)), "ldr h27, [sp, #2]");
+  COMPARE(ldr(q28, MemOperand(sp, 16)), "ldr q28, [sp, #16]");
 
   CLEANUP();
 }
@@ -1135,11 +1135,11 @@ TEST(load_store_v_pre) {
   COMPARE(str(q31, MemOperand(x3, 255, PreIndex)), "str q31, [x3, #255]!");
   COMPARE(str(q0, MemOperand(x5, -256, PreIndex)), "str q0, [x5, #-256]!");
 
-  COMPARE(str(b24, MemOperand(csp, 1, PreIndex)), "str b24, [csp, #1]!");
-  COMPARE(str(h25, MemOperand(csp, -2, PreIndex)), "str h25, [csp, #-2]!");
-  COMPARE(str(s26, MemOperand(csp, 4, PreIndex)), "str s26, [csp, #4]!");
-  COMPARE(str(d27, MemOperand(csp, -8, PreIndex)), "str d27, [csp, #-8]!");
-  COMPARE(str(q28, MemOperand(csp, 16, PreIndex)), "str q28, [csp, #16]!");
+  COMPARE(str(b24, MemOperand(sp, 1, PreIndex)), "str b24, [sp, #1]!");
+  COMPARE(str(h25, MemOperand(sp, -2, PreIndex)), "str h25, [sp, #-2]!");
+  COMPARE(str(s26, MemOperand(sp, 4, PreIndex)), "str s26, [sp, #4]!");
+  COMPARE(str(d27, MemOperand(sp, -8, PreIndex)), "str d27, [sp, #-8]!");
+  COMPARE(str(q28, MemOperand(sp, 16, PreIndex)), "str q28, [sp, #16]!");
 
   CLEANUP();
 }
@@ -1181,11 +1181,11 @@ TEST(load_store_v_post) {
   COMPARE(str(q31, MemOperand(x3, 255, PostIndex)), "str q31, [x3], #255");
   COMPARE(str(q0, MemOperand(x5, -256, PostIndex)), "str q0, [x5], #-256");
 
-  COMPARE(ldr(b24, MemOperand(csp, -1, PreIndex)), "ldr b24, [csp, #-1]!");
-  COMPARE(ldr(h25, MemOperand(csp, 2, PreIndex)), "ldr h25, [csp, #2]!");
-  COMPARE(ldr(s26, MemOperand(csp, -4, PreIndex)), "ldr s26, [csp, #-4]!");
-  COMPARE(ldr(d27, MemOperand(csp, 8, PreIndex)), "ldr d27, [csp, #8]!");
-  COMPARE(ldr(q28, MemOperand(csp, -16, PreIndex)), "ldr q28, [csp, #-16]!");
+  COMPARE(ldr(b24, MemOperand(sp, -1, PreIndex)), "ldr b24, [sp, #-1]!");
+  COMPARE(ldr(h25, MemOperand(sp, 2, PreIndex)), "ldr h25, [sp, #2]!");
+  COMPARE(ldr(s26, MemOperand(sp, -4, PreIndex)), "ldr s26, [sp, #-4]!");
+  COMPARE(ldr(d27, MemOperand(sp, 8, PreIndex)), "ldr d27, [sp, #8]!");
+  COMPARE(ldr(q28, MemOperand(sp, -16, PreIndex)), "ldr q28, [sp, #-16]!");
 
   CLEANUP();
 }
@@ -1198,88 +1198,88 @@ TEST(load_store_v_regoffset) {
   COMPARE(ldr(b2, MemOperand(x3, w4, SXTW)), "ldr b2, [x3, w4, sxtw]");
   // We can't assemble this instruction, but we check it disassembles correctly.
   COMPARE(dci(0x3c657883), "ldr b3, [x4, x5, lsl #0]");
-  COMPARE(ldr(b30, MemOperand(csp, xzr)), "ldr b30, [csp, xzr]");
-  COMPARE(ldr(b31, MemOperand(csp, wzr, UXTW)), "ldr b31, [csp, wzr, uxtw]");
+  COMPARE(ldr(b30, MemOperand(sp, xzr)), "ldr b30, [sp, xzr]");
+  COMPARE(ldr(b31, MemOperand(sp, wzr, UXTW)), "ldr b31, [sp, wzr, uxtw]");
 
   COMPARE(ldr(h0, MemOperand(x1, x2)), "ldr h0, [x1, x2]");
   COMPARE(ldr(h1, MemOperand(x2, w3, UXTW)), "ldr h1, [x2, w3, uxtw]");
   COMPARE(ldr(h2, MemOperand(x3, w4, SXTW)), "ldr h2, [x3, w4, sxtw]");
   COMPARE(ldr(h3, MemOperand(x4, w5, UXTW, 1)), "ldr h3, [x4, w5, uxtw #1]");
   COMPARE(ldr(h4, MemOperand(x5, w5, SXTW, 1)), "ldr h4, [x5, w5, sxtw #1]");
-  COMPARE(ldr(h30, MemOperand(csp, xzr)), "ldr h30, [csp, xzr]");
-  COMPARE(ldr(h31, MemOperand(csp, wzr, SXTW, 1)),
-          "ldr h31, [csp, wzr, sxtw #1]");
+  COMPARE(ldr(h30, MemOperand(sp, xzr)), "ldr h30, [sp, xzr]");
+  COMPARE(ldr(h31, MemOperand(sp, wzr, SXTW, 1)),
+          "ldr h31, [sp, wzr, sxtw #1]");
 
   COMPARE(ldr(s0, MemOperand(x1, x2)), "ldr s0, [x1, x2]");
   COMPARE(ldr(s1, MemOperand(x2, w3, UXTW)), "ldr s1, [x2, w3, uxtw]");
   COMPARE(ldr(s2, MemOperand(x3, w4, SXTW)), "ldr s2, [x3, w4, sxtw]");
   COMPARE(ldr(s3, MemOperand(x4, w5, UXTW, 2)), "ldr s3, [x4, w5, uxtw #2]");
   COMPARE(ldr(s4, MemOperand(x5, w5, SXTW, 2)), "ldr s4, [x5, w5, sxtw #2]");
-  COMPARE(ldr(s30, MemOperand(csp, xzr)), "ldr s30, [csp, xzr]");
-  COMPARE(ldr(s31, MemOperand(csp, wzr, SXTW, 2)),
-          "ldr s31, [csp, wzr, sxtw #2]");
+  COMPARE(ldr(s30, MemOperand(sp, xzr)), "ldr s30, [sp, xzr]");
+  COMPARE(ldr(s31, MemOperand(sp, wzr, SXTW, 2)),
+          "ldr s31, [sp, wzr, sxtw #2]");
 
   COMPARE(ldr(d0, MemOperand(x1, x2)), "ldr d0, [x1, x2]");
   COMPARE(ldr(d1, MemOperand(x2, w3, UXTW)), "ldr d1, [x2, w3, uxtw]");
   COMPARE(ldr(d2, MemOperand(x3, w4, SXTW)), "ldr d2, [x3, w4, sxtw]");
   COMPARE(ldr(d3, MemOperand(x4, w5, UXTW, 3)), "ldr d3, [x4, w5, uxtw #3]");
   COMPARE(ldr(d4, MemOperand(x5, w5, SXTW, 3)), "ldr d4, [x5, w5, sxtw #3]");
-  COMPARE(ldr(d30, MemOperand(csp, xzr)), "ldr d30, [csp, xzr]");
-  COMPARE(ldr(d31, MemOperand(csp, wzr, SXTW, 3)),
-          "ldr d31, [csp, wzr, sxtw #3]");
+  COMPARE(ldr(d30, MemOperand(sp, xzr)), "ldr d30, [sp, xzr]");
+  COMPARE(ldr(d31, MemOperand(sp, wzr, SXTW, 3)),
+          "ldr d31, [sp, wzr, sxtw #3]");
 
   COMPARE(ldr(q0, MemOperand(x1, x2)), "ldr q0, [x1, x2]");
   COMPARE(ldr(q1, MemOperand(x2, w3, UXTW)), "ldr q1, [x2, w3, uxtw]");
   COMPARE(ldr(q2, MemOperand(x3, w4, SXTW)), "ldr q2, [x3, w4, sxtw]");
   COMPARE(ldr(q3, MemOperand(x4, w5, UXTW, 4)), "ldr q3, [x4, w5, uxtw #4]");
   COMPARE(ldr(q4, MemOperand(x5, w5, SXTW, 4)), "ldr q4, [x5, w5, sxtw #4]");
-  COMPARE(ldr(q30, MemOperand(csp, xzr)), "ldr q30, [csp, xzr]");
-  COMPARE(ldr(q31, MemOperand(csp, wzr, SXTW, 4)),
-          "ldr q31, [csp, wzr, sxtw #4]");
+  COMPARE(ldr(q30, MemOperand(sp, xzr)), "ldr q30, [sp, xzr]");
+  COMPARE(ldr(q31, MemOperand(sp, wzr, SXTW, 4)),
+          "ldr q31, [sp, wzr, sxtw #4]");
 
   COMPARE(str(b0, MemOperand(x1, x2)), "str b0, [x1, x2]");
   COMPARE(str(b1, MemOperand(x2, w3, UXTW)), "str b1, [x2, w3, uxtw]");
   COMPARE(str(b2, MemOperand(x3, w4, SXTW)), "str b2, [x3, w4, sxtw]");
   // We can't assemble this instruction, but we check it disassembles correctly.
   COMPARE(dci(0x3c257883), "str b3, [x4, x5, lsl #0]");
-  COMPARE(str(b30, MemOperand(csp, xzr)), "str b30, [csp, xzr]");
-  COMPARE(str(b31, MemOperand(csp, wzr, UXTW)), "str b31, [csp, wzr, uxtw]");
+  COMPARE(str(b30, MemOperand(sp, xzr)), "str b30, [sp, xzr]");
+  COMPARE(str(b31, MemOperand(sp, wzr, UXTW)), "str b31, [sp, wzr, uxtw]");
 
   COMPARE(str(h0, MemOperand(x1, x2)), "str h0, [x1, x2]");
   COMPARE(str(h1, MemOperand(x2, w3, UXTW)), "str h1, [x2, w3, uxtw]");
   COMPARE(str(h2, MemOperand(x3, w4, SXTW)), "str h2, [x3, w4, sxtw]");
   COMPARE(str(h3, MemOperand(x4, w5, UXTW, 1)), "str h3, [x4, w5, uxtw #1]");
   COMPARE(str(h4, MemOperand(x5, w5, SXTW, 1)), "str h4, [x5, w5, sxtw #1]");
-  COMPARE(str(h30, MemOperand(csp, xzr)), "str h30, [csp, xzr]");
-  COMPARE(str(h31, MemOperand(csp, wzr, SXTW, 1)),
-          "str h31, [csp, wzr, sxtw #1]");
+  COMPARE(str(h30, MemOperand(sp, xzr)), "str h30, [sp, xzr]");
+  COMPARE(str(h31, MemOperand(sp, wzr, SXTW, 1)),
+          "str h31, [sp, wzr, sxtw #1]");
 
   COMPARE(str(s0, MemOperand(x1, x2)), "str s0, [x1, x2]");
   COMPARE(str(s1, MemOperand(x2, w3, UXTW)), "str s1, [x2, w3, uxtw]");
   COMPARE(str(s2, MemOperand(x3, w4, SXTW)), "str s2, [x3, w4, sxtw]");
   COMPARE(str(s3, MemOperand(x4, w5, UXTW, 2)), "str s3, [x4, w5, uxtw #2]");
   COMPARE(str(s4, MemOperand(x5, w5, SXTW, 2)), "str s4, [x5, w5, sxtw #2]");
-  COMPARE(str(s30, MemOperand(csp, xzr)), "str s30, [csp, xzr]");
-  COMPARE(str(s31, MemOperand(csp, wzr, SXTW, 2)),
-          "str s31, [csp, wzr, sxtw #2]");
+  COMPARE(str(s30, MemOperand(sp, xzr)), "str s30, [sp, xzr]");
+  COMPARE(str(s31, MemOperand(sp, wzr, SXTW, 2)),
+          "str s31, [sp, wzr, sxtw #2]");
 
   COMPARE(str(d0, MemOperand(x1, x2)), "str d0, [x1, x2]");
   COMPARE(str(d1, MemOperand(x2, w3, UXTW)), "str d1, [x2, w3, uxtw]");
   COMPARE(str(d2, MemOperand(x3, w4, SXTW)), "str d2, [x3, w4, sxtw]");
   COMPARE(str(d3, MemOperand(x4, w5, UXTW, 3)), "str d3, [x4, w5, uxtw #3]");
   COMPARE(str(d4, MemOperand(x5, w5, SXTW, 3)), "str d4, [x5, w5, sxtw #3]");
-  COMPARE(str(d30, MemOperand(csp, xzr)), "str d30, [csp, xzr]");
-  COMPARE(str(d31, MemOperand(csp, wzr, SXTW, 3)),
-          "str d31, [csp, wzr, sxtw #3]");
+  COMPARE(str(d30, MemOperand(sp, xzr)), "str d30, [sp, xzr]");
+  COMPARE(str(d31, MemOperand(sp, wzr, SXTW, 3)),
+          "str d31, [sp, wzr, sxtw #3]");
 
   COMPARE(str(q0, MemOperand(x1, x2)), "str q0, [x1, x2]");
   COMPARE(str(q1, MemOperand(x2, w3, UXTW)), "str q1, [x2, w3, uxtw]");
   COMPARE(str(q2, MemOperand(x3, w4, SXTW)), "str q2, [x3, w4, sxtw]");
   COMPARE(str(q3, MemOperand(x4, w5, UXTW, 4)), "str q3, [x4, w5, uxtw #4]");
   COMPARE(str(q4, MemOperand(x5, w5, SXTW, 4)), "str q4, [x5, w5, sxtw #4]");
-  COMPARE(str(q30, MemOperand(csp, xzr)), "str q30, [csp, xzr]");
-  COMPARE(str(q31, MemOperand(csp, wzr, SXTW, 4)),
-          "str q31, [csp, wzr, sxtw #4]");
+  COMPARE(str(q30, MemOperand(sp, xzr)), "str q30, [sp, xzr]");
+  COMPARE(str(q31, MemOperand(sp, wzr, SXTW, 4)),
+          "str q31, [sp, wzr, sxtw #4]");
 
   CLEANUP();
 }
@@ -1304,8 +1304,8 @@ TEST_(load_store_unscaled) {
   COMPARE(str(x26, MemOperand(x27, -1)), "stur x26, [cp, #-1]");
   COMPARE(str(x28, MemOperand(x29, 255)), "stur x28, [fp, #255]");
   COMPARE(str(x30, MemOperand(x0, -256)), "stur lr, [x0, #-256]");
-  COMPARE(ldr(w0, MemOperand(csp, 1)), "ldur w0, [csp, #1]");
-  COMPARE(str(x1, MemOperand(csp, -1)), "stur x1, [csp, #-1]");
+  COMPARE(ldr(w0, MemOperand(sp, 1)), "ldur w0, [sp, #1]");
+  COMPARE(str(x1, MemOperand(sp, -1)), "stur x1, [sp, #-1]");
   COMPARE(ldrb(w2, MemOperand(x3, -2)), "ldurb w2, [x3, #-2]");
   COMPARE(ldrsb(w4, MemOperand(x5, -3)), "ldursb w4, [x5, #-3]");
   COMPARE(ldrsb(x6, MemOperand(x7, -4)), "ldursb x6, [x7, #-4]");
@@ -1476,18 +1476,18 @@ TEST_(load_store_acquire_release) {
   COMPARE(stlxrb(w21, w22, x23), "stlxrb w21, w22, [x23]");
   COMPARE(stlxrh(w24, w25, x26), "stlxrh w24, w25, [x26]");
 
-  COMPARE(ldarb(wzr, csp), "ldarb wzr, [csp]");
-  COMPARE(ldarh(wzr, csp), "ldarh wzr, [csp]");
-  COMPARE(ldar(wzr, csp), "ldar wzr, [csp]");
-  COMPARE(stlrb(wzr, csp), "stlrb wzr, [csp]");
-  COMPARE(stlrh(wzr, csp), "stlrh wzr, [csp]");
-  COMPARE(stlr(wzr, csp), "stlr wzr, [csp]");
-  COMPARE(ldaxrb(wzr, csp), "ldaxrb wzr, [csp]");
-  COMPARE(ldaxrh(wzr, csp), "ldaxrh wzr, [csp]");
-  COMPARE(ldaxr(wzr, csp), "ldaxr wzr, [csp]");
-  COMPARE(stlxrb(w0, wzr, csp), "stlxrb w0, wzr, [csp]");
-  COMPARE(stlxrh(wzr, w1, csp), "stlxrh wzr, w1, [csp]");
-  COMPARE(stlxr(w2, wzr, csp), "stlxr w2, wzr, [csp]");
+  COMPARE(ldarb(wzr, sp), "ldarb wzr, [sp]");
+  COMPARE(ldarh(wzr, sp), "ldarh wzr, [sp]");
+  COMPARE(ldar(wzr, sp), "ldar wzr, [sp]");
+  COMPARE(stlrb(wzr, sp), "stlrb wzr, [sp]");
+  COMPARE(stlrh(wzr, sp), "stlrh wzr, [sp]");
+  COMPARE(stlr(wzr, sp), "stlr wzr, [sp]");
+  COMPARE(ldaxrb(wzr, sp), "ldaxrb wzr, [sp]");
+  COMPARE(ldaxrh(wzr, sp), "ldaxrh wzr, [sp]");
+  COMPARE(ldaxr(wzr, sp), "ldaxr wzr, [sp]");
+  COMPARE(stlxrb(w0, wzr, sp), "stlxrb w0, wzr, [sp]");
+  COMPARE(stlxrh(wzr, w1, sp), "stlxrh wzr, w1, [sp]");
+  COMPARE(stlxr(w2, wzr, sp), "stlxr w2, wzr, [sp]");
 
   CLEANUP();
 }
@@ -2038,6 +2038,9 @@ TEST_(barriers) {
   // ISB
   COMPARE(Isb(), "isb");
 
+  // CSDB
+  COMPARE(Csdb(), "csdb");
+
   CLEANUP();
 }
 
@@ -2099,24 +2102,24 @@ TEST_(barriers) {
 TEST(neon_load_store_vector) {
   SET_UP_MASM();
 
-#define DISASM_INST(M, S)                                          \
-  COMPARE(Ld1(v0.M, MemOperand(x15)), "ld1 {v0." S "}, [x15]");    \
-  COMPARE(Ld1(v1.M, v2.M, MemOperand(x16)),                        \
-          "ld1 {v1." S ", v2." S "}, [x16]");                      \
-  COMPARE(Ld1(v3.M, v4.M, v5.M, MemOperand(x17)),                  \
-          "ld1 {v3." S ", v4." S ", v5." S "}, [x17]");            \
-  COMPARE(Ld1(v6.M, v7.M, v8_.M, v9.M, MemOperand(x18)),           \
-          "ld1 {v6." S ", v7." S ", v8_." S ", v9." S "}, [x18]")  \
-  COMPARE(Ld1(v30.M, v31.M, v0.M, v1.M, MemOperand(sp)),           \
-          "ld1 {v30." S ", v31." S ", v0." S ", v1." S "}, [csp]") \
-  COMPARE(Ld2(v1.M, v2.M, MemOperand(x16)),                        \
-          "ld2 {v1." S ", v2." S "}, [x16]");                      \
-  COMPARE(Ld3(v3.M, v4.M, v5.M, MemOperand(x17)),                  \
-          "ld3 {v3." S ", v4." S ", v5." S "}, [x17]");            \
-  COMPARE(Ld4(v6.M, v7.M, v8_.M, v9.M, MemOperand(x18)),           \
-          "ld4 {v6." S ", v7." S ", v8." S ", v9." S "}, [x18]")   \
-  COMPARE(Ld4(v30.M, v31.M, v0.M, v1.M, MemOperand(sp)),           \
-          "ld4 {v30." S ", v31." S ", v0." S ", v1." S "}, [csp]") \
+#define DISASM_INST(M, S)                                         \
+  COMPARE(Ld1(v0.M, MemOperand(x15)), "ld1 {v0." S "}, [x15]");   \
+  COMPARE(Ld1(v1.M, v2.M, MemOperand(x16)),                       \
+          "ld1 {v1." S ", v2." S "}, [x16]");                     \
+  COMPARE(Ld1(v3.M, v4.M, v5.M, MemOperand(x17)),                 \
+          "ld1 {v3." S ", v4." S ", v5." S "}, [x17]");           \
+  COMPARE(Ld1(v6.M, v7.M, v8_.M, v9.M, MemOperand(x18)),          \
+          "ld1 {v6." S ", v7." S ", v8_." S ", v9." S "}, [x18]") \
+  COMPARE(Ld1(v30.M, v31.M, v0.M, v1.M, MemOperand(sp)),          \
+          "ld1 {v30." S ", v31." S ", v0." S ", v1." S "}, [sp]") \
+  COMPARE(Ld2(v1.M, v2.M, MemOperand(x16)),                       \
+          "ld2 {v1." S ", v2." S "}, [x16]");                     \
+  COMPARE(Ld3(v3.M, v4.M, v5.M, MemOperand(x17)),                 \
+          "ld3 {v3." S ", v4." S ", v5." S "}, [x17]");           \
+  COMPARE(Ld4(v6.M, v7.M, v8_.M, v9.M, MemOperand(x18)),          \
+          "ld4 {v6." S ", v7." S ", v8." S ", v9." S "}, [x18]")  \
+  COMPARE(Ld4(v30.M, v31.M, v0.M, v1.M, MemOperand(sp)),          \
+          "ld4 {v30." S ", v31." S ", v0." S ", v1." S "}, [sp]") \
   NEON_FORMAT_LIST(DISASM_INST);
 #undef DISASM_INST
 
@@ -2130,7 +2133,7 @@ TEST(neon_load_store_vector) {
   COMPARE(Ld1(v6.M, v7.M, v8_.M, v9.M, MemOperand(x18, x23, PostIndex)), \
           "ld1 {v6." S ", v7." S ", v8." S ", v9." S "}, [x18], x23")    \
   COMPARE(Ld1(v30.M, v31.M, v0.M, v1.M, MemOperand(sp, x24, PostIndex)), \
-          "ld1 {v30." S ", v31." S ", v0." S ", v1." S "}, [csp], x24")  \
+          "ld1 {v30." S ", v31." S ", v0." S ", v1." S "}, [sp], x24")   \
   COMPARE(Ld2(v1.M, v2.M, MemOperand(x16, x21, PostIndex)),              \
           "ld2 {v1." S ", v2." S "}, [x16], x21");                       \
   COMPARE(Ld3(v3.M, v4.M, v5.M, MemOperand(x17, x22, PostIndex)),        \
@@ -2138,7 +2141,7 @@ TEST(neon_load_store_vector) {
   COMPARE(Ld4(v6.M, v7.M, v8_.M, v9.M, MemOperand(x18, x23, PostIndex)), \
           "ld4 {v6." S ", v7." S ", v8_." S ", v9." S "}, [x18], x23")   \
   COMPARE(Ld4(v30.M, v31.M, v0.M, v1.M, MemOperand(sp, x24, PostIndex)), \
-          "ld4 {v30." S ", v31." S ", v0." S ", v1." S "}, [csp], x24")  \
+          "ld4 {v30." S ", v31." S ", v0." S ", v1." S "}, [sp], x24")   \
   NEON_FORMAT_LIST(DISASM_INST);
 #undef DISASM_INST
 
@@ -2195,36 +2198,36 @@ TEST(neon_load_store_vector) {
           "st1 {v23." S ", v24." S ", v25." S "}, [x17]");           \
   COMPARE(St1(v26.M, v27.M, v28.M, v29.M, MemOperand(x18)),          \
           "st1 {v26." S ", v27." S ", v28." S ", v29." S "}, [x18]") \
-  COMPARE(St1(v30.M, v31.M, v0.M, v1.M, MemOperand(csp)),            \
-          "st1 {v30." S ", v31." S ", v0." S ", v1." S "}, [csp]")   \
+  COMPARE(St1(v30.M, v31.M, v0.M, v1.M, MemOperand(sp)),             \
+          "st1 {v30." S ", v31." S ", v0." S ", v1." S "}, [sp]")    \
   COMPARE(St2(VLIST2(v21.M), MemOperand(x16)),                       \
           "st2 {v21." S ", v22." S "}, [x16]");                      \
   COMPARE(St3(v23.M, v24.M, v25.M, MemOperand(x17)),                 \
           "st3 {v23." S ", v24." S ", v25." S "}, [x17]");           \
-  COMPARE(St4(v30.M, v31.M, v0.M, v1.M, MemOperand(csp)),            \
-          "st4 {v30." S ", v31." S ", v0." S ", v1." S "}, [csp]")
+  COMPARE(St4(v30.M, v31.M, v0.M, v1.M, MemOperand(sp)),             \
+          "st4 {v30." S ", v31." S ", v0." S ", v1." S "}, [sp]")
   NEON_FORMAT_LIST(DISASM_INST);
 #undef DISASM_INST
 
-#define DISASM_INST(M, S)                                                 \
-  COMPARE(St1(v0.M, MemOperand(x15, x20, PostIndex)),                     \
-          "st1 {v0." S "}, [x15], x20");                                  \
-  COMPARE(St1(v1.M, v2.M, MemOperand(x16, x21, PostIndex)),               \
-          "st1 {v1." S ", v2." S "}, [x16], x21");                        \
-  COMPARE(St1(v3.M, v4.M, v5.M, MemOperand(x17, x22, PostIndex)),         \
-          "st1 {v3." S ", v4." S ", v5." S "}, [x17], x22");              \
-  COMPARE(St1(v6.M, v7.M, v8_.M, v9.M, MemOperand(x18, x23, PostIndex)),  \
-          "st1 {v6." S ", v7." S ", v8." S ", v9." S "}, [x18], x23")     \
-  COMPARE(St1(v30.M, v31.M, v0.M, v1.M, MemOperand(csp, x24, PostIndex)), \
-          "st1 {v30." S ", v31." S ", v0." S ", v1." S "}, [csp], x24")   \
-  COMPARE(St2(v1.M, v2.M, MemOperand(x16, x21, PostIndex)),               \
-          "st2 {v1." S ", v2." S "}, [x16], x21");                        \
-  COMPARE(St3(v3.M, v4.M, v5.M, MemOperand(x17, x22, PostIndex)),         \
-          "st3 {v3." S ", v4." S ", v5." S "}, [x17], x22");              \
-  COMPARE(St4(v6.M, v7.M, v8_.M, v9.M, MemOperand(x18, x23, PostIndex)),  \
-          "st4 {v6." S ", v7." S ", v8." S ", v9." S "}, [x18], x23")     \
-  COMPARE(St4(v30.M, v31.M, v0.M, v1.M, MemOperand(csp, x24, PostIndex)), \
-          "st4 {v30." S ", v31." S ", v0." S ", v1." S "}, [csp], x24")
+#define DISASM_INST(M, S)                                                \
+  COMPARE(St1(v0.M, MemOperand(x15, x20, PostIndex)),                    \
+          "st1 {v0." S "}, [x15], x20");                                 \
+  COMPARE(St1(v1.M, v2.M, MemOperand(x16, x21, PostIndex)),              \
+          "st1 {v1." S ", v2." S "}, [x16], x21");                       \
+  COMPARE(St1(v3.M, v4.M, v5.M, MemOperand(x17, x22, PostIndex)),        \
+          "st1 {v3." S ", v4." S ", v5." S "}, [x17], x22");             \
+  COMPARE(St1(v6.M, v7.M, v8_.M, v9.M, MemOperand(x18, x23, PostIndex)), \
+          "st1 {v6." S ", v7." S ", v8." S ", v9." S "}, [x18], x23")    \
+  COMPARE(St1(v30.M, v31.M, v0.M, v1.M, MemOperand(sp, x24, PostIndex)), \
+          "st1 {v30." S ", v31." S ", v0." S ", v1." S "}, [sp], x24")   \
+  COMPARE(St2(v1.M, v2.M, MemOperand(x16, x21, PostIndex)),              \
+          "st2 {v1." S ", v2." S "}, [x16], x21");                       \
+  COMPARE(St3(v3.M, v4.M, v5.M, MemOperand(x17, x22, PostIndex)),        \
+          "st3 {v3." S ", v4." S ", v5." S "}, [x17], x22");             \
+  COMPARE(St4(v6.M, v7.M, v8_.M, v9.M, MemOperand(x18, x23, PostIndex)), \
+          "st4 {v6." S ", v7." S ", v8." S ", v9." S "}, [x18], x23")    \
+  COMPARE(St4(v30.M, v31.M, v0.M, v1.M, MemOperand(sp, x24, PostIndex)), \
+          "st4 {v30." S ", v31." S ", v0." S ", v1." S "}, [sp], x24")
   NEON_FORMAT_LIST(DISASM_INST);
 #undef DISASM_INST
 
@@ -2357,7 +2360,7 @@ TEST(neon_load_store_lane) {
   COMPARE(Ld1(v10.H(), 7, MemOperand(x25)), "ld1 {v10.h}[7], [x25]");
   COMPARE(Ld1(v11.S(), 1, MemOperand(x26)), "ld1 {v11.s}[1], [x26]");
   COMPARE(Ld1(v12.S(), 3, MemOperand(x27)), "ld1 {v12.s}[3], [cp]");
-  COMPARE(Ld1(v13.D(), 1, MemOperand(csp)), "ld1 {v13.d}[1], [csp]");
+  COMPARE(Ld1(v13.D(), 1, MemOperand(sp)), "ld1 {v13.d}[1], [sp]");
 
   COMPARE(Ld1(v0.V8B(), 0, MemOperand(x15, x0, PostIndex)),
           "ld1 {v0.b}[0], [x15], x0");
@@ -2387,10 +2390,10 @@ TEST(neon_load_store_lane) {
           "ld1 {v12.s}[3], [cp], x5");
   COMPARE(Ld1(v12.S(), 3, MemOperand(x27, 4, PostIndex)),
           "ld1 {v12.s}[3], [cp], #4");
-  COMPARE(Ld1(v13.D(), 1, MemOperand(csp, x6, PostIndex)),
-          "ld1 {v13.d}[1], [csp], x6");
-  COMPARE(Ld1(v13.D(), 1, MemOperand(csp, 8, PostIndex)),
-          "ld1 {v13.d}[1], [csp], #8");
+  COMPARE(Ld1(v13.D(), 1, MemOperand(sp, x6, PostIndex)),
+          "ld1 {v13.d}[1], [sp], x6");
+  COMPARE(Ld1(v13.D(), 1, MemOperand(sp, 8, PostIndex)),
+          "ld1 {v13.d}[1], [sp], #8");
 
   COMPARE(Ld2(v0.V8B(), v1.V8B(), 0, MemOperand(x15)),
           "ld2 {v0.b, v1.b}[0], [x15]");
@@ -2418,8 +2421,8 @@ TEST(neon_load_store_lane) {
           "ld2 {v11.s, v12.s}[1], [x26]");
   COMPARE(Ld2(v12.S(), v13.S(), 3, MemOperand(x27)),
           "ld2 {v12.s, v13.s}[3], [cp]");
-  COMPARE(Ld2(v13.D(), v14.D(), 1, MemOperand(csp)),
-          "ld2 {v13.d, v14.d}[1], [csp]");
+  COMPARE(Ld2(v13.D(), v14.D(), 1, MemOperand(sp)),
+          "ld2 {v13.d, v14.d}[1], [sp]");
 
   COMPARE(Ld2(v0.V8B(), v1.V8B(), 0, MemOperand(x15, x0, PostIndex)),
           "ld2 {v0.b, v1.b}[0], [x15], x0");
@@ -2449,10 +2452,10 @@ TEST(neon_load_store_lane) {
           "ld2 {v12.s, v13.s}[3], [cp], x5");
   COMPARE(Ld2(v11.S(), v12.S(), 3, MemOperand(x26, 8, PostIndex)),
           "ld2 {v11.s, v12.s}[3], [x26], #8");
-  COMPARE(Ld2(v13.D(), v14.D(), 1, MemOperand(csp, x6, PostIndex)),
-          "ld2 {v13.d, v14.d}[1], [csp], x6");
-  COMPARE(Ld2(v13.D(), v14.D(), 1, MemOperand(csp, 16, PostIndex)),
-          "ld2 {v13.d, v14.d}[1], [csp], #16");
+  COMPARE(Ld2(v13.D(), v14.D(), 1, MemOperand(sp, x6, PostIndex)),
+          "ld2 {v13.d, v14.d}[1], [sp], x6");
+  COMPARE(Ld2(v13.D(), v14.D(), 1, MemOperand(sp, 16, PostIndex)),
+          "ld2 {v13.d, v14.d}[1], [sp], #16");
 
   COMPARE(Ld3(v0.V8B(), v1.V8B(), v2.V8B(), 0, MemOperand(x15)),
           "ld3 {v0.b, v1.b, v2.b}[0], [x15]");
@@ -2480,8 +2483,8 @@ TEST(neon_load_store_lane) {
           "ld3 {v11.s, v12.s, v13.s}[1], [x26]");
   COMPARE(Ld3(v12.S(), v13.S(), v14.S(), 3, MemOperand(x27)),
           "ld3 {v12.s, v13.s, v14.s}[3], [cp]");
-  COMPARE(Ld3(v13.D(), v14.D(), v15.D(), 1, MemOperand(csp)),
-          "ld3 {v13.d, v14.d, v15.d}[1], [csp]");
+  COMPARE(Ld3(v13.D(), v14.D(), v15.D(), 1, MemOperand(sp)),
+          "ld3 {v13.d, v14.d, v15.d}[1], [sp]");
 
   COMPARE(Ld3(v0.V8B(), v1.V8B(), v2.V8B(), 0, MemOperand(x15, x0, PostIndex)),
           "ld3 {v0.b, v1.b, v2.b}[0], [x15], x0");
@@ -2512,10 +2515,10 @@ TEST(neon_load_store_lane) {
           "ld3 {v12.s, v13.s, v14.s}[3], [cp], x5");
   COMPARE(Ld3(v12.S(), v13.S(), v14.S(), 3, MemOperand(x27, 12, PostIndex)),
           "ld3 {v12.s, v13.s, v14.s}[3], [cp], #12");
-  COMPARE(Ld3(v13.D(), v14.D(), v15.D(), 1, MemOperand(csp, x6, PostIndex)),
-          "ld3 {v13.d, v14.d, v15.d}[1], [csp], x6");
-  COMPARE(Ld3(v13.D(), v14.D(), v15.D(), 1, MemOperand(csp, 24, PostIndex)),
-          "ld3 {v13.d, v14.d, v15.d}[1], [csp], #24");
+  COMPARE(Ld3(v13.D(), v14.D(), v15.D(), 1, MemOperand(sp, x6, PostIndex)),
+          "ld3 {v13.d, v14.d, v15.d}[1], [sp], x6");
+  COMPARE(Ld3(v13.D(), v14.D(), v15.D(), 1, MemOperand(sp, 24, PostIndex)),
+          "ld3 {v13.d, v14.d, v15.d}[1], [sp], #24");
 
   COMPARE(Ld4(v0.V8B(), v1.V8B(), v2.V8B(), v3.V8B(), 0, MemOperand(x15)),
           "ld4 {v0.b, v1.b, v2.b, v3.b}[0], [x15]");
@@ -2543,8 +2546,8 @@ TEST(neon_load_store_lane) {
           "ld4 {v11.s, v12.s, v13.s, v14.s}[1], [x26]");
   COMPARE(Ld4(v12.S(), v13.S(), v14.S(), v15.S(), 3, MemOperand(x27)),
           "ld4 {v12.s, v13.s, v14.s, v15.s}[3], [cp]");
-  COMPARE(Ld4(v13.D(), v14.D(), v15.D(), v16.D(), 1, MemOperand(csp)),
-          "ld4 {v13.d, v14.d, v15.d, v16.d}[1], [csp]");
+  COMPARE(Ld4(v13.D(), v14.D(), v15.D(), v16.D(), 1, MemOperand(sp)),
+          "ld4 {v13.d, v14.d, v15.d, v16.d}[1], [sp]");
 
   COMPARE(Ld4(v0.V8B(), v1.V8B(), v2.V8B(), v3.V8B(), 0,
               MemOperand(x15, x0, PostIndex)),
@@ -2588,12 +2591,12 @@ TEST(neon_load_store_lane) {
   COMPARE(Ld4(v11.S(), v12.S(), v13.S(), v14.S(), 3,
               MemOperand(x26, 16, PostIndex)),
           "ld4 {v11.s, v12.s, v13.s, v14.s}[3], [x26], #16");
-  COMPARE(Ld4(v13.D(), v14.D(), v15.D(), v16.D(), 1,
-              MemOperand(csp, x6, PostIndex)),
-          "ld4 {v13.d, v14.d, v15.d, v16.d}[1], [csp], x6");
-  COMPARE(Ld4(v13.D(), v14.D(), v15.D(), v16.D(), 1,
-              MemOperand(csp, 32, PostIndex)),
-          "ld4 {v13.d, v14.d, v15.d, v16.d}[1], [csp], #32");
+  COMPARE(
+      Ld4(v13.D(), v14.D(), v15.D(), v16.D(), 1, MemOperand(sp, x6, PostIndex)),
+      "ld4 {v13.d, v14.d, v15.d, v16.d}[1], [sp], x6");
+  COMPARE(
+      Ld4(v13.D(), v14.D(), v15.D(), v16.D(), 1, MemOperand(sp, 32, PostIndex)),
+      "ld4 {v13.d, v14.d, v15.d, v16.d}[1], [sp], #32");
 
   COMPARE(St1(v0.V8B(), 0, MemOperand(x15)), "st1 {v0.b}[0], [x15]");
   COMPARE(St1(v1.V16B(), 1, MemOperand(x16)), "st1 {v1.b}[1], [x16]");
@@ -2608,7 +2611,7 @@ TEST(neon_load_store_lane) {
   COMPARE(St1(v10.H(), 7, MemOperand(x25)), "st1 {v10.h}[7], [x25]");
   COMPARE(St1(v11.S(), 1, MemOperand(x26)), "st1 {v11.s}[1], [x26]");
   COMPARE(St1(v12.S(), 3, MemOperand(x27)), "st1 {v12.s}[3], [cp]");
-  COMPARE(St1(v13.D(), 1, MemOperand(csp)), "st1 {v13.d}[1], [csp]");
+  COMPARE(St1(v13.D(), 1, MemOperand(sp)), "st1 {v13.d}[1], [sp]");
 
   COMPARE(St1(v0.V8B(), 0, MemOperand(x15, x0, PostIndex)),
           "st1 {v0.b}[0], [x15], x0");
@@ -2636,8 +2639,8 @@ TEST(neon_load_store_lane) {
           "st1 {v11.s}[1], [x26], #4");
   COMPARE(St1(v12.S(), 3, MemOperand(x27, x5, PostIndex)),
           "st1 {v12.s}[3], [cp], x5");
-  COMPARE(St1(v13.D(), 1, MemOperand(csp, x6, PostIndex)),
-          "st1 {v13.d}[1], [csp], x6");
+  COMPARE(St1(v13.D(), 1, MemOperand(sp, x6, PostIndex)),
+          "st1 {v13.d}[1], [sp], x6");
   COMPARE(St2(v0.V8B(), v1.V8B(), 0, MemOperand(x15, x0, PostIndex)),
           "st2 {v0.b, v1.b}[0], [x15], x0");
   COMPARE(St2(v1.V16B(), v2.V16B(), 1, MemOperand(x16, 2, PostIndex)),
@@ -2664,8 +2667,8 @@ TEST(neon_load_store_lane) {
           "st2 {v11.s, v12.s}[1], [x26], #8");
   COMPARE(St2(v12.S(), v13.S(), 3, MemOperand(x27, x5, PostIndex)),
           "st2 {v12.s, v13.s}[3], [cp], x5");
-  COMPARE(St2(v13.D(), v14.D(), 1, MemOperand(csp, x6, PostIndex)),
-          "st2 {v13.d, v14.d}[1], [csp], x6");
+  COMPARE(St2(v13.D(), v14.D(), 1, MemOperand(sp, x6, PostIndex)),
+          "st2 {v13.d, v14.d}[1], [sp], x6");
   COMPARE(St3(VLIST3(v0.V8B()), 0, MemOperand(x15, x0, PostIndex)),
           "st3 {v0.b, v1.b, v2.b}[0], [x15], x0");
   COMPARE(St3(VLIST3(v1.V16B()), 1, MemOperand(x16, 3, PostIndex)),
@@ -2692,8 +2695,8 @@ TEST(neon_load_store_lane) {
           "st3 {v11.s, v12.s, v13.s}[1], [x26], #12");
   COMPARE(St3(VLIST3(v12.S()), 3, MemOperand(x27, x5, PostIndex)),
           "st3 {v12.s, v13.s, v14.s}[3], [cp], x5");
-  COMPARE(St3(VLIST3(v13.D()), 1, MemOperand(csp, x6, PostIndex)),
-          "st3 {v13.d, v14.d, v15.d}[1], [csp], x6");
+  COMPARE(St3(VLIST3(v13.D()), 1, MemOperand(sp, x6, PostIndex)),
+          "st3 {v13.d, v14.d, v15.d}[1], [sp], x6");
 
   COMPARE(St4(VLIST4(v0.V8B()), 0, MemOperand(x15, x0, PostIndex)),
           "st4 {v0.b, v1.b, v2.b, v3.b}[0], [x15], x0");
@@ -2721,8 +2724,8 @@ TEST(neon_load_store_lane) {
           "st4 {v11.s, v12.s, v13.s, v14.s}[1], [x26], #16");
   COMPARE(St4(VLIST4(v12.S()), 3, MemOperand(x27, x5, PostIndex)),
           "st4 {v12.s, v13.s, v14.s, v15.s}[3], [cp], x5");
-  COMPARE(St4(VLIST4(v13.D()), 1, MemOperand(csp, x6, PostIndex)),
-          "st4 {v13.d, v14.d, v15.d, v16.d}[1], [csp], x6");
+  COMPARE(St4(VLIST4(v13.D()), 1, MemOperand(sp, x6, PostIndex)),
+          "st4 {v13.d, v14.d, v15.d, v16.d}[1], [sp], x6");
 
   CLEANUP();
 }
@@ -2810,7 +2813,7 @@ TEST(neon_load_all_lanes) {
   COMPARE(Ld1r(v17.V8H(), MemOperand(x3)), "ld1r {v17.8h}, [x3]");
   COMPARE(Ld1r(v18.V2S(), MemOperand(x4)), "ld1r {v18.2s}, [x4]");
   COMPARE(Ld1r(v19.V4S(), MemOperand(x5)), "ld1r {v19.4s}, [x5]");
-  COMPARE(Ld1r(v20.V2D(), MemOperand(csp)), "ld1r {v20.2d}, [csp]");
+  COMPARE(Ld1r(v20.V2D(), MemOperand(sp)), "ld1r {v20.2d}, [sp]");
   COMPARE(Ld1r(v21.V1D(), MemOperand(x30)), "ld1r {v21.1d}, [lr]");
 
   COMPARE(Ld1r(v22.V8B(), MemOperand(x6, 1, PostIndex)),
@@ -2842,8 +2845,8 @@ TEST(neon_load_all_lanes) {
           "ld2r {v18.2s, v19.2s}, [x4]");
   COMPARE(Ld2r(v19.V4S(), v20.V4S(), MemOperand(x5)),
           "ld2r {v19.4s, v20.4s}, [x5]");
-  COMPARE(Ld2r(v20.V2D(), v21.V2D(), MemOperand(csp)),
-          "ld2r {v20.2d, v21.2d}, [csp]");
+  COMPARE(Ld2r(v20.V2D(), v21.V2D(), MemOperand(sp)),
+          "ld2r {v20.2d, v21.2d}, [sp]");
   COMPARE(Ld2r(v21.V8B(), v22.V8B(), MemOperand(x6, 2, PostIndex)),
           "ld2r {v21.8b, v22.8b}, [x6], #2");
   COMPARE(Ld2r(v22.V16B(), v23.V16B(), MemOperand(x7, x16, PostIndex)),
@@ -2871,8 +2874,8 @@ TEST(neon_load_all_lanes) {
           "ld3r {v18.2s, v19.2s, v20.2s}, [x4]");
   COMPARE(Ld3r(v19.V4S(), v20.V4S(), v21.V4S(), MemOperand(x5)),
           "ld3r {v19.4s, v20.4s, v21.4s}, [x5]");
-  COMPARE(Ld3r(v20.V2D(), v21.V2D(), v22.V2D(), MemOperand(csp)),
-          "ld3r {v20.2d, v21.2d, v22.2d}, [csp]");
+  COMPARE(Ld3r(v20.V2D(), v21.V2D(), v22.V2D(), MemOperand(sp)),
+          "ld3r {v20.2d, v21.2d, v22.2d}, [sp]");
   COMPARE(Ld3r(v21.V8B(), v22.V8B(), v23.V8B(), MemOperand(x6, 3, PostIndex)),
           "ld3r {v21.8b, v22.8b, v23.8b}, [x6], #3");
   COMPARE(
@@ -2902,8 +2905,8 @@ TEST(neon_load_all_lanes) {
           "ld4r {v18.2s, v19.2s, v20.2s, v21.2s}, [x4]");
   COMPARE(Ld4r(v19.V4S(), v20.V4S(), v21.V4S(), v22.V4S(), MemOperand(x5)),
           "ld4r {v19.4s, v20.4s, v21.4s, v22.4s}, [x5]");
-  COMPARE(Ld4r(v20.V2D(), v21.V2D(), v22.V2D(), v23.V2D(), MemOperand(csp)),
-          "ld4r {v20.2d, v21.2d, v22.2d, v23.2d}, [csp]");
+  COMPARE(Ld4r(v20.V2D(), v21.V2D(), v22.V2D(), v23.V2D(), MemOperand(sp)),
+          "ld4r {v20.2d, v21.2d, v22.2d, v23.2d}, [sp]");
   COMPARE(Ld4r(v21.V8B(), v22.V8B(), v23.V8B(), v24.V8B(),
                MemOperand(x6, 4, PostIndex)),
           "ld4r {v21.8b, v22.8b, v23.8b, v24.8b}, [x6], #4");
@@ -4955,5 +4958,25 @@ TEST(neon_shift_immediate) {
   CLEANUP();
 }
 
+#undef TEST_
+#undef EXP_SIZE
+#undef INSTR_SIZE
+#undef SET_UP_MASM
+#undef SET_UP_ASM
+#undef COMPARE
+#undef COMPARE_PREFIX
+#undef CLEANUP
+#undef VLIST2
+#undef VLIST3
+#undef VLIST4
+#undef NEON_FORMAT_LIST
+#undef NEON_FORMAT_LIST_LP
+#undef NEON_FORMAT_LIST_LW
+#undef NEON_FORMAT_LIST_LW2
+#undef NEON_FORMAT_LIST_BHS
+#undef NEON_FORMAT_LIST_HS
+#undef NEON_FORMAT_LIST_FP
+#undef NEON_SCALAR_FORMAT_LIST
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-disasm-ia32.cc b/deps/v8/test/cctest/test-disasm-ia32.cc
index 35638c723a4..b5b61307290 100644
--- a/deps/v8/test/cctest/test-disasm-ia32.cc
+++ b/deps/v8/test/cctest/test-disasm-ia32.cc
@@ -42,7 +42,26 @@ namespace internal {
 
 #define __ assm.
 
-
+void Disassemble(FILE* f, byte* begin, byte* end) {
+  disasm::NameConverter converter;
+  disasm::Disassembler d(converter);
+  for (byte* pc = begin; pc < end;) {
+    v8::internal::EmbeddedVector<char, 128> buffer;
+    buffer[0] = '\0';
+    byte* prev_pc = pc;
+    pc += d.InstructionDecodeForTesting(buffer, pc);
+    fprintf(f, "%p", static_cast<void*>(prev_pc));
+    fprintf(f, "    ");
+
+    for (byte* bp = prev_pc; bp < pc; bp++) {
+      fprintf(f, "%02x", *bp);
+    }
+    for (int i = 6 - (pc - prev_pc); i >= 0; i--) {
+      fprintf(f, "  ");
+    }
+    fprintf(f, "  %s\n", buffer.start());
+  }
+}
 static void DummyStaticFunction(Object* result) {
 }
 
@@ -69,7 +88,7 @@ TEST(DisasmIa320) {
 
   // ---- All instructions that I can think of
   __ add(edx, ebx);
-  __ add(edx, Operand(12, RelocInfo::NONE32));
+  __ add(edx, Operand(12, RelocInfo::NONE));
   __ add(edx, Operand(ebx, 0));
   __ add(edx, Operand(ebx, 16));
   __ add(edx, Operand(ebx, 1999));
@@ -479,10 +498,10 @@ TEST(DisasmIa320) {
     __ minsd(xmm1, Operand(ebx, ecx, times_4, 10000));
     __ maxsd(xmm1, xmm0);
     __ maxsd(xmm1, Operand(ebx, ecx, times_4, 10000));
+    __ sqrtsd(xmm1, xmm0);
+    __ sqrtsd(xmm1, Operand(ebx, ecx, times_4, 10000));
     __ ucomisd(xmm0, xmm1);
     __ cmpltsd(xmm0, xmm1);
-    __ haddps(xmm1, xmm0);
-    __ haddps(xmm1, Operand(ebx, ecx, times_4, 10000));
 
     __ andpd(xmm0, xmm1);
 
@@ -532,6 +551,14 @@ TEST(DisasmIa320) {
     __ cmov(greater, eax, Operand(edx, 3));
   }
 
+  {
+    if (CpuFeatures::IsSupported(SSE3)) {
+      CpuFeatureScope scope(&assm, SSE3);
+      __ haddps(xmm1, xmm0);
+      __ haddps(xmm1, Operand(ebx, ecx, times_4, 10000));
+    }
+  }
+
 #define EMIT_SSE34_INSTR(instruction, notUsed1, notUsed2, notUsed3, notUsed4) \
   __ instruction(xmm5, xmm1);                                                 \
   __ instruction(xmm5, Operand(edx, 4));
@@ -546,6 +573,8 @@ TEST(DisasmIa320) {
   {
     if (CpuFeatures::IsSupported(SSE4_1)) {
       CpuFeatureScope scope(&assm, SSE4_1);
+      __ pblendw(xmm5, xmm1, 5);
+      __ pblendw(xmm5, Operand(edx, 4), 5);
       __ pextrb(eax, xmm0, 1);
       __ pextrb(Operand(edx, 4), xmm0, 1);
       __ pextrw(eax, xmm0, 1);
@@ -581,6 +610,8 @@ TEST(DisasmIa320) {
       __ vminsd(xmm0, xmm1, Operand(ebx, ecx, times_4, 10000));
       __ vmaxsd(xmm0, xmm1, xmm2);
       __ vmaxsd(xmm0, xmm1, Operand(ebx, ecx, times_4, 10000));
+      __ vsqrtsd(xmm0, xmm1, xmm2);
+      __ vsqrtsd(xmm0, xmm1, Operand(ebx, ecx, times_4, 10000));
 
       __ vaddss(xmm0, xmm1, xmm2);
       __ vaddss(xmm0, xmm1, Operand(ebx, ecx, times_4, 10000));
@@ -594,6 +625,8 @@ TEST(DisasmIa320) {
       __ vminss(xmm0, xmm1, Operand(ebx, ecx, times_4, 10000));
       __ vmaxss(xmm0, xmm1, xmm2);
       __ vmaxss(xmm0, xmm1, Operand(ebx, ecx, times_4, 10000));
+      __ vsqrtss(xmm0, xmm1, xmm2);
+      __ vsqrtss(xmm0, xmm1, Operand(ebx, ecx, times_4, 10000));
 
       __ vandps(xmm0, xmm1, xmm2);
       __ vandps(xmm0, xmm1, Operand(ebx, ecx, times_4, 10000));
@@ -618,6 +651,8 @@ TEST(DisasmIa320) {
       __ vmovaps(xmm0, xmm1);
       __ vshufps(xmm0, xmm1, xmm2, 3);
       __ vshufps(xmm0, xmm1, Operand(edx, 4), 3);
+      __ vhaddps(xmm0, xmm1, xmm2);
+      __ vhaddps(xmm0, xmm1, Operand(ebx, ecx, times_4, 10000));
 
       __ vcmpeqps(xmm5, xmm4, xmm1);
       __ vcmpeqps(xmm5, xmm4, Operand(ebx, ecx, times_4, 10000));
@@ -656,6 +691,8 @@ TEST(DisasmIa320) {
       __ vpshuflw(xmm5, Operand(edx, 4), 5);
       __ vpshufd(xmm5, xmm1, 5);
       __ vpshufd(xmm5, Operand(edx, 4), 5);
+      __ vpblendw(xmm5, xmm1, xmm0, 5);
+      __ vpblendw(xmm5, xmm1, Operand(edx, 4), 5);
       __ vpextrb(eax, xmm0, 1);
       __ vpextrb(Operand(edx, 4), xmm0, 1);
       __ vpextrw(eax, xmm0, 1);
@@ -865,7 +902,7 @@ TEST(DisasmIa320) {
   code->Print(os);
   byte* begin = code->instruction_start();
   byte* end = begin + code->instruction_size();
-  disasm::Disassembler::Disassemble(stdout, begin, end);
+  Disassemble(stdout, begin, end);
 #endif
 }
 
diff --git a/deps/v8/test/cctest/test-disasm-x64.cc b/deps/v8/test/cctest/test-disasm-x64.cc
index bbc1f894808..3371a4433b8 100644
--- a/deps/v8/test/cctest/test-disasm-x64.cc
+++ b/deps/v8/test/cctest/test-disasm-x64.cc
@@ -47,6 +47,26 @@ namespace internal {
 static void DummyStaticFunction(Object* result) {
 }
 
+void Disassemble(FILE* f, byte* begin, byte* end) {
+  disasm::NameConverter converter;
+  disasm::Disassembler d(converter);
+  for (byte* pc = begin; pc < end;) {
+    v8::internal::EmbeddedVector<char, 128> buffer;
+    buffer[0] = '\0';
+    byte* prev_pc = pc;
+    pc += d.InstructionDecodeForTesting(buffer, pc);
+    fprintf(f, "%p", static_cast<void*>(prev_pc));
+    fprintf(f, "    ");
+
+    for (byte* bp = prev_pc; bp < pc; bp++) {
+      fprintf(f, "%02x", *bp);
+    }
+    for (int i = 6 - static_cast<int>(pc - prev_pc); i >= 0; i--) {
+      fprintf(f, "  ");
+    }
+    fprintf(f, "  %s\n", buffer.start());
+  }
+}
 
 TEST(DisasmX64) {
   CcTest::InitializeVM();
@@ -413,6 +433,8 @@ TEST(DisasmX64) {
     __ maxss(xmm1, Operand(rbx, rcx, times_4, 10000));
     __ minss(xmm1, xmm0);
     __ minss(xmm1, Operand(rbx, rcx, times_4, 10000));
+    __ sqrtss(xmm1, xmm0);
+    __ sqrtss(xmm1, Operand(rbx, rcx, times_4, 10000));
     __ addps(xmm1, xmm0);
     __ addps(xmm1, Operand(rbx, rcx, times_4, 10000));
     __ subps(xmm1, xmm0);
@@ -454,9 +476,9 @@ TEST(DisasmX64) {
     __ minsd(xmm1, Operand(rbx, rcx, times_4, 10000));
     __ maxsd(xmm1, xmm0);
     __ maxsd(xmm1, Operand(rbx, rcx, times_4, 10000));
+    __ sqrtsd(xmm1, xmm0);
+    __ sqrtsd(xmm1, Operand(rbx, rcx, times_4, 10000));
     __ ucomisd(xmm0, xmm1);
-    __ haddps(xmm1, xmm0);
-    __ haddps(xmm1, Operand(rbx, rcx, times_4, 10000));
 
     __ andpd(xmm0, xmm1);
     __ andpd(xmm0, Operand(rbx, rcx, times_4, 10000));
@@ -510,6 +532,8 @@ TEST(DisasmX64) {
   {
     if (CpuFeatures::IsSupported(SSE3)) {
       CpuFeatureScope scope(&assm, SSE3);
+      __ haddps(xmm1, xmm0);
+      __ haddps(xmm1, Operand(rbx, rcx, times_4, 10000));
       __ lddqu(xmm1, Operand(rdx, 4));
     }
   }
@@ -615,6 +639,8 @@ TEST(DisasmX64) {
       __ vminss(xmm9, xmm1, Operand(rbx, rcx, times_8, 10000));
       __ vmaxss(xmm8, xmm1, xmm2);
       __ vmaxss(xmm9, xmm1, Operand(rbx, rcx, times_1, 10000));
+      __ vsqrtss(xmm8, xmm1, xmm2);
+      __ vsqrtss(xmm9, xmm1, Operand(rbx, rcx, times_1, 10000));
       __ vmovss(xmm9, Operand(r11, rcx, times_8, -10000));
       __ vmovss(Operand(rbx, r9, times_4, 10000), xmm1);
       __ vucomiss(xmm9, xmm1);
@@ -676,6 +702,8 @@ TEST(DisasmX64) {
       __ vandps(xmm9, xmm1, Operand(rbx, rcx, times_4, 10000));
       __ vxorps(xmm0, xmm1, xmm9);
       __ vxorps(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
+      __ vhaddps(xmm0, xmm1, xmm9);
+      __ vhaddps(xmm0, xmm1, Operand(rbx, rcx, times_4, 10000));
 
       __ vandpd(xmm0, xmm9, xmm2);
       __ vandpd(xmm9, xmm1, Operand(rbx, rcx, times_4, 10000));
@@ -960,7 +988,7 @@ TEST(DisasmX64) {
   code->Print(os);
   byte* begin = code->instruction_start();
   byte* end = begin + code->instruction_size();
-  disasm::Disassembler::Disassemble(stdout, begin, end);
+  Disassemble(stdout, begin, end);
 #endif
 }
 
diff --git a/deps/v8/test/cctest/test-extra.js b/deps/v8/test/cctest/test-extra.js
index 689738c02b3..9b17e401a22 100644
--- a/deps/v8/test/cctest/test-extra.js
+++ b/deps/v8/test/cctest/test-extra.js
@@ -23,7 +23,7 @@
 
   // Exercise all of the extras utils:
   // - v8.createPrivateSymbol
-  // - v8.simpleBind, v8.uncurryThis
+  // - v8.uncurryThis
   // - v8.InternalPackedArray
   // - v8.createPromise, v8.resolvePromise, v8.rejectPromise
 
@@ -35,7 +35,7 @@
   const apply = v8.uncurryThis(Function.prototype.apply);
 
   const Promise = global.Promise;
-  const Promise_resolve = v8.simpleBind(Promise.resolve, Promise);
+  const Promise_resolve = Promise.resolve.bind(Promise);
 
   const arrayToTest = new v8.InternalPackedArray();
   arrayToTest.push(1);
@@ -49,6 +49,22 @@
       arrayToTest[1] === 1 && slicedArray.length === 2 &&
       slicedArray[0] === "c" && slicedArray[1] === 1;
 
+  binding.testCreatePromise = function() {
+    return v8.createPromise();
+  }
+
+  binding.testCreatePromiseWithParent = function(parent) {
+    return v8.createPromise(parent);
+  }
+
+  binding.testRejectPromise = function(promise, reason) {
+    return v8.rejectPromise(promise, reason);
+  }
+
+  binding.testResolvePromise = function(promise, resolution) {
+    return v8.resolvePromise(promise, resolution);
+  }
+
   binding.testExtraCanUseUtils = function() {
     const fulfilledPromise = v8.createPromise();
     v8.resolvePromise(
diff --git a/deps/v8/test/cctest/test-feedback-vector.cc b/deps/v8/test/cctest/test-feedback-vector.cc
index e590b606490..781385cc633 100644
--- a/deps/v8/test/cctest/test-feedback-vector.cc
+++ b/deps/v8/test/cctest/test-feedback-vector.cc
@@ -95,7 +95,7 @@ TEST(VectorStructure) {
     CHECK_EQ(1,
              FeedbackMetadata::GetSlotSize(FeedbackSlotKind::kCreateClosure));
     FeedbackSlot slot = helper.slot(1);
-    Cell* cell = Cell::cast(vector->Get(slot));
+    FeedbackCell* cell = FeedbackCell::cast(vector->Get(slot));
     CHECK_EQ(cell->value(), *factory->undefined_value());
   }
 }
@@ -171,10 +171,8 @@ TEST(VectorCallICStates) {
   Handle<FeedbackVector> feedback_vector =
       Handle<FeedbackVector>(f->feedback_vector(), isolate);
   FeedbackSlot slot(0);
-  CallICNexus nexus(feedback_vector, slot);
+  FeedbackNexus nexus(feedback_vector, slot);
   CHECK_EQ(MONOMORPHIC, nexus.StateFromFeedback());
-  // CallIC doesn't return map feedback.
-  CHECK(!nexus.FindFirstMap());
 
   CompileRun("f(function() { return 16; })");
   CHECK_EQ(GENERIC, nexus.StateFromFeedback());
@@ -200,7 +198,7 @@ TEST(VectorCallFeedback) {
   Handle<FeedbackVector> feedback_vector =
       Handle<FeedbackVector>(f->feedback_vector(), isolate);
   FeedbackSlot slot(0);
-  CallICNexus nexus(feedback_vector, slot);
+  FeedbackNexus nexus(feedback_vector, slot);
 
   CHECK_EQ(MONOMORPHIC, nexus.StateFromFeedback());
   CHECK(nexus.GetFeedback()->IsWeakCell());
@@ -224,7 +222,7 @@ TEST(VectorCallFeedbackForArray) {
   Handle<FeedbackVector> feedback_vector =
       Handle<FeedbackVector>(f->feedback_vector(), isolate);
   FeedbackSlot slot(0);
-  CallICNexus nexus(feedback_vector, slot);
+  FeedbackNexus nexus(feedback_vector, slot);
 
   CHECK_EQ(MONOMORPHIC, nexus.StateFromFeedback());
   CHECK(nexus.GetFeedback()->IsWeakCell());
@@ -252,7 +250,7 @@ TEST(VectorCallCounts) {
   Handle<FeedbackVector> feedback_vector =
       Handle<FeedbackVector>(f->feedback_vector(), isolate);
   FeedbackSlot slot(0);
-  CallICNexus nexus(feedback_vector, slot);
+  FeedbackNexus nexus(feedback_vector, slot);
   CHECK_EQ(MONOMORPHIC, nexus.StateFromFeedback());
 
   CompileRun("f(foo); f(foo);");
@@ -281,7 +279,7 @@ TEST(VectorConstructCounts) {
       Handle<FeedbackVector>(f->feedback_vector(), isolate);
 
   FeedbackSlot slot(0);
-  CallICNexus nexus(feedback_vector, slot);
+  FeedbackNexus nexus(feedback_vector, slot);
   CHECK_EQ(MONOMORPHIC, nexus.StateFromFeedback());
 
   CHECK(feedback_vector->Get(slot)->IsWeakCell());
@@ -312,18 +310,20 @@ TEST(VectorSpeculationMode) {
       Handle<FeedbackVector>(f->feedback_vector(), isolate);
 
   FeedbackSlot slot(0);
-  CallICNexus nexus(feedback_vector, slot);
+  FeedbackNexus nexus(feedback_vector, slot);
   CHECK_EQ(SpeculationMode::kAllowSpeculation, nexus.GetSpeculationMode());
 
   CompileRun("f(Foo); f(Foo);");
   CHECK_EQ(3, nexus.GetCallCount());
   CHECK_EQ(SpeculationMode::kAllowSpeculation, nexus.GetSpeculationMode());
 
-  nexus.SetSpeculationMode(SpeculationMode::kAllowSpeculation);
   nexus.SetSpeculationMode(SpeculationMode::kDisallowSpeculation);
   CHECK_EQ(SpeculationMode::kDisallowSpeculation, nexus.GetSpeculationMode());
+  CHECK_EQ(3, nexus.GetCallCount());
+
   nexus.SetSpeculationMode(SpeculationMode::kAllowSpeculation);
   CHECK_EQ(SpeculationMode::kAllowSpeculation, nexus.GetSpeculationMode());
+  CHECK_EQ(3, nexus.GetCallCount());
 }
 
 TEST(VectorLoadICStates) {
@@ -342,7 +342,7 @@ TEST(VectorLoadICStates) {
   Handle<FeedbackVector> feedback_vector =
       Handle<FeedbackVector>(f->feedback_vector(), isolate);
   FeedbackSlot slot(0);
-  LoadICNexus nexus(feedback_vector, slot);
+  FeedbackNexus nexus(feedback_vector, slot);
   CHECK_EQ(PREMONOMORPHIC, nexus.StateFromFeedback());
 
   CompileRun("f(o)");
@@ -408,9 +408,9 @@ TEST(VectorLoadGlobalICSlotSharing) {
   FeedbackSlot slot1 = helper.slot(0);
   FeedbackSlot slot2 = helper.slot(1);
   CHECK_EQ(MONOMORPHIC,
-           LoadGlobalICNexus(feedback_vector, slot1).StateFromFeedback());
+           FeedbackNexus(feedback_vector, slot1).StateFromFeedback());
   CHECK_EQ(MONOMORPHIC,
-           LoadGlobalICNexus(feedback_vector, slot2).StateFromFeedback());
+           FeedbackNexus(feedback_vector, slot2).StateFromFeedback());
 }
 
 
@@ -431,7 +431,7 @@ TEST(VectorLoadICOnSmi) {
   Handle<FeedbackVector> feedback_vector =
       Handle<FeedbackVector>(f->feedback_vector(), isolate);
   FeedbackSlot slot(0);
-  LoadICNexus nexus(feedback_vector, slot);
+  FeedbackNexus nexus(feedback_vector, slot);
   CHECK_EQ(PREMONOMORPHIC, nexus.StateFromFeedback());
 
   CompileRun("f(34)");
@@ -495,11 +495,10 @@ TEST(ReferenceContextAllocatesNoSlots) {
     Handle<FeedbackVector> feedback_vector =
         handle(f->feedback_vector(), isolate);
     FeedbackVectorHelper helper(feedback_vector);
-    CHECK_EQ(4, helper.slot_count());
+    CHECK_EQ(3, helper.slot_count());
     CHECK_SLOT_KIND(helper, 0, FeedbackSlotKind::kStoreGlobalSloppy);
     CHECK_SLOT_KIND(helper, 1, FeedbackSlotKind::kLoadGlobalNotInsideTypeof);
-    CHECK_SLOT_KIND(helper, 2, FeedbackSlotKind::kStoreGlobalSloppy);
-    CHECK_SLOT_KIND(helper, 3, FeedbackSlotKind::kLoadGlobalNotInsideTypeof);
+    CHECK_SLOT_KIND(helper, 2, FeedbackSlotKind::kLoadGlobalNotInsideTypeof);
   }
 
   {
@@ -632,7 +631,7 @@ TEST(VectorStoreICBasic) {
   FeedbackVectorHelper helper(feedback_vector);
   CHECK_EQ(1, helper.slot_count());
   FeedbackSlot slot(0);
-  StoreICNexus nexus(feedback_vector, slot);
+  FeedbackNexus nexus(feedback_vector, slot);
   CHECK_EQ(MONOMORPHIC, nexus.StateFromFeedback());
 }
 
@@ -657,7 +656,7 @@ TEST(StoreOwnIC) {
   CHECK_EQ(2, helper.slot_count());
   CHECK_SLOT_KIND(helper, 0, FeedbackSlotKind::kLiteral);
   CHECK_SLOT_KIND(helper, 1, FeedbackSlotKind::kStoreOwnNamed);
-  StoreOwnICNexus nexus(feedback_vector, helper.slot(1));
+  FeedbackNexus nexus(feedback_vector, helper.slot(1));
   CHECK_EQ(MONOMORPHIC, nexus.StateFromFeedback());
 }
 
diff --git a/deps/v8/test/cctest/test-feedback-vector.h b/deps/v8/test/cctest/test-feedback-vector.h
index e36ed14a1bb..08215894773 100644
--- a/deps/v8/test/cctest/test-feedback-vector.h
+++ b/deps/v8/test/cctest/test-feedback-vector.h
@@ -5,6 +5,7 @@
 #ifndef V8_TEST_FEEDBACK_VECTOR_H_
 #define V8_TEST_FEEDBACK_VECTOR_H_
 
+#include "src/feedback-vector.h"
 #include "src/objects.h"
 #include "src/objects/shared-function-info.h"
 
@@ -42,8 +43,9 @@ class FeedbackVectorHelper {
 template <typename Spec>
 Handle<FeedbackVector> NewFeedbackVector(Isolate* isolate, Spec* spec) {
   Handle<FeedbackMetadata> metadata = FeedbackMetadata::New(isolate, spec);
-  Handle<SharedFunctionInfo> shared = isolate->factory()->NewSharedFunctionInfo(
-      isolate->factory()->empty_string(), MaybeHandle<Code>(), false);
+  Handle<SharedFunctionInfo> shared =
+      isolate->factory()->NewSharedFunctionInfoForBuiltin(
+          isolate->factory()->empty_string(), Builtins::kIllegal);
   shared->set_feedback_metadata(*metadata);
   return FeedbackVector::New(isolate, shared);
 }
diff --git a/deps/v8/test/cctest/test-field-type-tracking.cc b/deps/v8/test/cctest/test-field-type-tracking.cc
index 8736c9c5db1..9cc7606c295 100644
--- a/deps/v8/test/cctest/test-field-type-tracking.cc
+++ b/deps/v8/test/cctest/test-field-type-tracking.cc
@@ -1520,8 +1520,8 @@ TEST(ReconfigureDataFieldAttribute_DataConstantToDataFieldAfterTargetMap) {
       Handle<String> name = factory->empty_string();
       Handle<Map> sloppy_map =
           Map::CopyInitialMap(isolate->sloppy_function_map());
-      Handle<SharedFunctionInfo> info = factory->NewSharedFunctionInfo(
-          name, MaybeHandle<Code>(), sloppy_map->is_constructor());
+      Handle<SharedFunctionInfo> info =
+          factory->NewSharedFunctionInfoForBuiltin(name, Builtins::kIllegal);
       function_type_ = FieldType::Class(sloppy_map, isolate);
       CHECK(sloppy_map->is_stable());
 
@@ -2659,8 +2659,8 @@ TEST(TransitionDataConstantToAnotherDataConstant) {
   Factory* factory = isolate->factory();
   Handle<String> name = factory->empty_string();
   Handle<Map> sloppy_map = Map::CopyInitialMap(isolate->sloppy_function_map());
-  Handle<SharedFunctionInfo> info = factory->NewSharedFunctionInfo(
-      name, MaybeHandle<Code>(), sloppy_map->is_constructor());
+  Handle<SharedFunctionInfo> info =
+      factory->NewSharedFunctionInfoForBuiltin(name, Builtins::kIllegal);
   Handle<FieldType> function_type = FieldType::Class(sloppy_map, isolate);
   CHECK(sloppy_map->is_stable());
 
diff --git a/deps/v8/test/cctest/test-heap-profiler.cc b/deps/v8/test/cctest/test-heap-profiler.cc
index d9f919fbeeb..3d44c8567a6 100644
--- a/deps/v8/test/cctest/test-heap-profiler.cc
+++ b/deps/v8/test/cctest/test-heap-profiler.cc
@@ -35,6 +35,7 @@
 
 #include "include/v8-profiler.h"
 #include "src/api.h"
+#include "src/assembler-inl.h"
 #include "src/base/hashmap.h"
 #include "src/collector.h"
 #include "src/debug/debug.h"
@@ -98,7 +99,6 @@ class NamedEntriesDetector {
 
 static const v8::HeapGraphNode* GetGlobalObject(
     const v8::HeapSnapshot* snapshot) {
-  CHECK_EQ(2, snapshot->GetRoot()->GetChildrenCount());
   // The 0th-child is (GC Roots), 1st is the user root.
   const v8::HeapGraphNode* global_obj =
       snapshot->GetRoot()->GetChild(1)->GetToNode();
@@ -107,6 +107,32 @@ static const v8::HeapGraphNode* GetGlobalObject(
   return global_obj;
 }
 
+static const char* GetName(const v8::HeapGraphNode* node) {
+  return const_cast<i::HeapEntry*>(reinterpret_cast<const i::HeapEntry*>(node))
+      ->name();
+}
+
+static size_t GetSize(const v8::HeapGraphNode* node) {
+  return const_cast<i::HeapEntry*>(reinterpret_cast<const i::HeapEntry*>(node))
+      ->self_size();
+}
+
+static const v8::HeapGraphNode* GetChildByName(const v8::HeapGraphNode* node,
+                                               const char* name) {
+  for (int i = 0, count = node->GetChildrenCount(); i < count; ++i) {
+    const v8::HeapGraphNode* child = node->GetChild(i)->GetToNode();
+    if (!strcmp(name, GetName(child))) {
+      return child;
+    }
+  }
+  return nullptr;
+}
+
+static const v8::HeapGraphNode* GetRootChild(const v8::HeapSnapshot* snapshot,
+                                             const char* name) {
+  return GetChildByName(snapshot->GetRoot(), name);
+}
+
 static const v8::HeapGraphNode* GetProperty(v8::Isolate* isolate,
                                             const v8::HeapGraphNode* node,
                                             v8::HeapGraphEdge::Type type,
@@ -173,6 +199,11 @@ static bool ValidateSnapshot(const v8::HeapSnapshot* snapshot, int depth = 3) {
   return unretained_entries_count == 0;
 }
 
+bool EndsWith(const char* a, const char* b) {
+  size_t length_a = strlen(a);
+  size_t length_b = strlen(b);
+  return (length_a >= length_b) && !strcmp(a + length_a - length_b, b);
+}
 
 TEST(HeapSnapshot) {
   LocalContext env2;
@@ -334,29 +365,23 @@ TEST(HeapSnapshotCodeObjects) {
   v8::String::Utf8Value anonymous_name(env->GetIsolate(), anonymous->GetName());
   CHECK_EQ(0, strcmp("", *anonymous_name));
 
-  // Find references to code.
-  const v8::HeapGraphNode* compiled_code = GetProperty(
+  // Find references to shared function info.
+  const v8::HeapGraphNode* compiled_sfi = GetProperty(
       env->GetIsolate(), compiled, v8::HeapGraphEdge::kInternal, "shared");
-  CHECK(compiled_code);
-  const v8::HeapGraphNode* lazy_code = GetProperty(
+  CHECK(compiled_sfi);
+  const v8::HeapGraphNode* lazy_sfi = GetProperty(
       env->GetIsolate(), lazy, v8::HeapGraphEdge::kInternal, "shared");
-  CHECK(lazy_code);
+  CHECK(lazy_sfi);
 
-  // Check that there's no strong next_code_link. There might be a weak one
-  // but might be not, so we can't check that fact.
-  const v8::HeapGraphNode* code = GetProperty(
-      env->GetIsolate(), compiled_code, v8::HeapGraphEdge::kInternal, "code");
-  CHECK(code);
-  const v8::HeapGraphNode* next_code_link = GetProperty(
-      env->GetIsolate(), code, v8::HeapGraphEdge::kInternal, "code");
-  CHECK(!next_code_link);
+  // TODO(leszeks): Check that there's bytecode on the compiled function, but
+  // not the lazy function.
 
-  // Verify that non-compiled code doesn't contain references to "x"
-  // literal, while compiled code does. The scope info is stored in FixedArray
-  // objects attached to the SharedFunctionInfo.
+  // Verify that non-compiled function doesn't contain references to "x"
+  // literal, while compiled function does. The scope info is stored in
+  // FixedArray objects attached to the SharedFunctionInfo.
   bool compiled_references_x = false, lazy_references_x = false;
-  for (int i = 0, count = compiled_code->GetChildrenCount(); i < count; ++i) {
-    const v8::HeapGraphEdge* prop = compiled_code->GetChild(i);
+  for (int i = 0, count = compiled_sfi->GetChildrenCount(); i < count; ++i) {
+    const v8::HeapGraphEdge* prop = compiled_sfi->GetChild(i);
     const v8::HeapGraphNode* node = prop->GetToNode();
     if (node->GetType() == v8::HeapGraphNode::kArray) {
       if (HasString(env->GetIsolate(), node, "x")) {
@@ -365,8 +390,8 @@ TEST(HeapSnapshotCodeObjects) {
       }
     }
   }
-  for (int i = 0, count = lazy_code->GetChildrenCount(); i < count; ++i) {
-    const v8::HeapGraphEdge* prop = lazy_code->GetChild(i);
+  for (int i = 0, count = lazy_sfi->GetChildrenCount(); i < count; ++i) {
+    const v8::HeapGraphEdge* prop = lazy_sfi->GetChild(i);
     const v8::HeapGraphNode* node = prop->GetToNode();
     if (node->GetType() == v8::HeapGraphNode::kArray) {
       if (HasString(env->GetIsolate(), node, "x")) {
@@ -400,6 +425,28 @@ TEST(HeapSnapshotHeapNumbers) {
   CHECK_EQ(v8::HeapGraphNode::kHeapNumber, b->GetType());
 }
 
+TEST(HeapSnapshotHeapBigInts) {
+  // TODO(luoe): remove flag when it is on by default.
+  v8::internal::FLAG_harmony_bigint = true;
+
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
+  CompileRun(
+      "a = 1n;"
+      "b = Object(BigInt(2))");
+  const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
+  CHECK(ValidateSnapshot(snapshot));
+  const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
+  const v8::HeapGraphNode* a =
+      GetProperty(env->GetIsolate(), global, v8::HeapGraphEdge::kProperty, "a");
+  CHECK(a);
+  CHECK_EQ(v8::HeapGraphNode::kBigInt, a->GetType());
+  const v8::HeapGraphNode* b =
+      GetProperty(env->GetIsolate(), global, v8::HeapGraphEdge::kProperty, "b");
+  CHECK(b);
+  CHECK_EQ(v8::HeapGraphNode::kObject, b->GetType());
+}
 
 TEST(HeapSnapshotSlicedString) {
   if (!i::FLAG_string_slices) return;
@@ -694,6 +741,38 @@ TEST(HeapSnapshotInternalReferences) {
                     v8::HeapGraphEdge::kInternal, "1"));
 }
 
+TEST(HeapSnapshotEphemeron) {
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
+
+  CompileRun(
+      "class KeyClass{};\n"
+      "class ValueClass{};\n"
+      "var wm = new WeakMap();\n"
+      "function foo(key) { wm.set(key, new ValueClass()); }\n"
+      "var key = new KeyClass();\n"
+      "foo(key);");
+  const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
+  CHECK(ValidateSnapshot(snapshot));
+  const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
+
+  const v8::HeapGraphNode* key = GetProperty(
+      env->GetIsolate(), global, v8::HeapGraphEdge::kProperty, "key");
+  CHECK(key);
+  bool success = false;
+  for (int i = 0, count = key->GetChildrenCount(); i < count; ++i) {
+    const v8::HeapGraphEdge* edge = key->GetChild(i);
+    const v8::HeapGraphNode* child = edge->GetToNode();
+    if (!strcmp("ValueClass", GetName(child))) {
+      v8::String::Utf8Value edge_name(CcTest::isolate(), edge->GetName());
+      CHECK(EndsWith(*edge_name, " / WeakMap"));
+      success = true;
+      break;
+    }
+  }
+  CHECK(success);
+}
 
 TEST(HeapSnapshotAddressReuse) {
   LocalContext env;
@@ -1367,10 +1446,18 @@ namespace {
 class TestActivityControl : public v8::ActivityControl {
  public:
   explicit TestActivityControl(int abort_count)
-      : done_(0), total_(0), abort_count_(abort_count) {}
+      : done_(0),
+        total_(0),
+        abort_count_(abort_count),
+        reported_finish_(false) {}
   ControlOption ReportProgressValue(int done, int total) {
     done_ = done;
     total_ = total;
+    CHECK_LE(done_, total_);
+    if (done_ == total_) {
+      CHECK(!reported_finish_);
+      reported_finish_ = true;
+    }
     return --abort_count_ != 0 ? kContinue : kAbort;
   }
   int done() { return done_; }
@@ -1380,6 +1467,7 @@ class TestActivityControl : public v8::ActivityControl {
   int done_;
   int total_;
   int abort_count_;
+  bool reported_finish_;
 };
 
 }  // namespace
@@ -1408,72 +1496,88 @@ TEST(TakeHeapSnapshotAborting) {
   CHECK_GT(control.total(), 0);
 }
 
+TEST(TakeHeapSnapshotReportFinishOnce) {
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
+  TestActivityControl control(-1);
+  const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot(&control);
+  CHECK(ValidateSnapshot(snapshot));
+  CHECK_EQ(control.total(), control.done());
+  CHECK_GT(control.total(), 0);
+}
 
 namespace {
 
-class TestRetainedObjectInfo : public v8::RetainedObjectInfo {
+class EmbedderGraphBuilder : public v8::PersistentHandleVisitor {
  public:
-  TestRetainedObjectInfo(int hash,
-                         const char* group_label,
-                         const char* label,
-                         intptr_t element_count = -1,
-                         intptr_t size = -1)
-      : disposed_(false),
-        hash_(hash),
-        group_label_(group_label),
-        label_(label),
-        element_count_(element_count),
-        size_(size) {
-    instances.push_back(this);
-  }
-  virtual ~TestRetainedObjectInfo() {}
-  virtual void Dispose() {
-    CHECK(!disposed_);
-    disposed_ = true;
-  }
-  virtual bool IsEquivalent(RetainedObjectInfo* other) {
-    return GetHash() == other->GetHash();
-  }
-  virtual intptr_t GetHash() { return hash_; }
-  virtual const char* GetGroupLabel() { return group_label_; }
-  virtual const char* GetLabel() { return label_; }
-  virtual intptr_t GetElementCount() { return element_count_; }
-  virtual intptr_t GetSizeInBytes() { return size_; }
-  bool disposed() { return disposed_; }
-
-  static v8::RetainedObjectInfo* WrapperInfoCallback(
-      uint16_t class_id, v8::Local<v8::Value> wrapper) {
+  class Node : public v8::EmbedderGraph::Node {
+   public:
+    Node(const char* name, size_t size) : name_(name), size_(size) {}
+    // v8::EmbedderGraph::Node
+    const char* Name() override { return name_; }
+    size_t SizeInBytes() override { return size_; }
+
+   private:
+    const char* name_;
+    size_t size_;
+  };
+
+  class Group : public Node {
+   public:
+    explicit Group(const char* name) : Node(name, 0) {}
+    // v8::EmbedderGraph::EmbedderNode
+    bool IsRootNode() { return true; }
+  };
+
+  EmbedderGraphBuilder(v8::Isolate* isolate, v8::EmbedderGraph* graph)
+      : isolate_(isolate), graph_(graph) {
+    classid_to_group_[0] = nullptr;
+    classid_to_group_[1] =
+        graph->AddNode(std::unique_ptr<Group>(new Group("aaa-group")));
+    classid_to_group_[2] =
+        graph->AddNode(std::unique_ptr<Group>(new Group("ccc-group")));
+  }
+
+  static void BuildEmbedderGraph(v8::Isolate* isolate,
+                                 v8::EmbedderGraph* graph) {
+    EmbedderGraphBuilder builder(isolate, graph);
+    isolate->VisitHandlesWithClassIds(&builder);
+  }
+
+  void VisitPersistentHandle(v8::Persistent<v8::Value>* value,
+                             uint16_t class_id) override {
+    v8::Local<v8::Value> wrapper = v8::Local<v8::Value>::New(
+        isolate_, v8::Persistent<v8::Value>::Cast(*value));
     if (class_id == 1) {
       if (wrapper->IsString()) {
         v8::String::Utf8Value utf8(CcTest::isolate(), wrapper);
-        if (strcmp(*utf8, "AAA") == 0)
-          return new TestRetainedObjectInfo(1, "aaa-group", "aaa", 100);
-        else if (strcmp(*utf8, "BBB") == 0)
-          return new TestRetainedObjectInfo(1, "aaa-group", "aaa", 100);
+        DCHECK(!strcmp(*utf8, "AAA") || !strcmp(*utf8, "BBB"));
+        v8::EmbedderGraph::Node* node = graph_->V8Node(wrapper);
+        v8::EmbedderGraph::Node* group = classid_to_group_[1];
+        graph_->AddEdge(node, group);
+        graph_->AddEdge(group, node);
       }
     } else if (class_id == 2) {
       if (wrapper->IsString()) {
         v8::String::Utf8Value utf8(CcTest::isolate(), wrapper);
-        if (strcmp(*utf8, "CCC") == 0)
-          return new TestRetainedObjectInfo(2, "ccc-group", "ccc");
+        DCHECK(!strcmp(*utf8, "CCC"));
+        v8::EmbedderGraph::Node* node = graph_->V8Node(wrapper);
+        v8::EmbedderGraph::Node* group = classid_to_group_[2];
+        graph_->AddEdge(node, group);
+        graph_->AddEdge(group, node);
       }
+    } else {
+      UNREACHABLE();
     }
-    UNREACHABLE();
   }
 
-  static std::vector<TestRetainedObjectInfo*> instances;
-
  private:
-  bool disposed_;
-  int hash_;
-  const char* group_label_;
-  const char* label_;
-  intptr_t element_count_;
-  intptr_t size_;
+  v8::Isolate* isolate_;
+  v8::EmbedderGraph* graph_;
+  v8::EmbedderGraph::Node* classid_to_group_[3];
 };
 
-std::vector<TestRetainedObjectInfo*> TestRetainedObjectInfo::instances;
-
 }  // namespace
 
 
@@ -1498,58 +1602,37 @@ TEST(HeapSnapshotRetainedObjectInfo) {
   v8::HandleScope scope(isolate);
   v8::HeapProfiler* heap_profiler = isolate->GetHeapProfiler();
 
-  heap_profiler->SetWrapperClassInfoProvider(
-      1, TestRetainedObjectInfo::WrapperInfoCallback);
-  heap_profiler->SetWrapperClassInfoProvider(
-      2, TestRetainedObjectInfo::WrapperInfoCallback);
+  heap_profiler->SetBuildEmbedderGraphCallback(
+      EmbedderGraphBuilder::BuildEmbedderGraph);
   v8::Persistent<v8::String> p_AAA(isolate, v8_str("AAA"));
   p_AAA.SetWrapperClassId(1);
   v8::Persistent<v8::String> p_BBB(isolate, v8_str("BBB"));
   p_BBB.SetWrapperClassId(1);
   v8::Persistent<v8::String> p_CCC(isolate, v8_str("CCC"));
   p_CCC.SetWrapperClassId(2);
-  CHECK(TestRetainedObjectInfo::instances.empty());
   const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
   CHECK(ValidateSnapshot(snapshot));
 
-  CHECK_EQ(3, TestRetainedObjectInfo::instances.size());
-  for (TestRetainedObjectInfo* instance : TestRetainedObjectInfo::instances) {
-    CHECK(instance->disposed());
-    delete instance;
-  }
-
-  const v8::HeapGraphNode* native_group_aaa = GetNode(
-      snapshot->GetRoot(), v8::HeapGraphNode::kSynthetic, "aaa-group");
+  const v8::HeapGraphNode* native_group_aaa =
+      GetNode(snapshot->GetRoot(), v8::HeapGraphNode::kNative, "aaa-group");
   CHECK(native_group_aaa);
-  CHECK_EQ(1, native_group_aaa->GetChildrenCount());
-  const v8::HeapGraphNode* aaa = GetNode(
-      native_group_aaa, v8::HeapGraphNode::kNative, "aaa / 100 entries");
-  CHECK(aaa);
-  CHECK_EQ(2, aaa->GetChildrenCount());
-
-  const v8::HeapGraphNode* native_group_ccc = GetNode(
-      snapshot->GetRoot(), v8::HeapGraphNode::kSynthetic, "ccc-group");
-  const v8::HeapGraphNode* ccc = GetNode(
-      native_group_ccc, v8::HeapGraphNode::kNative, "ccc");
-  CHECK(ccc);
-
-  const v8::HeapGraphNode* n_AAA = GetNode(
-      aaa, v8::HeapGraphNode::kString, "AAA");
+  const v8::HeapGraphNode* native_group_ccc =
+      GetNode(snapshot->GetRoot(), v8::HeapGraphNode::kNative, "ccc-group");
+  CHECK(native_group_ccc);
+
+  const v8::HeapGraphNode* n_AAA =
+      GetNode(native_group_aaa, v8::HeapGraphNode::kString, "AAA");
   CHECK(n_AAA);
-  const v8::HeapGraphNode* n_BBB = GetNode(
-      aaa, v8::HeapGraphNode::kString, "BBB");
+  const v8::HeapGraphNode* n_BBB =
+      GetNode(native_group_aaa, v8::HeapGraphNode::kString, "BBB");
   CHECK(n_BBB);
-  CHECK_EQ(1, ccc->GetChildrenCount());
-  const v8::HeapGraphNode* n_CCC = GetNode(
-      ccc, v8::HeapGraphNode::kString, "CCC");
+  const v8::HeapGraphNode* n_CCC =
+      GetNode(native_group_ccc, v8::HeapGraphNode::kString, "CCC");
   CHECK(n_CCC);
 
-  CHECK_EQ(aaa, GetProperty(env->GetIsolate(), n_AAA,
-                            v8::HeapGraphEdge::kInternal, "native"));
-  CHECK_EQ(aaa, GetProperty(env->GetIsolate(), n_BBB,
-                            v8::HeapGraphEdge::kInternal, "native"));
-  CHECK_EQ(ccc, GetProperty(env->GetIsolate(), n_CCC,
-                            v8::HeapGraphEdge::kInternal, "native"));
+  CHECK_EQ(native_group_aaa, GetChildByName(n_AAA, "aaa-group"));
+  CHECK_EQ(native_group_aaa, GetChildByName(n_BBB, "aaa-group"));
+  CHECK_EQ(native_group_ccc, GetChildByName(n_CCC, "ccc-group"));
 }
 
 TEST(DeleteAllHeapSnapshots) {
@@ -2256,14 +2339,12 @@ TEST(AllocationSitesAreVisible) {
   const v8::HeapGraphNode* fun_code = GetProperty(
       env->GetIsolate(), global, v8::HeapGraphEdge::kProperty, "fun");
   CHECK(fun_code);
-  const v8::HeapGraphNode* vector_cell =
+  const v8::HeapGraphNode* feedback_cell =
       GetProperty(env->GetIsolate(), fun_code, v8::HeapGraphEdge::kInternal,
-                  "feedback_vector_cell");
-  // TODO(mvstanton): I'm not sure if this is the best way to expose
-  // literals. Is it too much to expose the Cell?
-  CHECK(vector_cell);
+                  "feedback_cell");
+  CHECK(feedback_cell);
   const v8::HeapGraphNode* vector = GetProperty(
-      env->GetIsolate(), vector_cell, v8::HeapGraphEdge::kInternal, "value");
+      env->GetIsolate(), feedback_cell, v8::HeapGraphEdge::kInternal, "value");
   CHECK_EQ(v8::HeapGraphNode::kArray, vector->GetType());
   CHECK_EQ(3, vector->GetChildrenCount());
 
@@ -2769,21 +2850,17 @@ TEST(JSPromise) {
   const v8::HeapGraphNode* resolved = GetProperty(
       env->GetIsolate(), global, v8::HeapGraphEdge::kProperty, "resolved");
   CHECK(GetProperty(env->GetIsolate(), resolved, v8::HeapGraphEdge::kInternal,
-                    "result"));
+                    "reactions_or_result"));
 
   const v8::HeapGraphNode* rejected = GetProperty(
       env->GetIsolate(), global, v8::HeapGraphEdge::kProperty, "rejected");
   CHECK(GetProperty(env->GetIsolate(), rejected, v8::HeapGraphEdge::kInternal,
-                    "result"));
+                    "reactions_or_result"));
 
   const v8::HeapGraphNode* pending = GetProperty(
       env->GetIsolate(), global, v8::HeapGraphEdge::kProperty, "pending");
   CHECK(GetProperty(env->GetIsolate(), pending, v8::HeapGraphEdge::kInternal,
-                    "deferred_promise"));
-  CHECK(GetProperty(env->GetIsolate(), pending, v8::HeapGraphEdge::kInternal,
-                    "fulfill_reactions"));
-  CHECK(GetProperty(env->GetIsolate(), pending, v8::HeapGraphEdge::kInternal,
-                    "reject_reactions"));
+                    "reactions_or_result"));
 
   const char* objectNames[] = {"resolved", "rejected", "pending", "chained"};
   for (auto objectName : objectNames) {
@@ -2793,11 +2870,244 @@ TEST(JSPromise) {
   }
 }
 
+TEST(HeapSnapshotScriptContext) {
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
+
+  CompileRun("class Foo{}; const foo = new Foo();");
+  const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
+  CHECK(ValidateSnapshot(snapshot));
+  const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
+  const v8::HeapGraphNode* native_context =
+      GetProperty(env->GetIsolate(), global, v8::HeapGraphEdge::kInternal,
+                  "native_context");
+  CHECK(native_context);
+  const v8::HeapGraphNode* script_context_table =
+      GetProperty(env->GetIsolate(), native_context,
+                  v8::HeapGraphEdge::kInternal, "script_context_table");
+  CHECK(script_context_table);
+  bool found_foo = false;
+  for (int i = 0, count = script_context_table->GetChildrenCount(); i < count;
+       ++i) {
+    const v8::HeapGraphNode* context =
+        script_context_table->GetChild(i)->GetToNode();
+    const v8::HeapGraphNode* foo = GetProperty(
+        env->GetIsolate(), context, v8::HeapGraphEdge::kContextVariable, "foo");
+    if (foo) {
+      found_foo = true;
+    }
+  }
+  CHECK(found_foo);
+}
+
+class EmbedderNode : public v8::EmbedderGraph::Node {
+ public:
+  EmbedderNode(const char* name, size_t size,
+               v8::EmbedderGraph::Node* wrapper_node = nullptr)
+      : name_(name), size_(size), wrapper_node_(wrapper_node) {}
+
+  // Graph::Node overrides.
+  const char* Name() override { return name_; }
+  size_t SizeInBytes() override { return size_; }
+  Node* WrapperNode() override { return wrapper_node_; }
+
+ private:
+  const char* name_;
+  size_t size_;
+  Node* wrapper_node_;
+};
+
+class EmbedderRootNode : public EmbedderNode {
+ public:
+  explicit EmbedderRootNode(const char* name) : EmbedderNode(name, 0) {}
+  // Graph::Node override.
+  bool IsRootNode() { return true; }
+};
+
+// Used to pass the global object to the BuildEmbedderGraph callback.
+// Otherwise, the callback has to iterate the global handles to find the
+// global object.
+v8::Local<v8::Value>* global_object_pointer;
+
+void BuildEmbedderGraph(v8::Isolate* v8_isolate, v8::EmbedderGraph* graph) {
+  using Node = v8::EmbedderGraph::Node;
+  Node* global_node = graph->V8Node(*global_object_pointer);
+  Node* embedder_node_A = graph->AddNode(
+      std::unique_ptr<Node>(new EmbedderNode("EmbedderNodeA", 10)));
+  Node* embedder_node_B = graph->AddNode(
+      std::unique_ptr<Node>(new EmbedderNode("EmbedderNodeB", 20)));
+  Node* embedder_node_C = graph->AddNode(
+      std::unique_ptr<Node>(new EmbedderNode("EmbedderNodeC", 30)));
+  Node* embedder_root = graph->AddNode(
+      std::unique_ptr<Node>(new EmbedderRootNode("EmbedderRoot")));
+  graph->AddEdge(global_node, embedder_node_A);
+  graph->AddEdge(embedder_node_A, embedder_node_B);
+  graph->AddEdge(embedder_root, embedder_node_C);
+  graph->AddEdge(embedder_node_C, global_node);
+}
+
+void CheckEmbedderGraphSnapshot(v8::Isolate* isolate,
+                                const v8::HeapSnapshot* snapshot) {
+  const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
+  const v8::HeapGraphNode* embedder_node_A =
+      GetChildByName(global, "EmbedderNodeA");
+  CHECK_EQ(10, GetSize(embedder_node_A));
+  const v8::HeapGraphNode* embedder_node_B =
+      GetChildByName(embedder_node_A, "EmbedderNodeB");
+  CHECK_EQ(20, GetSize(embedder_node_B));
+  const v8::HeapGraphNode* embedder_root =
+      GetRootChild(snapshot, "EmbedderRoot");
+  CHECK(embedder_root);
+  const v8::HeapGraphNode* embedder_node_C =
+      GetChildByName(embedder_root, "EmbedderNodeC");
+  CHECK_EQ(30, GetSize(embedder_node_C));
+  const v8::HeapGraphNode* global_reference =
+      GetChildByName(embedder_node_C, "Object");
+  CHECK(global_reference);
+}
+
+TEST(EmbedderGraph) {
+  i::FLAG_heap_profiler_use_embedder_graph = true;
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(env->GetIsolate());
+  v8::Local<v8::Value> global_object =
+      v8::Utils::ToLocal(i::Handle<i::JSObject>(
+          (isolate->context()->native_context()->global_object())));
+  global_object_pointer = &global_object;
+  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
+  heap_profiler->SetBuildEmbedderGraphCallback(BuildEmbedderGraph);
+  const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
+  CHECK(ValidateSnapshot(snapshot));
+  CheckEmbedderGraphSnapshot(env->GetIsolate(), snapshot);
+}
+
+TEST(StrongHandleAnnotation) {
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  v8::Persistent<v8::Object> handle1, handle2;
+  handle1.Reset(env->GetIsolate(), v8::Object::New(env->GetIsolate()));
+  handle2.Reset(env->GetIsolate(), v8::Object::New(env->GetIsolate()));
+  handle1.AnnotateStrongRetainer("my_label");
+  handle2.AnnotateStrongRetainer("my_label");
+  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
+  const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
+  const v8::HeapGraphNode* gc_roots = GetRootChild(snapshot, "(GC roots)");
+  CHECK(gc_roots);
+  const v8::HeapGraphNode* global_handles =
+      GetChildByName(gc_roots, "(Global handles)");
+  CHECK(global_handles);
+  int found = 0;
+  for (int i = 0, count = global_handles->GetChildrenCount(); i < count; ++i) {
+    const v8::HeapGraphEdge* edge = global_handles->GetChild(i);
+    v8::String::Utf8Value edge_name(CcTest::isolate(), edge->GetName());
+    if (EndsWith(*edge_name, "my_label")) ++found;
+  }
+  CHECK_EQ(2, found);
+}
+
+void BuildEmbedderGraphWithWrapperNode(v8::Isolate* v8_isolate,
+                                       v8::EmbedderGraph* graph) {
+  using Node = v8::EmbedderGraph::Node;
+  Node* global_node = graph->V8Node(*global_object_pointer);
+  Node* wrapper_node = graph->AddNode(
+      std::unique_ptr<Node>(new EmbedderNode("WrapperNode / TAG", 10)));
+  Node* embedder_node = graph->AddNode(std::unique_ptr<Node>(
+      new EmbedderNode("EmbedderNode", 10, wrapper_node)));
+  Node* other_node =
+      graph->AddNode(std::unique_ptr<Node>(new EmbedderNode("OtherNode", 20)));
+  graph->AddEdge(global_node, embedder_node);
+  graph->AddEdge(wrapper_node, other_node);
+
+  Node* wrapper_node2 = graph->AddNode(
+      std::unique_ptr<Node>(new EmbedderNode("WrapperNode2", 10)));
+  Node* embedder_node2 = graph->AddNode(std::unique_ptr<Node>(
+      new EmbedderNode("EmbedderNode2", 10, wrapper_node2)));
+  graph->AddEdge(global_node, embedder_node2);
+  graph->AddEdge(embedder_node2, wrapper_node2);
+  graph->AddEdge(wrapper_node2, other_node);
+}
+
+TEST(EmbedderGraphWithWrapperNode) {
+  i::FLAG_heap_profiler_use_embedder_graph = true;
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(env->GetIsolate());
+  v8::Local<v8::Value> global_object =
+      v8::Utils::ToLocal(i::Handle<i::JSObject>(
+          (isolate->context()->native_context()->global_object())));
+  global_object_pointer = &global_object;
+  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
+  heap_profiler->SetBuildEmbedderGraphCallback(
+      BuildEmbedderGraphWithWrapperNode);
+  const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
+  CHECK(ValidateSnapshot(snapshot));
+  const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
+  const v8::HeapGraphNode* embedder_node =
+      GetChildByName(global, "EmbedderNode / TAG");
+  const v8::HeapGraphNode* other_node =
+      GetChildByName(embedder_node, "OtherNode");
+  CHECK(other_node);
+  const v8::HeapGraphNode* wrapper_node =
+      GetChildByName(embedder_node, "WrapperNode / TAG");
+  CHECK(!wrapper_node);
+
+  const v8::HeapGraphNode* embedder_node2 =
+      GetChildByName(global, "EmbedderNode2");
+  other_node = GetChildByName(embedder_node2, "OtherNode");
+  CHECK(other_node);
+  const v8::HeapGraphNode* wrapper_node2 =
+      GetChildByName(embedder_node, "WrapperNode2");
+  CHECK(!wrapper_node2);
+}
+
+class EmbedderNodeWithPrefix : public v8::EmbedderGraph::Node {
+ public:
+  EmbedderNodeWithPrefix(const char* prefix, const char* name)
+      : prefix_(prefix), name_(name) {}
+
+  // Graph::Node overrides.
+  const char* Name() override { return name_; }
+  size_t SizeInBytes() override { return 0; }
+  const char* NamePrefix() override { return prefix_; }
+
+ private:
+  const char* prefix_;
+  const char* name_;
+};
+
+void BuildEmbedderGraphWithPrefix(v8::Isolate* v8_isolate,
+                                  v8::EmbedderGraph* graph) {
+  using Node = v8::EmbedderGraph::Node;
+  Node* global_node = graph->V8Node(*global_object_pointer);
+  Node* node = graph->AddNode(
+      std::unique_ptr<Node>(new EmbedderNodeWithPrefix("Detached", "Node")));
+  graph->AddEdge(global_node, node);
+}
+
+TEST(EmbedderGraphWithPrefix) {
+  i::FLAG_heap_profiler_use_embedder_graph = true;
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(env->GetIsolate());
+  v8::Local<v8::Value> global_object =
+      v8::Utils::ToLocal(i::Handle<i::JSObject>(
+          (isolate->context()->native_context()->global_object())));
+  global_object_pointer = &global_object;
+  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
+  heap_profiler->SetBuildEmbedderGraphCallback(BuildEmbedderGraphWithPrefix);
+  const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
+  CHECK(ValidateSnapshot(snapshot));
+  const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
+  const v8::HeapGraphNode* node = GetChildByName(global, "Detached Node");
+  CHECK(node);
+}
+
 static inline i::Address ToAddress(int n) {
   return reinterpret_cast<i::Address>(n);
 }
 
-
 TEST(AddressToTraceMap) {
   i::AddressToTraceMap map;
 
@@ -2880,6 +3190,16 @@ static void CheckNoZeroCountNodes(v8::AllocationProfile::Node* node) {
   }
 }
 
+static const char* simple_sampling_heap_profiler_script =
+    "var A = [];\n"
+    "function bar(size) { return new Array(size); }\n"
+    "var foo = function() {\n"
+    "  for (var i = 0; i < 1024; ++i) {\n"
+    "    A[i] = bar(1024);\n"
+    "  }\n"
+    "}\n"
+    "foo();";
+
 TEST(SamplingHeapProfiler) {
   v8::HandleScope scope(v8::Isolate::GetCurrent());
   LocalContext env;
@@ -2892,26 +3212,15 @@ TEST(SamplingHeapProfiler) {
   // Suppress randomness to avoid flakiness in tests.
   v8::internal::FLAG_sampling_heap_profiler_suppress_randomness = true;
 
-  const char* script_source =
-      "var A = [];\n"
-      "function bar(size) { return new Array(size); }\n"
-      "var foo = function() {\n"
-      "  for (var i = 0; i < 1024; ++i) {\n"
-      "    A[i] = bar(1024);\n"
-      "  }\n"
-      "}\n"
-      "foo();";
-
   // Sample should be empty if requested before sampling has started.
   {
     v8::AllocationProfile* profile = heap_profiler->GetAllocationProfile();
     CHECK_NULL(profile);
   }
 
-  int count_1024 = 0;
   {
     heap_profiler->StartSamplingHeapProfiler(1024);
-    CompileRun(script_source);
+    CompileRun(simple_sampling_heap_profiler_script);
 
     std::unique_ptr<v8::AllocationProfile> profile(
         heap_profiler->GetAllocationProfile());
@@ -2923,6 +3232,7 @@ TEST(SamplingHeapProfiler) {
     CHECK(node_bar);
 
     // Count the number of allocations we sampled from bar.
+    int count_1024 = 0;
     for (auto allocation : node_bar->allocations) {
       count_1024 += allocation.count;
     }
@@ -2936,40 +3246,6 @@ TEST(SamplingHeapProfiler) {
     CHECK_NULL(profile);
   }
 
-  // Sampling at a higher rate should give us similar numbers of objects.
-  {
-    heap_profiler->StartSamplingHeapProfiler(128);
-    CompileRun(script_source);
-
-    std::unique_ptr<v8::AllocationProfile> profile(
-        heap_profiler->GetAllocationProfile());
-    CHECK(profile);
-
-    const char* names[] = {"", "foo", "bar"};
-    auto node_bar = FindAllocationProfileNode(env->GetIsolate(), *profile,
-                                              ArrayVector(names));
-    CHECK(node_bar);
-
-    // Count the number of allocations we sampled from bar.
-    int count_128 = 0;
-    for (auto allocation : node_bar->allocations) {
-      count_128 += allocation.count;
-    }
-
-    // We should have similar unsampled counts of allocations. Though
-    // we will sample different numbers of objects at different rates,
-    // the unsampling process should produce similar final estimates
-    // at the true number of allocations. However, the process to
-    // determine these unsampled counts is probabilisitic so we need to
-    // account for error.
-    double max_count = std::max(count_128, count_1024);
-    double min_count = std::min(count_128, count_1024);
-    double percent_difference = (max_count - min_count) / min_count;
-    CHECK_LT(percent_difference, 0.15);
-
-    heap_profiler->StopSamplingHeapProfiler();
-  }
-
   // A more complicated test cases with deeper call graph and dynamically
   // generated function names.
   {
@@ -3013,6 +3289,77 @@ TEST(SamplingHeapProfiler) {
   }
 }
 
+TEST(SamplingHeapProfilerRateAgnosticEstimates) {
+  v8::HandleScope scope(v8::Isolate::GetCurrent());
+  LocalContext env;
+  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
+
+  // Turn off always_opt. Inlining can cause stack traces to be shorter than
+  // what we expect in this test.
+  v8::internal::FLAG_always_opt = false;
+
+  // Suppress randomness to avoid flakiness in tests.
+  v8::internal::FLAG_sampling_heap_profiler_suppress_randomness = true;
+
+  // stress_incremental_marking adds randomness to the test.
+  v8::internal::FLAG_stress_incremental_marking = false;
+
+  int count_1024 = 0;
+  {
+    heap_profiler->StartSamplingHeapProfiler(1024);
+    CompileRun(simple_sampling_heap_profiler_script);
+
+    std::unique_ptr<v8::AllocationProfile> profile(
+        heap_profiler->GetAllocationProfile());
+    CHECK(profile);
+
+    const char* names[] = {"", "foo", "bar"};
+    auto node_bar = FindAllocationProfileNode(env->GetIsolate(), *profile,
+                                              ArrayVector(names));
+    CHECK(node_bar);
+
+    // Count the number of allocations we sampled from bar.
+    for (auto allocation : node_bar->allocations) {
+      count_1024 += allocation.count;
+    }
+
+    heap_profiler->StopSamplingHeapProfiler();
+  }
+
+  // Sampling at a higher rate should give us similar numbers of objects.
+  {
+    heap_profiler->StartSamplingHeapProfiler(128);
+    CompileRun(simple_sampling_heap_profiler_script);
+
+    std::unique_ptr<v8::AllocationProfile> profile(
+        heap_profiler->GetAllocationProfile());
+    CHECK(profile);
+
+    const char* names[] = {"", "foo", "bar"};
+    auto node_bar = FindAllocationProfileNode(env->GetIsolate(), *profile,
+                                              ArrayVector(names));
+    CHECK(node_bar);
+
+    // Count the number of allocations we sampled from bar.
+    int count_128 = 0;
+    for (auto allocation : node_bar->allocations) {
+      count_128 += allocation.count;
+    }
+
+    // We should have similar unsampled counts of allocations. Though
+    // we will sample different numbers of objects at different rates,
+    // the unsampling process should produce similar final estimates
+    // at the true number of allocations. However, the process to
+    // determine these unsampled counts is probabilisitic so we need to
+    // account for error.
+    double max_count = std::max(count_128, count_1024);
+    double min_count = std::min(count_128, count_1024);
+    double percent_difference = (max_count - min_count) / min_count;
+    CHECK_LT(percent_difference, 0.15);
+
+    heap_profiler->StopSamplingHeapProfiler();
+  }
+}
 
 TEST(SamplingHeapProfilerApiAllocation) {
   v8::HandleScope scope(v8::Isolate::GetCurrent());
@@ -3161,6 +3508,17 @@ TEST(SamplingHeapProfilerLargeInterval) {
   heap_profiler->StopSamplingHeapProfiler();
 }
 
+TEST(HeapSnapshotPrototypeNotJSReceiver) {
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
+  CompileRun(
+      "function object() {}"
+      "object.prototype = 42;");
+  const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
+  CHECK(ValidateSnapshot(snapshot));
+}
+
 TEST(SamplingHeapProfilerSampleDuringDeopt) {
   i::FLAG_allow_natives_syntax = true;
 
@@ -3207,13 +3565,40 @@ TEST(SamplingHeapProfilerSampleDuringDeopt) {
   heap_profiler->StopSamplingHeapProfiler();
 }
 
-TEST(HeapSnapshotPrototypeNotJSReceiver) {
+TEST(WeakReference) {
+  v8::Isolate* isolate = CcTest::isolate();
+  i::Isolate* i_isolate = CcTest::i_isolate();
+  i::Factory* factory = i_isolate->factory();
+  i::HandleScope scope(i_isolate);
   LocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
-  CompileRun(
-      "function object() {}"
-      "object.prototype = 42;");
+
+  // Create a FeedbackVector.
+  v8::Local<v8::Script> script =
+      v8::Script::Compile(isolate->GetCurrentContext(),
+                          v8::String::NewFromUtf8(isolate, "function foo() {}",
+                                                  v8::NewStringType::kNormal)
+                              .ToLocalChecked())
+          .ToLocalChecked();
+  v8::MaybeLocal<v8::Value> value = script->Run(isolate->GetCurrentContext());
+  CHECK(!value.IsEmpty());
+
+  i::Handle<i::Object> obj = v8::Utils::OpenHandle(*script);
+  i::Handle<i::SharedFunctionInfo> shared_function =
+      i::Handle<i::SharedFunctionInfo>(i::JSFunction::cast(*obj)->shared());
+  i::Handle<i::FeedbackVector> fv = factory->NewFeedbackVector(shared_function);
+
+  // Create a Code.
+  i::Assembler assm(i_isolate, nullptr, 0);
+  assm.nop();  // supported on all architectures
+  i::CodeDesc desc;
+  assm.GetCode(i_isolate, &desc);
+  i::Handle<i::Code> code =
+      factory->NewCode(desc, i::Code::STUB, i::Handle<i::Code>());
+  CHECK(code->IsCode());
+
+  fv->set_optimized_code_weak_or_smi(i::HeapObjectReference::Weak(*code));
+
+  v8::HeapProfiler* heap_profiler = isolate->GetHeapProfiler();
   const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
   CHECK(ValidateSnapshot(snapshot));
 }
diff --git a/deps/v8/test/cctest/test-inobject-slack-tracking.cc b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
index be6a71b0e39..ec282746d53 100644
--- a/deps/v8/test/cctest/test-inobject-slack-tracking.cc
+++ b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
@@ -1142,6 +1142,8 @@ TEST(SubclassArrayBuiltinNoInlineNew) {
 TEST(SubclassTypedArrayBuiltin) {
   // Avoid eventual completion of in-object slack tracking.
   FLAG_always_opt = false;
+  // Make BigInt64Array/BigUint64Array available for testing.
+  FLAG_harmony_bigint = true;
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
 
diff --git a/deps/v8/test/cctest/test-isolate-independent-builtins.cc b/deps/v8/test/cctest/test-isolate-independent-builtins.cc
new file mode 100644
index 00000000000..c5e4efbd2d9
--- /dev/null
+++ b/deps/v8/test/cctest/test-isolate-independent-builtins.cc
@@ -0,0 +1,294 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "test/cctest/cctest.h"
+
+#include "src/assembler-inl.h"
+#include "src/handles-inl.h"
+#include "src/isolate.h"
+#include "src/macro-assembler-inl.h"
+#include "src/simulator.h"
+#include "src/snapshot/macros.h"
+#include "src/snapshot/snapshot.h"
+
+// To generate the binary files for the test function, enable this section and
+// run GenerateTestFunctionData once on each arch.
+#define GENERATE_TEST_FUNCTION_DATA false
+
+namespace v8 {
+namespace internal {
+namespace test_isolate_independent_builtins {
+
+#ifdef V8_EMBEDDED_BUILTINS
+UNINITIALIZED_TEST(VerifyBuiltinsIsolateIndependence) {
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  v8::Isolate* v8_isolate = v8::Isolate::New(create_params);
+
+  {
+    v8::Isolate::Scope isolate_scope(v8_isolate);
+    v8::internal::Isolate* isolate =
+        reinterpret_cast<v8::internal::Isolate*>(v8_isolate);
+    HandleScope handle_scope(isolate);
+
+    Snapshot::EnsureAllBuiltinsAreDeserialized(isolate);
+
+    // TODO(jgruber,v8:6666): Investigate CONST_POOL and VENEER_POOL kinds.
+    // CONST_POOL is currently relevant on {arm,arm64,mips,mips64,ppc,s390}.
+    //            Rumors are it will also become relevant on x64. My
+    //            understanding is that we should be fine if we ensure it
+    //            doesn't contain heap constants and we use pc-relative
+    //            addressing.
+    // VENEER_POOL is arm64-only. From what I've seen, jumps are pc-relative
+    //             and stay within the same code object and thus should be
+    //             isolate-independent.
+
+    // Build a white-list of all isolate-independent RelocInfo entry kinds.
+    constexpr int all_real_modes_mask =
+        (1 << (RelocInfo::LAST_REAL_RELOC_MODE + 1)) - 1;
+    constexpr int mode_mask =
+        all_real_modes_mask & ~RelocInfo::ModeMask(RelocInfo::COMMENT) &
+        ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) &
+        ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED) &
+        ~RelocInfo::ModeMask(RelocInfo::OFF_HEAP_TARGET) &
+        ~RelocInfo::ModeMask(RelocInfo::CONST_POOL) &
+        ~RelocInfo::ModeMask(RelocInfo::VENEER_POOL);
+    STATIC_ASSERT(RelocInfo::LAST_REAL_RELOC_MODE == RelocInfo::VENEER_POOL);
+    STATIC_ASSERT(RelocInfo::ModeMask(RelocInfo::COMMENT) ==
+                  (1 << RelocInfo::COMMENT));
+    STATIC_ASSERT(
+        mode_mask ==
+        (RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
+         RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
+         RelocInfo::ModeMask(RelocInfo::WASM_CONTEXT_REFERENCE) |
+         RelocInfo::ModeMask(RelocInfo::WASM_GLOBAL_HANDLE) |
+         RelocInfo::ModeMask(RelocInfo::WASM_CALL) |
+         RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL) |
+         RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
+         RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE)));
+
+    constexpr bool kVerbose = false;
+    bool found_mismatch = false;
+    for (int i = 0; i < Builtins::builtin_count; i++) {
+      Code* code = isolate->builtins()->builtin(i);
+
+      if (kVerbose) {
+        printf("%s %s\n", Builtins::KindNameOf(i),
+               isolate->builtins()->name(i));
+      }
+
+      bool is_isolate_independent = true;
+      for (RelocIterator it(code, mode_mask); !it.done(); it.next()) {
+        is_isolate_independent = false;
+
+#ifdef ENABLE_DISASSEMBLER
+        if (kVerbose) {
+          RelocInfo::Mode mode = it.rinfo()->rmode();
+          printf("  %s\n", RelocInfo::RelocModeName(mode));
+        }
+#endif
+      }
+
+      // Relaxed condition only checks whether the isolate-independent list is
+      // valid, not whether it is complete. This is to avoid constant work
+      // updating the list.
+      bool should_be_isolate_independent = Builtins::IsIsolateIndependent(i);
+      if (should_be_isolate_independent && !is_isolate_independent) {
+        found_mismatch = true;
+        printf("%s %s expected: %d, is: %d\n", Builtins::KindNameOf(i),
+               isolate->builtins()->name(i), should_be_isolate_independent,
+               is_isolate_independent);
+      }
+    }
+
+    CHECK(!found_mismatch);
+  }
+
+  v8_isolate->Dispose();
+}
+#endif  // V8_EMBEDDED_BUILTINS
+
+// V8_CC_MSVC is true for both MSVC and clang on windows. clang can handle
+// __asm__-style inline assembly but MSVC cannot, and thus we need a more
+// precise compiler detection that can distinguish between the two. clang on
+// windows sets both __clang__ and _MSC_VER, MSVC sets only _MSC_VER.
+#if defined(_MSC_VER) && !defined(__clang__)
+#define V8_COMPILER_IS_MSVC
+#endif
+
+#ifndef V8_COMPILER_IS_MSVC
+#if GENERATE_TEST_FUNCTION_DATA
+
+// Arch-specific defines.
+#if V8_TARGET_ARCH_IA32
+#define TEST_FUNCTION_FILE "f-ia32.bin"
+#elif V8_TARGET_ARCH_X64 && _WIN64
+#define TEST_FUNCTION_FILE "f-x64-win.bin"
+#elif V8_TARGET_ARCH_X64
+#define TEST_FUNCTION_FILE "f-x64.bin"
+#elif V8_TARGET_ARCH_ARM64
+#define TEST_FUNCTION_FILE "f-arm64.bin"
+#elif V8_TARGET_ARCH_ARM
+#define TEST_FUNCTION_FILE "f-arm.bin"
+#elif V8_TARGET_ARCH_PPC
+#define TEST_FUNCTION_FILE "f-ppc.bin"
+#elif V8_TARGET_ARCH_MIPS
+#define TEST_FUNCTION_FILE "f-mips.bin"
+#elif V8_TARGET_ARCH_MIPS64
+#define TEST_FUNCTION_FILE "f-mips64.bin"
+#elif V8_TARGET_ARCH_S390
+#define TEST_FUNCTION_FILE "f-s390.bin"
+#else
+#error "Unknown architecture."
+#endif
+
+#define __ masm.
+
+TEST(GenerateTestFunctionData) {
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  HandleScope scope(isolate);
+
+#if V8_TARGET_ARCH_IA32
+  v8::internal::byte buffer[256];
+  Assembler masm(isolate, buffer, sizeof(buffer));
+
+  __ mov(eax, Operand(esp, 4));
+  __ add(eax, Operand(esp, 8));
+  __ ret(0);
+#elif V8_TARGET_ARCH_X64
+  size_t allocated;
+  byte* buffer = AllocateAssemblerBuffer(&allocated);
+  Assembler masm(isolate, buffer, static_cast<int>(allocated));
+
+#ifdef _WIN64
+  static const Register arg1 = rcx;
+  static const Register arg2 = rdx;
+#else
+  static const Register arg1 = rdi;
+  static const Register arg2 = rsi;
+#endif
+
+  __ movq(rax, arg2);
+  __ addq(rax, arg1);
+  __ ret(0);
+#elif V8_TARGET_ARCH_ARM64
+  MacroAssembler masm(isolate, nullptr, 0,
+                      v8::internal::CodeObjectRequired::kYes);
+
+  __ Add(x0, x0, x1);
+  __ Ret();
+#elif V8_TARGET_ARCH_ARM
+  Assembler masm(isolate, nullptr, 0);
+
+  __ add(r0, r0, Operand(r1));
+  __ mov(pc, Operand(lr));
+#elif V8_TARGET_ARCH_PPC
+  Assembler masm(isolate, nullptr, 0);
+
+  __ function_descriptor();
+  __ add(r3, r3, r4);
+  __ blr();
+#elif V8_TARGET_ARCH_MIPS
+  MacroAssembler masm(isolate, nullptr, 0,
+                      v8::internal::CodeObjectRequired::kYes);
+
+  __ addu(v0, a0, a1);
+  __ jr(ra);
+  __ nop();
+#elif V8_TARGET_ARCH_MIPS64
+  MacroAssembler masm(isolate, nullptr, 0,
+                      v8::internal::CodeObjectRequired::kYes);
+
+  __ addu(v0, a0, a1);
+  __ jr(ra);
+  __ nop();
+#elif V8_TARGET_ARCH_S390
+  Assembler masm(isolate, nullptr, 0);
+
+  __ agr(r2, r3);
+  __ b(r14);
+#else  // Unknown architecture.
+#error "Unknown architecture."
+#endif  // Target architecture.
+
+  CodeDesc desc;
+  masm.GetCode(isolate, &desc);
+
+  std::ofstream of(TEST_FUNCTION_FILE, std::ios::out | std::ios::binary);
+  of.write(reinterpret_cast<char*>(desc.buffer), desc.instr_size);
+}
+#undef __
+#endif  // GENERATE_TEST_FUNCTION_DATA
+
+#if V8_TARGET_ARCH_IA32
+#define FUNCTION_BYTES \
+  ".byte 0x8b, 0x44, 0x24, 0x04, 0x03, 0x44, 0x24, 0x08, 0xc3\n"
+#elif V8_TARGET_ARCH_X64 && _WIN64
+#define FUNCTION_BYTES ".byte 0x48, 0x8b, 0xc2, 0x48, 0x03, 0xc1, 0xc3\n"
+#elif V8_TARGET_ARCH_X64
+#define FUNCTION_BYTES ".byte 0x48, 0x8b, 0xc6, 0x48, 0x03, 0xc7, 0xc3\n"
+#elif V8_TARGET_ARCH_ARM64
+#define FUNCTION_BYTES ".byte 0x00, 0x00, 0x01, 0x8b, 0xc0, 0x03, 0x5f, 0xd6\n"
+#elif V8_TARGET_ARCH_ARM
+#define FUNCTION_BYTES ".byte 0x01, 0x00, 0x80, 0xe0, 0x0e, 0xf0, 0xa0, 0xe1\n"
+#elif V8_TARGET_ARCH_PPC
+#if defined(V8_OS_AIX)
+#define FUNCTION_BYTES ".byte 0x7c, 0x64, 0x1a, 0x14, 0x4e, 0x80, 0x00, 0x20\n"
+#else
+#define FUNCTION_BYTES ".byte 0x14, 0x22, 0x63, 0x7c, 0x20, 0x00, 0x80, 0x4e\n"
+#endif
+#elif defined(V8_TARGET_ARCH_MIPS) || defined(V8_TARGET_ARCH_MIPS64)
+#if defined(V8_TARGET_BIG_ENDIAN)
+#define FUNCTION_BYTES                               \
+  ".byte 0x00, 0x85, 0x10, 0x21, 0x03, 0xe0, 0x00, " \
+  "0x08, 0x00, 0x00, 0x00, 0x00\n"
+#else
+#define FUNCTION_BYTES                               \
+  ".byte 0x21, 0x10, 0x85, 0x00, 0x08, 0x00, 0xe0, " \
+  "0x03, 0x00, 0x00, 0x00, 0x00\n"
+#endif
+#elif V8_TARGET_ARCH_S390
+#define FUNCTION_BYTES                               \
+  ".byte 0xb9, 0x08, 0x00, 0x23, 0x07, 0xfe\n"
+#else
+#error "Unknown architecture."
+#endif
+
+V8_EMBEDDED_RODATA_HEADER(test_string0_bytes)
+__asm__(".byte 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37\n"
+        ".byte 0x38, 0x39, 0x0a, 0x00\n");
+extern "C" V8_ALIGNED(16) const char test_string0_bytes[];
+
+V8_EMBEDDED_TEXT_HEADER(test_function0_bytes)
+__asm__(FUNCTION_BYTES);
+extern "C" V8_ALIGNED(16) const char test_function0_bytes[];
+// clang-format on
+
+// A historical note: We use .byte over .incbin since the latter leads to
+// complications involving generation of build-time dependencies.  Goma parses
+// #include statements, and clang has -MD/-MMD. Neither recognize .incbin.
+
+TEST(ByteInRodata) {
+  CHECK_EQ(0, std::strcmp("0123456789\n", test_string0_bytes));
+}
+
+TEST(ByteInText) {
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  auto f = GeneratedCode<int(int, int)>::FromAddress(
+      isolate, const_cast<char*>(test_function0_bytes));
+  CHECK_EQ(7, f.Call(3, 4));
+  CHECK_EQ(11, f.Call(5, 6));
+}
+#endif  // #ifndef V8_COMPILER_IS_MSVC
+#undef V8_COMPILER_IS_MSVC
+
+#undef FUNCTION_BYTES
+#undef GENERATE_TEST_FUNCTION_DATA
+#undef TEST_FUNCTION_FILE
+
+}  // namespace test_isolate_independent_builtins
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/test-log.cc b/deps/v8/test/cctest/test-log.cc
index 0579010292b..0138343112e 100644
--- a/deps/v8/test/cctest/test-log.cc
+++ b/deps/v8/test/cctest/test-log.cc
@@ -699,6 +699,8 @@ TEST(Issue539892) {
    private:
     void LogRecordedBuffer(i::AbstractCode* code, i::SharedFunctionInfo* shared,
                            const char* name, int length) override {}
+    void LogRecordedBuffer(const i::wasm::WasmCode* code, const char* name,
+                           int length) override {}
   } code_event_logger;
   SETUP_FLAGS();
   v8::Isolate::CreateParams create_params;
diff --git a/deps/v8/test/cctest/test-macro-assembler-mips.cc b/deps/v8/test/cctest/test-macro-assembler-mips.cc
index 66d6c4bf9d2..ccaa2142459 100644
--- a/deps/v8/test/cctest/test-macro-assembler-mips.cc
+++ b/deps/v8/test/cctest/test-macro-assembler-mips.cc
@@ -58,6 +58,16 @@ TEST(BYTESWAP) {
     int32_t r3;
     int32_t r4;
     int32_t r5;
+    int32_t t1;
+    int32_t t2;
+    int32_t t3;
+    int32_t t4;
+    int32_t t5;
+    int32_t p1;
+    int32_t p2;
+    int32_t p3;
+    int32_t p4;
+    int32_t p5;
   };
   T t;
 
@@ -66,27 +76,37 @@ TEST(BYTESWAP) {
   MacroAssembler* masm = &assembler;
 
   __ lw(a2, MemOperand(a0, offsetof(T, r1)));
-  __ nop();
+  __ ByteSwapSigned(a1, a2, 4);
+  __ sw(a2, MemOperand(a0, offsetof(T, p1)));
+  __ sw(a1, MemOperand(a0, offsetof(T, t1)));
   __ ByteSwapSigned(a2, a2, 4);
   __ sw(a2, MemOperand(a0, offsetof(T, r1)));
 
   __ lw(a2, MemOperand(a0, offsetof(T, r2)));
-  __ nop();
+  __ ByteSwapSigned(a1, a2, 2);
+  __ sw(a2, MemOperand(a0, offsetof(T, p2)));
+  __ sw(a1, MemOperand(a0, offsetof(T, t2)));
   __ ByteSwapSigned(a2, a2, 2);
   __ sw(a2, MemOperand(a0, offsetof(T, r2)));
 
   __ lw(a2, MemOperand(a0, offsetof(T, r3)));
-  __ nop();
+  __ ByteSwapSigned(a1, a2, 1);
+  __ sw(a2, MemOperand(a0, offsetof(T, p3)));
+  __ sw(a1, MemOperand(a0, offsetof(T, t3)));
   __ ByteSwapSigned(a2, a2, 1);
   __ sw(a2, MemOperand(a0, offsetof(T, r3)));
 
   __ lw(a2, MemOperand(a0, offsetof(T, r4)));
-  __ nop();
+  __ ByteSwapUnsigned(a1, a2, 1);
+  __ sw(a2, MemOperand(a0, offsetof(T, p4)));
+  __ sw(a1, MemOperand(a0, offsetof(T, t4)));
   __ ByteSwapUnsigned(a2, a2, 1);
   __ sw(a2, MemOperand(a0, offsetof(T, r4)));
 
   __ lw(a2, MemOperand(a0, offsetof(T, r5)));
-  __ nop();
+  __ ByteSwapUnsigned(a1, a2, 2);
+  __ sw(a2, MemOperand(a0, offsetof(T, p5)));
+  __ sw(a1, MemOperand(a0, offsetof(T, t5)));
   __ ByteSwapUnsigned(a2, a2, 2);
   __ sw(a2, MemOperand(a0, offsetof(T, r5)));
 
@@ -110,6 +130,18 @@ TEST(BYTESWAP) {
   CHECK_EQ(static_cast<int32_t>(0x9FFFFFFF), t.r3);
   CHECK_EQ(static_cast<int32_t>(0x9F000000), t.r4);
   CHECK_EQ(static_cast<int32_t>(0xDE2C0000), t.r5);
+
+  CHECK_EQ(t.t1, t.r1);
+  CHECK_EQ(t.t2, t.r2);
+  CHECK_EQ(t.t3, t.r3);
+  CHECK_EQ(t.t4, t.r4);
+  CHECK_EQ(t.t5, t.r5);
+
+  CHECK_EQ(static_cast<int32_t>(0x781A15C3), t.p1);
+  CHECK_EQ(static_cast<int32_t>(0x2CDE), t.p2);
+  CHECK_EQ(static_cast<int32_t>(0x9F), t.p3);
+  CHECK_EQ(static_cast<int32_t>(0x9F), t.p4);
+  CHECK_EQ(static_cast<int32_t>(0x2CDE), t.p5);
 }
 
 static void TestNaN(const char *code) {
@@ -556,403 +588,108 @@ static const std::vector<int32_t> overflow_int32_test_values() {
   return std::vector<int32_t>(&kValues[0], &kValues[arraysize(kValues)]);
 }
 
-enum OverflowBranchType {
-  kAddBranchOverflow,
-  kSubBranchOverflow,
-};
-
-struct OverflowRegisterCombination {
-  Register dst;
-  Register left;
-  Register right;
-  Register scratch;
-};
-
-static const std::vector<enum OverflowBranchType> overflow_branch_type() {
-  static const enum OverflowBranchType kValues[] = {kAddBranchOverflow,
-                                                    kSubBranchOverflow};
-  return std::vector<enum OverflowBranchType>(&kValues[0],
-                                              &kValues[arraysize(kValues)]);
-}
-
-static const std::vector<struct OverflowRegisterCombination>
-overflow_register_combination() {
-  static const struct OverflowRegisterCombination kValues[] = {
-      {t0, t1, t2, t3}, {t0, t0, t2, t3}, {t0, t1, t0, t3}, {t0, t1, t1, t3}};
-  return std::vector<struct OverflowRegisterCombination>(
-      &kValues[0], &kValues[arraysize(kValues)]);
-}
-
-template <typename T>
-static bool IsAddOverflow(T x, T y) {
-  DCHECK(std::numeric_limits<T>::is_integer);
-  T max = std::numeric_limits<T>::max();
-  T min = std::numeric_limits<T>::min();
-
-  return (x > 0 && y > (max - x)) || (x < 0 && y < (min - x));
-}
-
-template <typename T>
-static bool IsSubOverflow(T x, T y) {
-  DCHECK(std::numeric_limits<T>::is_integer);
-  T max = std::numeric_limits<T>::max();
-  T min = std::numeric_limits<T>::min();
-
-  return (y > 0 && x < (min + y)) || (y < 0 && x > (max + y));
-}
-
-template <typename IN_TYPE, typename Func>
-static bool runOverflow(IN_TYPE valLeft, IN_TYPE valRight,
-                        Func GenerateOverflowInstructions) {
-  typedef int32_t(F_CVT)(char* x0, int x1, int x2, int x3, int x4);
-
+TEST(OverflowInstructions) {
+  CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
-  HandleScope scope(isolate);
-  MacroAssembler assm(isolate, nullptr, 0,
-                      v8::internal::CodeObjectRequired::kYes);
-  MacroAssembler* masm = &assm;
-
-  GenerateOverflowInstructions(masm, valLeft, valRight);
-  __ jr(ra);
-  __ nop();
-
-  CodeDesc desc;
-  assm.GetCode(isolate, &desc);
-  Handle<Code> code =
-      isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
-
-  auto f = GeneratedCode<F_CVT>::FromCode(*code);
-
-  int32_t r = reinterpret_cast<int32_t>(f.Call(0, 0, 0, 0, 0));
-
-  DCHECK(r == 0 || r == 1);
-  return r;
-}
-
-TEST(BranchOverflowInt32BothLabelsTrampoline) {
-  if (!IsMipsArchVariant(kMips32r6)) return;
-  static const int kMaxBranchOffset = (1 << (18 - 1)) - 1;
-
-  FOR_INT32_INPUTS(i, overflow_int32_test_values) {
-    FOR_INT32_INPUTS(j, overflow_int32_test_values) {
-      FOR_ENUM_INPUTS(br, OverflowBranchType, overflow_branch_type) {
-        FOR_STRUCT_INPUTS(regComb, OverflowRegisterCombination,
-                          overflow_register_combination) {
-          int32_t ii = *i;
-          int32_t jj = *j;
-          enum OverflowBranchType branchType = *br;
-          struct OverflowRegisterCombination rc = *regComb;
-
-          // If left and right register are same then left and right
-          // test values must also be same, otherwise we skip the test
-          if (rc.left.code() == rc.right.code()) {
-            if (ii != jj) {
-              continue;
-            }
-          }
-
-          bool res1 = runOverflow<int32_t>(
-              ii, jj, [branchType, rc](MacroAssembler* masm, int32_t valLeft,
-                                       int32_t valRight) {
-                Label overflow, no_overflow, end;
-                __ li(rc.left, valLeft);
-                __ li(rc.right, valRight);
-                switch (branchType) {
-                  case kAddBranchOverflow:
-                    __ AddBranchOvf(rc.dst, rc.left, rc.right, &overflow,
-                                    &no_overflow, rc.scratch);
-                    break;
-                  case kSubBranchOverflow:
-                    __ SubBranchOvf(rc.dst, rc.left, rc.right, &overflow,
-                                    &no_overflow, rc.scratch);
-                    break;
-                }
-
-                Label done;
-                size_t nr_calls =
-                    kMaxBranchOffset / (2 * Instruction::kInstrSize) + 2;
-                for (size_t i = 0; i < nr_calls; ++i) {
-                  __ BranchShort(&done, eq, a0, Operand(a1));
-                }
-                __ bind(&done);
-
-                __ li(v0, 2);
-                __ Branch(&end);
-                __ bind(&overflow);
-                __ li(v0, 1);
-                __ Branch(&end);
-                __ bind(&no_overflow);
-                __ li(v0, 0);
-                __ bind(&end);
-              });
-
-          switch (branchType) {
-            case kAddBranchOverflow:
-              CHECK_EQ(IsAddOverflow<int32_t>(ii, jj), res1);
-              break;
-            case kSubBranchOverflow:
-              CHECK_EQ(IsSubOverflow<int32_t>(ii, jj), res1);
-              break;
-            default:
-              UNREACHABLE();
-          }
-        }
-      }
-    }
-  }
-}
+  HandleScope handles(isolate);
 
-TEST(BranchOverflowInt32BothLabels) {
-  FOR_INT32_INPUTS(i, overflow_int32_test_values) {
-    FOR_INT32_INPUTS(j, overflow_int32_test_values) {
-      FOR_ENUM_INPUTS(br, OverflowBranchType, overflow_branch_type) {
-        FOR_STRUCT_INPUTS(regComb, OverflowRegisterCombination,
-                          overflow_register_combination) {
-          int32_t ii = *i;
-          int32_t jj = *j;
-          enum OverflowBranchType branchType = *br;
-          struct OverflowRegisterCombination rc = *regComb;
-
-          // If left and right register are same then left and right
-          // test values must also be same, otherwise we skip the test
-          if (rc.left.code() == rc.right.code()) {
-            if (ii != jj) {
-              continue;
-            }
-          }
-
-          bool res1 = runOverflow<int32_t>(
-              ii, jj, [branchType, rc](MacroAssembler* masm, int32_t valLeft,
-                                       int32_t valRight) {
-                Label overflow, no_overflow, end;
-                __ li(rc.left, valLeft);
-                __ li(rc.right, valRight);
-                switch (branchType) {
-                  case kAddBranchOverflow:
-                    __ AddBranchOvf(rc.dst, rc.left, rc.right, &overflow,
-                                    &no_overflow, rc.scratch);
-                    break;
-                  case kSubBranchOverflow:
-                    __ SubBranchOvf(rc.dst, rc.left, rc.right, &overflow,
-                                    &no_overflow, rc.scratch);
-                    break;
-                }
-                __ li(v0, 2);
-                __ Branch(&end);
-                __ bind(&overflow);
-                __ li(v0, 1);
-                __ Branch(&end);
-                __ bind(&no_overflow);
-                __ li(v0, 0);
-                __ bind(&end);
-              });
-
-          bool res2 = runOverflow<int32_t>(
-              ii, jj, [branchType, rc](MacroAssembler* masm, int32_t valLeft,
-                                       int32_t valRight) {
-                Label overflow, no_overflow, end;
-                __ li(rc.left, valLeft);
-                switch (branchType) {
-                  case kAddBranchOverflow:
-                    __ AddBranchOvf(rc.dst, rc.left, Operand(valRight),
-                                    &overflow, &no_overflow, rc.scratch);
-                    break;
-                  case kSubBranchOverflow:
-                    __ SubBranchOvf(rc.dst, rc.left, Operand(valRight),
-                                    &overflow, &no_overflow, rc.scratch);
-                    break;
-                }
-                __ li(v0, 2);
-                __ Branch(&end);
-                __ bind(&overflow);
-                __ li(v0, 1);
-                __ Branch(&end);
-                __ bind(&no_overflow);
-                __ li(v0, 0);
-                __ bind(&end);
-              });
-
-          switch (branchType) {
-            case kAddBranchOverflow:
-              CHECK_EQ(IsAddOverflow<int32_t>(ii, jj), res1);
-              CHECK_EQ(IsAddOverflow<int32_t>(ii, jj), res2);
-              break;
-            case kSubBranchOverflow:
-              CHECK_EQ(IsSubOverflow<int32_t>(ii, jj), res1);
-              CHECK_EQ(IsSubOverflow<int32_t>(ii, jj), res2);
-              break;
-            default:
-              UNREACHABLE();
-          }
-        }
-      }
-    }
-  }
-}
+  struct T {
+    int32_t lhs;
+    int32_t rhs;
+    int32_t output_add;
+    int32_t output_add2;
+    int32_t output_sub;
+    int32_t output_sub2;
+    int32_t output_mul;
+    int32_t output_mul2;
+    int32_t overflow_add;
+    int32_t overflow_add2;
+    int32_t overflow_sub;
+    int32_t overflow_sub2;
+    int32_t overflow_mul;
+    int32_t overflow_mul2;
+  };
+  T t;
 
-TEST(BranchOverflowInt32LeftLabel) {
   FOR_INT32_INPUTS(i, overflow_int32_test_values) {
     FOR_INT32_INPUTS(j, overflow_int32_test_values) {
-      FOR_ENUM_INPUTS(br, OverflowBranchType, overflow_branch_type) {
-        FOR_STRUCT_INPUTS(regComb, OverflowRegisterCombination,
-                          overflow_register_combination) {
-          int32_t ii = *i;
-          int32_t jj = *j;
-          enum OverflowBranchType branchType = *br;
-          struct OverflowRegisterCombination rc = *regComb;
-
-          // If left and right register are same then left and right
-          // test values must also be same, otherwise we skip the test
-          if (rc.left.code() == rc.right.code()) {
-            if (ii != jj) {
-              continue;
-            }
-          }
-
-          bool res1 = runOverflow<int32_t>(
-              ii, jj, [branchType, rc](MacroAssembler* masm, int32_t valLeft,
-                                       int32_t valRight) {
-                Label overflow, end;
-                __ li(rc.left, valLeft);
-                __ li(rc.right, valRight);
-                switch (branchType) {
-                  case kAddBranchOverflow:
-                    __ AddBranchOvf(rc.dst, rc.left, rc.right, &overflow,
-                                    nullptr, rc.scratch);
-                    break;
-                  case kSubBranchOverflow:
-                    __ SubBranchOvf(rc.dst, rc.left, rc.right, &overflow,
-                                    nullptr, rc.scratch);
-                    break;
-                }
-                __ li(v0, 0);
-                __ Branch(&end);
-                __ bind(&overflow);
-                __ li(v0, 1);
-                __ bind(&end);
-              });
-
-          bool res2 = runOverflow<int32_t>(
-              ii, jj, [branchType, rc](MacroAssembler* masm, int32_t valLeft,
-                                       int32_t valRight) {
-                Label overflow, end;
-                __ li(rc.left, valLeft);
-                switch (branchType) {
-                  case kAddBranchOverflow:
-                    __ AddBranchOvf(rc.dst, rc.left, Operand(valRight),
-                                    &overflow, nullptr, rc.scratch);
-                    break;
-                  case kSubBranchOverflow:
-                    __ SubBranchOvf(rc.dst, rc.left, Operand(valRight),
-                                    &overflow, nullptr, rc.scratch);
-                    break;
-                }
-                __ li(v0, 0);
-                __ Branch(&end);
-                __ bind(&overflow);
-                __ li(v0, 1);
-                __ bind(&end);
-              });
-
-          switch (branchType) {
-            case kAddBranchOverflow:
-              CHECK_EQ(IsAddOverflow<int32_t>(ii, jj), res1);
-              CHECK_EQ(IsAddOverflow<int32_t>(ii, jj), res2);
-              break;
-            case kSubBranchOverflow:
-              CHECK_EQ(IsSubOverflow<int32_t>(ii, jj), res1);
-              CHECK_EQ(IsSubOverflow<int32_t>(ii, jj), res2);
-              break;
-            default:
-              UNREACHABLE();
-          }
-        }
+      int32_t ii = *i;
+      int32_t jj = *j;
+      int32_t expected_add, expected_sub, expected_mul;
+      bool expected_add_ovf, expected_sub_ovf, expected_mul_ovf;
+      MacroAssembler assembler(isolate, nullptr, 0,
+                               v8::internal::CodeObjectRequired::kYes);
+      MacroAssembler* masm = &assembler;
+
+      __ lw(t0, MemOperand(a0, offsetof(T, lhs)));
+      __ lw(t1, MemOperand(a0, offsetof(T, rhs)));
+
+      __ AddOverflow(t2, t0, Operand(t1), t3);
+      __ sw(t2, MemOperand(a0, offsetof(T, output_add)));
+      __ sw(t3, MemOperand(a0, offsetof(T, overflow_add)));
+      __ mov(t3, zero_reg);
+      __ AddOverflow(t0, t0, Operand(t1), t3);
+      __ sw(t0, MemOperand(a0, offsetof(T, output_add2)));
+      __ sw(t3, MemOperand(a0, offsetof(T, overflow_add2)));
+
+      __ lw(t0, MemOperand(a0, offsetof(T, lhs)));
+      __ lw(t1, MemOperand(a0, offsetof(T, rhs)));
+
+      __ SubOverflow(t2, t0, Operand(t1), t3);
+      __ sw(t2, MemOperand(a0, offsetof(T, output_sub)));
+      __ sw(t3, MemOperand(a0, offsetof(T, overflow_sub)));
+      __ mov(t3, zero_reg);
+      __ SubOverflow(t0, t0, Operand(t1), t3);
+      __ sw(t0, MemOperand(a0, offsetof(T, output_sub2)));
+      __ sw(t3, MemOperand(a0, offsetof(T, overflow_sub2)));
+
+      __ lw(t0, MemOperand(a0, offsetof(T, lhs)));
+      __ lw(t1, MemOperand(a0, offsetof(T, rhs)));
+
+      __ MulOverflow(t2, t0, Operand(t1), t3);
+      __ sw(t2, MemOperand(a0, offsetof(T, output_mul)));
+      __ sw(t3, MemOperand(a0, offsetof(T, overflow_mul)));
+      __ mov(t3, zero_reg);
+      __ MulOverflow(t0, t0, Operand(t1), t3);
+      __ sw(t0, MemOperand(a0, offsetof(T, output_mul2)));
+      __ sw(t3, MemOperand(a0, offsetof(T, overflow_mul2)));
+
+      __ jr(ra);
+      __ nop();
+
+      CodeDesc desc;
+      masm->GetCode(isolate, &desc);
+      Handle<Code> code =
+          isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
+      auto f = GeneratedCode<F3>::FromCode(*code);
+      t.lhs = ii;
+      t.rhs = jj;
+      f.Call(&t, 0, 0, 0, 0);
+
+      expected_add_ovf = base::bits::SignedAddOverflow32(ii, jj, &expected_add);
+      expected_sub_ovf = base::bits::SignedSubOverflow32(ii, jj, &expected_sub);
+      expected_mul_ovf = base::bits::SignedMulOverflow32(ii, jj, &expected_mul);
+
+      CHECK_EQ(expected_add_ovf, t.overflow_add < 0);
+      CHECK_EQ(expected_sub_ovf, t.overflow_sub < 0);
+      CHECK_EQ(expected_mul_ovf, t.overflow_mul != 0);
+
+      CHECK_EQ(t.overflow_add, t.overflow_add2);
+      CHECK_EQ(t.overflow_sub, t.overflow_sub2);
+      CHECK_EQ(t.overflow_mul, t.overflow_mul2);
+
+      CHECK_EQ(expected_add, t.output_add);
+      CHECK_EQ(expected_add, t.output_add2);
+      CHECK_EQ(expected_sub, t.output_sub);
+      CHECK_EQ(expected_sub, t.output_sub2);
+      if (!expected_mul_ovf) {
+        CHECK_EQ(expected_mul, t.output_mul);
+        CHECK_EQ(expected_mul, t.output_mul2);
       }
     }
   }
 }
 
-TEST(BranchOverflowInt32RightLabel) {
-  FOR_INT32_INPUTS(i, overflow_int32_test_values) {
-    FOR_INT32_INPUTS(j, overflow_int32_test_values) {
-      FOR_ENUM_INPUTS(br, OverflowBranchType, overflow_branch_type) {
-        FOR_STRUCT_INPUTS(regComb, OverflowRegisterCombination,
-                          overflow_register_combination) {
-          int32_t ii = *i;
-          int32_t jj = *j;
-          enum OverflowBranchType branchType = *br;
-          struct OverflowRegisterCombination rc = *regComb;
-
-          // If left and right register are same then left and right
-          // test values must also be same, otherwise we skip the test
-          if (rc.left.code() == rc.right.code()) {
-            if (ii != jj) {
-              continue;
-            }
-          }
-
-          bool res1 = runOverflow<int32_t>(
-              ii, jj, [branchType, rc](MacroAssembler* masm, int32_t valLeft,
-                                       int32_t valRight) {
-                Label no_overflow, end;
-                __ li(rc.left, valLeft);
-                __ li(rc.right, valRight);
-                switch (branchType) {
-                  case kAddBranchOverflow:
-                    __ AddBranchOvf(rc.dst, rc.left, rc.right, nullptr,
-                                    &no_overflow, rc.scratch);
-                    break;
-                  case kSubBranchOverflow:
-                    __ SubBranchOvf(rc.dst, rc.left, rc.right, nullptr,
-                                    &no_overflow, rc.scratch);
-                    break;
-                }
-                __ li(v0, 1);
-                __ Branch(&end);
-                __ bind(&no_overflow);
-                __ li(v0, 0);
-                __ bind(&end);
-              });
-
-          bool res2 = runOverflow<int32_t>(
-              ii, jj, [branchType, rc](MacroAssembler* masm, int32_t valLeft,
-                                       int32_t valRight) {
-                Label no_overflow, end;
-                __ li(rc.left, valLeft);
-                switch (branchType) {
-                  case kAddBranchOverflow:
-                    __ AddBranchOvf(rc.dst, rc.left, Operand(valRight), nullptr,
-                                    &no_overflow, rc.scratch);
-                    break;
-                  case kSubBranchOverflow:
-                    __ SubBranchOvf(rc.dst, rc.left, Operand(valRight), nullptr,
-                                    &no_overflow, rc.scratch);
-                    break;
-                }
-                __ li(v0, 1);
-                __ Branch(&end);
-                __ bind(&no_overflow);
-                __ li(v0, 0);
-                __ bind(&end);
-              });
-
-          switch (branchType) {
-            case kAddBranchOverflow:
-              CHECK_EQ(IsAddOverflow<int32_t>(ii, jj), res1);
-              CHECK_EQ(IsAddOverflow<int32_t>(ii, jj), res2);
-              break;
-            case kSubBranchOverflow:
-              CHECK_EQ(IsSubOverflow<int32_t>(ii, jj), res1);
-              CHECK_EQ(IsSubOverflow<int32_t>(ii, jj), res2);
-              break;
-            default:
-              UNREACHABLE();
-          }
-        }
-      }
-    }
-  }
-}
 
 TEST(min_max_nan) {
   CcTest::InitializeVM();
diff --git a/deps/v8/test/cctest/test-macro-assembler-mips64.cc b/deps/v8/test/cctest/test-macro-assembler-mips64.cc
index 2b199cb9c7b..5cc1d169770 100644
--- a/deps/v8/test/cctest/test-macro-assembler-mips64.cc
+++ b/deps/v8/test/cctest/test-macro-assembler-mips64.cc
@@ -785,326 +785,109 @@ static const std::vector<int64_t> overflow_int64_test_values() {
   return std::vector<int64_t>(&kValues[0], &kValues[arraysize(kValues)]);
 }
 
-enum OverflowBranchType {
-  kAddBranchOverflow,
-  kSubBranchOverflow,
-};
-
-struct OverflowRegisterCombination {
-  Register dst;
-  Register left;
-  Register right;
-  Register scratch;
-};
-
-static const std::vector<enum OverflowBranchType> overflow_branch_type() {
-  static const enum OverflowBranchType kValues[] = {kAddBranchOverflow,
-                                                    kSubBranchOverflow};
-  return std::vector<enum OverflowBranchType>(&kValues[0],
-                                              &kValues[arraysize(kValues)]);
-}
-
-static const std::vector<struct OverflowRegisterCombination>
-overflow_register_combination() {
-  static const struct OverflowRegisterCombination kValues[] = {
-      {t0, t1, t2, t3}, {t0, t0, t2, t3}, {t0, t1, t0, t3}, {t0, t1, t1, t3}};
-  return std::vector<struct OverflowRegisterCombination>(
-      &kValues[0], &kValues[arraysize(kValues)]);
-}
-
-template <typename T>
-static bool IsAddOverflow(T x, T y) {
-  DCHECK(std::numeric_limits<T>::is_integer);
-  T max = std::numeric_limits<T>::max();
-  T min = std::numeric_limits<T>::min();
-
-  return (x > 0 && y > (max - x)) || (x < 0 && y < (min - x));
-}
-
-template <typename T>
-static bool IsSubOverflow(T x, T y) {
-  DCHECK(std::numeric_limits<T>::is_integer);
-  T max = std::numeric_limits<T>::max();
-  T min = std::numeric_limits<T>::min();
-
-  return (y > 0 && x < (min + y)) || (y < 0 && x > (max + y));
-}
-
-template <typename IN_TYPE, typename Func>
-static bool runOverflow(IN_TYPE valLeft, IN_TYPE valRight,
-                        Func GenerateOverflowInstructions) {
-  typedef int64_t(F_CVT)(char* x0, int x1, int x2, int x3, int x4);
-
+TEST(OverflowInstructions) {
+  CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
-  HandleScope scope(isolate);
-  MacroAssembler assm(isolate, nullptr, 0,
-                      v8::internal::CodeObjectRequired::kYes);
-  MacroAssembler* masm = &assm;
-
-  GenerateOverflowInstructions(masm, valLeft, valRight);
-  __ jr(ra);
-  __ nop();
-
-  CodeDesc desc;
-  assm.GetCode(isolate, &desc);
-  Handle<Code> code =
-      isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
-
-  auto f = GeneratedCode<F_CVT>::FromCode(*code);
-
-  int64_t r = reinterpret_cast<int64_t>(f.Call(0, 0, 0, 0, 0));
-
-  DCHECK(r == 0 || r == 1);
-  return r;
-}
-
-TEST(BranchOverflowInt64BothLabels) {
-  FOR_INT64_INPUTS(i, overflow_int64_test_values) {
-    FOR_INT64_INPUTS(j, overflow_int64_test_values) {
-      FOR_ENUM_INPUTS(br, OverflowBranchType, overflow_branch_type) {
-        FOR_STRUCT_INPUTS(regComb, OverflowRegisterCombination,
-                          overflow_register_combination) {
-          int64_t ii = *i;
-          int64_t jj = *j;
-          enum OverflowBranchType branchType = *br;
-          struct OverflowRegisterCombination rc = *regComb;
-
-          // If left and right register are same then left and right
-          // test values must also be same, otherwise we skip the test
-          if (rc.left.code() == rc.right.code()) {
-            if (ii != jj) {
-              continue;
-            }
-          }
-
-          bool res1 = runOverflow<int64_t>(
-              ii, jj, [branchType, rc](MacroAssembler* masm, int64_t valLeft,
-                                       int64_t valRight) {
-                Label overflow, no_overflow, end;
-                __ li(rc.left, valLeft);
-                __ li(rc.right, valRight);
-                switch (branchType) {
-                  case kAddBranchOverflow:
-                    __ DaddBranchOvf(rc.dst, rc.left, rc.right, &overflow,
-                                     &no_overflow, rc.scratch);
-                    break;
-                  case kSubBranchOverflow:
-                    __ DsubBranchOvf(rc.dst, rc.left, rc.right, &overflow,
-                                     &no_overflow, rc.scratch);
-                    break;
-                }
-                __ li(v0, 2);
-                __ Branch(&end);
-                __ bind(&overflow);
-                __ li(v0, 1);
-                __ Branch(&end);
-                __ bind(&no_overflow);
-                __ li(v0, 0);
-                __ bind(&end);
-              });
-
-          bool res2 = runOverflow<int64_t>(
-              ii, jj, [branchType, rc](MacroAssembler* masm, int64_t valLeft,
-                                       int64_t valRight) {
-                Label overflow, no_overflow, end;
-                __ li(rc.left, valLeft);
-                switch (branchType) {
-                  case kAddBranchOverflow:
-                    __ DaddBranchOvf(rc.dst, rc.left, Operand(valRight),
-                                     &overflow, &no_overflow, rc.scratch);
-                    break;
-                  case kSubBranchOverflow:
-                    __ DsubBranchOvf(rc.dst, rc.left, Operand(valRight),
-                                     &overflow, &no_overflow, rc.scratch);
-                    break;
-                }
-                __ li(v0, 2);
-                __ Branch(&end);
-                __ bind(&overflow);
-                __ li(v0, 1);
-                __ Branch(&end);
-                __ bind(&no_overflow);
-                __ li(v0, 0);
-                __ bind(&end);
-              });
-
-          switch (branchType) {
-            case kAddBranchOverflow:
-              CHECK_EQ(IsAddOverflow<int64_t>(ii, jj), res1);
-              CHECK_EQ(IsAddOverflow<int64_t>(ii, jj), res2);
-              break;
-            case kSubBranchOverflow:
-              CHECK_EQ(IsSubOverflow<int64_t>(ii, jj), res1);
-              CHECK_EQ(IsSubOverflow<int64_t>(ii, jj), res2);
-              break;
-            default:
-              UNREACHABLE();
-          }
-        }
-      }
-    }
-  }
-}
+  HandleScope handles(isolate);
 
-TEST(BranchOverflowInt64LeftLabel) {
-  FOR_INT64_INPUTS(i, overflow_int64_test_values) {
-    FOR_INT64_INPUTS(j, overflow_int64_test_values) {
-      FOR_ENUM_INPUTS(br, OverflowBranchType, overflow_branch_type) {
-        FOR_STRUCT_INPUTS(regComb, OverflowRegisterCombination,
-                          overflow_register_combination) {
-          int64_t ii = *i;
-          int64_t jj = *j;
-          enum OverflowBranchType branchType = *br;
-          struct OverflowRegisterCombination rc = *regComb;
-
-          // If left and right register are same then left and right
-          // test values must also be same, otherwise we skip the test
-          if (rc.left.code() == rc.right.code()) {
-            if (ii != jj) {
-              continue;
-            }
-          }
-
-          bool res1 = runOverflow<int64_t>(
-              ii, jj, [branchType, rc](MacroAssembler* masm, int64_t valLeft,
-                                       int64_t valRight) {
-                Label overflow, end;
-                __ li(rc.left, valLeft);
-                __ li(rc.right, valRight);
-                switch (branchType) {
-                  case kAddBranchOverflow:
-                    __ DaddBranchOvf(rc.dst, rc.left, rc.right, &overflow,
-                                     nullptr, rc.scratch);
-                    break;
-                  case kSubBranchOverflow:
-                    __ DsubBranchOvf(rc.dst, rc.left, rc.right, &overflow,
-                                     nullptr, rc.scratch);
-                    break;
-                }
-                __ li(v0, 0);
-                __ Branch(&end);
-                __ bind(&overflow);
-                __ li(v0, 1);
-                __ bind(&end);
-              });
-
-          bool res2 = runOverflow<int64_t>(
-              ii, jj, [branchType, rc](MacroAssembler* masm, int64_t valLeft,
-                                       int64_t valRight) {
-                Label overflow, end;
-                __ li(rc.left, valLeft);
-                switch (branchType) {
-                  case kAddBranchOverflow:
-                    __ DaddBranchOvf(rc.dst, rc.left, Operand(valRight),
-                                     &overflow, nullptr, rc.scratch);
-                    break;
-                  case kSubBranchOverflow:
-                    __ DsubBranchOvf(rc.dst, rc.left, Operand(valRight),
-                                     &overflow, nullptr, rc.scratch);
-                    break;
-                }
-                __ li(v0, 0);
-                __ Branch(&end);
-                __ bind(&overflow);
-                __ li(v0, 1);
-                __ bind(&end);
-              });
-
-          switch (branchType) {
-            case kAddBranchOverflow:
-              CHECK_EQ(IsAddOverflow<int64_t>(ii, jj), res1);
-              CHECK_EQ(IsAddOverflow<int64_t>(ii, jj), res2);
-              break;
-            case kSubBranchOverflow:
-              CHECK_EQ(IsSubOverflow<int64_t>(ii, jj), res1);
-              CHECK_EQ(IsSubOverflow<int64_t>(ii, jj), res2);
-              break;
-            default:
-              UNREACHABLE();
-          }
-        }
-      }
-    }
-  }
-}
+  struct T {
+    int64_t lhs;
+    int64_t rhs;
+    int64_t output_add;
+    int64_t output_add2;
+    int64_t output_sub;
+    int64_t output_sub2;
+    int64_t output_mul;
+    int64_t output_mul2;
+    int64_t overflow_add;
+    int64_t overflow_add2;
+    int64_t overflow_sub;
+    int64_t overflow_sub2;
+    int64_t overflow_mul;
+    int64_t overflow_mul2;
+  };
+  T t;
 
-TEST(BranchOverflowInt64RightLabel) {
   FOR_INT64_INPUTS(i, overflow_int64_test_values) {
     FOR_INT64_INPUTS(j, overflow_int64_test_values) {
-      FOR_ENUM_INPUTS(br, OverflowBranchType, overflow_branch_type) {
-        FOR_STRUCT_INPUTS(regComb, OverflowRegisterCombination,
-                          overflow_register_combination) {
-          int64_t ii = *i;
-          int64_t jj = *j;
-          enum OverflowBranchType branchType = *br;
-          struct OverflowRegisterCombination rc = *regComb;
-
-          // If left and right register are same then left and right
-          // test values must also be same, otherwise we skip the test
-          if (rc.left.code() == rc.right.code()) {
-            if (ii != jj) {
-              continue;
-            }
-          }
-
-          bool res1 = runOverflow<int64_t>(
-              ii, jj, [branchType, rc](MacroAssembler* masm, int64_t valLeft,
-                                       int64_t valRight) {
-                Label no_overflow, end;
-                __ li(rc.left, valLeft);
-                __ li(rc.right, valRight);
-                switch (branchType) {
-                  case kAddBranchOverflow:
-                    __ DaddBranchOvf(rc.dst, rc.left, rc.right, nullptr,
-                                     &no_overflow, rc.scratch);
-                    break;
-                  case kSubBranchOverflow:
-                    __ DsubBranchOvf(rc.dst, rc.left, rc.right, nullptr,
-                                     &no_overflow, rc.scratch);
-                    break;
-                }
-                __ li(v0, 1);
-                __ Branch(&end);
-                __ bind(&no_overflow);
-                __ li(v0, 0);
-                __ bind(&end);
-              });
-
-          bool res2 = runOverflow<int64_t>(
-              ii, jj, [branchType, rc](MacroAssembler* masm, int64_t valLeft,
-                                       int64_t valRight) {
-                Label no_overflow, end;
-                __ li(rc.left, valLeft);
-                switch (branchType) {
-                  case kAddBranchOverflow:
-                    __ DaddBranchOvf(rc.dst, rc.left, Operand(valRight),
-                                     nullptr, &no_overflow, rc.scratch);
-                    break;
-                  case kSubBranchOverflow:
-                    __ DsubBranchOvf(rc.dst, rc.left, Operand(valRight),
-                                     nullptr, &no_overflow, rc.scratch);
-                    break;
-                }
-                __ li(v0, 1);
-                __ Branch(&end);
-                __ bind(&no_overflow);
-                __ li(v0, 0);
-                __ bind(&end);
-              });
-
-          switch (branchType) {
-            case kAddBranchOverflow:
-              CHECK_EQ(IsAddOverflow<int64_t>(ii, jj), res1);
-              CHECK_EQ(IsAddOverflow<int64_t>(ii, jj), res2);
-              break;
-            case kSubBranchOverflow:
-              CHECK_EQ(IsSubOverflow<int64_t>(ii, jj), res1);
-              CHECK_EQ(IsSubOverflow<int64_t>(ii, jj), res2);
-              break;
-            default:
-              UNREACHABLE();
-          }
-        }
+      int64_t ii = *i;
+      int64_t jj = *j;
+      int64_t expected_add, expected_sub;
+      int32_t ii32 = static_cast<int32_t>(ii);
+      int32_t jj32 = static_cast<int32_t>(jj);
+      int32_t expected_mul;
+      int64_t expected_add_ovf, expected_sub_ovf, expected_mul_ovf;
+      MacroAssembler assembler(isolate, nullptr, 0,
+                               v8::internal::CodeObjectRequired::kYes);
+      MacroAssembler* masm = &assembler;
+
+      __ ld(t0, MemOperand(a0, offsetof(T, lhs)));
+      __ ld(t1, MemOperand(a0, offsetof(T, rhs)));
+
+      __ DaddOverflow(t2, t0, Operand(t1), t3);
+      __ sd(t2, MemOperand(a0, offsetof(T, output_add)));
+      __ sd(t3, MemOperand(a0, offsetof(T, overflow_add)));
+      __ mov(t3, zero_reg);
+      __ DaddOverflow(t0, t0, Operand(t1), t3);
+      __ sd(t0, MemOperand(a0, offsetof(T, output_add2)));
+      __ sd(t3, MemOperand(a0, offsetof(T, overflow_add2)));
+
+      __ ld(t0, MemOperand(a0, offsetof(T, lhs)));
+      __ ld(t1, MemOperand(a0, offsetof(T, rhs)));
+
+      __ DsubOverflow(t2, t0, Operand(t1), t3);
+      __ sd(t2, MemOperand(a0, offsetof(T, output_sub)));
+      __ sd(t3, MemOperand(a0, offsetof(T, overflow_sub)));
+      __ mov(t3, zero_reg);
+      __ DsubOverflow(t0, t0, Operand(t1), t3);
+      __ sd(t0, MemOperand(a0, offsetof(T, output_sub2)));
+      __ sd(t3, MemOperand(a0, offsetof(T, overflow_sub2)));
+
+      __ ld(t0, MemOperand(a0, offsetof(T, lhs)));
+      __ ld(t1, MemOperand(a0, offsetof(T, rhs)));
+      __ sll(t0, t0, 0);
+      __ sll(t1, t1, 0);
+
+      __ MulOverflow(t2, t0, Operand(t1), t3);
+      __ sd(t2, MemOperand(a0, offsetof(T, output_mul)));
+      __ sd(t3, MemOperand(a0, offsetof(T, overflow_mul)));
+      __ mov(t3, zero_reg);
+      __ MulOverflow(t0, t0, Operand(t1), t3);
+      __ sd(t0, MemOperand(a0, offsetof(T, output_mul2)));
+      __ sd(t3, MemOperand(a0, offsetof(T, overflow_mul2)));
+
+      __ jr(ra);
+      __ nop();
+
+      CodeDesc desc;
+      masm->GetCode(isolate, &desc);
+      Handle<Code> code =
+          isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
+      auto f = GeneratedCode<F3>::FromCode(*code);
+      t.lhs = ii;
+      t.rhs = jj;
+      f.Call(&t, 0, 0, 0, 0);
+
+      expected_add_ovf = base::bits::SignedAddOverflow64(ii, jj, &expected_add);
+      expected_sub_ovf = base::bits::SignedSubOverflow64(ii, jj, &expected_sub);
+      expected_mul_ovf =
+          base::bits::SignedMulOverflow32(ii32, jj32, &expected_mul);
+
+      CHECK_EQ(expected_add_ovf, t.overflow_add < 0);
+      CHECK_EQ(expected_sub_ovf, t.overflow_sub < 0);
+      CHECK_EQ(expected_mul_ovf, t.overflow_mul != 0);
+
+      CHECK_EQ(t.overflow_add, t.overflow_add2);
+      CHECK_EQ(t.overflow_sub, t.overflow_sub2);
+      CHECK_EQ(t.overflow_mul, t.overflow_mul2);
+
+      CHECK_EQ(expected_add, t.output_add);
+      CHECK_EQ(expected_add, t.output_add2);
+      CHECK_EQ(expected_sub, t.output_sub);
+      CHECK_EQ(expected_sub, t.output_sub2);
+      if (!expected_mul_ovf) {
+        CHECK_EQ(expected_mul, t.output_mul);
+        CHECK_EQ(expected_mul, t.output_mul2);
       }
     }
   }
diff --git a/deps/v8/test/cctest/test-macro-assembler-x64.cc b/deps/v8/test/cctest/test-macro-assembler-x64.cc
index 6ace37c8b46..c9f601308f9 100644
--- a/deps/v8/test/cctest/test-macro-assembler-x64.cc
+++ b/deps/v8/test/cctest/test-macro-assembler-x64.cc
@@ -492,7 +492,7 @@ TEST(OperandOffset) {
   __ leaq(r13, Operand(rbp, -3 * kPointerSize));
   __ leaq(rbx, Operand(rbp, -5 * kPointerSize));
   __ movl(rcx, Immediate(2));
-  __ Move(r8, reinterpret_cast<Address>(&data[128]), RelocInfo::NONE64);
+  __ Move(r8, reinterpret_cast<Address>(&data[128]), RelocInfo::NONE);
   __ movl(rax, Immediate(1));
 
   Operand sp0 = Operand(rsp, 0);
diff --git a/deps/v8/test/cctest/test-parsing.cc b/deps/v8/test/cctest/test-parsing.cc
index 52a7d3ff7a9..725f40e6fbc 100644
--- a/deps/v8/test/cctest/test-parsing.cc
+++ b/deps/v8/test/cctest/test-parsing.cc
@@ -34,7 +34,6 @@
 #include "src/v8.h"
 
 #include "src/api.h"
-#include "src/ast/ast-numbering.h"
 #include "src/ast/ast-value-factory.h"
 #include "src/ast/ast.h"
 #include "src/compiler.h"
@@ -263,125 +262,6 @@ class ScriptResource : public v8::String::ExternalOneByteStringResource {
 };
 
 
-TEST(UsingCachedData) {
-  // Producing cached parser data while parsing eagerly is not supported.
-  if (!i::FLAG_lazy) return;
-
-  v8::Isolate* isolate = CcTest::isolate();
-  v8::HandleScope handles(isolate);
-  v8::Local<v8::Context> context = v8::Context::New(isolate);
-  v8::Context::Scope context_scope(context);
-  CcTest::i_isolate()->stack_guard()->SetStackLimit(
-      i::GetCurrentStackPosition() - 128 * 1024);
-
-  // Source containing functions that might be lazily compiled  and all types
-  // of symbols (string, propertyName, regexp).
-  const char* source =
-      "var x = 42;"
-      "function foo(a) { return function nolazy(b) { return a + b; } }"
-      "function bar(a) { if (a) return function lazy(b) { return b; } }"
-      "var z = {'string': 'string literal', bareword: 'propertyName', "
-      "         42: 'number literal', for: 'keyword as propertyName', "
-      "         f\\u006fr: 'keyword propertyname with escape'};"
-      "var v = /RegExp Literal/;"
-      "var w = /RegExp Literal\\u0020With Escape/gi;"
-      "var y = { get getter() { return 42; }, "
-      "          set setter(v) { this.value = v; }};"
-      "var f = a => function (b) { return a + b; };"
-      "var g = a => b => a + b;";
-  int source_length = i::StrLength(source);
-
-  // ScriptResource will be deleted when the corresponding String is GCd.
-  v8::ScriptCompiler::Source script_source(
-      v8::String::NewExternalOneByte(isolate,
-                                     new ScriptResource(source, source_length))
-          .ToLocalChecked());
-  v8::ScriptCompiler::Compile(isolate->GetCurrentContext(), &script_source,
-                              v8::ScriptCompiler::kProduceParserCache)
-      .ToLocalChecked();
-  CHECK(script_source.GetCachedData());
-
-  // Compile the script again, using the cached data.
-  bool lazy_flag = i::FLAG_lazy;
-  i::FLAG_lazy = true;
-  v8::ScriptCompiler::Compile(isolate->GetCurrentContext(), &script_source,
-                              v8::ScriptCompiler::kConsumeParserCache)
-      .ToLocalChecked();
-  i::FLAG_lazy = false;
-  v8::ScriptCompiler::CompileUnboundScript(
-      isolate, &script_source, v8::ScriptCompiler::kConsumeParserCache)
-      .ToLocalChecked();
-  i::FLAG_lazy = lazy_flag;
-}
-
-
-TEST(PreparseFunctionDataIsUsed) {
-  // Producing cached parser data while parsing eagerly is not supported.
-  if (!i::FLAG_lazy) return;
-
-  // This tests that we actually do use the function data generated by the
-  // preparser.
-
-  v8::Isolate* isolate = CcTest::isolate();
-  v8::HandleScope handles(isolate);
-  v8::Local<v8::Context> context = v8::Context::New(isolate);
-  v8::Context::Scope context_scope(context);
-  CcTest::i_isolate()->stack_guard()->SetStackLimit(
-      i::GetCurrentStackPosition() - 128 * 1024);
-
-  const char* good_code[] = {
-      "function z() { var a; } function f() { return 25; } f();",
-      "var z = function () { var a; }; function f() { return 25; } f();",
-      "function *z() { var a; } function f() { return 25; } f();",
-      "var z = function *() { var a; }; function f() { return 25; } f();",
-      "function z(p1, p2) { var a; } function f() { return 25; } f();",
-      "var z = function (p1, p2) { var a; }; function f() { return 25; } f();",
-      "function *z(p1, p2) { var a; } function f() { return 25; } f();",
-      "var z = function *(p1, p2) { var a; }; function f() { return 25; } f();",
-      "var z = () => { var a; }; function f() { return 25; } f();",
-      "var z = (p1, p2) => { var a; }; function f() { return 25; } f();",
-  };
-
-  // Insert a syntax error inside the lazy function.
-  const char* bad_code[] = {
-      "function z() { if (   } function f() { return 25; } f();",
-      "var z = function () { if (   }; function f() { return 25; } f();",
-      "function *z() { if (   } function f() { return 25; } f();",
-      "var z = function *() { if (   }; function f() { return 25; } f();",
-      "function z(p1, p2) { if (   } function f() { return 25; } f();",
-      "var z = function (p1, p2) { if (   }; function f() { return 25; } f();",
-      "function *z(p1, p2) { if (   } function f() { return 25; } f();",
-      "var z = function *(p1, p2) { if (   }; function f() { return 25; } f();",
-      "var z = () => { if (   }; function f() { return 25; } f();",
-      "var z = (p1, p2) => { if (   }; function f() { return 25; } f();",
-  };
-
-  for (unsigned i = 0; i < arraysize(good_code); i++) {
-    v8::ScriptCompiler::Source good_source(v8_str(good_code[i]));
-    v8::ScriptCompiler::Compile(isolate->GetCurrentContext(), &good_source,
-                                v8::ScriptCompiler::kProduceParserCache)
-        .ToLocalChecked();
-
-    const v8::ScriptCompiler::CachedData* cached_data =
-        good_source.GetCachedData();
-    CHECK_NOT_NULL(cached_data->data);
-    CHECK_GT(cached_data->length, 0);
-
-    // Now compile the erroneous code with the good preparse data. If the
-    // preparse data is used, the lazy function is skipped and it should
-    // compile fine.
-    v8::ScriptCompiler::Source bad_source(
-        v8_str(bad_code[i]), new v8::ScriptCompiler::CachedData(
-                                 cached_data->data, cached_data->length));
-    v8::Local<v8::Value> result =
-        CompileRun(isolate->GetCurrentContext(), &bad_source,
-                   v8::ScriptCompiler::kConsumeParserCache);
-    CHECK(result->IsInt32());
-    CHECK_EQ(25, result->Int32Value(isolate->GetCurrentContext()).FromJust());
-  }
-}
-
-
 TEST(StandAlonePreParser) {
   v8::V8::Initialize();
   i::Isolate* i_isolate = CcTest::i_isolate();
@@ -453,42 +333,6 @@ TEST(StandAlonePreParserNoNatives) {
 }
 
 
-TEST(PreparsingObjectLiterals) {
-  // Regression test for a bug where the symbol stream produced by PreParser
-  // didn't match what Parser wanted to consume.
-  v8::Isolate* isolate = CcTest::isolate();
-  v8::HandleScope handles(isolate);
-  v8::Local<v8::Context> context = v8::Context::New(isolate);
-  v8::Context::Scope context_scope(context);
-  CcTest::i_isolate()->stack_guard()->SetStackLimit(
-      i::GetCurrentStackPosition() - 128 * 1024);
-
-  {
-    const char* source = "var myo = {if: \"foo\"}; myo.if;";
-    v8::Local<v8::Value> result = ParserCacheCompileRun(source);
-    CHECK(result->IsString());
-    v8::String::Utf8Value utf8(isolate, result);
-    CHECK_EQ(0, strcmp("foo", *utf8));
-  }
-
-  {
-    const char* source = "var myo = {\"bar\": \"foo\"}; myo[\"bar\"];";
-    v8::Local<v8::Value> result = ParserCacheCompileRun(source);
-    CHECK(result->IsString());
-    v8::String::Utf8Value utf8(isolate, result);
-    CHECK_EQ(0, strcmp("foo", *utf8));
-  }
-
-  {
-    const char* source = "var myo = {1: \"foo\"}; myo[1];";
-    v8::Local<v8::Value> result = ParserCacheCompileRun(source);
-    CHECK(result->IsString());
-    v8::String::Utf8Value utf8(isolate, result);
-    CHECK_EQ(0, strcmp("foo", *utf8));
-  }
-}
-
-
 TEST(RegressChromium62639) {
   v8::V8::Initialize();
   i::Isolate* isolate = CcTest::i_isolate();
@@ -522,48 +366,6 @@ TEST(RegressChromium62639) {
 }
 
 
-TEST(Regress928) {
-  // Test only applies when lazy parsing.
-  if (!i::FLAG_lazy) return;
-
-  // Tests that the first non-toplevel function is not included in the preparse
-  // data.
-  const char* program =
-      "try { } catch (e) { var foo = function () { /* first */ } }"
-      "var bar = function () { /* second */ }";
-
-  v8::Isolate* isolate = CcTest::isolate();
-  v8::HandleScope handles(isolate);
-  v8::Local<v8::Context> context = v8::Context::New(isolate);
-  v8::Context::Scope context_scope(context);
-  v8::ScriptCompiler::Source script_source(v8_str(program));
-  v8::ScriptCompiler::Compile(context, &script_source,
-                              v8::ScriptCompiler::kProduceParserCache)
-      .ToLocalChecked();
-
-  const v8::ScriptCompiler::CachedData* cached_data =
-      script_source.GetCachedData();
-  i::ScriptData script_data(cached_data->data, cached_data->length);
-  std::unique_ptr<i::ParseData> pd(i::ParseData::FromCachedData(&script_data));
-  pd->Initialize();
-
-  int first_function =
-      static_cast<int>(strstr(program, "function") - program);
-  int first_lparen = first_function + i::StrLength("function ");
-  CHECK_EQ('(', program[first_lparen]);
-  i::FunctionEntry entry1 = pd->GetFunctionEntry(first_lparen);
-  CHECK(!entry1.is_valid());
-
-  int second_function =
-      static_cast<int>(strstr(program + first_lparen, "function") - program);
-  int second_lparen = second_function + i::StrLength("function ");
-  CHECK_EQ('(', program[second_lparen]);
-  i::FunctionEntry entry2 = pd->GetFunctionEntry(second_lparen);
-  CHECK(entry2.is_valid());
-  CHECK_EQ('}', program[entry2.end_pos() - 1]);
-}
-
-
 TEST(PreParseOverflow) {
   v8::V8::Initialize();
   i::Isolate* isolate = CcTest::i_isolate();
@@ -845,7 +647,7 @@ TEST(ScopeUsesArgumentsSuperThis) {
       CHECK(i::parsing::ParseProgram(&info, isolate));
       CHECK(i::Rewriter::Rewrite(&info));
       info.ast_value_factory()->Internalize(isolate);
-      i::DeclarationScope::Analyze(&info);
+      CHECK(i::DeclarationScope::Analyze(&info));
       i::DeclarationScope::AllocateScopeInfos(&info, isolate,
                                               i::AnalyzeMode::kRegular);
       CHECK_NOT_NULL(info.literal());
@@ -1313,7 +1115,6 @@ const char* ReadString(unsigned* start) {
 enum ParserFlag {
   kAllowLazy,
   kAllowNatives,
-  kAllowHarmonyFunctionSent,
   kAllowHarmonyPublicFields,
   kAllowHarmonyPrivateFields,
   kAllowHarmonyStaticFields,
@@ -1321,6 +1122,7 @@ enum ParserFlag {
   kAllowHarmonyImportMeta,
   kAllowHarmonyDoExpressions,
   kAllowHarmonyOptionalCatchBinding,
+  kAllowHarmonyNumericSeparator
 };
 
 enum ParserSyncTestResult {
@@ -1331,7 +1133,6 @@ enum ParserSyncTestResult {
 
 void SetGlobalFlags(i::EnumSet<ParserFlag> flags) {
   i::FLAG_allow_natives_syntax = flags.Contains(kAllowNatives);
-  i::FLAG_harmony_function_sent = flags.Contains(kAllowHarmonyFunctionSent);
   i::FLAG_harmony_public_fields = flags.Contains(kAllowHarmonyPublicFields);
   i::FLAG_harmony_private_fields = flags.Contains(kAllowHarmonyPrivateFields);
   i::FLAG_harmony_static_fields = flags.Contains(kAllowHarmonyStaticFields);
@@ -1340,12 +1141,12 @@ void SetGlobalFlags(i::EnumSet<ParserFlag> flags) {
   i::FLAG_harmony_do_expressions = flags.Contains(kAllowHarmonyDoExpressions);
   i::FLAG_harmony_optional_catch_binding =
       flags.Contains(kAllowHarmonyOptionalCatchBinding);
+  i::FLAG_harmony_numeric_separator =
+      flags.Contains(kAllowHarmonyNumericSeparator);
 }
 
 void SetParserFlags(i::PreParser* parser, i::EnumSet<ParserFlag> flags) {
   parser->set_allow_natives(flags.Contains(kAllowNatives));
-  parser->set_allow_harmony_function_sent(
-      flags.Contains(kAllowHarmonyFunctionSent));
   parser->set_allow_harmony_public_fields(
       flags.Contains(kAllowHarmonyPublicFields));
   parser->set_allow_harmony_private_fields(
@@ -1360,6 +1161,8 @@ void SetParserFlags(i::PreParser* parser, i::EnumSet<ParserFlag> flags) {
       flags.Contains(kAllowHarmonyDoExpressions));
   parser->set_allow_harmony_optional_catch_binding(
       flags.Contains(kAllowHarmonyOptionalCatchBinding));
+  parser->set_allow_harmony_numeric_separator(
+      flags.Contains(kAllowHarmonyNumericSeparator));
 }
 
 void TestParserSyncWithFlags(i::Handle<i::String> source,
@@ -1479,7 +1282,10 @@ void TestParserSync(const char* source, const ParserFlag* varying_flags,
                     bool is_module = false, bool test_preparser = true,
                     bool ignore_error_msg = false) {
   i::Handle<i::String> str =
-      CcTest::i_isolate()->factory()->NewStringFromAsciiChecked(source);
+      CcTest::i_isolate()
+          ->factory()
+          ->NewStringFromUtf8(Vector<const char>(source, strlen(source)))
+          .ToHandleChecked();
   for (int bits = 0; bits < (1 << varying_flags_length); bits++) {
     i::EnumSet<ParserFlag> flags;
     for (size_t flag_index = 0; flag_index < varying_flags_length;
@@ -1679,6 +1485,77 @@ void RunModuleParserSyncTest(
                     always_false_len, true, test_preparser, ignore_error_msg);
 }
 
+TEST(NumericSeparator) {
+  v8::HandleScope handles(CcTest::isolate());
+  v8::Local<v8::Context> context = v8::Context::New(CcTest::isolate());
+  v8::Context::Scope context_scope(context);
+
+  const char* context_data[][2] = {
+      {"", ""}, {"\"use strict\";", ""}, {nullptr, nullptr}};
+  const char* statement_data[] = {
+      "1_0_0_0", "1_0e+1",  "1_0e+1_0", "0xF_F_FF", "0o7_7_7", "0b0_1_0_1_0",
+      ".3_2_1",  "0.0_2_1", "1_0.0_1",  ".0_1_2",   nullptr};
+
+  static const ParserFlag flags[] = {kAllowHarmonyNumericSeparator};
+  RunParserSyncTest(context_data, statement_data, kSuccess, nullptr, 0, flags,
+                    1);
+
+  RunParserSyncTest(context_data, statement_data, kError);
+}
+
+TEST(NumericSeparatorErrors) {
+  v8::HandleScope handles(CcTest::isolate());
+  v8::Local<v8::Context> context = v8::Context::New(CcTest::isolate());
+  v8::Context::Scope context_scope(context);
+
+  const char* context_data[][2] = {
+      {"", ""}, {"\"use strict\";", ""}, {nullptr, nullptr}};
+  const char* statement_data[] = {
+      "1_0_0_0_", "1e_1",    "1e+_1", "1_e+1",  "1__0",    "0x_1",
+      "0x1__1",   "0x1_",    "0_x1",  "0_x_1",  "0b_0101", "0b11_",
+      "0b1__1",   "0_b1",    "0_b_1", "0o777_", "0o_777",  "0o7__77",
+      "0.0_2_1_", "0.0__21", "0_.01", "0._01",  nullptr};
+
+  static const ParserFlag flags[] = {kAllowHarmonyNumericSeparator};
+  RunParserSyncTest(context_data, statement_data, kError, nullptr, 0, flags, 1,
+                    nullptr, 0, false, true, true);
+
+  RunParserSyncTest(context_data, statement_data, kError);
+}
+
+TEST(NumericSeparatorImplicitOctalsErrors) {
+  v8::HandleScope handles(CcTest::isolate());
+  v8::Local<v8::Context> context = v8::Context::New(CcTest::isolate());
+  v8::Context::Scope context_scope(context);
+
+  const char* context_data[][2] = {
+      {"", ""}, {"\"use strict\";", ""}, {nullptr, nullptr}};
+  const char* statement_data[] = {"00_122",  "0_012",  "07_7_7",
+                                  "0_7_7_7", "0_777",  "07_7_7_",
+                                  "07__77",  "0__777", nullptr};
+
+  static const ParserFlag flags[] = {kAllowHarmonyNumericSeparator};
+  RunParserSyncTest(context_data, statement_data, kError, nullptr, 0, flags, 1,
+                    nullptr, 0, false, true, true);
+
+  RunParserSyncTest(context_data, statement_data, kError);
+}
+
+TEST(NumericSeparatorUnicodeEscapeSequencesErrors) {
+  v8::HandleScope handles(CcTest::isolate());
+  v8::Local<v8::Context> context = v8::Context::New(CcTest::isolate());
+  v8::Context::Scope context_scope(context);
+
+  const char* context_data[][2] = {
+      {"", ""}, {"'use strict'", ""}, {nullptr, nullptr}};
+  // https://github.com/tc39/proposal-numeric-separator/issues/25
+  const char* statement_data[] = {"\\u{10_FFFF}", nullptr};
+
+  static const ParserFlag flags[] = {kAllowHarmonyNumericSeparator};
+  RunParserSyncTest(context_data, statement_data, kError, nullptr, 0, flags, 1);
+
+  RunParserSyncTest(context_data, statement_data, kError);
+}
 
 TEST(ErrorsEvalAndArguments) {
   // Tests that both preparsing and parsing produce the right kind of errors for
@@ -2350,63 +2227,6 @@ TEST(NoErrorsIdentifierNames) {
   RunParserSyncTest(context_data, statement_data, kSuccess);
 }
 
-
-TEST(DontRegressPreParserDataSizes) {
-  // These tests make sure that Parser doesn't start producing less "preparse
-  // data" (data which the embedder can cache).
-
-  v8::V8::Initialize();
-  v8::Isolate* isolate = CcTest::isolate();
-  v8::HandleScope handles(isolate);
-
-  CcTest::i_isolate()->stack_guard()->SetStackLimit(
-      i::GetCurrentStackPosition() - 128 * 1024);
-
-  struct TestCase {
-    const char* program;
-    int functions;
-  } test_cases[] = {
-      // No functions.
-      {"var x = 42;", 0},
-      // Functions.
-      {"function foo() {}", 1},
-      {"function foo() {} function bar() {}", 2},
-      // Getter / setter functions are recorded as functions if they're on the
-      // top
-      // level.
-      {"var x = {get foo(){} };", 1},
-      // Functions insize lazy functions are not recorded.
-      {"function lazy() { function a() {} function b() {} function c() {} }",
-       1},
-      {"function lazy() { var x = {get foo(){} } }", 1},
-      {nullptr, 0}};
-
-  for (int i = 0; test_cases[i].program; i++) {
-    const char* program = test_cases[i].program;
-    i::Factory* factory = CcTest::i_isolate()->factory();
-    i::Handle<i::String> source =
-        factory->NewStringFromUtf8(i::CStrVector(program)).ToHandleChecked();
-    i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(script);
-    i::ScriptData* sd = nullptr;
-    info.set_cached_data(&sd);
-    info.set_compile_options(v8::ScriptCompiler::kProduceParserCache);
-    i::parsing::ParseProgram(&info, CcTest::i_isolate());
-    i::ParseData* pd = i::ParseData::FromCachedData(sd);
-
-    if (pd->FunctionCount() != test_cases[i].functions) {
-      FATAL(
-          "Expected preparse data for program:\n"
-          "\t%s\n"
-          "to contain %d functions, however, received %d functions.\n",
-          program, test_cases[i].functions, pd->FunctionCount());
-    }
-    delete sd;
-    delete pd;
-  }
-}
-
-
 TEST(FunctionDeclaresItselfStrict) {
   // Tests that we produce the right kinds of errors when a function declares
   // itself strict (we cannot produce there errors as soon as we see the
@@ -3900,15 +3720,44 @@ TEST(BothModesUseCount) {
 
 TEST(LineOrParagraphSeparatorAsLineTerminator) {
   // Tests that both preparsing and parsing accept U+2028 LINE SEPARATOR and
-  // U+2029 PARAGRAPH SEPARATOR as LineTerminator symbols.
+  // U+2029 PARAGRAPH SEPARATOR as LineTerminator symbols outside of string
+  // literals.
   const char* context_data[][2] = {{"", ""}, {nullptr, nullptr}};
-  const char* statement_data[] = {"\x31\xE2\x80\xA8\x32",  // "1<U+2028>2"
-                                  "\x31\xE2\x80\xA9\x32",  // "1<U+2029>2"
+  const char* statement_data[] = {"\x31\xE2\x80\xA8\x32",  // 1<U+2028>2
+                                  "\x31\xE2\x80\xA9\x32",  // 1<U+2029>2
+                                  nullptr};
+
+  RunParserSyncTest(context_data, statement_data, kSuccess);
+}
+
+TEST(LineOrParagraphSeparatorInStringLiteral) {
+  // Tests that both preparsing and parsing treat U+2028 LINE SEPARATOR and
+  // U+2029 PARAGRAPH SEPARATOR as line terminators within string literals
+  // when the "subsume JSON" flag is disabled.
+  v8::internal::FLAG_harmony_subsume_json = false;
+  const char* context_data[][2] = {
+      {"\"", "\""}, {"'", "'"}, {nullptr, nullptr}};
+  const char* statement_data[] = {"\x31\xE2\x80\xA8\x32",  // 1<U+2028>2
+                                  "\x31\xE2\x80\xA9\x32",  // 1<U+2029>2
                                   nullptr};
 
   RunParserSyncTest(context_data, statement_data, kError);
 }
 
+TEST(LineOrParagraphSeparatorInStringLiteralHarmony) {
+  // Tests that both preparsing and parsing don't treat U+2028 LINE SEPARATOR
+  // and U+2029 PARAGRAPH SEPARATOR as line terminators within string literals
+  // when the "subsume JSON" flag is enabled.
+  v8::internal::FLAG_harmony_subsume_json = true;
+  const char* context_data[][2] = {
+      {"\"", "\""}, {"'", "'"}, {nullptr, nullptr}};
+  const char* statement_data[] = {"\x31\xE2\x80\xA8\x32",  // 1<U+2028>2
+                                  "\x31\xE2\x80\xA9\x32",  // 1<U+2029>2
+                                  nullptr};
+
+  RunParserSyncTest(context_data, statement_data, kSuccess);
+}
+
 TEST(ErrorsArrowFormalParameters) {
   const char* context_data[][2] = {
     { "()", "=>{}" },
@@ -5130,6 +4979,9 @@ TEST(PrivateClassFieldsErrors) {
     "#async a = 0",
     "#async a",
 
+    "#constructor",
+    "#constructor = function() {}",
+
     "# a = 0",
     "#a() { }",
     "get #a() { }",
@@ -5160,6 +5012,14 @@ TEST(PrivateClassFieldsErrors) {
     "#a = f(arguments)",
     "#a = () => () => arguments",
 
+    "foo() { delete this.#a }",
+    "foo() { delete this.x.#a }",
+    "foo() { delete this.x().#a }",
+
+    "foo() { delete f.#a }",
+    "foo() { delete f.x.#a }",
+    "foo() { delete f.x().#a }",
+
     // ASI requires a linebreak
     "#a b",
     "#a = 0 b",
@@ -5309,6 +5169,16 @@ TEST(PrivateNameNoErrors) {
     "foo.#b.#a",
     "foo.#b.#a()",
 
+    "foo().#a",
+    "foo().b.#a",
+    "foo().b().#a",
+    "foo().b().#a()",
+    "foo().b().#a.bar",
+    "foo().b().#a.bar()",
+
+    "foo(this.#a)",
+    "foo(bar().#a)",
+
     "new foo.#a",
     "new foo.#b.#a",
     "new foo.#b.#a()",
@@ -8645,26 +8515,6 @@ TEST(EscapeSequenceErrors) {
   RunParserSyncTest(context_data, error_data, kError);
 }
 
-
-TEST(FunctionSentErrors) {
-  // clang-format off
-  const char* context_data[][2] = {
-    { "'use strict'", "" },
-    { "", "" },
-    { nullptr, nullptr }
-  };
-  const char* error_data[] = {
-    "var x = function.sent",
-    "function* g() { yield function.s\\u0065nt; }",
-    nullptr
-  };
-  // clang-format on
-
-  static const ParserFlag always_flags[] = {kAllowHarmonyFunctionSent};
-  RunParserSyncTest(context_data, error_data, kError, always_flags,
-                    arraysize(always_flags));
-}
-
 TEST(NewTargetErrors) {
   // clang-format off
   const char* context_data[][2] = {
@@ -10293,7 +10143,7 @@ TEST(LexicalLoopVariable) {
     info.set_allow_lazy_parsing(false);
     CHECK(i::parsing::ParseProgram(&info, isolate));
     CHECK(i::Rewriter::Rewrite(&info));
-    i::DeclarationScope::Analyze(&info);
+    CHECK(i::DeclarationScope::Analyze(&info));
     i::DeclarationScope::AllocateScopeInfos(&info, isolate,
                                             i::AnalyzeMode::kRegular);
     CHECK_NOT_NULL(info.literal());
@@ -10304,8 +10154,8 @@ TEST(LexicalLoopVariable) {
     test(info, script_scope);
   };
 
-  // Check `let` loop variables is a stack local when not captured by an eval
-  // or closure within the area of the loop body.
+  // Check `let` loop variables is a stack local when not captured by
+  // an eval or closure within the area of the loop body.
   const char* local_bindings[] = {
       "function loop() {"
       "  for (let loop_var = 0; loop_var < 10; ++loop_var) {"
@@ -10464,6 +10314,107 @@ TEST(LexicalLoopVariable) {
   }
 }
 
+TEST(PrivateNamesSyntaxError) {
+  i::Isolate* isolate = CcTest::i_isolate();
+  i::HandleScope scope(isolate);
+  LocalContext env;
+
+  auto test = [isolate](const char* program, bool is_lazy) {
+    i::Factory* const factory = isolate->factory();
+    i::Handle<i::String> source =
+        factory->NewStringFromUtf8(i::CStrVector(program)).ToHandleChecked();
+    i::Handle<i::Script> script = factory->NewScript(source);
+    i::ParseInfo info(script);
+
+    info.set_allow_lazy_parsing(is_lazy);
+    i::FLAG_harmony_private_fields = true;
+    CHECK(i::parsing::ParseProgram(&info, isolate));
+    CHECK(i::Rewriter::Rewrite(&info));
+    CHECK(!i::DeclarationScope::Analyze(&info));
+    return info.pending_error_handler()->has_pending_error();
+  };
+
+  const char* data[] = {
+      "class A {"
+      "  foo() { return this.#bar; }"
+      "}",
+
+      "let A = class {"
+      "  foo() { return this.#bar; }"
+      "}",
+
+      "class A {"
+      "  #foo;  "
+      "  bar() { return this.#baz; }"
+      "}",
+
+      "let A = class {"
+      "  #foo;  "
+      "  bar() { return this.#baz; }"
+      "}",
+
+      "class A {"
+      "  bar() {"
+      "    class D { #baz = 1; };"
+      "    return this.#baz;"
+      "  }"
+      "}",
+
+      "let A = class {"
+      "  bar() {"
+      "    class D { #baz = 1; };"
+      "    return this.#baz;"
+      "  }"
+      "}",
+
+      "a.#bar",
+
+      "class Foo {};"
+      "Foo.#bar;",
+
+      "let Foo = class {};"
+      "Foo.#bar;",
+
+      "class Foo {};"
+      "(new Foo).#bar;",
+
+      "let Foo = class {};"
+      "(new Foo).#bar;",
+
+      "class Foo { #bar; };"
+      "(new Foo).#bar;",
+
+      "let Foo = class { #bar; };"
+      "(new Foo).#bar;",
+
+      "function t(){"
+      "  class Foo { getA() { return this.#foo; } }"
+      "}",
+
+      "function t(){"
+      "  return class { getA() { return this.#foo; } }"
+      "}",
+  };
+
+  // TODO(gsathya): The preparser does not track unresolved
+  // variables in top level function which fails this test.
+  // https://bugs.chromium.org/p/v8/issues/detail?id=7468
+  const char* parser_data[] = {
+      "function t() {"
+      "  return this.#foo;"
+      "}",
+  };
+
+  for (const char* source : data) {
+    CHECK(test(source, true));
+    CHECK(test(source, false));
+  }
+
+  for (const char* source : parser_data) {
+    CHECK(test(source, false));
+  }
+}
+
 }  // namespace test_parsing
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-run-wasm-relocation-arm.cc b/deps/v8/test/cctest/test-run-wasm-relocation-arm.cc
index 000cf34c87c..69af784c850 100644
--- a/deps/v8/test/cctest/test-run-wasm-relocation-arm.cc
+++ b/deps/v8/test/cctest/test-run-wasm-relocation-arm.cc
@@ -59,8 +59,7 @@ TEST(WasmRelocationArmContextReference) {
     CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
     DCHECK(RelocInfo::IsWasmContextReference(it.rinfo()->rmode()));
     it.rinfo()->set_wasm_context_reference(
-        isolate, it.rinfo()->wasm_context_reference() + offset,
-        SKIP_ICACHE_FLUSH);
+        it.rinfo()->wasm_context_reference() + offset, SKIP_ICACHE_FLUSH);
   }
 
   // Call into relocated code object
diff --git a/deps/v8/test/cctest/test-run-wasm-relocation-arm64.cc b/deps/v8/test/cctest/test-run-wasm-relocation-arm64.cc
index 59f38e15541..7cb24e539f4 100644
--- a/deps/v8/test/cctest/test-run-wasm-relocation-arm64.cc
+++ b/deps/v8/test/cctest/test-run-wasm-relocation-arm64.cc
@@ -64,8 +64,7 @@ TEST(WasmRelocationArm64ContextReference) {
     CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
     DCHECK(RelocInfo::IsWasmContextReference(it.rinfo()->rmode()));
     it.rinfo()->set_wasm_context_reference(
-        isolate, it.rinfo()->wasm_context_reference() + offset,
-        SKIP_ICACHE_FLUSH);
+        it.rinfo()->wasm_context_reference() + offset, SKIP_ICACHE_FLUSH);
   }
 
   // Call into relocated code object
diff --git a/deps/v8/test/cctest/test-run-wasm-relocation-ia32.cc b/deps/v8/test/cctest/test-run-wasm-relocation-ia32.cc
index 080da36a479..d9e2cac6eee 100644
--- a/deps/v8/test/cctest/test-run-wasm-relocation-ia32.cc
+++ b/deps/v8/test/cctest/test-run-wasm-relocation-ia32.cc
@@ -68,8 +68,7 @@ TEST(WasmRelocationIa32ContextReference) {
     CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
     DCHECK(RelocInfo::IsWasmContextReference(it.rinfo()->rmode()));
     it.rinfo()->set_wasm_context_reference(
-        isolate, it.rinfo()->wasm_context_reference() + offset,
-        SKIP_ICACHE_FLUSH);
+        it.rinfo()->wasm_context_reference() + offset, SKIP_ICACHE_FLUSH);
   }
 
   // Check if immediate is updated correctly
diff --git a/deps/v8/test/cctest/test-run-wasm-relocation-x64.cc b/deps/v8/test/cctest/test-run-wasm-relocation-x64.cc
index 0526ce25a29..f290920ddcb 100644
--- a/deps/v8/test/cctest/test-run-wasm-relocation-x64.cc
+++ b/deps/v8/test/cctest/test-run-wasm-relocation-x64.cc
@@ -64,8 +64,7 @@ TEST(WasmRelocationX64ContextReference) {
     CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
     DCHECK(RelocInfo::IsWasmContextReference(it.rinfo()->rmode()));
     it.rinfo()->set_wasm_context_reference(
-        isolate, it.rinfo()->wasm_context_reference() + offset,
-        SKIP_ICACHE_FLUSH);
+        it.rinfo()->wasm_context_reference() + offset, SKIP_ICACHE_FLUSH);
   }
 
   // Check if immediate is updated correctly
diff --git a/deps/v8/test/cctest/test-serialize.cc b/deps/v8/test/cctest/test-serialize.cc
index 70fc8586eba..fef778ab05e 100644
--- a/deps/v8/test/cctest/test-serialize.cc
+++ b/deps/v8/test/cctest/test-serialize.cc
@@ -135,8 +135,7 @@ static StartupBlobs Serialize(v8::Isolate* isolate) {
   Isolate* internal_isolate = reinterpret_cast<Isolate*>(isolate);
   internal_isolate->heap()->CollectAllAvailableGarbage(
       i::GarbageCollectionReason::kTesting);
-  StartupSerializer ser(internal_isolate,
-                        v8::SnapshotCreator::FunctionCodeHandling::kClear);
+  StartupSerializer ser(internal_isolate);
   ser.SerializeStrongReferences();
 
   i::BuiltinSerializer builtin_serializer(internal_isolate, &ser);
@@ -376,8 +375,7 @@ static void PartiallySerializeContext(Vector<const byte>* startup_blob_out,
     env.Reset();
 
     SnapshotByteSink startup_sink;
-    StartupSerializer startup_serializer(
-        isolate, v8::SnapshotCreator::FunctionCodeHandling::kClear);
+    StartupSerializer startup_serializer(isolate);
     startup_serializer.SerializeStrongReferences();
 
     SnapshotByteSink partial_sink;
@@ -501,8 +499,7 @@ static void PartiallySerializeCustomContext(
     env.Reset();
 
     SnapshotByteSink startup_sink;
-    StartupSerializer startup_serializer(
-        isolate, v8::SnapshotCreator::FunctionCodeHandling::kClear);
+    StartupSerializer startup_serializer(isolate);
     startup_serializer.SerializeStrongReferences();
 
     SnapshotByteSink partial_sink;
@@ -1223,18 +1220,35 @@ int CountBuiltins() {
   return counter;
 }
 
-
 static Handle<SharedFunctionInfo> CompileScript(
     Isolate* isolate, Handle<String> source, Handle<String> name,
-    ScriptData** cached_data, v8::ScriptCompiler::CompileOptions options) {
+    ScriptData* cached_data, v8::ScriptCompiler::CompileOptions options) {
   return Compiler::GetSharedFunctionInfoForScript(
-             source, name, 0, 0, v8::ScriptOriginOptions(), Handle<Object>(),
-             Handle<Context>(isolate->native_context()), nullptr, cached_data,
-             options, ScriptCompiler::kNoCacheNoReason, NOT_NATIVES_CODE,
-             Handle<FixedArray>())
+             source, Compiler::ScriptDetails(name), v8::ScriptOriginOptions(),
+             nullptr, cached_data, options, ScriptCompiler::kNoCacheNoReason,
+             NOT_NATIVES_CODE)
       .ToHandleChecked();
 }
 
+static Handle<SharedFunctionInfo> CompileScriptAndProduceCache(
+    Isolate* isolate, Handle<String> source, Handle<String> name,
+    ScriptData** script_data, v8::ScriptCompiler::CompileOptions options) {
+  Handle<SharedFunctionInfo> sfi =
+      Compiler::GetSharedFunctionInfoForScript(
+          source, Compiler::ScriptDetails(name), v8::ScriptOriginOptions(),
+          nullptr, nullptr, options, ScriptCompiler::kNoCacheNoReason,
+          NOT_NATIVES_CODE)
+          .ToHandleChecked();
+  std::unique_ptr<ScriptCompiler::CachedData> cached_data(
+      ScriptCompiler::CreateCodeCache(ToApiHandle<UnboundScript>(sfi),
+                                      Utils::ToLocal(source)));
+  uint8_t* buffer = NewArray<uint8_t>(cached_data->length);
+  MemCopy(buffer, cached_data->data, cached_data->length);
+  *script_data = new i::ScriptData(buffer, cached_data->length);
+  (*script_data)->AcquireDataOwnership();
+  return sfi;
+}
+
 TEST(CodeSerializerOnePlusOne) {
   LocalContext context;
   Isolate* isolate = CcTest::i_isolate();
@@ -1255,16 +1269,16 @@ TEST(CodeSerializerOnePlusOne) {
 
   ScriptData* cache = nullptr;
 
-  Handle<SharedFunctionInfo> orig =
-      CompileScript(isolate, orig_source, Handle<String>(), &cache,
-                    v8::ScriptCompiler::kProduceCodeCache);
+  Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
+      isolate, orig_source, Handle<String>(), &cache,
+      v8::ScriptCompiler::kNoCompileOptions);
 
   int builtins_count = CountBuiltins();
 
   Handle<SharedFunctionInfo> copy;
   {
     DisallowCompilation no_compile_expected(isolate);
-    copy = CompileScript(isolate, copy_source, Handle<String>(), &cache,
+    copy = CompileScript(isolate, copy_source, Handle<String>(), cache,
                          v8::ScriptCompiler::kConsumeCodeCache);
   }
 
@@ -1297,18 +1311,19 @@ TEST(CodeSerializerPromotedToCompilationCache) {
                            .ToHandleChecked();
   ScriptData* cache = nullptr;
 
-  CompileScript(isolate, src, src, &cache,
-                v8::ScriptCompiler::kProduceCodeCache);
+  CompileScriptAndProduceCache(isolate, src, src, &cache,
+                               v8::ScriptCompiler::kNoCompileOptions);
 
   DisallowCompilation no_compile_expected(isolate);
   Handle<SharedFunctionInfo> copy = CompileScript(
-      isolate, src, src, &cache, v8::ScriptCompiler::kConsumeCodeCache);
+      isolate, src, src, cache, v8::ScriptCompiler::kConsumeCodeCache);
 
-  InfoVectorPair pair = isolate->compilation_cache()->LookupScript(
-      src, src, 0, 0, v8::ScriptOriginOptions(), isolate->native_context(),
-      LanguageMode::kSloppy);
+  MaybeHandle<SharedFunctionInfo> shared =
+      isolate->compilation_cache()->LookupScript(
+          src, src, 0, 0, v8::ScriptOriginOptions(), isolate->native_context(),
+          LanguageMode::kSloppy);
 
-  CHECK(pair.shared() == *copy);
+  CHECK(*shared.ToHandleChecked() == *copy);
 
   delete cache;
 }
@@ -1332,11 +1347,11 @@ TEST(CodeSerializerInternalizedString) {
   CHECK(orig_source->Equals(*copy_source));
 
   Handle<JSObject> global(isolate->context()->global_object());
-  ScriptData* cache = nullptr;
 
-  Handle<SharedFunctionInfo> orig =
-      CompileScript(isolate, orig_source, Handle<String>(), &cache,
-                    v8::ScriptCompiler::kProduceCodeCache);
+  i::ScriptData* script_data = nullptr;
+  Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
+      isolate, orig_source, Handle<String>(), &script_data,
+      v8::ScriptCompiler::kNoCompileOptions);
   Handle<JSFunction> orig_fun =
       isolate->factory()->NewFunctionFromSharedFunctionInfo(
           orig, isolate->native_context());
@@ -1349,7 +1364,7 @@ TEST(CodeSerializerInternalizedString) {
   Handle<SharedFunctionInfo> copy;
   {
     DisallowCompilation no_compile_expected(isolate);
-    copy = CompileScript(isolate, copy_source, Handle<String>(), &cache,
+    copy = CompileScript(isolate, copy_source, Handle<String>(), script_data,
                          v8::ScriptCompiler::kConsumeCodeCache);
   }
   CHECK_NE(*orig, *copy);
@@ -1368,7 +1383,7 @@ TEST(CodeSerializerInternalizedString) {
   CHECK(Handle<String>::cast(copy_result)->Equals(*expected));
   CHECK_EQ(builtins_count, CountBuiltins());
 
-  delete cache;
+  delete script_data;
 }
 
 TEST(CodeSerializerLargeCodeObject) {
@@ -1393,16 +1408,16 @@ TEST(CodeSerializerLargeCodeObject) {
   Handle<JSObject> global(isolate->context()->global_object());
   ScriptData* cache = nullptr;
 
-  Handle<SharedFunctionInfo> orig =
-      CompileScript(isolate, source_str, Handle<String>(), &cache,
-                    v8::ScriptCompiler::kProduceCodeCache);
+  Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
+      isolate, source_str, Handle<String>(), &cache,
+      v8::ScriptCompiler::kNoCompileOptions);
 
   CHECK(isolate->heap()->InSpace(orig->abstract_code(), LO_SPACE));
 
   Handle<SharedFunctionInfo> copy;
   {
     DisallowCompilation no_compile_expected(isolate);
-    copy = CompileScript(isolate, source_str, Handle<String>(), &cache,
+    copy = CompileScript(isolate, source_str, Handle<String>(), cache,
                          v8::ScriptCompiler::kConsumeCodeCache);
   }
   CHECK_NE(*orig, *copy);
@@ -1441,7 +1456,7 @@ TEST(CodeSerializerLargeCodeObjectWithIncrementalMarking) {
   Vector<const uint8_t> source = ConstructSource(
       STATIC_CHAR_VECTOR("var j=1; if (j == 0) {"),
       STATIC_CHAR_VECTOR("for (var i = 0; i < Object.prototype; i++);"),
-      STATIC_CHAR_VECTOR("} j=7; var s = 'happy_hippo'; j"), 10000);
+      STATIC_CHAR_VECTOR("} j=7; var s = 'happy_hippo'; j"), 20000);
   Handle<String> source_str =
       isolate->factory()->NewStringFromOneByte(source).ToHandleChecked();
 
@@ -1459,9 +1474,9 @@ TEST(CodeSerializerLargeCodeObjectWithIncrementalMarking) {
   Handle<JSObject> global(isolate->context()->global_object());
   ScriptData* cache = nullptr;
 
-  Handle<SharedFunctionInfo> orig =
-      CompileScript(isolate, source_str, Handle<String>(), &cache,
-                    v8::ScriptCompiler::kProduceCodeCache);
+  Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
+      isolate, source_str, Handle<String>(), &cache,
+      v8::ScriptCompiler::kNoCompileOptions);
 
   CHECK(heap->InSpace(orig->abstract_code(), LO_SPACE));
 
@@ -1476,7 +1491,7 @@ TEST(CodeSerializerLargeCodeObjectWithIncrementalMarking) {
   Handle<SharedFunctionInfo> copy;
   {
     DisallowCompilation no_compile_expected(isolate);
-    copy = CompileScript(isolate, source_str, Handle<String>(), &cache,
+    copy = CompileScript(isolate, source_str, Handle<String>(), cache,
                          v8::ScriptCompiler::kConsumeCodeCache);
   }
   CHECK_NE(*orig, *copy);
@@ -1522,14 +1537,14 @@ TEST(CodeSerializerLargeStrings) {
   Handle<JSObject> global(isolate->context()->global_object());
   ScriptData* cache = nullptr;
 
-  Handle<SharedFunctionInfo> orig =
-      CompileScript(isolate, source_str, Handle<String>(), &cache,
-                    v8::ScriptCompiler::kProduceCodeCache);
+  Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
+      isolate, source_str, Handle<String>(), &cache,
+      v8::ScriptCompiler::kNoCompileOptions);
 
   Handle<SharedFunctionInfo> copy;
   {
     DisallowCompilation no_compile_expected(isolate);
-    copy = CompileScript(isolate, source_str, Handle<String>(), &cache,
+    copy = CompileScript(isolate, source_str, Handle<String>(), cache,
                          v8::ScriptCompiler::kConsumeCodeCache);
   }
   CHECK_NE(*orig, *copy);
@@ -1590,14 +1605,14 @@ TEST(CodeSerializerThreeBigStrings) {
   Handle<JSObject> global(isolate->context()->global_object());
   ScriptData* cache = nullptr;
 
-  Handle<SharedFunctionInfo> orig =
-      CompileScript(isolate, source_str, Handle<String>(), &cache,
-                    v8::ScriptCompiler::kProduceCodeCache);
+  Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
+      isolate, source_str, Handle<String>(), &cache,
+      v8::ScriptCompiler::kNoCompileOptions);
 
   Handle<SharedFunctionInfo> copy;
   {
     DisallowCompilation no_compile_expected(isolate);
-    copy = CompileScript(isolate, source_str, Handle<String>(), &cache,
+    copy = CompileScript(isolate, source_str, Handle<String>(), cache,
                          v8::ScriptCompiler::kConsumeCodeCache);
   }
   CHECK_NE(*orig, *copy);
@@ -1708,14 +1723,14 @@ TEST(CodeSerializerExternalString) {
   Handle<JSObject> global(isolate->context()->global_object());
   ScriptData* cache = nullptr;
 
-  Handle<SharedFunctionInfo> orig =
-      CompileScript(isolate, source_string, Handle<String>(), &cache,
-                    v8::ScriptCompiler::kProduceCodeCache);
+  Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
+      isolate, source_string, Handle<String>(), &cache,
+      v8::ScriptCompiler::kNoCompileOptions);
 
   Handle<SharedFunctionInfo> copy;
   {
     DisallowCompilation no_compile_expected(isolate);
-    copy = CompileScript(isolate, source_string, Handle<String>(), &cache,
+    copy = CompileScript(isolate, source_string, Handle<String>(), cache,
                          v8::ScriptCompiler::kConsumeCodeCache);
   }
   CHECK_NE(*orig, *copy);
@@ -1765,14 +1780,14 @@ TEST(CodeSerializerLargeExternalString) {
   Handle<JSObject> global(isolate->context()->global_object());
   ScriptData* cache = nullptr;
 
-  Handle<SharedFunctionInfo> orig =
-      CompileScript(isolate, source_str, Handle<String>(), &cache,
-                    v8::ScriptCompiler::kProduceCodeCache);
+  Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
+      isolate, source_str, Handle<String>(), &cache,
+      v8::ScriptCompiler::kNoCompileOptions);
 
   Handle<SharedFunctionInfo> copy;
   {
     DisallowCompilation no_compile_expected(isolate);
-    copy = CompileScript(isolate, source_str, Handle<String>(), &cache,
+    copy = CompileScript(isolate, source_str, Handle<String>(), cache,
                          v8::ScriptCompiler::kConsumeCodeCache);
   }
   CHECK_NE(*orig, *copy);
@@ -1815,13 +1830,13 @@ TEST(CodeSerializerExternalScriptName) {
   ScriptData* cache = nullptr;
 
   Handle<SharedFunctionInfo> orig =
-      CompileScript(isolate, source_string, name, &cache,
-                    v8::ScriptCompiler::kProduceCodeCache);
+      CompileScriptAndProduceCache(isolate, source_string, name, &cache,
+                                   v8::ScriptCompiler::kNoCompileOptions);
 
   Handle<SharedFunctionInfo> copy;
   {
     DisallowCompilation no_compile_expected(isolate);
-    copy = CompileScript(isolate, source_string, name, &cache,
+    copy = CompileScript(isolate, source_string, name, cache,
                          v8::ScriptCompiler::kConsumeCodeCache);
   }
   CHECK_NE(*orig, *copy);
@@ -1848,7 +1863,7 @@ static void SerializerCodeEventListener(const v8::JitCodeEvent* event) {
   }
 }
 
-v8::ScriptCompiler::CachedData* ProduceCache(
+v8::ScriptCompiler::CachedData* CompileRunAndProduceCache(
     const char* source, CodeCacheType cacheType = CodeCacheType::kLazy) {
   v8::ScriptCompiler::CachedData* cache;
   v8::Isolate::CreateParams create_params;
@@ -1865,12 +1880,10 @@ v8::ScriptCompiler::CachedData* ProduceCache(
     v8::ScriptCompiler::Source source(source_str, origin);
     v8::ScriptCompiler::CompileOptions options;
     switch (cacheType) {
-      case CodeCacheType::kLazy:
-        options = v8::ScriptCompiler::kProduceCodeCache;
-        break;
       case CodeCacheType::kEager:
         options = v8::ScriptCompiler::kProduceFullCodeCache;
         break;
+      case CodeCacheType::kLazy:
       case CodeCacheType::kAfterExecute:
         options = v8::ScriptCompiler::kNoCompileOptions;
         break;
@@ -1881,6 +1894,10 @@ v8::ScriptCompiler::CachedData* ProduceCache(
         v8::ScriptCompiler::CompileUnboundScript(isolate1, &source, options)
             .ToLocalChecked();
 
+    if (cacheType != CodeCacheType::kAfterExecute) {
+      cache = ScriptCompiler::CreateCodeCache(script, source_str);
+    }
+
     v8::Local<v8::Value> result = script->BindToCurrentContext()
                                       ->Run(isolate1->GetCurrentContext())
                                       .ToLocalChecked();
@@ -1891,13 +1908,6 @@ v8::ScriptCompiler::CachedData* ProduceCache(
 
     if (cacheType == CodeCacheType::kAfterExecute) {
       cache = ScriptCompiler::CreateCodeCache(script, source_str);
-    } else {
-      const ScriptCompiler::CachedData* data = source.GetCachedData();
-      CHECK(data);
-      uint8_t* buffer = NewArray<uint8_t>(data->length);
-      MemCopy(buffer, data->data, data->length);
-      cache = new v8::ScriptCompiler::CachedData(
-          buffer, data->length, v8::ScriptCompiler::CachedData::BufferOwned);
     }
     CHECK(cache);
   }
@@ -1916,7 +1926,7 @@ void CheckDeserializedFlag(v8::Local<v8::UnboundScript> script) {
 
 TEST(CodeSerializerIsolates) {
   const char* source = "function f() { return 'abc'; }; f() + 'def'";
-  v8::ScriptCompiler::CachedData* cache = ProduceCache(source);
+  v8::ScriptCompiler::CachedData* cache = CompileRunAndProduceCache(source);
 
   v8::Isolate::CreateParams create_params;
   create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -1963,7 +1973,7 @@ TEST(CodeSerializerIsolatesEager) {
       "}"
       "f()() + 'def'";
   v8::ScriptCompiler::CachedData* cache =
-      ProduceCache(source, CodeCacheType::kEager);
+      CompileRunAndProduceCache(source, CodeCacheType::kEager);
 
   v8::Isolate::CreateParams create_params;
   create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -2010,7 +2020,7 @@ TEST(CodeSerializerAfterExecute) {
   FLAG_opt = false;
   const char* source = "function f() { return 'abc'; }; f() + 'def'";
   v8::ScriptCompiler::CachedData* cache =
-      ProduceCache(source, CodeCacheType::kAfterExecute);
+      CompileRunAndProduceCache(source, CodeCacheType::kAfterExecute);
 
   v8::Isolate::CreateParams create_params;
   create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -2040,7 +2050,7 @@ TEST(CodeSerializerAfterExecute) {
     CHECK(sfi->HasBytecodeArray());
     BytecodeArray* bytecode = sfi->bytecode_array();
     CHECK_EQ(bytecode->interrupt_budget(),
-             interpreter::Interpreter::kInterruptBudget);
+             interpreter::Interpreter::InterruptBudget());
     CHECK_EQ(bytecode->osr_loop_nesting_level(), 0);
 
     {
@@ -2065,7 +2075,7 @@ TEST(CodeSerializerAfterExecute) {
 
 TEST(CodeSerializerFlagChange) {
   const char* source = "function f() { return 'abc'; }; f() + 'def'";
-  v8::ScriptCompiler::CachedData* cache = ProduceCache(source);
+  v8::ScriptCompiler::CachedData* cache = CompileRunAndProduceCache(source);
 
   v8::Isolate::CreateParams create_params;
   create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
@@ -2092,7 +2102,7 @@ TEST(CodeSerializerFlagChange) {
 
 TEST(CodeSerializerBitFlip) {
   const char* source = "function f() { return 'abc'; }; f() + 'def'";
-  v8::ScriptCompiler::CachedData* cache = ProduceCache(source);
+  v8::ScriptCompiler::CachedData* cache = CompileRunAndProduceCache(source);
 
   // Random bit flip.
   const_cast<uint8_t*>(cache->data)[337] ^= 0x40;
@@ -2141,15 +2151,10 @@ TEST(CodeSerializerWithHarmonyScoping) {
     v8::ScriptCompiler::Source source(source_str, origin);
     v8::Local<v8::UnboundScript> script =
         v8::ScriptCompiler::CompileUnboundScript(
-            isolate1, &source, v8::ScriptCompiler::kProduceCodeCache)
+            isolate1, &source, v8::ScriptCompiler::kNoCompileOptions)
             .ToLocalChecked();
-    const v8::ScriptCompiler::CachedData* data = source.GetCachedData();
-    CHECK(data);
-    // Persist cached data.
-    uint8_t* buffer = NewArray<uint8_t>(data->length);
-    MemCopy(buffer, data->data, data->length);
-    cache = new v8::ScriptCompiler::CachedData(
-        buffer, data->length, v8::ScriptCompiler::CachedData::BufferOwned);
+    cache = v8::ScriptCompiler::CreateCodeCache(script, source_str);
+    CHECK(cache);
 
     v8::Local<v8::Value> result = script->BindToCurrentContext()
                                       ->Run(isolate1->GetCurrentContext())
@@ -2205,20 +2210,16 @@ TEST(Regress503552) {
   Handle<String> source = isolate->factory()->NewStringFromAsciiChecked(
       "function f() {} function g() {}");
   ScriptData* script_data = nullptr;
-  Handle<SharedFunctionInfo> shared =
-      Compiler::GetSharedFunctionInfoForScript(
-          source, MaybeHandle<String>(), 0, 0, v8::ScriptOriginOptions(),
-          MaybeHandle<Object>(), Handle<Context>(isolate->native_context()),
-          nullptr, &script_data, v8::ScriptCompiler::kProduceCodeCache,
-          ScriptCompiler::kNoCacheNoReason, NOT_NATIVES_CODE,
-          MaybeHandle<FixedArray>())
-          .ToHandleChecked();
+  Handle<SharedFunctionInfo> shared = CompileScriptAndProduceCache(
+      isolate, source, Handle<String>(), &script_data,
+      v8::ScriptCompiler::kNoCompileOptions);
   delete script_data;
 
   heap::SimulateIncrementalMarking(isolate->heap());
 
-  script_data = CodeSerializer::Serialize(isolate, shared, source);
-  delete script_data;
+  v8::ScriptCompiler::CachedData* cache_data =
+      CodeSerializer::Serialize(shared, source);
+  delete cache_data;
 }
 
 TEST(SnapshotCreatorMultipleContexts) {
@@ -2283,8 +2284,17 @@ TEST(SnapshotCreatorMultipleContexts) {
   delete[] blob.data;
 }
 
+static int serialized_static_field = 314;
+
 static void SerializedCallback(
     const v8::FunctionCallbackInfo<v8::Value>& args) {
+  if (args.Data()->IsExternal()) {
+    CHECK_EQ(args.Data().As<v8::External>()->Value(),
+             static_cast<void*>(&serialized_static_field));
+    int* value =
+        reinterpret_cast<int*>(args.Data().As<v8::External>()->Value());
+    (*value)++;
+  }
   args.GetReturnValue().Set(v8_num(42));
 }
 
@@ -2307,8 +2317,6 @@ static void AccessorForSerialization(
   info.GetReturnValue().Set(v8_num(2017));
 }
 
-static int serialized_static_field = 314;
-
 class SerializedExtension : public v8::Extension {
  public:
   SerializedExtension()
@@ -2638,8 +2646,10 @@ TEST(SnapshotCreatorTemplates) {
       v8::ExtensionConfiguration* no_extension = nullptr;
       v8::Local<v8::ObjectTemplate> global_template =
           v8::ObjectTemplate::New(isolate);
+      v8::Local<v8::External> external =
+          v8::External::New(isolate, &serialized_static_field);
       v8::Local<v8::FunctionTemplate> callback =
-          v8::FunctionTemplate::New(isolate, SerializedCallback);
+          v8::FunctionTemplate::New(isolate, SerializedCallback, external);
       global_template->Set(v8_str("f"), callback);
       v8::Local<v8::Context> context =
           v8::Context::New(isolate, no_extension, global_template);
@@ -2651,6 +2661,7 @@ TEST(SnapshotCreatorTemplates) {
 
       v8::Context::Scope context_scope(context);
       ExpectInt32("f()", 42);
+      CHECK_EQ(315, serialized_static_field);
 
       v8::Local<v8::Object> a =
           object_template->NewInstance(context).ToLocalChecked();
@@ -2706,6 +2717,7 @@ TEST(SnapshotCreatorTemplates) {
                 .ToLocalChecked();
         v8::Context::Scope context_scope(context);
         ExpectInt32("f()", 42);
+        CHECK_EQ(316, serialized_static_field);
 
         // Retrieve the snapshotted object template.
         v8::Local<v8::ObjectTemplate> obj_template =
@@ -2715,6 +2727,7 @@ TEST(SnapshotCreatorTemplates) {
             obj_template->NewInstance(context).ToLocalChecked();
         CHECK(context->Global()->Set(context, v8_str("o"), object).FromJust());
         ExpectInt32("o.f()", 42);
+        CHECK_EQ(317, serialized_static_field);
         // Check that it instantiates to the same prototype.
         ExpectTrue("o.f.prototype === f.prototype");
 
@@ -3320,25 +3333,137 @@ TEST(SerializationMemoryStats) {
   delete[] blob.data;
 }
 
-TEST(BuiltinsHaveBuiltinIdForLazyDeserialization) {
-  CcTest::InitializeVM();
+void CheckSFIsAreWeak(WeakFixedArray* sfis, Isolate* isolate) {
+  CHECK_GT(sfis->length(), 0);
+  int no_of_weak = 0;
+  for (int i = 0; i < sfis->length(); ++i) {
+    MaybeObject* maybe_object = sfis->Get(i);
+    HeapObject* heap_object;
+    CHECK(maybe_object->IsWeakHeapObject() ||
+          maybe_object->IsClearedWeakHeapObject() ||
+          (maybe_object->ToStrongHeapObject(&heap_object) &&
+           heap_object->IsUndefined(isolate)));
+    if (maybe_object->IsWeakHeapObject()) {
+      ++no_of_weak;
+    }
+  }
+  CHECK_GT(no_of_weak, 0);
+}
+
+TEST(WeakArraySerializizationInSnapshot) {
+  const char* code = "var my_func = function() { }";
+
+  DisableAlwaysOpt();
+  i::FLAG_allow_natives_syntax = true;
+  v8::StartupData blob;
+  {
+    v8::SnapshotCreator creator;
+    v8::Isolate* isolate = creator.GetIsolate();
+    {
+      v8::HandleScope handle_scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Context::Scope context_scope(context);
+
+      CompileRun(code);
+      creator.SetDefaultContext(
+          context, v8::SerializeInternalFieldsCallback(
+                       SerializeInternalFields, reinterpret_cast<void*>(2016)));
+    }
+    blob =
+        creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
+  }
+
+  v8::Isolate::CreateParams create_params;
+  create_params.snapshot_blob = &blob;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  v8::Isolate* isolate = TestIsolate::New(create_params);
+  {
+    v8::Isolate::Scope i_scope(isolate);
+    v8::HandleScope h_scope(isolate);
+    v8::Local<v8::Context> context = v8::Context::New(
+        isolate, nullptr, v8::MaybeLocal<v8::ObjectTemplate>(),
+        v8::MaybeLocal<v8::Value>(),
+        v8::DeserializeInternalFieldsCallback(DeserializeInternalFields,
+                                              reinterpret_cast<void*>(2017)));
+    v8::Context::Scope c_scope(context);
+
+    v8::Local<v8::Value> x = CompileRun("my_func");
+    CHECK(x->IsFunction());
+    Handle<JSFunction> function =
+        Handle<JSFunction>::cast(v8::Utils::OpenHandle(*x));
+
+    // Verify that the pointers in shared_function_infos are weak.
+    WeakFixedArray* sfis =
+        Script::cast(function->shared()->script())->shared_function_infos();
+    CheckSFIsAreWeak(sfis, CcTest::i_isolate());
+  }
+  isolate->Dispose();
+  delete[] blob.data;
+}
+
+TEST(WeakArraySerializationInCodeCache) {
+  LocalContext context;
+  Isolate* isolate = CcTest::i_isolate();
+  isolate->compilation_cache()->Disable();
+
+  v8::HandleScope scope(CcTest::isolate());
+
+  const char* source = "function foo() { }";
+
+  Handle<String> src = isolate->factory()
+                           ->NewStringFromUtf8(CStrVector(source))
+                           .ToHandleChecked();
+  ScriptData* cache = nullptr;
+
+  CompileScriptAndProduceCache(isolate, src, src, &cache,
+                               v8::ScriptCompiler::kNoCompileOptions);
+
+  DisallowCompilation no_compile_expected(isolate);
+  Handle<SharedFunctionInfo> copy = CompileScript(
+      isolate, src, src, cache, v8::ScriptCompiler::kConsumeCodeCache);
+
+  // Verify that the pointers in shared_function_infos are weak.
+  WeakFixedArray* sfis = Script::cast(copy->script())->shared_function_infos();
+  CheckSFIsAreWeak(sfis, isolate);
+
+  delete cache;
+}
+
+TEST(CachedCompileFunctionInContext) {
+  DisableAlwaysOpt();
+  LocalContext env;
   Isolate* isolate = CcTest::i_isolate();
-  i::HandleScope scope(isolate);
-
-  CHECK(Builtins::IsLazy(Builtins::kRegExpPrototypeExec));
-  CHECK_EQ(Builtins::kRegExpPrototypeExec,
-           isolate->regexp_exec_function()
-               ->shared()
-               ->lazy_deserialization_builtin_id());
-  CHECK(Builtins::IsLazy(Builtins::kAsyncIteratorValueUnwrap));
-  CHECK_EQ(Builtins::kAsyncIteratorValueUnwrap,
-           isolate->async_iterator_value_unwrap_shared_fun()
-               ->lazy_deserialization_builtin_id());
-
-  CHECK(!Builtins::IsLazy(Builtins::kIllegal));
-  CHECK(!isolate->opaque_reference_function()
-             ->shared()
-             ->HasLazyDeserializationBuiltinId());
+  isolate->compilation_cache()->Disable();  // Disable same-isolate code cache.
+
+  v8::HandleScope scope(CcTest::isolate());
+
+  v8::Local<v8::String> source = v8_str("return x*x;");
+  v8::Local<v8::String> arg_str = v8_str("x");
+  ScriptCompiler::CachedData* cache;
+  {
+    v8::ScriptCompiler::Source script_source(source);
+    v8::Local<v8::Function> fun =
+        v8::ScriptCompiler::CompileFunctionInContext(
+            env.local(), &script_source, 1, &arg_str, 0, nullptr,
+            v8::ScriptCompiler::kEagerCompile)
+            .ToLocalChecked();
+    cache = v8::ScriptCompiler::CreateCodeCacheForFunction(fun, source);
+  }
+
+  {
+    DisallowCompilation no_compile_expected(isolate);
+    v8::ScriptCompiler::Source script_source(source, cache);
+    v8::Local<v8::Function> fun =
+        v8::ScriptCompiler::CompileFunctionInContext(
+            env.local(), &script_source, 1, &arg_str, 0, nullptr,
+            v8::ScriptCompiler::kConsumeCodeCache)
+            .ToLocalChecked();
+    v8::Local<v8::Value> arg = v8_num(3);
+    v8::Local<v8::Value> result =
+        fun->Call(env.local(), v8::Undefined(CcTest::isolate()), 1, &arg)
+            .ToLocalChecked();
+    CHECK_EQ(9, result->Int32Value(env.local()).FromJust());
+  }
 }
 
 }  // namespace internal
diff --git a/deps/v8/test/cctest/test-strings.cc b/deps/v8/test/cctest/test-strings.cc
index ba6186828d4..45b4cc4a3d0 100644
--- a/deps/v8/test/cctest/test-strings.cc
+++ b/deps/v8/test/cctest/test-strings.cc
@@ -1335,99 +1335,6 @@ UNINITIALIZED_TEST(OneByteArrayJoin) {
   isolate->Dispose();
 }
 
-
-static void CheckException(const char* source) {
-  // An empty handle is returned upon exception.
-  CHECK(CompileRun(source).IsEmpty());
-}
-
-
-TEST(RobustSubStringStub) {
-  // This tests whether the SubStringStub can handle unsafe arguments.
-  // If not recognized, those unsafe arguments lead to out-of-bounds reads.
-  FLAG_allow_natives_syntax = true;
-  CcTest::InitializeVM();
-  v8::HandleScope scope(CcTest::isolate());
-  v8::Local<v8::Value> result;
-  Handle<String> string;
-  CompileRun("var short = 'abcdef';");
-
-  // Invalid indices.
-  CheckException("%_SubString(short,     0,    10000);");
-  CheckException("%_SubString(short, -1234,        5);");
-  CheckException("%_SubString(short,     5,        2);");
-  // Special HeapNumbers.
-  CheckException("%_SubString(short,     1, Infinity);");
-  CheckException("%_SubString(short,   NaN,        5);");
-  // String arguments.
-  CheckException("%_SubString(short,    '2',     '5');");
-  // Ordinary HeapNumbers can be handled (in runtime).
-  result = CompileRun("%_SubString(short, Math.sqrt(4), 5.1);");
-  string = v8::Utils::OpenHandle(v8::String::Cast(*result));
-  CHECK_EQ(0, strcmp("cde", string->ToCString().get()));
-
-  CompileRun("var long = 'abcdefghijklmnopqrstuvwxyz';");
-  // Invalid indices.
-  CheckException("%_SubString(long,     0,    10000);");
-  CheckException("%_SubString(long, -1234,       17);");
-  CheckException("%_SubString(long,    17,        2);");
-  // Special HeapNumbers.
-  CheckException("%_SubString(long,     1, Infinity);");
-  CheckException("%_SubString(long,   NaN,       17);");
-  // String arguments.
-  CheckException("%_SubString(long,    '2',    '17');");
-  // Ordinary HeapNumbers within bounds can be handled (in runtime).
-  result = CompileRun("%_SubString(long, Math.sqrt(4), 17.1);");
-  string = v8::Utils::OpenHandle(v8::String::Cast(*result));
-  CHECK_EQ(0, strcmp("cdefghijklmnopq", string->ToCString().get()));
-
-  // Test that out-of-bounds substring of a slice fails when the indices
-  // would have been valid for the underlying string.
-  CompileRun("var slice = long.slice(1, 15);");
-  CheckException("%_SubString(slice, 0, 17);");
-}
-
-TEST(RobustSubStringStubExternalStrings) {
-  // Ensure that the specific combination of calling the SubStringStub on an
-  // external string and triggering a GC on string allocation does not crash.
-  // See crbug.com/649967.
-
-  FLAG_allow_natives_syntax = true;
-#ifdef VERIFY_HEAP
-  FLAG_verify_heap = true;
-#endif
-
-  CcTest::InitializeVM();
-  v8::HandleScope handle_scope(CcTest::isolate());
-
-  v8::Local<v8::String> underlying =
-      CompileRun(
-          "var str = 'abcdefghijklmnopqrstuvwxyz';"
-          "str")
-          ->ToString(CcTest::isolate()->GetCurrentContext())
-          .ToLocalChecked();
-  CHECK(v8::Utils::OpenHandle(*underlying)->IsSeqOneByteString());
-
-  const int length = underlying->Length();
-  uc16* two_byte = NewArray<uc16>(length + 1);
-  underlying->Write(two_byte);
-
-  Resource* resource = new Resource(two_byte, length);
-  CHECK(underlying->MakeExternal(resource));
-  CHECK(v8::Utils::OpenHandle(*underlying)->IsExternalTwoByteString());
-
-  v8::Local<v8::Script> script = v8_compile(v8_str("%_SubString(str, 5, 8)"));
-
-  // Trigger a GC on string allocation.
-  i::heap::SimulateFullSpace(CcTest::heap()->new_space());
-
-  v8::Local<v8::Value> result;
-  CHECK(script->Run(v8::Isolate::GetCurrent()->GetCurrentContext())
-            .ToLocal(&result));
-  Handle<String> string = v8::Utils::OpenHandle(v8::String::Cast(*result));
-  CHECK_EQ(0, strcmp("fgh", string->ToCString().get()));
-}
-
 namespace {
 
 int* global_use_counts = nullptr;
@@ -1505,7 +1412,7 @@ static uint16_t ConvertLatin1(uint16_t c) {
 #ifndef V8_INTL_SUPPORT
 static void CheckCanonicalEquivalence(uint16_t c, uint16_t test) {
   uint16_t expect = ConvertLatin1<unibrow::Ecma262UnCanonicalize, true>(c);
-  if (expect > unibrow::Latin1::kMaxChar) expect = 0;
+  if (expect > unibrow::Latin1::kMaxChar || expect == 0) expect = c;
   CHECK_EQ(expect, test);
 }
 
@@ -1514,7 +1421,7 @@ TEST(Latin1IgnoreCase) {
   for (uint16_t c = unibrow::Latin1::kMaxChar + 1; c != 0; c++) {
     uint16_t lower = ConvertLatin1<unibrow::ToLowercase, false>(c);
     uint16_t upper = ConvertLatin1<unibrow::ToUppercase, false>(c);
-    uint16_t test = unibrow::Latin1::ConvertNonLatin1ToLatin1(c);
+    uint16_t test = unibrow::Latin1::TryConvertToLatin1(c);
     // Filter out all character whose upper is not their lower or vice versa.
     if (lower == 0 && upper == 0) {
       CheckCanonicalEquivalence(c, test);
@@ -1675,6 +1582,63 @@ TEST(ExternalStringIndexOf) {
                    .FromJust());
 }
 
+#define GC_INSIDE_NEW_STRING_FROM_UTF8_SUB_STRING(NAME, STRING)                \
+  TEST(GCInsideNewStringFromUtf8SubStringWith##NAME) {                         \
+    CcTest::InitializeVM();                                                    \
+    LocalContext context;                                                      \
+    v8::HandleScope scope(CcTest::isolate());                                  \
+    Factory* factory = CcTest::i_isolate()->factory();                         \
+    Heap* heap = CcTest::i_isolate()->heap();                                  \
+    /* Length must be bigger than the buffer size of the Utf8Decoder. */       \
+    const char* buf = STRING;                                                  \
+    size_t len = strlen(buf);                                                  \
+    Handle<String> main_string =                                               \
+        factory                                                                \
+            ->NewStringFromOneByte(Vector<const uint8_t>(                      \
+                reinterpret_cast<const uint8_t*>(buf), len))                   \
+            .ToHandleChecked();                                                \
+    CHECK(heap->InNewSpace(*main_string));                                     \
+    /* Next allocation will cause GC. */                                       \
+    heap::SimulateFullSpace(CcTest::i_isolate()->heap()->new_space());         \
+    /* Offset by two to check substring-ing. */                                \
+    Handle<String> s = factory                                                 \
+                           ->NewStringFromUtf8SubString(                       \
+                               Handle<SeqOneByteString>::cast(main_string), 2, \
+                               static_cast<int>(len - 2))                      \
+                           .ToHandleChecked();                                 \
+    Handle<String> expected_string =                                           \
+        factory->NewStringFromUtf8(Vector<const char>(buf + 2, len - 2))       \
+            .ToHandleChecked();                                                \
+    CHECK(s->Equals(*expected_string));                                        \
+  }
+
+GC_INSIDE_NEW_STRING_FROM_UTF8_SUB_STRING(
+    OneByte,
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ")
+GC_INSIDE_NEW_STRING_FROM_UTF8_SUB_STRING(
+    TwoByte,
+    "QQ\xF0\x9F\x98\x8D\xF0\x9F\x98\x8D"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ"
+    "QQ\xF0\x9F\x98\x8D\xF0\x9F\x98\x8D")
+
+#undef GC_INSIDE_NEW_STRING_FROM_UTF8_SUB_STRING
+
 }  // namespace test_strings
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-thread-termination.cc b/deps/v8/test/cctest/test-thread-termination.cc
index 21bdb645a5f..ccc9a74bf7c 100644
--- a/deps/v8/test/cctest/test-thread-termination.cc
+++ b/deps/v8/test/cctest/test-thread-termination.cc
@@ -615,3 +615,103 @@ TEST(TerminateConsole) {
   CHECK(try_catch.HasCaught());
   CHECK(!isolate->IsExecutionTerminating());
 }
+
+class TerminatorSleeperThread : public v8::base::Thread {
+ public:
+  explicit TerminatorSleeperThread(v8::Isolate* isolate, int sleep_ms)
+      : Thread(Options("TerminatorSlepperThread")),
+        isolate_(isolate),
+        sleep_ms_(sleep_ms) {}
+  void Run() {
+    v8::base::OS::Sleep(v8::base::TimeDelta::FromMilliseconds(sleep_ms_));
+    CHECK(!isolate_->IsExecutionTerminating());
+    isolate_->TerminateExecution();
+  }
+
+ private:
+  v8::Isolate* isolate_;
+  int sleep_ms_;
+};
+
+TEST(TerminateRegExp) {
+// regexp interpreter does not support preemption.
+#ifndef V8_INTERPRETED_REGEXP
+  i::FLAG_allow_natives_syntax = true;
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::ObjectTemplate> global = CreateGlobalTemplate(
+      isolate, TerminateCurrentThread, DoLoopCancelTerminate);
+  v8::Local<v8::Context> context = v8::Context::New(isolate, nullptr, global);
+  v8::Context::Scope context_scope(context);
+  CHECK(!isolate->IsExecutionTerminating());
+  v8::TryCatch try_catch(isolate);
+  CHECK(!isolate->IsExecutionTerminating());
+  CHECK(!CompileRun("var re = /(x+)+y$/; re.test('x');").IsEmpty());
+  TerminatorSleeperThread terminator(isolate, 100);
+  terminator.Start();
+  CHECK(CompileRun("re.test('xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'); fail();")
+            .IsEmpty());
+  CHECK(try_catch.HasCaught());
+  CHECK(!isolate->IsExecutionTerminating());
+#endif  // V8_INTERPRETED_REGEXP
+}
+
+TEST(TerminateInMicrotask) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::Locker locker(isolate);
+  isolate->SetMicrotasksPolicy(v8::MicrotasksPolicy::kExplicit);
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::ObjectTemplate> global = CreateGlobalTemplate(
+      isolate, TerminateCurrentThread, DoLoopCancelTerminate);
+  v8::Local<v8::Context> context1 = v8::Context::New(isolate, nullptr, global);
+  v8::Local<v8::Context> context2 = v8::Context::New(isolate, nullptr, global);
+  v8::TryCatch try_catch(isolate);
+  {
+    v8::Context::Scope context_scope(context1);
+    CHECK(!isolate->IsExecutionTerminating());
+    CHECK(!CompileRun("Promise.resolve().then(function() {"
+                      "terminate(); loop(); fail();})")
+               .IsEmpty());
+    CHECK(!try_catch.HasCaught());
+  }
+  {
+    v8::Context::Scope context_scope(context2);
+    CHECK(context2 == isolate->GetCurrentContext());
+    CHECK(context2 == isolate->GetEnteredContext());
+    CHECK(!isolate->IsExecutionTerminating());
+    isolate->RunMicrotasks();
+    CHECK(context2 == isolate->GetCurrentContext());
+    CHECK(context2 == isolate->GetEnteredContext());
+    CHECK(try_catch.HasCaught());
+    CHECK(try_catch.HasTerminated());
+  }
+  CHECK(!isolate->IsExecutionTerminating());
+}
+
+void TerminationMicrotask(void* data) {
+  CcTest::isolate()->TerminateExecution();
+  CompileRun("");
+}
+
+void UnreachableMicrotask(void* data) { UNREACHABLE(); }
+
+TEST(TerminateInApiMicrotask) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::Locker locker(isolate);
+  isolate->SetMicrotasksPolicy(v8::MicrotasksPolicy::kExplicit);
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::ObjectTemplate> global = CreateGlobalTemplate(
+      isolate, TerminateCurrentThread, DoLoopCancelTerminate);
+  v8::Local<v8::Context> context = v8::Context::New(isolate, nullptr, global);
+  v8::TryCatch try_catch(isolate);
+  {
+    v8::Context::Scope context_scope(context);
+    CHECK(!isolate->IsExecutionTerminating());
+    isolate->EnqueueMicrotask(TerminationMicrotask);
+    isolate->EnqueueMicrotask(UnreachableMicrotask);
+    isolate->RunMicrotasks();
+    CHECK(try_catch.HasCaught());
+    CHECK(try_catch.HasTerminated());
+  }
+  CHECK(!isolate->IsExecutionTerminating());
+}
diff --git a/deps/v8/test/cctest/test-typedarrays.cc b/deps/v8/test/cctest/test-typedarrays.cc
index c785b450226..7ec9197b65a 100644
--- a/deps/v8/test/cctest/test-typedarrays.cc
+++ b/deps/v8/test/cctest/test-typedarrays.cc
@@ -87,6 +87,8 @@ TEST(AllocateNotExternal) {
 
 void TestSpeciesProtector(char* code,
                           bool invalidates_species_protector = true) {
+  // Make BigInt64Array/BigUint64Array available for testing.
+  FLAG_harmony_bigint = true;
   v8::Isolate::CreateParams create_params;
   create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
   std::string typed_array_constructors[] = {
@@ -108,22 +110,24 @@ void TestSpeciesProtector(char* code,
       CompileRun(("let constructor = " + constructor + ";").c_str());
       v8::Local<v8::Value> constructor_obj = CompileRun(constructor.c_str());
       CHECK_EQ(constructor_obj, CompileRun("x.slice().constructor"));
+      CHECK_EQ(constructor_obj, CompileRun("x.subarray().constructor"));
       CHECK_EQ(constructor_obj, CompileRun("x.map(()=>{}).constructor"));
       std::string decl = "class MyTypedArray extends " + constructor + " { }";
       CompileRun(decl.c_str());
 
       v8::internal::Isolate* i_isolate =
           reinterpret_cast<v8::internal::Isolate*>(isolate);
-      CHECK(i_isolate->IsArraySpeciesLookupChainIntact());
+      CHECK(i_isolate->IsSpeciesLookupChainIntact());
       CompileRun(code);
       if (invalidates_species_protector) {
-        CHECK(!i_isolate->IsArraySpeciesLookupChainIntact());
+        CHECK(!i_isolate->IsSpeciesLookupChainIntact());
       } else {
-        CHECK(i_isolate->IsArraySpeciesLookupChainIntact());
+        CHECK(i_isolate->IsSpeciesLookupChainIntact());
       }
 
       v8::Local<v8::Value> my_typed_array = CompileRun("MyTypedArray");
       CHECK_EQ(my_typed_array, CompileRun("x.slice().constructor"));
+      CHECK_EQ(my_typed_array, CompileRun("x.subarray().constructor"));
       CHECK_EQ(my_typed_array, CompileRun("x.map(()=>{}).constructor"));
     }
     isolate->Exit();
diff --git a/deps/v8/test/cctest/test-types.cc b/deps/v8/test/cctest/test-types.cc
index 126e64c7de1..ff899f8dfee 100644
--- a/deps/v8/test/cctest/test-types.cc
+++ b/deps/v8/test/cctest/test-types.cc
@@ -273,11 +273,11 @@ struct Tests {
 
     // Typing of Strings
     Handle<String> s1 = fac->NewStringFromAsciiChecked("a");
-    CHECK(T.NewConstant(s1)->Is(T.InternalizedSeqString));
+    CHECK(T.NewConstant(s1)->Is(T.InternalizedString));
     const uc16 two_byte[1] = {0x2603};
     Handle<String> s2 =
         fac->NewTwoByteInternalizedString(Vector<const uc16>(two_byte, 1), 1);
-    CHECK(T.NewConstant(s2)->Is(T.InternalizedSeqString));
+    CHECK(T.NewConstant(s2)->Is(T.InternalizedString));
   }
 
   void Range() {
@@ -621,14 +621,9 @@ struct Tests {
 
     CheckSub(T.UniqueName, T.Name);
     CheckSub(T.String, T.Name);
-    CheckSub(T.InternalizedSeqString, T.InternalizedString);
-    CheckSub(T.InternalizedNonSeqString, T.InternalizedString);
     CheckSub(T.InternalizedString, T.String);
     CheckSub(T.InternalizedString, T.UniqueName);
     CheckSub(T.InternalizedString, T.Name);
-    CheckSub(T.OtherSeqString, T.OtherString);
-    CheckSub(T.OtherNonSeqString, T.OtherString);
-    CheckSub(T.OtherString, T.String);
     CheckSub(T.Symbol, T.UniqueName);
     CheckSub(T.Symbol, T.Name);
     CheckUnordered(T.String, T.UniqueName);
@@ -750,15 +745,10 @@ struct Tests {
     CheckOverlap(T.NaN, T.Number);
     CheckDisjoint(T.Signed32, T.NaN);
     CheckOverlap(T.UniqueName, T.Name);
-    CheckOverlap(T.InternalizedNonSeqString, T.InternalizedString);
-    CheckOverlap(T.InternalizedSeqString, T.InternalizedString);
-    CheckOverlap(T.OtherNonSeqString, T.OtherString);
-    CheckOverlap(T.OtherSeqString, T.OtherString);
     CheckOverlap(T.String, T.Name);
     CheckOverlap(T.InternalizedString, T.String);
     CheckOverlap(T.InternalizedString, T.UniqueName);
     CheckOverlap(T.InternalizedString, T.Name);
-    CheckOverlap(T.OtherString, T.String);
     CheckOverlap(T.Symbol, T.UniqueName);
     CheckOverlap(T.Symbol, T.Name);
     CheckOverlap(T.String, T.UniqueName);
diff --git a/deps/v8/test/cctest/test-utils-arm64.cc b/deps/v8/test/cctest/test-utils-arm64.cc
index e8bc58ffff4..ac647c5c640 100644
--- a/deps/v8/test/cctest/test-utils-arm64.cc
+++ b/deps/v8/test/cctest/test-utils-arm64.cc
@@ -286,8 +286,8 @@ void Clobber(MacroAssembler* masm, RegList reg_list, uint64_t const value) {
   for (unsigned i = 0; i < kNumberOfRegisters; i++) {
     if (reg_list & (1UL << i)) {
       Register xn = Register::Create(i, kXRegSizeInBits);
-      // We should never write into csp here.
-      CHECK(!xn.Is(csp));
+      // We should never write into sp here.
+      CHECK(!xn.Is(sp));
       if (!xn.IsZero()) {
         if (!first.IsValid()) {
           // This is the first register we've hit, so construct the literal.
@@ -337,8 +337,6 @@ void Clobber(MacroAssembler* masm, CPURegList reg_list) {
 
 
 void RegisterDump::Dump(MacroAssembler* masm) {
-  CHECK(__ StackPointer().Is(csp));
-
   // Ensure that we don't unintentionally clobber any registers.
   RegList old_tmp_list = masm->TmpList()->list();
   RegList old_fptmp_list = masm->FPTmpList()->list();
@@ -368,13 +366,13 @@ void RegisterDump::Dump(MacroAssembler* masm) {
   // Load the address where we will dump the state.
   __ Mov(dump_base, reinterpret_cast<uint64_t>(&dump_));
 
-  // Dump the stack pointer (csp and wcsp).
+  // Dump the stack pointer (sp and wsp).
   // The stack pointer cannot be stored directly; it needs to be moved into
   // another register first. Also, we pushed four X registers, so we need to
   // compensate here.
-  __ Add(tmp, csp, 4 * kXRegSize);
+  __ Add(tmp, sp, 4 * kXRegSize);
   __ Str(tmp, MemOperand(dump_base, sp_offset));
-  __ Add(tmp_w, wcsp, 4 * kXRegSize);
+  __ Add(tmp_w, wsp, 4 * kXRegSize);
   __ Str(tmp_w, MemOperand(dump_base, wsp_offset));
 
   // Dump X registers.
diff --git a/deps/v8/test/cctest/test-utils-arm64.h b/deps/v8/test/cctest/test-utils-arm64.h
index 78b266cb0b9..e5b91fb2805 100644
--- a/deps/v8/test/cctest/test-utils-arm64.h
+++ b/deps/v8/test/cctest/test-utils-arm64.h
@@ -52,8 +52,7 @@ class RegisterDump {
   RegisterDump() : completed_(false) {}
 
   // The Dump method generates code to store a snapshot of the register values.
-  // It needs to be able to use the stack temporarily, and requires that the
-  // current stack pointer is csp, and is properly aligned.
+  // It needs to be able to use the stack temporarily.
   //
   // The dumping code is generated though the given MacroAssembler. No registers
   // are corrupted in the process, but the stack is used briefly. The flags will
diff --git a/deps/v8/test/cctest/testcfg.py b/deps/v8/test/cctest/testcfg.py
index 28d1ab27f94..d79d6e4eb4e 100644
--- a/deps/v8/test/cctest/testcfg.py
+++ b/deps/v8/test/cctest/testcfg.py
@@ -37,14 +37,14 @@
 
 
 class TestSuite(testsuite.TestSuite):
-  def ListTests(self, context):
-    shell = os.path.abspath(os.path.join(context.shell_dir, SHELL))
+  def ListTests(self):
+    shell = os.path.abspath(os.path.join(self.test_config.shell_dir, SHELL))
     if utils.IsWindows():
       shell += ".exe"
     cmd = command.Command(
-        cmd_prefix=context.command_prefix,
+        cmd_prefix=self.test_config.command_prefix,
         shell=shell,
-        args=["--list"] + context.extra_flags)
+        args=["--list"] + self.test_config.extra_flags)
     output = cmd.execute()
     if output.exit_code != 0:
       print cmd
@@ -63,9 +63,9 @@ class TestCase(testcase.TestCase):
   def get_shell(self):
     return SHELL
 
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     return [self.path]
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/cctest/trace-extension.h b/deps/v8/test/cctest/trace-extension.h
index b20c4ae9dfa..bfebd34c060 100644
--- a/deps/v8/test/cctest/trace-extension.h
+++ b/deps/v8/test/cctest/trace-extension.h
@@ -28,7 +28,8 @@
 #ifndef V8_TEST_CCTEST_TRACE_EXTENSION_H_
 #define V8_TEST_CCTEST_TRACE_EXTENSION_H_
 
-#include "src/v8.h"
+#include "include/v8.h"
+#include "src/globals.h"
 
 namespace v8 {
 struct TickSample;
diff --git a/deps/v8/test/cctest/wasm/OWNERS b/deps/v8/test/cctest/wasm/OWNERS
index 972daf4d991..3972f0dd992 100644
--- a/deps/v8/test/cctest/wasm/OWNERS
+++ b/deps/v8/test/cctest/wasm/OWNERS
@@ -2,8 +2,6 @@ ahaas@chromium.org
 bradnelson@chromium.org
 clemensh@chromium.org
 eholk@chromium.org
-mtrofin@chromium.org
-rossberg@chromium.org
 titzer@chromium.org
 
 # COMPONENT: Blink>JavaScript>WebAssembly
diff --git a/deps/v8/test/cctest/wasm/test-c-wasm-entry.cc b/deps/v8/test/cctest/wasm/test-c-wasm-entry.cc
index f5c09b519e5..a0617a48825 100644
--- a/deps/v8/test/cctest/wasm/test-c-wasm-entry.cc
+++ b/deps/v8/test/cctest/wasm/test-c-wasm-entry.cc
@@ -62,18 +62,19 @@ class CWasmEntryArgTester {
     Handle<Object> buffer_obj(reinterpret_cast<Object*>(arg_buffer.data()),
                               isolate_);
     CHECK(!buffer_obj->IsHeapObject());
+    WasmContext* wasm_context = wasm_code_->native_module()
+                                    ->compiled_module()
+                                    ->owning_instance()
+                                    ->wasm_context()
+                                    ->get();
     Handle<Object> call_args[]{
-        (FLAG_wasm_jit_to_native
-             ? Handle<Object>::cast(isolate_->factory()->NewForeign(
-                   wasm_code_.GetWasmCode()->instructions().start(), TENURED))
-             : Handle<Object>::cast(wasm_code_.GetCode())),
-        buffer_obj};
+        Handle<Object>::cast(isolate_->factory()->NewForeign(
+            wasm_code_->instructions().start(), TENURED)),
+        handle(reinterpret_cast<Object*>(wasm_context), isolate_), buffer_obj};
     static_assert(
         arraysize(call_args) == compiler::CWasmEntryParameters::kNumParameters,
         "adapt this test");
-    if (FLAG_wasm_jit_to_native) {
-      wasm_code_.GetWasmCode()->owner()->SetExecutable(true);
-    }
+    wasm_code_->native_module()->SetExecutable(true);
     MaybeHandle<Object> return_obj = Execution::Call(
         isolate_, c_wasm_entry_fn_, receiver, arraysize(call_args), call_args);
     CHECK(!return_obj.is_null());
@@ -96,7 +97,7 @@ class CWasmEntryArgTester {
   std::function<ReturnType(Args...)> expected_fn_;
   FunctionSig* sig_;
   Handle<JSFunction> c_wasm_entry_fn_;
-  WasmCodeWrapper wasm_code_;
+  wasm::WasmCode* wasm_code_;
 };
 
 }  // namespace
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-64.cc b/deps/v8/test/cctest/wasm/test-run-wasm-64.cc
index 3ded63730ba..6ca19208a95 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-64.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-64.cc
@@ -21,80 +21,7 @@ namespace internal {
 namespace wasm {
 namespace test_run_wasm_64 {
 
-// If the target architecture is 64-bit, enable all tests.
-#if !V8_TARGET_ARCH_32_BIT || V8_TARGET_ARCH_X64
-#define WASM_64 1
-#else
-#define WASM_64 0
-#endif
-
-// Can't bridge macro land with nested macros.
-#if V8_TARGET_ARCH_MIPS
-#define MIPS true
-#else
-#define MIPS false
-#endif
-
-#define FOREACH_I64_OPERATOR(V) \
-  V(DepthFirst, true)           \
-  V(I64Phi, true)               \
-  V(I64Const, true)             \
-  V(I64Return, true)            \
-  V(I64Param, true)             \
-  V(I64LoadStore, true)         \
-  V(I64Add, true)               \
-  V(I64Sub, true)               \
-  V(I64Mul, !MIPS)              \
-  V(I64DivS, true)              \
-  V(I64DivU, true)              \
-  V(I64RemS, true)              \
-  V(I64RemU, true)              \
-  V(I64And, true)               \
-  V(I64Ior, true)               \
-  V(I64Xor, true)               \
-  V(I64Shl, true)               \
-  V(I64ShrU, true)              \
-  V(I64ShrS, true)              \
-  V(I64Eq, true)                \
-  V(I64Ne, true)                \
-  V(I64LtS, true)               \
-  V(I64LeS, true)               \
-  V(I64LtU, true)               \
-  V(I64LeU, true)               \
-  V(I64GtS, true)               \
-  V(I64GeS, true)               \
-  V(I64GtU, true)               \
-  V(I64GeU, true)               \
-  V(I64Ctz, true)               \
-  V(I64Clz, true)               \
-  V(I64Popcnt, true)            \
-  V(I32ConvertI64, true)        \
-  V(I64SConvertF32, true)       \
-  V(I64SConvertF64, true)       \
-  V(I64UConvertF32, true)       \
-  V(I64UConvertF64, true)       \
-  V(I64SConvertI32, true)       \
-  V(I64UConvertI32, true)       \
-  V(F32SConvertI64, true)       \
-  V(F32UConvertI64, true)       \
-  V(F64SConvertI64, true)       \
-  V(F64UConvertI64, true)       \
-  V(F64ReinterpretI64, true)    \
-  V(I64ReinterpretF64, true)    \
-  V(I64Ror, true)               \
-  V(I64Rol, true)
-
-#define DECLARE_CONST(name, cond) static const bool kSupported_##name = cond;
-FOREACH_I64_OPERATOR(DECLARE_CONST)
-#undef DECLARE_CONST
-
-#undef FOREACH_I64_OPERATOR
-
-#define REQUIRE(name) \
-  if (!WASM_64 && !kSupported_##name) return
-
 WASM_EXEC_TEST(I64Const) {
-  REQUIRE(I64Const);
   WasmRunner<int64_t> r(execution_mode);
   const int64_t kExpectedValue = 0x1122334455667788LL;
   // return(kExpectedValue)
@@ -103,7 +30,6 @@ WASM_EXEC_TEST(I64Const) {
 }
 
 WASM_EXEC_TEST(I64Const_many) {
-  REQUIRE(I64Const);
   int cntr = 0;
   FOR_INT32_INPUTS(i) {
     WasmRunner<int64_t> r(execution_mode);
@@ -116,7 +42,6 @@ WASM_EXEC_TEST(I64Const_many) {
 }
 
 WASM_EXEC_TEST(Return_I64) {
-  REQUIRE(I64Return);
   WasmRunner<int64_t, int64_t> r(execution_mode);
 
   BUILD(r, WASM_RETURN1(WASM_GET_LOCAL(0)));
@@ -125,7 +50,6 @@ WASM_EXEC_TEST(Return_I64) {
 }
 
 WASM_EXEC_TEST(I64Add) {
-  REQUIRE(I64Add);
   WasmRunner<int64_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_ADD(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_INT64_INPUTS(i) {
@@ -139,7 +63,6 @@ WASM_EXEC_TEST(I64Add) {
 const int64_t kHasBit33On = 0x100000000;
 
 WASM_EXEC_TEST(Regress5800_Add) {
-  REQUIRE(I64Add);
   WasmRunner<int32_t> r(execution_mode);
   BUILD(r, WASM_BLOCK(WASM_BR_IF(0, WASM_I64_EQZ(WASM_I64_ADD(
                                         WASM_I64V(0), WASM_I64V(kHasBit33On)))),
@@ -149,7 +72,6 @@ WASM_EXEC_TEST(Regress5800_Add) {
 }
 
 WASM_EXEC_TEST(I64Sub) {
-  REQUIRE(I64Sub);
   WasmRunner<int64_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_SUB(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_INT64_INPUTS(i) {
@@ -158,7 +80,6 @@ WASM_EXEC_TEST(I64Sub) {
 }
 
 WASM_EXEC_TEST(Regress5800_Sub) {
-  REQUIRE(I64Sub);
   WasmRunner<int32_t> r(execution_mode);
   BUILD(r, WASM_BLOCK(WASM_BR_IF(0, WASM_I64_EQZ(WASM_I64_SUB(
                                         WASM_I64V(0), WASM_I64V(kHasBit33On)))),
@@ -168,8 +89,6 @@ WASM_EXEC_TEST(Regress5800_Sub) {
 }
 
 WASM_EXEC_TEST(I64AddUseOnlyLowWord) {
-  REQUIRE(I64Add);
-  REQUIRE(I32ConvertI64);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I32_CONVERT_I64(
                WASM_I64_ADD(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))));
@@ -181,8 +100,6 @@ WASM_EXEC_TEST(I64AddUseOnlyLowWord) {
 }
 
 WASM_EXEC_TEST(I64SubUseOnlyLowWord) {
-  REQUIRE(I64Sub);
-  REQUIRE(I32ConvertI64);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I32_CONVERT_I64(
                WASM_I64_SUB(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))));
@@ -194,8 +111,6 @@ WASM_EXEC_TEST(I64SubUseOnlyLowWord) {
 }
 
 WASM_EXEC_TEST(I64MulUseOnlyLowWord) {
-  REQUIRE(I64Mul);
-  REQUIRE(I32ConvertI64);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I32_CONVERT_I64(
                WASM_I64_MUL(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))));
@@ -207,8 +122,6 @@ WASM_EXEC_TEST(I64MulUseOnlyLowWord) {
 }
 
 WASM_EXEC_TEST(I64ShlUseOnlyLowWord) {
-  REQUIRE(I64Shl);
-  REQUIRE(I32ConvertI64);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I32_CONVERT_I64(
                WASM_I64_SHL(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))));
@@ -221,8 +134,6 @@ WASM_EXEC_TEST(I64ShlUseOnlyLowWord) {
 }
 
 WASM_EXEC_TEST(I64ShrUseOnlyLowWord) {
-  REQUIRE(I64ShrU);
-  REQUIRE(I32ConvertI64);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I32_CONVERT_I64(
                WASM_I64_SHR(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))));
@@ -235,8 +146,6 @@ WASM_EXEC_TEST(I64ShrUseOnlyLowWord) {
 }
 
 WASM_EXEC_TEST(I64SarUseOnlyLowWord) {
-  REQUIRE(I64ShrS);
-  REQUIRE(I32ConvertI64);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I32_CONVERT_I64(
                WASM_I64_SAR(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))));
@@ -249,7 +158,6 @@ WASM_EXEC_TEST(I64SarUseOnlyLowWord) {
 }
 
 WASM_EXEC_TEST(I64DivS) {
-  REQUIRE(I64DivS);
   WasmRunner<int64_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_DIVS(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_INT64_INPUTS(i) {
@@ -266,7 +174,6 @@ WASM_EXEC_TEST(I64DivS) {
 }
 
 WASM_EXEC_TEST(I64DivS_Trap) {
-  REQUIRE(I64DivS);
   WasmRunner<int64_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_DIVS(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   CHECK_EQ(0, r.Call(int64_t{0}, int64_t{100}));
@@ -277,7 +184,6 @@ WASM_EXEC_TEST(I64DivS_Trap) {
 }
 
 WASM_EXEC_TEST(I64DivS_Byzero_Const) {
-  REQUIRE(I64DivS);
   for (int8_t denom = -2; denom < 8; denom++) {
     WasmRunner<int64_t, int64_t> r(execution_mode);
     BUILD(r, WASM_I64_DIVS(WASM_GET_LOCAL(0), WASM_I64V_1(denom)));
@@ -292,7 +198,6 @@ WASM_EXEC_TEST(I64DivS_Byzero_Const) {
 }
 
 WASM_EXEC_TEST(I64DivU) {
-  REQUIRE(I64DivU);
   WasmRunner<uint64_t, uint64_t, uint64_t> r(execution_mode);
   BUILD(r, WASM_I64_DIVU(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_UINT64_INPUTS(i) {
@@ -307,7 +212,6 @@ WASM_EXEC_TEST(I64DivU) {
 }
 
 WASM_EXEC_TEST(I64DivU_Trap) {
-  REQUIRE(I64DivU);
   WasmRunner<uint64_t, uint64_t, uint64_t> r(execution_mode);
   BUILD(r, WASM_I64_DIVU(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   CHECK_EQ(0, r.Call(uint64_t{0}, uint64_t{100}));
@@ -317,7 +221,6 @@ WASM_EXEC_TEST(I64DivU_Trap) {
 }
 
 WASM_EXEC_TEST(I64DivU_Byzero_Const) {
-  REQUIRE(I64DivU);
   for (uint64_t denom = 0xFFFFFFFFFFFFFFFE; denom < 8; denom++) {
     WasmRunner<uint64_t, uint64_t> r(execution_mode);
     BUILD(r, WASM_I64_DIVU(WASM_GET_LOCAL(0), WASM_I64V_1(denom)));
@@ -333,7 +236,6 @@ WASM_EXEC_TEST(I64DivU_Byzero_Const) {
 }
 
 WASM_EXEC_TEST(I64RemS) {
-  REQUIRE(I64RemS);
   WasmRunner<int64_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_REMS(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_INT64_INPUTS(i) {
@@ -348,7 +250,6 @@ WASM_EXEC_TEST(I64RemS) {
 }
 
 WASM_EXEC_TEST(I64RemS_Trap) {
-  REQUIRE(I64RemS);
   WasmRunner<int64_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_REMS(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   CHECK_EQ(33, r.Call(int64_t{133}, int64_t{100}));
@@ -359,7 +260,6 @@ WASM_EXEC_TEST(I64RemS_Trap) {
 }
 
 WASM_EXEC_TEST(I64RemU) {
-  REQUIRE(I64RemU);
   WasmRunner<uint64_t, uint64_t, uint64_t> r(execution_mode);
   BUILD(r, WASM_I64_REMU(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_UINT64_INPUTS(i) {
@@ -374,7 +274,6 @@ WASM_EXEC_TEST(I64RemU) {
 }
 
 WASM_EXEC_TEST(I64RemU_Trap) {
-  REQUIRE(I64RemU);
   WasmRunner<uint64_t, uint64_t, uint64_t> r(execution_mode);
   BUILD(r, WASM_I64_REMU(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   CHECK_EQ(17, r.Call(uint64_t{217}, uint64_t{100}));
@@ -384,7 +283,6 @@ WASM_EXEC_TEST(I64RemU_Trap) {
 }
 
 WASM_EXEC_TEST(I64And) {
-  REQUIRE(I64And);
   WasmRunner<int64_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_AND(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_INT64_INPUTS(i) {
@@ -393,7 +291,6 @@ WASM_EXEC_TEST(I64And) {
 }
 
 WASM_EXEC_TEST(I64Ior) {
-  REQUIRE(I64Ior);
   WasmRunner<int64_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_IOR(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_INT64_INPUTS(i) {
@@ -402,7 +299,6 @@ WASM_EXEC_TEST(I64Ior) {
 }
 
 WASM_EXEC_TEST(I64Xor) {
-  REQUIRE(I64Xor);
   WasmRunner<int64_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_XOR(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_INT64_INPUTS(i) {
@@ -411,7 +307,6 @@ WASM_EXEC_TEST(I64Xor) {
 }
 
 WASM_EXEC_TEST(I64Shl) {
-  REQUIRE(I64Shl);
   {
     WasmRunner<uint64_t, uint64_t, uint64_t> r(execution_mode);
     BUILD(r, WASM_I64_SHL(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
@@ -446,7 +341,6 @@ WASM_EXEC_TEST(I64Shl) {
 }
 
 WASM_EXEC_TEST(I64ShrU) {
-  REQUIRE(I64ShrU);
   {
     WasmRunner<uint64_t, uint64_t, uint64_t> r(execution_mode);
     BUILD(r, WASM_I64_SHR(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
@@ -481,7 +375,6 @@ WASM_EXEC_TEST(I64ShrU) {
 }
 
 WASM_EXEC_TEST(I64ShrS) {
-  REQUIRE(I64ShrS);
   {
     WasmRunner<int64_t, int64_t, int64_t> r(execution_mode);
     BUILD(r, WASM_I64_SAR(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
@@ -516,7 +409,6 @@ WASM_EXEC_TEST(I64ShrS) {
 }
 
 WASM_EXEC_TEST(I64Eq) {
-  REQUIRE(I64Eq);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_EQ(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_INT64_INPUTS(i) {
@@ -525,7 +417,6 @@ WASM_EXEC_TEST(I64Eq) {
 }
 
 WASM_EXEC_TEST(I64Ne) {
-  REQUIRE(I64Ne);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_NE(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_INT64_INPUTS(i) {
@@ -534,7 +425,6 @@ WASM_EXEC_TEST(I64Ne) {
 }
 
 WASM_EXEC_TEST(I64LtS) {
-  REQUIRE(I64LtS);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_LTS(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_INT64_INPUTS(i) {
@@ -543,7 +433,6 @@ WASM_EXEC_TEST(I64LtS) {
 }
 
 WASM_EXEC_TEST(I64LeS) {
-  REQUIRE(I64LeS);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_LES(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_INT64_INPUTS(i) {
@@ -552,7 +441,6 @@ WASM_EXEC_TEST(I64LeS) {
 }
 
 WASM_EXEC_TEST(I64LtU) {
-  REQUIRE(I64LtU);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_LTU(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_UINT64_INPUTS(i) {
@@ -561,7 +449,6 @@ WASM_EXEC_TEST(I64LtU) {
 }
 
 WASM_EXEC_TEST(I64LeU) {
-  REQUIRE(I64LeU);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_LEU(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_UINT64_INPUTS(i) {
@@ -570,7 +457,6 @@ WASM_EXEC_TEST(I64LeU) {
 }
 
 WASM_EXEC_TEST(I64GtS) {
-  REQUIRE(I64GtS);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_GTS(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_INT64_INPUTS(i) {
@@ -579,7 +465,6 @@ WASM_EXEC_TEST(I64GtS) {
 }
 
 WASM_EXEC_TEST(I64GeS) {
-  REQUIRE(I64GeS);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_GES(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_INT64_INPUTS(i) {
@@ -588,7 +473,6 @@ WASM_EXEC_TEST(I64GeS) {
 }
 
 WASM_EXEC_TEST(I64GtU) {
-  REQUIRE(I64GtU);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_GTU(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_UINT64_INPUTS(i) {
@@ -597,7 +481,6 @@ WASM_EXEC_TEST(I64GtU) {
 }
 
 WASM_EXEC_TEST(I64GeU) {
-  REQUIRE(I64GeU);
   WasmRunner<int32_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_GEU(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
   FOR_UINT64_INPUTS(i) {
@@ -606,7 +489,6 @@ WASM_EXEC_TEST(I64GeU) {
 }
 
 WASM_EXEC_TEST(I32ConvertI64) {
-  REQUIRE(I32ConvertI64);
   FOR_INT64_INPUTS(i) {
     WasmRunner<int32_t> r(execution_mode);
     BUILD(r, WASM_I32_CONVERT_I64(WASM_I64V(*i)));
@@ -615,14 +497,12 @@ WASM_EXEC_TEST(I32ConvertI64) {
 }
 
 WASM_EXEC_TEST(I64SConvertI32) {
-  REQUIRE(I64SConvertI32);
   WasmRunner<int64_t, int32_t> r(execution_mode);
   BUILD(r, WASM_I64_SCONVERT_I32(WASM_GET_LOCAL(0)));
   FOR_INT32_INPUTS(i) { CHECK_EQ(static_cast<int64_t>(*i), r.Call(*i)); }
 }
 
 WASM_EXEC_TEST(I64UConvertI32) {
-  REQUIRE(I64UConvertI32);
   WasmRunner<int64_t, uint32_t> r(execution_mode);
   BUILD(r, WASM_I64_UCONVERT_I32(WASM_GET_LOCAL(0)));
   FOR_UINT32_INPUTS(i) { CHECK_EQ(static_cast<int64_t>(*i), r.Call(*i)); }
@@ -646,14 +526,12 @@ WASM_EXEC_TEST(I64Popcnt) {
 }
 
 WASM_EXEC_TEST(F32SConvertI64) {
-  REQUIRE(F32SConvertI64);
   WasmRunner<float, int64_t> r(execution_mode);
   BUILD(r, WASM_F32_SCONVERT_I64(WASM_GET_LOCAL(0)));
   FOR_INT64_INPUTS(i) { CHECK_FLOAT_EQ(static_cast<float>(*i), r.Call(*i)); }
 }
 
 WASM_EXEC_TEST(F32UConvertI64) {
-  REQUIRE(F32UConvertI64);
   struct {
     uint64_t input;
     uint32_t expected;
@@ -741,14 +619,12 @@ WASM_EXEC_TEST(F32UConvertI64) {
 }
 
 WASM_EXEC_TEST(F64SConvertI64) {
-  REQUIRE(F64SConvertI64);
   WasmRunner<double, int64_t> r(execution_mode);
   BUILD(r, WASM_F64_SCONVERT_I64(WASM_GET_LOCAL(0)));
   FOR_INT64_INPUTS(i) { CHECK_DOUBLE_EQ(static_cast<double>(*i), r.Call(*i)); }
 }
 
 WASM_EXEC_TEST(F64UConvertI64) {
-  REQUIRE(F64UConvertI64);
   struct {
     uint64_t input;
     uint64_t expected;
@@ -834,7 +710,7 @@ WASM_EXEC_TEST(F64UConvertI64) {
   }
 }
 
-WASM_EXEC_TEST(I64SConvertF32a) {
+WASM_EXEC_TEST(I64SConvertF32) {
   WasmRunner<int64_t, float> r(execution_mode);
   BUILD(r, WASM_I64_SCONVERT_F32(WASM_GET_LOCAL(0)));
 
@@ -848,7 +724,28 @@ WASM_EXEC_TEST(I64SConvertF32a) {
   }
 }
 
-WASM_EXEC_TEST(I64SConvertF64a) {
+WASM_EXEC_TEST(I64SConvertSatF32) {
+  EXPERIMENTAL_FLAG_SCOPE(sat_f2i_conversions);
+  WasmRunner<int64_t, float> r(execution_mode);
+  BUILD(r, WASM_I64_SCONVERT_SAT_F32(WASM_GET_LOCAL(0)));
+  FOR_FLOAT32_INPUTS(i) {
+    int64_t expected;
+    if (*i < static_cast<float>(std::numeric_limits<int64_t>::max()) &&
+        *i >= static_cast<float>(std::numeric_limits<int64_t>::min())) {
+      expected = static_cast<int64_t>(*i);
+    } else if (std::isnan(*i)) {
+      expected = static_cast<int64_t>(0);
+    } else if (*i < 0.0) {
+      expected = std::numeric_limits<int64_t>::min();
+    } else {
+      expected = std::numeric_limits<int64_t>::max();
+    }
+    int64_t found = r.Call(*i);
+    CHECK_EQ(expected, found);
+  }
+}
+
+WASM_EXEC_TEST(I64SConvertF64) {
   WasmRunner<int64_t, double> r(execution_mode);
   BUILD(r, WASM_I64_SCONVERT_F64(WASM_GET_LOCAL(0)));
 
@@ -862,7 +759,28 @@ WASM_EXEC_TEST(I64SConvertF64a) {
   }
 }
 
-WASM_EXEC_TEST(I64UConvertF32a) {
+WASM_EXEC_TEST(I64SConvertSatF64) {
+  EXPERIMENTAL_FLAG_SCOPE(sat_f2i_conversions);
+  WasmRunner<int64_t, double> r(execution_mode);
+  BUILD(r, WASM_I64_SCONVERT_SAT_F64(WASM_GET_LOCAL(0)));
+  FOR_FLOAT64_INPUTS(i) {
+    int64_t expected;
+    if (*i < static_cast<double>(std::numeric_limits<int64_t>::max()) &&
+        *i >= static_cast<double>(std::numeric_limits<int64_t>::min())) {
+      expected = static_cast<int64_t>(*i);
+    } else if (std::isnan(*i)) {
+      expected = static_cast<int64_t>(0);
+    } else if (*i < 0.0) {
+      expected = std::numeric_limits<int64_t>::min();
+    } else {
+      expected = std::numeric_limits<int64_t>::max();
+    }
+    int64_t found = r.Call(*i);
+    CHECK_EQ(expected, found);
+  }
+}
+
+WASM_EXEC_TEST(I64UConvertF32) {
   WasmRunner<uint64_t, float> r(execution_mode);
   BUILD(r, WASM_I64_UCONVERT_F32(WASM_GET_LOCAL(0)));
 
@@ -876,7 +794,28 @@ WASM_EXEC_TEST(I64UConvertF32a) {
   }
 }
 
-WASM_EXEC_TEST(I64UConvertF64a) {
+WASM_EXEC_TEST(I64UConvertSatF32) {
+  EXPERIMENTAL_FLAG_SCOPE(sat_f2i_conversions);
+  WasmRunner<int64_t, float> r(execution_mode);
+  BUILD(r, WASM_I64_UCONVERT_SAT_F32(WASM_GET_LOCAL(0)));
+  FOR_FLOAT32_INPUTS(i) {
+    uint64_t expected;
+    if (*i < static_cast<float>(std::numeric_limits<uint64_t>::max()) &&
+        *i > -1) {
+      expected = static_cast<uint64_t>(*i);
+    } else if (std::isnan(*i)) {
+      expected = static_cast<uint64_t>(0);
+    } else if (*i < 0.0) {
+      expected = std::numeric_limits<uint64_t>::min();
+    } else {
+      expected = std::numeric_limits<uint64_t>::max();
+    }
+    uint64_t found = r.Call(*i);
+    CHECK_EQ(expected, found);
+  }
+}
+
+WASM_EXEC_TEST(I64UConvertF64) {
   WasmRunner<uint64_t, double> r(execution_mode);
   BUILD(r, WASM_I64_UCONVERT_F64(WASM_GET_LOCAL(0)));
 
@@ -890,6 +829,27 @@ WASM_EXEC_TEST(I64UConvertF64a) {
   }
 }
 
+WASM_EXEC_TEST(I64UConvertSatF64) {
+  EXPERIMENTAL_FLAG_SCOPE(sat_f2i_conversions);
+  WasmRunner<int64_t, double> r(execution_mode);
+  BUILD(r, WASM_I64_UCONVERT_SAT_F64(WASM_GET_LOCAL(0)));
+  FOR_FLOAT64_INPUTS(i) {
+    int64_t expected;
+    if (*i < static_cast<float>(std::numeric_limits<uint64_t>::max()) &&
+        *i > -1) {
+      expected = static_cast<uint64_t>(*i);
+    } else if (std::isnan(*i)) {
+      expected = static_cast<uint64_t>(0);
+    } else if (*i < 0.0) {
+      expected = std::numeric_limits<uint64_t>::min();
+    } else {
+      expected = std::numeric_limits<uint64_t>::max();
+    }
+    int64_t found = r.Call(*i);
+    CHECK_EQ(expected, found);
+  }
+}
+
 WASM_EXEC_TEST(CallI64Parameter) {
   ValueType param_types[20];
   for (int i = 0; i < 20; i++) param_types[i] = kWasmI64;
@@ -973,69 +933,71 @@ void TestI64Cmp(WasmExecutionMode execution_mode, WasmOpcode opcode,
   }
 }
 
-#define TEST_I64_BINOP(name, expected, a, b)                     \
-  do {                                                           \
-    if (WASM_64 || kSupported_##name)                            \
-      TestI64Binop(execution_mode, kExpr##name, expected, a, b); \
-  } while (false)
-
 WASM_EXEC_TEST(I64Binops) {
-  TEST_I64_BINOP(I64Add, -5586332274295447011, 0x501B72EBABC26847,
-                 0x625DE9793D8F79D6);
-  TEST_I64_BINOP(I64Sub, 9001903251710731490, 0xF24FE6474640002E,
-                 0x7562B6F711991B4C);
-  TEST_I64_BINOP(I64Mul, -4569547818546064176, 0x231A263C2CBC6451,
-                 0xEAD44DE6BD3E23D0);
-  TEST_I64_BINOP(I64Mul, -25963122347507043, 0x4DA1FA47C9352B73,
-                 0x91FE82317AA035AF);
-  TEST_I64_BINOP(I64Mul, 7640290486138131960, 0x185731ABE8EEA47C,
-                 0x714EC59F1380D4C2);
-  TEST_I64_BINOP(I64DivS, -91517, 0x93B1190A34DE56A0, 0x00004D8F68863948);
-  TEST_I64_BINOP(I64DivU, 149016, 0xE15B3727E8A2080A, 0x0000631BFA72DB8B);
-  TEST_I64_BINOP(I64RemS, -664128064149968, 0x9A78B4E4FE708692,
-                 0x0003E0B6B3BE7609);
-  TEST_I64_BINOP(I64RemU, 1742040017332765, 0x0CE84708C6258C81,
-                 0x000A6FDE82016697);
-  TEST_I64_BINOP(I64And, 2531040582801836054, 0xAF257D1602644A16,
-                 0x33B290A91A10D997);
-  TEST_I64_BINOP(I64Ior, 8556201506536114940, 0x169D9BE7BD3F0A5C,
-                 0x66BCA28D77AF40E8);
-  TEST_I64_BINOP(I64Xor, -4605655183785456377, 0xB6EA20A5D48E85B8,
-                 0x76FF4DA6C80688BF);
-  TEST_I64_BINOP(I64Shl, -7240704056088331264, 0xEF4DC1ED030E8FFE, 9);
-  TEST_I64_BINOP(I64ShrU, 12500673744059159, 0xB1A52FA7DEEC5D14, 10);
-  TEST_I64_BINOP(I64ShrS, 1725103446999874, 0x3107C791461A112B, 11);
-  TEST_I64_BINOP(I64Ror, -8960135652432576946, 0x73418D1717E4E83A, 12);
-  TEST_I64_BINOP(I64Ror, 7617662827409989779, 0xEBFF67CF0C126D36, 13);
-  TEST_I64_BINOP(I64Rol, -2097714064174346012, 0x43938B8DB0B0F230, 14);
-  TEST_I64_BINOP(I64Rol, 8728493013947314237, 0xE07AF243AC4D219D, 15);
-}
-
-#undef TEST_I64_BINOP
-
-#define TEST_I64_CMP(name, expected, a, b)                     \
-  do {                                                         \
-    if (WASM_64 || kSupported_##name)                          \
-      TestI64Cmp(execution_mode, kExpr##name, expected, a, b); \
-  } while (false)
+  TestI64Binop(execution_mode, kExprI64Add, -5586332274295447011,
+               0x501B72EBABC26847, 0x625DE9793D8F79D6);
+  TestI64Binop(execution_mode, kExprI64Sub, 9001903251710731490,
+               0xF24FE6474640002E, 0x7562B6F711991B4C);
+  TestI64Binop(execution_mode, kExprI64Mul, -4569547818546064176,
+               0x231A263C2CBC6451, 0xEAD44DE6BD3E23D0);
+  TestI64Binop(execution_mode, kExprI64Mul, -25963122347507043,
+               0x4DA1FA47C9352B73, 0x91FE82317AA035AF);
+  TestI64Binop(execution_mode, kExprI64Mul, 7640290486138131960,
+               0x185731ABE8EEA47C, 0x714EC59F1380D4C2);
+  TestI64Binop(execution_mode, kExprI64DivS, -91517, 0x93B1190A34DE56A0,
+               0x00004D8F68863948);
+  TestI64Binop(execution_mode, kExprI64DivU, 149016, 0xE15B3727E8A2080A,
+               0x0000631BFA72DB8B);
+  TestI64Binop(execution_mode, kExprI64RemS, -664128064149968,
+               0x9A78B4E4FE708692, 0x0003E0B6B3BE7609);
+  TestI64Binop(execution_mode, kExprI64RemU, 1742040017332765,
+               0x0CE84708C6258C81, 0x000A6FDE82016697);
+  TestI64Binop(execution_mode, kExprI64And, 2531040582801836054,
+               0xAF257D1602644A16, 0x33B290A91A10D997);
+  TestI64Binop(execution_mode, kExprI64Ior, 8556201506536114940,
+               0x169D9BE7BD3F0A5C, 0x66BCA28D77AF40E8);
+  TestI64Binop(execution_mode, kExprI64Xor, -4605655183785456377,
+               0xB6EA20A5D48E85B8, 0x76FF4DA6C80688BF);
+  TestI64Binop(execution_mode, kExprI64Shl, -7240704056088331264,
+               0xEF4DC1ED030E8FFE, 9);
+  TestI64Binop(execution_mode, kExprI64ShrU, 12500673744059159,
+               0xB1A52FA7DEEC5D14, 10);
+  TestI64Binop(execution_mode, kExprI64ShrS, 1725103446999874,
+               0x3107C791461A112B, 11);
+  TestI64Binop(execution_mode, kExprI64Ror, -8960135652432576946,
+               0x73418D1717E4E83A, 12);
+  TestI64Binop(execution_mode, kExprI64Ror, 7617662827409989779,
+               0xEBFF67CF0C126D36, 13);
+  TestI64Binop(execution_mode, kExprI64Rol, -2097714064174346012,
+               0x43938B8DB0B0F230, 14);
+  TestI64Binop(execution_mode, kExprI64Rol, 8728493013947314237,
+               0xE07AF243AC4D219D, 15);
+}
 
 WASM_EXEC_TEST(I64Compare) {
-  TEST_I64_CMP(I64Eq, 0, 0xB915D8FA494064F0, 0x04D700B2536019A3);
-  TEST_I64_CMP(I64Ne, 1, 0xC2FAFAAAB0446CDC, 0x52A3328F780C97A3);
-  TEST_I64_CMP(I64LtS, 0, 0x673636E6306B0578, 0x028EC9ECA78F7227);
-  TEST_I64_CMP(I64LeS, 1, 0xAE5214114B86A0FA, 0x7C1D21DA3DFD0CCF);
-  TEST_I64_CMP(I64LtU, 0, 0x7D52166381EC1CE0, 0x59F4A6A9E78CD3D8);
-  TEST_I64_CMP(I64LeU, 1, 0xE4169A385C7EA0E0, 0xFBDBED2C8781E5BC);
-  TEST_I64_CMP(I64GtS, 0, 0x9D08FF8FB5F42E81, 0xD4E5C9D7FE09F621);
-  TEST_I64_CMP(I64GeS, 1, 0x78DA3B2F73264E0F, 0x6FE5E2A67C501CBE);
-  TEST_I64_CMP(I64GtU, 0, 0x8F691284E44F7DA9, 0xD5EA9BC1EE149192);
-  TEST_I64_CMP(I64GeU, 0, 0x0886A0C58C7AA224, 0x5DDBE5A81FD7EE47);
+  TestI64Cmp(execution_mode, kExprI64Eq, 0, 0xB915D8FA494064F0,
+             0x04D700B2536019A3);
+  TestI64Cmp(execution_mode, kExprI64Ne, 1, 0xC2FAFAAAB0446CDC,
+             0x52A3328F780C97A3);
+  TestI64Cmp(execution_mode, kExprI64LtS, 0, 0x673636E6306B0578,
+             0x028EC9ECA78F7227);
+  TestI64Cmp(execution_mode, kExprI64LeS, 1, 0xAE5214114B86A0FA,
+             0x7C1D21DA3DFD0CCF);
+  TestI64Cmp(execution_mode, kExprI64LtU, 0, 0x7D52166381EC1CE0,
+             0x59F4A6A9E78CD3D8);
+  TestI64Cmp(execution_mode, kExprI64LeU, 1, 0xE4169A385C7EA0E0,
+             0xFBDBED2C8781E5BC);
+  TestI64Cmp(execution_mode, kExprI64GtS, 0, 0x9D08FF8FB5F42E81,
+             0xD4E5C9D7FE09F621);
+  TestI64Cmp(execution_mode, kExprI64GeS, 1, 0x78DA3B2F73264E0F,
+             0x6FE5E2A67C501CBE);
+  TestI64Cmp(execution_mode, kExprI64GtU, 0, 0x8F691284E44F7DA9,
+             0xD5EA9BC1EE149192);
+  TestI64Cmp(execution_mode, kExprI64GeU, 0, 0x0886A0C58C7AA224,
+             0x5DDBE5A81FD7EE47);
 }
 
-#undef TEST_I64_CMP
-
 WASM_EXEC_TEST(I64Clz) {
-  REQUIRE(I64Clz);
   struct {
     int64_t expected;
     uint64_t input;
@@ -1081,7 +1043,6 @@ WASM_EXEC_TEST(I64Clz) {
 }
 
 WASM_EXEC_TEST(I64Ctz) {
-  REQUIRE(I64Ctz);
   struct {
     int64_t expected;
     uint64_t input;
@@ -1127,7 +1088,6 @@ WASM_EXEC_TEST(I64Ctz) {
 }
 
 WASM_EXEC_TEST(I64Popcnt2) {
-  REQUIRE(I64Popcnt);
   struct {
     int64_t expected;
     uint64_t input;
@@ -1147,8 +1107,6 @@ WASM_EXEC_TEST(I64Popcnt2) {
 // Test the WasmRunner with an Int64 return value and different numbers of
 // Int64 parameters.
 WASM_EXEC_TEST(I64WasmRunner) {
-  REQUIRE(I64Param);
-  REQUIRE(I64Xor);
   {FOR_INT64_INPUTS(i){WasmRunner<int64_t> r(execution_mode);
   BUILD(r, WASM_I64V(*i));
   CHECK_EQ(*i, r.Call());
@@ -1196,7 +1154,6 @@ WASM_EXEC_TEST(I64WasmRunner) {
 }
 
 WASM_EXEC_TEST(Call_Int64Sub) {
-  REQUIRE(I64Sub);
   WasmRunner<int64_t, int64_t, int64_t> r(execution_mode);
   // Build the target function.
   TestSignatures sigs;
@@ -1222,8 +1179,6 @@ WASM_EXEC_TEST(Call_Int64Sub) {
 }
 
 WASM_EXEC_TEST(LoadStoreI64_sx) {
-  REQUIRE(I64LoadStore);
-  REQUIRE(DepthFirst);
   byte loads[] = {kExprI64LoadMem8S, kExprI64LoadMem16S, kExprI64LoadMem32S,
                   kExprI64LoadMem};
 
@@ -1265,66 +1220,8 @@ WASM_EXEC_TEST(LoadStoreI64_sx) {
   }
 }
 
-WASM_EXEC_TEST(I64SConvertF32b) {
-  REQUIRE(I64SConvertF32);
-  WasmRunner<int64_t, float> r(execution_mode);
-  BUILD(r, WASM_I64_SCONVERT_F32(WASM_GET_LOCAL(0)));
-
-  FOR_FLOAT32_INPUTS(i) {
-    if (*i < static_cast<float>(INT64_MAX) &&
-        *i >= static_cast<float>(INT64_MIN)) {
-      CHECK_EQ(static_cast<int64_t>(*i), r.Call(*i));
-    } else {
-      CHECK_TRAP64(r.Call(*i));
-    }
-  }
-}
-
-WASM_EXEC_TEST(I64SConvertF64b) {
-  REQUIRE(I64SConvertF64);
-  WasmRunner<int64_t, double> r(execution_mode);
-  BUILD(r, WASM_I64_SCONVERT_F64(WASM_GET_LOCAL(0)));
-
-  FOR_FLOAT64_INPUTS(i) {
-    if (*i < static_cast<double>(INT64_MAX) &&
-        *i >= static_cast<double>(INT64_MIN)) {
-      CHECK_EQ(static_cast<int64_t>(*i), r.Call(*i));
-    } else {
-      CHECK_TRAP64(r.Call(*i));
-    }
-  }
-}
-
-WASM_EXEC_TEST(I64UConvertF32b) {
-  REQUIRE(I64UConvertF32);
-  WasmRunner<uint64_t, float> r(execution_mode);
-  BUILD(r, WASM_I64_UCONVERT_F32(WASM_GET_LOCAL(0)));
-
-  FOR_FLOAT32_INPUTS(i) {
-    if (*i < static_cast<float>(UINT64_MAX) && *i > -1) {
-      CHECK_EQ(static_cast<uint64_t>(*i), r.Call(*i));
-    } else {
-      CHECK_TRAP64(r.Call(*i));
-    }
-  }
-}
-
-WASM_EXEC_TEST(I64UConvertF64b) {
-  REQUIRE(I64UConvertF64);
-  WasmRunner<uint64_t, double> r(execution_mode);
-  BUILD(r, WASM_I64_UCONVERT_F64(WASM_GET_LOCAL(0)));
-
-  FOR_FLOAT64_INPUTS(i) {
-    if (*i < static_cast<float>(UINT64_MAX) && *i > -1) {
-      CHECK_EQ(static_cast<uint64_t>(*i), r.Call(*i));
-    } else {
-      CHECK_TRAP64(r.Call(*i));
-    }
-  }
-}
 
 WASM_EXEC_TEST(I64ReinterpretF64) {
-  REQUIRE(I64ReinterpretF64);
   WasmRunner<int64_t> r(execution_mode);
   int64_t* memory = r.builder().AddMemoryElems<int64_t>(8);
 
@@ -1339,7 +1236,6 @@ WASM_EXEC_TEST(I64ReinterpretF64) {
 }
 
 WASM_EXEC_TEST(SignallingNanSurvivesI64ReinterpretF64) {
-  REQUIRE(I64ReinterpretF64);
   WasmRunner<int64_t> r(execution_mode);
   BUILD(r, WASM_I64_REINTERPRET_F64(WASM_SEQ(kExprF64Const, 0x00, 0x00, 0x00,
                                              0x00, 0x00, 0x00, 0xF4, 0x7F)));
@@ -1349,7 +1245,6 @@ WASM_EXEC_TEST(SignallingNanSurvivesI64ReinterpretF64) {
 }
 
 WASM_EXEC_TEST(F64ReinterpretI64) {
-  REQUIRE(F64ReinterpretI64);
   WasmRunner<int64_t, int64_t> r(execution_mode);
   int64_t* memory = r.builder().AddMemoryElems<int64_t>(8);
 
@@ -1365,7 +1260,6 @@ WASM_EXEC_TEST(F64ReinterpretI64) {
 }
 
 WASM_EXEC_TEST(LoadMemI64) {
-  REQUIRE(I64LoadStore);
   WasmRunner<int64_t> r(execution_mode);
   int64_t* memory = r.builder().AddMemoryElems<int64_t>(8);
   r.builder().RandomizeMemory(1111);
@@ -1383,7 +1277,6 @@ WASM_EXEC_TEST(LoadMemI64) {
 }
 
 WASM_EXEC_TEST(LoadMemI64_alignment) {
-  REQUIRE(I64LoadStore);
   for (byte alignment = 0; alignment <= 3; alignment++) {
     WasmRunner<int64_t> r(execution_mode);
     int64_t* memory = r.builder().AddMemoryElems<int64_t>(8);
@@ -1404,10 +1297,6 @@ WASM_EXEC_TEST(LoadMemI64_alignment) {
 }
 
 WASM_EXEC_TEST(MemI64_Sum) {
-  REQUIRE(I64LoadStore);
-  REQUIRE(I64Add);
-  REQUIRE(I64Sub);
-  REQUIRE(I64Phi);
   const int kNumElems = 20;
   WasmRunner<uint64_t, int32_t> r(execution_mode);
   uint64_t* memory = r.builder().AddMemoryElems<uint64_t>(kNumElems);
@@ -1454,10 +1343,6 @@ WASM_EXEC_TEST(StoreMemI64_alignment) {
 }
 
 WASM_EXEC_TEST(I64Global) {
-  REQUIRE(I64LoadStore);
-  REQUIRE(I64SConvertI32);
-  REQUIRE(I64And);
-  REQUIRE(DepthFirst);
   WasmRunner<int32_t, int32_t> r(execution_mode);
   int64_t* global = r.builder().AddGlobal<int64_t>();
   // global = global + p0
@@ -1475,8 +1360,6 @@ WASM_EXEC_TEST(I64Global) {
 }
 
 WASM_EXEC_TEST(I64Eqz) {
-  REQUIRE(I64Eq);
-
   WasmRunner<int32_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_EQZ(WASM_GET_LOCAL(0)));
 
@@ -1487,7 +1370,6 @@ WASM_EXEC_TEST(I64Eqz) {
 }
 
 WASM_EXEC_TEST(I64Ror) {
-  REQUIRE(I64Ror);
   WasmRunner<int64_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_ROR(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
 
@@ -1500,7 +1382,6 @@ WASM_EXEC_TEST(I64Ror) {
 }
 
 WASM_EXEC_TEST(I64Rol) {
-  REQUIRE(I64Rol);
   WasmRunner<int64_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_ROL(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
 
@@ -1703,9 +1584,6 @@ WASM_EXEC_TEST(MixedCall_i64_2) { Run_WasmMixedCall_N(execution_mode, 2); }
 WASM_EXEC_TEST(MixedCall_i64_3) { Run_WasmMixedCall_N(execution_mode, 3); }
 
 WASM_EXEC_TEST(Regress5874) {
-  REQUIRE(I32ConvertI64);
-  REQUIRE(I64LoadStore);
-  REQUIRE(I64Const);
   WasmRunner<int32_t> r(execution_mode);
   r.builder().AddMemoryElems<int64_t>(8);
 
@@ -1719,7 +1597,6 @@ WASM_EXEC_TEST(Regress5874) {
 }
 
 WASM_EXEC_TEST(Regression_6858) {
-  REQUIRE(I64DivS);
   // WasmRunner with 5 params and returns, which is the maximum.
   WasmRunner<int64_t, int64_t, int64_t, int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_DIVS(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
@@ -1729,9 +1606,6 @@ WASM_EXEC_TEST(Regression_6858) {
   CHECK_TRAP64(r.Call(dividend, divisor, filler, filler));
 }
 
-#undef WASM_64
-#undef MIPS
-#undef REQUIRE
 #undef ADD_CODE
 
 // clang-format gets confused about these closing parentheses (wants to change
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-atomics.cc b/deps/v8/test/cctest/wasm/test-run-wasm-atomics.cc
index 3b0e319bb43..eac90790452 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-atomics.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-atomics.cc
@@ -2,55 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/objects-inl.h"
-#include "test/cctest/cctest.h"
-#include "test/cctest/compiler/value-helper.h"
-#include "test/cctest/wasm/wasm-run-utils.h"
+#include "test/cctest/wasm/wasm-atomics-utils.h"
 #include "test/common/wasm/wasm-macro-gen.h"
 
 namespace v8 {
 namespace internal {
 namespace wasm {
-
-typedef uint32_t (*Uint32BinOp)(uint32_t, uint32_t);
-typedef uint16_t (*Uint16BinOp)(uint16_t, uint16_t);
-typedef uint8_t (*Uint8BinOp)(uint8_t, uint8_t);
-
-template <typename T>
-T Add(T a, T b) {
-  return a + b;
-}
-
-template <typename T>
-T Sub(T a, T b) {
-  return a - b;
-}
-
-template <typename T>
-T And(T a, T b) {
-  return a & b;
-}
-
-template <typename T>
-T Or(T a, T b) {
-  return a | b;
-}
-
-template <typename T>
-T Xor(T a, T b) {
-  return a ^ b;
-}
-
-template <typename T>
-T Exchange(T a, T b) {
-  return b;
-}
-
-template <typename T>
-T CompareExchange(T initial, T a, T b) {
-  if (initial == a) return b;
-  return a;
-}
+namespace test_run_wasm_atomics {
 
 void RunU32BinOp(WasmExecutionMode execution_mode, WasmOpcode wasm_op,
                  Uint32BinOp expected_op) {
@@ -337,6 +295,7 @@ WASM_EXEC_TEST(I32AtomicStoreLoad8U) {
   }
 }
 
+}  // namespace test_run_wasm_atomics
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc b/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc
new file mode 100644
index 00000000000..eb22b321de8
--- /dev/null
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc
@@ -0,0 +1,395 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "test/cctest/wasm/wasm-atomics-utils.h"
+#include "test/common/wasm/wasm-macro-gen.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+namespace test_run_wasm_atomics_64 {
+
+void RunU64BinOp(WasmExecutionMode execution_mode, WasmOpcode wasm_op,
+                 Uint64BinOp expected_op) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t, uint64_t> r(execution_mode);
+  uint64_t* memory = r.builder().AddMemoryElems<uint64_t>(8);
+  r.builder().SetHasSharedMemory();
+
+  BUILD(r, WASM_ATOMICS_BINOP(wasm_op, WASM_I32V_1(0), WASM_GET_LOCAL(0),
+                              MachineRepresentation::kWord64));
+
+  FOR_UINT64_INPUTS(i) {
+    uint64_t initial = *i;
+    FOR_UINT64_INPUTS(j) {
+      r.builder().WriteMemory(&memory[0], initial);
+      CHECK_EQ(initial, r.Call(*j));
+      uint64_t expected = expected_op(*i, *j);
+      CHECK_EQ(expected, r.builder().ReadMemory(&memory[0]));
+    }
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicAdd) {
+  RunU64BinOp(execution_mode, kExprI64AtomicAdd, Add);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicSub) {
+  RunU64BinOp(execution_mode, kExprI64AtomicSub, Sub);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicAnd) {
+  RunU64BinOp(execution_mode, kExprI64AtomicAnd, And);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicOr) {
+  RunU64BinOp(execution_mode, kExprI64AtomicOr, Or);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicXor) {
+  RunU64BinOp(execution_mode, kExprI64AtomicXor, Xor);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicExchange) {
+  RunU64BinOp(execution_mode, kExprI64AtomicExchange, Exchange);
+}
+
+void RunU32BinOp(WasmExecutionMode execution_mode, WasmOpcode wasm_op,
+                 Uint32BinOp expected_op) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t, uint64_t> r(execution_mode);
+  uint32_t* memory = r.builder().AddMemoryElems<uint32_t>(8);
+  r.builder().SetHasSharedMemory();
+
+  BUILD(r, WASM_ATOMICS_BINOP(wasm_op, WASM_I32V_1(0), WASM_GET_LOCAL(0),
+                              MachineRepresentation::kWord32));
+
+  FOR_UINT32_INPUTS(i) {
+    uint32_t initial = *i;
+    FOR_UINT32_INPUTS(j) {
+      r.builder().WriteMemory(&memory[0], initial);
+      CHECK_EQ(initial, r.Call(*j));
+      uint32_t expected = expected_op(*i, *j);
+      CHECK_EQ(expected, r.builder().ReadMemory(&memory[0]));
+    }
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicAdd32U) {
+  RunU32BinOp(execution_mode, kExprI64AtomicAdd32U, Add);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicSub32U) {
+  RunU32BinOp(execution_mode, kExprI64AtomicSub32U, Sub);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicAnd32U) {
+  RunU32BinOp(execution_mode, kExprI64AtomicAnd32U, And);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicOr32U) {
+  RunU32BinOp(execution_mode, kExprI64AtomicOr32U, Or);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicXor32U) {
+  RunU32BinOp(execution_mode, kExprI64AtomicXor32U, Xor);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicExchange32U) {
+  RunU32BinOp(execution_mode, kExprI64AtomicExchange32U, Exchange);
+}
+
+void RunU16BinOp(WasmExecutionMode mode, WasmOpcode wasm_op,
+                 Uint16BinOp expected_op) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t, uint64_t> r(mode);
+  r.builder().SetHasSharedMemory();
+  uint16_t* memory = r.builder().AddMemoryElems<uint16_t>(8);
+
+  BUILD(r, WASM_ATOMICS_BINOP(wasm_op, WASM_I32V_1(0), WASM_GET_LOCAL(0),
+                              MachineRepresentation::kWord16));
+
+  FOR_UINT16_INPUTS(i) {
+    uint16_t initial = *i;
+    FOR_UINT16_INPUTS(j) {
+      r.builder().WriteMemory(&memory[0], initial);
+      CHECK_EQ(initial, r.Call(*j));
+      uint16_t expected = expected_op(*i, *j);
+      CHECK_EQ(expected, r.builder().ReadMemory(&memory[0]));
+    }
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicAdd16U) {
+  RunU16BinOp(execution_mode, kExprI64AtomicAdd16U, Add);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicSub16U) {
+  RunU16BinOp(execution_mode, kExprI64AtomicSub16U, Sub);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicAnd16U) {
+  RunU16BinOp(execution_mode, kExprI64AtomicAnd16U, And);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicOr16U) {
+  RunU16BinOp(execution_mode, kExprI64AtomicOr16U, Or);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicXor16U) {
+  RunU16BinOp(execution_mode, kExprI64AtomicXor16U, Xor);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicExchange16U) {
+  RunU16BinOp(execution_mode, kExprI64AtomicExchange16U, Exchange);
+}
+
+void RunU8BinOp(WasmExecutionMode execution_mode, WasmOpcode wasm_op,
+                Uint8BinOp expected_op) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t, uint64_t> r(execution_mode);
+  r.builder().SetHasSharedMemory();
+  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(8);
+
+  BUILD(r, WASM_ATOMICS_BINOP(wasm_op, WASM_I32V_1(0), WASM_GET_LOCAL(0),
+                              MachineRepresentation::kWord8));
+
+  FOR_UINT8_INPUTS(i) {
+    uint8_t initial = *i;
+    FOR_UINT8_INPUTS(j) {
+      r.builder().WriteMemory(&memory[0], initial);
+      CHECK_EQ(initial, r.Call(*j));
+      uint8_t expected = expected_op(*i, *j);
+      CHECK_EQ(expected, r.builder().ReadMemory(&memory[0]));
+    }
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicAdd8U) {
+  RunU8BinOp(execution_mode, kExprI64AtomicAdd8U, Add);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicSub8U) {
+  RunU8BinOp(execution_mode, kExprI64AtomicSub8U, Sub);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicAnd8U) {
+  RunU8BinOp(execution_mode, kExprI64AtomicAnd8U, And);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicOr8U) {
+  RunU8BinOp(execution_mode, kExprI64AtomicOr8U, Or);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicXor8U) {
+  RunU8BinOp(execution_mode, kExprI64AtomicXor8U, Xor);
+}
+WASM_COMPILED_EXEC_TEST(I64AtomicExchange8U) {
+  RunU8BinOp(execution_mode, kExprI64AtomicExchange8U, Exchange);
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicCompareExchange) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t, uint64_t, uint64_t> r(execution_mode);
+  r.builder().SetHasSharedMemory();
+  uint64_t* memory = r.builder().AddMemoryElems<uint64_t>(8);
+  BUILD(r, WASM_ATOMICS_TERNARY_OP(
+               kExprI64AtomicCompareExchange, WASM_I32V_1(0), WASM_GET_LOCAL(0),
+               WASM_GET_LOCAL(1), MachineRepresentation::kWord64));
+
+  FOR_UINT64_INPUTS(i) {
+    uint64_t initial = *i;
+    FOR_UINT64_INPUTS(j) {
+      r.builder().WriteMemory(&memory[0], initial);
+      CHECK_EQ(initial, r.Call(*i, *j));
+      uint64_t expected = CompareExchange(initial, *i, *j);
+      CHECK_EQ(expected, r.builder().ReadMemory(&memory[0]));
+    }
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicCompareExchange32U) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t, uint64_t, uint64_t> r(execution_mode);
+  r.builder().SetHasSharedMemory();
+  uint32_t* memory = r.builder().AddMemoryElems<uint32_t>(8);
+  BUILD(r, WASM_ATOMICS_TERNARY_OP(kExprI64AtomicCompareExchange32U,
+                                   WASM_I32V_1(0), WASM_GET_LOCAL(0),
+                                   WASM_GET_LOCAL(1),
+                                   MachineRepresentation::kWord32));
+
+  FOR_UINT32_INPUTS(i) {
+    uint32_t initial = *i;
+    FOR_UINT32_INPUTS(j) {
+      r.builder().WriteMemory(&memory[0], initial);
+      CHECK_EQ(initial, r.Call(*i, *j));
+      uint32_t expected = CompareExchange(initial, *i, *j);
+      CHECK_EQ(expected, r.builder().ReadMemory(&memory[0]));
+    }
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicCompareExchange16U) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t, uint64_t, uint64_t> r(execution_mode);
+  r.builder().SetHasSharedMemory();
+  uint16_t* memory = r.builder().AddMemoryElems<uint16_t>(8);
+  BUILD(r, WASM_ATOMICS_TERNARY_OP(kExprI64AtomicCompareExchange16U,
+                                   WASM_I32V_1(0), WASM_GET_LOCAL(0),
+                                   WASM_GET_LOCAL(1),
+                                   MachineRepresentation::kWord16));
+
+  FOR_UINT16_INPUTS(i) {
+    uint16_t initial = *i;
+    FOR_UINT16_INPUTS(j) {
+      r.builder().WriteMemory(&memory[0], initial);
+      CHECK_EQ(initial, r.Call(*i, *j));
+      uint16_t expected = CompareExchange(initial, *i, *j);
+      CHECK_EQ(expected, r.builder().ReadMemory(&memory[0]));
+    }
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I32AtomicCompareExchange8U) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t, uint64_t, uint64_t> r(execution_mode);
+  r.builder().SetHasSharedMemory();
+  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(8);
+  BUILD(r,
+        WASM_ATOMICS_TERNARY_OP(kExprI64AtomicCompareExchange8U, WASM_I32V_1(0),
+                                WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
+                                MachineRepresentation::kWord8));
+  FOR_UINT8_INPUTS(i) {
+    uint8_t initial = *i;
+    FOR_UINT8_INPUTS(j) {
+      r.builder().WriteMemory(&memory[0], initial);
+      CHECK_EQ(initial, r.Call(*i, *j));
+      uint8_t expected = CompareExchange(initial, *i, *j);
+      CHECK_EQ(expected, r.builder().ReadMemory(&memory[0]));
+    }
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicLoad) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t> r(execution_mode);
+  r.builder().SetHasSharedMemory();
+  uint64_t* memory = r.builder().AddMemoryElems<uint64_t>(8);
+  BUILD(r, WASM_ATOMICS_LOAD_OP(kExprI64AtomicLoad, WASM_ZERO,
+                                MachineRepresentation::kWord64));
+
+  FOR_UINT64_INPUTS(i) {
+    uint64_t expected = *i;
+    r.builder().WriteMemory(&memory[0], expected);
+    CHECK_EQ(expected, r.Call());
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicLoad32U) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t> r(execution_mode);
+  r.builder().SetHasSharedMemory();
+  uint32_t* memory = r.builder().AddMemoryElems<uint32_t>(8);
+  BUILD(r, WASM_ATOMICS_LOAD_OP(kExprI64AtomicLoad32U, WASM_ZERO,
+                                MachineRepresentation::kWord32));
+
+  FOR_UINT32_INPUTS(i) {
+    uint32_t expected = *i;
+    r.builder().WriteMemory(&memory[0], expected);
+    CHECK_EQ(expected, r.Call());
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicLoad16U) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t> r(execution_mode);
+  r.builder().SetHasSharedMemory();
+  uint16_t* memory = r.builder().AddMemoryElems<uint16_t>(8);
+  BUILD(r, WASM_ATOMICS_LOAD_OP(kExprI64AtomicLoad16U, WASM_ZERO,
+                                MachineRepresentation::kWord16));
+
+  FOR_UINT16_INPUTS(i) {
+    uint16_t expected = *i;
+    r.builder().WriteMemory(&memory[0], expected);
+    CHECK_EQ(expected, r.Call());
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicLoad8U) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t> r(execution_mode);
+  r.builder().SetHasSharedMemory();
+  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(8);
+  BUILD(r, WASM_ATOMICS_LOAD_OP(kExprI64AtomicLoad8U, WASM_ZERO,
+                                MachineRepresentation::kWord8));
+
+  FOR_UINT8_INPUTS(i) {
+    uint8_t expected = *i;
+    r.builder().WriteMemory(&memory[0], expected);
+    CHECK_EQ(expected, r.Call());
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicStoreLoad) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t, uint64_t> r(execution_mode);
+  r.builder().SetHasSharedMemory();
+  uint64_t* memory = r.builder().AddMemoryElems<uint64_t>(8);
+
+  BUILD(r,
+        WASM_ATOMICS_STORE_OP(kExprI64AtomicStore, WASM_ZERO, WASM_GET_LOCAL(0),
+                              MachineRepresentation::kWord64),
+        WASM_ATOMICS_LOAD_OP(kExprI64AtomicLoad, WASM_ZERO,
+                             MachineRepresentation::kWord64));
+
+  FOR_UINT64_INPUTS(i) {
+    uint64_t expected = *i;
+    CHECK_EQ(expected, r.Call(*i));
+    CHECK_EQ(expected, r.builder().ReadMemory(&memory[0]));
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicStoreLoad32U) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t, uint64_t> r(execution_mode);
+  r.builder().SetHasSharedMemory();
+  uint32_t* memory = r.builder().AddMemoryElems<uint32_t>(8);
+
+  BUILD(
+      r,
+      WASM_ATOMICS_STORE_OP(kExprI64AtomicStore32U, WASM_ZERO,
+                            WASM_GET_LOCAL(0), MachineRepresentation::kWord32),
+      WASM_ATOMICS_LOAD_OP(kExprI64AtomicLoad32U, WASM_ZERO,
+                           MachineRepresentation::kWord32));
+
+  FOR_UINT32_INPUTS(i) {
+    uint32_t expected = *i;
+    CHECK_EQ(expected, r.Call(*i));
+    CHECK_EQ(expected, r.builder().ReadMemory(&memory[0]));
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicStoreLoad16U) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t, uint64_t> r(execution_mode);
+  r.builder().SetHasSharedMemory();
+  uint16_t* memory = r.builder().AddMemoryElems<uint16_t>(8);
+
+  BUILD(
+      r,
+      WASM_ATOMICS_STORE_OP(kExprI64AtomicStore16U, WASM_ZERO,
+                            WASM_GET_LOCAL(0), MachineRepresentation::kWord16),
+      WASM_ATOMICS_LOAD_OP(kExprI64AtomicLoad16U, WASM_ZERO,
+                           MachineRepresentation::kWord16));
+
+  FOR_UINT16_INPUTS(i) {
+    uint16_t expected = *i;
+    CHECK_EQ(expected, r.Call(*i));
+    CHECK_EQ(expected, r.builder().ReadMemory(&memory[0]));
+  }
+}
+
+WASM_COMPILED_EXEC_TEST(I64AtomicStoreLoad8U) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint64_t, uint64_t> r(execution_mode);
+  r.builder().SetHasSharedMemory();
+  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(8);
+
+  BUILD(r,
+        WASM_ATOMICS_STORE_OP(kExprI64AtomicStore8U, WASM_ZERO,
+                              WASM_GET_LOCAL(0), MachineRepresentation::kWord8),
+        WASM_ATOMICS_LOAD_OP(kExprI64AtomicLoad8U, WASM_ZERO,
+                             MachineRepresentation::kWord8));
+
+  FOR_UINT8_INPUTS(i) {
+    uint8_t expected = *i;
+    CHECK_EQ(expected, r.Call(*i));
+    CHECK_EQ(*i, r.builder().ReadMemory(&memory[0]));
+  }
+}
+}  // namespace test_run_wasm_atomics_64
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-module.cc b/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
index ab40a6366de..e2838035765 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
@@ -9,8 +9,8 @@
 #include "src/objects-inl.h"
 #include "src/snapshot/code-serializer.h"
 #include "src/version.h"
-#include "src/wasm/module-compiler.h"
 #include "src/wasm/module-decoder.h"
+#include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-memory.h"
 #include "src/wasm/wasm-module-builder.h"
 #include "src/wasm/wasm-module.h"
@@ -27,6 +27,8 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
+using testing::CompileAndInstantiateForTesting;
+
 namespace {
 void Cleanup(Isolate* isolate = nullptr) {
   // By sending a low memory notifications, we will try hard to collect all
@@ -256,7 +258,7 @@ class WasmSerializationTest {
     uint32_t* slot = reinterpret_cast<uint32_t*>(
         const_cast<uint8_t*>(serialized_bytes_.first) +
         SerializedCodeData::kPayloadLengthOffset);
-    *slot = FLAG_wasm_jit_to_native ? 0u : 0xFEFEFEFEu;
+    *slot = 0u;
   }
 
   v8::MaybeLocal<v8::WasmCompiledModule> Deserialize() {
@@ -283,9 +285,11 @@ class WasmSerializationTest {
           0);
     }
     Handle<WasmInstanceObject> instance =
-        SyncInstantiate(current_isolate(), &thrower, module_object,
-                        Handle<JSReceiver>::null(),
-                        MaybeHandle<JSArrayBuffer>())
+        current_isolate()
+            ->wasm_engine()
+            ->SyncInstantiate(current_isolate(), &thrower, module_object,
+                              Handle<JSReceiver>::null(),
+                              MaybeHandle<JSArrayBuffer>())
             .ToHandleChecked();
     Handle<Object> params[1] = {
         Handle<Object>(Smi::FromInt(41), current_isolate())};
@@ -330,8 +334,9 @@ class WasmSerializationTest {
       testing::SetupIsolateForWasmModule(serialization_isolate);
 
       MaybeHandle<WasmModuleObject> module_object =
-          SyncCompile(serialization_isolate, &thrower,
-                      ModuleWireBytes(buffer.begin(), buffer.end()));
+          serialization_isolate->wasm_engine()->SyncCompile(
+              serialization_isolate, &thrower,
+              ModuleWireBytes(buffer.begin(), buffer.end()));
 
       MaybeHandle<WasmCompiledModule> compiled_module(
           module_object.ToHandleChecked()->compiled_module(),
@@ -440,67 +445,6 @@ TEST(DeserializeWireBytesAndSerializedDataInvalid) {
   Cleanup();
 }
 
-std::unique_ptr<const uint8_t[]> CreatePayload(const uint8_t* start,
-                                               size_t size) {
-  uint8_t* ret = new uint8_t[size];
-  memcpy(ret, start, size);
-  return std::unique_ptr<const uint8_t[]>(const_cast<const uint8_t*>(ret));
-}
-
-TEST(ModuleBuilder) {
-  v8::internal::AccountingAllocator allocator;
-  Zone zone(&allocator, ZONE_NAME);
-  ZoneBuffer buffer(&zone);
-  WasmSerializationTest::BuildWireBytes(&zone, &buffer);
-  CHECK_GT(buffer.size(), 0);
-  size_t third = buffer.size() / 3;
-  size_t first_mark = third - 2;
-  size_t second_mark = buffer.size() - 2 - third;
-  CHECK_LT(0, first_mark);
-  CHECK(first_mark < second_mark);
-  CHECK(second_mark < buffer.size());
-  Isolate* i_isolate = CcTest::InitIsolateOnce();
-  v8::WasmModuleObjectBuilder builder(CcTest::isolate());
-  std::unique_ptr<const uint8_t[]> first_part =
-      CreatePayload(buffer.begin(), first_mark);
-  std::unique_ptr<const uint8_t[]> second_part =
-      CreatePayload(buffer.begin() + first_mark, second_mark - first_mark);
-  std::unique_ptr<const uint8_t[]> third_part =
-      CreatePayload(buffer.begin() + second_mark, buffer.size() - second_mark);
-  builder.OnBytesReceived(first_part.get(), first_mark);
-  builder.OnBytesReceived(second_part.get(), second_mark - first_mark);
-  builder.OnBytesReceived(third_part.get(), buffer.size() - second_mark);
-  {
-    HandleScope scope(i_isolate);
-    v8::MaybeLocal<v8::WasmCompiledModule> maybe_module = builder.Finish();
-    CHECK(!maybe_module.IsEmpty());
-  }
-}
-
-TEST(FailingModuleBuilder) {
-  v8::internal::AccountingAllocator allocator;
-  Zone zone(&allocator, ZONE_NAME);
-  ZoneBuffer buffer(&zone);
-  WasmSerializationTest::BuildWireBytes(&zone, &buffer);
-  CHECK_GT(buffer.size(), 0);
-  size_t third = buffer.size() / 3;
-  size_t first_mark = third - 2;
-  size_t second_mark = buffer.size() - 2 - third;
-  CHECK_LT(0, first_mark);
-  CHECK(first_mark < second_mark);
-  CHECK(second_mark < buffer.size());
-  Isolate* i_isolate = CcTest::InitIsolateOnce();
-  v8::WasmModuleObjectBuilder builder(CcTest::isolate());
-  std::unique_ptr<const uint8_t[]> first_part =
-      CreatePayload(buffer.begin(), first_mark);
-  builder.OnBytesReceived(first_part.get(), first_mark);
-  {
-    HandleScope scope(i_isolate);
-    v8::MaybeLocal<v8::WasmCompiledModule> maybe_module = builder.Finish();
-    CHECK(maybe_module.IsEmpty());
-  }
-}
-
 bool False(v8::Local<v8::Context> context, v8::Local<v8::String> source) {
   return false;
 }
@@ -531,8 +475,10 @@ TEST(TransferrableWasmModules) {
     HandleScope scope(from_isolate);
     testing::SetupIsolateForWasmModule(from_isolate);
 
-    MaybeHandle<WasmModuleObject> module_object = SyncCompile(
-        from_isolate, &thrower, ModuleWireBytes(buffer.begin(), buffer.end()));
+    MaybeHandle<WasmModuleObject> module_object =
+        from_isolate->wasm_engine()->SyncCompile(
+            from_isolate, &thrower,
+            ModuleWireBytes(buffer.begin(), buffer.end()));
     v8::Local<v8::WasmCompiledModule> v8_module =
         v8::Local<v8::WasmCompiledModule>::Cast(v8::Utils::ToLocal(
             Handle<JSObject>::cast(module_object.ToHandleChecked())));
@@ -685,9 +631,8 @@ TEST(TestInterruptLoop) {
     testing::SetupIsolateForWasmModule(isolate);
     ErrorThrower thrower(isolate, "Test");
     const Handle<WasmInstanceObject> instance =
-        SyncCompileAndInstantiate(isolate, &thrower,
-                                  ModuleWireBytes(buffer.begin(), buffer.end()),
-                                  {}, {})
+        CompileAndInstantiateForTesting(
+            isolate, &thrower, ModuleWireBytes(buffer.begin(), buffer.end()))
             .ToHandleChecked();
 
     Handle<JSArrayBuffer> memory(instance->memory_object()->array_buffer(),
@@ -768,9 +713,8 @@ TEST(Run_WasmModule_GrowMemOobFixedIndex) {
 
     ErrorThrower thrower(isolate, "Test");
     Handle<WasmInstanceObject> instance =
-        SyncCompileAndInstantiate(isolate, &thrower,
-                                  ModuleWireBytes(buffer.begin(), buffer.end()),
-                                  {}, {})
+        CompileAndInstantiateForTesting(
+            isolate, &thrower, ModuleWireBytes(buffer.begin(), buffer.end()))
             .ToHandleChecked();
 
     // Initial memory size is 16 pages, should trap till index > MemSize on
@@ -816,9 +760,8 @@ TEST(Run_WasmModule_GrowMemOobVariableIndex) {
 
     ErrorThrower thrower(isolate, "Test");
     Handle<WasmInstanceObject> instance =
-        SyncCompileAndInstantiate(isolate, &thrower,
-                                  ModuleWireBytes(buffer.begin(), buffer.end()),
-                                  {}, {})
+        CompileAndInstantiateForTesting(
+            isolate, &thrower, ModuleWireBytes(buffer.begin(), buffer.end()))
             .ToHandleChecked();
 
     // Initial memory size is 16 pages, should trap till index > MemSize on
@@ -945,9 +888,8 @@ TEST(InitDataAtTheUpperLimit) {
         'c'         // data bytes
     };
 
-    SyncCompileAndInstantiate(isolate, &thrower,
-                              ModuleWireBytes(data, data + arraysize(data)), {},
-                              {});
+    CompileAndInstantiateForTesting(
+        isolate, &thrower, ModuleWireBytes(data, data + arraysize(data)));
     if (thrower.error()) {
       thrower.Reify()->Print();
       FATAL("compile or instantiate error");
@@ -982,9 +924,8 @@ TEST(EmptyMemoryNonEmptyDataSegment) {
         'c'         // data bytes
     };
 
-    SyncCompileAndInstantiate(isolate, &thrower,
-                              ModuleWireBytes(data, data + arraysize(data)), {},
-                              {});
+    CompileAndInstantiateForTesting(
+        isolate, &thrower, ModuleWireBytes(data, data + arraysize(data)));
     // It should not be possible to instantiate this module.
     CHECK(thrower.error());
   }
@@ -1016,9 +957,8 @@ TEST(EmptyMemoryEmptyDataSegment) {
         U32V_1(0),  // source size
     };
 
-    SyncCompileAndInstantiate(isolate, &thrower,
-                              ModuleWireBytes(data, data + arraysize(data)), {},
-                              {});
+    CompileAndInstantiateForTesting(
+        isolate, &thrower, ModuleWireBytes(data, data + arraysize(data)));
     // It should be possible to instantiate this module.
     CHECK(!thrower.error());
   }
@@ -1050,9 +990,8 @@ TEST(MemoryWithOOBEmptyDataSegment) {
         U32V_1(0),  // source size
     };
 
-    SyncCompileAndInstantiate(isolate, &thrower,
-                              ModuleWireBytes(data, data + arraysize(data)), {},
-                              {});
+    CompileAndInstantiateForTesting(
+        isolate, &thrower, ModuleWireBytes(data, data + arraysize(data)));
     // It should not be possible to instantiate this module.
     CHECK(thrower.error());
   }
@@ -1066,20 +1005,23 @@ struct ManuallyExternalizedBuffer {
   Handle<JSArrayBuffer> buffer_;
   void* allocation_base_;
   size_t allocation_length_;
+  bool const should_free_;
 
   ManuallyExternalizedBuffer(JSArrayBuffer* buffer, Isolate* isolate)
       : isolate_(isolate),
         buffer_(buffer, isolate),
         allocation_base_(buffer->allocation_base()),
-        allocation_length_(buffer->allocation_length()) {
-    if (!buffer->has_guard_region()) {
+        allocation_length_(buffer->allocation_length()),
+        should_free_(!isolate_->wasm_engine()->memory_tracker()->IsWasmMemory(
+            buffer->backing_store())) {
+    if (!isolate_->wasm_engine()->memory_tracker()->IsWasmMemory(
+            buffer->backing_store())) {
       v8::Utils::ToLocal(buffer_)->Externalize();
     }
   }
   ~ManuallyExternalizedBuffer() {
-    if (!buffer_->has_guard_region()) {
-      isolate_->array_buffer_allocator()->Free(
-          allocation_base_, allocation_length_, buffer_->allocation_mode());
+    if (should_free_) {
+      buffer_->FreeBackingStore();
     }
   }
 };
@@ -1104,9 +1046,8 @@ TEST(Run_WasmModule_Buffer_Externalized_GrowMem) {
     testing::SetupIsolateForWasmModule(isolate);
     ErrorThrower thrower(isolate, "Test");
     const Handle<WasmInstanceObject> instance =
-        SyncCompileAndInstantiate(isolate, &thrower,
-                                  ModuleWireBytes(buffer.begin(), buffer.end()),
-                                  {}, {})
+        CompileAndInstantiateForTesting(
+            isolate, &thrower, ModuleWireBytes(buffer.begin(), buffer.end()))
             .ToHandleChecked();
     Handle<WasmMemoryObject> memory_object(instance->memory_object(), isolate);
 
@@ -1138,18 +1079,23 @@ TEST(Run_WasmModule_Buffer_Externalized_GrowMemMemSize) {
   {
     Isolate* isolate = CcTest::InitIsolateOnce();
     HandleScope scope(isolate);
-    void* backing_store =
-        isolate->array_buffer_allocator()->Allocate(16 * kWasmPageSize);
-    Handle<JSArrayBuffer> buffer =
-        wasm::SetupArrayBuffer(isolate, backing_store, 16 * kWasmPageSize,
-                               backing_store, 16 * kWasmPageSize, false, false);
+#if V8_TARGET_ARCH_64_BIT
+    constexpr bool require_guard_regions = true;
+#else
+    constexpr bool require_guard_regions = false;
+#endif
+    Handle<JSArrayBuffer> buffer = wasm::NewArrayBuffer(
+        isolate, 16 * kWasmPageSize, require_guard_regions);
     Handle<WasmMemoryObject> mem_obj =
         WasmMemoryObject::New(isolate, buffer, 100);
-    v8::Utils::ToLocal(buffer)->Externalize();
+    auto const contents = v8::Utils::ToLocal(buffer)->Externalize();
     int32_t result = WasmMemoryObject::Grow(isolate, mem_obj, 0);
     CHECK_EQ(16, result);
-
-    isolate->array_buffer_allocator()->Free(backing_store, 16 * kWasmPageSize);
+    constexpr bool is_wasm_memory = true;
+    const JSArrayBuffer::Allocation allocation{
+        contents.AllocationBase(), contents.AllocationLength(), contents.Data(),
+        contents.AllocationMode(), is_wasm_memory};
+    JSArrayBuffer::FreeBackingStore(isolate, allocation);
   }
   Cleanup();
 }
@@ -1160,18 +1106,64 @@ TEST(Run_WasmModule_Buffer_Externalized_Detach) {
     // https://bugs.chromium.org/p/chromium/issues/detail?id=731046
     Isolate* isolate = CcTest::InitIsolateOnce();
     HandleScope scope(isolate);
-    void* backing_store =
-        isolate->array_buffer_allocator()->Allocate(16 * kWasmPageSize);
-    Handle<JSArrayBuffer> buffer =
-        wasm::SetupArrayBuffer(isolate, backing_store, 16 * kWasmPageSize,
-                               backing_store, 16 * kWasmPageSize, false, false);
-    v8::Utils::ToLocal(buffer)->Externalize();
+#if V8_TARGET_ARCH_64_BIT
+    constexpr bool require_guard_regions = true;
+#else
+    constexpr bool require_guard_regions = false;
+#endif
+    Handle<JSArrayBuffer> buffer = wasm::NewArrayBuffer(
+        isolate, 16 * kWasmPageSize, require_guard_regions);
+    auto const contents = v8::Utils::ToLocal(buffer)->Externalize();
     wasm::DetachMemoryBuffer(isolate, buffer, true);
-    isolate->array_buffer_allocator()->Free(backing_store, 16 * kWasmPageSize);
+    constexpr bool is_wasm_memory = true;
+    const JSArrayBuffer::Allocation allocation{
+        contents.AllocationBase(), contents.AllocationLength(), contents.Data(),
+        contents.AllocationMode(), is_wasm_memory};
+    JSArrayBuffer::FreeBackingStore(isolate, allocation);
   }
   Cleanup();
 }
 
+TEST(Run_WasmModule_Buffer_Externalized_Regression_UseAfterFree) {
+  // Regresion test for https://crbug.com/813876
+  Isolate* isolate = CcTest::InitIsolateOnce();
+  HandleScope scope(isolate);
+#if V8_TARGET_ARCH_64_BIT
+  const bool require_guard_regions = trap_handler::IsTrapHandlerEnabled();
+#else
+  constexpr bool require_guard_regions = false;
+#endif
+  Handle<JSArrayBuffer> buffer =
+      wasm::NewArrayBuffer(isolate, 16 * kWasmPageSize, require_guard_regions);
+  Handle<WasmMemoryObject> mem = WasmMemoryObject::New(isolate, buffer, 128);
+  auto contents = v8::Utils::ToLocal(buffer)->Externalize();
+  WasmMemoryObject::Grow(isolate, mem, 0);
+  constexpr bool is_wasm_memory = true;
+  JSArrayBuffer::FreeBackingStore(
+      isolate, JSArrayBuffer::Allocation(
+                   contents.AllocationBase(), contents.AllocationLength(),
+                   contents.Data(), contents.AllocationMode(), is_wasm_memory));
+  // Make sure we can write to the buffer without crashing
+  uint32_t* int_buffer =
+      reinterpret_cast<uint32_t*>(mem->array_buffer()->backing_store());
+  int_buffer[0] = 0;
+}
+
+#if V8_TARGET_ARCH_64_BIT
+TEST(Run_WasmModule_Reclaim_Memory) {
+  // Make sure we can allocate memories without running out of address space.
+  Isolate* isolate = CcTest::InitIsolateOnce();
+  Handle<JSArrayBuffer> buffer;
+  for (int i = 0; i < 256; ++i) {
+    HandleScope scope(isolate);
+    constexpr bool require_guard_regions = true;
+    buffer = NewArrayBuffer(isolate, kWasmPageSize, require_guard_regions,
+                            SharedFlag::kNotShared);
+    CHECK(!buffer.is_null());
+  }
+}
+#endif
+
 TEST(AtomicOpDisassembly) {
   {
     EXPERIMENTAL_FLAG_SCOPE(threads);
@@ -1198,8 +1190,9 @@ TEST(AtomicOpDisassembly) {
     testing::SetupIsolateForWasmModule(isolate);
 
     ErrorThrower thrower(isolate, "Test");
-    MaybeHandle<WasmModuleObject> module_object = SyncCompile(
-        isolate, &thrower, ModuleWireBytes(buffer.begin(), buffer.end()));
+    MaybeHandle<WasmModuleObject> module_object =
+        isolate->wasm_engine()->SyncCompile(
+            isolate, &thrower, ModuleWireBytes(buffer.begin(), buffer.end()));
 
     Handle<WasmCompiledModule> compiled_module(
         module_object.ToHandleChecked()->compiled_module(), isolate);
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-relocation.cc b/deps/v8/test/cctest/wasm/test-run-wasm-relocation.cc
index 482ab9e9054..eb7d01b2c4d 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-relocation.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-relocation.cc
@@ -50,12 +50,11 @@ WASM_COMPILED_EXEC_TEST(RunPatchWasmContext) {
     for (RelocIterator it(*code, filter); !it.done(); it.next()) {
       CHECK_EQ(old_wasm_context_address, it.rinfo()->wasm_context_reference());
       it.rinfo()->set_wasm_context_reference(
-          isolate, reinterpret_cast<Address>(&new_wasm_context));
+          reinterpret_cast<Address>(&new_wasm_context));
       patched = true;
     }
     CHECK(patched);
-    Assembler::FlushICache(isolate, code->instruction_start(),
-                           code->instruction_size());
+    Assembler::FlushICache(code->instruction_start(), code->instruction_size());
   }
 
   // Run with the new global data.
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-sign-extension.cc b/deps/v8/test/cctest/wasm/test-run-wasm-sign-extension.cc
new file mode 100644
index 00000000000..8e1b88aaddc
--- /dev/null
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-sign-extension.cc
@@ -0,0 +1,74 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "test/cctest/cctest.h"
+#include "test/cctest/wasm/wasm-run-utils.h"
+#include "test/common/wasm/wasm-macro-gen.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+
+WASM_COMPILED_EXEC_TEST(I32SExtendI8) {
+  EXPERIMENTAL_FLAG_SCOPE(se);
+  WasmRunner<int32_t, int32_t> r(execution_mode);
+  BUILD(r, WASM_I32_SIGN_EXT_I8(WASM_GET_LOCAL(0)));
+  CHECK_EQ(0, r.Call(0));
+  CHECK_EQ(1, r.Call(1));
+  CHECK_EQ(-1, r.Call(-1));
+  CHECK_EQ(0x7a, r.Call(0x7a));
+  CHECK_EQ(-0x80, r.Call(0x80));
+}
+
+WASM_COMPILED_EXEC_TEST(I32SExtendI16) {
+  EXPERIMENTAL_FLAG_SCOPE(se);
+  WasmRunner<int32_t, int32_t> r(execution_mode);
+  BUILD(r, WASM_I32_SIGN_EXT_I16(WASM_GET_LOCAL(0)));
+  CHECK_EQ(0, r.Call(0));
+  CHECK_EQ(1, r.Call(1));
+  CHECK_EQ(-1, r.Call(-1));
+  CHECK_EQ(0x7afa, r.Call(0x7afa));
+  CHECK_EQ(-0x8000, r.Call(0x8000));
+}
+// TODO(gdeepti): Enable tests to run in the interpreter, and on 32 bit
+// platforms after int64 lowering support. Add JS tests once all ops can be run
+// on 32 bit platforms.
+#if V8_TARGET_ARCH_64_BIT
+WASM_COMPILED_EXEC_TEST(I64SExtendI8) {
+  EXPERIMENTAL_FLAG_SCOPE(se);
+  WasmRunner<int64_t, int64_t> r(execution_mode);
+  BUILD(r, WASM_I64_SIGN_EXT_I8(WASM_GET_LOCAL(0)));
+  CHECK_EQ(0, r.Call(0));
+  CHECK_EQ(1, r.Call(1));
+  CHECK_EQ(-1, r.Call(-1));
+  CHECK_EQ(0x7a, r.Call(0x7a));
+  CHECK_EQ(-0x80, r.Call(0x80));
+}
+
+WASM_COMPILED_EXEC_TEST(I64SExtendI16) {
+  EXPERIMENTAL_FLAG_SCOPE(se);
+  WasmRunner<int64_t, int64_t> r(execution_mode);
+  BUILD(r, WASM_I64_SIGN_EXT_I16(WASM_GET_LOCAL(0)));
+  CHECK_EQ(0, r.Call(0));
+  CHECK_EQ(1, r.Call(1));
+  CHECK_EQ(-1, r.Call(-1));
+  CHECK_EQ(0x7afa, r.Call(0x7afa));
+  CHECK_EQ(-0x8000, r.Call(0x8000));
+}
+
+WASM_COMPILED_EXEC_TEST(I64SExtendI32) {
+  EXPERIMENTAL_FLAG_SCOPE(se);
+  WasmRunner<int64_t, int64_t> r(execution_mode);
+  BUILD(r, WASM_I64_SIGN_EXT_I32(WASM_GET_LOCAL(0)));
+  CHECK_EQ(0, r.Call(0));
+  CHECK_EQ(1, r.Call(1));
+  CHECK_EQ(-1, r.Call(-1));
+  CHECK_EQ(0x7fffffff, r.Call(0x7fffffff));
+  CHECK_EQ(-0x80000000LL, r.Call(0x80000000));
+}
+#endif  // V8_TARGET_ARCH_64_BIT
+
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc b/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
index 1a97cdc1221..d2fe91098cb 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
@@ -446,7 +446,7 @@ WASM_SIMD_TEST(F32x4ReplaceLane) {
 }
 
 #if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
-    V8_TARGET_ARCH_MIPS64
+    V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 // Tests both signed and unsigned conversion.
 WASM_SIMD_TEST(F32x4ConvertI32x4) {
   WasmRunner<int32_t, int32_t, float, float> r(kExecuteTurbofan, lower_simd);
@@ -471,7 +471,7 @@ WASM_SIMD_TEST(F32x4ConvertI32x4) {
   }
 }
 #endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
-        // V8_TARGET_ARCH_MIPS64
+        // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
 void RunF32x4UnOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
                       FloatUnOp expected_op, float error = 0.0f) {
@@ -494,31 +494,23 @@ void RunF32x4UnOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
   }
 }
 
-#if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
-    V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 WASM_SIMD_TEST(F32x4Abs) {
   RunF32x4UnOpTest(lower_simd, kExprF32x4Abs, std::abs);
 }
 WASM_SIMD_TEST(F32x4Neg) {
   RunF32x4UnOpTest(lower_simd, kExprF32x4Neg, Negate);
 }
-#endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
-        // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
-#if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
-    V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_X64
 static const float kApproxError = 0.01f;
 
-WASM_SIMD_COMPILED_TEST(F32x4RecipApprox) {
+WASM_SIMD_TEST(F32x4RecipApprox) {
   RunF32x4UnOpTest(lower_simd, kExprF32x4RecipApprox, Recip, kApproxError);
 }
 
-WASM_SIMD_COMPILED_TEST(F32x4RecipSqrtApprox) {
+WASM_SIMD_TEST(F32x4RecipSqrtApprox) {
   RunF32x4UnOpTest(lower_simd, kExprF32x4RecipSqrtApprox, RecipSqrt,
                    kApproxError);
 }
-#endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
-        // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_X64
 
 void RunF32x4BinOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
                        FloatBinOp expected_op) {
@@ -938,11 +930,7 @@ WASM_SIMD_TEST(I32x4Neg) {
   RunI32x4UnOpTest(lower_simd, kExprI32x4Neg, Negate);
 }
 
-#if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_X64 || \
-    V8_TARGET_ARCH_IA32
 WASM_SIMD_TEST(S128Not) { RunI32x4UnOpTest(lower_simd, kExprS128Not, Not); }
-#endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_X64 ||
-        // V8_TARGET_ARCH_IA32
 
 void RunI32x4BinOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
                        Int32BinOp expected_op) {
@@ -1468,10 +1456,10 @@ WASM_SIMD_TEST(I8x16LeU) {
 }
 
 #if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
-    V8_TARGET_ARCH_MIPS64
+    V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 WASM_SIMD_TEST(I8x16Mul) { RunI8x16BinOpTest(lower_simd, kExprI8x16Mul, Mul); }
 #endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
-        // V8_TARGET_ARCH_MIPS64
+        // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
 void RunI8x16ShiftOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
                          Int8ShiftOp expected_op, int shift) {
@@ -1488,7 +1476,7 @@ void RunI8x16ShiftOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
 }
 
 #if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
-    V8_TARGET_ARCH_MIPS64
+    V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 WASM_SIMD_TEST(I8x16Shl) {
   RunI8x16ShiftOpTest(lower_simd, kExprI8x16Shl, LogicalShiftLeft, 1);
 }
@@ -1501,15 +1489,13 @@ WASM_SIMD_TEST(I8x16ShrU) {
   RunI8x16ShiftOpTest(lower_simd, kExprI8x16ShrU, LogicalShiftRight, 1);
 }
 #endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
-        // V8_TARGET_ARCH_MIPS64
+        // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
-#if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_X64 || \
-    V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64
 // Test Select by making a mask where the 0th and 3rd lanes are true and the
 // rest false, and comparing for non-equality with zero to convert to a boolean
 // vector.
 #define WASM_SIMD_SELECT_TEST(format)                                        \
-  WASM_SIMD_COMPILED_TEST(S##format##Select) {                               \
+  WASM_SIMD_TEST(S##format##Select) {                                        \
     WasmRunner<int32_t, int32_t, int32_t> r(kExecuteTurbofan, lower_simd);   \
     byte val1 = 0;                                                           \
     byte val2 = 1;                                                           \
@@ -1549,7 +1535,7 @@ WASM_SIMD_SELECT_TEST(8x16)
 // Test Select by making a mask where the 0th and 3rd lanes are non-zero and the
 // rest 0. The mask is not the result of a comparison op.
 #define WASM_SIMD_NON_CANONICAL_SELECT_TEST(format)                           \
-  WASM_SIMD_COMPILED_TEST(S##format##NonCanonicalSelect) {                    \
+  WASM_SIMD_TEST(S##format##NonCanonicalSelect) {                             \
     WasmRunner<int32_t, int32_t, int32_t, int32_t> r(kExecuteTurbofan,        \
                                                      lower_simd);             \
     byte val1 = 0;                                                            \
@@ -1617,27 +1603,29 @@ void RunBinaryLaneOpTest(
   }
 }
 
-WASM_SIMD_COMPILED_TEST(I32x4AddHoriz) {
+#if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_X64 || \
+    V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64
+WASM_SIMD_TEST(I32x4AddHoriz) {
   RunBinaryLaneOpTest<int32_t>(lower_simd, kExprI32x4AddHoriz, {{1, 5, 9, 13}});
 }
 
-WASM_SIMD_COMPILED_TEST(I16x8AddHoriz) {
+WASM_SIMD_TEST(I16x8AddHoriz) {
   RunBinaryLaneOpTest<int16_t>(lower_simd, kExprI16x8AddHoriz,
                                {{1, 5, 9, 13, 17, 21, 25, 29}});
 }
-#endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_X64 ||
-        // V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64
 
-#if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
-    V8_TARGET_ARCH_MIPS64
-WASM_SIMD_COMPILED_TEST(F32x4AddHoriz) {
+WASM_SIMD_TEST(F32x4AddHoriz) {
   RunBinaryLaneOpTest<float>(lower_simd, kExprF32x4AddHoriz,
                              {{1.0f, 5.0f, 9.0f, 13.0f}});
 }
+#endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_X64 ||
+        // V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64
 
+#if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
+    V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 // Test some regular shuffles that may have special handling on some targets.
 // Test a normal and unary versions (where second operand isn't used).
-WASM_SIMD_COMPILED_TEST(S32x4Dup) {
+WASM_SIMD_TEST(S32x4Dup) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{16, 17, 18, 19, 16, 17, 18, 19, 16, 17, 18, 19, 16, 17, 18, 19}});
@@ -1646,7 +1634,7 @@ WASM_SIMD_COMPILED_TEST(S32x4Dup) {
       {{4, 5, 6, 7, 4, 5, 6, 7, 4, 5, 6, 7, 4, 5, 6, 7}});
 }
 
-WASM_SIMD_COMPILED_TEST(S32x4ZipLeft) {
+WASM_SIMD_TEST(S32x4ZipLeft) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{0, 1, 2, 3, 16, 17, 18, 19, 4, 5, 6, 7, 20, 21, 22, 23}});
@@ -1655,7 +1643,7 @@ WASM_SIMD_COMPILED_TEST(S32x4ZipLeft) {
       {{0, 1, 2, 3, 0, 1, 2, 3, 4, 5, 6, 7, 4, 5, 6, 7}});
 }
 
-WASM_SIMD_COMPILED_TEST(S32x4ZipRight) {
+WASM_SIMD_TEST(S32x4ZipRight) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{8, 9, 10, 11, 24, 25, 26, 27, 12, 13, 14, 15, 28, 29, 30, 31}});
@@ -1664,7 +1652,7 @@ WASM_SIMD_COMPILED_TEST(S32x4ZipRight) {
       {{8, 9, 10, 11, 8, 9, 10, 11, 12, 13, 14, 15, 12, 13, 14, 15}});
 }
 
-WASM_SIMD_COMPILED_TEST(S32x4UnzipLeft) {
+WASM_SIMD_TEST(S32x4UnzipLeft) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{0, 1, 2, 3, 8, 9, 10, 11, 16, 17, 18, 19, 24, 25, 26, 27}});
@@ -1673,7 +1661,7 @@ WASM_SIMD_COMPILED_TEST(S32x4UnzipLeft) {
       {{0, 1, 2, 3, 8, 9, 10, 11, 0, 1, 2, 3, 8, 9, 10, 11}});
 }
 
-WASM_SIMD_COMPILED_TEST(S32x4UnzipRight) {
+WASM_SIMD_TEST(S32x4UnzipRight) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{4, 5, 6, 7, 12, 13, 14, 15, 20, 21, 22, 23, 28, 29, 30, 31}});
@@ -1682,7 +1670,7 @@ WASM_SIMD_COMPILED_TEST(S32x4UnzipRight) {
       {{4, 5, 6, 7, 12, 13, 14, 15, 4, 5, 6, 7, 12, 13, 14, 15}});
 }
 
-WASM_SIMD_COMPILED_TEST(S32x4TransposeLeft) {
+WASM_SIMD_TEST(S32x4TransposeLeft) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{0, 1, 2, 3, 16, 17, 18, 19, 8, 9, 10, 11, 24, 25, 26, 27}});
@@ -1691,7 +1679,7 @@ WASM_SIMD_COMPILED_TEST(S32x4TransposeLeft) {
       {{0, 1, 2, 3, 0, 1, 2, 3, 8, 9, 10, 11, 8, 9, 10, 11}});
 }
 
-WASM_SIMD_COMPILED_TEST(S32x4TransposeRight) {
+WASM_SIMD_TEST(S32x4TransposeRight) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{4, 5, 6, 7, 20, 21, 22, 23, 12, 13, 14, 15, 28, 29, 30, 31}});
@@ -1701,14 +1689,14 @@ WASM_SIMD_COMPILED_TEST(S32x4TransposeRight) {
 }
 
 // Reverses are only unary.
-WASM_SIMD_COMPILED_TEST(S32x2Reverse) {
+WASM_SIMD_TEST(S32x2Reverse) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11}});
 }
 
 // Test irregular shuffle.
-WASM_SIMD_COMPILED_TEST(S32x4Irregular) {
+WASM_SIMD_TEST(S32x4Irregular) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{0, 1, 2, 3, 16, 17, 18, 19, 16, 17, 18, 19, 20, 21, 22, 23}});
@@ -1717,7 +1705,7 @@ WASM_SIMD_COMPILED_TEST(S32x4Irregular) {
       {{0, 1, 2, 3, 0, 1, 2, 3, 0, 1, 2, 3, 4, 5, 6, 7}});
 }
 
-WASM_SIMD_COMPILED_TEST(S16x8Dup) {
+WASM_SIMD_TEST(S16x8Dup) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{18, 19, 18, 19, 18, 19, 18, 19, 18, 19, 18, 19, 18, 19, 18, 19}});
@@ -1726,7 +1714,7 @@ WASM_SIMD_COMPILED_TEST(S16x8Dup) {
       {{6, 7, 6, 7, 6, 7, 6, 7, 6, 7, 6, 7, 6, 7, 6, 7}});
 }
 
-WASM_SIMD_COMPILED_TEST(S16x8ZipLeft) {
+WASM_SIMD_TEST(S16x8ZipLeft) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{0, 1, 16, 17, 2, 3, 18, 19, 4, 5, 20, 21, 6, 7, 22, 23}});
@@ -1735,7 +1723,7 @@ WASM_SIMD_COMPILED_TEST(S16x8ZipLeft) {
       {{0, 1, 0, 1, 2, 3, 2, 3, 4, 5, 4, 5, 6, 7, 6, 7}});
 }
 
-WASM_SIMD_COMPILED_TEST(S16x8ZipRight) {
+WASM_SIMD_TEST(S16x8ZipRight) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{8, 9, 24, 25, 10, 11, 26, 27, 12, 13, 28, 29, 14, 15, 30, 31}});
@@ -1744,7 +1732,7 @@ WASM_SIMD_COMPILED_TEST(S16x8ZipRight) {
       {{8, 9, 8, 9, 10, 11, 10, 11, 12, 13, 12, 13, 14, 15, 14, 15}});
 }
 
-WASM_SIMD_COMPILED_TEST(S16x8UnzipLeft) {
+WASM_SIMD_TEST(S16x8UnzipLeft) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{0, 1, 4, 5, 8, 9, 12, 13, 16, 17, 20, 21, 24, 25, 28, 29}});
@@ -1753,7 +1741,7 @@ WASM_SIMD_COMPILED_TEST(S16x8UnzipLeft) {
       {{0, 1, 4, 5, 8, 9, 12, 13, 0, 1, 4, 5, 8, 9, 12, 13}});
 }
 
-WASM_SIMD_COMPILED_TEST(S16x8UnzipRight) {
+WASM_SIMD_TEST(S16x8UnzipRight) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{2, 3, 6, 7, 10, 11, 14, 15, 18, 19, 22, 23, 26, 27, 30, 31}});
@@ -1762,7 +1750,7 @@ WASM_SIMD_COMPILED_TEST(S16x8UnzipRight) {
       {{2, 3, 6, 7, 10, 11, 14, 15, 2, 3, 6, 7, 10, 11, 14, 15}});
 }
 
-WASM_SIMD_COMPILED_TEST(S16x8TransposeLeft) {
+WASM_SIMD_TEST(S16x8TransposeLeft) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{0, 1, 16, 17, 4, 5, 20, 21, 8, 9, 24, 25, 12, 13, 28, 29}});
@@ -1771,7 +1759,7 @@ WASM_SIMD_COMPILED_TEST(S16x8TransposeLeft) {
       {{0, 1, 0, 1, 4, 5, 4, 5, 8, 9, 8, 9, 12, 13, 12, 13}});
 }
 
-WASM_SIMD_COMPILED_TEST(S16x8TransposeRight) {
+WASM_SIMD_TEST(S16x8TransposeRight) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{2, 3, 18, 19, 6, 7, 22, 23, 10, 11, 26, 27, 14, 15, 30, 31}});
@@ -1780,19 +1768,19 @@ WASM_SIMD_COMPILED_TEST(S16x8TransposeRight) {
       {{2, 3, 2, 3, 6, 7, 6, 7, 10, 11, 10, 11, 14, 15, 14, 15}});
 }
 
-WASM_SIMD_COMPILED_TEST(S16x4Reverse) {
+WASM_SIMD_TEST(S16x4Reverse) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{6, 7, 4, 5, 2, 3, 0, 1, 14, 15, 12, 13, 10, 11, 8, 9}});
 }
 
-WASM_SIMD_COMPILED_TEST(S16x2Reverse) {
+WASM_SIMD_TEST(S16x2Reverse) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{2, 3, 0, 1, 6, 7, 4, 5, 10, 11, 8, 9, 14, 15, 12, 13}});
 }
 
-WASM_SIMD_COMPILED_TEST(S16x8Irregular) {
+WASM_SIMD_TEST(S16x8Irregular) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{0, 1, 16, 17, 16, 17, 0, 1, 4, 5, 20, 21, 6, 7, 22, 23}});
@@ -1801,7 +1789,7 @@ WASM_SIMD_COMPILED_TEST(S16x8Irregular) {
       {{0, 1, 0, 1, 0, 1, 0, 1, 4, 5, 4, 5, 6, 7, 6, 7}});
 }
 
-WASM_SIMD_COMPILED_TEST(S8x16Dup) {
+WASM_SIMD_TEST(S8x16Dup) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19}});
@@ -1810,7 +1798,7 @@ WASM_SIMD_COMPILED_TEST(S8x16Dup) {
       {{7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7}});
 }
 
-WASM_SIMD_COMPILED_TEST(S8x16ZipLeft) {
+WASM_SIMD_TEST(S8x16ZipLeft) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{0, 16, 1, 17, 2, 18, 3, 19, 4, 20, 5, 21, 6, 22, 7, 23}});
@@ -1819,7 +1807,7 @@ WASM_SIMD_COMPILED_TEST(S8x16ZipLeft) {
       {{0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7}});
 }
 
-WASM_SIMD_COMPILED_TEST(S8x16ZipRight) {
+WASM_SIMD_TEST(S8x16ZipRight) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{8, 24, 9, 25, 10, 26, 11, 27, 12, 28, 13, 29, 14, 30, 15, 31}});
@@ -1828,7 +1816,7 @@ WASM_SIMD_COMPILED_TEST(S8x16ZipRight) {
       {{8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13, 14, 14, 15, 15}});
 }
 
-WASM_SIMD_COMPILED_TEST(S8x16UnzipLeft) {
+WASM_SIMD_TEST(S8x16UnzipLeft) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 30}});
@@ -1837,7 +1825,7 @@ WASM_SIMD_COMPILED_TEST(S8x16UnzipLeft) {
       {{0, 2, 4, 6, 8, 10, 12, 14, 0, 2, 4, 6, 8, 10, 12, 14}});
 }
 
-WASM_SIMD_COMPILED_TEST(S8x16UnzipRight) {
+WASM_SIMD_TEST(S8x16UnzipRight) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23, 25, 27, 29, 31}});
@@ -1846,7 +1834,7 @@ WASM_SIMD_COMPILED_TEST(S8x16UnzipRight) {
       {{1, 3, 5, 7, 9, 11, 13, 15, 1, 3, 5, 7, 9, 11, 13, 15}});
 }
 
-WASM_SIMD_COMPILED_TEST(S8x16TransposeLeft) {
+WASM_SIMD_TEST(S8x16TransposeLeft) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{0, 16, 2, 18, 4, 20, 6, 22, 8, 24, 10, 26, 12, 28, 14, 30}});
@@ -1855,7 +1843,7 @@ WASM_SIMD_COMPILED_TEST(S8x16TransposeLeft) {
       {{0, 0, 2, 2, 4, 4, 6, 6, 8, 8, 10, 10, 12, 12, 14, 14}});
 }
 
-WASM_SIMD_COMPILED_TEST(S8x16TransposeRight) {
+WASM_SIMD_TEST(S8x16TransposeRight) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{1, 17, 3, 19, 5, 21, 7, 23, 9, 25, 11, 27, 13, 29, 15, 31}});
@@ -1864,25 +1852,25 @@ WASM_SIMD_COMPILED_TEST(S8x16TransposeRight) {
       {{1, 1, 3, 3, 5, 5, 7, 7, 9, 9, 11, 11, 13, 13, 15, 15}});
 }
 
-WASM_SIMD_COMPILED_TEST(S8x8Reverse) {
+WASM_SIMD_TEST(S8x8Reverse) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{7, 6, 5, 4, 3, 2, 1, 0, 15, 14, 13, 12, 11, 10, 9, 8}});
 }
 
-WASM_SIMD_COMPILED_TEST(S8x4Reverse) {
+WASM_SIMD_TEST(S8x4Reverse) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{3, 2, 1, 0, 7, 6, 5, 4, 11, 10, 9, 8, 15, 14, 13, 12}});
 }
 
-WASM_SIMD_COMPILED_TEST(S8x2Reverse) {
+WASM_SIMD_TEST(S8x2Reverse) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{1, 0, 3, 2, 5, 4, 7, 6, 9, 8, 11, 10, 13, 12, 15, 14}});
 }
 
-WASM_SIMD_COMPILED_TEST(S8x16Irregular) {
+WASM_SIMD_TEST(S8x16Irregular) {
   RunBinaryLaneOpTest<int8_t>(
       lower_simd, kExprS8x16Shuffle,
       {{0, 16, 0, 16, 2, 18, 3, 19, 4, 20, 5, 21, 6, 22, 7, 23}});
@@ -1893,7 +1881,7 @@ WASM_SIMD_COMPILED_TEST(S8x16Irregular) {
 
 // Test shuffles that concatenate the two vectors.
 
-WASM_SIMD_COMPILED_TEST(S8x16Concat) {
+WASM_SIMD_TEST(S8x16Concat) {
   static const int kLanes = 16;
   std::array<uint8_t, kLanes> expected;
   for (int bias = 1; bias < kLanes; bias++) {
@@ -1909,7 +1897,11 @@ WASM_SIMD_COMPILED_TEST(S8x16Concat) {
     RunBinaryLaneOpTest(lower_simd, kExprS8x16Shuffle, expected);
   }
 }
+#endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
+        // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
+#if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
+    V8_TARGET_ARCH_MIPS64
 // Boolean unary operations are 'AllTrue' and 'AnyTrue', which return an integer
 // result. Use relational ops on numeric vectors to create the boolean vector
 // test inputs. Test inputs with all true, all false, one true, and one false.
@@ -1996,6 +1988,8 @@ WASM_SIMD_TEST(SimdI32x4ExtractWithF32x4) {
                WASM_I32V(1), WASM_I32V(0)));
   CHECK_EQ(1, r.Call());
 }
+#endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
+        // V8_TARGET_ARCH_MIPS64
 
 WASM_SIMD_TEST(SimdF32x4ExtractWithI32x4) {
   WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);
@@ -2040,8 +2034,6 @@ WASM_SIMD_TEST(SimdI32x4AddWithF32x4) {
             WASM_I32V(1), WASM_I32V(0)));
   CHECK_EQ(1, r.Call());
 }
-#endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
-        // V8_TARGET_ARCH_MIPS64
 
 WASM_SIMD_TEST(SimdI32x4Local) {
   WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);
@@ -2097,8 +2089,6 @@ WASM_SIMD_TEST(SimdI32x4For) {
   CHECK_EQ(1, r.Call());
 }
 
-#if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
-    V8_TARGET_ARCH_MIPS64
 WASM_SIMD_TEST(SimdF32x4For) {
   WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);
   r.AllocateLocal(kWasmI32);
@@ -2122,8 +2112,6 @@ WASM_SIMD_TEST(SimdF32x4For) {
         WASM_GET_LOCAL(0));
   CHECK_EQ(1, r.Call());
 }
-#endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
-        // V8_TARGET_ARCH_MIPS64
 
 template <typename T, int numLanes = 4>
 void SetVectorByLanes(T* v, const std::array<T, numLanes>& arr) {
@@ -2201,8 +2189,6 @@ WASM_SIMD_TEST(SimdI32x4SetGlobal) {
   CHECK_EQ(GetScalar(global, 3), 56);
 }
 
-#if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
-    V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 WASM_SIMD_TEST(SimdF32x4GetGlobal) {
   WasmRunner<int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
   float* global = r.builder().AddGlobal<float>(kWasmS128);
@@ -2243,8 +2229,6 @@ WASM_SIMD_TEST(SimdF32x4SetGlobal) {
   CHECK_EQ(GetScalar(global, 2), 32.25f);
   CHECK_EQ(GetScalar(global, 3), 65.0f);
 }
-#endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
-        // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
 WASM_SIMD_COMPILED_TEST(SimdLoadStoreLoad) {
   WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm.cc b/deps/v8/test/cctest/wasm/test-run-wasm.cc
index 6a7fde64018..ff83371a937 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm.cc
@@ -1949,6 +1949,12 @@ static void TestBuildGraphForSimpleExpression(WasmOpcode opcode) {
   Isolate* isolate = CcTest::InitIsolateOnce();
   Zone zone(isolate->allocator(), ZONE_NAME);
   HandleScope scope(isolate);
+  // TODO(gdeepti): Enable this test for sign extension opcodes when lowering
+  // is enabled.
+  if (WasmOpcodes::IsSignExtensionOpcode(opcode)) return;
+  // TODO(ahaas): Enable this test for anyref opcodes when code generation for
+  // them is implemented.
+  if (WasmOpcodes::IsAnyRefOpcode(opcode)) return;
   // Enable all optional operators.
   compiler::CommonOperatorBuilder common(&zone);
   compiler::MachineOperatorBuilder machine(
diff --git a/deps/v8/test/cctest/wasm/test-streaming-compilation.cc b/deps/v8/test/cctest/wasm/test-streaming-compilation.cc
index ef77708267e..6716ded40db 100644
--- a/deps/v8/test/cctest/wasm/test-streaming-compilation.cc
+++ b/deps/v8/test/cctest/wasm/test-streaming-compilation.cc
@@ -35,7 +35,7 @@ class MockPlatform final : public TestPlatform {
     return task_runner_;
   }
 
-  std::shared_ptr<TaskRunner> GetBackgroundTaskRunner(
+  std::shared_ptr<TaskRunner> GetWorkerThreadsTaskRunner(
       v8::Isolate* isolate) override {
     return task_runner_;
   }
@@ -44,9 +44,8 @@ class MockPlatform final : public TestPlatform {
     task_runner_->PostTask(std::unique_ptr<Task>(task));
   }
 
-  void CallOnBackgroundThread(v8::Task* task,
-                              ExpectedRuntime expected_runtime) override {
-    task_runner_->PostTask(std::unique_ptr<Task>(task));
+  void CallOnWorkerThread(std::unique_ptr<v8::Task> task) override {
+    task_runner_->PostTask(std::move(task));
   }
 
   bool IdleTasksEnabled(v8::Isolate* isolate) override { return false; }
diff --git a/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc b/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc
index 48640ef1e5f..49e4b6ac44f 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc
@@ -88,7 +88,6 @@ class BreakHandler : public debug::DebugDelegate {
 
   void BreakProgramRequested(v8::Local<v8::Context> paused_context,
                              v8::Local<v8::Object> exec_state,
-                             v8::Local<v8::Value> break_points_hit,
                              const std::vector<int>&) override {
     printf("Break #%d\n", count_);
     CHECK_GT(expected_breaks_.size(), count_);
@@ -114,26 +113,6 @@ class BreakHandler : public debug::DebugDelegate {
   }
 };
 
-Handle<JSObject> MakeFakeBreakpoint(Isolate* isolate, int position) {
-  Handle<JSObject> obj =
-      isolate->factory()->NewJSObject(isolate->object_function());
-  // Generate an "isTriggered" method that always returns true.
-  // This can/must be refactored once we remove remaining JS parts from the
-  // debugger (bug 5530).
-  Handle<String> source = isolate->factory()->NewStringFromStaticChars("true");
-  Handle<Context> context(isolate->context(), isolate);
-  Handle<JSFunction> triggered_fun =
-      Compiler::GetFunctionFromString(context, source, NO_PARSE_RESTRICTION,
-                                      kNoSourcePosition)
-          .ToHandleChecked();
-  PropertyDescriptor desc;
-  desc.set_value(triggered_fun);
-  Handle<String> name =
-      isolate->factory()->InternalizeUtf8String(CStrVector("isTriggered"));
-  CHECK(JSObject::DefineOwnProperty(isolate, obj, name, &desc, kDontThrow)
-            .FromMaybe(false));
-  return obj;
-}
 
 void SetBreakpoint(WasmRunnerBase& runner, int function_index, int byte_offset,
                    int expected_set_byte_offset = -1) {
@@ -143,10 +122,12 @@ void SetBreakpoint(WasmRunnerBase& runner, int function_index, int byte_offset,
   if (expected_set_byte_offset == -1) expected_set_byte_offset = byte_offset;
   Handle<WasmInstanceObject> instance = runner.builder().instance_object();
   Handle<WasmCompiledModule> compiled_module(instance->compiled_module());
-  Handle<JSObject> fake_breakpoint_object =
-      MakeFakeBreakpoint(runner.main_isolate(), code_offset);
+  static int break_index = 0;
+  Handle<BreakPoint> break_point =
+      runner.main_isolate()->factory()->NewBreakPoint(
+          break_index++, runner.main_isolate()->factory()->empty_string());
   CHECK(WasmCompiledModule::SetBreakPoint(compiled_module, &code_offset,
-                                          fake_breakpoint_object));
+                                          break_point));
   int set_byte_offset = code_offset - func_offset;
   CHECK_EQ(expected_set_byte_offset, set_byte_offset);
   // Also set breakpoint on the debug info of the instance directly, since the
@@ -212,7 +193,6 @@ class CollectValuesBreakHandler : public debug::DebugDelegate {
 
   void BreakProgramRequested(v8::Local<v8::Context> paused_context,
                              v8::Local<v8::Object> exec_state,
-                             v8::Local<v8::Value> break_points_hit,
                              const std::vector<int>&) override {
     printf("Break #%d\n", count_);
     CHECK_GT(expected_values_.size(), count_);
diff --git a/deps/v8/test/cctest/wasm/wasm-atomics-utils.h b/deps/v8/test/cctest/wasm/wasm-atomics-utils.h
new file mode 100644
index 00000000000..c65d4c7d53c
--- /dev/null
+++ b/deps/v8/test/cctest/wasm/wasm-atomics-utils.h
@@ -0,0 +1,62 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef WASM_ATOMICOP_UTILS_H
+#define WASM_ATOMICOP_UTILS_H
+
+#include "src/objects-inl.h"
+#include "test/cctest/cctest.h"
+#include "test/cctest/compiler/value-helper.h"
+#include "test/cctest/wasm/wasm-run-utils.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+
+typedef uint64_t (*Uint64BinOp)(uint64_t, uint64_t);
+typedef uint32_t (*Uint32BinOp)(uint32_t, uint32_t);
+typedef uint16_t (*Uint16BinOp)(uint16_t, uint16_t);
+typedef uint8_t (*Uint8BinOp)(uint8_t, uint8_t);
+
+template <typename T>
+T Add(T a, T b) {
+  return a + b;
+}
+
+template <typename T>
+T Sub(T a, T b) {
+  return a - b;
+}
+
+template <typename T>
+T And(T a, T b) {
+  return a & b;
+}
+
+template <typename T>
+T Or(T a, T b) {
+  return a | b;
+}
+
+template <typename T>
+T Xor(T a, T b) {
+  return a ^ b;
+}
+
+template <typename T>
+T Exchange(T a, T b) {
+  return b;
+}
+
+template <typename T>
+T CompareExchange(T initial, T a, T b) {
+  if (initial == a) return b;
+  return a;
+}
+
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
+
+#endif
diff --git a/deps/v8/test/cctest/wasm/wasm-run-utils.cc b/deps/v8/test/cctest/wasm/wasm-run-utils.cc
index 4fa1fb1c7aa..bb0e15da317 100644
--- a/deps/v8/test/cctest/wasm/wasm-run-utils.cc
+++ b/deps/v8/test/cctest/wasm/wasm-run-utils.cc
@@ -72,17 +72,13 @@ uint32_t TestingModuleBuilder::AddFunction(FunctionSig* sig, const char* name) {
     test_module_.functions.reserve(kMaxFunctions);
   }
   uint32_t index = static_cast<uint32_t>(test_module_.functions.size());
-  if (FLAG_wasm_jit_to_native) {
-    native_module_->ResizeCodeTableForTest(index);
-  }
-  test_module_.functions.push_back(
-      {sig, index, 0, {0, 0}, {0, 0}, false, false});
+  native_module_->ResizeCodeTableForTest(index);
+  test_module_.functions.push_back({sig, index, 0, {0, 0}, false, false});
   if (name) {
     Vector<const byte> name_vec = Vector<const byte>::cast(CStrVector(name));
-    test_module_.functions.back().name = {
-        AddBytes(name_vec), static_cast<uint32_t>(name_vec.length())};
+    test_module_.AddNameForTesting(
+        index, {AddBytes(name_vec), static_cast<uint32_t>(name_vec.length())});
   }
-  function_code_.push_back(Handle<Code>::null());
   if (interpreter_) {
     interpreter_->AddFunctionForTesting(&test_module_.functions.back());
   }
@@ -101,21 +97,15 @@ uint32_t TestingModuleBuilder::AddJsFunction(
   Handle<Code> code = compiler::CompileWasmToJSWrapper(
       isolate_, jsfunc, sig, index, test_module_.origin(),
       trap_handler::IsTrapHandlerEnabled(), js_imports_table);
-  if (FLAG_wasm_jit_to_native) {
-    native_module_->ResizeCodeTableForTest(index);
-    native_module_->AddCodeCopy(code, wasm::WasmCode::kWasmToJsWrapper, index);
-  } else {
-    function_code_[index] = code;
-  }
+  native_module_->ResizeCodeTableForTest(index);
+  native_module_->AddCodeCopy(code, wasm::WasmCode::kWasmToJsWrapper, index);
   return index;
 }
 
 Handle<JSFunction> TestingModuleBuilder::WrapCode(uint32_t index) {
   // Wrap the code so it can be called as a JS function.
   Link();
-  WasmCodeWrapper code = FLAG_wasm_jit_to_native
-                             ? WasmCodeWrapper(native_module_->GetCode(index))
-                             : WasmCodeWrapper(function_code_[index]);
+  wasm::WasmCode* code = native_module_->GetCode(index);
   byte* context_address =
       test_module_.has_memory
           ? reinterpret_cast<byte*>(instance_object_->wasm_context()->get())
@@ -159,11 +149,20 @@ void TestingModuleBuilder::AddIndirectFunctionTable(
       table_size * compiler::kFunctionTableEntrySize);
   function_tables_.push_back(
       isolate_->global_handles()->Create(func_table).address());
+
+  WasmContext* wasm_context = instance_object()->wasm_context()->get();
+  wasm_context->table = reinterpret_cast<IndirectFunctionTableEntry*>(
+      calloc(table_size, sizeof(IndirectFunctionTableEntry)));
+  wasm_context->table_size = table_size;
+  for (uint32_t i = 0; i < table_size; i++) {
+    wasm_context->table[i].sig_id = -1;
+  }
 }
 
 void TestingModuleBuilder::PopulateIndirectFunctionTable() {
   if (interpret()) return;
   // Initialize the fixed arrays in instance->function_tables.
+  WasmContext* wasm_context = instance_object()->wasm_context()->get();
   for (uint32_t i = 0; i < function_tables_.size(); i++) {
     WasmIndirectFunctionTable& table = test_module_.function_tables[i];
     Handle<FixedArray> function_table(
@@ -171,21 +170,14 @@ void TestingModuleBuilder::PopulateIndirectFunctionTable() {
     int table_size = static_cast<int>(table.values.size());
     for (int j = 0; j < table_size; j++) {
       WasmFunction& function = test_module_.functions[table.values[j]];
-      function_table->set(
-          compiler::FunctionTableSigOffset(j),
-          Smi::FromInt(test_module_.signature_map.Find(function.sig)));
-      if (FLAG_wasm_jit_to_native) {
-        Handle<Foreign> foreign_holder = isolate_->factory()->NewForeign(
-            native_module_->GetCode(function.func_index)
-                ->instructions()
-                .start(),
-            TENURED);
-        function_table->set(compiler::FunctionTableCodeOffset(j),
-                            *foreign_holder);
-      } else {
-        function_table->set(compiler::FunctionTableCodeOffset(j),
-                            *function_code_[function.func_index]);
-      }
+      int sig_id = test_module_.signature_map.Find(function.sig);
+      function_table->set(compiler::FunctionTableSigOffset(j),
+                          Smi::FromInt(sig_id));
+      auto start =
+          native_module_->GetCode(function.func_index)->instructions().start();
+      wasm_context->table[j].context = wasm_context;
+      wasm_context->table[j].sig_id = sig_id;
+      wasm_context->table[j].target = start;
     }
   }
 }
@@ -208,7 +200,7 @@ uint32_t TestingModuleBuilder::AddBytes(Vector<const byte> bytes) {
 }
 
 compiler::ModuleEnv TestingModuleBuilder::CreateModuleEnv() {
-  return {&test_module_, function_tables_, function_code_, Handle<Code>::null(),
+  return {&test_module_, function_tables_,
           trap_handler::IsTrapHandlerEnabled()};
 }
 
@@ -236,12 +228,11 @@ Handle<WasmInstanceObject> TestingModuleBuilder::InitInstanceObject() {
   Handle<WasmSharedModuleData> shared_module_data =
       WasmSharedModuleData::New(isolate_, module_wrapper, empty_string, script,
                                 Handle<ByteArray>::null());
-  Handle<FixedArray> code_table = isolate_->factory()->NewFixedArray(0);
   Handle<FixedArray> export_wrappers = isolate_->factory()->NewFixedArray(0);
   Handle<WasmCompiledModule> compiled_module = WasmCompiledModule::New(
-      isolate_, test_module_ptr_, code_table, export_wrappers, function_tables_,
+      isolate_, test_module_ptr_, export_wrappers, function_tables_,
       trap_handler::IsTrapHandlerEnabled());
-  compiled_module->OnWasmModuleDecodingComplete(shared_module_data);
+  compiled_module->set_shared(*shared_module_data);
   // This method is called when we initialize TestEnvironment. We don't
   // have a memory yet, so we won't create it here. We'll update the
   // interpreter when we get a memory. We do have globals, though.
@@ -249,7 +240,7 @@ Handle<WasmInstanceObject> TestingModuleBuilder::InitInstanceObject() {
 
   Handle<FixedArray> weak_exported = isolate_->factory()->NewFixedArray(0);
   compiled_module->set_weak_exported_functions(*weak_exported);
-  DCHECK(WasmCompiledModule::IsWasmCompiledModule(*compiled_module));
+  DCHECK(compiled_module->IsWasmCompiledModule());
   script->set_wasm_compiled_module(*compiled_module);
   auto instance = WasmInstanceObject::New(isolate_, compiled_module);
   instance->wasm_context()->get()->globals_start = globals_data_;
@@ -315,10 +306,10 @@ WasmFunctionWrapper::WasmFunctionWrapper(Zone* zone, int num_params)
   signature_ = sig_builder.Build();
 }
 
-void WasmFunctionWrapper::Init(CallDescriptor* descriptor,
+void WasmFunctionWrapper::Init(CallDescriptor* call_descriptor,
                                MachineType return_type,
                                Vector<MachineType> param_types) {
-  DCHECK_NOT_NULL(descriptor);
+  DCHECK_NOT_NULL(call_descriptor);
   DCHECK_EQ(signature_->parameter_count(), param_types.length() + 1);
 
   // Create the TF graph for the wrapper.
@@ -349,8 +340,8 @@ void WasmFunctionWrapper::Init(CallDescriptor* descriptor,
 
   parameters[parameter_count++] = effect;
   parameters[parameter_count++] = graph()->start();
-  Node* call =
-      graph()->NewNode(common()->Call(descriptor), parameter_count, parameters);
+  Node* call = graph()->NewNode(common()->Call(call_descriptor),
+                                parameter_count, parameters);
 
   if (!return_type.IsNone()) {
     effect = graph()->NewNode(
@@ -373,7 +364,7 @@ Handle<Code> WasmFunctionWrapper::GetWrapperCode() {
   if (code_.is_null()) {
     Isolate* isolate = CcTest::InitIsolateOnce();
 
-    CallDescriptor* descriptor =
+    auto call_descriptor =
         compiler::Linkage::GetSimplifiedCDescriptor(zone(), signature_, true);
 
     if (kPointerSize == 4) {
@@ -394,11 +385,13 @@ Handle<Code> WasmFunctionWrapper::GetWrapperCode() {
     CompilationInfo info(ArrayVector("testing"), graph()->zone(),
                          Code::C_WASM_ENTRY);
     code_ = compiler::Pipeline::GenerateCodeForTesting(
-        &info, isolate, descriptor, graph(), nullptr);
+        &info, isolate, call_descriptor, graph(), nullptr);
     CHECK(!code_.is_null());
 #ifdef ENABLE_DISASSEMBLER
     if (FLAG_print_opt_code) {
-      OFStream os(stdout);
+      CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
+      OFStream os(tracing_scope.file());
+
       code_->Disassemble("wasm wrapper", os);
     }
 #endif
@@ -434,9 +427,7 @@ void WasmFunctionCompiler::Build(const byte* start, const byte* end) {
   Handle<WasmCompiledModule> compiled_module(
       builder_->instance_object()->compiled_module(), isolate());
   NativeModule* native_module = compiled_module->GetNativeModule();
-  if (FLAG_wasm_jit_to_native) {
-    native_module->ResizeCodeTableForTest(function_->func_index);
-  }
+  native_module->ResizeCodeTableForTest(function_->func_index);
   Handle<SeqOneByteString> wire_bytes(compiled_module->shared()->module_bytes(),
                                       isolate());
 
@@ -446,9 +437,11 @@ void WasmFunctionCompiler::Build(const byte* start, const byte* end) {
   memcpy(func_wire_bytes.start(),
          wire_bytes->GetChars() + function_->code.offset(),
          func_wire_bytes.length());
-  ScopedVector<char> func_name(function_->name.length());
-  memcpy(func_name.start(), wire_bytes->GetChars() + function_->name.offset(),
-         func_name.length());
+  WireBytesRef func_name_ref =
+      module_env.module->LookupName(*wire_bytes, function_->func_index);
+  ScopedVector<char> func_name(func_name_ref.length());
+  memcpy(func_name.start(), wire_bytes->GetChars() + func_name_ref.offset(),
+         func_name_ref.length());
 
   FunctionBody func_body{function_->sig, function_->code.offset(),
                          func_wire_bytes.start(), func_wire_bytes.end()};
@@ -462,47 +455,13 @@ void WasmFunctionCompiler::Build(const byte* start, const byte* end) {
       isolate()->counters(), builder_->runtime_exception_support(),
       builder_->lower_simd());
   unit.ExecuteCompilation();
-  WasmCodeWrapper code_wrapper = unit.FinishCompilation(&thrower);
+  wasm::WasmCode* wasm_code = unit.FinishCompilation(&thrower);
+  if (wasm::WasmCode::ShouldBeLogged(isolate())) {
+    wasm_code->LogCode(isolate());
+  }
   CHECK(!thrower.error());
-  if (!FLAG_wasm_jit_to_native) {
-    Handle<Code> code = code_wrapper.GetCode();
-    // TODO(6792): No longer needed once WebAssembly code is off heap.
-    CodeSpaceMemoryModificationScope modification_scope(isolate()->heap());
-
-    // Manually add the deoptimization info that would otherwise be added
-    // during instantiation. Deopt data holds <WeakCell<wasm_instance>,
-    // func_index>.
-    DCHECK_EQ(0, code->deoptimization_data()->length());
-    Handle<FixedArray> deopt_data =
-        isolate()->factory()->NewFixedArray(2, TENURED);
-    Handle<Object> weak_instance =
-        isolate()->factory()->NewWeakCell(builder_->instance_object());
-    deopt_data->set(0, *weak_instance);
-    deopt_data->set(1, Smi::FromInt(static_cast<int>(function_index())));
-    code->set_deoptimization_data(*deopt_data);
-
-    // Build the TurboFan graph.
-    builder_->SetFunctionCode(function_index(), code);
-
-    // Add to code table.
-    Handle<FixedArray> code_table(compiled_module->code_table(), isolate());
-    if (static_cast<int>(function_index()) >= code_table->length()) {
-      Handle<FixedArray> new_arr = isolate()->factory()->NewFixedArray(
-          static_cast<int>(function_index()) + 1);
-      code_table->CopyTo(0, *new_arr, 0, code_table->length());
-      code_table = new_arr;
-      compiled_module->ReplaceCodeTableForTesting(code_table);
-    }
-    DCHECK(code_table->get(static_cast<int>(function_index()))
-               ->IsUndefined(isolate()));
-    code_table->set(static_cast<int>(function_index()), *code);
-    if (trap_handler::IsTrapHandlerEnabled()) {
-      UnpackAndRegisterProtectedInstructionsGC(isolate(), code_table);
-    }
-  } else {
-    if (trap_handler::IsTrapHandlerEnabled()) {
-      UnpackAndRegisterProtectedInstructions(isolate(), native_module);
-    }
+  if (trap_handler::IsTrapHandlerEnabled()) {
+    UnpackAndRegisterProtectedInstructions(isolate(), native_module);
   }
 }
 
@@ -523,18 +482,7 @@ WasmFunctionCompiler::WasmFunctionCompiler(Zone* zone, FunctionSig* sig,
   function_ = builder_->GetFunctionAt(index);
 }
 
-WasmFunctionCompiler::~WasmFunctionCompiler() {
-  if (!FLAG_wasm_jit_to_native) {
-    if (trap_handler::IsTrapHandlerEnabled() &&
-        !builder_->GetFunctionCode(function_index()).is_null()) {
-      const int handler_index = builder_->GetFunctionCode(function_index())
-                                    .GetCode()
-                                    ->trap_handler_index()
-                                    ->value();
-      trap_handler::ReleaseHandlerData(handler_index);
-    }
-  }
-}
+WasmFunctionCompiler::~WasmFunctionCompiler() {}
 
 FunctionSig* WasmRunnerBase::CreateSig(MachineType return_type,
                                        Vector<MachineType> param_types) {
diff --git a/deps/v8/test/cctest/wasm/wasm-run-utils.h b/deps/v8/test/cctest/wasm/wasm-run-utils.h
index c0ce21533fd..40469c54257 100644
--- a/deps/v8/test/cctest/wasm/wasm-run-utils.h
+++ b/deps/v8/test/cctest/wasm/wasm-run-utils.h
@@ -26,6 +26,7 @@
 #include "src/wasm/function-body-decoder.h"
 #include "src/wasm/local-decl-encoder.h"
 #include "src/wasm/wasm-code-manager.h"
+#include "src/wasm/wasm-code-specialization.h"
 #include "src/wasm/wasm-external-refs.h"
 #include "src/wasm/wasm-interpreter.h"
 #include "src/wasm/wasm-js.h"
@@ -91,13 +92,7 @@ class TestingModuleBuilder {
 
   byte* AddMemory(uint32_t size);
 
-  size_t CodeTableLength() const {
-    if (FLAG_wasm_jit_to_native) {
-      return native_module_->FunctionCount();
-    } else {
-      return function_code_.size();
-    }
-  }
+  size_t CodeTableLength() const { return native_module_->FunctionCount(); }
 
   template <typename T>
   T* AddMemoryElems(uint32_t count) {
@@ -187,10 +182,6 @@ class TestingModuleBuilder {
 
   Handle<JSFunction> WrapCode(uint32_t index);
 
-  void SetFunctionCode(uint32_t index, Handle<Code> code) {
-    function_code_[index] = code;
-  }
-
   void AddIndirectFunctionTable(const uint16_t* function_indexes,
                                 uint32_t table_size);
 
@@ -207,21 +198,16 @@ class TestingModuleBuilder {
   LowerSimd lower_simd() { return lower_simd_; }
   Isolate* isolate() { return isolate_; }
   Handle<WasmInstanceObject> instance_object() { return instance_object_; }
-  WasmCodeWrapper GetFunctionCode(uint32_t index) {
-    if (FLAG_wasm_jit_to_native) {
-      return WasmCodeWrapper(native_module_->GetCode(index));
-    } else {
-      return WasmCodeWrapper(function_code_[index]);
-    }
-  }
-  void SetFunctionCode(int index, Handle<Code> code) {
-    function_code_[index] = code;
+  wasm::WasmCode* GetFunctionCode(uint32_t index) {
+    return native_module_->GetCode(index);
   }
   Address globals_start() { return reinterpret_cast<Address>(globals_data_); }
   void Link() {
-    if (!FLAG_wasm_jit_to_native) return;
     if (!linked_) {
-      native_module_->LinkAll();
+      Zone specialization_zone(isolate()->allocator(), ZONE_NAME);
+      CodeSpecialization code_specialization(isolate(), &specialization_zone);
+      code_specialization.RelocateDirectCalls(native_module_);
+      code_specialization.ApplyToWholeModule(native_module_);
       linked_ = true;
       native_module_->SetExecutable(true);
     }
@@ -242,7 +228,6 @@ class TestingModuleBuilder {
   uint32_t global_offset;
   byte* mem_start_;
   uint32_t mem_size_;
-  std::vector<Handle<Code>> function_code_;
   std::vector<GlobalHandleAddress> function_tables_;
   V8_ALIGNED(16) byte globals_data_[kMaxGlobalsSize];
   WasmInterpreter* interpreter_;
@@ -268,33 +253,26 @@ class WasmFunctionWrapper : private compiler::GraphAndBuilders {
  public:
   WasmFunctionWrapper(Zone* zone, int num_params);
 
-  void Init(CallDescriptor* descriptor, MachineType return_type,
+  void Init(CallDescriptor* call_descriptor, MachineType return_type,
             Vector<MachineType> param_types);
 
   template <typename ReturnType, typename... ParamTypes>
-  void Init(CallDescriptor* descriptor) {
+  void Init(CallDescriptor* call_descriptor) {
     std::array<MachineType, sizeof...(ParamTypes)> param_machine_types{
         {MachineTypeForC<ParamTypes>()...}};
     Vector<MachineType> param_vec(param_machine_types.data(),
                                   param_machine_types.size());
-    Init(descriptor, MachineTypeForC<ReturnType>(), param_vec);
+    Init(call_descriptor, MachineTypeForC<ReturnType>(), param_vec);
   }
 
-  void SetInnerCode(WasmCodeWrapper code) {
-    if (FLAG_wasm_jit_to_native) {
-      intptr_t address = reinterpret_cast<intptr_t>(
-          code.GetWasmCode()->instructions().start());
-      compiler::NodeProperties::ChangeOp(
-          inner_code_node_,
-          kPointerSize == 8
-              ? common()->RelocatableInt64Constant(address,
-                                                   RelocInfo::WASM_CALL)
-              : common()->RelocatableInt32Constant(static_cast<int>(address),
-                                                   RelocInfo::WASM_CALL));
-    } else {
-      compiler::NodeProperties::ChangeOp(
-          inner_code_node_, common()->HeapConstant(code.GetCode()));
-    }
+  void SetInnerCode(wasm::WasmCode* code) {
+    intptr_t address = reinterpret_cast<intptr_t>(code->instructions().start());
+    compiler::NodeProperties::ChangeOp(
+        inner_code_node_,
+        kPointerSize == 8
+            ? common()->RelocatableInt64Constant(address, RelocInfo::WASM_CALL)
+            : common()->RelocatableInt32Constant(static_cast<int>(address),
+                                                 RelocInfo::WASM_CALL));
   }
 
   const compiler::Operator* IntPtrConstant(intptr_t value) {
diff --git a/deps/v8/test/common/wasm/test-signatures.h b/deps/v8/test/common/wasm/test-signatures.h
index 9a0a3eac497..1b24a3b3cd9 100644
--- a/deps/v8/test/common/wasm/test-signatures.h
+++ b/deps/v8/test/common/wasm/test-signatures.h
@@ -26,6 +26,8 @@ class TestSignatures {
         sig_i_ff(1, 2, kIntFloatTypes4),
         sig_i_d(1, 1, kIntDoubleTypes4),
         sig_i_dd(1, 2, kIntDoubleTypes4),
+        sig_i_r(1, 1, kIntRefTypes4),
+        sig_i_rr(1, 2, kIntRefTypes4),
         sig_l_v(1, 0, kLongTypes4),
         sig_l_l(1, 1, kLongTypes4),
         sig_l_ll(1, 2, kLongTypes4),
@@ -34,6 +36,7 @@ class TestSignatures {
         sig_f_ff(1, 2, kFloatTypes4),
         sig_d_d(1, 1, kDoubleTypes4),
         sig_d_dd(1, 2, kDoubleTypes4),
+        sig_r_v(1, 0, kRefTypes4),
         sig_v_v(0, 0, kIntTypes4),
         sig_v_i(0, 1, kIntTypes4),
         sig_v_ii(0, 2, kIntTypes4),
@@ -46,13 +49,16 @@ class TestSignatures {
     for (int i = 0; i < 4; i++) kLongTypes4[i] = kWasmI64;
     for (int i = 0; i < 4; i++) kFloatTypes4[i] = kWasmF32;
     for (int i = 0; i < 4; i++) kDoubleTypes4[i] = kWasmF64;
+    for (int i = 0; i < 4; i++) kRefTypes4[i] = kWasmAnyRef;
     for (int i = 0; i < 4; i++) kIntLongTypes4[i] = kWasmI64;
     for (int i = 0; i < 4; i++) kIntFloatTypes4[i] = kWasmF32;
     for (int i = 0; i < 4; i++) kIntDoubleTypes4[i] = kWasmF64;
+    for (int i = 0; i < 4; i++) kIntRefTypes4[i] = kWasmAnyRef;
     for (int i = 0; i < 4; i++) kSimd128IntTypes4[i] = kWasmS128;
     kIntLongTypes4[0] = kWasmI32;
     kIntFloatTypes4[0] = kWasmI32;
     kIntDoubleTypes4[0] = kWasmI32;
+    kIntRefTypes4[0] = kWasmI32;
     kSimd128IntTypes4[1] = kWasmI32;
   }
 
@@ -70,12 +76,16 @@ class TestSignatures {
   FunctionSig* l_l() { return &sig_l_l; }
   FunctionSig* l_ll() { return &sig_l_ll; }
   FunctionSig* i_ll() { return &sig_i_ll; }
+  FunctionSig* i_r() { return &sig_i_r; }
+  FunctionSig* i_rr() { return &sig_i_rr; }
 
   FunctionSig* f_f() { return &sig_f_f; }
   FunctionSig* f_ff() { return &sig_f_ff; }
   FunctionSig* d_d() { return &sig_d_d; }
   FunctionSig* d_dd() { return &sig_d_dd; }
 
+  FunctionSig* r_v() { return &sig_r_v; }
+
   FunctionSig* v_v() { return &sig_v_v; }
   FunctionSig* v_i() { return &sig_v_i; }
   FunctionSig* v_ii() { return &sig_v_ii; }
@@ -99,9 +109,11 @@ class TestSignatures {
   ValueType kLongTypes4[4];
   ValueType kFloatTypes4[4];
   ValueType kDoubleTypes4[4];
+  ValueType kRefTypes4[4];
   ValueType kIntLongTypes4[4];
   ValueType kIntFloatTypes4[4];
   ValueType kIntDoubleTypes4[4];
+  ValueType kIntRefTypes4[4];
   ValueType kSimd128IntTypes4[4];
 
   FunctionSig sig_i_v;
@@ -113,6 +125,8 @@ class TestSignatures {
   FunctionSig sig_i_ff;
   FunctionSig sig_i_d;
   FunctionSig sig_i_dd;
+  FunctionSig sig_i_r;
+  FunctionSig sig_i_rr;
 
   FunctionSig sig_l_v;
   FunctionSig sig_l_l;
@@ -124,6 +138,8 @@ class TestSignatures {
   FunctionSig sig_d_d;
   FunctionSig sig_d_dd;
 
+  FunctionSig sig_r_v;
+
   FunctionSig sig_v_v;
   FunctionSig sig_v_i;
   FunctionSig sig_v_ii;
diff --git a/deps/v8/test/common/wasm/wasm-macro-gen.h b/deps/v8/test/common/wasm/wasm-macro-gen.h
index 83ddaa6b72b..02af6e95086 100644
--- a/deps/v8/test/common/wasm/wasm-macro-gen.h
+++ b/deps/v8/test/common/wasm/wasm-macro-gen.h
@@ -564,6 +564,10 @@ inline WasmOpcode LoadStoreOpcodeOf(MachineType type, bool store) {
 #define WASM_I32_UCONVERT_SAT_F32(x) x, WASM_NUMERIC_OP(kExprI32UConvertSatF32)
 #define WASM_I32_SCONVERT_SAT_F64(x) x, WASM_NUMERIC_OP(kExprI32SConvertSatF64)
 #define WASM_I32_UCONVERT_SAT_F64(x) x, WASM_NUMERIC_OP(kExprI32UConvertSatF64)
+#define WASM_I64_SCONVERT_SAT_F32(x) x, WASM_NUMERIC_OP(kExprI64SConvertSatF32)
+#define WASM_I64_UCONVERT_SAT_F32(x) x, WASM_NUMERIC_OP(kExprI64UConvertSatF32)
+#define WASM_I64_SCONVERT_SAT_F64(x) x, WASM_NUMERIC_OP(kExprI64SConvertSatF64)
+#define WASM_I64_UCONVERT_SAT_F64(x) x, WASM_NUMERIC_OP(kExprI64UConvertSatF64)
 
 //------------------------------------------------------------------------------
 // Memory Operations.
@@ -616,4 +620,13 @@ inline WasmOpcode LoadStoreOpcodeOf(MachineType type, bool store) {
   x, y, WASM_ATOMICS_OP(op),                            \
       static_cast<byte>(ElementSizeLog2Of(representation)), ZERO_OFFSET
 
+//------------------------------------------------------------------------------
+// Sign Externsion Operations.
+//------------------------------------------------------------------------------
+#define WASM_I32_SIGN_EXT_I8(x) x, kExprI32SExtendI8
+#define WASM_I32_SIGN_EXT_I16(x) x, kExprI32SExtendI16
+#define WASM_I64_SIGN_EXT_I8(x) x, kExprI64SExtendI8
+#define WASM_I64_SIGN_EXT_I16(x) x, kExprI64SExtendI16
+#define WASM_I64_SIGN_EXT_I32(x) x, kExprI64SExtendI32
+
 #endif  // V8_WASM_MACRO_GEN_H_
diff --git a/deps/v8/test/common/wasm/wasm-module-runner.cc b/deps/v8/test/common/wasm/wasm-module-runner.cc
index d89d87005e1..046d69e804b 100644
--- a/deps/v8/test/common/wasm/wasm-module-runner.cc
+++ b/deps/v8/test/common/wasm/wasm-module-runner.cc
@@ -9,8 +9,8 @@
 #include "src/objects-inl.h"
 #include "src/objects.h"
 #include "src/property-descriptor.h"
-#include "src/wasm/module-compiler.h"
 #include "src/wasm/module-decoder.h"
+#include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-interpreter.h"
 #include "src/wasm/wasm-js.h"
 #include "src/wasm/wasm-module.h"
@@ -26,6 +26,17 @@ uint32_t GetInitialMemSize(const WasmModule* module) {
   return kWasmPageSize * module->initial_pages;
 }
 
+MaybeHandle<WasmInstanceObject> CompileAndInstantiateForTesting(
+    Isolate* isolate, ErrorThrower* thrower, const ModuleWireBytes& bytes) {
+  MaybeHandle<WasmModuleObject> module =
+      isolate->wasm_engine()->SyncCompile(isolate, thrower, bytes);
+  DCHECK_EQ(thrower->error(), module.is_null());
+  if (module.is_null()) return {};
+
+  return isolate->wasm_engine()->SyncInstantiate(
+      isolate, thrower, module.ToHandleChecked(), {}, {});
+}
+
 std::unique_ptr<WasmModule> DecodeWasmModuleForTesting(
     Isolate* isolate, ErrorThrower* thrower, const byte* module_start,
     const byte* module_end, ModuleOrigin origin, bool verify_functions) {
@@ -117,8 +128,8 @@ int32_t CompileAndRunWasmModule(Isolate* isolate, const byte* module_start,
                                 const byte* module_end) {
   HandleScope scope(isolate);
   ErrorThrower thrower(isolate, "CompileAndRunWasmModule");
-  MaybeHandle<WasmInstanceObject> instance = SyncCompileAndInstantiate(
-      isolate, &thrower, ModuleWireBytes(module_start, module_end), {}, {});
+  MaybeHandle<WasmInstanceObject> instance = CompileAndInstantiateForTesting(
+      isolate, &thrower, ModuleWireBytes(module_start, module_end));
   if (instance.is_null()) {
     return -1;
   }
@@ -130,15 +141,17 @@ int32_t CompileAndRunAsmWasmModule(Isolate* isolate, const byte* module_start,
                                    const byte* module_end) {
   HandleScope scope(isolate);
   ErrorThrower thrower(isolate, "CompileAndRunAsmWasmModule");
-  MaybeHandle<WasmModuleObject> module = wasm::SyncCompileTranslatedAsmJs(
-      isolate, &thrower, ModuleWireBytes(module_start, module_end),
-      Handle<Script>::null(), Vector<const byte>());
+  MaybeHandle<WasmModuleObject> module =
+      isolate->wasm_engine()->SyncCompileTranslatedAsmJs(
+          isolate, &thrower, ModuleWireBytes(module_start, module_end),
+          Handle<Script>::null(), Vector<const byte>());
   DCHECK_EQ(thrower.error(), module.is_null());
   if (module.is_null()) return -1;
 
-  MaybeHandle<WasmInstanceObject> instance = wasm::SyncInstantiate(
-      isolate, &thrower, module.ToHandleChecked(), Handle<JSReceiver>::null(),
-      Handle<JSArrayBuffer>::null());
+  MaybeHandle<WasmInstanceObject> instance =
+      isolate->wasm_engine()->SyncInstantiate(
+          isolate, &thrower, module.ToHandleChecked(),
+          Handle<JSReceiver>::null(), Handle<JSArrayBuffer>::null());
   DCHECK_EQ(thrower.error(), instance.is_null());
   if (instance.is_null()) return -1;
 
diff --git a/deps/v8/test/common/wasm/wasm-module-runner.h b/deps/v8/test/common/wasm/wasm-module-runner.h
index cf85822175c..7b1c8bb5c03 100644
--- a/deps/v8/test/common/wasm/wasm-module-runner.h
+++ b/deps/v8/test/common/wasm/wasm-module-runner.h
@@ -54,6 +54,10 @@ bool InterpretWasmModuleForTesting(Isolate* isolate,
 int32_t CompileAndRunWasmModule(Isolate* isolate, const byte* module_start,
                                 const byte* module_end);
 
+// Decode, compile, and instantiate the given module with no imports.
+MaybeHandle<WasmInstanceObject> CompileAndInstantiateForTesting(
+    Isolate* isolate, ErrorThrower* thrower, const ModuleWireBytes& bytes);
+
 // Interprets the given module, starting at the function specified by
 // {function_index}. The return type of the function has to be int32. The module
 // should not have any imports or exports
diff --git a/deps/v8/test/d8_default.gyp b/deps/v8/test/d8_default.gyp
deleted file mode 100644
index 399623d30ac..00000000000
--- a/deps/v8/test/d8_default.gyp
+++ /dev/null
@@ -1,31 +0,0 @@
-# Copyright 2018 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'd8_default_run',
-          'type': 'none',
-          'dependencies': [
-            'debugger/debugger.gyp:debugger_run',
-            'intl/intl.gyp:intl_run',
-            'message/message.gyp:message_run',
-            'mjsunit/mjsunit.gyp:mjsunit_run',
-            'preparser/preparser.gyp:preparser_run',
-            'webkit/webkit.gyp:webkit_run',
-          ],
-          'includes': [
-            '../gypfiles/features.gypi',
-            '../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'd8_default.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/d8_default.isolate b/deps/v8/test/d8_default.isolate
deleted file mode 100644
index efeae64cae3..00000000000
--- a/deps/v8/test/d8_default.isolate
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2018 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'command': [
-      '../tools/run-tests.py',
-    ],
-  },
-  'includes': [
-    'debugger/debugger.isolate',
-    'intl/intl.isolate',
-    'message/message.isolate',
-    'mjsunit/mjsunit.isolate',
-    'preparser/preparser.isolate',
-    'webkit/webkit.isolate',
-  ],
-}
diff --git a/deps/v8/test/debugger/BUILD.gn b/deps/v8/test/debugger/BUILD.gn
new file mode 100644
index 00000000000..4a5b8423be1
--- /dev/null
+++ b/deps/v8/test/debugger/BUILD.gn
@@ -0,0 +1,16 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+group("v8_debugger") {
+  testonly = true
+
+  data_deps = [
+    "../..:d8",
+    "../../tools:v8_testrunner",
+  ]
+
+  data = [
+    "./",
+  ]
+}
diff --git a/deps/v8/test/debugger/debug/debug-backtrace.js b/deps/v8/test/debugger/debug/debug-backtrace.js
index 63bbe1065ac..79087d4683d 100644
--- a/deps/v8/test/debugger/debug/debug-backtrace.js
+++ b/deps/v8/test/debugger/debug/debug-backtrace.js
@@ -42,8 +42,8 @@ function g() {
 
 Debug = debug.Debug
 
-listenerCalled = false;
-exception = false;
+let listenerCalled = false;
+let exceptionThrown = false;
 
 function listener(event, exec_state, event_data, data) {
   try {
@@ -82,7 +82,7 @@ function listener(event, exec_state, event_data, data) {
       listenerCalled = true;
     }
   } catch (e) {
-    exception = e;
+    exceptionThrown = true;
   };
 };
 
@@ -94,5 +94,5 @@ Debug.setBreakPoint(f, 0, 0);
 g();
 
 // Make sure that the debug event listener vas invoked.
-assertFalse(exception, "exception in listener");
+assertFalse(exceptionThrown, "exception in listener");
 assertTrue(listenerCalled);
diff --git a/deps/v8/test/debugger/debug/debug-bigint.js b/deps/v8/test/debugger/debug/debug-bigint.js
new file mode 100644
index 00000000000..2abdc928d9c
--- /dev/null
+++ b/deps/v8/test/debugger/debug/debug-bigint.js
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-bigint
+
+Debug = debug.Debug
+let exceptionThrown = false;
+
+Debug.setListener(function(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    const o = exec_state.frame(0).evaluate("42n", true);
+    assertEquals("bigint", o.type());
+    assertFalse(o.isUndefined());
+    assertEquals("bigint", typeof(o.value()));
+    assertEquals(42n, o.value());
+  } catch (e) {
+    exceptionThrown = true;
+  };
+});
+
+!function() { debugger; }();
+assertFalse(exceptionThrown, "exception in listener")
diff --git a/deps/v8/test/debugger/debug/debug-clearbreakpoint.js b/deps/v8/test/debugger/debug/debug-clearbreakpoint.js
index 0c8267c711d..303eaf1a42e 100644
--- a/deps/v8/test/debugger/debug/debug-clearbreakpoint.js
+++ b/deps/v8/test/debugger/debug/debug-clearbreakpoint.js
@@ -28,8 +28,8 @@
 Debug = debug.Debug
 
 // Simple function which stores the last debug event.
-listenerComplete = false;
-exception = false;
+let listenerComplete = false;
+let exceptionThrown = false;
 
 var breakpoint = -1;
 
@@ -42,7 +42,7 @@ function listener(event, exec_state, event_data, data) {
       listenerComplete = true;
     }
   } catch (e) {
-    exception = e
+    exceptionThrown = true;
   };
 };
 
@@ -57,4 +57,4 @@ g();
 
 // Make sure that the debug event listener vas invoked.
 assertTrue(listenerComplete, "listener did not run to completion");
-assertFalse(exception, "exception in listener")
+assertFalse(exceptionThrown, "exception in listener")
diff --git a/deps/v8/test/debugger/debug/debug-compile-event.js b/deps/v8/test/debugger/debug/debug-compile-event.js
index 2e526095918..6c92bd76f2e 100644
--- a/deps/v8/test/debugger/debug/debug-compile-event.js
+++ b/deps/v8/test/debugger/debug/debug-compile-event.js
@@ -27,7 +27,7 @@
 
 Debug = debug.Debug
 
-var exception = false;  // Exception in debug event listener.
+var exceptionThrown = false;  // Exception in debug event listener.
 var after_compile_count = 0;
 var compile_error_count = 0;
 var current_source = '';  // Current source being compiled.
@@ -85,7 +85,7 @@ function listener(event, exec_state, event_data, data) {
       }
     }
   } catch (e) {
-    exception = e
+    exceptionThrown = true;
   }
 };
 
@@ -110,7 +110,7 @@ try {
 }
 
 // Make sure that the debug event listener was invoked.
-assertFalse(exception, "exception in listener")
+assertFalse(exceptionThrown, "exception in listener")
 
 // Number of before and after + error events should be the same.
 assertEquals(compile_error_count, 1);
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-bool-constructor.js b/deps/v8/test/debugger/debug/debug-evaluate-bool-constructor.js
index 83a0f063917..2c30df91e91 100644
--- a/deps/v8/test/debugger/debug/debug-evaluate-bool-constructor.js
+++ b/deps/v8/test/debugger/debug/debug-evaluate-bool-constructor.js
@@ -29,7 +29,7 @@
 Debug = debug.Debug
 
 var listenerComplete = false;
-var exception = false;
+var exceptionThrown = false;
 
 function listener(event, exec_state, event_data, data) {
   try {
@@ -43,7 +43,7 @@ function listener(event, exec_state, event_data, data) {
     }
   } catch (e) {
     print(e);
-    exception = e
+    exceptionThrown = true;
   };
 };
 
@@ -60,5 +60,5 @@ callDebugger();
 
 
 // Make sure that the debug event listener vas invoked.
-assertFalse(exception, "exception in listener")
+assertFalse(exceptionThrown, "exception in listener")
 assertTrue(listenerComplete, "listener did not run to completion");
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-locals-optimized-double.js b/deps/v8/test/debugger/debug/debug-evaluate-locals-optimized-double.js
index 462194c07bc..fa33725d6f1 100644
--- a/deps/v8/test/debugger/debug/debug-evaluate-locals-optimized-double.js
+++ b/deps/v8/test/debugger/debug/debug-evaluate-locals-optimized-double.js
@@ -30,7 +30,7 @@
 Debug = debug.Debug
 
 var listenerComplete = false;
-var exception = false;
+var exceptionThrown = false;
 
 var testingConstructCall = false;
 
@@ -127,7 +127,7 @@ function listener(event, exec_state, event_data, data) {
       listenerComplete = true;
     }
   } catch (e) {
-    exception = e.toString() + e.stack;
+    exceptionThrown = true;
   };
 };
 
@@ -191,7 +191,7 @@ new f(input.length - 1, 11.11, 12.12);
 new f(input.length - 1, 11.11, 12.12, "");
 
 // Make sure that the debug event listener was invoked.
-assertFalse(exception, "exception in listener " + exception)
+assertFalse(exceptionThrown, "exception in listener");
 assertTrue(listenerComplete);
 
 //Throw away type information for next run.
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-locals-optimized.js b/deps/v8/test/debugger/debug/debug-evaluate-locals-optimized.js
index 93c90b5abbd..be870684210 100644
--- a/deps/v8/test/debugger/debug/debug-evaluate-locals-optimized.js
+++ b/deps/v8/test/debugger/debug/debug-evaluate-locals-optimized.js
@@ -30,7 +30,7 @@
 Debug = debug.Debug
 
 var listenerComplete = false;
-var exception = false;
+var exceptionThrown = false;
 
 var testingConstructCall = false;
 
@@ -118,7 +118,7 @@ function listener(event, exec_state, event_data, data) {
       listenerComplete = true;
     }
   } catch (e) {
-    exception = e.toString() + e.stack;
+    exceptionThrown = true;
   };
 };
 
@@ -172,7 +172,7 @@ new f(expected.length - 1, 11, 12);
 new f(expected.length - 1, 11, 12, 0);
 
 // Make sure that the debug event listener was invoked.
-assertFalse(exception, "exception in listener " + exception)
+assertFalse(exceptionThrown, "exception in listener");
 assertTrue(listenerComplete);
 
 // Throw away type information for next run.
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-locals.js b/deps/v8/test/debugger/debug/debug-evaluate-locals.js
index 0108acf2ff4..edc27e60bbf 100644
--- a/deps/v8/test/debugger/debug/debug-evaluate-locals.js
+++ b/deps/v8/test/debugger/debug/debug-evaluate-locals.js
@@ -27,8 +27,8 @@
 
 Debug = debug.Debug
 
-listenerComplete = false;
-exception = false;
+let listenerComplete = false;
+let exceptionThrown = false;
 
 
 function h() {
@@ -132,7 +132,7 @@ function listener(event, exec_state, event_data, data) {
       listenerComplete = true;
     }
   } catch (e) {
-    exception = e;
+    exceptionThrown = true;
     print("Caught something. " + e + " " + e.stack);
   };
 };
@@ -145,5 +145,5 @@ var f_result = f();
 assertEquals("foobar", f_result);
 
 // Make sure that the debug event listener was invoked.
-assertFalse(exception, "exception in listener")
+assertFalse(exceptionThrown, "exception in listener");
 assertTrue(listenerComplete);
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-with.js b/deps/v8/test/debugger/debug/debug-evaluate-with.js
index 260114d94d0..640d050f998 100644
--- a/deps/v8/test/debugger/debug/debug-evaluate-with.js
+++ b/deps/v8/test/debugger/debug/debug-evaluate-with.js
@@ -30,9 +30,9 @@
 
 Debug = debug.Debug
 
-listenerComplete = false;
-exception = false;
-breakPointCount = 0;
+let listenerComplete = false;
+let exceptionThrown = false;
+let breakPointCount = 0;
 
 function listener(event, exec_state, event_data, data) {
   try {
@@ -53,7 +53,7 @@ function listener(event, exec_state, event_data, data) {
       }
     }
   } catch (e) {
-    exception = e
+    exceptionThrown = true;
   };
 };
 
@@ -79,4 +79,4 @@ eval("with({bar:'with'}) { (function g() { var foo = 'local'; debugger; })(); }"
 
 // Make sure that the debug event listener vas invoked.
 assertEquals(3, breakPointCount);
-assertFalse(exception, "exception in listener")
+assertFalse(exceptionThrown, "exception in listener");
diff --git a/deps/v8/test/debugger/debug/debug-evaluate.js b/deps/v8/test/debugger/debug/debug-evaluate.js
index 9328c323fa8..922bad89572 100644
--- a/deps/v8/test/debugger/debug/debug-evaluate.js
+++ b/deps/v8/test/debugger/debug/debug-evaluate.js
@@ -27,8 +27,8 @@
 
 Debug = debug.Debug
 
-listenerComplete = false;
-exception = false;
+let listenerComplete = false;
+let exceptionThrown = false;
 
 function listener(event, exec_state, event_data, data) {
   try {
@@ -51,7 +51,7 @@ function listener(event, exec_state, event_data, data) {
       listenerComplete = true;
     }
   } catch (e) {
-   exception = e
+   exceptionThrown = true;
   };
 };
 
@@ -80,6 +80,6 @@ for (var i = 0; i < 4; i++) {
 Debug.setBreakPoint(f, 2, 0);
 g();
 
-assertFalse(exception, "exception in listener")
+assertFalse(exceptionThrown, "exception in listener");
 // Make sure that the debug event listener vas invoked.
 assertTrue(listenerComplete, "listener did not run to completion");
diff --git a/deps/v8/test/debugger/debug/debug-return-value.js b/deps/v8/test/debugger/debug/debug-return-value.js
index 77717ceb7c3..4e8db7e4863 100644
--- a/deps/v8/test/debugger/debug/debug-return-value.js
+++ b/deps/v8/test/debugger/debug/debug-return-value.js
@@ -27,12 +27,12 @@
 
 Debug = debug.Debug
 
-listener_complete = false;
-exception = false;
-break_count = 0;
-expected_return_value = 0;
-expected_source_position = [];
-debugger_source_position = 0;
+let listener_complete = false;
+let exceptionThrown = false;
+let break_count = 0;
+let expected_return_value = 0;
+let expected_source_position = [];
+let debugger_source_position = 0;
 
 // Listener which expects to do four steps to reach returning from the function.
 function listener(event, exec_state, event_data, data) {
@@ -72,7 +72,7 @@ function listener(event, exec_state, event_data, data) {
       }
     }
   } catch (e) {
-    exception = e
+    exceptionThrown = true;
     print(e + e.stack)
   };
 };
@@ -93,7 +93,7 @@ expected_return_value = 2;
 expected_source_position = [10, 38, 47];
 listener_complete = false;
 f();
-assertFalse(exception, "exception in listener")
+assertFalse(exceptionThrown, "exception in listener");
 assertTrue(listener_complete);
 assertEquals(4, break_count);
 
@@ -102,7 +102,7 @@ expected_return_value = 1;
 expected_source_position = [10, 19, 28];
 listener_complete = false;
 f(true);
-assertFalse(exception, "exception in listener")
+assertFalse(exceptionThrown, "exception in listener");
 assertTrue(listener_complete);
 assertEquals(4, break_count);
 
@@ -111,6 +111,6 @@ expected_return_value = 2;
 expected_source_position = [10, 38, 47];
 listener_complete = false;
 f(false);
-assertFalse(exception, "exception in listener")
+assertFalse(exceptionThrown, "exception in listener");
 assertTrue(listener_complete);
 assertEquals(4, break_count);
diff --git a/deps/v8/test/debugger/debug/debug-scopes-suspended-generators.js b/deps/v8/test/debugger/debug/debug-scopes-suspended-generators.js
index 2d9d2533862..8d09e9c2a34 100644
--- a/deps/v8/test/debugger/debug/debug-scopes-suspended-generators.js
+++ b/deps/v8/test/debugger/debug/debug-scopes-suspended-generators.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --no-analyze-environment-liveness
+
 // The functions used for testing backtraces. They are at the top to make the
 // testing of source line/column easier.
 
diff --git a/deps/v8/test/debugger/debug/debug-setbreakpoint.js b/deps/v8/test/debugger/debug/debug-setbreakpoint.js
index bfcab7c6fd9..28a12f78ccf 100644
--- a/deps/v8/test/debugger/debug/debug-setbreakpoint.js
+++ b/deps/v8/test/debugger/debug/debug-setbreakpoint.js
@@ -129,8 +129,7 @@ assertTrue(breakListenerCalled, "Break listener not called on breakpoint set by
 function SetBreakpointInI1Script() {
   var i_script = Debug.findScript(i1);
   assertTrue(!!i_script, "invalid script for i1");
-  Debug.setScriptBreakPoint(Debug.ScriptBreakPointType.ScriptId,
-                            i_script.id, 4);
+  Debug.setScriptBreakPointById(i_script.id, 4);
 }
 
 // Creates the eval script and tries to set the breakpoint.
diff --git a/deps/v8/test/mjsunit/deserialize-script-id.js b/deps/v8/test/debugger/debug/deserialize-script-id.js
similarity index 93%
rename from deps/v8/test/mjsunit/deserialize-script-id.js
rename to deps/v8/test/debugger/debug/deserialize-script-id.js
index 5dca9f353ab..25b8c847495 100644
--- a/deps/v8/test/mjsunit/deserialize-script-id.js
+++ b/deps/v8/test/debugger/debug/deserialize-script-id.js
@@ -5,7 +5,7 @@
 // Flags: --allow-natives-syntax --cache=code
 // Test that script ids are unique and we found the correct ones.
 
-var Debug = %GetDebugContext().Debug;
+var Debug = debug.Debug;
 Debug.setListener(function(){});
 
 var scripts = %DebugGetLoadedScripts();
diff --git a/deps/v8/test/debugger/debug/es6/debug-promises/proxy-as-promise.js b/deps/v8/test/debugger/debug/es6/debug-promises/proxy-as-promise.js
new file mode 100644
index 00000000000..3bd1fead080
--- /dev/null
+++ b/deps/v8/test/debugger/debug/es6/debug-promises/proxy-as-promise.js
@@ -0,0 +1,42 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// Test debug events when we listen to all exceptions and
+// there is a catch handler for the exception thrown in a Promise.
+// We expect a normal Exception debug event to be triggered.
+
+Debug = debug.Debug;
+
+var expected_events = 1;
+var log = [];
+
+
+class P extends Promise {
+    constructor(...args) {
+        super(...args);
+        return new Proxy(this, {
+            get(target, property, receiver) {
+                if (property in target) {
+                    return Reflect.get(target, property, receiver);
+                } else {
+                    return (...args) =>
+                        new Promise((resolve, reject) =>
+                            target.then(v => resolve(v[property](...args)))
+                                .catch(reject)
+                        );
+                }
+            }
+        });
+    }
+}
+
+P.resolve({doStuff(){log.push(1)}}).doStuff()
+
+function listener(event, exec_state, event_data, data) {}
+
+Debug.setBreakOnUncaughtException();
+Debug.setListener(listener);
+
+%RunMicrotasks();
diff --git a/deps/v8/test/debugger/debug/es6/debug-promises/throw-with-throw-in-reject.js b/deps/v8/test/debugger/debug/es6/debug-promises/throw-with-throw-in-reject.js
index b17054b06d5..5cca2f93f03 100644
--- a/deps/v8/test/debugger/debug/es6/debug-promises/throw-with-throw-in-reject.js
+++ b/deps/v8/test/debugger/debug/es6/debug-promises/throw-with-throw-in-reject.js
@@ -3,15 +3,13 @@
 // found in the LICENSE file.
 
 
-// Test debug events when an exception is thrown inside a Promise, which is
-// caught by a custom promise, which throws a new exception in its reject
-// handler. We expect two Exception debug events:
-//  1) when the exception is thrown in the promise q.
-//  2) when the custom reject closure in MyPromise throws an exception.
+// Test debug events when an exception is thrown inside a Promise,
+// which is caught by a custom promise, which throws a new exception
+// in its reject handler. We expect no Exception debug events.
 
 Debug = debug.Debug;
 
-var expected_events = 1;
+var expected_events = 0;
 var log = [];
 
 var p = new Promise(function(resolve, reject) {
@@ -21,11 +19,9 @@ var p = new Promise(function(resolve, reject) {
 
 function MyPromise(resolver) {
   var reject = function() {
-    log.push("throw in reject");
     throw new Error("reject");  // event
   };
   var resolve = function() { };
-  log.push("construct");
   resolver(resolve, reject);
 };
 
@@ -42,16 +38,7 @@ var q = p.then(
 function listener(event, exec_state, event_data, data) {
   try {
     if (event == Debug.DebugEvent.Exception) {
-      expected_events--;
-      assertTrue(expected_events >= 0);
-      if (expected_events == 0) {
-        assertEquals(["resolve", "construct", "end main",
-                      "throw caught"], log);
-        assertEquals("caught", event_data.exception().message);
-      } else {
-        assertUnreachable();
-      }
-      assertTrue(exec_state.frame(0).sourceLineText().indexOf('// event') > 0);
+      assertUnreachable();
     }
   } catch (e) {
     %AbortJS(e + "\n" + e.stack);
@@ -68,8 +55,8 @@ function testDone(iteration) {
     try {
       assertTrue(iteration < 10);
       if (expected_events === 0) {
-        assertEquals(["resolve", "construct", "end main",
-                      "throw caught", "throw in reject"], log);
+        assertEquals(["resolve", "end main",
+                      "throw caught"], log);
       } else {
         testDone(iteration + 1);
       }
diff --git a/deps/v8/test/debugger/debug/es8/async-debug-basic.js b/deps/v8/test/debugger/debug/es8/async-debug-basic.js
index 9423fe5b2bb..ea87c67d842 100644
--- a/deps/v8/test/debugger/debug/es8/async-debug-basic.js
+++ b/deps/v8/test/debugger/debug/es8/async-debug-basic.js
@@ -4,8 +4,9 @@
 
 Debug = debug.Debug
 
-listenerComplete = false;
-breakPointCount = 0;
+let listenerComplete = false;
+let breakPointCount = 0;
+let exceptionThrown = false;
 
 async function f() {
   await (async function() { var a = "a"; await 1; debugger; })();
@@ -13,7 +14,7 @@ async function f() {
   var b = "b";
 
   assertTrue(listenerDone);
-  assertFalse(exception);
+  assertFalse(exceptionThrown);
   assertEquals(1, breakpointCount);
 }
 
@@ -27,7 +28,7 @@ function listener(event, exec_state, event_data, data) {
     assertEquals("b", exec_state.frame(1).evaluate("b"));
     assertEquals("c", exec_state.frame(2).evaluate("c"));
   } catch (e) {
-    exception = e;
+    exceptionThrown = true;
   };
 };
 
diff --git a/deps/v8/test/debugger/debug/regress/regress-1081309.js b/deps/v8/test/debugger/debug/regress/regress-1081309.js
index 5e4cd882168..0b32fa5d5d4 100644
--- a/deps/v8/test/debugger/debug/regress/regress-1081309.js
+++ b/deps/v8/test/debugger/debug/regress/regress-1081309.js
@@ -29,8 +29,8 @@ Debug = debug.Debug
 
 // Make sure that the backtrace command can be processed when the receiver is
 // undefined.
-listenerCalled = false;
-exception = false;
+let listenerCalled = false;
+let exceptionThrown = false;
 
 function listener(event, exec_state, event_data, data) {
   try {
@@ -47,7 +47,7 @@ function listener(event, exec_state, event_data, data) {
     }
   } catch (e) {
     print(e);
-    exception = e
+    exceptionThrown = true;
   };
 };
 
@@ -67,6 +67,6 @@ try {
   // Ignore the exception "Cannot call method 'x' of undefined"
 }
 
-assertFalse(exception, "exception in listener", exception)
+assertFalse(exceptionThrown, "exception in listener");
 // Make sure that the debug event listener vas invoked.
 assertTrue(listenerCalled, "listener not called");
diff --git a/deps/v8/test/debugger/debug/regress/regress-1170187.js b/deps/v8/test/debugger/debug/regress/regress-1170187.js
index 165a308dc5d..832b9b753ed 100644
--- a/deps/v8/test/debugger/debug/regress/regress-1170187.js
+++ b/deps/v8/test/debugger/debug/regress/regress-1170187.js
@@ -31,8 +31,8 @@
 
 Debug = debug.Debug
 
-listenerCalled = false;
-exception = false;
+let listenerCalled = false;
+let exceptionThrown = false;
 
 
 function checkName(name) {
@@ -64,7 +64,7 @@ function listener(event, exec_state, event_data, data) {
       listenerCalled = true;
     }
   } catch (e) {
-    exception = e;
+    exceptionThrown = true;
   };
 };
 
@@ -77,4 +77,4 @@ Debug.setListener(listener);
 
 // Make sure that the debug event listener vas invoked (again).
 assertTrue(listenerCalled);
-assertFalse(exception, "exception in listener")
+assertFalse(exceptionThrown, "exception in listener")
diff --git a/deps/v8/test/debugger/debug/regress/regress-119609.js b/deps/v8/test/debugger/debug/regress/regress-119609.js
index b6da891fb01..a1ad32a649d 100644
--- a/deps/v8/test/debugger/debug/regress/regress-119609.js
+++ b/deps/v8/test/debugger/debug/regress/regress-119609.js
@@ -28,7 +28,7 @@
 
 Debug = debug.Debug;
 
-var exception = false;
+var exceptionThrown = false;
 
 function listener(event, exec_state, event_data, data) {
   try {
@@ -44,7 +44,7 @@ function listener(event, exec_state, event_data, data) {
       assertThrows(() => lookup("b"), ReferenceError);
     }
   } catch (e) {
-    exception = e.toString() + e.stack;
+    exceptionThrown = true;
   }
 }
 
@@ -63,4 +63,4 @@ function f(a, b) {
 
 f(1, 2)(3, 4);
 
-assertFalse(exception);
+assertFalse(exceptionThrown);
diff --git a/deps/v8/test/debugger/debug/regress/regress-131994.js b/deps/v8/test/debugger/debug/regress/regress-131994.js
index 66bde74b257..ee431d0c3d7 100644
--- a/deps/v8/test/debugger/debug/regress/regress-131994.js
+++ b/deps/v8/test/debugger/debug/regress/regress-131994.js
@@ -33,7 +33,7 @@
 
 Debug = debug.Debug;
 
-var exception = false;
+var exceptionThrown = false;
 
 function listener(event, exec_state, event_data, data) {
   if (event != Debug.DebugEvent.Break) return;
@@ -44,7 +44,7 @@ function listener(event, exec_state, event_data, data) {
     // Assert correct value.
     assertEquals(3, breakpoint.evaluate('x').value());
   } catch (e) {
-    exception = e;
+    exceptionThrown = true;
   }
 }
 
@@ -67,4 +67,4 @@ function h() {
 
 h();
 
-assertFalse(exception);
+assertFalse(exceptionThrown);
diff --git a/deps/v8/test/debugger/debug/regress/regress-1639.js b/deps/v8/test/debugger/debug/regress/regress-1639.js
index eaaca5176da..cf5f8f5b23c 100644
--- a/deps/v8/test/debugger/debug/regress/regress-1639.js
+++ b/deps/v8/test/debugger/debug/regress/regress-1639.js
@@ -27,7 +27,7 @@
 
 Debug = debug.Debug
 var breaks = 0;
-var exception = false;
+var exceptionThrown = false;
 
 function listener(event, exec_state, event_data, data) {
   try {
@@ -43,7 +43,7 @@ function listener(event, exec_state, event_data, data) {
     }
   } catch (e) {
     print(e);
-    exception = true;
+    exceptionThrown = true;
   }
 }
 
@@ -72,4 +72,4 @@ Debug.setBreakPoint(b, 0, 0);
 a(b);
 a(); // BREAK 3
 
-assertFalse(exception);
+assertFalse(exceptionThrown);
diff --git a/deps/v8/test/debugger/debug/regress/regress-3960.js b/deps/v8/test/debugger/debug/regress/regress-3960.js
deleted file mode 100644
index 6580d4b805c..00000000000
--- a/deps/v8/test/debugger/debug/regress/regress-3960.js
+++ /dev/null
@@ -1,35 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-
-// Test that setting break point works correctly when the debugger is
-// activated late, which leads to duplicate shared function infos.
-
-(function() {
-  var Debug = %GetDebugContext().Debug;
-
-  function listener(event, exec_state, event_data, data) {
-    if (event != Debug.DebugEvent.Break) return;
-    try {
-      assertTrue(/foo/.test(exec_state.frame(0).sourceLineText()));
-      break_count++;
-    } catch (e) {
-      exception = e;
-    }
-  }
-
-  for (var i = 0; i < 3; i++) {
-    var foo = function() { a = 1; }
-    var exception = null;
-    var break_count = 0;
-    Debug.setListener(listener);
-    if (i < 2) Debug.setBreakPoint(foo, 0, 0);
-    assertTrue(/\[B\d\]a = 1/.test(Debug.showBreakPoints(foo)));
-    foo();
-    assertEquals(1, break_count);
-    assertNull(exception);
-  }
-
-  Debug.setListener(null);
-})();
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-async.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-async.js
similarity index 73%
rename from deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-async.js
rename to deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-async.js
index c5c8eeb9c6c..c7f55c148ca 100644
--- a/deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-async.js
+++ b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-async.js
@@ -19,6 +19,8 @@ async function async() {
 
 var g = generator();
 
+var p = new Promise(() => {});
+
 function listener(event, exec_state, event_data, data) {
   if (event != Debug.DebugEvent.Break) return;
   try {
@@ -30,6 +32,15 @@ function listener(event, exec_state, event_data, data) {
     fail("generator()");
     fail("g.next()");
     fail("async()");
+    fail("Promise.resolve()");
+    fail("Promise.reject()");
+    fail("p.then(() => {})");
+    fail("p.catch(() => {})");
+    fail("p.finally(() => {})");
+    fail("Promise.all([p, p])");
+    fail("Promise.race([p, p])");
+    fail("(async function() {})()");
+    fail("(async function() { await 1; })()");
   } catch (e) {
     exception = e;
     print(e, e.stack);
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-builtins-2.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins-2.js
similarity index 65%
rename from deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-builtins-2.js
rename to deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins-2.js
index 1b357ef6bbf..b965c95249a 100644
--- a/deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-builtins-2.js
+++ b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins-2.js
@@ -7,6 +7,10 @@ Debug = debug.Debug
 var exception = null;
 var date = new Date();
 var map = new Map().set("a", "b").set("c", "d");
+var set = new Set([1, 2]);
+var weak_key = [];
+var weak_map = new WeakMap().set(weak_key, "a").set({}, "b");
+var weak_set = new WeakSet([weak_key, {}]);
 
 function listener(event, exec_state, event_data, data) {
   if (event != Debug.DebugEvent.Break) return;
@@ -64,12 +68,46 @@ function listener(event, exec_state, event_data, data) {
     success(undefined, `map.entries()`);
     success(undefined, `map.keys()`);
     success(undefined, `map.values()`);
+    success(undefined, `map.forEach(()=>1)`);
+    success(true, `map.has("c")`);
     success(2, `map.size`);
-    fail(`map.has("c")`);  // This sets a hash on the object.
-    fail(`map.forEach(()=>1)`);
+    fail(`new Map([[1, 2]])`);
     fail(`map.delete("a")`);
     fail(`map.clear()`);
     fail(`map.set("x", "y")`);
+
+    // Test Set functions.
+    success(undefined, `new Set()`);
+    success("[object Set]", `set.toString()`);
+    success(undefined, `set.entries()`);
+    success(undefined, `set.keys()`);
+    success(undefined, `set.values()`);
+    success(undefined, `set.forEach(()=>1)`);
+    success(true, `set.has(1)`);
+    success(2, `set.size`);
+    fail(`new Set([1])`);
+    fail(`set.add(2)`);
+    fail(`set.delete(1)`);
+    fail(`set.clear()`);
+
+    // Test WeakMap functions.
+    success(undefined, `new WeakMap()`);
+    success("[object WeakMap]", `weak_map.toString()`);
+    success("a", `weak_map.get(weak_key)`);
+    success(true, `weak_map.get([]) === undefined`);
+    success(true, `weak_map.has(weak_key)`);
+    fail(`new WeakMap([[[], {}]])`);
+    fail(`weak_map.delete("a")`);
+    fail(`weak_map.set("x", "y")`);
+
+    // Test WeakSet functions.
+    success(undefined, `new WeakSet()`);
+    success("[object WeakSet]", `weak_set.toString()`);
+    success(true, `weak_set.has(weak_key)`);
+    fail(`new WeakSet([[], {}])`);
+    fail(`weak_set.add([])`);
+    fail(`weak_set.delete("a")`);
+
   } catch (e) {
     exception = e;
     print(e, e.stack);
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-builtins.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins.js
similarity index 70%
rename from deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-builtins.js
rename to deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins.js
index 73edb03a60c..8b308bf592d 100644
--- a/deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-builtins.js
+++ b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins.js
@@ -8,6 +8,9 @@ var exception = null;
 var object_with_symbol_key = {[Symbol("a")]: 1};
 var object_with_callbacks = { toString: () => "string", valueOf: () => 3};
 var symbol_for_a = Symbol.for("a");
+var typed_array = new Uint8Array([1, 2, 3]);
+var array_buffer = new ArrayBuffer(3);
+var data_view = new DataView(new ArrayBuffer(8), 0, 8);
 
 function listener(event, exec_state, event_data, data) {
   if (event != Debug.DebugEvent.Break) return;
@@ -57,14 +60,18 @@ function listener(event, exec_state, event_data, data) {
     success(3, `(object_with_callbacks).valueOf()`);
 
     // Test Array functions.
+    success(true, `Array.isArray([1, 2, 3])`);
     success([], `new Array()`);
+    success([undefined, undefined], `new Array(2)`);
+    success([1, 2], `new Array(1, 2)`);
+    fail(`Array.from([1, 2, 3])`);
+    fail(`Array.of(1, 2, 3)`);
     var function_param = [
       "forEach", "every", "some", "reduce", "reduceRight", "find", "filter",
       "map", "findIndex"
     ];
-    var fails = ["toString", "join", "toLocaleString", "pop", "push",
-      "reverse", "shift", "unshift", "slice", "splice", "sort", "filter",
-      "map", "copyWithin", "fill", "concat"];
+    var fails = ["toString", "join", "toLocaleString", "pop", "push", "reverse",
+      "shift", "unshift", "splice", "sort", "copyWithin", "fill"];
     for (f of Object.getOwnPropertyNames(Array.prototype)) {
       if (typeof Array.prototype[f] === "function") {
         if (fails.includes(f)) {
@@ -81,6 +88,57 @@ function listener(event, exec_state, event_data, data) {
       }
     }
 
+    // Test ArrayBuffer functions.
+    success(3, `array_buffer.byteLength`);
+    success(2, `array_buffer.slice(1, 3).byteLength`);
+    success(true, `ArrayBuffer.isView(typed_array)`);
+
+    // Test DataView functions.
+    success(undefined, `new DataView(array_buffer, 1, 2)`);
+    success(undefined, `data_view.buffer`);
+    success(undefined, `data_view.byteLength`);
+    success(undefined, `data_view.byteOffset`);
+    for (f of Object.getOwnPropertyNames(DataView.prototype)) {
+      if (typeof data_view[f] === 'function') {
+        if (f.startsWith('getBig')) {
+          success(0n, `data_view.${f}()`);
+        } else if (f.startsWith('get')) {
+          success(0, `data_view.${f}()`);
+        }
+      }
+    }
+
+    // Test TypedArray functions.
+    success({}, `new Uint8Array()`);
+    success({0: 0, 1: 0}, `new Uint8Array(2)`);
+    success({0: 1, 1: 2, 2: 3}, `new Uint8Array(typed_array)`);
+    success(true, `!!typed_array.buffer`);
+    success(0, `typed_array.byteOffset`);
+    success(3, `typed_array.byteLength`);
+    fail(`Uint8Array.of(1, 2)`);
+    function_param = [
+      "forEach", "every", "some", "reduce", "reduceRight", "find", "filter",
+      "map", "findIndex"
+    ];
+    fails = ["toString", "join", "toLocaleString", "reverse", "sort",
+      "copyWithin", "fill", "set"];
+    var typed_proto_proto = Object.getPrototypeOf(Object.getPrototypeOf(new Uint8Array()));
+    for (f of Object.getOwnPropertyNames(typed_proto_proto)) {
+      if (typeof typed_array[f] === "function" && f !== "constructor") {
+        if (fails.includes(f)) {
+          if (function_param.includes(f)) {
+            fail(`typed_array.${f}(()=>{});`);
+          } else {
+            fail(`typed_array.${f}();`);
+          }
+        } else if (function_param.includes(f)) {
+          exec_state.frame(0).evaluate(`typed_array.${f}(()=>{});`, true);
+        } else {
+          exec_state.frame(0).evaluate(`typed_array.${f}();`, true);
+        }
+      }
+    }
+
     // Test Math functions.
     for (f of Object.getOwnPropertyNames(Math)) {
       if (typeof Math[f] === "function") {
@@ -140,6 +198,12 @@ function listener(event, exec_state, event_data, data) {
     fail("'abcd'.search(/a/)");
     fail("'abcd'.split(/a/)");
 
+    // Test RegExp functions.
+    fail(`/a/.compile()`);
+    fail(`/a/.exec('abc')`);
+    fail(`/a/.test('abc')`);
+    fail(`/a/.toString()`);
+
     // Test JSON functions.
     success('{"abc":[1,2]}', "JSON.stringify(JSON.parse('{\"abc\":[1,2]}'))");
 
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-control.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-control.js
similarity index 100%
rename from deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-control.js
rename to deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-control.js
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-iife.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-iife.js
similarity index 100%
rename from deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-iife.js
rename to deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-iife.js
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-ops.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-ops.js
similarity index 100%
rename from deps/v8/test/debugger/debug/debug-evaluate-no-side-effect-ops.js
rename to deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-ops.js
diff --git a/deps/v8/test/debugger/debug/debug-evaluate-no-side-effect.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect.js
similarity index 85%
rename from deps/v8/test/debugger/debug/debug-evaluate-no-side-effect.js
rename to deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect.js
index 26cf258a9dd..d64a1f1f0a4 100644
--- a/deps/v8/test/debugger/debug/debug-evaluate-no-side-effect.js
+++ b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect.js
@@ -14,6 +14,7 @@ var string2 = { toString() { print("x"); return "x"; } };
 var array = [4, 5];
 var error = new Error();
 
+function simple_return(x) { return x; }
 function set_a() { a = 2; }
 function get_a() { return a; }
 var bound = get_a.bind(0);
@@ -61,6 +62,15 @@ function listener(event, exec_state, event_data, data) {
     success("set_a", "set_a.name");
     success(0, "bound.length");
     success("bound get_a", "bound.name");
+    // Non-evaluated call.
+    success("abc", "['abc'].join('foo')");
+    // Constructed literals.
+    success([1], "[1]");
+    success({x: 1}, "({x: 1})");
+    fail("[a]");
+    fail("({x: a})");
+    // Test that template literal evaluation fails.
+    fail("simple_return`1`");
     // Test that non-read-only code fails.
     fail("exception = 1");
     // Test that calling a non-read-only function fails.
@@ -72,6 +82,11 @@ function listener(event, exec_state, event_data, data) {
     fail("try { set_a() } catch (e) {}");
     // Test that call to set accessor fails.
     fail("array.length = 4");
+    fail("'x'.length = 1");
+    fail("set_a.name = 'set_b'");
+    fail("set_a.length = 1");
+    fail("bound.name = 'bound'");
+    fail("bound.length = 1");
     // Test that call to non-whitelisted get accessor fails.
     fail("error.stack");
     // Eval is not allowed.
diff --git a/deps/v8/test/debugger/debugger.gyp b/deps/v8/test/debugger/debugger.gyp
deleted file mode 100644
index c093d097173..00000000000
--- a/deps/v8/test/debugger/debugger.gyp
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'debugger_run',
-          'type': 'none',
-          'dependencies': [
-            '../../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../../gypfiles/features.gypi',
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'debugger.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/debugger/debugger.isolate b/deps/v8/test/debugger/debugger.isolate
deleted file mode 100644
index 3843c73b2c6..00000000000
--- a/deps/v8/test/debugger/debugger.isolate
+++ /dev/null
@@ -1,15 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'variables': {
-    'files': [
-      './',
-    ],
-  },
-  'includes': [
-    '../../src/d8.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
diff --git a/deps/v8/test/debugger/regress/regress-1639-2.js b/deps/v8/test/debugger/regress/regress-1639-2.js
index 566e2bb1bfd..be720d21070 100644
--- a/deps/v8/test/debugger/regress/regress-1639-2.js
+++ b/deps/v8/test/debugger/regress/regress-1639-2.js
@@ -27,7 +27,7 @@
 
 // Get the Debug object exposed from the debug context global object.
 Debug = debug.Debug
-var exception = false;
+var exceptionThrown = false;
 var state = 0;
 
 function listener(event, exec_state, event_data, data) {
@@ -57,7 +57,7 @@ function listener(event, exec_state, event_data, data) {
     }
   } catch (e) {
     print(e);
-    exception = true;
+    exceptionThrown = true;
   }
 }
 
@@ -70,4 +70,4 @@ function a() {
 // Set a break point and call to invoke the debug event listener.
 Debug.setBreakPoint(a, 0, 0);
 a();
-assertFalse(exception);
+assertFalse(exceptionThrown);
diff --git a/deps/v8/test/debugger/regress/regress-7421.js b/deps/v8/test/debugger/regress/regress-7421.js
new file mode 100644
index 00000000000..e82cc8a6db5
--- /dev/null
+++ b/deps/v8/test/debugger/regress/regress-7421.js
@@ -0,0 +1,78 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --block-concurrent-recompilation
+
+Debug = debug.Debug
+
+// Test that the side-effect check is not bypassed in optimized code.
+
+var exception = null;
+var counter = 0;
+
+function f1() {
+  counter++;
+}
+
+function wrapper1() {
+  for (var i = 0; i < 4; i++) {
+    // Get this function optimized before calling to increment.
+    // Check that that call performs the necessary side-effect checks.
+    %OptimizeOsr();
+  }
+  f1();
+}
+
+function f2() {
+  counter++;
+}
+
+function wrapper2(call) {
+  if (call) f2();
+}
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    function success(expectation, source) {
+      assertEquals(expectation,
+                   exec_state.frame(0).evaluate(source, true).value());
+    }
+    function fail(source) {
+      assertThrows(() => exec_state.frame(0).evaluate(source, true),
+                   EvalError);
+    }
+    wrapper1();
+    wrapper1();
+    fail("wrapper1()");
+
+    wrapper2(true);
+    wrapper2(false);
+    wrapper2(true);
+    %OptimizeFunctionOnNextCall(wrapper2);
+    wrapper2(false);
+    fail("wrapper2(true)");
+    fail("%OptimizeFunctionOnNextCall(wrapper2); wrapper2(true)");
+
+    %OptimizeFunctionOnNextCall(wrapper2, "concurrent");
+    wrapper2(false);
+    fail("%UnblockConcurrentRecompilation();" +
+         "%GetOptimizationStatus(wrapper2, 'sync');" +
+         "wrapper2(true);");
+  } catch (e) {
+    exception = e;
+    print(e, e.stack);
+  }
+};
+
+// Add the debug event listener.
+Debug.setListener(listener);
+
+function f() {
+  debugger;
+};
+
+f();
+
+assertNull(exception);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-507070.js b/deps/v8/test/debugger/regress/regress-crbug-507070.js
similarity index 92%
rename from deps/v8/test/mjsunit/regress/regress-crbug-507070.js
rename to deps/v8/test/debugger/regress/regress-crbug-507070.js
index 0cb14b27e79..1ca452f5806 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-507070.js
+++ b/deps/v8/test/debugger/regress/regress-crbug-507070.js
@@ -7,7 +7,7 @@
 try { } catch(e) { }
 try { try { } catch (e) { } } catch(e) { }
 try {
-  var Debug = %GetDebugContext().Debug;
+  var Debug = debug.Debug;
   Debug.setListener(function(){});
 } catch(e) { }
 (function() {
diff --git a/deps/v8/test/debugger/regress/regress-crbug-808973.js b/deps/v8/test/debugger/regress/regress-crbug-808973.js
new file mode 100644
index 00000000000..e61cb3b5629
--- /dev/null
+++ b/deps/v8/test/debugger/regress/regress-crbug-808973.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --enable-inspector
+
+const Debug = debug.Debug;
+Debug.setListener(() => {});
+Debug.setBreakOnUncaughtException()
+
+function sleep() {
+  return new Promise(resolve => setTimeout(resolve, 1));
+}
+async function thrower() {
+  await sleep();
+  throw "a"; // Exception a
+}
+(async function() { thrower(); })();
diff --git a/deps/v8/test/debugger/test-api.js b/deps/v8/test/debugger/test-api.js
index 0e9670b2772..f416edbda3b 100644
--- a/deps/v8/test/debugger/test-api.js
+++ b/deps/v8/test/debugger/test-api.js
@@ -67,11 +67,6 @@ class DebugWrapper {
     this.ExceptionBreak = { Caught : 0,
                             Uncaught: 1 };
 
-    // The different script break point types.
-    this.ScriptBreakPointType = { ScriptId: 0,
-                                  ScriptName: 1,
-                                  ScriptRegExp: 2 };
-
     // Store the current script id so we can skip corresponding break events.
     this.thisScriptId = %FunctionGetScriptId(receive);
 
@@ -139,13 +134,6 @@ class DebugWrapper {
     return this.setBreakPointAtLocation(scriptid, loc, opt_condition);
   }
 
-  setScriptBreakPoint(type, scriptid, opt_line, opt_column, opt_condition) {
-    // Only sets by script id are supported for now.
-    assertEquals(this.ScriptBreakPointType.ScriptId, type);
-    return this.setScriptBreakPointById(scriptid, opt_line, opt_column,
-                                        opt_condition);
-  }
-
   setScriptBreakPointById(scriptid, opt_line, opt_column, opt_condition) {
     const loc = %ScriptLocationFromLine2(scriptid, opt_line, opt_column, 0);
     return this.setBreakPointAtLocation(scriptid, loc, opt_condition);
@@ -653,6 +641,12 @@ class DebugWrapper {
         }
         break;
       }
+      case "bigint": {
+        assertEquals("n", obj.unserializableValue.charAt(
+            obj.unserializableValue.length - 1));
+        value = eval(obj.unserializableValue);
+        break;
+      }
       case "string":
       case "boolean": {
         break;
diff --git a/deps/v8/test/debugger/testcfg.py b/deps/v8/test/debugger/testcfg.py
index e287077ec32..da923ff63b0 100644
--- a/deps/v8/test/debugger/testcfg.py
+++ b/deps/v8/test/debugger/testcfg.py
@@ -12,7 +12,7 @@
 MODULE_PATTERN = re.compile(r"^// MODULE$", flags=re.MULTILINE)
 
 class TestSuite(testsuite.TestSuite):
-  def ListTests(self, context):
+  def ListTests(self):
     tests = []
     for dirname, dirs, files in os.walk(self.root):
       for dotted in [x for x in dirs if x.startswith('.')]:
@@ -62,21 +62,21 @@ def _parse_source_files(self, source):
     files.append(os.path.join(self.suite.root, self.path + self._get_suffix()))
     return files
 
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     files = self._source_files
-    if ctx.isolates:
+    if self._test_config.isolates:
       files = files + ['--isolate'] + files
     return files
 
   def _get_source_flags(self):
     return self._source_flags
 
-  def _get_suite_flags(self, ctx):
+  def _get_suite_flags(self):
     return ['--enable-inspector', '--allow-natives-syntax']
 
   def _get_source_path(self):
     return os.path.join(self.suite.root, self.path + self._get_suffix())
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/default.gyp b/deps/v8/test/default.gyp
deleted file mode 100644
index d1007b8a960..00000000000
--- a/deps/v8/test/default.gyp
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'default_run',
-          'type': 'none',
-          'dependencies': [
-            'cctest/cctest.gyp:cctest_run',
-            'debugger/debugger.gyp:debugger_run',
-            'fuzzer/fuzzer.gyp:fuzzer_run',
-            'inspector/inspector.gyp:inspector-test_run',
-            'intl/intl.gyp:intl_run',
-            'message/message.gyp:message_run',
-            'mjsunit/mjsunit.gyp:mjsunit_run',
-            'preparser/preparser.gyp:preparser_run',
-            'unittests/unittests.gyp:unittests_run',
-            'wasm-spec-tests/wasm-spec-tests.gyp:wasm_spec_tests_run',
-          ],
-          'includes': [
-            '../gypfiles/features.gypi',
-            '../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'default.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/default.isolate b/deps/v8/test/default.isolate
deleted file mode 100644
index e9104631d65..00000000000
--- a/deps/v8/test/default.isolate
+++ /dev/null
@@ -1,23 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'command': [
-      '../tools/run-tests.py',
-    ],
-  },
-  'includes': [
-    'cctest/cctest.isolate',
-    'debugger/debugger.isolate',
-    'fuzzer/fuzzer.isolate',
-    'inspector/inspector.isolate'
-    'intl/intl.isolate',
-    'message/message.isolate',
-    'mjsunit/mjsunit.isolate',
-    'mkgrokdump/mkgrokdump.isolate',
-    'preparser/preparser.isolate',
-    'unittests/unittests.isolate',
-    'wasm-spec-tests/wasm-spec-tests.isolate',
-  ],
-}
diff --git a/deps/v8/test/fuzzer/BUILD.gn b/deps/v8/test/fuzzer/BUILD.gn
new file mode 100644
index 00000000000..d72cb77a644
--- /dev/null
+++ b/deps/v8/test/fuzzer/BUILD.gn
@@ -0,0 +1,33 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+group("v8_fuzzer") {
+  testonly = true
+
+  data_deps = [
+    "../../tools:v8_testrunner",
+    "../..:v8_fuzzers",
+  ]
+
+  data = [
+    "./fuzzer.status",
+    "./testcfg.py",
+    "./json/",
+    "./parser/",
+    "./regexp/",
+    "./regexp_builtins/",
+    "./multi_return/",
+    "./wasm/",
+    "./wasm_async/",
+    "./wasm_code/",
+    "./wasm_compile/",
+    "./wasm_data_section/",
+    "./wasm_function_sigs_section/",
+    "./wasm_globals_section/",
+    "./wasm_imports_section/",
+    "./wasm_memory_section/",
+    "./wasm_names_section/",
+    "./wasm_types_section/",
+  ]
+}
\ No newline at end of file
diff --git a/deps/v8/test/fuzzer/README.md b/deps/v8/test/fuzzer/README.md
index 5f10d47ec4c..c4fd22a9e75 100644
--- a/deps/v8/test/fuzzer/README.md
+++ b/deps/v8/test/fuzzer/README.md
@@ -45,18 +45,10 @@ the fuzzer is called `foo`.
    * Use this binary to reproduce issues found by cluster fuzz, e.g.
      `out/x64.debug/v8_simple_foo_fuzzer testcase.foo`
 
-5. Copy the build rules of an existing fuzzer in
-   [test/fuzzer/fuzzer.gyp](https://cs.chromium.org/chromium/src/v8/test/fuzzer/fuzzer.gyp),
-   e.g. the build rules for the
-   [wasm.cc](https://cs.chromium.org/chromium/src/v8/test/fuzzer/wasm.cc) fuzzer
-   are `v8_simple_wasm_fuzzer` and `wasm_fuzzer_lib`
-
-   * This build rule is needed to compile with gyp
-
-6. Copy the binary name and the test directory name in
+5. Copy the binary name and the test directory name in
    [test/fuzzer/fuzzer.isolate](https://cs.chromium.org/chromium/src/v8/test/fuzzer/fuzzer.isolate)
 
-7. Add the fuzzer to the FuzzerTestSuite in
+6. Add the fuzzer to the FuzzerTestSuite in
    [test/fuzzer/testcfg.py](https://cs.chromium.org/chromium/src/v8/test/fuzzer/testcfg.py)
 
    * This step is needed to run the fuzzer with the files created in Step 2 on
diff --git a/deps/v8/test/fuzzer/fuzzer-support.cc b/deps/v8/test/fuzzer/fuzzer-support.cc
index d6cff118bf7..43d21ea59e7 100644
--- a/deps/v8/test/fuzzer/fuzzer-support.cc
+++ b/deps/v8/test/fuzzer/fuzzer-support.cc
@@ -33,8 +33,6 @@ FuzzerSupport::FuzzerSupport(int* argc, char*** argv) {
     v8::HandleScope handle_scope(isolate_);
     context_.Reset(isolate_, v8::Context::New(isolate_));
   }
-
-  v8::platform::EnsureEventLoopInitialized(platform_.get(), isolate_);
 }
 
 FuzzerSupport::~FuzzerSupport() {
diff --git a/deps/v8/test/fuzzer/fuzzer.isolate b/deps/v8/test/fuzzer/fuzzer.isolate
deleted file mode 100644
index 9391dcc7c06..00000000000
--- a/deps/v8/test/fuzzer/fuzzer.isolate
+++ /dev/null
@@ -1,48 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'variables': {
-    'files': [
-      '<(PRODUCT_DIR)/v8_simple_json_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_parser_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_regexp_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_multi_return_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_wasm_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_wasm_async_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_wasm_call_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_wasm_code_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_wasm_compile_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_wasm_data_section_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_wasm_function_sigs_section_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_wasm_globals_section_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_wasm_imports_section_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_wasm_memory_section_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_wasm_names_section_fuzzer<(EXECUTABLE_SUFFIX)',
-      '<(PRODUCT_DIR)/v8_simple_wasm_types_section_fuzzer<(EXECUTABLE_SUFFIX)',
-      './fuzzer.status',
-      './testcfg.py',
-      './json/',
-      './parser/',
-      './regexp/',
-      './multi_return/',
-      './wasm/',
-      './wasm_async/',
-      './wasm_call/',
-      './wasm_code/',
-      './wasm_compile/',
-      './wasm_data_section/',
-      './wasm_function_sigs_section/',
-      './wasm_globals_section/',
-      './wasm_imports_section/',
-      './wasm_memory_section/',
-      './wasm_names_section/',
-      './wasm_types_section/',
-    ],
-  },
-  'includes': [
-    '../../src/base.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
diff --git a/deps/v8/test/fuzzer/multi-return.cc b/deps/v8/test/fuzzer/multi-return.cc
index 47667740057..53a5dfe75bc 100644
--- a/deps/v8/test/fuzzer/multi-return.cc
+++ b/deps/v8/test/fuzzer/multi-return.cc
@@ -13,10 +13,16 @@
 #include "src/compiler/operator.h"
 #include "src/compiler/pipeline.h"
 #include "src/compiler/raw-machine-assembler.h"
+#include "src/compiler/wasm-compiler.h"
 #include "src/machine-type.h"
 #include "src/objects-inl.h"
 #include "src/objects.h"
 #include "src/simulator.h"
+#include "src/wasm/wasm-engine.h"
+#include "src/wasm/wasm-limits.h"
+#include "src/wasm/wasm-objects-inl.h"
+#include "src/wasm/wasm-objects.h"
+#include "src/wasm/wasm-opcodes.h"
 #include "src/zone/accounting-allocator.h"
 #include "src/zone/zone.h"
 #include "test/fuzzer/fuzzer-support.h"
@@ -90,49 +96,8 @@ int num_registers(MachineType type) {
   }
 }
 
-int size(MachineType type) {
-  return 1 << ElementSizeLog2Of(type.representation());
-}
-
 int index(MachineType type) { return static_cast<int>(type.representation()); }
 
-const int* codes(MachineType type) {
-  const RegisterConfiguration* config = RegisterConfiguration::Default();
-  switch (type.representation()) {
-    case MachineRepresentation::kWord32:
-    case MachineRepresentation::kWord64:
-      return config->allocatable_general_codes();
-    case MachineRepresentation::kFloat32:
-      return config->allocatable_float_codes();
-    case MachineRepresentation::kFloat64:
-      return config->allocatable_double_codes();
-    default:
-      UNREACHABLE();
-  }
-}
-
-LinkageLocation AllocateLocation(MachineType type, int* int_count,
-                                 int* float_count, int* stack_slots) {
-  int* count = IsFloatingPoint(type.representation()) ? float_count : int_count;
-  int reg_code = *count;
-#if V8_TARGET_ARCH_ARM
-  // Allocate floats using a double register, but modify the code to
-  // reflect how ARM FP registers alias.
-  if (type == MachineType::Float32()) {
-    reg_code *= 2;
-  }
-#endif
-  LinkageLocation location = LinkageLocation::ForAnyRegister();  // Dummy.
-  if (reg_code < num_registers(type)) {
-    location = LinkageLocation::ForRegister(codes(type)[reg_code], type);
-  } else {
-    location = LinkageLocation::ForCallerFrameSlot(-*stack_slots - 1, type);
-    *stack_slots += std::max(1, size(type) / kPointerSize);
-  }
-  ++*count;
-  return location;
-}
-
 Node* Constant(RawMachineAssembler& m, MachineType type, int value) {
   switch (type.representation()) {
     case MachineRepresentation::kWord32:
@@ -166,51 +131,31 @@ Node* ToInt32(RawMachineAssembler& m, MachineType type, Node* a) {
 CallDescriptor* CreateRandomCallDescriptor(Zone* zone, size_t return_count,
                                            size_t param_count,
                                            InputProvider* input) {
-  LocationSignature::Builder locations(zone, return_count, param_count);
-
-  int stack_slots = 0;
-  int int_params = 0;
-  int float_params = 0;
+  wasm::FunctionSig::Builder builder(zone, return_count, param_count);
   for (size_t i = 0; i < param_count; i++) {
     MachineType type = RandomType(input);
-    LinkageLocation location =
-        AllocateLocation(type, &int_params, &float_params, &stack_slots);
-    locations.AddParam(location);
+    builder.AddParam(type.representation());
   }
   // Read the end byte of the parameters.
   input->NextInt8(1);
 
-  int stack_params = stack_slots;
-#if V8_TARGET_ARCH_ARM64
-  // Align the stack slots.
-  stack_slots = stack_slots + (stack_slots % 2);
-#endif
-  int aligned_stack_params = stack_slots;
-  int int_returns = 0;
-  int float_returns = 0;
   for (size_t i = 0; i < return_count; i++) {
     MachineType type = RandomType(input);
-    LinkageLocation location =
-        AllocateLocation(type, &int_returns, &float_returns, &stack_slots);
-    locations.AddReturn(location);
+    builder.AddReturn(type.representation());
   }
-  int stack_returns = stack_slots - aligned_stack_params;
-
-  MachineType target_type = MachineType::AnyTagged();
-  LinkageLocation target_loc = LinkageLocation::ForAnyRegister(target_type);
-  return new (zone) CallDescriptor(       // --
-      CallDescriptor::kCallCodeObject,    // kind
-      target_type,                        // target MachineType
-      target_loc,                         // target location
-      locations.Build(),                  // location_sig
-      stack_params,                       // on-stack parameter count
-      compiler::Operator::kNoProperties,  // properties
-      0,                                  // callee-saved registers
-      0,                                  // callee-saved fp regs
-      CallDescriptor::kNoFlags,           // flags
-      "c-call",                           // debug name
-      0,                                  // allocatable registers
-      stack_returns);                     // on-stack return count
+
+  return compiler::GetWasmCallDescriptor(zone, builder.Build());
+}
+
+std::unique_ptr<wasm::NativeModule> AllocateNativeModule(i::Isolate* isolate,
+                                                         size_t code_size) {
+  // We have to add the code object to a NativeModule, because the
+  // WasmCallDescriptor assumes that code is on the native heap and not
+  // within a code object.
+  std::unique_ptr<wasm::NativeModule> module =
+      isolate->wasm_engine()->code_manager()->NewNativeModule(code_size, 1, 0,
+                                                              false);
+  return module;
 }
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
@@ -227,16 +172,21 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   InputProvider input(data, size);
   // Create randomized descriptor.
   size_t param_count = input.NumNonZeroBytes(0, kNumTypes);
+  if (param_count > Code::kMaxArguments) return 0;
+
   size_t return_count = input.NumNonZeroBytes(param_count + 1, kNumTypes);
+  if (return_count > wasm::kV8MaxWasmFunctionMultiReturns) return 0;
+
   CallDescriptor* desc =
       CreateRandomCallDescriptor(&zone, return_count, param_count, &input);
 
   if (FLAG_wasm_fuzzer_gen_test) {
     // Print some debugging output which describes the produced signature.
     printf("[");
-    for (size_t j = 0; j < desc->ParameterCount(); ++j) {
-      printf(" %s",
-             MachineReprToString(desc->GetParameterType(j).representation()));
+    for (size_t j = 0; j < param_count; ++j) {
+      // Parameter 0 is the WasmContext.
+      printf(" %s", MachineReprToString(
+                        desc->GetParameterType(j + 1).representation()));
     }
     printf(" ] -> [");
     for (size_t j = 0; j < desc->ReturnCount(); ++j) {
@@ -253,14 +203,15 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   // Trivial hash table for the number of occurrences of parameter types. The
   // MachineRepresentation of the parameter types is used as hash code.
   int counts[kNumMachineRepresentations] = {0};
-  for (size_t i = 0; i < desc->ParameterCount(); ++i) {
-    ++counts[index(desc->GetParameterType(i))];
+  for (size_t i = 0; i < param_count; ++i) {
+    // Parameter 0 is the WasmContext.
+    ++counts[index(desc->GetParameterType(i + 1))];
   }
 
   // Generate random inputs.
-  std::unique_ptr<int[]> inputs(new int[desc->ParameterCount()]);
+  std::unique_ptr<int[]> inputs(new int[param_count]);
   std::unique_ptr<int[]> outputs(new int[desc->ReturnCount()]);
-  for (size_t i = 0; i < desc->ParameterCount(); ++i) {
+  for (size_t i = 0; i < param_count; ++i) {
     inputs[i] = input.NextInt32(10000);
   }
 
@@ -270,11 +221,15 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
       InstructionSelector::SupportedMachineOperatorFlags());
 
   // Generate callee, returning random picks of its parameters.
-  std::unique_ptr<Node* []> params(new Node*[desc->ParameterCount() + 1]);
-  std::unique_ptr<Node* []> returns(new Node*[desc->ReturnCount()]);
-  for (size_t i = 0; i < desc->ParameterCount(); ++i) {
-    params[i] = callee.Parameter(i);
+  std::unique_ptr<Node* []> params(new Node*[desc->ParameterCount() + 2]);
+  // The first input of a return is the number of stack slots that should be
+  // popped before returning.
+  std::unique_ptr<Node* []> returns(new Node*[desc->ReturnCount() + 1]);
+  for (size_t i = 0; i < param_count; ++i) {
+    // Parameter(0) is the WasmContext.
+    params[i] = callee.Parameter(i + 1);
   }
+
   for (size_t i = 0; i < desc->ReturnCount(); ++i) {
     MachineType type = desc->GetReturnType(i);
     // Find a random same-type parameter to return. Use a constant if none.
@@ -282,9 +237,10 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
       returns[i] = Constant(callee, type, 42);
       outputs[i] = 42;
     } else {
-      int n = input.NextInt8(counts[index(type)]);
+      int n = input.NextInt32(counts[index(type)]);
       int k = 0;
-      while (desc->GetParameterType(k) != desc->GetReturnType(i) || --n > 0) {
+      while (desc->GetParameterType(k + 1) != desc->GetReturnType(i) ||
+             --n > 0) {
         ++k;
       }
       returns[i] = params[k];
@@ -297,6 +253,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   Handle<Code> code = Pipeline::GenerateCodeForTesting(
       &info, i_isolate, desc, callee.graph(), callee.Export());
 
+  std::unique_ptr<wasm::NativeModule> module =
+      AllocateNativeModule(i_isolate, code->instruction_size());
+  byte* code_start = module->AddCodeCopy(code, wasm::WasmCode::kFunction, 0)
+                         ->instructions()
+                         .start();
   // Generate wrapper.
   int expect = 0;
 
@@ -310,13 +271,14 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
       MachineType::PointerRepresentation(),
       InstructionSelector::SupportedMachineOperatorFlags());
 
-  params[0] = caller.HeapConstant(code);
-  for (size_t i = 0; i < desc->ParameterCount(); ++i) {
-    params[i + 1] = Constant(caller, desc->GetParameterType(i), inputs[i]);
+  params[0] = caller.PointerConstant(code_start);
+  // WasmContext dummy.
+  params[1] = caller.PointerConstant(nullptr);
+  for (size_t i = 0; i < param_count; ++i) {
+    params[i + 2] = Constant(caller, desc->GetParameterType(i + 1), inputs[i]);
   }
   Node* call = caller.AddNode(caller.common()->Call(desc),
-                              static_cast<int>(desc->ParameterCount() + 1),
-                              params.get());
+                              static_cast<int>(param_count + 2), params.get());
   Node* ret = Constant(caller, MachineType::Int32(), 0);
   for (size_t i = 0; i < desc->ReturnCount(); ++i) {
     // Skip roughly one third of the outputs.
diff --git a/deps/v8/test/fuzzer/regexp-builtins.cc b/deps/v8/test/fuzzer/regexp-builtins.cc
new file mode 100644
index 00000000000..cc02958f2a7
--- /dev/null
+++ b/deps/v8/test/fuzzer/regexp-builtins.cc
@@ -0,0 +1,448 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <limits.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#include <functional>
+#include <string>
+
+#include "include/v8.h"
+#include "src/factory.h"
+#include "src/objects-inl.h"
+#include "src/objects.h"
+#include "src/regexp/jsregexp.h"
+#include "test/fuzzer/fuzzer-support.h"
+
+// This is a hexdump of test/fuzzer/regexp_builtins/mjsunit.js generated using
+// `xxd -i mjsunit.js`. It contains the `assertEquals` JS function used below.
+#include "test/fuzzer/regexp_builtins/mjsunit.js.h"
+
+namespace v8 {
+namespace internal {
+namespace {
+
+constexpr bool kVerbose = false;  // For debugging, verbose error messages.
+constexpr uint32_t kRegExpBuiltinsFuzzerHashSeed = 83;
+
+#define REGEXP_BUILTINS(V)   \
+  V(Exec, exec)              \
+  V(Match, Symbol.match)     \
+  V(Replace, Symbol.replace) \
+  V(Search, Symbol.search)   \
+  V(Split, Symbol.split)     \
+  V(Test, test)
+
+struct FuzzerArgs {
+  FuzzerArgs(const uint8_t* input_data, size_t input_length,
+             v8::Local<v8::Context> context, Isolate* isolate)
+      : input_cursor(0),
+        input_data(input_data),
+        input_length(input_length),
+        context(context),
+        isolate(isolate) {}
+
+  size_t input_cursor;
+  const uint8_t* const input_data;
+  const size_t input_length;
+  v8::Local<v8::Context> context;
+  Isolate* const isolate;
+};
+
+enum RegExpBuiltin {
+#define CASE(name, ...) kRegExpPrototype##name,
+  REGEXP_BUILTINS(CASE)
+#undef CASE
+      kRegExpBuiltinCount,
+};
+
+#define CASE(name, ...) void TestRegExpPrototype##name(FuzzerArgs* args);
+REGEXP_BUILTINS(CASE)
+#undef CASE
+
+v8::Local<v8::String> v8_str(const char* s) {
+  return v8::String::NewFromUtf8(v8::Isolate::GetCurrent(), s,
+                                 v8::NewStringType::kNormal)
+      .ToLocalChecked();
+}
+
+v8::MaybeLocal<v8::Value> CompileRun(v8::Local<v8::Context> context,
+                                     const char* source) {
+  v8::Local<v8::Script> script;
+  v8::MaybeLocal<v8::Script> maybe_script =
+      v8::Script::Compile(context, v8_str(source));
+
+  if (!maybe_script.ToLocal(&script)) return v8::MaybeLocal<v8::Value>();
+  return script->Run(context);
+}
+
+uint8_t RandomByte(FuzzerArgs* args) {
+  // Silently wraps to the beginning of input data. Ideally, input data should
+  // be long enough to avoid that.
+  const size_t index = args->input_cursor;
+  CHECK(index < args->input_length);
+  args->input_cursor = (index + 1) % args->input_length;
+  return args->input_data[index];
+}
+
+void CompileMjsunit(const FuzzerArgs* args) {
+  std::string source(
+      reinterpret_cast<const char*>(test_fuzzer_regexp_builtins_mjsunit_js),
+      test_fuzzer_regexp_builtins_mjsunit_js_len);
+  CompileRun(args->context, source.c_str()).ToLocalChecked();
+}
+
+std::string NaiveEscape(const std::string& input, char escaped_char) {
+  std::string out;
+  for (size_t i = 0; i < input.size(); i++) {
+    // Just omit newlines and \0 chars and naively replace other escaped chars.
+    const char c = input[i];
+    if (c == '\r' || c == '\n' || c == '\0') continue;
+    out += (input[i] == escaped_char) ? '_' : c;
+  }
+  // Disallow trailing backslashes as they mess with our naive source string
+  // concatenation.
+  if (out.back() == '\\') out.back() = '_';
+
+  return out;
+}
+
+std::string GenerateRandomString(FuzzerArgs* args, size_t length) {
+  // Limited to an ASCII subset for now.
+  std::string s(length, '\0');
+  for (size_t i = 0; i < length; i++) {
+    s[i] = static_cast<char>((RandomByte(args) % 0x5F) + 0x20);
+  }
+
+  return s;
+}
+
+std::string GenerateRandomPattern(FuzzerArgs* args) {
+  const int kMaxPatternLength = 16;
+  std::string s =
+      GenerateRandomString(args, (RandomByte(args) % kMaxPatternLength) + 1);
+  // A leading '*' would be a comment instead of a regexp literal.
+  if (s[0] == '*') s[0] = '.';
+  return s;
+}
+
+std::string PickRandomPresetPattern(FuzzerArgs* args) {
+  static const char* preset_patterns[] = {
+      ".",         // Always matches.
+      "\\P{Any}",  // Never matches.
+      "^",         // Zero-width assertion, matches once.
+      "(?=.)",     // Zero-width assertion, matches at every position.
+      "\\b",       // Zero-width assertion, matches at each word boundary.
+      "()",      // Zero-width assertion, matches at every position with groups.
+      "(?<a>)",  // Likewise but with named groups.
+      "((((.).).).)", "(?<a>(?<b>(?<c>(?<d>.).).).)",
+      // Copied from
+      // https://cs.chromium.org/chromium/src/testing/libfuzzer/fuzzers/dicts/regexp.dict
+      "?", "abc", "()", "[]", "abc|def", "abc|def|ghi", "^xxx$",
+      "ab\\b\\d\\bcd", "\\w|\\d", "a*?", "abc+", "abc+?", "xyz?", "xyz??",
+      "xyz{0,1}", "xyz{0,1}?", "xyz{93}", "xyz{1,32}", "xyz{1,32}?", "xyz{1,}",
+      "xyz{1,}?", "a\\fb\\nc\\rd\\te\\vf", "a\\nb\\bc", "(?:foo)", "(?: foo )",
+      "foo|(bar|baz)|quux", "foo(?=bar)baz", "foo(?!bar)baz", "foo(?<=bar)baz",
+      "foo(?<!bar)baz", "()", "(?=)", "[]", "[x]", "[xyz]", "[a-zA-Z0-9]",
+      "[-123]", "[^123]", "]", "}", "[a-b-c]", "[x\\dz]", "[\\d-z]",
+      "[\\d-\\d]", "[z-\\d]", "\\cj\\cJ\\ci\\cI\\ck\\cK", "\\c!", "\\c_",
+      "\\c~", "[\\c!]", "[\\c_]", "[\\c~]", "[\\ca]", "[\\cz]", "[\\cA]",
+      "[\\cZ]", "[\\c1]", "\\[\\]\\{\\}\\(\\)\\%\\^\\#\\ ",
+      "[\\[\\]\\{\\}\\(\\)\\%\\^\\#\\ ]", "\\8", "\\9", "\\11", "\\11a",
+      "\\011", "\\118", "\\111", "\\1111", "(x)(x)(x)\\1", "(x)(x)(x)\\2",
+      "(x)(x)(x)\\3", "(x)(x)(x)\\4", "(x)(x)(x)\\1*", "(x)(x)(x)\\3*",
+      "(x)(x)(x)\\4*", "(x)(x)(x)(x)(x)(x)(x)(x)(x)(x)\\10",
+      "(x)(x)(x)(x)(x)(x)(x)(x)(x)(x)\\11", "(a)\\1", "(a\\1)", "(\\1a)",
+      "(\\2)(\\1)", "(?=a){0,10}a", "(?=a){1,10}a", "(?=a){9,10}a", "(?!a)?a",
+      "\\1(a)", "(?!(a))\\1", "(?!\\1(a\\1)\\1)\\1",
+      "\\1\\2(a(?:\\1(b\\1\\2))\\2)\\1", "[\\0]", "[\\11]", "[\\11a]",
+      "[\\011]", "[\\00011]", "[\\118]", "[\\111]", "[\\1111]", "\\x60",
+      "\\x3z", "\\c", "\\u0034", "\\u003z", "foo[z]*", "\\u{12345}",
+      "\\u{12345}\\u{23456}", "\\u{12345}{3}", "\\u{12345}*", "\\ud808\\udf45*",
+      "[\\ud808\\udf45-\\ud809\\udccc]", "a", "a|b", "a\\n", "a$", "a\\b!",
+      "a\\Bb", "a*?", "a?", "a??", "a{0,1}?", "a{1,2}?", "a+?", "(a)", "(a)\\1",
+      "(\\1a)", "\\1(a)", "a\\s", "a\\S", "a\\D", "a\\w", "a\\W", "a.", "a\\q",
+      "a[a]", "a[^a]", "a[a-z]", "a(?:b)", "a(?=b)", "a(?!b)", "\\x60",
+      "\\u0060", "\\cA", "\\q", "\\1112", "(a)\\1", "(?!a)?a\\1",
+      "(?:(?=a))a\\1", "a{}", "a{,}", "a{", "a{z}", "a{12z}", "a{12,",
+      "a{12,3b", "{}", "{,}", "{", "{z}", "{1z}", "{12,", "{12,3b", "a", "abc",
+      "a[bc]d", "a|bc", "ab|c", "a||bc", "(?:ab)", "(?:ab|cde)", "(?:ab)|cde",
+      "(ab)", "(ab|cde)", "(ab)\\1", "(ab|cde)\\1", "(?:ab)?", "(?:ab)+", "a?",
+      "a+", "a??", "a*?", "a+?", "(?:a?)?", "(?:a+)?", "(?:a?)+", "(?:a*)+",
+      "(?:a+)+", "(?:a?)*", "(?:a*)*", "(?:a+)*", "a{0}", "(?:a+){0,0}", "a*b",
+      "a+b", "a*b|c", "a+b|c", "(?:a{5,1000000}){3,1000000}", "(?:ab){4,7}",
+      "a\\bc", "a\\sc", "a\\Sc", "a(?=b)c", "a(?=bbb|bb)c", "a(?!bbb|bb)c",
+      "\xe2\x81\xa3", "[\xe2\x81\xa3]", "\xed\xb0\x80", "\xed\xa0\x80",
+      "(\xed\xb0\x80)\x01", "((\xed\xa0\x80))\x02", "\xf0\x9f\x92\xa9", "\x01",
+      "\x0f", "[-\xf0\x9f\x92\xa9]+", "[\xf0\x9f\x92\xa9-\xf4\x8f\xbf\xbf]",
+      "(?<=)", "(?<=a)", "(?<!)", "(?<!a)", "(?<a>)", "(?<a>.)",
+      "(?<a>.)\\k<a>", "\\p{Script=Greek}", "\\P{sc=Greek}",
+      "\\p{Script_Extensions=Greek}", "\\P{scx=Greek}",
+      "\\p{General_Category=Decimal_Number}", "\\P{gc=Decimal_Number}",
+      "\\p{gc=Nd}", "\\P{Decimal_Number}", "\\p{Nd}", "\\P{Any}",
+      "\\p{Changes_When_NFKC_Casefolded}",
+  };
+  static constexpr int preset_pattern_count = arraysize(preset_patterns);
+  STATIC_ASSERT(preset_pattern_count < 0xFF);
+
+  return std::string(preset_patterns[RandomByte(args) % preset_pattern_count]);
+}
+
+std::string PickPattern(FuzzerArgs* args) {
+  if ((RandomByte(args) & 3) == 0) {
+    return NaiveEscape(GenerateRandomPattern(args), '/');
+  } else {
+    return PickRandomPresetPattern(args);
+  }
+}
+
+std::string GenerateRandomString(FuzzerArgs* args) {
+  const int kMaxStringLength = 64;
+  return GenerateRandomString(args, RandomByte(args) % kMaxStringLength);
+}
+
+std::string PickSubjectString(FuzzerArgs* args) {
+  if ((RandomByte(args) & 0xF) == 0) {
+    // Sometimes we have a two-byte subject string.
+    return "f\\uD83D\\uDCA9ba\\u2603";
+  } else {
+    return NaiveEscape(GenerateRandomString(args), '\'');
+  }
+}
+
+std::string PickReplacementForReplace(FuzzerArgs* args) {
+  static const char* candidates[] = {
+      "'X'",
+      "'$1$2$3'",
+      "'$$$&$`$\\'$1'",
+      "() => 'X'",
+      "(arg0, arg1, arg2, arg3, arg4) => arg0 + arg1 + arg2 + arg3 + arg4",
+      "() => 42",
+  };
+  static const int candidate_count = arraysize(candidates);
+
+  if ((RandomByte(args) & 1) == 0) {
+    return candidates[RandomByte(args) % candidate_count];
+  } else {
+    return std::string("'") + NaiveEscape(GenerateRandomString(args), '\'') +
+           std::string("'");
+  }
+}
+
+std::string PickLimitForSplit(FuzzerArgs* args) {
+  // clang-format off
+  switch (RandomByte(args) & 0x3) {
+  case 0: return "undefined";
+  case 1: return "'not a number'";
+  case 2: return std::to_string(Smi::kMaxValue + RandomByte(args));
+  case 3: return std::to_string(RandomByte(args));
+  default: UNREACHABLE();
+  }  // clang-format on
+}
+
+std::string GenerateRandomFlags(FuzzerArgs* args) {
+  constexpr size_t kFlagCount = JSRegExp::FlagCount();
+  CHECK_EQ(JSRegExp::kDotAll, 1 << (kFlagCount - 1));
+  STATIC_ASSERT((1 << kFlagCount) - 1 < 0xFF);
+
+  const size_t flags = RandomByte(args) & ((1 << kFlagCount) - 1);
+
+  int cursor = 0;
+  char buffer[kFlagCount] = {'\0'};
+
+  if (flags & JSRegExp::kGlobal) buffer[cursor++] = 'g';
+  if (flags & JSRegExp::kIgnoreCase) buffer[cursor++] = 'i';
+  if (flags & JSRegExp::kMultiline) buffer[cursor++] = 'm';
+  if (flags & JSRegExp::kSticky) buffer[cursor++] = 'y';
+  if (flags & JSRegExp::kUnicode) buffer[cursor++] = 'u';
+  if (flags & JSRegExp::kDotAll) buffer[cursor++] = 's';
+
+  return std::string(buffer, cursor);
+}
+
+std::string GenerateRandomLastIndex(FuzzerArgs* args) {
+  static const char* candidates[] = {
+      "undefined",  "-1",         "0",
+      "1",          "2",          "3",
+      "4",          "5",          "6",
+      "7",          "8",          "9",
+      "50",         "4294967296", "2147483647",
+      "2147483648", "NaN",        "Not a Number",
+  };
+  static const int candidate_count = arraysize(candidates);
+  return candidates[RandomByte(args) % candidate_count];
+}
+
+void RunTest(FuzzerArgs* args) {
+  switch (RandomByte(args) % kRegExpBuiltinCount) {
+#define CASE(name, ...)              \
+  case kRegExpPrototype##name:       \
+    TestRegExpPrototype##name(args); \
+    break;
+    REGEXP_BUILTINS(CASE)
+#undef CASE
+    default:
+      UNREACHABLE();
+  }
+}
+
+std::string GenerateSourceString(FuzzerArgs* args, const std::string& test) {
+  std::string pattern = PickPattern(args);
+  std::string flags = GenerateRandomFlags(args);
+  std::string last_index = GenerateRandomLastIndex(args);
+  std::string subject = PickSubjectString(args);
+
+  // clang-format off
+  std::stringstream ss;
+  ss << "function test() {\n"
+     << "  const re = /" << pattern<< "/"
+                         << flags << ";\n"
+     << "  re.lastIndex = " << last_index << ";\n"
+     << "  const str = '" << subject << "';\n"
+     << "  let result = null;\n"
+     << "  let exception = null;\n"
+     << "  try {\n"
+     << "    result = " << test << "\n"
+     << "  } catch (e) {\n"
+     << "    exception = e;\n"
+     << "  }\n"
+     << "  return { result: result, re: re, exception: exception };\n"
+     << "}\n"
+     << "%SetForceSlowPath(false);\n"
+     << "test();  // Run once ahead of time to compile the regexp.\n"
+     << "const fast = test();\n"
+     << "%SetForceSlowPath(true);\n"
+     << "const slow = test();\n"
+     << "%SetForceSlowPath(false);\n";
+  // clang-format on
+  return ss.str();
+}
+
+void PrintExceptionMessage(v8::TryCatch* try_catch) {
+  CHECK(try_catch->HasCaught());
+  static const int kBufferLength = 256;
+  char buffer[kBufferLength + 1];
+  try_catch->Message()->Get()->WriteOneByte(
+      reinterpret_cast<uint8_t*>(&buffer[0]), 0, kBufferLength);
+  fprintf(stderr, "%s\n", buffer);
+}
+
+bool ResultsAreIdentical(FuzzerArgs* args) {
+  std::string source =
+      "assertEquals(fast.exception, slow.exception);\n"
+      "assertEquals(fast.result, slow.result);\n"
+      "if (fast.result !== null)\n"
+      "  assertEquals(fast.result.groups, slow.result.groups);\n"
+      "assertEquals(fast.re.lastIndex, slow.re.lastIndex);\n";
+
+  v8::Local<v8::Value> result;
+  v8::TryCatch try_catch(reinterpret_cast<v8::Isolate*>(args->isolate));
+  if (!CompileRun(args->context, source.c_str()).ToLocal(&result)) {
+    PrintExceptionMessage(&try_catch);
+    args->isolate->clear_pending_exception();
+    return false;
+  }
+
+  return true;
+}
+
+void CompileRunAndVerify(FuzzerArgs* args, const std::string& source) {
+  v8::Local<v8::Value> result;
+  v8::TryCatch try_catch(reinterpret_cast<v8::Isolate*>(args->isolate));
+  if (!CompileRun(args->context, source.c_str()).ToLocal(&result)) {
+    args->isolate->clear_pending_exception();
+    // No need to verify result if an exception was thrown here, since that
+    // implies a syntax error somewhere in the pattern or string. We simply
+    // ignore those.
+    if (kVerbose) {
+      PrintExceptionMessage(&try_catch);
+      fprintf(stderr, "Failed to run script:\n```\n%s\n```\n", source.c_str());
+    }
+    return;
+  }
+
+  if (!ResultsAreIdentical(args)) {
+    uint32_t hash = StringHasher::HashSequentialString(
+        args->input_data, static_cast<int>(args->input_length),
+        kRegExpBuiltinsFuzzerHashSeed);
+    V8_Fatal(__FILE__, __LINE__,
+             "!ResultAreIdentical(args); RegExpBuiltinsFuzzerHash=%x", hash);
+  }
+}
+
+void TestRegExpPrototypeExec(FuzzerArgs* args) {
+  std::string test = "re.exec(str);";
+  std::string source = GenerateSourceString(args, test);
+  CompileRunAndVerify(args, source);
+}
+
+void TestRegExpPrototypeMatch(FuzzerArgs* args) {
+  std::string test = "re[Symbol.match](str);";
+  std::string source = GenerateSourceString(args, test);
+  CompileRunAndVerify(args, source);
+}
+
+void TestRegExpPrototypeReplace(FuzzerArgs* args) {
+  std::string replacement = PickReplacementForReplace(args);
+  std::string test = "re[Symbol.replace](str, " + replacement + ");";
+  std::string source = GenerateSourceString(args, test);
+  CompileRunAndVerify(args, source);
+}
+
+void TestRegExpPrototypeSearch(FuzzerArgs* args) {
+  std::string test = "re[Symbol.search](str);";
+  std::string source = GenerateSourceString(args, test);
+  CompileRunAndVerify(args, source);
+}
+
+void TestRegExpPrototypeSplit(FuzzerArgs* args) {
+  std::string limit = PickLimitForSplit(args);
+  std::string test = "re[Symbol.split](str, " + limit + ");";
+  std::string source = GenerateSourceString(args, test);
+  CompileRunAndVerify(args, source);
+}
+
+void TestRegExpPrototypeTest(FuzzerArgs* args) {
+  std::string test = "re.test(str);";
+  std::string source = GenerateSourceString(args, test);
+  CompileRunAndVerify(args, source);
+}
+
+#undef REGEXP_BUILTINS
+
+}  // namespace
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  if (size < 64) return 0;  // Need a minimal amount of randomness to do stuff.
+
+  // Flag definitions.
+
+  FLAG_allow_natives_syntax = true;
+
+  // V8 setup.
+
+  v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
+  v8::Isolate* isolate = support->GetIsolate();
+  Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  v8::Isolate::Scope isolate_scope(isolate);
+  v8::HandleScope handle_scope(isolate);
+  v8::Local<v8::Context> context = support->GetContext();
+  v8::Context::Scope context_scope(context);
+  v8::TryCatch try_catch(isolate);
+
+  CHECK(!i_isolate->has_pending_exception());
+
+  // And run.
+
+  FuzzerArgs args(data, size, context, i_isolate);
+  CompileMjsunit(&args);
+  RunTest(&args);
+
+  CHECK(!i_isolate->has_pending_exception());
+  return 0;
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/fuzzer/regexp_builtins/mjsunit.js b/deps/v8/test/fuzzer/regexp_builtins/mjsunit.js
new file mode 100644
index 00000000000..53795dc63d9
--- /dev/null
+++ b/deps/v8/test/fuzzer/regexp_builtins/mjsunit.js
@@ -0,0 +1,188 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Stripped-down version of test/mjsunit/mjsunit.js that only contains
+// assertEquals.S
+var assertEquals;
+
+(function () {
+  var ObjectPrototypeToString = Object.prototype.toString;
+  var NumberPrototypeValueOf = Number.prototype.valueOf;
+  var BooleanPrototypeValueOf = Boolean.prototype.valueOf;
+  var StringPrototypeValueOf = String.prototype.valueOf;
+  var DatePrototypeValueOf = Date.prototype.valueOf;
+  var RegExpPrototypeToString = RegExp.prototype.toString;
+  var ArrayPrototypeForEach = Array.prototype.forEach;
+  var ArrayPrototypeJoin = Array.prototype.join;
+  var ArrayPrototypeMap = Array.prototype.map;
+  var ArrayPrototypePush = Array.prototype.push;
+
+  var BigIntPrototypeValueOf;
+  try {
+    BigIntPrototypeValueOf = BigInt.prototype.valueOf;
+  } catch(e) {}
+
+  function classOf(object) {
+    var string = ObjectPrototypeToString.call(object);
+    return string.substring(8, string.length - 1);
+  }
+
+  function ValueOf(value) {
+    switch (classOf(value)) {
+      case "Number":
+        return NumberPrototypeValueOf.call(value);
+      case "BigInt":
+        return BigIntPrototypeValueOf.call(value);
+      case "String":
+        return StringPrototypeValueOf.call(value);
+      case "Boolean":
+        return BooleanPrototypeValueOf.call(value);
+      case "Date":
+        return DatePrototypeValueOf.call(value);
+      default:
+        return value;
+    }
+  }
+
+
+  function PrettyPrint(value) {
+    switch (typeof value) {
+      case "string":
+        return JSON.stringify(value);
+      case "bigint":
+        return String(value) + "n";
+      case "number":
+        if (value === 0 && (1 / value) < 0) return "-0";
+        // FALLTHROUGH.
+      case "boolean":
+      case "undefined":
+      case "function":
+      case "symbol":
+        return String(value);
+      case "object":
+        if (value === null) return "null";
+        var objectClass = classOf(value);
+        switch (objectClass) {
+          case "Number":
+          case "BigInt":
+          case "String":
+          case "Boolean":
+          case "Date":
+            return objectClass + "(" + PrettyPrint(ValueOf(value)) + ")";
+          case "RegExp":
+            return RegExpPrototypeToString.call(value);
+          case "Array":
+            var mapped = ArrayPrototypeMap.call(value, PrettyPrintArrayElement);
+            var joined = ArrayPrototypeJoin.call(mapped, ",");
+            return "[" + joined + "]";
+          case "Uint8Array":
+          case "Int8Array":
+          case "Int16Array":
+          case "Uint16Array":
+          case "Uint32Array":
+          case "Int32Array":
+          case "Float32Array":
+          case "Float64Array":
+            var joined = ArrayPrototypeJoin.call(value, ",");
+            return objectClass + "([" + joined + "])";
+          case "Object":
+            break;
+          default:
+            return objectClass + "()";
+        }
+        var name = value.constructor.name;
+        if (name) return name + "()";
+        return "Object()";
+      default:
+        return "-- unknown value --";
+    }
+  }
+
+  function PrettyPrintArrayElement(value, index, array) {
+    if (value === undefined && !(index in array)) return "";
+    return PrettyPrint(value);
+  }
+
+  failWithMessage = function failWithMessage(message) {
+    throw new Error(message);
+  }
+
+  function formatFailureText(expectedText, found, name_opt) {
+    var message = "Fail" + "ure";
+    if (name_opt) {
+      message += " (" + name_opt + ")";
+    }
+
+    var foundText = PrettyPrint(found);
+    if (expectedText.length <= 40 && foundText.length <= 40) {
+      message += ": expected <" + expectedText + "> found <" + foundText + ">";
+    } else {
+      message += ":\nexpected:\n" + expectedText + "\nfound:\n" + foundText;
+    }
+    return message;
+  }
+
+  function fail(expectedText, found, name_opt) {
+    return failWithMessage(formatFailureText(expectedText, found, name_opt));
+  }
+
+  function deepObjectEquals(a, b) {
+    var aProps = Object.keys(a);
+    aProps.sort();
+    var bProps = Object.keys(b);
+    bProps.sort();
+    if (!deepEquals(aProps, bProps)) {
+      return false;
+    }
+    for (var i = 0; i < aProps.length; i++) {
+      if (!deepEquals(a[aProps[i]], b[aProps[i]])) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  function deepEquals(a, b) {
+    if (a === b) {
+      // Check for -0.
+      if (a === 0) return (1 / a) === (1 / b);
+      return true;
+    }
+    if (typeof a !== typeof b) return false;
+    if (typeof a === "number") return isNaN(a) && isNaN(b);
+    if (typeof a !== "object" && typeof a !== "function") return false;
+    // Neither a nor b is primitive.
+    var objectClass = classOf(a);
+    if (objectClass !== classOf(b)) return false;
+    if (objectClass === "RegExp") {
+      // For RegExp, just compare pattern and flags using its toString.
+      return RegExpPrototypeToString.call(a) ===
+             RegExpPrototypeToString.call(b);
+    }
+    // Functions are only identical to themselves.
+    if (objectClass === "Function") return false;
+    if (objectClass === "Array") {
+      var elementCount = 0;
+      if (a.length !== b.length) {
+        return false;
+      }
+      for (var i = 0; i < a.length; i++) {
+        if (!deepEquals(a[i], b[i])) return false;
+      }
+      return true;
+    }
+    if (objectClass === "String" || objectClass === "Number" ||
+      objectClass === "BigInt" || objectClass === "Boolean" ||
+      objectClass === "Date") {
+      if (ValueOf(a) !== ValueOf(b)) return false;
+    }
+    return deepObjectEquals(a, b);
+  }
+
+  assertEquals = function assertEquals(expected, found, name_opt) {
+    if (!deepEquals(found, expected)) {
+      fail(PrettyPrint(expected), found, name_opt);
+    }
+  };
+})();
diff --git a/deps/v8/test/fuzzer/regexp_builtins/mjsunit.js.h b/deps/v8/test/fuzzer/regexp_builtins/mjsunit.js.h
new file mode 100644
index 00000000000..696e3b9eca6
--- /dev/null
+++ b/deps/v8/test/fuzzer/regexp_builtins/mjsunit.js.h
@@ -0,0 +1,496 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+unsigned char test_fuzzer_regexp_builtins_mjsunit_js[] = {
+  0x2f, 0x2f, 0x20, 0x43, 0x6f, 0x70, 0x79, 0x72, 0x69, 0x67, 0x68, 0x74,
+  0x20, 0x32, 0x30, 0x31, 0x37, 0x20, 0x74, 0x68, 0x65, 0x20, 0x56, 0x38,
+  0x20, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x20, 0x61, 0x75, 0x74,
+  0x68, 0x6f, 0x72, 0x73, 0x2e, 0x20, 0x41, 0x6c, 0x6c, 0x20, 0x72, 0x69,
+  0x67, 0x68, 0x74, 0x73, 0x20, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65,
+  0x64, 0x2e, 0x0a, 0x2f, 0x2f, 0x20, 0x55, 0x73, 0x65, 0x20, 0x6f, 0x66,
+  0x20, 0x74, 0x68, 0x69, 0x73, 0x20, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+  0x20, 0x63, 0x6f, 0x64, 0x65, 0x20, 0x69, 0x73, 0x20, 0x67, 0x6f, 0x76,
+  0x65, 0x72, 0x6e, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x20, 0x42,
+  0x53, 0x44, 0x2d, 0x73, 0x74, 0x79, 0x6c, 0x65, 0x20, 0x6c, 0x69, 0x63,
+  0x65, 0x6e, 0x73, 0x65, 0x20, 0x74, 0x68, 0x61, 0x74, 0x20, 0x63, 0x61,
+  0x6e, 0x20, 0x62, 0x65, 0x0a, 0x2f, 0x2f, 0x20, 0x66, 0x6f, 0x75, 0x6e,
+  0x64, 0x20, 0x69, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x4c, 0x49, 0x43,
+  0x45, 0x4e, 0x53, 0x45, 0x20, 0x66, 0x69, 0x6c, 0x65, 0x2e, 0x0a, 0x0a,
+  0x2f, 0x2f, 0x20, 0x53, 0x74, 0x72, 0x69, 0x70, 0x70, 0x65, 0x64, 0x2d,
+  0x64, 0x6f, 0x77, 0x6e, 0x20, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+  0x20, 0x6f, 0x66, 0x20, 0x74, 0x65, 0x73, 0x74, 0x2f, 0x6d, 0x6a, 0x73,
+  0x75, 0x6e, 0x69, 0x74, 0x2f, 0x6d, 0x6a, 0x73, 0x75, 0x6e, 0x69, 0x74,
+  0x2e, 0x6a, 0x73, 0x20, 0x74, 0x68, 0x61, 0x74, 0x20, 0x6f, 0x6e, 0x6c,
+  0x79, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x73, 0x0a, 0x2f,
+  0x2f, 0x20, 0x61, 0x73, 0x73, 0x65, 0x72, 0x74, 0x45, 0x71, 0x75, 0x61,
+  0x6c, 0x73, 0x2e, 0x53, 0x0a, 0x76, 0x61, 0x72, 0x20, 0x61, 0x73, 0x73,
+  0x65, 0x72, 0x74, 0x45, 0x71, 0x75, 0x61, 0x6c, 0x73, 0x3b, 0x0a, 0x0a,
+  0x28, 0x66, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x28, 0x29,
+  0x20, 0x7b, 0x0a, 0x20, 0x20, 0x76, 0x61, 0x72, 0x20, 0x4f, 0x62, 0x6a,
+  0x65, 0x63, 0x74, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65,
+  0x54, 0x6f, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x20, 0x3d, 0x20, 0x4f,
+  0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x74,
+  0x79, 0x70, 0x65, 0x2e, 0x74, 0x6f, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67,
+  0x3b, 0x0a, 0x20, 0x20, 0x76, 0x61, 0x72, 0x20, 0x4e, 0x75, 0x6d, 0x62,
+  0x65, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65, 0x56,
+  0x61, 0x6c, 0x75, 0x65, 0x4f, 0x66, 0x20, 0x3d, 0x20, 0x4e, 0x75, 0x6d,
+  0x62, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70,
+  0x65, 0x2e, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x4f, 0x66, 0x3b, 0x0a, 0x20,
+  0x20, 0x76, 0x61, 0x72, 0x20, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e,
+  0x50, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65, 0x56, 0x61, 0x6c,
+  0x75, 0x65, 0x4f, 0x66, 0x20, 0x3d, 0x20, 0x42, 0x6f, 0x6f, 0x6c, 0x65,
+  0x61, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65,
+  0x2e, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x4f, 0x66, 0x3b, 0x0a, 0x20, 0x20,
+  0x76, 0x61, 0x72, 0x20, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x50, 0x72,
+  0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65,
+  0x4f, 0x66, 0x20, 0x3d, 0x20, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e,
+  0x70, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65, 0x2e, 0x76, 0x61,
+  0x6c, 0x75, 0x65, 0x4f, 0x66, 0x3b, 0x0a, 0x20, 0x20, 0x76, 0x61, 0x72,
+  0x20, 0x44, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79,
+  0x70, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4f, 0x66, 0x20, 0x3d, 0x20,
+  0x44, 0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79,
+  0x70, 0x65, 0x2e, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x4f, 0x66, 0x3b, 0x0a,
+  0x20, 0x20, 0x76, 0x61, 0x72, 0x20, 0x52, 0x65, 0x67, 0x45, 0x78, 0x70,
+  0x50, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65, 0x54, 0x6f, 0x53,
+  0x74, 0x72, 0x69, 0x6e, 0x67, 0x20, 0x3d, 0x20, 0x52, 0x65, 0x67, 0x45,
+  0x78, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65,
+  0x2e, 0x74, 0x6f, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x3b, 0x0a, 0x20,
+  0x20, 0x76, 0x61, 0x72, 0x20, 0x41, 0x72, 0x72, 0x61, 0x79, 0x50, 0x72,
+  0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65, 0x46, 0x6f, 0x72, 0x45, 0x61,
+  0x63, 0x68, 0x20, 0x3d, 0x20, 0x41, 0x72, 0x72, 0x61, 0x79, 0x2e, 0x70,
+  0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65, 0x2e, 0x66, 0x6f, 0x72,
+  0x45, 0x61, 0x63, 0x68, 0x3b, 0x0a, 0x20, 0x20, 0x76, 0x61, 0x72, 0x20,
+  0x41, 0x72, 0x72, 0x61, 0x79, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79,
+  0x70, 0x65, 0x4a, 0x6f, 0x69, 0x6e, 0x20, 0x3d, 0x20, 0x41, 0x72, 0x72,
+  0x61, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65,
+  0x2e, 0x6a, 0x6f, 0x69, 0x6e, 0x3b, 0x0a, 0x20, 0x20, 0x76, 0x61, 0x72,
+  0x20, 0x41, 0x72, 0x72, 0x61, 0x79, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x74,
+  0x79, 0x70, 0x65, 0x4d, 0x61, 0x70, 0x20, 0x3d, 0x20, 0x41, 0x72, 0x72,
+  0x61, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65,
+  0x2e, 0x6d, 0x61, 0x70, 0x3b, 0x0a, 0x20, 0x20, 0x76, 0x61, 0x72, 0x20,
+  0x41, 0x72, 0x72, 0x61, 0x79, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79,
+  0x70, 0x65, 0x50, 0x75, 0x73, 0x68, 0x20, 0x3d, 0x20, 0x41, 0x72, 0x72,
+  0x61, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65,
+  0x2e, 0x70, 0x75, 0x73, 0x68, 0x3b, 0x0a, 0x0a, 0x20, 0x20, 0x76, 0x61,
+  0x72, 0x20, 0x42, 0x69, 0x67, 0x49, 0x6e, 0x74, 0x50, 0x72, 0x6f, 0x74,
+  0x6f, 0x74, 0x79, 0x70, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4f, 0x66,
+  0x3b, 0x0a, 0x20, 0x20, 0x74, 0x72, 0x79, 0x20, 0x7b, 0x0a, 0x20, 0x20,
+  0x20, 0x20, 0x42, 0x69, 0x67, 0x49, 0x6e, 0x74, 0x50, 0x72, 0x6f, 0x74,
+  0x6f, 0x74, 0x79, 0x70, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4f, 0x66,
+  0x20, 0x3d, 0x20, 0x42, 0x69, 0x67, 0x49, 0x6e, 0x74, 0x2e, 0x70, 0x72,
+  0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65, 0x2e, 0x76, 0x61, 0x6c, 0x75,
+  0x65, 0x4f, 0x66, 0x3b, 0x0a, 0x20, 0x20, 0x7d, 0x20, 0x63, 0x61, 0x74,
+  0x63, 0x68, 0x28, 0x65, 0x29, 0x20, 0x7b, 0x7d, 0x0a, 0x0a, 0x20, 0x20,
+  0x66, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x63, 0x6c, 0x61,
+  0x73, 0x73, 0x4f, 0x66, 0x28, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x29,
+  0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x76, 0x61, 0x72, 0x20, 0x73,
+  0x74, 0x72, 0x69, 0x6e, 0x67, 0x20, 0x3d, 0x20, 0x4f, 0x62, 0x6a, 0x65,
+  0x63, 0x74, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65, 0x54,
+  0x6f, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e, 0x63, 0x61, 0x6c, 0x6c,
+  0x28, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x29, 0x3b, 0x0a, 0x20, 0x20,
+  0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x73, 0x74, 0x72,
+  0x69, 0x6e, 0x67, 0x2e, 0x73, 0x75, 0x62, 0x73, 0x74, 0x72, 0x69, 0x6e,
+  0x67, 0x28, 0x38, 0x2c, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e,
+  0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x20, 0x2d, 0x20, 0x31, 0x29, 0x3b,
+  0x0a, 0x20, 0x20, 0x7d, 0x0a, 0x0a, 0x20, 0x20, 0x66, 0x75, 0x6e, 0x63,
+  0x74, 0x69, 0x6f, 0x6e, 0x20, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4f, 0x66,
+  0x28, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x29, 0x20, 0x7b, 0x0a, 0x20, 0x20,
+  0x20, 0x20, 0x73, 0x77, 0x69, 0x74, 0x63, 0x68, 0x20, 0x28, 0x63, 0x6c,
+  0x61, 0x73, 0x73, 0x4f, 0x66, 0x28, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x29,
+  0x29, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61,
+  0x73, 0x65, 0x20, 0x22, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x22, 0x3a,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74,
+  0x75, 0x72, 0x6e, 0x20, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x50, 0x72,
+  0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65,
+  0x4f, 0x66, 0x2e, 0x63, 0x61, 0x6c, 0x6c, 0x28, 0x76, 0x61, 0x6c, 0x75,
+  0x65, 0x29, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61,
+  0x73, 0x65, 0x20, 0x22, 0x42, 0x69, 0x67, 0x49, 0x6e, 0x74, 0x22, 0x3a,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74,
+  0x75, 0x72, 0x6e, 0x20, 0x42, 0x69, 0x67, 0x49, 0x6e, 0x74, 0x50, 0x72,
+  0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65,
+  0x4f, 0x66, 0x2e, 0x63, 0x61, 0x6c, 0x6c, 0x28, 0x76, 0x61, 0x6c, 0x75,
+  0x65, 0x29, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61,
+  0x73, 0x65, 0x20, 0x22, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x22, 0x3a,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74,
+  0x75, 0x72, 0x6e, 0x20, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x50, 0x72,
+  0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65,
+  0x4f, 0x66, 0x2e, 0x63, 0x61, 0x6c, 0x6c, 0x28, 0x76, 0x61, 0x6c, 0x75,
+  0x65, 0x29, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61,
+  0x73, 0x65, 0x20, 0x22, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x22,
+  0x3a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65,
+  0x74, 0x75, 0x72, 0x6e, 0x20, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e,
+  0x50, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70, 0x65, 0x56, 0x61, 0x6c,
+  0x75, 0x65, 0x4f, 0x66, 0x2e, 0x63, 0x61, 0x6c, 0x6c, 0x28, 0x76, 0x61,
+  0x6c, 0x75, 0x65, 0x29, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x63, 0x61, 0x73, 0x65, 0x20, 0x22, 0x44, 0x61, 0x74, 0x65, 0x22, 0x3a,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74,
+  0x75, 0x72, 0x6e, 0x20, 0x44, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x74,
+  0x6f, 0x74, 0x79, 0x70, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4f, 0x66,
+  0x2e, 0x63, 0x61, 0x6c, 0x6c, 0x28, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x29,
+  0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x64, 0x65, 0x66, 0x61,
+  0x75, 0x6c, 0x74, 0x3a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x76, 0x61, 0x6c, 0x75,
+  0x65, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a, 0x20, 0x20, 0x7d,
+  0x0a, 0x0a, 0x0a, 0x20, 0x20, 0x66, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f,
+  0x6e, 0x20, 0x50, 0x72, 0x65, 0x74, 0x74, 0x79, 0x50, 0x72, 0x69, 0x6e,
+  0x74, 0x28, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x29, 0x20, 0x7b, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x73, 0x77, 0x69, 0x74, 0x63, 0x68, 0x20, 0x28, 0x74,
+  0x79, 0x70, 0x65, 0x6f, 0x66, 0x20, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x29,
+  0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61, 0x73,
+  0x65, 0x20, 0x22, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74, 0x75,
+  0x72, 0x6e, 0x20, 0x4a, 0x53, 0x4f, 0x4e, 0x2e, 0x73, 0x74, 0x72, 0x69,
+  0x6e, 0x67, 0x69, 0x66, 0x79, 0x28, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x29,
+  0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61, 0x73, 0x65,
+  0x20, 0x22, 0x62, 0x69, 0x67, 0x69, 0x6e, 0x74, 0x22, 0x3a, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72,
+  0x6e, 0x20, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x28, 0x76, 0x61, 0x6c,
+  0x75, 0x65, 0x29, 0x20, 0x2b, 0x20, 0x22, 0x6e, 0x22, 0x3b, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61, 0x73, 0x65, 0x20, 0x22, 0x6e,
+  0x75, 0x6d, 0x62, 0x65, 0x72, 0x22, 0x3a, 0x0a, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x28, 0x76, 0x61, 0x6c, 0x75,
+  0x65, 0x20, 0x3d, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x26, 0x26, 0x20, 0x28,
+  0x31, 0x20, 0x2f, 0x20, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x29, 0x20, 0x3c,
+  0x20, 0x30, 0x29, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x22,
+  0x2d, 0x30, 0x22, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x2f, 0x2f, 0x20, 0x46, 0x41, 0x4c, 0x4c, 0x54, 0x48, 0x52, 0x4f,
+  0x55, 0x47, 0x48, 0x2e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63,
+  0x61, 0x73, 0x65, 0x20, 0x22, 0x62, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e,
+  0x22, 0x3a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61, 0x73,
+  0x65, 0x20, 0x22, 0x75, 0x6e, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x65, 0x64,
+  0x22, 0x3a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61, 0x73,
+  0x65, 0x20, 0x22, 0x66, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22,
+  0x3a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61, 0x73, 0x65,
+  0x20, 0x22, 0x73, 0x79, 0x6d, 0x62, 0x6f, 0x6c, 0x22, 0x3a, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72,
+  0x6e, 0x20, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x28, 0x76, 0x61, 0x6c,
+  0x75, 0x65, 0x29, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63,
+  0x61, 0x73, 0x65, 0x20, 0x22, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x22,
+  0x3a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x69, 0x66,
+  0x20, 0x28, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x20, 0x3d, 0x3d, 0x3d, 0x20,
+  0x6e, 0x75, 0x6c, 0x6c, 0x29, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e,
+  0x20, 0x22, 0x6e, 0x75, 0x6c, 0x6c, 0x22, 0x3b, 0x0a, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x76, 0x61, 0x72, 0x20, 0x6f, 0x62, 0x6a,
+  0x65, 0x63, 0x74, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x3d, 0x20, 0x63,
+  0x6c, 0x61, 0x73, 0x73, 0x4f, 0x66, 0x28, 0x76, 0x61, 0x6c, 0x75, 0x65,
+  0x29, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x73,
+  0x77, 0x69, 0x74, 0x63, 0x68, 0x20, 0x28, 0x6f, 0x62, 0x6a, 0x65, 0x63,
+  0x74, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x29, 0x20, 0x7b, 0x0a, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61, 0x73, 0x65,
+  0x20, 0x22, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x22, 0x3a, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61, 0x73,
+  0x65, 0x20, 0x22, 0x42, 0x69, 0x67, 0x49, 0x6e, 0x74, 0x22, 0x3a, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61,
+  0x73, 0x65, 0x20, 0x22, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x22, 0x3a,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63,
+  0x61, 0x73, 0x65, 0x20, 0x22, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e,
+  0x22, 0x3a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x63, 0x61, 0x73, 0x65, 0x20, 0x22, 0x44, 0x61, 0x74, 0x65, 0x22,
+  0x3a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x6f, 0x62, 0x6a,
+  0x65, 0x63, 0x74, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x2b, 0x20, 0x22,
+  0x28, 0x22, 0x20, 0x2b, 0x20, 0x50, 0x72, 0x65, 0x74, 0x74, 0x79, 0x50,
+  0x72, 0x69, 0x6e, 0x74, 0x28, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4f, 0x66,
+  0x28, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x29, 0x29, 0x20, 0x2b, 0x20, 0x22,
+  0x29, 0x22, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x63, 0x61, 0x73, 0x65, 0x20, 0x22, 0x52, 0x65, 0x67, 0x45,
+  0x78, 0x70, 0x22, 0x3a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20,
+  0x52, 0x65, 0x67, 0x45, 0x78, 0x70, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x74,
+  0x79, 0x70, 0x65, 0x54, 0x6f, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e,
+  0x63, 0x61, 0x6c, 0x6c, 0x28, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x29, 0x3b,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63,
+  0x61, 0x73, 0x65, 0x20, 0x22, 0x41, 0x72, 0x72, 0x61, 0x79, 0x22, 0x3a,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x76, 0x61, 0x72, 0x20, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x20,
+  0x3d, 0x20, 0x41, 0x72, 0x72, 0x61, 0x79, 0x50, 0x72, 0x6f, 0x74, 0x6f,
+  0x74, 0x79, 0x70, 0x65, 0x4d, 0x61, 0x70, 0x2e, 0x63, 0x61, 0x6c, 0x6c,
+  0x28, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x2c, 0x20, 0x50, 0x72, 0x65, 0x74,
+  0x74, 0x79, 0x50, 0x72, 0x69, 0x6e, 0x74, 0x41, 0x72, 0x72, 0x61, 0x79,
+  0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x29, 0x3b, 0x0a, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x76, 0x61,
+  0x72, 0x20, 0x6a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x20, 0x3d, 0x20, 0x41,
+  0x72, 0x72, 0x61, 0x79, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x74, 0x79, 0x70,
+  0x65, 0x4a, 0x6f, 0x69, 0x6e, 0x2e, 0x63, 0x61, 0x6c, 0x6c, 0x28, 0x6d,
+  0x61, 0x70, 0x70, 0x65, 0x64, 0x2c, 0x20, 0x22, 0x2c, 0x22, 0x29, 0x3b,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x22, 0x5b, 0x22, 0x20,
+  0x2b, 0x20, 0x6a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x20, 0x2b, 0x20, 0x22,
+  0x5d, 0x22, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x63, 0x61, 0x73, 0x65, 0x20, 0x22, 0x55, 0x69, 0x6e, 0x74,
+  0x38, 0x41, 0x72, 0x72, 0x61, 0x79, 0x22, 0x3a, 0x0a, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61, 0x73, 0x65, 0x20,
+  0x22, 0x49, 0x6e, 0x74, 0x38, 0x41, 0x72, 0x72, 0x61, 0x79, 0x22, 0x3a,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63,
+  0x61, 0x73, 0x65, 0x20, 0x22, 0x49, 0x6e, 0x74, 0x31, 0x36, 0x41, 0x72,
+  0x72, 0x61, 0x79, 0x22, 0x3a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x63, 0x61, 0x73, 0x65, 0x20, 0x22, 0x55, 0x69,
+  0x6e, 0x74, 0x31, 0x36, 0x41, 0x72, 0x72, 0x61, 0x79, 0x22, 0x3a, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61,
+  0x73, 0x65, 0x20, 0x22, 0x55, 0x69, 0x6e, 0x74, 0x33, 0x32, 0x41, 0x72,
+  0x72, 0x61, 0x79, 0x22, 0x3a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x63, 0x61, 0x73, 0x65, 0x20, 0x22, 0x49, 0x6e,
+  0x74, 0x33, 0x32, 0x41, 0x72, 0x72, 0x61, 0x79, 0x22, 0x3a, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61, 0x73,
+  0x65, 0x20, 0x22, 0x46, 0x6c, 0x6f, 0x61, 0x74, 0x33, 0x32, 0x41, 0x72,
+  0x72, 0x61, 0x79, 0x22, 0x3a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x63, 0x61, 0x73, 0x65, 0x20, 0x22, 0x46, 0x6c,
+  0x6f, 0x61, 0x74, 0x36, 0x34, 0x41, 0x72, 0x72, 0x61, 0x79, 0x22, 0x3a,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x76, 0x61, 0x72, 0x20, 0x6a, 0x6f, 0x69, 0x6e, 0x65, 0x64, 0x20,
+  0x3d, 0x20, 0x41, 0x72, 0x72, 0x61, 0x79, 0x50, 0x72, 0x6f, 0x74, 0x6f,
+  0x74, 0x79, 0x70, 0x65, 0x4a, 0x6f, 0x69, 0x6e, 0x2e, 0x63, 0x61, 0x6c,
+  0x6c, 0x28, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x2c, 0x20, 0x22, 0x2c, 0x22,
+  0x29, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x6f, 0x62,
+  0x6a, 0x65, 0x63, 0x74, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x2b, 0x20,
+  0x22, 0x28, 0x5b, 0x22, 0x20, 0x2b, 0x20, 0x6a, 0x6f, 0x69, 0x6e, 0x65,
+  0x64, 0x20, 0x2b, 0x20, 0x22, 0x5d, 0x29, 0x22, 0x3b, 0x0a, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x63, 0x61, 0x73, 0x65,
+  0x20, 0x22, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x22, 0x3a, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x62,
+  0x72, 0x65, 0x61, 0x6b, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x3a,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x6f, 0x62, 0x6a, 0x65,
+  0x63, 0x74, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x2b, 0x20, 0x22, 0x28,
+  0x29, 0x22, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x7d, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x76, 0x61,
+  0x72, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x3d, 0x20, 0x76, 0x61, 0x6c,
+  0x75, 0x65, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x74, 0x72, 0x75, 0x63, 0x74,
+  0x6f, 0x72, 0x2e, 0x6e, 0x61, 0x6d, 0x65, 0x3b, 0x0a, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x28, 0x6e, 0x61, 0x6d,
+  0x65, 0x29, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x6e, 0x61,
+  0x6d, 0x65, 0x20, 0x2b, 0x20, 0x22, 0x28, 0x29, 0x22, 0x3b, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72,
+  0x6e, 0x20, 0x22, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x28, 0x29, 0x22,
+  0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x64, 0x65, 0x66, 0x61,
+  0x75, 0x6c, 0x74, 0x3a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x22, 0x2d, 0x2d, 0x20,
+  0x75, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x20, 0x76, 0x61, 0x6c, 0x75,
+  0x65, 0x20, 0x2d, 0x2d, 0x22, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x7d,
+  0x0a, 0x20, 0x20, 0x7d, 0x0a, 0x0a, 0x20, 0x20, 0x66, 0x75, 0x6e, 0x63,
+  0x74, 0x69, 0x6f, 0x6e, 0x20, 0x50, 0x72, 0x65, 0x74, 0x74, 0x79, 0x50,
+  0x72, 0x69, 0x6e, 0x74, 0x41, 0x72, 0x72, 0x61, 0x79, 0x45, 0x6c, 0x65,
+  0x6d, 0x65, 0x6e, 0x74, 0x28, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x2c, 0x20,
+  0x69, 0x6e, 0x64, 0x65, 0x78, 0x2c, 0x20, 0x61, 0x72, 0x72, 0x61, 0x79,
+  0x29, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x28,
+  0x76, 0x61, 0x6c, 0x75, 0x65, 0x20, 0x3d, 0x3d, 0x3d, 0x20, 0x75, 0x6e,
+  0x64, 0x65, 0x66, 0x69, 0x6e, 0x65, 0x64, 0x20, 0x26, 0x26, 0x20, 0x21,
+  0x28, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x20, 0x69, 0x6e, 0x20, 0x61, 0x72,
+  0x72, 0x61, 0x79, 0x29, 0x29, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e,
+  0x20, 0x22, 0x22, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74,
+  0x75, 0x72, 0x6e, 0x20, 0x50, 0x72, 0x65, 0x74, 0x74, 0x79, 0x50, 0x72,
+  0x69, 0x6e, 0x74, 0x28, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x29, 0x3b, 0x0a,
+  0x20, 0x20, 0x7d, 0x0a, 0x0a, 0x20, 0x20, 0x66, 0x61, 0x69, 0x6c, 0x57,
+  0x69, 0x74, 0x68, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x20, 0x3d,
+  0x20, 0x66, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x66, 0x61,
+  0x69, 0x6c, 0x57, 0x69, 0x74, 0x68, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
+  0x65, 0x28, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x29, 0x20, 0x7b,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x74, 0x68, 0x72, 0x6f, 0x77, 0x20, 0x6e,
+  0x65, 0x77, 0x20, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x28, 0x6d, 0x65, 0x73,
+  0x73, 0x61, 0x67, 0x65, 0x29, 0x3b, 0x0a, 0x20, 0x20, 0x7d, 0x0a, 0x0a,
+  0x20, 0x20, 0x66, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x66,
+  0x6f, 0x72, 0x6d, 0x61, 0x74, 0x46, 0x61, 0x69, 0x6c, 0x75, 0x72, 0x65,
+  0x54, 0x65, 0x78, 0x74, 0x28, 0x65, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65,
+  0x64, 0x54, 0x65, 0x78, 0x74, 0x2c, 0x20, 0x66, 0x6f, 0x75, 0x6e, 0x64,
+  0x2c, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x6f, 0x70, 0x74, 0x29, 0x20,
+  0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x76, 0x61, 0x72, 0x20, 0x6d, 0x65,
+  0x73, 0x73, 0x61, 0x67, 0x65, 0x20, 0x3d, 0x20, 0x22, 0x46, 0x61, 0x69,
+  0x6c, 0x22, 0x20, 0x2b, 0x20, 0x22, 0x75, 0x72, 0x65, 0x22, 0x3b, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x28, 0x6e, 0x61, 0x6d, 0x65,
+  0x5f, 0x6f, 0x70, 0x74, 0x29, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x20, 0x2b, 0x3d,
+  0x20, 0x22, 0x20, 0x28, 0x22, 0x20, 0x2b, 0x20, 0x6e, 0x61, 0x6d, 0x65,
+  0x5f, 0x6f, 0x70, 0x74, 0x20, 0x2b, 0x20, 0x22, 0x29, 0x22, 0x3b, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x76,
+  0x61, 0x72, 0x20, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x54, 0x65, 0x78, 0x74,
+  0x20, 0x3d, 0x20, 0x50, 0x72, 0x65, 0x74, 0x74, 0x79, 0x50, 0x72, 0x69,
+  0x6e, 0x74, 0x28, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x29, 0x3b, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x28, 0x65, 0x78, 0x70, 0x65, 0x63,
+  0x74, 0x65, 0x64, 0x54, 0x65, 0x78, 0x74, 0x2e, 0x6c, 0x65, 0x6e, 0x67,
+  0x74, 0x68, 0x20, 0x3c, 0x3d, 0x20, 0x34, 0x30, 0x20, 0x26, 0x26, 0x20,
+  0x66, 0x6f, 0x75, 0x6e, 0x64, 0x54, 0x65, 0x78, 0x74, 0x2e, 0x6c, 0x65,
+  0x6e, 0x67, 0x74, 0x68, 0x20, 0x3c, 0x3d, 0x20, 0x34, 0x30, 0x29, 0x20,
+  0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x6d, 0x65, 0x73, 0x73,
+  0x61, 0x67, 0x65, 0x20, 0x2b, 0x3d, 0x20, 0x22, 0x3a, 0x20, 0x65, 0x78,
+  0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x20, 0x3c, 0x22, 0x20, 0x2b, 0x20,
+  0x65, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x54, 0x65, 0x78, 0x74,
+  0x20, 0x2b, 0x20, 0x22, 0x3e, 0x20, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x20,
+  0x3c, 0x22, 0x20, 0x2b, 0x20, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x54, 0x65,
+  0x78, 0x74, 0x20, 0x2b, 0x20, 0x22, 0x3e, 0x22, 0x3b, 0x0a, 0x20, 0x20,
+  0x20, 0x20, 0x7d, 0x20, 0x65, 0x6c, 0x73, 0x65, 0x20, 0x7b, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+  0x20, 0x2b, 0x3d, 0x20, 0x22, 0x3a, 0x5c, 0x6e, 0x65, 0x78, 0x70, 0x65,
+  0x63, 0x74, 0x65, 0x64, 0x3a, 0x5c, 0x6e, 0x22, 0x20, 0x2b, 0x20, 0x65,
+  0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x54, 0x65, 0x78, 0x74, 0x20,
+  0x2b, 0x20, 0x22, 0x5c, 0x6e, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x3a, 0x5c,
+  0x6e, 0x22, 0x20, 0x2b, 0x20, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x54, 0x65,
+  0x78, 0x74, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a, 0x20, 0x20,
+  0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x6d, 0x65, 0x73,
+  0x73, 0x61, 0x67, 0x65, 0x3b, 0x0a, 0x20, 0x20, 0x7d, 0x0a, 0x0a, 0x20,
+  0x20, 0x66, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x66, 0x61,
+  0x69, 0x6c, 0x28, 0x65, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x54,
+  0x65, 0x78, 0x74, 0x2c, 0x20, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x2c, 0x20,
+  0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x6f, 0x70, 0x74, 0x29, 0x20, 0x7b, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x66,
+  0x61, 0x69, 0x6c, 0x57, 0x69, 0x74, 0x68, 0x4d, 0x65, 0x73, 0x73, 0x61,
+  0x67, 0x65, 0x28, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x46, 0x61, 0x69,
+  0x6c, 0x75, 0x72, 0x65, 0x54, 0x65, 0x78, 0x74, 0x28, 0x65, 0x78, 0x70,
+  0x65, 0x63, 0x74, 0x65, 0x64, 0x54, 0x65, 0x78, 0x74, 0x2c, 0x20, 0x66,
+  0x6f, 0x75, 0x6e, 0x64, 0x2c, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x6f,
+  0x70, 0x74, 0x29, 0x29, 0x3b, 0x0a, 0x20, 0x20, 0x7d, 0x0a, 0x0a, 0x20,
+  0x20, 0x66, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x64, 0x65,
+  0x65, 0x70, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x71, 0x75, 0x61,
+  0x6c, 0x73, 0x28, 0x61, 0x2c, 0x20, 0x62, 0x29, 0x20, 0x7b, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x76, 0x61, 0x72, 0x20, 0x61, 0x50, 0x72, 0x6f, 0x70,
+  0x73, 0x20, 0x3d, 0x20, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x6b,
+  0x65, 0x79, 0x73, 0x28, 0x61, 0x29, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20,
+  0x61, 0x50, 0x72, 0x6f, 0x70, 0x73, 0x2e, 0x73, 0x6f, 0x72, 0x74, 0x28,
+  0x29, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x76, 0x61, 0x72, 0x20, 0x62,
+  0x50, 0x72, 0x6f, 0x70, 0x73, 0x20, 0x3d, 0x20, 0x4f, 0x62, 0x6a, 0x65,
+  0x63, 0x74, 0x2e, 0x6b, 0x65, 0x79, 0x73, 0x28, 0x62, 0x29, 0x3b, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x62, 0x50, 0x72, 0x6f, 0x70, 0x73, 0x2e, 0x73,
+  0x6f, 0x72, 0x74, 0x28, 0x29, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x69,
+  0x66, 0x20, 0x28, 0x21, 0x64, 0x65, 0x65, 0x70, 0x45, 0x71, 0x75, 0x61,
+  0x6c, 0x73, 0x28, 0x61, 0x50, 0x72, 0x6f, 0x70, 0x73, 0x2c, 0x20, 0x62,
+  0x50, 0x72, 0x6f, 0x70, 0x73, 0x29, 0x29, 0x20, 0x7b, 0x0a, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x66,
+  0x61, 0x6c, 0x73, 0x65, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x28, 0x76, 0x61, 0x72,
+  0x20, 0x69, 0x20, 0x3d, 0x20, 0x30, 0x3b, 0x20, 0x69, 0x20, 0x3c, 0x20,
+  0x61, 0x50, 0x72, 0x6f, 0x70, 0x73, 0x2e, 0x6c, 0x65, 0x6e, 0x67, 0x74,
+  0x68, 0x3b, 0x20, 0x69, 0x2b, 0x2b, 0x29, 0x20, 0x7b, 0x0a, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x28, 0x21, 0x64, 0x65, 0x65,
+  0x70, 0x45, 0x71, 0x75, 0x61, 0x6c, 0x73, 0x28, 0x61, 0x5b, 0x61, 0x50,
+  0x72, 0x6f, 0x70, 0x73, 0x5b, 0x69, 0x5d, 0x5d, 0x2c, 0x20, 0x62, 0x5b,
+  0x61, 0x50, 0x72, 0x6f, 0x70, 0x73, 0x5b, 0x69, 0x5d, 0x5d, 0x29, 0x29,
+  0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x72,
+  0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x3b,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a, 0x20, 0x20, 0x20,
+  0x20, 0x7d, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72,
+  0x6e, 0x20, 0x74, 0x72, 0x75, 0x65, 0x3b, 0x0a, 0x20, 0x20, 0x7d, 0x0a,
+  0x0a, 0x20, 0x20, 0x66, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20,
+  0x64, 0x65, 0x65, 0x70, 0x45, 0x71, 0x75, 0x61, 0x6c, 0x73, 0x28, 0x61,
+  0x2c, 0x20, 0x62, 0x29, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x69,
+  0x66, 0x20, 0x28, 0x61, 0x20, 0x3d, 0x3d, 0x3d, 0x20, 0x62, 0x29, 0x20,
+  0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x2f, 0x2f, 0x20, 0x43,
+  0x68, 0x65, 0x63, 0x6b, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x2d, 0x30, 0x2e,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x28, 0x61,
+  0x20, 0x3d, 0x3d, 0x3d, 0x20, 0x30, 0x29, 0x20, 0x72, 0x65, 0x74, 0x75,
+  0x72, 0x6e, 0x20, 0x28, 0x31, 0x20, 0x2f, 0x20, 0x61, 0x29, 0x20, 0x3d,
+  0x3d, 0x3d, 0x20, 0x28, 0x31, 0x20, 0x2f, 0x20, 0x62, 0x29, 0x3b, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e,
+  0x20, 0x74, 0x72, 0x75, 0x65, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x7d,
+  0x0a, 0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x28, 0x74, 0x79, 0x70,
+  0x65, 0x6f, 0x66, 0x20, 0x61, 0x20, 0x21, 0x3d, 0x3d, 0x20, 0x74, 0x79,
+  0x70, 0x65, 0x6f, 0x66, 0x20, 0x62, 0x29, 0x20, 0x72, 0x65, 0x74, 0x75,
+  0x72, 0x6e, 0x20, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x3b, 0x0a, 0x20, 0x20,
+  0x20, 0x20, 0x69, 0x66, 0x20, 0x28, 0x74, 0x79, 0x70, 0x65, 0x6f, 0x66,
+  0x20, 0x61, 0x20, 0x3d, 0x3d, 0x3d, 0x20, 0x22, 0x6e, 0x75, 0x6d, 0x62,
+  0x65, 0x72, 0x22, 0x29, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20,
+  0x69, 0x73, 0x4e, 0x61, 0x4e, 0x28, 0x61, 0x29, 0x20, 0x26, 0x26, 0x20,
+  0x69, 0x73, 0x4e, 0x61, 0x4e, 0x28, 0x62, 0x29, 0x3b, 0x0a, 0x20, 0x20,
+  0x20, 0x20, 0x69, 0x66, 0x20, 0x28, 0x74, 0x79, 0x70, 0x65, 0x6f, 0x66,
+  0x20, 0x61, 0x20, 0x21, 0x3d, 0x3d, 0x20, 0x22, 0x6f, 0x62, 0x6a, 0x65,
+  0x63, 0x74, 0x22, 0x20, 0x26, 0x26, 0x20, 0x74, 0x79, 0x70, 0x65, 0x6f,
+  0x66, 0x20, 0x61, 0x20, 0x21, 0x3d, 0x3d, 0x20, 0x22, 0x66, 0x75, 0x6e,
+  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x29, 0x20, 0x72, 0x65, 0x74, 0x75,
+  0x72, 0x6e, 0x20, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x3b, 0x0a, 0x20, 0x20,
+  0x20, 0x20, 0x2f, 0x2f, 0x20, 0x4e, 0x65, 0x69, 0x74, 0x68, 0x65, 0x72,
+  0x20, 0x61, 0x20, 0x6e, 0x6f, 0x72, 0x20, 0x62, 0x20, 0x69, 0x73, 0x20,
+  0x70, 0x72, 0x69, 0x6d, 0x69, 0x74, 0x69, 0x76, 0x65, 0x2e, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x76, 0x61, 0x72, 0x20, 0x6f, 0x62, 0x6a, 0x65, 0x63,
+  0x74, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x3d, 0x20, 0x63, 0x6c, 0x61,
+  0x73, 0x73, 0x4f, 0x66, 0x28, 0x61, 0x29, 0x3b, 0x0a, 0x20, 0x20, 0x20,
+  0x20, 0x69, 0x66, 0x20, 0x28, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43,
+  0x6c, 0x61, 0x73, 0x73, 0x20, 0x21, 0x3d, 0x3d, 0x20, 0x63, 0x6c, 0x61,
+  0x73, 0x73, 0x4f, 0x66, 0x28, 0x62, 0x29, 0x29, 0x20, 0x72, 0x65, 0x74,
+  0x75, 0x72, 0x6e, 0x20, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x3b, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x28, 0x6f, 0x62, 0x6a, 0x65, 0x63,
+  0x74, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x3d, 0x3d, 0x3d, 0x20, 0x22,
+  0x52, 0x65, 0x67, 0x45, 0x78, 0x70, 0x22, 0x29, 0x20, 0x7b, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x2f, 0x2f, 0x20, 0x46, 0x6f, 0x72, 0x20,
+  0x52, 0x65, 0x67, 0x45, 0x78, 0x70, 0x2c, 0x20, 0x6a, 0x75, 0x73, 0x74,
+  0x20, 0x63, 0x6f, 0x6d, 0x70, 0x61, 0x72, 0x65, 0x20, 0x70, 0x61, 0x74,
+  0x74, 0x65, 0x72, 0x6e, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x66, 0x6c, 0x61,
+  0x67, 0x73, 0x20, 0x75, 0x73, 0x69, 0x6e, 0x67, 0x20, 0x69, 0x74, 0x73,
+  0x20, 0x74, 0x6f, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20,
+  0x52, 0x65, 0x67, 0x45, 0x78, 0x70, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x74,
+  0x79, 0x70, 0x65, 0x54, 0x6f, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e,
+  0x63, 0x61, 0x6c, 0x6c, 0x28, 0x61, 0x29, 0x20, 0x3d, 0x3d, 0x3d, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x52, 0x65, 0x67, 0x45, 0x78, 0x70, 0x50, 0x72, 0x6f, 0x74, 0x6f,
+  0x74, 0x79, 0x70, 0x65, 0x54, 0x6f, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67,
+  0x2e, 0x63, 0x61, 0x6c, 0x6c, 0x28, 0x62, 0x29, 0x3b, 0x0a, 0x20, 0x20,
+  0x20, 0x20, 0x7d, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x2f, 0x2f, 0x20, 0x46,
+  0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x20, 0x61, 0x72, 0x65,
+  0x20, 0x6f, 0x6e, 0x6c, 0x79, 0x20, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69,
+  0x63, 0x61, 0x6c, 0x20, 0x74, 0x6f, 0x20, 0x74, 0x68, 0x65, 0x6d, 0x73,
+  0x65, 0x6c, 0x76, 0x65, 0x73, 0x2e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x69,
+  0x66, 0x20, 0x28, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6c, 0x61,
+  0x73, 0x73, 0x20, 0x3d, 0x3d, 0x3d, 0x20, 0x22, 0x46, 0x75, 0x6e, 0x63,
+  0x74, 0x69, 0x6f, 0x6e, 0x22, 0x29, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72,
+  0x6e, 0x20, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x3b, 0x0a, 0x20, 0x20, 0x20,
+  0x20, 0x69, 0x66, 0x20, 0x28, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43,
+  0x6c, 0x61, 0x73, 0x73, 0x20, 0x3d, 0x3d, 0x3d, 0x20, 0x22, 0x41, 0x72,
+  0x72, 0x61, 0x79, 0x22, 0x29, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x76, 0x61, 0x72, 0x20, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e,
+  0x74, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x20, 0x3d, 0x20, 0x30, 0x3b, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x28, 0x61, 0x2e,
+  0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x20, 0x21, 0x3d, 0x3d, 0x20, 0x62,
+  0x2e, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x29, 0x20, 0x7b, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72,
+  0x6e, 0x20, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x3b, 0x0a, 0x20, 0x20, 0x20,
+  0x20, 0x20, 0x20, 0x7d, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x66,
+  0x6f, 0x72, 0x20, 0x28, 0x76, 0x61, 0x72, 0x20, 0x69, 0x20, 0x3d, 0x20,
+  0x30, 0x3b, 0x20, 0x69, 0x20, 0x3c, 0x20, 0x61, 0x2e, 0x6c, 0x65, 0x6e,
+  0x67, 0x74, 0x68, 0x3b, 0x20, 0x69, 0x2b, 0x2b, 0x29, 0x20, 0x7b, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x28,
+  0x21, 0x64, 0x65, 0x65, 0x70, 0x45, 0x71, 0x75, 0x61, 0x6c, 0x73, 0x28,
+  0x61, 0x5b, 0x69, 0x5d, 0x2c, 0x20, 0x62, 0x5b, 0x69, 0x5d, 0x29, 0x29,
+  0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x66, 0x61, 0x6c, 0x73,
+  0x65, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a, 0x20,
+  0x20, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20,
+  0x74, 0x72, 0x75, 0x65, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x28, 0x6f, 0x62, 0x6a, 0x65,
+  0x63, 0x74, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x3d, 0x3d, 0x3d, 0x20,
+  0x22, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x22, 0x20, 0x7c, 0x7c, 0x20,
+  0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x20,
+  0x3d, 0x3d, 0x3d, 0x20, 0x22, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x22,
+  0x20, 0x7c, 0x7c, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x6f, 0x62,
+  0x6a, 0x65, 0x63, 0x74, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x3d, 0x3d,
+  0x3d, 0x20, 0x22, 0x42, 0x69, 0x67, 0x49, 0x6e, 0x74, 0x22, 0x20, 0x7c,
+  0x7c, 0x20, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6c, 0x61, 0x73,
+  0x73, 0x20, 0x3d, 0x3d, 0x3d, 0x20, 0x22, 0x42, 0x6f, 0x6f, 0x6c, 0x65,
+  0x61, 0x6e, 0x22, 0x20, 0x7c, 0x7c, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20,
+  0x20, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6c, 0x61, 0x73, 0x73,
+  0x20, 0x3d, 0x3d, 0x3d, 0x20, 0x22, 0x44, 0x61, 0x74, 0x65, 0x22, 0x29,
+  0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20,
+  0x28, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4f, 0x66, 0x28, 0x61, 0x29, 0x20,
+  0x21, 0x3d, 0x3d, 0x20, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4f, 0x66, 0x28,
+  0x62, 0x29, 0x29, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x66,
+  0x61, 0x6c, 0x73, 0x65, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x7d, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x20, 0x64,
+  0x65, 0x65, 0x70, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x71, 0x75,
+  0x61, 0x6c, 0x73, 0x28, 0x61, 0x2c, 0x20, 0x62, 0x29, 0x3b, 0x0a, 0x20,
+  0x20, 0x7d, 0x0a, 0x0a, 0x20, 0x20, 0x61, 0x73, 0x73, 0x65, 0x72, 0x74,
+  0x45, 0x71, 0x75, 0x61, 0x6c, 0x73, 0x20, 0x3d, 0x20, 0x66, 0x75, 0x6e,
+  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x61, 0x73, 0x73, 0x65, 0x72, 0x74,
+  0x45, 0x71, 0x75, 0x61, 0x6c, 0x73, 0x28, 0x65, 0x78, 0x70, 0x65, 0x63,
+  0x74, 0x65, 0x64, 0x2c, 0x20, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x2c, 0x20,
+  0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x6f, 0x70, 0x74, 0x29, 0x20, 0x7b, 0x0a,
+  0x20, 0x20, 0x20, 0x20, 0x69, 0x66, 0x20, 0x28, 0x21, 0x64, 0x65, 0x65,
+  0x70, 0x45, 0x71, 0x75, 0x61, 0x6c, 0x73, 0x28, 0x66, 0x6f, 0x75, 0x6e,
+  0x64, 0x2c, 0x20, 0x65, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x29,
+  0x29, 0x20, 0x7b, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x66, 0x61,
+  0x69, 0x6c, 0x28, 0x50, 0x72, 0x65, 0x74, 0x74, 0x79, 0x50, 0x72, 0x69,
+  0x6e, 0x74, 0x28, 0x65, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x29,
+  0x2c, 0x20, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x2c, 0x20, 0x6e, 0x61, 0x6d,
+  0x65, 0x5f, 0x6f, 0x70, 0x74, 0x29, 0x3b, 0x0a, 0x20, 0x20, 0x20, 0x20,
+  0x7d, 0x0a, 0x20, 0x20, 0x7d, 0x3b, 0x0a, 0x7d, 0x29, 0x28, 0x29, 0x3b,
+  0x0a
+};
+unsigned int test_fuzzer_regexp_builtins_mjsunit_js_len = 5857;
diff --git a/deps/v8/test/fuzzer/testcfg.py b/deps/v8/test/fuzzer/testcfg.py
index b3fe174d950..8b90d5238c0 100644
--- a/deps/v8/test/fuzzer/testcfg.py
+++ b/deps/v8/test/fuzzer/testcfg.py
@@ -14,13 +14,13 @@ def _get_variants(self, test):
 
 
 class TestSuite(testsuite.TestSuite):
-  SUB_TESTS = ( 'json', 'parser', 'regexp', 'multi_return', 'wasm',
-          'wasm_async', 'wasm_call', 'wasm_code', 'wasm_compile',
+  SUB_TESTS = ( 'json', 'parser', 'regexp_builtins', 'regexp', 'multi_return', 'wasm',
+          'wasm_async', 'wasm_code', 'wasm_compile',
           'wasm_data_section', 'wasm_function_sigs_section',
           'wasm_globals_section', 'wasm_imports_section', 'wasm_memory_section',
           'wasm_names_section', 'wasm_types_section' )
 
-  def ListTests(self, context):
+  def ListTests(self):
     tests = []
     for subtest in TestSuite.SUB_TESTS:
       for fname in os.listdir(os.path.join(self.root, subtest)):
@@ -37,12 +37,9 @@ def _test_class(self):
   def _variants_gen_class(self):
     return VariantsGenerator
 
-  def _LegacyVariantsGeneratorFactory(self):
-    return testsuite.StandardLegacyVariantsGenerator
-
 
 class TestCase(testcase.TestCase):
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     suite, name = self.path.split('/')
     return [os.path.join(self.suite.root, suite, name)]
 
@@ -52,7 +49,7 @@ def _get_variant_flags(self):
   def _get_statusfile_flags(self):
     return []
 
-  def _get_mode_flags(self, ctx):
+  def _get_mode_flags(self):
     return []
 
   def get_shell(self):
@@ -60,5 +57,5 @@ def get_shell(self):
     return 'v8_simple_%s_fuzzer' % group
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/fuzzer/wasm-async.cc b/deps/v8/test/fuzzer/wasm-async.cc
index 4718601b0f9..703c5cc4c85 100644
--- a/deps/v8/test/fuzzer/wasm-async.cc
+++ b/deps/v8/test/fuzzer/wasm-async.cc
@@ -13,8 +13,7 @@
 #include "src/isolate.h"
 #include "src/objects-inl.h"
 #include "src/objects.h"
-#include "src/wasm/module-compiler.h"
-#include "src/wasm/wasm-api.h"
+#include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-module.h"
 #include "test/common/wasm/flag-utils.h"
 #include "test/common/wasm/wasm-module-runner.h"
@@ -93,8 +92,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
          Promise::Resolver::New(support->GetContext()));
   Local<Promise> promise = resolver->GetPromise();
 
-  AsyncCompile(i_isolate, Utils::OpenHandle(*promise),
-               ModuleWireBytes(data, data + size), false);
+  i_isolate->wasm_engine()->AsyncCompile(i_isolate, Utils::OpenHandle(*promise),
+                                         ModuleWireBytes(data, data + size),
+                                         false);
 
   ASSIGN(Function, instantiate_impl,
          Function::New(support->GetContext(), &InstantiateCallback,
diff --git a/deps/v8/test/fuzzer/wasm-call.cc b/deps/v8/test/fuzzer/wasm-call.cc
deleted file mode 100644
index 5c855023811..00000000000
--- a/deps/v8/test/fuzzer/wasm-call.cc
+++ /dev/null
@@ -1,134 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include <stddef.h>
-#include <stdint.h>
-
-#include "include/v8.h"
-#include "src/isolate.h"
-#include "src/objects-inl.h"
-#include "src/objects.h"
-#include "src/utils.h"
-#include "src/wasm/wasm-interpreter.h"
-#include "src/wasm/wasm-module-builder.h"
-#include "src/wasm/wasm-module.h"
-#include "test/common/wasm/test-signatures.h"
-#include "test/common/wasm/wasm-module-runner.h"
-#include "test/fuzzer/fuzzer-support.h"
-#include "test/fuzzer/wasm-fuzzer-common.h"
-
-namespace v8 {
-namespace internal {
-namespace wasm {
-namespace fuzzer {
-
-static constexpr uint32_t kMaxNumFunctions = 3;
-static constexpr uint32_t kMaxNumParams = 3;
-
-class WasmCallFuzzer : public WasmExecutionFuzzer {
-  template <typename V>
-  static inline V read_value(const uint8_t** data, size_t* size, bool* ok) {
-    // The status flag {ok} checks that the decoding up until now was okay, and
-    // that a value of type V can be read without problems.
-    *ok &= (*size > sizeof(V));
-    if (!(*ok)) return 0;
-    V result = ReadLittleEndianValue<V>(*data);
-    *data += sizeof(V);
-    *size -= sizeof(V);
-    return result;
-  }
-
-  static void add_argument(Isolate* isolate, ValueType type,
-                           WasmValue* interpreter_args,
-                           Handle<Object>* compiler_args, int* argc,
-                           const uint8_t** data, size_t* size, bool* ok) {
-    if (!(*ok)) return;
-    switch (type) {
-      case kWasmF32: {
-        float value = read_value<float>(data, size, ok);
-        interpreter_args[*argc] = WasmValue(value);
-        compiler_args[*argc] =
-            isolate->factory()->NewNumber(static_cast<double>(value));
-        break;
-      }
-      case kWasmF64: {
-        double value = read_value<double>(data, size, ok);
-        interpreter_args[*argc] = WasmValue(value);
-        compiler_args[*argc] = isolate->factory()->NewNumber(value);
-        break;
-      }
-      case kWasmI32: {
-        int32_t value = read_value<int32_t>(data, size, ok);
-        interpreter_args[*argc] = WasmValue(value);
-        compiler_args[*argc] =
-            isolate->factory()->NewNumber(static_cast<double>(value));
-        break;
-      }
-      default:
-        UNREACHABLE();
-    }
-    (*argc)++;
-  }
-
-  bool GenerateModule(
-      Isolate* isolate, Zone* zone, const uint8_t* data, size_t size,
-      ZoneBuffer& buffer, int32_t& num_args,
-      std::unique_ptr<WasmValue[]>& interpreter_args,
-      std::unique_ptr<Handle<Object>[]>& compiler_args) override {
-    bool ok = true;
-    uint8_t num_functions =
-        (read_value<uint8_t>(&data, &size, &ok) % kMaxNumFunctions) + 1;
-
-    ValueType types[] = {kWasmF32, kWasmF64, kWasmI32, kWasmI64};
-
-    interpreter_args.reset(new WasmValue[3]);
-    compiler_args.reset(new Handle<Object>[3]);
-
-    WasmModuleBuilder builder(zone);
-    for (int fun = 0; fun < num_functions; fun++) {
-      size_t num_params = static_cast<size_t>(
-          (read_value<uint8_t>(&data, &size, &ok) % kMaxNumParams) + 1);
-      FunctionSig::Builder sig_builder(zone, 1, num_params);
-      sig_builder.AddReturn(kWasmI32);
-      for (size_t param = 0; param < num_params; param++) {
-        // The main function cannot handle int64 parameters.
-        ValueType param_type = types[(read_value<uint8_t>(&data, &size, &ok) %
-                                      (arraysize(types) - (fun == 0 ? 1 : 0)))];
-        sig_builder.AddParam(param_type);
-        if (fun == 0) {
-          add_argument(isolate, param_type, interpreter_args.get(),
-                       compiler_args.get(), &num_args, &data, &size, &ok);
-        }
-      }
-      WasmFunctionBuilder* f = builder.AddFunction(sig_builder.Build());
-      uint32_t code_size = static_cast<uint32_t>(size / num_functions);
-      f->EmitCode(data, code_size);
-      uint8_t end_opcode = kExprEnd;
-      f->EmitCode(&end_opcode, 1);
-      data += code_size;
-      size -= code_size;
-      if (fun == 0) {
-        builder.AddExport(CStrVector("main"), f);
-      }
-    }
-
-    builder.SetMaxMemorySize(32);
-    builder.WriteTo(buffer);
-
-    if (!ok) {
-      // The input data was too short.
-      return 0;
-    }
-    return true;
-  }
-};
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  return WasmCallFuzzer().FuzzWasmModule(data, size);
-}
-
-}  // namespace fuzzer
-}  // namespace wasm
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/test/fuzzer/wasm-compile.cc b/deps/v8/test/fuzzer/wasm-compile.cc
index 4192a938e85..f4b2a912c62 100644
--- a/deps/v8/test/fuzzer/wasm-compile.cc
+++ b/deps/v8/test/fuzzer/wasm-compile.cc
@@ -31,6 +31,7 @@ namespace fuzzer {
 namespace {
 
 constexpr int kMaxFunctions = 4;
+constexpr int kMaxGlobals = 64;
 
 class DataRange {
   const uint8_t* data_;
@@ -137,6 +138,21 @@ class WasmGenerator {
     Generate<T>(data);
   }
 
+  enum IfType { kIf, kIfElse };
+
+  template <ValueType T, IfType type>
+  void if_(DataRange& data) {
+    static_assert(T == kWasmStmt || type == kIfElse,
+                  "if without else cannot produce a value");
+    Generate<kWasmI32>(data);
+    BlockScope block_scope(this, kExprIf, T, T);
+    Generate<T>(data);
+    if (type == kIfElse) {
+      builder_->Emit(kExprElse);
+      Generate<T>(data);
+    }
+  }
+
   void br(DataRange& data) {
     // There is always at least the block representing the function body.
     DCHECK(!blocks_.empty());
@@ -148,6 +164,20 @@ class WasmGenerator {
         kExprBr, static_cast<uint32_t>(blocks_.size()) - 1 - target_block);
   }
 
+  template <ValueType wanted_type>
+  void br_if(DataRange& data) {
+    // There is always at least the block representing the function body.
+    DCHECK(!blocks_.empty());
+    const uint32_t target_block = data.get<uint32_t>() % blocks_.size();
+    const ValueType break_type = blocks_[target_block];
+
+    Generate(break_type, data);
+    Generate(kWasmI32, data);
+    builder_->EmitWithI32V(
+        kExprBrIf, static_cast<uint32_t>(blocks_.size()) - 1 - target_block);
+    ConvertOrGenerate(break_type, wanted_type, data);
+  }
+
   // TODO(eholk): make this function constexpr once gcc supports it
   static uint8_t max_alignment(WasmOpcode memop) {
     switch (memop) {
@@ -234,6 +264,17 @@ class WasmGenerator {
     builder_->Emit(kConvertOpcodes[arr_idx]);
   }
 
+  void ConvertOrGenerate(ValueType src, ValueType dst, DataRange& data) {
+    if (src == dst) return;
+    if (src == kWasmStmt && dst != kWasmStmt) {
+      Generate(dst, data);
+    } else if (dst == kWasmStmt && src != kWasmStmt) {
+      builder_->Emit(kExprDrop);
+    } else {
+      Convert(src, dst);
+    }
+  }
+
   void call(DataRange& data, ValueType wanted_type) {
     int func_index = data.get<uint8_t>() % functions_.size();
     FunctionSig* sig = functions_[func_index];
@@ -258,15 +299,15 @@ class WasmGenerator {
     }
   }
 
-  struct Local {
+  struct Var {
     uint32_t index;
     ValueType type = kWasmStmt;
-    Local() = default;
-    Local(uint32_t index, ValueType type) : index(index), type(type) {}
+    Var() = default;
+    Var(uint32_t index, ValueType type) : index(index), type(type) {}
     bool is_valid() const { return type != kWasmStmt; }
   };
 
-  Local GetRandomLocal(DataRange& data) {
+  Var GetRandomLocal(DataRange& data) {
     uint32_t num_params =
         static_cast<uint32_t>(builder_->signature()->parameter_count());
     uint32_t num_locals = static_cast<uint32_t>(locals_.size());
@@ -279,7 +320,7 @@ class WasmGenerator {
 
   template <ValueType wanted_type>
   void local_op(DataRange& data, WasmOpcode opcode) {
-    Local local = GetRandomLocal(data);
+    Var local = GetRandomLocal(data);
     // If there are no locals and no parameters, just generate any value (if a
     // value is needed), or do nothing.
     if (!local.is_valid()) {
@@ -296,6 +337,7 @@ class WasmGenerator {
 
   template <ValueType wanted_type>
   void get_local(DataRange& data) {
+    static_assert(wanted_type != kWasmStmt, "illegal type");
     local_op<wanted_type>(data, kExprGetLocal);
   }
 
@@ -306,6 +348,46 @@ class WasmGenerator {
     local_op<wanted_type>(data, kExprTeeLocal);
   }
 
+  Var GetRandomGlobal(DataRange& data, bool ensure_mutable) {
+    uint32_t index;
+    if (ensure_mutable) {
+      if (mutable_globals_.empty()) return {};
+      index = mutable_globals_[data.get<uint8_t>() % mutable_globals_.size()];
+    } else {
+      if (globals_.empty()) return {};
+      index = data.get<uint8_t>() % globals_.size();
+    }
+    ValueType type = globals_[index];
+    return {index, type};
+  }
+
+  template <ValueType wanted_type>
+  void global_op(DataRange& data) {
+    constexpr bool is_set = wanted_type == kWasmStmt;
+    Var global = GetRandomGlobal(data, is_set);
+    // If there are no globals, just generate any value (if a value is needed),
+    // or do nothing.
+    if (!global.is_valid()) {
+      if (wanted_type == kWasmStmt) return;
+      return Generate<wanted_type>(data);
+    }
+
+    if (is_set) Generate(global.type, data);
+    builder_->EmitWithU32V(is_set ? kExprSetGlobal : kExprGetGlobal,
+                           global.index);
+    if (!is_set && global.type != wanted_type) {
+      Convert(global.type, wanted_type);
+    }
+  }
+
+  template <ValueType wanted_type>
+  void get_global(DataRange& data) {
+    static_assert(wanted_type != kWasmStmt, "illegal type");
+    global_op<wanted_type>(data);
+  }
+
+  void set_global(DataRange& data) { global_op<kWasmStmt>(data); }
+
   template <ValueType T1, ValueType T2>
   void sequence(DataRange& data) {
     Generate<T1, T2>(data);
@@ -343,8 +425,13 @@ class WasmGenerator {
 
  public:
   WasmGenerator(WasmFunctionBuilder* fn,
-                const std::vector<FunctionSig*>& functions, DataRange& data)
-      : builder_(fn), functions_(functions) {
+                const std::vector<FunctionSig*>& functions,
+                const std::vector<ValueType>& globals,
+                const std::vector<uint8_t>& mutable_globals, DataRange& data)
+      : builder_(fn),
+        functions_(functions),
+        globals_(globals),
+        mutable_globals_(mutable_globals) {
     FunctionSig* sig = fn->signature();
     DCHECK_GE(1, sig->return_count());
     blocks_.push_back(sig->return_count() == 0 ? kWasmStmt : sig->GetReturn(0));
@@ -375,6 +462,8 @@ class WasmGenerator {
   std::vector<ValueType> blocks_;
   const std::vector<FunctionSig*>& functions_;
   std::vector<ValueType> locals_;
+  std::vector<ValueType> globals_;
+  std::vector<uint8_t> mutable_globals_;  // indexes into {globals_}.
   uint32_t recursion_depth = 0;
 
   static constexpr uint32_t kMaxRecursionDepth = 64;
@@ -390,9 +479,13 @@ void WasmGenerator::Generate<kWasmStmt>(DataRange& data) {
   if (recursion_limit_reached() || data.size() == 0) return;
 
   constexpr generate_fn alternates[] = {
+      &WasmGenerator::sequence<kWasmStmt, kWasmStmt>,
       &WasmGenerator::block<kWasmStmt>,
       &WasmGenerator::loop<kWasmStmt>,
+      &WasmGenerator::if_<kWasmStmt, kIf>,
+      &WasmGenerator::if_<kWasmStmt, kIfElse>,
       &WasmGenerator::br,
+      &WasmGenerator::br_if<kWasmStmt>,
 
       &WasmGenerator::memop<kExprI32StoreMem, kWasmI32>,
       &WasmGenerator::memop<kExprI32StoreMem8, kWasmI32>,
@@ -408,7 +501,8 @@ void WasmGenerator::Generate<kWasmStmt>(DataRange& data) {
 
       &WasmGenerator::call<kWasmStmt>,
 
-      &WasmGenerator::set_local};
+      &WasmGenerator::set_local,
+      &WasmGenerator::set_global};
 
   GenerateOneOf(alternates, data);
 }
@@ -481,6 +575,8 @@ void WasmGenerator::Generate<kWasmI32>(DataRange& data) {
 
       &WasmGenerator::block<kWasmI32>,
       &WasmGenerator::loop<kWasmI32>,
+      &WasmGenerator::if_<kWasmI32, kIfElse>,
+      &WasmGenerator::br_if<kWasmI32>,
 
       &WasmGenerator::memop<kExprI32LoadMem>,
       &WasmGenerator::memop<kExprI32LoadMem8S>,
@@ -493,6 +589,7 @@ void WasmGenerator::Generate<kWasmI32>(DataRange& data) {
 
       &WasmGenerator::get_local<kWasmI32>,
       &WasmGenerator::tee_local<kWasmI32>,
+      &WasmGenerator::get_global<kWasmI32>,
 
       &WasmGenerator::call<kWasmI32>};
 
@@ -534,6 +631,8 @@ void WasmGenerator::Generate<kWasmI64>(DataRange& data) {
 
       &WasmGenerator::block<kWasmI64>,
       &WasmGenerator::loop<kWasmI64>,
+      &WasmGenerator::if_<kWasmI64, kIfElse>,
+      &WasmGenerator::br_if<kWasmI64>,
 
       &WasmGenerator::memop<kExprI64LoadMem>,
       &WasmGenerator::memop<kExprI64LoadMem8S>,
@@ -545,6 +644,7 @@ void WasmGenerator::Generate<kWasmI64>(DataRange& data) {
 
       &WasmGenerator::get_local<kWasmI64>,
       &WasmGenerator::tee_local<kWasmI64>,
+      &WasmGenerator::get_global<kWasmI64>,
 
       &WasmGenerator::call<kWasmI64>};
 
@@ -568,11 +668,14 @@ void WasmGenerator::Generate<kWasmF32>(DataRange& data) {
 
       &WasmGenerator::block<kWasmF32>,
       &WasmGenerator::loop<kWasmF32>,
+      &WasmGenerator::if_<kWasmF32, kIfElse>,
+      &WasmGenerator::br_if<kWasmF32>,
 
       &WasmGenerator::memop<kExprF32LoadMem>,
 
       &WasmGenerator::get_local<kWasmF32>,
       &WasmGenerator::tee_local<kWasmF32>,
+      &WasmGenerator::get_global<kWasmF32>,
 
       &WasmGenerator::call<kWasmF32>};
 
@@ -596,11 +699,14 @@ void WasmGenerator::Generate<kWasmF64>(DataRange& data) {
 
       &WasmGenerator::block<kWasmF64>,
       &WasmGenerator::loop<kWasmF64>,
+      &WasmGenerator::if_<kWasmF64, kIfElse>,
+      &WasmGenerator::br_if<kWasmF64>,
 
       &WasmGenerator::memop<kExprF64LoadMem>,
 
       &WasmGenerator::get_local<kWasmF64>,
       &WasmGenerator::tee_local<kWasmF64>,
+      &WasmGenerator::get_global<kWasmF64>,
 
       &WasmGenerator::call<kWasmF64>};
 
@@ -664,6 +770,22 @@ class WasmCompileFuzzer : public WasmExecutionFuzzer {
       function_signatures.push_back(GenerateSig(zone, range));
     }
 
+    int num_globals = range.get<uint8_t>() % (kMaxGlobals + 1);
+    std::vector<ValueType> globals;
+    std::vector<uint8_t> mutable_globals;
+    globals.reserve(num_globals);
+    mutable_globals.reserve(num_globals);
+
+    for (int i = 0; i < num_globals; ++i) {
+      ValueType type = GetValueType(range);
+      const bool exported = range.get<bool>();
+      // 1/8 of globals are immutable.
+      const bool mutability = (range.get<uint8_t>() % 8) != 0;
+      builder.AddGlobal(type, exported, mutability, WasmInitExpr());
+      globals.push_back(type);
+      if (mutability) mutable_globals.push_back(static_cast<uint8_t>(i));
+    }
+
     for (int i = 0; i < num_functions; ++i) {
       DataRange function_range =
           i == num_functions - 1 ? std::move(range) : range.split();
@@ -671,7 +793,8 @@ class WasmCompileFuzzer : public WasmExecutionFuzzer {
       FunctionSig* sig = function_signatures[i];
       WasmFunctionBuilder* f = builder.AddFunction(sig);
 
-      WasmGenerator gen(f, function_signatures, function_range);
+      WasmGenerator gen(f, function_signatures, globals, mutable_globals,
+                        function_range);
       ValueType return_type =
           sig->return_count() == 0 ? kWasmStmt : sig->GetReturn(0);
       gen.Generate(return_type, function_range);
diff --git a/deps/v8/test/fuzzer/wasm-fuzzer-common.cc b/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
index 46f51334862..b2e0b4bd2bf 100644
--- a/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
+++ b/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
@@ -7,8 +7,6 @@
 #include "include/v8.h"
 #include "src/isolate.h"
 #include "src/objects-inl.h"
-#include "src/wasm/module-compiler.h"
-#include "src/wasm/wasm-api.h"
 #include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-module-builder.h"
 #include "src/wasm/wasm-module.h"
@@ -68,26 +66,40 @@ int FuzzWasmSection(SectionCode section, const uint8_t* data, size_t size) {
 
 void InterpretAndExecuteModule(i::Isolate* isolate,
                                Handle<WasmModuleObject> module_object) {
-  ScheduledErrorThrower thrower(isolate, "WebAssembly Instantiation");
-  // Try to instantiate and interpret the module_object.
-  MaybeHandle<WasmInstanceObject> maybe_instance =
-      SyncInstantiate(isolate, &thrower, module_object,
-                      Handle<JSReceiver>::null(),     // imports
-                      MaybeHandle<JSArrayBuffer>());  // memory
+  ErrorThrower thrower(isolate, "WebAssembly Instantiation");
+  MaybeHandle<WasmInstanceObject> maybe_instance;
   Handle<WasmInstanceObject> instance;
-  if (!maybe_instance.ToHandle(&instance)) return;
+
+  // Try to instantiate and interpret the module_object.
+  maybe_instance = isolate->wasm_engine()->SyncInstantiate(
+      isolate, &thrower, module_object,
+      Handle<JSReceiver>::null(),     // imports
+      MaybeHandle<JSArrayBuffer>());  // memory
+  if (!maybe_instance.ToHandle(&instance)) {
+    isolate->clear_pending_exception();
+    thrower.Reset();  // Ignore errors.
+    return;
+  }
   if (!testing::InterpretWasmModuleForTesting(isolate, instance, "main", 0,
                                               nullptr)) {
+    isolate->clear_pending_exception();
     return;
   }
 
-  // Instantiate and execute the module_object.
-  maybe_instance = SyncInstantiate(isolate, &thrower, module_object,
-                                   Handle<JSReceiver>::null(),     // imports
-                                   MaybeHandle<JSArrayBuffer>());  // memory
-  if (!maybe_instance.ToHandle(&instance)) return;
-
-  testing::RunWasmModuleForTesting(isolate, instance, 0, nullptr);
+  // Try to instantiate and execute the module_object.
+  maybe_instance = isolate->wasm_engine()->SyncInstantiate(
+      isolate, &thrower, module_object,
+      Handle<JSReceiver>::null(),     // imports
+      MaybeHandle<JSArrayBuffer>());  // memory
+  if (!maybe_instance.ToHandle(&instance)) {
+    isolate->clear_pending_exception();
+    thrower.Reset();  // Ignore errors.
+    return;
+  }
+  if (testing::RunWasmModuleForTesting(isolate, instance, 0, nullptr) < 0) {
+    isolate->clear_pending_exception();
+    return;
+  }
 }
 
 namespace {
@@ -123,6 +135,15 @@ std::ostream& operator<<(std::ostream& os, const PrintSig& print) {
   return os << "]";
 }
 
+struct PrintName {
+  WasmName name;
+  PrintName(ModuleWireBytes wire_bytes, WireBytesRef ref)
+      : name(wire_bytes.GetNameOrNull(ref)) {}
+};
+std::ostream& operator<<(std::ostream& os, const PrintName& name) {
+  return os.write(name.name.start(), name.name.size());
+}
+
 void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
                       bool compiles) {
   constexpr bool kVerifyFunctions = false;
@@ -144,7 +165,7 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
         "load('test/mjsunit/wasm/wasm-module-builder.js');\n"
         "\n"
         "(function() {\n"
-        "  var builder = new WasmModuleBuilder();\n";
+        "  const builder = new WasmModuleBuilder();\n";
 
   if (module->has_memory) {
     os << "  builder.addMemory(" << module->initial_pages;
@@ -155,18 +176,24 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
     }
   }
 
+  for (WasmGlobal& glob : module->globals) {
+    os << "  builder.addGlobal(" << ValueTypeToConstantName(glob.type) << ", "
+       << glob.mutability << ");\n";
+  }
+
   Zone tmp_zone(isolate->allocator(), ZONE_NAME);
 
   for (const WasmFunction& func : module->functions) {
     Vector<const uint8_t> func_code = wire_bytes.GetFunctionBytes(&func);
-    os << "  // Generate function " << func.func_index + 1 << " of "
-       << module->functions.size() << ".\n";
+    os << "  // Generate function " << (func.func_index + 1) << " (out of "
+       << module->functions.size() << ").\n";
     // Generate signature.
-    os << "  sig" << func.func_index << " = makeSig("
+    os << "  sig" << (func.func_index + 1) << " = makeSig("
        << PrintParameters(func.sig) << ", " << PrintReturns(func.sig) << ");\n";
 
     // Add function.
-    os << "  builder.addFunction(undefined, sig" << func.func_index << ")\n";
+    os << "  builder.addFunction(undefined, sig" << (func.func_index + 1)
+       << ")\n";
 
     // Add locals.
     BodyLocalDecls decls(&tmp_zone);
@@ -190,16 +217,21 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
     FunctionBody func_body(func.sig, func.code.offset(), func_code.start(),
                            func_code.end());
     PrintRawWasmCode(isolate->allocator(), func_body, module, kOmitLocals);
-    os << "            ])";
-    if (func.func_index == 0) os << "\n            .exportAs('main')";
-    os << ";\n ";
+    os << "            ]);\n";
+  }
+
+  for (WasmExport& exp : module->export_table) {
+    if (exp.kind != kExternalFunction) continue;
+    os << "  builder.addExport('" << PrintName(wire_bytes, exp.name) << "', "
+       << exp.index << ");\n";
   }
 
   if (compiles) {
-    os << "  var module = builder.instantiate();\n"
-          "  module.exports.main(1, 2, 3);\n";
+    os << "  const instance = builder.instantiate();\n"
+          "  print(instance.exports.main(1, 2, 3));\n";
   } else {
-    os << "  assertThrows(function() { builder.instantiate(); });\n";
+    os << "  assertThrows(function() { builder.instantiate(); }, "
+          "WebAssembly.CompileError);\n";
   }
   os << "})();\n";
 }
@@ -241,7 +273,8 @@ int WasmExecutionFuzzer::FuzzWasmModule(const uint8_t* data, size_t size,
   MaybeHandle<WasmModuleObject> compiled_module;
   {
     FlagScope<bool> no_liftoff(&FLAG_liftoff, false);
-    compiled_module = SyncCompile(i_isolate, &interpreter_thrower, wire_bytes);
+    compiled_module = i_isolate->wasm_engine()->SyncCompile(
+        i_isolate, &interpreter_thrower, wire_bytes);
   }
   bool compiles = !compiled_module.is_null();
 
@@ -260,9 +293,10 @@ int WasmExecutionFuzzer::FuzzWasmModule(const uint8_t* data, size_t size,
   int32_t result_interpreter;
   bool possible_nondeterminism = false;
   {
-    MaybeHandle<WasmInstanceObject> interpreter_instance = SyncInstantiate(
-        i_isolate, &interpreter_thrower, compiled_module.ToHandleChecked(),
-        MaybeHandle<JSReceiver>(), MaybeHandle<JSArrayBuffer>());
+    MaybeHandle<WasmInstanceObject> interpreter_instance =
+        i_isolate->wasm_engine()->SyncInstantiate(
+            i_isolate, &interpreter_thrower, compiled_module.ToHandleChecked(),
+            MaybeHandle<JSReceiver>(), MaybeHandle<JSArrayBuffer>());
 
     // Ignore instantiation failure.
     if (interpreter_thrower.error()) {
@@ -286,9 +320,10 @@ int WasmExecutionFuzzer::FuzzWasmModule(const uint8_t* data, size_t size,
   int32_t result_turbofan;
   {
     ErrorThrower compiler_thrower(i_isolate, "Turbofan");
-    MaybeHandle<WasmInstanceObject> compiled_instance = SyncInstantiate(
-        i_isolate, &compiler_thrower, compiled_module.ToHandleChecked(),
-        MaybeHandle<JSReceiver>(), MaybeHandle<JSArrayBuffer>());
+    MaybeHandle<WasmInstanceObject> compiled_instance =
+        i_isolate->wasm_engine()->SyncInstantiate(
+            i_isolate, &compiler_thrower, compiled_module.ToHandleChecked(),
+            MaybeHandle<JSReceiver>(), MaybeHandle<JSArrayBuffer>());
 
     DCHECK(!compiler_thrower.error());
     result_turbofan = testing::CallWasmFunctionForTesting(
@@ -315,9 +350,8 @@ int WasmExecutionFuzzer::FuzzWasmModule(const uint8_t* data, size_t size,
     ErrorThrower compiler_thrower(i_isolate, "Liftoff");
     // Re-compile with Liftoff.
     MaybeHandle<WasmInstanceObject> compiled_instance =
-        SyncCompileAndInstantiate(i_isolate, &compiler_thrower, wire_bytes,
-                                  MaybeHandle<JSReceiver>(),
-                                  MaybeHandle<JSArrayBuffer>());
+        testing::CompileAndInstantiateForTesting(i_isolate, &compiler_thrower,
+                                                 wire_bytes);
     DCHECK(!compiler_thrower.error());
     result_liftoff = testing::CallWasmFunctionForTesting(
         i_isolate, compiled_instance.ToHandleChecked(), &compiler_thrower,
diff --git a/deps/v8/test/fuzzer/wasm.cc b/deps/v8/test/fuzzer/wasm.cc
index 567e68b40a1..99642b1182f 100644
--- a/deps/v8/test/fuzzer/wasm.cc
+++ b/deps/v8/test/fuzzer/wasm.cc
@@ -12,7 +12,7 @@
 #include "src/isolate.h"
 #include "src/objects-inl.h"
 #include "src/objects.h"
-#include "src/wasm/module-compiler.h"
+#include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-module.h"
 #include "test/common/wasm/flag-utils.h"
 #include "test/common/wasm/wasm-module-runner.h"
@@ -42,8 +42,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
 
   i::HandleScope scope(i_isolate);
   i::wasm::ErrorThrower thrower(i_isolate, "wasm fuzzer");
-  i::MaybeHandle<i::WasmModuleObject> maybe_object = SyncCompile(
-      i_isolate, &thrower, i::wasm::ModuleWireBytes(data, data + size));
+  i::MaybeHandle<i::WasmModuleObject> maybe_object =
+      i_isolate->wasm_engine()->SyncCompile(
+          i_isolate, &thrower, i::wasm::ModuleWireBytes(data, data + size));
   i::Handle<i::WasmModuleObject> module_object;
   if (maybe_object.ToHandle(&module_object)) {
     i::wasm::fuzzer::InterpretAndExecuteModule(i_isolate, module_object);
diff --git a/deps/v8/test/inspector/BUILD.gn b/deps/v8/test/inspector/BUILD.gn
index eec613b2127..0999e19b89c 100644
--- a/deps/v8/test/inspector/BUILD.gn
+++ b/deps/v8/test/inspector/BUILD.gn
@@ -28,6 +28,26 @@ v8_executable("inspector-test") {
     "//build/win:default_exe_manifest",
   ]
 
+  data_deps = [
+    "../../tools:v8_testrunner",
+  ]
+
+  data = [
+    "console/",
+    "cpu-profiler/",
+    "debugger/",
+    "heap-profiler/",
+    "inspector.status",
+    "json-parse-expected.txt",
+    "json-parse.js",
+    "protocol-test.js",
+    "runtime/",
+    "sessions/",
+    "testcfg.py",
+    "type-profiler/",
+    "../../src/inspector/injected-script-source.js",
+  ]
+
   cflags = []
   ldflags = []
 }
diff --git a/deps/v8/test/inspector/debugger/break-locations-await-expected.txt b/deps/v8/test/inspector/debugger/break-locations-await-expected.txt
index 1bf0317b219..15304c20735 100644
--- a/deps/v8/test/inspector/debugger/break-locations-await-expected.txt
+++ b/deps/v8/test/inspector/debugger/break-locations-await-expected.txt
@@ -5,11 +5,11 @@ Running test: testBreakLocations
 function testFunction() {
   async function f1() {
     for (let x = |_|0; x |_|< 1; ++|_|x) |_|await x;
-    |_|return await Promise.|C|resolve(2);
+    |_|return |_|await Promise.|C|resolve(2);
   |R|}
 
   async function f2() {
-    let r = |_|await |C|f1() + await |C|f1();
+    let r = |_|await |C|f1() + |_|await |C|f1();
     |_|await |C|f1();
     |_|await |C|f1().|C|then(x => x |_|* 2|R|);
     |_|await [1].|C|map(x => Promise.|C|resolve(x)|R|)[0];
diff --git a/deps/v8/test/inspector/debugger/cleanup-old-failed-to-parse-anonymous-scripts-expected.txt b/deps/v8/test/inspector/debugger/cleanup-old-failed-to-parse-anonymous-scripts-expected.txt
new file mode 100644
index 00000000000..8bb4fd211f8
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/cleanup-old-failed-to-parse-anonymous-scripts-expected.txt
@@ -0,0 +1,17 @@
+Checks that inspector collects old faied to parse anonymous scripts.
+Generate 1000 scriptFailedToParse events
+error:0
+success:1000
+Generate three scriptFailedToParse event for non anonymous script
+error:0
+success:1003
+Generate one more scriptFailedToParse event for anonymous script
+error:100
+success:904
+Check that latest script is still available
+{
+    id : <messageId>
+    result : {
+        scriptSource : }
+    }
+}
diff --git a/deps/v8/test/inspector/debugger/cleanup-old-failed-to-parse-anonymous-scripts.js b/deps/v8/test/inspector/debugger/cleanup-old-failed-to-parse-anonymous-scripts.js
new file mode 100644
index 00000000000..dfe0fb6493c
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/cleanup-old-failed-to-parse-anonymous-scripts.js
@@ -0,0 +1,49 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+    'Checks that inspector collects old faied to parse anonymous scripts.');
+
+(async function main() {
+  Protocol.Debugger.enable();
+  const scriptIds = [];
+  Protocol.Debugger.onScriptFailedToParse(
+      message => scriptIds.push(message.params.scriptId));
+  InspectorTest.log('Generate 1000 scriptFailedToParse events');
+  await Protocol.Runtime.evaluate({
+    expression: `for (var i = 0; i < 1000; ++i) {
+      try { JSON.parse('}'); } catch(e) {}
+    }`
+  });
+  await dumpScriptIdsStats(scriptIds);
+  InspectorTest.log(
+      'Generate three scriptFailedToParse event for non anonymous script');
+  for (var i = 0; i < 3; ++i) {
+    await Protocol.Runtime.evaluate({expression: '}//# sourceURL=foo.js'});
+  }
+  await dumpScriptIdsStats(scriptIds);
+  InspectorTest.log(
+      'Generate one more scriptFailedToParse event for anonymous script');
+  await Protocol.Runtime.evaluate(
+      {expression: `try {JSON.parse('}');} catch(e){}`});
+  await dumpScriptIdsStats(scriptIds);
+  InspectorTest.log('Check that latest script is still available');
+  InspectorTest.logMessage(await Protocol.Debugger.getScriptSource(
+      {scriptId: scriptIds[scriptIds.length - 1]}));
+  InspectorTest.completeTest();
+})();
+
+async function dumpScriptIdsStats(scriptIds) {
+  let errors = 0;
+  let success = 0;
+  for (let scriptId of scriptIds) {
+    const result =
+        await Protocol.Debugger.getScriptSource({scriptId: scriptId});
+    if (result.error)
+      ++errors;
+    else
+      ++success;
+  }
+  InspectorTest.log(`error:${errors}\nsuccess:${success}`);
+}
diff --git a/deps/v8/test/inspector/debugger/es6-module-script-parsed-expected.txt b/deps/v8/test/inspector/debugger/es6-module-script-parsed-expected.txt
index 7639ab65377..b8d920692fc 100644
--- a/deps/v8/test/inspector/debugger/es6-module-script-parsed-expected.txt
+++ b/deps/v8/test/inspector/debugger/es6-module-script-parsed-expected.txt
@@ -8,7 +8,7 @@ Running test: testLoadedModulesOnDebuggerEnable
         endLine : 3
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : F8E59942466284E2766FD161CA6FFD024048A807
+        hash : 03b276dd81b75bf832afbeccbbd273c62dad100c
         isLiveEdit : false
         isModule : true
         length : 39
@@ -28,7 +28,7 @@ Running test: testScriptEventsWhenDebuggerIsEnabled
         endLine : 3
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : F8E59942466284E2766FD161CA6FFD024048A807
+        hash : 03b276dd81b75bf832afbeccbbd273c62dad100c
         isLiveEdit : false
         isModule : true
         length : 39
@@ -46,7 +46,7 @@ Running test: testScriptEventsWhenDebuggerIsEnabled
         endLine : 0
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : FF746120E4E4F1BA4CB5762843D429DC872EBA18
+        hash : 021647ffab1f4e4e82675bc4cd924d3481abe278
         isModule : true
         length : 1
         scriptId : <scriptId>
diff --git a/deps/v8/test/inspector/debugger/eval-without-codegen-expected.txt b/deps/v8/test/inspector/debugger/eval-without-codegen-expected.txt
new file mode 100644
index 00000000000..04de9bb2269
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/eval-without-codegen-expected.txt
@@ -0,0 +1,32 @@
+Tests that evaluation works when code generation from strings is not allowed.
+
+Running test: testEvaluateNotPaused
+{
+    id : <messageId>
+    result : {
+        result : {
+            type : string
+            value : Global1
+        }
+    }
+}
+
+Running test: testEvaluatePaused
+{
+    id : <messageId>
+    result : {
+        result : {
+            type : string
+            value : Global2
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        result : {
+            type : string
+            value : Local
+        }
+    }
+}
diff --git a/deps/v8/test/inspector/debugger/eval-without-codegen.js b/deps/v8/test/inspector/debugger/eval-without-codegen.js
new file mode 100644
index 00000000000..18600d87a93
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/eval-without-codegen.js
@@ -0,0 +1,38 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+    'Tests that evaluation works when code generation from strings is not allowed.');
+
+Protocol.Debugger.enable();
+Protocol.Runtime.enable();
+
+InspectorTest.runAsyncTestSuite([
+  async function testEvaluateNotPaused() {
+    contextGroup.addScript(`inspector.setAllowCodeGenerationFromStrings(false);
+    var global1 = 'Global1';`);
+    await Protocol.Debugger.onceScriptParsed();
+    InspectorTest.logMessage(
+        await Protocol.Runtime.evaluate({expression: 'global1'}));
+  },
+
+  async function testEvaluatePaused() {
+    contextGroup.addScript(`inspector.setAllowCodeGenerationFromStrings(false);
+    var global2 = 'Global2';
+    function foo(x) {
+      var local = 'Local';
+      debugger;
+      return local + x;
+    }
+    foo();`);
+    let {params: {callFrames: [{callFrameId}]}} =
+        await Protocol.Debugger.oncePaused();
+
+    InspectorTest.logMessage(
+        await Protocol.Runtime.evaluate({expression: 'global2'}));
+    InspectorTest.logMessage(await Protocol.Debugger.evaluateOnCallFrame(
+        {callFrameId, expression: 'local'}));
+    await Protocol.Debugger.resume();
+  }
+]);
diff --git a/deps/v8/test/inspector/debugger/get-possible-breakpoints-lazy-error-expected.txt b/deps/v8/test/inspector/debugger/get-possible-breakpoints-lazy-error-expected.txt
index 9c65ba23254..41f9328f7d2 100644
--- a/deps/v8/test/inspector/debugger/get-possible-breakpoints-lazy-error-expected.txt
+++ b/deps/v8/test/inspector/debugger/get-possible-breakpoints-lazy-error-expected.txt
@@ -6,7 +6,7 @@ getPossibleBreakpoints should not crash during lazy compilation (crbug.com/71533
         endLine : 2
         executionContextId : <executionContextId>
         hasSourceURL : true
-        hash : FA2A959297747012766FE9C5006E7F522D88FA72
+        hash : 124cb0278e3aa9f250651d433cdefeb5618c7202
         isLiveEdit : false
         isModule : false
         length : 52
diff --git a/deps/v8/test/inspector/debugger/get-possible-breakpoints-master-expected.txt b/deps/v8/test/inspector/debugger/get-possible-breakpoints-master-expected.txt
index c304fe677b1..66793867844 100644
--- a/deps/v8/test/inspector/debugger/get-possible-breakpoints-master-expected.txt
+++ b/deps/v8/test/inspector/debugger/get-possible-breakpoints-master-expected.txt
@@ -152,7 +152,7 @@ function testSwitch() {
   }
 |R|}
 
-function* idMaker() {
+function* idMaker|_|() {
   |_|yield 1;
   |_|yield 2;
   |_|yield 3;
@@ -230,8 +230,8 @@ async function testPromiseAsyncWithCode() {
       |_|await p;
     |R|}
     |C|setTimeout(returnCall, 0);
-    await |C|foo();
-    await |C|foo();
+    |_|await |C|foo();
+    |_|await |C|foo();
     |C|nextTest();
   |R|}
   |C|main();
@@ -252,7 +252,7 @@ async function testPromiseComplex() {
     |R|}
     var x = |_|1;
     var y = |_|2;
-    |C|returnFunction(|C|emptyFunction(), x++, --y, x => 2 |_|* x|R|, |C|returnCall())|C|().a = await |C|foo((a => 2 |_|*a|R|)|C|(5));
+    |C|returnFunction(|C|emptyFunction(), x++, --y, x => 2 |_|* x|R|, |C|returnCall())|C|().a = |_|await |C|foo((a => 2 |_|*a|R|)|C|(5));
     |C|nextTest();
   |R|}
   |C|main();
diff --git a/deps/v8/test/inspector/debugger/object-preview-internal-properties-expected.txt b/deps/v8/test/inspector/debugger/object-preview-internal-properties-expected.txt
index 394c1be7c95..9173fe7e707 100644
--- a/deps/v8/test/inspector/debugger/object-preview-internal-properties-expected.txt
+++ b/deps/v8/test/inspector/debugger/object-preview-internal-properties-expected.txt
@@ -35,6 +35,13 @@ expression: Object(Symbol(42))
     }
 }
 
+expression: Object(BigInt(2))
+{
+    name : [[PrimitiveValue]]
+    type : bigint
+    value : 2n
+}
+
 
 Running test: promise
 expression: Promise.resolve(42)
diff --git a/deps/v8/test/inspector/debugger/object-preview-internal-properties.js b/deps/v8/test/inspector/debugger/object-preview-internal-properties.js
index 6c655d1f03b..a8e6bef6376 100644
--- a/deps/v8/test/inspector/debugger/object-preview-internal-properties.js
+++ b/deps/v8/test/inspector/debugger/object-preview-internal-properties.js
@@ -1,6 +1,8 @@
 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+// TODO(luoe): remove flag when it is on by default.
+// Flags: --harmony-bigint
 
 let {session, contextGroup, Protocol} = InspectorTest.start("Check internal properties reported in object preview.");
 
@@ -17,6 +19,7 @@ InspectorTest.runTestSuite([
       .then(() => checkExpression("new Boolean(false)"))
       .then(() => checkExpression("new String(\"abc\")"))
       .then(() => checkExpression("Object(Symbol(42))"))
+      .then(() => checkExpression("Object(BigInt(2))"))
       .then(next);
   },
 
diff --git a/deps/v8/test/inspector/debugger/script-on-after-compile-expected.txt b/deps/v8/test/inspector/debugger/script-on-after-compile-expected.txt
index 53e24c00276..702026b2e0d 100644
--- a/deps/v8/test/inspector/debugger/script-on-after-compile-expected.txt
+++ b/deps/v8/test/inspector/debugger/script-on-after-compile-expected.txt
@@ -8,7 +8,7 @@ scriptParsed
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : 2ACD11425BF645075D5696189A7BA7EB4048D6F7
+    hash : 1912c266357e416d5e19323209ce6b851f2e0f2c
     isLiveEdit : false
     isModule : false
     length : 42
@@ -27,7 +27,7 @@ scriptParsed
     endLine : 0
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : 0CD3C4132CE40E415D5696189A7BA7EB4048D6F7
+    hash : 10f9f2639b93aaa6175107400af8e91f3b0f471b
     isLiveEdit : false
     isModule : false
     length : 52
@@ -46,7 +46,7 @@ scriptParsed
     endLine : 2
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : 0E35E860580550805D5681F7BCD47D855B794EB3
+    hash : 0f8af679a498b4814efa01b934ce49ca06bf4ee7
     isLiveEdit : false
     isModule : false
     length : 43
@@ -65,7 +65,7 @@ scriptParsed
     endLine : 3
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : AD4760425BF645075D5681F7D1786BD4DA9A86A7
+    hash : 2cc1f4f316e466c0110dc50790dd520e45de6763
     isLiveEdit : false
     isModule : false
     length : 46
@@ -84,7 +84,7 @@ scriptParsed
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 3E60CE61913387795D5696189A7BA7EB4048B715
+    hash : 127829554266b55666f9cf02c2c7a05463c8c723
     isLiveEdit : false
     isModule : false
     length : 50
@@ -103,7 +103,7 @@ scriptParsed
     endLine : 0
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 3E60CE617215C621E8825B319A7BA7EB4048B715
+    hash : 1385e0fc24082a91521585943bfcce52262a7f4b
     isLiveEdit : false
     isModule : false
     length : 60
@@ -122,7 +122,7 @@ scriptParsed
     endLine : 2
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : F2A32D219EFACBF470C48663BCD47D85864D1A22
+    hash : 2b15af1d4127ae68644e0ce4443021185dbe2d2f
     isLiveEdit : false
     isModule : false
     length : 51
@@ -141,7 +141,7 @@ scriptParsed
     endLine : 3
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 46927EC1BFB78C355D5681F7D1786BD4216D5124
+    hash : 0036aba78093d0cf2ee6350c84b06ffe53aff63e
     isLiveEdit : false
     isModule : false
     length : 54
@@ -160,7 +160,7 @@ scriptParsed
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : 793E2411EDECF405E8825B31460F7CD9A656E096
+    hash : 374ed6be308871fa14f434e504168cba446836db
     isLiveEdit : false
     isModule : false
     length : 88
@@ -179,7 +179,7 @@ scriptParsed
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : DED761235CC24EE21D0E9277CF599B5A292D8053
+    hash : 0db017360f0b77f12660e00ca287b54b602a6795
     isLiveEdit : false
     isModule : false
     length : 89
@@ -198,7 +198,7 @@ scriptParsed
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : 9CF28A415BF64507692D5A84D1786BD4437C3511
+    hash : 096615cf17450c8153564f8c77c9b0421927e011
     isLiveEdit : false
     isModule : false
     length : 40
@@ -217,7 +217,7 @@ scriptParsed
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : BEE49C625BF64507692D5A84D1786BD4437C3511
+    hash : 1314f0ef0397feb553564f8c405d35f91927e011
     isLiveEdit : false
     isModule : false
     length : 41
@@ -236,7 +236,7 @@ scriptParsed
     endLine : 0
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 9CF28A415BF64507692D5A8443D429DC872EBA18
+    hash : 033b33d18f0514168154be7f45f542e4811403e2
     isLiveEdit : false
     isModule : false
     length : 18
@@ -255,7 +255,7 @@ scriptParsed
     endLine : 0
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : D26251F019679C792E2B4EF437A20E96134D5C26
+    hash : 01fcc474486991b12de451e963f458f0767397c8
     isLiveEdit : false
     isModule : false
     length : 96
@@ -274,7 +274,7 @@ scriptParsed
     endLine : 0
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : 814AEF635BF64507692D5A84BCD47D85C4031CD2
+    hash : 06c3a0dd6160579b49d51af109a969910e2e33fd
     isLiveEdit : false
     isModule : false
     length : 39
@@ -293,7 +293,7 @@ scriptParsed
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 9CF28A415BF64507692D5A84A8DC8126872EBA18
+    hash : 033b33d125db477a8154be7f45f542e4518bf49c
     isLiveEdit : false
     isModule : false
     length : 19
@@ -312,7 +312,7 @@ scriptParsed
     endLine : 2
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 9CF28A415BF64507692D5A8443D429DC872EBA18
+    hash : 033b33d1122e39ae8154be7f45f542e438020797
     isLiveEdit : false
     isModule : false
     length : 20
@@ -331,7 +331,7 @@ scriptParsed
     endLine : 3
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 9CF28A415BF64507692D5A84A8DC8126872EBA18
+    hash : 37189768928f28958154be7f45f542e438020797
     isLiveEdit : false
     isModule : false
     length : 21
@@ -350,7 +350,7 @@ scriptParsed
     endLine : 4
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 9CF28A415BF64507692D5A8443D429DC872EBA18
+    hash : 1886d59067d0c92d8154be7f45f542e438020797
     isLiveEdit : false
     isModule : false
     length : 22
@@ -369,7 +369,7 @@ scriptParsed
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : 2ACD11425BF645075D5696189A7BA7EB4048D6F7
+    hash : 1912c266357e416d5e19323209ce6b851f2e0f2c
     isLiveEdit : false
     isModule : false
     length : 42
@@ -388,7 +388,7 @@ scriptParsed
     endLine : 0
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : 0CD3C4132CE40E415D5696189A7BA7EB4048D6F7
+    hash : 10f9f2639b93aaa6175107400af8e91f3b0f471b
     isLiveEdit : false
     isModule : false
     length : 52
@@ -407,7 +407,7 @@ scriptParsed
     endLine : 2
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : 0E35E860580550805D5681F7BCD47D855B794EB3
+    hash : 0f8af679a498b4814efa01b934ce49ca06bf4ee7
     isLiveEdit : false
     isModule : false
     length : 43
@@ -426,7 +426,7 @@ scriptParsed
     endLine : 3
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : AD4760425BF645075D5681F7D1786BD4DA9A86A7
+    hash : 2cc1f4f316e466c0110dc50790dd520e45de6763
     isLiveEdit : false
     isModule : false
     length : 46
@@ -445,7 +445,7 @@ scriptParsed
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 3E60CE61913387795D5696189A7BA7EB4048B715
+    hash : 127829554266b55666f9cf02c2c7a05463c8c723
     isLiveEdit : false
     isModule : false
     length : 50
@@ -464,7 +464,7 @@ scriptParsed
     endLine : 0
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 3E60CE617215C621E8825B319A7BA7EB4048B715
+    hash : 1385e0fc24082a91521585943bfcce52262a7f4b
     isLiveEdit : false
     isModule : false
     length : 60
@@ -483,7 +483,7 @@ scriptParsed
     endLine : 2
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : F2A32D219EFACBF470C48663BCD47D85864D1A22
+    hash : 2b15af1d4127ae68644e0ce4443021185dbe2d2f
     isLiveEdit : false
     isModule : false
     length : 51
@@ -502,7 +502,7 @@ scriptParsed
     endLine : 3
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 46927EC1BFB78C355D5681F7D1786BD4216D5124
+    hash : 0036aba78093d0cf2ee6350c84b06ffe53aff63e
     isLiveEdit : false
     isModule : false
     length : 54
@@ -521,7 +521,7 @@ scriptParsed
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : 793E2411EDECF405E8825B31460F7CD9A656E096
+    hash : 374ed6be308871fa14f434e504168cba446836db
     isLiveEdit : false
     isModule : false
     length : 88
@@ -540,7 +540,7 @@ scriptParsed
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : DED761235CC24EE21D0E9277CF599B5A292D8053
+    hash : 0db017360f0b77f12660e00ca287b54b602a6795
     isLiveEdit : false
     isModule : false
     length : 89
@@ -559,7 +559,7 @@ scriptParsed
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : 9CF28A415BF64507692D5A84D1786BD4437C3511
+    hash : 096615cf17450c8153564f8c77c9b0421927e011
     isLiveEdit : false
     isModule : false
     length : 40
@@ -578,7 +578,7 @@ scriptParsed
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : BEE49C625BF64507692D5A84D1786BD4437C3511
+    hash : 1314f0ef0397feb553564f8c405d35f91927e011
     isLiveEdit : false
     isModule : false
     length : 41
@@ -597,7 +597,7 @@ scriptParsed
     endLine : 0
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 9CF28A415BF64507692D5A8443D429DC872EBA18
+    hash : 033b33d18f0514168154be7f45f542e4811403e2
     isLiveEdit : false
     isModule : false
     length : 18
@@ -616,7 +616,7 @@ scriptParsed
     endLine : 0
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : D26251F019679C792E2B4EF437A20E96134D5C26
+    hash : 01fcc474486991b12de451e963f458f0767397c8
     isLiveEdit : false
     isModule : false
     length : 96
@@ -635,7 +635,7 @@ scriptParsed
     endLine : 0
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : 814AEF635BF64507692D5A84BCD47D85C4031CD2
+    hash : 06c3a0dd6160579b49d51af109a969910e2e33fd
     isLiveEdit : false
     isModule : false
     length : 39
@@ -665,7 +665,7 @@ scriptFailedToParse
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : true
-    hash : C0C37C619263496792D5CFE7CA6F2911028287A6
+    hash : 01ee31bb2ab335516427f7ff73ddc9d476adbab4
     isModule : false
     length : 56
     scriptId : <scriptId>
@@ -683,7 +683,7 @@ scriptParsed
     endLine : 1
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 9CF28A415BF64507692D5A84A8DC8126872EBA18
+    hash : 033b33d125db477a8154be7f45f542e4518bf49c
     isLiveEdit : false
     isModule : false
     length : 19
@@ -702,7 +702,7 @@ scriptParsed
     endLine : 2
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 9CF28A415BF64507692D5A8443D429DC872EBA18
+    hash : 033b33d1122e39ae8154be7f45f542e438020797
     isLiveEdit : false
     isModule : false
     length : 20
@@ -721,7 +721,7 @@ scriptParsed
     endLine : 3
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 9CF28A415BF64507692D5A84A8DC8126872EBA18
+    hash : 37189768928f28958154be7f45f542e438020797
     isLiveEdit : false
     isModule : false
     length : 21
@@ -740,7 +740,7 @@ scriptParsed
     endLine : 4
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 9CF28A415BF64507692D5A8443D429DC872EBA18
+    hash : 1886d59067d0c92d8154be7f45f542e438020797
     isLiveEdit : false
     isModule : false
     length : 22
diff --git a/deps/v8/test/inspector/debugger/script-parsed-for-runtime-evaluate-expected.txt b/deps/v8/test/inspector/debugger/script-parsed-for-runtime-evaluate-expected.txt
index 75014e1144f..bec2c8354cb 100644
--- a/deps/v8/test/inspector/debugger/script-parsed-for-runtime-evaluate-expected.txt
+++ b/deps/v8/test/inspector/debugger/script-parsed-for-runtime-evaluate-expected.txt
@@ -7,7 +7,7 @@ Runtime.evaluate with valid expression
         endLine : 0
         executionContextId : <executionContextId>
         hasSourceURL : true
-        hash : 9D04F7335D1661503EAB9AF3EACAF92020803F34
+        hash : 088d339a1527053d718d72a610f9700c32e64eef
         isLiveEdit : false
         isModule : false
         length : 29
@@ -26,7 +26,7 @@ Runtime.evaluate with syntax error
         endLine : 0
         executionContextId : <executionContextId>
         hasSourceURL : true
-        hash : 9BCA34A10E5386925E74C1716C857BEB02821E15
+        hash : 37f7701801762b5e2198ec5dca86af5775b39421
         isModule : false
         length : 39
         scriptId : <scriptId>
@@ -44,7 +44,7 @@ Runtime.callFunctionOn with valid functionDeclaration
         endLine : 0
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : 9D04CEA1B54DF92A01A0498543D429DC872EBA18
+        hash : 1169ab358eba9e1a28fa39e19f578ced708a8404
         isLiveEdit : false
         isModule : false
         length : 18
@@ -63,7 +63,7 @@ Runtime.callFunctionOn with syntax error
         endLine : 0
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : 9D04D83251E2B7F64CB5762843D429DC872EBA18
+        hash : 238d40d96f7b2e1582675bc4cd924d3481abe278
         isModule : false
         length : 3
         scriptId : <scriptId>
@@ -81,7 +81,7 @@ Runtime.compileScript with valid expression
         endLine : 0
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : 9D04F733E4E4F1BA4CB5762843D429DC872EBA18
+        hash : 337f40d9a52d67b682675bc4cd924d3481abe278
         isLiveEdit : false
         isModule : false
         length : 4
@@ -100,7 +100,7 @@ Runtime.compileScript with syntax error
         endLine : 0
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : FF746120E4E4F1BA4CB5762843D429DC872EBA18
+        hash : 021647ffab1f4e4e82675bc4cd924d3481abe278
         isModule : false
         length : 1
         scriptId : <scriptId>
@@ -119,7 +119,7 @@ Runtime.evaluate compiled script with stack trace
         endLine : 0
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : A2185340E4E4F1BA4CB5762843D429DC872EBA18
+        hash : 0435812a3176b201645f85bac0ce254781abe278
         isLiveEdit : false
         isModule : false
         length : 8
@@ -137,7 +137,7 @@ Runtime.evaluate compiled script with stack trace
         endLine : 4
         executionContextId : <executionContextId>
         hasSourceURL : true
-        hash : 6AF4ED72C355E471C4E94D74464A25541932A242
+        hash : 1fe25013058a11e86a218cbdab72a4511253d317
         isLiveEdit : false
         isModule : false
         length : 86
@@ -166,7 +166,7 @@ Runtime.evaluate compiled script with stack trace
         endLine : 0
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : 9D04F733E4E4F1BA4CB5762843D429DC872EBA18
+        hash : 337f40d9a52d67b682675bc4cd924d3481abe278
         isLiveEdit : false
         isModule : false
         length : 4
@@ -196,7 +196,7 @@ Runtime.evaluate compile script error with stack trace
         endLine : 0
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : A218534034AA14704CB5762843D429DC872EBA18
+        hash : 04ea8c553176b201645f85ba59eab978523fb6e1
         isLiveEdit : false
         isModule : false
         length : 12
@@ -214,7 +214,7 @@ Runtime.evaluate compile script error with stack trace
         endLine : 4
         executionContextId : <executionContextId>
         hasSourceURL : true
-        hash : 5FD5C8C38F2D44588A4078148B0BC5635152B0C0
+        hash : 0178c875a610447615aeda1073937cd62e4f0919
         isLiveEdit : false
         isModule : false
         length : 98
@@ -243,7 +243,7 @@ Runtime.evaluate compile script error with stack trace
         endLine : 0
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : 9D04F7336C348CA34CB5762843D429DC872EBA18
+        hash : 337f40d93ac843c682675bc4cd924d3481abe278
         isModule : false
         length : 3
         scriptId : <scriptId>
diff --git a/deps/v8/test/inspector/debugger/script-parsed-hash-expected.txt b/deps/v8/test/inspector/debugger/script-parsed-hash-expected.txt
index 88cb394555f..2149d834f88 100644
--- a/deps/v8/test/inspector/debugger/script-parsed-hash-expected.txt
+++ b/deps/v8/test/inspector/debugger/script-parsed-hash-expected.txt
@@ -4,7 +4,7 @@ Tests scripts hasing
     endLine : 0
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 1C6D2E82E4E4F1BA4CB5762843D429DC872EBA18
+    hash : 28e2d6c1ab1f4e4e82675bc4cd924d3481abe278
     isLiveEdit : false
     isModule : false
     length : 1
@@ -19,7 +19,7 @@ Tests scripts hasing
     endLine : 0
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : EBF1ECD351E7A3294CB5762843D429DC872EBA18
+    hash : 3dce1fbe923a7e1582675bc4cd924d3481abe278
     isLiveEdit : false
     isModule : false
     length : 3
@@ -34,7 +34,7 @@ Tests scripts hasing
     endLine : 0
     executionContextId : <executionContextId>
     hasSourceURL : false
-    hash : 885818413D7FC3E2220B3E367FF57CB1D1572095
+    hash : 2a3f94401c23c4d8336963ce4656dae27a95edb4
     isLiveEdit : false
     isModule : false
     length : 8106
diff --git a/deps/v8/test/inspector/debugger/script-unique-hash-expected.txt b/deps/v8/test/inspector/debugger/script-unique-hash-expected.txt
new file mode 100644
index 00000000000..4591b7faf3e
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/script-unique-hash-expected.txt
@@ -0,0 +1,169 @@
+Checks hash in Debugger.scriptParsed event
+1
+2
+PASS
+1;
+2;
+PASS
+1 ;
+2 ;
+PASS
+ 1;
+ 2;
+PASS
+1  ;
+2  ;
+PASS
+ 1 ;
+ 2 ;
+PASS
+  1;
+  2;
+PASS
+1   ;
+2   ;
+PASS
+ 1  ;
+ 2  ;
+PASS
+  1 ;
+  2 ;
+PASS
+   1;
+   2;
+PASS
+1    ;
+2    ;
+PASS
+ 1   ;
+ 2   ;
+PASS
+  1  ;
+  2  ;
+PASS
+   1 ;
+   2 ;
+PASS
+    1;
+    2;
+PASS
+1     ;
+2     ;
+PASS
+ 1    ;
+ 2    ;
+PASS
+  1   ;
+  2   ;
+PASS
+   1  ;
+   2  ;
+PASS
+    1 ;
+    2 ;
+PASS
+     1;
+     2;
+PASS
+1      ;
+2      ;
+PASS
+ 1     ;
+ 2     ;
+PASS
+  1    ;
+  2    ;
+PASS
+   1   ;
+   2   ;
+PASS
+    1  ;
+    2  ;
+PASS
+     1 ;
+     2 ;
+PASS
+      1;
+      2;
+PASS
+1       ;
+2       ;
+PASS
+ 1      ;
+ 2      ;
+PASS
+  1     ;
+  2     ;
+PASS
+   1    ;
+   2    ;
+PASS
+    1   ;
+    2   ;
+PASS
+     1  ;
+     2  ;
+PASS
+      1 ;
+      2 ;
+PASS
+       1;
+       2;
+PASS
+1        ;
+2        ;
+PASS
+ 1       ;
+ 2       ;
+PASS
+  1      ;
+  2      ;
+PASS
+   1     ;
+   2     ;
+PASS
+    1    ;
+    2    ;
+PASS
+     1   ;
+     2   ;
+PASS
+      1  ;
+      2  ;
+PASS
+       1 ;
+       2 ;
+PASS
+        1;
+        2;
+PASS
+1         ;
+2         ;
+PASS
+ 1        ;
+ 2        ;
+PASS
+  1       ;
+  2       ;
+PASS
+   1      ;
+   2      ;
+PASS
+    1     ;
+    2     ;
+PASS
+     1    ;
+     2    ;
+PASS
+      1   ;
+      2   ;
+PASS
+       1  ;
+       2  ;
+PASS
+        1 ;
+        2 ;
+PASS
+         1;
+         2;
+PASS
diff --git a/deps/v8/test/inspector/debugger/script-unique-hash.js b/deps/v8/test/inspector/debugger/script-unique-hash.js
new file mode 100644
index 00000000000..06eca5d4fc5
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/script-unique-hash.js
@@ -0,0 +1,36 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+    InspectorTest.start('Checks hash in Debugger.scriptParsed event');
+
+(async function main() {
+  Protocol.Debugger.enable();
+
+  const tests = [{firstScript: '1', secondScript: '2'}];
+  for (let length = 1; length <= 10; ++length) {
+    for (let differentChar = 0; differentChar < length; ++differentChar) {
+      const firstScript = ' '.repeat(differentChar) + '1' +
+          ' '.repeat(length - differentChar - 1) + ';';
+      const secondScript = ' '.repeat(differentChar) + '2' +
+          ' '.repeat(length - differentChar - 1) + ';';
+      tests.push({firstScript, secondScript});
+    }
+  }
+
+  for (const {firstScript, secondScript} of tests) {
+    InspectorTest.log(firstScript);
+    const firstScriptParsed = Protocol.Debugger.onceScriptParsed();
+    Protocol.Runtime.evaluate({expression: firstScript});
+    const hash1 = (await firstScriptParsed).params.hash;
+
+    InspectorTest.log(secondScript);
+    const secondScriptParsed = Protocol.Debugger.onceScriptParsed();
+    Protocol.Runtime.evaluate({expression: secondScript});
+    const hash2 = (await secondScriptParsed).params.hash;
+
+    InspectorTest.log(hash1 === hash2 ? 'Error: the same hash!' : 'PASS');
+  }
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/step-into-external-async-task.js b/deps/v8/test/inspector/debugger/step-into-external-async-task.js
index 7c7c23816dc..b0d55c950d4 100644
--- a/deps/v8/test/inspector/debugger/step-into-external-async-task.js
+++ b/deps/v8/test/inspector/debugger/step-into-external-async-task.js
@@ -18,8 +18,11 @@ function store(description) {
 }
 //# sourceURL=utils.js`;
 
-contextGroup1.addScript(utilsScript);
+// TODO(rmcilroy): This has to be in this order since the i::Script object gets
+// reused via the CompilationCache, and we want OnAfterCompile to be called
+// for contextGroup1 last on this script.
 contextGroup2.addScript(utilsScript);
+contextGroup1.addScript(utilsScript);
 
 let frameworkScript = `
 function call(id, f) {
diff --git a/deps/v8/test/inspector/debugger/step-into-optimized-blackbox-expected.txt b/deps/v8/test/inspector/debugger/step-into-optimized-blackbox-expected.txt
new file mode 100644
index 00000000000..5f8f657a37c
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/step-into-optimized-blackbox-expected.txt
@@ -0,0 +1,9 @@
+Tests stepping with blackboxing and inlining
+Paused in
+(...):1
+Paused in
+(...):1
+Paused in
+foo:2
+bar:2
+(...):1
diff --git a/deps/v8/test/inspector/debugger/step-into-optimized-blackbox.js b/deps/v8/test/inspector/debugger/step-into-optimized-blackbox.js
new file mode 100644
index 00000000000..75505891bb4
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/step-into-optimized-blackbox.js
@@ -0,0 +1,46 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let {session, contextGroup, Protocol} =
+    InspectorTest.start('Tests stepping with blackboxing and inlining');
+
+contextGroup.addScript(
+`function bar() {
+  return 1 + foo();
+}
+//# sourceURL=bar.js`);
+
+contextGroup.addScript(
+`function foo() {
+  return "foo";
+}
+//# sourceURL=foo.js`);
+
+Protocol.Debugger.enable();
+Protocol.Debugger.setBlackboxPatterns({ patterns: [ "bar.js" ] });
+
+Protocol.Debugger.onPaused(PerformSteps);
+Protocol.Runtime.evaluate({
+  "expression": "bar(); bar(); %OptimizeFunctionOnNextCall(bar); bar()"
+});
+Protocol.Runtime.evaluate({ "expression": "debugger; bar();" });
+
+var commands = [ "stepInto", "stepInto" ];
+
+function PerformSteps(message) {
+  InspectorTest.log("Paused in");
+  var callFrames = message.params.callFrames;
+  for (var callFrame of callFrames) {
+    InspectorTest.log(
+        (callFrame.functionName || "(...)") + ":" + (callFrame.location.lineNumber + 1));
+  }
+  var command = commands.shift();
+  if (!command) {
+    InspectorTest.completeTest();
+    return;
+  }
+  Protocol.Debugger[command]();
+}
diff --git a/deps/v8/test/inspector/heap-profiler/console-retaining-path-expected.txt b/deps/v8/test/inspector/heap-profiler/console-retaining-path-expected.txt
new file mode 100644
index 00000000000..49e09850819
--- /dev/null
+++ b/deps/v8/test/inspector/heap-profiler/console-retaining-path-expected.txt
@@ -0,0 +1,5 @@
+Tests edge labels of objects retained by DevTools.
+
+Running test: testConsoleRetainingPath
+Edge from (Global handles) to MyClass1: DevTools console
+Edge from (Global handles) to MyClass2: DevTools console
diff --git a/deps/v8/test/inspector/heap-profiler/console-retaining-path.js b/deps/v8/test/inspector/heap-profiler/console-retaining-path.js
new file mode 100644
index 00000000000..7021e7f6e68
--- /dev/null
+++ b/deps/v8/test/inspector/heap-profiler/console-retaining-path.js
@@ -0,0 +1,97 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+    'Tests edge labels of objects retained by DevTools.');
+
+const kNodeName = 1;
+const kNodeEdgeCount = 4;
+const kNodeSize = 6;
+const kEdgeName = 1;
+const kEdgeTarget = 2;
+const kEdgeSize = 3;
+
+function EdgeName(snapshot, edgeIndex) {
+  return snapshot['strings'][snapshot['edges'][edgeIndex + kEdgeName]];
+}
+
+function EdgeTarget(snapshot, edgeIndex) {
+  return snapshot['edges'][edgeIndex + kEdgeTarget];
+}
+
+function EdgeCount(snapshot, nodeIndex) {
+  return snapshot['nodes'][nodeIndex + kNodeEdgeCount];
+}
+
+function NodeName(snapshot, nodeIndex) {
+  return snapshot['strings'][snapshot['nodes'][nodeIndex + kNodeName]];
+}
+
+function NodeEdges(snapshot, nodeIndex) {
+  let startEdgeIndex = 0;
+  for (let i = 0; i < nodeIndex; i += kNodeSize) {
+    startEdgeIndex += EdgeCount(snapshot, i);
+  }
+  let endEdgeIndex = startEdgeIndex + EdgeCount(snapshot, nodeIndex);
+  let result = [];
+  for (let i = startEdgeIndex; i < endEdgeIndex; ++i) {
+    result.push(i * kEdgeSize);
+  }
+  return result;
+}
+
+function NodeByName(snapshot, name) {
+  let count = snapshot['nodes'].length / kNodeSize;
+  for (let i = 0; i < count; i++) {
+    if (NodeName(snapshot, i * kNodeSize) == name) return i * kNodeSize;
+  }
+  InspectorTest.log(`Cannot node ${name}`);
+  return 0;
+}
+
+function FindEdge(snapshot, sourceName, targetName) {
+  let sourceIndex = NodeByName(snapshot, sourceName);
+  let targetIndex = NodeByName(snapshot, targetName);
+  let edges = NodeEdges(snapshot, sourceIndex);
+  for (let edge of edges) {
+    if (EdgeTarget(snapshot, edge) == targetIndex) return edge;
+  }
+  InspectorTest.log(`Cannot find edge between ${sourceName} and ${targetName}`);
+  return 0;
+}
+
+function GlobalHandleEdgeName(snapshot, targetName) {
+  let edge = FindEdge(snapshot, '(Global handles)', targetName);
+  let edgeName = EdgeName(snapshot, edge);
+  // Make the test more robust by skipping the edge index prefix and
+  // a single space.
+  return edgeName.substring(edgeName.indexOf('/') + 2);
+}
+
+contextGroup.addScript(`
+class MyClass1 {};
+class MyClass2 {};
+//# sourceURL=test.js`);
+
+Protocol.Debugger.enable();
+Protocol.HeapProfiler.enable();
+
+InspectorTest.runAsyncTestSuite([
+  async function testConsoleRetainingPath() {
+    let snapshot_string = '';
+    function onChunk(message) {
+      snapshot_string += message['params']['chunk'];
+    }
+    Protocol.HeapProfiler.onAddHeapSnapshotChunk(onChunk)
+    await Protocol.Runtime.evaluate({ expression: 'new MyClass1();' });
+    await Protocol.Runtime.evaluate(
+        { expression: 'console.log(new MyClass2());' });
+    await Protocol.HeapProfiler.takeHeapSnapshot({ reportProgress: false })
+    let snapshot = JSON.parse(snapshot_string);
+    let edge1 = GlobalHandleEdgeName(snapshot, 'MyClass1');
+    let edge2 = GlobalHandleEdgeName(snapshot, 'MyClass2');
+    InspectorTest.log(`Edge from (Global handles) to MyClass1: ${edge1}`);
+    InspectorTest.log(`Edge from (Global handles) to MyClass2: ${edge2}`);
+  }
+]);
diff --git a/deps/v8/test/inspector/inspector-test.cc b/deps/v8/test/inspector/inspector-test.cc
index 04a23df528f..513699fa6f3 100644
--- a/deps/v8/test/inspector/inspector-test.cc
+++ b/deps/v8/test/inspector/inspector-test.cc
@@ -707,6 +707,10 @@ class InspectorExtension : public IsolateData::SetupGlobalTask {
     inspector->Set(ToV8String(isolate, "scheduleWithAsyncStack"),
                    v8::FunctionTemplate::New(
                        isolate, &InspectorExtension::ScheduleWithAsyncStack));
+    inspector->Set(
+        ToV8String(isolate, "setAllowCodeGenerationFromStrings"),
+        v8::FunctionTemplate::New(
+            isolate, &InspectorExtension::SetAllowCodeGenerationFromStrings));
     global->Set(ToV8String(isolate, "inspector"), inspector);
   }
 
@@ -957,6 +961,17 @@ class InspectorExtension : public IsolateData::SetupGlobalTask {
                                     v8::Local<v8::Function>::Cast(args[0])));
     if (with_empty_stack) context->Enter();
   }
+
+  static void SetAllowCodeGenerationFromStrings(
+      const v8::FunctionCallbackInfo<v8::Value>& args) {
+    if (args.Length() != 1 || !args[0]->IsBoolean()) {
+      fprintf(stderr,
+              "Internal error: setAllowCodeGenerationFromStrings(allow).");
+      Exit();
+    }
+    args.GetIsolate()->GetCurrentContext()->AllowCodeGenerationFromStrings(
+        args[0].As<v8::Boolean>()->Value());
+  }
 };
 
 }  //  namespace
diff --git a/deps/v8/test/inspector/inspector.gyp b/deps/v8/test/inspector/inspector.gyp
deleted file mode 100644
index b465f9e5529..00000000000
--- a/deps/v8/test/inspector/inspector.gyp
+++ /dev/null
@@ -1,58 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'variables': {
-    'v8_code': 1,
-  },
-  'includes': ['../../gypfiles/toolchain.gypi', '../../gypfiles/features.gypi'],
-  'targets': [
-    {
-      'target_name': 'inspector-test',
-      'type': 'executable',
-      'dependencies': [
-        '../../src/v8.gyp:v8_libplatform',
-        '../../src/v8.gyp:v8_libbase',
-        '../../src/v8.gyp:v8',
-      ],
-      'include_dirs': [
-        '../..',
-      ],
-      'sources': [
-        'inspector-test.cc',
-        'isolate-data.cc',
-        'isolate-data.h',
-        'task-runner.cc',
-        'task-runner.h',
-      ],
-      'conditions': [
-        ['v8_enable_i18n_support==1', {
-          'dependencies': [
-            '<(icu_gyp_path):icui18n',
-            '<(icu_gyp_path):icuuc',
-          ],
-        }],
-      ],
-    },
-  ],
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'inspector-test_run',
-          'type': 'none',
-          'dependencies': [
-            'inspector-test',
-          ],
-          'includes': [
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'inspector.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/inspector/inspector.isolate b/deps/v8/test/inspector/inspector.isolate
deleted file mode 100644
index 38a96c57c63..00000000000
--- a/deps/v8/test/inspector/inspector.isolate
+++ /dev/null
@@ -1,27 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'files': [
-      './console/',
-      './cpu-profiler/',
-      './debugger/',
-      './heap-profiler/',
-      './inspector.status',
-      './json-parse-expected.txt',
-      './json-parse.js',
-      './protocol-test.js',
-      './runtime/',
-      './sessions/',
-      './testcfg.py',
-      './type-profiler/',
-      '../../src/inspector/injected-script-source.js',
-      '<(PRODUCT_DIR)/inspector-test<(EXECUTABLE_SUFFIX)',
-    ],
-  },
-  'includes': [
-    '../../src/base.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
diff --git a/deps/v8/test/inspector/protocol-test.js b/deps/v8/test/inspector/protocol-test.js
index 91f55e442a1..9b7ba0aafe6 100644
--- a/deps/v8/test/inspector/protocol-test.js
+++ b/deps/v8/test/inspector/protocol-test.js
@@ -309,6 +309,8 @@ InspectorTest.Session = class {
   }
 
   _sendCommandPromise(method, params) {
+    if (typeof params !== 'object')
+      utils.print(`WARNING: non-object params passed to invocation of method ${method}`);
     if (InspectorTest._commandsForLogging.has(method))
       utils.print(method + ' called');
     var requestId = ++this._requestId;
diff --git a/deps/v8/test/inspector/runtime/call-function-on-async-expected.txt b/deps/v8/test/inspector/runtime/call-function-on-async-expected.txt
index 0cbf6f1c080..930999bb2b5 100644
--- a/deps/v8/test/inspector/runtime/call-function-on-async-expected.txt
+++ b/deps/v8/test/inspector/runtime/call-function-on-async-expected.txt
@@ -13,6 +13,17 @@ Running test: testArguments
     }
 }
 
+Running test: testUnserializableArguments
+{
+    id : <messageId>
+    result : {
+        result : {
+            type : string
+            value : true|true|true|true|bigint
+        }
+    }
+}
+
 Running test: testComplexArguments
 {
     id : <messageId>
diff --git a/deps/v8/test/inspector/runtime/call-function-on-async.js b/deps/v8/test/inspector/runtime/call-function-on-async.js
index 277a01c4689..c5f11529795 100644
--- a/deps/v8/test/inspector/runtime/call-function-on-async.js
+++ b/deps/v8/test/inspector/runtime/call-function-on-async.js
@@ -1,6 +1,8 @@
 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+// TODO(luoe): remove flag when it is on by default.
+// Flags: --harmony-bigint
 
 let {session, contextGroup, Protocol} = InspectorTest.start('Tests that Runtime.callFunctionOn works with awaitPromise flag.');
 let callFunctionOn = Protocol.Runtime.callFunctionOn.bind(Protocol.Runtime);
@@ -36,6 +38,17 @@ let testSuite = [
     }));
   },
 
+  async function testUnserializableArguments() {
+    InspectorTest.logMessage(await callFunctionOn({
+      objectId: remoteObject1.objectId,
+      functionDeclaration: 'function(arg1, arg2, arg3, arg4, arg5) { return \'\' + Object.is(arg1, -0) + \'|\' + Object.is(arg2, NaN) + \'|\' + Object.is(arg3, Infinity) + \'|\' + Object.is(arg4, -Infinity) + \'|\' + (typeof arg5); }',
+      arguments: prepareArguments([-0, NaN, Infinity, -Infinity, 2n]),
+      returnByValue: true,
+      generatePreview: false,
+      awaitPromise: false
+    }));
+  },
+
   async function testComplexArguments() {
     InspectorTest.logMessage(await callFunctionOn({
       objectId: remoteObject1.objectId,
@@ -143,6 +156,8 @@ function prepareArguments(args) {
       return {unserializableValue: '-0'};
     if (Object.is(arg, NaN) || Object.is(arg, Infinity) || Object.is(arg, -Infinity))
       return {unserializableValue: arg + ''};
+    if (typeof arg === 'bigint')
+      return {unserializableValue: arg + 'n'};
     if (arg && arg.objectId)
       return {objectId: arg.objectId};
     return {value: arg};
diff --git a/deps/v8/test/inspector/runtime/command-line-api-expected.txt b/deps/v8/test/inspector/runtime/command-line-api-expected.txt
index 11e60d95357..38d53b7eb4f 100644
--- a/deps/v8/test/inspector/runtime/command-line-api-expected.txt
+++ b/deps/v8/test/inspector/runtime/command-line-api-expected.txt
@@ -235,7 +235,7 @@ Running test: testDebug
     result : {
         result : {
             className : Function
-            description : function debug(function) { [Command Line API] }
+            description : function debug(function, condition) { [Command Line API] }
             objectId : <objectId>
             type : function
         }
@@ -255,13 +255,39 @@ Running test: testDebug
 foo (:0:16)
 (anonymous) (:0:0)
 [
-    [0] : 5:0:12:<scriptId>
+    [0] : 5:1
 ]
+debugCommand
 foo (:0:16)
 (anonymous) (:0:0)
 [
-    [0] : 5:0:12:<scriptId>
+    [0] : 5:1
 ]
+debugCommand
+toUpper (:0:31)
+(anonymous) (:0:0)
+[
+    [0] : 5:2
+]
+debugCommand
+callSetTimeout (:0:28)
+(anonymous) (:0:0)
+[
+    [0] : 5:3
+]
+debugCommand
+callSetTimeout (:0:28)
+(anonymous) (:0:0)
+[
+    [0] : 5:3
+]
+debugCommand
+fromCharCode (:0:40)
+(anonymous) (:0:0)
+[
+    [0] : 5:4
+]
+debugCommand
 
 Running test: testMonitor
 {
@@ -291,6 +317,7 @@ after first call
 store functions..
 function foo called
 after first call
+function fromCharCode called with arguments: 1, 2, 3
 
 Running test: testProfile
 {
diff --git a/deps/v8/test/inspector/runtime/command-line-api.js b/deps/v8/test/inspector/runtime/command-line-api.js
index 2826ac24105..3572afec0b3 100644
--- a/deps/v8/test/inspector/runtime/command-line-api.js
+++ b/deps/v8/test/inspector/runtime/command-line-api.js
@@ -81,6 +81,7 @@ InspectorTest.runAsyncTestSuite([
     let message = await Protocol.Debugger.oncePaused();
     session.logCallFrames(message.params.callFrames);
     InspectorTest.logMessage(message.params.hitBreakpoints);
+    InspectorTest.logMessage(message.params.reason);
     await Protocol.Debugger.resume();
     await Protocol.Runtime.evaluate({expression: 'undebug(foo)', includeCommandLineAPI: true});
     await Protocol.Runtime.evaluate({ expression: 'foo()'});
@@ -92,10 +93,59 @@ InspectorTest.runAsyncTestSuite([
     message = await Protocol.Debugger.oncePaused();
     session.logCallFrames(message.params.callFrames);
     InspectorTest.logMessage(message.params.hitBreakpoints);
+    InspectorTest.logMessage(message.params.reason);
     await Protocol.Debugger.resume();
     await Protocol.Runtime.evaluate({expression: 'this.undebug(foo)'});
     await Protocol.Runtime.evaluate({expression: 'foo()'});
 
+    // Test builtin.
+    await Protocol.Runtime.evaluate({expression: 'function toUpper(x) { return x.toUpperCase() }'});
+    await Protocol.Runtime.evaluate({expression: 'debug(String.prototype.toUpperCase)', includeCommandLineAPI: true});
+    Protocol.Runtime.evaluate({ expression: 'toUpper("first call")'});
+    message = await Protocol.Debugger.oncePaused();
+    session.logCallFrames(message.params.callFrames);
+    InspectorTest.logMessage(message.params.hitBreakpoints);
+    InspectorTest.logMessage(message.params.reason);
+    await Protocol.Debugger.resume();
+    await Protocol.Runtime.evaluate({expression: 'undebug(String.prototype.toUpperCase)', includeCommandLineAPI: true});
+    await Protocol.Runtime.evaluate({ expression: 'toUpper("second call")'});
+
+    // Test API callback.
+    await Protocol.Runtime.evaluate({expression: 'function callSetTimeout() { setTimeout(function(){}, 0) }'});
+    await Protocol.Runtime.evaluate({expression: 'debug(setTimeout)', includeCommandLineAPI: true});
+    Protocol.Runtime.evaluate({ expression: 'callSetTimeout()'});
+    message = await Protocol.Debugger.oncePaused();
+    session.logCallFrames(message.params.callFrames);
+    InspectorTest.logMessage(message.params.hitBreakpoints);
+    InspectorTest.logMessage(message.params.reason);
+    let breakpointId = message.params.hitBreakpoints[0];
+    await Protocol.Debugger.resume();
+    await Protocol.Runtime.evaluate({expression: 'undebug(setTimeout)', includeCommandLineAPI: true});
+    await Protocol.Runtime.evaluate({ expression: 'callSetTimeout()'});
+
+    // Test remove break via protocol.
+    await Protocol.Runtime.evaluate({expression: 'function callSetTimeout() { setTimeout(function(){}, 0) }'});
+    await Protocol.Runtime.evaluate({expression: 'debug(setTimeout)', includeCommandLineAPI: true});
+    Protocol.Runtime.evaluate({ expression: 'callSetTimeout()'});
+    message = await Protocol.Debugger.oncePaused();
+    session.logCallFrames(message.params.callFrames);
+    InspectorTest.logMessage(message.params.hitBreakpoints);
+    InspectorTest.logMessage(message.params.reason);
+    await Protocol.Debugger.resume();
+    await Protocol.Debugger.removeBreakpoint({breakpointId});
+    await Protocol.Runtime.evaluate({ expression: 'callSetTimeout()'});
+
+    // Test condition.
+    await Protocol.Runtime.evaluate({expression: 'function fromCharCode(...args) { String.fromCharCode(...args) }'});
+    await Protocol.Runtime.evaluate({expression: 'debug(String.fromCharCode, "arguments.length == 3")'});
+    Protocol.Runtime.evaluate({ expression: 'fromCharCode("1", "2", "3")'});
+    message = await Protocol.Debugger.oncePaused();
+    session.logCallFrames(message.params.callFrames);
+    InspectorTest.logMessage(message.params.hitBreakpoints);
+    InspectorTest.logMessage(message.params.reason);
+    await Protocol.Runtime.evaluate({expression: 'undebug(String.fromCharCode)'});
+    await Protocol.Runtime.evaluate({ expression: 'fromCharCode()'});
+
     await Protocol.Debugger.disable();
   },
 
@@ -119,6 +169,13 @@ InspectorTest.runAsyncTestSuite([
     await Protocol.Runtime.evaluate({expression: 'this.unmonitor(foo)'});
     await Protocol.Runtime.evaluate({ expression: 'foo()'});
 
+    // Test builtin.
+    await Protocol.Runtime.evaluate({expression: 'function fromCharCode(...args) { String.fromCharCode(...args) }'});
+    await Protocol.Runtime.evaluate({expression: 'monitor(String.fromCharCode)'});
+    Protocol.Runtime.evaluate({ expression: 'fromCharCode("1", "2", "3")'});
+    await Protocol.Runtime.evaluate({expression: 'unmonitor(String.fromCharCode)'});
+    await Protocol.Runtime.evaluate({ expression: 'fromCharCode()'});
+
     Protocol.Runtime.onConsoleAPICalled(null);
     await Protocol.Debugger.disable();
     await Protocol.Runtime.disable();
diff --git a/deps/v8/test/inspector/runtime/es6-module-expected.txt b/deps/v8/test/inspector/runtime/es6-module-expected.txt
index 646fd018ea6..25ba52e0341 100644
--- a/deps/v8/test/inspector/runtime/es6-module-expected.txt
+++ b/deps/v8/test/inspector/runtime/es6-module-expected.txt
@@ -6,7 +6,7 @@ Checks basic ES6 modules support.
         endLine : 5
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : 9C014F7249BAFA12B91017817AD15091D01A9155
+        hash : 395a588e3dc4c9155d342cb169bcd60d5b96c1a1
         isLiveEdit : false
         isModule : true
         length : 83
@@ -24,7 +24,7 @@ Checks basic ES6 modules support.
         endLine : 5
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : 443A2FA24A6112E6B9101781E6A19B56BDC396D4
+        hash : 15448dfe629fbe4306eae7194754692706c6d6ba
         isLiveEdit : false
         isModule : true
         length : 84
@@ -42,7 +42,7 @@ Checks basic ES6 modules support.
         endLine : 8
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : 54D834614FBF9B389082DAE06CD3EFC499BEBF13
+        hash : 2eda454b04ad45b62a894c7590954c5074ca4569
         isLiveEdit : false
         isModule : true
         length : 191
@@ -189,7 +189,7 @@ console.log(239)
         endLine : 0
         executionContextId : <executionContextId>
         hasSourceURL : false
-        hash : FF746120E4E4F1BA4CB5762843D429DC872EBA18
+        hash : 021647ffab1f4e4e82675bc4cd924d3481abe278
         isModule : true
         length : 1
         scriptId : <scriptId>
diff --git a/deps/v8/test/inspector/runtime/evaluate-run-microtasks-expected.txt b/deps/v8/test/inspector/runtime/evaluate-run-microtasks-expected.txt
new file mode 100644
index 00000000000..080db69d7ee
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/evaluate-run-microtasks-expected.txt
@@ -0,0 +1,39 @@
+Tests that microtasks run before the Runtime.evaluate response is sent
+{
+    method : Runtime.consoleAPICalled
+    params : {
+        args : [
+            [0] : {
+                description : 42
+                type : number
+                value : 42
+            }
+        ]
+        executionContextId : <executionContextId>
+        stackTrace : {
+            callFrames : [
+                [0] : {
+                    columnNumber : 37
+                    functionName : Promise.resolve.then
+                    lineNumber : 0
+                    scriptId : <scriptId>
+                    url : 
+                }
+            ]
+        }
+        timestamp : <timestamp>
+        type : log
+    }
+}
+{
+    id : <messageId>
+    result : {
+        result : {
+            className : Promise
+            description : Promise
+            objectId : <objectId>
+            subtype : promise
+            type : object
+        }
+    }
+}
diff --git a/deps/v8/test/inspector/runtime/evaluate-run-microtasks.js b/deps/v8/test/inspector/runtime/evaluate-run-microtasks.js
new file mode 100644
index 00000000000..f2b6f28210b
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/evaluate-run-microtasks.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const {Protocol} = InspectorTest.start(
+    'Tests that microtasks run before the Runtime.evaluate response is sent');
+
+Protocol.Runtime.enable();
+Protocol.Runtime.onConsoleAPICalled(InspectorTest.logMessage);
+Protocol.Runtime
+    .evaluate({expression: 'Promise.resolve().then(() => console.log(42))'})
+    .then(InspectorTest.logMessage)
+    .then(InspectorTest.completeTest);
diff --git a/deps/v8/test/inspector/runtime/evaluate-unserializable-expected.txt b/deps/v8/test/inspector/runtime/evaluate-unserializable-expected.txt
new file mode 100644
index 00000000000..9ae0ef2c7c5
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/evaluate-unserializable-expected.txt
@@ -0,0 +1,56 @@
+Tests Runtime.evaluate with unserializable results.
+-0
+{
+    id : <messageId>
+    result : {
+        result : {
+            description : -0
+            type : number
+            unserializableValue : -0
+        }
+    }
+}
+NaN
+{
+    id : <messageId>
+    result : {
+        result : {
+            description : NaN
+            type : number
+            unserializableValue : NaN
+        }
+    }
+}
+Infinity
+{
+    id : <messageId>
+    result : {
+        result : {
+            description : Infinity
+            type : number
+            unserializableValue : Infinity
+        }
+    }
+}
+-Infinity
+{
+    id : <messageId>
+    result : {
+        result : {
+            description : -Infinity
+            type : number
+            unserializableValue : -Infinity
+        }
+    }
+}
+1n
+{
+    id : <messageId>
+    result : {
+        result : {
+            description : 1n
+            type : bigint
+            unserializableValue : 1n
+        }
+    }
+}
diff --git a/deps/v8/test/inspector/runtime/evaluate-unserializable.js b/deps/v8/test/inspector/runtime/evaluate-unserializable.js
new file mode 100644
index 00000000000..462af53f093
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/evaluate-unserializable.js
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// TODO(luoe): remove flag when it is on by default.
+// Flags: --harmony-bigint
+
+let {session, contextGroup, Protocol} =
+    InspectorTest.start("Tests Runtime.evaluate with unserializable results.");
+
+Protocol.Runtime.enable();
+(async function() {
+  await testCase("-0");
+  await testCase("NaN");
+  await testCase("Infinity");
+  await testCase("-Infinity");
+  await testCase("1n");
+
+  InspectorTest.completeTest();
+})();
+
+async function testCase(expression) {
+  InspectorTest.log(expression);
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({expression}));
+}
diff --git a/deps/v8/test/inspector/runtime/evaluate-with-generate-preview-expected.txt b/deps/v8/test/inspector/runtime/evaluate-with-generate-preview-expected.txt
index ef1cd1a753c..a8427b3d9bc 100644
--- a/deps/v8/test/inspector/runtime/evaluate-with-generate-preview-expected.txt
+++ b/deps/v8/test/inspector/runtime/evaluate-with-generate-preview-expected.txt
@@ -836,3 +836,23 @@ Running test: testObjWithArrayAsProto
     ]
     type : object
 }
+
+Running test: testArrayWithLongValues
+{
+    description : Array(2)
+    overflow : false
+    properties : [
+        [0] : {
+            name : 0
+            type : string
+            value : aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa…aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+        }
+        [1] : {
+            name : 1
+            type : bigint
+            value : 51644997561738171793118383440060237486594115856584…033682389259290706560275662871806343945494986752n
+        }
+    ]
+    subtype : array
+    type : object
+}
diff --git a/deps/v8/test/inspector/runtime/evaluate-with-generate-preview.js b/deps/v8/test/inspector/runtime/evaluate-with-generate-preview.js
index 8ea0ea4faff..081a93c64a4 100644
--- a/deps/v8/test/inspector/runtime/evaluate-with-generate-preview.js
+++ b/deps/v8/test/inspector/runtime/evaluate-with-generate-preview.js
@@ -1,6 +1,8 @@
 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+// TODO(luoe): remove flag when it is on by default.
+// Flags: --harmony-bigint
 
 let {session, contextGroup, Protocol} = InspectorTest.start("Tests that Runtime.evaluate will generate correct previews.");
 
@@ -63,6 +65,8 @@ Object.defineProperty(parentObj, 'propNotNamedProto', {
 });
 var objInheritsGetterProperty = {__proto__: parentObj};
 inspector.allowAccessorFormatting(objInheritsGetterProperty);
+
+var arrayWithLongValues = ["a".repeat(101), 2n**401n];
 `);
 
 contextGroup.setupInjectedScriptEnvironment();
@@ -143,5 +147,12 @@ InspectorTest.runTestSuite([
     Protocol.Runtime.evaluate({ "expression": "Object.create([1,2])", "generatePreview": true })
         .then(result => InspectorTest.logMessage(result.result.result.preview))
         .then(next);
+  },
+
+  function testArrayWithLongValues(next)
+  {
+    Protocol.Runtime.evaluate({ "expression": "arrayWithLongValues", "generatePreview": true })
+        .then(result => InspectorTest.logMessage(result.result.result.preview))
+        .then(next);
   }
 ]);
diff --git a/deps/v8/test/inspector/runtime/evaluate-without-side-effects-expected.txt b/deps/v8/test/inspector/runtime/evaluate-without-side-effects-expected.txt
new file mode 100644
index 00000000000..8108f7a9b8d
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/evaluate-without-side-effects-expected.txt
@@ -0,0 +1,73 @@
+Tests that Runtime.evaluate can run without side effects.
+Test throwOnSideEffect: false
+{
+    id : <messageId>
+    result : {
+        result : {
+            description : 2
+            type : number
+            value : 2
+        }
+    }
+}
+Test expression with side-effect, with throwOnSideEffect: true
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : -1
+            exception : {
+                className : EvalError
+                description : EvalError: Possible side-effect in debug-evaluate
+                objectId : <objectId>
+                subtype : error
+                type : object
+            }
+            exceptionId : <exceptionId>
+            lineNumber : -1
+            scriptId : <scriptId>
+            text : Uncaught
+        }
+        result : {
+            className : EvalError
+            description : EvalError: Possible side-effect in debug-evaluate
+            objectId : <objectId>
+            subtype : error
+            type : object
+        }
+    }
+}
+Test expression without side-effect, with throwOnSideEffect: true
+{
+    id : <messageId>
+    result : {
+        result : {
+            description : 4
+            type : number
+            value : 4
+        }
+    }
+}
+Test that debug break triggers without throwOnSideEffect
+paused
+{
+    id : <messageId>
+    result : {
+        result : {
+            description : 2
+            type : number
+            value : 2
+        }
+    }
+}
+Test that debug break does not trigger with throwOnSideEffect
+{
+    id : <messageId>
+    result : {
+        result : {
+            description : 2
+            type : number
+            value : 2
+        }
+    }
+}
\ No newline at end of file
diff --git a/deps/v8/test/inspector/runtime/evaluate-without-side-effects.js b/deps/v8/test/inspector/runtime/evaluate-without-side-effects.js
new file mode 100644
index 00000000000..5736a65e061
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/evaluate-without-side-effects.js
@@ -0,0 +1,53 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start("Tests that Runtime.evaluate can run without side effects.");
+
+session.setupScriptMap();
+contextGroup.addScript(`
+    function f() {
+      return 2;
+    } //# sourceURL=test.js`);
+Protocol.Runtime.enable();
+Protocol.Debugger.enable();
+
+Protocol.Debugger.onPaused(message => {
+  InspectorTest.log("paused");
+  Protocol.Debugger.resume();
+});
+
+(async function() {
+  InspectorTest.log("Test throwOnSideEffect: false");
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: "var x = 2; x;",
+    throwOnSideEffect: false
+  }));
+
+  InspectorTest.log("Test expression with side-effect, with throwOnSideEffect: true");
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: "x = 3; x;",
+    throwOnSideEffect: true
+  }));
+
+  InspectorTest.log("Test expression without side-effect, with throwOnSideEffect: true");
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: "x * 2",
+    throwOnSideEffect: true
+  }));
+
+  InspectorTest.log("Test that debug break triggers without throwOnSideEffect");
+  await Protocol.Debugger.setBreakpointByUrl({ url: 'test.js', lineNumber: 2 });
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: "f()",
+    throwOnSideEffect: false
+  }));
+
+  InspectorTest.log("Test that debug break does not trigger with throwOnSideEffect");
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: "f()",
+    throwOnSideEffect: true
+  }));
+
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/runtime/get-heap-usage-expected.txt b/deps/v8/test/inspector/runtime/get-heap-usage-expected.txt
new file mode 100644
index 00000000000..4bd9699e574
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/get-heap-usage-expected.txt
@@ -0,0 +1 @@
+Checks that Runtime.getHeapUsage works
diff --git a/deps/v8/test/inspector/runtime/get-heap-usage.js b/deps/v8/test/inspector/runtime/get-heap-usage.js
new file mode 100644
index 00000000000..8330001315b
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/get-heap-usage.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const {session, contextGroup, Protocol} = InspectorTest.start('Checks that Runtime.getHeapUsage works');
+
+(async function test() {
+  const heapUsage = await Protocol.Runtime.getHeapUsage();
+  const usedSize = heapUsage.result["usedSize"];
+  const totalSize = heapUsage.result["totalSize"];
+  console.assert(usedSize > 0);
+  console.assert(totalSize > 0);
+  console.assert(totalSize >= usedSize);
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/runtime/get-isolate-id-expected.txt b/deps/v8/test/inspector/runtime/get-isolate-id-expected.txt
new file mode 100644
index 00000000000..7b3dcfc500d
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/get-isolate-id-expected.txt
@@ -0,0 +1 @@
+Checks that Runtime.getIsolateId works
diff --git a/deps/v8/test/inspector/runtime/get-isolate-id.js b/deps/v8/test/inspector/runtime/get-isolate-id.js
new file mode 100644
index 00000000000..59bfc626391
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/get-isolate-id.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const {session, contextGroup, Protocol} = InspectorTest.start('Checks that Runtime.getIsolateId works');
+
+(async function test() {
+  const id = await Protocol.Runtime.getIsolateId();
+  console.assert(typeof id === 'string');
+  console.assert(id.length > 0);
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/runtime/internal-properties-expected.txt b/deps/v8/test/inspector/runtime/internal-properties-expected.txt
index a44c50b673b..a2e38ab013f 100644
--- a/deps/v8/test/inspector/runtime/internal-properties-expected.txt
+++ b/deps/v8/test/inspector/runtime/internal-properties-expected.txt
@@ -136,6 +136,22 @@ expression: Object(Symbol(42))
         ]
     }
 }
+expression: Object(BigInt(2))
+{
+    id : <messageId>
+    result : {
+        internalProperties : [
+            [0] : {
+                name : [[PrimitiveValue]]
+                value : {
+                    description : 2n
+                    type : bigint
+                    unserializableValue : 2n
+                }
+            }
+        ]
+    }
+}
 
 Running test: promise
 expression: Promise.resolve(42)
diff --git a/deps/v8/test/inspector/runtime/internal-properties.js b/deps/v8/test/inspector/runtime/internal-properties.js
index 1e42f917ea7..470dfb5049a 100644
--- a/deps/v8/test/inspector/runtime/internal-properties.js
+++ b/deps/v8/test/inspector/runtime/internal-properties.js
@@ -1,6 +1,8 @@
 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+// TODO(luoe): remove flag when it is on by default.
+// Flags: --harmony-bigint
 
 let {session, contextGroup, Protocol} = InspectorTest.start('Checks internal properties in Runtime.getProperties output');
 
@@ -29,6 +31,7 @@ InspectorTest.runTestSuite([
       .then(() => checkExpression('new Boolean(false)'))
       .then(() => checkExpression('new String(\'abc\')'))
       .then(() => checkExpression('Object(Symbol(42))'))
+      .then(() => checkExpression("Object(BigInt(2))"))
       .then(next);
   },
 
diff --git a/deps/v8/test/inspector/runtime/query-objects-expected.txt b/deps/v8/test/inspector/runtime/query-objects-expected.txt
index 9f365d979ab..db164029866 100644
--- a/deps/v8/test/inspector/runtime/query-objects-expected.txt
+++ b/deps/v8/test/inspector/runtime/query-objects-expected.txt
@@ -94,3 +94,12 @@ Dump each object constructor name.
     [0] : Object,object
     [1] : Object,object
 ]
+
+Running test: testWithObjectGroup
+Query for Array.prototype 3 times
+Results since initial: 0
+Results since initial: 1
+Results since initial: 2
+
+Released object group.
+Results since initial: 0
diff --git a/deps/v8/test/inspector/runtime/query-objects.js b/deps/v8/test/inspector/runtime/query-objects.js
index c3b1b2bd918..f37f1ed581e 100644
--- a/deps/v8/test/inspector/runtime/query-objects.js
+++ b/deps/v8/test/inspector/runtime/query-objects.js
@@ -116,7 +116,44 @@ InspectorTest.runAsyncTestSuite([
       await queryObjects(session, objectId, 'p');
     }
     session.disconnect();
-  }
+  },
+
+  async function testWithObjectGroup() {
+    let contextGroup = new InspectorTest.ContextGroup();
+    let session = contextGroup.connect();
+    let Protocol = session.Protocol;
+    let {result:{result:{objectId}}} = await Protocol.Runtime.evaluate({
+      expression: 'Array.prototype'
+    });
+
+    let initialArrayCount;
+    const N = 3;
+    InspectorTest.log(`Query for Array.prototype ${N} times`);
+    for (let i = 0; i < N; ++i) {
+      const {result:{objects}} = await Protocol.Runtime.queryObjects({
+        prototypeObjectId: objectId,
+        objectGroup: 'console'
+      });
+      logCountSinceInitial(objects.description);
+    }
+
+    await Protocol.Runtime.releaseObjectGroup({objectGroup: 'console'});
+    InspectorTest.log('\nReleased object group.');
+
+    const {result:{objects}} = await Protocol.Runtime.queryObjects({
+      prototypeObjectId: objectId,
+      objectGroup: 'console'
+    });
+    logCountSinceInitial(objects.description);
+    session.disconnect();
+
+    function logCountSinceInitial(description) {
+      const count = parseInt(/Array\((\d+)\)/.exec(description)[1]);
+      if (typeof initialArrayCount === 'undefined')
+        initialArrayCount = count;
+      InspectorTest.logMessage(`Results since initial: ${count - initialArrayCount}`);
+    }
+  },
 ]);
 
 const constructorsNameFunction = `
diff --git a/deps/v8/test/inspector/runtime/terminate-execution-expected.txt b/deps/v8/test/inspector/runtime/terminate-execution-expected.txt
new file mode 100644
index 00000000000..b64854cf80b
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/terminate-execution-expected.txt
@@ -0,0 +1,66 @@
+Tests Runtime.terminateExecution
+Terminate first evaluation (it forces injected-script-source compilation)
+{
+    id : <messageId>
+    result : {
+    }
+}
+{
+    error : {
+        code : -32000
+        message : Cannot access specified execution context
+    }
+    id : <messageId>
+}
+Checks that we reset termination after evaluation
+{
+    description : 42
+    type : number
+    value : 42
+}
+{
+    id : <messageId>
+    result : {
+        result : {
+            type : undefined
+        }
+    }
+}
+Terminate evaluation when injected-script-source already compiled
+{
+    id : <messageId>
+    result : {
+    }
+}
+{
+    error : {
+        code : -32000
+        message : Execution was terminated
+    }
+    id : <messageId>
+}
+Terminate script evaluated with v8 API
+{
+    id : <messageId>
+    result : {
+    }
+}
+Terminate chained callback
+Pause inside microtask and terminate execution
+{
+    id : <messageId>
+    result : {
+    }
+}
+{
+    type : string
+    value : separate eval after while(true)
+}
+{
+    id : <messageId>
+    result : {
+        result : {
+            type : undefined
+        }
+    }
+}
diff --git a/deps/v8/test/inspector/runtime/terminate-execution.js b/deps/v8/test/inspector/runtime/terminate-execution.js
new file mode 100644
index 00000000000..feaf52eb2c1
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/terminate-execution.js
@@ -0,0 +1,60 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+    InspectorTest.start('Tests Runtime.terminateExecution');
+
+(async function test() {
+  Protocol.Runtime.enable();
+  Protocol.Runtime.onConsoleAPICalled(
+      message => InspectorTest.logMessage(message.params.args[0]));
+  InspectorTest.log(
+      'Terminate first evaluation (it forces injected-script-source compilation)');
+  await Promise.all([
+    Protocol.Runtime.terminateExecution().then(InspectorTest.logMessage),
+    Protocol.Runtime.evaluate({expression: 'console.log(42)'})
+        .then(InspectorTest.logMessage)
+  ]);
+
+  InspectorTest.log('Checks that we reset termination after evaluation');
+  InspectorTest.logMessage(
+      await Protocol.Runtime.evaluate({expression: 'console.log(42)'}));
+  InspectorTest.log(
+      'Terminate evaluation when injected-script-source already compiled');
+  await Promise.all([
+    Protocol.Runtime.terminateExecution().then(InspectorTest.logMessage),
+    Protocol.Runtime.evaluate({expression: 'console.log(42)'})
+        .then(InspectorTest.logMessage)
+  ]);
+
+  InspectorTest.log('Terminate script evaluated with v8 API');
+  const terminated =
+      Protocol.Runtime.terminateExecution().then(InspectorTest.logMessage);
+  contextGroup.addScript('console.log(42)');
+  await terminated;
+
+  InspectorTest.log('Terminate chained callback');
+  Protocol.Debugger.enable();
+  const paused = Protocol.Debugger.oncePaused();
+  await Protocol.Runtime.evaluate({
+    expression: `let p = new Promise(resolve => setTimeout(resolve, 0));
+    p.then(() => {
+        while(true){ debugger; }
+      }).then(() => console.log('chained after chained callback'));
+    p.then(() => { console.log('another chained callback'); });
+    undefined`
+  });
+  await paused;
+
+  InspectorTest.log('Pause inside microtask and terminate execution');
+  Protocol.Runtime.terminateExecution().then(InspectorTest.logMessage);
+  await Protocol.Debugger.resume();
+  await Protocol.Runtime
+      .evaluate({expression: `console.log('separate eval after while(true)')`})
+      .then(InspectorTest.logMessage);
+  await Protocol.Debugger.disable();
+
+  await Protocol.Runtime.disable();
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/testcfg.py b/deps/v8/test/inspector/testcfg.py
index 64fa163a5eb..66db34b5629 100644
--- a/deps/v8/test/inspector/testcfg.py
+++ b/deps/v8/test/inspector/testcfg.py
@@ -14,7 +14,7 @@
 RESOURCES_FOLDER = "resources"
 
 class TestSuite(testsuite.TestSuite):
-  def ListTests(self, context):
+  def ListTests(self):
     tests = []
     for dirname, dirs, files in os.walk(
         os.path.join(self.root), followlinks=True):
@@ -43,7 +43,7 @@ def __init__(self, *args, **kwargs):
 
     self._source_flags = self._parse_source_flags()
 
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     return [
       os.path.join(self.suite.root, PROTOCOL_TEST_JS),
       os.path.join(self.suite.root, self.path + self._get_suffix()),
@@ -65,5 +65,5 @@ def output_proc(self):
         os.path.join(self.suite.root, self.path) + EXPECTED_SUFFIX)
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/intl/BUILD.gn b/deps/v8/test/intl/BUILD.gn
new file mode 100644
index 00000000000..671fb055772
--- /dev/null
+++ b/deps/v8/test/intl/BUILD.gn
@@ -0,0 +1,16 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+group("v8_intl") {
+  testonly = true
+
+  data_deps = [
+    "../..:d8",
+    "../../tools:v8_testrunner",
+  ]
+
+  data = [
+    "./",
+  ]
+}
diff --git a/deps/v8/test/intl/date-format/month-far-future.js b/deps/v8/test/intl/date-format/month-far-future.js
new file mode 100644
index 00000000000..930ac388b31
--- /dev/null
+++ b/deps/v8/test/intl/date-format/month-far-future.js
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test for crbug.com/801602 .
+
+var locales = [
+    "en-u-ca-gregori",
+    "fa-u-ca-persian",
+    "ar-u-ca-islamic-civil",
+    "ar-u-ca-islamic-umalqura",
+    "ar-u-ca-islamic-tbla",
+    "ar-u-ca-islamic-rgsa",
+    "he-u-ca-hebrew",
+    "zh-u-ca-chinese",
+    "ko-u-ca-dangi",
+    "ja-u-ca-japanese",
+    "am-u-ca-ethiopic",
+    "am-u-ca-ethioaa",
+    "hi-u-ca-indian",
+    "th-u-ca-buddhist",
+];
+
+var hugeNum = 1.7976931348623157e+308;
+
+locales.forEach(function(loc) {
+  var df = new Intl.DateTimeFormat(loc, {month: "long"});
+  assertFalse(df.format(hugeNum) == '');
+}
+);
diff --git a/deps/v8/test/intl/intl.gyp b/deps/v8/test/intl/intl.gyp
deleted file mode 100644
index f2e107f5237..00000000000
--- a/deps/v8/test/intl/intl.gyp
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'intl_run',
-          'type': 'none',
-          'dependencies': [
-            '../../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../../gypfiles/features.gypi',
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'intl.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/intl/intl.isolate b/deps/v8/test/intl/intl.isolate
deleted file mode 100644
index dbeca5e55cf..00000000000
--- a/deps/v8/test/intl/intl.isolate
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'files': [
-      './',
-    ],
-  },
-  'includes': [
-    '../../src/d8.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
\ No newline at end of file
diff --git a/deps/v8/test/intl/testcfg.py b/deps/v8/test/intl/testcfg.py
index 87aece3da60..aa81c934345 100644
--- a/deps/v8/test/intl/testcfg.py
+++ b/deps/v8/test/intl/testcfg.py
@@ -31,7 +31,7 @@
 from testrunner.objects import testcase
 
 class TestSuite(testsuite.TestSuite):
-  def ListTests(self, context):
+  def ListTests(self):
     tests = []
     for dirname, dirs, files in os.walk(self.root):
       for dotted in [x for x in dirs if x.startswith('.')]:
@@ -59,7 +59,7 @@ def __init__(self, *args, **kwargs):
 
     self._source_flags = self._parse_source_flags()
 
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     files = map(lambda f: os.path.join(self.suite.root, f), [
         'assert.js',
         'utils.js',
@@ -68,19 +68,19 @@ def _get_files_params(self, ctx):
         'regexp-assert.js',
     ])
 
-    if ctx.isolates:
+    if self._test_config.isolates:
       files += ['--isolate'] + files
     return files
 
   def _get_source_flags(self):
     return self._source_flags
 
-  def _get_suite_flags(self, ctx):
+  def _get_suite_flags(self):
     return ['--allow-natives-syntax']
 
   def _get_source_path(self):
     return os.path.join(self.suite.root, self.path + self._get_suffix())
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/js-perf-test/Array/from.js b/deps/v8/test/js-perf-test/Array/from.js
new file mode 100644
index 00000000000..2c6bd265bd2
--- /dev/null
+++ b/deps/v8/test/js-perf-test/Array/from.js
@@ -0,0 +1,153 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+(() => {
+
+benchy('MixedFrom', MixedFrom, MixedFromSetup);
+benchy('SmiFrom', SmiFrom, SmiFromSetup);
+benchy('SmallSmiFrom', SmallSmiFrom, SmallSmiFromSetup);
+benchy('SmiNoMapFrom', SmiNoMapFrom, SmiNoMapFromSetup);
+benchy('SmiNoIteratorFrom', SmiNoIteratorFrom, SmiNoIteratorFromSetup);
+benchy('TransplantedFrom', TransplantedFrom, TransplantedFromSetup);
+benchy('DoubleFrom', DoubleFrom, DoubleFromSetup);
+benchy('StringFrom', StringFrom, StringFromSetup);
+benchy('StringNoMapFrom', StringNoMapFrom, StringNoMapFromSetup);
+
+function ArrayLike() {}
+ArrayLike.from = Array.from;
+
+var arg
+var result;
+var func
+
+var smi_array = [
+    1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
+    1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
+    1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
+    1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
+    1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
+];
+
+var double_array = [
+    1.5,2.5,3.5,4.5,5.5,6.5,7.5,8.5,9.5,10.5,
+    11.5,12.5,13.5,14.5,15.5,16.5,17.5,18.5,19.5,20.5,
+    1.5,2.5,3.5,4.5,5.5,6.5,7.5,8.5,9.5,10.5,
+    11.5,12.5,13.5,14.5,15.5,16.5,17.5,18.5,19.5,20.5,
+    1.5,2.5,3.5,4.5,5.5,6.5,7.5,8.5,9.5,10.5,
+    11.5,12.5,13.5,14.5,15.5,16.5,17.5,18.5,19.5,20.5,
+    1.5,2.5,3.5,4.5,5.5,6.5,7.5,8.5,9.5,10.5,
+    11.5,12.5,13.5,14.5,15.5,16.5,17.5,18.5,19.5,20.5,
+    1.5,2.5,3.5,4.5,5.5,6.5,7.5,8.5,9.5,10.5,
+    11.5,12.5,13.5,14.5,15.5,16.5,17.5,18.5,19.5,20.5,
+];
+
+var string_array = [
+    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
+    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
+    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
+    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
+    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
+    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
+    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
+    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
+    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
+    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
+];
+
+var mixed_array = [
+    1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
+    1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
+    1.5,2.5,3.5,4.5,5.5,6.5,7.5,8.5,9.5,10.5,
+    11.5,12.5,13.5,14.5,15.5,16.5,17.5,18.5,19.5,20.5,
+    1.5,2.5,3.5,4.5,5.5,6.5,7.5,8.5,9.5,10.5,
+    11.5,12.5,13.5,14.5,15.5,16.5,17.5,18.5,19.5,20.5,
+    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
+    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
+]
+
+// Although these functions have the same code, they are separated for
+// clean IC feedback.
+function SmallSmiFrom() {
+  result = Array.from(arg, func);
+}
+
+function SmiNoMapFrom() {
+  result = Array.from(arg);
+}
+
+function SmiFrom() {
+  result = Array.from(arg, func);
+}
+
+function SmiNoIteratorFrom() {
+  result = Array.from(arg, func);
+}
+
+function TransplantedFrom() {
+  result = ArrayLike.from(arg, func);
+}
+
+function DoubleFrom() {
+  result = Array.from(arg, func);
+}
+
+function StringFrom() {
+  result = Array.from(arg, func);
+}
+
+function StringNoMapFrom() {
+  result = Array.from(arg);
+}
+
+function MixedFrom() {
+  result = Array.from(arg, func);
+}
+
+function SmallSmiFromSetup() {
+  func = (v,i) => v + i;
+  arg = [1,2,3];
+}
+
+function SmiNoMapFromSetup() {
+  func = undefined;
+  arg = smi_array;
+}
+
+function SmiFromSetup() {
+  func = (v,i) => v + i;
+  arg = smi_array;
+}
+
+function SmiNoIteratorFromSetup() {
+  func = (v,i) => v + i;
+  array = smi_array;
+  arg = {length: array.length}
+  Object.assign(arg, array);
+}
+
+function TransplantedFromSetup() {
+  func = (v,i) => v + i;
+  arg = smi_array;
+}
+
+function DoubleFromSetup() {
+  func = (v,i) => v + i;
+  arg = double_array;
+}
+
+function StringFromSetup() {
+  func = (v,i) => v + i;
+  arg = string_array;
+}
+
+function StringNoMapFromSetup() {
+  func = undefined;
+  arg = string_array;
+}
+
+function MixedFromSetup() {
+  func = (v,i) => v + i;
+  arg = mixed_array;
+}
+
+})();
diff --git a/deps/v8/test/js-perf-test/Array/run.js b/deps/v8/test/js-perf-test/Array/run.js
index 15b4da94c2e..623047678a8 100644
--- a/deps/v8/test/js-perf-test/Array/run.js
+++ b/deps/v8/test/js-perf-test/Array/run.js
@@ -77,9 +77,10 @@ load('reduce.js');
 load('reduce-right.js');
 load('find.js');
 load('find-index.js');
-load('of.js');
 
 // Other Array builtins.
+load('from.js');
+load('of.js');
 load('join.js');
 load('to-string.js');
 
diff --git a/deps/v8/test/js-perf-test/ArrayLiteralSpread/run.js b/deps/v8/test/js-perf-test/ArrayLiteralSpread/run.js
new file mode 100644
index 00000000000..605df86ef94
--- /dev/null
+++ b/deps/v8/test/js-perf-test/ArrayLiteralSpread/run.js
@@ -0,0 +1,97 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+const input = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+
+
+// ----------------------------------------------------------------------------
+// Benchmark: Babel
+// ----------------------------------------------------------------------------
+
+function _toConsumableArray(arr) {
+  if (Array.isArray(arr)) {
+    for (var i = 0, arr2 = Array(arr.length); i < arr.length; i++) {
+      arr2[i] = arr[i];
+    }
+    return arr2;
+  } else {
+    return Array.from(arr);
+  }
+}
+
+function Babel() {
+  const result = [0].concat(_toConsumableArray(input));
+  if (result.length != 11) throw 666;
+}
+
+
+// ----------------------------------------------------------------------------
+// Benchmark: ForOfPush
+// ----------------------------------------------------------------------------
+
+
+function ForOfPush() {
+  const result = [0];
+  for (const x of input) {
+    result.push(x);
+  }
+  if (result.length != 11) throw 666;
+}
+
+
+// ----------------------------------------------------------------------------
+// Benchmark: ForOfSet
+// ----------------------------------------------------------------------------
+
+
+function ForOfSet() {
+  const result = [0];
+  for (const x of input) {
+    result[result.length] = x;
+  }
+  if (result.length != 11) throw 666;
+}
+
+
+// ----------------------------------------------------------------------------
+// Benchmark: Spread
+// ----------------------------------------------------------------------------
+
+
+function Spread() {
+  const result = [0, ...input];
+  if (result.length != 11) throw 666;
+}
+
+
+// ----------------------------------------------------------------------------
+// Setup and Run
+// ----------------------------------------------------------------------------
+
+load('../base.js');
+
+var success = true;
+
+function PrintResult(name, result) {
+  print(name + '-ArrayLiteralSpread(Score): ' + result);
+}
+
+function PrintError(name, error) {
+  PrintResult(name, error);
+  success = false;
+}
+
+function CreateBenchmark(name, f) {
+  new BenchmarkSuite(name, [100], [ new Benchmark(name, false, false, 0, f) ]);
+}
+
+CreateBenchmark('Babel', Babel);
+CreateBenchmark('ForOfPush', ForOfPush);
+CreateBenchmark('ForOfSet', ForOfSet);
+CreateBenchmark('Spread', Spread);
+
+BenchmarkSuite.config.doWarmup = undefined;
+BenchmarkSuite.config.doDeterministic = undefined;
+BenchmarkSuite.RunSuites({NotifyResult: PrintResult, NotifyError: PrintError});
diff --git a/deps/v8/test/js-perf-test/Generators/generators.js b/deps/v8/test/js-perf-test/Generators/generators.js
index d49dee3069c..b891f2a5fbd 100644
--- a/deps/v8/test/js-perf-test/Generators/generators.js
+++ b/deps/v8/test/js-perf-test/Generators/generators.js
@@ -67,7 +67,7 @@ function Loop() {
 // ----------------------------------------------------------------------------
 
 function* multiples(x) {
-  let skip = function.sent || 0;
+  let skip = 2;
   let next = 0;
   while (true) {
     if (skip === 0) {
diff --git a/deps/v8/test/js-perf-test/JSTests.json b/deps/v8/test/js-perf-test/JSTests.json
index a1a19f5988c..4f1e39c58d2 100644
--- a/deps/v8/test/js-perf-test/JSTests.json
+++ b/deps/v8/test/js-perf-test/JSTests.json
@@ -56,9 +56,33 @@
       "path": ["Generators"],
       "main": "run.js",
       "resources": ["generators.js"],
-      "flags": ["--harmony-function-sent"],
       "results_regexp": "^Generators\\-Generators\\(Score\\): (.+)$"
     },
+    {
+      "name": "ArrayLiteralSpread",
+      "path": ["ArrayLiteralSpread"],
+      "main": "run.js",
+      "resources": [],
+      "results_regexp": "^%s\\-ArrayLiteralSpread\\(Score\\): (.+)$",
+      "tests": [
+        {"name": "Babel"},
+        {"name": "ForOfPush"},
+        {"name": "ForOfSet"},
+        {"name": "Spread"}
+      ]
+    },
+    {
+      "name": "SpreadCallsGeneral",
+      "path": ["SpreadCallsGeneral"],
+      "main": "run.js",
+      "resources": [],
+      "results_regexp": "^%s\\-SpreadCallsGeneral\\(Score\\): (.+)$",
+      "tests": [
+        {"name": "ApplySpreadLiteral"},
+        {"name": "SpreadCall"},
+        {"name": "SpreadCallSpreadLiteral"}
+      ]
+    },
     {
       "name": "RestParameters",
       "path": ["RestParameters"],
@@ -179,18 +203,99 @@
     {
       "name": "Strings",
       "path": ["Strings"],
-      "main": "run.js",
-      "resources": ["harmony-string.js", "string-indexof.js"],
-      "results_regexp": "^%s\\-Strings\\(Score\\): (.+)$",
       "run_count": 1,
       "timeout": 240,
       "timeout_arm": 420,
+      "units": "score",
       "tests": [
-        {"name": "StringFunctions"},
-        {"name": "StringIndexOfConstant"},
-        {"name": "StringIndexOfNonConstant"},
-        {"name": "StringCharCodeAtConstant"},
-        {"name": "StringCharCodeAtNonConstant"}
+        {
+          "name": "StringFunctions",
+          "main": "run.js",
+          "resources": [ "harmony-string.js" ],
+          "test_flags": [ "harmony-string" ],
+          "results_regexp": "^%s\\-Strings\\(Score\\): (.+)$",
+          "run_count": 1,
+          "tests": [
+            {"name": "StringRepeat"},
+            {"name": "StringStartsWith"},
+            {"name": "StringEndsWith"},
+            {"name": "StringIncludes"},
+            {"name": "StringFromCodePoint"},
+            {"name": "StringCodePointAt"},
+            {"name": "StringCodePointAtSum"}
+          ]
+        },
+        {
+          "name": "StringIndexOf",
+          "main": "run.js",
+          "resources": [ "string-indexof.js" ],
+          "test_flags": [ "string-indexof" ],
+          "results_regexp": "^%s\\-Strings\\(Score\\): (.+)$",
+          "run_count": 1,
+          "tests": [
+            {"name": "StringIndexOfConstant"},
+            {"name": "StringIndexOfNonConstant"}
+          ]
+        },
+        {
+          "name": "StringAt",
+          "main": "run.js",
+          "resources": [ "string-stringat.js" ],
+          "test_flags": [ "string-stringat" ],
+          "results_regexp": "^%s\\-Strings\\(Score\\): (.+)$",
+          "run_count": 1,
+          "tests": [
+            {"name": "StringCharCodeAtConstant"},
+            {"name": "StringCharCodeAtNonConstant"},
+            {"name": "StringCharCodeAtConstantInbounds"},
+            {"name": "StringCharCodeAtNonConstantInbounds"},
+            {"name": "StringCodePointAtConstant"},
+            {"name": "StringCodePointAtNonConstant"},
+            {"name": "StringCodePointAtConstantInbounds"},
+            {"name": "StringCodePointAtNonConstantInbounds"}
+          ]
+        },
+        {
+          "name": "StringAtComparison",
+          "main": "run.js",
+          "resources": [ "string-stringat-comp.js" ],
+          "test_flags": [ "string-stringat-comp" ],
+          "results_regexp": "^%s\\-Strings\\(Score\\): (.+)$",
+          "run_count": 1,
+          "tests": [
+            {"name": "charCodeAt_const"},
+            {"name": "charCodeAt_both"},
+            {"name": "charAt_const"},
+            {"name": "charAt_never"},
+            {"name": "charAt_both"},
+            {"name": "stringIndex_const"}
+          ]
+        },
+        {
+          "name": "StringSubstring",
+          "main": "run.js",
+          "resources": [ "string-substring.js" ],
+          "test_flags": [ "string-substring" ],
+          "results_regexp": "^%s\\-Strings\\(Score\\): (.+)$",
+          "run_count": 1,
+          "tests": [
+            {"name": "StringDropFirstSlice"},
+            {"name": "StringDropFirstSubstr"},
+            {"name": "StringDropFirstSubstring"},
+            {"name": "StringTakeFirstSlice"},
+            {"name": "StringTakeFirstSubstr"},
+            {"name": "StringTakeFirstSubstring"},
+            {"name": "StringDropLastSlice"},
+            {"name": "StringDropLastSubstr"},
+            {"name": "StringDropLastSubstring"},
+            {"name": "StringTakeLastSlice"},
+            {"name": "StringTakeLastSubstr"},
+            {"name": "StringTakeLastSubstring"},
+            {"name": "StringDropFirstSlice"},
+            {"name": "StringDropFirstSubstr"},
+            {"name": "StringDropFirstSubstring"}
+          ]
+        }
       ]
     },
     {
@@ -397,7 +502,7 @@
       "resources": [
         "filter.js", "map.js", "every.js", "join.js", "some.js",
         "reduce.js", "reduce-right.js", "to-string.js", "find.js",
-        "find-index.js", "of.js"
+        "find-index.js", "from.js", "of.js", "for-each.js"
       ],
       "flags": [
         "--allow-natives-syntax"
@@ -473,7 +578,16 @@
         {"name": "SmallTransplantedArrayOf"},
         {"name": "SmallDoubleArrayOf"},
         {"name": "SmallStringArrayOf"},
-        {"name": "SmallMixedArrayOf"}
+        {"name": "SmallMixedArrayOf"},
+        {"name": "SmiFrom"},
+        {"name": "SmallSmiFrom"},
+        {"name": "SmiNoMapFrom"},
+        {"name": "SmiNoIteratorFrom"},
+        {"name": "TransplantedFrom"},
+        {"name": "DoubleFrom"},
+        {"name": "StringFrom"},
+        {"name": "StringNoMapFrom"},
+        {"name": "MixedFrom"}
       ]
     },
     {
diff --git a/deps/v8/test/js-perf-test/OWNERS b/deps/v8/test/js-perf-test/OWNERS
new file mode 100644
index 00000000000..e46cedb98bf
--- /dev/null
+++ b/deps/v8/test/js-perf-test/OWNERS
@@ -0,0 +1 @@
+per-file JSTests.json=petermarshall@chromium.org
diff --git a/deps/v8/test/js-perf-test/SixSpeed.json b/deps/v8/test/js-perf-test/SixSpeed.json
index a2fb5608861..3b9092f4703 100644
--- a/deps/v8/test/js-perf-test/SixSpeed.json
+++ b/deps/v8/test/js-perf-test/SixSpeed.json
@@ -93,7 +93,6 @@
     {
       "name": "Spread",
       "path": ["SixSpeed"],
-      "flags": ["--future"],
       "results_regexp": "^%s\\(Score\\): (.+)$",
       "tests": [
         {
@@ -144,7 +143,6 @@
     {
       "name": "SuperSpread",
       "path": ["SixSpeed"],
-      "flags": ["--future"],
       "results_regexp": "^%s\\(Score\\): (.+)$",
       "tests": [
         {
@@ -170,7 +168,6 @@
     {
       "name": "SpreadLiteral",
       "path": ["SixSpeed"],
-      "flags": ["--future"],
       "results_regexp": "^%s\\(Score\\): (.+)$",
       "tests": [
         {
diff --git a/deps/v8/test/js-perf-test/SpreadCallsGeneral/run.js b/deps/v8/test/js-perf-test/SpreadCallsGeneral/run.js
new file mode 100644
index 00000000000..fc4bf35a779
--- /dev/null
+++ b/deps/v8/test/js-perf-test/SpreadCallsGeneral/run.js
@@ -0,0 +1,69 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+function foo(...args) {
+  if (args.length != 4) throw 666;
+}
+
+const front = [1, 2];
+const mid = 3;
+const back = function*() { yield 4 };
+
+
+// ----------------------------------------------------------------------------
+// Benchmark: SpreadCall
+// ----------------------------------------------------------------------------
+
+function SpreadCall() {
+  foo(...front, mid, ...back());
+}
+
+
+// ----------------------------------------------------------------------------
+// Benchmark: SpreadCallSpreadLiteral
+// ----------------------------------------------------------------------------
+
+function SpreadCallSpreadLiteral() {
+  foo(...[...front, mid, ...back()]);
+}
+
+
+// ----------------------------------------------------------------------------
+// Benchmark: ApplySpreadLiteral
+// ----------------------------------------------------------------------------
+
+function ApplySpreadLiteral() {
+  foo.apply(this, [...front, mid, ...back()]);
+}
+
+
+// ----------------------------------------------------------------------------
+// Setup and Run
+// ----------------------------------------------------------------------------
+
+load('../base.js');
+
+var success = true;
+
+function PrintResult(name, result) {
+  print(name + '-SpreadCallsGeneral(Score): ' + result);
+}
+
+function PrintError(name, error) {
+  PrintResult(name, error);
+  success = false;
+}
+
+function CreateBenchmark(name, f) {
+  new BenchmarkSuite(name, [100], [ new Benchmark(name, false, false, 0, f) ]);
+}
+
+CreateBenchmark('ApplySpreadLiteral', ApplySpreadLiteral);
+CreateBenchmark('SpreadCall', SpreadCall);
+CreateBenchmark('SpreadCallSpreadLiteral', SpreadCallSpreadLiteral);
+
+BenchmarkSuite.config.doWarmup = undefined;
+BenchmarkSuite.config.doDeterministic = undefined;
+BenchmarkSuite.RunSuites({NotifyResult: PrintResult, NotifyError: PrintError});
diff --git a/deps/v8/test/js-perf-test/Strings/harmony-string.js b/deps/v8/test/js-perf-test/Strings/harmony-string.js
index c2eac4ee33d..cbab3d9455e 100644
--- a/deps/v8/test/js-perf-test/Strings/harmony-string.js
+++ b/deps/v8/test/js-perf-test/Strings/harmony-string.js
@@ -2,19 +2,39 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-new BenchmarkSuite('StringFunctions', [1000], [
+new BenchmarkSuite('StringRepeat', [10], [
   new Benchmark('StringRepeat', false, false, 0,
-                Repeat, RepeatSetup, RepeatTearDown),
+    Repeat, RepeatSetup, RepeatTearDown),
+]);
+
+new BenchmarkSuite('StringStartsWith', [10], [
   new Benchmark('StringStartsWith', false, false, 0,
-                StartsWith, WithSetup, WithTearDown),
+    StartsWith, WithSetup, WithTearDown),
+]);
+
+new BenchmarkSuite('StringEndsWith', [10], [
   new Benchmark('StringEndsWith', false, false, 0,
-                EndsWith, WithSetup, WithTearDown),
+    EndsWith, WithSetup, WithTearDown),
+]);
+
+new BenchmarkSuite('StringIncludes', [10], [
   new Benchmark('StringIncludes', false, false, 0,
-                Includes, IncludesSetup, WithTearDown),
+    Includes, IncludesSetup, WithTearDown),
+]);
+
+new BenchmarkSuite('StringFromCodePoint', [10000], [
   new Benchmark('StringFromCodePoint', false, false, 0,
-                FromCodePoint, FromCodePointSetup, FromCodePointTearDown),
+    FromCodePoint, FromCodePointSetup, FromCodePointTearDown),
+]);
+
+new BenchmarkSuite('StringCodePointAt', [1000], [
   new Benchmark('StringCodePointAt', false, false, 0,
-                CodePointAt, CodePointAtSetup, CodePointAtTearDown),
+    CodePointAt, CodePointAtSetup, CodePointAtTearDown),
+]);
+
+new BenchmarkSuite('StringCodePointAtSum', [100000], [
+  new Benchmark('StringCodePointAtSum', false, true, 3,
+    CodePointAtSum, CodePointAtSumSetup),
 ]);
 
 
@@ -32,7 +52,7 @@ function Repeat() {
 
 function RepeatTearDown() {
   var expected = "";
-  for(var i = 0; i < 1000; i++) {
+  for (var i = 0; i < 1000; i++) {
     expected += stringRepeatSource;
   }
   return result === expected;
@@ -70,19 +90,20 @@ function Includes() {
 }
 
 var MAX_CODE_POINT = 0xFFFFF;
+const K = 1024;
 
 function FromCodePointSetup() {
-  result = new Array(MAX_CODE_POINT + 1);
+  result = new Array((MAX_CODE_POINT + 1) / K);
 }
 
 function FromCodePoint() {
-  for (var i = 0; i <= MAX_CODE_POINT; i++) {
+  for (var i = 0; i <= MAX_CODE_POINT; i += K) {
     result[i] = String.fromCodePoint(i);
   }
 }
 
 function FromCodePointTearDown() {
-  for (var i = 0; i <= MAX_CODE_POINT; i++) {
+  for (var i = 0; i <= MAX_CODE_POINT; i += K) {
     if (i !== result[i].codePointAt(0)) return false;
   }
   return true;
@@ -92,8 +113,8 @@ function FromCodePointTearDown() {
 var allCodePoints;
 
 function CodePointAtSetup() {
-  allCodePoints = new Array(MAX_CODE_POINT + 1);
-  for (var i = 0; i <= MAX_CODE_POINT; i++) {
+  allCodePoints = new Array((MAX_CODE_POINT + 1) / K);
+  for (var i = 0; i <= MAX_CODE_POINT; i += K) {
     allCodePoints = String.fromCodePoint(i);
   }
   result = undefined;
@@ -101,11 +122,24 @@ function CodePointAtSetup() {
 
 function CodePointAt() {
   result = 0;
-  for (var i = 0; i <= MAX_CODE_POINT; i++) {
+  for (var i = 0; i <= MAX_CODE_POINT; i += K) {
     result += allCodePoints.codePointAt(i);
   }
 }
 
 function CodePointAtTearDown() {
-  return result === MAX_CODE_POINT * (MAX_CODE_POINT + 1) / 2;
+  return result === (MAX_CODE_POINT / K) * ((MAX_CODE_POINT / K) + 1) / 2;
+}
+
+var payload;
+
+function CodePointAtSumSetup() {
+  payload = "abcdefghijklmnopqrstuvwxyz";
+  for(var j = 0; j < 16; ++j) payload += payload;
+}
+
+function CodePointAtSum() {
+  var c = 0;
+  for(j=payload.length-1; j >=0; --j) c+=payload.charCodeAt(j);
+  return c;
 }
diff --git a/deps/v8/test/js-perf-test/Strings/run.js b/deps/v8/test/js-perf-test/Strings/run.js
index 66dd9b21881..8f3f383240e 100644
--- a/deps/v8/test/js-perf-test/Strings/run.js
+++ b/deps/v8/test/js-perf-test/Strings/run.js
@@ -4,9 +4,7 @@
 
 
 load('../base.js');
-load('harmony-string.js');
-load('string-indexof.js');
-
+load(arguments[0] + '.js');
 
 var success = true;
 
diff --git a/deps/v8/test/js-perf-test/Strings/string-indexof.js b/deps/v8/test/js-perf-test/Strings/string-indexof.js
index a2049e0fe6d..1e077bc96bb 100644
--- a/deps/v8/test/js-perf-test/Strings/string-indexof.js
+++ b/deps/v8/test/js-perf-test/Strings/string-indexof.js
@@ -34,36 +34,3 @@ function StringIndexOfNonConstant() {
 
   return sum;
 }
-
-new BenchmarkSuite('StringCharCodeAtConstant', [3], [
-  new Benchmark('StringIndexOfConstant', true, false, 0,
-  StringCharCodeAtConstant),
-]);
-
-new BenchmarkSuite('StringCharCodeAtNonConstant', [3], [
-  new Benchmark('StringIndexOfNonConstant', true, false, 0,
-  StringCharCodeAtNonConstant),
-]);
-
-const string = "qweruiplkjhgfdsazxccvbnm";
-const indices = [1, 13, 32, 100, "xx"];
-
-function StringCharCodeAtConstant() {
-  var sum = 0;
-
-  for (var j = 0; j < indices.length - 1; ++j) {
-    sum += string.charCodeAt(indices[j] | 0);
-  }
-
-  return sum;
-}
-
-function StringCharCodeAtNonConstant() {
-  var sum = 0;
-
-  for (var j = 0; j < indices.length - 1; ++j) {
-    sum += string.charCodeAt(indices[j]);
-  }
-
-  return sum;
-}
diff --git a/deps/v8/test/js-perf-test/Strings/string-stringat-comp.js b/deps/v8/test/js-perf-test/Strings/string-stringat-comp.js
new file mode 100644
index 00000000000..37c5e1eabd2
--- /dev/null
+++ b/deps/v8/test/js-perf-test/Strings/string-stringat-comp.js
@@ -0,0 +1,50 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function benchy(f, name) {
+  new BenchmarkSuite(name, [1], [
+    new Benchmark(name, true, false, 0, f),
+  ]);
+}
+
+const input = 'äϠ�𝌆 Lorem ipsum test test';
+
+function helper(fn) {
+  var sum = 0;
+  for (var i = 0; i < input.length; i++) {
+    sum += fn(input, i, i);
+  }
+  return sum;
+}
+
+function charCodeAt(str, i) {
+  return str.charCodeAt(i) === 116;
+}
+
+function charCodeAtBoth(str, i, j) {
+  return str.charCodeAt(j) == str.charCodeAt(i);
+}
+
+function charAt(str, i) {
+  return 't' == str.charAt(i);
+}
+
+function charAtNever(str, i) {
+  return '𝌆' == str.charAt(i);
+}
+
+function charAtBoth(str, i, j) {
+  return str.charAt(j) == str.charAt(i);
+}
+
+function stringIndex(str, i) {
+  return str[i] === 't';
+}
+
+benchy(() => helper(charCodeAt), "charCodeAt_const");
+benchy(() => helper(charCodeAtBoth), "charCodeAt_both");
+benchy(() => helper(charAt), "charAt_const");
+benchy(() => helper(charAtNever), "charAt_never");
+benchy(() => helper(charAtBoth), "charAt_both");
+benchy(() => helper(stringIndex), "stringIndex_const");
diff --git a/deps/v8/test/js-perf-test/Strings/string-stringat.js b/deps/v8/test/js-perf-test/Strings/string-stringat.js
new file mode 100644
index 00000000000..1e0be73ce01
--- /dev/null
+++ b/deps/v8/test/js-perf-test/Strings/string-stringat.js
@@ -0,0 +1,129 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+new BenchmarkSuite('StringCharCodeAtConstant', [3], [
+  new Benchmark('StringCharCodeAtConstant', true, false, 0,
+  StringCharCodeAtConstant),
+]);
+
+new BenchmarkSuite('StringCharCodeAtNonConstant', [3], [
+  new Benchmark('StringCharCodeAtNonConstant', true, false, 0,
+  StringCharCodeAtNonConstant),
+]);
+
+new BenchmarkSuite('StringCharCodeAtConstantInbounds', [3], [
+  new Benchmark('StringCharCodeAtConstantInbounds', true, false, 0,
+  StringCharCodeAtConstantInbounds),
+]);
+
+new BenchmarkSuite('StringCharCodeAtNonConstantInbounds', [3], [
+  new Benchmark('StringCharCodeAtNonConstantInbounds', true, false, 0,
+  StringCharCodeAtNonConstantInbounds),
+]);
+
+const string = "qweruiplkjhgfdsazxccvbnm";
+const indices = [1, 13, 32, 100, "xx"];
+const indicesInbounds = [1, 7, 13, 17, "xx"];
+
+function StringCharCodeAtConstant() {
+  var sum = 0;
+
+  for (var j = 0; j < indices.length - 1; ++j) {
+    sum += string.charCodeAt(indices[j] | 0);
+  }
+
+  return sum;
+}
+
+function StringCharCodeAtNonConstant() {
+  var sum = 0;
+
+  for (var j = 0; j < indices.length - 1; ++j) {
+    sum += string.charCodeAt(indices[j]);
+  }
+
+  return sum;
+}
+
+function StringCharCodeAtConstantInbounds() {
+  var sum = 0;
+
+  for (var j = 0; j < indicesInbounds.length - 1; ++j) {
+    sum += string.charCodeAt(indicesInbounds[j] | 0);
+  }
+
+  return sum;
+}
+
+function StringCharCodeAtNonConstantInbounds() {
+  var sum = 0;
+
+  for (var j = 0; j < indicesInbounds.length - 1; ++j) {
+    sum += string.charCodeAt(indicesInbounds[j]);
+  }
+
+  return sum;
+}
+
+new BenchmarkSuite('StringCodePointAtConstant', [3], [
+  new Benchmark('StringCodePointAtConstant', true, false, 0,
+  StringCodePointAtConstant),
+]);
+
+new BenchmarkSuite('StringCodePointAtNonConstant', [3], [
+  new Benchmark('StringCodePointAtNonConstant', true, false, 0,
+  StringCodePointAtNonConstant),
+]);
+
+new BenchmarkSuite('StringCodePointAtConstantInbounds', [3], [
+  new Benchmark('StringCodePointAtConstantInbounds', true, false, 0,
+  StringCodePointAtConstantInbounds),
+]);
+
+new BenchmarkSuite('StringCodePointAtNonConstantInbounds', [3], [
+  new Benchmark('StringCodePointAtNonConstantInbounds', true, false, 0,
+  StringCodePointAtNonConstantInbounds),
+]);
+
+const unicode_string = "qweräϠ�𝌆krefdäϠ�𝌆ccäϠ�𝌆";
+
+function StringCodePointAtConstant() {
+  var sum = 0;
+
+  for (var j = 0; j < indices.length - 1; ++j) {
+    sum += unicode_string.codePointAt(indices[j] | 0);
+  }
+
+  return sum;
+}
+
+function StringCodePointAtNonConstant() {
+  var sum = 0;
+
+  for (var j = 0; j < indices.length - 1; ++j) {
+    sum += unicode_string.codePointAt(indices[j]);
+  }
+
+  return sum;
+}
+
+function StringCodePointAtConstantInbounds() {
+  var sum = 0;
+
+  for (var j = 0; j < indicesInbounds.length - 1; ++j) {
+    sum += unicode_string.codePointAt(indicesInbounds[j] | 0);
+  }
+
+  return sum;
+}
+
+function StringCodePointAtNonConstantInbounds() {
+  var sum = 0;
+
+  for (var j = 0; j < indicesInbounds.length - 1; ++j) {
+    sum += unicode_string.codePointAt(indicesInbounds[j]);
+  }
+
+  return sum;
+}
diff --git a/deps/v8/test/js-perf-test/Strings/string-substring.js b/deps/v8/test/js-perf-test/Strings/string-substring.js
new file mode 100644
index 00000000000..865c709becd
--- /dev/null
+++ b/deps/v8/test/js-perf-test/Strings/string-substring.js
@@ -0,0 +1,206 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function benchy (f, name) {
+  new BenchmarkSuite(name, [5], [
+    new Benchmark(name, true, false, 0,
+    f),
+  ]);
+}
+
+const subjects = ['abcde', '123456', 'aqwsde', "nbvveqxu", "f03ks-120-3;jfkm;ajp3f", "sd-93u498thikefnow8y3-0rh1nalksfnwo8y3t19-3r8hoiefnw"];
+
+// Drop first element.
+
+function StringDropFirstSlice() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j];
+    sum += s.slice(1);
+  }
+
+  return sum;
+}
+benchy(StringDropFirstSlice, "StringDropFirstSlice");
+
+function StringDropFirstSubstr() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j];
+    sum += s.substr(1);
+  }
+
+  return sum;
+}
+benchy(StringDropFirstSubstr, "StringDropFirstSubstr");
+
+function StringDropFirstSubstring() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j];
+    sum += s.substring(1);
+  }
+
+  return sum;
+}
+benchy(StringDropFirstSubstring, "StringDropFirstSubstring");
+
+
+// Take first element.
+
+function StringTakeFirstSlice() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j];
+    sum += s.slice(0,1);
+  }
+
+  return sum;
+}
+benchy(StringTakeFirstSlice, "StringTakeFirstSlice");
+
+function StringTakeFirstSubstr() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j];
+    sum += s.substr(0,1);
+  }
+
+  return sum;
+}
+benchy(StringTakeFirstSubstr, "StringTakeFirstSubstr");
+
+function StringTakeFirstSubstring() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j];
+    sum += s.substring(0, 1);
+  }
+
+  return sum;
+}
+benchy(StringTakeFirstSubstring, "StringTakeFirstSubstring");
+
+
+// Drop last element.
+
+function StringDropLastSlice() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j];
+    sum += s.slice(0, -1);
+  }
+
+  return sum;
+}
+benchy(StringDropLastSlice, "StringDropLastSlice");
+
+function StringDropLastSubstr() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j];
+    sum += s.substr(0, s.length-1);
+  }
+
+  return sum;
+}
+benchy(StringDropLastSubstr, "StringDropLastSubstr");
+
+function StringDropLastSubstring() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j];
+    sum += s.substring(0, s.length-1);
+  }
+
+  return sum;
+}
+benchy(StringDropLastSubstring, "StringDropLastSubstring");
+
+
+// Take last element.
+
+function StringTakeLastSlice() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j];
+    sum += s.slice(-1);
+  }
+
+  return sum;
+}
+benchy(StringTakeLastSlice, "StringTakeLastSlice");
+
+function StringTakeLastSubstr() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j];
+    sum += s.substr(-1);
+  }
+
+  return sum;
+}
+benchy(StringTakeLastSubstr, "StringTakeLastSubstr");
+
+function StringTakeLastSubstring() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j];
+    sum += s.substring(s.length-1, s.length);
+  }
+
+  return sum;
+}
+benchy(StringTakeLastSubstring, "StringTakeLastSubstring");
+
+
+// Drop first and last.
+
+function StringDropFirstSlice() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j];
+    sum += s.slice(1, -1);
+  }
+
+  return sum;
+}
+benchy(StringDropFirstSlice, "StringDropFirstSlice");
+
+function StringDropFirstSubstr() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j]
+    sum += s.substr(1, s.length-2);
+  }
+
+  return sum;
+}
+benchy(StringDropFirstSubstr, "StringDropFirstSubstr");
+
+function StringDropFirstSubstring() {
+  var sum = "";
+
+  for (var j = 0; j < subjects.length; ++j) {
+    let s = subjects[j];
+    sum += s.substring(1, s.length-1);
+  }
+
+  return sum;
+}
+benchy(StringDropFirstSubstring, "StringDropFirstSubstring");
diff --git a/deps/v8/test/message/BUILD.gn b/deps/v8/test/message/BUILD.gn
new file mode 100644
index 00000000000..c8800ed19e4
--- /dev/null
+++ b/deps/v8/test/message/BUILD.gn
@@ -0,0 +1,16 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+group("v8_message") {
+  testonly = true
+
+  data_deps = [
+    "../..:d8",
+    "../../tools:v8_testrunner",
+  ]
+
+  data = [
+    "./",
+  ]
+}
diff --git a/deps/v8/test/message/fail/call-expression.js b/deps/v8/test/message/fail/call-expression.js
new file mode 100644
index 00000000000..757b5349400
--- /dev/null
+++ b/deps/v8/test/message/fail/call-expression.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+const config = {
+  min: Math.min(1, 2),
+  func: myfunc(),
+}
diff --git a/deps/v8/test/message/fail/call-expression.out b/deps/v8/test/message/fail/call-expression.out
new file mode 100644
index 00000000000..ece67f6959e
--- /dev/null
+++ b/deps/v8/test/message/fail/call-expression.out
@@ -0,0 +1,5 @@
+*%(basename)s:8: ReferenceError: myfunc is not defined
+  func: myfunc(),
+        ^
+ReferenceError: myfunc is not defined
+    at *%(basename)s:8:9
\ No newline at end of file
diff --git a/deps/v8/test/message/fail/function-sent-escaped.js b/deps/v8/test/message/fail/function-sent-escaped.js
deleted file mode 100644
index aa17258f854..00000000000
--- a/deps/v8/test/message/fail/function-sent-escaped.js
+++ /dev/null
@@ -1,10 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-//
-// Flags: --harmony-function-sent
-
-function* f() {
-  return function.s\u0065nt;
-}
-for (var i of f()) print(i);
diff --git a/deps/v8/test/message/fail/function-sent-escaped.out b/deps/v8/test/message/fail/function-sent-escaped.out
deleted file mode 100644
index d9613d8ef41..00000000000
--- a/deps/v8/test/message/fail/function-sent-escaped.out
+++ /dev/null
@@ -1,4 +0,0 @@
-*%(basename)s:8: SyntaxError: 'function.sent' must not contain escaped characters
-  return function.s\u0065nt;
-         ^^^^^^^^^^^^^^^^^^
-SyntaxError: 'function.sent' must not contain escaped characters
diff --git a/deps/v8/test/message/fail/map-arg-non-iterable.js b/deps/v8/test/message/fail/map-arg-non-iterable.js
new file mode 100644
index 00000000000..d4cb7a7714f
--- /dev/null
+++ b/deps/v8/test/message/fail/map-arg-non-iterable.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+new Map(1);
diff --git a/deps/v8/test/message/fail/map-arg-non-iterable.out b/deps/v8/test/message/fail/map-arg-non-iterable.out
new file mode 100644
index 00000000000..78aa8ef033e
--- /dev/null
+++ b/deps/v8/test/message/fail/map-arg-non-iterable.out
@@ -0,0 +1,6 @@
+*%(basename)s:5: TypeError: 1 is not iterable
+new Map(1);
+^
+TypeError: 1 is not iterable
+    at new Map (<anonymous>)
+    at *%(basename)s:5:1
diff --git a/deps/v8/test/message/fail/octal-template-literal.js b/deps/v8/test/message/fail/octal-template-literal.js
new file mode 100644
index 00000000000..4c678faed9c
--- /dev/null
+++ b/deps/v8/test/message/fail/octal-template-literal.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+//
+
+`\123`
diff --git a/deps/v8/test/message/fail/octal-template-literal.out b/deps/v8/test/message/fail/octal-template-literal.out
new file mode 100644
index 00000000000..b0a7159ad82
--- /dev/null
+++ b/deps/v8/test/message/fail/octal-template-literal.out
@@ -0,0 +1,4 @@
+*%(basename)s:7: SyntaxError: Octal escape sequences are not allowed in template strings.
+`\123`
+  ^^
+SyntaxError: Octal escape sequences are not allowed in template strings.
diff --git a/deps/v8/test/message/fail/paren_in_arg_string.out b/deps/v8/test/message/fail/paren_in_arg_string.out
index 9784712ab8a..d71e9521224 100644
--- a/deps/v8/test/message/fail/paren_in_arg_string.out
+++ b/deps/v8/test/message/fail/paren_in_arg_string.out
@@ -1,6 +1,6 @@
-*%(basename)s:29: SyntaxError: Function arg string contains parenthesis
-var paren_in_arg_string_bad = new Function(')', 'return;');
-                              ^
-SyntaxError: Function arg string contains parenthesis
+undefined:1: SyntaxError: Arg string terminates parameters early
+(function anonymous()
+                    ^
+SyntaxError: Arg string terminates parameters early
     at new Function (<anonymous>)
     at *%(basename)s:29:31
diff --git a/deps/v8/test/message/fail/redeclaration4.js b/deps/v8/test/message/fail/redeclaration4.js
new file mode 100644
index 00000000000..3cef563f30b
--- /dev/null
+++ b/deps/v8/test/message/fail/redeclaration4.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+{
+  function foo() {}
+  function foo() {}
+}
diff --git a/deps/v8/test/message/fail/redeclaration4.out b/deps/v8/test/message/fail/redeclaration4.out
new file mode 100644
index 00000000000..9e1a7cbce93
--- /dev/null
+++ b/deps/v8/test/message/fail/redeclaration4.out
@@ -0,0 +1,5 @@
+*%(basename)s:9: SyntaxError: Identifier 'foo' has already been declared
+  function foo() {}
+  ^
+SyntaxError: Identifier 'foo' has already been declared
+
diff --git a/deps/v8/test/message/fail/redeclaration5.js b/deps/v8/test/message/fail/redeclaration5.js
new file mode 100644
index 00000000000..d47593ef08b
--- /dev/null
+++ b/deps/v8/test/message/fail/redeclaration5.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// MODULE
+
+function foo() {}
+function foo() {}
diff --git a/deps/v8/test/message/fail/redeclaration5.out b/deps/v8/test/message/fail/redeclaration5.out
new file mode 100644
index 00000000000..241582e0ee7
--- /dev/null
+++ b/deps/v8/test/message/fail/redeclaration5.out
@@ -0,0 +1,5 @@
+*%(basename)s:8: SyntaxError: Identifier 'foo' has already been declared
+function foo() {}
+^
+SyntaxError: Identifier 'foo' has already been declared
+
diff --git a/deps/v8/test/message/message.gyp b/deps/v8/test/message/message.gyp
deleted file mode 100644
index fc1ae32f4e8..00000000000
--- a/deps/v8/test/message/message.gyp
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'message_run',
-          'type': 'none',
-          'dependencies': [
-            '../../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../../gypfiles/features.gypi',
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'message.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/message/message.isolate b/deps/v8/test/message/message.isolate
deleted file mode 100644
index dbeca5e55cf..00000000000
--- a/deps/v8/test/message/message.isolate
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'files': [
-      './',
-    ],
-  },
-  'includes': [
-    '../../src/d8.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
\ No newline at end of file
diff --git a/deps/v8/test/message/mjsunit/fail/assert_true.js b/deps/v8/test/message/mjsunit/fail/assert_true.js
new file mode 100644
index 00000000000..363f41a7810
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/fail/assert_true.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/mjsunit.js");
+
+assertTrue(false);
diff --git a/deps/v8/test/message/mjsunit/fail/assert_true.out b/deps/v8/test/message/mjsunit/fail/assert_true.out
new file mode 100644
index 00000000000..055cac4cdee
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/fail/assert_true.out
@@ -0,0 +1,10 @@
+test/mjsunit/mjsunit.js:{NUMBER}: Failure: expected <true> found <false>
+
+Stack: MjsUnitAssertionError
+    at assertTrue *mjsunit.js {NUMBER}:{NUMBER}
+    at            *%(basename)s 7:1
+    throw new MjsUnitAssertionError(message);
+    ^
+MjsUnitAssertionError
+    at assertTrue *mjsunit.js {NUMBER}:{NUMBER}
+    at            *%(basename)s 7:1
diff --git a/deps/v8/test/message/testcfg.py b/deps/v8/test/message/testcfg.py
index cd1495f3907..b0f821f62f2 100644
--- a/deps/v8/test/message/testcfg.py
+++ b/deps/v8/test/message/testcfg.py
@@ -39,7 +39,7 @@
 
 
 class TestSuite(testsuite.TestSuite):
-  def ListTests(self, context):
+  def ListTests(self):
     tests = []
     for dirname, dirs, files in os.walk(self.root):
       for dotted in [x for x in dirs if x.startswith('.')]:
@@ -58,13 +58,6 @@ def ListTests(self, context):
   def _test_class(self):
     return TestCase
 
-  def CreateLegacyVariantsGenerator(self, variants):
-    return super(TestSuite, self).CreateLegacyVariantsGenerator(
-        variants + ["preparser"])
-
-  def create_variant_proc(self, variants):
-    return super(TestSuite, self).create_variant_proc(variants + ['preparser'])
-
 
 class TestCase(testcase.TestCase):
   def __init__(self, *args, **kwargs):
@@ -90,11 +83,11 @@ def _expected_fail(self):
       path = head
     return False
 
-  def _get_cmd_params(self, ctx):
-    params = super(TestCase, self)._get_cmd_params(ctx)
+  def _get_cmd_params(self):
+    params = super(TestCase, self)._get_cmd_params()
     return [p for p in params if p not in INVALID_FLAGS]
 
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     return self._source_files
 
   def _get_source_flags(self):
@@ -110,5 +103,5 @@ def output_proc(self):
                            self._expected_fail())
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/message/wasm-function-name-async.js b/deps/v8/test/message/wasm-function-name-async.js
new file mode 100644
index 00000000000..ddff21ee210
--- /dev/null
+++ b/deps/v8/test/message/wasm-function-name-async.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --no-stress-opt
+
+load('test/mjsunit/mjsunit.js');
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.addFunction('main', kSig_i_v).addBody([kExprUnreachable]).exportFunc();
+let buffer = builder.toBuffer();
+assertPromiseResult(WebAssembly.instantiate(buffer), pair => {
+  try {
+    pair.instance.exports.main();
+  } catch (e) {
+    print(e.stack);
+  }
+});
diff --git a/deps/v8/test/message/wasm-function-name-async.out b/deps/v8/test/message/wasm-function-name-async.out
new file mode 100644
index 00000000000..8e8d96ff101
--- /dev/null
+++ b/deps/v8/test/message/wasm-function-name-async.out
@@ -0,0 +1,4 @@
+RuntimeError: unreachable
+    at main (wasm-function[0]:1)
+    at pair (*%(basename)s:16:27)
+    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
diff --git a/deps/v8/test/message/wasm-function-name-streaming.js b/deps/v8/test/message/wasm-function-name-streaming.js
new file mode 100644
index 00000000000..9095da4a8da
--- /dev/null
+++ b/deps/v8/test/message/wasm-function-name-streaming.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --wasm-test-streaming --no-stress-opt
+
+load("test/message/wasm-function-name-async.js");
diff --git a/deps/v8/test/message/wasm-function-name-streaming.out b/deps/v8/test/message/wasm-function-name-streaming.out
new file mode 100644
index 00000000000..0daaabd93b6
--- /dev/null
+++ b/deps/v8/test/message/wasm-function-name-streaming.out
@@ -0,0 +1,4 @@
+RuntimeError: unreachable
+    at main (wasm-function[0]:1)
+    at pair (test/message/wasm-function-name-async.js:16:27)
+    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
diff --git a/deps/v8/test/message/wasm-module-and-function-name-async.js b/deps/v8/test/message/wasm-module-and-function-name-async.js
new file mode 100644
index 00000000000..fa29cab2162
--- /dev/null
+++ b/deps/v8/test/message/wasm-module-and-function-name-async.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --no-stress-opt
+
+load('test/mjsunit/mjsunit.js');
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.setName('test-module');
+builder.addFunction('main', kSig_i_v).addBody([kExprUnreachable]).exportFunc();
+let buffer = builder.toBuffer();
+assertPromiseResult(WebAssembly.instantiate(buffer), pair => {
+  try {
+    pair.instance.exports.main();
+  } catch (e) {
+    print(e.stack);
+  }
+});
diff --git a/deps/v8/test/message/wasm-module-and-function-name-async.out b/deps/v8/test/message/wasm-module-and-function-name-async.out
new file mode 100644
index 00000000000..de4edf44915
--- /dev/null
+++ b/deps/v8/test/message/wasm-module-and-function-name-async.out
@@ -0,0 +1,4 @@
+RuntimeError: unreachable
+    at test-module.main (wasm-function[0]:1)
+    at pair (*%(basename)s:17:27)
+    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
diff --git a/deps/v8/test/message/wasm-module-and-function-name-streaming.js b/deps/v8/test/message/wasm-module-and-function-name-streaming.js
new file mode 100644
index 00000000000..87b95c253a5
--- /dev/null
+++ b/deps/v8/test/message/wasm-module-and-function-name-streaming.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --wasm-test-streaming --no-stress-opt
+
+load("test/message/wasm-module-and-function-name-async.js");
diff --git a/deps/v8/test/message/wasm-module-and-function-name-streaming.out b/deps/v8/test/message/wasm-module-and-function-name-streaming.out
new file mode 100644
index 00000000000..692011d5541
--- /dev/null
+++ b/deps/v8/test/message/wasm-module-and-function-name-streaming.out
@@ -0,0 +1,4 @@
+RuntimeError: unreachable
+    at test-module.main (wasm-function[0]:1)
+    at pair (test/message/wasm-module-and-function-name-async.js:17:27)
+    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
diff --git a/deps/v8/test/message/wasm-module-name-async.js b/deps/v8/test/message/wasm-module-name-async.js
new file mode 100644
index 00000000000..d24357965bc
--- /dev/null
+++ b/deps/v8/test/message/wasm-module-name-async.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --no-stress-opt
+
+load('test/mjsunit/mjsunit.js');
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.setName('test-module');
+builder.addFunction(undefined, kSig_i_v)
+    .addBody([kExprUnreachable])
+    .exportAs('main');
+let buffer = builder.toBuffer();
+assertPromiseResult(WebAssembly.instantiate(buffer), pair => {
+  try {
+    pair.instance.exports.main();
+  } catch (e) {
+    print(e.stack);
+  }
+});
diff --git a/deps/v8/test/message/wasm-module-name-async.out b/deps/v8/test/message/wasm-module-name-async.out
new file mode 100644
index 00000000000..66e7219ff5f
--- /dev/null
+++ b/deps/v8/test/message/wasm-module-name-async.out
@@ -0,0 +1,4 @@
+RuntimeError: unreachable
+    at test-module (wasm-function[0]:1)
+    at pair (*%(basename)s:19:27)
+    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
diff --git a/deps/v8/test/message/wasm-module-name-streaming.js b/deps/v8/test/message/wasm-module-name-streaming.js
new file mode 100644
index 00000000000..044b0b968ef
--- /dev/null
+++ b/deps/v8/test/message/wasm-module-name-streaming.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --wasm-test-streaming --no-stress-opt
+
+load("test/message/wasm-module-name-async.js");
diff --git a/deps/v8/test/message/wasm-module-name-streaming.out b/deps/v8/test/message/wasm-module-name-streaming.out
new file mode 100644
index 00000000000..b06fba77452
--- /dev/null
+++ b/deps/v8/test/message/wasm-module-name-streaming.out
@@ -0,0 +1,4 @@
+RuntimeError: unreachable
+    at test-module (wasm-function[0]:1)
+    at pair (test/message/wasm-module-name-async.js:19:27)
+    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
diff --git a/deps/v8/test/message/wasm-no-name-async.js b/deps/v8/test/message/wasm-no-name-async.js
new file mode 100644
index 00000000000..f60ba351332
--- /dev/null
+++ b/deps/v8/test/message/wasm-no-name-async.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --no-stress-opt
+
+load('test/mjsunit/mjsunit.js');
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_i_v)
+    .addBody([kExprUnreachable])
+    .exportAs('main');
+let buffer = builder.toBuffer();
+assertPromiseResult(WebAssembly.instantiate(buffer), pair => {
+  try {
+    pair.instance.exports.main();
+  } catch (e) {
+    print(e.stack);
+  }
+});
diff --git a/deps/v8/test/message/wasm-no-name-async.out b/deps/v8/test/message/wasm-no-name-async.out
new file mode 100644
index 00000000000..d7d31c513f5
--- /dev/null
+++ b/deps/v8/test/message/wasm-no-name-async.out
@@ -0,0 +1,4 @@
+RuntimeError: unreachable
+    at wasm-function[0]:1
+    at pair (*%(basename)s:18:27)
+    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
diff --git a/deps/v8/test/message/wasm-no-name-streaming.js b/deps/v8/test/message/wasm-no-name-streaming.js
new file mode 100644
index 00000000000..238fe5da577
--- /dev/null
+++ b/deps/v8/test/message/wasm-no-name-streaming.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --wasm-test-streaming --no-stress-opt
+
+load("test/message/wasm-no-name-async.js");
diff --git a/deps/v8/test/message/wasm-no-name-streaming.out b/deps/v8/test/message/wasm-no-name-streaming.out
new file mode 100644
index 00000000000..20bf178e268
--- /dev/null
+++ b/deps/v8/test/message/wasm-no-name-streaming.out
@@ -0,0 +1,4 @@
+RuntimeError: unreachable
+    at wasm-function[0]:1
+    at pair (test/message/wasm-no-name-async.js:18:27)
+    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
diff --git a/deps/v8/test/mjsunit/BUILD.gn b/deps/v8/test/mjsunit/BUILD.gn
new file mode 100644
index 00000000000..7823d8f3aa1
--- /dev/null
+++ b/deps/v8/test/mjsunit/BUILD.gn
@@ -0,0 +1,30 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+group("v8_mjsunit") {
+  testonly = true
+
+  data_deps = [
+    "../../:d8",
+    "../../tools/:v8_testrunner",
+  ]
+
+  data = [
+    "./",
+    "../../tools/codemap.js",
+    "../../tools/consarray.js",
+    "../../tools/csvparser.js",
+    "../../tools/logreader.js",
+    "../../tools/arguments.js",
+    "../../tools/profile.js",
+    "../../tools/profile_view.js",
+    "../../tools/profviz/composer.js",
+    "../../tools/splaytree.js",
+    "../../tools/tickprocessor.js",
+    "../../tools/dumpcpp.js",
+    "../wasm-js/test/harness/wasm-constants.js",
+    "../wasm-js/test/harness/wasm-module-builder.js",
+    "../wasm-js/test/js-api/jsapi.js",
+  ]
+}
diff --git a/deps/v8/test/mjsunit/array-reduce.js b/deps/v8/test/mjsunit/array-reduce.js
index 171a40f0921..dd7c378847a 100644
--- a/deps/v8/test/mjsunit/array-reduce.js
+++ b/deps/v8/test/mjsunit/array-reduce.js
@@ -641,6 +641,64 @@ assertEquals(undefined, arr.reduceRight(function(val) { return val }));
   assertEquals(total, g());
 })();
 
+(function OptimizedReduceEagerDeoptMiddleOfIterationHoley() {
+  let deopt = false;
+  let array = [, ,11,22,,33,45,56,,6,77,84,93,101,];
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[0] = 1.5; }
+    return a + current;
+  };
+  let g = function() {
+    return array.reduce(f);
+  }
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  deopt = true;
+  g();
+  deopt = false;
+  array = [11,22,33,45,56,6,77,84,93,101];
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  deopt = true;
+  assertEquals(total, g());
+})();
+
+(function TriggerReduceRightPreLoopDeopt() {
+  function f(a) {
+    a.reduceRight((x) => { return x + 1 });
+  }
+  f([1,2,]);
+  f([1,2,]);
+  %OptimizeFunctionOnNextCall(f);
+  assertThrows(() => f([]), TypeError);
+})();
+
+(function OptimizedReduceRightEagerDeoptMiddleOfIterationHoley() {
+  let deopt = false;
+  let array = [, ,11,22,,33,45,56,,6,77,84,93,101,];
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[array.length-1] = 1.5; }
+    return a + current;
+  };
+  let g = function() {
+    return array.reduceRight(f);
+  }
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  deopt = true;
+  g();
+  deopt = false;
+  array = [11,22,33,45,56,6,77,84,93,101];
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  deopt = true;
+  assertEquals(total, g());
+})();
+
 (function ReduceCatch() {
   let f = (a,current) => {
     return a + current;
@@ -1241,3 +1299,14 @@ assertEquals(undefined, arr.reduceRight(function(val) { return val }));
   %OptimizeFunctionOnNextCall(__f_3253);
   assertEquals(18, __f_3253(__v_12258));
 })();
+
+(function ReduceMixedHoleyArrays() {
+  function r(a) {
+    return a.reduce((acc, i) => {acc[0]});
+  }
+  r([[0]]);
+  r([[0]]);
+  r([0,,]);
+  %OptimizeFunctionOnNextCall(r);
+  r([,0,0]);
+})();
diff --git a/deps/v8/test/mjsunit/array-sort.js b/deps/v8/test/mjsunit/array-sort.js
index acc96117be4..0454da8cae9 100644
--- a/deps/v8/test/mjsunit/array-sort.js
+++ b/deps/v8/test/mjsunit/array-sort.js
@@ -503,6 +503,19 @@ function TestSortOnNonExtensible() {
 }
 TestSortOnNonExtensible();
 
+function TestSortOnTypedArray() {
+  var array = new Int8Array([10,9,8,7,6,5,4,3,2,1]);
+  Object.defineProperty(array, "length", {value: 5});
+  Array.prototype.sort.call(array);
+  assertEquals(array, new Int8Array([10,6,7,8,9,5,4,3,2,1]));
+
+  var array = new Int8Array([10,9,8,7,6,5,4,3,2,1]);
+  Object.defineProperty(array, "length", {value: 15});
+  Array.prototype.sort.call(array);
+  assertEquals(array, new Int8Array([1,10,2,3,4,5,6,7,8,9]));
+}
+TestSortOnTypedArray();
+
 
 // Test special prototypes
 (function testSortSpecialPrototypes() {
diff --git a/deps/v8/test/mjsunit/compiler/array-multiple-receiver-maps.js b/deps/v8/test/mjsunit/compiler/array-multiple-receiver-maps.js
index 2ef0cc3a018..f615032d97d 100644
--- a/deps/v8/test/mjsunit/compiler/array-multiple-receiver-maps.js
+++ b/deps/v8/test/mjsunit/compiler/array-multiple-receiver-maps.js
@@ -29,21 +29,23 @@ function runTest(f, message, mkICTraining, deoptArg) {
       // Make sure the optimized function can handle
       // all trained maps without deopt.
       for (let a of t3) {
+        message += " for args " + JSON.stringify(a) + " should have been optimized";
         f(a.arr, () => a.el);
-        message += " for args " + JSON.stringify(a);
-        assertOptimized(f, undefined, message + " should have been optimized");
+        assertOptimized(f, undefined, message);
       }
     } else {
       // Trigger deopt, causing no-speculation bit to be set.
       let a1 = deoptArg;
       let a2 = deoptArg;
       message += " for args " + JSON.stringify(a1);
+      message_unoptimized = message + " should have been unoptimized"
+      message_optimized = message + " should have been unoptimized"
       f(a1.arr, () => a1.el);
-      assertUnoptimized(f, undefined, message + " should have been unoptimized");
+      assertUnoptimized(f, undefined, message_unoptimized);
       %OptimizeFunctionOnNextCall(f);
       // No speculation should protect against further deopts.
       f(a2.arr, () => a2.el);
-      assertOptimized(f, undefined,  message + " should have been optimized");
+      assertOptimized(f, undefined,  message_optimized);
     }
   }
 
diff --git a/deps/v8/test/mjsunit/compiler/number-isfinite-inl.js b/deps/v8/test/mjsunit/compiler/number-isfinite-inl.js
new file mode 100644
index 00000000000..2948fe09530
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/number-isfinite-inl.js
@@ -0,0 +1,54 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test(f) {
+  assertTrue(Number.isFinite(0));
+  assertTrue(Number.isFinite(Number.MIN_VALUE));
+  assertTrue(Number.isFinite(Number.MAX_VALUE));
+  assertTrue(Number.isFinite(Number.MIN_SAFE_INTEGER));
+  assertTrue(Number.isFinite(Number.MIN_SAFE_INTEGER - 13));
+  assertTrue(Number.isFinite(Number.MAX_SAFE_INTEGER));
+  assertTrue(Number.isFinite(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(Number.isFinite(0));
+  assertTrue(Number.isFinite(-1));
+  assertTrue(Number.isFinite(123456));
+  assertFalse(Number.isFinite(Number.NaN));
+  assertFalse(Number.isFinite(Number.POSITIVE_INFINITY));
+  assertFalse(Number.isFinite(Number.NEGATIVE_INFINITY));
+  assertFalse(Number.isFinite(1 / 0));
+  assertFalse(Number.isFinite(-1 / 0));
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
+
+
+function test2(f) {
+  assertFalse(Number.isFinite({}));
+  assertFalse(Number.isFinite("abc"));
+  assertTrue(Number.isFinite(0));
+  assertTrue(Number.isFinite(Number.MIN_VALUE));
+  assertTrue(Number.isFinite(Number.MAX_VALUE));
+  assertTrue(Number.isFinite(Number.MIN_SAFE_INTEGER));
+  assertTrue(Number.isFinite(Number.MIN_SAFE_INTEGER - 13));
+  assertTrue(Number.isFinite(Number.MAX_SAFE_INTEGER));
+  assertTrue(Number.isFinite(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(Number.isFinite(0));
+  assertTrue(Number.isFinite(-1));
+  assertTrue(Number.isFinite(123456));
+  assertFalse(Number.isFinite(Number.NaN));
+  assertFalse(Number.isFinite(Number.POSITIVE_INFINITY));
+  assertFalse(Number.isFinite(Number.NEGATIVE_INFINITY));
+  assertFalse(Number.isFinite(1 / 0));
+  assertFalse(Number.isFinite(-1 / 0));
+}
+
+test2();
+test2();
+%OptimizeFunctionOnNextCall(test2);
+test2();
diff --git a/deps/v8/test/mjsunit/compiler/number-isfinite.js b/deps/v8/test/mjsunit/compiler/number-isfinite.js
index 689e31cf373..03493ce69ea 100644
--- a/deps/v8/test/mjsunit/compiler/number-isfinite.js
+++ b/deps/v8/test/mjsunit/compiler/number-isfinite.js
@@ -12,6 +12,9 @@ function test(f) {
   assertTrue(f(Number.MIN_SAFE_INTEGER - 13));
   assertTrue(f(Number.MAX_SAFE_INTEGER));
   assertTrue(f(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(f(0));
+  assertTrue(f(-1));
+  assertTrue(f(123456));
   assertFalse(f(Number.NaN));
   assertFalse(f(Number.POSITIVE_INFINITY));
   assertFalse(f(Number.NEGATIVE_INFINITY));
@@ -27,3 +30,33 @@ test(f);
 test(f);
 %OptimizeFunctionOnNextCall(f);
 test(f);
+
+
+function test2(f) {
+  assertFalse(f({}));
+  assertFalse(f("abc"));
+  assertTrue(f(0));
+  assertTrue(f(Number.MIN_VALUE));
+  assertTrue(f(Number.MAX_VALUE));
+  assertTrue(f(Number.MIN_SAFE_INTEGER));
+  assertTrue(f(Number.MIN_SAFE_INTEGER - 13));
+  assertTrue(f(Number.MAX_SAFE_INTEGER));
+  assertTrue(f(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(f(0));
+  assertTrue(f(-1));
+  assertTrue(f(123456));
+  assertFalse(f(Number.NaN));
+  assertFalse(f(Number.POSITIVE_INFINITY));
+  assertFalse(f(Number.NEGATIVE_INFINITY));
+  assertFalse(f(1 / 0));
+  assertFalse(f(-1 / 0));
+}
+
+function f2(x) {
+  return Number.isFinite(x);
+}
+
+test2(f2);
+test2(f2);
+%OptimizeFunctionOnNextCall(f2);
+test2(f2);
diff --git a/deps/v8/test/mjsunit/compiler/number-isinteger-inl.js b/deps/v8/test/mjsunit/compiler/number-isinteger-inl.js
new file mode 100644
index 00000000000..8379fb81473
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/number-isinteger-inl.js
@@ -0,0 +1,54 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test() {
+  assertTrue(Number.isInteger(0));
+  assertFalse(Number.isInteger(Number.MIN_VALUE));
+  assertTrue(Number.isInteger(Number.MAX_VALUE));
+  assertTrue(Number.isInteger(Number.MIN_SAFE_INTEGER));
+  assertTrue(Number.isInteger(Number.MIN_SAFE_INTEGER - 13));
+  assertTrue(Number.isInteger(Number.MAX_SAFE_INTEGER));
+  assertTrue(Number.isInteger(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(Number.isInteger(0));
+  assertTrue(Number.isInteger(-1));
+  assertTrue(Number.isInteger(123456));
+  assertFalse(Number.isInteger(Number.NaN));
+  assertFalse(Number.isInteger(Number.POSITIVE_INFINITY));
+  assertFalse(Number.isInteger(Number.NEGATIVE_INFINITY));
+  assertFalse(Number.isInteger(1 / 0));
+  assertFalse(Number.isInteger(-1 / 0));
+  assertFalse(Number.isInteger(Number.EPSILON));
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
+
+
+function test2() {
+  assertTrue(Number.isInteger(0));
+  assertFalse(Number.isInteger(Number.MIN_VALUE));
+  assertTrue(Number.isInteger(Number.MAX_VALUE));
+  assertTrue(Number.isInteger(Number.MIN_SAFE_INTEGER));
+  assertTrue(Number.isInteger(Number.MIN_SAFE_INTEGER - 13));
+  assertTrue(Number.isInteger(Number.MAX_SAFE_INTEGER));
+  assertTrue(Number.isInteger(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(Number.isInteger(0));
+  assertTrue(Number.isInteger(-1));
+  assertTrue(Number.isInteger(123456));
+  assertFalse(Number.isInteger(Number.NaN));
+  assertFalse(Number.isInteger(Number.POSITIVE_INFINITY));
+  assertFalse(Number.isInteger(Number.NEGATIVE_INFINITY));
+  assertFalse(Number.isInteger(1 / 0));
+  assertFalse(Number.isInteger(-1 / 0));
+  assertFalse(Number.isInteger(Number.EPSILON));
+}
+
+test2();
+test2();
+%OptimizeFunctionOnNextCall(test2);
+test2();
diff --git a/deps/v8/test/mjsunit/compiler/number-isinteger.js b/deps/v8/test/mjsunit/compiler/number-isinteger.js
index 8999569bb08..aae172ea066 100644
--- a/deps/v8/test/mjsunit/compiler/number-isinteger.js
+++ b/deps/v8/test/mjsunit/compiler/number-isinteger.js
@@ -12,6 +12,9 @@ function test(f) {
   assertTrue(f(Number.MIN_SAFE_INTEGER - 13));
   assertTrue(f(Number.MAX_SAFE_INTEGER));
   assertTrue(f(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(f(0));
+  assertTrue(f(-1));
+  assertTrue(f(123456));
   assertFalse(f(Number.NaN));
   assertFalse(f(Number.POSITIVE_INFINITY));
   assertFalse(f(Number.NEGATIVE_INFINITY));
@@ -28,3 +31,32 @@ test(f);
 test(f);
 %OptimizeFunctionOnNextCall(f);
 test(f);
+
+
+function test2(f) {
+  assertTrue(f(0));
+  assertFalse(f(Number.MIN_VALUE));
+  assertTrue(f(Number.MAX_VALUE));
+  assertTrue(f(Number.MIN_SAFE_INTEGER));
+  assertTrue(f(Number.MIN_SAFE_INTEGER - 13));
+  assertTrue(f(Number.MAX_SAFE_INTEGER));
+  assertTrue(f(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(f(0));
+  assertTrue(f(-1));
+  assertTrue(f(123456));
+  assertFalse(f(Number.NaN));
+  assertFalse(f(Number.POSITIVE_INFINITY));
+  assertFalse(f(Number.NEGATIVE_INFINITY));
+  assertFalse(f(1 / 0));
+  assertFalse(f(-1 / 0));
+  assertFalse(f(Number.EPSILON));
+}
+
+function f2(x) {
+  return Number.isInteger(x);
+}
+
+test2(f2);
+test2(f2);
+%OptimizeFunctionOnNextCall(f2);
+test2(f2);
diff --git a/deps/v8/test/mjsunit/compiler/promise-capability-default-closures.js b/deps/v8/test/mjsunit/compiler/promise-capability-default-closures.js
new file mode 100644
index 00000000000..f4d8cd4e5df
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/promise-capability-default-closures.js
@@ -0,0 +1,47 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  var resolve, value;
+  (new Promise(r => resolve = r)).then(v => value = v);
+  function foo() { resolve(1); }
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+  setTimeout(_ => assertEquals(1, value));
+})();
+
+(function() {
+  var reject, value;
+  (new Promise((_, r) => reject = r)).catch(v => value = v);
+  function foo() { reject(1); }
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+  setTimeout(_ => assertEquals(1, value));
+})();
+
+(function() {
+  var value;
+  function foo(x) { return new Promise((resolve, reject) => resolve(x)); }
+  foo(1);
+  foo(1);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(1).then(v => value = v);
+  setTimeout(_ => assertEquals(1, value));
+})();
+
+(function() {
+  var value;
+  function foo(x) { return new Promise((resolve, reject) => reject(x)); }
+  foo(1);
+  foo(1);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(1).catch(v => value = v);
+  setTimeout(_ => assertEquals(1, value));
+})();
diff --git a/deps/v8/test/mjsunit/compiler/promise-constructor.js b/deps/v8/test/mjsunit/compiler/promise-constructor.js
new file mode 100644
index 00000000000..67677fad4b9
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/promise-constructor.js
@@ -0,0 +1,198 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --experimental-inline-promise-constructor
+
+// We have to patch mjsunit because normal assertion failures just throw
+// exceptions which are swallowed in a then clause.
+failWithMessage = (msg) => %AbortJS(msg);
+
+// Don't crash.
+(function() {
+  function foo() {
+    let resolve, reject, promise;
+    promise = new Promise((a, b) => { resolve = a; reject = b; });
+
+    return {resolve, reject, promise};
+  }
+
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+// Check that when executor is non-callable, the constructor throws.
+(function() {
+  function foo() {
+    return new Promise(1);
+  }
+
+  assertThrows(foo, TypeError);
+  assertThrows(foo, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo, TypeError);
+})();
+
+// Check that when the promise constructor throws because the executor is
+// non-callable, the stack contains 'new Promise'.
+(function() {
+  function foo() {
+    return new Promise(1);
+  }
+
+  let threw;
+  try {
+    threw = false;
+    foo();
+  } catch (e) {
+    threw = true;
+    assertContains('new Promise', e.stack);
+  } finally {
+    assertTrue(threw);
+  }
+  try {
+    threw = false;
+    foo();
+  } catch (e) {
+    threw = true;
+    assertContains('new Promise', e.stack);
+  } finally {
+    assertTrue(threw);
+  }
+
+  %OptimizeFunctionOnNextCall(foo);
+  try {
+    threw = false;
+    foo();
+  } catch (e) {
+    threw = true;
+    assertContains('new Promise', e.stack);
+  } finally {
+    assertTrue(threw);
+  }
+})();
+
+// Check that when executor throws, the promise is rejected.
+(function() {
+  function foo() {
+    return new Promise((a, b) => { throw new Error(); });
+  }
+
+  function bar(i) {
+    let error = null;
+    foo().then(_ => error = 1, e => error = e);
+    setTimeout(_ => assertInstanceof(error, Error));
+    if (i == 1) %OptimizeFunctionOnNextCall(foo);
+    if (i > 0) setTimeout(bar.bind(null, i - 1));
+    }
+  bar(3);
+})();
+
+// Check that when executor causes lazy deoptimization of the inlined
+// constructor, we return the promise value and not the return value of the
+// executor function itself.
+(function() {
+  function foo() {
+    let p;
+    try {
+      p = new Promise((a, b) => { %DeoptimizeFunction(foo); });
+    } catch (e) {
+      // Nothing should throw
+      assertUnreachable();
+    }
+    assertInstanceof(p, Promise);
+  }
+
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+// The same as above, except that the executor function also creates a promise
+// and both executor functions cause a lazy deopt of the calling function.
+(function() {
+  function executor(a, b) {
+    %DeoptimizeFunction(foo);
+    let p = new Promise((a, b) => { %DeoptimizeFunction(executor); });
+  }
+  function foo() {
+    let p;
+    try {
+      p = new Promise(executor);
+    } catch (e) {
+      // Nothing should throw
+      assertUnreachable();
+    }
+    assertInstanceof(p, Promise);
+  }
+
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+// Check that when the executor causes lazy deoptimization of the inlined
+// constructor, and then throws, the deopt continuation catches and then calls
+// the reject function instead of propagating the exception.
+(function() {
+  function foo() {
+    let p;
+    try {
+      p = new Promise((a, b) => {
+        %DeoptimizeFunction(foo);
+        throw new Error();
+      });
+    } catch (e) {
+      // The promise constructor should catch the exception and reject the
+      // promise instead.
+      // TODO(petermarshall): This fails but should not. We need to fix deopts.
+      // assertUnreachable();
+    }
+    // TODO(petermarshall): This fails but should not.
+    // assertInstanceof(p, Promise);
+  }
+
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+// Test when the executor is not inlined.
+(function() {
+  let resolve, reject, promise;
+  function bar(a, b) {
+    resolve = a; reject = b;
+    throw new Error();
+  }
+  function foo() {
+    promise = new Promise(bar);
+  }
+  foo();
+  foo();
+  %NeverOptimizeFunction(bar);
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+// Test that the stack trace contains 'new Promise'
+(function() {
+  let resolve, reject, promise;
+  function bar(a, b) {
+    resolve = a; reject = b;
+    let stack = new Error().stack;
+    assertContains("new Promise", stack);
+    throw new Error();
+  }
+  function foo() {
+    promise = new Promise(bar);
+  }
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
diff --git a/deps/v8/test/mjsunit/compiler/promise-prototype-catch-custom-then-1.js b/deps/v8/test/mjsunit/compiler/promise-prototype-catch-custom-then-1.js
new file mode 100644
index 00000000000..d3bd0b85433
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/promise-prototype-catch-custom-then-1.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(p) { return p.catch(x => x); }
+
+const a = Promise.resolve(1);
+
+foo(a);
+foo(a);
+%OptimizeFunctionOnNextCall(foo);
+foo(a);
+
+let custom_then_called = false;
+a.__proto__.then = function() { custom_then_called = true; }
+foo(a);
+assertTrue(custom_then_called);
diff --git a/deps/v8/test/mjsunit/compiler/promise-prototype-catch-custom-then-2.js b/deps/v8/test/mjsunit/compiler/promise-prototype-catch-custom-then-2.js
new file mode 100644
index 00000000000..0d3f34db28a
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/promise-prototype-catch-custom-then-2.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(p) { return p.catch(x => x); }
+
+const a = Promise.resolve(1);
+
+foo(a);
+foo(a);
+%OptimizeFunctionOnNextCall(foo);
+foo(a);
+
+let custom_then_called = false;
+a.then = function() { custom_then_called = true; }
+foo(a);
+assertTrue(custom_then_called);
diff --git a/deps/v8/test/mjsunit/compiler/promise-prototype-catch-subclass.js b/deps/v8/test/mjsunit/compiler/promise-prototype-catch-subclass.js
new file mode 100644
index 00000000000..5aadaada812
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/promise-prototype-catch-subclass.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let custom_then_called = false;
+
+function foo(p) {
+  custom_then_called = false;
+  p.catch(x => x);
+  return custom_then_called;
+}
+
+class MyPromise extends Promise {
+  then(onFulfilled, onRejected) {
+    custom_then_called = true;
+    return super.then(onFulfilled, onRejected);
+  }
+}
+
+const a = MyPromise.resolve(1);
+
+assertTrue(foo(a));
+assertTrue(foo(a));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(a));
diff --git a/deps/v8/test/mjsunit/compiler/promise-prototype-catch.js b/deps/v8/test/mjsunit/compiler/promise-prototype-catch.js
new file mode 100644
index 00000000000..eae343fd2e8
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/promise-prototype-catch.js
@@ -0,0 +1,29 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function foo(p) { return p.catch(); }
+  foo(Promise.resolve(1));
+  foo(Promise.resolve(1));
+  %OptimizeFunctionOnNextCall(foo);
+  foo(Promise.resolve(1));
+})();
+
+(function() {
+  function foo(p) { return p.catch(foo); }
+  foo(Promise.resolve(1));
+  foo(Promise.resolve(1));
+  %OptimizeFunctionOnNextCall(foo);
+  foo(Promise.resolve(1));
+})();
+
+(function() {
+  function foo(p) { return p.catch(foo, undefined); }
+  foo(Promise.resolve(1));
+  foo(Promise.resolve(1));
+  %OptimizeFunctionOnNextCall(foo);
+  foo(Promise.resolve(1));
+})();
diff --git a/deps/v8/test/mjsunit/compiler/promise-prototype-finally-custom-then-1.js b/deps/v8/test/mjsunit/compiler/promise-prototype-finally-custom-then-1.js
new file mode 100644
index 00000000000..a6987d446fe
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/promise-prototype-finally-custom-then-1.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(p) { return p.finally(x => x); }
+
+const a = Promise.resolve(1);
+
+foo(a);
+foo(a);
+%OptimizeFunctionOnNextCall(foo);
+foo(a);
+
+let custom_then_called = false;
+a.__proto__.then = function() { custom_then_called = true; }
+foo(a);
+assertTrue(custom_then_called);
diff --git a/deps/v8/test/mjsunit/compiler/promise-prototype-finally-custom-then-2.js b/deps/v8/test/mjsunit/compiler/promise-prototype-finally-custom-then-2.js
new file mode 100644
index 00000000000..5bad54a61d9
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/promise-prototype-finally-custom-then-2.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(p) { return p.finally(x => x); }
+
+const a = Promise.resolve(1);
+
+foo(a);
+foo(a);
+%OptimizeFunctionOnNextCall(foo);
+foo(a);
+
+let custom_then_called = false;
+a.then = function() { custom_then_called = true; }
+foo(a);
+assertTrue(custom_then_called);
diff --git a/deps/v8/test/mjsunit/compiler/promise-prototype-finally-subclass.js b/deps/v8/test/mjsunit/compiler/promise-prototype-finally-subclass.js
new file mode 100644
index 00000000000..ff5657f6cba
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/promise-prototype-finally-subclass.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let custom_then_called = false;
+
+function foo(p) {
+  custom_then_called = false;
+  p.finally(x => x);
+  return custom_then_called;
+}
+
+class MyPromise extends Promise {
+  then(onFulfilled, onRejected) {
+    custom_then_called = true;
+    return super.then(onFulfilled, onRejected);
+  }
+}
+
+const a = MyPromise.resolve(1);
+
+assertTrue(foo(a));
+assertTrue(foo(a));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(a));
diff --git a/deps/v8/test/mjsunit/compiler/promise-prototype-finally.js b/deps/v8/test/mjsunit/compiler/promise-prototype-finally.js
new file mode 100644
index 00000000000..6060f7b857a
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/promise-prototype-finally.js
@@ -0,0 +1,41 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p) { return p.finally(); }
+  foo(p);
+  foo(p);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p);
+})();
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p) { return p.finally(x => x); }
+  foo(p);
+  foo(p);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p);
+})();
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p, f) { return p.finally(f); }
+  foo(p, x => x);
+  foo(p, x => x);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p, x => x);
+})();
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p, f) { return p.finally(f).finally(f); }
+  foo(p, x => x);
+  foo(p, x => x);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p, x => x);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/promise-prototype-then.js b/deps/v8/test/mjsunit/compiler/promise-prototype-then.js
new file mode 100644
index 00000000000..caf77708b64
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/promise-prototype-then.js
@@ -0,0 +1,50 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p) { return p.then(); }
+  foo(p);
+  foo(p);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p);
+})();
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p) { return p.then(x => x); }
+  foo(p);
+  foo(p);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p);
+})();
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p) { return p.then(x => x, y => y); }
+  foo(p);
+  foo(p);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p);
+})();
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p, f) { return p.then(f, f); }
+  foo(p, x => x);
+  foo(p, x => x);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p, x => x);
+})();
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p, f) { return p.then(f, f).then(f, f); }
+  foo(p, x => x);
+  foo(p, x => x);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p, x => x);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/promise-resolve.js b/deps/v8/test/mjsunit/compiler/promise-resolve.js
new file mode 100644
index 00000000000..13cb0fa0a35
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/promise-resolve.js
@@ -0,0 +1,119 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertFulfilledWith(expected, thenable) {
+  assertPromiseResult(thenable, v => assertEquals(expected, v));
+}
+
+(function() {
+  function foo() { return Promise.resolve(); }
+  assertFulfilledWith(undefined, foo());
+  assertFulfilledWith(undefined, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFulfilledWith(undefined, foo());
+})();
+
+(function() {
+  function foo(x) { return Promise.resolve(x); }
+  assertFulfilledWith(3, foo(3));
+  assertFulfilledWith(3, foo(3));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFulfilledWith(3, foo(3));
+})();
+
+(function() {
+  function foo(x, y) { return Promise.resolve(x, y); }
+  assertFulfilledWith(1, foo(1, 0));
+  assertFulfilledWith(2, foo(2, 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFulfilledWith(3, foo(3, 2));
+})();
+
+(function() {
+  function foo(x) { return Promise.resolve({x}); }
+  assertFulfilledWith({x:1}, foo(1));
+  assertFulfilledWith({x:2}, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFulfilledWith({x:3}, foo(3));
+})();
+
+(function() {
+  function foo(x) { return Promise.resolve(Promise.resolve(x)); }
+  assertFulfilledWith(null, foo(null));
+  assertFulfilledWith('a', foo('a'));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFulfilledWith(42, foo(42));
+})();
+
+(function() {
+  const thenable = new class Thenable {
+    then(fulfill, reject) {
+      fulfill(1);
+    }
+  };
+  function foo() { return Promise.resolve(thenable); }
+  assertFulfilledWith(1, foo());
+  assertFulfilledWith(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFulfilledWith(1, foo());
+})();
+
+(function() {
+  const MyPromise = class MyPromise extends Promise {};
+
+  (function() {
+    function foo() { return MyPromise.resolve(); }
+    assertFulfilledWith(undefined, foo());
+    assertFulfilledWith(undefined, foo());
+    %OptimizeFunctionOnNextCall(foo);
+    assertFulfilledWith(undefined, foo());
+  })();
+
+  (function() {
+    function foo(x) { return MyPromise.resolve(x); }
+    assertFulfilledWith(3, foo(3));
+    assertFulfilledWith(3, foo(3));
+    %OptimizeFunctionOnNextCall(foo);
+    assertFulfilledWith(3, foo(3));
+  })();
+
+  (function() {
+    function foo(x, y) { return MyPromise.resolve(x, y); }
+    assertFulfilledWith(1, foo(1, 0));
+    assertFulfilledWith(2, foo(2, 1));
+    %OptimizeFunctionOnNextCall(foo);
+    assertFulfilledWith(3, foo(3, 2));
+  })();
+
+  (function() {
+    function foo(x) { return MyPromise.resolve({x}); }
+    assertFulfilledWith({x:1}, foo(1));
+    assertFulfilledWith({x:2}, foo(2));
+    %OptimizeFunctionOnNextCall(foo);
+    assertFulfilledWith({x:3}, foo(3));
+  })();
+
+  (function() {
+    function foo(x) { return MyPromise.resolve(Promise.resolve(x)); }
+    assertFulfilledWith(null, foo(null));
+    assertFulfilledWith('a', foo('a'));
+    %OptimizeFunctionOnNextCall(foo);
+    assertFulfilledWith(42, foo(42));
+  })();
+
+  (function() {
+    const thenable = new class Thenable {
+      then(fulfill, reject) {
+        fulfill(1);
+      }
+    };
+    function foo() { return MyPromise.resolve(thenable); }
+    assertFulfilledWith(1, foo());
+    assertFulfilledWith(1, foo());
+    %OptimizeFunctionOnNextCall(foo);
+    assertFulfilledWith(1, foo());
+  })();
+})();
diff --git a/deps/v8/test/mjsunit/compiler/regress-803022.js b/deps/v8/test/mjsunit/compiler/regress-803022.js
new file mode 100644
index 00000000000..30e13cf0320
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-803022.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  for (var a = 0; a < 2; a++) {
+    if (a === 1) %OptimizeOsr();
+    while (0 && 1) {
+      for (var j = 1; j < 2; j++) { }
+    }
+  }
+}
+
+foo();
diff --git a/deps/v8/test/mjsunit/compiler/regress-808472.js b/deps/v8/test/mjsunit/compiler/regress-808472.js
new file mode 100644
index 00000000000..8c8bdf1d0d1
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-808472.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function opt() {
+    let opt, arr = [...[...[...[...new Uint8Array(0x10000)]]]];
+    while (arr--)  {
+        opt = ((typeof opt) === 'undefined') ? /a/ : arr;
+    }
+}
+opt();
+opt();
diff --git a/deps/v8/test/mjsunit/compiler/regress-815392.js b/deps/v8/test/mjsunit/compiler/regress-815392.js
new file mode 100644
index 00000000000..367c5e824d3
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-815392.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const __f_1 = eval(`(function __f_1() {
+    class Derived extends Object {
+      constructor() {
+        ${"this.a=1;".repeat(0x3fffe-8)}
+      }
+    }
+    return Derived;
+})`);
+assertThrows(() => new (__f_1())());
diff --git a/deps/v8/test/mjsunit/compiler/regress-817225.js b/deps/v8/test/mjsunit/compiler/regress-817225.js
new file mode 100644
index 00000000000..22f03756057
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-817225.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function inlined(abort, n, a, b) {
+  if (abort) return;
+  var x = a ? true : "" + a;
+  if (!a) {
+    var y = n + y + 10;
+    if(!b) {
+      x = y;
+    }
+    if (x) {
+      x = false;
+    }
+  }
+  return x + 1;
+}
+inlined();
+function optimized(abort, a, b) {
+  return inlined(abort, "abc", a, b);
+}
+optimized(true);
+%OptimizeFunctionOnNextCall(optimized);
+optimized();
diff --git a/deps/v8/test/mjsunit/compiler/string-comparison-opt.js b/deps/v8/test/mjsunit/compiler/string-comparison-opt.js
new file mode 100644
index 00000000000..6c884e13e6d
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/string-comparison-opt.js
@@ -0,0 +1,247 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license
+// that can be found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) == "";
+  }
+  assertEquals(false, f("aaa"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) < "";
+  }
+  assertEquals(false, f("aaa"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) <= "";
+  }
+  assertEquals(false, f("aaa"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) > "";
+  }
+  assertEquals(true, f("aaa"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aaa"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) >= "";
+  }
+  assertEquals(true, f("aaa"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aaa"));
+})();
+
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) == a.charAt(2);
+  }
+  assertEquals(false, f("aab"));
+  assertEquals(true, f("aaa"));
+  assertEquals(false, f("acb"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aab"));
+  assertEquals(true, f("aaa"));
+  assertEquals(false, f("acb"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) < a.charAt(2);
+  }
+  assertEquals(true, f("aab"));
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("acb"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aab"));
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("acb"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) <= a.charAt(2);
+  }
+  assertEquals(true, f("aab"));
+  assertEquals(true, f("aaa"));
+  assertEquals(false, f("acb"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aab"));
+  assertEquals(true, f("aaa"));
+  assertEquals(false, f("acb"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) > a.charAt(2);
+  }
+  assertEquals(false, f("aab"));
+  assertEquals(false, f("aaa"));
+  assertEquals(true, f("acb"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aab"));
+  assertEquals(false, f("aaa"));
+  assertEquals(true, f("acb"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) >= a.charAt(2);
+  }
+  assertEquals(false, f("aab"));
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("acb"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aab"));
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("acb"));
+})();
+
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) == "b";
+  }
+  assertEquals(false, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) == "bb";
+  }
+  assertEquals(false, f("aaa"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+})();
+
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) < "b";
+  }
+  assertEquals(true, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(false, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(false, f("ccc"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) < "bb";
+  }
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+})();
+
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) <= "b";
+  }
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) <= "bb";
+  }
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+})();
+
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) > "b";
+  }
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(true, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(true, f("ccc"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) > "bb";
+  }
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(true, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(true, f("ccc"));
+})();
+
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) >= "b";
+  }
+  assertEquals(false, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(true, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(true, f("ccc"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) >= "bb";
+  }
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(true, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(true, f("ccc"));
+})();
diff --git a/deps/v8/test/mjsunit/compiler/string-concat-deopt.js b/deps/v8/test/mjsunit/compiler/string-concat-deopt.js
new file mode 100644
index 00000000000..1d6ce9997c2
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/string-concat-deopt.js
@@ -0,0 +1,102 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(() => {
+  function f(a) {
+    return "abc".concat();
+  }
+
+  assertEquals("abc", f());
+  assertEquals("abc", f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abc", f());
+})();
+
+(() => {
+  function f(a) {
+    return "abc".concat(a);
+  }
+
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abcde", f("de"));
+})();
+
+(() => {
+  function f(a) {
+    return "abc".concat(a);
+  }
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abc1", f(1));
+})();
+
+(() => {
+  function f(a) {
+    return "abc".concat(a);
+  }
+
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  var s = "x".repeat((1 << 28) - 16);
+  try {
+    s = "x".repeat((1 << 30) - 1 - 24);
+  } catch (e) {
+  }
+  assertThrows(() => f(s), RangeError);
+})();
+
+
+(() => {
+  function f(a) {
+    return "ab".concat("c");
+  }
+
+  assertEquals("abc", f());
+  assertEquals("abc", f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abc", f());
+})();
+
+(() => {
+  function f(a) {
+    return "ab".concat("c", a);
+  }
+
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abcde", f("de"));
+})();
+
+(() => {
+  function f(a) {
+    return "ab".concat("c", a);
+  }
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abc1", f(1));
+})();
+
+(() => {
+  function f(a) {
+    return "ab".concat("c", a);
+  }
+
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  var s = "x".repeat((1 << 28) - 16);
+  try {
+    s = "x".repeat((1 << 30) - 1 - 24);
+  } catch (e) {
+  }
+  assertThrows(() => f(s), RangeError);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/typed-array-constructor.js b/deps/v8/test/mjsunit/compiler/typed-array-constructor.js
new file mode 100644
index 00000000000..a785eadf37b
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/typed-array-constructor.js
@@ -0,0 +1,129 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-bigint
+
+const limit = %MaxSmi() + 1;
+
+(function() {
+  function foo() {
+    try { new Int8Array(limit); } catch (e) { return e.stack; }
+  }
+
+  assertTrue(/new Int8Array/.test(foo()));
+  assertTrue(/new Int8Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Int8Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new Uint8Array(limit); } catch (e) { return e.stack; }
+  }
+
+  assertTrue(/new Uint8Array/.test(foo()));
+  assertTrue(/new Uint8Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Uint8Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new Uint8ClampedArray(limit); } catch (e) { return e.stack; }
+  }
+
+  assertTrue(/new Uint8ClampedArray/.test(foo()));
+  assertTrue(/new Uint8ClampedArray/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Uint8ClampedArray/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new Int16Array(limit); } catch (e) { return e.stack; }
+  }
+
+  assertTrue(/new Int16Array/.test(foo()));
+  assertTrue(/new Int16Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Int16Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new Uint16Array(limit); } catch (e) { return e.stack; }
+  }
+
+  assertTrue(/new Uint16Array/.test(foo()));
+  assertTrue(/new Uint16Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Uint16Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new Int32Array(limit); } catch (e) { return e.stack; }
+  }
+
+  assertTrue(/new Int32Array/.test(foo()));
+  assertTrue(/new Int32Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Int32Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new Uint32Array(limit); } catch (e) { return e.stack; }
+  }
+
+  assertTrue(/new Uint32Array/.test(foo()));
+  assertTrue(/new Uint32Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Uint32Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new Float32Array(limit); } catch (e) { return e.stack; }
+  }
+
+  assertTrue(/new Float32Array/.test(foo()));
+  assertTrue(/new Float32Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Float32Array/.test(foo()));
+})();
+
+
+(function() {
+  function foo() {
+    try { new Float64Array(limit); } catch (e) { return e.stack; }
+  }
+
+  assertTrue(/new Float64Array/.test(foo()));
+  assertTrue(/new Float64Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Float64Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new BigInt64Array(limit); } catch (e) { return e.stack; }
+  }
+
+  assertTrue(/new BigInt64Array/.test(foo()));
+  assertTrue(/new BigInt64Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new BigInt64Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new BigUint64Array(limit); } catch (e) { return e.stack; }
+  }
+
+  assertTrue(/new BigUint64Array/.test(foo()));
+  assertTrue(/new BigUint64Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new BigUint64Array/.test(foo()));
+})();
diff --git a/deps/v8/test/mjsunit/constant-folding-2.js b/deps/v8/test/mjsunit/constant-folding-2.js
index 7586261c923..8359dc2c0e0 100644
--- a/deps/v8/test/mjsunit/constant-folding-2.js
+++ b/deps/v8/test/mjsunit/constant-folding-2.js
@@ -28,22 +28,28 @@
 
 // Flags: --allow-natives-syntax --nostress-opt --opt
 
-function test(f) {
+function test(f, iterations) {
   f();
   f();
-  %OptimizeFunctionOnNextCall(f);
-  f();
+  // Some of the tests need to learn until they stabilize.
+  let n = iterations ? iterations : 1;
+  for (let i = 0; i < n; i++) {
+    %OptimizeFunctionOnNextCall(f);
+    f();
+  }
+  // Assert that the function finally stabilized.
+  assertOptimized(f);
 }
 
 test(function add() {
   assertEquals(2, 1 + 1);
   assertEquals(2.5, 1.25 + 1.25);
-  assertEquals("Infinity", String(Infinity + Infinity));
-  assertEquals("Infinity", String(Infinity + 3));
-  assertEquals("NaN", String(Infinity + (-Infinity)));
-  assertEquals("NaN", String(NaN + 2));
-  assertEquals("-Infinity", String(1 / (-0.0 + (-0.0))));
-  assertEquals("Infinity", String(1 / (-0.0 + 0.0)));
+  assertSame(Infinity, Infinity + Infinity);
+  assertSame(Infinity, Infinity + 3);
+  assertSame(NaN, Infinity + (-Infinity));
+  assertSame(NaN, NaN + 2);
+  assertSame(-Infinity, 1 / (-0.0 + (-0.0)));
+  assertSame(Infinity, 1 / (-0.0 + 0.0));
 });
 
 test(function inc() {
@@ -52,9 +58,9 @@ test(function inc() {
   var c = -Infinity;
   var d = NaN;
   assertEquals(2, ++a);
-  assertEquals("Infinity", String(++b));
-  assertEquals("-Infinity", String(++c));
-  assertEquals("NaN", String(++d));
+  assertSame(Infinity, ++b);
+  assertSame(-Infinity, ++c);
+  assertSame(NaN, ++d);
 });
 
 test(function dec() {
@@ -63,155 +69,155 @@ test(function dec() {
   var c = -Infinity;
   var d = NaN;
   assertEquals(0, --a);
-  assertEquals("Infinity", String(--b));
-  assertEquals("-Infinity", String(--c));
-  assertEquals("NaN", String(--d));
+  assertSame(Infinity, --b);
+  assertSame(-Infinity, --c);
+  assertSame(NaN, --d);
 });
 
 test(function sub() {
   assertEquals(0, 1 - 1);
   assertEquals(0.5, 1.5 - 1);
-  assertEquals("Infinity", String(Infinity - (-Infinity)));
-  assertEquals("Infinity", String(Infinity - 3));
-  assertEquals("NaN", String(Infinity - Infinity));
-  assertEquals("NaN", String(NaN - 2));
-  assertEquals("-Infinity", String(1 / (-0.0 - 0.0)));
-  assertEquals("Infinity", String(1 / (0.0 - 0.0)));
+  assertSame(Infinity, Infinity - (-Infinity));
+  assertSame(Infinity, Infinity - 3);
+  assertSame(NaN, Infinity - Infinity);
+  assertSame(NaN, NaN - 2);
+  assertSame(-Infinity, 1 / (-0.0 - 0.0));
+  assertSame(Infinity, 1 / (0.0 - 0.0));
 });
 
 test(function mul() {
   assertEquals(1, 1 * 1);
   assertEquals(2.25, 1.5 * 1.5);
-  assertEquals("Infinity", String(Infinity * Infinity));
-  assertEquals("-Infinity", String(Infinity * (-Infinity)));
-  assertEquals("Infinity", String(Infinity * 3));
-  assertEquals("-Infinity", String(Infinity * (-3)));
-  assertEquals("NaN", String(NaN * 3));
-  assertEquals("-Infinity", String(1 / (-0.0 * 0.0)));
-  assertEquals("Infinity", String(1 / (0.0 * 0.0)));
+  assertSame(Infinity, Infinity * Infinity);
+  assertSame(-Infinity, Infinity * (-Infinity));
+  assertSame(Infinity, Infinity * 3);
+  assertSame(-Infinity, Infinity * (-3));
+  assertSame(NaN, NaN * 3);
+  assertSame(-Infinity, 1 / (-0.0 * 0.0));
+  assertSame(Infinity, 1 / (0.0 * 0.0));
 });
 
 test(function div() {
   assertEquals(1, 1 / 1);
   assertEquals(1.5, 2.25 / 1.5);
-  assertEquals("NaN", String(Infinity / Infinity));
-  assertEquals("Infinity", String(Infinity / 3));
-  assertEquals("-Infinity", String(Infinity / (-3)));
-  assertEquals("NaN", String(NaN / 3));
-  assertEquals("-Infinity", String(1 / (-0.0)));
-  assertEquals("Infinity", String(Infinity/0.0));
+  assertSame(NaN, Infinity / Infinity);
+  assertSame(Infinity, Infinity / 3);
+  assertSame(-Infinity, Infinity / (-3));
+  assertSame(NaN, NaN / 3);
+  assertSame(-Infinity, 1 / (-0.0));
+  assertSame(Infinity, Infinity / 0.0);
 });
 
 test(function mathMin() {
   assertEquals(1, Math.min(1, 10));
   assertEquals(1.5, Math.min(1.5, 2.5));
   assertEquals(0, Math.min(Infinity, 0));
-  assertEquals("Infinity", String(Math.min(Infinity, Infinity)));
-  assertEquals("-Infinity", String(Math.min(Infinity, -Infinity)));
-  assertEquals("NaN", String(Math.min(NaN, 1)));
-  assertEquals("Infinity", String(1 / Math.min(0.0, 0.0)));
-  assertEquals("-Infinity", String(1 / Math.min(-0.0, -0.0)));
-  assertEquals("-Infinity", String(1 / Math.min(0.0, -0.0)));
+  assertSame(Infinity, Math.min(Infinity, Infinity));
+  assertSame(-Infinity, Math.min(Infinity, -Infinity));
+  assertSame(NaN, Math.min(NaN, 1));
+  assertSame(Infinity, 1 / Math.min(0.0, 0.0));
+  assertSame(-Infinity, 1 / Math.min(-0.0, -0.0));
+  assertSame(-Infinity, 1 / Math.min(0.0, -0.0));
 });
 
 test(function mathMax() {
   assertEquals(10, Math.max(1, 10));
   assertEquals(2.5, Math.max(1.5, 2.5));
   assertEquals(Infinity, Math.max(Infinity, 0));
-  assertEquals("-Infinity", String(Math.max(-Infinity, -Infinity)));
-  assertEquals("Infinity", String(Math.max(Infinity, -Infinity)));
-  assertEquals("NaN", String(Math.max(NaN, 1)));
-  assertEquals("Infinity", String(1 / Math.max(0.0, 0.0)));
-  assertEquals("-Infinity", String(1 / Math.max(-0.0, -0.0)));
-  assertEquals("Infinity", String(1 / Math.max(0.0, -0.0)));
+  assertSame(-Infinity, Math.max(-Infinity, -Infinity));
+  assertSame(Infinity, Math.max(Infinity, -Infinity));
+  assertSame(NaN, Math.max(NaN, 1));
+  assertSame(Infinity, 1 / Math.max(0.0, 0.0));
+  assertSame(-Infinity, 1 / Math.max(-0.0, -0.0));
+  assertSame(Infinity, 1 / Math.max(0.0, -0.0));
 });
 
 test(function mathExp() {
   assertEquals(1.0, Math.exp(0.0));
   assertTrue(2.7 < Math.exp(1) && Math.exp(1) < 2.8);
-  assertEquals("Infinity", String(Math.exp(Infinity)));
+  assertSame(Infinity, Math.exp(Infinity));
   assertEquals("0", String(Math.exp(-Infinity)));
-  assertEquals("NaN", String(Math.exp(NaN)));
+  assertSame(NaN, Math.exp(NaN));
 });
 
 test(function mathLog() {
   assertEquals(0.0, Math.log(1.0));
   assertTrue(1 < Math.log(3) && Math.log(3) < 1.5);
-  assertEquals("Infinity", String(Math.log(Infinity)));
-  assertEquals("NaN", String(Math.log(-Infinity)));
-  assertEquals("NaN", String(Math.exp(NaN)));
+  assertSame(Infinity, Math.log(Infinity));
+  assertSame(NaN, Math.log(-Infinity));
+  assertSame(NaN, Math.exp(NaN));
 });
 
 test(function mathSqrt() {
   assertEquals(1.0, Math.sqrt(1.0));
-  assertEquals("NaN", String(Math.sqrt(-1.0)));
-  assertEquals("Infinity", String(Math.sqrt(Infinity)));
-  assertEquals("NaN", String(Math.sqrt(-Infinity)));
-  assertEquals("NaN", String(Math.sqrt(NaN)));
+  assertSame(NaN, Math.sqrt(-1.0));
+  assertSame(Infinity, Math.sqrt(Infinity));
+  assertSame(NaN, Math.sqrt(-Infinity));
+  assertSame(NaN, Math.sqrt(NaN));
 });
 
 test(function mathPowHalf() {
   assertEquals(1.0, Math.pow(1.0, 0.5));
-  assertEquals("NaN", String(Math.sqrt(-1.0)));
-  assertEquals("Infinity", String(Math.pow(Infinity, 0.5)));
-  assertEquals("NaN", String(Math.sqrt(-Infinity, 0.5)));
+  assertSame(NaN, Math.sqrt(-1.0));
+  assertSame(Infinity, Math.pow(Infinity, 0.5));
+  assertSame(NaN, Math.sqrt(-Infinity, 0.5));
   assertEquals(0, Math.pow(Infinity, -0.5));
-  assertEquals("NaN", String(Math.sqrt(-Infinity, -0.5)));
-  assertEquals("NaN", String(Math.sqrt(NaN, 0.5)));
+  assertSame(NaN, Math.sqrt(-Infinity, -0.5));
+  assertSame(NaN, Math.sqrt(NaN, 0.5));
 });
 
 test(function mathAbs() {
   assertEquals(1.5, Math.abs(1.5));
   assertEquals(1.5, Math.abs(-1.5));
-  assertEquals("Infinity", String(Math.abs(Infinity)));
-  assertEquals("Infinity", String(Math.abs(-Infinity)));
-  assertEquals("NaN", String(Math.abs(NaN)));
+  assertSame(Infinity, Math.abs(Infinity));
+  assertSame(Infinity, Math.abs(-Infinity));
+  assertSame(NaN, Math.abs(NaN));
 });
 
 test(function mathRound() {
   assertEquals(2, Math.round(1.5));
   assertEquals(-1, Math.round(-1.5));
-  assertEquals("Infinity", String(Math.round(Infinity)));
-  assertEquals("-Infinity", String(Math.round(-Infinity)));
-  assertEquals("Infinity", String(1 / Math.round(0.0)));
-  assertEquals("-Infinity", String(1 / Math.round(-0.0)));
-  assertEquals("NaN", String(Math.round(NaN)));
+  assertSame(Infinity, Math.round(Infinity));
+  assertSame(-Infinity, Math.round(-Infinity));
+  assertSame(Infinity, 1 / Math.round(0.0));
+  assertSame(-Infinity, 1 / Math.round(-0.0));
+  assertSame(NaN, Math.round(NaN));
   assertEquals(Math.pow(2, 52) + 1, Math.round(Math.pow(2, 52) + 1));
 });
 
 test(function mathFround() {
   assertTrue(isNaN(Math.fround(NaN)));
-  assertEquals("Infinity", String(1/Math.fround(0)));
-  assertEquals("-Infinity", String(1/Math.fround(-0)));
-  assertEquals("Infinity", String(Math.fround(Infinity)));
-  assertEquals("-Infinity", String(Math.fround(-Infinity)));
-  assertEquals("Infinity", String(Math.fround(1E200)));
-  assertEquals("-Infinity", String(Math.fround(-1E200)));
+  assertSame(Infinity, 1 / Math.fround(0));
+  assertSame(-Infinity, 1 / Math.fround(-0));
+  assertSame(Infinity, Math.fround(Infinity));
+  assertSame(-Infinity, Math.fround(-Infinity));
+  assertSame(Infinity, Math.fround(1E200));
+  assertSame(-Infinity, Math.fround(-1E200));
   assertEquals(3.1415927410125732, Math.fround(Math.PI));
 });
 
 test(function mathFloor() {
   assertEquals(1, Math.floor(1.5));
   assertEquals(-2, Math.floor(-1.5));
-  assertEquals("Infinity", String(Math.floor(Infinity)));
-  assertEquals("-Infinity", String(Math.floor(-Infinity)));
-  assertEquals("Infinity", String(1 / Math.floor(0.0)));
-  assertEquals("-Infinity", String(1 / Math.floor(-0.0)));
-  assertEquals("NaN", String(Math.floor(NaN)));
+  assertSame(Infinity, Math.floor(Infinity));
+  assertSame(-Infinity, Math.floor(-Infinity));
+  assertSame(Infinity, 1 / Math.floor(0.0));
+  assertSame(-Infinity, 1 / Math.floor(-0.0));
+  assertSame(NaN, Math.floor(NaN));
   assertEquals(Math.pow(2, 52) + 1, Math.floor(Math.pow(2, 52) + 1));
 });
 
 test(function mathPow() {
   assertEquals(2.25, Math.pow(1.5, 2));
   assertTrue(1.8 < Math.pow(1.5, 1.5) && Math.pow(1.5, 1.5) < 1.9);
-  assertEquals("Infinity", String(Math.pow(Infinity, 0.5)));
-  assertEquals("Infinity", String(Math.pow(-Infinity, 0.5)));
+  assertSame(Infinity, Math.pow(Infinity, 0.5));
+  assertSame(Infinity, Math.pow(-Infinity, 0.5));
   assertEquals(0, Math.pow(Infinity, -0.5));
   assertEquals(0, Math.pow(Infinity, -0.5));
-  assertEquals("Infinity", String(Math.pow(Infinity, Infinity)));
+  assertSame(Infinity, Math.pow(Infinity, Infinity));
   assertEquals(0, Math.pow(Infinity, -Infinity));
-  assertEquals("NaN", String(Math.pow(Infinity, NaN)));
-  assertEquals("NaN", String(Math.pow(NaN, 2)));
+  assertSame(NaN, Math.pow(Infinity, NaN));
+  assertSame(NaN, Math.pow(NaN, 2));
 });
 
 test(function stringAdd() {
@@ -226,24 +232,66 @@ test(function stringLength() {
   assertEquals(-5, { length: -5 }.length);
 });
 
-test(function stringCharCodeAt() {
-  assertEquals(99, "abc".charCodeAt(2));
-  assertEquals("NaN", String("abc".charCodeAt(-1)));
-  assertEquals("NaN", String("abc".charCodeAt(4)));
-  assertEquals(98, "abc".charCodeAt(1.1));
-  assertEquals("NaN", String("abc".charCodeAt(4.1)));
-  assertEquals("NaN", String("abc".charCodeAt(1 + 4294967295)));
-});
-
 test(function stringCharAt() {
   assertEquals("c", "abc".charAt(2));
   assertEquals("", "abc".charAt(-1));
   assertEquals("", "abc".charAt(4));
   assertEquals("b", "abc".charAt(1.1));
   assertEquals("", "abc".charAt(4.1));
-  assertEquals("", String("abc".charAt(1 + 4294967295)));
-});
+  assertEquals("", "abc".charAt(Infinity));
+  assertEquals("", "abc".charAt(-Infinity));
+  assertEquals("a", "abc".charAt(-0));
+  assertEquals("a", "abc".charAt(+0));
+  assertEquals("", "".charAt());
+  assertEquals("", "abc".charAt(1 + 4294967295));
+}, 10);
+
+test(function stringCharCodeAt() {
+  assertSame(99, "abc".charCodeAt(2));
+  assertSame(NaN, "abc".charCodeAt(-1));
+  assertSame(NaN, "abc".charCodeAt(4));
+  assertSame(98, "abc".charCodeAt(1.1));
+  assertSame(NaN, "abc".charCodeAt(4.1));
+  assertSame(NaN, "abc".charCodeAt(Infinity));
+  assertSame(NaN, "abc".charCodeAt(-Infinity));
+  assertSame(97, "abc".charCodeAt(-0));
+  assertSame(97, "abc".charCodeAt(+0));
+  assertSame(NaN, "".charCodeAt());
+  assertSame(NaN, "abc".charCodeAt(1 + 4294967295));
+}, 10);
+
+test(function stringCodePointAt() {
+  assertSame(65533, "äϠ�𝌆".codePointAt(2));
+  assertSame(119558, "äϠ�𝌆".codePointAt(3));
+  assertSame(undefined, "äϠ�".codePointAt(-1));
+  assertSame(undefined, "äϠ�".codePointAt(4));
+  assertSame(992, "äϠ�".codePointAt(1.1));
+  assertSame(undefined, "äϠ�".codePointAt(4.1));
+  assertSame(undefined, "äϠ�".codePointAt(Infinity));
+  assertSame(undefined, "äϠ�".codePointAt(-Infinity));
+  assertSame(228, "äϠ�".codePointAt(-0));
+  assertSame(97, "aϠ�".codePointAt(+0));
+  assertSame(undefined, "".codePointAt());
+  assertSame(undefined, "äϠ�".codePointAt(1 + 4294967295));
+}, 10);
+
+test(function stringFromCodePoint() {
+  assertEquals(String.fromCodePoint(""), "\0");
+  assertEquals(String.fromCodePoint(), "");
+  assertEquals(String.fromCodePoint(-0), "\0");
+  assertEquals(String.fromCodePoint(0), "\0");
+  assertEquals(String.fromCodePoint(0x1D306), "\uD834\uDF06");
+  assertEquals(
+    String.fromCodePoint(0x1D306, 0x61, 0x1D307),
+    "\uD834\uDF06a\uD834\uDF07");
+  assertEquals(String.fromCodePoint(0x61, 0x62, 0x1D307), "ab\uD834\uDF07");
+  assertEquals(String.fromCodePoint(false), "\0");
+  assertEquals(String.fromCodePoint(null), "\0");
+}, 5);
 
+test(function stringFromCharCode() {
+  assertEquals("！", String.fromCharCode(0x10FF01));
+}, 2);
 
 test(function int32Mod() {
   assertEquals(-0, -2147483648 % (-1));
diff --git a/deps/v8/test/mjsunit/d8/d8-worker-sharedarraybuffer.js b/deps/v8/test/mjsunit/d8/d8-worker-sharedarraybuffer.js
index 09586c3a11c..0a15413ea30 100644
--- a/deps/v8/test/mjsunit/d8/d8-worker-sharedarraybuffer.js
+++ b/deps/v8/test/mjsunit/d8/d8-worker-sharedarraybuffer.js
@@ -28,17 +28,17 @@
 // Flags: --harmony-sharedarraybuffer
 
 if (this.Worker) {
-  (function TestTransfer() {
+  (function TestClone() {
     var workerScript =
       `onmessage = function(m) {
         var sab = m;
         var ta = new Uint32Array(sab);
         if (sab.byteLength !== 16) {
-          throw new Error('SharedArrayBuffer transfer byteLength');
+          throw new Error('SharedArrayBuffer clone byteLength');
         }
         for (var i = 0; i < 4; ++i) {
           if (ta[i] !== i) {
-            throw new Error('SharedArrayBuffer transfer value ' + i);
+            throw new Error('SharedArrayBuffer clone value ' + i);
           }
         }
         // Atomically update ta[0]
@@ -53,7 +53,7 @@ if (this.Worker) {
       ta[i] = i;
     }
 
-    // Transfer SharedArrayBuffer
+    // Clone SharedArrayBuffer
     w.postMessage(sab);
     assertEquals(16, sab.byteLength);  // ArrayBuffer should not be neutered.
 
@@ -68,7 +68,7 @@ if (this.Worker) {
     assertEquals(16, sab.byteLength);  // Still not neutered.
   })();
 
-  (function TestTransferMulti() {
+  (function TestCloneMulti() {
     var workerScript =
       `onmessage = function(msg) {
        var sab = msg.sab;
diff --git a/deps/v8/test/mjsunit/default-nospec.js b/deps/v8/test/mjsunit/default-nospec.js
new file mode 100644
index 00000000000..0e3b6c1f550
--- /dev/null
+++ b/deps/v8/test/mjsunit/default-nospec.js
@@ -0,0 +1,84 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+(()=> {
+  function f(a, b, c) {
+    return String.prototype.indexOf.call(a, b, c);
+  }
+  f("abc", "de", 1);
+  f("abc", "de", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", "de", {});
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", "de", {});
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a, b, c) {
+    return String.prototype.indexOf.apply(a, [b, c]);
+  }
+  f("abc", "de", 1);
+  f("abc", "de", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {}, 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {}, 1);
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a, b, c) {
+    return Reflect.apply(String.prototype.indexOf, a, [b, c]);
+  }
+  f("abc", "de", 1);
+  f("abc", "de", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f({}, "de", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f({}, "de", 1);
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a, b) {
+    return String.fromCharCode.call(a, b);
+  }
+  f("abc", 1);
+  f("abc", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {});
+  %OptimizeFunctionOnNextCall(f);
+  f({}, {});
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a, b) {
+    return String.fromCharCode.apply(undefined, [b, {}]);
+  }
+  f("abc", 1);
+  f("abc", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {});
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {});
+  assertOptimized(f);
+})();
+
+
+(()=> {
+  function f(a, b) {
+    return Reflect.apply(String.fromCharCode, a, [b, {}]);
+  }
+  f("abc", 1);
+  f("abc", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {});
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {});
+  assertOptimized(f);
+})();
diff --git a/deps/v8/test/mjsunit/es6/array-from.js b/deps/v8/test/mjsunit/es6/array-from.js
index c483d3deb69..02a599d4cab 100644
--- a/deps/v8/test/mjsunit/es6/array-from.js
+++ b/deps/v8/test/mjsunit/es6/array-from.js
@@ -161,6 +161,14 @@ assertThrows(function () { Array.from.call(exotic, [1]); }, TypeError);
 // The setter wasn't called
 assertEquals(0, setterCalled);
 
+// Non-callable iterators should cause a TypeError before calling the target
+// constructor.
+items = {};
+items[Symbol.iterator] = 7;
+function TestError() {}
+function ArrayLike() { throw new TestError() }
+assertThrows(function() { Array.from.call(ArrayLike, items); }, TypeError);
+
 // Check that array properties defined are writable, enumerable, configurable
 function ordinary() { }
 var x = Array.from.call(ordinary, [2]);
diff --git a/deps/v8/test/mjsunit/es6/array-iterator.js b/deps/v8/test/mjsunit/es6/array-iterator.js
index d2d19b059d2..b143c8c034f 100644
--- a/deps/v8/test/mjsunit/es6/array-iterator.js
+++ b/deps/v8/test/mjsunit/es6/array-iterator.js
@@ -152,10 +152,6 @@ function TestArrayIteratorPrototype() {
 
   assertEquals(Object.prototype, ArrayIteratorPrototype.__proto__);
 
-  assertEquals('Array Iterator', %_ClassOf(array[Symbol.iterator]()));
-  assertEquals('Array Iterator', %_ClassOf(array.keys()));
-  assertEquals('Array Iterator', %_ClassOf(array.entries()));
-
   assertFalse(ArrayIteratorPrototype.hasOwnProperty('constructor'));
   assertArrayEquals(['next'],
       Object.getOwnPropertyNames(ArrayIteratorPrototype));
diff --git a/deps/v8/test/mjsunit/es6/classof-proxy.js b/deps/v8/test/mjsunit/es6/classof-proxy.js
deleted file mode 100644
index 02043614ba6..00000000000
--- a/deps/v8/test/mjsunit/es6/classof-proxy.js
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax
-
-function test_function(o) {
-  if (%_ClassOf(o) === "Function") {
-    return true;
-  } else {
-    return false;
-  }
-}
-
-var non_callable = new Proxy({}, {});
-var callable = new Proxy(function(){}.__proto__, {});
-var constructable = new Proxy(function(){}, {});
-
-assertFalse(test_function(non_callable));
-assertTrue(test_function(callable));
-assertTrue(test_function(constructable));
-
-%OptimizeFunctionOnNextCall(test_function);
-
-assertFalse(test_function(non_callable));
-assertTrue(test_function(callable));
-assertTrue(test_function(constructable));
diff --git a/deps/v8/test/mjsunit/es6/collection-iterator.js b/deps/v8/test/mjsunit/es6/collection-iterator.js
index 5a9b2f54e64..8257d96664a 100644
--- a/deps/v8/test/mjsunit/es6/collection-iterator.js
+++ b/deps/v8/test/mjsunit/es6/collection-iterator.js
@@ -14,7 +14,6 @@ function test(f) {
 test(function TestSetIterator() {
   var s = new Set;
   var iter = s.values();
-  assertEquals('Set Iterator', %_ClassOf(iter));
 
   var SetIteratorPrototype = iter.__proto__;
   assertFalse(SetIteratorPrototype.hasOwnProperty('constructor'));
@@ -160,7 +159,6 @@ test(function TestSetIteratorSymbol() {
 test(function TestMapIterator() {
   var m = new Map;
   var iter = m.values();
-  assertEquals('Map Iterator', %_ClassOf(iter));
 
   var MapIteratorPrototype = iter.__proto__;
   assertFalse(MapIteratorPrototype.hasOwnProperty('constructor'));
diff --git a/deps/v8/test/mjsunit/es6/collections-constructor-custom-iterator.js b/deps/v8/test/mjsunit/es6/collections-constructor-custom-iterator.js
new file mode 100644
index 00000000000..e4b52bc5c57
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/collections-constructor-custom-iterator.js
@@ -0,0 +1,65 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestSetWithCustomIterator(ctor) {
+  const k1 = {};
+  const k2 = {};
+  const entries = [k1];
+  let callCount = 0;
+  entries[Symbol.iterator] = () => ({
+    next: () =>
+      callCount++ === 0
+        ? { value: k2, done: false }
+        : { done: true }
+  });
+  const set = new ctor(entries);
+  assertFalse(set.has(k1));
+  assertTrue(set.has(k2));
+  assertEquals(2, callCount);
+}
+TestSetWithCustomIterator(Set);
+TestSetWithCustomIterator(Set);
+TestSetWithCustomIterator(Set);
+%OptimizeFunctionOnNextCall(TestSetWithCustomIterator);
+TestSetWithCustomIterator(Set);
+assertOptimized(TestSetWithCustomIterator);
+
+TestSetWithCustomIterator(WeakSet);
+TestSetWithCustomIterator(WeakSet);
+TestSetWithCustomIterator(WeakSet);
+%OptimizeFunctionOnNextCall(TestSetWithCustomIterator);
+TestSetWithCustomIterator(WeakSet);
+assertOptimized(TestSetWithCustomIterator);
+
+function TestMapWithCustomIterator(ctor) {
+  const k1 = {};
+  const k2 = {};
+  const entries = [[k1, 1]];
+  let callCount = 0;
+  entries[Symbol.iterator] = () => ({
+    next: () =>
+      callCount++ === 0
+        ? { value: [k2, 2], done: false }
+        : { done: true }
+  });
+  const map = new ctor(entries);
+  assertFalse(map.has(k1));
+  assertEquals(2, map.get(k2));
+  assertEquals(2, callCount);
+}
+TestMapWithCustomIterator(Map);
+TestMapWithCustomIterator(Map);
+TestMapWithCustomIterator(Map);
+%OptimizeFunctionOnNextCall(TestMapWithCustomIterator);
+TestMapWithCustomIterator(Map);
+assertOptimized(TestMapWithCustomIterator);
+
+TestMapWithCustomIterator(WeakMap);
+TestMapWithCustomIterator(WeakMap);
+TestMapWithCustomIterator(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapWithCustomIterator);
+TestMapWithCustomIterator(WeakMap);
+assertOptimized(TestMapWithCustomIterator);
diff --git a/deps/v8/test/mjsunit/es6/collections-constructor-iterator-side-effect.js b/deps/v8/test/mjsunit/es6/collections-constructor-iterator-side-effect.js
new file mode 100644
index 00000000000..50308fdde39
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/collections-constructor-iterator-side-effect.js
@@ -0,0 +1,80 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestSetWithModifiedIterator(ctor) {
+  const k1 = {};
+  const k2 = {};
+  const entries = [k1, k2];
+  const arrayIteratorProto = Object.getPrototypeOf(entries[Symbol.iterator]());
+  const originalNext = arrayIteratorProto.next;
+  let callCount = 0;
+  arrayIteratorProto.next = function() {
+    callCount++;
+    return originalNext.call(this);
+  };
+
+  const set = new ctor(entries);
+  assertEquals(3, callCount); // +1 for iterator done
+
+  if('size' in set) assertEquals(2, set.size);
+  assertTrue(set.has(k1));
+  assertTrue(set.has(k2));
+
+  arrayIteratorProto.next = originalNext;
+}
+TestSetWithModifiedIterator(Set);
+TestSetWithModifiedIterator(Set);
+TestSetWithModifiedIterator(Set);
+%OptimizeFunctionOnNextCall(TestSetWithModifiedIterator);
+TestSetWithModifiedIterator(Set);
+assertOptimized(TestSetWithModifiedIterator);
+%DeoptimizeFunction(TestSetWithModifiedIterator);
+
+TestSetWithModifiedIterator(WeakSet);
+TestSetWithModifiedIterator(WeakSet);
+TestSetWithModifiedIterator(WeakSet);
+%OptimizeFunctionOnNextCall(TestSetWithModifiedIterator);
+TestSetWithModifiedIterator(WeakSet);
+assertOptimized(TestSetWithModifiedIterator);
+%DeoptimizeFunction(TestSetWithModifiedIterator);
+
+
+function TestMapWithModifiedIterator(ctor) {
+  const k1 = {};
+  const k2 = {};
+  const entries = [[k1, 1], [k2, 2]];
+  const arrayIteratorProto = Object.getPrototypeOf(entries[Symbol.iterator]());
+  const originalNext = arrayIteratorProto.next;
+  let callCount = 0;
+  arrayIteratorProto.next = function() {
+    callCount++;
+    return originalNext.call(this);
+  };
+
+  const set = new ctor(entries);
+  assertEquals(3, callCount); // +1 for iterator done
+
+  if('size' in set) assertEquals(2, set.size);
+  assertEquals(1, set.get(k1));
+  assertEquals(2, set.get(k2));
+
+  arrayIteratorProto.next = originalNext;
+}
+TestMapWithModifiedIterator(Map);
+TestMapWithModifiedIterator(Map);
+TestMapWithModifiedIterator(Map);
+%OptimizeFunctionOnNextCall(TestMapWithModifiedIterator);
+TestMapWithModifiedIterator(Map);
+assertOptimized(TestMapWithModifiedIterator);
+%DeoptimizeFunction(TestMapWithModifiedIterator);
+
+TestMapWithModifiedIterator(WeakMap);
+TestMapWithModifiedIterator(WeakMap);
+TestMapWithModifiedIterator(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapWithModifiedIterator);
+TestMapWithModifiedIterator(WeakMap);
+assertOptimized(TestMapWithModifiedIterator);
+%DeoptimizeFunction(TestMapWithModifiedIterator);
diff --git a/deps/v8/test/mjsunit/es6/collections-constructor-with-modified-array-prototype.js b/deps/v8/test/mjsunit/es6/collections-constructor-with-modified-array-prototype.js
new file mode 100644
index 00000000000..cc441b1ad42
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/collections-constructor-with-modified-array-prototype.js
@@ -0,0 +1,65 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestSetWithCustomIterator(ctor) {
+  const k1 = {};
+  const k2 = {};
+  let callCount = 0;
+  Array.prototype[Symbol.iterator] = () => ({
+    next: () =>
+      callCount++ === 0
+        ? { value: k2, done: false }
+        : { done: true }
+  });
+  const entries = [k1];
+  const set = new ctor(entries);
+  assertFalse(set.has(k1));
+  assertTrue(set.has(k2));
+  assertEquals(2, callCount);
+}
+TestSetWithCustomIterator(Set);
+TestSetWithCustomIterator(Set);
+TestSetWithCustomIterator(Set);
+%OptimizeFunctionOnNextCall(TestSetWithCustomIterator);
+TestSetWithCustomIterator(Set);
+assertOptimized(TestSetWithCustomIterator);
+
+TestSetWithCustomIterator(WeakSet);
+TestSetWithCustomIterator(WeakSet);
+TestSetWithCustomIterator(WeakSet);
+%OptimizeFunctionOnNextCall(TestSetWithCustomIterator);
+TestSetWithCustomIterator(WeakSet);
+assertOptimized(TestSetWithCustomIterator);
+
+function TestMapWithCustomIterator(ctor) {
+  const k1 = {};
+  const k2 = {};
+  let callCount = 0;
+  Array.prototype[Symbol.iterator] = () => ({
+    next: () =>
+      callCount++ === 0
+        ? { value: [k2, 2], done: false }
+        : { done: true }
+  });
+  const entries = [[k1, 1]];
+  const map = new ctor(entries);
+  assertFalse(map.has(k1));
+  assertEquals(2, map.get(k2));
+  assertEquals(2, callCount);
+}
+TestMapWithCustomIterator(Map);
+TestMapWithCustomIterator(Map);
+TestMapWithCustomIterator(Map);
+%OptimizeFunctionOnNextCall(TestMapWithCustomIterator);
+TestMapWithCustomIterator(Map);
+assertOptimized(TestMapWithCustomIterator);
+
+TestMapWithCustomIterator(WeakMap);
+TestMapWithCustomIterator(WeakMap);
+TestMapWithCustomIterator(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapWithCustomIterator);
+TestMapWithCustomIterator(WeakMap);
+assertOptimized(TestMapWithCustomIterator);
diff --git a/deps/v8/test/mjsunit/es6/collections-constructor-with-modified-protoype.js b/deps/v8/test/mjsunit/es6/collections-constructor-with-modified-protoype.js
new file mode 100644
index 00000000000..a4278952436
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/collections-constructor-with-modified-protoype.js
@@ -0,0 +1,76 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestSetPrototypeModified(ctor) {
+  const originalPrototypeAdd = ctor.prototype.add;
+  const k1 = {};
+  const k2 = {};
+  const entries = [k1, k2];
+  let addCount = 0;
+
+  ctor.prototype.add = function(value) {
+    addCount++;
+    originalPrototypeAdd.call(this, value);
+    entries.length = 1;
+  };
+  const set = new ctor(entries);
+
+  assertEquals(1, addCount);
+  assertTrue(set.has(k1));
+  assertFalse(set.has(k2));
+
+  ctor.prototype.add = originalPrototypeAdd;
+}
+TestSetPrototypeModified(Set);
+TestSetPrototypeModified(Set);
+TestSetPrototypeModified(Set);
+%OptimizeFunctionOnNextCall(TestSetPrototypeModified);
+TestSetPrototypeModified(Set);
+assertOptimized(TestSetPrototypeModified);
+%DeoptimizeFunction(TestSetPrototypeModified);
+
+TestSetPrototypeModified(WeakSet);
+TestSetPrototypeModified(WeakSet);
+TestSetPrototypeModified(WeakSet);
+%OptimizeFunctionOnNextCall(TestSetPrototypeModified);
+TestSetPrototypeModified(WeakSet);
+assertOptimized(TestSetPrototypeModified);
+%DeoptimizeFunction(TestSetPrototypeModified);
+
+function TestMapPrototypeModified(ctor) {
+  const originalPrototypeSet = ctor.prototype.set;
+  const k1 = {};
+  const k2 = {};
+  const entries = [[k1, 1], [k2, 2]];
+  let setCount = 0;
+
+  ctor.prototype.set = function(key, value) {
+    setCount++;
+    originalPrototypeSet.call(this, key, value);
+    entries.length = 1;
+  };
+  const map = new ctor(entries);
+
+  assertEquals(1, setCount);
+  assertTrue(map.has(k1));
+  assertFalse(map.has(k2));
+
+  ctor.prototype.set = originalPrototypeSet;
+}
+TestMapPrototypeModified(Map);
+TestMapPrototypeModified(Map);
+TestMapPrototypeModified(Map);
+%OptimizeFunctionOnNextCall(TestMapPrototypeModified);
+TestMapPrototypeModified(Map);
+assertOptimized(TestMapPrototypeModified);
+%DeoptimizeFunction(TestMapPrototypeModified);
+
+TestMapPrototypeModified(WeakMap);
+TestMapPrototypeModified(WeakMap);
+TestMapPrototypeModified(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapPrototypeModified);
+TestMapPrototypeModified(WeakMap);
+assertOptimized(TestMapPrototypeModified);
diff --git a/deps/v8/test/mjsunit/es6/collections.js b/deps/v8/test/mjsunit/es6/collections.js
index 1664a93bded..feae6294392 100644
--- a/deps/v8/test/mjsunit/es6/collections.js
+++ b/deps/v8/test/mjsunit/es6/collections.js
@@ -307,17 +307,6 @@ assertTrue(WeakSet.prototype.has instanceof Function)
 assertTrue(WeakSet.prototype.delete instanceof Function)
 
 
-// Test class of instance and prototype.
-assertEquals("Set", %_ClassOf(new Set))
-assertEquals("Object", %_ClassOf(Set.prototype))
-assertEquals("Map", %_ClassOf(new Map))
-assertEquals("Object", %_ClassOf(Map.prototype))
-assertEquals("WeakMap", %_ClassOf(new WeakMap))
-assertEquals("Object", %_ClassOf(WeakMap.prototype))
-assertEquals("WeakSet", %_ClassOf(new WeakSet))
-assertEquals("Object", %_ClassOf(WeakMap.prototype))
-
-
 // Test name of constructor.
 assertEquals("Set", Set.name);
 assertEquals("Map", Map.name);
diff --git a/deps/v8/test/mjsunit/es6/generators-objects.js b/deps/v8/test/mjsunit/es6/generators-objects.js
index 2cc359f911f..ff216d43e48 100644
--- a/deps/v8/test/mjsunit/es6/generators-objects.js
+++ b/deps/v8/test/mjsunit/es6/generators-objects.js
@@ -55,7 +55,6 @@ function TestGeneratorObject() {
   var iter = g();
   assertSame(g.prototype, Object.getPrototypeOf(iter));
   assertTrue(iter instanceof g);
-  assertEquals("Generator", %_ClassOf(iter));
   assertEquals("[object Generator]", String(iter));
   assertEquals([], Object.getOwnPropertyNames(iter));
   assertTrue(iter !== g());
diff --git a/deps/v8/test/mjsunit/es6/map-constructor-entry-side-effect.js b/deps/v8/test/mjsunit/es6/map-constructor-entry-side-effect.js
new file mode 100644
index 00000000000..813fffccf7a
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/map-constructor-entry-side-effect.js
@@ -0,0 +1,48 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestMapConstructorEntrySideEffect(ctor) {
+  const k1 = {};
+  const k2 = {};
+  const k3 = {};
+  let callCount = 0;
+  const input = [
+    Object.defineProperty([, 1], "0", {
+      get() {
+        input.length = 2;
+        return k1;
+      }
+    }),
+    [k2, 2],
+    Object.defineProperty([, 3], "0", {
+      get() {
+        callCount++;
+        return k3;
+      }
+    })
+  ];
+  const col = new ctor(input);
+
+  assertEquals(0, callCount);
+  if ('size' in col) assertEquals(2, col.size);
+  assertEquals(col.get(k1), 1);
+  assertEquals(col.get(k2), 2);
+  assertFalse(col.has(k3));
+}
+
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(Map);
+assertOptimized(TestMapConstructorEntrySideEffect);
+
+TestMapConstructorEntrySideEffect(WeakMap);
+TestMapConstructorEntrySideEffect(WeakMap);
+TestMapConstructorEntrySideEffect(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(WeakMap);
+assertOptimized(TestMapConstructorEntrySideEffect);
diff --git a/deps/v8/test/mjsunit/es6/map-constructor-entry-side-effect2.js b/deps/v8/test/mjsunit/es6/map-constructor-entry-side-effect2.js
new file mode 100644
index 00000000000..0c167c1bfab
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/map-constructor-entry-side-effect2.js
@@ -0,0 +1,53 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestMapConstructorEntrySideEffect(ctor) {
+  const originalPrototypeSet = ctor.prototype.set;
+  const k1 = {};
+  const k2 = {};
+  let callCount = 0;
+  const input = [
+    Object.defineProperty([, 1], "0", {
+      get() {
+        // Verify continuation retains original set function
+        ctor.prototype.set = () => {
+          callCount++;
+        };
+        return k1;
+      }
+    }),
+    [k2, 2]
+  ];
+  const col = new ctor(input);
+
+  assertEquals(0, callCount);
+  if ('size' in col) assertEquals(2, col.size);
+  assertTrue(col.has(k1));
+  assertTrue(col.has(k2));
+
+  const col2 = new ctor(input);
+
+  assertEquals(2, callCount);
+  if ('size' in col) assertEquals(0, col2.size);
+  assertFalse(col2.has(k1));
+  assertFalse(col2.has(k2));
+
+  ctor.prototype.set = originalPrototypeSet;
+}
+
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(Map);
+assertOptimized(TestMapConstructorEntrySideEffect);
+
+TestMapConstructorEntrySideEffect(WeakMap);
+TestMapConstructorEntrySideEffect(WeakMap);
+TestMapConstructorEntrySideEffect(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(WeakMap);
+assertOptimized(TestMapConstructorEntrySideEffect);
diff --git a/deps/v8/test/mjsunit/es6/map-constructor-entry-side-effect3.js b/deps/v8/test/mjsunit/es6/map-constructor-entry-side-effect3.js
new file mode 100644
index 00000000000..7dd7aa78525
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/map-constructor-entry-side-effect3.js
@@ -0,0 +1,43 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestMapConstructorEntrySideEffect(ctor) {
+  const k1 = {};
+  const k2 = {};
+  const k3 = {};
+  const input = [
+    Object.defineProperty([, 1], "0", {
+      get() {
+        // Verify continuation accesses properly accesses subsequent entries
+        Object.defineProperty(input, "1", {
+          get: () => [k3, 3]
+        });
+        return k1;
+      }
+    }),
+    [k2, 2]
+  ];
+  const col = new ctor(input);
+
+  if ('size' in col) assertEquals(2, col.size);
+  assertTrue(col.has(k1));
+  assertFalse(col.has(k2));
+  assertTrue(col.has(k3));
+}
+
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(Map);
+assertOptimized(TestMapConstructorEntrySideEffect);
+
+TestMapConstructorEntrySideEffect(WeakMap);
+TestMapConstructorEntrySideEffect(WeakMap);
+TestMapConstructorEntrySideEffect(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(WeakMap);
+assertOptimized(TestMapConstructorEntrySideEffect);
diff --git a/deps/v8/test/mjsunit/es6/map-constructor-entry-side-effect4.js b/deps/v8/test/mjsunit/es6/map-constructor-entry-side-effect4.js
new file mode 100644
index 00000000000..ebf8c790ed6
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/map-constructor-entry-side-effect4.js
@@ -0,0 +1,53 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestMapConstructorEntrySideEffect(ctor) {
+  const k1 = {};
+  const k2 = {};
+  const k3 = {};
+  let firstEntryCallCount = 0;
+  let lastEntryCallCount = 0;
+  const input = [
+    Object.defineProperty([, 1], "0", {
+      get() {
+        // Verify handling of a non-Smi array length
+        input.length = 2 ** 32 - 2;
+        firstEntryCallCount++;
+        return k1;
+      }
+    }),
+    [k2, 2],
+    Object.defineProperty([k3, ], "1", {
+      get() {
+        input.length = 1;
+        lastEntryCallCount++;
+        return 3;
+      }
+    })
+  ];
+  const col = new ctor(input);
+
+  assertEquals(1, firstEntryCallCount,);
+  assertEquals(1, lastEntryCallCount);
+  if ('size' in col) assertEquals(3, col.size);
+  assertEquals(1, col.get(k1));
+  assertEquals(2, col.get(k2));
+  assertEquals(3, col.get(k3));
+}
+
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(Map);
+assertOptimized(TestMapConstructorEntrySideEffect);
+
+TestMapConstructorEntrySideEffect(WeakMap);
+TestMapConstructorEntrySideEffect(WeakMap);
+TestMapConstructorEntrySideEffect(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(WeakMap);
+assertOptimized(TestMapConstructorEntrySideEffect);
diff --git a/deps/v8/test/mjsunit/es6/promise-all-overflow-1.js b/deps/v8/test/mjsunit/es6/promise-all-overflow-1.js
new file mode 100644
index 00000000000..e86edbbc27b
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/promise-all-overflow-1.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Make sure we properly throw a RangeError when overflowing the maximum
+// number of elements for Promise.all, which is capped at 2^21 bits right
+// now, since we store the indices as identity hash on the resolve element
+// closures.
+const a = new Array(2 ** 21 - 1);
+const p = Promise.resolve(1);
+for (let i = 0; i < a.length; ++i) a[i] = p;
+testAsync(assert => {
+  assert.plan(1);
+  Promise.all(a).then(assert.unreachable, reason => {
+    assert.equals(true, reason instanceof RangeError);
+  });
+});
diff --git a/deps/v8/test/mjsunit/es6/promise-all-overflow-2.js b/deps/v8/test/mjsunit/es6/promise-all-overflow-2.js
new file mode 100644
index 00000000000..ece2c5b9b96
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/promise-all-overflow-2.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test that pre-allocation of the result array works even if it needs to be
+// allocated in large object space.
+const a = new Array(64 * 1024);
+a.fill(Promise.resolve(1));
+testAsync(assert => {
+  assert.plan(1);
+  Promise.all(a).then(b => {
+    assert.equals(a.length, b.length);
+  });
+});
diff --git a/deps/v8/test/mjsunit/es6/promise-all.js b/deps/v8/test/mjsunit/es6/promise-all.js
new file mode 100644
index 00000000000..c60d3069a63
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/promise-all.js
@@ -0,0 +1,84 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// We store the index in the hash code field of the Promise.all resolve
+// element closures, so make sure we properly handle the cases where this
+// magical field turns into a PropertyArray later.
+(function() {
+  class MyPromise extends Promise {
+    then(resolve, reject) {
+      this.resolve = resolve;
+    }
+  };
+  const myPromise = new MyPromise(() => {});
+  MyPromise.all([myPromise]);
+  myPromise.resolve.x = 1;
+  myPromise.resolve(1);
+})();
+
+// Same test as above, but for PropertyDictionary.
+(function() {
+  class MyPromise extends Promise {
+    then(resolve, reject) {
+      this.resolve = resolve;
+    }
+  };
+  const myPromise = new MyPromise(() => {});
+  MyPromise.all([myPromise]);
+  for (let i = 0; i < 1025; ++i) {
+    myPromise.resolve[`x${i}`] = i;
+  }
+  myPromise.resolve(1);
+})();
+
+// Test that we return a proper array even if (custom) "then" invokes the
+// resolve callbacks right away.
+(function() {
+  class MyPromise extends Promise {
+    constructor(executor, id) {
+      super(executor);
+      this.id = id;
+    }
+
+    then(resolve, reject) {
+      if (this.id) return resolve(this.id);
+      return super.then(resolve, reject)
+    }
+  };
+  const a = new MyPromise(() => {}, 'a');
+  const b = new MyPromise(() => {}, 'b');
+  testAsync(assert => {
+    assert.plan(1);
+    MyPromise.all([a, b]).then(
+        v => assert.equals(['a', 'b'], v),
+        assert.unexpectedRejection());
+  });
+})();
+
+// Test that we properly handle holes introduced into the resulting array
+// by resolving some late elements immediately.
+(function() {
+  class MyPromise extends Promise {
+    then(resolve, reject) {
+      if (this.immediately) {
+        resolve(42);
+      } else {
+        super.then(resolve, reject);
+      }
+    }
+  };
+  const a = new Array(1024);
+  a.fill(MyPromise.resolve(1));
+  const p = MyPromise.resolve(0);
+  p.immediately = true;
+  a.push(p);
+  testAsync(assert => {
+    assert.plan(1);
+    MyPromise.all(a).then(
+        b => assert.equals(42, b[1024]),
+        assert.unexpectedRejection());
+  });
+})();
diff --git a/deps/v8/test/mjsunit/es6/promise-resolve-thenable-job.js b/deps/v8/test/mjsunit/es6/promise-resolve-thenable-job.js
new file mode 100644
index 00000000000..70ab6cda962
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/promise-resolve-thenable-job.js
@@ -0,0 +1,127 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+  let resolve;
+  let onFulfilledValue;
+  const p = new Promise(r => resolve = r);
+  resolve(Promise.resolve(1));
+  p.then(
+      v => {
+        onFulfilledValue = v;
+      },
+      e => {
+        assertUnreachable();
+      });
+  setTimeout(_ => assertEquals(1, onFulfilledValue));
+})();
+
+(function() {
+  let resolve;
+  let onRejectedReason;
+  const p = new Promise(r => resolve = r);
+  resolve(Promise.reject(1));
+  p.then(
+      v => {
+        assertUnreachable();
+      },
+      e => {
+        onRejectedReason = e;
+      });
+  setTimeout(_ => assertEquals(1, onRejectedReason));
+})();
+
+(function() {
+  let onFulfilledValue;
+  (async () => Promise.resolve(1))().then(
+      v => {
+        onFulfilledValue = v;
+      },
+      e => {
+        assertUnreachable();
+      });
+  setTimeout(_ => assertEquals(1, onFulfilledValue));
+})();
+
+(function() {
+  let onRejectedReason;
+  (async () => Promise.reject(1))().then(
+      v => {
+        assertUnreachable();
+      },
+      e => {
+        onRejectedReason = e;
+      });
+  setTimeout(_ => assertEquals(1, onRejectedReason));
+})();
+
+(function() {
+  let resolve;
+  let onFulfilledValue;
+  const p = new Promise(r => resolve = r);
+  resolve({
+    then(onFulfilled, onRejected) {
+      onFulfilled(1);
+    }
+  });
+  p.then(
+      v => {
+        onFulfilledValue = v;
+      },
+      e => {
+        assertUnreachable();
+      });
+  setTimeout(_ => assertEquals(1, onFulfilledValue));
+})();
+
+(function() {
+  let resolve;
+  let onRejectedReason;
+  const p = new Promise(r => resolve = r);
+  resolve({
+    then(onFulfilled, onRejected) {
+      onRejected(1);
+    }
+  });
+  p.then(
+      v => {
+        assertUnreachable();
+      },
+      e => {
+        onRejectedReason = e;
+      });
+  setTimeout(_ => assertEquals(1, onRejectedReason));
+})();
+
+(function() {
+  let onFulfilledValue;
+  (async () => ({
+    then(onFulfilled, onRejected) {
+      onFulfilled(1);
+    }
+  }))().then(
+      v => {
+        onFulfilledValue = v;
+      },
+      e => {
+        assertUnreachable();
+      });
+  setTimeout(_ => assertEquals(1, onFulfilledValue));
+})();
+
+(function() {
+  let onRejectedReason;
+  (async () => ({
+    then(onFulfilled, onRejected) {
+      onRejected(1);
+    }
+  }))().then(
+      v => {
+        assertUnreachable();
+      },
+      e => {
+        onRejectedReason = e;
+      });
+  setTimeout(_ => assertEquals(1, onRejectedReason));
+})();
diff --git a/deps/v8/test/mjsunit/es6/promises.js b/deps/v8/test/mjsunit/es6/promises.js
index 6e20d684ff8..86b6afd5380 100644
--- a/deps/v8/test/mjsunit/es6/promises.js
+++ b/deps/v8/test/mjsunit/es6/promises.js
@@ -582,6 +582,15 @@ function assertAsyncDone(iteration) {
   testPromiseAllNonIterable(42);
 })();
 
+(function() {
+  Promise.all({[symbolIterator](){ return null; }}).then(
+    assertUnreachable,
+    function(r) {
+      assertAsync(r instanceof TypeError, 'all/non iterable');
+    });
+  assertAsyncRan();
+})();
+
 (function() {
   var deferred = defer(Promise);
   var p = deferred.promise;
diff --git a/deps/v8/test/mjsunit/es6/proxies.js b/deps/v8/test/mjsunit/es6/proxies.js
index 75a80a15bda..f67f9df41e6 100644
--- a/deps/v8/test/mjsunit/es6/proxies.js
+++ b/deps/v8/test/mjsunit/es6/proxies.js
@@ -1287,8 +1287,7 @@ TestKeysThrow({
 
 // ---------------------------------------------------------------------------
 // String conversion (Object.prototype.toString,
-//                    Object.prototype.toLocaleString,
-//                    Function.prototype.toString)
+//                    Object.prototype.toLocaleString)
 
 var key
 
@@ -1306,7 +1305,6 @@ function TestToString(handler) {
   assertEquals(Symbol.toStringTag, key)
   assertEquals("my_proxy", Object.prototype.toLocaleString.call(f))
   assertEquals("toString", key)
-  assertThrows(function(){ Function.prototype.toString.call(f) })
 
   var o = Object.create(p)
   key = ""
diff --git a/deps/v8/test/mjsunit/es6/proxy-function-tostring.js b/deps/v8/test/mjsunit/es6/proxy-function-tostring.js
new file mode 100644
index 00000000000..d859822df01
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/proxy-function-tostring.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --noharmony-function-tostring
+
+assertThrows(() => new Proxy(function() {}, {}).toString(), TypeError);
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-crbug-820596.js b/deps/v8/test/mjsunit/es6/regress/regress-crbug-820596.js
new file mode 100644
index 00000000000..6257e141586
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regress/regress-crbug-820596.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --print-ast
+
+var x;
+`Crashes if OOB read with --print-ast ${x}`;
diff --git a/deps/v8/test/mjsunit/es6/spread-array-misc.js b/deps/v8/test/mjsunit/es6/spread-array-misc.js
new file mode 100644
index 00000000000..baed14629b6
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/spread-array-misc.js
@@ -0,0 +1,273 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --allow-natives-syntax
+
+"use strict";
+{
+
+
+// We use g(a, b, c) instead of [a, b, c] when we care about Sminess being
+// preserved.
+function* g(...args) { for (const x of args) yield x; }
+// G is like g but triggers GC to avoid allocation-site updates.
+function* G(...args) { gc(); for (const x of args) { gc(); yield x; }; gc(); }
+
+
+assertEquals([], [...[]]);
+assertEquals([], [...[], ]);
+assertEquals([1], [1, ...[]]);
+assertEquals([1, 2], [1, ...[], 2]);
+assertEquals([, ], [, ...[]]);
+assertEquals([, ], [, ...[], ]);
+assertEquals([, ], [, ...[],...[]]);
+assertEquals([, ], [, ...[],...[], ]);
+assertEquals([1, 2, 3], [...[1, 2, 3]]);
+assertEquals([1, 1.5], [...g(1, 1.5)]);
+assertEquals([, 1, 1.5], [, ...g(1, 1.5)]);
+assertEquals([1, 2, 2.5, 3.5], [...g(1, 2, 2.5, 3.5)]);
+assertEquals([2.5, 1, 3.5, 4], [...g(2.5, 1, 3.5, 4)]);
+assertEquals([2.5, 3.5, 1, 4], [...g(2.5, 3.5, 1, 4)]);
+assertEquals([{a: 1}, {b: 2}], [...[{a: 1}, {b: 2}]]);
+assertEquals([0, {a: 1}, {b: 2}], [...g(0, {a: 1}, {b: 2})]);
+assertEquals([1, 1.5, "2"], [...g(1, 1.5, "2")]);
+
+
+function f1(x) {
+  return [...[x, x, x]];
+}
+assertEquals([1, 1, 1], f1(1));
+assertEquals([0.1, 0.1, 0.1], f1(0.1));
+assertEquals([{}, {}, {}], f1({}));
+assertEquals([1, 1, 1], f1(1));
+
+function f1_(x) {
+  return [...[x, x, x]];
+}
+assertEquals([1, 1, 1], f1_(1));
+%OptimizeFunctionOnNextCall(f1_);
+assertEquals([1, 1, 1], f1_(1));
+assertEquals([0.1, 0.1, 0.1], f1_(0.1));
+assertEquals([{}, {}, {}], f1_({}));
+assertEquals([1, 1, 1], f1_(1));
+
+
+function f2(x) {
+  return [...[x, x, x], ,];
+}
+assertEquals([1, 1, 1, ,], f2(1));
+assertEquals([0.1, 0.1, 0.1, ,], f2(0.1));
+assertEquals([{}, {}, {}, ,], f2({}));
+assertEquals([1, 1, 1, ,], f2(1));
+
+function f2_(x) {
+  return [...[x, x, x], ,];
+}
+assertEquals([1, 1, 1, ,], f2_(1));
+%OptimizeFunctionOnNextCall(f2_);
+assertEquals([1, 1, 1, ,], f2_(1));
+assertEquals([0.1, 0.1, 0.1, ,], f2_(0.1));
+assertEquals([{}, {}, {}, ,], f2_({}));
+assertEquals([1, 1, 1, ,], f2_(1));
+
+
+function f3(it) {
+  return [...it, ,];
+}
+assertEquals([1, 0.1, "1", , ], f3(g(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1", , ], f3(g({}, 0.1, "1")));
+assertEquals([0, 0, 0, , ], f3(g(0, 0, 0)));
+assertEquals([1, 0.1, "1", , ], f3(g(1, 0.1, "1")));
+
+function f3_(it) {
+  return [...it, ,];
+}
+assertEquals([1, 0.1, "1", , ], f3_(g(1, 0.1, "1")));
+%OptimizeFunctionOnNextCall(f3_);
+assertEquals([1, 0.1, "1", , ], f3_(g(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1", , ], f3_(g({}, 0.1, "1")));
+assertEquals([0, 0, 0, , ], f3_(g(0, 0, 0)));
+assertEquals([1, 0.1, "1", , ], f3_(g(1, 0.1, "1")));
+
+
+function f4(x) {
+  return [...[x, x, x]];
+}
+assertEquals([1, 1, 1], f4(1));
+assertEquals([0.1, 0.1, 0.1], f4(0.1));
+assertEquals([{}, {}, {}], f4({}));
+assertEquals([1, 1, 1], f4(1));
+
+function f4_(x) {
+  return [...[x, x, x]];
+}
+assertEquals([1, 1, 1], f4_(1));
+%OptimizeFunctionOnNextCall(f4_);
+assertEquals([1, 1, 1], f4_(1));
+assertEquals([0.1, 0.1, 0.1], f4_(0.1));
+assertEquals([{}, {}, {}], f4_({}));
+assertEquals([1, 1, 1], f4_(1));
+
+
+function f5(x) {
+  return [...[x, x, x], ,];
+}
+assertEquals([1, 1, 1, ,], f5(1));
+assertEquals([0.1, 0.1, 0.1, ,], f5(0.1));
+assertEquals([{}, {}, {}, ,], f5({}));
+assertEquals([1, 1, 1, ,], f5(1));
+
+function f5_(x) {
+  return [...[x, x, x], ,];
+}
+assertEquals([1, 1, 1, ,], f5_(1));
+%OptimizeFunctionOnNextCall(f5_);
+assertEquals([1, 1, 1, ,], f5_(1));
+assertEquals([0.1, 0.1, 0.1, ,], f5_(0.1));
+assertEquals([{}, {}, {}, ,], f5_({}));
+assertEquals([1, 1, 1, ,], f5_(1));
+
+
+function f6(it) {
+  return [...it, ,];
+}
+assertEquals([1, 0.1, "1", , ], f6(g(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1", , ], f6(g({}, 0.1, "1")));
+assertEquals([0, 0, 0, , ], f6(g(0, 0, 0)));
+assertEquals([1, 0.1, "1", , ], f6(g(1, 0.1, "1")));
+
+function f6_(it) {
+  return [...it, ,];
+}
+assertEquals([1, 0.1, "1", , ], f6_(g(1, 0.1, "1")));
+%OptimizeFunctionOnNextCall(f6_);
+assertEquals([1, 0.1, "1", , ], f6_(g(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1", , ], f6_(g({}, 0.1, "1")));
+assertEquals([0, 0, 0, , ], f6_(g(0, 0, 0)));
+assertEquals([1, 0.1, "1", , ], f6_(g(1, 0.1, "1")));
+
+
+function f7(it) {
+  return [...it];
+}
+assertEquals([1, 0.1, "1"], f7(G(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1"], f7(G({}, 0.1, "1")));
+assertEquals([0, 0, 0], f7(G(0, 0, 0)));
+assertEquals([1, 0.1, "1"], f7(G(1, 0.1, "1")));
+
+function f7_(it) {
+  return [...it];
+}
+assertEquals([1, 0.1, "1"], f7_(G(1, 0.1, "1")));
+%OptimizeFunctionOnNextCall(f7_);
+assertEquals([1, 0.1, "1"], f7_(G(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1"], f7_(G({}, 0.1, "1")));
+assertEquals([0, 0, 0], f7_(G(0, 0, 0)));
+assertEquals([1, 0.1, "1"], f7_(G(1, 0.1, "1")));
+
+
+function f8(it) {
+  return [...it, ,];
+}
+assertEquals([1, 0.1, "1", , ], f8(G(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1", , ], f8(G({}, 0.1, "1")));
+assertEquals([0, 0, 0, , ], f8(G(0, 0, 0)));
+assertEquals([1, 0.1, "1", , ], f8(G(1, 0.1, "1")));
+
+function f8_(it) {
+  return [...it, ,];
+}
+assertEquals([1, 0.1, "1", , ], f8_(G(1, 0.1, "1")));
+%OptimizeFunctionOnNextCall(f8_);
+assertEquals([1, 0.1, "1", , ], f8_(G(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1", , ], f8_(G({}, 0.1, "1")));
+assertEquals([0, 0, 0, , ], f8_(G(0, 0, 0)));
+assertEquals([1, 0.1, "1", , ], f8_(G(1, 0.1, "1")));
+
+
+// Megamorphic
+function* f9() {
+  for (let i = 0; i < 160000; ++i) yield i;
+}
+let a = [...f9()];
+assertEquals(160000, a.length);
+assertEquals(0, a[0]);
+assertEquals(159999, a[159999]);
+%OptimizeFunctionOnNextCall(f9);
+a = [...f9()];
+assertEquals(160000, a.length);
+assertEquals(0, a[0]);
+assertEquals(159999, a[159999]);
+
+// Slow stub
+function f10(b) {
+  let x = [
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ...b];
+  return x.length;
+}
+assertEquals(4335, f10([3.3, 3.3, 3.3]));
+assertEquals(4335, f10([{}, "", 3.3]));
+%OptimizeFunctionOnNextCall(f10);
+assertEquals(4335, f10([{}, "", 3.3]));
+assertEquals(4332, f10([]));
+
+
+}  // top-level scope
diff --git a/deps/v8/test/mjsunit/es6/spread-array-mutated-prototype.js b/deps/v8/test/mjsunit/es6/spread-array-mutated-prototype.js
new file mode 100644
index 00000000000..5d29e7a8f06
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/spread-array-mutated-prototype.js
@@ -0,0 +1,236 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// NOTE:
+// Tests in this file are meant to run in the presence of an invalidated
+// NoElementsProtector, as effected by the following line.
+Array.prototype[0] = 42;
+delete Array.prototype[0];
+
+
+(function TestBasics() {
+  var a = [1, 2];
+  var b = [...a];
+  assertArrayEquals([1, 2], b)
+
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e', 'f'],
+                    ['a', ...'bc', 'd', ...'ef'])
+})();
+
+
+var log = [];
+
+function* gen(n) {
+  log.push(n, 1);
+  yield 1;
+  log.push(n, 2);
+  yield 2;
+  log.push(n, 3);
+  yield 3;
+  log.push(n, 'done');
+}
+
+function id(v) {
+  log.push(v);
+  return v;
+}
+
+
+(function TestGenerator() {
+  assertArrayEquals([1, 2, 3], [...gen('a')]);
+  assertArrayEquals(['x', 1, 2, 3, 'y', 1, 2, 3, 'z'],
+                    ['x', ...gen('a'), 'y', ...gen('b'), 'z']);
+})();
+
+
+(function TestOrderOfExecution() {
+  log = [];
+  assertArrayEquals(['x', 1, 2, 3, 'y', 1, 2, 3, 'z'],
+                    [id('x'), ...gen('a'), id('y'), ...gen('b'), id('z')]);
+  assertArrayEquals([
+    'x', 'a', 1, 'a', 2, 'a', 3, 'a', 'done',
+    'y', 'b', 1, 'b', 2, 'b', 3, 'b', 'done',
+    'z'
+  ], log);
+})();
+
+
+(function TestNotIterable() {
+  var a;
+  assertThrows(function() {
+    a = [...42];
+  }, TypeError);
+  assertSame(undefined, a);
+
+
+})();
+
+
+(function TestInvalidIterator() {
+  var iter = {
+    [Symbol.iterator]: 42
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, TypeError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestIteratorNotAnObject() {
+  var iter = {
+    [Symbol.iterator]() {
+      return 42;
+    }
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, TypeError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestIteratorNoNext() {
+  var iter = {
+    [Symbol.iterator]() {
+      return {};
+    }
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, TypeError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestIteratorResultDoneThrows() {
+  function MyError() {}
+  var iter = {
+    [Symbol.iterator]() {
+      return {
+        next() {
+          return {
+            get done() {
+              throw new MyError();
+            }
+          }
+        }
+      };
+    }
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, MyError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestIteratorResultValueThrows() {
+  function MyError() {}
+  var iter = {
+    [Symbol.iterator]() {
+      return {
+        next() {
+          return {
+            done: false,
+            get value() {
+              throw new MyError();
+            }
+          }
+        }
+      };
+    }
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, MyError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestOptimize() {
+  function f() {
+    return [...'abc'];
+  }
+  assertArrayEquals(['a', 'b', 'c'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c'], f());
+})();
+
+
+(function TestDeoptimize() {
+  var iter = {
+    [Symbol.iterator]() {
+      var i = 0;
+      return {
+        next() {
+          %DeoptimizeFunction(f);
+          return {value: ++i, done: i === 3};
+        }
+      };
+    }
+  };
+  function f() {
+    return [0, ...iter];
+  }
+
+  assertArrayEquals([0, 1, 2], f());
+})();
+
+
+(function TestPrototypeSetter1() {
+  Object.defineProperty(Array.prototype, 3, {set() {throw 666}})
+  Object.defineProperty(Array.prototype, 4, {set() {throw 666}})
+
+  function f() {
+    return ['a', ...['b', 'c', 'd'], 'e']
+  }
+
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+
+  delete Array.prototype[3];
+  delete Array.prototype[4];
+})();
+
+
+(function TestPrototypeSetter2() {
+  Object.defineProperty(Array.prototype.__proto__, 3, {set() {throw 666}})
+  Object.defineProperty(Array.prototype.__proto__, 4, {set() {throw 666}})
+
+  function f() {
+    return ['a', ...['b', 'c', 'd'], 'e']
+  }
+
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+
+  delete Array.prototype.__proto__[3];
+  delete Array.prototype.__proto__[4];
+})();
+
+
+(function TestPrototypeProxy() {
+  const backup = Array.prototype.__proto__;
+  Array.prototype.__proto__ = new Proxy({}, {set() {throw 666}});
+
+  function f() {
+    return ['a', ...['b', 'c', 'd'], 'e']
+  }
+
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+
+  Object.setPrototypeOf(Array.prototype, backup);
+})();
diff --git a/deps/v8/test/mjsunit/es6/spread-array.js b/deps/v8/test/mjsunit/es6/spread-array-pristine-prototype.js
similarity index 94%
rename from deps/v8/test/mjsunit/es6/spread-array.js
rename to deps/v8/test/mjsunit/es6/spread-array-pristine-prototype.js
index d112422b784..ea4d1337033 100644
--- a/deps/v8/test/mjsunit/es6/spread-array.js
+++ b/deps/v8/test/mjsunit/es6/spread-array-pristine-prototype.js
@@ -4,6 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
+// NOTE:
+// Tests in this file are meant to run in the presence of a valid
+// NoElementsProtector. Do not touch Array.prototype here.
+
 (function TestBasics() {
   var a = [1, 2];
   var b = [...a];
@@ -165,7 +169,7 @@ function id(v) {
       var i = 0;
       return {
         next() {
-          $DeoptimizeFunction(f);
+          %DeoptimizeFunction(f);
           return {value: ++i, done: i === 3};
         }
       };
@@ -176,4 +180,4 @@ function id(v) {
   }
 
   assertArrayEquals([0, 1, 2], f());
-});
+})();
diff --git a/deps/v8/test/mjsunit/es6/spread-array-prototype-proxy.js b/deps/v8/test/mjsunit/es6/spread-array-prototype-proxy.js
new file mode 100644
index 00000000000..ed38228c28f
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/spread-array-prototype-proxy.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+(function TestPrototypeProxy() {
+  const backup = Array.prototype.__proto__;
+  Array.prototype.__proto__ = new Proxy({}, {set() {throw 666}});
+
+  function f() {
+    return ['a', ...['b', 'c', 'd'], 'e']
+  }
+
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+
+  Object.setPrototypeOf(Array.prototype, backup);
+})();
diff --git a/deps/v8/test/mjsunit/es6/spread-array-prototype-setter1.js b/deps/v8/test/mjsunit/es6/spread-array-prototype-setter1.js
new file mode 100644
index 00000000000..2ca9e217879
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/spread-array-prototype-setter1.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+(function TestPrototypeSetter1() {
+  Object.defineProperty(Array.prototype, 3, {set() {throw 666}})
+  Object.defineProperty(Array.prototype, 4, {set() {throw 666}})
+
+  function f() {
+    return ['a', ...['b', 'c', 'd'], 'e']
+  }
+
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+
+  delete Array.prototype[3];
+  delete Array.prototype[4];
+})();
diff --git a/deps/v8/test/mjsunit/es6/spread-array-prototype-setter2.js b/deps/v8/test/mjsunit/es6/spread-array-prototype-setter2.js
new file mode 100644
index 00000000000..736d50b46b0
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/spread-array-prototype-setter2.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+(function TestPrototypeSetter2() {
+  Object.defineProperty(Array.prototype.__proto__, 3, {set() {throw 666}})
+  Object.defineProperty(Array.prototype.__proto__, 4, {set() {throw 666}})
+
+  function f() {
+    return ['a', ...['b', 'c', 'd'], 'e']
+  }
+
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+
+  delete Array.prototype.__proto__[3];
+  delete Array.prototype.__proto__[4];
+})();
diff --git a/deps/v8/test/mjsunit/es6/string-fromcodepoint.js b/deps/v8/test/mjsunit/es6/string-fromcodepoint.js
index c4634ace44f..92734324df3 100644
--- a/deps/v8/test/mjsunit/es6/string-fromcodepoint.js
+++ b/deps/v8/test/mjsunit/es6/string-fromcodepoint.js
@@ -5,6 +5,8 @@
 // Tests taken from:
 // https://github.com/mathiasbynens/String.fromCodePoint
 
+// Flags: --allow-natives-syntax
+
 assertEquals(String.fromCodePoint.length, 1);
 assertEquals(String.propertyIsEnumerable("fromCodePoint"), false);
 
@@ -14,34 +16,38 @@ assertEquals(String.fromCodePoint(-0), "\0");
 assertEquals(String.fromCodePoint(0), "\0");
 assertEquals(String.fromCodePoint(0x1D306), "\uD834\uDF06");
 assertEquals(
-    String.fromCodePoint(0x1D306, 0x61, 0x1D307),
-    "\uD834\uDF06a\uD834\uDF07");
+  String.fromCodePoint(0x1D306, 0x61, 0x1D307),
+  "\uD834\uDF06a\uD834\uDF07");
 assertEquals(String.fromCodePoint(0x61, 0x62, 0x1D307), "ab\uD834\uDF07");
 assertEquals(String.fromCodePoint(false), "\0");
 assertEquals(String.fromCodePoint(null), "\0");
 
-assertThrows(function() { String.fromCodePoint("_"); }, RangeError);
-assertThrows(function() { String.fromCodePoint("+Infinity"); }, RangeError);
-assertThrows(function() { String.fromCodePoint("-Infinity"); }, RangeError);
-assertThrows(function() { String.fromCodePoint(-1); }, RangeError);
-assertThrows(function() { String.fromCodePoint(0x10FFFF + 1); }, RangeError);
-assertThrows(function() { String.fromCodePoint(3.14); }, RangeError);
-assertThrows(function() { String.fromCodePoint(3e-2); }, RangeError);
-assertThrows(function() { String.fromCodePoint(-Infinity); }, RangeError);
-assertThrows(function() { String.fromCodePoint(+Infinity); }, RangeError);
-assertThrows(function() { String.fromCodePoint(NaN); }, RangeError);
-assertThrows(function() { String.fromCodePoint(undefined); }, RangeError);
-assertThrows(function() { String.fromCodePoint({}); }, RangeError);
-assertThrows(function() { String.fromCodePoint(/./); }, RangeError);
-assertThrows(function() { String.fromCodePoint({
-  valueOf: function() { throw Error(); } });
+assertThrows(function () { String.fromCodePoint("_"); }, RangeError);
+assertThrows(function () { String.fromCodePoint("+Infinity"); }, RangeError);
+assertThrows(function () { String.fromCodePoint("-Infinity"); }, RangeError);
+assertThrows(function () { String.fromCodePoint(-1); }, RangeError);
+assertThrows(function () { String.fromCodePoint(0x10FFFF + 1); }, RangeError);
+assertThrows(function () { String.fromCodePoint(3.14); }, RangeError);
+assertThrows(function () { String.fromCodePoint(3e-2); }, RangeError);
+assertThrows(function () { String.fromCodePoint(-Infinity); }, RangeError);
+assertThrows(function () { String.fromCodePoint(+Infinity); }, RangeError);
+assertThrows(function () { String.fromCodePoint(NaN); }, RangeError);
+assertThrows(function () { String.fromCodePoint(undefined); }, RangeError);
+assertThrows(function () { String.fromCodePoint({}); }, RangeError);
+assertThrows(function () { String.fromCodePoint(/./); }, RangeError);
+assertThrows(function () {
+  String.fromCodePoint({
+    valueOf: function () { throw Error(); }
+  });
 }, Error);
-assertThrows(function() { String.fromCodePoint({
-  valueOf: function() { throw Error(); } });
+assertThrows(function () {
+  String.fromCodePoint({
+    valueOf: function () { throw Error(); }
+  });
 }, Error);
 var tmp = 0x60;
 assertEquals(String.fromCodePoint({
-  valueOf: function() { ++tmp; return tmp; }
+  valueOf: function () { ++tmp; return tmp; }
 }), "a");
 assertEquals(tmp, 0x61);
 
diff --git a/deps/v8/test/mjsunit/es6/symbols.js b/deps/v8/test/mjsunit/es6/symbols.js
index d83e2174eca..a6c12909b48 100644
--- a/deps/v8/test/mjsunit/es6/symbols.js
+++ b/deps/v8/test/mjsunit/es6/symbols.js
@@ -67,8 +67,6 @@ function TestType() {
     assertEquals("symbol", typeof symbols[i])
     assertTrue(typeof symbols[i] === "symbol")
     assertFalse(%SymbolIsPrivate(symbols[i]))
-    assertEquals(null, %_ClassOf(symbols[i]))
-    assertEquals("Symbol", %_ClassOf(Object(symbols[i])))
   }
 }
 TestType()
diff --git a/deps/v8/test/mjsunit/es6/templates.js b/deps/v8/test/mjsunit/es6/templates.js
index 3eb73e4d169..3e113cb8295 100644
--- a/deps/v8/test/mjsunit/es6/templates.js
+++ b/deps/v8/test/mjsunit/es6/templates.js
@@ -342,27 +342,30 @@ var obj = {
   var a = 1;
   var b = 2;
 
-  tag`head${a}tail`;
-  tag`head${b}tail`;
-
+  // Call-sites are cached by ParseNode. Same tag call in a loop
+  // means same template object
+  for (var i = 0; i < 2; ++i) {
+    tag`head${i == 0 ? a : b}tail`;
+  }
   assertEquals(2, callSites.length);
   assertSame(callSites[0], callSites[1]);
 
-  eval("tag`head${a}tail`");
-  assertEquals(3, callSites.length);
-  assertSame(callSites[1], callSites[2]);
-
-  eval("tag`head${b}tail`");
+  // Tag calls within eval() never have the same ParseNode as the same tag
+  // call from a different eval() invocation.
+  for (var i = 0; i < 2; ++i) {
+    eval("tag`head${i == 0 ? a : b}tail`");
+  }
   assertEquals(4, callSites.length);
-  assertSame(callSites[2], callSites[3]);
+  assertTrue(callSites[1] !== callSites[2]);
+  assertTrue(callSites[2] !== callSites[3]);
 
   (new Function("tag", "a", "b", "return tag`head${a}tail`;"))(tag, 1, 2);
   assertEquals(5, callSites.length);
-  assertSame(callSites[3], callSites[4]);
+  assertTrue(callSites[3] !== callSites[4]);
 
   (new Function("tag", "a", "b", "return tag`head${b}tail`;"))(tag, 1, 2);
   assertEquals(6, callSites.length);
-  assertSame(callSites[4], callSites[5]);
+  assertTrue(callSites[4] !== callSites[5]);
 
   callSites = [];
 
@@ -374,17 +377,19 @@ var obj = {
 
   callSites = [];
 
-  eval("tag`\\\r\n\\\n\\\r`");
-  eval("tag`\\\r\n\\\n\\\r`");
+  for (var i = 0; i < 2; ++i) {
+    eval("tag`\\\r\n\\\n\\\r`");
+  }
   assertEquals(2, callSites.length);
-  assertSame(callSites[0], callSites[1]);
+  assertTrue(callSites[0] !== callSites[1]);
   assertEquals("", callSites[0][0]);
   assertEquals("\\\n\\\n\\\n", callSites[0].raw[0]);
 
   callSites = [];
 
-  tag`\uc548\ub155`;
-  tag`\uc548\ub155`;
+  for (var i = 0; i < 2; ++i) {
+    tag`\uc548\ub155`;
+  }
   assertEquals(2, callSites.length);
   assertSame(callSites[0], callSites[1]);
   assertEquals("안녕", callSites[0][0]);
@@ -735,3 +740,128 @@ var global = this;
   assertThrows(() => Function("f`foo`--"), ReferenceError);
   assertThrows(() => Function("f`foo` = 1"), ReferenceError);
 })();
+
+// Disable eval caching if a tagged template occurs in a nested function
+var v = 0;
+var templates = [];
+function tag(callSite) { templates.push(callSite); }
+for (v = 0; v < 6; v += 2) {
+  eval("(function() { for (var i = 0; i < 2; ++i) tag`Hello${v}world` })()");
+  assertSame(templates[v], templates[v + 1]);
+}
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+
+function makeSource1(id) {
+  return `function f() {
+    for (var i = 0; i < 2; ++i) tag\`Hello${id}world\`;
+  }
+  f();`;
+}
+templates = [];
+for (v = 0; v < 6; v += 2) {
+  eval(makeSource1(v));
+  assertSame(templates[v], templates[v + 1]);
+}
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+
+templates = [];
+eval("(function() { for (var i = 0; i < 2; ++i) tag`Hello${1}world` })()");
+eval("(function() { for (var i = 0; i < 2; ++i) tag`Hello${2}world` })()");
+eval("(function() { for (var i = 0; i < 2; ++i) tag`Hello${2}world` })()");
+assertSame(templates[0], templates[1]);
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertSame(templates[2], templates[3]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+assertSame(templates[4],templates[5]);
+
+templates = [];
+eval(makeSource1(1));
+eval(makeSource1(2));
+eval(makeSource1(3));
+assertSame(templates[0], templates[1]);
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertSame(templates[2], templates[3]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+assertSame(templates[4],templates[5]);
+
+// Disable eval caching if a tagged template occurs in an even deeper nested function
+var v = 0;
+templates = [];
+for (v = 0; v < 6; v += 2) {
+    eval("(function() { (function() { for (var i = 0; i < 2; ++i) tag`Hello${v}world` })() })()");
+    if (!v) continue;
+    assertNotSame(templates[v], templates[v - 1]);
+}
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+
+function makeSource2(id) {
+  return `function f() {
+    function innerF() {
+      for (var i = 0; i < 2; ++i) tag\`Hello${id}world\`;
+    }
+    return innerF();
+  }
+  f();`;
+}
+templates = [];
+for (v = 0; v < 6; v += 2) {
+  eval(makeSource2(v));
+  assertSame(templates[v], templates[v + 1]);
+}
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+
+templates = [];
+eval("(function() { (function() { for (var i = 0; i < 2; ++i) tag`Hello${1}world` })() })()");
+eval("(function() { (function() { for (var i = 0; i < 2; ++i) tag`Hello${2}world` })() })()");
+eval("(function() { (function() { for (var i = 0; i < 2; ++i) tag`Hello${2}world` })() })()");
+assertSame(templates[0], templates[1]);
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertSame(templates[2], templates[3]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+assertSame(templates[4], templates[5]);
+
+templates = [];
+eval(makeSource2(1));
+eval(makeSource2(2));
+eval(makeSource2(3));
+assertSame(templates[0], templates[1]);
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertSame(templates[2], templates[3]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+assertSame(templates[4], templates[5]);
diff --git a/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js b/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
index 66316f300ed..6573f2635d3 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
@@ -120,6 +120,31 @@ tests.push(function TestConstructFromArrayNoIteratorWithGetter(constr) {
   assertArrayEquals([1, 2, 22], ta);
 });
 
+tests.push(function TestConstructFromArrayNullIterator(constr) {
+  var arr = [1, 2, 3];
+  arr[Symbol.iterator] = null;
+
+  var ta = new Uint8Array(arr);
+
+  assertArrayEquals([1, 2, 3], ta);
+});
+
+tests.push(function TestConstructFromArrayUndefinedIterator(constr) {
+  var arr = [1, 2, 3];
+  arr[Symbol.iterator] = undefined;
+
+  var ta = new Uint8Array(arr);
+
+  assertArrayEquals([1, 2, 3], ta);
+});
+
+tests.push(function TestConstructFromArrayNonCallableIterator(constr) {
+  var arr = [1, 2, 3];
+  arr[Symbol.iterator] = 1;
+
+  assertThrows(() => new Uint8Array(arr), TypeError);
+});
+
 tests.push(function TestConstructFromArray(constr) {
   var n = 64;
   var jsArray = [];
@@ -150,6 +175,44 @@ tests.push(function TestConstructFromTypedArray(constr) {
   }
 });
 
+tests.push(function TestFromTypedArraySpecies(constr) {
+  var b = new ArrayBuffer(16);
+  var a1 = new constr(b);
+
+  var constructor_read = 0;
+  var cons = b.constructor;
+
+  Object.defineProperty(b, 'constructor', {
+    get: function() {
+      constructor_read++;
+      return cons;
+    }
+  });
+
+  var a2 = new constr(a1);
+
+  assertEquals(1, constructor_read);
+});
+
+tests.push(function TestFromTypedArraySpeciesNeutersBuffer(constr) {
+  var b = new ArrayBuffer(16);
+  var a1 = new constr(b);
+
+  var constructor_read = 0;
+  var cons = b.constructor;
+
+  Object.defineProperty(b, 'constructor', {
+    get: function() {
+      %ArrayBufferNeuter(b);
+      return cons;
+    }
+  });
+
+  var a2 = new constr(a1);
+
+  assertArrayEquals([], a2);
+});
+
 tests.push(function TestLengthIsMaxSmi(constr) {
   var myObject = { 0: 5, 1: 6, length: %_MaxSmi() + 1 };
 
diff --git a/deps/v8/test/mjsunit/es6/typedarray-every.js b/deps/v8/test/mjsunit/es6/typedarray-every.js
index a3498f57866..968078988fe 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-every.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-every.js
@@ -132,7 +132,6 @@ function TestTypedArrayForEach(constructor) {
   });
   assertEquals(2, count);
   assertTrue(!!buffer);
-  assertEquals("ArrayBuffer", %_ClassOf(buffer));
   assertSame(buffer, a.buffer);
 
   // The %TypedArray%.every() method should not work when
diff --git a/deps/v8/test/mjsunit/es6/typedarray-filter.js b/deps/v8/test/mjsunit/es6/typedarray-filter.js
new file mode 100644
index 00000000000..0f25c362ec9
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/typedarray-filter.js
@@ -0,0 +1,111 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var typedArrayConstructors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Uint8ClampedArray,
+  Float32Array,
+  Float64Array];
+
+function TestTypedArrayFilter(constructor) {
+  assertEquals(1, constructor.prototype.filter.length);
+
+  // Throw type error if source array is detached while executing a callback
+  let ta1 = new constructor(10);
+  assertThrows(() =>
+    ta1.filter(() => %ArrayBufferNeuter(ta1.buffer))
+  , TypeError);
+
+  // A new typed array should be created after finishing callbacks
+  var speciesCreated = 0;
+
+  class MyTypedArray extends constructor {
+    static get [Symbol.species]() {
+      return function() {
+        speciesCreated++;
+        return new constructor(10);
+      };
+    }
+  }
+
+  new MyTypedArray(10).filter(() => {
+    assertEquals(0, speciesCreated);
+    return true;
+  });
+  assertEquals(1, speciesCreated);
+
+  // A new typed array should be initialized to 0s
+  class LongTypedArray extends constructor {
+    static get [Symbol.species]() {
+      return function(len) {
+        return new constructor(len * 2);
+      }
+    }
+  }
+  let ta2 = new LongTypedArray(3).fill(1);
+  let ta3 = ta2.filter((val, index, array) => val > 0);
+  assertArrayEquals(ta3, [1, 1, 1, 0, 0, 0]);
+  assertEquals(ta3.constructor, constructor);
+
+  // Throw if a new typed array is too small
+  class ShortTypedArray extends constructor {
+    static get [Symbol.species]() {
+      return function(len) {
+        return new constructor(len/2);
+      }
+    }
+  }
+  assertThrows(() => new ShortTypedArray(10).filter(() => true));
+
+  // Throw if callback is not callable
+  assertThrows(() => new constructor(10).filter(123));
+  assertThrows(() => new constructor(10).filter({}));
+
+  // Empty result
+  assertEquals(new constructor(10).filter(() => false), new constructor(0));
+
+  // If a new typed array shares a buffer with a source array
+  let ab = new ArrayBuffer(100);
+  class SharedBufferTypedArray extends constructor {
+    static get [Symbol.species]() {
+      return function(len) {
+        return new constructor(ab, 0, 5);
+      }
+    }
+  }
+  let ta4 = new SharedBufferTypedArray(ab, 0, 5).fill(1);
+  let ta5 = ta4.filter(() => {
+    ta4[0] = 123;
+    ta4[2] = 123;
+    return true;
+  });
+  assertEquals(ta4.buffer, ta5.buffer);
+  assertArrayEquals(ta4, [1, 1, 123, 1, 1]);
+  assertArrayEquals(ta5, [1, 1, 123, 1, 1]);
+
+  // If a new typed array has a different type with source array
+  for (let j = 0; j < typedArrayConstructors.length; j++) {
+    let otherConstructor = typedArrayConstructors[j];
+    class OtherTypedArray extends constructor {
+      static get [Symbol.species]() {
+        return function(len) {
+          return new otherConstructor(len);
+        }
+      }
+    }
+    let ta6 = new OtherTypedArray(10).fill(123);
+    assertEquals(ta6.filter(() => true), new otherConstructor(10).fill(123));
+  }
+}
+
+for (i = 0; i < typedArrayConstructors.length; i++) {
+  TestTypedArrayFilter(typedArrayConstructors[i]);
+}
diff --git a/deps/v8/test/mjsunit/es6/typedarray-foreach.js b/deps/v8/test/mjsunit/es6/typedarray-foreach.js
index 7a846b1ac78..252706a9b58 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-foreach.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-foreach.js
@@ -121,7 +121,6 @@ function TestTypedArrayForEach(constructor) {
   });
   assertEquals(2, count);
   assertTrue(!!buffer);
-  assertEquals("ArrayBuffer", %_ClassOf(buffer));
   assertSame(buffer, a.buffer);
 
   // The %TypedArray%.forEach() method should not work when
diff --git a/deps/v8/test/mjsunit/es6/typedarray-from.js b/deps/v8/test/mjsunit/es6/typedarray-from.js
index 709c4533795..81576582498 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-from.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-from.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -14,19 +16,65 @@ var typedArrayConstructors = [
   Float64Array
 ];
 
+function defaultValue(constr) {
+  if (constr == Float32Array || constr == Float64Array) return NaN;
+  return 0;
+}
+
+function assertArrayLikeEquals(value, expected, type) {
+  assertEquals(value.__proto__, type.prototype);
+  assertEquals(expected.length, value.length);
+  for (var i = 0; i < value.length; ++i) {
+    assertEquals(expected[i], value[i]);
+  }
+}
+
+(function() {
+  var source = [-0, 0, 2**40, 2**41, 2**42];
+  var arr = Float64Array.from(source);
+  assertArrayLikeEquals(arr, source, Float64Array);
+
+  arr = Float32Array.from(source);
+  assertArrayLikeEquals(arr, source, Float32Array);
+})();
+
+(function() {
+  var source = [-0, 0, , 2**42];
+  var expected = [-0, 0, NaN, 2**42];
+  var arr = Float64Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float64Array);
+
+  arr = Float32Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float32Array);
+})();
+
+(function() {
+  var source = {0: -0, 1: 0, 2: 2**40, 3: 2**41, 4: 2**42, length: 5};
+  var expected = [-0, 0, 2**40, 2**41, 2**42];
+  var arr = Float64Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float64Array);
+
+  arr = Float32Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float32Array);
+})();
+
+(function() {
+  var source = [-0, 0, , 2**42];
+  Object.getPrototypeOf(source)[2] = 27;
+  var expected = [-0, 0, 27, 2**42];
+  var arr = Float64Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float64Array);
+
+  arr = Float32Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float32Array);
+})();
+
 for (var constructor of typedArrayConstructors) {
   assertEquals(1, constructor.from.length);
 
   // TypedArray.from only callable on this subclassing %TypedArray%
   assertThrows(function () {constructor.from.call(Array, [])}, TypeError);
 
-  function assertArrayLikeEquals(value, expected, type) {
-    assertEquals(value.__proto__, type.prototype);
-    assertEquals(expected.length, value.length);
-    for (var i = 0; i < value.length; ++i) {
-      assertEquals(expected[i], value[i]);
-    }
-  }
 
   // Assert that calling mapfn with / without thisArg in sloppy and strict modes
   // works as expected.
@@ -47,6 +95,14 @@ for (var constructor of typedArrayConstructors) {
   assertThrows(function() {constructor.from.call(1, [])}, TypeError);
   assertThrows(function() {constructor.from.call(undefined, [])}, TypeError);
 
+  // Use a map function that returns non-numbers.
+  function mapper(value, index) {
+    return String.fromCharCode(value);
+  }
+  var d = defaultValue(constructor);
+  assertArrayLikeEquals(
+      constructor.from([72, 69, 89], mapper), [d, d, d], constructor);
+
   // Converting from various other types, demonstrating that it can
   // operate on array-like objects as well as iterables.
   // TODO(littledan): constructors should have similar flexibility.
@@ -72,12 +128,62 @@ for (var constructor of typedArrayConstructors) {
   assertArrayLikeEquals(constructor.from(generator()),
                         [4, 5, 6], constructor);
 
+  // Check mapper is used for non-iterator case.
+  function mapper2(value, index) {
+    return value + 1;
+  }
+  var array_like = {
+    0: 1,
+    1: 2,
+    2: 3,
+    length: 3
+  };
+  assertArrayLikeEquals(constructor.from(array_like, mapper2),
+                        [2, 3, 4], constructor);
+
+  // With a smi source. Step 10 will set len = 0.
+  var source = 1;
+  assertArrayLikeEquals(constructor.from(source), [], constructor);
+
   assertThrows(function() { constructor.from(null); }, TypeError);
   assertThrows(function() { constructor.from(undefined); }, TypeError);
   assertThrows(function() { constructor.from([], null); }, TypeError);
   assertThrows(function() { constructor.from([], 'noncallable'); },
                TypeError);
 
+  source = [1, 2, 3];
+  var proxy = new Proxy(source, {});
+  assertArrayLikeEquals(constructor.from(proxy), source, constructor);
+
+  proxy = new Proxy(source, {
+    get: function(target, name) {
+      if (name === Symbol.iterator) return target[name];
+      if (name === "length") return 3;
+      return target[name] + 1;
+    }
+  });
+  assertArrayLikeEquals(constructor.from(proxy), [2, 3, 4], constructor);
+}
+
+// Tests that modify global state in a way that affects fast paths e.g. by
+// invalidating protectors or changing prototypes.
+for (var constructor of typedArrayConstructors) {
+  source = [1, 2, 3];
+  source[Symbol.iterator] = undefined;
+  assertArrayLikeEquals(constructor.from(source), source, constructor);
+
+  source = [{ valueOf: function(){ return 42; }}];
+  source[Symbol.iterator] = undefined;
+  assertArrayLikeEquals(constructor.from(source), [42], constructor);
+
+  Number.prototype[Symbol.iterator] = function* () {
+    yield 1;
+    yield 2;
+    yield 3;
+  }
+  assertArrayLikeEquals(constructor.from(1), [1, 2, 3], constructor);
+  assertArrayLikeEquals(constructor.from(1.1), [1, 2, 3], constructor);
+
   var nullIterator = {};
   nullIterator[Symbol.iterator] = null;
   assertArrayLikeEquals(constructor.from(nullIterator), [],
@@ -90,6 +196,26 @@ for (var constructor of typedArrayConstructors) {
 
   assertThrows(function() { constructor.from([], null); }, TypeError);
 
+  d = defaultValue(constructor);
+  let ta1 = new constructor(3).fill(1);
+  Object.defineProperty(ta1, "length", {get: function() {
+    return 6;
+  }});
+  delete ta1[Symbol.iterator];
+  delete ta1.__proto__[Symbol.iterator];
+  delete ta1.__proto__.__proto__[Symbol.iterator];
+  assertArrayLikeEquals(constructor.from(ta1), [1, 1, 1, d, d, d], constructor);
+
+  let ta2 = new constructor(3).fill(1);
+  Object.defineProperty(ta2, "length", {get: function() {
+    %ArrayBufferNeuter(ta2.buffer);
+    return 6;
+  }});
+  assertArrayLikeEquals(constructor.from(ta2), [d, d, d, d, d, d], constructor);
+
+  var o1 = {0: 0, 1: 1, 2: 2, length: 6};
+  assertArrayLikeEquals(constructor.from(o1), [0, 1, 2, d, d, d], constructor);
+
   // Ensure iterator is only accessed once, and only invoked once
   var called = 0;
   var arr = [1, 2, 3];
diff --git a/deps/v8/test/mjsunit/es6/typedarray-of.js b/deps/v8/test/mjsunit/es6/typedarray-of.js
index eaa7bde11b3..8ae590a8493 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-of.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-of.js
@@ -1,6 +1,8 @@
 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+//
+// Flags: --expose-gc
 
 // Based on Mozilla Array.of() tests at http://dxr.mozilla.org/mozilla-central/source/js/src/jit-test/tests/collections
 
@@ -130,6 +132,20 @@ function TestTypedArrayOf(constructor) {
   for (var x of [undefined, null, false, true, "cow", 42, 3.14]) {
     assertThrows(function () { constructor.of.call(x); }, TypeError);
   }
+
+  // Check if it's correctly accessing new typed array elements even after
+  // garbage collection is invoked in ToNumber.
+  var not_number = {
+    [Symbol.toPrimitive]() {
+      gc();
+      return 123;
+    }
+  };
+  var dangerous_array = new Array(64).fill(not_number);
+  var a = constructor.of(...dangerous_array);
+  for (var i = 0; i < 64; i++) {
+    assertEquals(123, a[i]);
+  }
 }
 
 for (var constructor of typedArrayConstructors) {
diff --git a/deps/v8/test/mjsunit/es6/unicode-regexp-restricted-syntax.js b/deps/v8/test/mjsunit/es6/unicode-regexp-restricted-syntax.js
index dd4fa39ab5d..1cc46df1b6e 100644
--- a/deps/v8/test/mjsunit/es6/unicode-regexp-restricted-syntax.js
+++ b/deps/v8/test/mjsunit/es6/unicode-regexp-restricted-syntax.js
@@ -13,6 +13,7 @@ assertThrows("/\\c/u", SyntaxError);
 assertThrows("/\\c0/u", SyntaxError);
 // test262/built-ins/RegExp/unicode_restricted_quantifiable_assertion
 assertThrows("/(?=.)*/u", SyntaxError);
+assertThrows("/(?=.){1,2}/u", SyntaxError);
 // test262/built-ins/RegExp/unicode_restricted_octal_escape
 assertThrows("/[\\1]/u", SyntaxError);
 assertThrows("/\\00/u", SyntaxError);
diff --git a/deps/v8/test/mjsunit/es8/object-entries.js b/deps/v8/test/mjsunit/es8/object-entries.js
index 5c7e74e378e..1c6358648b9 100644
--- a/deps/v8/test/mjsunit/es8/object-entries.js
+++ b/deps/v8/test/mjsunit/es8/object-entries.js
@@ -19,7 +19,7 @@ function TestMeta() {
 TestMeta();
 
 
-function TestBasic() {
+function TestBasic(withWarmup) {
   var x = 16;
   var O = {
     d: 1,
@@ -33,22 +33,29 @@ function TestBasic() {
   O.a = 2;
   O.b = 4;
   Object.defineProperty(O, "HIDDEN", { enumerable: false, value: NaN });
-  assertEquals([
+  if (withWarmup) {
+    for (const key in O) {}
+  }
+  O.c = 6;
+  const resultEntries = [
     ["0", 123],
     ["256", "ducks"],
     ["1000", 456],
     ["d", 1],
-    ["c", 3],
+    ["c", 6],
     ["0x100", "quack"],
     ["a", 2],
     ["b", 4]
-  ], Object.entries(O));
+  ];
+  assertEquals(resultEntries, Object.entries(O));
+  assertEquals(resultEntries, Object.entries(O));
   assertEquals(Object.entries(O), Object.keys(O).map(key => [key, O[key]]));
 
   assertTrue(Array.isArray(Object.entries({})));
   assertEquals(0, Object.entries({}).length);
 }
 TestBasic();
+TestBasic(true);
 
 
 function TestToObject() {
@@ -59,7 +66,7 @@ function TestToObject() {
 TestToObject();
 
 
-function TestOrder() {
+function TestOrder(withWarmup) {
   var O = {
     a: 1,
     [Symbol.iterator]: null
@@ -88,6 +95,11 @@ function TestOrder() {
     }
   });
 
+  if (withWarmup) {
+    for (const key in P) {}
+  }
+  log = [];
+
   assertEquals([["456", 123], ["a", 1]], Object.entries(P));
   assertEquals([
     "[[OwnPropertyKeys]]",
@@ -99,9 +111,10 @@ function TestOrder() {
   ], log);
 }
 TestOrder();
+TestOrder(true);
 
 
-function TestOrderWithDuplicates() {
+function TestOrderWithDuplicates(withWarmup) {
   var O = {
     a: 1,
     [Symbol.iterator]: null
@@ -130,6 +143,11 @@ function TestOrderWithDuplicates() {
     }
   });
 
+  if (withWarmup) {
+    for (const key in P) {}
+  }
+  log = [];
+
   assertEquals([
     ["a", 1],
     ["a", 1],
@@ -151,9 +169,20 @@ function TestOrderWithDuplicates() {
   ], log);
 }
 TestOrderWithDuplicates();
+TestOrderWithDuplicates(true);
 
+function TestDescriptorProperty() {
+  function f() {};
+  const o = {};
+  o.a = f;
 
-function TestPropertyFilter() {
+  for (const key in o) {};
+  const entries = Object.entries(o);
+  assertEquals([['a', f]], entries);
+}
+TestDescriptorProperty();
+
+function TestPropertyFilter(withWarmup) {
   var object = { prop3: 30 };
   object[2] = 40;
   object["prop4"] = 50;
@@ -164,6 +193,10 @@ function TestPropertyFilter() {
   var sym = Symbol("prop8");
   object[sym] = 90;
 
+  if (withWarmup) {
+    for (const key in object) {}
+  }
+
   values = Object.entries(object);
   assertEquals(5, values.length);
   assertEquals([
@@ -175,11 +208,15 @@ function TestPropertyFilter() {
   ], values);
 }
 TestPropertyFilter();
+TestPropertyFilter(true);
 
 
-function TestWithProxy() {
+function TestWithProxy(withWarmup) {
   var obj1 = {prop1:10};
   var proxy1 = new Proxy(obj1, { });
+  if (withWarmup) {
+    for (const key in proxy1) {}
+  }
   assertEquals([ [ "prop1", 10 ] ], Object.entries(proxy1));
 
   var obj2 = {};
@@ -191,6 +228,9 @@ function TestWithProxy() {
       return Reflect.getOwnPropertyDescriptor(target, name);
     }
   });
+  if (withWarmup) {
+    for (const key in proxy2) {}
+  }
   assertEquals([ [ "prop2", 20 ], [ "prop3", 30 ] ], Object.entries(proxy2));
 
   var obj3 = {};
@@ -206,12 +246,16 @@ function TestWithProxy() {
       return [ "prop0", "prop1", Symbol("prop2"), Symbol("prop5") ];
     }
   });
+  if (withWarmup) {
+    for (const key in proxy3) {}
+  }
   assertEquals([ [ "prop0", 0 ], [ "prop1", 5 ] ], Object.entries(proxy3));
 }
 TestWithProxy();
+TestWithProxy(true);
 
 
-function TestMutateDuringEnumeration() {
+function TestMutateDuringEnumeration(withWarmup) {
   var aDeletesB = {
     get a() {
       delete this.b;
@@ -219,6 +263,9 @@ function TestMutateDuringEnumeration() {
     },
     b: 2
   };
+  if (withWarmup) {
+    for (const key in aDeletesB) {}
+  }
   assertEquals([ [ "a", 1 ] ], Object.entries(aDeletesB));
 
   var aRemovesB = {
@@ -228,9 +275,15 @@ function TestMutateDuringEnumeration() {
     },
     b: 2
   };
+  if (withWarmup) {
+    for (const key in aRemovesB) {}
+  }
   assertEquals([ [ "a", 1 ] ], Object.entries(aRemovesB));
 
   var aAddsB = { get a() { this.b = 2; return 1; } };
+  if (withWarmup) {
+    for (const key in aAddsB) {}
+  }
   assertEquals([ [ "a", 1 ] ], Object.entries(aAddsB));
 
   var aMakesBEnumerable = {};
@@ -243,12 +296,16 @@ function TestMutateDuringEnumeration() {
   });
   Object.defineProperty(aMakesBEnumerable, "b", {
       value: 2, configurable:true, enumerable: false });
+  if (withWarmup) {
+    for (const key in aMakesBEnumerable) {}
+  }
   assertEquals([ [ "a", 1 ], [ "b", 2 ] ], Object.entries(aMakesBEnumerable));
 }
 TestMutateDuringEnumeration();
+TestMutateDuringEnumeration(true);
 
 
-(function TestElementKinds() {
+function TestElementKinds(withWarmup) {
   var O1 = { name: "1" }, O2 = { name: "2" }, O3 = { name: "3" };
   var PI = 3.141592653589793;
   var E = 2.718281828459045;
@@ -303,13 +360,22 @@ TestMutateDuringEnumeration();
         }), [["0", "s"], ["1", "t"], ["2", "r"], ["9999", "Y"]] ],
   };
 
+  if (withWarmup) {
+    for (const key in element_kinds) {}
+  }
   for (let [kind, [object, expected]] of Object.entries(element_kinds)) {
+    if (withWarmup) {
+      for (const key in object) {}
+    }
     let result1 = Object.entries(object);
     %HeapObjectVerify(object);
     %HeapObjectVerify(result1);
     assertEquals(expected, result1, `fast Object.entries() with ${kind}`);
 
     let proxy = new Proxy(object, {});
+    if (withWarmup) {
+      for (const key in proxy) {}
+    }
     let result2 = Object.entries(proxy);
     %HeapObjectVerify(result2);
     assertEquals(result1, result2, `slow Object.entries() with ${kind}`);
@@ -331,9 +397,15 @@ TestMutateDuringEnumeration();
   for (let [kind, [object, expected]] of Object.entries(element_kinds)) {
     if (kind == "FAST_STRING_WRAPPER_ELEMENTS") break;
     object.__defineGetter__(1, makeFastElements);
+    if (withWarmup) {
+      for (const key in object) {}
+    }
     let result1 = Object.entries(object).toString();
     %HeapObjectVerify(object);
     %HeapObjectVerify(result1);
   }
 
-})();
+}
+
+TestElementKinds();
+TestElementKinds(true);
diff --git a/deps/v8/test/mjsunit/es9/regexp-lookbehind.js b/deps/v8/test/mjsunit/es9/regexp-lookbehind.js
index 54c975cfdf6..c3aae317a94 100644
--- a/deps/v8/test/mjsunit/es9/regexp-lookbehind.js
+++ b/deps/v8/test/mjsunit/es9/regexp-lookbehind.js
@@ -162,3 +162,10 @@ assertEquals(["cacb", "a", ""], /(?<=a(.\2)b(\1)).{4}/.exec("aabcacbc"));
 assertEquals(["b", "ac", "ac"], /(?<=a(\2)b(..\1))b/.exec("aacbacb"));
 assertEquals(["x", "aa"], /(?<=(?:\1b)(aa))./.exec("aabaax"));
 assertEquals(["x", "aa"], /(?<=(?:\1|b)(aa))./.exec("aaaax"));
+
+// Restricted syntax in Annex B 1.4.
+assertThrows("/(?<=.)*/u", SyntaxError);
+assertThrows("/(?<=.){1,2}/u", SyntaxError);
+assertThrows("/(?<=.)*/", SyntaxError);
+assertThrows("/(?<=.)?/", SyntaxError);
+assertThrows("/(?<=.)+/", SyntaxError);
diff --git a/deps/v8/test/mjsunit/harmony/array-flatMap.js b/deps/v8/test/mjsunit/harmony/array-flatMap.js
new file mode 100644
index 00000000000..d129c32e03c
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/array-flatMap.js
@@ -0,0 +1,120 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-array-flatten --allow-natives-syntax
+
+assertEquals(Array.prototype.flatMap.length, 1);
+assertEquals(Array.prototype.flatMap.name, 'flatMap');
+
+assertEquals(
+  [1, 2, 3, 4].flatMap((element) => [element, element ** 2]),
+  [1, 1, 2, 4, 3, 9, 4, 16]
+);
+assertEquals(
+  [1, 2, 3, 4].flatMap((element) => [[element, element ** 2]]),
+  [[1, 1], [2, 4], [3, 9], [4, 16]]
+);
+
+const elements = new Set([
+  -Infinity,
+  -1,
+  -0,
+  +0,
+  +1,
+  Infinity,
+  null,
+  undefined,
+  true,
+  false,
+  '',
+  'foo',
+  /./,
+  [],
+  {},
+  Object.create(null),
+  new Proxy({}, {}),
+  Symbol(),
+  x => x ** 2,
+  String
+]);
+
+for (const value of elements) {
+  assertEquals(
+    [value].flatMap((element) => [element, element]),
+    [value, value]
+  );
+}
+
+const array = [42];
+assertEquals(
+  [array].flatMap((element) => [element, element]),
+  [array, array]
+);
+
+const nonCallables = new Set([
+  -Infinity,
+  -1,
+  -0,
+  +0,
+  +1,
+  Infinity,
+  null,
+  undefined,
+  true,
+  false,
+  '',
+  'foo',
+  /./,
+  [],
+  {},
+  Object.create(null),
+  new Proxy({}, {}),
+  Symbol(),
+]);
+for (const nonCallable of nonCallables) {
+  assertThrows(() => {
+    [].flatMap(nonCallable);
+  }, TypeError);
+}
+
+const object = {
+  foo: 42,
+  get length() {
+    object.foo = 0;
+  }
+};
+const result = [object].flatMap((element) => [element, element]);
+%HeapObjectVerify(result);
+assertEquals(result, [object, object]);
+assertEquals(result[0].foo, 42);
+
+assertThrows(() => {
+  Array.prototype.flatMap.call(null, (element) => element);
+}, TypeError);
+assertThrows(() => {
+  Array.prototype.flatMap.call(undefined, (element) => element);
+}, TypeError);
+
+assertEquals(
+  Array.prototype.flatMap.call(
+    {
+      length: 1,
+      0: 'a',
+      1: 'b',
+    },
+    (element) => element
+  ),
+  ['a']
+);
+assertEquals(
+  Array.prototype.flatMap.call(
+    {
+      length: 2,
+      0: 'a',
+      1: 'b',
+    },
+    (element) => element
+  ),
+  ['a', 'b']
+);
diff --git a/deps/v8/test/mjsunit/harmony/array-flatten.js b/deps/v8/test/mjsunit/harmony/array-flatten.js
new file mode 100644
index 00000000000..7ca6218ed89
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/array-flatten.js
@@ -0,0 +1,38 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-array-flatten
+
+assertEquals(Array.prototype.flatten.length, 0);
+assertEquals(Array.prototype.flatten.name, 'flatten');
+
+const input = [1, [2], [[3]]];
+
+assertEquals(input.flatten(),          [1, 2, [3]]);
+assertEquals(input.flatten(1),         [1, 2, [3]]);
+assertEquals(input.flatten(true),      [1, 2, [3]]);
+assertEquals(input.flatten(undefined), [1, 2, [3]]);
+
+assertEquals(input.flatten(-Infinity), [1, [2], [[3]]]);
+assertEquals(input.flatten(-1),        [1, [2], [[3]]]);
+assertEquals(input.flatten(-0),        [1, [2], [[3]]]);
+assertEquals(input.flatten(0),         [1, [2], [[3]]]);
+assertEquals(input.flatten(false),     [1, [2], [[3]]]);
+assertEquals(input.flatten(null),      [1, [2], [[3]]]);
+assertEquals(input.flatten(''),        [1, [2], [[3]]]);
+assertEquals(input.flatten('foo'),     [1, [2], [[3]]]);
+assertEquals(input.flatten(/./),       [1, [2], [[3]]]);
+assertEquals(input.flatten([]),        [1, [2], [[3]]]);
+assertEquals(input.flatten({}),        [1, [2], [[3]]]);
+assertEquals(
+  input.flatten(new Proxy({}, {})),    [1, [2], [[3]]]);
+assertEquals(input.flatten((x) => x),  [1, [2], [[3]]]);
+assertEquals(
+  input.flatten(String),               [1, [2], [[3]]]);
+
+assertEquals(input.flatten(2),         [1, 2, 3]);
+assertEquals(input.flatten(Infinity),  [1, 2, 3]);
+
+assertThrows(() => { input.flatten(Symbol()); }, TypeError);
+assertThrows(() => { input.flatten(Object.create(null)); }, TypeError);
diff --git a/deps/v8/test/mjsunit/harmony/async-from-sync-iterator.js b/deps/v8/test/mjsunit/harmony/async-from-sync-iterator.js
index a7b0d1bda4a..2d6be098a24 100644
--- a/deps/v8/test/mjsunit/harmony/async-from-sync-iterator.js
+++ b/deps/v8/test/mjsunit/harmony/async-from-sync-iterator.js
@@ -717,8 +717,8 @@ if (testFailed) {
     next_: 0,
     get next() {
       log.push("get syncIterable.next");
-      let i = this.next_++;
       return (...args) => {
+        let i = this.next_++;
         log.push("call syncIterable.next(" + args.join(", ") + ")");
         return results[i];
       }
@@ -748,14 +748,12 @@ if (testFailed) {
       "get nextValue#1.then",
       "call nextValue#1.then",
       "got value value1",
-      "get syncIterable.next",
       "call syncIterable.next()",
       "get iterResult #2.done",
       "get iterResult #2.value",
       "get nextValue#2.then",
       "call nextValue#2.then",
       "got value value2",
-      "get syncIterable.next",
       "call syncIterable.next()",
       "get iterResult #3.done",
       "get iterResult #3.value",
diff --git a/deps/v8/test/mjsunit/harmony/async-generators-basic.js b/deps/v8/test/mjsunit/harmony/async-generators-basic.js
index d7af1836b83..12240e61149 100644
--- a/deps/v8/test/mjsunit/harmony/async-generators-basic.js
+++ b/deps/v8/test/mjsunit/harmony/async-generators-basic.js
@@ -153,7 +153,7 @@ async function* asyncGeneratorForToString() {}
 assertEquals("async function* asyncGeneratorForToString() {}",
              asyncGeneratorForToString.toString());
 
-assertEquals("async function* () {}", async function*() {}.toString());
+assertEquals("async function*() {}", async function*() {}.toString());
 assertEquals("async function* namedAsyncGeneratorForToString() {}",
              async function* namedAsyncGeneratorForToString() {}.toString());
 
@@ -164,9 +164,9 @@ assertEquals("async *method() { }",
 assertEquals("async *method() { }",
              (new (class { async *method() { } })).method.toString());
 
-assertEquals("async function* anonymous() {\n\n}",
+assertEquals("async function* anonymous(\n) {\n\n}",
              AsyncGeneratorFunction().toString());
-assertEquals("async function* anonymous() {\n\n}",
+assertEquals("async function* anonymous(\n) {\n\n}",
              (new AsyncGeneratorFunction()).toString());
 
 // ----------------------------------------------------------------------------
diff --git a/deps/v8/test/mjsunit/harmony/bigint/add.js b/deps/v8/test/mjsunit/harmony/bigint/add.js
index b57846e7f17..5e986b37262 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/add.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/add.js
@@ -7,96 +7,94 @@
 // Flags: --harmony-bigint
 
 var data = [{
-  a: "a2102214b151421124f462d37f843",
-  b: "90f3fa0f2fb9b1481b1a4737586ad6bdf71cb2ae51e06fdcb00fb779163e94ae4237",
-  r: "90f3fa0f2fb9b1481b1a4737586ad6bdf71cb2b872e29127c523d88b6584c1e63a7a"
+  a: -0xc4043e2c4cc49e4d6870103ce7c2ff2d512bf4b1b67553ba410db514ee0af8888ad6cfn,
+  b: 0x2aae86de73ff479133a657a40d26e8dcf192019c7421836615ec34978bad93n,
+  r: -0xc4043e2c2216176ef470c8abb41ca78944050bd4c4e3521dccec31aed81ec3f0ff293cn
 }, {
-  a: "35ca28bdd383c1b9ffdb851cc7f385ad370eef3d",
-  b: "-ca2d4dd677f23e005f44ec121303c3c304940eb2fd15e9e88772a3c5ba8515",
-  r: "-ca2d4dd677f23e005f44ebdc48db05ef80d254b32190cd2093ecf68eab95d8"
+  a: -0xee0933b25c8c0ef09fa385ffa1d3ca76855b560e186d27fa9f6ce105cb8517a4aecd5n,
+  b: -0x2ffc3a7babad313ede574774cb55cd40ab3b2n,
+  r: -0xee0933b25c8c0ef09fa385ffa1d3ca76b5579089c41a59397dc4287a96dae4e55a087n
 }, {
-  a: "-8abb4b6ca534b584fad2f5898dd22ae6",
-  b: "0",
-  r: "-8abb4b6ca534b584fad2f5898dd22ae6"
+  a: -0xdbb3e8fac212affdeda8959829838af77e43172n,
+  b: 0x2315999da3ac2ab89d2076cbe6e2e03082352e92c274680117ce7012dn,
+  r: 0x2315999da3ac2ab89c44c2e2ec20cd80844785fd2a4ae47620502cfbbn
 }, {
-  a: "b3",
-  b: "4180a0a",
-  r: "4180abd"
+  a: -0x5ad9780b309c24919defb1b331ebba4en,
+  b: 0xbe8dd806b3da0f79e7f6ad2fb566536cc78c1471c236891ce0n,
+  r: 0xbe8dd806b3da0f79e79bd3b7aa35b74835ee24c00f049d6292n
 }, {
-  a: "-8de89",
-  b: "c329fbab24d762a9453f90b134fcf5da9777aa1fdb26b74f27583a92a43f0f2c450",
-  r: "c329fbab24d762a9453f90b134fcf5da9777aa1fdb26b74f27583a92a43f0e9e5c7"
+  a: -0xade45eac6aaaf2c8097d7a3efecba4e80dd7aac4f692cfe841d113e68096c0218d521an,
+  b: -0x73c4119b366e22edd0797b5883a13e3bfc4124a559903ce785e0c833a8306b41cfn,
+  r: -0xade4d2707c4629362c6b4ab87a2428894c13a7061b3829787eb899c748ca6851f893e9n
 }, {
-  a: "-49af5f350d64c75047dfb107550dae478c983dd520e86c9807b1f5",
-  b: "60a62691669b8c323a29db2eb9cb75ba5811",
-  r: "-49af5f350d64c750477f0ae0c3a712bb5a5e13f9f22ea1224d59e4"
+  a: -0x6e9ab93d5cff3b3f31a55aa2f43fc321bff6978189e00fa4e64cn,
+  b: 0xec1caec29eb55312a313e50e20178873a350f1f89cbc971n,
+  r: -0x6e9aaa7b92131153dc743071b5eee120476f5d4c7ac085d91cdbn
 }, {
-  a: "80bf614aaa1140792099375f7fac9c7046303a8d13086755d505795f38761",
-  b: "-949dc945",
-  r: "80bf614aaa1140792099375f7fac9c7046303a8d13086755d50570155be1c"
+  a: -0x9a61c05bd53b74b731b8f8687e64d1ed1340404b5137ce39n,
+  b: -0x1e6793ea0fa51b2354b48n,
+  r: -0x9a61c05bd53b74b731b8f8687e66b86651e13a9d036d1981n
 }, {
-  a: "4241d736e6a40",
-  b: "-78e88f5eaeae4ff8b",
-  r: "-78e84d1cd7776954b"
+  a: -0x7c5a08517038f7dn,
+  b: 0x1d89f2n,
+  r: -0x7c5a08516e6058bn
 }, {
-  a: "-8033927bf52210827b99e712fb220631503adfaa4e0045c872b9b",
-  b: "-2f",
-  r: "-8033927bf52210827b99e712fb220631503adfaa4e0045c872bca"
+  a: -0xc4fd1b5aae2cfdc7b3ea6a74b7926a9a1ca3513bd08341e0c770080ban,
+  b: 0x76c79770202f9d9c6d2e244n,
+  r: -0xc4fd1b5aae2cfdc7b3ea6a74b7926a9a1c2c89a4606312432b02d9e76n
 }, {
-  a: "-3ad8b67efe9",
-  b: "-35586bf43788fd8e313da33c62d9a5",
-  r: "-35586bf43788fd8e314150c7cac98e"
+  a: 0xda114ddab6bfed910cc05c64f72961107beb98c3271n,
+  b: 0x98c52c393c6660663248fcbaa300b8n,
+  r: 0xda114ddab6bff71d5f83f02b5d2fc4350bb742f3329n
 }, {
-  a: "-a43d8c9af54e8ea545e1af4674613932650c833669c7adc9273b77",
-  b: "-6a4",
-  r: "-a43d8c9af54e8ea545e1af4674613932650c833669c7adc927421b"
+  a: -0x46311d926dfd26f0850ea3497fcd0d95a5dabab0361f219a601dc3dbe35d0n,
+  b: -0xf340af7b84e4eced2ca613e1ef4bb6aec4b8f01bc3n,
+  r: -0x46311d926dfd26f0851dd75477855be474ad8511743e1655cb0a0f6ae5193n
 }, {
-  a: "26c178e22dd42280a59b",
-  b: "fba77d85ba082981ce4a1ca21ac8b805b389297dc",
-  r: "fba77d85ba082981ce4a1f0e3256dae2f5b133d77"
+  a: 0xb2b4d9c0c73258a8092n,
+  b: 0xf4d1c3d2861cc0bfaea456c03b0f548a32effc1c3e1593935a6b0n,
+  r: 0xf4d1c3d2861cc0bfaea456c03b0f548a33a2b0f5fedcc5ec02742n
 }, {
-  a: "-c9bc2ac82920efc63fa48f63fae105ec432672b50269fad72ee8b44a1",
-  b: "8967d49deeff878f40fa1bf408400b8085820d47b",
-  r: "-c9bc2ac82920efc5b63cbac60be17e5d022c56c0fa29ef56a966a7026"
+  a: -0x56604879bdaaff7409cd59cfbafe73a74c284bfaeb991b6e11171bc08cf68bean,
+  b: 0xf4016a6e94c0f256af54fca00d6c909a620c6ea950c73cade3724174c12888n,
+  r: -0x556c470f4f163e81b31e04d31af10716b1c63f8c424854316333a97f18356362n
 }, {
-  a: "815a18c9a2d8c6e5f3fffa958430851c4ea3",
-  b: "59d451c6efad276d3cc393907dda0eca463488958f397bb09",
-  r: "59d451c6efad2f82de502dbe0a486e0a45dde0d8978b409ac"
+  a: -0x7a238c856c50aee41d1a2a1446a77f1567n,
+  b: 0x58n,
+  r: -0x7a238c856c50aee41d1a2a1446a77f150fn
 }, {
-  a: "8cfc360e8d215045cb5c289a50e5c7fa9da34c0b9d9be9597e6e476efdb121",
-  b: "-482747619f0edd06",
-  r: "8cfc360e8d215045cb5c289a50e5c7fa9da34c0b9d9be9115726e5cfeed41b"
+  a: 0xcdaf8c242e5da7265cc715871c3n,
+  b: -0x63604dd2b8df176c627ce3b018b2e74448746123d5578e66e9c0n,
+  r: -0x63604dd2b8df176c627ce3b00bd7ee82058e86b16f8b1d0e77fdn
 }, {
-  a: "346337dbb9bbfc08cb815434c50315d32d",
-  b: "-ac569f54f5ea8852463c7542e876a9953",
-  r: "299dcde66a5d5383a71d8ce0967bab39da"
+  a: 0xfa254e9c8d182d2bd90d8ff2b25d4e9819900b62b9ef60f3744ddc55cd362den,
+  b: -0x1fef80ff5d53dd0adaa75e8f0d16429851de115822n,
+  r: 0xfa254e9c8d182d2bd90d8df3ba4d58c2dbbf5db84406702210245737ec20abcn
 }, {
-  a: "8bb7c3e56",
-  b: "-c334d52ed6eb903256253e01fc0c5118fe9bc",
-  r: "-c334d52ed6eb903256253e01fc0bc5613ab66"
+  a: 0x3e85cn,
+  b: 0x687c558b2c1308c1a133d647ff7en,
+  r: 0x687c558b2c1308c1a133d64be7dan
 }, {
-  a: "b1f444a7a95e6d1d293ff0182e3dd5e945234484a5b47516b5b42627ed54fa8cf1221e",
-  b: "-93b77e906778b7e0a85c07e08babe730edd93ed37adef19da9e76de2add3",
-  r: "b1f444a7a8cab59e98d877604d9579e16497989d74c69bd7e23947364fab131f0e744b"
+  a: 0x9011db3dd56dbf2ef06154cbd48a67f6038483cff59f49011e57n,
+  b: 0xc033be10adcb6a7a5a697a7ef95ac3680611ff7ef690231314d338an,
+  r: 0xc03cbf2e61a8c1564d58809446180c0e857237c7338f7d07a4e51e1n
 }, {
-  a: "9a156524b9",
-  b: "-bce28d1561fc0153b836c6e0969d2674fcb960331cdb55df24e34e4b65136fcb59",
-  r: "-bce28d1561fc0153b836c6e0969d2674fcb960331cdb55df24e34e4acafe0aa6a0"
+  a: -0xefac02ab40df0f00a1b97a4n,
+  b: 0xc3b5e53656cd891e179ec3fb8a8d192f9bab5cfd76c014400n,
+  r: 0xc3b5e53656cd891e179ec3fb899d6d2cf06a7dee761e5ac5cn
 }, {
-  a: "5eaf418fbccefb4f53abc413c02cee60eb3880b615c615c2005b3d11c8ee4aaf3b4ded8",
-  b: "-eb8aa4a72cf44f06208",
-  r: "5eaf418fbccefb4f53abc413c02cee60eb3880b615c615c2005a518724471dbaec47cd0"
+  a: -0x7f9d48b408a5bb3827bc0149ecd538a2b2a7d4e1e0a4e9c36ee05f8be3a5b3n,
+  b: 0xd83d8cb2fb784703498cf0d61ff097ca42635664058cb85ea39f5931c37a1n,
+  r: -0x72196fe8d8ee36c7f323323c8ad62f260e819f7ba04c1e3d84a669f8c76e12n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a + b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a + d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: +");
diff --git a/deps/v8/test/mjsunit/harmony/bigint/and.js b/deps/v8/test/mjsunit/harmony/bigint/and.js
index e5c3b145d60..7a68f8b3dc1 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/and.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/and.js
@@ -7,96 +7,94 @@
 // Flags: --harmony-bigint
 
 var data = [{
-  a: "-193b47d0d9a8688b329e80de92195f311825",
-  b: "-2fabed9434bff933e23ea21af0f21a43",
-  r: "-193b6ffbfdbc7cbffbbfe2feb21bfff31a67"
+  a: 0x9252b94f220ded0c18706998886397699c5a25527575dn,
+  b: -0x286817ba2e8fd8n,
+  r: 0x9252b94f220ded0c1870699888639769185a045015008n
 }, {
-  a: "35979ec99b7ff03f81817ebc9ddd50025d1ccf41565b502f0fc85ec54f630",
-  b: "be96016cc031653c9b1eceb1dd",
-  r: "8c9401648000603c810c44b010"
+  a: 0x15a28152354fe421bbe4649d4d22d536ac34f9ba962n,
+  b: 0x8n,
+  r: 0n
 }, {
-  a: "-f594f8199c11594681a9c38fd985a03d8c79ce6c8d342809924c89b385af43116ec3a21",
-  b: "-53e7b9738caaecc58fde1b5a4aa9f782f28a04e2bb29d207ccd5d45",
-  r: "-f594f8199c115946d3effbffddafecfd8fffdf7ecfbdff8bf2ce8df3bfafd317eed7f65"
+  a: 0xd09791bf7ae6703fae8d654104f54fcd957bbf028540b8e7c0f859fdcc1b7abd617en,
+  b: 0x24b473d03n,
+  r: 0x24a052102n
 }, {
-  a: "dd7245d3ca5b360296082e6ca91915179b257f36e45e6e44cf892db875fdcfb19522b3",
-  b: "-dcc83137df3bb234e1144390f6c5bc0772a07f2a4540865554d20ebd37be",
-  r: "dd7245d3ca0336028000044c891801140b013a02e00c4e00c5882d3820a90db1000002"
+  a: 0x2f73fbd05e9f7f70beba3dc7cd883732149a3d02a422f90f336n,
+  b: 0x4490583f8n,
+  r: 0x9008330n
 }, {
-  a: "-28",
-  b: "eaec4017147fd9741ff3b98f1b6f71d8f3d6869c18b39c6237a6b2d4d2fc3c81e9",
-  r: "eaec4017147fd9741ff3b98f1b6f71d8f3d6869c18b39c6237a6b2d4d2fc3c81c8"
+  a: 0xd6ea27844b3d356774e73de10d393ab9cadb81848e3b4a34d1f7440d3n,
+  b: 0x1639eeee731f3ba09234b5e15ec92f8bfb5cea28a0e89c59ed1c45b5f04n,
+  r: 0x10ea26000b39200234a5214009290ab948ca008088184824104504000n
 }, {
-  a: "-223909fc585f36f995d6f72dd9f169df1fad8",
-  b: "b13e919ce59c18c7c0517eecdb2519155cc",
-  r: "80360184a0880042000052240a040000508"
+  a: -0x131f5e2c196269fd140c8727a9a02170e0dddb6aec109a89bcn,
+  b: 0x401ec4eae8b756f2b222f6f565fb6acecce3c524e9b453n,
+  r: 0x12c488800242f230005655448b0a0204810124613440n
 }, {
-  a: "-fcb4ac9fdc7ee85d03585f944a79b28efffb461e17df2d",
-  b: "13cd27fb49c92d53c567688ab6b9",
-  r: "38023b100492100042160882091"
+  a: -0x5bcba128bf7b949780a4bd02782a63ae79f646a33b8672f3f692ab98n,
+  b: -0xa81dd8ff624072fce3a00eb0bd5700e5666c3beb7d59701c42489n,
+  r: -0x5bcba1fdbfffb497afeebf02fb2bf7fe7ff666e3bfb7f7f7f7d6afa0n
 }, {
-  a: "-1a16ca8c3725cec0c8a61ce81",
-  b: "-dbf3e",
-  r: "-1a16ca8c3725cec0c8a6dffbe"
+  a: 0xc997546528786548270061bcn,
+  b: 0x75023f046c04f9095f64d3b8c75ab21950an,
+  r: 0x499014640838044023000108n
 }, {
-  a: "-834db45b67472062091e",
-  b: "5aff66623af6b6cd042a361d5a22aea03152b764a056c71",
-  r: "5aff66623af6b6cd042a361d5a228a2030408304a056460"
+  a: 0x5ad0abd6e43ef787248af2607fb29b9c3f7a1e7b106269ff3bn,
+  b: -0xd483c8630392db4b620e0f6n,
+  r: 0x5ad0abd6e43ef787248af2607fb29380394a06520040491f0an
 }, {
-  a: "1a8c37cff2e02f5272bc61d60b8301e443c38172446f75d75e01c41f60",
-  b: "e15d12bee18edaca77ad15ff0a567e132bb1b046623858",
-  r: "215012bc61860a8201a401c30052440321911000401840"
+  a: -0x9ed448bdb4794e4c0485db9ebe6cad0b0n,
+  b: -0x549a70753c9afn,
+  r: -0x9ed448bdb4794e4c0485df9efe7dbd9b0n
 }, {
-  a: "-f463",
-  b: "bb02038e2ff03fa",
-  r: "bb02038e2ff0398"
+  a: -0x3a3fe42647633612082372714484767efc9673ce964b76f9f53a63d5n,
+  b: 0x99615e5edd0506cbb5512fb56ee2dd1238bn,
+  r: 0x986116189800068881100b0000608c1000bn
 }, {
-  a: "3178f92d2eeee1aebc33f085aa96c9046f1133ad6afbd666664ab79625639e001",
-  b: "124d8bd8ea20d8e510ba30d9",
-  r: "20d02406020586010382001"
+  a: -0xac1b8238c08f5n,
+  b: -0xb9439dfbbc70e12b3a1fc7ccbfebeacd9bb321d83d3an,
+  r: -0xb9439dfbbc70e12b3a1fc7ccbfebeacfdbbb23dc3dfen
 }, {
-  a: "fc7aaaa7a52f3604e1e700f01ea6f266912f583bffa78aee08939401056cde",
-  b: "-50e3611d6ada075f432319f10c8192f1de56ead628972",
-  r: "fc7aaaa7a52f3604e0e100e008025202010d4820ef2782c00012900005648e"
+  a: 0x120580503n,
+  b: 0x90e13d34618496af407fabefabdd23892f488n,
+  r: 0x20100400n
 }, {
-  a: "7dea10c67bdf023c00d94643e9f2d38295635b0b2b55a0e40818",
-  b: "8defe4741785c6c2d2ecaf7752a903ed",
-  r: "443e0701380844252082b5500a00008"
+  a: 0xaa51cn,
+  b: 0x2122a9c43b2531d5n,
+  r: 0x2114n
 }, {
-  a: "6f837e0ec2d00abb60051299bfd36b58c803f6445f91bb8dded858c6c1c476142",
-  b: "-26746eda5ca5095ab8f315c88b201cfa2affbbb700fc3bba8626b5bfd0a",
-  r: "6f837e08829000a3400400010cc22350c80304440000088d02c04040c14040042"
+  a: 0xaf43eb353c1547dc6ad79768e9a6n,
+  b: 0x55c80f89d8fe82dbf69eca557dd0479b6a449db77e38b2241ec81aa7d4042766dd3e63n,
+  r: 0x28022014081007d4000706482822n
 }, {
-  a: "ab69c286138358dea4308b60f12f212fcd1e0",
-  b: "-c8735b6ce5513cc661fdae7941055028a2ea768dc13b9c83a79b9bf84e62cdf",
-  r: "aa29c2041181501e84200840602401218d120"
+  a: 0xbd38b2d88212ceea6fbe3890769e46236n,
+  b: 0xeb22e568873e9bfdb5d2ddbc03n,
+  r: 0x88202468863a83890540c42002n
 }, {
-  a: "6c9ec2e7cdb2c1fb630a8e16323138db939c2a21e3576b777d",
-  b: "-51cf93f77a711c00",
-  r: "6c9ec2e7cdb2c1fb630a8e16323138db938c202000050a6400"
+  a: 0x24cd8c9634eddf319c57b54dffb49ce4974528f03b2c732d052ad496n,
+  b: -0x4079cfn,
+  r: 0x24cd8c9634eddf319c57b54dffb49ce4974528f03b2c732d052a8410n
 }, {
-  a: "edee34cd0c29ad27fed12e77a42aedbf8b53161716c90d516394b9038a2f125c95",
-  b: "-18a515e3705a582d82f14bd42075b3b",
-  r: "edee34cd0c29ad27fed12e77a42aedbf8b52140600c8085061049003022d100485"
+  a: -0x61f263476a1212fce55cf7d437f4364b73a1815a641n,
+  b: -0x19226cb79772cca166043a29d1f0fe1df5n,
+  r: -0x61f263476b9236fffd7fffde37f477ebffbf8ffbff5n
 }, {
-  a: "466fee7dabecbaea71c19892f045d7d196a80c6f",
-  b: "-5c93c7afd552be",
-  r: "466fee7dabecbaea71c19892f001441010280c42"
+  a: -0x44309b08a65bc7dc1e53d598d82ccdaa852941d7c851d907a6acn,
+  b: 0xdd93dc17d38658ee30453d5f27en,
+  r: 0x5d1304178102408230402d05054n
 }, {
-  a: "-657c587f67a70177797befb96f116c2843",
-  b: "-c3b8e2",
-  r: "-657c587f67a70177797befb96f11efb8e4"
+  a: 0x1e3eea4668e7a6c3bfa87d3f7a419bd18an,
+  b: -0x592d83940f884f9n,
+  r: 0x1e3eea4668e7a6c3bfa86d274201035102n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a & b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a & d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: &");
diff --git a/deps/v8/test/mjsunit/harmony/bigint/as-int-n.js b/deps/v8/test/mjsunit/harmony/bigint/as-int-n.js
index faa7dba866f..51b5073d240 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/as-int-n.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/as-int-n.js
@@ -284,9 +284,7 @@
   assertEquals(4294967296n, BigInt.asUintN(2**32, 4294967296n));
   assertEquals(4294967297n, BigInt.asUintN(2**32, 4294967297n));
 }{
-  assertEquals(
-      BigInt.parseInt("0x7234567812345678"),
-      BigInt.asUintN(63, BigInt.parseInt("0xf234567812345678")));
+  assertEquals(0x7234567812345678n, BigInt.asUintN(63, 0xf234567812345678n));
 }{
   assertThrows(() => BigInt.asUintN(2n, 12n), TypeError);
   assertThrows(() => BigInt.asUintN(-1, 0n), RangeError);
diff --git a/deps/v8/test/mjsunit/harmony/bigint/basics.js b/deps/v8/test/mjsunit/harmony/bigint/basics.js
index 398d670ca89..99a9403db0f 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/basics.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/basics.js
@@ -197,6 +197,28 @@ const six = BigInt(6);
   // Multi-digit BigInts.
   // Test parseInt/toString round trip on a list of randomly generated
   // string representations of numbers in various bases.
+
+  // Userland polyfill while we wait for BigInt.fromString (see:
+  // https://mathiasbynens.github.io/proposal-number-fromstring/ ).
+  // This intentionally only implements what the tests below need.
+  function ParseBigInt(str, radix) {
+    const alphabet = "0123456789abcdefghijklmnopqrstuvwxyz";
+    var result = 0n;
+    var base = BigInt(radix);
+    var index = 0;
+    var negative = false;
+    if (str[0] === "-") {
+      negative = true;
+      index++;
+    }
+    for (; index < str.length; index++) {
+      var digit = alphabet.indexOf(str[index]);
+      assertTrue(digit >= 0 && digit < radix);
+      result = result * base + BigInt(digit);
+    }
+    if (negative) result = -result;
+    return result;
+  }
   var positive = [0, 0,  // Skip base 0 and 1.
     "1100110001100010110011110110010010001011100111100101111000111101100001000",
     "1001200022210010220101120212021002011002201122200002211102120120021011020",
@@ -273,28 +295,12 @@ const six = BigInt(6);
   ];
   for (var base = 2; base <= 36; base++) {
     var input = positive[base];
-    assertEquals(input, BigInt.parseInt(input, base).toString(base));
+    assertEquals(input, ParseBigInt(input, base).toString(base));
     input = negative[base];
-    assertEquals(input, BigInt.parseInt(input, base).toString(base));
+    assertEquals(input, ParseBigInt(input, base).toString(base));
   }
 }
 
-// .parseInt
-{
-  assertEquals("hellobigint", BigInt.parseInt("hellobigint", 32).toString(32));
-  assertEquals("abc", BigInt.parseInt("101010111100", 2).toString(16));
-  // Detect "0x" prefix.
-  assertEquals("f00dcafe", BigInt.parseInt("0xf00dcafe").toString(16));
-  // Default base is 10, trailing junk is skipped.
-  assertEquals("abc", BigInt.parseInt("2748junk").toString(16));
-  // Objects are converted to string.
-  let obj = {toString: () => "0x12345"};
-  assertEquals("12345", BigInt.parseInt(obj).toString(16));
-  // Empty and invalid strings throw.
-  assertThrows("BigInt.parseInt('')", SyntaxError);
-  assertThrows("BigInt.parseInt('nope', 2)", SyntaxError);
-}
-
 // .valueOf
 {
   assertEquals(Object(zero).valueOf(), another_zero);
diff --git a/deps/v8/test/mjsunit/harmony/bigint/comparisons.js b/deps/v8/test/mjsunit/harmony/bigint/comparisons.js
index 513ff37d00a..38150c74bfd 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/comparisons.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/comparisons.js
@@ -429,8 +429,8 @@ const six = BigInt(6);
   assertFalse(%Equal("-0x1", minus_one));
 
   const unsafe = "9007199254740993";  // 2**53 + 1
-  assertTrue(%GreaterThan(BigInt.parseInt(unsafe), unsafe));
-  assertTrue(%LessThan(unsafe, BigInt.parseInt(unsafe)));
+  assertTrue(%GreaterThan(eval(unsafe + "n"), unsafe));
+  assertTrue(%LessThan(unsafe, eval(unsafe + "n")));
 
   assertThrows(() => %LessThan(six, Symbol(6)), TypeError);
   assertThrows(() => %LessThan(Symbol(6), six), TypeError);
@@ -508,10 +508,10 @@ const six = BigInt(6);
   assertFalse("-0x1" <= minus_one);
 
   const unsafe = "9007199254740993";  // 2**53 + 1
-  assertFalse(BigInt.parseInt(unsafe) < unsafe);
-  assertFalse(BigInt.parseInt(unsafe) <= unsafe);
-  assertTrue(unsafe < BigInt.parseInt(unsafe));
-  assertTrue(unsafe <= BigInt.parseInt(unsafe));
+  assertFalse(eval(unsafe + "n") < unsafe);
+  assertFalse(eval(unsafe + "n") <= unsafe);
+  assertTrue(unsafe < eval(unsafe + "n"));
+  assertTrue(unsafe <= eval(unsafe + "n"));
 
   assertThrows(() => six < Symbol(6), TypeError);
   assertThrows(() => six <= Symbol(6), TypeError);
diff --git a/deps/v8/test/mjsunit/harmony/bigint/dataview.js b/deps/v8/test/mjsunit/harmony/bigint/dataview.js
new file mode 100644
index 00000000000..c34a42ac1da
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/bigint/dataview.js
@@ -0,0 +1,78 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-bigint
+
+var buffer = new ArrayBuffer(64);
+var dataview = new DataView(buffer, 8, 24);
+var bytes = new Uint8Array(buffer);
+
+var b1 = 0xff1234567890abcdefn;
+var b1_64 = BigInt.asUintN(64, b1);
+
+dataview.setBigInt64(8, b1);
+assertEquals(0x12, bytes[16]);
+assertEquals(0x34, bytes[17]);
+assertEquals(0x56, bytes[18]);
+assertEquals(0x78, bytes[19]);
+assertEquals(0x90, bytes[20]);
+assertEquals(0xab, bytes[21]);
+assertEquals(0xcd, bytes[22]);
+assertEquals(0xef, bytes[23]);
+assertEquals(b1_64, dataview.getBigInt64(8));
+
+dataview.setBigInt64(8, b1, true);  // Little-endian.
+assertEquals(0xef, bytes[16]);
+assertEquals(0xcd, bytes[17]);
+assertEquals(0xab, bytes[18]);
+assertEquals(0x90, bytes[19]);
+assertEquals(0x78, bytes[20]);
+assertEquals(0x56, bytes[21]);
+assertEquals(0x34, bytes[22]);
+assertEquals(0x12, bytes[23]);
+assertEquals(b1_64, dataview.getBigInt64(8, true));
+
+dataview.setBigUint64(8, b1);
+assertEquals(0x12, bytes[16]);
+assertEquals(0x34, bytes[17]);
+assertEquals(0x56, bytes[18]);
+assertEquals(0x78, bytes[19]);
+assertEquals(0x90, bytes[20]);
+assertEquals(0xab, bytes[21]);
+assertEquals(0xcd, bytes[22]);
+assertEquals(0xef, bytes[23]);
+assertEquals(b1_64, dataview.getBigUint64(8));
+
+dataview.setBigUint64(8, b1, true);  // Little-endian.
+assertEquals(0xef, bytes[16]);
+assertEquals(0xcd, bytes[17]);
+assertEquals(0xab, bytes[18]);
+assertEquals(0x90, bytes[19]);
+assertEquals(0x78, bytes[20]);
+assertEquals(0x56, bytes[21]);
+assertEquals(0x34, bytes[22]);
+assertEquals(0x12, bytes[23]);
+assertEquals(b1_64, dataview.getBigUint64(8, true));
+
+var b2 = -0x76543210fedcba98n;
+dataview.setBigInt64(8, b2, true);
+assertEquals(0x68, bytes[16]);
+assertEquals(0x45, bytes[17]);
+assertEquals(0x23, bytes[18]);
+assertEquals(0x01, bytes[19]);
+assertEquals(0xef, bytes[20]);
+assertEquals(0xcd, bytes[21]);
+assertEquals(0xab, bytes[22]);
+assertEquals(0x89, bytes[23]);
+assertEquals(b2, dataview.getBigInt64(8, true));
+assertEquals(0x89abcdef01234568n, dataview.getBigUint64(8, true));
+
+assertThrows(() => dataview.setBigInt64(0, 1), TypeError);
+assertThrows(() => dataview.setBigUint64(0, 1), TypeError);
+assertThrows(() => dataview.setInt32(0, 1n), TypeError);
+assertThrows(() => dataview.setUint32(0, 1n), TypeError);
+
+// None of the stores wrote out of bounds.
+for (var i = 0; i < 16; i++) assertEquals(0, bytes[i]);
+for (var i = 24; i < 64; i++) assertEquals(0, bytes[i]);
diff --git a/deps/v8/test/mjsunit/harmony/bigint/dec.js b/deps/v8/test/mjsunit/harmony/bigint/dec.js
index 5e1f40b2dda..ddb0431cba7 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/dec.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/dec.js
@@ -7,74 +7,73 @@
 // Flags: --harmony-bigint
 
 var data = [{
-  a: "-609648ccf253976b12f6b6c8e20790c17ef6b89ea9f536267783607cf465b1ca",
-  r: "-609648ccf253976b12f6b6c8e20790c17ef6b89ea9f536267783607cf465b1cb"
+  a: 0x26ffcdbd233a53e7ca4612f2b02e1f2c1d885c3177e7n,
+  r: 0x26ffcdbd233a53e7ca4612f2b02e1f2c1d885c3177e6n
 }, {
-  a: "-6e4c39cdd2c666e32cf2fd3c53a20eeb725e7578af97d42",
-  r: "-6e4c39cdd2c666e32cf2fd3c53a20eeb725e7578af97d43"
+  a: 0xf2a29a35193377a223ef0d6d98db95eeb24a4165f288fd2b4an,
+  r: 0xf2a29a35193377a223ef0d6d98db95eeb24a4165f288fd2b49n
 }, {
-  a: "34c93e1c",
-  r: "34c93e1b"
+  a: 0x454d22e29e6104n,
+  r: 0x454d22e29e6103n
 }, {
-  a: "-db3032",
-  r: "-db3033"
+  a: -0xb00874640d30e6fce6bf79508378ed17e44dacb48a4200bce536cec462b3c2n,
+  r: -0xb00874640d30e6fce6bf79508378ed17e44dacb48a4200bce536cec462b3c3n
 }, {
-  a: "8e658ffacbefbdec5",
-  r: "8e658ffacbefbdec4"
+  a: 0x4c151a24d765249c2bab4a1915b24b80ae437417c5n,
+  r: 0x4c151a24d765249c2bab4a1915b24b80ae437417c4n
 }, {
-  a: "-d321033ec94d6a75f",
-  r: "-d321033ec94d6a760"
+  a: -0xcbd476b1f9ca08ff820941n,
+  r: -0xcbd476b1f9ca08ff820942n
 }, {
-  a: "-286017f718d6118b581ec4357e456ce6d12c01aed9a32ff0cc048d",
-  r: "-286017f718d6118b581ec4357e456ce6d12c01aed9a32ff0cc048e"
+  a: -0xe848e5830fa1035322b39c2cdd031109ca8n,
+  r: -0xe848e5830fa1035322b39c2cdd031109ca9n
 }, {
-  a: "c0",
-  r: "bf"
+  a: -0x4d58c5e190f0ebac5bb36ca4d214069f69726c63a5n,
+  r: -0x4d58c5e190f0ebac5bb36ca4d214069f69726c63a6n
 }, {
-  a: "9f9577e008a6f46f7709f71362176ebe23d19eb9e58a41de6f2631b18f2ca",
-  r: "9f9577e008a6f46f7709f71362176ebe23d19eb9e58a41de6f2631b18f2c9"
+  a: 0x9b396n,
+  r: 0x9b395n
 }, {
-  a: "-9d4294590df0aa8ea46a5c2a3d186a6afcc00c6ebb072752",
-  r: "-9d4294590df0aa8ea46a5c2a3d186a6afcc00c6ebb072753"
+  a: 0x593921fe8b9d4906cn,
+  r: 0x593921fe8b9d4906bn
 }, {
-  a: "-4bc2aed1641151db908c0eb21aa46d8b406803dc0f71d66671322d59babf10c2",
-  r: "-4bc2aed1641151db908c0eb21aa46d8b406803dc0f71d66671322d59babf10c3"
+  a: -0xe127928c7cecd6e9ca94d98e858f9c76a0fccac62203aac7710cef1f9e352n,
+  r: -0xe127928c7cecd6e9ca94d98e858f9c76a0fccac62203aac7710cef1f9e353n
 }, {
-  a: "-1dfb3929632fbba39f60cabdc27",
-  r: "-1dfb3929632fbba39f60cabdc28"
+  a: 0xeb14cd952d06eb6fc613016f73b7339cbdd010n,
+  r: 0xeb14cd952d06eb6fc613016f73b7339cbdd00fn
 }, {
-  a: "c0d409943c093aec43ba99a33ef2bb54574ecdc7cccf6547ab44eafb27",
-  r: "c0d409943c093aec43ba99a33ef2bb54574ecdc7cccf6547ab44eafb26"
+  a: -0xfdeab6a3dbd603137f680413fecc9e1c80n,
+  r: -0xfdeab6a3dbd603137f680413fecc9e1c81n
 }, {
-  a: "3d148dcffe94f859c80b38c4",
-  r: "3d148dcffe94f859c80b38c3"
+  a: -0x7e9abbdfad170df2129dae8e15088a02b9ba99276a351a05n,
+  r: -0x7e9abbdfad170df2129dae8e15088a02b9ba99276a351a06n
 }, {
-  a: "0",
-  r: "-1"
+  a: 0x7b98f57n,
+  r: 0x7b98f56n
 }, {
-  a: "d659f6507e0ac2e653bdb7c3fb38c1514dd33619a9a0c87fcb69b22",
-  r: "d659f6507e0ac2e653bdb7c3fb38c1514dd33619a9a0c87fcb69b21"
+  a: -0x919751deb470faa60d7c5c995c8bed72f9542d710fbbf1341n,
+  r: -0x919751deb470faa60d7c5c995c8bed72f9542d710fbbf1342n
 }, {
-  a: "14efe",
-  r: "14efd"
+  a: -0xc5541d89b118a88afdd187228440427c8a24f9d9bn,
+  r: -0xc5541d89b118a88afdd187228440427c8a24f9d9cn
 }, {
-  a: "-f2df301948cd17ff391a6589a67551c00679687ba5",
-  r: "-f2df301948cd17ff391a6589a67551c00679687ba6"
+  a: -0xe6c88a170595fn,
+  r: -0xe6c88a1705960n
 }, {
-  a: "-e",
-  r: "-f"
+  a: -0xa1ffbfa388c332804dc4dc973n,
+  r: -0xa1ffbfa388c332804dc4dc974n
 }, {
-  a: "-a09cf77fea7af1767695c978af13fdb62f4f040b6fb803625fb124cc99139cddadd",
-  r: "-a09cf77fea7af1767695c978af13fdb62f4f040b6fb803625fb124cc99139cddade"
+  a: 0x67b768ce0c415127a77402861d1901dd7f60a8624ebea6ecafe03adc3cen,
+  r: 0x67b768ce0c415127a77402861d1901dd7f60a8624ebea6ecafe03adc3cdn
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var r = --a;
-  if (d.r !== r.toString(16)) {
-    print("Input:    " + a.toString(16));
+  var r = --d.a;
+  if (d.r !== r) {
+    print("Input:    " + d.a.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     error_count++;
diff --git a/deps/v8/test/mjsunit/harmony/bigint/div.js b/deps/v8/test/mjsunit/harmony/bigint/div.js
index 771a0c7fda5..1eeea1184ff 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/div.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/div.js
@@ -7,96 +7,94 @@
 // Flags: --harmony-bigint
 
 var data = [{
-  a: "c0bb18527ab19a800932cc14c553c69688372809dde38f095fdb99478a7eba",
-  b: "8137ebc482f361a3e43fb80fe2ba509caa3f0acc62be0d2",
-  r: "17dd3b8ecbdd71a4"
+  a: -0x1e0f357314bac34227333c0c2086430dae88cb538f161174888591n,
+  b: 0x390n,
+  r: -0x8700f00dd65d4009ab90c5d3a887e9c8ad110a72ca7e0f84a40n
 }, {
-  a: "10c5163e874c786fcfcb48bbb0ccf8d6c66f480b76332194",
-  b: "4e462b2",
-  r: "36d8ca96869a7226d456bff9b5ed3effdcaaf6f83"
+  a: 0x9b7a0098fd2d495b4b2c76ff5888ae2a0359cfec6b029e6f3ee9b014802n,
+  b: 0xbn,
+  r: 0xe225d252e49ef6563ecc4fff0c69b782ed99e89db2ec895bfe6b2ea974n
 }, {
-  a: "-677f8c8668fcc826129f2724a5b88a6225dd19959810b5254afbc0",
-  b: "-2bf8ff1c49636",
-  r: "25a8bd406d721554f45ad37cc691d58821ad163f3a"
+  a: 0x6821a6dad136b9f64096337b45d6d947cf0f0b55501e33e66fbc4ef9776n,
+  b: 0xan,
+  r: 0xa69c3e2ae8578ff06756b8c53c8af53fb1b1abbbb363863d7f93b18f25n
 }, {
-  a: "e80276ba7d416f4f7e5f8917529eb204cc7ed08413261e73aa23f169eb46e7162",
-  b: "-c884f07a",
-  r: "-12834073e7cbc44804a99cb2778fb82b098645946d5e4f5e6c47c49267"
+  a: 0xf42f96f0c7f5a9c656a66122a9bcc57aa386bdb9a834e4174d45795ae408dae14e085cn,
+  b: -0x5e0d81a1107ef9a38b4f24b4n,
+  r: -0x298a4d479eac8c186fd61939024b420080b6ae6500c70c1n
 }, {
-  a: "-f9a51f64ce995e0a1c7f8369a573dae2533bc3df801edbb79235d41502e1ce",
-  b: "-f33bf",
-  r: "106bf522569501704f9700d6bfcd203a606e63725e339e92ff931f568f"
+  a: 0xbaf7baed984dda3c20f23201f366257c601f7fbcaf51d8b738a68fd92b4n,
+  b: 0xd24a1eafcn,
+  r: 0xe39bd4d870d72880e6ad88ec17bcca6bd0eaacfbbd28ba7458n
 }, {
-  a: "-6c9ae08dfa5b11c29ae30e53c108d915e0e87f1a8ca82f42d23a53b08895",
-  b: "-43fd79afe1ae6a4994ee7dfc2c89453d6b6",
-  r: "198ecd667e8cca17c2839b38fe"
+  a: -0xa658d0683d450bfec3de3fe4253f4348dd8e9a5b1002f6c24ff0en,
+  b: -0xeffb9a6fa690e0be59aba488b7a7c5a85a65a018242n,
+  r: 0xb1730d7206n
 }, {
-  a: "-d20a2f7074ecbc776b64c2e04ff007e194b8cdd106b2be2e78d752f2d16e9",
-  b: "43eb8ae7d7f9be6d77e3be696ffef",
-  r: "-317ab1a09014950e1c53b9e3e8f44873c"
+  a: 0x5a65f7b2dace4550099f4009192caa513468ef4da7e2fd81n,
+  b: 0xf144f8bfad42d9beaf7b82a46561n,
+  r: 0x5feae36e8e4932adcb21n
 }, {
-  a: "-999e0f75f2f652d403840cea3536b1a522433a331dace7c39d7990b993908fdd6",
-  b: "cea1de74020232c6c4bedca49d63f140c",
-  r: "-be51ac62c073e7d7cb9e43fc12436bfe"
+  a: -0x87271b0cbb63eba5e3d70f6af1aa6ec60c0a7884fb8d657b03en,
+  b: -0xb67f8c18099ce8fa0c0f4ce2852b5590f7a8037d326b0n,
+  r: 0xbd9602n
 }, {
-  a: "1b49ac0c323436294f1471a3f00feb197b9b42549c3",
-  b: "5a7e30888a22fbbcecfe2a0b2e5eca30",
-  r: "4d321e8fe1c"
+  a: 0xd4bc42a434dba1427d387f0858aaf39c6281ffc0f10b8b0996cb3bfn,
+  b: -0x4198d1fec9b48e38d42f2e295abc39c2a6866527efn,
+  r: -0x33e39b6878d955n
 }, {
-  a: "-689adf0d332ed26c63f8f361d5cb66056321b683ce87c60567df7305396f20d6ab8",
-  b: "82f3b92f5bb57811fdb66f519",
-  r: "-cc7e64b9ef239ac4c31b6ae3687aa181bda7657222"
+  a: 0x6a6f0c97d974dfd20337ca611dbdc96433964a206d54n,
+  b: 0x16c7c6f9e0e4e24d521e463fecb394e2936f3104590n,
+  r: 0x4an
 }, {
-  a: "-6fecb457f9e05c15b7fe038494c25053938d4747a01577cf2dc939a21e",
-  b: "b7cb6ce62c1d7483d0b675109f5782a1ad19",
-  r: "-9be52d2e94716bb441dbcd"
+  a: -0xd09af7515272d81a64307afaed8854c8e2996d8e01d4864n,
+  b: 0x7521dfcbdf4cfbbf8d3859bf67618c91dc6915718303dbn,
+  r: -0x1cn
 }, {
-  a: "f96f8276f314d37657ce7774bc539198ee84fcec8a53cbb3d36ad81040b715",
-  b: "-891c9a0dd99b02",
-  r: "-1d1b803e3484173c0d2e8add5042117eaa27c853c222f5fdd"
+  a: 0xf0da5f24832a2b651aac5dff62b22475212c26e123ff78c34560f35e9bcn,
+  b: -0xf9n,
+  r: -0xf79fbd51bf65f518c82563b974e4632b505ebe13adbfb6c297859a98cn
 }, {
-  a: "-d2c9a9068d57f2ebc9ad432b48b4135f2a911519d4b791",
-  b: "-a34d124b5b4825d314683098d0",
-  r: "14a715b96671307438926"
+  a: 0x76f4f5b5de8a263514554d62273e51f40342d5df692ae17625ead5b5fen,
+  b: -0xa5e697c57fb65858604e0a060737e7d9d1en,
+  r: -0xb78fb2167de210959e57cd3n
 }, {
-  a: "-59593d55f61c1c739601e15624fe2e61592fe6abf1ecb238c9f8e1a7bded9c1bd1c",
-  b: "f067a5a155fc894b0f7f0a939f1772c4d135a",
-  r: "-5f250867331e7eff64dafcd58e9922"
+  a: -0xa714d4d9d747fa5258f80f3887f4dda8a11423050046282n,
+  b: -0xaa3b218ab92e21920a707487fdbn,
+  r: 0xfb437487ba8580181ca3n
 }, {
-  a: "2c0a3172494623013ba14d01433ad38167f365765b1c0ca610",
-  b: "ffe8",
-  r: "2c0e52ca0c37483000215020c64d6ac36a455bf6fa4382"
+  a: -0x165f3c659ac4157cb3af081b3fc42c0c788e2df501596c2b8n,
+  b: -0xfaa86d6eca3n,
+  r: 0x16d94bce4865cf842d17a399d8b4467f3f369fn
 }, {
-  a: "-a9cde7cdfe56eb8bd6777543ae714fadac2d97a394d8e9e8",
-  b: "104b0d7135d3d2",
-  r: "-a6bfb9031e60b5bc4b20e814cabfd80bd27"
+  a: 0x268d93a21aab44c52f961b1c97c002f427eb8b11e0707e3879c3a348f8e2b1c40c122n,
+  b: 0x70ccda2e2bba53b124c877bb4edbdbd387742cfe59d9bn,
+  r: 0x577effaeb2338647e38edb43n
 }, {
-  a: "6216ceed0d221476bfba7701f8297af56a4e66d003f8165b",
-  b: "bfcaaf8676ad6a",
-  r: "82ed6efc83669b0bc476bdd717dcfb6f10"
+  a: 0x3a13493c9e8d3d986a2a56c0aa811be408e1560f30ae155n,
+  b: -0x62a1a35fd7e184be45a1d0ba67888f0d982afb7a90an,
+  r: -0x96bcn
 }, {
-  a: "-707752a899efbe8989d205293535a404a6afb39cf21ce1274",
-  b: "-3a24848be1024a6ea901f",
-  r: "1ef2f2a8c0ad85ff4e6e6afdd3966"
+  a: -0x2a3f3f90ea280bf64e7e460f004ea4fb2553637cb7c844f349f045ffdbn,
+  b: -0xf2af2581bddfd9bfc1158c86211c4f4b169c0b1n,
+  r: 0x2c90ab8577b8d0ee86en
 }, {
-  a: "-e662fb8c46f979ff3b3f576fffd5c51cf70071ab61168b2eafee4708af",
-  b: "964c4dd019b9a543df0cd1830a90428ec84ec04f8165283",
-  r: "-18869d87ce54"
+  a: 0x8fd5f992d4d767c8a360ad32142fa9e9d87bc0036d1d6bb7aa7471dd7f38bn,
+  b: 0xe70n,
+  r: 0x9f6709805e05fd8b3c433e470387f06391b6948459e4c2bc072747e2a0n
 }, {
-  a: "b4403dee3a192009a5aae85c74efdb52b66dee1be6befa66f708ca9bf6b7",
-  b: "-36db9f9f6e",
-  r: "-34928ce65c2b71a6b6ce351838d4263d91ff2bceecec7a91441"
+  a: 0x52c0e08ba0a22a00498058dfeeaab2b21909e81e30c48652699n,
+  b: 0x1d516c96827an,
+  r: 0x2d2967f58654a5d30934348b225bf2b6e2a3123dn
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a / b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a / d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: /");
diff --git a/deps/v8/test/mjsunit/harmony/bigint/exp.js b/deps/v8/test/mjsunit/harmony/bigint/exp.js
index 5a4601134ff..54d5849373f 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/exp.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/exp.js
@@ -4,6 +4,15 @@
 
 // Flags: --allow-natives-syntax --harmony-bigint
 
+assertEquals(1n, (-1n) ** 0n);
+assertEquals(-1n, (-1n) ** 1n);
+assertEquals(1n, (-1n) ** 2n);
+assertEquals(-1n, (-1n) ** 3n);
+assertEquals(1n, (-1n) ** 4n);
+// Multi-digit exponents.
+assertEquals(1n, (-1n) ** (2n ** 80n));
+assertEquals(-1n, (-1n) ** ((2n ** 80n) + 1n));
+
 assertEquals(1n, 0n ** 0n);
 assertEquals(0n, 0n ** 1n);
 assertEquals(0n, 0n ** 23n);
diff --git a/deps/v8/test/mjsunit/harmony/bigint/inc.js b/deps/v8/test/mjsunit/harmony/bigint/inc.js
index 64865a2b325..4ead89e1bf4 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/inc.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/inc.js
@@ -7,74 +7,73 @@
 // Flags: --harmony-bigint
 
 var data = [{
-  a: "-989c298c6fc3",
-  r: "-989c298c6fc2"
+  a: 0xb3df90n,
+  r: 0xb3df91n
 }, {
-  a: "bff2c86c449a56",
-  r: "bff2c86c449a57"
+  a: 0xaacd53fc9545eb394304a3c69caba730230a6527730an,
+  r: 0xaacd53fc9545eb394304a3c69caba730230a6527730bn
 }, {
-  a: "-6fb15264369b63e3b92d6f74458140d4b62a56ecbfca000492b6b8a0c56c651ebaecdd1",
-  r: "-6fb15264369b63e3b92d6f74458140d4b62a56ecbfca000492b6b8a0c56c651ebaecdd0"
+  a: 0x32efa4ba1c29098be7df8fa0f3c74a183612ecn,
+  r: 0x32efa4ba1c29098be7df8fa0f3c74a183612edn
 }, {
-  a: "e161f6284b91fa2646dc0f162c575bb8a0d0f5bfee26748b7181413567",
-  r: "e161f6284b91fa2646dc0f162c575bb8a0d0f5bfee26748b7181413568"
+  a: -0xcabed06f63ad50406b96187208cf9ec6faf46413ce83e280c31ben,
+  r: -0xcabed06f63ad50406b96187208cf9ec6faf46413ce83e280c31bdn
 }, {
-  a: "-4d073653cc812",
-  r: "-4d073653cc811"
+  a: -0x8a40ce58f753466f4008faa0814e76d9b594908df0e42cf6ad4a781e60ce2n,
+  r: -0x8a40ce58f753466f4008faa0814e76d9b594908df0e42cf6ad4a781e60ce1n
 }, {
-  a: "-ce31549364717dea9d1bf30baed642f",
-  r: "-ce31549364717dea9d1bf30baed642e"
+  a: -0x848c8fc23bc93801n,
+  r: -0x848c8fc23bc93800n
 }, {
-  a: "2ae123a62361f1de2cc5ca9cfd9658f47d",
-  r: "2ae123a62361f1de2cc5ca9cfd9658f47e"
+  a: -0x13a8316c5af3f3b06aab6642e717a7bdn,
+  r: -0x13a8316c5af3f3b06aab6642e717a7bcn
 }, {
-  a: "-4820298153b7bbd86337ad72e0d1ac7448de99bc6ce4c43c2",
-  r: "-4820298153b7bbd86337ad72e0d1ac7448de99bc6ce4c43c1"
+  a: -0x5f5e517cf7efe577cd689c36d1beb3d9df4cfdc3fcb55ed9e9d8fan,
+  r: -0x5f5e517cf7efe577cd689c36d1beb3d9df4cfdc3fcb55ed9e9d8f9n
 }, {
-  a: "2e",
-  r: "2f"
+  a: 0n,
+  r: 0x1n
 }, {
-  a: "-8f3b598ac2ab8a78a2d3e1f7ab1124b05a830aa1261bf57d8de2a",
-  r: "-8f3b598ac2ab8a78a2d3e1f7ab1124b05a830aa1261bf57d8de29"
+  a: 0x107d5ec8048c4d715e213ec74f9f04006d3f2d90dd95d17c3e82f7a4ccn,
+  r: 0x107d5ec8048c4d715e213ec74f9f04006d3f2d90dd95d17c3e82f7a4cdn
 }, {
-  a: "-5c070fdee0d3f4a9adc63",
-  r: "-5c070fdee0d3f4a9adc62"
+  a: 0xb8e09fc6037a75bbfn,
+  r: 0xb8e09fc6037a75bc0n
 }, {
-  a: "-3700cd6a6d1e68de1",
-  r: "-3700cd6a6d1e68de0"
+  a: 0x515d1b999660074184n,
+  r: 0x515d1b999660074185n
 }, {
-  a: "56c68c",
-  r: "56c68d"
+  a: 0xe12def67dc33628638612b8137d0fa425ea2dn,
+  r: 0xe12def67dc33628638612b8137d0fa425ea2en
 }, {
-  a: "-1ab894376fcf0dab9c",
-  r: "-1ab894376fcf0dab9b"
+  a: 0x96a9n,
+  r: 0x96aan
 }, {
-  a: "-937dcf37c57588e55260c3eea20318",
-  r: "-937dcf37c57588e55260c3eea20317"
+  a: -0x9df122a299a5e65b275028n,
+  r: -0x9df122a299a5e65b275027n
 }, {
-  a: "-f8ee63b438580a8915baf84edcfd0688247905e593e153644a88761bab0",
-  r: "-f8ee63b438580a8915baf84edcfd0688247905e593e153644a88761baaf"
+  a: 0x20dd05bfb5ed6ebfb05da9a7488800b8895fbfe6d709eecb6071cda73e13n,
+  r: 0x20dd05bfb5ed6ebfb05da9a7488800b8895fbfe6d709eecb6071cda73e14n
 }, {
-  a: "-c63d4353ddf575bf02",
-  r: "-c63d4353ddf575bf01"
+  a: 0xb38294d2e5523534c56dd6ef38ba744b29e3a3bb6f863f1aeaen,
+  r: 0xb38294d2e5523534c56dd6ef38ba744b29e3a3bb6f863f1aeafn
 }, {
-  a: "-bef439cc990a8b1d69b80fa7b3c703ba2",
-  r: "-bef439cc990a8b1d69b80fa7b3c703ba1"
+  a: -0x6b58de4ba9b2699ea6777dc1adc0b2486n,
+  r: -0x6b58de4ba9b2699ea6777dc1adc0b2485n
 }, {
-  a: "6007edbd20b0ba90d86cf80e871e898c8907bb37",
-  r: "6007edbd20b0ba90d86cf80e871e898c8907bb38"
+  a: 0xf40028a48894df5d81131046477a22e55cbead5n,
+  r: 0xf40028a48894df5d81131046477a22e55cbead6n
 }, {
-  a: "-692b36b5e874a448415678ac2b4d0a61c75bdc1674ae14d753cad7d46846",
-  r: "-692b36b5e874a448415678ac2b4d0a61c75bdc1674ae14d753cad7d46845"
+  a: -0x44cbe6c7f5e7e879d3cb2eaffc4af0a43affc094218031a1f123746549dd7b8cdcbdn,
+  r: -0x44cbe6c7f5e7e879d3cb2eaffc4af0a43affc094218031a1f123746549dd7b8cdcbcn
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var r = ++a;
-  if (d.r !== r.toString(16)) {
-    print("Input:    " + a.toString(16));
+  var r = ++d.a;
+  if (d.r !== r) {
+    print("Input:    " + d.a.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     error_count++;
diff --git a/deps/v8/test/mjsunit/harmony/bigint/mod.js b/deps/v8/test/mjsunit/harmony/bigint/mod.js
index c310e2d3b40..c8cc7fa4fd2 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/mod.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/mod.js
@@ -7,96 +7,94 @@
 // Flags: --harmony-bigint
 
 var data = [{
-  a: "-67c2a5ba4221c048b64ecca6dd979391c44296b8b87ce97584ebab03be18",
-  b: "-bebdbd9b278d05704416fd87d09aece9b69f98843",
-  r: "-8794ba5d9204eb8adfb5e44c11a65fe5af057e6a4"
+  a: 0xaed3c714bb42a73d708bcf1dc9a9deebadc913ef42bac6a6178a60n,
+  b: -0xf3d6bd1c059b79n,
+  r: 0x2a4f893c8ece3n
 }, {
-  a: "-843cfbe576106b8e7c0aabec2cde402e7f76a711dbbf6ae79d6d932e22cf",
-  b: "553d800ffcf69f80026",
-  r: "-272250d344908c21525"
+  a: -0x8a6d8cb8e32aba50e08fd50aecbda6821e1863bf9a2n,
+  b: 0xe19ab8530bce542ec6b4c848fc383a2b688f07976dd523dabn,
+  r: -0x8a6d8cb8e32aba50e08fd50aecbda6821e1863bf9a2n
 }, {
-  a: "-b5fc9e8e21fbad798bcd3571ab169dd5e2059d1a9aa4d1bf44fe18da725b",
-  b: "-da5d287414fbb2b4b",
-  r: "-2610eb2277e01a758"
+  a: 0x7cd19a308b217ddd9dcda69ebe37767f09a483cb87060314aeade6f6c619d27c3n,
+  b: 0xae30b5c754e0an,
+  r: 0x619154797565dn
 }, {
-  a: "a9c92d42b53a6fbf0824f5b7bd9ed1cab1f9419d7ec2b50f192abfa6d620d53",
-  b: "9de30592e1fe27d26afe06bbb4781c77ef58418",
-  r: "9a67af5868a619a48883aed4c0d0a876e2ce143"
+  a: -0xaa90d777e849974d7ebebd2ed76dce635e36713e9e0c97cen,
+  b: 0xcc2bc7239bf83ecafc74b25750981df258n,
+  r: -0xa32d47bc250c5a41d147a862099778685en
 }, {
-  a: "ffa271b138163a779c89f17aa720490854520120b1307ef",
-  b: "ab27ef49f3a00085981a5bc1c13530aec35e29c",
-  r: "4c49a63b98d2dd7a33a843f98ba82b54909e337"
+  a: 0x7386178fe1159c4ca3c4e5caa6eda4413926047efd22007931c22ab54bn,
+  b: 0xc05100caa704bca144n,
+  r: 0x55ead7f83d4a795753n
 }, {
-  a: "d43f739464bcc8643dfaa807cbbe1157189e33368dd19b800db3682bb0dcb73",
-  b: "bf66b1dc93054920039f9b3eba688d9",
-  r: "bb2f3000959d66b3962d755d141c3ac"
+  a: -0xa48867cf46692351a59bc89c0ddc9a6d2cd9f72578c0bab72d8389n,
+  b: 0x77c2eec6cc0bef33dd4756b223c35a0f2b528f8648a7n,
+  r: -0x184a6eed8fcd32399c59605c7255b5614b388be24b44n
 }, {
-  a: "111ae5ba62ec37fd157ef531195363c5c8ace4427ff58811746af94ab8",
-  b: "58112d0d88f3c8722d1e28942e8949c433c4619b451",
-  r: "283276aa2b6316ca2146b1e6bcc8aa8de4b5446847a"
+  a: 0xac7681c26f78191107c9cde47f984fc7ffb7bffd0a055fc14n,
+  b: -0xe2d91d1a0e1edc3f806a24c36f7ca0a8a9b44b66c9n,
+  r: 0xdf0b3460335089fca0b1da676b3d1e9caf15afd3den
 }, {
-  a: "-4609a1c7d563bbdb49fd01e05031395e6e06b78407e440",
-  b: "-75ee71f85344163bae2ba0e438",
-  r: "-68b517938971cb261babea1cf8"
+  a: -0x3035011f4adba0c032ddc2fc884ff7663b45cb3baebec0fn,
+  b: 0xcc27f9a21470911a61aae50ae118ebcf85ea4dn,
+  r: -0xc5ea1db5af95ccdce2844b13b82659be1ac2adn
 }, {
-  a: "292cd2c5eb3e80942066c5af8bfdaf8d1d091f61f3005d226318",
-  b: "5",
-  r: "3"
+  a: -0x2dbe79c42b1e8db7aea4ca9cfaf1350528b096e23f69ea322cn,
+  b: -0x82f7e4f2ee432485n,
+  r: -0x824bddbaf61ce383n
 }, {
-  a: "-a9f8c03f06200b54959a2ced325090be25417f0bf1274d",
-  b: "13eb3a0c772fc98e537883a3ef72e1ee37b249ee17c0510",
-  r: "-a9f8c03f06200b54959a2ced325090be25417f0bf1274d"
+  a: 0xc5c7fbeb60fdb9f8e8347ebf9fe303e3223394b2db93ce2n,
+  b: 0xcd988b4cb278a39fd3ae58c16616855f01fab0fb0n,
+  r: 0xc3b5157e680c8ca66df1bd640c6ad1601bd612b02n
 }, {
-  a: "c4ddadae9abee150068fe6536c6b2fe229070410da61a09abe1a7270b",
-  b: "5f4d55e3345e37fe8887f3ca5e",
-  r: "42eea65dd545aacdcd250b505b"
+  a: 0x73dd1e27450edb450fe4bd70494a8ad85a8ad9691bc40bf500a1n,
+  b: 0xc8fb467f71be8a6b965d21857ecfdn,
+  r: 0x646e6d9fa1e2eb2933b2e5a837d37n
 }, {
-  a: "-7a73d61e639dacedd207dfe1edc630b1dfda9078489a7f0cf79dcdfcbf3992efc13861f",
-  b: "-c0f2b9045bb3865d89cc0c9920c3ccfae382c250",
-  r: "-6bdc3d5943d7a35e4ecbc5c8deb335ca2c3bbc0f"
+  a: -0xecb217583ec4240399bfa34560b45f1fd08efd0ebb56b2dn,
+  b: 0xeba34abn,
+  r: -0xc2d347bn
 }, {
-  a: "-a9ac4a2e055f22c8ba7956ffca5457a71412eb74d3a180555bb25ce5096e23d6c619",
-  b: "-f3c",
-  r: "-a5d"
+  a: 0x29c8a9854802b9317b90683eb82609b3aa695598807fea0482a56567n,
+  b: -0xabe5e55b228f8n,
+  r: 0x52303615b525fn
 }, {
-  a: "-b16cfd7fbbf820afc77be1590fd9802ecd12059238b98bb96d9d215af4808",
-  b: "2c288a9de167",
-  r: "-2b3901c1b8d1"
+  a: 0x7b532ee90b3945dbed20180632f46c90d0edb558e39456103f50e5a74ff1dn,
+  b: 0x17n,
+  r: 0x6n
 }, {
-  a: "-df12dd3e56dc3c3dd769ad964f8356a5860177f1b4a3b95acc75",
-  b: "4ec6f5474b18",
-  r: "-17bf0980582d"
+  a: -0x6f1dbf8dedea796a2423fad9688d71340963da3a4f005f13e9cd4aa03b96c864552cn,
+  b: -0x408a4f36ec4a1b74642fb0a4559en,
+  r: -0x33c06c53e6e47ca87f36447f1b0n
 }, {
-  a: "1d197bf4aa09a02760cb004e9edf25e6591ae14d92b6cbf1349ea1c040d66",
-  b: "-23ebacc5f380e5649a1234c3ed050472569cbcd056",
-  r: "20e5e588b4861be3ec7b4005a6a50566e60a3a4364"
+  a: -0xe77508ff49bc76c78678676ca1edc82eb167f3b07d3208d89d26582ef74d60n,
+  b: -0xf005fb1a8b29035c72980abe4a0715c90n,
+  r: -0x159e8c7616079663b4e12765a05cc6d40n
 }, {
-  a: "fab19b7e774bf33bb42a7af90d8dc75cbc927e3225003610c05b117c25c90944d",
-  b: "-3b433469282a54d46cac",
-  r: "10eda9e98b721b4a2505"
+  a: 0x626749ef019017f53b2c686f26594e6d3c5f247cf0ed7024cca277n,
+  b: 0x5bd931ea8c6939115ad69f6ce3c6bbc300320n,
+  r: 0x3a4b041c36d0a45ef932745eab473943b1a97n
 }, {
-  a: "5b19514660782d3a2429d7791659868abb9d8fc96077247",
-  b: "-59188be60",
-  r: "2340c3607"
+  a: -0x960dde134b881d3366d659c7d8c3eb6346f50c08c6f78en,
+  b: -0xc9e7fa60f6ce1997012f5a6164138447fa248754985905dc6n,
+  r: -0x960dde134b881d3366d659c7d8c3eb6346f50c08c6f78en
 }, {
-  a: "-2884ed1401b5e976be7dc1faf7bffb632c808649fa75ab458cc66ef4e75",
-  b: "bf",
-  r: "-40"
+  a: 0x702dc0033e09e9e58ec3fc96f861587ad13cea1ed7b7eb301n,
+  b: 0x71f0c97687b4f3318be2fe54b90273n,
+  r: 0x4e1859254ac1d42f7c812decef00a3n
 }, {
-  a: "-4c9cdf26be1797e54480ab20797e35d04941c11ff78b040c00099422cec",
-  b: "ee20f34835529f4a73",
-  r: "-e24db40426d47f968b"
+  a: 0x39376649769a0abb26133deee934330ef21a2f90ea89476569630021af6023235n,
+  b: -0x4aaaec4085f65ccc9d547beb122160afcbb3n,
+  r: 0x3027d5ebb37c5aa438f11dfcafa3b003b91bn
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a % b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a % d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: %");
diff --git a/deps/v8/test/mjsunit/harmony/bigint/mul.js b/deps/v8/test/mjsunit/harmony/bigint/mul.js
index 83a67007682..c6a9ae61489 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/mul.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/mul.js
@@ -7,96 +7,94 @@
 // Flags: --harmony-bigint
 
 var data = [{
-  a: "-be5e349bf5ad48e7a5d",
-  b: "a47a19a48667620a82973579739e08c64651b3ede2c578ff975e",
-  r: "-7a4f25aa8725368922062fc91a110352a660657ffb3a489126ded10ccd29d929120c926"
+  a: 0x2bf1f236c2df29f7c99be052dfe1b69ae158d777fea487af889f6259f472c0n,
+  b: -0xae0090dfn,
+  r: -0x1dde8b7f987479d7b308e2b8a122703d417f921fd4ab04fcac81439ace4f445c7bf540n
 }, {
-  a: "912d5d85aec5ec6caf90514f0ec005f711caac82960c0ee911ef30f145107ae236783e6",
-  b: "0",
-  r: "0"
+  a: -0x71cd629b6682b5b1c50f9436ded88468bcn,
+  b: -0xb24ce1d11726048158fb42c02e9361973193n,
+  r: 0x4f42fbebca0bc1746d114996d9c9cceb4065c347da31dc0efa88db41f1f724aef81ff4n
 }, {
-  a: "-87c17f6930bdef7e7c7ae7dab8be3baa2e7d67",
-  b: "285af6503c42d077a0d59558deb170bad",
-  r: "-1566788db7747e33ddb6540190617b57856e5f3924447f9f400f34a9aa75aa7d20f2b9b"
+  a: 0xef7c15fb2256338bd0650fa51c28551108ccb9828850f1b415d0c8f1a47fc0e2f86n,
+  b: 0xc17n,
+  r: 0xb4f552dbf2c20292f5475d025276b9c70f16316c91e0a9a2833bf2d616bc484f808d0an
 }, {
-  a: "-3d0fd72abc5fb82d5cf45679812b71",
-  b: "-3c537c742e17c5fac136e33f5e7edf256ef52b6df",
-  r: "e63a0402966391e13e600371183f223379b66912ee706a2b369668b3e33e9a15992d6f"
+  a: 0xcc8a5a56c623d9f9be2103bc237976f26n,
+  b: 0x13a02fec7cfd49c5a081c06bbbaac5c70dc3an,
+  r: 0xfae417740ef1963ad78aa4252159d986593845690f4f5fe759f6d913d79810473d69cn
 }, {
-  a: "dfd77cf4b0d071df2487c9b77959ee027380a159b0",
-  b: "-56300fb05cba28d5150892ff66e77",
-  r: "-4b5c6a1976d3a318cb9f93e154dc362da4e740fa31d82baefead60c355bfea99eaa50d0"
+  a: -0x519n,
+  b: 0x7de5551df3ec2619a89139153663a79f8bdb47047423c8070d7cfddc26d43af8ee9n,
+  r: -0x281c60ee5b06ece38cc4c4bfd2242017c4ff0cd05b40a66abf3c22a1741efe09ef81c1n
 }, {
-  a: "-bea52261387bb2aaf8c61b5ee7bbf85b3bbbedfe60773ed9873cbceba078d3fecbb",
-  b: "-2ad7",
-  r: "1fe73453d2eabb331a676ede8eb9759c8c6bffe09c76947578e08b0152379841d867f0d"
+  a: 0x6fb9ba0d0n,
+  b: -0x86b45ffb80fbf2b61abc14b28855780f83e187fd6ae26e09d28d6f05260e1n,
+  r: -0x3ac9efdd4e930fcbf654819060b858f182f7768db6bc72deb8d734d2ea10fa02b656d0n
 }, {
-  a: "5b5a3a047d8f7e1519d6d92d3241c0f32c4d789",
-  b: "-4bd3e8c09b0ba71bc25416877a4c7135",
-  r: "-1b0f0d6ba20fe60049c4a172e8b1fb9824c1e85e21f1ebe08556b7074d8d4f4ac90185d"
+  a: -0xde2e7a0883a63d69d2120108f92943e4a34b63e8468c12b38a0519a6498n,
+  b: -0xb1857781fefn,
+  r: 0x9a11f83db6da31f78a2415d3891f79a0f6aafc69553fb458a2bc3ae2e2f65cb09251e8n
 }, {
-  a: "1b2c8263d4bac8cc825657f81fca6196799aff00fa960d5c04",
-  b: "-6b140fca30c8037b18d88",
-  r: "-b5dbba6fba700592408e2ebbba2d4c6557d61d1201e24314f690e77c0b59c68d8b1620"
+  a: -0x2c90284ebdb5237ba7c9562f596ef9a21254a3n,
+  b: -0xb55feab8b45cc1bcdcfc5585c9114de0n,
+  r: 0x1f929eda8d33ec2ded8d76382a4cb731f805d28e827521a27154b6618a6f87ed5215a0n
 }, {
-  a: "dd74f1f92ab5b9e0b447b7fe9076f7",
-  b: "-9dbb0acb24e6336fe4f37f8e942d1d5c22dfe4f34",
-  r: "-88728628dd4ed79514e720448e4f9ad422ba6ca62cd61bf779cfb3cb12afb5bbe20632c"
+  a: 0x11ffe68d26ca29eac43b64n,
+  b: -0xe3311b278fec1fb3f8f59acfd9147c773197fc54c66b25bdn,
+  r: -0xff95d530fd53e61744d86d09f9ab5401b1efb2133af5c47ffeca31aca22a4da414cd4n
 }, {
-  a: "-e97d2712832aa20a",
-  b: "-cb98c0fa9b4b35fc7a4ebed6d3d106bb758c244eb756c75587300ad",
-  r: "b9b1904d502a19d20cc7bd8e05670f667db817bb9104ef8acc747f3df6541eede4d80c2"
+  a: 0xbda74de44eeb2995a4185325014863n,
+  b: 0xf99164c7248a0372d72d82cbf65fdb345c84bca6n,
+  r: 0xb8e3712f119fefa47168950100b33aa1ec4e61a970d0eec2d2dd4b925cc4dfd709a432n
 }, {
-  a: "828ca2d8981f347f4bec14ba",
-  b: "-8ce5b6b1c329477a0a728ed81331af1f03e3eaa1ccb2cb3",
-  r: "-47da0e06c179e58b3e5d8abc4a2b274ede3a7d73c0b5fcb3690f0b544ed6c0b7120760e"
+  a: 0x47fc0bb6d761e12a1f7cf2a14f4cc777486b22516ca339641fn,
+  b: -0xd2fa2494ae242494f307n,
+  r: -0x3b531808ad9095f9f904dba47ef4a0aef54f736cc2836accb7b1b70f07ee862e8729d9n
 }, {
-  a: "aade382f2483a571e12cb1796bd124e21c6014261cef5d733a1b35fb01db7232c5b",
-  b: "-d34a",
-  r: "-8d068c8b18b90f6aaf82ed3260f68bdb06bf64613cdda736fc33395b7d16688edb9d34e"
+  a: 0x91d09f35203fcf69974d347ab718912cn,
+  b: 0xfc2d9a00611e4e1767b67db898b951e5d2bbb9n,
+  r: 0x8fa3561bff2cc00a780a71e5b16d6092296514d401c88fc54e04a91062775cb4e40cccn
 }, {
-  a: "34188043594e64ac10b37923ad29b4b536a4098ce76c9133155820b7843de95af",
-  b: "106952",
-  r: "356f6c0aa4a1a0d27dd2e8867420eddcd9fb5614450d6bb85cba0071e03e4563a0b90e"
+  a: 0x5a5b1ede360dafcac08c92f4b809e401502df5ab8569303a2n,
+  b: -0xb64d963b1ac4eb46ddd65n,
+  r: -0x40582a6083cd0feb5b33ac138feaf9250b5084e561807e56a8415c810a1bf9861d48ean
 }, {
-  a: "96b2a125fc041fe36aebe7dfd02a4f56b90",
-  b: "-a9f9c57a732002abf0764868f297442f61d1",
-  r: "-640ef4605c38f6643d60526833e7a3b7b71a72b7042434abc0ca600e7f79b3aa98e6090"
+  a: 0xf68275dc25d6af7dde130n,
+  b: 0xfe330b766e44f479e342e3315812e977d4d5e39bffe42111dn,
+  r: 0xf4c697f78dc7c9b3207b50cf2cf3035aa065e96c37c0be3345f71f34096f057e76b270n
 }, {
-  a: "-ae8327a77a340d2c90c93bb0ebe02d7a77d7c2a4e8d21a21d0",
-  b: "268a49068f2769f949d95",
-  r: "-1a45bc5e1b636b28bf716dfeaf0599cd932270796233adf7d58b8d72d06ac580c323e10"
+  a: 0x77009ed053f71n,
+  b: -0x647aecfc2af4079a586fbba99070c3f51d5465d9a4fd8c12cdab10854n,
+  r: -0x2eb5627edb1072a65a1db2d243d0bf2eeb5c3ff6ad61ec1063e9ee40b783bd06d55914n
 }, {
-  a: "-a0adcb953540a4f25fc97a40a2c9285bfba7e70e4ffc",
-  b: "fff2302a069e8f69d00e529a81b",
-  r: "-a0a5204f09eeb3ecd9fe2c6de34d0e0ed70c6d1589d95fd83de33d921a3152dfe5bcf94"
+  a: 0xccfa15bb6125b01bece5a919ab5e9128e784d63e50b5990ba8047a7effn,
+  b: 0x1a366ac48cdan,
+  r: 0x14fcf8728aa3dc5ef26b077dfc012d592c3a0cdfc3331942f921f037eea5af9eff9926n
 }, {
-  a: "-83771467194c5b612539be7228f366a8",
-  b: "9412ce8f98510486287bc15c35883fff04d126e",
-  r: "-4c0a803e9a079742969e01dbb7990566b2f5ac9658653c967b5d295f6a996ba1655ec30"
+  a: 0x4fc54a59f2n,
+  b: -0x93bbcbd684987407c4ec4a3cbdc7c4821c33ca20ca8449b0055905e9a8ffn,
+  r: -0x2e08ce533fdc7bb8a3a2280cfb116c85837b74606ed25f8daad623baa4ac7de758680en
 }, {
-  a: "12c3327d3d7ed4b3180cc301f98d351804451be431137fa48aa67627db867a2cd",
-  b: "-ee0af6",
-  r: "-11724697fa94a9caafbee6e7b778ecae17ed7ebba5575296b1fc4995a12fe5c9a8872fe"
+  a: -0xcf21626f318089a85738f7e9cdcf0a477f4d880ce58679n,
+  b: -0xc7ca8704a49fdb8f9567c68cn,
+  r: 0xa1a6d11a77d8e1b723bfa0242407a454274145c31bb6ede29bb0e3883b08951b36202cn
 }, {
-  a: "-5",
-  b: "-a00c8e774e3d4a6fc2fa384382720700e49e3e4b882bb5c4c0dbe4cdcd92126731128b",
-  r: "3203ec8548732742ecee319518c3a230477173779a8da8cd7c44b780503da5c03f55cb7"
+  a: 0x20c3cb19e51d4e2ac2c89f26e052bef8n,
+  b: -0xab2a148297108425ebd2fd17d897f647e0792fn,
+  r: -0x15e82b69a0eaed04cd140c6aed3b1f5bc0fc5de7ceddcb2d77615767b19dd82c744788n
 }, {
-  a: "a0a4dc9610ada50dfa633ad910a02aa20c85",
-  b: "-4d7aa1dc1cc1d1767b4e25a839e7c177652",
-  r: "-309e8a7c10fbc6b50f6ad012099765a35395b9d51112d50e0a8f3ac076942a9e5a0509a"
+  a: -0xcc4f48f45d8165569348fb995370n,
+  b: 0x140cc111df0a06e32335478ded744eb3a737a53409n,
+  r: -0x10005f808c07a1d91faac090aad06804b491919a9d2ed58f6caa52448ad97bd486aef0n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a * b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a * d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: *");
diff --git a/deps/v8/test/mjsunit/harmony/bigint/neg.js b/deps/v8/test/mjsunit/harmony/bigint/neg.js
index 8cec9cc21b4..2fedf297a52 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/neg.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/neg.js
@@ -7,74 +7,73 @@
 // Flags: --harmony-bigint
 
 var data = [{
-  a: "58ad59aa3aa9d04d4c12493966e204ef0500d5f92ecb31",
-  r: "-58ad59aa3aa9d04d4c12493966e204ef0500d5f92ecb31"
+  a: 0xcn,
+  r: -0xcn
 }, {
-  a: "6dbd19e4b781a8f113ae95738dda4b70ba027755052126c198d20ade97869ff",
-  r: "-6dbd19e4b781a8f113ae95738dda4b70ba027755052126c198d20ade97869ff"
+  a: -0x5a3d0f6cdb7987a2d262838c05359f786a484d052529n,
+  r: 0x5a3d0f6cdb7987a2d262838c05359f786a484d052529n
 }, {
-  a: "d02befb1c96364a984664f85",
-  r: "-d02befb1c96364a984664f85"
+  a: -0x98d8c6cbfd67b6b652b7a4670478f6706e06a3n,
+  r: 0x98d8c6cbfd67b6b652b7a4670478f6706e06a3n
 }, {
-  a: "86",
-  r: "-86"
+  a: -0xe66ac692ff012bd0f4ca38804628f71ff411aede09c59597n,
+  r: 0xe66ac692ff012bd0f4ca38804628f71ff411aede09c59597n
 }, {
-  a: "0",
-  r: "0"
+  a: -0x97e1e0c13c0c0c420aca92268ea802047c30570335de0000dn,
+  r: 0x97e1e0c13c0c0c420aca92268ea802047c30570335de0000dn
 }, {
-  a: "-f8da",
-  r: "f8da"
+  a: 0x6b2eddc3b212913abed4f5c84e3eee64d6463224dff8n,
+  r: -0x6b2eddc3b212913abed4f5c84e3eee64d6463224dff8n
 }, {
-  a: "2b0f358b54a82fbaddc5a6e61a5d",
-  r: "-2b0f358b54a82fbaddc5a6e61a5d"
+  a: -0xfcd42a712dd928deb51ab2d151fa6bee0f4dd2fa6n,
+  r: 0xfcd42a712dd928deb51ab2d151fa6bee0f4dd2fa6n
 }, {
-  a: "-3d32065b9bbb36ee521ff82da",
-  r: "3d32065b9bbb36ee521ff82da"
+  a: -0x75ba8e0e92a05ff552f2dc3afb39a4dn,
+  r: 0x75ba8e0e92a05ff552f2dc3afb39a4dn
 }, {
-  a: "ca3da934e8081c457933c90",
-  r: "-ca3da934e8081c457933c90"
+  a: 0x4570376e541836fab5190e08an,
+  r: -0x4570376e541836fab5190e08an
 }, {
-  a: "-e4d2bbdf90affad1d2a",
-  r: "e4d2bbdf90affad1d2a"
+  a: 0x15aca33cfb06n,
+  r: -0x15aca33cfb06n
 }, {
-  a: "-290845e8f55d467e3",
-  r: "290845e8f55d467e3"
+  a: 0x7ec0027910c44b791bf193c6f25487a9435n,
+  r: -0x7ec0027910c44b791bf193c6f25487a9435n
 }, {
-  a: "-771c77d2dd2227c30cf44f1bf3230",
-  r: "771c77d2dd2227c30cf44f1bf3230"
+  a: -0x31f0d92f358618e6b29a2899bd988533838d33839fb37n,
+  r: 0x31f0d92f358618e6b29a2899bd988533838d33839fb37n
 }, {
-  a: "-77aa11",
-  r: "77aa11"
+  a: 0xb4f84118d797244c982f1n,
+  r: -0xb4f84118d797244c982f1n
 }, {
-  a: "d220c8af9c97516bf5ec295585f711e020480d08ac11689726a285930",
-  r: "-d220c8af9c97516bf5ec295585f711e020480d08ac11689726a285930"
+  a: 0x626n,
+  r: -0x626n
 }, {
-  a: "53841e699f994e1a43f7f848f34d418792191de15b78e1a852c430b2f8af6e7",
-  r: "-53841e699f994e1a43f7f848f34d418792191de15b78e1a852c430b2f8af6e7"
+  a: 0x9f35c8968457d07608699df5894c0542f35b73b0b5ce8423aan,
+  r: -0x9f35c8968457d07608699df5894c0542f35b73b0b5ce8423aan
 }, {
-  a: "7c30187b8901bd748adc4bc243",
-  r: "-7c30187b8901bd748adc4bc243"
+  a: -0xb5be1f7937895adc457f051d1f4bc74d556b432dn,
+  r: 0xb5be1f7937895adc457f051d1f4bc74d556b432dn
 }, {
-  a: "-e07ac5649eb741a023b0f9928d5982032f6766a479c7fbf26",
-  r: "e07ac5649eb741a023b0f9928d5982032f6766a479c7fbf26"
+  a: 0xcacb413b3cab5a5f5086511728d1afbaa82ca41e69805daf47503e2n,
+  r: -0xcacb413b3cab5a5f5086511728d1afbaa82ca41e69805daf47503e2n
 }, {
-  a: "5ab3237bb32234bcaf8",
-  r: "-5ab3237bb32234bcaf8"
+  a: -0x77ef7cbb15cee20a519a1n,
+  r: 0x77ef7cbb15cee20a519a1n
 }, {
-  a: "7df7",
-  r: "-7df7"
+  a: -0x71ac9bfe7f5f70038c7fn,
+  r: 0x71ac9bfe7f5f70038c7fn
 }, {
-  a: "-518b7b",
-  r: "518b7b"
+  a: -0x500a02b8fd66ee1067022c02c7241acdc42b947bfb933aa95a8d6n,
+  r: 0x500a02b8fd66ee1067022c02c7241acdc42b947bfb933aa95a8d6n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var r = -a;
-  if (d.r !== r.toString(16)) {
-    print("Input:    " + a.toString(16));
+  var r = -d.a;
+  if (d.r !== r) {
+    print("Input:    " + d.a.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     error_count++;
diff --git a/deps/v8/test/mjsunit/harmony/bigint/not.js b/deps/v8/test/mjsunit/harmony/bigint/not.js
index 7ceaa01e631..6b4b2eb713d 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/not.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/not.js
@@ -7,74 +7,73 @@
 // Flags: --harmony-bigint
 
 var data = [{
-  a: "3d02c87edc77722299f6559ecca038911f864a4e78c20af80f4a6d9",
-  r: "-3d02c87edc77722299f6559ecca038911f864a4e78c20af80f4a6da"
+  a: 0x9f0305cd75e4n,
+  r: -0x9f0305cd75e5n
 }, {
-  a: "ac01894aeaf77255ede209897561ec1e3c7e916b9",
-  r: "-ac01894aeaf77255ede209897561ec1e3c7e916ba"
+  a: -0xe8e9c8312f553c9n,
+  r: 0xe8e9c8312f553c8n
 }, {
-  a: "-7aaab657ab197f26eb6b98fe4c2c79b199a8156129ca04",
-  r: "7aaab657ab197f26eb6b98fe4c2c79b199a8156129ca03"
+  a: -0x1a29f0783a66534da3c024ad1cc854073f886888fen,
+  r: 0x1a29f0783a66534da3c024ad1cc854073f886888fdn
 }, {
-  a: "9718579cc52befdaff1ec035b5ed03cec5c1d1678c28712cf0c9bec2c807897b74f0",
-  r: "-9718579cc52befdaff1ec035b5ed03cec5c1d1678c28712cf0c9bec2c807897b74f1"
+  a: -0xfc2cc19496c1ced95be832ca5246d41c526b9fa28b88bcd39813aa336n,
+  r: 0xfc2cc19496c1ced95be832ca5246d41c526b9fa28b88bcd39813aa335n
 }, {
-  a: "e614366bc4e67509843254c52e13da5380b00a35aa1d233e70821f7d649ad1957db",
-  r: "-e614366bc4e67509843254c52e13da5380b00a35aa1d233e70821f7d649ad1957dc"
+  a: 0x13ebn,
+  r: -0x13ecn
 }, {
-  a: "fb815f78e6952b500226c",
-  r: "-fb815f78e6952b500226d"
+  a: 0x4c12d642b2a132f0c927ec7504b530fb45d5e249163ffdc59feb3de31881n,
+  r: -0x4c12d642b2a132f0c927ec7504b530fb45d5e249163ffdc59feb3de31882n
 }, {
-  a: "94404df802649cff2ea6c0996f55ec60c14f00ab29b287092389951f6227c4ec7",
-  r: "-94404df802649cff2ea6c0996f55ec60c14f00ab29b287092389951f6227c4ec8"
+  a: 0x49637a624cb8782002e3e0874ad76215e188cee948c7ce7b0f66e1d0n,
+  r: -0x49637a624cb8782002e3e0874ad76215e188cee948c7ce7b0f66e1d1n
 }, {
-  a: "-74b42cd7bccd",
-  r: "74b42cd7bccc"
+  a: -0x81cbae84e6753b885ada46c0bf72368c083fed622fn,
+  r: 0x81cbae84e6753b885ada46c0bf72368c083fed622en
 }, {
-  a: "da",
-  r: "-db"
+  a: -0xcdf793acfdd08b6n,
+  r: 0xcdf793acfdd08b5n
 }, {
-  a: "3a9ade198",
-  r: "-3a9ade199"
+  a: 0x88n,
+  r: -0x89n
 }, {
-  a: "56e766d24fd18c2241f244dedc426c0b1ae59e7ed4f06def0a75e0a5c8651e2ce87928",
-  r: "-56e766d24fd18c2241f244dedc426c0b1ae59e7ed4f06def0a75e0a5c8651e2ce87929"
+  a: -0x1fn,
+  r: 0x1en
 }, {
-  a: "cc430c91347b22ecb1a6f1a2ceea168ffa4a9b80065bd1ec5d",
-  r: "-cc430c91347b22ecb1a6f1a2ceea168ffa4a9b80065bd1ec5e"
+  a: 0x5c3278e76266b9e93d63eb4f2aa53716220aa1n,
+  r: -0x5c3278e76266b9e93d63eb4f2aa53716220aa2n
 }, {
-  a: "32e4b7f82d8c037d0f562296e21b1e58a",
-  r: "-32e4b7f82d8c037d0f562296e21b1e58b"
+  a: -0x9f4fe05n,
+  r: 0x9f4fe04n
 }, {
-  a: "-526d3f1a904561f0cde1f0a2a4",
-  r: "526d3f1a904561f0cde1f0a2a3"
+  a: 0xdn,
+  r: -0xen
 }, {
-  a: "3de5a9635a40539831c9665577e5eedbf680755e2065a0caa346759e17225",
-  r: "-3de5a9635a40539831c9665577e5eedbf680755e2065a0caa346759e17226"
+  a: -0x74a9d63d02bd1393b311211e35c8b2d11e2367ffffb812683365f02d98n,
+  r: 0x74a9d63d02bd1393b311211e35c8b2d11e2367ffffb812683365f02d97n
 }, {
-  a: "-d912828b8d6419900",
-  r: "d912828b8d64198ff"
+  a: 0x8a2831ae3e1b6b21a7b3d7ee921a0c0edf29b272d654f647169a5a6141d3aaf41439n,
+  r: -0x8a2831ae3e1b6b21a7b3d7ee921a0c0edf29b272d654f647169a5a6141d3aaf4143an
 }, {
-  a: "-17968ddf93",
-  r: "17968ddf92"
+  a: 0xa2ef28270a7e668e190bc303537f5a8ba3f0d59bcn,
+  r: -0xa2ef28270a7e668e190bc303537f5a8ba3f0d59bdn
 }, {
-  a: "-c2bfd766e34923d549bbaedb4d9b7bb35a61908e6144462a",
-  r: "c2bfd766e34923d549bbaedb4d9b7bb35a61908e61444629"
+  a: -0x4f8bd11ee4ef38682a0c94en,
+  r: 0x4f8bd11ee4ef38682a0c94dn
 }, {
-  a: "af426ec83aaafc84a94930e51a2899696a3d",
-  r: "-af426ec83aaafc84a94930e51a2899696a3e"
+  a: 0x5436d0721d1282755068add3b5ab5424cb455fad50811a9afff0be5n,
+  r: -0x5436d0721d1282755068add3b5ab5424cb455fad50811a9afff0be6n
 }, {
-  a: "-283de5b9379a45f065d3b8662ac38faa6492bc0eea6b7e3b51591a5cc27669e",
-  r: "283de5b9379a45f065d3b8662ac38faa6492bc0eea6b7e3b51591a5cc27669d"
+  a: 0x5db6907c92529f517d24a6ff7303de42cb9059ae2adc0c22n,
+  r: -0x5db6907c92529f517d24a6ff7303de42cb9059ae2adc0c23n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var r = ~a;
-  if (d.r !== r.toString(16)) {
-    print("Input:    " + a.toString(16));
+  var r = ~d.a;
+  if (d.r !== r) {
+    print("Input:    " + d.a.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     error_count++;
diff --git a/deps/v8/test/mjsunit/harmony/bigint/or.js b/deps/v8/test/mjsunit/harmony/bigint/or.js
index 4ee32657d40..c378e141cd4 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/or.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/or.js
@@ -7,96 +7,94 @@
 // Flags: --harmony-bigint
 
 var data = [{
-  a: "a66",
-  b: "d0671cd6e4ebd7baf6e48b2529348cfa89fc9513ba30ef3f99aee07f267df163cf8",
-  r: "d0671cd6e4ebd7baf6e48b2529348cfa89fc9513ba30ef3f99aee07f267df163efe"
+  a: 0x77a87n,
+  b: 0xde08e7433fb9584911b8cb4bc7eed802299b4489fc635974d063847da4e8b461df5dn,
+  r: 0xde08e7433fb9584911b8cb4bc7eed802299b4489fc635974d063847da4e8b467ffdfn
 }, {
-  a: "a9950e5fc429f0f93d5fa8f306f4e5da88a8c9f9",
-  b: "d1fc1ac3db7ff5547462800923e616727120f74f0a6cb7bf1886dd4f4ac",
-  r: "d1fc1ac3db7ff554746a9959e7fe56ff7fb3f7ff8f7cffff5daedfcfdfd"
+  a: -0x1d3ff6f353f2d035ed7b4b8e5e4ae1c8d162n,
+  b: -0xcf829b11c2f996f388b22cd03aeb75ec434f3be8fde6466n,
+  r: -0x192f308302c00024a55a4004520a81c84062n
 }, {
-  a: "5e277a64b6515ad69ed8935ae8dcdb6dc66f98fcbb462b10bea0db15ad6010d",
-  b: "7df3",
-  r: "5e277a64b6515ad69ed8935ae8dcdb6dc66f98fcbb462b10bea0db15ad67dff"
+  a: 0x6dbbc93af9a9c222187dn,
+  b: -0xfaa906348dc49859c34bc7c6n,
+  r: -0xfaa9020404c400500149c781n
 }, {
-  a: "3b8368196588e684403965902763d66aa",
-  b: "-edf58c5ab418f49cf9fdb7f3b1c416a03c1dfbe90ba7ea6373c",
-  r: "-edf58c5ab418f49cf9c43493a0801600381dc2880b808821112"
+  a: 0xf8n,
+  b: 0x4388532n,
+  r: 0x43885fan
 }, {
-  a: "-5587f5e86137f8ea4d7259acdd0b77a26ea069385501c9985df6a5fcd3c",
-  b: "9878871628ea5cb66",
-  r: "-5587f5e86137f8ea4d7259acdd0b77a26ea069385501811849d605a041a"
+  a: -0x3ee35e1823b91414618f05995e11594920539921e9440n,
+  b: -0x58c5811ee19db01b7d9824c49682af55956119cfbc9868287ef138da08ee3n,
+  r: -0x3c80040002800414010101891c1048082051180008423n
 }, {
-  a: "-dc65679b1ea7c86c10890e6d6be3bd069b4c7",
-  b: "83ea9",
-  r: "-dc65679b1ea7c86c10890e6d6be3bd0618047"
+  a: -0xa2a70c5da9a7e98f242e82d518n,
+  b: 0n,
+  r: -0xa2a70c5da9a7e98f242e82d518n
 }, {
-  a: "-755f422bfb614b7ed2c8e05cd1e0e0a",
-  b: "-d3185fac5454a495d7b149e67df4436339e060d924d",
-  r: "-24154221496049744240204040c0209"
+  a: 0x7868475f450ff2b15a03eccb4d26ce8711383f615cn,
+  b: 0x1c62774e1db239cb461c4190b54de4d872f9484cf82ed1258cc14580cf29f608n,
+  r: 0x1c62774e1db239cb461c41f8fd4fffdd7ffbf95efbeedb6daecfc791ff3ff75cn
 }, {
-  a: "-1dfdf84b41ddd069053",
-  b: "f9b2bc80b580311773e9a5d57e8f24ace46bd2a0fce24404db684efa8692638b5d604e6",
-  r: "-1105784900548009011"
+  a: 0x865d033028551a71f6f9f8d7b36cf9819n,
+  b: -0x68e30391d9831a4ea3e65b2e433f55ba398n,
+  r: -0x68610290c9830a4482000206000c1102387n
 }, {
-  a: "18d1b78380aa9016029417c2ebe77a",
-  b: "-b63b35e6711dcbf00dc02cd936",
-  r: "-3835446109c9600800041806"
+  a: -0x817a0dacbafbaf40ef819fc62a8efc4b4960n,
+  b: -0x5af313e32a5386e29cb5d2b34d54f04da389f33d52444f177671e41n,
+  r: -0x12a04840a008a008f019504008074430841n
 }, {
-  a: "-9981f",
-  b: "-5d876576146a2d5dc8d52d26ea3304287af0922685f8e1a46875e80f24a470",
-  r: "-800f"
+  a: -0xef8c9475210c0a31aa12c34db6e7737609c75b78a54cn,
+  b: -0xba91b4ec3a5390db84febaeaddb8209155413e2e02fb0n,
+  r: -0xa9080441210808300a02820d9282011400034260250cn
 }, {
-  a: "-20f8052991bc5a8f2631c9e4b34aa9073a69913185a539d719",
-  b: "a59fdaa025b42",
-  r: "-20f8052991bc5a8f2631c9e4b34aa9073a6991200005398419"
+  a: -0xf4e707078d14001959f4n,
+  b: 0n,
+  r: -0xf4e707078d14001959f4n
 }, {
-  a: "-d02620570",
-  b: "-3b14d75fb9d9b95d13f884a82c9f16",
-  r: "-400200506"
+  a: 0x601f0n,
+  b: 0x246fbfn,
+  r: 0x266fffn
 }, {
-  a: "-8",
-  b: "-4",
-  r: "-4"
+  a: -0x9ccd3d1b6d4bcde8643ad641d395980bn,
+  b: -0x379e57728185fd098383a23c7f56dn,
+  r: -0x13901650808484018100003859009n
 }, {
-  a: "e0e8ab319d1f051560e1155ae5789dd4d9b638e07e5a57c3432e6cb9239d",
-  b: "85c9cd1f09436dc45ac783f31a21a1ff4e11ceca00cc164",
-  r: "e0e8ab319d1f0d5dfcf1f5def7fcddfcf9bf39e27e5ff7e35feeecbde3fd"
+  a: 0xcc4b3ba719bd1b37f254f36a72ee375ad22abn,
+  b: -0xb0c220750f2dad9de91ffb8a7bbf8ffefen,
+  r: -0x4000640e0c8098a0095880188a02dc55n
 }, {
-  a: "8131173cb5597e2ae560cae6d0907f004792b1b1c7",
-  b: "-2ac290724a7c86",
-  r: "-c290604a4c01"
+  a: 0xa230c33b718cd563f9c1577f4f8da160851902341ba1a6e6bdcbec413d98a18n,
+  b: 0xc2f4e2db2df59ccc34690479ebe64df967n,
+  r: 0xa230c33b718cd563f9c1577f4f8dad6fcf3db2ff5bede7e6bdcffeff7ddfb7fn
 }, {
-  a: "bdb24fd4d78b01d77e41d95f2c3eedeb2bf919",
-  b: "-97f6ccbd94d64ada501e0f288568",
-  r: "-14f60881940600d2401204000467"
+  a: -0x5fbac9a8f47n,
+  b: 0xf1bfe6f97e8f516685372b06ea89659c3df4ab3f6779e5c0b41e1b570fn,
+  r: -0x54ba0808841n
 }, {
-  a: "-d5ad86f9a4808394f6e7dcd2a67bd3e6a9",
-  b: "1a80309934942e4e55fbf2ba4d1d2f8cc4697338097e2c1b7ce013da8a79965974286",
-  r: "-408c066804000010f6c25450261a40a429"
+  a: -0x7fd2d4a4c60ba795e2fcn,
+  b: 0x33dcea557cc5156dacb9ad7b252598172f92d8cf7d38e69f0a0n,
+  r: -0xd02d02000082194025cn
 }, {
-  a: "c7a0086120a1613a28456",
-  b: "b8",
-  r: "c7a0086120a1613a284fe"
+  a: -0x3833089d7cf4e0181247572037a90cc2506342a2191137345e3a0e10n,
+  b: 0xededf5c7e54cd86afc6d838205c8a78cac7a0e410792a21cf3e4e38dd8ca2dd80n,
+  r: -0x283208103824c01802450720300908c2004142200111072052180210n
 }, {
-  a: "c8480c",
-  b: "0",
-  r: "c8480c"
+  a: -0x188818a47abbfe64357ccd1a33fb5cb875f86n,
+  b: -0x14faf1811ee737d048c025f7a1fe156f7e90d23a699d040609e631836500df2e30cdn,
+  r: -0x108808202299d040201c411832500cb061085n
 }, {
-  a: "ec8913fc89aa7a47672bc0f5269e8629cabf2dba88836cb3a9",
-  b: "-52594e7",
-  r: "-4010447"
+  a: 0xf60c0260022920bdbd1c837778657936956c15b4cb1n,
+  b: 0xa10df3b397c24n,
+  r: 0xf60c0260022920bdbd1c8377786579b79dffb7b7cb5n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a | b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a | d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: |");
diff --git a/deps/v8/test/mjsunit/harmony/bigint/regressions.js b/deps/v8/test/mjsunit/harmony/bigint/regressions.js
index 3057fe12302..c1df45a1b17 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/regressions.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/regressions.js
@@ -18,3 +18,24 @@ assertEquals(0n, 5n % -1n);
 assertEquals(0n, -5n % -1n);
 
 assertTrue(0n === 0n);
+
+// crbug.com/818277: Must throw without DCHECK failures.
+// In order to run acceptably fast in Debug mode, this test assumes that
+// we allow at least 2 billion bits in a BigInt.
+var close_to_limit = 2n ** 2000000000n;
+assertThrows(() => close_to_limit ** 100n, RangeError);
+
+// Check boundary conditions of the power-of-two fast path.
+// The following "max" constants are just under BigInt::kMaxLengthBits
+// and replicate the computation of that constant.
+var kMaxInt = 2n ** 31n - 1n;
+var max64 = kMaxInt - 64n - 2n;
+var max32 = kMaxInt - 32n - 2n;
+// Platform independence trick: at least one of the two operations will throw!
+assertThrows(() => { var a = 2n ** max32; var b = 2n ** max64; }, RangeError);
+
+(function() {
+  function Constructor() { }
+  Constructor.prototype = 5n;
+  assertThrows(() => ({}) instanceof Constructor, TypeError);
+})();
diff --git a/deps/v8/test/mjsunit/harmony/bigint/sar.js b/deps/v8/test/mjsunit/harmony/bigint/sar.js
index 7feb8aebcd5..f66115dcb6c 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/sar.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/sar.js
@@ -7,100 +7,94 @@
 // Flags: --harmony-bigint
 
 var data = [{
-  a: "-4efa0d1f8a127",
-  b: "-66",
-  r: "-13be8347e2849c0000000000000000000000000"
+  a: 0x211a34fn,
+  b: 0xa6n,
+  r: 0n
 }, {
-  a: "-100000001",
-  b: "20",
-  r: "-2"
+  a: 0xa0d0aff5d2783ad192f37423n,
+  b: 0x7n,
+  r: 0x141a15feba4f075a325e6e8n
 }, {
-  a: "853cd87b0bd5c046aecbf4b3d",
-  b: "-96",
-  r: "214f361ec2f57011abb2fd2cf40000000000000000000000000000000000000"
+  a: -0x68ba010a12ed551fc17c67f63331eea3n,
+  b: 0xae5n,
+  r: -0x1n
 }, {
-  a: "-4bc82dba903fedec0a079f7ae4fa6bd6befa",
-  b: "0",
-  r: "-4bc82dba903fedec0a079f7ae4fa6bd6befa"
+  a: 0xb64dc8009n,
+  b: 0xf1n,
+  r: 0n
 }, {
-  a: "43969b4db0d921d9f0ca68f74e4e4b9073732a7955a5b4571",
-  b: "-91",
-  r: "872d369b61b243b3e194d1ee9c9c9720e6e654f2ab4b68ae2000000000000000000000000000000000000"
+  a: -0x364cdec628e438712e4f8cb7an,
+  b: 0x48cn,
+  r: -0x1n
 }, {
-  a: "495f57",
-  b: "-a5",
-  r: "92beae00000000000000000000000000000000000000000"
+  a: -0xb417099aba80a783f52790b779b38c2e6fbdf5f490d7b02a59e81032een,
+  b: 0x6a3n,
+  r: -0x1n
 }, {
-  a: "-22109b99d3025aaef5c3fbd27420a72",
-  b: "45d",
-  r: "-1"
+  a: 0x9d2b41n,
+  b: 0n,
+  r: 0x9d2b41n
 }, {
-  a: "b3f6b156f4afcf259efd3cd1",
-  b: "c7",
-  r: "0"
+  a: -0x4a070c83b02ba86434228a50cbaf50ddf38n,
+  b: -0x63n,
+  r: -0x25038641d815d4321a11452865d7a86ef9c0000000000000000000000000n
 }, {
-  a: "137aeeadc8d1395042e80393cc1b6a1c7b6e526ab1b6fc2f2859fd70e0c29df2802",
-  b: "f49",
-  r: "0"
+  a: 0x3e76514036ccb958c98f60n,
+  b: -0x76n,
+  r: 0xf9d94500db32e563263d8000000000000000000000000000000n
 }, {
-  a: "70f51026476e43bd7e911d37a4553701",
-  b: "33",
-  r: "e1ea204c8edc877afd2"
+  a: -0x51fe20d47ba564bc09337d5c8d284deb5006549bad2629230198f34n,
+  b: -0xfn,
+  r: -0x28ff106a3dd2b25e0499beae469426f5a8032a4dd693149180cc79a0000n
 }, {
-  a: "-3f935a89481c85d666498cf64fdc2a57028f7b295621dc665c0442229563",
-  b: "-2",
-  r: "-fe4d6a2520721759992633d93f70a95c0a3deca5588771997011088a558c"
+  a: 0x49adce1d09dadc5a0635f24d066d3a29e37b9be6059b88d0239d6ca6d92267a372n,
+  b: -0x6n,
+  r: 0x126b73874276b716818d7c93419b4e8a78dee6f98166e23408e75b29b64899e8dc80n
 }, {
-  a: "-c3",
-  b: "-87",
-  r: "-618000000000000000000000000000000000"
+  a: 0xca19971406fb07cn,
+  b: -0x17n,
+  r: 0x650ccb8a037d83e000000n
 }, {
-  a: "aae225520f630c0dfbb815f121836612d75a1f65a301461cd05ad0a741496",
-  b: "-4",
-  r: "aae225520f630c0dfbb815f121836612d75a1f65a301461cd05ad0a7414960"
+  a: 0xd8de8f631313b1f98f77d265ee48014f82eb20n,
+  b: 0xen,
+  r: 0x3637a3d8c4c4ec7e63ddf4997b920053e0bn
 }, {
-  a: "a5348f9af939041cc6ed386c060619a42f30c4aa8",
-  b: "95",
-  r: "529a"
+  a: -0x550d3470c8ad9b8f22ed01a4b1d3f648n,
+  b: -0x4dn,
+  r: -0xaa1a68e1915b371e45da034963a7ec900000000000000000000n
 }, {
-  a: "-4c27fc7e3892a6a5b517",
-  b: "-6c",
-  r: "-4c27fc7e3892a6a5b517000000000000000000000000000"
+  a: -0xa7eadcd4a1b8037081952f0a9199n,
+  b: -0xcfn,
+  r: -0x53f56e6a50dc01b840ca978548cc8000000000000000000000000000000000000000000000000000n
 }, {
-  a: "98efd35f2239f7efde9aef42ad0acd835e68ad868a2cd8fac260f1c7496e3fd2ada76",
-  b: "0",
-  r: "98efd35f2239f7efde9aef42ad0acd835e68ad868a2cd8fac260f1c7496e3fd2ada76"
+  a: -0x65b3933c9e1eb5f953f6cc55cn,
+  b: 0xa6cn,
+  r: -0x1n
 }, {
-  a: "-92f0264c863bdf66d4c83e8bf812123d759b4",
-  b: "-96",
-  r: "-24bc0993218ef7d9b5320fa2fe04848f5d66d00000000000000000000000000000000000000"
+  a: -0x92cea858475460661a2831a28434bde95e5132e1dcaeb161ec89bd9555f41n,
+  b: -0xbn,
+  r: -0x4967542c23aa30330d1418d1421a5ef4af289970ee5758b0f644decaaafa0800n
 }, {
-  a: "ec6341ff2b0e9cf8721e2eb4ec9c9",
-  b: "74",
-  r: "0"
+  a: -0x1d838ade17fe571916a26314b6a8b42e9b6e2b74238de734d6f5575df7n,
+  b: -0x7n,
+  r: -0xec1c56f0bff2b8c8b51318a5b545a174db715ba11c6f39a6b7aabaefb80n
 }, {
-  a: "-32de8dced947fa55cd0b91332a81f70",
-  b: "-5b",
-  r: "-196f46e76ca3fd2ae685c8999540fb800000000000000000000000"
+  a: 0xdd5bf8581e32875d44e26ef10c45bdff68d209015933586dc37211n,
+  b: -0xa9n,
+  r: 0x1bab7f0b03c650eba89c4dde2188b7bfed1a41202b266b0db86e422000000000000000000000000000000000000000000n
 }, {
-  a: "-3ef43bf8610f6533526ba734e85eafa04cd50a3",
-  b: "-25",
-  r: "-7de877f0c21eca66a4d74e69d0bd5f4099aa146000000000"
-}, {
-  a: "-9979591a367a32ae0039c54fd0f3d9e0ccc80be52b7e517fc94d9f3587dc54d933bb",
-  b: "0",
-  r: "-9979591a367a32ae0039c54fd0f3d9e0ccc80be52b7e517fc94d9f3587dc54d933bb"
+  a: -0xa92d3014dcn,
+  b: -0x4cn,
+  r: -0xa92d3014dc0000000000000000000n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a >> b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a >> d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: >>");
diff --git a/deps/v8/test/mjsunit/harmony/bigint/shl.js b/deps/v8/test/mjsunit/harmony/bigint/shl.js
index 1b0f309f88b..bedd785b544 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/shl.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/shl.js
@@ -7,96 +7,94 @@
 // Flags: --harmony-bigint
 
 var data = [{
-  a: "-9a6d035348727045f6abf7d59056d30e9ce885e87f5f8438347bfcda0a1f9b",
-  b: "-2",
-  r: "-269b40d4d21c9c117daafdf56415b4c3a73a217a1fd7e10e0d1eff368287e7"
+  a: -0xe813d76adc0a177778c0c232c595e8572b783210f4a7009d7c1787n,
+  b: 0x9en,
+  r: -0x3a04f5dab70285ddde30308cb1657a15cade0c843d29c0275f05e1c000000000000000000000000000000000000000n
 }, {
-  a: "615f9676062ea7a1b89396ce4208712f279475490829",
-  b: "ff",
-  r: "30afcb3b031753d0dc49cb672104389793ca3aa484148000000000000000000000000000000000000000000000000000000000000000"
+  a: -0xded00dff14554cn,
+  b: 0xd9n,
+  r: -0x1bda01bfe28aa98000000000000000000000000000000000000000000000000000000n
 }, {
-  a: "-9b6131d8b806543fce32b4c2ca2038ffa956929848a61b5eb7f",
-  b: "-e7",
-  r: "-1"
+  a: -0x50c2df089209be37998c8f6e30c4c95a61e77a9241n,
+  b: 0x46n,
+  r: -0x1430b7c224826f8de66323db8c3132569879dea490400000000000000000n
 }, {
-  a: "-331d9e",
-  b: "0",
-  r: "-331d9e"
+  a: 0x668086293eab52b52b879f00375d0f513f1ff9a93df788e38527en,
+  b: -0x3n,
+  r: 0xcd010c527d56a56a570f3e006eba1ea27e3ff3527bef11c70a4fn
 }, {
-  a: "cb79696d3a6f5d5d034e9d2",
-  b: "-d33",
-  r: "0"
+  a: 0n,
+  b: -0x1n,
+  r: 0n
 }, {
-  a: "ca99",
-  b: "10",
-  r: "ca990000"
+  a: 0x26bd28fb3e06bb0ddan,
+  b: -0xcn,
+  r: 0x26bd28fb3e06bb0n
 }, {
-  a: "6f97833d5",
-  b: "0",
-  r: "6f97833d5"
+  a: -0xa04dca5c74bdb1dbf2f0n,
+  b: -0x3fn,
+  r: -0x1409cn
 }, {
-  a: "67d36e7948d18af35f0823c0d58ba47ca0846cdfaa7a7407f09d44747275532681b343",
-  b: "f",
-  r: "33e9b73ca468c579af8411e06ac5d23e5042366fd53d3a03f84ea23a393aa99340d9a18000"
+  a: -0xd6b46ec3ead311e2e45ca4ae8aa9cf5acf4c2d6c61de06e9e36n,
+  b: -0xan,
+  r: -0x35ad1bb0fab4c478b917292ba2aa73d6b3d30b5b187781ba8n
 }, {
-  a: "f4896",
-  b: "-7",
-  r: "1e91"
+  a: -0x1f1922aen,
+  b: -0xbfn,
+  r: -0x1n
 }, {
-  a: "996ce2a9e0f7d65e0523204c9c469bfd14821efe571ac59cdc01",
-  b: "1d",
-  r: "132d9c553c1efacbc0a464099388d37fa29043dfcae358b39b8020000000"
+  a: 0x47n,
+  b: -0x2n,
+  r: 0x11n
 }, {
-  a: "-f8f",
-  b: "f1",
-  r: "-1f1e000000000000000000000000000000000000000000000000000000000000"
+  a: -0xf64n,
+  b: 0x7en,
+  r: -0x3d900000000000000000000000000000000n
 }, {
-  a: "-b685bbcd953ba9c5973ae523dc81d7b35e0cf2b9b51026d4ba1ac21bd5c3c18f9c13",
-  b: "0",
-  r: "-b685bbcd953ba9c5973ae523dc81d7b35e0cf2b9b51026d4ba1ac21bd5c3c18f9c13"
+  a: -0x78dn,
+  b: -0x85en,
+  r: -0x1n
 }, {
-  a: "e2295b362b7048fb163d1272178ed441517fc689e5ec5ea40f29",
-  b: "-30",
-  r: "e2295b362b7048fb163d1272178ed441517fc689"
+  a: -0xa03bc462b00e4113a2472eb73dn,
+  b: 0n,
+  r: -0xa03bc462b00e4113a2472eb73dn
 }, {
-  a: "-b322e816b014448f44e60b418582390d2a3ad95",
-  b: "0",
-  r: "-b322e816b014448f44e60b418582390d2a3ad95"
+  a: 0x3816aa0f01396f4abe0ee7164e211ce60ce590b615d86f6e6363c0bdd513d8a0n,
+  b: 0x4n,
+  r: 0x3816aa0f01396f4abe0ee7164e211ce60ce590b615d86f6e6363c0bdd513d8a00n
 }, {
-  a: "4c135e4d7",
-  b: "0",
-  r: "4c135e4d7"
+  a: -0xaf8711d29fdecd42a255f14aafe13b9404cced5df0af8b86080af7682cben,
+  b: 0x1n,
+  r: -0x15f0e23a53fbd9a8544abe2955fc277280999dabbe15f170c1015eed0597cn
 }, {
-  a: "-d5b694",
-  b: "f1",
-  r: "-1ab6d28000000000000000000000000000000000000000000000000000000000000"
+  a: 0x218b11dfn,
+  b: 0n,
+  r: 0x218b11dfn
 }, {
-  a: "-7994be7",
-  b: "-d",
-  r: "-3ccb"
+  a: 0x263fcb4707e6fd4a21b1f646ddd90a5e78d781c272621dcaf861d6250d7be675e067n,
+  b: -0x868n,
+  r: 0n
 }, {
-  a: "a6443add555ea15af90092e8",
-  b: "42",
-  r: "29910eb75557a856be4024ba00000000000000000"
+  a: 0x8312b459b585847682en,
+  b: 0x4en,
+  r: 0x20c4ad166d61611da0b80000000000000000000n
 }, {
-  a: "9385ed",
-  b: "e5",
-  r: "1270bda000000000000000000000000000000000000000000000000000000000"
+  a: 0xb45d42e0595a4b104b0b9a177ffdc52b401b61659fe163e720621aef8c8e6191ba7an,
+  b: 0x3n,
+  r: 0x5a2ea1702cad25882585cd0bbffee295a00db0b2cff0b1f390310d77c64730c8dd3d0n
 }, {
-  a: "-531",
-  b: "7d",
-  r: "-a620000000000000000000000000000000"
+  a: -0x42d2c4n,
+  b: 0xfdn,
+  r: -0x85a588000000000000000000000000000000000000000000000000000000000000000n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a << b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a << d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: <<");
diff --git a/deps/v8/test/mjsunit/harmony/bigint/sub.js b/deps/v8/test/mjsunit/harmony/bigint/sub.js
index f0af2ca930f..a1ff9b4bb33 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/sub.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/sub.js
@@ -7,96 +7,94 @@
 // Flags: --harmony-bigint
 
 var data = [{
-  a: "e5e5071838eb1314",
-  b: "3b7f55dce703a25ea14fdea6186156f775dec5d29f6edb3a014",
-  r: "-3b7f55dce703a25ea14fdea6186156f775d067822deb4c88d00"
+  a: 0xc4fd438551d58edn,
+  b: 0x91b42ee55a50d974an,
+  r: -0x90ef31a1d4ff03e5dn
 }, {
-  a: "-f",
-  b: "22d6805c7201a8ad4b9e6c2a7e8b5ab3bac",
-  r: "-22d6805c7201a8ad4b9e6c2a7e8b5ab3bbb"
+  a: -0x86b766ec276e390087458ce093b07b2574732d5f3f5125n,
+  b: 0x4b1fe0dd23316de1b38b343d4112fbd7e8c8d081de5dbabda7357fd9e868466693den,
+  r: -0x4b1fe0dd23316de1b38b34c3f879e7ff5701d10923ea9b5157b0a54e5b95a5a5e503n
 }, {
-  a: "-22",
-  b: "-11a0adfaedd5adb92297af1c3794ef5461dd8bc146db3",
-  r: "11a0adfaedd5adb92297af1c3794ef5461dd8bc146d91"
+  a: 0x63e1eac0d5470c8f802ec390b6415c43ed16d28d6dn,
+  b: -0xbe26927b2f6ae85b5d3062d869d22da005805d23142a236955127b6ca688c07fn,
+  r: 0xbe26927b2f6ae85b5d30633c4bbcee754c8ceca342edb41f966ebf59bd5b4decn
 }, {
-  a: "-d20c39d0",
-  b: "-46faa9d3eabcbd8b6d07adc2d0ff289d2",
-  r: "46faa9d3eabcbd8b6d07adc2c3de65002"
+  a: -0x873cf988993d97e5180fn,
+  b: -0xd791aa365f881a7f05f21f73ef390c0b37408dd0a908801682464178426an,
+  r: 0xd791aa365f881a7f05f21f73ef390c0b37408dd021cb868de908a9932a5bn
 }, {
-  a: "-e5b56109a11",
-  b: "211e1dcdf52f020ab0f16e18cc4e46027d05bfa3155b88973e630ae9a75bf2c7fbad269",
-  r: "-211e1dcdf52f020ab0f16e18cc4e46027d05bfa3155b88973e630ae9a75cd87d5cb6c7a"
+  a: -0xcb273d5b123eff101c62f016ae2896223b93b9114e40d1fn,
+  b: 0x2169f8c954623f8381bf12fd0927e1a645f5b3c6c00e58105c297ba40446208dn,
+  r: -0x2169f8c954623f838e7186d2ba4bd19747bbe2c82af0e1727fe2b735192a2dacn
 }, {
-  a: "-b682aa",
-  b: "-5fa59a6a80d39c0c885c030e9c8c84ec7",
-  r: "5fa59a6a80d39c0c885c030e9c811cc1d"
+  a: -0xe965bf745fffcf22n,
+  b: 0x7c3b92f8a030cbfca7cc5f2fd454459c79a3ac2201524468fbn,
+  r: -0x7c3b92f8a030cbfca7cc5f2fd454459c7a8d11e175b244381dn
 }, {
-  a: "-c1325b8ab9fea966f093bbfbc2e611b0e5bf0b13ce047c7133056d4eea",
-  b: "f97d5c4014c5cc87923c344a",
-  r: "-c1325b8ab9fea966f093bbfbc2e611b0e6b888700e19423dba97a98334"
+  a: 0n,
+  b: 0x6975a8ededffd265f472e660e18n,
+  r: -0x6975a8ededffd265f472e660e18n
 }, {
-  a: "-1872900ab729911a3c021db53672eda07a9ad623",
-  b: "152d13997090c43551edfc89d4c7ea5e9ffee4a114085858892e67e82edea6384aaaba7",
-  r: "-152d13997090c43551edfc89d4c7ea602727e54c86a169fc4950433b960d803ff4581ca"
+  a: -0x236bda1a3a9635190f26c3739b7342f33a27cd2568n,
+  b: 0x1a7e6n,
+  r: -0x236bda1a3a9635190f26c3739b7342f33a27cecd4en
 }, {
-  a: "5440388fc10de9",
-  b: "-4b",
-  r: "5440388fc10e34"
+  a: 0xb682b9c88f0b6d7b5e9a4f77dd0d7885d62cd162783b2e55b30b954e10caf3n,
+  b: 0x2c6574161d9aff7bbebd95e561fbd5d70d893e8c9772bcc697cddn,
+  r: 0xb682b9c88c451639fcc09f8021219f27800d140507629a6ce9946981a74e16n
 }, {
-  a: "-198dc54795a81722f70acc9cc20505492172c7819ba168e57d",
-  b: "-48f3b40bf850f771d44e423eb266846801d9e4e920c",
-  r: "-198dc543066cd66371fb557f7d20e15dfb0a81017e031a5371"
+  a: 0xdd6aa5240c4n,
+  b: 0xb9c7bef20c0cc0f814cce3c40d43e4c26en,
+  r: -0xb9c7bef20c0cc0f814cce3b636999281aan
 }, {
-  a: "c78082429b3163ce243c778",
-  b: "-97afe29",
-  r: "c78082429b3163cebbec5a1"
+  a: 0x35cd14329d5f81dbn,
+  b: 0x25997b1f3500f9b27f2ceean,
+  r: -0x25997b1bd82fb688a934d0fn
 }, {
-  a: "-50df",
-  b: "-d5352ec9c1b0e62b97ea1363ce8b72",
-  r: "d5352ec9c1b0e62b97ea1363ce3a93"
+  a: -0x55ec15d7ed316df3fc7bcfcce0f0a6d7034113bad6d74bae88d4aab03032n,
+  b: 0x9d09b8869aab44d6690fad48c8dffd0e18cc21fb26c2a80ac08fd4f42296f46d37cddn,
+  r: -0x9d09b886a00a0633e7e2c42808a7ba0ae6db2c6896f6b9466dfd49af0b243f183ad0fn
 }, {
-  a: "-5c9777f93d64636ff8bcda39125625aa58a49e9a4f29ece2b7afa5d",
-  b: "894bb7aa90b8687e6290c3218a4258dac9400d556caafe02cf8c312c053f2fc73",
-  r: "-894bb7aa9114fff65bce2784fa3b15b50252637b1703a2a169db5b18e7f6df6d0"
+  a: 0n,
+  b: -0xfbf3b308a6066d497e1cn,
+  r: 0xfbf3b308a6066d497e1cn
 }, {
-  a: "-e15c51f0627e460c477",
-  b: "-dfd13bac43ebe2f8e77f5b31314843",
-  r: "dfd13bac43ddcd33c879334cd083cc"
+  a: 0x6acfc1e4b681be9582cd28453387ed2c29f5eb4cd6d78aaac67n,
+  b: -0x4f5997n,
+  r: 0x6acfc1e4b681be9582cd28453387ed2c29f5eb4cd6d78fa05fen
 }, {
-  a: "0",
-  b: "adbd3e4b06b92771ae25eb52fca5fc86391303ebf7962",
-  r: "-adbd3e4b06b92771ae25eb52fca5fc86391303ebf7962"
+  a: -0xc93eb5cae0c90eb77e702ccb44eea6180829d0b360872n,
+  b: 0xdn,
+  r: -0xc93eb5cae0c90eb77e702ccb44eea6180829d0b36087fn
 }, {
-  a: "960a8aa627a1c48721f4e0",
-  b: "-9e8742ae61615481cdd12f0728f0b61",
-  r: "9e8742ae6ac1fd2c304b4b4f9b10041"
+  a: -0x324ef140a16c5c20a9a189a720136f4836ea98056n,
+  b: 0x49471582a658bf5524128e130b3378d29331baa8eb8n,
+  r: -0x49796473e6fa2bb144bc2f9cb2538c41db68a540f0en
 }, {
-  a: "-abf5cf9ff3c15b0645009",
-  b: "-e805773176aaa712d144e172db033c64aeaddf3380b2",
-  r: "e805773176aaa712d144e1681ba6426572982ecf30a9"
+  a: 0x6f15ac8490de4e308286fdde1142ad0052c2cn,
+  b: 0x9ca6c715de18d7f64a751452e967b5807eec951777245ce5fe3n,
+  r: -0x9ca6c715de18d78734c88fc20b1984fdf7eeb70634775c933b7n
 }, {
-  a: "349ebb89b13a7149ec1a4e067574c3825f90ec4e4413948b808c6a",
-  b: "-44cdc0e3efa11513525f68163033a59d7b0610070",
-  r: "349ebb89b13a7596c8288d0086c5f8a856124f517e6d6c3be18cda"
+  a: -0xc303adn,
+  b: 0x5ec0a706a54978a59b10007942e563957ad22e708678fbfdb02862b2c3n,
+  r: -0x5ec0a706a54978a59b10007942e563957ad22e708678fbfdb02925b670n
 }, {
-  a: "a86c53e8c49b20cff057882c4345c40f5c34a8cb8",
-  b: "-76453703c781511b52e663",
-  r: "a86c53e8c49b20cff05eec7fb3823c246de9d731b"
+  a: -0xdb736b5f3979c24f70aafa5f17711d725d552a9778e1n,
+  b: 0x70b56a0773498a45b796cf79ea18211614cn,
+  r: -0xdb736b5f408518efe7df930372ea8a69fbf6aca8da2dn
 }, {
-  a: "-2647d3c",
-  b: "776e5b3a57bd5196be1b9c99ae899d949cb2b94310c53be8910db71b",
-  r: "-776e5b3a57bd5196be1b9c99ae899d949cb2b94310c53be893723457"
+  a: 0xe91b9a797168c6b7440f946n,
+  b: -0x2588c1301521dd9646a2e22e3aca462ca95e76069be2f7b95d8bb81ccn,
+  r: 0x2588c1301521dd9646a2e22e3aca462caa4791a11554608014cfc7b12n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a - b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a - d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: -");
diff --git a/deps/v8/test/mjsunit/harmony/bigint/tonumber.js b/deps/v8/test/mjsunit/harmony/bigint/tonumber.js
index d2802a79bef..d59e8429b89 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/tonumber.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/tonumber.js
@@ -5,7 +5,7 @@
 // Flags: --harmony-bigint
 
 function Check(bigint, number_string) {
-  var number = Number(number_string);
+  var number = Number(bigint);
   if (number_string.substring(0, 2) === "0x") {
     assertEquals(number_string.substring(2), number.toString(16));
   } else {
@@ -29,6 +29,19 @@ Check(0x7ffffffffffffdn, "0x7ffffffffffffc");  // 55 bits, rounding down.
 Check(0x7ffffffffffffen, "0x80000000000000");  // 55 bits, tie to even.
 Check(0x7fffffffffffffn, "0x80000000000000");  // 55 bits, rounding up.
 Check(0x1ffff0000ffff0000n, "0x1ffff0000ffff0000");  // 65 bits.
+Check(100000000000000008192n, "100000000000000000000");  // Tie to even.
+
+// Check the cornercase where the most significant cut-off bit is 1.
+// If a digit beyond the mantissa is non-zero, we must round up;
+// otherwise tie to even.
+// ...digit2 ][    digit1    ][    digit0    ]
+//        [ mantissa  ]
+Check(0x01000000000000080000000000000000001000n,
+      "0x1000000000000100000000000000000000000");
+Check(0x01000000000000080000000000000000000000n,
+      "0x1000000000000000000000000000000000000");
+Check(0x01000000000000180000000000000000000000n,
+      "0x1000000000000200000000000000000000000");
 
 // Values near infinity.
 Check(1n << 1024n, "Infinity");
diff --git a/deps/v8/test/mjsunit/harmony/bigint/typedarray.js b/deps/v8/test/mjsunit/harmony/bigint/typedarray.js
new file mode 100644
index 00000000000..29713b8a204
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/bigint/typedarray.js
@@ -0,0 +1,240 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-bigint --allow-natives-syntax
+
+var intarray = new BigInt64Array(8);
+var uintarray = new BigUint64Array(8);
+
+function test(f) {
+  f();
+  f();  // Make sure we test ICs.
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  f();
+}
+
+function test_both(f) {
+  test(() => f(BigInt64Array));
+  test(() => f(BigUint64Array));
+}
+
+test(function basic_assignment() {
+  const x = 0x1234567890abcdefn;
+  intarray[0] = x;
+  assertEquals(x, intarray[0]);
+  uintarray[0] = x;
+  assertEquals(x, uintarray[0]);
+  const y = -0x76543210fedcba98n;
+  intarray[0] = y;
+  assertEquals(y, intarray[0]);
+});
+
+test(function construct() {
+  var a = new BigInt64Array([1n, -2n, {valueOf: () => 3n}]);
+  assertArrayEquals([1n, -2n, 3n], a);
+  assertThrows(() => new BigInt64Array([4, 5]), TypeError);
+  var b = new BigUint64Array([6n, -7n]);
+  assertArrayEquals([6n, 0xfffffffffffffff9n], b);
+  var c = new BigUint64Array(new BigInt64Array([8n, -9n]));
+  assertArrayEquals([8n, 0xfffffffffffffff7n], c);
+  var d = new BigInt64Array(new BigUint64Array([10n, 0xfffffffffffffff5n]));
+  assertArrayEquals([10n, -11n], d);
+  assertThrows(() => new BigInt64Array(new Int32Array([12, 13])), TypeError);
+  assertThrows(() => new Int32Array(new BigInt64Array([14n, -15n])), TypeError);
+});
+
+test_both(function copyWithin(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  a.copyWithin(0, 1, 3);
+  assertArrayEquals([2n, 3n, 3n], a);
+});
+
+test_both(function entries(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  var it = a.entries();
+  assertEquals([0, 1n], it.next().value);
+  assertEquals([1, 2n], it.next().value);
+  assertEquals([2, 3n], it.next().value);
+  assertTrue(it.next().done);
+});
+
+test_both(function every(BigArray) {
+  var a = BigArray.of(2n, 3n, 4n);
+  var seen = [];
+  assertTrue(a.every((x) => {seen.push(x); return x > 1n}));
+  assertEquals([2n, 3n, 4n], seen);
+});
+
+test_both(function fill(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n, 4n);
+  a.fill(7n, 1, 3);
+  assertArrayEquals([1n, 7n, 7n, 4n], a);
+  assertThrows(() => (new BigArray(3).fill(1)), TypeError);
+});
+
+test_both(function filter(BigArray) {
+  var a = BigArray.of(1n, 3n, 4n, 2n);
+  var b = a.filter((x) => x > 2n);
+  assertArrayEquals([3n, 4n], b);
+});
+
+test_both(function find(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  assertEquals(2n, a.find((x) => x === 2n));
+  assertEquals(undefined, a.find((x) => x === 2));
+});
+
+test_both(function findIndex(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  assertEquals(1, a.findIndex((x) => x === 2n));
+  assertEquals(-1, a.findIndex((x) => x === 2));
+});
+
+test_both(function forEach(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  var seen = [];
+  a.forEach((x) => seen.push(x));
+  assertEquals([1n, 2n, 3n], seen);
+});
+
+test_both(function from(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  var b = BigArray.from(a);
+  assertArrayEquals([1n, 2n, 3n], b);
+  assertThrows(() => BigArray.from([4, 5]), TypeError);
+  var c = BigArray.from([6, 7], BigInt);
+  assertArrayEquals([6n, 7n], c);
+  assertThrows(() => Int32Array.from([4n, 5n]), TypeError);
+  assertThrows(() => Int32Array.from([4, 5], BigInt), TypeError);
+});
+
+test(function from_mixed() {
+  var contents = [1n, 2n, 3n];
+  var a = new BigInt64Array(contents);
+  var b = BigUint64Array.from(a);
+  assertArrayEquals(contents, b);
+  var c = BigInt64Array.from(b);
+  assertArrayEquals(contents, c);
+});
+
+test_both(function includes(BigArray) {
+  var a = BigArray.of(0n, 1n, 2n);
+  assertTrue(a.includes(1n));
+  assertFalse(a.includes(undefined));
+  assertFalse(a.includes(1));
+  assertFalse(a.includes(0x1234567890abcdef123n));  // More than 64 bits.
+});
+
+test_both(function indexOf(BigArray) {
+  var a = BigArray.of(0n, 1n, 2n);
+  assertEquals(1, a.indexOf(1n));
+  assertEquals(-1, a.indexOf(undefined));
+  assertEquals(-1, a.indexOf(1));
+  assertEquals(-1, a.indexOf(0x1234567890abcdef123n));  // More than 64 bits.
+});
+
+test_both(function join(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  assertEquals("1-2-3", a.join("-"));
+});
+
+test_both(function keys(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  var it = a.keys();
+  assertEquals(0, it.next().value);
+  assertEquals(1, it.next().value);
+  assertEquals(2, it.next().value);
+  assertTrue(it.next().done);
+});
+
+test_both(function lastIndexOf(BigArray) {
+  var a = BigArray.of(0n, 1n, 2n);
+  assertEquals(1, a.lastIndexOf(1n));
+  assertEquals(-1, a.lastIndexOf(undefined));
+  assertEquals(-1, a.lastIndexOf(1));
+  assertEquals(-1, a.lastIndexOf(0x1234567890abcdef123n));  // > 64 bits.
+});
+
+test_both(function map(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  var b = a.map((x) => 2n * x);
+  assertEquals(BigArray, b.constructor);
+  assertArrayEquals([2n, 4n, 6n], b);
+});
+
+test_both(function of(BigArray) {
+  var a = BigArray.of(true, 2n, {valueOf: () => 3n}, "4");
+  assertArrayEquals([1n, 2n, 3n, 4n], a);
+  assertThrows(() => BigArray.of(1), TypeError)
+  assertThrows(() => BigArray.of(undefined), TypeError)
+});
+
+test_both(function reduce(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  assertEquals(6n, a.reduce((sum, x) => sum + x, 0n));
+});
+
+test_both(function reduceRight(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  assertEquals(6n, a.reduce((sum, x) => sum + x, 0n));
+});
+
+test_both(function reverse(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  a.reverse();
+  assertArrayEquals([3n, 2n, 1n], a);
+});
+
+test_both(function set(BigArray) {
+  var a = new BigArray(7);
+  a.set(BigArray.of(1n, 2n, 3n), 2);
+  assertArrayEquals([0n, 0n, 1n, 2n, 3n, 0n, 0n], a);
+  a.set([4n, 5n, 6n], 1);
+  assertArrayEquals([0n, 4n, 5n, 6n, 3n, 0n, 0n], a);
+  assertThrows(() => a.set([7, 8, 9], 3), TypeError);
+  assertThrows(() => a.set(Int32Array.of(10, 11), 2), TypeError);
+
+  var Other = BigArray == BigInt64Array ? BigUint64Array : BigInt64Array;
+  a.set(Other.of(12n, 13n), 4);
+  assertArrayEquals([0n, 4n, 5n, 6n, 12n, 13n, 0n], a);
+});
+
+test_both(function slice(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n, 4n);
+  var b = a.slice(1, 3);
+  assertArrayEquals([2n, 3n], b);
+});
+
+test_both(function some(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  assertTrue(a.some((x) => x === 2n));
+});
+
+test_both(function sort(BigArray) {
+  var a = BigArray.of(7n, 2n, 5n, 3n);
+  a.sort();
+  assertArrayEquals([2n, 3n, 5n, 7n], a);
+});
+
+test_both(function subarray(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n, 4n);
+  var b = a.subarray(1, 3);
+  assertEquals(BigArray, b.constructor);
+  assertArrayEquals([2n, 3n], b);
+});
+
+test_both(function toString(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  assertEquals("1,2,3", a.toString());
+});
+
+test_both(function values(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  var it = a.values();
+  assertEquals(1n, it.next().value);
+  assertEquals(2n, it.next().value);
+  assertEquals(3n, it.next().value);
+  assertTrue(it.next().done);
+});
diff --git a/deps/v8/test/mjsunit/harmony/bigint/xor.js b/deps/v8/test/mjsunit/harmony/bigint/xor.js
index d8c9012971f..a934825bd97 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/xor.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/xor.js
@@ -7,96 +7,94 @@
 // Flags: --harmony-bigint
 
 var data = [{
-  a: "abde23cae3113c95ec7f444c7277658",
-  b: "-65e40fb1",
-  r: "-abde23cae3113c95ec7f444a2c379e9"
+  a: -0x46505bec40d461c595b5e4be178b7d00n,
+  b: -0x9170e5437d4e3ec7c0971e2c6d3bbbd2929ff108ea4ee64f7a91aa367fn,
+  r: 0x9170e5437d4e3ec7c0971e2c6d7deb897edf25692fdb53abc486214a81n
 }, {
-  a: "2d0bbdc05059c78b7e9f43689b2f7a9afaefd679212c2a9b990",
-  b: "29fcdb109b54650f9762b494916bc1cf14853430697febe7acf4327983ce0c6c4c183",
-  r: "29fcdb109b54650f974fbf29513b98089ffbab7301e4c49d360eddaffaef2046d7813"
+  a: -0x49171f24aa9660f7f854148018a8b03256200508n,
+  b: 0x75c2103e4e8e52d0311n,
+  r: -0x49171f24aa9660f7f85413dc39ab54dab30d0617n
 }, {
-  a: "b958dc77068d01811e031d6320df5e53823697be94f7654340b",
-  b: "-c1f5ca609a658e24fc33fec10a84b18fb745cb7c6",
-  r: "-b958dc77064cf44b7e9978ed04236dad433c130f1b4020883cf"
+  a: -0x3cde31210d299e4f6734f76c4f2df3056fn,
+  b: -0x402b7fe66d16877867f43n,
+  r: 0x3cde31210d299a4dd0ca91bd275a757a2cn
 }, {
-  a: "cf7319e3fe16912370c830906f88b",
-  b: "98d972f3c",
-  r: "cf7319e3fe16912370c8a8491d7b7"
+  a: 0x727n,
+  b: 0xe1c82371da63bdb801273077095be8977ff9f14aa619829bf4b418n,
+  r: 0xe1c82371da63bdb801273077095be8977ff9f14aa619829bf4b33fn
 }, {
-  a: "aea6d9e7cec74bca19",
-  b: "5abbcd0c5aa1f96fef9db32b3618de782db64b8f6b4",
-  r: "5abbcd0c5aa1f96fef9db32b3cf2b3e6515a3f33cad"
+  a: 0x7c2b1e0918a85bf5faea9077b7dn,
+  b: -0xed714ba58fd54b19n,
+  r: -0x7c2b1e0918a68ce140b26d23066n
 }, {
-  a: "-b522a022e90fa094f3b729a7a0a914349f5e1fd778829d7576ad36711",
-  b: "-aa00d2fd6a7636",
-  r: "b522a022e90fa094f3b729a7a0a914349f5e1fd778883d78597b91125"
+  a: 0x1dded5fd695f4babcan,
+  b: 0x7e1cb4346c68e84f8fbdd3501daead2ce99a90e56038n,
+  r: 0x7e1cb4346c68e84f8fbdd3501db373f914f3cfaecbf2n
 }, {
-  a: "9c2bc822ec4a590eb8a77ee630009713090",
-  b: "30b13459c1434",
-  r: "9c2bc822ec4a590eb8a77ed68134ced24a4"
+  a: 0xec7d9595de759652a3bb96c80edca63790c32ce7f6cf0ef0n,
+  b: -0x67f0feef424f56d6ae6856a20901199de53ebn,
+  r: -0xec7d9595de73e95d4d4fb23d63b640b2fae3bcf66f115d1bn
 }, {
-  a: "-f14873e1f6121d584d5541073c7ce162873e156b72fb3c943ffd5f212c0d6",
-  b: "f449f0a292048546924d2973626f5441c045d4adbfd00d301791f0db965f",
-  r: "-fe0cecebdf32550c247193900a5a14269b3a4821a9063c473e84402c9568b"
+  a: 0x69ab204291f752866c3d49fdf1d656298f43e896cea3ef31a04n,
+  b: -0x5f5b2fd130e33ed76fa22de5ac70bdf96dee80a09e3107e1c93a135ea80b7e3640cdn,
+  r: -0x5f5b2fd130e33ed769389fe1856fc8d10b2d543f412c628351ce2dd7c4e140c55ac9n
 }, {
-  a: "83d5552fba4213d8dd1ed9bc6c2",
-  b: "4f7ccc10ba9b6880b862f8d5e1c9",
-  r: "47419942413f49bd35b3154e270b"
+  a: -0xd396d40076en,
+  b: 0x3158623c80393n,
+  r: -0x318bf4e8804ffn
 }, {
-  a: "9fdb44741177921c8338b70fc7fa362295bfc92f6275fa16492",
-  b: "93676e5ef972",
-  r: "9fdb44741177921c8338b70fc7fa362295bfc92654031ff9de0"
+  a: 0x8c1dbfbd68007d171986777446303896a1ee46n,
+  b: -0x75fd69710f5bea1cece9d59ec4bca29712b49dcf5ee5cc3299d7fb4fb024f10ae955fn,
+  r: -0x75fd69710f5bea1cece9d59ec4bca29fd36f6619dee21d4301b08c0bd3277860f7b19n
 }, {
-  a: "4355637ed",
-  b: "-7aeb3013cc5eb39d56eed8104407a3e68039944f7673a0c75bd3",
-  r: "-7aeb3013cc5eb39d56eed8104407a3e68039944f767795916c40"
+  a: -0x4c6e3ccbabdd6f58450ec3ec8adfb10831b70893cb996f0ac97a0ae2f3a943185d1n,
+  b: 0xeb136731a19867949d46886e62050c4b446767a076c73dn,
+  r: -0x4c6e3ccbabdd6f58450ecd5dbcacab11b7ce4147a31f892a99bebea485d344742een
 }, {
-  a: "7fdf50188f716c13feced67a1c33ecf422",
-  b: "-7106cd7b9",
-  r: "-7fdf50188f716c13feced67a1b2380239b"
+  a: 0xeaff60e10ebb4b8f2da6a517n,
+  b: -0x17af62a3e808af1be3d864132dfd7363bc95872580585d7a9904n,
+  r: -0x17af62a3e808af1be3d864132dfd999cdc74899ecbd770dc3c15n
 }, {
-  a: "368cf8d0f5790a03774b9a1e116f82281ebd9e18de7f54a7d91f50",
-  b: "8bc4e4f24ce2a7d037079552e6c7db2795f15c92a01f4e0d9",
-  r: "368cf06cbb362ecd5d36996e683aac44630fe747cbb67ea62dff89"
+  a: -0xd4424b4f09210108076d63bd621180f280df8f4480n,
+  b: -0x20953185dd2c534b3cb8da73ce55ab386d62fe8a793a1e74cdf3ad95f3cc2573b3n,
+  r: 0x20953185dd2c534b3cb8da731a17e0776443ff827e577dc9afe22d677313aa37cdn
 }, {
-  a: "-7466a596078a20cc4eca96953e3",
-  b: "-666328e5437b1475dcfe2f44f1c6a82af82ce7ee7cf229c8398836d2d834f9014",
-  r: "666328e5437b1475dcfe2f44f1c6a82af82ce79a1a57bfcfb3a8fa9c12a26c3f1"
+  a: 0x84317d7ec6df6dbfe9413cee812ff95c587f61c7b8de5828d445a69555cff26fba9n,
+  b: -0x853c667aed62685df5993748e5668802b7bf918f8c1222a5267c33f013ff1e10f1b909n,
+  r: -0x8534256d3a8e05ab2e67a35b2b8e9afd227a16799069af40a4f177aa7aaa42efd742a2n
 }, {
-  a: "ad284b70a22d96bdefba53f134c65a1e4958013bb9a31f091fde6fc89",
-  b: "-c89374df2",
-  r: "-ad284b70a22d96bdefba53f134c65a1e4958013bb9a31f09d74d1b179"
+  a: -0xe3b4bf724b172b23c5834ed6f70f984ab3b146070770cbc3b86779db7n,
+  b: -0x68166de3a03d9efce30cb36e242db000c850c0d4f454594e23a1a7cn,
+  r: 0xe3dca91fa8b716bd39604265992bb5fab37916c7d3849f9af644d87cdn
 }, {
-  a: "-47df52354db5",
-  b: "-aa7f61aba9ad859e803e964418af30",
-  r: "aa7f61aba9ad859e807949162de29b"
+  a: -0x5358b8efb260b40e37cb5b45eb4e7864n,
+  b: -0x3e617e3967a5b3554ebf24f1e51a253dfc20a76ef01f02442fn,
+  r: 0x3e617e3967a5b3554eec7c490aa84589f2176c35b5f44c3c4dn
 }, {
-  a: "-f03ea80f22a3dc03f036b13f85faf5fb1",
-  b: "86e9110772d369fdd52b45a8fb22cea26cb73e908408f8a3cdf637f0042c8efdc11",
-  r: "-86e9110772d369fdd52b45a8fb22cea26c4700388b2a5b7fce0601413ba974083a2"
+  a: -0x702359917a8aceedc381n,
+  b: -0x714f08d9c29e9fc0044982eb2469707896265n,
+  r: 0x714f08d9c29e9fc0034bb77233c1dc964a1e4n
 }, {
-  a: "3603d29c8",
-  b: "f4849ec3ec3c352b",
-  r: "f4849ec08c011ce3"
+  a: -0x455ac38dn,
+  b: -0x6152562bf5b6f785abec41e8625bccd3bf3067225733dan,
+  r: 0x6152562bf5b6f785abec41e8625bccd3bf3067670df055n
 }, {
-  a: "e6668ed8eae8b4bb7bdf522d44e9f1bcf66",
-  b: "361cab4f5be1",
-  r: "e6668ed8eae8b4bb7bdf522e25234549487"
+  a: 0x47n,
+  b: 0xa3d30490286ddf5d4f4256n,
+  r: 0xa3d30490286ddf5d4f4211n
 }, {
-  a: "-d0395d",
-  b: "-4a8ee89d006d22a124070241caf5f4343bdfd30d12",
-  r: "4a8ee89d006d22a124070241caf5f4343bdf03344d"
+  a: -0x530cc599859ccdbbb3c1dcb46248a4474c63323cc58a7891da79e0322b91c795ac57n,
+  b: 0x2d986083244cd488657c947a952ae15b23d90ebbc34daan,
+  r: -0x530cc599859ccdbbb3c1dc99fa28276300b7ba59b91e0204f098bb11f29f7c56e1fdn
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a ^ b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a ^ d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: ^");
diff --git a/deps/v8/test/mjsunit/harmony/function-sent.js b/deps/v8/test/mjsunit/harmony/function-sent.js
deleted file mode 100644
index cd0ca957a8c..00000000000
--- a/deps/v8/test/mjsunit/harmony/function-sent.js
+++ /dev/null
@@ -1,90 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-function-sent
-
-
-{
-  function* g() { return function.sent }
-  assertEquals({value: 42, done: true}, g().next(42));
-}
-
-
-{
-  function* g() {
-    try {
-      yield function.sent;
-    } finally {
-      yield function.sent;
-      return function.sent;
-    }
-  }
-
-  {
-    let x = g();
-    assertEquals({value: 1, done: false}, x.next(1));
-    assertEquals({value: 2, done: false}, x.next(2));
-    assertEquals({value: 3, done: true}, x.next(3));
-  }
-
-  {
-    let x = g();
-    assertEquals({value: 1, done: false}, x.next(1));
-    assertEquals({value: 2, done: false}, x.throw(2));
-    assertEquals({value: 3, done: true}, x.next(3));
-  }
-
-  {
-    let x = g();
-    assertEquals({value: 1, done: false}, x.next(1));
-    assertEquals({value: 2, done: false}, x.return(2));
-    assertEquals({value: 3, done: true}, x.next(3));
-  }
-}
-
-
-{
-  function* inner() {
-    try {
-      yield function.sent;
-    } finally {
-      return 23;
-    }
-  }
-
-  function* g() {
-    yield function.sent;
-    yield* inner();
-    return function.sent;
-  }
-
-  {
-    let x = g();
-    assertEquals({value: 1, done: false}, x.next(1));
-    assertEquals({value: undefined, done: false}, x.next(2));
-    assertEquals({value: 3, done: true}, x.next(3));
-  }
-
-  {
-    let x = g();
-    assertEquals({value: 1, done: false}, x.next(1));
-    assertEquals({value: undefined, done: false}, x.next(2));
-    assertEquals({value: 42, done: true}, x.throw(42));
-  }
-
-  {
-    let x = g();
-    assertEquals({value: 1, done: false}, x.next(1));
-    assertEquals({value: undefined, done: false}, x.next(2));
-    assertEquals({value: 23, done: true}, x.return(42));
-  }
-}
-
-
-assertThrows("function f() { return function.sent }", SyntaxError);
-assertThrows("() => { return function.sent }", SyntaxError);
-assertThrows("() => { function.sent }", SyntaxError);
-assertThrows("() => function.sent", SyntaxError);
-assertThrows("({*f() { function.sent }})", SyntaxError);
-assertDoesNotThrow("({*f() { return function.sent }})");
diff --git a/deps/v8/test/mjsunit/harmony/function-tostring.js b/deps/v8/test/mjsunit/harmony/function-tostring.js
index 949ac2282f8..8fccf0dacd1 100644
--- a/deps/v8/test/mjsunit/harmony/function-tostring.js
+++ b/deps/v8/test/mjsunit/harmony/function-tostring.js
@@ -122,3 +122,25 @@ testDynamicFunction("a,   b", "return a");
 testDynamicFunction("a,/*A*/b", "return a");
 testDynamicFunction("/*A*/a,b", "return a");
 testDynamicFunction("a,b", "return a/*A*/");
+
+// Proxies of functions should not throw, but return a NativeFunction.
+assertEquals("function () { [native code] }",
+             new Proxy(function () { hidden }, {}).toString());
+assertEquals("function () { [native code] }",
+             new Proxy(() => { hidden }, {}).toString());
+assertEquals("function () { [native code] }",
+             new Proxy(class {}, {}).toString());
+assertEquals("function () { [native code] }",
+             new Proxy(function() { hidden }.bind({}), {}).toString());
+assertEquals("function () { [native code] }",
+             new Proxy(function*() { hidden }, {}).toString());
+assertEquals("function () { [native code] }",
+             new Proxy(async function() { hidden }, {}).toString());
+assertEquals("function () { [native code] }",
+             new Proxy(async function*() { hidden }, {}).toString());
+assertEquals("function () { [native code] }",
+             new Proxy({ method() { hidden } }.method, {}).toString());
+
+// Non-callable proxies still throw.
+assertThrows(() => Function.prototype.toString.call(new Proxy({}, {})),
+             TypeError);
diff --git a/deps/v8/test/mjsunit/harmony/numeric-separator.js b/deps/v8/test/mjsunit/harmony/numeric-separator.js
new file mode 100644
index 00000000000..0ea3ac8f8d0
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/numeric-separator.js
@@ -0,0 +1,116 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-numeric-separator
+
+{
+  const basic = 1_0_0_0;
+  assertEquals(basic, 1000);
+}
+{
+  const exponent = 1_0e+1;
+  assertEquals(exponent, 10e+1);
+}
+{
+  const exponent2 = 1_0e+1_0;
+  assertEquals(exponent2, 10e+10);
+}
+{
+  const hex = 0xF_F_FF;
+  assertEquals(hex, 0xFFFF);
+}
+{
+  const octal = 0o7_7_7;
+  assertEquals(octal, 0o777);
+}
+{
+  let exception = false;
+  try {
+    const code = `"use strict" const implicitOctal = 07_7_7`;
+    eval(code);
+  } catch(e) {
+    exception = true;
+    assertInstanceof(e, SyntaxError);
+  }
+  assertTrue(exception);
+}
+
+{
+  const binary = 0b0_1_0_1_0;
+  assertEquals(binary, 0b01010);
+}
+{
+  const leadingZeros = 09_1_3;
+  assertEquals(leadingZeros, 0913);
+}
+
+{
+  const dot1 = 9_1.1_3;
+  assertEquals(dot1, 91.13);
+
+  const dot2 = 1.1_3;
+  assertEquals(dot2, 1.13);
+
+  const dot3 = 1_1.21;
+  assertEquals(dot3, 11.21);
+}
+
+{
+  const basic = Number('1_2_3');
+  assertEquals(NaN, basic);
+  const exponent = Number('1_0e+1');
+  assertEquals(NaN, exponent);
+  const exponent2 = Number('1_0e+1_0');
+  assertEquals(NaN, exponent2);
+  const hex = Number('0xF_F_FF');
+  assertEquals(NaN, hex);
+  const octal = Number('0o7_7_7');
+  assertEquals(NaN, octal);
+  const binary = Number('0b0_1_0_1_0');
+  assertEquals(NaN, binary);
+  const leadingZeros = Number('09_1_3');
+  assertEquals(NaN, leadingZeros);
+  const dot1 = Number('9_1.1_3');
+  assertEquals(NaN, dot1);
+  const dot2 = Number('1.1_3');
+  assertEquals(NaN, dot2);
+  const dot3 = Number('1_1.21');
+  assertEquals(NaN, dot3);
+}
+
+{
+  assertEquals(1, parseInt('1_2_3'));
+  assertEquals(0, parseInt('0_1_0_1_0'));
+  assertEquals(15, parseInt('0xF_F'));
+  assertEquals(10, parseInt('10e+1_0'));
+  assertEquals(0, parseInt('0o7_7_7'));
+  assertEquals(0, parseInt('0b1_0_1_0'));
+  assertEquals(9, parseInt('9_1.1_3'));
+  assertEquals(1, parseInt('1.1_3'));
+  assertEquals(1, parseInt('1_1.21'));
+  assertEquals(17, parseInt('017_123'));
+
+  assertEquals(1, parseInt('1_2_3', 10));
+  assertEquals(15, parseInt('0xF_F', 16));
+  assertEquals(7, parseInt('7_7_7', 8));
+  assertEquals(1, parseInt('1_0_1_0', 2));
+}
+
+assertThrows('1_0_0_0_', SyntaxError);
+assertThrows('1e_1', SyntaxError);
+assertThrows('1e+_1', SyntaxError);
+assertThrows('1_e+1', SyntaxError);
+assertThrows('1__0', SyntaxError);
+assertThrows('0x_1', SyntaxError);
+assertThrows('0x1__1', SyntaxError);
+assertThrows('0x1_', SyntaxError);
+assertThrows('0b_0101', SyntaxError);
+assertThrows('0b11_', SyntaxError);
+assertThrows('0b1__1', SyntaxError);
+assertThrows('0o777_', SyntaxError);
+assertThrows('0o_777', SyntaxError);
+assertThrows('0o7__77', SyntaxError);
+assertThrows('0777_', SyntaxError);
+assertThrows('07__77', SyntaxError);
+assertThrows('07_7_7', SyntaxError);
diff --git a/deps/v8/test/mjsunit/harmony/private-fields-ic.js b/deps/v8/test/mjsunit/harmony/private-fields-ic.js
new file mode 100644
index 00000000000..e7889b1e7b3
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/private-fields-ic.js
@@ -0,0 +1,294 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-private-fields
+
+{
+  class X {
+    #x = 1;
+    getX(arg) { return arg.#x; }
+    setX(arg, val) { arg.#x = val; }
+  }
+
+  let x1 = new X;
+  let y = new class {};
+
+  // IC: 0 -> Error
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+
+  assertThrows(() => x1.setX(y, 2), TypeError);
+  assertThrows(() => x1.setX(y, 3), TypeError);
+  assertThrows(() => x1.setX(y, 4), TypeError);
+
+  // IC: 0 -> Monomorphic
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+
+  x1.setX(x1, 2);
+  x1.setX(x1, 3);
+  x1.setX(x1, 4);
+}
+
+{
+  class X {
+    #x = 1;
+    getX(arg) { return arg.#x; }
+    setX(arg, val) { arg.#x = val; }
+  }
+
+  let x1 = new X;
+  // IC: 0 -> Monomorphic
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+
+  x1.setX(x1, 2);
+  x1.setX(x1, 3);
+  x1.setX(x1, 4);
+
+  let y = new class {};
+  // IC: Monomorphic -> Error
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+
+  assertThrows(() => x1.setX(y, 2), TypeError);
+  assertThrows(() => x1.setX(y, 3), TypeError);
+  assertThrows(() => x1.setX(y, 4), TypeError);
+
+  let x3 = new X;
+  // IC: Monomorphic -> Monomorphic
+  assertEquals(1, x1.getX(x3));
+  assertEquals(1, x1.getX(x3));
+  assertEquals(1, x1.getX(x3));
+
+  x1.setX(x3, 2);
+  x1.setX(x3, 3);
+  x1.setX(x3, 4);
+}
+
+
+{
+  class X {
+    #x = 1;
+    getX(arg) { return arg.#x; }
+    setX(arg, val) { arg.#x = val; }
+  }
+
+  let x1 = new X;
+  // IC: 0 -> Monomorphic
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+
+  x1.setX(x1, 2);
+  x1.setX(x1, 3);
+  x1.setX(x1, 4);
+
+  class X2 extends X {
+    #x2 = 2;
+  }
+
+  let x2 = new X2;
+  // IC: Monomorphic -> Polymorphic
+  assertEquals(1, x1.getX(x2));
+  assertEquals(1, x1.getX(x2));
+  assertEquals(1, x1.getX(x2));
+
+  x1.setX(x2, 2);
+  x1.setX(x2, 3);
+  x1.setX(x2, 4);
+
+  let y = new class {};
+
+  // IC: Polymorphic -> Error
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+
+  assertThrows(() => x1.setX(y, 2), TypeError);
+  assertThrows(() => x1.setX(y, 3), TypeError);
+  assertThrows(() => x1.setX(y, 4), TypeError);
+
+  class X3 extends X {
+    #x3 = 2;
+  }
+
+  let x3 = new X3;
+  // IC: Polymorphic -> Polymorphic
+  assertEquals(1, x1.getX(x3));
+  assertEquals(1, x1.getX(x3));
+  assertEquals(1, x1.getX(x3));
+
+  x1.setX(x3, 2);
+  x1.setX(x3, 3);
+  x1.setX(x3, 4);
+}
+
+{
+  class X {
+    #x = 1;
+    getX(arg) { return arg.#x; }
+    setX(arg, val) { arg.#x = val; }
+  }
+
+  let x1 = new X;
+  // IC: 0 -> Monomorphic
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+
+  x1.setX(x1, 2);
+  x1.setX(x1, 3);
+  x1.setX(x1, 4);
+
+  class X2 extends X {
+    #x2 = 2;
+  }
+
+  let x2 = new X2;
+  // IC: Monomorphic -> Polymorphic
+  assertEquals(1, x1.getX(x2));
+  assertEquals(1, x1.getX(x2));
+  assertEquals(1, x1.getX(x2));
+
+  x1.setX(x2, 2);
+  x1.setX(x2, 3);
+  x1.setX(x2, 4);
+
+  class X3 extends X {
+    #x3 = 2;
+  }
+
+  let x3 = new X3;
+  assertEquals(1, x1.getX(x3));
+  assertEquals(1, x1.getX(x3));
+  assertEquals(1, x1.getX(x3));
+
+  x1.setX(x3, 2);
+  x1.setX(x3, 3);
+  x1.setX(x3, 4);
+
+
+  class X4 extends X {
+    #x4 = 2;
+  }
+
+  let x4 = new X4;
+  assertEquals(1, x1.getX(x4));
+  assertEquals(1, x1.getX(x4));
+  assertEquals(1, x1.getX(x4));
+
+  x1.setX(x4, 2);
+  x1.setX(x4, 3);
+  x1.setX(x4, 4);
+
+  class X5 extends X {
+    #x5 = 2;
+  }
+
+  let x5 = new X5;
+  // IC: Polymorphic -> Megamorphic
+  assertEquals(1, x1.getX(x5));
+  assertEquals(1, x1.getX(x5));
+  assertEquals(1, x1.getX(x5));
+
+  x1.setX(x5, 2);
+  x1.setX(x5, 3);
+  x1.setX(x5, 4);
+
+  let y = new class {};
+
+  // IC: Megamorphic -> Error
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+
+  assertThrows(() => x1.setX(y, 2), TypeError);
+  assertThrows(() => x1.setX(y, 3), TypeError);
+  assertThrows(() => x1.setX(y, 4), TypeError);
+
+  class X6 extends X {
+    #x6 = 2;
+  }
+
+  let x6 = new X6;
+  // IC: Megamorphic -> Megamorphic
+  assertEquals(1, x1.getX(x6));
+  assertEquals(1, x1.getX(x6));
+  assertEquals(1, x1.getX(x6));
+
+  x1.setX(x6, 2);
+  x1.setX(x6, 3);
+  x1.setX(x6, 4);
+}
+
+{
+  class C {
+    #a = 1;
+    getA() { return this.#a; }
+    setA(v) { this.#a = v; }
+  }
+
+  let p = new Proxy(new C, {
+    get(target, name) {
+      return target[name];
+    },
+
+    set(target, name, val) {
+      target[name] = val;
+    }
+  });
+
+  assertThrows(() => p.getA(), TypeError);
+  assertThrows(() => p.getA(), TypeError);
+  assertThrows(() => p.getA(), TypeError);
+
+  assertThrows(() => p.setA(2), TypeError);
+  assertThrows(() => p.setA(3), TypeError);
+  assertThrows(() => p.setA(4), TypeError);
+
+  let x = new Proxy(new C, {});
+  assertThrows(() => x.getA(), TypeError);
+  assertThrows(() => x.getA(), TypeError);
+  assertThrows(() => x.getA(), TypeError);
+
+  assertThrows(() => x.setA(2), TypeError);
+  assertThrows(() => x.setA(3), TypeError);
+  assertThrows(() => x.setA(4), TypeError);
+}
+
+{
+  class A {
+    constructor(arg) {
+      return arg;
+    }
+  }
+
+  class X extends A {
+    #x = 1;
+
+    constructor(arg) {
+      super(arg);
+    }
+
+    getX(arg) { return arg.#x; }
+
+    setX(arg, val) { arg.#x = val; }
+  }
+
+  let proxy = new Proxy({}, {});
+  let x = new X(proxy);
+
+  assertEquals(1, X.prototype.getX(proxy));
+  assertEquals(1, X.prototype.getX(proxy));
+  assertEquals(1, X.prototype.getX(proxy));
+
+  X.prototype.setX(proxy, 2);
+  X.prototype.setX(proxy, 3);
+  X.prototype.setX(proxy, 4);
+}
diff --git a/deps/v8/test/mjsunit/harmony/private-fields-special-object.js b/deps/v8/test/mjsunit/harmony/private-fields-special-object.js
new file mode 100644
index 00000000000..309143d9044
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/private-fields-special-object.js
@@ -0,0 +1,49 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-private-fields --allow-natives-syntax
+
+async function f(assert) {
+  try {
+    module_namespace_obj = await import('modules-skip-1.js');
+  } catch(e) {
+    %AbortJS(e);
+  }
+
+  class A {
+    constructor(arg) {
+      return arg;
+    }
+  }
+
+  class X extends A {
+    #x = 1;
+
+    constructor(arg) {
+      super(arg);
+    }
+
+    getX(arg) {
+      return arg.#x;
+    }
+
+    setX(arg, val) { arg.#x = val; }
+  }
+
+  let x = new X(module_namespace_obj);
+
+  assert.equals(1, X.prototype.getX(module_namespace_obj));
+  assert.equals(1, X.prototype.getX(module_namespace_obj));
+  assert.equals(1, X.prototype.getX(module_namespace_obj));
+
+  X.prototype.setX(module_namespace_obj, 2);
+  X.prototype.setX(module_namespace_obj, 3);
+  X.prototype.setX(module_namespace_obj, 4);
+}
+
+testAsync(assert => {
+  assert.plan(3);
+
+  f(assert).catch(assert.unreachable);
+}, "private-fields-special-object");
diff --git a/deps/v8/test/mjsunit/harmony/private-fields.js b/deps/v8/test/mjsunit/harmony/private-fields.js
new file mode 100644
index 00000000000..ec25bb743e7
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/private-fields.js
@@ -0,0 +1,478 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-private-fields --allow-natives-syntax
+
+
+"use strict";
+
+{
+  class C {
+    #a;
+    getA() { return this.#a; }
+  }
+
+  assertEquals(undefined, C.a);
+
+  let c = new C;
+  assertEquals(undefined, c.a);
+  assertEquals(undefined, c.getA());
+}
+
+{
+  class C {
+    #a = 1;
+    getA() { return this.#a; }
+  }
+
+  assertEquals(undefined, C.a);
+
+  let c = new C;
+  assertEquals(undefined, c.a);
+  assertEquals(1, c.getA());
+}
+
+{
+  class C {
+    #a = 1;
+    #b = this.#a;
+    getB() { return this.#b; }
+  }
+
+  let c = new C;
+  assertEquals(1, c.getB());
+}
+
+{
+  class C {
+    #a = 1;
+    getA() { return this.#a; }
+    constructor() {
+      assertEquals(1, this.#a);
+      this.#a = 5;
+    }
+  }
+
+  let c = new C;
+  assertEquals(5, c.getA());
+}
+
+{
+  class C {
+    #a = this;
+    #b = () => this;
+    getA() { return this.#a; }
+    getB() { return this.#b; }
+  }
+
+  let c1 = new C;
+  assertSame(c1, c1.getA());
+  assertSame(c1, c1.getB()());
+  let c2 = new C;
+  assertSame(c1, c1.getB().call(c2));
+}
+
+{
+  class C {
+    #a = this;
+    #b = function() { return this; };
+    getA() { return this.#a; }
+    getB() { return this.#b; }
+  }
+
+  let c1 = new C;
+  assertSame(c1, c1.getA());
+  assertSame(c1, c1.getB().call(c1));
+  let c2 = new C;
+  assertSame(c2, c1.getB().call(c2));
+}
+
+
+{
+  class C {
+    #a = function() { return 1 };
+    getA() {return this.#a;}
+  }
+
+  let c = new C;
+  assertEquals('#a', c.getA().name);
+}
+
+{
+  let d = function() { return new.target; }
+  class C {
+    #c = d;
+    getC() { return this.#c; }
+  }
+
+  let c = new C;
+  assertEquals(undefined, c.getC()());
+  assertSame(new d, new (c.getC()));
+}
+
+{
+  class C {
+    #b = new.target;
+    #c = () => new.target;
+    getB() { return this.#b; }
+    getC() { return this.#c; }
+  }
+
+  let c = new C;
+  assertEquals(undefined, c.getB());
+  assertEquals(undefined, c.getC()());
+}
+
+{
+  class C {
+    #a = 1;
+    #b = () => this.#a;
+    getB() { return this.#b; }
+  }
+
+  let c1 = new C;
+  assertSame(1, c1.getB()());
+}
+
+{
+  class C {
+    #a = 1;
+    getA(instance) { return instance.#a; }
+  }
+
+  class B { }
+  let c = new C;
+  assertEquals(undefined, c.a);
+  assertEquals(1, c.getA(c));
+
+  assertThrows(() => c.getA(new B), TypeError);
+}
+
+{
+  class A {
+    #a = 1;
+    getA() { return this.#a; }
+  }
+
+  class B extends A {}
+  let b = new B;
+  assertEquals(1, b.getA());
+}
+
+{
+  let prototypeLookup = false;
+  class A {
+    set a(val) {
+      prototypeLookup = true;
+    }
+
+    get a() { return undefined; }
+  }
+
+  class C extends A {
+    #a = 1;
+    getA() { return this.#a; }
+  }
+
+  let c = new C;
+  assertEquals(1, c.getA());
+  assertEquals(false, prototypeLookup);
+}
+
+{
+  class A {
+    constructor() { this.a = 1; }
+  }
+
+  class B extends A {
+    #b = this.a;
+    getB() { return this.#b; }
+  }
+
+  let b = new B;
+  assertEquals(1, b.getB());
+}
+
+{
+  class A {
+    #a = 1;
+    getA() { return this.#a; }
+  }
+
+  class B extends A {
+    #b = super.getA();
+    getB() { return this.#b; }
+  }
+
+  let b = new B;
+  assertEquals(1, b.getB());
+}
+
+{
+  class A {
+    #a = 1;
+    getA() { return this.#a;}
+  }
+
+  class B extends A {
+    #a = 2;
+    get_A() { return this.#a;}
+  }
+
+  let a = new A;
+  let b = new B;
+  assertEquals(1, a.getA());
+  assertEquals(1, b.getA());
+  assertEquals(2, b.get_A());
+}
+
+{
+  let foo = undefined;
+  class A {
+    #a = 1;
+    constructor() {
+      foo = this.#a;
+    }
+  }
+
+  let a = new A;
+  assertEquals(1, foo);
+}
+
+{
+  let foo = undefined;
+  class A extends class {} {
+    #a = 1;
+    constructor() {
+      super();
+      foo = this.#a;
+    }
+  }
+
+  let a = new A;
+  assertEquals(1, foo);
+}
+
+{
+  function makeClass() {
+    return class {
+      #a;
+      setA(val) { this.#a = val; }
+      getA() { return this.#a; }
+    }
+  }
+
+  let classA = makeClass();
+  let a = new classA;
+  let classB = makeClass();
+  let b = new classB;
+
+  assertEquals(undefined, a.getA());
+  assertEquals(undefined, b.getA());
+
+  a.setA(3);
+  assertEquals(3, a.getA());
+  assertEquals(undefined, b.getA());
+
+  b.setA(5);
+  assertEquals(3, a.getA());
+  assertEquals(5, b.getA());
+
+  assertThrows(() => a.getA.call(b), TypeError);
+  assertThrows(() => b.getA.call(a), TypeError);
+}
+
+{
+  let value = undefined;
+
+  new class {
+    #a = 1;
+    getA() { return this.#a; }
+
+    constructor() {
+      new class {
+        #a = 2;
+        constructor() {
+          value = this.#a;
+        }
+      }
+    }
+  }
+
+  assertEquals(2, value);
+}
+
+{
+  class A {
+    #a = 1;
+    b = class {
+      getA() { return this.#a; }
+      get_A(val) { return val.#a; }
+    }
+  }
+
+  let a = new A();
+  let b = new a.b;
+  assertEquals(1, b.getA.call(a));
+  assertEquals(1, b.get_A(a));
+}
+
+{
+  class C {
+    b = this.#a;
+    #a = 1;
+  }
+
+  assertThrows(() => new C, TypeError);
+}
+
+{
+  class C {
+    #b = this.#a;
+    #a = 1;
+  }
+
+  assertThrows(() => new C, TypeError);
+}
+
+{
+  let symbol = Symbol();
+
+  class C {
+    #a = 1;
+    [symbol] = 1;
+    getA() { return this.#a; }
+    setA(val) { this.#a = val; }
+  }
+
+  var p = new Proxy(new C, {
+    get: function(target, name) {
+      if (typeof(arg) === 'symbol') {
+        assertFalse(%SymbolIsPrivate(name));
+      }
+      return target[name];
+    }
+  });
+
+  assertThrows(() => p.getA(), TypeError);
+  assertThrows(() => p.setA(1), TypeError);
+  assertEquals(1, p[symbol]);
+}
+
+{
+  class C {
+    #b = Object.freeze(this);
+    #a = 1;
+    getA() { return this.#a; }
+  }
+
+  let c = new C;
+  assertEquals(1, c.getA());
+}
+
+{
+  class C {
+    #a = 1;
+    setA(another, val) { another.#a = val; }
+    getA(another) { return another.#a; }
+  }
+
+  let c = new C;
+  assertThrows(() => c.setA({}, 2), TypeError);
+  c.setA(c, 3);
+  assertEquals(3, c.getA(c));
+}
+
+{
+  class A {
+    constructor(arg) {
+      return arg;
+    }
+  }
+
+  class C extends A {
+    #x = 1;
+
+    constructor(arg) {
+      super(arg);
+    }
+
+    getX(arg) {
+      return arg.#x;
+    }
+  }
+
+  let leaker = new Proxy({}, {});
+  let c = new C(leaker);
+  assertEquals(1, C.prototype.getX(leaker));
+  assertSame(c, leaker);
+
+  c = new C();
+  assertThrows(() => new C(c), TypeError);
+
+  new C(1);
+}
+
+{
+  class C {
+    #a = 1;
+    b;
+    getA() { return this.b().#a; }
+  }
+
+  let c = new C();
+  c.b = () => c;
+  assertEquals(1, c.getA());
+}
+
+{
+  class C {
+    #a = 1;
+    b;
+    getA(arg) { return arg.b().#a; }
+  }
+
+  let c = new C();
+  c.b = () => c;
+  assertEquals(1, c.getA(c));
+}
+
+{
+  class C {
+    #a = 1;
+    getA() { return eval('this.#a'); }
+  }
+
+  let c = new C;
+  assertEquals(1, c.getA());
+}
+
+{
+  var C;
+  eval('C = class {#a = 1;getA() { return eval(\'this.#a\'); }}');
+
+  let c = new C;
+  assertEquals(1, c.getA());
+}
+
+{
+  class C {
+    #a = 1;
+    getA() { return this.#a; }
+    setA() { eval('this.#a = 4'); }
+  }
+  let c = new C;
+  assertEquals(1, c.getA());
+  c.setA();
+  assertEquals(4, c.getA());
+}
+
+{
+  class C {
+    getA() { return eval('this.#a'); }
+  }
+
+  let c = new C;
+  assertThrows(() => c.getA(), SyntaxError);
+}
diff --git a/deps/v8/test/mjsunit/harmony/private.js b/deps/v8/test/mjsunit/harmony/private.js
index 39376f3ea99..c4306c516ce 100644
--- a/deps/v8/test/mjsunit/harmony/private.js
+++ b/deps/v8/test/mjsunit/harmony/private.js
@@ -57,8 +57,6 @@ function TestType() {
     assertEquals("symbol", typeof symbols[i])
     assertTrue(typeof symbols[i] === "symbol")
     assertTrue(%SymbolIsPrivate(symbols[i]))
-    assertEquals(null, %_ClassOf(symbols[i]))
-    assertEquals("Symbol", %_ClassOf(Object(symbols[i])))
   }
 }
 TestType()
diff --git a/deps/v8/test/mjsunit/keyed-store-array-literal.js b/deps/v8/test/mjsunit/keyed-store-array-literal.js
new file mode 100644
index 00000000000..6892a8fd18f
--- /dev/null
+++ b/deps/v8/test/mjsunit/keyed-store-array-literal.js
@@ -0,0 +1,75 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+function f1() {
+  const x = [,];
+  x[1] = 42;
+  assertEquals([undefined, 42], x);
+}
+
+f1();
+f1();
+%OptimizeFunctionOnNextCall(f1);
+f1();
+f1();
+
+
+function f2() {
+  const x = [0];
+  for (const y of [1, 2, 3, 4]) {
+    x[x.length] = y;
+  }
+  assertEquals([0, 1, 2, 3, 4], x);
+}
+
+f2();
+f2();
+%OptimizeFunctionOnNextCall(f2);
+f2();
+f2();
+
+
+function f3() {
+  const x = [0];
+  for (const y of [1.1, {}]) {
+    x[x.length] = y;
+  }
+  assertEquals([0, 1.1, {}], x);
+}
+
+f3();
+f3();
+%OptimizeFunctionOnNextCall(f3);
+f3();
+f3();
+
+
+function f4(x) {
+  x[x.length] = x.length;
+}
+
+let x1 = [];
+f4(x1);
+assertEquals([0], x1);
+f4(x1);
+assertEquals([0, 1], x1);
+%OptimizeFunctionOnNextCall(f4);
+f4(x1);
+assertEquals([0, 1, 2], x1);
+f4(x1);
+assertEquals([0, 1, 2, 3], x1);
+
+let x2 = {length: 42};
+f4(x2);
+assertEquals(42, x2[42]);
+f4(x2);
+assertEquals(42, x2[42]);
+%OptimizeFunctionOnNextCall(f4);
+f4(x2);
+assertEquals(42, x2[42]);
+f4(x2);
+assertEquals(42, x2[42]);
diff --git a/deps/v8/test/mjsunit/math-deopt.js b/deps/v8/test/mjsunit/math-deopt.js
new file mode 100644
index 00000000000..b5fff7d1497
--- /dev/null
+++ b/deps/v8/test/mjsunit/math-deopt.js
@@ -0,0 +1,70 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license
+// that can be found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+(()=> {
+  function f(a) {
+    return Math.abs(a);
+  }
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a) {
+    return Math.min(1,a);
+  }
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a) {
+    return Math.pow(a,10);
+  }
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a) {
+    return Math.clz32(a);
+  }
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a) {
+    return Math.imul(a, 10);
+  }
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();
diff --git a/deps/v8/test/mjsunit/mjsunit.gyp b/deps/v8/test/mjsunit/mjsunit.gyp
deleted file mode 100644
index e0a7469248b..00000000000
--- a/deps/v8/test/mjsunit/mjsunit.gyp
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'mjsunit_run',
-          'type': 'none',
-          'dependencies': [
-            '../../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../../gypfiles/features.gypi',
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'mjsunit.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/mjsunit/mjsunit.isolate b/deps/v8/test/mjsunit/mjsunit.isolate
deleted file mode 100644
index a7d151aee6b..00000000000
--- a/deps/v8/test/mjsunit/mjsunit.isolate
+++ /dev/null
@@ -1,28 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'files': [
-      './',
-      '../../tools/codemap.js',
-      '../../tools/consarray.js',
-      '../../tools/csvparser.js',
-      '../../tools/logreader.js',
-      '../../tools/arguments.js',
-      '../../tools/profile.js',
-      '../../tools/profile_view.js',
-      '../../tools/profviz/composer.js',
-      '../../tools/splaytree.js',
-      '../../tools/tickprocessor.js',
-      '../../tools/dumpcpp.js',
-      '../wasm-js/test/harness/wasm-constants.js',
-      '../wasm-js/test/harness/wasm-module-builder.js',
-      '../wasm-js/test/js-api/jsapi.js',
-    ],
-  },
-  'includes': [
-    '../../src/d8.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
diff --git a/deps/v8/test/mjsunit/mjsunit.js b/deps/v8/test/mjsunit/mjsunit.js
index 10cf527f307..e51f2a99108 100644
--- a/deps/v8/test/mjsunit/mjsunit.js
+++ b/deps/v8/test/mjsunit/mjsunit.js
@@ -55,6 +55,9 @@ MjsUnitAssertionError.prototype.toString = function () {
 // For known primitive values, please use assertEquals.
 var assertSame;
 
+// Inverse of assertSame.
+var assertNotSame;
+
 // Expected and found values are identical primitive values or functions
 // or similarly structured objects (checking internal properties
 // of, e.g., Number and Date objects, the elements of arrays
@@ -166,9 +169,6 @@ var isInterpreted;
 // Returns true if given function is optimized.
 var isOptimized;
 
-// Returns true if given function is compiled by Crankshaft.
-var isCrankshafted;
-
 // Returns true if given function is compiled by TurboFan.
 var isTurboFanned;
 
@@ -178,6 +178,8 @@ var testAsync;
 // Monkey-patchable all-purpose failure handler.
 var failWithMessage;
 
+// Returns a pretty-printed string representation of the passed value.
+var prettyPrinted;
 
 (function () {  // Scope for utility functions.
 
@@ -224,7 +226,7 @@ var failWithMessage;
   }
 
 
-  function PrettyPrint(value) {
+  prettyPrinted = function prettyPrinted(value) {
     switch (typeof value) {
       case "string":
         return JSON.stringify(value);
@@ -247,11 +249,12 @@ var failWithMessage;
           case "String":
           case "Boolean":
           case "Date":
-            return objectClass + "(" + PrettyPrint(ValueOf(value)) + ")";
+            return objectClass + "(" + prettyPrinted(ValueOf(value)) + ")";
           case "RegExp":
             return RegExpPrototypeToString.call(value);
           case "Array":
-            var mapped = ArrayPrototypeMap.call(value, PrettyPrintArrayElement);
+            var mapped = ArrayPrototypeMap.call(
+                value, prettyPrintedArrayElement);
             var joined = ArrayPrototypeJoin.call(mapped, ",");
             return "[" + joined + "]";
           case "Uint8Array":
@@ -279,9 +282,9 @@ var failWithMessage;
   }
 
 
-  function PrettyPrintArrayElement(value, index, array) {
+  function prettyPrintedArrayElement(value, index, array) {
     if (value === undefined && !(index in array)) return "";
-    return PrettyPrint(value);
+    return prettyPrinted(value);
   }
 
 
@@ -296,7 +299,7 @@ var failWithMessage;
       message += " (" + name_opt + ")";
     }
 
-    var foundText = PrettyPrint(found);
+    var foundText = prettyPrinted(found);
     if (expectedText.length <= 40 && foundText.length <= 40) {
       message += ": expected <" + expectedText + "> found <" + foundText + ">";
     } else {
@@ -372,19 +375,29 @@ var failWithMessage;
     } else if ((expected !== expected) && (found !== found)) {
       return;
     }
-    fail(PrettyPrint(expected), found, name_opt);
+    fail(prettyPrinted(expected), found, name_opt);
   };
 
+  assertNotSame = function assertNotSame(expected, found, name_opt) {
+    // TODO(mstarzinger): We should think about using Harmony's egal operator
+    // or the function equivalent Object.is() here.
+    if (found !== expected) {
+      if (expected === 0 || (1 / expected) !== (1 / found)) return;
+    } else if (!((expected !== expected) && (found !== found))) {
+      return;
+    }
+    fail(prettyPrinted(expected), found, name_opt);
+  }
 
   assertEquals = function assertEquals(expected, found, name_opt) {
     if (!deepEquals(found, expected)) {
-      fail(PrettyPrint(expected), found, name_opt);
+      fail(prettyPrinted(expected), found, name_opt);
     }
   };
 
   assertNotEquals = function assertNotEquals(expected, found, name_opt) {
     if (deepEquals(found, expected)) {
-      fail("not equals to " + PrettyPrint(expected), found, name_opt);
+      fail("not equals to " + prettyPrinted(expected), found, name_opt);
     }
   };
 
@@ -392,7 +405,7 @@ var failWithMessage;
   assertEqualsDelta =
       function assertEqualsDelta(expected, found, delta, name_opt) {
     if (Math.abs(expected - found) > delta) {
-      fail(PrettyPrint(expected) + " +- " + PrettyPrint(delta), found, name_opt);
+      fail(prettyPrinted(expected) + " +- " + prettyPrinted(delta), found, name_opt);
     }
   };
 
@@ -499,7 +512,7 @@ var failWithMessage;
       if (typeof actualConstructor === "function") {
         actualTypeName = actualConstructor.name || String(actualConstructor);
       }
-      failWithMessage("Object <" + PrettyPrint(obj) + "> is not an instance of <" +
+      failWithMessage("Object <" + prettyPrinted(obj) + "> is not an instance of <" +
                (type.name || type) + ">" +
                (actualTypeName ? " but of <" + actualTypeName + ">" : ""));
     }
@@ -657,14 +670,6 @@ var failWithMessage;
     return (opt_status & V8OptimizationStatus.kOptimized) !== 0;
   }
 
-  isCrankshafted = function isCrankshafted(fun) {
-    var opt_status = OptimizationStatus(fun, "");
-    assertTrue((opt_status & V8OptimizationStatus.kIsFunction) !== 0,
-               "not a function");
-    return (opt_status & V8OptimizationStatus.kOptimized) !== 0 &&
-           (opt_status & V8OptimizationStatus.kTurboFanned) === 0;
-  }
-
   isTurboFanned = function isTurboFanned(fun) {
     var opt_status = OptimizationStatus(fun, "");
     assertTrue((opt_status & V8OptimizationStatus.kIsFunction) !== 0,
@@ -779,7 +784,7 @@ var failWithMessage;
     equals(expected, found, name_opt) {
       this.actualAsserts_++;
       if (!deepEquals(expected, found)) {
-        this.fail(PrettyPrint(expected), found, name_opt);
+        this.fail(prettyPrinted(expected), found, name_opt);
       }
     }
 
diff --git a/deps/v8/test/mjsunit/mjsunit.status b/deps/v8/test/mjsunit/mjsunit.status
index ebcdad18524..309f2845fd4 100644
--- a/deps/v8/test/mjsunit/mjsunit.status
+++ b/deps/v8/test/mjsunit/mjsunit.status
@@ -87,7 +87,7 @@
   'array-constructor': [PASS, SLOW, ['arch == arm and simulator == True', SKIP]],
 
   # Very slow test
-  'regress/regress-crbug-808192' : [PASS, NO_VARIANTS, ['arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips64 or arch == mips', SKIP]],
+  'regress/regress-crbug-808192' : [PASS, SLOW, NO_VARIANTS, ['arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips64 or arch == mips or arch == s390 or arch == s390x or arch == ppc or arch == ppc64', SKIP]],
 
   # Very slow on ARM and MIPS, contains no architecture dependent code.
   'unicode-case-overoptimization': [PASS, NO_VARIANTS, ['arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips64 or arch == mips', SKIP]],
@@ -104,6 +104,8 @@
   'generated-transition-stub': [PASS, ['mode == debug', SKIP]],
   'migrations': [SKIP],
   'array-functions-prototype-misc': [PASS, SLOW, ['mode == debug', SKIP]],
+  'compiler/regress-808472': [PASS, ['mode == debug', SKIP]],
+  'es6/promise-all-overflow-*': [PASS, SLOW, ['mode == debug or arch != x64', SKIP]],
 
   ##############################################################################
   # This test sets the umask on a per-process basis and hence cannot be
@@ -159,7 +161,6 @@
   'regress/regress-605470': [PASS, SLOW],
   'regress/regress-655573': [PASS, SLOW],
   'regress/regress-1200351': [PASS, SLOW],
-  'regress/regress-crbug-474297': [PASS, ['gc_stress == False', SKIP]],
   'wasm/embenchen/*': [PASS, SLOW],
   'wasm/unreachable-validation': [PASS, SLOW],
 
@@ -242,6 +243,10 @@
   'unicode-test': [SKIP],
   'whitespaces': [SKIP],
 
+  # Unsuitable for GC stress because coverage information is lost on GC.
+  'code-coverage-ad-hoc': [SKIP],
+  'code-coverage-precise': [SKIP],
+
   # TODO(mstarzinger): Takes too long with TF.
   'array-sort': [PASS, NO_VARIANTS],
   'regress/regress-91008': [PASS, NO_VARIANTS],
@@ -409,6 +414,7 @@
 
   # Too slow.
   'harmony/regexp-property-lu-ui': [SKIP],
+  'regress/regress-165637': [SKIP],
 
   # Flaky with baseline?
   'regress/regress-2185-2': [SKIP],
@@ -536,6 +542,7 @@
   # Requires too much memory on MIPS.
   'regress/regress-752764': [SKIP],
   'regress/regress-779407': [SKIP],
+  'harmony/bigint/regressions': [SKIP],
 }],  # 'arch == mipsel or arch == mips'
 
 ##############################################################################
@@ -633,16 +640,57 @@
   'shared-function-tier-up-turbo': [SKIP],
 
   # Fails deopt_fuzzer due to --deopt_every_n_times
-  'es6/array-iterator-turbo': [SKIP]
+  'es6/array-iterator-turbo': [SKIP],
+
+  # BUG(v8:7466).
+  'compiler/promise-constructor': [SKIP],
 }],  # 'deopt_fuzzer == True'
 
 ##############################################################################
-['gc_fuzzer == True', {
+['gc_fuzzer', {
   'regress/regress-336820': [SKIP],
   'regress/regress-748069': [SKIP],
   'regress/regress-778668': [SKIP],
   'ignition/regress-672027': [PASS, ['tsan', SKIP]],
-}],  # 'gc_fuzzer == True'
+  'string-replace-gc': [PASS, SLOW, ['mode == debug', SKIP]],
+
+  # Unsuitable for GC fuzzing because coverage information is lost on GC.
+  'code-coverage-ad-hoc': [SKIP],
+  'code-coverage-precise': [SKIP],
+
+  # Fails allocation on tsan.
+  'es6/classes': [PASS, ['tsan', SKIP]],
+
+  # Tests that fail some assertions due to checking internal state sensitive
+  # to GC. We mark PASS,FAIL to not skip those tests on the endurance fuzzer.
+  'array-literal-feedback': [PASS, FAIL],
+  'compiler/native-context-specialization-hole-check': [PASS, FAIL],
+  'elements-transition-hoisting': [PASS, FAIL],
+  'es6/collections-constructor-custom-iterator': [PASS, FAIL],
+  'keyed-load-with-symbol-key': [PASS, FAIL],
+  'regress/regress-3709': [PASS, FAIL],
+  'regress/regress-trap-allocation-memento': [PASS, FAIL],
+  'regress/regress-unlink-closures-on-deopt': [PASS, FAIL],
+  'shared-function-tier-up-turbo': [PASS, FAIL],
+}],  # 'gc_fuzzer'
+
+##############################################################################
+['endurance_fuzzer', {
+  # BUG(v8:7400).
+  'wasm/lazy-compilation': [SKIP],
+
+  # BUG(v8:7429).
+  'regress/regress-599414-array-concat-fast-path': [SKIP],
+
+  # Often crashes due to memory consumption.
+  'regress/regress-655573': [SKIP],
+
+  # TSAN allocation failures.
+  'deep-recursion': [PASS, ['tsan', SKIP]],
+  'regress/regress-430201b': [PASS, ['tsan', SKIP]],
+  'regress/regress-crbug-493779': [PASS, ['tsan', SKIP]],
+  'regress/wasm/regress-763439': [PASS, ['tsan', SKIP]],
+}],  # 'endurance_fuzzer'
 
 ##############################################################################
 ['predictable == True', {
@@ -654,6 +702,8 @@
 
   # BUG(v8:7166).
   'd8/enable-tracing': [SKIP],
+  # Relies on async compilation which requires background tasks.
+  'wasm/streaming-error-position': [SKIP],
 }],  # 'predictable == True'
 
 ##############################################################################
@@ -686,6 +736,7 @@
   # TODO(ppc/s390): fix constant pool issue and implement tagging for reloc
   'wasm/compiled-module-serialization': [SKIP],
   'regress/wasm/regress-808980': [SKIP],
+  'regress/wasm/regress-808848': [SKIP],
 }],  # 'arch == ppc64 or arch == ppc or arch == s390 or arch == s390x'
 
 ##############################################################################
@@ -734,12 +785,6 @@
   'whitespaces': [SKIP],
 }],  # variant == wasm_traps
 
-['variant == wasm_traps and gc_stress == True', {
-  # TODO(eholk): these tests are disabled due to address space exhaustion.
-  # Re-enable them once Wasm address space limits are in place.
-  '*': [SKIP],
-}],  # variant == wasm_traps and gc_stress == True
-
 ##############################################################################
 ['no_harness', {
     # skip assertion tests since the stack trace is broken if mjsunit is
diff --git a/deps/v8/test/mjsunit/mjsunit_suppressions.js b/deps/v8/test/mjsunit/mjsunit_suppressions.js
new file mode 100644
index 00000000000..1bd466993f9
--- /dev/null
+++ b/deps/v8/test/mjsunit/mjsunit_suppressions.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// This turns all mjsunit asserts into no-ops used for fuzzing.
+(function () {
+  failWithMessage = function () {}
+})();
diff --git a/deps/v8/test/mjsunit/modules-namespace-getownproperty1.js b/deps/v8/test/mjsunit/modules-namespace-getownproperty1.js
new file mode 100644
index 00000000000..55b4db03f59
--- /dev/null
+++ b/deps/v8/test/mjsunit/modules-namespace-getownproperty1.js
@@ -0,0 +1,148 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// MODULE
+
+import * as ns from "./modules-namespace-getownproperty1.js";
+
+
+////////////////////////////////////////////////////////////////////////////////
+// There are three exports, a and b and c (all let-declared).  Variable b is
+// declared AFTER the first set of tests ran (see below).
+export let a = 1;
+export let c = 3;
+////////////////////////////////////////////////////////////////////////////////
+
+
+// for-in
+assertThrows(() => { for (let p in ns) {} }, ReferenceError);
+
+// Object.prototype.propertyIsEnumerable
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'a'));
+assertThrows(() => Object.prototype.propertyIsEnumerable.call(ns, 'b'),
+    ReferenceError);
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'c'));
+
+// Object.prototype.hasOwnProperty
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'a'));
+assertThrows(() => Object.prototype.hasOwnProperty.call(ns, 'b'),
+    ReferenceError);
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'c'));
+
+// Object.keys
+assertThrows(() => Object.keys(ns), ReferenceError);
+
+// Object.entries
+assertThrows(() => Object.entries(ns), ReferenceError);
+
+// Object.values
+assertThrows(() => Object.values(ns), ReferenceError);
+
+// Object.getOwnPropertyNames
+assertEquals(['a', 'b', 'c'], Object.getOwnPropertyNames(ns));
+
+// Object.getOwnPropertySymbols
+assertEquals([Symbol.toStringTag], Object.getOwnPropertySymbols(ns));
+
+// Reflect.ownKeys
+assertEquals(['a', 'b', 'c', Symbol.toStringTag], Reflect.ownKeys(ns));
+
+// Object.assign
+var copy = {};
+assertThrows(() => Object.assign(copy, ns), ReferenceError);
+assertEquals({a: 1}, copy);
+
+// Object.isFrozen
+assertFalse(Object.isFrozen(ns));
+
+// Object.isSealed
+assertThrows(() => Object.isSealed(ns), ReferenceError);
+
+// Object.freeze
+assertThrows(() => Object.freeze(ns), TypeError);
+
+// Object.seal
+assertThrows(() => Object.seal(ns), ReferenceError);
+
+// JSON.stringify
+assertThrows(() => JSON.stringify(ns), ReferenceError);
+
+// PropertyDefinition
+assertThrows(() => ({...copy} = ns), ReferenceError);
+
+// delete
+assertThrows(() => delete ns.b, TypeError);
+assertFalse(Reflect.deleteProperty(ns, 'b'));
+
+
+////////////////////////////////////////////////////////////////////////////////
+// Variable b is declared here.
+export let b = 2;
+////////////////////////////////////////////////////////////////////////////////
+
+
+// for-in
+var i = 1;
+for (let p in ns) {
+  assertEquals(i, ns[p]);
+  i++
+}
+assertEquals(i, 4);
+
+// Object.prototype.propertyIsEnumerable
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'a'));
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'b'));
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'c'));
+
+// Object.prototype.hasOwnProperty
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'a'));
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'b'));
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'c'));
+
+// Object.keys
+assertEquals(['a', 'b', 'c'], Object.keys(ns));
+
+// Object.entries
+assertEquals([['a', 1], ['b', 2], ['c', 3]], Object.entries(ns));
+
+// Object.values
+assertEquals([1, 2, 3], Object.values(ns));
+
+// Object.getOwnPropertyNames
+assertEquals(['a', 'b', 'c'], Object.getOwnPropertyNames(ns));
+
+// Object.getOwnPropertySymbols
+assertEquals([Symbol.toStringTag], Object.getOwnPropertySymbols(ns));
+
+// Reflect.ownKeys
+assertEquals(['a', 'b', 'c', Symbol.toStringTag], Reflect.ownKeys(ns));
+
+// Object.assign
+copy = {};
+Object.assign(copy, ns);
+assertEquals({a: 1, b:2, c:3}, copy);
+
+// Object.isFrozen
+assertFalse(Object.isFrozen(ns));
+
+// Object.isSealed
+assertTrue(Object.isSealed(ns));
+
+// Object.freeze
+assertThrows(() => Object.freeze(ns), TypeError);
+
+// Object.seal
+assertDoesNotThrow(() => Object.seal(ns));
+
+// JSON.stringify
+assertEquals('{"a":1,"b":2,"c":3}', JSON.stringify(ns));
+
+// PropertyDefinition
+copy = {};
+({...copy} = ns);
+assertEquals({a: 1, b:2, c:3}, copy);
+
+// delete
+assertThrows(() => delete ns.b, TypeError);
+assertFalse(Reflect.deleteProperty(ns, 'b'));
diff --git a/deps/v8/test/mjsunit/modules-namespace-getownproperty2.js b/deps/v8/test/mjsunit/modules-namespace-getownproperty2.js
new file mode 100644
index 00000000000..c276a09210d
--- /dev/null
+++ b/deps/v8/test/mjsunit/modules-namespace-getownproperty2.js
@@ -0,0 +1,148 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// MODULE
+
+import * as ns from "./modules-namespace-getownproperty2.js";
+
+// This tests the same as modules-namespace-getownproperty1.js except that here
+// variable a doesn't exist. This means that the late-declared variable b is the
+// (alphabetically) first property of the namespace object, which makes a
+// difference for some operations.
+
+
+////////////////////////////////////////////////////////////////////////////////
+// There are two exports, b and c (both let-declared).  Variable b is
+// declared AFTER the first set of tests ran (see below).
+export let c = 3;
+////////////////////////////////////////////////////////////////////////////////
+
+
+// for-in
+assertThrows(() => { for (let p in ns) {} }, ReferenceError);
+
+// Object.prototype.propertyIsEnumerable
+assertThrows(() => Object.prototype.propertyIsEnumerable.call(ns, 'b'),
+    ReferenceError);
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'c'));
+
+// Object.prototype.hasOwnProperty
+assertThrows(() => Object.prototype.hasOwnProperty.call(ns, 'b'),
+    ReferenceError);
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'c'));
+
+// Object.keys
+assertThrows(() => Object.keys(ns), ReferenceError);
+
+// Object.entries
+assertThrows(() => Object.entries(ns), ReferenceError);
+
+// Object.values
+assertThrows(() => Object.values(ns), ReferenceError);
+
+// Object.getOwnPropertyNames
+assertEquals(['b', 'c'], Object.getOwnPropertyNames(ns));
+
+// Object.getOwnPropertySymbols
+assertEquals([Symbol.toStringTag], Object.getOwnPropertySymbols(ns));
+
+// Reflect.ownKeys
+assertEquals(['b', 'c', Symbol.toStringTag], Reflect.ownKeys(ns));
+
+// Object.assign
+var copy = {};
+assertThrows(() => Object.assign(copy, ns), ReferenceError);
+assertEquals({}, copy);
+
+// Object.isFrozen
+assertThrows(() => Object.isFrozen(ns), ReferenceError);
+
+// Object.isSealed
+assertThrows(() => Object.isSealed(ns), ReferenceError);
+
+// Object.freeze
+assertThrows(() => Object.freeze(ns), ReferenceError);
+
+// Object.seal
+assertThrows(() => Object.seal(ns), ReferenceError);
+
+// JSON.stringify
+assertThrows(() => JSON.stringify(ns), ReferenceError);
+
+// PropertyDefinition
+assertThrows(() => ({...copy} = ns), ReferenceError);
+
+// delete
+assertThrows(() => delete ns.b, TypeError);
+assertFalse(Reflect.deleteProperty(ns, 'b'));
+
+
+////////////////////////////////////////////////////////////////////////////////
+// Variable b is declared here.
+export let b = 2;
+////////////////////////////////////////////////////////////////////////////////
+
+
+// for-in
+var i = 2;
+for (let p in ns) {
+  assertEquals(i, ns[p]);
+  i++
+}
+assertEquals(i, 4);
+
+// Object.prototype.propertyIsEnumerable
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'b'));
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'c'));
+
+// Object.prototype.hasOwnProperty
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'b'));
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'c'));
+
+// Object.keys
+assertEquals(['b', 'c'], Object.keys(ns));
+
+// Object.entries
+assertEquals([['b', 2], ['c', 3]], Object.entries(ns));
+
+// Object.values
+assertEquals([2, 3], Object.values(ns));
+
+// Object.getOwnPropertyNames
+assertEquals(['b', 'c'], Object.getOwnPropertyNames(ns));
+
+// Object.getOwnPropertySymbols
+assertEquals([Symbol.toStringTag], Object.getOwnPropertySymbols(ns));
+
+// Reflect.ownKeys
+assertEquals(['b', 'c', Symbol.toStringTag], Reflect.ownKeys(ns));
+
+// Object.assign
+copy = {};
+Object.assign(copy, ns);
+assertEquals({b:2, c:3}, copy);
+
+// Object.isFrozen
+assertFalse(Object.isFrozen(ns));
+
+// Object.isSealed
+assertTrue(Object.isSealed(ns));
+
+// Object.freeze
+assertThrows(() => Object.freeze(ns), TypeError);
+
+// Object.seal
+assertDoesNotThrow(() => Object.seal(ns));
+
+// JSON.stringify
+assertEquals('{"b":2,"c":3}', JSON.stringify(ns));
+
+// PropertyDefinition
+copy = {};
+({...copy} = ns);
+assertEquals({b:2, c:3}, copy);
+
+// delete
+assertThrows(() => delete ns.b, TypeError);
+assertFalse(Reflect.deleteProperty(ns, 'b'));
diff --git a/deps/v8/test/mjsunit/optimized-reduce.js b/deps/v8/test/mjsunit/optimized-reduce.js
new file mode 100644
index 00000000000..efcb7ccd1c2
--- /dev/null
+++ b/deps/v8/test/mjsunit/optimized-reduce.js
@@ -0,0 +1,49 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --turbo-inline-array-builtins
+// Flags: --opt --no-always-opt
+
+// Make sure we gracefully handle the case of an empty array in
+// optimized code.
+(function() {
+  var nothingThere = function(only_holes) {
+    var a = [1,2,,3];  // holey smi array.
+    if (only_holes) {
+      a = [,,,];  // also a holey smi array.
+    }
+    return a.reduce((r,v,i,o)=>r+v);
+  }
+  nothingThere();
+  nothingThere();
+  %OptimizeFunctionOnNextCall(nothingThere);
+  assertThrows(() => nothingThere(true));
+})();
+
+// An error generated inside the callback includes reduce in it's
+// stack trace.
+(function() {
+  var re = /Array\.reduce/;
+  var alwaysThrows = function() {
+    var b = [,,,];
+    var result = 0;
+    var callback = function(r,v,i,o) {
+      return r + v;
+    };
+    b.reduce(callback);
+  }
+  try {
+    alwaysThrows();
+  } catch (e) {
+    assertTrue(re.exec(e.stack) !== null);
+  }
+  try { alwaysThrows(); } catch (e) {}
+  try { alwaysThrows(); } catch (e) {}
+  %OptimizeFunctionOnNextCall(alwaysThrows);
+  try {
+    alwaysThrows();
+  } catch (e) {
+    assertTrue(re.exec(e.stack) !== null);
+  }
+})();
diff --git a/deps/v8/test/mjsunit/optimized-reduceright.js b/deps/v8/test/mjsunit/optimized-reduceright.js
new file mode 100644
index 00000000000..2689a39de53
--- /dev/null
+++ b/deps/v8/test/mjsunit/optimized-reduceright.js
@@ -0,0 +1,49 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --turbo-inline-array-builtins
+// Flags: --opt --no-always-opt
+
+// Make sure we gracefully handle the case of an empty array in
+// optimized code.
+(function() {
+  var nothingThere = function(only_holes) {
+    var a = [1,2,,3];  // holey smi array.
+    if (only_holes) {
+      a = [,,,];  // also a holey smi array.
+    }
+    return a.reduceRight((r,v,i,o)=>r+v);
+  }
+  nothingThere();
+  nothingThere();
+  %OptimizeFunctionOnNextCall(nothingThere);
+  assertThrows(() => nothingThere(true));
+})();
+
+// An error generated inside the callback includes reduce in it's
+// stack trace.
+(function() {
+  var re = /Array\.reduceRight/;
+  var alwaysThrows = function() {
+    var b = [,,,];
+    var result = 0;
+    var callback = function(r,v,i,o) {
+      return r + v;
+    };
+    b.reduceRight(callback);
+  }
+  try {
+    alwaysThrows();
+  } catch (e) {
+    assertTrue(re.exec(e.stack) !== null);
+  }
+  try { alwaysThrows(); } catch (e) {}
+  try { alwaysThrows(); } catch (e) {}
+  %OptimizeFunctionOnNextCall(alwaysThrows);
+  try {
+    alwaysThrows();
+  } catch (e) {
+    assertTrue(re.exec(e.stack) !== null);
+  }
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-2470.js b/deps/v8/test/mjsunit/regress/regress-2470.js
index cba1b06c3e1..708af54ca36 100644
--- a/deps/v8/test/mjsunit/regress/regress-2470.js
+++ b/deps/v8/test/mjsunit/regress/regress-2470.js
@@ -46,4 +46,4 @@ assertThrows('Function("a", "", "//", "//")', SyntaxError);
 // Some embedders rely on the string representation of the resulting
 // function in cases where no formal parameters are specified.
 var asString = Function("return 23").toString();
-assertSame("function anonymous() {\nreturn 23\n}", asString);
+assertSame("function anonymous(\n) {\nreturn 23\n}", asString);
diff --git a/deps/v8/test/mjsunit/regress/regress-5010.js b/deps/v8/test/mjsunit/regress/regress-5010.js
deleted file mode 100644
index ecd4026dd82..00000000000
--- a/deps/v8/test/mjsunit/regress/regress-5010.js
+++ /dev/null
@@ -1,9 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax
-
-var bound = (function(){}).bind({});
-assertEquals("Function", %_ClassOf(bound));
-assertEquals("Function", %ClassOf(bound));
diff --git a/deps/v8/test/mjsunit/regress/regress-5691.js b/deps/v8/test/mjsunit/regress/regress-5691.js
new file mode 100644
index 00000000000..6cda92ca793
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5691.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+var log = "";
+var result;
+Promise.resolve()
+  .then(() => log += "|turn1")
+  .then(() => log += "|turn2")
+  .then(() => log += "|turn3")
+  .then(() => log += "|turn4")
+  .then(() => result = "|start|turn1|fast-resolve|turn2|turn3|slow-resolve|turn4\n"+log)
+  .catch(e => print("ERROR", e));
+
+Promise.resolve(Promise.resolve()).then(() => log += "|fast-resolve");
+(class extends Promise {}).resolve(Promise.resolve()).then(() => log += "|slow-resolve");
+
+log += "|start";
+  %RunMicrotasks();
+assertEquals("|start|turn1|fast-resolve|turn2|turn3|slow-resolve|turn4\n\
+|start|turn1|fast-resolve|turn2|turn3|slow-resolve|turn4", result);
diff --git a/deps/v8/test/mjsunit/regress/regress-6703.js b/deps/v8/test/mjsunit/regress/regress-6703.js
new file mode 100644
index 00000000000..82bf21d55e7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-6703.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertTrue(/(\u039C)/i.test("\xB5"));
+assertTrue(/(\u039C)+/i.test("\xB5"));
+assertTrue(/(\u039C)/ui.test("\xB5"));
+assertTrue(/(\u039C)+/ui.test("\xB5"));
+
+assertTrue(/(\u03BC)/i.test("\xB5"));
+assertTrue(/(\u03BC)+/i.test("\xB5"));
+assertTrue(/(\u03BC)/ui.test("\xB5"));
+assertTrue(/(\u03BC)+/ui.test("\xB5"));
+
+assertTrue(/(\u03BC)/i.test("\u039C"));
+assertTrue(/(\u03BC)+/i.test("\u039C"));
+assertTrue(/(\u03BC)/ui.test("\u039C"));
+assertTrue(/(\u03BC)+/ui.test("\u039C"));
+
+assertTrue(/(\u0178)/i.test("\xFF"));
+assertTrue(/(\u0178)+/i.test("\xFF"));
+assertTrue(/(\u0178)/ui.test("\xFF"));
+assertTrue(/(\u0178)+/ui.test("\xFF"));
diff --git a/deps/v8/test/mjsunit/regress/regress-7254.js b/deps/v8/test/mjsunit/regress/regress-7254.js
new file mode 100644
index 00000000000..8231a8fd746
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-7254.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function foo(a) {
+  a[0];
+  a[1] = "";
+}
+
+foo([0,0].map(x => x));
+foo([0,0].map(x => x));
+%OptimizeFunctionOnNextCall(foo);
+foo([0,0].map(x => x));
+assertOptimized(foo);
diff --git a/deps/v8/test/mjsunit/regress/regress-7369.js b/deps/v8/test/mjsunit/regress/regress-7369.js
new file mode 100644
index 00000000000..de715ef6dcd
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-7369.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(-Infinity, 1/parseInt(-0.9));
+assertEquals(-Infinity, 1/parseInt("-0.9"));
+assertEquals(-Infinity, 1/parseInt(-0.09));
+assertEquals(-Infinity, 1/parseInt(-0.009));
diff --git a/deps/v8/test/mjsunit/regress/regress-7510.js b/deps/v8/test/mjsunit/regress/regress-7510.js
new file mode 100644
index 00000000000..0dd934573ae
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-7510.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function foo(a) {
+  for (const x of a) {
+    a[100] = 1;
+  }
+}
+
+foo([1]);
+foo([1]);
+%OptimizeFunctionOnNextCall(foo);
+foo([1]);
+%OptimizeFunctionOnNextCall(foo);
+foo([1]);
+assertOptimized(foo);
diff --git a/deps/v8/test/mjsunit/regress/regress-800651.js b/deps/v8/test/mjsunit/regress/regress-800651.js
new file mode 100644
index 00000000000..420cc7c294f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-800651.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+var list = [];
+function log(item) { list.push(item); }
+async function f() {
+  try {
+    let namespace = await import(/a/);
+  } catch(e) {
+    log(1);
+  }
+}
+f();
+
+async function g() {
+  try {
+    let namespace = await import({ get toString() { return undefined; }});
+  } catch(e) {
+    log(2);
+  }
+}
+g();
+  %RunMicrotasks();
+assertEquals(list, [1,2]);
diff --git a/deps/v8/test/mjsunit/regress/regress-803750.js b/deps/v8/test/mjsunit/regress/regress-803750.js
new file mode 100644
index 00000000000..3541ff9a35e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-803750.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Verify that very large arrays can be constructed.
+assertEquals(Array.isArray(Array.of.apply(Array, Array(65536))), true);
+assertEquals(Array.isArray(Array.of.apply(null, Array(65536))), true);
diff --git a/deps/v8/test/mjsunit/regress/regress-804096.js b/deps/v8/test/mjsunit/regress/regress-804096.js
new file mode 100644
index 00000000000..43a2ef47548
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-804096.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt
+
+for (let i = 0; i < 5000; i++) {
+  try {
+    [].reduce(function() {});
+  } catch (x) {
+  }
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-804176.js b/deps/v8/test/mjsunit/regress/regress-804176.js
new file mode 100644
index 00000000000..ab36c8ccbb9
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-804176.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const set_entries = [{}];
+set_entries[Symbol.iterator] = function() {};
+assertThrows(() => new Set(set_entries), TypeError);
+assertThrows(() => new WeakSet(set_entries), TypeError);
+
+const map_entries = [[{}, 1]];
+map_entries[Symbol.iterator] = function() {};
+assertThrows(() => new Set(map_entries), TypeError);
+assertThrows(() => new WeakSet(map_entries), TypeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-804177.js b/deps/v8/test/mjsunit/regress/regress-804177.js
new file mode 100644
index 00000000000..b1004805995
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-804177.js
@@ -0,0 +1,38 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Tests that insertion at the beginning via unshift won't crash when using a
+// constructor that creates an array larger than normal. (Also values inserted
+// by original constructor past the end should not survive into the result of
+// unshift).
+(function testUnshift() {
+  a = [1];
+  function f() {
+    return a;
+  }
+  b = Array.of.call(f);
+  b.unshift(2);
+  assertEquals(b, [2]);
+})();
+
+// Tests that insertion past the end won't expose values previously put into the
+// backing store by using a constructor that creates an array larger than normal.
+(function testInsertionPastEnd() {
+  a = [9,9,9,9];
+  function f() {
+    return a;
+  }
+  b = Array.of.call(f,1,2);
+  b[4] = 1;
+  assertEquals(b, [1, 2, undefined, undefined, 1]);
+})();
+
+// Tests that using Array.of with a constructor returning an object with an
+// unwriteable length throws a TypeError.
+(function testFrozenArrayThrows() {
+  function f() {
+    return Object.freeze([1,2,3]);
+  }
+  assertThrows(function() { Array.of.call(f); }, TypeError);
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-804188.js b/deps/v8/test/mjsunit/regress/regress-804188.js
new file mode 100644
index 00000000000..72fe8ef6516
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-804188.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(Array.prototype, Symbol.iterator, {
+  value: function* () {}
+});
+const arrayIteratorProto = Object.getPrototypeOf([][Symbol.iterator]());
+arrayIteratorProto.next = function() {};
+
+assertThrows(() => new Map([[{}, 1], [{}, 2]]), TypeError);
+assertThrows(() => new WeakMap([[{}, 1], [{}, 2]]), TypeError);
+assertThrows(() => new Set([{}]), TypeError);
+assertThrows(() => new WeakSet([{}]), TypeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-804288.js b/deps/v8/test/mjsunit/regress/regress-804288.js
new file mode 100644
index 00000000000..6f7855d68c0
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-804288.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var arr = [{}];
+Object.setPrototypeOf(arr, {});
+var ta = new Uint8Array(arr);
+
+let kDeclNoLocals = 0;
diff --git a/deps/v8/test/mjsunit/regress/regress-804801.js b/deps/v8/test/mjsunit/regress/regress-804801.js
new file mode 100644
index 00000000000..daec8dc92fd
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-804801.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() { return 42; }
+const bound_function = f.bind();
+const callable_proxy = new Proxy(function(){}.__proto__, {});
+
+function testSet(ctor) {
+  new ctor([]);
+  new ctor([{},{}]);
+}
+
+function testMap(ctor) {
+  new ctor([]);
+  new ctor([[{},{}],[{},{}]]);
+}
+
+function testAllVariants(set_or_add_function) {
+  Set.prototype.add = set_or_add_function;
+  testSet(Set);
+
+  WeakSet.prototype.add = set_or_add_function;
+  testSet(WeakSet);
+
+  Map.prototype.set = set_or_add_function;
+  testMap(Map);
+
+  WeakMap.prototype.set = set_or_add_function;
+  testMap(WeakMap);
+}
+
+testAllVariants(bound_function);
+testAllVariants(callable_proxy);
diff --git a/deps/v8/test/mjsunit/regress/regress-804837.js b/deps/v8/test/mjsunit/regress/regress-804837.js
new file mode 100644
index 00000000000..2e5e603a7fa
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-804837.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --allow-natives-syntax
+
+var __v_25662 = [, 1.8];
+function __f_6214(__v_25668) {
+     __v_25662.reduce(() => {1});
+}
+__f_6214();
+__f_6214();
+%OptimizeFunctionOnNextCall(__f_6214);
+__f_6214();
diff --git a/deps/v8/test/mjsunit/regress/regress-805729.js b/deps/v8/test/mjsunit/regress/regress-805729.js
new file mode 100644
index 00000000000..0703aa2ad8e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-805729.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+async function* asyncGenerator() {};
+let gen = asyncGenerator();
+gen.return({ get then() { delete this.then; gen.next(); } });
diff --git a/deps/v8/test/mjsunit/regress/regress-805768.js b/deps/v8/test/mjsunit/regress/regress-805768.js
new file mode 100644
index 00000000000..e36106fdb3e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-805768.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  var a = [''];
+  print(a[0]);
+  return a;
+}
+
+function bar(a) { a[0] = "bazinga!"; }
+
+for (var i = 0; i < 5; i++) bar([]);
+
+%OptimizeFunctionOnNextCall(bar);
+bar(foo());
+assertEquals([''], foo());
diff --git a/deps/v8/test/mjsunit/regress/regress-812451.js b/deps/v8/test/mjsunit/regress/regress-812451.js
new file mode 100644
index 00000000000..8ccad1d124b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-812451.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var x = [];
+function foo(x, p) {
+  x[p] = 5.3;
+}
+foo(x, 1);
+foo(x, 2);
+foo(x, -1);
+gc();
diff --git a/deps/v8/test/mjsunit/regress/regress-813440.js b/deps/v8/test/mjsunit/regress/regress-813440.js
new file mode 100644
index 00000000000..d2aef2528bc
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-813440.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --invoke-weak-callbacks --omit-quit --wasm-async-compilation --expose-wasm --allow-natives-syntax
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+const builder = new WasmModuleBuilder();
+builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 42]);
+const buffer = builder.toBuffer();
+// Start async compilation, but don't wait for it to finish.
+const module = WebAssembly.compile(buffer);
+
+// This create the collator.
+'퓛'.localeCompare();
diff --git a/deps/v8/test/mjsunit/regress/regress-814643.js b/deps/v8/test/mjsunit/regress/regress-814643.js
new file mode 100644
index 00000000000..085c56fe84f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-814643.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Number.prototype.__proto__ = String.prototype;
+Uint8Array.from(1);
diff --git a/deps/v8/test/mjsunit/regress/regress-816289.js b/deps/v8/test/mjsunit/regress/regress-816289.js
new file mode 100644
index 00000000000..4a3a4b629de
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-816289.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+delete String.prototype[Symbol.iterator];
+Int8Array.from("anything");
diff --git a/deps/v8/test/mjsunit/regress/regress-816317.js b/deps/v8/test/mjsunit/regress/regress-816317.js
new file mode 100644
index 00000000000..304786e694e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-816317.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let a = new Float64Array(15);
+Object.defineProperty(a, "length", {
+  get: function () {
+    return 6;
+  }
+});
+delete a.__proto__.__proto__[Symbol.iterator];
+Float64Array.from(a);
diff --git a/deps/v8/test/mjsunit/regress/regress-818070.js b/deps/v8/test/mjsunit/regress/regress-818070.js
new file mode 100644
index 00000000000..7afb695b29d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-818070.js
@@ -0,0 +1,35 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --no-always-opt --allow-natives-syntax
+
+function f(a) {
+  Math.imul(a);
+}
+
+x = { [Symbol.toPrimitive]: () => FAIL };
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(() => f(x), ReferenceError);
+
+function f(a) {
+  Math.pow(a);
+}
+
+x = { [Symbol.toPrimitive]: () => FAIL };
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(() => f(x), ReferenceError);
+
+function f(a) {
+  Math.atan2(a);
+}
+
+x = { [Symbol.toPrimitive]: () => FAIL };
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(() => f(x), ReferenceError);
diff --git a/deps/v8/test/mjsunit/regress/regress-818438.js b/deps/v8/test/mjsunit/regress/regress-818438.js
new file mode 100644
index 00000000000..67f235df32a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-818438.js
@@ -0,0 +1,55 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo(b) {
+  [,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ...b];
+}
+Array.prototype.__defineSetter__("0", () => {});
+foo([3.3, 3.3, 3.3]);
+foo([{}, 3.3]);
diff --git a/deps/v8/test/mjsunit/regress/regress-821137.js b/deps/v8/test/mjsunit/regress/regress-821137.js
new file mode 100644
index 00000000000..639b3b998a5
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-821137.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Tests that creating an iterator that shrinks the array populated by
+// Array.from does not lead to out of bounds writes.
+let oobArray = [];
+let maxSize = 1028 * 8;
+Array.from.call(function() { return oobArray }, {[Symbol.iterator] : _ => (
+  {
+    counter : 0,
+    next() {
+      let result = this.counter++;
+      if (this.counter > maxSize) {
+        oobArray.length = 0;
+        return {done: true};
+      } else {
+        return {value: result, done: false};
+      }
+    }
+  }
+) });
+assertEquals(oobArray.length, maxSize);
+
+// iterator reset the length to 0 just before returning done, so this will crash
+// if the backing store was not resized correctly.
+oobArray[oobArray.length - 1] = 0x41414141;
diff --git a/deps/v8/test/mjsunit/regress/regress-821368.js b/deps/v8/test/mjsunit/regress/regress-821368.js
new file mode 100644
index 00000000000..b41261d7c9f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-821368.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const worker = new Worker("onmessage = function(){}");
+const buffer = new ArrayBuffer();
+worker.postMessage(buffer, [buffer]);
+try {
+  worker.postMessage(buffer, [buffer]);
+} catch (e) {
+  if (e != "ArrayBuffer could not be transferred") {
+    throw e;
+  }
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-995.js b/deps/v8/test/mjsunit/regress/regress-995.js
index 3f99179104a..cf680da1e79 100644
--- a/deps/v8/test/mjsunit/regress/regress-995.js
+++ b/deps/v8/test/mjsunit/regress/regress-995.js
@@ -39,14 +39,6 @@ function f(value) {
 }
 f(new String("bar"));
 
-// HClassOf.
-function g(value) {
-  if (%_ClassOf(value) === 'Date') {
-    if (%_ClassOf(value) === 'String') assertTrue(false);
-  }
-}
-g(new Date());
-
 // HIsNull.
 function h(value) {
   if (value == null) {
diff --git a/deps/v8/test/mjsunit/regress/regress-arguments-gc.js b/deps/v8/test/mjsunit/regress/regress-arguments-gc.js
deleted file mode 100644
index b5ed608e0e7..00000000000
--- a/deps/v8/test/mjsunit/regress/regress-arguments-gc.js
+++ /dev/null
@@ -1,37 +0,0 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --expose-gc --nocleanup-code-caches-at-gc
-
-function f(x) {
-  gc();
-  arguments[0] = {};
-}
-
-f(1);
-f(1);
-f(1);
diff --git a/deps/v8/test/mjsunit/regress/regress-charat-empty.js b/deps/v8/test/mjsunit/regress/regress-charat-empty.js
new file mode 100644
index 00000000000..6548ad5b2fd
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-charat-empty.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --no-always-opt --allow-natives-syntax
+(() => {
+  function f(s) {
+    return s.charAt();
+  }
+  f("");
+  f("");
+  %OptimizeFunctionOnNextCall(f);
+  f("");
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-109362.js b/deps/v8/test/mjsunit/regress/regress-crbug-109362.js
index 20285f614d1..cf7cd4e5fa7 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-109362.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-109362.js
@@ -14,15 +14,16 @@ function test(expectation, f) {
 }
 
 /*
-(function() {
+(function(
+) {
 1 + reference_error //@ sourceURL=evaltest
 })
 */
-test("2:5", new Function(
+test("3:5", new Function(
     '1 + reference_error //@ sourceURL=evaltest'));
 /*
 (function(x
-/\**\/) {
+) {
 
  1 + reference_error //@ sourceURL=evaltest
 })
@@ -34,7 +35,7 @@ test("4:6", new Function(
 
 ,z//
 ,y
-/\**\/) {
+) {
 
  1 + reference_error //@ sourceURL=evaltest
 })
@@ -44,7 +45,7 @@ test("7:6", new Function(
 /*
 (function(x/\*,z//
 ,y*\/
-/\**\/) {
+) {
 1 + reference_error //@ sourceURL=evaltest
 })
 */
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-474297.js b/deps/v8/test/mjsunit/regress/regress-crbug-474297.js
deleted file mode 100644
index ce240251bdb..00000000000
--- a/deps/v8/test/mjsunit/regress/regress-crbug-474297.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --gc-interval=33 --expose-gc --allow-natives-syntax
-
-var Debug = %GetDebugContext().Debug;
-Debug.setListener(function(){});
-
-%DebugGetLoadedScripts();
-
-Debug.setListener(null);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-663410.js b/deps/v8/test/mjsunit/regress/regress-crbug-663410.js
index 5bef089f117..6d2a4877155 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-663410.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-663410.js
@@ -4,5 +4,5 @@
 
 function alert(x) {};
 assertThrows(
-  Function("a=`","`,xss=1){alert(xss)")
+  'Function("a=`","`,xss=1){alert(xss)")'
 );
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-802333.js b/deps/v8/test/mjsunit/regress/regress-crbug-802333.js
new file mode 100644
index 00000000000..35d762187bc
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-802333.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function deferred_func() {
+    class C {
+        method1() {
+
+        }
+    }
+}
+
+let bound = (a => a).bind(this, 0);
+
+function opt() {
+    deferred_func.prototype;  // ReduceJSLoadNamed
+
+    return bound();
+}
+
+assertEquals(0, opt());
+%OptimizeFunctionOnNextCall(opt);
+
+assertEquals(0, opt());
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-805765.js b/deps/v8/test/mjsunit/regress/regress-crbug-805765.js
new file mode 100644
index 00000000000..b630efb4c72
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-805765.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var code = "(function* gen() {"
+for (var i = 0; i < 256; ++i) {
+  code += `var v_${i} = 0;`
+}
+code += `yield; })`
+
+var gen = eval(code);
+var g = gen();
+g.next();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-806200.js b/deps/v8/test/mjsunit/regress/regress-crbug-806200.js
new file mode 100644
index 00000000000..dbd66019a5b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-806200.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertThrows("%Foo(...spread)", SyntaxError);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-808192.js b/deps/v8/test/mjsunit/regress/regress-crbug-808192.js
index 3336c0043e0..f57d5fc3a69 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-808192.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-808192.js
@@ -2,8 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// TODO(cbruni): enable always opt once v8:7438
-// Flags: --expose-gc --no-always-opt
+// Flags: --expose-gc
 
 const f = eval(`(function f(i) {
   if (i == 0) {
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-813450.js b/deps/v8/test/mjsunit/regress/regress-crbug-813450.js
new file mode 100644
index 00000000000..b301012950d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-813450.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var constructorArgs = new Array(0x10100);
+var constructor = function() {};
+var target = new Proxy(constructor, {
+  construct: function() {
+  }
+});
+var proxy = new Proxy(target, {
+  construct: function(newTarget, args) {
+    return Reflect.construct(constructor, []);
+  }
+});
+var instance = new proxy();
+var instance2 = Reflect.construct(proxy, constructorArgs);
+%HeapObjectVerify(target);
+%HeapObjectVerify(proxy);
+%HeapObjectVerify(instance);
+%HeapObjectVerify(instance2);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-813630.js b/deps/v8/test/mjsunit/regress/regress-crbug-813630.js
new file mode 100644
index 00000000000..7ec9e35c0d9
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-813630.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Regression test for a bug where aborting a function which has a rest
+// parameter didn't work correctly.
+function g(...args) {
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-816961.js b/deps/v8/test/mjsunit/regress/regress-crbug-816961.js
new file mode 100644
index 00000000000..c1637ad2c54
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-816961.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function() {
+  var memory = new WebAssembly.Memory({initial: 64 * 1024 * 1024 / 0x10000});
+  var array = new Uint8Array(memory.buffer);
+  Uint8Array.of.call(function() { return array },
+                    {valueOf() { memory.grow(1); } });
+}, TypeError);
+
+assertThrows(function() {
+  var memory = new WebAssembly.Memory({initial: 64 * 1024 * 1024 / 0x10000});
+  var array = new Uint8Array(memory.buffer);
+  Uint8Array.from.call(function() { return array },
+                       [{valueOf() { memory.grow(1); } }],
+                       x => x);
+}, TypeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-819086.js b/deps/v8/test/mjsunit/regress/regress-crbug-819086.js
new file mode 100644
index 00000000000..85f76a1fb5d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-819086.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  return [...[, -Infinity]];
+}
+
+foo()[0];
+foo()[0];
+%OptimizeFunctionOnNextCall(foo);
+foo()[0];
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-819298.js b/deps/v8/test/mjsunit/regress/regress-crbug-819298.js
new file mode 100644
index 00000000000..0c28aeb48c8
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-819298.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Int32Array(2);
+
+function foo(base) {
+  a[base - 91] = 1;
+}
+
+foo("");
+foo("");
+%OptimizeFunctionOnNextCall(foo);
+foo(NaN);
+assertEquals(0, a[0]);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-820312.js b/deps/v8/test/mjsunit/regress/regress-crbug-820312.js
new file mode 100644
index 00000000000..448d4e97c0f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-820312.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let arr = new Array(0x10000);
+let resolve_element_closures = new Array(0x10000);
+
+for (let i = 0; i < arr.length; i++) {
+    arr[i] = new Promise(() => {});
+    arr[i].then = ((idx, resolve) => {
+        resolve_element_closures[idx] = resolve;
+    }).bind(null, i);
+}
+
+Promise.all(arr);
+
+// 0xffff is too large, transitions to DICTIONARY_ELEMENTS
+resolve_element_closures[0xffff]();
+
+// grows the capacity, the elements kind of the result array is still DICTIONARY_ELEMENTS, but the elements object of it is no more a dictionary.
+resolve_element_closures[100]();
+
+// You can observe that V8 crashes here in debug mode.
+resolve_element_closures[0xfffe]();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-820820.js b/deps/v8/test/mjsunit/regress/regress-crbug-820820.js
new file mode 100644
index 00000000000..bdee5589917
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-820820.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function* generator() {
+  yield undefined;
+}
+function bar(x) {
+  const objects = [];
+  for (let obj of generator()) {
+  }
+  return objects[0];
+}
+function foo() {
+  try { undefined[0] = bar(); } catch (e) { }
+  Math.min(bar(), bar(), bar());
+}
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-821159-1.js b/deps/v8/test/mjsunit/regress/regress-crbug-821159-1.js
new file mode 100644
index 00000000000..058688a340b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-821159-1.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Array.prototype[0] = 0;
+Math.max(...[3]);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-821159-2.js b/deps/v8/test/mjsunit/regress/regress-crbug-821159-2.js
new file mode 100644
index 00000000000..a982068c9b3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-821159-2.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Object.prototype[0] = 0;
+Math.max(...[3]);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-821159-3.js b/deps/v8/test/mjsunit/regress/regress-crbug-821159-3.js
new file mode 100644
index 00000000000..2bb09c76feb
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-821159-3.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Array.prototype[0] = 0;
+Math.max(...[3.1]);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-821159-4.js b/deps/v8/test/mjsunit/regress/regress-crbug-821159-4.js
new file mode 100644
index 00000000000..ec596c60da2
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-821159-4.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Object.prototype[0] = 0;
+Math.max(...[3.1]);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-822284.js b/deps/v8/test/mjsunit/regress/regress-crbug-822284.js
new file mode 100644
index 00000000000..97a38259e34
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-822284.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a) {
+  a = "" + Math.abs(a);
+  return a.charCodeAt(0);
+}
+
+// Add '1' to the number to string table (as SeqString).
+String.fromCharCode(49);
+
+// Turn the SeqString into a ThinString via forced internalization.
+const o = {};
+o[(1).toString()] = 1;
+
+assertEquals(49, foo(1));
+assertEquals(49, foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(49, foo(1));
diff --git a/deps/v8/test/mjsunit/regress/regress-store-transition-dict.js b/deps/v8/test/mjsunit/regress/regress-store-transition-dict.js
new file mode 100644
index 00000000000..8199a1d8125
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-store-transition-dict.js
@@ -0,0 +1,84 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function SetX(o, v) {
+    o.x = v;
+  }
+
+  function SetY(o, v) {
+    o.y = v;
+  }
+
+  var p = {};
+
+  function Create() {
+    var o = {__proto__:p, b:1, a:2};
+    delete o.b;
+    assertFalse(%HasFastProperties(o));
+    return o;
+  }
+
+  for (var i = 0; i < 10; i++) {
+    var o = Create();
+    SetX(o, 13);
+    SetY(o, 13);
+  }
+
+  Object.defineProperty(p, "x", {value:42, configurable: true, writable: false});
+
+  for (var i = 0; i < 10; i++) {
+    var o = Create();
+    SetY(o, 13);
+  }
+
+  var o = Create();
+  assertEquals(42, o.x);
+  SetX(o, 13);
+  assertEquals(42, o.x);
+})();
+
+
+(function() {
+  var p1 = {a:10};
+  Object.defineProperty(p1, "x", {value:42, configurable: true, writable: false});
+
+  var p2 = {__proto__: p1, x:153};
+  for (var i = 0; i < 2000; i++) {
+    p1["p" + i] = 0;
+    p2["p" + i] = 0;
+  }
+  assertFalse(%HasFastProperties(p1));
+  assertFalse(%HasFastProperties(p2));
+
+  function GetX(o) {
+    return o.x;
+  }
+  function SetX(o, v) {
+    o.x = v;
+  }
+
+  function Create() {
+    var o = {__proto__:p2, b:1, a:2};
+    return o;
+  }
+
+  for (var i = 0; i < 10; i++) {
+    var o = Create();
+    assertEquals(153, GetX(o));
+    SetX(o, 13);
+    assertEquals(13, GetX(o));
+  }
+
+  delete p2.x;
+  assertFalse(%HasFastProperties(p1));
+  assertFalse(%HasFastProperties(p2));
+
+  var o = Create();
+  assertEquals(42, GetX(o));
+  SetX(o, 13);
+  assertEquals(42, GetX(o));
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-stringAt-boundsCheck.js b/deps/v8/test/mjsunit/regress/regress-stringAt-boundsCheck.js
new file mode 100644
index 00000000000..2e14aa027c7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-stringAt-boundsCheck.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --allow-natives-syntax
+
+(() => {
+  function f(u) {
+    for (var j = 0; j < 20; ++j) {
+        print("" + u.codePointAt());
+    }
+  }
+
+  f("test");
+  f("foo");
+  %OptimizeFunctionOnNextCall(f);
+  f("");
+})();
diff --git a/deps/v8/test/mjsunit/regress/string-next-encoding.js b/deps/v8/test/mjsunit/regress/string-next-encoding.js
new file mode 100644
index 00000000000..27b99a9c9e5
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/string-next-encoding.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --allow-natives-syntax
+
+function f() {
+  var s = "äϠ�𝌆";
+  var i = s[Symbol.iterator]();
+  assertEquals("ä", i.next().value);
+  assertEquals("Ϡ", i.next().value);
+  assertEquals("�", i.next().value);
+  assertEquals("𝌆", i.next().value);
+  assertSame(undefined, i.next().value);
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7353.js b/deps/v8/test/mjsunit/regress/wasm/regress-7353.js
new file mode 100644
index 00000000000..d41cbabf363
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7353.js
@@ -0,0 +1,29 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32);
+builder.addFunction('grow', kSig_i_i).addBody([
+  kExprGetLocal, 0,
+  kExprGrowMemory, 0,
+]).exportFunc();
+builder.addFunction('main', kSig_i_i).addBody([
+  ...wasmI32Const(0x41),
+  kExprSetLocal, 0,
+  // Enter loop, such that values are spilled to the stack.
+  kExprLoop, kWasmStmt,
+  kExprEnd,
+  // Reload value. This must be loaded as 32 bit value.
+  kExprGetLocal, 0,
+  kExprI32LoadMem, 0, 0,
+]).exportFunc();
+const instance = builder.instantiate();
+// Execute grow, such that the stack contains garbage data afterwards.
+instance.exports.grow(1);
+instance.exports.main();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7364.js b/deps/v8/test/mjsunit/regress/wasm/regress-7364.js
new file mode 100644
index 00000000000..8e66295b70a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7364.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const exportingModuleBinary = (() => {
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 42]).exportFunc();
+  return builder.toBuffer();
+})();
+
+const exportingModule = new WebAssembly.Module(exportingModuleBinary);
+const exportingInstance = new WebAssembly.Instance(exportingModule);
+
+const reExportingModuleBinary = (() => {
+  const builder = new WasmModuleBuilder();
+  const gIndex = builder.addImport('a', 'g', kSig_i_v);
+  builder.addExport('y', gIndex);
+  return builder.toBuffer();
+})();
+
+const module = new WebAssembly.Module(reExportingModuleBinary);
+const imports = {
+  a: {g: exportingInstance.exports.f},
+};
+const instance = new WebAssembly.Instance(module, imports);
+
+// Previously exported Wasm functions are re-exported with the same value
+assertEquals(instance.exports.y, exportingInstance.exports.f);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7366.js b/deps/v8/test/mjsunit/regress/wasm/regress-7366.js
new file mode 100644
index 00000000000..41f758efb15
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7366.js
@@ -0,0 +1,33 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_i_iii).addBody([
+  // Return the sum of all arguments.
+  kExprGetLocal, 0, kExprGetLocal, 1, kExprGetLocal, 2, kExprI32Add, kExprI32Add
+]);
+const sig = builder.addType(kSig_i_iii);
+builder.addFunction(undefined, kSig_i_iii)
+    .addBody([
+      ...wasmI32Const(1),         // i32.const 0x1
+      kExprSetLocal, 0,           // set_local 0
+      ...wasmI32Const(4),         // i32.const 0x1
+      kExprSetLocal, 1,           // set_local 1
+      ...wasmI32Const(16),        // i32.const 0x1
+      kExprSetLocal, 2,           // set_local 2
+      kExprLoop, kWasmStmt,       // loop
+      kExprEnd,                   // end
+      kExprGetLocal, 0,           // get_local 0
+      kExprGetLocal, 1,           // get_local 1
+      kExprGetLocal, 2,           // get_local 2
+      kExprI32Const, 0,           // i32.const 0 (func index)
+      kExprCallIndirect, sig, 0,  // call indirect
+    ])
+    .exportAs('main');
+builder.appendToTable([0]);
+const instance = builder.instantiate();
+assertEquals(21, instance.exports.main());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7422.js b/deps/v8/test/mjsunit/regress/wasm/regress-7422.js
new file mode 100644
index 00000000000..87896b4c35b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7422.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+sig = makeSig([kWasmI32, kWasmI32, kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+builder.addFunction(undefined, sig).addBody([kExprGetLocal, 4]);
+builder.addMemory(16, 32);
+builder.addFunction('main', sig)
+    .addBody([
+      kExprI32Const, 0, kExprSetLocal, 0,
+      // Compute five arguments to the function call.
+      kExprI32Const, 0, kExprI32Const, 0, kExprI32Const, 0, kExprI32Const, 0,
+      kExprGetLocal, 4, kExprI32Const, 1, kExprI32Add,
+      // Now some intermediate computation to force the arguments to be spilled
+      // to the stack:
+      kExprGetLocal, 0, kExprI32Const, 1, kExprI32Add, kExprGetLocal, 1,
+      kExprGetLocal, 1, kExprI32Add, kExprI32Add, kExprDrop,
+      // Now call the function.
+      kExprCallFunction, 0
+    ])
+    .exportFunc();
+var instance = builder.instantiate();
+assertEquals(11, instance.exports.main(2, 4, 6, 8, 10));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7499.js b/deps/v8/test/mjsunit/regress/wasm/regress-7499.js
new file mode 100644
index 00000000000..71f246decfc
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7499.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32);
+builder.addFunction(undefined, kSig_v_v).addBody([
+  kExprI32Const, 0,  // i32.const 0
+  kExprI64LoadMem, 0, 0xff, 0xff, 0xff, 0xff,
+  0x0f,       // i64.load align=0 offset=0xffffffff
+  kExprDrop,  // drop
+]);
+builder.addExport('main', 0);
+const module = builder.instantiate();
+assertThrows(
+    () => module.exports.main(), WebAssembly.RuntimeError, /out of bounds/);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7508.js b/deps/v8/test/mjsunit/regress/wasm/regress-7508.js
new file mode 100644
index 00000000000..7c07d2d7e36
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7508.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_v_v).addLocals({i64_count: 1}).addBody([
+  kExprI64Const, 0xeb,     0xd7, 0xaf, 0xdf,
+  0xbe,          0xfd,     0xfa, 0xf5, 0x6b,  // i64.const
+  kExprI32Const, 0,                           // i32.const
+  kExprIf,       kWasmI32,                    // if i32
+  kExprI32Const, 0,                           // i32.const
+  kExprElse,                                  // else
+  kExprI32Const, 0,                           // i32.const
+  kExprEnd,                                   // end
+  kExprBrIf,     0,                           // br_if depth=0
+  kExprSetLocal, 0,                           // set_local 0
+]);
+builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7565.js b/deps/v8/test/mjsunit/regress/wasm/regress-7565.js
new file mode 100644
index 00000000000..055bfc0c594
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7565.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+sig0 = makeSig([], [kWasmI32]);
+builder.addFunction(undefined, sig0).addLocals({i64_count: 1}).addBody([
+  kExprLoop, kWasmI32,                    // loop i32
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,  // f32.const 0      --> f32:0
+  kExprGetLocal, 0x00,                    // get_local 0      --> i64:0
+  kExprF32SConvertI64,                    // f32.sconvert/i64 --> f32:0
+  kExprF32Ge,                             // f32.ge           --> i32:1
+  kExprEnd,                               // end
+]);
+builder.addExport('main', 0);
+const module = builder.instantiate();
+assertEquals(1, module.exports.main());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7579.js b/deps/v8/test/mjsunit/regress/wasm/regress-7579.js
new file mode 100644
index 00000000000..40cf12317fc
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7579.js
@@ -0,0 +1,62 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+// Generate function 1 (out of 2).
+sig0 = makeSig([], [kWasmI32]);
+builder.addFunction(undefined, sig0)
+  .addBody([
+    kExprI64Const, 0xc8, 0xda, 0x9c, 0xbc, 0xf8, 0xf0, 0xe1, 0xc3, 0x87, 0x7f,
+    kExprLoop, kWasmF64,
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      kExprCallFunction, 0x01,
+      ...wasmF64Const(0),
+      kExprEnd,
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    kExprCallFunction, 0x01,
+    kExprI64Const, 0xb9, 0xf2, 0xe4, 0x01,
+    kExprI64LtS]);
+// Generate function 2 (out of 2).
+sig1 = makeSig(new Array(12).fill(kWasmF64), []);
+builder.addFunction(undefined, sig1).addBody([]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(1, instance.exports.main());
+
+const builder2 = new WasmModuleBuilder();
+sig0 = makeSig([], [kWasmI32]);
+builder2.addFunction(undefined, sig0).addLocals({i64_count: 1}).addBody([
+  kExprLoop, kWasmI32,     // loop i32
+  kExprGetLocal, 0,        // get_local 3
+  kExprF32SConvertI64,     // f32.sconvert/i64
+  kExprI32ReinterpretF32,  // i32.reinterpret/f32
+  kExprEnd                 // end
+]);
+builder2.addExport('main', 0);
+const instance2 = builder2.instantiate();
+assertEquals(0, instance2.exports.main());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7582.js b/deps/v8/test/mjsunit/regress/wasm/regress-7582.js
new file mode 100644
index 00000000000..476a0e18e8b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7582.js
@@ -0,0 +1,48 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addGlobal(kWasmI32, 1);
+sig0 = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+builder.addFunction(undefined, sig0)
+  .addBody([
+kExprF32Const, 0x01, 0x00, 0x00, 0x00,
+kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+kExprF32Eq,  // --> i32:0
+kExprF32Const, 0xc9, 0xc9, 0x69, 0xc9,
+kExprF32Const, 0xc9, 0xc9, 0xc9, 0x00,
+kExprF32Eq,  // --> i32:0 i32:0
+kExprIf, kWasmF32,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+kExprElse,   // @32
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+  kExprEnd,   // --> i32:0 f32:0
+kExprF32Const, 0xc9, 0x00, 0x00, 0x00,
+kExprF32Const, 0xc9, 0xc9, 0xc9, 0x00,
+kExprF32Const, 0xc9, 0xc9, 0xa0, 0x00, // --> i32:0 f32:0 f32 f32 f32
+kExprF32Eq,  // --> i32:0 f32:0 f32 i32:0
+kExprIf, kWasmF32,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+kExprElse,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+  kExprEnd,  // --> i32:0 f32:0 f32 f32:0
+kExprF32Eq,  // --> i32:0 f32:0 i32:0
+kExprIf, kWasmF32,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+kExprElse,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+  kExprEnd,   // --> i32:0 f32:0 f32:0
+kExprF32Const, 0xc9, 0xc9, 0xff, 0xff,  // --> i32:0 f32:0 f32:0 f32
+kExprF32Eq,  // --> i32:0 f32:0 i32:0
+kExprDrop,
+kExprDrop, // --> i32:0
+kExprI32Const, 1, // --> i32:0 i32:1
+kExprI32GeU,  // --> i32:0
+          ]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(0, instance.exports.main(1, 2, 3));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-801785.js b/deps/v8/test/mjsunit/regress/wasm/regress-801785.js
new file mode 100644
index 00000000000..1870d7e8f1e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-801785.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// Flags: --print-wasm-code
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(8, 16);
+builder.addFunction(undefined, kSig_i_i).addBody([
+  // wasm to wasm call.
+  kExprGetLocal, 0, kExprCallFunction, 0x1
+]);
+builder.addFunction(undefined, kSig_i_i).addBody([
+  // load from <get_local 0> to create trap code.
+  kExprGetLocal, 0, kExprI32LoadMem, 0,
+  // unreachable to create a runtime call.
+  kExprUnreachable
+]);
+builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-803427.js b/deps/v8/test/mjsunit/regress/wasm/regress-803427.js
new file mode 100644
index 00000000000..833b140fd47
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-803427.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+let module = new WebAssembly.Module(builder.toBuffer());
+var worker = new Worker('onmessage = function() {};');
+worker.postMessage(module)
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-803788.js b/deps/v8/test/mjsunit/regress/wasm/regress-803788.js
new file mode 100644
index 00000000000..8edec7c4645
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-803788.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+let q_table = builder.addImportedTable("q", "table")
+let q_base = builder.addImportedGlobal("q", "base", kWasmI32);
+let q_fun = builder.addImport("q", "fun", kSig_v_v);
+builder.addType(kSig_i_ii);
+builder.addFunctionTableInit(q_base, true, [ q_fun ])
+let module = new WebAssembly.Module(builder.toBuffer());
+let table = new WebAssembly.Table({
+  element: "anyfunc",
+  initial: 10,
+});
+let instance = new WebAssembly.Instance(module, {
+  q: {
+    base: 0,
+    table: table,
+    fun: () => (0)
+  }
+});
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-808012.js b/deps/v8/test/mjsunit/regress/wasm/regress-808012.js
new file mode 100644
index 00000000000..1b91f226a88
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-808012.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction('test', kSig_i_i).addBody([kExprUnreachable]);
+let module = new WebAssembly.Module(builder.toBuffer());
+var worker = new Worker('onmessage = function() {};');
+worker.postMessage(module);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-808848.js b/deps/v8/test/mjsunit/regress/wasm/regress-808848.js
new file mode 100644
index 00000000000..bb3b89a3601
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-808848.js
@@ -0,0 +1,71 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// The number of locals must be greater than the constant defined here:
+// https://cs.chromium.org/chromium/src/v8/src/compiler/x64/code-generator-x64.cc?l=3146
+const kNumLocals = 128;
+
+function varuint32(val) {
+  let bytes = [];
+  for (let i = 0; i < 4; ++i) {
+    bytes.push(0x80 | ((val >> (7 * i)) & 0x7f));
+  }
+  bytes.push((val >> (7 * 4)) & 0x7f);
+  return bytes;
+}
+
+// Generate a function that calls the "get" import `kNumLocals` times, and
+// stores each result in a local, then calls the "call" import `kNumLocals`
+// times with the stored local values.
+//
+// The intention is to create a function that has a large stack frame.
+let body = [];
+
+for (let i = 0; i < kNumLocals; ++i) {
+  body.push(kExprCallFunction, 0, kExprSetLocal, ...varuint32(i));
+}
+
+for (let i = 0; i < kNumLocals; ++i) {
+  body.push(kExprGetLocal, ...varuint32(i), kExprCallFunction, 1);
+}
+
+let builder = new WasmModuleBuilder();
+builder.addImport('mod', 'get', kSig_i_v);
+builder.addImport('mod', 'call', kSig_v_i);
+builder.
+  addFunction('main', kSig_v_v).
+  addLocals({i32_count: kNumLocals}).
+  addBody(body).
+  exportAs('main');
+let m1_bytes = builder.toBuffer();
+let m1 = new WebAssembly.Module(m1_bytes);
+
+// Serialize the module and postMessage it to another thread.
+let serialized_m1 = %SerializeWasmModule(m1);
+
+let workerScript =
+  `onmessage = function(msg) {
+    let {serialized_m1, m1_bytes} = msg;
+
+    try {
+      let m1_clone = %DeserializeWasmModule(serialized_m1, m1_bytes);
+      let imports = {mod: {get: () => 3, call: () => {}}};
+      let i2 = new WebAssembly.Instance(m1_clone, imports);
+      i2.exports.main();
+      postMessage('done');
+    } catch(e) {
+      postMessage('done w/ exception');
+    }
+  }`;
+
+let worker = new Worker(workerScript);
+worker.postMessage({serialized_m1, m1_bytes});
+
+// Wait for worker to finish.
+print(worker.getMessage());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-810973.js b/deps/v8/test/mjsunit/regress/wasm/regress-810973.js
new file mode 100644
index 00000000000..5a776884eea
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-810973.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+  this.WScript = new Proxy({}, {
+    get() {
+      switch (name) {
+      }
+    }
+  });
+function MjsUnitAssertionError() {
+};
+let __v_692 = `(function module() { "use asm";function foo(`;
+const __v_693 =
+3695;
+for (let __v_695 = 0; __v_695 < __v_693; ++__v_695) {
+    __v_692 += `arg${__v_695},`;
+}
+try {
+  __v_692 += `arg${__v_693}){`;
+} catch (e) {}
+for (let __v_696 = 0; __v_696 <= __v_693; ++__v_696) {
+    __v_692 += `arg${__v_696}=+arg${__v_696};`;
+}
+  __v_692 += "return 10;}function bar(){return foo(";
+for (let __v_697 = 0; __v_697 < __v_693; ++__v_697) {
+    __v_692 += "0.0,";
+}
+  __v_692 += "1.0)|0;}";
+
+  __v_692 += "return bar})()()";
+const __v_694 = eval(__v_692);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-812005.js b/deps/v8/test/mjsunit/regress/wasm/regress-812005.js
new file mode 100644
index 00000000000..979b769bbc2
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-812005.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_d_v).addBody([
+  ...wasmF64Const(0),  // f64.const 0
+  ...wasmF64Const(0),  // f64.const 0
+  ...wasmI32Const(0),  // i32.const 0
+  kExprBrIf, 0x00,     // br_if depth=0
+  kExprF64Add          // f64.add
+]);
+builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-816226.js b/deps/v8/test/mjsunit/regress/wasm/regress-816226.js
new file mode 100644
index 00000000000..a9cb7155700
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-816226.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(new Int8Array((new WebAssembly.Memory({})).buffer)).buffer;
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-817380.js b/deps/v8/test/mjsunit/regress/wasm/regress-817380.js
new file mode 100644
index 00000000000..e6047ea2314
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-817380.js
@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder1 = new WasmModuleBuilder();
+builder1.addFunction('mul', kSig_i_ii)
+    .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32Mul])
+    .exportFunc();
+const mul = builder1.instantiate().exports.mul;
+const table = new WebAssembly.Table({
+  element: 'anyfunc',
+  initial: 10,
+});
+const builder2 = new WasmModuleBuilder();
+const mul_import = builder2.addImport('q', 'wasm_mul', kSig_i_ii);
+builder2.addImportedTable('q', 'table');
+const glob_import = builder2.addImportedGlobal('q', 'glob', kWasmI32);
+builder2.addFunctionTableInit(glob_import, true, [mul_import]);
+builder2.instantiate(
+    {q: {glob: 0, js_div: i => i, wasm_mul: mul, table: table}});
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-819869.js b/deps/v8/test/mjsunit/regress/wasm/regress-819869.js
new file mode 100644
index 00000000000..f2606fb6108
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-819869.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_i_i)
+    .addLocals({i32_count: 0xffffffff})
+    .addBody([]);
+assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-820802.js b/deps/v8/test/mjsunit/regress/wasm/regress-820802.js
new file mode 100644
index 00000000000..224a2260f51
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-820802.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32);
+builder.addGlobal(kWasmI32, 0);
+const sig0 = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+builder.addFunction(undefined, sig0).addBody([
+  kExprI32Const, 1,  // i32.const 1
+  kExprI32Const, 0,  // i32.const 0
+  kExprI32Const, 3,  // i32.const 3
+  kExprI32GeU,       // i32.ge_u
+  kExprI32Rol,       // i32.rol
+]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(1, instance.exports.main());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-824681.js b/deps/v8/test/mjsunit/regress/wasm/regress-824681.js
new file mode 100644
index 00000000000..18ca3d0b5db
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-824681.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let chain = Promise.resolve();
+const builder = new WasmModuleBuilder();
+for (let i = 0; i < 50; ++i) {
+  builder.addFunction('fun' + i, kSig_i_v)
+      .addBody([...wasmI32Const(i)])
+      .exportFunc();
+}
+const buffer = builder.toBuffer();
+for (let i = 0; i < 100; ++i) {
+  chain = chain.then(() => WebAssembly.instantiate(buffer));
+}
+chain.then(({module, instance}) => instance.exports.fun1155())
+    .then(res => print('Result of executing fun1155: ' + res));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-825087a.js b/deps/v8/test/mjsunit/regress/wasm/regress-825087a.js
new file mode 100644
index 00000000000..a1f9a1bea85
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-825087a.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+PAGES = 10;
+memory = new WebAssembly.Memory({initial: PAGES});
+buffer = memory.buffer;
+memory.grow();
+WebAssembly.validate(buffer);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-825087b.js b/deps/v8/test/mjsunit/regress/wasm/regress-825087b.js
new file mode 100644
index 00000000000..699549d429d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-825087b.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+PAGES = 10;
+memory = new WebAssembly.Memory({initial: PAGES});
+buffer = memory.buffer;
+buffer = new Uint8Array(buffer);
+memory.grow();
+WebAssembly.validate(buffer);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-769637.js b/deps/v8/test/mjsunit/regress/wasm/regression-769637.js
new file mode 100644
index 00000000000..c2e783014ab
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regression-769637.js
@@ -0,0 +1,17 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+builder
+    .addMemory()
+    .addFunction("main", kSig_v_v)
+    .addBody([kExprI32Const, 4,
+              kExprI32Const, 8,
+              kExprI32StoreMem, 0, 16])
+    .exportAs("main");
+let instance = builder.instantiate();
+assertTraps(kTrapMemOutOfBounds, instance.exports.main);
diff --git a/deps/v8/test/mjsunit/skipping-inner-functions.js b/deps/v8/test/mjsunit/skipping-inner-functions.js
index e228b258c46..fba9a3e2776 100644
--- a/deps/v8/test/mjsunit/skipping-inner-functions.js
+++ b/deps/v8/test/mjsunit/skipping-inner-functions.js
@@ -365,3 +365,15 @@ TestSkippableFunctionInForOfHeaderAndBody();
   function lazy(p = (function() {}, class {}, function() {}, class { method1() { } })) { }
   lazy();
 })();
+
+(function TestOneByteTwoByteMismatch() {
+  // Regression test for
+  // https://bugs.chromium.org/p/v8/issues/detail?id=7428
+
+  let name = 'weird_string\u2653'.slice(0, 12);
+  let o = {};
+  o[name] = null;
+  var x;
+  eval('x = function weird_string() { function skip() {} };');
+  x();
+})();
diff --git a/deps/v8/test/mjsunit/string-charcodeat-external.js b/deps/v8/test/mjsunit/string-charcodeat-external.js
new file mode 100644
index 00000000000..8b291dad33e
--- /dev/null
+++ b/deps/v8/test/mjsunit/string-charcodeat-external.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-externalize-string --expose-gc --allow-natives-syntax
+
+function foo(s) {
+  return s.charCodeAt(12);
+}
+
+var extern = "internalized dummy";
+extern = "1234567890qiaipppiúöäöáœba"+"jalsdjasldjasdlasjdalsdjasldk";
+externalizeString(extern, true /* force two-byte */);
+assertEquals(97, foo(extern));
+assertEquals(97, foo(extern));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(97, foo(extern));
diff --git a/deps/v8/test/mjsunit/string-deopt.js b/deps/v8/test/mjsunit/string-deopt.js
new file mode 100644
index 00000000000..15549186ea5
--- /dev/null
+++ b/deps/v8/test/mjsunit/string-deopt.js
@@ -0,0 +1,57 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license
+// that can be found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+(()=> {
+  function f(a, b, c) {
+    return a.indexOf(b, c);
+  }
+  f("abc", "de", 1);
+  f("abc", "de", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", "de", {});
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", "de", {});
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a, b, c) {
+    return a.indexOf(b, c);
+  }
+  f("abc", "de", 1);
+  f("abc", "de", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {}, 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {}, 1);
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a, b, c) {
+    return a.substring(b, c);
+  }
+  f("abcde", 1, 4);
+  f("abcde", 1, 4);
+  %OptimizeFunctionOnNextCall(f);
+  f("abcde", 1, {});
+  %OptimizeFunctionOnNextCall(f);
+  f("abcde", 1, {});
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a, b, c) {
+    return a.substring(b, c);
+  }
+  f("abcde", 1, 4);
+  f("abcde", 1, 4);
+  %OptimizeFunctionOnNextCall(f);
+  f("abcde", {}, 4);
+  %OptimizeFunctionOnNextCall(f);
+  f("abcde", {}, 4);
+  assertOptimized(f);
+})();
diff --git a/deps/v8/test/mjsunit/string-trim.js b/deps/v8/test/mjsunit/string-trim.js
new file mode 100644
index 00000000000..201a34f1c96
--- /dev/null
+++ b/deps/v8/test/mjsunit/string-trim.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-string-trimming
+
+assertEquals('trim',      String.prototype.trim.name);
+assertEquals('trimStart', String.prototype.trimStart.name);
+assertEquals('trimStart', String.prototype.trimLeft.name);
+assertEquals('trimEnd',   String.prototype.trimEnd.name);
+assertEquals('trimEnd',   String.prototype.trimRight.name);
diff --git a/deps/v8/test/mjsunit/testcfg.py b/deps/v8/test/mjsunit/testcfg.py
index bc9d69ff33d..d31a189ba2c 100644
--- a/deps/v8/test/mjsunit/testcfg.py
+++ b/deps/v8/test/mjsunit/testcfg.py
@@ -25,11 +25,15 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+from collections import OrderedDict
+import itertools
 import os
 import re
 
+from testrunner.local import statusfile
 from testrunner.local import testsuite
 from testrunner.objects import testcase
+from testrunner.outproc import base as outproc
 
 FILES_PATTERN = re.compile(r"//\s+Files:(.*)")
 ENV_PATTERN = re.compile(r"//\s+Environment Variables:(.*)")
@@ -37,9 +41,22 @@
 MODULE_PATTERN = re.compile(r"^// MODULE$", flags=re.MULTILINE)
 NO_HARNESS_PATTERN = re.compile(r"^// NO HARNESS$", flags=re.MULTILINE)
 
+# Flags known to misbehave when combining arbitrary mjsunit tests. Can also
+# be compiled regular expressions.
+COMBINE_TESTS_FLAGS_BLACKLIST = [
+  '--check-handle-count',
+  '--enable-tracing',
+  re.compile('--experimental.*'),
+  '--expose-trigger-failure',
+  re.compile('--harmony.*'),
+  '--mock-arraybuffer-allocator',
+  '--print-ast',
+  re.compile('--trace.*'),
+  '--wasm-lazy-compilation',
+]
 
 class TestSuite(testsuite.TestSuite):
-  def ListTests(self, context):
+  def ListTests(self):
     tests = []
     for dirname, dirs, files in os.walk(self.root, followlinks=True):
       for dotted in [x for x in dirs if x.startswith('.')]:
@@ -47,7 +64,9 @@ def ListTests(self, context):
       dirs.sort()
       files.sort()
       for filename in files:
-        if filename.endswith(".js") and filename != "mjsunit.js":
+        if (filename.endswith(".js") and
+            filename != "mjsunit.js" and
+            filename != "mjsunit_suppressions.js"):
           fullpath = os.path.join(dirname, filename)
           relpath = fullpath[len(self.root) + 1 : -3]
           testname = relpath.replace(os.path.sep, "/")
@@ -55,9 +74,15 @@ def ListTests(self, context):
           tests.append(test)
     return tests
 
+  def _test_combiner_class(self):
+    return TestCombiner
+
   def _test_class(self):
     return TestCase
 
+  def _suppressed_test_class(self):
+    return SuppressedTestCase
+
 
 class TestCase(testcase.TestCase):
   def __init__(self, *args, **kwargs):
@@ -111,12 +136,12 @@ def _parse_source_env(self, source):
   def _get_source_flags(self):
     return self._source_flags
 
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     files = list(self._source_files)
-    if not ctx.no_harness:
+    if not self._test_config.no_harness:
       files += self._mjsunit_files
     files += self._files_suffix
-    if ctx.isolates:
+    if self._test_config.isolates:
       files += ['--isolate'] + files
 
     return files
@@ -128,5 +153,157 @@ def _get_source_path(self):
     return os.path.join(self.suite.root, self.path + self._get_suffix())
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+class TestCombiner(testsuite.TestCombiner):
+  def get_group_key(self, test):
+    """Combine tests with the same set of flags.
+    Ignore:
+    1. Some special cases where it's not obvious what to pass in the command.
+    2. Tests with flags that can cause failure even inside try-catch wrapper.
+    3. Tests that use async functions. Async functions can be scheduled after
+      exiting from try-catch wrapper and cause failure.
+    """
+    if (len(test._files_suffix) > 1 or
+        test._env or
+        not test._mjsunit_files or
+        test._source_files):
+      return None
+
+    source_flags = test._get_source_flags()
+    if ('--expose-trigger-failure' in source_flags or
+        '--throws' in source_flags):
+      return None
+
+    source_code = test.get_source()
+    # Maybe we could just update the tests to await all async functions they
+    # call?
+    if 'async' in source_code:
+      return None
+
+    # TODO(machenbach): Remove grouping if combining tests in a flag-independent
+    # way works well.
+    return 1
+
+  def _combined_test_class(self):
+    return CombinedTest
+
+
+class CombinedTest(testcase.TestCase):
+  """Behaves like normal mjsunit tests except:
+    1. Expected outcome is always PASS
+    2. Instead of one file there is a try-catch wrapper with all combined tests
+      passed as arguments.
+  """
+  def __init__(self, name, tests):
+    super(CombinedTest, self).__init__(tests[0].suite, '', name,
+                                       tests[0]._test_config)
+    self._tests = tests
+
+  def _prepare_outcomes(self, force_update=True):
+    self._statusfile_outcomes = outproc.OUTCOMES_PASS_OR_TIMEOUT
+    self.expected_outcomes = outproc.OUTCOMES_PASS_OR_TIMEOUT
+
+  def _get_shell_with_flags(self):
+    """In addition to standard set of shell flags it appends:
+      --disable-abortjs: %AbortJS can abort the test even inside
+        trycatch-wrapper, so we disable it.
+      --es-staging: We blacklist all harmony flags due to false positives,
+          but always pass the staging flag to cover the mature features.
+      --omit-quit: Calling quit() in JS would otherwise early terminate.
+      --quiet-load: suppress any stdout from load() function used by
+        trycatch-wrapper.
+    """
+    shell = 'd8'
+    shell_flags = [
+      '--test',
+      '--disable-abortjs',
+      '--es-staging',
+      '--omit-quit',
+      '--quiet-load',
+    ]
+    return shell, shell_flags
+
+  def _get_cmd_params(self):
+    return (
+      super(CombinedTest, self)._get_cmd_params() +
+      ['tools/testrunner/trycatch_loader.js', '--'] +
+      self._tests[0]._mjsunit_files +
+      ['--'] +
+      [t._files_suffix[0] for t in self._tests]
+    )
+
+  def _merge_flags(self, flags):
+    """Merges flags from a list of flags.
+
+    Flag values not starting with '-' are merged with the preceeding flag,
+    e.g. --foo 1 will become --foo=1. All other flags remain the same.
+
+    Returns: A generator of flags.
+    """
+    if not flags:
+      return
+    # Iterate over flag pairs. ['-'] is a sentinel value for the last iteration.
+    for flag1, flag2 in itertools.izip(flags, flags[1:] + ['-']):
+      if not flag2.startswith('-'):
+        assert '=' not in flag1
+        yield flag1 + '=' + flag2
+      elif flag1.startswith('-'):
+        yield flag1
+
+  def _is_flag_blacklisted(self, flag):
+    for item in COMBINE_TESTS_FLAGS_BLACKLIST:
+      if isinstance(item, basestring):
+        if item == flag:
+          return True
+      elif item.match(flag):
+        return True
+    return False
+
+  def _get_combined_flags(self, flags_gen):
+    """Combines all flags - dedupes, keeps order and filters some flags.
+
+    Args:
+      flags_gen: Generator for flag lists.
+    Returns: A list of flags.
+    """
+    merged_flags = self._merge_flags(list(itertools.chain(*flags_gen)))
+    unique_flags = OrderedDict((flag, True) for flag in merged_flags).keys()
+    return [
+      flag for flag in unique_flags
+      if not self._is_flag_blacklisted(flag)
+    ]
+
+  def _get_source_flags(self):
+    # Combine flags from all source files.
+    return self._get_combined_flags(
+        test._get_source_flags() for test in self._tests)
+
+  def _get_statusfile_flags(self):
+    # Combine flags from all status file entries.
+    return self._get_combined_flags(
+        test._get_statusfile_flags() for test in self._tests)
+
+
+class SuppressedTestCase(TestCase):
+  """The same as a standard mjsunit test case with all asserts as no-ops."""
+  def __init__(self, *args, **kwargs):
+    super(SuppressedTestCase, self).__init__(*args, **kwargs)
+    self._mjsunit_files.append(
+        os.path.join(self.suite.root, "mjsunit_suppressions.js"))
+
+  def _prepare_outcomes(self, *args, **kwargs):
+    super(SuppressedTestCase, self)._prepare_outcomes(*args, **kwargs)
+    # Skip tests expected to fail. We suppress all asserts anyways, but some
+    # tests are expected to fail with type errors or even dchecks, and we
+    # can't differentiate that.
+    if statusfile.FAIL in self._statusfile_outcomes:
+      self._statusfile_outcomes = [statusfile.SKIP]
+
+  def _get_extra_flags(self, *args, **kwargs):
+    return (
+        super(SuppressedTestCase, self)._get_extra_flags(*args, **kwargs) +
+        ['--disable-abortjs']
+    )
+
+
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/mjsunit/wasm/OWNERS b/deps/v8/test/mjsunit/wasm/OWNERS
index 5bd472f49d1..d9195d8e544 100644
--- a/deps/v8/test/mjsunit/wasm/OWNERS
+++ b/deps/v8/test/mjsunit/wasm/OWNERS
@@ -2,6 +2,4 @@ ahaas@chromium.org
 bradnelson@chromium.org
 clemensh@chromium.org
 eholk@chromium.org
-mtrofin@chromium.org
-rossberg@chromium.org
 titzer@chromium.org
diff --git a/deps/v8/test/mjsunit/wasm/asm-wasm-f32.js b/deps/v8/test/mjsunit/wasm/asm-wasm-f32.js
index a1af7a43932..1a89c3ef1a0 100644
--- a/deps/v8/test/mjsunit/wasm/asm-wasm-f32.js
+++ b/deps/v8/test/mjsunit/wasm/asm-wasm-f32.js
@@ -200,23 +200,8 @@ var inputs = [
 ];
 
 var funcs = [
-  f32_add,
-  f32_sub,
-  f32_mul,
-  f32_div,
-  f32_ceil,
-  f32_floor,
-// TODO(bradnelson) f32_sqrt,
-// TODO(bradnelson) f32_abs,
-// TODO(bradnelson) f32_min is wrong for -0
-// TODO(bradnelson) f32_max is wrong for -0
-  f32_eq,
-  f32_ne,
-  f32_lt,
-  f32_lteq,
-  f32_gt,
-  f32_gteq,
-  f32_neg,
+  f32_add, f32_sub, f32_mul, f32_div, f32_ceil, f32_floor, f32_sqrt, f32_abs,
+  f32_min, f32_max, f32_eq, f32_ne, f32_lt, f32_lteq, f32_gt, f32_gteq, f32_neg
 ];
 
 (function () {
diff --git a/deps/v8/test/mjsunit/wasm/asm-wasm-f64.js b/deps/v8/test/mjsunit/wasm/asm-wasm-f64.js
index c7b439fedea..a07de985585 100644
--- a/deps/v8/test/mjsunit/wasm/asm-wasm-f64.js
+++ b/deps/v8/test/mjsunit/wasm/asm-wasm-f64.js
@@ -262,32 +262,10 @@ var inputs = [
 ];
 
 var funcs = [
-  f64_add,
-  f64_sub,
-  f64_mul,
-  f64_div,
-  f64_eq,
-  f64_ne,
-  f64_lt,
-  f64_lteq,
-  f64_gt,
-  f64_gteq,
-  f64_ceil,
-  f64_floor,
-// TODO(bradnelson) f64_sqrt,
-  f64_abs,
-  f64_neg,
-// TODO(bradnelson) f64_min is wrong for -0
-// TODO(bradnelson) f64_max is wrong for -0
-  f64_acos,
-  f64_asin,
-  f64_atan,
-  f64_cos,
-  f64_sin,
-  f64_tan,
-  f64_exp,
-  f64_log,
-  f64_atan2,
+  f64_add,  f64_sub, f64_mul,  f64_div,  f64_eq,    f64_ne,   f64_lt,
+  f64_lteq, f64_gt,  f64_gteq, f64_ceil, f64_floor, f64_sqrt, f64_abs,
+  f64_neg,  f64_min, f64_max,  f64_acos, f64_asin,  f64_atan, f64_cos,
+  f64_sin,  f64_tan, f64_exp,  f64_log,  f64_atan2,
 ];
 
 (function () {
diff --git a/deps/v8/test/mjsunit/wasm/compiled-module-serialization.js b/deps/v8/test/mjsunit/wasm/compiled-module-serialization.js
index 0ec3296b030..d254c9e6205 100644
--- a/deps/v8/test/mjsunit/wasm/compiled-module-serialization.js
+++ b/deps/v8/test/mjsunit/wasm/compiled-module-serialization.js
@@ -98,6 +98,26 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
   assertEquals(clone.constructor, compiled_module.constructor);
 })();
 
+(function SerializeWrappersWithSameSignature() {
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("main", kSig_i_v)
+    .addBody([kExprI32Const, 42])
+    .exportFunc();
+  builder.addFunction("main_same_signature", kSig_i_v)
+    .addBody([kExprI32Const, 23])
+    .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var compiled_module = new WebAssembly.Module(wire_bytes);
+  var serialized = %SerializeWasmModule(compiled_module);
+  var clone = %DeserializeWasmModule(serialized, wire_bytes);
+
+  assertNotNull(clone);
+  assertFalse(clone == undefined);
+  assertFalse(clone == compiled_module);
+  assertEquals(clone.constructor, compiled_module.constructor);
+})();
+
 (function SerializeAfterInstantiation() {
   let builder = new WasmModuleBuilder();
   builder.addFunction("main", kSig_i_v)
diff --git a/deps/v8/test/mjsunit/wasm/errors.js b/deps/v8/test/mjsunit/wasm/errors.js
index a90236459f9..0d4893c18a5 100644
--- a/deps/v8/test/mjsunit/wasm/errors.js
+++ b/deps/v8/test/mjsunit/wasm/errors.js
@@ -160,15 +160,22 @@ function assertConversionError(bytes, imports, msg) {
 
 (function TestConversionError() {
   let b = builder();
-  b.addImport("foo", "bar", kSig_v_l);
-  assertConversionError(b.addFunction("run", kSig_v_v).addBody([
-    kExprI64Const, 0, kExprCallFunction, 0
-  ]).exportFunc().end().toBuffer(), {foo:{bar: (l)=>{}}}, "invalid type");
-
-  b = builder()
-  assertConversionError(builder().addFunction("run", kSig_l_v).addBody([
-    kExprI64Const, 0
-  ]).exportFunc().end().toBuffer(), {}, "invalid type");
+  b.addImport('foo', 'bar', kSig_v_l);
+  let buffer = b.addFunction('run', kSig_v_v)
+                   .addBody([kExprI64Const, 0, kExprCallFunction, 0])
+                   .exportFunc()
+                   .end()
+                   .toBuffer();
+  assertConversionError(
+      buffer, {foo: {bar: (l) => {}}}, kTrapMsgs[kTrapTypeError]);
+
+  buffer = builder()
+               .addFunction('run', kSig_l_v)
+               .addBody([kExprI64Const, 0])
+               .exportFunc()
+               .end()
+               .toBuffer();
+  assertConversionError(buffer, {}, kTrapMsgs[kTrapTypeError]);
 })();
 
 
@@ -178,7 +185,7 @@ function assertConversionError(bytes, imports, msg) {
   builder.addImport("mod", "func", sig);
   builder.addFunction("main", sig)
     .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprCallFunction, 0])
-    .exportAs("main")
+    .exportAs("main");
   var main = builder.instantiate({
     mod: {
       func: ()=>{%DebugTrace();}
diff --git a/deps/v8/test/mjsunit/wasm/ffi.js b/deps/v8/test/mjsunit/wasm/ffi.js
index 67b1ccc8f57..ce961847664 100644
--- a/deps/v8/test/mjsunit/wasm/ffi.js
+++ b/deps/v8/test/mjsunit/wasm/ffi.js
@@ -68,9 +68,8 @@ print("Bind function");
 var bind_sub = FOREIGN_SUB.bind();
 testCallFFI(bind_sub, check_FOREIGN_SUB);
 
-var main_for_constructor_test;
-print("Constructor");
 (function testCallConstructor() {
+  print(arguments.callee.name);
   class C {}
   var builder = new WasmModuleBuilder();
 
@@ -84,13 +83,30 @@ print("Constructor");
     ])        // --
     .exportFunc();
 
-  main_for_constructor_test = builder.instantiate({"": {func: C}}).exports.main;
+  let main_for_constructor_test = builder.instantiate({"": {func: C}}).exports.main;
 
-  assertThrows("main_for_constructor_test(12, 43)", TypeError);
+  assertThrows(_ => main_for_constructor_test(12, 43), TypeError);
 }) ();
 
-print("Native function");
+(function testCallConstructorWithSuperClass() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_index = builder.addType(kSig_v_v);
+  let func_index = builder.addImport('', 'func', sig_index);
+  builder.addExport('exp', func_index);
+
+  class B {}
+  class C extends B {
+    constructor() {
+      super();
+    }
+  };
+  let exports = builder.instantiate({'': {func: C}}).exports;
+  assertThrows(_ => exports.exp(), TypeError);
+})();
+
 (function test_ffi_call_to_native() {
+  print(arguments.callee.name);
 
   var builder = new WasmModuleBuilder();
 
diff --git a/deps/v8/test/mjsunit/wasm/function-prototype.js b/deps/v8/test/mjsunit/wasm/function-prototype.js
index d3356cec80e..c2f1edd5c46 100644
--- a/deps/v8/test/mjsunit/wasm/function-prototype.js
+++ b/deps/v8/test/mjsunit/wasm/function-prototype.js
@@ -17,8 +17,9 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
   var func = builder.instantiate().exports.nine;
 
   // Check type and existence of prototype
-  assertEquals("function", typeof func.apply);
-  assertTrue(func.prototype != undefined);
+  assertEquals('function', typeof func);
+  assertEquals('function', typeof func.apply);
+  assertEquals('prototype' in func, false);
   assertEquals(String(f.index), func.name);
   assertEquals(undefined, func.displayName);
 
diff --git a/deps/v8/test/mjsunit/wasm/graceful_shutdown.js b/deps/v8/test/mjsunit/wasm/graceful_shutdown.js
index 53d38013687..a3091075ea2 100644
--- a/deps/v8/test/mjsunit/wasm/graceful_shutdown.js
+++ b/deps/v8/test/mjsunit/wasm/graceful_shutdown.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm --wasm-async-compilation
+// Flags: --expose-wasm --wasm-async-compilation --no-wait-for-wasm
 
 load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
diff --git a/deps/v8/test/mjsunit/wasm/import-table.js b/deps/v8/test/mjsunit/wasm/import-function.js
similarity index 100%
rename from deps/v8/test/mjsunit/wasm/import-table.js
rename to deps/v8/test/mjsunit/wasm/import-function.js
diff --git a/deps/v8/test/mjsunit/wasm/indirect-tables.js b/deps/v8/test/mjsunit/wasm/indirect-tables.js
index 88d1bb719a1..9176ec49328 100644
--- a/deps/v8/test/mjsunit/wasm/indirect-tables.js
+++ b/deps/v8/test/mjsunit/wasm/indirect-tables.js
@@ -33,7 +33,7 @@ function AddFunctions(builder) {
 function js_div(a, b) { return (a / b) | 0; }
 
 (function ExportedTableTest() {
-  print("ExportedTableTest...");
+  print(arguments.callee.name);
 
   let builder = new WasmModuleBuilder();
 
@@ -102,9 +102,9 @@ function js_div(a, b) { return (a / b) | 0; }
 })();
 
 
-(function ImportedTableTest() {
+(function ImportedTableTest1() {
   let kTableSize = 10;
-  print("ImportedTableTest...");
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
 
   let d = builder.addImport("q", "js_div", kSig_i_ii);
@@ -172,9 +172,9 @@ function js_div(a, b) { return (a / b) | 0; }
   }
 })();
 
-(function ImportedTableTest() {
+(function ImportedTableTest2() {
   let kTableSize = 10;
-  print("ManualTableTest...");
+  print(arguments.callee.name);
 
   var builder = new WasmModuleBuilder();
 
@@ -240,7 +240,7 @@ function js_div(a, b) { return (a / b) | 0; }
 
 
 (function CumulativeTest() {
-  print("CumulativeTest...");
+  print(arguments.callee.name);
 
   let kTableSize = 10;
   let table = new WebAssembly.Table(
@@ -251,7 +251,7 @@ function js_div(a, b) { return (a / b) | 0; }
   builder.addImportedTable("x", "table", kTableSize, kTableSize);
   let g = builder.addImportedGlobal("x", "base", kWasmI32);
   let sig_index = builder.addType(kSig_i_v);
-  builder.addFunction("g", sig_index)
+  let f = builder.addFunction("f", sig_index)
     .addBody([
       kExprGetGlobal, g
     ]);
@@ -260,7 +260,7 @@ function js_div(a, b) { return (a / b) | 0; }
       kExprGetLocal, 0,
       kExprCallIndirect, sig_index, kTableZero])  // --
     .exportAs("main");
-  builder.addFunctionTableInit(g, true, [g]);
+  builder.addFunctionTableInit(g, true, [f.index]);
 
   let module = new WebAssembly.Module(builder.toBuffer());
 
@@ -283,7 +283,7 @@ function js_div(a, b) { return (a / b) | 0; }
 })();
 
 (function TwoWayTest() {
-  print("TwoWayTest...");
+  print(arguments.callee.name);
   let kTableSize = 3;
 
   // Module {m1} defines the table and exports it.
@@ -342,7 +342,7 @@ function js_div(a, b) { return (a / b) | 0; }
 })();
 
 (function MismatchedTableSize() {
-  print("MismatchedTableSize...");
+  print(arguments.callee.name);
   let kTableSize = 5;
 
   for (var expsize = 1; expsize < 4; expsize++) {
@@ -374,7 +374,7 @@ function js_div(a, b) { return (a / b) | 0; }
 })();
 
 (function TableGrowBoundsCheck() {
-  print("TableGrowBoundsCheck");
+  print(arguments.callee.name);
   var kMaxSize = 30, kInitSize = 5;
   let table = new WebAssembly.Table({element: "anyfunc",
     initial: kInitSize, maximum: kMaxSize});
@@ -398,7 +398,7 @@ function js_div(a, b) { return (a / b) | 0; }
 })();
 
 (function CumulativeGrowTest() {
-  print("CumulativeGrowTest...");
+  print(arguments.callee.name);
   let table = new WebAssembly.Table({
     element: "anyfunc", initial: 10, maximum: 30});
   var builder = new WasmModuleBuilder();
@@ -460,7 +460,7 @@ function js_div(a, b) { return (a / b) | 0; }
 
 
 (function TestImportTooLarge() {
-  print("TestImportTooLarge...");
+  print(arguments.callee.name);
   let builder = new WasmModuleBuilder();
   builder.addImportedTable("t", "t", 1, 2);
 
@@ -478,7 +478,7 @@ function js_div(a, b) { return (a / b) | 0; }
 })();
 
 (function TableImportLargerThanCompiled() {
-  print("TableImportLargerThanCompiled...");
+  print(arguments.callee.name);
   var kMaxSize = 30, kInitSize = 5;
   var builder = new WasmModuleBuilder();
   builder.addImportedTable("x", "table", 1, 35);
@@ -492,7 +492,7 @@ function js_div(a, b) { return (a / b) | 0; }
 })();
 
 (function ModulesShareTableAndGrow() {
-  print("ModulesShareTableAndGrow...");
+  print(arguments.callee.name);
   let module1 = (() => {
     let builder = new WasmModuleBuilder();
     builder.addImportedTable("x", "table", 1, 35);
@@ -525,7 +525,7 @@ function js_div(a, b) { return (a / b) | 0; }
 
 (function MultipleElementSegments() {
   let kTableSize = 10;
-  print("MultipleElementSegments...");
+  print(arguments.callee.name);
 
   let mul = (a, b) => a * b;
   let add = (a, b) => a + b;
@@ -603,7 +603,8 @@ function js_div(a, b) { return (a / b) | 0; }
 })();
 
 (function IndirectCallIntoOtherInstance() {
-  print("IndirectCallIntoOtherInstance...");
+  print(arguments.callee.name);
+
   var mem_1 = new WebAssembly.Memory({initial: 1});
   var mem_2 = new WebAssembly.Memory({initial: 1});
   var view_1 = new Int32Array(mem_1.buffer);
@@ -644,7 +645,7 @@ function js_div(a, b) { return (a / b) | 0; }
 
 
 (function ImportedFreestandingTable() {
-  print("ImportedFreestandingTable...");
+  print(arguments.callee.name);
 
   function forceGc() {
     gc();
@@ -709,7 +710,8 @@ function js_div(a, b) { return (a / b) | 0; }
 
 // Remove this test when v8:7232 is addressed comprehensively.
 (function TablesAreImmutableInWasmCallstacks() {
-  print('TablesAreImmutableInWasmCallstacks...');
+  print(arguments.callee.name);
+
   let table = new WebAssembly.Table({initial:2, element:'anyfunc'});
 
   let builder = new WasmModuleBuilder();
@@ -743,3 +745,93 @@ function js_div(a, b) { return (a / b) | 0; }
   table.set(0, null);
   assertEquals(null, table.get(0));
 })();
+
+(function ImportedWasmFunctionPutIntoTable() {
+  print(arguments.callee.name);
+
+  let wasm_mul = (() => {
+    let builder = new WasmModuleBuilder();
+    builder.addFunction("mul", kSig_i_ii)
+      .addBody(
+        [kExprGetLocal, 0,
+         kExprGetLocal, 1,
+         kExprI32Mul])
+      .exportFunc();
+    return builder.instantiate().exports.mul;
+  })();
+
+  let builder = new WasmModuleBuilder();
+
+  let j = builder.addImport("q", "js_div", kSig_i_ii);
+  let w = builder.addImport("q", "wasm_mul", kSig_i_ii);
+  builder.addFunction("main", kSig_i_ii)
+    .addBody([
+      kExprI32Const, 33,  // --
+      kExprGetLocal, 0,   // --
+      kExprGetLocal, 1,   // --
+      kExprCallIndirect, 0, kTableZero])  // --
+    .exportAs("main");
+
+  builder.setFunctionTableBounds(10, 10);
+  let g = builder.addImportedGlobal("q", "base", kWasmI32);
+  builder.addFunctionTableInit(g, true, [j, w]);
+
+  let module = new WebAssembly.Module(builder.toBuffer());
+  for (var i = 0; i < 5; i++) {
+    let instance = new WebAssembly.Instance(module, {q: {base: i, js_div: js_div, wasm_mul: wasm_mul}});
+    let j = i + 1;
+
+    assertThrows(() => {instance.exports.main(j, i-1)});
+    assertEquals((33/j)|0, instance.exports.main(j, i+0));
+    assertEquals((33*j)|0, instance.exports.main(j, i+1));
+    assertThrows(() => {instance.exports.main(j, i+2)});
+  }
+
+})();
+
+(function ImportedWasmFunctionPutIntoImportedTable() {
+  print(arguments.callee.name);
+
+  let kTableSize = 10;
+
+  let wasm_mul = (() => {
+    let builder = new WasmModuleBuilder();
+    builder.addFunction("mul", kSig_i_ii)
+      .addBody(
+        [kExprGetLocal, 0,
+         kExprGetLocal, 1,
+         kExprI32Mul])
+      .exportFunc();
+    return builder.instantiate().exports.mul;
+  })();
+
+  let table = new WebAssembly.Table({element: "anyfunc",
+                                     initial: kTableSize,
+                                     maximum: kTableSize});
+
+  let builder = new WasmModuleBuilder();
+
+  let j = builder.addImport("q", "js_div", kSig_i_ii);
+  let w = builder.addImport("q", "wasm_mul", kSig_i_ii);
+  builder.addImportedTable("q", "table", kTableSize, kTableSize);
+  builder.addFunction("main", kSig_i_ii)
+    .addBody([
+      kExprI32Const, 44,  // --
+      kExprGetLocal, 0,   // --
+      kExprGetLocal, 1,   // --
+      kExprCallIndirect, 0, kTableZero])  // --
+    .exportAs("main");
+
+  let g = builder.addImportedGlobal("q", "base", kWasmI32);
+  builder.addFunctionTableInit(g, true, [j, w]);
+
+  let module = new WebAssembly.Module(builder.toBuffer());
+  for (var i = 0; i < 5; i++) {
+    let instance = new WebAssembly.Instance(module, {q: {base: i, js_div: js_div, wasm_mul: wasm_mul, table: table}});
+    let j = i + 1;
+
+    assertEquals((44/j)|0, instance.exports.main(j, i+0));
+    assertEquals((44*j)|0, instance.exports.main(j, i+1));
+    assertThrows(() => {instance.exports.main(j, i+2)});
+  }
+})();
diff --git a/deps/v8/test/mjsunit/wasm/interpreter.js b/deps/v8/test/mjsunit/wasm/interpreter.js
index f5697eb00fd..a57498b9a8b 100644
--- a/deps/v8/test/mjsunit/wasm/interpreter.js
+++ b/deps/v8/test/mjsunit/wasm/interpreter.js
@@ -296,7 +296,7 @@ function checkStack(stack, expected_lines) {
   } catch (e) {
     if (!(e instanceof TypeError)) throw e;
     checkStack(stripPath(e.stack), [
-      'TypeError: invalid type',                                // -
+      'TypeError: ' + kTrapMsgs[kTrapTypeError],                // -
       '    at direct (wasm-function[1]:1)',                     // -
       '    at main (wasm-function[3]:3)',                       // -
       /^    at testIllegalImports \(interpreter.js:\d+:22\)$/,  // -
@@ -309,7 +309,7 @@ function checkStack(stack, expected_lines) {
   } catch (e) {
     if (!(e instanceof TypeError)) throw e;
     checkStack(stripPath(e.stack), [
-      'TypeError: invalid type',                                // -
+      'TypeError: ' + kTrapMsgs[kTrapTypeError],                // -
       '    at indirect (wasm-function[2]:1)',                   // -
       '    at main (wasm-function[3]:3)',                       // -
       /^    at testIllegalImports \(interpreter.js:\d+:22\)$/,  // -
@@ -493,3 +493,30 @@ function checkStack(stack, expected_lines) {
   tab.set(0, instance1.exports.exp);
   instance2.exports.call2();
 })();
+
+(function testTableCall3() {
+  // See crbug.com/814562.
+  print(arguments.callee.name);
+  const builder0 = new WasmModuleBuilder();
+  const sig_index = builder0.addType(kSig_i_v);
+  builder0.addFunction('main', kSig_i_i)
+      .addBody([
+        kExprGetLocal, 0,  // --
+        kExprCallIndirect, sig_index, kTableZero
+      ])  // --
+      .exportAs('main');
+  builder0.setFunctionTableBounds(3, 3);
+  builder0.addExportOfKind('table', kExternalTable);
+  const module0 = new WebAssembly.Module(builder0.toBuffer());
+  const instance0 = new WebAssembly.Instance(module0);
+
+  const builder1 = new WasmModuleBuilder();
+  builder1.addFunction('main', kSig_i_v).addBody([kExprUnreachable]);
+  builder1.addImportedTable('z', 'table');
+  builder1.addFunctionTableInit(0, false, [0], true);
+  const module1 = new WebAssembly.Module(builder1.toBuffer());
+  const instance1 =
+      new WebAssembly.Instance(module1, {z: {table: instance0.exports.table}});
+  assertThrows(
+      () => instance0.exports.main(0), WebAssembly.RuntimeError, 'unreachable');
+})();
diff --git a/deps/v8/test/mjsunit/wasm/liftoff-trap-handler.js b/deps/v8/test/mjsunit/wasm/liftoff-trap-handler.js
new file mode 100644
index 00000000000..d24b5a3b225
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/liftoff-trap-handler.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --liftoff --wasm-trap-handler
+
+// A simple test to make sure Liftoff can compile memory operations with trap
+// handlers enabled.
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+function testCompileLoadStore() {
+  const builder = new WasmModuleBuilder();
+  // These functions generate statically out of bounds accesses.
+  builder.addFunction("load", kSig_i_i)
+      .addBody([kExprGetLocal, 0, kExprI32LoadMem, 0, 0x80, 0x80, 0x80, 1])
+      .exportFunc();
+  builder.addFunction("store", kSig_i_ii)
+      .addBody([kExprGetLocal, 0,
+                kExprGetLocal, 1,
+                kExprI32StoreMem, 0, 0x80, 0x80, 0x80, 1,
+                kExprGetLocal, 1])
+      .exportFunc();
+  builder.addMemory(1, 1, false);
+  const instance = builder.instantiate();
+}
+testCompileLoadStore();
diff --git a/deps/v8/test/mjsunit/wasm/liftoff.js b/deps/v8/test/mjsunit/wasm/liftoff.js
index b65f83f9ec0..c57cbfc0904 100644
--- a/deps/v8/test/mjsunit/wasm/liftoff.js
+++ b/deps/v8/test/mjsunit/wasm/liftoff.js
@@ -7,6 +7,22 @@
 load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
+(function testLiftoffFlag() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('i32_add', kSig_i_ii)
+      .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32Add])
+      .exportFunc();
+
+  const module = new WebAssembly.Module(builder.toBuffer());
+  const instance = new WebAssembly.Instance(module);
+  const instance2 = new WebAssembly.Instance(module);
+
+  assertEquals(%IsLiftoffFunction(instance.exports.i32_add),
+               %IsLiftoffFunction(instance2.exports.i32_add));
+})();
+
+
 (function testLiftoffSync() {
   print(arguments.callee.name);
   const builder = new WasmModuleBuilder();
diff --git a/deps/v8/test/mjsunit/wasm/memory-size.js b/deps/v8/test/mjsunit/wasm/memory-size.js
index 0c96efb798a..f803df2e3dc 100644
--- a/deps/v8/test/mjsunit/wasm/memory-size.js
+++ b/deps/v8/test/mjsunit/wasm/memory-size.js
@@ -7,8 +7,11 @@
 load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
+var kV8MaxWasmMemoryPages = 32767;  // ~ 2 GiB
+var kSpecMaxWasmMemoryPages = 65536;  // 4 GiB
+
 (function testMemorySizeZero() {
-  print("testMemorySizeZero()");
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
   builder.addMemory(0, 0, false);
   builder.addFunction("memory_size", kSig_i_v)
@@ -19,7 +22,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
 })();
 
 (function testMemorySizeNonZero() {
-  print("testMemorySizeNonZero()");
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
   var size = 11;
   builder.addMemory(size, size, false);
@@ -29,3 +32,42 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
   var module = builder.instantiate();
   assertEquals(size, module.exports.memory_size());
 })();
+
+(function testMemorySizeSpecMaxOk() {
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+  builder.addMemory(1, kSpecMaxWasmMemoryPages, true);
+  builder.addFunction("memory_size", kSig_i_v)
+         .addBody([kExprMemorySize, kMemoryZero])
+         .exportFunc();
+  var module = builder.instantiate();
+  assertEquals(1, module.exports.memory_size());
+})();
+
+(function testMemorySizeV8MaxPlus1Throws() {
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+  builder.addMemory(kV8MaxWasmMemoryPages + 1,
+                    kV8MaxWasmMemoryPages + 1, false);
+  builder.addFunction("memory_size", kSig_i_v)
+         .addBody([kExprMemorySize, kMemoryZero])
+         .exportFunc();
+  assertThrows(() => builder.instantiate());
+})();
+
+(function testMemorySpecMaxOk() {
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+  builder.addMemory(1, kSpecMaxWasmMemoryPages, false);
+  builder.addFunction("memory_size", kSig_i_v)
+         .addBody([kExprMemorySize, kMemoryZero])
+    .exportFunc();
+  var module = builder.instantiate();
+  assertEquals(1, module.exports.memory_size());
+})();
+
+(function testMemoryInitialMaxPlus1Throws() {
+  print(arguments.callee.name);
+  assertThrows(() => new WebAssembly.Memory(
+      {initial: kV8WasmMaxMemoryPages + 1}));
+})();
diff --git a/deps/v8/test/mjsunit/wasm/table-grow.js b/deps/v8/test/mjsunit/wasm/table-grow.js
index a9a4ba298cc..c78d2721397 100644
--- a/deps/v8/test/mjsunit/wasm/table-grow.js
+++ b/deps/v8/test/mjsunit/wasm/table-grow.js
@@ -286,7 +286,7 @@ let id = (() => {  // identity exported function
       assertInvalidFunction = function(s) {
         assertThrows(
             () => instances[i].exports.main(s), WebAssembly.RuntimeError,
-            /invalid function/);
+            kTrapMsgs[kTrapFuncInvalid]);
       }
       assertInvalidFunction(size);
       assertInvalidFunction(size + 1);
diff --git a/deps/v8/test/mjsunit/wasm/test-import-export-wrapper.js b/deps/v8/test/mjsunit/wasm/test-import-export-wrapper.js
deleted file mode 100644
index e298468350a..00000000000
--- a/deps/v8/test/mjsunit/wasm/test-import-export-wrapper.js
+++ /dev/null
@@ -1,326 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-wasm --allow-natives-syntax
-
-load("test/mjsunit/wasm/wasm-constants.js");
-load("test/mjsunit/wasm/wasm-module-builder.js");
-
-var expect_elison = 0;
-var expect_no_elison = 1;
-// function calls stack: first_export -> first_func -> first_import ->
-// second_export -> second_import
-// In this case, first_import and second_export have same signature,
-// So that wrappers will be removed
-(function TestWasmWrapperElision() {
-    var imported = function (a) {
-        return a;
-    };
-
-    var second_module = new WasmModuleBuilder();
-    var sig_index = second_module.addType(kSig_i_i);
-    second_module
-        .addImport("import_module_2", "import_name_2", sig_index);
-    second_module
-        .addFunction("second_export", sig_index)
-        .addBody([
-            kExprGetLocal, 0,
-            kExprCallFunction, 0,
-            kExprReturn
-        ])
-        .exportFunc();
-
-    var first_module = new WasmModuleBuilder();
-    var sig_index = first_module.addType(kSig_i_i);
-    first_module
-        .addImport("import_module_1", "import_name_1", sig_index);
-    first_module
-        .addFunction("first_export", sig_index)
-        .addBody([
-            kExprGetLocal, 0,
-            kExprCallFunction, 2,
-            kExprReturn
-        ])
-        .exportFunc();
-    first_module
-        .addFunction("first_func", sig_index)
-        .addBody([
-            kExprI32Const, 1,
-            kExprGetLocal, 0,
-            kExprI32Add,
-            kExprCallFunction, 0,
-            kExprReturn
-        ]);
-
-    var f = second_module
-        .instantiate({import_module_2: {import_name_2: imported}})
-        .exports.second_export;
-    var the_export = first_module
-        .instantiate({import_module_1: {import_name_1: f}})
-        .exports.first_export;
-    assertEquals(the_export(2), 3);
-    assertEquals(the_export(-1), 0);
-    assertEquals(the_export(0), 1);
-    assertEquals(the_export(5.5), 6);
-    assertEquals(%CheckWasmWrapperElision(the_export, expect_elison), true);
-})();
-
-// Function calls stack: first_export -> first_func -> first_import ->
-// second_export -> second_import
-// In this test, first_import and second_export have the same signature, and
-// therefore the wrappers will be removed. If the wrappers are not removed, then
-// the test crashes because of the int64 parameter, which is not allowed in the
-// wrappers.
-(function TestWasmWrapperElisionInt64() {
- var imported = function (a) {
-     return a;
- };
-
- var second_module = new WasmModuleBuilder();
- var sig_index1 = second_module.addType(kSig_i_i);
- var sig_index_ll = second_module.addType(kSig_l_l);
- second_module
-     .addImport("import_module_2", "import_name_2", sig_index1);
- second_module
-     .addFunction("second_export", sig_index_ll)
-     .addBody([
-         kExprGetLocal, 0,
-         kExprI32ConvertI64,
-         kExprCallFunction, 0,
-         kExprI64SConvertI32,
-         kExprReturn
-     ])
-     .exportFunc();
-
- var first_module = new WasmModuleBuilder();
- var sig_index = first_module.addType(kSig_i_v);
- var sig_index_ll = first_module.addType(kSig_l_l);
- first_module
-     .addImport("import_module_1", "import_name_1", sig_index_ll);
- first_module
-     .addFunction("first_export", sig_index)
-     .addBody([
-         kExprI64Const, 2,
-         kExprCallFunction, 2,
-         kExprI32ConvertI64,
-         kExprReturn
-     ])
-     .exportFunc();
- first_module
-     .addFunction("first_func", sig_index_ll)
-     .addBody([
-         kExprI64Const, 1,
-         kExprGetLocal, 0,
-         kExprI64Add,
-         kExprCallFunction, 0,
-         kExprReturn
-     ]);
-
- var f = second_module
-     .instantiate({import_module_2: {import_name_2: imported}})
-     .exports.second_export;
- var the_export = first_module
-     .instantiate({import_module_1: {import_name_1: f}})
-     .exports.first_export;
-   assertEquals(the_export(), 3);
-})();
-
-// function calls stack: first_export -> first_func -> first_import ->
-// second_export -> second_import
-// In this case, second_export has fewer params than first_import,
-// so instantiation should fail.
-assertThrows(function TestWasmWrapperNoElisionLessParams() {
-    var imported = function (a) {
-        return a;
-    };
-
-    var second_module = new WasmModuleBuilder();
-    var sig_index_1 = second_module.addType(kSig_i_i);
-    second_module
-        .addImport("import_module_2", "import_name_2", sig_index_1);
-    second_module
-        .addFunction("second_export", sig_index_1)
-        .addBody([
-            kExprGetLocal, 0,
-            kExprCallFunction, 0,
-            kExprReturn
-        ])
-        .exportFunc();
-
-    var first_module = new WasmModuleBuilder();
-    var sig_index_2 = first_module.addType(kSig_i_ii);
-    first_module
-        .addImport("import_module_1", "import_name_1", sig_index_2);
-    first_module
-        .addFunction("first_export", sig_index_2)
-        .addBody([
-            kExprGetLocal, 0,
-            kExprGetLocal, 1,
-            kExprCallFunction, 2,
-            kExprReturn
-        ])
-        .exportFunc();
-    first_module
-        .addFunction("first_func", sig_index_2)
-        .addBody([
-            kExprGetLocal, 0,
-            kExprGetLocal, 1,
-            kExprCallFunction, 0,
-            kExprReturn
-        ]);
-
-    var f = second_module
-        .instantiate({import_module_2: {import_name_2: imported}})
-        .exports.second_export;
-    var the_export = first_module
-        .instantiate({import_module_1: {import_name_1: f}})
-        .exports.first_export;
-    assertEquals(the_export(4, 5), 4);
-    assertEquals(the_export(-1, 4), -1);
-    assertEquals(the_export(0, 2), 0);
-    assertEquals(the_export(9.9, 4.3), 9);
-    assertEquals(%CheckWasmWrapperElision(the_export, expect_no_elison), true);
-});
-
-// function calls stack: first_export -> first_func -> first_import ->
-// second_export -> second_import
-// In this case, second_export has more params than first_import,
-// so instantiation should fail.
-assertThrows(function TestWasmWrapperNoElisionMoreParams() {
-    var imported = function (a, b, c) {
-        return a+b+c;
-    };
-
-    var second_module = new WasmModuleBuilder();
-    var sig_index_3 = second_module.addType(kSig_i_iii);
-    second_module
-        .addImport("import_module_2", "import_name_2", sig_index_3);
-    second_module
-        .addFunction("second_export", sig_index_3)
-        .addBody([
-            kExprGetLocal, 0,
-            kExprGetLocal, 1,
-            kExprGetLocal, 2,
-            kExprCallFunction, 0,
-            kExprReturn
-        ])
-        .exportFunc();
-
-    var first_module = new WasmModuleBuilder();
-    var sig_index_2 = first_module.addType(kSig_i_ii);
-    first_module
-        .addImport("import_module_1", "import_name_1", sig_index_2);
-    first_module
-        .addFunction("first_export", sig_index_2)
-        .addBody([
-            kExprGetLocal, 0,
-            kExprGetLocal, 1,
-            kExprCallFunction, 2,
-            kExprReturn
-        ])
-        .exportFunc();
-    first_module
-        .addFunction("first_func", sig_index_2)
-        .addBody([
-            kExprGetLocal, 0,
-            kExprGetLocal, 1,
-            kExprCallFunction, 0,
-            kExprReturn
-        ]);
-
-    var f = second_module
-        .instantiate({import_module_2: {import_name_2: imported}})
-        .exports.second_export;
-    var the_export = first_module
-        .instantiate({import_module_1: {import_name_1: f}})
-        .exports.first_export;
-    assertEquals(the_export(5, 6), 11);
-    assertEquals(the_export(-1, -4), -5);
-    assertEquals(the_export(0, 0), 0);
-    assertEquals(the_export(1.1, 2.7), 3);
-    assertEquals(%CheckWasmWrapperElision(the_export, expect_no_elison), true);
-});
-
-// function calls stack: first_export -> first_func -> first_import ->
-// second_export -> second_import
-// In this case, second_export has different params type with first_import,
-// so instantiation should fail.
-assertThrows(function TestWasmWrapperNoElisionTypeMismatch() {
-    var imported = function (a, b) {
-        return a+b;
-    };
-
-    var second_module = new WasmModuleBuilder();
-    var sig_index_2 = second_module.addType(kSig_d_dd);
-    second_module
-        .addImport("import_module_2", "import_name_2", sig_index_2);
-    second_module
-        .addFunction("second_export", sig_index_2)
-        .addBody([
-            kExprGetLocal, 0,
-            kExprGetLocal, 1,
-            kExprCallFunction, 0,
-            kExprReturn
-        ])
-        .exportFunc();
-
-    var first_module = new WasmModuleBuilder();
-    var sig_index_2 = first_module.addType(kSig_i_ii);
-    first_module
-        .addImport("import_module_1", "import_name_1", sig_index_2);
-    first_module
-        .addFunction("first_export", sig_index_2)
-        .addBody([
-            kExprGetLocal, 0,
-            kExprGetLocal, 1,
-            kExprCallFunction, 2,
-            kExprReturn
-        ])
-        .exportFunc();
-    first_module
-        .addFunction("first_func", sig_index_2)
-        .addBody([
-            kExprGetLocal, 0,
-            kExprGetLocal, 1,
-            kExprCallFunction, 0,
-            kExprReturn
-        ]);
-
-    var f = second_module
-        .instantiate({import_module_2: {import_name_2: imported}})
-        .exports.second_export;
-    var the_export = first_module
-        .instantiate({import_module_1: {import_name_1: f}})
-        .exports.first_export;
-    assertEquals(the_export(2.8, 9.1), 11);
-    assertEquals(the_export(-1.7, -2.5), -3);
-    assertEquals(the_export(0.0, 0.0), 0);
-    assertEquals(the_export(2, -2), 0);
-    assertEquals(%CheckWasmWrapperElision(the_export, expect_no_elison), true);
-});
-
-
-(function TestSimpleI64Ret() {
-  var builder = new WasmModuleBuilder();
-  builder.addFunction("exp", kSig_l_v)
-    .addBody([
-      kExprI64Const, 23
-    ])
-    .exportFunc();
-  var exported = builder.instantiate().exports.exp;
-
-  var builder = new WasmModuleBuilder();
-  builder.addImport("imp", "func", kSig_l_v);
-  builder.addFunction("main", kSig_i_v)
-    .addBody([
-      kExprCallFunction, 0,
-      kExprI32ConvertI64
-    ])
-    .exportFunc();
-
-  var instance = builder.instantiate({imp: {func: exported}});
-
-  assertEquals(23, instance.exports.main());
-
-})();
diff --git a/deps/v8/test/mjsunit/wasm/wasm-constants.js b/deps/v8/test/mjsunit/wasm/wasm-constants.js
index 4c86065b89a..4a303c77ac5 100644
--- a/deps/v8/test/mjsunit/wasm/wasm-constants.js
+++ b/deps/v8/test/mjsunit/wasm/wasm-constants.js
@@ -114,7 +114,7 @@ let kSig_i_dd = makeSig([kWasmF64, kWasmF64], [kWasmI32]);
 let kSig_v_v = makeSig([], []);
 let kSig_i_v = makeSig([], [kWasmI32]);
 let kSig_l_v = makeSig([], [kWasmI64]);
-let kSig_f_v = makeSig([], [kWasmF64]);
+let kSig_f_v = makeSig([], [kWasmF32]);
 let kSig_d_v = makeSig([], [kWasmF64]);
 let kSig_v_i = makeSig([kWasmI32], []);
 let kSig_v_ii = makeSig([kWasmI32, kWasmI32], []);
@@ -374,7 +374,7 @@ let kTrapRemByZero            = 4;
 let kTrapFloatUnrepresentable = 5;
 let kTrapFuncInvalid          = 6;
 let kTrapFuncSigMismatch      = 7;
-let kTrapInvalidIndex         = 8;
+let kTrapTypeError            = 8;
 
 let kTrapMsgs = [
   "unreachable",
@@ -382,10 +382,10 @@ let kTrapMsgs = [
   "divide by zero",
   "divide result unrepresentable",
   "remainder by zero",
-  "integer result unrepresentable",
-  "invalid function",
+  "float unrepresentable in integer range",
+  "invalid index into function table",
   "function signature mismatch",
-  "invalid index into function table"
+  "wasm function signature contains illegal type"
 ];
 
 function assertTraps(trap, code) {
diff --git a/deps/v8/test/mkgrokdump/BUILD.gn b/deps/v8/test/mkgrokdump/BUILD.gn
index 5359f675d05..e35ce57d844 100644
--- a/deps/v8/test/mkgrokdump/BUILD.gn
+++ b/deps/v8/test/mkgrokdump/BUILD.gn
@@ -24,4 +24,14 @@ v8_executable("mkgrokdump") {
     "//build/config:exe_and_shlib_deps",
     "//build/win:default_exe_manifest",
   ]
+
+  data_deps = [
+    "../../tools:v8_testrunner",
+  ]
+
+  data = [
+    "mkgrokdump.status",
+    "testcfg.py",
+    "../../tools/v8heapconst.py",
+  ]
 }
diff --git a/deps/v8/test/mkgrokdump/mkgrokdump.cc b/deps/v8/test/mkgrokdump/mkgrokdump.cc
index 75dac7a4a47..535dc47dd3f 100644
--- a/deps/v8/test/mkgrokdump/mkgrokdump.cc
+++ b/deps/v8/test/mkgrokdump/mkgrokdump.cc
@@ -37,13 +37,32 @@ class MockArrayBufferAllocator : public v8::ArrayBuffer::Allocator {
  public:
   void* Allocate(size_t length) override { return nullptr; }
   void* AllocateUninitialized(size_t length) override { return nullptr; }
-  void* Reserve(size_t length) override { return nullptr; }
-  void Free(void* data, size_t length, AllocationMode mode) override {}
   void Free(void* p, size_t) override {}
-  void SetProtection(void* data, size_t length,
-                     Protection protection) override {}
 };
 
+#define ROOT_LIST_CASE(type, name, camel_name) \
+  if (n == NULL && o == space->heap()->name()) n = #camel_name;
+#define STRUCT_LIST_CASE(upper_name, camel_name, name) \
+  if (n == NULL && o == space->heap()->name##_map()) n = #camel_name "Map";
+static void DumpMaps(i::PagedSpace* space) {
+  i::HeapObjectIterator it(space);
+  for (i::Object* o = it.Next(); o != NULL; o = it.Next()) {
+    if (!o->IsMap()) continue;
+    i::Map* m = i::Map::cast(o);
+    const char* n = NULL;
+    intptr_t p = reinterpret_cast<intptr_t>(m) & 0x7FFFF;
+    int t = m->instance_type();
+    ROOT_LIST(ROOT_LIST_CASE)
+    STRUCT_LIST(STRUCT_LIST_CASE)
+    if (n == NULL) continue;
+    const char* sname = AllocationSpaceName(space->identity());
+    i::PrintF("  (\"%s\", 0x%05" V8PRIxPTR "): (%d, \"%s\"),\n", sname, p, t,
+              n);
+  }
+}
+#undef STRUCT_LIST_CASE
+#undef ROOT_LIST_CASE
+
 static int DumpHeapConstants(const char* argv0) {
   // Start up V8.
   std::unique_ptr<v8::Platform> platform = v8::platform::NewDefaultPlatform();
@@ -66,25 +85,10 @@ static int DumpHeapConstants(const char* argv0) {
 
     // Dump the KNOWN_MAP table to the console.
     i::PrintF("\n# List of known V8 maps.\n");
-#define ROOT_LIST_CASE(type, name, camel_name) \
-  if (n == NULL && o == heap->name()) n = #camel_name;
-#define STRUCT_LIST_CASE(upper_name, camel_name, name) \
-  if (n == NULL && o == heap->name##_map()) n = #camel_name "Map";
-    i::HeapObjectIterator it(heap->map_space());
     i::PrintF("KNOWN_MAPS = {\n");
-    for (i::Object* o = it.Next(); o != NULL; o = it.Next()) {
-      i::Map* m = i::Map::cast(o);
-      const char* n = NULL;
-      intptr_t p = reinterpret_cast<intptr_t>(m) & 0x7FFFF;
-      int t = m->instance_type();
-      ROOT_LIST(ROOT_LIST_CASE)
-      STRUCT_LIST(STRUCT_LIST_CASE)
-      if (n == NULL) continue;
-      i::PrintF("  0x%05" V8PRIxPTR ": (%d, \"%s\"),\n", p, t, n);
-    }
+    DumpMaps(heap->read_only_space());
+    DumpMaps(heap->map_space());
     i::PrintF("}\n");
-#undef STRUCT_LIST_CASE
-#undef ROOT_LIST_CASE
 
     // Dump the KNOWN_OBJECTS table to the console.
     i::PrintF("\n# List of known V8 objects.\n");
@@ -93,7 +97,7 @@ static int DumpHeapConstants(const char* argv0) {
     n = #camel_name;                           \
     i = i::Heap::k##camel_name##RootIndex;     \
   }
-    i::PagedSpaces spit(heap);
+    i::PagedSpaces spit(heap, i::PagedSpaces::SpacesSpecifier::kAllPagedSpaces);
     i::PrintF("KNOWN_OBJECTS = {\n");
     for (i::PagedSpace* s = spit.next(); s != NULL; s = spit.next()) {
       i::HeapObjectIterator it(s);
@@ -102,6 +106,8 @@ static int DumpHeapConstants(const char* argv0) {
         continue;
       const char* sname = AllocationSpaceName(s->identity());
       for (i::Object* o = it.Next(); o != NULL; o = it.Next()) {
+        // Skip maps in RO_SPACE since they will be reported elsewhere.
+        if (o->IsMap()) continue;
         const char* n = NULL;
         i::Heap::RootListIndex i = i::Heap::kStrongRootListLength;
         intptr_t p = reinterpret_cast<intptr_t>(o) & 0x7FFFF;
@@ -120,7 +126,7 @@ static int DumpHeapConstants(const char* argv0) {
     i::PrintF("FRAME_MARKERS = (\n");
     STACK_FRAME_TYPE_LIST(DUMP_MARKER)
     i::PrintF(")\n");
-#undef DUMP_TYPE
+#undef DUMP_MARKER
   }
 
   i::PrintF("\n# This set of constants is generated from a %s build.\n",
diff --git a/deps/v8/test/mkgrokdump/mkgrokdump.gyp b/deps/v8/test/mkgrokdump/mkgrokdump.gyp
deleted file mode 100644
index 56f9ad14e09..00000000000
--- a/deps/v8/test/mkgrokdump/mkgrokdump.gyp
+++ /dev/null
@@ -1,46 +0,0 @@
-# Copyright 2017 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'variables': {
-    'v8_code': 1,
-  },
-  'includes': ['../../gypfiles/toolchain.gypi', '../../gypfiles/features.gypi'],
-  'targets': [
-    {
-      'target_name': 'mkgrokdump',
-      'type': 'executable',
-      'dependencies': [
-        '../../src/v8.gyp:v8',
-        '../../src/v8.gyp:v8_libbase',
-        '../../src/v8.gyp:v8_libplatform',
-      ],
-      'include_dirs': [
-        '../..',
-      ],
-      'sources': [
-        'mkgrokdump.cc',
-      ],
-    },
-  ],
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'mkgrokdump_run',
-          'type': 'none',
-          'dependencies': [
-            'mkgrokdump',
-          ],
-          'includes': [
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'mkgrokdump.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/mkgrokdump/mkgrokdump.isolate b/deps/v8/test/mkgrokdump/mkgrokdump.isolate
deleted file mode 100644
index b2cbc325517..00000000000
--- a/deps/v8/test/mkgrokdump/mkgrokdump.isolate
+++ /dev/null
@@ -1,17 +0,0 @@
-# Copyright 2017 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'files': [
-      './mkgrokdump.status',
-      './testcfg.py',
-      '../../tools/v8heapconst.py',
-      '<(PRODUCT_DIR)/mkgrokdump<(EXECUTABLE_SUFFIX)',
-    ],
-  },
-  'includes': [
-    '../../src/base.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
diff --git a/deps/v8/test/mkgrokdump/testcfg.py b/deps/v8/test/mkgrokdump/testcfg.py
index de8e71f7eab..d8f0380e752 100644
--- a/deps/v8/test/mkgrokdump/testcfg.py
+++ b/deps/v8/test/mkgrokdump/testcfg.py
@@ -18,7 +18,7 @@ def __init__(self, *args, **kwargs):
     v8_path = os.path.dirname(os.path.dirname(os.path.abspath(self.root)))
     self.expected_path = os.path.join(v8_path, 'tools', 'v8heapconst.py')
 
-  def ListTests(self, context):
+  def ListTests(self):
     test = self._create_test(SHELL)
     return [test]
 
@@ -33,7 +33,7 @@ def _get_variant_flags(self):
   def _get_statusfile_flags(self):
     return []
 
-  def _get_mode_flags(self, ctx):
+  def _get_mode_flags(self):
     return []
 
   def get_shell(self):
@@ -44,5 +44,5 @@ def output_proc(self):
     return mkgrokdump.OutProc(self.expected_outcomes, self.suite.expected_path)
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/mozilla/BUILD.gn b/deps/v8/test/mozilla/BUILD.gn
new file mode 100644
index 00000000000..7416a749b19
--- /dev/null
+++ b/deps/v8/test/mozilla/BUILD.gn
@@ -0,0 +1,16 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+group("v8_mozilla") {
+  testonly = true
+
+  data_deps = [
+    "../..:d8",
+    "../../tools:v8_testrunner",
+  ]
+
+  data = [
+    "./",
+  ]
+}
diff --git a/deps/v8/test/mozilla/mozilla.gyp b/deps/v8/test/mozilla/mozilla.gyp
deleted file mode 100644
index 0327dd8dab3..00000000000
--- a/deps/v8/test/mozilla/mozilla.gyp
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'mozilla_run',
-          'type': 'none',
-          'dependencies': [
-            '../../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../../gypfiles/features.gypi',
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'mozilla.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/mozilla/mozilla.isolate b/deps/v8/test/mozilla/mozilla.isolate
deleted file mode 100644
index dbeca5e55cf..00000000000
--- a/deps/v8/test/mozilla/mozilla.isolate
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'files': [
-      './',
-    ],
-  },
-  'includes': [
-    '../../src/d8.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
\ No newline at end of file
diff --git a/deps/v8/test/mozilla/mozilla.status b/deps/v8/test/mozilla/mozilla.status
index 40334cdcd85..24378217226 100644
--- a/deps/v8/test/mozilla/mozilla.status
+++ b/deps/v8/test/mozilla/mozilla.status
@@ -118,6 +118,10 @@
   # Invalid according to ES2015 syntax. (Details: crbug.com/726625)
   'ecma_3/extensions/regress-368516': [FAIL],
 
+  # Function.prototype.toString revision.
+  # (https://chromium-review.googlesource.com/c/546941#message-5dc0f5efe277388501e8870e39ec70383dfc7db8)
+  'js1_5/Scope/regress-185485': [FAIL],
+
   ##################### SKIPPED TESTS #####################
 
   # This test checks that we behave properly in an out-of-memory
diff --git a/deps/v8/test/mozilla/testcfg.py b/deps/v8/test/mozilla/testcfg.py
index 8e69b7d9b71..52ba9dcbcb3 100644
--- a/deps/v8/test/mozilla/testcfg.py
+++ b/deps/v8/test/mozilla/testcfg.py
@@ -56,11 +56,11 @@
 
 
 class TestSuite(testsuite.TestSuite):
-  def __init__(self, name, root):
-    super(TestSuite, self).__init__(name, root)
-    self.testroot = os.path.join(root, "data")
+  def __init__(self, *args, **kwargs):
+    super(TestSuite, self).__init__(*args, **kwargs)
+    self.testroot = os.path.join(self.root, "data")
 
-  def ListTests(self, context):
+  def ListTests(self):
     tests = []
     for testdir in TEST_DIRS:
       current_root = os.path.join(self.testroot, testdir)
@@ -86,7 +86,7 @@ def _test_class(self):
 
 
 class TestCase(testcase.TestCase):
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     files = [os.path.join(self.suite.root, "mozilla-shell-emulation.js")]
     testfilename = self.path + ".js"
     testfilepath = testfilename.split("/")
@@ -100,7 +100,7 @@ def _get_files_params(self, ctx):
     files.append(os.path.join(self.suite.testroot, testfilename))
     return files
 
-  def _get_suite_flags(self, ctx):
+  def _get_suite_flags(self):
     return ['--expose-gc']
 
   def _get_source_path(self):
@@ -118,5 +118,5 @@ def output_proc(self):
 
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/optimize_for_size.gyp b/deps/v8/test/optimize_for_size.gyp
deleted file mode 100644
index 8728479c231..00000000000
--- a/deps/v8/test/optimize_for_size.gyp
+++ /dev/null
@@ -1,30 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'optimize_for_size_run',
-          'type': 'none',
-          'dependencies': [
-            'cctest/cctest.gyp:cctest_run',
-            'debugger/debugger.gyp:debugger_run',
-            'intl/intl.gyp:intl_run',
-            'mjsunit/mjsunit.gyp:mjsunit_run',
-            'webkit/webkit.gyp:webkit_run',
-          ],
-          'includes': [
-            '../gypfiles/features.gypi',
-            '../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'optimize_for_size.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/optimize_for_size.isolate b/deps/v8/test/optimize_for_size.isolate
deleted file mode 100644
index 6f3313e8687..00000000000
--- a/deps/v8/test/optimize_for_size.isolate
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'command': [
-      '../tools/run-tests.py',
-    ],
-  },
-  'includes': [
-    'cctest/cctest.isolate',
-    'debugger/debugger.isolate',
-    'inspector/inspector.isolate',
-    'intl/intl.isolate',
-    'mjsunit/mjsunit.isolate',
-    'webkit/webkit.isolate',
-  ],
-}
diff --git a/deps/v8/test/perf.gyp b/deps/v8/test/perf.gyp
deleted file mode 100644
index 4f024f774fc..00000000000
--- a/deps/v8/test/perf.gyp
+++ /dev/null
@@ -1,27 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'perf_run',
-          'type': 'none',
-          'dependencies': [
-            'cctest/cctest.gyp:cctest_exe_run',
-            '../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../gypfiles/features.gypi',
-            '../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'perf.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/perf.isolate b/deps/v8/test/perf.isolate
deleted file mode 100644
index 132bcc54f08..00000000000
--- a/deps/v8/test/perf.isolate
+++ /dev/null
@@ -1,27 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'command': [
-      '../tools/run_perf.py',
-    ],
-    'files': [
-      '../tools/run_perf.py',
-      # TODO(machenbach): These files are referenced by the perf runner.
-      # They should be transformed into a proper python module.
-      '../tools/testrunner/local/command.py',
-      '../tools/testrunner/local/utils.py',
-      '../tools/testrunner/objects/output.py',
-      # This is often used to trigger performance bots. We include it in the
-      # isolate to not get these builds deduped.
-      '../tools/whitespace.txt',
-      'js-perf-test/',
-      'memory/',
-    ],
-  },
-  'includes': [
-    'cctest/cctest_exe.isolate',
-    '../src/d8.isolate',
-  ],
-}
diff --git a/deps/v8/test/preparser/BUILD.gn b/deps/v8/test/preparser/BUILD.gn
new file mode 100644
index 00000000000..7d158710978
--- /dev/null
+++ b/deps/v8/test/preparser/BUILD.gn
@@ -0,0 +1,16 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+group("v8_preparser") {
+  testonly = true
+
+  data_deps = [
+    "../..:d8",
+    "../../tools:v8_testrunner",
+  ]
+
+  data = [
+    "./",
+  ]
+}
diff --git a/deps/v8/test/preparser/preparser.gyp b/deps/v8/test/preparser/preparser.gyp
deleted file mode 100644
index 8e944ed0098..00000000000
--- a/deps/v8/test/preparser/preparser.gyp
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'preparser_run',
-          'type': 'none',
-          'dependencies': [
-            '../../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../../gypfiles/features.gypi',
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'preparser.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/preparser/preparser.isolate b/deps/v8/test/preparser/preparser.isolate
deleted file mode 100644
index dbeca5e55cf..00000000000
--- a/deps/v8/test/preparser/preparser.isolate
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'files': [
-      './',
-    ],
-  },
-  'includes': [
-    '../../src/d8.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
\ No newline at end of file
diff --git a/deps/v8/test/preparser/testcfg.py b/deps/v8/test/preparser/testcfg.py
index f6814e756fb..0ffde419d4a 100644
--- a/deps/v8/test/preparser/testcfg.py
+++ b/deps/v8/test/preparser/testcfg.py
@@ -60,7 +60,7 @@ def MkTest(replacement, expectation):
       return MkTest
     execfile(pathname, {"Test": Test, "Template": Template})
 
-  def ListTests(self, context):
+  def ListTests(self):
     result = []
 
     # Find all .pyt files in this directory.
@@ -77,33 +77,30 @@ def _create_test(self, path, source, template_flags):
   def _test_class(self):
     return TestCase
 
-  def _LegacyVariantsGeneratorFactory(self):
-    return testsuite.StandardLegacyVariantsGenerator
-
   def _variants_gen_class(self):
     return VariantsGenerator
 
 
 class TestCase(testcase.TestCase):
-  def __init__(self, suite, path, name, source, template_flags):
-    super(TestCase, self).__init__(suite, path, name)
+  def __init__(self, suite, path, name, test_config, source, template_flags):
+    super(TestCase, self).__init__(suite, path, name, test_config)
 
     self._source = source
     self._template_flags = template_flags
 
-  def _get_cmd_params(self, ctx):
+  def _get_cmd_params(self):
     return (
-        self._get_files_params(ctx) +
-        self._get_extra_flags(ctx) +
+        self._get_files_params() +
+        self._get_extra_flags() +
         ['-e', self._source] +
         self._template_flags +
         self._get_variant_flags() +
         self._get_statusfile_flags() +
-        self._get_mode_flags(ctx) +
+        self._get_mode_flags() +
         self._get_source_flags()
     )
 
-  def _get_mode_flags(self, ctx):
+  def _get_mode_flags(self):
     return []
 
   def is_source_available(self):
@@ -113,5 +110,5 @@ def get_source(self):
     return self._source
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/test262/BUILD.gn b/deps/v8/test/test262/BUILD.gn
index 9aaa7770c10..334511168d7 100644
--- a/deps/v8/test/test262/BUILD.gn
+++ b/deps/v8/test/test262/BUILD.gn
@@ -2,33 +2,22 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-import("../../gni/isolate.gni")
+group("v8_test262") {
+  testonly = true
 
-if (v8_test_isolation_mode != "noop") {
-  action("archive_test262") {
-    visibility = [ ":*" ]
-
-    script = "archive.py"
-
-    inputs = [
-      "list.py",
-    ]
-
-    sources = exec_script("list.py", [], "list lines")
-
-    outputs = [
-      "$target_gen_dir/test262_archiving.stamp",
-    ]
-
-    args = rebase_path(outputs, root_build_dir)
-  }
-}
-
-v8_isolate_run("test262") {
-  deps = [
-    ":archive_test262",
-    "../..:d8_run",
+  data_deps = [
+    "../..:d8",
+    "../../tools:v8_testrunner",
   ]
 
-  isolate = "test262.isolate"
-}
+  data = [
+    "data/",
+    "detachArrayBuffer.js",
+    "harness/",
+    "harness-adapt.js",
+    "harness-agent.js",
+    "test262.status",
+    "testcfg.py",
+    "local-tests/",
+  ]
+}
\ No newline at end of file
diff --git a/deps/v8/test/test262/archive.py b/deps/v8/test/test262/archive.py
deleted file mode 100755
index 894853e2085..00000000000
--- a/deps/v8/test/test262/archive.py
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/usr/bin/env python
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import os
-import sys
-import tarfile
-import time
-
-# In GN we expect the path to a stamp file as an argument.
-if len(sys.argv) == 2:
-  STAMP_FILE = os.path.abspath(sys.argv[1])
-
-os.chdir(os.path.dirname(os.path.abspath(__file__)))
-
-# Workaround for slow grp and pwd calls.
-tarfile.grp = None
-tarfile.pwd = None
-
-def filter_git(tar_info):
-  if tar_info.name.startswith(os.path.join('data', '.git')) or \
-      tar_info.name.startswith(os.path.join('harness', '.git')):
-    return None
-  else:
-    tar_info.uname = tar_info.gname = "test262"
-    return tar_info
-
-with tarfile.open('data.tar', 'w') as tar:
-  tar.add('data', filter=filter_git)
-  tar.add('harness', filter=filter_git)
-
-# Workaround for GN. We can't specify the tarfile as output because it's
-# not in the product directory. Therefore we track running of this script
-# with an extra stamp file in the product directory.
-if len(sys.argv) == 2:
-  with open(STAMP_FILE, 'w') as f:
-    f.write(str(time.time()))
diff --git a/deps/v8/test/test262/list.py b/deps/v8/test/test262/list.py
deleted file mode 100755
index e99be68cd7f..00000000000
--- a/deps/v8/test/test262/list.py
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/usr/bin/env python
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import os
-import sys
-import tarfile
-from itertools import chain
-
-os.chdir(os.path.dirname(os.path.abspath(__file__)))
-
-for root, dirs, files in chain(os.walk("data"), os.walk("harness")):
-  dirs[:] = [d for d in dirs if not d.endswith('.git')]
-  for name in files:
-    # These names are for gyp, which expects slashes on all platforms.
-    pathname = '/'.join(root.split(os.sep) + [name])
-    # For gyp, quote the name in case it includes spaces
-    if len(sys.argv) > 1 and sys.argv[1] == '--quoted':
-      pathname = '"' + pathname + '"'
-      # Temporary hack until we upgrade to gn swarming:
-      # gyp doesn't handle files containing $ in the name very well, so we just
-      # exclude them from the 'sources' list and hope that other changes cause
-      # the archive to be rebuilt.
-      if '$' in pathname: continue
-    print(pathname)
diff --git a/deps/v8/test/test262/local-tests/test/intl402/DateTimeFormat/12.1.1_1.js b/deps/v8/test/test262/local-tests/test/intl402/DateTimeFormat/12.1.1_1.js
index ef843d4bb48..9cabc6e50b7 100644
--- a/deps/v8/test/test262/local-tests/test/intl402/DateTimeFormat/12.1.1_1.js
+++ b/deps/v8/test/test262/local-tests/test/intl402/DateTimeFormat/12.1.1_1.js
@@ -31,12 +31,5 @@ testWithIntlConstructors(function (Constructor) {
       $ERROR("DateTimeFormat object created with \"new\" was not ignored as this-value.");
     }
 
-    // variant 2: use constructor as a function
-    obj = Constructor();
-    newObj = Intl.DateTimeFormat.call(obj);
-    if (obj === newObj) {
-      $ERROR("DateTimeFormat object created with constructor as function was not ignored as this-value.");
-    }
-
     return true;
 });
diff --git a/deps/v8/test/test262/local-tests/test/intl402/NumberFormat/11.1.1_1.js b/deps/v8/test/test262/local-tests/test/intl402/NumberFormat/11.1.1_1.js
index 2d42609acb1..b492a411836 100644
--- a/deps/v8/test/test262/local-tests/test/intl402/NumberFormat/11.1.1_1.js
+++ b/deps/v8/test/test262/local-tests/test/intl402/NumberFormat/11.1.1_1.js
@@ -31,12 +31,5 @@ testWithIntlConstructors(function (Constructor) {
       $ERROR("NumberFormat object created with \"new\" was not ignored as this-value.");
     }
 
-    // variant 2: use constructor as a function
-    obj = Constructor();
-    newObj = Intl.NumberFormat.call(obj);
-    if (obj === newObj) {
-      $ERROR("NumberFormat object created with constructor as function was not ignored as this-value.");
-    }
-
     return true;
 });
diff --git a/deps/v8/test/test262/test262.gyp b/deps/v8/test/test262/test262.gyp
deleted file mode 100644
index eb14da40103..00000000000
--- a/deps/v8/test/test262/test262.gyp
+++ /dev/null
@@ -1,34 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'test262_run',
-          'type': 'none',
-          'dependencies': [
-            '../../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../../gypfiles/features.gypi',
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'test262.isolate',
-          ],
-          'actions': [
-            {
-              'action_name': 'archive_test262',
-              'inputs': ['archive.py', '<!@(python list.py --quoted)'],
-              'outputs': ['data.tar'],
-              'action': ['python', 'archive.py'],
-            },
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/test262/test262.isolate b/deps/v8/test/test262/test262.isolate
deleted file mode 100644
index 7631438e419..00000000000
--- a/deps/v8/test/test262/test262.isolate
+++ /dev/null
@@ -1,20 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'files': [
-      'data.tar',
-      'detachArrayBuffer.js',
-      'harness-adapt.js',
-      'harness-agent.js',
-      'test262.status',
-      'testcfg.py',
-      'local-tests/',
-    ],
-  },
-  'includes': [
-    '../../src/d8.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
diff --git a/deps/v8/test/test262/test262.status b/deps/v8/test/test262/test262.status
index bd4b667a091..f58a1924595 100644
--- a/deps/v8/test/test262/test262.status
+++ b/deps/v8/test/test262/test262.status
@@ -85,69 +85,64 @@
   'language/statements/variable/binding-resolution': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=4895
+  'built-ins/TypedArrays/ctors/typedarray-arg/typedarray-arg-detached-when-species-retrieved-different-type': [FAIL],
+  'built-ins/TypedArrays/ctors-bigint/typedarray-arg/typedarray-arg-detached-when-species-retrieved-different-type': [FAIL],
+  'built-ins/TypedArrays/ctors/typedarray-arg/typedarray-arg-detached-when-species-retrieved-same-type': [FAIL],
+  'built-ins/TypedArrays/ctors-bigint/typedarray-arg/typedarray-arg-detached-when-species-retrieved-same-type': [FAIL],
   'built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer': [FAIL],
+  'built-ins/TypedArrays/internals/DefineOwnProperty/BigInt/detached-buffer': [FAIL],
   'built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrays/internals/DefineOwnProperty/BigInt/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrays/internals/DefineOwnProperty/tonumber-value-detached-buffer': [FAIL],
+  'built-ins/TypedArrays/internals/DefineOwnProperty/BigInt/tonumber-value-detached-buffer': [FAIL],
   'built-ins/TypedArrays/internals/Get/detached-buffer': [FAIL],
+  'built-ins/TypedArrays/internals/Get/BigInt/detached-buffer': [FAIL],
   'built-ins/TypedArrays/internals/Get/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrays/internals/Get/BigInt/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrays/internals/Get/infinity-detached-buffer': [FAIL],
+  'built-ins/TypedArrays/internals/Get/BigInt/infinity-detached-buffer': [FAIL],
   'built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer': [FAIL],
+  'built-ins/TypedArrays/internals/GetOwnProperty/BigInt/detached-buffer': [FAIL],
   'built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrays/internals/GetOwnProperty/BigInt/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrays/internals/GetOwnProperty/enumerate-detached-buffer': [FAIL],
+  'built-ins/TypedArrays/internals/GetOwnProperty/BigInt/enumerate-detached-buffer': [FAIL],
   'built-ins/TypedArrays/internals/HasProperty/detached-buffer': [FAIL],
+  'built-ins/TypedArrays/internals/HasProperty/BigInt/detached-buffer': [FAIL],
   'built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrays/internals/HasProperty/BigInt/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrays/internals/HasProperty/infinity-with-detached-buffer': [FAIL],
+  'built-ins/TypedArrays/internals/HasProperty/BigInt/infinity-with-detached-buffer': [FAIL],
   'built-ins/TypedArrays/internals/Set/detached-buffer': [FAIL],
+  'built-ins/TypedArrays/internals/Set/BigInt/detached-buffer': [FAIL],
   'built-ins/TypedArrays/internals/Set/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrays/internals/Set/BigInt/detached-buffer-realm': [FAIL],
   'built-ins/TypedArrays/internals/Set/tonumber-value-detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/DefineOwnProperty/tonumber-value-detached-buffer': [FAIL],
+  'built-ins/TypedArrays/internals/Set/BigInt/tonumber-value-detached-buffer': [FAIL],
   # Some TypedArray methods throw due to the same bug, from Get
   'built-ins/TypedArray/prototype/every/callbackfn-detachbuffer': [FAIL],
-  'built-ins/TypedArray/prototype/filter/callbackfn-detachbuffer': [FAIL],
+  'built-ins/TypedArray/prototype/every/BigInt/callbackfn-detachbuffer': [FAIL],
   'built-ins/TypedArray/prototype/find/predicate-may-detach-buffer': [FAIL],
+  'built-ins/TypedArray/prototype/find/BigInt/predicate-may-detach-buffer': [FAIL],
   'built-ins/TypedArray/prototype/findIndex/predicate-may-detach-buffer': [FAIL],
+  'built-ins/TypedArray/prototype/findIndex/BigInt/predicate-may-detach-buffer': [FAIL],
   'built-ins/TypedArray/prototype/forEach/callbackfn-detachbuffer': [FAIL],
+  'built-ins/TypedArray/prototype/forEach/BigInt/callbackfn-detachbuffer': [FAIL],
   'built-ins/TypedArray/prototype/map/callbackfn-detachbuffer': [FAIL],
+  'built-ins/TypedArray/prototype/map/BigInt/callbackfn-detachbuffer': [FAIL],
   'built-ins/TypedArray/prototype/reduce/callbackfn-detachbuffer': [FAIL],
+  'built-ins/TypedArray/prototype/reduce/BigInt/callbackfn-detachbuffer': [FAIL],
   'built-ins/TypedArray/prototype/reduceRight/callbackfn-detachbuffer': [FAIL],
-  'built-ins/TypedArray/prototype/slice/detached-buffer-custom-ctor-other-targettype': [FAIL],
-  'built-ins/TypedArray/prototype/slice/detached-buffer-custom-ctor-same-targettype': [FAIL],
-  'built-ins/TypedArray/prototype/slice/detached-buffer-get-ctor': [FAIL],
+  'built-ins/TypedArray/prototype/reduceRight/BigInt/callbackfn-detachbuffer': [FAIL],
   'built-ins/TypedArray/prototype/some/callbackfn-detachbuffer': [FAIL],
+  'built-ins/TypedArray/prototype/some/BigInt/callbackfn-detachbuffer': [FAIL],
   'built-ins/TypedArray/prototype/sort/detached-buffer-comparefn': [FAIL],
+  'built-ins/TypedArray/prototype/sort/BigInt/detached-buffer-comparefn': [FAIL],
   # DataView functions should also throw on detached buffers
   'built-ins/ArrayBuffer/prototype/byteLength/detached-buffer': [FAIL],
   'built-ins/DataView/detached-buffer': [FAIL],
   'built-ins/DataView/prototype/byteLength/detached-buffer': [FAIL],
   'built-ins/DataView/prototype/byteOffset/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/getFloat32/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/getFloat32/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/getFloat64/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/getFloat64/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/getInt16/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/getInt16/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/getInt32/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/getInt32/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/getInt8/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/getInt8/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/getUint16/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/getUint16/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/getUint32/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/getUint32/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/getUint8/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/getUint8/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/setFloat32/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/setFloat32/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/setFloat64/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/setFloat64/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/setInt16/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/setInt16/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/setInt32/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/setInt32/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/setInt8/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/setInt8/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/setUint16/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/setUint16/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/setUint32/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/setUint32/detached-buffer-before-outofrange-byteoffset': [FAIL],
-  'built-ins/DataView/prototype/setUint8/detached-buffer': [FAIL],
-  'built-ins/DataView/prototype/setUint8/detached-buffer-before-outofrange-byteoffset': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=4231
   'language/eval-code/direct/var-env-lower-lex-catch-non-strict': [FAIL],
@@ -215,6 +210,7 @@
   'language/literals/regexp/u-invalid-quantifiable-assertion': [FAIL],
   'language/literals/regexp/u-unicode-esc-bounds': [FAIL],
   'language/literals/regexp/u-unicode-esc-non-hex': [FAIL],
+  'language/literals/regexp/unicode-escape-nls-err': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=4628
   'language/eval-code/direct/non-definable-function-with-function': [FAIL],
@@ -267,7 +263,15 @@
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=4698
   'language/expressions/call/tco-call-args': [SKIP],
+  'language/expressions/call/tco-cross-realm-class-construct': [SKIP],
+  'language/expressions/call/tco-cross-realm-class-derived-construct': [SKIP],
+  'language/expressions/call/tco-cross-realm-fun-call': [SKIP],
+  'language/expressions/call/tco-cross-realm-fun-construct': [SKIP],
   'language/expressions/call/tco-member-args': [SKIP],
+  'language/expressions/call/tco-non-eval-function': [SKIP],
+  'language/expressions/call/tco-non-eval-function-dynamic': [SKIP],
+  'language/expressions/call/tco-non-eval-global': [SKIP],
+  'language/expressions/call/tco-non-eval-with': [SKIP],
   'language/expressions/comma/tco-final': [SKIP],
   'language/expressions/conditional/tco-cond': [SKIP],
   'language/expressions/conditional/tco-pos': [SKIP],
@@ -304,9 +308,13 @@
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=5327
   'built-ins/TypedArrays/internals/Set/key-is-minus-zero': [FAIL],
+  'built-ins/TypedArrays/internals/Set/BigInt/key-is-minus-zero': [FAIL],
   'built-ins/TypedArrays/internals/Set/key-is-not-integer': [FAIL],
+  'built-ins/TypedArrays/internals/Set/BigInt/key-is-not-integer': [FAIL],
   'built-ins/TypedArrays/internals/Set/key-is-out-of-bounds': [FAIL],
+  'built-ins/TypedArrays/internals/Set/BigInt/key-is-out-of-bounds': [FAIL],
   'built-ins/TypedArrays/internals/Set/tonumber-value-throws': [FAIL],
+  'built-ins/TypedArrays/internals/Set/BigInt/tonumber-value-throws': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=5329
   'built-ins/RegExp/prototype/source/value-line-terminator': [FAIL],
@@ -343,7 +351,6 @@
   'built-ins/DataView/buffer-does-not-have-arraybuffer-data-throws-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/DataView/buffer-reference-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/DataView/byteoffset-is-negative-throws-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/DataView/custom-proto-access-throws-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/DataView/custom-proto-if-not-object-fallbacks-to-default-prototype-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/DataView/custom-proto-if-object-is-used-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/DataView/defined-bytelength-and-byteoffset-sab': ['--harmony-sharedarraybuffer'],
@@ -371,7 +378,6 @@
   'built-ins/DataView/prototype/getInt32/return-values-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/DataView/prototype/getInt32/this-has-no-dataview-internal-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/DataView/prototype/getInt32/to-boolean-littleendian-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/DataView/prototype/getInt32/toindex-byteoffset-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/DataView/return-abrupt-tonumber-bytelength-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/DataView/return-abrupt-tonumber-bytelength-symbol-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/DataView/return-abrupt-tonumber-byteoffset-sab': ['--harmony-sharedarraybuffer'],
@@ -383,36 +389,20 @@
   'built-ins/TypedArray/prototype/set/typedarray-arg-set-values-diff-buffer-other-type-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/TypedArray/prototype/set/typedarray-arg-set-values-diff-buffer-same-type-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/TypedArray/prototype/set/typedarray-arg-set-values-same-buffer-same-type-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-bufferbyteoffset-throws-from-modulo-element-size-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-byteoffset-is-negative-throws-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-byteoffset-is-negative-zero-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-byteoffset-is-symbol-throws-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-byteoffset-throws-from-modulo-element-size-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-byteoffset-to-number-throws-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-custom-proto-access-throws-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-defined-length-and-offset-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-defined-length-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-defined-negative-length-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-defined-offset-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-excessive-length-throws-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-excessive-offset-throws-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-invoked-with-undefined-newtarget-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-is-referenced-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-length-access-throws-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-length-is-symbol-throws-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-new-instance-extensibility-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-returns-new-instance-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-toindex-bytelength-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-toindex-byteoffset-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-typedarray-backed-by-sharedarraybuffer': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-use-custom-proto-if-object-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/buffer-arg-use-default-proto-if-custom-proto-is-not-object-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/TypedArrays/internals/Get/indexed-value-sab': ['--harmony-sharedarraybuffer'],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=6045
-  'intl402/NumberFormat/prototype/format/11.3.2_TRF': [FAIL],
-  'intl402/NumberFormat/prototype/format/11.3.2_TRP': [FAIL],
+  # 64-bit Atomics are not implemented yet.
+  'built-ins/Atomics/wake/bad-range': ['--noharmony-bigint'],
+  'built-ins/Atomics/xor/bad-range': ['--noharmony-bigint'],
+  'built-ins/Atomics/load/bad-range': ['--noharmony-bigint'],
+  'built-ins/Atomics/compareExchange/bad-range': ['--noharmony-bigint'],
+  'built-ins/Atomics/wait/bad-range': ['--noharmony-bigint'],
+  'built-ins/Atomics/exchange/bad-range': ['--noharmony-bigint'],
+  'built-ins/Atomics/sub/bad-range': ['--noharmony-bigint'],
+  'built-ins/Atomics/store/bad-range': ['--noharmony-bigint'],
+  'built-ins/Atomics/or/bad-range': ['--noharmony-bigint'],
+  'built-ins/Atomics/and/bad-range': ['--noharmony-bigint'],
+  'built-ins/Atomics/add/bad-range': ['--noharmony-bigint'],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=6049
   'built-ins/Object/internals/DefineOwnProperty/consistent-value-function-caller': [FAIL_SLOPPY],
@@ -422,24 +412,9 @@
   'built-ins/Proxy/ownKeys/return-duplicate-entries-throws': [FAIL],
   'built-ins/Proxy/ownKeys/return-duplicate-symbol-entries-throws': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=6861
-  'language/expressions/object/method-definition/async-gen-yield-star-sync-next': [FAIL],
-  'language/expressions/class/async-gen-method-static-yield-star-sync-next': [FAIL],
-  'language/expressions/async-generator/yield-star-sync-next': [FAIL],
-  'language/statements/class/async-gen-method-static-yield-star-sync-next': [FAIL],
-  'language/expressions/async-generator/named-yield-star-sync-next': [FAIL],
-  'language/expressions/class/async-gen-method-yield-star-sync-next': [FAIL],
-  'language/statements/class/async-gen-method-yield-star-sync-next': [FAIL],
-  'language/statements/async-generator/yield-star-sync-next': [FAIL],
-
-  # https://bugs.chromium.org/p/v8/issues/detail?id=6791
-  'built-ins/BigInt/prototype/Symbol.toStringTag': [SKIP],
-  'built-ins/DataView/prototype/getBigInt64/*': [SKIP],
-  'built-ins/DataView/prototype/getBigUint64/*': [SKIP],
-  'built-ins/DataView/prototype/setBigInt64/*': [SKIP],
-  'built-ins/DataView/prototype/setBigUint64/*': [SKIP],
-  'built-ins/TypedArrays/BigInt64Array/*': [SKIP],
-  'built-ins/TypedArrays/BigUint64Array/*': [SKIP],
+  # https://github.com/tc39/test262/issues/1467
+  'built-ins/BigInt/prototype/Symbol.toStringTag': [FAIL],
+  'built-ins/TypedArrays/ctors-bigint/typedarray-arg/typedarray-arg-other-ctor-returns-new-typedarray': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=7184
   'annexB/language/expressions/yield/star-iterable-return-emulates-undefined-throws-when-called': [FAIL],
@@ -450,6 +425,61 @@
   'language/statements/class/fields-indirect-eval-err-contains-arguments': [FAIL],
   'language/expressions/class/fields-indirect-eval-err-contains-arguments': [FAIL],
 
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7468
+  'language/statements/class/privatename-not-valid-earlyerr-script-8': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=5690
+  'language/expressions/call/eval-spread': [FAIL],
+  'language/expressions/call/eval-spread-empty-leading': [FAIL],
+  'language/expressions/call/eval-spread-empty-trailing': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7471
+  'intl402/DateTimeFormat/prototype/format/time-clip-near-time-boundaries': [FAIL],
+  'intl402/DateTimeFormat/prototype/format/time-clip-to-integer': [FAIL],
+  'intl402/DateTimeFormat/prototype/formatToParts/time-clip-near-time-boundaries': [FAIL],
+  'intl402/DateTimeFormat/prototype/formatToParts/time-clip-to-integer': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7472
+  'intl402/NumberFormat/currency-digits': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7473
+  'intl402/language-tags-canonicalized': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7474
+  'intl402/NumberFormat/prototype/format/format-fraction-digits': [FAIL],
+  'intl402/NumberFormat/prototype/format/format-significant-digits': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7475
+  'built-ins/Date/UTC/non-integer-values': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7480
+  'intl402/Collator/unicode-ext-seq-in-private-tag': [FAIL],
+  'intl402/Collator/unicode-ext-seq-with-attribute': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7481
+  'intl402/NumberFormat/ignore-invalid-unicode-ext-values': [FAIL],
+  'intl402/DateTimeFormat/ignore-invalid-unicode-ext-values': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7482
+  'intl402/DateTimeFormat/prototype/resolvedOptions/resolved-locale-with-hc-unicode': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7483
+  'annexB/built-ins/Function/createdynfn-html-close-comment-params': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=5012
+  'intl402/Intl/getCanonicalLocales/canonicalized-tags': [FAIL],
+  'intl402/Intl/getCanonicalLocales/preferred-grandfathered': [FAIL],
+  'intl402/Intl/getCanonicalLocales/preferred-variant': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7513
+  'built-ins/TypedArrays/ctors/buffer-arg/buffer-arg-bufferbyteoffset-throws-from-modulo-element-size': [FAIL],
+  'built-ins/TypedArrays/ctors/buffer-arg/buffer-arg-byteoffset-throws-from-modulo-element-size': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7512
+  'built-ins/TypedArrays/ctors/typedarray-arg/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm': [FAIL],
+  'built-ins/TypedArrays/ctors/typedarray-arg/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm': [FAIL],
+  'built-ins/TypedArrays/ctors-bigint/typedarray-arg/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm': [FAIL],
+  'built-ins/TypedArrays/ctors-bigint/typedarray-arg/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm': [FAIL],
 
 ######################## NEEDS INVESTIGATION ###########################
 
@@ -457,17 +487,7 @@
   # to be either marked as bugs with issues filed for them or as deliberate
   # incompatibilities if the test cases turn out to be broken or ambiguous.
   # Some of these are related to v8:4361 in being visible side effects from Intl.
-  'intl402/6.2.3_a': [FAIL],
-  'intl402/Collator/10.1.2_a': [PASS, FAIL],
-  'intl402/Collator/10.2.3_b': [PASS, FAIL],
   'intl402/DateTimeFormat/prototype/resolvedOptions/hourCycle': [FAIL],
-  'intl402/DateTimeFormat/12.1.2': [PASS, FAIL],
-  'intl402/DateTimeFormat/12.2.3_b': [FAIL],
-  'intl402/Number/prototype/toLocaleString/13.2.1_5': [PASS, FAIL],
-  'intl402/NumberFormat/11.1.1_20_c': [FAIL],
-  'intl402/NumberFormat/11.1.2': [PASS, FAIL],
-  'intl402/NumberFormat/11.2.3_b': [FAIL],
-  'intl402/String/prototype/localeCompare/13.1.1_7': [PASS, FAIL],
 
   ##################### DELIBERATE INCOMPATIBILITIES #####################
 
@@ -514,13 +534,13 @@
   # Test262 Bug: https://bugs.ecmascript.org/show_bug.cgi?id=596
   'built-ins/Array/prototype/sort/bug_596_1': [PASS, FAIL_OK],
 
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7418
+  'language/line-terminators/S7.3_A2.3': [FAIL],
+  'language/line-terminators/S7.3_A2.4': [FAIL],
+
   # https://github.com/tc39/test262/pull/688#pullrequestreview-14025354
   'built-ins/Function/internals/Construct/derived-this-uninitialized-realm': [FAIL],
 
-  # https://github.com/tc39/test262/pull/688/files#r93657665
-  'built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm': [FAIL],
-  'built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm': [FAIL],
-
   # Date tests that fail in CE(S)T timezone.
   # https://bugs.chromium.org/p/v8/issues/detail?id=5449
   'built-ins/Date/prototype/setFullYear/new-value-time-clip': [PASS, FAIL],
@@ -548,7 +568,6 @@
   'built-ins/decodeURIComponent/S15.1.3.2_A1.12_T1': [SKIP],
   'built-ins/decodeURIComponent/S15.1.3.2_A2.5_T1': [SKIP],
   'built-ins/RegExp/S15.10.2.12_A3_T1': [SKIP],
-  'intl402/9.2.6_4_b': [SKIP],
   'language/literals/regexp/S7.8.5_A1.1_T2': [SKIP],
   'language/literals/regexp/S7.8.5_A1.4_T2': [SKIP],
   'language/literals/regexp/S7.8.5_A2.1_T2': [SKIP],
diff --git a/deps/v8/test/test262/testcfg.py b/deps/v8/test/test262/testcfg.py
index 2f23fb67fbf..86703a7ce5f 100644
--- a/deps/v8/test/test262/testcfg.py
+++ b/deps/v8/test/test262/testcfg.py
@@ -31,7 +31,6 @@
 import os
 import re
 import sys
-import tarfile
 
 from testrunner.local import statusfile
 from testrunner.local import testsuite
@@ -47,14 +46,17 @@
   'regexp-named-groups': '--harmony-regexp-named-captures',
   'regexp-unicode-property-escapes': '--harmony-regexp-property',
   'Promise.prototype.finally': '--harmony-promise-finally',
-  'class-fields-public': '--harmony-class-fields',
+  'class-fields-public': '--harmony-public-fields',
   'optional-catch-binding': '--harmony-optional-catch-binding',
+  'class-fields-private': '--harmony-private-fields',
+  'Array.prototype.flatten': '--harmony-array-flatten',
+  'Array.prototype.flatMap': '--harmony-array-flatten',
+  'numeric-separator-literal': '--harmony-numeric-separator',
 }
 
-SKIPPED_FEATURES = set(['class-fields-private'])
+SKIPPED_FEATURES = set([])
 
 DATA = os.path.join(os.path.dirname(os.path.abspath(__file__)), "data")
-ARCHIVE = DATA + ".tar"
 
 TEST_262_HARNESS_FILES = ["sta.js", "assert.js"]
 TEST_262_NATIVE_FILES = ["detachArrayBuffer.js"]
@@ -70,32 +72,6 @@
 sys.path.append(os.path.join(os.path.dirname(os.path.abspath(__file__)),
                              *TEST_262_TOOLS_PATH))
 
-ALL_VARIANT_FLAGS_STRICT = dict(
-    (v, [flags + ["--use-strict"] for flags in flag_sets])
-    for v, flag_sets in testsuite.ALL_VARIANT_FLAGS.iteritems()
-)
-
-ALL_VARIANT_FLAGS_BOTH = dict(
-    (v, [flags for flags in testsuite.ALL_VARIANT_FLAGS[v] +
-                            ALL_VARIANT_FLAGS_STRICT[v]])
-    for v in testsuite.ALL_VARIANT_FLAGS
-)
-
-ALL_VARIANTS = {
-  'nostrict': testsuite.ALL_VARIANT_FLAGS,
-  'strict': ALL_VARIANT_FLAGS_STRICT,
-  'both': ALL_VARIANT_FLAGS_BOTH,
-}
-
-class LegacyVariantsGenerator(testsuite.LegacyVariantsGenerator):
-  def GetFlagSets(self, test, variant):
-    test_record = test.test_record
-    if "noStrict" in test_record:
-      return ALL_VARIANTS["nostrict"][variant]
-    if "onlyStrict" in test_record:
-      return ALL_VARIANTS["strict"][variant]
-    return ALL_VARIANTS["both"][variant]
-
 
 class VariantsGenerator(testsuite.VariantsGenerator):
   def gen(self, test):
@@ -116,33 +92,16 @@ class TestSuite(testsuite.TestSuite):
   # Match the (...) in '/path/to/v8/test/test262/subdir/test/(...).js'
   # In practice, subdir is data or local-tests
 
-  def __init__(self, name, root):
-    super(TestSuite, self).__init__(name, root)
+  def __init__(self, *args, **kwargs):
+    super(TestSuite, self).__init__(*args, **kwargs)
     self.testroot = os.path.join(self.root, *TEST_262_SUITE_PATH)
     self.harnesspath = os.path.join(self.root, *TEST_262_HARNESS_PATH)
     self.harness = [os.path.join(self.harnesspath, f)
                     for f in TEST_262_HARNESS_FILES]
     self.harness += [os.path.join(self.root, "harness-adapt.js")]
     self.localtestroot = os.path.join(self.root, *TEST_262_LOCAL_TESTS_PATH)
-
-    self._extract_sources()
     self.parse_test_record = self._load_parse_test_record()
 
-  def _extract_sources(self):
-    # The archive is created only on swarming. Local checkouts have the
-    # data folder.
-    if (os.path.exists(ARCHIVE) and
-        # Check for a JS file from the archive if we need to unpack. Some other
-        # files from the archive unfortunately exist due to a bug in the
-        # isolate_processor.
-        # TODO(machenbach): Migrate this to GN to avoid using the faulty
-        # isolate_processor: http://crbug.com/669910
-        not os.path.exists(os.path.join(DATA, 'test', 'harness', 'error.js'))):
-      print "Extracting archive..."
-      tar = tarfile.open(ARCHIVE)
-      tar.extractall(path=os.path.dirname(ARCHIVE))
-      tar.close()
-
   def _load_parse_test_record(self):
     root = os.path.join(self.root, *TEST_262_TOOLS_PATH)
     f = None
@@ -158,13 +117,13 @@ def _load_parse_test_record(self):
       if f:
         f.close()
 
-  def ListTests(self, context):
+  def ListTests(self):
     testnames = set()
     for dirname, dirs, files in itertools.chain(os.walk(self.testroot),
                                                 os.walk(self.localtestroot)):
       for dotted in [x for x in dirs if x.startswith(".")]:
         dirs.remove(dotted)
-      if context.noi18n and "intl402" in dirs:
+      if self.test_config.noi18n and "intl402" in dirs:
         dirs.remove("intl402")
       dirs.sort()
       files.sort()
@@ -184,9 +143,6 @@ def ListTests(self, context):
   def _test_class(self):
     return TestCase
 
-  def _LegacyVariantsGeneratorFactory(self):
-    return LegacyVariantsGenerator
-
   def _variants_gen_class(self):
     return VariantsGenerator
 
@@ -203,7 +159,7 @@ def __init__(self, *args, **kwargs):
           .get('type', None)
     )
 
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     return (
         list(self.suite.harness) +
         ([os.path.join(self.suite.root, "harness-agent.js")]
@@ -213,7 +169,7 @@ def _get_files_params(self, ctx):
         [self._get_source_path()]
     )
 
-  def _get_suite_flags(self, ctx):
+  def _get_suite_flags(self):
     return (
         (["--throws"] if "negative" in self.test_record else []) +
         (["--allow-natives-syntax"]
@@ -250,5 +206,5 @@ def output_proc(self):
     return test262.NoExceptionOutProc(self.expected_outcomes)
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/unittests/BUILD.gn b/deps/v8/test/unittests/BUILD.gn
index 7f70a5c959a..08669793c2d 100644
--- a/deps/v8/test/unittests/BUILD.gn
+++ b/deps/v8/test/unittests/BUILD.gn
@@ -23,11 +23,21 @@ v8_executable("unittests") {
     "//testing/gtest",
   ]
 
+  data_deps = [
+    "../../tools:v8_testrunner",
+  ]
+
+  data = [
+    "testcfg.py",
+    "unittests.status",
+  ]
+
   configs = [
     "../..:external_config",
     "../..:internal_config_base",
   ]
 }
+
 v8_source_set("unittests_sources") {
   testonly = true
 
@@ -98,6 +108,7 @@ v8_source_set("unittests_sources") {
     "compiler/instruction-unittest.cc",
     "compiler/int64-lowering-unittest.cc",
     "compiler/js-builtin-reducer-unittest.cc",
+    "compiler/js-call-reducer-unittest.cc",
     "compiler/js-create-lowering-unittest.cc",
     "compiler/js-intrinsic-lowering-unittest.cc",
     "compiler/js-operator-unittest.cc",
@@ -143,6 +154,7 @@ v8_source_set("unittests_sources") {
     "heap/item-parallel-job-unittest.cc",
     "heap/marking-unittest.cc",
     "heap/memory-reducer-unittest.cc",
+    "heap/object-stats-unittest.cc",
     "heap/scavenge-job-unittest.cc",
     "heap/slot-set-unittest.cc",
     "heap/spaces-unittest.cc",
diff --git a/deps/v8/test/unittests/allocation-unittest.cc b/deps/v8/test/unittests/allocation-unittest.cc
index 42904da1497..68cd8a77e0f 100644
--- a/deps/v8/test/unittests/allocation-unittest.cc
+++ b/deps/v8/test/unittests/allocation-unittest.cc
@@ -112,6 +112,7 @@ TEST_F(MemoryAllocationPermissionsTest, DoTest) {
   TestPermissions(PageAllocator::Permission::kNoAccess, false, false);
   TestPermissions(PageAllocator::Permission::kReadWrite, true, true);
   TestPermissions(PageAllocator::Permission::kReadWriteExecute, true, true);
+  TestPermissions(PageAllocator::Permission::kReadExecute, true, false);
 }
 #endif  // V8_OS_POSIX
 
@@ -134,8 +135,8 @@ TEST(AllocationTest, AllocateAndFree) {
   // A large allocation, aligned significantly beyond native granularity.
   const size_t kBigAlignment = 64 * v8::internal::MB;
   void* aligned_mem_addr = v8::internal::AllocatePages(
-      v8::internal::GetRandomMmapAddr(), kAllocationSize, kBigAlignment,
-      PageAllocator::Permission::kReadWrite);
+      AlignedAddress(v8::internal::GetRandomMmapAddr(), kBigAlignment),
+      kAllocationSize, kBigAlignment, PageAllocator::Permission::kReadWrite);
   CHECK_NOT_NULL(aligned_mem_addr);
   CHECK_EQ(aligned_mem_addr, AlignedAddress(aligned_mem_addr, kBigAlignment));
   CHECK(v8::internal::FreePages(aligned_mem_addr, kAllocationSize));
diff --git a/deps/v8/test/unittests/api/isolate-unittest.cc b/deps/v8/test/unittests/api/isolate-unittest.cc
index 5a7c8e0ceff..377ad83187b 100644
--- a/deps/v8/test/unittests/api/isolate-unittest.cc
+++ b/deps/v8/test/unittests/api/isolate-unittest.cc
@@ -9,6 +9,7 @@
 #include "include/v8.h"
 #include "src/base/macros.h"
 #include "src/base/platform/semaphore.h"
+#include "src/base/template-utils.h"
 #include "src/execution.h"
 #include "src/isolate.h"
 #include "src/v8.h"
@@ -60,9 +61,8 @@ TEST_F(IsolateTest, MemoryPressureNotificationBackground) {
 
   base::Semaphore semaphore(0);
 
-  internal::V8::GetCurrentPlatform()->CallOnBackgroundThread(
-      new MemoryPressureTask(isolate(), &semaphore),
-      v8::Platform::kShortRunningTask);
+  internal::V8::GetCurrentPlatform()->CallOnWorkerThread(
+      base::make_unique<MemoryPressureTask>(isolate(), &semaphore));
 
   semaphore.Wait();
 
diff --git a/deps/v8/test/unittests/base/logging-unittest.cc b/deps/v8/test/unittests/base/logging-unittest.cc
index a0686a2f643..d73845c373f 100644
--- a/deps/v8/test/unittests/base/logging-unittest.cc
+++ b/deps/v8/test/unittests/base/logging-unittest.cc
@@ -248,6 +248,42 @@ TEST(LoggingDeathTest, V8_DcheckCanBeOverridden) {
       "Dread pirate");
 }
 
+#if defined(DEBUG)
+namespace {
+int g_log_sink_call_count = 0;
+void DcheckCountFunction(const char* file, int line, const char* message) {
+  ++g_log_sink_call_count;
+}
+
+void DcheckEmptyFunction1() {
+  // Provide a body so that Release builds do not cause the compiler to
+  // optimize DcheckEmptyFunction1 and DcheckEmptyFunction2 as a single
+  // function, which breaks the Dcheck tests below.
+  // Note that this function is never actually called.
+  g_log_sink_call_count += 42;
+}
+void DcheckEmptyFunction2() {}
+
+}  // namespace
+
+TEST(LoggingTest, LogFunctionPointers) {
+  v8::base::SetDcheckFunction(&DcheckCountFunction);
+  g_log_sink_call_count = 0;
+  void (*fp1)() = DcheckEmptyFunction1;
+  void (*fp2)() = DcheckEmptyFunction2;
+  void (*fp3)() = DcheckEmptyFunction1;
+  DCHECK_EQ(fp1, DcheckEmptyFunction1);
+  DCHECK_EQ(fp1, fp3);
+  EXPECT_EQ(0, g_log_sink_call_count);
+  DCHECK_EQ(fp1, fp2);
+  EXPECT_EQ(1, g_log_sink_call_count);
+  std::string* error_message =
+      CheckEQImpl<decltype(fp1), decltype(fp2)>(fp1, fp2, "");
+  EXPECT_NE(*error_message, "(1 vs 1)");
+  delete error_message;
+}
+#endif  // defined(DEBUG)
+
 }  // namespace logging_unittest
 }  // namespace base
 }  // namespace v8
diff --git a/deps/v8/test/unittests/base/macros-unittest.cc b/deps/v8/test/unittests/base/macros-unittest.cc
index 593319d1f8e..a7bd8769794 100644
--- a/deps/v8/test/unittests/base/macros-unittest.cc
+++ b/deps/v8/test/unittests/base/macros-unittest.cc
@@ -21,5 +21,41 @@ TEST(AlignedAddressTest, AlignedAddress) {
             AlignedAddress(reinterpret_cast<void*>(0xFFFFF), 0x100000));
 }
 
+struct TriviallyCopyable {
+  const int i;
+};
+ASSERT_TRIVIALLY_COPYABLE(TriviallyCopyable);
+
+struct StillTriviallyCopyable {
+  const int i;
+  StillTriviallyCopyable(const StillTriviallyCopyable&) = delete;
+};
+ASSERT_TRIVIALLY_COPYABLE(StillTriviallyCopyable);
+
+struct NonTrivialDestructor {
+  ~NonTrivialDestructor() {}
+};
+ASSERT_NOT_TRIVIALLY_COPYABLE(NonTrivialDestructor);
+
+struct NonTrivialCopyConstructor {
+  NonTrivialCopyConstructor(const NonTrivialCopyConstructor&) {}
+};
+ASSERT_NOT_TRIVIALLY_COPYABLE(NonTrivialCopyConstructor);
+
+struct NonTrivialMoveConstructor {
+  NonTrivialMoveConstructor(const NonTrivialMoveConstructor&) {}
+};
+ASSERT_NOT_TRIVIALLY_COPYABLE(NonTrivialMoveConstructor);
+
+struct NonTrivialCopyAssignment {
+  NonTrivialCopyAssignment(const NonTrivialCopyAssignment&) {}
+};
+ASSERT_NOT_TRIVIALLY_COPYABLE(NonTrivialCopyAssignment);
+
+struct NonTrivialMoveAssignment {
+  NonTrivialMoveAssignment(const NonTrivialMoveAssignment&) {}
+};
+ASSERT_NOT_TRIVIALLY_COPYABLE(NonTrivialMoveAssignment);
+
 }  // namespace base
 }  // namespace v8
diff --git a/deps/v8/test/unittests/base/platform/time-unittest.cc b/deps/v8/test/unittests/base/platform/time-unittest.cc
index 7417e1c70b8..19420d5dc6b 100644
--- a/deps/v8/test/unittests/base/platform/time-unittest.cc
+++ b/deps/v8/test/unittests/base/platform/time-unittest.cc
@@ -24,6 +24,163 @@
 namespace v8 {
 namespace base {
 
+TEST(TimeDelta, ZeroMinMax) {
+  constexpr TimeDelta kZero;
+  static_assert(kZero.IsZero(), "");
+
+  constexpr TimeDelta kMax = TimeDelta::Max();
+  static_assert(kMax.IsMax(), "");
+  static_assert(kMax == TimeDelta::Max(), "");
+  EXPECT_GT(kMax, TimeDelta::FromDays(100 * 365));
+  static_assert(kMax > kZero, "");
+
+  constexpr TimeDelta kMin = TimeDelta::Min();
+  static_assert(kMin.IsMin(), "");
+  static_assert(kMin == TimeDelta::Min(), "");
+  EXPECT_LT(kMin, TimeDelta::FromDays(-100 * 365));
+  static_assert(kMin < kZero, "");
+}
+
+TEST(TimeDelta, MaxConversions) {
+  // static_assert also confirms constexpr works as intended.
+  constexpr TimeDelta kMax = TimeDelta::Max();
+  EXPECT_EQ(kMax.InDays(), std::numeric_limits<int>::max());
+  EXPECT_EQ(kMax.InHours(), std::numeric_limits<int>::max());
+  EXPECT_EQ(kMax.InMinutes(), std::numeric_limits<int>::max());
+  EXPECT_EQ(kMax.InSecondsF(), std::numeric_limits<double>::infinity());
+  EXPECT_EQ(kMax.InSeconds(), std::numeric_limits<int64_t>::max());
+  EXPECT_EQ(kMax.InMillisecondsF(), std::numeric_limits<double>::infinity());
+  EXPECT_EQ(kMax.InMilliseconds(), std::numeric_limits<int64_t>::max());
+  EXPECT_EQ(kMax.InMillisecondsRoundedUp(),
+            std::numeric_limits<int64_t>::max());
+
+  // TODO(v8-team): Import overflow support from Chromium's base.
+
+  // EXPECT_TRUE(TimeDelta::FromDays(std::numeric_limits<int>::max()).IsMax());
+
+  // EXPECT_TRUE(
+  //     TimeDelta::FromHours(std::numeric_limits<int>::max()).IsMax());
+
+  // EXPECT_TRUE(
+  //     TimeDelta::FromMinutes(std::numeric_limits<int>::max()).IsMax());
+
+  // constexpr int64_t max_int = std::numeric_limits<int64_t>::max();
+  // constexpr int64_t min_int = std::numeric_limits<int64_t>::min();
+
+  // EXPECT_TRUE(
+  //     TimeDelta::FromSeconds(max_int / Time::kMicrosecondsPerSecond + 1)
+  //         .IsMax());
+
+  // EXPECT_TRUE(TimeDelta::FromMilliseconds(
+  //                 max_int / Time::kMillisecondsPerSecond + 1)
+  //                 .IsMax());
+
+  // EXPECT_TRUE(TimeDelta::FromMicroseconds(max_int).IsMax());
+
+  // EXPECT_TRUE(
+  //     TimeDelta::FromSeconds(min_int / Time::kMicrosecondsPerSecond - 1)
+  //         .IsMin());
+
+  // EXPECT_TRUE(TimeDelta::FromMilliseconds(
+  //                 min_int / Time::kMillisecondsPerSecond - 1)
+  //                 .IsMin());
+
+  // EXPECT_TRUE(TimeDelta::FromMicroseconds(min_int).IsMin());
+
+  // EXPECT_TRUE(
+  //     TimeDelta::FromMicroseconds(std::numeric_limits<int64_t>::min())
+  //         .IsMin());
+}
+
+TEST(TimeDelta, NumericOperators) {
+  constexpr int i = 2;
+  EXPECT_EQ(TimeDelta::FromMilliseconds(2000),
+            (TimeDelta::FromMilliseconds(1000) * i));
+  EXPECT_EQ(TimeDelta::FromMilliseconds(500),
+            (TimeDelta::FromMilliseconds(1000) / i));
+  EXPECT_EQ(TimeDelta::FromMilliseconds(2000),
+            (TimeDelta::FromMilliseconds(1000) *= i));
+  EXPECT_EQ(TimeDelta::FromMilliseconds(500),
+            (TimeDelta::FromMilliseconds(1000) /= i));
+
+  constexpr int64_t i64 = 2;
+  EXPECT_EQ(TimeDelta::FromMilliseconds(2000),
+            (TimeDelta::FromMilliseconds(1000) * i64));
+  EXPECT_EQ(TimeDelta::FromMilliseconds(500),
+            (TimeDelta::FromMilliseconds(1000) / i64));
+  EXPECT_EQ(TimeDelta::FromMilliseconds(2000),
+            (TimeDelta::FromMilliseconds(1000) *= i64));
+  EXPECT_EQ(TimeDelta::FromMilliseconds(500),
+            (TimeDelta::FromMilliseconds(1000) /= i64));
+
+  EXPECT_EQ(TimeDelta::FromMilliseconds(2000),
+            (TimeDelta::FromMilliseconds(1000) * 2));
+  EXPECT_EQ(TimeDelta::FromMilliseconds(500),
+            (TimeDelta::FromMilliseconds(1000) / 2));
+  EXPECT_EQ(TimeDelta::FromMilliseconds(2000),
+            (TimeDelta::FromMilliseconds(1000) *= 2));
+  EXPECT_EQ(TimeDelta::FromMilliseconds(500),
+            (TimeDelta::FromMilliseconds(1000) /= 2));
+}
+
+// TODO(v8-team): Import support for overflow from Chromium's base.
+TEST(TimeDelta, DISABLED_Overflows) {
+  // Some sanity checks. static_assert's used were possible to verify constexpr
+  // evaluation at the same time.
+  static_assert(TimeDelta::Max().IsMax(), "");
+  static_assert(-TimeDelta::Max() < TimeDelta(), "");
+  static_assert(-TimeDelta::Max() > TimeDelta::Min(), "");
+  static_assert(TimeDelta() > -TimeDelta::Max(), "");
+
+  TimeDelta large_delta = TimeDelta::Max() - TimeDelta::FromMilliseconds(1);
+  TimeDelta large_negative = -large_delta;
+  EXPECT_GT(TimeDelta(), large_negative);
+  EXPECT_FALSE(large_delta.IsMax());
+  EXPECT_FALSE((-large_negative).IsMin());
+  const TimeDelta kOneSecond = TimeDelta::FromSeconds(1);
+
+  // Test +, -, * and / operators.
+  EXPECT_TRUE((large_delta + kOneSecond).IsMax());
+  EXPECT_TRUE((large_negative + (-kOneSecond)).IsMin());
+  EXPECT_TRUE((large_negative - kOneSecond).IsMin());
+  EXPECT_TRUE((large_delta - (-kOneSecond)).IsMax());
+  EXPECT_TRUE((large_delta * 2).IsMax());
+  EXPECT_TRUE((large_delta * -2).IsMin());
+
+  // Test +=, -=, *= and /= operators.
+  TimeDelta delta = large_delta;
+  delta += kOneSecond;
+  EXPECT_TRUE(delta.IsMax());
+  delta = large_negative;
+  delta += -kOneSecond;
+  EXPECT_TRUE((delta).IsMin());
+
+  delta = large_negative;
+  delta -= kOneSecond;
+  EXPECT_TRUE((delta).IsMin());
+  delta = large_delta;
+  delta -= -kOneSecond;
+  EXPECT_TRUE(delta.IsMax());
+
+  delta = large_delta;
+  delta *= 2;
+  EXPECT_TRUE(delta.IsMax());
+
+  // Test operations with Time and TimeTicks.
+  EXPECT_TRUE((large_delta + Time::Now()).IsMax());
+  EXPECT_TRUE((large_delta + TimeTicks::Now()).IsMax());
+  EXPECT_TRUE((Time::Now() + large_delta).IsMax());
+  EXPECT_TRUE((TimeTicks::Now() + large_delta).IsMax());
+
+  Time time_now = Time::Now();
+  EXPECT_EQ(kOneSecond, (time_now + kOneSecond) - time_now);
+  EXPECT_EQ(-kOneSecond, (time_now - kOneSecond) - time_now);
+
+  TimeTicks ticks_now = TimeTicks::Now();
+  EXPECT_EQ(-kOneSecond, (ticks_now - kOneSecond) - ticks_now);
+  EXPECT_EQ(kOneSecond, (ticks_now + kOneSecond) - ticks_now);
+}
+
 TEST(TimeDelta, FromAndIn) {
   EXPECT_EQ(TimeDelta::FromDays(2), TimeDelta::FromHours(48));
   EXPECT_EQ(TimeDelta::FromHours(3), TimeDelta::FromMinutes(180));
@@ -54,6 +211,47 @@ TEST(TimeDelta, MachTimespec) {
 }
 #endif
 
+TEST(Time, Max) {
+  Time max = Time::Max();
+  EXPECT_TRUE(max.IsMax());
+  EXPECT_EQ(max, Time::Max());
+  EXPECT_GT(max, Time::Now());
+  EXPECT_GT(max, Time());
+}
+
+TEST(Time, MaxConversions) {
+  Time t = Time::Max();
+  EXPECT_EQ(std::numeric_limits<int64_t>::max(), t.ToInternalValue());
+
+// TODO(v8-team): Time::FromJsTime() overflows with infinity. Import support
+// from Chromium's base.
+// t = Time::FromJsTime(std::numeric_limits<double>::infinity());
+// EXPECT_TRUE(t.IsMax());
+// EXPECT_EQ(std::numeric_limits<double>::infinity(), t.ToJsTime());
+
+#if defined(OS_POSIX)
+  struct timeval tval;
+  tval.tv_sec = std::numeric_limits<time_t>::max();
+  tval.tv_usec = static_cast<suseconds_t>(Time::kMicrosecondsPerSecond) - 1;
+  t = Time::FromTimeVal(tval);
+  EXPECT_TRUE(t.IsMax());
+  tval = t.ToTimeVal();
+  EXPECT_EQ(std::numeric_limits<time_t>::max(), tval.tv_sec);
+  EXPECT_EQ(static_cast<suseconds_t>(Time::kMicrosecondsPerSecond) - 1,
+            tval.tv_usec);
+#endif
+
+#if defined(OS_WIN)
+  FILETIME ftime;
+  ftime.dwHighDateTime = std::numeric_limits<DWORD>::max();
+  ftime.dwLowDateTime = std::numeric_limits<DWORD>::max();
+  t = Time::FromFileTime(ftime);
+  EXPECT_TRUE(t.IsMax());
+  ftime = t.ToFileTime();
+  EXPECT_EQ(std::numeric_limits<DWORD>::max(), ftime.dwHighDateTime);
+  EXPECT_EQ(std::numeric_limits<DWORD>::max(), ftime.dwLowDateTime);
+#endif
+}
 
 TEST(Time, JsTime) {
   Time t = Time::FromJsTime(700000.3);
@@ -153,21 +351,15 @@ TEST(Time, NowResolution) {
 
 
 TEST(TimeTicks, NowResolution) {
-  // We assume that TimeTicks::Now() has at least 16ms resolution.
-  static const TimeDelta kTargetGranularity = TimeDelta::FromMilliseconds(16);
+  // TimeTicks::Now() is documented as having "no worse than one microsecond"
+  // resolution. Unless !TimeTicks::IsHighResolution() in which case the clock
+  // could be as coarse as ~15.6ms.
+  const TimeDelta kTargetGranularity = TimeTicks::IsHighResolution()
+                                           ? TimeDelta::FromMicroseconds(1)
+                                           : TimeDelta::FromMilliseconds(16);
   ResolutionTest<TimeTicks>(&TimeTicks::Now, kTargetGranularity);
 }
 
-
-TEST(TimeTicks, HighResolutionNowResolution) {
-  if (!TimeTicks::IsHighResolutionClockWorking()) return;
-
-  // We assume that TimeTicks::HighResolutionNow() has sub-ms resolution.
-  static const TimeDelta kTargetGranularity = TimeDelta::FromMilliseconds(1);
-  ResolutionTest<TimeTicks>(&TimeTicks::HighResolutionNow, kTargetGranularity);
-}
-
-
 TEST(TimeTicks, IsMonotonic) {
   TimeTicks previous_normal_ticks;
   TimeTicks previous_highres_ticks;
@@ -194,15 +386,21 @@ TEST(TimeTicks, IsMonotonic) {
 TEST(ThreadTicks, MAYBE_ThreadNow) {
   if (ThreadTicks::IsSupported()) {
     ThreadTicks::WaitUntilInitialized();
-    TimeTicks begin = TimeTicks::Now();
-    ThreadTicks begin_thread = ThreadTicks::Now();
+    TimeTicks end, begin = TimeTicks::Now();
+    ThreadTicks end_thread, begin_thread = ThreadTicks::Now();
+    TimeDelta delta;
     // Make sure that ThreadNow value is non-zero.
     EXPECT_GT(begin_thread, ThreadTicks());
-    // Sleep for 10 milliseconds to get the thread de-scheduled.
-    OS::Sleep(base::TimeDelta::FromMilliseconds(10));
-    ThreadTicks end_thread = ThreadTicks::Now();
-    TimeTicks end = TimeTicks::Now();
-    TimeDelta delta = end - begin;
+    int iterations_count = 0;
+    do {
+      // Sleep for 10 milliseconds to get the thread de-scheduled.
+      OS::Sleep(base::TimeDelta::FromMilliseconds(10));
+      end_thread = ThreadTicks::Now();
+      end = TimeTicks::Now();
+      delta = end - begin;
+      EXPECT_LE(++iterations_count, 2);  // fail after 2 attempts.
+    } while (delta.InMicroseconds() <
+             10000);  // Make sure that the OS did sleep for at least 10 ms.
     TimeDelta delta_thread = end_thread - begin_thread;
     // Make sure that some thread time have elapsed.
     EXPECT_GT(delta_thread.InMicroseconds(), 0);
diff --git a/deps/v8/test/unittests/base/template-utils-unittest.cc b/deps/v8/test/unittests/base/template-utils-unittest.cc
index 2c1da8ec862..42917e0ffc4 100644
--- a/deps/v8/test/unittests/base/template-utils-unittest.cc
+++ b/deps/v8/test/unittests/base/template-utils-unittest.cc
@@ -93,13 +93,19 @@ static_assert(has_output_operator<uint64_t>::value, "int can be output");
 // Classes:
 class TestClass1 {};
 class TestClass2 {};
-extern std::ostream& operator<<(std::ostream& str, TestClass2&);
+extern std::ostream& operator<<(std::ostream& str, const TestClass2&);
+class TestClass3 {};
+extern std::ostream& operator<<(std::ostream& str, TestClass3);
 static_assert(!has_output_operator<TestClass1>::value,
               "TestClass1 can not be output");
 static_assert(has_output_operator<TestClass2>::value,
               "non-const TestClass2 can be output");
-static_assert(!has_output_operator<const TestClass2>::value,
-              "const TestClass2 can not be output");
+static_assert(has_output_operator<const TestClass2>::value,
+              "const TestClass2 can be output");
+static_assert(has_output_operator<TestClass3>::value,
+              "non-const TestClass3 can be output");
+static_assert(has_output_operator<const TestClass3>::value,
+              "const TestClass3 can be output");
 
 //////////////////////////////
 // Test fold.
diff --git a/deps/v8/test/unittests/code-stub-assembler-unittest.cc b/deps/v8/test/unittests/code-stub-assembler-unittest.cc
index 0ef06c71ffb..d39649a3558 100644
--- a/deps/v8/test/unittests/code-stub-assembler-unittest.cc
+++ b/deps/v8/test/unittests/code-stub-assembler-unittest.cc
@@ -32,7 +32,7 @@ CodeStubAssemblerTestState::CodeStubAssemblerTestState(
     CodeStubAssemblerTest* test)
     : compiler::CodeAssemblerState(test->isolate(), test->zone(),
                                    VoidDescriptor(test->isolate()), Code::STUB,
-                                   "test") {}
+                                   "test", PoisoningMitigationLevel::kOn) {}
 
 TARGET_TEST_F(CodeStubAssemblerTest, SmiTag) {
   CodeStubAssemblerTestState state(this);
diff --git a/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc b/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
index a0ddd1e5e4a..31a5044e146 100644
--- a/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
+++ b/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
@@ -10,6 +10,7 @@
 #include "src/api.h"
 #include "src/ast/ast-value-factory.h"
 #include "src/base/platform/semaphore.h"
+#include "src/base/template-utils.h"
 #include "src/compiler-dispatcher/compiler-dispatcher-job.h"
 #include "src/compiler-dispatcher/compiler-dispatcher-tracer.h"
 #include "src/compiler-dispatcher/unoptimized-compile-job.h"
@@ -93,11 +94,11 @@ class MockPlatform : public v8::Platform {
   ~MockPlatform() override {
     base::LockGuard<base::Mutex> lock(&mutex_);
     EXPECT_TRUE(foreground_tasks_.empty());
-    EXPECT_TRUE(background_tasks_.empty());
+    EXPECT_TRUE(worker_tasks_.empty());
     EXPECT_TRUE(idle_task_ == nullptr);
   }
 
-  size_t NumberOfAvailableBackgroundThreads() override { return 1; }
+  int NumberOfWorkerThreads() override { return 1; }
 
   std::shared_ptr<TaskRunner> GetForegroundTaskRunner(
       v8::Isolate* isolate) override {
@@ -105,21 +106,20 @@ class MockPlatform : public v8::Platform {
     return std::make_shared<MockTaskRunner>(this, is_foreground_task_runner);
   }
 
-  std::shared_ptr<TaskRunner> GetBackgroundTaskRunner(
+  std::shared_ptr<TaskRunner> GetWorkerThreadsTaskRunner(
       v8::Isolate* isolate) override {
     constexpr bool is_foreground_task_runner = false;
     return std::make_shared<MockTaskRunner>(this, is_foreground_task_runner);
   }
 
-  void CallOnBackgroundThread(Task* task,
-                              ExpectedRuntime expected_runtime) override {
+  void CallOnWorkerThread(std::unique_ptr<Task> task) override {
     base::LockGuard<base::Mutex> lock(&mutex_);
-    background_tasks_.push_back(task);
+    worker_tasks_.push_back(std::move(task));
   }
 
   void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override {
     base::LockGuard<base::Mutex> lock(&mutex_);
-    foreground_tasks_.push_back(task);
+    foreground_tasks_.push_back(std::unique_ptr<Task>(task));
   }
 
   void CallDelayedOnForegroundThread(v8::Isolate* isolate, Task* task,
@@ -167,9 +167,9 @@ class MockPlatform : public v8::Platform {
     return idle_task_;
   }
 
-  bool BackgroundTasksPending() {
+  bool WorkerTasksPending() {
     base::LockGuard<base::Mutex> lock(&mutex_);
-    return !background_tasks_.empty();
+    return !worker_tasks_.empty();
   }
 
   bool ForegroundTasksPending() {
@@ -177,59 +177,54 @@ class MockPlatform : public v8::Platform {
     return !foreground_tasks_.empty();
   }
 
-  void RunBackgroundTasksAndBlock(Platform* platform) {
-    std::vector<Task*> tasks;
+  void RunWorkerTasksAndBlock(Platform* platform) {
+    std::vector<std::unique_ptr<Task>> tasks;
     {
       base::LockGuard<base::Mutex> lock(&mutex_);
-      tasks.swap(background_tasks_);
+      tasks.swap(worker_tasks_);
     }
-    platform->CallOnBackgroundThread(new TaskWrapper(this, tasks, true),
-                                     kShortRunningTask);
+    platform->CallOnWorkerThread(
+        base::make_unique<TaskWrapper>(this, std::move(tasks), true));
     sem_.Wait();
   }
 
-  void RunBackgroundTasks(Platform* platform) {
-    std::vector<Task*> tasks;
+  void RunWorkerTasks(Platform* platform) {
+    std::vector<std::unique_ptr<Task>> tasks;
     {
       base::LockGuard<base::Mutex> lock(&mutex_);
-      tasks.swap(background_tasks_);
+      tasks.swap(worker_tasks_);
     }
-    platform->CallOnBackgroundThread(new TaskWrapper(this, tasks, false),
-                                     kShortRunningTask);
+    platform->CallOnWorkerThread(
+        base::make_unique<TaskWrapper>(this, std::move(tasks), false));
   }
 
   void RunForegroundTasks() {
-    std::vector<Task*> tasks;
+    std::vector<std::unique_ptr<Task>> tasks;
     {
       base::LockGuard<base::Mutex> lock(&mutex_);
       tasks.swap(foreground_tasks_);
     }
     for (auto& task : tasks) {
       task->Run();
-      delete task;
+      // Reset |task| before running the next one.
+      task.reset();
     }
   }
 
-  void ClearBackgroundTasks() {
-    std::vector<Task*> tasks;
+  void ClearWorkerTasks() {
+    std::vector<std::unique_ptr<Task>> tasks;
     {
       base::LockGuard<base::Mutex> lock(&mutex_);
-      tasks.swap(background_tasks_);
-    }
-    for (auto& task : tasks) {
-      delete task;
+      tasks.swap(worker_tasks_);
     }
   }
 
   void ClearForegroundTasks() {
-    std::vector<Task*> tasks;
+    std::vector<std::unique_ptr<Task>> tasks;
     {
       base::LockGuard<base::Mutex> lock(&mutex_);
       tasks.swap(foreground_tasks_);
     }
-    for (auto& task : tasks) {
-      delete task;
-    }
   }
 
   void ClearIdleTask() {
@@ -242,22 +237,23 @@ class MockPlatform : public v8::Platform {
  private:
   class TaskWrapper : public Task {
    public:
-    TaskWrapper(MockPlatform* platform, const std::vector<Task*>& tasks,
-                bool signal)
-        : platform_(platform), tasks_(tasks), signal_(signal) {}
+    TaskWrapper(MockPlatform* platform,
+                std::vector<std::unique_ptr<Task>> tasks, bool signal)
+        : platform_(platform), tasks_(std::move(tasks)), signal_(signal) {}
     ~TaskWrapper() = default;
 
     void Run() override {
       for (auto& task : tasks_) {
         task->Run();
-        delete task;
+        // Reset |task| before running the next one.
+        task.reset();
       }
       if (signal_) platform_->sem_.Signal();
     }
 
    private:
     MockPlatform* platform_;
-    std::vector<Task*> tasks_;
+    std::vector<std::unique_ptr<Task>> tasks_;
     bool signal_;
 
     DISALLOW_COPY_AND_ASSIGN(TaskWrapper);
@@ -272,9 +268,9 @@ class MockPlatform : public v8::Platform {
     void PostTask(std::unique_ptr<v8::Task> task) override {
       base::LockGuard<base::Mutex> lock(&platform_->mutex_);
       if (is_foreground_task_runner_) {
-        platform_->foreground_tasks_.push_back(task.release());
+        platform_->foreground_tasks_.push_back(std::move(task));
       } else {
-        platform_->background_tasks_.push_back(task.release());
+        platform_->worker_tasks_.push_back(std::move(task));
       }
     }
 
@@ -307,8 +303,8 @@ class MockPlatform : public v8::Platform {
   base::Mutex mutex_;
 
   IdleTask* idle_task_;
-  std::vector<Task*> background_tasks_;
-  std::vector<Task*> foreground_tasks_;
+  std::vector<std::unique_ptr<Task>> worker_tasks_;
+  std::vector<std::unique_ptr<Task>> foreground_tasks_;
 
   base::Semaphore sem_;
 
@@ -336,7 +332,7 @@ TEST_F(CompilerDispatcherTest, IsEnqueued) {
   ASSERT_FALSE(dispatcher.IsEnqueued(shared));
   ASSERT_TRUE(dispatcher.Enqueue(shared));
   ASSERT_TRUE(dispatcher.IsEnqueued(shared));
-  dispatcher.AbortAll(CompilerDispatcher::BlockingBehavior::kBlock);
+  dispatcher.AbortAll(BlockingBehavior::kBlock);
   ASSERT_FALSE(dispatcher.IsEnqueued(shared));
   ASSERT_TRUE(platform.IdleTaskPending());
   platform.ClearIdleTask();
@@ -386,7 +382,7 @@ TEST_F(CompilerDispatcherTest, FinishAllNow) {
     ASSERT_TRUE(shared[i]->is_compiled());
   }
   platform.ClearIdleTask();
-  platform.ClearBackgroundTasks();
+  platform.ClearWorkerTasks();
 }
 
 TEST_F(CompilerDispatcherTest, IdleTask) {
@@ -500,12 +496,12 @@ TEST_F(CompilerDispatcherTest, CompileOnBackgroundThread) {
   ASSERT_TRUE(dispatcher.IsEnqueued(shared));
   ASSERT_FALSE(shared->is_compiled());
   ASSERT_FALSE(platform.IdleTaskPending());
-  ASSERT_TRUE(platform.BackgroundTasksPending());
+  ASSERT_TRUE(platform.WorkerTasksPending());
 
-  platform.RunBackgroundTasksAndBlock(V8::GetCurrentPlatform());
+  platform.RunWorkerTasksAndBlock(V8::GetCurrentPlatform());
 
   ASSERT_TRUE(platform.IdleTaskPending());
-  ASSERT_FALSE(platform.BackgroundTasksPending());
+  ASSERT_FALSE(platform.WorkerTasksPending());
   ASSERT_EQ(UnoptimizedCompileJob::Status::kCompiled,
             dispatcher.jobs_.begin()->second->status());
 
@@ -517,7 +513,7 @@ TEST_F(CompilerDispatcherTest, CompileOnBackgroundThread) {
   ASSERT_FALSE(platform.IdleTaskPending());
 }
 
-TEST_F(CompilerDispatcherTest, FinishNowWithBackgroundTask) {
+TEST_F(CompilerDispatcherTest, FinishNowWithWorkerTask) {
   MockPlatform platform;
   CompilerDispatcher dispatcher(i_isolate(), &platform, FLAG_stack_size);
 
@@ -543,17 +539,17 @@ TEST_F(CompilerDispatcherTest, FinishNowWithBackgroundTask) {
   ASSERT_TRUE(dispatcher.IsEnqueued(shared));
   ASSERT_FALSE(shared->is_compiled());
   ASSERT_FALSE(platform.IdleTaskPending());
-  ASSERT_TRUE(platform.BackgroundTasksPending());
+  ASSERT_TRUE(platform.WorkerTasksPending());
 
   // This does not block, but races with the FinishNow() call below.
-  platform.RunBackgroundTasks(V8::GetCurrentPlatform());
+  platform.RunWorkerTasks(V8::GetCurrentPlatform());
 
   ASSERT_TRUE(dispatcher.FinishNow(shared));
   // Finishing removes the SFI from the queue.
   ASSERT_FALSE(dispatcher.IsEnqueued(shared));
   ASSERT_TRUE(shared->is_compiled());
   if (platform.IdleTaskPending()) platform.ClearIdleTask();
-  ASSERT_FALSE(platform.BackgroundTasksPending());
+  ASSERT_FALSE(platform.WorkerTasksPending());
 }
 
 TEST_F(CompilerDispatcherTest, IdleTaskMultipleJobs) {
@@ -611,7 +607,7 @@ TEST_F(CompilerDispatcherTest, FinishNowException) {
   platform.ClearIdleTask();
 }
 
-TEST_F(CompilerDispatcherTest, AsyncAbortAllPendingBackgroundTask) {
+TEST_F(CompilerDispatcherTest, AsyncAbortAllPendingWorkerTask) {
   MockPlatform platform;
   CompilerDispatcher dispatcher(i_isolate(), &platform, FLAG_stack_size);
 
@@ -637,23 +633,23 @@ TEST_F(CompilerDispatcherTest, AsyncAbortAllPendingBackgroundTask) {
   ASSERT_TRUE(dispatcher.IsEnqueued(shared));
   ASSERT_FALSE(shared->is_compiled());
   ASSERT_FALSE(platform.IdleTaskPending());
-  ASSERT_TRUE(platform.BackgroundTasksPending());
+  ASSERT_TRUE(platform.WorkerTasksPending());
 
   // The background task hasn't yet started, so we can just cancel it.
-  dispatcher.AbortAll(CompilerDispatcher::BlockingBehavior::kDontBlock);
+  dispatcher.AbortAll(BlockingBehavior::kDontBlock);
   ASSERT_FALSE(platform.ForegroundTasksPending());
 
   ASSERT_FALSE(dispatcher.IsEnqueued(shared));
   ASSERT_FALSE(shared->is_compiled());
 
-  platform.RunBackgroundTasksAndBlock(V8::GetCurrentPlatform());
+  platform.RunWorkerTasksAndBlock(V8::GetCurrentPlatform());
 
   if (platform.IdleTaskPending()) platform.ClearIdleTask();
-  ASSERT_FALSE(platform.BackgroundTasksPending());
+  ASSERT_FALSE(platform.WorkerTasksPending());
   ASSERT_FALSE(platform.ForegroundTasksPending());
 }
 
-TEST_F(CompilerDispatcherTest, AsyncAbortAllRunningBackgroundTask) {
+TEST_F(CompilerDispatcherTest, AsyncAbortAllRunningWorkerTask) {
   MockPlatform platform;
   CompilerDispatcher dispatcher(i_isolate(), &platform, FLAG_stack_size);
 
@@ -683,16 +679,16 @@ TEST_F(CompilerDispatcherTest, AsyncAbortAllRunningBackgroundTask) {
   ASSERT_TRUE(dispatcher.IsEnqueued(shared1));
   ASSERT_FALSE(shared1->is_compiled());
   ASSERT_FALSE(platform.IdleTaskPending());
-  ASSERT_TRUE(platform.BackgroundTasksPending());
+  ASSERT_TRUE(platform.WorkerTasksPending());
 
   // Kick off background tasks and freeze them.
   dispatcher.block_for_testing_.SetValue(true);
-  platform.RunBackgroundTasks(V8::GetCurrentPlatform());
+  platform.RunWorkerTasks(V8::GetCurrentPlatform());
 
   // Busy loop until the background task started running.
   while (dispatcher.block_for_testing_.Value()) {
   }
-  dispatcher.AbortAll(CompilerDispatcher::BlockingBehavior::kDontBlock);
+  dispatcher.AbortAll(BlockingBehavior::kDontBlock);
   ASSERT_TRUE(platform.ForegroundTasksPending());
 
   // We can't schedule new tasks while we're aborting.
@@ -722,13 +718,13 @@ TEST_F(CompilerDispatcherTest, AsyncAbortAllRunningBackgroundTask) {
 
   ASSERT_TRUE(platform.IdleTaskPending());
   platform.RunIdleTask(5.0, 1.0);
-  ASSERT_FALSE(platform.BackgroundTasksPending());
+  ASSERT_FALSE(platform.WorkerTasksPending());
   ASSERT_FALSE(platform.ForegroundTasksPending());
 
   // Now it's possible to enqueue new functions again.
   ASSERT_TRUE(dispatcher.Enqueue(shared2));
   ASSERT_TRUE(platform.IdleTaskPending());
-  ASSERT_FALSE(platform.BackgroundTasksPending());
+  ASSERT_FALSE(platform.WorkerTasksPending());
   ASSERT_FALSE(platform.ForegroundTasksPending());
   platform.ClearIdleTask();
 }
@@ -759,16 +755,16 @@ TEST_F(CompilerDispatcherTest, FinishNowDuringAbortAll) {
   ASSERT_TRUE(dispatcher.IsEnqueued(shared));
   ASSERT_FALSE(shared->is_compiled());
   ASSERT_FALSE(platform.IdleTaskPending());
-  ASSERT_TRUE(platform.BackgroundTasksPending());
+  ASSERT_TRUE(platform.WorkerTasksPending());
 
   // Kick off background tasks and freeze them.
   dispatcher.block_for_testing_.SetValue(true);
-  platform.RunBackgroundTasks(V8::GetCurrentPlatform());
+  platform.RunWorkerTasks(V8::GetCurrentPlatform());
 
   // Busy loop until the background task started running.
   while (dispatcher.block_for_testing_.Value()) {
   }
-  dispatcher.AbortAll(CompilerDispatcher::BlockingBehavior::kDontBlock);
+  dispatcher.AbortAll(BlockingBehavior::kDontBlock);
   ASSERT_TRUE(platform.ForegroundTasksPending());
 
   // Run the first AbortTask. Since the background job is still pending, it
@@ -792,14 +788,14 @@ TEST_F(CompilerDispatcherTest, FinishNowDuringAbortAll) {
   // Busy wait for the background task to finish.
   for (;;) {
     base::LockGuard<base::Mutex> lock(&dispatcher.mutex_);
-    if (dispatcher.num_background_tasks_ == 0) {
+    if (dispatcher.num_worker_tasks_ == 0) {
       break;
     }
   }
 
   ASSERT_TRUE(platform.ForegroundTasksPending());
   ASSERT_TRUE(platform.IdleTaskPending());
-  ASSERT_FALSE(platform.BackgroundTasksPending());
+  ASSERT_FALSE(platform.WorkerTasksPending());
 
   platform.RunForegroundTasks();
   {
@@ -868,9 +864,9 @@ TEST_F(CompilerDispatcherTest, MemoryPressureFromBackground) {
 
   ASSERT_TRUE(dispatcher.Enqueue(shared));
   base::Semaphore sem(0);
-  V8::GetCurrentPlatform()->CallOnBackgroundThread(
-      new PressureNotificationTask(i_isolate(), &dispatcher, &sem),
-      v8::Platform::kShortRunningTask);
+  V8::GetCurrentPlatform()->CallOnWorkerThread(
+      base::make_unique<PressureNotificationTask>(i_isolate(), &dispatcher,
+                                                  &sem));
 
   sem.Wait();
 
@@ -905,7 +901,7 @@ TEST_F(CompilerDispatcherTest, EnqueueJob) {
 
   ASSERT_TRUE(platform.IdleTaskPending());
   platform.ClearIdleTask();
-  ASSERT_FALSE(platform.BackgroundTasksPending());
+  ASSERT_FALSE(platform.WorkerTasksPending());
 }
 
 TEST_F(CompilerDispatcherTest, EnqueueAndStep) {
@@ -925,8 +921,8 @@ TEST_F(CompilerDispatcherTest, EnqueueAndStep) {
 
   ASSERT_TRUE(platform.IdleTaskPending());
   platform.ClearIdleTask();
-  ASSERT_TRUE(platform.BackgroundTasksPending());
-  platform.ClearBackgroundTasks();
+  ASSERT_TRUE(platform.WorkerTasksPending());
+  platform.ClearWorkerTasks();
 }
 
 TEST_F(CompilerDispatcherTest, CompileLazyFinishesDispatcherJob) {
@@ -995,9 +991,9 @@ TEST_F(CompilerDispatcherTest, EnqueueAndStepTwice) {
             dispatcher.jobs_.begin()->second->status());
 
   ASSERT_TRUE(platform.IdleTaskPending());
-  ASSERT_TRUE(platform.BackgroundTasksPending());
+  ASSERT_TRUE(platform.WorkerTasksPending());
   platform.ClearIdleTask();
-  platform.ClearBackgroundTasks();
+  platform.ClearWorkerTasks();
 }
 
 TEST_F(CompilerDispatcherTest, CompileMultipleOnBackgroundThread) {
@@ -1037,12 +1033,12 @@ TEST_F(CompilerDispatcherTest, CompileMultipleOnBackgroundThread) {
   ASSERT_FALSE(shared1->is_compiled());
   ASSERT_FALSE(shared2->is_compiled());
   ASSERT_FALSE(platform.IdleTaskPending());
-  ASSERT_TRUE(platform.BackgroundTasksPending());
+  ASSERT_TRUE(platform.WorkerTasksPending());
 
-  platform.RunBackgroundTasksAndBlock(V8::GetCurrentPlatform());
+  platform.RunWorkerTasksAndBlock(V8::GetCurrentPlatform());
 
   ASSERT_TRUE(platform.IdleTaskPending());
-  ASSERT_FALSE(platform.BackgroundTasksPending());
+  ASSERT_FALSE(platform.WorkerTasksPending());
   ASSERT_EQ(dispatcher.jobs_.size(), 2u);
   ASSERT_EQ(UnoptimizedCompileJob::Status::kCompiled,
             dispatcher.jobs_.begin()->second->status());
diff --git a/deps/v8/test/unittests/compiler-dispatcher/optimizing-compile-dispatcher-unittest.cc b/deps/v8/test/unittests/compiler-dispatcher/optimizing-compile-dispatcher-unittest.cc
index d5c37264a5c..529b518070d 100644
--- a/deps/v8/test/unittests/compiler-dispatcher/optimizing-compile-dispatcher-unittest.cc
+++ b/deps/v8/test/unittests/compiler-dispatcher/optimizing-compile-dispatcher-unittest.cc
@@ -84,7 +84,7 @@ TEST_F(OptimizingCompileDispatcherTest, NonBlockingFlush) {
   }
 
   // Should not block.
-  dispatcher.Flush(OptimizingCompileDispatcher::BlockingBehavior::kDontBlock);
+  dispatcher.Flush(BlockingBehavior::kDontBlock);
 
   // Unblock the job & finish.
   job->Signal();
diff --git a/deps/v8/test/unittests/compiler-dispatcher/unoptimized-compile-job-unittest.cc b/deps/v8/test/unittests/compiler-dispatcher/unoptimized-compile-job-unittest.cc
index d6816279ed4..6344d3806e0 100644
--- a/deps/v8/test/unittests/compiler-dispatcher/unoptimized-compile-job-unittest.cc
+++ b/deps/v8/test/unittests/compiler-dispatcher/unoptimized-compile-job-unittest.cc
@@ -9,6 +9,7 @@
 #include "src/ast/ast.h"
 #include "src/ast/scopes.h"
 #include "src/base/platform/semaphore.h"
+#include "src/base/template-utils.h"
 #include "src/compiler-dispatcher/compiler-dispatcher-job.h"
 #include "src/compiler-dispatcher/compiler-dispatcher-tracer.h"
 #include "src/compiler-dispatcher/unoptimized-compile-job.h"
@@ -226,10 +227,9 @@ TEST_F(UnoptimizedCompileJobTest, CompileOnBackgroundThread) {
   ASSERT_FALSE(job->IsFailed());
 
   base::Semaphore semaphore(0);
-  CompileTask* background_task = new CompileTask(job.get(), &semaphore);
+  auto background_task = base::make_unique<CompileTask>(job.get(), &semaphore);
   ASSERT_JOB_STATUS(CompilerDispatcherJob::Status::kPrepared, job);
-  V8::GetCurrentPlatform()->CallOnBackgroundThread(background_task,
-                                                   Platform::kShortRunningTask);
+  V8::GetCurrentPlatform()->CallOnWorkerThread(std::move(background_task));
   semaphore.Wait();
   job->FinalizeOnMainThread(isolate());
   ASSERT_FALSE(job->IsFailed());
diff --git a/deps/v8/test/unittests/compiler/arm/instruction-selector-arm-unittest.cc b/deps/v8/test/unittests/compiler/arm/instruction-selector-arm-unittest.cc
index ab1c57d9c54..becc1d84050 100644
--- a/deps/v8/test/unittests/compiler/arm/instruction-selector-arm-unittest.cc
+++ b/deps/v8/test/unittests/compiler/arm/instruction-selector-arm-unittest.cc
@@ -3257,6 +3257,15 @@ TEST_F(InstructionSelectorTest, Float64Neg) {
   EXPECT_EQ(s.ToVreg(n), s.ToVreg(s[0]->Output()));
 }
 
+TEST_F(InstructionSelectorTest, SpeculationFence) {
+  StreamBuilder m(this, MachineType::Int32());
+  m.SpeculationFence();
+  m.Return(m.Int32Constant(0));
+  Stream s = m.Build();
+  ASSERT_EQ(1U, s.size());
+  EXPECT_EQ(kArmDsbIsb, s[0]->arch_opcode());
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc b/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc
index 013d96f26d4..f8b0a478e21 100644
--- a/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc
+++ b/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc
@@ -4417,6 +4417,15 @@ TEST_F(InstructionSelectorTest, CompareFloat64HighGreaterThanOrEqualZero64) {
   EXPECT_EQ(63, s.ToInt32(s[1]->InputAt(1)));
 }
 
+TEST_F(InstructionSelectorTest, SpeculationFence) {
+  StreamBuilder m(this, MachineType::Int32());
+  m.SpeculationFence();
+  m.Return(m.Int32Constant(0));
+  Stream s = m.Build();
+  ASSERT_EQ(1U, s.size());
+  EXPECT_EQ(kArm64DsbIsb, s[0]->arch_opcode());
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/bytecode-analysis-unittest.cc b/deps/v8/test/unittests/compiler/bytecode-analysis-unittest.cc
index dd8b661fcf6..48c15934dfb 100644
--- a/deps/v8/test/unittests/compiler/bytecode-analysis-unittest.cc
+++ b/deps/v8/test/unittests/compiler/bytecode-analysis-unittest.cc
@@ -11,6 +11,7 @@
 #include "src/interpreter/bytecode-label.h"
 #include "src/interpreter/control-flow-builders.h"
 #include "src/objects-inl.h"
+#include "test/unittests/interpreter/bytecode-utils.h"
 #include "test/unittests/test-utils.h"
 
 namespace v8 {
@@ -452,6 +453,53 @@ TEST_F(BytecodeAnalysisTest, KillingLoopInsideLoop) {
   EnsureLivenessMatches(bytecode, expected_liveness);
 }
 
+TEST_F(BytecodeAnalysisTest, SuspendPoint) {
+  interpreter::BytecodeArrayBuilder builder(zone(), 3, 3);
+  std::vector<std::pair<std::string, std::string>> expected_liveness;
+
+  interpreter::Register reg_0(0);
+  interpreter::Register reg_1(1);
+  interpreter::Register reg_gen(2);
+  interpreter::BytecodeJumpTable* gen_jump_table =
+      builder.AllocateJumpTable(1, 0);
+
+  builder.StoreAccumulatorInRegister(reg_gen);
+  expected_liveness.emplace_back("L..L", "L.LL");
+
+  // Note: technically, r0 should be dead here since the resume will write it,
+  // but in practice the bytecode analysis doesn't bother to special case it,
+  // since the generator switch is close to the top of the function anyway.
+  builder.SwitchOnGeneratorState(reg_gen, gen_jump_table);
+  expected_liveness.emplace_back("L.LL", "L.LL");
+
+  builder.StoreAccumulatorInRegister(reg_0);
+  expected_liveness.emplace_back("..LL", "L.LL");
+
+  // Reg 1 is never read, so should be dead.
+  builder.StoreAccumulatorInRegister(reg_1);
+  expected_liveness.emplace_back("L.LL", "L.LL");
+
+  builder.SuspendGenerator(
+      reg_gen, interpreter::BytecodeUtils::NewRegisterList(0, 3), 0);
+  expected_liveness.emplace_back("L.LL", "L.L.");
+
+  builder.Bind(gen_jump_table, 0);
+
+  builder.ResumeGenerator(reg_gen,
+                          interpreter::BytecodeUtils::NewRegisterList(0, 1));
+  expected_liveness.emplace_back("L.L.", "L...");
+
+  builder.LoadAccumulatorWithRegister(reg_0);
+  expected_liveness.emplace_back("L...", "...L");
+
+  builder.Return();
+  expected_liveness.emplace_back("...L", "....");
+
+  Handle<BytecodeArray> bytecode = builder.ToBytecodeArray(isolate());
+
+  EnsureLivenessMatches(bytecode, expected_liveness);
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/code-assembler-unittest.cc b/deps/v8/test/unittests/compiler/code-assembler-unittest.cc
index 1716c8d5351..9cf955e86e5 100644
--- a/deps/v8/test/unittests/compiler/code-assembler-unittest.cc
+++ b/deps/v8/test/unittests/compiler/code-assembler-unittest.cc
@@ -20,7 +20,8 @@ namespace compiler {
 
 CodeAssemblerTestState::CodeAssemblerTestState(CodeAssemblerTest* test)
     : CodeAssemblerState(test->isolate(), test->zone(),
-                         VoidDescriptor(test->isolate()), Code::STUB, "test") {}
+                         VoidDescriptor(test->isolate()), Code::STUB, "test",
+                         PoisoningMitigationLevel::kOn) {}
 
 TARGET_TEST_F(CodeAssemblerTest, IntPtrAdd) {
   CodeAssemblerTestState state(this);
diff --git a/deps/v8/test/unittests/compiler/common-operator-reducer-unittest.cc b/deps/v8/test/unittests/compiler/common-operator-reducer-unittest.cc
index 6618dfb4524..3cae7e60d76 100644
--- a/deps/v8/test/unittests/compiler/common-operator-reducer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/common-operator-reducer-unittest.cc
@@ -31,7 +31,7 @@ class CommonOperatorReducerTest : public GraphTest {
       MachineOperatorBuilder::Flags flags = MachineOperatorBuilder::kNoFlags) {
     MachineOperatorBuilder machine(zone(), MachineType::PointerRepresentation(),
                                    flags);
-    CommonOperatorReducer reducer(editor, graph(), common(), &machine);
+    CommonOperatorReducer reducer(editor, graph(), common(), &machine, zone());
     return reducer.Reduce(node);
   }
 
@@ -492,6 +492,52 @@ TEST_F(CommonOperatorReducerTest, SelectToFloat64Abs) {
   EXPECT_THAT(r.replacement(), IsFloat64Abs(p0));
 }
 
+// -----------------------------------------------------------------------------
+// Switch
+
+TEST_F(CommonOperatorReducerTest, SwitchInputMatchesCaseWithDefault) {
+  Node* const control = graph()->start();
+
+  Node* sw = graph()->NewNode(common()->Switch(2), Int32Constant(1), control);
+  Node* const if_1 = graph()->NewNode(common()->IfValue(1), sw);
+  graph()->NewNode(common()->IfDefault(), sw);
+
+  StrictMock<MockAdvancedReducerEditor> editor;
+  EXPECT_CALL(editor, Replace(if_1, control));
+  Reduction r = Reduce(&editor, sw);
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsDead());
+}
+
+TEST_F(CommonOperatorReducerTest, SwitchInputMatchesDefaultWithCase) {
+  Node* const control = graph()->start();
+
+  Node* sw = graph()->NewNode(common()->Switch(2), Int32Constant(0), control);
+  graph()->NewNode(common()->IfValue(1), sw);
+  Node* const if_default = graph()->NewNode(common()->IfDefault(), sw);
+
+  StrictMock<MockAdvancedReducerEditor> editor;
+  EXPECT_CALL(editor, Replace(if_default, control));
+  Reduction r = Reduce(&editor, sw);
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsDead());
+}
+
+TEST_F(CommonOperatorReducerTest, SwitchInputMatchesCaseExtraCaseWithDefault) {
+  Node* const control = graph()->start();
+
+  Node* sw = graph()->NewNode(common()->Switch(3), Int32Constant(0), control);
+  Node* const if_0 = graph()->NewNode(common()->IfValue(0), sw);
+  graph()->NewNode(common()->IfValue(1), sw);
+  graph()->NewNode(common()->IfDefault(), sw);
+
+  StrictMock<MockAdvancedReducerEditor> editor;
+  EXPECT_CALL(editor, Replace(if_0, control));
+  Reduction r = Reduce(&editor, sw);
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsDead());
+}
+
 }  // namespace common_operator_reducer_unittest
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/test/unittests/compiler/common-operator-unittest.cc b/deps/v8/test/unittests/compiler/common-operator-unittest.cc
index b51d5f3cf69..2ee0dbb3823 100644
--- a/deps/v8/test/unittests/compiler/common-operator-unittest.cc
+++ b/deps/v8/test/unittests/compiler/common-operator-unittest.cc
@@ -238,17 +238,19 @@ TEST_F(CommonOperatorTest, Switch) {
 
 TEST_F(CommonOperatorTest, IfValue) {
   TRACED_FOREACH(int32_t, value, kInt32Values) {
-    const Operator* const op = common()->IfValue(value);
-    EXPECT_EQ(IrOpcode::kIfValue, op->opcode());
-    EXPECT_EQ(Operator::kKontrol, op->properties());
-    EXPECT_EQ(value, OpParameter<int32_t>(op));
-    EXPECT_EQ(0, op->ValueInputCount());
-    EXPECT_EQ(0, op->EffectInputCount());
-    EXPECT_EQ(1, op->ControlInputCount());
-    EXPECT_EQ(1, OperatorProperties::GetTotalInputCount(op));
-    EXPECT_EQ(0, op->ValueOutputCount());
-    EXPECT_EQ(0, op->EffectOutputCount());
-    EXPECT_EQ(1, op->ControlOutputCount());
+    TRACED_FOREACH(int32_t, order, kInt32Values) {
+      const Operator* const op = common()->IfValue(value, order);
+      EXPECT_EQ(IrOpcode::kIfValue, op->opcode());
+      EXPECT_EQ(Operator::kKontrol, op->properties());
+      EXPECT_EQ(IfValueParameters(value, order), IfValueParametersOf(op));
+      EXPECT_EQ(0, op->ValueInputCount());
+      EXPECT_EQ(0, op->EffectInputCount());
+      EXPECT_EQ(1, op->ControlInputCount());
+      EXPECT_EQ(1, OperatorProperties::GetTotalInputCount(op));
+      EXPECT_EQ(0, op->ValueOutputCount());
+      EXPECT_EQ(0, op->EffectOutputCount());
+      EXPECT_EQ(1, op->ControlOutputCount());
+    }
   }
 }
 
diff --git a/deps/v8/test/unittests/compiler/control-flow-optimizer-unittest.cc b/deps/v8/test/unittests/compiler/control-flow-optimizer-unittest.cc
index a0c483344e9..607df1fafb3 100644
--- a/deps/v8/test/unittests/compiler/control-flow-optimizer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/control-flow-optimizer-unittest.cc
@@ -57,11 +57,12 @@ TEST_F(ControlFlowOptimizerTest, BuildSwitch1) {
   graph()->SetEnd(graph()->NewNode(common()->End(1), merge));
   Optimize();
   Capture<Node*> switch_capture;
-  EXPECT_THAT(end(),
-              IsEnd(IsMerge(IsIfValue(0, CaptureEq(&switch_capture)),
-                            IsIfValue(1, CaptureEq(&switch_capture)),
-                            IsIfDefault(AllOf(CaptureEq(&switch_capture),
-                                              IsSwitch(index, start()))))));
+  EXPECT_THAT(
+      end(), IsEnd(IsMerge(
+                 IsIfValue(IfValueParameters(0, 1), CaptureEq(&switch_capture)),
+                 IsIfValue(IfValueParameters(1, 2), CaptureEq(&switch_capture)),
+                 IsIfDefault(AllOf(CaptureEq(&switch_capture),
+                                   IsSwitch(index, start()))))));
 }
 
 
@@ -89,11 +90,11 @@ TEST_F(ControlFlowOptimizerTest, BuildSwitch2) {
   Optimize();
   Capture<Node*> switch_capture;
   EXPECT_THAT(
-      end(),
-      IsEnd(IsMerge(IsIfValue(0, CaptureEq(&switch_capture)),
-                    IsIfValue(1, CaptureEq(&switch_capture)),
-                    IsIfDefault(AllOf(CaptureEq(&switch_capture),
-                                      IsSwitch(index, IsIfSuccess(index)))))));
+      end(), IsEnd(IsMerge(
+                 IsIfValue(IfValueParameters(0, 1), CaptureEq(&switch_capture)),
+                 IsIfValue(IfValueParameters(1, 2), CaptureEq(&switch_capture)),
+                 IsIfDefault(AllOf(CaptureEq(&switch_capture),
+                                   IsSwitch(index, IsIfSuccess(index)))))));
 }
 
 }  // namespace compiler
diff --git a/deps/v8/test/unittests/compiler/ia32/instruction-selector-ia32-unittest.cc b/deps/v8/test/unittests/compiler/ia32/instruction-selector-ia32-unittest.cc
index f2767a0bb87..ecf76e6146f 100644
--- a/deps/v8/test/unittests/compiler/ia32/instruction-selector-ia32-unittest.cc
+++ b/deps/v8/test/unittests/compiler/ia32/instruction-selector-ia32-unittest.cc
@@ -830,26 +830,6 @@ TEST_F(InstructionSelectorTest, Float64BinopArithmetic) {
 // -----------------------------------------------------------------------------
 // Miscellaneous.
 
-
-TEST_F(InstructionSelectorTest, Uint32LessThanWithLoadAndLoadStackPointer) {
-  StreamBuilder m(this, MachineType::Bool());
-  Node* const sl = m.Load(
-      MachineType::Pointer(),
-      m.ExternalConstant(ExternalReference::address_of_stack_limit(isolate())));
-  Node* const sp = m.LoadStackPointer();
-  Node* const n = m.Uint32LessThan(sl, sp);
-  m.Return(n);
-  Stream s = m.Build();
-  ASSERT_EQ(1U, s.size());
-  EXPECT_EQ(kIA32StackCheck, s[0]->arch_opcode());
-  ASSERT_EQ(0U, s[0]->InputCount());
-  ASSERT_EQ(1U, s[0]->OutputCount());
-  EXPECT_EQ(s.ToVreg(n), s.ToVreg(s[0]->Output()));
-  EXPECT_EQ(kFlags_set, s[0]->flags_mode());
-  EXPECT_EQ(kUnsignedGreaterThan, s[0]->flags_condition());
-}
-
-
 TEST_F(InstructionSelectorTest, Word32Clz) {
   StreamBuilder m(this, MachineType::Uint32(), MachineType::Uint32());
   Node* const p0 = m.Parameter(0);
diff --git a/deps/v8/test/unittests/compiler/instruction-selector-unittest.cc b/deps/v8/test/unittests/compiler/instruction-selector-unittest.cc
index 3444e0542a9..947bcdf4e4b 100644
--- a/deps/v8/test/unittests/compiler/instruction-selector-unittest.cc
+++ b/deps/v8/test/unittests/compiler/instruction-selector-unittest.cc
@@ -43,8 +43,11 @@ InstructionSelectorTest::Stream InstructionSelectorTest::StreamBuilder::Build(
   SourcePositionTable source_position_table(graph());
   InstructionSelector selector(test_->zone(), node_count, &linkage, &sequence,
                                schedule, &source_position_table, nullptr,
+                               InstructionSelector::kEnableSwitchJumpTable,
                                source_position_mode, features,
-                               InstructionSelector::kDisableScheduling);
+                               InstructionSelector::kDisableScheduling,
+                               InstructionSelector::kDisableSerialization,
+                               PoisoningMitigationLevel::kOn);
   selector.SelectInstructions();
   if (FLAG_trace_turbo) {
     OFStream out(stdout);
@@ -361,7 +364,7 @@ TARGET_TEST_F(InstructionSelectorTest, CallJSFunctionWithDeopt) {
   ZoneVector<MachineType> int32_type(1, MachineType::Int32(), zone());
   ZoneVector<MachineType> empty_types(zone());
 
-  CallDescriptor* descriptor = Linkage::GetJSCallDescriptor(
+  auto call_descriptor = Linkage::GetJSCallDescriptor(
       zone(), false, 1, CallDescriptor::kNeedsFrameState);
 
   // Build frame state for the state before the call.
@@ -382,7 +385,7 @@ TARGET_TEST_F(InstructionSelectorTest, CallJSFunctionWithDeopt) {
   // Build the call.
   Node* nodes[] = {function_node,      receiver, m.UndefinedConstant(),
                    m.Int32Constant(1), context,  state_node};
-  Node* call = m.CallNWithFrameState(descriptor, arraysize(nodes), nodes);
+  Node* call = m.CallNWithFrameState(call_descriptor, arraysize(nodes), nodes);
   m.Return(call);
 
   Stream s = m.Build(kAllExceptNopInstructions);
@@ -418,7 +421,7 @@ TARGET_TEST_F(InstructionSelectorTest, CallStubWithDeopt) {
   ZoneVector<MachineType> tagged_type(1, MachineType::AnyTagged(), zone());
 
   Callable callable = Builtins::CallableFor(isolate(), Builtins::kToObject);
-  CallDescriptor* descriptor = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), callable.descriptor(), 1,
       CallDescriptor::kNeedsFrameState, Operator::kNoProperties);
 
@@ -443,7 +446,7 @@ TARGET_TEST_F(InstructionSelectorTest, CallStubWithDeopt) {
   // Build the call.
   Node* stub_code = m.HeapConstant(callable.code());
   Node* nodes[] = {stub_code, function_node, receiver, context, state_node};
-  Node* call = m.CallNWithFrameState(descriptor, arraysize(nodes), nodes);
+  Node* call = m.CallNWithFrameState(call_descriptor, arraysize(nodes), nodes);
   m.Return(call);
 
   Stream s = m.Build(kAllExceptNopInstructions);
@@ -461,8 +464,8 @@ TARGET_TEST_F(InstructionSelectorTest, CallStubWithDeopt) {
   EXPECT_EQ(kArchCallCodeObject, call_instr->arch_opcode());
   size_t num_operands =
       1 +  // Code object.
-      1 +
-      5 +  // Frame state deopt id + one input for each value in frame state.
+      1 +  // Poison index
+      6 +  // Frame state deopt id + one input for each value in frame state.
       1 +  // Function.
       1;   // Context.
   ASSERT_EQ(num_operands, call_instr->InputCount());
@@ -471,23 +474,23 @@ TARGET_TEST_F(InstructionSelectorTest, CallStubWithDeopt) {
   EXPECT_TRUE(call_instr->InputAt(0)->IsImmediate());
 
   // Deoptimization id.
-  int32_t deopt_id_before = s.ToInt32(call_instr->InputAt(1));
+  int32_t deopt_id_before = s.ToInt32(call_instr->InputAt(2));
   FrameStateDescriptor* desc_before =
       s.GetFrameStateDescriptor(deopt_id_before);
   EXPECT_EQ(bailout_id_before, desc_before->bailout_id());
   EXPECT_EQ(1u, desc_before->parameters_count());
   EXPECT_EQ(1u, desc_before->locals_count());
   EXPECT_EQ(1u, desc_before->stack_count());
-  EXPECT_EQ(43, s.ToInt32(call_instr->InputAt(3)));
-  EXPECT_EQ(0, s.ToInt32(call_instr->InputAt(4)));  // This should be a context.
+  EXPECT_EQ(43, s.ToInt32(call_instr->InputAt(4)));
+  EXPECT_EQ(0, s.ToInt32(call_instr->InputAt(5)));  // This should be a context.
                                                     // We inserted 0 here.
-  EXPECT_EQ(0.5, s.ToFloat64(call_instr->InputAt(5)));
-  EXPECT_TRUE(s.ToHeapObject(call_instr->InputAt(6))->IsUndefined(isolate()));
+  EXPECT_EQ(0.5, s.ToFloat64(call_instr->InputAt(6)));
+  EXPECT_TRUE(s.ToHeapObject(call_instr->InputAt(7))->IsUndefined(isolate()));
 
   // Function.
-  EXPECT_EQ(s.ToVreg(function_node), s.ToVreg(call_instr->InputAt(7)));
+  EXPECT_EQ(s.ToVreg(function_node), s.ToVreg(call_instr->InputAt(8)));
   // Context.
-  EXPECT_EQ(s.ToVreg(context), s.ToVreg(call_instr->InputAt(8)));
+  EXPECT_EQ(s.ToVreg(context), s.ToVreg(call_instr->InputAt(9)));
 
   EXPECT_EQ(kArchRet, s[index++]->arch_opcode());
 
@@ -513,7 +516,7 @@ TARGET_TEST_F(InstructionSelectorTest, CallStubWithDeoptRecursiveFrameState) {
   ZoneVector<MachineType> float64_type(1, MachineType::Float64(), zone());
 
   Callable callable = Builtins::CallableFor(isolate(), Builtins::kToObject);
-  CallDescriptor* descriptor = Linkage::GetStubCallDescriptor(
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
       isolate(), zone(), callable.descriptor(), 1,
       CallDescriptor::kNeedsFrameState, Operator::kNoProperties);
 
@@ -552,7 +555,7 @@ TARGET_TEST_F(InstructionSelectorTest, CallStubWithDeoptRecursiveFrameState) {
   // Build the call.
   Node* stub_code = m.HeapConstant(callable.code());
   Node* nodes[] = {stub_code, function_node, receiver, context2, state_node};
-  Node* call = m.CallNWithFrameState(descriptor, arraysize(nodes), nodes);
+  Node* call = m.CallNWithFrameState(call_descriptor, arraysize(nodes), nodes);
   m.Return(call);
 
   Stream s = m.Build(kAllExceptNopInstructions);
@@ -570,6 +573,7 @@ TARGET_TEST_F(InstructionSelectorTest, CallStubWithDeoptRecursiveFrameState) {
   EXPECT_EQ(kArchCallCodeObject, call_instr->arch_opcode());
   size_t num_operands =
       1 +  // Code object.
+      1 +  // Poison index.
       1 +  // Frame state deopt id
       6 +  // One input for each value in frame state + context.
       5 +  // One input for each value in the parent frame state + context.
@@ -580,7 +584,7 @@ TARGET_TEST_F(InstructionSelectorTest, CallStubWithDeoptRecursiveFrameState) {
   EXPECT_TRUE(call_instr->InputAt(0)->IsImmediate());
 
   // Deoptimization id.
-  int32_t deopt_id_before = s.ToInt32(call_instr->InputAt(1));
+  int32_t deopt_id_before = s.ToInt32(call_instr->InputAt(2));
   FrameStateDescriptor* desc_before =
       s.GetFrameStateDescriptor(deopt_id_before);
   FrameStateDescriptor* desc_before_outer = desc_before->outer_state();
@@ -589,25 +593,25 @@ TARGET_TEST_F(InstructionSelectorTest, CallStubWithDeoptRecursiveFrameState) {
   EXPECT_EQ(1u, desc_before_outer->locals_count());
   EXPECT_EQ(1u, desc_before_outer->stack_count());
   // Values from parent environment.
-  EXPECT_EQ(63, s.ToInt32(call_instr->InputAt(3)));
+  EXPECT_EQ(63, s.ToInt32(call_instr->InputAt(4)));
   // Context:
-  EXPECT_EQ(66, s.ToInt32(call_instr->InputAt(4)));
-  EXPECT_EQ(64, s.ToInt32(call_instr->InputAt(5)));
-  EXPECT_EQ(65, s.ToInt32(call_instr->InputAt(6)));
+  EXPECT_EQ(66, s.ToInt32(call_instr->InputAt(5)));
+  EXPECT_EQ(64, s.ToInt32(call_instr->InputAt(6)));
+  EXPECT_EQ(65, s.ToInt32(call_instr->InputAt(7)));
   // Values from the nested frame.
   EXPECT_EQ(1u, desc_before->parameters_count());
   EXPECT_EQ(1u, desc_before->locals_count());
   EXPECT_EQ(2u, desc_before->stack_count());
-  EXPECT_EQ(43, s.ToInt32(call_instr->InputAt(8)));
-  EXPECT_EQ(46, s.ToInt32(call_instr->InputAt(9)));
-  EXPECT_EQ(0.25, s.ToFloat64(call_instr->InputAt(10)));
-  EXPECT_EQ(44, s.ToInt32(call_instr->InputAt(11)));
-  EXPECT_EQ(45, s.ToInt32(call_instr->InputAt(12)));
+  EXPECT_EQ(43, s.ToInt32(call_instr->InputAt(9)));
+  EXPECT_EQ(46, s.ToInt32(call_instr->InputAt(10)));
+  EXPECT_EQ(0.25, s.ToFloat64(call_instr->InputAt(11)));
+  EXPECT_EQ(44, s.ToInt32(call_instr->InputAt(12)));
+  EXPECT_EQ(45, s.ToInt32(call_instr->InputAt(13)));
 
   // Function.
-  EXPECT_EQ(s.ToVreg(function_node), s.ToVreg(call_instr->InputAt(13)));
+  EXPECT_EQ(s.ToVreg(function_node), s.ToVreg(call_instr->InputAt(14)));
   // Context.
-  EXPECT_EQ(s.ToVreg(context2), s.ToVreg(call_instr->InputAt(14)));
+  EXPECT_EQ(s.ToVreg(context2), s.ToVreg(call_instr->InputAt(15)));
   // Continuation.
 
   EXPECT_EQ(kArchRet, s[index++]->arch_opcode());
diff --git a/deps/v8/test/unittests/compiler/int64-lowering-unittest.cc b/deps/v8/test/unittests/compiler/int64-lowering-unittest.cc
index ddb8408e5f4..0d949f7c0d6 100644
--- a/deps/v8/test/unittests/compiler/int64-lowering-unittest.cc
+++ b/deps/v8/test/unittests/compiler/int64-lowering-unittest.cc
@@ -337,12 +337,13 @@ TEST_F(Int64LoweringTest, CallI64Return) {
   Signature<MachineRepresentation>::Builder sig_builder(zone(), 1, 0);
   sig_builder.AddReturn(MachineRepresentation::kWord64);
 
-  compiler::CallDescriptor* desc =
+  auto call_descriptor =
       compiler::GetWasmCallDescriptor(zone(), sig_builder.Build());
 
-  LowerGraph(graph()->NewNode(common()->Call(desc), Int32Constant(function),
-                              context_address, start(), start()),
-             MachineRepresentation::kWord64);
+  LowerGraph(
+      graph()->NewNode(common()->Call(call_descriptor), Int32Constant(function),
+                       context_address, start(), start()),
+      MachineRepresentation::kWord64);
 
   Capture<Node*> call;
   Matcher<Node*> call_matcher =
@@ -354,9 +355,9 @@ TEST_F(Int64LoweringTest, CallI64Return) {
                         start(), start()));
 
   CompareCallDescriptors(
-      OpParameter<const CallDescriptor*>(
-          graph()->end()->InputAt(1)->InputAt(1)->InputAt(0)),
-      compiler::GetI32WasmCallDescriptor(zone(), desc));
+      CallDescriptorOf(
+          graph()->end()->InputAt(1)->InputAt(1)->InputAt(0)->op()),
+      compiler::GetI32WasmCallDescriptor(zone(), call_descriptor));
 }
 
 TEST_F(Int64LoweringTest, CallI64Parameter) {
@@ -369,14 +370,15 @@ TEST_F(Int64LoweringTest, CallI64Parameter) {
   sig_builder.AddParam(MachineRepresentation::kWord32);
   sig_builder.AddParam(MachineRepresentation::kWord64);
 
-  compiler::CallDescriptor* desc =
+  auto call_descriptor =
       compiler::GetWasmCallDescriptor(zone(), sig_builder.Build());
 
-  LowerGraph(graph()->NewNode(common()->Call(desc), Int32Constant(function),
-                              context_address, Int64Constant(value(0)),
-                              Int32Constant(low_word_value(1)),
-                              Int64Constant(value(2)), start(), start()),
-             MachineRepresentation::kWord32);
+  LowerGraph(
+      graph()->NewNode(common()->Call(call_descriptor), Int32Constant(function),
+                       context_address, Int64Constant(value(0)),
+                       Int32Constant(low_word_value(1)),
+                       Int64Constant(value(2)), start(), start()),
+      MachineRepresentation::kWord32);
 
   EXPECT_THAT(
       graph()->end()->InputAt(1),
@@ -388,9 +390,9 @@ TEST_F(Int64LoweringTest, CallI64Parameter) {
                       IsInt32Constant(high_word_value(2)), start(), start()),
                start(), start()));
 
-  CompareCallDescriptors(OpParameter<const CallDescriptor*>(
-                             graph()->end()->InputAt(1)->InputAt(1)),
-                         compiler::GetI32WasmCallDescriptor(zone(), desc));
+  CompareCallDescriptors(
+      CallDescriptorOf(graph()->end()->InputAt(1)->InputAt(1)->op()),
+      compiler::GetI32WasmCallDescriptor(zone(), call_descriptor));
 }
 
 TEST_F(Int64LoweringTest, Int64Add) {
diff --git a/deps/v8/test/unittests/compiler/js-builtin-reducer-unittest.cc b/deps/v8/test/unittests/compiler/js-builtin-reducer-unittest.cc
index a0ea6f376ef..a110b87a335 100644
--- a/deps/v8/test/unittests/compiler/js-builtin-reducer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/js-builtin-reducer-unittest.cc
@@ -195,1311 +195,6 @@ TEST_F(JSBuiltinReducerTest, GlobalIsNaNWithPlainPrimitive) {
                                          IsPlainPrimitiveToNumber(p0))));
 }
 
-// -----------------------------------------------------------------------------
-// Math.abs
-
-TEST_F(JSBuiltinReducerTest, MathAbsWithNumber) {
-  Node* function = MathFunction("abs");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberAbs(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathAbsWithPlainPrimitive) {
-  Node* function = MathFunction("abs");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberAbs(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.acos
-
-TEST_F(JSBuiltinReducerTest, MathAcosWithNumber) {
-  Node* function = MathFunction("acos");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberAcos(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathAcosWithPlainPrimitive) {
-  Node* function = MathFunction("acos");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberAcos(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.acosh
-
-TEST_F(JSBuiltinReducerTest, MathAcoshWithNumber) {
-  Node* function = MathFunction("acosh");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberAcosh(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathAcoshWithPlainPrimitive) {
-  Node* function = MathFunction("acosh");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberAcosh(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.asin
-
-TEST_F(JSBuiltinReducerTest, MathAsinWithNumber) {
-  Node* function = MathFunction("asin");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberAsin(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathAsinWithPlainPrimitive) {
-  Node* function = MathFunction("asin");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberAsin(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.asinh
-
-TEST_F(JSBuiltinReducerTest, MathAsinhWithNumber) {
-  Node* function = MathFunction("asinh");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberAsinh(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathAsinhWithPlainPrimitive) {
-  Node* function = MathFunction("asinh");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberAsinh(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.atan
-
-TEST_F(JSBuiltinReducerTest, MathAtanWithNumber) {
-  Node* function = MathFunction("atan");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberAtan(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathAtanWithPlainPrimitive) {
-  Node* function = MathFunction("atan");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberAtan(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.atanh
-
-TEST_F(JSBuiltinReducerTest, MathAtanhWithNumber) {
-  Node* function = MathFunction("atanh");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberAtanh(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathAtanhWithPlainPrimitive) {
-  Node* function = MathFunction("atanh");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberAtanh(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.atan2
-
-TEST_F(JSBuiltinReducerTest, MathAtan2WithNumber) {
-  Node* function = MathFunction("atan2");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    TRACED_FOREACH(Type*, t1, kNumberTypes) {
-      Node* p1 = Parameter(t1, 0);
-      Node* call =
-          graph()->NewNode(javascript()->Call(4), function, UndefinedConstant(),
-                           p0, p1, context, frame_state, effect, control);
-      Reduction r = Reduce(call);
-
-      ASSERT_TRUE(r.Changed());
-      EXPECT_THAT(r.replacement(), IsNumberAtan2(p0, p1));
-    }
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathAtan2WithPlainPrimitive) {
-  Node* function = MathFunction("atan2");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* p1 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(4), function, UndefinedConstant(), p0,
-                       p1, context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberAtan2(IsPlainPrimitiveToNumber(p0),
-                                             IsPlainPrimitiveToNumber(p1)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.ceil
-
-TEST_F(JSBuiltinReducerTest, MathCeilWithNumber) {
-  Node* function = MathFunction("ceil");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberCeil(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathCeilWithPlainPrimitive) {
-  Node* function = MathFunction("ceil");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberCeil(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.clz32
-
-TEST_F(JSBuiltinReducerTest, MathClz32WithUnsigned32) {
-  Node* function = MathFunction("clz32");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::Unsigned32(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberClz32(p0));
-}
-
-TEST_F(JSBuiltinReducerTest, MathClz32WithNumber) {
-  Node* function = MathFunction("clz32");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::Number(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberClz32(IsNumberToUint32(p0)));
-}
-
-TEST_F(JSBuiltinReducerTest, MathClz32WithPlainPrimitive) {
-  Node* function = MathFunction("clz32");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(),
-              IsNumberClz32(IsNumberToUint32(IsPlainPrimitiveToNumber(p0))));
-}
-
-// -----------------------------------------------------------------------------
-// Math.cos
-
-TEST_F(JSBuiltinReducerTest, MathCosWithNumber) {
-  Node* function = MathFunction("cos");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberCos(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathCosWithPlainPrimitive) {
-  Node* function = MathFunction("cos");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberCos(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.cosh
-
-TEST_F(JSBuiltinReducerTest, MathCoshWithNumber) {
-  Node* function = MathFunction("cosh");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberCosh(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathCoshWithPlainPrimitive) {
-  Node* function = MathFunction("cosh");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberCosh(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.exp
-
-TEST_F(JSBuiltinReducerTest, MathExpWithNumber) {
-  Node* function = MathFunction("exp");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberExp(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathExpWithPlainPrimitive) {
-  Node* function = MathFunction("exp");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberExp(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.floor
-
-TEST_F(JSBuiltinReducerTest, MathFloorWithNumber) {
-  Node* function = MathFunction("floor");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberFloor(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathFloorWithPlainPrimitive) {
-  Node* function = MathFunction("floor");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberFloor(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.fround
-
-TEST_F(JSBuiltinReducerTest, MathFroundWithNumber) {
-  Node* function = MathFunction("fround");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberFround(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathFroundWithPlainPrimitive) {
-  Node* function = MathFunction("fround");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberFround(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.imul
-
-TEST_F(JSBuiltinReducerTest, MathImulWithUnsigned32) {
-  Node* function = MathFunction("imul");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::Unsigned32(), 0);
-  Node* p1 = Parameter(Type::Unsigned32(), 1);
-  Node* call =
-      graph()->NewNode(javascript()->Call(4), function, UndefinedConstant(), p0,
-                       p1, context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberImul(p0, p1));
-}
-
-TEST_F(JSBuiltinReducerTest, MathImulWithNumber) {
-  Node* function = MathFunction("imul");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::Number(), 0);
-  Node* p1 = Parameter(Type::Number(), 1);
-  Node* call =
-      graph()->NewNode(javascript()->Call(4), function, UndefinedConstant(), p0,
-                       p1, context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(),
-              IsNumberImul(IsNumberToUint32(p0), IsNumberToUint32(p1)));
-}
-
-TEST_F(JSBuiltinReducerTest, MathImulWithPlainPrimitive) {
-  Node* function = MathFunction("imul");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* p1 = Parameter(Type::PlainPrimitive(), 1);
-  Node* call =
-      graph()->NewNode(javascript()->Call(4), function, UndefinedConstant(), p0,
-                       p1, context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(),
-              IsNumberImul(IsNumberToUint32(IsPlainPrimitiveToNumber(p0)),
-                           IsNumberToUint32(IsPlainPrimitiveToNumber(p1))));
-}
-
-// -----------------------------------------------------------------------------
-// Math.log
-
-TEST_F(JSBuiltinReducerTest, MathLogWithNumber) {
-  Node* function = MathFunction("log");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberLog(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathLogWithPlainPrimitive) {
-  Node* function = MathFunction("log");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberLog(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.log1p
-
-TEST_F(JSBuiltinReducerTest, MathLog1pWithNumber) {
-  Node* function = MathFunction("log1p");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberLog1p(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathLog1pWithPlainPrimitive) {
-  Node* function = MathFunction("log1p");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberLog1p(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.max
-
-TEST_F(JSBuiltinReducerTest, MathMaxWithNoArguments) {
-  Node* function = MathFunction("max");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* call =
-      graph()->NewNode(javascript()->Call(2), function, UndefinedConstant(),
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberConstant(-V8_INFINITY));
-}
-
-TEST_F(JSBuiltinReducerTest, MathMaxWithNumber) {
-  Node* function = MathFunction("max");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), p0);
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathMaxWithPlainPrimitive) {
-  Node* function = MathFunction("max");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* p1 = Parameter(Type::PlainPrimitive(), 1);
-  Node* call =
-      graph()->NewNode(javascript()->Call(4), function, UndefinedConstant(), p0,
-                       p1, context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberMax(IsPlainPrimitiveToNumber(p0),
-                                           IsPlainPrimitiveToNumber(p1)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.min
-
-TEST_F(JSBuiltinReducerTest, MathMinWithNoArguments) {
-  Node* function = MathFunction("min");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* call =
-      graph()->NewNode(javascript()->Call(2), function, UndefinedConstant(),
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberConstant(V8_INFINITY));
-}
-
-TEST_F(JSBuiltinReducerTest, MathMinWithNumber) {
-  Node* function = MathFunction("min");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), p0);
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathMinWithPlainPrimitive) {
-  Node* function = MathFunction("min");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* p1 = Parameter(Type::PlainPrimitive(), 1);
-  Node* call =
-      graph()->NewNode(javascript()->Call(4), function, UndefinedConstant(), p0,
-                       p1, context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberMin(IsPlainPrimitiveToNumber(p0),
-                                           IsPlainPrimitiveToNumber(p1)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.round
-
-TEST_F(JSBuiltinReducerTest, MathRoundWithNumber) {
-  Node* function = MathFunction("round");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberRound(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathRoundWithPlainPrimitive) {
-  Node* function = MathFunction("round");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberRound(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.pow
-
-TEST_F(JSBuiltinReducerTest, MathPowWithNumber) {
-  Node* function = MathFunction("pow");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    TRACED_FOREACH(Type*, t1, kNumberTypes) {
-      Node* p1 = Parameter(t1, 0);
-      Node* call =
-          graph()->NewNode(javascript()->Call(4), function, UndefinedConstant(),
-                           p0, p1, context, frame_state, effect, control);
-      Reduction r = Reduce(call);
-
-      ASSERT_TRUE(r.Changed());
-      EXPECT_THAT(r.replacement(), IsNumberPow(p0, p1));
-    }
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathPowWithPlainPrimitive) {
-  Node* function = MathFunction("pow");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* p1 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(4), function, UndefinedConstant(), p0,
-                       p1, context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberPow(IsPlainPrimitiveToNumber(p0),
-                                           IsPlainPrimitiveToNumber(p1)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.sign
-
-TEST_F(JSBuiltinReducerTest, MathSignWithNumber) {
-  Node* function = MathFunction("sign");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberSign(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathSignWithPlainPrimitive) {
-  Node* function = MathFunction("sign");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberSign(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.sin
-
-TEST_F(JSBuiltinReducerTest, MathSinWithNumber) {
-  Node* function = MathFunction("sin");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberSin(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathSinWithPlainPrimitive) {
-  Node* function = MathFunction("sin");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberSin(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.sinh
-
-TEST_F(JSBuiltinReducerTest, MathSinhWithNumber) {
-  Node* function = MathFunction("sinh");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberSinh(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathSinhWithPlainPrimitive) {
-  Node* function = MathFunction("sinh");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberSinh(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.sqrt
-
-TEST_F(JSBuiltinReducerTest, MathSqrtWithNumber) {
-  Node* function = MathFunction("sqrt");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberSqrt(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathSqrtWithPlainPrimitive) {
-  Node* function = MathFunction("sqrt");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberSqrt(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.tan
-
-TEST_F(JSBuiltinReducerTest, MathTanWithNumber) {
-  Node* function = MathFunction("tan");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberTan(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathTanWithPlainPrimitive) {
-  Node* function = MathFunction("tan");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberTan(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.tanh
-
-TEST_F(JSBuiltinReducerTest, MathTanhWithNumber) {
-  Node* function = MathFunction("tanh");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberTanh(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathTanhWithPlainPrimitive) {
-  Node* function = MathFunction("tanh");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberTanh(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Math.trunc
-
-TEST_F(JSBuiltinReducerTest, MathTruncWithNumber) {
-  Node* function = MathFunction("trunc");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberTrunc(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, MathTruncWithPlainPrimitive) {
-  Node* function = MathFunction("trunc");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsNumberTrunc(IsPlainPrimitiveToNumber(p0)));
-}
-
-// -----------------------------------------------------------------------------
-// Number.isFinite
-
-TEST_F(JSBuiltinReducerTest, NumberIsFiniteWithNumber) {
-  Node* function = NumberFunction("isFinite");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberEqual(IsNumberSubtract(p0, p0),
-                                               IsNumberSubtract(p0, p0)));
-  }
-}
-
-// -----------------------------------------------------------------------------
-// Number.isInteger
-
-TEST_F(JSBuiltinReducerTest, NumberIsIntegerWithNumber) {
-  Node* function = NumberFunction("isInteger");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(),
-                IsNumberEqual(IsNumberSubtract(p0, IsNumberTrunc(p0)),
-                              IsNumberConstant(0.0)));
-  }
-}
-
-// -----------------------------------------------------------------------------
-// Number.isNaN
-
-TEST_F(JSBuiltinReducerTest, NumberIsNaNWithNumber) {
-  Node* function = NumberFunction("isNaN");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsObjectIsNaN(p0));
-  }
-}
-
-// -----------------------------------------------------------------------------
-// Number.isSafeInteger
-
-TEST_F(JSBuiltinReducerTest, NumberIsSafeIntegerWithIntegral32) {
-  Node* function = NumberFunction("isSafeInteger");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kIntegral32Types) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsTrueConstant());
-  }
-}
-
 // -----------------------------------------------------------------------------
 // Number.parseInt
 
@@ -1542,46 +237,6 @@ TEST_F(JSBuiltinReducerTest, NumberParseIntWithIntegral32AndUndefined) {
   }
 }
 
-// -----------------------------------------------------------------------------
-// String.fromCharCode
-
-TEST_F(JSBuiltinReducerTest, StringFromCharCodeWithNumber) {
-  Node* function = StringFunction("fromCharCode");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsStringFromCharCode(p0));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, StringFromCharCodeWithPlainPrimitive) {
-  Node* function = StringFunction("fromCharCode");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(),
-              IsStringFromCharCode(IsPlainPrimitiveToNumber(p0)));
-}
-
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc b/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc
new file mode 100644
index 00000000000..3f1560d4b09
--- /dev/null
+++ b/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc
@@ -0,0 +1,538 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <cctype>
+
+#include "src/compilation-dependencies.h"
+#include "src/compiler/js-call-reducer.h"
+#include "src/compiler/js-graph.h"
+#include "src/compiler/simplified-operator.h"
+#include "src/factory.h"
+#include "src/feedback-vector.h"
+#include "src/isolate.h"
+#include "test/unittests/compiler/graph-unittest.h"
+#include "test/unittests/compiler/node-test-utils.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+class JSCallReducerTest : public TypedGraphTest {
+ public:
+  JSCallReducerTest()
+      : TypedGraphTest(3), javascript_(zone()), deps_(isolate(), zone()) {}
+  ~JSCallReducerTest() override {}
+
+ protected:
+  Reduction Reduce(Node* node) {
+    MachineOperatorBuilder machine(zone());
+    SimplifiedOperatorBuilder simplified(zone());
+    JSGraph jsgraph(isolate(), graph(), common(), javascript(), &simplified,
+                    &machine);
+    // TODO(titzer): mock the GraphReducer here for better unit testing.
+    GraphReducer graph_reducer(zone(), graph());
+
+    JSCallReducer reducer(&graph_reducer, &jsgraph, JSCallReducer::kNoFlags,
+                          native_context(), &deps_);
+    return reducer.Reduce(node);
+  }
+
+  JSOperatorBuilder* javascript() { return &javascript_; }
+
+  static void SetUpTestCase() {
+    old_flag_lazy_ = i::FLAG_lazy_deserialization;
+    old_flag_lazy_handler_ = i::FLAG_lazy_handler_deserialization;
+    i::FLAG_lazy_deserialization = false;
+    i::FLAG_lazy_handler_deserialization = false;
+    TypedGraphTest::SetUpTestCase();
+  }
+
+  static void TearDownTestCase() {
+    TypedGraphTest::TearDownTestCase();
+    i::FLAG_lazy_deserialization = old_flag_lazy_;
+    i::FLAG_lazy_handler_deserialization = old_flag_lazy_handler_;
+  }
+
+  Node* MathFunction(const std::string& name) {
+    Handle<Object> m =
+        JSObject::GetProperty(
+            isolate()->global_object(),
+            isolate()->factory()->NewStringFromAsciiChecked("Math"))
+            .ToHandleChecked();
+    Handle<JSFunction> f = Handle<JSFunction>::cast(
+        Object::GetProperty(
+            m, isolate()->factory()->NewStringFromAsciiChecked(name.c_str()))
+            .ToHandleChecked());
+    return HeapConstant(f);
+  }
+
+  Node* StringFunction(const char* name) {
+    Handle<Object> m =
+        JSObject::GetProperty(
+            isolate()->global_object(),
+            isolate()->factory()->NewStringFromAsciiChecked("String"))
+            .ToHandleChecked();
+    Handle<JSFunction> f = Handle<JSFunction>::cast(
+        Object::GetProperty(
+            m, isolate()->factory()->NewStringFromAsciiChecked(name))
+            .ToHandleChecked());
+    return HeapConstant(f);
+  }
+
+  Node* NumberFunction(const char* name) {
+    Handle<Object> m =
+        JSObject::GetProperty(
+            isolate()->global_object(),
+            isolate()->factory()->NewStringFromAsciiChecked("Number"))
+            .ToHandleChecked();
+    Handle<JSFunction> f = Handle<JSFunction>::cast(
+        Object::GetProperty(
+            m, isolate()->factory()->NewStringFromAsciiChecked(name))
+            .ToHandleChecked());
+    return HeapConstant(f);
+  }
+
+  std::string op_name_for(const char* fnc) {
+    std::string string_fnc(fnc);
+    char initial = std::toupper(fnc[0]);
+    return std::string("Number") + initial +
+           string_fnc.substr(1, std::string::npos);
+  }
+
+  const Operator* Call(int arity) {
+    FeedbackVectorSpec spec(zone());
+    spec.AddCallICSlot();
+    Handle<FeedbackMetadata> metadata = FeedbackMetadata::New(isolate(), &spec);
+    Handle<SharedFunctionInfo> shared =
+        isolate()->factory()->NewSharedFunctionInfoForBuiltin(
+            isolate()->factory()->empty_string(), Builtins::kIllegal);
+    shared->set_feedback_metadata(*metadata);
+    Handle<FeedbackVector> vector = FeedbackVector::New(isolate(), shared);
+    VectorSlotPair feedback(vector, FeedbackSlot(0));
+    return javascript()->Call(arity, CallFrequency(), feedback,
+                              ConvertReceiverMode::kAny,
+                              SpeculationMode::kAllowSpeculation);
+  }
+
+ private:
+  JSOperatorBuilder javascript_;
+  CompilationDependencies deps_;
+
+  static bool old_flag_lazy_;
+  static bool old_flag_lazy_handler_;
+};
+
+TEST_F(JSCallReducerTest, PromiseConstructorNoArgs) {
+  Node* promise = HeapConstant(handle(native_context()->promise_function()));
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+
+  Node* construct =
+      graph()->NewNode(javascript()->Construct(2), promise, promise, context,
+                       frame_state, effect, control);
+
+  Reduction r = Reduce(construct);
+
+  ASSERT_FALSE(r.Changed());
+}
+
+TEST_F(JSCallReducerTest, PromiseConstructorSubclass) {
+  Node* promise = HeapConstant(handle(native_context()->promise_function()));
+  Node* new_target = HeapConstant(handle(native_context()->array_function()));
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+
+  Node* executor = UndefinedConstant();
+  Node* construct =
+      graph()->NewNode(javascript()->Construct(3), promise, executor,
+                       new_target, context, frame_state, effect, control);
+
+  Reduction r = Reduce(construct);
+
+  ASSERT_FALSE(r.Changed());
+}
+
+TEST_F(JSCallReducerTest, PromiseConstructorBasic) {
+  Node* promise = HeapConstant(handle(native_context()->promise_function()));
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+
+  Node* executor = UndefinedConstant();
+  Node* construct =
+      graph()->NewNode(javascript()->Construct(3), promise, executor, promise,
+                       context, frame_state, effect, control);
+
+  Reduction r = Reduce(construct);
+
+  if (FLAG_experimental_inline_promise_constructor) {
+    ASSERT_TRUE(r.Changed());
+  } else {
+    ASSERT_FALSE(r.Changed());
+  }
+}
+
+// Exactly the same as PromiseConstructorBasic which expects a reduction,
+// except that we invalidate the protector cell.
+TEST_F(JSCallReducerTest, PromiseConstructorWithHook) {
+  Node* promise = HeapConstant(handle(native_context()->promise_function()));
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+
+  Node* executor = UndefinedConstant();
+  Node* construct =
+      graph()->NewNode(javascript()->Construct(3), promise, executor, promise,
+                       context, frame_state, effect, control);
+
+  isolate()->InvalidatePromiseHookProtector();
+
+  Reduction r = Reduce(construct);
+
+  ASSERT_FALSE(r.Changed());
+}
+
+bool JSCallReducerTest::old_flag_lazy_;
+bool JSCallReducerTest::old_flag_lazy_handler_;
+
+// -----------------------------------------------------------------------------
+// Math unaries
+
+namespace {
+
+const char* kMathUnaries[] = {
+    "abs",  "acos",  "acosh", "asin", "asinh", "atan",  "cbrt",
+    "ceil", "cos",   "cosh",  "exp",  "expm1", "floor", "fround",
+    "log",  "log1p", "log10", "log2", "round", "sign",  "sin",
+    "sinh", "sqrt",  "tan",   "tanh", "trunc"};
+
+}  // namespace
+
+TEST_F(JSCallReducerTest, MathUnaryWithNumber) {
+  TRACED_FOREACH(const char*, fnc, kMathUnaries) {
+    Node* effect = graph()->start();
+    Node* control = graph()->start();
+    Node* context = UndefinedConstant();
+    Node* frame_state = graph()->start();
+    Node* jsfunction = MathFunction(fnc);
+    Node* p0 = Parameter(Type::Any(), 0);
+    Node* call = graph()->NewNode(Call(3), jsfunction, UndefinedConstant(), p0,
+                                  context, frame_state, effect, control);
+    Reduction r = Reduce(call);
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(std::string(IrOpcode::Mnemonic(r.replacement()->opcode())),
+                op_name_for(fnc));
+  }
+}
+
+// -----------------------------------------------------------------------------
+// Math binaries
+
+namespace {
+
+const char* kMathBinaries[] = {"atan2", "pow"};
+
+}  // namespace
+
+TEST_F(JSCallReducerTest, MathBinaryWithNumber) {
+  TRACED_FOREACH(const char*, fnc, kMathBinaries) {
+    Node* jsfunction = MathFunction(fnc);
+
+    Node* effect = graph()->start();
+    Node* control = graph()->start();
+    Node* context = UndefinedConstant();
+    Node* frame_state = graph()->start();
+    Node* p0 = Parameter(Type::Any(), 0);
+    Node* p1 = Parameter(Type::Any(), 0);
+    Node* call = graph()->NewNode(Call(4), jsfunction, UndefinedConstant(), p0,
+                                  p1, context, frame_state, effect, control);
+    Reduction r = Reduce(call);
+
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(std::string(IrOpcode::Mnemonic(r.replacement()->opcode())),
+                op_name_for(fnc));
+  }
+}
+
+// -----------------------------------------------------------------------------
+// Math.clz32
+
+TEST_F(JSCallReducerTest, MathClz32WithUnsigned32) {
+  Node* jsfunction = MathFunction("clz32");
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+
+  Node* p0 = Parameter(Type::Unsigned32(), 0);
+  Node* call = graph()->NewNode(Call(3), jsfunction, UndefinedConstant(), p0,
+                                context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(),
+              IsNumberClz32(IsNumberToUint32(IsSpeculativeToNumber(p0))));
+}
+
+TEST_F(JSCallReducerTest, MathClz32WithUnsigned32NoArg) {
+  Node* jsfunction = MathFunction("clz32");
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+
+  Node* call = graph()->NewNode(Call(2), jsfunction, UndefinedConstant(),
+                                context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsNumberConstant(32));
+}
+
+// -----------------------------------------------------------------------------
+// Math.imul
+
+TEST_F(JSCallReducerTest, MathImulWithUnsigned32) {
+  Node* jsfunction = MathFunction("imul");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::Unsigned32(), 0);
+  Node* p1 = Parameter(Type::Unsigned32(), 1);
+  Node* call = graph()->NewNode(Call(4), jsfunction, UndefinedConstant(), p0,
+                                p1, context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(std::string(IrOpcode::Mnemonic(r.replacement()->opcode())),
+              op_name_for("imul"));
+}
+
+// -----------------------------------------------------------------------------
+// Math.min
+
+TEST_F(JSCallReducerTest, MathMinWithNoArguments) {
+  Node* jsfunction = MathFunction("min");
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* call = graph()->NewNode(Call(2), jsfunction, UndefinedConstant(),
+                                context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsNumberConstant(V8_INFINITY));
+}
+
+TEST_F(JSCallReducerTest, MathMinWithNumber) {
+  Node* jsfunction = MathFunction("min");
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::Any(), 0);
+  Node* call = graph()->NewNode(Call(3), jsfunction, UndefinedConstant(), p0,
+                                context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsSpeculativeToNumber(p0));
+}
+
+TEST_F(JSCallReducerTest, MathMinWithTwoArguments) {
+  Node* jsfunction = MathFunction("min");
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::Any(), 0);
+  Node* p1 = Parameter(Type::Any(), 1);
+  Node* call = graph()->NewNode(Call(4), jsfunction, UndefinedConstant(), p0,
+                                p1, context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsNumberMin(IsSpeculativeToNumber(p0),
+                                           IsSpeculativeToNumber(p1)));
+}
+
+// -----------------------------------------------------------------------------
+// Math.max
+
+TEST_F(JSCallReducerTest, MathMaxWithNoArguments) {
+  Node* jsfunction = MathFunction("max");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* call = graph()->NewNode(Call(2), jsfunction, UndefinedConstant(),
+                                context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsNumberConstant(-V8_INFINITY));
+}
+
+TEST_F(JSCallReducerTest, MathMaxWithNumber) {
+  Node* jsfunction = MathFunction("max");
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::Any(), 0);
+  Node* call = graph()->NewNode(Call(3), jsfunction, UndefinedConstant(), p0,
+                                context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsSpeculativeToNumber(p0));
+}
+
+TEST_F(JSCallReducerTest, MathMaxWithTwoArguments) {
+  Node* jsfunction = MathFunction("max");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::Any(), 0);
+  Node* p1 = Parameter(Type::Any(), 1);
+  Node* call = graph()->NewNode(Call(4), jsfunction, UndefinedConstant(), p0,
+                                p1, context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsNumberMax(IsSpeculativeToNumber(p0),
+                                           IsSpeculativeToNumber(p1)));
+}
+
+// -----------------------------------------------------------------------------
+// String.fromCharCode
+
+TEST_F(JSCallReducerTest, StringFromSingleCharCodeWithNumber) {
+  Node* function = StringFunction("fromCharCode");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::Any(), 0);
+  Node* call = graph()->NewNode(Call(3), function, UndefinedConstant(), p0,
+                                context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(),
+              IsStringFromSingleCharCode(IsSpeculativeToNumber(p0)));
+}
+
+TEST_F(JSCallReducerTest, StringFromSingleCharCodeWithPlainPrimitive) {
+  Node* function = StringFunction("fromCharCode");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
+  Node* call = graph()->NewNode(Call(3), function, UndefinedConstant(), p0,
+                                context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(),
+              IsStringFromSingleCharCode(IsSpeculativeToNumber(p0)));
+}
+
+// -----------------------------------------------------------------------------
+// Number.isFinite
+
+TEST_F(JSCallReducerTest, NumberIsFinite) {
+  Node* function = NumberFunction("isFinite");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::Any(), 0);
+  Node* call = graph()->NewNode(Call(3), function, UndefinedConstant(), p0,
+                                context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsObjectIsFiniteNumber(p0));
+}
+
+// -----------------------------------------------------------------------------
+// Number.isInteger
+
+TEST_F(JSCallReducerTest, NumberIsIntegerWithNumber) {
+  Node* function = NumberFunction("isInteger");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::Any(), 0);
+  Node* call =
+      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
+                       context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsObjectIsInteger(p0));
+}
+
+// -----------------------------------------------------------------------------
+// Number.isNaN
+
+TEST_F(JSCallReducerTest, NumberIsNaNWithNumber) {
+  Node* function = NumberFunction("isNaN");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::Any(), 0);
+  Node* call =
+      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
+                       context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsObjectIsNaN(p0));
+}
+
+// -----------------------------------------------------------------------------
+// Number.isSafeInteger
+
+TEST_F(JSCallReducerTest, NumberIsSafeIntegerWithIntegral32) {
+  Node* function = NumberFunction("isSafeInteger");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::Any(), 0);
+  Node* call =
+      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
+                       context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsObjectIsSafeInteger(p0));
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/machine-operator-unittest.cc b/deps/v8/test/unittests/compiler/machine-operator-unittest.cc
index 75e84682446..eea7276f6fe 100644
--- a/deps/v8/test/unittests/compiler/machine-operator-unittest.cc
+++ b/deps/v8/test/unittests/compiler/machine-operator-unittest.cc
@@ -88,8 +88,7 @@ TEST_P(MachineLoadOperatorTest, OpcodeIsCorrect) {
 
 TEST_P(MachineLoadOperatorTest, ParameterIsCorrect) {
   MachineOperatorBuilder machine(zone(), representation());
-  EXPECT_EQ(GetParam(),
-            OpParameter<LoadRepresentation>(machine.Load(GetParam())));
+  EXPECT_EQ(GetParam(), LoadRepresentationOf(machine.Load(GetParam())));
 }
 
 
@@ -149,8 +148,7 @@ TEST_P(MachineStoreOperatorTest, OpcodeIsCorrect) {
 
 TEST_P(MachineStoreOperatorTest, ParameterIsCorrect) {
   MachineOperatorBuilder machine(zone(), representation());
-  EXPECT_EQ(GetParam(),
-            OpParameter<StoreRepresentation>(machine.Store(GetParam())));
+  EXPECT_EQ(GetParam(), StoreRepresentationOf(machine.Store(GetParam())));
 }
 
 
diff --git a/deps/v8/test/unittests/compiler/mips/OWNERS b/deps/v8/test/unittests/compiler/mips/OWNERS
index 3fce7dd6883..4ce9d7f91da 100644
--- a/deps/v8/test/unittests/compiler/mips/OWNERS
+++ b/deps/v8/test/unittests/compiler/mips/OWNERS
@@ -1,2 +1,3 @@
 ivica.bogosavljevic@mips.com
-Miran.Karic@mips.com
\ No newline at end of file
+Miran.Karic@mips.com
+sreten.kovacevic@mips.com
\ No newline at end of file
diff --git a/deps/v8/test/unittests/compiler/mips64/OWNERS b/deps/v8/test/unittests/compiler/mips64/OWNERS
index 978563cab5e..4ce9d7f91da 100644
--- a/deps/v8/test/unittests/compiler/mips64/OWNERS
+++ b/deps/v8/test/unittests/compiler/mips64/OWNERS
@@ -1,2 +1,3 @@
 ivica.bogosavljevic@mips.com
 Miran.Karic@mips.com
+sreten.kovacevic@mips.com
\ No newline at end of file
diff --git a/deps/v8/test/unittests/compiler/node-test-utils.cc b/deps/v8/test/unittests/compiler/node-test-utils.cc
index 8e7084d1b1c..1695902639e 100644
--- a/deps/v8/test/unittests/compiler/node-test-utils.cc
+++ b/deps/v8/test/unittests/compiler/node-test-utils.cc
@@ -135,7 +135,7 @@ class IsSwitchMatcher final : public TestNodeMatcher {
 
 class IsIfValueMatcher final : public TestNodeMatcher {
  public:
-  IsIfValueMatcher(const Matcher<int32_t>& value_matcher,
+  IsIfValueMatcher(const Matcher<IfValueParameters>& value_matcher,
                    const Matcher<Node*>& control_matcher)
       : TestNodeMatcher(IrOpcode::kIfValue),
         value_matcher_(value_matcher),
@@ -152,14 +152,14 @@ class IsIfValueMatcher final : public TestNodeMatcher {
 
   bool MatchAndExplain(Node* node, MatchResultListener* listener) const final {
     return (TestNodeMatcher::MatchAndExplain(node, listener) &&
-            PrintMatchAndExplain(OpParameter<int32_t>(node->op()), "value",
+            PrintMatchAndExplain(IfValueParametersOf(node->op()), "value",
                                  value_matcher_, listener) &&
             PrintMatchAndExplain(NodeProperties::GetControlInput(node),
                                  "control", control_matcher_, listener));
   }
 
  private:
-  const Matcher<int32_t> value_matcher_;
+  const Matcher<IfValueParameters> value_matcher_;
   const Matcher<Node*> control_matcher_;
 };
 
@@ -442,8 +442,8 @@ class IsConstantMatcher final : public TestNodeMatcher {
 
   bool MatchAndExplain(Node* node, MatchResultListener* listener) const final {
     return (TestNodeMatcher::MatchAndExplain(node, listener) &&
-            PrintMatchAndExplain(OpParameter<T>(node), "value", value_matcher_,
-                                 listener));
+            PrintMatchAndExplain(OpParameter<T>(node->op()), "value",
+                                 value_matcher_, listener));
   }
 
  private:
@@ -646,7 +646,7 @@ class IsProjectionMatcher final : public TestNodeMatcher {
 
   bool MatchAndExplain(Node* node, MatchResultListener* listener) const final {
     return (TestNodeMatcher::MatchAndExplain(node, listener) &&
-            PrintMatchAndExplain(OpParameter<size_t>(node), "index",
+            PrintMatchAndExplain(OpParameter<size_t>(node->op()), "index",
                                  index_matcher_, listener) &&
             PrintMatchAndExplain(NodeProperties::GetValueInput(node, 0), "base",
                                  base_matcher_, listener));
@@ -688,8 +688,8 @@ class IsCallMatcher final : public TestNodeMatcher {
 
   bool MatchAndExplain(Node* node, MatchResultListener* listener) const final {
     if (!TestNodeMatcher::MatchAndExplain(node, listener) ||
-        !PrintMatchAndExplain(OpParameter<const CallDescriptor*>(node),
-                              "descriptor", descriptor_matcher_, listener)) {
+        !PrintMatchAndExplain(CallDescriptorOf(node->op()), "descriptor",
+                              descriptor_matcher_, listener)) {
       return false;
     }
     for (size_t i = 0; i < value_matchers_.size(); ++i) {
@@ -753,8 +753,8 @@ class IsTailCallMatcher final : public TestNodeMatcher {
 
   bool MatchAndExplain(Node* node, MatchResultListener* listener) const final {
     if (!TestNodeMatcher::MatchAndExplain(node, listener) ||
-        !PrintMatchAndExplain(OpParameter<CallDescriptor const*>(node),
-                              "descriptor", descriptor_matcher_, listener)) {
+        !PrintMatchAndExplain(CallDescriptorOf(node->op()), "descriptor",
+                              descriptor_matcher_, listener)) {
       return false;
     }
     for (size_t i = 0; i < value_matchers_.size(); ++i) {
@@ -805,8 +805,8 @@ class IsSpeculativeBinopMatcher final : public TestNodeMatcher {
   bool MatchAndExplain(Node* node, MatchResultListener* listener) const final {
     return (TestNodeMatcher::MatchAndExplain(node, listener) &&
             // TODO(bmeurer): The type parameter is currently ignored.
-            PrintMatchAndExplain(OpParameter<NumberOperationHint>(node->op()),
-                                 "hints", hint_matcher_, listener) &&
+            PrintMatchAndExplain(NumberOperationHintOf(node->op()), "hints",
+                                 hint_matcher_, listener) &&
             PrintMatchAndExplain(NodeProperties::GetValueInput(node, 0), "lhs",
                                  lhs_matcher_, listener) &&
             PrintMatchAndExplain(NodeProperties::GetValueInput(node, 1), "rhs",
@@ -879,7 +879,7 @@ class IsLoadFieldMatcher final : public TestNodeMatcher {
 
   bool MatchAndExplain(Node* node, MatchResultListener* listener) const final {
     return (TestNodeMatcher::MatchAndExplain(node, listener) &&
-            PrintMatchAndExplain(OpParameter<FieldAccess>(node), "access",
+            PrintMatchAndExplain(FieldAccessOf(node->op()), "access",
                                  access_matcher_, listener) &&
             PrintMatchAndExplain(NodeProperties::GetValueInput(node, 0), "base",
                                  base_matcher_, listener) &&
@@ -927,7 +927,7 @@ class IsStoreFieldMatcher final : public TestNodeMatcher {
 
   bool MatchAndExplain(Node* node, MatchResultListener* listener) const final {
     return (TestNodeMatcher::MatchAndExplain(node, listener) &&
-            PrintMatchAndExplain(OpParameter<FieldAccess>(node), "access",
+            PrintMatchAndExplain(FieldAccessOf(node->op()), "access",
                                  access_matcher_, listener) &&
             PrintMatchAndExplain(NodeProperties::GetValueInput(node, 0), "base",
                                  base_matcher_, listener) &&
@@ -978,7 +978,7 @@ class IsLoadElementMatcher final : public TestNodeMatcher {
 
   bool MatchAndExplain(Node* node, MatchResultListener* listener) const final {
     return (TestNodeMatcher::MatchAndExplain(node, listener) &&
-            PrintMatchAndExplain(OpParameter<ElementAccess>(node), "access",
+            PrintMatchAndExplain(ElementAccessOf(node->op()), "access",
                                  access_matcher_, listener) &&
             PrintMatchAndExplain(NodeProperties::GetValueInput(node, 0), "base",
                                  base_matcher_, listener) &&
@@ -1033,7 +1033,7 @@ class IsStoreElementMatcher final : public TestNodeMatcher {
 
   bool MatchAndExplain(Node* node, MatchResultListener* listener) const final {
     return (TestNodeMatcher::MatchAndExplain(node, listener) &&
-            PrintMatchAndExplain(OpParameter<ElementAccess>(node), "access",
+            PrintMatchAndExplain(ElementAccessOf(node->op()), "access",
                                  access_matcher_, listener) &&
             PrintMatchAndExplain(NodeProperties::GetValueInput(node, 0), "base",
                                  base_matcher_, listener) &&
@@ -1059,7 +1059,7 @@ class IsStoreElementMatcher final : public TestNodeMatcher {
 #define LOAD_MATCHER(kLoad)                                                   \
   class Is##kLoad##Matcher final : public TestNodeMatcher {                   \
    public:                                                                    \
-    Is##kLoad##Matcher(const Matcher<kLoad##Representation>& rep_matcher,     \
+    Is##kLoad##Matcher(const Matcher<LoadRepresentation>& rep_matcher,        \
                        const Matcher<Node*>& base_matcher,                    \
                        const Matcher<Node*>& index_matcher,                   \
                        const Matcher<Node*>& effect_matcher,                  \
@@ -1097,8 +1097,8 @@ class IsStoreElementMatcher final : public TestNodeMatcher {
         control_node = NodeProperties::GetControlInput(node);                 \
       }                                                                       \
       return (TestNodeMatcher::MatchAndExplain(node, listener) &&             \
-              PrintMatchAndExplain(OpParameter<kLoad##Representation>(node),  \
-                                   "rep", rep_matcher_, listener) &&          \
+              PrintMatchAndExplain(LoadRepresentationOf(node->op()), "rep",   \
+                                   rep_matcher_, listener) &&                 \
               PrintMatchAndExplain(NodeProperties::GetValueInput(node, 0),    \
                                    "base", base_matcher_, listener) &&        \
               PrintMatchAndExplain(NodeProperties::GetValueInput(node, 1),    \
@@ -1110,7 +1110,7 @@ class IsStoreElementMatcher final : public TestNodeMatcher {
     }                                                                         \
                                                                               \
    private:                                                                   \
-    const Matcher<kLoad##Representation> rep_matcher_;                        \
+    const Matcher<LoadRepresentation> rep_matcher_;                           \
     const Matcher<Node*> base_matcher_;                                       \
     const Matcher<Node*> index_matcher_;                                      \
     const Matcher<Node*> effect_matcher_;                                     \
@@ -1119,6 +1119,7 @@ class IsStoreElementMatcher final : public TestNodeMatcher {
 
 LOAD_MATCHER(Load)
 LOAD_MATCHER(UnalignedLoad)
+LOAD_MATCHER(PoisonedLoad)
 
 #define STORE_MATCHER(kStore)                                                 \
   class Is##kStore##Matcher final : public TestNodeMatcher {                  \
@@ -1165,8 +1166,9 @@ LOAD_MATCHER(UnalignedLoad)
         control_node = NodeProperties::GetControlInput(node);                 \
       }                                                                       \
       return (TestNodeMatcher::MatchAndExplain(node, listener) &&             \
-              PrintMatchAndExplain(OpParameter<kStore##Representation>(node), \
-                                   "rep", rep_matcher_, listener) &&          \
+              PrintMatchAndExplain(                                           \
+                  OpParameter<kStore##Representation>(node->op()), "rep",     \
+                  rep_matcher_, listener) &&                                  \
               PrintMatchAndExplain(NodeProperties::GetValueInput(node, 0),    \
                                    "base", base_matcher_, listener) &&        \
               PrintMatchAndExplain(NodeProperties::GetValueInput(node, 1),    \
@@ -1206,8 +1208,8 @@ class IsStackSlotMatcher final : public TestNodeMatcher {
 
   bool MatchAndExplain(Node* node, MatchResultListener* listener) const final {
     return (TestNodeMatcher::MatchAndExplain(node, listener) &&
-            PrintMatchAndExplain(OpParameter<StackSlotRepresentation>(node),
-                                 "rep", rep_matcher_, listener));
+            PrintMatchAndExplain(StackSlotRepresentationOf(node->op()), "rep",
+                                 rep_matcher_, listener));
   }
 
  private:
@@ -1277,7 +1279,7 @@ class IsLoadContextMatcher final : public TestNodeMatcher {
 
   bool MatchAndExplain(Node* node, MatchResultListener* listener) const final {
     return (TestNodeMatcher::MatchAndExplain(node, listener) &&
-            PrintMatchAndExplain(OpParameter<ContextAccess>(node), "access",
+            PrintMatchAndExplain(ContextAccessOf(node->op()), "access",
                                  access_matcher_, listener) &&
             PrintMatchAndExplain(NodeProperties::GetContextInput(node),
                                  "context", context_matcher_, listener));
@@ -1526,8 +1528,7 @@ Matcher<Node*> IsSwitch(const Matcher<Node*>& value_matcher,
   return MakeMatcher(new IsSwitchMatcher(value_matcher, control_matcher));
 }
 
-
-Matcher<Node*> IsIfValue(const Matcher<int32_t>& value_matcher,
+Matcher<Node*> IsIfValue(const Matcher<IfValueParameters>& value_matcher,
                          const Matcher<Node*>& control_matcher) {
   return MakeMatcher(new IsIfValueMatcher(value_matcher, control_matcher));
 }
@@ -1970,11 +1971,21 @@ Matcher<Node*> IsLoad(const Matcher<LoadRepresentation>& rep_matcher,
                                        effect_matcher, control_matcher));
 }
 
-Matcher<Node*> IsUnalignedLoad(
-    const Matcher<UnalignedLoadRepresentation>& rep_matcher,
-    const Matcher<Node*>& base_matcher, const Matcher<Node*>& index_matcher,
-    const Matcher<Node*>& effect_matcher,
-    const Matcher<Node*>& control_matcher) {
+Matcher<Node*> IsPoisonedLoad(const Matcher<LoadRepresentation>& rep_matcher,
+                              const Matcher<Node*>& base_matcher,
+                              const Matcher<Node*>& index_matcher,
+                              const Matcher<Node*>& effect_matcher,
+                              const Matcher<Node*>& control_matcher) {
+  return MakeMatcher(new IsPoisonedLoadMatcher(rep_matcher, base_matcher,
+                                               index_matcher, effect_matcher,
+                                               control_matcher));
+}
+
+Matcher<Node*> IsUnalignedLoad(const Matcher<LoadRepresentation>& rep_matcher,
+                               const Matcher<Node*>& base_matcher,
+                               const Matcher<Node*>& index_matcher,
+                               const Matcher<Node*>& effect_matcher,
+                               const Matcher<Node*>& control_matcher) {
   return MakeMatcher(new IsUnalignedLoadMatcher(rep_matcher, base_matcher,
                                                 index_matcher, effect_matcher,
                                                 control_matcher));
@@ -2025,7 +2036,6 @@ Matcher<Node*> IsParameter(const Matcher<int> index_matcher) {
   return MakeMatcher(new IsParameterMatcher(index_matcher));
 }
 
-
 Matcher<Node*> IsLoadFramePointer() {
   return MakeMatcher(new TestNodeMatcher(IrOpcode::kLoadFramePointer));
 }
@@ -2123,9 +2133,7 @@ IS_BINOP_MATCHER(Float64InsertHighWord32)
     return MakeMatcher(new IsUnopMatcher(IrOpcode::k##Name, input_matcher)); \
   }
 IS_UNOP_MATCHER(BooleanNot)
-IS_UNOP_MATCHER(BitcastTaggedToWord)
 IS_UNOP_MATCHER(BitcastWordToTagged)
-IS_UNOP_MATCHER(BitcastWordToTaggedSigned)
 IS_UNOP_MATCHER(TruncateFloat64ToWord32)
 IS_UNOP_MATCHER(ChangeFloat64ToInt32)
 IS_UNOP_MATCHER(ChangeFloat64ToUint32)
@@ -2177,18 +2185,49 @@ IS_UNOP_MATCHER(NumberToBoolean)
 IS_UNOP_MATCHER(NumberToInt32)
 IS_UNOP_MATCHER(NumberToUint32)
 IS_UNOP_MATCHER(PlainPrimitiveToNumber)
+IS_UNOP_MATCHER(ObjectIsFiniteNumber)
+IS_UNOP_MATCHER(ObjectIsInteger)
+IS_UNOP_MATCHER(ObjectIsSafeInteger)
 IS_UNOP_MATCHER(ObjectIsNaN)
 IS_UNOP_MATCHER(ObjectIsReceiver)
 IS_UNOP_MATCHER(ObjectIsSmi)
 IS_UNOP_MATCHER(ObjectIsUndetectable)
-IS_UNOP_MATCHER(StringFromCharCode)
+IS_UNOP_MATCHER(StringFromSingleCharCode)
 IS_UNOP_MATCHER(StringLength)
 IS_UNOP_MATCHER(Word32Clz)
 IS_UNOP_MATCHER(Word32Ctz)
 IS_UNOP_MATCHER(Word32Popcnt)
 IS_UNOP_MATCHER(Word32ReverseBytes)
+IS_UNOP_MATCHER(SpeculativeToNumber)
+IS_UNOP_MATCHER(PoisonOnSpeculationTagged)
 #undef IS_UNOP_MATCHER
 
+// Special-case Bitcast operators which are disabled when ENABLE_VERIFY_CSA is
+// not enabled.
+Matcher<Node*> IsBitcastTaggedToWord(const Matcher<Node*>& input_matcher) {
+#ifdef ENABLE_VERIFY_CSA
+  return MakeMatcher(
+      new IsUnopMatcher(IrOpcode::kBitcastTaggedToWord, input_matcher));
+#else
+  return input_matcher;
+#endif
+}
+
+Matcher<Node*> IsBitcastWordToTaggedSigned(
+    const Matcher<Node*>& input_matcher) {
+#ifdef ENABLE_VERIFY_CSA
+  return MakeMatcher(
+      new IsUnopMatcher(IrOpcode::kBitcastWordToTaggedSigned, input_matcher));
+#else
+  return input_matcher;
+#endif
+}
+
+#undef LOAD_MATCHER
+#undef STORE_MATCHER
+#undef IS_QUADOP_MATCHER
+#undef IS_TERNOP_MATCHER
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/node-test-utils.h b/deps/v8/test/unittests/compiler/node-test-utils.h
index 3ce6aba0f33..baec34cd337 100644
--- a/deps/v8/test/unittests/compiler/node-test-utils.h
+++ b/deps/v8/test/unittests/compiler/node-test-utils.h
@@ -5,6 +5,7 @@
 #ifndef V8_UNITTESTS_COMPILER_NODE_TEST_UTILS_H_
 #define V8_UNITTESTS_COMPILER_NODE_TEST_UTILS_H_
 
+#include "src/compiler/common-operator.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/simplified-operator.h"
 #include "src/machine-type.h"
@@ -68,7 +69,7 @@ Matcher<Node*> IsIfFalse(const Matcher<Node*>& control_matcher);
 Matcher<Node*> IsIfSuccess(const Matcher<Node*>& control_matcher);
 Matcher<Node*> IsSwitch(const Matcher<Node*>& value_matcher,
                         const Matcher<Node*>& control_matcher);
-Matcher<Node*> IsIfValue(const Matcher<int32_t>& value_matcher,
+Matcher<Node*> IsIfValue(const Matcher<IfValueParameters>& value_matcher,
                          const Matcher<Node*>& control_matcher);
 Matcher<Node*> IsIfDefault(const Matcher<Node*>& control_matcher);
 Matcher<Node*> IsBeginRegion(const Matcher<Node*>& effect_matcher);
@@ -271,7 +272,7 @@ Matcher<Node*> IsNumberSqrt(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsNumberTan(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsNumberTanh(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsNumberTrunc(const Matcher<Node*>& value_matcher);
-Matcher<Node*> IsStringFromCharCode(const Matcher<Node*>& value_matcher);
+Matcher<Node*> IsStringFromSingleCharCode(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsStringLength(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsAllocate(const Matcher<Node*>& size_matcher,
                           const Matcher<Node*>& effect_matcher,
@@ -309,6 +310,10 @@ Matcher<Node*> IsStoreElement(const Matcher<ElementAccess>& access_matcher,
                               const Matcher<Node*>& value_matcher,
                               const Matcher<Node*>& effect_matcher,
                               const Matcher<Node*>& control_matcher);
+
+Matcher<Node*> IsObjectIsFiniteNumber(const Matcher<Node*>& value_matcher);
+Matcher<Node*> IsObjectIsInteger(const Matcher<Node*>& value_matcher);
+Matcher<Node*> IsObjectIsSafeInteger(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsObjectIsNaN(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsObjectIsReceiver(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsObjectIsSmi(const Matcher<Node*>& value_matcher);
@@ -319,11 +324,16 @@ Matcher<Node*> IsLoad(const Matcher<LoadRepresentation>& rep_matcher,
                       const Matcher<Node*>& index_matcher,
                       const Matcher<Node*>& effect_matcher,
                       const Matcher<Node*>& control_matcher);
-Matcher<Node*> IsUnalignedLoad(
-    const Matcher<UnalignedLoadRepresentation>& rep_matcher,
-    const Matcher<Node*>& base_matcher, const Matcher<Node*>& index_matcher,
-    const Matcher<Node*>& effect_matcher,
-    const Matcher<Node*>& control_matcher);
+Matcher<Node*> IsPoisonedLoad(const Matcher<LoadRepresentation>& rep_matcher,
+                              const Matcher<Node*>& base_matcher,
+                              const Matcher<Node*>& index_matcher,
+                              const Matcher<Node*>& effect_matcher,
+                              const Matcher<Node*>& control_matcher);
+Matcher<Node*> IsUnalignedLoad(const Matcher<LoadRepresentation>& rep_matcher,
+                               const Matcher<Node*>& base_matcher,
+                               const Matcher<Node*>& index_matcher,
+                               const Matcher<Node*>& effect_matcher,
+                               const Matcher<Node*>& control_matcher);
 Matcher<Node*> IsStore(const Matcher<StoreRepresentation>& rep_matcher,
                        const Matcher<Node*>& base_matcher,
                        const Matcher<Node*>& index_matcher,
@@ -336,6 +346,7 @@ Matcher<Node*> IsUnalignedStore(
     const Matcher<Node*>& value_matcher, const Matcher<Node*>& effect_matcher,
     const Matcher<Node*>& control_matcher);
 Matcher<Node*> IsStackSlot(const Matcher<StackSlotRepresentation>& rep_matcher);
+Matcher<Node*> IsWord32Popcnt(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsWord32And(const Matcher<Node*>& lhs_matcher,
                            const Matcher<Node*>& rhs_matcher);
 Matcher<Node*> IsWord32Or(const Matcher<Node*>& lhs_matcher,
@@ -447,6 +458,7 @@ Matcher<Node*> IsNumberToBoolean(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsNumberToInt32(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsNumberToUint32(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsParameter(const Matcher<int> index_matcher);
+Matcher<Node*> IsSpeculationPoison();
 Matcher<Node*> IsLoadFramePointer();
 Matcher<Node*> IsLoadParentFramePointer();
 Matcher<Node*> IsPlainPrimitiveToNumber(const Matcher<Node*>& input_matcher);
@@ -478,6 +490,8 @@ Matcher<Node*> IsWord32ReverseBytes(const Matcher<Node*>& value_matcher);
 
 Matcher<Node*> IsStackSlot();
 
+Matcher<Node*> IsSpeculativeToNumber(const Matcher<Node*>& value_matcher);
+
 // Helpers
 static inline Matcher<Node*> IsIntPtrConstant(const intptr_t value) {
   return kPointerSize == 8 ? IsInt64Constant(static_cast<int64_t>(value))
@@ -548,7 +562,7 @@ static inline Matcher<Node*> IsChangeUint32ToWord(
   return kPointerSize == 8 ? IsChangeUint32ToUint64(matcher) : matcher;
 }
 
-static inline Matcher<Node*> IsTruncateWordToWord32(
+static inline Matcher<Node*> IsTruncateIntPtrToInt32(
     const Matcher<Node*>& matcher) {
   return kPointerSize == 8 ? IsTruncateInt64ToInt32(matcher) : matcher;
 }
diff --git a/deps/v8/test/unittests/compiler/persistent-unittest.cc b/deps/v8/test/unittests/compiler/persistent-unittest.cc
index d65eda0e883..8454aeaeb1a 100644
--- a/deps/v8/test/unittests/compiler/persistent-unittest.cc
+++ b/deps/v8/test/unittests/compiler/persistent-unittest.cc
@@ -83,7 +83,9 @@ TEST(PersistentMap, Zip) {
 
   // Provoke hash collisions to stress the iterator.
   struct bad_hash {
-    size_t operator()(int key) { return static_cast<size_t>(key) % 1000; }
+    size_t operator()(int key) {
+      return base::hash_value(static_cast<size_t>(key) % 1000);
+    }
   };
   PersistentMap<int, int, bad_hash> a(&zone);
   PersistentMap<int, int, bad_hash> b(&zone);
@@ -116,7 +118,13 @@ TEST(PersistentMap, Zip) {
   ASSERT_EQ(0, sum_b);
 
   for (auto triple : a.Zip(b)) {
-    sum -= std::get<1>(triple) + std::get<2>(triple);
+    int key = std::get<0>(triple);
+    int value_a = std::get<1>(triple);
+    int value_b = std::get<2>(triple);
+    ASSERT_EQ(value_a, a.Get(key));
+    ASSERT_EQ(value_b, b.Get(key));
+    sum -= value_a;
+    sum -= value_b;
   }
   ASSERT_EQ(0, sum);
 }
diff --git a/deps/v8/test/unittests/compiler/regalloc/OWNERS b/deps/v8/test/unittests/compiler/regalloc/OWNERS
index 88646a12067..bfde831c207 100644
--- a/deps/v8/test/unittests/compiler/regalloc/OWNERS
+++ b/deps/v8/test/unittests/compiler/regalloc/OWNERS
@@ -2,4 +2,3 @@ set noparent
 
 bmeurer@chromium.org
 jarin@chromium.org
-mtrofin@chromium.org
\ No newline at end of file
diff --git a/deps/v8/test/unittests/compiler/typer-unittest.cc b/deps/v8/test/unittests/compiler/typer-unittest.cc
index 44464b9476d..fcfbfdb6466 100644
--- a/deps/v8/test/unittests/compiler/typer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/typer-unittest.cc
@@ -491,7 +491,6 @@ TEST_MONOTONICITY(ObjectIsString)
 TEST_MONOTONICITY(ObjectIsSymbol)
 TEST_MONOTONICITY(ObjectIsUndetectable)
 TEST_MONOTONICITY(TypeOf)
-TEST_MONOTONICITY(ClassOf)
 TEST_MONOTONICITY(ToBoolean)
 #undef TEST_MONOTONICITY
 
diff --git a/deps/v8/test/unittests/compiler/x64/instruction-selector-x64-unittest.cc b/deps/v8/test/unittests/compiler/x64/instruction-selector-x64-unittest.cc
index 031217b6b82..4871704d664 100644
--- a/deps/v8/test/unittests/compiler/x64/instruction-selector-x64-unittest.cc
+++ b/deps/v8/test/unittests/compiler/x64/instruction-selector-x64-unittest.cc
@@ -1463,25 +1463,6 @@ TEST_F(InstructionSelectorTest, Float64BinopArithmetic) {
 // Miscellaneous.
 
 
-TEST_F(InstructionSelectorTest, Uint64LessThanWithLoadAndLoadStackPointer) {
-  StreamBuilder m(this, MachineType::Bool());
-  Node* const sl = m.Load(
-      MachineType::Pointer(),
-      m.ExternalConstant(ExternalReference::address_of_stack_limit(isolate())));
-  Node* const sp = m.LoadStackPointer();
-  Node* const n = m.Uint64LessThan(sl, sp);
-  m.Return(n);
-  Stream s = m.Build();
-  ASSERT_EQ(1U, s.size());
-  EXPECT_EQ(kX64StackCheck, s[0]->arch_opcode());
-  ASSERT_EQ(0U, s[0]->InputCount());
-  ASSERT_EQ(1U, s[0]->OutputCount());
-  EXPECT_EQ(s.ToVreg(n), s.ToVreg(s[0]->Output()));
-  EXPECT_EQ(kFlags_set, s[0]->flags_mode());
-  EXPECT_EQ(kUnsignedGreaterThan, s[0]->flags_condition());
-}
-
-
 TEST_F(InstructionSelectorTest, Word64ShlWithChangeInt32ToInt64) {
   TRACED_FORRANGE(int64_t, x, 32, 63) {
     StreamBuilder m(this, MachineType::Int64(), MachineType::Int32());
diff --git a/deps/v8/test/unittests/counters-unittest.cc b/deps/v8/test/unittests/counters-unittest.cc
index 887ba54e016..d4772934d6f 100644
--- a/deps/v8/test/unittests/counters-unittest.cc
+++ b/deps/v8/test/unittests/counters-unittest.cc
@@ -611,7 +611,7 @@ TEST_F(RuntimeCallStatsTest, FunctionLengthGetter) {
   EXPECT_EQ(1, getter_counter->count());
   EXPECT_EQ(2, js_counter->count());
   EXPECT_LE(0, getter_counter->time().InMicroseconds());
-  EXPECT_LT(js_time, js_counter->time().InMicroseconds());
+  EXPECT_LE(js_time, js_counter->time().InMicroseconds());
 
   {
     NativeTimeScope native_timer_scope;
diff --git a/deps/v8/test/unittests/heap/gc-tracer-unittest.cc b/deps/v8/test/unittests/heap/gc-tracer-unittest.cc
index e4e92608815..0f1a841e2d3 100644
--- a/deps/v8/test/unittests/heap/gc-tracer-unittest.cc
+++ b/deps/v8/test/unittests/heap/gc-tracer-unittest.cc
@@ -295,6 +295,42 @@ TEST_F(GCTracerTest, IncrementalMarkingSpeed) {
                        tracer->IncrementalMarkingSpeedInBytesPerMillisecond()));
 }
 
+TEST_F(GCTracerTest, MutatorUtilization) {
+  GCTracer* tracer = i_isolate()->heap()->tracer();
+  tracer->ResetForTesting();
+
+  // Mark-compact #1 ended at 200ms and took 100ms.
+  tracer->RecordMutatorUtilization(200, 100);
+  // Avarage mark-compact time = 0ms.
+  // Avarage mutator time = 0ms.
+  EXPECT_DOUBLE_EQ(1.0, tracer->CurrentMarkCompactMutatorUtilization());
+  EXPECT_DOUBLE_EQ(1.0, tracer->AverageMarkCompactMutatorUtilization());
+
+  // Mark-compact #2 ended at 400ms and took 100ms.
+  tracer->RecordMutatorUtilization(400, 100);
+  // The first mark-compactor is ignored.
+  // Avarage mark-compact time = 100ms.
+  // Avarage mutator time = 100ms.
+  EXPECT_DOUBLE_EQ(0.5, tracer->CurrentMarkCompactMutatorUtilization());
+  EXPECT_DOUBLE_EQ(0.5, tracer->AverageMarkCompactMutatorUtilization());
+
+  // Mark-compact #3 ended at 600ms and took 200ms.
+  tracer->RecordMutatorUtilization(600, 200);
+  // Avarage mark-compact time = 100ms * 0.5 + 200ms * 0.5.
+  // Avarage mutator time = 100ms * 0.5 + 0ms * 0.5.
+  EXPECT_DOUBLE_EQ(0.0, tracer->CurrentMarkCompactMutatorUtilization());
+  EXPECT_DOUBLE_EQ(50.0 / 200.0,
+                   tracer->AverageMarkCompactMutatorUtilization());
+
+  // Mark-compact #4 ended at 800ms and took 0ms.
+  tracer->RecordMutatorUtilization(800, 0);
+  // Avarage mark-compact time = 150ms * 0.5 + 0ms * 0.5.
+  // Avarage mutator time = 50ms * 0.5 + 200ms * 0.5.
+  EXPECT_DOUBLE_EQ(1.0, tracer->CurrentMarkCompactMutatorUtilization());
+  EXPECT_DOUBLE_EQ(125.0 / 200.0,
+                   tracer->AverageMarkCompactMutatorUtilization());
+}
+
 TEST_F(GCTracerTest, BackgroundScavengerScope) {
   GCTracer* tracer = i_isolate()->heap()->tracer();
   tracer->ResetForTesting();
diff --git a/deps/v8/test/unittests/heap/item-parallel-job-unittest.cc b/deps/v8/test/unittests/heap/item-parallel-job-unittest.cc
index 23ff94fae9a..adeae2b593e 100644
--- a/deps/v8/test/unittests/heap/item-parallel-job-unittest.cc
+++ b/deps/v8/test/unittests/heap/item-parallel-job-unittest.cc
@@ -23,22 +23,32 @@ class ItemParallelJobTest : public TestWithIsolate {
 
 namespace {
 
-class EmptyTask : public ItemParallelJob::Task {
+class SimpleTask : public ItemParallelJob::Task {
  public:
-  explicit EmptyTask(Isolate* isolate, bool* did_run)
+  SimpleTask(Isolate* isolate, bool* did_run)
       : ItemParallelJob::Task(isolate), did_run_(did_run) {}
 
-  void RunInParallel() override { *did_run_ = true; }
+  void RunInParallel() override {
+    ItemParallelJob::Item* item = nullptr;
+    while ((item = GetItem<ItemParallelJob::Item>()) != nullptr) {
+      item->MarkFinished();
+    }
+    *did_run_ = true;
+  }
 
  private:
   bool* did_run_;
 };
 
+// A simple work item which sets |was_processed| to true, if non-null, when it
+// is processed.
 class SimpleItem : public ItemParallelJob::Item {
  public:
-  explicit SimpleItem(bool* was_processed)
+  explicit SimpleItem(bool* was_processed = nullptr)
       : ItemParallelJob::Item(), was_processed_(was_processed) {}
-  void Process() { *was_processed_ = true; }
+  void Process() {
+    if (was_processed_) *was_processed_ = true;
+  }
 
  private:
   bool* was_processed_;
@@ -57,6 +67,9 @@ class EagerTask : public ItemParallelJob::Task {
   }
 };
 
+// A OneShotBarrier is meant to be passed to |counter| users. Users should
+// either Signal() or Wait() when done (based on whether they want to return
+// immediately or wait until others are also done).
 class OneShotBarrier {
  public:
   explicit OneShotBarrier(size_t counter) : counter_(counter) {
@@ -77,28 +90,61 @@ class OneShotBarrier {
     mutex_.Unlock();
   }
 
+  void Signal() {
+    mutex_.Lock();
+    counter_--;
+    if (counter_ == 0) {
+      condition_.NotifyAll();
+    }
+    mutex_.Unlock();
+  }
+
  private:
   base::Mutex mutex_;
   base::ConditionVariable condition_;
   size_t counter_;
 };
 
+// A task that only processes a single item. Signals |barrier| when done; if
+// |wait_when_done|, will blocks until all other tasks have signaled |barrier|.
+// If |did_process_an_item| is non-null, will set it to true if it does process
+// an item. Otherwise, it will expect to get an item to process (and will report
+// a failure if it doesn't).
 class TaskProcessingOneItem : public ItemParallelJob::Task {
  public:
-  explicit TaskProcessingOneItem(Isolate* isolate, OneShotBarrier* barrier)
-      : ItemParallelJob::Task(isolate), barrier_(barrier) {}
+  TaskProcessingOneItem(Isolate* isolate, OneShotBarrier* barrier,
+                        bool wait_when_done,
+                        bool* did_process_an_item = nullptr)
+      : ItemParallelJob::Task(isolate),
+        barrier_(barrier),
+        wait_when_done_(wait_when_done),
+        did_process_an_item_(did_process_an_item) {}
 
   void RunInParallel() override {
     SimpleItem* item = GetItem<SimpleItem>();
-    EXPECT_NE(nullptr, item);
-    item->Process();
-    item->MarkFinished();
-    // Avoid canceling the remaining tasks with a simple barrier.
-    barrier_->Wait();
+
+    if (did_process_an_item_) {
+      *did_process_an_item_ = item != nullptr;
+    } else {
+      EXPECT_NE(nullptr, item);
+    }
+
+    if (item) {
+      item->Process();
+      item->MarkFinished();
+    }
+
+    if (wait_when_done_) {
+      barrier_->Wait();
+    } else {
+      barrier_->Signal();
+    }
   }
 
  private:
   OneShotBarrier* barrier_;
+  bool wait_when_done_;
+  bool* did_process_an_item_;
 };
 
 class TaskForDifferentItems;
@@ -148,47 +194,95 @@ class ItemB : public BaseItem {
 
 }  // namespace
 
-TEST_F(ItemParallelJobTest, EmptyTaskRuns) {
+// ItemParallelJob runs tasks even without work items (as requested tasks may be
+// responsible for post-processing).
+TEST_F(ItemParallelJobTest, SimpleTaskWithNoItemsRuns) {
   bool did_run = false;
   ItemParallelJob job(i_isolate()->cancelable_task_manager(),
                       parallel_job_semaphore());
-  job.AddTask(new EmptyTask(i_isolate(), &did_run));
-  job.Run();
+  job.AddTask(new SimpleTask(i_isolate(), &did_run));
+
+  job.Run(i_isolate()->async_counters());
   EXPECT_TRUE(did_run);
 }
 
-TEST_F(ItemParallelJobTest, FinishAllItems) {
-  const int kItems = 111;
-  bool was_processed[kItems];
-  for (int i = 0; i < kItems; i++) {
-    was_processed[i] = false;
+TEST_F(ItemParallelJobTest, SimpleTaskWithSimpleItemRuns) {
+  bool did_run = false;
+  ItemParallelJob job(i_isolate()->cancelable_task_manager(),
+                      parallel_job_semaphore());
+  job.AddTask(new SimpleTask(i_isolate(), &did_run));
+
+  job.AddItem(new ItemParallelJob::Item);
+
+  job.Run(i_isolate()->async_counters());
+  EXPECT_TRUE(did_run);
+}
+
+TEST_F(ItemParallelJobTest, MoreTasksThanItems) {
+  const int kNumTasks = 128;
+  const int kNumItems = kNumTasks - 4;
+
+  TaskProcessingOneItem* tasks[kNumTasks] = {};
+  bool did_process_an_item[kNumTasks] = {};
+
+  ItemParallelJob job(i_isolate()->cancelable_task_manager(),
+                      parallel_job_semaphore());
+
+  // The barrier ensures that all tasks run. But only the first kNumItems tasks
+  // should be assigned an item to execute.
+  OneShotBarrier barrier(kNumTasks);
+  for (int i = 0; i < kNumTasks; i++) {
+    // Block the main thread when done to prevent it from returning control to
+    // the job (which could cancel tasks that have yet to be scheduled).
+    const bool wait_when_done = i == 0;
+    tasks[i] = new TaskProcessingOneItem(i_isolate(), &barrier, wait_when_done,
+                                         &did_process_an_item[i]);
+    job.AddTask(tasks[i]);
+  }
+
+  for (int i = 0; i < kNumItems; i++) {
+    job.AddItem(new SimpleItem);
+  }
+
+  job.Run(i_isolate()->async_counters());
+
+  for (int i = 0; i < kNumTasks; i++) {
+    // Only the first kNumItems tasks should have been assigned a work item.
+    EXPECT_EQ(i < kNumItems, did_process_an_item[i]);
   }
+}
+
+TEST_F(ItemParallelJobTest, SingleThreadProcessing) {
+  const int kItems = 111;
+  bool was_processed[kItems] = {};
   ItemParallelJob job(i_isolate()->cancelable_task_manager(),
                       parallel_job_semaphore());
   job.AddTask(new EagerTask(i_isolate()));
   for (int i = 0; i < kItems; i++) {
     job.AddItem(new SimpleItem(&was_processed[i]));
   }
-  job.Run();
+  job.Run(i_isolate()->async_counters());
   for (int i = 0; i < kItems; i++) {
     EXPECT_TRUE(was_processed[i]);
   }
 }
 
 TEST_F(ItemParallelJobTest, DistributeItemsMultipleTasks) {
-  const int kItemsAndTasks = 2;  // Main thread + additional task.
-  bool was_processed[kItemsAndTasks];
+  const int kItemsAndTasks = 256;
+  bool was_processed[kItemsAndTasks] = {};
   OneShotBarrier barrier(kItemsAndTasks);
-  for (int i = 0; i < kItemsAndTasks; i++) {
-    was_processed[i] = false;
-  }
   ItemParallelJob job(i_isolate()->cancelable_task_manager(),
                       parallel_job_semaphore());
   for (int i = 0; i < kItemsAndTasks; i++) {
     job.AddItem(new SimpleItem(&was_processed[i]));
-    job.AddTask(new TaskProcessingOneItem(i_isolate(), &barrier));
+
+    // Block the main thread when done to prevent it from returning control to
+    // the job (which could cancel tasks that have yet to be scheduled).
+    const bool wait_when_done = i == 0;
+    job.AddTask(
+        new TaskProcessingOneItem(i_isolate(), &barrier, wait_when_done));
   }
-  job.Run();
+  job.Run(i_isolate()->async_counters());
   for (int i = 0; i < kItemsAndTasks; i++) {
     EXPECT_TRUE(was_processed[i]);
   }
@@ -202,7 +296,7 @@ TEST_F(ItemParallelJobTest, DifferentItems) {
   job.AddItem(new ItemA());
   job.AddItem(new ItemB());
   job.AddTask(new TaskForDifferentItems(i_isolate(), &item_a, &item_b));
-  job.Run();
+  job.Run(i_isolate()->async_counters());
   EXPECT_TRUE(item_a);
   EXPECT_TRUE(item_b);
 }
diff --git a/deps/v8/test/unittests/heap/object-stats-unittest.cc b/deps/v8/test/unittests/heap/object-stats-unittest.cc
new file mode 100644
index 00000000000..678fdd2a05e
--- /dev/null
+++ b/deps/v8/test/unittests/heap/object-stats-unittest.cc
@@ -0,0 +1,38 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <unordered_set>
+
+#include "src/heap/object-stats.h"
+#include "src/objects-inl.h"
+#include "src/objects/fixed-array-inl.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace v8 {
+namespace internal {
+namespace heap {
+
+namespace {
+
+template <typename T>
+bool Contains(const std::unordered_set<T>& set, T needle) {
+  return set.find(needle) != set.end();
+}
+
+}  // namespace
+
+TEST(ObjectStats, NoClashWithInstanceTypes) {
+  std::unordered_set<const char*> virtual_types;
+#define ADD_VIRTUAL_INSTANCE_TYPE(type) virtual_types.insert(#type);
+  VIRTUAL_INSTANCE_TYPE_LIST(ADD_VIRTUAL_INSTANCE_TYPE)
+#undef ADD_VIRTUAL_INSTANCE_TYPE
+#define CHECK_REGULARINSTANCE_TYPE(type) \
+  EXPECT_FALSE(Contains(virtual_types, #type));
+  INSTANCE_TYPE_LIST(CHECK_REGULARINSTANCE_TYPE)
+#undef CHECK_REGULARINSTANCE_TYPE
+}
+
+}  // namespace heap
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/unittests/heap/scavenge-job-unittest.cc b/deps/v8/test/unittests/heap/scavenge-job-unittest.cc
index 91abbb1f8fb..43386ac385e 100644
--- a/deps/v8/test/unittests/heap/scavenge-job-unittest.cc
+++ b/deps/v8/test/unittests/heap/scavenge-job-unittest.cc
@@ -6,6 +6,7 @@
 
 #include "src/globals.h"
 #include "src/heap/scavenge-job.h"
+#include "src/utils.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace v8 {
@@ -31,6 +32,8 @@ TEST(ScavengeJob, AllocationLimitUnknownScavengeSpeed) {
   size_t expected_size = ScavengeJob::kInitialScavengeSpeedInBytesPerMs *
                              ScavengeJob::kAverageIdleTimeMs -
                          ScavengeJob::kBytesAllocatedBeforeNextIdleTask;
+  expected_size = Max(expected_size, ScavengeJob::kMinAllocationLimit);
+
   EXPECT_FALSE(ScavengeJob::ReachedIdleAllocationLimit(0, expected_size - 1,
                                                        kNewSpaceCapacity));
   EXPECT_TRUE(ScavengeJob::ReachedIdleAllocationLimit(0, expected_size,
diff --git a/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc b/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc
index 26fcd1937b3..e6348f47855 100644
--- a/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc
+++ b/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc
@@ -104,6 +104,8 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
   FeedbackSlot strict_keyed_store_slot =
       feedback_spec.AddKeyedStoreICSlot(LanguageMode::kStrict);
   FeedbackSlot store_own_slot = feedback_spec.AddStoreOwnICSlot();
+  FeedbackSlot store_array_element_slot =
+      feedback_spec.AddStoreInArrayLiteralICSlot();
 
   // Emit global load / store operations.
   const AstRawString* name = ast_factory.GetOneByteString("var_name");
@@ -141,7 +143,8 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
                           LanguageMode::kStrict)
       .StoreKeyedProperty(reg, reg, strict_keyed_store_slot.ToInt(),
                           LanguageMode::kStrict)
-      .StoreNamedOwnProperty(reg, name, store_own_slot.ToInt());
+      .StoreNamedOwnProperty(reg, name, store_own_slot.ToInt())
+      .StoreInArrayLiteral(reg, reg, store_array_element_slot.ToInt());
 
   // Emit load / store lookup slots.
   builder.LoadLookupSlot(name, TypeofMode::NOT_INSIDE_TYPEOF)
@@ -176,7 +179,7 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
   builder.CreateObjectLiteral(0, 0, 0, reg);
 
   // Emit tagged template operations.
-  builder.GetTemplateObject(0);
+  builder.GetTemplateObject(0, 0);
 
   // Call operations.
   builder.CallAnyReceiver(reg, reg_list, 1)
@@ -190,7 +193,7 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
       .CallUndefinedReceiver(reg, pair, 1)
       .CallRuntime(Runtime::kIsArray, reg)
       .CallRuntimeForPair(Runtime::kLoadLookupSlotForCall, reg_list, pair)
-      .CallJSRuntime(Context::SPREAD_ITERABLE_INDEX, reg_list)
+      .CallJSRuntime(Context::OBJECT_IS_FROZEN, reg_list)
       .CallWithSpread(reg, reg_list, 1);
 
   // Emit binary operator invocations.
@@ -259,7 +262,7 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
       .CompareNull();
 
   // Emit conversion operator invocations.
-  builder.ToNumber(1).ToNumeric(1).ToObject(reg).ToName(reg);
+  builder.ToNumber(1).ToNumeric(1).ToObject(reg).ToName(reg).ToString();
 
   // Emit GetSuperConstructor.
   builder.GetSuperConstructor(reg);
@@ -384,9 +387,17 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
       .StoreModuleVariable(1, 42);
 
   // Emit generator operations.
-  builder.SuspendGenerator(reg, reg_list, 0)
-      .RestoreGeneratorState(reg)
-      .ResumeGenerator(reg, reg, reg_list);
+  {
+    // We have to skip over suspend because it returns and marks the remaining
+    // bytecode dead.
+    BytecodeLabel after_suspend;
+    builder.JumpIfTrue(ToBooleanMode::kAlreadyBoolean, &after_suspend)
+        .SuspendGenerator(reg, reg_list, 0)
+        .Bind(&after_suspend)
+        .ResumeGenerator(reg, reg_list);
+  }
+  BytecodeJumpTable* gen_jump_table = builder.AllocateJumpTable(1, 0);
+  builder.SwitchOnGeneratorState(reg, gen_jump_table).Bind(gen_jump_table, 0);
 
   // Intrinsics handled by the interpreter.
   builder.CallRuntime(Runtime::kInlineIsArray, reg_list);
@@ -438,6 +449,7 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
       operand_scale = Bytecodes::PrefixBytecodeToOperandScale(final_bytecode);
       prefix_offset = 1;
       code = the_array->get(i + 1);
+      scorecard[code] += 1;
       final_bytecode = Bytecodes::FromByte(code);
     }
     i += prefix_offset + Bytecodes::Size(final_bytecode, operand_scale);
@@ -457,7 +469,7 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
 #define CHECK_BYTECODE_PRESENT(Name, ...)                                \
   /* Check Bytecode is marked in scorecard, unless it's a debug break */ \
   if (!Bytecodes::IsDebugBreak(Bytecode::k##Name)) {                     \
-    CHECK_GE(scorecard[Bytecodes::ToByte(Bytecode::k##Name)], 1);        \
+    EXPECT_GE(scorecard[Bytecodes::ToByte(Bytecode::k##Name)], 1);       \
   }
   BYTECODE_LIST(CHECK_BYTECODE_PRESENT)
 #undef CHECK_BYTECODE_PRESENT
diff --git a/deps/v8/test/unittests/interpreter/bytecode-array-writer-unittest.cc b/deps/v8/test/unittests/interpreter/bytecode-array-writer-unittest.cc
index e4a956a0ce0..9f8f2db9534 100644
--- a/deps/v8/test/unittests/interpreter/bytecode-array-writer-unittest.cc
+++ b/deps/v8/test/unittests/interpreter/bytecode-array-writer-unittest.cc
@@ -143,8 +143,8 @@ TEST_F(BytecodeArrayWriterUnittest, SimpleExample) {
     CHECK_EQ(bytecodes()->at(i), expected_bytes[i]);
   }
 
-  Handle<BytecodeArray> bytecode_array = writer()->ToBytecodeArray(
-      isolate(), 0, 0, factory()->empty_fixed_array());
+  Handle<BytecodeArray> bytecode_array =
+      writer()->ToBytecodeArray(isolate(), 0, 0, factory()->empty_byte_array());
   CHECK_EQ(bytecodes()->size(), arraysize(expected_bytes));
 
   PositionTableEntry expected_positions[] = {
@@ -232,8 +232,8 @@ TEST_F(BytecodeArrayWriterUnittest, ComplexExample) {
              static_cast<int>(expected_bytes[i]));
   }
 
-  Handle<BytecodeArray> bytecode_array = writer()->ToBytecodeArray(
-      isolate(), 0, 0, factory()->empty_fixed_array());
+  Handle<BytecodeArray> bytecode_array =
+      writer()->ToBytecodeArray(isolate(), 0, 0, factory()->empty_byte_array());
   SourcePositionTableIterator source_iterator(
       bytecode_array->SourcePositionTable());
   for (size_t i = 0; i < arraysize(expected_positions); ++i) {
@@ -284,8 +284,8 @@ TEST_F(BytecodeArrayWriterUnittest, ElideNoneffectfulBytecodes) {
              static_cast<int>(expected_bytes[i]));
   }
 
-  Handle<BytecodeArray> bytecode_array = writer()->ToBytecodeArray(
-      isolate(), 0, 0, factory()->empty_fixed_array());
+  Handle<BytecodeArray> bytecode_array =
+      writer()->ToBytecodeArray(isolate(), 0, 0, factory()->empty_byte_array());
   SourcePositionTableIterator source_iterator(
       bytecode_array->SourcePositionTable());
   for (size_t i = 0; i < arraysize(expected_positions); ++i) {
@@ -350,8 +350,8 @@ TEST_F(BytecodeArrayWriterUnittest, DeadcodeElimination) {
              static_cast<int>(expected_bytes[i]));
   }
 
-  Handle<BytecodeArray> bytecode_array = writer()->ToBytecodeArray(
-      isolate(), 0, 0, factory()->empty_fixed_array());
+  Handle<BytecodeArray> bytecode_array =
+      writer()->ToBytecodeArray(isolate(), 0, 0, factory()->empty_byte_array());
   SourcePositionTableIterator source_iterator(
       bytecode_array->SourcePositionTable());
   for (size_t i = 0; i < arraysize(expected_positions); ++i) {
diff --git a/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.cc b/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.cc
index 03d9397c7fc..74afa845fbe 100644
--- a/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.cc
+++ b/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.cc
@@ -28,7 +28,7 @@ InterpreterAssemblerTestState::InterpreterAssemblerTestState(
           test->isolate(), test->zone(),
           InterpreterDispatchDescriptor(test->isolate()),
           Code::BYTECODE_HANDLER, Bytecodes::ToString(bytecode),
-          Bytecodes::ReturnCount(bytecode)) {}
+          PoisoningMitigationLevel::kOn, Bytecodes::ReturnCount(bytecode)) {}
 
 const interpreter::Bytecode kBytecodes[] = {
 #define DEFINE_BYTECODE(Name, ...) interpreter::Bytecode::k##Name,
@@ -51,7 +51,13 @@ InterpreterAssemblerTest::InterpreterAssemblerForTest::
 
 Matcher<Node*> InterpreterAssemblerTest::InterpreterAssemblerForTest::IsLoad(
     const Matcher<c::LoadRepresentation>& rep_matcher,
-    const Matcher<Node*>& base_matcher, const Matcher<Node*>& index_matcher) {
+    const Matcher<Node*>& base_matcher, const Matcher<Node*>& index_matcher,
+    LoadSensitivity needs_poisoning) {
+  if (poisoning_enabled() == PoisoningMitigationLevel::kOn &&
+      needs_poisoning == LoadSensitivity::kNeedsPoisoning) {
+    return ::i::compiler::IsPoisonedLoad(rep_matcher, base_matcher,
+                                         index_matcher, _, _);
+  }
   return ::i::compiler::IsLoad(rep_matcher, base_matcher, index_matcher, _, _);
 }
 
@@ -63,38 +69,47 @@ Matcher<Node*> InterpreterAssemblerTest::InterpreterAssemblerForTest::IsStore(
                                 value_matcher, _, _);
 }
 
+Matcher<Node*> InterpreterAssemblerTest::InterpreterAssemblerForTest::IsWordNot(
+    const Matcher<Node*>& value_matcher) {
+  return kPointerSize == 8 ? IsWord64Xor(value_matcher, c::IsInt64Constant(-1))
+                           : IsWord32Xor(value_matcher, c::IsInt32Constant(-1));
+}
+
 Matcher<Node*>
 InterpreterAssemblerTest::InterpreterAssemblerForTest::IsUnsignedByteOperand(
-    int offset) {
+    int offset, LoadSensitivity needs_poisoning) {
   return IsLoad(
       MachineType::Uint8(),
       c::IsParameter(InterpreterDispatchDescriptor::kBytecodeArray),
       c::IsIntPtrAdd(
           c::IsParameter(InterpreterDispatchDescriptor::kBytecodeOffset),
-          c::IsIntPtrConstant(offset)));
+          c::IsIntPtrConstant(offset)),
+      needs_poisoning);
 }
 
 Matcher<Node*>
 InterpreterAssemblerTest::InterpreterAssemblerForTest::IsSignedByteOperand(
-    int offset) {
+    int offset, LoadSensitivity needs_poisoning) {
   return IsLoad(
       MachineType::Int8(),
       c::IsParameter(InterpreterDispatchDescriptor::kBytecodeArray),
       c::IsIntPtrAdd(
           c::IsParameter(InterpreterDispatchDescriptor::kBytecodeOffset),
-          c::IsIntPtrConstant(offset)));
+          c::IsIntPtrConstant(offset)),
+      needs_poisoning);
 }
 
 Matcher<Node*>
 InterpreterAssemblerTest::InterpreterAssemblerForTest::IsUnsignedShortOperand(
-    int offset) {
+    int offset, LoadSensitivity needs_poisoning) {
   if (TargetSupportsUnalignedAccess()) {
     return IsLoad(
         MachineType::Uint16(),
         c::IsParameter(InterpreterDispatchDescriptor::kBytecodeArray),
         c::IsIntPtrAdd(
             c::IsParameter(InterpreterDispatchDescriptor::kBytecodeOffset),
-            c::IsIntPtrConstant(offset)));
+            c::IsIntPtrConstant(offset)),
+        needs_poisoning);
   } else {
 #if V8_TARGET_LITTLE_ENDIAN
     const int kStep = -1;
@@ -121,14 +136,15 @@ InterpreterAssemblerTest::InterpreterAssemblerForTest::IsUnsignedShortOperand(
 
 Matcher<Node*>
 InterpreterAssemblerTest::InterpreterAssemblerForTest::IsSignedShortOperand(
-    int offset) {
+    int offset, LoadSensitivity needs_poisoning) {
   if (TargetSupportsUnalignedAccess()) {
     return IsLoad(
         MachineType::Int16(),
         c::IsParameter(InterpreterDispatchDescriptor::kBytecodeArray),
         c::IsIntPtrAdd(
             c::IsParameter(InterpreterDispatchDescriptor::kBytecodeOffset),
-            c::IsIntPtrConstant(offset)));
+            c::IsIntPtrConstant(offset)),
+        needs_poisoning);
   } else {
 #if V8_TARGET_LITTLE_ENDIAN
     const int kStep = -1;
@@ -146,7 +162,8 @@ InterpreterAssemblerTest::InterpreterAssemblerForTest::IsSignedShortOperand(
           c::IsParameter(InterpreterDispatchDescriptor::kBytecodeArray),
           c::IsIntPtrAdd(
               c::IsParameter(InterpreterDispatchDescriptor::kBytecodeOffset),
-              c::IsIntPtrConstant(offset + kMsbOffset + kStep * i)));
+              c::IsIntPtrConstant(offset + kMsbOffset + kStep * i)),
+          needs_poisoning);
     }
     return c::IsWord32Or(
         c::IsWord32Shl(bytes[0], c::IsInt32Constant(kBitsPerByte)), bytes[1]);
@@ -155,14 +172,15 @@ InterpreterAssemblerTest::InterpreterAssemblerForTest::IsSignedShortOperand(
 
 Matcher<Node*>
 InterpreterAssemblerTest::InterpreterAssemblerForTest::IsUnsignedQuadOperand(
-    int offset) {
+    int offset, LoadSensitivity needs_poisoning) {
   if (TargetSupportsUnalignedAccess()) {
     return IsLoad(
         MachineType::Uint32(),
         c::IsParameter(InterpreterDispatchDescriptor::kBytecodeArray),
         c::IsIntPtrAdd(
             c::IsParameter(InterpreterDispatchDescriptor::kBytecodeOffset),
-            c::IsIntPtrConstant(offset)));
+            c::IsIntPtrConstant(offset)),
+        needs_poisoning);
   } else {
 #if V8_TARGET_LITTLE_ENDIAN
     const int kStep = -1;
@@ -180,7 +198,8 @@ InterpreterAssemblerTest::InterpreterAssemblerForTest::IsUnsignedQuadOperand(
           c::IsParameter(InterpreterDispatchDescriptor::kBytecodeArray),
           c::IsIntPtrAdd(
               c::IsParameter(InterpreterDispatchDescriptor::kBytecodeOffset),
-              c::IsIntPtrConstant(offset + kMsbOffset + kStep * i)));
+              c::IsIntPtrConstant(offset + kMsbOffset + kStep * i)),
+          needs_poisoning);
     }
     return c::IsWord32Or(
         c::IsWord32Shl(bytes[0], c::IsInt32Constant(3 * kBitsPerByte)),
@@ -194,14 +213,15 @@ InterpreterAssemblerTest::InterpreterAssemblerForTest::IsUnsignedQuadOperand(
 
 Matcher<Node*>
 InterpreterAssemblerTest::InterpreterAssemblerForTest::IsSignedQuadOperand(
-    int offset) {
+    int offset, LoadSensitivity needs_poisoning) {
   if (TargetSupportsUnalignedAccess()) {
     return IsLoad(
         MachineType::Int32(),
         c::IsParameter(InterpreterDispatchDescriptor::kBytecodeArray),
         c::IsIntPtrAdd(
             c::IsParameter(InterpreterDispatchDescriptor::kBytecodeOffset),
-            c::IsIntPtrConstant(offset)));
+            c::IsIntPtrConstant(offset)),
+        needs_poisoning);
   } else {
 #if V8_TARGET_LITTLE_ENDIAN
     const int kStep = -1;
@@ -219,7 +239,8 @@ InterpreterAssemblerTest::InterpreterAssemblerForTest::IsSignedQuadOperand(
           c::IsParameter(InterpreterDispatchDescriptor::kBytecodeArray),
           c::IsIntPtrAdd(
               c::IsParameter(InterpreterDispatchDescriptor::kBytecodeOffset),
-              c::IsIntPtrConstant(offset + kMsbOffset + kStep * i)));
+              c::IsIntPtrConstant(offset + kMsbOffset + kStep * i)),
+          needs_poisoning);
     }
     return c::IsWord32Or(
         c::IsWord32Shl(bytes[0], c::IsInt32Constant(3 * kBitsPerByte)),
@@ -233,14 +254,14 @@ InterpreterAssemblerTest::InterpreterAssemblerForTest::IsSignedQuadOperand(
 
 Matcher<Node*>
 InterpreterAssemblerTest::InterpreterAssemblerForTest::IsSignedOperand(
-    int offset, OperandSize operand_size) {
+    int offset, OperandSize operand_size, LoadSensitivity needs_poisoning) {
   switch (operand_size) {
     case OperandSize::kByte:
-      return IsSignedByteOperand(offset);
+      return IsSignedByteOperand(offset, needs_poisoning);
     case OperandSize::kShort:
-      return IsSignedShortOperand(offset);
+      return IsSignedShortOperand(offset, needs_poisoning);
     case OperandSize::kQuad:
-      return IsSignedQuadOperand(offset);
+      return IsSignedQuadOperand(offset, needs_poisoning);
     case OperandSize::kNone:
       UNREACHABLE();
   }
@@ -249,20 +270,31 @@ InterpreterAssemblerTest::InterpreterAssemblerForTest::IsSignedOperand(
 
 Matcher<Node*>
 InterpreterAssemblerTest::InterpreterAssemblerForTest::IsUnsignedOperand(
-    int offset, OperandSize operand_size) {
+    int offset, OperandSize operand_size, LoadSensitivity needs_poisoning) {
   switch (operand_size) {
     case OperandSize::kByte:
-      return IsUnsignedByteOperand(offset);
+      return IsUnsignedByteOperand(offset, needs_poisoning);
     case OperandSize::kShort:
-      return IsUnsignedShortOperand(offset);
+      return IsUnsignedShortOperand(offset, needs_poisoning);
     case OperandSize::kQuad:
-      return IsUnsignedQuadOperand(offset);
+      return IsUnsignedQuadOperand(offset, needs_poisoning);
     case OperandSize::kNone:
       UNREACHABLE();
   }
   return nullptr;
 }
 
+Matcher<compiler::Node*>
+InterpreterAssemblerTest::InterpreterAssemblerForTest::IsLoadRegisterOperand(
+    int offset, OperandSize operand_size) {
+  Matcher<compiler::Node*> reg_operand = IsChangeInt32ToIntPtr(
+      IsSignedOperand(offset, operand_size, LoadSensitivity::kSafe));
+  return IsLoad(
+      MachineType::AnyTagged(), c::IsLoadParentFramePointer(),
+      c::IsWordShl(reg_operand, c::IsIntPtrConstant(kPointerSizeLog2)),
+      LoadSensitivity::kNeedsPoisoning);
+}
+
 TARGET_TEST_F(InterpreterAssemblerTest, Jump) {
   // If debug code is enabled we emit extra code in Jump.
   if (FLAG_debug_code) return;
@@ -320,49 +352,56 @@ TARGET_TEST_F(InterpreterAssemblerTest, BytecodeOperand) {
         switch (interpreter::Bytecodes::GetOperandType(bytecode, i)) {
           case interpreter::OperandType::kRegCount:
             EXPECT_THAT(m.BytecodeOperandCount(i),
-                        m.IsUnsignedOperand(offset, operand_size));
+                        m.IsUnsignedOperand(offset, operand_size,
+                                            LoadSensitivity::kNeedsPoisoning));
             break;
           case interpreter::OperandType::kFlag8:
             EXPECT_THAT(m.BytecodeOperandFlag(i),
-                        m.IsUnsignedOperand(offset, operand_size));
+                        m.IsUnsignedOperand(offset, operand_size,
+                                            LoadSensitivity::kNeedsPoisoning));
             break;
           case interpreter::OperandType::kIdx:
-            EXPECT_THAT(m.BytecodeOperandIdx(i),
-                        c::IsChangeUint32ToWord(
-                            m.IsUnsignedOperand(offset, operand_size)));
+            EXPECT_THAT(
+                m.BytecodeOperandIdx(i),
+                c::IsChangeUint32ToWord(m.IsUnsignedOperand(
+                    offset, operand_size, LoadSensitivity::kNeedsPoisoning)));
             break;
           case interpreter::OperandType::kNativeContextIndex:
-            EXPECT_THAT(m.BytecodeOperandNativeContextIndex(i),
-                        c::IsChangeUint32ToWord(
-                            m.IsUnsignedOperand(offset, operand_size)));
+            EXPECT_THAT(
+                m.BytecodeOperandNativeContextIndex(i),
+                c::IsChangeUint32ToWord(m.IsUnsignedOperand(
+                    offset, operand_size, LoadSensitivity::kNeedsPoisoning)));
             break;
           case interpreter::OperandType::kUImm:
             EXPECT_THAT(m.BytecodeOperandUImm(i),
-                        m.IsUnsignedOperand(offset, operand_size));
+                        m.IsUnsignedOperand(offset, operand_size,
+                                            LoadSensitivity::kNeedsPoisoning));
             break;
           case interpreter::OperandType::kImm: {
             EXPECT_THAT(m.BytecodeOperandImm(i),
-                        m.IsSignedOperand(offset, operand_size));
+                        m.IsSignedOperand(offset, operand_size,
+                                          LoadSensitivity::kNeedsPoisoning));
             break;
           }
+          case interpreter::OperandType::kRuntimeId:
+            EXPECT_THAT(m.BytecodeOperandRuntimeId(i),
+                        m.IsUnsignedOperand(offset, operand_size,
+                                            LoadSensitivity::kNeedsPoisoning));
+            break;
+          case interpreter::OperandType::kIntrinsicId:
+            EXPECT_THAT(m.BytecodeOperandIntrinsicId(i),
+                        m.IsUnsignedOperand(offset, operand_size,
+                                            LoadSensitivity::kNeedsPoisoning));
+            break;
           case interpreter::OperandType::kRegList:
           case interpreter::OperandType::kReg:
+          case interpreter::OperandType::kRegPair:
           case interpreter::OperandType::kRegOut:
           case interpreter::OperandType::kRegOutList:
           case interpreter::OperandType::kRegOutPair:
           case interpreter::OperandType::kRegOutTriple:
-          case interpreter::OperandType::kRegPair:
-            EXPECT_THAT(m.BytecodeOperandReg(i),
-                        c::IsChangeInt32ToIntPtr(
-                            m.IsSignedOperand(offset, operand_size)));
-            break;
-          case interpreter::OperandType::kRuntimeId:
-            EXPECT_THAT(m.BytecodeOperandRuntimeId(i),
-                        m.IsUnsignedOperand(offset, operand_size));
-            break;
-          case interpreter::OperandType::kIntrinsicId:
-            EXPECT_THAT(m.BytecodeOperandIntrinsicId(i),
-                        m.IsUnsignedOperand(offset, operand_size));
+            EXPECT_THAT(m.LoadRegisterAtOperandIndex(i),
+                        m.IsLoadRegisterOperand(offset, operand_size));
             break;
           case interpreter::OperandType::kNone:
             UNREACHABLE();
@@ -385,51 +424,6 @@ TARGET_TEST_F(InterpreterAssemblerTest, GetContext) {
   }
 }
 
-TARGET_TEST_F(InterpreterAssemblerTest, RegisterLocation) {
-  TRACED_FOREACH(interpreter::Bytecode, bytecode, kBytecodes) {
-    InterpreterAssemblerTestState state(this, bytecode);
-    InterpreterAssemblerForTest m(&state, bytecode);
-    Node* reg_index_node = m.Parameter(0);
-    Node* reg_location_node = m.RegisterLocation(reg_index_node);
-    EXPECT_THAT(
-        reg_location_node,
-        c::IsIntPtrAdd(c::IsLoadParentFramePointer(),
-                       c::IsWordShl(reg_index_node,
-                                    c::IsIntPtrConstant(kPointerSizeLog2))));
-  }
-}
-
-TARGET_TEST_F(InterpreterAssemblerTest, LoadRegister) {
-  TRACED_FOREACH(interpreter::Bytecode, bytecode, kBytecodes) {
-    InterpreterAssemblerTestState state(this, bytecode);
-    InterpreterAssemblerForTest m(&state, bytecode);
-    Node* reg_index_node = m.Parameter(0);
-    Node* load_reg_node = m.LoadRegister(reg_index_node);
-    EXPECT_THAT(
-        load_reg_node,
-        m.IsLoad(MachineType::AnyTagged(), c::IsLoadParentFramePointer(),
-                 c::IsWordShl(reg_index_node,
-                              c::IsIntPtrConstant(kPointerSizeLog2))));
-  }
-}
-
-TARGET_TEST_F(InterpreterAssemblerTest, StoreRegister) {
-  TRACED_FOREACH(interpreter::Bytecode, bytecode, kBytecodes) {
-    InterpreterAssemblerTestState state(this, bytecode);
-    InterpreterAssemblerForTest m(&state, bytecode);
-    Node* store_value = m.Int32Constant(0xDEADBEEF);
-    Node* reg_index_node = m.Parameter(0);
-    Node* store_reg_node = m.StoreRegister(store_value, reg_index_node);
-    EXPECT_THAT(store_reg_node,
-                m.IsStore(c::StoreRepresentation(MachineRepresentation::kTagged,
-                                                 kNoWriteBarrier),
-                          c::IsLoadParentFramePointer(),
-                          c::IsWordShl(reg_index_node,
-                                       c::IsIntPtrConstant(kPointerSizeLog2)),
-                          store_value));
-  }
-}
-
 TARGET_TEST_F(InterpreterAssemblerTest, LoadConstantPoolEntry) {
   TRACED_FOREACH(interpreter::Bytecode, bytecode, kBytecodes) {
     InterpreterAssemblerTestState state(this, bytecode);
@@ -446,7 +440,8 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadConstantPoolEntry) {
           load_constant,
           m.IsLoad(MachineType::AnyTagged(), constant_pool_matcher,
                    c::IsIntPtrConstant(FixedArray::OffsetOfElementAt(2) -
-                                       kHeapObjectTag)));
+                                       kHeapObjectTag),
+                   LoadSensitivity::kNeedsPoisoning));
     }
     {
       Node* index = m.Parameter(2);
@@ -462,7 +457,8 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadConstantPoolEntry) {
               MachineType::AnyTagged(), constant_pool_matcher,
               c::IsIntPtrAdd(
                   c::IsIntPtrConstant(FixedArray::kHeaderSize - kHeapObjectTag),
-                  c::IsWordShl(index, c::IsIntPtrConstant(kPointerSizeLog2)))));
+                  c::IsWordShl(index, c::IsIntPtrConstant(kPointerSizeLog2))),
+              LoadSensitivity::kNeedsPoisoning));
     }
   }
 }
@@ -504,12 +500,13 @@ TARGET_TEST_F(InterpreterAssemblerTest, CallRuntime) {
             CodeFactory::InterpreterCEntry(isolate(), result_size);
 
         Node* function_id = m.Int32Constant(0);
-        Node* first_arg = m.IntPtrConstant(1);
-        Node* arg_count = m.Int32Constant(2);
+        InterpreterAssembler::RegListNodePair registers(m.IntPtrConstant(1),
+                                                        m.Int32Constant(2));
         Node* context = m.IntPtrConstant(4);
 
         Matcher<Node*> function_table = c::IsExternalConstant(
-            ExternalReference::runtime_function_table_address(isolate()));
+            ExternalReference::runtime_function_table_address_for_unittests(
+                isolate()));
         Matcher<Node*> function = c::IsIntPtrAdd(
             function_table,
             c::IsChangeUint32ToWord(c::IsInt32Mul(
@@ -518,11 +515,13 @@ TARGET_TEST_F(InterpreterAssemblerTest, CallRuntime) {
             m.IsLoad(MachineType::Pointer(), function,
                      c::IsIntPtrConstant(offsetof(Runtime::Function, entry)));
 
-        Node* call_runtime = m.CallRuntimeN(function_id, context, first_arg,
-                                            arg_count, result_size);
-        EXPECT_THAT(call_runtime,
-                    c::IsCall(_, c::IsHeapConstant(builtin.code()), arg_count,
-                              first_arg, function_entry, context, _, _));
+        Node* call_runtime =
+            m.CallRuntimeN(function_id, context, registers, result_size);
+        EXPECT_THAT(
+            call_runtime,
+            c::IsCall(_, c::IsHeapConstant(builtin.code()),
+                      registers.reg_count(), registers.base_reg_location(),
+                      function_entry, context, _, _));
       }
     }
   }
@@ -538,10 +537,9 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadFeedbackVector) {
         m.IsLoad(MachineType::AnyTagged(), c::IsLoadParentFramePointer(),
                  c::IsIntPtrConstant(Register::function_closure().ToOperand()
                                      << kPointerSizeLog2));
-    Matcher<Node*> load_vector_cell_matcher =
-        m.IsLoad(MachineType::AnyTagged(), load_function_matcher,
-                 c::IsIntPtrConstant(JSFunction::kFeedbackVectorOffset -
-                                     kHeapObjectTag));
+    Matcher<Node*> load_vector_cell_matcher = m.IsLoad(
+        MachineType::AnyTagged(), load_function_matcher,
+        c::IsIntPtrConstant(JSFunction::kFeedbackCellOffset - kHeapObjectTag));
     EXPECT_THAT(
         feedback_vector,
         m.IsLoad(MachineType::AnyTagged(), load_vector_cell_matcher,
diff --git a/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.h b/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.h
index 589d0c8df59..669db930403 100644
--- a/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.h
+++ b/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.h
@@ -42,24 +42,43 @@ class InterpreterAssemblerTest : public TestWithIsolateAndZone {
     Matcher<compiler::Node*> IsLoad(
         const Matcher<compiler::LoadRepresentation>& rep_matcher,
         const Matcher<compiler::Node*>& base_matcher,
-        const Matcher<compiler::Node*>& index_matcher);
+        const Matcher<compiler::Node*>& index_matcher,
+        LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);
     Matcher<compiler::Node*> IsStore(
         const Matcher<compiler::StoreRepresentation>& rep_matcher,
         const Matcher<compiler::Node*>& base_matcher,
         const Matcher<compiler::Node*>& index_matcher,
         const Matcher<compiler::Node*>& value_matcher);
 
-    Matcher<compiler::Node*> IsUnsignedByteOperand(int offset);
-    Matcher<compiler::Node*> IsSignedByteOperand(int offset);
-    Matcher<compiler::Node*> IsUnsignedShortOperand(int offset);
-    Matcher<compiler::Node*> IsSignedShortOperand(int offset);
-    Matcher<compiler::Node*> IsUnsignedQuadOperand(int offset);
-    Matcher<compiler::Node*> IsSignedQuadOperand(int offset);
+    Matcher<Node*> IsWordNot(const Matcher<Node*>& value_matcher);
+
+    Matcher<compiler::Node*> IsUnsignedByteOperand(
+        int offset, LoadSensitivity needs_poisoning);
+    Matcher<compiler::Node*> IsSignedByteOperand(
+        int offset, LoadSensitivity needs_poisoning);
+    Matcher<compiler::Node*> IsUnsignedShortOperand(
+        int offset, LoadSensitivity needs_poisoning);
+    Matcher<compiler::Node*> IsSignedShortOperand(
+        int offset, LoadSensitivity needs_poisoning);
+    Matcher<compiler::Node*> IsUnsignedQuadOperand(
+        int offset, LoadSensitivity needs_poisoning);
+    Matcher<compiler::Node*> IsSignedQuadOperand(
+        int offset, LoadSensitivity needs_poisoning);
+
+    Matcher<compiler::Node*> IsUnpoisonedSignedOperand(
+        int offset, OperandSize operand_size, LoadSensitivity needs_poisoning);
+    Matcher<compiler::Node*> IsUnpoisonedUnsignedOperand(
+        int offset, OperandSize operand_size, LoadSensitivity needs_poisoning);
 
     Matcher<compiler::Node*> IsSignedOperand(int offset,
-                                             OperandSize operand_size);
+                                             OperandSize operand_size,
+                                             LoadSensitivity needs_poisoning);
     Matcher<compiler::Node*> IsUnsignedOperand(int offset,
-                                               OperandSize operand_size);
+                                               OperandSize operand_size,
+                                               LoadSensitivity needs_poisoning);
+
+    Matcher<compiler::Node*> IsLoadRegisterOperand(int offset,
+                                                   OperandSize operand_size);
 
    private:
     DISALLOW_COPY_AND_ASSIGN(InterpreterAssemblerForTest);
diff --git a/deps/v8/test/unittests/libplatform/default-platform-unittest.cc b/deps/v8/test/unittests/libplatform/default-platform-unittest.cc
index 17f1a34ba41..6417e56482e 100644
--- a/deps/v8/test/unittests/libplatform/default-platform-unittest.cc
+++ b/deps/v8/test/unittests/libplatform/default-platform-unittest.cc
@@ -264,7 +264,7 @@ TEST(DefaultPlatformTest, RunBackgroundTask) {
   DefaultPlatform platform;
   platform.SetThreadPoolSize(1);
   std::shared_ptr<TaskRunner> taskrunner =
-      platform.GetBackgroundTaskRunner(isolate);
+      platform.GetWorkerThreadsTaskRunner(isolate);
 
   base::Semaphore sem(0);
   bool task_executed = false;
@@ -282,7 +282,7 @@ TEST(DefaultPlatformTest, NoIdleTasksInBackground) {
   DefaultPlatform platform;
   platform.SetThreadPoolSize(1);
   std::shared_ptr<TaskRunner> taskrunner =
-      platform.GetBackgroundTaskRunner(isolate);
+      platform.GetWorkerThreadsTaskRunner(isolate);
   EXPECT_FALSE(taskrunner->IdleTasksEnabled());
 }
 
@@ -296,7 +296,7 @@ TEST(DefaultPlatformTest, PostTaskAfterPlatformTermination) {
     DefaultPlatformWithMockTime platform;
     platform.SetThreadPoolSize(1);
     foreground_taskrunner = platform.GetForegroundTaskRunner(isolate);
-    background_taskrunner = platform.GetBackgroundTaskRunner(isolate);
+    background_taskrunner = platform.GetWorkerThreadsTaskRunner(isolate);
   }
   // It should still be possible to post tasks, even when the platform does not
   // exist anymore.
diff --git a/deps/v8/test/unittests/object-unittest.cc b/deps/v8/test/unittests/object-unittest.cc
index 4cb113a6448..c88e04a89b5 100644
--- a/deps/v8/test/unittests/object-unittest.cc
+++ b/deps/v8/test/unittests/object-unittest.cc
@@ -19,10 +19,11 @@ namespace {
 
 bool IsInStringInstanceTypeList(InstanceType instance_type) {
   switch (instance_type) {
-#define TEST_INSTANCE_TYPE(type, ...) \
-  case InstanceType::type:            \
-    STATIC_ASSERT(InstanceType::type < InstanceType::FIRST_NONSTRING_TYPE);
-
+#define ASSERT_INSTANCE_TYPE(type, ...) \
+  STATIC_ASSERT(InstanceType::type < InstanceType::FIRST_NONSTRING_TYPE);
+    STRING_TYPE_LIST(ASSERT_INSTANCE_TYPE)
+#undef ASSERT_INSTANCE_TYPE
+#define TEST_INSTANCE_TYPE(type, ...) case InstanceType::type:
     STRING_TYPE_LIST(TEST_INSTANCE_TYPE)
 #undef TEST_INSTANCE_TYPE
     return true;
diff --git a/deps/v8/test/unittests/test-helpers.cc b/deps/v8/test/unittests/test-helpers.cc
index 46600c662db..b025f25c0e4 100644
--- a/deps/v8/test/unittests/test-helpers.cc
+++ b/deps/v8/test/unittests/test-helpers.cc
@@ -32,12 +32,13 @@ Handle<SharedFunctionInfo> CreateSharedFunctionInfo(
   HandleScope scope(isolate);
   Handle<String> source = CreateSource(isolate, maybe_resource);
   Handle<Script> script = isolate->factory()->NewScript(source);
-  Handle<FixedArray> infos = isolate->factory()->NewFixedArray(3);
+  Handle<WeakFixedArray> infos = isolate->factory()->NewWeakFixedArray(3);
   script->set_shared_function_infos(*infos);
-  Handle<SharedFunctionInfo> shared = isolate->factory()->NewSharedFunctionInfo(
-      isolate->factory()->NewStringFromAsciiChecked("f"),
-      BUILTIN_CODE(isolate, CompileLazy), false);
-  shared->set_end_position(source->length());
+  Handle<SharedFunctionInfo> shared =
+      isolate->factory()->NewSharedFunctionInfoForBuiltin(
+          isolate->factory()->NewStringFromAsciiChecked("f"),
+          Builtins::kCompileLazy);
+  shared->set_raw_end_position(source->length());
   shared->set_outer_scope_info(ScopeInfo::Empty(isolate));
   shared->set_function_literal_id(1);
   SharedFunctionInfo::SetScript(shared, script);
diff --git a/deps/v8/test/unittests/test-utils.cc b/deps/v8/test/unittests/test-utils.cc
index 354d1b7d2db..d19c3372395 100644
--- a/deps/v8/test/unittests/test-utils.cc
+++ b/deps/v8/test/unittests/test-utils.cc
@@ -32,6 +32,8 @@ TestWithIsolate::~TestWithIsolate() {}
 void TestWithIsolate::SetUpTestCase() {
   Test::SetUpTestCase();
   EXPECT_EQ(NULL, isolate_);
+  // Make BigInt64Array / BigUint64Array available for testing.
+  i::FLAG_harmony_bigint = true;
   v8::Isolate::CreateParams create_params;
   array_buffer_allocator_ = v8::ArrayBuffer::Allocator::NewDefaultAllocator();
   create_params.array_buffer_allocator = array_buffer_allocator_;
diff --git a/deps/v8/test/unittests/testcfg.py b/deps/v8/test/unittests/testcfg.py
index 9b187435668..05fdd858094 100644
--- a/deps/v8/test/unittests/testcfg.py
+++ b/deps/v8/test/unittests/testcfg.py
@@ -10,18 +10,23 @@
 from testrunner.objects import testcase
 
 
+class VariantsGenerator(testsuite.VariantsGenerator):
+  def _get_variants(self, test):
+    return self._standard_variant
+
+
 class TestSuite(testsuite.TestSuite):
-  def ListTests(self, context):
-    shell = os.path.abspath(os.path.join(context.shell_dir, self.name))
+  def ListTests(self):
+    shell = os.path.abspath(os.path.join(self.test_config.shell_dir, self.name))
     if utils.IsWindows():
       shell += ".exe"
 
     output = None
     for i in xrange(3): # Try 3 times in case of errors.
       cmd = command.Command(
-        cmd_prefix=context.command_prefix,
+        cmd_prefix=self.test_config.command_prefix,
         shell=shell,
-        args=['--gtest_list_tests'] + context.extra_flags)
+        args=['--gtest_list_tests'] + self.test_config.extra_flags)
       output = cmd.execute()
       if output.exit_code == 0:
         break
@@ -50,15 +55,15 @@ def ListTests(self, context):
   def _test_class(self):
     return TestCase
 
-  def _LegacyVariantsGeneratorFactory(self):
-    return testsuite.StandardLegacyVariantsGenerator
+  def _variants_gen_class(self):
+    return VariantsGenerator
 
 
 class TestCase(testcase.TestCase):
-  def _get_suite_flags(self, ctx):
+  def _get_suite_flags(self):
     return (
         ["--gtest_filter=" + self.path] +
-        ["--gtest_random_seed=%s" % ctx.random_seed] +
+        ["--gtest_random_seed=%s" % self.random_seed] +
         ["--gtest_print_time=0"]
     )
 
@@ -66,5 +71,5 @@ def get_shell(self):
     return self.suite.name
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/unittests/unicode-unittest.cc b/deps/v8/test/unittests/unicode-unittest.cc
index e5ccaca7b11..068052a3fc4 100644
--- a/deps/v8/test/unittests/unicode-unittest.cc
+++ b/deps/v8/test/unittests/unicode-unittest.cc
@@ -8,6 +8,7 @@
 
 #include "src/unicode-decoder.h"
 #include "src/unicode-inl.h"
+#include "src/vector.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace v8 {
@@ -15,16 +16,6 @@ namespace internal {
 
 namespace {
 
-using Utf8Decoder = unibrow::Utf8Decoder<512>;
-
-void Decode(Utf8Decoder* decoder, const std::string& str) {
-  // Put the string in its own buffer on the heap to make sure that
-  // AddressSanitizer's heap-buffer-overflow logic can see what's going on.
-  std::unique_ptr<char[]> buffer(new char[str.length()]);
-  memcpy(buffer.get(), str.data(), str.length());
-  decoder->Reset(buffer.get(), str.length());
-}
-
 void DecodeNormally(const std::vector<byte>& bytes,
                     std::vector<unibrow::uchar>* output) {
   size_t cursor = 0;
@@ -34,6 +25,28 @@ void DecodeNormally(const std::vector<byte>& bytes,
   }
 }
 
+template <size_t kBufferSize>
+void DecodeUtf16(unibrow::Utf8Decoder<kBufferSize>* decoder,
+                 const std::vector<byte>& bytes,
+                 std::vector<unibrow::uchar>* output) {
+  const char* bytes_begin = reinterpret_cast<const char*>(&(*bytes.begin()));
+  auto vector = Vector<const char>(bytes_begin, bytes.size());
+  decoder->Reset(vector);
+
+  std::vector<uint16_t> utf16(decoder->Utf16Length());
+  decoder->WriteUtf16(&(*utf16.begin()), decoder->Utf16Length(), vector);
+
+  // Decode back into code points
+  for (size_t i = 0; i < utf16.size(); i++) {
+    uint16_t b = utf16[i];
+    if (unibrow::Utf16::IsLeadSurrogate(b)) {
+      output->push_back(unibrow::Utf16::CombineSurrogatePair(b, utf16[++i]));
+    } else {
+      output->push_back(b);
+    }
+  }
+}
+
 void DecodeIncrementally(const std::vector<byte>& bytes,
                          std::vector<unibrow::uchar>* output) {
   unibrow::Utf8::Utf8IncrementalBuffer buffer = 0;
@@ -53,14 +66,52 @@ void DecodeIncrementally(const std::vector<byte>& bytes,
 
 }  // namespace
 
-TEST(UnicodeTest, ReadOffEndOfUtf8String) {
-  Utf8Decoder decoder;
+TEST(UnicodeTest, Utf16BufferReuse) {
+  unibrow::Utf8Decoder<4> utf16_decoder;
+
+  // Not enough continuation bytes before string ends.
+  typedef struct {
+    std::vector<byte> bytes;
+    std::vector<unibrow::uchar> unicode_expected;
+  } TestCase;
+
+  TestCase data[] = {
+      {{0x00}, {0x0}},
+      {{0xC2, 0x80}, {0x80}},
+      {{0xE0, 0xA0, 0x80}, {0x800}},
+      {{0xF0, 0x90, 0x80, 0x80}, {0x10000}},
+      {{0xE0, 0xA0, 0x80}, {0x800}},
+      {{0xC2, 0x80}, {0x80}},
+      {{0x00}, {0x0}},
+  };
+  for (auto test : data) {
+    // For figuring out which test fails:
+    fprintf(stderr, "test: ");
+    for (auto b : test.bytes) {
+      fprintf(stderr, "%x ", b);
+    }
+    fprintf(stderr, "\n");
+
+    std::vector<unibrow::uchar> output_utf16;
+    DecodeUtf16(&utf16_decoder, test.bytes, &output_utf16);
+
+    CHECK_EQ(output_utf16.size(), test.unicode_expected.size());
+    for (size_t i = 0; i < output_utf16.size(); ++i) {
+      CHECK_EQ(output_utf16[i], test.unicode_expected[i]);
+    }
+  }
+}
+
+TEST(UnicodeTest, SurrogateOverrunsBuffer) {
+  unibrow::Utf8Decoder<2> utf16_decoder;
 
+  std::vector<unibrow::uchar> output_utf16;
   // Not enough continuation bytes before string ends.
-  Decode(&decoder, "\xE0");
-  Decode(&decoder, "\xED");
-  Decode(&decoder, "\xF0");
-  Decode(&decoder, "\xF4");
+  DecodeUtf16(&utf16_decoder, {0x00, 0xF0, 0x90, 0x80, 0x80, 0x00},
+              &output_utf16);
+  CHECK_EQ(output_utf16[0], 0x00);
+  CHECK_EQ(output_utf16[1], 0x10000);
+  CHECK_EQ(output_utf16[0], 0x00);
 }
 
 TEST(UnicodeTest, IncrementalUTF8DecodingVsNonIncrementalUtf8Decoding) {
@@ -414,6 +465,8 @@ TEST(UnicodeTest, IncrementalUTF8DecodingVsNonIncrementalUtf8Decoding) {
         0x8FFFF}},
   };
 
+  unibrow::Utf8Decoder<50> utf16_decoder;
+
   for (auto test : data) {
     // For figuring out which test fails:
     fprintf(stderr, "test: ");
@@ -437,6 +490,14 @@ TEST(UnicodeTest, IncrementalUTF8DecodingVsNonIncrementalUtf8Decoding) {
     for (size_t i = 0; i < output_incremental.size(); ++i) {
       CHECK_EQ(output_incremental[i], test.unicode_expected[i]);
     }
+
+    std::vector<unibrow::uchar> output_utf16;
+    DecodeUtf16(&utf16_decoder, test.bytes, &output_utf16);
+
+    CHECK_EQ(output_utf16.size(), test.unicode_expected.size());
+    for (size_t i = 0; i < output_utf16.size(); ++i) {
+      CHECK_EQ(output_utf16[i], test.unicode_expected[i]);
+    }
   }
 }
 
diff --git a/deps/v8/test/unittests/unittests.gyp b/deps/v8/test/unittests/unittests.gyp
deleted file mode 100644
index 50e820e5f14..00000000000
--- a/deps/v8/test/unittests/unittests.gyp
+++ /dev/null
@@ -1,305 +0,0 @@
-# Copyright 2014 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# The sources are kept automatically in sync with BUILD.gn.
-
-{
-  'variables': {
-    'v8_code': 1,
-    'unittests_sources': [  ### gcmole(all) ###
-      'allocation-unittest.cc',
-      'api/access-check-unittest.cc',
-      'api/exception-unittest.cc',
-      'api/interceptor-unittest.cc',
-      'api/isolate-unittest.cc',
-      'api/remote-object-unittest.cc',
-      'api/v8-object-unittest.cc',
-      'asmjs/asm-scanner-unittest.cc',
-      'asmjs/asm-types-unittest.cc',
-      'asmjs/switch-logic-unittest.cc',
-      'base/atomic-utils-unittest.cc',
-      'base/bits-unittest.cc',
-      'base/cpu-unittest.cc',
-      'base/division-by-constant-unittest.cc',
-      'base/flags-unittest.cc',
-      'base/functional-unittest.cc',
-      'base/ieee754-unittest.cc',
-      'base/logging-unittest.cc',
-      'base/macros-unittest.cc',
-      'base/iterator-unittest.cc',
-      'base/ostreams-unittest.cc',
-      'base/platform/condition-variable-unittest.cc',
-      'base/platform/mutex-unittest.cc',
-      'base/platform/platform-unittest.cc',
-      'base/platform/semaphore-unittest.cc',
-      'base/platform/time-unittest.cc',
-      'base/sys-info-unittest.cc',
-      'base/template-utils-unittest.cc',
-      'base/utils/random-number-generator-unittest.cc',
-      'bigint-unittest.cc',
-      'cancelable-tasks-unittest.cc',
-      'char-predicates-unittest.cc',
-      "code-stub-assembler-unittest.cc",
-      "code-stub-assembler-unittest.h",
-      'compiler/branch-elimination-unittest.cc',
-      'compiler/bytecode-analysis-unittest.cc',
-      'compiler/checkpoint-elimination-unittest.cc',
-      "compiler/code-assembler-unittest.cc",
-      "compiler/code-assembler-unittest.h",
-      'compiler/common-operator-reducer-unittest.cc',
-      'compiler/common-operator-unittest.cc',
-      'compiler/compiler-test-utils.h',
-      'compiler/control-equivalence-unittest.cc',
-      'compiler/control-flow-optimizer-unittest.cc',
-      'compiler/dead-code-elimination-unittest.cc',
-      'compiler/diamond-unittest.cc',
-      'compiler/effect-control-linearizer-unittest.cc',
-      'compiler/graph-reducer-unittest.cc',
-      'compiler/graph-reducer-unittest.h',
-      'compiler/graph-trimmer-unittest.cc',
-      'compiler/graph-unittest.cc',
-      'compiler/graph-unittest.h',
-      'compiler/instruction-unittest.cc',
-      'compiler/instruction-selector-unittest.cc',
-      'compiler/instruction-selector-unittest.h',
-      'compiler/instruction-sequence-unittest.cc',
-      'compiler/instruction-sequence-unittest.h',
-      'compiler/int64-lowering-unittest.cc',
-      'compiler/js-builtin-reducer-unittest.cc',
-      'compiler/js-create-lowering-unittest.cc',
-      'compiler/js-intrinsic-lowering-unittest.cc',
-      'compiler/js-operator-unittest.cc',
-      'compiler/js-typed-lowering-unittest.cc',
-      'compiler/linkage-tail-call-unittest.cc',
-      'compiler/live-range-builder.h',
-      'compiler/regalloc/live-range-unittest.cc',
-      'compiler/load-elimination-unittest.cc',
-      'compiler/loop-peeling-unittest.cc',
-      'compiler/machine-operator-reducer-unittest.cc',
-      'compiler/machine-operator-unittest.cc',
-      'compiler/regalloc/move-optimizer-unittest.cc',
-      'compiler/node-cache-unittest.cc',
-      'compiler/node-matchers-unittest.cc',
-      'compiler/node-properties-unittest.cc',
-      'compiler/node-test-utils.cc',
-      'compiler/node-test-utils.h',
-      'compiler/node-unittest.cc',
-      'compiler/opcodes-unittest.cc',
-      'compiler/persistent-unittest.cc',
-      'compiler/regalloc/register-allocator-unittest.cc',
-      'compiler/schedule-unittest.cc',
-      'compiler/scheduler-unittest.cc',
-      'compiler/scheduler-rpo-unittest.cc',
-      'compiler/simplified-lowering-unittest.cc',
-      'compiler/simplified-operator-reducer-unittest.cc',
-      'compiler/simplified-operator-unittest.cc',
-      'compiler/state-values-utils-unittest.cc',
-      'compiler/typed-optimization-unittest.cc',
-      'compiler/typer-unittest.cc',
-      'compiler/value-numbering-reducer-unittest.cc',
-      'compiler/zone-stats-unittest.cc',
-      'compiler-dispatcher/compiler-dispatcher-tracer-unittest.cc',
-      'compiler-dispatcher/compiler-dispatcher-unittest.cc',
-      'compiler-dispatcher/optimizing-compile-dispatcher-unittest.cc',
-      'compiler-dispatcher/unoptimized-compile-job-unittest.cc',
-      'counters-unittest.cc',
-      'detachable-vector-unittest.cc',
-      'eh-frame-iterator-unittest.cc',
-      'eh-frame-writer-unittest.cc',
-      'heap/barrier-unittest.cc',
-      'heap/bitmap-unittest.cc',
-      'heap/embedder-tracing-unittest.cc',
-      'heap/gc-idle-time-handler-unittest.cc',
-      'heap/gc-tracer-unittest.cc',
-      'heap/item-parallel-job-unittest.cc',
-      'heap/marking-unittest.cc',
-      'heap/memory-reducer-unittest.cc',
-      'heap/heap-unittest.cc',
-      'heap/scavenge-job-unittest.cc',
-      'heap/slot-set-unittest.cc',
-      'heap/spaces-unittest.cc',
-      'heap/unmapper-unittest.cc',
-      'heap/worklist-unittest.cc',
-      'interpreter/bytecodes-unittest.cc',
-      'interpreter/bytecode-array-builder-unittest.cc',
-      'interpreter/bytecode-array-iterator-unittest.cc',
-      'interpreter/bytecode-array-random-iterator-unittest.cc',
-      'interpreter/bytecode-array-writer-unittest.cc',
-      'interpreter/bytecode-decoder-unittest.cc',
-      'interpreter/bytecode-node-unittest.cc',
-      'interpreter/bytecode-operands-unittest.cc',
-      'interpreter/bytecode-register-allocator-unittest.cc',
-      'interpreter/bytecode-register-optimizer-unittest.cc',
-      'interpreter/bytecode-source-info-unittest.cc',
-      'interpreter/bytecode-utils.h',
-      'interpreter/constant-array-builder-unittest.cc',
-      'interpreter/interpreter-assembler-unittest.cc',
-      'interpreter/interpreter-assembler-unittest.h',
-      'libplatform/default-platform-unittest.cc',
-      'libplatform/task-queue-unittest.cc',
-      'libplatform/worker-thread-unittest.cc',
-      'locked-queue-unittest.cc',
-      'object-unittest.cc',
-      'parser/ast-value-unittest.cc',
-      'parser/preparser-unittest.cc',
-      'register-configuration-unittest.cc',
-      'run-all-unittests.cc',
-      'source-position-table-unittest.cc',
-      'test-helpers.cc',
-      'test-helpers.h',
-      'test-utils.h',
-      'test-utils.cc',
-      'unicode-unittest.cc',
-      'utils-unittest.cc',
-      'value-serializer-unittest.cc',
-      'zone/segmentpool-unittest.cc',
-      'zone/zone-allocator-unittest.cc',
-      'zone/zone-chunk-list-unittest.cc',
-      'zone/zone-unittest.cc',
-      'wasm/control-transfer-unittest.cc',
-      'wasm/decoder-unittest.cc',
-      'wasm/function-body-decoder-unittest.cc',
-      'wasm/wasm-code-manager-unittest.cc',
-      'wasm/leb-helper-unittest.cc',
-      'wasm/loop-assignment-analysis-unittest.cc',
-      'wasm/module-decoder-unittest.cc',
-      'wasm/streaming-decoder-unittest.cc',
-      'wasm/trap-handler-unittest.cc',
-      'wasm/wasm-macro-gen-unittest.cc',
-      'wasm/wasm-module-builder-unittest.cc',
-      'wasm/wasm-opcodes-unittest.cc',
-    ],
-    'unittests_sources_arm': [  ### gcmole(arch:arm) ###
-      'compiler/arm/instruction-selector-arm-unittest.cc',
-    ],
-    'unittests_sources_arm64': [  ### gcmole(arch:arm64) ###
-      'compiler/arm64/instruction-selector-arm64-unittest.cc',
-    ],
-    'unittests_sources_ia32': [  ### gcmole(arch:ia32) ###
-      'compiler/ia32/instruction-selector-ia32-unittest.cc',
-    ],
-    'unittests_sources_mips': [  ### gcmole(arch:mips) ###
-      'compiler/mips/instruction-selector-mips-unittest.cc',
-    ],
-    'unittests_sources_mips64': [  ### gcmole(arch:mips64) ###
-      'compiler/mips64/instruction-selector-mips64-unittest.cc',
-    ],
-    'unittests_sources_x64': [  ### gcmole(arch:x64) ###
-      'compiler/x64/instruction-selector-x64-unittest.cc',
-    ],
-    'unittests_sources_ppc': [  ### gcmole(arch:ppc) ###
-      'compiler/ppc/instruction-selector-ppc-unittest.cc',
-    ],
-    'unittests_sources_s390': [  ### gcmole(arch:s390) ###
-      'compiler/s390/instruction-selector-s390-unittest.cc',
-    ],
-  },
-  'includes': ['../../gypfiles/toolchain.gypi', '../../gypfiles/features.gypi'],
-  'targets': [
-    {
-      'target_name': 'unittests',
-      'type': 'executable',
-      'variables': {
-        'optimize': 'max',
-      },
-      'dependencies': [
-        '../../testing/gmock.gyp:gmock',
-        '../../testing/gtest.gyp:gtest',
-        '../../src/v8.gyp:v8',
-        '../../src/v8.gyp:v8_libbase',
-        '../../src/v8.gyp:v8_libplatform',
-        '../../src/v8.gyp:v8_maybe_snapshot',
-      ],
-      'include_dirs': [
-        '../..',
-      ],
-      'sources': [
-        '<@(unittests_sources)',
-      ],
-      'conditions': [
-        ['v8_target_arch=="arm"', {
-          'sources': [
-            '<@(unittests_sources_arm)',
-          ],
-        }],
-        ['v8_target_arch=="arm64"', {
-          'sources': [
-            '<@(unittests_sources_arm64)',
-          ],
-        }],
-        ['v8_target_arch=="ia32"', {
-          'sources': [
-            '<@(unittests_sources_ia32)',
-          ],
-        }],
-        ['v8_target_arch=="mips"', {
-          'sources': [
-            '<@(unittests_sources_mips)',
-          ],
-        }],
-        ['v8_target_arch=="mipsel"', {
-          'sources': [
-            '<@(unittests_sources_mips)',
-          ],
-        }],
-        ['v8_target_arch=="mips64"', {
-          'sources': [
-            '<@(unittests_sources_mips64)',
-          ],
-        }],
-        ['v8_target_arch=="mips64el"', {
-          'sources': [
-            '<@(unittests_sources_mips64)',
-          ],
-        }],
-        ['v8_target_arch=="x64"', {
-          'sources': [
-            '<@(unittests_sources_x64)',
-          ],
-        }],
-        ['v8_target_arch=="ppc" or v8_target_arch=="ppc64"', {
-          'sources': [
-            '<@(unittests_sources_ppc)',
-          ],
-        }],
-        ['v8_target_arch=="s390" or v8_target_arch=="s390x"', {
-          'sources': [
-            '<@(unittests_sources_s390)',
-          ],
-        }],
-        ['OS=="aix"', {
-          'ldflags': [ '-Wl,-bbigtoc' ],
-        }],
-        ['v8_enable_i18n_support==1', {
-          'dependencies': [
-            '<(icu_gyp_path):icui18n',
-            '<(icu_gyp_path):icuuc',
-          ],
-        }],
-        ['v8_use_snapshot=="true"', {
-          'dependencies': ['../../src/v8.gyp:v8_initializers'],
-        }],
-      ],
-    },
-  ],
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'unittests_run',
-          'type': 'none',
-          'dependencies': [
-            'unittests',
-          ],
-          'includes': [
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'unittests.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/unittests/unittests.isolate b/deps/v8/test/unittests/unittests.isolate
deleted file mode 100644
index ec3bae42d3b..00000000000
--- a/deps/v8/test/unittests/unittests.isolate
+++ /dev/null
@@ -1,16 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'files': [
-      '<(PRODUCT_DIR)/unittests<(EXECUTABLE_SUFFIX)',
-      './testcfg.py',
-      './unittests.status',
-    ],
-  },
-  'includes': [
-    '../../src/base.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
diff --git a/deps/v8/test/unittests/unittests.status b/deps/v8/test/unittests/unittests.status
index d439913ccf6..51f3462fe94 100644
--- a/deps/v8/test/unittests/unittests.status
+++ b/deps/v8/test/unittests/unittests.status
@@ -3,4 +3,14 @@
 # found in the LICENSE file.
 
 [
+['system == macos and asan', {
+  # BUG(820416).
+  'BitsDeathTest*': [SKIP],
+  'LiveRangeUnitTest*': [SKIP],
+  'LoggingDeathTest*': [SKIP],
+  'LoggingTest.CompareClassTypes': [SKIP],
+  'RandomNumberGenerator.NextSampleInvalidParam': [SKIP],
+  'RandomNumberGenerator.NextSampleSlowInvalidParam1': [SKIP],
+  'RandomNumberGenerator.NextSampleSlowInvalidParam2': [SKIP],
+}],  # 'system == macos and asan'
 ]
diff --git a/deps/v8/test/unittests/value-serializer-unittest.cc b/deps/v8/test/unittests/value-serializer-unittest.cc
index c143b580902..92603b588ad 100644
--- a/deps/v8/test/unittests/value-serializer-unittest.cc
+++ b/deps/v8/test/unittests/value-serializer-unittest.cc
@@ -81,42 +81,32 @@ class ValueSerializerTest : public TestWithIsolate {
   // Overridden in more specific fixtures.
   virtual ValueSerializer::Delegate* GetSerializerDelegate() { return nullptr; }
   virtual void BeforeEncode(ValueSerializer*) {}
-  virtual void AfterEncode() {}
   virtual ValueDeserializer::Delegate* GetDeserializerDelegate() {
     return nullptr;
   }
   virtual void BeforeDecode(ValueDeserializer*) {}
 
-  template <typename InputFunctor, typename OutputFunctor>
-  void RoundTripTest(const InputFunctor& input_functor,
-                     const OutputFunctor& output_functor) {
-    EncodeTest(input_functor,
-               [this, &output_functor](const std::vector<uint8_t>& data) {
-                 DecodeTest(data, output_functor);
-               });
+  Local<Value> RoundTripTest(Local<Value> input_value) {
+    std::vector<uint8_t> encoded = EncodeTest(input_value);
+    return DecodeTest(encoded);
   }
 
   // Variant for the common case where a script is used to build the original
   // value.
-  template <typename OutputFunctor>
-  void RoundTripTest(const char* source, const OutputFunctor& output_functor) {
-    RoundTripTest([this, source]() { return EvaluateScriptForInput(source); },
-                  output_functor);
+  Local<Value> RoundTripTest(const char* source) {
+    return RoundTripTest(EvaluateScriptForInput(source));
   }
 
   // Variant which uses JSON.parse/stringify to check the result.
   void RoundTripJSON(const char* source) {
-    RoundTripTest(
-        [this, source]() {
-          return JSON::Parse(serialization_context_, StringFromUtf8(source))
-              .ToLocalChecked();
-        },
-        [this, source](Local<Value> value) {
-          ASSERT_TRUE(value->IsObject());
-          EXPECT_EQ(source, Utf8Value(JSON::Stringify(deserialization_context_,
-                                                      value.As<Object>())
-                                          .ToLocalChecked()));
-        });
+    Local<Value> input_value =
+        JSON::Parse(serialization_context_, StringFromUtf8(source))
+            .ToLocalChecked();
+    Local<Value> result = RoundTripTest(input_value);
+    ASSERT_TRUE(result->IsObject());
+    EXPECT_EQ(source, Utf8Value(JSON::Stringify(deserialization_context_,
+                                                result.As<Object>())
+                                    .ToLocalChecked()));
   }
 
   Maybe<std::vector<uint8_t>> DoEncode(Local<Value> value) {
@@ -127,48 +117,39 @@ class ValueSerializerTest : public TestWithIsolate {
     if (!serializer.WriteValue(context, value).FromMaybe(false)) {
       return Nothing<std::vector<uint8_t>>();
     }
-    AfterEncode();
     std::pair<uint8_t*, size_t> buffer = serializer.Release();
     std::vector<uint8_t> result(buffer.first, buffer.first + buffer.second);
     free(buffer.first);
     return Just(std::move(result));
   }
 
-  template <typename InputFunctor, typename EncodedDataFunctor>
-  void EncodeTest(const InputFunctor& input_functor,
-                  const EncodedDataFunctor& encoded_data_functor) {
+  std::vector<uint8_t> EncodeTest(Local<Value> input_value) {
     Context::Scope scope(serialization_context());
     TryCatch try_catch(isolate());
-    Local<Value> input_value = input_functor();
     std::vector<uint8_t> buffer;
-    ASSERT_TRUE(DoEncode(input_value).To(&buffer));
-    ASSERT_FALSE(try_catch.HasCaught());
-    encoded_data_functor(buffer);
+    // Ideally we would use GTest's ASSERT_* macros here and below. However,
+    // those only work in functions returning {void}, and they only terminate
+    // the current function, but not the entire current test (so we would need
+    // additional manual checks whether it is okay to proceed). Given that our
+    // test driver starts a new process for each test anyway, it is acceptable
+    // to just use a CHECK (which would kill the process on failure) instead.
+    CHECK(DoEncode(input_value).To(&buffer));
+    CHECK(!try_catch.HasCaught());
+    return buffer;
   }
 
-  template <typename InputFunctor, typename MessageFunctor>
-  void InvalidEncodeTest(const InputFunctor& input_functor,
-                         const MessageFunctor& functor) {
+  v8::Local<v8::Message> InvalidEncodeTest(Local<Value> input_value) {
     Context::Scope scope(serialization_context());
     TryCatch try_catch(isolate());
-    Local<Value> input_value = input_functor();
-    ASSERT_TRUE(DoEncode(input_value).IsNothing());
-    functor(try_catch.Message());
-  }
-
-  template <typename MessageFunctor>
-  void InvalidEncodeTest(const char* source, const MessageFunctor& functor) {
-    InvalidEncodeTest(
-        [this, source]() { return EvaluateScriptForInput(source); }, functor);
+    CHECK(DoEncode(input_value).IsNothing());
+    return try_catch.Message();
   }
 
-  void InvalidEncodeTest(const char* source) {
-    InvalidEncodeTest(source, [](Local<Message>) {});
+  v8::Local<v8::Message> InvalidEncodeTest(const char* source) {
+    return InvalidEncodeTest(EvaluateScriptForInput(source));
   }
 
-  template <typename OutputFunctor>
-  void DecodeTest(const std::vector<uint8_t>& data,
-                  const OutputFunctor& output_functor) {
+  Local<Value> DecodeTest(const std::vector<uint8_t>& data) {
     Local<Context> context = deserialization_context();
     Context::Scope scope(context);
     TryCatch try_catch(isolate());
@@ -178,22 +159,19 @@ class ValueSerializerTest : public TestWithIsolate {
     deserializer.SetSupportsLegacyWireFormat(true);
     deserializer.SetExpectInlineWasm(ExpectInlineWasm());
     BeforeDecode(&deserializer);
-    ASSERT_TRUE(deserializer.ReadHeader(context).FromMaybe(false));
+    CHECK(deserializer.ReadHeader(context).FromMaybe(false));
     Local<Value> result;
-    ASSERT_TRUE(deserializer.ReadValue(context).ToLocal(&result));
-    ASSERT_FALSE(result.IsEmpty());
-    ASSERT_FALSE(try_catch.HasCaught());
-    ASSERT_TRUE(
-        context->Global()
-            ->CreateDataProperty(context, StringFromUtf8("result"), result)
-            .FromMaybe(false));
-    output_functor(result);
-    ASSERT_FALSE(try_catch.HasCaught());
+    CHECK(deserializer.ReadValue(context).ToLocal(&result));
+    CHECK(!result.IsEmpty());
+    CHECK(!try_catch.HasCaught());
+    CHECK(context->Global()
+              ->CreateDataProperty(context, StringFromUtf8("result"), result)
+              .FromMaybe(false));
+    CHECK(!try_catch.HasCaught());
+    return result;
   }
 
-  template <typename OutputFunctor>
-  void DecodeTestForVersion0(const std::vector<uint8_t>& data,
-                             const OutputFunctor& output_functor) {
+  Local<Value> DecodeTestForVersion0(const std::vector<uint8_t>& data) {
     Local<Context> context = deserialization_context();
     Context::Scope scope(context);
     TryCatch try_catch(isolate());
@@ -203,18 +181,17 @@ class ValueSerializerTest : public TestWithIsolate {
     deserializer.SetSupportsLegacyWireFormat(true);
     deserializer.SetExpectInlineWasm(ExpectInlineWasm());
     BeforeDecode(&deserializer);
-    ASSERT_TRUE(deserializer.ReadHeader(context).FromMaybe(false));
-    ASSERT_EQ(0u, deserializer.GetWireFormatVersion());
+    CHECK(deserializer.ReadHeader(context).FromMaybe(false));
+    CHECK_EQ(0u, deserializer.GetWireFormatVersion());
     Local<Value> result;
-    ASSERT_TRUE(deserializer.ReadValue(context).ToLocal(&result));
-    ASSERT_FALSE(result.IsEmpty());
-    ASSERT_FALSE(try_catch.HasCaught());
-    ASSERT_TRUE(
-        context->Global()
-            ->CreateDataProperty(context, StringFromUtf8("result"), result)
-            .FromMaybe(false));
-    output_functor(result);
-    ASSERT_FALSE(try_catch.HasCaught());
+    CHECK(deserializer.ReadValue(context).ToLocal(&result));
+    CHECK(!result.IsEmpty());
+    CHECK(!try_catch.HasCaught());
+    CHECK(context->Global()
+              ->CreateDataProperty(context, StringFromUtf8("result"), result)
+              .FromMaybe(false));
+    CHECK(!try_catch.HasCaught());
+    return result;
   }
 
   void InvalidDecodeTest(const std::vector<uint8_t>& data) {
@@ -232,24 +209,26 @@ class ValueSerializerTest : public TestWithIsolate {
       EXPECT_TRUE(try_catch.HasCaught());
       return;
     }
-    ASSERT_TRUE(header_result.ToChecked());
-    ASSERT_TRUE(deserializer.ReadValue(context).IsEmpty());
+    CHECK(header_result.ToChecked());
+    CHECK(deserializer.ReadValue(context).IsEmpty());
     EXPECT_TRUE(try_catch.HasCaught());
   }
 
   Local<Value> EvaluateScriptForInput(const char* utf8_source) {
+    Context::Scope scope(serialization_context_);
     Local<String> source = StringFromUtf8(utf8_source);
     Local<Script> script =
         Script::Compile(serialization_context_, source).ToLocalChecked();
     return script->Run(serialization_context_).ToLocalChecked();
   }
 
-  bool EvaluateScriptForResultBool(const char* utf8_source) {
+  void ExpectScriptTrue(const char* utf8_source) {
+    Context::Scope scope(deserialization_context_);
     Local<String> source = StringFromUtf8(utf8_source);
     Local<Script> script =
         Script::Compile(deserialization_context_, source).ToLocalChecked();
     Local<Value> value = script->Run(deserialization_context_).ToLocalChecked();
-    return value->BooleanValue(deserialization_context_).FromJust();
+    EXPECT_TRUE(value->BooleanValue(deserialization_context_).FromJust());
   }
 
   Local<String> StringFromUtf8(const char* source) {
@@ -297,230 +276,269 @@ TEST_F(ValueSerializerTest, DecodeInvalid) {
 }
 
 TEST_F(ValueSerializerTest, RoundTripOddball) {
-  RoundTripTest([this]() { return Undefined(isolate()); },
-                [](Local<Value> value) { EXPECT_TRUE(value->IsUndefined()); });
-  RoundTripTest([this]() { return True(isolate()); },
-                [](Local<Value> value) { EXPECT_TRUE(value->IsTrue()); });
-  RoundTripTest([this]() { return False(isolate()); },
-                [](Local<Value> value) { EXPECT_TRUE(value->IsFalse()); });
-  RoundTripTest([this]() { return Null(isolate()); },
-                [](Local<Value> value) { EXPECT_TRUE(value->IsNull()); });
+  Local<Value> value = RoundTripTest(Undefined(isolate()));
+  EXPECT_TRUE(value->IsUndefined());
+  value = RoundTripTest(True(isolate()));
+  EXPECT_TRUE(value->IsTrue());
+  value = RoundTripTest(False(isolate()));
+  EXPECT_TRUE(value->IsFalse());
+  value = RoundTripTest(Null(isolate()));
+  EXPECT_TRUE(value->IsNull());
 }
 
 TEST_F(ValueSerializerTest, DecodeOddball) {
   // What this code is expected to generate.
-  DecodeTest({0xFF, 0x09, 0x5F},
-             [](Local<Value> value) { EXPECT_TRUE(value->IsUndefined()); });
-  DecodeTest({0xFF, 0x09, 0x54},
-             [](Local<Value> value) { EXPECT_TRUE(value->IsTrue()); });
-  DecodeTest({0xFF, 0x09, 0x46},
-             [](Local<Value> value) { EXPECT_TRUE(value->IsFalse()); });
-  DecodeTest({0xFF, 0x09, 0x30},
-             [](Local<Value> value) { EXPECT_TRUE(value->IsNull()); });
+  Local<Value> value = DecodeTest({0xFF, 0x09, 0x5F});
+  EXPECT_TRUE(value->IsUndefined());
+  value = DecodeTest({0xFF, 0x09, 0x54});
+  EXPECT_TRUE(value->IsTrue());
+  value = DecodeTest({0xFF, 0x09, 0x46});
+  EXPECT_TRUE(value->IsFalse());
+  value = DecodeTest({0xFF, 0x09, 0x30});
+  EXPECT_TRUE(value->IsNull());
 
   // What v9 of the Blink code generates.
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x5F, 0x00},
-             [](Local<Value> value) { EXPECT_TRUE(value->IsUndefined()); });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x54, 0x00},
-             [](Local<Value> value) { EXPECT_TRUE(value->IsTrue()); });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x46, 0x00},
-             [](Local<Value> value) { EXPECT_TRUE(value->IsFalse()); });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x30, 0x00},
-             [](Local<Value> value) { EXPECT_TRUE(value->IsNull()); });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x5F, 0x00});
+  EXPECT_TRUE(value->IsUndefined());
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x54, 0x00});
+  EXPECT_TRUE(value->IsTrue());
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x46, 0x00});
+  EXPECT_TRUE(value->IsFalse());
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x30, 0x00});
+  EXPECT_TRUE(value->IsNull());
 
   // v0 (with no explicit version).
-  DecodeTest({0x5F, 0x00},
-             [](Local<Value> value) { EXPECT_TRUE(value->IsUndefined()); });
-  DecodeTest({0x54, 0x00},
-             [](Local<Value> value) { EXPECT_TRUE(value->IsTrue()); });
-  DecodeTest({0x46, 0x00},
-             [](Local<Value> value) { EXPECT_TRUE(value->IsFalse()); });
-  DecodeTest({0x30, 0x00},
-             [](Local<Value> value) { EXPECT_TRUE(value->IsNull()); });
+  value = DecodeTest({0x5F, 0x00});
+  EXPECT_TRUE(value->IsUndefined());
+  value = DecodeTest({0x54, 0x00});
+  EXPECT_TRUE(value->IsTrue());
+  value = DecodeTest({0x46, 0x00});
+  EXPECT_TRUE(value->IsFalse());
+  value = DecodeTest({0x30, 0x00});
+  EXPECT_TRUE(value->IsNull());
 }
 
 TEST_F(ValueSerializerTest, RoundTripNumber) {
-  RoundTripTest([this]() { return Integer::New(isolate(), 42); },
-                [](Local<Value> value) {
-                  ASSERT_TRUE(value->IsInt32());
-                  EXPECT_EQ(42, Int32::Cast(*value)->Value());
-                });
-  RoundTripTest([this]() { return Integer::New(isolate(), -31337); },
-                [](Local<Value> value) {
-                  ASSERT_TRUE(value->IsInt32());
-                  EXPECT_EQ(-31337, Int32::Cast(*value)->Value());
-                });
-  RoundTripTest(
-      [this]() {
-        return Integer::New(isolate(), std::numeric_limits<int32_t>::min());
-      },
-      [](Local<Value> value) {
-        ASSERT_TRUE(value->IsInt32());
-        EXPECT_EQ(std::numeric_limits<int32_t>::min(),
-                  Int32::Cast(*value)->Value());
-      });
-  RoundTripTest([this]() { return Number::New(isolate(), -0.25); },
-                [](Local<Value> value) {
-                  ASSERT_TRUE(value->IsNumber());
-                  EXPECT_EQ(-0.25, Number::Cast(*value)->Value());
-                });
-  RoundTripTest(
-      [this]() {
-        return Number::New(isolate(), std::numeric_limits<double>::quiet_NaN());
-      },
-      [](Local<Value> value) {
-        ASSERT_TRUE(value->IsNumber());
-        EXPECT_TRUE(std::isnan(Number::Cast(*value)->Value()));
-      });
+  Local<Value> value = RoundTripTest(Integer::New(isolate(), 42));
+  ASSERT_TRUE(value->IsInt32());
+  EXPECT_EQ(42, Int32::Cast(*value)->Value());
+
+  value = RoundTripTest(Integer::New(isolate(), -31337));
+  ASSERT_TRUE(value->IsInt32());
+  EXPECT_EQ(-31337, Int32::Cast(*value)->Value());
+
+  value = RoundTripTest(
+      Integer::New(isolate(), std::numeric_limits<int32_t>::min()));
+  ASSERT_TRUE(value->IsInt32());
+  EXPECT_EQ(std::numeric_limits<int32_t>::min(), Int32::Cast(*value)->Value());
+
+  value = RoundTripTest(Number::New(isolate(), -0.25));
+  ASSERT_TRUE(value->IsNumber());
+  EXPECT_EQ(-0.25, Number::Cast(*value)->Value());
+
+  value = RoundTripTest(
+      Number::New(isolate(), std::numeric_limits<double>::quiet_NaN()));
+  ASSERT_TRUE(value->IsNumber());
+  EXPECT_TRUE(std::isnan(Number::Cast(*value)->Value()));
 }
 
 TEST_F(ValueSerializerTest, DecodeNumber) {
   // 42 zig-zag encoded (signed)
-  DecodeTest({0xFF, 0x09, 0x49, 0x54}, [](Local<Value> value) {
-    ASSERT_TRUE(value->IsInt32());
-    EXPECT_EQ(42, Int32::Cast(*value)->Value());
-  });
+  Local<Value> value = DecodeTest({0xFF, 0x09, 0x49, 0x54});
+  ASSERT_TRUE(value->IsInt32());
+  EXPECT_EQ(42, Int32::Cast(*value)->Value());
+
   // 42 varint encoded (unsigned)
-  DecodeTest({0xFF, 0x09, 0x55, 0x2A}, [](Local<Value> value) {
-    ASSERT_TRUE(value->IsInt32());
-    EXPECT_EQ(42, Int32::Cast(*value)->Value());
-  });
+  value = DecodeTest({0xFF, 0x09, 0x55, 0x2A});
+  ASSERT_TRUE(value->IsInt32());
+  EXPECT_EQ(42, Int32::Cast(*value)->Value());
+
   // 160 zig-zag encoded (signed)
-  DecodeTest({0xFF, 0x09, 0x49, 0xC0, 0x02}, [](Local<Value> value) {
-    ASSERT_TRUE(value->IsInt32());
-    ASSERT_EQ(160, Int32::Cast(*value)->Value());
-  });
+  value = DecodeTest({0xFF, 0x09, 0x49, 0xC0, 0x02});
+  ASSERT_TRUE(value->IsInt32());
+  ASSERT_EQ(160, Int32::Cast(*value)->Value());
+
   // 160 varint encoded (unsigned)
-  DecodeTest({0xFF, 0x09, 0x55, 0xA0, 0x01}, [](Local<Value> value) {
-    ASSERT_TRUE(value->IsInt32());
-    ASSERT_EQ(160, Int32::Cast(*value)->Value());
-  });
+  value = DecodeTest({0xFF, 0x09, 0x55, 0xA0, 0x01});
+  ASSERT_TRUE(value->IsInt32());
+  ASSERT_EQ(160, Int32::Cast(*value)->Value());
+
 #if defined(V8_TARGET_LITTLE_ENDIAN)
   // IEEE 754 doubles, little-endian byte order
-  DecodeTest({0xFF, 0x09, 0x4E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD0, 0xBF},
-             [](Local<Value> value) {
-               ASSERT_TRUE(value->IsNumber());
-               EXPECT_EQ(-0.25, Number::Cast(*value)->Value());
-             });
+  value = DecodeTest(
+      {0xFF, 0x09, 0x4E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD0, 0xBF});
+  ASSERT_TRUE(value->IsNumber());
+  EXPECT_EQ(-0.25, Number::Cast(*value)->Value());
+
   // quiet NaN
-  DecodeTest({0xFF, 0x09, 0x4E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF8, 0x7F},
-             [](Local<Value> value) {
-               ASSERT_TRUE(value->IsNumber());
-               EXPECT_TRUE(std::isnan(Number::Cast(*value)->Value()));
-             });
+  value = DecodeTest(
+      {0xFF, 0x09, 0x4E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF8, 0x7F});
+  ASSERT_TRUE(value->IsNumber());
+  EXPECT_TRUE(std::isnan(Number::Cast(*value)->Value()));
+
   // signaling NaN
-  DecodeTest({0xFF, 0x09, 0x4E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF4, 0x7F},
-             [](Local<Value> value) {
-               ASSERT_TRUE(value->IsNumber());
-               EXPECT_TRUE(std::isnan(Number::Cast(*value)->Value()));
-             });
+  value = DecodeTest(
+      {0xFF, 0x09, 0x4E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF4, 0x7F});
+  ASSERT_TRUE(value->IsNumber());
+  EXPECT_TRUE(std::isnan(Number::Cast(*value)->Value()));
 #endif
   // TODO(jbroman): Equivalent test for big-endian machines.
 }
 
+TEST_F(ValueSerializerTest, RoundTripBigInt) {
+  Local<Value> value = RoundTripTest(BigInt::New(isolate(), -42));
+  ASSERT_TRUE(value->IsBigInt());
+  ExpectScriptTrue("result === -42n");
+
+  value = RoundTripTest(BigInt::New(isolate(), 42));
+  ExpectScriptTrue("result === 42n");
+
+  value = RoundTripTest(BigInt::New(isolate(), 0));
+  ExpectScriptTrue("result === 0n");
+
+  value = RoundTripTest("0x1234567890abcdef777888999n");
+  ExpectScriptTrue("result === 0x1234567890abcdef777888999n");
+
+  value = RoundTripTest("-0x1234567890abcdef777888999123n");
+  ExpectScriptTrue("result === -0x1234567890abcdef777888999123n");
+
+  Context::Scope scope(serialization_context());
+  value = RoundTripTest(BigIntObject::New(isolate(), 23));
+  ASSERT_TRUE(value->IsBigIntObject());
+  ExpectScriptTrue("result == 23n");
+}
+
+TEST_F(ValueSerializerTest, DecodeBigInt) {
+  Local<Value> value = DecodeTest({
+      0xFF, 0x0D,              // Version 13
+      0x5A,                    // BigInt
+      0x08,                    // Bitfield: sign = false, bytelength = 4
+      0x2A, 0x00, 0x00, 0x00,  // Digit: 42
+  });
+  ASSERT_TRUE(value->IsBigInt());
+  ExpectScriptTrue("result === 42n");
+
+  value = DecodeTest({
+      0xFF, 0x0D,  // Version 13
+      0x7A,        // BigIntObject
+      0x11,        // Bitfield: sign = true, bytelength = 8
+      0x2A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00  // Digit: 42
+  });
+  ASSERT_TRUE(value->IsBigIntObject());
+  ExpectScriptTrue("result == -42n");
+
+  value = DecodeTest({
+      0xFF, 0x0D,  // Version 13
+      0x5A,        // BigInt
+      0x10,        // Bitfield: sign = false, bytelength = 8
+      0xEF, 0xCD, 0xAB, 0x90, 0x78, 0x56, 0x34, 0x12  // Digit(s).
+  });
+  ExpectScriptTrue("result === 0x1234567890abcdefn");
+
+  value = DecodeTest({0xFF, 0x0D,  // Version 13
+                      0x5A,        // BigInt
+                      0x17,        // Bitfield: sign = true, bytelength = 11
+                      0xEF, 0xCD, 0xAB, 0x90,  // Digits.
+                      0x78, 0x56, 0x34, 0x12, 0x33, 0x44, 0x55});
+  ExpectScriptTrue("result === -0x5544331234567890abcdefn");
+
+  value = DecodeTest({
+      0xFF, 0x0D,  // Version 13
+      0x5A,        // BigInt
+      0x02,        // Bitfield: sign = false, bytelength = 1
+      0x2A,        // Digit: 42
+  });
+  ExpectScriptTrue("result === 42n");
+}
+
 // String constants (in UTF-8) used for string encoding tests.
 static const char kHelloString[] = "Hello";
 static const char kQuebecString[] = "\x51\x75\xC3\xA9\x62\x65\x63";
 static const char kEmojiString[] = "\xF0\x9F\x91\x8A";
 
 TEST_F(ValueSerializerTest, RoundTripString) {
-  RoundTripTest([this]() { return String::Empty(isolate()); },
-                [](Local<Value> value) {
-                  ASSERT_TRUE(value->IsString());
-                  EXPECT_EQ(0, String::Cast(*value)->Length());
-                });
+  Local<Value> value = RoundTripTest(String::Empty(isolate()));
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(0, String::Cast(*value)->Length());
+
   // Inside ASCII.
-  RoundTripTest([this]() { return StringFromUtf8(kHelloString); },
-                [this](Local<Value> value) {
-                  ASSERT_TRUE(value->IsString());
-                  EXPECT_EQ(5, String::Cast(*value)->Length());
-                  EXPECT_EQ(kHelloString, Utf8Value(value));
-                });
+  value = RoundTripTest(StringFromUtf8(kHelloString));
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(5, String::Cast(*value)->Length());
+  EXPECT_EQ(kHelloString, Utf8Value(value));
+
   // Inside Latin-1 (i.e. one-byte string), but not ASCII.
-  RoundTripTest([this]() { return StringFromUtf8(kQuebecString); },
-                [this](Local<Value> value) {
-                  ASSERT_TRUE(value->IsString());
-                  EXPECT_EQ(6, String::Cast(*value)->Length());
-                  EXPECT_EQ(kQuebecString, Utf8Value(value));
-                });
+  value = RoundTripTest(StringFromUtf8(kQuebecString));
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(6, String::Cast(*value)->Length());
+  EXPECT_EQ(kQuebecString, Utf8Value(value));
+
   // An emoji (decodes to two 16-bit chars).
-  RoundTripTest([this]() { return StringFromUtf8(kEmojiString); },
-                [this](Local<Value> value) {
-                  ASSERT_TRUE(value->IsString());
-                  EXPECT_EQ(2, String::Cast(*value)->Length());
-                  EXPECT_EQ(kEmojiString, Utf8Value(value));
-                });
+  value = RoundTripTest(StringFromUtf8(kEmojiString));
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(2, String::Cast(*value)->Length());
+  EXPECT_EQ(kEmojiString, Utf8Value(value));
 }
 
 TEST_F(ValueSerializerTest, DecodeString) {
   // Decoding the strings above from UTF-8.
-  DecodeTest({0xFF, 0x09, 0x53, 0x00}, [](Local<Value> value) {
-    ASSERT_TRUE(value->IsString());
-    EXPECT_EQ(0, String::Cast(*value)->Length());
-  });
-  DecodeTest({0xFF, 0x09, 0x53, 0x05, 'H', 'e', 'l', 'l', 'o'},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsString());
-               EXPECT_EQ(5, String::Cast(*value)->Length());
-               EXPECT_EQ(kHelloString, Utf8Value(value));
-             });
-  DecodeTest({0xFF, 0x09, 0x53, 0x07, 'Q', 'u', 0xC3, 0xA9, 'b', 'e', 'c'},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsString());
-               EXPECT_EQ(6, String::Cast(*value)->Length());
-               EXPECT_EQ(kQuebecString, Utf8Value(value));
-             });
-  DecodeTest({0xFF, 0x09, 0x53, 0x04, 0xF0, 0x9F, 0x91, 0x8A},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsString());
-               EXPECT_EQ(2, String::Cast(*value)->Length());
-               EXPECT_EQ(kEmojiString, Utf8Value(value));
-             });
+  Local<Value> value = DecodeTest({0xFF, 0x09, 0x53, 0x00});
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(0, String::Cast(*value)->Length());
+
+  value = DecodeTest({0xFF, 0x09, 0x53, 0x05, 'H', 'e', 'l', 'l', 'o'});
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(5, String::Cast(*value)->Length());
+  EXPECT_EQ(kHelloString, Utf8Value(value));
+
+  value =
+      DecodeTest({0xFF, 0x09, 0x53, 0x07, 'Q', 'u', 0xC3, 0xA9, 'b', 'e', 'c'});
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(6, String::Cast(*value)->Length());
+  EXPECT_EQ(kQuebecString, Utf8Value(value));
+
+  value = DecodeTest({0xFF, 0x09, 0x53, 0x04, 0xF0, 0x9F, 0x91, 0x8A});
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(2, String::Cast(*value)->Length());
+  EXPECT_EQ(kEmojiString, Utf8Value(value));
 
   // And from Latin-1 (for the ones that fit).
-  DecodeTest({0xFF, 0x0A, 0x22, 0x00}, [](Local<Value> value) {
-    ASSERT_TRUE(value->IsString());
-    EXPECT_EQ(0, String::Cast(*value)->Length());
-  });
-  DecodeTest({0xFF, 0x0A, 0x22, 0x05, 'H', 'e', 'l', 'l', 'o'},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsString());
-               EXPECT_EQ(5, String::Cast(*value)->Length());
-               EXPECT_EQ(kHelloString, Utf8Value(value));
-             });
-  DecodeTest({0xFF, 0x0A, 0x22, 0x06, 'Q', 'u', 0xE9, 'b', 'e', 'c'},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsString());
-               EXPECT_EQ(6, String::Cast(*value)->Length());
-               EXPECT_EQ(kQuebecString, Utf8Value(value));
-             });
+  value = DecodeTest({0xFF, 0x0A, 0x22, 0x00});
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(0, String::Cast(*value)->Length());
+
+  value = DecodeTest({0xFF, 0x0A, 0x22, 0x05, 'H', 'e', 'l', 'l', 'o'});
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(5, String::Cast(*value)->Length());
+  EXPECT_EQ(kHelloString, Utf8Value(value));
+
+  value = DecodeTest({0xFF, 0x0A, 0x22, 0x06, 'Q', 'u', 0xE9, 'b', 'e', 'c'});
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(6, String::Cast(*value)->Length());
+  EXPECT_EQ(kQuebecString, Utf8Value(value));
 
 // And from two-byte strings (endianness dependent).
 #if defined(V8_TARGET_LITTLE_ENDIAN)
-  DecodeTest({0xFF, 0x09, 0x63, 0x00}, [](Local<Value> value) {
-    ASSERT_TRUE(value->IsString());
-    EXPECT_EQ(0, String::Cast(*value)->Length());
-  });
-  DecodeTest({0xFF, 0x09, 0x63, 0x0A, 'H', '\0', 'e', '\0', 'l', '\0', 'l',
-              '\0', 'o', '\0'},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsString());
-               EXPECT_EQ(5, String::Cast(*value)->Length());
-               EXPECT_EQ(kHelloString, Utf8Value(value));
-             });
-  DecodeTest({0xFF, 0x09, 0x63, 0x0C, 'Q', '\0', 'u', '\0', 0xE9, '\0', 'b',
-              '\0', 'e', '\0', 'c', '\0'},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsString());
-               EXPECT_EQ(6, String::Cast(*value)->Length());
-               EXPECT_EQ(kQuebecString, Utf8Value(value));
-             });
-  DecodeTest({0xFF, 0x09, 0x63, 0x04, 0x3D, 0xD8, 0x4A, 0xDC},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsString());
-               EXPECT_EQ(2, String::Cast(*value)->Length());
-               EXPECT_EQ(kEmojiString, Utf8Value(value));
-             });
+  value = DecodeTest({0xFF, 0x09, 0x63, 0x00});
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(0, String::Cast(*value)->Length());
+
+  value = DecodeTest({0xFF, 0x09, 0x63, 0x0A, 'H', '\0', 'e', '\0', 'l', '\0',
+                      'l', '\0', 'o', '\0'});
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(5, String::Cast(*value)->Length());
+  EXPECT_EQ(kHelloString, Utf8Value(value));
+
+  value = DecodeTest({0xFF, 0x09, 0x63, 0x0C, 'Q', '\0', 'u', '\0', 0xE9, '\0',
+                      'b', '\0', 'e', '\0', 'c', '\0'});
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(6, String::Cast(*value)->Length());
+  EXPECT_EQ(kQuebecString, Utf8Value(value));
+
+  value = DecodeTest({0xFF, 0x09, 0x63, 0x04, 0x3D, 0xD8, 0x4A, 0xDC});
+  ASSERT_TRUE(value->IsString());
+  EXPECT_EQ(2, String::Cast(*value)->Length());
+  EXPECT_EQ(kEmojiString, Utf8Value(value));
 #endif
   // TODO(jbroman): The same for big-endian systems.
 }
@@ -543,152 +561,124 @@ TEST_F(ValueSerializerTest, EncodeTwoByteStringUsesPadding) {
   // As long as the output has a version that Blink expects to be able to read,
   // we must respect its alignment requirements. It requires that two-byte
   // characters be aligned.
-  EncodeTest(
-      [this]() {
-        // We need a string whose length will take two bytes to encode, so that
-        // a padding byte is needed to keep the characters aligned. The string
-        // must also have a two-byte character, so that it gets the two-byte
-        // encoding.
-        std::string string(200, ' ');
-        string += kEmojiString;
-        return StringFromUtf8(string.c_str());
-      },
-      [](const std::vector<uint8_t>& data) {
-        // This is a sufficient but not necessary condition. This test assumes
-        // that the wire format version is one byte long, but is flexible to
-        // what that value may be.
-        const uint8_t expected_prefix[] = {0x00, 0x63, 0x94, 0x03};
-        ASSERT_GT(data.size(), sizeof(expected_prefix) + 2);
-        EXPECT_EQ(0xFF, data[0]);
-        EXPECT_GE(data[1], 0x09);
-        EXPECT_LE(data[1], 0x7F);
-        EXPECT_TRUE(std::equal(std::begin(expected_prefix),
-                               std::end(expected_prefix), data.begin() + 2));
-      });
+  // We need a string whose length will take two bytes to encode, so that
+  // a padding byte is needed to keep the characters aligned. The string
+  // must also have a two-byte character, so that it gets the two-byte
+  // encoding.
+  std::string string(200, ' ');
+  string += kEmojiString;
+  const std::vector<uint8_t> data = EncodeTest(StringFromUtf8(string.c_str()));
+  // This is a sufficient but not necessary condition. This test assumes
+  // that the wire format version is one byte long, but is flexible to
+  // what that value may be.
+  const uint8_t expected_prefix[] = {0x00, 0x63, 0x94, 0x03};
+  ASSERT_GT(data.size(), sizeof(expected_prefix) + 2);
+  EXPECT_EQ(0xFF, data[0]);
+  EXPECT_GE(data[1], 0x09);
+  EXPECT_LE(data[1], 0x7F);
+  EXPECT_TRUE(std::equal(std::begin(expected_prefix), std::end(expected_prefix),
+                         data.begin() + 2));
 }
 
 TEST_F(ValueSerializerTest, RoundTripDictionaryObject) {
   // Empty object.
-  RoundTripTest("({})", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsObject());
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === Object.prototype"));
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getOwnPropertyNames(result).length === 0"));
-  });
+  Local<Value> value = RoundTripTest("({})");
+  ASSERT_TRUE(value->IsObject());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Object.prototype");
+  ExpectScriptTrue("Object.getOwnPropertyNames(result).length === 0");
+
   // String key.
-  RoundTripTest("({ a: 42 })", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsObject());
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.hasOwnProperty('a')"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.a === 42"));
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getOwnPropertyNames(result).length === 1"));
-  });
+  value = RoundTripTest("({ a: 42 })");
+  ASSERT_TRUE(value->IsObject());
+  ExpectScriptTrue("result.hasOwnProperty('a')");
+  ExpectScriptTrue("result.a === 42");
+  ExpectScriptTrue("Object.getOwnPropertyNames(result).length === 1");
+
   // Integer key (treated as a string, but may be encoded differently).
-  RoundTripTest("({ 42: 'a' })", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsObject());
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.hasOwnProperty('42')"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result[42] === 'a'"));
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getOwnPropertyNames(result).length === 1"));
-  });
+  value = RoundTripTest("({ 42: 'a' })");
+  ASSERT_TRUE(value->IsObject());
+  ExpectScriptTrue("result.hasOwnProperty('42')");
+  ExpectScriptTrue("result[42] === 'a'");
+  ExpectScriptTrue("Object.getOwnPropertyNames(result).length === 1");
+
   // Key order must be preserved.
-  RoundTripTest("({ x: 1, y: 2, a: 3 })", [this](Local<Value> value) {
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getOwnPropertyNames(result).toString() === 'x,y,a'"));
-  });
+  value = RoundTripTest("({ x: 1, y: 2, a: 3 })");
+  ExpectScriptTrue("Object.getOwnPropertyNames(result).toString() === 'x,y,a'");
+
   // A harder case of enumeration order.
   // Indexes first, in order (but not 2^32 - 1, which is not an index), then the
   // remaining (string) keys, in the order they were defined.
-  RoundTripTest(
-      "({ a: 2, 0xFFFFFFFF: 1, 0xFFFFFFFE: 3, 1: 0 })",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getOwnPropertyNames(result).toString() === "
-            "'1,4294967294,a,4294967295'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === 2"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[0xFFFFFFFF] === 1"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[0xFFFFFFFE] === 3"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[1] === 0"));
-      });
+  value = RoundTripTest("({ a: 2, 0xFFFFFFFF: 1, 0xFFFFFFFE: 3, 1: 0 })");
+  ExpectScriptTrue(
+      "Object.getOwnPropertyNames(result).toString() === "
+      "'1,4294967294,a,4294967295'");
+  ExpectScriptTrue("result.a === 2");
+  ExpectScriptTrue("result[0xFFFFFFFF] === 1");
+  ExpectScriptTrue("result[0xFFFFFFFE] === 3");
+  ExpectScriptTrue("result[1] === 0");
+
   // This detects a fairly subtle case: the object itself must be in the map
   // before its properties are deserialized, so that references to it can be
   // resolved.
-  RoundTripTest(
-      "(() => { var y = {}; y.self = y; return y; })()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsObject());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result === result.self"));
-      });
+  value = RoundTripTest("var y = {}; y.self = y; y;");
+  ASSERT_TRUE(value->IsObject());
+  ExpectScriptTrue("result === result.self");
 }
 
 TEST_F(ValueSerializerTest, DecodeDictionaryObject) {
   // Empty object.
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x7B, 0x00, 0x00},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsObject());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Object.prototype"));
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getOwnPropertyNames(result).length === 0"));
-             });
+  Local<Value> value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x7B, 0x00, 0x00});
+  ASSERT_TRUE(value->IsObject());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Object.prototype");
+  ExpectScriptTrue("Object.getOwnPropertyNames(result).length === 0");
+
   // String key.
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x01, 0x61, 0x3F, 0x01,
-       0x49, 0x54, 0x7B, 0x01},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsObject());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.hasOwnProperty('a')"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === 42"));
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getOwnPropertyNames(result).length === 1"));
-      });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x01,
+                      0x61, 0x3F, 0x01, 0x49, 0x54, 0x7B, 0x01});
+  ASSERT_TRUE(value->IsObject());
+  ExpectScriptTrue("result.hasOwnProperty('a')");
+  ExpectScriptTrue("result.a === 42");
+  ExpectScriptTrue("Object.getOwnPropertyNames(result).length === 1");
+
   // Integer key (treated as a string, but may be encoded differently).
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x49, 0x54, 0x3F, 0x01, 0x53,
-       0x01, 0x61, 0x7B, 0x01},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsObject());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.hasOwnProperty('42')"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[42] === 'a'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getOwnPropertyNames(result).length === 1"));
-      });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x49, 0x54,
+                      0x3F, 0x01, 0x53, 0x01, 0x61, 0x7B, 0x01});
+  ASSERT_TRUE(value->IsObject());
+  ExpectScriptTrue("result.hasOwnProperty('42')");
+  ExpectScriptTrue("result[42] === 'a'");
+  ExpectScriptTrue("Object.getOwnPropertyNames(result).length === 1");
+
   // Key order must be preserved.
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x01, 0x78, 0x3F, 0x01,
-       0x49, 0x02, 0x3F, 0x01, 0x53, 0x01, 0x79, 0x3F, 0x01, 0x49, 0x04, 0x3F,
-       0x01, 0x53, 0x01, 0x61, 0x3F, 0x01, 0x49, 0x06, 0x7B, 0x03},
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getOwnPropertyNames(result).toString() === 'x,y,a'"));
-      });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x01,
+                      0x78, 0x3F, 0x01, 0x49, 0x02, 0x3F, 0x01, 0x53, 0x01,
+                      0x79, 0x3F, 0x01, 0x49, 0x04, 0x3F, 0x01, 0x53, 0x01,
+                      0x61, 0x3F, 0x01, 0x49, 0x06, 0x7B, 0x03});
+  ExpectScriptTrue("Object.getOwnPropertyNames(result).toString() === 'x,y,a'");
+
   // A harder case of enumeration order.
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x49, 0x02, 0x3F, 0x01,
-       0x49, 0x00, 0x3F, 0x01, 0x55, 0xFE, 0xFF, 0xFF, 0xFF, 0x0F, 0x3F,
-       0x01, 0x49, 0x06, 0x3F, 0x01, 0x53, 0x01, 0x61, 0x3F, 0x01, 0x49,
-       0x04, 0x3F, 0x01, 0x53, 0x0A, 0x34, 0x32, 0x39, 0x34, 0x39, 0x36,
-       0x37, 0x32, 0x39, 0x35, 0x3F, 0x01, 0x49, 0x02, 0x7B, 0x04},
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getOwnPropertyNames(result).toString() === "
-            "'1,4294967294,a,4294967295'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === 2"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[0xFFFFFFFF] === 1"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[0xFFFFFFFE] === 3"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[1] === 0"));
-      });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x49, 0x02,
+                      0x3F, 0x01, 0x49, 0x00, 0x3F, 0x01, 0x55, 0xFE, 0xFF,
+                      0xFF, 0xFF, 0x0F, 0x3F, 0x01, 0x49, 0x06, 0x3F, 0x01,
+                      0x53, 0x01, 0x61, 0x3F, 0x01, 0x49, 0x04, 0x3F, 0x01,
+                      0x53, 0x0A, 0x34, 0x32, 0x39, 0x34, 0x39, 0x36, 0x37,
+                      0x32, 0x39, 0x35, 0x3F, 0x01, 0x49, 0x02, 0x7B, 0x04});
+  ExpectScriptTrue(
+      "Object.getOwnPropertyNames(result).toString() === "
+      "'1,4294967294,a,4294967295'");
+  ExpectScriptTrue("result.a === 2");
+  ExpectScriptTrue("result[0xFFFFFFFF] === 1");
+  ExpectScriptTrue("result[0xFFFFFFFE] === 3");
+  ExpectScriptTrue("result[1] === 0");
+
   // This detects a fairly subtle case: the object itself must be in the map
   // before its properties are deserialized, so that references to it can be
   // resolved.
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x04, 0x73,
-       0x65, 0x6C, 0x66, 0x3F, 0x01, 0x5E, 0x00, 0x7B, 0x01, 0x00},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsObject());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result === result.self"));
-      });
+  value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x04, 0x73,
+                  0x65, 0x6C, 0x66, 0x3F, 0x01, 0x5E, 0x00, 0x7B, 0x01, 0x00});
+  ASSERT_TRUE(value->IsObject());
+  ExpectScriptTrue("result === result.self");
 }
 
 TEST_F(ValueSerializerTest, InvalidDecodeObjectWithInvalidKeyType) {
@@ -701,89 +691,72 @@ TEST_F(ValueSerializerTest, InvalidDecodeObjectWithInvalidKeyType) {
 
 TEST_F(ValueSerializerTest, RoundTripOnlyOwnEnumerableStringKeys) {
   // Only "own" properties should be serialized, not ones on the prototype.
-  RoundTripTest("(() => { var x = {}; x.__proto__ = {a: 4}; return x; })()",
-                [this](Local<Value> value) {
-                  EXPECT_TRUE(EvaluateScriptForResultBool("!('a' in result)"));
-                });
+  Local<Value> value = RoundTripTest("var x = {}; x.__proto__ = {a: 4}; x;");
+  ExpectScriptTrue("!('a' in result)");
+
   // Only enumerable properties should be serialized.
-  RoundTripTest(
-      "(() => {"
-      "  var x = {};"
-      "  Object.defineProperty(x, 'a', {value: 1, enumerable: false});"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("!('a' in result)"));
-      });
+  value = RoundTripTest(
+      "var x = {};"
+      "Object.defineProperty(x, 'a', {value: 1, enumerable: false});"
+      "x;");
+  ExpectScriptTrue("!('a' in result)");
+
   // Symbol keys should not be serialized.
-  RoundTripTest("({ [Symbol()]: 4 })", [this](Local<Value> value) {
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getOwnPropertySymbols(result).length === 0"));
-  });
+  value = RoundTripTest("({ [Symbol()]: 4 })");
+  ExpectScriptTrue("Object.getOwnPropertySymbols(result).length === 0");
 }
 
 TEST_F(ValueSerializerTest, RoundTripTrickyGetters) {
   // Keys are enumerated before any setters are called, but if there is no own
   // property when the value is to be read, then it should not be serialized.
-  RoundTripTest("({ get a() { delete this.b; return 1; }, b: 2 })",
-                [this](Local<Value> value) {
-                  EXPECT_TRUE(EvaluateScriptForResultBool("!('b' in result)"));
-                });
+  Local<Value> value =
+      RoundTripTest("({ get a() { delete this.b; return 1; }, b: 2 })");
+  ExpectScriptTrue("!('b' in result)");
+
   // Keys added after the property enumeration should not be serialized.
-  RoundTripTest("({ get a() { this.b = 3; }})", [this](Local<Value> value) {
-    EXPECT_TRUE(EvaluateScriptForResultBool("!('b' in result)"));
-  });
+  value = RoundTripTest("({ get a() { this.b = 3; }})");
+  ExpectScriptTrue("!('b' in result)");
+
   // But if you remove a key and add it back, that's fine. But it will appear in
   // the original place in enumeration order.
-  RoundTripTest(
-      "({ get a() { delete this.b; this.b = 4; }, b: 2, c: 3 })",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getOwnPropertyNames(result).toString() === 'a,b,c'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.b === 4"));
-      });
+  value =
+      RoundTripTest("({ get a() { delete this.b; this.b = 4; }, b: 2, c: 3 })");
+  ExpectScriptTrue("Object.getOwnPropertyNames(result).toString() === 'a,b,c'");
+  ExpectScriptTrue("result.b === 4");
+
   // Similarly, it only matters if a property was enumerable when the
   // enumeration happened.
-  RoundTripTest(
+  value = RoundTripTest(
       "({ get a() {"
       "    Object.defineProperty(this, 'b', {value: 2, enumerable: false});"
-      "}, b: 1})",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.b === 2"));
-      });
-  RoundTripTest(
-      "(() => {"
-      "  var x = {"
-      "    get a() {"
-      "      Object.defineProperty(this, 'b', {value: 2, enumerable: true});"
-      "    }"
-      "  };"
-      "  Object.defineProperty(x, 'b',"
-      "      {value: 1, enumerable: false, configurable: true});"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("!('b' in result)"));
-      });
+      "}, b: 1})");
+  ExpectScriptTrue("result.b === 2");
+
+  value = RoundTripTest(
+      "var x = {"
+      "  get a() {"
+      "    Object.defineProperty(this, 'b', {value: 2, enumerable: true});"
+      "  }"
+      "};"
+      "Object.defineProperty(x, 'b',"
+      "    {value: 1, enumerable: false, configurable: true});"
+      "x;");
+  ExpectScriptTrue("!('b' in result)");
+
   // The property also should not be read if it can only be found on the
   // prototype chain (but not as an own property) after enumeration.
-  RoundTripTest(
-      "(() => {"
-      "  var x = { get a() { delete this.b; }, b: 1 };"
-      "  x.__proto__ = { b: 0 };"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("!('b' in result)"));
-      });
+  value = RoundTripTest(
+      "var x = { get a() { delete this.b; }, b: 1 };"
+      "x.__proto__ = { b: 0 };"
+      "x;");
+  ExpectScriptTrue("!('b' in result)");
+
   // If an exception is thrown by script, encoding must fail and the exception
   // must be thrown.
-  InvalidEncodeTest("({ get a() { throw new Error('sentinel'); } })",
-                    [this](Local<Message> message) {
-                      ASSERT_FALSE(message.IsEmpty());
-                      EXPECT_NE(std::string::npos,
-                                Utf8Value(message->Get()).find("sentinel"));
-                    });
+  Local<Message> message =
+      InvalidEncodeTest("({ get a() { throw new Error('sentinel'); } })");
+  ASSERT_FALSE(message.IsEmpty());
+  EXPECT_NE(std::string::npos, Utf8Value(message->Get()).find("sentinel"));
 }
 
 TEST_F(ValueSerializerTest, RoundTripDictionaryObjectForTransitions) {
@@ -813,234 +786,186 @@ TEST_F(ValueSerializerTest, RoundTripDictionaryObjectForTransitions) {
 
 TEST_F(ValueSerializerTest, DecodeDictionaryObjectVersion0) {
   // Empty object.
-  DecodeTestForVersion0(
-      {0x7B, 0x00}, [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsObject());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getPrototypeOf(result) === Object.prototype"));
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getOwnPropertyNames(result).length === 0"));
-      });
+  Local<Value> value = DecodeTestForVersion0({0x7B, 0x00});
+  ASSERT_TRUE(value->IsObject());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Object.prototype");
+  ExpectScriptTrue("Object.getOwnPropertyNames(result).length === 0");
+
   // String key.
-  DecodeTestForVersion0(
-      {0x53, 0x01, 0x61, 0x49, 0x54, 0x7B, 0x01, 0x00},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsObject());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getPrototypeOf(result) === Object.prototype"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.hasOwnProperty('a')"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === 42"));
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getOwnPropertyNames(result).length === 1"));
-      });
+  value =
+      DecodeTestForVersion0({0x53, 0x01, 0x61, 0x49, 0x54, 0x7B, 0x01, 0x00});
+  ASSERT_TRUE(value->IsObject());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Object.prototype");
+  ExpectScriptTrue("result.hasOwnProperty('a')");
+  ExpectScriptTrue("result.a === 42");
+  ExpectScriptTrue("Object.getOwnPropertyNames(result).length === 1");
+
   // Integer key (treated as a string, but may be encoded differently).
-  DecodeTestForVersion0(
-      {0x49, 0x54, 0x53, 0x01, 0x61, 0x7B, 0x01, 0x00},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsObject());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.hasOwnProperty('42')"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[42] === 'a'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getOwnPropertyNames(result).length === 1"));
-      });
+  value =
+      DecodeTestForVersion0({0x49, 0x54, 0x53, 0x01, 0x61, 0x7B, 0x01, 0x00});
+  ASSERT_TRUE(value->IsObject());
+  ExpectScriptTrue("result.hasOwnProperty('42')");
+  ExpectScriptTrue("result[42] === 'a'");
+  ExpectScriptTrue("Object.getOwnPropertyNames(result).length === 1");
+
   // Key order must be preserved.
-  DecodeTestForVersion0(
-      {0x53, 0x01, 0x78, 0x49, 0x02, 0x53, 0x01, 0x79, 0x49, 0x04, 0x53, 0x01,
-       0x61, 0x49, 0x06, 0x7B, 0x03, 0x00},
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getOwnPropertyNames(result).toString() === 'x,y,a'"));
-      });
+  value = DecodeTestForVersion0({0x53, 0x01, 0x78, 0x49, 0x02, 0x53, 0x01, 0x79,
+                                 0x49, 0x04, 0x53, 0x01, 0x61, 0x49, 0x06, 0x7B,
+                                 0x03, 0x00});
+  ExpectScriptTrue("Object.getOwnPropertyNames(result).toString() === 'x,y,a'");
+
   // A property and an element.
-  DecodeTestForVersion0(
-      {0x49, 0x54, 0x53, 0x01, 0x61, 0x53, 0x01, 0x61, 0x49, 0x54, 0x7B, 0x02},
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getOwnPropertyNames(result).toString() === '42,a'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[42] === 'a'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === 42"));
-      });
+  value = DecodeTestForVersion0(
+      {0x49, 0x54, 0x53, 0x01, 0x61, 0x53, 0x01, 0x61, 0x49, 0x54, 0x7B, 0x02});
+  ExpectScriptTrue("Object.getOwnPropertyNames(result).toString() === '42,a'");
+  ExpectScriptTrue("result[42] === 'a'");
+  ExpectScriptTrue("result.a === 42");
 }
 
 TEST_F(ValueSerializerTest, RoundTripArray) {
   // A simple array of integers.
-  RoundTripTest("[1, 2, 3, 4, 5]", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsArray());
-    EXPECT_EQ(5u, Array::Cast(*value)->Length());
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === Array.prototype"));
-    EXPECT_TRUE(
-        EvaluateScriptForResultBool("result.toString() === '1,2,3,4,5'"));
-  });
+  Local<Value> value = RoundTripTest("[1, 2, 3, 4, 5]");
+  ASSERT_TRUE(value->IsArray());
+  EXPECT_EQ(5u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Array.prototype");
+  ExpectScriptTrue("result.toString() === '1,2,3,4,5'");
+
   // A long (sparse) array.
-  RoundTripTest(
-      "(() => { var x = new Array(1000); x[500] = 42; return x; })()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        EXPECT_EQ(1000u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[500] === 42"));
-      });
+  value = RoundTripTest("var x = new Array(1000); x[500] = 42; x;");
+  ASSERT_TRUE(value->IsArray());
+  EXPECT_EQ(1000u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[500] === 42");
+
   // Duplicate reference.
-  RoundTripTest(
-      "(() => { var y = {}; return [y, y]; })()", [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(2u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[0] === result[1]"));
-      });
+  value = RoundTripTest("var y = {}; [y, y];");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(2u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[0] === result[1]");
+
   // Duplicate reference in a sparse array.
-  RoundTripTest(
-      "(() => { var x = new Array(1000); x[1] = x[500] = {}; return x; })()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(1000u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("typeof result[1] === 'object'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[1] === result[500]"));
-      });
+  value = RoundTripTest("var x = new Array(1000); x[1] = x[500] = {}; x;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(1000u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("typeof result[1] === 'object'");
+  ExpectScriptTrue("result[1] === result[500]");
+
   // Self reference.
-  RoundTripTest(
-      "(() => { var y = []; y[0] = y; return y; })()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(1u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[0] === result"));
-      });
+  value = RoundTripTest("var y = []; y[0] = y; y;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(1u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[0] === result");
+
   // Self reference in a sparse array.
-  RoundTripTest(
-      "(() => { var y = new Array(1000); y[519] = y; return y; })()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(1000u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[519] === result"));
-      });
+  value = RoundTripTest("var y = new Array(1000); y[519] = y; y;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(1000u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[519] === result");
+
   // Array with additional properties.
-  RoundTripTest(
-      "(() => { var y = [1, 2]; y.foo = 'bar'; return y; })()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(2u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.toString() === '1,2'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.foo === 'bar'"));
-      });
+  value = RoundTripTest("var y = [1, 2]; y.foo = 'bar'; y;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(2u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result.toString() === '1,2'");
+  ExpectScriptTrue("result.foo === 'bar'");
+
   // Sparse array with additional properties.
-  RoundTripTest(
-      "(() => { var y = new Array(1000); y.foo = 'bar'; return y; })()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(1000u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "result.toString() === ','.repeat(999)"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.foo === 'bar'"));
-      });
+  value = RoundTripTest("var y = new Array(1000); y.foo = 'bar'; y;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(1000u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result.toString() === ','.repeat(999)");
+  ExpectScriptTrue("result.foo === 'bar'");
+
   // The distinction between holes and undefined elements must be maintained.
-  RoundTripTest("[,undefined]", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsArray());
-    ASSERT_EQ(2u, Array::Cast(*value)->Length());
-    EXPECT_TRUE(
-        EvaluateScriptForResultBool("typeof result[0] === 'undefined'"));
-    EXPECT_TRUE(
-        EvaluateScriptForResultBool("typeof result[1] === 'undefined'"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("!result.hasOwnProperty(0)"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.hasOwnProperty(1)"));
-  });
+  value = RoundTripTest("[,undefined]");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(2u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("typeof result[0] === 'undefined'");
+  ExpectScriptTrue("typeof result[1] === 'undefined'");
+  ExpectScriptTrue("!result.hasOwnProperty(0)");
+  ExpectScriptTrue("result.hasOwnProperty(1)");
 }
 
 TEST_F(ValueSerializerTest, DecodeArray) {
   // A simple array of integers.
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x41, 0x05, 0x3F, 0x01, 0x49, 0x02,
-              0x3F, 0x01, 0x49, 0x04, 0x3F, 0x01, 0x49, 0x06, 0x3F, 0x01,
-              0x49, 0x08, 0x3F, 0x01, 0x49, 0x0A, 0x24, 0x00, 0x05, 0x00},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsArray());
-               EXPECT_EQ(5u, Array::Cast(*value)->Length());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Array.prototype"));
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.toString() === '1,2,3,4,5'"));
-             });
+  Local<Value> value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x41, 0x05, 0x3F, 0x01, 0x49, 0x02,
+                  0x3F, 0x01, 0x49, 0x04, 0x3F, 0x01, 0x49, 0x06, 0x3F, 0x01,
+                  0x49, 0x08, 0x3F, 0x01, 0x49, 0x0A, 0x24, 0x00, 0x05, 0x00});
+  ASSERT_TRUE(value->IsArray());
+  EXPECT_EQ(5u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Array.prototype");
+  ExpectScriptTrue("result.toString() === '1,2,3,4,5'");
+
   // A long (sparse) array.
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x61, 0xE8, 0x07, 0x3F, 0x01, 0x49,
-              0xE8, 0x07, 0x3F, 0x01, 0x49, 0x54, 0x40, 0x01, 0xE8, 0x07},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsArray());
-               EXPECT_EQ(1000u, Array::Cast(*value)->Length());
-               EXPECT_TRUE(EvaluateScriptForResultBool("result[500] === 42"));
-             });
+  value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x61, 0xE8, 0x07, 0x3F, 0x01, 0x49,
+                  0xE8, 0x07, 0x3F, 0x01, 0x49, 0x54, 0x40, 0x01, 0xE8, 0x07});
+  ASSERT_TRUE(value->IsArray());
+  EXPECT_EQ(1000u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[500] === 42");
+
   // Duplicate reference.
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x41, 0x02, 0x3F, 0x01, 0x6F, 0x7B, 0x00, 0x3F,
-       0x02, 0x5E, 0x01, 0x24, 0x00, 0x02},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(2u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[0] === result[1]"));
-      });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x41, 0x02, 0x3F, 0x01, 0x6F,
+                      0x7B, 0x00, 0x3F, 0x02, 0x5E, 0x01, 0x24, 0x00, 0x02});
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(2u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[0] === result[1]");
+
   // Duplicate reference in a sparse array.
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x61, 0xE8, 0x07, 0x3F, 0x01, 0x49,
-       0x02, 0x3F, 0x01, 0x6F, 0x7B, 0x00, 0x3F, 0x02, 0x49, 0xE8,
-       0x07, 0x3F, 0x02, 0x5E, 0x01, 0x40, 0x02, 0xE8, 0x07, 0x00},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(1000u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("typeof result[1] === 'object'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[1] === result[500]"));
-      });
+  value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x61, 0xE8, 0x07, 0x3F, 0x01, 0x49,
+                  0x02, 0x3F, 0x01, 0x6F, 0x7B, 0x00, 0x3F, 0x02, 0x49, 0xE8,
+                  0x07, 0x3F, 0x02, 0x5E, 0x01, 0x40, 0x02, 0xE8, 0x07, 0x00});
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(1000u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("typeof result[1] === 'object'");
+  ExpectScriptTrue("result[1] === result[500]");
+
   // Self reference.
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x41, 0x01, 0x3F, 0x01, 0x5E, 0x00, 0x24,
-              0x00, 0x01, 0x00},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsArray());
-               ASSERT_EQ(1u, Array::Cast(*value)->Length());
-               EXPECT_TRUE(EvaluateScriptForResultBool("result[0] === result"));
-             });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x41, 0x01, 0x3F, 0x01, 0x5E,
+                      0x00, 0x24, 0x00, 0x01, 0x00});
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(1u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[0] === result");
+
   // Self reference in a sparse array.
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x61, 0xE8, 0x07, 0x3F, 0x01, 0x49,
-       0x8E, 0x08, 0x3F, 0x01, 0x5E, 0x00, 0x40, 0x01, 0xE8, 0x07},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(1000u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[519] === result"));
-      });
+  value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x61, 0xE8, 0x07, 0x3F, 0x01, 0x49,
+                  0x8E, 0x08, 0x3F, 0x01, 0x5E, 0x00, 0x40, 0x01, 0xE8, 0x07});
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(1000u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[519] === result");
+
   // Array with additional properties.
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x41, 0x02, 0x3F, 0x01, 0x49, 0x02, 0x3F,
-       0x01, 0x49, 0x04, 0x3F, 0x01, 0x53, 0x03, 0x66, 0x6F, 0x6F, 0x3F,
-       0x01, 0x53, 0x03, 0x62, 0x61, 0x72, 0x24, 0x01, 0x02, 0x00},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(2u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.toString() === '1,2'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.foo === 'bar'"));
-      });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x41, 0x02, 0x3F, 0x01,
+                      0x49, 0x02, 0x3F, 0x01, 0x49, 0x04, 0x3F, 0x01,
+                      0x53, 0x03, 0x66, 0x6F, 0x6F, 0x3F, 0x01, 0x53,
+                      0x03, 0x62, 0x61, 0x72, 0x24, 0x01, 0x02, 0x00});
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(2u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result.toString() === '1,2'");
+  ExpectScriptTrue("result.foo === 'bar'");
+
   // Sparse array with additional properties.
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x61, 0xE8, 0x07, 0x3F, 0x01,
-              0x53, 0x03, 0x66, 0x6F, 0x6F, 0x3F, 0x01, 0x53, 0x03,
-              0x62, 0x61, 0x72, 0x40, 0x01, 0xE8, 0x07, 0x00},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsArray());
-               ASSERT_EQ(1000u, Array::Cast(*value)->Length());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.toString() === ','.repeat(999)"));
-               EXPECT_TRUE(EvaluateScriptForResultBool("result.foo === 'bar'"));
-             });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x61, 0xE8, 0x07, 0x3F, 0x01,
+                      0x53, 0x03, 0x66, 0x6F, 0x6F, 0x3F, 0x01, 0x53, 0x03,
+                      0x62, 0x61, 0x72, 0x40, 0x01, 0xE8, 0x07, 0x00});
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(1000u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result.toString() === ','.repeat(999)");
+  ExpectScriptTrue("result.foo === 'bar'");
+
   // The distinction between holes and undefined elements must be maintained.
   // Note that since the previous output from Chrome fails this test, an
   // encoding using the sparse format was constructed instead.
-  DecodeTest(
-      {0xFF, 0x09, 0x61, 0x02, 0x49, 0x02, 0x5F, 0x40, 0x01, 0x02},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(2u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("typeof result[0] === 'undefined'"));
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("typeof result[1] === 'undefined'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("!result.hasOwnProperty(0)"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.hasOwnProperty(1)"));
-      });
+  value =
+      DecodeTest({0xFF, 0x09, 0x61, 0x02, 0x49, 0x02, 0x5F, 0x40, 0x01, 0x02});
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(2u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("typeof result[0] === 'undefined'");
+  ExpectScriptTrue("typeof result[1] === 'undefined'");
+  ExpectScriptTrue("!result.hasOwnProperty(0)");
+  ExpectScriptTrue("result.hasOwnProperty(1)");
 }
 
 TEST_F(ValueSerializerTest, DecodeInvalidOverLargeArray) {
@@ -1055,375 +980,285 @@ TEST_F(ValueSerializerTest, RoundTripArrayWithNonEnumerableElement) {
   // Even though this array looks like [1,5,3], the 5 should be missing from the
   // perspective of structured clone, which only clones properties that were
   // enumerable.
-  RoundTripTest(
-      "(() => {"
-      "  var x = [1,2,3];"
-      "  Object.defineProperty(x, '1', {enumerable:false, value:5});"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(3u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("!result.hasOwnProperty('1')"));
-      });
+  Local<Value> value = RoundTripTest(
+      "var x = [1,2,3];"
+      "Object.defineProperty(x, '1', {enumerable:false, value:5});"
+      "x;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(3u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("!result.hasOwnProperty('1')");
 }
 
 TEST_F(ValueSerializerTest, RoundTripArrayWithTrickyGetters) {
   // If an element is deleted before it is serialized, then it's deleted.
-  RoundTripTest(
-      "(() => {"
-      "  var x = [{ get a() { delete x[1]; }}, 42];"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(2u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("typeof result[1] === 'undefined'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("!result.hasOwnProperty(1)"));
-      });
+  Local<Value> value =
+      RoundTripTest("var x = [{ get a() { delete x[1]; }}, 42]; x;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(2u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("typeof result[1] === 'undefined'");
+  ExpectScriptTrue("!result.hasOwnProperty(1)");
+
   // Same for sparse arrays.
-  RoundTripTest(
-      "(() => {"
-      "  var x = [{ get a() { delete x[1]; }}, 42];"
-      "  x.length = 1000;"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(1000u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("typeof result[1] === 'undefined'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("!result.hasOwnProperty(1)"));
-      });
+  value = RoundTripTest(
+      "var x = [{ get a() { delete x[1]; }}, 42];"
+      "x.length = 1000;"
+      "x;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(1000u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("typeof result[1] === 'undefined'");
+  ExpectScriptTrue("!result.hasOwnProperty(1)");
+
   // If the length is changed, then the resulting array still has the original
   // length, but elements that were not yet serialized are gone.
-  RoundTripTest(
-      "(() => {"
-      "  var x = [1, { get a() { x.length = 0; }}, 3, 4];"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(4u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[0] === 1"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("!result.hasOwnProperty(2)"));
-      });
+  value = RoundTripTest("var x = [1, { get a() { x.length = 0; }}, 3, 4]; x;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(4u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[0] === 1");
+  ExpectScriptTrue("!result.hasOwnProperty(2)");
+
   // The same is true if the length is shortened, but there are still items
   // remaining.
-  RoundTripTest(
-      "(() => {"
-      "  var x = [1, { get a() { x.length = 3; }}, 3, 4];"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(4u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[2] === 3"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("!result.hasOwnProperty(3)"));
-      });
+  value = RoundTripTest("var x = [1, { get a() { x.length = 3; }}, 3, 4]; x;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(4u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[2] === 3");
+  ExpectScriptTrue("!result.hasOwnProperty(3)");
+
   // Same for sparse arrays.
-  RoundTripTest(
-      "(() => {"
-      "  var x = [1, { get a() { x.length = 0; }}, 3, 4];"
-      "  x.length = 1000;"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(1000u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[0] === 1"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("!result.hasOwnProperty(2)"));
-      });
-  RoundTripTest(
-      "(() => {"
-      "  var x = [1, { get a() { x.length = 3; }}, 3, 4];"
-      "  x.length = 1000;"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(1000u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[2] === 3"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("!result.hasOwnProperty(3)"));
-      });
+  value = RoundTripTest(
+      "var x = [1, { get a() { x.length = 0; }}, 3, 4];"
+      "x.length = 1000;"
+      "x;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(1000u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[0] === 1");
+  ExpectScriptTrue("!result.hasOwnProperty(2)");
+
+  value = RoundTripTest(
+      "var x = [1, { get a() { x.length = 3; }}, 3, 4];"
+      "x.length = 1000;"
+      "x;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(1000u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[2] === 3");
+  ExpectScriptTrue("!result.hasOwnProperty(3)");
+
   // If a getter makes a property non-enumerable, it should still be enumerated
   // as enumeration happens once before getters are invoked.
-  RoundTripTest(
-      "(() => {"
-      "  var x = [{ get a() {"
-      "    Object.defineProperty(x, '1', { value: 3, enumerable: false });"
-      "  }}, 2];"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(2u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[1] === 3"));
-      });
+  value = RoundTripTest(
+      "var x = [{ get a() {"
+      "  Object.defineProperty(x, '1', { value: 3, enumerable: false });"
+      "}}, 2];"
+      "x;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(2u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[1] === 3");
+
   // Same for sparse arrays.
-  RoundTripTest(
-      "(() => {"
-      "  var x = [{ get a() {"
-      "    Object.defineProperty(x, '1', { value: 3, enumerable: false });"
-      "  }}, 2];"
-      "  x.length = 1000;"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(1000u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[1] === 3"));
-      });
+  value = RoundTripTest(
+      "var x = [{ get a() {"
+      "  Object.defineProperty(x, '1', { value: 3, enumerable: false });"
+      "}}, 2];"
+      "x.length = 1000;"
+      "x;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(1000u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[1] === 3");
+
   // Getters on the array itself must also run.
-  RoundTripTest(
-      "(() => {"
-      "  var x = [1, 2, 3];"
-      "  Object.defineProperty(x, '1', { enumerable: true, get: () => 4 });"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(3u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[1] === 4"));
-      });
+  value = RoundTripTest(
+      "var x = [1, 2, 3];"
+      "Object.defineProperty(x, '1', { enumerable: true, get: () => 4 });"
+      "x;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(3u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[1] === 4");
+
   // Same for sparse arrays.
-  RoundTripTest(
-      "(() => {"
-      "  var x = [1, 2, 3];"
-      "  Object.defineProperty(x, '1', { enumerable: true, get: () => 4 });"
-      "  x.length = 1000;"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(1000u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[1] === 4"));
-      });
+  value = RoundTripTest(
+      "var x = [1, 2, 3];"
+      "Object.defineProperty(x, '1', { enumerable: true, get: () => 4 });"
+      "x.length = 1000;"
+      "x;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(1000u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result[1] === 4");
+
   // Even with a getter that deletes things, we don't read from the prototype.
-  RoundTripTest(
-      "(() => {"
-      "  var x = [{ get a() { delete x[1]; } }, 2];"
-      "  x.__proto__ = Object.create(Array.prototype, { 1: { value: 6 } });"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(2u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("!(1 in result)"));
-      });
+  value = RoundTripTest(
+      "var x = [{ get a() { delete x[1]; } }, 2];"
+      "x.__proto__ = Object.create(Array.prototype, { 1: { value: 6 } });"
+      "x;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(2u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("!(1 in result)");
+
   // Same for sparse arrays.
-  RoundTripTest(
-      "(() => {"
-      "  var x = [{ get a() { delete x[1]; } }, 2];"
-      "  x.__proto__ = Object.create(Array.prototype, { 1: { value: 6 } });"
-      "  x.length = 1000;"
-      "  return x;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        ASSERT_EQ(1000u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("!(1 in result)"));
-      });
+  value = RoundTripTest(
+      "var x = [{ get a() { delete x[1]; } }, 2];"
+      "x.__proto__ = Object.create(Array.prototype, { 1: { value: 6 } });"
+      "x.length = 1000;"
+      "x;");
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(1000u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("!(1 in result)");
 }
 
 TEST_F(ValueSerializerTest, DecodeSparseArrayVersion0) {
   // Empty (sparse) array.
-  DecodeTestForVersion0({0x40, 0x00, 0x00, 0x00},
-                        [](Local<Value> value) {
-                          ASSERT_TRUE(value->IsArray());
-                          ASSERT_EQ(0u, Array::Cast(*value)->Length());
-                        });
+  Local<Value> value = DecodeTestForVersion0({0x40, 0x00, 0x00, 0x00});
+  ASSERT_TRUE(value->IsArray());
+  ASSERT_EQ(0u, Array::Cast(*value)->Length());
+
   // Sparse array with a mixture of elements and properties.
-  DecodeTestForVersion0(
-      {0x55, 0x00, 0x53, 0x01, 'a',  0x55, 0x02, 0x55, 0x05, 0x53,
-       0x03, 'f',  'o',  'o',  0x53, 0x03, 'b',  'a',  'r',  0x53,
-       0x03, 'b',  'a',  'z',  0x49, 0x0B, 0x40, 0x04, 0x03, 0x00},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        EXPECT_EQ(3u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("result.toString() === 'a,,5'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("!(1 in result)"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.foo === 'bar'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.baz === -6"));
-      });
+  value = DecodeTestForVersion0({0x55, 0x00, 0x53, 0x01, 'a',  0x55, 0x02, 0x55,
+                                 0x05, 0x53, 0x03, 'f',  'o',  'o',  0x53, 0x03,
+                                 'b',  'a',  'r',  0x53, 0x03, 'b',  'a',  'z',
+                                 0x49, 0x0B, 0x40, 0x04, 0x03, 0x00});
+  ASSERT_TRUE(value->IsArray());
+  EXPECT_EQ(3u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result.toString() === 'a,,5'");
+  ExpectScriptTrue("!(1 in result)");
+  ExpectScriptTrue("result.foo === 'bar'");
+  ExpectScriptTrue("result.baz === -6");
+
   // Sparse array in a sparse array (sanity check of nesting).
-  DecodeTestForVersion0(
-      {0x55, 0x01, 0x55, 0x01, 0x54, 0x40, 0x01, 0x02, 0x40, 0x01, 0x02, 0x00},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsArray());
-        EXPECT_EQ(2u, Array::Cast(*value)->Length());
-        EXPECT_TRUE(EvaluateScriptForResultBool("!(0 in result)"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[1] instanceof Array"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("!(0 in result[1])"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[1][1] === true"));
-      });
+  value = DecodeTestForVersion0(
+      {0x55, 0x01, 0x55, 0x01, 0x54, 0x40, 0x01, 0x02, 0x40, 0x01, 0x02, 0x00});
+  ASSERT_TRUE(value->IsArray());
+  EXPECT_EQ(2u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("!(0 in result)");
+  ExpectScriptTrue("result[1] instanceof Array");
+  ExpectScriptTrue("!(0 in result[1])");
+  ExpectScriptTrue("result[1][1] === true");
 }
 
 TEST_F(ValueSerializerTest, RoundTripDenseArrayContainingUndefined) {
   // In previous serialization versions, this would be interpreted as an absent
   // property.
-  RoundTripTest("[undefined]", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsArray());
-    EXPECT_EQ(1u, Array::Cast(*value)->Length());
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.hasOwnProperty(0)"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result[0] === undefined"));
-  });
+  Local<Value> value = RoundTripTest("[undefined]");
+  ASSERT_TRUE(value->IsArray());
+  EXPECT_EQ(1u, Array::Cast(*value)->Length());
+  ExpectScriptTrue("result.hasOwnProperty(0)");
+  ExpectScriptTrue("result[0] === undefined");
 }
 
 TEST_F(ValueSerializerTest, DecodeDenseArrayContainingUndefined) {
   // In previous versions, "undefined" in a dense array signified absence of the
   // element (for compatibility). In new versions, it has a separate encoding.
-  DecodeTest({0xFF, 0x09, 0x41, 0x01, 0x5F, 0x24, 0x00, 0x01},
-             [this](Local<Value> value) {
-               EXPECT_TRUE(EvaluateScriptForResultBool("!(0 in result)"));
-             });
-  DecodeTest(
-      {0xFF, 0x0B, 0x41, 0x01, 0x5F, 0x24, 0x00, 0x01},
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("0 in result"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result[0] === undefined"));
-      });
-  DecodeTest({0xFF, 0x0B, 0x41, 0x01, 0x2D, 0x24, 0x00, 0x01},
-             [this](Local<Value> value) {
-               EXPECT_TRUE(EvaluateScriptForResultBool("!(0 in result)"));
-             });
+  Local<Value> value =
+      DecodeTest({0xFF, 0x09, 0x41, 0x01, 0x5F, 0x24, 0x00, 0x01});
+  ExpectScriptTrue("!(0 in result)");
+
+  value = DecodeTest({0xFF, 0x0B, 0x41, 0x01, 0x5F, 0x24, 0x00, 0x01});
+  ExpectScriptTrue("0 in result");
+  ExpectScriptTrue("result[0] === undefined");
+
+  value = DecodeTest({0xFF, 0x0B, 0x41, 0x01, 0x2D, 0x24, 0x00, 0x01});
+  ExpectScriptTrue("!(0 in result)");
 }
 
 TEST_F(ValueSerializerTest, RoundTripDate) {
-  RoundTripTest("new Date(1e6)", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsDate());
-    EXPECT_EQ(1e6, Date::Cast(*value)->ValueOf());
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === Date.prototype"));
-  });
-  RoundTripTest("new Date(Date.UTC(1867, 6, 1))", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsDate());
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "result.toISOString() === '1867-07-01T00:00:00.000Z'"));
-  });
-  RoundTripTest("new Date(NaN)", [](Local<Value> value) {
-    ASSERT_TRUE(value->IsDate());
-    EXPECT_TRUE(std::isnan(Date::Cast(*value)->ValueOf()));
-  });
-  RoundTripTest(
-      "({ a: new Date(), get b() { return this.a; } })",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a instanceof Date"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-      });
+  Local<Value> value = RoundTripTest("new Date(1e6)");
+  ASSERT_TRUE(value->IsDate());
+  EXPECT_EQ(1e6, Date::Cast(*value)->ValueOf());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Date.prototype");
+
+  value = RoundTripTest("new Date(Date.UTC(1867, 6, 1))");
+  ASSERT_TRUE(value->IsDate());
+  ExpectScriptTrue("result.toISOString() === '1867-07-01T00:00:00.000Z'");
+
+  value = RoundTripTest("new Date(NaN)");
+  ASSERT_TRUE(value->IsDate());
+  EXPECT_TRUE(std::isnan(Date::Cast(*value)->ValueOf()));
+
+  value = RoundTripTest("({ a: new Date(), get b() { return this.a; } })");
+  ExpectScriptTrue("result.a instanceof Date");
+  ExpectScriptTrue("result.a === result.b");
 }
 
 TEST_F(ValueSerializerTest, DecodeDate) {
+  Local<Value> value;
 #if defined(V8_TARGET_LITTLE_ENDIAN)
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x80, 0x84,
-              0x2E, 0x41, 0x00},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsDate());
-               EXPECT_EQ(1e6, Date::Cast(*value)->ValueOf());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Date.prototype"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x44, 0x00, 0x00, 0x20, 0x45, 0x27, 0x89,
-              0x87, 0xC2, 0x00},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsDate());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.toISOString() === '1867-07-01T00:00:00.000Z'"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-              0xF8, 0x7F, 0x00},
-             [](Local<Value> value) {
-               ASSERT_TRUE(value->IsDate());
-               EXPECT_TRUE(std::isnan(Date::Cast(*value)->ValueOf()));
-             });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00,
+                      0x80, 0x84, 0x2E, 0x41, 0x00});
+  ASSERT_TRUE(value->IsDate());
+  EXPECT_EQ(1e6, Date::Cast(*value)->ValueOf());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Date.prototype");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x44, 0x00, 0x00, 0x20, 0x45,
+                      0x27, 0x89, 0x87, 0xC2, 0x00});
+  ASSERT_TRUE(value->IsDate());
+  ExpectScriptTrue("result.toISOString() === '1867-07-01T00:00:00.000Z'");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00,
+                      0x00, 0x00, 0xF8, 0x7F, 0x00});
+  ASSERT_TRUE(value->IsDate());
+  EXPECT_TRUE(std::isnan(Date::Cast(*value)->ValueOf()));
 #else
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x44, 0x41, 0x2E, 0x84, 0x80, 0x00, 0x00,
-              0x00, 0x00, 0x00},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsDate());
-               EXPECT_EQ(1e6, Date::Cast(*value)->ValueOf());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Date.prototype"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x44, 0xC2, 0x87, 0x89, 0x27, 0x45, 0x20,
-              0x00, 0x00, 0x00},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsDate());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.toISOString() === '1867-07-01T00:00:00.000Z'"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x44, 0x7F, 0xF8, 0x00, 0x00, 0x00, 0x00,
-              0x00, 0x00, 0x00},
-             [](Local<Value> value) {
-               ASSERT_TRUE(value->IsDate());
-               EXPECT_TRUE(std::isnan(Date::Cast(*value)->ValueOf()));
-             });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x44, 0x41, 0x2E, 0x84, 0x80,
+                      0x00, 0x00, 0x00, 0x00, 0x00});
+  ASSERT_TRUE(value->IsDate());
+  EXPECT_EQ(1e6, Date::Cast(*value)->ValueOf());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Date.prototype");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x44, 0xC2, 0x87, 0x89, 0x27,
+                      0x45, 0x20, 0x00, 0x00, 0x00});
+  ASSERT_TRUE(value->IsDate());
+  ExpectScriptTrue("result.toISOString() === '1867-07-01T00:00:00.000Z'");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x44, 0x7F, 0xF8, 0x00, 0x00,
+                      0x00, 0x00, 0x00, 0x00, 0x00});
+  ASSERT_TRUE(value->IsDate());
+  EXPECT_TRUE(std::isnan(Date::Cast(*value)->ValueOf()));
 #endif
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x01, 0x61, 0x3F,
-       0x01, 0x44, 0x00, 0x20, 0x39, 0x50, 0x37, 0x6A, 0x75, 0x42, 0x3F,
-       0x02, 0x53, 0x01, 0x62, 0x3F, 0x02, 0x5E, 0x01, 0x7B, 0x02},
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a instanceof Date"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-      });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53,
+                      0x01, 0x61, 0x3F, 0x01, 0x44, 0x00, 0x20, 0x39,
+                      0x50, 0x37, 0x6A, 0x75, 0x42, 0x3F, 0x02, 0x53,
+                      0x01, 0x62, 0x3F, 0x02, 0x5E, 0x01, 0x7B, 0x02});
+  ExpectScriptTrue("result.a instanceof Date");
+  ExpectScriptTrue("result.a === result.b");
 }
 
 TEST_F(ValueSerializerTest, RoundTripValueObjects) {
-  RoundTripTest("new Boolean(true)", [this](Local<Value> value) {
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === Boolean.prototype"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.valueOf() === true"));
-  });
-  RoundTripTest("new Boolean(false)", [this](Local<Value> value) {
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === Boolean.prototype"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.valueOf() === false"));
-  });
-  RoundTripTest(
-      "({ a: new Boolean(true), get b() { return this.a; }})",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a instanceof Boolean"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-      });
-  RoundTripTest("new Number(-42)", [this](Local<Value> value) {
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === Number.prototype"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.valueOf() === -42"));
-  });
-  RoundTripTest("new Number(NaN)", [this](Local<Value> value) {
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === Number.prototype"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("Number.isNaN(result.valueOf())"));
-  });
-  RoundTripTest(
-      "({ a: new Number(6), get b() { return this.a; }})",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a instanceof Number"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-      });
-  RoundTripTest("new String('Qu\\xe9bec')", [this](Local<Value> value) {
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === String.prototype"));
-    EXPECT_TRUE(
-        EvaluateScriptForResultBool("result.valueOf() === 'Qu\\xe9bec'"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.length === 6"));
-  });
-  RoundTripTest("new String('\\ud83d\\udc4a')", [this](Local<Value> value) {
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === String.prototype"));
-    EXPECT_TRUE(
-        EvaluateScriptForResultBool("result.valueOf() === '\\ud83d\\udc4a'"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.length === 2"));
-  });
-  RoundTripTest(
-      "({ a: new String(), get b() { return this.a; }})",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a instanceof String"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-      });
+  Local<Value> value = RoundTripTest("new Boolean(true)");
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Boolean.prototype");
+  ExpectScriptTrue("result.valueOf() === true");
+
+  value = RoundTripTest("new Boolean(false)");
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Boolean.prototype");
+  ExpectScriptTrue("result.valueOf() === false");
+
+  value =
+      RoundTripTest("({ a: new Boolean(true), get b() { return this.a; }})");
+  ExpectScriptTrue("result.a instanceof Boolean");
+  ExpectScriptTrue("result.a === result.b");
+
+  value = RoundTripTest("new Number(-42)");
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Number.prototype");
+  ExpectScriptTrue("result.valueOf() === -42");
+
+  value = RoundTripTest("new Number(NaN)");
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Number.prototype");
+  ExpectScriptTrue("Number.isNaN(result.valueOf())");
+
+  value = RoundTripTest("({ a: new Number(6), get b() { return this.a; }})");
+  ExpectScriptTrue("result.a instanceof Number");
+  ExpectScriptTrue("result.a === result.b");
+
+  value = RoundTripTest("new String('Qu\\xe9bec')");
+  ExpectScriptTrue("Object.getPrototypeOf(result) === String.prototype");
+  ExpectScriptTrue("result.valueOf() === 'Qu\\xe9bec'");
+  ExpectScriptTrue("result.length === 6");
+
+  value = RoundTripTest("new String('\\ud83d\\udc4a')");
+  ExpectScriptTrue("Object.getPrototypeOf(result) === String.prototype");
+  ExpectScriptTrue("result.valueOf() === '\\ud83d\\udc4a'");
+  ExpectScriptTrue("result.length === 2");
+
+  value = RoundTripTest("({ a: new String(), get b() { return this.a; }})");
+  ExpectScriptTrue("result.a instanceof String");
+  ExpectScriptTrue("result.a === result.b");
 }
 
 TEST_F(ValueSerializerTest, RejectsOtherValueObjects) {
@@ -1432,437 +1267,322 @@ TEST_F(ValueSerializerTest, RejectsOtherValueObjects) {
 }
 
 TEST_F(ValueSerializerTest, DecodeValueObjects) {
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x79, 0x00}, [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getPrototypeOf(result) === Boolean.prototype"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.valueOf() === true"));
-      });
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x78, 0x00}, [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getPrototypeOf(result) === Boolean.prototype"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.valueOf() === false"));
-      });
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x01, 0x61, 0x3F, 0x01,
-       0x79, 0x3F, 0x02, 0x53, 0x01, 0x62, 0x3F, 0x02, 0x5E, 0x01, 0x7B, 0x02},
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a instanceof Boolean"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-      });
+  Local<Value> value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x79, 0x00});
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Boolean.prototype");
+  ExpectScriptTrue("result.valueOf() === true");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x78, 0x00});
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Boolean.prototype");
+  ExpectScriptTrue("result.valueOf() === false");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53,
+                      0x01, 0x61, 0x3F, 0x01, 0x79, 0x3F, 0x02, 0x53,
+                      0x01, 0x62, 0x3F, 0x02, 0x5E, 0x01, 0x7B, 0x02});
+  ExpectScriptTrue("result.a instanceof Boolean");
+  ExpectScriptTrue("result.a === result.b");
+
 #if defined(V8_TARGET_LITTLE_ENDIAN)
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x6E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x45,
-       0xC0, 0x00},
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getPrototypeOf(result) === Number.prototype"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.valueOf() === -42"));
-      });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-              0xF8, 0x7F, 0x00},
-             [this](Local<Value> value) {
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Number.prototype"));
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Number.isNaN(result.valueOf())"));
-             });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6E, 0x00, 0x00, 0x00, 0x00,
+                      0x00, 0x00, 0x45, 0xC0, 0x00});
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Number.prototype");
+  ExpectScriptTrue("result.valueOf() === -42");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6E, 0x00, 0x00, 0x00, 0x00,
+                      0x00, 0x00, 0xF8, 0x7F, 0x00});
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Number.prototype");
+  ExpectScriptTrue("Number.isNaN(result.valueOf())");
 #else
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x6E, 0xC0, 0x45, 0x00, 0x00, 0x00, 0x00, 0x00,
-       0x00, 0x00},
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getPrototypeOf(result) === Number.prototype"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.valueOf() === -42"));
-      });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6E, 0x7F, 0xF8, 0x00, 0x00, 0x00, 0x00,
-              0x00, 0x00, 0x00},
-             [this](Local<Value> value) {
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Number.prototype"));
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Number.isNaN(result.valueOf())"));
-             });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6E, 0xC0, 0x45, 0x00, 0x00,
+                      0x00, 0x00, 0x00, 0x00, 0x00});
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Number.prototype");
+  ExpectScriptTrue("result.valueOf() === -42");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6E, 0x7F, 0xF8, 0x00, 0x00,
+                      0x00, 0x00, 0x00, 0x00, 0x00});
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Number.prototype");
+  ExpectScriptTrue("Number.isNaN(result.valueOf())");
 #endif
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x01, 0x61, 0x3F,
-       0x01, 0x6E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0x40, 0x3F,
-       0x02, 0x53, 0x01, 0x62, 0x3F, 0x02, 0x5E, 0x01, 0x7B, 0x02},
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a instanceof Number"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-      });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x73, 0x07, 0x51, 0x75, 0xC3, 0xA9, 0x62,
-              0x65, 0x63, 0x00},
-             [this](Local<Value> value) {
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === String.prototype"));
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.valueOf() === 'Qu\\xe9bec'"));
-               EXPECT_TRUE(EvaluateScriptForResultBool("result.length === 6"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x73, 0x04, 0xF0, 0x9F, 0x91, 0x8A},
-             [this](Local<Value> value) {
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === String.prototype"));
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.valueOf() === '\\ud83d\\udc4a'"));
-               EXPECT_TRUE(EvaluateScriptForResultBool("result.length === 2"));
-             });
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x01,
-       0x61, 0x3F, 0x01, 0x73, 0x00, 0x3F, 0x02, 0x53, 0x01,
-       0x62, 0x3F, 0x02, 0x5E, 0x01, 0x7B, 0x02, 0x00},
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a instanceof String"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-      });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53,
+                      0x01, 0x61, 0x3F, 0x01, 0x6E, 0x00, 0x00, 0x00,
+                      0x00, 0x00, 0x00, 0x18, 0x40, 0x3F, 0x02, 0x53,
+                      0x01, 0x62, 0x3F, 0x02, 0x5E, 0x01, 0x7B, 0x02});
+  ExpectScriptTrue("result.a instanceof Number");
+  ExpectScriptTrue("result.a === result.b");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x73, 0x07, 0x51, 0x75, 0xC3,
+                      0xA9, 0x62, 0x65, 0x63, 0x00});
+  ExpectScriptTrue("Object.getPrototypeOf(result) === String.prototype");
+  ExpectScriptTrue("result.valueOf() === 'Qu\\xe9bec'");
+  ExpectScriptTrue("result.length === 6");
+
+  value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x73, 0x04, 0xF0, 0x9F, 0x91, 0x8A});
+  ExpectScriptTrue("Object.getPrototypeOf(result) === String.prototype");
+  ExpectScriptTrue("result.valueOf() === '\\ud83d\\udc4a'");
+  ExpectScriptTrue("result.length === 2");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x01,
+                      0x61, 0x3F, 0x01, 0x73, 0x00, 0x3F, 0x02, 0x53, 0x01,
+                      0x62, 0x3F, 0x02, 0x5E, 0x01, 0x7B, 0x02, 0x00});
+  ExpectScriptTrue("result.a instanceof String");
+  ExpectScriptTrue("result.a === result.b");
 
   // String object containing a Latin-1 string.
-  DecodeTest({0xFF, 0x0C, 0x73, 0x22, 0x06, 'Q', 'u', 0xE9, 'b', 'e', 'c'},
-             [this](Local<Value> value) {
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === String.prototype"));
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.valueOf() === 'Qu\\xe9bec'"));
-               EXPECT_TRUE(EvaluateScriptForResultBool("result.length === 6"));
-             });
+  value =
+      DecodeTest({0xFF, 0x0C, 0x73, 0x22, 0x06, 'Q', 'u', 0xE9, 'b', 'e', 'c'});
+  ExpectScriptTrue("Object.getPrototypeOf(result) === String.prototype");
+  ExpectScriptTrue("result.valueOf() === 'Qu\\xe9bec'");
+  ExpectScriptTrue("result.length === 6");
 }
 
 TEST_F(ValueSerializerTest, RoundTripRegExp) {
-  RoundTripTest("/foo/g", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsRegExp());
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === RegExp.prototype"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.toString() === '/foo/g'"));
-  });
-  RoundTripTest("new RegExp('Qu\\xe9bec', 'i')", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsRegExp());
-    EXPECT_TRUE(
-        EvaluateScriptForResultBool("result.toString() === '/Qu\\xe9bec/i'"));
-  });
-  RoundTripTest("new RegExp('\\ud83d\\udc4a', 'ug')",
-                [this](Local<Value> value) {
-                  ASSERT_TRUE(value->IsRegExp());
-                  EXPECT_TRUE(EvaluateScriptForResultBool(
-                      "result.toString() === '/\\ud83d\\udc4a/gu'"));
-                });
-  RoundTripTest(
-      "({ a: /foo/gi, get b() { return this.a; }})",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a instanceof RegExp"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-      });
+  Local<Value> value = RoundTripTest("/foo/g");
+  ASSERT_TRUE(value->IsRegExp());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === RegExp.prototype");
+  ExpectScriptTrue("result.toString() === '/foo/g'");
+
+  value = RoundTripTest("new RegExp('Qu\\xe9bec', 'i')");
+  ASSERT_TRUE(value->IsRegExp());
+  ExpectScriptTrue("result.toString() === '/Qu\\xe9bec/i'");
+
+  value = RoundTripTest("new RegExp('\\ud83d\\udc4a', 'ug')");
+  ASSERT_TRUE(value->IsRegExp());
+  ExpectScriptTrue("result.toString() === '/\\ud83d\\udc4a/gu'");
+
+  value = RoundTripTest("({ a: /foo/gi, get b() { return this.a; }})");
+  ExpectScriptTrue("result.a instanceof RegExp");
+  ExpectScriptTrue("result.a === result.b");
 }
 
 TEST_F(ValueSerializerTest, DecodeRegExp) {
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x52, 0x03, 0x66, 0x6F, 0x6F, 0x01},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsRegExp());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === RegExp.prototype"));
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.toString() === '/foo/g'"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x52, 0x07, 0x51, 0x75, 0xC3, 0xA9, 0x62,
-              0x65, 0x63, 0x02},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsRegExp());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.toString() === '/Qu\\xe9bec/i'"));
-             });
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x52, 0x04, 0xF0, 0x9F, 0x91, 0x8A, 0x11, 0x00},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsRegExp());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "result.toString() === '/\\ud83d\\udc4a/gu'"));
-      });
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x01, 0x61,
-       0x3F, 0x01, 0x52, 0x03, 0x66, 0x6F, 0x6F, 0x03, 0x3F, 0x02,
-       0x53, 0x01, 0x62, 0x3F, 0x02, 0x5E, 0x01, 0x7B, 0x02, 0x00},
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a instanceof RegExp"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-      });
+  Local<Value> value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x52, 0x03, 0x66, 0x6F, 0x6F, 0x01});
+  ASSERT_TRUE(value->IsRegExp());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === RegExp.prototype");
+  ExpectScriptTrue("result.toString() === '/foo/g'");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x52, 0x07, 0x51, 0x75, 0xC3,
+                      0xA9, 0x62, 0x65, 0x63, 0x02});
+  ASSERT_TRUE(value->IsRegExp());
+  ExpectScriptTrue("result.toString() === '/Qu\\xe9bec/i'");
+
+  value = DecodeTest(
+      {0xFF, 0x09, 0x3F, 0x00, 0x52, 0x04, 0xF0, 0x9F, 0x91, 0x8A, 0x11, 0x00});
+  ASSERT_TRUE(value->IsRegExp());
+  ExpectScriptTrue("result.toString() === '/\\ud83d\\udc4a/gu'");
+
+  value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x01, 0x61,
+                  0x3F, 0x01, 0x52, 0x03, 0x66, 0x6F, 0x6F, 0x03, 0x3F, 0x02,
+                  0x53, 0x01, 0x62, 0x3F, 0x02, 0x5E, 0x01, 0x7B, 0x02, 0x00});
+  ExpectScriptTrue("result.a instanceof RegExp");
+  ExpectScriptTrue("result.a === result.b");
 
   // RegExp containing a Latin-1 string.
-  DecodeTest(
-      {0xFF, 0x0C, 0x52, 0x22, 0x06, 'Q', 'u', 0xE9, 'b', 'e', 'c', 0x02},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsRegExp());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "result.toString() === '/Qu\\xe9bec/i'"));
-      });
+  value = DecodeTest(
+      {0xFF, 0x0C, 0x52, 0x22, 0x06, 'Q', 'u', 0xE9, 'b', 'e', 'c', 0x02});
+  ASSERT_TRUE(value->IsRegExp());
+  ExpectScriptTrue("result.toString() === '/Qu\\xe9bec/i'");
 }
 
 // Tests that invalid flags are not accepted by the deserializer.
 TEST_F(ValueSerializerTest, DecodeRegExpDotAll) {
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x52, 0x03, 0x66, 0x6F, 0x6F, 0x1F},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsRegExp());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === RegExp.prototype"));
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.toString() === '/foo/gimuy'"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x52, 0x03, 0x66, 0x6F, 0x6F, 0x3F},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsRegExp());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === RegExp.prototype"));
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.toString() === '/foo/gimsuy'"));
-             });
+  Local<Value> value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x52, 0x03, 0x66, 0x6F, 0x6F, 0x1F});
+  ASSERT_TRUE(value->IsRegExp());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === RegExp.prototype");
+  ExpectScriptTrue("result.toString() === '/foo/gimuy'");
+
+  value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x52, 0x03, 0x66, 0x6F, 0x6F, 0x3F});
+  ASSERT_TRUE(value->IsRegExp());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === RegExp.prototype");
+  ExpectScriptTrue("result.toString() === '/foo/gimsuy'");
+
   InvalidDecodeTest(
       {0xFF, 0x09, 0x3F, 0x00, 0x52, 0x03, 0x66, 0x6F, 0x6F, 0x7F});
 }
 
 TEST_F(ValueSerializerTest, RoundTripMap) {
-  RoundTripTest(
-      "(() => { var m = new Map(); m.set(42, 'foo'); return m; })()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsMap());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getPrototypeOf(result) === Map.prototype"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.size === 1"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.get(42) === 'foo'"));
-      });
-  RoundTripTest("(() => { var m = new Map(); m.set(m, m); return m; })()",
-                [this](Local<Value> value) {
-                  ASSERT_TRUE(value->IsMap());
-                  EXPECT_TRUE(EvaluateScriptForResultBool("result.size === 1"));
-                  EXPECT_TRUE(EvaluateScriptForResultBool(
-                      "result.get(result) === result"));
-                });
+  Local<Value> value = RoundTripTest("var m = new Map(); m.set(42, 'foo'); m;");
+  ASSERT_TRUE(value->IsMap());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Map.prototype");
+  ExpectScriptTrue("result.size === 1");
+  ExpectScriptTrue("result.get(42) === 'foo'");
+
+  value = RoundTripTest("var m = new Map(); m.set(m, m); m;");
+  ASSERT_TRUE(value->IsMap());
+  ExpectScriptTrue("result.size === 1");
+  ExpectScriptTrue("result.get(result) === result");
+
   // Iteration order must be preserved.
-  RoundTripTest(
-      "(() => {"
-      "  var m = new Map();"
-      "  m.set(1, 0); m.set('a', 0); m.set(3, 0); m.set(2, 0);"
-      "  return m;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsMap());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Array.from(result.keys()).toString() === '1,a,3,2'"));
-      });
+  value = RoundTripTest(
+      "var m = new Map();"
+      "m.set(1, 0); m.set('a', 0); m.set(3, 0); m.set(2, 0);"
+      "m;");
+  ASSERT_TRUE(value->IsMap());
+  ExpectScriptTrue("Array.from(result.keys()).toString() === '1,a,3,2'");
 }
 
 TEST_F(ValueSerializerTest, DecodeMap) {
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x3B, 0x3F, 0x01, 0x49, 0x54, 0x3F, 0x01, 0x53,
-       0x03, 0x66, 0x6F, 0x6F, 0x3A, 0x02},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsMap());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getPrototypeOf(result) === Map.prototype"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.size === 1"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.get(42) === 'foo'"));
-      });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3B, 0x3F, 0x01, 0x5E, 0x00, 0x3F, 0x01,
-              0x5E, 0x00, 0x3A, 0x02, 0x00},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsMap());
-               EXPECT_TRUE(EvaluateScriptForResultBool("result.size === 1"));
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.get(result) === result"));
-             });
+  Local<Value> value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3B, 0x3F, 0x01, 0x49, 0x54, 0x3F,
+                  0x01, 0x53, 0x03, 0x66, 0x6F, 0x6F, 0x3A, 0x02});
+  ASSERT_TRUE(value->IsMap());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Map.prototype");
+  ExpectScriptTrue("result.size === 1");
+  ExpectScriptTrue("result.get(42) === 'foo'");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3B, 0x3F, 0x01, 0x5E, 0x00,
+                      0x3F, 0x01, 0x5E, 0x00, 0x3A, 0x02, 0x00});
+  ASSERT_TRUE(value->IsMap());
+  ExpectScriptTrue("result.size === 1");
+  ExpectScriptTrue("result.get(result) === result");
+
   // Iteration order must be preserved.
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3B, 0x3F, 0x01, 0x49, 0x02, 0x3F,
-              0x01, 0x49, 0x00, 0x3F, 0x01, 0x53, 0x01, 0x61, 0x3F, 0x01,
-              0x49, 0x00, 0x3F, 0x01, 0x49, 0x06, 0x3F, 0x01, 0x49, 0x00,
-              0x3F, 0x01, 0x49, 0x04, 0x3F, 0x01, 0x49, 0x00, 0x3A, 0x08},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsMap());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Array.from(result.keys()).toString() === '1,a,3,2'"));
-             });
+  value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3B, 0x3F, 0x01, 0x49, 0x02, 0x3F,
+                  0x01, 0x49, 0x00, 0x3F, 0x01, 0x53, 0x01, 0x61, 0x3F, 0x01,
+                  0x49, 0x00, 0x3F, 0x01, 0x49, 0x06, 0x3F, 0x01, 0x49, 0x00,
+                  0x3F, 0x01, 0x49, 0x04, 0x3F, 0x01, 0x49, 0x00, 0x3A, 0x08});
+  ASSERT_TRUE(value->IsMap());
+  ExpectScriptTrue("Array.from(result.keys()).toString() === '1,a,3,2'");
 }
 
 TEST_F(ValueSerializerTest, RoundTripMapWithTrickyGetters) {
   // Even if an entry is removed or reassigned, the original key/value pair is
   // used.
-  RoundTripTest(
-      "(() => {"
-      "  var m = new Map();"
-      "  m.set(0, { get a() {"
-      "    m.delete(1); m.set(2, 'baz'); m.set(3, 'quux');"
-      "  }});"
-      "  m.set(1, 'foo');"
-      "  m.set(2, 'bar');"
-      "  return m;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsMap());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Array.from(result.keys()).toString() === '0,1,2'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.get(1) === 'foo'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.get(2) === 'bar'"));
-      });
+  Local<Value> value = RoundTripTest(
+      "var m = new Map();"
+      "m.set(0, { get a() {"
+      "  m.delete(1); m.set(2, 'baz'); m.set(3, 'quux');"
+      "}});"
+      "m.set(1, 'foo');"
+      "m.set(2, 'bar');"
+      "m;");
+  ASSERT_TRUE(value->IsMap());
+  ExpectScriptTrue("Array.from(result.keys()).toString() === '0,1,2'");
+  ExpectScriptTrue("result.get(1) === 'foo'");
+  ExpectScriptTrue("result.get(2) === 'bar'");
+
   // However, deeper modifications of objects yet to be serialized still apply.
-  RoundTripTest(
-      "(() => {"
-      "  var m = new Map();"
-      "  var key = { get a() { value.foo = 'bar'; } };"
-      "  var value = { get a() { key.baz = 'quux'; } };"
-      "  m.set(key, value);"
-      "  return m;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsMap());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "!('baz' in Array.from(result.keys())[0])"));
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Array.from(result.values())[0].foo === 'bar'"));
-      });
+  value = RoundTripTest(
+      "var m = new Map();"
+      "var key = { get a() { value.foo = 'bar'; } };"
+      "var value = { get a() { key.baz = 'quux'; } };"
+      "m.set(key, value);"
+      "m;");
+  ASSERT_TRUE(value->IsMap());
+  ExpectScriptTrue("!('baz' in Array.from(result.keys())[0])");
+  ExpectScriptTrue("Array.from(result.values())[0].foo === 'bar'");
 }
 
 TEST_F(ValueSerializerTest, RoundTripSet) {
-  RoundTripTest(
-      "(() => { var s = new Set(); s.add(42); s.add('foo'); return s; })()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsSet());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getPrototypeOf(result) === Set.prototype"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.size === 2"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.has(42)"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.has('foo')"));
-      });
-  RoundTripTest(
-      "(() => { var s = new Set(); s.add(s); return s; })()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsSet());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.size === 1"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.has(result)"));
-      });
+  Local<Value> value =
+      RoundTripTest("var s = new Set(); s.add(42); s.add('foo'); s;");
+  ASSERT_TRUE(value->IsSet());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Set.prototype");
+  ExpectScriptTrue("result.size === 2");
+  ExpectScriptTrue("result.has(42)");
+  ExpectScriptTrue("result.has('foo')");
+
+  value = RoundTripTest("var s = new Set(); s.add(s); s;");
+  ASSERT_TRUE(value->IsSet());
+  ExpectScriptTrue("result.size === 1");
+  ExpectScriptTrue("result.has(result)");
+
   // Iteration order must be preserved.
-  RoundTripTest(
-      "(() => {"
-      "  var s = new Set();"
-      "  s.add(1); s.add('a'); s.add(3); s.add(2);"
-      "  return s;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsSet());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Array.from(result.keys()).toString() === '1,a,3,2'"));
-      });
+  value = RoundTripTest(
+      "var s = new Set();"
+      "s.add(1); s.add('a'); s.add(3); s.add(2);"
+      "s;");
+  ASSERT_TRUE(value->IsSet());
+  ExpectScriptTrue("Array.from(result.keys()).toString() === '1,a,3,2'");
 }
 
 TEST_F(ValueSerializerTest, DecodeSet) {
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x27, 0x3F, 0x01, 0x49, 0x54, 0x3F, 0x01,
-              0x53, 0x03, 0x66, 0x6F, 0x6F, 0x2C, 0x02},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsSet());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Set.prototype"));
-               EXPECT_TRUE(EvaluateScriptForResultBool("result.size === 2"));
-               EXPECT_TRUE(EvaluateScriptForResultBool("result.has(42)"));
-               EXPECT_TRUE(EvaluateScriptForResultBool("result.has('foo')"));
-             });
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x27, 0x3F, 0x01, 0x5E, 0x00, 0x2C, 0x01, 0x00},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsSet());
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.size === 1"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.has(result)"));
-      });
+  Local<Value> value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x27, 0x3F, 0x01, 0x49, 0x54, 0x3F,
+                  0x01, 0x53, 0x03, 0x66, 0x6F, 0x6F, 0x2C, 0x02});
+  ASSERT_TRUE(value->IsSet());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Set.prototype");
+  ExpectScriptTrue("result.size === 2");
+  ExpectScriptTrue("result.has(42)");
+  ExpectScriptTrue("result.has('foo')");
+
+  value = DecodeTest(
+      {0xFF, 0x09, 0x3F, 0x00, 0x27, 0x3F, 0x01, 0x5E, 0x00, 0x2C, 0x01, 0x00});
+  ASSERT_TRUE(value->IsSet());
+  ExpectScriptTrue("result.size === 1");
+  ExpectScriptTrue("result.has(result)");
+
   // Iteration order must be preserved.
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x27, 0x3F, 0x01, 0x49, 0x02, 0x3F, 0x01, 0x53,
-       0x01, 0x61, 0x3F, 0x01, 0x49, 0x06, 0x3F, 0x01, 0x49, 0x04, 0x2C, 0x04},
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsSet());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Array.from(result.keys()).toString() === '1,a,3,2'"));
-      });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x27, 0x3F, 0x01, 0x49,
+                      0x02, 0x3F, 0x01, 0x53, 0x01, 0x61, 0x3F, 0x01,
+                      0x49, 0x06, 0x3F, 0x01, 0x49, 0x04, 0x2C, 0x04});
+  ASSERT_TRUE(value->IsSet());
+  ExpectScriptTrue("Array.from(result.keys()).toString() === '1,a,3,2'");
 }
 
 TEST_F(ValueSerializerTest, RoundTripSetWithTrickyGetters) {
   // Even if an element is added or removed during serialization, the original
   // set of elements is used.
-  RoundTripTest(
-      "(() => {"
-      "  var s = new Set();"
-      "  s.add({ get a() { s.delete(1); s.add(2); } });"
-      "  s.add(1);"
-      "  return s;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsSet());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Array.from(result.keys()).toString() === '[object Object],1'"));
-      });
+  Local<Value> value = RoundTripTest(
+      "var s = new Set();"
+      "s.add({ get a() { s.delete(1); s.add(2); } });"
+      "s.add(1);"
+      "s;");
+  ASSERT_TRUE(value->IsSet());
+  ExpectScriptTrue(
+      "Array.from(result.keys()).toString() === '[object Object],1'");
+
   // However, deeper modifications of objects yet to be serialized still apply.
-  RoundTripTest(
-      "(() => {"
-      "  var s = new Set();"
-      "  var first = { get a() { second.foo = 'bar'; } };"
-      "  var second = { get a() { first.baz = 'quux'; } };"
-      "  s.add(first);"
-      "  s.add(second);"
-      "  return s;"
-      "})()",
-      [this](Local<Value> value) {
-        ASSERT_TRUE(value->IsSet());
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "!('baz' in Array.from(result.keys())[0])"));
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Array.from(result.keys())[1].foo === 'bar'"));
-      });
+  value = RoundTripTest(
+      "var s = new Set();"
+      "var first = { get a() { second.foo = 'bar'; } };"
+      "var second = { get a() { first.baz = 'quux'; } };"
+      "s.add(first);"
+      "s.add(second);"
+      "s;");
+  ASSERT_TRUE(value->IsSet());
+  ExpectScriptTrue("!('baz' in Array.from(result.keys())[0])");
+  ExpectScriptTrue("Array.from(result.keys())[1].foo === 'bar'");
 }
 
 TEST_F(ValueSerializerTest, RoundTripArrayBuffer) {
-  RoundTripTest("new ArrayBuffer()", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsArrayBuffer());
-    EXPECT_EQ(0u, ArrayBuffer::Cast(*value)->ByteLength());
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === ArrayBuffer.prototype"));
-  });
-  RoundTripTest("new Uint8Array([0, 128, 255]).buffer",
-                [this](Local<Value> value) {
-                  ASSERT_TRUE(value->IsArrayBuffer());
-                  EXPECT_EQ(3u, ArrayBuffer::Cast(*value)->ByteLength());
-                  EXPECT_TRUE(EvaluateScriptForResultBool(
-                      "new Uint8Array(result).toString() === '0,128,255'"));
-                });
-  RoundTripTest(
-      "({ a: new ArrayBuffer(), get b() { return this.a; }})",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("result.a instanceof ArrayBuffer"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-      });
+  Local<Value> value = RoundTripTest("new ArrayBuffer()");
+  ASSERT_TRUE(value->IsArrayBuffer());
+  EXPECT_EQ(0u, ArrayBuffer::Cast(*value)->ByteLength());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === ArrayBuffer.prototype");
+
+  value = RoundTripTest("new Uint8Array([0, 128, 255]).buffer");
+  ASSERT_TRUE(value->IsArrayBuffer());
+  EXPECT_EQ(3u, ArrayBuffer::Cast(*value)->ByteLength());
+  ExpectScriptTrue("new Uint8Array(result).toString() === '0,128,255'");
+
+  value =
+      RoundTripTest("({ a: new ArrayBuffer(), get b() { return this.a; }})");
+  ExpectScriptTrue("result.a instanceof ArrayBuffer");
+  ExpectScriptTrue("result.a === result.b");
 }
 
 TEST_F(ValueSerializerTest, DecodeArrayBuffer) {
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x42, 0x00},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsArrayBuffer());
-               EXPECT_EQ(0u, ArrayBuffer::Cast(*value)->ByteLength());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === ArrayBuffer.prototype"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x42, 0x03, 0x00, 0x80, 0xFF, 0x00},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsArrayBuffer());
-               EXPECT_EQ(3u, ArrayBuffer::Cast(*value)->ByteLength());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "new Uint8Array(result).toString() === '0,128,255'"));
-             });
-  DecodeTest(
-      {0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x01,
-       0x61, 0x3F, 0x01, 0x42, 0x00, 0x3F, 0x02, 0x53, 0x01,
-       0x62, 0x3F, 0x02, 0x5E, 0x01, 0x7B, 0x02, 0x00},
-      [this](Local<Value> value) {
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("result.a instanceof ArrayBuffer"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-      });
+  Local<Value> value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x42, 0x00});
+  ASSERT_TRUE(value->IsArrayBuffer());
+  EXPECT_EQ(0u, ArrayBuffer::Cast(*value)->ByteLength());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === ArrayBuffer.prototype");
+
+  value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x42, 0x03, 0x00, 0x80, 0xFF, 0x00});
+  ASSERT_TRUE(value->IsArrayBuffer());
+  EXPECT_EQ(3u, ArrayBuffer::Cast(*value)->ByteLength());
+  ExpectScriptTrue("new Uint8Array(result).toString() === '0,128,255'");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x01,
+                      0x61, 0x3F, 0x01, 0x42, 0x00, 0x3F, 0x02, 0x53, 0x01,
+                      0x62, 0x3F, 0x02, 0x5E, 0x01, 0x7B, 0x02, 0x00});
+  ExpectScriptTrue("result.a instanceof ArrayBuffer");
+  ExpectScriptTrue("result.a === result.b");
 }
 
 TEST_F(ValueSerializerTest, DecodeInvalidArrayBuffer) {
@@ -1874,11 +1594,7 @@ class OOMArrayBufferAllocator : public ArrayBuffer::Allocator {
  public:
   void* Allocate(size_t) override { return nullptr; }
   void* AllocateUninitialized(size_t) override { return nullptr; }
-  void* Reserve(size_t length) override { return nullptr; }
-  void Free(void* data, size_t length, AllocationMode mode) override {}
   void Free(void*, size_t) override {}
-  void SetProtection(void* data, size_t length,
-                     Protection protection) override {}
 };
 
 TEST_F(ValueSerializerTest, DecodeArrayBufferOOM) {
@@ -1934,8 +1650,6 @@ class ValueSerializerTestWithArrayBufferTransfer : public ValueSerializerTest {
     serializer->TransferArrayBuffer(0, input_buffer_);
   }
 
-  void AfterEncode() override { input_buffer_->Neuter(); }
-
   void BeforeDecode(ValueDeserializer* deserializer) override {
     deserializer->TransferArrayBuffer(0, output_buffer_);
   }
@@ -1947,196 +1661,161 @@ class ValueSerializerTestWithArrayBufferTransfer : public ValueSerializerTest {
 
 TEST_F(ValueSerializerTestWithArrayBufferTransfer,
        RoundTripArrayBufferTransfer) {
-  RoundTripTest([this]() { return input_buffer(); },
-                [this](Local<Value> value) {
-                  ASSERT_TRUE(value->IsArrayBuffer());
-                  EXPECT_EQ(output_buffer(), value);
-                  EXPECT_TRUE(EvaluateScriptForResultBool(
-                      "new Uint8Array(result).toString() === '0,1,128,255'"));
-                });
-  RoundTripTest(
-      [this]() {
-        Local<Object> object = Object::New(isolate());
-        EXPECT_TRUE(object
-                        ->CreateDataProperty(serialization_context(),
-                                             StringFromUtf8("a"),
-                                             input_buffer())
-                        .FromMaybe(false));
-        EXPECT_TRUE(object
-                        ->CreateDataProperty(serialization_context(),
-                                             StringFromUtf8("b"),
-                                             input_buffer())
-                        .FromMaybe(false));
-        return object;
-      },
-      [this](Local<Value> value) {
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("result.a instanceof ArrayBuffer"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "new Uint8Array(result.a).toString() === '0,1,128,255'"));
-      });
+  Local<Value> value = RoundTripTest(input_buffer());
+  ASSERT_TRUE(value->IsArrayBuffer());
+  EXPECT_EQ(output_buffer(), value);
+  ExpectScriptTrue("new Uint8Array(result).toString() === '0,1,128,255'");
+
+  Local<Object> object;
+  {
+    Context::Scope scope(serialization_context());
+    object = Object::New(isolate());
+    EXPECT_TRUE(object
+                    ->CreateDataProperty(serialization_context(),
+                                         StringFromUtf8("a"), input_buffer())
+                    .FromMaybe(false));
+    EXPECT_TRUE(object
+                    ->CreateDataProperty(serialization_context(),
+                                         StringFromUtf8("b"), input_buffer())
+                    .FromMaybe(false));
+  }
+  value = RoundTripTest(object);
+  ExpectScriptTrue("result.a instanceof ArrayBuffer");
+  ExpectScriptTrue("result.a === result.b");
+  ExpectScriptTrue("new Uint8Array(result.a).toString() === '0,1,128,255'");
 }
 
 TEST_F(ValueSerializerTest, RoundTripTypedArray) {
-// Check that the right type comes out the other side for every kind of typed
-// array.
-#define TYPED_ARRAY_ROUND_TRIP_TEST(Type, type, TYPE, ctype, size)      \
-  RoundTripTest("new " #Type "Array(2)", [this](Local<Value> value) {   \
-    ASSERT_TRUE(value->Is##Type##Array());                              \
-    EXPECT_EQ(2u * size, TypedArray::Cast(*value)->ByteLength());       \
-    EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());                  \
-    EXPECT_TRUE(EvaluateScriptForResultBool(                            \
-        "Object.getPrototypeOf(result) === " #Type "Array.prototype")); \
-  });
+  // Check that the right type comes out the other side for every kind of typed
+  // array.
+  Local<Value> value;
+#define TYPED_ARRAY_ROUND_TRIP_TEST(Type, type, TYPE, ctype, size) \
+  value = RoundTripTest("new " #Type "Array(2)");                  \
+  ASSERT_TRUE(value->Is##Type##Array());                           \
+  EXPECT_EQ(2u * size, TypedArray::Cast(*value)->ByteLength());    \
+  EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());               \
+  ExpectScriptTrue("Object.getPrototypeOf(result) === " #Type      \
+                   "Array.prototype");
+
   TYPED_ARRAYS(TYPED_ARRAY_ROUND_TRIP_TEST)
-#undef TYPED_ARRAY_CASE
+#undef TYPED_ARRAY_ROUND_TRIP_TEST
 
   // Check that values of various kinds are suitably preserved.
-  RoundTripTest("new Uint8Array([1, 128, 255])", [this](Local<Value> value) {
-    EXPECT_TRUE(
-        EvaluateScriptForResultBool("result.toString() === '1,128,255'"));
-  });
-  RoundTripTest("new Int16Array([0, 256, -32768])", [this](Local<Value> value) {
-    EXPECT_TRUE(
-        EvaluateScriptForResultBool("result.toString() === '0,256,-32768'"));
-  });
-  RoundTripTest("new Float32Array([0, -0.5, NaN, Infinity])",
-                [this](Local<Value> value) {
-                  EXPECT_TRUE(EvaluateScriptForResultBool(
-                      "result.toString() === '0,-0.5,NaN,Infinity'"));
-                });
+  value = RoundTripTest("new Uint8Array([1, 128, 255])");
+  ExpectScriptTrue("result.toString() === '1,128,255'");
+
+  value = RoundTripTest("new Int16Array([0, 256, -32768])");
+  ExpectScriptTrue("result.toString() === '0,256,-32768'");
+
+  value = RoundTripTest("new Float32Array([0, -0.5, NaN, Infinity])");
+  ExpectScriptTrue("result.toString() === '0,-0.5,NaN,Infinity'");
 
   // Array buffer views sharing a buffer should do so on the other side.
   // Similarly, multiple references to the same typed array should be resolved.
-  RoundTripTest(
-      "(() => {"
-      "  var buffer = new ArrayBuffer(32);"
-      "  return {"
-      "    u8: new Uint8Array(buffer),"
-      "    get u8_2() { return this.u8; },"
-      "    f32: new Float32Array(buffer, 4, 5),"
-      "    b: buffer,"
-      "  };"
-      "})()",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("result.u8 instanceof Uint8Array"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.u8 === result.u8_2"));
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("result.f32 instanceof Float32Array"));
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "result.u8.buffer === result.f32.buffer"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.f32.byteOffset === 4"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.f32.length === 5"));
-      });
+  value = RoundTripTest(
+      "var buffer = new ArrayBuffer(32);"
+      "({"
+      "  u8: new Uint8Array(buffer),"
+      "  get u8_2() { return this.u8; },"
+      "  f32: new Float32Array(buffer, 4, 5),"
+      "  b: buffer,"
+      "});");
+  ExpectScriptTrue("result.u8 instanceof Uint8Array");
+  ExpectScriptTrue("result.u8 === result.u8_2");
+  ExpectScriptTrue("result.f32 instanceof Float32Array");
+  ExpectScriptTrue("result.u8.buffer === result.f32.buffer");
+  ExpectScriptTrue("result.f32.byteOffset === 4");
+  ExpectScriptTrue("result.f32.length === 5");
 }
 
 TEST_F(ValueSerializerTest, DecodeTypedArray) {
   // Check that the right type comes out the other side for every kind of typed
   // array.
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x02, 0x00, 0x00, 0x56,
-              0x42, 0x00, 0x02},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsUint8Array());
-               EXPECT_EQ(2u, TypedArray::Cast(*value)->ByteLength());
-               EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Uint8Array.prototype"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x02, 0x00, 0x00, 0x56,
-              0x62, 0x00, 0x02},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsInt8Array());
-               EXPECT_EQ(2u, TypedArray::Cast(*value)->ByteLength());
-               EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Int8Array.prototype"));
-             });
+  Local<Value> value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42,
+                                   0x02, 0x00, 0x00, 0x56, 0x42, 0x00, 0x02});
+  ASSERT_TRUE(value->IsUint8Array());
+  EXPECT_EQ(2u, TypedArray::Cast(*value)->ByteLength());
+  EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Uint8Array.prototype");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x02, 0x00,
+                      0x00, 0x56, 0x62, 0x00, 0x02});
+  ASSERT_TRUE(value->IsInt8Array());
+  EXPECT_EQ(2u, TypedArray::Cast(*value)->ByteLength());
+  EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Int8Array.prototype");
+
 #if defined(V8_TARGET_LITTLE_ENDIAN)
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x04, 0x00, 0x00, 0x00,
-              0x00, 0x56, 0x57, 0x00, 0x04},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsUint16Array());
-               EXPECT_EQ(4u, TypedArray::Cast(*value)->ByteLength());
-               EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Uint16Array.prototype"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x04, 0x00, 0x00, 0x00,
-              0x00, 0x56, 0x77, 0x00, 0x04},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsInt16Array());
-               EXPECT_EQ(4u, TypedArray::Cast(*value)->ByteLength());
-               EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Int16Array.prototype"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x08, 0x00, 0x00,
-              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x56, 0x44, 0x00, 0x08},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsUint32Array());
-               EXPECT_EQ(8u, TypedArray::Cast(*value)->ByteLength());
-               EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Uint32Array.prototype"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x08, 0x00, 0x00,
-              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x56, 0x64, 0x00, 0x08},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsInt32Array());
-               EXPECT_EQ(8u, TypedArray::Cast(*value)->ByteLength());
-               EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Int32Array.prototype"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x08, 0x00, 0x00,
-              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x56, 0x66, 0x00, 0x08},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsFloat32Array());
-               EXPECT_EQ(8u, TypedArray::Cast(*value)->ByteLength());
-               EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Float32Array.prototype"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x10, 0x00, 0x00,
-              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-              0x00, 0x00, 0x00, 0x00, 0x56, 0x46, 0x00, 0x10},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsFloat64Array());
-               EXPECT_EQ(16u, TypedArray::Cast(*value)->ByteLength());
-               EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === Float64Array.prototype"));
-             });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x04, 0x00,
+                      0x00, 0x00, 0x00, 0x56, 0x57, 0x00, 0x04});
+  ASSERT_TRUE(value->IsUint16Array());
+  EXPECT_EQ(4u, TypedArray::Cast(*value)->ByteLength());
+  EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Uint16Array.prototype");
+
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x04, 0x00,
+                      0x00, 0x00, 0x00, 0x56, 0x77, 0x00, 0x04});
+  ASSERT_TRUE(value->IsInt16Array());
+  EXPECT_EQ(4u, TypedArray::Cast(*value)->ByteLength());
+  EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Int16Array.prototype");
+
+  value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x08, 0x00, 0x00,
+                  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x56, 0x44, 0x00, 0x08});
+  ASSERT_TRUE(value->IsUint32Array());
+  EXPECT_EQ(8u, TypedArray::Cast(*value)->ByteLength());
+  EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Uint32Array.prototype");
+
+  value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x08, 0x00, 0x00,
+                  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x56, 0x64, 0x00, 0x08});
+  ASSERT_TRUE(value->IsInt32Array());
+  EXPECT_EQ(8u, TypedArray::Cast(*value)->ByteLength());
+  EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Int32Array.prototype");
+
+  value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x08, 0x00, 0x00,
+                  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x56, 0x66, 0x00, 0x08});
+  ASSERT_TRUE(value->IsFloat32Array());
+  EXPECT_EQ(8u, TypedArray::Cast(*value)->ByteLength());
+  EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Float32Array.prototype");
+
+  value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x10, 0x00, 0x00,
+                  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                  0x00, 0x00, 0x00, 0x00, 0x56, 0x46, 0x00, 0x10});
+  ASSERT_TRUE(value->IsFloat64Array());
+  EXPECT_EQ(16u, TypedArray::Cast(*value)->ByteLength());
+  EXPECT_EQ(2u, TypedArray::Cast(*value)->Length());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === Float64Array.prototype");
+
 #endif  // V8_TARGET_LITTLE_ENDIAN
 
   // Check that values of various kinds are suitably preserved.
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x03, 0x01, 0x80, 0xFF,
-              0x56, 0x42, 0x00, 0x03, 0x00},
-             [this](Local<Value> value) {
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.toString() === '1,128,255'"));
-             });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x03, 0x01,
+                      0x80, 0xFF, 0x56, 0x42, 0x00, 0x03, 0x00});
+  ExpectScriptTrue("result.toString() === '1,128,255'");
+
 #if defined(V8_TARGET_LITTLE_ENDIAN)
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x06, 0x00, 0x00, 0x00,
-              0x01, 0x00, 0x80, 0x56, 0x77, 0x00, 0x06},
-             [this](Local<Value> value) {
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.toString() === '0,256,-32768'"));
-             });
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x10, 0x00, 0x00,
-              0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x00, 0x00, 0xC0, 0x7F,
-              0x00, 0x00, 0x80, 0x7F, 0x56, 0x66, 0x00, 0x10},
-             [this](Local<Value> value) {
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "result.toString() === '0,-0.5,NaN,Infinity'"));
-             });
+  value = DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x06, 0x00,
+                      0x00, 0x00, 0x01, 0x00, 0x80, 0x56, 0x77, 0x00, 0x06});
+  ExpectScriptTrue("result.toString() === '0,256,-32768'");
+
+  value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x10, 0x00, 0x00,
+                  0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x00, 0x00, 0xC0, 0x7F,
+                  0x00, 0x00, 0x80, 0x7F, 0x56, 0x66, 0x00, 0x10});
+  ExpectScriptTrue("result.toString() === '0,-0.5,NaN,Infinity'");
+
 #endif  // V8_TARGET_LITTLE_ENDIAN
 
   // Array buffer views sharing a buffer should do so on the other side.
   // Similarly, multiple references to the same typed array should be resolved.
-  DecodeTest(
+  value = DecodeTest(
       {0xFF, 0x09, 0x3F, 0x00, 0x6F, 0x3F, 0x01, 0x53, 0x02, 0x75, 0x38, 0x3F,
        0x01, 0x3F, 0x01, 0x42, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -2144,18 +1823,13 @@ TEST_F(ValueSerializerTest, DecodeTypedArray) {
        0x00, 0x56, 0x42, 0x00, 0x20, 0x3F, 0x03, 0x53, 0x04, 0x75, 0x38, 0x5F,
        0x32, 0x3F, 0x03, 0x5E, 0x02, 0x3F, 0x03, 0x53, 0x03, 0x66, 0x33, 0x32,
        0x3F, 0x03, 0x3F, 0x03, 0x5E, 0x01, 0x56, 0x66, 0x04, 0x14, 0x3F, 0x04,
-       0x53, 0x01, 0x62, 0x3F, 0x04, 0x5E, 0x01, 0x7B, 0x04, 0x00},
-      [this](Local<Value> value) {
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("result.u8 instanceof Uint8Array"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.u8 === result.u8_2"));
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("result.f32 instanceof Float32Array"));
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "result.u8.buffer === result.f32.buffer"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.f32.byteOffset === 4"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.f32.length === 5"));
-      });
+       0x53, 0x01, 0x62, 0x3F, 0x04, 0x5E, 0x01, 0x7B, 0x04, 0x00});
+  ExpectScriptTrue("result.u8 instanceof Uint8Array");
+  ExpectScriptTrue("result.u8 === result.u8_2");
+  ExpectScriptTrue("result.f32 instanceof Float32Array");
+  ExpectScriptTrue("result.u8.buffer === result.f32.buffer");
+  ExpectScriptTrue("result.f32.byteOffset === 4");
+  ExpectScriptTrue("result.f32.length === 5");
 }
 
 TEST_F(ValueSerializerTest, DecodeInvalidTypedArray) {
@@ -2177,28 +1851,23 @@ TEST_F(ValueSerializerTest, DecodeInvalidTypedArray) {
 }
 
 TEST_F(ValueSerializerTest, RoundTripDataView) {
-  RoundTripTest("new DataView(new ArrayBuffer(4), 1, 2)",
-                [this](Local<Value> value) {
-                  ASSERT_TRUE(value->IsDataView());
-                  EXPECT_EQ(1u, DataView::Cast(*value)->ByteOffset());
-                  EXPECT_EQ(2u, DataView::Cast(*value)->ByteLength());
-                  EXPECT_EQ(4u, DataView::Cast(*value)->Buffer()->ByteLength());
-                  EXPECT_TRUE(EvaluateScriptForResultBool(
-                      "Object.getPrototypeOf(result) === DataView.prototype"));
-                });
+  Local<Value> value = RoundTripTest("new DataView(new ArrayBuffer(4), 1, 2)");
+  ASSERT_TRUE(value->IsDataView());
+  EXPECT_EQ(1u, DataView::Cast(*value)->ByteOffset());
+  EXPECT_EQ(2u, DataView::Cast(*value)->ByteLength());
+  EXPECT_EQ(4u, DataView::Cast(*value)->Buffer()->ByteLength());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === DataView.prototype");
 }
 
 TEST_F(ValueSerializerTest, DecodeDataView) {
-  DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x04, 0x00, 0x00, 0x00,
-              0x00, 0x56, 0x3F, 0x01, 0x02},
-             [this](Local<Value> value) {
-               ASSERT_TRUE(value->IsDataView());
-               EXPECT_EQ(1u, DataView::Cast(*value)->ByteOffset());
-               EXPECT_EQ(2u, DataView::Cast(*value)->ByteLength());
-               EXPECT_EQ(4u, DataView::Cast(*value)->Buffer()->ByteLength());
-               EXPECT_TRUE(EvaluateScriptForResultBool(
-                   "Object.getPrototypeOf(result) === DataView.prototype"));
-             });
+  Local<Value> value =
+      DecodeTest({0xFF, 0x09, 0x3F, 0x00, 0x3F, 0x00, 0x42, 0x04, 0x00, 0x00,
+                  0x00, 0x00, 0x56, 0x3F, 0x01, 0x02});
+  ASSERT_TRUE(value->IsDataView());
+  EXPECT_EQ(1u, DataView::Cast(*value)->ByteOffset());
+  EXPECT_EQ(2u, DataView::Cast(*value)->ByteLength());
+  EXPECT_EQ(4u, DataView::Cast(*value)->Buffer()->ByteLength());
+  ExpectScriptTrue("Object.getPrototypeOf(result) === DataView.prototype");
 }
 
 TEST_F(ValueSerializerTest, DecodeInvalidDataView) {
@@ -2210,11 +1879,11 @@ TEST_F(ValueSerializerTest, DecodeInvalidDataView) {
       {0xFF, 0x09, 0x42, 0x02, 0x00, 0x00, 0x56, 0x3F, 0x01, 0x03});
 }
 
-class ValueSerializerTestWithSharedArrayBufferTransfer
+class ValueSerializerTestWithSharedArrayBufferClone
     : public ValueSerializerTest {
  protected:
-  ValueSerializerTestWithSharedArrayBufferTransfer()
-      : serializer_delegate_(this) {}
+  ValueSerializerTestWithSharedArrayBufferClone()
+      : serializer_delegate_(this), deserializer_delegate_(this) {}
 
   void InitializeData(const std::vector<uint8_t>& data) {
     data_ = data;
@@ -2233,10 +1902,6 @@ class ValueSerializerTestWithSharedArrayBufferTransfer
   const Local<SharedArrayBuffer>& input_buffer() { return input_buffer_; }
   const Local<SharedArrayBuffer>& output_buffer() { return output_buffer_; }
 
-  void BeforeDecode(ValueDeserializer* deserializer) override {
-    deserializer->TransferSharedArrayBuffer(0, output_buffer_);
-  }
-
   static void SetUpTestCase() {
     flag_was_enabled_ = i::FLAG_harmony_sharedarraybuffer;
     i::FLAG_harmony_sharedarraybuffer = true;
@@ -2259,17 +1924,27 @@ class ValueSerializerTestWithSharedArrayBufferTransfer
   class SerializerDelegate : public ValueSerializer::Delegate {
    public:
     explicit SerializerDelegate(
-        ValueSerializerTestWithSharedArrayBufferTransfer* test)
+        ValueSerializerTestWithSharedArrayBufferClone* test)
         : test_(test) {}
     MOCK_METHOD2(GetSharedArrayBufferId,
                  Maybe<uint32_t>(Isolate* isolate,
                                  Local<SharedArrayBuffer> shared_array_buffer));
+    MOCK_METHOD2(GetSharedArrayBufferFromId,
+                 MaybeLocal<SharedArrayBuffer>(Isolate* isolate, uint32_t id));
     void ThrowDataCloneError(Local<String> message) override {
       test_->isolate()->ThrowException(Exception::Error(message));
     }
 
    private:
-    ValueSerializerTestWithSharedArrayBufferTransfer* test_;
+    ValueSerializerTestWithSharedArrayBufferClone* test_;
+  };
+
+  class DeserializerDelegate : public ValueDeserializer::Delegate {
+   public:
+    explicit DeserializerDelegate(
+        ValueSerializerTestWithSharedArrayBufferClone* test) {}
+    MOCK_METHOD2(GetSharedArrayBufferFromId,
+                 MaybeLocal<SharedArrayBuffer>(Isolate* isolate, uint32_t id));
   };
 
 #if __clang__
@@ -2280,7 +1955,12 @@ class ValueSerializerTestWithSharedArrayBufferTransfer
     return &serializer_delegate_;
   }
 
+  ValueDeserializer::Delegate* GetDeserializerDelegate() override {
+    return &deserializer_delegate_;
+  }
+
   SerializerDelegate serializer_delegate_;
+  DeserializerDelegate deserializer_delegate_;
 
  private:
   static bool flag_was_enabled_;
@@ -2289,49 +1969,43 @@ class ValueSerializerTestWithSharedArrayBufferTransfer
   Local<SharedArrayBuffer> output_buffer_;
 };
 
-bool ValueSerializerTestWithSharedArrayBufferTransfer::flag_was_enabled_ =
-    false;
+bool ValueSerializerTestWithSharedArrayBufferClone::flag_was_enabled_ = false;
 
-TEST_F(ValueSerializerTestWithSharedArrayBufferTransfer,
-       RoundTripSharedArrayBufferTransfer) {
+TEST_F(ValueSerializerTestWithSharedArrayBufferClone,
+       RoundTripSharedArrayBufferClone) {
   InitializeData({0x00, 0x01, 0x80, 0xFF});
 
   EXPECT_CALL(serializer_delegate_,
               GetSharedArrayBufferId(isolate(), input_buffer()))
       .WillRepeatedly(Return(Just(0U)));
+  EXPECT_CALL(deserializer_delegate_, GetSharedArrayBufferFromId(isolate(), 0U))
+      .WillRepeatedly(Return(output_buffer()));
 
-  RoundTripTest([this]() { return input_buffer(); },
-                [this](Local<Value> value) {
-                  ASSERT_TRUE(value->IsSharedArrayBuffer());
-                  EXPECT_EQ(output_buffer(), value);
-                  EXPECT_TRUE(EvaluateScriptForResultBool(
-                      "new Uint8Array(result).toString() === '0,1,128,255'"));
-                });
-  RoundTripTest(
-      [this]() {
-        Local<Object> object = Object::New(isolate());
-        EXPECT_TRUE(object
-                        ->CreateDataProperty(serialization_context(),
-                                             StringFromUtf8("a"),
-                                             input_buffer())
-                        .FromMaybe(false));
-        EXPECT_TRUE(object
-                        ->CreateDataProperty(serialization_context(),
-                                             StringFromUtf8("b"),
-                                             input_buffer())
-                        .FromMaybe(false));
-        return object;
-      },
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "result.a instanceof SharedArrayBuffer"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "new Uint8Array(result.a).toString() === '0,1,128,255'"));
-      });
-}
-
-TEST_F(ValueSerializerTestWithSharedArrayBufferTransfer,
+  Local<Value> value = RoundTripTest(input_buffer());
+  ASSERT_TRUE(value->IsSharedArrayBuffer());
+  EXPECT_EQ(output_buffer(), value);
+  ExpectScriptTrue("new Uint8Array(result).toString() === '0,1,128,255'");
+
+  Local<Object> object;
+  {
+    Context::Scope scope(serialization_context());
+    object = Object::New(isolate());
+    EXPECT_TRUE(object
+                    ->CreateDataProperty(serialization_context(),
+                                         StringFromUtf8("a"), input_buffer())
+                    .FromMaybe(false));
+    EXPECT_TRUE(object
+                    ->CreateDataProperty(serialization_context(),
+                                         StringFromUtf8("b"), input_buffer())
+                    .FromMaybe(false));
+  }
+  value = RoundTripTest(object);
+  ExpectScriptTrue("result.a instanceof SharedArrayBuffer");
+  ExpectScriptTrue("result.a === result.b");
+  ExpectScriptTrue("new Uint8Array(result.a).toString() === '0,1,128,255'");
+}
+
+TEST_F(ValueSerializerTestWithSharedArrayBufferClone,
        RoundTripWebAssemblyMemory) {
   bool flag_was_enabled = i::FLAG_experimental_wasm_threads;
   i::FLAG_experimental_wasm_threads = true;
@@ -2343,24 +2017,23 @@ TEST_F(ValueSerializerTestWithSharedArrayBufferTransfer,
   EXPECT_CALL(serializer_delegate_,
               GetSharedArrayBufferId(isolate(), input_buffer()))
       .WillRepeatedly(Return(Just(0U)));
+  EXPECT_CALL(deserializer_delegate_, GetSharedArrayBufferFromId(isolate(), 0U))
+      .WillRepeatedly(Return(output_buffer()));
 
-  RoundTripTest(
-      [this]() -> Local<Value> {
-        const int32_t kMaxPages = 1;
-        auto i_isolate = reinterpret_cast<i::Isolate*>(isolate());
-        i::Handle<i::JSArrayBuffer> obj = Utils::OpenHandle(*input_buffer());
-        return Utils::Convert<i::WasmMemoryObject, Value>(
-            i::WasmMemoryObject::New(i_isolate, obj, kMaxPages));
-      },
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "result instanceof WebAssembly.Memory"));
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("result.buffer.byteLength === 65536"));
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("new Uint8Array(result.buffer, 0, "
-                                        "4).toString() === '0,1,128,255'"));
-      });
+  Local<Value> input;
+  {
+    Context::Scope scope(serialization_context());
+    const int32_t kMaxPages = 1;
+    i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate());
+    i::Handle<i::JSArrayBuffer> obj = Utils::OpenHandle(*input_buffer());
+    input = Utils::Convert<i::WasmMemoryObject, Value>(
+        i::WasmMemoryObject::New(i_isolate, obj, kMaxPages));
+  }
+  RoundTripTest(input);
+  ExpectScriptTrue("result instanceof WebAssembly.Memory");
+  ExpectScriptTrue("result.buffer.byteLength === 65536");
+  ExpectScriptTrue(
+      "new Uint8Array(result.buffer, 0, 4).toString() === '0,1,128,255'");
 
   i::FLAG_experimental_wasm_threads = flag_was_enabled;
 }
@@ -2461,17 +2134,15 @@ TEST_F(ValueSerializerTestWithHostObject, RoundTripUint32) {
         Local<Value> argv[] = {Integer::NewFromUnsigned(isolate(), value)};
         return NewHostObject(deserialization_context(), arraysize(argv), argv);
       }));
-  RoundTripTest("new ExampleHostObject(42)", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsObject());
-    ASSERT_TRUE(Object::Cast(*value)->InternalFieldCount());
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === ExampleHostObject.prototype"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.value === 42"));
-  });
-  RoundTripTest(
-      "new ExampleHostObject(0xCAFECAFE)", [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.value === 0xCAFECAFE"));
-      });
+  Local<Value> value = RoundTripTest("new ExampleHostObject(42)");
+  ASSERT_TRUE(value->IsObject());
+  ASSERT_TRUE(Object::Cast(*value)->InternalFieldCount());
+  ExpectScriptTrue(
+      "Object.getPrototypeOf(result) === ExampleHostObject.prototype");
+  ExpectScriptTrue("result.value === 42");
+
+  value = RoundTripTest("new ExampleHostObject(0xCAFECAFE)");
+  ExpectScriptTrue("result.value === 0xCAFECAFE");
 }
 
 TEST_F(ValueSerializerTestWithHostObject, RoundTripUint64) {
@@ -2501,21 +2172,17 @@ TEST_F(ValueSerializerTestWithHostObject, RoundTripUint64) {
                                      static_cast<uint32_t>(value_packed))};
         return NewHostObject(deserialization_context(), arraysize(argv), argv);
       }));
-  RoundTripTest("new ExampleHostObject(42, 0)", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsObject());
-    ASSERT_TRUE(Object::Cast(*value)->InternalFieldCount());
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === ExampleHostObject.prototype"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.value === 42"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.value2 === 0"));
-  });
-  RoundTripTest(
-      "new ExampleHostObject(0xFFFFFFFF, 0x12345678)",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.value === 0xFFFFFFFF"));
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("result.value2 === 0x12345678"));
-      });
+  Local<Value> value = RoundTripTest("new ExampleHostObject(42, 0)");
+  ASSERT_TRUE(value->IsObject());
+  ASSERT_TRUE(Object::Cast(*value)->InternalFieldCount());
+  ExpectScriptTrue(
+      "Object.getPrototypeOf(result) === ExampleHostObject.prototype");
+  ExpectScriptTrue("result.value === 42");
+  ExpectScriptTrue("result.value2 === 0");
+
+  value = RoundTripTest("new ExampleHostObject(0xFFFFFFFF, 0x12345678)");
+  ExpectScriptTrue("result.value === 0xFFFFFFFF");
+  ExpectScriptTrue("result.value2 === 0x12345678");
 }
 
 TEST_F(ValueSerializerTestWithHostObject, RoundTripDouble) {
@@ -2538,22 +2205,21 @@ TEST_F(ValueSerializerTestWithHostObject, RoundTripDouble) {
         Local<Value> argv[] = {Number::New(isolate(), value)};
         return NewHostObject(deserialization_context(), arraysize(argv), argv);
       }));
-  RoundTripTest("new ExampleHostObject(-3.5)", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsObject());
-    ASSERT_TRUE(Object::Cast(*value)->InternalFieldCount());
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === ExampleHostObject.prototype"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.value === -3.5"));
-  });
-  RoundTripTest("new ExampleHostObject(NaN)", [this](Local<Value> value) {
-    EXPECT_TRUE(EvaluateScriptForResultBool("Number.isNaN(result.value)"));
-  });
-  RoundTripTest("new ExampleHostObject(Infinity)", [this](Local<Value> value) {
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.value === Infinity"));
-  });
-  RoundTripTest("new ExampleHostObject(-0)", [this](Local<Value> value) {
-    EXPECT_TRUE(EvaluateScriptForResultBool("1/result.value === -Infinity"));
-  });
+  Local<Value> value = RoundTripTest("new ExampleHostObject(-3.5)");
+  ASSERT_TRUE(value->IsObject());
+  ASSERT_TRUE(Object::Cast(*value)->InternalFieldCount());
+  ExpectScriptTrue(
+      "Object.getPrototypeOf(result) === ExampleHostObject.prototype");
+  ExpectScriptTrue("result.value === -3.5");
+
+  value = RoundTripTest("new ExampleHostObject(NaN)");
+  ExpectScriptTrue("Number.isNaN(result.value)");
+
+  value = RoundTripTest("new ExampleHostObject(Infinity)");
+  ExpectScriptTrue("result.value === Infinity");
+
+  value = RoundTripTest("new ExampleHostObject(-0)");
+  ExpectScriptTrue("1/result.value === -Infinity");
 }
 
 TEST_F(ValueSerializerTestWithHostObject, RoundTripRawBytes) {
@@ -2581,12 +2247,11 @@ TEST_F(ValueSerializerTestWithHostObject, RoundTripRawBytes) {
         }
         return NewHostObject(deserialization_context(), 0, nullptr);
       }));
-  RoundTripTest("new ExampleHostObject()", [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsObject());
-    ASSERT_TRUE(Object::Cast(*value)->InternalFieldCount());
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "Object.getPrototypeOf(result) === ExampleHostObject.prototype"));
-  });
+  Local<Value> value = RoundTripTest("new ExampleHostObject()");
+  ASSERT_TRUE(value->IsObject());
+  ASSERT_TRUE(Object::Cast(*value)->InternalFieldCount());
+  ExpectScriptTrue(
+      "Object.getPrototypeOf(result) === ExampleHostObject.prototype");
 }
 
 TEST_F(ValueSerializerTestWithHostObject, RoundTripSameObject) {
@@ -2603,13 +2268,9 @@ TEST_F(ValueSerializerTestWithHostObject, RoundTripSameObject) {
         EXPECT_TRUE(ReadExampleHostObjectTag());
         return NewHostObject(deserialization_context(), 0, nullptr);
       }));
-  RoundTripTest(
-      "({ a: new ExampleHostObject(), get b() { return this.a; }})",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "result.a instanceof ExampleHostObject"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-      });
+  RoundTripTest("({ a: new ExampleHostObject(), get b() { return this.a; }})");
+  ExpectScriptTrue("result.a instanceof ExampleHostObject");
+  ExpectScriptTrue("result.a === result.b");
 }
 
 TEST_F(ValueSerializerTestWithHostObject, DecodeSimpleHostObject) {
@@ -2618,11 +2279,9 @@ TEST_F(ValueSerializerTestWithHostObject, DecodeSimpleHostObject) {
         EXPECT_TRUE(ReadExampleHostObjectTag());
         return NewHostObject(deserialization_context(), 0, nullptr);
       }));
-  DecodeTest(
-      {0xFF, 0x0D, 0x5C, kExampleHostObjectTag}, [this](Local<Value> value) {
-        EXPECT_TRUE(EvaluateScriptForResultBool(
-            "Object.getPrototypeOf(result) === ExampleHostObject.prototype"));
-      });
+  DecodeTest({0xFF, 0x0D, 0x5C, kExampleHostObjectTag});
+  ExpectScriptTrue(
+      "Object.getPrototypeOf(result) === ExampleHostObject.prototype");
 }
 
 class ValueSerializerTestWithHostArrayBufferView
@@ -2647,14 +2306,10 @@ TEST_F(ValueSerializerTestWithHostArrayBufferView, RoundTripUint8ArrayInput) {
         return NewDummyUint8Array();
       }));
   RoundTripTest(
-      "({ a: new Uint8Array([1, 2, 3]), get b() { return this.a; }})",
-      [this](Local<Value> value) {
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("result.a instanceof Uint8Array"));
-        EXPECT_TRUE(
-            EvaluateScriptForResultBool("result.a.toString() === '4,5,6'"));
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.a === result.b"));
-      });
+      "({ a: new Uint8Array([1, 2, 3]), get b() { return this.a; }})");
+  ExpectScriptTrue("result.a instanceof Uint8Array");
+  ExpectScriptTrue("result.a.toString() === '4,5,6'");
+  ExpectScriptTrue("result.a === result.b");
 }
 
 // It's expected that WebAssembly has more exhaustive tests elsewhere; this
@@ -2770,6 +2425,7 @@ class ValueSerializerTestWithWasm : public ValueSerializerTest {
   }
 
   Local<WasmCompiledModule> MakeWasm() {
+    Context::Scope scope(serialization_context());
     return WasmCompiledModule::DeserializeOrCompile(
                isolate(), {nullptr, 0},
                {kIncrementerWasm, sizeof(kIncrementerWasm)})
@@ -2777,22 +2433,20 @@ class ValueSerializerTestWithWasm : public ValueSerializerTest {
   }
 
   void ExpectPass() {
-    RoundTripTest(
-        [this]() { return MakeWasm(); },
-        [this](Local<Value> value) {
-          ASSERT_TRUE(value->IsWebAssemblyCompiledModule());
-          EXPECT_TRUE(EvaluateScriptForResultBool(
-              "new WebAssembly.Instance(result).exports.increment(8) === 9"));
-        });
+    Local<Value> value = RoundTripTest(MakeWasm());
+    Context::Scope scope(deserialization_context());
+    ASSERT_TRUE(value->IsWebAssemblyCompiledModule());
+    ExpectScriptTrue(
+        "new WebAssembly.Instance(result).exports.increment(8) === 9");
   }
 
   void ExpectFail() {
-    EncodeTest(
-        [this]() { return MakeWasm(); },
-        [this](const std::vector<uint8_t>& data) { InvalidDecodeTest(data); });
+    const std::vector<uint8_t> data = EncodeTest(MakeWasm());
+    InvalidDecodeTest(data);
   }
 
   Local<Value> GetComplexObjectWithDuplicate() {
+    Context::Scope scope(serialization_context());
     Local<Value> wasm_module = MakeWasm();
     serialization_context()
         ->Global()
@@ -2809,14 +2463,13 @@ class ValueSerializerTestWithWasm : public ValueSerializerTest {
 
   void VerifyComplexObject(Local<Value> value) {
     ASSERT_TRUE(value->IsObject());
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "result.mod1 instanceof WebAssembly.Module"));
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "result.mod2 instanceof WebAssembly.Module"));
-    EXPECT_TRUE(EvaluateScriptForResultBool("result.num === 2"));
+    ExpectScriptTrue("result.mod1 instanceof WebAssembly.Module");
+    ExpectScriptTrue("result.mod2 instanceof WebAssembly.Module");
+    ExpectScriptTrue("result.num === 2");
   }
 
   Local<Value> GetComplexObjectWithMany() {
+    Context::Scope scope(serialization_context());
     Local<Value> wasm_module1 = MakeWasm();
     Local<Value> wasm_module2 = MakeWasm();
     serialization_context()
@@ -2858,27 +2511,22 @@ const char* ValueSerializerTestWithWasm::kUnsupportedSerialization =
 // embedder must decide serialization policy.
 TEST_F(ValueSerializerTestWithWasm, DefaultSerializationDelegate) {
   EnableThrowingSerializer();
-  InvalidEncodeTest(
-      [this]() { return MakeWasm(); },
-      [](Local<Message> message) {
-        size_t msg_len = static_cast<size_t>(message->Get()->Length());
-        std::unique_ptr<char[]> buff(new char[msg_len + 1]);
-        message->Get()->WriteOneByte(reinterpret_cast<uint8_t*>(buff.get()));
-        // the message ends with the custom error string
-        size_t custom_msg_len = strlen(kUnsupportedSerialization);
-        ASSERT_GE(msg_len, custom_msg_len);
-        size_t start_pos = msg_len - custom_msg_len;
-        ASSERT_EQ(strcmp(&buff.get()[start_pos], kUnsupportedSerialization), 0);
-      });
+  Local<Message> message = InvalidEncodeTest(MakeWasm());
+  size_t msg_len = static_cast<size_t>(message->Get()->Length());
+  std::unique_ptr<char[]> buff(new char[msg_len + 1]);
+  message->Get()->WriteOneByte(reinterpret_cast<uint8_t*>(buff.get()));
+  // the message ends with the custom error string
+  size_t custom_msg_len = strlen(kUnsupportedSerialization);
+  ASSERT_GE(msg_len, custom_msg_len);
+  size_t start_pos = msg_len - custom_msg_len;
+  ASSERT_EQ(strcmp(&buff.get()[start_pos], kUnsupportedSerialization), 0);
 }
 
 // The default deserializer throws if wasm transfer is attempted
 TEST_F(ValueSerializerTestWithWasm, DefaultDeserializationDelegate) {
   EnableTransferSerialization();
   EnableDefaultDeserializer();
-  EncodeTest(
-      [this]() { return MakeWasm(); },
-      [this](const std::vector<uint8_t>& data) { InvalidDecodeTest(data); });
+  ExpectFail();
 }
 
 // We only want to allow deserialization through
@@ -2913,43 +2561,31 @@ TEST_F(ValueSerializerTestWithWasm, CannotTransferWasmWhenExpectingInline) {
 TEST_F(ValueSerializerTestWithWasm, ComplexObjectDuplicateTransfer) {
   EnableTransferSerialization();
   EnableTransferDeserialization();
-  RoundTripTest(
-      [this]() { return GetComplexObjectWithDuplicate(); },
-      [this](Local<Value> value) {
-        VerifyComplexObject(value);
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.mod1 === result.mod2"));
-      });
+  Local<Value> value = RoundTripTest(GetComplexObjectWithDuplicate());
+  VerifyComplexObject(value);
+  ExpectScriptTrue("result.mod1 === result.mod2");
 }
 
 TEST_F(ValueSerializerTestWithWasm, ComplexObjectDuplicateInline) {
   SetExpectInlineWasm(true);
-  RoundTripTest(
-      [this]() { return GetComplexObjectWithDuplicate(); },
-      [this](Local<Value> value) {
-        VerifyComplexObject(value);
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.mod1 === result.mod2"));
-      });
+  Local<Value> value = RoundTripTest(GetComplexObjectWithDuplicate());
+  VerifyComplexObject(value);
+  ExpectScriptTrue("result.mod1 === result.mod2");
 }
 
 TEST_F(ValueSerializerTestWithWasm, ComplexObjectWithManyTransfer) {
   EnableTransferSerialization();
   EnableTransferDeserialization();
-  RoundTripTest(
-      [this]() { return GetComplexObjectWithMany(); },
-      [this](Local<Value> value) {
-        VerifyComplexObject(value);
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.mod1 != result.mod2"));
-      });
+  Local<Value> value = RoundTripTest(GetComplexObjectWithMany());
+  VerifyComplexObject(value);
+  ExpectScriptTrue("result.mod1 != result.mod2");
 }
 
 TEST_F(ValueSerializerTestWithWasm, ComplexObjectWithManyInline) {
   SetExpectInlineWasm(true);
-  RoundTripTest(
-      [this]() { return GetComplexObjectWithMany(); },
-      [this](Local<Value> value) {
-        VerifyComplexObject(value);
-        EXPECT_TRUE(EvaluateScriptForResultBool("result.mod1 != result.mod2"));
-      });
+  Local<Value> value = RoundTripTest(GetComplexObjectWithMany());
+  VerifyComplexObject(value);
+  ExpectScriptTrue("result.mod1 != result.mod2");
 }
 
 // As produced around Chrome 56.
@@ -3018,11 +2654,10 @@ TEST_F(ValueSerializerTestWithWasm, DecodeWasmModule) {
   std::vector<uint8_t> raw(
       kSerializedIncrementerWasm,
       kSerializedIncrementerWasm + sizeof(kSerializedIncrementerWasm));
-  DecodeTest(raw, [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsWebAssemblyCompiledModule());
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "new WebAssembly.Instance(result).exports.increment(8) === 9"));
-  });
+  Local<Value> value = DecodeTest(raw);
+  ASSERT_TRUE(value->IsWebAssemblyCompiledModule());
+  ExpectScriptTrue(
+      "new WebAssembly.Instance(result).exports.increment(8) === 9");
 }
 
 // As above, but with empty compiled data. Should work due to fallback to wire
@@ -3040,11 +2675,10 @@ TEST_F(ValueSerializerTestWithWasm, DecodeWasmModuleWithInvalidCompiledData) {
       kSerializedIncrementerWasmWithInvalidCompiledData,
       kSerializedIncrementerWasmWithInvalidCompiledData +
           sizeof(kSerializedIncrementerWasmWithInvalidCompiledData));
-  DecodeTest(raw, [this](Local<Value> value) {
-    ASSERT_TRUE(value->IsWebAssemblyCompiledModule());
-    EXPECT_TRUE(EvaluateScriptForResultBool(
-        "new WebAssembly.Instance(result).exports.increment(8) === 9"));
-  });
+  Local<Value> value = DecodeTest(raw);
+  ASSERT_TRUE(value->IsWebAssemblyCompiledModule());
+  ExpectScriptTrue(
+      "new WebAssembly.Instance(result).exports.increment(8) === 9");
 }
 
 // As above, but also with empty wire data. Should fail.
diff --git a/deps/v8/test/unittests/wasm/OWNERS b/deps/v8/test/unittests/wasm/OWNERS
index 972daf4d991..3972f0dd992 100644
--- a/deps/v8/test/unittests/wasm/OWNERS
+++ b/deps/v8/test/unittests/wasm/OWNERS
@@ -2,8 +2,6 @@ ahaas@chromium.org
 bradnelson@chromium.org
 clemensh@chromium.org
 eholk@chromium.org
-mtrofin@chromium.org
-rossberg@chromium.org
 titzer@chromium.org
 
 # COMPONENT: Blink>JavaScript>WebAssembly
diff --git a/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc b/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
index 5cc4bf8196a..147c42caac6 100644
--- a/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
@@ -36,7 +36,8 @@ static const byte kCodeGetLocal1[] = {kExprGetLocal, 1};
 static const byte kCodeSetLocal0[] = {WASM_SET_LOCAL(0, WASM_ZERO)};
 static const byte kCodeTeeLocal0[] = {WASM_TEE_LOCAL(0, WASM_ZERO)};
 
-static const ValueType kValueTypes[] = {kWasmI32, kWasmI64, kWasmF32, kWasmF64};
+static const ValueType kValueTypes[] = {kWasmI32, kWasmI64, kWasmF32, kWasmF64,
+                                        kWasmAnyRef};
 static const MachineType machineTypes[] = {
     MachineType::Int8(),   MachineType::Uint8(),  MachineType::Int16(),
     MachineType::Uint16(), MachineType::Int32(),  MachineType::Uint32(),
@@ -220,7 +221,6 @@ class TestModuleBuilder {
     mod.functions.push_back({sig,      // sig
                              0,        // func_index
                              0,        // sig_index
-                             {0, 0},   // name
                              {0, 0},   // code
                              false,    // import
                              false});  // export
@@ -261,6 +261,12 @@ TEST_F(FunctionBodyDecoderTest, Int32Const1) {
   }
 }
 
+TEST_F(FunctionBodyDecoderTest, RefNull) {
+  FlagScope<bool> flag_scope(&FLAG_experimental_wasm_anyref, true);
+  byte code[] = {kExprRefNull};
+  EXPECT_VERIFIES_C(r_v, code);
+}
+
 TEST_F(FunctionBodyDecoderTest, EmptyFunction) {
   byte code[] = {0};
   Verify(true, sigs.v_v(), code, code, kAppendEnd);
@@ -929,6 +935,7 @@ TEST_F(FunctionBodyDecoderTest, ReturnVoid3) {
   EXPECT_FAILURE(v_v, kExprI64Const, 0);
   EXPECT_FAILURE(v_v, kExprF32Const, 0, 0, 0, 0);
   EXPECT_FAILURE(v_v, kExprF64Const, 0, 0, 0, 0, 0, 0, 0, 0);
+  EXPECT_FAILURE(v_v, kExprRefNull);
 
   EXPECT_FAILURE(v_i, kExprGetLocal, 0);
 }
@@ -1228,6 +1235,8 @@ TEST_F(FunctionBodyDecoderTest, MacrosInt64) {
 }
 
 TEST_F(FunctionBodyDecoderTest, AllSimpleExpressions) {
+  EXPERIMENTAL_FLAG_SCOPE(se);
+  EXPERIMENTAL_FLAG_SCOPE(anyref);
 // Test all simple expressions which are described by a signature.
 #define DECODE_TEST(name, opcode, sig)                      \
   {                                                         \
@@ -2777,6 +2786,7 @@ TEST_F(WasmOpcodeLengthTest, Statements) {
 TEST_F(WasmOpcodeLengthTest, MiscExpressions) {
   EXPECT_LENGTH(5, kExprF32Const);
   EXPECT_LENGTH(9, kExprF64Const);
+  EXPECT_LENGTH(1, kExprRefNull);
   EXPECT_LENGTH(2, kExprGetLocal);
   EXPECT_LENGTH(2, kExprSetLocal);
   EXPECT_LENGTH(2, kExprGetGlobal);
@@ -2964,6 +2974,7 @@ TEST_F(WasmOpcodeLengthTest, SimpleExpressions) {
   EXPECT_LENGTH(1, kExprF64ReinterpretI64);
   EXPECT_LENGTH(1, kExprI32ReinterpretF32);
   EXPECT_LENGTH(1, kExprI64ReinterpretF64);
+  EXPECT_LENGTH(1, kExprRefEq);
 }
 
 TEST_F(WasmOpcodeLengthTest, SimdExpressions) {
@@ -3013,6 +3024,7 @@ TEST_F(LocalDeclDecoderTest, NoLocals) {
 }
 
 TEST_F(LocalDeclDecoderTest, OneLocal) {
+  EXPERIMENTAL_FLAG_SCOPE(anyref);
   for (size_t i = 0; i < arraysize(kValueTypes); i++) {
     ValueType type = kValueTypes[i];
     const byte data[] = {
@@ -3028,6 +3040,7 @@ TEST_F(LocalDeclDecoderTest, OneLocal) {
 }
 
 TEST_F(LocalDeclDecoderTest, FiveLocals) {
+  EXPERIMENTAL_FLAG_SCOPE(anyref);
   for (size_t i = 0; i < arraysize(kValueTypes); i++) {
     ValueType type = kValueTypes[i];
     const byte data[] = {
diff --git a/deps/v8/test/unittests/wasm/module-decoder-unittest.cc b/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
index a472623096d..a8c1bccea3f 100644
--- a/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
@@ -137,7 +137,8 @@ struct ValueTypePair {
 } kValueTypes[] = {{kLocalI32, kWasmI32},
                    {kLocalI64, kWasmI64},
                    {kLocalF32, kWasmF32},
-                   {kLocalF64, kWasmF64}};
+                   {kLocalF64, kWasmF64},
+                   {kLocalAnyRef, kWasmAnyRef}};
 
 class WasmModuleVerifyTest : public TestWithIsolateAndZone {
  public:
@@ -894,7 +895,17 @@ TEST_F(WasmModuleVerifyTest, IndirectFunctionInvalidIndex) {
   EXPECT_FAILURE(data);
 }
 
-class WasmSignatureDecodeTest : public TestWithZone {};
+class WasmSignatureDecodeTest : public TestWithZone {
+ public:
+  WasmSignatureDecodeTest()
+      // In the following tests we turn on support for AnyRef by default. There
+      // is a test (Fail_anyref_without_flag) which explicitly turns off support
+      // for AnyRef.
+      : flag_scope(&FLAG_experimental_wasm_anyref, true) {}
+
+ private:
+  FlagScope<bool> flag_scope;
+};
 
 TEST_F(WasmSignatureDecodeTest, Ok_v_v) {
   static const byte data[] = {SIG_ENTRY_v_v};
@@ -1010,6 +1021,19 @@ TEST_F(WasmSignatureDecodeTest, Fail_off_end) {
   }
 }
 
+TEST_F(WasmSignatureDecodeTest, Fail_anyref_without_flag) {
+  // Disable AnyRef support and check that decoding fails.
+  FlagScope<bool> flag_scope(&FLAG_experimental_wasm_anyref, false);
+  byte kInvalidType = kLocalAnyRef;
+  for (size_t i = 0; i < SIZEOF_SIG_ENTRY_x_xx; i++) {
+    byte data[] = {SIG_ENTRY_x_xx(kLocalI32, kLocalI32, kLocalI32)};
+    data[i] = kInvalidType;
+    FunctionSig* sig =
+        DecodeWasmSignatureForTesting(zone(), data, data + sizeof(data));
+    EXPECT_EQ(nullptr, sig);
+  }
+}
+
 TEST_F(WasmSignatureDecodeTest, Fail_invalid_type) {
   byte kInvalidType = 76;
   for (size_t i = 0; i < SIZEOF_SIG_ENTRY_x_xx; i++) {
@@ -1075,7 +1099,6 @@ TEST_F(WasmFunctionVerifyTest, Ok_v_v_empty) {
     WasmFunction* function = result.val.get();
     EXPECT_EQ(0u, function->sig->parameter_count());
     EXPECT_EQ(0u, function->sig->return_count());
-    EXPECT_EQ(0u, function->name.offset());
     EXPECT_EQ(static_cast<uint32_t>(SIZEOF_SIG_ENTRY_v_v),
               function->code.offset());
     EXPECT_EQ(sizeof(data), function->code.end_offset());
diff --git a/deps/v8/test/unittests/wasm/trap-handler-unittest.cc b/deps/v8/test/unittests/wasm/trap-handler-unittest.cc
index eb578647add..1b4ddf5bb0e 100644
--- a/deps/v8/test/unittests/wasm/trap-handler-unittest.cc
+++ b/deps/v8/test/unittests/wasm/trap-handler-unittest.cc
@@ -13,7 +13,7 @@
 
 namespace {
 
-#if V8_OS_POSIX
+#if V8_TRAP_HANDLER_SUPPORTED
 
 void CrashOnPurpose() { *reinterpret_cast<volatile int*>(42); }
 
@@ -52,7 +52,8 @@ sigjmp_buf SignalHandlerFallbackTest::continuation_;
 TEST_F(SignalHandlerFallbackTest, DoTest) {
   const int save_sigs = 1;
   if (!sigsetjmp(continuation_, save_sigs)) {
-    v8::V8::RegisterDefaultSignalHandler();
+    constexpr bool use_default_signal_handler = true;
+    CHECK(v8::V8::EnableWebAssemblyTrapHandler(use_default_signal_handler));
     CrashOnPurpose();
     FAIL();
   } else {
diff --git a/deps/v8/test/unittests/wasm/wasm-code-manager-unittest.cc b/deps/v8/test/unittests/wasm/wasm-code-manager-unittest.cc
index 1b6af25a4a8..6292d32947e 100644
--- a/deps/v8/test/unittests/wasm/wasm-code-manager-unittest.cc
+++ b/deps/v8/test/unittests/wasm/wasm-code-manager-unittest.cc
@@ -151,14 +151,13 @@ TEST_F(DisjointAllocationPoolTest, MergingSkipLargerSrcWithGap) {
   CheckLooksLike(a, {{10, 15}, {20, 35}, {36, 40}});
 }
 
-class WasmCodeManagerTest : public TestWithIsolate {
+enum ModuleStyle : int { Fixed = 0, Growable = 1 };
+
+class WasmCodeManagerTest : public TestWithContext,
+                            public ::testing::WithParamInterface<ModuleStyle> {
  public:
   using NativeModulePtr = std::unique_ptr<NativeModule>;
-  enum ModuleStyle : int { Fixed = 0, Growable = 1 };
 
-  const std::vector<ModuleStyle> styles() const {
-    return std::vector<ModuleStyle>({Fixed, Growable});
-  }
   // We pretend all our modules have 10 functions and no imports, just so
   // we can size up the code_table.
   NativeModulePtr AllocFixedModule(WasmCodeManager* manager, size_t size) {
@@ -187,7 +186,9 @@ class WasmCodeManagerTest : public TestWithIsolate {
     std::unique_ptr<byte[]> exec_buff(new byte[size]);
     desc.buffer = exec_buff.get();
     desc.instr_size = static_cast<int>(size);
-    return native_module->AddCode(desc, 0, index, 0, {}, false);
+    Handle<ByteArray> source_pos = i_isolate()->factory()->empty_byte_array();
+    return native_module->AddCode(desc, 0, index, 0, 0, {}, source_pos,
+                                  WasmCode::kOther);
   }
 
   size_t page() const { return AllocatePageSize(); }
@@ -196,194 +197,171 @@ class WasmCodeManagerTest : public TestWithIsolate {
   }
 };
 
-TEST_F(WasmCodeManagerTest, EmptyCase) {
-  for (auto style : styles()) {
-    WasmCodeManager manager(v8_isolate(), 0 * page());
-    CHECK_EQ(0, manager.remaining_uncommitted());
-
-    NativeModulePtr native_module = AllocModule(&manager, 1 * page(), style);
-    CHECK(native_module);
-    WasmCode* code = AddCode(native_module.get(), 0, 10);
-    CHECK_NULL(code);
-    CHECK_EQ(0, manager.remaining_uncommitted());
-    native_module.reset();
-    CHECK_EQ(0, manager.remaining_uncommitted());
-  }
+INSTANTIATE_TEST_CASE_P(Parameterized, WasmCodeManagerTest,
+                        ::testing::Values(Fixed, Growable));
+
+TEST_P(WasmCodeManagerTest, EmptyCase) {
+  WasmCodeManager manager(v8_isolate(), 0 * page());
+  CHECK_EQ(0, manager.remaining_uncommitted());
+
+  NativeModulePtr native_module = AllocModule(&manager, 1 * page(), GetParam());
+  CHECK(native_module);
+  ASSERT_DEATH_IF_SUPPORTED(AddCode(native_module.get(), 0, 10),
+                            "OOM in NativeModule::AddOwnedCode");
 }
 
-TEST_F(WasmCodeManagerTest, AllocateAndGoOverLimit) {
-  for (auto style : styles()) {
-    WasmCodeManager manager(v8_isolate(), 1 * page());
-    CHECK_EQ(1 * page(), manager.remaining_uncommitted());
-    NativeModulePtr native_module = AllocModule(&manager, 1 * page(), style);
-    CHECK(native_module);
-    CHECK_EQ(1 * page(), manager.remaining_uncommitted());
-    uint32_t index = 0;
-    WasmCode* code = AddCode(native_module.get(), index++, 1 * kCodeAlignment);
-    CHECK_NOT_NULL(code);
-    CHECK_EQ(0, manager.remaining_uncommitted());
-
-    code = AddCode(native_module.get(), index++, 3 * kCodeAlignment);
-    CHECK_NOT_NULL(code);
-    CHECK_EQ(0, manager.remaining_uncommitted());
-
-    code = AddCode(native_module.get(), index++, page() - 4 * kCodeAlignment);
-    CHECK_NOT_NULL(code);
-    CHECK_EQ(0, manager.remaining_uncommitted());
-
-    code = AddCode(native_module.get(), index++, 1 * kCodeAlignment);
-    CHECK_NULL(code);
-    CHECK_EQ(0, manager.remaining_uncommitted());
-
-    native_module.reset();
-    CHECK_EQ(1 * page(), manager.remaining_uncommitted());
-  }
+TEST_P(WasmCodeManagerTest, AllocateAndGoOverLimit) {
+  WasmCodeManager manager(v8_isolate(), 1 * page());
+  CHECK_EQ(1 * page(), manager.remaining_uncommitted());
+  NativeModulePtr native_module = AllocModule(&manager, 1 * page(), GetParam());
+  CHECK(native_module);
+  CHECK_EQ(1 * page(), manager.remaining_uncommitted());
+  uint32_t index = 0;
+  WasmCode* code = AddCode(native_module.get(), index++, 1 * kCodeAlignment);
+  CHECK_NOT_NULL(code);
+  CHECK_EQ(0, manager.remaining_uncommitted());
+
+  code = AddCode(native_module.get(), index++, 3 * kCodeAlignment);
+  CHECK_NOT_NULL(code);
+  CHECK_EQ(0, manager.remaining_uncommitted());
+
+  code = AddCode(native_module.get(), index++, page() - 4 * kCodeAlignment);
+  CHECK_NOT_NULL(code);
+  CHECK_EQ(0, manager.remaining_uncommitted());
+
+  ASSERT_DEATH_IF_SUPPORTED(
+      AddCode(native_module.get(), index++, 1 * kCodeAlignment),
+      "OOM in NativeModule::AddOwnedCode");
 }
 
-TEST_F(WasmCodeManagerTest, TotalLimitIrrespectiveOfModuleCount) {
-  for (auto style : styles()) {
-    WasmCodeManager manager(v8_isolate(), 1 * page());
-    NativeModulePtr nm1 = AllocModule(&manager, 1 * page(), style);
-    NativeModulePtr nm2 = AllocModule(&manager, 1 * page(), style);
-    CHECK(nm1);
-    CHECK(nm2);
-    WasmCode* code = AddCode(nm1.get(), 0, 1 * page());
-    CHECK_NOT_NULL(code);
-    code = AddCode(nm2.get(), 0, 1 * page());
-    CHECK_NULL(code);
-  }
+TEST_P(WasmCodeManagerTest, TotalLimitIrrespectiveOfModuleCount) {
+  WasmCodeManager manager(v8_isolate(), 1 * page());
+  NativeModulePtr nm1 = AllocModule(&manager, 1 * page(), GetParam());
+  NativeModulePtr nm2 = AllocModule(&manager, 1 * page(), GetParam());
+  CHECK(nm1);
+  CHECK(nm2);
+  WasmCode* code = AddCode(nm1.get(), 0, 1 * page());
+  CHECK_NOT_NULL(code);
+  ASSERT_DEATH_IF_SUPPORTED(AddCode(nm2.get(), 0, 1 * page()),
+                            "OOM in NativeModule::AddOwnedCode");
 }
 
-TEST_F(WasmCodeManagerTest, DifferentHeapsApplyLimitsIndependently) {
-  for (auto style : styles()) {
-    WasmCodeManager manager1(v8_isolate(), 1 * page());
-    WasmCodeManager manager2(v8_isolate(), 2 * page());
-    NativeModulePtr nm1 = AllocModule(&manager1, 1 * page(), style);
-    NativeModulePtr nm2 = AllocModule(&manager2, 1 * page(), style);
-    CHECK(nm1);
-    CHECK(nm2);
-    WasmCode* code = AddCode(nm1.get(), 0, 1 * page());
-    CHECK_NOT_NULL(code);
-    CHECK_EQ(0, manager1.remaining_uncommitted());
-    code = AddCode(nm2.get(), 0, 1 * page());
-    CHECK_NOT_NULL(code);
-  }
+TEST_P(WasmCodeManagerTest, DifferentHeapsApplyLimitsIndependently) {
+  WasmCodeManager manager1(v8_isolate(), 1 * page());
+  WasmCodeManager manager2(v8_isolate(), 2 * page());
+  NativeModulePtr nm1 = AllocModule(&manager1, 1 * page(), GetParam());
+  NativeModulePtr nm2 = AllocModule(&manager2, 1 * page(), GetParam());
+  CHECK(nm1);
+  CHECK(nm2);
+  WasmCode* code = AddCode(nm1.get(), 0, 1 * page());
+  CHECK_NOT_NULL(code);
+  CHECK_EQ(0, manager1.remaining_uncommitted());
+  code = AddCode(nm2.get(), 0, 1 * page());
+  CHECK_NOT_NULL(code);
 }
 
-TEST_F(WasmCodeManagerTest, GrowingVsFixedModule) {
-  for (auto style : styles()) {
-    WasmCodeManager manager(v8_isolate(), 3 * page());
-    NativeModulePtr nm = AllocModule(&manager, 1 * page(), style);
-    WasmCode* code = AddCode(nm.get(), 0, 1 * page() + kCodeAlignment);
-    if (style == Fixed) {
-      CHECK_NULL(code);
-      CHECK_EQ(manager.remaining_uncommitted(), 3 * page());
-    } else {
-      CHECK_NOT_NULL(code);
-      CHECK_EQ(manager.remaining_uncommitted(), 1 * page());
-    }
+TEST_P(WasmCodeManagerTest, GrowingVsFixedModule) {
+  WasmCodeManager manager(v8_isolate(), 3 * page());
+  NativeModulePtr nm = AllocModule(&manager, 1 * page(), GetParam());
+  if (GetParam() == Fixed) {
+    ASSERT_DEATH_IF_SUPPORTED(AddCode(nm.get(), 0, 1 * page() + kCodeAlignment),
+                              "OOM in NativeModule::AddOwnedCode");
+  } else {
+    CHECK_NOT_NULL(AddCode(nm.get(), 0, 1 * page() + kCodeAlignment));
+    CHECK_EQ(manager.remaining_uncommitted(), 1 * page());
   }
 }
 
-TEST_F(WasmCodeManagerTest, CommitIncrements) {
-  for (auto style : styles()) {
-    WasmCodeManager manager(v8_isolate(), 10 * page());
-    NativeModulePtr nm = AllocModule(&manager, 3 * page(), style);
-    WasmCode* code = AddCode(nm.get(), 0, kCodeAlignment);
-    CHECK_NOT_NULL(code);
-    CHECK_EQ(manager.remaining_uncommitted(), 9 * page());
-    code = AddCode(nm.get(), 1, 2 * page());
-    CHECK_NOT_NULL(code);
-    CHECK_EQ(manager.remaining_uncommitted(), 7 * page());
-    code = AddCode(nm.get(), 2, page() - kCodeAlignment);
-    CHECK_NOT_NULL(code);
-    CHECK_EQ(manager.remaining_uncommitted(), 7 * page());
-  }
+TEST_P(WasmCodeManagerTest, CommitIncrements) {
+  WasmCodeManager manager(v8_isolate(), 10 * page());
+  NativeModulePtr nm = AllocModule(&manager, 3 * page(), GetParam());
+  WasmCode* code = AddCode(nm.get(), 0, kCodeAlignment);
+  CHECK_NOT_NULL(code);
+  CHECK_EQ(manager.remaining_uncommitted(), 9 * page());
+  code = AddCode(nm.get(), 1, 2 * page());
+  CHECK_NOT_NULL(code);
+  CHECK_EQ(manager.remaining_uncommitted(), 7 * page());
+  code = AddCode(nm.get(), 2, page() - kCodeAlignment);
+  CHECK_NOT_NULL(code);
+  CHECK_EQ(manager.remaining_uncommitted(), 7 * page());
 }
 
-TEST_F(WasmCodeManagerTest, Lookup) {
-  for (auto style : styles()) {
-    WasmCodeManager manager(v8_isolate(), 2 * page());
-
-    NativeModulePtr nm1 = AllocModule(&manager, 1 * page(), style);
-    NativeModulePtr nm2 = AllocModule(&manager, 1 * page(), style);
-    WasmCode* code1_0 = AddCode(nm1.get(), 0, kCodeAlignment);
-    CHECK_EQ(nm1.get(), code1_0->owner());
-    WasmCode* code1_1 = AddCode(nm1.get(), 1, kCodeAlignment);
-    WasmCode* code2_0 = AddCode(nm2.get(), 0, kCodeAlignment);
-    WasmCode* code2_1 = AddCode(nm2.get(), 1, kCodeAlignment);
-    CHECK_EQ(nm2.get(), code2_1->owner());
-
-    CHECK_EQ(0, code1_0->index());
-    CHECK_EQ(1, code1_1->index());
-    CHECK_EQ(0, code2_0->index());
-    CHECK_EQ(1, code2_1->index());
-
-    // we know the manager object is allocated here, so we shouldn't
-    // find any WasmCode* associated with that ptr.
-    WasmCode* not_found =
-        manager.LookupCode(reinterpret_cast<Address>(&manager));
-    CHECK_NULL(not_found);
-    WasmCode* found = manager.LookupCode(code1_0->instructions().start());
-    CHECK_EQ(found, code1_0);
-    found = manager.LookupCode(code2_1->instructions().start() +
-                               (code2_1->instructions().size() / 2));
-    CHECK_EQ(found, code2_1);
-    found = manager.LookupCode(code2_1->instructions().start() +
-                               code2_1->instructions().size() - 1);
-    CHECK_EQ(found, code2_1);
-    found = manager.LookupCode(code2_1->instructions().start() +
-                               code2_1->instructions().size());
-    CHECK_NULL(found);
-    Address mid_code1_1 =
-        code1_1->instructions().start() + (code1_1->instructions().size() / 2);
-    CHECK_EQ(code1_1, manager.LookupCode(mid_code1_1));
-    nm1.reset();
-    CHECK_NULL(manager.LookupCode(mid_code1_1));
-  }
+TEST_P(WasmCodeManagerTest, Lookup) {
+  WasmCodeManager manager(v8_isolate(), 2 * page());
+
+  NativeModulePtr nm1 = AllocModule(&manager, 1 * page(), GetParam());
+  NativeModulePtr nm2 = AllocModule(&manager, 1 * page(), GetParam());
+  WasmCode* code1_0 = AddCode(nm1.get(), 0, kCodeAlignment);
+  CHECK_EQ(nm1.get(), code1_0->native_module());
+  WasmCode* code1_1 = AddCode(nm1.get(), 1, kCodeAlignment);
+  WasmCode* code2_0 = AddCode(nm2.get(), 0, kCodeAlignment);
+  WasmCode* code2_1 = AddCode(nm2.get(), 1, kCodeAlignment);
+  CHECK_EQ(nm2.get(), code2_1->native_module());
+
+  CHECK_EQ(0, code1_0->index());
+  CHECK_EQ(1, code1_1->index());
+  CHECK_EQ(0, code2_0->index());
+  CHECK_EQ(1, code2_1->index());
+
+  // we know the manager object is allocated here, so we shouldn't
+  // find any WasmCode* associated with that ptr.
+  WasmCode* not_found = manager.LookupCode(reinterpret_cast<Address>(&manager));
+  CHECK_NULL(not_found);
+  WasmCode* found = manager.LookupCode(code1_0->instructions().start());
+  CHECK_EQ(found, code1_0);
+  found = manager.LookupCode(code2_1->instructions().start() +
+                             (code2_1->instructions().size() / 2));
+  CHECK_EQ(found, code2_1);
+  found = manager.LookupCode(code2_1->instructions().start() +
+                             code2_1->instructions().size() - 1);
+  CHECK_EQ(found, code2_1);
+  found = manager.LookupCode(code2_1->instructions().start() +
+                             code2_1->instructions().size());
+  CHECK_NULL(found);
+  Address mid_code1_1 =
+      code1_1->instructions().start() + (code1_1->instructions().size() / 2);
+  CHECK_EQ(code1_1, manager.LookupCode(mid_code1_1));
+  nm1.reset();
+  CHECK_NULL(manager.LookupCode(mid_code1_1));
 }
 
-TEST_F(WasmCodeManagerTest, MultiManagerLookup) {
-  for (auto style : styles()) {
-    WasmCodeManager manager1(v8_isolate(), 2 * page());
-    WasmCodeManager manager2(v8_isolate(), 2 * page());
+TEST_P(WasmCodeManagerTest, MultiManagerLookup) {
+  WasmCodeManager manager1(v8_isolate(), 2 * page());
+  WasmCodeManager manager2(v8_isolate(), 2 * page());
 
-    NativeModulePtr nm1 = AllocModule(&manager1, 1 * page(), style);
-    NativeModulePtr nm2 = AllocModule(&manager2, 1 * page(), style);
+  NativeModulePtr nm1 = AllocModule(&manager1, 1 * page(), GetParam());
+  NativeModulePtr nm2 = AllocModule(&manager2, 1 * page(), GetParam());
 
-    WasmCode* code1_0 = AddCode(nm1.get(), 0, kCodeAlignment);
-    CHECK_EQ(nm1.get(), code1_0->owner());
-    WasmCode* code1_1 = AddCode(nm1.get(), 1, kCodeAlignment);
-    WasmCode* code2_0 = AddCode(nm2.get(), 0, kCodeAlignment);
-    WasmCode* code2_1 = AddCode(nm2.get(), 1, kCodeAlignment);
-    CHECK_EQ(nm2.get(), code2_1->owner());
+  WasmCode* code1_0 = AddCode(nm1.get(), 0, kCodeAlignment);
+  CHECK_EQ(nm1.get(), code1_0->native_module());
+  WasmCode* code1_1 = AddCode(nm1.get(), 1, kCodeAlignment);
+  WasmCode* code2_0 = AddCode(nm2.get(), 0, kCodeAlignment);
+  WasmCode* code2_1 = AddCode(nm2.get(), 1, kCodeAlignment);
+  CHECK_EQ(nm2.get(), code2_1->native_module());
 
-    CHECK_EQ(0, code1_0->index());
-    CHECK_EQ(1, code1_1->index());
-    CHECK_EQ(0, code2_0->index());
-    CHECK_EQ(1, code2_1->index());
+  CHECK_EQ(0, code1_0->index());
+  CHECK_EQ(1, code1_1->index());
+  CHECK_EQ(0, code2_0->index());
+  CHECK_EQ(1, code2_1->index());
 
-    CHECK_EQ(code1_0, manager1.LookupCode(code1_0->instructions().start()));
-    CHECK_NULL(manager2.LookupCode(code1_0->instructions().start()));
-  }
+  CHECK_EQ(code1_0, manager1.LookupCode(code1_0->instructions().start()));
+  CHECK_NULL(manager2.LookupCode(code1_0->instructions().start()));
 }
 
-TEST_F(WasmCodeManagerTest, LookupWorksAfterRewrite) {
-  for (auto style : styles()) {
-    WasmCodeManager manager(v8_isolate(), 2 * page());
-
-    NativeModulePtr nm1 = AllocModule(&manager, 1 * page(), style);
-
-    WasmCode* code0 = AddCode(nm1.get(), 0, kCodeAlignment);
-    WasmCode* code1 = AddCode(nm1.get(), 1, kCodeAlignment);
-    CHECK_EQ(0, code0->index());
-    CHECK_EQ(1, code1->index());
-    CHECK_EQ(code1, manager.LookupCode(code1->instructions().start()));
-    WasmCode* code1_1 = AddCode(nm1.get(), 1, kCodeAlignment);
-    CHECK_EQ(1, code1_1->index());
-    CHECK_EQ(code1, manager.LookupCode(code1->instructions().start()));
-    CHECK_EQ(code1_1, manager.LookupCode(code1_1->instructions().start()));
-  }
+TEST_P(WasmCodeManagerTest, LookupWorksAfterRewrite) {
+  WasmCodeManager manager(v8_isolate(), 2 * page());
+
+  NativeModulePtr nm1 = AllocModule(&manager, 1 * page(), GetParam());
+
+  WasmCode* code0 = AddCode(nm1.get(), 0, kCodeAlignment);
+  WasmCode* code1 = AddCode(nm1.get(), 1, kCodeAlignment);
+  CHECK_EQ(0, code0->index());
+  CHECK_EQ(1, code1->index());
+  CHECK_EQ(code1, manager.LookupCode(code1->instructions().start()));
+  WasmCode* code1_1 = AddCode(nm1.get(), 1, kCodeAlignment);
+  CHECK_EQ(1, code1_1->index());
+  CHECK_EQ(code1, manager.LookupCode(code1->instructions().start()));
+  CHECK_EQ(code1_1, manager.LookupCode(code1_1->instructions().start()));
 }
 
 }  // namespace wasm_heap_unittest
diff --git a/deps/v8/test/unittests/zone/zone-chunk-list-unittest.cc b/deps/v8/test/unittests/zone/zone-chunk-list-unittest.cc
index 73e43a30d99..0883dd95387 100644
--- a/deps/v8/test/unittests/zone/zone-chunk-list-unittest.cc
+++ b/deps/v8/test/unittests/zone/zone-chunk-list-unittest.cc
@@ -202,5 +202,83 @@ TEST(ZoneChunkList, BigCopyToTest) {
   }
 }
 
+void TestForwardIterationOfConstList(
+    const ZoneChunkList<uintptr_t>& zone_chunk_list) {
+  size_t count = 0;
+
+  for (uintptr_t item : zone_chunk_list) {
+    EXPECT_EQ(static_cast<size_t>(item), count);
+    count++;
+  }
+
+  EXPECT_EQ(count, kItemCount);
+}
+
+TEST(ZoneChunkList, ConstForwardIterationTest) {
+  AccountingAllocator allocator;
+  Zone zone(&allocator, ZONE_NAME);
+
+  ZoneChunkList<uintptr_t> zone_chunk_list(&zone);
+
+  for (size_t i = 0; i < kItemCount; ++i) {
+    zone_chunk_list.push_back(static_cast<uintptr_t>(i));
+  }
+
+  TestForwardIterationOfConstList(zone_chunk_list);
+}
+
+TEST(ZoneChunkList, RewindAndIterate) {
+  // Regression test for https://bugs.chromium.org/p/v8/issues/detail?id=7478
+  AccountingAllocator allocator;
+  Zone zone(&allocator, ZONE_NAME);
+
+  ZoneChunkList<int> zone_chunk_list(&zone);
+
+  // Fill the list enough so that it will contain 2 chunks.
+  int chunk_size = static_cast<int>(ZoneChunkList<int>::StartMode::kSmall);
+  for (int i = 0; i < chunk_size + 1; ++i) {
+    zone_chunk_list.push_back(i);
+  }
+
+  // Rewind and fill the first chunk again.
+  zone_chunk_list.Rewind();
+  for (int i = 0; i < chunk_size; ++i) {
+    zone_chunk_list.push_back(i);
+  }
+
+  std::vector<int> expected;
+  for (int i = 0; i < chunk_size; ++i) {
+    expected.push_back(i);
+  }
+  std::vector<int> got;
+
+  // Iterate. This used to not yield the expected result, since the end iterator
+  // was in a weird state, and the running iterator didn't reach it after the
+  // first chunk.
+  auto it = zone_chunk_list.begin();
+  while (it != zone_chunk_list.end()) {
+    int value = *it;
+    got.push_back(value);
+    ++it;
+  }
+  CHECK_EQ(expected.size(), got.size());
+  for (size_t i = 0; i < expected.size(); ++i) {
+    CHECK_EQ(expected[i], got[i]);
+  }
+}
+
+TEST(ZoneChunkList, PushBackPopBackSize) {
+  // Regression test for https://bugs.chromium.org/p/v8/issues/detail?id=7489
+  AccountingAllocator allocator;
+  Zone zone(&allocator, ZONE_NAME);
+
+  ZoneChunkList<int> zone_chunk_list(&zone);
+  CHECK_EQ(size_t(0), zone_chunk_list.size());
+  zone_chunk_list.push_back(1);
+  CHECK_EQ(size_t(1), zone_chunk_list.size());
+  zone_chunk_list.pop_back();
+  CHECK_EQ(size_t(0), zone_chunk_list.size());
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/wasm-spec-tests/BUILD.gn b/deps/v8/test/wasm-spec-tests/BUILD.gn
new file mode 100644
index 00000000000..29f5ec142fc
--- /dev/null
+++ b/deps/v8/test/wasm-spec-tests/BUILD.gn
@@ -0,0 +1,16 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+group("v8_wasm_spec_tests") {
+  testonly = true
+
+  data_deps = [
+    "../..:d8",
+    "../../tools:v8_testrunner",
+  ]
+
+  data = [
+    "./",
+  ]
+}
diff --git a/deps/v8/test/wasm-spec-tests/OWNERS b/deps/v8/test/wasm-spec-tests/OWNERS
index c42a6f4caa2..88cf9bea307 100644
--- a/deps/v8/test/wasm-spec-tests/OWNERS
+++ b/deps/v8/test/wasm-spec-tests/OWNERS
@@ -1,6 +1,5 @@
 ahaas@chromium.org
 clemensh@chromium.org
 machenbach@chromium.org
-rossberg@chromium.org
 
 # COMPONENT: Blink>JavaScript>WebAssembly
diff --git a/deps/v8/test/wasm-spec-tests/testcfg.py b/deps/v8/test/wasm-spec-tests/testcfg.py
index 7f99ed4711f..3571b628079 100644
--- a/deps/v8/test/wasm-spec-tests/testcfg.py
+++ b/deps/v8/test/wasm-spec-tests/testcfg.py
@@ -8,7 +8,7 @@
 from testrunner.objects import testcase
 
 class TestSuite(testsuite.TestSuite):
-  def ListTests(self, context):
+  def ListTests(self):
     tests = []
     for dirname, dirs, files in os.walk(self.root):
       for dotted in [x for x in dirs if x.startswith('.')]:
@@ -27,9 +27,9 @@ def _test_class(self):
 
 
 class TestCase(testcase.TestCase):
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     return [os.path.join(self.suite.root, self.path + self._get_suffix())]
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1 b/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1
index 6fc33c12e2b..43d7bf01ee4 100644
--- a/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1
+++ b/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1
@@ -1 +1 @@
-310ca173c041a53775a713ac948c3627ae357f8d
\ No newline at end of file
+7f228226bee9e163f4dcc18ab3219240eeb004cb
\ No newline at end of file
diff --git a/deps/v8/test/wasm-spec-tests/wasm-spec-tests.gyp b/deps/v8/test/wasm-spec-tests/wasm-spec-tests.gyp
deleted file mode 100644
index 711f982c9ab..00000000000
--- a/deps/v8/test/wasm-spec-tests/wasm-spec-tests.gyp
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2017 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'wasm_spec_tests_run',
-          'type': 'none',
-          'dependencies': [
-            '../../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../../gypfiles/features.gypi',
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'wasm-spec-tests.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/wasm-spec-tests/wasm-spec-tests.isolate b/deps/v8/test/wasm-spec-tests/wasm-spec-tests.isolate
deleted file mode 100644
index 4c29f9fed70..00000000000
--- a/deps/v8/test/wasm-spec-tests/wasm-spec-tests.isolate
+++ /dev/null
@@ -1,15 +0,0 @@
-# Copyright 2017 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'files': [
-      './',
-    ],
-  },
-  'includes': [
-    '../../src/d8.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
-
diff --git a/deps/v8/test/webkit/BUILD.gn b/deps/v8/test/webkit/BUILD.gn
new file mode 100644
index 00000000000..eea8e6fc012
--- /dev/null
+++ b/deps/v8/test/webkit/BUILD.gn
@@ -0,0 +1,16 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+group("v8_webkit") {
+  testonly = true
+
+  data_deps = [
+    "../..:d8",
+    "../../tools:v8_testrunner",
+  ]
+
+  data = [
+    "./",
+  ]
+}
diff --git a/deps/v8/test/webkit/fast/js/Promise-resolve-with-then-exception-expected.txt b/deps/v8/test/webkit/fast/js/Promise-resolve-with-then-exception-expected.txt
index 7c2a301dc34..8b44ae59b5c 100644
--- a/deps/v8/test/webkit/fast/js/Promise-resolve-with-then-exception-expected.txt
+++ b/deps/v8/test/webkit/fast/js/Promise-resolve-with-then-exception-expected.txt
@@ -3,8 +3,6 @@ Test whether Promise treats thenable correctly.
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 The promise is already rejected now.
-PASS rejected
-PASS result is "hello"
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/deps/v8/test/webkit/fast/js/parser-syntax-check-expected.txt b/deps/v8/test/webkit/fast/js/parser-syntax-check-expected.txt
index 2a09635ebe4..f6dbe354e7f 100644
--- a/deps/v8/test/webkit/fast/js/parser-syntax-check-expected.txt
+++ b/deps/v8/test/webkit/fast/js/parser-syntax-check-expected.txt
@@ -497,8 +497,8 @@ PASS Invalid: "try {} finally {} catch(e) {}"
 PASS Invalid: "function f() { try {} finally {} catch(e) {} }"
 PASS Invalid: "try {} catch (...) {}"
 PASS Invalid: "function f() { try {} catch (...) {} }"
-PASS Invalid: "try {} catch {}"
-PASS Invalid: "function f() { try {} catch {} }"
+PASS Valid:   "try {} catch {}"
+PASS Valid:   "function f() { try {} catch {} }"
 PASS Valid:   "if (a) try {} finally {} else b;"
 PASS Valid:   "function f() { if (a) try {} finally {} else b; }"
 PASS Valid:   "if (--a()) do with(1) try {} catch(ke) { f() ; g() } while (a in b) else {}"
diff --git a/deps/v8/test/webkit/fast/js/parser-syntax-check.js b/deps/v8/test/webkit/fast/js/parser-syntax-check.js
index 6902f530a46..15be4b048bc 100644
--- a/deps/v8/test/webkit/fast/js/parser-syntax-check.js
+++ b/deps/v8/test/webkit/fast/js/parser-syntax-check.js
@@ -331,7 +331,7 @@ invalid("try {} catch(e)");
 invalid("try {} finally");
 invalid("try {} finally {} catch(e) {}");
 invalid("try {} catch (...) {}");
-invalid("try {} catch {}");
+valid  ("try {} catch {}");
 valid  ("if (a) try {} finally {} else b;");
 valid  ("if (--a()) do with(1) try {} catch(ke) { f() ; g() } while (a in b) else {}");
 invalid("if (a) try {} else b; catch (e) { }");
diff --git a/deps/v8/test/webkit/string-trim-expected.txt b/deps/v8/test/webkit/string-trim-expected.txt
index 6472f89d0b4..22d2e4776a5 100644
--- a/deps/v8/test/webkit/string-trim-expected.txt
+++ b/deps/v8/test/webkit/string-trim-expected.txt
@@ -21,130 +21,212 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 # SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-This test checks String.trim(), String.trimLeft() and String.trimRight() methods.
+This test checks the `trim`, `trimStart`/`trimLeft`, and `trimEnd`/`trimRight` methods on `String.prototype`.
 
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
 PASS whitespace[0].s.trim() is ''
+PASS whitespace[0].s.trimStart() is ''
 PASS whitespace[0].s.trimLeft() is ''
+PASS whitespace[0].s.trimEnd() is ''
 PASS whitespace[0].s.trimRight() is ''
 PASS whitespace[1].s.trim() is ''
+PASS whitespace[1].s.trimStart() is ''
 PASS whitespace[1].s.trimLeft() is ''
+PASS whitespace[1].s.trimEnd() is ''
 PASS whitespace[1].s.trimRight() is ''
 PASS whitespace[2].s.trim() is ''
+PASS whitespace[2].s.trimStart() is ''
 PASS whitespace[2].s.trimLeft() is ''
+PASS whitespace[2].s.trimEnd() is ''
 PASS whitespace[2].s.trimRight() is ''
 PASS whitespace[3].s.trim() is ''
+PASS whitespace[3].s.trimStart() is ''
 PASS whitespace[3].s.trimLeft() is ''
+PASS whitespace[3].s.trimEnd() is ''
 PASS whitespace[3].s.trimRight() is ''
 PASS whitespace[4].s.trim() is ''
+PASS whitespace[4].s.trimStart() is ''
 PASS whitespace[4].s.trimLeft() is ''
+PASS whitespace[4].s.trimEnd() is ''
 PASS whitespace[4].s.trimRight() is ''
 PASS whitespace[5].s.trim() is ''
+PASS whitespace[5].s.trimStart() is ''
 PASS whitespace[5].s.trimLeft() is ''
+PASS whitespace[5].s.trimEnd() is ''
 PASS whitespace[5].s.trimRight() is ''
 PASS whitespace[6].s.trim() is ''
+PASS whitespace[6].s.trimStart() is ''
 PASS whitespace[6].s.trimLeft() is ''
+PASS whitespace[6].s.trimEnd() is ''
 PASS whitespace[6].s.trimRight() is ''
 PASS whitespace[7].s.trim() is ''
+PASS whitespace[7].s.trimStart() is ''
 PASS whitespace[7].s.trimLeft() is ''
+PASS whitespace[7].s.trimEnd() is ''
 PASS whitespace[7].s.trimRight() is ''
 PASS whitespace[8].s.trim() is ''
+PASS whitespace[8].s.trimStart() is ''
 PASS whitespace[8].s.trimLeft() is ''
+PASS whitespace[8].s.trimEnd() is ''
 PASS whitespace[8].s.trimRight() is ''
 PASS whitespace[9].s.trim() is ''
+PASS whitespace[9].s.trimStart() is ''
 PASS whitespace[9].s.trimLeft() is ''
+PASS whitespace[9].s.trimEnd() is ''
 PASS whitespace[9].s.trimRight() is ''
 PASS whitespace[10].s.trim() is ''
+PASS whitespace[10].s.trimStart() is ''
 PASS whitespace[10].s.trimLeft() is ''
+PASS whitespace[10].s.trimEnd() is ''
 PASS whitespace[10].s.trimRight() is ''
 PASS whitespace[11].s.trim() is ''
+PASS whitespace[11].s.trimStart() is ''
 PASS whitespace[11].s.trimLeft() is ''
+PASS whitespace[11].s.trimEnd() is ''
 PASS whitespace[11].s.trimRight() is ''
 PASS whitespace[12].s.trim() is ''
+PASS whitespace[12].s.trimStart() is ''
 PASS whitespace[12].s.trimLeft() is ''
+PASS whitespace[12].s.trimEnd() is ''
 PASS whitespace[12].s.trimRight() is ''
 PASS whitespace[13].s.trim() is ''
+PASS whitespace[13].s.trimStart() is ''
 PASS whitespace[13].s.trimLeft() is ''
+PASS whitespace[13].s.trimEnd() is ''
 PASS whitespace[13].s.trimRight() is ''
 PASS whitespace[14].s.trim() is ''
+PASS whitespace[14].s.trimStart() is ''
 PASS whitespace[14].s.trimLeft() is ''
+PASS whitespace[14].s.trimEnd() is ''
 PASS whitespace[14].s.trimRight() is ''
 PASS whitespace[15].s.trim() is ''
+PASS whitespace[15].s.trimStart() is ''
 PASS whitespace[15].s.trimLeft() is ''
+PASS whitespace[15].s.trimEnd() is ''
 PASS whitespace[15].s.trimRight() is ''
 PASS whitespace[16].s.trim() is ''
+PASS whitespace[16].s.trimStart() is ''
 PASS whitespace[16].s.trimLeft() is ''
+PASS whitespace[16].s.trimEnd() is ''
 PASS whitespace[16].s.trimRight() is ''
 PASS whitespace[17].s.trim() is ''
+PASS whitespace[17].s.trimStart() is ''
 PASS whitespace[17].s.trimLeft() is ''
+PASS whitespace[17].s.trimEnd() is ''
 PASS whitespace[17].s.trimRight() is ''
 PASS whitespace[18].s.trim() is ''
+PASS whitespace[18].s.trimStart() is ''
 PASS whitespace[18].s.trimLeft() is ''
+PASS whitespace[18].s.trimEnd() is ''
 PASS whitespace[18].s.trimRight() is ''
 PASS whitespace[19].s.trim() is ''
+PASS whitespace[19].s.trimStart() is ''
 PASS whitespace[19].s.trimLeft() is ''
+PASS whitespace[19].s.trimEnd() is ''
 PASS whitespace[19].s.trimRight() is ''
 PASS whitespace[20].s.trim() is ''
+PASS whitespace[20].s.trimStart() is ''
 PASS whitespace[20].s.trimLeft() is ''
+PASS whitespace[20].s.trimEnd() is ''
 PASS whitespace[20].s.trimRight() is ''
 FAIL whitespace[21].s.trim() should be . Was ​.
+FAIL whitespace[21].s.trimStart() should be . Was ​.
 FAIL whitespace[21].s.trimLeft() should be . Was ​.
+FAIL whitespace[21].s.trimEnd() should be . Was ​.
 FAIL whitespace[21].s.trimRight() should be . Was ​.
 FAIL wsString.trim() should be . Was ​.
+FAIL wsString.trimStart() should be . Was ​.
 FAIL wsString.trimLeft() should be . Was ​.
-FAIL wsString.trimRight() should be . Was   
+FAIL wsString.trimEnd() should be . Was
 
              　

​.
-FAIL trimString.trim() should be foo bar. Was ​foo bar  
+FAIL wsString.trimRight() should be . Was
 
              　

​.
-FAIL trimString.trimLeft() should be foo bar  
+FAIL trimString.trim() should be foo bar. Was ​foo bar
 
-             　

​. Was ​foo bar 
+             　

​.
+FAIL trimString.trimStart() should be foo bar
+
+             　

​. Was ​foo bar
+
+             　

​.
+FAIL trimString.trimLeft() should be foo bar
+
+             　

​. Was ​foo bar
 
              　

​.
-FAIL trimString.trimRight() should be   
+FAIL trimString.trimEnd() should be
 
-             　

​foo bar. Was   
+             　

​foo bar. Was
 
-             　

​foo bar  
+             　

​foo bar
 
              　

​.
-FAIL leftTrimString.trim() should be foo bar. Was foo bar 
+FAIL trimString.trimRight() should be
+
+             　

​foo bar. Was
+
+             　

​foo bar
+
+             　

​.
+FAIL leftTrimString.trim() should be foo bar. Was foo bar
 
              　

​.
+PASS leftTrimString.trimStart() is leftTrimString
 PASS leftTrimString.trimLeft() is leftTrimString
-FAIL leftTrimString.trimRight() should be foo bar. Was foo bar  
+FAIL leftTrimString.trimEnd() should be foo bar. Was foo bar
+
+             　

​.
+FAIL leftTrimString.trimRight() should be foo bar. Was foo bar
 
              　

​.
 FAIL rightTrimString.trim() should be foo bar. Was ​foo bar.
+FAIL rightTrimString.trimStart() should be foo bar. Was ​foo bar.
 FAIL rightTrimString.trimLeft() should be foo bar. Was ​foo bar.
+PASS rightTrimString.trimEnd() is rightTrimString
 PASS rightTrimString.trimRight() is rightTrimString
 PASS trim.call(0) is '0'
+PASS trimStart.call(0) is '0'
 PASS trimLeft.call(0) is '0'
+PASS trimEnd.call(0) is '0'
 PASS trimRight.call(0) is '0'
 PASS trim.call(Infinity) is 'Infinity'
+PASS trimStart.call(Infinity) is 'Infinity'
 PASS trimLeft.call(Infinity) is 'Infinity'
+PASS trimEnd.call(Infinity) is 'Infinity'
 PASS trimRight.call(Infinity) is 'Infinity'
 PASS trim.call(NaN) is 'NaN'
+PASS trimStart.call(NaN) is 'NaN'
 PASS trimLeft.call(NaN) is 'NaN'
+PASS trimEnd.call(NaN) is 'NaN'
 PASS trimRight.call(NaN) is 'NaN'
 PASS trim.call(true) is 'true'
+PASS trimStart.call(true) is 'true'
 PASS trimLeft.call(true) is 'true'
+PASS trimEnd.call(true) is 'true'
 PASS trimRight.call(true) is 'true'
 PASS trim.call(false) is 'false'
+PASS trimStart.call(false) is 'false'
 PASS trimLeft.call(false) is 'false'
+PASS trimEnd.call(false) is 'false'
 PASS trimRight.call(false) is 'false'
 PASS trim.call(({})) is '[object Object]'
+PASS trimStart.call(({})) is '[object Object]'
 PASS trimLeft.call(({})) is '[object Object]'
+PASS trimEnd.call(({})) is '[object Object]'
 PASS trimRight.call(({})) is '[object Object]'
 PASS trim.call(({toString:function(){return 'wibble'}})) is 'wibble'
+PASS trimStart.call(({toString:function(){return 'wibble'}})) is 'wibble'
 PASS trimLeft.call(({toString:function(){return 'wibble'}})) is 'wibble'
+PASS trimEnd.call(({toString:function(){return 'wibble'}})) is 'wibble'
 PASS trimRight.call(({toString:function(){return 'wibble'}})) is 'wibble'
 PASS trim.call(['an','array']) is 'an,array'
+PASS trimStart.call(['an','array']) is 'an,array'
 PASS trimLeft.call(['an','array']) is 'an,array'
+PASS trimEnd.call(['an','array']) is 'an,array'
 PASS trimRight.call(['an','array']) is 'an,array'
 PASS successfullyParsed is true
 
diff --git a/deps/v8/test/webkit/string-trim.js b/deps/v8/test/webkit/string-trim.js
index 27f99d579ae..fd9c1d1557e 100644
--- a/deps/v8/test/webkit/string-trim.js
+++ b/deps/v8/test/webkit/string-trim.js
@@ -21,74 +21,95 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 // SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-description("This test checks String.trim(), String.trimLeft() and String.trimRight() methods.");
+// Flags: --harmony-string-trimming
 
-//references to trim(), trimLeft() and trimRight() functions for testing Function's *.call() and *.apply() methods
-var trim            = String.prototype.trim;
-var trimLeft        = String.prototype.trimLeft;
-var trimRight       = String.prototype.trimRight;
+description("This test checks the `trim`, `trimStart`/`trimLeft`, and `trimEnd`/`trimRight` methods on `String.prototype`.");
 
-var testString      = 'foo bar';
-var trimString      = '';
-var leftTrimString  = '';
-var rightTrimString = '';
-var wsString        = '';
+// References to trim(), trimLeft() and trimRight() functions for testing Function's *.call() and *.apply() methods
+const trim      = String.prototype.trim;
+const trimStart = String.prototype.trimStart;
+const trimLeft  = String.prototype.trimLeft;
+const trimEnd   = String.prototype.trimEnd;
+const trimRight = String.prototype.trimRight;
 
-var whitespace      = [
-    {s : '\u0009', t : 'HORIZONTAL TAB'},
-    {s : '\u000A', t : 'LINE FEED OR NEW LINE'},
-    {s : '\u000B', t : 'VERTICAL TAB'},
-    {s : '\u000C', t : 'FORMFEED'},
-    {s : '\u000D', t : 'CARRIAGE RETURN'},
-    {s : '\u0020', t : 'SPACE'},
-    {s : '\u00A0', t : 'NO-BREAK SPACE'},
-    {s : '\u2000', t : 'EN QUAD'},
-    {s : '\u2001', t : 'EM QUAD'},
-    {s : '\u2002', t : 'EN SPACE'},
-    {s : '\u2003', t : 'EM SPACE'},
-    {s : '\u2004', t : 'THREE-PER-EM SPACE'},
-    {s : '\u2005', t : 'FOUR-PER-EM SPACE'},
-    {s : '\u2006', t : 'SIX-PER-EM SPACE'},
-    {s : '\u2007', t : 'FIGURE SPACE'},
-    {s : '\u2008', t : 'PUNCTUATION SPACE'},
-    {s : '\u2009', t : 'THIN SPACE'},
-    {s : '\u200A', t : 'HAIR SPACE'},
-    {s : '\u3000', t : 'IDEOGRAPHIC SPACE'},
-    {s : '\u2028', t : 'LINE SEPARATOR'},
-    {s : '\u2029', t : 'PARAGRAPH SEPARATOR'},
-    {s : '\u200B', t : 'ZERO WIDTH SPACE (category Cf)'}
+const whitespace = [
+  {s: '\u0009', t: 'HORIZONTAL TAB'},
+  {s: '\u000A', t: 'LINE FEED OR NEW LINE'},
+  {s: '\u000B', t: 'VERTICAL TAB'},
+  {s: '\u000C', t: 'FORMFEED'},
+  {s: '\u000D', t: 'CARRIAGE RETURN'},
+  {s: '\u0020', t: 'SPACE'},
+  {s: '\u00A0', t: 'NO-BREAK SPACE'},
+  {s: '\u2000', t: 'EN QUAD'},
+  {s: '\u2001', t: 'EM QUAD'},
+  {s: '\u2002', t: 'EN SPACE'},
+  {s: '\u2003', t: 'EM SPACE'},
+  {s: '\u2004', t: 'THREE-PER-EM SPACE'},
+  {s: '\u2005', t: 'FOUR-PER-EM SPACE'},
+  {s: '\u2006', t: 'SIX-PER-EM SPACE'},
+  {s: '\u2007', t: 'FIGURE SPACE'},
+  {s: '\u2008', t: 'PUNCTUATION SPACE'},
+  {s: '\u2009', t: 'THIN SPACE'},
+  {s: '\u200A', t: 'HAIR SPACE'},
+  {s: '\u3000', t: 'IDEOGRAPHIC SPACE'},
+  {s: '\u2028', t: 'LINE SEPARATOR'},
+  {s: '\u2029', t: 'PARAGRAPH SEPARATOR'},
+  {s: '\u200B', t: 'ZERO WIDTH SPACE (category Cf)'},
 ];
 
-for (var i = 0; i < whitespace.length; i++) {
-    shouldBe("whitespace["+i+"].s.trim()", "''");
-    shouldBe("whitespace["+i+"].s.trimLeft()", "''");
-    shouldBe("whitespace["+i+"].s.trimRight()", "''");
-    wsString += whitespace[i].s;
+let wsString = '';
+for (let i = 0; i < whitespace.length; i++) {
+  shouldBe("whitespace["+i+"].s.trim()",      "''");
+  shouldBe("whitespace["+i+"].s.trimStart()", "''");
+  shouldBe("whitespace["+i+"].s.trimLeft()",  "''");
+  shouldBe("whitespace["+i+"].s.trimEnd()",   "''");
+  shouldBe("whitespace["+i+"].s.trimRight()", "''");
+  wsString += whitespace[i].s;
 }
 
-trimString      = wsString   + testString + wsString;
-leftTrimString  = testString + wsString;   //trimmed from the left
-rightTrimString = wsString   + testString; //trimmed from the right
+const testString = 'foo bar';
+const trimString      = wsString   + testString + wsString;
+const leftTrimString  = testString + wsString;   //trimmed from the left
+const rightTrimString = wsString   + testString; //trimmed from the right
 
 shouldBe("wsString.trim()",      "''");
+shouldBe("wsString.trimStart()", "''");
 shouldBe("wsString.trimLeft()",  "''");
+shouldBe("wsString.trimEnd()",   "''");
 shouldBe("wsString.trimRight()", "''");
 
 shouldBe("trimString.trim()",      "testString");
+shouldBe("trimString.trimStart()", "leftTrimString");
 shouldBe("trimString.trimLeft()",  "leftTrimString");
+shouldBe("trimString.trimEnd()",   "rightTrimString");
 shouldBe("trimString.trimRight()", "rightTrimString");
 
 shouldBe("leftTrimString.trim()",      "testString");
+shouldBe("leftTrimString.trimStart()", "leftTrimString");
 shouldBe("leftTrimString.trimLeft()",  "leftTrimString");
+shouldBe("leftTrimString.trimEnd()",   "testString");
 shouldBe("leftTrimString.trimRight()", "testString");
 
 shouldBe("rightTrimString.trim()",      "testString");
+shouldBe("rightTrimString.trimStart()", "testString");
 shouldBe("rightTrimString.trimLeft()",  "testString");
+shouldBe("rightTrimString.trimEnd()",   "rightTrimString");
 shouldBe("rightTrimString.trimRight()", "rightTrimString");
 
-var testValues = ["0", "Infinity", "NaN", "true", "false", "({})", "({toString:function(){return 'wibble'}})", "['an','array']"];
-for (var i = 0; i < testValues.length; i++) {
-    shouldBe("trim.call("+testValues[i]+")", "'"+eval(testValues[i])+"'");
-    shouldBe("trimLeft.call("+testValues[i]+")", "'"+eval(testValues[i])+"'");
-    shouldBe("trimRight.call("+testValues[i]+")", "'"+eval(testValues[i])+"'");
+const testValues = [
+  "0",
+  "Infinity",
+  "NaN",
+  "true",
+  "false",
+  "({})",
+  "({toString:function(){return 'wibble'}})",
+  "['an','array']",
+];
+for (const testValue of testValues) {
+  shouldBe("trim.call("+testValue+")", "'"+eval(testValue)+"'");
+  shouldBe("trimStart.call("+testValue+")", "'"+eval(testValue)+"'");
+  shouldBe("trimLeft.call("+testValue+")", "'"+eval(testValue)+"'");
+  shouldBe("trimEnd.call("+testValue+")", "'"+eval(testValue)+"'");
+  shouldBe("trimRight.call("+testValue+")", "'"+eval(testValue)+"'");
 }
diff --git a/deps/v8/test/webkit/testcfg.py b/deps/v8/test/webkit/testcfg.py
index bd0149ffbcc..d76527276aa 100644
--- a/deps/v8/test/webkit/testcfg.py
+++ b/deps/v8/test/webkit/testcfg.py
@@ -38,7 +38,7 @@
 
 # TODO (machenbach): Share commonalities with mjstest.
 class TestSuite(testsuite.TestSuite):
-  def ListTests(self, context):
+  def ListTests(self):
     tests = []
     for dirname, dirs, files in os.walk(self.root):
       for dotted in [x for x in dirs if x.startswith('.')]:
@@ -90,9 +90,9 @@ def _parse_source_files(self, source):
     files.append(os.path.join(self.suite.root, "resources/standalone-post.js"))
     return files
 
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     files = self._source_files
-    if ctx.isolates:
+    if self._test_config.isolates:
       files = files + ['--isolate'] + files
     return files
 
@@ -109,5 +109,5 @@ def output_proc(self):
         os.path.join(self.suite.root, self.path) + '-expected.txt')
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/test/webkit/webkit.gyp b/deps/v8/test/webkit/webkit.gyp
deleted file mode 100644
index cd4c4b981b9..00000000000
--- a/deps/v8/test/webkit/webkit.gyp
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'webkit_run',
-          'type': 'none',
-          'dependencies': [
-            '../../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../../gypfiles/features.gypi',
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'webkit.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/test/webkit/webkit.isolate b/deps/v8/test/webkit/webkit.isolate
deleted file mode 100644
index dbeca5e55cf..00000000000
--- a/deps/v8/test/webkit/webkit.isolate
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'files': [
-      './',
-    ],
-  },
-  'includes': [
-    '../../src/d8.isolate',
-    '../../tools/testrunner/testrunner.isolate',
-  ],
-}
\ No newline at end of file
diff --git a/deps/v8/test/webkit/webkit.status b/deps/v8/test/webkit/webkit.status
index 0b6f5a5ff66..7cd69d53e0a 100644
--- a/deps/v8/test/webkit/webkit.status
+++ b/deps/v8/test/webkit/webkit.status
@@ -68,6 +68,10 @@
   # Too slow for mips big-endian boards on bots (no FPU).
   'dfg-int-overflow-in-loop': [SKIP],
 }], # 'arch == mips'
+['(arch == mips64 or arch == mips64el) and simulator_run', {
+  # Too slow.
+  'dfg-int-overflow-in-loop': [SKIP],
+}], # '(arch == mips64 or arch == mips64el) and simulator_run'
 ['(arch == ppc or arch == ppc64) and simulator_run', {
   # Too slow.
   'dfg-int-overflow-in-loop': [SKIP],
diff --git a/deps/v8/testing/gmock.gyp b/deps/v8/testing/gmock.gyp
deleted file mode 100644
index 89c97e32ec5..00000000000
--- a/deps/v8/testing/gmock.gyp
+++ /dev/null
@@ -1,72 +0,0 @@
-# Copyright 2014 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'targets': [
-    {
-      'target_name': 'gmock',
-      'type': 'static_library',
-      'dependencies': [
-        'gtest.gyp:gtest',
-      ],
-      'sources': [
-        # Sources based on files in r173 of gmock.
-        'gmock/include/gmock/gmock-actions.h',
-        'gmock/include/gmock/gmock-cardinalities.h',
-        'gmock/include/gmock/gmock-generated-actions.h',
-        'gmock/include/gmock/gmock-generated-function-mockers.h',
-        'gmock/include/gmock/gmock-generated-matchers.h',
-        'gmock/include/gmock/gmock-generated-nice-strict.h',
-        'gmock/include/gmock/gmock-matchers.h',
-        'gmock/include/gmock/gmock-spec-builders.h',
-        'gmock/include/gmock/gmock.h',
-        'gmock/include/gmock/internal/gmock-generated-internal-utils.h',
-        'gmock/include/gmock/internal/gmock-internal-utils.h',
-        'gmock/include/gmock/internal/gmock-port.h',
-        'gmock/src/gmock-all.cc',
-        'gmock/src/gmock-cardinalities.cc',
-        'gmock/src/gmock-internal-utils.cc',
-        'gmock/src/gmock-matchers.cc',
-        'gmock/src/gmock-spec-builders.cc',
-        'gmock/src/gmock.cc',
-        'gmock-support.h',  # gMock helpers
-        'gmock_custom/gmock/internal/custom/gmock-port.h',
-      ],
-      'sources!': [
-        'gmock/src/gmock-all.cc',  # Not needed by our build.
-      ],
-      'include_dirs': [
-        'gmock_custom',
-        'gmock',
-        'gmock/include',
-      ],
-      'all_dependent_settings': {
-        'include_dirs': [
-          'gmock_custom',
-          'gmock/include',  # So that gmock headers can find themselves.
-        ],
-      },
-      'export_dependent_settings': [
-        'gtest.gyp:gtest',
-      ],
-      'conditions': [
-        ['want_separate_host_toolset==1', {
-          'toolsets': ['host', 'target'],
-        }, {
-          'toolsets': ['target'],
-        }],
-      ],
-    },
-    {
-      'target_name': 'gmock_main',
-      'type': 'static_library',
-      'dependencies': [
-        'gmock',
-      ],
-      'sources': [
-        'gmock/src/gmock_main.cc',
-      ],
-    },
-  ],
-}
diff --git a/deps/v8/testing/gmock/BUILD.gn b/deps/v8/testing/gmock/BUILD.gn
new file mode 100644
index 00000000000..0e203cb6eee
--- /dev/null
+++ b/deps/v8/testing/gmock/BUILD.gn
@@ -0,0 +1,37 @@
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# The file/directory layout of Google Test is not yet considered stable. Until
+# it stabilizes, Chromium code MUST use this target instead of reaching directly
+# into //third_party/googletest.
+
+import("//build_overrides/build.gni")
+
+source_set("gmock") {
+  testonly = true
+  sources = [
+    "include/gmock/gmock-actions.h",
+    "include/gmock/gmock-generated-function-mockers.h",
+    "include/gmock/gmock-matchers.h",
+    "include/gmock/gmock.h",
+  ]
+  deps = [
+    "//third_party/googletest:gmock",
+  ]
+
+  public_configs = [
+    "//third_party/googletest:gmock_config",
+    "//third_party/googletest:gtest_config",
+  ]
+}
+
+# The file/directory layout of Google Test is not yet considered stable. Until
+# it stabilizes, Chromium code MUST use this target instead of reaching directly
+# into //third_party/googletest.
+source_set("gmock_main") {
+  testonly = true
+  deps = [
+    "//third_party/googletest:gmock_main",
+  ]
+}
diff --git a/deps/v8/testing/gmock/OWNERS b/deps/v8/testing/gmock/OWNERS
new file mode 100644
index 00000000000..d5fa70ced55
--- /dev/null
+++ b/deps/v8/testing/gmock/OWNERS
@@ -0,0 +1,2 @@
+thakis@chromium.org
+pwnall@chromium.org
diff --git a/deps/v8/testing/gmock/include/DEPS b/deps/v8/testing/gmock/include/DEPS
new file mode 100644
index 00000000000..c817a8474e7
--- /dev/null
+++ b/deps/v8/testing/gmock/include/DEPS
@@ -0,0 +1,3 @@
+include_rules = [
+  '+third_party/googletest/src/googlemock/include/gmock',
+]
diff --git a/deps/v8/testing/gmock/include/gmock/gmock-actions.h b/deps/v8/testing/gmock/include/gmock/gmock-actions.h
new file mode 100644
index 00000000000..e4ae2febb56
--- /dev/null
+++ b/deps/v8/testing/gmock/include/gmock/gmock-actions.h
@@ -0,0 +1,10 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// The file/directory layout of Google Test is not yet considered stable. Until
+// it stabilizes, Chromium code will use forwarding headers in testing/gtest
+// and testing/gmock, instead of directly including files in
+// third_party/googletest.
+
+#include "third_party/googletest/src/googlemock/include/gmock/gmock-actions.h"
diff --git a/deps/v8/testing/gmock/include/gmock/gmock-generated-function-mockers.h b/deps/v8/testing/gmock/include/gmock/gmock-generated-function-mockers.h
new file mode 100644
index 00000000000..b9986c7b11b
--- /dev/null
+++ b/deps/v8/testing/gmock/include/gmock/gmock-generated-function-mockers.h
@@ -0,0 +1,10 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// The file/directory layout of Google Test is not yet considered stable. Until
+// it stabilizes, Chromium code will use forwarding headers in testing/gtest
+// and testing/gmock, instead of directly including files in
+// third_party/googletest.
+
+#include "third_party/googletest/src/googlemock/include/gmock/gmock-generated-function-mockers.h"
diff --git a/deps/v8/testing/gmock/include/gmock/gmock-matchers.h b/deps/v8/testing/gmock/include/gmock/gmock-matchers.h
new file mode 100644
index 00000000000..8cfc699871b
--- /dev/null
+++ b/deps/v8/testing/gmock/include/gmock/gmock-matchers.h
@@ -0,0 +1,10 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// The file/directory layout of Google Test is not yet considered stable. Until
+// it stabilizes, Chromium code will use forwarding headers in testing/gtest
+// and testing/gmock, instead of directly including files in
+// third_party/googletest.
+
+#include "third_party/googletest/src/googlemock/include/gmock/gmock-matchers.h"
diff --git a/deps/v8/testing/gmock/include/gmock/gmock.h b/deps/v8/testing/gmock/include/gmock/gmock.h
new file mode 100644
index 00000000000..c39a9f6aeaa
--- /dev/null
+++ b/deps/v8/testing/gmock/include/gmock/gmock.h
@@ -0,0 +1,10 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// The file/directory layout of Google Test is not yet considered stable. Until
+// it stabilizes, Chromium code will use forwarding headers in testing/gtest
+// and testing/gmock, instead of directly including files in
+// third_party/googletest.
+
+#include "third_party/googletest/src/googlemock/include/gmock/gmock.h"
diff --git a/deps/v8/testing/gtest/BUILD.gn b/deps/v8/testing/gtest/BUILD.gn
new file mode 100644
index 00000000000..fe7ba6d4839
--- /dev/null
+++ b/deps/v8/testing/gtest/BUILD.gn
@@ -0,0 +1,100 @@
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//build_overrides/gtest.gni")
+if (is_ios) {
+  import("//build/config/coverage/coverage.gni")
+  import("//build/config/ios/ios_sdk.gni")
+  import("//build/buildflag_header.gni")
+}
+
+config("gtest_direct_config") {
+  visibility = [ ":*" ]
+  defines = [ "UNIT_TEST" ]
+}
+
+# The file/directory layout of Google Test is not yet considered stable. Until
+# it stabilizes, Chromium code MUST use this target instead of reaching directly
+# into //third_party/googletest.
+static_library("gtest") {
+  testonly = true
+
+  sources = [
+    "include/gtest/gtest-death-test.h",
+    "include/gtest/gtest-message.h",
+    "include/gtest/gtest-param-test.h",
+    "include/gtest/gtest-spi.h",
+    "include/gtest/gtest.h",
+    "include/gtest/gtest_prod.h",
+
+    # This is a workaround for the issues below.
+    #
+    # 1) This target needs to be a static_library (not a source set) on Mac to
+    #    avoid the build errors in
+    #    https://codereview.chromium.org/2779193002#msg82.
+    # 2) A static_library must have at least one source file, to avoid build
+    #    errors on Mac and Windows. https://crbug.com/710334
+    # 3) A static_library with complete_static_lib = true, which would not
+    #    require adding the empty file, will result in duplicate symbols on
+    #    Android. https://codereview.chromium.org/2852613002/#ps20001
+    "empty.cc",
+  ]
+  public_deps = [
+    "//third_party/googletest:gtest",
+  ]
+
+  public_configs = [ ":gtest_direct_config" ]
+
+  if (gtest_include_multiprocess) {
+    sources += [
+      "../multiprocess_func_list.cc",
+      "../multiprocess_func_list.h",
+    ]
+  }
+
+  if (gtest_include_platform_test) {
+    sources += [ "../platform_test.h" ]
+  }
+
+  if ((is_mac || is_ios) && gtest_include_objc_support) {
+    if (is_ios) {
+      set_sources_assignment_filter([])
+    }
+    sources += [
+      "../gtest_mac.h",
+      "../gtest_mac.mm",
+    ]
+    if (gtest_include_platform_test) {
+      sources += [ "../platform_test_mac.mm" ]
+    }
+    set_sources_assignment_filter(sources_assignment_filter)
+  }
+
+  if (is_ios && gtest_include_ios_coverage) {
+    sources += [
+      "../coverage_util_ios.h",
+      "../coverage_util_ios.mm",
+    ]
+    deps = [
+      ":ios_enable_coverage",
+    ]
+  }
+}
+
+# The file/directory layout of Google Test is not yet considered stable. Until
+# it stabilizes, Chromium code MUST use this target instead of reaching directly
+# into //third_party/googletest.
+source_set("gtest_main") {
+  testonly = true
+  deps = [
+    "//third_party/googletest:gtest_main",
+  ]
+}
+
+if (is_ios) {
+  buildflag_header("ios_enable_coverage") {
+    header = "ios_enable_coverage.h"
+    flags = [ "IOS_ENABLE_COVERAGE=$use_clang_coverage" ]
+  }
+}
diff --git a/deps/v8/testing/gtest/OWNERS b/deps/v8/testing/gtest/OWNERS
new file mode 100644
index 00000000000..d5fa70ced55
--- /dev/null
+++ b/deps/v8/testing/gtest/OWNERS
@@ -0,0 +1,2 @@
+thakis@chromium.org
+pwnall@chromium.org
diff --git a/deps/v8/testing/gtest/empty.cc b/deps/v8/testing/gtest/empty.cc
new file mode 100644
index 00000000000..7487e66ecb6
--- /dev/null
+++ b/deps/v8/testing/gtest/empty.cc
@@ -0,0 +1,3 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
diff --git a/deps/v8/testing/gtest/include/DEPS b/deps/v8/testing/gtest/include/DEPS
new file mode 100644
index 00000000000..e67416c517d
--- /dev/null
+++ b/deps/v8/testing/gtest/include/DEPS
@@ -0,0 +1,3 @@
+include_rules = [
+  '+third_party/googletest/src/googletest/include/gtest',
+]
diff --git a/deps/v8/testing/gtest/include/gtest/gtest-death-test.h b/deps/v8/testing/gtest/include/gtest/gtest-death-test.h
new file mode 100644
index 00000000000..d2fead05b22
--- /dev/null
+++ b/deps/v8/testing/gtest/include/gtest/gtest-death-test.h
@@ -0,0 +1,10 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// The file/directory layout of Google Test is not yet considered stable. Until
+// it stabilizes, Chromium code will use forwarding headers in testing/gtest
+// and testing/gmock, instead of directly including files in
+// third_party/googletest.
+
+#include "third_party/googletest/src/googletest/include/gtest/gtest-death-test.h"
diff --git a/deps/v8/testing/gtest/include/gtest/gtest-message.h b/deps/v8/testing/gtest/include/gtest/gtest-message.h
new file mode 100644
index 00000000000..4ec1e0ebece
--- /dev/null
+++ b/deps/v8/testing/gtest/include/gtest/gtest-message.h
@@ -0,0 +1,10 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// The file/directory layout of Google Test is not yet considered stable. Until
+// it stabilizes, Chromium code will use forwarding headers in testing/gtest
+// and testing/gmock, instead of directly including files in
+// third_party/googletest.
+
+#include "third_party/googletest/src/googletest/include/gtest/gtest-message.h"
diff --git a/deps/v8/testing/gtest/include/gtest/gtest-param-test.h b/deps/v8/testing/gtest/include/gtest/gtest-param-test.h
new file mode 100644
index 00000000000..e85c2f3593e
--- /dev/null
+++ b/deps/v8/testing/gtest/include/gtest/gtest-param-test.h
@@ -0,0 +1,10 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// The file/directory layout of Google Test is not yet considered stable. Until
+// it stabilizes, Chromium code will use forwarding headers in testing/gtest
+// and testing/gmock, instead of directly including files in
+// third_party/googletest.
+
+#include "third_party/googletest/src/googletest/include/gtest/gtest-param-test.h"
diff --git a/deps/v8/testing/gtest/include/gtest/gtest-spi.h b/deps/v8/testing/gtest/include/gtest/gtest-spi.h
new file mode 100644
index 00000000000..87af65ccdd8
--- /dev/null
+++ b/deps/v8/testing/gtest/include/gtest/gtest-spi.h
@@ -0,0 +1,10 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// The file/directory layout of Google Test is not yet considered stable. Until
+// it stabilizes, Chromium code will use forwarding headers in testing/gtest
+// and testing/gmock, instead of directly including files in
+// third_party/googletest.
+
+#include "third_party/googletest/src/googletest/include/gtest/gtest-spi.h"
diff --git a/deps/v8/testing/gtest/include/gtest/gtest.h b/deps/v8/testing/gtest/include/gtest/gtest.h
new file mode 100644
index 00000000000..b026e3a6dfd
--- /dev/null
+++ b/deps/v8/testing/gtest/include/gtest/gtest.h
@@ -0,0 +1,10 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// The file/directory layout of Google Test is not yet considered stable. Until
+// it stabilizes, Chromium code will use forwarding headers in testing/gtest
+// and testing/gmock, instead of directly including files in
+// third_party/googletest.
+
+#include "third_party/googletest/src/googletest/include/gtest/gtest.h"
diff --git a/deps/v8/testing/gtest/include/gtest/gtest_prod.h b/deps/v8/testing/gtest/include/gtest/gtest_prod.h
index da80ddc6c70..b6f81aa76ba 100644
--- a/deps/v8/testing/gtest/include/gtest/gtest_prod.h
+++ b/deps/v8/testing/gtest/include/gtest/gtest_prod.h
@@ -1,58 +1,10 @@
-// Copyright 2006, Google Inc.
-// All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//     * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived from
-// this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-//
-// Author: wan@google.com (Zhanyong Wan)
-//
-// Google C++ Testing Framework definitions useful in production code.
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
-#ifndef GTEST_INCLUDE_GTEST_GTEST_PROD_H_
-#define GTEST_INCLUDE_GTEST_GTEST_PROD_H_
+// The file/directory layout of Google Test is not yet considered stable. Until
+// it stabilizes, Chromium code will use forwarding headers in testing/gtest
+// and testing/gmock, instead of directly including files in
+// third_party/googletest.
 
-// When you need to test the private or protected members of a class,
-// use the FRIEND_TEST macro to declare your tests as friends of the
-// class.  For example:
-//
-// class MyClass {
-//  private:
-//   void MyMethod();
-//   FRIEND_TEST(MyClassTest, MyMethod);
-// };
-//
-// class MyClassTest : public testing::Test {
-//   // ...
-// };
-//
-// TEST_F(MyClassTest, MyMethod) {
-//   // Can call MyClass::MyMethod() here.
-// }
-
-#define FRIEND_TEST(test_case_name, test_name)\
-friend class test_case_name##_##test_name##_Test
-
-#endif  // GTEST_INCLUDE_GTEST_GTEST_PROD_H_
+#include "third_party/googletest/src/googletest/include/gtest/gtest_prod.h"
diff --git a/deps/v8/gypfiles/detect_v8_host_arch.py b/deps/v8/third_party/binutils/detect_v8_host_arch.py
similarity index 98%
rename from deps/v8/gypfiles/detect_v8_host_arch.py
rename to deps/v8/third_party/binutils/detect_v8_host_arch.py
index 89e8286e1fd..3a5a5762d96 100644
--- a/deps/v8/gypfiles/detect_v8_host_arch.py
+++ b/deps/v8/third_party/binutils/detect_v8_host_arch.py
@@ -38,6 +38,9 @@ def main():
   return 0
 
 def DoMain(_):
+  return DetectHostArch();
+
+def DetectHostArch():
   """Hook to be called from gyp without starting a separate python
   interpreter."""
   host_arch = platform.machine()
diff --git a/deps/v8/third_party/binutils/download.py b/deps/v8/third_party/binutils/download.py
index a8ad814dbe3..99f43708f5e 100755
--- a/deps/v8/third_party/binutils/download.py
+++ b/deps/v8/third_party/binutils/download.py
@@ -15,6 +15,7 @@
 import shutil
 import subprocess
 import sys
+from detect_v8_host_arch import DetectHostArch
 
 
 BINUTILS_DIR = os.path.abspath(os.path.dirname(__file__))
@@ -22,9 +23,6 @@
 BINUTILS_TOOLS = ['bin/ld.gold', 'bin/objcopy', 'bin/objdump']
 BINUTILS_OUT = 'Release'
 
-DETECT_HOST_ARCH = os.path.abspath(os.path.join(
-    BINUTILS_DIR, '../../gypfiles/detect_v8_host_arch.py'))
-
 
 def ReadFile(filename):
   with file(filename, 'r') as f:
@@ -48,7 +46,7 @@ def GetArch():
       return 'x64'
     return arch
 
-  return subprocess.check_output(['python', DETECT_HOST_ARCH]).strip()
+  return DetectHostArch()
 
 
 def FetchAndExtract(arch):
diff --git a/deps/v8/third_party/googletest/BUILD.gn b/deps/v8/third_party/googletest/BUILD.gn
new file mode 100644
index 00000000000..4529c0523e6
--- /dev/null
+++ b/deps/v8/third_party/googletest/BUILD.gn
@@ -0,0 +1,144 @@
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+config("gtest_config") {
+  visibility = [ ":*" ]  # gmock also shares this config.
+
+  defines = [
+    # Chromium always links googletest statically, so no API qualifier is
+    # necessary. The definition in gtest-port.h at the time of this writing
+    # causes crashes in content_browsertests.
+    "GTEST_API_=",
+
+    # In order to allow regex matches in gtest to be shared between Windows
+    # and other systems, we tell gtest to always use its internal engine.
+    "GTEST_HAS_POSIX_RE=0",
+    "GTEST_LANG_CXX11=1",
+
+    # ::testing::Combine, which is heavily used in Chromium, is gated on
+    # tr1::tuple. Upstream avoids using tr1::tuple on Visual Studio 2017+,
+    # because it causes warnings. We'll take (and ignore) the warnings to keep
+    # our ::testing::Combine.
+    "GTEST_HAS_TR1_TUPLE=1",
+  ]
+
+  # Gtest headers need to be able to find themselves.
+  include_dirs = [ "src/googletest/include" ]
+
+  if (is_win) {
+    cflags = [ "/wd4800" ]  # Unused variable warning.
+  }
+}
+
+config("gmock_config") {
+  # Gmock headers need to be able to find themselves.
+  include_dirs = [
+    "custom",
+    "src/googlemock/include",
+  ]
+}
+
+# Do NOT depend on this directly. Use //testing/gtest instead.
+# See README.chromium for details.
+source_set("gtest") {
+  testonly = true
+  sources = [
+    "src/googletest/include/gtest/gtest-death-test.h",
+    "src/googletest/include/gtest/gtest-message.h",
+    "src/googletest/include/gtest/gtest-param-test.h",
+    "src/googletest/include/gtest/gtest-printers.h",
+    "src/googletest/include/gtest/gtest-spi.h",
+    "src/googletest/include/gtest/gtest-test-part.h",
+    "src/googletest/include/gtest/gtest-typed-test.h",
+    "src/googletest/include/gtest/gtest.h",
+    "src/googletest/include/gtest/gtest_pred_impl.h",
+    "src/googletest/include/gtest/internal/gtest-death-test-internal.h",
+    "src/googletest/include/gtest/internal/gtest-filepath.h",
+    "src/googletest/include/gtest/internal/gtest-internal.h",
+    "src/googletest/include/gtest/internal/gtest-linked_ptr.h",
+    "src/googletest/include/gtest/internal/gtest-param-util-generated.h",
+    "src/googletest/include/gtest/internal/gtest-param-util.h",
+    "src/googletest/include/gtest/internal/gtest-port.h",
+    "src/googletest/include/gtest/internal/gtest-string.h",
+    "src/googletest/include/gtest/internal/gtest-tuple.h",
+    "src/googletest/include/gtest/internal/gtest-type-util.h",
+
+    #"src/googletest/src/gtest-all.cc",  # Not needed by our build.
+    "src/googletest/src/gtest-death-test.cc",
+    "src/googletest/src/gtest-filepath.cc",
+    "src/googletest/src/gtest-internal-inl.h",
+    "src/googletest/src/gtest-port.cc",
+    "src/googletest/src/gtest-printers.cc",
+    "src/googletest/src/gtest-test-part.cc",
+    "src/googletest/src/gtest-typed-test.cc",
+    "src/googletest/src/gtest.cc",
+  ]
+
+  # Some files include "src/gtest-internal-inl.h".
+  include_dirs = [ "src/googletest" ]
+
+  all_dependent_configs = [ ":gtest_config" ]
+
+  configs -= [ "//build/config/compiler:chromium_code" ]
+  configs += [ "//build/config/compiler:no_chromium_code" ]
+}
+
+# Do NOT depend on this directly. Use //testing/gtest:gtest_main instead.
+# See README.chromium for details.
+source_set("gtest_main") {
+  testonly = true
+  sources = [
+    "src/googletest/src/gtest_main.cc",
+  ]
+  deps = [
+    ":gtest",
+  ]
+}
+
+# Do NOT depend on this directly. Use //testing/gmock:gmock_main instead.
+# See README.chromium for details.
+source_set("gmock") {
+  testonly = true
+  sources = [
+    "src/googlemock/include/gmock/gmock-actions.h",
+    "src/googlemock/include/gmock/gmock-cardinalities.h",
+    "src/googlemock/include/gmock/gmock-generated-actions.h",
+    "src/googlemock/include/gmock/gmock-generated-function-mockers.h",
+    "src/googlemock/include/gmock/gmock-generated-matchers.h",
+    "src/googlemock/include/gmock/gmock-generated-nice-strict.h",
+    "src/googlemock/include/gmock/gmock-matchers.h",
+    "src/googlemock/include/gmock/gmock-spec-builders.h",
+    "src/googlemock/include/gmock/gmock.h",
+    "src/googlemock/include/gmock/internal/gmock-generated-internal-utils.h",
+    "src/googlemock/include/gmock/internal/gmock-internal-utils.h",
+    "src/googlemock/include/gmock/internal/gmock-port.h",
+
+    # gmock helpers.
+    "custom/gmock/internal/custom/gmock-port.h",
+
+    #"src/googlemock/src/gmock-all.cc",  # Not needed by our build.
+    "src/googlemock/src/gmock-cardinalities.cc",
+    "src/googlemock/src/gmock-internal-utils.cc",
+    "src/googlemock/src/gmock-matchers.cc",
+    "src/googlemock/src/gmock-spec-builders.cc",
+    "src/googlemock/src/gmock.cc",
+  ]
+
+  public_configs = [
+    ":gmock_config",
+    ":gtest_config",
+  ]
+}
+
+# Do NOT depend on this directly. Use //testing/gmock:gmock_main instead.
+# See README.chromium for details.
+static_library("gmock_main") {
+  testonly = true
+  sources = [
+    "src/googlemock/src/gmock_main.cc",
+  ]
+  deps = [
+    ":gmock",
+  ]
+}
diff --git a/deps/v8/third_party/googletest/OWNERS b/deps/v8/third_party/googletest/OWNERS
new file mode 100644
index 00000000000..d5fa70ced55
--- /dev/null
+++ b/deps/v8/third_party/googletest/OWNERS
@@ -0,0 +1,2 @@
+thakis@chromium.org
+pwnall@chromium.org
diff --git a/deps/v8/third_party/googletest/README.chromium b/deps/v8/third_party/googletest/README.chromium
new file mode 100644
index 00000000000..170ae3ef278
--- /dev/null
+++ b/deps/v8/third_party/googletest/README.chromium
@@ -0,0 +1,17 @@
+Name: Google Test: Google's C++ Testing Framework
+Short Name: googletest
+URL: https://github.com/google/googletest.git
+Version: 1.8.0.git-7d15497f7538fb531d0f025929d080743af421ee
+License: BSD
+Security critical: no
+
+Google Test is imported as-is, to facilitate version bumping. However, the
+file/directory layout of Google Test is not yet considered stable. Therefore,
+until Google Test's layout stabilizes, Chromium code MUST NOT depend on it
+directly. Instead, Chromium code MUST:
+
+* #include the headers in testing/gtest and testing/gmock
+* use //testing/gtest(:gtest_main) and //testing/gmock(:gmock_main) in BUILD.gn
+  deps
+
+This will allow us to adapt to Google Test changes with minimal disruption.
diff --git a/deps/v8/testing/gmock_custom/gmock/internal/custom/gmock-port.h b/deps/v8/third_party/googletest/gmock_custom/gmock/internal/custom/gmock-port.h
similarity index 72%
rename from deps/v8/testing/gmock_custom/gmock/internal/custom/gmock-port.h
rename to deps/v8/third_party/googletest/gmock_custom/gmock/internal/custom/gmock-port.h
index 1e8d86dbc0b..b541499a85d 100644
--- a/deps/v8/testing/gmock_custom/gmock/internal/custom/gmock-port.h
+++ b/deps/v8/third_party/googletest/gmock_custom/gmock/internal/custom/gmock-port.h
@@ -1,9 +1,7 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
+// Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Copied from http://crrev.com/6ad76b419eacefc4/testing/gmock_custom/gmock/internal/custom/gmock-port.h
-
 #ifndef TESTING_GMOCK_CUSTOM_GMOCK_INTERNAL_CUSTOM_GMOCK_PORT_H_
 #define TESTING_GMOCK_CUSTOM_GMOCK_INTERNAL_CUSTOM_GMOCK_PORT_H_
 
@@ -16,14 +14,12 @@ namespace std {
 // <20120322 below implies pre-4.7.0. In addition we blacklist several version
 // that released after 4.7.0 from pre-4.7.0 branch. 20120702 implies 4.5.4, and
 // 20121127 implies 4.6.4.
-#if defined(__GLIBCXX__) &&   \
-  (__GLIBCXX__ < 20120322 ||  \
-   __GLIBCXX__ == 20120702 || \
-   __GLIBCXX__ == 20121127)
+#if defined(__GLIBCXX__) &&                               \
+    (__GLIBCXX__ < 20120322 || __GLIBCXX__ == 20120702 || \
+     __GLIBCXX__ == 20121127)
 template <typename T>
 using is_default_constructible = std::is_constructible<T>;
 #endif
-
 }
 
 #endif  // TESTING_GMOCK_CUSTOM_GMOCK_INTERNAL_CUSTOM_GMOCK_PORT_H_
diff --git a/deps/v8/third_party/googletest/src/googletest/include/gtest/gtest_prod.h b/deps/v8/third_party/googletest/src/googletest/include/gtest/gtest_prod.h
new file mode 100644
index 00000000000..d9ea685f6d3
--- /dev/null
+++ b/deps/v8/third_party/googletest/src/googletest/include/gtest/gtest_prod.h
@@ -0,0 +1,61 @@
+// Copyright 2006, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+// Author: wan@google.com (Zhanyong Wan)
+//
+// Google C++ Testing Framework definitions useful in production code.
+
+#ifndef GTEST_INCLUDE_GTEST_GTEST_PROD_H_
+#define GTEST_INCLUDE_GTEST_GTEST_PROD_H_
+
+// When you need to test the private or protected members of a class,
+// use the FRIEND_TEST macro to declare your tests as friends of the
+// class.  For example:
+//
+// class MyClass {
+//  private:
+//   void PrivateMethod();
+//   FRIEND_TEST(MyClassTest, PrivateMethodWorks);
+// };
+//
+// class MyClassTest : public testing::Test {
+//   // ...
+// };
+//
+// TEST_F(MyClassTest, PrivateMethodWorks) {
+//   // Can call MyClass::PrivateMethod() here.
+// }
+//
+// Note: The test class must be in the same namespace as the class being tested.
+// For example, putting MyClassTest in an anonymous namespace will not work.
+
+#define FRIEND_TEST(test_case_name, test_name)\
+friend class test_case_name##_##test_name##_Test
+
+#endif  // GTEST_INCLUDE_GTEST_GTEST_PROD_H_
diff --git a/deps/v8/third_party/jinja2/AUTHORS b/deps/v8/third_party/jinja2/AUTHORS
index 943f625f876..fd6dbfcbfd8 100644
--- a/deps/v8/third_party/jinja2/AUTHORS
+++ b/deps/v8/third_party/jinja2/AUTHORS
@@ -17,6 +17,7 @@ Contributors:
 - Cameron Knight
 - Lawrence Journal-World.
 - David Cramer
+- Adrian Mönnich (ThiefMaster)
 
 Patches and suggestions:
 
diff --git a/deps/v8/third_party/jinja2/Jinja2-2.10.tar.gz.md5 b/deps/v8/third_party/jinja2/Jinja2-2.10.tar.gz.md5
new file mode 100644
index 00000000000..9137ee129a0
--- /dev/null
+++ b/deps/v8/third_party/jinja2/Jinja2-2.10.tar.gz.md5
@@ -0,0 +1 @@
+61ef1117f945486472850819b8d1eb3d  Jinja2-2.10.tar.gz
diff --git a/deps/v8/third_party/jinja2/Jinja2-2.10.tar.gz.sha512 b/deps/v8/third_party/jinja2/Jinja2-2.10.tar.gz.sha512
new file mode 100644
index 00000000000..087d24c18eb
--- /dev/null
+++ b/deps/v8/third_party/jinja2/Jinja2-2.10.tar.gz.sha512
@@ -0,0 +1 @@
+0ea7371be67ffcf19e46dfd06523a45a0806e678a407d54f5f2f3e573982f0959cf82ec5d07b203670309928a62ef71109701ab16547a9bba2ebcdc178cb67f2  Jinja2-2.10.tar.gz
diff --git a/deps/v8/third_party/jinja2/Jinja2-2.8.tar.gz.md5 b/deps/v8/third_party/jinja2/Jinja2-2.8.tar.gz.md5
deleted file mode 100644
index a0eb1b24642..00000000000
--- a/deps/v8/third_party/jinja2/Jinja2-2.8.tar.gz.md5
+++ /dev/null
@@ -1 +0,0 @@
-edb51693fe22c53cee5403775c71a99e  Jinja2-2.8.tar.gz
diff --git a/deps/v8/third_party/jinja2/Jinja2-2.8.tar.gz.sha512 b/deps/v8/third_party/jinja2/Jinja2-2.8.tar.gz.sha512
deleted file mode 100644
index 88e4ea61543..00000000000
--- a/deps/v8/third_party/jinja2/Jinja2-2.8.tar.gz.sha512
+++ /dev/null
@@ -1 +0,0 @@
-2e80d6d9ad10dafcce1e6dd24493f5dffc43a17f71a30a650415638e12d3a3891738ebacc569701129214026d062d91a2b10e4f7a2c7b85d801dde26ded1bebb  Jinja2-2.8.tar.gz
diff --git a/deps/v8/third_party/jinja2/LICENSE b/deps/v8/third_party/jinja2/LICENSE
index 31bf900e58e..10145a26434 100644
--- a/deps/v8/third_party/jinja2/LICENSE
+++ b/deps/v8/third_party/jinja2/LICENSE
@@ -1,31 +1,31 @@
-Copyright (c) 2009 by the Jinja Team, see AUTHORS for more details.
-
-Some rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-    * Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-
-    * Redistributions in binary form must reproduce the above
-      copyright notice, this list of conditions and the following
-      disclaimer in the documentation and/or other materials provided
-      with the distribution.
-
-    * The names of the contributors may not be used to endorse or
-      promote products derived from this software without specific
-      prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+Copyright (c) 2009 by the Jinja Team, see AUTHORS for more details.
+
+Some rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+
+    * Redistributions in binary form must reproduce the above
+      copyright notice, this list of conditions and the following
+      disclaimer in the documentation and/or other materials provided
+      with the distribution.
+
+    * The names of the contributors may not be used to endorse or
+      promote products derived from this software without specific
+      prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/deps/v8/third_party/jinja2/README.chromium b/deps/v8/third_party/jinja2/README.chromium
index 684ff8ec0a2..5246c2f84b6 100644
--- a/deps/v8/third_party/jinja2/README.chromium
+++ b/deps/v8/third_party/jinja2/README.chromium
@@ -1,17 +1,17 @@
 Name: Jinja2 Python Template Engine
 Short Name: jinja2
 URL: http://jinja.pocoo.org/
-Version: 2.8
-License: BSD 3-clause License
-License File: NOT_SHIPPED
+Version: 2.10
+License: BSD 3-Clause
+License File: LICENSE
 Security Critical: no
 
 Description:
 Template engine for code generation in Blink.
 
-Source: https://pypi.python.org/packages/f2/2f/0b98b06a345a761bec91a079ccae392d282690c2d8272e708f4d10829e22/Jinja2-2.8.tar.gz
-MD5: edb51693fe22c53cee5403775c71a99e
-SHA-1: 4a33c1a0fd585eba2507e8c274a9cd113b1d13ab
+Source: https://pypi.python.org/packages/56/e6/332789f295cf22308386cf5bbd1f4e00ed11484299c5d7383378cf48ba47/Jinja2-2.10.tar.gz
+MD5: 61ef1117f945486472850819b8d1eb3d
+SHA-1: 34b69e5caab12ee37b9df69df9018776c008b7b8
 
 Local Modifications:
 This only includes the jinja2 directory from the tarball and the LICENSE and
@@ -19,7 +19,8 @@ AUTHORS files. Unit tests (testsuite directory) have been removed.
 Additional chromium-specific files are:
 * README.chromium (this file)
 * OWNERS
-* install script (get_jinja2.sh)
+* get_jinja2.sh (install script)
+* jinja2.gni (generated by get_jinja2.sh)
 * files of hashes (MD5 is also posted on website, SHA-512 computed locally).
 Script checks hash then unpacks archive and installs desired files.
 Retrieve or update by executing jinja2/get_jinja2.sh from third_party.
diff --git a/deps/v8/third_party/jinja2/__init__.py b/deps/v8/third_party/jinja2/__init__.py
index 029fb2e6e8b..42aa763d571 100644
--- a/deps/v8/third_party/jinja2/__init__.py
+++ b/deps/v8/third_party/jinja2/__init__.py
@@ -23,11 +23,11 @@
         {% endblock %}
 
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD, see LICENSE for more details.
 """
 __docformat__ = 'restructuredtext en'
-__version__ = '2.8'
+__version__ = '2.10'
 
 # high level interface
 from jinja2.environment import Environment, Template
@@ -48,14 +48,14 @@
 # exceptions
 from jinja2.exceptions import TemplateError, UndefinedError, \
      TemplateNotFound, TemplatesNotFound, TemplateSyntaxError, \
-     TemplateAssertionError
+     TemplateAssertionError, TemplateRuntimeError
 
 # decorators and public utilities
 from jinja2.filters import environmentfilter, contextfilter, \
      evalcontextfilter
 from jinja2.utils import Markup, escape, clear_caches, \
      environmentfunction, evalcontextfunction, contextfunction, \
-     is_undefined
+     is_undefined, select_autoescape
 
 __all__ = [
     'Environment', 'Template', 'BaseLoader', 'FileSystemLoader',
@@ -64,7 +64,20 @@
     'MemcachedBytecodeCache', 'Undefined', 'DebugUndefined',
     'StrictUndefined', 'TemplateError', 'UndefinedError', 'TemplateNotFound',
     'TemplatesNotFound', 'TemplateSyntaxError', 'TemplateAssertionError',
+    'TemplateRuntimeError',
     'ModuleLoader', 'environmentfilter', 'contextfilter', 'Markup', 'escape',
     'environmentfunction', 'contextfunction', 'clear_caches', 'is_undefined',
     'evalcontextfilter', 'evalcontextfunction', 'make_logging_undefined',
+    'select_autoescape',
 ]
+
+
+def _patch_async():
+    from jinja2.utils import have_async_gen
+    if have_async_gen:
+        from jinja2.asyncsupport import patch_all
+        patch_all()
+
+
+_patch_async()
+del _patch_async
diff --git a/deps/v8/third_party/jinja2/_compat.py b/deps/v8/third_party/jinja2/_compat.py
index 143962f384f..61d85301a4a 100644
--- a/deps/v8/third_party/jinja2/_compat.py
+++ b/deps/v8/third_party/jinja2/_compat.py
@@ -45,7 +45,6 @@ def reraise(tp, value, tb=None):
     implements_iterator = _identity
     implements_to_string = _identity
     encode_filename = _identity
-    get_next = lambda x: x.__next__
 
 else:
     unichr = unichr
@@ -77,8 +76,6 @@ def implements_to_string(cls):
         cls.__str__ = lambda x: x.__unicode__().encode('utf-8')
         return cls
 
-    get_next = lambda x: x.next
-
     def encode_filename(filename):
         if isinstance(filename, unicode):
             return filename.encode('utf-8')
@@ -86,23 +83,14 @@ def encode_filename(filename):
 
 
 def with_metaclass(meta, *bases):
+    """Create a base class with a metaclass."""
     # This requires a bit of explanation: the basic idea is to make a
-    # dummy metaclass for one level of class instanciation that replaces
-    # itself with the actual metaclass.  Because of internal type checks
-    # we also need to make sure that we downgrade the custom metaclass
-    # for one level to something closer to type (that's why __call__ and
-    # __init__ comes back from type etc.).
-    #
-    # This has the advantage over six.with_metaclass in that it does not
-    # introduce dummy classes into the final MRO.
-    class metaclass(meta):
-        __call__ = type.__call__
-        __init__ = type.__init__
+    # dummy metaclass for one level of class instantiation that replaces
+    # itself with the actual metaclass.
+    class metaclass(type):
         def __new__(cls, name, this_bases, d):
-            if this_bases is None:
-                return type.__new__(cls, name, (), d)
             return meta(name, bases, d)
-    return metaclass('temporary_class', None, {})
+    return type.__new__(metaclass, 'temporary_class', (), {})
 
 
 try:
diff --git a/deps/v8/third_party/jinja2/_identifier.py b/deps/v8/third_party/jinja2/_identifier.py
new file mode 100644
index 00000000000..2eac35d5c35
--- /dev/null
+++ b/deps/v8/third_party/jinja2/_identifier.py
@@ -0,0 +1,2 @@
+# generated by scripts/generate_identifier_pattern.py
+pattern = '·̀-ͯ·҃-֑҇-ׇֽֿׁׂׅׄؐ-ًؚ-ٰٟۖ-ۜ۟-۪ۤۧۨ-ܑۭܰ-݊ަ-ް߫-߳ࠖ-࠙ࠛ-ࠣࠥ-ࠧࠩ-࡙࠭-࡛ࣔ-ࣣ࣡-ःऺ-़ा-ॏ॑-ॗॢॣঁ-ঃ়া-ৄেৈো-্ৗৢৣਁ-ਃ਼ਾ-ੂੇੈੋ-੍ੑੰੱੵઁ-ઃ઼ા-ૅે-ૉો-્ૢૣଁ-ଃ଼ା-ୄେୈୋ-୍ୖୗୢୣஂா-ூெ-ைொ-்ௗఀ-ఃా-ౄె-ైొ-్ౕౖౢౣಁ-ಃ಼ಾ-ೄೆ-ೈೊ-್ೕೖೢೣഁ-ഃാ-ൄെ-ൈൊ-്ൗൢൣංඃ්ා-ුූෘ-ෟෲෳัิ-ฺ็-๎ັິ-ູົຼ່-ໍ༹༘༙༵༷༾༿ཱ-྄྆྇ྍ-ྗྙ-ྼ࿆ါ-ှၖ-ၙၞ-ၠၢ-ၤၧ-ၭၱ-ၴႂ-ႍႏႚ-ႝ፝-፟ᜒ-᜔ᜲ-᜴ᝒᝓᝲᝳ឴-៓៝᠋-᠍ᢅᢆᢩᤠ-ᤫᤰ-᤻ᨗ-ᨛᩕ-ᩞ᩠-᩿᩼᪰-᪽ᬀ-ᬄ᬴-᭄᭫-᭳ᮀ-ᮂᮡ-ᮭ᯦-᯳ᰤ-᰷᳐-᳔᳒-᳨᳭ᳲ-᳴᳸᳹᷀-᷵᷻-᷿‿⁀⁔⃐-⃥⃜⃡-⃰℘℮⳯-⵿⳱ⷠ-〪ⷿ-゙゚〯꙯ꙴ-꙽ꚞꚟ꛰꛱ꠂ꠆ꠋꠣ-ꠧꢀꢁꢴ-ꣅ꣠-꣱ꤦ-꤭ꥇ-꥓ꦀ-ꦃ꦳-꧀ꧥꨩ-ꨶꩃꩌꩍꩻ-ꩽꪰꪲ-ꪴꪷꪸꪾ꪿꫁ꫫ-ꫯꫵ꫶ꯣ-ꯪ꯬꯭ﬞ︀-️︠-︯︳︴﹍-﹏＿𐇽𐋠𐍶-𐍺𐨁-𐨃𐨅𐨆𐨌-𐨏𐨸-𐨿𐨺𐫦𐫥𑀀-𑀂𑀸-𑁆𑁿-𑂂𑂰-𑂺𑄀-𑄂𑄧-𑅳𑄴𑆀-𑆂𑆳-𑇊𑇀-𑇌𑈬-𑈷𑈾𑋟-𑋪𑌀-𑌃𑌼𑌾-𑍄𑍇𑍈𑍋-𑍍𑍗𑍢𑍣𑍦-𑍬𑍰-𑍴𑐵-𑑆𑒰-𑓃𑖯-𑖵𑖸-𑗀𑗜𑗝𑘰-𑙀𑚫-𑚷𑜝-𑜫𑰯-𑰶𑰸-𑰿𑲒-𑲧𑲩-𑲶𖫰-𖫴𖬰-𖬶𖽑-𖽾𖾏-𖾒𛲝𛲞𝅥-𝅩𝅭-𝅲𝅻-𝆂𝆅-𝆋𝆪-𝆭𝉂-𝉄𝨀-𝨶𝨻-𝩬𝩵𝪄𝪛-𝪟𝪡-𝪯𞀀-𞀆𞀈-𞀘𞀛-𞀡𞀣𞀤𞀦-𞣐𞀪-𞣖𞥄-𞥊󠄀-󠇯'
diff --git a/deps/v8/third_party/jinja2/_stringdefs.py b/deps/v8/third_party/jinja2/_stringdefs.py
deleted file mode 100644
index da5830e9f19..00000000000
--- a/deps/v8/third_party/jinja2/_stringdefs.py
+++ /dev/null
@@ -1,132 +0,0 @@
-# -*- coding: utf-8 -*-
-"""
-    jinja2._stringdefs
-    ~~~~~~~~~~~~~~~~~~
-
-    Strings of all Unicode characters of a certain category.
-    Used for matching in Unicode-aware languages. Run to regenerate.
-
-    Inspired by chartypes_create.py from the MoinMoin project, original
-    implementation from Pygments.
-
-    :copyright: Copyright 2006-2009 by the Jinja team, see AUTHORS.
-    :license: BSD, see LICENSE for details.
-"""
-
-from jinja2._compat import unichr
-
-Cc = u'\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f'
-
-Cf = u'\xad\u0600\u0601\u0602\u0603\u06dd\u070f\u17b4\u17b5\u200b\u200c\u200d\u200e\u200f\u202a\u202b\u202c\u202d\u202e\u2060\u2061\u2062\u2063\u206a\u206b\u206c\u206d\u206e\u206f\ufeff\ufff9\ufffa\ufffb'
-
-Cn = u'\u0242\u0243\u0244\u0245\u0246\u0247\u0248\u0249\u024a\u024b\u024c\u024d\u024e\u024f\u0370\u0371\u0372\u0373\u0376\u0377\u0378\u0379\u037b\u037c\u037d\u037f\u0380\u0381\u0382\u0383\u038b\u038d\u03a2\u03cf\u0487\u04cf\u04fa\u04fb\u04fc\u04fd\u04fe\u04ff\u0510\u0511\u0512\u0513\u0514\u0515\u0516\u0517\u0518\u0519\u051a\u051b\u051c\u051d\u051e\u051f\u0520\u0521\u0522\u0523\u0524\u0525\u0526\u0527\u0528\u0529\u052a\u052b\u052c\u052d\u052e\u052f\u0530\u0557\u0558\u0560\u0588\u058b\u058c\u058d\u058e\u058f\u0590\u05ba\u05c8\u05c9\u05ca\u05cb\u05cc\u05cd\u05ce\u05cf\u05eb\u05ec\u05ed\u05ee\u05ef\u05f5\u05f6\u05f7\u05f8\u05f9\u05fa\u05fb\u05fc\u05fd\u05fe\u05ff\u0604\u0605\u0606\u0607\u0608\u0609\u060a\u0616\u0617\u0618\u0619\u061a\u061c\u061d\u0620\u063b\u063c\u063d\u063e\u063f\u065f\u070e\u074b\u074c\u076e\u076f\u0770\u0771\u0772\u0773\u0774\u0775\u0776\u0777\u0778\u0779\u077a\u077b\u077c\u077d\u077e\u077f\u07b2\u07b3\u07b4\u07b5\u07b6\u07b7\u07b8\u07b9\u07ba\u07bb\u07bc\u07bd\u07be\u07bf\u07c0\u07c1\u07c2\u07c3\u07c4\u07c5\u07c6\u07c7\u07c8\u07c9\u07ca\u07cb\u07cc\u07cd\u07ce\u07cf\u07d0\u07d1\u07d2\u07d3\u07d4\u07d5\u07d6\u07d7\u07d8\u07d9\u07da\u07db\u07dc\u07dd\u07de\u07df\u07e0\u07e1\u07e2\u07e3\u07e4\u07e5\u07e6\u07e7\u07e8\u07e9\u07ea\u07eb\u07ec\u07ed\u07ee\u07ef\u07f0\u07f1\u07f2\u07f3\u07f4\u07f5\u07f6\u07f7\u07f8\u07f9\u07fa\u07fb\u07fc\u07fd\u07fe\u07ff\u0800\u0801\u0802\u0803\u0804\u0805\u0806\u0807\u0808\u0809\u080a\u080b\u080c\u080d\u080e\u080f\u0810\u0811\u0812\u0813\u0814\u0815\u0816\u0817\u0818\u0819\u081a\u081b\u081c\u081d\u081e\u081f\u0820\u0821\u0822\u0823\u0824\u0825\u0826\u0827\u0828\u0829\u082a\u082b\u082c\u082d\u082e\u082f\u0830\u0831\u0832\u0833\u0834\u0835\u0836\u0837\u0838\u0839\u083a\u083b\u083c\u083d\u083e\u083f\u0840\u0841\u0842\u0843\u0844\u0845\u0846\u0847\u0848\u0849\u084a\u084b\u084c\u084d\u084e\u084f\u0850\u0851\u0852\u0853\u0854\u0855\u0856\u0857\u0858\u0859\u085a\u085b\u085c\u085d\u085e\u085f\u0860\u0861\u0862\u0863\u0864\u0865\u0866\u0867\u0868\u0869\u086a\u086b\u086c\u086d\u086e\u086f\u0870\u0871\u0872\u0873\u0874\u0875\u0876\u0877\u0878\u0879\u087a\u087b\u087c\u087d\u087e\u087f\u0880\u0881\u0882\u0883\u0884\u0885\u0886\u0887\u0888\u0889\u088a\u088b\u088c\u088d\u088e\u088f\u0890\u0891\u0892\u0893\u0894\u0895\u0896\u0897\u0898\u0899\u089a\u089b\u089c\u089d\u089e\u089f\u08a0\u08a1\u08a2\u08a3\u08a4\u08a5\u08a6\u08a7\u08a8\u08a9\u08aa\u08ab\u08ac\u08ad\u08ae\u08af\u08b0\u08b1\u08b2\u08b3\u08b4\u08b5\u08b6\u08b7\u08b8\u08b9\u08ba\u08bb\u08bc\u08bd\u08be\u08bf\u08c0\u08c1\u08c2\u08c3\u08c4\u08c5\u08c6\u08c7\u08c8\u08c9\u08ca\u08cb\u08cc\u08cd\u08ce\u08cf\u08d0\u08d1\u08d2\u08d3\u08d4\u08d5\u08d6\u08d7\u08d8\u08d9\u08da\u08db\u08dc\u08dd\u08de\u08df\u08e0\u08e1\u08e2\u08e3\u08e4\u08e5\u08e6\u08e7\u08e8\u08e9\u08ea\u08eb\u08ec\u08ed\u08ee\u08ef\u08f0\u08f1\u08f2\u08f3\u08f4\u08f5\u08f6\u08f7\u08f8\u08f9\u08fa\u08fb\u08fc\u08fd\u08fe\u08ff\u0900\u093a\u093b\u094e\u094f\u0955\u0956\u0957\u0971\u0972\u0973\u0974\u0975\u0976\u0977\u0978\u0979\u097a\u097b\u097c\u097e\u097f\u0980\u0984\u098d\u098e\u0991\u0992\u09a9\u09b1\u09b3\u09b4\u09b5\u09ba\u09bb\u09c5\u09c6\u09c9\u09ca\u09cf\u09d0\u09d1\u09d2\u09d3\u09d4\u09d5\u09d6\u09d8\u09d9\u09da\u09db\u09de\u09e4\u09e5\u09fb\u09fc\u09fd\u09fe\u09ff\u0a00\u0a04\u0a0b\u0a0c\u0a0d\u0a0e\u0a11\u0a12\u0a29\u0a31\u0a34\u0a37\u0a3a\u0a3b\u0a3d\u0a43\u0a44\u0a45\u0a46\u0a49\u0a4a\u0a4e\u0a4f\u0a50\u0a51\u0a52\u0a53\u0a54\u0a55\u0a56\u0a57\u0a58\u0a5d\u0a5f\u0a60\u0a61\u0a62\u0a63\u0a64\u0a65\u0a75\u0a76\u0a77\u0a78\u0a79\u0a7a\u0a7b\u0a7c\u0a7d\u0a7e\u0a7f\u0a80\u0a84\u0a8e\u0a92\u0aa9\u0ab1\u0ab4\u0aba\u0abb\u0ac6\u0aca\u0ace\u0acf\u0ad1\u0ad2\u0ad3\u0ad4\u0ad5\u0ad6\u0ad7\u0ad8\u0ad9\u0ada\u0adb\u0adc\u0add\u0ade\u0adf\u0ae4\u0ae5\u0af0\u0af2\u0af3\u0af4\u0af5\u0af6\u0af7\u0af8\u0af9\u0afa\u0afb\u0afc\u0afd\u0afe\u0aff\u0b00\u0b04\u0b0d\u0b0e\u0b11\u0b12\u0b29\u0b31\u0b34\u0b3a\u0b3b\u0b44\u0b45\u0b46\u0b49\u0b4a\u0b4e\u0b4f\u0b50\u0b51\u0b52\u0b53\u0b54\u0b55\u0b58\u0b59\u0b5a\u0b5b\u0b5e\u0b62\u0b63\u0b64\u0b65\u0b72\u0b73\u0b74\u0b75\u0b76\u0b77\u0b78\u0b79\u0b7a\u0b7b\u0b7c\u0b7d\u0b7e\u0b7f\u0b80\u0b81\u0b84\u0b8b\u0b8c\u0b8d\u0b91\u0b96\u0b97\u0b98\u0b9b\u0b9d\u0ba0\u0ba1\u0ba2\u0ba5\u0ba6\u0ba7\u0bab\u0bac\u0bad\u0bba\u0bbb\u0bbc\u0bbd\u0bc3\u0bc4\u0bc5\u0bc9\u0bce\u0bcf\u0bd0\u0bd1\u0bd2\u0bd3\u0bd4\u0bd5\u0bd6\u0bd8\u0bd9\u0bda\u0bdb\u0bdc\u0bdd\u0bde\u0bdf\u0be0\u0be1\u0be2\u0be3\u0be4\u0be5\u0bfb\u0bfc\u0bfd\u0bfe\u0bff\u0c00\u0c04\u0c0d\u0c11\u0c29\u0c34\u0c3a\u0c3b\u0c3c\u0c3d\u0c45\u0c49\u0c4e\u0c4f\u0c50\u0c51\u0c52\u0c53\u0c54\u0c57\u0c58\u0c59\u0c5a\u0c5b\u0c5c\u0c5d\u0c5e\u0c5f\u0c62\u0c63\u0c64\u0c65\u0c70\u0c71\u0c72\u0c73\u0c74\u0c75\u0c76\u0c77\u0c78\u0c79\u0c7a\u0c7b\u0c7c\u0c7d\u0c7e\u0c7f\u0c80\u0c81\u0c84\u0c8d\u0c91\u0ca9\u0cb4\u0cba\u0cbb\u0cc5\u0cc9\u0cce\u0ccf\u0cd0\u0cd1\u0cd2\u0cd3\u0cd4\u0cd7\u0cd8\u0cd9\u0cda\u0cdb\u0cdc\u0cdd\u0cdf\u0ce2\u0ce3\u0ce4\u0ce5\u0cf0\u0cf1\u0cf2\u0cf3\u0cf4\u0cf5\u0cf6\u0cf7\u0cf8\u0cf9\u0cfa\u0cfb\u0cfc\u0cfd\u0cfe\u0cff\u0d00\u0d01\u0d04\u0d0d\u0d11\u0d29\u0d3a\u0d3b\u0d3c\u0d3d\u0d44\u0d45\u0d49\u0d4e\u0d4f\u0d50\u0d51\u0d52\u0d53\u0d54\u0d55\u0d56\u0d58\u0d59\u0d5a\u0d5b\u0d5c\u0d5d\u0d5e\u0d5f\u0d62\u0d63\u0d64\u0d65\u0d70\u0d71\u0d72\u0d73\u0d74\u0d75\u0d76\u0d77\u0d78\u0d79\u0d7a\u0d7b\u0d7c\u0d7d\u0d7e\u0d7f\u0d80\u0d81\u0d84\u0d97\u0d98\u0d99\u0db2\u0dbc\u0dbe\u0dbf\u0dc7\u0dc8\u0dc9\u0dcb\u0dcc\u0dcd\u0dce\u0dd5\u0dd7\u0de0\u0de1\u0de2\u0de3\u0de4\u0de5\u0de6\u0de7\u0de8\u0de9\u0dea\u0deb\u0dec\u0ded\u0dee\u0def\u0df0\u0df1\u0df5\u0df6\u0df7\u0df8\u0df9\u0dfa\u0dfb\u0dfc\u0dfd\u0dfe\u0dff\u0e00\u0e3b\u0e3c\u0e3d\u0e3e\u0e5c\u0e5d\u0e5e\u0e5f\u0e60\u0e61\u0e62\u0e63\u0e64\u0e65\u0e66\u0e67\u0e68\u0e69\u0e6a\u0e6b\u0e6c\u0e6d\u0e6e\u0e6f\u0e70\u0e71\u0e72\u0e73\u0e74\u0e75\u0e76\u0e77\u0e78\u0e79\u0e7a\u0e7b\u0e7c\u0e7d\u0e7e\u0e7f\u0e80\u0e83\u0e85\u0e86\u0e89\u0e8b\u0e8c\u0e8e\u0e8f\u0e90\u0e91\u0e92\u0e93\u0e98\u0ea0\u0ea4\u0ea6\u0ea8\u0ea9\u0eac\u0eba\u0ebe\u0ebf\u0ec5\u0ec7\u0ece\u0ecf\u0eda\u0edb\u0ede\u0edf\u0ee0\u0ee1\u0ee2\u0ee3\u0ee4\u0ee5\u0ee6\u0ee7\u0ee8\u0ee9\u0eea\u0eeb\u0eec\u0eed\u0eee\u0eef\u0ef0\u0ef1\u0ef2\u0ef3\u0ef4\u0ef5\u0ef6\u0ef7\u0ef8\u0ef9\u0efa\u0efb\u0efc\u0efd\u0efe\u0eff\u0f48\u0f6b\u0f6c\u0f6d\u0f6e\u0f6f\u0f70\u0f8c\u0f8d\u0f8e\u0f8f\u0f98\u0fbd\u0fcd\u0fce\u0fd2\u0fd3\u0fd4\u0fd5\u0fd6\u0fd7\u0fd8\u0fd9\u0fda\u0fdb\u0fdc\u0fdd\u0fde\u0fdf\u0fe0\u0fe1\u0fe2\u0fe3\u0fe4\u0fe5\u0fe6\u0fe7\u0fe8\u0fe9\u0fea\u0feb\u0fec\u0fed\u0fee\u0fef\u0ff0\u0ff1\u0ff2\u0ff3\u0ff4\u0ff5\u0ff6\u0ff7\u0ff8\u0ff9\u0ffa\u0ffb\u0ffc\u0ffd\u0ffe\u0fff\u1022\u1028\u102b\u1033\u1034\u1035\u103a\u103b\u103c\u103d\u103e\u103f\u105a\u105b\u105c\u105d\u105e\u105f\u1060\u1061\u1062\u1063\u1064\u1065\u1066\u1067\u1068\u1069\u106a\u106b\u106c\u106d\u106e\u106f\u1070\u1071\u1072\u1073\u1074\u1075\u1076\u1077\u1078\u1079\u107a\u107b\u107c\u107d\u107e\u107f\u1080\u1081\u1082\u1083\u1084\u1085\u1086\u1087\u1088\u1089\u108a\u108b\u108c\u108d\u108e\u108f\u1090\u1091\u1092\u1093\u1094\u1095\u1096\u1097\u1098\u1099\u109a\u109b\u109c\u109d\u109e\u109f\u10c6\u10c7\u10c8\u10c9\u10ca\u10cb\u10cc\u10cd\u10ce\u10cf\u10fd\u10fe\u10ff\u115a\u115b\u115c\u115d\u115e\u11a3\u11a4\u11a5\u11a6\u11a7\u11fa\u11fb\u11fc\u11fd\u11fe\u11ff\u1249\u124e\u124f\u1257\u1259\u125e\u125f\u1289\u128e\u128f\u12b1\u12b6\u12b7\u12bf\u12c1\u12c6\u12c7\u12d7\u1311\u1316\u1317\u135b\u135c\u135d\u135e\u137d\u137e\u137f\u139a\u139b\u139c\u139d\u139e\u139f\u13f5\u13f6\u13f7\u13f8\u13f9\u13fa\u13fb\u13fc\u13fd\u13fe\u13ff\u1400\u1677\u1678\u1679\u167a\u167b\u167c\u167d\u167e\u167f\u169d\u169e\u169f\u16f1\u16f2\u16f3\u16f4\u16f5\u16f6\u16f7\u16f8\u16f9\u16fa\u16fb\u16fc\u16fd\u16fe\u16ff\u170d\u1715\u1716\u1717\u1718\u1719\u171a\u171b\u171c\u171d\u171e\u171f\u1737\u1738\u1739\u173a\u173b\u173c\u173d\u173e\u173f\u1754\u1755\u1756\u1757\u1758\u1759\u175a\u175b\u175c\u175d\u175e\u175f\u176d\u1771\u1774\u1775\u1776\u1777\u1778\u1779\u177a\u177b\u177c\u177d\u177e\u177f\u17de\u17df\u17ea\u17eb\u17ec\u17ed\u17ee\u17ef\u17fa\u17fb\u17fc\u17fd\u17fe\u17ff\u180f\u181a\u181b\u181c\u181d\u181e\u181f\u1878\u1879\u187a\u187b\u187c\u187d\u187e\u187f\u18aa\u18ab\u18ac\u18ad\u18ae\u18af\u18b0\u18b1\u18b2\u18b3\u18b4\u18b5\u18b6\u18b7\u18b8\u18b9\u18ba\u18bb\u18bc\u18bd\u18be\u18bf\u18c0\u18c1\u18c2\u18c3\u18c4\u18c5\u18c6\u18c7\u18c8\u18c9\u18ca\u18cb\u18cc\u18cd\u18ce\u18cf\u18d0\u18d1\u18d2\u18d3\u18d4\u18d5\u18d6\u18d7\u18d8\u18d9\u18da\u18db\u18dc\u18dd\u18de\u18df\u18e0\u18e1\u18e2\u18e3\u18e4\u18e5\u18e6\u18e7\u18e8\u18e9\u18ea\u18eb\u18ec\u18ed\u18ee\u18ef\u18f0\u18f1\u18f2\u18f3\u18f4\u18f5\u18f6\u18f7\u18f8\u18f9\u18fa\u18fb\u18fc\u18fd\u18fe\u18ff\u191d\u191e\u191f\u192c\u192d\u192e\u192f\u193c\u193d\u193e\u193f\u1941\u1942\u1943\u196e\u196f\u1975\u1976\u1977\u1978\u1979\u197a\u197b\u197c\u197d\u197e\u197f\u19aa\u19ab\u19ac\u19ad\u19ae\u19af\u19ca\u19cb\u19cc\u19cd\u19ce\u19cf\u19da\u19db\u19dc\u19dd\u1a1c\u1a1d\u1a20\u1a21\u1a22\u1a23\u1a24\u1a25\u1a26\u1a27\u1a28\u1a29\u1a2a\u1a2b\u1a2c\u1a2d\u1a2e\u1a2f\u1a30\u1a31\u1a32\u1a33\u1a34\u1a35\u1a36\u1a37\u1a38\u1a39\u1a3a\u1a3b\u1a3c\u1a3d\u1a3e\u1a3f\u1a40\u1a41\u1a42\u1a43\u1a44\u1a45\u1a46\u1a47\u1a48\u1a49\u1a4a\u1a4b\u1a4c\u1a4d\u1a4e\u1a4f\u1a50\u1a51\u1a52\u1a53\u1a54\u1a55\u1a56\u1a57\u1a58\u1a59\u1a5a\u1a5b\u1a5c\u1a5d\u1a5e\u1a5f\u1a60\u1a61\u1a62\u1a63\u1a64\u1a65\u1a66\u1a67\u1a68\u1a69\u1a6a\u1a6b\u1a6c\u1a6d\u1a6e\u1a6f\u1a70\u1a71\u1a72\u1a73\u1a74\u1a75\u1a76\u1a77\u1a78\u1a79\u1a7a\u1a7b\u1a7c\u1a7d\u1a7e\u1a7f\u1a80\u1a81\u1a82\u1a83\u1a84\u1a85\u1a86\u1a87\u1a88\u1a89\u1a8a\u1a8b\u1a8c\u1a8d\u1a8e\u1a8f\u1a90\u1a91\u1a92\u1a93\u1a94\u1a95\u1a96\u1a97\u1a98\u1a99\u1a9a\u1a9b\u1a9c\u1a9d\u1a9e\u1a9f\u1aa0\u1aa1\u1aa2\u1aa3\u1aa4\u1aa5\u1aa6\u1aa7\u1aa8\u1aa9\u1aaa\u1aab\u1aac\u1aad\u1aae\u1aaf\u1ab0\u1ab1\u1ab2\u1ab3\u1ab4\u1ab5\u1ab6\u1ab7\u1ab8\u1ab9\u1aba\u1abb\u1abc\u1abd\u1abe\u1abf\u1ac0\u1ac1\u1ac2\u1ac3\u1ac4\u1ac5\u1ac6\u1ac7\u1ac8\u1ac9\u1aca\u1acb\u1acc\u1acd\u1ace\u1acf\u1ad0\u1ad1\u1ad2\u1ad3\u1ad4\u1ad5\u1ad6\u1ad7\u1ad8\u1ad9\u1ada\u1adb\u1adc\u1add\u1ade\u1adf\u1ae0\u1ae1\u1ae2\u1ae3\u1ae4\u1ae5\u1ae6\u1ae7\u1ae8\u1ae9\u1aea\u1aeb\u1aec\u1aed\u1aee\u1aef\u1af0\u1af1\u1af2\u1af3\u1af4\u1af5\u1af6\u1af7\u1af8\u1af9\u1afa\u1afb\u1afc\u1afd\u1afe\u1aff\u1b00\u1b01\u1b02\u1b03\u1b04\u1b05\u1b06\u1b07\u1b08\u1b09\u1b0a\u1b0b\u1b0c\u1b0d\u1b0e\u1b0f\u1b10\u1b11\u1b12\u1b13\u1b14\u1b15\u1b16\u1b17\u1b18\u1b19\u1b1a\u1b1b\u1b1c\u1b1d\u1b1e\u1b1f\u1b20\u1b21\u1b22\u1b23\u1b24\u1b25\u1b26\u1b27\u1b28\u1b29\u1b2a\u1b2b\u1b2c\u1b2d\u1b2e\u1b2f\u1b30\u1b31\u1b32\u1b33\u1b34\u1b35\u1b36\u1b37\u1b38\u1b39\u1b3a\u1b3b\u1b3c\u1b3d\u1b3e\u1b3f\u1b40\u1b41\u1b42\u1b43\u1b44\u1b45\u1b46\u1b47\u1b48\u1b49\u1b4a\u1b4b\u1b4c\u1b4d\u1b4e\u1b4f\u1b50\u1b51\u1b52\u1b53\u1b54\u1b55\u1b56\u1b57\u1b58\u1b59\u1b5a\u1b5b\u1b5c\u1b5d\u1b5e\u1b5f\u1b60\u1b61\u1b62\u1b63\u1b64\u1b65\u1b66\u1b67\u1b68\u1b69\u1b6a\u1b6b\u1b6c\u1b6d\u1b6e\u1b6f\u1b70\u1b71\u1b72\u1b73\u1b74\u1b75\u1b76\u1b77\u1b78\u1b79\u1b7a\u1b7b\u1b7c\u1b7d\u1b7e\u1b7f\u1b80\u1b81\u1b82\u1b83\u1b84\u1b85\u1b86\u1b87\u1b88\u1b89\u1b8a\u1b8b\u1b8c\u1b8d\u1b8e\u1b8f\u1b90\u1b91\u1b92\u1b93\u1b94\u1b95\u1b96\u1b97\u1b98\u1b99\u1b9a\u1b9b\u1b9c\u1b9d\u1b9e\u1b9f\u1ba0\u1ba1\u1ba2\u1ba3\u1ba4\u1ba5\u1ba6\u1ba7\u1ba8\u1ba9\u1baa\u1bab\u1bac\u1bad\u1bae\u1baf\u1bb0\u1bb1\u1bb2\u1bb3\u1bb4\u1bb5\u1bb6\u1bb7\u1bb8\u1bb9\u1bba\u1bbb\u1bbc\u1bbd\u1bbe\u1bbf\u1bc0\u1bc1\u1bc2\u1bc3\u1bc4\u1bc5\u1bc6\u1bc7\u1bc8\u1bc9\u1bca\u1bcb\u1bcc\u1bcd\u1bce\u1bcf\u1bd0\u1bd1\u1bd2\u1bd3\u1bd4\u1bd5\u1bd6\u1bd7\u1bd8\u1bd9\u1bda\u1bdb\u1bdc\u1bdd\u1bde\u1bdf\u1be0\u1be1\u1be2\u1be3\u1be4\u1be5\u1be6\u1be7\u1be8\u1be9\u1bea\u1beb\u1bec\u1bed\u1bee\u1bef\u1bf0\u1bf1\u1bf2\u1bf3\u1bf4\u1bf5\u1bf6\u1bf7\u1bf8\u1bf9\u1bfa\u1bfb\u1bfc\u1bfd\u1bfe\u1bff\u1c00\u1c01\u1c02\u1c03\u1c04\u1c05\u1c06\u1c07\u1c08\u1c09\u1c0a\u1c0b\u1c0c\u1c0d\u1c0e\u1c0f\u1c10\u1c11\u1c12\u1c13\u1c14\u1c15\u1c16\u1c17\u1c18\u1c19\u1c1a\u1c1b\u1c1c\u1c1d\u1c1e\u1c1f\u1c20\u1c21\u1c22\u1c23\u1c24\u1c25\u1c26\u1c27\u1c28\u1c29\u1c2a\u1c2b\u1c2c\u1c2d\u1c2e\u1c2f\u1c30\u1c31\u1c32\u1c33\u1c34\u1c35\u1c36\u1c37\u1c38\u1c39\u1c3a\u1c3b\u1c3c\u1c3d\u1c3e\u1c3f\u1c40\u1c41\u1c42\u1c43\u1c44\u1c45\u1c46\u1c47\u1c48\u1c49\u1c4a\u1c4b\u1c4c\u1c4d\u1c4e\u1c4f\u1c50\u1c51\u1c52\u1c53\u1c54\u1c55\u1c56\u1c57\u1c58\u1c59\u1c5a\u1c5b\u1c5c\u1c5d\u1c5e\u1c5f\u1c60\u1c61\u1c62\u1c63\u1c64\u1c65\u1c66\u1c67\u1c68\u1c69\u1c6a\u1c6b\u1c6c\u1c6d\u1c6e\u1c6f\u1c70\u1c71\u1c72\u1c73\u1c74\u1c75\u1c76\u1c77\u1c78\u1c79\u1c7a\u1c7b\u1c7c\u1c7d\u1c7e\u1c7f\u1c80\u1c81\u1c82\u1c83\u1c84\u1c85\u1c86\u1c87\u1c88\u1c89\u1c8a\u1c8b\u1c8c\u1c8d\u1c8e\u1c8f\u1c90\u1c91\u1c92\u1c93\u1c94\u1c95\u1c96\u1c97\u1c98\u1c99\u1c9a\u1c9b\u1c9c\u1c9d\u1c9e\u1c9f\u1ca0\u1ca1\u1ca2\u1ca3\u1ca4\u1ca5\u1ca6\u1ca7\u1ca8\u1ca9\u1caa\u1cab\u1cac\u1cad\u1cae\u1caf\u1cb0\u1cb1\u1cb2\u1cb3\u1cb4\u1cb5\u1cb6\u1cb7\u1cb8\u1cb9\u1cba\u1cbb\u1cbc\u1cbd\u1cbe\u1cbf\u1cc0\u1cc1\u1cc2\u1cc3\u1cc4\u1cc5\u1cc6\u1cc7\u1cc8\u1cc9\u1cca\u1ccb\u1ccc\u1ccd\u1cce\u1ccf\u1cd0\u1cd1\u1cd2\u1cd3\u1cd4\u1cd5\u1cd6\u1cd7\u1cd8\u1cd9\u1cda\u1cdb\u1cdc\u1cdd\u1cde\u1cdf\u1ce0\u1ce1\u1ce2\u1ce3\u1ce4\u1ce5\u1ce6\u1ce7\u1ce8\u1ce9\u1cea\u1ceb\u1cec\u1ced\u1cee\u1cef\u1cf0\u1cf1\u1cf2\u1cf3\u1cf4\u1cf5\u1cf6\u1cf7\u1cf8\u1cf9\u1cfa\u1cfb\u1cfc\u1cfd\u1cfe\u1cff\u1dc4\u1dc5\u1dc6\u1dc7\u1dc8\u1dc9\u1dca\u1dcb\u1dcc\u1dcd\u1dce\u1dcf\u1dd0\u1dd1\u1dd2\u1dd3\u1dd4\u1dd5\u1dd6\u1dd7\u1dd8\u1dd9\u1dda\u1ddb\u1ddc\u1ddd\u1dde\u1ddf\u1de0\u1de1\u1de2\u1de3\u1de4\u1de5\u1de6\u1de7\u1de8\u1de9\u1dea\u1deb\u1dec\u1ded\u1dee\u1def\u1df0\u1df1\u1df2\u1df3\u1df4\u1df5\u1df6\u1df7\u1df8\u1df9\u1dfa\u1dfb\u1dfc\u1dfd\u1dfe\u1dff\u1e9c\u1e9d\u1e9e\u1e9f\u1efa\u1efb\u1efc\u1efd\u1efe\u1eff\u1f16\u1f17\u1f1e\u1f1f\u1f46\u1f47\u1f4e\u1f4f\u1f58\u1f5a\u1f5c\u1f5e\u1f7e\u1f7f\u1fb5\u1fc5\u1fd4\u1fd5\u1fdc\u1ff0\u1ff1\u1ff5\u1fff\u2064\u2065\u2066\u2067\u2068\u2069\u2072\u2073\u208f\u2095\u2096\u2097\u2098\u2099\u209a\u209b\u209c\u209d\u209e\u209f\u20b6\u20b7\u20b8\u20b9\u20ba\u20bb\u20bc\u20bd\u20be\u20bf\u20c0\u20c1\u20c2\u20c3\u20c4\u20c5\u20c6\u20c7\u20c8\u20c9\u20ca\u20cb\u20cc\u20cd\u20ce\u20cf\u20ec\u20ed\u20ee\u20ef\u20f0\u20f1\u20f2\u20f3\u20f4\u20f5\u20f6\u20f7\u20f8\u20f9\u20fa\u20fb\u20fc\u20fd\u20fe\u20ff\u214d\u214e\u214f\u2150\u2151\u2152\u2184\u2185\u2186\u2187\u2188\u2189\u218a\u218b\u218c\u218d\u218e\u218f\u23dc\u23dd\u23de\u23df\u23e0\u23e1\u23e2\u23e3\u23e4\u23e5\u23e6\u23e7\u23e8\u23e9\u23ea\u23eb\u23ec\u23ed\u23ee\u23ef\u23f0\u23f1\u23f2\u23f3\u23f4\u23f5\u23f6\u23f7\u23f8\u23f9\u23fa\u23fb\u23fc\u23fd\u23fe\u23ff\u2427\u2428\u2429\u242a\u242b\u242c\u242d\u242e\u242f\u2430\u2431\u2432\u2433\u2434\u2435\u2436\u2437\u2438\u2439\u243a\u243b\u243c\u243d\u243e\u243f\u244b\u244c\u244d\u244e\u244f\u2450\u2451\u2452\u2453\u2454\u2455\u2456\u2457\u2458\u2459\u245a\u245b\u245c\u245d\u245e\u245f\u269d\u269e\u269f\u26b2\u26b3\u26b4\u26b5\u26b6\u26b7\u26b8\u26b9\u26ba\u26bb\u26bc\u26bd\u26be\u26bf\u26c0\u26c1\u26c2\u26c3\u26c4\u26c5\u26c6\u26c7\u26c8\u26c9\u26ca\u26cb\u26cc\u26cd\u26ce\u26cf\u26d0\u26d1\u26d2\u26d3\u26d4\u26d5\u26d6\u26d7\u26d8\u26d9\u26da\u26db\u26dc\u26dd\u26de\u26df\u26e0\u26e1\u26e2\u26e3\u26e4\u26e5\u26e6\u26e7\u26e8\u26e9\u26ea\u26eb\u26ec\u26ed\u26ee\u26ef\u26f0\u26f1\u26f2\u26f3\u26f4\u26f5\u26f6\u26f7\u26f8\u26f9\u26fa\u26fb\u26fc\u26fd\u26fe\u26ff\u2700\u2705\u270a\u270b\u2728\u274c\u274e\u2753\u2754\u2755\u2757\u275f\u2760\u2795\u2796\u2797\u27b0\u27bf\u27c7\u27c8\u27c9\u27ca\u27cb\u27cc\u27cd\u27ce\u27cf\u27ec\u27ed\u27ee\u27ef\u2b14\u2b15\u2b16\u2b17\u2b18\u2b19\u2b1a\u2b1b\u2b1c\u2b1d\u2b1e\u2b1f\u2b20\u2b21\u2b22\u2b23\u2b24\u2b25\u2b26\u2b27\u2b28\u2b29\u2b2a\u2b2b\u2b2c\u2b2d\u2b2e\u2b2f\u2b30\u2b31\u2b32\u2b33\u2b34\u2b35\u2b36\u2b37\u2b38\u2b39\u2b3a\u2b3b\u2b3c\u2b3d\u2b3e\u2b3f\u2b40\u2b41\u2b42\u2b43\u2b44\u2b45\u2b46\u2b47\u2b48\u2b49\u2b4a\u2b4b\u2b4c\u2b4d\u2b4e\u2b4f\u2b50\u2b51\u2b52\u2b53\u2b54\u2b55\u2b56\u2b57\u2b58\u2b59\u2b5a\u2b5b\u2b5c\u2b5d\u2b5e\u2b5f\u2b60\u2b61\u2b62\u2b63\u2b64\u2b65\u2b66\u2b67\u2b68\u2b69\u2b6a\u2b6b\u2b6c\u2b6d\u2b6e\u2b6f\u2b70\u2b71\u2b72\u2b73\u2b74\u2b75\u2b76\u2b77\u2b78\u2b79\u2b7a\u2b7b\u2b7c\u2b7d\u2b7e\u2b7f\u2b80\u2b81\u2b82\u2b83\u2b84\u2b85\u2b86\u2b87\u2b88\u2b89\u2b8a\u2b8b\u2b8c\u2b8d\u2b8e\u2b8f\u2b90\u2b91\u2b92\u2b93\u2b94\u2b95\u2b96\u2b97\u2b98\u2b99\u2b9a\u2b9b\u2b9c\u2b9d\u2b9e\u2b9f\u2ba0\u2ba1\u2ba2\u2ba3\u2ba4\u2ba5\u2ba6\u2ba7\u2ba8\u2ba9\u2baa\u2bab\u2bac\u2bad\u2bae\u2baf\u2bb0\u2bb1\u2bb2\u2bb3\u2bb4\u2bb5\u2bb6\u2bb7\u2bb8\u2bb9\u2bba\u2bbb\u2bbc\u2bbd\u2bbe\u2bbf\u2bc0\u2bc1\u2bc2\u2bc3\u2bc4\u2bc5\u2bc6\u2bc7\u2bc8\u2bc9\u2bca\u2bcb\u2bcc\u2bcd\u2bce\u2bcf\u2bd0\u2bd1\u2bd2\u2bd3\u2bd4\u2bd5\u2bd6\u2bd7\u2bd8\u2bd9\u2bda\u2bdb\u2bdc\u2bdd\u2bde\u2bdf\u2be0\u2be1\u2be2\u2be3\u2be4\u2be5\u2be6\u2be7\u2be8\u2be9\u2bea\u2beb\u2bec\u2bed\u2bee\u2bef\u2bf0\u2bf1\u2bf2\u2bf3\u2bf4\u2bf5\u2bf6\u2bf7\u2bf8\u2bf9\u2bfa\u2bfb\u2bfc\u2bfd\u2bfe\u2bff\u2c2f\u2c5f\u2c60\u2c61\u2c62\u2c63\u2c64\u2c65\u2c66\u2c67\u2c68\u2c69\u2c6a\u2c6b\u2c6c\u2c6d\u2c6e\u2c6f\u2c70\u2c71\u2c72\u2c73\u2c74\u2c75\u2c76\u2c77\u2c78\u2c79\u2c7a\u2c7b\u2c7c\u2c7d\u2c7e\u2c7f\u2ceb\u2cec\u2ced\u2cee\u2cef\u2cf0\u2cf1\u2cf2\u2cf3\u2cf4\u2cf5\u2cf6\u2cf7\u2cf8\u2d26\u2d27\u2d28\u2d29\u2d2a\u2d2b\u2d2c\u2d2d\u2d2e\u2d2f\u2d66\u2d67\u2d68\u2d69\u2d6a\u2d6b\u2d6c\u2d6d\u2d6e\u2d70\u2d71\u2d72\u2d73\u2d74\u2d75\u2d76\u2d77\u2d78\u2d79\u2d7a\u2d7b\u2d7c\u2d7d\u2d7e\u2d7f\u2d97\u2d98\u2d99\u2d9a\u2d9b\u2d9c\u2d9d\u2d9e\u2d9f\u2da7\u2daf\u2db7\u2dbf\u2dc7\u2dcf\u2dd7\u2ddf\u2de0\u2de1\u2de2\u2de3\u2de4\u2de5\u2de6\u2de7\u2de8\u2de9\u2dea\u2deb\u2dec\u2ded\u2dee\u2def\u2df0\u2df1\u2df2\u2df3\u2df4\u2df5\u2df6\u2df7\u2df8\u2df9\u2dfa\u2dfb\u2dfc\u2dfd\u2dfe\u2dff\u2e18\u2e19\u2e1a\u2e1b\u2e1e\u2e1f\u2e20\u2e21\u2e22\u2e23\u2e24\u2e25\u2e26\u2e27\u2e28\u2e29\u2e2a\u2e2b\u2e2c\u2e2d\u2e2e\u2e2f\u2e30\u2e31\u2e32\u2e33\u2e34\u2e35\u2e36\u2e37\u2e38\u2e39\u2e3a\u2e3b\u2e3c\u2e3d\u2e3e\u2e3f\u2e40\u2e41\u2e42\u2e43\u2e44\u2e45\u2e46\u2e47\u2e48\u2e49\u2e4a\u2e4b\u2e4c\u2e4d\u2e4e\u2e4f\u2e50\u2e51\u2e52\u2e53\u2e54\u2e55\u2e56\u2e57\u2e58\u2e59\u2e5a\u2e5b\u2e5c\u2e5d\u2e5e\u2e5f\u2e60\u2e61\u2e62\u2e63\u2e64\u2e65\u2e66\u2e67\u2e68\u2e69\u2e6a\u2e6b\u2e6c\u2e6d\u2e6e\u2e6f\u2e70\u2e71\u2e72\u2e73\u2e74\u2e75\u2e76\u2e77\u2e78\u2e79\u2e7a\u2e7b\u2e7c\u2e7d\u2e7e\u2e7f\u2e9a\u2ef4\u2ef5\u2ef6\u2ef7\u2ef8\u2ef9\u2efa\u2efb\u2efc\u2efd\u2efe\u2eff\u2fd6\u2fd7\u2fd8\u2fd9\u2fda\u2fdb\u2fdc\u2fdd\u2fde\u2fdf\u2fe0\u2fe1\u2fe2\u2fe3\u2fe4\u2fe5\u2fe6\u2fe7\u2fe8\u2fe9\u2fea\u2feb\u2fec\u2fed\u2fee\u2fef\u2ffc\u2ffd\u2ffe\u2fff\u3040\u3097\u3098\u3100\u3101\u3102\u3103\u3104\u312d\u312e\u312f\u3130\u318f\u31b8\u31b9\u31ba\u31bb\u31bc\u31bd\u31be\u31bf\u31d0\u31d1\u31d2\u31d3\u31d4\u31d5\u31d6\u31d7\u31d8\u31d9\u31da\u31db\u31dc\u31dd\u31de\u31df\u31e0\u31e1\u31e2\u31e3\u31e4\u31e5\u31e6\u31e7\u31e8\u31e9\u31ea\u31eb\u31ec\u31ed\u31ee\u31ef\u321f\u3244\u3245\u3246\u3247\u3248\u3249\u324a\u324b\u324c\u324d\u324e\u324f\u32ff\u4db6\u4db7\u4db8\u4db9\u4dba\u4dbb\u4dbc\u4dbd\u4dbe\u4dbf\u9fbc\u9fbd\u9fbe\u9fbf\u9fc0\u9fc1\u9fc2\u9fc3\u9fc4\u9fc5\u9fc6\u9fc7\u9fc8\u9fc9\u9fca\u9fcb\u9fcc\u9fcd\u9fce\u9fcf\u9fd0\u9fd1\u9fd2\u9fd3\u9fd4\u9fd5\u9fd6\u9fd7\u9fd8\u9fd9\u9fda\u9fdb\u9fdc\u9fdd\u9fde\u9fdf\u9fe0\u9fe1\u9fe2\u9fe3\u9fe4\u9fe5\u9fe6\u9fe7\u9fe8\u9fe9\u9fea\u9feb\u9fec\u9fed\u9fee\u9fef\u9ff0\u9ff1\u9ff2\u9ff3\u9ff4\u9ff5\u9ff6\u9ff7\u9ff8\u9ff9\u9ffa\u9ffb\u9ffc\u9ffd\u9ffe\u9fff\ua48d\ua48e\ua48f\ua4c7\ua4c8\ua4c9\ua4ca\ua4cb\ua4cc\ua4cd\ua4ce\ua4cf\ua4d0\ua4d1\ua4d2\ua4d3\ua4d4\ua4d5\ua4d6\ua4d7\ua4d8\ua4d9\ua4da\ua4db\ua4dc\ua4dd\ua4de\ua4df\ua4e0\ua4e1\ua4e2\ua4e3\ua4e4\ua4e5\ua4e6\ua4e7\ua4e8\ua4e9\ua4ea\ua4eb\ua4ec\ua4ed\ua4ee\ua4ef\ua4f0\ua4f1\ua4f2\ua4f3\ua4f4\ua4f5\ua4f6\ua4f7\ua4f8\ua4f9\ua4fa\ua4fb\ua4fc\ua4fd\ua4fe\ua4ff\ua500\ua501\ua502\ua503\ua504\ua505\ua506\ua507\ua508\ua509\ua50a\ua50b\ua50c\ua50d\ua50e\ua50f\ua510\ua511\ua512\ua513\ua514\ua515\ua516\ua517\ua518\ua519\ua51a\ua51b\ua51c\ua51d\ua51e\ua51f\ua520\ua521\ua522\ua523\ua524\ua525\ua526\ua527\ua528\ua529\ua52a\ua52b\ua52c\ua52d\ua52e\ua52f\ua530\ua531\ua532\ua533\ua534\ua535\ua536\ua537\ua538\ua539\ua53a\ua53b\ua53c\ua53d\ua53e\ua53f\ua540\ua541\ua542\ua543\ua544\ua545\ua546\ua547\ua548\ua549\ua54a\ua54b\ua54c\ua54d\ua54e\ua54f\ua550\ua551\ua552\ua553\ua554\ua555\ua556\ua557\ua558\ua559\ua55a\ua55b\ua55c\ua55d\ua55e\ua55f\ua560\ua561\ua562\ua563\ua564\ua565\ua566\ua567\ua568\ua569\ua56a\ua56b\ua56c\ua56d\ua56e\ua56f\ua570\ua571\ua572\ua573\ua574\ua575\ua576\ua577\ua578\ua579\ua57a\ua57b\ua57c\ua57d\ua57e\ua57f\ua580\ua581\ua582\ua583\ua584\ua585\ua586\ua587\ua588\ua589\ua58a\ua58b\ua58c\ua58d\ua58e\ua58f\ua590\ua591\ua592\ua593\ua594\ua595\ua596\ua597\ua598\ua599\ua59a\ua59b\ua59c\ua59d\ua59e\ua59f\ua5a0\ua5a1\ua5a2\ua5a3\ua5a4\ua5a5\ua5a6\ua5a7\ua5a8\ua5a9\ua5aa\ua5ab\ua5ac\ua5ad\ua5ae\ua5af\ua5b0\ua5b1\ua5b2\ua5b3\ua5b4\ua5b5\ua5b6\ua5b7\ua5b8\ua5b9\ua5ba\ua5bb\ua5bc\ua5bd\ua5be\ua5bf\ua5c0\ua5c1\ua5c2\ua5c3\ua5c4\ua5c5\ua5c6\ua5c7\ua5c8\ua5c9\ua5ca\ua5cb\ua5cc\ua5cd\ua5ce\ua5cf\ua5d0\ua5d1\ua5d2\ua5d3\ua5d4\ua5d5\ua5d6\ua5d7\ua5d8\ua5d9\ua5da\ua5db\ua5dc\ua5dd\ua5de\ua5df\ua5e0\ua5e1\ua5e2\ua5e3\ua5e4\ua5e5\ua5e6\ua5e7\ua5e8\ua5e9\ua5ea\ua5eb\ua5ec\ua5ed\ua5ee\ua5ef\ua5f0\ua5f1\ua5f2\ua5f3\ua5f4\ua5f5\ua5f6\ua5f7\ua5f8\ua5f9\ua5fa\ua5fb\ua5fc\ua5fd\ua5fe\ua5ff\ua600\ua601\ua602\ua603\ua604\ua605\ua606\ua607\ua608\ua609\ua60a\ua60b\ua60c\ua60d\ua60e\ua60f\ua610\ua611\ua612\ua613\ua614\ua615\ua616\ua617\ua618\ua619\ua61a\ua61b\ua61c\ua61d\ua61e\ua61f\ua620\ua621\ua622\ua623\ua624\ua625\ua626\ua627\ua628\ua629\ua62a\ua62b\ua62c\ua62d\ua62e\ua62f\ua630\ua631\ua632\ua633\ua634\ua635\ua636\ua637\ua638\ua639\ua63a\ua63b\ua63c\ua63d\ua63e\ua63f\ua640\ua641\ua642\ua643\ua644\ua645\ua646\ua647\ua648\ua649\ua64a\ua64b\ua64c\ua64d\ua64e\ua64f\ua650\ua651\ua652\ua653\ua654\ua655\ua656\ua657\ua658\ua659\ua65a\ua65b\ua65c\ua65d\ua65e\ua65f\ua660\ua661\ua662\ua663\ua664\ua665\ua666\ua667\ua668\ua669\ua66a\ua66b\ua66c\ua66d\ua66e\ua66f\ua670\ua671\ua672\ua673\ua674\ua675\ua676\ua677\ua678\ua679\ua67a\ua67b\ua67c\ua67d\ua67e\ua67f\ua680\ua681\ua682\ua683\ua684\ua685\ua686\ua687\ua688\ua689\ua68a\ua68b\ua68c\ua68d\ua68e\ua68f\ua690\ua691\ua692\ua693\ua694\ua695\ua696\ua697\ua698\ua699\ua69a\ua69b\ua69c\ua69d\ua69e\ua69f\ua6a0\ua6a1\ua6a2\ua6a3\ua6a4\ua6a5\ua6a6\ua6a7\ua6a8\ua6a9\ua6aa\ua6ab\ua6ac\ua6ad\ua6ae\ua6af\ua6b0\ua6b1\ua6b2\ua6b3\ua6b4\ua6b5\ua6b6\ua6b7\ua6b8\ua6b9\ua6ba\ua6bb\ua6bc\ua6bd\ua6be\ua6bf\ua6c0\ua6c1\ua6c2\ua6c3\ua6c4\ua6c5\ua6c6\ua6c7\ua6c8\ua6c9\ua6ca\ua6cb\ua6cc\ua6cd\ua6ce\ua6cf\ua6d0\ua6d1\ua6d2\ua6d3\ua6d4\ua6d5\ua6d6\ua6d7\ua6d8\ua6d9\ua6da\ua6db\ua6dc\ua6dd\ua6de\ua6df\ua6e0\ua6e1\ua6e2\ua6e3\ua6e4\ua6e5\ua6e6\ua6e7\ua6e8\ua6e9\ua6ea\ua6eb\ua6ec\ua6ed\ua6ee\ua6ef\ua6f0\ua6f1\ua6f2\ua6f3\ua6f4\ua6f5\ua6f6\ua6f7\ua6f8\ua6f9\ua6fa\ua6fb\ua6fc\ua6fd\ua6fe\ua6ff\ua717\ua718\ua719\ua71a\ua71b\ua71c\ua71d\ua71e\ua71f\ua720\ua721\ua722\ua723\ua724\ua725\ua726\ua727\ua728\ua729\ua72a\ua72b\ua72c\ua72d\ua72e\ua72f\ua730\ua731\ua732\ua733\ua734\ua735\ua736\ua737\ua738\ua739\ua73a\ua73b\ua73c\ua73d\ua73e\ua73f\ua740\ua741\ua742\ua743\ua744\ua745\ua746\ua747\ua748\ua749\ua74a\ua74b\ua74c\ua74d\ua74e\ua74f\ua750\ua751\ua752\ua753\ua754\ua755\ua756\ua757\ua758\ua759\ua75a\ua75b\ua75c\ua75d\ua75e\ua75f\ua760\ua761\ua762\ua763\ua764\ua765\ua766\ua767\ua768\ua769\ua76a\ua76b\ua76c\ua76d\ua76e\ua76f\ua770\ua771\ua772\ua773\ua774\ua775\ua776\ua777\ua778\ua779\ua77a\ua77b\ua77c\ua77d\ua77e\ua77f\ua780\ua781\ua782\ua783\ua784\ua785\ua786\ua787\ua788\ua789\ua78a\ua78b\ua78c\ua78d\ua78e\ua78f\ua790\ua791\ua792\ua793\ua794\ua795\ua796\ua797\ua798\ua799\ua79a\ua79b\ua79c\ua79d\ua79e\ua79f\ua7a0\ua7a1\ua7a2\ua7a3\ua7a4\ua7a5\ua7a6\ua7a7\ua7a8\ua7a9\ua7aa\ua7ab\ua7ac\ua7ad\ua7ae\ua7af\ua7b0\ua7b1\ua7b2\ua7b3\ua7b4\ua7b5\ua7b6\ua7b7\ua7b8\ua7b9\ua7ba\ua7bb\ua7bc\ua7bd\ua7be\ua7bf\ua7c0\ua7c1\ua7c2\ua7c3\ua7c4\ua7c5\ua7c6\ua7c7\ua7c8\ua7c9\ua7ca\ua7cb\ua7cc\ua7cd\ua7ce\ua7cf\ua7d0\ua7d1\ua7d2\ua7d3\ua7d4\ua7d5\ua7d6\ua7d7\ua7d8\ua7d9\ua7da\ua7db\ua7dc\ua7dd\ua7de\ua7df\ua7e0\ua7e1\ua7e2\ua7e3\ua7e4\ua7e5\ua7e6\ua7e7\ua7e8\ua7e9\ua7ea\ua7eb\ua7ec\ua7ed\ua7ee\ua7ef\ua7f0\ua7f1\ua7f2\ua7f3\ua7f4\ua7f5\ua7f6\ua7f7\ua7f8\ua7f9\ua7fa\ua7fb\ua7fc\ua7fd\ua7fe\ua7ff\ua82c\ua82d\ua82e\ua82f\ua830\ua831\ua832\ua833\ua834\ua835\ua836\ua837\ua838\ua839\ua83a\ua83b\ua83c\ua83d\ua83e\ua83f\ua840\ua841\ua842\ua843\ua844\ua845\ua846\ua847\ua848\ua849\ua84a\ua84b\ua84c\ua84d\ua84e\ua84f\ua850\ua851\ua852\ua853\ua854\ua855\ua856\ua857\ua858\ua859\ua85a\ua85b\ua85c\ua85d\ua85e\ua85f\ua860\ua861\ua862\ua863\ua864\ua865\ua866\ua867\ua868\ua869\ua86a\ua86b\ua86c\ua86d\ua86e\ua86f\ua870\ua871\ua872\ua873\ua874\ua875\ua876\ua877\ua878\ua879\ua87a\ua87b\ua87c\ua87d\ua87e\ua87f\ua880\ua881\ua882\ua883\ua884\ua885\ua886\ua887\ua888\ua889\ua88a\ua88b\ua88c\ua88d\ua88e\ua88f\ua890\ua891\ua892\ua893\ua894\ua895\ua896\ua897\ua898\ua899\ua89a\ua89b\ua89c\ua89d\ua89e\ua89f\ua8a0\ua8a1\ua8a2\ua8a3\ua8a4\ua8a5\ua8a6\ua8a7\ua8a8\ua8a9\ua8aa\ua8ab\ua8ac\ua8ad\ua8ae\ua8af\ua8b0\ua8b1\ua8b2\ua8b3\ua8b4\ua8b5\ua8b6\ua8b7\ua8b8\ua8b9\ua8ba\ua8bb\ua8bc\ua8bd\ua8be\ua8bf\ua8c0\ua8c1\ua8c2\ua8c3\ua8c4\ua8c5\ua8c6\ua8c7\ua8c8\ua8c9\ua8ca\ua8cb\ua8cc\ua8cd\ua8ce\ua8cf\ua8d0\ua8d1\ua8d2\ua8d3\ua8d4\ua8d5\ua8d6\ua8d7\ua8d8\ua8d9\ua8da\ua8db\ua8dc\ua8dd\ua8de\ua8df\ua8e0\ua8e1\ua8e2\ua8e3\ua8e4\ua8e5\ua8e6\ua8e7\ua8e8\ua8e9\ua8ea\ua8eb\ua8ec\ua8ed\ua8ee\ua8ef\ua8f0\ua8f1\ua8f2\ua8f3\ua8f4\ua8f5\ua8f6\ua8f7\ua8f8\ua8f9\ua8fa\ua8fb\ua8fc\ua8fd\ua8fe\ua8ff\ua900\ua901\ua902\ua903\ua904\ua905\ua906\ua907\ua908\ua909\ua90a\ua90b\ua90c\ua90d\ua90e\ua90f\ua910\ua911\ua912\ua913\ua914\ua915\ua916\ua917\ua918\ua919\ua91a\ua91b\ua91c\ua91d\ua91e\ua91f\ua920\ua921\ua922\ua923\ua924\ua925\ua926\ua927\ua928\ua929\ua92a\ua92b\ua92c\ua92d\ua92e\ua92f\ua930\ua931\ua932\ua933\ua934\ua935\ua936\ua937\ua938\ua939\ua93a\ua93b\ua93c\ua93d\ua93e\ua93f\ua940\ua941\ua942\ua943\ua944\ua945\ua946\ua947\ua948\ua949\ua94a\ua94b\ua94c\ua94d\ua94e\ua94f\ua950\ua951\ua952\ua953\ua954\ua955\ua956\ua957\ua958\ua959\ua95a\ua95b\ua95c\ua95d\ua95e\ua95f\ua960\ua961\ua962\ua963\ua964\ua965\ua966\ua967\ua968\ua969\ua96a\ua96b\ua96c\ua96d\ua96e\ua96f\ua970\ua971\ua972\ua973\ua974\ua975\ua976\ua977\ua978\ua979\ua97a\ua97b\ua97c\ua97d\ua97e\ua97f\ua980\ua981\ua982\ua983\ua984\ua985\ua986\ua987\ua988\ua989\ua98a\ua98b\ua98c\ua98d\ua98e\ua98f\ua990\ua991\ua992\ua993\ua994\ua995\ua996\ua997\ua998\ua999\ua99a\ua99b\ua99c\ua99d\ua99e\ua99f\ua9a0\ua9a1\ua9a2\ua9a3\ua9a4\ua9a5\ua9a6\ua9a7\ua9a8\ua9a9\ua9aa\ua9ab\ua9ac\ua9ad\ua9ae\ua9af\ua9b0\ua9b1\ua9b2\ua9b3\ua9b4\ua9b5\ua9b6\ua9b7\ua9b8\ua9b9\ua9ba\ua9bb\ua9bc\ua9bd\ua9be\ua9bf\ua9c0\ua9c1\ua9c2\ua9c3\ua9c4\ua9c5\ua9c6\ua9c7\ua9c8\ua9c9\ua9ca\ua9cb\ua9cc\ua9cd\ua9ce\ua9cf\ua9d0\ua9d1\ua9d2\ua9d3\ua9d4\ua9d5\ua9d6\ua9d7\ua9d8\ua9d9\ua9da\ua9db\ua9dc\ua9dd\ua9de\ua9df\ua9e0\ua9e1\ua9e2\ua9e3\ua9e4\ua9e5\ua9e6\ua9e7\ua9e8\ua9e9\ua9ea\ua9eb\ua9ec\ua9ed\ua9ee\ua9ef\ua9f0\ua9f1\ua9f2\ua9f3\ua9f4\ua9f5\ua9f6\ua9f7\ua9f8\ua9f9\ua9fa\ua9fb\ua9fc\ua9fd\ua9fe\ua9ff\uaa00\uaa01\uaa02\uaa03\uaa04\uaa05\uaa06\uaa07\uaa08\uaa09\uaa0a\uaa0b\uaa0c\uaa0d\uaa0e\uaa0f\uaa10\uaa11\uaa12\uaa13\uaa14\uaa15\uaa16\uaa17\uaa18\uaa19\uaa1a\uaa1b\uaa1c\uaa1d\uaa1e\uaa1f\uaa20\uaa21\uaa22\uaa23\uaa24\uaa25\uaa26\uaa27\uaa28\uaa29\uaa2a\uaa2b\uaa2c\uaa2d\uaa2e\uaa2f\uaa30\uaa31\uaa32\uaa33\uaa34\uaa35\uaa36\uaa37\uaa38\uaa39\uaa3a\uaa3b\uaa3c\uaa3d\uaa3e\uaa3f\uaa40\uaa41\uaa42\uaa43\uaa44\uaa45\uaa46\uaa47\uaa48\uaa49\uaa4a\uaa4b\uaa4c\uaa4d\uaa4e\uaa4f\uaa50\uaa51\uaa52\uaa53\uaa54\uaa55\uaa56\uaa57\uaa58\uaa59\uaa5a\uaa5b\uaa5c\uaa5d\uaa5e\uaa5f\uaa60\uaa61\uaa62\uaa63\uaa64\uaa65\uaa66\uaa67\uaa68\uaa69\uaa6a\uaa6b\uaa6c\uaa6d\uaa6e\uaa6f\uaa70\uaa71\uaa72\uaa73\uaa74\uaa75\uaa76\uaa77\uaa78\uaa79\uaa7a\uaa7b\uaa7c\uaa7d\uaa7e\uaa7f\uaa80\uaa81\uaa82\uaa83\uaa84\uaa85\uaa86\uaa87\uaa88\uaa89\uaa8a\uaa8b\uaa8c\uaa8d\uaa8e\uaa8f\uaa90\uaa91\uaa92\uaa93\uaa94\uaa95\uaa96\uaa97\uaa98\uaa99\uaa9a\uaa9b\uaa9c\uaa9d\uaa9e\uaa9f\uaaa0\uaaa1\uaaa2\uaaa3\uaaa4\uaaa5\uaaa6\uaaa7\uaaa8\uaaa9\uaaaa\uaaab\uaaac\uaaad\uaaae\uaaaf\uaab0\uaab1\uaab2\uaab3\uaab4\uaab5\uaab6\uaab7\uaab8\uaab9\uaaba\uaabb\uaabc\uaabd\uaabe\uaabf\uaac0\uaac1\uaac2\uaac3\uaac4\uaac5\uaac6\uaac7\uaac8\uaac9\uaaca\uaacb\uaacc\uaacd\uaace\uaacf\uaad0\uaad1\uaad2\uaad3\uaad4\uaad5\uaad6\uaad7\uaad8\uaad9\uaada\uaadb\uaadc\uaadd\uaade\uaadf\uaae0\uaae1\uaae2\uaae3\uaae4\uaae5\uaae6\uaae7\uaae8\uaae9\uaaea\uaaeb\uaaec\uaaed\uaaee\uaaef\uaaf0\uaaf1\uaaf2\uaaf3\uaaf4\uaaf5\uaaf6\uaaf7\uaaf8\uaaf9\uaafa\uaafb\uaafc\uaafd\uaafe\uaaff\uab00\uab01\uab02\uab03\uab04\uab05\uab06\uab07\uab08\uab09\uab0a\uab0b\uab0c\uab0d\uab0e\uab0f\uab10\uab11\uab12\uab13\uab14\uab15\uab16\uab17\uab18\uab19\uab1a\uab1b\uab1c\uab1d\uab1e\uab1f\uab20\uab21\uab22\uab23\uab24\uab25\uab26\uab27\uab28\uab29\uab2a\uab2b\uab2c\uab2d\uab2e\uab2f\uab30\uab31\uab32\uab33\uab34\uab35\uab36\uab37\uab38\uab39\uab3a\uab3b\uab3c\uab3d\uab3e\uab3f\uab40\uab41\uab42\uab43\uab44\uab45\uab46\uab47\uab48\uab49\uab4a\uab4b\uab4c\uab4d\uab4e\uab4f\uab50\uab51\uab52\uab53\uab54\uab55\uab56\uab57\uab58\uab59\uab5a\uab5b\uab5c\uab5d\uab5e\uab5f\uab60\uab61\uab62\uab63\uab64\uab65\uab66\uab67\uab68\uab69\uab6a\uab6b\uab6c\uab6d\uab6e\uab6f\uab70\uab71\uab72\uab73\uab74\uab75\uab76\uab77\uab78\uab79\uab7a\uab7b\uab7c\uab7d\uab7e\uab7f\uab80\uab81\uab82\uab83\uab84\uab85\uab86\uab87\uab88\uab89\uab8a\uab8b\uab8c\uab8d\uab8e\uab8f\uab90\uab91\uab92\uab93\uab94\uab95\uab96\uab97\uab98\uab99\uab9a\uab9b\uab9c\uab9d\uab9e\uab9f\uaba0\uaba1\uaba2\uaba3\uaba4\uaba5\uaba6\uaba7\uaba8\uaba9\uabaa\uabab\uabac\uabad\uabae\uabaf\uabb0\uabb1\uabb2\uabb3\uabb4\uabb5\uabb6\uabb7\uabb8\uabb9\uabba\uabbb\uabbc\uabbd\uabbe\uabbf\uabc0\uabc1\uabc2\uabc3\uabc4\uabc5\uabc6\uabc7\uabc8\uabc9\uabca\uabcb\uabcc\uabcd\uabce\uabcf\uabd0\uabd1\uabd2\uabd3\uabd4\uabd5\uabd6\uabd7\uabd8\uabd9\uabda\uabdb\uabdc\uabdd\uabde\uabdf\uabe0\uabe1\uabe2\uabe3\uabe4\uabe5\uabe6\uabe7\uabe8\uabe9\uabea\uabeb\uabec\uabed\uabee\uabef\uabf0\uabf1\uabf2\uabf3\uabf4\uabf5\uabf6\uabf7\uabf8\uabf9\uabfa\uabfb\uabfc\uabfd\uabfe\uabff\ud7a4\ud7a5\ud7a6\ud7a7\ud7a8\ud7a9\ud7aa\ud7ab\ud7ac\ud7ad\ud7ae\ud7af\ud7b0\ud7b1\ud7b2\ud7b3\ud7b4\ud7b5\ud7b6\ud7b7\ud7b8\ud7b9\ud7ba\ud7bb\ud7bc\ud7bd\ud7be\ud7bf\ud7c0\ud7c1\ud7c2\ud7c3\ud7c4\ud7c5\ud7c6\ud7c7\ud7c8\ud7c9\ud7ca\ud7cb\ud7cc\ud7cd\ud7ce\ud7cf\ud7d0\ud7d1\ud7d2\ud7d3\ud7d4\ud7d5\ud7d6\ud7d7\ud7d8\ud7d9\ud7da\ud7db\ud7dc\ud7dd\ud7de\ud7df\ud7e0\ud7e1\ud7e2\ud7e3\ud7e4\ud7e5\ud7e6\ud7e7\ud7e8\ud7e9\ud7ea\ud7eb\ud7ec\ud7ed\ud7ee\ud7ef\ud7f0\ud7f1\ud7f2\ud7f3\ud7f4\ud7f5\ud7f6\ud7f7\ud7f8\ud7f9\ud7fa\ud7fb\ud7fc\ud7fd\ud7fe\ud7ff\ufa2e\ufa2f\ufa6b\ufa6c\ufa6d\ufa6e\ufa6f\ufada\ufadb\ufadc\ufadd\ufade\ufadf\ufae0\ufae1\ufae2\ufae3\ufae4\ufae5\ufae6\ufae7\ufae8\ufae9\ufaea\ufaeb\ufaec\ufaed\ufaee\ufaef\ufaf0\ufaf1\ufaf2\ufaf3\ufaf4\ufaf5\ufaf6\ufaf7\ufaf8\ufaf9\ufafa\ufafb\ufafc\ufafd\ufafe\ufaff\ufb07\ufb08\ufb09\ufb0a\ufb0b\ufb0c\ufb0d\ufb0e\ufb0f\ufb10\ufb11\ufb12\ufb18\ufb19\ufb1a\ufb1b\ufb1c\ufb37\ufb3d\ufb3f\ufb42\ufb45\ufbb2\ufbb3\ufbb4\ufbb5\ufbb6\ufbb7\ufbb8\ufbb9\ufbba\ufbbb\ufbbc\ufbbd\ufbbe\ufbbf\ufbc0\ufbc1\ufbc2\ufbc3\ufbc4\ufbc5\ufbc6\ufbc7\ufbc8\ufbc9\ufbca\ufbcb\ufbcc\ufbcd\ufbce\ufbcf\ufbd0\ufbd1\ufbd2\ufd40\ufd41\ufd42\ufd43\ufd44\ufd45\ufd46\ufd47\ufd48\ufd49\ufd4a\ufd4b\ufd4c\ufd4d\ufd4e\ufd4f\ufd90\ufd91\ufdc8\ufdc9\ufdca\ufdcb\ufdcc\ufdcd\ufdce\ufdcf\ufdd0\ufdd1\ufdd2\ufdd3\ufdd4\ufdd5\ufdd6\ufdd7\ufdd8\ufdd9\ufdda\ufddb\ufddc\ufddd\ufdde\ufddf\ufde0\ufde1\ufde2\ufde3\ufde4\ufde5\ufde6\ufde7\ufde8\ufde9\ufdea\ufdeb\ufdec\ufded\ufdee\ufdef\ufdfe\ufdff\ufe1a\ufe1b\ufe1c\ufe1d\ufe1e\ufe1f\ufe24\ufe25\ufe26\ufe27\ufe28\ufe29\ufe2a\ufe2b\ufe2c\ufe2d\ufe2e\ufe2f\ufe53\ufe67\ufe6c\ufe6d\ufe6e\ufe6f\ufe75\ufefd\ufefe\uff00\uffbf\uffc0\uffc1\uffc8\uffc9\uffd0\uffd1\uffd8\uffd9\uffdd\uffde\uffdf\uffe7\uffef\ufff0\ufff1\ufff2\ufff3\ufff4\ufff5\ufff6\ufff7\ufff8\ufffe'
-
-Co = u'\ue000\ue001\ue002\ue003\ue004\ue005\ue006\ue007\ue008\ue009\ue00a\ue00b\ue00c\ue00d\ue00e\ue00f\ue010\ue011\ue012\ue013\ue014\ue015\ue016\ue017\ue018\ue019\ue01a\ue01b\ue01c\ue01d\ue01e\ue01f\ue020\ue021\ue022\ue023\ue024\ue025\ue026\ue027\ue028\ue029\ue02a\ue02b\ue02c\ue02d\ue02e\ue02f\ue030\ue031\ue032\ue033\ue034\ue035\ue036\ue037\ue038\ue039\ue03a\ue03b\ue03c\ue03d\ue03e\ue03f\ue040\ue041\ue042\ue043\ue044\ue045\ue046\ue047\ue048\ue049\ue04a\ue04b\ue04c\ue04d\ue04e\ue04f\ue050\ue051\ue052\ue053\ue054\ue055\ue056\ue057\ue058\ue059\ue05a\ue05b\ue05c\ue05d\ue05e\ue05f\ue060\ue061\ue062\ue063\ue064\ue065\ue066\ue067\ue068\ue069\ue06a\ue06b\ue06c\ue06d\ue06e\ue06f\ue070\ue071\ue072\ue073\ue074\ue075\ue076\ue077\ue078\ue079\ue07a\ue07b\ue07c\ue07d\ue07e\ue07f\ue080\ue081\ue082\ue083\ue084\ue085\ue086\ue087\ue088\ue089\ue08a\ue08b\ue08c\ue08d\ue08e\ue08f\ue090\ue091\ue092\ue093\ue094\ue095\ue096\ue097\ue098\ue099\ue09a\ue09b\ue09c\ue09d\ue09e\ue09f\ue0a0\ue0a1\ue0a2\ue0a3\ue0a4\ue0a5\ue0a6\ue0a7\ue0a8\ue0a9\ue0aa\ue0ab\ue0ac\ue0ad\ue0ae\ue0af\ue0b0\ue0b1\ue0b2\ue0b3\ue0b4\ue0b5\ue0b6\ue0b7\ue0b8\ue0b9\ue0ba\ue0bb\ue0bc\ue0bd\ue0be\ue0bf\ue0c0\ue0c1\ue0c2\ue0c3\ue0c4\ue0c5\ue0c6\ue0c7\ue0c8\ue0c9\ue0ca\ue0cb\ue0cc\ue0cd\ue0ce\ue0cf\ue0d0\ue0d1\ue0d2\ue0d3\ue0d4\ue0d5\ue0d6\ue0d7\ue0d8\ue0d9\ue0da\ue0db\ue0dc\ue0dd\ue0de\ue0df\ue0e0\ue0e1\ue0e2\ue0e3\ue0e4\ue0e5\ue0e6\ue0e7\ue0e8\ue0e9\ue0ea\ue0eb\ue0ec\ue0ed\ue0ee\ue0ef\ue0f0\ue0f1\ue0f2\ue0f3\ue0f4\ue0f5\ue0f6\ue0f7\ue0f8\ue0f9\ue0fa\ue0fb\ue0fc\ue0fd\ue0fe\ue0ff\ue100\ue101\ue102\ue103\ue104\ue105\ue106\ue107\ue108\ue109\ue10a\ue10b\ue10c\ue10d\ue10e\ue10f\ue110\ue111\ue112\ue113\ue114\ue115\ue116\ue117\ue118\ue119\ue11a\ue11b\ue11c\ue11d\ue11e\ue11f\ue120\ue121\ue122\ue123\ue124\ue125\ue126\ue127\ue128\ue129\ue12a\ue12b\ue12c\ue12d\ue12e\ue12f\ue130\ue131\ue132\ue133\ue134\ue135\ue136\ue137\ue138\ue139\ue13a\ue13b\ue13c\ue13d\ue13e\ue13f\ue140\ue141\ue142\ue143\ue144\ue145\ue146\ue147\ue148\ue149\ue14a\ue14b\ue14c\ue14d\ue14e\ue14f\ue150\ue151\ue152\ue153\ue154\ue155\ue156\ue157\ue158\ue159\ue15a\ue15b\ue15c\ue15d\ue15e\ue15f\ue160\ue161\ue162\ue163\ue164\ue165\ue166\ue167\ue168\ue169\ue16a\ue16b\ue16c\ue16d\ue16e\ue16f\ue170\ue171\ue172\ue173\ue174\ue175\ue176\ue177\ue178\ue179\ue17a\ue17b\ue17c\ue17d\ue17e\ue17f\ue180\ue181\ue182\ue183\ue184\ue185\ue186\ue187\ue188\ue189\ue18a\ue18b\ue18c\ue18d\ue18e\ue18f\ue190\ue191\ue192\ue193\ue194\ue195\ue196\ue197\ue198\ue199\ue19a\ue19b\ue19c\ue19d\ue19e\ue19f\ue1a0\ue1a1\ue1a2\ue1a3\ue1a4\ue1a5\ue1a6\ue1a7\ue1a8\ue1a9\ue1aa\ue1ab\ue1ac\ue1ad\ue1ae\ue1af\ue1b0\ue1b1\ue1b2\ue1b3\ue1b4\ue1b5\ue1b6\ue1b7\ue1b8\ue1b9\ue1ba\ue1bb\ue1bc\ue1bd\ue1be\ue1bf\ue1c0\ue1c1\ue1c2\ue1c3\ue1c4\ue1c5\ue1c6\ue1c7\ue1c8\ue1c9\ue1ca\ue1cb\ue1cc\ue1cd\ue1ce\ue1cf\ue1d0\ue1d1\ue1d2\ue1d3\ue1d4\ue1d5\ue1d6\ue1d7\ue1d8\ue1d9\ue1da\ue1db\ue1dc\ue1dd\ue1de\ue1df\ue1e0\ue1e1\ue1e2\ue1e3\ue1e4\ue1e5\ue1e6\ue1e7\ue1e8\ue1e9\ue1ea\ue1eb\ue1ec\ue1ed\ue1ee\ue1ef\ue1f0\ue1f1\ue1f2\ue1f3\ue1f4\ue1f5\ue1f6\ue1f7\ue1f8\ue1f9\ue1fa\ue1fb\ue1fc\ue1fd\ue1fe\ue1ff\ue200\ue201\ue202\ue203\ue204\ue205\ue206\ue207\ue208\ue209\ue20a\ue20b\ue20c\ue20d\ue20e\ue20f\ue210\ue211\ue212\ue213\ue214\ue215\ue216\ue217\ue218\ue219\ue21a\ue21b\ue21c\ue21d\ue21e\ue21f\ue220\ue221\ue222\ue223\ue224\ue225\ue226\ue227\ue228\ue229\ue22a\ue22b\ue22c\ue22d\ue22e\ue22f\ue230\ue231\ue232\ue233\ue234\ue235\ue236\ue237\ue238\ue239\ue23a\ue23b\ue23c\ue23d\ue23e\ue23f\ue240\ue241\ue242\ue243\ue244\ue245\ue246\ue247\ue248\ue249\ue24a\ue24b\ue24c\ue24d\ue24e\ue24f\ue250\ue251\ue252\ue253\ue254\ue255\ue256\ue257\ue258\ue259\ue25a\ue25b\ue25c\ue25d\ue25e\ue25f\ue260\ue261\ue262\ue263\ue264\ue265\ue266\ue267\ue268\ue269\ue26a\ue26b\ue26c\ue26d\ue26e\ue26f\ue270\ue271\ue272\ue273\ue274\ue275\ue276\ue277\ue278\ue279\ue27a\ue27b\ue27c\ue27d\ue27e\ue27f\ue280\ue281\ue282\ue283\ue284\ue285\ue286\ue287\ue288\ue289\ue28a\ue28b\ue28c\ue28d\ue28e\ue28f\ue290\ue291\ue292\ue293\ue294\ue295\ue296\ue297\ue298\ue299\ue29a\ue29b\ue29c\ue29d\ue29e\ue29f\ue2a0\ue2a1\ue2a2\ue2a3\ue2a4\ue2a5\ue2a6\ue2a7\ue2a8\ue2a9\ue2aa\ue2ab\ue2ac\ue2ad\ue2ae\ue2af\ue2b0\ue2b1\ue2b2\ue2b3\ue2b4\ue2b5\ue2b6\ue2b7\ue2b8\ue2b9\ue2ba\ue2bb\ue2bc\ue2bd\ue2be\ue2bf\ue2c0\ue2c1\ue2c2\ue2c3\ue2c4\ue2c5\ue2c6\ue2c7\ue2c8\ue2c9\ue2ca\ue2cb\ue2cc\ue2cd\ue2ce\ue2cf\ue2d0\ue2d1\ue2d2\ue2d3\ue2d4\ue2d5\ue2d6\ue2d7\ue2d8\ue2d9\ue2da\ue2db\ue2dc\ue2dd\ue2de\ue2df\ue2e0\ue2e1\ue2e2\ue2e3\ue2e4\ue2e5\ue2e6\ue2e7\ue2e8\ue2e9\ue2ea\ue2eb\ue2ec\ue2ed\ue2ee\ue2ef\ue2f0\ue2f1\ue2f2\ue2f3\ue2f4\ue2f5\ue2f6\ue2f7\ue2f8\ue2f9\ue2fa\ue2fb\ue2fc\ue2fd\ue2fe\ue2ff\ue300\ue301\ue302\ue303\ue304\ue305\ue306\ue307\ue308\ue309\ue30a\ue30b\ue30c\ue30d\ue30e\ue30f\ue310\ue311\ue312\ue313\ue314\ue315\ue316\ue317\ue318\ue319\ue31a\ue31b\ue31c\ue31d\ue31e\ue31f\ue320\ue321\ue322\ue323\ue324\ue325\ue326\ue327\ue328\ue329\ue32a\ue32b\ue32c\ue32d\ue32e\ue32f\ue330\ue331\ue332\ue333\ue334\ue335\ue336\ue337\ue338\ue339\ue33a\ue33b\ue33c\ue33d\ue33e\ue33f\ue340\ue341\ue342\ue343\ue344\ue345\ue346\ue347\ue348\ue349\ue34a\ue34b\ue34c\ue34d\ue34e\ue34f\ue350\ue351\ue352\ue353\ue354\ue355\ue356\ue357\ue358\ue359\ue35a\ue35b\ue35c\ue35d\ue35e\ue35f\ue360\ue361\ue362\ue363\ue364\ue365\ue366\ue367\ue368\ue369\ue36a\ue36b\ue36c\ue36d\ue36e\ue36f\ue370\ue371\ue372\ue373\ue374\ue375\ue376\ue377\ue378\ue379\ue37a\ue37b\ue37c\ue37d\ue37e\ue37f\ue380\ue381\ue382\ue383\ue384\ue385\ue386\ue387\ue388\ue389\ue38a\ue38b\ue38c\ue38d\ue38e\ue38f\ue390\ue391\ue392\ue393\ue394\ue395\ue396\ue397\ue398\ue399\ue39a\ue39b\ue39c\ue39d\ue39e\ue39f\ue3a0\ue3a1\ue3a2\ue3a3\ue3a4\ue3a5\ue3a6\ue3a7\ue3a8\ue3a9\ue3aa\ue3ab\ue3ac\ue3ad\ue3ae\ue3af\ue3b0\ue3b1\ue3b2\ue3b3\ue3b4\ue3b5\ue3b6\ue3b7\ue3b8\ue3b9\ue3ba\ue3bb\ue3bc\ue3bd\ue3be\ue3bf\ue3c0\ue3c1\ue3c2\ue3c3\ue3c4\ue3c5\ue3c6\ue3c7\ue3c8\ue3c9\ue3ca\ue3cb\ue3cc\ue3cd\ue3ce\ue3cf\ue3d0\ue3d1\ue3d2\ue3d3\ue3d4\ue3d5\ue3d6\ue3d7\ue3d8\ue3d9\ue3da\ue3db\ue3dc\ue3dd\ue3de\ue3df\ue3e0\ue3e1\ue3e2\ue3e3\ue3e4\ue3e5\ue3e6\ue3e7\ue3e8\ue3e9\ue3ea\ue3eb\ue3ec\ue3ed\ue3ee\ue3ef\ue3f0\ue3f1\ue3f2\ue3f3\ue3f4\ue3f5\ue3f6\ue3f7\ue3f8\ue3f9\ue3fa\ue3fb\ue3fc\ue3fd\ue3fe\ue3ff\ue400\ue401\ue402\ue403\ue404\ue405\ue406\ue407\ue408\ue409\ue40a\ue40b\ue40c\ue40d\ue40e\ue40f\ue410\ue411\ue412\ue413\ue414\ue415\ue416\ue417\ue418\ue419\ue41a\ue41b\ue41c\ue41d\ue41e\ue41f\ue420\ue421\ue422\ue423\ue424\ue425\ue426\ue427\ue428\ue429\ue42a\ue42b\ue42c\ue42d\ue42e\ue42f\ue430\ue431\ue432\ue433\ue434\ue435\ue436\ue437\ue438\ue439\ue43a\ue43b\ue43c\ue43d\ue43e\ue43f\ue440\ue441\ue442\ue443\ue444\ue445\ue446\ue447\ue448\ue449\ue44a\ue44b\ue44c\ue44d\ue44e\ue44f\ue450\ue451\ue452\ue453\ue454\ue455\ue456\ue457\ue458\ue459\ue45a\ue45b\ue45c\ue45d\ue45e\ue45f\ue460\ue461\ue462\ue463\ue464\ue465\ue466\ue467\ue468\ue469\ue46a\ue46b\ue46c\ue46d\ue46e\ue46f\ue470\ue471\ue472\ue473\ue474\ue475\ue476\ue477\ue478\ue479\ue47a\ue47b\ue47c\ue47d\ue47e\ue47f\ue480\ue481\ue482\ue483\ue484\ue485\ue486\ue487\ue488\ue489\ue48a\ue48b\ue48c\ue48d\ue48e\ue48f\ue490\ue491\ue492\ue493\ue494\ue495\ue496\ue497\ue498\ue499\ue49a\ue49b\ue49c\ue49d\ue49e\ue49f\ue4a0\ue4a1\ue4a2\ue4a3\ue4a4\ue4a5\ue4a6\ue4a7\ue4a8\ue4a9\ue4aa\ue4ab\ue4ac\ue4ad\ue4ae\ue4af\ue4b0\ue4b1\ue4b2\ue4b3\ue4b4\ue4b5\ue4b6\ue4b7\ue4b8\ue4b9\ue4ba\ue4bb\ue4bc\ue4bd\ue4be\ue4bf\ue4c0\ue4c1\ue4c2\ue4c3\ue4c4\ue4c5\ue4c6\ue4c7\ue4c8\ue4c9\ue4ca\ue4cb\ue4cc\ue4cd\ue4ce\ue4cf\ue4d0\ue4d1\ue4d2\ue4d3\ue4d4\ue4d5\ue4d6\ue4d7\ue4d8\ue4d9\ue4da\ue4db\ue4dc\ue4dd\ue4de\ue4df\ue4e0\ue4e1\ue4e2\ue4e3\ue4e4\ue4e5\ue4e6\ue4e7\ue4e8\ue4e9\ue4ea\ue4eb\ue4ec\ue4ed\ue4ee\ue4ef\ue4f0\ue4f1\ue4f2\ue4f3\ue4f4\ue4f5\ue4f6\ue4f7\ue4f8\ue4f9\ue4fa\ue4fb\ue4fc\ue4fd\ue4fe\ue4ff\ue500\ue501\ue502\ue503\ue504\ue505\ue506\ue507\ue508\ue509\ue50a\ue50b\ue50c\ue50d\ue50e\ue50f\ue510\ue511\ue512\ue513\ue514\ue515\ue516\ue517\ue518\ue519\ue51a\ue51b\ue51c\ue51d\ue51e\ue51f\ue520\ue521\ue522\ue523\ue524\ue525\ue526\ue527\ue528\ue529\ue52a\ue52b\ue52c\ue52d\ue52e\ue52f\ue530\ue531\ue532\ue533\ue534\ue535\ue536\ue537\ue538\ue539\ue53a\ue53b\ue53c\ue53d\ue53e\ue53f\ue540\ue541\ue542\ue543\ue544\ue545\ue546\ue547\ue548\ue549\ue54a\ue54b\ue54c\ue54d\ue54e\ue54f\ue550\ue551\ue552\ue553\ue554\ue555\ue556\ue557\ue558\ue559\ue55a\ue55b\ue55c\ue55d\ue55e\ue55f\ue560\ue561\ue562\ue563\ue564\ue565\ue566\ue567\ue568\ue569\ue56a\ue56b\ue56c\ue56d\ue56e\ue56f\ue570\ue571\ue572\ue573\ue574\ue575\ue576\ue577\ue578\ue579\ue57a\ue57b\ue57c\ue57d\ue57e\ue57f\ue580\ue581\ue582\ue583\ue584\ue585\ue586\ue587\ue588\ue589\ue58a\ue58b\ue58c\ue58d\ue58e\ue58f\ue590\ue591\ue592\ue593\ue594\ue595\ue596\ue597\ue598\ue599\ue59a\ue59b\ue59c\ue59d\ue59e\ue59f\ue5a0\ue5a1\ue5a2\ue5a3\ue5a4\ue5a5\ue5a6\ue5a7\ue5a8\ue5a9\ue5aa\ue5ab\ue5ac\ue5ad\ue5ae\ue5af\ue5b0\ue5b1\ue5b2\ue5b3\ue5b4\ue5b5\ue5b6\ue5b7\ue5b8\ue5b9\ue5ba\ue5bb\ue5bc\ue5bd\ue5be\ue5bf\ue5c0\ue5c1\ue5c2\ue5c3\ue5c4\ue5c5\ue5c6\ue5c7\ue5c8\ue5c9\ue5ca\ue5cb\ue5cc\ue5cd\ue5ce\ue5cf\ue5d0\ue5d1\ue5d2\ue5d3\ue5d4\ue5d5\ue5d6\ue5d7\ue5d8\ue5d9\ue5da\ue5db\ue5dc\ue5dd\ue5de\ue5df\ue5e0\ue5e1\ue5e2\ue5e3\ue5e4\ue5e5\ue5e6\ue5e7\ue5e8\ue5e9\ue5ea\ue5eb\ue5ec\ue5ed\ue5ee\ue5ef\ue5f0\ue5f1\ue5f2\ue5f3\ue5f4\ue5f5\ue5f6\ue5f7\ue5f8\ue5f9\ue5fa\ue5fb\ue5fc\ue5fd\ue5fe\ue5ff\ue600\ue601\ue602\ue603\ue604\ue605\ue606\ue607\ue608\ue609\ue60a\ue60b\ue60c\ue60d\ue60e\ue60f\ue610\ue611\ue612\ue613\ue614\ue615\ue616\ue617\ue618\ue619\ue61a\ue61b\ue61c\ue61d\ue61e\ue61f\ue620\ue621\ue622\ue623\ue624\ue625\ue626\ue627\ue628\ue629\ue62a\ue62b\ue62c\ue62d\ue62e\ue62f\ue630\ue631\ue632\ue633\ue634\ue635\ue636\ue637\ue638\ue639\ue63a\ue63b\ue63c\ue63d\ue63e\ue63f\ue640\ue641\ue642\ue643\ue644\ue645\ue646\ue647\ue648\ue649\ue64a\ue64b\ue64c\ue64d\ue64e\ue64f\ue650\ue651\ue652\ue653\ue654\ue655\ue656\ue657\ue658\ue659\ue65a\ue65b\ue65c\ue65d\ue65e\ue65f\ue660\ue661\ue662\ue663\ue664\ue665\ue666\ue667\ue668\ue669\ue66a\ue66b\ue66c\ue66d\ue66e\ue66f\ue670\ue671\ue672\ue673\ue674\ue675\ue676\ue677\ue678\ue679\ue67a\ue67b\ue67c\ue67d\ue67e\ue67f\ue680\ue681\ue682\ue683\ue684\ue685\ue686\ue687\ue688\ue689\ue68a\ue68b\ue68c\ue68d\ue68e\ue68f\ue690\ue691\ue692\ue693\ue694\ue695\ue696\ue697\ue698\ue699\ue69a\ue69b\ue69c\ue69d\ue69e\ue69f\ue6a0\ue6a1\ue6a2\ue6a3\ue6a4\ue6a5\ue6a6\ue6a7\ue6a8\ue6a9\ue6aa\ue6ab\ue6ac\ue6ad\ue6ae\ue6af\ue6b0\ue6b1\ue6b2\ue6b3\ue6b4\ue6b5\ue6b6\ue6b7\ue6b8\ue6b9\ue6ba\ue6bb\ue6bc\ue6bd\ue6be\ue6bf\ue6c0\ue6c1\ue6c2\ue6c3\ue6c4\ue6c5\ue6c6\ue6c7\ue6c8\ue6c9\ue6ca\ue6cb\ue6cc\ue6cd\ue6ce\ue6cf\ue6d0\ue6d1\ue6d2\ue6d3\ue6d4\ue6d5\ue6d6\ue6d7\ue6d8\ue6d9\ue6da\ue6db\ue6dc\ue6dd\ue6de\ue6df\ue6e0\ue6e1\ue6e2\ue6e3\ue6e4\ue6e5\ue6e6\ue6e7\ue6e8\ue6e9\ue6ea\ue6eb\ue6ec\ue6ed\ue6ee\ue6ef\ue6f0\ue6f1\ue6f2\ue6f3\ue6f4\ue6f5\ue6f6\ue6f7\ue6f8\ue6f9\ue6fa\ue6fb\ue6fc\ue6fd\ue6fe\ue6ff\ue700\ue701\ue702\ue703\ue704\ue705\ue706\ue707\ue708\ue709\ue70a\ue70b\ue70c\ue70d\ue70e\ue70f\ue710\ue711\ue712\ue713\ue714\ue715\ue716\ue717\ue718\ue719\ue71a\ue71b\ue71c\ue71d\ue71e\ue71f\ue720\ue721\ue722\ue723\ue724\ue725\ue726\ue727\ue728\ue729\ue72a\ue72b\ue72c\ue72d\ue72e\ue72f\ue730\ue731\ue732\ue733\ue734\ue735\ue736\ue737\ue738\ue739\ue73a\ue73b\ue73c\ue73d\ue73e\ue73f\ue740\ue741\ue742\ue743\ue744\ue745\ue746\ue747\ue748\ue749\ue74a\ue74b\ue74c\ue74d\ue74e\ue74f\ue750\ue751\ue752\ue753\ue754\ue755\ue756\ue757\ue758\ue759\ue75a\ue75b\ue75c\ue75d\ue75e\ue75f\ue760\ue761\ue762\ue763\ue764\ue765\ue766\ue767\ue768\ue769\ue76a\ue76b\ue76c\ue76d\ue76e\ue76f\ue770\ue771\ue772\ue773\ue774\ue775\ue776\ue777\ue778\ue779\ue77a\ue77b\ue77c\ue77d\ue77e\ue77f\ue780\ue781\ue782\ue783\ue784\ue785\ue786\ue787\ue788\ue789\ue78a\ue78b\ue78c\ue78d\ue78e\ue78f\ue790\ue791\ue792\ue793\ue794\ue795\ue796\ue797\ue798\ue799\ue79a\ue79b\ue79c\ue79d\ue79e\ue79f\ue7a0\ue7a1\ue7a2\ue7a3\ue7a4\ue7a5\ue7a6\ue7a7\ue7a8\ue7a9\ue7aa\ue7ab\ue7ac\ue7ad\ue7ae\ue7af\ue7b0\ue7b1\ue7b2\ue7b3\ue7b4\ue7b5\ue7b6\ue7b7\ue7b8\ue7b9\ue7ba\ue7bb\ue7bc\ue7bd\ue7be\ue7bf\ue7c0\ue7c1\ue7c2\ue7c3\ue7c4\ue7c5\ue7c6\ue7c7\ue7c8\ue7c9\ue7ca\ue7cb\ue7cc\ue7cd\ue7ce\ue7cf\ue7d0\ue7d1\ue7d2\ue7d3\ue7d4\ue7d5\ue7d6\ue7d7\ue7d8\ue7d9\ue7da\ue7db\ue7dc\ue7dd\ue7de\ue7df\ue7e0\ue7e1\ue7e2\ue7e3\ue7e4\ue7e5\ue7e6\ue7e7\ue7e8\ue7e9\ue7ea\ue7eb\ue7ec\ue7ed\ue7ee\ue7ef\ue7f0\ue7f1\ue7f2\ue7f3\ue7f4\ue7f5\ue7f6\ue7f7\ue7f8\ue7f9\ue7fa\ue7fb\ue7fc\ue7fd\ue7fe\ue7ff\ue800\ue801\ue802\ue803\ue804\ue805\ue806\ue807\ue808\ue809\ue80a\ue80b\ue80c\ue80d\ue80e\ue80f\ue810\ue811\ue812\ue813\ue814\ue815\ue816\ue817\ue818\ue819\ue81a\ue81b\ue81c\ue81d\ue81e\ue81f\ue820\ue821\ue822\ue823\ue824\ue825\ue826\ue827\ue828\ue829\ue82a\ue82b\ue82c\ue82d\ue82e\ue82f\ue830\ue831\ue832\ue833\ue834\ue835\ue836\ue837\ue838\ue839\ue83a\ue83b\ue83c\ue83d\ue83e\ue83f\ue840\ue841\ue842\ue843\ue844\ue845\ue846\ue847\ue848\ue849\ue84a\ue84b\ue84c\ue84d\ue84e\ue84f\ue850\ue851\ue852\ue853\ue854\ue855\ue856\ue857\ue858\ue859\ue85a\ue85b\ue85c\ue85d\ue85e\ue85f\ue860\ue861\ue862\ue863\ue864\ue865\ue866\ue867\ue868\ue869\ue86a\ue86b\ue86c\ue86d\ue86e\ue86f\ue870\ue871\ue872\ue873\ue874\ue875\ue876\ue877\ue878\ue879\ue87a\ue87b\ue87c\ue87d\ue87e\ue87f\ue880\ue881\ue882\ue883\ue884\ue885\ue886\ue887\ue888\ue889\ue88a\ue88b\ue88c\ue88d\ue88e\ue88f\ue890\ue891\ue892\ue893\ue894\ue895\ue896\ue897\ue898\ue899\ue89a\ue89b\ue89c\ue89d\ue89e\ue89f\ue8a0\ue8a1\ue8a2\ue8a3\ue8a4\ue8a5\ue8a6\ue8a7\ue8a8\ue8a9\ue8aa\ue8ab\ue8ac\ue8ad\ue8ae\ue8af\ue8b0\ue8b1\ue8b2\ue8b3\ue8b4\ue8b5\ue8b6\ue8b7\ue8b8\ue8b9\ue8ba\ue8bb\ue8bc\ue8bd\ue8be\ue8bf\ue8c0\ue8c1\ue8c2\ue8c3\ue8c4\ue8c5\ue8c6\ue8c7\ue8c8\ue8c9\ue8ca\ue8cb\ue8cc\ue8cd\ue8ce\ue8cf\ue8d0\ue8d1\ue8d2\ue8d3\ue8d4\ue8d5\ue8d6\ue8d7\ue8d8\ue8d9\ue8da\ue8db\ue8dc\ue8dd\ue8de\ue8df\ue8e0\ue8e1\ue8e2\ue8e3\ue8e4\ue8e5\ue8e6\ue8e7\ue8e8\ue8e9\ue8ea\ue8eb\ue8ec\ue8ed\ue8ee\ue8ef\ue8f0\ue8f1\ue8f2\ue8f3\ue8f4\ue8f5\ue8f6\ue8f7\ue8f8\ue8f9\ue8fa\ue8fb\ue8fc\ue8fd\ue8fe\ue8ff\ue900\ue901\ue902\ue903\ue904\ue905\ue906\ue907\ue908\ue909\ue90a\ue90b\ue90c\ue90d\ue90e\ue90f\ue910\ue911\ue912\ue913\ue914\ue915\ue916\ue917\ue918\ue919\ue91a\ue91b\ue91c\ue91d\ue91e\ue91f\ue920\ue921\ue922\ue923\ue924\ue925\ue926\ue927\ue928\ue929\ue92a\ue92b\ue92c\ue92d\ue92e\ue92f\ue930\ue931\ue932\ue933\ue934\ue935\ue936\ue937\ue938\ue939\ue93a\ue93b\ue93c\ue93d\ue93e\ue93f\ue940\ue941\ue942\ue943\ue944\ue945\ue946\ue947\ue948\ue949\ue94a\ue94b\ue94c\ue94d\ue94e\ue94f\ue950\ue951\ue952\ue953\ue954\ue955\ue956\ue957\ue958\ue959\ue95a\ue95b\ue95c\ue95d\ue95e\ue95f\ue960\ue961\ue962\ue963\ue964\ue965\ue966\ue967\ue968\ue969\ue96a\ue96b\ue96c\ue96d\ue96e\ue96f\ue970\ue971\ue972\ue973\ue974\ue975\ue976\ue977\ue978\ue979\ue97a\ue97b\ue97c\ue97d\ue97e\ue97f\ue980\ue981\ue982\ue983\ue984\ue985\ue986\ue987\ue988\ue989\ue98a\ue98b\ue98c\ue98d\ue98e\ue98f\ue990\ue991\ue992\ue993\ue994\ue995\ue996\ue997\ue998\ue999\ue99a\ue99b\ue99c\ue99d\ue99e\ue99f\ue9a0\ue9a1\ue9a2\ue9a3\ue9a4\ue9a5\ue9a6\ue9a7\ue9a8\ue9a9\ue9aa\ue9ab\ue9ac\ue9ad\ue9ae\ue9af\ue9b0\ue9b1\ue9b2\ue9b3\ue9b4\ue9b5\ue9b6\ue9b7\ue9b8\ue9b9\ue9ba\ue9bb\ue9bc\ue9bd\ue9be\ue9bf\ue9c0\ue9c1\ue9c2\ue9c3\ue9c4\ue9c5\ue9c6\ue9c7\ue9c8\ue9c9\ue9ca\ue9cb\ue9cc\ue9cd\ue9ce\ue9cf\ue9d0\ue9d1\ue9d2\ue9d3\ue9d4\ue9d5\ue9d6\ue9d7\ue9d8\ue9d9\ue9da\ue9db\ue9dc\ue9dd\ue9de\ue9df\ue9e0\ue9e1\ue9e2\ue9e3\ue9e4\ue9e5\ue9e6\ue9e7\ue9e8\ue9e9\ue9ea\ue9eb\ue9ec\ue9ed\ue9ee\ue9ef\ue9f0\ue9f1\ue9f2\ue9f3\ue9f4\ue9f5\ue9f6\ue9f7\ue9f8\ue9f9\ue9fa\ue9fb\ue9fc\ue9fd\ue9fe\ue9ff\uea00\uea01\uea02\uea03\uea04\uea05\uea06\uea07\uea08\uea09\uea0a\uea0b\uea0c\uea0d\uea0e\uea0f\uea10\uea11\uea12\uea13\uea14\uea15\uea16\uea17\uea18\uea19\uea1a\uea1b\uea1c\uea1d\uea1e\uea1f\uea20\uea21\uea22\uea23\uea24\uea25\uea26\uea27\uea28\uea29\uea2a\uea2b\uea2c\uea2d\uea2e\uea2f\uea30\uea31\uea32\uea33\uea34\uea35\uea36\uea37\uea38\uea39\uea3a\uea3b\uea3c\uea3d\uea3e\uea3f\uea40\uea41\uea42\uea43\uea44\uea45\uea46\uea47\uea48\uea49\uea4a\uea4b\uea4c\uea4d\uea4e\uea4f\uea50\uea51\uea52\uea53\uea54\uea55\uea56\uea57\uea58\uea59\uea5a\uea5b\uea5c\uea5d\uea5e\uea5f\uea60\uea61\uea62\uea63\uea64\uea65\uea66\uea67\uea68\uea69\uea6a\uea6b\uea6c\uea6d\uea6e\uea6f\uea70\uea71\uea72\uea73\uea74\uea75\uea76\uea77\uea78\uea79\uea7a\uea7b\uea7c\uea7d\uea7e\uea7f\uea80\uea81\uea82\uea83\uea84\uea85\uea86\uea87\uea88\uea89\uea8a\uea8b\uea8c\uea8d\uea8e\uea8f\uea90\uea91\uea92\uea93\uea94\uea95\uea96\uea97\uea98\uea99\uea9a\uea9b\uea9c\uea9d\uea9e\uea9f\ueaa0\ueaa1\ueaa2\ueaa3\ueaa4\ueaa5\ueaa6\ueaa7\ueaa8\ueaa9\ueaaa\ueaab\ueaac\ueaad\ueaae\ueaaf\ueab0\ueab1\ueab2\ueab3\ueab4\ueab5\ueab6\ueab7\ueab8\ueab9\ueaba\ueabb\ueabc\ueabd\ueabe\ueabf\ueac0\ueac1\ueac2\ueac3\ueac4\ueac5\ueac6\ueac7\ueac8\ueac9\ueaca\ueacb\ueacc\ueacd\ueace\ueacf\uead0\uead1\uead2\uead3\uead4\uead5\uead6\uead7\uead8\uead9\ueada\ueadb\ueadc\ueadd\ueade\ueadf\ueae0\ueae1\ueae2\ueae3\ueae4\ueae5\ueae6\ueae7\ueae8\ueae9\ueaea\ueaeb\ueaec\ueaed\ueaee\ueaef\ueaf0\ueaf1\ueaf2\ueaf3\ueaf4\ueaf5\ueaf6\ueaf7\ueaf8\ueaf9\ueafa\ueafb\ueafc\ueafd\ueafe\ueaff\ueb00\ueb01\ueb02\ueb03\ueb04\ueb05\ueb06\ueb07\ueb08\ueb09\ueb0a\ueb0b\ueb0c\ueb0d\ueb0e\ueb0f\ueb10\ueb11\ueb12\ueb13\ueb14\ueb15\ueb16\ueb17\ueb18\ueb19\ueb1a\ueb1b\ueb1c\ueb1d\ueb1e\ueb1f\ueb20\ueb21\ueb22\ueb23\ueb24\ueb25\ueb26\ueb27\ueb28\ueb29\ueb2a\ueb2b\ueb2c\ueb2d\ueb2e\ueb2f\ueb30\ueb31\ueb32\ueb33\ueb34\ueb35\ueb36\ueb37\ueb38\ueb39\ueb3a\ueb3b\ueb3c\ueb3d\ueb3e\ueb3f\ueb40\ueb41\ueb42\ueb43\ueb44\ueb45\ueb46\ueb47\ueb48\ueb49\ueb4a\ueb4b\ueb4c\ueb4d\ueb4e\ueb4f\ueb50\ueb51\ueb52\ueb53\ueb54\ueb55\ueb56\ueb57\ueb58\ueb59\ueb5a\ueb5b\ueb5c\ueb5d\ueb5e\ueb5f\ueb60\ueb61\ueb62\ueb63\ueb64\ueb65\ueb66\ueb67\ueb68\ueb69\ueb6a\ueb6b\ueb6c\ueb6d\ueb6e\ueb6f\ueb70\ueb71\ueb72\ueb73\ueb74\ueb75\ueb76\ueb77\ueb78\ueb79\ueb7a\ueb7b\ueb7c\ueb7d\ueb7e\ueb7f\ueb80\ueb81\ueb82\ueb83\ueb84\ueb85\ueb86\ueb87\ueb88\ueb89\ueb8a\ueb8b\ueb8c\ueb8d\ueb8e\ueb8f\ueb90\ueb91\ueb92\ueb93\ueb94\ueb95\ueb96\ueb97\ueb98\ueb99\ueb9a\ueb9b\ueb9c\ueb9d\ueb9e\ueb9f\ueba0\ueba1\ueba2\ueba3\ueba4\ueba5\ueba6\ueba7\ueba8\ueba9\uebaa\uebab\uebac\uebad\uebae\uebaf\uebb0\uebb1\uebb2\uebb3\uebb4\uebb5\uebb6\uebb7\uebb8\uebb9\uebba\uebbb\uebbc\uebbd\uebbe\uebbf\uebc0\uebc1\uebc2\uebc3\uebc4\uebc5\uebc6\uebc7\uebc8\uebc9\uebca\uebcb\uebcc\uebcd\uebce\uebcf\uebd0\uebd1\uebd2\uebd3\uebd4\uebd5\uebd6\uebd7\uebd8\uebd9\uebda\uebdb\uebdc\uebdd\uebde\uebdf\uebe0\uebe1\uebe2\uebe3\uebe4\uebe5\uebe6\uebe7\uebe8\uebe9\uebea\uebeb\uebec\uebed\uebee\uebef\uebf0\uebf1\uebf2\uebf3\uebf4\uebf5\uebf6\uebf7\uebf8\uebf9\uebfa\uebfb\uebfc\uebfd\uebfe\uebff\uec00\uec01\uec02\uec03\uec04\uec05\uec06\uec07\uec08\uec09\uec0a\uec0b\uec0c\uec0d\uec0e\uec0f\uec10\uec11\uec12\uec13\uec14\uec15\uec16\uec17\uec18\uec19\uec1a\uec1b\uec1c\uec1d\uec1e\uec1f\uec20\uec21\uec22\uec23\uec24\uec25\uec26\uec27\uec28\uec29\uec2a\uec2b\uec2c\uec2d\uec2e\uec2f\uec30\uec31\uec32\uec33\uec34\uec35\uec36\uec37\uec38\uec39\uec3a\uec3b\uec3c\uec3d\uec3e\uec3f\uec40\uec41\uec42\uec43\uec44\uec45\uec46\uec47\uec48\uec49\uec4a\uec4b\uec4c\uec4d\uec4e\uec4f\uec50\uec51\uec52\uec53\uec54\uec55\uec56\uec57\uec58\uec59\uec5a\uec5b\uec5c\uec5d\uec5e\uec5f\uec60\uec61\uec62\uec63\uec64\uec65\uec66\uec67\uec68\uec69\uec6a\uec6b\uec6c\uec6d\uec6e\uec6f\uec70\uec71\uec72\uec73\uec74\uec75\uec76\uec77\uec78\uec79\uec7a\uec7b\uec7c\uec7d\uec7e\uec7f\uec80\uec81\uec82\uec83\uec84\uec85\uec86\uec87\uec88\uec89\uec8a\uec8b\uec8c\uec8d\uec8e\uec8f\uec90\uec91\uec92\uec93\uec94\uec95\uec96\uec97\uec98\uec99\uec9a\uec9b\uec9c\uec9d\uec9e\uec9f\ueca0\ueca1\ueca2\ueca3\ueca4\ueca5\ueca6\ueca7\ueca8\ueca9\uecaa\uecab\uecac\uecad\uecae\uecaf\uecb0\uecb1\uecb2\uecb3\uecb4\uecb5\uecb6\uecb7\uecb8\uecb9\uecba\uecbb\uecbc\uecbd\uecbe\uecbf\uecc0\uecc1\uecc2\uecc3\uecc4\uecc5\uecc6\uecc7\uecc8\uecc9\uecca\ueccb\ueccc\ueccd\uecce\ueccf\uecd0\uecd1\uecd2\uecd3\uecd4\uecd5\uecd6\uecd7\uecd8\uecd9\uecda\uecdb\uecdc\uecdd\uecde\uecdf\uece0\uece1\uece2\uece3\uece4\uece5\uece6\uece7\uece8\uece9\uecea\ueceb\uecec\ueced\uecee\uecef\uecf0\uecf1\uecf2\uecf3\uecf4\uecf5\uecf6\uecf7\uecf8\uecf9\uecfa\uecfb\uecfc\uecfd\uecfe\uecff\ued00\ued01\ued02\ued03\ued04\ued05\ued06\ued07\ued08\ued09\ued0a\ued0b\ued0c\ued0d\ued0e\ued0f\ued10\ued11\ued12\ued13\ued14\ued15\ued16\ued17\ued18\ued19\ued1a\ued1b\ued1c\ued1d\ued1e\ued1f\ued20\ued21\ued22\ued23\ued24\ued25\ued26\ued27\ued28\ued29\ued2a\ued2b\ued2c\ued2d\ued2e\ued2f\ued30\ued31\ued32\ued33\ued34\ued35\ued36\ued37\ued38\ued39\ued3a\ued3b\ued3c\ued3d\ued3e\ued3f\ued40\ued41\ued42\ued43\ued44\ued45\ued46\ued47\ued48\ued49\ued4a\ued4b\ued4c\ued4d\ued4e\ued4f\ued50\ued51\ued52\ued53\ued54\ued55\ued56\ued57\ued58\ued59\ued5a\ued5b\ued5c\ued5d\ued5e\ued5f\ued60\ued61\ued62\ued63\ued64\ued65\ued66\ued67\ued68\ued69\ued6a\ued6b\ued6c\ued6d\ued6e\ued6f\ued70\ued71\ued72\ued73\ued74\ued75\ued76\ued77\ued78\ued79\ued7a\ued7b\ued7c\ued7d\ued7e\ued7f\ued80\ued81\ued82\ued83\ued84\ued85\ued86\ued87\ued88\ued89\ued8a\ued8b\ued8c\ued8d\ued8e\ued8f\ued90\ued91\ued92\ued93\ued94\ued95\ued96\ued97\ued98\ued99\ued9a\ued9b\ued9c\ued9d\ued9e\ued9f\ueda0\ueda1\ueda2\ueda3\ueda4\ueda5\ueda6\ueda7\ueda8\ueda9\uedaa\uedab\uedac\uedad\uedae\uedaf\uedb0\uedb1\uedb2\uedb3\uedb4\uedb5\uedb6\uedb7\uedb8\uedb9\uedba\uedbb\uedbc\uedbd\uedbe\uedbf\uedc0\uedc1\uedc2\uedc3\uedc4\uedc5\uedc6\uedc7\uedc8\uedc9\uedca\uedcb\uedcc\uedcd\uedce\uedcf\uedd0\uedd1\uedd2\uedd3\uedd4\uedd5\uedd6\uedd7\uedd8\uedd9\uedda\ueddb\ueddc\ueddd\uedde\ueddf\uede0\uede1\uede2\uede3\uede4\uede5\uede6\uede7\uede8\uede9\uedea\uedeb\uedec\ueded\uedee\uedef\uedf0\uedf1\uedf2\uedf3\uedf4\uedf5\uedf6\uedf7\uedf8\uedf9\uedfa\uedfb\uedfc\uedfd\uedfe\uedff\uee00\uee01\uee02\uee03\uee04\uee05\uee06\uee07\uee08\uee09\uee0a\uee0b\uee0c\uee0d\uee0e\uee0f\uee10\uee11\uee12\uee13\uee14\uee15\uee16\uee17\uee18\uee19\uee1a\uee1b\uee1c\uee1d\uee1e\uee1f\uee20\uee21\uee22\uee23\uee24\uee25\uee26\uee27\uee28\uee29\uee2a\uee2b\uee2c\uee2d\uee2e\uee2f\uee30\uee31\uee32\uee33\uee34\uee35\uee36\uee37\uee38\uee39\uee3a\uee3b\uee3c\uee3d\uee3e\uee3f\uee40\uee41\uee42\uee43\uee44\uee45\uee46\uee47\uee48\uee49\uee4a\uee4b\uee4c\uee4d\uee4e\uee4f\uee50\uee51\uee52\uee53\uee54\uee55\uee56\uee57\uee58\uee59\uee5a\uee5b\uee5c\uee5d\uee5e\uee5f\uee60\uee61\uee62\uee63\uee64\uee65\uee66\uee67\uee68\uee69\uee6a\uee6b\uee6c\uee6d\uee6e\uee6f\uee70\uee71\uee72\uee73\uee74\uee75\uee76\uee77\uee78\uee79\uee7a\uee7b\uee7c\uee7d\uee7e\uee7f\uee80\uee81\uee82\uee83\uee84\uee85\uee86\uee87\uee88\uee89\uee8a\uee8b\uee8c\uee8d\uee8e\uee8f\uee90\uee91\uee92\uee93\uee94\uee95\uee96\uee97\uee98\uee99\uee9a\uee9b\uee9c\uee9d\uee9e\uee9f\ueea0\ueea1\ueea2\ueea3\ueea4\ueea5\ueea6\ueea7\ueea8\ueea9\ueeaa\ueeab\ueeac\ueead\ueeae\ueeaf\ueeb0\ueeb1\ueeb2\ueeb3\ueeb4\ueeb5\ueeb6\ueeb7\ueeb8\ueeb9\ueeba\ueebb\ueebc\ueebd\ueebe\ueebf\ueec0\ueec1\ueec2\ueec3\ueec4\ueec5\ueec6\ueec7\ueec8\ueec9\ueeca\ueecb\ueecc\ueecd\ueece\ueecf\ueed0\ueed1\ueed2\ueed3\ueed4\ueed5\ueed6\ueed7\ueed8\ueed9\ueeda\ueedb\ueedc\ueedd\ueede\ueedf\ueee0\ueee1\ueee2\ueee3\ueee4\ueee5\ueee6\ueee7\ueee8\ueee9\ueeea\ueeeb\ueeec\ueeed\ueeee\ueeef\ueef0\ueef1\ueef2\ueef3\ueef4\ueef5\ueef6\ueef7\ueef8\ueef9\ueefa\ueefb\ueefc\ueefd\ueefe\ueeff\uef00\uef01\uef02\uef03\uef04\uef05\uef06\uef07\uef08\uef09\uef0a\uef0b\uef0c\uef0d\uef0e\uef0f\uef10\uef11\uef12\uef13\uef14\uef15\uef16\uef17\uef18\uef19\uef1a\uef1b\uef1c\uef1d\uef1e\uef1f\uef20\uef21\uef22\uef23\uef24\uef25\uef26\uef27\uef28\uef29\uef2a\uef2b\uef2c\uef2d\uef2e\uef2f\uef30\uef31\uef32\uef33\uef34\uef35\uef36\uef37\uef38\uef39\uef3a\uef3b\uef3c\uef3d\uef3e\uef3f\uef40\uef41\uef42\uef43\uef44\uef45\uef46\uef47\uef48\uef49\uef4a\uef4b\uef4c\uef4d\uef4e\uef4f\uef50\uef51\uef52\uef53\uef54\uef55\uef56\uef57\uef58\uef59\uef5a\uef5b\uef5c\uef5d\uef5e\uef5f\uef60\uef61\uef62\uef63\uef64\uef65\uef66\uef67\uef68\uef69\uef6a\uef6b\uef6c\uef6d\uef6e\uef6f\uef70\uef71\uef72\uef73\uef74\uef75\uef76\uef77\uef78\uef79\uef7a\uef7b\uef7c\uef7d\uef7e\uef7f\uef80\uef81\uef82\uef83\uef84\uef85\uef86\uef87\uef88\uef89\uef8a\uef8b\uef8c\uef8d\uef8e\uef8f\uef90\uef91\uef92\uef93\uef94\uef95\uef96\uef97\uef98\uef99\uef9a\uef9b\uef9c\uef9d\uef9e\uef9f\uefa0\uefa1\uefa2\uefa3\uefa4\uefa5\uefa6\uefa7\uefa8\uefa9\uefaa\uefab\uefac\uefad\uefae\uefaf\uefb0\uefb1\uefb2\uefb3\uefb4\uefb5\uefb6\uefb7\uefb8\uefb9\uefba\uefbb\uefbc\uefbd\uefbe\uefbf\uefc0\uefc1\uefc2\uefc3\uefc4\uefc5\uefc6\uefc7\uefc8\uefc9\uefca\uefcb\uefcc\uefcd\uefce\uefcf\uefd0\uefd1\uefd2\uefd3\uefd4\uefd5\uefd6\uefd7\uefd8\uefd9\uefda\uefdb\uefdc\uefdd\uefde\uefdf\uefe0\uefe1\uefe2\uefe3\uefe4\uefe5\uefe6\uefe7\uefe8\uefe9\uefea\uefeb\uefec\uefed\uefee\uefef\ueff0\ueff1\ueff2\ueff3\ueff4\ueff5\ueff6\ueff7\ueff8\ueff9\ueffa\ueffb\ueffc\ueffd\ueffe\uefff\uf000\uf001\uf002\uf003\uf004\uf005\uf006\uf007\uf008\uf009\uf00a\uf00b\uf00c\uf00d\uf00e\uf00f\uf010\uf011\uf012\uf013\uf014\uf015\uf016\uf017\uf018\uf019\uf01a\uf01b\uf01c\uf01d\uf01e\uf01f\uf020\uf021\uf022\uf023\uf024\uf025\uf026\uf027\uf028\uf029\uf02a\uf02b\uf02c\uf02d\uf02e\uf02f\uf030\uf031\uf032\uf033\uf034\uf035\uf036\uf037\uf038\uf039\uf03a\uf03b\uf03c\uf03d\uf03e\uf03f\uf040\uf041\uf042\uf043\uf044\uf045\uf046\uf047\uf048\uf049\uf04a\uf04b\uf04c\uf04d\uf04e\uf04f\uf050\uf051\uf052\uf053\uf054\uf055\uf056\uf057\uf058\uf059\uf05a\uf05b\uf05c\uf05d\uf05e\uf05f\uf060\uf061\uf062\uf063\uf064\uf065\uf066\uf067\uf068\uf069\uf06a\uf06b\uf06c\uf06d\uf06e\uf06f\uf070\uf071\uf072\uf073\uf074\uf075\uf076\uf077\uf078\uf079\uf07a\uf07b\uf07c\uf07d\uf07e\uf07f\uf080\uf081\uf082\uf083\uf084\uf085\uf086\uf087\uf088\uf089\uf08a\uf08b\uf08c\uf08d\uf08e\uf08f\uf090\uf091\uf092\uf093\uf094\uf095\uf096\uf097\uf098\uf099\uf09a\uf09b\uf09c\uf09d\uf09e\uf09f\uf0a0\uf0a1\uf0a2\uf0a3\uf0a4\uf0a5\uf0a6\uf0a7\uf0a8\uf0a9\uf0aa\uf0ab\uf0ac\uf0ad\uf0ae\uf0af\uf0b0\uf0b1\uf0b2\uf0b3\uf0b4\uf0b5\uf0b6\uf0b7\uf0b8\uf0b9\uf0ba\uf0bb\uf0bc\uf0bd\uf0be\uf0bf\uf0c0\uf0c1\uf0c2\uf0c3\uf0c4\uf0c5\uf0c6\uf0c7\uf0c8\uf0c9\uf0ca\uf0cb\uf0cc\uf0cd\uf0ce\uf0cf\uf0d0\uf0d1\uf0d2\uf0d3\uf0d4\uf0d5\uf0d6\uf0d7\uf0d8\uf0d9\uf0da\uf0db\uf0dc\uf0dd\uf0de\uf0df\uf0e0\uf0e1\uf0e2\uf0e3\uf0e4\uf0e5\uf0e6\uf0e7\uf0e8\uf0e9\uf0ea\uf0eb\uf0ec\uf0ed\uf0ee\uf0ef\uf0f0\uf0f1\uf0f2\uf0f3\uf0f4\uf0f5\uf0f6\uf0f7\uf0f8\uf0f9\uf0fa\uf0fb\uf0fc\uf0fd\uf0fe\uf0ff\uf100\uf101\uf102\uf103\uf104\uf105\uf106\uf107\uf108\uf109\uf10a\uf10b\uf10c\uf10d\uf10e\uf10f\uf110\uf111\uf112\uf113\uf114\uf115\uf116\uf117\uf118\uf119\uf11a\uf11b\uf11c\uf11d\uf11e\uf11f\uf120\uf121\uf122\uf123\uf124\uf125\uf126\uf127\uf128\uf129\uf12a\uf12b\uf12c\uf12d\uf12e\uf12f\uf130\uf131\uf132\uf133\uf134\uf135\uf136\uf137\uf138\uf139\uf13a\uf13b\uf13c\uf13d\uf13e\uf13f\uf140\uf141\uf142\uf143\uf144\uf145\uf146\uf147\uf148\uf149\uf14a\uf14b\uf14c\uf14d\uf14e\uf14f\uf150\uf151\uf152\uf153\uf154\uf155\uf156\uf157\uf158\uf159\uf15a\uf15b\uf15c\uf15d\uf15e\uf15f\uf160\uf161\uf162\uf163\uf164\uf165\uf166\uf167\uf168\uf169\uf16a\uf16b\uf16c\uf16d\uf16e\uf16f\uf170\uf171\uf172\uf173\uf174\uf175\uf176\uf177\uf178\uf179\uf17a\uf17b\uf17c\uf17d\uf17e\uf17f\uf180\uf181\uf182\uf183\uf184\uf185\uf186\uf187\uf188\uf189\uf18a\uf18b\uf18c\uf18d\uf18e\uf18f\uf190\uf191\uf192\uf193\uf194\uf195\uf196\uf197\uf198\uf199\uf19a\uf19b\uf19c\uf19d\uf19e\uf19f\uf1a0\uf1a1\uf1a2\uf1a3\uf1a4\uf1a5\uf1a6\uf1a7\uf1a8\uf1a9\uf1aa\uf1ab\uf1ac\uf1ad\uf1ae\uf1af\uf1b0\uf1b1\uf1b2\uf1b3\uf1b4\uf1b5\uf1b6\uf1b7\uf1b8\uf1b9\uf1ba\uf1bb\uf1bc\uf1bd\uf1be\uf1bf\uf1c0\uf1c1\uf1c2\uf1c3\uf1c4\uf1c5\uf1c6\uf1c7\uf1c8\uf1c9\uf1ca\uf1cb\uf1cc\uf1cd\uf1ce\uf1cf\uf1d0\uf1d1\uf1d2\uf1d3\uf1d4\uf1d5\uf1d6\uf1d7\uf1d8\uf1d9\uf1da\uf1db\uf1dc\uf1dd\uf1de\uf1df\uf1e0\uf1e1\uf1e2\uf1e3\uf1e4\uf1e5\uf1e6\uf1e7\uf1e8\uf1e9\uf1ea\uf1eb\uf1ec\uf1ed\uf1ee\uf1ef\uf1f0\uf1f1\uf1f2\uf1f3\uf1f4\uf1f5\uf1f6\uf1f7\uf1f8\uf1f9\uf1fa\uf1fb\uf1fc\uf1fd\uf1fe\uf1ff\uf200\uf201\uf202\uf203\uf204\uf205\uf206\uf207\uf208\uf209\uf20a\uf20b\uf20c\uf20d\uf20e\uf20f\uf210\uf211\uf212\uf213\uf214\uf215\uf216\uf217\uf218\uf219\uf21a\uf21b\uf21c\uf21d\uf21e\uf21f\uf220\uf221\uf222\uf223\uf224\uf225\uf226\uf227\uf228\uf229\uf22a\uf22b\uf22c\uf22d\uf22e\uf22f\uf230\uf231\uf232\uf233\uf234\uf235\uf236\uf237\uf238\uf239\uf23a\uf23b\uf23c\uf23d\uf23e\uf23f\uf240\uf241\uf242\uf243\uf244\uf245\uf246\uf247\uf248\uf249\uf24a\uf24b\uf24c\uf24d\uf24e\uf24f\uf250\uf251\uf252\uf253\uf254\uf255\uf256\uf257\uf258\uf259\uf25a\uf25b\uf25c\uf25d\uf25e\uf25f\uf260\uf261\uf262\uf263\uf264\uf265\uf266\uf267\uf268\uf269\uf26a\uf26b\uf26c\uf26d\uf26e\uf26f\uf270\uf271\uf272\uf273\uf274\uf275\uf276\uf277\uf278\uf279\uf27a\uf27b\uf27c\uf27d\uf27e\uf27f\uf280\uf281\uf282\uf283\uf284\uf285\uf286\uf287\uf288\uf289\uf28a\uf28b\uf28c\uf28d\uf28e\uf28f\uf290\uf291\uf292\uf293\uf294\uf295\uf296\uf297\uf298\uf299\uf29a\uf29b\uf29c\uf29d\uf29e\uf29f\uf2a0\uf2a1\uf2a2\uf2a3\uf2a4\uf2a5\uf2a6\uf2a7\uf2a8\uf2a9\uf2aa\uf2ab\uf2ac\uf2ad\uf2ae\uf2af\uf2b0\uf2b1\uf2b2\uf2b3\uf2b4\uf2b5\uf2b6\uf2b7\uf2b8\uf2b9\uf2ba\uf2bb\uf2bc\uf2bd\uf2be\uf2bf\uf2c0\uf2c1\uf2c2\uf2c3\uf2c4\uf2c5\uf2c6\uf2c7\uf2c8\uf2c9\uf2ca\uf2cb\uf2cc\uf2cd\uf2ce\uf2cf\uf2d0\uf2d1\uf2d2\uf2d3\uf2d4\uf2d5\uf2d6\uf2d7\uf2d8\uf2d9\uf2da\uf2db\uf2dc\uf2dd\uf2de\uf2df\uf2e0\uf2e1\uf2e2\uf2e3\uf2e4\uf2e5\uf2e6\uf2e7\uf2e8\uf2e9\uf2ea\uf2eb\uf2ec\uf2ed\uf2ee\uf2ef\uf2f0\uf2f1\uf2f2\uf2f3\uf2f4\uf2f5\uf2f6\uf2f7\uf2f8\uf2f9\uf2fa\uf2fb\uf2fc\uf2fd\uf2fe\uf2ff\uf300\uf301\uf302\uf303\uf304\uf305\uf306\uf307\uf308\uf309\uf30a\uf30b\uf30c\uf30d\uf30e\uf30f\uf310\uf311\uf312\uf313\uf314\uf315\uf316\uf317\uf318\uf319\uf31a\uf31b\uf31c\uf31d\uf31e\uf31f\uf320\uf321\uf322\uf323\uf324\uf325\uf326\uf327\uf328\uf329\uf32a\uf32b\uf32c\uf32d\uf32e\uf32f\uf330\uf331\uf332\uf333\uf334\uf335\uf336\uf337\uf338\uf339\uf33a\uf33b\uf33c\uf33d\uf33e\uf33f\uf340\uf341\uf342\uf343\uf344\uf345\uf346\uf347\uf348\uf349\uf34a\uf34b\uf34c\uf34d\uf34e\uf34f\uf350\uf351\uf352\uf353\uf354\uf355\uf356\uf357\uf358\uf359\uf35a\uf35b\uf35c\uf35d\uf35e\uf35f\uf360\uf361\uf362\uf363\uf364\uf365\uf366\uf367\uf368\uf369\uf36a\uf36b\uf36c\uf36d\uf36e\uf36f\uf370\uf371\uf372\uf373\uf374\uf375\uf376\uf377\uf378\uf379\uf37a\uf37b\uf37c\uf37d\uf37e\uf37f\uf380\uf381\uf382\uf383\uf384\uf385\uf386\uf387\uf388\uf389\uf38a\uf38b\uf38c\uf38d\uf38e\uf38f\uf390\uf391\uf392\uf393\uf394\uf395\uf396\uf397\uf398\uf399\uf39a\uf39b\uf39c\uf39d\uf39e\uf39f\uf3a0\uf3a1\uf3a2\uf3a3\uf3a4\uf3a5\uf3a6\uf3a7\uf3a8\uf3a9\uf3aa\uf3ab\uf3ac\uf3ad\uf3ae\uf3af\uf3b0\uf3b1\uf3b2\uf3b3\uf3b4\uf3b5\uf3b6\uf3b7\uf3b8\uf3b9\uf3ba\uf3bb\uf3bc\uf3bd\uf3be\uf3bf\uf3c0\uf3c1\uf3c2\uf3c3\uf3c4\uf3c5\uf3c6\uf3c7\uf3c8\uf3c9\uf3ca\uf3cb\uf3cc\uf3cd\uf3ce\uf3cf\uf3d0\uf3d1\uf3d2\uf3d3\uf3d4\uf3d5\uf3d6\uf3d7\uf3d8\uf3d9\uf3da\uf3db\uf3dc\uf3dd\uf3de\uf3df\uf3e0\uf3e1\uf3e2\uf3e3\uf3e4\uf3e5\uf3e6\uf3e7\uf3e8\uf3e9\uf3ea\uf3eb\uf3ec\uf3ed\uf3ee\uf3ef\uf3f0\uf3f1\uf3f2\uf3f3\uf3f4\uf3f5\uf3f6\uf3f7\uf3f8\uf3f9\uf3fa\uf3fb\uf3fc\uf3fd\uf3fe\uf3ff\uf400\uf401\uf402\uf403\uf404\uf405\uf406\uf407\uf408\uf409\uf40a\uf40b\uf40c\uf40d\uf40e\uf40f\uf410\uf411\uf412\uf413\uf414\uf415\uf416\uf417\uf418\uf419\uf41a\uf41b\uf41c\uf41d\uf41e\uf41f\uf420\uf421\uf422\uf423\uf424\uf425\uf426\uf427\uf428\uf429\uf42a\uf42b\uf42c\uf42d\uf42e\uf42f\uf430\uf431\uf432\uf433\uf434\uf435\uf436\uf437\uf438\uf439\uf43a\uf43b\uf43c\uf43d\uf43e\uf43f\uf440\uf441\uf442\uf443\uf444\uf445\uf446\uf447\uf448\uf449\uf44a\uf44b\uf44c\uf44d\uf44e\uf44f\uf450\uf451\uf452\uf453\uf454\uf455\uf456\uf457\uf458\uf459\uf45a\uf45b\uf45c\uf45d\uf45e\uf45f\uf460\uf461\uf462\uf463\uf464\uf465\uf466\uf467\uf468\uf469\uf46a\uf46b\uf46c\uf46d\uf46e\uf46f\uf470\uf471\uf472\uf473\uf474\uf475\uf476\uf477\uf478\uf479\uf47a\uf47b\uf47c\uf47d\uf47e\uf47f\uf480\uf481\uf482\uf483\uf484\uf485\uf486\uf487\uf488\uf489\uf48a\uf48b\uf48c\uf48d\uf48e\uf48f\uf490\uf491\uf492\uf493\uf494\uf495\uf496\uf497\uf498\uf499\uf49a\uf49b\uf49c\uf49d\uf49e\uf49f\uf4a0\uf4a1\uf4a2\uf4a3\uf4a4\uf4a5\uf4a6\uf4a7\uf4a8\uf4a9\uf4aa\uf4ab\uf4ac\uf4ad\uf4ae\uf4af\uf4b0\uf4b1\uf4b2\uf4b3\uf4b4\uf4b5\uf4b6\uf4b7\uf4b8\uf4b9\uf4ba\uf4bb\uf4bc\uf4bd\uf4be\uf4bf\uf4c0\uf4c1\uf4c2\uf4c3\uf4c4\uf4c5\uf4c6\uf4c7\uf4c8\uf4c9\uf4ca\uf4cb\uf4cc\uf4cd\uf4ce\uf4cf\uf4d0\uf4d1\uf4d2\uf4d3\uf4d4\uf4d5\uf4d6\uf4d7\uf4d8\uf4d9\uf4da\uf4db\uf4dc\uf4dd\uf4de\uf4df\uf4e0\uf4e1\uf4e2\uf4e3\uf4e4\uf4e5\uf4e6\uf4e7\uf4e8\uf4e9\uf4ea\uf4eb\uf4ec\uf4ed\uf4ee\uf4ef\uf4f0\uf4f1\uf4f2\uf4f3\uf4f4\uf4f5\uf4f6\uf4f7\uf4f8\uf4f9\uf4fa\uf4fb\uf4fc\uf4fd\uf4fe\uf4ff\uf500\uf501\uf502\uf503\uf504\uf505\uf506\uf507\uf508\uf509\uf50a\uf50b\uf50c\uf50d\uf50e\uf50f\uf510\uf511\uf512\uf513\uf514\uf515\uf516\uf517\uf518\uf519\uf51a\uf51b\uf51c\uf51d\uf51e\uf51f\uf520\uf521\uf522\uf523\uf524\uf525\uf526\uf527\uf528\uf529\uf52a\uf52b\uf52c\uf52d\uf52e\uf52f\uf530\uf531\uf532\uf533\uf534\uf535\uf536\uf537\uf538\uf539\uf53a\uf53b\uf53c\uf53d\uf53e\uf53f\uf540\uf541\uf542\uf543\uf544\uf545\uf546\uf547\uf548\uf549\uf54a\uf54b\uf54c\uf54d\uf54e\uf54f\uf550\uf551\uf552\uf553\uf554\uf555\uf556\uf557\uf558\uf559\uf55a\uf55b\uf55c\uf55d\uf55e\uf55f\uf560\uf561\uf562\uf563\uf564\uf565\uf566\uf567\uf568\uf569\uf56a\uf56b\uf56c\uf56d\uf56e\uf56f\uf570\uf571\uf572\uf573\uf574\uf575\uf576\uf577\uf578\uf579\uf57a\uf57b\uf57c\uf57d\uf57e\uf57f\uf580\uf581\uf582\uf583\uf584\uf585\uf586\uf587\uf588\uf589\uf58a\uf58b\uf58c\uf58d\uf58e\uf58f\uf590\uf591\uf592\uf593\uf594\uf595\uf596\uf597\uf598\uf599\uf59a\uf59b\uf59c\uf59d\uf59e\uf59f\uf5a0\uf5a1\uf5a2\uf5a3\uf5a4\uf5a5\uf5a6\uf5a7\uf5a8\uf5a9\uf5aa\uf5ab\uf5ac\uf5ad\uf5ae\uf5af\uf5b0\uf5b1\uf5b2\uf5b3\uf5b4\uf5b5\uf5b6\uf5b7\uf5b8\uf5b9\uf5ba\uf5bb\uf5bc\uf5bd\uf5be\uf5bf\uf5c0\uf5c1\uf5c2\uf5c3\uf5c4\uf5c5\uf5c6\uf5c7\uf5c8\uf5c9\uf5ca\uf5cb\uf5cc\uf5cd\uf5ce\uf5cf\uf5d0\uf5d1\uf5d2\uf5d3\uf5d4\uf5d5\uf5d6\uf5d7\uf5d8\uf5d9\uf5da\uf5db\uf5dc\uf5dd\uf5de\uf5df\uf5e0\uf5e1\uf5e2\uf5e3\uf5e4\uf5e5\uf5e6\uf5e7\uf5e8\uf5e9\uf5ea\uf5eb\uf5ec\uf5ed\uf5ee\uf5ef\uf5f0\uf5f1\uf5f2\uf5f3\uf5f4\uf5f5\uf5f6\uf5f7\uf5f8\uf5f9\uf5fa\uf5fb\uf5fc\uf5fd\uf5fe\uf5ff\uf600\uf601\uf602\uf603\uf604\uf605\uf606\uf607\uf608\uf609\uf60a\uf60b\uf60c\uf60d\uf60e\uf60f\uf610\uf611\uf612\uf613\uf614\uf615\uf616\uf617\uf618\uf619\uf61a\uf61b\uf61c\uf61d\uf61e\uf61f\uf620\uf621\uf622\uf623\uf624\uf625\uf626\uf627\uf628\uf629\uf62a\uf62b\uf62c\uf62d\uf62e\uf62f\uf630\uf631\uf632\uf633\uf634\uf635\uf636\uf637\uf638\uf639\uf63a\uf63b\uf63c\uf63d\uf63e\uf63f\uf640\uf641\uf642\uf643\uf644\uf645\uf646\uf647\uf648\uf649\uf64a\uf64b\uf64c\uf64d\uf64e\uf64f\uf650\uf651\uf652\uf653\uf654\uf655\uf656\uf657\uf658\uf659\uf65a\uf65b\uf65c\uf65d\uf65e\uf65f\uf660\uf661\uf662\uf663\uf664\uf665\uf666\uf667\uf668\uf669\uf66a\uf66b\uf66c\uf66d\uf66e\uf66f\uf670\uf671\uf672\uf673\uf674\uf675\uf676\uf677\uf678\uf679\uf67a\uf67b\uf67c\uf67d\uf67e\uf67f\uf680\uf681\uf682\uf683\uf684\uf685\uf686\uf687\uf688\uf689\uf68a\uf68b\uf68c\uf68d\uf68e\uf68f\uf690\uf691\uf692\uf693\uf694\uf695\uf696\uf697\uf698\uf699\uf69a\uf69b\uf69c\uf69d\uf69e\uf69f\uf6a0\uf6a1\uf6a2\uf6a3\uf6a4\uf6a5\uf6a6\uf6a7\uf6a8\uf6a9\uf6aa\uf6ab\uf6ac\uf6ad\uf6ae\uf6af\uf6b0\uf6b1\uf6b2\uf6b3\uf6b4\uf6b5\uf6b6\uf6b7\uf6b8\uf6b9\uf6ba\uf6bb\uf6bc\uf6bd\uf6be\uf6bf\uf6c0\uf6c1\uf6c2\uf6c3\uf6c4\uf6c5\uf6c6\uf6c7\uf6c8\uf6c9\uf6ca\uf6cb\uf6cc\uf6cd\uf6ce\uf6cf\uf6d0\uf6d1\uf6d2\uf6d3\uf6d4\uf6d5\uf6d6\uf6d7\uf6d8\uf6d9\uf6da\uf6db\uf6dc\uf6dd\uf6de\uf6df\uf6e0\uf6e1\uf6e2\uf6e3\uf6e4\uf6e5\uf6e6\uf6e7\uf6e8\uf6e9\uf6ea\uf6eb\uf6ec\uf6ed\uf6ee\uf6ef\uf6f0\uf6f1\uf6f2\uf6f3\uf6f4\uf6f5\uf6f6\uf6f7\uf6f8\uf6f9\uf6fa\uf6fb\uf6fc\uf6fd\uf6fe\uf6ff\uf700\uf701\uf702\uf703\uf704\uf705\uf706\uf707\uf708\uf709\uf70a\uf70b\uf70c\uf70d\uf70e\uf70f\uf710\uf711\uf712\uf713\uf714\uf715\uf716\uf717\uf718\uf719\uf71a\uf71b\uf71c\uf71d\uf71e\uf71f\uf720\uf721\uf722\uf723\uf724\uf725\uf726\uf727\uf728\uf729\uf72a\uf72b\uf72c\uf72d\uf72e\uf72f\uf730\uf731\uf732\uf733\uf734\uf735\uf736\uf737\uf738\uf739\uf73a\uf73b\uf73c\uf73d\uf73e\uf73f\uf740\uf741\uf742\uf743\uf744\uf745\uf746\uf747\uf748\uf749\uf74a\uf74b\uf74c\uf74d\uf74e\uf74f\uf750\uf751\uf752\uf753\uf754\uf755\uf756\uf757\uf758\uf759\uf75a\uf75b\uf75c\uf75d\uf75e\uf75f\uf760\uf761\uf762\uf763\uf764\uf765\uf766\uf767\uf768\uf769\uf76a\uf76b\uf76c\uf76d\uf76e\uf76f\uf770\uf771\uf772\uf773\uf774\uf775\uf776\uf777\uf778\uf779\uf77a\uf77b\uf77c\uf77d\uf77e\uf77f\uf780\uf781\uf782\uf783\uf784\uf785\uf786\uf787\uf788\uf789\uf78a\uf78b\uf78c\uf78d\uf78e\uf78f\uf790\uf791\uf792\uf793\uf794\uf795\uf796\uf797\uf798\uf799\uf79a\uf79b\uf79c\uf79d\uf79e\uf79f\uf7a0\uf7a1\uf7a2\uf7a3\uf7a4\uf7a5\uf7a6\uf7a7\uf7a8\uf7a9\uf7aa\uf7ab\uf7ac\uf7ad\uf7ae\uf7af\uf7b0\uf7b1\uf7b2\uf7b3\uf7b4\uf7b5\uf7b6\uf7b7\uf7b8\uf7b9\uf7ba\uf7bb\uf7bc\uf7bd\uf7be\uf7bf\uf7c0\uf7c1\uf7c2\uf7c3\uf7c4\uf7c5\uf7c6\uf7c7\uf7c8\uf7c9\uf7ca\uf7cb\uf7cc\uf7cd\uf7ce\uf7cf\uf7d0\uf7d1\uf7d2\uf7d3\uf7d4\uf7d5\uf7d6\uf7d7\uf7d8\uf7d9\uf7da\uf7db\uf7dc\uf7dd\uf7de\uf7df\uf7e0\uf7e1\uf7e2\uf7e3\uf7e4\uf7e5\uf7e6\uf7e7\uf7e8\uf7e9\uf7ea\uf7eb\uf7ec\uf7ed\uf7ee\uf7ef\uf7f0\uf7f1\uf7f2\uf7f3\uf7f4\uf7f5\uf7f6\uf7f7\uf7f8\uf7f9\uf7fa\uf7fb\uf7fc\uf7fd\uf7fe\uf7ff\uf800\uf801\uf802\uf803\uf804\uf805\uf806\uf807\uf808\uf809\uf80a\uf80b\uf80c\uf80d\uf80e\uf80f\uf810\uf811\uf812\uf813\uf814\uf815\uf816\uf817\uf818\uf819\uf81a\uf81b\uf81c\uf81d\uf81e\uf81f\uf820\uf821\uf822\uf823\uf824\uf825\uf826\uf827\uf828\uf829\uf82a\uf82b\uf82c\uf82d\uf82e\uf82f\uf830\uf831\uf832\uf833\uf834\uf835\uf836\uf837\uf838\uf839\uf83a\uf83b\uf83c\uf83d\uf83e\uf83f\uf840\uf841\uf842\uf843\uf844\uf845\uf846\uf847\uf848\uf849\uf84a\uf84b\uf84c\uf84d\uf84e\uf84f\uf850\uf851\uf852\uf853\uf854\uf855\uf856\uf857\uf858\uf859\uf85a\uf85b\uf85c\uf85d\uf85e\uf85f\uf860\uf861\uf862\uf863\uf864\uf865\uf866\uf867\uf868\uf869\uf86a\uf86b\uf86c\uf86d\uf86e\uf86f\uf870\uf871\uf872\uf873\uf874\uf875\uf876\uf877\uf878\uf879\uf87a\uf87b\uf87c\uf87d\uf87e\uf87f\uf880\uf881\uf882\uf883\uf884\uf885\uf886\uf887\uf888\uf889\uf88a\uf88b\uf88c\uf88d\uf88e\uf88f\uf890\uf891\uf892\uf893\uf894\uf895\uf896\uf897\uf898\uf899\uf89a\uf89b\uf89c\uf89d\uf89e\uf89f\uf8a0\uf8a1\uf8a2\uf8a3\uf8a4\uf8a5\uf8a6\uf8a7\uf8a8\uf8a9\uf8aa\uf8ab\uf8ac\uf8ad\uf8ae\uf8af\uf8b0\uf8b1\uf8b2\uf8b3\uf8b4\uf8b5\uf8b6\uf8b7\uf8b8\uf8b9\uf8ba\uf8bb\uf8bc\uf8bd\uf8be\uf8bf\uf8c0\uf8c1\uf8c2\uf8c3\uf8c4\uf8c5\uf8c6\uf8c7\uf8c8\uf8c9\uf8ca\uf8cb\uf8cc\uf8cd\uf8ce\uf8cf\uf8d0\uf8d1\uf8d2\uf8d3\uf8d4\uf8d5\uf8d6\uf8d7\uf8d8\uf8d9\uf8da\uf8db\uf8dc\uf8dd\uf8de\uf8df\uf8e0\uf8e1\uf8e2\uf8e3\uf8e4\uf8e5\uf8e6\uf8e7\uf8e8\uf8e9\uf8ea\uf8eb\uf8ec\uf8ed\uf8ee\uf8ef\uf8f0\uf8f1\uf8f2\uf8f3\uf8f4\uf8f5\uf8f6\uf8f7\uf8f8\uf8f9\uf8fa\uf8fb\uf8fc\uf8fd\uf8fe\uf8ff'
-
-try:
-    Cs = eval(r"'\ud800\ud801\ud802\ud803\ud804\ud805\ud806\ud807\ud808\ud809\ud80a\ud80b\ud80c\ud80d\ud80e\ud80f\ud810\ud811\ud812\ud813\ud814\ud815\ud816\ud817\ud818\ud819\ud81a\ud81b\ud81c\ud81d\ud81e\ud81f\ud820\ud821\ud822\ud823\ud824\ud825\ud826\ud827\ud828\ud829\ud82a\ud82b\ud82c\ud82d\ud82e\ud82f\ud830\ud831\ud832\ud833\ud834\ud835\ud836\ud837\ud838\ud839\ud83a\ud83b\ud83c\ud83d\ud83e\ud83f\ud840\ud841\ud842\ud843\ud844\ud845\ud846\ud847\ud848\ud849\ud84a\ud84b\ud84c\ud84d\ud84e\ud84f\ud850\ud851\ud852\ud853\ud854\ud855\ud856\ud857\ud858\ud859\ud85a\ud85b\ud85c\ud85d\ud85e\ud85f\ud860\ud861\ud862\ud863\ud864\ud865\ud866\ud867\ud868\ud869\ud86a\ud86b\ud86c\ud86d\ud86e\ud86f\ud870\ud871\ud872\ud873\ud874\ud875\ud876\ud877\ud878\ud879\ud87a\ud87b\ud87c\ud87d\ud87e\ud87f\ud880\ud881\ud882\ud883\ud884\ud885\ud886\ud887\ud888\ud889\ud88a\ud88b\ud88c\ud88d\ud88e\ud88f\ud890\ud891\ud892\ud893\ud894\ud895\ud896\ud897\ud898\ud899\ud89a\ud89b\ud89c\ud89d\ud89e\ud89f\ud8a0\ud8a1\ud8a2\ud8a3\ud8a4\ud8a5\ud8a6\ud8a7\ud8a8\ud8a9\ud8aa\ud8ab\ud8ac\ud8ad\ud8ae\ud8af\ud8b0\ud8b1\ud8b2\ud8b3\ud8b4\ud8b5\ud8b6\ud8b7\ud8b8\ud8b9\ud8ba\ud8bb\ud8bc\ud8bd\ud8be\ud8bf\ud8c0\ud8c1\ud8c2\ud8c3\ud8c4\ud8c5\ud8c6\ud8c7\ud8c8\ud8c9\ud8ca\ud8cb\ud8cc\ud8cd\ud8ce\ud8cf\ud8d0\ud8d1\ud8d2\ud8d3\ud8d4\ud8d5\ud8d6\ud8d7\ud8d8\ud8d9\ud8da\ud8db\ud8dc\ud8dd\ud8de\ud8df\ud8e0\ud8e1\ud8e2\ud8e3\ud8e4\ud8e5\ud8e6\ud8e7\ud8e8\ud8e9\ud8ea\ud8eb\ud8ec\ud8ed\ud8ee\ud8ef\ud8f0\ud8f1\ud8f2\ud8f3\ud8f4\ud8f5\ud8f6\ud8f7\ud8f8\ud8f9\ud8fa\ud8fb\ud8fc\ud8fd\ud8fe\ud8ff\ud900\ud901\ud902\ud903\ud904\ud905\ud906\ud907\ud908\ud909\ud90a\ud90b\ud90c\ud90d\ud90e\ud90f\ud910\ud911\ud912\ud913\ud914\ud915\ud916\ud917\ud918\ud919\ud91a\ud91b\ud91c\ud91d\ud91e\ud91f\ud920\ud921\ud922\ud923\ud924\ud925\ud926\ud927\ud928\ud929\ud92a\ud92b\ud92c\ud92d\ud92e\ud92f\ud930\ud931\ud932\ud933\ud934\ud935\ud936\ud937\ud938\ud939\ud93a\ud93b\ud93c\ud93d\ud93e\ud93f\ud940\ud941\ud942\ud943\ud944\ud945\ud946\ud947\ud948\ud949\ud94a\ud94b\ud94c\ud94d\ud94e\ud94f\ud950\ud951\ud952\ud953\ud954\ud955\ud956\ud957\ud958\ud959\ud95a\ud95b\ud95c\ud95d\ud95e\ud95f\ud960\ud961\ud962\ud963\ud964\ud965\ud966\ud967\ud968\ud969\ud96a\ud96b\ud96c\ud96d\ud96e\ud96f\ud970\ud971\ud972\ud973\ud974\ud975\ud976\ud977\ud978\ud979\ud97a\ud97b\ud97c\ud97d\ud97e\ud97f\ud980\ud981\ud982\ud983\ud984\ud985\ud986\ud987\ud988\ud989\ud98a\ud98b\ud98c\ud98d\ud98e\ud98f\ud990\ud991\ud992\ud993\ud994\ud995\ud996\ud997\ud998\ud999\ud99a\ud99b\ud99c\ud99d\ud99e\ud99f\ud9a0\ud9a1\ud9a2\ud9a3\ud9a4\ud9a5\ud9a6\ud9a7\ud9a8\ud9a9\ud9aa\ud9ab\ud9ac\ud9ad\ud9ae\ud9af\ud9b0\ud9b1\ud9b2\ud9b3\ud9b4\ud9b5\ud9b6\ud9b7\ud9b8\ud9b9\ud9ba\ud9bb\ud9bc\ud9bd\ud9be\ud9bf\ud9c0\ud9c1\ud9c2\ud9c3\ud9c4\ud9c5\ud9c6\ud9c7\ud9c8\ud9c9\ud9ca\ud9cb\ud9cc\ud9cd\ud9ce\ud9cf\ud9d0\ud9d1\ud9d2\ud9d3\ud9d4\ud9d5\ud9d6\ud9d7\ud9d8\ud9d9\ud9da\ud9db\ud9dc\ud9dd\ud9de\ud9df\ud9e0\ud9e1\ud9e2\ud9e3\ud9e4\ud9e5\ud9e6\ud9e7\ud9e8\ud9e9\ud9ea\ud9eb\ud9ec\ud9ed\ud9ee\ud9ef\ud9f0\ud9f1\ud9f2\ud9f3\ud9f4\ud9f5\ud9f6\ud9f7\ud9f8\ud9f9\ud9fa\ud9fb\ud9fc\ud9fd\ud9fe\ud9ff\uda00\uda01\uda02\uda03\uda04\uda05\uda06\uda07\uda08\uda09\uda0a\uda0b\uda0c\uda0d\uda0e\uda0f\uda10\uda11\uda12\uda13\uda14\uda15\uda16\uda17\uda18\uda19\uda1a\uda1b\uda1c\uda1d\uda1e\uda1f\uda20\uda21\uda22\uda23\uda24\uda25\uda26\uda27\uda28\uda29\uda2a\uda2b\uda2c\uda2d\uda2e\uda2f\uda30\uda31\uda32\uda33\uda34\uda35\uda36\uda37\uda38\uda39\uda3a\uda3b\uda3c\uda3d\uda3e\uda3f\uda40\uda41\uda42\uda43\uda44\uda45\uda46\uda47\uda48\uda49\uda4a\uda4b\uda4c\uda4d\uda4e\uda4f\uda50\uda51\uda52\uda53\uda54\uda55\uda56\uda57\uda58\uda59\uda5a\uda5b\uda5c\uda5d\uda5e\uda5f\uda60\uda61\uda62\uda63\uda64\uda65\uda66\uda67\uda68\uda69\uda6a\uda6b\uda6c\uda6d\uda6e\uda6f\uda70\uda71\uda72\uda73\uda74\uda75\uda76\uda77\uda78\uda79\uda7a\uda7b\uda7c\uda7d\uda7e\uda7f\uda80\uda81\uda82\uda83\uda84\uda85\uda86\uda87\uda88\uda89\uda8a\uda8b\uda8c\uda8d\uda8e\uda8f\uda90\uda91\uda92\uda93\uda94\uda95\uda96\uda97\uda98\uda99\uda9a\uda9b\uda9c\uda9d\uda9e\uda9f\udaa0\udaa1\udaa2\udaa3\udaa4\udaa5\udaa6\udaa7\udaa8\udaa9\udaaa\udaab\udaac\udaad\udaae\udaaf\udab0\udab1\udab2\udab3\udab4\udab5\udab6\udab7\udab8\udab9\udaba\udabb\udabc\udabd\udabe\udabf\udac0\udac1\udac2\udac3\udac4\udac5\udac6\udac7\udac8\udac9\udaca\udacb\udacc\udacd\udace\udacf\udad0\udad1\udad2\udad3\udad4\udad5\udad6\udad7\udad8\udad9\udada\udadb\udadc\udadd\udade\udadf\udae0\udae1\udae2\udae3\udae4\udae5\udae6\udae7\udae8\udae9\udaea\udaeb\udaec\udaed\udaee\udaef\udaf0\udaf1\udaf2\udaf3\udaf4\udaf5\udaf6\udaf7\udaf8\udaf9\udafa\udafb\udafc\udafd\udafe\udaff\udb00\udb01\udb02\udb03\udb04\udb05\udb06\udb07\udb08\udb09\udb0a\udb0b\udb0c\udb0d\udb0e\udb0f\udb10\udb11\udb12\udb13\udb14\udb15\udb16\udb17\udb18\udb19\udb1a\udb1b\udb1c\udb1d\udb1e\udb1f\udb20\udb21\udb22\udb23\udb24\udb25\udb26\udb27\udb28\udb29\udb2a\udb2b\udb2c\udb2d\udb2e\udb2f\udb30\udb31\udb32\udb33\udb34\udb35\udb36\udb37\udb38\udb39\udb3a\udb3b\udb3c\udb3d\udb3e\udb3f\udb40\udb41\udb42\udb43\udb44\udb45\udb46\udb47\udb48\udb49\udb4a\udb4b\udb4c\udb4d\udb4e\udb4f\udb50\udb51\udb52\udb53\udb54\udb55\udb56\udb57\udb58\udb59\udb5a\udb5b\udb5c\udb5d\udb5e\udb5f\udb60\udb61\udb62\udb63\udb64\udb65\udb66\udb67\udb68\udb69\udb6a\udb6b\udb6c\udb6d\udb6e\udb6f\udb70\udb71\udb72\udb73\udb74\udb75\udb76\udb77\udb78\udb79\udb7a\udb7b\udb7c\udb7d\udb7e\udb7f\udb80\udb81\udb82\udb83\udb84\udb85\udb86\udb87\udb88\udb89\udb8a\udb8b\udb8c\udb8d\udb8e\udb8f\udb90\udb91\udb92\udb93\udb94\udb95\udb96\udb97\udb98\udb99\udb9a\udb9b\udb9c\udb9d\udb9e\udb9f\udba0\udba1\udba2\udba3\udba4\udba5\udba6\udba7\udba8\udba9\udbaa\udbab\udbac\udbad\udbae\udbaf\udbb0\udbb1\udbb2\udbb3\udbb4\udbb5\udbb6\udbb7\udbb8\udbb9\udbba\udbbb\udbbc\udbbd\udbbe\udbbf\udbc0\udbc1\udbc2\udbc3\udbc4\udbc5\udbc6\udbc7\udbc8\udbc9\udbca\udbcb\udbcc\udbcd\udbce\udbcf\udbd0\udbd1\udbd2\udbd3\udbd4\udbd5\udbd6\udbd7\udbd8\udbd9\udbda\udbdb\udbdc\udbdd\udbde\udbdf\udbe0\udbe1\udbe2\udbe3\udbe4\udbe5\udbe6\udbe7\udbe8\udbe9\udbea\udbeb\udbec\udbed\udbee\udbef\udbf0\udbf1\udbf2\udbf3\udbf4\udbf5\udbf6\udbf7\udbf8\udbf9\udbfa\udbfb\udbfc\udbfd\udbfe\U0010fc00\udc01\udc02\udc03\udc04\udc05\udc06\udc07\udc08\udc09\udc0a\udc0b\udc0c\udc0d\udc0e\udc0f\udc10\udc11\udc12\udc13\udc14\udc15\udc16\udc17\udc18\udc19\udc1a\udc1b\udc1c\udc1d\udc1e\udc1f\udc20\udc21\udc22\udc23\udc24\udc25\udc26\udc27\udc28\udc29\udc2a\udc2b\udc2c\udc2d\udc2e\udc2f\udc30\udc31\udc32\udc33\udc34\udc35\udc36\udc37\udc38\udc39\udc3a\udc3b\udc3c\udc3d\udc3e\udc3f\udc40\udc41\udc42\udc43\udc44\udc45\udc46\udc47\udc48\udc49\udc4a\udc4b\udc4c\udc4d\udc4e\udc4f\udc50\udc51\udc52\udc53\udc54\udc55\udc56\udc57\udc58\udc59\udc5a\udc5b\udc5c\udc5d\udc5e\udc5f\udc60\udc61\udc62\udc63\udc64\udc65\udc66\udc67\udc68\udc69\udc6a\udc6b\udc6c\udc6d\udc6e\udc6f\udc70\udc71\udc72\udc73\udc74\udc75\udc76\udc77\udc78\udc79\udc7a\udc7b\udc7c\udc7d\udc7e\udc7f\udc80\udc81\udc82\udc83\udc84\udc85\udc86\udc87\udc88\udc89\udc8a\udc8b\udc8c\udc8d\udc8e\udc8f\udc90\udc91\udc92\udc93\udc94\udc95\udc96\udc97\udc98\udc99\udc9a\udc9b\udc9c\udc9d\udc9e\udc9f\udca0\udca1\udca2\udca3\udca4\udca5\udca6\udca7\udca8\udca9\udcaa\udcab\udcac\udcad\udcae\udcaf\udcb0\udcb1\udcb2\udcb3\udcb4\udcb5\udcb6\udcb7\udcb8\udcb9\udcba\udcbb\udcbc\udcbd\udcbe\udcbf\udcc0\udcc1\udcc2\udcc3\udcc4\udcc5\udcc6\udcc7\udcc8\udcc9\udcca\udccb\udccc\udccd\udcce\udccf\udcd0\udcd1\udcd2\udcd3\udcd4\udcd5\udcd6\udcd7\udcd8\udcd9\udcda\udcdb\udcdc\udcdd\udcde\udcdf\udce0\udce1\udce2\udce3\udce4\udce5\udce6\udce7\udce8\udce9\udcea\udceb\udcec\udced\udcee\udcef\udcf0\udcf1\udcf2\udcf3\udcf4\udcf5\udcf6\udcf7\udcf8\udcf9\udcfa\udcfb\udcfc\udcfd\udcfe\udcff\udd00\udd01\udd02\udd03\udd04\udd05\udd06\udd07\udd08\udd09\udd0a\udd0b\udd0c\udd0d\udd0e\udd0f\udd10\udd11\udd12\udd13\udd14\udd15\udd16\udd17\udd18\udd19\udd1a\udd1b\udd1c\udd1d\udd1e\udd1f\udd20\udd21\udd22\udd23\udd24\udd25\udd26\udd27\udd28\udd29\udd2a\udd2b\udd2c\udd2d\udd2e\udd2f\udd30\udd31\udd32\udd33\udd34\udd35\udd36\udd37\udd38\udd39\udd3a\udd3b\udd3c\udd3d\udd3e\udd3f\udd40\udd41\udd42\udd43\udd44\udd45\udd46\udd47\udd48\udd49\udd4a\udd4b\udd4c\udd4d\udd4e\udd4f\udd50\udd51\udd52\udd53\udd54\udd55\udd56\udd57\udd58\udd59\udd5a\udd5b\udd5c\udd5d\udd5e\udd5f\udd60\udd61\udd62\udd63\udd64\udd65\udd66\udd67\udd68\udd69\udd6a\udd6b\udd6c\udd6d\udd6e\udd6f\udd70\udd71\udd72\udd73\udd74\udd75\udd76\udd77\udd78\udd79\udd7a\udd7b\udd7c\udd7d\udd7e\udd7f\udd80\udd81\udd82\udd83\udd84\udd85\udd86\udd87\udd88\udd89\udd8a\udd8b\udd8c\udd8d\udd8e\udd8f\udd90\udd91\udd92\udd93\udd94\udd95\udd96\udd97\udd98\udd99\udd9a\udd9b\udd9c\udd9d\udd9e\udd9f\udda0\udda1\udda2\udda3\udda4\udda5\udda6\udda7\udda8\udda9\uddaa\uddab\uddac\uddad\uddae\uddaf\uddb0\uddb1\uddb2\uddb3\uddb4\uddb5\uddb6\uddb7\uddb8\uddb9\uddba\uddbb\uddbc\uddbd\uddbe\uddbf\uddc0\uddc1\uddc2\uddc3\uddc4\uddc5\uddc6\uddc7\uddc8\uddc9\uddca\uddcb\uddcc\uddcd\uddce\uddcf\uddd0\uddd1\uddd2\uddd3\uddd4\uddd5\uddd6\uddd7\uddd8\uddd9\uddda\udddb\udddc\udddd\uddde\udddf\udde0\udde1\udde2\udde3\udde4\udde5\udde6\udde7\udde8\udde9\uddea\uddeb\uddec\udded\uddee\uddef\uddf0\uddf1\uddf2\uddf3\uddf4\uddf5\uddf6\uddf7\uddf8\uddf9\uddfa\uddfb\uddfc\uddfd\uddfe\uddff\ude00\ude01\ude02\ude03\ude04\ude05\ude06\ude07\ude08\ude09\ude0a\ude0b\ude0c\ude0d\ude0e\ude0f\ude10\ude11\ude12\ude13\ude14\ude15\ude16\ude17\ude18\ude19\ude1a\ude1b\ude1c\ude1d\ude1e\ude1f\ude20\ude21\ude22\ude23\ude24\ude25\ude26\ude27\ude28\ude29\ude2a\ude2b\ude2c\ude2d\ude2e\ude2f\ude30\ude31\ude32\ude33\ude34\ude35\ude36\ude37\ude38\ude39\ude3a\ude3b\ude3c\ude3d\ude3e\ude3f\ude40\ude41\ude42\ude43\ude44\ude45\ude46\ude47\ude48\ude49\ude4a\ude4b\ude4c\ude4d\ude4e\ude4f\ude50\ude51\ude52\ude53\ude54\ude55\ude56\ude57\ude58\ude59\ude5a\ude5b\ude5c\ude5d\ude5e\ude5f\ude60\ude61\ude62\ude63\ude64\ude65\ude66\ude67\ude68\ude69\ude6a\ude6b\ude6c\ude6d\ude6e\ude6f\ude70\ude71\ude72\ude73\ude74\ude75\ude76\ude77\ude78\ude79\ude7a\ude7b\ude7c\ude7d\ude7e\ude7f\ude80\ude81\ude82\ude83\ude84\ude85\ude86\ude87\ude88\ude89\ude8a\ude8b\ude8c\ude8d\ude8e\ude8f\ude90\ude91\ude92\ude93\ude94\ude95\ude96\ude97\ude98\ude99\ude9a\ude9b\ude9c\ude9d\ude9e\ude9f\udea0\udea1\udea2\udea3\udea4\udea5\udea6\udea7\udea8\udea9\udeaa\udeab\udeac\udead\udeae\udeaf\udeb0\udeb1\udeb2\udeb3\udeb4\udeb5\udeb6\udeb7\udeb8\udeb9\udeba\udebb\udebc\udebd\udebe\udebf\udec0\udec1\udec2\udec3\udec4\udec5\udec6\udec7\udec8\udec9\udeca\udecb\udecc\udecd\udece\udecf\uded0\uded1\uded2\uded3\uded4\uded5\uded6\uded7\uded8\uded9\udeda\udedb\udedc\udedd\udede\udedf\udee0\udee1\udee2\udee3\udee4\udee5\udee6\udee7\udee8\udee9\udeea\udeeb\udeec\udeed\udeee\udeef\udef0\udef1\udef2\udef3\udef4\udef5\udef6\udef7\udef8\udef9\udefa\udefb\udefc\udefd\udefe\udeff\udf00\udf01\udf02\udf03\udf04\udf05\udf06\udf07\udf08\udf09\udf0a\udf0b\udf0c\udf0d\udf0e\udf0f\udf10\udf11\udf12\udf13\udf14\udf15\udf16\udf17\udf18\udf19\udf1a\udf1b\udf1c\udf1d\udf1e\udf1f\udf20\udf21\udf22\udf23\udf24\udf25\udf26\udf27\udf28\udf29\udf2a\udf2b\udf2c\udf2d\udf2e\udf2f\udf30\udf31\udf32\udf33\udf34\udf35\udf36\udf37\udf38\udf39\udf3a\udf3b\udf3c\udf3d\udf3e\udf3f\udf40\udf41\udf42\udf43\udf44\udf45\udf46\udf47\udf48\udf49\udf4a\udf4b\udf4c\udf4d\udf4e\udf4f\udf50\udf51\udf52\udf53\udf54\udf55\udf56\udf57\udf58\udf59\udf5a\udf5b\udf5c\udf5d\udf5e\udf5f\udf60\udf61\udf62\udf63\udf64\udf65\udf66\udf67\udf68\udf69\udf6a\udf6b\udf6c\udf6d\udf6e\udf6f\udf70\udf71\udf72\udf73\udf74\udf75\udf76\udf77\udf78\udf79\udf7a\udf7b\udf7c\udf7d\udf7e\udf7f\udf80\udf81\udf82\udf83\udf84\udf85\udf86\udf87\udf88\udf89\udf8a\udf8b\udf8c\udf8d\udf8e\udf8f\udf90\udf91\udf92\udf93\udf94\udf95\udf96\udf97\udf98\udf99\udf9a\udf9b\udf9c\udf9d\udf9e\udf9f\udfa0\udfa1\udfa2\udfa3\udfa4\udfa5\udfa6\udfa7\udfa8\udfa9\udfaa\udfab\udfac\udfad\udfae\udfaf\udfb0\udfb1\udfb2\udfb3\udfb4\udfb5\udfb6\udfb7\udfb8\udfb9\udfba\udfbb\udfbc\udfbd\udfbe\udfbf\udfc0\udfc1\udfc2\udfc3\udfc4\udfc5\udfc6\udfc7\udfc8\udfc9\udfca\udfcb\udfcc\udfcd\udfce\udfcf\udfd0\udfd1\udfd2\udfd3\udfd4\udfd5\udfd6\udfd7\udfd8\udfd9\udfda\udfdb\udfdc\udfdd\udfde\udfdf\udfe0\udfe1\udfe2\udfe3\udfe4\udfe5\udfe6\udfe7\udfe8\udfe9\udfea\udfeb\udfec\udfed\udfee\udfef\udff0\udff1\udff2\udff3\udff4\udff5\udff6\udff7\udff8\udff9\udffa\udffb\udffc\udffd\udffe\udfff'")
-except UnicodeDecodeError:
-    Cs = '' # Jython can't handle isolated surrogates
-
-Ll = u'abcdefghijklmnopqrstuvwxyz\xaa\xb5\xba\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\u0101\u0103\u0105\u0107\u0109\u010b\u010d\u010f\u0111\u0113\u0115\u0117\u0119\u011b\u011d\u011f\u0121\u0123\u0125\u0127\u0129\u012b\u012d\u012f\u0131\u0133\u0135\u0137\u0138\u013a\u013c\u013e\u0140\u0142\u0144\u0146\u0148\u0149\u014b\u014d\u014f\u0151\u0153\u0155\u0157\u0159\u015b\u015d\u015f\u0161\u0163\u0165\u0167\u0169\u016b\u016d\u016f\u0171\u0173\u0175\u0177\u017a\u017c\u017e\u017f\u0180\u0183\u0185\u0188\u018c\u018d\u0192\u0195\u0199\u019a\u019b\u019e\u01a1\u01a3\u01a5\u01a8\u01aa\u01ab\u01ad\u01b0\u01b4\u01b6\u01b9\u01ba\u01bd\u01be\u01bf\u01c6\u01c9\u01cc\u01ce\u01d0\u01d2\u01d4\u01d6\u01d8\u01da\u01dc\u01dd\u01df\u01e1\u01e3\u01e5\u01e7\u01e9\u01eb\u01ed\u01ef\u01f0\u01f3\u01f5\u01f9\u01fb\u01fd\u01ff\u0201\u0203\u0205\u0207\u0209\u020b\u020d\u020f\u0211\u0213\u0215\u0217\u0219\u021b\u021d\u021f\u0221\u0223\u0225\u0227\u0229\u022b\u022d\u022f\u0231\u0233\u0234\u0235\u0236\u0237\u0238\u0239\u023c\u023f\u0240\u0250\u0251\u0252\u0253\u0254\u0255\u0256\u0257\u0258\u0259\u025a\u025b\u025c\u025d\u025e\u025f\u0260\u0261\u0262\u0263\u0264\u0265\u0266\u0267\u0268\u0269\u026a\u026b\u026c\u026d\u026e\u026f\u0270\u0271\u0272\u0273\u0274\u0275\u0276\u0277\u0278\u0279\u027a\u027b\u027c\u027d\u027e\u027f\u0280\u0281\u0282\u0283\u0284\u0285\u0286\u0287\u0288\u0289\u028a\u028b\u028c\u028d\u028e\u028f\u0290\u0291\u0292\u0293\u0294\u0295\u0296\u0297\u0298\u0299\u029a\u029b\u029c\u029d\u029e\u029f\u02a0\u02a1\u02a2\u02a3\u02a4\u02a5\u02a6\u02a7\u02a8\u02a9\u02aa\u02ab\u02ac\u02ad\u02ae\u02af\u0390\u03ac\u03ad\u03ae\u03af\u03b0\u03b1\u03b2\u03b3\u03b4\u03b5\u03b6\u03b7\u03b8\u03b9\u03ba\u03bb\u03bc\u03bd\u03be\u03bf\u03c0\u03c1\u03c2\u03c3\u03c4\u03c5\u03c6\u03c7\u03c8\u03c9\u03ca\u03cb\u03cc\u03cd\u03ce\u03d0\u03d1\u03d5\u03d6\u03d7\u03d9\u03db\u03dd\u03df\u03e1\u03e3\u03e5\u03e7\u03e9\u03eb\u03ed\u03ef\u03f0\u03f1\u03f2\u03f3\u03f5\u03f8\u03fb\u03fc\u0430\u0431\u0432\u0433\u0434\u0435\u0436\u0437\u0438\u0439\u043a\u043b\u043c\u043d\u043e\u043f\u0440\u0441\u0442\u0443\u0444\u0445\u0446\u0447\u0448\u0449\u044a\u044b\u044c\u044d\u044e\u044f\u0450\u0451\u0452\u0453\u0454\u0455\u0456\u0457\u0458\u0459\u045a\u045b\u045c\u045d\u045e\u045f\u0461\u0463\u0465\u0467\u0469\u046b\u046d\u046f\u0471\u0473\u0475\u0477\u0479\u047b\u047d\u047f\u0481\u048b\u048d\u048f\u0491\u0493\u0495\u0497\u0499\u049b\u049d\u049f\u04a1\u04a3\u04a5\u04a7\u04a9\u04ab\u04ad\u04af\u04b1\u04b3\u04b5\u04b7\u04b9\u04bb\u04bd\u04bf\u04c2\u04c4\u04c6\u04c8\u04ca\u04cc\u04ce\u04d1\u04d3\u04d5\u04d7\u04d9\u04db\u04dd\u04df\u04e1\u04e3\u04e5\u04e7\u04e9\u04eb\u04ed\u04ef\u04f1\u04f3\u04f5\u04f7\u04f9\u0501\u0503\u0505\u0507\u0509\u050b\u050d\u050f\u0561\u0562\u0563\u0564\u0565\u0566\u0567\u0568\u0569\u056a\u056b\u056c\u056d\u056e\u056f\u0570\u0571\u0572\u0573\u0574\u0575\u0576\u0577\u0578\u0579\u057a\u057b\u057c\u057d\u057e\u057f\u0580\u0581\u0582\u0583\u0584\u0585\u0586\u0587\u1d00\u1d01\u1d02\u1d03\u1d04\u1d05\u1d06\u1d07\u1d08\u1d09\u1d0a\u1d0b\u1d0c\u1d0d\u1d0e\u1d0f\u1d10\u1d11\u1d12\u1d13\u1d14\u1d15\u1d16\u1d17\u1d18\u1d19\u1d1a\u1d1b\u1d1c\u1d1d\u1d1e\u1d1f\u1d20\u1d21\u1d22\u1d23\u1d24\u1d25\u1d26\u1d27\u1d28\u1d29\u1d2a\u1d2b\u1d62\u1d63\u1d64\u1d65\u1d66\u1d67\u1d68\u1d69\u1d6a\u1d6b\u1d6c\u1d6d\u1d6e\u1d6f\u1d70\u1d71\u1d72\u1d73\u1d74\u1d75\u1d76\u1d77\u1d79\u1d7a\u1d7b\u1d7c\u1d7d\u1d7e\u1d7f\u1d80\u1d81\u1d82\u1d83\u1d84\u1d85\u1d86\u1d87\u1d88\u1d89\u1d8a\u1d8b\u1d8c\u1d8d\u1d8e\u1d8f\u1d90\u1d91\u1d92\u1d93\u1d94\u1d95\u1d96\u1d97\u1d98\u1d99\u1d9a\u1e01\u1e03\u1e05\u1e07\u1e09\u1e0b\u1e0d\u1e0f\u1e11\u1e13\u1e15\u1e17\u1e19\u1e1b\u1e1d\u1e1f\u1e21\u1e23\u1e25\u1e27\u1e29\u1e2b\u1e2d\u1e2f\u1e31\u1e33\u1e35\u1e37\u1e39\u1e3b\u1e3d\u1e3f\u1e41\u1e43\u1e45\u1e47\u1e49\u1e4b\u1e4d\u1e4f\u1e51\u1e53\u1e55\u1e57\u1e59\u1e5b\u1e5d\u1e5f\u1e61\u1e63\u1e65\u1e67\u1e69\u1e6b\u1e6d\u1e6f\u1e71\u1e73\u1e75\u1e77\u1e79\u1e7b\u1e7d\u1e7f\u1e81\u1e83\u1e85\u1e87\u1e89\u1e8b\u1e8d\u1e8f\u1e91\u1e93\u1e95\u1e96\u1e97\u1e98\u1e99\u1e9a\u1e9b\u1ea1\u1ea3\u1ea5\u1ea7\u1ea9\u1eab\u1ead\u1eaf\u1eb1\u1eb3\u1eb5\u1eb7\u1eb9\u1ebb\u1ebd\u1ebf\u1ec1\u1ec3\u1ec5\u1ec7\u1ec9\u1ecb\u1ecd\u1ecf\u1ed1\u1ed3\u1ed5\u1ed7\u1ed9\u1edb\u1edd\u1edf\u1ee1\u1ee3\u1ee5\u1ee7\u1ee9\u1eeb\u1eed\u1eef\u1ef1\u1ef3\u1ef5\u1ef7\u1ef9\u1f00\u1f01\u1f02\u1f03\u1f04\u1f05\u1f06\u1f07\u1f10\u1f11\u1f12\u1f13\u1f14\u1f15\u1f20\u1f21\u1f22\u1f23\u1f24\u1f25\u1f26\u1f27\u1f30\u1f31\u1f32\u1f33\u1f34\u1f35\u1f36\u1f37\u1f40\u1f41\u1f42\u1f43\u1f44\u1f45\u1f50\u1f51\u1f52\u1f53\u1f54\u1f55\u1f56\u1f57\u1f60\u1f61\u1f62\u1f63\u1f64\u1f65\u1f66\u1f67\u1f70\u1f71\u1f72\u1f73\u1f74\u1f75\u1f76\u1f77\u1f78\u1f79\u1f7a\u1f7b\u1f7c\u1f7d\u1f80\u1f81\u1f82\u1f83\u1f84\u1f85\u1f86\u1f87\u1f90\u1f91\u1f92\u1f93\u1f94\u1f95\u1f96\u1f97\u1fa0\u1fa1\u1fa2\u1fa3\u1fa4\u1fa5\u1fa6\u1fa7\u1fb0\u1fb1\u1fb2\u1fb3\u1fb4\u1fb6\u1fb7\u1fbe\u1fc2\u1fc3\u1fc4\u1fc6\u1fc7\u1fd0\u1fd1\u1fd2\u1fd3\u1fd6\u1fd7\u1fe0\u1fe1\u1fe2\u1fe3\u1fe4\u1fe5\u1fe6\u1fe7\u1ff2\u1ff3\u1ff4\u1ff6\u1ff7\u2071\u207f\u210a\u210e\u210f\u2113\u212f\u2134\u2139\u213c\u213d\u2146\u2147\u2148\u2149\u2c30\u2c31\u2c32\u2c33\u2c34\u2c35\u2c36\u2c37\u2c38\u2c39\u2c3a\u2c3b\u2c3c\u2c3d\u2c3e\u2c3f\u2c40\u2c41\u2c42\u2c43\u2c44\u2c45\u2c46\u2c47\u2c48\u2c49\u2c4a\u2c4b\u2c4c\u2c4d\u2c4e\u2c4f\u2c50\u2c51\u2c52\u2c53\u2c54\u2c55\u2c56\u2c57\u2c58\u2c59\u2c5a\u2c5b\u2c5c\u2c5d\u2c5e\u2c81\u2c83\u2c85\u2c87\u2c89\u2c8b\u2c8d\u2c8f\u2c91\u2c93\u2c95\u2c97\u2c99\u2c9b\u2c9d\u2c9f\u2ca1\u2ca3\u2ca5\u2ca7\u2ca9\u2cab\u2cad\u2caf\u2cb1\u2cb3\u2cb5\u2cb7\u2cb9\u2cbb\u2cbd\u2cbf\u2cc1\u2cc3\u2cc5\u2cc7\u2cc9\u2ccb\u2ccd\u2ccf\u2cd1\u2cd3\u2cd5\u2cd7\u2cd9\u2cdb\u2cdd\u2cdf\u2ce1\u2ce3\u2ce4\u2d00\u2d01\u2d02\u2d03\u2d04\u2d05\u2d06\u2d07\u2d08\u2d09\u2d0a\u2d0b\u2d0c\u2d0d\u2d0e\u2d0f\u2d10\u2d11\u2d12\u2d13\u2d14\u2d15\u2d16\u2d17\u2d18\u2d19\u2d1a\u2d1b\u2d1c\u2d1d\u2d1e\u2d1f\u2d20\u2d21\u2d22\u2d23\u2d24\u2d25\ufb00\ufb01\ufb02\ufb03\ufb04\ufb05\ufb06\ufb13\ufb14\ufb15\ufb16\ufb17\uff41\uff42\uff43\uff44\uff45\uff46\uff47\uff48\uff49\uff4a\uff4b\uff4c\uff4d\uff4e\uff4f\uff50\uff51\uff52\uff53\uff54\uff55\uff56\uff57\uff58\uff59\uff5a'
-
-Lm = u'\u02b0\u02b1\u02b2\u02b3\u02b4\u02b5\u02b6\u02b7\u02b8\u02b9\u02ba\u02bb\u02bc\u02bd\u02be\u02bf\u02c0\u02c1\u02c6\u02c7\u02c8\u02c9\u02ca\u02cb\u02cc\u02cd\u02ce\u02cf\u02d0\u02d1\u02e0\u02e1\u02e2\u02e3\u02e4\u02ee\u037a\u0559\u0640\u06e5\u06e6\u0e46\u0ec6\u10fc\u17d7\u1843\u1d2c\u1d2d\u1d2e\u1d2f\u1d30\u1d31\u1d32\u1d33\u1d34\u1d35\u1d36\u1d37\u1d38\u1d39\u1d3a\u1d3b\u1d3c\u1d3d\u1d3e\u1d3f\u1d40\u1d41\u1d42\u1d43\u1d44\u1d45\u1d46\u1d47\u1d48\u1d49\u1d4a\u1d4b\u1d4c\u1d4d\u1d4e\u1d4f\u1d50\u1d51\u1d52\u1d53\u1d54\u1d55\u1d56\u1d57\u1d58\u1d59\u1d5a\u1d5b\u1d5c\u1d5d\u1d5e\u1d5f\u1d60\u1d61\u1d78\u1d9b\u1d9c\u1d9d\u1d9e\u1d9f\u1da0\u1da1\u1da2\u1da3\u1da4\u1da5\u1da6\u1da7\u1da8\u1da9\u1daa\u1dab\u1dac\u1dad\u1dae\u1daf\u1db0\u1db1\u1db2\u1db3\u1db4\u1db5\u1db6\u1db7\u1db8\u1db9\u1dba\u1dbb\u1dbc\u1dbd\u1dbe\u1dbf\u2090\u2091\u2092\u2093\u2094\u2d6f\u3005\u3031\u3032\u3033\u3034\u3035\u303b\u309d\u309e\u30fc\u30fd\u30fe\ua015\uff70\uff9e\uff9f'
-
-Lo = u'\u01bb\u01c0\u01c1\u01c2\u01c3\u05d0\u05d1\u05d2\u05d3\u05d4\u05d5\u05d6\u05d7\u05d8\u05d9\u05da\u05db\u05dc\u05dd\u05de\u05df\u05e0\u05e1\u05e2\u05e3\u05e4\u05e5\u05e6\u05e7\u05e8\u05e9\u05ea\u05f0\u05f1\u05f2\u0621\u0622\u0623\u0624\u0625\u0626\u0627\u0628\u0629\u062a\u062b\u062c\u062d\u062e\u062f\u0630\u0631\u0632\u0633\u0634\u0635\u0636\u0637\u0638\u0639\u063a\u0641\u0642\u0643\u0644\u0645\u0646\u0647\u0648\u0649\u064a\u066e\u066f\u0671\u0672\u0673\u0674\u0675\u0676\u0677\u0678\u0679\u067a\u067b\u067c\u067d\u067e\u067f\u0680\u0681\u0682\u0683\u0684\u0685\u0686\u0687\u0688\u0689\u068a\u068b\u068c\u068d\u068e\u068f\u0690\u0691\u0692\u0693\u0694\u0695\u0696\u0697\u0698\u0699\u069a\u069b\u069c\u069d\u069e\u069f\u06a0\u06a1\u06a2\u06a3\u06a4\u06a5\u06a6\u06a7\u06a8\u06a9\u06aa\u06ab\u06ac\u06ad\u06ae\u06af\u06b0\u06b1\u06b2\u06b3\u06b4\u06b5\u06b6\u06b7\u06b8\u06b9\u06ba\u06bb\u06bc\u06bd\u06be\u06bf\u06c0\u06c1\u06c2\u06c3\u06c4\u06c5\u06c6\u06c7\u06c8\u06c9\u06ca\u06cb\u06cc\u06cd\u06ce\u06cf\u06d0\u06d1\u06d2\u06d3\u06d5\u06ee\u06ef\u06fa\u06fb\u06fc\u06ff\u0710\u0712\u0713\u0714\u0715\u0716\u0717\u0718\u0719\u071a\u071b\u071c\u071d\u071e\u071f\u0720\u0721\u0722\u0723\u0724\u0725\u0726\u0727\u0728\u0729\u072a\u072b\u072c\u072d\u072e\u072f\u074d\u074e\u074f\u0750\u0751\u0752\u0753\u0754\u0755\u0756\u0757\u0758\u0759\u075a\u075b\u075c\u075d\u075e\u075f\u0760\u0761\u0762\u0763\u0764\u0765\u0766\u0767\u0768\u0769\u076a\u076b\u076c\u076d\u0780\u0781\u0782\u0783\u0784\u0785\u0786\u0787\u0788\u0789\u078a\u078b\u078c\u078d\u078e\u078f\u0790\u0791\u0792\u0793\u0794\u0795\u0796\u0797\u0798\u0799\u079a\u079b\u079c\u079d\u079e\u079f\u07a0\u07a1\u07a2\u07a3\u07a4\u07a5\u07b1\u0904\u0905\u0906\u0907\u0908\u0909\u090a\u090b\u090c\u090d\u090e\u090f\u0910\u0911\u0912\u0913\u0914\u0915\u0916\u0917\u0918\u0919\u091a\u091b\u091c\u091d\u091e\u091f\u0920\u0921\u0922\u0923\u0924\u0925\u0926\u0927\u0928\u0929\u092a\u092b\u092c\u092d\u092e\u092f\u0930\u0931\u0932\u0933\u0934\u0935\u0936\u0937\u0938\u0939\u093d\u0950\u0958\u0959\u095a\u095b\u095c\u095d\u095e\u095f\u0960\u0961\u097d\u0985\u0986\u0987\u0988\u0989\u098a\u098b\u098c\u098f\u0990\u0993\u0994\u0995\u0996\u0997\u0998\u0999\u099a\u099b\u099c\u099d\u099e\u099f\u09a0\u09a1\u09a2\u09a3\u09a4\u09a5\u09a6\u09a7\u09a8\u09aa\u09ab\u09ac\u09ad\u09ae\u09af\u09b0\u09b2\u09b6\u09b7\u09b8\u09b9\u09bd\u09ce\u09dc\u09dd\u09df\u09e0\u09e1\u09f0\u09f1\u0a05\u0a06\u0a07\u0a08\u0a09\u0a0a\u0a0f\u0a10\u0a13\u0a14\u0a15\u0a16\u0a17\u0a18\u0a19\u0a1a\u0a1b\u0a1c\u0a1d\u0a1e\u0a1f\u0a20\u0a21\u0a22\u0a23\u0a24\u0a25\u0a26\u0a27\u0a28\u0a2a\u0a2b\u0a2c\u0a2d\u0a2e\u0a2f\u0a30\u0a32\u0a33\u0a35\u0a36\u0a38\u0a39\u0a59\u0a5a\u0a5b\u0a5c\u0a5e\u0a72\u0a73\u0a74\u0a85\u0a86\u0a87\u0a88\u0a89\u0a8a\u0a8b\u0a8c\u0a8d\u0a8f\u0a90\u0a91\u0a93\u0a94\u0a95\u0a96\u0a97\u0a98\u0a99\u0a9a\u0a9b\u0a9c\u0a9d\u0a9e\u0a9f\u0aa0\u0aa1\u0aa2\u0aa3\u0aa4\u0aa5\u0aa6\u0aa7\u0aa8\u0aaa\u0aab\u0aac\u0aad\u0aae\u0aaf\u0ab0\u0ab2\u0ab3\u0ab5\u0ab6\u0ab7\u0ab8\u0ab9\u0abd\u0ad0\u0ae0\u0ae1\u0b05\u0b06\u0b07\u0b08\u0b09\u0b0a\u0b0b\u0b0c\u0b0f\u0b10\u0b13\u0b14\u0b15\u0b16\u0b17\u0b18\u0b19\u0b1a\u0b1b\u0b1c\u0b1d\u0b1e\u0b1f\u0b20\u0b21\u0b22\u0b23\u0b24\u0b25\u0b26\u0b27\u0b28\u0b2a\u0b2b\u0b2c\u0b2d\u0b2e\u0b2f\u0b30\u0b32\u0b33\u0b35\u0b36\u0b37\u0b38\u0b39\u0b3d\u0b5c\u0b5d\u0b5f\u0b60\u0b61\u0b71\u0b83\u0b85\u0b86\u0b87\u0b88\u0b89\u0b8a\u0b8e\u0b8f\u0b90\u0b92\u0b93\u0b94\u0b95\u0b99\u0b9a\u0b9c\u0b9e\u0b9f\u0ba3\u0ba4\u0ba8\u0ba9\u0baa\u0bae\u0baf\u0bb0\u0bb1\u0bb2\u0bb3\u0bb4\u0bb5\u0bb6\u0bb7\u0bb8\u0bb9\u0c05\u0c06\u0c07\u0c08\u0c09\u0c0a\u0c0b\u0c0c\u0c0e\u0c0f\u0c10\u0c12\u0c13\u0c14\u0c15\u0c16\u0c17\u0c18\u0c19\u0c1a\u0c1b\u0c1c\u0c1d\u0c1e\u0c1f\u0c20\u0c21\u0c22\u0c23\u0c24\u0c25\u0c26\u0c27\u0c28\u0c2a\u0c2b\u0c2c\u0c2d\u0c2e\u0c2f\u0c30\u0c31\u0c32\u0c33\u0c35\u0c36\u0c37\u0c38\u0c39\u0c60\u0c61\u0c85\u0c86\u0c87\u0c88\u0c89\u0c8a\u0c8b\u0c8c\u0c8e\u0c8f\u0c90\u0c92\u0c93\u0c94\u0c95\u0c96\u0c97\u0c98\u0c99\u0c9a\u0c9b\u0c9c\u0c9d\u0c9e\u0c9f\u0ca0\u0ca1\u0ca2\u0ca3\u0ca4\u0ca5\u0ca6\u0ca7\u0ca8\u0caa\u0cab\u0cac\u0cad\u0cae\u0caf\u0cb0\u0cb1\u0cb2\u0cb3\u0cb5\u0cb6\u0cb7\u0cb8\u0cb9\u0cbd\u0cde\u0ce0\u0ce1\u0d05\u0d06\u0d07\u0d08\u0d09\u0d0a\u0d0b\u0d0c\u0d0e\u0d0f\u0d10\u0d12\u0d13\u0d14\u0d15\u0d16\u0d17\u0d18\u0d19\u0d1a\u0d1b\u0d1c\u0d1d\u0d1e\u0d1f\u0d20\u0d21\u0d22\u0d23\u0d24\u0d25\u0d26\u0d27\u0d28\u0d2a\u0d2b\u0d2c\u0d2d\u0d2e\u0d2f\u0d30\u0d31\u0d32\u0d33\u0d34\u0d35\u0d36\u0d37\u0d38\u0d39\u0d60\u0d61\u0d85\u0d86\u0d87\u0d88\u0d89\u0d8a\u0d8b\u0d8c\u0d8d\u0d8e\u0d8f\u0d90\u0d91\u0d92\u0d93\u0d94\u0d95\u0d96\u0d9a\u0d9b\u0d9c\u0d9d\u0d9e\u0d9f\u0da0\u0da1\u0da2\u0da3\u0da4\u0da5\u0da6\u0da7\u0da8\u0da9\u0daa\u0dab\u0dac\u0dad\u0dae\u0daf\u0db0\u0db1\u0db3\u0db4\u0db5\u0db6\u0db7\u0db8\u0db9\u0dba\u0dbb\u0dbd\u0dc0\u0dc1\u0dc2\u0dc3\u0dc4\u0dc5\u0dc6\u0e01\u0e02\u0e03\u0e04\u0e05\u0e06\u0e07\u0e08\u0e09\u0e0a\u0e0b\u0e0c\u0e0d\u0e0e\u0e0f\u0e10\u0e11\u0e12\u0e13\u0e14\u0e15\u0e16\u0e17\u0e18\u0e19\u0e1a\u0e1b\u0e1c\u0e1d\u0e1e\u0e1f\u0e20\u0e21\u0e22\u0e23\u0e24\u0e25\u0e26\u0e27\u0e28\u0e29\u0e2a\u0e2b\u0e2c\u0e2d\u0e2e\u0e2f\u0e30\u0e32\u0e33\u0e40\u0e41\u0e42\u0e43\u0e44\u0e45\u0e81\u0e82\u0e84\u0e87\u0e88\u0e8a\u0e8d\u0e94\u0e95\u0e96\u0e97\u0e99\u0e9a\u0e9b\u0e9c\u0e9d\u0e9e\u0e9f\u0ea1\u0ea2\u0ea3\u0ea5\u0ea7\u0eaa\u0eab\u0ead\u0eae\u0eaf\u0eb0\u0eb2\u0eb3\u0ebd\u0ec0\u0ec1\u0ec2\u0ec3\u0ec4\u0edc\u0edd\u0f00\u0f40\u0f41\u0f42\u0f43\u0f44\u0f45\u0f46\u0f47\u0f49\u0f4a\u0f4b\u0f4c\u0f4d\u0f4e\u0f4f\u0f50\u0f51\u0f52\u0f53\u0f54\u0f55\u0f56\u0f57\u0f58\u0f59\u0f5a\u0f5b\u0f5c\u0f5d\u0f5e\u0f5f\u0f60\u0f61\u0f62\u0f63\u0f64\u0f65\u0f66\u0f67\u0f68\u0f69\u0f6a\u0f88\u0f89\u0f8a\u0f8b\u1000\u1001\u1002\u1003\u1004\u1005\u1006\u1007\u1008\u1009\u100a\u100b\u100c\u100d\u100e\u100f\u1010\u1011\u1012\u1013\u1014\u1015\u1016\u1017\u1018\u1019\u101a\u101b\u101c\u101d\u101e\u101f\u1020\u1021\u1023\u1024\u1025\u1026\u1027\u1029\u102a\u1050\u1051\u1052\u1053\u1054\u1055\u10d0\u10d1\u10d2\u10d3\u10d4\u10d5\u10d6\u10d7\u10d8\u10d9\u10da\u10db\u10dc\u10dd\u10de\u10df\u10e0\u10e1\u10e2\u10e3\u10e4\u10e5\u10e6\u10e7\u10e8\u10e9\u10ea\u10eb\u10ec\u10ed\u10ee\u10ef\u10f0\u10f1\u10f2\u10f3\u10f4\u10f5\u10f6\u10f7\u10f8\u10f9\u10fa\u1100\u1101\u1102\u1103\u1104\u1105\u1106\u1107\u1108\u1109\u110a\u110b\u110c\u110d\u110e\u110f\u1110\u1111\u1112\u1113\u1114\u1115\u1116\u1117\u1118\u1119\u111a\u111b\u111c\u111d\u111e\u111f\u1120\u1121\u1122\u1123\u1124\u1125\u1126\u1127\u1128\u1129\u112a\u112b\u112c\u112d\u112e\u112f\u1130\u1131\u1132\u1133\u1134\u1135\u1136\u1137\u1138\u1139\u113a\u113b\u113c\u113d\u113e\u113f\u1140\u1141\u1142\u1143\u1144\u1145\u1146\u1147\u1148\u1149\u114a\u114b\u114c\u114d\u114e\u114f\u1150\u1151\u1152\u1153\u1154\u1155\u1156\u1157\u1158\u1159\u115f\u1160\u1161\u1162\u1163\u1164\u1165\u1166\u1167\u1168\u1169\u116a\u116b\u116c\u116d\u116e\u116f\u1170\u1171\u1172\u1173\u1174\u1175\u1176\u1177\u1178\u1179\u117a\u117b\u117c\u117d\u117e\u117f\u1180\u1181\u1182\u1183\u1184\u1185\u1186\u1187\u1188\u1189\u118a\u118b\u118c\u118d\u118e\u118f\u1190\u1191\u1192\u1193\u1194\u1195\u1196\u1197\u1198\u1199\u119a\u119b\u119c\u119d\u119e\u119f\u11a0\u11a1\u11a2\u11a8\u11a9\u11aa\u11ab\u11ac\u11ad\u11ae\u11af\u11b0\u11b1\u11b2\u11b3\u11b4\u11b5\u11b6\u11b7\u11b8\u11b9\u11ba\u11bb\u11bc\u11bd\u11be\u11bf\u11c0\u11c1\u11c2\u11c3\u11c4\u11c5\u11c6\u11c7\u11c8\u11c9\u11ca\u11cb\u11cc\u11cd\u11ce\u11cf\u11d0\u11d1\u11d2\u11d3\u11d4\u11d5\u11d6\u11d7\u11d8\u11d9\u11da\u11db\u11dc\u11dd\u11de\u11df\u11e0\u11e1\u11e2\u11e3\u11e4\u11e5\u11e6\u11e7\u11e8\u11e9\u11ea\u11eb\u11ec\u11ed\u11ee\u11ef\u11f0\u11f1\u11f2\u11f3\u11f4\u11f5\u11f6\u11f7\u11f8\u11f9\u1200\u1201\u1202\u1203\u1204\u1205\u1206\u1207\u1208\u1209\u120a\u120b\u120c\u120d\u120e\u120f\u1210\u1211\u1212\u1213\u1214\u1215\u1216\u1217\u1218\u1219\u121a\u121b\u121c\u121d\u121e\u121f\u1220\u1221\u1222\u1223\u1224\u1225\u1226\u1227\u1228\u1229\u122a\u122b\u122c\u122d\u122e\u122f\u1230\u1231\u1232\u1233\u1234\u1235\u1236\u1237\u1238\u1239\u123a\u123b\u123c\u123d\u123e\u123f\u1240\u1241\u1242\u1243\u1244\u1245\u1246\u1247\u1248\u124a\u124b\u124c\u124d\u1250\u1251\u1252\u1253\u1254\u1255\u1256\u1258\u125a\u125b\u125c\u125d\u1260\u1261\u1262\u1263\u1264\u1265\u1266\u1267\u1268\u1269\u126a\u126b\u126c\u126d\u126e\u126f\u1270\u1271\u1272\u1273\u1274\u1275\u1276\u1277\u1278\u1279\u127a\u127b\u127c\u127d\u127e\u127f\u1280\u1281\u1282\u1283\u1284\u1285\u1286\u1287\u1288\u128a\u128b\u128c\u128d\u1290\u1291\u1292\u1293\u1294\u1295\u1296\u1297\u1298\u1299\u129a\u129b\u129c\u129d\u129e\u129f\u12a0\u12a1\u12a2\u12a3\u12a4\u12a5\u12a6\u12a7\u12a8\u12a9\u12aa\u12ab\u12ac\u12ad\u12ae\u12af\u12b0\u12b2\u12b3\u12b4\u12b5\u12b8\u12b9\u12ba\u12bb\u12bc\u12bd\u12be\u12c0\u12c2\u12c3\u12c4\u12c5\u12c8\u12c9\u12ca\u12cb\u12cc\u12cd\u12ce\u12cf\u12d0\u12d1\u12d2\u12d3\u12d4\u12d5\u12d6\u12d8\u12d9\u12da\u12db\u12dc\u12dd\u12de\u12df\u12e0\u12e1\u12e2\u12e3\u12e4\u12e5\u12e6\u12e7\u12e8\u12e9\u12ea\u12eb\u12ec\u12ed\u12ee\u12ef\u12f0\u12f1\u12f2\u12f3\u12f4\u12f5\u12f6\u12f7\u12f8\u12f9\u12fa\u12fb\u12fc\u12fd\u12fe\u12ff\u1300\u1301\u1302\u1303\u1304\u1305\u1306\u1307\u1308\u1309\u130a\u130b\u130c\u130d\u130e\u130f\u1310\u1312\u1313\u1314\u1315\u1318\u1319\u131a\u131b\u131c\u131d\u131e\u131f\u1320\u1321\u1322\u1323\u1324\u1325\u1326\u1327\u1328\u1329\u132a\u132b\u132c\u132d\u132e\u132f\u1330\u1331\u1332\u1333\u1334\u1335\u1336\u1337\u1338\u1339\u133a\u133b\u133c\u133d\u133e\u133f\u1340\u1341\u1342\u1343\u1344\u1345\u1346\u1347\u1348\u1349\u134a\u134b\u134c\u134d\u134e\u134f\u1350\u1351\u1352\u1353\u1354\u1355\u1356\u1357\u1358\u1359\u135a\u1380\u1381\u1382\u1383\u1384\u1385\u1386\u1387\u1388\u1389\u138a\u138b\u138c\u138d\u138e\u138f\u13a0\u13a1\u13a2\u13a3\u13a4\u13a5\u13a6\u13a7\u13a8\u13a9\u13aa\u13ab\u13ac\u13ad\u13ae\u13af\u13b0\u13b1\u13b2\u13b3\u13b4\u13b5\u13b6\u13b7\u13b8\u13b9\u13ba\u13bb\u13bc\u13bd\u13be\u13bf\u13c0\u13c1\u13c2\u13c3\u13c4\u13c5\u13c6\u13c7\u13c8\u13c9\u13ca\u13cb\u13cc\u13cd\u13ce\u13cf\u13d0\u13d1\u13d2\u13d3\u13d4\u13d5\u13d6\u13d7\u13d8\u13d9\u13da\u13db\u13dc\u13dd\u13de\u13df\u13e0\u13e1\u13e2\u13e3\u13e4\u13e5\u13e6\u13e7\u13e8\u13e9\u13ea\u13eb\u13ec\u13ed\u13ee\u13ef\u13f0\u13f1\u13f2\u13f3\u13f4\u1401\u1402\u1403\u1404\u1405\u1406\u1407\u1408\u1409\u140a\u140b\u140c\u140d\u140e\u140f\u1410\u1411\u1412\u1413\u1414\u1415\u1416\u1417\u1418\u1419\u141a\u141b\u141c\u141d\u141e\u141f\u1420\u1421\u1422\u1423\u1424\u1425\u1426\u1427\u1428\u1429\u142a\u142b\u142c\u142d\u142e\u142f\u1430\u1431\u1432\u1433\u1434\u1435\u1436\u1437\u1438\u1439\u143a\u143b\u143c\u143d\u143e\u143f\u1440\u1441\u1442\u1443\u1444\u1445\u1446\u1447\u1448\u1449\u144a\u144b\u144c\u144d\u144e\u144f\u1450\u1451\u1452\u1453\u1454\u1455\u1456\u1457\u1458\u1459\u145a\u145b\u145c\u145d\u145e\u145f\u1460\u1461\u1462\u1463\u1464\u1465\u1466\u1467\u1468\u1469\u146a\u146b\u146c\u146d\u146e\u146f\u1470\u1471\u1472\u1473\u1474\u1475\u1476\u1477\u1478\u1479\u147a\u147b\u147c\u147d\u147e\u147f\u1480\u1481\u1482\u1483\u1484\u1485\u1486\u1487\u1488\u1489\u148a\u148b\u148c\u148d\u148e\u148f\u1490\u1491\u1492\u1493\u1494\u1495\u1496\u1497\u1498\u1499\u149a\u149b\u149c\u149d\u149e\u149f\u14a0\u14a1\u14a2\u14a3\u14a4\u14a5\u14a6\u14a7\u14a8\u14a9\u14aa\u14ab\u14ac\u14ad\u14ae\u14af\u14b0\u14b1\u14b2\u14b3\u14b4\u14b5\u14b6\u14b7\u14b8\u14b9\u14ba\u14bb\u14bc\u14bd\u14be\u14bf\u14c0\u14c1\u14c2\u14c3\u14c4\u14c5\u14c6\u14c7\u14c8\u14c9\u14ca\u14cb\u14cc\u14cd\u14ce\u14cf\u14d0\u14d1\u14d2\u14d3\u14d4\u14d5\u14d6\u14d7\u14d8\u14d9\u14da\u14db\u14dc\u14dd\u14de\u14df\u14e0\u14e1\u14e2\u14e3\u14e4\u14e5\u14e6\u14e7\u14e8\u14e9\u14ea\u14eb\u14ec\u14ed\u14ee\u14ef\u14f0\u14f1\u14f2\u14f3\u14f4\u14f5\u14f6\u14f7\u14f8\u14f9\u14fa\u14fb\u14fc\u14fd\u14fe\u14ff\u1500\u1501\u1502\u1503\u1504\u1505\u1506\u1507\u1508\u1509\u150a\u150b\u150c\u150d\u150e\u150f\u1510\u1511\u1512\u1513\u1514\u1515\u1516\u1517\u1518\u1519\u151a\u151b\u151c\u151d\u151e\u151f\u1520\u1521\u1522\u1523\u1524\u1525\u1526\u1527\u1528\u1529\u152a\u152b\u152c\u152d\u152e\u152f\u1530\u1531\u1532\u1533\u1534\u1535\u1536\u1537\u1538\u1539\u153a\u153b\u153c\u153d\u153e\u153f\u1540\u1541\u1542\u1543\u1544\u1545\u1546\u1547\u1548\u1549\u154a\u154b\u154c\u154d\u154e\u154f\u1550\u1551\u1552\u1553\u1554\u1555\u1556\u1557\u1558\u1559\u155a\u155b\u155c\u155d\u155e\u155f\u1560\u1561\u1562\u1563\u1564\u1565\u1566\u1567\u1568\u1569\u156a\u156b\u156c\u156d\u156e\u156f\u1570\u1571\u1572\u1573\u1574\u1575\u1576\u1577\u1578\u1579\u157a\u157b\u157c\u157d\u157e\u157f\u1580\u1581\u1582\u1583\u1584\u1585\u1586\u1587\u1588\u1589\u158a\u158b\u158c\u158d\u158e\u158f\u1590\u1591\u1592\u1593\u1594\u1595\u1596\u1597\u1598\u1599\u159a\u159b\u159c\u159d\u159e\u159f\u15a0\u15a1\u15a2\u15a3\u15a4\u15a5\u15a6\u15a7\u15a8\u15a9\u15aa\u15ab\u15ac\u15ad\u15ae\u15af\u15b0\u15b1\u15b2\u15b3\u15b4\u15b5\u15b6\u15b7\u15b8\u15b9\u15ba\u15bb\u15bc\u15bd\u15be\u15bf\u15c0\u15c1\u15c2\u15c3\u15c4\u15c5\u15c6\u15c7\u15c8\u15c9\u15ca\u15cb\u15cc\u15cd\u15ce\u15cf\u15d0\u15d1\u15d2\u15d3\u15d4\u15d5\u15d6\u15d7\u15d8\u15d9\u15da\u15db\u15dc\u15dd\u15de\u15df\u15e0\u15e1\u15e2\u15e3\u15e4\u15e5\u15e6\u15e7\u15e8\u15e9\u15ea\u15eb\u15ec\u15ed\u15ee\u15ef\u15f0\u15f1\u15f2\u15f3\u15f4\u15f5\u15f6\u15f7\u15f8\u15f9\u15fa\u15fb\u15fc\u15fd\u15fe\u15ff\u1600\u1601\u1602\u1603\u1604\u1605\u1606\u1607\u1608\u1609\u160a\u160b\u160c\u160d\u160e\u160f\u1610\u1611\u1612\u1613\u1614\u1615\u1616\u1617\u1618\u1619\u161a\u161b\u161c\u161d\u161e\u161f\u1620\u1621\u1622\u1623\u1624\u1625\u1626\u1627\u1628\u1629\u162a\u162b\u162c\u162d\u162e\u162f\u1630\u1631\u1632\u1633\u1634\u1635\u1636\u1637\u1638\u1639\u163a\u163b\u163c\u163d\u163e\u163f\u1640\u1641\u1642\u1643\u1644\u1645\u1646\u1647\u1648\u1649\u164a\u164b\u164c\u164d\u164e\u164f\u1650\u1651\u1652\u1653\u1654\u1655\u1656\u1657\u1658\u1659\u165a\u165b\u165c\u165d\u165e\u165f\u1660\u1661\u1662\u1663\u1664\u1665\u1666\u1667\u1668\u1669\u166a\u166b\u166c\u166f\u1670\u1671\u1672\u1673\u1674\u1675\u1676\u1681\u1682\u1683\u1684\u1685\u1686\u1687\u1688\u1689\u168a\u168b\u168c\u168d\u168e\u168f\u1690\u1691\u1692\u1693\u1694\u1695\u1696\u1697\u1698\u1699\u169a\u16a0\u16a1\u16a2\u16a3\u16a4\u16a5\u16a6\u16a7\u16a8\u16a9\u16aa\u16ab\u16ac\u16ad\u16ae\u16af\u16b0\u16b1\u16b2\u16b3\u16b4\u16b5\u16b6\u16b7\u16b8\u16b9\u16ba\u16bb\u16bc\u16bd\u16be\u16bf\u16c0\u16c1\u16c2\u16c3\u16c4\u16c5\u16c6\u16c7\u16c8\u16c9\u16ca\u16cb\u16cc\u16cd\u16ce\u16cf\u16d0\u16d1\u16d2\u16d3\u16d4\u16d5\u16d6\u16d7\u16d8\u16d9\u16da\u16db\u16dc\u16dd\u16de\u16df\u16e0\u16e1\u16e2\u16e3\u16e4\u16e5\u16e6\u16e7\u16e8\u16e9\u16ea\u1700\u1701\u1702\u1703\u1704\u1705\u1706\u1707\u1708\u1709\u170a\u170b\u170c\u170e\u170f\u1710\u1711\u1720\u1721\u1722\u1723\u1724\u1725\u1726\u1727\u1728\u1729\u172a\u172b\u172c\u172d\u172e\u172f\u1730\u1731\u1740\u1741\u1742\u1743\u1744\u1745\u1746\u1747\u1748\u1749\u174a\u174b\u174c\u174d\u174e\u174f\u1750\u1751\u1760\u1761\u1762\u1763\u1764\u1765\u1766\u1767\u1768\u1769\u176a\u176b\u176c\u176e\u176f\u1770\u1780\u1781\u1782\u1783\u1784\u1785\u1786\u1787\u1788\u1789\u178a\u178b\u178c\u178d\u178e\u178f\u1790\u1791\u1792\u1793\u1794\u1795\u1796\u1797\u1798\u1799\u179a\u179b\u179c\u179d\u179e\u179f\u17a0\u17a1\u17a2\u17a3\u17a4\u17a5\u17a6\u17a7\u17a8\u17a9\u17aa\u17ab\u17ac\u17ad\u17ae\u17af\u17b0\u17b1\u17b2\u17b3\u17dc\u1820\u1821\u1822\u1823\u1824\u1825\u1826\u1827\u1828\u1829\u182a\u182b\u182c\u182d\u182e\u182f\u1830\u1831\u1832\u1833\u1834\u1835\u1836\u1837\u1838\u1839\u183a\u183b\u183c\u183d\u183e\u183f\u1840\u1841\u1842\u1844\u1845\u1846\u1847\u1848\u1849\u184a\u184b\u184c\u184d\u184e\u184f\u1850\u1851\u1852\u1853\u1854\u1855\u1856\u1857\u1858\u1859\u185a\u185b\u185c\u185d\u185e\u185f\u1860\u1861\u1862\u1863\u1864\u1865\u1866\u1867\u1868\u1869\u186a\u186b\u186c\u186d\u186e\u186f\u1870\u1871\u1872\u1873\u1874\u1875\u1876\u1877\u1880\u1881\u1882\u1883\u1884\u1885\u1886\u1887\u1888\u1889\u188a\u188b\u188c\u188d\u188e\u188f\u1890\u1891\u1892\u1893\u1894\u1895\u1896\u1897\u1898\u1899\u189a\u189b\u189c\u189d\u189e\u189f\u18a0\u18a1\u18a2\u18a3\u18a4\u18a5\u18a6\u18a7\u18a8\u1900\u1901\u1902\u1903\u1904\u1905\u1906\u1907\u1908\u1909\u190a\u190b\u190c\u190d\u190e\u190f\u1910\u1911\u1912\u1913\u1914\u1915\u1916\u1917\u1918\u1919\u191a\u191b\u191c\u1950\u1951\u1952\u1953\u1954\u1955\u1956\u1957\u1958\u1959\u195a\u195b\u195c\u195d\u195e\u195f\u1960\u1961\u1962\u1963\u1964\u1965\u1966\u1967\u1968\u1969\u196a\u196b\u196c\u196d\u1970\u1971\u1972\u1973\u1974\u1980\u1981\u1982\u1983\u1984\u1985\u1986\u1987\u1988\u1989\u198a\u198b\u198c\u198d\u198e\u198f\u1990\u1991\u1992\u1993\u1994\u1995\u1996\u1997\u1998\u1999\u199a\u199b\u199c\u199d\u199e\u199f\u19a0\u19a1\u19a2\u19a3\u19a4\u19a5\u19a6\u19a7\u19a8\u19a9\u19c1\u19c2\u19c3\u19c4\u19c5\u19c6\u19c7\u1a00\u1a01\u1a02\u1a03\u1a04\u1a05\u1a06\u1a07\u1a08\u1a09\u1a0a\u1a0b\u1a0c\u1a0d\u1a0e\u1a0f\u1a10\u1a11\u1a12\u1a13\u1a14\u1a15\u1a16\u2135\u2136\u2137\u2138\u2d30\u2d31\u2d32\u2d33\u2d34\u2d35\u2d36\u2d37\u2d38\u2d39\u2d3a\u2d3b\u2d3c\u2d3d\u2d3e\u2d3f\u2d40\u2d41\u2d42\u2d43\u2d44\u2d45\u2d46\u2d47\u2d48\u2d49\u2d4a\u2d4b\u2d4c\u2d4d\u2d4e\u2d4f\u2d50\u2d51\u2d52\u2d53\u2d54\u2d55\u2d56\u2d57\u2d58\u2d59\u2d5a\u2d5b\u2d5c\u2d5d\u2d5e\u2d5f\u2d60\u2d61\u2d62\u2d63\u2d64\u2d65\u2d80\u2d81\u2d82\u2d83\u2d84\u2d85\u2d86\u2d87\u2d88\u2d89\u2d8a\u2d8b\u2d8c\u2d8d\u2d8e\u2d8f\u2d90\u2d91\u2d92\u2d93\u2d94\u2d95\u2d96\u2da0\u2da1\u2da2\u2da3\u2da4\u2da5\u2da6\u2da8\u2da9\u2daa\u2dab\u2dac\u2dad\u2dae\u2db0\u2db1\u2db2\u2db3\u2db4\u2db5\u2db6\u2db8\u2db9\u2dba\u2dbb\u2dbc\u2dbd\u2dbe\u2dc0\u2dc1\u2dc2\u2dc3\u2dc4\u2dc5\u2dc6\u2dc8\u2dc9\u2dca\u2dcb\u2dcc\u2dcd\u2dce\u2dd0\u2dd1\u2dd2\u2dd3\u2dd4\u2dd5\u2dd6\u2dd8\u2dd9\u2dda\u2ddb\u2ddc\u2ddd\u2dde\u3006\u303c\u3041\u3042\u3043\u3044\u3045\u3046\u3047\u3048\u3049\u304a\u304b\u304c\u304d\u304e\u304f\u3050\u3051\u3052\u3053\u3054\u3055\u3056\u3057\u3058\u3059\u305a\u305b\u305c\u305d\u305e\u305f\u3060\u3061\u3062\u3063\u3064\u3065\u3066\u3067\u3068\u3069\u306a\u306b\u306c\u306d\u306e\u306f\u3070\u3071\u3072\u3073\u3074\u3075\u3076\u3077\u3078\u3079\u307a\u307b\u307c\u307d\u307e\u307f\u3080\u3081\u3082\u3083\u3084\u3085\u3086\u3087\u3088\u3089\u308a\u308b\u308c\u308d\u308e\u308f\u3090\u3091\u3092\u3093\u3094\u3095\u3096\u309f\u30a1\u30a2\u30a3\u30a4\u30a5\u30a6\u30a7\u30a8\u30a9\u30aa\u30ab\u30ac\u30ad\u30ae\u30af\u30b0\u30b1\u30b2\u30b3\u30b4\u30b5\u30b6\u30b7\u30b8\u30b9\u30ba\u30bb\u30bc\u30bd\u30be\u30bf\u30c0\u30c1\u30c2\u30c3\u30c4\u30c5\u30c6\u30c7\u30c8\u30c9\u30ca\u30cb\u30cc\u30cd\u30ce\u30cf\u30d0\u30d1\u30d2\u30d3\u30d4\u30d5\u30d6\u30d7\u30d8\u30d9\u30da\u30db\u30dc\u30dd\u30de\u30df\u30e0\u30e1\u30e2\u30e3\u30e4\u30e5\u30e6\u30e7\u30e8\u30e9\u30ea\u30eb\u30ec\u30ed\u30ee\u30ef\u30f0\u30f1\u30f2\u30f3\u30f4\u30f5\u30f6\u30f7\u30f8\u30f9\u30fa\u30ff\u3105\u3106\u3107\u3108\u3109\u310a\u310b\u310c\u310d\u310e\u310f\u3110\u3111\u3112\u3113\u3114\u3115\u3116\u3117\u3118\u3119\u311a\u311b\u311c\u311d\u311e\u311f\u3120\u3121\u3122\u3123\u3124\u3125\u3126\u3127\u3128\u3129\u312a\u312b\u312c\u3131\u3132\u3133\u3134\u3135\u3136\u3137\u3138\u3139\u313a\u313b\u313c\u313d\u313e\u313f\u3140\u3141\u3142\u3143\u3144\u3145\u3146\u3147\u3148\u3149\u314a\u314b\u314c\u314d\u314e\u314f\u3150\u3151\u3152\u3153\u3154\u3155\u3156\u3157\u3158\u3159\u315a\u315b\u315c\u315d\u315e\u315f\u3160\u3161\u3162\u3163\u3164\u3165\u3166\u3167\u3168\u3169\u316a\u316b\u316c\u316d\u316e\u316f\u3170\u3171\u3172\u3173\u3174\u3175\u3176\u3177\u3178\u3179\u317a\u317b\u317c\u317d\u317e\u317f\u3180\u3181\u3182\u3183\u3184\u3185\u3186\u3187\u3188\u3189\u318a\u318b\u318c\u318d\u318e\u31a0\u31a1\u31a2\u31a3\u31a4\u31a5\u31a6\u31a7\u31a8\u31a9\u31aa\u31ab\u31ac\u31ad\u31ae\u31af\u31b0\u31b1\u31b2\u31b3\u31b4\u31b5\u31b6\u31b7\u31f0\u31f1\u31f2\u31f3\u31f4\u31f5\u31f6\u31f7\u31f8\u31f9\u31fa\u31fb\u31fc\u31fd\u31fe\u31ff\u3400\u3401\u3402\u3403\u3404\u3405\u3406\u3407\u3408\u3409\u340a\u340b\u340c\u340d\u340e\u340f\u3410\u3411\u3412\u3413\u3414\u3415\u3416\u3417\u3418\u3419\u341a\u341b\u341c\u341d\u341e\u341f\u3420\u3421\u3422\u3423\u3424\u3425\u3426\u3427\u3428\u3429\u342a\u342b\u342c\u342d\u342e\u342f\u3430\u3431\u3432\u3433\u3434\u3435\u3436\u3437\u3438\u3439\u343a\u343b\u343c\u343d\u343e\u343f\u3440\u3441\u3442\u3443\u3444\u3445\u3446\u3447\u3448\u3449\u344a\u344b\u344c\u344d\u344e\u344f\u3450\u3451\u3452\u3453\u3454\u3455\u3456\u3457\u3458\u3459\u345a\u345b\u345c\u345d\u345e\u345f\u3460\u3461\u3462\u3463\u3464\u3465\u3466\u3467\u3468\u3469\u346a\u346b\u346c\u346d\u346e\u346f\u3470\u3471\u3472\u3473\u3474\u3475\u3476\u3477\u3478\u3479\u347a\u347b\u347c\u347d\u347e\u347f\u3480\u3481\u3482\u3483\u3484\u3485\u3486\u3487\u3488\u3489\u348a\u348b\u348c\u348d\u348e\u348f\u3490\u3491\u3492\u3493\u3494\u3495\u3496\u3497\u3498\u3499\u349a\u349b\u349c\u349d\u349e\u349f\u34a0\u34a1\u34a2\u34a3\u34a4\u34a5\u34a6\u34a7\u34a8\u34a9\u34aa\u34ab\u34ac\u34ad\u34ae\u34af\u34b0\u34b1\u34b2\u34b3\u34b4\u34b5\u34b6\u34b7\u34b8\u34b9\u34ba\u34bb\u34bc\u34bd\u34be\u34bf\u34c0\u34c1\u34c2\u34c3\u34c4\u34c5\u34c6\u34c7\u34c8\u34c9\u34ca\u34cb\u34cc\u34cd\u34ce\u34cf\u34d0\u34d1\u34d2\u34d3\u34d4\u34d5\u34d6\u34d7\u34d8\u34d9\u34da\u34db\u34dc\u34dd\u34de\u34df\u34e0\u34e1\u34e2\u34e3\u34e4\u34e5\u34e6\u34e7\u34e8\u34e9\u34ea\u34eb\u34ec\u34ed\u34ee\u34ef\u34f0\u34f1\u34f2\u34f3\u34f4\u34f5\u34f6\u34f7\u34f8\u34f9\u34fa\u34fb\u34fc\u34fd\u34fe\u34ff\u3500\u3501\u3502\u3503\u3504\u3505\u3506\u3507\u3508\u3509\u350a\u350b\u350c\u350d\u350e\u350f\u3510\u3511\u3512\u3513\u3514\u3515\u3516\u3517\u3518\u3519\u351a\u351b\u351c\u351d\u351e\u351f\u3520\u3521\u3522\u3523\u3524\u3525\u3526\u3527\u3528\u3529\u352a\u352b\u352c\u352d\u352e\u352f\u3530\u3531\u3532\u3533\u3534\u3535\u3536\u3537\u3538\u3539\u353a\u353b\u353c\u353d\u353e\u353f\u3540\u3541\u3542\u3543\u3544\u3545\u3546\u3547\u3548\u3549\u354a\u354b\u354c\u354d\u354e\u354f\u3550\u3551\u3552\u3553\u3554\u3555\u3556\u3557\u3558\u3559\u355a\u355b\u355c\u355d\u355e\u355f\u3560\u3561\u3562\u3563\u3564\u3565\u3566\u3567\u3568\u3569\u356a\u356b\u356c\u356d\u356e\u356f\u3570\u3571\u3572\u3573\u3574\u3575\u3576\u3577\u3578\u3579\u357a\u357b\u357c\u357d\u357e\u357f\u3580\u3581\u3582\u3583\u3584\u3585\u3586\u3587\u3588\u3589\u358a\u358b\u358c\u358d\u358e\u358f\u3590\u3591\u3592\u3593\u3594\u3595\u3596\u3597\u3598\u3599\u359a\u359b\u359c\u359d\u359e\u359f\u35a0\u35a1\u35a2\u35a3\u35a4\u35a5\u35a6\u35a7\u35a8\u35a9\u35aa\u35ab\u35ac\u35ad\u35ae\u35af\u35b0\u35b1\u35b2\u35b3\u35b4\u35b5\u35b6\u35b7\u35b8\u35b9\u35ba\u35bb\u35bc\u35bd\u35be\u35bf\u35c0\u35c1\u35c2\u35c3\u35c4\u35c5\u35c6\u35c7\u35c8\u35c9\u35ca\u35cb\u35cc\u35cd\u35ce\u35cf\u35d0\u35d1\u35d2\u35d3\u35d4\u35d5\u35d6\u35d7\u35d8\u35d9\u35da\u35db\u35dc\u35dd\u35de\u35df\u35e0\u35e1\u35e2\u35e3\u35e4\u35e5\u35e6\u35e7\u35e8\u35e9\u35ea\u35eb\u35ec\u35ed\u35ee\u35ef\u35f0\u35f1\u35f2\u35f3\u35f4\u35f5\u35f6\u35f7\u35f8\u35f9\u35fa\u35fb\u35fc\u35fd\u35fe\u35ff\u3600\u3601\u3602\u3603\u3604\u3605\u3606\u3607\u3608\u3609\u360a\u360b\u360c\u360d\u360e\u360f\u3610\u3611\u3612\u3613\u3614\u3615\u3616\u3617\u3618\u3619\u361a\u361b\u361c\u361d\u361e\u361f\u3620\u3621\u3622\u3623\u3624\u3625\u3626\u3627\u3628\u3629\u362a\u362b\u362c\u362d\u362e\u362f\u3630\u3631\u3632\u3633\u3634\u3635\u3636\u3637\u3638\u3639\u363a\u363b\u363c\u363d\u363e\u363f\u3640\u3641\u3642\u3643\u3644\u3645\u3646\u3647\u3648\u3649\u364a\u364b\u364c\u364d\u364e\u364f\u3650\u3651\u3652\u3653\u3654\u3655\u3656\u3657\u3658\u3659\u365a\u365b\u365c\u365d\u365e\u365f\u3660\u3661\u3662\u3663\u3664\u3665\u3666\u3667\u3668\u3669\u366a\u366b\u366c\u366d\u366e\u366f\u3670\u3671\u3672\u3673\u3674\u3675\u3676\u3677\u3678\u3679\u367a\u367b\u367c\u367d\u367e\u367f\u3680\u3681\u3682\u3683\u3684\u3685\u3686\u3687\u3688\u3689\u368a\u368b\u368c\u368d\u368e\u368f\u3690\u3691\u3692\u3693\u3694\u3695\u3696\u3697\u3698\u3699\u369a\u369b\u369c\u369d\u369e\u369f\u36a0\u36a1\u36a2\u36a3\u36a4\u36a5\u36a6\u36a7\u36a8\u36a9\u36aa\u36ab\u36ac\u36ad\u36ae\u36af\u36b0\u36b1\u36b2\u36b3\u36b4\u36b5\u36b6\u36b7\u36b8\u36b9\u36ba\u36bb\u36bc\u36bd\u36be\u36bf\u36c0\u36c1\u36c2\u36c3\u36c4\u36c5\u36c6\u36c7\u36c8\u36c9\u36ca\u36cb\u36cc\u36cd\u36ce\u36cf\u36d0\u36d1\u36d2\u36d3\u36d4\u36d5\u36d6\u36d7\u36d8\u36d9\u36da\u36db\u36dc\u36dd\u36de\u36df\u36e0\u36e1\u36e2\u36e3\u36e4\u36e5\u36e6\u36e7\u36e8\u36e9\u36ea\u36eb\u36ec\u36ed\u36ee\u36ef\u36f0\u36f1\u36f2\u36f3\u36f4\u36f5\u36f6\u36f7\u36f8\u36f9\u36fa\u36fb\u36fc\u36fd\u36fe\u36ff\u3700\u3701\u3702\u3703\u3704\u3705\u3706\u3707\u3708\u3709\u370a\u370b\u370c\u370d\u370e\u370f\u3710\u3711\u3712\u3713\u3714\u3715\u3716\u3717\u3718\u3719\u371a\u371b\u371c\u371d\u371e\u371f\u3720\u3721\u3722\u3723\u3724\u3725\u3726\u3727\u3728\u3729\u372a\u372b\u372c\u372d\u372e\u372f\u3730\u3731\u3732\u3733\u3734\u3735\u3736\u3737\u3738\u3739\u373a\u373b\u373c\u373d\u373e\u373f\u3740\u3741\u3742\u3743\u3744\u3745\u3746\u3747\u3748\u3749\u374a\u374b\u374c\u374d\u374e\u374f\u3750\u3751\u3752\u3753\u3754\u3755\u3756\u3757\u3758\u3759\u375a\u375b\u375c\u375d\u375e\u375f\u3760\u3761\u3762\u3763\u3764\u3765\u3766\u3767\u3768\u3769\u376a\u376b\u376c\u376d\u376e\u376f\u3770\u3771\u3772\u3773\u3774\u3775\u3776\u3777\u3778\u3779\u377a\u377b\u377c\u377d\u377e\u377f\u3780\u3781\u3782\u3783\u3784\u3785\u3786\u3787\u3788\u3789\u378a\u378b\u378c\u378d\u378e\u378f\u3790\u3791\u3792\u3793\u3794\u3795\u3796\u3797\u3798\u3799\u379a\u379b\u379c\u379d\u379e\u379f\u37a0\u37a1\u37a2\u37a3\u37a4\u37a5\u37a6\u37a7\u37a8\u37a9\u37aa\u37ab\u37ac\u37ad\u37ae\u37af\u37b0\u37b1\u37b2\u37b3\u37b4\u37b5\u37b6\u37b7\u37b8\u37b9\u37ba\u37bb\u37bc\u37bd\u37be\u37bf\u37c0\u37c1\u37c2\u37c3\u37c4\u37c5\u37c6\u37c7\u37c8\u37c9\u37ca\u37cb\u37cc\u37cd\u37ce\u37cf\u37d0\u37d1\u37d2\u37d3\u37d4\u37d5\u37d6\u37d7\u37d8\u37d9\u37da\u37db\u37dc\u37dd\u37de\u37df\u37e0\u37e1\u37e2\u37e3\u37e4\u37e5\u37e6\u37e7\u37e8\u37e9\u37ea\u37eb\u37ec\u37ed\u37ee\u37ef\u37f0\u37f1\u37f2\u37f3\u37f4\u37f5\u37f6\u37f7\u37f8\u37f9\u37fa\u37fb\u37fc\u37fd\u37fe\u37ff\u3800\u3801\u3802\u3803\u3804\u3805\u3806\u3807\u3808\u3809\u380a\u380b\u380c\u380d\u380e\u380f\u3810\u3811\u3812\u3813\u3814\u3815\u3816\u3817\u3818\u3819\u381a\u381b\u381c\u381d\u381e\u381f\u3820\u3821\u3822\u3823\u3824\u3825\u3826\u3827\u3828\u3829\u382a\u382b\u382c\u382d\u382e\u382f\u3830\u3831\u3832\u3833\u3834\u3835\u3836\u3837\u3838\u3839\u383a\u383b\u383c\u383d\u383e\u383f\u3840\u3841\u3842\u3843\u3844\u3845\u3846\u3847\u3848\u3849\u384a\u384b\u384c\u384d\u384e\u384f\u3850\u3851\u3852\u3853\u3854\u3855\u3856\u3857\u3858\u3859\u385a\u385b\u385c\u385d\u385e\u385f\u3860\u3861\u3862\u3863\u3864\u3865\u3866\u3867\u3868\u3869\u386a\u386b\u386c\u386d\u386e\u386f\u3870\u3871\u3872\u3873\u3874\u3875\u3876\u3877\u3878\u3879\u387a\u387b\u387c\u387d\u387e\u387f\u3880\u3881\u3882\u3883\u3884\u3885\u3886\u3887\u3888\u3889\u388a\u388b\u388c\u388d\u388e\u388f\u3890\u3891\u3892\u3893\u3894\u3895\u3896\u3897\u3898\u3899\u389a\u389b\u389c\u389d\u389e\u389f\u38a0\u38a1\u38a2\u38a3\u38a4\u38a5\u38a6\u38a7\u38a8\u38a9\u38aa\u38ab\u38ac\u38ad\u38ae\u38af\u38b0\u38b1\u38b2\u38b3\u38b4\u38b5\u38b6\u38b7\u38b8\u38b9\u38ba\u38bb\u38bc\u38bd\u38be\u38bf\u38c0\u38c1\u38c2\u38c3\u38c4\u38c5\u38c6\u38c7\u38c8\u38c9\u38ca\u38cb\u38cc\u38cd\u38ce\u38cf\u38d0\u38d1\u38d2\u38d3\u38d4\u38d5\u38d6\u38d7\u38d8\u38d9\u38da\u38db\u38dc\u38dd\u38de\u38df\u38e0\u38e1\u38e2\u38e3\u38e4\u38e5\u38e6\u38e7\u38e8\u38e9\u38ea\u38eb\u38ec\u38ed\u38ee\u38ef\u38f0\u38f1\u38f2\u38f3\u38f4\u38f5\u38f6\u38f7\u38f8\u38f9\u38fa\u38fb\u38fc\u38fd\u38fe\u38ff\u3900\u3901\u3902\u3903\u3904\u3905\u3906\u3907\u3908\u3909\u390a\u390b\u390c\u390d\u390e\u390f\u3910\u3911\u3912\u3913\u3914\u3915\u3916\u3917\u3918\u3919\u391a\u391b\u391c\u391d\u391e\u391f\u3920\u3921\u3922\u3923\u3924\u3925\u3926\u3927\u3928\u3929\u392a\u392b\u392c\u392d\u392e\u392f\u3930\u3931\u3932\u3933\u3934\u3935\u3936\u3937\u3938\u3939\u393a\u393b\u393c\u393d\u393e\u393f\u3940\u3941\u3942\u3943\u3944\u3945\u3946\u3947\u3948\u3949\u394a\u394b\u394c\u394d\u394e\u394f\u3950\u3951\u3952\u3953\u3954\u3955\u3956\u3957\u3958\u3959\u395a\u395b\u395c\u395d\u395e\u395f\u3960\u3961\u3962\u3963\u3964\u3965\u3966\u3967\u3968\u3969\u396a\u396b\u396c\u396d\u396e\u396f\u3970\u3971\u3972\u3973\u3974\u3975\u3976\u3977\u3978\u3979\u397a\u397b\u397c\u397d\u397e\u397f\u3980\u3981\u3982\u3983\u3984\u3985\u3986\u3987\u3988\u3989\u398a\u398b\u398c\u398d\u398e\u398f\u3990\u3991\u3992\u3993\u3994\u3995\u3996\u3997\u3998\u3999\u399a\u399b\u399c\u399d\u399e\u399f\u39a0\u39a1\u39a2\u39a3\u39a4\u39a5\u39a6\u39a7\u39a8\u39a9\u39aa\u39ab\u39ac\u39ad\u39ae\u39af\u39b0\u39b1\u39b2\u39b3\u39b4\u39b5\u39b6\u39b7\u39b8\u39b9\u39ba\u39bb\u39bc\u39bd\u39be\u39bf\u39c0\u39c1\u39c2\u39c3\u39c4\u39c5\u39c6\u39c7\u39c8\u39c9\u39ca\u39cb\u39cc\u39cd\u39ce\u39cf\u39d0\u39d1\u39d2\u39d3\u39d4\u39d5\u39d6\u39d7\u39d8\u39d9\u39da\u39db\u39dc\u39dd\u39de\u39df\u39e0\u39e1\u39e2\u39e3\u39e4\u39e5\u39e6\u39e7\u39e8\u39e9\u39ea\u39eb\u39ec\u39ed\u39ee\u39ef\u39f0\u39f1\u39f2\u39f3\u39f4\u39f5\u39f6\u39f7\u39f8\u39f9\u39fa\u39fb\u39fc\u39fd\u39fe\u39ff\u3a00\u3a01\u3a02\u3a03\u3a04\u3a05\u3a06\u3a07\u3a08\u3a09\u3a0a\u3a0b\u3a0c\u3a0d\u3a0e\u3a0f\u3a10\u3a11\u3a12\u3a13\u3a14\u3a15\u3a16\u3a17\u3a18\u3a19\u3a1a\u3a1b\u3a1c\u3a1d\u3a1e\u3a1f\u3a20\u3a21\u3a22\u3a23\u3a24\u3a25\u3a26\u3a27\u3a28\u3a29\u3a2a\u3a2b\u3a2c\u3a2d\u3a2e\u3a2f\u3a30\u3a31\u3a32\u3a33\u3a34\u3a35\u3a36\u3a37\u3a38\u3a39\u3a3a\u3a3b\u3a3c\u3a3d\u3a3e\u3a3f\u3a40\u3a41\u3a42\u3a43\u3a44\u3a45\u3a46\u3a47\u3a48\u3a49\u3a4a\u3a4b\u3a4c\u3a4d\u3a4e\u3a4f\u3a50\u3a51\u3a52\u3a53\u3a54\u3a55\u3a56\u3a57\u3a58\u3a59\u3a5a\u3a5b\u3a5c\u3a5d\u3a5e\u3a5f\u3a60\u3a61\u3a62\u3a63\u3a64\u3a65\u3a66\u3a67\u3a68\u3a69\u3a6a\u3a6b\u3a6c\u3a6d\u3a6e\u3a6f\u3a70\u3a71\u3a72\u3a73\u3a74\u3a75\u3a76\u3a77\u3a78\u3a79\u3a7a\u3a7b\u3a7c\u3a7d\u3a7e\u3a7f\u3a80\u3a81\u3a82\u3a83\u3a84\u3a85\u3a86\u3a87\u3a88\u3a89\u3a8a\u3a8b\u3a8c\u3a8d\u3a8e\u3a8f\u3a90\u3a91\u3a92\u3a93\u3a94\u3a95\u3a96\u3a97\u3a98\u3a99\u3a9a\u3a9b\u3a9c\u3a9d\u3a9e\u3a9f\u3aa0\u3aa1\u3aa2\u3aa3\u3aa4\u3aa5\u3aa6\u3aa7\u3aa8\u3aa9\u3aaa\u3aab\u3aac\u3aad\u3aae\u3aaf\u3ab0\u3ab1\u3ab2\u3ab3\u3ab4\u3ab5\u3ab6\u3ab7\u3ab8\u3ab9\u3aba\u3abb\u3abc\u3abd\u3abe\u3abf\u3ac0\u3ac1\u3ac2\u3ac3\u3ac4\u3ac5\u3ac6\u3ac7\u3ac8\u3ac9\u3aca\u3acb\u3acc\u3acd\u3ace\u3acf\u3ad0\u3ad1\u3ad2\u3ad3\u3ad4\u3ad5\u3ad6\u3ad7\u3ad8\u3ad9\u3ada\u3adb\u3adc\u3add\u3ade\u3adf\u3ae0\u3ae1\u3ae2\u3ae3\u3ae4\u3ae5\u3ae6\u3ae7\u3ae8\u3ae9\u3aea\u3aeb\u3aec\u3aed\u3aee\u3aef\u3af0\u3af1\u3af2\u3af3\u3af4\u3af5\u3af6\u3af7\u3af8\u3af9\u3afa\u3afb\u3afc\u3afd\u3afe\u3aff\u3b00\u3b01\u3b02\u3b03\u3b04\u3b05\u3b06\u3b07\u3b08\u3b09\u3b0a\u3b0b\u3b0c\u3b0d\u3b0e\u3b0f\u3b10\u3b11\u3b12\u3b13\u3b14\u3b15\u3b16\u3b17\u3b18\u3b19\u3b1a\u3b1b\u3b1c\u3b1d\u3b1e\u3b1f\u3b20\u3b21\u3b22\u3b23\u3b24\u3b25\u3b26\u3b27\u3b28\u3b29\u3b2a\u3b2b\u3b2c\u3b2d\u3b2e\u3b2f\u3b30\u3b31\u3b32\u3b33\u3b34\u3b35\u3b36\u3b37\u3b38\u3b39\u3b3a\u3b3b\u3b3c\u3b3d\u3b3e\u3b3f\u3b40\u3b41\u3b42\u3b43\u3b44\u3b45\u3b46\u3b47\u3b48\u3b49\u3b4a\u3b4b\u3b4c\u3b4d\u3b4e\u3b4f\u3b50\u3b51\u3b52\u3b53\u3b54\u3b55\u3b56\u3b57\u3b58\u3b59\u3b5a\u3b5b\u3b5c\u3b5d\u3b5e\u3b5f\u3b60\u3b61\u3b62\u3b63\u3b64\u3b65\u3b66\u3b67\u3b68\u3b69\u3b6a\u3b6b\u3b6c\u3b6d\u3b6e\u3b6f\u3b70\u3b71\u3b72\u3b73\u3b74\u3b75\u3b76\u3b77\u3b78\u3b79\u3b7a\u3b7b\u3b7c\u3b7d\u3b7e\u3b7f\u3b80\u3b81\u3b82\u3b83\u3b84\u3b85\u3b86\u3b87\u3b88\u3b89\u3b8a\u3b8b\u3b8c\u3b8d\u3b8e\u3b8f\u3b90\u3b91\u3b92\u3b93\u3b94\u3b95\u3b96\u3b97\u3b98\u3b99\u3b9a\u3b9b\u3b9c\u3b9d\u3b9e\u3b9f\u3ba0\u3ba1\u3ba2\u3ba3\u3ba4\u3ba5\u3ba6\u3ba7\u3ba8\u3ba9\u3baa\u3bab\u3bac\u3bad\u3bae\u3baf\u3bb0\u3bb1\u3bb2\u3bb3\u3bb4\u3bb5\u3bb6\u3bb7\u3bb8\u3bb9\u3bba\u3bbb\u3bbc\u3bbd\u3bbe\u3bbf\u3bc0\u3bc1\u3bc2\u3bc3\u3bc4\u3bc5\u3bc6\u3bc7\u3bc8\u3bc9\u3bca\u3bcb\u3bcc\u3bcd\u3bce\u3bcf\u3bd0\u3bd1\u3bd2\u3bd3\u3bd4\u3bd5\u3bd6\u3bd7\u3bd8\u3bd9\u3bda\u3bdb\u3bdc\u3bdd\u3bde\u3bdf\u3be0\u3be1\u3be2\u3be3\u3be4\u3be5\u3be6\u3be7\u3be8\u3be9\u3bea\u3beb\u3bec\u3bed\u3bee\u3bef\u3bf0\u3bf1\u3bf2\u3bf3\u3bf4\u3bf5\u3bf6\u3bf7\u3bf8\u3bf9\u3bfa\u3bfb\u3bfc\u3bfd\u3bfe\u3bff\u3c00\u3c01\u3c02\u3c03\u3c04\u3c05\u3c06\u3c07\u3c08\u3c09\u3c0a\u3c0b\u3c0c\u3c0d\u3c0e\u3c0f\u3c10\u3c11\u3c12\u3c13\u3c14\u3c15\u3c16\u3c17\u3c18\u3c19\u3c1a\u3c1b\u3c1c\u3c1d\u3c1e\u3c1f\u3c20\u3c21\u3c22\u3c23\u3c24\u3c25\u3c26\u3c27\u3c28\u3c29\u3c2a\u3c2b\u3c2c\u3c2d\u3c2e\u3c2f\u3c30\u3c31\u3c32\u3c33\u3c34\u3c35\u3c36\u3c37\u3c38\u3c39\u3c3a\u3c3b\u3c3c\u3c3d\u3c3e\u3c3f\u3c40\u3c41\u3c42\u3c43\u3c44\u3c45\u3c46\u3c47\u3c48\u3c49\u3c4a\u3c4b\u3c4c\u3c4d\u3c4e\u3c4f\u3c50\u3c51\u3c52\u3c53\u3c54\u3c55\u3c56\u3c57\u3c58\u3c59\u3c5a\u3c5b\u3c5c\u3c5d\u3c5e\u3c5f\u3c60\u3c61\u3c62\u3c63\u3c64\u3c65\u3c66\u3c67\u3c68\u3c69\u3c6a\u3c6b\u3c6c\u3c6d\u3c6e\u3c6f\u3c70\u3c71\u3c72\u3c73\u3c74\u3c75\u3c76\u3c77\u3c78\u3c79\u3c7a\u3c7b\u3c7c\u3c7d\u3c7e\u3c7f\u3c80\u3c81\u3c82\u3c83\u3c84\u3c85\u3c86\u3c87\u3c88\u3c89\u3c8a\u3c8b\u3c8c\u3c8d\u3c8e\u3c8f\u3c90\u3c91\u3c92\u3c93\u3c94\u3c95\u3c96\u3c97\u3c98\u3c99\u3c9a\u3c9b\u3c9c\u3c9d\u3c9e\u3c9f\u3ca0\u3ca1\u3ca2\u3ca3\u3ca4\u3ca5\u3ca6\u3ca7\u3ca8\u3ca9\u3caa\u3cab\u3cac\u3cad\u3cae\u3caf\u3cb0\u3cb1\u3cb2\u3cb3\u3cb4\u3cb5\u3cb6\u3cb7\u3cb8\u3cb9\u3cba\u3cbb\u3cbc\u3cbd\u3cbe\u3cbf\u3cc0\u3cc1\u3cc2\u3cc3\u3cc4\u3cc5\u3cc6\u3cc7\u3cc8\u3cc9\u3cca\u3ccb\u3ccc\u3ccd\u3cce\u3ccf\u3cd0\u3cd1\u3cd2\u3cd3\u3cd4\u3cd5\u3cd6\u3cd7\u3cd8\u3cd9\u3cda\u3cdb\u3cdc\u3cdd\u3cde\u3cdf\u3ce0\u3ce1\u3ce2\u3ce3\u3ce4\u3ce5\u3ce6\u3ce7\u3ce8\u3ce9\u3cea\u3ceb\u3cec\u3ced\u3cee\u3cef\u3cf0\u3cf1\u3cf2\u3cf3\u3cf4\u3cf5\u3cf6\u3cf7\u3cf8\u3cf9\u3cfa\u3cfb\u3cfc\u3cfd\u3cfe\u3cff\u3d00\u3d01\u3d02\u3d03\u3d04\u3d05\u3d06\u3d07\u3d08\u3d09\u3d0a\u3d0b\u3d0c\u3d0d\u3d0e\u3d0f\u3d10\u3d11\u3d12\u3d13\u3d14\u3d15\u3d16\u3d17\u3d18\u3d19\u3d1a\u3d1b\u3d1c\u3d1d\u3d1e\u3d1f\u3d20\u3d21\u3d22\u3d23\u3d24\u3d25\u3d26\u3d27\u3d28\u3d29\u3d2a\u3d2b\u3d2c\u3d2d\u3d2e\u3d2f\u3d30\u3d31\u3d32\u3d33\u3d34\u3d35\u3d36\u3d37\u3d38\u3d39\u3d3a\u3d3b\u3d3c\u3d3d\u3d3e\u3d3f\u3d40\u3d41\u3d42\u3d43\u3d44\u3d45\u3d46\u3d47\u3d48\u3d49\u3d4a\u3d4b\u3d4c\u3d4d\u3d4e\u3d4f\u3d50\u3d51\u3d52\u3d53\u3d54\u3d55\u3d56\u3d57\u3d58\u3d59\u3d5a\u3d5b\u3d5c\u3d5d\u3d5e\u3d5f\u3d60\u3d61\u3d62\u3d63\u3d64\u3d65\u3d66\u3d67\u3d68\u3d69\u3d6a\u3d6b\u3d6c\u3d6d\u3d6e\u3d6f\u3d70\u3d71\u3d72\u3d73\u3d74\u3d75\u3d76\u3d77\u3d78\u3d79\u3d7a\u3d7b\u3d7c\u3d7d\u3d7e\u3d7f\u3d80\u3d81\u3d82\u3d83\u3d84\u3d85\u3d86\u3d87\u3d88\u3d89\u3d8a\u3d8b\u3d8c\u3d8d\u3d8e\u3d8f\u3d90\u3d91\u3d92\u3d93\u3d94\u3d95\u3d96\u3d97\u3d98\u3d99\u3d9a\u3d9b\u3d9c\u3d9d\u3d9e\u3d9f\u3da0\u3da1\u3da2\u3da3\u3da4\u3da5\u3da6\u3da7\u3da8\u3da9\u3daa\u3dab\u3dac\u3dad\u3dae\u3daf\u3db0\u3db1\u3db2\u3db3\u3db4\u3db5\u3db6\u3db7\u3db8\u3db9\u3dba\u3dbb\u3dbc\u3dbd\u3dbe\u3dbf\u3dc0\u3dc1\u3dc2\u3dc3\u3dc4\u3dc5\u3dc6\u3dc7\u3dc8\u3dc9\u3dca\u3dcb\u3dcc\u3dcd\u3dce\u3dcf\u3dd0\u3dd1\u3dd2\u3dd3\u3dd4\u3dd5\u3dd6\u3dd7\u3dd8\u3dd9\u3dda\u3ddb\u3ddc\u3ddd\u3dde\u3ddf\u3de0\u3de1\u3de2\u3de3\u3de4\u3de5\u3de6\u3de7\u3de8\u3de9\u3dea\u3deb\u3dec\u3ded\u3dee\u3def\u3df0\u3df1\u3df2\u3df3\u3df4\u3df5\u3df6\u3df7\u3df8\u3df9\u3dfa\u3dfb\u3dfc\u3dfd\u3dfe\u3dff\u3e00\u3e01\u3e02\u3e03\u3e04\u3e05\u3e06\u3e07\u3e08\u3e09\u3e0a\u3e0b\u3e0c\u3e0d\u3e0e\u3e0f\u3e10\u3e11\u3e12\u3e13\u3e14\u3e15\u3e16\u3e17\u3e18\u3e19\u3e1a\u3e1b\u3e1c\u3e1d\u3e1e\u3e1f\u3e20\u3e21\u3e22\u3e23\u3e24\u3e25\u3e26\u3e27\u3e28\u3e29\u3e2a\u3e2b\u3e2c\u3e2d\u3e2e\u3e2f\u3e30\u3e31\u3e32\u3e33\u3e34\u3e35\u3e36\u3e37\u3e38\u3e39\u3e3a\u3e3b\u3e3c\u3e3d\u3e3e\u3e3f\u3e40\u3e41\u3e42\u3e43\u3e44\u3e45\u3e46\u3e47\u3e48\u3e49\u3e4a\u3e4b\u3e4c\u3e4d\u3e4e\u3e4f\u3e50\u3e51\u3e52\u3e53\u3e54\u3e55\u3e56\u3e57\u3e58\u3e59\u3e5a\u3e5b\u3e5c\u3e5d\u3e5e\u3e5f\u3e60\u3e61\u3e62\u3e63\u3e64\u3e65\u3e66\u3e67\u3e68\u3e69\u3e6a\u3e6b\u3e6c\u3e6d\u3e6e\u3e6f\u3e70\u3e71\u3e72\u3e73\u3e74\u3e75\u3e76\u3e77\u3e78\u3e79\u3e7a\u3e7b\u3e7c\u3e7d\u3e7e\u3e7f\u3e80\u3e81\u3e82\u3e83\u3e84\u3e85\u3e86\u3e87\u3e88\u3e89\u3e8a\u3e8b\u3e8c\u3e8d\u3e8e\u3e8f\u3e90\u3e91\u3e92\u3e93\u3e94\u3e95\u3e96\u3e97\u3e98\u3e99\u3e9a\u3e9b\u3e9c\u3e9d\u3e9e\u3e9f\u3ea0\u3ea1\u3ea2\u3ea3\u3ea4\u3ea5\u3ea6\u3ea7\u3ea8\u3ea9\u3eaa\u3eab\u3eac\u3ead\u3eae\u3eaf\u3eb0\u3eb1\u3eb2\u3eb3\u3eb4\u3eb5\u3eb6\u3eb7\u3eb8\u3eb9\u3eba\u3ebb\u3ebc\u3ebd\u3ebe\u3ebf\u3ec0\u3ec1\u3ec2\u3ec3\u3ec4\u3ec5\u3ec6\u3ec7\u3ec8\u3ec9\u3eca\u3ecb\u3ecc\u3ecd\u3ece\u3ecf\u3ed0\u3ed1\u3ed2\u3ed3\u3ed4\u3ed5\u3ed6\u3ed7\u3ed8\u3ed9\u3eda\u3edb\u3edc\u3edd\u3ede\u3edf\u3ee0\u3ee1\u3ee2\u3ee3\u3ee4\u3ee5\u3ee6\u3ee7\u3ee8\u3ee9\u3eea\u3eeb\u3eec\u3eed\u3eee\u3eef\u3ef0\u3ef1\u3ef2\u3ef3\u3ef4\u3ef5\u3ef6\u3ef7\u3ef8\u3ef9\u3efa\u3efb\u3efc\u3efd\u3efe\u3eff\u3f00\u3f01\u3f02\u3f03\u3f04\u3f05\u3f06\u3f07\u3f08\u3f09\u3f0a\u3f0b\u3f0c\u3f0d\u3f0e\u3f0f\u3f10\u3f11\u3f12\u3f13\u3f14\u3f15\u3f16\u3f17\u3f18\u3f19\u3f1a\u3f1b\u3f1c\u3f1d\u3f1e\u3f1f\u3f20\u3f21\u3f22\u3f23\u3f24\u3f25\u3f26\u3f27\u3f28\u3f29\u3f2a\u3f2b\u3f2c\u3f2d\u3f2e\u3f2f\u3f30\u3f31\u3f32\u3f33\u3f34\u3f35\u3f36\u3f37\u3f38\u3f39\u3f3a\u3f3b\u3f3c\u3f3d\u3f3e\u3f3f\u3f40\u3f41\u3f42\u3f43\u3f44\u3f45\u3f46\u3f47\u3f48\u3f49\u3f4a\u3f4b\u3f4c\u3f4d\u3f4e\u3f4f\u3f50\u3f51\u3f52\u3f53\u3f54\u3f55\u3f56\u3f57\u3f58\u3f59\u3f5a\u3f5b\u3f5c\u3f5d\u3f5e\u3f5f\u3f60\u3f61\u3f62\u3f63\u3f64\u3f65\u3f66\u3f67\u3f68\u3f69\u3f6a\u3f6b\u3f6c\u3f6d\u3f6e\u3f6f\u3f70\u3f71\u3f72\u3f73\u3f74\u3f75\u3f76\u3f77\u3f78\u3f79\u3f7a\u3f7b\u3f7c\u3f7d\u3f7e\u3f7f\u3f80\u3f81\u3f82\u3f83\u3f84\u3f85\u3f86\u3f87\u3f88\u3f89\u3f8a\u3f8b\u3f8c\u3f8d\u3f8e\u3f8f\u3f90\u3f91\u3f92\u3f93\u3f94\u3f95\u3f96\u3f97\u3f98\u3f99\u3f9a\u3f9b\u3f9c\u3f9d\u3f9e\u3f9f\u3fa0\u3fa1\u3fa2\u3fa3\u3fa4\u3fa5\u3fa6\u3fa7\u3fa8\u3fa9\u3faa\u3fab\u3fac\u3fad\u3fae\u3faf\u3fb0\u3fb1\u3fb2\u3fb3\u3fb4\u3fb5\u3fb6\u3fb7\u3fb8\u3fb9\u3fba\u3fbb\u3fbc\u3fbd\u3fbe\u3fbf\u3fc0\u3fc1\u3fc2\u3fc3\u3fc4\u3fc5\u3fc6\u3fc7\u3fc8\u3fc9\u3fca\u3fcb\u3fcc\u3fcd\u3fce\u3fcf\u3fd0\u3fd1\u3fd2\u3fd3\u3fd4\u3fd5\u3fd6\u3fd7\u3fd8\u3fd9\u3fda\u3fdb\u3fdc\u3fdd\u3fde\u3fdf\u3fe0\u3fe1\u3fe2\u3fe3\u3fe4\u3fe5\u3fe6\u3fe7\u3fe8\u3fe9\u3fea\u3feb\u3fec\u3fed\u3fee\u3fef\u3ff0\u3ff1\u3ff2\u3ff3\u3ff4\u3ff5\u3ff6\u3ff7\u3ff8\u3ff9\u3ffa\u3ffb\u3ffc\u3ffd\u3ffe\u3fff\u4000\u4001\u4002\u4003\u4004\u4005\u4006\u4007\u4008\u4009\u400a\u400b\u400c\u400d\u400e\u400f\u4010\u4011\u4012\u4013\u4014\u4015\u4016\u4017\u4018\u4019\u401a\u401b\u401c\u401d\u401e\u401f\u4020\u4021\u4022\u4023\u4024\u4025\u4026\u4027\u4028\u4029\u402a\u402b\u402c\u402d\u402e\u402f\u4030\u4031\u4032\u4033\u4034\u4035\u4036\u4037\u4038\u4039\u403a\u403b\u403c\u403d\u403e\u403f\u4040\u4041\u4042\u4043\u4044\u4045\u4046\u4047\u4048\u4049\u404a\u404b\u404c\u404d\u404e\u404f\u4050\u4051\u4052\u4053\u4054\u4055\u4056\u4057\u4058\u4059\u405a\u405b\u405c\u405d\u405e\u405f\u4060\u4061\u4062\u4063\u4064\u4065\u4066\u4067\u4068\u4069\u406a\u406b\u406c\u406d\u406e\u406f\u4070\u4071\u4072\u4073\u4074\u4075\u4076\u4077\u4078\u4079\u407a\u407b\u407c\u407d\u407e\u407f\u4080\u4081\u4082\u4083\u4084\u4085\u4086\u4087\u4088\u4089\u408a\u408b\u408c\u408d\u408e\u408f\u4090\u4091\u4092\u4093\u4094\u4095\u4096\u4097\u4098\u4099\u409a\u409b\u409c\u409d\u409e\u409f\u40a0\u40a1\u40a2\u40a3\u40a4\u40a5\u40a6\u40a7\u40a8\u40a9\u40aa\u40ab\u40ac\u40ad\u40ae\u40af\u40b0\u40b1\u40b2\u40b3\u40b4\u40b5\u40b6\u40b7\u40b8\u40b9\u40ba\u40bb\u40bc\u40bd\u40be\u40bf\u40c0\u40c1\u40c2\u40c3\u40c4\u40c5\u40c6\u40c7\u40c8\u40c9\u40ca\u40cb\u40cc\u40cd\u40ce\u40cf\u40d0\u40d1\u40d2\u40d3\u40d4\u40d5\u40d6\u40d7\u40d8\u40d9\u40da\u40db\u40dc\u40dd\u40de\u40df\u40e0\u40e1\u40e2\u40e3\u40e4\u40e5\u40e6\u40e7\u40e8\u40e9\u40ea\u40eb\u40ec\u40ed\u40ee\u40ef\u40f0\u40f1\u40f2\u40f3\u40f4\u40f5\u40f6\u40f7\u40f8\u40f9\u40fa\u40fb\u40fc\u40fd\u40fe\u40ff\u4100\u4101\u4102\u4103\u4104\u4105\u4106\u4107\u4108\u4109\u410a\u410b\u410c\u410d\u410e\u410f\u4110\u4111\u4112\u4113\u4114\u4115\u4116\u4117\u4118\u4119\u411a\u411b\u411c\u411d\u411e\u411f\u4120\u4121\u4122\u4123\u4124\u4125\u4126\u4127\u4128\u4129\u412a\u412b\u412c\u412d\u412e\u412f\u4130\u4131\u4132\u4133\u4134\u4135\u4136\u4137\u4138\u4139\u413a\u413b\u413c\u413d\u413e\u413f\u4140\u4141\u4142\u4143\u4144\u4145\u4146\u4147\u4148\u4149\u414a\u414b\u414c\u414d\u414e\u414f\u4150\u4151\u4152\u4153\u4154\u4155\u4156\u4157\u4158\u4159\u415a\u415b\u415c\u415d\u415e\u415f\u4160\u4161\u4162\u4163\u4164\u4165\u4166\u4167\u4168\u4169\u416a\u416b\u416c\u416d\u416e\u416f\u4170\u4171\u4172\u4173\u4174\u4175\u4176\u4177\u4178\u4179\u417a\u417b\u417c\u417d\u417e\u417f\u4180\u4181\u4182\u4183\u4184\u4185\u4186\u4187\u4188\u4189\u418a\u418b\u418c\u418d\u418e\u418f\u4190\u4191\u4192\u4193\u4194\u4195\u4196\u4197\u4198\u4199\u419a\u419b\u419c\u419d\u419e\u419f\u41a0\u41a1\u41a2\u41a3\u41a4\u41a5\u41a6\u41a7\u41a8\u41a9\u41aa\u41ab\u41ac\u41ad\u41ae\u41af\u41b0\u41b1\u41b2\u41b3\u41b4\u41b5\u41b6\u41b7\u41b8\u41b9\u41ba\u41bb\u41bc\u41bd\u41be\u41bf\u41c0\u41c1\u41c2\u41c3\u41c4\u41c5\u41c6\u41c7\u41c8\u41c9\u41ca\u41cb\u41cc\u41cd\u41ce\u41cf\u41d0\u41d1\u41d2\u41d3\u41d4\u41d5\u41d6\u41d7\u41d8\u41d9\u41da\u41db\u41dc\u41dd\u41de\u41df\u41e0\u41e1\u41e2\u41e3\u41e4\u41e5\u41e6\u41e7\u41e8\u41e9\u41ea\u41eb\u41ec\u41ed\u41ee\u41ef\u41f0\u41f1\u41f2\u41f3\u41f4\u41f5\u41f6\u41f7\u41f8\u41f9\u41fa\u41fb\u41fc\u41fd\u41fe\u41ff\u4200\u4201\u4202\u4203\u4204\u4205\u4206\u4207\u4208\u4209\u420a\u420b\u420c\u420d\u420e\u420f\u4210\u4211\u4212\u4213\u4214\u4215\u4216\u4217\u4218\u4219\u421a\u421b\u421c\u421d\u421e\u421f\u4220\u4221\u4222\u4223\u4224\u4225\u4226\u4227\u4228\u4229\u422a\u422b\u422c\u422d\u422e\u422f\u4230\u4231\u4232\u4233\u4234\u4235\u4236\u4237\u4238\u4239\u423a\u423b\u423c\u423d\u423e\u423f\u4240\u4241\u4242\u4243\u4244\u4245\u4246\u4247\u4248\u4249\u424a\u424b\u424c\u424d\u424e\u424f\u4250\u4251\u4252\u4253\u4254\u4255\u4256\u4257\u4258\u4259\u425a\u425b\u425c\u425d\u425e\u425f\u4260\u4261\u4262\u4263\u4264\u4265\u4266\u4267\u4268\u4269\u426a\u426b\u426c\u426d\u426e\u426f\u4270\u4271\u4272\u4273\u4274\u4275\u4276\u4277\u4278\u4279\u427a\u427b\u427c\u427d\u427e\u427f\u4280\u4281\u4282\u4283\u4284\u4285\u4286\u4287\u4288\u4289\u428a\u428b\u428c\u428d\u428e\u428f\u4290\u4291\u4292\u4293\u4294\u4295\u4296\u4297\u4298\u4299\u429a\u429b\u429c\u429d\u429e\u429f\u42a0\u42a1\u42a2\u42a3\u42a4\u42a5\u42a6\u42a7\u42a8\u42a9\u42aa\u42ab\u42ac\u42ad\u42ae\u42af\u42b0\u42b1\u42b2\u42b3\u42b4\u42b5\u42b6\u42b7\u42b8\u42b9\u42ba\u42bb\u42bc\u42bd\u42be\u42bf\u42c0\u42c1\u42c2\u42c3\u42c4\u42c5\u42c6\u42c7\u42c8\u42c9\u42ca\u42cb\u42cc\u42cd\u42ce\u42cf\u42d0\u42d1\u42d2\u42d3\u42d4\u42d5\u42d6\u42d7\u42d8\u42d9\u42da\u42db\u42dc\u42dd\u42de\u42df\u42e0\u42e1\u42e2\u42e3\u42e4\u42e5\u42e6\u42e7\u42e8\u42e9\u42ea\u42eb\u42ec\u42ed\u42ee\u42ef\u42f0\u42f1\u42f2\u42f3\u42f4\u42f5\u42f6\u42f7\u42f8\u42f9\u42fa\u42fb\u42fc\u42fd\u42fe\u42ff\u4300\u4301\u4302\u4303\u4304\u4305\u4306\u4307\u4308\u4309\u430a\u430b\u430c\u430d\u430e\u430f\u4310\u4311\u4312\u4313\u4314\u4315\u4316\u4317\u4318\u4319\u431a\u431b\u431c\u431d\u431e\u431f\u4320\u4321\u4322\u4323\u4324\u4325\u4326\u4327\u4328\u4329\u432a\u432b\u432c\u432d\u432e\u432f\u4330\u4331\u4332\u4333\u4334\u4335\u4336\u4337\u4338\u4339\u433a\u433b\u433c\u433d\u433e\u433f\u4340\u4341\u4342\u4343\u4344\u4345\u4346\u4347\u4348\u4349\u434a\u434b\u434c\u434d\u434e\u434f\u4350\u4351\u4352\u4353\u4354\u4355\u4356\u4357\u4358\u4359\u435a\u435b\u435c\u435d\u435e\u435f\u4360\u4361\u4362\u4363\u4364\u4365\u4366\u4367\u4368\u4369\u436a\u436b\u436c\u436d\u436e\u436f\u4370\u4371\u4372\u4373\u4374\u4375\u4376\u4377\u4378\u4379\u437a\u437b\u437c\u437d\u437e\u437f\u4380\u4381\u4382\u4383\u4384\u4385\u4386\u4387\u4388\u4389\u438a\u438b\u438c\u438d\u438e\u438f\u4390\u4391\u4392\u4393\u4394\u4395\u4396\u4397\u4398\u4399\u439a\u439b\u439c\u439d\u439e\u439f\u43a0\u43a1\u43a2\u43a3\u43a4\u43a5\u43a6\u43a7\u43a8\u43a9\u43aa\u43ab\u43ac\u43ad\u43ae\u43af\u43b0\u43b1\u43b2\u43b3\u43b4\u43b5\u43b6\u43b7\u43b8\u43b9\u43ba\u43bb\u43bc\u43bd\u43be\u43bf\u43c0\u43c1\u43c2\u43c3\u43c4\u43c5\u43c6\u43c7\u43c8\u43c9\u43ca\u43cb\u43cc\u43cd\u43ce\u43cf\u43d0\u43d1\u43d2\u43d3\u43d4\u43d5\u43d6\u43d7\u43d8\u43d9\u43da\u43db\u43dc\u43dd\u43de\u43df\u43e0\u43e1\u43e2\u43e3\u43e4\u43e5\u43e6\u43e7\u43e8\u43e9\u43ea\u43eb\u43ec\u43ed\u43ee\u43ef\u43f0\u43f1\u43f2\u43f3\u43f4\u43f5\u43f6\u43f7\u43f8\u43f9\u43fa\u43fb\u43fc\u43fd\u43fe\u43ff\u4400\u4401\u4402\u4403\u4404\u4405\u4406\u4407\u4408\u4409\u440a\u440b\u440c\u440d\u440e\u440f\u4410\u4411\u4412\u4413\u4414\u4415\u4416\u4417\u4418\u4419\u441a\u441b\u441c\u441d\u441e\u441f\u4420\u4421\u4422\u4423\u4424\u4425\u4426\u4427\u4428\u4429\u442a\u442b\u442c\u442d\u442e\u442f\u4430\u4431\u4432\u4433\u4434\u4435\u4436\u4437\u4438\u4439\u443a\u443b\u443c\u443d\u443e\u443f\u4440\u4441\u4442\u4443\u4444\u4445\u4446\u4447\u4448\u4449\u444a\u444b\u444c\u444d\u444e\u444f\u4450\u4451\u4452\u4453\u4454\u4455\u4456\u4457\u4458\u4459\u445a\u445b\u445c\u445d\u445e\u445f\u4460\u4461\u4462\u4463\u4464\u4465\u4466\u4467\u4468\u4469\u446a\u446b\u446c\u446d\u446e\u446f\u4470\u4471\u4472\u4473\u4474\u4475\u4476\u4477\u4478\u4479\u447a\u447b\u447c\u447d\u447e\u447f\u4480\u4481\u4482\u4483\u4484\u4485\u4486\u4487\u4488\u4489\u448a\u448b\u448c\u448d\u448e\u448f\u4490\u4491\u4492\u4493\u4494\u4495\u4496\u4497\u4498\u4499\u449a\u449b\u449c\u449d\u449e\u449f\u44a0\u44a1\u44a2\u44a3\u44a4\u44a5\u44a6\u44a7\u44a8\u44a9\u44aa\u44ab\u44ac\u44ad\u44ae\u44af\u44b0\u44b1\u44b2\u44b3\u44b4\u44b5\u44b6\u44b7\u44b8\u44b9\u44ba\u44bb\u44bc\u44bd\u44be\u44bf\u44c0\u44c1\u44c2\u44c3\u44c4\u44c5\u44c6\u44c7\u44c8\u44c9\u44ca\u44cb\u44cc\u44cd\u44ce\u44cf\u44d0\u44d1\u44d2\u44d3\u44d4\u44d5\u44d6\u44d7\u44d8\u44d9\u44da\u44db\u44dc\u44dd\u44de\u44df\u44e0\u44e1\u44e2\u44e3\u44e4\u44e5\u44e6\u44e7\u44e8\u44e9\u44ea\u44eb\u44ec\u44ed\u44ee\u44ef\u44f0\u44f1\u44f2\u44f3\u44f4\u44f5\u44f6\u44f7\u44f8\u44f9\u44fa\u44fb\u44fc\u44fd\u44fe\u44ff\u4500\u4501\u4502\u4503\u4504\u4505\u4506\u4507\u4508\u4509\u450a\u450b\u450c\u450d\u450e\u450f\u4510\u4511\u4512\u4513\u4514\u4515\u4516\u4517\u4518\u4519\u451a\u451b\u451c\u451d\u451e\u451f\u4520\u4521\u4522\u4523\u4524\u4525\u4526\u4527\u4528\u4529\u452a\u452b\u452c\u452d\u452e\u452f\u4530\u4531\u4532\u4533\u4534\u4535\u4536\u4537\u4538\u4539\u453a\u453b\u453c\u453d\u453e\u453f\u4540\u4541\u4542\u4543\u4544\u4545\u4546\u4547\u4548\u4549\u454a\u454b\u454c\u454d\u454e\u454f\u4550\u4551\u4552\u4553\u4554\u4555\u4556\u4557\u4558\u4559\u455a\u455b\u455c\u455d\u455e\u455f\u4560\u4561\u4562\u4563\u4564\u4565\u4566\u4567\u4568\u4569\u456a\u456b\u456c\u456d\u456e\u456f\u4570\u4571\u4572\u4573\u4574\u4575\u4576\u4577\u4578\u4579\u457a\u457b\u457c\u457d\u457e\u457f\u4580\u4581\u4582\u4583\u4584\u4585\u4586\u4587\u4588\u4589\u458a\u458b\u458c\u458d\u458e\u458f\u4590\u4591\u4592\u4593\u4594\u4595\u4596\u4597\u4598\u4599\u459a\u459b\u459c\u459d\u459e\u459f\u45a0\u45a1\u45a2\u45a3\u45a4\u45a5\u45a6\u45a7\u45a8\u45a9\u45aa\u45ab\u45ac\u45ad\u45ae\u45af\u45b0\u45b1\u45b2\u45b3\u45b4\u45b5\u45b6\u45b7\u45b8\u45b9\u45ba\u45bb\u45bc\u45bd\u45be\u45bf\u45c0\u45c1\u45c2\u45c3\u45c4\u45c5\u45c6\u45c7\u45c8\u45c9\u45ca\u45cb\u45cc\u45cd\u45ce\u45cf\u45d0\u45d1\u45d2\u45d3\u45d4\u45d5\u45d6\u45d7\u45d8\u45d9\u45da\u45db\u45dc\u45dd\u45de\u45df\u45e0\u45e1\u45e2\u45e3\u45e4\u45e5\u45e6\u45e7\u45e8\u45e9\u45ea\u45eb\u45ec\u45ed\u45ee\u45ef\u45f0\u45f1\u45f2\u45f3\u45f4\u45f5\u45f6\u45f7\u45f8\u45f9\u45fa\u45fb\u45fc\u45fd\u45fe\u45ff\u4600\u4601\u4602\u4603\u4604\u4605\u4606\u4607\u4608\u4609\u460a\u460b\u460c\u460d\u460e\u460f\u4610\u4611\u4612\u4613\u4614\u4615\u4616\u4617\u4618\u4619\u461a\u461b\u461c\u461d\u461e\u461f\u4620\u4621\u4622\u4623\u4624\u4625\u4626\u4627\u4628\u4629\u462a\u462b\u462c\u462d\u462e\u462f\u4630\u4631\u4632\u4633\u4634\u4635\u4636\u4637\u4638\u4639\u463a\u463b\u463c\u463d\u463e\u463f\u4640\u4641\u4642\u4643\u4644\u4645\u4646\u4647\u4648\u4649\u464a\u464b\u464c\u464d\u464e\u464f\u4650\u4651\u4652\u4653\u4654\u4655\u4656\u4657\u4658\u4659\u465a\u465b\u465c\u465d\u465e\u465f\u4660\u4661\u4662\u4663\u4664\u4665\u4666\u4667\u4668\u4669\u466a\u466b\u466c\u466d\u466e\u466f\u4670\u4671\u4672\u4673\u4674\u4675\u4676\u4677\u4678\u4679\u467a\u467b\u467c\u467d\u467e\u467f\u4680\u4681\u4682\u4683\u4684\u4685\u4686\u4687\u4688\u4689\u468a\u468b\u468c\u468d\u468e\u468f\u4690\u4691\u4692\u4693\u4694\u4695\u4696\u4697\u4698\u4699\u469a\u469b\u469c\u469d\u469e\u469f\u46a0\u46a1\u46a2\u46a3\u46a4\u46a5\u46a6\u46a7\u46a8\u46a9\u46aa\u46ab\u46ac\u46ad\u46ae\u46af\u46b0\u46b1\u46b2\u46b3\u46b4\u46b5\u46b6\u46b7\u46b8\u46b9\u46ba\u46bb\u46bc\u46bd\u46be\u46bf\u46c0\u46c1\u46c2\u46c3\u46c4\u46c5\u46c6\u46c7\u46c8\u46c9\u46ca\u46cb\u46cc\u46cd\u46ce\u46cf\u46d0\u46d1\u46d2\u46d3\u46d4\u46d5\u46d6\u46d7\u46d8\u46d9\u46da\u46db\u46dc\u46dd\u46de\u46df\u46e0\u46e1\u46e2\u46e3\u46e4\u46e5\u46e6\u46e7\u46e8\u46e9\u46ea\u46eb\u46ec\u46ed\u46ee\u46ef\u46f0\u46f1\u46f2\u46f3\u46f4\u46f5\u46f6\u46f7\u46f8\u46f9\u46fa\u46fb\u46fc\u46fd\u46fe\u46ff\u4700\u4701\u4702\u4703\u4704\u4705\u4706\u4707\u4708\u4709\u470a\u470b\u470c\u470d\u470e\u470f\u4710\u4711\u4712\u4713\u4714\u4715\u4716\u4717\u4718\u4719\u471a\u471b\u471c\u471d\u471e\u471f\u4720\u4721\u4722\u4723\u4724\u4725\u4726\u4727\u4728\u4729\u472a\u472b\u472c\u472d\u472e\u472f\u4730\u4731\u4732\u4733\u4734\u4735\u4736\u4737\u4738\u4739\u473a\u473b\u473c\u473d\u473e\u473f\u4740\u4741\u4742\u4743\u4744\u4745\u4746\u4747\u4748\u4749\u474a\u474b\u474c\u474d\u474e\u474f\u4750\u4751\u4752\u4753\u4754\u4755\u4756\u4757\u4758\u4759\u475a\u475b\u475c\u475d\u475e\u475f\u4760\u4761\u4762\u4763\u4764\u4765\u4766\u4767\u4768\u4769\u476a\u476b\u476c\u476d\u476e\u476f\u4770\u4771\u4772\u4773\u4774\u4775\u4776\u4777\u4778\u4779\u477a\u477b\u477c\u477d\u477e\u477f\u4780\u4781\u4782\u4783\u4784\u4785\u4786\u4787\u4788\u4789\u478a\u478b\u478c\u478d\u478e\u478f\u4790\u4791\u4792\u4793\u4794\u4795\u4796\u4797\u4798\u4799\u479a\u479b\u479c\u479d\u479e\u479f\u47a0\u47a1\u47a2\u47a3\u47a4\u47a5\u47a6\u47a7\u47a8\u47a9\u47aa\u47ab\u47ac\u47ad\u47ae\u47af\u47b0\u47b1\u47b2\u47b3\u47b4\u47b5\u47b6\u47b7\u47b8\u47b9\u47ba\u47bb\u47bc\u47bd\u47be\u47bf\u47c0\u47c1\u47c2\u47c3\u47c4\u47c5\u47c6\u47c7\u47c8\u47c9\u47ca\u47cb\u47cc\u47cd\u47ce\u47cf\u47d0\u47d1\u47d2\u47d3\u47d4\u47d5\u47d6\u47d7\u47d8\u47d9\u47da\u47db\u47dc\u47dd\u47de\u47df\u47e0\u47e1\u47e2\u47e3\u47e4\u47e5\u47e6\u47e7\u47e8\u47e9\u47ea\u47eb\u47ec\u47ed\u47ee\u47ef\u47f0\u47f1\u47f2\u47f3\u47f4\u47f5\u47f6\u47f7\u47f8\u47f9\u47fa\u47fb\u47fc\u47fd\u47fe\u47ff\u4800\u4801\u4802\u4803\u4804\u4805\u4806\u4807\u4808\u4809\u480a\u480b\u480c\u480d\u480e\u480f\u4810\u4811\u4812\u4813\u4814\u4815\u4816\u4817\u4818\u4819\u481a\u481b\u481c\u481d\u481e\u481f\u4820\u4821\u4822\u4823\u4824\u4825\u4826\u4827\u4828\u4829\u482a\u482b\u482c\u482d\u482e\u482f\u4830\u4831\u4832\u4833\u4834\u4835\u4836\u4837\u4838\u4839\u483a\u483b\u483c\u483d\u483e\u483f\u4840\u4841\u4842\u4843\u4844\u4845\u4846\u4847\u4848\u4849\u484a\u484b\u484c\u484d\u484e\u484f\u4850\u4851\u4852\u4853\u4854\u4855\u4856\u4857\u4858\u4859\u485a\u485b\u485c\u485d\u485e\u485f\u4860\u4861\u4862\u4863\u4864\u4865\u4866\u4867\u4868\u4869\u486a\u486b\u486c\u486d\u486e\u486f\u4870\u4871\u4872\u4873\u4874\u4875\u4876\u4877\u4878\u4879\u487a\u487b\u487c\u487d\u487e\u487f\u4880\u4881\u4882\u4883\u4884\u4885\u4886\u4887\u4888\u4889\u488a\u488b\u488c\u488d\u488e\u488f\u4890\u4891\u4892\u4893\u4894\u4895\u4896\u4897\u4898\u4899\u489a\u489b\u489c\u489d\u489e\u489f\u48a0\u48a1\u48a2\u48a3\u48a4\u48a5\u48a6\u48a7\u48a8\u48a9\u48aa\u48ab\u48ac\u48ad\u48ae\u48af\u48b0\u48b1\u48b2\u48b3\u48b4\u48b5\u48b6\u48b7\u48b8\u48b9\u48ba\u48bb\u48bc\u48bd\u48be\u48bf\u48c0\u48c1\u48c2\u48c3\u48c4\u48c5\u48c6\u48c7\u48c8\u48c9\u48ca\u48cb\u48cc\u48cd\u48ce\u48cf\u48d0\u48d1\u48d2\u48d3\u48d4\u48d5\u48d6\u48d7\u48d8\u48d9\u48da\u48db\u48dc\u48dd\u48de\u48df\u48e0\u48e1\u48e2\u48e3\u48e4\u48e5\u48e6\u48e7\u48e8\u48e9\u48ea\u48eb\u48ec\u48ed\u48ee\u48ef\u48f0\u48f1\u48f2\u48f3\u48f4\u48f5\u48f6\u48f7\u48f8\u48f9\u48fa\u48fb\u48fc\u48fd\u48fe\u48ff\u4900\u4901\u4902\u4903\u4904\u4905\u4906\u4907\u4908\u4909\u490a\u490b\u490c\u490d\u490e\u490f\u4910\u4911\u4912\u4913\u4914\u4915\u4916\u4917\u4918\u4919\u491a\u491b\u491c\u491d\u491e\u491f\u4920\u4921\u4922\u4923\u4924\u4925\u4926\u4927\u4928\u4929\u492a\u492b\u492c\u492d\u492e\u492f\u4930\u4931\u4932\u4933\u4934\u4935\u4936\u4937\u4938\u4939\u493a\u493b\u493c\u493d\u493e\u493f\u4940\u4941\u4942\u4943\u4944\u4945\u4946\u4947\u4948\u4949\u494a\u494b\u494c\u494d\u494e\u494f\u4950\u4951\u4952\u4953\u4954\u4955\u4956\u4957\u4958\u4959\u495a\u495b\u495c\u495d\u495e\u495f\u4960\u4961\u4962\u4963\u4964\u4965\u4966\u4967\u4968\u4969\u496a\u496b\u496c\u496d\u496e\u496f\u4970\u4971\u4972\u4973\u4974\u4975\u4976\u4977\u4978\u4979\u497a\u497b\u497c\u497d\u497e\u497f\u4980\u4981\u4982\u4983\u4984\u4985\u4986\u4987\u4988\u4989\u498a\u498b\u498c\u498d\u498e\u498f\u4990\u4991\u4992\u4993\u4994\u4995\u4996\u4997\u4998\u4999\u499a\u499b\u499c\u499d\u499e\u499f\u49a0\u49a1\u49a2\u49a3\u49a4\u49a5\u49a6\u49a7\u49a8\u49a9\u49aa\u49ab\u49ac\u49ad\u49ae\u49af\u49b0\u49b1\u49b2\u49b3\u49b4\u49b5\u49b6\u49b7\u49b8\u49b9\u49ba\u49bb\u49bc\u49bd\u49be\u49bf\u49c0\u49c1\u49c2\u49c3\u49c4\u49c5\u49c6\u49c7\u49c8\u49c9\u49ca\u49cb\u49cc\u49cd\u49ce\u49cf\u49d0\u49d1\u49d2\u49d3\u49d4\u49d5\u49d6\u49d7\u49d8\u49d9\u49da\u49db\u49dc\u49dd\u49de\u49df\u49e0\u49e1\u49e2\u49e3\u49e4\u49e5\u49e6\u49e7\u49e8\u49e9\u49ea\u49eb\u49ec\u49ed\u49ee\u49ef\u49f0\u49f1\u49f2\u49f3\u49f4\u49f5\u49f6\u49f7\u49f8\u49f9\u49fa\u49fb\u49fc\u49fd\u49fe\u49ff\u4a00\u4a01\u4a02\u4a03\u4a04\u4a05\u4a06\u4a07\u4a08\u4a09\u4a0a\u4a0b\u4a0c\u4a0d\u4a0e\u4a0f\u4a10\u4a11\u4a12\u4a13\u4a14\u4a15\u4a16\u4a17\u4a18\u4a19\u4a1a\u4a1b\u4a1c\u4a1d\u4a1e\u4a1f\u4a20\u4a21\u4a22\u4a23\u4a24\u4a25\u4a26\u4a27\u4a28\u4a29\u4a2a\u4a2b\u4a2c\u4a2d\u4a2e\u4a2f\u4a30\u4a31\u4a32\u4a33\u4a34\u4a35\u4a36\u4a37\u4a38\u4a39\u4a3a\u4a3b\u4a3c\u4a3d\u4a3e\u4a3f\u4a40\u4a41\u4a42\u4a43\u4a44\u4a45\u4a46\u4a47\u4a48\u4a49\u4a4a\u4a4b\u4a4c\u4a4d\u4a4e\u4a4f\u4a50\u4a51\u4a52\u4a53\u4a54\u4a55\u4a56\u4a57\u4a58\u4a59\u4a5a\u4a5b\u4a5c\u4a5d\u4a5e\u4a5f\u4a60\u4a61\u4a62\u4a63\u4a64\u4a65\u4a66\u4a67\u4a68\u4a69\u4a6a\u4a6b\u4a6c\u4a6d\u4a6e\u4a6f\u4a70\u4a71\u4a72\u4a73\u4a74\u4a75\u4a76\u4a77\u4a78\u4a79\u4a7a\u4a7b\u4a7c\u4a7d\u4a7e\u4a7f\u4a80\u4a81\u4a82\u4a83\u4a84\u4a85\u4a86\u4a87\u4a88\u4a89\u4a8a\u4a8b\u4a8c\u4a8d\u4a8e\u4a8f\u4a90\u4a91\u4a92\u4a93\u4a94\u4a95\u4a96\u4a97\u4a98\u4a99\u4a9a\u4a9b\u4a9c\u4a9d\u4a9e\u4a9f\u4aa0\u4aa1\u4aa2\u4aa3\u4aa4\u4aa5\u4aa6\u4aa7\u4aa8\u4aa9\u4aaa\u4aab\u4aac\u4aad\u4aae\u4aaf\u4ab0\u4ab1\u4ab2\u4ab3\u4ab4\u4ab5\u4ab6\u4ab7\u4ab8\u4ab9\u4aba\u4abb\u4abc\u4abd\u4abe\u4abf\u4ac0\u4ac1\u4ac2\u4ac3\u4ac4\u4ac5\u4ac6\u4ac7\u4ac8\u4ac9\u4aca\u4acb\u4acc\u4acd\u4ace\u4acf\u4ad0\u4ad1\u4ad2\u4ad3\u4ad4\u4ad5\u4ad6\u4ad7\u4ad8\u4ad9\u4ada\u4adb\u4adc\u4add\u4ade\u4adf\u4ae0\u4ae1\u4ae2\u4ae3\u4ae4\u4ae5\u4ae6\u4ae7\u4ae8\u4ae9\u4aea\u4aeb\u4aec\u4aed\u4aee\u4aef\u4af0\u4af1\u4af2\u4af3\u4af4\u4af5\u4af6\u4af7\u4af8\u4af9\u4afa\u4afb\u4afc\u4afd\u4afe\u4aff\u4b00\u4b01\u4b02\u4b03\u4b04\u4b05\u4b06\u4b07\u4b08\u4b09\u4b0a\u4b0b\u4b0c\u4b0d\u4b0e\u4b0f\u4b10\u4b11\u4b12\u4b13\u4b14\u4b15\u4b16\u4b17\u4b18\u4b19\u4b1a\u4b1b\u4b1c\u4b1d\u4b1e\u4b1f\u4b20\u4b21\u4b22\u4b23\u4b24\u4b25\u4b26\u4b27\u4b28\u4b29\u4b2a\u4b2b\u4b2c\u4b2d\u4b2e\u4b2f\u4b30\u4b31\u4b32\u4b33\u4b34\u4b35\u4b36\u4b37\u4b38\u4b39\u4b3a\u4b3b\u4b3c\u4b3d\u4b3e\u4b3f\u4b40\u4b41\u4b42\u4b43\u4b44\u4b45\u4b46\u4b47\u4b48\u4b49\u4b4a\u4b4b\u4b4c\u4b4d\u4b4e\u4b4f\u4b50\u4b51\u4b52\u4b53\u4b54\u4b55\u4b56\u4b57\u4b58\u4b59\u4b5a\u4b5b\u4b5c\u4b5d\u4b5e\u4b5f\u4b60\u4b61\u4b62\u4b63\u4b64\u4b65\u4b66\u4b67\u4b68\u4b69\u4b6a\u4b6b\u4b6c\u4b6d\u4b6e\u4b6f\u4b70\u4b71\u4b72\u4b73\u4b74\u4b75\u4b76\u4b77\u4b78\u4b79\u4b7a\u4b7b\u4b7c\u4b7d\u4b7e\u4b7f\u4b80\u4b81\u4b82\u4b83\u4b84\u4b85\u4b86\u4b87\u4b88\u4b89\u4b8a\u4b8b\u4b8c\u4b8d\u4b8e\u4b8f\u4b90\u4b91\u4b92\u4b93\u4b94\u4b95\u4b96\u4b97\u4b98\u4b99\u4b9a\u4b9b\u4b9c\u4b9d\u4b9e\u4b9f\u4ba0\u4ba1\u4ba2\u4ba3\u4ba4\u4ba5\u4ba6\u4ba7\u4ba8\u4ba9\u4baa\u4bab\u4bac\u4bad\u4bae\u4baf\u4bb0\u4bb1\u4bb2\u4bb3\u4bb4\u4bb5\u4bb6\u4bb7\u4bb8\u4bb9\u4bba\u4bbb\u4bbc\u4bbd\u4bbe\u4bbf\u4bc0\u4bc1\u4bc2\u4bc3\u4bc4\u4bc5\u4bc6\u4bc7\u4bc8\u4bc9\u4bca\u4bcb\u4bcc\u4bcd\u4bce\u4bcf\u4bd0\u4bd1\u4bd2\u4bd3\u4bd4\u4bd5\u4bd6\u4bd7\u4bd8\u4bd9\u4bda\u4bdb\u4bdc\u4bdd\u4bde\u4bdf\u4be0\u4be1\u4be2\u4be3\u4be4\u4be5\u4be6\u4be7\u4be8\u4be9\u4bea\u4beb\u4bec\u4bed\u4bee\u4bef\u4bf0\u4bf1\u4bf2\u4bf3\u4bf4\u4bf5\u4bf6\u4bf7\u4bf8\u4bf9\u4bfa\u4bfb\u4bfc\u4bfd\u4bfe\u4bff\u4c00\u4c01\u4c02\u4c03\u4c04\u4c05\u4c06\u4c07\u4c08\u4c09\u4c0a\u4c0b\u4c0c\u4c0d\u4c0e\u4c0f\u4c10\u4c11\u4c12\u4c13\u4c14\u4c15\u4c16\u4c17\u4c18\u4c19\u4c1a\u4c1b\u4c1c\u4c1d\u4c1e\u4c1f\u4c20\u4c21\u4c22\u4c23\u4c24\u4c25\u4c26\u4c27\u4c28\u4c29\u4c2a\u4c2b\u4c2c\u4c2d\u4c2e\u4c2f\u4c30\u4c31\u4c32\u4c33\u4c34\u4c35\u4c36\u4c37\u4c38\u4c39\u4c3a\u4c3b\u4c3c\u4c3d\u4c3e\u4c3f\u4c40\u4c41\u4c42\u4c43\u4c44\u4c45\u4c46\u4c47\u4c48\u4c49\u4c4a\u4c4b\u4c4c\u4c4d\u4c4e\u4c4f\u4c50\u4c51\u4c52\u4c53\u4c54\u4c55\u4c56\u4c57\u4c58\u4c59\u4c5a\u4c5b\u4c5c\u4c5d\u4c5e\u4c5f\u4c60\u4c61\u4c62\u4c63\u4c64\u4c65\u4c66\u4c67\u4c68\u4c69\u4c6a\u4c6b\u4c6c\u4c6d\u4c6e\u4c6f\u4c70\u4c71\u4c72\u4c73\u4c74\u4c75\u4c76\u4c77\u4c78\u4c79\u4c7a\u4c7b\u4c7c\u4c7d\u4c7e\u4c7f\u4c80\u4c81\u4c82\u4c83\u4c84\u4c85\u4c86\u4c87\u4c88\u4c89\u4c8a\u4c8b\u4c8c\u4c8d\u4c8e\u4c8f\u4c90\u4c91\u4c92\u4c93\u4c94\u4c95\u4c96\u4c97\u4c98\u4c99\u4c9a\u4c9b\u4c9c\u4c9d\u4c9e\u4c9f\u4ca0\u4ca1\u4ca2\u4ca3\u4ca4\u4ca5\u4ca6\u4ca7\u4ca8\u4ca9\u4caa\u4cab\u4cac\u4cad\u4cae\u4caf\u4cb0\u4cb1\u4cb2\u4cb3\u4cb4\u4cb5\u4cb6\u4cb7\u4cb8\u4cb9\u4cba\u4cbb\u4cbc\u4cbd\u4cbe\u4cbf\u4cc0\u4cc1\u4cc2\u4cc3\u4cc4\u4cc5\u4cc6\u4cc7\u4cc8\u4cc9\u4cca\u4ccb\u4ccc\u4ccd\u4cce\u4ccf\u4cd0\u4cd1\u4cd2\u4cd3\u4cd4\u4cd5\u4cd6\u4cd7\u4cd8\u4cd9\u4cda\u4cdb\u4cdc\u4cdd\u4cde\u4cdf\u4ce0\u4ce1\u4ce2\u4ce3\u4ce4\u4ce5\u4ce6\u4ce7\u4ce8\u4ce9\u4cea\u4ceb\u4cec\u4ced\u4cee\u4cef\u4cf0\u4cf1\u4cf2\u4cf3\u4cf4\u4cf5\u4cf6\u4cf7\u4cf8\u4cf9\u4cfa\u4cfb\u4cfc\u4cfd\u4cfe\u4cff\u4d00\u4d01\u4d02\u4d03\u4d04\u4d05\u4d06\u4d07\u4d08\u4d09\u4d0a\u4d0b\u4d0c\u4d0d\u4d0e\u4d0f\u4d10\u4d11\u4d12\u4d13\u4d14\u4d15\u4d16\u4d17\u4d18\u4d19\u4d1a\u4d1b\u4d1c\u4d1d\u4d1e\u4d1f\u4d20\u4d21\u4d22\u4d23\u4d24\u4d25\u4d26\u4d27\u4d28\u4d29\u4d2a\u4d2b\u4d2c\u4d2d\u4d2e\u4d2f\u4d30\u4d31\u4d32\u4d33\u4d34\u4d35\u4d36\u4d37\u4d38\u4d39\u4d3a\u4d3b\u4d3c\u4d3d\u4d3e\u4d3f\u4d40\u4d41\u4d42\u4d43\u4d44\u4d45\u4d46\u4d47\u4d48\u4d49\u4d4a\u4d4b\u4d4c\u4d4d\u4d4e\u4d4f\u4d50\u4d51\u4d52\u4d53\u4d54\u4d55\u4d56\u4d57\u4d58\u4d59\u4d5a\u4d5b\u4d5c\u4d5d\u4d5e\u4d5f\u4d60\u4d61\u4d62\u4d63\u4d64\u4d65\u4d66\u4d67\u4d68\u4d69\u4d6a\u4d6b\u4d6c\u4d6d\u4d6e\u4d6f\u4d70\u4d71\u4d72\u4d73\u4d74\u4d75\u4d76\u4d77\u4d78\u4d79\u4d7a\u4d7b\u4d7c\u4d7d\u4d7e\u4d7f\u4d80\u4d81\u4d82\u4d83\u4d84\u4d85\u4d86\u4d87\u4d88\u4d89\u4d8a\u4d8b\u4d8c\u4d8d\u4d8e\u4d8f\u4d90\u4d91\u4d92\u4d93\u4d94\u4d95\u4d96\u4d97\u4d98\u4d99\u4d9a\u4d9b\u4d9c\u4d9d\u4d9e\u4d9f\u4da0\u4da1\u4da2\u4da3\u4da4\u4da5\u4da6\u4da7\u4da8\u4da9\u4daa\u4dab\u4dac\u4dad\u4dae\u4daf\u4db0\u4db1\u4db2\u4db3\u4db4\u4db5\u4e00\u4e01\u4e02\u4e03\u4e04\u4e05\u4e06\u4e07\u4e08\u4e09\u4e0a\u4e0b\u4e0c\u4e0d\u4e0e\u4e0f\u4e10\u4e11\u4e12\u4e13\u4e14\u4e15\u4e16\u4e17\u4e18\u4e19\u4e1a\u4e1b\u4e1c\u4e1d\u4e1e\u4e1f\u4e20\u4e21\u4e22\u4e23\u4e24\u4e25\u4e26\u4e27\u4e28\u4e29\u4e2a\u4e2b\u4e2c\u4e2d\u4e2e\u4e2f\u4e30\u4e31\u4e32\u4e33\u4e34\u4e35\u4e36\u4e37\u4e38\u4e39\u4e3a\u4e3b\u4e3c\u4e3d\u4e3e\u4e3f\u4e40\u4e41\u4e42\u4e43\u4e44\u4e45\u4e46\u4e47\u4e48\u4e49\u4e4a\u4e4b\u4e4c\u4e4d\u4e4e\u4e4f\u4e50\u4e51\u4e52\u4e53\u4e54\u4e55\u4e56\u4e57\u4e58\u4e59\u4e5a\u4e5b\u4e5c\u4e5d\u4e5e\u4e5f\u4e60\u4e61\u4e62\u4e63\u4e64\u4e65\u4e66\u4e67\u4e68\u4e69\u4e6a\u4e6b\u4e6c\u4e6d\u4e6e\u4e6f\u4e70\u4e71\u4e72\u4e73\u4e74\u4e75\u4e76\u4e77\u4e78\u4e79\u4e7a\u4e7b\u4e7c\u4e7d\u4e7e\u4e7f\u4e80\u4e81\u4e82\u4e83\u4e84\u4e85\u4e86\u4e87\u4e88\u4e89\u4e8a\u4e8b\u4e8c\u4e8d\u4e8e\u4e8f\u4e90\u4e91\u4e92\u4e93\u4e94\u4e95\u4e96\u4e97\u4e98\u4e99\u4e9a\u4e9b\u4e9c\u4e9d\u4e9e\u4e9f\u4ea0\u4ea1\u4ea2\u4ea3\u4ea4\u4ea5\u4ea6\u4ea7\u4ea8\u4ea9\u4eaa\u4eab\u4eac\u4ead\u4eae\u4eaf\u4eb0\u4eb1\u4eb2\u4eb3\u4eb4\u4eb5\u4eb6\u4eb7\u4eb8\u4eb9\u4eba\u4ebb\u4ebc\u4ebd\u4ebe\u4ebf\u4ec0\u4ec1\u4ec2\u4ec3\u4ec4\u4ec5\u4ec6\u4ec7\u4ec8\u4ec9\u4eca\u4ecb\u4ecc\u4ecd\u4ece\u4ecf\u4ed0\u4ed1\u4ed2\u4ed3\u4ed4\u4ed5\u4ed6\u4ed7\u4ed8\u4ed9\u4eda\u4edb\u4edc\u4edd\u4ede\u4edf\u4ee0\u4ee1\u4ee2\u4ee3\u4ee4\u4ee5\u4ee6\u4ee7\u4ee8\u4ee9\u4eea\u4eeb\u4eec\u4eed\u4eee\u4eef\u4ef0\u4ef1\u4ef2\u4ef3\u4ef4\u4ef5\u4ef6\u4ef7\u4ef8\u4ef9\u4efa\u4efb\u4efc\u4efd\u4efe\u4eff\u4f00\u4f01\u4f02\u4f03\u4f04\u4f05\u4f06\u4f07\u4f08\u4f09\u4f0a\u4f0b\u4f0c\u4f0d\u4f0e\u4f0f\u4f10\u4f11\u4f12\u4f13\u4f14\u4f15\u4f16\u4f17\u4f18\u4f19\u4f1a\u4f1b\u4f1c\u4f1d\u4f1e\u4f1f\u4f20\u4f21\u4f22\u4f23\u4f24\u4f25\u4f26\u4f27\u4f28\u4f29\u4f2a\u4f2b\u4f2c\u4f2d\u4f2e\u4f2f\u4f30\u4f31\u4f32\u4f33\u4f34\u4f35\u4f36\u4f37\u4f38\u4f39\u4f3a\u4f3b\u4f3c\u4f3d\u4f3e\u4f3f\u4f40\u4f41\u4f42\u4f43\u4f44\u4f45\u4f46\u4f47\u4f48\u4f49\u4f4a\u4f4b\u4f4c\u4f4d\u4f4e\u4f4f\u4f50\u4f51\u4f52\u4f53\u4f54\u4f55\u4f56\u4f57\u4f58\u4f59\u4f5a\u4f5b\u4f5c\u4f5d\u4f5e\u4f5f\u4f60\u4f61\u4f62\u4f63\u4f64\u4f65\u4f66\u4f67\u4f68\u4f69\u4f6a\u4f6b\u4f6c\u4f6d\u4f6e\u4f6f\u4f70\u4f71\u4f72\u4f73\u4f74\u4f75\u4f76\u4f77\u4f78\u4f79\u4f7a\u4f7b\u4f7c\u4f7d\u4f7e\u4f7f\u4f80\u4f81\u4f82\u4f83\u4f84\u4f85\u4f86\u4f87\u4f88\u4f89\u4f8a\u4f8b\u4f8c\u4f8d\u4f8e\u4f8f\u4f90\u4f91\u4f92\u4f93\u4f94\u4f95\u4f96\u4f97\u4f98\u4f99\u4f9a\u4f9b\u4f9c\u4f9d\u4f9e\u4f9f\u4fa0\u4fa1\u4fa2\u4fa3\u4fa4\u4fa5\u4fa6\u4fa7\u4fa8\u4fa9\u4faa\u4fab\u4fac\u4fad\u4fae\u4faf\u4fb0\u4fb1\u4fb2\u4fb3\u4fb4\u4fb5\u4fb6\u4fb7\u4fb8\u4fb9\u4fba\u4fbb\u4fbc\u4fbd\u4fbe\u4fbf\u4fc0\u4fc1\u4fc2\u4fc3\u4fc4\u4fc5\u4fc6\u4fc7\u4fc8\u4fc9\u4fca\u4fcb\u4fcc\u4fcd\u4fce\u4fcf\u4fd0\u4fd1\u4fd2\u4fd3\u4fd4\u4fd5\u4fd6\u4fd7\u4fd8\u4fd9\u4fda\u4fdb\u4fdc\u4fdd\u4fde\u4fdf\u4fe0\u4fe1\u4fe2\u4fe3\u4fe4\u4fe5\u4fe6\u4fe7\u4fe8\u4fe9\u4fea\u4feb\u4fec\u4fed\u4fee\u4fef\u4ff0\u4ff1\u4ff2\u4ff3\u4ff4\u4ff5\u4ff6\u4ff7\u4ff8\u4ff9\u4ffa\u4ffb\u4ffc\u4ffd\u4ffe\u4fff\u5000\u5001\u5002\u5003\u5004\u5005\u5006\u5007\u5008\u5009\u500a\u500b\u500c\u500d\u500e\u500f\u5010\u5011\u5012\u5013\u5014\u5015\u5016\u5017\u5018\u5019\u501a\u501b\u501c\u501d\u501e\u501f\u5020\u5021\u5022\u5023\u5024\u5025\u5026\u5027\u5028\u5029\u502a\u502b\u502c\u502d\u502e\u502f\u5030\u5031\u5032\u5033\u5034\u5035\u5036\u5037\u5038\u5039\u503a\u503b\u503c\u503d\u503e\u503f\u5040\u5041\u5042\u5043\u5044\u5045\u5046\u5047\u5048\u5049\u504a\u504b\u504c\u504d\u504e\u504f\u5050\u5051\u5052\u5053\u5054\u5055\u5056\u5057\u5058\u5059\u505a\u505b\u505c\u505d\u505e\u505f\u5060\u5061\u5062\u5063\u5064\u5065\u5066\u5067\u5068\u5069\u506a\u506b\u506c\u506d\u506e\u506f\u5070\u5071\u5072\u5073\u5074\u5075\u5076\u5077\u5078\u5079\u507a\u507b\u507c\u507d\u507e\u507f\u5080\u5081\u5082\u5083\u5084\u5085\u5086\u5087\u5088\u5089\u508a\u508b\u508c\u508d\u508e\u508f\u5090\u5091\u5092\u5093\u5094\u5095\u5096\u5097\u5098\u5099\u509a\u509b\u509c\u509d\u509e\u509f\u50a0\u50a1\u50a2\u50a3\u50a4\u50a5\u50a6\u50a7\u50a8\u50a9\u50aa\u50ab\u50ac\u50ad\u50ae\u50af\u50b0\u50b1\u50b2\u50b3\u50b4\u50b5\u50b6\u50b7\u50b8\u50b9\u50ba\u50bb\u50bc\u50bd\u50be\u50bf\u50c0\u50c1\u50c2\u50c3\u50c4\u50c5\u50c6\u50c7\u50c8\u50c9\u50ca\u50cb\u50cc\u50cd\u50ce\u50cf\u50d0\u50d1\u50d2\u50d3\u50d4\u50d5\u50d6\u50d7\u50d8\u50d9\u50da\u50db\u50dc\u50dd\u50de\u50df\u50e0\u50e1\u50e2\u50e3\u50e4\u50e5\u50e6\u50e7\u50e8\u50e9\u50ea\u50eb\u50ec\u50ed\u50ee\u50ef\u50f0\u50f1\u50f2\u50f3\u50f4\u50f5\u50f6\u50f7\u50f8\u50f9\u50fa\u50fb\u50fc\u50fd\u50fe\u50ff\u5100\u5101\u5102\u5103\u5104\u5105\u5106\u5107\u5108\u5109\u510a\u510b\u510c\u510d\u510e\u510f\u5110\u5111\u5112\u5113\u5114\u5115\u5116\u5117\u5118\u5119\u511a\u511b\u511c\u511d\u511e\u511f\u5120\u5121\u5122\u5123\u5124\u5125\u5126\u5127\u5128\u5129\u512a\u512b\u512c\u512d\u512e\u512f\u5130\u5131\u5132\u5133\u5134\u5135\u5136\u5137\u5138\u5139\u513a\u513b\u513c\u513d\u513e\u513f\u5140\u5141\u5142\u5143\u5144\u5145\u5146\u5147\u5148\u5149\u514a\u514b\u514c\u514d\u514e\u514f\u5150\u5151\u5152\u5153\u5154\u5155\u5156\u5157\u5158\u5159\u515a\u515b\u515c\u515d\u515e\u515f\u5160\u5161\u5162\u5163\u5164\u5165\u5166\u5167\u5168\u5169\u516a\u516b\u516c\u516d\u516e\u516f\u5170\u5171\u5172\u5173\u5174\u5175\u5176\u5177\u5178\u5179\u517a\u517b\u517c\u517d\u517e\u517f\u5180\u5181\u5182\u5183\u5184\u5185\u5186\u5187\u5188\u5189\u518a\u518b\u518c\u518d\u518e\u518f\u5190\u5191\u5192\u5193\u5194\u5195\u5196\u5197\u5198\u5199\u519a\u519b\u519c\u519d\u519e\u519f\u51a0\u51a1\u51a2\u51a3\u51a4\u51a5\u51a6\u51a7\u51a8\u51a9\u51aa\u51ab\u51ac\u51ad\u51ae\u51af\u51b0\u51b1\u51b2\u51b3\u51b4\u51b5\u51b6\u51b7\u51b8\u51b9\u51ba\u51bb\u51bc\u51bd\u51be\u51bf\u51c0\u51c1\u51c2\u51c3\u51c4\u51c5\u51c6\u51c7\u51c8\u51c9\u51ca\u51cb\u51cc\u51cd\u51ce\u51cf\u51d0\u51d1\u51d2\u51d3\u51d4\u51d5\u51d6\u51d7\u51d8\u51d9\u51da\u51db\u51dc\u51dd\u51de\u51df\u51e0\u51e1\u51e2\u51e3\u51e4\u51e5\u51e6\u51e7\u51e8\u51e9\u51ea\u51eb\u51ec\u51ed\u51ee\u51ef\u51f0\u51f1\u51f2\u51f3\u51f4\u51f5\u51f6\u51f7\u51f8\u51f9\u51fa\u51fb\u51fc\u51fd\u51fe\u51ff\u5200\u5201\u5202\u5203\u5204\u5205\u5206\u5207\u5208\u5209\u520a\u520b\u520c\u520d\u520e\u520f\u5210\u5211\u5212\u5213\u5214\u5215\u5216\u5217\u5218\u5219\u521a\u521b\u521c\u521d\u521e\u521f\u5220\u5221\u5222\u5223\u5224\u5225\u5226\u5227\u5228\u5229\u522a\u522b\u522c\u522d\u522e\u522f\u5230\u5231\u5232\u5233\u5234\u5235\u5236\u5237\u5238\u5239\u523a\u523b\u523c\u523d\u523e\u523f\u5240\u5241\u5242\u5243\u5244\u5245\u5246\u5247\u5248\u5249\u524a\u524b\u524c\u524d\u524e\u524f\u5250\u5251\u5252\u5253\u5254\u5255\u5256\u5257\u5258\u5259\u525a\u525b\u525c\u525d\u525e\u525f\u5260\u5261\u5262\u5263\u5264\u5265\u5266\u5267\u5268\u5269\u526a\u526b\u526c\u526d\u526e\u526f\u5270\u5271\u5272\u5273\u5274\u5275\u5276\u5277\u5278\u5279\u527a\u527b\u527c\u527d\u527e\u527f\u5280\u5281\u5282\u5283\u5284\u5285\u5286\u5287\u5288\u5289\u528a\u528b\u528c\u528d\u528e\u528f\u5290\u5291\u5292\u5293\u5294\u5295\u5296\u5297\u5298\u5299\u529a\u529b\u529c\u529d\u529e\u529f\u52a0\u52a1\u52a2\u52a3\u52a4\u52a5\u52a6\u52a7\u52a8\u52a9\u52aa\u52ab\u52ac\u52ad\u52ae\u52af\u52b0\u52b1\u52b2\u52b3\u52b4\u52b5\u52b6\u52b7\u52b8\u52b9\u52ba\u52bb\u52bc\u52bd\u52be\u52bf\u52c0\u52c1\u52c2\u52c3\u52c4\u52c5\u52c6\u52c7\u52c8\u52c9\u52ca\u52cb\u52cc\u52cd\u52ce\u52cf\u52d0\u52d1\u52d2\u52d3\u52d4\u52d5\u52d6\u52d7\u52d8\u52d9\u52da\u52db\u52dc\u52dd\u52de\u52df\u52e0\u52e1\u52e2\u52e3\u52e4\u52e5\u52e6\u52e7\u52e8\u52e9\u52ea\u52eb\u52ec\u52ed\u52ee\u52ef\u52f0\u52f1\u52f2\u52f3\u52f4\u52f5\u52f6\u52f7\u52f8\u52f9\u52fa\u52fb\u52fc\u52fd\u52fe\u52ff\u5300\u5301\u5302\u5303\u5304\u5305\u5306\u5307\u5308\u5309\u530a\u530b\u530c\u530d\u530e\u530f\u5310\u5311\u5312\u5313\u5314\u5315\u5316\u5317\u5318\u5319\u531a\u531b\u531c\u531d\u531e\u531f\u5320\u5321\u5322\u5323\u5324\u5325\u5326\u5327\u5328\u5329\u532a\u532b\u532c\u532d\u532e\u532f\u5330\u5331\u5332\u5333\u5334\u5335\u5336\u5337\u5338\u5339\u533a\u533b\u533c\u533d\u533e\u533f\u5340\u5341\u5342\u5343\u5344\u5345\u5346\u5347\u5348\u5349\u534a\u534b\u534c\u534d\u534e\u534f\u5350\u5351\u5352\u5353\u5354\u5355\u5356\u5357\u5358\u5359\u535a\u535b\u535c\u535d\u535e\u535f\u5360\u5361\u5362\u5363\u5364\u5365\u5366\u5367\u5368\u5369\u536a\u536b\u536c\u536d\u536e\u536f\u5370\u5371\u5372\u5373\u5374\u5375\u5376\u5377\u5378\u5379\u537a\u537b\u537c\u537d\u537e\u537f\u5380\u5381\u5382\u5383\u5384\u5385\u5386\u5387\u5388\u5389\u538a\u538b\u538c\u538d\u538e\u538f\u5390\u5391\u5392\u5393\u5394\u5395\u5396\u5397\u5398\u5399\u539a\u539b\u539c\u539d\u539e\u539f\u53a0\u53a1\u53a2\u53a3\u53a4\u53a5\u53a6\u53a7\u53a8\u53a9\u53aa\u53ab\u53ac\u53ad\u53ae\u53af\u53b0\u53b1\u53b2\u53b3\u53b4\u53b5\u53b6\u53b7\u53b8\u53b9\u53ba\u53bb\u53bc\u53bd\u53be\u53bf\u53c0\u53c1\u53c2\u53c3\u53c4\u53c5\u53c6\u53c7\u53c8\u53c9\u53ca\u53cb\u53cc\u53cd\u53ce\u53cf\u53d0\u53d1\u53d2\u53d3\u53d4\u53d5\u53d6\u53d7\u53d8\u53d9\u53da\u53db\u53dc\u53dd\u53de\u53df\u53e0\u53e1\u53e2\u53e3\u53e4\u53e5\u53e6\u53e7\u53e8\u53e9\u53ea\u53eb\u53ec\u53ed\u53ee\u53ef\u53f0\u53f1\u53f2\u53f3\u53f4\u53f5\u53f6\u53f7\u53f8\u53f9\u53fa\u53fb\u53fc\u53fd\u53fe\u53ff\u5400\u5401\u5402\u5403\u5404\u5405\u5406\u5407\u5408\u5409\u540a\u540b\u540c\u540d\u540e\u540f\u5410\u5411\u5412\u5413\u5414\u5415\u5416\u5417\u5418\u5419\u541a\u541b\u541c\u541d\u541e\u541f\u5420\u5421\u5422\u5423\u5424\u5425\u5426\u5427\u5428\u5429\u542a\u542b\u542c\u542d\u542e\u542f\u5430\u5431\u5432\u5433\u5434\u5435\u5436\u5437\u5438\u5439\u543a\u543b\u543c\u543d\u543e\u543f\u5440\u5441\u5442\u5443\u5444\u5445\u5446\u5447\u5448\u5449\u544a\u544b\u544c\u544d\u544e\u544f\u5450\u5451\u5452\u5453\u5454\u5455\u5456\u5457\u5458\u5459\u545a\u545b\u545c\u545d\u545e\u545f\u5460\u5461\u5462\u5463\u5464\u5465\u5466\u5467\u5468\u5469\u546a\u546b\u546c\u546d\u546e\u546f\u5470\u5471\u5472\u5473\u5474\u5475\u5476\u5477\u5478\u5479\u547a\u547b\u547c\u547d\u547e\u547f\u5480\u5481\u5482\u5483\u5484\u5485\u5486\u5487\u5488\u5489\u548a\u548b\u548c\u548d\u548e\u548f\u5490\u5491\u5492\u5493\u5494\u5495\u5496\u5497\u5498\u5499\u549a\u549b\u549c\u549d\u549e\u549f\u54a0\u54a1\u54a2\u54a3\u54a4\u54a5\u54a6\u54a7\u54a8\u54a9\u54aa\u54ab\u54ac\u54ad\u54ae\u54af\u54b0\u54b1\u54b2\u54b3\u54b4\u54b5\u54b6\u54b7\u54b8\u54b9\u54ba\u54bb\u54bc\u54bd\u54be\u54bf\u54c0\u54c1\u54c2\u54c3\u54c4\u54c5\u54c6\u54c7\u54c8\u54c9\u54ca\u54cb\u54cc\u54cd\u54ce\u54cf\u54d0\u54d1\u54d2\u54d3\u54d4\u54d5\u54d6\u54d7\u54d8\u54d9\u54da\u54db\u54dc\u54dd\u54de\u54df\u54e0\u54e1\u54e2\u54e3\u54e4\u54e5\u54e6\u54e7\u54e8\u54e9\u54ea\u54eb\u54ec\u54ed\u54ee\u54ef\u54f0\u54f1\u54f2\u54f3\u54f4\u54f5\u54f6\u54f7\u54f8\u54f9\u54fa\u54fb\u54fc\u54fd\u54fe\u54ff\u5500\u5501\u5502\u5503\u5504\u5505\u5506\u5507\u5508\u5509\u550a\u550b\u550c\u550d\u550e\u550f\u5510\u5511\u5512\u5513\u5514\u5515\u5516\u5517\u5518\u5519\u551a\u551b\u551c\u551d\u551e\u551f\u5520\u5521\u5522\u5523\u5524\u5525\u5526\u5527\u5528\u5529\u552a\u552b\u552c\u552d\u552e\u552f\u5530\u5531\u5532\u5533\u5534\u5535\u5536\u5537\u5538\u5539\u553a\u553b\u553c\u553d\u553e\u553f\u5540\u5541\u5542\u5543\u5544\u5545\u5546\u5547\u5548\u5549\u554a\u554b\u554c\u554d\u554e\u554f\u5550\u5551\u5552\u5553\u5554\u5555\u5556\u5557\u5558\u5559\u555a\u555b\u555c\u555d\u555e\u555f\u5560\u5561\u5562\u5563\u5564\u5565\u5566\u5567\u5568\u5569\u556a\u556b\u556c\u556d\u556e\u556f\u5570\u5571\u5572\u5573\u5574\u5575\u5576\u5577\u5578\u5579\u557a\u557b\u557c\u557d\u557e\u557f\u5580\u5581\u5582\u5583\u5584\u5585\u5586\u5587\u5588\u5589\u558a\u558b\u558c\u558d\u558e\u558f\u5590\u5591\u5592\u5593\u5594\u5595\u5596\u5597\u5598\u5599\u559a\u559b\u559c\u559d\u559e\u559f\u55a0\u55a1\u55a2\u55a3\u55a4\u55a5\u55a6\u55a7\u55a8\u55a9\u55aa\u55ab\u55ac\u55ad\u55ae\u55af\u55b0\u55b1\u55b2\u55b3\u55b4\u55b5\u55b6\u55b7\u55b8\u55b9\u55ba\u55bb\u55bc\u55bd\u55be\u55bf\u55c0\u55c1\u55c2\u55c3\u55c4\u55c5\u55c6\u55c7\u55c8\u55c9\u55ca\u55cb\u55cc\u55cd\u55ce\u55cf\u55d0\u55d1\u55d2\u55d3\u55d4\u55d5\u55d6\u55d7\u55d8\u55d9\u55da\u55db\u55dc\u55dd\u55de\u55df\u55e0\u55e1\u55e2\u55e3\u55e4\u55e5\u55e6\u55e7\u55e8\u55e9\u55ea\u55eb\u55ec\u55ed\u55ee\u55ef\u55f0\u55f1\u55f2\u55f3\u55f4\u55f5\u55f6\u55f7\u55f8\u55f9\u55fa\u55fb\u55fc\u55fd\u55fe\u55ff\u5600\u5601\u5602\u5603\u5604\u5605\u5606\u5607\u5608\u5609\u560a\u560b\u560c\u560d\u560e\u560f\u5610\u5611\u5612\u5613\u5614\u5615\u5616\u5617\u5618\u5619\u561a\u561b\u561c\u561d\u561e\u561f\u5620\u5621\u5622\u5623\u5624\u5625\u5626\u5627\u5628\u5629\u562a\u562b\u562c\u562d\u562e\u562f\u5630\u5631\u5632\u5633\u5634\u5635\u5636\u5637\u5638\u5639\u563a\u563b\u563c\u563d\u563e\u563f\u5640\u5641\u5642\u5643\u5644\u5645\u5646\u5647\u5648\u5649\u564a\u564b\u564c\u564d\u564e\u564f\u5650\u5651\u5652\u5653\u5654\u5655\u5656\u5657\u5658\u5659\u565a\u565b\u565c\u565d\u565e\u565f\u5660\u5661\u5662\u5663\u5664\u5665\u5666\u5667\u5668\u5669\u566a\u566b\u566c\u566d\u566e\u566f\u5670\u5671\u5672\u5673\u5674\u5675\u5676\u5677\u5678\u5679\u567a\u567b\u567c\u567d\u567e\u567f\u5680\u5681\u5682\u5683\u5684\u5685\u5686\u5687\u5688\u5689\u568a\u568b\u568c\u568d\u568e\u568f\u5690\u5691\u5692\u5693\u5694\u5695\u5696\u5697\u5698\u5699\u569a\u569b\u569c\u569d\u569e\u569f\u56a0\u56a1\u56a2\u56a3\u56a4\u56a5\u56a6\u56a7\u56a8\u56a9\u56aa\u56ab\u56ac\u56ad\u56ae\u56af\u56b0\u56b1\u56b2\u56b3\u56b4\u56b5\u56b6\u56b7\u56b8\u56b9\u56ba\u56bb\u56bc\u56bd\u56be\u56bf\u56c0\u56c1\u56c2\u56c3\u56c4\u56c5\u56c6\u56c7\u56c8\u56c9\u56ca\u56cb\u56cc\u56cd\u56ce\u56cf\u56d0\u56d1\u56d2\u56d3\u56d4\u56d5\u56d6\u56d7\u56d8\u56d9\u56da\u56db\u56dc\u56dd\u56de\u56df\u56e0\u56e1\u56e2\u56e3\u56e4\u56e5\u56e6\u56e7\u56e8\u56e9\u56ea\u56eb\u56ec\u56ed\u56ee\u56ef\u56f0\u56f1\u56f2\u56f3\u56f4\u56f5\u56f6\u56f7\u56f8\u56f9\u56fa\u56fb\u56fc\u56fd\u56fe\u56ff\u5700\u5701\u5702\u5703\u5704\u5705\u5706\u5707\u5708\u5709\u570a\u570b\u570c\u570d\u570e\u570f\u5710\u5711\u5712\u5713\u5714\u5715\u5716\u5717\u5718\u5719\u571a\u571b\u571c\u571d\u571e\u571f\u5720\u5721\u5722\u5723\u5724\u5725\u5726\u5727\u5728\u5729\u572a\u572b\u572c\u572d\u572e\u572f\u5730\u5731\u5732\u5733\u5734\u5735\u5736\u5737\u5738\u5739\u573a\u573b\u573c\u573d\u573e\u573f\u5740\u5741\u5742\u5743\u5744\u5745\u5746\u5747\u5748\u5749\u574a\u574b\u574c\u574d\u574e\u574f\u5750\u5751\u5752\u5753\u5754\u5755\u5756\u5757\u5758\u5759\u575a\u575b\u575c\u575d\u575e\u575f\u5760\u5761\u5762\u5763\u5764\u5765\u5766\u5767\u5768\u5769\u576a\u576b\u576c\u576d\u576e\u576f\u5770\u5771\u5772\u5773\u5774\u5775\u5776\u5777\u5778\u5779\u577a\u577b\u577c\u577d\u577e\u577f\u5780\u5781\u5782\u5783\u5784\u5785\u5786\u5787\u5788\u5789\u578a\u578b\u578c\u578d\u578e\u578f\u5790\u5791\u5792\u5793\u5794\u5795\u5796\u5797\u5798\u5799\u579a\u579b\u579c\u579d\u579e\u579f\u57a0\u57a1\u57a2\u57a3\u57a4\u57a5\u57a6\u57a7\u57a8\u57a9\u57aa\u57ab\u57ac\u57ad\u57ae\u57af\u57b0\u57b1\u57b2\u57b3\u57b4\u57b5\u57b6\u57b7\u57b8\u57b9\u57ba\u57bb\u57bc\u57bd\u57be\u57bf\u57c0\u57c1\u57c2\u57c3\u57c4\u57c5\u57c6\u57c7\u57c8\u57c9\u57ca\u57cb\u57cc\u57cd\u57ce\u57cf\u57d0\u57d1\u57d2\u57d3\u57d4\u57d5\u57d6\u57d7\u57d8\u57d9\u57da\u57db\u57dc\u57dd\u57de\u57df\u57e0\u57e1\u57e2\u57e3\u57e4\u57e5\u57e6\u57e7\u57e8\u57e9\u57ea\u57eb\u57ec\u57ed\u57ee\u57ef\u57f0\u57f1\u57f2\u57f3\u57f4\u57f5\u57f6\u57f7\u57f8\u57f9\u57fa\u57fb\u57fc\u57fd\u57fe\u57ff\u5800\u5801\u5802\u5803\u5804\u5805\u5806\u5807\u5808\u5809\u580a\u580b\u580c\u580d\u580e\u580f\u5810\u5811\u5812\u5813\u5814\u5815\u5816\u5817\u5818\u5819\u581a\u581b\u581c\u581d\u581e\u581f\u5820\u5821\u5822\u5823\u5824\u5825\u5826\u5827\u5828\u5829\u582a\u582b\u582c\u582d\u582e\u582f\u5830\u5831\u5832\u5833\u5834\u5835\u5836\u5837\u5838\u5839\u583a\u583b\u583c\u583d\u583e\u583f\u5840\u5841\u5842\u5843\u5844\u5845\u5846\u5847\u5848\u5849\u584a\u584b\u584c\u584d\u584e\u584f\u5850\u5851\u5852\u5853\u5854\u5855\u5856\u5857\u5858\u5859\u585a\u585b\u585c\u585d\u585e\u585f\u5860\u5861\u5862\u5863\u5864\u5865\u5866\u5867\u5868\u5869\u586a\u586b\u586c\u586d\u586e\u586f\u5870\u5871\u5872\u5873\u5874\u5875\u5876\u5877\u5878\u5879\u587a\u587b\u587c\u587d\u587e\u587f\u5880\u5881\u5882\u5883\u5884\u5885\u5886\u5887\u5888\u5889\u588a\u588b\u588c\u588d\u588e\u588f\u5890\u5891\u5892\u5893\u5894\u5895\u5896\u5897\u5898\u5899\u589a\u589b\u589c\u589d\u589e\u589f\u58a0\u58a1\u58a2\u58a3\u58a4\u58a5\u58a6\u58a7\u58a8\u58a9\u58aa\u58ab\u58ac\u58ad\u58ae\u58af\u58b0\u58b1\u58b2\u58b3\u58b4\u58b5\u58b6\u58b7\u58b8\u58b9\u58ba\u58bb\u58bc\u58bd\u58be\u58bf\u58c0\u58c1\u58c2\u58c3\u58c4\u58c5\u58c6\u58c7\u58c8\u58c9\u58ca\u58cb\u58cc\u58cd\u58ce\u58cf\u58d0\u58d1\u58d2\u58d3\u58d4\u58d5\u58d6\u58d7\u58d8\u58d9\u58da\u58db\u58dc\u58dd\u58de\u58df\u58e0\u58e1\u58e2\u58e3\u58e4\u58e5\u58e6\u58e7\u58e8\u58e9\u58ea\u58eb\u58ec\u58ed\u58ee\u58ef\u58f0\u58f1\u58f2\u58f3\u58f4\u58f5\u58f6\u58f7\u58f8\u58f9\u58fa\u58fb\u58fc\u58fd\u58fe\u58ff\u5900\u5901\u5902\u5903\u5904\u5905\u5906\u5907\u5908\u5909\u590a\u590b\u590c\u590d\u590e\u590f\u5910\u5911\u5912\u5913\u5914\u5915\u5916\u5917\u5918\u5919\u591a\u591b\u591c\u591d\u591e\u591f\u5920\u5921\u5922\u5923\u5924\u5925\u5926\u5927\u5928\u5929\u592a\u592b\u592c\u592d\u592e\u592f\u5930\u5931\u5932\u5933\u5934\u5935\u5936\u5937\u5938\u5939\u593a\u593b\u593c\u593d\u593e\u593f\u5940\u5941\u5942\u5943\u5944\u5945\u5946\u5947\u5948\u5949\u594a\u594b\u594c\u594d\u594e\u594f\u5950\u5951\u5952\u5953\u5954\u5955\u5956\u5957\u5958\u5959\u595a\u595b\u595c\u595d\u595e\u595f\u5960\u5961\u5962\u5963\u5964\u5965\u5966\u5967\u5968\u5969\u596a\u596b\u596c\u596d\u596e\u596f\u5970\u5971\u5972\u5973\u5974\u5975\u5976\u5977\u5978\u5979\u597a\u597b\u597c\u597d\u597e\u597f\u5980\u5981\u5982\u5983\u5984\u5985\u5986\u5987\u5988\u5989\u598a\u598b\u598c\u598d\u598e\u598f\u5990\u5991\u5992\u5993\u5994\u5995\u5996\u5997\u5998\u5999\u599a\u599b\u599c\u599d\u599e\u599f\u59a0\u59a1\u59a2\u59a3\u59a4\u59a5\u59a6\u59a7\u59a8\u59a9\u59aa\u59ab\u59ac\u59ad\u59ae\u59af\u59b0\u59b1\u59b2\u59b3\u59b4\u59b5\u59b6\u59b7\u59b8\u59b9\u59ba\u59bb\u59bc\u59bd\u59be\u59bf\u59c0\u59c1\u59c2\u59c3\u59c4\u59c5\u59c6\u59c7\u59c8\u59c9\u59ca\u59cb\u59cc\u59cd\u59ce\u59cf\u59d0\u59d1\u59d2\u59d3\u59d4\u59d5\u59d6\u59d7\u59d8\u59d9\u59da\u59db\u59dc\u59dd\u59de\u59df\u59e0\u59e1\u59e2\u59e3\u59e4\u59e5\u59e6\u59e7\u59e8\u59e9\u59ea\u59eb\u59ec\u59ed\u59ee\u59ef\u59f0\u59f1\u59f2\u59f3\u59f4\u59f5\u59f6\u59f7\u59f8\u59f9\u59fa\u59fb\u59fc\u59fd\u59fe\u59ff\u5a00\u5a01\u5a02\u5a03\u5a04\u5a05\u5a06\u5a07\u5a08\u5a09\u5a0a\u5a0b\u5a0c\u5a0d\u5a0e\u5a0f\u5a10\u5a11\u5a12\u5a13\u5a14\u5a15\u5a16\u5a17\u5a18\u5a19\u5a1a\u5a1b\u5a1c\u5a1d\u5a1e\u5a1f\u5a20\u5a21\u5a22\u5a23\u5a24\u5a25\u5a26\u5a27\u5a28\u5a29\u5a2a\u5a2b\u5a2c\u5a2d\u5a2e\u5a2f\u5a30\u5a31\u5a32\u5a33\u5a34\u5a35\u5a36\u5a37\u5a38\u5a39\u5a3a\u5a3b\u5a3c\u5a3d\u5a3e\u5a3f\u5a40\u5a41\u5a42\u5a43\u5a44\u5a45\u5a46\u5a47\u5a48\u5a49\u5a4a\u5a4b\u5a4c\u5a4d\u5a4e\u5a4f\u5a50\u5a51\u5a52\u5a53\u5a54\u5a55\u5a56\u5a57\u5a58\u5a59\u5a5a\u5a5b\u5a5c\u5a5d\u5a5e\u5a5f\u5a60\u5a61\u5a62\u5a63\u5a64\u5a65\u5a66\u5a67\u5a68\u5a69\u5a6a\u5a6b\u5a6c\u5a6d\u5a6e\u5a6f\u5a70\u5a71\u5a72\u5a73\u5a74\u5a75\u5a76\u5a77\u5a78\u5a79\u5a7a\u5a7b\u5a7c\u5a7d\u5a7e\u5a7f\u5a80\u5a81\u5a82\u5a83\u5a84\u5a85\u5a86\u5a87\u5a88\u5a89\u5a8a\u5a8b\u5a8c\u5a8d\u5a8e\u5a8f\u5a90\u5a91\u5a92\u5a93\u5a94\u5a95\u5a96\u5a97\u5a98\u5a99\u5a9a\u5a9b\u5a9c\u5a9d\u5a9e\u5a9f\u5aa0\u5aa1\u5aa2\u5aa3\u5aa4\u5aa5\u5aa6\u5aa7\u5aa8\u5aa9\u5aaa\u5aab\u5aac\u5aad\u5aae\u5aaf\u5ab0\u5ab1\u5ab2\u5ab3\u5ab4\u5ab5\u5ab6\u5ab7\u5ab8\u5ab9\u5aba\u5abb\u5abc\u5abd\u5abe\u5abf\u5ac0\u5ac1\u5ac2\u5ac3\u5ac4\u5ac5\u5ac6\u5ac7\u5ac8\u5ac9\u5aca\u5acb\u5acc\u5acd\u5ace\u5acf\u5ad0\u5ad1\u5ad2\u5ad3\u5ad4\u5ad5\u5ad6\u5ad7\u5ad8\u5ad9\u5ada\u5adb\u5adc\u5add\u5ade\u5adf\u5ae0\u5ae1\u5ae2\u5ae3\u5ae4\u5ae5\u5ae6\u5ae7\u5ae8\u5ae9\u5aea\u5aeb\u5aec\u5aed\u5aee\u5aef\u5af0\u5af1\u5af2\u5af3\u5af4\u5af5\u5af6\u5af7\u5af8\u5af9\u5afa\u5afb\u5afc\u5afd\u5afe\u5aff\u5b00\u5b01\u5b02\u5b03\u5b04\u5b05\u5b06\u5b07\u5b08\u5b09\u5b0a\u5b0b\u5b0c\u5b0d\u5b0e\u5b0f\u5b10\u5b11\u5b12\u5b13\u5b14\u5b15\u5b16\u5b17\u5b18\u5b19\u5b1a\u5b1b\u5b1c\u5b1d\u5b1e\u5b1f\u5b20\u5b21\u5b22\u5b23\u5b24\u5b25\u5b26\u5b27\u5b28\u5b29\u5b2a\u5b2b\u5b2c\u5b2d\u5b2e\u5b2f\u5b30\u5b31\u5b32\u5b33\u5b34\u5b35\u5b36\u5b37\u5b38\u5b39\u5b3a\u5b3b\u5b3c\u5b3d\u5b3e\u5b3f\u5b40\u5b41\u5b42\u5b43\u5b44\u5b45\u5b46\u5b47\u5b48\u5b49\u5b4a\u5b4b\u5b4c\u5b4d\u5b4e\u5b4f\u5b50\u5b51\u5b52\u5b53\u5b54\u5b55\u5b56\u5b57\u5b58\u5b59\u5b5a\u5b5b\u5b5c\u5b5d\u5b5e\u5b5f\u5b60\u5b61\u5b62\u5b63\u5b64\u5b65\u5b66\u5b67\u5b68\u5b69\u5b6a\u5b6b\u5b6c\u5b6d\u5b6e\u5b6f\u5b70\u5b71\u5b72\u5b73\u5b74\u5b75\u5b76\u5b77\u5b78\u5b79\u5b7a\u5b7b\u5b7c\u5b7d\u5b7e\u5b7f\u5b80\u5b81\u5b82\u5b83\u5b84\u5b85\u5b86\u5b87\u5b88\u5b89\u5b8a\u5b8b\u5b8c\u5b8d\u5b8e\u5b8f\u5b90\u5b91\u5b92\u5b93\u5b94\u5b95\u5b96\u5b97\u5b98\u5b99\u5b9a\u5b9b\u5b9c\u5b9d\u5b9e\u5b9f\u5ba0\u5ba1\u5ba2\u5ba3\u5ba4\u5ba5\u5ba6\u5ba7\u5ba8\u5ba9\u5baa\u5bab\u5bac\u5bad\u5bae\u5baf\u5bb0\u5bb1\u5bb2\u5bb3\u5bb4\u5bb5\u5bb6\u5bb7\u5bb8\u5bb9\u5bba\u5bbb\u5bbc\u5bbd\u5bbe\u5bbf\u5bc0\u5bc1\u5bc2\u5bc3\u5bc4\u5bc5\u5bc6\u5bc7\u5bc8\u5bc9\u5bca\u5bcb\u5bcc\u5bcd\u5bce\u5bcf\u5bd0\u5bd1\u5bd2\u5bd3\u5bd4\u5bd5\u5bd6\u5bd7\u5bd8\u5bd9\u5bda\u5bdb\u5bdc\u5bdd\u5bde\u5bdf\u5be0\u5be1\u5be2\u5be3\u5be4\u5be5\u5be6\u5be7\u5be8\u5be9\u5bea\u5beb\u5bec\u5bed\u5bee\u5bef\u5bf0\u5bf1\u5bf2\u5bf3\u5bf4\u5bf5\u5bf6\u5bf7\u5bf8\u5bf9\u5bfa\u5bfb\u5bfc\u5bfd\u5bfe\u5bff\u5c00\u5c01\u5c02\u5c03\u5c04\u5c05\u5c06\u5c07\u5c08\u5c09\u5c0a\u5c0b\u5c0c\u5c0d\u5c0e\u5c0f\u5c10\u5c11\u5c12\u5c13\u5c14\u5c15\u5c16\u5c17\u5c18\u5c19\u5c1a\u5c1b\u5c1c\u5c1d\u5c1e\u5c1f\u5c20\u5c21\u5c22\u5c23\u5c24\u5c25\u5c26\u5c27\u5c28\u5c29\u5c2a\u5c2b\u5c2c\u5c2d\u5c2e\u5c2f\u5c30\u5c31\u5c32\u5c33\u5c34\u5c35\u5c36\u5c37\u5c38\u5c39\u5c3a\u5c3b\u5c3c\u5c3d\u5c3e\u5c3f\u5c40\u5c41\u5c42\u5c43\u5c44\u5c45\u5c46\u5c47\u5c48\u5c49\u5c4a\u5c4b\u5c4c\u5c4d\u5c4e\u5c4f\u5c50\u5c51\u5c52\u5c53\u5c54\u5c55\u5c56\u5c57\u5c58\u5c59\u5c5a\u5c5b\u5c5c\u5c5d\u5c5e\u5c5f\u5c60\u5c61\u5c62\u5c63\u5c64\u5c65\u5c66\u5c67\u5c68\u5c69\u5c6a\u5c6b\u5c6c\u5c6d\u5c6e\u5c6f\u5c70\u5c71\u5c72\u5c73\u5c74\u5c75\u5c76\u5c77\u5c78\u5c79\u5c7a\u5c7b\u5c7c\u5c7d\u5c7e\u5c7f\u5c80\u5c81\u5c82\u5c83\u5c84\u5c85\u5c86\u5c87\u5c88\u5c89\u5c8a\u5c8b\u5c8c\u5c8d\u5c8e\u5c8f\u5c90\u5c91\u5c92\u5c93\u5c94\u5c95\u5c96\u5c97\u5c98\u5c99\u5c9a\u5c9b\u5c9c\u5c9d\u5c9e\u5c9f\u5ca0\u5ca1\u5ca2\u5ca3\u5ca4\u5ca5\u5ca6\u5ca7\u5ca8\u5ca9\u5caa\u5cab\u5cac\u5cad\u5cae\u5caf\u5cb0\u5cb1\u5cb2\u5cb3\u5cb4\u5cb5\u5cb6\u5cb7\u5cb8\u5cb9\u5cba\u5cbb\u5cbc\u5cbd\u5cbe\u5cbf\u5cc0\u5cc1\u5cc2\u5cc3\u5cc4\u5cc5\u5cc6\u5cc7\u5cc8\u5cc9\u5cca\u5ccb\u5ccc\u5ccd\u5cce\u5ccf\u5cd0\u5cd1\u5cd2\u5cd3\u5cd4\u5cd5\u5cd6\u5cd7\u5cd8\u5cd9\u5cda\u5cdb\u5cdc\u5cdd\u5cde\u5cdf\u5ce0\u5ce1\u5ce2\u5ce3\u5ce4\u5ce5\u5ce6\u5ce7\u5ce8\u5ce9\u5cea\u5ceb\u5cec\u5ced\u5cee\u5cef\u5cf0\u5cf1\u5cf2\u5cf3\u5cf4\u5cf5\u5cf6\u5cf7\u5cf8\u5cf9\u5cfa\u5cfb\u5cfc\u5cfd\u5cfe\u5cff\u5d00\u5d01\u5d02\u5d03\u5d04\u5d05\u5d06\u5d07\u5d08\u5d09\u5d0a\u5d0b\u5d0c\u5d0d\u5d0e\u5d0f\u5d10\u5d11\u5d12\u5d13\u5d14\u5d15\u5d16\u5d17\u5d18\u5d19\u5d1a\u5d1b\u5d1c\u5d1d\u5d1e\u5d1f\u5d20\u5d21\u5d22\u5d23\u5d24\u5d25\u5d26\u5d27\u5d28\u5d29\u5d2a\u5d2b\u5d2c\u5d2d\u5d2e\u5d2f\u5d30\u5d31\u5d32\u5d33\u5d34\u5d35\u5d36\u5d37\u5d38\u5d39\u5d3a\u5d3b\u5d3c\u5d3d\u5d3e\u5d3f\u5d40\u5d41\u5d42\u5d43\u5d44\u5d45\u5d46\u5d47\u5d48\u5d49\u5d4a\u5d4b\u5d4c\u5d4d\u5d4e\u5d4f\u5d50\u5d51\u5d52\u5d53\u5d54\u5d55\u5d56\u5d57\u5d58\u5d59\u5d5a\u5d5b\u5d5c\u5d5d\u5d5e\u5d5f\u5d60\u5d61\u5d62\u5d63\u5d64\u5d65\u5d66\u5d67\u5d68\u5d69\u5d6a\u5d6b\u5d6c\u5d6d\u5d6e\u5d6f\u5d70\u5d71\u5d72\u5d73\u5d74\u5d75\u5d76\u5d77\u5d78\u5d79\u5d7a\u5d7b\u5d7c\u5d7d\u5d7e\u5d7f\u5d80\u5d81\u5d82\u5d83\u5d84\u5d85\u5d86\u5d87\u5d88\u5d89\u5d8a\u5d8b\u5d8c\u5d8d\u5d8e\u5d8f\u5d90\u5d91\u5d92\u5d93\u5d94\u5d95\u5d96\u5d97\u5d98\u5d99\u5d9a\u5d9b\u5d9c\u5d9d\u5d9e\u5d9f\u5da0\u5da1\u5da2\u5da3\u5da4\u5da5\u5da6\u5da7\u5da8\u5da9\u5daa\u5dab\u5dac\u5dad\u5dae\u5daf\u5db0\u5db1\u5db2\u5db3\u5db4\u5db5\u5db6\u5db7\u5db8\u5db9\u5dba\u5dbb\u5dbc\u5dbd\u5dbe\u5dbf\u5dc0\u5dc1\u5dc2\u5dc3\u5dc4\u5dc5\u5dc6\u5dc7\u5dc8\u5dc9\u5dca\u5dcb\u5dcc\u5dcd\u5dce\u5dcf\u5dd0\u5dd1\u5dd2\u5dd3\u5dd4\u5dd5\u5dd6\u5dd7\u5dd8\u5dd9\u5dda\u5ddb\u5ddc\u5ddd\u5dde\u5ddf\u5de0\u5de1\u5de2\u5de3\u5de4\u5de5\u5de6\u5de7\u5de8\u5de9\u5dea\u5deb\u5dec\u5ded\u5dee\u5def\u5df0\u5df1\u5df2\u5df3\u5df4\u5df5\u5df6\u5df7\u5df8\u5df9\u5dfa\u5dfb\u5dfc\u5dfd\u5dfe\u5dff\u5e00\u5e01\u5e02\u5e03\u5e04\u5e05\u5e06\u5e07\u5e08\u5e09\u5e0a\u5e0b\u5e0c\u5e0d\u5e0e\u5e0f\u5e10\u5e11\u5e12\u5e13\u5e14\u5e15\u5e16\u5e17\u5e18\u5e19\u5e1a\u5e1b\u5e1c\u5e1d\u5e1e\u5e1f\u5e20\u5e21\u5e22\u5e23\u5e24\u5e25\u5e26\u5e27\u5e28\u5e29\u5e2a\u5e2b\u5e2c\u5e2d\u5e2e\u5e2f\u5e30\u5e31\u5e32\u5e33\u5e34\u5e35\u5e36\u5e37\u5e38\u5e39\u5e3a\u5e3b\u5e3c\u5e3d\u5e3e\u5e3f\u5e40\u5e41\u5e42\u5e43\u5e44\u5e45\u5e46\u5e47\u5e48\u5e49\u5e4a\u5e4b\u5e4c\u5e4d\u5e4e\u5e4f\u5e50\u5e51\u5e52\u5e53\u5e54\u5e55\u5e56\u5e57\u5e58\u5e59\u5e5a\u5e5b\u5e5c\u5e5d\u5e5e\u5e5f\u5e60\u5e61\u5e62\u5e63\u5e64\u5e65\u5e66\u5e67\u5e68\u5e69\u5e6a\u5e6b\u5e6c\u5e6d\u5e6e\u5e6f\u5e70\u5e71\u5e72\u5e73\u5e74\u5e75\u5e76\u5e77\u5e78\u5e79\u5e7a\u5e7b\u5e7c\u5e7d\u5e7e\u5e7f\u5e80\u5e81\u5e82\u5e83\u5e84\u5e85\u5e86\u5e87\u5e88\u5e89\u5e8a\u5e8b\u5e8c\u5e8d\u5e8e\u5e8f\u5e90\u5e91\u5e92\u5e93\u5e94\u5e95\u5e96\u5e97\u5e98\u5e99\u5e9a\u5e9b\u5e9c\u5e9d\u5e9e\u5e9f\u5ea0\u5ea1\u5ea2\u5ea3\u5ea4\u5ea5\u5ea6\u5ea7\u5ea8\u5ea9\u5eaa\u5eab\u5eac\u5ead\u5eae\u5eaf\u5eb0\u5eb1\u5eb2\u5eb3\u5eb4\u5eb5\u5eb6\u5eb7\u5eb8\u5eb9\u5eba\u5ebb\u5ebc\u5ebd\u5ebe\u5ebf\u5ec0\u5ec1\u5ec2\u5ec3\u5ec4\u5ec5\u5ec6\u5ec7\u5ec8\u5ec9\u5eca\u5ecb\u5ecc\u5ecd\u5ece\u5ecf\u5ed0\u5ed1\u5ed2\u5ed3\u5ed4\u5ed5\u5ed6\u5ed7\u5ed8\u5ed9\u5eda\u5edb\u5edc\u5edd\u5ede\u5edf\u5ee0\u5ee1\u5ee2\u5ee3\u5ee4\u5ee5\u5ee6\u5ee7\u5ee8\u5ee9\u5eea\u5eeb\u5eec\u5eed\u5eee\u5eef\u5ef0\u5ef1\u5ef2\u5ef3\u5ef4\u5ef5\u5ef6\u5ef7\u5ef8\u5ef9\u5efa\u5efb\u5efc\u5efd\u5efe\u5eff\u5f00\u5f01\u5f02\u5f03\u5f04\u5f05\u5f06\u5f07\u5f08\u5f09\u5f0a\u5f0b\u5f0c\u5f0d\u5f0e\u5f0f\u5f10\u5f11\u5f12\u5f13\u5f14\u5f15\u5f16\u5f17\u5f18\u5f19\u5f1a\u5f1b\u5f1c\u5f1d\u5f1e\u5f1f\u5f20\u5f21\u5f22\u5f23\u5f24\u5f25\u5f26\u5f27\u5f28\u5f29\u5f2a\u5f2b\u5f2c\u5f2d\u5f2e\u5f2f\u5f30\u5f31\u5f32\u5f33\u5f34\u5f35\u5f36\u5f37\u5f38\u5f39\u5f3a\u5f3b\u5f3c\u5f3d\u5f3e\u5f3f\u5f40\u5f41\u5f42\u5f43\u5f44\u5f45\u5f46\u5f47\u5f48\u5f49\u5f4a\u5f4b\u5f4c\u5f4d\u5f4e\u5f4f\u5f50\u5f51\u5f52\u5f53\u5f54\u5f55\u5f56\u5f57\u5f58\u5f59\u5f5a\u5f5b\u5f5c\u5f5d\u5f5e\u5f5f\u5f60\u5f61\u5f62\u5f63\u5f64\u5f65\u5f66\u5f67\u5f68\u5f69\u5f6a\u5f6b\u5f6c\u5f6d\u5f6e\u5f6f\u5f70\u5f71\u5f72\u5f73\u5f74\u5f75\u5f76\u5f77\u5f78\u5f79\u5f7a\u5f7b\u5f7c\u5f7d\u5f7e\u5f7f\u5f80\u5f81\u5f82\u5f83\u5f84\u5f85\u5f86\u5f87\u5f88\u5f89\u5f8a\u5f8b\u5f8c\u5f8d\u5f8e\u5f8f\u5f90\u5f91\u5f92\u5f93\u5f94\u5f95\u5f96\u5f97\u5f98\u5f99\u5f9a\u5f9b\u5f9c\u5f9d\u5f9e\u5f9f\u5fa0\u5fa1\u5fa2\u5fa3\u5fa4\u5fa5\u5fa6\u5fa7\u5fa8\u5fa9\u5faa\u5fab\u5fac\u5fad\u5fae\u5faf\u5fb0\u5fb1\u5fb2\u5fb3\u5fb4\u5fb5\u5fb6\u5fb7\u5fb8\u5fb9\u5fba\u5fbb\u5fbc\u5fbd\u5fbe\u5fbf\u5fc0\u5fc1\u5fc2\u5fc3\u5fc4\u5fc5\u5fc6\u5fc7\u5fc8\u5fc9\u5fca\u5fcb\u5fcc\u5fcd\u5fce\u5fcf\u5fd0\u5fd1\u5fd2\u5fd3\u5fd4\u5fd5\u5fd6\u5fd7\u5fd8\u5fd9\u5fda\u5fdb\u5fdc\u5fdd\u5fde\u5fdf\u5fe0\u5fe1\u5fe2\u5fe3\u5fe4\u5fe5\u5fe6\u5fe7\u5fe8\u5fe9\u5fea\u5feb\u5fec\u5fed\u5fee\u5fef\u5ff0\u5ff1\u5ff2\u5ff3\u5ff4\u5ff5\u5ff6\u5ff7\u5ff8\u5ff9\u5ffa\u5ffb\u5ffc\u5ffd\u5ffe\u5fff\u6000\u6001\u6002\u6003\u6004\u6005\u6006\u6007\u6008\u6009\u600a\u600b\u600c\u600d\u600e\u600f\u6010\u6011\u6012\u6013\u6014\u6015\u6016\u6017\u6018\u6019\u601a\u601b\u601c\u601d\u601e\u601f\u6020\u6021\u6022\u6023\u6024\u6025\u6026\u6027\u6028\u6029\u602a\u602b\u602c\u602d\u602e\u602f\u6030\u6031\u6032\u6033\u6034\u6035\u6036\u6037\u6038\u6039\u603a\u603b\u603c\u603d\u603e\u603f\u6040\u6041\u6042\u6043\u6044\u6045\u6046\u6047\u6048\u6049\u604a\u604b\u604c\u604d\u604e\u604f\u6050\u6051\u6052\u6053\u6054\u6055\u6056\u6057\u6058\u6059\u605a\u605b\u605c\u605d\u605e\u605f\u6060\u6061\u6062\u6063\u6064\u6065\u6066\u6067\u6068\u6069\u606a\u606b\u606c\u606d\u606e\u606f\u6070\u6071\u6072\u6073\u6074\u6075\u6076\u6077\u6078\u6079\u607a\u607b\u607c\u607d\u607e\u607f\u6080\u6081\u6082\u6083\u6084\u6085\u6086\u6087\u6088\u6089\u608a\u608b\u608c\u608d\u608e\u608f\u6090\u6091\u6092\u6093\u6094\u6095\u6096\u6097\u6098\u6099\u609a\u609b\u609c\u609d\u609e\u609f\u60a0\u60a1\u60a2\u60a3\u60a4\u60a5\u60a6\u60a7\u60a8\u60a9\u60aa\u60ab\u60ac\u60ad\u60ae\u60af\u60b0\u60b1\u60b2\u60b3\u60b4\u60b5\u60b6\u60b7\u60b8\u60b9\u60ba\u60bb\u60bc\u60bd\u60be\u60bf\u60c0\u60c1\u60c2\u60c3\u60c4\u60c5\u60c6\u60c7\u60c8\u60c9\u60ca\u60cb\u60cc\u60cd\u60ce\u60cf\u60d0\u60d1\u60d2\u60d3\u60d4\u60d5\u60d6\u60d7\u60d8\u60d9\u60da\u60db\u60dc\u60dd\u60de\u60df\u60e0\u60e1\u60e2\u60e3\u60e4\u60e5\u60e6\u60e7\u60e8\u60e9\u60ea\u60eb\u60ec\u60ed\u60ee\u60ef\u60f0\u60f1\u60f2\u60f3\u60f4\u60f5\u60f6\u60f7\u60f8\u60f9\u60fa\u60fb\u60fc\u60fd\u60fe\u60ff\u6100\u6101\u6102\u6103\u6104\u6105\u6106\u6107\u6108\u6109\u610a\u610b\u610c\u610d\u610e\u610f\u6110\u6111\u6112\u6113\u6114\u6115\u6116\u6117\u6118\u6119\u611a\u611b\u611c\u611d\u611e\u611f\u6120\u6121\u6122\u6123\u6124\u6125\u6126\u6127\u6128\u6129\u612a\u612b\u612c\u612d\u612e\u612f\u6130\u6131\u6132\u6133\u6134\u6135\u6136\u6137\u6138\u6139\u613a\u613b\u613c\u613d\u613e\u613f\u6140\u6141\u6142\u6143\u6144\u6145\u6146\u6147\u6148\u6149\u614a\u614b\u614c\u614d\u614e\u614f\u6150\u6151\u6152\u6153\u6154\u6155\u6156\u6157\u6158\u6159\u615a\u615b\u615c\u615d\u615e\u615f\u6160\u6161\u6162\u6163\u6164\u6165\u6166\u6167\u6168\u6169\u616a\u616b\u616c\u616d\u616e\u616f\u6170\u6171\u6172\u6173\u6174\u6175\u6176\u6177\u6178\u6179\u617a\u617b\u617c\u617d\u617e\u617f\u6180\u6181\u6182\u6183\u6184\u6185\u6186\u6187\u6188\u6189\u618a\u618b\u618c\u618d\u618e\u618f\u6190\u6191\u6192\u6193\u6194\u6195\u6196\u6197\u6198\u6199\u619a\u619b\u619c\u619d\u619e\u619f\u61a0\u61a1\u61a2\u61a3\u61a4\u61a5\u61a6\u61a7\u61a8\u61a9\u61aa\u61ab\u61ac\u61ad\u61ae\u61af\u61b0\u61b1\u61b2\u61b3\u61b4\u61b5\u61b6\u61b7\u61b8\u61b9\u61ba\u61bb\u61bc\u61bd\u61be\u61bf\u61c0\u61c1\u61c2\u61c3\u61c4\u61c5\u61c6\u61c7\u61c8\u61c9\u61ca\u61cb\u61cc\u61cd\u61ce\u61cf\u61d0\u61d1\u61d2\u61d3\u61d4\u61d5\u61d6\u61d7\u61d8\u61d9\u61da\u61db\u61dc\u61dd\u61de\u61df\u61e0\u61e1\u61e2\u61e3\u61e4\u61e5\u61e6\u61e7\u61e8\u61e9\u61ea\u61eb\u61ec\u61ed\u61ee\u61ef\u61f0\u61f1\u61f2\u61f3\u61f4\u61f5\u61f6\u61f7\u61f8\u61f9\u61fa\u61fb\u61fc\u61fd\u61fe\u61ff\u6200\u6201\u6202\u6203\u6204\u6205\u6206\u6207\u6208\u6209\u620a\u620b\u620c\u620d\u620e\u620f\u6210\u6211\u6212\u6213\u6214\u6215\u6216\u6217\u6218\u6219\u621a\u621b\u621c\u621d\u621e\u621f\u6220\u6221\u6222\u6223\u6224\u6225\u6226\u6227\u6228\u6229\u622a\u622b\u622c\u622d\u622e\u622f\u6230\u6231\u6232\u6233\u6234\u6235\u6236\u6237\u6238\u6239\u623a\u623b\u623c\u623d\u623e\u623f\u6240\u6241\u6242\u6243\u6244\u6245\u6246\u6247\u6248\u6249\u624a\u624b\u624c\u624d\u624e\u624f\u6250\u6251\u6252\u6253\u6254\u6255\u6256\u6257\u6258\u6259\u625a\u625b\u625c\u625d\u625e\u625f\u6260\u6261\u6262\u6263\u6264\u6265\u6266\u6267\u6268\u6269\u626a\u626b\u626c\u626d\u626e\u626f\u6270\u6271\u6272\u6273\u6274\u6275\u6276\u6277\u6278\u6279\u627a\u627b\u627c\u627d\u627e\u627f\u6280\u6281\u6282\u6283\u6284\u6285\u6286\u6287\u6288\u6289\u628a\u628b\u628c\u628d\u628e\u628f\u6290\u6291\u6292\u6293\u6294\u6295\u6296\u6297\u6298\u6299\u629a\u629b\u629c\u629d\u629e\u629f\u62a0\u62a1\u62a2\u62a3\u62a4\u62a5\u62a6\u62a7\u62a8\u62a9\u62aa\u62ab\u62ac\u62ad\u62ae\u62af\u62b0\u62b1\u62b2\u62b3\u62b4\u62b5\u62b6\u62b7\u62b8\u62b9\u62ba\u62bb\u62bc\u62bd\u62be\u62bf\u62c0\u62c1\u62c2\u62c3\u62c4\u62c5\u62c6\u62c7\u62c8\u62c9\u62ca\u62cb\u62cc\u62cd\u62ce\u62cf\u62d0\u62d1\u62d2\u62d3\u62d4\u62d5\u62d6\u62d7\u62d8\u62d9\u62da\u62db\u62dc\u62dd\u62de\u62df\u62e0\u62e1\u62e2\u62e3\u62e4\u62e5\u62e6\u62e7\u62e8\u62e9\u62ea\u62eb\u62ec\u62ed\u62ee\u62ef\u62f0\u62f1\u62f2\u62f3\u62f4\u62f5\u62f6\u62f7\u62f8\u62f9\u62fa\u62fb\u62fc\u62fd\u62fe\u62ff\u6300\u6301\u6302\u6303\u6304\u6305\u6306\u6307\u6308\u6309\u630a\u630b\u630c\u630d\u630e\u630f\u6310\u6311\u6312\u6313\u6314\u6315\u6316\u6317\u6318\u6319\u631a\u631b\u631c\u631d\u631e\u631f\u6320\u6321\u6322\u6323\u6324\u6325\u6326\u6327\u6328\u6329\u632a\u632b\u632c\u632d\u632e\u632f\u6330\u6331\u6332\u6333\u6334\u6335\u6336\u6337\u6338\u6339\u633a\u633b\u633c\u633d\u633e\u633f\u6340\u6341\u6342\u6343\u6344\u6345\u6346\u6347\u6348\u6349\u634a\u634b\u634c\u634d\u634e\u634f\u6350\u6351\u6352\u6353\u6354\u6355\u6356\u6357\u6358\u6359\u635a\u635b\u635c\u635d\u635e\u635f\u6360\u6361\u6362\u6363\u6364\u6365\u6366\u6367\u6368\u6369\u636a\u636b\u636c\u636d\u636e\u636f\u6370\u6371\u6372\u6373\u6374\u6375\u6376\u6377\u6378\u6379\u637a\u637b\u637c\u637d\u637e\u637f\u6380\u6381\u6382\u6383\u6384\u6385\u6386\u6387\u6388\u6389\u638a\u638b\u638c\u638d\u638e\u638f\u6390\u6391\u6392\u6393\u6394\u6395\u6396\u6397\u6398\u6399\u639a\u639b\u639c\u639d\u639e\u639f\u63a0\u63a1\u63a2\u63a3\u63a4\u63a5\u63a6\u63a7\u63a8\u63a9\u63aa\u63ab\u63ac\u63ad\u63ae\u63af\u63b0\u63b1\u63b2\u63b3\u63b4\u63b5\u63b6\u63b7\u63b8\u63b9\u63ba\u63bb\u63bc\u63bd\u63be\u63bf\u63c0\u63c1\u63c2\u63c3\u63c4\u63c5\u63c6\u63c7\u63c8\u63c9\u63ca\u63cb\u63cc\u63cd\u63ce\u63cf\u63d0\u63d1\u63d2\u63d3\u63d4\u63d5\u63d6\u63d7\u63d8\u63d9\u63da\u63db\u63dc\u63dd\u63de\u63df\u63e0\u63e1\u63e2\u63e3\u63e4\u63e5\u63e6\u63e7\u63e8\u63e9\u63ea\u63eb\u63ec\u63ed\u63ee\u63ef\u63f0\u63f1\u63f2\u63f3\u63f4\u63f5\u63f6\u63f7\u63f8\u63f9\u63fa\u63fb\u63fc\u63fd\u63fe\u63ff\u6400\u6401\u6402\u6403\u6404\u6405\u6406\u6407\u6408\u6409\u640a\u640b\u640c\u640d\u640e\u640f\u6410\u6411\u6412\u6413\u6414\u6415\u6416\u6417\u6418\u6419\u641a\u641b\u641c\u641d\u641e\u641f\u6420\u6421\u6422\u6423\u6424\u6425\u6426\u6427\u6428\u6429\u642a\u642b\u642c\u642d\u642e\u642f\u6430\u6431\u6432\u6433\u6434\u6435\u6436\u6437\u6438\u6439\u643a\u643b\u643c\u643d\u643e\u643f\u6440\u6441\u6442\u6443\u6444\u6445\u6446\u6447\u6448\u6449\u644a\u644b\u644c\u644d\u644e\u644f\u6450\u6451\u6452\u6453\u6454\u6455\u6456\u6457\u6458\u6459\u645a\u645b\u645c\u645d\u645e\u645f\u6460\u6461\u6462\u6463\u6464\u6465\u6466\u6467\u6468\u6469\u646a\u646b\u646c\u646d\u646e\u646f\u6470\u6471\u6472\u6473\u6474\u6475\u6476\u6477\u6478\u6479\u647a\u647b\u647c\u647d\u647e\u647f\u6480\u6481\u6482\u6483\u6484\u6485\u6486\u6487\u6488\u6489\u648a\u648b\u648c\u648d\u648e\u648f\u6490\u6491\u6492\u6493\u6494\u6495\u6496\u6497\u6498\u6499\u649a\u649b\u649c\u649d\u649e\u649f\u64a0\u64a1\u64a2\u64a3\u64a4\u64a5\u64a6\u64a7\u64a8\u64a9\u64aa\u64ab\u64ac\u64ad\u64ae\u64af\u64b0\u64b1\u64b2\u64b3\u64b4\u64b5\u64b6\u64b7\u64b8\u64b9\u64ba\u64bb\u64bc\u64bd\u64be\u64bf\u64c0\u64c1\u64c2\u64c3\u64c4\u64c5\u64c6\u64c7\u64c8\u64c9\u64ca\u64cb\u64cc\u64cd\u64ce\u64cf\u64d0\u64d1\u64d2\u64d3\u64d4\u64d5\u64d6\u64d7\u64d8\u64d9\u64da\u64db\u64dc\u64dd\u64de\u64df\u64e0\u64e1\u64e2\u64e3\u64e4\u64e5\u64e6\u64e7\u64e8\u64e9\u64ea\u64eb\u64ec\u64ed\u64ee\u64ef\u64f0\u64f1\u64f2\u64f3\u64f4\u64f5\u64f6\u64f7\u64f8\u64f9\u64fa\u64fb\u64fc\u64fd\u64fe\u64ff\u6500\u6501\u6502\u6503\u6504\u6505\u6506\u6507\u6508\u6509\u650a\u650b\u650c\u650d\u650e\u650f\u6510\u6511\u6512\u6513\u6514\u6515\u6516\u6517\u6518\u6519\u651a\u651b\u651c\u651d\u651e\u651f\u6520\u6521\u6522\u6523\u6524\u6525\u6526\u6527\u6528\u6529\u652a\u652b\u652c\u652d\u652e\u652f\u6530\u6531\u6532\u6533\u6534\u6535\u6536\u6537\u6538\u6539\u653a\u653b\u653c\u653d\u653e\u653f\u6540\u6541\u6542\u6543\u6544\u6545\u6546\u6547\u6548\u6549\u654a\u654b\u654c\u654d\u654e\u654f\u6550\u6551\u6552\u6553\u6554\u6555\u6556\u6557\u6558\u6559\u655a\u655b\u655c\u655d\u655e\u655f\u6560\u6561\u6562\u6563\u6564\u6565\u6566\u6567\u6568\u6569\u656a\u656b\u656c\u656d\u656e\u656f\u6570\u6571\u6572\u6573\u6574\u6575\u6576\u6577\u6578\u6579\u657a\u657b\u657c\u657d\u657e\u657f\u6580\u6581\u6582\u6583\u6584\u6585\u6586\u6587\u6588\u6589\u658a\u658b\u658c\u658d\u658e\u658f\u6590\u6591\u6592\u6593\u6594\u6595\u6596\u6597\u6598\u6599\u659a\u659b\u659c\u659d\u659e\u659f\u65a0\u65a1\u65a2\u65a3\u65a4\u65a5\u65a6\u65a7\u65a8\u65a9\u65aa\u65ab\u65ac\u65ad\u65ae\u65af\u65b0\u65b1\u65b2\u65b3\u65b4\u65b5\u65b6\u65b7\u65b8\u65b9\u65ba\u65bb\u65bc\u65bd\u65be\u65bf\u65c0\u65c1\u65c2\u65c3\u65c4\u65c5\u65c6\u65c7\u65c8\u65c9\u65ca\u65cb\u65cc\u65cd\u65ce\u65cf\u65d0\u65d1\u65d2\u65d3\u65d4\u65d5\u65d6\u65d7\u65d8\u65d9\u65da\u65db\u65dc\u65dd\u65de\u65df\u65e0\u65e1\u65e2\u65e3\u65e4\u65e5\u65e6\u65e7\u65e8\u65e9\u65ea\u65eb\u65ec\u65ed\u65ee\u65ef\u65f0\u65f1\u65f2\u65f3\u65f4\u65f5\u65f6\u65f7\u65f8\u65f9\u65fa\u65fb\u65fc\u65fd\u65fe\u65ff\u6600\u6601\u6602\u6603\u6604\u6605\u6606\u6607\u6608\u6609\u660a\u660b\u660c\u660d\u660e\u660f\u6610\u6611\u6612\u6613\u6614\u6615\u6616\u6617\u6618\u6619\u661a\u661b\u661c\u661d\u661e\u661f\u6620\u6621\u6622\u6623\u6624\u6625\u6626\u6627\u6628\u6629\u662a\u662b\u662c\u662d\u662e\u662f\u6630\u6631\u6632\u6633\u6634\u6635\u6636\u6637\u6638\u6639\u663a\u663b\u663c\u663d\u663e\u663f\u6640\u6641\u6642\u6643\u6644\u6645\u6646\u6647\u6648\u6649\u664a\u664b\u664c\u664d\u664e\u664f\u6650\u6651\u6652\u6653\u6654\u6655\u6656\u6657\u6658\u6659\u665a\u665b\u665c\u665d\u665e\u665f\u6660\u6661\u6662\u6663\u6664\u6665\u6666\u6667\u6668\u6669\u666a\u666b\u666c\u666d\u666e\u666f\u6670\u6671\u6672\u6673\u6674\u6675\u6676\u6677\u6678\u6679\u667a\u667b\u667c\u667d\u667e\u667f\u6680\u6681\u6682\u6683\u6684\u6685\u6686\u6687\u6688\u6689\u668a\u668b\u668c\u668d\u668e\u668f\u6690\u6691\u6692\u6693\u6694\u6695\u6696\u6697\u6698\u6699\u669a\u669b\u669c\u669d\u669e\u669f\u66a0\u66a1\u66a2\u66a3\u66a4\u66a5\u66a6\u66a7\u66a8\u66a9\u66aa\u66ab\u66ac\u66ad\u66ae\u66af\u66b0\u66b1\u66b2\u66b3\u66b4\u66b5\u66b6\u66b7\u66b8\u66b9\u66ba\u66bb\u66bc\u66bd\u66be\u66bf\u66c0\u66c1\u66c2\u66c3\u66c4\u66c5\u66c6\u66c7\u66c8\u66c9\u66ca\u66cb\u66cc\u66cd\u66ce\u66cf\u66d0\u66d1\u66d2\u66d3\u66d4\u66d5\u66d6\u66d7\u66d8\u66d9\u66da\u66db\u66dc\u66dd\u66de\u66df\u66e0\u66e1\u66e2\u66e3\u66e4\u66e5\u66e6\u66e7\u66e8\u66e9\u66ea\u66eb\u66ec\u66ed\u66ee\u66ef\u66f0\u66f1\u66f2\u66f3\u66f4\u66f5\u66f6\u66f7\u66f8\u66f9\u66fa\u66fb\u66fc\u66fd\u66fe\u66ff\u6700\u6701\u6702\u6703\u6704\u6705\u6706\u6707\u6708\u6709\u670a\u670b\u670c\u670d\u670e\u670f\u6710\u6711\u6712\u6713\u6714\u6715\u6716\u6717\u6718\u6719\u671a\u671b\u671c\u671d\u671e\u671f\u6720\u6721\u6722\u6723\u6724\u6725\u6726\u6727\u6728\u6729\u672a\u672b\u672c\u672d\u672e\u672f\u6730\u6731\u6732\u6733\u6734\u6735\u6736\u6737\u6738\u6739\u673a\u673b\u673c\u673d\u673e\u673f\u6740\u6741\u6742\u6743\u6744\u6745\u6746\u6747\u6748\u6749\u674a\u674b\u674c\u674d\u674e\u674f\u6750\u6751\u6752\u6753\u6754\u6755\u6756\u6757\u6758\u6759\u675a\u675b\u675c\u675d\u675e\u675f\u6760\u6761\u6762\u6763\u6764\u6765\u6766\u6767\u6768\u6769\u676a\u676b\u676c\u676d\u676e\u676f\u6770\u6771\u6772\u6773\u6774\u6775\u6776\u6777\u6778\u6779\u677a\u677b\u677c\u677d\u677e\u677f\u6780\u6781\u6782\u6783\u6784\u6785\u6786\u6787\u6788\u6789\u678a\u678b\u678c\u678d\u678e\u678f\u6790\u6791\u6792\u6793\u6794\u6795\u6796\u6797\u6798\u6799\u679a\u679b\u679c\u679d\u679e\u679f\u67a0\u67a1\u67a2\u67a3\u67a4\u67a5\u67a6\u67a7\u67a8\u67a9\u67aa\u67ab\u67ac\u67ad\u67ae\u67af\u67b0\u67b1\u67b2\u67b3\u67b4\u67b5\u67b6\u67b7\u67b8\u67b9\u67ba\u67bb\u67bc\u67bd\u67be\u67bf\u67c0\u67c1\u67c2\u67c3\u67c4\u67c5\u67c6\u67c7\u67c8\u67c9\u67ca\u67cb\u67cc\u67cd\u67ce\u67cf\u67d0\u67d1\u67d2\u67d3\u67d4\u67d5\u67d6\u67d7\u67d8\u67d9\u67da\u67db\u67dc\u67dd\u67de\u67df\u67e0\u67e1\u67e2\u67e3\u67e4\u67e5\u67e6\u67e7\u67e8\u67e9\u67ea\u67eb\u67ec\u67ed\u67ee\u67ef\u67f0\u67f1\u67f2\u67f3\u67f4\u67f5\u67f6\u67f7\u67f8\u67f9\u67fa\u67fb\u67fc\u67fd\u67fe\u67ff\u6800\u6801\u6802\u6803\u6804\u6805\u6806\u6807\u6808\u6809\u680a\u680b\u680c\u680d\u680e\u680f\u6810\u6811\u6812\u6813\u6814\u6815\u6816\u6817\u6818\u6819\u681a\u681b\u681c\u681d\u681e\u681f\u6820\u6821\u6822\u6823\u6824\u6825\u6826\u6827\u6828\u6829\u682a\u682b\u682c\u682d\u682e\u682f\u6830\u6831\u6832\u6833\u6834\u6835\u6836\u6837\u6838\u6839\u683a\u683b\u683c\u683d\u683e\u683f\u6840\u6841\u6842\u6843\u6844\u6845\u6846\u6847\u6848\u6849\u684a\u684b\u684c\u684d\u684e\u684f\u6850\u6851\u6852\u6853\u6854\u6855\u6856\u6857\u6858\u6859\u685a\u685b\u685c\u685d\u685e\u685f\u6860\u6861\u6862\u6863\u6864\u6865\u6866\u6867\u6868\u6869\u686a\u686b\u686c\u686d\u686e\u686f\u6870\u6871\u6872\u6873\u6874\u6875\u6876\u6877\u6878\u6879\u687a\u687b\u687c\u687d\u687e\u687f\u6880\u6881\u6882\u6883\u6884\u6885\u6886\u6887\u6888\u6889\u688a\u688b\u688c\u688d\u688e\u688f\u6890\u6891\u6892\u6893\u6894\u6895\u6896\u6897\u6898\u6899\u689a\u689b\u689c\u689d\u689e\u689f\u68a0\u68a1\u68a2\u68a3\u68a4\u68a5\u68a6\u68a7\u68a8\u68a9\u68aa\u68ab\u68ac\u68ad\u68ae\u68af\u68b0\u68b1\u68b2\u68b3\u68b4\u68b5\u68b6\u68b7\u68b8\u68b9\u68ba\u68bb\u68bc\u68bd\u68be\u68bf\u68c0\u68c1\u68c2\u68c3\u68c4\u68c5\u68c6\u68c7\u68c8\u68c9\u68ca\u68cb\u68cc\u68cd\u68ce\u68cf\u68d0\u68d1\u68d2\u68d3\u68d4\u68d5\u68d6\u68d7\u68d8\u68d9\u68da\u68db\u68dc\u68dd\u68de\u68df\u68e0\u68e1\u68e2\u68e3\u68e4\u68e5\u68e6\u68e7\u68e8\u68e9\u68ea\u68eb\u68ec\u68ed\u68ee\u68ef\u68f0\u68f1\u68f2\u68f3\u68f4\u68f5\u68f6\u68f7\u68f8\u68f9\u68fa\u68fb\u68fc\u68fd\u68fe\u68ff\u6900\u6901\u6902\u6903\u6904\u6905\u6906\u6907\u6908\u6909\u690a\u690b\u690c\u690d\u690e\u690f\u6910\u6911\u6912\u6913\u6914\u6915\u6916\u6917\u6918\u6919\u691a\u691b\u691c\u691d\u691e\u691f\u6920\u6921\u6922\u6923\u6924\u6925\u6926\u6927\u6928\u6929\u692a\u692b\u692c\u692d\u692e\u692f\u6930\u6931\u6932\u6933\u6934\u6935\u6936\u6937\u6938\u6939\u693a\u693b\u693c\u693d\u693e\u693f\u6940\u6941\u6942\u6943\u6944\u6945\u6946\u6947\u6948\u6949\u694a\u694b\u694c\u694d\u694e\u694f\u6950\u6951\u6952\u6953\u6954\u6955\u6956\u6957\u6958\u6959\u695a\u695b\u695c\u695d\u695e\u695f\u6960\u6961\u6962\u6963\u6964\u6965\u6966\u6967\u6968\u6969\u696a\u696b\u696c\u696d\u696e\u696f\u6970\u6971\u6972\u6973\u6974\u6975\u6976\u6977\u6978\u6979\u697a\u697b\u697c\u697d\u697e\u697f\u6980\u6981\u6982\u6983\u6984\u6985\u6986\u6987\u6988\u6989\u698a\u698b\u698c\u698d\u698e\u698f\u6990\u6991\u6992\u6993\u6994\u6995\u6996\u6997\u6998\u6999\u699a\u699b\u699c\u699d\u699e\u699f\u69a0\u69a1\u69a2\u69a3\u69a4\u69a5\u69a6\u69a7\u69a8\u69a9\u69aa\u69ab\u69ac\u69ad\u69ae\u69af\u69b0\u69b1\u69b2\u69b3\u69b4\u69b5\u69b6\u69b7\u69b8\u69b9\u69ba\u69bb\u69bc\u69bd\u69be\u69bf\u69c0\u69c1\u69c2\u69c3\u69c4\u69c5\u69c6\u69c7\u69c8\u69c9\u69ca\u69cb\u69cc\u69cd\u69ce\u69cf\u69d0\u69d1\u69d2\u69d3\u69d4\u69d5\u69d6\u69d7\u69d8\u69d9\u69da\u69db\u69dc\u69dd\u69de\u69df\u69e0\u69e1\u69e2\u69e3\u69e4\u69e5\u69e6\u69e7\u69e8\u69e9\u69ea\u69eb\u69ec\u69ed\u69ee\u69ef\u69f0\u69f1\u69f2\u69f3\u69f4\u69f5\u69f6\u69f7\u69f8\u69f9\u69fa\u69fb\u69fc\u69fd\u69fe\u69ff\u6a00\u6a01\u6a02\u6a03\u6a04\u6a05\u6a06\u6a07\u6a08\u6a09\u6a0a\u6a0b\u6a0c\u6a0d\u6a0e\u6a0f\u6a10\u6a11\u6a12\u6a13\u6a14\u6a15\u6a16\u6a17\u6a18\u6a19\u6a1a\u6a1b\u6a1c\u6a1d\u6a1e\u6a1f\u6a20\u6a21\u6a22\u6a23\u6a24\u6a25\u6a26\u6a27\u6a28\u6a29\u6a2a\u6a2b\u6a2c\u6a2d\u6a2e\u6a2f\u6a30\u6a31\u6a32\u6a33\u6a34\u6a35\u6a36\u6a37\u6a38\u6a39\u6a3a\u6a3b\u6a3c\u6a3d\u6a3e\u6a3f\u6a40\u6a41\u6a42\u6a43\u6a44\u6a45\u6a46\u6a47\u6a48\u6a49\u6a4a\u6a4b\u6a4c\u6a4d\u6a4e\u6a4f\u6a50\u6a51\u6a52\u6a53\u6a54\u6a55\u6a56\u6a57\u6a58\u6a59\u6a5a\u6a5b\u6a5c\u6a5d\u6a5e\u6a5f\u6a60\u6a61\u6a62\u6a63\u6a64\u6a65\u6a66\u6a67\u6a68\u6a69\u6a6a\u6a6b\u6a6c\u6a6d\u6a6e\u6a6f\u6a70\u6a71\u6a72\u6a73\u6a74\u6a75\u6a76\u6a77\u6a78\u6a79\u6a7a\u6a7b\u6a7c\u6a7d\u6a7e\u6a7f\u6a80\u6a81\u6a82\u6a83\u6a84\u6a85\u6a86\u6a87\u6a88\u6a89\u6a8a\u6a8b\u6a8c\u6a8d\u6a8e\u6a8f\u6a90\u6a91\u6a92\u6a93\u6a94\u6a95\u6a96\u6a97\u6a98\u6a99\u6a9a\u6a9b\u6a9c\u6a9d\u6a9e\u6a9f\u6aa0\u6aa1\u6aa2\u6aa3\u6aa4\u6aa5\u6aa6\u6aa7\u6aa8\u6aa9\u6aaa\u6aab\u6aac\u6aad\u6aae\u6aaf\u6ab0\u6ab1\u6ab2\u6ab3\u6ab4\u6ab5\u6ab6\u6ab7\u6ab8\u6ab9\u6aba\u6abb\u6abc\u6abd\u6abe\u6abf\u6ac0\u6ac1\u6ac2\u6ac3\u6ac4\u6ac5\u6ac6\u6ac7\u6ac8\u6ac9\u6aca\u6acb\u6acc\u6acd\u6ace\u6acf\u6ad0\u6ad1\u6ad2\u6ad3\u6ad4\u6ad5\u6ad6\u6ad7\u6ad8\u6ad9\u6ada\u6adb\u6adc\u6add\u6ade\u6adf\u6ae0\u6ae1\u6ae2\u6ae3\u6ae4\u6ae5\u6ae6\u6ae7\u6ae8\u6ae9\u6aea\u6aeb\u6aec\u6aed\u6aee\u6aef\u6af0\u6af1\u6af2\u6af3\u6af4\u6af5\u6af6\u6af7\u6af8\u6af9\u6afa\u6afb\u6afc\u6afd\u6afe\u6aff\u6b00\u6b01\u6b02\u6b03\u6b04\u6b05\u6b06\u6b07\u6b08\u6b09\u6b0a\u6b0b\u6b0c\u6b0d\u6b0e\u6b0f\u6b10\u6b11\u6b12\u6b13\u6b14\u6b15\u6b16\u6b17\u6b18\u6b19\u6b1a\u6b1b\u6b1c\u6b1d\u6b1e\u6b1f\u6b20\u6b21\u6b22\u6b23\u6b24\u6b25\u6b26\u6b27\u6b28\u6b29\u6b2a\u6b2b\u6b2c\u6b2d\u6b2e\u6b2f\u6b30\u6b31\u6b32\u6b33\u6b34\u6b35\u6b36\u6b37\u6b38\u6b39\u6b3a\u6b3b\u6b3c\u6b3d\u6b3e\u6b3f\u6b40\u6b41\u6b42\u6b43\u6b44\u6b45\u6b46\u6b47\u6b48\u6b49\u6b4a\u6b4b\u6b4c\u6b4d\u6b4e\u6b4f\u6b50\u6b51\u6b52\u6b53\u6b54\u6b55\u6b56\u6b57\u6b58\u6b59\u6b5a\u6b5b\u6b5c\u6b5d\u6b5e\u6b5f\u6b60\u6b61\u6b62\u6b63\u6b64\u6b65\u6b66\u6b67\u6b68\u6b69\u6b6a\u6b6b\u6b6c\u6b6d\u6b6e\u6b6f\u6b70\u6b71\u6b72\u6b73\u6b74\u6b75\u6b76\u6b77\u6b78\u6b79\u6b7a\u6b7b\u6b7c\u6b7d\u6b7e\u6b7f\u6b80\u6b81\u6b82\u6b83\u6b84\u6b85\u6b86\u6b87\u6b88\u6b89\u6b8a\u6b8b\u6b8c\u6b8d\u6b8e\u6b8f\u6b90\u6b91\u6b92\u6b93\u6b94\u6b95\u6b96\u6b97\u6b98\u6b99\u6b9a\u6b9b\u6b9c\u6b9d\u6b9e\u6b9f\u6ba0\u6ba1\u6ba2\u6ba3\u6ba4\u6ba5\u6ba6\u6ba7\u6ba8\u6ba9\u6baa\u6bab\u6bac\u6bad\u6bae\u6baf\u6bb0\u6bb1\u6bb2\u6bb3\u6bb4\u6bb5\u6bb6\u6bb7\u6bb8\u6bb9\u6bba\u6bbb\u6bbc\u6bbd\u6bbe\u6bbf\u6bc0\u6bc1\u6bc2\u6bc3\u6bc4\u6bc5\u6bc6\u6bc7\u6bc8\u6bc9\u6bca\u6bcb\u6bcc\u6bcd\u6bce\u6bcf\u6bd0\u6bd1\u6bd2\u6bd3\u6bd4\u6bd5\u6bd6\u6bd7\u6bd8\u6bd9\u6bda\u6bdb\u6bdc\u6bdd\u6bde\u6bdf\u6be0\u6be1\u6be2\u6be3\u6be4\u6be5\u6be6\u6be7\u6be8\u6be9\u6bea\u6beb\u6bec\u6bed\u6bee\u6bef\u6bf0\u6bf1\u6bf2\u6bf3\u6bf4\u6bf5\u6bf6\u6bf7\u6bf8\u6bf9\u6bfa\u6bfb\u6bfc\u6bfd\u6bfe\u6bff\u6c00\u6c01\u6c02\u6c03\u6c04\u6c05\u6c06\u6c07\u6c08\u6c09\u6c0a\u6c0b\u6c0c\u6c0d\u6c0e\u6c0f\u6c10\u6c11\u6c12\u6c13\u6c14\u6c15\u6c16\u6c17\u6c18\u6c19\u6c1a\u6c1b\u6c1c\u6c1d\u6c1e\u6c1f\u6c20\u6c21\u6c22\u6c23\u6c24\u6c25\u6c26\u6c27\u6c28\u6c29\u6c2a\u6c2b\u6c2c\u6c2d\u6c2e\u6c2f\u6c30\u6c31\u6c32\u6c33\u6c34\u6c35\u6c36\u6c37\u6c38\u6c39\u6c3a\u6c3b\u6c3c\u6c3d\u6c3e\u6c3f\u6c40\u6c41\u6c42\u6c43\u6c44\u6c45\u6c46\u6c47\u6c48\u6c49\u6c4a\u6c4b\u6c4c\u6c4d\u6c4e\u6c4f\u6c50\u6c51\u6c52\u6c53\u6c54\u6c55\u6c56\u6c57\u6c58\u6c59\u6c5a\u6c5b\u6c5c\u6c5d\u6c5e\u6c5f\u6c60\u6c61\u6c62\u6c63\u6c64\u6c65\u6c66\u6c67\u6c68\u6c69\u6c6a\u6c6b\u6c6c\u6c6d\u6c6e\u6c6f\u6c70\u6c71\u6c72\u6c73\u6c74\u6c75\u6c76\u6c77\u6c78\u6c79\u6c7a\u6c7b\u6c7c\u6c7d\u6c7e\u6c7f\u6c80\u6c81\u6c82\u6c83\u6c84\u6c85\u6c86\u6c87\u6c88\u6c89\u6c8a\u6c8b\u6c8c\u6c8d\u6c8e\u6c8f\u6c90\u6c91\u6c92\u6c93\u6c94\u6c95\u6c96\u6c97\u6c98\u6c99\u6c9a\u6c9b\u6c9c\u6c9d\u6c9e\u6c9f\u6ca0\u6ca1\u6ca2\u6ca3\u6ca4\u6ca5\u6ca6\u6ca7\u6ca8\u6ca9\u6caa\u6cab\u6cac\u6cad\u6cae\u6caf\u6cb0\u6cb1\u6cb2\u6cb3\u6cb4\u6cb5\u6cb6\u6cb7\u6cb8\u6cb9\u6cba\u6cbb\u6cbc\u6cbd\u6cbe\u6cbf\u6cc0\u6cc1\u6cc2\u6cc3\u6cc4\u6cc5\u6cc6\u6cc7\u6cc8\u6cc9\u6cca\u6ccb\u6ccc\u6ccd\u6cce\u6ccf\u6cd0\u6cd1\u6cd2\u6cd3\u6cd4\u6cd5\u6cd6\u6cd7\u6cd8\u6cd9\u6cda\u6cdb\u6cdc\u6cdd\u6cde\u6cdf\u6ce0\u6ce1\u6ce2\u6ce3\u6ce4\u6ce5\u6ce6\u6ce7\u6ce8\u6ce9\u6cea\u6ceb\u6cec\u6ced\u6cee\u6cef\u6cf0\u6cf1\u6cf2\u6cf3\u6cf4\u6cf5\u6cf6\u6cf7\u6cf8\u6cf9\u6cfa\u6cfb\u6cfc\u6cfd\u6cfe\u6cff\u6d00\u6d01\u6d02\u6d03\u6d04\u6d05\u6d06\u6d07\u6d08\u6d09\u6d0a\u6d0b\u6d0c\u6d0d\u6d0e\u6d0f\u6d10\u6d11\u6d12\u6d13\u6d14\u6d15\u6d16\u6d17\u6d18\u6d19\u6d1a\u6d1b\u6d1c\u6d1d\u6d1e\u6d1f\u6d20\u6d21\u6d22\u6d23\u6d24\u6d25\u6d26\u6d27\u6d28\u6d29\u6d2a\u6d2b\u6d2c\u6d2d\u6d2e\u6d2f\u6d30\u6d31\u6d32\u6d33\u6d34\u6d35\u6d36\u6d37\u6d38\u6d39\u6d3a\u6d3b\u6d3c\u6d3d\u6d3e\u6d3f\u6d40\u6d41\u6d42\u6d43\u6d44\u6d45\u6d46\u6d47\u6d48\u6d49\u6d4a\u6d4b\u6d4c\u6d4d\u6d4e\u6d4f\u6d50\u6d51\u6d52\u6d53\u6d54\u6d55\u6d56\u6d57\u6d58\u6d59\u6d5a\u6d5b\u6d5c\u6d5d\u6d5e\u6d5f\u6d60\u6d61\u6d62\u6d63\u6d64\u6d65\u6d66\u6d67\u6d68\u6d69\u6d6a\u6d6b\u6d6c\u6d6d\u6d6e\u6d6f\u6d70\u6d71\u6d72\u6d73\u6d74\u6d75\u6d76\u6d77\u6d78\u6d79\u6d7a\u6d7b\u6d7c\u6d7d\u6d7e\u6d7f\u6d80\u6d81\u6d82\u6d83\u6d84\u6d85\u6d86\u6d87\u6d88\u6d89\u6d8a\u6d8b\u6d8c\u6d8d\u6d8e\u6d8f\u6d90\u6d91\u6d92\u6d93\u6d94\u6d95\u6d96\u6d97\u6d98\u6d99\u6d9a\u6d9b\u6d9c\u6d9d\u6d9e\u6d9f\u6da0\u6da1\u6da2\u6da3\u6da4\u6da5\u6da6\u6da7\u6da8\u6da9\u6daa\u6dab\u6dac\u6dad\u6dae\u6daf\u6db0\u6db1\u6db2\u6db3\u6db4\u6db5\u6db6\u6db7\u6db8\u6db9\u6dba\u6dbb\u6dbc\u6dbd\u6dbe\u6dbf\u6dc0\u6dc1\u6dc2\u6dc3\u6dc4\u6dc5\u6dc6\u6dc7\u6dc8\u6dc9\u6dca\u6dcb\u6dcc\u6dcd\u6dce\u6dcf\u6dd0\u6dd1\u6dd2\u6dd3\u6dd4\u6dd5\u6dd6\u6dd7\u6dd8\u6dd9\u6dda\u6ddb\u6ddc\u6ddd\u6dde\u6ddf\u6de0\u6de1\u6de2\u6de3\u6de4\u6de5\u6de6\u6de7\u6de8\u6de9\u6dea\u6deb\u6dec\u6ded\u6dee\u6def\u6df0\u6df1\u6df2\u6df3\u6df4\u6df5\u6df6\u6df7\u6df8\u6df9\u6dfa\u6dfb\u6dfc\u6dfd\u6dfe\u6dff\u6e00\u6e01\u6e02\u6e03\u6e04\u6e05\u6e06\u6e07\u6e08\u6e09\u6e0a\u6e0b\u6e0c\u6e0d\u6e0e\u6e0f\u6e10\u6e11\u6e12\u6e13\u6e14\u6e15\u6e16\u6e17\u6e18\u6e19\u6e1a\u6e1b\u6e1c\u6e1d\u6e1e\u6e1f\u6e20\u6e21\u6e22\u6e23\u6e24\u6e25\u6e26\u6e27\u6e28\u6e29\u6e2a\u6e2b\u6e2c\u6e2d\u6e2e\u6e2f\u6e30\u6e31\u6e32\u6e33\u6e34\u6e35\u6e36\u6e37\u6e38\u6e39\u6e3a\u6e3b\u6e3c\u6e3d\u6e3e\u6e3f\u6e40\u6e41\u6e42\u6e43\u6e44\u6e45\u6e46\u6e47\u6e48\u6e49\u6e4a\u6e4b\u6e4c\u6e4d\u6e4e\u6e4f\u6e50\u6e51\u6e52\u6e53\u6e54\u6e55\u6e56\u6e57\u6e58\u6e59\u6e5a\u6e5b\u6e5c\u6e5d\u6e5e\u6e5f\u6e60\u6e61\u6e62\u6e63\u6e64\u6e65\u6e66\u6e67\u6e68\u6e69\u6e6a\u6e6b\u6e6c\u6e6d\u6e6e\u6e6f\u6e70\u6e71\u6e72\u6e73\u6e74\u6e75\u6e76\u6e77\u6e78\u6e79\u6e7a\u6e7b\u6e7c\u6e7d\u6e7e\u6e7f\u6e80\u6e81\u6e82\u6e83\u6e84\u6e85\u6e86\u6e87\u6e88\u6e89\u6e8a\u6e8b\u6e8c\u6e8d\u6e8e\u6e8f\u6e90\u6e91\u6e92\u6e93\u6e94\u6e95\u6e96\u6e97\u6e98\u6e99\u6e9a\u6e9b\u6e9c\u6e9d\u6e9e\u6e9f\u6ea0\u6ea1\u6ea2\u6ea3\u6ea4\u6ea5\u6ea6\u6ea7\u6ea8\u6ea9\u6eaa\u6eab\u6eac\u6ead\u6eae\u6eaf\u6eb0\u6eb1\u6eb2\u6eb3\u6eb4\u6eb5\u6eb6\u6eb7\u6eb8\u6eb9\u6eba\u6ebb\u6ebc\u6ebd\u6ebe\u6ebf\u6ec0\u6ec1\u6ec2\u6ec3\u6ec4\u6ec5\u6ec6\u6ec7\u6ec8\u6ec9\u6eca\u6ecb\u6ecc\u6ecd\u6ece\u6ecf\u6ed0\u6ed1\u6ed2\u6ed3\u6ed4\u6ed5\u6ed6\u6ed7\u6ed8\u6ed9\u6eda\u6edb\u6edc\u6edd\u6ede\u6edf\u6ee0\u6ee1\u6ee2\u6ee3\u6ee4\u6ee5\u6ee6\u6ee7\u6ee8\u6ee9\u6eea\u6eeb\u6eec\u6eed\u6eee\u6eef\u6ef0\u6ef1\u6ef2\u6ef3\u6ef4\u6ef5\u6ef6\u6ef7\u6ef8\u6ef9\u6efa\u6efb\u6efc\u6efd\u6efe\u6eff\u6f00\u6f01\u6f02\u6f03\u6f04\u6f05\u6f06\u6f07\u6f08\u6f09\u6f0a\u6f0b\u6f0c\u6f0d\u6f0e\u6f0f\u6f10\u6f11\u6f12\u6f13\u6f14\u6f15\u6f16\u6f17\u6f18\u6f19\u6f1a\u6f1b\u6f1c\u6f1d\u6f1e\u6f1f\u6f20\u6f21\u6f22\u6f23\u6f24\u6f25\u6f26\u6f27\u6f28\u6f29\u6f2a\u6f2b\u6f2c\u6f2d\u6f2e\u6f2f\u6f30\u6f31\u6f32\u6f33\u6f34\u6f35\u6f36\u6f37\u6f38\u6f39\u6f3a\u6f3b\u6f3c\u6f3d\u6f3e\u6f3f\u6f40\u6f41\u6f42\u6f43\u6f44\u6f45\u6f46\u6f47\u6f48\u6f49\u6f4a\u6f4b\u6f4c\u6f4d\u6f4e\u6f4f\u6f50\u6f51\u6f52\u6f53\u6f54\u6f55\u6f56\u6f57\u6f58\u6f59\u6f5a\u6f5b\u6f5c\u6f5d\u6f5e\u6f5f\u6f60\u6f61\u6f62\u6f63\u6f64\u6f65\u6f66\u6f67\u6f68\u6f69\u6f6a\u6f6b\u6f6c\u6f6d\u6f6e\u6f6f\u6f70\u6f71\u6f72\u6f73\u6f74\u6f75\u6f76\u6f77\u6f78\u6f79\u6f7a\u6f7b\u6f7c\u6f7d\u6f7e\u6f7f\u6f80\u6f81\u6f82\u6f83\u6f84\u6f85\u6f86\u6f87\u6f88\u6f89\u6f8a\u6f8b\u6f8c\u6f8d\u6f8e\u6f8f\u6f90\u6f91\u6f92\u6f93\u6f94\u6f95\u6f96\u6f97\u6f98\u6f99\u6f9a\u6f9b\u6f9c\u6f9d\u6f9e\u6f9f\u6fa0\u6fa1\u6fa2\u6fa3\u6fa4\u6fa5\u6fa6\u6fa7\u6fa8\u6fa9\u6faa\u6fab\u6fac\u6fad\u6fae\u6faf\u6fb0\u6fb1\u6fb2\u6fb3\u6fb4\u6fb5\u6fb6\u6fb7\u6fb8\u6fb9\u6fba\u6fbb\u6fbc\u6fbd\u6fbe\u6fbf\u6fc0\u6fc1\u6fc2\u6fc3\u6fc4\u6fc5\u6fc6\u6fc7\u6fc8\u6fc9\u6fca\u6fcb\u6fcc\u6fcd\u6fce\u6fcf\u6fd0\u6fd1\u6fd2\u6fd3\u6fd4\u6fd5\u6fd6\u6fd7\u6fd8\u6fd9\u6fda\u6fdb\u6fdc\u6fdd\u6fde\u6fdf\u6fe0\u6fe1\u6fe2\u6fe3\u6fe4\u6fe5\u6fe6\u6fe7\u6fe8\u6fe9\u6fea\u6feb\u6fec\u6fed\u6fee\u6fef\u6ff0\u6ff1\u6ff2\u6ff3\u6ff4\u6ff5\u6ff6\u6ff7\u6ff8\u6ff9\u6ffa\u6ffb\u6ffc\u6ffd\u6ffe\u6fff\u7000\u7001\u7002\u7003\u7004\u7005\u7006\u7007\u7008\u7009\u700a\u700b\u700c\u700d\u700e\u700f\u7010\u7011\u7012\u7013\u7014\u7015\u7016\u7017\u7018\u7019\u701a\u701b\u701c\u701d\u701e\u701f\u7020\u7021\u7022\u7023\u7024\u7025\u7026\u7027\u7028\u7029\u702a\u702b\u702c\u702d\u702e\u702f\u7030\u7031\u7032\u7033\u7034\u7035\u7036\u7037\u7038\u7039\u703a\u703b\u703c\u703d\u703e\u703f\u7040\u7041\u7042\u7043\u7044\u7045\u7046\u7047\u7048\u7049\u704a\u704b\u704c\u704d\u704e\u704f\u7050\u7051\u7052\u7053\u7054\u7055\u7056\u7057\u7058\u7059\u705a\u705b\u705c\u705d\u705e\u705f\u7060\u7061\u7062\u7063\u7064\u7065\u7066\u7067\u7068\u7069\u706a\u706b\u706c\u706d\u706e\u706f\u7070\u7071\u7072\u7073\u7074\u7075\u7076\u7077\u7078\u7079\u707a\u707b\u707c\u707d\u707e\u707f\u7080\u7081\u7082\u7083\u7084\u7085\u7086\u7087\u7088\u7089\u708a\u708b\u708c\u708d\u708e\u708f\u7090\u7091\u7092\u7093\u7094\u7095\u7096\u7097\u7098\u7099\u709a\u709b\u709c\u709d\u709e\u709f\u70a0\u70a1\u70a2\u70a3\u70a4\u70a5\u70a6\u70a7\u70a8\u70a9\u70aa\u70ab\u70ac\u70ad\u70ae\u70af\u70b0\u70b1\u70b2\u70b3\u70b4\u70b5\u70b6\u70b7\u70b8\u70b9\u70ba\u70bb\u70bc\u70bd\u70be\u70bf\u70c0\u70c1\u70c2\u70c3\u70c4\u70c5\u70c6\u70c7\u70c8\u70c9\u70ca\u70cb\u70cc\u70cd\u70ce\u70cf\u70d0\u70d1\u70d2\u70d3\u70d4\u70d5\u70d6\u70d7\u70d8\u70d9\u70da\u70db\u70dc\u70dd\u70de\u70df\u70e0\u70e1\u70e2\u70e3\u70e4\u70e5\u70e6\u70e7\u70e8\u70e9\u70ea\u70eb\u70ec\u70ed\u70ee\u70ef\u70f0\u70f1\u70f2\u70f3\u70f4\u70f5\u70f6\u70f7\u70f8\u70f9\u70fa\u70fb\u70fc\u70fd\u70fe\u70ff\u7100\u7101\u7102\u7103\u7104\u7105\u7106\u7107\u7108\u7109\u710a\u710b\u710c\u710d\u710e\u710f\u7110\u7111\u7112\u7113\u7114\u7115\u7116\u7117\u7118\u7119\u711a\u711b\u711c\u711d\u711e\u711f\u7120\u7121\u7122\u7123\u7124\u7125\u7126\u7127\u7128\u7129\u712a\u712b\u712c\u712d\u712e\u712f\u7130\u7131\u7132\u7133\u7134\u7135\u7136\u7137\u7138\u7139\u713a\u713b\u713c\u713d\u713e\u713f\u7140\u7141\u7142\u7143\u7144\u7145\u7146\u7147\u7148\u7149\u714a\u714b\u714c\u714d\u714e\u714f\u7150\u7151\u7152\u7153\u7154\u7155\u7156\u7157\u7158\u7159\u715a\u715b\u715c\u715d\u715e\u715f\u7160\u7161\u7162\u7163\u7164\u7165\u7166\u7167\u7168\u7169\u716a\u716b\u716c\u716d\u716e\u716f\u7170\u7171\u7172\u7173\u7174\u7175\u7176\u7177\u7178\u7179\u717a\u717b\u717c\u717d\u717e\u717f\u7180\u7181\u7182\u7183\u7184\u7185\u7186\u7187\u7188\u7189\u718a\u718b\u718c\u718d\u718e\u718f\u7190\u7191\u7192\u7193\u7194\u7195\u7196\u7197\u7198\u7199\u719a\u719b\u719c\u719d\u719e\u719f\u71a0\u71a1\u71a2\u71a3\u71a4\u71a5\u71a6\u71a7\u71a8\u71a9\u71aa\u71ab\u71ac\u71ad\u71ae\u71af\u71b0\u71b1\u71b2\u71b3\u71b4\u71b5\u71b6\u71b7\u71b8\u71b9\u71ba\u71bb\u71bc\u71bd\u71be\u71bf\u71c0\u71c1\u71c2\u71c3\u71c4\u71c5\u71c6\u71c7\u71c8\u71c9\u71ca\u71cb\u71cc\u71cd\u71ce\u71cf\u71d0\u71d1\u71d2\u71d3\u71d4\u71d5\u71d6\u71d7\u71d8\u71d9\u71da\u71db\u71dc\u71dd\u71de\u71df\u71e0\u71e1\u71e2\u71e3\u71e4\u71e5\u71e6\u71e7\u71e8\u71e9\u71ea\u71eb\u71ec\u71ed\u71ee\u71ef\u71f0\u71f1\u71f2\u71f3\u71f4\u71f5\u71f6\u71f7\u71f8\u71f9\u71fa\u71fb\u71fc\u71fd\u71fe\u71ff\u7200\u7201\u7202\u7203\u7204\u7205\u7206\u7207\u7208\u7209\u720a\u720b\u720c\u720d\u720e\u720f\u7210\u7211\u7212\u7213\u7214\u7215\u7216\u7217\u7218\u7219\u721a\u721b\u721c\u721d\u721e\u721f\u7220\u7221\u7222\u7223\u7224\u7225\u7226\u7227\u7228\u7229\u722a\u722b\u722c\u722d\u722e\u722f\u7230\u7231\u7232\u7233\u7234\u7235\u7236\u7237\u7238\u7239\u723a\u723b\u723c\u723d\u723e\u723f\u7240\u7241\u7242\u7243\u7244\u7245\u7246\u7247\u7248\u7249\u724a\u724b\u724c\u724d\u724e\u724f\u7250\u7251\u7252\u7253\u7254\u7255\u7256\u7257\u7258\u7259\u725a\u725b\u725c\u725d\u725e\u725f\u7260\u7261\u7262\u7263\u7264\u7265\u7266\u7267\u7268\u7269\u726a\u726b\u726c\u726d\u726e\u726f\u7270\u7271\u7272\u7273\u7274\u7275\u7276\u7277\u7278\u7279\u727a\u727b\u727c\u727d\u727e\u727f\u7280\u7281\u7282\u7283\u7284\u7285\u7286\u7287\u7288\u7289\u728a\u728b\u728c\u728d\u728e\u728f\u7290\u7291\u7292\u7293\u7294\u7295\u7296\u7297\u7298\u7299\u729a\u729b\u729c\u729d\u729e\u729f\u72a0\u72a1\u72a2\u72a3\u72a4\u72a5\u72a6\u72a7\u72a8\u72a9\u72aa\u72ab\u72ac\u72ad\u72ae\u72af\u72b0\u72b1\u72b2\u72b3\u72b4\u72b5\u72b6\u72b7\u72b8\u72b9\u72ba\u72bb\u72bc\u72bd\u72be\u72bf\u72c0\u72c1\u72c2\u72c3\u72c4\u72c5\u72c6\u72c7\u72c8\u72c9\u72ca\u72cb\u72cc\u72cd\u72ce\u72cf\u72d0\u72d1\u72d2\u72d3\u72d4\u72d5\u72d6\u72d7\u72d8\u72d9\u72da\u72db\u72dc\u72dd\u72de\u72df\u72e0\u72e1\u72e2\u72e3\u72e4\u72e5\u72e6\u72e7\u72e8\u72e9\u72ea\u72eb\u72ec\u72ed\u72ee\u72ef\u72f0\u72f1\u72f2\u72f3\u72f4\u72f5\u72f6\u72f7\u72f8\u72f9\u72fa\u72fb\u72fc\u72fd\u72fe\u72ff\u7300\u7301\u7302\u7303\u7304\u7305\u7306\u7307\u7308\u7309\u730a\u730b\u730c\u730d\u730e\u730f\u7310\u7311\u7312\u7313\u7314\u7315\u7316\u7317\u7318\u7319\u731a\u731b\u731c\u731d\u731e\u731f\u7320\u7321\u7322\u7323\u7324\u7325\u7326\u7327\u7328\u7329\u732a\u732b\u732c\u732d\u732e\u732f\u7330\u7331\u7332\u7333\u7334\u7335\u7336\u7337\u7338\u7339\u733a\u733b\u733c\u733d\u733e\u733f\u7340\u7341\u7342\u7343\u7344\u7345\u7346\u7347\u7348\u7349\u734a\u734b\u734c\u734d\u734e\u734f\u7350\u7351\u7352\u7353\u7354\u7355\u7356\u7357\u7358\u7359\u735a\u735b\u735c\u735d\u735e\u735f\u7360\u7361\u7362\u7363\u7364\u7365\u7366\u7367\u7368\u7369\u736a\u736b\u736c\u736d\u736e\u736f\u7370\u7371\u7372\u7373\u7374\u7375\u7376\u7377\u7378\u7379\u737a\u737b\u737c\u737d\u737e\u737f\u7380\u7381\u7382\u7383\u7384\u7385\u7386\u7387\u7388\u7389\u738a\u738b\u738c\u738d\u738e\u738f\u7390\u7391\u7392\u7393\u7394\u7395\u7396\u7397\u7398\u7399\u739a\u739b\u739c\u739d\u739e\u739f\u73a0\u73a1\u73a2\u73a3\u73a4\u73a5\u73a6\u73a7\u73a8\u73a9\u73aa\u73ab\u73ac\u73ad\u73ae\u73af\u73b0\u73b1\u73b2\u73b3\u73b4\u73b5\u73b6\u73b7\u73b8\u73b9\u73ba\u73bb\u73bc\u73bd\u73be\u73bf\u73c0\u73c1\u73c2\u73c3\u73c4\u73c5\u73c6\u73c7\u73c8\u73c9\u73ca\u73cb\u73cc\u73cd\u73ce\u73cf\u73d0\u73d1\u73d2\u73d3\u73d4\u73d5\u73d6\u73d7\u73d8\u73d9\u73da\u73db\u73dc\u73dd\u73de\u73df\u73e0\u73e1\u73e2\u73e3\u73e4\u73e5\u73e6\u73e7\u73e8\u73e9\u73ea\u73eb\u73ec\u73ed\u73ee\u73ef\u73f0\u73f1\u73f2\u73f3\u73f4\u73f5\u73f6\u73f7\u73f8\u73f9\u73fa\u73fb\u73fc\u73fd\u73fe\u73ff\u7400\u7401\u7402\u7403\u7404\u7405\u7406\u7407\u7408\u7409\u740a\u740b\u740c\u740d\u740e\u740f\u7410\u7411\u7412\u7413\u7414\u7415\u7416\u7417\u7418\u7419\u741a\u741b\u741c\u741d\u741e\u741f\u7420\u7421\u7422\u7423\u7424\u7425\u7426\u7427\u7428\u7429\u742a\u742b\u742c\u742d\u742e\u742f\u7430\u7431\u7432\u7433\u7434\u7435\u7436\u7437\u7438\u7439\u743a\u743b\u743c\u743d\u743e\u743f\u7440\u7441\u7442\u7443\u7444\u7445\u7446\u7447\u7448\u7449\u744a\u744b\u744c\u744d\u744e\u744f\u7450\u7451\u7452\u7453\u7454\u7455\u7456\u7457\u7458\u7459\u745a\u745b\u745c\u745d\u745e\u745f\u7460\u7461\u7462\u7463\u7464\u7465\u7466\u7467\u7468\u7469\u746a\u746b\u746c\u746d\u746e\u746f\u7470\u7471\u7472\u7473\u7474\u7475\u7476\u7477\u7478\u7479\u747a\u747b\u747c\u747d\u747e\u747f\u7480\u7481\u7482\u7483\u7484\u7485\u7486\u7487\u7488\u7489\u748a\u748b\u748c\u748d\u748e\u748f\u7490\u7491\u7492\u7493\u7494\u7495\u7496\u7497\u7498\u7499\u749a\u749b\u749c\u749d\u749e\u749f\u74a0\u74a1\u74a2\u74a3\u74a4\u74a5\u74a6\u74a7\u74a8\u74a9\u74aa\u74ab\u74ac\u74ad\u74ae\u74af\u74b0\u74b1\u74b2\u74b3\u74b4\u74b5\u74b6\u74b7\u74b8\u74b9\u74ba\u74bb\u74bc\u74bd\u74be\u74bf\u74c0\u74c1\u74c2\u74c3\u74c4\u74c5\u74c6\u74c7\u74c8\u74c9\u74ca\u74cb\u74cc\u74cd\u74ce\u74cf\u74d0\u74d1\u74d2\u74d3\u74d4\u74d5\u74d6\u74d7\u74d8\u74d9\u74da\u74db\u74dc\u74dd\u74de\u74df\u74e0\u74e1\u74e2\u74e3\u74e4\u74e5\u74e6\u74e7\u74e8\u74e9\u74ea\u74eb\u74ec\u74ed\u74ee\u74ef\u74f0\u74f1\u74f2\u74f3\u74f4\u74f5\u74f6\u74f7\u74f8\u74f9\u74fa\u74fb\u74fc\u74fd\u74fe\u74ff\u7500\u7501\u7502\u7503\u7504\u7505\u7506\u7507\u7508\u7509\u750a\u750b\u750c\u750d\u750e\u750f\u7510\u7511\u7512\u7513\u7514\u7515\u7516\u7517\u7518\u7519\u751a\u751b\u751c\u751d\u751e\u751f\u7520\u7521\u7522\u7523\u7524\u7525\u7526\u7527\u7528\u7529\u752a\u752b\u752c\u752d\u752e\u752f\u7530\u7531\u7532\u7533\u7534\u7535\u7536\u7537\u7538\u7539\u753a\u753b\u753c\u753d\u753e\u753f\u7540\u7541\u7542\u7543\u7544\u7545\u7546\u7547\u7548\u7549\u754a\u754b\u754c\u754d\u754e\u754f\u7550\u7551\u7552\u7553\u7554\u7555\u7556\u7557\u7558\u7559\u755a\u755b\u755c\u755d\u755e\u755f\u7560\u7561\u7562\u7563\u7564\u7565\u7566\u7567\u7568\u7569\u756a\u756b\u756c\u756d\u756e\u756f\u7570\u7571\u7572\u7573\u7574\u7575\u7576\u7577\u7578\u7579\u757a\u757b\u757c\u757d\u757e\u757f\u7580\u7581\u7582\u7583\u7584\u7585\u7586\u7587\u7588\u7589\u758a\u758b\u758c\u758d\u758e\u758f\u7590\u7591\u7592\u7593\u7594\u7595\u7596\u7597\u7598\u7599\u759a\u759b\u759c\u759d\u759e\u759f\u75a0\u75a1\u75a2\u75a3\u75a4\u75a5\u75a6\u75a7\u75a8\u75a9\u75aa\u75ab\u75ac\u75ad\u75ae\u75af\u75b0\u75b1\u75b2\u75b3\u75b4\u75b5\u75b6\u75b7\u75b8\u75b9\u75ba\u75bb\u75bc\u75bd\u75be\u75bf\u75c0\u75c1\u75c2\u75c3\u75c4\u75c5\u75c6\u75c7\u75c8\u75c9\u75ca\u75cb\u75cc\u75cd\u75ce\u75cf\u75d0\u75d1\u75d2\u75d3\u75d4\u75d5\u75d6\u75d7\u75d8\u75d9\u75da\u75db\u75dc\u75dd\u75de\u75df\u75e0\u75e1\u75e2\u75e3\u75e4\u75e5\u75e6\u75e7\u75e8\u75e9\u75ea\u75eb\u75ec\u75ed\u75ee\u75ef\u75f0\u75f1\u75f2\u75f3\u75f4\u75f5\u75f6\u75f7\u75f8\u75f9\u75fa\u75fb\u75fc\u75fd\u75fe\u75ff\u7600\u7601\u7602\u7603\u7604\u7605\u7606\u7607\u7608\u7609\u760a\u760b\u760c\u760d\u760e\u760f\u7610\u7611\u7612\u7613\u7614\u7615\u7616\u7617\u7618\u7619\u761a\u761b\u761c\u761d\u761e\u761f\u7620\u7621\u7622\u7623\u7624\u7625\u7626\u7627\u7628\u7629\u762a\u762b\u762c\u762d\u762e\u762f\u7630\u7631\u7632\u7633\u7634\u7635\u7636\u7637\u7638\u7639\u763a\u763b\u763c\u763d\u763e\u763f\u7640\u7641\u7642\u7643\u7644\u7645\u7646\u7647\u7648\u7649\u764a\u764b\u764c\u764d\u764e\u764f\u7650\u7651\u7652\u7653\u7654\u7655\u7656\u7657\u7658\u7659\u765a\u765b\u765c\u765d\u765e\u765f\u7660\u7661\u7662\u7663\u7664\u7665\u7666\u7667\u7668\u7669\u766a\u766b\u766c\u766d\u766e\u766f\u7670\u7671\u7672\u7673\u7674\u7675\u7676\u7677\u7678\u7679\u767a\u767b\u767c\u767d\u767e\u767f\u7680\u7681\u7682\u7683\u7684\u7685\u7686\u7687\u7688\u7689\u768a\u768b\u768c\u768d\u768e\u768f\u7690\u7691\u7692\u7693\u7694\u7695\u7696\u7697\u7698\u7699\u769a\u769b\u769c\u769d\u769e\u769f\u76a0\u76a1\u76a2\u76a3\u76a4\u76a5\u76a6\u76a7\u76a8\u76a9\u76aa\u76ab\u76ac\u76ad\u76ae\u76af\u76b0\u76b1\u76b2\u76b3\u76b4\u76b5\u76b6\u76b7\u76b8\u76b9\u76ba\u76bb\u76bc\u76bd\u76be\u76bf\u76c0\u76c1\u76c2\u76c3\u76c4\u76c5\u76c6\u76c7\u76c8\u76c9\u76ca\u76cb\u76cc\u76cd\u76ce\u76cf\u76d0\u76d1\u76d2\u76d3\u76d4\u76d5\u76d6\u76d7\u76d8\u76d9\u76da\u76db\u76dc\u76dd\u76de\u76df\u76e0\u76e1\u76e2\u76e3\u76e4\u76e5\u76e6\u76e7\u76e8\u76e9\u76ea\u76eb\u76ec\u76ed\u76ee\u76ef\u76f0\u76f1\u76f2\u76f3\u76f4\u76f5\u76f6\u76f7\u76f8\u76f9\u76fa\u76fb\u76fc\u76fd\u76fe\u76ff\u7700\u7701\u7702\u7703\u7704\u7705\u7706\u7707\u7708\u7709\u770a\u770b\u770c\u770d\u770e\u770f\u7710\u7711\u7712\u7713\u7714\u7715\u7716\u7717\u7718\u7719\u771a\u771b\u771c\u771d\u771e\u771f\u7720\u7721\u7722\u7723\u7724\u7725\u7726\u7727\u7728\u7729\u772a\u772b\u772c\u772d\u772e\u772f\u7730\u7731\u7732\u7733\u7734\u7735\u7736\u7737\u7738\u7739\u773a\u773b\u773c\u773d\u773e\u773f\u7740\u7741\u7742\u7743\u7744\u7745\u7746\u7747\u7748\u7749\u774a\u774b\u774c\u774d\u774e\u774f\u7750\u7751\u7752\u7753\u7754\u7755\u7756\u7757\u7758\u7759\u775a\u775b\u775c\u775d\u775e\u775f\u7760\u7761\u7762\u7763\u7764\u7765\u7766\u7767\u7768\u7769\u776a\u776b\u776c\u776d\u776e\u776f\u7770\u7771\u7772\u7773\u7774\u7775\u7776\u7777\u7778\u7779\u777a\u777b\u777c\u777d\u777e\u777f\u7780\u7781\u7782\u7783\u7784\u7785\u7786\u7787\u7788\u7789\u778a\u778b\u778c\u778d\u778e\u778f\u7790\u7791\u7792\u7793\u7794\u7795\u7796\u7797\u7798\u7799\u779a\u779b\u779c\u779d\u779e\u779f\u77a0\u77a1\u77a2\u77a3\u77a4\u77a5\u77a6\u77a7\u77a8\u77a9\u77aa\u77ab\u77ac\u77ad\u77ae\u77af\u77b0\u77b1\u77b2\u77b3\u77b4\u77b5\u77b6\u77b7\u77b8\u77b9\u77ba\u77bb\u77bc\u77bd\u77be\u77bf\u77c0\u77c1\u77c2\u77c3\u77c4\u77c5\u77c6\u77c7\u77c8\u77c9\u77ca\u77cb\u77cc\u77cd\u77ce\u77cf\u77d0\u77d1\u77d2\u77d3\u77d4\u77d5\u77d6\u77d7\u77d8\u77d9\u77da\u77db\u77dc\u77dd\u77de\u77df\u77e0\u77e1\u77e2\u77e3\u77e4\u77e5\u77e6\u77e7\u77e8\u77e9\u77ea\u77eb\u77ec\u77ed\u77ee\u77ef\u77f0\u77f1\u77f2\u77f3\u77f4\u77f5\u77f6\u77f7\u77f8\u77f9\u77fa\u77fb\u77fc\u77fd\u77fe\u77ff\u7800\u7801\u7802\u7803\u7804\u7805\u7806\u7807\u7808\u7809\u780a\u780b\u780c\u780d\u780e\u780f\u7810\u7811\u7812\u7813\u7814\u7815\u7816\u7817\u7818\u7819\u781a\u781b\u781c\u781d\u781e\u781f\u7820\u7821\u7822\u7823\u7824\u7825\u7826\u7827\u7828\u7829\u782a\u782b\u782c\u782d\u782e\u782f\u7830\u7831\u7832\u7833\u7834\u7835\u7836\u7837\u7838\u7839\u783a\u783b\u783c\u783d\u783e\u783f\u7840\u7841\u7842\u7843\u7844\u7845\u7846\u7847\u7848\u7849\u784a\u784b\u784c\u784d\u784e\u784f\u7850\u7851\u7852\u7853\u7854\u7855\u7856\u7857\u7858\u7859\u785a\u785b\u785c\u785d\u785e\u785f\u7860\u7861\u7862\u7863\u7864\u7865\u7866\u7867\u7868\u7869\u786a\u786b\u786c\u786d\u786e\u786f\u7870\u7871\u7872\u7873\u7874\u7875\u7876\u7877\u7878\u7879\u787a\u787b\u787c\u787d\u787e\u787f\u7880\u7881\u7882\u7883\u7884\u7885\u7886\u7887\u7888\u7889\u788a\u788b\u788c\u788d\u788e\u788f\u7890\u7891\u7892\u7893\u7894\u7895\u7896\u7897\u7898\u7899\u789a\u789b\u789c\u789d\u789e\u789f\u78a0\u78a1\u78a2\u78a3\u78a4\u78a5\u78a6\u78a7\u78a8\u78a9\u78aa\u78ab\u78ac\u78ad\u78ae\u78af\u78b0\u78b1\u78b2\u78b3\u78b4\u78b5\u78b6\u78b7\u78b8\u78b9\u78ba\u78bb\u78bc\u78bd\u78be\u78bf\u78c0\u78c1\u78c2\u78c3\u78c4\u78c5\u78c6\u78c7\u78c8\u78c9\u78ca\u78cb\u78cc\u78cd\u78ce\u78cf\u78d0\u78d1\u78d2\u78d3\u78d4\u78d5\u78d6\u78d7\u78d8\u78d9\u78da\u78db\u78dc\u78dd\u78de\u78df\u78e0\u78e1\u78e2\u78e3\u78e4\u78e5\u78e6\u78e7\u78e8\u78e9\u78ea\u78eb\u78ec\u78ed\u78ee\u78ef\u78f0\u78f1\u78f2\u78f3\u78f4\u78f5\u78f6\u78f7\u78f8\u78f9\u78fa\u78fb\u78fc\u78fd\u78fe\u78ff\u7900\u7901\u7902\u7903\u7904\u7905\u7906\u7907\u7908\u7909\u790a\u790b\u790c\u790d\u790e\u790f\u7910\u7911\u7912\u7913\u7914\u7915\u7916\u7917\u7918\u7919\u791a\u791b\u791c\u791d\u791e\u791f\u7920\u7921\u7922\u7923\u7924\u7925\u7926\u7927\u7928\u7929\u792a\u792b\u792c\u792d\u792e\u792f\u7930\u7931\u7932\u7933\u7934\u7935\u7936\u7937\u7938\u7939\u793a\u793b\u793c\u793d\u793e\u793f\u7940\u7941\u7942\u7943\u7944\u7945\u7946\u7947\u7948\u7949\u794a\u794b\u794c\u794d\u794e\u794f\u7950\u7951\u7952\u7953\u7954\u7955\u7956\u7957\u7958\u7959\u795a\u795b\u795c\u795d\u795e\u795f\u7960\u7961\u7962\u7963\u7964\u7965\u7966\u7967\u7968\u7969\u796a\u796b\u796c\u796d\u796e\u796f\u7970\u7971\u7972\u7973\u7974\u7975\u7976\u7977\u7978\u7979\u797a\u797b\u797c\u797d\u797e\u797f\u7980\u7981\u7982\u7983\u7984\u7985\u7986\u7987\u7988\u7989\u798a\u798b\u798c\u798d\u798e\u798f\u7990\u7991\u7992\u7993\u7994\u7995\u7996\u7997\u7998\u7999\u799a\u799b\u799c\u799d\u799e\u799f\u79a0\u79a1\u79a2\u79a3\u79a4\u79a5\u79a6\u79a7\u79a8\u79a9\u79aa\u79ab\u79ac\u79ad\u79ae\u79af\u79b0\u79b1\u79b2\u79b3\u79b4\u79b5\u79b6\u79b7\u79b8\u79b9\u79ba\u79bb\u79bc\u79bd\u79be\u79bf\u79c0\u79c1\u79c2\u79c3\u79c4\u79c5\u79c6\u79c7\u79c8\u79c9\u79ca\u79cb\u79cc\u79cd\u79ce\u79cf\u79d0\u79d1\u79d2\u79d3\u79d4\u79d5\u79d6\u79d7\u79d8\u79d9\u79da\u79db\u79dc\u79dd\u79de\u79df\u79e0\u79e1\u79e2\u79e3\u79e4\u79e5\u79e6\u79e7\u79e8\u79e9\u79ea\u79eb\u79ec\u79ed\u79ee\u79ef\u79f0\u79f1\u79f2\u79f3\u79f4\u79f5\u79f6\u79f7\u79f8\u79f9\u79fa\u79fb\u79fc\u79fd\u79fe\u79ff\u7a00\u7a01\u7a02\u7a03\u7a04\u7a05\u7a06\u7a07\u7a08\u7a09\u7a0a\u7a0b\u7a0c\u7a0d\u7a0e\u7a0f\u7a10\u7a11\u7a12\u7a13\u7a14\u7a15\u7a16\u7a17\u7a18\u7a19\u7a1a\u7a1b\u7a1c\u7a1d\u7a1e\u7a1f\u7a20\u7a21\u7a22\u7a23\u7a24\u7a25\u7a26\u7a27\u7a28\u7a29\u7a2a\u7a2b\u7a2c\u7a2d\u7a2e\u7a2f\u7a30\u7a31\u7a32\u7a33\u7a34\u7a35\u7a36\u7a37\u7a38\u7a39\u7a3a\u7a3b\u7a3c\u7a3d\u7a3e\u7a3f\u7a40\u7a41\u7a42\u7a43\u7a44\u7a45\u7a46\u7a47\u7a48\u7a49\u7a4a\u7a4b\u7a4c\u7a4d\u7a4e\u7a4f\u7a50\u7a51\u7a52\u7a53\u7a54\u7a55\u7a56\u7a57\u7a58\u7a59\u7a5a\u7a5b\u7a5c\u7a5d\u7a5e\u7a5f\u7a60\u7a61\u7a62\u7a63\u7a64\u7a65\u7a66\u7a67\u7a68\u7a69\u7a6a\u7a6b\u7a6c\u7a6d\u7a6e\u7a6f\u7a70\u7a71\u7a72\u7a73\u7a74\u7a75\u7a76\u7a77\u7a78\u7a79\u7a7a\u7a7b\u7a7c\u7a7d\u7a7e\u7a7f\u7a80\u7a81\u7a82\u7a83\u7a84\u7a85\u7a86\u7a87\u7a88\u7a89\u7a8a\u7a8b\u7a8c\u7a8d\u7a8e\u7a8f\u7a90\u7a91\u7a92\u7a93\u7a94\u7a95\u7a96\u7a97\u7a98\u7a99\u7a9a\u7a9b\u7a9c\u7a9d\u7a9e\u7a9f\u7aa0\u7aa1\u7aa2\u7aa3\u7aa4\u7aa5\u7aa6\u7aa7\u7aa8\u7aa9\u7aaa\u7aab\u7aac\u7aad\u7aae\u7aaf\u7ab0\u7ab1\u7ab2\u7ab3\u7ab4\u7ab5\u7ab6\u7ab7\u7ab8\u7ab9\u7aba\u7abb\u7abc\u7abd\u7abe\u7abf\u7ac0\u7ac1\u7ac2\u7ac3\u7ac4\u7ac5\u7ac6\u7ac7\u7ac8\u7ac9\u7aca\u7acb\u7acc\u7acd\u7ace\u7acf\u7ad0\u7ad1\u7ad2\u7ad3\u7ad4\u7ad5\u7ad6\u7ad7\u7ad8\u7ad9\u7ada\u7adb\u7adc\u7add\u7ade\u7adf\u7ae0\u7ae1\u7ae2\u7ae3\u7ae4\u7ae5\u7ae6\u7ae7\u7ae8\u7ae9\u7aea\u7aeb\u7aec\u7aed\u7aee\u7aef\u7af0\u7af1\u7af2\u7af3\u7af4\u7af5\u7af6\u7af7\u7af8\u7af9\u7afa\u7afb\u7afc\u7afd\u7afe\u7aff\u7b00\u7b01\u7b02\u7b03\u7b04\u7b05\u7b06\u7b07\u7b08\u7b09\u7b0a\u7b0b\u7b0c\u7b0d\u7b0e\u7b0f\u7b10\u7b11\u7b12\u7b13\u7b14\u7b15\u7b16\u7b17\u7b18\u7b19\u7b1a\u7b1b\u7b1c\u7b1d\u7b1e\u7b1f\u7b20\u7b21\u7b22\u7b23\u7b24\u7b25\u7b26\u7b27\u7b28\u7b29\u7b2a\u7b2b\u7b2c\u7b2d\u7b2e\u7b2f\u7b30\u7b31\u7b32\u7b33\u7b34\u7b35\u7b36\u7b37\u7b38\u7b39\u7b3a\u7b3b\u7b3c\u7b3d\u7b3e\u7b3f\u7b40\u7b41\u7b42\u7b43\u7b44\u7b45\u7b46\u7b47\u7b48\u7b49\u7b4a\u7b4b\u7b4c\u7b4d\u7b4e\u7b4f\u7b50\u7b51\u7b52\u7b53\u7b54\u7b55\u7b56\u7b57\u7b58\u7b59\u7b5a\u7b5b\u7b5c\u7b5d\u7b5e\u7b5f\u7b60\u7b61\u7b62\u7b63\u7b64\u7b65\u7b66\u7b67\u7b68\u7b69\u7b6a\u7b6b\u7b6c\u7b6d\u7b6e\u7b6f\u7b70\u7b71\u7b72\u7b73\u7b74\u7b75\u7b76\u7b77\u7b78\u7b79\u7b7a\u7b7b\u7b7c\u7b7d\u7b7e\u7b7f\u7b80\u7b81\u7b82\u7b83\u7b84\u7b85\u7b86\u7b87\u7b88\u7b89\u7b8a\u7b8b\u7b8c\u7b8d\u7b8e\u7b8f\u7b90\u7b91\u7b92\u7b93\u7b94\u7b95\u7b96\u7b97\u7b98\u7b99\u7b9a\u7b9b\u7b9c\u7b9d\u7b9e\u7b9f\u7ba0\u7ba1\u7ba2\u7ba3\u7ba4\u7ba5\u7ba6\u7ba7\u7ba8\u7ba9\u7baa\u7bab\u7bac\u7bad\u7bae\u7baf\u7bb0\u7bb1\u7bb2\u7bb3\u7bb4\u7bb5\u7bb6\u7bb7\u7bb8\u7bb9\u7bba\u7bbb\u7bbc\u7bbd\u7bbe\u7bbf\u7bc0\u7bc1\u7bc2\u7bc3\u7bc4\u7bc5\u7bc6\u7bc7\u7bc8\u7bc9\u7bca\u7bcb\u7bcc\u7bcd\u7bce\u7bcf\u7bd0\u7bd1\u7bd2\u7bd3\u7bd4\u7bd5\u7bd6\u7bd7\u7bd8\u7bd9\u7bda\u7bdb\u7bdc\u7bdd\u7bde\u7bdf\u7be0\u7be1\u7be2\u7be3\u7be4\u7be5\u7be6\u7be7\u7be8\u7be9\u7bea\u7beb\u7bec\u7bed\u7bee\u7bef\u7bf0\u7bf1\u7bf2\u7bf3\u7bf4\u7bf5\u7bf6\u7bf7\u7bf8\u7bf9\u7bfa\u7bfb\u7bfc\u7bfd\u7bfe\u7bff\u7c00\u7c01\u7c02\u7c03\u7c04\u7c05\u7c06\u7c07\u7c08\u7c09\u7c0a\u7c0b\u7c0c\u7c0d\u7c0e\u7c0f\u7c10\u7c11\u7c12\u7c13\u7c14\u7c15\u7c16\u7c17\u7c18\u7c19\u7c1a\u7c1b\u7c1c\u7c1d\u7c1e\u7c1f\u7c20\u7c21\u7c22\u7c23\u7c24\u7c25\u7c26\u7c27\u7c28\u7c29\u7c2a\u7c2b\u7c2c\u7c2d\u7c2e\u7c2f\u7c30\u7c31\u7c32\u7c33\u7c34\u7c35\u7c36\u7c37\u7c38\u7c39\u7c3a\u7c3b\u7c3c\u7c3d\u7c3e\u7c3f\u7c40\u7c41\u7c42\u7c43\u7c44\u7c45\u7c46\u7c47\u7c48\u7c49\u7c4a\u7c4b\u7c4c\u7c4d\u7c4e\u7c4f\u7c50\u7c51\u7c52\u7c53\u7c54\u7c55\u7c56\u7c57\u7c58\u7c59\u7c5a\u7c5b\u7c5c\u7c5d\u7c5e\u7c5f\u7c60\u7c61\u7c62\u7c63\u7c64\u7c65\u7c66\u7c67\u7c68\u7c69\u7c6a\u7c6b\u7c6c\u7c6d\u7c6e\u7c6f\u7c70\u7c71\u7c72\u7c73\u7c74\u7c75\u7c76\u7c77\u7c78\u7c79\u7c7a\u7c7b\u7c7c\u7c7d\u7c7e\u7c7f\u7c80\u7c81\u7c82\u7c83\u7c84\u7c85\u7c86\u7c87\u7c88\u7c89\u7c8a\u7c8b\u7c8c\u7c8d\u7c8e\u7c8f\u7c90\u7c91\u7c92\u7c93\u7c94\u7c95\u7c96\u7c97\u7c98\u7c99\u7c9a\u7c9b\u7c9c\u7c9d\u7c9e\u7c9f\u7ca0\u7ca1\u7ca2\u7ca3\u7ca4\u7ca5\u7ca6\u7ca7\u7ca8\u7ca9\u7caa\u7cab\u7cac\u7cad\u7cae\u7caf\u7cb0\u7cb1\u7cb2\u7cb3\u7cb4\u7cb5\u7cb6\u7cb7\u7cb8\u7cb9\u7cba\u7cbb\u7cbc\u7cbd\u7cbe\u7cbf\u7cc0\u7cc1\u7cc2\u7cc3\u7cc4\u7cc5\u7cc6\u7cc7\u7cc8\u7cc9\u7cca\u7ccb\u7ccc\u7ccd\u7cce\u7ccf\u7cd0\u7cd1\u7cd2\u7cd3\u7cd4\u7cd5\u7cd6\u7cd7\u7cd8\u7cd9\u7cda\u7cdb\u7cdc\u7cdd\u7cde\u7cdf\u7ce0\u7ce1\u7ce2\u7ce3\u7ce4\u7ce5\u7ce6\u7ce7\u7ce8\u7ce9\u7cea\u7ceb\u7cec\u7ced\u7cee\u7cef\u7cf0\u7cf1\u7cf2\u7cf3\u7cf4\u7cf5\u7cf6\u7cf7\u7cf8\u7cf9\u7cfa\u7cfb\u7cfc\u7cfd\u7cfe\u7cff\u7d00\u7d01\u7d02\u7d03\u7d04\u7d05\u7d06\u7d07\u7d08\u7d09\u7d0a\u7d0b\u7d0c\u7d0d\u7d0e\u7d0f\u7d10\u7d11\u7d12\u7d13\u7d14\u7d15\u7d16\u7d17\u7d18\u7d19\u7d1a\u7d1b\u7d1c\u7d1d\u7d1e\u7d1f\u7d20\u7d21\u7d22\u7d23\u7d24\u7d25\u7d26\u7d27\u7d28\u7d29\u7d2a\u7d2b\u7d2c\u7d2d\u7d2e\u7d2f\u7d30\u7d31\u7d32\u7d33\u7d34\u7d35\u7d36\u7d37\u7d38\u7d39\u7d3a\u7d3b\u7d3c\u7d3d\u7d3e\u7d3f\u7d40\u7d41\u7d42\u7d43\u7d44\u7d45\u7d46\u7d47\u7d48\u7d49\u7d4a\u7d4b\u7d4c\u7d4d\u7d4e\u7d4f\u7d50\u7d51\u7d52\u7d53\u7d54\u7d55\u7d56\u7d57\u7d58\u7d59\u7d5a\u7d5b\u7d5c\u7d5d\u7d5e\u7d5f\u7d60\u7d61\u7d62\u7d63\u7d64\u7d65\u7d66\u7d67\u7d68\u7d69\u7d6a\u7d6b\u7d6c\u7d6d\u7d6e\u7d6f\u7d70\u7d71\u7d72\u7d73\u7d74\u7d75\u7d76\u7d77\u7d78\u7d79\u7d7a\u7d7b\u7d7c\u7d7d\u7d7e\u7d7f\u7d80\u7d81\u7d82\u7d83\u7d84\u7d85\u7d86\u7d87\u7d88\u7d89\u7d8a\u7d8b\u7d8c\u7d8d\u7d8e\u7d8f\u7d90\u7d91\u7d92\u7d93\u7d94\u7d95\u7d96\u7d97\u7d98\u7d99\u7d9a\u7d9b\u7d9c\u7d9d\u7d9e\u7d9f\u7da0\u7da1\u7da2\u7da3\u7da4\u7da5\u7da6\u7da7\u7da8\u7da9\u7daa\u7dab\u7dac\u7dad\u7dae\u7daf\u7db0\u7db1\u7db2\u7db3\u7db4\u7db5\u7db6\u7db7\u7db8\u7db9\u7dba\u7dbb\u7dbc\u7dbd\u7dbe\u7dbf\u7dc0\u7dc1\u7dc2\u7dc3\u7dc4\u7dc5\u7dc6\u7dc7\u7dc8\u7dc9\u7dca\u7dcb\u7dcc\u7dcd\u7dce\u7dcf\u7dd0\u7dd1\u7dd2\u7dd3\u7dd4\u7dd5\u7dd6\u7dd7\u7dd8\u7dd9\u7dda\u7ddb\u7ddc\u7ddd\u7dde\u7ddf\u7de0\u7de1\u7de2\u7de3\u7de4\u7de5\u7de6\u7de7\u7de8\u7de9\u7dea\u7deb\u7dec\u7ded\u7dee\u7def\u7df0\u7df1\u7df2\u7df3\u7df4\u7df5\u7df6\u7df7\u7df8\u7df9\u7dfa\u7dfb\u7dfc\u7dfd\u7dfe\u7dff\u7e00\u7e01\u7e02\u7e03\u7e04\u7e05\u7e06\u7e07\u7e08\u7e09\u7e0a\u7e0b\u7e0c\u7e0d\u7e0e\u7e0f\u7e10\u7e11\u7e12\u7e13\u7e14\u7e15\u7e16\u7e17\u7e18\u7e19\u7e1a\u7e1b\u7e1c\u7e1d\u7e1e\u7e1f\u7e20\u7e21\u7e22\u7e23\u7e24\u7e25\u7e26\u7e27\u7e28\u7e29\u7e2a\u7e2b\u7e2c\u7e2d\u7e2e\u7e2f\u7e30\u7e31\u7e32\u7e33\u7e34\u7e35\u7e36\u7e37\u7e38\u7e39\u7e3a\u7e3b\u7e3c\u7e3d\u7e3e\u7e3f\u7e40\u7e41\u7e42\u7e43\u7e44\u7e45\u7e46\u7e47\u7e48\u7e49\u7e4a\u7e4b\u7e4c\u7e4d\u7e4e\u7e4f\u7e50\u7e51\u7e52\u7e53\u7e54\u7e55\u7e56\u7e57\u7e58\u7e59\u7e5a\u7e5b\u7e5c\u7e5d\u7e5e\u7e5f\u7e60\u7e61\u7e62\u7e63\u7e64\u7e65\u7e66\u7e67\u7e68\u7e69\u7e6a\u7e6b\u7e6c\u7e6d\u7e6e\u7e6f\u7e70\u7e71\u7e72\u7e73\u7e74\u7e75\u7e76\u7e77\u7e78\u7e79\u7e7a\u7e7b\u7e7c\u7e7d\u7e7e\u7e7f\u7e80\u7e81\u7e82\u7e83\u7e84\u7e85\u7e86\u7e87\u7e88\u7e89\u7e8a\u7e8b\u7e8c\u7e8d\u7e8e\u7e8f\u7e90\u7e91\u7e92\u7e93\u7e94\u7e95\u7e96\u7e97\u7e98\u7e99\u7e9a\u7e9b\u7e9c\u7e9d\u7e9e\u7e9f\u7ea0\u7ea1\u7ea2\u7ea3\u7ea4\u7ea5\u7ea6\u7ea7\u7ea8\u7ea9\u7eaa\u7eab\u7eac\u7ead\u7eae\u7eaf\u7eb0\u7eb1\u7eb2\u7eb3\u7eb4\u7eb5\u7eb6\u7eb7\u7eb8\u7eb9\u7eba\u7ebb\u7ebc\u7ebd\u7ebe\u7ebf\u7ec0\u7ec1\u7ec2\u7ec3\u7ec4\u7ec5\u7ec6\u7ec7\u7ec8\u7ec9\u7eca\u7ecb\u7ecc\u7ecd\u7ece\u7ecf\u7ed0\u7ed1\u7ed2\u7ed3\u7ed4\u7ed5\u7ed6\u7ed7\u7ed8\u7ed9\u7eda\u7edb\u7edc\u7edd\u7ede\u7edf\u7ee0\u7ee1\u7ee2\u7ee3\u7ee4\u7ee5\u7ee6\u7ee7\u7ee8\u7ee9\u7eea\u7eeb\u7eec\u7eed\u7eee\u7eef\u7ef0\u7ef1\u7ef2\u7ef3\u7ef4\u7ef5\u7ef6\u7ef7\u7ef8\u7ef9\u7efa\u7efb\u7efc\u7efd\u7efe\u7eff\u7f00\u7f01\u7f02\u7f03\u7f04\u7f05\u7f06\u7f07\u7f08\u7f09\u7f0a\u7f0b\u7f0c\u7f0d\u7f0e\u7f0f\u7f10\u7f11\u7f12\u7f13\u7f14\u7f15\u7f16\u7f17\u7f18\u7f19\u7f1a\u7f1b\u7f1c\u7f1d\u7f1e\u7f1f\u7f20\u7f21\u7f22\u7f23\u7f24\u7f25\u7f26\u7f27\u7f28\u7f29\u7f2a\u7f2b\u7f2c\u7f2d\u7f2e\u7f2f\u7f30\u7f31\u7f32\u7f33\u7f34\u7f35\u7f36\u7f37\u7f38\u7f39\u7f3a\u7f3b\u7f3c\u7f3d\u7f3e\u7f3f\u7f40\u7f41\u7f42\u7f43\u7f44\u7f45\u7f46\u7f47\u7f48\u7f49\u7f4a\u7f4b\u7f4c\u7f4d\u7f4e\u7f4f\u7f50\u7f51\u7f52\u7f53\u7f54\u7f55\u7f56\u7f57\u7f58\u7f59\u7f5a\u7f5b\u7f5c\u7f5d\u7f5e\u7f5f\u7f60\u7f61\u7f62\u7f63\u7f64\u7f65\u7f66\u7f67\u7f68\u7f69\u7f6a\u7f6b\u7f6c\u7f6d\u7f6e\u7f6f\u7f70\u7f71\u7f72\u7f73\u7f74\u7f75\u7f76\u7f77\u7f78\u7f79\u7f7a\u7f7b\u7f7c\u7f7d\u7f7e\u7f7f\u7f80\u7f81\u7f82\u7f83\u7f84\u7f85\u7f86\u7f87\u7f88\u7f89\u7f8a\u7f8b\u7f8c\u7f8d\u7f8e\u7f8f\u7f90\u7f91\u7f92\u7f93\u7f94\u7f95\u7f96\u7f97\u7f98\u7f99\u7f9a\u7f9b\u7f9c\u7f9d\u7f9e\u7f9f\u7fa0\u7fa1\u7fa2\u7fa3\u7fa4\u7fa5\u7fa6\u7fa7\u7fa8\u7fa9\u7faa\u7fab\u7fac\u7fad\u7fae\u7faf\u7fb0\u7fb1\u7fb2\u7fb3\u7fb4\u7fb5\u7fb6\u7fb7\u7fb8\u7fb9\u7fba\u7fbb\u7fbc\u7fbd\u7fbe\u7fbf\u7fc0\u7fc1\u7fc2\u7fc3\u7fc4\u7fc5\u7fc6\u7fc7\u7fc8\u7fc9\u7fca\u7fcb\u7fcc\u7fcd\u7fce\u7fcf\u7fd0\u7fd1\u7fd2\u7fd3\u7fd4\u7fd5\u7fd6\u7fd7\u7fd8\u7fd9\u7fda\u7fdb\u7fdc\u7fdd\u7fde\u7fdf\u7fe0\u7fe1\u7fe2\u7fe3\u7fe4\u7fe5\u7fe6\u7fe7\u7fe8\u7fe9\u7fea\u7feb\u7fec\u7fed\u7fee\u7fef\u7ff0\u7ff1\u7ff2\u7ff3\u7ff4\u7ff5\u7ff6\u7ff7\u7ff8\u7ff9\u7ffa\u7ffb\u7ffc\u7ffd\u7ffe\u7fff\u8000\u8001\u8002\u8003\u8004\u8005\u8006\u8007\u8008\u8009\u800a\u800b\u800c\u800d\u800e\u800f\u8010\u8011\u8012\u8013\u8014\u8015\u8016\u8017\u8018\u8019\u801a\u801b\u801c\u801d\u801e\u801f\u8020\u8021\u8022\u8023\u8024\u8025\u8026\u8027\u8028\u8029\u802a\u802b\u802c\u802d\u802e\u802f\u8030\u8031\u8032\u8033\u8034\u8035\u8036\u8037\u8038\u8039\u803a\u803b\u803c\u803d\u803e\u803f\u8040\u8041\u8042\u8043\u8044\u8045\u8046\u8047\u8048\u8049\u804a\u804b\u804c\u804d\u804e\u804f\u8050\u8051\u8052\u8053\u8054\u8055\u8056\u8057\u8058\u8059\u805a\u805b\u805c\u805d\u805e\u805f\u8060\u8061\u8062\u8063\u8064\u8065\u8066\u8067\u8068\u8069\u806a\u806b\u806c\u806d\u806e\u806f\u8070\u8071\u8072\u8073\u8074\u8075\u8076\u8077\u8078\u8079\u807a\u807b\u807c\u807d\u807e\u807f\u8080\u8081\u8082\u8083\u8084\u8085\u8086\u8087\u8088\u8089\u808a\u808b\u808c\u808d\u808e\u808f\u8090\u8091\u8092\u8093\u8094\u8095\u8096\u8097\u8098\u8099\u809a\u809b\u809c\u809d\u809e\u809f\u80a0\u80a1\u80a2\u80a3\u80a4\u80a5\u80a6\u80a7\u80a8\u80a9\u80aa\u80ab\u80ac\u80ad\u80ae\u80af\u80b0\u80b1\u80b2\u80b3\u80b4\u80b5\u80b6\u80b7\u80b8\u80b9\u80ba\u80bb\u80bc\u80bd\u80be\u80bf\u80c0\u80c1\u80c2\u80c3\u80c4\u80c5\u80c6\u80c7\u80c8\u80c9\u80ca\u80cb\u80cc\u80cd\u80ce\u80cf\u80d0\u80d1\u80d2\u80d3\u80d4\u80d5\u80d6\u80d7\u80d8\u80d9\u80da\u80db\u80dc\u80dd\u80de\u80df\u80e0\u80e1\u80e2\u80e3\u80e4\u80e5\u80e6\u80e7\u80e8\u80e9\u80ea\u80eb\u80ec\u80ed\u80ee\u80ef\u80f0\u80f1\u80f2\u80f3\u80f4\u80f5\u80f6\u80f7\u80f8\u80f9\u80fa\u80fb\u80fc\u80fd\u80fe\u80ff\u8100\u8101\u8102\u8103\u8104\u8105\u8106\u8107\u8108\u8109\u810a\u810b\u810c\u810d\u810e\u810f\u8110\u8111\u8112\u8113\u8114\u8115\u8116\u8117\u8118\u8119\u811a\u811b\u811c\u811d\u811e\u811f\u8120\u8121\u8122\u8123\u8124\u8125\u8126\u8127\u8128\u8129\u812a\u812b\u812c\u812d\u812e\u812f\u8130\u8131\u8132\u8133\u8134\u8135\u8136\u8137\u8138\u8139\u813a\u813b\u813c\u813d\u813e\u813f\u8140\u8141\u8142\u8143\u8144\u8145\u8146\u8147\u8148\u8149\u814a\u814b\u814c\u814d\u814e\u814f\u8150\u8151\u8152\u8153\u8154\u8155\u8156\u8157\u8158\u8159\u815a\u815b\u815c\u815d\u815e\u815f\u8160\u8161\u8162\u8163\u8164\u8165\u8166\u8167\u8168\u8169\u816a\u816b\u816c\u816d\u816e\u816f\u8170\u8171\u8172\u8173\u8174\u8175\u8176\u8177\u8178\u8179\u817a\u817b\u817c\u817d\u817e\u817f\u8180\u8181\u8182\u8183\u8184\u8185\u8186\u8187\u8188\u8189\u818a\u818b\u818c\u818d\u818e\u818f\u8190\u8191\u8192\u8193\u8194\u8195\u8196\u8197\u8198\u8199\u819a\u819b\u819c\u819d\u819e\u819f\u81a0\u81a1\u81a2\u81a3\u81a4\u81a5\u81a6\u81a7\u81a8\u81a9\u81aa\u81ab\u81ac\u81ad\u81ae\u81af\u81b0\u81b1\u81b2\u81b3\u81b4\u81b5\u81b6\u81b7\u81b8\u81b9\u81ba\u81bb\u81bc\u81bd\u81be\u81bf\u81c0\u81c1\u81c2\u81c3\u81c4\u81c5\u81c6\u81c7\u81c8\u81c9\u81ca\u81cb\u81cc\u81cd\u81ce\u81cf\u81d0\u81d1\u81d2\u81d3\u81d4\u81d5\u81d6\u81d7\u81d8\u81d9\u81da\u81db\u81dc\u81dd\u81de\u81df\u81e0\u81e1\u81e2\u81e3\u81e4\u81e5\u81e6\u81e7\u81e8\u81e9\u81ea\u81eb\u81ec\u81ed\u81ee\u81ef\u81f0\u81f1\u81f2\u81f3\u81f4\u81f5\u81f6\u81f7\u81f8\u81f9\u81fa\u81fb\u81fc\u81fd\u81fe\u81ff\u8200\u8201\u8202\u8203\u8204\u8205\u8206\u8207\u8208\u8209\u820a\u820b\u820c\u820d\u820e\u820f\u8210\u8211\u8212\u8213\u8214\u8215\u8216\u8217\u8218\u8219\u821a\u821b\u821c\u821d\u821e\u821f\u8220\u8221\u8222\u8223\u8224\u8225\u8226\u8227\u8228\u8229\u822a\u822b\u822c\u822d\u822e\u822f\u8230\u8231\u8232\u8233\u8234\u8235\u8236\u8237\u8238\u8239\u823a\u823b\u823c\u823d\u823e\u823f\u8240\u8241\u8242\u8243\u8244\u8245\u8246\u8247\u8248\u8249\u824a\u824b\u824c\u824d\u824e\u824f\u8250\u8251\u8252\u8253\u8254\u8255\u8256\u8257\u8258\u8259\u825a\u825b\u825c\u825d\u825e\u825f\u8260\u8261\u8262\u8263\u8264\u8265\u8266\u8267\u8268\u8269\u826a\u826b\u826c\u826d\u826e\u826f\u8270\u8271\u8272\u8273\u8274\u8275\u8276\u8277\u8278\u8279\u827a\u827b\u827c\u827d\u827e\u827f\u8280\u8281\u8282\u8283\u8284\u8285\u8286\u8287\u8288\u8289\u828a\u828b\u828c\u828d\u828e\u828f\u8290\u8291\u8292\u8293\u8294\u8295\u8296\u8297\u8298\u8299\u829a\u829b\u829c\u829d\u829e\u829f\u82a0\u82a1\u82a2\u82a3\u82a4\u82a5\u82a6\u82a7\u82a8\u82a9\u82aa\u82ab\u82ac\u82ad\u82ae\u82af\u82b0\u82b1\u82b2\u82b3\u82b4\u82b5\u82b6\u82b7\u82b8\u82b9\u82ba\u82bb\u82bc\u82bd\u82be\u82bf\u82c0\u82c1\u82c2\u82c3\u82c4\u82c5\u82c6\u82c7\u82c8\u82c9\u82ca\u82cb\u82cc\u82cd\u82ce\u82cf\u82d0\u82d1\u82d2\u82d3\u82d4\u82d5\u82d6\u82d7\u82d8\u82d9\u82da\u82db\u82dc\u82dd\u82de\u82df\u82e0\u82e1\u82e2\u82e3\u82e4\u82e5\u82e6\u82e7\u82e8\u82e9\u82ea\u82eb\u82ec\u82ed\u82ee\u82ef\u82f0\u82f1\u82f2\u82f3\u82f4\u82f5\u82f6\u82f7\u82f8\u82f9\u82fa\u82fb\u82fc\u82fd\u82fe\u82ff\u8300\u8301\u8302\u8303\u8304\u8305\u8306\u8307\u8308\u8309\u830a\u830b\u830c\u830d\u830e\u830f\u8310\u8311\u8312\u8313\u8314\u8315\u8316\u8317\u8318\u8319\u831a\u831b\u831c\u831d\u831e\u831f\u8320\u8321\u8322\u8323\u8324\u8325\u8326\u8327\u8328\u8329\u832a\u832b\u832c\u832d\u832e\u832f\u8330\u8331\u8332\u8333\u8334\u8335\u8336\u8337\u8338\u8339\u833a\u833b\u833c\u833d\u833e\u833f\u8340\u8341\u8342\u8343\u8344\u8345\u8346\u8347\u8348\u8349\u834a\u834b\u834c\u834d\u834e\u834f\u8350\u8351\u8352\u8353\u8354\u8355\u8356\u8357\u8358\u8359\u835a\u835b\u835c\u835d\u835e\u835f\u8360\u8361\u8362\u8363\u8364\u8365\u8366\u8367\u8368\u8369\u836a\u836b\u836c\u836d\u836e\u836f\u8370\u8371\u8372\u8373\u8374\u8375\u8376\u8377\u8378\u8379\u837a\u837b\u837c\u837d\u837e\u837f\u8380\u8381\u8382\u8383\u8384\u8385\u8386\u8387\u8388\u8389\u838a\u838b\u838c\u838d\u838e\u838f\u8390\u8391\u8392\u8393\u8394\u8395\u8396\u8397\u8398\u8399\u839a\u839b\u839c\u839d\u839e\u839f\u83a0\u83a1\u83a2\u83a3\u83a4\u83a5\u83a6\u83a7\u83a8\u83a9\u83aa\u83ab\u83ac\u83ad\u83ae\u83af\u83b0\u83b1\u83b2\u83b3\u83b4\u83b5\u83b6\u83b7\u83b8\u83b9\u83ba\u83bb\u83bc\u83bd\u83be\u83bf\u83c0\u83c1\u83c2\u83c3\u83c4\u83c5\u83c6\u83c7\u83c8\u83c9\u83ca\u83cb\u83cc\u83cd\u83ce\u83cf\u83d0\u83d1\u83d2\u83d3\u83d4\u83d5\u83d6\u83d7\u83d8\u83d9\u83da\u83db\u83dc\u83dd\u83de\u83df\u83e0\u83e1\u83e2\u83e3\u83e4\u83e5\u83e6\u83e7\u83e8\u83e9\u83ea\u83eb\u83ec\u83ed\u83ee\u83ef\u83f0\u83f1\u83f2\u83f3\u83f4\u83f5\u83f6\u83f7\u83f8\u83f9\u83fa\u83fb\u83fc\u83fd\u83fe\u83ff\u8400\u8401\u8402\u8403\u8404\u8405\u8406\u8407\u8408\u8409\u840a\u840b\u840c\u840d\u840e\u840f\u8410\u8411\u8412\u8413\u8414\u8415\u8416\u8417\u8418\u8419\u841a\u841b\u841c\u841d\u841e\u841f\u8420\u8421\u8422\u8423\u8424\u8425\u8426\u8427\u8428\u8429\u842a\u842b\u842c\u842d\u842e\u842f\u8430\u8431\u8432\u8433\u8434\u8435\u8436\u8437\u8438\u8439\u843a\u843b\u843c\u843d\u843e\u843f\u8440\u8441\u8442\u8443\u8444\u8445\u8446\u8447\u8448\u8449\u844a\u844b\u844c\u844d\u844e\u844f\u8450\u8451\u8452\u8453\u8454\u8455\u8456\u8457\u8458\u8459\u845a\u845b\u845c\u845d\u845e\u845f\u8460\u8461\u8462\u8463\u8464\u8465\u8466\u8467\u8468\u8469\u846a\u846b\u846c\u846d\u846e\u846f\u8470\u8471\u8472\u8473\u8474\u8475\u8476\u8477\u8478\u8479\u847a\u847b\u847c\u847d\u847e\u847f\u8480\u8481\u8482\u8483\u8484\u8485\u8486\u8487\u8488\u8489\u848a\u848b\u848c\u848d\u848e\u848f\u8490\u8491\u8492\u8493\u8494\u8495\u8496\u8497\u8498\u8499\u849a\u849b\u849c\u849d\u849e\u849f\u84a0\u84a1\u84a2\u84a3\u84a4\u84a5\u84a6\u84a7\u84a8\u84a9\u84aa\u84ab\u84ac\u84ad\u84ae\u84af\u84b0\u84b1\u84b2\u84b3\u84b4\u84b5\u84b6\u84b7\u84b8\u84b9\u84ba\u84bb\u84bc\u84bd\u84be\u84bf\u84c0\u84c1\u84c2\u84c3\u84c4\u84c5\u84c6\u84c7\u84c8\u84c9\u84ca\u84cb\u84cc\u84cd\u84ce\u84cf\u84d0\u84d1\u84d2\u84d3\u84d4\u84d5\u84d6\u84d7\u84d8\u84d9\u84da\u84db\u84dc\u84dd\u84de\u84df\u84e0\u84e1\u84e2\u84e3\u84e4\u84e5\u84e6\u84e7\u84e8\u84e9\u84ea\u84eb\u84ec\u84ed\u84ee\u84ef\u84f0\u84f1\u84f2\u84f3\u84f4\u84f5\u84f6\u84f7\u84f8\u84f9\u84fa\u84fb\u84fc\u84fd\u84fe\u84ff\u8500\u8501\u8502\u8503\u8504\u8505\u8506\u8507\u8508\u8509\u850a\u850b\u850c\u850d\u850e\u850f\u8510\u8511\u8512\u8513\u8514\u8515\u8516\u8517\u8518\u8519\u851a\u851b\u851c\u851d\u851e\u851f\u8520\u8521\u8522\u8523\u8524\u8525\u8526\u8527\u8528\u8529\u852a\u852b\u852c\u852d\u852e\u852f\u8530\u8531\u8532\u8533\u8534\u8535\u8536\u8537\u8538\u8539\u853a\u853b\u853c\u853d\u853e\u853f\u8540\u8541\u8542\u8543\u8544\u8545\u8546\u8547\u8548\u8549\u854a\u854b\u854c\u854d\u854e\u854f\u8550\u8551\u8552\u8553\u8554\u8555\u8556\u8557\u8558\u8559\u855a\u855b\u855c\u855d\u855e\u855f\u8560\u8561\u8562\u8563\u8564\u8565\u8566\u8567\u8568\u8569\u856a\u856b\u856c\u856d\u856e\u856f\u8570\u8571\u8572\u8573\u8574\u8575\u8576\u8577\u8578\u8579\u857a\u857b\u857c\u857d\u857e\u857f\u8580\u8581\u8582\u8583\u8584\u8585\u8586\u8587\u8588\u8589\u858a\u858b\u858c\u858d\u858e\u858f\u8590\u8591\u8592\u8593\u8594\u8595\u8596\u8597\u8598\u8599\u859a\u859b\u859c\u859d\u859e\u859f\u85a0\u85a1\u85a2\u85a3\u85a4\u85a5\u85a6\u85a7\u85a8\u85a9\u85aa\u85ab\u85ac\u85ad\u85ae\u85af\u85b0\u85b1\u85b2\u85b3\u85b4\u85b5\u85b6\u85b7\u85b8\u85b9\u85ba\u85bb\u85bc\u85bd\u85be\u85bf\u85c0\u85c1\u85c2\u85c3\u85c4\u85c5\u85c6\u85c7\u85c8\u85c9\u85ca\u85cb\u85cc\u85cd\u85ce\u85cf\u85d0\u85d1\u85d2\u85d3\u85d4\u85d5\u85d6\u85d7\u85d8\u85d9\u85da\u85db\u85dc\u85dd\u85de\u85df\u85e0\u85e1\u85e2\u85e3\u85e4\u85e5\u85e6\u85e7\u85e8\u85e9\u85ea\u85eb\u85ec\u85ed\u85ee\u85ef\u85f0\u85f1\u85f2\u85f3\u85f4\u85f5\u85f6\u85f7\u85f8\u85f9\u85fa\u85fb\u85fc\u85fd\u85fe\u85ff\u8600\u8601\u8602\u8603\u8604\u8605\u8606\u8607\u8608\u8609\u860a\u860b\u860c\u860d\u860e\u860f\u8610\u8611\u8612\u8613\u8614\u8615\u8616\u8617\u8618\u8619\u861a\u861b\u861c\u861d\u861e\u861f\u8620\u8621\u8622\u8623\u8624\u8625\u8626\u8627\u8628\u8629\u862a\u862b\u862c\u862d\u862e\u862f\u8630\u8631\u8632\u8633\u8634\u8635\u8636\u8637\u8638\u8639\u863a\u863b\u863c\u863d\u863e\u863f\u8640\u8641\u8642\u8643\u8644\u8645\u8646\u8647\u8648\u8649\u864a\u864b\u864c\u864d\u864e\u864f\u8650\u8651\u8652\u8653\u8654\u8655\u8656\u8657\u8658\u8659\u865a\u865b\u865c\u865d\u865e\u865f\u8660\u8661\u8662\u8663\u8664\u8665\u8666\u8667\u8668\u8669\u866a\u866b\u866c\u866d\u866e\u866f\u8670\u8671\u8672\u8673\u8674\u8675\u8676\u8677\u8678\u8679\u867a\u867b\u867c\u867d\u867e\u867f\u8680\u8681\u8682\u8683\u8684\u8685\u8686\u8687\u8688\u8689\u868a\u868b\u868c\u868d\u868e\u868f\u8690\u8691\u8692\u8693\u8694\u8695\u8696\u8697\u8698\u8699\u869a\u869b\u869c\u869d\u869e\u869f\u86a0\u86a1\u86a2\u86a3\u86a4\u86a5\u86a6\u86a7\u86a8\u86a9\u86aa\u86ab\u86ac\u86ad\u86ae\u86af\u86b0\u86b1\u86b2\u86b3\u86b4\u86b5\u86b6\u86b7\u86b8\u86b9\u86ba\u86bb\u86bc\u86bd\u86be\u86bf\u86c0\u86c1\u86c2\u86c3\u86c4\u86c5\u86c6\u86c7\u86c8\u86c9\u86ca\u86cb\u86cc\u86cd\u86ce\u86cf\u86d0\u86d1\u86d2\u86d3\u86d4\u86d5\u86d6\u86d7\u86d8\u86d9\u86da\u86db\u86dc\u86dd\u86de\u86df\u86e0\u86e1\u86e2\u86e3\u86e4\u86e5\u86e6\u86e7\u86e8\u86e9\u86ea\u86eb\u86ec\u86ed\u86ee\u86ef\u86f0\u86f1\u86f2\u86f3\u86f4\u86f5\u86f6\u86f7\u86f8\u86f9\u86fa\u86fb\u86fc\u86fd\u86fe\u86ff\u8700\u8701\u8702\u8703\u8704\u8705\u8706\u8707\u8708\u8709\u870a\u870b\u870c\u870d\u870e\u870f\u8710\u8711\u8712\u8713\u8714\u8715\u8716\u8717\u8718\u8719\u871a\u871b\u871c\u871d\u871e\u871f\u8720\u8721\u8722\u8723\u8724\u8725\u8726\u8727\u8728\u8729\u872a\u872b\u872c\u872d\u872e\u872f\u8730\u8731\u8732\u8733\u8734\u8735\u8736\u8737\u8738\u8739\u873a\u873b\u873c\u873d\u873e\u873f\u8740\u8741\u8742\u8743\u8744\u8745\u8746\u8747\u8748\u8749\u874a\u874b\u874c\u874d\u874e\u874f\u8750\u8751\u8752\u8753\u8754\u8755\u8756\u8757\u8758\u8759\u875a\u875b\u875c\u875d\u875e\u875f\u8760\u8761\u8762\u8763\u8764\u8765\u8766\u8767\u8768\u8769\u876a\u876b\u876c\u876d\u876e\u876f\u8770\u8771\u8772\u8773\u8774\u8775\u8776\u8777\u8778\u8779\u877a\u877b\u877c\u877d\u877e\u877f\u8780\u8781\u8782\u8783\u8784\u8785\u8786\u8787\u8788\u8789\u878a\u878b\u878c\u878d\u878e\u878f\u8790\u8791\u8792\u8793\u8794\u8795\u8796\u8797\u8798\u8799\u879a\u879b\u879c\u879d\u879e\u879f\u87a0\u87a1\u87a2\u87a3\u87a4\u87a5\u87a6\u87a7\u87a8\u87a9\u87aa\u87ab\u87ac\u87ad\u87ae\u87af\u87b0\u87b1\u87b2\u87b3\u87b4\u87b5\u87b6\u87b7\u87b8\u87b9\u87ba\u87bb\u87bc\u87bd\u87be\u87bf\u87c0\u87c1\u87c2\u87c3\u87c4\u87c5\u87c6\u87c7\u87c8\u87c9\u87ca\u87cb\u87cc\u87cd\u87ce\u87cf\u87d0\u87d1\u87d2\u87d3\u87d4\u87d5\u87d6\u87d7\u87d8\u87d9\u87da\u87db\u87dc\u87dd\u87de\u87df\u87e0\u87e1\u87e2\u87e3\u87e4\u87e5\u87e6\u87e7\u87e8\u87e9\u87ea\u87eb\u87ec\u87ed\u87ee\u87ef\u87f0\u87f1\u87f2\u87f3\u87f4\u87f5\u87f6\u87f7\u87f8\u87f9\u87fa\u87fb\u87fc\u87fd\u87fe\u87ff\u8800\u8801\u8802\u8803\u8804\u8805\u8806\u8807\u8808\u8809\u880a\u880b\u880c\u880d\u880e\u880f\u8810\u8811\u8812\u8813\u8814\u8815\u8816\u8817\u8818\u8819\u881a\u881b\u881c\u881d\u881e\u881f\u8820\u8821\u8822\u8823\u8824\u8825\u8826\u8827\u8828\u8829\u882a\u882b\u882c\u882d\u882e\u882f\u8830\u8831\u8832\u8833\u8834\u8835\u8836\u8837\u8838\u8839\u883a\u883b\u883c\u883d\u883e\u883f\u8840\u8841\u8842\u8843\u8844\u8845\u8846\u8847\u8848\u8849\u884a\u884b\u884c\u884d\u884e\u884f\u8850\u8851\u8852\u8853\u8854\u8855\u8856\u8857\u8858\u8859\u885a\u885b\u885c\u885d\u885e\u885f\u8860\u8861\u8862\u8863\u8864\u8865\u8866\u8867\u8868\u8869\u886a\u886b\u886c\u886d\u886e\u886f\u8870\u8871\u8872\u8873\u8874\u8875\u8876\u8877\u8878\u8879\u887a\u887b\u887c\u887d\u887e\u887f\u8880\u8881\u8882\u8883\u8884\u8885\u8886\u8887\u8888\u8889\u888a\u888b\u888c\u888d\u888e\u888f\u8890\u8891\u8892\u8893\u8894\u8895\u8896\u8897\u8898\u8899\u889a\u889b\u889c\u889d\u889e\u889f\u88a0\u88a1\u88a2\u88a3\u88a4\u88a5\u88a6\u88a7\u88a8\u88a9\u88aa\u88ab\u88ac\u88ad\u88ae\u88af\u88b0\u88b1\u88b2\u88b3\u88b4\u88b5\u88b6\u88b7\u88b8\u88b9\u88ba\u88bb\u88bc\u88bd\u88be\u88bf\u88c0\u88c1\u88c2\u88c3\u88c4\u88c5\u88c6\u88c7\u88c8\u88c9\u88ca\u88cb\u88cc\u88cd\u88ce\u88cf\u88d0\u88d1\u88d2\u88d3\u88d4\u88d5\u88d6\u88d7\u88d8\u88d9\u88da\u88db\u88dc\u88dd\u88de\u88df\u88e0\u88e1\u88e2\u88e3\u88e4\u88e5\u88e6\u88e7\u88e8\u88e9\u88ea\u88eb\u88ec\u88ed\u88ee\u88ef\u88f0\u88f1\u88f2\u88f3\u88f4\u88f5\u88f6\u88f7\u88f8\u88f9\u88fa\u88fb\u88fc\u88fd\u88fe\u88ff\u8900\u8901\u8902\u8903\u8904\u8905\u8906\u8907\u8908\u8909\u890a\u890b\u890c\u890d\u890e\u890f\u8910\u8911\u8912\u8913\u8914\u8915\u8916\u8917\u8918\u8919\u891a\u891b\u891c\u891d\u891e\u891f\u8920\u8921\u8922\u8923\u8924\u8925\u8926\u8927\u8928\u8929\u892a\u892b\u892c\u892d\u892e\u892f\u8930\u8931\u8932\u8933\u8934\u8935\u8936\u8937\u8938\u8939\u893a\u893b\u893c\u893d\u893e\u893f\u8940\u8941\u8942\u8943\u8944\u8945\u8946\u8947\u8948\u8949\u894a\u894b\u894c\u894d\u894e\u894f\u8950\u8951\u8952\u8953\u8954\u8955\u8956\u8957\u8958\u8959\u895a\u895b\u895c\u895d\u895e\u895f\u8960\u8961\u8962\u8963\u8964\u8965\u8966\u8967\u8968\u8969\u896a\u896b\u896c\u896d\u896e\u896f\u8970\u8971\u8972\u8973\u8974\u8975\u8976\u8977\u8978\u8979\u897a\u897b\u897c\u897d\u897e\u897f\u8980\u8981\u8982\u8983\u8984\u8985\u8986\u8987\u8988\u8989\u898a\u898b\u898c\u898d\u898e\u898f\u8990\u8991\u8992\u8993\u8994\u8995\u8996\u8997\u8998\u8999\u899a\u899b\u899c\u899d\u899e\u899f\u89a0\u89a1\u89a2\u89a3\u89a4\u89a5\u89a6\u89a7\u89a8\u89a9\u89aa\u89ab\u89ac\u89ad\u89ae\u89af\u89b0\u89b1\u89b2\u89b3\u89b4\u89b5\u89b6\u89b7\u89b8\u89b9\u89ba\u89bb\u89bc\u89bd\u89be\u89bf\u89c0\u89c1\u89c2\u89c3\u89c4\u89c5\u89c6\u89c7\u89c8\u89c9\u89ca\u89cb\u89cc\u89cd\u89ce\u89cf\u89d0\u89d1\u89d2\u89d3\u89d4\u89d5\u89d6\u89d7\u89d8\u89d9\u89da\u89db\u89dc\u89dd\u89de\u89df\u89e0\u89e1\u89e2\u89e3\u89e4\u89e5\u89e6\u89e7\u89e8\u89e9\u89ea\u89eb\u89ec\u89ed\u89ee\u89ef\u89f0\u89f1\u89f2\u89f3\u89f4\u89f5\u89f6\u89f7\u89f8\u89f9\u89fa\u89fb\u89fc\u89fd\u89fe\u89ff\u8a00\u8a01\u8a02\u8a03\u8a04\u8a05\u8a06\u8a07\u8a08\u8a09\u8a0a\u8a0b\u8a0c\u8a0d\u8a0e\u8a0f\u8a10\u8a11\u8a12\u8a13\u8a14\u8a15\u8a16\u8a17\u8a18\u8a19\u8a1a\u8a1b\u8a1c\u8a1d\u8a1e\u8a1f\u8a20\u8a21\u8a22\u8a23\u8a24\u8a25\u8a26\u8a27\u8a28\u8a29\u8a2a\u8a2b\u8a2c\u8a2d\u8a2e\u8a2f\u8a30\u8a31\u8a32\u8a33\u8a34\u8a35\u8a36\u8a37\u8a38\u8a39\u8a3a\u8a3b\u8a3c\u8a3d\u8a3e\u8a3f\u8a40\u8a41\u8a42\u8a43\u8a44\u8a45\u8a46\u8a47\u8a48\u8a49\u8a4a\u8a4b\u8a4c\u8a4d\u8a4e\u8a4f\u8a50\u8a51\u8a52\u8a53\u8a54\u8a55\u8a56\u8a57\u8a58\u8a59\u8a5a\u8a5b\u8a5c\u8a5d\u8a5e\u8a5f\u8a60\u8a61\u8a62\u8a63\u8a64\u8a65\u8a66\u8a67\u8a68\u8a69\u8a6a\u8a6b\u8a6c\u8a6d\u8a6e\u8a6f\u8a70\u8a71\u8a72\u8a73\u8a74\u8a75\u8a76\u8a77\u8a78\u8a79\u8a7a\u8a7b\u8a7c\u8a7d\u8a7e\u8a7f\u8a80\u8a81\u8a82\u8a83\u8a84\u8a85\u8a86\u8a87\u8a88\u8a89\u8a8a\u8a8b\u8a8c\u8a8d\u8a8e\u8a8f\u8a90\u8a91\u8a92\u8a93\u8a94\u8a95\u8a96\u8a97\u8a98\u8a99\u8a9a\u8a9b\u8a9c\u8a9d\u8a9e\u8a9f\u8aa0\u8aa1\u8aa2\u8aa3\u8aa4\u8aa5\u8aa6\u8aa7\u8aa8\u8aa9\u8aaa\u8aab\u8aac\u8aad\u8aae\u8aaf\u8ab0\u8ab1\u8ab2\u8ab3\u8ab4\u8ab5\u8ab6\u8ab7\u8ab8\u8ab9\u8aba\u8abb\u8abc\u8abd\u8abe\u8abf\u8ac0\u8ac1\u8ac2\u8ac3\u8ac4\u8ac5\u8ac6\u8ac7\u8ac8\u8ac9\u8aca\u8acb\u8acc\u8acd\u8ace\u8acf\u8ad0\u8ad1\u8ad2\u8ad3\u8ad4\u8ad5\u8ad6\u8ad7\u8ad8\u8ad9\u8ada\u8adb\u8adc\u8add\u8ade\u8adf\u8ae0\u8ae1\u8ae2\u8ae3\u8ae4\u8ae5\u8ae6\u8ae7\u8ae8\u8ae9\u8aea\u8aeb\u8aec\u8aed\u8aee\u8aef\u8af0\u8af1\u8af2\u8af3\u8af4\u8af5\u8af6\u8af7\u8af8\u8af9\u8afa\u8afb\u8afc\u8afd\u8afe\u8aff\u8b00\u8b01\u8b02\u8b03\u8b04\u8b05\u8b06\u8b07\u8b08\u8b09\u8b0a\u8b0b\u8b0c\u8b0d\u8b0e\u8b0f\u8b10\u8b11\u8b12\u8b13\u8b14\u8b15\u8b16\u8b17\u8b18\u8b19\u8b1a\u8b1b\u8b1c\u8b1d\u8b1e\u8b1f\u8b20\u8b21\u8b22\u8b23\u8b24\u8b25\u8b26\u8b27\u8b28\u8b29\u8b2a\u8b2b\u8b2c\u8b2d\u8b2e\u8b2f\u8b30\u8b31\u8b32\u8b33\u8b34\u8b35\u8b36\u8b37\u8b38\u8b39\u8b3a\u8b3b\u8b3c\u8b3d\u8b3e\u8b3f\u8b40\u8b41\u8b42\u8b43\u8b44\u8b45\u8b46\u8b47\u8b48\u8b49\u8b4a\u8b4b\u8b4c\u8b4d\u8b4e\u8b4f\u8b50\u8b51\u8b52\u8b53\u8b54\u8b55\u8b56\u8b57\u8b58\u8b59\u8b5a\u8b5b\u8b5c\u8b5d\u8b5e\u8b5f\u8b60\u8b61\u8b62\u8b63\u8b64\u8b65\u8b66\u8b67\u8b68\u8b69\u8b6a\u8b6b\u8b6c\u8b6d\u8b6e\u8b6f\u8b70\u8b71\u8b72\u8b73\u8b74\u8b75\u8b76\u8b77\u8b78\u8b79\u8b7a\u8b7b\u8b7c\u8b7d\u8b7e\u8b7f\u8b80\u8b81\u8b82\u8b83\u8b84\u8b85\u8b86\u8b87\u8b88\u8b89\u8b8a\u8b8b\u8b8c\u8b8d\u8b8e\u8b8f\u8b90\u8b91\u8b92\u8b93\u8b94\u8b95\u8b96\u8b97\u8b98\u8b99\u8b9a\u8b9b\u8b9c\u8b9d\u8b9e\u8b9f\u8ba0\u8ba1\u8ba2\u8ba3\u8ba4\u8ba5\u8ba6\u8ba7\u8ba8\u8ba9\u8baa\u8bab\u8bac\u8bad\u8bae\u8baf\u8bb0\u8bb1\u8bb2\u8bb3\u8bb4\u8bb5\u8bb6\u8bb7\u8bb8\u8bb9\u8bba\u8bbb\u8bbc\u8bbd\u8bbe\u8bbf\u8bc0\u8bc1\u8bc2\u8bc3\u8bc4\u8bc5\u8bc6\u8bc7\u8bc8\u8bc9\u8bca\u8bcb\u8bcc\u8bcd\u8bce\u8bcf\u8bd0\u8bd1\u8bd2\u8bd3\u8bd4\u8bd5\u8bd6\u8bd7\u8bd8\u8bd9\u8bda\u8bdb\u8bdc\u8bdd\u8bde\u8bdf\u8be0\u8be1\u8be2\u8be3\u8be4\u8be5\u8be6\u8be7\u8be8\u8be9\u8bea\u8beb\u8bec\u8bed\u8bee\u8bef\u8bf0\u8bf1\u8bf2\u8bf3\u8bf4\u8bf5\u8bf6\u8bf7\u8bf8\u8bf9\u8bfa\u8bfb\u8bfc\u8bfd\u8bfe\u8bff\u8c00\u8c01\u8c02\u8c03\u8c04\u8c05\u8c06\u8c07\u8c08\u8c09\u8c0a\u8c0b\u8c0c\u8c0d\u8c0e\u8c0f\u8c10\u8c11\u8c12\u8c13\u8c14\u8c15\u8c16\u8c17\u8c18\u8c19\u8c1a\u8c1b\u8c1c\u8c1d\u8c1e\u8c1f\u8c20\u8c21\u8c22\u8c23\u8c24\u8c25\u8c26\u8c27\u8c28\u8c29\u8c2a\u8c2b\u8c2c\u8c2d\u8c2e\u8c2f\u8c30\u8c31\u8c32\u8c33\u8c34\u8c35\u8c36\u8c37\u8c38\u8c39\u8c3a\u8c3b\u8c3c\u8c3d\u8c3e\u8c3f\u8c40\u8c41\u8c42\u8c43\u8c44\u8c45\u8c46\u8c47\u8c48\u8c49\u8c4a\u8c4b\u8c4c\u8c4d\u8c4e\u8c4f\u8c50\u8c51\u8c52\u8c53\u8c54\u8c55\u8c56\u8c57\u8c58\u8c59\u8c5a\u8c5b\u8c5c\u8c5d\u8c5e\u8c5f\u8c60\u8c61\u8c62\u8c63\u8c64\u8c65\u8c66\u8c67\u8c68\u8c69\u8c6a\u8c6b\u8c6c\u8c6d\u8c6e\u8c6f\u8c70\u8c71\u8c72\u8c73\u8c74\u8c75\u8c76\u8c77\u8c78\u8c79\u8c7a\u8c7b\u8c7c\u8c7d\u8c7e\u8c7f\u8c80\u8c81\u8c82\u8c83\u8c84\u8c85\u8c86\u8c87\u8c88\u8c89\u8c8a\u8c8b\u8c8c\u8c8d\u8c8e\u8c8f\u8c90\u8c91\u8c92\u8c93\u8c94\u8c95\u8c96\u8c97\u8c98\u8c99\u8c9a\u8c9b\u8c9c\u8c9d\u8c9e\u8c9f\u8ca0\u8ca1\u8ca2\u8ca3\u8ca4\u8ca5\u8ca6\u8ca7\u8ca8\u8ca9\u8caa\u8cab\u8cac\u8cad\u8cae\u8caf\u8cb0\u8cb1\u8cb2\u8cb3\u8cb4\u8cb5\u8cb6\u8cb7\u8cb8\u8cb9\u8cba\u8cbb\u8cbc\u8cbd\u8cbe\u8cbf\u8cc0\u8cc1\u8cc2\u8cc3\u8cc4\u8cc5\u8cc6\u8cc7\u8cc8\u8cc9\u8cca\u8ccb\u8ccc\u8ccd\u8cce\u8ccf\u8cd0\u8cd1\u8cd2\u8cd3\u8cd4\u8cd5\u8cd6\u8cd7\u8cd8\u8cd9\u8cda\u8cdb\u8cdc\u8cdd\u8cde\u8cdf\u8ce0\u8ce1\u8ce2\u8ce3\u8ce4\u8ce5\u8ce6\u8ce7\u8ce8\u8ce9\u8cea\u8ceb\u8cec\u8ced\u8cee\u8cef\u8cf0\u8cf1\u8cf2\u8cf3\u8cf4\u8cf5\u8cf6\u8cf7\u8cf8\u8cf9\u8cfa\u8cfb\u8cfc\u8cfd\u8cfe\u8cff\u8d00\u8d01\u8d02\u8d03\u8d04\u8d05\u8d06\u8d07\u8d08\u8d09\u8d0a\u8d0b\u8d0c\u8d0d\u8d0e\u8d0f\u8d10\u8d11\u8d12\u8d13\u8d14\u8d15\u8d16\u8d17\u8d18\u8d19\u8d1a\u8d1b\u8d1c\u8d1d\u8d1e\u8d1f\u8d20\u8d21\u8d22\u8d23\u8d24\u8d25\u8d26\u8d27\u8d28\u8d29\u8d2a\u8d2b\u8d2c\u8d2d\u8d2e\u8d2f\u8d30\u8d31\u8d32\u8d33\u8d34\u8d35\u8d36\u8d37\u8d38\u8d39\u8d3a\u8d3b\u8d3c\u8d3d\u8d3e\u8d3f\u8d40\u8d41\u8d42\u8d43\u8d44\u8d45\u8d46\u8d47\u8d48\u8d49\u8d4a\u8d4b\u8d4c\u8d4d\u8d4e\u8d4f\u8d50\u8d51\u8d52\u8d53\u8d54\u8d55\u8d56\u8d57\u8d58\u8d59\u8d5a\u8d5b\u8d5c\u8d5d\u8d5e\u8d5f\u8d60\u8d61\u8d62\u8d63\u8d64\u8d65\u8d66\u8d67\u8d68\u8d69\u8d6a\u8d6b\u8d6c\u8d6d\u8d6e\u8d6f\u8d70\u8d71\u8d72\u8d73\u8d74\u8d75\u8d76\u8d77\u8d78\u8d79\u8d7a\u8d7b\u8d7c\u8d7d\u8d7e\u8d7f\u8d80\u8d81\u8d82\u8d83\u8d84\u8d85\u8d86\u8d87\u8d88\u8d89\u8d8a\u8d8b\u8d8c\u8d8d\u8d8e\u8d8f\u8d90\u8d91\u8d92\u8d93\u8d94\u8d95\u8d96\u8d97\u8d98\u8d99\u8d9a\u8d9b\u8d9c\u8d9d\u8d9e\u8d9f\u8da0\u8da1\u8da2\u8da3\u8da4\u8da5\u8da6\u8da7\u8da8\u8da9\u8daa\u8dab\u8dac\u8dad\u8dae\u8daf\u8db0\u8db1\u8db2\u8db3\u8db4\u8db5\u8db6\u8db7\u8db8\u8db9\u8dba\u8dbb\u8dbc\u8dbd\u8dbe\u8dbf\u8dc0\u8dc1\u8dc2\u8dc3\u8dc4\u8dc5\u8dc6\u8dc7\u8dc8\u8dc9\u8dca\u8dcb\u8dcc\u8dcd\u8dce\u8dcf\u8dd0\u8dd1\u8dd2\u8dd3\u8dd4\u8dd5\u8dd6\u8dd7\u8dd8\u8dd9\u8dda\u8ddb\u8ddc\u8ddd\u8dde\u8ddf\u8de0\u8de1\u8de2\u8de3\u8de4\u8de5\u8de6\u8de7\u8de8\u8de9\u8dea\u8deb\u8dec\u8ded\u8dee\u8def\u8df0\u8df1\u8df2\u8df3\u8df4\u8df5\u8df6\u8df7\u8df8\u8df9\u8dfa\u8dfb\u8dfc\u8dfd\u8dfe\u8dff\u8e00\u8e01\u8e02\u8e03\u8e04\u8e05\u8e06\u8e07\u8e08\u8e09\u8e0a\u8e0b\u8e0c\u8e0d\u8e0e\u8e0f\u8e10\u8e11\u8e12\u8e13\u8e14\u8e15\u8e16\u8e17\u8e18\u8e19\u8e1a\u8e1b\u8e1c\u8e1d\u8e1e\u8e1f\u8e20\u8e21\u8e22\u8e23\u8e24\u8e25\u8e26\u8e27\u8e28\u8e29\u8e2a\u8e2b\u8e2c\u8e2d\u8e2e\u8e2f\u8e30\u8e31\u8e32\u8e33\u8e34\u8e35\u8e36\u8e37\u8e38\u8e39\u8e3a\u8e3b\u8e3c\u8e3d\u8e3e\u8e3f\u8e40\u8e41\u8e42\u8e43\u8e44\u8e45\u8e46\u8e47\u8e48\u8e49\u8e4a\u8e4b\u8e4c\u8e4d\u8e4e\u8e4f\u8e50\u8e51\u8e52\u8e53\u8e54\u8e55\u8e56\u8e57\u8e58\u8e59\u8e5a\u8e5b\u8e5c\u8e5d\u8e5e\u8e5f\u8e60\u8e61\u8e62\u8e63\u8e64\u8e65\u8e66\u8e67\u8e68\u8e69\u8e6a\u8e6b\u8e6c\u8e6d\u8e6e\u8e6f\u8e70\u8e71\u8e72\u8e73\u8e74\u8e75\u8e76\u8e77\u8e78\u8e79\u8e7a\u8e7b\u8e7c\u8e7d\u8e7e\u8e7f\u8e80\u8e81\u8e82\u8e83\u8e84\u8e85\u8e86\u8e87\u8e88\u8e89\u8e8a\u8e8b\u8e8c\u8e8d\u8e8e\u8e8f\u8e90\u8e91\u8e92\u8e93\u8e94\u8e95\u8e96\u8e97\u8e98\u8e99\u8e9a\u8e9b\u8e9c\u8e9d\u8e9e\u8e9f\u8ea0\u8ea1\u8ea2\u8ea3\u8ea4\u8ea5\u8ea6\u8ea7\u8ea8\u8ea9\u8eaa\u8eab\u8eac\u8ead\u8eae\u8eaf\u8eb0\u8eb1\u8eb2\u8eb3\u8eb4\u8eb5\u8eb6\u8eb7\u8eb8\u8eb9\u8eba\u8ebb\u8ebc\u8ebd\u8ebe\u8ebf\u8ec0\u8ec1\u8ec2\u8ec3\u8ec4\u8ec5\u8ec6\u8ec7\u8ec8\u8ec9\u8eca\u8ecb\u8ecc\u8ecd\u8ece\u8ecf\u8ed0\u8ed1\u8ed2\u8ed3\u8ed4\u8ed5\u8ed6\u8ed7\u8ed8\u8ed9\u8eda\u8edb\u8edc\u8edd\u8ede\u8edf\u8ee0\u8ee1\u8ee2\u8ee3\u8ee4\u8ee5\u8ee6\u8ee7\u8ee8\u8ee9\u8eea\u8eeb\u8eec\u8eed\u8eee\u8eef\u8ef0\u8ef1\u8ef2\u8ef3\u8ef4\u8ef5\u8ef6\u8ef7\u8ef8\u8ef9\u8efa\u8efb\u8efc\u8efd\u8efe\u8eff\u8f00\u8f01\u8f02\u8f03\u8f04\u8f05\u8f06\u8f07\u8f08\u8f09\u8f0a\u8f0b\u8f0c\u8f0d\u8f0e\u8f0f\u8f10\u8f11\u8f12\u8f13\u8f14\u8f15\u8f16\u8f17\u8f18\u8f19\u8f1a\u8f1b\u8f1c\u8f1d\u8f1e\u8f1f\u8f20\u8f21\u8f22\u8f23\u8f24\u8f25\u8f26\u8f27\u8f28\u8f29\u8f2a\u8f2b\u8f2c\u8f2d\u8f2e\u8f2f\u8f30\u8f31\u8f32\u8f33\u8f34\u8f35\u8f36\u8f37\u8f38\u8f39\u8f3a\u8f3b\u8f3c\u8f3d\u8f3e\u8f3f\u8f40\u8f41\u8f42\u8f43\u8f44\u8f45\u8f46\u8f47\u8f48\u8f49\u8f4a\u8f4b\u8f4c\u8f4d\u8f4e\u8f4f\u8f50\u8f51\u8f52\u8f53\u8f54\u8f55\u8f56\u8f57\u8f58\u8f59\u8f5a\u8f5b\u8f5c\u8f5d\u8f5e\u8f5f\u8f60\u8f61\u8f62\u8f63\u8f64\u8f65\u8f66\u8f67\u8f68\u8f69\u8f6a\u8f6b\u8f6c\u8f6d\u8f6e\u8f6f\u8f70\u8f71\u8f72\u8f73\u8f74\u8f75\u8f76\u8f77\u8f78\u8f79\u8f7a\u8f7b\u8f7c\u8f7d\u8f7e\u8f7f\u8f80\u8f81\u8f82\u8f83\u8f84\u8f85\u8f86\u8f87\u8f88\u8f89\u8f8a\u8f8b\u8f8c\u8f8d\u8f8e\u8f8f\u8f90\u8f91\u8f92\u8f93\u8f94\u8f95\u8f96\u8f97\u8f98\u8f99\u8f9a\u8f9b\u8f9c\u8f9d\u8f9e\u8f9f\u8fa0\u8fa1\u8fa2\u8fa3\u8fa4\u8fa5\u8fa6\u8fa7\u8fa8\u8fa9\u8faa\u8fab\u8fac\u8fad\u8fae\u8faf\u8fb0\u8fb1\u8fb2\u8fb3\u8fb4\u8fb5\u8fb6\u8fb7\u8fb8\u8fb9\u8fba\u8fbb\u8fbc\u8fbd\u8fbe\u8fbf\u8fc0\u8fc1\u8fc2\u8fc3\u8fc4\u8fc5\u8fc6\u8fc7\u8fc8\u8fc9\u8fca\u8fcb\u8fcc\u8fcd\u8fce\u8fcf\u8fd0\u8fd1\u8fd2\u8fd3\u8fd4\u8fd5\u8fd6\u8fd7\u8fd8\u8fd9\u8fda\u8fdb\u8fdc\u8fdd\u8fde\u8fdf\u8fe0\u8fe1\u8fe2\u8fe3\u8fe4\u8fe5\u8fe6\u8fe7\u8fe8\u8fe9\u8fea\u8feb\u8fec\u8fed\u8fee\u8fef\u8ff0\u8ff1\u8ff2\u8ff3\u8ff4\u8ff5\u8ff6\u8ff7\u8ff8\u8ff9\u8ffa\u8ffb\u8ffc\u8ffd\u8ffe\u8fff\u9000\u9001\u9002\u9003\u9004\u9005\u9006\u9007\u9008\u9009\u900a\u900b\u900c\u900d\u900e\u900f\u9010\u9011\u9012\u9013\u9014\u9015\u9016\u9017\u9018\u9019\u901a\u901b\u901c\u901d\u901e\u901f\u9020\u9021\u9022\u9023\u9024\u9025\u9026\u9027\u9028\u9029\u902a\u902b\u902c\u902d\u902e\u902f\u9030\u9031\u9032\u9033\u9034\u9035\u9036\u9037\u9038\u9039\u903a\u903b\u903c\u903d\u903e\u903f\u9040\u9041\u9042\u9043\u9044\u9045\u9046\u9047\u9048\u9049\u904a\u904b\u904c\u904d\u904e\u904f\u9050\u9051\u9052\u9053\u9054\u9055\u9056\u9057\u9058\u9059\u905a\u905b\u905c\u905d\u905e\u905f\u9060\u9061\u9062\u9063\u9064\u9065\u9066\u9067\u9068\u9069\u906a\u906b\u906c\u906d\u906e\u906f\u9070\u9071\u9072\u9073\u9074\u9075\u9076\u9077\u9078\u9079\u907a\u907b\u907c\u907d\u907e\u907f\u9080\u9081\u9082\u9083\u9084\u9085\u9086\u9087\u9088\u9089\u908a\u908b\u908c\u908d\u908e\u908f\u9090\u9091\u9092\u9093\u9094\u9095\u9096\u9097\u9098\u9099\u909a\u909b\u909c\u909d\u909e\u909f\u90a0\u90a1\u90a2\u90a3\u90a4\u90a5\u90a6\u90a7\u90a8\u90a9\u90aa\u90ab\u90ac\u90ad\u90ae\u90af\u90b0\u90b1\u90b2\u90b3\u90b4\u90b5\u90b6\u90b7\u90b8\u90b9\u90ba\u90bb\u90bc\u90bd\u90be\u90bf\u90c0\u90c1\u90c2\u90c3\u90c4\u90c5\u90c6\u90c7\u90c8\u90c9\u90ca\u90cb\u90cc\u90cd\u90ce\u90cf\u90d0\u90d1\u90d2\u90d3\u90d4\u90d5\u90d6\u90d7\u90d8\u90d9\u90da\u90db\u90dc\u90dd\u90de\u90df\u90e0\u90e1\u90e2\u90e3\u90e4\u90e5\u90e6\u90e7\u90e8\u90e9\u90ea\u90eb\u90ec\u90ed\u90ee\u90ef\u90f0\u90f1\u90f2\u90f3\u90f4\u90f5\u90f6\u90f7\u90f8\u90f9\u90fa\u90fb\u90fc\u90fd\u90fe\u90ff\u9100\u9101\u9102\u9103\u9104\u9105\u9106\u9107\u9108\u9109\u910a\u910b\u910c\u910d\u910e\u910f\u9110\u9111\u9112\u9113\u9114\u9115\u9116\u9117\u9118\u9119\u911a\u911b\u911c\u911d\u911e\u911f\u9120\u9121\u9122\u9123\u9124\u9125\u9126\u9127\u9128\u9129\u912a\u912b\u912c\u912d\u912e\u912f\u9130\u9131\u9132\u9133\u9134\u9135\u9136\u9137\u9138\u9139\u913a\u913b\u913c\u913d\u913e\u913f\u9140\u9141\u9142\u9143\u9144\u9145\u9146\u9147\u9148\u9149\u914a\u914b\u914c\u914d\u914e\u914f\u9150\u9151\u9152\u9153\u9154\u9155\u9156\u9157\u9158\u9159\u915a\u915b\u915c\u915d\u915e\u915f\u9160\u9161\u9162\u9163\u9164\u9165\u9166\u9167\u9168\u9169\u916a\u916b\u916c\u916d\u916e\u916f\u9170\u9171\u9172\u9173\u9174\u9175\u9176\u9177\u9178\u9179\u917a\u917b\u917c\u917d\u917e\u917f\u9180\u9181\u9182\u9183\u9184\u9185\u9186\u9187\u9188\u9189\u918a\u918b\u918c\u918d\u918e\u918f\u9190\u9191\u9192\u9193\u9194\u9195\u9196\u9197\u9198\u9199\u919a\u919b\u919c\u919d\u919e\u919f\u91a0\u91a1\u91a2\u91a3\u91a4\u91a5\u91a6\u91a7\u91a8\u91a9\u91aa\u91ab\u91ac\u91ad\u91ae\u91af\u91b0\u91b1\u91b2\u91b3\u91b4\u91b5\u91b6\u91b7\u91b8\u91b9\u91ba\u91bb\u91bc\u91bd\u91be\u91bf\u91c0\u91c1\u91c2\u91c3\u91c4\u91c5\u91c6\u91c7\u91c8\u91c9\u91ca\u91cb\u91cc\u91cd\u91ce\u91cf\u91d0\u91d1\u91d2\u91d3\u91d4\u91d5\u91d6\u91d7\u91d8\u91d9\u91da\u91db\u91dc\u91dd\u91de\u91df\u91e0\u91e1\u91e2\u91e3\u91e4\u91e5\u91e6\u91e7\u91e8\u91e9\u91ea\u91eb\u91ec\u91ed\u91ee\u91ef\u91f0\u91f1\u91f2\u91f3\u91f4\u91f5\u91f6\u91f7\u91f8\u91f9\u91fa\u91fb\u91fc\u91fd\u91fe\u91ff\u9200\u9201\u9202\u9203\u9204\u9205\u9206\u9207\u9208\u9209\u920a\u920b\u920c\u920d\u920e\u920f\u9210\u9211\u9212\u9213\u9214\u9215\u9216\u9217\u9218\u9219\u921a\u921b\u921c\u921d\u921e\u921f\u9220\u9221\u9222\u9223\u9224\u9225\u9226\u9227\u9228\u9229\u922a\u922b\u922c\u922d\u922e\u922f\u9230\u9231\u9232\u9233\u9234\u9235\u9236\u9237\u9238\u9239\u923a\u923b\u923c\u923d\u923e\u923f\u9240\u9241\u9242\u9243\u9244\u9245\u9246\u9247\u9248\u9249\u924a\u924b\u924c\u924d\u924e\u924f\u9250\u9251\u9252\u9253\u9254\u9255\u9256\u9257\u9258\u9259\u925a\u925b\u925c\u925d\u925e\u925f\u9260\u9261\u9262\u9263\u9264\u9265\u9266\u9267\u9268\u9269\u926a\u926b\u926c\u926d\u926e\u926f\u9270\u9271\u9272\u9273\u9274\u9275\u9276\u9277\u9278\u9279\u927a\u927b\u927c\u927d\u927e\u927f\u9280\u9281\u9282\u9283\u9284\u9285\u9286\u9287\u9288\u9289\u928a\u928b\u928c\u928d\u928e\u928f\u9290\u9291\u9292\u9293\u9294\u9295\u9296\u9297\u9298\u9299\u929a\u929b\u929c\u929d\u929e\u929f\u92a0\u92a1\u92a2\u92a3\u92a4\u92a5\u92a6\u92a7\u92a8\u92a9\u92aa\u92ab\u92ac\u92ad\u92ae\u92af\u92b0\u92b1\u92b2\u92b3\u92b4\u92b5\u92b6\u92b7\u92b8\u92b9\u92ba\u92bb\u92bc\u92bd\u92be\u92bf\u92c0\u92c1\u92c2\u92c3\u92c4\u92c5\u92c6\u92c7\u92c8\u92c9\u92ca\u92cb\u92cc\u92cd\u92ce\u92cf\u92d0\u92d1\u92d2\u92d3\u92d4\u92d5\u92d6\u92d7\u92d8\u92d9\u92da\u92db\u92dc\u92dd\u92de\u92df\u92e0\u92e1\u92e2\u92e3\u92e4\u92e5\u92e6\u92e7\u92e8\u92e9\u92ea\u92eb\u92ec\u92ed\u92ee\u92ef\u92f0\u92f1\u92f2\u92f3\u92f4\u92f5\u92f6\u92f7\u92f8\u92f9\u92fa\u92fb\u92fc\u92fd\u92fe\u92ff\u9300\u9301\u9302\u9303\u9304\u9305\u9306\u9307\u9308\u9309\u930a\u930b\u930c\u930d\u930e\u930f\u9310\u9311\u9312\u9313\u9314\u9315\u9316\u9317\u9318\u9319\u931a\u931b\u931c\u931d\u931e\u931f\u9320\u9321\u9322\u9323\u9324\u9325\u9326\u9327\u9328\u9329\u932a\u932b\u932c\u932d\u932e\u932f\u9330\u9331\u9332\u9333\u9334\u9335\u9336\u9337\u9338\u9339\u933a\u933b\u933c\u933d\u933e\u933f\u9340\u9341\u9342\u9343\u9344\u9345\u9346\u9347\u9348\u9349\u934a\u934b\u934c\u934d\u934e\u934f\u9350\u9351\u9352\u9353\u9354\u9355\u9356\u9357\u9358\u9359\u935a\u935b\u935c\u935d\u935e\u935f\u9360\u9361\u9362\u9363\u9364\u9365\u9366\u9367\u9368\u9369\u936a\u936b\u936c\u936d\u936e\u936f\u9370\u9371\u9372\u9373\u9374\u9375\u9376\u9377\u9378\u9379\u937a\u937b\u937c\u937d\u937e\u937f\u9380\u9381\u9382\u9383\u9384\u9385\u9386\u9387\u9388\u9389\u938a\u938b\u938c\u938d\u938e\u938f\u9390\u9391\u9392\u9393\u9394\u9395\u9396\u9397\u9398\u9399\u939a\u939b\u939c\u939d\u939e\u939f\u93a0\u93a1\u93a2\u93a3\u93a4\u93a5\u93a6\u93a7\u93a8\u93a9\u93aa\u93ab\u93ac\u93ad\u93ae\u93af\u93b0\u93b1\u93b2\u93b3\u93b4\u93b5\u93b6\u93b7\u93b8\u93b9\u93ba\u93bb\u93bc\u93bd\u93be\u93bf\u93c0\u93c1\u93c2\u93c3\u93c4\u93c5\u93c6\u93c7\u93c8\u93c9\u93ca\u93cb\u93cc\u93cd\u93ce\u93cf\u93d0\u93d1\u93d2\u93d3\u93d4\u93d5\u93d6\u93d7\u93d8\u93d9\u93da\u93db\u93dc\u93dd\u93de\u93df\u93e0\u93e1\u93e2\u93e3\u93e4\u93e5\u93e6\u93e7\u93e8\u93e9\u93ea\u93eb\u93ec\u93ed\u93ee\u93ef\u93f0\u93f1\u93f2\u93f3\u93f4\u93f5\u93f6\u93f7\u93f8\u93f9\u93fa\u93fb\u93fc\u93fd\u93fe\u93ff\u9400\u9401\u9402\u9403\u9404\u9405\u9406\u9407\u9408\u9409\u940a\u940b\u940c\u940d\u940e\u940f\u9410\u9411\u9412\u9413\u9414\u9415\u9416\u9417\u9418\u9419\u941a\u941b\u941c\u941d\u941e\u941f\u9420\u9421\u9422\u9423\u9424\u9425\u9426\u9427\u9428\u9429\u942a\u942b\u942c\u942d\u942e\u942f\u9430\u9431\u9432\u9433\u9434\u9435\u9436\u9437\u9438\u9439\u943a\u943b\u943c\u943d\u943e\u943f\u9440\u9441\u9442\u9443\u9444\u9445\u9446\u9447\u9448\u9449\u944a\u944b\u944c\u944d\u944e\u944f\u9450\u9451\u9452\u9453\u9454\u9455\u9456\u9457\u9458\u9459\u945a\u945b\u945c\u945d\u945e\u945f\u9460\u9461\u9462\u9463\u9464\u9465\u9466\u9467\u9468\u9469\u946a\u946b\u946c\u946d\u946e\u946f\u9470\u9471\u9472\u9473\u9474\u9475\u9476\u9477\u9478\u9479\u947a\u947b\u947c\u947d\u947e\u947f\u9480\u9481\u9482\u9483\u9484\u9485\u9486\u9487\u9488\u9489\u948a\u948b\u948c\u948d\u948e\u948f\u9490\u9491\u9492\u9493\u9494\u9495\u9496\u9497\u9498\u9499\u949a\u949b\u949c\u949d\u949e\u949f\u94a0\u94a1\u94a2\u94a3\u94a4\u94a5\u94a6\u94a7\u94a8\u94a9\u94aa\u94ab\u94ac\u94ad\u94ae\u94af\u94b0\u94b1\u94b2\u94b3\u94b4\u94b5\u94b6\u94b7\u94b8\u94b9\u94ba\u94bb\u94bc\u94bd\u94be\u94bf\u94c0\u94c1\u94c2\u94c3\u94c4\u94c5\u94c6\u94c7\u94c8\u94c9\u94ca\u94cb\u94cc\u94cd\u94ce\u94cf\u94d0\u94d1\u94d2\u94d3\u94d4\u94d5\u94d6\u94d7\u94d8\u94d9\u94da\u94db\u94dc\u94dd\u94de\u94df\u94e0\u94e1\u94e2\u94e3\u94e4\u94e5\u94e6\u94e7\u94e8\u94e9\u94ea\u94eb\u94ec\u94ed\u94ee\u94ef\u94f0\u94f1\u94f2\u94f3\u94f4\u94f5\u94f6\u94f7\u94f8\u94f9\u94fa\u94fb\u94fc\u94fd\u94fe\u94ff\u9500\u9501\u9502\u9503\u9504\u9505\u9506\u9507\u9508\u9509\u950a\u950b\u950c\u950d\u950e\u950f\u9510\u9511\u9512\u9513\u9514\u9515\u9516\u9517\u9518\u9519\u951a\u951b\u951c\u951d\u951e\u951f\u9520\u9521\u9522\u9523\u9524\u9525\u9526\u9527\u9528\u9529\u952a\u952b\u952c\u952d\u952e\u952f\u9530\u9531\u9532\u9533\u9534\u9535\u9536\u9537\u9538\u9539\u953a\u953b\u953c\u953d\u953e\u953f\u9540\u9541\u9542\u9543\u9544\u9545\u9546\u9547\u9548\u9549\u954a\u954b\u954c\u954d\u954e\u954f\u9550\u9551\u9552\u9553\u9554\u9555\u9556\u9557\u9558\u9559\u955a\u955b\u955c\u955d\u955e\u955f\u9560\u9561\u9562\u9563\u9564\u9565\u9566\u9567\u9568\u9569\u956a\u956b\u956c\u956d\u956e\u956f\u9570\u9571\u9572\u9573\u9574\u9575\u9576\u9577\u9578\u9579\u957a\u957b\u957c\u957d\u957e\u957f\u9580\u9581\u9582\u9583\u9584\u9585\u9586\u9587\u9588\u9589\u958a\u958b\u958c\u958d\u958e\u958f\u9590\u9591\u9592\u9593\u9594\u9595\u9596\u9597\u9598\u9599\u959a\u959b\u959c\u959d\u959e\u959f\u95a0\u95a1\u95a2\u95a3\u95a4\u95a5\u95a6\u95a7\u95a8\u95a9\u95aa\u95ab\u95ac\u95ad\u95ae\u95af\u95b0\u95b1\u95b2\u95b3\u95b4\u95b5\u95b6\u95b7\u95b8\u95b9\u95ba\u95bb\u95bc\u95bd\u95be\u95bf\u95c0\u95c1\u95c2\u95c3\u95c4\u95c5\u95c6\u95c7\u95c8\u95c9\u95ca\u95cb\u95cc\u95cd\u95ce\u95cf\u95d0\u95d1\u95d2\u95d3\u95d4\u95d5\u95d6\u95d7\u95d8\u95d9\u95da\u95db\u95dc\u95dd\u95de\u95df\u95e0\u95e1\u95e2\u95e3\u95e4\u95e5\u95e6\u95e7\u95e8\u95e9\u95ea\u95eb\u95ec\u95ed\u95ee\u95ef\u95f0\u95f1\u95f2\u95f3\u95f4\u95f5\u95f6\u95f7\u95f8\u95f9\u95fa\u95fb\u95fc\u95fd\u95fe\u95ff\u9600\u9601\u9602\u9603\u9604\u9605\u9606\u9607\u9608\u9609\u960a\u960b\u960c\u960d\u960e\u960f\u9610\u9611\u9612\u9613\u9614\u9615\u9616\u9617\u9618\u9619\u961a\u961b\u961c\u961d\u961e\u961f\u9620\u9621\u9622\u9623\u9624\u9625\u9626\u9627\u9628\u9629\u962a\u962b\u962c\u962d\u962e\u962f\u9630\u9631\u9632\u9633\u9634\u9635\u9636\u9637\u9638\u9639\u963a\u963b\u963c\u963d\u963e\u963f\u9640\u9641\u9642\u9643\u9644\u9645\u9646\u9647\u9648\u9649\u964a\u964b\u964c\u964d\u964e\u964f\u9650\u9651\u9652\u9653\u9654\u9655\u9656\u9657\u9658\u9659\u965a\u965b\u965c\u965d\u965e\u965f\u9660\u9661\u9662\u9663\u9664\u9665\u9666\u9667\u9668\u9669\u966a\u966b\u966c\u966d\u966e\u966f\u9670\u9671\u9672\u9673\u9674\u9675\u9676\u9677\u9678\u9679\u967a\u967b\u967c\u967d\u967e\u967f\u9680\u9681\u9682\u9683\u9684\u9685\u9686\u9687\u9688\u9689\u968a\u968b\u968c\u968d\u968e\u968f\u9690\u9691\u9692\u9693\u9694\u9695\u9696\u9697\u9698\u9699\u969a\u969b\u969c\u969d\u969e\u969f\u96a0\u96a1\u96a2\u96a3\u96a4\u96a5\u96a6\u96a7\u96a8\u96a9\u96aa\u96ab\u96ac\u96ad\u96ae\u96af\u96b0\u96b1\u96b2\u96b3\u96b4\u96b5\u96b6\u96b7\u96b8\u96b9\u96ba\u96bb\u96bc\u96bd\u96be\u96bf\u96c0\u96c1\u96c2\u96c3\u96c4\u96c5\u96c6\u96c7\u96c8\u96c9\u96ca\u96cb\u96cc\u96cd\u96ce\u96cf\u96d0\u96d1\u96d2\u96d3\u96d4\u96d5\u96d6\u96d7\u96d8\u96d9\u96da\u96db\u96dc\u96dd\u96de\u96df\u96e0\u96e1\u96e2\u96e3\u96e4\u96e5\u96e6\u96e7\u96e8\u96e9\u96ea\u96eb\u96ec\u96ed\u96ee\u96ef\u96f0\u96f1\u96f2\u96f3\u96f4\u96f5\u96f6\u96f7\u96f8\u96f9\u96fa\u96fb\u96fc\u96fd\u96fe\u96ff\u9700\u9701\u9702\u9703\u9704\u9705\u9706\u9707\u9708\u9709\u970a\u970b\u970c\u970d\u970e\u970f\u9710\u9711\u9712\u9713\u9714\u9715\u9716\u9717\u9718\u9719\u971a\u971b\u971c\u971d\u971e\u971f\u9720\u9721\u9722\u9723\u9724\u9725\u9726\u9727\u9728\u9729\u972a\u972b\u972c\u972d\u972e\u972f\u9730\u9731\u9732\u9733\u9734\u9735\u9736\u9737\u9738\u9739\u973a\u973b\u973c\u973d\u973e\u973f\u9740\u9741\u9742\u9743\u9744\u9745\u9746\u9747\u9748\u9749\u974a\u974b\u974c\u974d\u974e\u974f\u9750\u9751\u9752\u9753\u9754\u9755\u9756\u9757\u9758\u9759\u975a\u975b\u975c\u975d\u975e\u975f\u9760\u9761\u9762\u9763\u9764\u9765\u9766\u9767\u9768\u9769\u976a\u976b\u976c\u976d\u976e\u976f\u9770\u9771\u9772\u9773\u9774\u9775\u9776\u9777\u9778\u9779\u977a\u977b\u977c\u977d\u977e\u977f\u9780\u9781\u9782\u9783\u9784\u9785\u9786\u9787\u9788\u9789\u978a\u978b\u978c\u978d\u978e\u978f\u9790\u9791\u9792\u9793\u9794\u9795\u9796\u9797\u9798\u9799\u979a\u979b\u979c\u979d\u979e\u979f\u97a0\u97a1\u97a2\u97a3\u97a4\u97a5\u97a6\u97a7\u97a8\u97a9\u97aa\u97ab\u97ac\u97ad\u97ae\u97af\u97b0\u97b1\u97b2\u97b3\u97b4\u97b5\u97b6\u97b7\u97b8\u97b9\u97ba\u97bb\u97bc\u97bd\u97be\u97bf\u97c0\u97c1\u97c2\u97c3\u97c4\u97c5\u97c6\u97c7\u97c8\u97c9\u97ca\u97cb\u97cc\u97cd\u97ce\u97cf\u97d0\u97d1\u97d2\u97d3\u97d4\u97d5\u97d6\u97d7\u97d8\u97d9\u97da\u97db\u97dc\u97dd\u97de\u97df\u97e0\u97e1\u97e2\u97e3\u97e4\u97e5\u97e6\u97e7\u97e8\u97e9\u97ea\u97eb\u97ec\u97ed\u97ee\u97ef\u97f0\u97f1\u97f2\u97f3\u97f4\u97f5\u97f6\u97f7\u97f8\u97f9\u97fa\u97fb\u97fc\u97fd\u97fe\u97ff\u9800\u9801\u9802\u9803\u9804\u9805\u9806\u9807\u9808\u9809\u980a\u980b\u980c\u980d\u980e\u980f\u9810\u9811\u9812\u9813\u9814\u9815\u9816\u9817\u9818\u9819\u981a\u981b\u981c\u981d\u981e\u981f\u9820\u9821\u9822\u9823\u9824\u9825\u9826\u9827\u9828\u9829\u982a\u982b\u982c\u982d\u982e\u982f\u9830\u9831\u9832\u9833\u9834\u9835\u9836\u9837\u9838\u9839\u983a\u983b\u983c\u983d\u983e\u983f\u9840\u9841\u9842\u9843\u9844\u9845\u9846\u9847\u9848\u9849\u984a\u984b\u984c\u984d\u984e\u984f\u9850\u9851\u9852\u9853\u9854\u9855\u9856\u9857\u9858\u9859\u985a\u985b\u985c\u985d\u985e\u985f\u9860\u9861\u9862\u9863\u9864\u9865\u9866\u9867\u9868\u9869\u986a\u986b\u986c\u986d\u986e\u986f\u9870\u9871\u9872\u9873\u9874\u9875\u9876\u9877\u9878\u9879\u987a\u987b\u987c\u987d\u987e\u987f\u9880\u9881\u9882\u9883\u9884\u9885\u9886\u9887\u9888\u9889\u988a\u988b\u988c\u988d\u988e\u988f\u9890\u9891\u9892\u9893\u9894\u9895\u9896\u9897\u9898\u9899\u989a\u989b\u989c\u989d\u989e\u989f\u98a0\u98a1\u98a2\u98a3\u98a4\u98a5\u98a6\u98a7\u98a8\u98a9\u98aa\u98ab\u98ac\u98ad\u98ae\u98af\u98b0\u98b1\u98b2\u98b3\u98b4\u98b5\u98b6\u98b7\u98b8\u98b9\u98ba\u98bb\u98bc\u98bd\u98be\u98bf\u98c0\u98c1\u98c2\u98c3\u98c4\u98c5\u98c6\u98c7\u98c8\u98c9\u98ca\u98cb\u98cc\u98cd\u98ce\u98cf\u98d0\u98d1\u98d2\u98d3\u98d4\u98d5\u98d6\u98d7\u98d8\u98d9\u98da\u98db\u98dc\u98dd\u98de\u98df\u98e0\u98e1\u98e2\u98e3\u98e4\u98e5\u98e6\u98e7\u98e8\u98e9\u98ea\u98eb\u98ec\u98ed\u98ee\u98ef\u98f0\u98f1\u98f2\u98f3\u98f4\u98f5\u98f6\u98f7\u98f8\u98f9\u98fa\u98fb\u98fc\u98fd\u98fe\u98ff\u9900\u9901\u9902\u9903\u9904\u9905\u9906\u9907\u9908\u9909\u990a\u990b\u990c\u990d\u990e\u990f\u9910\u9911\u9912\u9913\u9914\u9915\u9916\u9917\u9918\u9919\u991a\u991b\u991c\u991d\u991e\u991f\u9920\u9921\u9922\u9923\u9924\u9925\u9926\u9927\u9928\u9929\u992a\u992b\u992c\u992d\u992e\u992f\u9930\u9931\u9932\u9933\u9934\u9935\u9936\u9937\u9938\u9939\u993a\u993b\u993c\u993d\u993e\u993f\u9940\u9941\u9942\u9943\u9944\u9945\u9946\u9947\u9948\u9949\u994a\u994b\u994c\u994d\u994e\u994f\u9950\u9951\u9952\u9953\u9954\u9955\u9956\u9957\u9958\u9959\u995a\u995b\u995c\u995d\u995e\u995f\u9960\u9961\u9962\u9963\u9964\u9965\u9966\u9967\u9968\u9969\u996a\u996b\u996c\u996d\u996e\u996f\u9970\u9971\u9972\u9973\u9974\u9975\u9976\u9977\u9978\u9979\u997a\u997b\u997c\u997d\u997e\u997f\u9980\u9981\u9982\u9983\u9984\u9985\u9986\u9987\u9988\u9989\u998a\u998b\u998c\u998d\u998e\u998f\u9990\u9991\u9992\u9993\u9994\u9995\u9996\u9997\u9998\u9999\u999a\u999b\u999c\u999d\u999e\u999f\u99a0\u99a1\u99a2\u99a3\u99a4\u99a5\u99a6\u99a7\u99a8\u99a9\u99aa\u99ab\u99ac\u99ad\u99ae\u99af\u99b0\u99b1\u99b2\u99b3\u99b4\u99b5\u99b6\u99b7\u99b8\u99b9\u99ba\u99bb\u99bc\u99bd\u99be\u99bf\u99c0\u99c1\u99c2\u99c3\u99c4\u99c5\u99c6\u99c7\u99c8\u99c9\u99ca\u99cb\u99cc\u99cd\u99ce\u99cf\u99d0\u99d1\u99d2\u99d3\u99d4\u99d5\u99d6\u99d7\u99d8\u99d9\u99da\u99db\u99dc\u99dd\u99de\u99df\u99e0\u99e1\u99e2\u99e3\u99e4\u99e5\u99e6\u99e7\u99e8\u99e9\u99ea\u99eb\u99ec\u99ed\u99ee\u99ef\u99f0\u99f1\u99f2\u99f3\u99f4\u99f5\u99f6\u99f7\u99f8\u99f9\u99fa\u99fb\u99fc\u99fd\u99fe\u99ff\u9a00\u9a01\u9a02\u9a03\u9a04\u9a05\u9a06\u9a07\u9a08\u9a09\u9a0a\u9a0b\u9a0c\u9a0d\u9a0e\u9a0f\u9a10\u9a11\u9a12\u9a13\u9a14\u9a15\u9a16\u9a17\u9a18\u9a19\u9a1a\u9a1b\u9a1c\u9a1d\u9a1e\u9a1f\u9a20\u9a21\u9a22\u9a23\u9a24\u9a25\u9a26\u9a27\u9a28\u9a29\u9a2a\u9a2b\u9a2c\u9a2d\u9a2e\u9a2f\u9a30\u9a31\u9a32\u9a33\u9a34\u9a35\u9a36\u9a37\u9a38\u9a39\u9a3a\u9a3b\u9a3c\u9a3d\u9a3e\u9a3f\u9a40\u9a41\u9a42\u9a43\u9a44\u9a45\u9a46\u9a47\u9a48\u9a49\u9a4a\u9a4b\u9a4c\u9a4d\u9a4e\u9a4f\u9a50\u9a51\u9a52\u9a53\u9a54\u9a55\u9a56\u9a57\u9a58\u9a59\u9a5a\u9a5b\u9a5c\u9a5d\u9a5e\u9a5f\u9a60\u9a61\u9a62\u9a63\u9a64\u9a65\u9a66\u9a67\u9a68\u9a69\u9a6a\u9a6b\u9a6c\u9a6d\u9a6e\u9a6f\u9a70\u9a71\u9a72\u9a73\u9a74\u9a75\u9a76\u9a77\u9a78\u9a79\u9a7a\u9a7b\u9a7c\u9a7d\u9a7e\u9a7f\u9a80\u9a81\u9a82\u9a83\u9a84\u9a85\u9a86\u9a87\u9a88\u9a89\u9a8a\u9a8b\u9a8c\u9a8d\u9a8e\u9a8f\u9a90\u9a91\u9a92\u9a93\u9a94\u9a95\u9a96\u9a97\u9a98\u9a99\u9a9a\u9a9b\u9a9c\u9a9d\u9a9e\u9a9f\u9aa0\u9aa1\u9aa2\u9aa3\u9aa4\u9aa5\u9aa6\u9aa7\u9aa8\u9aa9\u9aaa\u9aab\u9aac\u9aad\u9aae\u9aaf\u9ab0\u9ab1\u9ab2\u9ab3\u9ab4\u9ab5\u9ab6\u9ab7\u9ab8\u9ab9\u9aba\u9abb\u9abc\u9abd\u9abe\u9abf\u9ac0\u9ac1\u9ac2\u9ac3\u9ac4\u9ac5\u9ac6\u9ac7\u9ac8\u9ac9\u9aca\u9acb\u9acc\u9acd\u9ace\u9acf\u9ad0\u9ad1\u9ad2\u9ad3\u9ad4\u9ad5\u9ad6\u9ad7\u9ad8\u9ad9\u9ada\u9adb\u9adc\u9add\u9ade\u9adf\u9ae0\u9ae1\u9ae2\u9ae3\u9ae4\u9ae5\u9ae6\u9ae7\u9ae8\u9ae9\u9aea\u9aeb\u9aec\u9aed\u9aee\u9aef\u9af0\u9af1\u9af2\u9af3\u9af4\u9af5\u9af6\u9af7\u9af8\u9af9\u9afa\u9afb\u9afc\u9afd\u9afe\u9aff\u9b00\u9b01\u9b02\u9b03\u9b04\u9b05\u9b06\u9b07\u9b08\u9b09\u9b0a\u9b0b\u9b0c\u9b0d\u9b0e\u9b0f\u9b10\u9b11\u9b12\u9b13\u9b14\u9b15\u9b16\u9b17\u9b18\u9b19\u9b1a\u9b1b\u9b1c\u9b1d\u9b1e\u9b1f\u9b20\u9b21\u9b22\u9b23\u9b24\u9b25\u9b26\u9b27\u9b28\u9b29\u9b2a\u9b2b\u9b2c\u9b2d\u9b2e\u9b2f\u9b30\u9b31\u9b32\u9b33\u9b34\u9b35\u9b36\u9b37\u9b38\u9b39\u9b3a\u9b3b\u9b3c\u9b3d\u9b3e\u9b3f\u9b40\u9b41\u9b42\u9b43\u9b44\u9b45\u9b46\u9b47\u9b48\u9b49\u9b4a\u9b4b\u9b4c\u9b4d\u9b4e\u9b4f\u9b50\u9b51\u9b52\u9b53\u9b54\u9b55\u9b56\u9b57\u9b58\u9b59\u9b5a\u9b5b\u9b5c\u9b5d\u9b5e\u9b5f\u9b60\u9b61\u9b62\u9b63\u9b64\u9b65\u9b66\u9b67\u9b68\u9b69\u9b6a\u9b6b\u9b6c\u9b6d\u9b6e\u9b6f\u9b70\u9b71\u9b72\u9b73\u9b74\u9b75\u9b76\u9b77\u9b78\u9b79\u9b7a\u9b7b\u9b7c\u9b7d\u9b7e\u9b7f\u9b80\u9b81\u9b82\u9b83\u9b84\u9b85\u9b86\u9b87\u9b88\u9b89\u9b8a\u9b8b\u9b8c\u9b8d\u9b8e\u9b8f\u9b90\u9b91\u9b92\u9b93\u9b94\u9b95\u9b96\u9b97\u9b98\u9b99\u9b9a\u9b9b\u9b9c\u9b9d\u9b9e\u9b9f\u9ba0\u9ba1\u9ba2\u9ba3\u9ba4\u9ba5\u9ba6\u9ba7\u9ba8\u9ba9\u9baa\u9bab\u9bac\u9bad\u9bae\u9baf\u9bb0\u9bb1\u9bb2\u9bb3\u9bb4\u9bb5\u9bb6\u9bb7\u9bb8\u9bb9\u9bba\u9bbb\u9bbc\u9bbd\u9bbe\u9bbf\u9bc0\u9bc1\u9bc2\u9bc3\u9bc4\u9bc5\u9bc6\u9bc7\u9bc8\u9bc9\u9bca\u9bcb\u9bcc\u9bcd\u9bce\u9bcf\u9bd0\u9bd1\u9bd2\u9bd3\u9bd4\u9bd5\u9bd6\u9bd7\u9bd8\u9bd9\u9bda\u9bdb\u9bdc\u9bdd\u9bde\u9bdf\u9be0\u9be1\u9be2\u9be3\u9be4\u9be5\u9be6\u9be7\u9be8\u9be9\u9bea\u9beb\u9bec\u9bed\u9bee\u9bef\u9bf0\u9bf1\u9bf2\u9bf3\u9bf4\u9bf5\u9bf6\u9bf7\u9bf8\u9bf9\u9bfa\u9bfb\u9bfc\u9bfd\u9bfe\u9bff\u9c00\u9c01\u9c02\u9c03\u9c04\u9c05\u9c06\u9c07\u9c08\u9c09\u9c0a\u9c0b\u9c0c\u9c0d\u9c0e\u9c0f\u9c10\u9c11\u9c12\u9c13\u9c14\u9c15\u9c16\u9c17\u9c18\u9c19\u9c1a\u9c1b\u9c1c\u9c1d\u9c1e\u9c1f\u9c20\u9c21\u9c22\u9c23\u9c24\u9c25\u9c26\u9c27\u9c28\u9c29\u9c2a\u9c2b\u9c2c\u9c2d\u9c2e\u9c2f\u9c30\u9c31\u9c32\u9c33\u9c34\u9c35\u9c36\u9c37\u9c38\u9c39\u9c3a\u9c3b\u9c3c\u9c3d\u9c3e\u9c3f\u9c40\u9c41\u9c42\u9c43\u9c44\u9c45\u9c46\u9c47\u9c48\u9c49\u9c4a\u9c4b\u9c4c\u9c4d\u9c4e\u9c4f\u9c50\u9c51\u9c52\u9c53\u9c54\u9c55\u9c56\u9c57\u9c58\u9c59\u9c5a\u9c5b\u9c5c\u9c5d\u9c5e\u9c5f\u9c60\u9c61\u9c62\u9c63\u9c64\u9c65\u9c66\u9c67\u9c68\u9c69\u9c6a\u9c6b\u9c6c\u9c6d\u9c6e\u9c6f\u9c70\u9c71\u9c72\u9c73\u9c74\u9c75\u9c76\u9c77\u9c78\u9c79\u9c7a\u9c7b\u9c7c\u9c7d\u9c7e\u9c7f\u9c80\u9c81\u9c82\u9c83\u9c84\u9c85\u9c86\u9c87\u9c88\u9c89\u9c8a\u9c8b\u9c8c\u9c8d\u9c8e\u9c8f\u9c90\u9c91\u9c92\u9c93\u9c94\u9c95\u9c96\u9c97\u9c98\u9c99\u9c9a\u9c9b\u9c9c\u9c9d\u9c9e\u9c9f\u9ca0\u9ca1\u9ca2\u9ca3\u9ca4\u9ca5\u9ca6\u9ca7\u9ca8\u9ca9\u9caa\u9cab\u9cac\u9cad\u9cae\u9caf\u9cb0\u9cb1\u9cb2\u9cb3\u9cb4\u9cb5\u9cb6\u9cb7\u9cb8\u9cb9\u9cba\u9cbb\u9cbc\u9cbd\u9cbe\u9cbf\u9cc0\u9cc1\u9cc2\u9cc3\u9cc4\u9cc5\u9cc6\u9cc7\u9cc8\u9cc9\u9cca\u9ccb\u9ccc\u9ccd\u9cce\u9ccf\u9cd0\u9cd1\u9cd2\u9cd3\u9cd4\u9cd5\u9cd6\u9cd7\u9cd8\u9cd9\u9cda\u9cdb\u9cdc\u9cdd\u9cde\u9cdf\u9ce0\u9ce1\u9ce2\u9ce3\u9ce4\u9ce5\u9ce6\u9ce7\u9ce8\u9ce9\u9cea\u9ceb\u9cec\u9ced\u9cee\u9cef\u9cf0\u9cf1\u9cf2\u9cf3\u9cf4\u9cf5\u9cf6\u9cf7\u9cf8\u9cf9\u9cfa\u9cfb\u9cfc\u9cfd\u9cfe\u9cff\u9d00\u9d01\u9d02\u9d03\u9d04\u9d05\u9d06\u9d07\u9d08\u9d09\u9d0a\u9d0b\u9d0c\u9d0d\u9d0e\u9d0f\u9d10\u9d11\u9d12\u9d13\u9d14\u9d15\u9d16\u9d17\u9d18\u9d19\u9d1a\u9d1b\u9d1c\u9d1d\u9d1e\u9d1f\u9d20\u9d21\u9d22\u9d23\u9d24\u9d25\u9d26\u9d27\u9d28\u9d29\u9d2a\u9d2b\u9d2c\u9d2d\u9d2e\u9d2f\u9d30\u9d31\u9d32\u9d33\u9d34\u9d35\u9d36\u9d37\u9d38\u9d39\u9d3a\u9d3b\u9d3c\u9d3d\u9d3e\u9d3f\u9d40\u9d41\u9d42\u9d43\u9d44\u9d45\u9d46\u9d47\u9d48\u9d49\u9d4a\u9d4b\u9d4c\u9d4d\u9d4e\u9d4f\u9d50\u9d51\u9d52\u9d53\u9d54\u9d55\u9d56\u9d57\u9d58\u9d59\u9d5a\u9d5b\u9d5c\u9d5d\u9d5e\u9d5f\u9d60\u9d61\u9d62\u9d63\u9d64\u9d65\u9d66\u9d67\u9d68\u9d69\u9d6a\u9d6b\u9d6c\u9d6d\u9d6e\u9d6f\u9d70\u9d71\u9d72\u9d73\u9d74\u9d75\u9d76\u9d77\u9d78\u9d79\u9d7a\u9d7b\u9d7c\u9d7d\u9d7e\u9d7f\u9d80\u9d81\u9d82\u9d83\u9d84\u9d85\u9d86\u9d87\u9d88\u9d89\u9d8a\u9d8b\u9d8c\u9d8d\u9d8e\u9d8f\u9d90\u9d91\u9d92\u9d93\u9d94\u9d95\u9d96\u9d97\u9d98\u9d99\u9d9a\u9d9b\u9d9c\u9d9d\u9d9e\u9d9f\u9da0\u9da1\u9da2\u9da3\u9da4\u9da5\u9da6\u9da7\u9da8\u9da9\u9daa\u9dab\u9dac\u9dad\u9dae\u9daf\u9db0\u9db1\u9db2\u9db3\u9db4\u9db5\u9db6\u9db7\u9db8\u9db9\u9dba\u9dbb\u9dbc\u9dbd\u9dbe\u9dbf\u9dc0\u9dc1\u9dc2\u9dc3\u9dc4\u9dc5\u9dc6\u9dc7\u9dc8\u9dc9\u9dca\u9dcb\u9dcc\u9dcd\u9dce\u9dcf\u9dd0\u9dd1\u9dd2\u9dd3\u9dd4\u9dd5\u9dd6\u9dd7\u9dd8\u9dd9\u9dda\u9ddb\u9ddc\u9ddd\u9dde\u9ddf\u9de0\u9de1\u9de2\u9de3\u9de4\u9de5\u9de6\u9de7\u9de8\u9de9\u9dea\u9deb\u9dec\u9ded\u9dee\u9def\u9df0\u9df1\u9df2\u9df3\u9df4\u9df5\u9df6\u9df7\u9df8\u9df9\u9dfa\u9dfb\u9dfc\u9dfd\u9dfe\u9dff\u9e00\u9e01\u9e02\u9e03\u9e04\u9e05\u9e06\u9e07\u9e08\u9e09\u9e0a\u9e0b\u9e0c\u9e0d\u9e0e\u9e0f\u9e10\u9e11\u9e12\u9e13\u9e14\u9e15\u9e16\u9e17\u9e18\u9e19\u9e1a\u9e1b\u9e1c\u9e1d\u9e1e\u9e1f\u9e20\u9e21\u9e22\u9e23\u9e24\u9e25\u9e26\u9e27\u9e28\u9e29\u9e2a\u9e2b\u9e2c\u9e2d\u9e2e\u9e2f\u9e30\u9e31\u9e32\u9e33\u9e34\u9e35\u9e36\u9e37\u9e38\u9e39\u9e3a\u9e3b\u9e3c\u9e3d\u9e3e\u9e3f\u9e40\u9e41\u9e42\u9e43\u9e44\u9e45\u9e46\u9e47\u9e48\u9e49\u9e4a\u9e4b\u9e4c\u9e4d\u9e4e\u9e4f\u9e50\u9e51\u9e52\u9e53\u9e54\u9e55\u9e56\u9e57\u9e58\u9e59\u9e5a\u9e5b\u9e5c\u9e5d\u9e5e\u9e5f\u9e60\u9e61\u9e62\u9e63\u9e64\u9e65\u9e66\u9e67\u9e68\u9e69\u9e6a\u9e6b\u9e6c\u9e6d\u9e6e\u9e6f\u9e70\u9e71\u9e72\u9e73\u9e74\u9e75\u9e76\u9e77\u9e78\u9e79\u9e7a\u9e7b\u9e7c\u9e7d\u9e7e\u9e7f\u9e80\u9e81\u9e82\u9e83\u9e84\u9e85\u9e86\u9e87\u9e88\u9e89\u9e8a\u9e8b\u9e8c\u9e8d\u9e8e\u9e8f\u9e90\u9e91\u9e92\u9e93\u9e94\u9e95\u9e96\u9e97\u9e98\u9e99\u9e9a\u9e9b\u9e9c\u9e9d\u9e9e\u9e9f\u9ea0\u9ea1\u9ea2\u9ea3\u9ea4\u9ea5\u9ea6\u9ea7\u9ea8\u9ea9\u9eaa\u9eab\u9eac\u9ead\u9eae\u9eaf\u9eb0\u9eb1\u9eb2\u9eb3\u9eb4\u9eb5\u9eb6\u9eb7\u9eb8\u9eb9\u9eba\u9ebb\u9ebc\u9ebd\u9ebe\u9ebf\u9ec0\u9ec1\u9ec2\u9ec3\u9ec4\u9ec5\u9ec6\u9ec7\u9ec8\u9ec9\u9eca\u9ecb\u9ecc\u9ecd\u9ece\u9ecf\u9ed0\u9ed1\u9ed2\u9ed3\u9ed4\u9ed5\u9ed6\u9ed7\u9ed8\u9ed9\u9eda\u9edb\u9edc\u9edd\u9ede\u9edf\u9ee0\u9ee1\u9ee2\u9ee3\u9ee4\u9ee5\u9ee6\u9ee7\u9ee8\u9ee9\u9eea\u9eeb\u9eec\u9eed\u9eee\u9eef\u9ef0\u9ef1\u9ef2\u9ef3\u9ef4\u9ef5\u9ef6\u9ef7\u9ef8\u9ef9\u9efa\u9efb\u9efc\u9efd\u9efe\u9eff\u9f00\u9f01\u9f02\u9f03\u9f04\u9f05\u9f06\u9f07\u9f08\u9f09\u9f0a\u9f0b\u9f0c\u9f0d\u9f0e\u9f0f\u9f10\u9f11\u9f12\u9f13\u9f14\u9f15\u9f16\u9f17\u9f18\u9f19\u9f1a\u9f1b\u9f1c\u9f1d\u9f1e\u9f1f\u9f20\u9f21\u9f22\u9f23\u9f24\u9f25\u9f26\u9f27\u9f28\u9f29\u9f2a\u9f2b\u9f2c\u9f2d\u9f2e\u9f2f\u9f30\u9f31\u9f32\u9f33\u9f34\u9f35\u9f36\u9f37\u9f38\u9f39\u9f3a\u9f3b\u9f3c\u9f3d\u9f3e\u9f3f\u9f40\u9f41\u9f42\u9f43\u9f44\u9f45\u9f46\u9f47\u9f48\u9f49\u9f4a\u9f4b\u9f4c\u9f4d\u9f4e\u9f4f\u9f50\u9f51\u9f52\u9f53\u9f54\u9f55\u9f56\u9f57\u9f58\u9f59\u9f5a\u9f5b\u9f5c\u9f5d\u9f5e\u9f5f\u9f60\u9f61\u9f62\u9f63\u9f64\u9f65\u9f66\u9f67\u9f68\u9f69\u9f6a\u9f6b\u9f6c\u9f6d\u9f6e\u9f6f\u9f70\u9f71\u9f72\u9f73\u9f74\u9f75\u9f76\u9f77\u9f78\u9f79\u9f7a\u9f7b\u9f7c\u9f7d\u9f7e\u9f7f\u9f80\u9f81\u9f82\u9f83\u9f84\u9f85\u9f86\u9f87\u9f88\u9f89\u9f8a\u9f8b\u9f8c\u9f8d\u9f8e\u9f8f\u9f90\u9f91\u9f92\u9f93\u9f94\u9f95\u9f96\u9f97\u9f98\u9f99\u9f9a\u9f9b\u9f9c\u9f9d\u9f9e\u9f9f\u9fa0\u9fa1\u9fa2\u9fa3\u9fa4\u9fa5\u9fa6\u9fa7\u9fa8\u9fa9\u9faa\u9fab\u9fac\u9fad\u9fae\u9faf\u9fb0\u9fb1\u9fb2\u9fb3\u9fb4\u9fb5\u9fb6\u9fb7\u9fb8\u9fb9\u9fba\u9fbb\ua000\ua001\ua002\ua003\ua004\ua005\ua006\ua007\ua008\ua009\ua00a\ua00b\ua00c\ua00d\ua00e\ua00f\ua010\ua011\ua012\ua013\ua014\ua016\ua017\ua018\ua019\ua01a\ua01b\ua01c\ua01d\ua01e\ua01f\ua020\ua021\ua022\ua023\ua024\ua025\ua026\ua027\ua028\ua029\ua02a\ua02b\ua02c\ua02d\ua02e\ua02f\ua030\ua031\ua032\ua033\ua034\ua035\ua036\ua037\ua038\ua039\ua03a\ua03b\ua03c\ua03d\ua03e\ua03f\ua040\ua041\ua042\ua043\ua044\ua045\ua046\ua047\ua048\ua049\ua04a\ua04b\ua04c\ua04d\ua04e\ua04f\ua050\ua051\ua052\ua053\ua054\ua055\ua056\ua057\ua058\ua059\ua05a\ua05b\ua05c\ua05d\ua05e\ua05f\ua060\ua061\ua062\ua063\ua064\ua065\ua066\ua067\ua068\ua069\ua06a\ua06b\ua06c\ua06d\ua06e\ua06f\ua070\ua071\ua072\ua073\ua074\ua075\ua076\ua077\ua078\ua079\ua07a\ua07b\ua07c\ua07d\ua07e\ua07f\ua080\ua081\ua082\ua083\ua084\ua085\ua086\ua087\ua088\ua089\ua08a\ua08b\ua08c\ua08d\ua08e\ua08f\ua090\ua091\ua092\ua093\ua094\ua095\ua096\ua097\ua098\ua099\ua09a\ua09b\ua09c\ua09d\ua09e\ua09f\ua0a0\ua0a1\ua0a2\ua0a3\ua0a4\ua0a5\ua0a6\ua0a7\ua0a8\ua0a9\ua0aa\ua0ab\ua0ac\ua0ad\ua0ae\ua0af\ua0b0\ua0b1\ua0b2\ua0b3\ua0b4\ua0b5\ua0b6\ua0b7\ua0b8\ua0b9\ua0ba\ua0bb\ua0bc\ua0bd\ua0be\ua0bf\ua0c0\ua0c1\ua0c2\ua0c3\ua0c4\ua0c5\ua0c6\ua0c7\ua0c8\ua0c9\ua0ca\ua0cb\ua0cc\ua0cd\ua0ce\ua0cf\ua0d0\ua0d1\ua0d2\ua0d3\ua0d4\ua0d5\ua0d6\ua0d7\ua0d8\ua0d9\ua0da\ua0db\ua0dc\ua0dd\ua0de\ua0df\ua0e0\ua0e1\ua0e2\ua0e3\ua0e4\ua0e5\ua0e6\ua0e7\ua0e8\ua0e9\ua0ea\ua0eb\ua0ec\ua0ed\ua0ee\ua0ef\ua0f0\ua0f1\ua0f2\ua0f3\ua0f4\ua0f5\ua0f6\ua0f7\ua0f8\ua0f9\ua0fa\ua0fb\ua0fc\ua0fd\ua0fe\ua0ff\ua100\ua101\ua102\ua103\ua104\ua105\ua106\ua107\ua108\ua109\ua10a\ua10b\ua10c\ua10d\ua10e\ua10f\ua110\ua111\ua112\ua113\ua114\ua115\ua116\ua117\ua118\ua119\ua11a\ua11b\ua11c\ua11d\ua11e\ua11f\ua120\ua121\ua122\ua123\ua124\ua125\ua126\ua127\ua128\ua129\ua12a\ua12b\ua12c\ua12d\ua12e\ua12f\ua130\ua131\ua132\ua133\ua134\ua135\ua136\ua137\ua138\ua139\ua13a\ua13b\ua13c\ua13d\ua13e\ua13f\ua140\ua141\ua142\ua143\ua144\ua145\ua146\ua147\ua148\ua149\ua14a\ua14b\ua14c\ua14d\ua14e\ua14f\ua150\ua151\ua152\ua153\ua154\ua155\ua156\ua157\ua158\ua159\ua15a\ua15b\ua15c\ua15d\ua15e\ua15f\ua160\ua161\ua162\ua163\ua164\ua165\ua166\ua167\ua168\ua169\ua16a\ua16b\ua16c\ua16d\ua16e\ua16f\ua170\ua171\ua172\ua173\ua174\ua175\ua176\ua177\ua178\ua179\ua17a\ua17b\ua17c\ua17d\ua17e\ua17f\ua180\ua181\ua182\ua183\ua184\ua185\ua186\ua187\ua188\ua189\ua18a\ua18b\ua18c\ua18d\ua18e\ua18f\ua190\ua191\ua192\ua193\ua194\ua195\ua196\ua197\ua198\ua199\ua19a\ua19b\ua19c\ua19d\ua19e\ua19f\ua1a0\ua1a1\ua1a2\ua1a3\ua1a4\ua1a5\ua1a6\ua1a7\ua1a8\ua1a9\ua1aa\ua1ab\ua1ac\ua1ad\ua1ae\ua1af\ua1b0\ua1b1\ua1b2\ua1b3\ua1b4\ua1b5\ua1b6\ua1b7\ua1b8\ua1b9\ua1ba\ua1bb\ua1bc\ua1bd\ua1be\ua1bf\ua1c0\ua1c1\ua1c2\ua1c3\ua1c4\ua1c5\ua1c6\ua1c7\ua1c8\ua1c9\ua1ca\ua1cb\ua1cc\ua1cd\ua1ce\ua1cf\ua1d0\ua1d1\ua1d2\ua1d3\ua1d4\ua1d5\ua1d6\ua1d7\ua1d8\ua1d9\ua1da\ua1db\ua1dc\ua1dd\ua1de\ua1df\ua1e0\ua1e1\ua1e2\ua1e3\ua1e4\ua1e5\ua1e6\ua1e7\ua1e8\ua1e9\ua1ea\ua1eb\ua1ec\ua1ed\ua1ee\ua1ef\ua1f0\ua1f1\ua1f2\ua1f3\ua1f4\ua1f5\ua1f6\ua1f7\ua1f8\ua1f9\ua1fa\ua1fb\ua1fc\ua1fd\ua1fe\ua1ff\ua200\ua201\ua202\ua203\ua204\ua205\ua206\ua207\ua208\ua209\ua20a\ua20b\ua20c\ua20d\ua20e\ua20f\ua210\ua211\ua212\ua213\ua214\ua215\ua216\ua217\ua218\ua219\ua21a\ua21b\ua21c\ua21d\ua21e\ua21f\ua220\ua221\ua222\ua223\ua224\ua225\ua226\ua227\ua228\ua229\ua22a\ua22b\ua22c\ua22d\ua22e\ua22f\ua230\ua231\ua232\ua233\ua234\ua235\ua236\ua237\ua238\ua239\ua23a\ua23b\ua23c\ua23d\ua23e\ua23f\ua240\ua241\ua242\ua243\ua244\ua245\ua246\ua247\ua248\ua249\ua24a\ua24b\ua24c\ua24d\ua24e\ua24f\ua250\ua251\ua252\ua253\ua254\ua255\ua256\ua257\ua258\ua259\ua25a\ua25b\ua25c\ua25d\ua25e\ua25f\ua260\ua261\ua262\ua263\ua264\ua265\ua266\ua267\ua268\ua269\ua26a\ua26b\ua26c\ua26d\ua26e\ua26f\ua270\ua271\ua272\ua273\ua274\ua275\ua276\ua277\ua278\ua279\ua27a\ua27b\ua27c\ua27d\ua27e\ua27f\ua280\ua281\ua282\ua283\ua284\ua285\ua286\ua287\ua288\ua289\ua28a\ua28b\ua28c\ua28d\ua28e\ua28f\ua290\ua291\ua292\ua293\ua294\ua295\ua296\ua297\ua298\ua299\ua29a\ua29b\ua29c\ua29d\ua29e\ua29f\ua2a0\ua2a1\ua2a2\ua2a3\ua2a4\ua2a5\ua2a6\ua2a7\ua2a8\ua2a9\ua2aa\ua2ab\ua2ac\ua2ad\ua2ae\ua2af\ua2b0\ua2b1\ua2b2\ua2b3\ua2b4\ua2b5\ua2b6\ua2b7\ua2b8\ua2b9\ua2ba\ua2bb\ua2bc\ua2bd\ua2be\ua2bf\ua2c0\ua2c1\ua2c2\ua2c3\ua2c4\ua2c5\ua2c6\ua2c7\ua2c8\ua2c9\ua2ca\ua2cb\ua2cc\ua2cd\ua2ce\ua2cf\ua2d0\ua2d1\ua2d2\ua2d3\ua2d4\ua2d5\ua2d6\ua2d7\ua2d8\ua2d9\ua2da\ua2db\ua2dc\ua2dd\ua2de\ua2df\ua2e0\ua2e1\ua2e2\ua2e3\ua2e4\ua2e5\ua2e6\ua2e7\ua2e8\ua2e9\ua2ea\ua2eb\ua2ec\ua2ed\ua2ee\ua2ef\ua2f0\ua2f1\ua2f2\ua2f3\ua2f4\ua2f5\ua2f6\ua2f7\ua2f8\ua2f9\ua2fa\ua2fb\ua2fc\ua2fd\ua2fe\ua2ff\ua300\ua301\ua302\ua303\ua304\ua305\ua306\ua307\ua308\ua309\ua30a\ua30b\ua30c\ua30d\ua30e\ua30f\ua310\ua311\ua312\ua313\ua314\ua315\ua316\ua317\ua318\ua319\ua31a\ua31b\ua31c\ua31d\ua31e\ua31f\ua320\ua321\ua322\ua323\ua324\ua325\ua326\ua327\ua328\ua329\ua32a\ua32b\ua32c\ua32d\ua32e\ua32f\ua330\ua331\ua332\ua333\ua334\ua335\ua336\ua337\ua338\ua339\ua33a\ua33b\ua33c\ua33d\ua33e\ua33f\ua340\ua341\ua342\ua343\ua344\ua345\ua346\ua347\ua348\ua349\ua34a\ua34b\ua34c\ua34d\ua34e\ua34f\ua350\ua351\ua352\ua353\ua354\ua355\ua356\ua357\ua358\ua359\ua35a\ua35b\ua35c\ua35d\ua35e\ua35f\ua360\ua361\ua362\ua363\ua364\ua365\ua366\ua367\ua368\ua369\ua36a\ua36b\ua36c\ua36d\ua36e\ua36f\ua370\ua371\ua372\ua373\ua374\ua375\ua376\ua377\ua378\ua379\ua37a\ua37b\ua37c\ua37d\ua37e\ua37f\ua380\ua381\ua382\ua383\ua384\ua385\ua386\ua387\ua388\ua389\ua38a\ua38b\ua38c\ua38d\ua38e\ua38f\ua390\ua391\ua392\ua393\ua394\ua395\ua396\ua397\ua398\ua399\ua39a\ua39b\ua39c\ua39d\ua39e\ua39f\ua3a0\ua3a1\ua3a2\ua3a3\ua3a4\ua3a5\ua3a6\ua3a7\ua3a8\ua3a9\ua3aa\ua3ab\ua3ac\ua3ad\ua3ae\ua3af\ua3b0\ua3b1\ua3b2\ua3b3\ua3b4\ua3b5\ua3b6\ua3b7\ua3b8\ua3b9\ua3ba\ua3bb\ua3bc\ua3bd\ua3be\ua3bf\ua3c0\ua3c1\ua3c2\ua3c3\ua3c4\ua3c5\ua3c6\ua3c7\ua3c8\ua3c9\ua3ca\ua3cb\ua3cc\ua3cd\ua3ce\ua3cf\ua3d0\ua3d1\ua3d2\ua3d3\ua3d4\ua3d5\ua3d6\ua3d7\ua3d8\ua3d9\ua3da\ua3db\ua3dc\ua3dd\ua3de\ua3df\ua3e0\ua3e1\ua3e2\ua3e3\ua3e4\ua3e5\ua3e6\ua3e7\ua3e8\ua3e9\ua3ea\ua3eb\ua3ec\ua3ed\ua3ee\ua3ef\ua3f0\ua3f1\ua3f2\ua3f3\ua3f4\ua3f5\ua3f6\ua3f7\ua3f8\ua3f9\ua3fa\ua3fb\ua3fc\ua3fd\ua3fe\ua3ff\ua400\ua401\ua402\ua403\ua404\ua405\ua406\ua407\ua408\ua409\ua40a\ua40b\ua40c\ua40d\ua40e\ua40f\ua410\ua411\ua412\ua413\ua414\ua415\ua416\ua417\ua418\ua419\ua41a\ua41b\ua41c\ua41d\ua41e\ua41f\ua420\ua421\ua422\ua423\ua424\ua425\ua426\ua427\ua428\ua429\ua42a\ua42b\ua42c\ua42d\ua42e\ua42f\ua430\ua431\ua432\ua433\ua434\ua435\ua436\ua437\ua438\ua439\ua43a\ua43b\ua43c\ua43d\ua43e\ua43f\ua440\ua441\ua442\ua443\ua444\ua445\ua446\ua447\ua448\ua449\ua44a\ua44b\ua44c\ua44d\ua44e\ua44f\ua450\ua451\ua452\ua453\ua454\ua455\ua456\ua457\ua458\ua459\ua45a\ua45b\ua45c\ua45d\ua45e\ua45f\ua460\ua461\ua462\ua463\ua464\ua465\ua466\ua467\ua468\ua469\ua46a\ua46b\ua46c\ua46d\ua46e\ua46f\ua470\ua471\ua472\ua473\ua474\ua475\ua476\ua477\ua478\ua479\ua47a\ua47b\ua47c\ua47d\ua47e\ua47f\ua480\ua481\ua482\ua483\ua484\ua485\ua486\ua487\ua488\ua489\ua48a\ua48b\ua48c\ua800\ua801\ua803\ua804\ua805\ua807\ua808\ua809\ua80a\ua80c\ua80d\ua80e\ua80f\ua810\ua811\ua812\ua813\ua814\ua815\ua816\ua817\ua818\ua819\ua81a\ua81b\ua81c\ua81d\ua81e\ua81f\ua820\ua821\ua822\uac00\uac01\uac02\uac03\uac04\uac05\uac06\uac07\uac08\uac09\uac0a\uac0b\uac0c\uac0d\uac0e\uac0f\uac10\uac11\uac12\uac13\uac14\uac15\uac16\uac17\uac18\uac19\uac1a\uac1b\uac1c\uac1d\uac1e\uac1f\uac20\uac21\uac22\uac23\uac24\uac25\uac26\uac27\uac28\uac29\uac2a\uac2b\uac2c\uac2d\uac2e\uac2f\uac30\uac31\uac32\uac33\uac34\uac35\uac36\uac37\uac38\uac39\uac3a\uac3b\uac3c\uac3d\uac3e\uac3f\uac40\uac41\uac42\uac43\uac44\uac45\uac46\uac47\uac48\uac49\uac4a\uac4b\uac4c\uac4d\uac4e\uac4f\uac50\uac51\uac52\uac53\uac54\uac55\uac56\uac57\uac58\uac59\uac5a\uac5b\uac5c\uac5d\uac5e\uac5f\uac60\uac61\uac62\uac63\uac64\uac65\uac66\uac67\uac68\uac69\uac6a\uac6b\uac6c\uac6d\uac6e\uac6f\uac70\uac71\uac72\uac73\uac74\uac75\uac76\uac77\uac78\uac79\uac7a\uac7b\uac7c\uac7d\uac7e\uac7f\uac80\uac81\uac82\uac83\uac84\uac85\uac86\uac87\uac88\uac89\uac8a\uac8b\uac8c\uac8d\uac8e\uac8f\uac90\uac91\uac92\uac93\uac94\uac95\uac96\uac97\uac98\uac99\uac9a\uac9b\uac9c\uac9d\uac9e\uac9f\uaca0\uaca1\uaca2\uaca3\uaca4\uaca5\uaca6\uaca7\uaca8\uaca9\uacaa\uacab\uacac\uacad\uacae\uacaf\uacb0\uacb1\uacb2\uacb3\uacb4\uacb5\uacb6\uacb7\uacb8\uacb9\uacba\uacbb\uacbc\uacbd\uacbe\uacbf\uacc0\uacc1\uacc2\uacc3\uacc4\uacc5\uacc6\uacc7\uacc8\uacc9\uacca\uaccb\uaccc\uaccd\uacce\uaccf\uacd0\uacd1\uacd2\uacd3\uacd4\uacd5\uacd6\uacd7\uacd8\uacd9\uacda\uacdb\uacdc\uacdd\uacde\uacdf\uace0\uace1\uace2\uace3\uace4\uace5\uace6\uace7\uace8\uace9\uacea\uaceb\uacec\uaced\uacee\uacef\uacf0\uacf1\uacf2\uacf3\uacf4\uacf5\uacf6\uacf7\uacf8\uacf9\uacfa\uacfb\uacfc\uacfd\uacfe\uacff\uad00\uad01\uad02\uad03\uad04\uad05\uad06\uad07\uad08\uad09\uad0a\uad0b\uad0c\uad0d\uad0e\uad0f\uad10\uad11\uad12\uad13\uad14\uad15\uad16\uad17\uad18\uad19\uad1a\uad1b\uad1c\uad1d\uad1e\uad1f\uad20\uad21\uad22\uad23\uad24\uad25\uad26\uad27\uad28\uad29\uad2a\uad2b\uad2c\uad2d\uad2e\uad2f\uad30\uad31\uad32\uad33\uad34\uad35\uad36\uad37\uad38\uad39\uad3a\uad3b\uad3c\uad3d\uad3e\uad3f\uad40\uad41\uad42\uad43\uad44\uad45\uad46\uad47\uad48\uad49\uad4a\uad4b\uad4c\uad4d\uad4e\uad4f\uad50\uad51\uad52\uad53\uad54\uad55\uad56\uad57\uad58\uad59\uad5a\uad5b\uad5c\uad5d\uad5e\uad5f\uad60\uad61\uad62\uad63\uad64\uad65\uad66\uad67\uad68\uad69\uad6a\uad6b\uad6c\uad6d\uad6e\uad6f\uad70\uad71\uad72\uad73\uad74\uad75\uad76\uad77\uad78\uad79\uad7a\uad7b\uad7c\uad7d\uad7e\uad7f\uad80\uad81\uad82\uad83\uad84\uad85\uad86\uad87\uad88\uad89\uad8a\uad8b\uad8c\uad8d\uad8e\uad8f\uad90\uad91\uad92\uad93\uad94\uad95\uad96\uad97\uad98\uad99\uad9a\uad9b\uad9c\uad9d\uad9e\uad9f\uada0\uada1\uada2\uada3\uada4\uada5\uada6\uada7\uada8\uada9\uadaa\uadab\uadac\uadad\uadae\uadaf\uadb0\uadb1\uadb2\uadb3\uadb4\uadb5\uadb6\uadb7\uadb8\uadb9\uadba\uadbb\uadbc\uadbd\uadbe\uadbf\uadc0\uadc1\uadc2\uadc3\uadc4\uadc5\uadc6\uadc7\uadc8\uadc9\uadca\uadcb\uadcc\uadcd\uadce\uadcf\uadd0\uadd1\uadd2\uadd3\uadd4\uadd5\uadd6\uadd7\uadd8\uadd9\uadda\uaddb\uaddc\uaddd\uadde\uaddf\uade0\uade1\uade2\uade3\uade4\uade5\uade6\uade7\uade8\uade9\uadea\uadeb\uadec\uaded\uadee\uadef\uadf0\uadf1\uadf2\uadf3\uadf4\uadf5\uadf6\uadf7\uadf8\uadf9\uadfa\uadfb\uadfc\uadfd\uadfe\uadff\uae00\uae01\uae02\uae03\uae04\uae05\uae06\uae07\uae08\uae09\uae0a\uae0b\uae0c\uae0d\uae0e\uae0f\uae10\uae11\uae12\uae13\uae14\uae15\uae16\uae17\uae18\uae19\uae1a\uae1b\uae1c\uae1d\uae1e\uae1f\uae20\uae21\uae22\uae23\uae24\uae25\uae26\uae27\uae28\uae29\uae2a\uae2b\uae2c\uae2d\uae2e\uae2f\uae30\uae31\uae32\uae33\uae34\uae35\uae36\uae37\uae38\uae39\uae3a\uae3b\uae3c\uae3d\uae3e\uae3f\uae40\uae41\uae42\uae43\uae44\uae45\uae46\uae47\uae48\uae49\uae4a\uae4b\uae4c\uae4d\uae4e\uae4f\uae50\uae51\uae52\uae53\uae54\uae55\uae56\uae57\uae58\uae59\uae5a\uae5b\uae5c\uae5d\uae5e\uae5f\uae60\uae61\uae62\uae63\uae64\uae65\uae66\uae67\uae68\uae69\uae6a\uae6b\uae6c\uae6d\uae6e\uae6f\uae70\uae71\uae72\uae73\uae74\uae75\uae76\uae77\uae78\uae79\uae7a\uae7b\uae7c\uae7d\uae7e\uae7f\uae80\uae81\uae82\uae83\uae84\uae85\uae86\uae87\uae88\uae89\uae8a\uae8b\uae8c\uae8d\uae8e\uae8f\uae90\uae91\uae92\uae93\uae94\uae95\uae96\uae97\uae98\uae99\uae9a\uae9b\uae9c\uae9d\uae9e\uae9f\uaea0\uaea1\uaea2\uaea3\uaea4\uaea5\uaea6\uaea7\uaea8\uaea9\uaeaa\uaeab\uaeac\uaead\uaeae\uaeaf\uaeb0\uaeb1\uaeb2\uaeb3\uaeb4\uaeb5\uaeb6\uaeb7\uaeb8\uaeb9\uaeba\uaebb\uaebc\uaebd\uaebe\uaebf\uaec0\uaec1\uaec2\uaec3\uaec4\uaec5\uaec6\uaec7\uaec8\uaec9\uaeca\uaecb\uaecc\uaecd\uaece\uaecf\uaed0\uaed1\uaed2\uaed3\uaed4\uaed5\uaed6\uaed7\uaed8\uaed9\uaeda\uaedb\uaedc\uaedd\uaede\uaedf\uaee0\uaee1\uaee2\uaee3\uaee4\uaee5\uaee6\uaee7\uaee8\uaee9\uaeea\uaeeb\uaeec\uaeed\uaeee\uaeef\uaef0\uaef1\uaef2\uaef3\uaef4\uaef5\uaef6\uaef7\uaef8\uaef9\uaefa\uaefb\uaefc\uaefd\uaefe\uaeff\uaf00\uaf01\uaf02\uaf03\uaf04\uaf05\uaf06\uaf07\uaf08\uaf09\uaf0a\uaf0b\uaf0c\uaf0d\uaf0e\uaf0f\uaf10\uaf11\uaf12\uaf13\uaf14\uaf15\uaf16\uaf17\uaf18\uaf19\uaf1a\uaf1b\uaf1c\uaf1d\uaf1e\uaf1f\uaf20\uaf21\uaf22\uaf23\uaf24\uaf25\uaf26\uaf27\uaf28\uaf29\uaf2a\uaf2b\uaf2c\uaf2d\uaf2e\uaf2f\uaf30\uaf31\uaf32\uaf33\uaf34\uaf35\uaf36\uaf37\uaf38\uaf39\uaf3a\uaf3b\uaf3c\uaf3d\uaf3e\uaf3f\uaf40\uaf41\uaf42\uaf43\uaf44\uaf45\uaf46\uaf47\uaf48\uaf49\uaf4a\uaf4b\uaf4c\uaf4d\uaf4e\uaf4f\uaf50\uaf51\uaf52\uaf53\uaf54\uaf55\uaf56\uaf57\uaf58\uaf59\uaf5a\uaf5b\uaf5c\uaf5d\uaf5e\uaf5f\uaf60\uaf61\uaf62\uaf63\uaf64\uaf65\uaf66\uaf67\uaf68\uaf69\uaf6a\uaf6b\uaf6c\uaf6d\uaf6e\uaf6f\uaf70\uaf71\uaf72\uaf73\uaf74\uaf75\uaf76\uaf77\uaf78\uaf79\uaf7a\uaf7b\uaf7c\uaf7d\uaf7e\uaf7f\uaf80\uaf81\uaf82\uaf83\uaf84\uaf85\uaf86\uaf87\uaf88\uaf89\uaf8a\uaf8b\uaf8c\uaf8d\uaf8e\uaf8f\uaf90\uaf91\uaf92\uaf93\uaf94\uaf95\uaf96\uaf97\uaf98\uaf99\uaf9a\uaf9b\uaf9c\uaf9d\uaf9e\uaf9f\uafa0\uafa1\uafa2\uafa3\uafa4\uafa5\uafa6\uafa7\uafa8\uafa9\uafaa\uafab\uafac\uafad\uafae\uafaf\uafb0\uafb1\uafb2\uafb3\uafb4\uafb5\uafb6\uafb7\uafb8\uafb9\uafba\uafbb\uafbc\uafbd\uafbe\uafbf\uafc0\uafc1\uafc2\uafc3\uafc4\uafc5\uafc6\uafc7\uafc8\uafc9\uafca\uafcb\uafcc\uafcd\uafce\uafcf\uafd0\uafd1\uafd2\uafd3\uafd4\uafd5\uafd6\uafd7\uafd8\uafd9\uafda\uafdb\uafdc\uafdd\uafde\uafdf\uafe0\uafe1\uafe2\uafe3\uafe4\uafe5\uafe6\uafe7\uafe8\uafe9\uafea\uafeb\uafec\uafed\uafee\uafef\uaff0\uaff1\uaff2\uaff3\uaff4\uaff5\uaff6\uaff7\uaff8\uaff9\uaffa\uaffb\uaffc\uaffd\uaffe\uafff\ub000\ub001\ub002\ub003\ub004\ub005\ub006\ub007\ub008\ub009\ub00a\ub00b\ub00c\ub00d\ub00e\ub00f\ub010\ub011\ub012\ub013\ub014\ub015\ub016\ub017\ub018\ub019\ub01a\ub01b\ub01c\ub01d\ub01e\ub01f\ub020\ub021\ub022\ub023\ub024\ub025\ub026\ub027\ub028\ub029\ub02a\ub02b\ub02c\ub02d\ub02e\ub02f\ub030\ub031\ub032\ub033\ub034\ub035\ub036\ub037\ub038\ub039\ub03a\ub03b\ub03c\ub03d\ub03e\ub03f\ub040\ub041\ub042\ub043\ub044\ub045\ub046\ub047\ub048\ub049\ub04a\ub04b\ub04c\ub04d\ub04e\ub04f\ub050\ub051\ub052\ub053\ub054\ub055\ub056\ub057\ub058\ub059\ub05a\ub05b\ub05c\ub05d\ub05e\ub05f\ub060\ub061\ub062\ub063\ub064\ub065\ub066\ub067\ub068\ub069\ub06a\ub06b\ub06c\ub06d\ub06e\ub06f\ub070\ub071\ub072\ub073\ub074\ub075\ub076\ub077\ub078\ub079\ub07a\ub07b\ub07c\ub07d\ub07e\ub07f\ub080\ub081\ub082\ub083\ub084\ub085\ub086\ub087\ub088\ub089\ub08a\ub08b\ub08c\ub08d\ub08e\ub08f\ub090\ub091\ub092\ub093\ub094\ub095\ub096\ub097\ub098\ub099\ub09a\ub09b\ub09c\ub09d\ub09e\ub09f\ub0a0\ub0a1\ub0a2\ub0a3\ub0a4\ub0a5\ub0a6\ub0a7\ub0a8\ub0a9\ub0aa\ub0ab\ub0ac\ub0ad\ub0ae\ub0af\ub0b0\ub0b1\ub0b2\ub0b3\ub0b4\ub0b5\ub0b6\ub0b7\ub0b8\ub0b9\ub0ba\ub0bb\ub0bc\ub0bd\ub0be\ub0bf\ub0c0\ub0c1\ub0c2\ub0c3\ub0c4\ub0c5\ub0c6\ub0c7\ub0c8\ub0c9\ub0ca\ub0cb\ub0cc\ub0cd\ub0ce\ub0cf\ub0d0\ub0d1\ub0d2\ub0d3\ub0d4\ub0d5\ub0d6\ub0d7\ub0d8\ub0d9\ub0da\ub0db\ub0dc\ub0dd\ub0de\ub0df\ub0e0\ub0e1\ub0e2\ub0e3\ub0e4\ub0e5\ub0e6\ub0e7\ub0e8\ub0e9\ub0ea\ub0eb\ub0ec\ub0ed\ub0ee\ub0ef\ub0f0\ub0f1\ub0f2\ub0f3\ub0f4\ub0f5\ub0f6\ub0f7\ub0f8\ub0f9\ub0fa\ub0fb\ub0fc\ub0fd\ub0fe\ub0ff\ub100\ub101\ub102\ub103\ub104\ub105\ub106\ub107\ub108\ub109\ub10a\ub10b\ub10c\ub10d\ub10e\ub10f\ub110\ub111\ub112\ub113\ub114\ub115\ub116\ub117\ub118\ub119\ub11a\ub11b\ub11c\ub11d\ub11e\ub11f\ub120\ub121\ub122\ub123\ub124\ub125\ub126\ub127\ub128\ub129\ub12a\ub12b\ub12c\ub12d\ub12e\ub12f\ub130\ub131\ub132\ub133\ub134\ub135\ub136\ub137\ub138\ub139\ub13a\ub13b\ub13c\ub13d\ub13e\ub13f\ub140\ub141\ub142\ub143\ub144\ub145\ub146\ub147\ub148\ub149\ub14a\ub14b\ub14c\ub14d\ub14e\ub14f\ub150\ub151\ub152\ub153\ub154\ub155\ub156\ub157\ub158\ub159\ub15a\ub15b\ub15c\ub15d\ub15e\ub15f\ub160\ub161\ub162\ub163\ub164\ub165\ub166\ub167\ub168\ub169\ub16a\ub16b\ub16c\ub16d\ub16e\ub16f\ub170\ub171\ub172\ub173\ub174\ub175\ub176\ub177\ub178\ub179\ub17a\ub17b\ub17c\ub17d\ub17e\ub17f\ub180\ub181\ub182\ub183\ub184\ub185\ub186\ub187\ub188\ub189\ub18a\ub18b\ub18c\ub18d\ub18e\ub18f\ub190\ub191\ub192\ub193\ub194\ub195\ub196\ub197\ub198\ub199\ub19a\ub19b\ub19c\ub19d\ub19e\ub19f\ub1a0\ub1a1\ub1a2\ub1a3\ub1a4\ub1a5\ub1a6\ub1a7\ub1a8\ub1a9\ub1aa\ub1ab\ub1ac\ub1ad\ub1ae\ub1af\ub1b0\ub1b1\ub1b2\ub1b3\ub1b4\ub1b5\ub1b6\ub1b7\ub1b8\ub1b9\ub1ba\ub1bb\ub1bc\ub1bd\ub1be\ub1bf\ub1c0\ub1c1\ub1c2\ub1c3\ub1c4\ub1c5\ub1c6\ub1c7\ub1c8\ub1c9\ub1ca\ub1cb\ub1cc\ub1cd\ub1ce\ub1cf\ub1d0\ub1d1\ub1d2\ub1d3\ub1d4\ub1d5\ub1d6\ub1d7\ub1d8\ub1d9\ub1da\ub1db\ub1dc\ub1dd\ub1de\ub1df\ub1e0\ub1e1\ub1e2\ub1e3\ub1e4\ub1e5\ub1e6\ub1e7\ub1e8\ub1e9\ub1ea\ub1eb\ub1ec\ub1ed\ub1ee\ub1ef\ub1f0\ub1f1\ub1f2\ub1f3\ub1f4\ub1f5\ub1f6\ub1f7\ub1f8\ub1f9\ub1fa\ub1fb\ub1fc\ub1fd\ub1fe\ub1ff\ub200\ub201\ub202\ub203\ub204\ub205\ub206\ub207\ub208\ub209\ub20a\ub20b\ub20c\ub20d\ub20e\ub20f\ub210\ub211\ub212\ub213\ub214\ub215\ub216\ub217\ub218\ub219\ub21a\ub21b\ub21c\ub21d\ub21e\ub21f\ub220\ub221\ub222\ub223\ub224\ub225\ub226\ub227\ub228\ub229\ub22a\ub22b\ub22c\ub22d\ub22e\ub22f\ub230\ub231\ub232\ub233\ub234\ub235\ub236\ub237\ub238\ub239\ub23a\ub23b\ub23c\ub23d\ub23e\ub23f\ub240\ub241\ub242\ub243\ub244\ub245\ub246\ub247\ub248\ub249\ub24a\ub24b\ub24c\ub24d\ub24e\ub24f\ub250\ub251\ub252\ub253\ub254\ub255\ub256\ub257\ub258\ub259\ub25a\ub25b\ub25c\ub25d\ub25e\ub25f\ub260\ub261\ub262\ub263\ub264\ub265\ub266\ub267\ub268\ub269\ub26a\ub26b\ub26c\ub26d\ub26e\ub26f\ub270\ub271\ub272\ub273\ub274\ub275\ub276\ub277\ub278\ub279\ub27a\ub27b\ub27c\ub27d\ub27e\ub27f\ub280\ub281\ub282\ub283\ub284\ub285\ub286\ub287\ub288\ub289\ub28a\ub28b\ub28c\ub28d\ub28e\ub28f\ub290\ub291\ub292\ub293\ub294\ub295\ub296\ub297\ub298\ub299\ub29a\ub29b\ub29c\ub29d\ub29e\ub29f\ub2a0\ub2a1\ub2a2\ub2a3\ub2a4\ub2a5\ub2a6\ub2a7\ub2a8\ub2a9\ub2aa\ub2ab\ub2ac\ub2ad\ub2ae\ub2af\ub2b0\ub2b1\ub2b2\ub2b3\ub2b4\ub2b5\ub2b6\ub2b7\ub2b8\ub2b9\ub2ba\ub2bb\ub2bc\ub2bd\ub2be\ub2bf\ub2c0\ub2c1\ub2c2\ub2c3\ub2c4\ub2c5\ub2c6\ub2c7\ub2c8\ub2c9\ub2ca\ub2cb\ub2cc\ub2cd\ub2ce\ub2cf\ub2d0\ub2d1\ub2d2\ub2d3\ub2d4\ub2d5\ub2d6\ub2d7\ub2d8\ub2d9\ub2da\ub2db\ub2dc\ub2dd\ub2de\ub2df\ub2e0\ub2e1\ub2e2\ub2e3\ub2e4\ub2e5\ub2e6\ub2e7\ub2e8\ub2e9\ub2ea\ub2eb\ub2ec\ub2ed\ub2ee\ub2ef\ub2f0\ub2f1\ub2f2\ub2f3\ub2f4\ub2f5\ub2f6\ub2f7\ub2f8\ub2f9\ub2fa\ub2fb\ub2fc\ub2fd\ub2fe\ub2ff\ub300\ub301\ub302\ub303\ub304\ub305\ub306\ub307\ub308\ub309\ub30a\ub30b\ub30c\ub30d\ub30e\ub30f\ub310\ub311\ub312\ub313\ub314\ub315\ub316\ub317\ub318\ub319\ub31a\ub31b\ub31c\ub31d\ub31e\ub31f\ub320\ub321\ub322\ub323\ub324\ub325\ub326\ub327\ub328\ub329\ub32a\ub32b\ub32c\ub32d\ub32e\ub32f\ub330\ub331\ub332\ub333\ub334\ub335\ub336\ub337\ub338\ub339\ub33a\ub33b\ub33c\ub33d\ub33e\ub33f\ub340\ub341\ub342\ub343\ub344\ub345\ub346\ub347\ub348\ub349\ub34a\ub34b\ub34c\ub34d\ub34e\ub34f\ub350\ub351\ub352\ub353\ub354\ub355\ub356\ub357\ub358\ub359\ub35a\ub35b\ub35c\ub35d\ub35e\ub35f\ub360\ub361\ub362\ub363\ub364\ub365\ub366\ub367\ub368\ub369\ub36a\ub36b\ub36c\ub36d\ub36e\ub36f\ub370\ub371\ub372\ub373\ub374\ub375\ub376\ub377\ub378\ub379\ub37a\ub37b\ub37c\ub37d\ub37e\ub37f\ub380\ub381\ub382\ub383\ub384\ub385\ub386\ub387\ub388\ub389\ub38a\ub38b\ub38c\ub38d\ub38e\ub38f\ub390\ub391\ub392\ub393\ub394\ub395\ub396\ub397\ub398\ub399\ub39a\ub39b\ub39c\ub39d\ub39e\ub39f\ub3a0\ub3a1\ub3a2\ub3a3\ub3a4\ub3a5\ub3a6\ub3a7\ub3a8\ub3a9\ub3aa\ub3ab\ub3ac\ub3ad\ub3ae\ub3af\ub3b0\ub3b1\ub3b2\ub3b3\ub3b4\ub3b5\ub3b6\ub3b7\ub3b8\ub3b9\ub3ba\ub3bb\ub3bc\ub3bd\ub3be\ub3bf\ub3c0\ub3c1\ub3c2\ub3c3\ub3c4\ub3c5\ub3c6\ub3c7\ub3c8\ub3c9\ub3ca\ub3cb\ub3cc\ub3cd\ub3ce\ub3cf\ub3d0\ub3d1\ub3d2\ub3d3\ub3d4\ub3d5\ub3d6\ub3d7\ub3d8\ub3d9\ub3da\ub3db\ub3dc\ub3dd\ub3de\ub3df\ub3e0\ub3e1\ub3e2\ub3e3\ub3e4\ub3e5\ub3e6\ub3e7\ub3e8\ub3e9\ub3ea\ub3eb\ub3ec\ub3ed\ub3ee\ub3ef\ub3f0\ub3f1\ub3f2\ub3f3\ub3f4\ub3f5\ub3f6\ub3f7\ub3f8\ub3f9\ub3fa\ub3fb\ub3fc\ub3fd\ub3fe\ub3ff\ub400\ub401\ub402\ub403\ub404\ub405\ub406\ub407\ub408\ub409\ub40a\ub40b\ub40c\ub40d\ub40e\ub40f\ub410\ub411\ub412\ub413\ub414\ub415\ub416\ub417\ub418\ub419\ub41a\ub41b\ub41c\ub41d\ub41e\ub41f\ub420\ub421\ub422\ub423\ub424\ub425\ub426\ub427\ub428\ub429\ub42a\ub42b\ub42c\ub42d\ub42e\ub42f\ub430\ub431\ub432\ub433\ub434\ub435\ub436\ub437\ub438\ub439\ub43a\ub43b\ub43c\ub43d\ub43e\ub43f\ub440\ub441\ub442\ub443\ub444\ub445\ub446\ub447\ub448\ub449\ub44a\ub44b\ub44c\ub44d\ub44e\ub44f\ub450\ub451\ub452\ub453\ub454\ub455\ub456\ub457\ub458\ub459\ub45a\ub45b\ub45c\ub45d\ub45e\ub45f\ub460\ub461\ub462\ub463\ub464\ub465\ub466\ub467\ub468\ub469\ub46a\ub46b\ub46c\ub46d\ub46e\ub46f\ub470\ub471\ub472\ub473\ub474\ub475\ub476\ub477\ub478\ub479\ub47a\ub47b\ub47c\ub47d\ub47e\ub47f\ub480\ub481\ub482\ub483\ub484\ub485\ub486\ub487\ub488\ub489\ub48a\ub48b\ub48c\ub48d\ub48e\ub48f\ub490\ub491\ub492\ub493\ub494\ub495\ub496\ub497\ub498\ub499\ub49a\ub49b\ub49c\ub49d\ub49e\ub49f\ub4a0\ub4a1\ub4a2\ub4a3\ub4a4\ub4a5\ub4a6\ub4a7\ub4a8\ub4a9\ub4aa\ub4ab\ub4ac\ub4ad\ub4ae\ub4af\ub4b0\ub4b1\ub4b2\ub4b3\ub4b4\ub4b5\ub4b6\ub4b7\ub4b8\ub4b9\ub4ba\ub4bb\ub4bc\ub4bd\ub4be\ub4bf\ub4c0\ub4c1\ub4c2\ub4c3\ub4c4\ub4c5\ub4c6\ub4c7\ub4c8\ub4c9\ub4ca\ub4cb\ub4cc\ub4cd\ub4ce\ub4cf\ub4d0\ub4d1\ub4d2\ub4d3\ub4d4\ub4d5\ub4d6\ub4d7\ub4d8\ub4d9\ub4da\ub4db\ub4dc\ub4dd\ub4de\ub4df\ub4e0\ub4e1\ub4e2\ub4e3\ub4e4\ub4e5\ub4e6\ub4e7\ub4e8\ub4e9\ub4ea\ub4eb\ub4ec\ub4ed\ub4ee\ub4ef\ub4f0\ub4f1\ub4f2\ub4f3\ub4f4\ub4f5\ub4f6\ub4f7\ub4f8\ub4f9\ub4fa\ub4fb\ub4fc\ub4fd\ub4fe\ub4ff\ub500\ub501\ub502\ub503\ub504\ub505\ub506\ub507\ub508\ub509\ub50a\ub50b\ub50c\ub50d\ub50e\ub50f\ub510\ub511\ub512\ub513\ub514\ub515\ub516\ub517\ub518\ub519\ub51a\ub51b\ub51c\ub51d\ub51e\ub51f\ub520\ub521\ub522\ub523\ub524\ub525\ub526\ub527\ub528\ub529\ub52a\ub52b\ub52c\ub52d\ub52e\ub52f\ub530\ub531\ub532\ub533\ub534\ub535\ub536\ub537\ub538\ub539\ub53a\ub53b\ub53c\ub53d\ub53e\ub53f\ub540\ub541\ub542\ub543\ub544\ub545\ub546\ub547\ub548\ub549\ub54a\ub54b\ub54c\ub54d\ub54e\ub54f\ub550\ub551\ub552\ub553\ub554\ub555\ub556\ub557\ub558\ub559\ub55a\ub55b\ub55c\ub55d\ub55e\ub55f\ub560\ub561\ub562\ub563\ub564\ub565\ub566\ub567\ub568\ub569\ub56a\ub56b\ub56c\ub56d\ub56e\ub56f\ub570\ub571\ub572\ub573\ub574\ub575\ub576\ub577\ub578\ub579\ub57a\ub57b\ub57c\ub57d\ub57e\ub57f\ub580\ub581\ub582\ub583\ub584\ub585\ub586\ub587\ub588\ub589\ub58a\ub58b\ub58c\ub58d\ub58e\ub58f\ub590\ub591\ub592\ub593\ub594\ub595\ub596\ub597\ub598\ub599\ub59a\ub59b\ub59c\ub59d\ub59e\ub59f\ub5a0\ub5a1\ub5a2\ub5a3\ub5a4\ub5a5\ub5a6\ub5a7\ub5a8\ub5a9\ub5aa\ub5ab\ub5ac\ub5ad\ub5ae\ub5af\ub5b0\ub5b1\ub5b2\ub5b3\ub5b4\ub5b5\ub5b6\ub5b7\ub5b8\ub5b9\ub5ba\ub5bb\ub5bc\ub5bd\ub5be\ub5bf\ub5c0\ub5c1\ub5c2\ub5c3\ub5c4\ub5c5\ub5c6\ub5c7\ub5c8\ub5c9\ub5ca\ub5cb\ub5cc\ub5cd\ub5ce\ub5cf\ub5d0\ub5d1\ub5d2\ub5d3\ub5d4\ub5d5\ub5d6\ub5d7\ub5d8\ub5d9\ub5da\ub5db\ub5dc\ub5dd\ub5de\ub5df\ub5e0\ub5e1\ub5e2\ub5e3\ub5e4\ub5e5\ub5e6\ub5e7\ub5e8\ub5e9\ub5ea\ub5eb\ub5ec\ub5ed\ub5ee\ub5ef\ub5f0\ub5f1\ub5f2\ub5f3\ub5f4\ub5f5\ub5f6\ub5f7\ub5f8\ub5f9\ub5fa\ub5fb\ub5fc\ub5fd\ub5fe\ub5ff\ub600\ub601\ub602\ub603\ub604\ub605\ub606\ub607\ub608\ub609\ub60a\ub60b\ub60c\ub60d\ub60e\ub60f\ub610\ub611\ub612\ub613\ub614\ub615\ub616\ub617\ub618\ub619\ub61a\ub61b\ub61c\ub61d\ub61e\ub61f\ub620\ub621\ub622\ub623\ub624\ub625\ub626\ub627\ub628\ub629\ub62a\ub62b\ub62c\ub62d\ub62e\ub62f\ub630\ub631\ub632\ub633\ub634\ub635\ub636\ub637\ub638\ub639\ub63a\ub63b\ub63c\ub63d\ub63e\ub63f\ub640\ub641\ub642\ub643\ub644\ub645\ub646\ub647\ub648\ub649\ub64a\ub64b\ub64c\ub64d\ub64e\ub64f\ub650\ub651\ub652\ub653\ub654\ub655\ub656\ub657\ub658\ub659\ub65a\ub65b\ub65c\ub65d\ub65e\ub65f\ub660\ub661\ub662\ub663\ub664\ub665\ub666\ub667\ub668\ub669\ub66a\ub66b\ub66c\ub66d\ub66e\ub66f\ub670\ub671\ub672\ub673\ub674\ub675\ub676\ub677\ub678\ub679\ub67a\ub67b\ub67c\ub67d\ub67e\ub67f\ub680\ub681\ub682\ub683\ub684\ub685\ub686\ub687\ub688\ub689\ub68a\ub68b\ub68c\ub68d\ub68e\ub68f\ub690\ub691\ub692\ub693\ub694\ub695\ub696\ub697\ub698\ub699\ub69a\ub69b\ub69c\ub69d\ub69e\ub69f\ub6a0\ub6a1\ub6a2\ub6a3\ub6a4\ub6a5\ub6a6\ub6a7\ub6a8\ub6a9\ub6aa\ub6ab\ub6ac\ub6ad\ub6ae\ub6af\ub6b0\ub6b1\ub6b2\ub6b3\ub6b4\ub6b5\ub6b6\ub6b7\ub6b8\ub6b9\ub6ba\ub6bb\ub6bc\ub6bd\ub6be\ub6bf\ub6c0\ub6c1\ub6c2\ub6c3\ub6c4\ub6c5\ub6c6\ub6c7\ub6c8\ub6c9\ub6ca\ub6cb\ub6cc\ub6cd\ub6ce\ub6cf\ub6d0\ub6d1\ub6d2\ub6d3\ub6d4\ub6d5\ub6d6\ub6d7\ub6d8\ub6d9\ub6da\ub6db\ub6dc\ub6dd\ub6de\ub6df\ub6e0\ub6e1\ub6e2\ub6e3\ub6e4\ub6e5\ub6e6\ub6e7\ub6e8\ub6e9\ub6ea\ub6eb\ub6ec\ub6ed\ub6ee\ub6ef\ub6f0\ub6f1\ub6f2\ub6f3\ub6f4\ub6f5\ub6f6\ub6f7\ub6f8\ub6f9\ub6fa\ub6fb\ub6fc\ub6fd\ub6fe\ub6ff\ub700\ub701\ub702\ub703\ub704\ub705\ub706\ub707\ub708\ub709\ub70a\ub70b\ub70c\ub70d\ub70e\ub70f\ub710\ub711\ub712\ub713\ub714\ub715\ub716\ub717\ub718\ub719\ub71a\ub71b\ub71c\ub71d\ub71e\ub71f\ub720\ub721\ub722\ub723\ub724\ub725\ub726\ub727\ub728\ub729\ub72a\ub72b\ub72c\ub72d\ub72e\ub72f\ub730\ub731\ub732\ub733\ub734\ub735\ub736\ub737\ub738\ub739\ub73a\ub73b\ub73c\ub73d\ub73e\ub73f\ub740\ub741\ub742\ub743\ub744\ub745\ub746\ub747\ub748\ub749\ub74a\ub74b\ub74c\ub74d\ub74e\ub74f\ub750\ub751\ub752\ub753\ub754\ub755\ub756\ub757\ub758\ub759\ub75a\ub75b\ub75c\ub75d\ub75e\ub75f\ub760\ub761\ub762\ub763\ub764\ub765\ub766\ub767\ub768\ub769\ub76a\ub76b\ub76c\ub76d\ub76e\ub76f\ub770\ub771\ub772\ub773\ub774\ub775\ub776\ub777\ub778\ub779\ub77a\ub77b\ub77c\ub77d\ub77e\ub77f\ub780\ub781\ub782\ub783\ub784\ub785\ub786\ub787\ub788\ub789\ub78a\ub78b\ub78c\ub78d\ub78e\ub78f\ub790\ub791\ub792\ub793\ub794\ub795\ub796\ub797\ub798\ub799\ub79a\ub79b\ub79c\ub79d\ub79e\ub79f\ub7a0\ub7a1\ub7a2\ub7a3\ub7a4\ub7a5\ub7a6\ub7a7\ub7a8\ub7a9\ub7aa\ub7ab\ub7ac\ub7ad\ub7ae\ub7af\ub7b0\ub7b1\ub7b2\ub7b3\ub7b4\ub7b5\ub7b6\ub7b7\ub7b8\ub7b9\ub7ba\ub7bb\ub7bc\ub7bd\ub7be\ub7bf\ub7c0\ub7c1\ub7c2\ub7c3\ub7c4\ub7c5\ub7c6\ub7c7\ub7c8\ub7c9\ub7ca\ub7cb\ub7cc\ub7cd\ub7ce\ub7cf\ub7d0\ub7d1\ub7d2\ub7d3\ub7d4\ub7d5\ub7d6\ub7d7\ub7d8\ub7d9\ub7da\ub7db\ub7dc\ub7dd\ub7de\ub7df\ub7e0\ub7e1\ub7e2\ub7e3\ub7e4\ub7e5\ub7e6\ub7e7\ub7e8\ub7e9\ub7ea\ub7eb\ub7ec\ub7ed\ub7ee\ub7ef\ub7f0\ub7f1\ub7f2\ub7f3\ub7f4\ub7f5\ub7f6\ub7f7\ub7f8\ub7f9\ub7fa\ub7fb\ub7fc\ub7fd\ub7fe\ub7ff\ub800\ub801\ub802\ub803\ub804\ub805\ub806\ub807\ub808\ub809\ub80a\ub80b\ub80c\ub80d\ub80e\ub80f\ub810\ub811\ub812\ub813\ub814\ub815\ub816\ub817\ub818\ub819\ub81a\ub81b\ub81c\ub81d\ub81e\ub81f\ub820\ub821\ub822\ub823\ub824\ub825\ub826\ub827\ub828\ub829\ub82a\ub82b\ub82c\ub82d\ub82e\ub82f\ub830\ub831\ub832\ub833\ub834\ub835\ub836\ub837\ub838\ub839\ub83a\ub83b\ub83c\ub83d\ub83e\ub83f\ub840\ub841\ub842\ub843\ub844\ub845\ub846\ub847\ub848\ub849\ub84a\ub84b\ub84c\ub84d\ub84e\ub84f\ub850\ub851\ub852\ub853\ub854\ub855\ub856\ub857\ub858\ub859\ub85a\ub85b\ub85c\ub85d\ub85e\ub85f\ub860\ub861\ub862\ub863\ub864\ub865\ub866\ub867\ub868\ub869\ub86a\ub86b\ub86c\ub86d\ub86e\ub86f\ub870\ub871\ub872\ub873\ub874\ub875\ub876\ub877\ub878\ub879\ub87a\ub87b\ub87c\ub87d\ub87e\ub87f\ub880\ub881\ub882\ub883\ub884\ub885\ub886\ub887\ub888\ub889\ub88a\ub88b\ub88c\ub88d\ub88e\ub88f\ub890\ub891\ub892\ub893\ub894\ub895\ub896\ub897\ub898\ub899\ub89a\ub89b\ub89c\ub89d\ub89e\ub89f\ub8a0\ub8a1\ub8a2\ub8a3\ub8a4\ub8a5\ub8a6\ub8a7\ub8a8\ub8a9\ub8aa\ub8ab\ub8ac\ub8ad\ub8ae\ub8af\ub8b0\ub8b1\ub8b2\ub8b3\ub8b4\ub8b5\ub8b6\ub8b7\ub8b8\ub8b9\ub8ba\ub8bb\ub8bc\ub8bd\ub8be\ub8bf\ub8c0\ub8c1\ub8c2\ub8c3\ub8c4\ub8c5\ub8c6\ub8c7\ub8c8\ub8c9\ub8ca\ub8cb\ub8cc\ub8cd\ub8ce\ub8cf\ub8d0\ub8d1\ub8d2\ub8d3\ub8d4\ub8d5\ub8d6\ub8d7\ub8d8\ub8d9\ub8da\ub8db\ub8dc\ub8dd\ub8de\ub8df\ub8e0\ub8e1\ub8e2\ub8e3\ub8e4\ub8e5\ub8e6\ub8e7\ub8e8\ub8e9\ub8ea\ub8eb\ub8ec\ub8ed\ub8ee\ub8ef\ub8f0\ub8f1\ub8f2\ub8f3\ub8f4\ub8f5\ub8f6\ub8f7\ub8f8\ub8f9\ub8fa\ub8fb\ub8fc\ub8fd\ub8fe\ub8ff\ub900\ub901\ub902\ub903\ub904\ub905\ub906\ub907\ub908\ub909\ub90a\ub90b\ub90c\ub90d\ub90e\ub90f\ub910\ub911\ub912\ub913\ub914\ub915\ub916\ub917\ub918\ub919\ub91a\ub91b\ub91c\ub91d\ub91e\ub91f\ub920\ub921\ub922\ub923\ub924\ub925\ub926\ub927\ub928\ub929\ub92a\ub92b\ub92c\ub92d\ub92e\ub92f\ub930\ub931\ub932\ub933\ub934\ub935\ub936\ub937\ub938\ub939\ub93a\ub93b\ub93c\ub93d\ub93e\ub93f\ub940\ub941\ub942\ub943\ub944\ub945\ub946\ub947\ub948\ub949\ub94a\ub94b\ub94c\ub94d\ub94e\ub94f\ub950\ub951\ub952\ub953\ub954\ub955\ub956\ub957\ub958\ub959\ub95a\ub95b\ub95c\ub95d\ub95e\ub95f\ub960\ub961\ub962\ub963\ub964\ub965\ub966\ub967\ub968\ub969\ub96a\ub96b\ub96c\ub96d\ub96e\ub96f\ub970\ub971\ub972\ub973\ub974\ub975\ub976\ub977\ub978\ub979\ub97a\ub97b\ub97c\ub97d\ub97e\ub97f\ub980\ub981\ub982\ub983\ub984\ub985\ub986\ub987\ub988\ub989\ub98a\ub98b\ub98c\ub98d\ub98e\ub98f\ub990\ub991\ub992\ub993\ub994\ub995\ub996\ub997\ub998\ub999\ub99a\ub99b\ub99c\ub99d\ub99e\ub99f\ub9a0\ub9a1\ub9a2\ub9a3\ub9a4\ub9a5\ub9a6\ub9a7\ub9a8\ub9a9\ub9aa\ub9ab\ub9ac\ub9ad\ub9ae\ub9af\ub9b0\ub9b1\ub9b2\ub9b3\ub9b4\ub9b5\ub9b6\ub9b7\ub9b8\ub9b9\ub9ba\ub9bb\ub9bc\ub9bd\ub9be\ub9bf\ub9c0\ub9c1\ub9c2\ub9c3\ub9c4\ub9c5\ub9c6\ub9c7\ub9c8\ub9c9\ub9ca\ub9cb\ub9cc\ub9cd\ub9ce\ub9cf\ub9d0\ub9d1\ub9d2\ub9d3\ub9d4\ub9d5\ub9d6\ub9d7\ub9d8\ub9d9\ub9da\ub9db\ub9dc\ub9dd\ub9de\ub9df\ub9e0\ub9e1\ub9e2\ub9e3\ub9e4\ub9e5\ub9e6\ub9e7\ub9e8\ub9e9\ub9ea\ub9eb\ub9ec\ub9ed\ub9ee\ub9ef\ub9f0\ub9f1\ub9f2\ub9f3\ub9f4\ub9f5\ub9f6\ub9f7\ub9f8\ub9f9\ub9fa\ub9fb\ub9fc\ub9fd\ub9fe\ub9ff\uba00\uba01\uba02\uba03\uba04\uba05\uba06\uba07\uba08\uba09\uba0a\uba0b\uba0c\uba0d\uba0e\uba0f\uba10\uba11\uba12\uba13\uba14\uba15\uba16\uba17\uba18\uba19\uba1a\uba1b\uba1c\uba1d\uba1e\uba1f\uba20\uba21\uba22\uba23\uba24\uba25\uba26\uba27\uba28\uba29\uba2a\uba2b\uba2c\uba2d\uba2e\uba2f\uba30\uba31\uba32\uba33\uba34\uba35\uba36\uba37\uba38\uba39\uba3a\uba3b\uba3c\uba3d\uba3e\uba3f\uba40\uba41\uba42\uba43\uba44\uba45\uba46\uba47\uba48\uba49\uba4a\uba4b\uba4c\uba4d\uba4e\uba4f\uba50\uba51\uba52\uba53\uba54\uba55\uba56\uba57\uba58\uba59\uba5a\uba5b\uba5c\uba5d\uba5e\uba5f\uba60\uba61\uba62\uba63\uba64\uba65\uba66\uba67\uba68\uba69\uba6a\uba6b\uba6c\uba6d\uba6e\uba6f\uba70\uba71\uba72\uba73\uba74\uba75\uba76\uba77\uba78\uba79\uba7a\uba7b\uba7c\uba7d\uba7e\uba7f\uba80\uba81\uba82\uba83\uba84\uba85\uba86\uba87\uba88\uba89\uba8a\uba8b\uba8c\uba8d\uba8e\uba8f\uba90\uba91\uba92\uba93\uba94\uba95\uba96\uba97\uba98\uba99\uba9a\uba9b\uba9c\uba9d\uba9e\uba9f\ubaa0\ubaa1\ubaa2\ubaa3\ubaa4\ubaa5\ubaa6\ubaa7\ubaa8\ubaa9\ubaaa\ubaab\ubaac\ubaad\ubaae\ubaaf\ubab0\ubab1\ubab2\ubab3\ubab4\ubab5\ubab6\ubab7\ubab8\ubab9\ubaba\ubabb\ubabc\ubabd\ubabe\ubabf\ubac0\ubac1\ubac2\ubac3\ubac4\ubac5\ubac6\ubac7\ubac8\ubac9\ubaca\ubacb\ubacc\ubacd\ubace\ubacf\ubad0\ubad1\ubad2\ubad3\ubad4\ubad5\ubad6\ubad7\ubad8\ubad9\ubada\ubadb\ubadc\ubadd\ubade\ubadf\ubae0\ubae1\ubae2\ubae3\ubae4\ubae5\ubae6\ubae7\ubae8\ubae9\ubaea\ubaeb\ubaec\ubaed\ubaee\ubaef\ubaf0\ubaf1\ubaf2\ubaf3\ubaf4\ubaf5\ubaf6\ubaf7\ubaf8\ubaf9\ubafa\ubafb\ubafc\ubafd\ubafe\ubaff\ubb00\ubb01\ubb02\ubb03\ubb04\ubb05\ubb06\ubb07\ubb08\ubb09\ubb0a\ubb0b\ubb0c\ubb0d\ubb0e\ubb0f\ubb10\ubb11\ubb12\ubb13\ubb14\ubb15\ubb16\ubb17\ubb18\ubb19\ubb1a\ubb1b\ubb1c\ubb1d\ubb1e\ubb1f\ubb20\ubb21\ubb22\ubb23\ubb24\ubb25\ubb26\ubb27\ubb28\ubb29\ubb2a\ubb2b\ubb2c\ubb2d\ubb2e\ubb2f\ubb30\ubb31\ubb32\ubb33\ubb34\ubb35\ubb36\ubb37\ubb38\ubb39\ubb3a\ubb3b\ubb3c\ubb3d\ubb3e\ubb3f\ubb40\ubb41\ubb42\ubb43\ubb44\ubb45\ubb46\ubb47\ubb48\ubb49\ubb4a\ubb4b\ubb4c\ubb4d\ubb4e\ubb4f\ubb50\ubb51\ubb52\ubb53\ubb54\ubb55\ubb56\ubb57\ubb58\ubb59\ubb5a\ubb5b\ubb5c\ubb5d\ubb5e\ubb5f\ubb60\ubb61\ubb62\ubb63\ubb64\ubb65\ubb66\ubb67\ubb68\ubb69\ubb6a\ubb6b\ubb6c\ubb6d\ubb6e\ubb6f\ubb70\ubb71\ubb72\ubb73\ubb74\ubb75\ubb76\ubb77\ubb78\ubb79\ubb7a\ubb7b\ubb7c\ubb7d\ubb7e\ubb7f\ubb80\ubb81\ubb82\ubb83\ubb84\ubb85\ubb86\ubb87\ubb88\ubb89\ubb8a\ubb8b\ubb8c\ubb8d\ubb8e\ubb8f\ubb90\ubb91\ubb92\ubb93\ubb94\ubb95\ubb96\ubb97\ubb98\ubb99\ubb9a\ubb9b\ubb9c\ubb9d\ubb9e\ubb9f\ubba0\ubba1\ubba2\ubba3\ubba4\ubba5\ubba6\ubba7\ubba8\ubba9\ubbaa\ubbab\ubbac\ubbad\ubbae\ubbaf\ubbb0\ubbb1\ubbb2\ubbb3\ubbb4\ubbb5\ubbb6\ubbb7\ubbb8\ubbb9\ubbba\ubbbb\ubbbc\ubbbd\ubbbe\ubbbf\ubbc0\ubbc1\ubbc2\ubbc3\ubbc4\ubbc5\ubbc6\ubbc7\ubbc8\ubbc9\ubbca\ubbcb\ubbcc\ubbcd\ubbce\ubbcf\ubbd0\ubbd1\ubbd2\ubbd3\ubbd4\ubbd5\ubbd6\ubbd7\ubbd8\ubbd9\ubbda\ubbdb\ubbdc\ubbdd\ubbde\ubbdf\ubbe0\ubbe1\ubbe2\ubbe3\ubbe4\ubbe5\ubbe6\ubbe7\ubbe8\ubbe9\ubbea\ubbeb\ubbec\ubbed\ubbee\ubbef\ubbf0\ubbf1\ubbf2\ubbf3\ubbf4\ubbf5\ubbf6\ubbf7\ubbf8\ubbf9\ubbfa\ubbfb\ubbfc\ubbfd\ubbfe\ubbff\ubc00\ubc01\ubc02\ubc03\ubc04\ubc05\ubc06\ubc07\ubc08\ubc09\ubc0a\ubc0b\ubc0c\ubc0d\ubc0e\ubc0f\ubc10\ubc11\ubc12\ubc13\ubc14\ubc15\ubc16\ubc17\ubc18\ubc19\ubc1a\ubc1b\ubc1c\ubc1d\ubc1e\ubc1f\ubc20\ubc21\ubc22\ubc23\ubc24\ubc25\ubc26\ubc27\ubc28\ubc29\ubc2a\ubc2b\ubc2c\ubc2d\ubc2e\ubc2f\ubc30\ubc31\ubc32\ubc33\ubc34\ubc35\ubc36\ubc37\ubc38\ubc39\ubc3a\ubc3b\ubc3c\ubc3d\ubc3e\ubc3f\ubc40\ubc41\ubc42\ubc43\ubc44\ubc45\ubc46\ubc47\ubc48\ubc49\ubc4a\ubc4b\ubc4c\ubc4d\ubc4e\ubc4f\ubc50\ubc51\ubc52\ubc53\ubc54\ubc55\ubc56\ubc57\ubc58\ubc59\ubc5a\ubc5b\ubc5c\ubc5d\ubc5e\ubc5f\ubc60\ubc61\ubc62\ubc63\ubc64\ubc65\ubc66\ubc67\ubc68\ubc69\ubc6a\ubc6b\ubc6c\ubc6d\ubc6e\ubc6f\ubc70\ubc71\ubc72\ubc73\ubc74\ubc75\ubc76\ubc77\ubc78\ubc79\ubc7a\ubc7b\ubc7c\ubc7d\ubc7e\ubc7f\ubc80\ubc81\ubc82\ubc83\ubc84\ubc85\ubc86\ubc87\ubc88\ubc89\ubc8a\ubc8b\ubc8c\ubc8d\ubc8e\ubc8f\ubc90\ubc91\ubc92\ubc93\ubc94\ubc95\ubc96\ubc97\ubc98\ubc99\ubc9a\ubc9b\ubc9c\ubc9d\ubc9e\ubc9f\ubca0\ubca1\ubca2\ubca3\ubca4\ubca5\ubca6\ubca7\ubca8\ubca9\ubcaa\ubcab\ubcac\ubcad\ubcae\ubcaf\ubcb0\ubcb1\ubcb2\ubcb3\ubcb4\ubcb5\ubcb6\ubcb7\ubcb8\ubcb9\ubcba\ubcbb\ubcbc\ubcbd\ubcbe\ubcbf\ubcc0\ubcc1\ubcc2\ubcc3\ubcc4\ubcc5\ubcc6\ubcc7\ubcc8\ubcc9\ubcca\ubccb\ubccc\ubccd\ubcce\ubccf\ubcd0\ubcd1\ubcd2\ubcd3\ubcd4\ubcd5\ubcd6\ubcd7\ubcd8\ubcd9\ubcda\ubcdb\ubcdc\ubcdd\ubcde\ubcdf\ubce0\ubce1\ubce2\ubce3\ubce4\ubce5\ubce6\ubce7\ubce8\ubce9\ubcea\ubceb\ubcec\ubced\ubcee\ubcef\ubcf0\ubcf1\ubcf2\ubcf3\ubcf4\ubcf5\ubcf6\ubcf7\ubcf8\ubcf9\ubcfa\ubcfb\ubcfc\ubcfd\ubcfe\ubcff\ubd00\ubd01\ubd02\ubd03\ubd04\ubd05\ubd06\ubd07\ubd08\ubd09\ubd0a\ubd0b\ubd0c\ubd0d\ubd0e\ubd0f\ubd10\ubd11\ubd12\ubd13\ubd14\ubd15\ubd16\ubd17\ubd18\ubd19\ubd1a\ubd1b\ubd1c\ubd1d\ubd1e\ubd1f\ubd20\ubd21\ubd22\ubd23\ubd24\ubd25\ubd26\ubd27\ubd28\ubd29\ubd2a\ubd2b\ubd2c\ubd2d\ubd2e\ubd2f\ubd30\ubd31\ubd32\ubd33\ubd34\ubd35\ubd36\ubd37\ubd38\ubd39\ubd3a\ubd3b\ubd3c\ubd3d\ubd3e\ubd3f\ubd40\ubd41\ubd42\ubd43\ubd44\ubd45\ubd46\ubd47\ubd48\ubd49\ubd4a\ubd4b\ubd4c\ubd4d\ubd4e\ubd4f\ubd50\ubd51\ubd52\ubd53\ubd54\ubd55\ubd56\ubd57\ubd58\ubd59\ubd5a\ubd5b\ubd5c\ubd5d\ubd5e\ubd5f\ubd60\ubd61\ubd62\ubd63\ubd64\ubd65\ubd66\ubd67\ubd68\ubd69\ubd6a\ubd6b\ubd6c\ubd6d\ubd6e\ubd6f\ubd70\ubd71\ubd72\ubd73\ubd74\ubd75\ubd76\ubd77\ubd78\ubd79\ubd7a\ubd7b\ubd7c\ubd7d\ubd7e\ubd7f\ubd80\ubd81\ubd82\ubd83\ubd84\ubd85\ubd86\ubd87\ubd88\ubd89\ubd8a\ubd8b\ubd8c\ubd8d\ubd8e\ubd8f\ubd90\ubd91\ubd92\ubd93\ubd94\ubd95\ubd96\ubd97\ubd98\ubd99\ubd9a\ubd9b\ubd9c\ubd9d\ubd9e\ubd9f\ubda0\ubda1\ubda2\ubda3\ubda4\ubda5\ubda6\ubda7\ubda8\ubda9\ubdaa\ubdab\ubdac\ubdad\ubdae\ubdaf\ubdb0\ubdb1\ubdb2\ubdb3\ubdb4\ubdb5\ubdb6\ubdb7\ubdb8\ubdb9\ubdba\ubdbb\ubdbc\ubdbd\ubdbe\ubdbf\ubdc0\ubdc1\ubdc2\ubdc3\ubdc4\ubdc5\ubdc6\ubdc7\ubdc8\ubdc9\ubdca\ubdcb\ubdcc\ubdcd\ubdce\ubdcf\ubdd0\ubdd1\ubdd2\ubdd3\ubdd4\ubdd5\ubdd6\ubdd7\ubdd8\ubdd9\ubdda\ubddb\ubddc\ubddd\ubdde\ubddf\ubde0\ubde1\ubde2\ubde3\ubde4\ubde5\ubde6\ubde7\ubde8\ubde9\ubdea\ubdeb\ubdec\ubded\ubdee\ubdef\ubdf0\ubdf1\ubdf2\ubdf3\ubdf4\ubdf5\ubdf6\ubdf7\ubdf8\ubdf9\ubdfa\ubdfb\ubdfc\ubdfd\ubdfe\ubdff\ube00\ube01\ube02\ube03\ube04\ube05\ube06\ube07\ube08\ube09\ube0a\ube0b\ube0c\ube0d\ube0e\ube0f\ube10\ube11\ube12\ube13\ube14\ube15\ube16\ube17\ube18\ube19\ube1a\ube1b\ube1c\ube1d\ube1e\ube1f\ube20\ube21\ube22\ube23\ube24\ube25\ube26\ube27\ube28\ube29\ube2a\ube2b\ube2c\ube2d\ube2e\ube2f\ube30\ube31\ube32\ube33\ube34\ube35\ube36\ube37\ube38\ube39\ube3a\ube3b\ube3c\ube3d\ube3e\ube3f\ube40\ube41\ube42\ube43\ube44\ube45\ube46\ube47\ube48\ube49\ube4a\ube4b\ube4c\ube4d\ube4e\ube4f\ube50\ube51\ube52\ube53\ube54\ube55\ube56\ube57\ube58\ube59\ube5a\ube5b\ube5c\ube5d\ube5e\ube5f\ube60\ube61\ube62\ube63\ube64\ube65\ube66\ube67\ube68\ube69\ube6a\ube6b\ube6c\ube6d\ube6e\ube6f\ube70\ube71\ube72\ube73\ube74\ube75\ube76\ube77\ube78\ube79\ube7a\ube7b\ube7c\ube7d\ube7e\ube7f\ube80\ube81\ube82\ube83\ube84\ube85\ube86\ube87\ube88\ube89\ube8a\ube8b\ube8c\ube8d\ube8e\ube8f\ube90\ube91\ube92\ube93\ube94\ube95\ube96\ube97\ube98\ube99\ube9a\ube9b\ube9c\ube9d\ube9e\ube9f\ubea0\ubea1\ubea2\ubea3\ubea4\ubea5\ubea6\ubea7\ubea8\ubea9\ubeaa\ubeab\ubeac\ubead\ubeae\ubeaf\ubeb0\ubeb1\ubeb2\ubeb3\ubeb4\ubeb5\ubeb6\ubeb7\ubeb8\ubeb9\ubeba\ubebb\ubebc\ubebd\ubebe\ubebf\ubec0\ubec1\ubec2\ubec3\ubec4\ubec5\ubec6\ubec7\ubec8\ubec9\ubeca\ubecb\ubecc\ubecd\ubece\ubecf\ubed0\ubed1\ubed2\ubed3\ubed4\ubed5\ubed6\ubed7\ubed8\ubed9\ubeda\ubedb\ubedc\ubedd\ubede\ubedf\ubee0\ubee1\ubee2\ubee3\ubee4\ubee5\ubee6\ubee7\ubee8\ubee9\ubeea\ubeeb\ubeec\ubeed\ubeee\ubeef\ubef0\ubef1\ubef2\ubef3\ubef4\ubef5\ubef6\ubef7\ubef8\ubef9\ubefa\ubefb\ubefc\ubefd\ubefe\ubeff\ubf00\ubf01\ubf02\ubf03\ubf04\ubf05\ubf06\ubf07\ubf08\ubf09\ubf0a\ubf0b\ubf0c\ubf0d\ubf0e\ubf0f\ubf10\ubf11\ubf12\ubf13\ubf14\ubf15\ubf16\ubf17\ubf18\ubf19\ubf1a\ubf1b\ubf1c\ubf1d\ubf1e\ubf1f\ubf20\ubf21\ubf22\ubf23\ubf24\ubf25\ubf26\ubf27\ubf28\ubf29\ubf2a\ubf2b\ubf2c\ubf2d\ubf2e\ubf2f\ubf30\ubf31\ubf32\ubf33\ubf34\ubf35\ubf36\ubf37\ubf38\ubf39\ubf3a\ubf3b\ubf3c\ubf3d\ubf3e\ubf3f\ubf40\ubf41\ubf42\ubf43\ubf44\ubf45\ubf46\ubf47\ubf48\ubf49\ubf4a\ubf4b\ubf4c\ubf4d\ubf4e\ubf4f\ubf50\ubf51\ubf52\ubf53\ubf54\ubf55\ubf56\ubf57\ubf58\ubf59\ubf5a\ubf5b\ubf5c\ubf5d\ubf5e\ubf5f\ubf60\ubf61\ubf62\ubf63\ubf64\ubf65\ubf66\ubf67\ubf68\ubf69\ubf6a\ubf6b\ubf6c\ubf6d\ubf6e\ubf6f\ubf70\ubf71\ubf72\ubf73\ubf74\ubf75\ubf76\ubf77\ubf78\ubf79\ubf7a\ubf7b\ubf7c\ubf7d\ubf7e\ubf7f\ubf80\ubf81\ubf82\ubf83\ubf84\ubf85\ubf86\ubf87\ubf88\ubf89\ubf8a\ubf8b\ubf8c\ubf8d\ubf8e\ubf8f\ubf90\ubf91\ubf92\ubf93\ubf94\ubf95\ubf96\ubf97\ubf98\ubf99\ubf9a\ubf9b\ubf9c\ubf9d\ubf9e\ubf9f\ubfa0\ubfa1\ubfa2\ubfa3\ubfa4\ubfa5\ubfa6\ubfa7\ubfa8\ubfa9\ubfaa\ubfab\ubfac\ubfad\ubfae\ubfaf\ubfb0\ubfb1\ubfb2\ubfb3\ubfb4\ubfb5\ubfb6\ubfb7\ubfb8\ubfb9\ubfba\ubfbb\ubfbc\ubfbd\ubfbe\ubfbf\ubfc0\ubfc1\ubfc2\ubfc3\ubfc4\ubfc5\ubfc6\ubfc7\ubfc8\ubfc9\ubfca\ubfcb\ubfcc\ubfcd\ubfce\ubfcf\ubfd0\ubfd1\ubfd2\ubfd3\ubfd4\ubfd5\ubfd6\ubfd7\ubfd8\ubfd9\ubfda\ubfdb\ubfdc\ubfdd\ubfde\ubfdf\ubfe0\ubfe1\ubfe2\ubfe3\ubfe4\ubfe5\ubfe6\ubfe7\ubfe8\ubfe9\ubfea\ubfeb\ubfec\ubfed\ubfee\ubfef\ubff0\ubff1\ubff2\ubff3\ubff4\ubff5\ubff6\ubff7\ubff8\ubff9\ubffa\ubffb\ubffc\ubffd\ubffe\ubfff\uc000\uc001\uc002\uc003\uc004\uc005\uc006\uc007\uc008\uc009\uc00a\uc00b\uc00c\uc00d\uc00e\uc00f\uc010\uc011\uc012\uc013\uc014\uc015\uc016\uc017\uc018\uc019\uc01a\uc01b\uc01c\uc01d\uc01e\uc01f\uc020\uc021\uc022\uc023\uc024\uc025\uc026\uc027\uc028\uc029\uc02a\uc02b\uc02c\uc02d\uc02e\uc02f\uc030\uc031\uc032\uc033\uc034\uc035\uc036\uc037\uc038\uc039\uc03a\uc03b\uc03c\uc03d\uc03e\uc03f\uc040\uc041\uc042\uc043\uc044\uc045\uc046\uc047\uc048\uc049\uc04a\uc04b\uc04c\uc04d\uc04e\uc04f\uc050\uc051\uc052\uc053\uc054\uc055\uc056\uc057\uc058\uc059\uc05a\uc05b\uc05c\uc05d\uc05e\uc05f\uc060\uc061\uc062\uc063\uc064\uc065\uc066\uc067\uc068\uc069\uc06a\uc06b\uc06c\uc06d\uc06e\uc06f\uc070\uc071\uc072\uc073\uc074\uc075\uc076\uc077\uc078\uc079\uc07a\uc07b\uc07c\uc07d\uc07e\uc07f\uc080\uc081\uc082\uc083\uc084\uc085\uc086\uc087\uc088\uc089\uc08a\uc08b\uc08c\uc08d\uc08e\uc08f\uc090\uc091\uc092\uc093\uc094\uc095\uc096\uc097\uc098\uc099\uc09a\uc09b\uc09c\uc09d\uc09e\uc09f\uc0a0\uc0a1\uc0a2\uc0a3\uc0a4\uc0a5\uc0a6\uc0a7\uc0a8\uc0a9\uc0aa\uc0ab\uc0ac\uc0ad\uc0ae\uc0af\uc0b0\uc0b1\uc0b2\uc0b3\uc0b4\uc0b5\uc0b6\uc0b7\uc0b8\uc0b9\uc0ba\uc0bb\uc0bc\uc0bd\uc0be\uc0bf\uc0c0\uc0c1\uc0c2\uc0c3\uc0c4\uc0c5\uc0c6\uc0c7\uc0c8\uc0c9\uc0ca\uc0cb\uc0cc\uc0cd\uc0ce\uc0cf\uc0d0\uc0d1\uc0d2\uc0d3\uc0d4\uc0d5\uc0d6\uc0d7\uc0d8\uc0d9\uc0da\uc0db\uc0dc\uc0dd\uc0de\uc0df\uc0e0\uc0e1\uc0e2\uc0e3\uc0e4\uc0e5\uc0e6\uc0e7\uc0e8\uc0e9\uc0ea\uc0eb\uc0ec\uc0ed\uc0ee\uc0ef\uc0f0\uc0f1\uc0f2\uc0f3\uc0f4\uc0f5\uc0f6\uc0f7\uc0f8\uc0f9\uc0fa\uc0fb\uc0fc\uc0fd\uc0fe\uc0ff\uc100\uc101\uc102\uc103\uc104\uc105\uc106\uc107\uc108\uc109\uc10a\uc10b\uc10c\uc10d\uc10e\uc10f\uc110\uc111\uc112\uc113\uc114\uc115\uc116\uc117\uc118\uc119\uc11a\uc11b\uc11c\uc11d\uc11e\uc11f\uc120\uc121\uc122\uc123\uc124\uc125\uc126\uc127\uc128\uc129\uc12a\uc12b\uc12c\uc12d\uc12e\uc12f\uc130\uc131\uc132\uc133\uc134\uc135\uc136\uc137\uc138\uc139\uc13a\uc13b\uc13c\uc13d\uc13e\uc13f\uc140\uc141\uc142\uc143\uc144\uc145\uc146\uc147\uc148\uc149\uc14a\uc14b\uc14c\uc14d\uc14e\uc14f\uc150\uc151\uc152\uc153\uc154\uc155\uc156\uc157\uc158\uc159\uc15a\uc15b\uc15c\uc15d\uc15e\uc15f\uc160\uc161\uc162\uc163\uc164\uc165\uc166\uc167\uc168\uc169\uc16a\uc16b\uc16c\uc16d\uc16e\uc16f\uc170\uc171\uc172\uc173\uc174\uc175\uc176\uc177\uc178\uc179\uc17a\uc17b\uc17c\uc17d\uc17e\uc17f\uc180\uc181\uc182\uc183\uc184\uc185\uc186\uc187\uc188\uc189\uc18a\uc18b\uc18c\uc18d\uc18e\uc18f\uc190\uc191\uc192\uc193\uc194\uc195\uc196\uc197\uc198\uc199\uc19a\uc19b\uc19c\uc19d\uc19e\uc19f\uc1a0\uc1a1\uc1a2\uc1a3\uc1a4\uc1a5\uc1a6\uc1a7\uc1a8\uc1a9\uc1aa\uc1ab\uc1ac\uc1ad\uc1ae\uc1af\uc1b0\uc1b1\uc1b2\uc1b3\uc1b4\uc1b5\uc1b6\uc1b7\uc1b8\uc1b9\uc1ba\uc1bb\uc1bc\uc1bd\uc1be\uc1bf\uc1c0\uc1c1\uc1c2\uc1c3\uc1c4\uc1c5\uc1c6\uc1c7\uc1c8\uc1c9\uc1ca\uc1cb\uc1cc\uc1cd\uc1ce\uc1cf\uc1d0\uc1d1\uc1d2\uc1d3\uc1d4\uc1d5\uc1d6\uc1d7\uc1d8\uc1d9\uc1da\uc1db\uc1dc\uc1dd\uc1de\uc1df\uc1e0\uc1e1\uc1e2\uc1e3\uc1e4\uc1e5\uc1e6\uc1e7\uc1e8\uc1e9\uc1ea\uc1eb\uc1ec\uc1ed\uc1ee\uc1ef\uc1f0\uc1f1\uc1f2\uc1f3\uc1f4\uc1f5\uc1f6\uc1f7\uc1f8\uc1f9\uc1fa\uc1fb\uc1fc\uc1fd\uc1fe\uc1ff\uc200\uc201\uc202\uc203\uc204\uc205\uc206\uc207\uc208\uc209\uc20a\uc20b\uc20c\uc20d\uc20e\uc20f\uc210\uc211\uc212\uc213\uc214\uc215\uc216\uc217\uc218\uc219\uc21a\uc21b\uc21c\uc21d\uc21e\uc21f\uc220\uc221\uc222\uc223\uc224\uc225\uc226\uc227\uc228\uc229\uc22a\uc22b\uc22c\uc22d\uc22e\uc22f\uc230\uc231\uc232\uc233\uc234\uc235\uc236\uc237\uc238\uc239\uc23a\uc23b\uc23c\uc23d\uc23e\uc23f\uc240\uc241\uc242\uc243\uc244\uc245\uc246\uc247\uc248\uc249\uc24a\uc24b\uc24c\uc24d\uc24e\uc24f\uc250\uc251\uc252\uc253\uc254\uc255\uc256\uc257\uc258\uc259\uc25a\uc25b\uc25c\uc25d\uc25e\uc25f\uc260\uc261\uc262\uc263\uc264\uc265\uc266\uc267\uc268\uc269\uc26a\uc26b\uc26c\uc26d\uc26e\uc26f\uc270\uc271\uc272\uc273\uc274\uc275\uc276\uc277\uc278\uc279\uc27a\uc27b\uc27c\uc27d\uc27e\uc27f\uc280\uc281\uc282\uc283\uc284\uc285\uc286\uc287\uc288\uc289\uc28a\uc28b\uc28c\uc28d\uc28e\uc28f\uc290\uc291\uc292\uc293\uc294\uc295\uc296\uc297\uc298\uc299\uc29a\uc29b\uc29c\uc29d\uc29e\uc29f\uc2a0\uc2a1\uc2a2\uc2a3\uc2a4\uc2a5\uc2a6\uc2a7\uc2a8\uc2a9\uc2aa\uc2ab\uc2ac\uc2ad\uc2ae\uc2af\uc2b0\uc2b1\uc2b2\uc2b3\uc2b4\uc2b5\uc2b6\uc2b7\uc2b8\uc2b9\uc2ba\uc2bb\uc2bc\uc2bd\uc2be\uc2bf\uc2c0\uc2c1\uc2c2\uc2c3\uc2c4\uc2c5\uc2c6\uc2c7\uc2c8\uc2c9\uc2ca\uc2cb\uc2cc\uc2cd\uc2ce\uc2cf\uc2d0\uc2d1\uc2d2\uc2d3\uc2d4\uc2d5\uc2d6\uc2d7\uc2d8\uc2d9\uc2da\uc2db\uc2dc\uc2dd\uc2de\uc2df\uc2e0\uc2e1\uc2e2\uc2e3\uc2e4\uc2e5\uc2e6\uc2e7\uc2e8\uc2e9\uc2ea\uc2eb\uc2ec\uc2ed\uc2ee\uc2ef\uc2f0\uc2f1\uc2f2\uc2f3\uc2f4\uc2f5\uc2f6\uc2f7\uc2f8\uc2f9\uc2fa\uc2fb\uc2fc\uc2fd\uc2fe\uc2ff\uc300\uc301\uc302\uc303\uc304\uc305\uc306\uc307\uc308\uc309\uc30a\uc30b\uc30c\uc30d\uc30e\uc30f\uc310\uc311\uc312\uc313\uc314\uc315\uc316\uc317\uc318\uc319\uc31a\uc31b\uc31c\uc31d\uc31e\uc31f\uc320\uc321\uc322\uc323\uc324\uc325\uc326\uc327\uc328\uc329\uc32a\uc32b\uc32c\uc32d\uc32e\uc32f\uc330\uc331\uc332\uc333\uc334\uc335\uc336\uc337\uc338\uc339\uc33a\uc33b\uc33c\uc33d\uc33e\uc33f\uc340\uc341\uc342\uc343\uc344\uc345\uc346\uc347\uc348\uc349\uc34a\uc34b\uc34c\uc34d\uc34e\uc34f\uc350\uc351\uc352\uc353\uc354\uc355\uc356\uc357\uc358\uc359\uc35a\uc35b\uc35c\uc35d\uc35e\uc35f\uc360\uc361\uc362\uc363\uc364\uc365\uc366\uc367\uc368\uc369\uc36a\uc36b\uc36c\uc36d\uc36e\uc36f\uc370\uc371\uc372\uc373\uc374\uc375\uc376\uc377\uc378\uc379\uc37a\uc37b\uc37c\uc37d\uc37e\uc37f\uc380\uc381\uc382\uc383\uc384\uc385\uc386\uc387\uc388\uc389\uc38a\uc38b\uc38c\uc38d\uc38e\uc38f\uc390\uc391\uc392\uc393\uc394\uc395\uc396\uc397\uc398\uc399\uc39a\uc39b\uc39c\uc39d\uc39e\uc39f\uc3a0\uc3a1\uc3a2\uc3a3\uc3a4\uc3a5\uc3a6\uc3a7\uc3a8\uc3a9\uc3aa\uc3ab\uc3ac\uc3ad\uc3ae\uc3af\uc3b0\uc3b1\uc3b2\uc3b3\uc3b4\uc3b5\uc3b6\uc3b7\uc3b8\uc3b9\uc3ba\uc3bb\uc3bc\uc3bd\uc3be\uc3bf\uc3c0\uc3c1\uc3c2\uc3c3\uc3c4\uc3c5\uc3c6\uc3c7\uc3c8\uc3c9\uc3ca\uc3cb\uc3cc\uc3cd\uc3ce\uc3cf\uc3d0\uc3d1\uc3d2\uc3d3\uc3d4\uc3d5\uc3d6\uc3d7\uc3d8\uc3d9\uc3da\uc3db\uc3dc\uc3dd\uc3de\uc3df\uc3e0\uc3e1\uc3e2\uc3e3\uc3e4\uc3e5\uc3e6\uc3e7\uc3e8\uc3e9\uc3ea\uc3eb\uc3ec\uc3ed\uc3ee\uc3ef\uc3f0\uc3f1\uc3f2\uc3f3\uc3f4\uc3f5\uc3f6\uc3f7\uc3f8\uc3f9\uc3fa\uc3fb\uc3fc\uc3fd\uc3fe\uc3ff\uc400\uc401\uc402\uc403\uc404\uc405\uc406\uc407\uc408\uc409\uc40a\uc40b\uc40c\uc40d\uc40e\uc40f\uc410\uc411\uc412\uc413\uc414\uc415\uc416\uc417\uc418\uc419\uc41a\uc41b\uc41c\uc41d\uc41e\uc41f\uc420\uc421\uc422\uc423\uc424\uc425\uc426\uc427\uc428\uc429\uc42a\uc42b\uc42c\uc42d\uc42e\uc42f\uc430\uc431\uc432\uc433\uc434\uc435\uc436\uc437\uc438\uc439\uc43a\uc43b\uc43c\uc43d\uc43e\uc43f\uc440\uc441\uc442\uc443\uc444\uc445\uc446\uc447\uc448\uc449\uc44a\uc44b\uc44c\uc44d\uc44e\uc44f\uc450\uc451\uc452\uc453\uc454\uc455\uc456\uc457\uc458\uc459\uc45a\uc45b\uc45c\uc45d\uc45e\uc45f\uc460\uc461\uc462\uc463\uc464\uc465\uc466\uc467\uc468\uc469\uc46a\uc46b\uc46c\uc46d\uc46e\uc46f\uc470\uc471\uc472\uc473\uc474\uc475\uc476\uc477\uc478\uc479\uc47a\uc47b\uc47c\uc47d\uc47e\uc47f\uc480\uc481\uc482\uc483\uc484\uc485\uc486\uc487\uc488\uc489\uc48a\uc48b\uc48c\uc48d\uc48e\uc48f\uc490\uc491\uc492\uc493\uc494\uc495\uc496\uc497\uc498\uc499\uc49a\uc49b\uc49c\uc49d\uc49e\uc49f\uc4a0\uc4a1\uc4a2\uc4a3\uc4a4\uc4a5\uc4a6\uc4a7\uc4a8\uc4a9\uc4aa\uc4ab\uc4ac\uc4ad\uc4ae\uc4af\uc4b0\uc4b1\uc4b2\uc4b3\uc4b4\uc4b5\uc4b6\uc4b7\uc4b8\uc4b9\uc4ba\uc4bb\uc4bc\uc4bd\uc4be\uc4bf\uc4c0\uc4c1\uc4c2\uc4c3\uc4c4\uc4c5\uc4c6\uc4c7\uc4c8\uc4c9\uc4ca\uc4cb\uc4cc\uc4cd\uc4ce\uc4cf\uc4d0\uc4d1\uc4d2\uc4d3\uc4d4\uc4d5\uc4d6\uc4d7\uc4d8\uc4d9\uc4da\uc4db\uc4dc\uc4dd\uc4de\uc4df\uc4e0\uc4e1\uc4e2\uc4e3\uc4e4\uc4e5\uc4e6\uc4e7\uc4e8\uc4e9\uc4ea\uc4eb\uc4ec\uc4ed\uc4ee\uc4ef\uc4f0\uc4f1\uc4f2\uc4f3\uc4f4\uc4f5\uc4f6\uc4f7\uc4f8\uc4f9\uc4fa\uc4fb\uc4fc\uc4fd\uc4fe\uc4ff\uc500\uc501\uc502\uc503\uc504\uc505\uc506\uc507\uc508\uc509\uc50a\uc50b\uc50c\uc50d\uc50e\uc50f\uc510\uc511\uc512\uc513\uc514\uc515\uc516\uc517\uc518\uc519\uc51a\uc51b\uc51c\uc51d\uc51e\uc51f\uc520\uc521\uc522\uc523\uc524\uc525\uc526\uc527\uc528\uc529\uc52a\uc52b\uc52c\uc52d\uc52e\uc52f\uc530\uc531\uc532\uc533\uc534\uc535\uc536\uc537\uc538\uc539\uc53a\uc53b\uc53c\uc53d\uc53e\uc53f\uc540\uc541\uc542\uc543\uc544\uc545\uc546\uc547\uc548\uc549\uc54a\uc54b\uc54c\uc54d\uc54e\uc54f\uc550\uc551\uc552\uc553\uc554\uc555\uc556\uc557\uc558\uc559\uc55a\uc55b\uc55c\uc55d\uc55e\uc55f\uc560\uc561\uc562\uc563\uc564\uc565\uc566\uc567\uc568\uc569\uc56a\uc56b\uc56c\uc56d\uc56e\uc56f\uc570\uc571\uc572\uc573\uc574\uc575\uc576\uc577\uc578\uc579\uc57a\uc57b\uc57c\uc57d\uc57e\uc57f\uc580\uc581\uc582\uc583\uc584\uc585\uc586\uc587\uc588\uc589\uc58a\uc58b\uc58c\uc58d\uc58e\uc58f\uc590\uc591\uc592\uc593\uc594\uc595\uc596\uc597\uc598\uc599\uc59a\uc59b\uc59c\uc59d\uc59e\uc59f\uc5a0\uc5a1\uc5a2\uc5a3\uc5a4\uc5a5\uc5a6\uc5a7\uc5a8\uc5a9\uc5aa\uc5ab\uc5ac\uc5ad\uc5ae\uc5af\uc5b0\uc5b1\uc5b2\uc5b3\uc5b4\uc5b5\uc5b6\uc5b7\uc5b8\uc5b9\uc5ba\uc5bb\uc5bc\uc5bd\uc5be\uc5bf\uc5c0\uc5c1\uc5c2\uc5c3\uc5c4\uc5c5\uc5c6\uc5c7\uc5c8\uc5c9\uc5ca\uc5cb\uc5cc\uc5cd\uc5ce\uc5cf\uc5d0\uc5d1\uc5d2\uc5d3\uc5d4\uc5d5\uc5d6\uc5d7\uc5d8\uc5d9\uc5da\uc5db\uc5dc\uc5dd\uc5de\uc5df\uc5e0\uc5e1\uc5e2\uc5e3\uc5e4\uc5e5\uc5e6\uc5e7\uc5e8\uc5e9\uc5ea\uc5eb\uc5ec\uc5ed\uc5ee\uc5ef\uc5f0\uc5f1\uc5f2\uc5f3\uc5f4\uc5f5\uc5f6\uc5f7\uc5f8\uc5f9\uc5fa\uc5fb\uc5fc\uc5fd\uc5fe\uc5ff\uc600\uc601\uc602\uc603\uc604\uc605\uc606\uc607\uc608\uc609\uc60a\uc60b\uc60c\uc60d\uc60e\uc60f\uc610\uc611\uc612\uc613\uc614\uc615\uc616\uc617\uc618\uc619\uc61a\uc61b\uc61c\uc61d\uc61e\uc61f\uc620\uc621\uc622\uc623\uc624\uc625\uc626\uc627\uc628\uc629\uc62a\uc62b\uc62c\uc62d\uc62e\uc62f\uc630\uc631\uc632\uc633\uc634\uc635\uc636\uc637\uc638\uc639\uc63a\uc63b\uc63c\uc63d\uc63e\uc63f\uc640\uc641\uc642\uc643\uc644\uc645\uc646\uc647\uc648\uc649\uc64a\uc64b\uc64c\uc64d\uc64e\uc64f\uc650\uc651\uc652\uc653\uc654\uc655\uc656\uc657\uc658\uc659\uc65a\uc65b\uc65c\uc65d\uc65e\uc65f\uc660\uc661\uc662\uc663\uc664\uc665\uc666\uc667\uc668\uc669\uc66a\uc66b\uc66c\uc66d\uc66e\uc66f\uc670\uc671\uc672\uc673\uc674\uc675\uc676\uc677\uc678\uc679\uc67a\uc67b\uc67c\uc67d\uc67e\uc67f\uc680\uc681\uc682\uc683\uc684\uc685\uc686\uc687\uc688\uc689\uc68a\uc68b\uc68c\uc68d\uc68e\uc68f\uc690\uc691\uc692\uc693\uc694\uc695\uc696\uc697\uc698\uc699\uc69a\uc69b\uc69c\uc69d\uc69e\uc69f\uc6a0\uc6a1\uc6a2\uc6a3\uc6a4\uc6a5\uc6a6\uc6a7\uc6a8\uc6a9\uc6aa\uc6ab\uc6ac\uc6ad\uc6ae\uc6af\uc6b0\uc6b1\uc6b2\uc6b3\uc6b4\uc6b5\uc6b6\uc6b7\uc6b8\uc6b9\uc6ba\uc6bb\uc6bc\uc6bd\uc6be\uc6bf\uc6c0\uc6c1\uc6c2\uc6c3\uc6c4\uc6c5\uc6c6\uc6c7\uc6c8\uc6c9\uc6ca\uc6cb\uc6cc\uc6cd\uc6ce\uc6cf\uc6d0\uc6d1\uc6d2\uc6d3\uc6d4\uc6d5\uc6d6\uc6d7\uc6d8\uc6d9\uc6da\uc6db\uc6dc\uc6dd\uc6de\uc6df\uc6e0\uc6e1\uc6e2\uc6e3\uc6e4\uc6e5\uc6e6\uc6e7\uc6e8\uc6e9\uc6ea\uc6eb\uc6ec\uc6ed\uc6ee\uc6ef\uc6f0\uc6f1\uc6f2\uc6f3\uc6f4\uc6f5\uc6f6\uc6f7\uc6f8\uc6f9\uc6fa\uc6fb\uc6fc\uc6fd\uc6fe\uc6ff\uc700\uc701\uc702\uc703\uc704\uc705\uc706\uc707\uc708\uc709\uc70a\uc70b\uc70c\uc70d\uc70e\uc70f\uc710\uc711\uc712\uc713\uc714\uc715\uc716\uc717\uc718\uc719\uc71a\uc71b\uc71c\uc71d\uc71e\uc71f\uc720\uc721\uc722\uc723\uc724\uc725\uc726\uc727\uc728\uc729\uc72a\uc72b\uc72c\uc72d\uc72e\uc72f\uc730\uc731\uc732\uc733\uc734\uc735\uc736\uc737\uc738\uc739\uc73a\uc73b\uc73c\uc73d\uc73e\uc73f\uc740\uc741\uc742\uc743\uc744\uc745\uc746\uc747\uc748\uc749\uc74a\uc74b\uc74c\uc74d\uc74e\uc74f\uc750\uc751\uc752\uc753\uc754\uc755\uc756\uc757\uc758\uc759\uc75a\uc75b\uc75c\uc75d\uc75e\uc75f\uc760\uc761\uc762\uc763\uc764\uc765\uc766\uc767\uc768\uc769\uc76a\uc76b\uc76c\uc76d\uc76e\uc76f\uc770\uc771\uc772\uc773\uc774\uc775\uc776\uc777\uc778\uc779\uc77a\uc77b\uc77c\uc77d\uc77e\uc77f\uc780\uc781\uc782\uc783\uc784\uc785\uc786\uc787\uc788\uc789\uc78a\uc78b\uc78c\uc78d\uc78e\uc78f\uc790\uc791\uc792\uc793\uc794\uc795\uc796\uc797\uc798\uc799\uc79a\uc79b\uc79c\uc79d\uc79e\uc79f\uc7a0\uc7a1\uc7a2\uc7a3\uc7a4\uc7a5\uc7a6\uc7a7\uc7a8\uc7a9\uc7aa\uc7ab\uc7ac\uc7ad\uc7ae\uc7af\uc7b0\uc7b1\uc7b2\uc7b3\uc7b4\uc7b5\uc7b6\uc7b7\uc7b8\uc7b9\uc7ba\uc7bb\uc7bc\uc7bd\uc7be\uc7bf\uc7c0\uc7c1\uc7c2\uc7c3\uc7c4\uc7c5\uc7c6\uc7c7\uc7c8\uc7c9\uc7ca\uc7cb\uc7cc\uc7cd\uc7ce\uc7cf\uc7d0\uc7d1\uc7d2\uc7d3\uc7d4\uc7d5\uc7d6\uc7d7\uc7d8\uc7d9\uc7da\uc7db\uc7dc\uc7dd\uc7de\uc7df\uc7e0\uc7e1\uc7e2\uc7e3\uc7e4\uc7e5\uc7e6\uc7e7\uc7e8\uc7e9\uc7ea\uc7eb\uc7ec\uc7ed\uc7ee\uc7ef\uc7f0\uc7f1\uc7f2\uc7f3\uc7f4\uc7f5\uc7f6\uc7f7\uc7f8\uc7f9\uc7fa\uc7fb\uc7fc\uc7fd\uc7fe\uc7ff\uc800\uc801\uc802\uc803\uc804\uc805\uc806\uc807\uc808\uc809\uc80a\uc80b\uc80c\uc80d\uc80e\uc80f\uc810\uc811\uc812\uc813\uc814\uc815\uc816\uc817\uc818\uc819\uc81a\uc81b\uc81c\uc81d\uc81e\uc81f\uc820\uc821\uc822\uc823\uc824\uc825\uc826\uc827\uc828\uc829\uc82a\uc82b\uc82c\uc82d\uc82e\uc82f\uc830\uc831\uc832\uc833\uc834\uc835\uc836\uc837\uc838\uc839\uc83a\uc83b\uc83c\uc83d\uc83e\uc83f\uc840\uc841\uc842\uc843\uc844\uc845\uc846\uc847\uc848\uc849\uc84a\uc84b\uc84c\uc84d\uc84e\uc84f\uc850\uc851\uc852\uc853\uc854\uc855\uc856\uc857\uc858\uc859\uc85a\uc85b\uc85c\uc85d\uc85e\uc85f\uc860\uc861\uc862\uc863\uc864\uc865\uc866\uc867\uc868\uc869\uc86a\uc86b\uc86c\uc86d\uc86e\uc86f\uc870\uc871\uc872\uc873\uc874\uc875\uc876\uc877\uc878\uc879\uc87a\uc87b\uc87c\uc87d\uc87e\uc87f\uc880\uc881\uc882\uc883\uc884\uc885\uc886\uc887\uc888\uc889\uc88a\uc88b\uc88c\uc88d\uc88e\uc88f\uc890\uc891\uc892\uc893\uc894\uc895\uc896\uc897\uc898\uc899\uc89a\uc89b\uc89c\uc89d\uc89e\uc89f\uc8a0\uc8a1\uc8a2\uc8a3\uc8a4\uc8a5\uc8a6\uc8a7\uc8a8\uc8a9\uc8aa\uc8ab\uc8ac\uc8ad\uc8ae\uc8af\uc8b0\uc8b1\uc8b2\uc8b3\uc8b4\uc8b5\uc8b6\uc8b7\uc8b8\uc8b9\uc8ba\uc8bb\uc8bc\uc8bd\uc8be\uc8bf\uc8c0\uc8c1\uc8c2\uc8c3\uc8c4\uc8c5\uc8c6\uc8c7\uc8c8\uc8c9\uc8ca\uc8cb\uc8cc\uc8cd\uc8ce\uc8cf\uc8d0\uc8d1\uc8d2\uc8d3\uc8d4\uc8d5\uc8d6\uc8d7\uc8d8\uc8d9\uc8da\uc8db\uc8dc\uc8dd\uc8de\uc8df\uc8e0\uc8e1\uc8e2\uc8e3\uc8e4\uc8e5\uc8e6\uc8e7\uc8e8\uc8e9\uc8ea\uc8eb\uc8ec\uc8ed\uc8ee\uc8ef\uc8f0\uc8f1\uc8f2\uc8f3\uc8f4\uc8f5\uc8f6\uc8f7\uc8f8\uc8f9\uc8fa\uc8fb\uc8fc\uc8fd\uc8fe\uc8ff\uc900\uc901\uc902\uc903\uc904\uc905\uc906\uc907\uc908\uc909\uc90a\uc90b\uc90c\uc90d\uc90e\uc90f\uc910\uc911\uc912\uc913\uc914\uc915\uc916\uc917\uc918\uc919\uc91a\uc91b\uc91c\uc91d\uc91e\uc91f\uc920\uc921\uc922\uc923\uc924\uc925\uc926\uc927\uc928\uc929\uc92a\uc92b\uc92c\uc92d\uc92e\uc92f\uc930\uc931\uc932\uc933\uc934\uc935\uc936\uc937\uc938\uc939\uc93a\uc93b\uc93c\uc93d\uc93e\uc93f\uc940\uc941\uc942\uc943\uc944\uc945\uc946\uc947\uc948\uc949\uc94a\uc94b\uc94c\uc94d\uc94e\uc94f\uc950\uc951\uc952\uc953\uc954\uc955\uc956\uc957\uc958\uc959\uc95a\uc95b\uc95c\uc95d\uc95e\uc95f\uc960\uc961\uc962\uc963\uc964\uc965\uc966\uc967\uc968\uc969\uc96a\uc96b\uc96c\uc96d\uc96e\uc96f\uc970\uc971\uc972\uc973\uc974\uc975\uc976\uc977\uc978\uc979\uc97a\uc97b\uc97c\uc97d\uc97e\uc97f\uc980\uc981\uc982\uc983\uc984\uc985\uc986\uc987\uc988\uc989\uc98a\uc98b\uc98c\uc98d\uc98e\uc98f\uc990\uc991\uc992\uc993\uc994\uc995\uc996\uc997\uc998\uc999\uc99a\uc99b\uc99c\uc99d\uc99e\uc99f\uc9a0\uc9a1\uc9a2\uc9a3\uc9a4\uc9a5\uc9a6\uc9a7\uc9a8\uc9a9\uc9aa\uc9ab\uc9ac\uc9ad\uc9ae\uc9af\uc9b0\uc9b1\uc9b2\uc9b3\uc9b4\uc9b5\uc9b6\uc9b7\uc9b8\uc9b9\uc9ba\uc9bb\uc9bc\uc9bd\uc9be\uc9bf\uc9c0\uc9c1\uc9c2\uc9c3\uc9c4\uc9c5\uc9c6\uc9c7\uc9c8\uc9c9\uc9ca\uc9cb\uc9cc\uc9cd\uc9ce\uc9cf\uc9d0\uc9d1\uc9d2\uc9d3\uc9d4\uc9d5\uc9d6\uc9d7\uc9d8\uc9d9\uc9da\uc9db\uc9dc\uc9dd\uc9de\uc9df\uc9e0\uc9e1\uc9e2\uc9e3\uc9e4\uc9e5\uc9e6\uc9e7\uc9e8\uc9e9\uc9ea\uc9eb\uc9ec\uc9ed\uc9ee\uc9ef\uc9f0\uc9f1\uc9f2\uc9f3\uc9f4\uc9f5\uc9f6\uc9f7\uc9f8\uc9f9\uc9fa\uc9fb\uc9fc\uc9fd\uc9fe\uc9ff\uca00\uca01\uca02\uca03\uca04\uca05\uca06\uca07\uca08\uca09\uca0a\uca0b\uca0c\uca0d\uca0e\uca0f\uca10\uca11\uca12\uca13\uca14\uca15\uca16\uca17\uca18\uca19\uca1a\uca1b\uca1c\uca1d\uca1e\uca1f\uca20\uca21\uca22\uca23\uca24\uca25\uca26\uca27\uca28\uca29\uca2a\uca2b\uca2c\uca2d\uca2e\uca2f\uca30\uca31\uca32\uca33\uca34\uca35\uca36\uca37\uca38\uca39\uca3a\uca3b\uca3c\uca3d\uca3e\uca3f\uca40\uca41\uca42\uca43\uca44\uca45\uca46\uca47\uca48\uca49\uca4a\uca4b\uca4c\uca4d\uca4e\uca4f\uca50\uca51\uca52\uca53\uca54\uca55\uca56\uca57\uca58\uca59\uca5a\uca5b\uca5c\uca5d\uca5e\uca5f\uca60\uca61\uca62\uca63\uca64\uca65\uca66\uca67\uca68\uca69\uca6a\uca6b\uca6c\uca6d\uca6e\uca6f\uca70\uca71\uca72\uca73\uca74\uca75\uca76\uca77\uca78\uca79\uca7a\uca7b\uca7c\uca7d\uca7e\uca7f\uca80\uca81\uca82\uca83\uca84\uca85\uca86\uca87\uca88\uca89\uca8a\uca8b\uca8c\uca8d\uca8e\uca8f\uca90\uca91\uca92\uca93\uca94\uca95\uca96\uca97\uca98\uca99\uca9a\uca9b\uca9c\uca9d\uca9e\uca9f\ucaa0\ucaa1\ucaa2\ucaa3\ucaa4\ucaa5\ucaa6\ucaa7\ucaa8\ucaa9\ucaaa\ucaab\ucaac\ucaad\ucaae\ucaaf\ucab0\ucab1\ucab2\ucab3\ucab4\ucab5\ucab6\ucab7\ucab8\ucab9\ucaba\ucabb\ucabc\ucabd\ucabe\ucabf\ucac0\ucac1\ucac2\ucac3\ucac4\ucac5\ucac6\ucac7\ucac8\ucac9\ucaca\ucacb\ucacc\ucacd\ucace\ucacf\ucad0\ucad1\ucad2\ucad3\ucad4\ucad5\ucad6\ucad7\ucad8\ucad9\ucada\ucadb\ucadc\ucadd\ucade\ucadf\ucae0\ucae1\ucae2\ucae3\ucae4\ucae5\ucae6\ucae7\ucae8\ucae9\ucaea\ucaeb\ucaec\ucaed\ucaee\ucaef\ucaf0\ucaf1\ucaf2\ucaf3\ucaf4\ucaf5\ucaf6\ucaf7\ucaf8\ucaf9\ucafa\ucafb\ucafc\ucafd\ucafe\ucaff\ucb00\ucb01\ucb02\ucb03\ucb04\ucb05\ucb06\ucb07\ucb08\ucb09\ucb0a\ucb0b\ucb0c\ucb0d\ucb0e\ucb0f\ucb10\ucb11\ucb12\ucb13\ucb14\ucb15\ucb16\ucb17\ucb18\ucb19\ucb1a\ucb1b\ucb1c\ucb1d\ucb1e\ucb1f\ucb20\ucb21\ucb22\ucb23\ucb24\ucb25\ucb26\ucb27\ucb28\ucb29\ucb2a\ucb2b\ucb2c\ucb2d\ucb2e\ucb2f\ucb30\ucb31\ucb32\ucb33\ucb34\ucb35\ucb36\ucb37\ucb38\ucb39\ucb3a\ucb3b\ucb3c\ucb3d\ucb3e\ucb3f\ucb40\ucb41\ucb42\ucb43\ucb44\ucb45\ucb46\ucb47\ucb48\ucb49\ucb4a\ucb4b\ucb4c\ucb4d\ucb4e\ucb4f\ucb50\ucb51\ucb52\ucb53\ucb54\ucb55\ucb56\ucb57\ucb58\ucb59\ucb5a\ucb5b\ucb5c\ucb5d\ucb5e\ucb5f\ucb60\ucb61\ucb62\ucb63\ucb64\ucb65\ucb66\ucb67\ucb68\ucb69\ucb6a\ucb6b\ucb6c\ucb6d\ucb6e\ucb6f\ucb70\ucb71\ucb72\ucb73\ucb74\ucb75\ucb76\ucb77\ucb78\ucb79\ucb7a\ucb7b\ucb7c\ucb7d\ucb7e\ucb7f\ucb80\ucb81\ucb82\ucb83\ucb84\ucb85\ucb86\ucb87\ucb88\ucb89\ucb8a\ucb8b\ucb8c\ucb8d\ucb8e\ucb8f\ucb90\ucb91\ucb92\ucb93\ucb94\ucb95\ucb96\ucb97\ucb98\ucb99\ucb9a\ucb9b\ucb9c\ucb9d\ucb9e\ucb9f\ucba0\ucba1\ucba2\ucba3\ucba4\ucba5\ucba6\ucba7\ucba8\ucba9\ucbaa\ucbab\ucbac\ucbad\ucbae\ucbaf\ucbb0\ucbb1\ucbb2\ucbb3\ucbb4\ucbb5\ucbb6\ucbb7\ucbb8\ucbb9\ucbba\ucbbb\ucbbc\ucbbd\ucbbe\ucbbf\ucbc0\ucbc1\ucbc2\ucbc3\ucbc4\ucbc5\ucbc6\ucbc7\ucbc8\ucbc9\ucbca\ucbcb\ucbcc\ucbcd\ucbce\ucbcf\ucbd0\ucbd1\ucbd2\ucbd3\ucbd4\ucbd5\ucbd6\ucbd7\ucbd8\ucbd9\ucbda\ucbdb\ucbdc\ucbdd\ucbde\ucbdf\ucbe0\ucbe1\ucbe2\ucbe3\ucbe4\ucbe5\ucbe6\ucbe7\ucbe8\ucbe9\ucbea\ucbeb\ucbec\ucbed\ucbee\ucbef\ucbf0\ucbf1\ucbf2\ucbf3\ucbf4\ucbf5\ucbf6\ucbf7\ucbf8\ucbf9\ucbfa\ucbfb\ucbfc\ucbfd\ucbfe\ucbff\ucc00\ucc01\ucc02\ucc03\ucc04\ucc05\ucc06\ucc07\ucc08\ucc09\ucc0a\ucc0b\ucc0c\ucc0d\ucc0e\ucc0f\ucc10\ucc11\ucc12\ucc13\ucc14\ucc15\ucc16\ucc17\ucc18\ucc19\ucc1a\ucc1b\ucc1c\ucc1d\ucc1e\ucc1f\ucc20\ucc21\ucc22\ucc23\ucc24\ucc25\ucc26\ucc27\ucc28\ucc29\ucc2a\ucc2b\ucc2c\ucc2d\ucc2e\ucc2f\ucc30\ucc31\ucc32\ucc33\ucc34\ucc35\ucc36\ucc37\ucc38\ucc39\ucc3a\ucc3b\ucc3c\ucc3d\ucc3e\ucc3f\ucc40\ucc41\ucc42\ucc43\ucc44\ucc45\ucc46\ucc47\ucc48\ucc49\ucc4a\ucc4b\ucc4c\ucc4d\ucc4e\ucc4f\ucc50\ucc51\ucc52\ucc53\ucc54\ucc55\ucc56\ucc57\ucc58\ucc59\ucc5a\ucc5b\ucc5c\ucc5d\ucc5e\ucc5f\ucc60\ucc61\ucc62\ucc63\ucc64\ucc65\ucc66\ucc67\ucc68\ucc69\ucc6a\ucc6b\ucc6c\ucc6d\ucc6e\ucc6f\ucc70\ucc71\ucc72\ucc73\ucc74\ucc75\ucc76\ucc77\ucc78\ucc79\ucc7a\ucc7b\ucc7c\ucc7d\ucc7e\ucc7f\ucc80\ucc81\ucc82\ucc83\ucc84\ucc85\ucc86\ucc87\ucc88\ucc89\ucc8a\ucc8b\ucc8c\ucc8d\ucc8e\ucc8f\ucc90\ucc91\ucc92\ucc93\ucc94\ucc95\ucc96\ucc97\ucc98\ucc99\ucc9a\ucc9b\ucc9c\ucc9d\ucc9e\ucc9f\ucca0\ucca1\ucca2\ucca3\ucca4\ucca5\ucca6\ucca7\ucca8\ucca9\uccaa\uccab\uccac\uccad\uccae\uccaf\uccb0\uccb1\uccb2\uccb3\uccb4\uccb5\uccb6\uccb7\uccb8\uccb9\uccba\uccbb\uccbc\uccbd\uccbe\uccbf\uccc0\uccc1\uccc2\uccc3\uccc4\uccc5\uccc6\uccc7\uccc8\uccc9\uccca\ucccb\ucccc\ucccd\uccce\ucccf\uccd0\uccd1\uccd2\uccd3\uccd4\uccd5\uccd6\uccd7\uccd8\uccd9\uccda\uccdb\uccdc\uccdd\uccde\uccdf\ucce0\ucce1\ucce2\ucce3\ucce4\ucce5\ucce6\ucce7\ucce8\ucce9\uccea\ucceb\uccec\ucced\uccee\uccef\uccf0\uccf1\uccf2\uccf3\uccf4\uccf5\uccf6\uccf7\uccf8\uccf9\uccfa\uccfb\uccfc\uccfd\uccfe\uccff\ucd00\ucd01\ucd02\ucd03\ucd04\ucd05\ucd06\ucd07\ucd08\ucd09\ucd0a\ucd0b\ucd0c\ucd0d\ucd0e\ucd0f\ucd10\ucd11\ucd12\ucd13\ucd14\ucd15\ucd16\ucd17\ucd18\ucd19\ucd1a\ucd1b\ucd1c\ucd1d\ucd1e\ucd1f\ucd20\ucd21\ucd22\ucd23\ucd24\ucd25\ucd26\ucd27\ucd28\ucd29\ucd2a\ucd2b\ucd2c\ucd2d\ucd2e\ucd2f\ucd30\ucd31\ucd32\ucd33\ucd34\ucd35\ucd36\ucd37\ucd38\ucd39\ucd3a\ucd3b\ucd3c\ucd3d\ucd3e\ucd3f\ucd40\ucd41\ucd42\ucd43\ucd44\ucd45\ucd46\ucd47\ucd48\ucd49\ucd4a\ucd4b\ucd4c\ucd4d\ucd4e\ucd4f\ucd50\ucd51\ucd52\ucd53\ucd54\ucd55\ucd56\ucd57\ucd58\ucd59\ucd5a\ucd5b\ucd5c\ucd5d\ucd5e\ucd5f\ucd60\ucd61\ucd62\ucd63\ucd64\ucd65\ucd66\ucd67\ucd68\ucd69\ucd6a\ucd6b\ucd6c\ucd6d\ucd6e\ucd6f\ucd70\ucd71\ucd72\ucd73\ucd74\ucd75\ucd76\ucd77\ucd78\ucd79\ucd7a\ucd7b\ucd7c\ucd7d\ucd7e\ucd7f\ucd80\ucd81\ucd82\ucd83\ucd84\ucd85\ucd86\ucd87\ucd88\ucd89\ucd8a\ucd8b\ucd8c\ucd8d\ucd8e\ucd8f\ucd90\ucd91\ucd92\ucd93\ucd94\ucd95\ucd96\ucd97\ucd98\ucd99\ucd9a\ucd9b\ucd9c\ucd9d\ucd9e\ucd9f\ucda0\ucda1\ucda2\ucda3\ucda4\ucda5\ucda6\ucda7\ucda8\ucda9\ucdaa\ucdab\ucdac\ucdad\ucdae\ucdaf\ucdb0\ucdb1\ucdb2\ucdb3\ucdb4\ucdb5\ucdb6\ucdb7\ucdb8\ucdb9\ucdba\ucdbb\ucdbc\ucdbd\ucdbe\ucdbf\ucdc0\ucdc1\ucdc2\ucdc3\ucdc4\ucdc5\ucdc6\ucdc7\ucdc8\ucdc9\ucdca\ucdcb\ucdcc\ucdcd\ucdce\ucdcf\ucdd0\ucdd1\ucdd2\ucdd3\ucdd4\ucdd5\ucdd6\ucdd7\ucdd8\ucdd9\ucdda\ucddb\ucddc\ucddd\ucdde\ucddf\ucde0\ucde1\ucde2\ucde3\ucde4\ucde5\ucde6\ucde7\ucde8\ucde9\ucdea\ucdeb\ucdec\ucded\ucdee\ucdef\ucdf0\ucdf1\ucdf2\ucdf3\ucdf4\ucdf5\ucdf6\ucdf7\ucdf8\ucdf9\ucdfa\ucdfb\ucdfc\ucdfd\ucdfe\ucdff\uce00\uce01\uce02\uce03\uce04\uce05\uce06\uce07\uce08\uce09\uce0a\uce0b\uce0c\uce0d\uce0e\uce0f\uce10\uce11\uce12\uce13\uce14\uce15\uce16\uce17\uce18\uce19\uce1a\uce1b\uce1c\uce1d\uce1e\uce1f\uce20\uce21\uce22\uce23\uce24\uce25\uce26\uce27\uce28\uce29\uce2a\uce2b\uce2c\uce2d\uce2e\uce2f\uce30\uce31\uce32\uce33\uce34\uce35\uce36\uce37\uce38\uce39\uce3a\uce3b\uce3c\uce3d\uce3e\uce3f\uce40\uce41\uce42\uce43\uce44\uce45\uce46\uce47\uce48\uce49\uce4a\uce4b\uce4c\uce4d\uce4e\uce4f\uce50\uce51\uce52\uce53\uce54\uce55\uce56\uce57\uce58\uce59\uce5a\uce5b\uce5c\uce5d\uce5e\uce5f\uce60\uce61\uce62\uce63\uce64\uce65\uce66\uce67\uce68\uce69\uce6a\uce6b\uce6c\uce6d\uce6e\uce6f\uce70\uce71\uce72\uce73\uce74\uce75\uce76\uce77\uce78\uce79\uce7a\uce7b\uce7c\uce7d\uce7e\uce7f\uce80\uce81\uce82\uce83\uce84\uce85\uce86\uce87\uce88\uce89\uce8a\uce8b\uce8c\uce8d\uce8e\uce8f\uce90\uce91\uce92\uce93\uce94\uce95\uce96\uce97\uce98\uce99\uce9a\uce9b\uce9c\uce9d\uce9e\uce9f\ucea0\ucea1\ucea2\ucea3\ucea4\ucea5\ucea6\ucea7\ucea8\ucea9\uceaa\uceab\uceac\ucead\uceae\uceaf\uceb0\uceb1\uceb2\uceb3\uceb4\uceb5\uceb6\uceb7\uceb8\uceb9\uceba\ucebb\ucebc\ucebd\ucebe\ucebf\ucec0\ucec1\ucec2\ucec3\ucec4\ucec5\ucec6\ucec7\ucec8\ucec9\uceca\ucecb\ucecc\ucecd\ucece\ucecf\uced0\uced1\uced2\uced3\uced4\uced5\uced6\uced7\uced8\uced9\uceda\ucedb\ucedc\ucedd\ucede\ucedf\ucee0\ucee1\ucee2\ucee3\ucee4\ucee5\ucee6\ucee7\ucee8\ucee9\uceea\uceeb\uceec\uceed\uceee\uceef\ucef0\ucef1\ucef2\ucef3\ucef4\ucef5\ucef6\ucef7\ucef8\ucef9\ucefa\ucefb\ucefc\ucefd\ucefe\uceff\ucf00\ucf01\ucf02\ucf03\ucf04\ucf05\ucf06\ucf07\ucf08\ucf09\ucf0a\ucf0b\ucf0c\ucf0d\ucf0e\ucf0f\ucf10\ucf11\ucf12\ucf13\ucf14\ucf15\ucf16\ucf17\ucf18\ucf19\ucf1a\ucf1b\ucf1c\ucf1d\ucf1e\ucf1f\ucf20\ucf21\ucf22\ucf23\ucf24\ucf25\ucf26\ucf27\ucf28\ucf29\ucf2a\ucf2b\ucf2c\ucf2d\ucf2e\ucf2f\ucf30\ucf31\ucf32\ucf33\ucf34\ucf35\ucf36\ucf37\ucf38\ucf39\ucf3a\ucf3b\ucf3c\ucf3d\ucf3e\ucf3f\ucf40\ucf41\ucf42\ucf43\ucf44\ucf45\ucf46\ucf47\ucf48\ucf49\ucf4a\ucf4b\ucf4c\ucf4d\ucf4e\ucf4f\ucf50\ucf51\ucf52\ucf53\ucf54\ucf55\ucf56\ucf57\ucf58\ucf59\ucf5a\ucf5b\ucf5c\ucf5d\ucf5e\ucf5f\ucf60\ucf61\ucf62\ucf63\ucf64\ucf65\ucf66\ucf67\ucf68\ucf69\ucf6a\ucf6b\ucf6c\ucf6d\ucf6e\ucf6f\ucf70\ucf71\ucf72\ucf73\ucf74\ucf75\ucf76\ucf77\ucf78\ucf79\ucf7a\ucf7b\ucf7c\ucf7d\ucf7e\ucf7f\ucf80\ucf81\ucf82\ucf83\ucf84\ucf85\ucf86\ucf87\ucf88\ucf89\ucf8a\ucf8b\ucf8c\ucf8d\ucf8e\ucf8f\ucf90\ucf91\ucf92\ucf93\ucf94\ucf95\ucf96\ucf97\ucf98\ucf99\ucf9a\ucf9b\ucf9c\ucf9d\ucf9e\ucf9f\ucfa0\ucfa1\ucfa2\ucfa3\ucfa4\ucfa5\ucfa6\ucfa7\ucfa8\ucfa9\ucfaa\ucfab\ucfac\ucfad\ucfae\ucfaf\ucfb0\ucfb1\ucfb2\ucfb3\ucfb4\ucfb5\ucfb6\ucfb7\ucfb8\ucfb9\ucfba\ucfbb\ucfbc\ucfbd\ucfbe\ucfbf\ucfc0\ucfc1\ucfc2\ucfc3\ucfc4\ucfc5\ucfc6\ucfc7\ucfc8\ucfc9\ucfca\ucfcb\ucfcc\ucfcd\ucfce\ucfcf\ucfd0\ucfd1\ucfd2\ucfd3\ucfd4\ucfd5\ucfd6\ucfd7\ucfd8\ucfd9\ucfda\ucfdb\ucfdc\ucfdd\ucfde\ucfdf\ucfe0\ucfe1\ucfe2\ucfe3\ucfe4\ucfe5\ucfe6\ucfe7\ucfe8\ucfe9\ucfea\ucfeb\ucfec\ucfed\ucfee\ucfef\ucff0\ucff1\ucff2\ucff3\ucff4\ucff5\ucff6\ucff7\ucff8\ucff9\ucffa\ucffb\ucffc\ucffd\ucffe\ucfff\ud000\ud001\ud002\ud003\ud004\ud005\ud006\ud007\ud008\ud009\ud00a\ud00b\ud00c\ud00d\ud00e\ud00f\ud010\ud011\ud012\ud013\ud014\ud015\ud016\ud017\ud018\ud019\ud01a\ud01b\ud01c\ud01d\ud01e\ud01f\ud020\ud021\ud022\ud023\ud024\ud025\ud026\ud027\ud028\ud029\ud02a\ud02b\ud02c\ud02d\ud02e\ud02f\ud030\ud031\ud032\ud033\ud034\ud035\ud036\ud037\ud038\ud039\ud03a\ud03b\ud03c\ud03d\ud03e\ud03f\ud040\ud041\ud042\ud043\ud044\ud045\ud046\ud047\ud048\ud049\ud04a\ud04b\ud04c\ud04d\ud04e\ud04f\ud050\ud051\ud052\ud053\ud054\ud055\ud056\ud057\ud058\ud059\ud05a\ud05b\ud05c\ud05d\ud05e\ud05f\ud060\ud061\ud062\ud063\ud064\ud065\ud066\ud067\ud068\ud069\ud06a\ud06b\ud06c\ud06d\ud06e\ud06f\ud070\ud071\ud072\ud073\ud074\ud075\ud076\ud077\ud078\ud079\ud07a\ud07b\ud07c\ud07d\ud07e\ud07f\ud080\ud081\ud082\ud083\ud084\ud085\ud086\ud087\ud088\ud089\ud08a\ud08b\ud08c\ud08d\ud08e\ud08f\ud090\ud091\ud092\ud093\ud094\ud095\ud096\ud097\ud098\ud099\ud09a\ud09b\ud09c\ud09d\ud09e\ud09f\ud0a0\ud0a1\ud0a2\ud0a3\ud0a4\ud0a5\ud0a6\ud0a7\ud0a8\ud0a9\ud0aa\ud0ab\ud0ac\ud0ad\ud0ae\ud0af\ud0b0\ud0b1\ud0b2\ud0b3\ud0b4\ud0b5\ud0b6\ud0b7\ud0b8\ud0b9\ud0ba\ud0bb\ud0bc\ud0bd\ud0be\ud0bf\ud0c0\ud0c1\ud0c2\ud0c3\ud0c4\ud0c5\ud0c6\ud0c7\ud0c8\ud0c9\ud0ca\ud0cb\ud0cc\ud0cd\ud0ce\ud0cf\ud0d0\ud0d1\ud0d2\ud0d3\ud0d4\ud0d5\ud0d6\ud0d7\ud0d8\ud0d9\ud0da\ud0db\ud0dc\ud0dd\ud0de\ud0df\ud0e0\ud0e1\ud0e2\ud0e3\ud0e4\ud0e5\ud0e6\ud0e7\ud0e8\ud0e9\ud0ea\ud0eb\ud0ec\ud0ed\ud0ee\ud0ef\ud0f0\ud0f1\ud0f2\ud0f3\ud0f4\ud0f5\ud0f6\ud0f7\ud0f8\ud0f9\ud0fa\ud0fb\ud0fc\ud0fd\ud0fe\ud0ff\ud100\ud101\ud102\ud103\ud104\ud105\ud106\ud107\ud108\ud109\ud10a\ud10b\ud10c\ud10d\ud10e\ud10f\ud110\ud111\ud112\ud113\ud114\ud115\ud116\ud117\ud118\ud119\ud11a\ud11b\ud11c\ud11d\ud11e\ud11f\ud120\ud121\ud122\ud123\ud124\ud125\ud126\ud127\ud128\ud129\ud12a\ud12b\ud12c\ud12d\ud12e\ud12f\ud130\ud131\ud132\ud133\ud134\ud135\ud136\ud137\ud138\ud139\ud13a\ud13b\ud13c\ud13d\ud13e\ud13f\ud140\ud141\ud142\ud143\ud144\ud145\ud146\ud147\ud148\ud149\ud14a\ud14b\ud14c\ud14d\ud14e\ud14f\ud150\ud151\ud152\ud153\ud154\ud155\ud156\ud157\ud158\ud159\ud15a\ud15b\ud15c\ud15d\ud15e\ud15f\ud160\ud161\ud162\ud163\ud164\ud165\ud166\ud167\ud168\ud169\ud16a\ud16b\ud16c\ud16d\ud16e\ud16f\ud170\ud171\ud172\ud173\ud174\ud175\ud176\ud177\ud178\ud179\ud17a\ud17b\ud17c\ud17d\ud17e\ud17f\ud180\ud181\ud182\ud183\ud184\ud185\ud186\ud187\ud188\ud189\ud18a\ud18b\ud18c\ud18d\ud18e\ud18f\ud190\ud191\ud192\ud193\ud194\ud195\ud196\ud197\ud198\ud199\ud19a\ud19b\ud19c\ud19d\ud19e\ud19f\ud1a0\ud1a1\ud1a2\ud1a3\ud1a4\ud1a5\ud1a6\ud1a7\ud1a8\ud1a9\ud1aa\ud1ab\ud1ac\ud1ad\ud1ae\ud1af\ud1b0\ud1b1\ud1b2\ud1b3\ud1b4\ud1b5\ud1b6\ud1b7\ud1b8\ud1b9\ud1ba\ud1bb\ud1bc\ud1bd\ud1be\ud1bf\ud1c0\ud1c1\ud1c2\ud1c3\ud1c4\ud1c5\ud1c6\ud1c7\ud1c8\ud1c9\ud1ca\ud1cb\ud1cc\ud1cd\ud1ce\ud1cf\ud1d0\ud1d1\ud1d2\ud1d3\ud1d4\ud1d5\ud1d6\ud1d7\ud1d8\ud1d9\ud1da\ud1db\ud1dc\ud1dd\ud1de\ud1df\ud1e0\ud1e1\ud1e2\ud1e3\ud1e4\ud1e5\ud1e6\ud1e7\ud1e8\ud1e9\ud1ea\ud1eb\ud1ec\ud1ed\ud1ee\ud1ef\ud1f0\ud1f1\ud1f2\ud1f3\ud1f4\ud1f5\ud1f6\ud1f7\ud1f8\ud1f9\ud1fa\ud1fb\ud1fc\ud1fd\ud1fe\ud1ff\ud200\ud201\ud202\ud203\ud204\ud205\ud206\ud207\ud208\ud209\ud20a\ud20b\ud20c\ud20d\ud20e\ud20f\ud210\ud211\ud212\ud213\ud214\ud215\ud216\ud217\ud218\ud219\ud21a\ud21b\ud21c\ud21d\ud21e\ud21f\ud220\ud221\ud222\ud223\ud224\ud225\ud226\ud227\ud228\ud229\ud22a\ud22b\ud22c\ud22d\ud22e\ud22f\ud230\ud231\ud232\ud233\ud234\ud235\ud236\ud237\ud238\ud239\ud23a\ud23b\ud23c\ud23d\ud23e\ud23f\ud240\ud241\ud242\ud243\ud244\ud245\ud246\ud247\ud248\ud249\ud24a\ud24b\ud24c\ud24d\ud24e\ud24f\ud250\ud251\ud252\ud253\ud254\ud255\ud256\ud257\ud258\ud259\ud25a\ud25b\ud25c\ud25d\ud25e\ud25f\ud260\ud261\ud262\ud263\ud264\ud265\ud266\ud267\ud268\ud269\ud26a\ud26b\ud26c\ud26d\ud26e\ud26f\ud270\ud271\ud272\ud273\ud274\ud275\ud276\ud277\ud278\ud279\ud27a\ud27b\ud27c\ud27d\ud27e\ud27f\ud280\ud281\ud282\ud283\ud284\ud285\ud286\ud287\ud288\ud289\ud28a\ud28b\ud28c\ud28d\ud28e\ud28f\ud290\ud291\ud292\ud293\ud294\ud295\ud296\ud297\ud298\ud299\ud29a\ud29b\ud29c\ud29d\ud29e\ud29f\ud2a0\ud2a1\ud2a2\ud2a3\ud2a4\ud2a5\ud2a6\ud2a7\ud2a8\ud2a9\ud2aa\ud2ab\ud2ac\ud2ad\ud2ae\ud2af\ud2b0\ud2b1\ud2b2\ud2b3\ud2b4\ud2b5\ud2b6\ud2b7\ud2b8\ud2b9\ud2ba\ud2bb\ud2bc\ud2bd\ud2be\ud2bf\ud2c0\ud2c1\ud2c2\ud2c3\ud2c4\ud2c5\ud2c6\ud2c7\ud2c8\ud2c9\ud2ca\ud2cb\ud2cc\ud2cd\ud2ce\ud2cf\ud2d0\ud2d1\ud2d2\ud2d3\ud2d4\ud2d5\ud2d6\ud2d7\ud2d8\ud2d9\ud2da\ud2db\ud2dc\ud2dd\ud2de\ud2df\ud2e0\ud2e1\ud2e2\ud2e3\ud2e4\ud2e5\ud2e6\ud2e7\ud2e8\ud2e9\ud2ea\ud2eb\ud2ec\ud2ed\ud2ee\ud2ef\ud2f0\ud2f1\ud2f2\ud2f3\ud2f4\ud2f5\ud2f6\ud2f7\ud2f8\ud2f9\ud2fa\ud2fb\ud2fc\ud2fd\ud2fe\ud2ff\ud300\ud301\ud302\ud303\ud304\ud305\ud306\ud307\ud308\ud309\ud30a\ud30b\ud30c\ud30d\ud30e\ud30f\ud310\ud311\ud312\ud313\ud314\ud315\ud316\ud317\ud318\ud319\ud31a\ud31b\ud31c\ud31d\ud31e\ud31f\ud320\ud321\ud322\ud323\ud324\ud325\ud326\ud327\ud328\ud329\ud32a\ud32b\ud32c\ud32d\ud32e\ud32f\ud330\ud331\ud332\ud333\ud334\ud335\ud336\ud337\ud338\ud339\ud33a\ud33b\ud33c\ud33d\ud33e\ud33f\ud340\ud341\ud342\ud343\ud344\ud345\ud346\ud347\ud348\ud349\ud34a\ud34b\ud34c\ud34d\ud34e\ud34f\ud350\ud351\ud352\ud353\ud354\ud355\ud356\ud357\ud358\ud359\ud35a\ud35b\ud35c\ud35d\ud35e\ud35f\ud360\ud361\ud362\ud363\ud364\ud365\ud366\ud367\ud368\ud369\ud36a\ud36b\ud36c\ud36d\ud36e\ud36f\ud370\ud371\ud372\ud373\ud374\ud375\ud376\ud377\ud378\ud379\ud37a\ud37b\ud37c\ud37d\ud37e\ud37f\ud380\ud381\ud382\ud383\ud384\ud385\ud386\ud387\ud388\ud389\ud38a\ud38b\ud38c\ud38d\ud38e\ud38f\ud390\ud391\ud392\ud393\ud394\ud395\ud396\ud397\ud398\ud399\ud39a\ud39b\ud39c\ud39d\ud39e\ud39f\ud3a0\ud3a1\ud3a2\ud3a3\ud3a4\ud3a5\ud3a6\ud3a7\ud3a8\ud3a9\ud3aa\ud3ab\ud3ac\ud3ad\ud3ae\ud3af\ud3b0\ud3b1\ud3b2\ud3b3\ud3b4\ud3b5\ud3b6\ud3b7\ud3b8\ud3b9\ud3ba\ud3bb\ud3bc\ud3bd\ud3be\ud3bf\ud3c0\ud3c1\ud3c2\ud3c3\ud3c4\ud3c5\ud3c6\ud3c7\ud3c8\ud3c9\ud3ca\ud3cb\ud3cc\ud3cd\ud3ce\ud3cf\ud3d0\ud3d1\ud3d2\ud3d3\ud3d4\ud3d5\ud3d6\ud3d7\ud3d8\ud3d9\ud3da\ud3db\ud3dc\ud3dd\ud3de\ud3df\ud3e0\ud3e1\ud3e2\ud3e3\ud3e4\ud3e5\ud3e6\ud3e7\ud3e8\ud3e9\ud3ea\ud3eb\ud3ec\ud3ed\ud3ee\ud3ef\ud3f0\ud3f1\ud3f2\ud3f3\ud3f4\ud3f5\ud3f6\ud3f7\ud3f8\ud3f9\ud3fa\ud3fb\ud3fc\ud3fd\ud3fe\ud3ff\ud400\ud401\ud402\ud403\ud404\ud405\ud406\ud407\ud408\ud409\ud40a\ud40b\ud40c\ud40d\ud40e\ud40f\ud410\ud411\ud412\ud413\ud414\ud415\ud416\ud417\ud418\ud419\ud41a\ud41b\ud41c\ud41d\ud41e\ud41f\ud420\ud421\ud422\ud423\ud424\ud425\ud426\ud427\ud428\ud429\ud42a\ud42b\ud42c\ud42d\ud42e\ud42f\ud430\ud431\ud432\ud433\ud434\ud435\ud436\ud437\ud438\ud439\ud43a\ud43b\ud43c\ud43d\ud43e\ud43f\ud440\ud441\ud442\ud443\ud444\ud445\ud446\ud447\ud448\ud449\ud44a\ud44b\ud44c\ud44d\ud44e\ud44f\ud450\ud451\ud452\ud453\ud454\ud455\ud456\ud457\ud458\ud459\ud45a\ud45b\ud45c\ud45d\ud45e\ud45f\ud460\ud461\ud462\ud463\ud464\ud465\ud466\ud467\ud468\ud469\ud46a\ud46b\ud46c\ud46d\ud46e\ud46f\ud470\ud471\ud472\ud473\ud474\ud475\ud476\ud477\ud478\ud479\ud47a\ud47b\ud47c\ud47d\ud47e\ud47f\ud480\ud481\ud482\ud483\ud484\ud485\ud486\ud487\ud488\ud489\ud48a\ud48b\ud48c\ud48d\ud48e\ud48f\ud490\ud491\ud492\ud493\ud494\ud495\ud496\ud497\ud498\ud499\ud49a\ud49b\ud49c\ud49d\ud49e\ud49f\ud4a0\ud4a1\ud4a2\ud4a3\ud4a4\ud4a5\ud4a6\ud4a7\ud4a8\ud4a9\ud4aa\ud4ab\ud4ac\ud4ad\ud4ae\ud4af\ud4b0\ud4b1\ud4b2\ud4b3\ud4b4\ud4b5\ud4b6\ud4b7\ud4b8\ud4b9\ud4ba\ud4bb\ud4bc\ud4bd\ud4be\ud4bf\ud4c0\ud4c1\ud4c2\ud4c3\ud4c4\ud4c5\ud4c6\ud4c7\ud4c8\ud4c9\ud4ca\ud4cb\ud4cc\ud4cd\ud4ce\ud4cf\ud4d0\ud4d1\ud4d2\ud4d3\ud4d4\ud4d5\ud4d6\ud4d7\ud4d8\ud4d9\ud4da\ud4db\ud4dc\ud4dd\ud4de\ud4df\ud4e0\ud4e1\ud4e2\ud4e3\ud4e4\ud4e5\ud4e6\ud4e7\ud4e8\ud4e9\ud4ea\ud4eb\ud4ec\ud4ed\ud4ee\ud4ef\ud4f0\ud4f1\ud4f2\ud4f3\ud4f4\ud4f5\ud4f6\ud4f7\ud4f8\ud4f9\ud4fa\ud4fb\ud4fc\ud4fd\ud4fe\ud4ff\ud500\ud501\ud502\ud503\ud504\ud505\ud506\ud507\ud508\ud509\ud50a\ud50b\ud50c\ud50d\ud50e\ud50f\ud510\ud511\ud512\ud513\ud514\ud515\ud516\ud517\ud518\ud519\ud51a\ud51b\ud51c\ud51d\ud51e\ud51f\ud520\ud521\ud522\ud523\ud524\ud525\ud526\ud527\ud528\ud529\ud52a\ud52b\ud52c\ud52d\ud52e\ud52f\ud530\ud531\ud532\ud533\ud534\ud535\ud536\ud537\ud538\ud539\ud53a\ud53b\ud53c\ud53d\ud53e\ud53f\ud540\ud541\ud542\ud543\ud544\ud545\ud546\ud547\ud548\ud549\ud54a\ud54b\ud54c\ud54d\ud54e\ud54f\ud550\ud551\ud552\ud553\ud554\ud555\ud556\ud557\ud558\ud559\ud55a\ud55b\ud55c\ud55d\ud55e\ud55f\ud560\ud561\ud562\ud563\ud564\ud565\ud566\ud567\ud568\ud569\ud56a\ud56b\ud56c\ud56d\ud56e\ud56f\ud570\ud571\ud572\ud573\ud574\ud575\ud576\ud577\ud578\ud579\ud57a\ud57b\ud57c\ud57d\ud57e\ud57f\ud580\ud581\ud582\ud583\ud584\ud585\ud586\ud587\ud588\ud589\ud58a\ud58b\ud58c\ud58d\ud58e\ud58f\ud590\ud591\ud592\ud593\ud594\ud595\ud596\ud597\ud598\ud599\ud59a\ud59b\ud59c\ud59d\ud59e\ud59f\ud5a0\ud5a1\ud5a2\ud5a3\ud5a4\ud5a5\ud5a6\ud5a7\ud5a8\ud5a9\ud5aa\ud5ab\ud5ac\ud5ad\ud5ae\ud5af\ud5b0\ud5b1\ud5b2\ud5b3\ud5b4\ud5b5\ud5b6\ud5b7\ud5b8\ud5b9\ud5ba\ud5bb\ud5bc\ud5bd\ud5be\ud5bf\ud5c0\ud5c1\ud5c2\ud5c3\ud5c4\ud5c5\ud5c6\ud5c7\ud5c8\ud5c9\ud5ca\ud5cb\ud5cc\ud5cd\ud5ce\ud5cf\ud5d0\ud5d1\ud5d2\ud5d3\ud5d4\ud5d5\ud5d6\ud5d7\ud5d8\ud5d9\ud5da\ud5db\ud5dc\ud5dd\ud5de\ud5df\ud5e0\ud5e1\ud5e2\ud5e3\ud5e4\ud5e5\ud5e6\ud5e7\ud5e8\ud5e9\ud5ea\ud5eb\ud5ec\ud5ed\ud5ee\ud5ef\ud5f0\ud5f1\ud5f2\ud5f3\ud5f4\ud5f5\ud5f6\ud5f7\ud5f8\ud5f9\ud5fa\ud5fb\ud5fc\ud5fd\ud5fe\ud5ff\ud600\ud601\ud602\ud603\ud604\ud605\ud606\ud607\ud608\ud609\ud60a\ud60b\ud60c\ud60d\ud60e\ud60f\ud610\ud611\ud612\ud613\ud614\ud615\ud616\ud617\ud618\ud619\ud61a\ud61b\ud61c\ud61d\ud61e\ud61f\ud620\ud621\ud622\ud623\ud624\ud625\ud626\ud627\ud628\ud629\ud62a\ud62b\ud62c\ud62d\ud62e\ud62f\ud630\ud631\ud632\ud633\ud634\ud635\ud636\ud637\ud638\ud639\ud63a\ud63b\ud63c\ud63d\ud63e\ud63f\ud640\ud641\ud642\ud643\ud644\ud645\ud646\ud647\ud648\ud649\ud64a\ud64b\ud64c\ud64d\ud64e\ud64f\ud650\ud651\ud652\ud653\ud654\ud655\ud656\ud657\ud658\ud659\ud65a\ud65b\ud65c\ud65d\ud65e\ud65f\ud660\ud661\ud662\ud663\ud664\ud665\ud666\ud667\ud668\ud669\ud66a\ud66b\ud66c\ud66d\ud66e\ud66f\ud670\ud671\ud672\ud673\ud674\ud675\ud676\ud677\ud678\ud679\ud67a\ud67b\ud67c\ud67d\ud67e\ud67f\ud680\ud681\ud682\ud683\ud684\ud685\ud686\ud687\ud688\ud689\ud68a\ud68b\ud68c\ud68d\ud68e\ud68f\ud690\ud691\ud692\ud693\ud694\ud695\ud696\ud697\ud698\ud699\ud69a\ud69b\ud69c\ud69d\ud69e\ud69f\ud6a0\ud6a1\ud6a2\ud6a3\ud6a4\ud6a5\ud6a6\ud6a7\ud6a8\ud6a9\ud6aa\ud6ab\ud6ac\ud6ad\ud6ae\ud6af\ud6b0\ud6b1\ud6b2\ud6b3\ud6b4\ud6b5\ud6b6\ud6b7\ud6b8\ud6b9\ud6ba\ud6bb\ud6bc\ud6bd\ud6be\ud6bf\ud6c0\ud6c1\ud6c2\ud6c3\ud6c4\ud6c5\ud6c6\ud6c7\ud6c8\ud6c9\ud6ca\ud6cb\ud6cc\ud6cd\ud6ce\ud6cf\ud6d0\ud6d1\ud6d2\ud6d3\ud6d4\ud6d5\ud6d6\ud6d7\ud6d8\ud6d9\ud6da\ud6db\ud6dc\ud6dd\ud6de\ud6df\ud6e0\ud6e1\ud6e2\ud6e3\ud6e4\ud6e5\ud6e6\ud6e7\ud6e8\ud6e9\ud6ea\ud6eb\ud6ec\ud6ed\ud6ee\ud6ef\ud6f0\ud6f1\ud6f2\ud6f3\ud6f4\ud6f5\ud6f6\ud6f7\ud6f8\ud6f9\ud6fa\ud6fb\ud6fc\ud6fd\ud6fe\ud6ff\ud700\ud701\ud702\ud703\ud704\ud705\ud706\ud707\ud708\ud709\ud70a\ud70b\ud70c\ud70d\ud70e\ud70f\ud710\ud711\ud712\ud713\ud714\ud715\ud716\ud717\ud718\ud719\ud71a\ud71b\ud71c\ud71d\ud71e\ud71f\ud720\ud721\ud722\ud723\ud724\ud725\ud726\ud727\ud728\ud729\ud72a\ud72b\ud72c\ud72d\ud72e\ud72f\ud730\ud731\ud732\ud733\ud734\ud735\ud736\ud737\ud738\ud739\ud73a\ud73b\ud73c\ud73d\ud73e\ud73f\ud740\ud741\ud742\ud743\ud744\ud745\ud746\ud747\ud748\ud749\ud74a\ud74b\ud74c\ud74d\ud74e\ud74f\ud750\ud751\ud752\ud753\ud754\ud755\ud756\ud757\ud758\ud759\ud75a\ud75b\ud75c\ud75d\ud75e\ud75f\ud760\ud761\ud762\ud763\ud764\ud765\ud766\ud767\ud768\ud769\ud76a\ud76b\ud76c\ud76d\ud76e\ud76f\ud770\ud771\ud772\ud773\ud774\ud775\ud776\ud777\ud778\ud779\ud77a\ud77b\ud77c\ud77d\ud77e\ud77f\ud780\ud781\ud782\ud783\ud784\ud785\ud786\ud787\ud788\ud789\ud78a\ud78b\ud78c\ud78d\ud78e\ud78f\ud790\ud791\ud792\ud793\ud794\ud795\ud796\ud797\ud798\ud799\ud79a\ud79b\ud79c\ud79d\ud79e\ud79f\ud7a0\ud7a1\ud7a2\ud7a3\uf900\uf901\uf902\uf903\uf904\uf905\uf906\uf907\uf908\uf909\uf90a\uf90b\uf90c\uf90d\uf90e\uf90f\uf910\uf911\uf912\uf913\uf914\uf915\uf916\uf917\uf918\uf919\uf91a\uf91b\uf91c\uf91d\uf91e\uf91f\uf920\uf921\uf922\uf923\uf924\uf925\uf926\uf927\uf928\uf929\uf92a\uf92b\uf92c\uf92d\uf92e\uf92f\uf930\uf931\uf932\uf933\uf934\uf935\uf936\uf937\uf938\uf939\uf93a\uf93b\uf93c\uf93d\uf93e\uf93f\uf940\uf941\uf942\uf943\uf944\uf945\uf946\uf947\uf948\uf949\uf94a\uf94b\uf94c\uf94d\uf94e\uf94f\uf950\uf951\uf952\uf953\uf954\uf955\uf956\uf957\uf958\uf959\uf95a\uf95b\uf95c\uf95d\uf95e\uf95f\uf960\uf961\uf962\uf963\uf964\uf965\uf966\uf967\uf968\uf969\uf96a\uf96b\uf96c\uf96d\uf96e\uf96f\uf970\uf971\uf972\uf973\uf974\uf975\uf976\uf977\uf978\uf979\uf97a\uf97b\uf97c\uf97d\uf97e\uf97f\uf980\uf981\uf982\uf983\uf984\uf985\uf986\uf987\uf988\uf989\uf98a\uf98b\uf98c\uf98d\uf98e\uf98f\uf990\uf991\uf992\uf993\uf994\uf995\uf996\uf997\uf998\uf999\uf99a\uf99b\uf99c\uf99d\uf99e\uf99f\uf9a0\uf9a1\uf9a2\uf9a3\uf9a4\uf9a5\uf9a6\uf9a7\uf9a8\uf9a9\uf9aa\uf9ab\uf9ac\uf9ad\uf9ae\uf9af\uf9b0\uf9b1\uf9b2\uf9b3\uf9b4\uf9b5\uf9b6\uf9b7\uf9b8\uf9b9\uf9ba\uf9bb\uf9bc\uf9bd\uf9be\uf9bf\uf9c0\uf9c1\uf9c2\uf9c3\uf9c4\uf9c5\uf9c6\uf9c7\uf9c8\uf9c9\uf9ca\uf9cb\uf9cc\uf9cd\uf9ce\uf9cf\uf9d0\uf9d1\uf9d2\uf9d3\uf9d4\uf9d5\uf9d6\uf9d7\uf9d8\uf9d9\uf9da\uf9db\uf9dc\uf9dd\uf9de\uf9df\uf9e0\uf9e1\uf9e2\uf9e3\uf9e4\uf9e5\uf9e6\uf9e7\uf9e8\uf9e9\uf9ea\uf9eb\uf9ec\uf9ed\uf9ee\uf9ef\uf9f0\uf9f1\uf9f2\uf9f3\uf9f4\uf9f5\uf9f6\uf9f7\uf9f8\uf9f9\uf9fa\uf9fb\uf9fc\uf9fd\uf9fe\uf9ff\ufa00\ufa01\ufa02\ufa03\ufa04\ufa05\ufa06\ufa07\ufa08\ufa09\ufa0a\ufa0b\ufa0c\ufa0d\ufa0e\ufa0f\ufa10\ufa11\ufa12\ufa13\ufa14\ufa15\ufa16\ufa17\ufa18\ufa19\ufa1a\ufa1b\ufa1c\ufa1d\ufa1e\ufa1f\ufa20\ufa21\ufa22\ufa23\ufa24\ufa25\ufa26\ufa27\ufa28\ufa29\ufa2a\ufa2b\ufa2c\ufa2d\ufa30\ufa31\ufa32\ufa33\ufa34\ufa35\ufa36\ufa37\ufa38\ufa39\ufa3a\ufa3b\ufa3c\ufa3d\ufa3e\ufa3f\ufa40\ufa41\ufa42\ufa43\ufa44\ufa45\ufa46\ufa47\ufa48\ufa49\ufa4a\ufa4b\ufa4c\ufa4d\ufa4e\ufa4f\ufa50\ufa51\ufa52\ufa53\ufa54\ufa55\ufa56\ufa57\ufa58\ufa59\ufa5a\ufa5b\ufa5c\ufa5d\ufa5e\ufa5f\ufa60\ufa61\ufa62\ufa63\ufa64\ufa65\ufa66\ufa67\ufa68\ufa69\ufa6a\ufa70\ufa71\ufa72\ufa73\ufa74\ufa75\ufa76\ufa77\ufa78\ufa79\ufa7a\ufa7b\ufa7c\ufa7d\ufa7e\ufa7f\ufa80\ufa81\ufa82\ufa83\ufa84\ufa85\ufa86\ufa87\ufa88\ufa89\ufa8a\ufa8b\ufa8c\ufa8d\ufa8e\ufa8f\ufa90\ufa91\ufa92\ufa93\ufa94\ufa95\ufa96\ufa97\ufa98\ufa99\ufa9a\ufa9b\ufa9c\ufa9d\ufa9e\ufa9f\ufaa0\ufaa1\ufaa2\ufaa3\ufaa4\ufaa5\ufaa6\ufaa7\ufaa8\ufaa9\ufaaa\ufaab\ufaac\ufaad\ufaae\ufaaf\ufab0\ufab1\ufab2\ufab3\ufab4\ufab5\ufab6\ufab7\ufab8\ufab9\ufaba\ufabb\ufabc\ufabd\ufabe\ufabf\ufac0\ufac1\ufac2\ufac3\ufac4\ufac5\ufac6\ufac7\ufac8\ufac9\ufaca\ufacb\ufacc\ufacd\uface\ufacf\ufad0\ufad1\ufad2\ufad3\ufad4\ufad5\ufad6\ufad7\ufad8\ufad9\ufb1d\ufb1f\ufb20\ufb21\ufb22\ufb23\ufb24\ufb25\ufb26\ufb27\ufb28\ufb2a\ufb2b\ufb2c\ufb2d\ufb2e\ufb2f\ufb30\ufb31\ufb32\ufb33\ufb34\ufb35\ufb36\ufb38\ufb39\ufb3a\ufb3b\ufb3c\ufb3e\ufb40\ufb41\ufb43\ufb44\ufb46\ufb47\ufb48\ufb49\ufb4a\ufb4b\ufb4c\ufb4d\ufb4e\ufb4f\ufb50\ufb51\ufb52\ufb53\ufb54\ufb55\ufb56\ufb57\ufb58\ufb59\ufb5a\ufb5b\ufb5c\ufb5d\ufb5e\ufb5f\ufb60\ufb61\ufb62\ufb63\ufb64\ufb65\ufb66\ufb67\ufb68\ufb69\ufb6a\ufb6b\ufb6c\ufb6d\ufb6e\ufb6f\ufb70\ufb71\ufb72\ufb73\ufb74\ufb75\ufb76\ufb77\ufb78\ufb79\ufb7a\ufb7b\ufb7c\ufb7d\ufb7e\ufb7f\ufb80\ufb81\ufb82\ufb83\ufb84\ufb85\ufb86\ufb87\ufb88\ufb89\ufb8a\ufb8b\ufb8c\ufb8d\ufb8e\ufb8f\ufb90\ufb91\ufb92\ufb93\ufb94\ufb95\ufb96\ufb97\ufb98\ufb99\ufb9a\ufb9b\ufb9c\ufb9d\ufb9e\ufb9f\ufba0\ufba1\ufba2\ufba3\ufba4\ufba5\ufba6\ufba7\ufba8\ufba9\ufbaa\ufbab\ufbac\ufbad\ufbae\ufbaf\ufbb0\ufbb1\ufbd3\ufbd4\ufbd5\ufbd6\ufbd7\ufbd8\ufbd9\ufbda\ufbdb\ufbdc\ufbdd\ufbde\ufbdf\ufbe0\ufbe1\ufbe2\ufbe3\ufbe4\ufbe5\ufbe6\ufbe7\ufbe8\ufbe9\ufbea\ufbeb\ufbec\ufbed\ufbee\ufbef\ufbf0\ufbf1\ufbf2\ufbf3\ufbf4\ufbf5\ufbf6\ufbf7\ufbf8\ufbf9\ufbfa\ufbfb\ufbfc\ufbfd\ufbfe\ufbff\ufc00\ufc01\ufc02\ufc03\ufc04\ufc05\ufc06\ufc07\ufc08\ufc09\ufc0a\ufc0b\ufc0c\ufc0d\ufc0e\ufc0f\ufc10\ufc11\ufc12\ufc13\ufc14\ufc15\ufc16\ufc17\ufc18\ufc19\ufc1a\ufc1b\ufc1c\ufc1d\ufc1e\ufc1f\ufc20\ufc21\ufc22\ufc23\ufc24\ufc25\ufc26\ufc27\ufc28\ufc29\ufc2a\ufc2b\ufc2c\ufc2d\ufc2e\ufc2f\ufc30\ufc31\ufc32\ufc33\ufc34\ufc35\ufc36\ufc37\ufc38\ufc39\ufc3a\ufc3b\ufc3c\ufc3d\ufc3e\ufc3f\ufc40\ufc41\ufc42\ufc43\ufc44\ufc45\ufc46\ufc47\ufc48\ufc49\ufc4a\ufc4b\ufc4c\ufc4d\ufc4e\ufc4f\ufc50\ufc51\ufc52\ufc53\ufc54\ufc55\ufc56\ufc57\ufc58\ufc59\ufc5a\ufc5b\ufc5c\ufc5d\ufc5e\ufc5f\ufc60\ufc61\ufc62\ufc63\ufc64\ufc65\ufc66\ufc67\ufc68\ufc69\ufc6a\ufc6b\ufc6c\ufc6d\ufc6e\ufc6f\ufc70\ufc71\ufc72\ufc73\ufc74\ufc75\ufc76\ufc77\ufc78\ufc79\ufc7a\ufc7b\ufc7c\ufc7d\ufc7e\ufc7f\ufc80\ufc81\ufc82\ufc83\ufc84\ufc85\ufc86\ufc87\ufc88\ufc89\ufc8a\ufc8b\ufc8c\ufc8d\ufc8e\ufc8f\ufc90\ufc91\ufc92\ufc93\ufc94\ufc95\ufc96\ufc97\ufc98\ufc99\ufc9a\ufc9b\ufc9c\ufc9d\ufc9e\ufc9f\ufca0\ufca1\ufca2\ufca3\ufca4\ufca5\ufca6\ufca7\ufca8\ufca9\ufcaa\ufcab\ufcac\ufcad\ufcae\ufcaf\ufcb0\ufcb1\ufcb2\ufcb3\ufcb4\ufcb5\ufcb6\ufcb7\ufcb8\ufcb9\ufcba\ufcbb\ufcbc\ufcbd\ufcbe\ufcbf\ufcc0\ufcc1\ufcc2\ufcc3\ufcc4\ufcc5\ufcc6\ufcc7\ufcc8\ufcc9\ufcca\ufccb\ufccc\ufccd\ufcce\ufccf\ufcd0\ufcd1\ufcd2\ufcd3\ufcd4\ufcd5\ufcd6\ufcd7\ufcd8\ufcd9\ufcda\ufcdb\ufcdc\ufcdd\ufcde\ufcdf\ufce0\ufce1\ufce2\ufce3\ufce4\ufce5\ufce6\ufce7\ufce8\ufce9\ufcea\ufceb\ufcec\ufced\ufcee\ufcef\ufcf0\ufcf1\ufcf2\ufcf3\ufcf4\ufcf5\ufcf6\ufcf7\ufcf8\ufcf9\ufcfa\ufcfb\ufcfc\ufcfd\ufcfe\ufcff\ufd00\ufd01\ufd02\ufd03\ufd04\ufd05\ufd06\ufd07\ufd08\ufd09\ufd0a\ufd0b\ufd0c\ufd0d\ufd0e\ufd0f\ufd10\ufd11\ufd12\ufd13\ufd14\ufd15\ufd16\ufd17\ufd18\ufd19\ufd1a\ufd1b\ufd1c\ufd1d\ufd1e\ufd1f\ufd20\ufd21\ufd22\ufd23\ufd24\ufd25\ufd26\ufd27\ufd28\ufd29\ufd2a\ufd2b\ufd2c\ufd2d\ufd2e\ufd2f\ufd30\ufd31\ufd32\ufd33\ufd34\ufd35\ufd36\ufd37\ufd38\ufd39\ufd3a\ufd3b\ufd3c\ufd3d\ufd50\ufd51\ufd52\ufd53\ufd54\ufd55\ufd56\ufd57\ufd58\ufd59\ufd5a\ufd5b\ufd5c\ufd5d\ufd5e\ufd5f\ufd60\ufd61\ufd62\ufd63\ufd64\ufd65\ufd66\ufd67\ufd68\ufd69\ufd6a\ufd6b\ufd6c\ufd6d\ufd6e\ufd6f\ufd70\ufd71\ufd72\ufd73\ufd74\ufd75\ufd76\ufd77\ufd78\ufd79\ufd7a\ufd7b\ufd7c\ufd7d\ufd7e\ufd7f\ufd80\ufd81\ufd82\ufd83\ufd84\ufd85\ufd86\ufd87\ufd88\ufd89\ufd8a\ufd8b\ufd8c\ufd8d\ufd8e\ufd8f\ufd92\ufd93\ufd94\ufd95\ufd96\ufd97\ufd98\ufd99\ufd9a\ufd9b\ufd9c\ufd9d\ufd9e\ufd9f\ufda0\ufda1\ufda2\ufda3\ufda4\ufda5\ufda6\ufda7\ufda8\ufda9\ufdaa\ufdab\ufdac\ufdad\ufdae\ufdaf\ufdb0\ufdb1\ufdb2\ufdb3\ufdb4\ufdb5\ufdb6\ufdb7\ufdb8\ufdb9\ufdba\ufdbb\ufdbc\ufdbd\ufdbe\ufdbf\ufdc0\ufdc1\ufdc2\ufdc3\ufdc4\ufdc5\ufdc6\ufdc7\ufdf0\ufdf1\ufdf2\ufdf3\ufdf4\ufdf5\ufdf6\ufdf7\ufdf8\ufdf9\ufdfa\ufdfb\ufe70\ufe71\ufe72\ufe73\ufe74\ufe76\ufe77\ufe78\ufe79\ufe7a\ufe7b\ufe7c\ufe7d\ufe7e\ufe7f\ufe80\ufe81\ufe82\ufe83\ufe84\ufe85\ufe86\ufe87\ufe88\ufe89\ufe8a\ufe8b\ufe8c\ufe8d\ufe8e\ufe8f\ufe90\ufe91\ufe92\ufe93\ufe94\ufe95\ufe96\ufe97\ufe98\ufe99\ufe9a\ufe9b\ufe9c\ufe9d\ufe9e\ufe9f\ufea0\ufea1\ufea2\ufea3\ufea4\ufea5\ufea6\ufea7\ufea8\ufea9\ufeaa\ufeab\ufeac\ufead\ufeae\ufeaf\ufeb0\ufeb1\ufeb2\ufeb3\ufeb4\ufeb5\ufeb6\ufeb7\ufeb8\ufeb9\ufeba\ufebb\ufebc\ufebd\ufebe\ufebf\ufec0\ufec1\ufec2\ufec3\ufec4\ufec5\ufec6\ufec7\ufec8\ufec9\ufeca\ufecb\ufecc\ufecd\ufece\ufecf\ufed0\ufed1\ufed2\ufed3\ufed4\ufed5\ufed6\ufed7\ufed8\ufed9\ufeda\ufedb\ufedc\ufedd\ufede\ufedf\ufee0\ufee1\ufee2\ufee3\ufee4\ufee5\ufee6\ufee7\ufee8\ufee9\ufeea\ufeeb\ufeec\ufeed\ufeee\ufeef\ufef0\ufef1\ufef2\ufef3\ufef4\ufef5\ufef6\ufef7\ufef8\ufef9\ufefa\ufefb\ufefc\uff66\uff67\uff68\uff69\uff6a\uff6b\uff6c\uff6d\uff6e\uff6f\uff71\uff72\uff73\uff74\uff75\uff76\uff77\uff78\uff79\uff7a\uff7b\uff7c\uff7d\uff7e\uff7f\uff80\uff81\uff82\uff83\uff84\uff85\uff86\uff87\uff88\uff89\uff8a\uff8b\uff8c\uff8d\uff8e\uff8f\uff90\uff91\uff92\uff93\uff94\uff95\uff96\uff97\uff98\uff99\uff9a\uff9b\uff9c\uff9d\uffa0\uffa1\uffa2\uffa3\uffa4\uffa5\uffa6\uffa7\uffa8\uffa9\uffaa\uffab\uffac\uffad\uffae\uffaf\uffb0\uffb1\uffb2\uffb3\uffb4\uffb5\uffb6\uffb7\uffb8\uffb9\uffba\uffbb\uffbc\uffbd\uffbe\uffc2\uffc3\uffc4\uffc5\uffc6\uffc7\uffca\uffcb\uffcc\uffcd\uffce\uffcf\uffd2\uffd3\uffd4\uffd5\uffd6\uffd7\uffda\uffdb\uffdc'
-
-Lt = u'\u01c5\u01c8\u01cb\u01f2\u1f88\u1f89\u1f8a\u1f8b\u1f8c\u1f8d\u1f8e\u1f8f\u1f98\u1f99\u1f9a\u1f9b\u1f9c\u1f9d\u1f9e\u1f9f\u1fa8\u1fa9\u1faa\u1fab\u1fac\u1fad\u1fae\u1faf\u1fbc\u1fcc\u1ffc'
-
-Lu = u'ABCDEFGHIJKLMNOPQRSTUVWXYZ\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd8\xd9\xda\xdb\xdc\xdd\xde\u0100\u0102\u0104\u0106\u0108\u010a\u010c\u010e\u0110\u0112\u0114\u0116\u0118\u011a\u011c\u011e\u0120\u0122\u0124\u0126\u0128\u012a\u012c\u012e\u0130\u0132\u0134\u0136\u0139\u013b\u013d\u013f\u0141\u0143\u0145\u0147\u014a\u014c\u014e\u0150\u0152\u0154\u0156\u0158\u015a\u015c\u015e\u0160\u0162\u0164\u0166\u0168\u016a\u016c\u016e\u0170\u0172\u0174\u0176\u0178\u0179\u017b\u017d\u0181\u0182\u0184\u0186\u0187\u0189\u018a\u018b\u018e\u018f\u0190\u0191\u0193\u0194\u0196\u0197\u0198\u019c\u019d\u019f\u01a0\u01a2\u01a4\u01a6\u01a7\u01a9\u01ac\u01ae\u01af\u01b1\u01b2\u01b3\u01b5\u01b7\u01b8\u01bc\u01c4\u01c7\u01ca\u01cd\u01cf\u01d1\u01d3\u01d5\u01d7\u01d9\u01db\u01de\u01e0\u01e2\u01e4\u01e6\u01e8\u01ea\u01ec\u01ee\u01f1\u01f4\u01f6\u01f7\u01f8\u01fa\u01fc\u01fe\u0200\u0202\u0204\u0206\u0208\u020a\u020c\u020e\u0210\u0212\u0214\u0216\u0218\u021a\u021c\u021e\u0220\u0222\u0224\u0226\u0228\u022a\u022c\u022e\u0230\u0232\u023a\u023b\u023d\u023e\u0241\u0386\u0388\u0389\u038a\u038c\u038e\u038f\u0391\u0392\u0393\u0394\u0395\u0396\u0397\u0398\u0399\u039a\u039b\u039c\u039d\u039e\u039f\u03a0\u03a1\u03a3\u03a4\u03a5\u03a6\u03a7\u03a8\u03a9\u03aa\u03ab\u03d2\u03d3\u03d4\u03d8\u03da\u03dc\u03de\u03e0\u03e2\u03e4\u03e6\u03e8\u03ea\u03ec\u03ee\u03f4\u03f7\u03f9\u03fa\u03fd\u03fe\u03ff\u0400\u0401\u0402\u0403\u0404\u0405\u0406\u0407\u0408\u0409\u040a\u040b\u040c\u040d\u040e\u040f\u0410\u0411\u0412\u0413\u0414\u0415\u0416\u0417\u0418\u0419\u041a\u041b\u041c\u041d\u041e\u041f\u0420\u0421\u0422\u0423\u0424\u0425\u0426\u0427\u0428\u0429\u042a\u042b\u042c\u042d\u042e\u042f\u0460\u0462\u0464\u0466\u0468\u046a\u046c\u046e\u0470\u0472\u0474\u0476\u0478\u047a\u047c\u047e\u0480\u048a\u048c\u048e\u0490\u0492\u0494\u0496\u0498\u049a\u049c\u049e\u04a0\u04a2\u04a4\u04a6\u04a8\u04aa\u04ac\u04ae\u04b0\u04b2\u04b4\u04b6\u04b8\u04ba\u04bc\u04be\u04c0\u04c1\u04c3\u04c5\u04c7\u04c9\u04cb\u04cd\u04d0\u04d2\u04d4\u04d6\u04d8\u04da\u04dc\u04de\u04e0\u04e2\u04e4\u04e6\u04e8\u04ea\u04ec\u04ee\u04f0\u04f2\u04f4\u04f6\u04f8\u0500\u0502\u0504\u0506\u0508\u050a\u050c\u050e\u0531\u0532\u0533\u0534\u0535\u0536\u0537\u0538\u0539\u053a\u053b\u053c\u053d\u053e\u053f\u0540\u0541\u0542\u0543\u0544\u0545\u0546\u0547\u0548\u0549\u054a\u054b\u054c\u054d\u054e\u054f\u0550\u0551\u0552\u0553\u0554\u0555\u0556\u10a0\u10a1\u10a2\u10a3\u10a4\u10a5\u10a6\u10a7\u10a8\u10a9\u10aa\u10ab\u10ac\u10ad\u10ae\u10af\u10b0\u10b1\u10b2\u10b3\u10b4\u10b5\u10b6\u10b7\u10b8\u10b9\u10ba\u10bb\u10bc\u10bd\u10be\u10bf\u10c0\u10c1\u10c2\u10c3\u10c4\u10c5\u1e00\u1e02\u1e04\u1e06\u1e08\u1e0a\u1e0c\u1e0e\u1e10\u1e12\u1e14\u1e16\u1e18\u1e1a\u1e1c\u1e1e\u1e20\u1e22\u1e24\u1e26\u1e28\u1e2a\u1e2c\u1e2e\u1e30\u1e32\u1e34\u1e36\u1e38\u1e3a\u1e3c\u1e3e\u1e40\u1e42\u1e44\u1e46\u1e48\u1e4a\u1e4c\u1e4e\u1e50\u1e52\u1e54\u1e56\u1e58\u1e5a\u1e5c\u1e5e\u1e60\u1e62\u1e64\u1e66\u1e68\u1e6a\u1e6c\u1e6e\u1e70\u1e72\u1e74\u1e76\u1e78\u1e7a\u1e7c\u1e7e\u1e80\u1e82\u1e84\u1e86\u1e88\u1e8a\u1e8c\u1e8e\u1e90\u1e92\u1e94\u1ea0\u1ea2\u1ea4\u1ea6\u1ea8\u1eaa\u1eac\u1eae\u1eb0\u1eb2\u1eb4\u1eb6\u1eb8\u1eba\u1ebc\u1ebe\u1ec0\u1ec2\u1ec4\u1ec6\u1ec8\u1eca\u1ecc\u1ece\u1ed0\u1ed2\u1ed4\u1ed6\u1ed8\u1eda\u1edc\u1ede\u1ee0\u1ee2\u1ee4\u1ee6\u1ee8\u1eea\u1eec\u1eee\u1ef0\u1ef2\u1ef4\u1ef6\u1ef8\u1f08\u1f09\u1f0a\u1f0b\u1f0c\u1f0d\u1f0e\u1f0f\u1f18\u1f19\u1f1a\u1f1b\u1f1c\u1f1d\u1f28\u1f29\u1f2a\u1f2b\u1f2c\u1f2d\u1f2e\u1f2f\u1f38\u1f39\u1f3a\u1f3b\u1f3c\u1f3d\u1f3e\u1f3f\u1f48\u1f49\u1f4a\u1f4b\u1f4c\u1f4d\u1f59\u1f5b\u1f5d\u1f5f\u1f68\u1f69\u1f6a\u1f6b\u1f6c\u1f6d\u1f6e\u1f6f\u1fb8\u1fb9\u1fba\u1fbb\u1fc8\u1fc9\u1fca\u1fcb\u1fd8\u1fd9\u1fda\u1fdb\u1fe8\u1fe9\u1fea\u1feb\u1fec\u1ff8\u1ff9\u1ffa\u1ffb\u2102\u2107\u210b\u210c\u210d\u2110\u2111\u2112\u2115\u2119\u211a\u211b\u211c\u211d\u2124\u2126\u2128\u212a\u212b\u212c\u212d\u2130\u2131\u2133\u213e\u213f\u2145\u2c00\u2c01\u2c02\u2c03\u2c04\u2c05\u2c06\u2c07\u2c08\u2c09\u2c0a\u2c0b\u2c0c\u2c0d\u2c0e\u2c0f\u2c10\u2c11\u2c12\u2c13\u2c14\u2c15\u2c16\u2c17\u2c18\u2c19\u2c1a\u2c1b\u2c1c\u2c1d\u2c1e\u2c1f\u2c20\u2c21\u2c22\u2c23\u2c24\u2c25\u2c26\u2c27\u2c28\u2c29\u2c2a\u2c2b\u2c2c\u2c2d\u2c2e\u2c80\u2c82\u2c84\u2c86\u2c88\u2c8a\u2c8c\u2c8e\u2c90\u2c92\u2c94\u2c96\u2c98\u2c9a\u2c9c\u2c9e\u2ca0\u2ca2\u2ca4\u2ca6\u2ca8\u2caa\u2cac\u2cae\u2cb0\u2cb2\u2cb4\u2cb6\u2cb8\u2cba\u2cbc\u2cbe\u2cc0\u2cc2\u2cc4\u2cc6\u2cc8\u2cca\u2ccc\u2cce\u2cd0\u2cd2\u2cd4\u2cd6\u2cd8\u2cda\u2cdc\u2cde\u2ce0\u2ce2\uff21\uff22\uff23\uff24\uff25\uff26\uff27\uff28\uff29\uff2a\uff2b\uff2c\uff2d\uff2e\uff2f\uff30\uff31\uff32\uff33\uff34\uff35\uff36\uff37\uff38\uff39\uff3a'
-
-Mc = u'\u0903\u093e\u093f\u0940\u0949\u094a\u094b\u094c\u0982\u0983\u09be\u09bf\u09c0\u09c7\u09c8\u09cb\u09cc\u09d7\u0a03\u0a3e\u0a3f\u0a40\u0a83\u0abe\u0abf\u0ac0\u0ac9\u0acb\u0acc\u0b02\u0b03\u0b3e\u0b40\u0b47\u0b48\u0b4b\u0b4c\u0b57\u0bbe\u0bbf\u0bc1\u0bc2\u0bc6\u0bc7\u0bc8\u0bca\u0bcb\u0bcc\u0bd7\u0c01\u0c02\u0c03\u0c41\u0c42\u0c43\u0c44\u0c82\u0c83\u0cbe\u0cc0\u0cc1\u0cc2\u0cc3\u0cc4\u0cc7\u0cc8\u0cca\u0ccb\u0cd5\u0cd6\u0d02\u0d03\u0d3e\u0d3f\u0d40\u0d46\u0d47\u0d48\u0d4a\u0d4b\u0d4c\u0d57\u0d82\u0d83\u0dcf\u0dd0\u0dd1\u0dd8\u0dd9\u0dda\u0ddb\u0ddc\u0ddd\u0dde\u0ddf\u0df2\u0df3\u0f3e\u0f3f\u0f7f\u102c\u1031\u1038\u1056\u1057\u17b6\u17be\u17bf\u17c0\u17c1\u17c2\u17c3\u17c4\u17c5\u17c7\u17c8\u1923\u1924\u1925\u1926\u1929\u192a\u192b\u1930\u1931\u1933\u1934\u1935\u1936\u1937\u1938\u19b0\u19b1\u19b2\u19b3\u19b4\u19b5\u19b6\u19b7\u19b8\u19b9\u19ba\u19bb\u19bc\u19bd\u19be\u19bf\u19c0\u19c8\u19c9\u1a19\u1a1a\u1a1b\ua802\ua823\ua824\ua827'
-
-Me = u'\u0488\u0489\u06de\u20dd\u20de\u20df\u20e0\u20e2\u20e3\u20e4'
-
-Mn = u'\u0300\u0301\u0302\u0303\u0304\u0305\u0306\u0307\u0308\u0309\u030a\u030b\u030c\u030d\u030e\u030f\u0310\u0311\u0312\u0313\u0314\u0315\u0316\u0317\u0318\u0319\u031a\u031b\u031c\u031d\u031e\u031f\u0320\u0321\u0322\u0323\u0324\u0325\u0326\u0327\u0328\u0329\u032a\u032b\u032c\u032d\u032e\u032f\u0330\u0331\u0332\u0333\u0334\u0335\u0336\u0337\u0338\u0339\u033a\u033b\u033c\u033d\u033e\u033f\u0340\u0341\u0342\u0343\u0344\u0345\u0346\u0347\u0348\u0349\u034a\u034b\u034c\u034d\u034e\u034f\u0350\u0351\u0352\u0353\u0354\u0355\u0356\u0357\u0358\u0359\u035a\u035b\u035c\u035d\u035e\u035f\u0360\u0361\u0362\u0363\u0364\u0365\u0366\u0367\u0368\u0369\u036a\u036b\u036c\u036d\u036e\u036f\u0483\u0484\u0485\u0486\u0591\u0592\u0593\u0594\u0595\u0596\u0597\u0598\u0599\u059a\u059b\u059c\u059d\u059e\u059f\u05a0\u05a1\u05a2\u05a3\u05a4\u05a5\u05a6\u05a7\u05a8\u05a9\u05aa\u05ab\u05ac\u05ad\u05ae\u05af\u05b0\u05b1\u05b2\u05b3\u05b4\u05b5\u05b6\u05b7\u05b8\u05b9\u05bb\u05bc\u05bd\u05bf\u05c1\u05c2\u05c4\u05c5\u05c7\u0610\u0611\u0612\u0613\u0614\u0615\u064b\u064c\u064d\u064e\u064f\u0650\u0651\u0652\u0653\u0654\u0655\u0656\u0657\u0658\u0659\u065a\u065b\u065c\u065d\u065e\u0670\u06d6\u06d7\u06d8\u06d9\u06da\u06db\u06dc\u06df\u06e0\u06e1\u06e2\u06e3\u06e4\u06e7\u06e8\u06ea\u06eb\u06ec\u06ed\u0711\u0730\u0731\u0732\u0733\u0734\u0735\u0736\u0737\u0738\u0739\u073a\u073b\u073c\u073d\u073e\u073f\u0740\u0741\u0742\u0743\u0744\u0745\u0746\u0747\u0748\u0749\u074a\u07a6\u07a7\u07a8\u07a9\u07aa\u07ab\u07ac\u07ad\u07ae\u07af\u07b0\u0901\u0902\u093c\u0941\u0942\u0943\u0944\u0945\u0946\u0947\u0948\u094d\u0951\u0952\u0953\u0954\u0962\u0963\u0981\u09bc\u09c1\u09c2\u09c3\u09c4\u09cd\u09e2\u09e3\u0a01\u0a02\u0a3c\u0a41\u0a42\u0a47\u0a48\u0a4b\u0a4c\u0a4d\u0a70\u0a71\u0a81\u0a82\u0abc\u0ac1\u0ac2\u0ac3\u0ac4\u0ac5\u0ac7\u0ac8\u0acd\u0ae2\u0ae3\u0b01\u0b3c\u0b3f\u0b41\u0b42\u0b43\u0b4d\u0b56\u0b82\u0bc0\u0bcd\u0c3e\u0c3f\u0c40\u0c46\u0c47\u0c48\u0c4a\u0c4b\u0c4c\u0c4d\u0c55\u0c56\u0cbc\u0cbf\u0cc6\u0ccc\u0ccd\u0d41\u0d42\u0d43\u0d4d\u0dca\u0dd2\u0dd3\u0dd4\u0dd6\u0e31\u0e34\u0e35\u0e36\u0e37\u0e38\u0e39\u0e3a\u0e47\u0e48\u0e49\u0e4a\u0e4b\u0e4c\u0e4d\u0e4e\u0eb1\u0eb4\u0eb5\u0eb6\u0eb7\u0eb8\u0eb9\u0ebb\u0ebc\u0ec8\u0ec9\u0eca\u0ecb\u0ecc\u0ecd\u0f18\u0f19\u0f35\u0f37\u0f39\u0f71\u0f72\u0f73\u0f74\u0f75\u0f76\u0f77\u0f78\u0f79\u0f7a\u0f7b\u0f7c\u0f7d\u0f7e\u0f80\u0f81\u0f82\u0f83\u0f84\u0f86\u0f87\u0f90\u0f91\u0f92\u0f93\u0f94\u0f95\u0f96\u0f97\u0f99\u0f9a\u0f9b\u0f9c\u0f9d\u0f9e\u0f9f\u0fa0\u0fa1\u0fa2\u0fa3\u0fa4\u0fa5\u0fa6\u0fa7\u0fa8\u0fa9\u0faa\u0fab\u0fac\u0fad\u0fae\u0faf\u0fb0\u0fb1\u0fb2\u0fb3\u0fb4\u0fb5\u0fb6\u0fb7\u0fb8\u0fb9\u0fba\u0fbb\u0fbc\u0fc6\u102d\u102e\u102f\u1030\u1032\u1036\u1037\u1039\u1058\u1059\u135f\u1712\u1713\u1714\u1732\u1733\u1734\u1752\u1753\u1772\u1773\u17b7\u17b8\u17b9\u17ba\u17bb\u17bc\u17bd\u17c6\u17c9\u17ca\u17cb\u17cc\u17cd\u17ce\u17cf\u17d0\u17d1\u17d2\u17d3\u17dd\u180b\u180c\u180d\u18a9\u1920\u1921\u1922\u1927\u1928\u1932\u1939\u193a\u193b\u1a17\u1a18\u1dc0\u1dc1\u1dc2\u1dc3\u20d0\u20d1\u20d2\u20d3\u20d4\u20d5\u20d6\u20d7\u20d8\u20d9\u20da\u20db\u20dc\u20e1\u20e5\u20e6\u20e7\u20e8\u20e9\u20ea\u20eb\u302a\u302b\u302c\u302d\u302e\u302f\u3099\u309a\ua806\ua80b\ua825\ua826\ufb1e\ufe00\ufe01\ufe02\ufe03\ufe04\ufe05\ufe06\ufe07\ufe08\ufe09\ufe0a\ufe0b\ufe0c\ufe0d\ufe0e\ufe0f\ufe20\ufe21\ufe22\ufe23'
-
-Nd = u'0123456789\u0660\u0661\u0662\u0663\u0664\u0665\u0666\u0667\u0668\u0669\u06f0\u06f1\u06f2\u06f3\u06f4\u06f5\u06f6\u06f7\u06f8\u06f9\u0966\u0967\u0968\u0969\u096a\u096b\u096c\u096d\u096e\u096f\u09e6\u09e7\u09e8\u09e9\u09ea\u09eb\u09ec\u09ed\u09ee\u09ef\u0a66\u0a67\u0a68\u0a69\u0a6a\u0a6b\u0a6c\u0a6d\u0a6e\u0a6f\u0ae6\u0ae7\u0ae8\u0ae9\u0aea\u0aeb\u0aec\u0aed\u0aee\u0aef\u0b66\u0b67\u0b68\u0b69\u0b6a\u0b6b\u0b6c\u0b6d\u0b6e\u0b6f\u0be6\u0be7\u0be8\u0be9\u0bea\u0beb\u0bec\u0bed\u0bee\u0bef\u0c66\u0c67\u0c68\u0c69\u0c6a\u0c6b\u0c6c\u0c6d\u0c6e\u0c6f\u0ce6\u0ce7\u0ce8\u0ce9\u0cea\u0ceb\u0cec\u0ced\u0cee\u0cef\u0d66\u0d67\u0d68\u0d69\u0d6a\u0d6b\u0d6c\u0d6d\u0d6e\u0d6f\u0e50\u0e51\u0e52\u0e53\u0e54\u0e55\u0e56\u0e57\u0e58\u0e59\u0ed0\u0ed1\u0ed2\u0ed3\u0ed4\u0ed5\u0ed6\u0ed7\u0ed8\u0ed9\u0f20\u0f21\u0f22\u0f23\u0f24\u0f25\u0f26\u0f27\u0f28\u0f29\u1040\u1041\u1042\u1043\u1044\u1045\u1046\u1047\u1048\u1049\u17e0\u17e1\u17e2\u17e3\u17e4\u17e5\u17e6\u17e7\u17e8\u17e9\u1810\u1811\u1812\u1813\u1814\u1815\u1816\u1817\u1818\u1819\u1946\u1947\u1948\u1949\u194a\u194b\u194c\u194d\u194e\u194f\u19d0\u19d1\u19d2\u19d3\u19d4\u19d5\u19d6\u19d7\u19d8\u19d9\uff10\uff11\uff12\uff13\uff14\uff15\uff16\uff17\uff18\uff19'
-
-Nl = u'\u16ee\u16ef\u16f0\u2160\u2161\u2162\u2163\u2164\u2165\u2166\u2167\u2168\u2169\u216a\u216b\u216c\u216d\u216e\u216f\u2170\u2171\u2172\u2173\u2174\u2175\u2176\u2177\u2178\u2179\u217a\u217b\u217c\u217d\u217e\u217f\u2180\u2181\u2182\u2183\u3007\u3021\u3022\u3023\u3024\u3025\u3026\u3027\u3028\u3029\u3038\u3039\u303a'
-
-No = u'\xb2\xb3\xb9\xbc\xbd\xbe\u09f4\u09f5\u09f6\u09f7\u09f8\u09f9\u0bf0\u0bf1\u0bf2\u0f2a\u0f2b\u0f2c\u0f2d\u0f2e\u0f2f\u0f30\u0f31\u0f32\u0f33\u1369\u136a\u136b\u136c\u136d\u136e\u136f\u1370\u1371\u1372\u1373\u1374\u1375\u1376\u1377\u1378\u1379\u137a\u137b\u137c\u17f0\u17f1\u17f2\u17f3\u17f4\u17f5\u17f6\u17f7\u17f8\u17f9\u2070\u2074\u2075\u2076\u2077\u2078\u2079\u2080\u2081\u2082\u2083\u2084\u2085\u2086\u2087\u2088\u2089\u2153\u2154\u2155\u2156\u2157\u2158\u2159\u215a\u215b\u215c\u215d\u215e\u215f\u2460\u2461\u2462\u2463\u2464\u2465\u2466\u2467\u2468\u2469\u246a\u246b\u246c\u246d\u246e\u246f\u2470\u2471\u2472\u2473\u2474\u2475\u2476\u2477\u2478\u2479\u247a\u247b\u247c\u247d\u247e\u247f\u2480\u2481\u2482\u2483\u2484\u2485\u2486\u2487\u2488\u2489\u248a\u248b\u248c\u248d\u248e\u248f\u2490\u2491\u2492\u2493\u2494\u2495\u2496\u2497\u2498\u2499\u249a\u249b\u24ea\u24eb\u24ec\u24ed\u24ee\u24ef\u24f0\u24f1\u24f2\u24f3\u24f4\u24f5\u24f6\u24f7\u24f8\u24f9\u24fa\u24fb\u24fc\u24fd\u24fe\u24ff\u2776\u2777\u2778\u2779\u277a\u277b\u277c\u277d\u277e\u277f\u2780\u2781\u2782\u2783\u2784\u2785\u2786\u2787\u2788\u2789\u278a\u278b\u278c\u278d\u278e\u278f\u2790\u2791\u2792\u2793\u2cfd\u3192\u3193\u3194\u3195\u3220\u3221\u3222\u3223\u3224\u3225\u3226\u3227\u3228\u3229\u3251\u3252\u3253\u3254\u3255\u3256\u3257\u3258\u3259\u325a\u325b\u325c\u325d\u325e\u325f\u3280\u3281\u3282\u3283\u3284\u3285\u3286\u3287\u3288\u3289\u32b1\u32b2\u32b3\u32b4\u32b5\u32b6\u32b7\u32b8\u32b9\u32ba\u32bb\u32bc\u32bd\u32be\u32bf'
-
-Pc = u'_\u203f\u2040\u2054\ufe33\ufe34\ufe4d\ufe4e\ufe4f\uff3f'
-
-Pd = u'-\u058a\u1806\u2010\u2011\u2012\u2013\u2014\u2015\u2e17\u301c\u3030\u30a0\ufe31\ufe32\ufe58\ufe63\uff0d'
-
-Pe = u')]}\u0f3b\u0f3d\u169c\u2046\u207e\u208e\u232a\u23b5\u2769\u276b\u276d\u276f\u2771\u2773\u2775\u27c6\u27e7\u27e9\u27eb\u2984\u2986\u2988\u298a\u298c\u298e\u2990\u2992\u2994\u2996\u2998\u29d9\u29db\u29fd\u3009\u300b\u300d\u300f\u3011\u3015\u3017\u3019\u301b\u301e\u301f\ufd3f\ufe18\ufe36\ufe38\ufe3a\ufe3c\ufe3e\ufe40\ufe42\ufe44\ufe48\ufe5a\ufe5c\ufe5e\uff09\uff3d\uff5d\uff60\uff63'
-
-Pf = u'\xbb\u2019\u201d\u203a\u2e03\u2e05\u2e0a\u2e0d\u2e1d'
-
-Pi = u'\xab\u2018\u201b\u201c\u201f\u2039\u2e02\u2e04\u2e09\u2e0c\u2e1c'
-
-Po = u'!"#%&\'*,./:;?@\\\xa1\xb7\xbf\u037e\u0387\u055a\u055b\u055c\u055d\u055e\u055f\u0589\u05be\u05c0\u05c3\u05c6\u05f3\u05f4\u060c\u060d\u061b\u061e\u061f\u066a\u066b\u066c\u066d\u06d4\u0700\u0701\u0702\u0703\u0704\u0705\u0706\u0707\u0708\u0709\u070a\u070b\u070c\u070d\u0964\u0965\u0970\u0df4\u0e4f\u0e5a\u0e5b\u0f04\u0f05\u0f06\u0f07\u0f08\u0f09\u0f0a\u0f0b\u0f0c\u0f0d\u0f0e\u0f0f\u0f10\u0f11\u0f12\u0f85\u0fd0\u0fd1\u104a\u104b\u104c\u104d\u104e\u104f\u10fb\u1361\u1362\u1363\u1364\u1365\u1366\u1367\u1368\u166d\u166e\u16eb\u16ec\u16ed\u1735\u1736\u17d4\u17d5\u17d6\u17d8\u17d9\u17da\u1800\u1801\u1802\u1803\u1804\u1805\u1807\u1808\u1809\u180a\u1944\u1945\u19de\u19df\u1a1e\u1a1f\u2016\u2017\u2020\u2021\u2022\u2023\u2024\u2025\u2026\u2027\u2030\u2031\u2032\u2033\u2034\u2035\u2036\u2037\u2038\u203b\u203c\u203d\u203e\u2041\u2042\u2043\u2047\u2048\u2049\u204a\u204b\u204c\u204d\u204e\u204f\u2050\u2051\u2053\u2055\u2056\u2057\u2058\u2059\u205a\u205b\u205c\u205d\u205e\u23b6\u2cf9\u2cfa\u2cfb\u2cfc\u2cfe\u2cff\u2e00\u2e01\u2e06\u2e07\u2e08\u2e0b\u2e0e\u2e0f\u2e10\u2e11\u2e12\u2e13\u2e14\u2e15\u2e16\u3001\u3002\u3003\u303d\u30fb\ufe10\ufe11\ufe12\ufe13\ufe14\ufe15\ufe16\ufe19\ufe30\ufe45\ufe46\ufe49\ufe4a\ufe4b\ufe4c\ufe50\ufe51\ufe52\ufe54\ufe55\ufe56\ufe57\ufe5f\ufe60\ufe61\ufe68\ufe6a\ufe6b\uff01\uff02\uff03\uff05\uff06\uff07\uff0a\uff0c\uff0e\uff0f\uff1a\uff1b\uff1f\uff20\uff3c\uff61\uff64\uff65'
-
-Ps = u'([{\u0f3a\u0f3c\u169b\u201a\u201e\u2045\u207d\u208d\u2329\u23b4\u2768\u276a\u276c\u276e\u2770\u2772\u2774\u27c5\u27e6\u27e8\u27ea\u2983\u2985\u2987\u2989\u298b\u298d\u298f\u2991\u2993\u2995\u2997\u29d8\u29da\u29fc\u3008\u300a\u300c\u300e\u3010\u3014\u3016\u3018\u301a\u301d\ufd3e\ufe17\ufe35\ufe37\ufe39\ufe3b\ufe3d\ufe3f\ufe41\ufe43\ufe47\ufe59\ufe5b\ufe5d\uff08\uff3b\uff5b\uff5f\uff62'
-
-Sc = u'$\xa2\xa3\xa4\xa5\u060b\u09f2\u09f3\u0af1\u0bf9\u0e3f\u17db\u20a0\u20a1\u20a2\u20a3\u20a4\u20a5\u20a6\u20a7\u20a8\u20a9\u20aa\u20ab\u20ac\u20ad\u20ae\u20af\u20b0\u20b1\u20b2\u20b3\u20b4\u20b5\ufdfc\ufe69\uff04\uffe0\uffe1\uffe5\uffe6'
-
-Sk = u'^`\xa8\xaf\xb4\xb8\u02c2\u02c3\u02c4\u02c5\u02d2\u02d3\u02d4\u02d5\u02d6\u02d7\u02d8\u02d9\u02da\u02db\u02dc\u02dd\u02de\u02df\u02e5\u02e6\u02e7\u02e8\u02e9\u02ea\u02eb\u02ec\u02ed\u02ef\u02f0\u02f1\u02f2\u02f3\u02f4\u02f5\u02f6\u02f7\u02f8\u02f9\u02fa\u02fb\u02fc\u02fd\u02fe\u02ff\u0374\u0375\u0384\u0385\u1fbd\u1fbf\u1fc0\u1fc1\u1fcd\u1fce\u1fcf\u1fdd\u1fde\u1fdf\u1fed\u1fee\u1fef\u1ffd\u1ffe\u309b\u309c\ua700\ua701\ua702\ua703\ua704\ua705\ua706\ua707\ua708\ua709\ua70a\ua70b\ua70c\ua70d\ua70e\ua70f\ua710\ua711\ua712\ua713\ua714\ua715\ua716\uff3e\uff40\uffe3'
-
-Sm = u'+<=>|~\xac\xb1\xd7\xf7\u03f6\u2044\u2052\u207a\u207b\u207c\u208a\u208b\u208c\u2140\u2141\u2142\u2143\u2144\u214b\u2190\u2191\u2192\u2193\u2194\u219a\u219b\u21a0\u21a3\u21a6\u21ae\u21ce\u21cf\u21d2\u21d4\u21f4\u21f5\u21f6\u21f7\u21f8\u21f9\u21fa\u21fb\u21fc\u21fd\u21fe\u21ff\u2200\u2201\u2202\u2203\u2204\u2205\u2206\u2207\u2208\u2209\u220a\u220b\u220c\u220d\u220e\u220f\u2210\u2211\u2212\u2213\u2214\u2215\u2216\u2217\u2218\u2219\u221a\u221b\u221c\u221d\u221e\u221f\u2220\u2221\u2222\u2223\u2224\u2225\u2226\u2227\u2228\u2229\u222a\u222b\u222c\u222d\u222e\u222f\u2230\u2231\u2232\u2233\u2234\u2235\u2236\u2237\u2238\u2239\u223a\u223b\u223c\u223d\u223e\u223f\u2240\u2241\u2242\u2243\u2244\u2245\u2246\u2247\u2248\u2249\u224a\u224b\u224c\u224d\u224e\u224f\u2250\u2251\u2252\u2253\u2254\u2255\u2256\u2257\u2258\u2259\u225a\u225b\u225c\u225d\u225e\u225f\u2260\u2261\u2262\u2263\u2264\u2265\u2266\u2267\u2268\u2269\u226a\u226b\u226c\u226d\u226e\u226f\u2270\u2271\u2272\u2273\u2274\u2275\u2276\u2277\u2278\u2279\u227a\u227b\u227c\u227d\u227e\u227f\u2280\u2281\u2282\u2283\u2284\u2285\u2286\u2287\u2288\u2289\u228a\u228b\u228c\u228d\u228e\u228f\u2290\u2291\u2292\u2293\u2294\u2295\u2296\u2297\u2298\u2299\u229a\u229b\u229c\u229d\u229e\u229f\u22a0\u22a1\u22a2\u22a3\u22a4\u22a5\u22a6\u22a7\u22a8\u22a9\u22aa\u22ab\u22ac\u22ad\u22ae\u22af\u22b0\u22b1\u22b2\u22b3\u22b4\u22b5\u22b6\u22b7\u22b8\u22b9\u22ba\u22bb\u22bc\u22bd\u22be\u22bf\u22c0\u22c1\u22c2\u22c3\u22c4\u22c5\u22c6\u22c7\u22c8\u22c9\u22ca\u22cb\u22cc\u22cd\u22ce\u22cf\u22d0\u22d1\u22d2\u22d3\u22d4\u22d5\u22d6\u22d7\u22d8\u22d9\u22da\u22db\u22dc\u22dd\u22de\u22df\u22e0\u22e1\u22e2\u22e3\u22e4\u22e5\u22e6\u22e7\u22e8\u22e9\u22ea\u22eb\u22ec\u22ed\u22ee\u22ef\u22f0\u22f1\u22f2\u22f3\u22f4\u22f5\u22f6\u22f7\u22f8\u22f9\u22fa\u22fb\u22fc\u22fd\u22fe\u22ff\u2308\u2309\u230a\u230b\u2320\u2321\u237c\u239b\u239c\u239d\u239e\u239f\u23a0\u23a1\u23a2\u23a3\u23a4\u23a5\u23a6\u23a7\u23a8\u23a9\u23aa\u23ab\u23ac\u23ad\u23ae\u23af\u23b0\u23b1\u23b2\u23b3\u25b7\u25c1\u25f8\u25f9\u25fa\u25fb\u25fc\u25fd\u25fe\u25ff\u266f\u27c0\u27c1\u27c2\u27c3\u27c4\u27d0\u27d1\u27d2\u27d3\u27d4\u27d5\u27d6\u27d7\u27d8\u27d9\u27da\u27db\u27dc\u27dd\u27de\u27df\u27e0\u27e1\u27e2\u27e3\u27e4\u27e5\u27f0\u27f1\u27f2\u27f3\u27f4\u27f5\u27f6\u27f7\u27f8\u27f9\u27fa\u27fb\u27fc\u27fd\u27fe\u27ff\u2900\u2901\u2902\u2903\u2904\u2905\u2906\u2907\u2908\u2909\u290a\u290b\u290c\u290d\u290e\u290f\u2910\u2911\u2912\u2913\u2914\u2915\u2916\u2917\u2918\u2919\u291a\u291b\u291c\u291d\u291e\u291f\u2920\u2921\u2922\u2923\u2924\u2925\u2926\u2927\u2928\u2929\u292a\u292b\u292c\u292d\u292e\u292f\u2930\u2931\u2932\u2933\u2934\u2935\u2936\u2937\u2938\u2939\u293a\u293b\u293c\u293d\u293e\u293f\u2940\u2941\u2942\u2943\u2944\u2945\u2946\u2947\u2948\u2949\u294a\u294b\u294c\u294d\u294e\u294f\u2950\u2951\u2952\u2953\u2954\u2955\u2956\u2957\u2958\u2959\u295a\u295b\u295c\u295d\u295e\u295f\u2960\u2961\u2962\u2963\u2964\u2965\u2966\u2967\u2968\u2969\u296a\u296b\u296c\u296d\u296e\u296f\u2970\u2971\u2972\u2973\u2974\u2975\u2976\u2977\u2978\u2979\u297a\u297b\u297c\u297d\u297e\u297f\u2980\u2981\u2982\u2999\u299a\u299b\u299c\u299d\u299e\u299f\u29a0\u29a1\u29a2\u29a3\u29a4\u29a5\u29a6\u29a7\u29a8\u29a9\u29aa\u29ab\u29ac\u29ad\u29ae\u29af\u29b0\u29b1\u29b2\u29b3\u29b4\u29b5\u29b6\u29b7\u29b8\u29b9\u29ba\u29bb\u29bc\u29bd\u29be\u29bf\u29c0\u29c1\u29c2\u29c3\u29c4\u29c5\u29c6\u29c7\u29c8\u29c9\u29ca\u29cb\u29cc\u29cd\u29ce\u29cf\u29d0\u29d1\u29d2\u29d3\u29d4\u29d5\u29d6\u29d7\u29dc\u29dd\u29de\u29df\u29e0\u29e1\u29e2\u29e3\u29e4\u29e5\u29e6\u29e7\u29e8\u29e9\u29ea\u29eb\u29ec\u29ed\u29ee\u29ef\u29f0\u29f1\u29f2\u29f3\u29f4\u29f5\u29f6\u29f7\u29f8\u29f9\u29fa\u29fb\u29fe\u29ff\u2a00\u2a01\u2a02\u2a03\u2a04\u2a05\u2a06\u2a07\u2a08\u2a09\u2a0a\u2a0b\u2a0c\u2a0d\u2a0e\u2a0f\u2a10\u2a11\u2a12\u2a13\u2a14\u2a15\u2a16\u2a17\u2a18\u2a19\u2a1a\u2a1b\u2a1c\u2a1d\u2a1e\u2a1f\u2a20\u2a21\u2a22\u2a23\u2a24\u2a25\u2a26\u2a27\u2a28\u2a29\u2a2a\u2a2b\u2a2c\u2a2d\u2a2e\u2a2f\u2a30\u2a31\u2a32\u2a33\u2a34\u2a35\u2a36\u2a37\u2a38\u2a39\u2a3a\u2a3b\u2a3c\u2a3d\u2a3e\u2a3f\u2a40\u2a41\u2a42\u2a43\u2a44\u2a45\u2a46\u2a47\u2a48\u2a49\u2a4a\u2a4b\u2a4c\u2a4d\u2a4e\u2a4f\u2a50\u2a51\u2a52\u2a53\u2a54\u2a55\u2a56\u2a57\u2a58\u2a59\u2a5a\u2a5b\u2a5c\u2a5d\u2a5e\u2a5f\u2a60\u2a61\u2a62\u2a63\u2a64\u2a65\u2a66\u2a67\u2a68\u2a69\u2a6a\u2a6b\u2a6c\u2a6d\u2a6e\u2a6f\u2a70\u2a71\u2a72\u2a73\u2a74\u2a75\u2a76\u2a77\u2a78\u2a79\u2a7a\u2a7b\u2a7c\u2a7d\u2a7e\u2a7f\u2a80\u2a81\u2a82\u2a83\u2a84\u2a85\u2a86\u2a87\u2a88\u2a89\u2a8a\u2a8b\u2a8c\u2a8d\u2a8e\u2a8f\u2a90\u2a91\u2a92\u2a93\u2a94\u2a95\u2a96\u2a97\u2a98\u2a99\u2a9a\u2a9b\u2a9c\u2a9d\u2a9e\u2a9f\u2aa0\u2aa1\u2aa2\u2aa3\u2aa4\u2aa5\u2aa6\u2aa7\u2aa8\u2aa9\u2aaa\u2aab\u2aac\u2aad\u2aae\u2aaf\u2ab0\u2ab1\u2ab2\u2ab3\u2ab4\u2ab5\u2ab6\u2ab7\u2ab8\u2ab9\u2aba\u2abb\u2abc\u2abd\u2abe\u2abf\u2ac0\u2ac1\u2ac2\u2ac3\u2ac4\u2ac5\u2ac6\u2ac7\u2ac8\u2ac9\u2aca\u2acb\u2acc\u2acd\u2ace\u2acf\u2ad0\u2ad1\u2ad2\u2ad3\u2ad4\u2ad5\u2ad6\u2ad7\u2ad8\u2ad9\u2ada\u2adb\u2adc\u2add\u2ade\u2adf\u2ae0\u2ae1\u2ae2\u2ae3\u2ae4\u2ae5\u2ae6\u2ae7\u2ae8\u2ae9\u2aea\u2aeb\u2aec\u2aed\u2aee\u2aef\u2af0\u2af1\u2af2\u2af3\u2af4\u2af5\u2af6\u2af7\u2af8\u2af9\u2afa\u2afb\u2afc\u2afd\u2afe\u2aff\ufb29\ufe62\ufe64\ufe65\ufe66\uff0b\uff1c\uff1d\uff1e\uff5c\uff5e\uffe2\uffe9\uffea\uffeb\uffec'
-
-So = u'\xa6\xa7\xa9\xae\xb0\xb6\u0482\u060e\u060f\u06e9\u06fd\u06fe\u09fa\u0b70\u0bf3\u0bf4\u0bf5\u0bf6\u0bf7\u0bf8\u0bfa\u0f01\u0f02\u0f03\u0f13\u0f14\u0f15\u0f16\u0f17\u0f1a\u0f1b\u0f1c\u0f1d\u0f1e\u0f1f\u0f34\u0f36\u0f38\u0fbe\u0fbf\u0fc0\u0fc1\u0fc2\u0fc3\u0fc4\u0fc5\u0fc7\u0fc8\u0fc9\u0fca\u0fcb\u0fcc\u0fcf\u1360\u1390\u1391\u1392\u1393\u1394\u1395\u1396\u1397\u1398\u1399\u1940\u19e0\u19e1\u19e2\u19e3\u19e4\u19e5\u19e6\u19e7\u19e8\u19e9\u19ea\u19eb\u19ec\u19ed\u19ee\u19ef\u19f0\u19f1\u19f2\u19f3\u19f4\u19f5\u19f6\u19f7\u19f8\u19f9\u19fa\u19fb\u19fc\u19fd\u19fe\u19ff\u2100\u2101\u2103\u2104\u2105\u2106\u2108\u2109\u2114\u2116\u2117\u2118\u211e\u211f\u2120\u2121\u2122\u2123\u2125\u2127\u2129\u212e\u2132\u213a\u213b\u214a\u214c\u2195\u2196\u2197\u2198\u2199\u219c\u219d\u219e\u219f\u21a1\u21a2\u21a4\u21a5\u21a7\u21a8\u21a9\u21aa\u21ab\u21ac\u21ad\u21af\u21b0\u21b1\u21b2\u21b3\u21b4\u21b5\u21b6\u21b7\u21b8\u21b9\u21ba\u21bb\u21bc\u21bd\u21be\u21bf\u21c0\u21c1\u21c2\u21c3\u21c4\u21c5\u21c6\u21c7\u21c8\u21c9\u21ca\u21cb\u21cc\u21cd\u21d0\u21d1\u21d3\u21d5\u21d6\u21d7\u21d8\u21d9\u21da\u21db\u21dc\u21dd\u21de\u21df\u21e0\u21e1\u21e2\u21e3\u21e4\u21e5\u21e6\u21e7\u21e8\u21e9\u21ea\u21eb\u21ec\u21ed\u21ee\u21ef\u21f0\u21f1\u21f2\u21f3\u2300\u2301\u2302\u2303\u2304\u2305\u2306\u2307\u230c\u230d\u230e\u230f\u2310\u2311\u2312\u2313\u2314\u2315\u2316\u2317\u2318\u2319\u231a\u231b\u231c\u231d\u231e\u231f\u2322\u2323\u2324\u2325\u2326\u2327\u2328\u232b\u232c\u232d\u232e\u232f\u2330\u2331\u2332\u2333\u2334\u2335\u2336\u2337\u2338\u2339\u233a\u233b\u233c\u233d\u233e\u233f\u2340\u2341\u2342\u2343\u2344\u2345\u2346\u2347\u2348\u2349\u234a\u234b\u234c\u234d\u234e\u234f\u2350\u2351\u2352\u2353\u2354\u2355\u2356\u2357\u2358\u2359\u235a\u235b\u235c\u235d\u235e\u235f\u2360\u2361\u2362\u2363\u2364\u2365\u2366\u2367\u2368\u2369\u236a\u236b\u236c\u236d\u236e\u236f\u2370\u2371\u2372\u2373\u2374\u2375\u2376\u2377\u2378\u2379\u237a\u237b\u237d\u237e\u237f\u2380\u2381\u2382\u2383\u2384\u2385\u2386\u2387\u2388\u2389\u238a\u238b\u238c\u238d\u238e\u238f\u2390\u2391\u2392\u2393\u2394\u2395\u2396\u2397\u2398\u2399\u239a\u23b7\u23b8\u23b9\u23ba\u23bb\u23bc\u23bd\u23be\u23bf\u23c0\u23c1\u23c2\u23c3\u23c4\u23c5\u23c6\u23c7\u23c8\u23c9\u23ca\u23cb\u23cc\u23cd\u23ce\u23cf\u23d0\u23d1\u23d2\u23d3\u23d4\u23d5\u23d6\u23d7\u23d8\u23d9\u23da\u23db\u2400\u2401\u2402\u2403\u2404\u2405\u2406\u2407\u2408\u2409\u240a\u240b\u240c\u240d\u240e\u240f\u2410\u2411\u2412\u2413\u2414\u2415\u2416\u2417\u2418\u2419\u241a\u241b\u241c\u241d\u241e\u241f\u2420\u2421\u2422\u2423\u2424\u2425\u2426\u2440\u2441\u2442\u2443\u2444\u2445\u2446\u2447\u2448\u2449\u244a\u249c\u249d\u249e\u249f\u24a0\u24a1\u24a2\u24a3\u24a4\u24a5\u24a6\u24a7\u24a8\u24a9\u24aa\u24ab\u24ac\u24ad\u24ae\u24af\u24b0\u24b1\u24b2\u24b3\u24b4\u24b5\u24b6\u24b7\u24b8\u24b9\u24ba\u24bb\u24bc\u24bd\u24be\u24bf\u24c0\u24c1\u24c2\u24c3\u24c4\u24c5\u24c6\u24c7\u24c8\u24c9\u24ca\u24cb\u24cc\u24cd\u24ce\u24cf\u24d0\u24d1\u24d2\u24d3\u24d4\u24d5\u24d6\u24d7\u24d8\u24d9\u24da\u24db\u24dc\u24dd\u24de\u24df\u24e0\u24e1\u24e2\u24e3\u24e4\u24e5\u24e6\u24e7\u24e8\u24e9\u2500\u2501\u2502\u2503\u2504\u2505\u2506\u2507\u2508\u2509\u250a\u250b\u250c\u250d\u250e\u250f\u2510\u2511\u2512\u2513\u2514\u2515\u2516\u2517\u2518\u2519\u251a\u251b\u251c\u251d\u251e\u251f\u2520\u2521\u2522\u2523\u2524\u2525\u2526\u2527\u2528\u2529\u252a\u252b\u252c\u252d\u252e\u252f\u2530\u2531\u2532\u2533\u2534\u2535\u2536\u2537\u2538\u2539\u253a\u253b\u253c\u253d\u253e\u253f\u2540\u2541\u2542\u2543\u2544\u2545\u2546\u2547\u2548\u2549\u254a\u254b\u254c\u254d\u254e\u254f\u2550\u2551\u2552\u2553\u2554\u2555\u2556\u2557\u2558\u2559\u255a\u255b\u255c\u255d\u255e\u255f\u2560\u2561\u2562\u2563\u2564\u2565\u2566\u2567\u2568\u2569\u256a\u256b\u256c\u256d\u256e\u256f\u2570\u2571\u2572\u2573\u2574\u2575\u2576\u2577\u2578\u2579\u257a\u257b\u257c\u257d\u257e\u257f\u2580\u2581\u2582\u2583\u2584\u2585\u2586\u2587\u2588\u2589\u258a\u258b\u258c\u258d\u258e\u258f\u2590\u2591\u2592\u2593\u2594\u2595\u2596\u2597\u2598\u2599\u259a\u259b\u259c\u259d\u259e\u259f\u25a0\u25a1\u25a2\u25a3\u25a4\u25a5\u25a6\u25a7\u25a8\u25a9\u25aa\u25ab\u25ac\u25ad\u25ae\u25af\u25b0\u25b1\u25b2\u25b3\u25b4\u25b5\u25b6\u25b8\u25b9\u25ba\u25bb\u25bc\u25bd\u25be\u25bf\u25c0\u25c2\u25c3\u25c4\u25c5\u25c6\u25c7\u25c8\u25c9\u25ca\u25cb\u25cc\u25cd\u25ce\u25cf\u25d0\u25d1\u25d2\u25d3\u25d4\u25d5\u25d6\u25d7\u25d8\u25d9\u25da\u25db\u25dc\u25dd\u25de\u25df\u25e0\u25e1\u25e2\u25e3\u25e4\u25e5\u25e6\u25e7\u25e8\u25e9\u25ea\u25eb\u25ec\u25ed\u25ee\u25ef\u25f0\u25f1\u25f2\u25f3\u25f4\u25f5\u25f6\u25f7\u2600\u2601\u2602\u2603\u2604\u2605\u2606\u2607\u2608\u2609\u260a\u260b\u260c\u260d\u260e\u260f\u2610\u2611\u2612\u2613\u2614\u2615\u2616\u2617\u2618\u2619\u261a\u261b\u261c\u261d\u261e\u261f\u2620\u2621\u2622\u2623\u2624\u2625\u2626\u2627\u2628\u2629\u262a\u262b\u262c\u262d\u262e\u262f\u2630\u2631\u2632\u2633\u2634\u2635\u2636\u2637\u2638\u2639\u263a\u263b\u263c\u263d\u263e\u263f\u2640\u2641\u2642\u2643\u2644\u2645\u2646\u2647\u2648\u2649\u264a\u264b\u264c\u264d\u264e\u264f\u2650\u2651\u2652\u2653\u2654\u2655\u2656\u2657\u2658\u2659\u265a\u265b\u265c\u265d\u265e\u265f\u2660\u2661\u2662\u2663\u2664\u2665\u2666\u2667\u2668\u2669\u266a\u266b\u266c\u266d\u266e\u2670\u2671\u2672\u2673\u2674\u2675\u2676\u2677\u2678\u2679\u267a\u267b\u267c\u267d\u267e\u267f\u2680\u2681\u2682\u2683\u2684\u2685\u2686\u2687\u2688\u2689\u268a\u268b\u268c\u268d\u268e\u268f\u2690\u2691\u2692\u2693\u2694\u2695\u2696\u2697\u2698\u2699\u269a\u269b\u269c\u26a0\u26a1\u26a2\u26a3\u26a4\u26a5\u26a6\u26a7\u26a8\u26a9\u26aa\u26ab\u26ac\u26ad\u26ae\u26af\u26b0\u26b1\u2701\u2702\u2703\u2704\u2706\u2707\u2708\u2709\u270c\u270d\u270e\u270f\u2710\u2711\u2712\u2713\u2714\u2715\u2716\u2717\u2718\u2719\u271a\u271b\u271c\u271d\u271e\u271f\u2720\u2721\u2722\u2723\u2724\u2725\u2726\u2727\u2729\u272a\u272b\u272c\u272d\u272e\u272f\u2730\u2731\u2732\u2733\u2734\u2735\u2736\u2737\u2738\u2739\u273a\u273b\u273c\u273d\u273e\u273f\u2740\u2741\u2742\u2743\u2744\u2745\u2746\u2747\u2748\u2749\u274a\u274b\u274d\u274f\u2750\u2751\u2752\u2756\u2758\u2759\u275a\u275b\u275c\u275d\u275e\u2761\u2762\u2763\u2764\u2765\u2766\u2767\u2794\u2798\u2799\u279a\u279b\u279c\u279d\u279e\u279f\u27a0\u27a1\u27a2\u27a3\u27a4\u27a5\u27a6\u27a7\u27a8\u27a9\u27aa\u27ab\u27ac\u27ad\u27ae\u27af\u27b1\u27b2\u27b3\u27b4\u27b5\u27b6\u27b7\u27b8\u27b9\u27ba\u27bb\u27bc\u27bd\u27be\u2800\u2801\u2802\u2803\u2804\u2805\u2806\u2807\u2808\u2809\u280a\u280b\u280c\u280d\u280e\u280f\u2810\u2811\u2812\u2813\u2814\u2815\u2816\u2817\u2818\u2819\u281a\u281b\u281c\u281d\u281e\u281f\u2820\u2821\u2822\u2823\u2824\u2825\u2826\u2827\u2828\u2829\u282a\u282b\u282c\u282d\u282e\u282f\u2830\u2831\u2832\u2833\u2834\u2835\u2836\u2837\u2838\u2839\u283a\u283b\u283c\u283d\u283e\u283f\u2840\u2841\u2842\u2843\u2844\u2845\u2846\u2847\u2848\u2849\u284a\u284b\u284c\u284d\u284e\u284f\u2850\u2851\u2852\u2853\u2854\u2855\u2856\u2857\u2858\u2859\u285a\u285b\u285c\u285d\u285e\u285f\u2860\u2861\u2862\u2863\u2864\u2865\u2866\u2867\u2868\u2869\u286a\u286b\u286c\u286d\u286e\u286f\u2870\u2871\u2872\u2873\u2874\u2875\u2876\u2877\u2878\u2879\u287a\u287b\u287c\u287d\u287e\u287f\u2880\u2881\u2882\u2883\u2884\u2885\u2886\u2887\u2888\u2889\u288a\u288b\u288c\u288d\u288e\u288f\u2890\u2891\u2892\u2893\u2894\u2895\u2896\u2897\u2898\u2899\u289a\u289b\u289c\u289d\u289e\u289f\u28a0\u28a1\u28a2\u28a3\u28a4\u28a5\u28a6\u28a7\u28a8\u28a9\u28aa\u28ab\u28ac\u28ad\u28ae\u28af\u28b0\u28b1\u28b2\u28b3\u28b4\u28b5\u28b6\u28b7\u28b8\u28b9\u28ba\u28bb\u28bc\u28bd\u28be\u28bf\u28c0\u28c1\u28c2\u28c3\u28c4\u28c5\u28c6\u28c7\u28c8\u28c9\u28ca\u28cb\u28cc\u28cd\u28ce\u28cf\u28d0\u28d1\u28d2\u28d3\u28d4\u28d5\u28d6\u28d7\u28d8\u28d9\u28da\u28db\u28dc\u28dd\u28de\u28df\u28e0\u28e1\u28e2\u28e3\u28e4\u28e5\u28e6\u28e7\u28e8\u28e9\u28ea\u28eb\u28ec\u28ed\u28ee\u28ef\u28f0\u28f1\u28f2\u28f3\u28f4\u28f5\u28f6\u28f7\u28f8\u28f9\u28fa\u28fb\u28fc\u28fd\u28fe\u28ff\u2b00\u2b01\u2b02\u2b03\u2b04\u2b05\u2b06\u2b07\u2b08\u2b09\u2b0a\u2b0b\u2b0c\u2b0d\u2b0e\u2b0f\u2b10\u2b11\u2b12\u2b13\u2ce5\u2ce6\u2ce7\u2ce8\u2ce9\u2cea\u2e80\u2e81\u2e82\u2e83\u2e84\u2e85\u2e86\u2e87\u2e88\u2e89\u2e8a\u2e8b\u2e8c\u2e8d\u2e8e\u2e8f\u2e90\u2e91\u2e92\u2e93\u2e94\u2e95\u2e96\u2e97\u2e98\u2e99\u2e9b\u2e9c\u2e9d\u2e9e\u2e9f\u2ea0\u2ea1\u2ea2\u2ea3\u2ea4\u2ea5\u2ea6\u2ea7\u2ea8\u2ea9\u2eaa\u2eab\u2eac\u2ead\u2eae\u2eaf\u2eb0\u2eb1\u2eb2\u2eb3\u2eb4\u2eb5\u2eb6\u2eb7\u2eb8\u2eb9\u2eba\u2ebb\u2ebc\u2ebd\u2ebe\u2ebf\u2ec0\u2ec1\u2ec2\u2ec3\u2ec4\u2ec5\u2ec6\u2ec7\u2ec8\u2ec9\u2eca\u2ecb\u2ecc\u2ecd\u2ece\u2ecf\u2ed0\u2ed1\u2ed2\u2ed3\u2ed4\u2ed5\u2ed6\u2ed7\u2ed8\u2ed9\u2eda\u2edb\u2edc\u2edd\u2ede\u2edf\u2ee0\u2ee1\u2ee2\u2ee3\u2ee4\u2ee5\u2ee6\u2ee7\u2ee8\u2ee9\u2eea\u2eeb\u2eec\u2eed\u2eee\u2eef\u2ef0\u2ef1\u2ef2\u2ef3\u2f00\u2f01\u2f02\u2f03\u2f04\u2f05\u2f06\u2f07\u2f08\u2f09\u2f0a\u2f0b\u2f0c\u2f0d\u2f0e\u2f0f\u2f10\u2f11\u2f12\u2f13\u2f14\u2f15\u2f16\u2f17\u2f18\u2f19\u2f1a\u2f1b\u2f1c\u2f1d\u2f1e\u2f1f\u2f20\u2f21\u2f22\u2f23\u2f24\u2f25\u2f26\u2f27\u2f28\u2f29\u2f2a\u2f2b\u2f2c\u2f2d\u2f2e\u2f2f\u2f30\u2f31\u2f32\u2f33\u2f34\u2f35\u2f36\u2f37\u2f38\u2f39\u2f3a\u2f3b\u2f3c\u2f3d\u2f3e\u2f3f\u2f40\u2f41\u2f42\u2f43\u2f44\u2f45\u2f46\u2f47\u2f48\u2f49\u2f4a\u2f4b\u2f4c\u2f4d\u2f4e\u2f4f\u2f50\u2f51\u2f52\u2f53\u2f54\u2f55\u2f56\u2f57\u2f58\u2f59\u2f5a\u2f5b\u2f5c\u2f5d\u2f5e\u2f5f\u2f60\u2f61\u2f62\u2f63\u2f64\u2f65\u2f66\u2f67\u2f68\u2f69\u2f6a\u2f6b\u2f6c\u2f6d\u2f6e\u2f6f\u2f70\u2f71\u2f72\u2f73\u2f74\u2f75\u2f76\u2f77\u2f78\u2f79\u2f7a\u2f7b\u2f7c\u2f7d\u2f7e\u2f7f\u2f80\u2f81\u2f82\u2f83\u2f84\u2f85\u2f86\u2f87\u2f88\u2f89\u2f8a\u2f8b\u2f8c\u2f8d\u2f8e\u2f8f\u2f90\u2f91\u2f92\u2f93\u2f94\u2f95\u2f96\u2f97\u2f98\u2f99\u2f9a\u2f9b\u2f9c\u2f9d\u2f9e\u2f9f\u2fa0\u2fa1\u2fa2\u2fa3\u2fa4\u2fa5\u2fa6\u2fa7\u2fa8\u2fa9\u2faa\u2fab\u2fac\u2fad\u2fae\u2faf\u2fb0\u2fb1\u2fb2\u2fb3\u2fb4\u2fb5\u2fb6\u2fb7\u2fb8\u2fb9\u2fba\u2fbb\u2fbc\u2fbd\u2fbe\u2fbf\u2fc0\u2fc1\u2fc2\u2fc3\u2fc4\u2fc5\u2fc6\u2fc7\u2fc8\u2fc9\u2fca\u2fcb\u2fcc\u2fcd\u2fce\u2fcf\u2fd0\u2fd1\u2fd2\u2fd3\u2fd4\u2fd5\u2ff0\u2ff1\u2ff2\u2ff3\u2ff4\u2ff5\u2ff6\u2ff7\u2ff8\u2ff9\u2ffa\u2ffb\u3004\u3012\u3013\u3020\u3036\u3037\u303e\u303f\u3190\u3191\u3196\u3197\u3198\u3199\u319a\u319b\u319c\u319d\u319e\u319f\u31c0\u31c1\u31c2\u31c3\u31c4\u31c5\u31c6\u31c7\u31c8\u31c9\u31ca\u31cb\u31cc\u31cd\u31ce\u31cf\u3200\u3201\u3202\u3203\u3204\u3205\u3206\u3207\u3208\u3209\u320a\u320b\u320c\u320d\u320e\u320f\u3210\u3211\u3212\u3213\u3214\u3215\u3216\u3217\u3218\u3219\u321a\u321b\u321c\u321d\u321e\u322a\u322b\u322c\u322d\u322e\u322f\u3230\u3231\u3232\u3233\u3234\u3235\u3236\u3237\u3238\u3239\u323a\u323b\u323c\u323d\u323e\u323f\u3240\u3241\u3242\u3243\u3250\u3260\u3261\u3262\u3263\u3264\u3265\u3266\u3267\u3268\u3269\u326a\u326b\u326c\u326d\u326e\u326f\u3270\u3271\u3272\u3273\u3274\u3275\u3276\u3277\u3278\u3279\u327a\u327b\u327c\u327d\u327e\u327f\u328a\u328b\u328c\u328d\u328e\u328f\u3290\u3291\u3292\u3293\u3294\u3295\u3296\u3297\u3298\u3299\u329a\u329b\u329c\u329d\u329e\u329f\u32a0\u32a1\u32a2\u32a3\u32a4\u32a5\u32a6\u32a7\u32a8\u32a9\u32aa\u32ab\u32ac\u32ad\u32ae\u32af\u32b0\u32c0\u32c1\u32c2\u32c3\u32c4\u32c5\u32c6\u32c7\u32c8\u32c9\u32ca\u32cb\u32cc\u32cd\u32ce\u32cf\u32d0\u32d1\u32d2\u32d3\u32d4\u32d5\u32d6\u32d7\u32d8\u32d9\u32da\u32db\u32dc\u32dd\u32de\u32df\u32e0\u32e1\u32e2\u32e3\u32e4\u32e5\u32e6\u32e7\u32e8\u32e9\u32ea\u32eb\u32ec\u32ed\u32ee\u32ef\u32f0\u32f1\u32f2\u32f3\u32f4\u32f5\u32f6\u32f7\u32f8\u32f9\u32fa\u32fb\u32fc\u32fd\u32fe\u3300\u3301\u3302\u3303\u3304\u3305\u3306\u3307\u3308\u3309\u330a\u330b\u330c\u330d\u330e\u330f\u3310\u3311\u3312\u3313\u3314\u3315\u3316\u3317\u3318\u3319\u331a\u331b\u331c\u331d\u331e\u331f\u3320\u3321\u3322\u3323\u3324\u3325\u3326\u3327\u3328\u3329\u332a\u332b\u332c\u332d\u332e\u332f\u3330\u3331\u3332\u3333\u3334\u3335\u3336\u3337\u3338\u3339\u333a\u333b\u333c\u333d\u333e\u333f\u3340\u3341\u3342\u3343\u3344\u3345\u3346\u3347\u3348\u3349\u334a\u334b\u334c\u334d\u334e\u334f\u3350\u3351\u3352\u3353\u3354\u3355\u3356\u3357\u3358\u3359\u335a\u335b\u335c\u335d\u335e\u335f\u3360\u3361\u3362\u3363\u3364\u3365\u3366\u3367\u3368\u3369\u336a\u336b\u336c\u336d\u336e\u336f\u3370\u3371\u3372\u3373\u3374\u3375\u3376\u3377\u3378\u3379\u337a\u337b\u337c\u337d\u337e\u337f\u3380\u3381\u3382\u3383\u3384\u3385\u3386\u3387\u3388\u3389\u338a\u338b\u338c\u338d\u338e\u338f\u3390\u3391\u3392\u3393\u3394\u3395\u3396\u3397\u3398\u3399\u339a\u339b\u339c\u339d\u339e\u339f\u33a0\u33a1\u33a2\u33a3\u33a4\u33a5\u33a6\u33a7\u33a8\u33a9\u33aa\u33ab\u33ac\u33ad\u33ae\u33af\u33b0\u33b1\u33b2\u33b3\u33b4\u33b5\u33b6\u33b7\u33b8\u33b9\u33ba\u33bb\u33bc\u33bd\u33be\u33bf\u33c0\u33c1\u33c2\u33c3\u33c4\u33c5\u33c6\u33c7\u33c8\u33c9\u33ca\u33cb\u33cc\u33cd\u33ce\u33cf\u33d0\u33d1\u33d2\u33d3\u33d4\u33d5\u33d6\u33d7\u33d8\u33d9\u33da\u33db\u33dc\u33dd\u33de\u33df\u33e0\u33e1\u33e2\u33e3\u33e4\u33e5\u33e6\u33e7\u33e8\u33e9\u33ea\u33eb\u33ec\u33ed\u33ee\u33ef\u33f0\u33f1\u33f2\u33f3\u33f4\u33f5\u33f6\u33f7\u33f8\u33f9\u33fa\u33fb\u33fc\u33fd\u33fe\u33ff\u4dc0\u4dc1\u4dc2\u4dc3\u4dc4\u4dc5\u4dc6\u4dc7\u4dc8\u4dc9\u4dca\u4dcb\u4dcc\u4dcd\u4dce\u4dcf\u4dd0\u4dd1\u4dd2\u4dd3\u4dd4\u4dd5\u4dd6\u4dd7\u4dd8\u4dd9\u4dda\u4ddb\u4ddc\u4ddd\u4dde\u4ddf\u4de0\u4de1\u4de2\u4de3\u4de4\u4de5\u4de6\u4de7\u4de8\u4de9\u4dea\u4deb\u4dec\u4ded\u4dee\u4def\u4df0\u4df1\u4df2\u4df3\u4df4\u4df5\u4df6\u4df7\u4df8\u4df9\u4dfa\u4dfb\u4dfc\u4dfd\u4dfe\u4dff\ua490\ua491\ua492\ua493\ua494\ua495\ua496\ua497\ua498\ua499\ua49a\ua49b\ua49c\ua49d\ua49e\ua49f\ua4a0\ua4a1\ua4a2\ua4a3\ua4a4\ua4a5\ua4a6\ua4a7\ua4a8\ua4a9\ua4aa\ua4ab\ua4ac\ua4ad\ua4ae\ua4af\ua4b0\ua4b1\ua4b2\ua4b3\ua4b4\ua4b5\ua4b6\ua4b7\ua4b8\ua4b9\ua4ba\ua4bb\ua4bc\ua4bd\ua4be\ua4bf\ua4c0\ua4c1\ua4c2\ua4c3\ua4c4\ua4c5\ua4c6\ua828\ua829\ua82a\ua82b\ufdfd\uffe4\uffe8\uffed\uffee\ufffc\ufffd'
-
-Zl = u'\u2028'
-
-Zp = u'\u2029'
-
-Zs = u' \xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000'
-
-cats = ['Cc', 'Cf', 'Cn', 'Co', 'Cs', 'Ll', 'Lm', 'Lo', 'Lt', 'Lu', 'Mc', 'Me', 'Mn', 'Nd', 'Nl', 'No', 'Pc', 'Pd', 'Pe', 'Pf', 'Pi', 'Po', 'Ps', 'Sc', 'Sk', 'Sm', 'So', 'Zl', 'Zp', 'Zs']
-
-def combine(*args):
-    return u''.join([globals()[cat] for cat in args])
-
-xid_start = u'\u0041-\u005A\u005F\u0061-\u007A\u00AA\u00B5\u00BA\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u01BA\u01BB\u01BC-\u01BF\u01C0-\u01C3\u01C4-\u0241\u0250-\u02AF\u02B0-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EE\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03CE\u03D0-\u03F5\u03F7-\u0481\u048A-\u04CE\u04D0-\u04F9\u0500-\u050F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0621-\u063A\u0640\u0641-\u064A\u066E-\u066F\u0671-\u06D3\u06D5\u06E5-\u06E6\u06EE-\u06EF\u06FA-\u06FC\u06FF\u0710\u0712-\u072F\u074D-\u076D\u0780-\u07A5\u07B1\u0904-\u0939\u093D\u0950\u0958-\u0961\u097D\u0985-\u098C\u098F-\u0990\u0993-\u09A8\u09AA-\u09B0\u09B2\u09B6-\u09B9\u09BD\u09CE\u09DC-\u09DD\u09DF-\u09E1\u09F0-\u09F1\u0A05-\u0A0A\u0A0F-\u0A10\u0A13-\u0A28\u0A2A-\u0A30\u0A32-\u0A33\u0A35-\u0A36\u0A38-\u0A39\u0A59-\u0A5C\u0A5E\u0A72-\u0A74\u0A85-\u0A8D\u0A8F-\u0A91\u0A93-\u0AA8\u0AAA-\u0AB0\u0AB2-\u0AB3\u0AB5-\u0AB9\u0ABD\u0AD0\u0AE0-\u0AE1\u0B05-\u0B0C\u0B0F-\u0B10\u0B13-\u0B28\u0B2A-\u0B30\u0B32-\u0B33\u0B35-\u0B39\u0B3D\u0B5C-\u0B5D\u0B5F-\u0B61\u0B71\u0B83\u0B85-\u0B8A\u0B8E-\u0B90\u0B92-\u0B95\u0B99-\u0B9A\u0B9C\u0B9E-\u0B9F\u0BA3-\u0BA4\u0BA8-\u0BAA\u0BAE-\u0BB9\u0C05-\u0C0C\u0C0E-\u0C10\u0C12-\u0C28\u0C2A-\u0C33\u0C35-\u0C39\u0C60-\u0C61\u0C85-\u0C8C\u0C8E-\u0C90\u0C92-\u0CA8\u0CAA-\u0CB3\u0CB5-\u0CB9\u0CBD\u0CDE\u0CE0-\u0CE1\u0D05-\u0D0C\u0D0E-\u0D10\u0D12-\u0D28\u0D2A-\u0D39\u0D60-\u0D61\u0D85-\u0D96\u0D9A-\u0DB1\u0DB3-\u0DBB\u0DBD\u0DC0-\u0DC6\u0E01-\u0E30\u0E32\u0E40-\u0E45\u0E46\u0E81-\u0E82\u0E84\u0E87-\u0E88\u0E8A\u0E8D\u0E94-\u0E97\u0E99-\u0E9F\u0EA1-\u0EA3\u0EA5\u0EA7\u0EAA-\u0EAB\u0EAD-\u0EB0\u0EB2\u0EBD\u0EC0-\u0EC4\u0EC6\u0EDC-\u0EDD\u0F00\u0F40-\u0F47\u0F49-\u0F6A\u0F88-\u0F8B\u1000-\u1021\u1023-\u1027\u1029-\u102A\u1050-\u1055\u10A0-\u10C5\u10D0-\u10FA\u10FC\u1100-\u1159\u115F-\u11A2\u11A8-\u11F9\u1200-\u1248\u124A-\u124D\u1250-\u1256\u1258\u125A-\u125D\u1260-\u1288\u128A-\u128D\u1290-\u12B0\u12B2-\u12B5\u12B8-\u12BE\u12C0\u12C2-\u12C5\u12C8-\u12D6\u12D8-\u1310\u1312-\u1315\u1318-\u135A\u1380-\u138F\u13A0-\u13F4\u1401-\u166C\u166F-\u1676\u1681-\u169A\u16A0-\u16EA\u16EE-\u16F0\u1700-\u170C\u170E-\u1711\u1720-\u1731\u1740-\u1751\u1760-\u176C\u176E-\u1770\u1780-\u17B3\u17D7\u17DC\u1820-\u1842\u1843\u1844-\u1877\u1880-\u18A8\u1900-\u191C\u1950-\u196D\u1970-\u1974\u1980-\u19A9\u19C1-\u19C7\u1A00-\u1A16\u1D00-\u1D2B\u1D2C-\u1D61\u1D62-\u1D77\u1D78\u1D79-\u1D9A\u1D9B-\u1DBF\u1E00-\u1E9B\u1EA0-\u1EF9\u1F00-\u1F15\u1F18-\u1F1D\u1F20-\u1F45\u1F48-\u1F4D\u1F50-\u1F57\u1F59\u1F5B\u1F5D\u1F5F-\u1F7D\u1F80-\u1FB4\u1FB6-\u1FBC\u1FBE\u1FC2-\u1FC4\u1FC6-\u1FCC\u1FD0-\u1FD3\u1FD6-\u1FDB\u1FE0-\u1FEC\u1FF2-\u1FF4\u1FF6-\u1FFC\u2071\u207F\u2090-\u2094\u2102\u2107\u210A-\u2113\u2115\u2118\u2119-\u211D\u2124\u2126\u2128\u212A-\u212D\u212E\u212F-\u2131\u2133-\u2134\u2135-\u2138\u2139\u213C-\u213F\u2145-\u2149\u2160-\u2183\u2C00-\u2C2E\u2C30-\u2C5E\u2C80-\u2CE4\u2D00-\u2D25\u2D30-\u2D65\u2D6F\u2D80-\u2D96\u2DA0-\u2DA6\u2DA8-\u2DAE\u2DB0-\u2DB6\u2DB8-\u2DBE\u2DC0-\u2DC6\u2DC8-\u2DCE\u2DD0-\u2DD6\u2DD8-\u2DDE\u3005\u3006\u3007\u3021-\u3029\u3031-\u3035\u3038-\u303A\u303B\u303C\u3041-\u3096\u309D-\u309E\u309F\u30A1-\u30FA\u30FC-\u30FE\u30FF\u3105-\u312C\u3131-\u318E\u31A0-\u31B7\u31F0-\u31FF\u3400-\u4DB5\u4E00-\u9FBB\uA000-\uA014\uA015\uA016-\uA48C\uA800-\uA801\uA803-\uA805\uA807-\uA80A\uA80C-\uA822\uAC00-\uD7A3\uF900-\uFA2D\uFA30-\uFA6A\uFA70-\uFAD9\uFB00-\uFB06\uFB13-\uFB17\uFB1D\uFB1F-\uFB28\uFB2A-\uFB36\uFB38-\uFB3C\uFB3E\uFB40-\uFB41\uFB43-\uFB44\uFB46-\uFBB1\uFBD3-\uFC5D\uFC64-\uFD3D\uFD50-\uFD8F\uFD92-\uFDC7\uFDF0-\uFDF9\uFE71\uFE73\uFE77\uFE79\uFE7B\uFE7D\uFE7F-\uFEFC\uFF21-\uFF3A\uFF41-\uFF5A\uFF66-\uFF6F\uFF70\uFF71-\uFF9D\uFFA0-\uFFBE\uFFC2-\uFFC7\uFFCA-\uFFCF\uFFD2-\uFFD7\uFFDA-\uFFDC'
-
-xid_continue = u'\u0030-\u0039\u0041-\u005A\u005F\u0061-\u007A\u00AA\u00B5\u00B7\u00BA\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u01BA\u01BB\u01BC-\u01BF\u01C0-\u01C3\u01C4-\u0241\u0250-\u02AF\u02B0-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EE\u0300-\u036F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03CE\u03D0-\u03F5\u03F7-\u0481\u0483-\u0486\u048A-\u04CE\u04D0-\u04F9\u0500-\u050F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05B9\u05BB-\u05BD\u05BF\u05C1-\u05C2\u05C4-\u05C5\u05C7\u05D0-\u05EA\u05F0-\u05F2\u0610-\u0615\u0621-\u063A\u0640\u0641-\u064A\u064B-\u065E\u0660-\u0669\u066E-\u066F\u0670\u0671-\u06D3\u06D5\u06D6-\u06DC\u06DF-\u06E4\u06E5-\u06E6\u06E7-\u06E8\u06EA-\u06ED\u06EE-\u06EF\u06F0-\u06F9\u06FA-\u06FC\u06FF\u0710\u0711\u0712-\u072F\u0730-\u074A\u074D-\u076D\u0780-\u07A5\u07A6-\u07B0\u07B1\u0901-\u0902\u0903\u0904-\u0939\u093C\u093D\u093E-\u0940\u0941-\u0948\u0949-\u094C\u094D\u0950\u0951-\u0954\u0958-\u0961\u0962-\u0963\u0966-\u096F\u097D\u0981\u0982-\u0983\u0985-\u098C\u098F-\u0990\u0993-\u09A8\u09AA-\u09B0\u09B2\u09B6-\u09B9\u09BC\u09BD\u09BE-\u09C0\u09C1-\u09C4\u09C7-\u09C8\u09CB-\u09CC\u09CD\u09CE\u09D7\u09DC-\u09DD\u09DF-\u09E1\u09E2-\u09E3\u09E6-\u09EF\u09F0-\u09F1\u0A01-\u0A02\u0A03\u0A05-\u0A0A\u0A0F-\u0A10\u0A13-\u0A28\u0A2A-\u0A30\u0A32-\u0A33\u0A35-\u0A36\u0A38-\u0A39\u0A3C\u0A3E-\u0A40\u0A41-\u0A42\u0A47-\u0A48\u0A4B-\u0A4D\u0A59-\u0A5C\u0A5E\u0A66-\u0A6F\u0A70-\u0A71\u0A72-\u0A74\u0A81-\u0A82\u0A83\u0A85-\u0A8D\u0A8F-\u0A91\u0A93-\u0AA8\u0AAA-\u0AB0\u0AB2-\u0AB3\u0AB5-\u0AB9\u0ABC\u0ABD\u0ABE-\u0AC0\u0AC1-\u0AC5\u0AC7-\u0AC8\u0AC9\u0ACB-\u0ACC\u0ACD\u0AD0\u0AE0-\u0AE1\u0AE2-\u0AE3\u0AE6-\u0AEF\u0B01\u0B02-\u0B03\u0B05-\u0B0C\u0B0F-\u0B10\u0B13-\u0B28\u0B2A-\u0B30\u0B32-\u0B33\u0B35-\u0B39\u0B3C\u0B3D\u0B3E\u0B3F\u0B40\u0B41-\u0B43\u0B47-\u0B48\u0B4B-\u0B4C\u0B4D\u0B56\u0B57\u0B5C-\u0B5D\u0B5F-\u0B61\u0B66-\u0B6F\u0B71\u0B82\u0B83\u0B85-\u0B8A\u0B8E-\u0B90\u0B92-\u0B95\u0B99-\u0B9A\u0B9C\u0B9E-\u0B9F\u0BA3-\u0BA4\u0BA8-\u0BAA\u0BAE-\u0BB9\u0BBE-\u0BBF\u0BC0\u0BC1-\u0BC2\u0BC6-\u0BC8\u0BCA-\u0BCC\u0BCD\u0BD7\u0BE6-\u0BEF\u0C01-\u0C03\u0C05-\u0C0C\u0C0E-\u0C10\u0C12-\u0C28\u0C2A-\u0C33\u0C35-\u0C39\u0C3E-\u0C40\u0C41-\u0C44\u0C46-\u0C48\u0C4A-\u0C4D\u0C55-\u0C56\u0C60-\u0C61\u0C66-\u0C6F\u0C82-\u0C83\u0C85-\u0C8C\u0C8E-\u0C90\u0C92-\u0CA8\u0CAA-\u0CB3\u0CB5-\u0CB9\u0CBC\u0CBD\u0CBE\u0CBF\u0CC0-\u0CC4\u0CC6\u0CC7-\u0CC8\u0CCA-\u0CCB\u0CCC-\u0CCD\u0CD5-\u0CD6\u0CDE\u0CE0-\u0CE1\u0CE6-\u0CEF\u0D02-\u0D03\u0D05-\u0D0C\u0D0E-\u0D10\u0D12-\u0D28\u0D2A-\u0D39\u0D3E-\u0D40\u0D41-\u0D43\u0D46-\u0D48\u0D4A-\u0D4C\u0D4D\u0D57\u0D60-\u0D61\u0D66-\u0D6F\u0D82-\u0D83\u0D85-\u0D96\u0D9A-\u0DB1\u0DB3-\u0DBB\u0DBD\u0DC0-\u0DC6\u0DCA\u0DCF-\u0DD1\u0DD2-\u0DD4\u0DD6\u0DD8-\u0DDF\u0DF2-\u0DF3\u0E01-\u0E30\u0E31\u0E32-\u0E33\u0E34-\u0E3A\u0E40-\u0E45\u0E46\u0E47-\u0E4E\u0E50-\u0E59\u0E81-\u0E82\u0E84\u0E87-\u0E88\u0E8A\u0E8D\u0E94-\u0E97\u0E99-\u0E9F\u0EA1-\u0EA3\u0EA5\u0EA7\u0EAA-\u0EAB\u0EAD-\u0EB0\u0EB1\u0EB2-\u0EB3\u0EB4-\u0EB9\u0EBB-\u0EBC\u0EBD\u0EC0-\u0EC4\u0EC6\u0EC8-\u0ECD\u0ED0-\u0ED9\u0EDC-\u0EDD\u0F00\u0F18-\u0F19\u0F20-\u0F29\u0F35\u0F37\u0F39\u0F3E-\u0F3F\u0F40-\u0F47\u0F49-\u0F6A\u0F71-\u0F7E\u0F7F\u0F80-\u0F84\u0F86-\u0F87\u0F88-\u0F8B\u0F90-\u0F97\u0F99-\u0FBC\u0FC6\u1000-\u1021\u1023-\u1027\u1029-\u102A\u102C\u102D-\u1030\u1031\u1032\u1036-\u1037\u1038\u1039\u1040-\u1049\u1050-\u1055\u1056-\u1057\u1058-\u1059\u10A0-\u10C5\u10D0-\u10FA\u10FC\u1100-\u1159\u115F-\u11A2\u11A8-\u11F9\u1200-\u1248\u124A-\u124D\u1250-\u1256\u1258\u125A-\u125D\u1260-\u1288\u128A-\u128D\u1290-\u12B0\u12B2-\u12B5\u12B8-\u12BE\u12C0\u12C2-\u12C5\u12C8-\u12D6\u12D8-\u1310\u1312-\u1315\u1318-\u135A\u135F\u1369-\u1371\u1380-\u138F\u13A0-\u13F4\u1401-\u166C\u166F-\u1676\u1681-\u169A\u16A0-\u16EA\u16EE-\u16F0\u1700-\u170C\u170E-\u1711\u1712-\u1714\u1720-\u1731\u1732-\u1734\u1740-\u1751\u1752-\u1753\u1760-\u176C\u176E-\u1770\u1772-\u1773\u1780-\u17B3\u17B6\u17B7-\u17BD\u17BE-\u17C5\u17C6\u17C7-\u17C8\u17C9-\u17D3\u17D7\u17DC\u17DD\u17E0-\u17E9\u180B-\u180D\u1810-\u1819\u1820-\u1842\u1843\u1844-\u1877\u1880-\u18A8\u18A9\u1900-\u191C\u1920-\u1922\u1923-\u1926\u1927-\u1928\u1929-\u192B\u1930-\u1931\u1932\u1933-\u1938\u1939-\u193B\u1946-\u194F\u1950-\u196D\u1970-\u1974\u1980-\u19A9\u19B0-\u19C0\u19C1-\u19C7\u19C8-\u19C9\u19D0-\u19D9\u1A00-\u1A16\u1A17-\u1A18\u1A19-\u1A1B\u1D00-\u1D2B\u1D2C-\u1D61\u1D62-\u1D77\u1D78\u1D79-\u1D9A\u1D9B-\u1DBF\u1DC0-\u1DC3\u1E00-\u1E9B\u1EA0-\u1EF9\u1F00-\u1F15\u1F18-\u1F1D\u1F20-\u1F45\u1F48-\u1F4D\u1F50-\u1F57\u1F59\u1F5B\u1F5D\u1F5F-\u1F7D\u1F80-\u1FB4\u1FB6-\u1FBC\u1FBE\u1FC2-\u1FC4\u1FC6-\u1FCC\u1FD0-\u1FD3\u1FD6-\u1FDB\u1FE0-\u1FEC\u1FF2-\u1FF4\u1FF6-\u1FFC\u203F-\u2040\u2054\u2071\u207F\u2090-\u2094\u20D0-\u20DC\u20E1\u20E5-\u20EB\u2102\u2107\u210A-\u2113\u2115\u2118\u2119-\u211D\u2124\u2126\u2128\u212A-\u212D\u212E\u212F-\u2131\u2133-\u2134\u2135-\u2138\u2139\u213C-\u213F\u2145-\u2149\u2160-\u2183\u2C00-\u2C2E\u2C30-\u2C5E\u2C80-\u2CE4\u2D00-\u2D25\u2D30-\u2D65\u2D6F\u2D80-\u2D96\u2DA0-\u2DA6\u2DA8-\u2DAE\u2DB0-\u2DB6\u2DB8-\u2DBE\u2DC0-\u2DC6\u2DC8-\u2DCE\u2DD0-\u2DD6\u2DD8-\u2DDE\u3005\u3006\u3007\u3021-\u3029\u302A-\u302F\u3031-\u3035\u3038-\u303A\u303B\u303C\u3041-\u3096\u3099-\u309A\u309D-\u309E\u309F\u30A1-\u30FA\u30FC-\u30FE\u30FF\u3105-\u312C\u3131-\u318E\u31A0-\u31B7\u31F0-\u31FF\u3400-\u4DB5\u4E00-\u9FBB\uA000-\uA014\uA015\uA016-\uA48C\uA800-\uA801\uA802\uA803-\uA805\uA806\uA807-\uA80A\uA80B\uA80C-\uA822\uA823-\uA824\uA825-\uA826\uA827\uAC00-\uD7A3\uF900-\uFA2D\uFA30-\uFA6A\uFA70-\uFAD9\uFB00-\uFB06\uFB13-\uFB17\uFB1D\uFB1E\uFB1F-\uFB28\uFB2A-\uFB36\uFB38-\uFB3C\uFB3E\uFB40-\uFB41\uFB43-\uFB44\uFB46-\uFBB1\uFBD3-\uFC5D\uFC64-\uFD3D\uFD50-\uFD8F\uFD92-\uFDC7\uFDF0-\uFDF9\uFE00-\uFE0F\uFE20-\uFE23\uFE33-\uFE34\uFE4D-\uFE4F\uFE71\uFE73\uFE77\uFE79\uFE7B\uFE7D\uFE7F-\uFEFC\uFF10-\uFF19\uFF21-\uFF3A\uFF3F\uFF41-\uFF5A\uFF66-\uFF6F\uFF70\uFF71-\uFF9D\uFF9E-\uFF9F\uFFA0-\uFFBE\uFFC2-\uFFC7\uFFCA-\uFFCF\uFFD2-\uFFD7\uFFDA-\uFFDC'
-
-def allexcept(*args):
-    newcats = cats[:]
-    for arg in args:
-        newcats.remove(arg)
-    return u''.join([globals()[cat] for cat in newcats])
-
-if __name__ == '__main__':
-    import unicodedata
-
-    categories = {}
-
-    f = open(__file__.rstrip('co'))
-    try:
-        content = f.read()
-    finally:
-        f.close()
-
-    header = content[:content.find('Cc =')]
-    footer = content[content.find("def combine("):]
-
-    for code in range(65535):
-        c = unichr(code)
-        cat = unicodedata.category(c)
-        categories.setdefault(cat, []).append(c)
-
-    f = open(__file__, 'w')
-    f.write(header)
-
-    for cat in sorted(categories):
-        val = u''.join(categories[cat])
-        if cat == 'Cs':
-            # Jython can't handle isolated surrogates
-            f.write("""\
-try:
-    Cs = eval(r"%r")
-except UnicodeDecodeError:
-    Cs = '' # Jython can't handle isolated surrogates\n\n""" % val)
-        else:
-            f.write('%s = %r\n\n' % (cat, val))
-    f.write('cats = %r\n\n' % sorted(categories.keys()))
-
-    f.write(footer)
-    f.close()
diff --git a/deps/v8/third_party/jinja2/asyncfilters.py b/deps/v8/third_party/jinja2/asyncfilters.py
new file mode 100644
index 00000000000..5c1f46d7fa7
--- /dev/null
+++ b/deps/v8/third_party/jinja2/asyncfilters.py
@@ -0,0 +1,146 @@
+from functools import wraps
+
+from jinja2.asyncsupport import auto_aiter
+from jinja2 import filters
+
+
+async def auto_to_seq(value):
+    seq = []
+    if hasattr(value, '__aiter__'):
+        async for item in value:
+            seq.append(item)
+    else:
+        for item in value:
+            seq.append(item)
+    return seq
+
+
+async def async_select_or_reject(args, kwargs, modfunc, lookup_attr):
+    seq, func = filters.prepare_select_or_reject(
+        args, kwargs, modfunc, lookup_attr)
+    if seq:
+        async for item in auto_aiter(seq):
+            if func(item):
+                yield item
+
+
+def dualfilter(normal_filter, async_filter):
+    wrap_evalctx = False
+    if getattr(normal_filter, 'environmentfilter', False):
+        is_async = lambda args: args[0].is_async
+        wrap_evalctx = False
+    else:
+        if not getattr(normal_filter, 'evalcontextfilter', False) and \
+           not getattr(normal_filter, 'contextfilter', False):
+            wrap_evalctx = True
+        is_async = lambda args: args[0].environment.is_async
+
+    @wraps(normal_filter)
+    def wrapper(*args, **kwargs):
+        b = is_async(args)
+        if wrap_evalctx:
+            args = args[1:]
+        if b:
+            return async_filter(*args, **kwargs)
+        return normal_filter(*args, **kwargs)
+
+    if wrap_evalctx:
+        wrapper.evalcontextfilter = True
+
+    wrapper.asyncfiltervariant = True
+
+    return wrapper
+
+
+def asyncfiltervariant(original):
+    def decorator(f):
+        return dualfilter(original, f)
+    return decorator
+
+
+@asyncfiltervariant(filters.do_first)
+async def do_first(environment, seq):
+    try:
+        return await auto_aiter(seq).__anext__()
+    except StopAsyncIteration:
+        return environment.undefined('No first item, sequence was empty.')
+
+
+@asyncfiltervariant(filters.do_groupby)
+async def do_groupby(environment, value, attribute):
+    expr = filters.make_attrgetter(environment, attribute)
+    return [filters._GroupTuple(key, await auto_to_seq(values))
+            for key, values in filters.groupby(sorted(
+                await auto_to_seq(value), key=expr), expr)]
+
+
+@asyncfiltervariant(filters.do_join)
+async def do_join(eval_ctx, value, d=u'', attribute=None):
+    return filters.do_join(eval_ctx, await auto_to_seq(value), d, attribute)
+
+
+@asyncfiltervariant(filters.do_list)
+async def do_list(value):
+    return await auto_to_seq(value)
+
+
+@asyncfiltervariant(filters.do_reject)
+async def do_reject(*args, **kwargs):
+    return async_select_or_reject(args, kwargs, lambda x: not x, False)
+
+
+@asyncfiltervariant(filters.do_rejectattr)
+async def do_rejectattr(*args, **kwargs):
+    return async_select_or_reject(args, kwargs, lambda x: not x, True)
+
+
+@asyncfiltervariant(filters.do_select)
+async def do_select(*args, **kwargs):
+    return async_select_or_reject(args, kwargs, lambda x: x, False)
+
+
+@asyncfiltervariant(filters.do_selectattr)
+async def do_selectattr(*args, **kwargs):
+    return async_select_or_reject(args, kwargs, lambda x: x, True)
+
+
+@asyncfiltervariant(filters.do_map)
+async def do_map(*args, **kwargs):
+    seq, func = filters.prepare_map(args, kwargs)
+    if seq:
+        async for item in auto_aiter(seq):
+            yield func(item)
+
+
+@asyncfiltervariant(filters.do_sum)
+async def do_sum(environment, iterable, attribute=None, start=0):
+    rv = start
+    if attribute is not None:
+        func = filters.make_attrgetter(environment, attribute)
+    else:
+        func = lambda x: x
+    async for item in auto_aiter(iterable):
+        rv += func(item)
+    return rv
+
+
+@asyncfiltervariant(filters.do_slice)
+async def do_slice(value, slices, fill_with=None):
+    return filters.do_slice(await auto_to_seq(value), slices, fill_with)
+
+
+ASYNC_FILTERS = {
+    'first':        do_first,
+    'groupby':      do_groupby,
+    'join':         do_join,
+    'list':         do_list,
+    # we intentionally do not support do_last because that would be
+    # ridiculous
+    'reject':       do_reject,
+    'rejectattr':   do_rejectattr,
+    'map':          do_map,
+    'select':       do_select,
+    'selectattr':   do_selectattr,
+    'sum':          do_sum,
+    'slice':        do_slice,
+}
diff --git a/deps/v8/third_party/jinja2/asyncsupport.py b/deps/v8/third_party/jinja2/asyncsupport.py
new file mode 100644
index 00000000000..b1e7b5ce9a2
--- /dev/null
+++ b/deps/v8/third_party/jinja2/asyncsupport.py
@@ -0,0 +1,256 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.asyncsupport
+    ~~~~~~~~~~~~~~~~~~~
+
+    Has all the code for async support which is implemented as a patch
+    for supported Python versions.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+import sys
+import asyncio
+import inspect
+from functools import update_wrapper
+
+from jinja2.utils import concat, internalcode, Markup
+from jinja2.environment import TemplateModule
+from jinja2.runtime import LoopContextBase, _last_iteration
+
+
+async def concat_async(async_gen):
+    rv = []
+    async def collect():
+        async for event in async_gen:
+            rv.append(event)
+    await collect()
+    return concat(rv)
+
+
+async def generate_async(self, *args, **kwargs):
+    vars = dict(*args, **kwargs)
+    try:
+        async for event in self.root_render_func(self.new_context(vars)):
+            yield event
+    except Exception:
+        exc_info = sys.exc_info()
+    else:
+        return
+    yield self.environment.handle_exception(exc_info, True)
+
+
+def wrap_generate_func(original_generate):
+    def _convert_generator(self, loop, args, kwargs):
+        async_gen = self.generate_async(*args, **kwargs)
+        try:
+            while 1:
+                yield loop.run_until_complete(async_gen.__anext__())
+        except StopAsyncIteration:
+            pass
+    def generate(self, *args, **kwargs):
+        if not self.environment.is_async:
+            return original_generate(self, *args, **kwargs)
+        return _convert_generator(self, asyncio.get_event_loop(), args, kwargs)
+    return update_wrapper(generate, original_generate)
+
+
+async def render_async(self, *args, **kwargs):
+    if not self.environment.is_async:
+        raise RuntimeError('The environment was not created with async mode '
+                           'enabled.')
+
+    vars = dict(*args, **kwargs)
+    ctx = self.new_context(vars)
+
+    try:
+        return await concat_async(self.root_render_func(ctx))
+    except Exception:
+        exc_info = sys.exc_info()
+    return self.environment.handle_exception(exc_info, True)
+
+
+def wrap_render_func(original_render):
+    def render(self, *args, **kwargs):
+        if not self.environment.is_async:
+            return original_render(self, *args, **kwargs)
+        loop = asyncio.get_event_loop()
+        return loop.run_until_complete(self.render_async(*args, **kwargs))
+    return update_wrapper(render, original_render)
+
+
+def wrap_block_reference_call(original_call):
+    @internalcode
+    async def async_call(self):
+        rv = await concat_async(self._stack[self._depth](self._context))
+        if self._context.eval_ctx.autoescape:
+            rv = Markup(rv)
+        return rv
+
+    @internalcode
+    def __call__(self):
+        if not self._context.environment.is_async:
+            return original_call(self)
+        return async_call(self)
+
+    return update_wrapper(__call__, original_call)
+
+
+def wrap_macro_invoke(original_invoke):
+    @internalcode
+    async def async_invoke(self, arguments, autoescape):
+        rv = await self._func(*arguments)
+        if autoescape:
+            rv = Markup(rv)
+        return rv
+
+    @internalcode
+    def _invoke(self, arguments, autoescape):
+        if not self._environment.is_async:
+            return original_invoke(self, arguments, autoescape)
+        return async_invoke(self, arguments, autoescape)
+    return update_wrapper(_invoke, original_invoke)
+
+
+@internalcode
+async def get_default_module_async(self):
+    if self._module is not None:
+        return self._module
+    self._module = rv = await self.make_module_async()
+    return rv
+
+
+def wrap_default_module(original_default_module):
+    @internalcode
+    def _get_default_module(self):
+        if self.environment.is_async:
+            raise RuntimeError('Template module attribute is unavailable '
+                               'in async mode')
+        return original_default_module(self)
+    return _get_default_module
+
+
+async def make_module_async(self, vars=None, shared=False, locals=None):
+    context = self.new_context(vars, shared, locals)
+    body_stream = []
+    async for item in self.root_render_func(context):
+        body_stream.append(item)
+    return TemplateModule(self, context, body_stream)
+
+
+def patch_template():
+    from jinja2 import Template
+    Template.generate = wrap_generate_func(Template.generate)
+    Template.generate_async = update_wrapper(
+        generate_async, Template.generate_async)
+    Template.render_async = update_wrapper(
+        render_async, Template.render_async)
+    Template.render = wrap_render_func(Template.render)
+    Template._get_default_module = wrap_default_module(
+        Template._get_default_module)
+    Template._get_default_module_async = get_default_module_async
+    Template.make_module_async = update_wrapper(
+        make_module_async, Template.make_module_async)
+
+
+def patch_runtime():
+    from jinja2.runtime import BlockReference, Macro
+    BlockReference.__call__ = wrap_block_reference_call(
+        BlockReference.__call__)
+    Macro._invoke = wrap_macro_invoke(Macro._invoke)
+
+
+def patch_filters():
+    from jinja2.filters import FILTERS
+    from jinja2.asyncfilters import ASYNC_FILTERS
+    FILTERS.update(ASYNC_FILTERS)
+
+
+def patch_all():
+    patch_template()
+    patch_runtime()
+    patch_filters()
+
+
+async def auto_await(value):
+    if inspect.isawaitable(value):
+        return await value
+    return value
+
+
+async def auto_aiter(iterable):
+    if hasattr(iterable, '__aiter__'):
+        async for item in iterable:
+            yield item
+        return
+    for item in iterable:
+        yield item
+
+
+class AsyncLoopContext(LoopContextBase):
+
+    def __init__(self, async_iterator, undefined, after, length, recurse=None,
+                 depth0=0):
+        LoopContextBase.__init__(self, undefined, recurse, depth0)
+        self._async_iterator = async_iterator
+        self._after = after
+        self._length = length
+
+    @property
+    def length(self):
+        if self._length is None:
+            raise TypeError('Loop length for some iterators cannot be '
+                            'lazily calculated in async mode')
+        return self._length
+
+    def __aiter__(self):
+        return AsyncLoopContextIterator(self)
+
+
+class AsyncLoopContextIterator(object):
+    __slots__ = ('context',)
+
+    def __init__(self, context):
+        self.context = context
+
+    def __aiter__(self):
+        return self
+
+    async def __anext__(self):
+        ctx = self.context
+        ctx.index0 += 1
+        if ctx._after is _last_iteration:
+            raise StopAsyncIteration()
+        ctx._before = ctx._current
+        ctx._current = ctx._after
+        try:
+            ctx._after = await ctx._async_iterator.__anext__()
+        except StopAsyncIteration:
+            ctx._after = _last_iteration
+        return ctx._current, ctx
+
+
+async def make_async_loop_context(iterable, undefined, recurse=None, depth0=0):
+    # Length is more complicated and less efficient in async mode.  The
+    # reason for this is that we cannot know if length will be used
+    # upfront but because length is a property we cannot lazily execute it
+    # later.  This means that we need to buffer it up and measure :(
+    #
+    # We however only do this for actual iterators, not for async
+    # iterators as blocking here does not seem like the best idea in the
+    # world.
+    try:
+        length = len(iterable)
+    except (TypeError, AttributeError):
+        if not hasattr(iterable, '__aiter__'):
+            iterable = tuple(iterable)
+            length = len(iterable)
+        else:
+            length = None
+    async_iterator = auto_aiter(iterable)
+    try:
+        after = await async_iterator.__anext__()
+    except StopAsyncIteration:
+        after = _last_iteration
+    return AsyncLoopContext(async_iterator, undefined, after, length, recurse,
+                            depth0)
diff --git a/deps/v8/third_party/jinja2/bccache.py b/deps/v8/third_party/jinja2/bccache.py
index f5bd3145f6b..080e527cabf 100644
--- a/deps/v8/third_party/jinja2/bccache.py
+++ b/deps/v8/third_party/jinja2/bccache.py
@@ -11,7 +11,7 @@
     Situations where this is useful are often forking web applications that
     are initialized on the first request.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD.
 """
 from os import path, listdir
@@ -45,7 +45,7 @@ def marshal_load(f):
         return marshal.loads(f.read())
 
 
-bc_version = 2
+bc_version = 3
 
 # magic version used to only change with new jinja versions.  With 2.6
 # we change this to also take Python version changes into account.  The
@@ -297,7 +297,7 @@ class MemcachedBytecodeCache(BytecodeCache):
     Libraries compatible with this class:
 
     -   `werkzeug <http://werkzeug.pocoo.org/>`_.contrib.cache
-    -   `python-memcached <http://www.tummy.com/Community/software/python-memcached/>`_
+    -   `python-memcached <https://www.tummy.com/Community/software/python-memcached/>`_
     -   `cmemcache <http://gijsbert.org/cmemcache/>`_
 
     (Unfortunately the django cache interface is not compatible because it
diff --git a/deps/v8/third_party/jinja2/compiler.py b/deps/v8/third_party/jinja2/compiler.py
index fad007b596f..d534a827391 100644
--- a/deps/v8/third_party/jinja2/compiler.py
+++ b/deps/v8/third_party/jinja2/compiler.py
@@ -5,19 +5,23 @@
 
     Compiles nodes into python code.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD, see LICENSE for more details.
 """
 from itertools import chain
 from copy import deepcopy
 from keyword import iskeyword as is_python_keyword
+from functools import update_wrapper
 from jinja2 import nodes
 from jinja2.nodes import EvalContext
 from jinja2.visitor import NodeVisitor
+from jinja2.optimizer import Optimizer
 from jinja2.exceptions import TemplateAssertionError
 from jinja2.utils import Markup, concat, escape
 from jinja2._compat import range_type, text_type, string_types, \
-     iteritems, NativeStringIO, imap
+     iteritems, NativeStringIO, imap, izip
+from jinja2.idtracking import Symbols, VAR_LOAD_PARAMETER, \
+     VAR_LOAD_RESOLVE, VAR_LOAD_ALIAS, VAR_LOAD_UNDEFINED
 
 
 operators = {
@@ -38,27 +42,43 @@
 else:
     dict_item_iter = 'items'
 
+code_features = ['division']
 
-# does if 0: dummy(x) get us x into the scope?
-def unoptimize_before_dead_code():
-    x = 42
-    def f():
-        if 0: dummy(x)
-    return f
+# does this python version support generator stops? (PEP 0479)
+try:
+    exec('from __future__ import generator_stop')
+    code_features.append('generator_stop')
+except SyntaxError:
+    pass
+
+# does this python version support yield from?
+try:
+    exec('def f(): yield from x()')
+except SyntaxError:
+    supports_yield_from = False
+else:
+    supports_yield_from = True
 
-# The getattr is necessary for pypy which does not set this attribute if
-# no closure is on the function
-unoptimize_before_dead_code = bool(
-    getattr(unoptimize_before_dead_code(), '__closure__', None))
+
+def optimizeconst(f):
+    def new_func(self, node, frame, **kwargs):
+        # Only optimize if the frame is not volatile
+        if self.optimized and not frame.eval_ctx.volatile:
+            new_node = self.optimizer.visit(node, frame.eval_ctx)
+            if new_node != node:
+                return self.visit(new_node, frame)
+        return f(self, node, frame, **kwargs)
+    return update_wrapper(new_func, f)
 
 
 def generate(node, environment, name, filename, stream=None,
-             defer_init=False):
+             defer_init=False, optimized=True):
     """Generate the python source for a node tree."""
     if not isinstance(node, nodes.Template):
         raise TypeError('Can\'t compile non template nodes')
     generator = environment.code_generator_class(environment, name, filename,
-                                                 stream, defer_init)
+                                                 stream, defer_init,
+                                                 optimized)
     generator.visit(node)
     if stream is None:
         return generator.stream.getvalue()
@@ -68,15 +88,14 @@ def has_safe_repr(value):
     """Does the node have a safe representation?"""
     if value is None or value is NotImplemented or value is Ellipsis:
         return True
-    if isinstance(value, (bool, int, float, complex, range_type,
-            Markup) + string_types):
+    if type(value) in (bool, int, float, complex, range_type, Markup) + string_types:
         return True
-    if isinstance(value, (tuple, list, set, frozenset)):
+    if type(value) in (tuple, list, set, frozenset):
         for item in value:
             if not has_safe_repr(item):
                 return False
         return True
-    elif isinstance(value, dict):
+    elif type(value) is dict:
         for key, value in iteritems(value):
             if not has_safe_repr(key):
                 return False
@@ -99,49 +118,22 @@ def find_undeclared(nodes, names):
     return visitor.undeclared
 
 
-class Identifiers(object):
-    """Tracks the status of identifiers in frames."""
-
-    def __init__(self):
-        # variables that are known to be declared (probably from outer
-        # frames or because they are special for the frame)
-        self.declared = set()
-
-        # undeclared variables from outer scopes
-        self.outer_undeclared = set()
-
-        # names that are accessed without being explicitly declared by
-        # this one or any of the outer scopes.  Names can appear both in
-        # declared and undeclared.
-        self.undeclared = set()
-
-        # names that are declared locally
-        self.declared_locally = set()
+class MacroRef(object):
 
-        # names that are declared by parameters
-        self.declared_parameter = set()
-
-    def add_special(self, name):
-        """Register a special name like `loop`."""
-        self.undeclared.discard(name)
-        self.declared.add(name)
-
-    def is_declared(self, name):
-        """Check if a name is declared in this or an outer scope."""
-        if name in self.declared_locally or name in self.declared_parameter:
-            return True
-        return name in self.declared
-
-    def copy(self):
-        return deepcopy(self)
+    def __init__(self, node):
+        self.node = node
+        self.accesses_caller = False
+        self.accesses_kwargs = False
+        self.accesses_varargs = False
 
 
 class Frame(object):
     """Holds compile time information for us."""
 
-    def __init__(self, eval_ctx, parent=None):
+    def __init__(self, eval_ctx, parent=None, level=None):
         self.eval_ctx = eval_ctx
-        self.identifiers = Identifiers()
+        self.symbols = Symbols(parent and parent.symbols or None,
+                               level=level)
 
         # a toplevel frame is the root + soft frames such as if conditions.
         self.toplevel = False
@@ -164,58 +156,31 @@ def __init__(self, eval_ctx, parent=None):
         # the name of the block we're in, otherwise None.
         self.block = parent and parent.block or None
 
-        # a set of actually assigned names
-        self.assigned_names = set()
-
         # the parent of this frame
         self.parent = parent
 
         if parent is not None:
-            self.identifiers.declared.update(
-                parent.identifiers.declared |
-                parent.identifiers.declared_parameter |
-                parent.assigned_names
-            )
-            self.identifiers.outer_undeclared.update(
-                parent.identifiers.undeclared -
-                self.identifiers.declared
-            )
             self.buffer = parent.buffer
 
     def copy(self):
         """Create a copy of the current one."""
         rv = object.__new__(self.__class__)
         rv.__dict__.update(self.__dict__)
-        rv.identifiers = object.__new__(self.identifiers.__class__)
-        rv.identifiers.__dict__.update(self.identifiers.__dict__)
+        rv.symbols = self.symbols.copy()
         return rv
 
-    def inspect(self, nodes):
-        """Walk the node and check for identifiers.  If the scope is hard (eg:
-        enforce on a python level) overrides from outer scopes are tracked
-        differently.
-        """
-        visitor = FrameIdentifierVisitor(self.identifiers)
-        for node in nodes:
-            visitor.visit(node)
-
-    def find_shadowed(self, extra=()):
-        """Find all the shadowed names.  extra is an iterable of variables
-        that may be defined with `add_special` which may occour scoped.
-        """
-        i = self.identifiers
-        return (i.declared | i.outer_undeclared) & \
-               (i.declared_locally | i.declared_parameter) | \
-               set(x for x in extra if i.is_declared(x))
-
-    def inner(self):
+    def inner(self, isolated=False):
         """Return an inner frame."""
+        if isolated:
+            return Frame(self.eval_ctx, level=self.symbols.level + 1)
         return Frame(self.eval_ctx, self)
 
     def soft(self):
         """Return a soft frame.  A soft frame may not be modified as
         standalone thing as it shares the resources with the frame it
         was created of, but it's not a rootlevel frame any longer.
+
+        This is only used to implement if-statements.
         """
         rv = self.copy()
         rv.rootlevel = False
@@ -269,95 +234,6 @@ def visit_Block(self, node):
         """Stop visiting a blocks."""
 
 
-class FrameIdentifierVisitor(NodeVisitor):
-    """A visitor for `Frame.inspect`."""
-
-    def __init__(self, identifiers):
-        self.identifiers = identifiers
-
-    def visit_Name(self, node):
-        """All assignments to names go through this function."""
-        if node.ctx == 'store':
-            self.identifiers.declared_locally.add(node.name)
-        elif node.ctx == 'param':
-            self.identifiers.declared_parameter.add(node.name)
-        elif node.ctx == 'load' and not \
-             self.identifiers.is_declared(node.name):
-            self.identifiers.undeclared.add(node.name)
-
-    def visit_If(self, node):
-        self.visit(node.test)
-        real_identifiers = self.identifiers
-
-        old_names = real_identifiers.declared_locally | \
-                    real_identifiers.declared_parameter
-
-        def inner_visit(nodes):
-            if not nodes:
-                return set()
-            self.identifiers = real_identifiers.copy()
-            for subnode in nodes:
-                self.visit(subnode)
-            rv = self.identifiers.declared_locally - old_names
-            # we have to remember the undeclared variables of this branch
-            # because we will have to pull them.
-            real_identifiers.undeclared.update(self.identifiers.undeclared)
-            self.identifiers = real_identifiers
-            return rv
-
-        body = inner_visit(node.body)
-        else_ = inner_visit(node.else_ or ())
-
-        # the differences between the two branches are also pulled as
-        # undeclared variables
-        real_identifiers.undeclared.update(body.symmetric_difference(else_) -
-                                           real_identifiers.declared)
-
-        # remember those that are declared.
-        real_identifiers.declared_locally.update(body | else_)
-
-    def visit_Macro(self, node):
-        self.identifiers.declared_locally.add(node.name)
-
-    def visit_Import(self, node):
-        self.generic_visit(node)
-        self.identifiers.declared_locally.add(node.target)
-
-    def visit_FromImport(self, node):
-        self.generic_visit(node)
-        for name in node.names:
-            if isinstance(name, tuple):
-                self.identifiers.declared_locally.add(name[1])
-            else:
-                self.identifiers.declared_locally.add(name)
-
-    def visit_Assign(self, node):
-        """Visit assignments in the correct order."""
-        self.visit(node.node)
-        self.visit(node.target)
-
-    def visit_For(self, node):
-        """Visiting stops at for blocks.  However the block sequence
-        is visited as part of the outer scope.
-        """
-        self.visit(node.iter)
-
-    def visit_CallBlock(self, node):
-        self.visit(node.call)
-
-    def visit_FilterBlock(self, node):
-        self.visit(node.filter)
-
-    def visit_AssignBlock(self, node):
-        """Stop visiting at block assigns."""
-
-    def visit_Scope(self, node):
-        """Stop visiting at scopes."""
-
-    def visit_Block(self, node):
-        """Stop visiting at blocks."""
-
-
 class CompilerExit(Exception):
     """Raised if the compiler encountered a situation where it just
     doesn't make sense to further process the code.  Any block that
@@ -368,7 +244,7 @@ class CompilerExit(Exception):
 class CodeGenerator(NodeVisitor):
 
     def __init__(self, environment, name, filename, stream=None,
-                 defer_init=False):
+                 defer_init=False, optimized=True):
         if stream is None:
             stream = NativeStringIO()
         self.environment = environment
@@ -377,6 +253,9 @@ def __init__(self, environment, name, filename, stream=None,
         self.stream = stream
         self.created_block_context = False
         self.defer_init = defer_init
+        self.optimized = optimized
+        if optimized:
+            self.optimizer = Optimizer(environment)
 
         # aliases for imports
         self.import_aliases = {}
@@ -420,6 +299,15 @@ def __init__(self, environment, name, filename, stream=None,
         # the current indentation
         self._indentation = 0
 
+        # Tracks toplevel assignments
+        self._assign_stack = []
+
+        # Tracks parameter definition blocks
+        self._param_def_block = []
+
+        # Tracks the current context.
+        self._context_reference_stack = ['context']
+
     # -- Various compilation helpers
 
     def fail(self, msg, lineno):
@@ -436,21 +324,23 @@ def buffer(self, frame):
         frame.buffer = self.temporary_identifier()
         self.writeline('%s = []' % frame.buffer)
 
-    def return_buffer_contents(self, frame):
+    def return_buffer_contents(self, frame, force_unescaped=False):
         """Return the buffer contents of the frame."""
-        if frame.eval_ctx.volatile:
-            self.writeline('if context.eval_ctx.autoescape:')
-            self.indent()
-            self.writeline('return Markup(concat(%s))' % frame.buffer)
-            self.outdent()
-            self.writeline('else:')
-            self.indent()
-            self.writeline('return concat(%s)' % frame.buffer)
-            self.outdent()
-        elif frame.eval_ctx.autoescape:
-            self.writeline('return Markup(concat(%s))' % frame.buffer)
-        else:
-            self.writeline('return concat(%s)' % frame.buffer)
+        if not force_unescaped:
+            if frame.eval_ctx.volatile:
+                self.writeline('if context.eval_ctx.autoescape:')
+                self.indent()
+                self.writeline('return Markup(concat(%s))' % frame.buffer)
+                self.outdent()
+                self.writeline('else:')
+                self.indent()
+                self.writeline('return concat(%s)' % frame.buffer)
+                self.outdent()
+                return
+            elif frame.eval_ctx.autoescape:
+                self.writeline('return Markup(concat(%s))' % frame.buffer)
+                return
+        self.writeline('return concat(%s)' % frame.buffer)
 
     def indent(self):
         """Indent by one."""
@@ -480,14 +370,10 @@ def simple_write(self, s, frame, node=None):
 
     def blockvisit(self, nodes, frame):
         """Visit a list of nodes as block in a frame.  If the current frame
-        is no buffer a dummy ``if 0: yield None`` is written automatically
-        unless the force_generator parameter is set to False.
+        is no buffer a dummy ``if 0: yield None`` is written automatically.
         """
-        if frame.buffer is None:
-            self.writeline('if 0: yield None')
-        else:
-            self.writeline('pass')
         try:
+            self.writeline('pass')
             for node in nodes:
                 self.visit(node, frame)
         except CompilerExit:
@@ -573,11 +459,6 @@ def signature(self, node, frame, extra_kwargs=None):
             self.write(', **')
             self.visit(node.dyn_kwargs, frame)
 
-    def pull_locals(self, frame):
-        """Pull all the references identifiers into the local scope."""
-        for name in frame.identifiers.undeclared:
-            self.writeline('l_%s = context.resolve(%r)' % (name, name))
-
     def pull_dependencies(self, nodes):
         """Pull all the dependencies."""
         visitor = DependencyFinderVisitor()
@@ -591,163 +472,123 @@ def pull_dependencies(self, nodes):
                 self.writeline('%s = environment.%s[%r]' %
                                (mapping[name], dependency, name))
 
-    def unoptimize_scope(self, frame):
-        """Disable Python optimizations for the frame."""
-        # XXX: this is not that nice but it has no real overhead.  It
-        # mainly works because python finds the locals before dead code
-        # is removed.  If that breaks we have to add a dummy function
-        # that just accepts the arguments and does nothing.
-        if frame.identifiers.declared:
-            self.writeline('%sdummy(%s)' % (
-                unoptimize_before_dead_code and 'if 0: ' or '',
-                ', '.join('l_' + name for name in frame.identifiers.declared)
-            ))
-
-    def push_scope(self, frame, extra_vars=()):
-        """This function returns all the shadowed variables in a dict
-        in the form name: alias and will write the required assignments
-        into the current scope.  No indentation takes place.
-
-        This also predefines locally declared variables from the loop
-        body because under some circumstances it may be the case that
-
-        `extra_vars` is passed to `Frame.find_shadowed`.
-        """
-        aliases = {}
-        for name in frame.find_shadowed(extra_vars):
-            aliases[name] = ident = self.temporary_identifier()
-            self.writeline('%s = l_%s' % (ident, name))
-        to_declare = set()
-        for name in frame.identifiers.declared_locally:
-            if name not in aliases:
-                to_declare.add('l_' + name)
-        if to_declare:
-            self.writeline(' = '.join(to_declare) + ' = missing')
-        return aliases
-
-    def pop_scope(self, aliases, frame):
-        """Restore all aliases and delete unused variables."""
-        for name, alias in iteritems(aliases):
-            self.writeline('l_%s = %s' % (name, alias))
-        to_delete = set()
-        for name in frame.identifiers.declared_locally:
-            if name not in aliases:
-                to_delete.add('l_' + name)
-        if to_delete:
-            # we cannot use the del statement here because enclosed
-            # scopes can trigger a SyntaxError:
-            #   a = 42; b = lambda: a; del a
-            self.writeline(' = '.join(to_delete) + ' = missing')
-
-    def function_scoping(self, node, frame, children=None,
-                         find_special=True):
-        """In Jinja a few statements require the help of anonymous
-        functions.  Those are currently macros and call blocks and in
-        the future also recursive loops.  As there is currently
-        technical limitation that doesn't allow reading and writing a
-        variable in a scope where the initial value is coming from an
-        outer scope, this function tries to fall back with a common
-        error message.  Additionally the frame passed is modified so
-        that the argumetns are collected and callers are looked up.
-
-        This will return the modified frame.
-        """
-        # we have to iterate twice over it, make sure that works
-        if children is None:
-            children = node.iter_child_nodes()
-        children = list(children)
-        func_frame = frame.inner()
-        func_frame.inspect(children)
-
-        # variables that are undeclared (accessed before declaration) and
-        # declared locally *and* part of an outside scope raise a template
-        # assertion error. Reason: we can't generate reasonable code from
-        # it without aliasing all the variables.
-        # this could be fixed in Python 3 where we have the nonlocal
-        # keyword or if we switch to bytecode generation
-        overridden_closure_vars = (
-            func_frame.identifiers.undeclared &
-            func_frame.identifiers.declared &
-            (func_frame.identifiers.declared_locally |
-             func_frame.identifiers.declared_parameter)
-        )
-        if overridden_closure_vars:
-            self.fail('It\'s not possible to set and access variables '
-                      'derived from an outer scope! (affects: %s)' %
-                      ', '.join(sorted(overridden_closure_vars)), node.lineno)
-
-        # remove variables from a closure from the frame's undeclared
-        # identifiers.
-        func_frame.identifiers.undeclared -= (
-            func_frame.identifiers.undeclared &
-            func_frame.identifiers.declared
-        )
-
-        # no special variables for this scope, abort early
-        if not find_special:
-            return func_frame
-
-        func_frame.accesses_kwargs = False
-        func_frame.accesses_varargs = False
-        func_frame.accesses_caller = False
-        func_frame.arguments = args = ['l_' + x.name for x in node.args]
-
-        undeclared = find_undeclared(children, ('caller', 'kwargs', 'varargs'))
+    def enter_frame(self, frame):
+        undefs = []
+        for target, (action, param) in iteritems(frame.symbols.loads):
+            if action == VAR_LOAD_PARAMETER:
+                pass
+            elif action == VAR_LOAD_RESOLVE:
+                self.writeline('%s = %s(%r)' %
+                               (target, self.get_resolve_func(), param))
+            elif action == VAR_LOAD_ALIAS:
+                self.writeline('%s = %s' % (target, param))
+            elif action == VAR_LOAD_UNDEFINED:
+                undefs.append(target)
+            else:
+                raise NotImplementedError('unknown load instruction')
+        if undefs:
+            self.writeline('%s = missing' % ' = '.join(undefs))
+
+    def leave_frame(self, frame, with_python_scope=False):
+        if not with_python_scope:
+            undefs = []
+            for target, _ in iteritems(frame.symbols.loads):
+                undefs.append(target)
+            if undefs:
+                self.writeline('%s = missing' % ' = '.join(undefs))
+
+    def func(self, name):
+        if self.environment.is_async:
+            return 'async def %s' % name
+        return 'def %s' % name
+
+    def macro_body(self, node, frame):
+        """Dump the function def of a macro or call block."""
+        frame = frame.inner()
+        frame.symbols.analyze_node(node)
+        macro_ref = MacroRef(node)
+
+        explicit_caller = None
+        skip_special_params = set()
+        args = []
+        for idx, arg in enumerate(node.args):
+            if arg.name == 'caller':
+                explicit_caller = idx
+            if arg.name in ('kwargs', 'varargs'):
+                skip_special_params.add(arg.name)
+            args.append(frame.symbols.ref(arg.name))
+
+        undeclared = find_undeclared(node.body, ('caller', 'kwargs', 'varargs'))
 
         if 'caller' in undeclared:
-            func_frame.accesses_caller = True
-            func_frame.identifiers.add_special('caller')
-            args.append('l_caller')
-        if 'kwargs' in undeclared:
-            func_frame.accesses_kwargs = True
-            func_frame.identifiers.add_special('kwargs')
-            args.append('l_kwargs')
-        if 'varargs' in undeclared:
-            func_frame.accesses_varargs = True
-            func_frame.identifiers.add_special('varargs')
-            args.append('l_varargs')
-        return func_frame
-
-    def macro_body(self, node, frame, children=None):
-        """Dump the function def of a macro or call block."""
-        frame = self.function_scoping(node, frame, children)
+            # In older Jinja2 versions there was a bug that allowed caller
+            # to retain the special behavior even if it was mentioned in
+            # the argument list.  However thankfully this was only really
+            # working if it was the last argument.  So we are explicitly
+            # checking this now and error out if it is anywhere else in
+            # the argument list.
+            if explicit_caller is not None:
+                try:
+                    node.defaults[explicit_caller - len(node.args)]
+                except IndexError:
+                    self.fail('When defining macros or call blocks the '
+                              'special "caller" argument must be omitted '
+                              'or be given a default.', node.lineno)
+            else:
+                args.append(frame.symbols.declare_parameter('caller'))
+            macro_ref.accesses_caller = True
+        if 'kwargs' in undeclared and not 'kwargs' in skip_special_params:
+            args.append(frame.symbols.declare_parameter('kwargs'))
+            macro_ref.accesses_kwargs = True
+        if 'varargs' in undeclared and not 'varargs' in skip_special_params:
+            args.append(frame.symbols.declare_parameter('varargs'))
+            macro_ref.accesses_varargs = True
+
         # macros are delayed, they never require output checks
         frame.require_output_check = False
-        args = frame.arguments
-        # XXX: this is an ugly fix for the loop nesting bug
-        # (tests.test_old_bugs.test_loop_call_bug).  This works around
-        # a identifier nesting problem we have in general.  It's just more
-        # likely to happen in loops which is why we work around it.  The
-        # real solution would be "nonlocal" all the identifiers that are
-        # leaking into a new python frame and might be used both unassigned
-        # and assigned.
-        if 'loop' in frame.identifiers.declared:
-            args = args + ['l_loop=l_loop']
-        self.writeline('def macro(%s):' % ', '.join(args), node)
+        frame.symbols.analyze_node(node)
+        self.writeline('%s(%s):' % (self.func('macro'), ', '.join(args)), node)
         self.indent()
+
         self.buffer(frame)
-        self.pull_locals(frame)
+        self.enter_frame(frame)
+
+        self.push_parameter_definitions(frame)
+        for idx, arg in enumerate(node.args):
+            ref = frame.symbols.ref(arg.name)
+            self.writeline('if %s is missing:' % ref)
+            self.indent()
+            try:
+                default = node.defaults[idx - len(node.args)]
+            except IndexError:
+                self.writeline('%s = undefined(%r, name=%r)' % (
+                    ref,
+                    'parameter %r was not provided' % arg.name,
+                    arg.name))
+            else:
+                self.writeline('%s = ' % ref)
+                self.visit(default, frame)
+            self.mark_parameter_stored(ref)
+            self.outdent()
+        self.pop_parameter_definitions()
+
         self.blockvisit(node.body, frame)
-        self.return_buffer_contents(frame)
+        self.return_buffer_contents(frame, force_unescaped=True)
+        self.leave_frame(frame, with_python_scope=True)
         self.outdent()
-        return frame
 
-    def macro_def(self, node, frame):
+        return frame, macro_ref
+
+    def macro_def(self, macro_ref, frame):
         """Dump the macro definition for the def created by macro_body."""
-        arg_tuple = ', '.join(repr(x.name) for x in node.args)
-        name = getattr(node, 'name', None)
-        if len(node.args) == 1:
+        arg_tuple = ', '.join(repr(x.name) for x in macro_ref.node.args)
+        name = getattr(macro_ref.node, 'name', None)
+        if len(macro_ref.node.args) == 1:
             arg_tuple += ','
-        self.write('Macro(environment, macro, %r, (%s), (' %
-                   (name, arg_tuple))
-        for arg in node.defaults:
-            self.visit(arg, frame)
-            self.write(', ')
-        self.write('), %r, %r, %r)' % (
-            bool(frame.accesses_kwargs),
-            bool(frame.accesses_varargs),
-            bool(frame.accesses_caller)
-        ))
+        self.write('Macro(environment, macro, %r, (%s), %r, %r, %r, '
+                   'context.eval_ctx.autoescape)' %
+                   (name, arg_tuple, macro_ref.accesses_kwargs,
+                    macro_ref.accesses_varargs, macro_ref.accesses_caller))
 
     def position(self, node):
         """Return a human readable position for the node."""
@@ -756,6 +597,99 @@ def position(self, node):
             rv += ' in ' + repr(self.name)
         return rv
 
+    def dump_local_context(self, frame):
+        return '{%s}' % ', '.join(
+            '%r: %s' % (name, target) for name, target
+            in iteritems(frame.symbols.dump_stores()))
+
+    def write_commons(self):
+        """Writes a common preamble that is used by root and block functions.
+        Primarily this sets up common local helpers and enforces a generator
+        through a dead branch.
+        """
+        self.writeline('resolve = context.resolve_or_missing')
+        self.writeline('undefined = environment.undefined')
+        self.writeline('if 0: yield None')
+
+    def push_parameter_definitions(self, frame):
+        """Pushes all parameter targets from the given frame into a local
+        stack that permits tracking of yet to be assigned parameters.  In
+        particular this enables the optimization from `visit_Name` to skip
+        undefined expressions for parameters in macros as macros can reference
+        otherwise unbound parameters.
+        """
+        self._param_def_block.append(frame.symbols.dump_param_targets())
+
+    def pop_parameter_definitions(self):
+        """Pops the current parameter definitions set."""
+        self._param_def_block.pop()
+
+    def mark_parameter_stored(self, target):
+        """Marks a parameter in the current parameter definitions as stored.
+        This will skip the enforced undefined checks.
+        """
+        if self._param_def_block:
+            self._param_def_block[-1].discard(target)
+
+    def push_context_reference(self, target):
+        self._context_reference_stack.append(target)
+
+    def pop_context_reference(self):
+        self._context_reference_stack.pop()
+
+    def get_context_ref(self):
+        return self._context_reference_stack[-1]
+
+    def get_resolve_func(self):
+        target = self._context_reference_stack[-1]
+        if target == 'context':
+            return 'resolve'
+        return '%s.resolve' % target
+
+    def derive_context(self, frame):
+        return '%s.derived(%s)' % (
+            self.get_context_ref(),
+            self.dump_local_context(frame),
+        )
+
+    def parameter_is_undeclared(self, target):
+        """Checks if a given target is an undeclared parameter."""
+        if not self._param_def_block:
+            return False
+        return target in self._param_def_block[-1]
+
+    def push_assign_tracking(self):
+        """Pushes a new layer for assignment tracking."""
+        self._assign_stack.append(set())
+
+    def pop_assign_tracking(self, frame):
+        """Pops the topmost level for assignment tracking and updates the
+        context variables if necessary.
+        """
+        vars = self._assign_stack.pop()
+        if not frame.toplevel or not vars:
+            return
+        public_names = [x for x in vars if x[:1] != '_']
+        if len(vars) == 1:
+            name = next(iter(vars))
+            ref = frame.symbols.ref(name)
+            self.writeline('context.vars[%r] = %s' % (name, ref))
+        else:
+            self.writeline('context.vars.update({')
+            for idx, name in enumerate(vars):
+                if idx:
+                    self.write(', ')
+                ref = frame.symbols.ref(name)
+                self.write('%r: %s' % (name, ref))
+            self.write('})')
+        if public_names:
+            if len(public_names) == 1:
+                self.writeline('context.exported_vars.add(%r)' %
+                               public_names[0])
+            else:
+                self.writeline('context.exported_vars.update((%s))' %
+                               ', '.join(imap(repr, public_names)))
+
     # -- Statement Visitors
 
     def visit_Template(self, node, frame=None):
@@ -763,10 +697,12 @@ def visit_Template(self, node, frame=None):
         eval_ctx = EvalContext(self.environment, self.name)
 
         from jinja2.runtime import __all__ as exported
-        self.writeline('from __future__ import division')
+        self.writeline('from __future__ import %s' % ', '.join(code_features))
         self.writeline('from jinja2.runtime import ' + ', '.join(exported))
-        if not unoptimize_before_dead_code:
-            self.writeline('dummy = lambda *x: None')
+
+        if self.environment.is_async:
+            self.writeline('from jinja2.asyncsupport import auto_await, '
+                           'auto_aiter, make_async_loop_context')
 
         # if we want a deferred initialization we cannot move the
         # environment into a local name
@@ -798,22 +734,25 @@ def visit_Template(self, node, frame=None):
         self.writeline('name = %r' % self.name)
 
         # generate the root render function.
-        self.writeline('def root(context%s):' % envenv, extra=1)
+        self.writeline('%s(context, missing=missing%s):' %
+                       (self.func('root'), envenv), extra=1)
+        self.indent()
+        self.write_commons()
 
         # process the root
         frame = Frame(eval_ctx)
-        frame.inspect(node.body)
+        if 'self' in find_undeclared(node.body, ('self',)):
+            ref = frame.symbols.declare_parameter('self')
+            self.writeline('%s = TemplateReference(context)' % ref)
+        frame.symbols.analyze_node(node)
         frame.toplevel = frame.rootlevel = True
         frame.require_output_check = have_extends and not self.has_known_extends
-        self.indent()
         if have_extends:
             self.writeline('parent_template = None')
-        if 'self' in find_undeclared(node.body, ('self',)):
-            frame.identifiers.add_special('self')
-            self.writeline('l_self = TemplateReference(context)')
-        self.pull_locals(frame)
+        self.enter_frame(frame)
         self.pull_dependencies(node.body)
         self.blockvisit(node.body, frame)
+        self.leave_frame(frame, with_python_scope=True)
         self.outdent()
 
         # make sure that the parent root is called.
@@ -822,31 +761,43 @@ def visit_Template(self, node, frame=None):
                 self.indent()
                 self.writeline('if parent_template is not None:')
             self.indent()
-            self.writeline('for event in parent_template.'
-                           'root_render_func(context):')
-            self.indent()
-            self.writeline('yield event')
-            self.outdent(2 + (not self.has_known_extends))
+            if supports_yield_from and not self.environment.is_async:
+                self.writeline('yield from parent_template.'
+                               'root_render_func(context)')
+            else:
+                self.writeline('%sfor event in parent_template.'
+                               'root_render_func(context):' %
+                               (self.environment.is_async and 'async ' or ''))
+                self.indent()
+                self.writeline('yield event')
+                self.outdent()
+            self.outdent(1 + (not self.has_known_extends))
 
         # at this point we now have the blocks collected and can visit them too.
         for name, block in iteritems(self.blocks):
-            block_frame = Frame(eval_ctx)
-            block_frame.inspect(block.body)
-            block_frame.block = name
-            self.writeline('def block_%s(context%s):' % (name, envenv),
+            self.writeline('%s(context, missing=missing%s):' %
+                           (self.func('block_' + name), envenv),
                            block, 1)
             self.indent()
+            self.write_commons()
+            # It's important that we do not make this frame a child of the
+            # toplevel template.  This would cause a variety of
+            # interesting issues with identifier tracking.
+            block_frame = Frame(eval_ctx)
             undeclared = find_undeclared(block.body, ('self', 'super'))
             if 'self' in undeclared:
-                block_frame.identifiers.add_special('self')
-                self.writeline('l_self = TemplateReference(context)')
+                ref = block_frame.symbols.declare_parameter('self')
+                self.writeline('%s = TemplateReference(context)' % ref)
             if 'super' in undeclared:
-                block_frame.identifiers.add_special('super')
-                self.writeline('l_super = context.super(%r, '
-                               'block_%s)' % (name, name))
-            self.pull_locals(block_frame)
+                ref = block_frame.symbols.declare_parameter('super')
+                self.writeline('%s = context.super(%r, '
+                               'block_%s)' % (ref, name, name))
+            block_frame.symbols.analyze_node(block)
+            block_frame.block = name
+            self.enter_frame(block_frame)
             self.pull_dependencies(block.body)
             self.blockvisit(block.body, block_frame)
+            self.leave_frame(block_frame, with_python_scope=True)
             self.outdent()
 
         self.writeline('blocks = {%s}' % ', '.join('%r: block_%s' % (x, x)
@@ -859,7 +810,7 @@ def visit_Template(self, node, frame=None):
 
     def visit_Block(self, node, frame):
         """Call a block and register it for the template."""
-        level = 1
+        level = 0
         if frame.toplevel:
             # if we know that we are a child template, there is no need to
             # check if we are one
@@ -869,11 +820,24 @@ def visit_Block(self, node, frame):
                 self.writeline('if parent_template is None:')
                 self.indent()
                 level += 1
-        context = node.scoped and 'context.derived(locals())' or 'context'
-        self.writeline('for event in context.blocks[%r][0](%s):' % (
-                       node.name, context), node)
-        self.indent()
-        self.simple_write('event', frame)
+
+        if node.scoped:
+            context = self.derive_context(frame)
+        else:
+            context = self.get_context_ref()
+
+        if supports_yield_from and not self.environment.is_async and \
+           frame.buffer is None:
+            self.writeline('yield from context.blocks[%r][0](%s)' % (
+                           node.name, context), node)
+        else:
+            loop = self.environment.is_async and 'async for' or 'for'
+            self.writeline('%s event in context.blocks[%r][0](%s):' % (
+                           loop, node.name, context), node)
+            self.indent()
+            self.simple_write('event', frame)
+            self.outdent()
+
         self.outdent(level)
 
     def visit_Extends(self, node, frame):
@@ -925,8 +889,6 @@ def visit_Extends(self, node, frame):
 
     def visit_Include(self, node, frame):
         """Handles includes."""
-        if node.with_context:
-            self.unoptimize_scope(frame)
         if node.ignore_missing:
             self.writeline('try:')
             self.indent()
@@ -952,48 +914,69 @@ def visit_Include(self, node, frame):
             self.writeline('else:')
             self.indent()
 
+        skip_event_yield = False
         if node.with_context:
-            self.writeline('for event in template.root_render_func('
-                           'template.new_context(context.parent, True, '
-                           'locals())):')
+            loop = self.environment.is_async and 'async for' or 'for'
+            self.writeline('%s event in template.root_render_func('
+                           'template.new_context(context.get_all(), True, '
+                           '%s)):' % (loop, self.dump_local_context(frame)))
+        elif self.environment.is_async:
+            self.writeline('for event in (await '
+                           'template._get_default_module_async())'
+                           '._body_stream:')
         else:
-            self.writeline('for event in template.module._body_stream:')
+            if supports_yield_from:
+                self.writeline('yield from template._get_default_module()'
+                               '._body_stream')
+                skip_event_yield = True
+            else:
+                self.writeline('for event in template._get_default_module()'
+                               '._body_stream:')
 
-        self.indent()
-        self.simple_write('event', frame)
-        self.outdent()
+        if not skip_event_yield:
+            self.indent()
+            self.simple_write('event', frame)
+            self.outdent()
 
         if node.ignore_missing:
             self.outdent()
 
     def visit_Import(self, node, frame):
         """Visit regular imports."""
-        if node.with_context:
-            self.unoptimize_scope(frame)
-        self.writeline('l_%s = ' % node.target, node)
+        self.writeline('%s = ' % frame.symbols.ref(node.target), node)
         if frame.toplevel:
             self.write('context.vars[%r] = ' % node.target)
+        if self.environment.is_async:
+            self.write('await ')
         self.write('environment.get_template(')
         self.visit(node.template, frame)
         self.write(', %r).' % self.name)
         if node.with_context:
-            self.write('make_module(context.parent, True, locals())')
+            self.write('make_module%s(context.get_all(), True, %s)'
+                       % (self.environment.is_async and '_async' or '',
+                          self.dump_local_context(frame)))
+        elif self.environment.is_async:
+            self.write('_get_default_module_async()')
         else:
-            self.write('module')
+            self.write('_get_default_module()')
         if frame.toplevel and not node.target.startswith('_'):
             self.writeline('context.exported_vars.discard(%r)' % node.target)
-        frame.assigned_names.add(node.target)
 
     def visit_FromImport(self, node, frame):
         """Visit named imports."""
         self.newline(node)
-        self.write('included_template = environment.get_template(')
+        self.write('included_template = %senvironment.get_template('
+                   % (self.environment.is_async and 'await ' or ''))
         self.visit(node.template, frame)
         self.write(', %r).' % self.name)
         if node.with_context:
-            self.write('make_module(context.parent, True)')
+            self.write('make_module%s(context.get_all(), True, %s)'
+                       % (self.environment.is_async and '_async' or '',
+                          self.dump_local_context(frame)))
+        elif self.environment.is_async:
+            self.write('_get_default_module_async()')
         else:
-            self.write('module')
+            self.write('_get_default_module()')
 
         var_names = []
         discarded_names = []
@@ -1002,15 +985,16 @@ def visit_FromImport(self, node, frame):
                 name, alias = name
             else:
                 alias = name
-            self.writeline('l_%s = getattr(included_template, '
-                           '%r, missing)' % (alias, name))
-            self.writeline('if l_%s is missing:' % alias)
+            self.writeline('%s = getattr(included_template, '
+                           '%r, missing)' % (frame.symbols.ref(alias), name))
+            self.writeline('if %s is missing:' % frame.symbols.ref(alias))
             self.indent()
-            self.writeline('l_%s = environment.undefined(%r %% '
+            self.writeline('%s = undefined(%r %% '
                            'included_template.__name__, '
                            'name=%r)' %
-                           (alias, 'the template %%r (imported on %s) does '
-                           'not export the requested name %s' % (
+                           (frame.symbols.ref(alias),
+                            'the template %%r (imported on %s) does '
+                            'not export the requested name %s' % (
                                 self.position(node),
                                 repr(name)
                            ), name))
@@ -1019,15 +1003,15 @@ def visit_FromImport(self, node, frame):
                 var_names.append(alias)
                 if not alias.startswith('_'):
                     discarded_names.append(alias)
-            frame.assigned_names.add(alias)
 
         if var_names:
             if len(var_names) == 1:
                 name = var_names[0]
-                self.writeline('context.vars[%r] = l_%s' % (name, name))
+                self.writeline('context.vars[%r] = %s' %
+                               (name, frame.symbols.ref(name)))
             else:
                 self.writeline('context.vars.update({%s})' % ', '.join(
-                    '%r: l_%s' % (name, name) for name in var_names
+                    '%r: %s' % (name, frame.symbols.ref(name)) for name in var_names
                 ))
         if discarded_names:
             if len(discarded_names) == 1:
@@ -1038,15 +1022,9 @@ def visit_FromImport(self, node, frame):
                                'update((%s))' % ', '.join(imap(repr, discarded_names)))
 
     def visit_For(self, node, frame):
-        # when calculating the nodes for the inner frame we have to exclude
-        # the iterator contents from it
-        children = node.iter_child_nodes(exclude=('iter',))
-        if node.recursive:
-            loop_frame = self.function_scoping(node, frame, children,
-                                               find_special=False)
-        else:
-            loop_frame = frame.inner()
-            loop_frame.inspect(children)
+        loop_frame = frame.inner()
+        test_frame = frame.inner()
+        else_frame = frame.inner()
 
         # try to figure out if we have an extended loop.  An extended loop
         # is necessary if the loop is in recursive mode if the special loop
@@ -1055,111 +1033,121 @@ def visit_For(self, node, frame):
                         find_undeclared(node.iter_child_nodes(
                             only=('body',)), ('loop',))
 
+        loop_ref = None
+        if extended_loop:
+            loop_ref = loop_frame.symbols.declare_parameter('loop')
+
+        loop_frame.symbols.analyze_node(node, for_branch='body')
+        if node.else_:
+            else_frame.symbols.analyze_node(node, for_branch='else')
+
+        if node.test:
+            loop_filter_func = self.temporary_identifier()
+            test_frame.symbols.analyze_node(node, for_branch='test')
+            self.writeline('%s(fiter):' % self.func(loop_filter_func), node.test)
+            self.indent()
+            self.enter_frame(test_frame)
+            self.writeline(self.environment.is_async and 'async for ' or 'for ')
+            self.visit(node.target, loop_frame)
+            self.write(' in ')
+            self.write(self.environment.is_async and 'auto_aiter(fiter)' or 'fiter')
+            self.write(':')
+            self.indent()
+            self.writeline('if ', node.test)
+            self.visit(node.test, test_frame)
+            self.write(':')
+            self.indent()
+            self.writeline('yield ')
+            self.visit(node.target, loop_frame)
+            self.outdent(3)
+            self.leave_frame(test_frame, with_python_scope=True)
+
         # if we don't have an recursive loop we have to find the shadowed
         # variables at that point.  Because loops can be nested but the loop
         # variable is a special one we have to enforce aliasing for it.
-        if not node.recursive:
-            aliases = self.push_scope(loop_frame, ('loop',))
-
-        # otherwise we set up a buffer and add a function def
-        else:
-            self.writeline('def loop(reciter, loop_render_func, depth=0):', node)
+        if node.recursive:
+            self.writeline('%s(reciter, loop_render_func, depth=0):' %
+                           self.func('loop'), node)
             self.indent()
             self.buffer(loop_frame)
-            aliases = {}
+
+            # Use the same buffer for the else frame
+            else_frame.buffer = loop_frame.buffer
 
         # make sure the loop variable is a special one and raise a template
         # assertion error if a loop tries to write to loop
         if extended_loop:
-            self.writeline('l_loop = missing')
-            loop_frame.identifiers.add_special('loop')
+            self.writeline('%s = missing' % loop_ref)
+
         for name in node.find_all(nodes.Name):
             if name.ctx == 'store' and name.name == 'loop':
                 self.fail('Can\'t assign to special loop variable '
                           'in for-loop target', name.lineno)
 
-        self.pull_locals(loop_frame)
         if node.else_:
             iteration_indicator = self.temporary_identifier()
             self.writeline('%s = 1' % iteration_indicator)
 
-        # Create a fake parent loop if the else or test section of a
-        # loop is accessing the special loop variable and no parent loop
-        # exists.
-        if 'loop' not in aliases and 'loop' in find_undeclared(
-           node.iter_child_nodes(only=('else_', 'test')), ('loop',)):
-            self.writeline("l_loop = environment.undefined(%r, name='loop')" %
-                ("'loop' is undefined. the filter section of a loop as well "
-                 "as the else block don't have access to the special 'loop'"
-                 " variable of the current loop.  Because there is no parent "
-                 "loop it's undefined.  Happened in loop on %s" %
-                 self.position(node)))
-
-        self.writeline('for ', node)
+        self.writeline(self.environment.is_async and 'async for ' or 'for ', node)
         self.visit(node.target, loop_frame)
-        self.write(extended_loop and ', l_loop in LoopContext(' or ' in ')
-
-        # if we have an extened loop and a node test, we filter in the
-        # "outer frame".
-        if extended_loop and node.test is not None:
-            self.write('(')
-            self.visit(node.target, loop_frame)
-            self.write(' for ')
-            self.visit(node.target, loop_frame)
-            self.write(' in ')
-            if node.recursive:
-                self.write('reciter')
+        if extended_loop:
+            if self.environment.is_async:
+                self.write(', %s in await make_async_loop_context(' % loop_ref)
             else:
-                self.visit(node.iter, loop_frame)
-            self.write(' if (')
-            test_frame = loop_frame.copy()
-            self.visit(node.test, test_frame)
-            self.write('))')
+                self.write(', %s in LoopContext(' % loop_ref)
+        else:
+            self.write(' in ')
 
-        elif node.recursive:
+        if node.test:
+            self.write('%s(' % loop_filter_func)
+        if node.recursive:
             self.write('reciter')
         else:
-            self.visit(node.iter, loop_frame)
+            if self.environment.is_async and not extended_loop:
+                self.write('auto_aiter(')
+            self.visit(node.iter, frame)
+            if self.environment.is_async and not extended_loop:
+                self.write(')')
+        if node.test:
+            self.write(')')
 
         if node.recursive:
-            self.write(', loop_render_func, depth):')
+            self.write(', undefined, loop_render_func, depth):')
         else:
-            self.write(extended_loop and '):' or ':')
-
-        # tests in not extended loops become a continue
-        if not extended_loop and node.test is not None:
-            self.indent()
-            self.writeline('if not ')
-            self.visit(node.test, loop_frame)
-            self.write(':')
-            self.indent()
-            self.writeline('continue')
-            self.outdent(2)
+            self.write(extended_loop and ', undefined):' or ':')
 
         self.indent()
+        self.enter_frame(loop_frame)
+
         self.blockvisit(node.body, loop_frame)
         if node.else_:
             self.writeline('%s = 0' % iteration_indicator)
         self.outdent()
+        self.leave_frame(loop_frame, with_python_scope=node.recursive
+                         and not node.else_)
 
         if node.else_:
             self.writeline('if %s:' % iteration_indicator)
             self.indent()
-            self.blockvisit(node.else_, loop_frame)
+            self.enter_frame(else_frame)
+            self.blockvisit(node.else_, else_frame)
+            self.leave_frame(else_frame)
             self.outdent()
 
-        # reset the aliases if there are any.
-        if not node.recursive:
-            self.pop_scope(aliases, loop_frame)
-
         # if the node was recursive we have to return the buffer contents
         # and start the iteration code
         if node.recursive:
             self.return_buffer_contents(loop_frame)
             self.outdent()
             self.start_write(frame, node)
+            if self.environment.is_async:
+                self.write('await ')
             self.write('loop(')
+            if self.environment.is_async:
+                self.write('auto_aiter(')
             self.visit(node.iter, frame)
+            if self.environment.is_async:
+                self.write(')')
             self.write(', loop)')
             self.end_write(frame)
 
@@ -1171,6 +1159,13 @@ def visit_If(self, node, frame):
         self.indent()
         self.blockvisit(node.body, if_frame)
         self.outdent()
+        for elif_ in node.elif_:
+            self.writeline('elif ', elif_)
+            self.visit(elif_.test, if_frame)
+            self.write(':')
+            self.indent()
+            self.blockvisit(elif_.body, if_frame)
+            self.outdent()
         if node.else_:
             self.writeline('else:')
             self.indent()
@@ -1178,36 +1173,46 @@ def visit_If(self, node, frame):
             self.outdent()
 
     def visit_Macro(self, node, frame):
-        macro_frame = self.macro_body(node, frame)
+        macro_frame, macro_ref = self.macro_body(node, frame)
         self.newline()
         if frame.toplevel:
             if not node.name.startswith('_'):
                 self.write('context.exported_vars.add(%r)' % node.name)
+            ref = frame.symbols.ref(node.name)
             self.writeline('context.vars[%r] = ' % node.name)
-        self.write('l_%s = ' % node.name)
-        self.macro_def(node, macro_frame)
-        frame.assigned_names.add(node.name)
+        self.write('%s = ' % frame.symbols.ref(node.name))
+        self.macro_def(macro_ref, macro_frame)
 
     def visit_CallBlock(self, node, frame):
-        children = node.iter_child_nodes(exclude=('call',))
-        call_frame = self.macro_body(node, frame, children)
+        call_frame, macro_ref = self.macro_body(node, frame)
         self.writeline('caller = ')
-        self.macro_def(node, call_frame)
+        self.macro_def(macro_ref, call_frame)
         self.start_write(frame, node)
-        self.visit_Call(node.call, call_frame, forward_caller=True)
+        self.visit_Call(node.call, frame, forward_caller=True)
         self.end_write(frame)
 
     def visit_FilterBlock(self, node, frame):
         filter_frame = frame.inner()
-        filter_frame.inspect(node.iter_child_nodes())
-        aliases = self.push_scope(filter_frame)
-        self.pull_locals(filter_frame)
+        filter_frame.symbols.analyze_node(node)
+        self.enter_frame(filter_frame)
         self.buffer(filter_frame)
         self.blockvisit(node.body, filter_frame)
         self.start_write(frame, node)
         self.visit_Filter(node.filter, filter_frame)
         self.end_write(frame)
-        self.pop_scope(aliases, filter_frame)
+        self.leave_frame(filter_frame)
+
+    def visit_With(self, node, frame):
+        with_frame = frame.inner()
+        with_frame.symbols.analyze_node(node)
+        self.enter_frame(with_frame)
+        for idx, (target, expr) in enumerate(izip(node.targets, node.values)):
+            self.newline()
+            self.visit(target, with_frame)
+            self.write(' = ')
+            self.visit(expr, frame)
+        self.blockvisit(node.body, with_frame)
+        self.leave_frame(with_frame)
 
     def visit_ExprStmt(self, node, frame):
         self.newline(node)
@@ -1286,7 +1291,7 @@ def visit_Output(self, node, frame):
                     if frame.buffer is None:
                         self.writeline('yield ' + val)
                     else:
-                        self.writeline(val + ', ')
+                        self.writeline(val + ',')
                 else:
                     if frame.buffer is None:
                         self.writeline('yield ', item)
@@ -1294,8 +1299,8 @@ def visit_Output(self, node, frame):
                         self.newline(item)
                     close = 1
                     if frame.eval_ctx.volatile:
-                        self.write('(context.eval_ctx.autoescape and'
-                                   ' escape or to_string)(')
+                        self.write('(escape if context.eval_ctx.autoescape'
+                                   ' else to_string)(')
                     elif frame.eval_ctx.autoescape:
                         self.write('escape(')
                     else:
@@ -1309,7 +1314,7 @@ def visit_Output(self, node, frame):
                     self.visit(item, frame)
                     self.write(')' * close)
                     if frame.buffer is not None:
-                        self.write(', ')
+                        self.write(',')
             if frame.buffer is not None:
                 # close the open parentheses
                 self.outdent()
@@ -1332,8 +1337,8 @@ def visit_Output(self, node, frame):
                 self.newline(argument)
                 close = 0
                 if frame.eval_ctx.volatile:
-                    self.write('(context.eval_ctx.autoescape and'
-                               ' escape or to_string)(')
+                    self.write('(escape if context.eval_ctx.autoescape else'
+                               ' to_string)(')
                     close += 1
                 elif frame.eval_ctx.autoescape:
                     self.write('escape(')
@@ -1358,73 +1363,72 @@ def visit_Output(self, node, frame):
         if outdent_later:
             self.outdent()
 
-    def make_assignment_frame(self, frame):
-        # toplevel assignments however go into the local namespace and
-        # the current template's context.  We create a copy of the frame
-        # here and add a set so that the Name visitor can add the assigned
-        # names here.
-        if not frame.toplevel:
-            return frame
-        assignment_frame = frame.copy()
-        assignment_frame.toplevel_assignments = set()
-        return assignment_frame
-
-    def export_assigned_vars(self, frame, assignment_frame):
-        if not frame.toplevel:
-            return
-        public_names = [x for x in assignment_frame.toplevel_assignments
-                        if not x.startswith('_')]
-        if len(assignment_frame.toplevel_assignments) == 1:
-            name = next(iter(assignment_frame.toplevel_assignments))
-            self.writeline('context.vars[%r] = l_%s' % (name, name))
-        else:
-            self.writeline('context.vars.update({')
-            for idx, name in enumerate(assignment_frame.toplevel_assignments):
-                if idx:
-                    self.write(', ')
-                self.write('%r: l_%s' % (name, name))
-            self.write('})')
-        if public_names:
-            if len(public_names) == 1:
-                self.writeline('context.exported_vars.add(%r)' %
-                               public_names[0])
-            else:
-                self.writeline('context.exported_vars.update((%s))' %
-                               ', '.join(imap(repr, public_names)))
-
     def visit_Assign(self, node, frame):
+        self.push_assign_tracking()
         self.newline(node)
-        assignment_frame = self.make_assignment_frame(frame)
-        self.visit(node.target, assignment_frame)
+        self.visit(node.target, frame)
         self.write(' = ')
         self.visit(node.node, frame)
-        self.export_assigned_vars(frame, assignment_frame)
+        self.pop_assign_tracking(frame)
 
     def visit_AssignBlock(self, node, frame):
+        self.push_assign_tracking()
         block_frame = frame.inner()
-        block_frame.inspect(node.body)
-        aliases = self.push_scope(block_frame)
-        self.pull_locals(block_frame)
+        # This is a special case.  Since a set block always captures we
+        # will disable output checks.  This way one can use set blocks
+        # toplevel even in extended templates.
+        block_frame.require_output_check = False
+        block_frame.symbols.analyze_node(node)
+        self.enter_frame(block_frame)
         self.buffer(block_frame)
         self.blockvisit(node.body, block_frame)
-        self.pop_scope(aliases, block_frame)
-
-        assignment_frame = self.make_assignment_frame(frame)
         self.newline(node)
-        self.visit(node.target, assignment_frame)
-        self.write(' = concat(%s)' % block_frame.buffer)
-        self.export_assigned_vars(frame, assignment_frame)
+        self.visit(node.target, frame)
+        self.write(' = (Markup if context.eval_ctx.autoescape '
+                   'else identity)(')
+        if node.filter is not None:
+            self.visit_Filter(node.filter, block_frame)
+        else:
+            self.write('concat(%s)' % block_frame.buffer)
+        self.write(')')
+        self.pop_assign_tracking(frame)
+        self.leave_frame(block_frame)
 
     # -- Expression Visitors
 
     def visit_Name(self, node, frame):
         if node.ctx == 'store' and frame.toplevel:
-            frame.toplevel_assignments.add(node.name)
-        self.write('l_' + node.name)
-        frame.assigned_names.add(node.name)
+            if self._assign_stack:
+                self._assign_stack[-1].add(node.name)
+        ref = frame.symbols.ref(node.name)
+
+        # If we are looking up a variable we might have to deal with the
+        # case where it's undefined.  We can skip that case if the load
+        # instruction indicates a parameter which are always defined.
+        if node.ctx == 'load':
+            load = frame.symbols.find_load(ref)
+            if not (load is not None and load[0] == VAR_LOAD_PARAMETER and \
+                    not self.parameter_is_undeclared(ref)):
+                self.write('(undefined(name=%r) if %s is missing else %s)' %
+                           (node.name, ref, ref))
+                return
+
+        self.write(ref)
+
+    def visit_NSRef(self, node, frame):
+        # NSRefs can only be used to store values; since they use the normal
+        # `foo.bar` notation they will be parsed as a normal attribute access
+        # when used anywhere but in a `set` context
+        ref = frame.symbols.ref(node.name)
+        self.writeline('if not isinstance(%s, Namespace):' % ref)
+        self.indent()
+        self.writeline('raise TemplateRuntimeError(%r)' %
+                       'cannot assign attribute on non-namespace object')
+        self.outdent()
+        self.writeline('%s[%r]' % (ref, node.attr))
 
     def visit_Const(self, node, frame):
-        val = node.value
+        val = node.as_const(frame.eval_ctx)
         if isinstance(val, float):
             self.write(str(val))
         else:
@@ -1434,7 +1438,7 @@ def visit_TemplateData(self, node, frame):
         try:
             self.write(repr(node.as_const(frame.eval_ctx)))
         except nodes.Impossible:
-            self.write('(context.eval_ctx.autoescape and Markup or identity)(%r)'
+            self.write('(Markup if context.eval_ctx.autoescape else identity)(%r)'
                        % node.data)
 
     def visit_Tuple(self, node, frame):
@@ -1465,6 +1469,7 @@ def visit_Dict(self, node, frame):
         self.write('}')
 
     def binop(operator, interceptable=True):
+        @optimizeconst
         def visitor(self, node, frame):
             if self.environment.sandboxed and \
                operator in self.environment.intercepted_binops:
@@ -1481,6 +1486,7 @@ def visitor(self, node, frame):
         return visitor
 
     def uaop(operator, interceptable=True):
+        @optimizeconst
         def visitor(self, node, frame):
             if self.environment.sandboxed and \
                operator in self.environment.intercepted_unops:
@@ -1506,6 +1512,7 @@ def visitor(self, node, frame):
     visit_Not = uaop('not ', interceptable=False)
     del binop, uaop
 
+    @optimizeconst
     def visit_Concat(self, node, frame):
         if frame.eval_ctx.volatile:
             func_name = '(context.eval_ctx.volatile and' \
@@ -1520,6 +1527,7 @@ def visit_Concat(self, node, frame):
             self.write(', ')
         self.write('))')
 
+    @optimizeconst
     def visit_Compare(self, node, frame):
         self.visit(node.expr, frame)
         for op in node.ops:
@@ -1529,11 +1537,13 @@ def visit_Operand(self, node, frame):
         self.write(' %s ' % operators[node.op])
         self.visit(node.expr, frame)
 
+    @optimizeconst
     def visit_Getattr(self, node, frame):
         self.write('environment.getattr(')
         self.visit(node.node, frame)
         self.write(', %r)' % node.attr)
 
+    @optimizeconst
     def visit_Getitem(self, node, frame):
         # slices bypass the environment getitem method.
         if isinstance(node.arg, nodes.Slice):
@@ -1558,7 +1568,10 @@ def visit_Slice(self, node, frame):
             self.write(':')
             self.visit(node.step, frame)
 
+    @optimizeconst
     def visit_Filter(self, node, frame):
+        if self.environment.is_async:
+            self.write('await auto_await(')
         self.write(self.filters[node.name] + '(')
         func = self.environment.filters.get(node.name)
         if func is None:
@@ -1584,7 +1597,10 @@ def visit_Filter(self, node, frame):
             self.write('concat(%s)' % frame.buffer)
         self.signature(node, frame)
         self.write(')')
+        if self.environment.is_async:
+            self.write(')')
 
+    @optimizeconst
     def visit_Test(self, node, frame):
         self.write(self.tests[node.name] + '(')
         if node.name not in self.environment.tests:
@@ -1593,11 +1609,12 @@ def visit_Test(self, node, frame):
         self.signature(node, frame)
         self.write(')')
 
+    @optimizeconst
     def visit_CondExpr(self, node, frame):
         def write_expr2():
             if node.expr2 is not None:
                 return self.visit(node.expr2, frame)
-            self.write('environment.undefined(%r)' % ('the inline if-'
+            self.write('undefined(%r)' % ('the inline if-'
                        'expression on %s evaluated to false and '
                        'no else section was defined.' % self.position(node)))
 
@@ -1609,7 +1626,10 @@ def write_expr2():
         write_expr2()
         self.write(')')
 
+    @optimizeconst
     def visit_Call(self, node, frame, forward_caller=False):
+        if self.environment.is_async:
+            self.write('await auto_await(')
         if self.environment.sandboxed:
             self.write('environment.call(context, ')
         else:
@@ -1618,6 +1638,8 @@ def visit_Call(self, node, frame, forward_caller=False):
         extra_kwargs = forward_caller and {'caller': 'caller'} or None
         self.signature(node, frame, extra_kwargs)
         self.write(')')
+        if self.environment.is_async:
+            self.write(')')
 
     def visit_Keyword(self, node, frame):
         self.write(node.key + '=')
@@ -1658,11 +1680,24 @@ def visit_Break(self, node, frame):
 
     def visit_Scope(self, node, frame):
         scope_frame = frame.inner()
-        scope_frame.inspect(node.iter_child_nodes())
-        aliases = self.push_scope(scope_frame)
-        self.pull_locals(scope_frame)
+        scope_frame.symbols.analyze_node(node)
+        self.enter_frame(scope_frame)
+        self.blockvisit(node.body, scope_frame)
+        self.leave_frame(scope_frame)
+
+    def visit_OverlayScope(self, node, frame):
+        ctx = self.temporary_identifier()
+        self.writeline('%s = %s' % (ctx, self.derive_context(frame)))
+        self.writeline('%s.vars = ' % ctx)
+        self.visit(node.context, frame)
+        self.push_context_reference(ctx)
+
+        scope_frame = frame.inner(isolated=True)
+        scope_frame.symbols.analyze_node(node)
+        self.enter_frame(scope_frame)
         self.blockvisit(node.body, scope_frame)
-        self.pop_scope(aliases, scope_frame)
+        self.leave_frame(scope_frame)
+        self.pop_context_reference()
 
     def visit_EvalContextModifier(self, node, frame):
         for keyword in node.options:
@@ -1677,10 +1712,10 @@ def visit_EvalContextModifier(self, node, frame):
 
     def visit_ScopedEvalContextModifier(self, node, frame):
         old_ctx_name = self.temporary_identifier()
-        safed_ctx = frame.eval_ctx.save()
+        saved_ctx = frame.eval_ctx.save()
         self.writeline('%s = context.eval_ctx.save()' % old_ctx_name)
         self.visit_EvalContextModifier(node, frame)
         for child in node.body:
             self.visit(child, frame)
-        frame.eval_ctx.revert(safed_ctx)
+        frame.eval_ctx.revert(saved_ctx)
         self.writeline('context.eval_ctx.revert(%s)' % old_ctx_name)
diff --git a/deps/v8/third_party/jinja2/constants.py b/deps/v8/third_party/jinja2/constants.py
index cab203cc772..11efd1ed158 100644
--- a/deps/v8/third_party/jinja2/constants.py
+++ b/deps/v8/third_party/jinja2/constants.py
@@ -5,7 +5,7 @@
 
     Various constants.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD, see LICENSE for more details.
 """
 
diff --git a/deps/v8/third_party/jinja2/debug.py b/deps/v8/third_party/jinja2/debug.py
index 32527483694..b61139f0cde 100644
--- a/deps/v8/third_party/jinja2/debug.py
+++ b/deps/v8/third_party/jinja2/debug.py
@@ -7,7 +7,7 @@
     ugly stuff with the Python traceback system in order to achieve tracebacks
     with correct line numbers, locals and contents.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD, see LICENSE for more details.
 """
 import sys
@@ -195,21 +195,43 @@ def translate_exception(exc_info, initial_skip=0):
     return ProcessedTraceback(exc_info[0], exc_info[1], frames)
 
 
+def get_jinja_locals(real_locals):
+    ctx = real_locals.get('context')
+    if ctx:
+        locals = ctx.get_all().copy()
+    else:
+        locals = {}
+
+    local_overrides = {}
+
+    for name, value in iteritems(real_locals):
+        if not name.startswith('l_') or value is missing:
+            continue
+        try:
+            _, depth, name = name.split('_', 2)
+            depth = int(depth)
+        except ValueError:
+            continue
+        cur_depth = local_overrides.get(name, (-1,))[0]
+        if cur_depth < depth:
+            local_overrides[name] = (depth, value)
+
+    for name, (_, value) in iteritems(local_overrides):
+        if value is missing:
+            locals.pop(name, None)
+        else:
+            locals[name] = value
+
+    return locals
+
+
 def fake_exc_info(exc_info, filename, lineno):
     """Helper for `translate_exception`."""
     exc_type, exc_value, tb = exc_info
 
     # figure the real context out
     if tb is not None:
-        real_locals = tb.tb_frame.f_locals.copy()
-        ctx = real_locals.get('context')
-        if ctx:
-            locals = ctx.get_all()
-        else:
-            locals = {}
-        for name, value in iteritems(real_locals):
-            if name.startswith('l_') and value is not missing:
-                locals[name[2:]] = value
+        locals = get_jinja_locals(tb.tb_frame.f_locals)
 
         # if there is a local called __jinja_exception__, we get
         # rid of it to not break the debug functionality.
diff --git a/deps/v8/third_party/jinja2/defaults.py b/deps/v8/third_party/jinja2/defaults.py
index 3717a7223f6..7c93dec0aeb 100644
--- a/deps/v8/third_party/jinja2/defaults.py
+++ b/deps/v8/third_party/jinja2/defaults.py
@@ -5,11 +5,11 @@
 
     Jinja default filters and tags.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD, see LICENSE for more details.
 """
 from jinja2._compat import range_type
-from jinja2.utils import generate_lorem_ipsum, Cycler, Joiner
+from jinja2.utils import generate_lorem_ipsum, Cycler, Joiner, Namespace
 
 
 # defaults for the parser / lexer
@@ -35,7 +35,20 @@
     'dict':         dict,
     'lipsum':       generate_lorem_ipsum,
     'cycler':       Cycler,
-    'joiner':       Joiner
+    'joiner':       Joiner,
+    'namespace':    Namespace
+}
+
+
+# default policies
+DEFAULT_POLICIES = {
+    'compiler.ascii_str':   True,
+    'urlize.rel':           'noopener',
+    'urlize.target':        None,
+    'truncate.leeway':      5,
+    'json.dumps_function':  None,
+    'json.dumps_kwargs':    {'sort_keys': True},
+    'ext.i18n.trimmed':     False,
 }
 
 
diff --git a/deps/v8/third_party/jinja2/environment.py b/deps/v8/third_party/jinja2/environment.py
index 8b2572bb8c1..549d9afab45 100644
--- a/deps/v8/third_party/jinja2/environment.py
+++ b/deps/v8/third_party/jinja2/environment.py
@@ -5,32 +5,32 @@
 
     Provides a class that holds runtime and parsing time options.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD, see LICENSE for more details.
 """
 import os
 import sys
+import weakref
+from functools import reduce, partial
 from jinja2 import nodes
 from jinja2.defaults import BLOCK_START_STRING, \
      BLOCK_END_STRING, VARIABLE_START_STRING, VARIABLE_END_STRING, \
      COMMENT_START_STRING, COMMENT_END_STRING, LINE_STATEMENT_PREFIX, \
      LINE_COMMENT_PREFIX, TRIM_BLOCKS, NEWLINE_SEQUENCE, \
      DEFAULT_FILTERS, DEFAULT_TESTS, DEFAULT_NAMESPACE, \
-     KEEP_TRAILING_NEWLINE, LSTRIP_BLOCKS
+     DEFAULT_POLICIES, KEEP_TRAILING_NEWLINE, LSTRIP_BLOCKS
 from jinja2.lexer import get_lexer, TokenStream
 from jinja2.parser import Parser
 from jinja2.nodes import EvalContext
-from jinja2.optimizer import optimize
 from jinja2.compiler import generate, CodeGenerator
 from jinja2.runtime import Undefined, new_context, Context
 from jinja2.exceptions import TemplateSyntaxError, TemplateNotFound, \
      TemplatesNotFound, TemplateRuntimeError
 from jinja2.utils import import_string, LRUCache, Markup, missing, \
-     concat, consume, internalcode
+     concat, consume, internalcode, have_async_gen
 from jinja2._compat import imap, ifilter, string_types, iteritems, \
      text_type, reraise, implements_iterator, implements_to_string, \
-     get_next, encode_filename, PY2, PYPY
-from functools import reduce
+     encode_filename, PY2, PYPY
 
 
 # for direct template usage we have up to ten living environments
@@ -87,6 +87,16 @@ def load_extensions(environment, extensions):
     return result
 
 
+def fail_for_missing_callable(string, name):
+    msg = string % name
+    if isinstance(name, Undefined):
+        try:
+            name._fail_with_undefined_error()
+        except Exception as e:
+            msg = '%s (%s; did you forget to quote the callable name?)' % (msg, e)
+    raise TemplateRuntimeError(msg)
+
+
 def _environment_sanity_check(environment):
     """Perform a sanity check on the environment."""
     assert issubclass(environment.undefined, Undefined), 'undefined must ' \
@@ -167,7 +177,7 @@ class Environment(object):
             look at :ref:`the extensions documentation <jinja-extensions>`.
 
         `optimized`
-            should the optimizer be enabled?  Default is `True`.
+            should the optimizer be enabled?  Default is ``True``.
 
         `undefined`
             :class:`Undefined` or a subclass of it that is used to represent
@@ -176,14 +186,14 @@ class Environment(object):
         `finalize`
             A callable that can be used to process the result of a variable
             expression before it is output.  For example one can convert
-            `None` implicitly into an empty string here.
+            ``None`` implicitly into an empty string here.
 
         `autoescape`
-            If set to true the XML/HTML autoescaping feature is enabled by
+            If set to ``True`` the XML/HTML autoescaping feature is enabled by
             default.  For more details about autoescaping see
             :class:`~jinja2.utils.Markup`.  As of Jinja 2.4 this can also
             be a callable that is passed the template name and has to
-            return `True` or `False` depending on autoescape should be
+            return ``True`` or ``False`` depending on autoescape should be
             enabled by default.
 
             .. versionchanged:: 2.4
@@ -205,7 +215,7 @@ class Environment(object):
         `auto_reload`
             Some loaders load templates from locations where the template
             sources may change (ie: file system or database).  If
-            `auto_reload` is set to `True` (default) every time a template is
+            ``auto_reload`` is set to ``True`` (default) every time a template is
             requested the loader checks if the source changed and if yes, it
             will reload the template.  For higher performance it's possible to
             disable that.
@@ -216,6 +226,11 @@ class Environment(object):
             have to be parsed if they were not changed.
 
             See :ref:`bytecode-cache` for more information.
+
+        `enable_async`
+            If set to true this enables async template execution which allows
+            you to take advantage of newer Python features.  This requires
+            Python 3.6 or later.
     """
 
     #: if this environment is sandboxed.  Modifying this variable won't make
@@ -267,7 +282,8 @@ def __init__(self,
                  loader=None,
                  cache_size=400,
                  auto_reload=True,
-                 bytecode_cache=None):
+                 bytecode_cache=None,
+                 enable_async=False):
         # !!Important notice!!
         #   The constructor accepts quite a few arguments that should be
         #   passed by keyword rather than position.  However it's important to
@@ -310,9 +326,15 @@ def __init__(self,
         self.bytecode_cache = bytecode_cache
         self.auto_reload = auto_reload
 
+        # configurable policies
+        self.policies = DEFAULT_POLICIES.copy()
+
         # load extensions
         self.extensions = load_extensions(self, extensions)
 
+        self.enable_async = enable_async
+        self.is_async = self.enable_async and have_async_gen
+
         _environment_sanity_check(self)
 
     def add_extension(self, extension):
@@ -387,7 +409,7 @@ def getitem(self, obj, argument):
         """Get an item or attribute of an object but prefer the item."""
         try:
             return obj[argument]
-        except (TypeError, LookupError):
+        except (AttributeError, TypeError, LookupError):
             if isinstance(argument, string_types):
                 try:
                     attr = str(argument)
@@ -417,11 +439,16 @@ def call_filter(self, name, value, args=None, kwargs=None,
                     context=None, eval_ctx=None):
         """Invokes a filter on a value the same way the compiler does it.
 
+        Note that on Python 3 this might return a coroutine in case the
+        filter is running from an environment in async mode and the filter
+        supports async execution.  It's your responsibility to await this
+        if needed.
+
         .. versionadded:: 2.7
         """
         func = self.filters.get(name)
         if func is None:
-            raise TemplateRuntimeError('no filter named %r' % name)
+            fail_for_missing_callable('no filter named %r', name)
         args = [value] + list(args or ())
         if getattr(func, 'contextfilter', False):
             if context is None:
@@ -446,7 +473,7 @@ def call_test(self, name, value, args=None, kwargs=None):
         """
         func = self.tests.get(name)
         if func is None:
-            raise TemplateRuntimeError('no test named %r' % name)
+            fail_for_missing_callable('no test named %r', name)
         return func(value, *(args or ()), **(kwargs or {}))
 
     @internalcode
@@ -512,7 +539,8 @@ def _generate(self, source, name, filename, defer_init=False):
 
         .. versionadded:: 2.5
         """
-        return generate(source, self, name, filename, defer_init=defer_init)
+        return generate(source, self, name, filename, defer_init=defer_init,
+                        optimized=self.optimized)
 
     def _compile(self, source, filename):
         """Internal hook that can be overridden to hook a different compile
@@ -549,8 +577,6 @@ def compile(self, source, name=None, filename=None, raw=False,
             if isinstance(source, string_types):
                 source_hint = source
                 source = self._parse(source, name, filename)
-            if self.optimized:
-                source = optimize(source, self)
             source = self._generate(source, name, filename,
                                     defer_init=defer_init)
             if raw:
@@ -769,15 +795,7 @@ def join_path(self, template, parent):
     def _load_template(self, name, globals):
         if self.loader is None:
             raise TypeError('no loader for this environment specified')
-        try:
-            # use abs path for cache key
-            cache_key = self.loader.get_source(self, name)[1]
-        except RuntimeError:
-            # if loader does not implement get_source()
-            cache_key = None
-        # if template is not file, use name for cache key
-        if cache_key is None:
-            cache_key = name
+        cache_key = (weakref.ref(self.loader), name)
         if self.cache is not None:
             template = self.cache.get(cache_key)
             if template is not None and (not self.auto_reload or
@@ -791,7 +809,7 @@ def _load_template(self, name, globals):
     @internalcode
     def get_template(self, name, parent=None, globals=None):
         """Load a template from the loader.  If a loader is configured this
-        method ask the loader for the template and returns a :class:`Template`.
+        method asks the loader for the template and returns a :class:`Template`.
         If the `parent` parameter is not `None`, :meth:`join_path` is called
         to get the real template name before loading.
 
@@ -915,14 +933,15 @@ def __new__(cls, source,
                 optimized=True,
                 undefined=Undefined,
                 finalize=None,
-                autoescape=False):
+                autoescape=False,
+                enable_async=False):
         env = get_spontaneous_environment(
             block_start_string, block_end_string, variable_start_string,
             variable_end_string, comment_start_string, comment_end_string,
             line_statement_prefix, line_comment_prefix, trim_blocks,
             lstrip_blocks, newline_sequence, keep_trailing_newline,
             frozenset(extensions), optimized, undefined, finalize, autoescape,
-            None, 0, False, None)
+            None, 0, False, None, enable_async)
         return env.from_string(source, template_class=cls)
 
     @classmethod
@@ -988,6 +1007,19 @@ def render(self, *args, **kwargs):
             exc_info = sys.exc_info()
         return self.environment.handle_exception(exc_info, True)
 
+    def render_async(self, *args, **kwargs):
+        """This works similar to :meth:`render` but returns a coroutine
+        that when awaited returns the entire rendered template string.  This
+        requires the async feature to be enabled.
+
+        Example usage::
+
+            await template.render_async(knights='that say nih; asynchronously')
+        """
+        # see asyncsupport for the actual implementation
+        raise NotImplementedError('This feature is not available for this '
+                                  'version of Python')
+
     def stream(self, *args, **kwargs):
         """Works exactly like :meth:`generate` but returns a
         :class:`TemplateStream`.
@@ -1012,6 +1044,14 @@ def generate(self, *args, **kwargs):
             return
         yield self.environment.handle_exception(exc_info, True)
 
+    def generate_async(self, *args, **kwargs):
+        """An async version of :meth:`generate`.  Works very similarly but
+        returns an async iterator instead.
+        """
+        # see asyncsupport for the actual implementation
+        raise NotImplementedError('This feature is not available for this '
+                                  'version of Python')
+
     def new_context(self, vars=None, shared=False, locals=None):
         """Create a new :class:`Context` for this template.  The vars
         provided will be passed to the template.  Per default the globals
@@ -1032,6 +1072,23 @@ def make_module(self, vars=None, shared=False, locals=None):
         """
         return TemplateModule(self, self.new_context(vars, shared, locals))
 
+    def make_module_async(self, vars=None, shared=False, locals=None):
+        """As template module creation can invoke template code for
+        asynchronous exections this method must be used instead of the
+        normal :meth:`make_module` one.  Likewise the module attribute
+        becomes unavailable in async mode.
+        """
+        # see asyncsupport for the actual implementation
+        raise NotImplementedError('This feature is not available for this '
+                                  'version of Python')
+
+    @internalcode
+    def _get_default_module(self):
+        if self._module is not None:
+            return self._module
+        self._module = rv = self.make_module()
+        return rv
+
     @property
     def module(self):
         """The template as module.  This is used for imports in the
@@ -1043,11 +1100,10 @@ def module(self):
         '23'
         >>> t.module.foo() == u'42'
         True
+
+        This attribute is not available if async mode is enabled.
         """
-        if self._module is not None:
-            return self._module
-        self._module = rv = self.make_module()
-        return rv
+        return self._get_default_module()
 
     def get_corresponding_lineno(self, lineno):
         """Return the source line number of a line number in the
@@ -1086,8 +1142,15 @@ class TemplateModule(object):
     converting it into an unicode- or bytestrings renders the contents.
     """
 
-    def __init__(self, template, context):
-        self._body_stream = list(template.root_render_func(context))
+    def __init__(self, template, context, body_stream=None):
+        if body_stream is None:
+            if context.environment.is_async:
+                raise RuntimeError('Async mode requires a body stream '
+                                   'to be passed to a template module.  Use '
+                                   'the async methods of the API you are '
+                                   'using.')
+            body_stream = list(template.root_render_func(context))
+        self._body_stream = body_stream
         self.__dict__.update(context.get_exported())
         self.__name__ = template.name
 
@@ -1171,35 +1234,35 @@ def dump(self, fp, encoding=None, errors='strict'):
 
     def disable_buffering(self):
         """Disable the output buffering."""
-        self._next = get_next(self._gen)
+        self._next = partial(next, self._gen)
         self.buffered = False
 
+    def _buffered_generator(self, size):
+        buf = []
+        c_size = 0
+        push = buf.append
+
+        while 1:
+            try:
+                while c_size < size:
+                    c = next(self._gen)
+                    push(c)
+                    if c:
+                        c_size += 1
+            except StopIteration:
+                if not c_size:
+                    return
+            yield concat(buf)
+            del buf[:]
+            c_size = 0
+
     def enable_buffering(self, size=5):
         """Enable buffering.  Buffer `size` items before yielding them."""
         if size <= 1:
             raise ValueError('buffer size too small')
 
-        def generator(next):
-            buf = []
-            c_size = 0
-            push = buf.append
-
-            while 1:
-                try:
-                    while c_size < size:
-                        c = next()
-                        push(c)
-                        if c:
-                            c_size += 1
-                except StopIteration:
-                    if not c_size:
-                        return
-                yield concat(buf)
-                del buf[:]
-                c_size = 0
-
         self.buffered = True
-        self._next = get_next(generator(get_next(self._gen)))
+        self._next = partial(next, self._buffered_generator(size))
 
     def __iter__(self):
         return self
diff --git a/deps/v8/third_party/jinja2/exceptions.py b/deps/v8/third_party/jinja2/exceptions.py
index c9df6dc7c28..c018a33e323 100644
--- a/deps/v8/third_party/jinja2/exceptions.py
+++ b/deps/v8/third_party/jinja2/exceptions.py
@@ -5,7 +5,7 @@
 
     Jinja exceptions.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD, see LICENSE for more details.
 """
 from jinja2._compat import imap, text_type, PY2, implements_to_string
diff --git a/deps/v8/third_party/jinja2/ext.py b/deps/v8/third_party/jinja2/ext.py
index 562ab506ffe..0734a84f73d 100644
--- a/deps/v8/third_party/jinja2/ext.py
+++ b/deps/v8/third_party/jinja2/ext.py
@@ -7,9 +7,11 @@
     tags work.  By default two example extensions exist: an i18n and a cache
     extension.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD.
 """
+import re
+
 from jinja2 import nodes
 from jinja2.defaults import BLOCK_START_STRING, \
      BLOCK_END_STRING, VARIABLE_START_STRING, VARIABLE_END_STRING, \
@@ -87,7 +89,7 @@ def preprocess(self, source, name, filename=None):
     def filter_stream(self, stream):
         """It's passed a :class:`~jinja2.lexer.TokenStream` that can be used
         to filter tokens returned.  This method has to return an iterable of
-        :class:`~jinja2.lexer.Token`\s, but it doesn't have to return a
+        :class:`~jinja2.lexer.Token`\\s, but it doesn't have to return a
         :class:`~jinja2.lexer.TokenStream`.
 
         In the `ext` folder of the Jinja2 source distribution there is a file
@@ -223,6 +225,7 @@ def parse(self, parser):
         plural_expr = None
         plural_expr_assignment = None
         variables = {}
+        trimmed = None
         while parser.stream.current.type != 'block_end':
             if variables:
                 parser.stream.expect('comma')
@@ -241,6 +244,9 @@ def parse(self, parser):
             if parser.stream.current.type == 'assign':
                 next(parser.stream)
                 variables[name.value] = var = parser.parse_expression()
+            elif trimmed is None and name.value in ('trimmed', 'notrimmed'):
+                trimmed = name.value == 'trimmed'
+                continue
             else:
                 variables[name.value] = var = nodes.Name(name.value, 'load')
 
@@ -256,7 +262,7 @@ def parse(self, parser):
 
         parser.stream.expect('block_end')
 
-        plural = plural_names = None
+        plural = None
         have_plural = False
         referenced = set()
 
@@ -297,6 +303,13 @@ def parse(self, parser):
         elif plural_expr is None:
             parser.fail('pluralize without variables', lineno)
 
+        if trimmed is None:
+            trimmed = self.environment.policies['ext.i18n.trimmed']
+        if trimmed:
+            singular = self._trim_whitespace(singular)
+            if plural:
+                plural = self._trim_whitespace(plural)
+
         node = self._make_node(singular, plural, variables, plural_expr,
                                bool(referenced),
                                num_called_num and have_plural)
@@ -306,6 +319,9 @@ def parse(self, parser):
         else:
             return node
 
+    def _trim_whitespace(self, string, _ws_re=re.compile(r'\s*\n\s*')):
+        return _ws_re.sub(' ', string.strip())
+
     def _parse_block(self, parser, allow_pluralize):
         """Parse until the next block tag with a given name."""
         referenced = []
@@ -411,38 +427,11 @@ def parse(self, parser):
 
 
 class WithExtension(Extension):
-    """Adds support for a django-like with block."""
-    tags = set(['with'])
-
-    def parse(self, parser):
-        node = nodes.Scope(lineno=next(parser.stream).lineno)
-        assignments = []
-        while parser.stream.current.type != 'block_end':
-            lineno = parser.stream.current.lineno
-            if assignments:
-                parser.stream.expect('comma')
-            target = parser.parse_assign_target()
-            parser.stream.expect('assign')
-            expr = parser.parse_expression()
-            assignments.append(nodes.Assign(target, expr, lineno=lineno))
-        node.body = assignments + \
-            list(parser.parse_statements(('name:endwith',),
-                                         drop_needle=True))
-        return node
+    pass
 
 
 class AutoEscapeExtension(Extension):
-    """Changes auto escape rules for a scope."""
-    tags = set(['autoescape'])
-
-    def parse(self, parser):
-        node = nodes.ScopedEvalContextModifier(lineno=next(parser.stream).lineno)
-        node.options = [
-            nodes.Keyword('autoescape', parser.parse_expression())
-        ]
-        node.body = parser.parse_statements(('name:endautoescape',),
-                                            drop_needle=True)
-        return nodes.Scope([node])
+    pass
 
 
 def extract_from_ast(node, gettext_functions=GETTEXT_FUNCTIONS,
@@ -610,6 +599,8 @@ def getbool(options, key, default=False):
         auto_reload=False
     )
 
+    if getbool(options, 'trimmed'):
+        environment.policies['ext.i18n.trimmed'] = True
     if getbool(options, 'newstyle_gettext'):
         environment.newstyle_gettext = True
 
diff --git a/deps/v8/third_party/jinja2/filters.py b/deps/v8/third_party/jinja2/filters.py
index e5c7a1ab439..267ddddaa03 100644
--- a/deps/v8/third_party/jinja2/filters.py
+++ b/deps/v8/third_party/jinja2/filters.py
@@ -5,23 +5,25 @@
 
     Bundled jinja filters.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD, see LICENSE for more details.
 """
 import re
 import math
+import random
+import warnings
 
-from random import choice
-from operator import itemgetter
-from itertools import groupby
+from itertools import groupby, chain
+from collections import namedtuple
 from jinja2.utils import Markup, escape, pformat, urlize, soft_unicode, \
-     unicode_urlencode
+     unicode_urlencode, htmlsafe_json_dumps
 from jinja2.runtime import Undefined
 from jinja2.exceptions import FilterArgumentError
-from jinja2._compat import imap, string_types, text_type, iteritems
+from jinja2._compat import imap, string_types, text_type, iteritems, PY2
 
 
-_word_re = re.compile(r'\w+(?u)')
+_word_re = re.compile(r'\w+', re.UNICODE)
+_word_beginning_split_re = re.compile(r'([-\s\(\{\[\<]+)', re.UNICODE)
 
 
 def contextfilter(f):
@@ -44,29 +46,41 @@ def evalcontextfilter(f):
 
 
 def environmentfilter(f):
-    """Decorator for marking evironment dependent filters.  The current
+    """Decorator for marking environment dependent filters.  The current
     :class:`Environment` is passed to the filter as first argument.
     """
     f.environmentfilter = True
     return f
 
 
-def make_attrgetter(environment, attribute):
+def ignore_case(value):
+    """For use as a postprocessor for :func:`make_attrgetter`. Converts strings
+    to lowercase and returns other types as-is."""
+    return value.lower() if isinstance(value, string_types) else value
+
+
+def make_attrgetter(environment, attribute, postprocess=None):
     """Returns a callable that looks up the given attribute from a
     passed object with the rules of the environment.  Dots are allowed
     to access attributes of attributes.  Integer parts in paths are
     looked up as integers.
     """
-    if not isinstance(attribute, string_types) \
-       or ('.' not in attribute and not attribute.isdigit()):
-        return lambda x: environment.getitem(x, attribute)
-    attribute = attribute.split('.')
+    if attribute is None:
+        attribute = []
+    elif isinstance(attribute, string_types):
+        attribute = [int(x) if x.isdigit() else x for x in attribute.split('.')]
+    else:
+        attribute = [attribute]
+
     def attrgetter(item):
         for part in attribute:
-            if part.isdigit():
-                part = int(part)
             item = environment.getitem(item, part)
+
+        if postprocess is not None:
+            item = postprocess(item)
+
         return item
+
     return attrgetter
 
 
@@ -183,15 +197,13 @@ def do_title(s):
     """Return a titlecased version of the value. I.e. words will start with
     uppercase letters, all remaining characters are lowercase.
     """
-    rv = []
-    for item in re.compile(r'([-\s]+)(?u)').split(soft_unicode(s)):
-        if not item:
-            continue
-        rv.append(item[0].upper() + item[1:].lower())
-    return ''.join(rv)
+    return ''.join(
+        [item[0].upper() + item[1:].lower()
+         for item in _word_beginning_split_re.split(soft_unicode(s))
+         if item])
 
 
-def do_dictsort(value, case_sensitive=False, by='key'):
+def do_dictsort(value, case_sensitive=False, by='key', reverse=False):
     """Sort a dict and yield (key, value) pairs. Because python dicts are
     unsorted you may want to use this function to order them by either
     key or value:
@@ -201,6 +213,9 @@ def do_dictsort(value, case_sensitive=False, by='key'):
         {% for item in mydict|dictsort %}
             sort the dict by key, case insensitive
 
+        {% for item in mydict|dictsort(reverse=true) %}
+            sort the dict by key, case insensitive, reverse order
+
         {% for item in mydict|dictsort(true) %}
             sort the dict by key, case sensitive
 
@@ -212,20 +227,25 @@ def do_dictsort(value, case_sensitive=False, by='key'):
     elif by == 'value':
         pos = 1
     else:
-        raise FilterArgumentError('You can only sort by either '
-                                  '"key" or "value"')
+        raise FilterArgumentError(
+            'You can only sort by either "key" or "value"'
+        )
+
     def sort_func(item):
         value = item[pos]
-        if isinstance(value, string_types) and not case_sensitive:
-            value = value.lower()
+
+        if not case_sensitive:
+            value = ignore_case(value)
+
         return value
 
-    return sorted(value.items(), key=sort_func)
+    return sorted(value.items(), key=sort_func, reverse=reverse)
 
 
 @environmentfilter
-def do_sort(environment, value, reverse=False, case_sensitive=False,
-            attribute=None):
+def do_sort(
+    environment, value, reverse=False, case_sensitive=False, attribute=None
+):
     """Sort an iterable.  Per default it sorts ascending, if you pass it
     true as first argument it will reverse the sorting.
 
@@ -251,18 +271,85 @@ def do_sort(environment, value, reverse=False, case_sensitive=False,
     .. versionchanged:: 2.6
        The `attribute` parameter was added.
     """
-    if not case_sensitive:
-        def sort_func(item):
-            if isinstance(item, string_types):
-                item = item.lower()
-            return item
-    else:
-        sort_func = None
-    if attribute is not None:
-        getter = make_attrgetter(environment, attribute)
-        def sort_func(item, processor=sort_func or (lambda x: x)):
-            return processor(getter(item))
-    return sorted(value, key=sort_func, reverse=reverse)
+    key_func = make_attrgetter(
+        environment, attribute,
+        postprocess=ignore_case if not case_sensitive else None
+    )
+    return sorted(value, key=key_func, reverse=reverse)
+
+
+@environmentfilter
+def do_unique(environment, value, case_sensitive=False, attribute=None):
+    """Returns a list of unique items from the the given iterable.
+
+    .. sourcecode:: jinja
+
+        {{ ['foo', 'bar', 'foobar', 'FooBar']|unique }}
+            -> ['foo', 'bar', 'foobar']
+
+    The unique items are yielded in the same order as their first occurrence in
+    the iterable passed to the filter.
+
+    :param case_sensitive: Treat upper and lower case strings as distinct.
+    :param attribute: Filter objects with unique values for this attribute.
+    """
+    getter = make_attrgetter(
+        environment, attribute,
+        postprocess=ignore_case if not case_sensitive else None
+    )
+    seen = set()
+
+    for item in value:
+        key = getter(item)
+
+        if key not in seen:
+            seen.add(key)
+            yield item
+
+
+def _min_or_max(environment, value, func, case_sensitive, attribute):
+    it = iter(value)
+
+    try:
+        first = next(it)
+    except StopIteration:
+        return environment.undefined('No aggregated item, sequence was empty.')
+
+    key_func = make_attrgetter(
+        environment, attribute,
+        ignore_case if not case_sensitive else None
+    )
+    return func(chain([first], it), key=key_func)
+
+
+@environmentfilter
+def do_min(environment, value, case_sensitive=False, attribute=None):
+    """Return the smallest item from the sequence.
+
+    .. sourcecode:: jinja
+
+        {{ [1, 2, 3]|min }}
+            -> 1
+
+    :param case_sensitive: Treat upper and lower case strings as distinct.
+    :param attribute: Get the object with the max value of this attribute.
+    """
+    return _min_or_max(environment, value, min, case_sensitive, attribute)
+
+
+@environmentfilter
+def do_max(environment, value, case_sensitive=False, attribute=None):
+    """Return the largest item from the sequence.
+
+    .. sourcecode:: jinja
+
+        {{ [1, 2, 3]|max }}
+            -> 3
+
+    :param case_sensitive: Treat upper and lower case strings as distinct.
+    :param attribute: Get the object with the max value of this attribute.
+    """
+    return _min_or_max(environment, value, max, case_sensitive, attribute)
 
 
 def do_default(value, default_value=u'', boolean=False):
@@ -360,13 +447,13 @@ def do_last(environment, seq):
         return environment.undefined('No last item, sequence was empty.')
 
 
-@environmentfilter
-def do_random(environment, seq):
+@contextfilter
+def do_random(context, seq):
     """Return a random item from the sequence."""
     try:
-        return choice(seq)
+        return random.choice(seq)
     except IndexError:
-        return environment.undefined('No random item, sequence was empty.')
+        return context.environment.undefined('No random item, sequence was empty.')
 
 
 def do_filesizeformat(value, binary=False):
@@ -410,7 +497,7 @@ def do_pprint(value, verbose=False):
 
 @evalcontextfilter
 def do_urlize(eval_ctx, value, trim_url_limit=None, nofollow=False,
-              target=None):
+              target=None, rel=None):
     """Converts URLs in plain text into clickable links.
 
     If you pass the filter an additional integer it will shorten the urls
@@ -432,55 +519,95 @@ def do_urlize(eval_ctx, value, trim_url_limit=None, nofollow=False,
     .. versionchanged:: 2.8+
        The *target* parameter was added.
     """
-    rv = urlize(value, trim_url_limit, nofollow, target)
+    policies = eval_ctx.environment.policies
+    rel = set((rel or '').split() or [])
+    if nofollow:
+        rel.add('nofollow')
+    rel.update((policies['urlize.rel'] or '').split())
+    if target is None:
+        target = policies['urlize.target']
+    rel = ' '.join(sorted(rel)) or None
+    rv = urlize(value, trim_url_limit, rel=rel, target=target)
     if eval_ctx.autoescape:
         rv = Markup(rv)
     return rv
 
 
-def do_indent(s, width=4, indentfirst=False):
-    """Return a copy of the passed string, each line indented by
-    4 spaces. The first line is not indented. If you want to
-    change the number of spaces or indent the first line too
-    you can pass additional parameters to the filter:
+def do_indent(
+    s, width=4, first=False, blank=False, indentfirst=None
+):
+    """Return a copy of the string with each line indented by 4 spaces. The
+    first line and blank lines are not indented by default.
 
-    .. sourcecode:: jinja
+    :param width: Number of spaces to indent by.
+    :param first: Don't skip indenting the first line.
+    :param blank: Don't skip indenting empty lines.
 
-        {{ mytext|indent(2, true) }}
-            indent by two spaces and indent the first line too.
+    .. versionchanged:: 2.10
+        Blank lines are not indented by default.
+
+        Rename the ``indentfirst`` argument to ``first``.
     """
+    if indentfirst is not None:
+        warnings.warn(DeprecationWarning(
+            'The "indentfirst" argument is renamed to "first".'
+        ), stacklevel=2)
+        first = indentfirst
+
+    s += u'\n'  # this quirk is necessary for splitlines method
     indention = u' ' * width
-    rv = (u'\n' + indention).join(s.splitlines())
-    if indentfirst:
+
+    if blank:
+        rv = (u'\n' + indention).join(s.splitlines())
+    else:
+        lines = s.splitlines()
+        rv = lines.pop(0)
+
+        if lines:
+            rv += u'\n' + u'\n'.join(
+                indention + line if line else line for line in lines
+            )
+
+    if first:
         rv = indention + rv
+
     return rv
 
 
-def do_truncate(s, length=255, killwords=False, end='...'):
+@environmentfilter
+def do_truncate(env, s, length=255, killwords=False, end='...', leeway=None):
     """Return a truncated copy of the string. The length is specified
     with the first parameter which defaults to ``255``. If the second
     parameter is ``true`` the filter will cut the text at length. Otherwise
     it will discard the last word. If the text was in fact
     truncated it will append an ellipsis sign (``"..."``). If you want a
     different ellipsis sign than ``"..."`` you can specify it using the
-    third parameter.
+    third parameter. Strings that only exceed the length by the tolerance
+    margin given in the fourth parameter will not be truncated.
 
     .. sourcecode:: jinja
 
-        {{ "foo bar baz"|truncate(9) }}
-            -> "foo ..."
-        {{ "foo bar baz"|truncate(9, True) }}
+        {{ "foo bar baz qux"|truncate(9) }}
+            -> "foo..."
+        {{ "foo bar baz qux"|truncate(9, True) }}
             -> "foo ba..."
+        {{ "foo bar baz qux"|truncate(11) }}
+            -> "foo bar baz qux"
+        {{ "foo bar baz qux"|truncate(11, False, '...', 0) }}
+            -> "foo bar..."
 
+    The default leeway on newer Jinja2 versions is 5 and was 0 before but
+    can be reconfigured globally.
     """
-    if len(s) <= length:
+    if leeway is None:
+        leeway = env.policies['truncate.leeway']
+    assert length >= len(end), 'expected length >= %s, got %s' % (len(end), length)
+    assert leeway >= 0, 'expected leeway >= 0, got %s' % leeway
+    if len(s) <= length + leeway:
         return s
-    elif killwords:
+    if killwords:
         return s[:length - len(end)] + end
-
     result = s[:length - len(end)].rsplit(' ', 1)[0]
-    if len(result) < length:
-        result += ' '
     return result + end
 
 
@@ -518,9 +645,12 @@ def do_int(value, default=0, base=10):
     can also override the default base (10) in the second
     parameter, which handles input with prefixes such as
     0b, 0o and 0x for bases 2, 8 and 16 respectively.
+    The base is ignored for decimal numbers and non-string values.
     """
     try:
-        return int(value, base)
+        if isinstance(value, string_types):
+            return int(value, base)
+        return int(value)
     except (TypeError, ValueError):
         # this quirk is necessary so that "42.23"|int gives 42.
         try:
@@ -669,6 +799,15 @@ def do_round(value, precision=0, method='common'):
     return func(value * (10 ** precision)) / (10 ** precision)
 
 
+# Use a regular tuple repr here.  This is what we did in the past and we
+# really want to hide this custom type as much as possible.  In particular
+# we do not want to accidentally expose an auto generated repr in case
+# people start to print this out in comments or something similar for
+# debugging.
+_GroupTuple = namedtuple('_GroupTuple', ['grouper', 'list'])
+_GroupTuple.__repr__ = tuple.__repr__
+_GroupTuple.__str__ = tuple.__str__
+
 @environmentfilter
 def do_groupby(environment, value, attribute):
     """Group a sequence of objects by a common attribute.
@@ -709,17 +848,8 @@ def do_groupby(environment, value, attribute):
        attribute of another attribute.
     """
     expr = make_attrgetter(environment, attribute)
-    return sorted(map(_GroupTuple, groupby(sorted(value, key=expr), expr)))
-
-
-class _GroupTuple(tuple):
-    __slots__ = ()
-    grouper = property(itemgetter(0))
-    list = property(itemgetter(1))
-
-    def __new__(cls, xxx_todo_changeme):
-        (key, value) = xxx_todo_changeme
-        return tuple.__new__(cls, (key, list(value)))
+    return [_GroupTuple(key, list(values)) for key, values
+            in groupby(sorted(value, key=expr), expr)]
 
 
 @environmentfilter
@@ -827,24 +957,7 @@ def do_map(*args, **kwargs):
 
     .. versionadded:: 2.7
     """
-    context = args[0]
-    seq = args[1]
-
-    if len(args) == 2 and 'attribute' in kwargs:
-        attribute = kwargs.pop('attribute')
-        if kwargs:
-            raise FilterArgumentError('Unexpected keyword argument %r' %
-                next(iter(kwargs)))
-        func = make_attrgetter(context.environment, attribute)
-    else:
-        try:
-            name = args[2]
-            args = args[3:]
-        except LookupError:
-            raise FilterArgumentError('map requires a filter argument')
-        func = lambda item: context.environment.call_filter(
-            name, item, args, kwargs, context=context)
-
+    seq, func = prepare_map(args, kwargs)
     if seq:
         for item in seq:
             yield func(item)
@@ -852,8 +965,10 @@ def do_map(*args, **kwargs):
 
 @contextfilter
 def do_select(*args, **kwargs):
-    """Filters a sequence of objects by applying a test to the object and only
-    selecting the ones with the test succeeding.
+    """Filters a sequence of objects by applying a test to each object,
+    and only selecting the objects with the test succeeding.
+
+    If no test is specified, each object will be evaluated as a boolean.
 
     Example usage:
 
@@ -861,16 +976,21 @@ def do_select(*args, **kwargs):
 
         {{ numbers|select("odd") }}
         {{ numbers|select("odd") }}
+        {{ numbers|select("divisibleby", 3) }}
+        {{ numbers|select("lessthan", 42) }}
+        {{ strings|select("equalto", "mystring") }}
 
     .. versionadded:: 2.7
     """
-    return _select_or_reject(args, kwargs, lambda x: x, False)
+    return select_or_reject(args, kwargs, lambda x: x, False)
 
 
 @contextfilter
 def do_reject(*args, **kwargs):
-    """Filters a sequence of objects by applying a test to the object and
-    rejecting the ones with the test succeeding.
+    """Filters a sequence of objects by applying a test to each object,
+    and rejecting the objects with the test succeeding.
+
+    If no test is specified, each object will be evaluated as a boolean.
 
     Example usage:
 
@@ -880,13 +1000,17 @@ def do_reject(*args, **kwargs):
 
     .. versionadded:: 2.7
     """
-    return _select_or_reject(args, kwargs, lambda x: not x, False)
+    return select_or_reject(args, kwargs, lambda x: not x, False)
 
 
 @contextfilter
 def do_selectattr(*args, **kwargs):
-    """Filters a sequence of objects by applying a test to an attribute of an
-    object and only selecting the ones with the test succeeding.
+    """Filters a sequence of objects by applying a test to the specified
+    attribute of each object, and only selecting the objects with the
+    test succeeding.
+
+    If no test is specified, the attribute's value will be evaluated as
+    a boolean.
 
     Example usage:
 
@@ -897,13 +1021,17 @@ def do_selectattr(*args, **kwargs):
 
     .. versionadded:: 2.7
     """
-    return _select_or_reject(args, kwargs, lambda x: x, True)
+    return select_or_reject(args, kwargs, lambda x: x, True)
 
 
 @contextfilter
 def do_rejectattr(*args, **kwargs):
-    """Filters a sequence of objects by applying a test to an attribute of an
-    object or the attribute and rejecting the ones with the test succeeding.
+    """Filters a sequence of objects by applying a test to the specified
+    attribute of each object, and rejecting the objects with the test
+    succeeding.
+
+    If no test is specified, the attribute's value will be evaluated as
+    a boolean.
 
     .. sourcecode:: jinja
 
@@ -912,10 +1040,67 @@ def do_rejectattr(*args, **kwargs):
 
     .. versionadded:: 2.7
     """
-    return _select_or_reject(args, kwargs, lambda x: not x, True)
+    return select_or_reject(args, kwargs, lambda x: not x, True)
+
+
+@evalcontextfilter
+def do_tojson(eval_ctx, value, indent=None):
+    """Dumps a structure to JSON so that it's safe to use in ``<script>``
+    tags.  It accepts the same arguments and returns a JSON string.  Note that
+    this is available in templates through the ``|tojson`` filter which will
+    also mark the result as safe.  Due to how this function escapes certain
+    characters this is safe even if used outside of ``<script>`` tags.
+
+    The following characters are escaped in strings:
+
+    -   ``<``
+    -   ``>``
+    -   ``&``
+    -   ``'``
+
+    This makes it safe to embed such strings in any place in HTML with the
+    notable exception of double quoted attributes.  In that case single
+    quote your attributes or HTML escape it in addition.
+
+    The indent parameter can be used to enable pretty printing.  Set it to
+    the number of spaces that the structures should be indented with.
+
+    Note that this filter is for use in HTML contexts only.
+
+    .. versionadded:: 2.9
+    """
+    policies = eval_ctx.environment.policies
+    dumper = policies['json.dumps_function']
+    options = policies['json.dumps_kwargs']
+    if indent is not None:
+        options = dict(options)
+        options['indent'] = indent
+    return htmlsafe_json_dumps(value, dumper=dumper, **options)
+
+
+def prepare_map(args, kwargs):
+    context = args[0]
+    seq = args[1]
+
+    if len(args) == 2 and 'attribute' in kwargs:
+        attribute = kwargs.pop('attribute')
+        if kwargs:
+            raise FilterArgumentError('Unexpected keyword argument %r' %
+                next(iter(kwargs)))
+        func = make_attrgetter(context.environment, attribute)
+    else:
+        try:
+            name = args[2]
+            args = args[3:]
+        except LookupError:
+            raise FilterArgumentError('map requires a filter argument')
+        func = lambda item: context.environment.call_filter(
+            name, item, args, kwargs, context=context)
 
+    return seq, func
 
-def _select_or_reject(args, kwargs, modfunc, lookup_attr):
+
+def prepare_select_or_reject(args, kwargs, modfunc, lookup_attr):
     context = args[0]
     seq = args[1]
     if lookup_attr:
@@ -937,9 +1122,14 @@ def _select_or_reject(args, kwargs, modfunc, lookup_attr):
     except LookupError:
         func = bool
 
+    return seq, lambda item: modfunc(func(transfunc(item)))
+
+
+def select_or_reject(args, kwargs, modfunc, lookup_attr):
+    seq, func = prepare_select_or_reject(args, kwargs, modfunc, lookup_attr)
     if seq:
         for item in seq:
-            if modfunc(func(transfunc(item))):
+            if func(item):
                 yield item
 
 
@@ -969,6 +1159,8 @@ def _select_or_reject(args, kwargs, modfunc, lookup_attr):
     'list':                 do_list,
     'lower':                do_lower,
     'map':                  do_map,
+    'min':                  do_min,
+    'max':                  do_max,
     'pprint':               do_pprint,
     'random':               do_random,
     'reject':               do_reject,
@@ -987,10 +1179,12 @@ def _select_or_reject(args, kwargs, modfunc, lookup_attr):
     'title':                do_title,
     'trim':                 do_trim,
     'truncate':             do_truncate,
+    'unique':               do_unique,
     'upper':                do_upper,
     'urlencode':            do_urlencode,
     'urlize':               do_urlize,
     'wordcount':            do_wordcount,
     'wordwrap':             do_wordwrap,
     'xmlattr':              do_xmlattr,
+    'tojson':               do_tojson,
 }
diff --git a/deps/v8/third_party/jinja2/get_jinja2.sh b/deps/v8/third_party/jinja2/get_jinja2.sh
index 0018349ebc4..bc6c4c3068f 100755
--- a/deps/v8/third_party/jinja2/get_jinja2.sh
+++ b/deps/v8/third_party/jinja2/get_jinja2.sh
@@ -7,8 +7,8 @@
 # Download page:
 # https://pypi.python.org/pypi/Jinja2
 PACKAGE='Jinja2'
-VERSION='2.8'
-SRC_URL='https://pypi.python.org/packages/f2/2f/0b98b06a345a761bec91a079ccae392d282690c2d8272e708f4d10829e22/Jinja2-2.8.tar.gz'
+VERSION='2.10'
+SRC_URL='https://pypi.python.org/packages/56/e6/332789f295cf22308386cf5bbd1f4e00ed11484299c5d7383378cf48ba47/Jinja2-2.10.tar.gz'
 PACKAGE_DIR='jinja2'
 
 CHROMIUM_FILES="README.chromium OWNERS get_jinja2.sh"
@@ -120,3 +120,17 @@ mv "$INSTALL_DIR" "$OLD_DIR"
 mv "$PACKAGE_DIR" "$INSTALL_DIR"
 cd "$INSTALL_DIR"
 rm -fr "$OLD_DIR"
+
+# Generating jinja2.gni
+cat > jinja2.gni <<EOF
+# DO NOT EDIT
+# This is generated from get_jinja2.sh.
+jinja2_sources = [
+EOF
+
+for i in $(LC_COLLATE=C ls *.py)
+do
+  echo "  \"//third_party/jinja2/${i}\"," >> jinja2.gni
+done
+
+echo "]" >> jinja2.gni
diff --git a/deps/v8/third_party/jinja2/idtracking.py b/deps/v8/third_party/jinja2/idtracking.py
new file mode 100644
index 00000000000..491bfe08364
--- /dev/null
+++ b/deps/v8/third_party/jinja2/idtracking.py
@@ -0,0 +1,286 @@
+from jinja2.visitor import NodeVisitor
+from jinja2._compat import iteritems
+
+
+VAR_LOAD_PARAMETER = 'param'
+VAR_LOAD_RESOLVE = 'resolve'
+VAR_LOAD_ALIAS = 'alias'
+VAR_LOAD_UNDEFINED = 'undefined'
+
+
+def find_symbols(nodes, parent_symbols=None):
+    sym = Symbols(parent=parent_symbols)
+    visitor = FrameSymbolVisitor(sym)
+    for node in nodes:
+        visitor.visit(node)
+    return sym
+
+
+def symbols_for_node(node, parent_symbols=None):
+    sym = Symbols(parent=parent_symbols)
+    sym.analyze_node(node)
+    return sym
+
+
+class Symbols(object):
+
+    def __init__(self, parent=None, level=None):
+        if level is None:
+            if parent is None:
+                level = 0
+            else:
+                level = parent.level + 1
+        self.level = level
+        self.parent = parent
+        self.refs = {}
+        self.loads = {}
+        self.stores = set()
+
+    def analyze_node(self, node, **kwargs):
+        visitor = RootVisitor(self)
+        visitor.visit(node, **kwargs)
+
+    def _define_ref(self, name, load=None):
+        ident = 'l_%d_%s' % (self.level, name)
+        self.refs[name] = ident
+        if load is not None:
+            self.loads[ident] = load
+        return ident
+
+    def find_load(self, target):
+        if target in self.loads:
+            return self.loads[target]
+        if self.parent is not None:
+            return self.parent.find_load(target)
+
+    def find_ref(self, name):
+        if name in self.refs:
+            return self.refs[name]
+        if self.parent is not None:
+            return self.parent.find_ref(name)
+
+    def ref(self, name):
+        rv = self.find_ref(name)
+        if rv is None:
+            raise AssertionError('Tried to resolve a name to a reference that '
+                                 'was unknown to the frame (%r)' % name)
+        return rv
+
+    def copy(self):
+        rv = object.__new__(self.__class__)
+        rv.__dict__.update(self.__dict__)
+        rv.refs = self.refs.copy()
+        rv.loads = self.loads.copy()
+        rv.stores = self.stores.copy()
+        return rv
+
+    def store(self, name):
+        self.stores.add(name)
+
+        # If we have not see the name referenced yet, we need to figure
+        # out what to set it to.
+        if name not in self.refs:
+            # If there is a parent scope we check if the name has a
+            # reference there.  If it does it means we might have to alias
+            # to a variable there.
+            if self.parent is not None:
+                outer_ref = self.parent.find_ref(name)
+                if outer_ref is not None:
+                    self._define_ref(name, load=(VAR_LOAD_ALIAS, outer_ref))
+                    return
+
+            # Otherwise we can just set it to undefined.
+            self._define_ref(name, load=(VAR_LOAD_UNDEFINED, None))
+
+    def declare_parameter(self, name):
+        self.stores.add(name)
+        return self._define_ref(name, load=(VAR_LOAD_PARAMETER, None))
+
+    def load(self, name):
+        target = self.find_ref(name)
+        if target is None:
+            self._define_ref(name, load=(VAR_LOAD_RESOLVE, name))
+
+    def branch_update(self, branch_symbols):
+        stores = {}
+        for branch in branch_symbols:
+            for target in branch.stores:
+                if target in self.stores:
+                    continue
+                stores[target] = stores.get(target, 0) + 1
+
+        for sym in branch_symbols:
+            self.refs.update(sym.refs)
+            self.loads.update(sym.loads)
+            self.stores.update(sym.stores)
+
+        for name, branch_count in iteritems(stores):
+            if branch_count == len(branch_symbols):
+                continue
+            target = self.find_ref(name)
+            assert target is not None, 'should not happen'
+
+            if self.parent is not None:
+                outer_target = self.parent.find_ref(name)
+                if outer_target is not None:
+                    self.loads[target] = (VAR_LOAD_ALIAS, outer_target)
+                    continue
+            self.loads[target] = (VAR_LOAD_RESOLVE, name)
+
+    def dump_stores(self):
+        rv = {}
+        node = self
+        while node is not None:
+            for name in node.stores:
+                if name not in rv:
+                    rv[name] = self.find_ref(name)
+            node = node.parent
+        return rv
+
+    def dump_param_targets(self):
+        rv = set()
+        node = self
+        while node is not None:
+            for target, (instr, _) in iteritems(self.loads):
+                if instr == VAR_LOAD_PARAMETER:
+                    rv.add(target)
+            node = node.parent
+        return rv
+
+
+class RootVisitor(NodeVisitor):
+
+    def __init__(self, symbols):
+        self.sym_visitor = FrameSymbolVisitor(symbols)
+
+    def _simple_visit(self, node, **kwargs):
+        for child in node.iter_child_nodes():
+            self.sym_visitor.visit(child)
+
+    visit_Template = visit_Block = visit_Macro = visit_FilterBlock = \
+        visit_Scope = visit_If = visit_ScopedEvalContextModifier = \
+        _simple_visit
+
+    def visit_AssignBlock(self, node, **kwargs):
+        for child in node.body:
+            self.sym_visitor.visit(child)
+
+    def visit_CallBlock(self, node, **kwargs):
+        for child in node.iter_child_nodes(exclude=('call',)):
+            self.sym_visitor.visit(child)
+
+    def visit_OverlayScope(self, node, **kwargs):
+        for child in node.body:
+            self.sym_visitor.visit(child)
+
+    def visit_For(self, node, for_branch='body', **kwargs):
+        if for_branch == 'body':
+            self.sym_visitor.visit(node.target, store_as_param=True)
+            branch = node.body
+        elif for_branch == 'else':
+            branch = node.else_
+        elif for_branch == 'test':
+            self.sym_visitor.visit(node.target, store_as_param=True)
+            if node.test is not None:
+                self.sym_visitor.visit(node.test)
+            return
+        else:
+            raise RuntimeError('Unknown for branch')
+        for item in branch or ():
+            self.sym_visitor.visit(item)
+
+    def visit_With(self, node, **kwargs):
+        for target in node.targets:
+            self.sym_visitor.visit(target)
+        for child in node.body:
+            self.sym_visitor.visit(child)
+
+    def generic_visit(self, node, *args, **kwargs):
+        raise NotImplementedError('Cannot find symbols for %r' %
+                                  node.__class__.__name__)
+
+
+class FrameSymbolVisitor(NodeVisitor):
+    """A visitor for `Frame.inspect`."""
+
+    def __init__(self, symbols):
+        self.symbols = symbols
+
+    def visit_Name(self, node, store_as_param=False, **kwargs):
+        """All assignments to names go through this function."""
+        if store_as_param or node.ctx == 'param':
+            self.symbols.declare_parameter(node.name)
+        elif node.ctx == 'store':
+            self.symbols.store(node.name)
+        elif node.ctx == 'load':
+            self.symbols.load(node.name)
+
+    def visit_NSRef(self, node, **kwargs):
+        self.symbols.load(node.name)
+
+    def visit_If(self, node, **kwargs):
+        self.visit(node.test, **kwargs)
+
+        original_symbols = self.symbols
+
+        def inner_visit(nodes):
+            self.symbols = rv = original_symbols.copy()
+            for subnode in nodes:
+                self.visit(subnode, **kwargs)
+            self.symbols = original_symbols
+            return rv
+
+        body_symbols = inner_visit(node.body)
+        elif_symbols = inner_visit(node.elif_)
+        else_symbols = inner_visit(node.else_ or ())
+
+        self.symbols.branch_update([body_symbols, elif_symbols, else_symbols])
+
+    def visit_Macro(self, node, **kwargs):
+        self.symbols.store(node.name)
+
+    def visit_Import(self, node, **kwargs):
+        self.generic_visit(node, **kwargs)
+        self.symbols.store(node.target)
+
+    def visit_FromImport(self, node, **kwargs):
+        self.generic_visit(node, **kwargs)
+        for name in node.names:
+            if isinstance(name, tuple):
+                self.symbols.store(name[1])
+            else:
+                self.symbols.store(name)
+
+    def visit_Assign(self, node, **kwargs):
+        """Visit assignments in the correct order."""
+        self.visit(node.node, **kwargs)
+        self.visit(node.target, **kwargs)
+
+    def visit_For(self, node, **kwargs):
+        """Visiting stops at for blocks.  However the block sequence
+        is visited as part of the outer scope.
+        """
+        self.visit(node.iter, **kwargs)
+
+    def visit_CallBlock(self, node, **kwargs):
+        self.visit(node.call, **kwargs)
+
+    def visit_FilterBlock(self, node, **kwargs):
+        self.visit(node.filter, **kwargs)
+
+    def visit_With(self, node, **kwargs):
+        for target in node.values:
+            self.visit(target)
+
+    def visit_AssignBlock(self, node, **kwargs):
+        """Stop visiting at block assigns."""
+        self.visit(node.target, **kwargs)
+
+    def visit_Scope(self, node, **kwargs):
+        """Stop visiting at scopes."""
+
+    def visit_Block(self, node, **kwargs):
+        """Stop visiting at blocks."""
+
+    def visit_OverlayScope(self, node, **kwargs):
+        """Do not visit into overlay scopes."""
diff --git a/deps/v8/third_party/jinja2/jinja2.gni b/deps/v8/third_party/jinja2/jinja2.gni
new file mode 100644
index 00000000000..cef0d48a883
--- /dev/null
+++ b/deps/v8/third_party/jinja2/jinja2.gni
@@ -0,0 +1,31 @@
+# DO NOT EDIT
+# This is generated from get_jinja2.sh.
+jinja2_sources = [
+  "//third_party/jinja2/__init__.py",
+  "//third_party/jinja2/_compat.py",
+  "//third_party/jinja2/_identifier.py",
+  "//third_party/jinja2/asyncfilters.py",
+  "//third_party/jinja2/asyncsupport.py",
+  "//third_party/jinja2/bccache.py",
+  "//third_party/jinja2/compiler.py",
+  "//third_party/jinja2/constants.py",
+  "//third_party/jinja2/debug.py",
+  "//third_party/jinja2/defaults.py",
+  "//third_party/jinja2/environment.py",
+  "//third_party/jinja2/exceptions.py",
+  "//third_party/jinja2/ext.py",
+  "//third_party/jinja2/filters.py",
+  "//third_party/jinja2/idtracking.py",
+  "//third_party/jinja2/lexer.py",
+  "//third_party/jinja2/loaders.py",
+  "//third_party/jinja2/meta.py",
+  "//third_party/jinja2/nativetypes.py",
+  "//third_party/jinja2/nodes.py",
+  "//third_party/jinja2/optimizer.py",
+  "//third_party/jinja2/parser.py",
+  "//third_party/jinja2/runtime.py",
+  "//third_party/jinja2/sandbox.py",
+  "//third_party/jinja2/tests.py",
+  "//third_party/jinja2/utils.py",
+  "//third_party/jinja2/visitor.py",
+]
diff --git a/deps/v8/third_party/jinja2/lexer.py b/deps/v8/third_party/jinja2/lexer.py
index c8dac214edd..6fd135dd5b0 100644
--- a/deps/v8/third_party/jinja2/lexer.py
+++ b/deps/v8/third_party/jinja2/lexer.py
@@ -11,18 +11,16 @@
     operators we don't allow in templates. On the other hand it separates
     template code and python code in expressions.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD, see LICENSE for more details.
 """
 import re
-
-from operator import itemgetter
 from collections import deque
+from operator import itemgetter
+
+from jinja2._compat import implements_iterator, intern, iteritems, text_type
 from jinja2.exceptions import TemplateSyntaxError
 from jinja2.utils import LRUCache
-from jinja2._compat import iteritems, implements_iterator, text_type, \
-     intern, PY2
-
 
 # cache for the lexers. Exists in order to be able to have multiple
 # environments with the same lexer
@@ -34,16 +32,25 @@
                        r'|"([^"\\]*(?:\\.[^"\\]*)*)")', re.S)
 integer_re = re.compile(r'\d+')
 
-# we use the unicode identifier rule if this python version is able
-# to handle unicode identifiers, otherwise the standard ASCII one.
 try:
+    # check if this Python supports Unicode identifiers
     compile('föö', '<unknown>', 'eval')
 except SyntaxError:
-    name_re = re.compile(r'\b[a-zA-Z_][a-zA-Z0-9_]*\b')
+    # no Unicode support, use ASCII identifiers
+    name_re = re.compile(r'[a-zA-Z_][a-zA-Z0-9_]*')
+    check_ident = False
 else:
-    from jinja2 import _stringdefs
-    name_re = re.compile(r'[%s][%s]*' % (_stringdefs.xid_start,
-                                         _stringdefs.xid_continue))
+    # Unicode support, build a pattern to match valid characters, and set flag
+    # to use str.isidentifier to validate during lexing
+    from jinja2 import _identifier
+    name_re = re.compile(r'[\w{0}]+'.format(_identifier.pattern))
+    check_ident = True
+    # remove the pattern from memory after building the regex
+    import sys
+    del sys.modules['jinja2._identifier']
+    import jinja2
+    del jinja2._identifier
+    del _identifier
 
 float_re = re.compile(r'(?<!\.)\d+\.\d+')
 newline_re = re.compile(r'(\r\n|\r|\n)')
@@ -288,7 +295,7 @@ def __next__(self):
 
 @implements_iterator
 class TokenStream(object):
-    """A token stream is an iterable that yields :class:`Token`\s.  The
+    """A token stream is an iterable that yields :class:`Token`\\s.  The
     parser however does not iterate over it but calls :meth:`next` to go
     one token ahead.  The current active token is stored as :attr:`current`.
     """
@@ -340,7 +347,10 @@ def skip_if(self, expr):
         return self.next_if(expr) is not None
 
     def __next__(self):
-        """Go one token ahead and return the old one"""
+        """Go one token ahead and return the old one.
+
+        Use the built-in :func:`next` instead of calling this directly.
+        """
         rv = self.current
         if self._pushed:
             self.current = self._pushed.popleft()
@@ -500,7 +510,7 @@ def __init__(self, environment):
             ],
             # blocks
             TOKEN_BLOCK_BEGIN: [
-                (c('(?:\-%s\s*|%s)%s' % (
+                (c(r'(?:\-%s\s*|%s)%s' % (
                     e(environment.block_end_string),
                     e(environment.block_end_string),
                     block_suffix_re
@@ -508,14 +518,14 @@ def __init__(self, environment):
             ] + tag_rules,
             # variables
             TOKEN_VARIABLE_BEGIN: [
-                (c('\-%s\s*|%s' % (
+                (c(r'\-%s\s*|%s' % (
                     e(environment.variable_end_string),
                     e(environment.variable_end_string)
                 )), TOKEN_VARIABLE_END, '#pop')
             ] + tag_rules,
             # raw block
             TOKEN_RAW_BEGIN: [
-                (c('(.*?)((?:\s*%s\-|%s)\s*endraw\s*(?:\-%s\s*|%s%s))' % (
+                (c(r'(.*?)((?:\s*%s\-|%s)\s*endraw\s*(?:\-%s\s*|%s%s))' % (
                     e(environment.block_start_string),
                     block_prefix_re,
                     e(environment.block_end_string),
@@ -565,6 +575,10 @@ def wrap(self, stream, name=None, filename=None):
                 token = value
             elif token == 'name':
                 value = str(value)
+                if check_ident and not value.isidentifier():
+                    raise TemplateSyntaxError(
+                        'Invalid character in identifier',
+                        lineno, name, filename)
             elif token == 'string':
                 # try to unescape string
                 try:
@@ -574,15 +588,6 @@ def wrap(self, stream, name=None, filename=None):
                 except Exception as e:
                     msg = str(e).split(':')[-1].strip()
                     raise TemplateSyntaxError(msg, lineno, name, filename)
-                # if we can express it as bytestring (ascii only)
-                # we do that for support of semi broken APIs
-                # as datetime.datetime.strftime.  On python 3 this
-                # call becomes a noop thanks to 2to3
-                if PY2:
-                    try:
-                        value = value.encode('ascii')
-                    except UnicodeError:
-                        pass
             elif token == 'integer':
                 value = int(value)
             elif token == 'float':
diff --git a/deps/v8/third_party/jinja2/loaders.py b/deps/v8/third_party/jinja2/loaders.py
index 44aa3925a2d..4c797937606 100644
--- a/deps/v8/third_party/jinja2/loaders.py
+++ b/deps/v8/third_party/jinja2/loaders.py
@@ -5,7 +5,7 @@
 
     Jinja loader classes.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD, see LICENSE for more details.
 """
 import os
@@ -351,7 +351,7 @@ def get_source(self, environment, template):
         try:
             return loader.get_source(environment, name)
         except TemplateNotFound:
-            # re-raise the exception with the correct fileame here.
+            # re-raise the exception with the correct filename here.
             # (the one that includes the prefix)
             raise TemplateNotFound(template)
 
@@ -361,7 +361,7 @@ def load(self, environment, name, globals=None):
         try:
             return loader.load(environment, local_name, globals)
         except TemplateNotFound:
-            # re-raise the exception with the correct fileame here.
+            # re-raise the exception with the correct filename here.
             # (the one that includes the prefix)
             raise TemplateNotFound(name)
 
diff --git a/deps/v8/third_party/jinja2/meta.py b/deps/v8/third_party/jinja2/meta.py
index 3dbab7c22d5..7421914f772 100644
--- a/deps/v8/third_party/jinja2/meta.py
+++ b/deps/v8/third_party/jinja2/meta.py
@@ -6,12 +6,12 @@
     This module implements various functions that exposes information about
     templates that might be interesting for various kinds of applications.
 
-    :copyright: (c) 2010 by the Jinja Team, see AUTHORS for more details.
+    :copyright: (c) 2017 by the Jinja Team, see AUTHORS for more details.
     :license: BSD, see LICENSE for more details.
 """
 from jinja2 import nodes
 from jinja2.compiler import CodeGenerator
-from jinja2._compat import string_types
+from jinja2._compat import string_types, iteritems
 
 
 class TrackingCodeGenerator(CodeGenerator):
@@ -25,9 +25,12 @@ def __init__(self, environment):
     def write(self, x):
         """Don't write."""
 
-    def pull_locals(self, frame):
+    def enter_frame(self, frame):
         """Remember all undeclared identifiers."""
-        self.undeclared_identifiers.update(frame.identifiers.undeclared)
+        CodeGenerator.enter_frame(self, frame)
+        for _, (action, param) in iteritems(frame.symbols.loads):
+            if action == 'resolve':
+                self.undeclared_identifiers.add(param)
 
 
 def find_undeclared_variables(ast):
diff --git a/deps/v8/third_party/jinja2/nativetypes.py b/deps/v8/third_party/jinja2/nativetypes.py
new file mode 100644
index 00000000000..fe17e4138df
--- /dev/null
+++ b/deps/v8/third_party/jinja2/nativetypes.py
@@ -0,0 +1,220 @@
+import sys
+from ast import literal_eval
+from itertools import islice, chain
+from jinja2 import nodes
+from jinja2._compat import text_type
+from jinja2.compiler import CodeGenerator, has_safe_repr
+from jinja2.environment import Environment, Template
+from jinja2.utils import concat, escape
+
+
+def native_concat(nodes):
+    """Return a native Python type from the list of compiled nodes. If the
+    result is a single node, its value is returned. Otherwise, the nodes are
+    concatenated as strings. If the result can be parsed with
+    :func:`ast.literal_eval`, the parsed value is returned. Otherwise, the
+    string is returned.
+    """
+    head = list(islice(nodes, 2))
+
+    if not head:
+        return None
+
+    if len(head) == 1:
+        out = head[0]
+    else:
+        out = u''.join([text_type(v) for v in chain(head, nodes)])
+
+    try:
+        return literal_eval(out)
+    except (ValueError, SyntaxError, MemoryError):
+        return out
+
+
+class NativeCodeGenerator(CodeGenerator):
+    """A code generator which avoids injecting ``to_string()`` calls around the
+    internal code Jinja uses to render templates.
+    """
+
+    def visit_Output(self, node, frame):
+        """Same as :meth:`CodeGenerator.visit_Output`, but do not call
+        ``to_string`` on output nodes in generated code.
+        """
+        if self.has_known_extends and frame.require_output_check:
+            return
+
+        finalize = self.environment.finalize
+        finalize_context = getattr(finalize, 'contextfunction', False)
+        finalize_eval = getattr(finalize, 'evalcontextfunction', False)
+        finalize_env = getattr(finalize, 'environmentfunction', False)
+
+        if finalize is not None:
+            if finalize_context or finalize_eval:
+                const_finalize = None
+            elif finalize_env:
+                def const_finalize(x):
+                    return finalize(self.environment, x)
+            else:
+                const_finalize = finalize
+        else:
+            def const_finalize(x):
+                return x
+
+        # If we are inside a frame that requires output checking, we do so.
+        outdent_later = False
+
+        if frame.require_output_check:
+            self.writeline('if parent_template is None:')
+            self.indent()
+            outdent_later = True
+
+        # Try to evaluate as many chunks as possible into a static string at
+        # compile time.
+        body = []
+
+        for child in node.nodes:
+            try:
+                if const_finalize is None:
+                    raise nodes.Impossible()
+
+                const = child.as_const(frame.eval_ctx)
+                if not has_safe_repr(const):
+                    raise nodes.Impossible()
+            except nodes.Impossible:
+                body.append(child)
+                continue
+
+            # the frame can't be volatile here, because otherwise the as_const
+            # function would raise an Impossible exception at that point
+            try:
+                if frame.eval_ctx.autoescape:
+                    if hasattr(const, '__html__'):
+                        const = const.__html__()
+                    else:
+                        const = escape(const)
+
+                const = const_finalize(const)
+            except Exception:
+                # if something goes wrong here we evaluate the node at runtime
+                # for easier debugging
+                body.append(child)
+                continue
+
+            if body and isinstance(body[-1], list):
+                body[-1].append(const)
+            else:
+                body.append([const])
+
+        # if we have less than 3 nodes or a buffer we yield or extend/append
+        if len(body) < 3 or frame.buffer is not None:
+            if frame.buffer is not None:
+                # for one item we append, for more we extend
+                if len(body) == 1:
+                    self.writeline('%s.append(' % frame.buffer)
+                else:
+                    self.writeline('%s.extend((' % frame.buffer)
+
+                self.indent()
+
+            for item in body:
+                if isinstance(item, list):
+                    val = repr(native_concat(item))
+
+                    if frame.buffer is None:
+                        self.writeline('yield ' + val)
+                    else:
+                        self.writeline(val + ',')
+                else:
+                    if frame.buffer is None:
+                        self.writeline('yield ', item)
+                    else:
+                        self.newline(item)
+
+                    close = 0
+
+                    if finalize is not None:
+                        self.write('environment.finalize(')
+
+                        if finalize_context:
+                            self.write('context, ')
+
+                        close += 1
+
+                    self.visit(item, frame)
+
+                    if close > 0:
+                        self.write(')' * close)
+
+                    if frame.buffer is not None:
+                        self.write(',')
+
+            if frame.buffer is not None:
+                # close the open parentheses
+                self.outdent()
+                self.writeline(len(body) == 1 and ')' or '))')
+
+        # otherwise we create a format string as this is faster in that case
+        else:
+            format = []
+            arguments = []
+
+            for item in body:
+                if isinstance(item, list):
+                    format.append(native_concat(item).replace('%', '%%'))
+                else:
+                    format.append('%s')
+                    arguments.append(item)
+
+            self.writeline('yield ')
+            self.write(repr(concat(format)) + ' % (')
+            self.indent()
+
+            for argument in arguments:
+                self.newline(argument)
+                close = 0
+
+                if finalize is not None:
+                    self.write('environment.finalize(')
+
+                    if finalize_context:
+                        self.write('context, ')
+                    elif finalize_eval:
+                        self.write('context.eval_ctx, ')
+                    elif finalize_env:
+                        self.write('environment, ')
+
+                    close += 1
+
+                self.visit(argument, frame)
+                self.write(')' * close + ', ')
+
+            self.outdent()
+            self.writeline(')')
+
+        if outdent_later:
+            self.outdent()
+
+
+class NativeTemplate(Template):
+    def render(self, *args, **kwargs):
+        """Render the template to produce a native Python type. If the result
+        is a single node, its value is returned. Otherwise, the nodes are
+        concatenated as strings. If the result can be parsed with
+        :func:`ast.literal_eval`, the parsed value is returned. Otherwise, the
+        string is returned.
+        """
+        vars = dict(*args, **kwargs)
+
+        try:
+            return native_concat(self.root_render_func(self.new_context(vars)))
+        except Exception:
+            exc_info = sys.exc_info()
+
+        return self.environment.handle_exception(exc_info, True)
+
+
+class NativeEnvironment(Environment):
+    """An environment that renders templates to native Python types."""
+
+    code_generator_class = NativeCodeGenerator
+    template_class = NativeTemplate
diff --git a/deps/v8/third_party/jinja2/nodes.py b/deps/v8/third_party/jinja2/nodes.py
index d32046ce5c3..4d9a01ad8bb 100644
--- a/deps/v8/third_party/jinja2/nodes.py
+++ b/deps/v8/third_party/jinja2/nodes.py
@@ -9,7 +9,7 @@
     `get_nodes` used by the parser and translator in order to normalize
     python and jinja nodes.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD, see LICENSE for more details.
 """
 import types
@@ -17,7 +17,7 @@
 
 from collections import deque
 from jinja2.utils import Markup
-from jinja2._compat import izip, with_metaclass, text_type
+from jinja2._compat import izip, with_metaclass, text_type, PY2
 
 
 #: the types we support for context functions
@@ -242,6 +242,35 @@ def __repr__(self):
                       arg in self.fields)
         )
 
+    def dump(self):
+        def _dump(node):
+            if not isinstance(node, Node):
+                buf.append(repr(node))
+                return
+
+            buf.append('nodes.%s(' % node.__class__.__name__)
+            if not node.fields:
+                buf.append(')')
+                return
+            for idx, field in enumerate(node.fields):
+                if idx:
+                    buf.append(', ')
+                value = getattr(node, field)
+                if isinstance(value, list):
+                    buf.append('[')
+                    for idx, item in enumerate(value):
+                        if idx:
+                            buf.append(', ')
+                        _dump(item)
+                    buf.append(']')
+                else:
+                    _dump(value)
+            buf.append(')')
+        buf = []
+        _dump(self)
+        return ''.join(buf)
+
+
 
 class Stmt(Node):
     """Base node for all statements."""
@@ -285,7 +314,7 @@ class For(Stmt):
 
 class If(Stmt):
     """If `test` is true, `body` is rendered, else `else_`."""
-    fields = ('test', 'body', 'else_')
+    fields = ('test', 'body', 'elif_', 'else_')
 
 
 class Macro(Stmt):
@@ -308,6 +337,15 @@ class FilterBlock(Stmt):
     fields = ('body', 'filter')
 
 
+class With(Stmt):
+    """Specific node for with statements.  In older versions of Jinja the
+    with statement was implemented on the base of the `Scope` node instead.
+
+    .. versionadded:: 2.9.3
+    """
+    fields = ('targets', 'values', 'body')
+
+
 class Block(Stmt):
     """A node that represents a block."""
     fields = ('name', 'body', 'scoped')
@@ -349,7 +387,7 @@ class Assign(Stmt):
 
 class AssignBlock(Stmt):
     """Assigns a block to a target."""
-    fields = ('target', 'body')
+    fields = ('target', 'filter', 'body')
 
 
 class Expr(Node):
@@ -427,6 +465,18 @@ def can_assign(self):
                                  'True', 'False', 'None')
 
 
+class NSRef(Expr):
+    """Reference to a namespace value assignment"""
+    fields = ('name', 'attr')
+
+    def can_assign(self):
+        # We don't need any special checks here; NSRef assignments have a
+        # runtime check to ensure the target is a namespace object which will
+        # have been checked already as it is created using a normal assignment
+        # which goes through a `Name` node.
+        return True
+
+
 class Literal(Expr):
     """Baseclass for literals."""
     abstract = True
@@ -441,7 +491,14 @@ class Const(Literal):
     fields = ('value',)
 
     def as_const(self, eval_ctx=None):
-        return self.value
+        rv = self.value
+        if PY2 and type(rv) is text_type and \
+           self.environment.policies['compiler.ascii_str']:
+            try:
+                rv = rv.encode('ascii')
+            except UnicodeError:
+                pass
+        return rv
 
     @classmethod
     def from_untrusted(cls, value, lineno=None, environment=None):
@@ -542,6 +599,25 @@ def as_const(self, eval_ctx=None):
         return self.expr2.as_const(eval_ctx)
 
 
+def args_as_const(node, eval_ctx):
+    args = [x.as_const(eval_ctx) for x in node.args]
+    kwargs = dict(x.as_const(eval_ctx) for x in node.kwargs)
+
+    if node.dyn_args is not None:
+        try:
+            args.extend(node.dyn_args.as_const(eval_ctx))
+        except Exception:
+            raise Impossible()
+
+    if node.dyn_kwargs is not None:
+        try:
+            kwargs.update(node.dyn_kwargs.as_const(eval_ctx))
+        except Exception:
+            raise Impossible()
+
+    return args, kwargs
+
+
 class Filter(Expr):
     """This node applies a filter on an expression.  `name` is the name of
     the filter, the rest of the fields are the same as for :class:`Call`.
@@ -549,39 +625,43 @@ class Filter(Expr):
     If the `node` of a filter is `None` the contents of the last buffer are
     filtered.  Buffers are created by macros and filter blocks.
     """
+
     fields = ('node', 'name', 'args', 'kwargs', 'dyn_args', 'dyn_kwargs')
 
     def as_const(self, eval_ctx=None):
         eval_ctx = get_eval_context(self, eval_ctx)
+
         if eval_ctx.volatile or self.node is None:
             raise Impossible()
+
         # we have to be careful here because we call filter_ below.
         # if this variable would be called filter, 2to3 would wrap the
         # call in a list beause it is assuming we are talking about the
         # builtin filter function here which no longer returns a list in
         # python 3.  because of that, do not rename filter_ to filter!
         filter_ = self.environment.filters.get(self.name)
+
         if filter_ is None or getattr(filter_, 'contextfilter', False):
             raise Impossible()
-        obj = self.node.as_const(eval_ctx)
-        args = [x.as_const(eval_ctx) for x in self.args]
+
+        # We cannot constant handle async filters, so we need to make sure
+        # to not go down this path.
+        if (
+            eval_ctx.environment.is_async
+            and getattr(filter_, 'asyncfiltervariant', False)
+        ):
+            raise Impossible()
+
+        args, kwargs = args_as_const(self, eval_ctx)
+        args.insert(0, self.node.as_const(eval_ctx))
+
         if getattr(filter_, 'evalcontextfilter', False):
             args.insert(0, eval_ctx)
         elif getattr(filter_, 'environmentfilter', False):
             args.insert(0, self.environment)
-        kwargs = dict(x.as_const(eval_ctx) for x in self.kwargs)
-        if self.dyn_args is not None:
-            try:
-                args.extend(self.dyn_args.as_const(eval_ctx))
-            except Exception:
-                raise Impossible()
-        if self.dyn_kwargs is not None:
-            try:
-                kwargs.update(self.dyn_kwargs.as_const(eval_ctx))
-            except Exception:
-                raise Impossible()
+
         try:
-            return filter_(obj, *args, **kwargs)
+            return filter_(*args, **kwargs)
         except Exception:
             raise Impossible()
 
@@ -590,8 +670,24 @@ class Test(Expr):
     """Applies a test on an expression.  `name` is the name of the test, the
     rest of the fields are the same as for :class:`Call`.
     """
+
     fields = ('node', 'name', 'args', 'kwargs', 'dyn_args', 'dyn_kwargs')
 
+    def as_const(self, eval_ctx=None):
+        test = self.environment.tests.get(self.name)
+
+        if test is None:
+            raise Impossible()
+
+        eval_ctx = get_eval_context(self, eval_ctx)
+        args, kwargs = args_as_const(self, eval_ctx)
+        args.insert(0, self.node.as_const(eval_ctx))
+
+        try:
+            return test(*args, **kwargs)
+        except Exception:
+            raise Impossible()
+
 
 class Call(Expr):
     """Calls an expression.  `args` is a list of arguments, `kwargs` a list
@@ -602,38 +698,6 @@ class Call(Expr):
     """
     fields = ('node', 'args', 'kwargs', 'dyn_args', 'dyn_kwargs')
 
-    def as_const(self, eval_ctx=None):
-        eval_ctx = get_eval_context(self, eval_ctx)
-        if eval_ctx.volatile:
-            raise Impossible()
-        obj = self.node.as_const(eval_ctx)
-
-        # don't evaluate context functions
-        args = [x.as_const(eval_ctx) for x in self.args]
-        if isinstance(obj, _context_function_types):
-            if getattr(obj, 'contextfunction', False):
-                raise Impossible()
-            elif getattr(obj, 'evalcontextfunction', False):
-                args.insert(0, eval_ctx)
-            elif getattr(obj, 'environmentfunction', False):
-                args.insert(0, self.environment)
-
-        kwargs = dict(x.as_const(eval_ctx) for x in self.kwargs)
-        if self.dyn_args is not None:
-            try:
-                args.extend(self.dyn_args.as_const(eval_ctx))
-            except Exception:
-                raise Impossible()
-        if self.dyn_kwargs is not None:
-            try:
-                kwargs.update(self.dyn_kwargs.as_const(eval_ctx))
-            except Exception:
-                raise Impossible()
-        try:
-            return obj(*args, **kwargs)
-        except Exception:
-            raise Impossible()
-
 
 class Getitem(Expr):
     """Get an attribute or item from an expression and prefer the item."""
@@ -701,7 +765,7 @@ def as_const(self, eval_ctx=None):
 
 class Compare(Expr):
     """Compares an expression with some other expressions.  `ops` must be a
-    list of :class:`Operand`\s.
+    list of :class:`Operand`\\s.
     """
     fields = ('expr', 'ops')
 
@@ -894,6 +958,22 @@ class Scope(Stmt):
     fields = ('body',)
 
 
+class OverlayScope(Stmt):
+    """An overlay scope for extensions.  This is a largely unoptimized scope
+    that however can be used to introduce completely arbitrary variables into
+    a sub scope from a dictionary or dictionary like object.  The `context`
+    field has to evaluate to a dictionary object.
+
+    Example usage::
+
+        OverlayScope(context=self.call_method('get_context'),
+                     body=[...])
+
+    .. versionadded:: 2.10
+    """
+    fields = ('context', 'body')
+
+
 class EvalContextModifier(Stmt):
     """Modifies the eval context.  For each option that should be modified,
     a :class:`Keyword` has to be added to the :attr:`options` list.
diff --git a/deps/v8/third_party/jinja2/optimizer.py b/deps/v8/third_party/jinja2/optimizer.py
index 00eab115e1c..65ab3ceb71f 100644
--- a/deps/v8/third_party/jinja2/optimizer.py
+++ b/deps/v8/third_party/jinja2/optimizer.py
@@ -13,7 +13,7 @@
 
     The solution would be a second syntax tree that has the scoping rules stored.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD.
 """
 from jinja2 import nodes
@@ -32,30 +32,11 @@ class Optimizer(NodeTransformer):
     def __init__(self, environment):
         self.environment = environment
 
-    def visit_If(self, node):
-        """Eliminate dead code."""
-        # do not optimize ifs that have a block inside so that it doesn't
-        # break super().
-        if node.find(nodes.Block) is not None:
-            return self.generic_visit(node)
-        try:
-            val = self.visit(node.test).as_const()
-        except nodes.Impossible:
-            return self.generic_visit(node)
-        if val:
-            body = node.body
-        else:
-            body = node.else_
-        result = []
-        for node in body:
-            result.extend(self.visit_list(node))
-        return result
-
-    def fold(self, node):
+    def fold(self, node, eval_ctx=None):
         """Do constant folding."""
         node = self.generic_visit(node)
         try:
-            return nodes.Const.from_untrusted(node.as_const(),
+            return nodes.Const.from_untrusted(node.as_const(eval_ctx),
                                               lineno=node.lineno,
                                               environment=self.environment)
         except nodes.Impossible:
diff --git a/deps/v8/third_party/jinja2/parser.py b/deps/v8/third_party/jinja2/parser.py
index d24da180ea6..ed00d9708e9 100644
--- a/deps/v8/third_party/jinja2/parser.py
+++ b/deps/v8/third_party/jinja2/parser.py
@@ -5,7 +5,7 @@
 
     Implements the template parser.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD, see LICENSE for more details.
 """
 from jinja2 import nodes
@@ -16,9 +16,18 @@
 
 _statement_keywords = frozenset(['for', 'if', 'block', 'extends', 'print',
                                  'macro', 'include', 'from', 'import',
-                                 'set'])
+                                 'set', 'with', 'autoescape'])
 _compare_operators = frozenset(['eq', 'ne', 'lt', 'lteq', 'gt', 'gteq'])
 
+_math_nodes = {
+    'add': nodes.Add,
+    'sub': nodes.Sub,
+    'mul': nodes.Mul,
+    'div': nodes.Div,
+    'floordiv': nodes.FloorDiv,
+    'mod': nodes.Mod,
+}
+
 
 class Parser(object):
     """This is the central parsing class Jinja2 uses.  It's passed to
@@ -167,13 +176,14 @@ def parse_statements(self, end_tokens, drop_needle=False):
     def parse_set(self):
         """Parse an assign statement."""
         lineno = next(self.stream).lineno
-        target = self.parse_assign_target()
+        target = self.parse_assign_target(with_namespace=True)
         if self.stream.skip_if('assign'):
             expr = self.parse_tuple()
             return nodes.Assign(target, expr, lineno=lineno)
+        filter_node = self.parse_filter(None)
         body = self.parse_statements(('name:endset',),
                                      drop_needle=True)
-        return nodes.AssignBlock(target, body, lineno=lineno)
+        return nodes.AssignBlock(target, filter_node, body, lineno=lineno)
 
     def parse_for(self):
         """Parse a for loop."""
@@ -201,20 +211,47 @@ def parse_if(self):
             node.test = self.parse_tuple(with_condexpr=False)
             node.body = self.parse_statements(('name:elif', 'name:else',
                                                'name:endif'))
+            node.elif_ = []
+            node.else_ = []
             token = next(self.stream)
             if token.test('name:elif'):
-                new_node = nodes.If(lineno=self.stream.current.lineno)
-                node.else_ = [new_node]
-                node = new_node
+                node = nodes.If(lineno=self.stream.current.lineno)
+                result.elif_.append(node)
                 continue
             elif token.test('name:else'):
-                node.else_ = self.parse_statements(('name:endif',),
-                                                   drop_needle=True)
-            else:
-                node.else_ = []
+                result.else_ = self.parse_statements(('name:endif',),
+                                                     drop_needle=True)
             break
         return result
 
+    def parse_with(self):
+        node = nodes.With(lineno=next(self.stream).lineno)
+        targets = []
+        values = []
+        while self.stream.current.type != 'block_end':
+            lineno = self.stream.current.lineno
+            if targets:
+                self.stream.expect('comma')
+            target = self.parse_assign_target()
+            target.set_ctx('param')
+            targets.append(target)
+            self.stream.expect('assign')
+            values.append(self.parse_expression())
+        node.targets = targets
+        node.values = values
+        node.body = self.parse_statements(('name:endwith',),
+                                          drop_needle=True)
+        return node
+
+    def parse_autoescape(self):
+        node = nodes.ScopedEvalContextModifier(lineno=next(self.stream).lineno)
+        node.options = [
+            nodes.Keyword('autoescape', self.parse_expression())
+        ]
+        node.body = self.parse_statements(('name:endautoescape',),
+                                            drop_needle=True)
+        return nodes.Scope([node])
+
     def parse_block(self):
         node = nodes.Block(lineno=next(self.stream).lineno)
         node.name = self.stream.expect('name').value
@@ -297,10 +334,9 @@ def parse_context():
                 if parse_context() or self.stream.current.type != 'comma':
                     break
             else:
-                break
+                self.stream.expect('name')
         if not hasattr(node, 'with_context'):
             node.with_context = False
-            self.stream.skip_if('comma')
         return node
 
     def parse_signature(self, node):
@@ -358,15 +394,21 @@ def parse_print(self):
         return node
 
     def parse_assign_target(self, with_tuple=True, name_only=False,
-                            extra_end_rules=None):
+                            extra_end_rules=None, with_namespace=False):
         """Parse an assignment target.  As Jinja2 allows assignments to
         tuples, this function can parse all allowed assignment targets.  Per
         default assignments to tuples are parsed, that can be disable however
         by setting `with_tuple` to `False`.  If only assignments to names are
         wanted `name_only` can be set to `True`.  The `extra_end_rules`
-        parameter is forwarded to the tuple parsing function.
+        parameter is forwarded to the tuple parsing function.  If
+        `with_namespace` is enabled, a namespace assignment may be parsed.
         """
-        if name_only:
+        if with_namespace and self.stream.look().type == 'dot':
+            token = self.stream.expect('name')
+            next(self.stream)  # dot
+            attr = self.stream.expect('name')
+            target = nodes.NSRef(token.value, attr.value, lineno=token.lineno)
+        elif name_only:
             token = self.stream.expect('name')
             target = nodes.Name(token.value, 'store', lineno=token.lineno)
         else:
@@ -429,19 +471,19 @@ def parse_not(self):
 
     def parse_compare(self):
         lineno = self.stream.current.lineno
-        expr = self.parse_add()
+        expr = self.parse_math1()
         ops = []
         while 1:
             token_type = self.stream.current.type
             if token_type in _compare_operators:
                 next(self.stream)
-                ops.append(nodes.Operand(token_type, self.parse_add()))
+                ops.append(nodes.Operand(token_type, self.parse_math1()))
             elif self.stream.skip_if('name:in'):
-                ops.append(nodes.Operand('in', self.parse_add()))
+                ops.append(nodes.Operand('in', self.parse_math1()))
             elif (self.stream.current.test('name:not') and
                   self.stream.look().test('name:in')):
                 self.stream.skip(2)
-                ops.append(nodes.Operand('notin', self.parse_add()))
+                ops.append(nodes.Operand('notin', self.parse_math1()))
             else:
                 break
             lineno = self.stream.current.lineno
@@ -449,73 +491,35 @@ def parse_compare(self):
             return expr
         return nodes.Compare(expr, ops, lineno=lineno)
 
-    def parse_add(self):
-        lineno = self.stream.current.lineno
-        left = self.parse_sub()
-        while self.stream.current.type == 'add':
-            next(self.stream)
-            right = self.parse_sub()
-            left = nodes.Add(left, right, lineno=lineno)
-            lineno = self.stream.current.lineno
-        return left
-
-    def parse_sub(self):
+    def parse_math1(self):
         lineno = self.stream.current.lineno
         left = self.parse_concat()
-        while self.stream.current.type == 'sub':
+        while self.stream.current.type in ('add', 'sub'):
+            cls = _math_nodes[self.stream.current.type]
             next(self.stream)
             right = self.parse_concat()
-            left = nodes.Sub(left, right, lineno=lineno)
+            left = cls(left, right, lineno=lineno)
             lineno = self.stream.current.lineno
         return left
 
     def parse_concat(self):
         lineno = self.stream.current.lineno
-        args = [self.parse_mul()]
+        args = [self.parse_math2()]
         while self.stream.current.type == 'tilde':
             next(self.stream)
-            args.append(self.parse_mul())
+            args.append(self.parse_math2())
         if len(args) == 1:
             return args[0]
         return nodes.Concat(args, lineno=lineno)
 
-    def parse_mul(self):
-        lineno = self.stream.current.lineno
-        left = self.parse_div()
-        while self.stream.current.type == 'mul':
-            next(self.stream)
-            right = self.parse_div()
-            left = nodes.Mul(left, right, lineno=lineno)
-            lineno = self.stream.current.lineno
-        return left
-
-    def parse_div(self):
-        lineno = self.stream.current.lineno
-        left = self.parse_floordiv()
-        while self.stream.current.type == 'div':
-            next(self.stream)
-            right = self.parse_floordiv()
-            left = nodes.Div(left, right, lineno=lineno)
-            lineno = self.stream.current.lineno
-        return left
-
-    def parse_floordiv(self):
-        lineno = self.stream.current.lineno
-        left = self.parse_mod()
-        while self.stream.current.type == 'floordiv':
-            next(self.stream)
-            right = self.parse_mod()
-            left = nodes.FloorDiv(left, right, lineno=lineno)
-            lineno = self.stream.current.lineno
-        return left
-
-    def parse_mod(self):
+    def parse_math2(self):
         lineno = self.stream.current.lineno
         left = self.parse_pow()
-        while self.stream.current.type == 'mod':
+        while self.stream.current.type in ('mul', 'div', 'floordiv', 'mod'):
+            cls = _math_nodes[self.stream.current.type]
             next(self.stream)
             right = self.parse_pow()
-            left = nodes.Mod(left, right, lineno=lineno)
+            left = cls(left, right, lineno=lineno)
             lineno = self.stream.current.lineno
         return left
 
@@ -835,7 +839,7 @@ def parse_test(self, node):
                                            'name:and')):
             if self.stream.current.test('name:is'):
                 self.fail('You cannot chain multiple tests with is')
-            args = [self.parse_expression()]
+            args = [self.parse_primary()]
         else:
             args = []
         node = nodes.Test(node, name, args, kwargs, dyn_args,
diff --git a/deps/v8/third_party/jinja2/runtime.py b/deps/v8/third_party/jinja2/runtime.py
index 685a12da068..f9d7a6806ca 100644
--- a/deps/v8/third_party/jinja2/runtime.py
+++ b/deps/v8/third_party/jinja2/runtime.py
@@ -5,26 +5,29 @@
 
     Runtime helpers.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD.
 """
 import sys
 
 from itertools import chain
+from types import MethodType
+
 from jinja2.nodes import EvalContext, _context_function_types
 from jinja2.utils import Markup, soft_unicode, escape, missing, concat, \
-     internalcode, object_type_repr
+     internalcode, object_type_repr, evalcontextfunction, Namespace
 from jinja2.exceptions import UndefinedError, TemplateRuntimeError, \
      TemplateNotFound
 from jinja2._compat import imap, text_type, iteritems, \
-     implements_iterator, implements_to_string, string_types, PY2
+     implements_iterator, implements_to_string, string_types, PY2, \
+     with_metaclass
 
 
 # these variables are exported to the template runtime
 __all__ = ['LoopContext', 'TemplateReference', 'Macro', 'Markup',
            'TemplateRuntimeError', 'missing', 'concat', 'escape',
            'markup_join', 'unicode_join', 'to_string', 'identity',
-           'TemplateNotFound', 'make_logging_undefined']
+           'TemplateNotFound', 'Namespace']
 
 #: the name of the function that is used to convert something into
 #: a string.  We can just use the text type here.
@@ -33,6 +36,7 @@
 #: the identity function.  Useful for certain things in the environment
 identity = lambda x: x
 
+_first_iteration = object()
 _last_iteration = object()
 
 
@@ -67,8 +71,8 @@ def new_context(environment, template_name, blocks, vars=None,
         if shared:
             parent = dict(parent)
         for key, value in iteritems(locals):
-            if key[:2] == 'l_' and value is not missing:
-                parent[key[2:]] = value
+            if value is not missing:
+                parent[key] = value
     return environment.context_class(environment, parent, template_name,
                                      blocks)
 
@@ -90,7 +94,43 @@ def __repr__(self):
         )
 
 
-class Context(object):
+def _get_func(x):
+    return getattr(x, '__func__', x)
+
+
+class ContextMeta(type):
+
+    def __new__(cls, name, bases, d):
+        rv = type.__new__(cls, name, bases, d)
+        if bases == ():
+            return rv
+
+        resolve = _get_func(rv.resolve)
+        default_resolve = _get_func(Context.resolve)
+        resolve_or_missing = _get_func(rv.resolve_or_missing)
+        default_resolve_or_missing = _get_func(Context.resolve_or_missing)
+
+        # If we have a changed resolve but no changed default or missing
+        # resolve we invert the call logic.
+        if resolve is not default_resolve and \
+           resolve_or_missing is default_resolve_or_missing:
+            rv._legacy_resolve_mode = True
+        elif resolve is default_resolve and \
+             resolve_or_missing is default_resolve_or_missing:
+            rv._fast_resolve_mode = True
+
+        return rv
+
+
+def resolve_or_missing(context, key, missing=missing):
+    if key in context.vars:
+        return context.vars[key]
+    if key in context.parent:
+        return context.parent[key]
+    return missing
+
+
+class Context(with_metaclass(ContextMeta)):
     """The template context holds the variables of a template.  It stores the
     values passed to the template and also the names the template exports.
     Creating instances is neither supported nor useful as it's created
@@ -100,7 +140,7 @@ class Context(object):
     The context is immutable.  Modifications on :attr:`parent` **must not**
     happen and modifications on :attr:`vars` are allowed from generated
     template code only.  Template filters and global functions marked as
-    :func:`contextfunction`\s get the active context passed as first argument
+    :func:`contextfunction`\\s get the active context passed as first argument
     and are allowed to access the context read-only.
 
     The template context supports read only dict operations (`get`,
@@ -109,8 +149,10 @@ class Context(object):
     method that doesn't fail with a `KeyError` but returns an
     :class:`Undefined` object for missing variables.
     """
-    __slots__ = ('parent', 'vars', 'environment', 'eval_ctx', 'exported_vars',
-                 'name', 'blocks', '__weakref__')
+    # XXX: we want to eventually make this be a deprecation warning and
+    # remove it.
+    _legacy_resolve_mode = False
+    _fast_resolve_mode = False
 
     def __init__(self, environment, parent, name, blocks):
         self.parent = parent
@@ -125,6 +167,11 @@ def __init__(self, environment, parent, name, blocks):
         # from the template.
         self.blocks = dict((k, [v]) for k, v in iteritems(blocks))
 
+        # In case we detect the fast resolve mode we can set up an alias
+        # here that bypasses the legacy code logic.
+        if self._fast_resolve_mode:
+            self.resolve_or_missing = MethodType(resolve_or_missing, self)
+
     def super(self, name, current):
         """Render a parent block."""
         try:
@@ -150,20 +197,38 @@ def resolve(self, key):
         """Looks up a variable like `__getitem__` or `get` but returns an
         :class:`Undefined` object with the name of the name looked up.
         """
-        if key in self.vars:
-            return self.vars[key]
-        if key in self.parent:
-            return self.parent[key]
-        return self.environment.undefined(name=key)
+        if self._legacy_resolve_mode:
+            rv = resolve_or_missing(self, key)
+        else:
+            rv = self.resolve_or_missing(key)
+        if rv is missing:
+            return self.environment.undefined(name=key)
+        return rv
+
+    def resolve_or_missing(self, key):
+        """Resolves a variable like :meth:`resolve` but returns the
+        special `missing` value if it cannot be found.
+        """
+        if self._legacy_resolve_mode:
+            rv = self.resolve(key)
+            if isinstance(rv, Undefined):
+                rv = missing
+            return rv
+        return resolve_or_missing(self, key)
 
     def get_exported(self):
         """Get a new dict with the exported variables."""
         return dict((k, self.vars[k]) for k in self.exported_vars)
 
     def get_all(self):
-        """Return a copy of the complete context as dict including the
-        exported variables.
+        """Return the complete context as dict including the exported
+        variables.  For optimizations reasons this might not return an
+        actual copy so be careful with using it.
         """
+        if not self.vars:
+            return self.parent
+        if not self.parent:
+            return self.vars
         return dict(self.parent, **self.vars)
 
     @internalcode
@@ -177,13 +242,14 @@ def call(__self, __obj, *args, **kwargs):
             __traceback_hide__ = True  # noqa
 
         # Allow callable classes to take a context
-        fn = __obj.__call__
-        for fn_type in ('contextfunction',
-                        'evalcontextfunction',
-                        'environmentfunction'):
-            if hasattr(fn, fn_type):
-                __obj = fn
-                break
+        if hasattr(__obj, '__call__'):
+            fn = __obj.__call__
+            for fn_type in ('contextfunction',
+                            'evalcontextfunction',
+                            'environmentfunction'):
+                if hasattr(fn, fn_type):
+                    __obj = fn
+                    break
 
         if isinstance(__obj, _context_function_types):
             if getattr(__obj, 'contextfunction', 0):
@@ -200,10 +266,12 @@ def call(__self, __obj, *args, **kwargs):
                                                 'StopIteration exception')
 
     def derived(self, locals=None):
-        """Internal helper function to create a derived context."""
+        """Internal helper function to create a derived context.  This is
+        used in situations where the system needs a new context in the same
+        template that is independent.
+        """
         context = new_context(self.environment, self.name, {},
-                              self.parent, True, None, locals)
-        context.vars.update(self.vars)
+                              self.get_all(), True, None, locals)
         context.eval_ctx = self.eval_ctx
         context.blocks.update((k, list(v)) for k, v in iteritems(self.blocks))
         return context
@@ -232,8 +300,8 @@ def __getitem__(self, key):
         """Lookup a variable or raise `KeyError` if the variable is
         undefined.
         """
-        item = self.resolve(key)
-        if isinstance(item, Undefined):
+        item = self.resolve_or_missing(key)
+        if item is missing:
             raise KeyError(key)
         return item
 
@@ -280,24 +348,20 @@ def __call__(self):
         return rv
 
 
-class LoopContext(object):
+class LoopContextBase(object):
     """A loop context for dynamic iteration."""
 
-    def __init__(self, iterable, recurse=None, depth0=0):
-        self._iterator = iter(iterable)
+    _before = _first_iteration
+    _current = _first_iteration
+    _after = _last_iteration
+    _length = None
+
+    def __init__(self, undefined, recurse=None, depth0=0):
+        self._undefined = undefined
         self._recurse = recurse
-        self._after = self._safe_next()
         self.index0 = -1
         self.depth0 = depth0
-
-        # try to get the length of the iterable early.  This must be done
-        # here because there are some broken iterators around where there
-        # __len__ is the number of iterations left (i'm looking at your
-        # listreverseiterator!).
-        try:
-            self._length = len(iterable)
-        except (TypeError, AttributeError):
-            self._length = None
+        self._last_checked_value = missing
 
     def cycle(self, *args):
         """Cycles among the arguments with the current loop index."""
@@ -305,6 +369,13 @@ def cycle(self, *args):
             raise TypeError('no items for cycling given')
         return args[self.index0 % len(args)]
 
+    def changed(self, *value):
+        """Checks whether the value has changed since the last call."""
+        if self._last_checked_value != value:
+            self._last_checked_value = value
+            return True
+        return False
+
     first = property(lambda x: x.index0 == 0)
     last = property(lambda x: x._after is _last_iteration)
     index = property(lambda x: x.index0 + 1)
@@ -312,17 +383,20 @@ def cycle(self, *args):
     revindex0 = property(lambda x: x.length - x.index)
     depth = property(lambda x: x.depth0 + 1)
 
-    def __len__(self):
-        return self.length
+    @property
+    def previtem(self):
+        if self._before is _first_iteration:
+            return self._undefined('there is no previous item')
+        return self._before
 
-    def __iter__(self):
-        return LoopContextIterator(self)
+    @property
+    def nextitem(self):
+        if self._after is _last_iteration:
+            return self._undefined('there is no next item')
+        return self._after
 
-    def _safe_next(self):
-        try:
-            return next(self._iterator)
-        except StopIteration:
-            return _last_iteration
+    def __len__(self):
+        return self.length
 
     @internalcode
     def loop(self, iterable):
@@ -336,6 +410,30 @@ def loop(self, iterable):
     __call__ = loop
     del loop
 
+    def __repr__(self):
+        return '<%s %r/%r>' % (
+            self.__class__.__name__,
+            self.index,
+            self.length
+        )
+
+
+class LoopContext(LoopContextBase):
+
+    def __init__(self, iterable, undefined, recurse=None, depth0=0):
+        LoopContextBase.__init__(self, undefined, recurse, depth0)
+        self._iterator = iter(iterable)
+
+        # try to get the length of the iterable early.  This must be done
+        # here because there are some broken iterators around where there
+        # __len__ is the number of iterations left (i'm looking at your
+        # listreverseiterator!).
+        try:
+            self._length = len(iterable)
+        except (TypeError, AttributeError):
+            self._length = None
+        self._after = self._safe_next()
+
     @property
     def length(self):
         if self._length is None:
@@ -349,12 +447,14 @@ def length(self):
             self._length = len(iterable) + iterations_done
         return self._length
 
-    def __repr__(self):
-        return '<%s %r/%r>' % (
-            self.__class__.__name__,
-            self.index,
-            self.length
-        )
+    def __iter__(self):
+        return LoopContextIterator(self)
+
+    def _safe_next(self):
+        try:
+            return next(self._iterator)
+        except StopIteration:
+            return _last_iteration
 
 
 @implements_iterator
@@ -373,32 +473,65 @@ def __next__(self):
         ctx.index0 += 1
         if ctx._after is _last_iteration:
             raise StopIteration()
-        next_elem = ctx._after
+        ctx._before = ctx._current
+        ctx._current = ctx._after
         ctx._after = ctx._safe_next()
-        return next_elem, ctx
+        return ctx._current, ctx
 
 
 class Macro(object):
     """Wraps a macro function."""
 
-    def __init__(self, environment, func, name, arguments, defaults,
-                 catch_kwargs, catch_varargs, caller):
+    def __init__(self, environment, func, name, arguments,
+                 catch_kwargs, catch_varargs, caller,
+                 default_autoescape=None):
         self._environment = environment
         self._func = func
         self._argument_count = len(arguments)
         self.name = name
         self.arguments = arguments
-        self.defaults = defaults
         self.catch_kwargs = catch_kwargs
         self.catch_varargs = catch_varargs
         self.caller = caller
+        self.explicit_caller = 'caller' in arguments
+        if default_autoescape is None:
+            default_autoescape = environment.autoescape
+        self._default_autoescape = default_autoescape
 
     @internalcode
+    @evalcontextfunction
     def __call__(self, *args, **kwargs):
+        # This requires a bit of explanation,  In the past we used to
+        # decide largely based on compile-time information if a macro is
+        # safe or unsafe.  While there was a volatile mode it was largely
+        # unused for deciding on escaping.  This turns out to be
+        # problemtic for macros because if a macro is safe or not not so
+        # much depends on the escape mode when it was defined but when it
+        # was used.
+        #
+        # Because however we export macros from the module system and
+        # there are historic callers that do not pass an eval context (and
+        # will continue to not pass one), we need to perform an instance
+        # check here.
+        #
+        # This is considered safe because an eval context is not a valid
+        # argument to callables otherwise anwyays.  Worst case here is
+        # that if no eval context is passed we fall back to the compile
+        # time autoescape flag.
+        if args and isinstance(args[0], EvalContext):
+            autoescape = args[0].autoescape
+            args = args[1:]
+        else:
+            autoescape = self._default_autoescape
+
         # try to consume the positional arguments
         arguments = list(args[:self._argument_count])
         off = len(arguments)
 
+        # For information why this is necessary refer to the handling
+        # of caller in the `macro_body` handler in the compiler.
+        found_caller = False
+
         # if the number of arguments consumed is not the number of
         # arguments expected we start filling in keyword arguments
         # and defaults.
@@ -407,25 +540,30 @@ def __call__(self, *args, **kwargs):
                 try:
                     value = kwargs.pop(name)
                 except KeyError:
-                    try:
-                        value = self.defaults[idx - self._argument_count + off]
-                    except IndexError:
-                        value = self._environment.undefined(
-                            'parameter %r was not provided' % name, name=name)
+                    value = missing
+                if name == 'caller':
+                    found_caller = True
                 arguments.append(value)
+        else:
+            found_caller = self.explicit_caller
 
         # it's important that the order of these arguments does not change
         # if not also changed in the compiler's `function_scoping` method.
         # the order is caller, keyword arguments, positional arguments!
-        if self.caller:
+        if self.caller and not found_caller:
             caller = kwargs.pop('caller', None)
             if caller is None:
                 caller = self._environment.undefined('No caller defined',
                                                      name='caller')
             arguments.append(caller)
+
         if self.catch_kwargs:
             arguments.append(kwargs)
         elif kwargs:
+            if 'caller' in kwargs:
+                raise TypeError('macro %r was invoked with two values for '
+                                'the special caller argument.  This is '
+                                'most likely a bug.' % self.name)
             raise TypeError('macro %r takes no keyword argument %r' %
                             (self.name, next(iter(kwargs))))
         if self.catch_varargs:
@@ -433,7 +571,15 @@ def __call__(self, *args, **kwargs):
         elif len(args) > self._argument_count:
             raise TypeError('macro %r takes not more than %d argument(s)' %
                             (self.name, len(self.arguments)))
-        return self._func(*arguments)
+
+        return self._invoke(arguments, autoescape)
+
+    def _invoke(self, arguments, autoescape):
+        """This method is being swapped out by the async implementation."""
+        rv = self._func(*arguments)
+        if autoescape:
+            rv = Markup(rv)
+        return rv
 
     def __repr__(self):
         return '<%s %s>' % (
@@ -498,8 +644,8 @@ def __getattr__(self, name):
         __truediv__ = __rtruediv__ = __floordiv__ = __rfloordiv__ = \
         __mod__ = __rmod__ = __pos__ = __neg__ = __call__ = \
         __getitem__ = __lt__ = __le__ = __gt__ = __ge__ = __int__ = \
-        __float__ = __complex__ = __pow__ = __rpow__ = \
-        _fail_with_undefined_error
+        __float__ = __complex__ = __pow__ = __rpow__ = __sub__ = \
+        __rsub__ = _fail_with_undefined_error
 
     def __eq__(self, other):
         return type(self) is type(other)
diff --git a/deps/v8/third_party/jinja2/sandbox.py b/deps/v8/third_party/jinja2/sandbox.py
index 7e40ab30850..93fb9d45f32 100644
--- a/deps/v8/third_party/jinja2/sandbox.py
+++ b/deps/v8/third_party/jinja2/sandbox.py
@@ -9,14 +9,19 @@
 
     The behavior can be changed by subclassing the environment.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD.
 """
 import types
 import operator
+from collections import Mapping
 from jinja2.environment import Environment
 from jinja2.exceptions import SecurityError
 from jinja2._compat import string_types, PY2
+from jinja2.utils import Markup
+
+from markupsafe import EscapeFormatter
+from string import Formatter
 
 
 #: maximum number of items a range may produce
@@ -38,6 +43,12 @@
 #: unsafe generator attirbutes.
 UNSAFE_GENERATOR_ATTRIBUTES = set(['gi_frame', 'gi_code'])
 
+#: unsafe attributes on coroutines
+UNSAFE_COROUTINE_ATTRIBUTES = set(['cr_frame', 'cr_code'])
+
+#: unsafe attributes on async generators
+UNSAFE_ASYNC_GENERATOR_ATTRIBUTES = set(['ag_code', 'ag_frame'])
+
 import warnings
 
 # make sure we don't warn in python 2.6 about stuff we don't care about
@@ -68,13 +79,11 @@
     pass
 
 #: register Python 2.6 abstract base classes
-try:
-    from collections import MutableSet, MutableMapping, MutableSequence
-    _mutable_set_types += (MutableSet,)
-    _mutable_mapping_types += (MutableMapping,)
-    _mutable_sequence_types += (MutableSequence,)
-except ImportError:
-    pass
+from collections import MutableSet, MutableMapping, MutableSequence
+_mutable_set_types += (MutableSet,)
+_mutable_mapping_types += (MutableMapping,)
+_mutable_sequence_types += (MutableSequence,)
+
 
 _mutable_spec = (
     (_mutable_set_types, frozenset([
@@ -94,6 +103,47 @@
 )
 
 
+class _MagicFormatMapping(Mapping):
+    """This class implements a dummy wrapper to fix a bug in the Python
+    standard library for string formatting.
+
+    See https://bugs.python.org/issue13598 for information about why
+    this is necessary.
+    """
+
+    def __init__(self, args, kwargs):
+        self._args = args
+        self._kwargs = kwargs
+        self._last_index = 0
+
+    def __getitem__(self, key):
+        if key == '':
+            idx = self._last_index
+            self._last_index += 1
+            try:
+                return self._args[idx]
+            except LookupError:
+                pass
+            key = str(idx)
+        return self._kwargs[key]
+
+    def __iter__(self):
+        return iter(self._kwargs)
+
+    def __len__(self):
+        return len(self._kwargs)
+
+
+def inspect_format_method(callable):
+    if not isinstance(callable, (types.MethodType,
+                                 types.BuiltinMethodType)) or \
+       callable.__name__ != 'format':
+        return None
+    obj = callable.__self__
+    if isinstance(obj, string_types):
+        return obj
+
+
 def safe_range(*args):
     """A range that can't generate ranges with a length of more than
     MAX_RANGE items.
@@ -145,6 +195,12 @@ def is_internal_attribute(obj, attr):
     elif isinstance(obj, types.GeneratorType):
         if attr in UNSAFE_GENERATOR_ATTRIBUTES:
             return True
+    elif hasattr(types, 'CoroutineType') and isinstance(obj, types.CoroutineType):
+        if attr in UNSAFE_COROUTINE_ATTRIBUTES:
+            return True
+    elif hasattr(types, 'AsyncGeneratorType') and isinstance(obj, types.AsyncGeneratorType):
+        if attr in UNSAFE_ASYNC_GENERATOR_ATTRIBUTES:
+            return True
     return attr.startswith('__')
 
 
@@ -183,8 +239,8 @@ class SandboxedEnvironment(Environment):
     attributes or functions are safe to access.
 
     If the template tries to access insecure code a :exc:`SecurityError` is
-    raised.  However also other exceptions may occour during the rendering so
-    the caller has to ensure that all exceptions are catched.
+    raised.  However also other exceptions may occur during the rendering so
+    the caller has to ensure that all exceptions are caught.
     """
     sandboxed = True
 
@@ -346,8 +402,24 @@ def unsafe_undefined(self, obj, attribute):
             obj.__class__.__name__
         ), name=attribute, obj=obj, exc=SecurityError)
 
+    def format_string(self, s, args, kwargs):
+        """If a format call is detected, then this is routed through this
+        method so that our safety sandbox can be used for it.
+        """
+        if isinstance(s, Markup):
+            formatter = SandboxedEscapeFormatter(self, s.escape)
+        else:
+            formatter = SandboxedFormatter(self)
+        kwargs = _MagicFormatMapping(args, kwargs)
+        rv = formatter.vformat(s, args, kwargs)
+        return type(s)(rv)
+
     def call(__self, __context, __obj, *args, **kwargs):
         """Call an object from sandboxed code."""
+        fmt = inspect_format_method(__obj)
+        if fmt is not None:
+            return __self.format_string(fmt, args, kwargs)
+
         # the double prefixes are to avoid double keyword argument
         # errors when proxying the call.
         if not __self.is_safe_callable(__obj):
@@ -365,3 +437,39 @@ def is_safe_attribute(self, obj, attr, value):
         if not SandboxedEnvironment.is_safe_attribute(self, obj, attr, value):
             return False
         return not modifies_known_mutable(obj, attr)
+
+
+# This really is not a public API apparenlty.
+try:
+    from _string import formatter_field_name_split
+except ImportError:
+    def formatter_field_name_split(field_name):
+        return field_name._formatter_field_name_split()
+
+
+class SandboxedFormatterMixin(object):
+
+    def __init__(self, env):
+        self._env = env
+
+    def get_field(self, field_name, args, kwargs):
+        first, rest = formatter_field_name_split(field_name)
+        obj = self.get_value(first, args, kwargs)
+        for is_attr, i in rest:
+            if is_attr:
+                obj = self._env.getattr(obj, i)
+            else:
+                obj = self._env.getitem(obj, i)
+        return obj, first
+
+class SandboxedFormatter(SandboxedFormatterMixin, Formatter):
+
+    def __init__(self, env):
+        SandboxedFormatterMixin.__init__(self, env)
+        Formatter.__init__(self)
+
+class SandboxedEscapeFormatter(SandboxedFormatterMixin, EscapeFormatter):
+
+    def __init__(self, env, escape):
+        SandboxedFormatterMixin.__init__(self, env)
+        EscapeFormatter.__init__(self, escape)
diff --git a/deps/v8/third_party/jinja2/tests.py b/deps/v8/third_party/jinja2/tests.py
index bb32349df0b..0adc3d4dbcb 100644
--- a/deps/v8/third_party/jinja2/tests.py
+++ b/deps/v8/third_party/jinja2/tests.py
@@ -5,9 +5,10 @@
 
     Jinja test functions. Used with the "is" operator.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD, see LICENSE for more details.
 """
+import operator
 import re
 from collections import Mapping
 from jinja2.runtime import Undefined
@@ -103,28 +104,6 @@ def test_sequence(value):
     return True
 
 
-def test_equalto(value, other):
-    """Check if an object has the same value as another object:
-
-    .. sourcecode:: jinja
-
-        {% if foo.expression is equalto 42 %}
-            the foo attribute evaluates to the constant 42
-        {% endif %}
-
-    This appears to be a useless test as it does exactly the same as the
-    ``==`` operator, but it can be useful when used together with the
-    `selectattr` function:
-
-    .. sourcecode:: jinja
-
-        {{ users|selectattr("email", "equalto", "foo@bar.invalid") }}
-
-    .. versionadded:: 2.8
-    """
-    return value == other
-
-
 def test_sameas(value, other):
     """Check if an object points to the same memory address than another
     object:
@@ -152,6 +131,14 @@ def test_escaped(value):
     return hasattr(value, '__html__')
 
 
+def test_in(value, seq):
+    """Check if value is in seq.
+
+    .. versionadded:: 2.10
+    """
+    return value in seq
+
+
 TESTS = {
     'odd':              test_odd,
     'even':             test_even,
@@ -168,6 +155,21 @@ def test_escaped(value):
     'iterable':         test_iterable,
     'callable':         test_callable,
     'sameas':           test_sameas,
-    'equalto':          test_equalto,
-    'escaped':          test_escaped
+    'escaped':          test_escaped,
+    'in':               test_in,
+    '==':               operator.eq,
+    'eq':               operator.eq,
+    'equalto':          operator.eq,
+    '!=':               operator.ne,
+    'ne':               operator.ne,
+    '>':                operator.gt,
+    'gt':               operator.gt,
+    'greaterthan':      operator.gt,
+    'ge':               operator.ge,
+    '>=':               operator.ge,
+    '<':                operator.lt,
+    'lt':               operator.lt,
+    'lessthan':         operator.lt,
+    '<=':               operator.le,
+    'le':               operator.le,
 }
diff --git a/deps/v8/third_party/jinja2/utils.py b/deps/v8/third_party/jinja2/utils.py
index cdd4cd3af05..502a311c08e 100644
--- a/deps/v8/third_party/jinja2/utils.py
+++ b/deps/v8/third_party/jinja2/utils.py
@@ -5,10 +5,11 @@
 
     Utility functions.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD, see LICENSE for more details.
 """
 import re
+import json
 import errno
 from collections import deque
 from threading import Lock
@@ -37,6 +38,8 @@
 
 concat = u''.join
 
+_slash_escape = '\\/' not in json.dumps('/')
+
 
 def contextfunction(f):
     """This decorator can be used to mark a function or method context callable.
@@ -109,7 +112,7 @@ def clear_caches():
     """Jinja2 keeps internal caches for environments and lexers.  These are
     used so that Jinja2 doesn't have to recreate environments and lexers all
     the time.  Normally you don't have to care about that but if you are
-    messuring memory consumption you may want to clean the caches.
+    measuring memory consumption you may want to clean the caches.
     """
     from jinja2.environment import _spontaneous_environments
     from jinja2.lexer import _lexer_cache
@@ -183,7 +186,7 @@ def pformat(obj, verbose=False):
         return pformat(obj)
 
 
-def urlize(text, trim_url_limit=None, nofollow=False, target=None):
+def urlize(text, trim_url_limit=None, rel=None, target=None):
     """Converts any URLs in text into clickable links. Works on http://,
     https:// and www. links. Links can have trailing punctuation (periods,
     commas, close-parens) and leading punctuation (opening parens) and
@@ -201,11 +204,9 @@ def urlize(text, trim_url_limit=None, nofollow=False, target=None):
                          and (x[:limit] + (len(x) >=limit and '...'
                          or '')) or x
     words = _word_split_re.split(text_type(escape(text)))
-    nofollow_attr = nofollow and ' rel="nofollow"' or ''
-    if target is not None and isinstance(target, string_types):
-        target_attr = ' target="%s"' % target
-    else:
-        target_attr = ''
+    rel_attr = rel and ' rel="%s"' % text_type(escape(rel)) or ''
+    target_attr = target and ' target="%s"' % escape(target) or ''
+
     for i, word in enumerate(words):
         match = _punctuation_re.match(word)
         if match:
@@ -221,11 +222,11 @@ def urlize(text, trim_url_limit=None, nofollow=False, target=None):
                     middle.endswith('.com')
                 )):
                 middle = '<a href="http://%s"%s%s>%s</a>' % (middle,
-                    nofollow_attr, target_attr, trim_url(middle))
+                    rel_attr, target_attr, trim_url(middle))
             if middle.startswith('http://') or \
                middle.startswith('https://'):
                 middle = '<a href="%s"%s%s>%s</a>' % (middle,
-                    nofollow_attr, target_attr, trim_url(middle))
+                    rel_attr, target_attr, trim_url(middle))
             if '@' in middle and not middle.startswith('www.') and \
                not ':' in middle and _simple_email_re.match(middle):
                 middle = '<a href="mailto:%s">%s</a>' % (middle, middle)
@@ -295,7 +296,7 @@ def unicode_urlencode(obj, charset='utf-8', for_qs=False):
         obj = text_type(obj)
     if isinstance(obj, text_type):
         obj = obj.encode(charset)
-    safe = for_qs and b'' or b'/'
+    safe = not for_qs and b'/' or b''
     rv = text_type(url_quote(obj, safe))
     if for_qs:
         rv = rv.replace('%20', '+')
@@ -487,6 +488,88 @@ def __reversed__(self):
     pass
 
 
+def select_autoescape(enabled_extensions=('html', 'htm', 'xml'),
+                      disabled_extensions=(),
+                      default_for_string=True,
+                      default=False):
+    """Intelligently sets the initial value of autoescaping based on the
+    filename of the template.  This is the recommended way to configure
+    autoescaping if you do not want to write a custom function yourself.
+
+    If you want to enable it for all templates created from strings or
+    for all templates with `.html` and `.xml` extensions::
+
+        from jinja2 import Environment, select_autoescape
+        env = Environment(autoescape=select_autoescape(
+            enabled_extensions=('html', 'xml'),
+            default_for_string=True,
+        ))
+
+    Example configuration to turn it on at all times except if the template
+    ends with `.txt`::
+
+        from jinja2 import Environment, select_autoescape
+        env = Environment(autoescape=select_autoescape(
+            disabled_extensions=('txt',),
+            default_for_string=True,
+            default=True,
+        ))
+
+    The `enabled_extensions` is an iterable of all the extensions that
+    autoescaping should be enabled for.  Likewise `disabled_extensions` is
+    a list of all templates it should be disabled for.  If a template is
+    loaded from a string then the default from `default_for_string` is used.
+    If nothing matches then the initial value of autoescaping is set to the
+    value of `default`.
+
+    For security reasons this function operates case insensitive.
+
+    .. versionadded:: 2.9
+    """
+    enabled_patterns = tuple('.' + x.lstrip('.').lower()
+                             for x in enabled_extensions)
+    disabled_patterns = tuple('.' + x.lstrip('.').lower()
+                              for x in disabled_extensions)
+    def autoescape(template_name):
+        if template_name is None:
+            return default_for_string
+        template_name = template_name.lower()
+        if template_name.endswith(enabled_patterns):
+            return True
+        if template_name.endswith(disabled_patterns):
+            return False
+        return default
+    return autoescape
+
+
+def htmlsafe_json_dumps(obj, dumper=None, **kwargs):
+    """Works exactly like :func:`dumps` but is safe for use in ``<script>``
+    tags.  It accepts the same arguments and returns a JSON string.  Note that
+    this is available in templates through the ``|tojson`` filter which will
+    also mark the result as safe.  Due to how this function escapes certain
+    characters this is safe even if used outside of ``<script>`` tags.
+
+    The following characters are escaped in strings:
+
+    -   ``<``
+    -   ``>``
+    -   ``&``
+    -   ``'``
+
+    This makes it safe to embed such strings in any place in HTML with the
+    notable exception of double quoted attributes.  In that case single
+    quote your attributes or HTML escape it in addition.
+    """
+    if dumper is None:
+        dumper = json.dumps
+    rv = dumper(obj, **kwargs) \
+        .replace(u'<', u'\\u003c') \
+        .replace(u'>', u'\\u003e') \
+        .replace(u'&', u'\\u0026') \
+        .replace(u"'", u'\\u0027')
+    return Markup(rv)
+
+
 @implements_iterator
 class Cycler(object):
     """A cycle helper for templates."""
@@ -506,12 +589,14 @@ def current(self):
         """Returns the current item."""
         return self.items[self.pos]
 
-    def __next__(self):
+    def next(self):
         """Goes one item ahead and returns it."""
         rv = self.current
         self.pos = (self.pos + 1) % len(self.items)
         return rv
 
+    __next__ = next
+
 
 class Joiner(object):
     """A joining helper for templates."""
@@ -527,5 +612,36 @@ def __call__(self):
         return self.sep
 
 
+class Namespace(object):
+    """A namespace object that can hold arbitrary attributes.  It may be
+    initialized from a dictionary or with keyword argments."""
+
+    def __init__(*args, **kwargs):
+        self, args = args[0], args[1:]
+        self.__attrs = dict(*args, **kwargs)
+
+    def __getattribute__(self, name):
+        if name == '_Namespace__attrs':
+            return object.__getattribute__(self, name)
+        try:
+            return self.__attrs[name]
+        except KeyError:
+            raise AttributeError(name)
+
+    def __setitem__(self, name, value):
+        self.__attrs[name] = value
+
+    def __repr__(self):
+        return '<Namespace %r>' % self.__attrs
+
+
+# does this python version support async for in and async generators?
+try:
+    exec('async def _():\n async for _ in ():\n  yield _')
+    have_async_gen = True
+except SyntaxError:
+    have_async_gen = False
+
+
 # Imported here because that's where it was in the past
 from markupsafe import Markup, escape, soft_unicode
diff --git a/deps/v8/third_party/jinja2/visitor.py b/deps/v8/third_party/jinja2/visitor.py
index 413e7c309dc..ba526dfac92 100644
--- a/deps/v8/third_party/jinja2/visitor.py
+++ b/deps/v8/third_party/jinja2/visitor.py
@@ -5,7 +5,7 @@
 
     This module implements a visitor for the nodes.
 
-    :copyright: (c) 2010 by the Jinja Team.
+    :copyright: (c) 2017 by the Jinja Team.
     :license: BSD.
 """
 from jinja2.nodes import Node
diff --git a/deps/v8/tools/BUILD.gn b/deps/v8/tools/BUILD.gn
index 1c0864d0d85..29d7b273f0d 100644
--- a/deps/v8/tools/BUILD.gn
+++ b/deps/v8/tools/BUILD.gn
@@ -2,59 +2,46 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-import("../gni/isolate.gni")
+import("//build/config/sanitizers/sanitizers.gni")
+import("../gni/v8.gni")
 
 group("gn_all") {
   testonly = true
 
-  if (v8_test_isolation_mode != "noop") {
-    deps = [
-      ":check-static-initializers_run",
-      ":jsfunfuzz_run",
-      ":run-deopt-fuzzer_run",
-      ":run-gcmole_run",
-      ":run-num-fuzzer_run",
-    ]
-  }
-}
-
-v8_isolate_run("check-static-initializers") {
-  deps = [
-    "..:d8_run",
+  data_deps = [
+    ":v8_check_static_initializers",
+    "gcmole:v8_run_gcmole",
+    "jsfunfuzz:v8_jsfunfuzz",
   ]
-
-  isolate = "check-static-initializers.isolate"
 }
 
-v8_isolate_run("jsfunfuzz") {
-  deps = [
-    "..:d8_run",
+group("v8_check_static_initializers") {
+  data_deps = [
+    "..:d8",
   ]
 
-  isolate = "jsfunfuzz/jsfunfuzz.isolate"
-}
-
-v8_isolate_run("run-deopt-fuzzer") {
-  deps = [
-    "..:d8_run",
+  data = [
+    "check-static-initializers.sh",
   ]
-
-  isolate = "run-deopt-fuzzer.isolate"
 }
 
-v8_isolate_run("run-gcmole") {
-  deps = [
-    "..:d8_run",
+group("v8_testrunner") {
+  data_deps = [
+    "..:v8_dump_build_config",
   ]
 
-  isolate = "gcmole/run-gcmole.isolate"
-}
-
-# TODO(machenbach): Add tests as dependencies.
-v8_isolate_run("run-num-fuzzer") {
-  deps = [
-    "..:d8_run",
+  data = [
+    # Also add the num-fuzzer wrapper script in order to be able to run the
+    # num-fuzzer on all existing isolated V8 test suites.
+    "run-num-fuzzer.py",
+    "run-tests.py",
+    "testrunner/",
   ]
 
-  isolate = "run-num-fuzzer.isolate"
+  if (v8_code_coverage && sanitizer_coverage_flags == "bb,trace-pc-guard") {
+    data += [
+      "sanitizers/sancov_merger.py",
+      "../third_party/llvm/projects/compiler-rt/lib/sanitizer_common/scripts/sancov.py",
+    ]
+  }
 }
diff --git a/deps/v8/tools/Makefile.tags b/deps/v8/tools/Makefile.tags
new file mode 100644
index 00000000000..372824dad74
--- /dev/null
+++ b/deps/v8/tools/Makefile.tags
@@ -0,0 +1,30 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+
+# Variable default definitions. Override them by exporting them in your shell.
+V8_DIR ?= $(realpath $(dir $(lastword $(MAKEFILE_LIST)))/..)
+
+# Support for the GNU GLOBAL Source Code Tag System.
+$(V8_DIR)/gtags.files: $(wildcard $(addprefix $(V8_DIR)/,$(shell cat $(V8_DIR)/gtags.files 2> /dev/null)))
+	@(cd $(V8_DIR) && find include src test -name '*.h' -o -name '*.cc' -o -name '*.c') > $@
+
+# We need to manually set the stack limit here, to work around bugs in
+# gmake-3.81 and global-5.7.1 on recent 64-bit Linux systems.
+# Using $(wildcard ...) gracefully ignores non-existing files, so that stale
+# gtags.files after switching branches don't cause recipe failures.
+$(V8_DIR)/GPATH $(V8_DIR)/GRTAGS $(V8_DIR)/GSYMS $(V8_DIR)/GTAGS: $(V8_DIR)/gtags.files $(wildcard $(addprefix $(V8_DIR)/,$(shell cat $(V8_DIR)/gtags.files 2> /dev/null)))
+	@cd $(V8_DIR) && bash -c 'ulimit -s 10240 && GTAGSFORCECPP=yes gtags -i -q -f $<'
+
+$(V8_DIR)/tags: $(V8_DIR)/gtags.files $(wildcard $(addprefix $(V8_DIR)/,$(shell cat $(V8_DIR)/gtags.files 2> /dev/null)))
+	@(ctags --version | grep 'Exuberant Ctags' >/dev/null) || \
+	  (echo "Please install Exuberant Ctags (check 'ctags --version')" >&2; false)
+	@cd $(V8_DIR) && ctags --fields=+l -L gtags.files
+
+tags: $(V8_DIR)/tags
+
+tags.clean:
+	@rm -f $(addprefix $(V8_DIR), gtags.files GPATH GRTAGS GSYMS GTAGS tags)
+
+clean: tags.clean
diff --git a/deps/v8/tools/bigint-tester.py b/deps/v8/tools/bigint-tester.py
index 0452a0d1db4..d48d2546f93 100755
--- a/deps/v8/tools/bigint-tester.py
+++ b/deps/v8/tools/bigint-tester.py
@@ -13,9 +13,9 @@
 import tempfile
 
 # Configuration.
-kChars = "0123456789abcdefghijklmnopqrstuvwxyz"
+kChars = "0123456789abcdef"
 kBase = 16
-kLineLength = 71  # A bit less than 80.
+kLineLength = 70  # A bit less than 80.
 kNumInputsGenerate = 20
 kNumInputsStress = 1000
 
@@ -46,29 +46,36 @@
 }"""
 
 def GenRandom(length, negative=kRandom):
-  if length == 0: return "0"
+  if length == 0: return "0n"
   s = []
   if negative == kYes or (negative == kRandom and (random.randint(0, 1) == 0)):
     s.append("-")  # 50% chance of negative.
+  s.append("0x")
   s.append(kChars[random.randint(1, kBase - 1)])  # No leading zero.
   for i in range(1, length):
     s.append(kChars[random.randint(0, kBase - 1)])
+  s.append("n")
   return "".join(s)
 
-def Format(x, base):
+def Parse(x):
+  assert x[-1] == 'n', x
+  return int(x[:-1], kBase)
+
+def Format(x):
   original = x
   negative = False
-  if x == 0: return "0"
+  if x == 0: return "0n"
   if x < 0:
     negative = True
     x = -x
   s = ""
   while x > 0:
-    s = kChars[x % base] + s
-    x = x / base
+    s = kChars[x % kBase] + s
+    x = x / kBase
+  s = "0x" + s + "n"
   if negative:
     s = "-" + s
-  assert int(s, base) == original
+  assert Parse(s) == original
   return s
 
 class TestGenerator(object):
@@ -120,17 +127,16 @@ def GenerateInput(self):
   # Subclasses should not override anything below.
   def EmitOne(self):
     x_str = self.GenerateInput()
-    x_num = int(x_str, kBase)
+    x_num = Parse(x_str)
     result_num = self.GenerateResult(x_num)
-    result_str = Format(result_num, kBase)
-    return "{\n  a: \"%s\",\n  r: \"%s\"\n}" % (x_str, result_str)
+    result_str = Format(result_num)
+    return "{\n  a: %s,\n  r: %s\n}" % (x_str, result_str)
 
   def EmitTestCore(self):
     return """\
-  var a = BigInt.parseInt(d.a, %(base)d);
-  var r = %(op)sa;
-  if (d.r !== r.toString(%(base)d)) {
-    print("Input:    " + a.toString(%(base)d));
+  var r = %(op)sd.a;
+  if (d.r !== r) {
+    print("Input:    " + d.a.toString(%(base)d));
     print("Result:   " + r.toString(%(base)d));
     print("Expected: " + d.r);
     error_count++;
@@ -152,21 +158,19 @@ def GenerateInputs(self):
   # Subclasses should not override anything below.
   def EmitOne(self):
     left_str, right_str = self.GenerateInputs()
-    left_num = int(left_str, kBase)
-    right_num = int(right_str, kBase)
+    left_num = Parse(left_str)
+    right_num = Parse(right_str)
     result_num = self.GenerateResult(left_num, right_num)
-    result_str = Format(result_num, kBase)
-    return ("{\n  a: \"%s\",\n  b: \"%s\",\n  r: \"%s\"\n}" %
+    result_str = Format(result_num)
+    return ("{\n  a: %s,\n  b: %s,\n  r: %s\n}" %
             (left_str, right_str, result_str))
 
   def EmitTestCore(self):
     return """\
-  var a = BigInt.parseInt(d.a, %(base)d);
-  var b = BigInt.parseInt(d.b, %(base)d);
-  var r = a %(op)s b;
-  if (d.r !== r.toString(%(base)d)) {
-    print("Input A:  " + a.toString(%(base)d));
-    print("Input B:  " + b.toString(%(base)d));
+  var r = d.a %(op)s d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(%(base)d));
+    print("Input B:  " + d.b.toString(%(base)d));
     print("Result:   " + r.toString(%(base)d));
     print("Expected: " + d.r);
     print("Op: %(op)s");
diff --git a/deps/v8/tools/check-static-initializers.gyp b/deps/v8/tools/check-static-initializers.gyp
deleted file mode 100644
index cfeacfc89fb..00000000000
--- a/deps/v8/tools/check-static-initializers.gyp
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'check_static_initializers_run',
-          'type': 'none',
-          'dependencies': [
-            '../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../gypfiles/features.gypi',
-            '../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'check-static-initializers.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/tools/check-static-initializers.isolate b/deps/v8/tools/check-static-initializers.isolate
deleted file mode 100644
index d1197d3d6c9..00000000000
--- a/deps/v8/tools/check-static-initializers.isolate
+++ /dev/null
@@ -1,16 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'command': [
-      'check-static-initializers.sh',
-    ],
-    'files': [
-      'check-static-initializers.sh',
-    ],
-  },
-  'includes': [
-    '../src/d8.isolate',
-  ],
-}
diff --git a/deps/v8/tools/foozzie/BUILD.gn b/deps/v8/tools/clusterfuzz/BUILD.gn
similarity index 88%
rename from deps/v8/tools/foozzie/BUILD.gn
rename to deps/v8/tools/clusterfuzz/BUILD.gn
index 532c1faca47..88219600a28 100644
--- a/deps/v8/tools/foozzie/BUILD.gn
+++ b/deps/v8/tools/clusterfuzz/BUILD.gn
@@ -9,6 +9,8 @@ if (v8_correctness_fuzzer) {
     sources = [
       "v8_commands.py",
       "v8_foozzie.py",
+      "v8_foozzie_harness_adjust.js",
+      "v8_fuzz_config.py",
       "v8_mock.js",
       "v8_mock_archs.js",
       "v8_suppressions.js",
diff --git a/deps/v8/tools/clusterfuzz/PRESUBMIT.py b/deps/v8/tools/clusterfuzz/PRESUBMIT.py
new file mode 100644
index 00000000000..0faeb0603ca
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/PRESUBMIT.py
@@ -0,0 +1,8 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+def CheckChangeOnCommit(input_api, output_api):
+  tests = input_api.canned_checks.GetUnitTestsInDirectory(
+      input_api, output_api, '.', whitelist=['v8_foozzie_test.py$'])
+  return input_api.RunTests(tests)
diff --git a/deps/v8/tools/foozzie/testdata/failure_output.txt b/deps/v8/tools/clusterfuzz/testdata/failure_output.txt
similarity index 100%
rename from deps/v8/tools/foozzie/testdata/failure_output.txt
rename to deps/v8/tools/clusterfuzz/testdata/failure_output.txt
diff --git a/deps/v8/tools/foozzie/testdata/fuzz-123.js b/deps/v8/tools/clusterfuzz/testdata/fuzz-123.js
similarity index 100%
rename from deps/v8/tools/foozzie/testdata/fuzz-123.js
rename to deps/v8/tools/clusterfuzz/testdata/fuzz-123.js
diff --git a/deps/v8/tools/foozzie/testdata/test_d8_1.py b/deps/v8/tools/clusterfuzz/testdata/test_d8_1.py
similarity index 100%
rename from deps/v8/tools/foozzie/testdata/test_d8_1.py
rename to deps/v8/tools/clusterfuzz/testdata/test_d8_1.py
diff --git a/deps/v8/tools/foozzie/testdata/test_d8_2.py b/deps/v8/tools/clusterfuzz/testdata/test_d8_2.py
similarity index 100%
rename from deps/v8/tools/foozzie/testdata/test_d8_2.py
rename to deps/v8/tools/clusterfuzz/testdata/test_d8_2.py
diff --git a/deps/v8/tools/foozzie/testdata/test_d8_3.py b/deps/v8/tools/clusterfuzz/testdata/test_d8_3.py
similarity index 100%
rename from deps/v8/tools/foozzie/testdata/test_d8_3.py
rename to deps/v8/tools/clusterfuzz/testdata/test_d8_3.py
diff --git a/deps/v8/tools/foozzie/testdata/v8_build_config.json b/deps/v8/tools/clusterfuzz/testdata/v8_build_config.json
similarity index 100%
rename from deps/v8/tools/foozzie/testdata/v8_build_config.json
rename to deps/v8/tools/clusterfuzz/testdata/v8_build_config.json
diff --git a/deps/v8/tools/foozzie/v8_commands.py b/deps/v8/tools/clusterfuzz/v8_commands.py
similarity index 100%
rename from deps/v8/tools/foozzie/v8_commands.py
rename to deps/v8/tools/clusterfuzz/v8_commands.py
diff --git a/deps/v8/tools/foozzie/v8_foozzie.py b/deps/v8/tools/clusterfuzz/v8_foozzie.py
similarity index 99%
rename from deps/v8/tools/foozzie/v8_foozzie.py
rename to deps/v8/tools/clusterfuzz/v8_foozzie.py
index 9bb3512bcfb..8d975a587c0 100755
--- a/deps/v8/tools/foozzie/v8_foozzie.py
+++ b/deps/v8/tools/clusterfuzz/v8_foozzie.py
@@ -56,6 +56,10 @@
     '--no-lazy-inner-functions',
     '--suppress-asm-messages',
   ],
+  liftoff=[
+    '--liftoff',
+    '--suppress-asm-messages',
+  ],
   slow_path=[
     '--force-slow-path',
     '--suppress-asm-messages',
diff --git a/deps/v8/tools/clusterfuzz/v8_foozzie_harness_adjust.js b/deps/v8/tools/clusterfuzz/v8_foozzie_harness_adjust.js
new file mode 100644
index 00000000000..4a8ed35cc26
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/v8_foozzie_harness_adjust.js
@@ -0,0 +1,96 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Extensions to mjsunit and other test harnesses added between harness and
+// fuzzing code.
+
+try {
+  // Scope for utility functions.
+  (function() {
+    // Same as in mjsunit.js.
+    function classOf(object) {
+      // Argument must not be null or undefined.
+      var string = Object.prototype.toString.call(object);
+      // String has format [object <ClassName>].
+      return string.substring(8, string.length - 1);
+    }
+
+    // Override prettyPrinted with a version that also recusively prints object
+    // properties (with a depth of 3).
+    let origPrettyPrinted = prettyPrinted;
+    prettyPrinted = function prettyPrinted(value, depth=3) {
+      if (depth == 0) {
+        return "...";
+      }
+      switch (typeof value) {
+        case "object":
+          if (value === null) return "null";
+          var objectClass = classOf(value);
+          switch (objectClass) {
+            case "Object":
+              var name = value.constructor.name;
+              if (!name)
+                name = "Object";
+              return name + "{" + Object.keys(value).map(function(key, index) {
+                return (
+                    prettyPrinted(key, depth - 1) +
+                    ": " +
+                    prettyPrinted(value[key], depth - 1)
+                );
+              }).join(",")  + "}";
+          }
+      }
+      // Fall through to original version for all other types.
+      return origPrettyPrinted(value);
+    }
+
+    // We're not interested in stack traces.
+    MjsUnitAssertionError = function MjsUnitAssertionError(message) {}
+    MjsUnitAssertionError.prototype.toString = function () { return ""; };
+
+    // Do more printing in assertions for more correctness coverage.
+    failWithMessage = function failWithMessage(message) {
+      print(prettyPrinted(message))
+    }
+
+    assertSame = function assertSame(expected, found, name_opt) {
+      print(prettyPrinted(found));
+    }
+
+    assertNotSame = function assertNotSame(expected, found, name_opt) {
+      print(prettyPrinted(found));
+    }
+
+    assertEquals = function assertEquals(expected, found, name_opt) {
+      print(prettyPrinted(found));
+    }
+
+    assertNotEquals = function assertNotEquals(expected, found, name_opt) {
+      print(prettyPrinted(found));
+    }
+
+    assertNull = function assertNull(value, name_opt) {
+      print(prettyPrinted(value));
+    }
+
+    assertNotNull = function assertNotNull(value, name_opt) {
+      print(prettyPrinted(value));
+    }
+
+    // Suppress optimization status as it leads to false positives.
+    assertUnoptimized = function assertUnoptimized() {}
+
+    assertOptimized = function assertOptimized() {}
+
+    isNeverOptimize = function isNeverOptimize() {}
+
+    isAlwaysOptimize = function isAlwaysOptimize() {}
+
+    isInterpreted = function isInterpreted() {}
+
+    isOptimized = function isOptimized() {}
+
+    isTurboFanned = function isTurboFanned() {}
+  })();
+} catch(e) { }
diff --git a/deps/v8/tools/foozzie/v8_foozzie_test.py b/deps/v8/tools/clusterfuzz/v8_foozzie_test.py
old mode 100644
new mode 100755
similarity index 74%
rename from deps/v8/tools/foozzie/v8_foozzie_test.py
rename to deps/v8/tools/clusterfuzz/v8_foozzie_test.py
index ffe18a88d5d..9f6dd33c548
--- a/deps/v8/tools/foozzie/v8_foozzie_test.py
+++ b/deps/v8/tools/clusterfuzz/v8_foozzie_test.py
@@ -1,3 +1,4 @@
+#!/usr/bin/env python
 # Copyright 2016 the V8 project authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
@@ -8,12 +9,43 @@
 import unittest
 
 import v8_foozzie
+import v8_fuzz_config
 import v8_suppressions
 
 BASE_DIR = os.path.dirname(os.path.abspath(__file__))
 FOOZZIE = os.path.join(BASE_DIR, 'v8_foozzie.py')
 TEST_DATA = os.path.join(BASE_DIR, 'testdata')
 
+
+class ConfigTest(unittest.TestCase):
+  def testExperiments(self):
+    """Test that probabilities add up to 100 and that all config names exist.
+    """
+    EXPERIMENTS = v8_fuzz_config.FOOZZIE_EXPERIMENTS
+    CONFIGS = v8_foozzie.CONFIGS
+    assert sum(x[0] for x in EXPERIMENTS) == 100
+    assert all(map(lambda x: x[1] in CONFIGS, EXPERIMENTS))
+    assert all(map(lambda x: x[2] in CONFIGS, EXPERIMENTS))
+    assert all(map(lambda x: x[3].endswith('d8'), EXPERIMENTS))
+
+  def testConfig(self):
+    """Smoke test how to choose experiments.
+
+    When experiment distribution changes this test might change, too.
+    """
+    class Rng(object):
+      def random(self):
+        return 0.5
+    self.assertEqual(
+        [
+          '--first-config=ignition',
+          '--second-config=ignition_turbo_opt',
+          '--second-d8=d8',
+        ],
+        v8_fuzz_config.Config('foo', Rng()).choose_foozzie_flags(),
+    )
+
+
 class UnitTest(unittest.TestCase):
   def testDiff(self):
     # TODO(machenbach): Mock out suppression configuration.
@@ -109,3 +141,7 @@ def testDifferentOutputFail(self):
     e = ctx.exception
     self.assertEquals(v8_foozzie.RETURN_FAIL, e.returncode)
     self.assertEquals(expected_output, cut_verbose_output(e.output))
+
+
+if __name__ == '__main__':
+  unittest.main()
diff --git a/deps/v8/tools/clusterfuzz/v8_fuzz_config.py b/deps/v8/tools/clusterfuzz/v8_fuzz_config.py
new file mode 100644
index 00000000000..24bbf8f43db
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/v8_fuzz_config.py
@@ -0,0 +1,47 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import random
+
+# List of configuration experiments for correctness fuzzing.
+# List of <probability>, <1st config name>, <2nd config name>, <2nd d8>.
+# Probabilities must add up to 100.
+FOOZZIE_EXPERIMENTS = [
+  [5, 'ignition', 'ignition_asm', 'd8'],
+  [5, 'ignition', 'trusted', 'd8'],
+  [5, 'ignition', 'trusted_opt', 'd8'],
+  [10, 'ignition', 'slow_path', 'd8'],
+  [5, 'ignition', 'slow_path_opt', 'd8'],
+  [20, 'ignition', 'ignition_turbo', 'd8'],
+  [20, 'ignition', 'ignition_turbo_opt', 'd8'],
+  [4, 'ignition_turbo_opt', 'ignition_turbo_opt', 'clang_x86/d8'],
+  [4, 'ignition_turbo', 'ignition_turbo', 'clang_x86/d8'],
+  [4, 'ignition', 'ignition', 'clang_x86/d8'],
+  [5, 'ignition', 'ignition', 'clang_x64_v8_arm64/d8'],
+  [5, 'ignition', 'ignition', 'clang_x86_v8_arm/d8'],
+  [5, 'ignition', 'liftoff', 'd8'],
+  [3, 'liftoff', 'liftoff', 'clang_x86/d8'],
+]
+
+class Config(object):
+  def __init__(self, name, rng=None):
+    self.name = name
+    self.rng = rng or random.Random()
+
+  def choose_foozzie_flags(self):
+    """Randomly chooses a configuration from FOOZZIE_EXPERIMENTS.
+
+    Returns: List of flags to pass to v8_foozzie.py fuzz harness.
+    """
+    acc = 0
+    threshold = self.rng.random() * 100
+    for prob, first_config, second_config, second_d8 in FOOZZIE_EXPERIMENTS:
+      acc += prob
+      if acc > threshold:
+        return [
+          '--first-config=' + first_config,
+          '--second-config=' + second_config,
+          '--second-d8=' + second_d8,
+        ]
+    assert False
diff --git a/deps/v8/tools/foozzie/v8_mock.js b/deps/v8/tools/clusterfuzz/v8_mock.js
similarity index 93%
rename from deps/v8/tools/foozzie/v8_mock.js
rename to deps/v8/tools/clusterfuzz/v8_mock.js
index 5d15304cd73..2f797dd89f0 100644
--- a/deps/v8/tools/foozzie/v8_mock.js
+++ b/deps/v8/tools/clusterfuzz/v8_mock.js
@@ -10,7 +10,7 @@
 
 
 // This will be overridden in the test cases. The override can be minimized.
-var __PrettyPrint = function __PrettyPrint(msg) { print(msg); };
+var prettyPrinted = function prettyPrinted(msg) { return msg; };
 
 // Mock Math.random.
 (function () {
@@ -69,6 +69,9 @@ var __PrettyPrint = function __PrettyPrint(msg) { print(msg); };
       if (property == "now") {
         return mockDateNow;
       }
+      if (property == "prototype") {
+        return origDate.prototype
+      }
     },
   }
 
@@ -121,16 +124,16 @@ Object.defineProperty(
   ];
   Worker = function(code){
     try {
-      __PrettyPrint(eval(code));
+      print(prettyPrinted(eval(code)));
     } catch(e) {
-      __PrettyPrint(e);
+      print(prettyPrinted(e));
     }
     this.getMessage = function(){
       index = (index + 1) % 10;
       return workerMessages[index];
     }
     this.postMessage = function(msg){
-      __PrettyPrint(msg);
+      print(prettyPrinted(msg));
     }
   };
 })();
diff --git a/deps/v8/tools/foozzie/v8_mock_archs.js b/deps/v8/tools/clusterfuzz/v8_mock_archs.js
similarity index 100%
rename from deps/v8/tools/foozzie/v8_mock_archs.js
rename to deps/v8/tools/clusterfuzz/v8_mock_archs.js
diff --git a/deps/v8/tools/foozzie/v8_suppressions.js b/deps/v8/tools/clusterfuzz/v8_suppressions.js
similarity index 100%
rename from deps/v8/tools/foozzie/v8_suppressions.js
rename to deps/v8/tools/clusterfuzz/v8_suppressions.js
diff --git a/deps/v8/tools/foozzie/v8_suppressions.py b/deps/v8/tools/clusterfuzz/v8_suppressions.py
similarity index 98%
rename from deps/v8/tools/foozzie/v8_suppressions.py
rename to deps/v8/tools/clusterfuzz/v8_suppressions.py
index 87b1972e94b..04f67b2cf94 100644
--- a/deps/v8/tools/foozzie/v8_suppressions.py
+++ b/deps/v8/tools/clusterfuzz/v8_suppressions.py
@@ -72,14 +72,6 @@
 # label.
 # Regular expressions are assumed to be compiled. We use regexp.search.
 IGNORE_TEST_CASES = {
-  'slow_path': {
-    'crbug.com/800651':
-        re.compile(r'async', re.S),
-  },
-  'slow_path_opt': {
-    'crbug.com/800651':
-        re.compile(r'async', re.S),
-  },
 }
 
 # Ignore by output pattern. Map from config->bug->regexp. See IGNORE_TEST_CASES
diff --git a/deps/v8/tools/dev/gm.py b/deps/v8/tools/dev/gm.py
index c3dab0a870c..6dfd46bf7ba 100755
--- a/deps/v8/tools/dev/gm.py
+++ b/deps/v8/tools/dev/gm.py
@@ -20,15 +20,12 @@
 
 from __future__ import print_function
 import errno
-import multiprocessing
 import os
 import pty
 import re
 import subprocess
 import sys
 
-BUILD_OPTS_DEFAULT = ""
-BUILD_OPTS_GOMA = "-j1000 -l%d" % (multiprocessing.cpu_count() + 2)
 BUILD_TARGETS_TEST = ["d8", "cctest", "unittests"]
 BUILD_TARGETS_ALL = ["all"]
 
@@ -231,11 +228,6 @@ def GetGnArgs(self):
     arch_specific = self.GetTargetCpu() + self.GetV8TargetCpu()
     return template % arch_specific
 
-  def WantsGoma(self):
-    output = _CallWithOutputNoTerminal(
-        "gn args --short --list=use_goma %s" % (GetPath(self.arch, self.mode)))
-    return "true" in output
-
   def Build(self):
     path = GetPath(self.arch, self.mode)
     args_gn = os.path.join(path, "args.gn")
@@ -247,14 +239,13 @@ def Build(self):
       code = _Call("gn gen %s" % path)
       if code != 0: return code
     targets = " ".join(self.targets)
-    build_opts = BUILD_OPTS_GOMA if self.WantsGoma() else BUILD_OPTS_DEFAULT
     # The implementation of mksnapshot failure detection relies on
     # the "pty" module and GDB presence, so skip it on non-Linux.
     if "linux" not in sys.platform:
-      return _Call("ninja -C %s %s %s" % (path, build_opts, targets))
+      return _Call("autoninja -C %s %s" % (path, targets))
 
-    return_code, output = _CallWithOutput("ninja -C %s %s %s" %
-                                          (path, build_opts, targets))
+    return_code, output = _CallWithOutput("autoninja -C %s %s" %
+                                          (path, targets))
     if return_code != 0 and "FAILED: gen/snapshot.cc" in output:
       csa_trap = re.compile("Specify option( --csa-trap-on-node=[^ ]*)")
       match = csa_trap.search(output)
diff --git a/deps/v8/tools/gcmole/BUILD.gn b/deps/v8/tools/gcmole/BUILD.gn
new file mode 100644
index 00000000000..65f11223bab
--- /dev/null
+++ b/deps/v8/tools/gcmole/BUILD.gn
@@ -0,0 +1,33 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("../../gni/v8.gni")
+
+group("v8_run_gcmole") {
+  testonly = true
+
+  data = [
+    "gccause.lua",
+    "gcmole.lua",
+    "gcmole-tools/",
+    "parallel.py",
+    "run-gcmole.py",
+
+    # The following contains all relevant source and build files.
+    "../../BUILD.gn",
+    "../../base/",
+    "../../include/",
+    "../../src/",
+    "../../test/cctest/",
+    "../../testing/gtest/include/gtest/gtest_prod.h",
+    "../../third_party/googletest/src/googletest/include/gtest/gtest_prod.h",
+    "../../third_party/icu/source/",
+  ]
+
+  if (v8_gcmole) {
+    # This assumes gcmole tools have been fetched by a hook
+    # into v8/tools/gcmole/gcmole_tools.
+    data += [ "gcmole-tools/" ]
+  }
+}
diff --git a/deps/v8/tools/gcmole/download_gcmole_tools.py b/deps/v8/tools/gcmole/download_gcmole_tools.py
deleted file mode 100755
index af27723da6f..00000000000
--- a/deps/v8/tools/gcmole/download_gcmole_tools.py
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/usr/bin/env python
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import os
-import re
-import subprocess
-
-GCMOLE_PATH = os.path.dirname(os.path.abspath(__file__))
-SHA1_PATH = os.path.join(GCMOLE_PATH, 'gcmole-tools.tar.gz.sha1')
-
-if re.search(r'\bgcmole=1', os.environ.get('GYP_DEFINES', '')):
-  subprocess.check_call([
-    'download_from_google_storage',
-    '-b', 'chrome-v8-gcmole',
-    '-u', '--no_resume',
-    '-s', SHA1_PATH,
-    '--platform=linux*'
-  ])
diff --git a/deps/v8/tools/gcmole/gcmole.lua b/deps/v8/tools/gcmole/gcmole.lua
index 862b7b02471..d832041361f 100644
--- a/deps/v8/tools/gcmole/gcmole.lua
+++ b/deps/v8/tools/gcmole/gcmole.lua
@@ -181,34 +181,6 @@ function InvokeClangPluginForEachFile(filenames, cfg, func)
 end
 
 -------------------------------------------------------------------------------
--- GYP file parsing
-
--- TODO(machenbach): Remove this when deprecating gyp.
-local function ParseGYPFile()
-   local result = {}
-   local gyp_files = {
-       { "src/v8.gyp",             "'([^']-%.cc)'",      "src/"         },
-       { "test/cctest/cctest.gyp", "'(test-[^']-%.cc)'", "test/cctest/" }
-   }
-
-   for i = 1, #gyp_files do
-      local filename = gyp_files[i][1]
-      local pattern = gyp_files[i][2]
-      local prefix = gyp_files[i][3]
-      local gyp_file = assert(io.open(filename), "failed to open GYP file")
-      local gyp = gyp_file:read('*a')
-      for condition, sources in
-         gyp:gmatch "%[.-### gcmole%((.-)%) ###(.-)%]" do
-         if result[condition] == nil then result[condition] = {} end
-         for file in sources:gmatch(pattern) do
-            table.insert(result[condition], prefix .. file)
-         end
-      end
-      gyp_file:close()
-   end
-
-   return result
-end
 
 local function ParseGNFile()
    local result = {}
@@ -258,34 +230,8 @@ local function BuildFileList(sources, props)
 end
 
 
-local gyp_sources = ParseGYPFile()
 local gn_sources = ParseGNFile()
 
--- TODO(machenbach): Remove this comparison logic when deprecating gyp.
-local function CompareSources(sources1, sources2, what)
-  for condition, files1 in pairs(sources1) do
-    local files2 = sources2[condition]
-    assert(
-      files2 ~= nil,
-      "Missing gcmole condition in " .. what .. ": " .. condition)
-
-    -- Turn into set for speed.
-    files2_set = {}
-    for i, file in pairs(files2) do files2_set[file] = true end
-
-    for i, file in pairs(files1) do
-      assert(
-        files2_set[file] ~= nil,
-        "Missing file " .. file .. " in " .. what .. " for condition " ..
-        condition)
-    end
-  end
-end
-
-CompareSources(gyp_sources, gn_sources, "GN")
-CompareSources(gn_sources, gyp_sources, "GYP")
-
-
 local function FilesForArch(arch)
    return BuildFileList(gn_sources, { os = 'linux',
                                       arch = arch,
diff --git a/deps/v8/tools/gcmole/run-gcmole.isolate b/deps/v8/tools/gcmole/run-gcmole.isolate
deleted file mode 100644
index 0fba2a12c1c..00000000000
--- a/deps/v8/tools/gcmole/run-gcmole.isolate
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'command': [
-      'run-gcmole.py',
-    ],
-    'files': [
-      'gccause.lua',
-      'gcmole.lua',
-      'parallel.py',
-      'run-gcmole.py',
-      # The following contains all relevant source and gyp files.
-      '../../BUILD.gn',
-      '../../base/',
-      '../../include/',
-      '../../src/',
-      '../../test/cctest/',
-      '../../testing/gtest/include/gtest/gtest_prod.h',
-      '../../third_party/icu/source/',
-    ],
-  },
-  'conditions': [
-    ['gcmole==1', {
-      'variables': {
-        'files': [
-          # This assumes gcmole tools have been fetched by a hook
-          # into v8/tools/gcmole/gcmole_tools.
-          'gcmole-tools/',
-        ],
-      },
-    }],
-  ],
-}
diff --git a/deps/v8/tools/gcmole/run_gcmole.gyp b/deps/v8/tools/gcmole/run_gcmole.gyp
deleted file mode 100644
index 7d206bf4125..00000000000
--- a/deps/v8/tools/gcmole/run_gcmole.gyp
+++ /dev/null
@@ -1,23 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'run_gcmole_run',
-          'type': 'none',
-          'includes': [
-            '../../gypfiles/features.gypi',
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'run-gcmole.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/tools/gcov.sh b/deps/v8/tools/gcov.sh
deleted file mode 100755
index d7277043d4d..00000000000
--- a/deps/v8/tools/gcov.sh
+++ /dev/null
@@ -1,67 +0,0 @@
-#!/bin/bash
-#
-# Copyright 2017 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# Build and collect code coverage data, cummulatively, on specified architectures.
-
-BUILD_TYPE=${BUILD_TYPE:-Release}
-
-declare -A modes=( [Release]=release [Debug]=debug )
-declare -A pairs=( [arm]=ia32 [arm64]=x64 [ia32]=ia32 [x64]=x64 )
-
-if [ -z ${modes[$BUILD_TYPE]} ]
-then
-    echo "BUILD_TYPE must be {<unspecified>|Release|Debug}"
-    echo "Release is default"
-    exit
-fi
-
-mode=${modes[$BUILD_TYPE]}
-
-echo "Using build:" $BUILD_TYPE
-v8_root=$(readlink -f $(dirname $BASH_SOURCE)/../)
-work_dir=$v8_root/cov
-build_dir=$work_dir/$BUILD_TYPE
-
-if [ -z $@ ]
-then
-    echo "Pass at least one target architecture"
-    echo "Supported architectures: x64 ia32 arm arm64"
-    echo ""
-    echo "Example: ./tools/gcov.sh x64 arm"
-    echo ""
-    echo "Optionally, set BUILD_TYPE env variable to"
-    echo "either Debug or Release, to use the corresponding build."
-    echo "By default, BUILD_TYPE is Release."
-    echo ""
-    echo "Example: BUILD_TYPE=Debug ./tools/gcov.sh x64 arm"
-    echo ""
-    exit
-fi
-
-lcov --directory=$build_dir --zerocounters
-
-# Mapping v8 build terminology to gnu compiler terminology:
-#   target_arch is the host, and
-#   v8_target_arch is the target
-
-for v8_target_arch in "$@"
-do
-    target_arch=${pairs[$v8_target_arch]}
-    if [ -z $target_arch ]
-    then
-        echo "Skipping unknown architecture: " $v8_target_arch
-    else
-        echo "Building" $v8_target_arch
-        GYP_DEFINES="component=static_library use_goma=1 target_arch=$target_arch v8_target_arch=$v8_target_arch coverage=1 clang=0" python $v8_root/gypfiles/gyp_v8.py -G output_dir=$work_dir
-        ninja -C $build_dir -j2000
-        $v8_root/tools/run-tests.py --gcov-coverage --arch=$v8_target_arch --mode=$mode --shell-dir=$build_dir --variants=exhaustive
-    fi
-done
-
-lcov --directory=$build_dir --capture --output-file $work_dir/app.info
-genhtml --output-directory $work_dir/html $work_dir/app.info
-echo "Done"
-echo "Output available at: " $work_dir/html/index.html
diff --git a/deps/v8/tools/gen-postmortem-metadata.py b/deps/v8/tools/gen-postmortem-metadata.py
index 043ecc306d0..c89635253ba 100644
--- a/deps/v8/tools/gen-postmortem-metadata.py
+++ b/deps/v8/tools/gen-postmortem-metadata.py
@@ -226,6 +226,11 @@
         'value': 'NumberDictionaryShape::kPrefixSize' },
     { 'name': 'numberdictionaryshape_entry_size',
         'value': 'NumberDictionaryShape::kEntrySize' },
+
+    { 'name': 'simplenumberdictionaryshape_prefix_size',
+        'value': 'SimpleNumberDictionaryShape::kPrefixSize' },
+    { 'name': 'simplenumberdictionaryshape_entry_size',
+        'value': 'SimpleNumberDictionaryShape::kEntrySize' },
 ];
 
 #
@@ -260,13 +265,11 @@
     'ExternalString, resource, Object, kResourceOffset',
     'SeqOneByteString, chars, char, kHeaderSize',
     'SeqTwoByteString, chars, char, kHeaderSize',
-    'SharedFunctionInfo, code, Code, kCodeOffset',
-    'SharedFunctionInfo, scope_info, ScopeInfo, kScopeInfoOffset',
     'SharedFunctionInfo, function_token_position, int, kFunctionTokenPositionOffset',
     'SharedFunctionInfo, start_position_and_type, int, kStartPositionAndTypeOffset',
     'SharedFunctionInfo, end_position, int, kEndPositionOffset',
     'SharedFunctionInfo, internal_formal_parameter_count, int, kFormalParameterCountOffset',
-    'SharedFunctionInfo, compiler_hints, int, kCompilerHintsOffset',
+    'SharedFunctionInfo, flags, int, kFlagsOffset',
     'SharedFunctionInfo, length, int, kLengthOffset',
     'SlicedString, parent, String, kParentOffset',
     'Code, instruction_start, uintptr_t, kHeaderSize',
diff --git a/deps/v8/gypfiles/get_landmines.py b/deps/v8/tools/get_landmines.py
similarity index 70%
rename from deps/v8/gypfiles/get_landmines.py
rename to deps/v8/tools/get_landmines.py
index 6137648e6dc..ff4831dff5c 100755
--- a/deps/v8/gypfiles/get_landmines.py
+++ b/deps/v8/tools/get_landmines.py
@@ -11,10 +11,16 @@
 import sys
 
 
-def main():
+def print_landmines():  # pylint: disable=invalid-name
   """
   ALL LANDMINES ARE EMITTED FROM HERE.
   """
+  # DO NOT add landmines as part of a regular CL. Landmines are a last-effort
+  # bandaid fix if a CL that got landed has a build dependency bug and all bots
+  # need to be cleaned up. If you're writing a new CL that causes build
+  # dependency problems, fix the dependency problems instead of adding a
+  # landmine.
+  # See the Chromium version in src/build/get_landmines.py for usage examples.
   print 'Need to clobber after ICU52 roll.'
   print 'Landmines test.'
   print 'Activating MSVS 2013.'
@@ -35,5 +41,10 @@ def main():
   return 0
 
 
+def main():
+  print_landmines()
+  return 0
+
+
 if __name__ == '__main__':
   sys.exit(main())
diff --git a/deps/v8/tools/grokdump.py b/deps/v8/tools/grokdump.py
index 5d9ffff607d..0246a18bfed 100755
--- a/deps/v8/tools/grokdump.py
+++ b/deps/v8/tools/grokdump.py
@@ -185,6 +185,10 @@ def dump_region(reader, start, size, location):
     (0xbbbbbbbb, 0xbbbbbbbb),
     (0xfefefefe, 0xfefefeff),
 )
+# See StackTraceFailureMessage in isolate.h
+STACK_TRACE_MARKER = 0xdecade30
+# See FailureMessage in logging.cc
+ERROR_MESSAGE_MARKER = 0xdecade10
 
 # Set of structures and constants that describe the layout of minidump
 # files. Based on MSDN and Google Breakpad.
@@ -1728,6 +1732,8 @@ class V8Heap(object):
     "ODDBALL_TYPE": Oddball,
     "FIXED_ARRAY_TYPE": FixedArray,
     "HASH_TABLE_TYPE": FixedArray,
+    "BOILERPLATE_DESCRIPTION_TYPE": FixedArray,
+    "SCOPE_INFO_TYPE": FixedArray,
     "JS_FUNCTION_TYPE": JSFunction,
     "SHARED_FUNCTION_INFO_TYPE": SharedFunctionInfo,
     "SCRIPT_TYPE": Script,
@@ -2057,7 +2063,8 @@ def SenseObject(self, address, slot=None):
   def SenseMap(self, tagged_address):
     if self.IsInKnownMapSpace(tagged_address):
       offset = self.GetPageOffset(tagged_address)
-      known_map_info = KNOWN_MAPS.get(offset)
+      lookup_key = ("MAP_SPACE", offset)
+      known_map_info = KNOWN_MAPS.get(lookup_key)
       if known_map_info:
         known_map_type, known_map_name = known_map_info
         return KnownMap(self, known_map_name, known_map_type)
@@ -2105,11 +2112,9 @@ def PrintStackTraceMessage(self, start=None, print_message=True):
     """
     # Only look at the first 1k words on the stack
     ptr_size = self.reader.PointerSize()
-    if start is None:
-      start = self.reader.ExceptionSP()
+    if start is None: start = self.reader.ExceptionSP()
     if not self.reader.IsValidAddress(start): return start
     end = start + ptr_size * 1024 * 4
-    message_start = 0
     magic1 = None
     for slot in xrange(start, end, ptr_size):
       if not self.reader.IsValidAddress(slot + ptr_size): break
@@ -2117,10 +2122,65 @@ def PrintStackTraceMessage(self, start=None, print_message=True):
       magic2 = self.reader.ReadUIntPtr(slot + ptr_size)
       pair = (magic1 & 0xFFFFFFFF, magic2 & 0xFFFFFFFF)
       if pair in MAGIC_MARKER_PAIRS:
-        message_slot = slot + ptr_size * 4
-        message_start = self.reader.ReadUIntPtr(message_slot)
-        break
-    if message_start == 0:
+        return self.TryExtractOldStyleStackTrace(slot, start, end,
+                                                 print_message)
+      if pair[0] == STACK_TRACE_MARKER:
+        return self.TryExtractStackTrace(slot, start, end, print_message)
+      elif pair[0] == ERROR_MESSAGE_MARKER:
+        return self.TryExtractErrorMessage(slot, start, end, print_message)
+    # Simple fallback in case not stack trace object was found
+    return self.TryExtractOldStyleStackTrace(0, start, end,
+                                             print_message)
+
+  def TryExtractStackTrace(self, slot, start, end, print_message):
+    ptr_size = self.reader.PointerSize()
+    assert self.reader.ReadUIntPtr(slot) & 0xFFFFFFFF == STACK_TRACE_MARKER
+    end_marker = STACK_TRACE_MARKER + 1;
+    header_size = 10
+    # Look for the end marker after the fields and the message buffer.
+    end_search = start + (32 * 1024) + (header_size * ptr_size);
+    end_slot = self.FindPtr(end_marker, end_search, end_search + ptr_size * 512)
+    if not end_slot: return start
+    print "Stack Message (start=%s):" % self.heap.FormatIntPtr(slot)
+    slot += ptr_size
+    for name in ("isolate","ptr1", "ptr2", "ptr3", "ptr4", "codeObject1",
+                 "codeObject2", "codeObject3", "codeObject4"):
+      value = self.reader.ReadUIntPtr(slot)
+      print " %s: %s" % (name.rjust(14), self.heap.FormatIntPtr(value))
+      slot += ptr_size
+    print "  message start: %s" % self.heap.FormatIntPtr(slot)
+    stack_start = end_slot + ptr_size
+    print "  stack_start:   %s" % self.heap.FormatIntPtr(stack_start)
+    (message_start, message) = self.FindFirstAsciiString(slot)
+    self.FormatStackTrace(message, print_message)
+    return stack_start
+
+  def FindPtr(self, expected_value, start, end):
+    ptr_size = self.reader.PointerSize()
+    for slot in xrange(start, end, ptr_size):
+      if not self.reader.IsValidAddress(slot): return None
+      value = self.reader.ReadUIntPtr(slot)
+      if value == expected_value: return slot
+    return None
+
+  def TryExtractErrorMessage(self, slot, start, end, print_message):
+    ptr_size = self.reader.PointerSize()
+    end_marker = ERROR_MESSAGE_MARKER + 1;
+    header_size = 1
+    end_search = start + 1024 + (header_size * ptr_size);
+    end_slot = self.FindPtr(end_marker, end_search, end_search + ptr_size * 512)
+    if not end_slot: return start
+    print "Error Message (start=%s):" % self.heap.FormatIntPtr(slot)
+    slot += ptr_size
+    (message_start, message) = self.FindFirstAsciiString(slot)
+    self.FormatStackTrace(message, print_message)
+    stack_start = end_slot + ptr_size
+    return stack_start
+
+  def TryExtractOldStyleStackTrace(self, message_slot, start, end,
+                                   print_message):
+    ptr_size = self.reader.PointerSize()
+    if message_slot == 0:
       """
       On Mac we don't always get proper magic markers, so just try printing
       the first long ascii string found on the stack.
@@ -2130,6 +2190,7 @@ def PrintStackTraceMessage(self, start=None, print_message=True):
       message_start, message = self.FindFirstAsciiString(start, end, 128)
       if message_start is None: return start
     else:
+      message_start = self.reader.ReadUIntPtr(message_slot + ptr_size * 4)
       message = self.reader.ReadAsciiString(message_start)
     stack_start = message_start + len(message) + 1
     # Make sure the address is word aligned
@@ -2149,10 +2210,15 @@ def PrintStackTraceMessage(self, start=None, print_message=True):
       print "  message start: %s" % self.heap.FormatIntPtr(message_start)
       print "  stack_start:   %s" % self.heap.FormatIntPtr(stack_start )
       print ""
+    self.FormatStackTrace(message, print_message)
+    return stack_start
+
+  def FormatStackTrace(self, message, print_message):
     if not print_message:
       print "  Use `dsa` to print the message with annotated addresses."
       print ""
-      return stack_start
+      return
+    ptr_size = self.reader.PointerSize()
     # Annotate all addresses in the dumped message
     prog = re.compile("[0-9a-fA-F]{%s}" % ptr_size*2)
     addresses = list(set(prog.findall(message)))
@@ -2166,7 +2232,7 @@ def PrintStackTraceMessage(self, start=None, print_message=True):
     print message
     print "="*80
     print ""
-    return stack_start
+
 
   def TryInferFramePointer(self, slot, address):
     """ Assume we have a framepointer if we find 4 consecutive links """
diff --git a/deps/v8/tools/gyp_flag_compare.py b/deps/v8/tools/gyp_flag_compare.py
deleted file mode 100755
index 86fa5c40984..00000000000
--- a/deps/v8/tools/gyp_flag_compare.py
+++ /dev/null
@@ -1,280 +0,0 @@
-#!/usr/bin/env python
-
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Copyright 2014 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-"""Given the output of -t commands from a ninja build for a gyp and GN generated
-build, report on differences between the command lines."""
-
-
-import os
-import shlex
-import subprocess
-import sys
-
-
-# Must be in v8/.
-BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-os.chdir(BASE_DIR)
-
-
-g_total_differences = 0
-
-
-def FindAndRemoveArgWithValue(command_line, argname):
-  """Given a command line as a list, remove and return the value of an option
-  that takes a value as a separate entry.
-
-  Modifies |command_line| in place.
-  """
-  if argname not in command_line:
-    return ''
-  location = command_line.index(argname)
-  value = command_line[location + 1]
-  command_line[location:location + 2] = []
-  return value
-
-
-def MergeSpacedArgs(command_line, argname):
-  """Combine all arguments |argname| with their values, separated by a space."""
-  i = 0
-  result = []
-  while i < len(command_line):
-    arg = command_line[i]
-    if arg == argname:
-      result.append(arg + ' ' + command_line[i + 1])
-      i += 1
-    else:
-      result.append(arg)
-    i += 1
-  return result
-
-
-def NormalizeSymbolArguments(command_line):
-  """Normalize -g arguments.
-
-  If there's no -g args, it's equivalent to -g0. -g2 is equivalent to -g.
-  Modifies |command_line| in place.
-  """
-  # Strip -g0 if there's no symbols.
-  have_some_symbols = False
-  for x in command_line:
-    if x.startswith('-g') and x != '-g0':
-      have_some_symbols = True
-  if not have_some_symbols and '-g0' in command_line:
-    command_line.remove('-g0')
-
-  # Rename -g2 to -g.
-  if '-g2' in command_line:
-    command_line[command_line.index('-g2')] = '-g'
-
-
-def GetFlags(lines, build_dir):
-  """Turn a list of command lines into a semi-structured dict."""
-  is_win = sys.platform == 'win32'
-  flags_by_output = {}
-  for line in lines:
-    command_line = shlex.split(line.strip(), posix=not is_win)[1:]
-
-    output_name = FindAndRemoveArgWithValue(command_line, '-o')
-    dep_name = FindAndRemoveArgWithValue(command_line, '-MF')
-
-    NormalizeSymbolArguments(command_line)
-
-    command_line = MergeSpacedArgs(command_line, '-Xclang')
-
-    cc_file = [x for x in command_line if x.endswith('.cc') or
-                                          x.endswith('.c') or
-                                          x.endswith('.cpp')]
-    if len(cc_file) != 1:
-      print 'Skipping %s' % command_line
-      continue
-    assert len(cc_file) == 1
-
-    if is_win:
-      rsp_file = [x for x in command_line if x.endswith('.rsp')]
-      assert len(rsp_file) <= 1
-      if rsp_file:
-        rsp_file = os.path.join(build_dir, rsp_file[0][1:])
-        with open(rsp_file, "r") as open_rsp_file:
-          command_line = shlex.split(open_rsp_file, posix=False)
-
-    defines = [x for x in command_line if x.startswith('-D')]
-    include_dirs = [x for x in command_line if x.startswith('-I')]
-    dash_f = [x for x in command_line if x.startswith('-f')]
-    warnings = \
-        [x for x in command_line if x.startswith('/wd' if is_win else '-W')]
-    others = [x for x in command_line if x not in defines and \
-                                         x not in include_dirs and \
-                                         x not in dash_f and \
-                                         x not in warnings and \
-                                         x not in cc_file]
-
-    for index, value in enumerate(include_dirs):
-      if value == '-Igen':
-        continue
-      path = value[2:]
-      if not os.path.isabs(path):
-        path = os.path.join(build_dir, path)
-      include_dirs[index] = '-I' + os.path.normpath(path)
-
-    # GYP supports paths above the source root like <(DEPTH)/../foo while such
-    # paths are unsupported by gn. But gn allows to use system-absolute paths
-    # instead (paths that start with single '/'). Normalize all paths.
-    cc_file = [os.path.normpath(os.path.join(build_dir, cc_file[0]))]
-
-    # Filter for libFindBadConstructs.so having a relative path in one and
-    # absolute path in the other.
-    others_filtered = []
-    for x in others:
-      if x.startswith('-Xclang ') and x.endswith('libFindBadConstructs.so'):
-        others_filtered.append(
-            '-Xclang ' +
-            os.path.join(os.getcwd(),
-                         os.path.normpath(
-                             os.path.join('out/gn_flags', x.split(' ', 1)[1]))))
-      elif x.startswith('-B'):
-        others_filtered.append(
-            '-B' +
-            os.path.join(os.getcwd(),
-                         os.path.normpath(os.path.join('out/gn_flags', x[2:]))))
-      else:
-        others_filtered.append(x)
-    others = others_filtered
-
-    flags_by_output[cc_file[0]] = {
-      'output': output_name,
-      'depname': dep_name,
-      'defines': sorted(defines),
-      'include_dirs': sorted(include_dirs),  # TODO(scottmg): This is wrong.
-      'dash_f': sorted(dash_f),
-      'warnings': sorted(warnings),
-      'other': sorted(others),
-    }
-  return flags_by_output
-
-
-def CompareLists(gyp, gn, name, dont_care_gyp=None, dont_care_gn=None):
-  """Return a report of any differences between gyp and gn lists, ignoring
-  anything in |dont_care_{gyp|gn}| respectively."""
-  global g_total_differences
-  if not dont_care_gyp:
-    dont_care_gyp = []
-  if not dont_care_gn:
-    dont_care_gn = []
-  output = ''
-  if gyp[name] != gn[name]:
-    gyp_set = set(gyp[name])
-    gn_set = set(gn[name])
-    missing_in_gyp = gyp_set - gn_set
-    missing_in_gn = gn_set - gyp_set
-    missing_in_gyp -= set(dont_care_gyp)
-    missing_in_gn -= set(dont_care_gn)
-    if missing_in_gyp or missing_in_gn:
-      output += '  %s differ:\n' % name
-    if missing_in_gyp:
-      output += '    In gyp, but not in GN:\n      %s' % '\n      '.join(
-          sorted(missing_in_gyp)) + '\n'
-      g_total_differences += len(missing_in_gyp)
-    if missing_in_gn:
-      output += '    In GN, but not in gyp:\n      %s' % '\n      '.join(
-          sorted(missing_in_gn)) + '\n\n'
-      g_total_differences += len(missing_in_gn)
-  return output
-
-
-def Run(command_line):
-  """Run |command_line| as a subprocess and return stdout. Raises on error."""
-  try:
-    return subprocess.check_output(command_line, shell=True)
-  except subprocess.CalledProcessError as e:
-    # Rescue the output we got until the exception happened.
-    print '#### Stdout: ####################################################'
-    print e.output
-    print '#################################################################'
-    raise
-
-
-def main():
-  if len(sys.argv) < 4:
-    print ('usage: %s gn_outdir gyp_outdir gn_target '
-           '[gyp_target1, gyp_target2, ...]' % __file__)
-    return 1
-
-  if len(sys.argv) == 4:
-    sys.argv.append(sys.argv[3])
-  gn_out_dir = sys.argv[1]
-  print >> sys.stderr, 'Expecting gn outdir in %s...' % gn_out_dir
-  gn = Run('ninja -C %s -t commands %s' % (gn_out_dir, sys.argv[3]))
-  if sys.platform == 'win32':
-    # On Windows flags are stored in .rsp files which are created during build.
-    print >> sys.stderr, 'Building in %s...' % gn_out_dir
-    Run('ninja -C %s -d keeprsp %s' % (gn_out_dir, sys.argv[3]))
-
-  gyp_out_dir = sys.argv[2]
-  print >> sys.stderr, 'Expecting gyp outdir in %s...' % gyp_out_dir
-  gyp = Run('ninja -C %s -t commands %s' % (gyp_out_dir, " ".join(sys.argv[4:])))
-  if sys.platform == 'win32':
-    # On Windows flags are stored in .rsp files which are created during build.
-    print >> sys.stderr, 'Building in %s...' % gyp_out_dir
-    Run('ninja -C %s -d keeprsp %s' % (gyp_out_dir, " ".join(sys.argv[4:])))
-
-  all_gyp_flags = GetFlags(gyp.splitlines(),
-                           os.path.join(os.getcwd(), gyp_out_dir))
-  all_gn_flags = GetFlags(gn.splitlines(),
-                          os.path.join(os.getcwd(), gn_out_dir))
-  gyp_files = set(all_gyp_flags.keys())
-  gn_files = set(all_gn_flags.keys())
-  different_source_list = gyp_files != gn_files
-  if different_source_list:
-    print 'Different set of sources files:'
-    print '  In gyp, not in GN:\n    %s' % '\n    '.join(
-        sorted(gyp_files - gn_files))
-    print '  In GN, not in gyp:\n    %s' % '\n    '.join(
-        sorted(gn_files - gyp_files))
-    print '\nNote that flags will only be compared for files in both sets.\n'
-  file_list = gyp_files & gn_files
-  files_with_given_differences = {}
-  for filename in sorted(file_list):
-    gyp_flags = all_gyp_flags[filename]
-    gn_flags = all_gn_flags[filename]
-    differences = CompareLists(gyp_flags, gn_flags, 'dash_f')
-    differences += CompareLists(gyp_flags, gn_flags, 'defines')
-    differences += CompareLists(gyp_flags, gn_flags, 'include_dirs',
-                                ['-I%s' % os.path.dirname(BASE_DIR)])
-    differences += CompareLists(gyp_flags, gn_flags, 'warnings',
-        # More conservative warnings in GN we consider to be OK.
-        dont_care_gyp=[
-          '/wd4091',  # 'keyword' : ignored on left of 'type' when no variable
-                      # is declared.
-          '/wd4456',  # Declaration hides previous local declaration.
-          '/wd4457',  # Declaration hides function parameter.
-          '/wd4458',  # Declaration hides class member.
-          '/wd4459',  # Declaration hides global declaration.
-          '/wd4702',  # Unreachable code.
-          '/wd4800',  # Forcing value to bool 'true' or 'false'.
-          '/wd4838',  # Conversion from 'type' to 'type' requires a narrowing
-                      # conversion.
-        ] if sys.platform == 'win32' else None,
-        dont_care_gn=[
-          '-Wendif-labels',
-          '-Wextra',
-          '-Wsign-compare',
-        ] if not sys.platform == 'win32' else None)
-    differences += CompareLists(gyp_flags, gn_flags, 'other')
-    if differences:
-      files_with_given_differences.setdefault(differences, []).append(filename)
-
-  for diff, files in files_with_given_differences.iteritems():
-    print '\n'.join(sorted(files))
-    print diff
-
-  print 'Total differences:', g_total_differences
-  # TODO(scottmg): Return failure on difference once we're closer to identical.
-  return 0
-
-
-if __name__ == '__main__':
-  sys.exit(main())
diff --git a/deps/v8/tools/heap-stats/README.md b/deps/v8/tools/heap-stats/README.md
index 70083fe2574..9cf6e5673c7 100644
--- a/deps/v8/tools/heap-stats/README.md
+++ b/deps/v8/tools/heap-stats/README.md
@@ -6,8 +6,9 @@ maintaining internal state versus actually allocated by the user.
 
 The tool consumes log files produced by d8 (or Chromium) by passing
 `--trace-gc-object-stats` or a trace captured using Chrome's tracing
-infrastructure. Chrome trace files need to be unpacked before they can
-be used though.
+infrastructure. Chrome trace files can either be processed as gzip or raw text
+files.
+
 
 Hosting requires a web server, e.g.:
 
diff --git a/deps/v8/tools/heap-stats/categories.js b/deps/v8/tools/heap-stats/categories.js
index 0a836d5f6c0..a05c1d04958 100644
--- a/deps/v8/tools/heap-stats/categories.js
+++ b/deps/v8/tools/heap-stats/categories.js
@@ -6,20 +6,17 @@
 const CATEGORIES = new Map([
   [
     'user', new Set([
-      '*FIXED_ARRAY_CONTEXT_SUB_TYPE',
-      '*FIXED_ARRAY_COPY_ON_WRITE_SUB_TYPE',
-      '*FIXED_ARRAY_DICTIONARY_PROPERTIES_SUB_TYPE',
-      '*FIXED_ARRAY_JS_COLLECTION_SUB_TYPE',
-      '*FIXED_ARRAY_JS_WEAK_COLLECTION_SUB_TYPE',
-      '*FIXED_ARRAY_PACKED_ELEMENTS_SUB_TYPE',
       'CONS_ONE_BYTE_STRING_TYPE',
       'CONS_STRING_TYPE',
       'DESCRIPTOR_ARRAY_TYPE',
+      'ELEMENTS_TYPE',
       'EXTERNAL_INTERNALIZED_STRING_TYPE',
       'EXTERNAL_ONE_BYTE_INTERNALIZED_STRING_TYPE',
       'EXTERNAL_ONE_BYTE_STRING_TYPE',
       'EXTERNAL_STRING_TYPE',
       'EXTERNAL_STRING_WITH_ONE_BYTE_DATA_TYPE',
+      'FIXED_BIGINT64_ARRAY_TYPE',
+      'FIXED_BIGUINT64_ARRAY_TYPE',
       'FIXED_DOUBLE_ARRAY_TYPE',
       'FIXED_FLOAT32_ARRAY_TYPE',
       'FIXED_FLOAT64_ARRAY_TYPE',
@@ -30,6 +27,9 @@ const CATEGORIES = new Map([
       'FIXED_UINT32_ARRAY_TYPE',
       'FIXED_UINT8_ARRAY_TYPE',
       'FIXED_UINT8_CLAMPED_ARRAY_TYPE',
+      'FUNCTION_CONTEXT_TYPE',
+      'GLOBAL_ELEMENTS_TYPE',
+      'GLOBAL_PROPERTIES_TYPE',
       'HEAP_NUMBER_TYPE',
       'INTERNALIZED_STRING_TYPE',
       'JS_ARGUMENTS_TYPE',
@@ -51,18 +51,24 @@ const CATEGORIES = new Map([
       'JS_GLOBAL_PROXY_TYPE',
       'JS_MAP_KEY_VALUE_ITERATOR_TYPE',
       'JS_MAP_TYPE',
+      'JS_MAP_VALUE_ITERATOR_TYPE',
       'JS_MESSAGE_OBJECT_TYPE',
       'JS_OBJECT_TYPE',
       'JS_PROMISE_TYPE',
       'JS_REGEXP_TYPE',
       'JS_SET_TYPE',
+      'JS_SET_VALUE_ITERATOR_TYPE',
       'JS_STRING_ITERATOR_TYPE',
+      'JS_TO_WASM_FUNCTION',
       'JS_TYPED_ARRAY_TYPE',
       'JS_VALUE_TYPE',
       'JS_WEAK_MAP_TYPE',
       'MUTABLE_HEAP_NUMBER_TYPE',
+      'NATIVE_CONTEXT_TYPE',
+      'OBJECT_PROPERTY_DICTIONARY_TYPE',
       'ONE_BYTE_INTERNALIZED_STRING_TYPE',
       'ONE_BYTE_STRING_TYPE',
+      'OTHER_CONTEXT_TYPE',
       'PROPERTY_ARRAY_TYPE',
       'SHORT_EXTERNAL_INTERNALIZED_STRING_TYPE',
       'SHORT_EXTERNAL_ONE_BYTE_INTERNALIZED_STRING_TYPE',
@@ -74,6 +80,9 @@ const CATEGORIES = new Map([
       'SYMBOL_TYPE',
       'THIN_ONE_BYTE_STRING_TYPE',
       'THIN_STRING_TYPE',
+      'WASM_INSTANCE_TYPE',
+      'WASM_MEMORY_TYPE',
+      'WASM_MODULE_TYPE',
     ])
   ],
   [
@@ -83,27 +92,18 @@ const CATEGORIES = new Map([
       'ACCESSOR_PAIR_TYPE',
       'ALLOCATION_MEMENTO_TYPE',
       'ALLOCATION_SITE_TYPE',
+      'BOILERPLATE_DESCRIPTION_TYPE',
       'BOILERPLATE_ELEMENTS_TYPE',
-      'BOILERPLATE_NAME_DICTIONARY_TYPE',
       'BOILERPLATE_PROPERTY_ARRAY_TYPE',
+      'BOILERPLATE_PROPERTY_DICTIONARY_TYPE',
       'BYTE_ARRAY_TYPE',
       'CELL_TYPE',
+      'CODE_STUBS_TABLE_TYPE',
       'CONTEXT_EXTENSION_TYPE',
-      '*FIXED_ARRAY_DEPENDENT_CODE_SUB_TYPE',
-      '*FIXED_ARRAY_ENUM_CACHE_SUB_TYPE',
-      '*FIXED_ARRAY_ENUM_INDICES_CACHE_SUB_TYPE',
-      '*FIXED_ARRAY_FAST_TEMPLATE_INSTANTIATIONS_CACHE_SUB_TYPE',
-      '*FIXED_ARRAY_NUMBER_STRING_CACHE_SUB_TYPE',
-      '*FIXED_ARRAY_PROTOTYPE_USERS_SUB_TYPE',
-      '*FIXED_ARRAY_REGEXP_MULTIPLE_CACHE_SUB_TYPE',
-      '*FIXED_ARRAY_RETAINED_MAPS_SUB_TYPE',
-      '*FIXED_ARRAY_SCOPE_INFO_SUB_TYPE',
-      '*FIXED_ARRAY_SCRIPT_LIST_SUB_TYPE',
-      '*FIXED_ARRAY_SINGLE_CHARACTER_STRING_CACHE_SUB_TYPE',
-      '*FIXED_ARRAY_STRING_SPLIT_CACHE_SUB_TYPE',
-      '*FIXED_ARRAY_TEMPLATE_INFO_SUB_TYPE',
-      '*FIXED_ARRAY_WEAK_NEW_SPACE_OBJECT_TO_CODE_SUB_TYPE',
+      'ENUM_CACHE_TYPE',
+      'ENUM_INDICES_CACHE_TYPE',
       'FOREIGN_TYPE',
+      'FUNCTION_TEMPLATE_INFO_ENTRIES_TYPE',
       'FUNCTION_TEMPLATE_INFO_TYPE',
       'INTERCEPTOR_INFO_TYPE',
       'JS_API_OBJECT_TYPE',
@@ -111,41 +111,66 @@ const CATEGORIES = new Map([
       'JS_OBJECT_BOILERPLATE_TYPE',
       'JS_SPECIAL_API_OBJECT_TYPE',
       'MAP_TYPE',
+      'NUMBER_STRING_CACHE_TYPE',
       'OBJECT_TEMPLATE_INFO_TYPE',
+      'OBJECT_TO_CODE_TYPE',
       'ODDBALL_TYPE',
       'PROMISE_REACTION_JOB_INFO_TYPE',
       'PROMISE_RESOLVE_THENABLE_JOB_INFO_TYPE',
       'PROPERTY_CELL_TYPE',
       'PROTOTYPE_INFO_TYPE',
+      'PROTOTYPE_USERS_TYPE',
+      'REGEXP_MULTIPLE_CACHE_TYPE',
+      'RETAINED_MAPS_TYPE',
+      'SCOPE_INFO_TYPE',
+      'SCRIPT_LIST_TYPE',
+      'SCRIPT_SHARED_FUNCTION_INFOS_TYPE',
+      'SERIALIZED_OBJECTS_TYPE',
+      'SINGLE_CHARACTER_STRING_CACHE_TYPE',
       'STACK_FRAME_INFO_TYPE',
+      'STRING_SPLIT_CACHE_TYPE',
+      'STRING_TABLE_TYPE',
       'TRANSITION_ARRAY_TYPE',
       'WEAK_CELL_TYPE',
+      'WEAK_NEW_SPACE_OBJECT_TO_CODE_TYPE',
     ])
   ],
   [
     'code', new Set([
-      '*CODE_BUILTIN',
-      '*CODE_BYTECODE_HANDLER',
-      '*CODE_OPTIMIZED_FUNCTION',
-      '*CODE_REGEXP',
-      '*CODE_STUB',
-      '*FIXED_ARRAY_BYTECODE_ARRAY_CONSTANT_POOL_SUB_TYPE',
-      '*FIXED_ARRAY_BYTECODE_ARRAY_HANDLER_TABLE_SUB_TYPE',
-      '*FIXED_ARRAY_CODE_STUBS_TABLE_SUB_TYPE',
-      '*FIXED_ARRAY_COMPILATION_CACHE_TABLE_SUB_TYPE',
-      '*FIXED_ARRAY_DEOPTIMIZATION_DATA_SUB_TYPE',
-      '*FIXED_ARRAY_EMBEDDED_OBJECT_SUB_TYPE',
-      '*FIXED_ARRAY_HANDLER_TABLE_SUB_TYPE',
-      '*FIXED_ARRAY_NOSCRIPT_SHARED_FUNCTION_INFOS_SUB_TYPE',
-      '*FIXED_ARRAY_OPTIMIZED_CODE_LITERALS_SUB_TYPE',
-      '*FIXED_ARRAY_SHARED_FUNCTION_INFOS_SUB_TYPE',
+      'BUILTIN',
+      'BYTECODE_HANDLER',
+      'OPTIMIZED_FUNCTION',
+      'REGEXP',
+      'STUB',
+      'BYTECODE_ARRAY_CONSTANT_POOL_TYPE',
+      'BYTECODE_ARRAY_HANDLER_TABLE_TYPE',
       'BYTECODE_ARRAY_TYPE',
       'CODE_DATA_CONTAINER_TYPE',
+      'DEOPTIMIZATION_DATA_TYPE',
+      'EMBEDDED_OBJECT_TYPE',
+      'FEEDBACK_CELL_TYPE',
+      'FEEDBACK_METADATA_TYPE',
+      'FEEDBACK_VECTOR_ENTRY_TYPE',
+      'FEEDBACK_VECTOR_HEADER_TYPE',
+      'FEEDBACK_VECTOR_SLOT_CALL_TYPE',
+      'FEEDBACK_VECTOR_SLOT_CALL_UNUSED_TYPE',
+      'FEEDBACK_VECTOR_SLOT_ENUM_TYPE',
+      'FEEDBACK_VECTOR_SLOT_LOAD_TYPE',
+      'FEEDBACK_VECTOR_SLOT_LOAD_UNUSED_TYPE',
+      'FEEDBACK_VECTOR_SLOT_OTHER_TYPE',
+      'FEEDBACK_VECTOR_SLOT_STORE_TYPE',
+      'FEEDBACK_VECTOR_SLOT_STORE_UNUSED_TYPE',
       'FEEDBACK_VECTOR_TYPE',
       'LOAD_HANDLER_TYPE',
+      'NOSCRIPT_SHARED_FUNCTION_INFOS_TYPE',
+      'OPTIMIZED_CODE_LITERALS_TYPE',
+      'SCRIPT_SOURCE_EXTERNAL_TYPE',
+      'SCRIPT_SOURCE_NON_EXTERNAL_TYPE',
       'SCRIPT_TYPE',
       'SHARED_FUNCTION_INFO_TYPE',
       'STORE_HANDLER_TYPE',
+      'UNCOMPILED_JS_FUNCTION_TYPE',
+      'UNCOMPILED_SHARED_FUNCTION_INFO_TYPE',
     ])
   ],
   ['unclassified', new Set()],
@@ -158,10 +183,3 @@ const CATEGORY_NAMES = new Map([
   ['code', 'Code'],
   ['unclassified', 'Unclassified'],
 ]);
-
-// Instance types that are constructed from their sub types and
-// should thus be hidden.
-const IGNORED_INSTANCE_TYPES = new Set([
-  'FIXED_ARRAY_TYPE',
-  'CODE_TYPE',
-]);
diff --git a/deps/v8/tools/heap-stats/details-selection.html b/deps/v8/tools/heap-stats/details-selection.html
index d60aef96694..67a27ae284c 100644
--- a/deps/v8/tools/heap-stats/details-selection.html
+++ b/deps/v8/tools/heap-stats/details-selection.html
@@ -3,12 +3,17 @@
 found in the LICENSE file. -->
 <template id="details-selection-template">
 <style>
+#dataSelectionSection {
+  display: none;
+}
+
 .box {
   border-left: dashed 1px #666666;
   border-right: dashed 1px #666666;
   border-bottom: dashed 1px #666666;
   padding: 10px;
   overflow: hidden;
+  position: relative;
 }
 
 .box:nth-of-type(1) {
@@ -20,53 +25,119 @@
     border-radius: 0px 0px 5px 5px;
 }
 
-span {
-  display: block;
-  padding: 5px;
+.box > ul {
+  margin: 0px;
+  padding: 0px;
+}
+
+.box > ul > li {
+  display: inline-block;
+}
+
+.box > ul > li:not(:first-child) {
+  margin-left: 10px;
+}
+
+.box > ul > li:first-child {
   font-weight: bold;
 }
 
-.boxDiv {
-  padding: 3px;
+.instanceTypeSelectBox {
+  position: relative;
+  overflow: hidden;
   float: left;
+  padding: 0px 5px 2px 0px;
+  margin: 3px;
+  border-radius: 3px;
 }
 
-.boxDiv > label {
+.instanceTypeSelectBox > label {
   font-size: xx-small;
 }
 
+.instanceTypeSelectBox > input {
+  vertical-align: middle;
+}
+
+.percentBackground {
+  position: absolute;
+  width: 200%;
+  height: 100%;
+  left: 0%;
+  top: 0px;
+  margin-left: -100%;
+  transition: all 1s ease-in-out;
+}
+
+.instanceTypeSelectBox > .percentBackground  {
+  background: linear-gradient(90deg, #68b0f7 50%, #b3d9ff 50%);
+  z-index: -1;
+}
+.box > .percentBackground  {
+  background: linear-gradient(90deg, #e0edfe 50%, #fff 50%);
+  z-index: -2;
+}
+
 #categories {
   margin-top: 10px;
 }
+
+#category-filter {
+  text-align: right;
+  width: 50px;
+}
+
 </style>
-<h2>Data selection</h2>
-<ul>
-  <li>
-    <label for="isolate-select">
-      Isolate
-    </label>
-    <select id="isolate-select">
-      <option>No data</option>
-    </select>
-  </li>
-  <li>
-    <label for="dataset-select">
-      Data set
-    </label>
-    <select id="dataset-select">
-      <option>No data</option>
-    </select>
-  </li>
-  <li>
-    <input type="checkbox" id="merge-categories" checked=checked />
-    <label for="merge-categories">
-      Merge categories
-    </label>
-  </li>
-</ul>
-
-
-<div id="categories"></div>
+<section id="dataSelectionSection">
+  <h2>Data selection</h2>
+  <ul>
+    <li>
+      <label for="isolate-select">
+        Isolate
+      </label>
+      <select id="isolate-select">
+        <option>No data</option>
+      </select>
+    </li>
+    <li>
+      <label for="dataset-select">
+        Data set
+      </label>
+      <select id="dataset-select">
+        <option>No data</option>
+      </select>
+    </li>
+    <li>
+      <input type="checkbox" id="merge-categories" checked=checked />
+      <label for="merge-categories">
+        Merge categories
+      </label>
+    </li>
+    <li>
+      <label for="gc-select">
+        Garbage collection (at a specific time in ms)
+      </label>
+      <select id="gc-select">
+        <option>No data</option>
+      </select>
+    </li>
+    <li>
+      <input id="category-filter" type="text" value="0" disabled="disabled" />KB
+      <button id="category-filter-btn" disabled="disabled">
+        Filter categories with less memory
+      </button>
+      <button id="category-auto-filter-btn" disabled="disabled">
+        Show top 20 categories only
+      </button>
+    </li>
+    <li>
+      <button id="csv-export-btn" disabled="disabled">Export selection as CSV</button>
+    </li>
+  </ul>
+
+  <div id="categories"></div>
+</section>
 </template>
+
 <script type="text/javascript" src="categories.js"></script>
-<script type="text/javascript" src="details-selection.js"></script>
\ No newline at end of file
+<script type="text/javascript" src="details-selection.js"></script>
diff --git a/deps/v8/tools/heap-stats/details-selection.js b/deps/v8/tools/heap-stats/details-selection.js
index 43c000d3f45..5e9ffc5f94e 100644
--- a/deps/v8/tools/heap-stats/details-selection.js
+++ b/deps/v8/tools/heap-stats/details-selection.js
@@ -17,8 +17,16 @@ class DetailsSelection extends HTMLElement {
         'change', e => this.handleIsolateChange(e));
     this.datasetSelect.addEventListener(
         'change', e => this.notifySelectionChanged(e));
+    this.gcSelect.addEventListener(
+        'change', e => this.notifySelectionChanged(e));
+    this.$('#csv-export-btn')
+        .addEventListener('click', e => this.exportCurrentSelection(e));
     this.$('#merge-categories')
         .addEventListener('change', e => this.notifySelectionChanged(e));
+    this.$('#category-filter-btn')
+        .addEventListener('click', e => this.filterCurrentSelection(e));
+    this.$('#category-auto-filter-btn')
+        .addEventListener('click', e => this.filterTop20Categories(e));
   }
 
   connectedCallback() {
@@ -36,50 +44,101 @@ class DetailsSelection extends HTMLElement {
     return this._data;
   }
 
+  get selectedIsolate() {
+    return this._data[this.selection.isolate];
+  }
+
+  get selectedData() {
+    console.assert(this.data, 'invalid data');
+    console.assert(this.selection, 'invalid selection');
+    return this.selectedIsolate.gcs[this.selection.gc][this.selection.data_set];
+  }
+
+  $(id) {
+    return this.shadowRoot.querySelector(id);
+  }
+
+  querySelectorAll(query) {
+    return this.shadowRoot.querySelectorAll(query);
+  }
+
+  get datasetSelect() {
+    return this.$('#dataset-select');
+  }
+
+  get isolateSelect() {
+    return this.$('#isolate-select');
+  }
+
+  get gcSelect() {
+    return this.$('#gc-select');
+  }
+
   buildCategory(name) {
     const div = document.createElement('div');
     div.id = name;
     div.classList.add('box');
-    const span = document.createElement('span');
-    div.appendChild(span);
-    span.innerHTML = CATEGORY_NAMES.get(name) + ' ';
+    const ul = document.createElement('ul');
+    div.appendChild(ul);
+    const name_li = document.createElement('li');
+    ul.appendChild(name_li);
+    name_li.innerHTML = CATEGORY_NAMES.get(name);
+    const percent_li = document.createElement('li');
+    ul.appendChild(percent_li);
+    percent_li.innerHTML = '0%';
+    percent_li.id = name + 'PercentContent';
+    const all_li = document.createElement('li');
+    ul.appendChild(all_li);
     const all_button = document.createElement('button');
-    span.appendChild(all_button);
+    all_li.appendChild(all_button);
     all_button.innerHTML = 'All';
     all_button.addEventListener('click', e => this.selectCategory(name));
+    const none_li = document.createElement('li');
+    ul.appendChild(none_li);
     const none_button = document.createElement('button');
-    span.appendChild(none_button);
+    none_li.appendChild(none_button);
     none_button.innerHTML = 'None';
     none_button.addEventListener('click', e => this.unselectCategory(name));
     const innerDiv = document.createElement('div');
     div.appendChild(innerDiv);
     innerDiv.id = name + 'Content';
+    const percentDiv = document.createElement('div');
+    div.appendChild(percentDiv);
+    percentDiv.className = 'percentBackground';
+    percentDiv.id = name + 'PercentBackground';
     return div;
   }
 
-  $(id) {
-    return this.shadowRoot.querySelector(id);
-  }
-
-  get datasetSelect() {
-    return this.$('#dataset-select');
+  dataChanged() {
+    this.selection = {categories: {}};
+    this.resetUI(true);
+    this.populateIsolateSelect();
+    this.handleIsolateChange();
+    this.$('#dataSelectionSection').style.display = 'block';
   }
 
-  get isolateSelect() {
-    return this.$('#isolate-select');
+  populateIsolateSelect() {
+    let isolates = Object.entries(this.data);
+    // Sorty by peak heap memory consumption.
+    isolates.sort((a, b) => b[1].peakMemory - a[1].peakMemory);
+    this.populateSelect(
+        '#isolate-select', isolates, (key, isolate) => isolate.getLabel());
   }
 
-  dataChanged() {
-    this.clearUI();
-    this.populateSelect('#isolate-select', Object.keys(this.data));
-    this.handleIsolateChange();
-  }
+  resetUI(resetIsolateSelect) {
+    if (resetIsolateSelect) removeAllChildren(this.isolateSelect);
 
-  clearUI() {
-    this.selection = {categories: {}};
-    removeAllChildren(this.isolateSelect);
     removeAllChildren(this.datasetSelect);
+    removeAllChildren(this.gcSelect);
     this.clearCategories();
+    this.setButtonState('disabled');
+  }
+
+  setButtonState(disabled) {
+    this.$('#csv-export-btn').disabled = disabled;
+    this.$('#category-filter').disabled = disabled;
+    this.$('#category-filter-btn').disabled = disabled;
+    this.$('#category-auto-filter-btn').disabled = disabled;
   }
 
   handleIsolateChange(e) {
@@ -88,9 +147,20 @@ class DetailsSelection extends HTMLElement {
       this.selection.isolate = null;
       return;
     }
-
+    this.resetUI(false);
     this.populateSelect(
-        '#dataset-select', this.data[this.selection.isolate].data_sets, 'live');
+        '#dataset-select', this.selectedIsolate.data_sets.entries(), null,
+        'live');
+    this.populateSelect(
+        '#gc-select',
+        Object.keys(this.selectedIsolate.gcs)
+            .map(id => [id, this.selectedIsolate.gcs[id].time]),
+        (key, time, index) => {
+          return (index + ': ').padStart(4, '0') +
+              formatSeconds(time).padStart(6, '0') + ' ' +
+              formatBytes(this.selectedIsolate.gcs[key].live.overall)
+                  .padStart(9, '0');
+        });
     this.populateCategories();
     this.notifySelectionChanged();
   }
@@ -106,15 +176,92 @@ class DetailsSelection extends HTMLElement {
     this.selection.category_names = CATEGORY_NAMES;
     this.selection.data_set = this.datasetSelect.value;
     this.selection.merge_categories = this.$('#merge-categories').checked;
+    this.selection.gc = this.gcSelect.value;
+    this.setButtonState(false);
+    this.updatePercentagesInCategory();
+    this.updatePercentagesInInstanceTypes();
     this.dispatchEvent(new CustomEvent(
         'change', {bubbles: true, composed: true, detail: this.selection}));
   }
 
+  filterCurrentSelection(e) {
+    const minSize = this.$('#category-filter').value * KB;
+    this.filterCurrentSelectionWithThresold(minSize);
+  }
+
+  filterTop20Categories(e) {
+    // Limit to show top 20 categories only.
+    let minSize = 0;
+    let count = 0;
+    let sizes = this.selectedIsolate.instanceTypePeakMemory;
+    for (let key in sizes) {
+      if (count == 20) break;
+      minSize = sizes[key];
+      count++;
+    }
+    this.filterCurrentSelectionWithThresold(minSize);
+  }
+
+  filterCurrentSelectionWithThresold(minSize) {
+    if (minSize === 0) return;
+
+    this.selection.category_names.forEach((_, category) => {
+      for (let checkbox of this.querySelectorAll(
+               'input[name=' + category + 'Checkbox]')) {
+        checkbox.checked =
+            this.selectedData.instance_type_data[checkbox.instance_type]
+                .overall > minSize;
+        console.log(
+            checkbox.instance_type, checkbox.checked,
+            this.selectedData.instance_type_data[checkbox.instance_type]
+                .overall);
+      }
+    });
+    this.notifySelectionChanged();
+  }
+
+  updatePercentagesInCategory() {
+    const overalls = {};
+    let overall = 0;
+    // Reset all categories.
+    this.selection.category_names.forEach((_, category) => {
+      overalls[category] = 0;
+    });
+    // Only update categories that have selections.
+    Object.entries(this.selection.categories).forEach(([category, value]) => {
+      overalls[category] =
+          Object.values(value).reduce(
+              (accu, current) =>
+                  accu + this.selectedData.instance_type_data[current].overall,
+              0) /
+          KB;
+      overall += overalls[category];
+    });
+    Object.entries(overalls).forEach(([category, category_overall]) => {
+      let percents = category_overall / overall * 100;
+      this.$(`#${category}PercentContent`).innerHTML =
+          `${percents.toFixed(1)}%`;
+      this.$('#' + category + 'PercentBackground').style.left = percents + '%';
+    });
+  }
+
+  updatePercentagesInInstanceTypes() {
+    const instanceTypeData = this.selectedData.instance_type_data;
+    const maxInstanceType = this.selectedData.singleInstancePeakMemory;
+    this.querySelectorAll('.instanceTypeSelectBox  input').forEach(checkbox => {
+      let instanceType = checkbox.value;
+      let instanceTypeSize = instanceTypeData[instanceType].overall;
+      let percents = instanceTypeSize / maxInstanceType;
+      let percentDiv = checkbox.parentNode.querySelector('.percentBackground');
+      percentDiv.style.left = (percents * 100) + '%';
+
+    });
+  }
+
   selectedInCategory(category) {
-    const selected = this.shadowRoot.querySelectorAll(
-        'input[name=' + category + 'Checkbox]:checked');
-    var tmp = [];
-    for (var val of selected.values()) tmp.push(val.value);
+    let tmp = [];
+    this.querySelectorAll('input[name=' + category + 'Checkbox]:checked')
+        .forEach(checkbox => tmp.push(checkbox.value));
     return tmp;
   }
 
@@ -125,17 +272,21 @@ class DetailsSelection extends HTMLElement {
     return 'unclassified';
   }
 
-  createOption(text) {
+  createOption(value, text) {
     const option = document.createElement('option');
-    option.value = text;
+    option.value = value;
     option.text = text;
     return option;
   }
 
-  populateSelect(id, iterable, autoselect = null) {
-    for (let option_value of iterable) {
-      const option = this.createOption(option_value);
-      if (autoselect === option_value) {
+  populateSelect(id, iterable, labelFn = null, autoselect = null) {
+    if (labelFn == null) labelFn = e => e;
+    let index = 0;
+    for (let [key, value] of iterable) {
+      index++;
+      const label = labelFn(key, value, index);
+      const option = this.createOption(key, label);
+      if (autoselect === key) {
         option.selected = 'selected';
       }
       this.$(id).appendChild(option);
@@ -158,9 +309,7 @@ class DetailsSelection extends HTMLElement {
       categories[cat] = [];
     }
 
-    for (let instance_type of this.data[this.selection.isolate]
-             .non_empty_instance_types) {
-      if (IGNORED_INSTANCE_TYPES.has(instance_type)) continue;
+    for (let instance_type of this.selectedIsolate.non_empty_instance_types) {
       const category = this.categoryForType(instance_type);
       categories[category].push(instance_type);
     }
@@ -174,38 +323,65 @@ class DetailsSelection extends HTMLElement {
   }
 
   unselectCategory(category) {
-    for (let checkbox of this.shadowRoot.querySelectorAll(
-             'input[name=' + category + 'Checkbox]')) {
-      checkbox.checked = false;
-    }
+    this.querySelectorAll('input[name=' + category + 'Checkbox]')
+        .forEach(checkbox => checkbox.checked = false);
     this.notifySelectionChanged();
   }
 
   selectCategory(category) {
-    for (let checkbox of this.shadowRoot.querySelectorAll(
-             'input[name=' + category + 'Checkbox]')) {
-      checkbox.checked = true;
-    }
+    this.querySelectorAll('input[name=' + category + 'Checkbox]')
+        .forEach(checkbox => checkbox.checked = true);
     this.notifySelectionChanged();
   }
 
   createCheckBox(instance_type, category) {
     const div = document.createElement('div');
-    div.classList.add('boxDiv');
+    div.classList.add('instanceTypeSelectBox');
     const input = document.createElement('input');
     div.appendChild(input);
     input.type = 'checkbox';
     input.name = category + 'Checkbox';
     input.checked = 'checked';
     input.id = instance_type + 'Checkbox';
+    input.instance_type = instance_type;
     input.value = instance_type;
     input.addEventListener('change', e => this.notifySelectionChanged(e));
     const label = document.createElement('label');
     div.appendChild(label);
     label.innerText = instance_type;
     label.htmlFor = instance_type + 'Checkbox';
+    const percentDiv = document.createElement('div');
+    percentDiv.className = 'percentBackground';
+    div.appendChild(percentDiv);
     return div;
   }
+
+  exportCurrentSelection(e) {
+    const data = [];
+    const selected_data =
+        this.selectedIsolate.gcs[this.selection.gc][this.selection.data_set]
+            .instance_type_data;
+    Object.values(this.selection.categories).forEach(instance_types => {
+      instance_types.forEach(instance_type => {
+        data.push([instance_type, selected_data[instance_type].overall / KB]);
+      });
+    });
+    const createInlineContent = arrayOfRows => {
+      const content = arrayOfRows.reduce(
+          (accu, rowAsArray) => {return accu + `${rowAsArray.join(',')}\n`},
+          '');
+      return `data:text/csv;charset=utf-8,${content}`;
+    };
+    const encodedUri = encodeURI(createInlineContent(data));
+    const link = document.createElement('a');
+    link.setAttribute('href', encodedUri);
+    link.setAttribute(
+        'download',
+        `heap_objects_data_${this.selection.isolate}_${this.selection.gc}.csv`);
+    this.shadowRoot.appendChild(link);
+    link.click();
+    this.shadowRoot.removeChild(link);
+  }
 }
 
 customElements.define('details-selection', DetailsSelection);
diff --git a/deps/v8/tools/heap-stats/global-timeline.js b/deps/v8/tools/heap-stats/global-timeline.js
index 0533f214322..a32cf59135a 100644
--- a/deps/v8/tools/heap-stats/global-timeline.js
+++ b/deps/v8/tools/heap-stats/global-timeline.js
@@ -4,9 +4,6 @@
 
 'use strict';
 
-const KB = 1024;
-const MB = KB * KB;
-
 const global_timeline_template =
     document.currentScript.ownerDocument.querySelector(
         '#global-timeline-template');
@@ -70,7 +67,7 @@ class GlobalTimeline extends HTMLElement {
       const gc_data = isolate_data.gcs[gc_key];
       const data_set = gc_data[this.selection.data_set].instance_type_data;
       const data = [];
-      data.push(gc_data.time);
+      data.push(gc_data.time * kMillis2Seconds);
       Object.values(this.selection.categories).forEach(instance_types => {
         data.push(
             instance_types
@@ -86,7 +83,6 @@ class GlobalTimeline extends HTMLElement {
   }
 
   getInstanceTypeData() {
-    const categories = Object.keys(this.selection.categories);
     const instance_types =
         Object.values(this.selection.categories)
             .reduce((accu, current) => accu.concat(current), []);
@@ -97,7 +93,7 @@ class GlobalTimeline extends HTMLElement {
       const gc_data = isolate_data.gcs[gc_key];
       const data_set = gc_data[this.selection.data_set].instance_type_data;
       const data = [];
-      data.push(gc_data.time);
+      data.push(gc_data.time * kMillis2Seconds);
       instance_types.forEach(instance_type => {
         data.push(data_set[instance_type].overall / KB);
       });
@@ -117,10 +113,14 @@ class GlobalTimeline extends HTMLElement {
     const options = {
       isStacked: true,
       hAxis: {
-        title: 'Time [ms]',
+        format: '###.##s',
+        title: 'Time [s]',
+      },
+      vAxis: {
+        format: '#,###KB',
+        title: 'Memory consumption [KBytes]'
       },
-      vAxis: {title: 'Memory consumption [KBytes]'},
-      chartArea: {width: '85%', height: '70%'},
+      chartArea: {left:100, width: '85%', height: '70%'},
       legend: {position: 'top', maxLines: '1'},
       pointsVisible: true,
       pointSize: 5,
diff --git a/deps/v8/tools/heap-stats/helper.js b/deps/v8/tools/heap-stats/helper.js
new file mode 100644
index 00000000000..00f68f9d62a
--- /dev/null
+++ b/deps/v8/tools/heap-stats/helper.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const KB = 1024;
+const MB = KB * KB;
+const GB = MB * KB;
+const kMillis2Seconds = 1 / 1000;
+
+function formatBytes(bytes) {
+  const units = ['B', 'KiB', 'MiB', 'GiB'];
+  const divisor = 1024;
+  let index = 0;
+  while (index < units.length && bytes >= divisor) {
+    index++;
+    bytes /= divisor;
+  }
+  return bytes.toFixed(2) + units[index];
+}
+
+function formatSeconds(millis) {
+  return (millis * kMillis2Seconds).toFixed(2) + 's';
+}
diff --git a/deps/v8/tools/heap-stats/histogram-viewer.html b/deps/v8/tools/heap-stats/histogram-viewer.html
new file mode 100644
index 00000000000..93fe9809780
--- /dev/null
+++ b/deps/v8/tools/heap-stats/histogram-viewer.html
@@ -0,0 +1,19 @@
+<!-- Copyright 2018 the V8 project authors. All rights reserved.
+Use of this source code is governed by a BSD-style license that can be
+found in the LICENSE file. -->
+<template id="histogram-viewer-template">
+<style>
+#chart {
+  width: 100%;
+  height: 800px;
+}
+</style>
+<div id="container" style="display: none;">
+  <h2>Details</h2>
+  <ul>
+    <li><span id="overall"></span></li>
+  </ul>
+  <div id="chart"></div>
+</div>
+</template>
+<script type="text/javascript"  src="histogram-viewer.js"></script>
\ No newline at end of file
diff --git a/deps/v8/tools/heap-stats/histogram-viewer.js b/deps/v8/tools/heap-stats/histogram-viewer.js
new file mode 100644
index 00000000000..d252f4cb1b7
--- /dev/null
+++ b/deps/v8/tools/heap-stats/histogram-viewer.js
@@ -0,0 +1,167 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+'use strict';
+
+const histogram_viewer_template =
+    document.currentScript.ownerDocument.querySelector(
+        '#histogram-viewer-template');
+
+class HistogramViewer extends HTMLElement {
+  constructor() {
+    super();
+    const shadowRoot = this.attachShadow({mode: 'open'});
+    shadowRoot.appendChild(histogram_viewer_template.content.cloneNode(true));
+  }
+
+  $(id) {
+    return this.shadowRoot.querySelector(id);
+  }
+
+  set data(value) {
+    this._data = value;
+    this.stateChanged();
+  }
+
+  get data() {
+    return this._data;
+  }
+
+  set selection(value) {
+    this._selection = value;
+    this.stateChanged();
+  }
+
+  get selection() {
+    return this._selection;
+  }
+
+  isValid() {
+    return this.data && this.selection;
+  }
+
+  hide() {
+    this.$('#container').style.display = 'none';
+  }
+
+  show() {
+    this.$('#container').style.display = 'block';
+  }
+
+  stateChanged() {
+    if (this.isValid()) {
+      const overall_bytes = (this.selection.merge_categories) ?
+          this.getPropertyForCategory('overall') :
+          this.getPropertyForInstanceTypes('overall');
+      this.$('#overall').innerHTML = `Overall: ${overall_bytes / KB} KB`;
+      this.drawChart();
+    } else {
+      this.hide();
+    }
+  }
+
+  get selectedData() {
+    console.assert(this.data, 'invalid data');
+    console.assert(this.selection, 'invalid selection');
+    return this.data[this.selection.isolate]
+        .gcs[this.selection.gc][this.selection.data_set];
+  }
+
+  get selectedInstanceTypes() {
+    console.assert(this.selection, 'invalid selection');
+    return Object.values(this.selection.categories)
+        .reduce((accu, current) => accu.concat(current), []);
+  }
+
+  getPropertyForCategory(property) {
+    return Object.values(this.selection.categories)
+        .reduce(
+            (outer_accu, instance_types) => outer_accu +
+                instance_types.reduce(
+                    (inner_accu, instance_type) => inner_accu +
+                        this.selectedData
+                            .instance_type_data[instance_type][property],
+                    0),
+            0);
+  }
+
+  getPropertyForInstanceTypes(property) {
+    return this.selectedInstanceTypes.reduce(
+        (accu, instance_type) => accu +
+            this.selectedData.instance_type_data[instance_type][property],
+        0);
+  }
+
+  formatBytes(bytes) {
+    const units = ['B', 'KiB', 'MiB'];
+    const divisor = 1024;
+    let index = 0;
+    while (index < units.length && bytes >= divisor) {
+      index++;
+      bytes /= divisor;
+    }
+    return bytes + units[index];
+  }
+
+  getCategoryData() {
+    const labels = [
+      'Bucket',
+      ...Object.keys(this.selection.categories)
+          .map(k => this.selection.category_names.get(k))
+    ];
+    const data = this.selectedData.bucket_sizes.map(
+        (bucket_size, index) =>
+            [`<${this.formatBytes(bucket_size)}`,
+             ...Object.values(this.selection.categories)
+                 .map(
+                     instance_types =>
+                         instance_types
+                             .map(
+                                 instance_type =>
+                                     this.selectedData
+                                         .instance_type_data[instance_type]
+                                         .histogram[index])
+                             .reduce((accu, current) => accu + current, 0))]);
+    // Adjust last histogram bucket label.
+    data[data.length - 1][0] = 'rest';
+    return [labels, ...data];
+  }
+
+  getInstanceTypeData() {
+    const instance_types = this.selectedInstanceTypes;
+    const labels = ['Bucket', ...instance_types];
+    const data = this.selectedData.bucket_sizes.map(
+        (bucket_size, index) =>
+            [`<${bucket_size}`,
+             ...instance_types.map(
+                 instance_type =>
+                     this.selectedData.instance_type_data[instance_type]
+                         .histogram[index])]);
+    // Adjust last histogram bucket label.
+    data[data.length - 1][0] = 'rest';
+    return [labels, ...data];
+  }
+
+  drawChart() {
+    const chart_data = (this.selection.merge_categories) ?
+        this.getCategoryData() :
+        this.getInstanceTypeData();
+    const data = google.visualization.arrayToDataTable(chart_data);
+    const options = {
+      legend: {position: 'top', maxLines: '1'},
+      chartArea: {width: '85%', height: '85%'},
+      bar: {groupWidth: '80%'},
+      hAxis: {
+        title: 'Count',
+        minValue: 0
+      },
+      explorer: {},
+    };
+    const chart = new google.visualization.BarChart(this.$('#chart'));
+    this.show();
+    chart.draw(data, options);
+  }
+}
+
+customElements.define('histogram-viewer', HistogramViewer);
diff --git a/deps/v8/tools/heap-stats/index.html b/deps/v8/tools/heap-stats/index.html
index 3c2e62b6d0b..648a38c798b 100644
--- a/deps/v8/tools/heap-stats/index.html
+++ b/deps/v8/tools/heap-stats/index.html
@@ -8,15 +8,22 @@
 <head>
   <meta charset="UTF-8">
   <title>V8 Heap Statistics</title>
-  <link href='https://fonts.googleapis.com/css?family=Roboto' rel='stylesheet' type='text/css'>
-  <script type="text/javascript" src="https://www.gstatic.com/charts/loader.js"></script>
+  <link href='https://fonts.googleapis.com/css?family=Roboto' rel='stylesheet'>
+  <script
+          src="https://www.gstatic.com/charts/loader.js"></script>
+  <script
+          src="https://cdnjs.cloudflare.com/ajax/libs/pako/1.0.6/pako_inflate.min.js"
+          integrity="sha256-N1z6ddQzX83fjw8v7uSNe7/MgOmMKdwFUv1+AJMDqNM="
+          crossorigin="anonymous"></script>
+
+  <script src="helper.js"></script>
 
   <link rel="import" href="details-selection.html">
   <link rel="import" href="global-timeline.html">
+  <link rel="import" href="histogram-viewer.html">
   <link rel="import" href="trace-file-reader.html">
 
-  <style type="text/css">
-
+  <style>
 body {
   font-family: 'Roboto', sans-serif;
   margin-left: 5%;
@@ -24,11 +31,11 @@
 }
 
   </style>
-  <script type="text/javascript">
+  <script>
 
 'use strict';
 
-google.charts.load('current', {'packages':['line', 'corechart']});
+google.charts.load('current', {'packages':['line', 'corechart', 'bar']});
 
 function $(id) { return document.querySelector(id); }
 
@@ -47,42 +54,48 @@
   state.selection = null;
   $('#global-timeline').selection = state.selection;
   $('#global-timeline').data = state.data;
-  $('#type-details').selection = state.selection;
-  $('#type-details').data = state.data;
+  $('#histogram-viewer').selection = state.selection;
+  $('#histogram-viewer').data = state.data;
   $('#details-selection').data = state.data;
 }
 
 function globalSelectionChangedA(e) {
   state.selection = e.detail;
+  console.log(state.selection);
   $('#global-timeline').selection = state.selection;
-  $('#type-details').selection = state.selection;
+  $('#histogram-viewer').selection = state.selection;
 }
 
   </script>
 </head>
 
 <body>
-  <trace-file-reader onchange="globalDataChanged(event)"></trace-file-reader>
   <h1>V8 Heap Statistics</h1>
+  <trace-file-reader onchange="globalDataChanged(event)"></trace-file-reader>
+
+  <details-selection id="details-selection" onchange="globalSelectionChangedA(event)"></details-selection>
+  <global-timeline id="global-timeline"></global-timeline>
+  <histogram-viewer id="histogram-viewer"></histogram-viewer>
+
   <p>Visualize object statistics that have been gathered using</p>
   <ul>
-    <li><code>--trace-gc-object-stats on V8</code></li>
+    <li><code>--trace-gc-object-stats</code> on V8</li>
     <li>
       <a
         href="https://www.chromium.org/developers/how-tos/trace-event-profiling-tool">Chrome's
         tracing infrastructure</a> collecting data for the category
-      <code>v8.gc_stats</code>. The trace file needs to be unpacked (e.g. using
-      <code>gunzip</code>).
+      <code>v8.gc_stats</code>.
     </li>
   </ul>
+  <p>
+    Note that you only get a data point on major GCs. You can enforce this by
+    using the <code>--gc-global</code> flag.
+  </p>
   <p>
     Note that the visualizer needs to run on a web server due to HTML imports
     requiring <a
          href="https://en.wikipedia.org/wiki/Cross-origin_resource_sharing">CORS</a>.
   </p>
-  <details-selection id="details-selection" onchange="globalSelectionChangedA(event)"></details-selection>
-  <global-timeline id="global-timeline"></global-timeline>
-  <type-details id="type-details"></type-details>
 </body>
 
 </html>
diff --git a/deps/v8/tools/heap-stats/model.js b/deps/v8/tools/heap-stats/model.js
new file mode 100644
index 00000000000..cd6e1e514ea
--- /dev/null
+++ b/deps/v8/tools/heap-stats/model.js
@@ -0,0 +1,105 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+'use strict';
+
+class Isolate {
+  constructor(address) {
+    this.address = address;
+    this.start = null;
+    this.end = null;
+    this.samples = Object.create(null);
+    this.non_empty_instance_types = new Set();
+    this.gcs = Object.create(null);
+    this.zonetags = [];
+    this.samples = {zone: {}};
+    this.data_sets = new Set();
+    this.peakMemory = 0;
+    // Maps instance_types to their max memory consumption over all gcs.
+    this.instanceTypePeakMemory = Object.create(null);
+    // Peak memory consumed by any single instance type.
+    this.singleInstanceTypePeakMemory = 0;
+  }
+
+  finalize() {
+    Object.values(this.gcs).forEach(gc => this.finalizeGC(gc));
+    this.sortInstanceTypePeakMemory();
+  }
+
+  getLabel() {
+    let label = `${this.address}: gc=#${Object.keys(this.gcs).length}`;
+    label += ` peak=${formatBytes(this.peakMemory)}`
+    return label;
+  }
+
+  finalizeGC(gc_data) {
+    this.data_sets.forEach(key => this.finalizeDataSet(gc_data[key]));
+    if (!('live' in gc_data)) return;
+    let liveData = gc_data.live;
+    this.peakMemory = Math.max(this.peakMemory, liveData.overall);
+    let data = liveData.instance_type_data;
+    for (let name in data) {
+      let prev = this.instanceTypePeakMemory[name] || 0;
+      this.instanceTypePeakMemory[name] = Math.max(prev, data[name].overall);
+    }
+  }
+
+  finalizeDataSet(data_set) {
+    // Create a ranked instance type array that sorts instance types by
+    // memory size (overall).
+    let data = data_set.instance_type_data;
+    let ranked_instance_types =
+        [...data_set.non_empty_instance_types].sort((a, b) => {
+          return data[a].overall - data[b].overall;
+        });
+    // Reassemble the instance_type list sorted by size.
+    let sorted_data = Object.create(null);
+    let max = 0;
+    ranked_instance_types.forEach((name) => {
+      let entry = sorted_data[name] = data[name];
+      max = Math.max(max, entry.overall);
+    });
+    data_set.instance_type_data = data;
+    data_set.singleInstancePeakMemory = max;
+
+    Object.entries(data_set.instance_type_data).forEach(([name, entry]) => {
+      this.checkHistogram(
+          name, entry, data_set.bucket_sizes, 'histogram', ' overall');
+      this.checkHistogram(
+          name, entry, data_set.bucket_sizes, 'over_allocated_histogram',
+          ' over_allocated');
+    });
+  }
+
+  // Check that a lower bound for histogram memory does not exceed the
+  // overall counter.
+  checkHistogram(type, entry, bucket_sizes, histogram, overallProperty) {
+    let sum = 0;
+    for (let i = 1; i < entry[histogram].length; i++) {
+      sum += entry[histogram][i] * bucket_sizes[i - 1];
+    }
+    const overall = entry[overallProperty];
+    if (sum >= overall) {
+      console.error(
+          `${type}: sum('${histogram}') > overall (${sum} > ${overall})`);
+    }
+  }
+
+  sortInstanceTypePeakMemory() {
+    let entries = Object.entries(this.instanceTypePeakMemory);
+    entries.sort((a, b) => {return b[1] - a[1]});
+    this.instanceTypePeakMemory = Object.create(null);
+    let max = 0;
+    for (let [key, value] of entries) {
+      this.instanceTypePeakMemory[key] = value;
+      max = Math.max(max, value);
+    }
+    this.singleInstanceTypePeakMemory = max;
+  }
+
+  getInstanceTypePeakMemory(type) {
+    if (!(type in this.instanceTypePeakMemory)) return 0;
+    return this.instanceTypePeakMemory[type];
+  }
+}
diff --git a/deps/v8/tools/heap-stats/trace-file-reader.html b/deps/v8/tools/heap-stats/trace-file-reader.html
index 98c2ef0c606..649d32bb406 100644
--- a/deps/v8/tools/heap-stats/trace-file-reader.html
+++ b/deps/v8/tools/heap-stats/trace-file-reader.html
@@ -10,17 +10,77 @@
   text-align: center;
   border: solid 1px #000000;
   border-radius: 5px;
+  cursor: pointer;
+  transition: all 0.5s ease-in-out;
+}
+
+#fileReader.done {
+    height: 20px;
+    line-height: 20px;
+}
+
+#fileReader:hover {
+  background-color: #e0edfe ;
+}
+
+.loading #fileReader {
+  cursor: wait;
 }
 
 #fileReader > input {
   display: none;
 }
+
+
+#loader {
+  display: none;
+}
+
+.loading #loader {
+  display: block;
+  position: fixed;
+  top: 0px;
+  left: 0px;
+  width: 100%;
+  height: 100%;
+  background-color: rgba(255, 255, 255, 0.5);
+}
+
+#spinner {
+  position: absolute;
+  width: 100px;
+  height: 100px;
+  top: 40%;
+  left: 50%;
+  margin-left: -50px;
+  border: 30px solid #000;
+  border-top: 30px solid #36E;
+  border-radius: 50%;
+  animation: spin 1s ease-in-out infinite;
+}
+
+@keyframes spin {
+  0% {
+    transform: rotate(0deg);
+ };
+  100% {
+    transform: rotate(360deg);
+  };
+}
 </style>
-<div id="fileReader">
-  <span id="label">
-    Drag and drop a trace file into this area, or click to choose from disk.
-   </span>
-  <input id="file" type="file" name="file" />
-</div>
+
+<section id="fileReaderSection">
+  <div id="fileReader" tabindex=1 >
+    <span id="label">
+      Drag and drop a trace file into this area, or click to choose from disk.
+     </span>
+    <input id="file" type="file" name="file" />
+  </div>
+  <div id="loader">
+    <div id="spinner"></div>
+  </div>
+</section>
 </template>
-<script type="text/javascript" src="trace-file-reader.js"></script>
+<script type="text/javascript" src="model.js"></script>
+
+<script src="trace-file-reader.js"></script>
diff --git a/deps/v8/tools/heap-stats/trace-file-reader.js b/deps/v8/tools/heap-stats/trace-file-reader.js
index 59825fe514e..4ad1269835b 100644
--- a/deps/v8/tools/heap-stats/trace-file-reader.js
+++ b/deps/v8/tools/heap-stats/trace-file-reader.js
@@ -17,16 +17,25 @@ class TraceFileReader extends HTMLElement {
     this.addEventListener('dragover', e => this.handleDragOver(e));
     this.addEventListener('drop', e => this.handleChange(e));
     this.$('#file').addEventListener('change', e => this.handleChange(e));
+    this.$('#fileReader').addEventListener('keydown', e => this.handleKeyEvent(e));
   }
 
   $(id) {
     return this.shadowRoot.querySelector(id);
   }
 
+  get section() {
+    return this.$('#fileReaderSection');
+  }
+
   updateLabel(text) {
     this.$('#label').innerText = text;
   }
 
+  handleKeyEvent(event) {
+    if (event.key == "Enter") this.handleClick(event);
+  }
+
   handleClick(event) {
     this.$('#file').click();
   }
@@ -42,56 +51,71 @@ class TraceFileReader extends HTMLElement {
     event.preventDefault();
   }
 
-  connectedCallback() {}
+  connectedCallback() {
+    this.$('#fileReader').focus();
+  }
 
   readFile(file) {
     if (!file) {
       this.updateLabel('Failed to load file.');
       return;
     }
+    this.$('#fileReader').blur();
 
-    const result = new FileReader();
-    result.onload = (e) => {
-      let contents = e.target.result.split('\n');
-      const return_data = (e.target.result.includes('V8.GC_Objects_Stats')) ?
-          this.createModelFromChromeTraceFile(contents) :
-          this.createModelFromV8TraceFile(contents);
-      this.updateLabel('Finished loading \'' + file.name + '\'.');
-      this.dispatchEvent(new CustomEvent(
-          'change', {bubbles: true, composed: true, detail: return_data}));
-    };
-    result.readAsText(file);
+    this.section.className = 'loading';
+    const reader = new FileReader();
+
+    if (['application/gzip', 'application/x-gzip'].includes(file.type)) {
+      reader.onload = (e) => {
+        try {
+          const textResult = pako.inflate(e.target.result, {to: 'string'});
+          this.processRawText(file, textResult);
+          this.section.className = 'success';
+          this.$('#fileReader').classList.add('done');
+        } catch (err) {
+          console.error(err);
+          this.section.className = 'failure';
+        }
+      };
+      // Delay the loading a bit to allow for CSS animations to happen.
+      setTimeout(() => reader.readAsArrayBuffer(file), 10);
+    } else {
+      reader.onload = (e) => this.processRawText(file, e.target.result);
+      setTimeout(() => reader.readAsText(file), 10);
+    }
+  }
+
+  processRawText(file, result) {
+    let contents = result.split('\n');
+    const return_data = (result.includes('V8.GC_Objects_Stats')) ?
+        this.createModelFromChromeTraceFile(contents) :
+        this.createModelFromV8TraceFile(contents);
+    this.extendAndSanitizeModel(return_data);
+    this.updateLabel('Finished loading \'' + file.name + '\'.');
+    this.dispatchEvent(new CustomEvent(
+        'change', {bubbles: true, composed: true, detail: return_data}));
   }
 
-  createOrUpdateEntryIfNeeded(data, keys, entry) {
+  createOrUpdateEntryIfNeeded(data, entry) {
     console.assert(entry.isolate, 'entry should have an isolate');
-    if (!(entry.isolate in keys)) {
-      keys[entry.isolate] = new Set();
-    }
     if (!(entry.isolate in data)) {
-      data[entry.isolate] = {
-        non_empty_instance_types: new Set(),
-        gcs: {},
-        zonetags: [],
-        samples: {zone: {}},
-        start: null,
-        end: null,
-        data_sets: new Set()
-      };
+      data[entry.isolate] = new Isolate(entry.isolate);
     }
     const data_object = data[entry.isolate];
     if (('id' in entry) && !(entry.id in data_object.gcs)) {
       data_object.gcs[entry.id] = {non_empty_instance_types: new Set()};
     }
     if ('time' in entry) {
-      if (data_object.end === null || data_object.end < entry.time)
+      if (data_object.end === null || data_object.end < entry.time) {
         data_object.end = entry.time;
-      if (data_object.start === null || data_object.start > entry.time)
+      }
+      if (data_object.start === null || data_object.start > entry.time) {
         data_object.start = entry.time;
+      }
     }
   }
 
-  createDatasetIfNeeded(data, keys, entry, data_set) {
+  createDatasetIfNeeded(data, entry, data_set) {
     if (!(data_set in data[entry.isolate].gcs[entry.id])) {
       data[entry.isolate].gcs[entry.id][data_set] = {
         instance_type_data: {},
@@ -102,9 +126,7 @@ class TraceFileReader extends HTMLElement {
     }
   }
 
-  addInstanceTypeData(
-      data, keys, isolate, gc_id, data_set, instance_type, entry) {
-    keys[isolate].add(data_set);
+  addInstanceTypeData(data, isolate, gc_id, data_set, instance_type, entry) {
     data[isolate].gcs[gc_id][data_set].instance_type_data[instance_type] = {
       overall: entry.overall,
       count: entry.count,
@@ -121,117 +143,75 @@ class TraceFileReader extends HTMLElement {
     }
   }
 
-  extendAndSanitizeModel(data, keys) {
+  extendAndSanitizeModel(data) {
     const checkNonNegativeProperty = (obj, property) => {
       console.assert(obj[property] >= 0, 'negative property', obj, property);
     };
 
-    for (const isolate of Object.keys(data)) {
-      for (const gc of Object.keys(data[isolate].gcs)) {
-        for (const data_set_key of keys[isolate]) {
-          const data_set = data[isolate].gcs[gc][data_set_key];
-          // 1. Create a ranked instance type array that sorts instance
-          // types by memory size (overall).
-          data_set.ranked_instance_types =
-              [...data_set.non_empty_instance_types].sort(function(a, b) {
-                if (data_set.instance_type_data[a].overall >
-                    data_set.instance_type_data[b].overall) {
-                  return 1;
-                } else if (
-                    data_set.instance_type_data[a].overall <
-                    data_set.instance_type_data[b].overall) {
-                  return -1;
-                }
-                return 0;
-              });
-
-          let known_count = 0;
-          let known_overall = 0;
-          let known_histogram =
-              Array(
-                  data_set.instance_type_data.FIXED_ARRAY_TYPE.histogram.length)
-                  .fill(0);
-          for (const instance_type in data_set.instance_type_data) {
-            if (!instance_type.startsWith('*FIXED_ARRAY')) continue;
-            const subtype = data_set.instance_type_data[instance_type];
-            known_count += subtype.count;
-            known_overall += subtype.count;
-            for (let i = 0; i < subtype.histogram.length; i++) {
-              known_histogram[i] += subtype.histogram[i];
-            }
-          }
-
-          const fixed_array_data = data_set.instance_type_data.FIXED_ARRAY_TYPE;
-          const unknown_entry = {
-            count: fixed_array_data.count - known_count,
-            overall: fixed_array_data.overall - known_overall,
-            histogram: fixed_array_data.histogram.map(
-                (value, index) => value - known_histogram[index])
-          };
-
-          // Check for non-negative values.
-          checkNonNegativeProperty(unknown_entry, 'count');
-          checkNonNegativeProperty(unknown_entry, 'overall');
-          for (let i = 0; i < unknown_entry.histogram.length; i++) {
-            checkNonNegativeProperty(unknown_entry.histogram, i);
-          }
-
-          data_set.instance_type_data['*FIXED_ARRAY_UNKNOWN_SUB_TYPE'] =
-              unknown_entry;
-          data_set.non_empty_instance_types.add(
-              '*FIXED_ARRAY_UNKNOWN_SUB_TYPE');
-        }
-      }
-    }
+    Object.values(data).forEach(isolate => isolate.finalize());
   }
 
   createModelFromChromeTraceFile(contents) {
-    console.log('Processing log as chrome trace file.');
-    const data = Object.create(null);  // Final data container.
-    const keys = Object.create(null);  // Collecting 'keys' per isolate.
+    // Trace files support two formats.
+    // {traceEvents: [ data ]}
+    const kObjectTraceFile = {
+      name: 'object',
+      endToken: ']}',
+      getDataArray: o => o.traceEvents
+    };
+    // [ data ]
+    const kArrayTraceFile = {
+      name: 'array',
+      endToken: ']',
+      getDataArray: o => o
+    };
+    const handler =
+        (contents[0][0] === '{') ? kObjectTraceFile : kArrayTraceFile;
+    console.log(`Processing log as chrome trace file (${handler.name}).`);
 
     // Pop last line in log as it might be broken.
     contents.pop();
     // Remove trailing comma.
     contents[contents.length - 1] = contents[contents.length - 1].slice(0, -1);
     // Terminate JSON.
-    const sanitized_contents = [...contents, ']}'].join('');
+    const sanitized_contents = [...contents, handler.endToken].join('');
+
+    const data = Object.create(null);  // Final data container.
     try {
       const raw_data = JSON.parse(sanitized_contents);
-      const objects_stats_data =
-          raw_data.traceEvents.filter(e => e.name == 'V8.GC_Objects_Stats');
-      objects_stats_data.forEach(trace_data => {
-        const actual_data = trace_data.args;
-        const data_sets = new Set(Object.keys(actual_data));
-        Object.keys(actual_data).forEach(data_set => {
-          const string_entry = actual_data[data_set];
-          try {
-            const entry = JSON.parse(string_entry);
-            this.createOrUpdateEntryIfNeeded(data, keys, entry);
-            this.createDatasetIfNeeded(data, keys, entry, data_set);
-            const isolate = entry.isolate;
-            const time = entry.time;
-            const gc_id = entry.id;
-            data[isolate].gcs[gc_id].time = time;
-            data[isolate].gcs[gc_id][data_set].bucket_sizes =
-                entry.bucket_sizes;
-            for (let [instance_type, value] of Object.entries(
-                     entry.type_data)) {
-              // Trace file format uses markers that do not have actual
-              // properties.
-              if (!('overall' in value)) continue;
-              this.addInstanceTypeData(
-                  data, keys, isolate, gc_id, data_set, instance_type, value);
-            }
-          } catch (e) {
-            console.log('Unable to parse data set entry', e);
-          }
-        });
-      });
+      const raw_array_data = handler.getDataArray(raw_data);
+      raw_array_data.filter(e => e.name === 'V8.GC_Objects_Stats')
+          .forEach(trace_data => {
+            const actual_data = trace_data.args;
+            const data_sets = new Set(Object.keys(actual_data));
+            Object.keys(actual_data).forEach(data_set => {
+              const string_entry = actual_data[data_set];
+              try {
+                const entry = JSON.parse(string_entry);
+                this.createOrUpdateEntryIfNeeded(data, entry);
+                this.createDatasetIfNeeded(data, entry, data_set);
+                const isolate = entry.isolate;
+                const time = entry.time;
+                const gc_id = entry.id;
+                data[isolate].gcs[gc_id].time = time;
+                data[isolate].gcs[gc_id][data_set].bucket_sizes =
+                    entry.bucket_sizes;
+                for (let [instance_type, value] of Object.entries(
+                         entry.type_data)) {
+                  // Trace file format uses markers that do not have actual
+                  // properties.
+                  if (!('overall' in value)) continue;
+                  this.addInstanceTypeData(
+                      data, isolate, gc_id, data_set, instance_type, value);
+                }
+              } catch (e) {
+                console.log('Unable to parse data set entry', e);
+              }
+            });
+          });
     } catch (e) {
-      console.log('Unable to parse chrome trace file.', e);
+      console.error('Unable to parse chrome trace file.', e);
     }
-    this.extendAndSanitizeModel(data, keys);
     return data;
   }
 
@@ -249,14 +229,12 @@ class TraceFileReader extends HTMLElement {
     });
 
     const data = Object.create(null);  // Final data container.
-    const keys = Object.create(null);  // Collecting 'keys' per isolate.
-
     for (var entry of contents) {
       if (entry === null || entry.type === undefined) {
         continue;
       }
       if (entry.type === 'zone') {
-        this.createOrUpdateEntryIfNeeded(data, keys, entry);
+        this.createOrUpdateEntryIfNeeded(data, entry);
         const stacktrace = ('stacktrace' in entry) ? entry.stacktrace : [];
         data[entry.isolate].samples.zone[entry.time] = {
           allocated: entry.allocated,
@@ -265,26 +243,26 @@ class TraceFileReader extends HTMLElement {
         };
       } else if (
           entry.type === 'zonecreation' || entry.type === 'zonedestruction') {
-        this.createOrUpdateEntryIfNeeded(data, keys, entry);
+        this.createOrUpdateEntryIfNeeded(data, entry);
         data[entry.isolate].zonetags.push(
             Object.assign({opening: entry.type === 'zonecreation'}, entry));
       } else if (entry.type === 'gc_descriptor') {
-        this.createOrUpdateEntryIfNeeded(data, keys, entry);
+        this.createOrUpdateEntryIfNeeded(data, entry);
         data[entry.isolate].gcs[entry.id].time = entry.time;
         if ('zone' in entry)
           data[entry.isolate].gcs[entry.id].malloced = entry.zone;
       } else if (entry.type === 'instance_type_data') {
         if (entry.id in data[entry.isolate].gcs) {
-          this.createOrUpdateEntryIfNeeded(data, keys, entry);
-          this.createDatasetIfNeeded(data, keys, entry, entry.key);
+          this.createOrUpdateEntryIfNeeded(data, entry);
+          this.createDatasetIfNeeded(data, entry, entry.key);
           this.addInstanceTypeData(
-              data, keys, entry.isolate, entry.id, entry.key,
+              data, entry.isolate, entry.id, entry.key,
               entry.instance_type_name, entry);
         }
       } else if (entry.type === 'bucket_sizes') {
         if (entry.id in data[entry.isolate].gcs) {
-          this.createOrUpdateEntryIfNeeded(data, keys, entry);
-          this.createDatasetIfNeeded(data, keys, entry, entry.key);
+          this.createOrUpdateEntryIfNeeded(data, entry);
+          this.createDatasetIfNeeded(data, entry, entry.key);
           data[entry.isolate].gcs[entry.id][entry.key].bucket_sizes =
               entry.sizes;
         }
@@ -292,7 +270,6 @@ class TraceFileReader extends HTMLElement {
         console.log('Unknown entry type: ' + entry.type);
       }
     }
-    this.extendAndSanitizeModel(data, keys);
     return data;
   }
 }
diff --git a/deps/v8/tools/ic-processor.js b/deps/v8/tools/ic-processor.js
index 93f40b38a08..9a78d16943f 100644
--- a/deps/v8/tools/ic-processor.js
+++ b/deps/v8/tools/ic-processor.js
@@ -56,6 +56,9 @@ function IcProcessor() {
       'KeyedStoreIC': {
         parsers : propertyICParser,
         processor: this.processPropertyIC.bind(this, "KeyedStoreIC") },
+      'StoreInArrayLiteralIC': {
+        parsers : propertyICParser,
+        processor: this.processPropertyIC.bind(this, "StoreInArrayLiteralIC") },
       });
   this.deserializedEntriesNames_ = [];
   this.profile_ = new Profile();
@@ -64,6 +67,7 @@ function IcProcessor() {
   this.StoreIC = 0;
   this.KeyedLoadIC = 0;
   this.KeyedStoreIC = 0;
+  this.StoreInArrayLiteralIC = 0;
 }
 inherits(IcProcessor, LogReader);
 
@@ -104,6 +108,7 @@ IcProcessor.prototype.processLogFile = function(fileName) {
   print("Store: " + this.StoreIC);
   print("KeyedLoad: " + this.KeyedLoadIC);
   print("KeyedStore: " + this.KeyedStoreIC);
+  print("StoreInArrayLiteral: " + this.StoreInArrayLiteralIC);
 };
 
 IcProcessor.prototype.addEntry = function(entry) {
diff --git a/deps/v8/tools/isolate_driver.py b/deps/v8/tools/isolate_driver.py
deleted file mode 100644
index a6bcfbf71f9..00000000000
--- a/deps/v8/tools/isolate_driver.py
+++ /dev/null
@@ -1,340 +0,0 @@
-#!/usr/bin/env python
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Copyright 2014 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-"""Adaptor script called through build/isolate.gypi.
-
-Creates a wrapping .isolate which 'includes' the original one, that can be
-consumed by tools/swarming_client/isolate.py. Path variables are determined
-based on the current working directory. The relative_cwd in the .isolated file
-is determined based on the .isolate file that declare the 'command' variable to
-be used so the wrapping .isolate doesn't affect this value.
-
-This script loads build.ninja and processes it to determine all the executables
-referenced by the isolated target. It adds them in the wrapping .isolate file.
-
-WARNING: The target to use for build.ninja analysis is the base name of the
-.isolate file plus '_run'. For example, 'foo_test.isolate' would have the target
-'foo_test_run' analysed.
-"""
-
-import errno
-import glob
-import json
-import logging
-import os
-import posixpath
-import StringIO
-import subprocess
-import sys
-import time
-
-TOOLS_DIR = os.path.dirname(os.path.abspath(__file__))
-SWARMING_CLIENT_DIR = os.path.join(TOOLS_DIR, 'swarming_client')
-SRC_DIR = os.path.dirname(TOOLS_DIR)
-
-sys.path.insert(0, SWARMING_CLIENT_DIR)
-
-import isolate_format
-
-
-def load_ninja_recursively(build_dir, ninja_path, build_steps):
-  """Crudely extracts all the subninja and build referenced in ninja_path.
-
-  In particular, it ignores rule and variable declarations. The goal is to be
-  performant (well, as much as python can be performant) which is currently in
-  the <200ms range for a complete chromium tree. As such the code is laid out
-  for performance instead of readability.
-  """
-  logging.debug('Loading %s', ninja_path)
-  try:
-    with open(os.path.join(build_dir, ninja_path), 'rb') as f:
-      line = None
-      merge_line = ''
-      subninja = []
-      for line in f:
-        line = line.rstrip()
-        if not line:
-          continue
-
-        if line[-1] == '$':
-          # The next line needs to be merged in.
-          merge_line += line[:-1]
-          continue
-
-        if merge_line:
-          line = merge_line + line
-          merge_line = ''
-
-        statement = line[:line.find(' ')]
-        if statement == 'build':
-          # Save the dependency list as a raw string. Only the lines needed will
-          # be processed with raw_build_to_deps(). This saves a good 70ms of
-          # processing time.
-          build_target, dependencies = line[6:].split(': ', 1)
-          # Interestingly, trying to be smart and only saving the build steps
-          # with the intended extensions ('', '.stamp', '.so') slows down
-          # parsing even if 90% of the build rules can be skipped.
-          # On Windows, a single step may generate two target, so split items
-          # accordingly. It has only been seen for .exe/.exe.pdb combos.
-          for i in build_target.strip().split():
-            build_steps[i] = dependencies
-        elif statement == 'subninja':
-          subninja.append(line[9:])
-  except IOError:
-    print >> sys.stderr, 'Failed to open %s' % ninja_path
-    raise
-
-  total = 1
-  for rel_path in subninja:
-    try:
-      # Load each of the files referenced.
-      # TODO(maruel): Skip the files known to not be needed. It saves an aweful
-      # lot of processing time.
-      total += load_ninja_recursively(build_dir, rel_path, build_steps)
-    except IOError:
-      print >> sys.stderr, '... as referenced by %s' % ninja_path
-      raise
-  return total
-
-
-def load_ninja(build_dir):
-  """Loads the tree of .ninja files in build_dir."""
-  build_steps = {}
-  total = load_ninja_recursively(build_dir, 'build.ninja', build_steps)
-  logging.info('Loaded %d ninja files, %d build steps', total, len(build_steps))
-  return build_steps
-
-
-def using_blacklist(item):
-  """Returns True if an item should be analyzed.
-
-  Ignores many rules that are assumed to not depend on a dynamic library. If
-  the assumption doesn't hold true anymore for a file format, remove it from
-  this list. This is simply an optimization.
-  """
-  # *.json is ignored below, *.isolated.gen.json is an exception, it is produced
-  # by isolate_driver.py in 'test_isolation_mode==prepare'.
-  if item.endswith('.isolated.gen.json'):
-    return True
-  IGNORED = (
-    '.a', '.cc', '.css', '.dat', '.def', '.frag', '.h', '.html', '.isolate',
-    '.js', '.json', '.manifest', '.o', '.obj', '.pak', '.png', '.pdb', '.py',
-    '.strings', '.test', '.txt', '.vert',
-  )
-  # ninja files use native path format.
-  ext = os.path.splitext(item)[1]
-  if ext in IGNORED:
-    return False
-  # Special case Windows, keep .dll.lib but discard .lib.
-  if item.endswith('.dll.lib'):
-    return True
-  if ext == '.lib':
-    return False
-  return item not in ('', '|', '||')
-
-
-def raw_build_to_deps(item):
-  """Converts a raw ninja build statement into the list of interesting
-  dependencies.
-  """
-  # TODO(maruel): Use a whitelist instead? .stamp, .so.TOC, .dylib.TOC,
-  # .dll.lib, .exe and empty.
-  # The first item is the build rule, e.g. 'link', 'cxx', 'phony', etc.
-  return filter(using_blacklist, item.split(' ')[1:])
-
-
-def collect_deps(target, build_steps, dependencies_added, rules_seen):
-  """Recursively adds all the interesting dependencies for |target|
-  into |dependencies_added|.
-  """
-  if rules_seen is None:
-    rules_seen = set()
-  if target in rules_seen:
-    # TODO(maruel): Figure out how it happens.
-    logging.warning('Circular dependency for %s!', target)
-    return
-  rules_seen.add(target)
-  try:
-    dependencies = raw_build_to_deps(build_steps[target])
-  except KeyError:
-    logging.info('Failed to find a build step to generate: %s', target)
-    return
-  logging.debug('collect_deps(%s) -> %s', target, dependencies)
-  for dependency in dependencies:
-    dependencies_added.add(dependency)
-    collect_deps(dependency, build_steps, dependencies_added, rules_seen)
-
-
-def post_process_deps(build_dir, dependencies):
-  """Processes the dependency list with OS specific rules."""
-  def filter_item(i):
-    if i.endswith('.so.TOC'):
-      # Remove only the suffix .TOC, not the .so!
-      return i[:-4]
-    if i.endswith('.dylib.TOC'):
-      # Remove only the suffix .TOC, not the .dylib!
-      return i[:-4]
-    if i.endswith('.dll.lib'):
-      # Remove only the suffix .lib, not the .dll!
-      return i[:-4]
-    return i
-
-  def is_exe(i):
-    # This script is only for adding new binaries that are created as part of
-    # the component build.
-    ext = os.path.splitext(i)[1]
-    # On POSIX, executables have no extension.
-    if ext not in ('', '.dll', '.dylib', '.exe', '.nexe', '.so'):
-      return False
-    if os.path.isabs(i):
-      # In some rare case, there's dependency set explicitly on files outside
-      # the checkout.
-      return False
-
-    # Check for execute access and strip directories. This gets rid of all the
-    # phony rules.
-    p = os.path.join(build_dir, i)
-    return os.access(p, os.X_OK) and not os.path.isdir(p)
-
-  return filter(is_exe, map(filter_item, dependencies))
-
-
-def create_wrapper(args, isolate_index, isolated_index):
-  """Creates a wrapper .isolate that add dynamic libs.
-
-  The original .isolate is not modified.
-  """
-  cwd = os.getcwd()
-  isolate = args[isolate_index]
-  # The code assumes the .isolate file is always specified path-less in cwd. Fix
-  # if this assumption doesn't hold true.
-  assert os.path.basename(isolate) == isolate, isolate
-
-  # This will look like ../out/Debug. This is based against cwd. Note that this
-  # must equal the value provided as PRODUCT_DIR.
-  build_dir = os.path.dirname(args[isolated_index])
-
-  # This will look like chrome/unit_tests.isolate. It is based against SRC_DIR.
-  # It's used to calculate temp_isolate.
-  src_isolate = os.path.relpath(os.path.join(cwd, isolate), SRC_DIR)
-
-  # The wrapping .isolate. This will look like
-  # ../out/Debug/gen/chrome/unit_tests.isolate.
-  temp_isolate = os.path.join(build_dir, 'gen', src_isolate)
-  temp_isolate_dir = os.path.dirname(temp_isolate)
-
-  # Relative path between the new and old .isolate file.
-  isolate_relpath = os.path.relpath(
-      '.', temp_isolate_dir).replace(os.path.sep, '/')
-
-  # It's a big assumption here that the name of the isolate file matches the
-  # primary target '_run'. Fix accordingly if this doesn't hold true, e.g.
-  # complain to maruel@.
-  target = isolate[:-len('.isolate')] + '_run'
-  build_steps = load_ninja(build_dir)
-  binary_deps = set()
-  collect_deps(target, build_steps, binary_deps, None)
-  binary_deps = post_process_deps(build_dir, binary_deps)
-  logging.debug(
-      'Binary dependencies:%s', ''.join('\n  ' + i for i in binary_deps))
-
-  # Now do actual wrapping .isolate.
-  isolate_dict = {
-    'includes': [
-      posixpath.join(isolate_relpath, isolate),
-    ],
-    'variables': {
-      # Will look like ['<(PRODUCT_DIR)/lib/flibuser_prefs.so'].
-      'files': sorted(
-          '<(PRODUCT_DIR)/%s' % i.replace(os.path.sep, '/')
-          for i in binary_deps),
-    },
-  }
-  # Some .isolate files have the same temp directory and the build system may
-  # run this script in parallel so make directories safely here.
-  try:
-    os.makedirs(temp_isolate_dir)
-  except OSError as e:
-    if e.errno != errno.EEXIST:
-      raise
-  comment = (
-      '# Warning: this file was AUTOGENERATED.\n'
-      '# DO NO EDIT.\n')
-  out = StringIO.StringIO()
-  isolate_format.print_all(comment, isolate_dict, out)
-  isolate_content = out.getvalue()
-  with open(temp_isolate, 'wb') as f:
-    f.write(isolate_content)
-  logging.info('Added %d dynamic libs', len(binary_deps))
-  logging.debug('%s', isolate_content)
-  args[isolate_index] = temp_isolate
-
-
-def prepare_isolate_call(args, output):
-  """Gathers all information required to run isolate.py later.
-
-  Dumps it as JSON to |output| file.
-  """
-  with open(output, 'wb') as f:
-    json.dump({
-      'args': args,
-      'dir': os.getcwd(),
-      'version': 1,
-    }, f, indent=2, sort_keys=True)
-
-
-def rebase_directories(args, abs_base):
-  """Rebases all paths to be relative to abs_base."""
-  def replace(index):
-    args[index] = os.path.relpath(os.path.abspath(args[index]), abs_base)
-  for i, arg in enumerate(args):
-    if arg in ['--isolate', '--isolated']:
-      replace(i + 1)
-    if arg == '--path-variable':
-      # Path variables have a triple form: --path-variable NAME <path>.
-      replace(i + 2)
-
-
-def main():
-  logging.basicConfig(level=logging.ERROR, format='%(levelname)7s %(message)s')
-  args = sys.argv[1:]
-  mode = args[0] if args else None
-  isolate = None
-  isolated = None
-  for i, arg in enumerate(args):
-    if arg == '--isolate':
-      isolate = i + 1
-    if arg == '--isolated':
-      isolated = i + 1
-  if isolate is None or isolated is None or not mode:
-    print >> sys.stderr, 'Internal failure'
-    return 1
-
-  # Make sure all paths are relative to the isolate file. This is an
-  # expectation of the go binaries. In gn, this script is not called
-  # relative to the isolate file, but relative to the product dir.
-  new_base = os.path.abspath(os.path.dirname(args[isolate]))
-  rebase_directories(args, new_base)
-  assert args[isolate] == os.path.basename(args[isolate])
-  os.chdir(new_base)
-
-  create_wrapper(args, isolate, isolated)
-
-  # In 'prepare' mode just collect all required information for postponed
-  # isolated.py invocation later, store it in *.isolated.gen.json file.
-  if mode == 'prepare':
-    prepare_isolate_call(args[1:], args[isolated] + '.gen.json')
-    return 0
-
-  swarming_client = os.path.join(SRC_DIR, 'tools', 'swarming_client')
-  sys.stdout.flush()
-  result = subprocess.call(
-      [sys.executable, os.path.join(swarming_client, 'isolate.py')] + args)
-  return result
-
-
-if __name__ == '__main__':
-  sys.exit(main())
diff --git a/deps/v8/tools/jsfunfuzz/BUILD.gn b/deps/v8/tools/jsfunfuzz/BUILD.gn
new file mode 100644
index 00000000000..3c40460f8db
--- /dev/null
+++ b/deps/v8/tools/jsfunfuzz/BUILD.gn
@@ -0,0 +1,19 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("../../gni/v8.gni")
+
+group("v8_jsfunfuzz") {
+  testonly = true
+
+  data_deps = [
+    "../..:d8",
+  ]
+
+  data = [
+    # Grab current directory. This avoids adding logic for checking the
+    # existence of the jsfunfuzz subdirectory.
+    "./",
+  ]
+}
diff --git a/deps/v8/tools/jsfunfuzz/download_jsfunfuzz.py b/deps/v8/tools/jsfunfuzz/download_jsfunfuzz.py
deleted file mode 100644
index 2925213ced5..00000000000
--- a/deps/v8/tools/jsfunfuzz/download_jsfunfuzz.py
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/usr/bin/env python
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import os
-import re
-import subprocess
-
-FUZZ_PATH = os.path.dirname(os.path.abspath(__file__))
-SHA1_PATH = os.path.join(FUZZ_PATH, 'jsfunfuzz.tar.gz.sha1')
-
-if re.search(r'\bjsfunfuzz=1', os.environ.get('GYP_DEFINES', '')):
-  subprocess.check_call([
-    'download_from_google_storage',
-    '-b', 'chrome-v8-jsfunfuzz',
-    '-u', '--no_resume',
-    '-s', SHA1_PATH,
-    '--platform=linux*'
-  ])
diff --git a/deps/v8/tools/jsfunfuzz/jsfunfuzz.gyp b/deps/v8/tools/jsfunfuzz/jsfunfuzz.gyp
deleted file mode 100644
index 8938e44538b..00000000000
--- a/deps/v8/tools/jsfunfuzz/jsfunfuzz.gyp
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'jsfunfuzz_run',
-          'type': 'none',
-          'dependencies': [
-            '../../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../../gypfiles/features.gypi',
-            '../../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'jsfunfuzz.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/tools/jsfunfuzz/jsfunfuzz.isolate b/deps/v8/tools/jsfunfuzz/jsfunfuzz.isolate
deleted file mode 100644
index 56cb4a733f3..00000000000
--- a/deps/v8/tools/jsfunfuzz/jsfunfuzz.isolate
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'command': [
-      'fuzz-harness.sh',
-    ],
-    'files': [
-      # Grab current directory. This avoids adding logic for checking the
-      # existence of the jsfunfuzz subdirectory.
-      './',
-    ],
-  },
-  'includes': [
-    '../../src/d8.isolate',
-  ],
-}
diff --git a/deps/v8/tools/mb/mb.py b/deps/v8/tools/mb/mb.py
index 9a6600225b8..9d6f73b5e8a 100755
--- a/deps/v8/tools/mb/mb.py
+++ b/deps/v8/tools/mb/mb.py
@@ -4,16 +4,12 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-"""MB - the Meta-Build wrapper around GYP and GN
+"""MB - the Meta-Build wrapper around GN.
 
-MB is a wrapper script for GYP and GN that can be used to generate build files
+MB is a wrapper script for GN that can be used to generate build files
 for sets of canned configurations and analyze them.
 """
 
-# TODO(thomasanderson): Remove this comment.  It is added to
-# workaround https://crbug.com/736215 for CL
-# https://codereview.chromium.org/2974603002/
-
 from __future__ import print_function
 
 import argparse
@@ -22,6 +18,7 @@
 import json
 import os
 import pipes
+import platform
 import pprint
 import re
 import shutil
@@ -95,21 +92,17 @@ def AddCommonOptions(subp):
                         help='path to config file '
                              '(default is %(default)s)')
       subp.add_argument('-i', '--isolate-map-file', metavar='PATH',
-                        default=self.default_isolate_map,
                         help='path to isolate map file '
-                             '(default is %(default)s)')
+                             '(default is %(default)s)',
+                        default=[],
+                        action='append',
+                        dest='isolate_map_files')
       subp.add_argument('-g', '--goma-dir',
                         help='path to goma directory')
-      subp.add_argument('--gyp-script', metavar='PATH',
-                        default=self.PathJoin('build', 'gyp_chromium'),
-                        help='path to gyp script relative to project root '
-                             '(default is %(default)s)')
       subp.add_argument('--android-version-code',
-                        help='Sets GN arg android_default_version_code and '
-                             'GYP_DEFINE app_manifest_version_code')
+                        help='Sets GN arg android_default_version_code')
       subp.add_argument('--android-version-name',
-                        help='Sets GN arg android_default_version_name and '
-                             'GYP_DEFINE app_manifest_version_name')
+                        help='Sets GN arg android_default_version_name')
       subp.add_argument('-n', '--dryrun', action='store_true',
                         help='Do a dry run (i.e., do nothing, just print '
                              'the commands that will run)')
@@ -190,7 +183,6 @@ def AddCommonOptions(subp):
         '    --test-launcher-retry-limit=0'
         '\n'
     )
-
     AddCommonOptions(subp)
     subp.add_argument('-j', '--jobs', dest='jobs', type=int,
                       help='Number of jobs to pass to ninja')
@@ -202,6 +194,14 @@ def AddCommonOptions(subp):
                             ' This can be either a regular path or a '
                             'GN-style source-relative path like '
                             '//out/Default.'))
+    subp.add_argument('-s', '--swarmed', action='store_true',
+                      help='Run under swarming with the default dimensions')
+    subp.add_argument('-d', '--dimension', default=[], action='append', nargs=2,
+                      dest='dimensions', metavar='FOO bar',
+                      help='dimension to filter on')
+    subp.add_argument('--no-default-dimensions', action='store_false',
+                      dest='default_dimensions', default=True,
+                      help='Do not automatically add dimensions to the task')
     subp.add_argument('target', nargs=1,
                       help='ninja target to build and run')
     subp.add_argument('extra_args', nargs='*',
@@ -217,26 +217,6 @@ def AddCommonOptions(subp):
                       help='path to config file (default is %(default)s)')
     subp.set_defaults(func=self.CmdValidate)
 
-    subp = subps.add_parser('audit',
-                            help='Audit the config file to track progress')
-    subp.add_argument('-f', '--config-file', metavar='PATH',
-                      default=self.default_config,
-                      help='path to config file (default is %(default)s)')
-    subp.add_argument('-i', '--internal', action='store_true',
-                      help='check internal masters also')
-    subp.add_argument('-m', '--master', action='append',
-                      help='master to audit (default is all non-internal '
-                           'masters in file)')
-    subp.add_argument('-u', '--url-template', action='store',
-                      default='https://build.chromium.org/p/'
-                              '{master}/json/builders',
-                      help='URL scheme for JSON APIs to buildbot '
-                           '(default: %(default)s) ')
-    subp.add_argument('-c', '--check-compile', action='store_true',
-                      help='check whether tbd and master-only bots actually'
-                           ' do compiles')
-    subp.set_defaults(func=self.CmdAudit)
-
     subp = subps.add_parser('gerrit-buildbucket-config',
                             help='Print buildbucket.config for gerrit '
                             '(see MB user guide)')
@@ -253,10 +233,6 @@ def AddCommonOptions(subp):
 
     self.args = parser.parse_args(argv)
 
-    # TODO(machenbach): This prepares passing swarming targets to isolate on the
-    # infra side.
-    self.args.swarming_targets_file = None
-
   def DumpInputFiles(self):
 
     def DumpContentsOfFilePassedTo(arg_name, path):
@@ -276,11 +252,7 @@ def DumpContentsOfFilePassedTo(arg_name, path):
 
   def CmdAnalyze(self):
     vals = self.Lookup()
-    self.ClobberIfNeeded(vals)
-    if vals['type'] == 'gn':
-      return self.RunGNAnalyze(vals)
-    else:
-      return self.RunGYPAnalyze(vals)
+    return self.RunGNAnalyze(vals)
 
   def CmdExport(self):
     self.ReadConfigFile()
@@ -312,11 +284,7 @@ def CmdExport(self):
 
   def CmdGen(self):
     vals = self.Lookup()
-    self.ClobberIfNeeded(vals)
-    if vals['type'] == 'gn':
-      return self.RunGNGen(vals)
-    else:
-      return self.RunGYPGen(vals)
+    return self.RunGNGen(vals)
 
   def CmdHelp(self):
     if self.args.subcommand:
@@ -328,21 +296,14 @@ def CmdIsolate(self):
     vals = self.GetConfig()
     if not vals:
       return 1
-
-    if vals['type'] == 'gn':
-      return self.RunGNIsolate()
-    else:
-      return self.Build('%s_run' % self.args.target[0])
+    return self.RunGNIsolate()
 
   def CmdLookup(self):
     vals = self.Lookup()
-    if vals['type'] == 'gn':
-      cmd = self.GNCmd('gen', '_path_')
-      gn_args = self.GNArgs(vals)
-      self.Print('\nWriting """\\\n%s""" to _path_/args.gn.\n' % gn_args)
-      env = None
-    else:
-      cmd, env = self.GYPCmd('_path_', vals)
+    cmd = self.GNCmd('gen', '_path_')
+    gn_args = self.GNArgs(vals)
+    self.Print('\nWriting """\\\n%s""" to _path_/args.gn.\n' % gn_args)
+    env = None
 
     self.PrintCmd(cmd, env)
     return 0
@@ -355,32 +316,86 @@ def CmdRun(self):
     build_dir = self.args.path[0]
     target = self.args.target[0]
 
-    if vals['type'] == 'gn':
-      if self.args.build:
-        ret = self.Build(target)
-        if ret:
-          return ret
-      ret = self.RunGNIsolate()
+    if self.args.build:
+      ret = self.Build(target)
       if ret:
         return ret
+    ret = self.RunGNIsolate()
+    if ret:
+      return ret
+
+    if self.args.swarmed:
+      return self._RunUnderSwarming(build_dir, target)
     else:
-      ret = self.Build('%s_run' % target)
-      if ret:
-        return ret
+      return self._RunLocallyIsolated(build_dir, target)
+
+  def _RunUnderSwarming(self, build_dir, target):
+    # TODO(dpranke): Look up the information for the target in
+    # the //testing/buildbot.json file, if possible, so that we
+    # can determine the isolate target, command line, and additional
+    # swarming parameters, if possible.
+    #
+    # TODO(dpranke): Also, add support for sharding and merging results.
+    dimensions = []
+    for k, v in self._DefaultDimensions() + self.args.dimensions:
+      dimensions += ['-d', k, v]
+
+    cmd = [
+        self.executable,
+        self.PathJoin('tools', 'swarming_client', 'isolate.py'),
+        'archive',
+        '-s',
+        self.ToSrcRelPath('%s/%s.isolated' % (build_dir, target)),
+        '-I', 'isolateserver.appspot.com',
+      ]
+    ret, out, _ = self.Run(cmd, force_verbose=False)
+    if ret:
+      return ret
+
+    isolated_hash = out.splitlines()[0].split()[0]
+    cmd = [
+        self.executable,
+        self.PathJoin('tools', 'swarming_client', 'swarming.py'),
+          'run',
+          '-s', isolated_hash,
+          '-I', 'isolateserver.appspot.com',
+          '-S', 'chromium-swarm.appspot.com',
+      ] + dimensions
+    if self.args.extra_args:
+      cmd += ['--'] + self.args.extra_args
+    ret, _, _ = self.Run(cmd, force_verbose=True, buffer_output=False)
+    return ret
 
+  def _RunLocallyIsolated(self, build_dir, target):
     cmd = [
         self.executable,
         self.PathJoin('tools', 'swarming_client', 'isolate.py'),
         'run',
         '-s',
         self.ToSrcRelPath('%s/%s.isolated' % (build_dir, target)),
-    ]
+      ]
     if self.args.extra_args:
-        cmd += ['--'] + self.args.extra_args
+      cmd += ['--'] + self.args.extra_args
+    ret, _, _ = self.Run(cmd, force_verbose=True, buffer_output=False)
+    return ret
 
-    ret, _, _ = self.Run(cmd, force_verbose=False, buffer_output=False)
+  def _DefaultDimensions(self):
+    if not self.args.default_dimensions:
+      return []
+
+    # This code is naive and just picks reasonable defaults per platform.
+    if self.platform == 'darwin':
+      os_dim = ('os', 'Mac-10.12')
+    elif self.platform.startswith('linux'):
+      os_dim = ('os', 'Ubuntu-14.04')
+    elif self.platform == 'win32':
+      os_dim = ('os', 'Windows-10-14393')
+    else:
+      raise MBErr('unrecognized platform string "%s"' % self.platform)
 
-    return ret
+    return [('pool', 'Chrome'),
+            ('cpu', 'x86-64'),
+            os_dim]
 
   def CmdBuildbucket(self):
     self.ReadConfigFile()
@@ -462,154 +477,26 @@ def CmdValidate(self, print_ok=True):
       self.Print('mb config file %s looks ok.' % self.args.config_file)
     return 0
 
-  def CmdAudit(self):
-    """Track the progress of the GYP->GN migration on the bots."""
-
-    # First, make sure the config file is okay, but don't print anything
-    # if it is (it will throw an error if it isn't).
-    self.CmdValidate(print_ok=False)
-
-    stats = OrderedDict()
-    STAT_MASTER_ONLY = 'Master only'
-    STAT_CONFIG_ONLY = 'Config only'
-    STAT_TBD = 'Still TBD'
-    STAT_GYP = 'Still GYP'
-    STAT_DONE = 'Done (on GN)'
-    stats[STAT_MASTER_ONLY] = 0
-    stats[STAT_CONFIG_ONLY] = 0
-    stats[STAT_TBD] = 0
-    stats[STAT_GYP] = 0
-    stats[STAT_DONE] = 0
-
-    def PrintBuilders(heading, builders, notes):
-      stats.setdefault(heading, 0)
-      stats[heading] += len(builders)
-      if builders:
-        self.Print('  %s:' % heading)
-        for builder in sorted(builders):
-          self.Print('    %s%s' % (builder, notes[builder]))
-
-    self.ReadConfigFile()
-
-    masters = self.args.master or self.masters
-    for master in sorted(masters):
-      url = self.args.url_template.replace('{master}', master)
-
-      self.Print('Auditing %s' % master)
-
-      MASTERS_TO_SKIP = (
-        'client.skia',
-        'client.v8.fyi',
-        'tryserver.v8',
-      )
-      if master in MASTERS_TO_SKIP:
-        # Skip these bots because converting them is the responsibility of
-        # those teams and out of scope for the Chromium migration to GN.
-        self.Print('  Skipped (out of scope)')
-        self.Print('')
-        continue
-
-      INTERNAL_MASTERS = ('official.desktop', 'official.desktop.continuous',
-                          'internal.client.kitchensync')
-      if master in INTERNAL_MASTERS and not self.args.internal:
-        # Skip these because the servers aren't accessible by default ...
-        self.Print('  Skipped (internal)')
-        self.Print('')
-        continue
-
-      try:
-        # Fetch the /builders contents from the buildbot master. The
-        # keys of the dict are the builder names themselves.
-        json_contents = self.Fetch(url)
-        d = json.loads(json_contents)
-      except Exception as e:
-        self.Print(str(e))
-        return 1
-
-      config_builders = set(self.masters[master])
-      master_builders = set(d.keys())
-      both = master_builders & config_builders
-      master_only = master_builders - config_builders
-      config_only = config_builders - master_builders
-      tbd = set()
-      gyp = set()
-      done = set()
-      notes = {builder: '' for builder in config_builders | master_builders}
-
-      for builder in both:
-        config = self.masters[master][builder]
-        if config == 'tbd':
-          tbd.add(builder)
-        elif isinstance(config, dict):
-          vals = self.FlattenConfig(config.values()[0])
-          if vals['type'] == 'gyp':
-            gyp.add(builder)
-          else:
-            done.add(builder)
-        elif config.startswith('//'):
-          done.add(builder)
-        else:
-          vals = self.FlattenConfig(config)
-          if vals['type'] == 'gyp':
-            gyp.add(builder)
-          else:
-            done.add(builder)
-
-      if self.args.check_compile and (tbd or master_only):
-        either = tbd | master_only
-        for builder in either:
-          notes[builder] = ' (' + self.CheckCompile(master, builder) +')'
-
-      if master_only or config_only or tbd or gyp:
-        PrintBuilders(STAT_MASTER_ONLY, master_only, notes)
-        PrintBuilders(STAT_CONFIG_ONLY, config_only, notes)
-        PrintBuilders(STAT_TBD, tbd, notes)
-        PrintBuilders(STAT_GYP, gyp, notes)
-      else:
-        self.Print('  All GN!')
-
-      stats[STAT_DONE] += len(done)
-
-      self.Print('')
-
-    fmt = '{:<27} {:>4}'
-    self.Print(fmt.format('Totals', str(sum(int(v) for v in stats.values()))))
-    self.Print(fmt.format('-' * 27, '----'))
-    for stat, count in stats.items():
-      self.Print(fmt.format(stat, str(count)))
-
-    return 0
-
   def GetConfig(self):
     build_dir = self.args.path[0]
 
     vals = self.DefaultVals()
     if self.args.builder or self.args.master or self.args.config:
       vals = self.Lookup()
-      if vals['type'] == 'gn':
-        # Re-run gn gen in order to ensure the config is consistent with the
-        # build dir.
-        self.RunGNGen(vals)
+      # Re-run gn gen in order to ensure the config is consistent with the
+      # build dir.
+      self.RunGNGen(vals)
       return vals
 
-    mb_type_path = self.PathJoin(self.ToAbsPath(build_dir), 'mb_type')
-    if not self.Exists(mb_type_path):
-      toolchain_path = self.PathJoin(self.ToAbsPath(build_dir),
-                                     'toolchain.ninja')
-      if not self.Exists(toolchain_path):
-        self.Print('Must either specify a path to an existing GN build dir '
-                   'or pass in a -m/-b pair or a -c flag to specify the '
-                   'configuration')
-        return {}
-      else:
-        mb_type = 'gn'
-    else:
-      mb_type = self.ReadFile(mb_type_path).strip()
-
-    if mb_type == 'gn':
-      vals['gn_args'] = self.GNArgsFromDir(build_dir)
-    vals['type'] = mb_type
+    toolchain_path = self.PathJoin(self.ToAbsPath(build_dir),
+                                   'toolchain.ninja')
+    if not self.Exists(toolchain_path):
+      self.Print('Must either specify a path to an existing GN build dir '
+                 'or pass in a -m/-b pair or a -c flag to specify the '
+                 'configuration')
+      return {}
 
+    vals['gn_args'] = self.GNArgsFromDir(build_dir)
     return vals
 
   def GNArgsFromDir(self, build_dir):
@@ -641,14 +528,6 @@ def Lookup(self):
           raise MBErr('Config "%s" not found in %s' %
                       (config, self.args.config_file))
         vals = self.FlattenConfig(config)
-
-    # Do some basic sanity checking on the config so that we
-    # don't have to do this in every caller.
-    if 'type' not in vals:
-        vals['type'] = 'gn'
-    assert vals['type'] in ('gn', 'gyp'), (
-        'Unknown meta-build type "%s"' % vals['gn_args'])
-
     return vals
 
   def ReadIOSBotConfig(self):
@@ -660,17 +539,10 @@ def ReadIOSBotConfig(self):
       return {}
 
     contents = json.loads(self.ReadFile(path))
-    gyp_vals = contents.get('GYP_DEFINES', {})
-    if isinstance(gyp_vals, dict):
-      gyp_defines = ' '.join('%s=%s' % (k, v) for k, v in gyp_vals.items())
-    else:
-      gyp_defines = ' '.join(gyp_vals)
     gn_args = ' '.join(contents.get('gn_args', []))
 
     vals = self.DefaultVals()
     vals['gn_args'] = gn_args
-    vals['gyp_defines'] = gyp_defines
-    vals['type'] = contents.get('mb_type', 'gn')
     return vals
 
   def ReadConfigFile(self):
@@ -689,14 +561,26 @@ def ReadConfigFile(self):
     self.mixins = contents['mixins']
 
   def ReadIsolateMap(self):
-    if not self.Exists(self.args.isolate_map_file):
-      raise MBErr('isolate map file not found at %s' %
-                  self.args.isolate_map_file)
-    try:
-      return ast.literal_eval(self.ReadFile(self.args.isolate_map_file))
-    except SyntaxError as e:
-      raise MBErr('Failed to parse isolate map file "%s": %s' %
-                  (self.args.isolate_map_file, e))
+    if not self.args.isolate_map_files:
+      self.args.isolate_map_files = [self.default_isolate_map]
+
+    for f in self.args.isolate_map_files:
+      if not self.Exists(f):
+        raise MBErr('isolate map file not found at %s' % f)
+    isolate_maps = {}
+    for isolate_map in self.args.isolate_map_files:
+      try:
+        isolate_map = ast.literal_eval(self.ReadFile(isolate_map))
+        duplicates = set(isolate_map).intersection(isolate_maps)
+        if duplicates:
+          raise MBErr(
+              'Duplicate targets in isolate map files: %s.' %
+              ', '.join(duplicates))
+        isolate_maps.update(isolate_map)
+      except SyntaxError as e:
+        raise MBErr(
+            'Failed to parse isolate map file "%s": %s' % (isolate_map, e))
+    return isolate_maps
 
   def ConfigFromArgs(self):
     if self.args.config:
@@ -747,9 +631,6 @@ def DefaultVals(self):
       'args_file': '',
       'cros_passthrough': False,
       'gn_args': '',
-      'gyp_defines': '',
-      'gyp_crosscompile': False,
-      'type': 'gn',
     }
 
   def FlattenMixins(self, mixins, vals, visited):
@@ -773,50 +654,11 @@ def FlattenMixins(self, mixins, vals, visited):
           vals['gn_args'] += ' ' + mixin_vals['gn_args']
         else:
           vals['gn_args'] = mixin_vals['gn_args']
-      if 'gyp_crosscompile' in mixin_vals:
-        vals['gyp_crosscompile'] = mixin_vals['gyp_crosscompile']
-      if 'gyp_defines' in mixin_vals:
-        if vals['gyp_defines']:
-          vals['gyp_defines'] += ' ' + mixin_vals['gyp_defines']
-        else:
-          vals['gyp_defines'] = mixin_vals['gyp_defines']
-      if 'type' in mixin_vals:
-        vals['type'] = mixin_vals['type']
 
       if 'mixins' in mixin_vals:
         self.FlattenMixins(mixin_vals['mixins'], vals, visited)
     return vals
 
-  def ClobberIfNeeded(self, vals):
-    path = self.args.path[0]
-    build_dir = self.ToAbsPath(path)
-    mb_type_path = self.PathJoin(build_dir, 'mb_type')
-    needs_clobber = False
-    new_mb_type = vals['type']
-    if self.Exists(build_dir):
-      if self.Exists(mb_type_path):
-        old_mb_type = self.ReadFile(mb_type_path)
-        if old_mb_type != new_mb_type:
-          self.Print("Build type mismatch: was %s, will be %s, clobbering %s" %
-                     (old_mb_type, new_mb_type, path))
-          needs_clobber = True
-      else:
-        # There is no 'mb_type' file in the build directory, so this probably
-        # means that the prior build(s) were not done through mb, and we
-        # have no idea if this was a GYP build or a GN build. Clobber it
-        # to be safe.
-        self.Print("%s/mb_type missing, clobbering to be safe" % path)
-        needs_clobber = True
-
-    if self.args.dryrun:
-      return
-
-    if needs_clobber:
-      self.RemoveDirectory(build_dir)
-
-    self.MaybeMakeDirectory(build_dir)
-    self.WriteFile(mb_type_path, new_mb_type)
-
   def RunGNGen(self, vals, compute_grit_inputs_for_analyze=False):
     build_dir = self.args.path[0]
 
@@ -861,6 +703,7 @@ def RunGNGen(self, vals, compute_grit_inputs_for_analyze=False):
         return ret
 
     android = 'target_os="android"' in vals['gn_args']
+    fuchsia = 'target_os="fuchsia"' in vals['gn_args']
     for target in swarming_targets:
       if android:
         # Android targets may be either android_apk or executable. The former
@@ -870,6 +713,11 @@ def RunGNGen(self, vals, compute_grit_inputs_for_analyze=False):
         runtime_deps_targets = [
             target + '.runtime_deps',
             'obj/%s.stamp.runtime_deps' % label.replace(':', '/')]
+      elif fuchsia:
+        # Only emit a runtime deps file for the group() target on Fuchsia.
+        label = isolate_map[target]['label']
+        runtime_deps_targets = [
+          'obj/%s.stamp.runtime_deps' % label.replace(':', '/')]
       elif (isolate_map[target]['type'] == 'script' or
             isolate_map[target].get('label_type') == 'group'):
         # For script targets, the build target is usually a group,
@@ -1023,38 +871,6 @@ def GNArgs(self, vals):
       gn_args = ('import("%s")\n' % vals['args_file']) + gn_args
     return gn_args
 
-  def RunGYPGen(self, vals):
-    path = self.args.path[0]
-
-    output_dir = self.ParseGYPConfigPath(path)
-    cmd, env = self.GYPCmd(output_dir, vals)
-    ret, _, _ = self.Run(cmd, env=env)
-    return ret
-
-  def RunGYPAnalyze(self, vals):
-    output_dir = self.ParseGYPConfigPath(self.args.path[0])
-    if self.args.verbose:
-      inp = self.ReadInputJSON(['files', 'test_targets',
-                                'additional_compile_targets'])
-      self.Print()
-      self.Print('analyze input:')
-      self.PrintJSON(inp)
-      self.Print()
-
-    cmd, env = self.GYPCmd(output_dir, vals)
-    cmd.extend(['-f', 'analyzer',
-                '-G', 'config_path=%s' % self.args.input_path[0],
-                '-G', 'analyzer_output_path=%s' % self.args.output_path[0]])
-    ret, _, _ = self.Run(cmd, env=env)
-    if not ret and self.args.verbose:
-      outp = json.loads(self.ReadFile(self.args.output_path[0]))
-      self.Print()
-      self.Print('analyze output:')
-      self.PrintJSON(outp)
-      self.Print()
-
-    return ret
-
   def ToAbsPath(self, build_path, *comps):
     return self.PathJoin(self.chromium_src_dir,
                          self.ToSrcRelPath(build_path),
@@ -1066,86 +882,6 @@ def ToSrcRelPath(self, path):
       return path[2:].replace('/', self.sep)
     return self.RelPath(path, self.chromium_src_dir)
 
-  def ParseGYPConfigPath(self, path):
-    rpath = self.ToSrcRelPath(path)
-    output_dir, _, _ = rpath.rpartition(self.sep)
-    return output_dir
-
-  def GYPCmd(self, output_dir, vals):
-    if vals['cros_passthrough']:
-      if not 'GYP_DEFINES' in os.environ:
-        raise MBErr('MB is expecting GYP_DEFINES to be in the environment')
-      gyp_defines = os.environ['GYP_DEFINES']
-      if not 'chromeos=1' in gyp_defines:
-        raise MBErr('GYP_DEFINES is missing chromeos=1: (GYP_DEFINES=%s)' %
-                    gyp_defines)
-    else:
-      gyp_defines = vals['gyp_defines']
-
-    goma_dir = self.args.goma_dir
-
-    # GYP uses shlex.split() to split the gyp defines into separate arguments,
-    # so we can support backslashes and and spaces in arguments by quoting
-    # them, even on Windows, where this normally wouldn't work.
-    if goma_dir and ('\\' in goma_dir or ' ' in goma_dir):
-      goma_dir = "'%s'" % goma_dir
-
-    if goma_dir:
-      gyp_defines += ' gomadir=%s' % goma_dir
-
-    android_version_code = self.args.android_version_code
-    if android_version_code:
-      gyp_defines += ' app_manifest_version_code=%s' % android_version_code
-
-    android_version_name = self.args.android_version_name
-    if android_version_name:
-      gyp_defines += ' app_manifest_version_name=%s' % android_version_name
-
-    cmd = [
-        self.executable,
-        self.args.gyp_script,
-        '-G',
-        'output_dir=' + output_dir,
-    ]
-
-    # Ensure that we have an environment that only contains
-    # the exact values of the GYP variables we need.
-    env = os.environ.copy()
-
-    # This is a terrible hack to work around the fact that
-    # //tools/clang/scripts/update.py is invoked by GYP and GN but
-    # currently relies on an environment variable to figure out
-    # what revision to embed in the command line #defines.
-    # For GN, we've made this work via a gn arg that will cause update.py
-    # to get an additional command line arg, but getting that to work
-    # via GYP_DEFINES has proven difficult, so we rewrite the GYP_DEFINES
-    # to get rid of the arg and add the old var in, instead.
-    # See crbug.com/582737 for more on this. This can hopefully all
-    # go away with GYP.
-    m = re.search('llvm_force_head_revision=1\s*', gyp_defines)
-    if m:
-      env['LLVM_FORCE_HEAD_REVISION'] = '1'
-      gyp_defines = gyp_defines.replace(m.group(0), '')
-
-    # This is another terrible hack to work around the fact that
-    # GYP sets the link concurrency to use via the GYP_LINK_CONCURRENCY
-    # environment variable, and not via a proper GYP_DEFINE. See
-    # crbug.com/611491 for more on this.
-    m = re.search('gyp_link_concurrency=(\d+)(\s*)', gyp_defines)
-    if m:
-      env['GYP_LINK_CONCURRENCY'] = m.group(1)
-      gyp_defines = gyp_defines.replace(m.group(0), '')
-
-    env['GYP_GENERATORS'] = 'ninja'
-    if 'GYP_CHROMIUM_NO_ACTION' in env:
-      del env['GYP_CHROMIUM_NO_ACTION']
-    if 'GYP_CROSSCOMPILE' in env:
-      del env['GYP_CROSSCOMPILE']
-    env['GYP_DEFINES'] = gyp_defines
-    if vals['gyp_crosscompile']:
-      env['GYP_CROSSCOMPILE'] = '1'
-    return cmd, env
-
   def RunGNAnalyze(self, vals):
     # Analyze runs before 'gn gen' now, so we need to run gn gen
     # in order to ensure that we have a build directory.
@@ -1347,9 +1083,6 @@ def print_env(var):
       if env and var in env:
         self.Print('%s%s=%s' % (env_prefix, var, env_quoter(env[var])))
 
-    print_env('GYP_CROSSCOMPILE')
-    print_env('GYP_DEFINES')
-    print_env('GYP_LINK_CONCURRENCY')
     print_env('LLVM_FORCE_HEAD_REVISION')
 
     if cmd[0] == self.executable:
@@ -1486,7 +1219,6 @@ def QuoteForSet(arg):
 
 def QuoteForCmd(arg):
   # First, escape the arg so that CommandLineToArgvW will parse it properly.
-  # From //tools/gyp/pylib/gyp/msvs_emulation.py:23.
   if arg == '' or ' ' in arg or '"' in arg:
     quote_re = re.compile(r'(\\*)"')
     arg = '"%s"' % (quote_re.sub(lambda mo: 2 * mo.group(1) + '\\"', arg))
diff --git a/deps/v8/tools/mb/mb_unittest.py b/deps/v8/tools/mb/mb_unittest.py
index 15763750da5..dbd599645d6 100755
--- a/deps/v8/tools/mb/mb_unittest.py
+++ b/deps/v8/tools/mb/mb_unittest.py
@@ -65,8 +65,6 @@ def WriteFile(self, path, contents, force_verbose=False):
     self.files[path] = contents
 
   def Call(self, cmd, env=None, buffer_output=True):
-    if env:
-      self.cross_compile = env.get('GYP_CROSSCOMPILE')
     self.calls.append(cmd)
     if self.cmds:
       return self.cmds.pop(0)
@@ -112,13 +110,10 @@ def close(self):
   'masters': {
     'chromium': {},
     'fake_master': {
-      'fake_builder': 'gyp_rel_bot',
-      'fake_gn_builder': 'gn_rel_bot',
-      'fake_gyp_crosscompile_builder': 'gyp_crosscompile',
-      'fake_gn_debug_builder': 'gn_debug_goma',
-      'fake_gyp_builder': 'gyp_debug',
-      'fake_gn_args_bot': '//build/args/bots/fake_master/fake_gn_args_bot.gn',
-      'fake_multi_phase': { 'phase_1': 'gn_phase_1', 'phase_2': 'gn_phase_2'},
+      'fake_builder': 'rel_bot',
+      'fake_debug_builder': 'debug_goma',
+      'fake_args_bot': '//build/args/bots/fake_master/fake_args_bot.gn',
+      'fake_multi_phase': { 'phase_1': 'phase_1', 'phase_2': 'phase_2'},
       'fake_args_file': 'args_file_goma',
       'fake_args_file_twice': 'args_file_twice',
     },
@@ -126,38 +121,26 @@ def close(self):
   'configs': {
     'args_file_goma': ['args_file', 'goma'],
     'args_file_twice': ['args_file', 'args_file'],
-    'gyp_rel_bot': ['gyp', 'rel', 'goma'],
-    'gn_debug_goma': ['gn', 'debug', 'goma'],
-    'gyp_debug': ['gyp', 'debug', 'fake_feature1'],
-    'gn_rel_bot': ['gn', 'rel', 'goma'],
-    'gyp_crosscompile': ['gyp', 'crosscompile'],
-    'gn_phase_1': ['gn', 'phase_1'],
-    'gn_phase_2': ['gn', 'phase_2'],
+    'rel_bot': ['rel', 'goma', 'fake_feature1'],
+    'debug_goma': ['debug', 'goma'],
+    'phase_1': ['phase_1'],
+    'phase_2': ['phase_2'],
   },
   'mixins': {
-    'crosscompile': {
-      'gyp_crosscompile': True,
-    },
     'fake_feature1': {
       'gn_args': 'enable_doom_melon=true',
-      'gyp_defines': 'doom_melon=1',
     },
-    'gyp': {'type': 'gyp'},
-    'gn': {'type': 'gn'},
     'goma': {
       'gn_args': 'use_goma=true',
-      'gyp_defines': 'goma=1',
     },
     'args_file': {
       'args_file': '//build/args/fake.gn',
     },
     'phase_1': {
       'gn_args': 'phase=1',
-      'gyp_args': 'phase=1',
     },
     'phase_2': {
       'gn_args': 'phase=2',
-      'gyp_args': 'phase=2',
     },
     'rel': {
       'gn_args': 'is_debug=false',
@@ -169,28 +152,6 @@ def close(self):
 }
 """
 
-GYP_HACKS_CONFIG = """\
-{
-  'masters': {
-    'chromium': {},
-    'fake_master': {
-      'fake_builder': 'fake_config',
-    },
-  },
-  'configs': {
-    'fake_config': ['fake_mixin'],
-  },
-  'mixins': {
-    'fake_mixin': {
-      'type': 'gyp',
-      'gn_args': '',
-      'gyp_defines':
-         ('foo=bar llvm_force_head_revision=1 '
-          'gyp_link_concurrency=1 baz=1'),
-    },
-  },
-}
-"""
 
 TRYSERVER_CONFIG = """\
 {
@@ -229,7 +190,7 @@ def fake_mbw(self, files=None, win32=False):
         },
       }''')
     mbw.files.setdefault(
-        mbw.ToAbsPath('//build/args/bots/fake_master/fake_gn_args_bot.gn'),
+        mbw.ToAbsPath('//build/args/bots/fake_master/fake_args_bot.gn'),
         'is_debug = false\n')
     if files:
       for path, contents in files.items():
@@ -249,37 +210,6 @@ def check(self, args, mbw=None, files=None, out=None, err=None, ret=None):
       self.assertEqual(mbw.err, err)
     return mbw
 
-  def test_clobber(self):
-    files = {
-      '/fake_src/out/Debug': None,
-      '/fake_src/out/Debug/mb_type': None,
-    }
-    mbw = self.fake_mbw(files)
-
-    # The first time we run this, the build dir doesn't exist, so no clobber.
-    self.check(['gen', '-c', 'gn_debug_goma', '//out/Debug'], mbw=mbw, ret=0)
-    self.assertEqual(mbw.rmdirs, [])
-    self.assertEqual(mbw.files['/fake_src/out/Debug/mb_type'], 'gn')
-
-    # The second time we run this, the build dir exists and matches, so no
-    # clobber.
-    self.check(['gen', '-c', 'gn_debug_goma', '//out/Debug'], mbw=mbw, ret=0)
-    self.assertEqual(mbw.rmdirs, [])
-    self.assertEqual(mbw.files['/fake_src/out/Debug/mb_type'], 'gn')
-
-    # Now we switch build types; this should result in a clobber.
-    self.check(['gen', '-c', 'gyp_debug', '//out/Debug'], mbw=mbw, ret=0)
-    self.assertEqual(mbw.rmdirs, ['/fake_src/out/Debug'])
-    self.assertEqual(mbw.files['/fake_src/out/Debug/mb_type'], 'gyp')
-
-    # Now we delete mb_type; this checks the case where the build dir
-    # exists but wasn't populated by mb; this should also result in a clobber.
-    del mbw.files['/fake_src/out/Debug/mb_type']
-    self.check(['gen', '-c', 'gyp_debug', '//out/Debug'], mbw=mbw, ret=0)
-    self.assertEqual(mbw.rmdirs,
-                     ['/fake_src/out/Debug', '/fake_src/out/Debug'])
-    self.assertEqual(mbw.files['/fake_src/out/Debug/mb_type'], 'gyp')
-
   def test_analyze(self):
     files = {'/tmp/in.json': '''{\
                "files": ["foo/foo_unittest.cc"],
@@ -295,7 +225,7 @@ def test_analyze(self):
     mbw = self.fake_mbw(files)
     mbw.Call = lambda cmd, env=None, buffer_output=True: (0, '', '')
 
-    self.check(['analyze', '-c', 'gn_debug_goma', '//out/Default',
+    self.check(['analyze', '-c', 'debug_goma', '//out/Default',
                 '/tmp/in.json', '/tmp/out.json'], mbw=mbw, ret=0)
     out = json.loads(mbw.files['/tmp/out.json'])
     self.assertEqual(out, {
@@ -319,7 +249,7 @@ def test_analyze_optimizes_compile_for_all(self):
     mbw = self.fake_mbw(files)
     mbw.Call = lambda cmd, env=None, buffer_output=True: (0, '', '')
 
-    self.check(['analyze', '-c', 'gn_debug_goma', '//out/Default',
+    self.check(['analyze', '-c', 'debug_goma', '//out/Default',
                 '/tmp/in.json', '/tmp/out.json'], mbw=mbw, ret=0)
     out = json.loads(mbw.files['/tmp/out.json'])
 
@@ -342,7 +272,7 @@ def test_analyze_handles_other_toolchains(self):
     mbw = self.fake_mbw(files)
     mbw.Call = lambda cmd, env=None, buffer_output=True: (0, '', '')
 
-    self.check(['analyze', '-c', 'gn_debug_goma', '//out/Default',
+    self.check(['analyze', '-c', 'debug_goma', '//out/Default',
                 '/tmp/in.json', '/tmp/out.json'], mbw=mbw, ret=0)
     out = json.loads(mbw.files['/tmp/out.json'])
 
@@ -369,7 +299,7 @@ def test_analyze_handles_way_too_many_results(self):
     mbw = self.fake_mbw(files)
     mbw.Call = lambda cmd, env=None, buffer_output=True: (0, '', '')
 
-    self.check(['analyze', '-c', 'gn_debug_goma', '//out/Default',
+    self.check(['analyze', '-c', 'debug_goma', '//out/Default',
                 '/tmp/in.json', '/tmp/out.json'], mbw=mbw, ret=0)
     out = json.loads(mbw.files['/tmp/out.json'])
 
@@ -379,9 +309,9 @@ def test_analyze_handles_way_too_many_results(self):
     # test_targets and additional_compile_targets.
     self.assertEqual(['all', 'foo_unittests'], out['compile_targets'])
 
-  def test_gn_gen(self):
+  def test_gen(self):
     mbw = self.fake_mbw()
-    self.check(['gen', '-c', 'gn_debug_goma', '//out/Default', '-g', '/goma'],
+    self.check(['gen', '-c', 'debug_goma', '//out/Default', '-g', '/goma'],
                mbw=mbw, ret=0)
     self.assertMultiLineEqual(mbw.files['/fake_src/out/Default/args.gn'],
                               ('goma_dir = "/goma"\n'
@@ -394,7 +324,7 @@ def test_gn_gen(self):
                   mbw.out)
 
     mbw = self.fake_mbw(win32=True)
-    self.check(['gen', '-c', 'gn_debug_goma', '-g', 'c:\\goma', '//out/Debug'],
+    self.check(['gen', '-c', 'debug_goma', '-g', 'c:\\goma', '//out/Debug'],
                mbw=mbw, ret=0)
     self.assertMultiLineEqual(mbw.files['c:\\fake_src\\out\\Debug\\args.gn'],
                               ('goma_dir = "c:\\\\goma"\n'
@@ -404,14 +334,14 @@ def test_gn_gen(self):
                   '--check\n', mbw.out)
 
     mbw = self.fake_mbw()
-    self.check(['gen', '-m', 'fake_master', '-b', 'fake_gn_args_bot',
+    self.check(['gen', '-m', 'fake_master', '-b', 'fake_args_bot',
                 '//out/Debug'],
                mbw=mbw, ret=0)
     self.assertEqual(
         mbw.files['/fake_src/out/Debug/args.gn'],
-        'import("//build/args/bots/fake_master/fake_gn_args_bot.gn")\n')
+        'import("//build/args/bots/fake_master/fake_args_bot.gn")\n')
 
-  def test_gn_gen_args_file_mixins(self):
+  def test_gen_args_file_mixins(self):
     mbw = self.fake_mbw()
     self.check(['gen', '-m', 'fake_master', '-b', 'fake_args_file',
                 '//out/Debug'], mbw=mbw, ret=0)
@@ -425,14 +355,12 @@ def test_gn_gen_args_file_mixins(self):
     self.check(['gen', '-m', 'fake_master', '-b', 'fake_args_file_twice',
                 '//out/Debug'], mbw=mbw, ret=1)
 
-  def test_gn_gen_fails(self):
+  def test_gen_fails(self):
     mbw = self.fake_mbw()
     mbw.Call = lambda cmd, env=None, buffer_output=True: (1, '', '')
-    self.check(['gen', '-c', 'gn_debug_goma', '//out/Default'], mbw=mbw, ret=1)
+    self.check(['gen', '-c', 'debug_goma', '//out/Default'], mbw=mbw, ret=1)
 
-  # TODO(machenbach): Comment back in after swarming file parameter is used.
-  """
-  def test_gn_gen_swarming(self):
+  def test_gen_swarming(self):
     files = {
       '/tmp/swarming_targets': 'base_unittests\n',
       '/fake_src/testing/buildbot/gn_isolate_map.pyl': (
@@ -448,7 +376,7 @@ def test_gn_gen_swarming(self):
     }
     mbw = self.fake_mbw(files)
     self.check(['gen',
-                '-c', 'gn_debug_goma',
+                '-c', 'debug_goma',
                 '--swarming-targets-file', '/tmp/swarming_targets',
                 '//out/Default'], mbw=mbw, ret=0)
     self.assertIn('/fake_src/out/Default/base_unittests.isolate',
@@ -456,7 +384,7 @@ def test_gn_gen_swarming(self):
     self.assertIn('/fake_src/out/Default/base_unittests.isolated.gen.json',
                   mbw.files)
 
-  def test_gn_gen_swarming_script(self):
+  def test_gen_swarming_script(self):
     files = {
       '/tmp/swarming_targets': 'cc_perftests\n',
       '/fake_src/testing/buildbot/gn_isolate_map.pyl': (
@@ -473,18 +401,86 @@ def test_gn_gen_swarming_script(self):
     }
     mbw = self.fake_mbw(files=files, win32=True)
     self.check(['gen',
-                '-c', 'gn_debug_goma',
+                '-c', 'debug_goma',
+                '--swarming-targets-file', '/tmp/swarming_targets',
+                '--isolate-map-file',
+                '/fake_src/testing/buildbot/gn_isolate_map.pyl',
+                '//out/Default'], mbw=mbw, ret=0)
+    self.assertIn('c:\\fake_src\\out\\Default\\cc_perftests.isolate',
+                  mbw.files)
+    self.assertIn('c:\\fake_src\\out\\Default\\cc_perftests.isolated.gen.json',
+                  mbw.files)
+
+
+  def test_multiple_isolate_maps(self):
+    files = {
+      '/tmp/swarming_targets': 'cc_perftests\n',
+      '/fake_src/testing/buildbot/gn_isolate_map.pyl': (
+          "{'cc_perftests': {"
+          "  'label': '//cc:cc_perftests',"
+          "  'type': 'raw',"
+          "  'args': [],"
+          "}}\n"
+      ),
+      '/fake_src/testing/buildbot/gn_isolate_map2.pyl': (
+          "{'cc_perftests2': {"
+          "  'label': '//cc:cc_perftests',"
+          "  'type': 'raw',"
+          "  'args': [],"
+          "}}\n"
+      ),
+      'c:\\fake_src\out\Default\cc_perftests.exe.runtime_deps': (
+          "cc_perftests\n"
+      ),
+    }
+    mbw = self.fake_mbw(files=files, win32=True)
+    self.check(['gen',
+                '-c', 'debug_goma',
                 '--swarming-targets-file', '/tmp/swarming_targets',
                 '--isolate-map-file',
                 '/fake_src/testing/buildbot/gn_isolate_map.pyl',
+                '--isolate-map-file',
+                '/fake_src/testing/buildbot/gn_isolate_map2.pyl',
                 '//out/Default'], mbw=mbw, ret=0)
     self.assertIn('c:\\fake_src\\out\\Default\\cc_perftests.isolate',
                   mbw.files)
     self.assertIn('c:\\fake_src\\out\\Default\\cc_perftests.isolated.gen.json',
                   mbw.files)
-  """  # pylint: disable=pointless-string-statement
 
-  def test_gn_isolate(self):
+
+  def test_duplicate_isolate_maps(self):
+    files = {
+      '/tmp/swarming_targets': 'cc_perftests\n',
+      '/fake_src/testing/buildbot/gn_isolate_map.pyl': (
+          "{'cc_perftests': {"
+          "  'label': '//cc:cc_perftests',"
+          "  'type': 'raw',"
+          "  'args': [],"
+          "}}\n"
+      ),
+      '/fake_src/testing/buildbot/gn_isolate_map2.pyl': (
+          "{'cc_perftests': {"
+          "  'label': '//cc:cc_perftests',"
+          "  'type': 'raw',"
+          "  'args': [],"
+          "}}\n"
+      ),
+      'c:\\fake_src\out\Default\cc_perftests.exe.runtime_deps': (
+          "cc_perftests\n"
+      ),
+    }
+    mbw = self.fake_mbw(files=files, win32=True)
+    # Check that passing duplicate targets into mb fails.
+    self.check(['gen',
+                '-c', 'debug_goma',
+                '--swarming-targets-file', '/tmp/swarming_targets',
+                '--isolate-map-file',
+                '/fake_src/testing/buildbot/gn_isolate_map.pyl',
+                '--isolate-map-file',
+                '/fake_src/testing/buildbot/gn_isolate_map2.pyl',
+                '//out/Default'], mbw=mbw, ret=1)
+
+  def test_isolate(self):
     files = {
       '/fake_src/out/Default/toolchain.ninja': "",
       '/fake_src/testing/buildbot/gn_isolate_map.pyl': (
@@ -498,7 +494,7 @@ def test_gn_isolate(self):
           "base_unittests\n"
       ),
     }
-    self.check(['isolate', '-c', 'gn_debug_goma', '//out/Default',
+    self.check(['isolate', '-c', 'debug_goma', '//out/Default',
                 'base_unittests'], files=files, ret=0)
 
     # test running isolate on an existing build_dir
@@ -506,11 +502,10 @@ def test_gn_isolate(self):
     self.check(['isolate', '//out/Default', 'base_unittests'],
                files=files, ret=0)
 
-    files['/fake_src/out/Default/mb_type'] = 'gn\n'
     self.check(['isolate', '//out/Default', 'base_unittests'],
                files=files, ret=0)
 
-  def test_gn_run(self):
+  def test_run(self):
     files = {
       '/fake_src/testing/buildbot/gn_isolate_map.pyl': (
           "{'base_unittests': {"
@@ -523,55 +518,50 @@ def test_gn_run(self):
           "base_unittests\n"
       ),
     }
-    self.check(['run', '-c', 'gn_debug_goma', '//out/Default',
+    self.check(['run', '-c', 'debug_goma', '//out/Default',
                 'base_unittests'], files=files, ret=0)
 
-  def test_gn_lookup(self):
-    self.check(['lookup', '-c', 'gn_debug_goma'], ret=0)
+  def test_run_swarmed(self):
+    files = {
+      '/fake_src/testing/buildbot/gn_isolate_map.pyl': (
+          "{'base_unittests': {"
+          "  'label': '//base:base_unittests',"
+          "  'type': 'raw',"
+          "  'args': [],"
+          "}}\n"
+      ),
+      '/fake_src/out/Default/base_unittests.runtime_deps': (
+          "base_unittests\n"
+      ),
+    }
+
+    def run_stub(cmd, **_kwargs):
+      if 'isolate.py' in cmd[1]:
+        return 0, 'fake_hash base_unittests', ''
+      else:
+        return 0, '', ''
+
+    mbw = self.fake_mbw(files=files)
+    mbw.Run = run_stub
+    self.check(['run', '-s', '-c', 'debug_goma', '//out/Default',
+                'base_unittests'], mbw=mbw, ret=0)
+    self.check(['run', '-s', '-c', 'debug_goma', '-d', 'os', 'Win7',
+                '//out/Default', 'base_unittests'], mbw=mbw, ret=0)
 
-  def test_gn_lookup_goma_dir_expansion(self):
-    self.check(['lookup', '-c', 'gn_rel_bot', '-g', '/foo'], ret=0,
+  def test_lookup(self):
+    self.check(['lookup', '-c', 'debug_goma'], ret=0)
+
+  def test_lookup_goma_dir_expansion(self):
+    self.check(['lookup', '-c', 'rel_bot', '-g', '/foo'], ret=0,
                out=('\n'
                     'Writing """\\\n'
+                    'enable_doom_melon = true\n'
                     'goma_dir = "/foo"\n'
                     'is_debug = false\n'
                     'use_goma = true\n'
                     '""" to _path_/args.gn.\n\n'
                     '/fake_src/buildtools/linux64/gn gen _path_\n'))
 
-  def test_gyp_analyze(self):
-    mbw = self.check(['analyze', '-c', 'gyp_rel_bot', '//out/Release',
-                      '/tmp/in.json', '/tmp/out.json'], ret=0)
-    self.assertIn('analyzer', mbw.calls[0])
-
-  def test_gyp_crosscompile(self):
-    mbw = self.fake_mbw()
-    self.check(['gen', '-c', 'gyp_crosscompile', '//out/Release'],
-               mbw=mbw, ret=0)
-    self.assertTrue(mbw.cross_compile)
-
-  def test_gyp_gen(self):
-    self.check(['gen', '-c', 'gyp_rel_bot', '-g', '/goma', '//out/Release'],
-               ret=0,
-               out=("GYP_DEFINES='goma=1 gomadir=/goma'\n"
-                    "python build/gyp_chromium -G output_dir=out\n"))
-
-    mbw = self.fake_mbw(win32=True)
-    self.check(['gen', '-c', 'gyp_rel_bot', '-g', 'c:\\goma', '//out/Release'],
-               mbw=mbw, ret=0,
-               out=("set GYP_DEFINES=goma=1 gomadir='c:\\goma'\n"
-                    "python build\\gyp_chromium -G output_dir=out\n"))
-
-  def test_gyp_gen_fails(self):
-    mbw = self.fake_mbw()
-    mbw.Call = lambda cmd, env=None, buffer_output=True: (1, '', '')
-    self.check(['gen', '-c', 'gyp_rel_bot', '//out/Release'], mbw=mbw, ret=1)
-
-  def test_gyp_lookup_goma_dir_expansion(self):
-    self.check(['lookup', '-c', 'gyp_rel_bot', '-g', '/foo'], ret=0,
-               out=("GYP_DEFINES='goma=1 gomadir=/foo'\n"
-                    "python build/gyp_chromium -G output_dir=_path_\n"))
-
   def test_help(self):
     orig_stdout = sys.stdout
     try:
@@ -589,7 +579,7 @@ def test_multiple_phases(self):
     self.assertIn('Must specify a build --phase', mbw.out)
 
     # Check that passing a --phase to a single-phase builder fails.
-    mbw = self.check(['lookup', '-m', 'fake_master', '-b', 'fake_gn_builder',
+    mbw = self.check(['lookup', '-m', 'fake_master', '-b', 'fake_builder',
                       '--phase', 'phase_1'], ret=1)
     self.assertIn('Must not specify a build --phase', mbw.out)
 
@@ -611,16 +601,6 @@ def test_validate(self):
     mbw = self.fake_mbw()
     self.check(['validate'], mbw=mbw, ret=0)
 
-  def test_gyp_env_hacks(self):
-    mbw = self.fake_mbw()
-    mbw.files[mbw.default_config] = GYP_HACKS_CONFIG
-    self.check(['lookup', '-c', 'fake_config'], mbw=mbw,
-               ret=0,
-               out=("GYP_DEFINES='foo=bar baz=1'\n"
-                    "GYP_LINK_CONCURRENCY=1\n"
-                    "LLVM_FORCE_HEAD_REVISION=1\n"
-                    "python build/gyp_chromium -G output_dir=_path_\n"))
-
   def test_buildbucket(self):
     mbw = self.fake_mbw()
     mbw.files[mbw.default_config] = TRYSERVER_CONFIG
diff --git a/deps/v8/tools/mingw-generate-makefiles.sh b/deps/v8/tools/mingw-generate-makefiles.sh
deleted file mode 100755
index 67715fc15b0..00000000000
--- a/deps/v8/tools/mingw-generate-makefiles.sh
+++ /dev/null
@@ -1,97 +0,0 @@
-#!/bin/sh
-# Copyright 2013 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-# Monkey-patch GYP.
-cat > tools/gyp/gyp.mingw << EOF
-#!/usr/bin/env python
-
-# Copyright (c) 2009 Google Inc. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import sys
-
-# TODO(mark): sys.path manipulation is some temporary testing stuff.
-try:
-  import gyp
-except ImportError, e:
-  import os.path
-  sys.path.append(os.path.join(os.path.dirname(sys.argv[0]), 'pylib'))
-  import gyp
-  
-def MonkeyBuildFileTargets(target_list, build_file):
-  """From a target_list, returns the subset from the specified build_file.
-  """
-  build_file = build_file.replace('/', '\\\\')
-  return [p for p in target_list if gyp.common.BuildFile(p) == build_file]
-gyp.common.BuildFileTargets = MonkeyBuildFileTargets
-
-import gyp.generator.make
-import os
-def Monkey_ITIP(self):
-  """Returns the location of the final output for an installable target."""
-  sep = os.path.sep
-  # Xcode puts shared_library results into PRODUCT_DIR, and some gyp files
-  # rely on this. Emulate this behavior for mac.
-  if (self.type == 'shared_library' and
-      (self.flavor != 'mac' or self.toolset != 'target')):
-    # Install all shared libs into a common directory (per toolset) for
-    # convenient access with LD_LIBRARY_PATH.
-    return '\$(builddir)%slib.%s%s%s' % (sep, self.toolset, sep, self.alias)
-  return '\$(builddir)' + sep + self.alias
-gyp.generator.make.MakefileWriter._InstallableTargetInstallPath = Monkey_ITIP
-
-if __name__ == '__main__':
-  sys.exit(gyp.main(sys.argv[1:]))
-EOF
-
-# Delete old generated Makefiles.
-find out -name '*.mk' -or -name 'Makefile*' -exec rm {} \;
-
-# Generate fresh Makefiles.
-mv tools/gyp/gyp tools/gyp/gyp.original
-mv tools/gyp/gyp.mingw tools/gyp/gyp
-make out/Makefile.ia32
-mv tools/gyp/gyp tools/gyp/gyp.mingw
-mv tools/gyp/gyp.original tools/gyp/gyp
-
-# Patch generated Makefiles: replace most backslashes with forward slashes,
-# fix library names in linker flags.
-FILES=$(find out -name '*.mk' -or -name 'Makefile*')
-for F in $FILES ; do
-  echo "Patching $F..."
-  cp $F $F.orig
-  cat $F.orig \
-    | sed -e 's|\([)a-zA-Z0-9]\)\\\([a-zA-Z]\)|\1/\2|g' \
-          -e 's|\([)a-zA-Z0-9]\)\\\\\([a-zA-Z]\)|\1/\2|g' \
-          -e 's|'%s/n'|'%s\\\\n'|g' \
-          -e 's|-lwinmm\.lib|-lwinmm|g' \
-          -e 's|-lws2_32\.lib|-lws2_32|g' \
-    > $F
-  rm $F.orig
-done
diff --git a/deps/v8/tools/mips_toolchain.tar.gz.sha1 b/deps/v8/tools/mips_toolchain.tar.gz.sha1
new file mode 100644
index 00000000000..8d4572336a8
--- /dev/null
+++ b/deps/v8/tools/mips_toolchain.tar.gz.sha1
@@ -0,0 +1 @@
+d51b5d903340262d8d13ecd51054c16a901b3cf3
\ No newline at end of file
diff --git a/deps/v8/tools/node/build_gn.py b/deps/v8/tools/node/build_gn.py
index 8ab2a635ea2..e95c3491e74 100755
--- a/deps/v8/tools/node/build_gn.py
+++ b/deps/v8/tools/node/build_gn.py
@@ -17,6 +17,7 @@
   v8_enable_disassembler=0
 """
 
+import argparse
 import os
 import subprocess
 import sys
@@ -31,52 +32,71 @@
   "use_sysroot = false",
 ]
 
-BUILD_SUBDIR = "gn"
+BUILD_TARGET = "v8_monolith"
 
-# TODO: make this cross-platform.
-GN_SUBDIR = ["buildtools", "linux64", "gn"]
+def FindGn(options):
+  if options.host_os == "linux":
+    os_path = "linux64"
+  elif options.host_os == "mac":
+    os_path = "mac"
+  elif options.host_os == "win":
+    os_path = "win"
+  else:
+    raise "Operating system not supported by GN"
+  return os.path.join(options.v8_path, "buildtools", os_path, "gn")
 
-def Build(v8_path, build_path, depot_tools, is_debug, build_flags):
+def GenerateBuildFiles(options):
   print "Setting GN args."
-  lines = []
-  lines.extend(GN_ARGS)
-  for flag in build_flags:
+  gn = FindGn(options)
+  gn_args = []
+  gn_args.extend(GN_ARGS)
+  for flag in options.flag:
     flag = flag.replace("=1", "=true")
     flag = flag.replace("=0", "=false")
     flag = flag.replace("target_cpu=ia32", "target_cpu=\"x86\"")
-    lines.append(flag)
-  lines.append("is_debug = %s" % ("true" if is_debug else "false"))
-  with open(os.path.join(build_path, "args.gn"), "w") as args_file:
-    args_file.write("\n".join(lines))
-  gn = os.path.join(v8_path, *GN_SUBDIR)
-  subprocess.check_call([gn, "gen", "-C", build_path], cwd=v8_path)
-  ninja = os.path.join(depot_tools, "ninja")
+    gn_args.append(flag)
+  if options.mode == "DEBUG":
+    gn_args.append("is_debug = true")
+  else:
+    gn_args.append("is_debug = false")
+
+  if not os.path.isdir(options.build_path):
+    os.makedirs(options.build_path)
+  with open(os.path.join(options.build_path, "args.gn"), "w") as args_file:
+    args_file.write("\n".join(gn_args))
+  subprocess.check_call([gn, "gen", "-C", options.build_path],
+                        cwd=options.v8_path)
+
+def Build(options):
   print "Building."
-  subprocess.check_call([ninja, "-v", "-C", build_path, "v8_monolith"],
-                        cwd=v8_path)
+  depot_tools = node_common.EnsureDepotTools(options.v8_path, False)
+  ninja = os.path.join(depot_tools, "ninja")
+  subprocess.check_call([ninja, "-v", "-C", options.build_path, BUILD_TARGET],
+                        cwd=options.v8_path)
+
+def ParseOptions(args):
+  parser = argparse.ArgumentParser(
+      description="Build %s with GN" % BUILD_TARGET)
+  parser.add_argument("--mode", help="Build mode (Release/Debug)")
+  parser.add_argument("--v8_path", help="Path to V8")
+  parser.add_argument("--build_path", help="Path to build result")
+  parser.add_argument("--flag", help="Translate GYP flag to GN",
+                      action="append")
+  parser.add_argument("--host_os", help="Current operating system")
+  options = parser.parse_args(args)
 
-def Main(v8_path, build_path, is_debug, build_flags):
-  # Verify paths.
-  v8_path = os.path.abspath(v8_path)
-  assert os.path.isdir(v8_path)
-  build_path = os.path.abspath(build_path)
-  build_path = os.path.join(build_path, BUILD_SUBDIR)
-  if not os.path.isdir(build_path):
-    os.makedirs(build_path)
+  assert options.host_os
+  assert options.mode == "Debug" or options.mode == "Release"
 
-  # Check that we have depot tools.
-  depot_tools = node_common.EnsureDepotTools(v8_path, False)
+  assert options.v8_path
+  options.v8_path = os.path.abspath(options.v8_path)
+  assert os.path.isdir(options.v8_path)
 
-  # Build with GN.
-  Build(v8_path, build_path, depot_tools, is_debug, build_flags)
+  assert options.build_path
+  options.build_path = os.path.abspath(options.build_path)
+  return options
 
 if __name__ == "__main__":
-  # TODO: use argparse to parse arguments.
-  build_mode = sys.argv[1]
-  v8_path = sys.argv[2]
-  build_path = sys.argv[3]
-  assert build_mode == "Debug" or build_mode == "Release"
-  is_debug = build_mode == "Debug"
-  # TODO: introduce "--" flag for pass-through flags.
-  build_flags = sys.argv[4:]
-  Main(v8_path, build_path, is_debug, build_flags)
+  options = ParseOptions(sys.argv[1:])
+  GenerateBuildFiles(options)
+  Build(options)
diff --git a/deps/v8/tools/node/fetch_deps.py b/deps/v8/tools/node/fetch_deps.py
index a3e6d749177..c402e0a3c42 100755
--- a/deps/v8/tools/node/fetch_deps.py
+++ b/deps/v8/tools/node/fetch_deps.py
@@ -37,7 +37,6 @@
       "v8/third_party/catapult"               : None,
       "v8/third_party/colorama/src"           : None,
       "v8/third_party/instrumented_libraries" : None,
-      "v8/tools/gyp"                          : None,
       "v8/tools/luci-go"                      : None,
       "v8/tools/swarming_client"              : None,
     },
diff --git a/deps/v8/tools/node/test_update_node.py b/deps/v8/tools/node/test_update_node.py
index 1a29b4ea619..785517b8c85 100755
--- a/deps/v8/tools/node/test_update_node.py
+++ b/deps/v8/tools/node/test_update_node.py
@@ -18,12 +18,16 @@
 
 # Expectations.
 EXPECTED_GITIGNORE = """
-/testing/gtest/*
-!/testing/gtest/include
-/testing/gtest/include/*
-!/testing/gtest/include/gtest
-/testing/gtest/include/gtest/*
-!/testing/gtest/include/gtest/gtest_prod.h
+/third_party/googletest/*
+!/third_party/googletest/src
+/third_party/googletest/src/*
+!/third_party/googletest/src/googletest
+/third_party/googletest/src/googletest/*
+!/third_party/googletest/src/googletest/include
+/third_party/googletest/src/googletest/include/*
+!/third_party/googletest/src/googletest/include/gtest
+/third_party/googletest/src/googletest/include/gtest/*
+!/third_party/googletest/src/googletest/include/gtest/gtest_prod.h
 !/third_party/jinja2
 !/third_party/markupsafe
 /unrelated
@@ -34,6 +38,7 @@
  rename deps/v8/baz/{delete_me => v8_new} (100%)
  delete mode 100644 deps/v8/include/v8-version.h
  rename deps/v8/{delete_me => new/v8_new} (100%)
+ create mode 100644 deps/v8/third_party/googletest/src/googletest/include/gtest/gtest_prod.h
  create mode 100644 deps/v8/third_party/jinja2/jinja2
  create mode 100644 deps/v8/third_party/markupsafe/markupsafe
  create mode 100644 deps/v8/v8_new
@@ -43,9 +48,9 @@
   'v8_new',
   'new/v8_new',
   'baz/v8_new',
-  'testing/gtest/gtest_new',
-  'testing/gtest/new/gtest_new',
-  'testing/gtest/baz/gtest_new',
+  '/third_party/googletest/src/googletest/include/gtest/gtest_new',
+  '/third_party/googletest/src/googletest/include/gtest/new/gtest_new',
+  '/third_party/googletest/src/googletest/include/gtest/baz/gtest_new',
   'third_party/jinja2/jinja2',
   'third_party/markupsafe/markupsafe'
 ]
diff --git a/deps/v8/tools/node/testdata/v8/.gitignore b/deps/v8/tools/node/testdata/v8/.gitignore
index 855286229f8..cc2f1ca2022 100644
--- a/deps/v8/tools/node/testdata/v8/.gitignore
+++ b/deps/v8/tools/node/testdata/v8/.gitignore
@@ -1,4 +1,3 @@
 /unrelated
-/testing/gtest
 /third_party/jinja2
-/third_party/markupsafe
\ No newline at end of file
+/third_party/markupsafe
diff --git a/deps/v8/tools/node/testdata/v8/testing/gtest/baz/gtest_foo b/deps/v8/tools/node/testdata/v8/testing/gtest/baz/gtest_foo
new file mode 100644
index 00000000000..eb1ae458f8e
--- /dev/null
+++ b/deps/v8/tools/node/testdata/v8/testing/gtest/baz/gtest_foo
@@ -0,0 +1 @@
+...
diff --git a/deps/v8/tools/node/testdata/v8/testing/gtest/baz/gtest_new b/deps/v8/tools/node/testdata/v8/testing/gtest/baz/gtest_new
new file mode 100644
index 00000000000..eb1ae458f8e
--- /dev/null
+++ b/deps/v8/tools/node/testdata/v8/testing/gtest/baz/gtest_new
@@ -0,0 +1 @@
+...
diff --git a/deps/v8/tools/node/testdata/v8/testing/gtest/gtest_bar b/deps/v8/tools/node/testdata/v8/testing/gtest/gtest_bar
new file mode 100644
index 00000000000..eb1ae458f8e
--- /dev/null
+++ b/deps/v8/tools/node/testdata/v8/testing/gtest/gtest_bar
@@ -0,0 +1 @@
+...
diff --git a/deps/v8/tools/node/testdata/v8/testing/gtest/gtest_new b/deps/v8/tools/node/testdata/v8/testing/gtest/gtest_new
new file mode 100644
index 00000000000..eb1ae458f8e
--- /dev/null
+++ b/deps/v8/tools/node/testdata/v8/testing/gtest/gtest_new
@@ -0,0 +1 @@
+...
diff --git a/deps/v8/tools/node/testdata/v8/testing/gtest/new/gtest_new b/deps/v8/tools/node/testdata/v8/testing/gtest/new/gtest_new
new file mode 100644
index 00000000000..eb1ae458f8e
--- /dev/null
+++ b/deps/v8/tools/node/testdata/v8/testing/gtest/new/gtest_new
@@ -0,0 +1 @@
+...
diff --git a/deps/v8/tools/node/update_node.py b/deps/v8/tools/node/update_node.py
index ebd953a9035..759e9d5aac7 100755
--- a/deps/v8/tools/node/update_node.py
+++ b/deps/v8/tools/node/update_node.py
@@ -34,26 +34,34 @@
 TARGET_SUBDIR = os.path.join("deps", "v8")
 
 SUB_REPOSITORIES = [ ["base", "trace_event", "common"],
-                     ["testing", "gtest"],
+                     ["third_party", "googletest", "src"],
                      ["third_party", "jinja2"],
                      ["third_party", "markupsafe"] ]
 
 DELETE_FROM_GITIGNORE = [ "/base",
-                          "/testing/gtest",
+                          "/third_party/googletest/src",
                           "/third_party/jinja2",
                           "/third_party/markupsafe" ]
 
 # Node.js requires only a single header file from gtest to build V8.
 # Both jinja2 and markupsafe are required to generate part of the inspector.
-ADD_TO_GITIGNORE = [ "/testing/gtest/*",
-                     "!/testing/gtest/include",
-                     "/testing/gtest/include/*",
-                     "!/testing/gtest/include/gtest",
-                     "/testing/gtest/include/gtest/*",
-                     "!/testing/gtest/include/gtest/gtest_prod.h",
+ADD_TO_GITIGNORE = [ "/third_party/googletest/*",
+                     "!/third_party/googletest/BUILD.gn",
+                     "!/third_party/googletest/src",
+                     "/third_party/googletest/src/*",
+                     "!/third_party/googletest/src/googletest",
+                     "/third_party/googletest/src/googletest/*",
+                     "!/third_party/googletest/src/googletest/include",
+                     "/third_party/googletest/src/googletest/include/*",
+                     "!/third_party/googletest/src/googletest/include/gtest",
+                     "/third_party/googletest/src/googletest/include/gtest/*",
+                     "!/third_party/googletest/src/googletest/include/gtest/gtest_prod.h",
                      "!/third_party/jinja2",
                      "!/third_party/markupsafe" ]
 
+# Node.js owns deps/v8/gypfiles in their downstream repository.
+FILES_TO_KEEP = [ "gypfiles" ]
+
 def RunGclient(path):
   assert os.path.isdir(path)
   print ">> Running gclient sync"
@@ -73,7 +81,7 @@ def CommitPatch(options):
       cwd=options.v8_path,
   )
 
-def UpdateTarget(repository, options):
+def UpdateTarget(repository, options, files_to_keep):
   source = os.path.join(options.v8_path, *repository)
   target = os.path.join(options.node_path, TARGET_SUBDIR, *repository)
   print ">> Updating target directory %s" % target
@@ -83,16 +91,24 @@ def UpdateTarget(repository, options):
   # Remove possible remnants of previous incomplete runs.
   node_common.UninitGit(target)
 
-  git_commands = [
-    ["git", "init"],                             # initialize target repo
-    ["git", "remote", "add", "origin", source],  # point to the source repo
-    ["git", "fetch", "origin", "HEAD"],          # sync to the current branch
-    ["git", "reset", "--hard", "FETCH_HEAD"],    # reset to the current branch
-    ["git", "clean", "-fd"],                     # delete removed files
-  ]
+  git_args = []
+  git_args.append(["init"])                       # initialize target repo
+
+  if files_to_keep:
+    git_args.append(["add"] + files_to_keep)            # add and commit
+    git_args.append(["commit", "-m", "keep files"])     # files we want to keep
+
+  git_args.append(["remote", "add", "source", source])  # point to source repo
+  git_args.append(["fetch", "source", "HEAD"])          # sync to current branch
+  git_args.append(["checkout", "-f", "FETCH_HEAD"])     # switch to that branch
+  git_args.append(["clean", "-fd"])                     # delete removed files
+
+  if files_to_keep:
+    git_args.append(["cherry-pick", "master"])    # restore kept files
+
   try:
-    for command in git_commands:
-      subprocess.check_call(command, cwd=target)
+    for args in git_args:
+      subprocess.check_call(["git"] + args, cwd=target)
   except:
     raise
   finally:
@@ -155,11 +171,11 @@ def Main(args):
   if options.with_patch:
     CommitPatch(options)
   # Update main V8 repository.
-  UpdateTarget([""], options)
+  UpdateTarget([""], options, FILES_TO_KEEP)
   # Patch .gitignore before updating sub-repositories.
   UpdateGitIgnore(options)
   for repo in SUB_REPOSITORIES:
-    UpdateTarget(repo, options)
+    UpdateTarget(repo, options, None)
   if options.commit:
     CreateCommit(options)
 
diff --git a/deps/v8/tools/parser-shell.cc b/deps/v8/tools/parser-shell.cc
index 1a492239969..bcee2b82582 100644
--- a/deps/v8/tools/parser-shell.cc
+++ b/deps/v8/tools/parser-shell.cc
@@ -39,7 +39,6 @@
 #include "src/objects-inl.h"
 #include "src/parsing/parse-info.h"
 #include "src/parsing/parsing.h"
-#include "src/parsing/preparse-data-format.h"
 #include "src/parsing/preparse-data.h"
 #include "src/parsing/preparser.h"
 #include "src/parsing/scanner-character-streams.h"
@@ -59,9 +58,9 @@ class StringResource8 : public v8::String::ExternalOneByteStringResource {
   int length_;
 };
 
-std::pair<v8::base::TimeDelta, v8::base::TimeDelta> RunBaselineParser(
-    const char* fname, Encoding encoding, int repeat, v8::Isolate* isolate,
-    v8::Local<v8::Context> context) {
+v8::base::TimeDelta RunBaselineParser(const char* fname, Encoding encoding,
+                                      int repeat, v8::Isolate* isolate,
+                                      v8::Local<v8::Context> context) {
   int length = 0;
   const byte* source = ReadFileAndRepeat(fname, &length, repeat);
   v8::Local<v8::String> source_handle;
@@ -87,42 +86,21 @@ std::pair<v8::base::TimeDelta, v8::base::TimeDelta> RunBaselineParser(
       break;
     }
   }
-  v8::base::TimeDelta parse_time1, parse_time2;
+  v8::base::TimeDelta parse_time1;
   Handle<Script> script =
       reinterpret_cast<i::Isolate*>(isolate)->factory()->NewScript(
           v8::Utils::OpenHandle(*source_handle));
-  i::ScriptData* cached_data_impl = NULL;
-  // First round of parsing (produce data to cache).
-  {
-    ParseInfo info(script);
-    info.set_cached_data(&cached_data_impl);
-    info.set_compile_options(v8::ScriptCompiler::kProduceParserCache);
-    v8::base::ElapsedTimer timer;
-    timer.Start();
-    bool success =
-        parsing::ParseProgram(&info, reinterpret_cast<i::Isolate*>(isolate));
-    parse_time1 = timer.Elapsed();
-    if (!success) {
-      fprintf(stderr, "Parsing failed\n");
-      return std::make_pair(v8::base::TimeDelta(), v8::base::TimeDelta());
-    }
-  }
-  // Second round of parsing (consume cached data).
-  {
-    ParseInfo info(script);
-    info.set_cached_data(&cached_data_impl);
-    info.set_compile_options(v8::ScriptCompiler::kConsumeParserCache);
-    v8::base::ElapsedTimer timer;
-    timer.Start();
-    bool success =
-        parsing::ParseProgram(&info, reinterpret_cast<i::Isolate*>(isolate));
-    parse_time2 = timer.Elapsed();
-    if (!success) {
-      fprintf(stderr, "Parsing failed\n");
-      return std::make_pair(v8::base::TimeDelta(), v8::base::TimeDelta());
-    }
+  ParseInfo info(script);
+  v8::base::ElapsedTimer timer;
+  timer.Start();
+  bool success =
+      parsing::ParseProgram(&info, reinterpret_cast<i::Isolate*>(isolate));
+  parse_time1 = timer.Elapsed();
+  if (!success) {
+    fprintf(stderr, "Parsing failed\n");
+    return v8::base::TimeDelta();
   }
-  return std::make_pair(parse_time1, parse_time2);
+  return parse_time1;
 }
 
 
@@ -167,19 +145,14 @@ int main(int argc, char* argv[]) {
     {
       v8::Context::Scope scope(context);
       double first_parse_total = 0;
-      double second_parse_total = 0;
       for (size_t i = 0; i < fnames.size(); i++) {
-        std::pair<v8::base::TimeDelta, v8::base::TimeDelta> time =
-            RunBaselineParser(fnames[i].c_str(), encoding, repeat, isolate,
-                              context);
-        first_parse_total += time.first.InMillisecondsF();
-        second_parse_total += time.second.InMillisecondsF();
+        v8::base::TimeDelta time = RunBaselineParser(
+            fnames[i].c_str(), encoding, repeat, isolate, context);
+        first_parse_total += time.InMillisecondsF();
       }
       if (benchmark.empty()) benchmark = "Baseline";
-      printf("%s(FirstParseRunTime): %.f ms\n", benchmark.c_str(),
+      printf("%s(ParseRunTime): %.f ms\n", benchmark.c_str(),
              first_parse_total);
-      printf("%s(SecondParseRunTime): %.f ms\n", benchmark.c_str(),
-             second_parse_total);
     }
   }
   v8::V8::Dispose();
diff --git a/deps/v8/tools/predictable_wrapper.py b/deps/v8/tools/predictable_wrapper.py
index cf7bf00b3f6..c357c13b41b 100644
--- a/deps/v8/tools/predictable_wrapper.py
+++ b/deps/v8/tools/predictable_wrapper.py
@@ -19,6 +19,7 @@
 from testrunner.local import command
 
 MAX_TRIES = 3
+TIMEOUT = 120
 
 def main(args):
   def allocation_str(stdout):
@@ -27,7 +28,7 @@ def allocation_str(stdout):
         return line
     return None
 
-  cmd = command.Command(args[0], args[1:])
+  cmd = command.Command(args[0], args[1:], timeout=TIMEOUT)
 
   previous_allocations = None
   for run in range(1, MAX_TRIES + 1):
diff --git a/deps/v8/tools/presubmit.py b/deps/v8/tools/presubmit.py
index 9ac26ddb165..29469be7589 100755
--- a/deps/v8/tools/presubmit.py
+++ b/deps/v8/tools/presubmit.py
@@ -52,6 +52,7 @@
 
 # Special LINT rules diverging from default and reason.
 # build/header_guard: Our guards have the form "V8_FOO_H_", not "SRC_FOO_H_".
+#   We now run our own header guard check in PRESUBMIT.py.
 # build/include_what_you_use: Started giving false positives for variables
 #   named "string" and "map" assuming that you needed to include STL headers.
 
@@ -59,7 +60,9 @@
 -build/header_guard
 -build/include_what_you_use
 -readability/fn_size
+-readability/multiline_comment
 -runtime/references
+-whitespace/comments
 """.split()
 
 LINT_OUTPUT_PATTERN = re.compile(r'^.+[:(]\d+[:)]|^Done processing')
@@ -280,8 +283,7 @@ class SourceProcessor(SourceFileProcessor):
   Check that all files include a copyright notice and no trailing whitespaces.
   """
 
-  RELEVANT_EXTENSIONS = ['.js', '.cc', '.h', '.py', '.c',
-                         '.status', '.gyp', '.gypi']
+  RELEVANT_EXTENSIONS = ['.js', '.cc', '.h', '.py', '.c', '.status']
 
   def __init__(self):
     self.runtime_function_call_pattern = self.CreateRuntimeFunctionCallMatcher()
@@ -331,7 +333,7 @@ def GetPathsToSearch(self):
 
   def IgnoreDir(self, name):
     return (super(SourceProcessor, self).IgnoreDir(name) or
-            name in ('third_party', 'gyp', 'out', 'obj', 'DerivedSources'))
+            name in ('third_party', 'out', 'obj', 'DerivedSources'))
 
   IGNORE_COPYRIGHTS = ['box2d.js',
                        'cpplint.py',
diff --git a/deps/v8/tools/release/auto_roll.py b/deps/v8/tools/release/auto_roll.py
index b27675e60c8..429a7af8cae 100755
--- a/deps/v8/tools/release/auto_roll.py
+++ b/deps/v8/tools/release/auto_roll.py
@@ -20,7 +20,7 @@
 https://v8-roll.appspot.com/
 This only works with a Google account.
 
-CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel""")
+CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;luci.chromium.try:android_optional_gpu_tests_rel""")
 
 class Preparation(Step):
   MESSAGE = "Preparation."
diff --git a/deps/v8/tools/release/common_includes.py b/deps/v8/tools/release/common_includes.py
index d295e37d64a..5dd60df4596 100644
--- a/deps/v8/tools/release/common_includes.py
+++ b/deps/v8/tools/release/common_includes.py
@@ -51,6 +51,7 @@
 PUSH_MSG_NEW_RE = re.compile(r"^Version \d+\.\d+\.\d+$")
 VERSION_FILE = os.path.join("include", "v8-version.h")
 WATCHLISTS_FILE = "WATCHLISTS"
+RELEASE_WORKDIR = "/tmp/v8-release-scripts-work-dir/"
 
 # V8 base directory.
 V8_BASE = os.path.dirname(
diff --git a/deps/v8/tools/release/merge_to_branch.py b/deps/v8/tools/release/merge_to_branch.py
index 877d121b492..bf526bf5d87 100755
--- a/deps/v8/tools/release/merge_to_branch.py
+++ b/deps/v8/tools/release/merge_to_branch.py
@@ -241,11 +241,12 @@ def _ProcessOptions(self, options):
   def _Config(self):
     return {
       "BRANCHNAME": "prepare-merge",
-      "PERSISTFILE_BASENAME": "/tmp/v8-merge-to-branch-tempfile",
+      "PERSISTFILE_BASENAME": RELEASE_WORKDIR + "v8-merge-to-branch-tempfile",
       "ALREADY_MERGING_SENTINEL_FILE":
-          "/tmp/v8-merge-to-branch-tempfile-already-merging",
-      "TEMPORARY_PATCH_FILE": "/tmp/v8-prepare-merge-tempfile-temporary-patch",
-      "COMMITMSG_FILE": "/tmp/v8-prepare-merge-tempfile-commitmsg",
+          RELEASE_WORKDIR + "v8-merge-to-branch-tempfile-already-merging",
+      "TEMPORARY_PATCH_FILE":
+          RELEASE_WORKDIR + "v8-prepare-merge-tempfile-temporary-patch",
+      "COMMITMSG_FILE": RELEASE_WORKDIR + "v8-prepare-merge-tempfile-commitmsg",
     }
 
   def _Steps(self):
diff --git a/deps/v8/tools/release/roll_merge.py b/deps/v8/tools/release/roll_merge.py
index 2dd43eae3ac..44ed858f7e9 100755
--- a/deps/v8/tools/release/roll_merge.py
+++ b/deps/v8/tools/release/roll_merge.py
@@ -262,11 +262,13 @@ def _ProcessOptions(self, options):
   def _Config(self):
     return {
       "BRANCHNAME": "prepare-merge",
-      "PERSISTFILE_BASENAME": "/tmp/v8-merge-to-branch-tempfile",
+      "PERSISTFILE_BASENAME":
+          RELEASE_WORKDIR + "v8-merge-to-branch-tempfile",
       "ALREADY_MERGING_SENTINEL_FILE":
-          "/tmp/v8-merge-to-branch-tempfile-already-merging",
-      "TEMPORARY_PATCH_FILE": "/tmp/v8-prepare-merge-tempfile-temporary-patch",
-      "COMMITMSG_FILE": "/tmp/v8-prepare-merge-tempfile-commitmsg",
+          RELEASE_WORKDIR + "v8-merge-to-branch-tempfile-already-merging",
+      "TEMPORARY_PATCH_FILE":
+          RELEASE_WORKDIR + "v8-prepare-merge-tempfile-temporary-patch",
+      "COMMITMSG_FILE": RELEASE_WORKDIR + "v8-prepare-merge-tempfile-commitmsg",
     }
 
   def _Steps(self):
diff --git a/deps/v8/tools/release/test_scripts.py b/deps/v8/tools/release/test_scripts.py
index 759012d8334..afda6257b36 100755
--- a/deps/v8/tools/release/test_scripts.py
+++ b/deps/v8/tools/release/test_scripts.py
@@ -1037,7 +1037,7 @@ def CheckVersionCommit():
 https://v8-roll.appspot.com/
 This only works with a Google account.
 
-CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel
+CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;luci.chromium.try:android_optional_gpu_tests_rel
 
 TBR=reviewer@chromium.org"""
 
diff --git a/deps/v8/test/fuzzer/wasm_call/foo b/deps/v8/tools/release/testdata/v8/third_party/googletest/src/googletest/include/gtest/baz/gtest_new
similarity index 100%
rename from deps/v8/test/fuzzer/wasm_call/foo
rename to deps/v8/tools/release/testdata/v8/third_party/googletest/src/googletest/include/gtest/baz/gtest_new
diff --git a/deps/v8/tools/release/testdata/v8/third_party/googletest/src/googletest/include/gtest/gtest_new b/deps/v8/tools/release/testdata/v8/third_party/googletest/src/googletest/include/gtest/gtest_new
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/deps/v8/tools/release/testdata/v8/third_party/googletest/src/googletest/include/gtest/gtest_prod.h b/deps/v8/tools/release/testdata/v8/third_party/googletest/src/googletest/include/gtest/gtest_prod.h
new file mode 100644
index 00000000000..847c8bc75ed
--- /dev/null
+++ b/deps/v8/tools/release/testdata/v8/third_party/googletest/src/googletest/include/gtest/gtest_prod.h
@@ -0,0 +1 @@
+gtest_prod
diff --git a/deps/v8/tools/release/testdata/v8/third_party/googletest/src/googletest/include/gtest/new/gtest_new b/deps/v8/tools/release/testdata/v8/third_party/googletest/src/googletest/include/gtest/new/gtest_new
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/deps/v8/tools/release/update_node.py b/deps/v8/tools/release/update_node.py
deleted file mode 100755
index d060e5c6157..00000000000
--- a/deps/v8/tools/release/update_node.py
+++ /dev/null
@@ -1,176 +0,0 @@
-#!/usr/bin/env python
-# Copyright 2017 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-"""
-Use this script to update V8 in a Node.js checkout.
-
-Requirements:
-  - Node.js checkout in which V8 should be updated.
-  - V8 checkout at the commit to which Node.js should be updated.
-
-Usage:
-  $ update_node.py <path_to_v8> <path_to_node>
-
-  This will synchronize the content of <path_to_node>/deps/v8 with <path_to_v8>,
-  and a few V8 dependencies require in Node.js. It will also update .gitignore
-  appropriately.
-
-Optional flags:
-  --gclient     Run `gclient sync` on the V8 checkout before updating.
-  --commit      Create commit with the updated V8 in the Node.js checkout.
-  --with-patch  Also include currently staged files in the V8 checkout.
-"""
-
-import argparse
-import os
-import shutil
-import subprocess
-import sys
-import stat
-
-TARGET_SUBDIR = os.path.join("deps", "v8")
-
-SUB_REPOSITORIES = [ ["base", "trace_event", "common"],
-                     ["testing", "gtest"],
-                     ["third_party", "jinja2"],
-                     ["third_party", "markupsafe"] ]
-
-DELETE_FROM_GITIGNORE = [ "/base",
-                          "/testing/gtest",
-                          "/third_party/jinja2",
-                          "/third_party/markupsafe" ]
-
-# Node.js requires only a single header file from gtest to build V8.
-# Both jinja2 and markupsafe are required to generate part of the inspector.
-ADD_TO_GITIGNORE = [ "/testing/gtest/*",
-                     "!/testing/gtest/include",
-                     "/testing/gtest/include/*",
-                     "!/testing/gtest/include/gtest",
-                     "/testing/gtest/include/gtest/*",
-                     "!/testing/gtest/include/gtest/gtest_prod.h",
-                     "!/third_party/jinja2",
-                     "!/third_party/markupsafe" ]
-
-def RunGclient(path):
-  assert os.path.isdir(path)
-  print ">> Running gclient sync"
-  subprocess.check_call(["gclient", "sync", "--nohooks"], cwd=path)
-
-def UninitGit(path):
-  target = os.path.join(path, ".git")
-  if os.path.isdir(target):
-    print ">> Cleaning up %s" % path
-    def OnRmError(func, path, exec_info):
-      # This might happen on Windows
-      os.chmod(path, stat.S_IWRITE)
-      os.unlink(path)
-    shutil.rmtree(target, onerror=OnRmError)
-
-def CommitPatch(options):
-  """Makes a dummy commit for the changes in the index.
-
-  On trybots, bot_updated applies the patch to the index. We commit it to make
-  the fake git clone fetch it into node.js. We can leave the commit, as
-  bot_update will ensure a clean state on each run.
-  """
-  print ">> Committing patch"
-  subprocess.check_call(
-      ["git", "-c", "user.name=fake", "-c", "user.email=fake@chromium.org",
-       "commit", "--allow-empty", "-m", "placeholder-commit"],
-      cwd=options.v8_path,
-  )
-
-def UpdateTarget(repository, options):
-  source = os.path.join(options.v8_path, *repository)
-  target = os.path.join(options.node_path, TARGET_SUBDIR, *repository)
-  print ">> Updating target directory %s" % target
-  print ">>     from active branch at %s" % source
-  if not os.path.exists(target):
-    os.makedirs(target)
-  # Remove possible remnants of previous incomplete runs.
-  UninitGit(target)
-
-  git_commands = [
-    ["git", "init"],                             # initialize target repo
-    ["git", "remote", "add", "origin", source],  # point to the source repo
-    ["git", "fetch", "origin", "HEAD"],          # sync to the current branch
-    ["git", "reset", "--hard", "FETCH_HEAD"],    # reset to the current branch
-    ["git", "clean", "-fd"],                     # delete removed files
-  ]
-  try:
-    for command in git_commands:
-      subprocess.check_call(command, cwd=target)
-  except:
-    raise
-  finally:
-    UninitGit(target)
-
-def UpdateGitIgnore(options):
-  file_name = os.path.join(options.node_path, TARGET_SUBDIR, ".gitignore")
-  assert os.path.isfile(file_name)
-  print ">> Updating .gitignore with lines"
-  with open(file_name) as gitignore:
-    content = gitignore.readlines()
-  content = [x.strip() for x in content]
-  for x in DELETE_FROM_GITIGNORE:
-    if x in content:
-      print "- %s" % x
-      content.remove(x)
-  for x in ADD_TO_GITIGNORE:
-    if x not in content:
-      print "+ %s" % x
-      content.append(x)
-  content.sort(key=lambda x: x[1:] if x.startswith("!") else x)
-  with open(file_name, "w") as gitignore:
-    for x in content:
-      gitignore.write("%s\n" % x)
-
-def CreateCommit(options):
-  print ">> Creating commit."
-  # Find git hash from source.
-  githash = subprocess.check_output(["git", "rev-parse", "--short", "HEAD"],
-                                    cwd=options.v8_path).strip()
-  # Create commit at target.
-  git_commands = [
-    ["git", "checkout", "-b", "update_v8_to_%s" % githash],  # new branch
-    ["git", "add", "."],                                     # add files
-    ["git", "commit", "-m", "Update V8 to %s" % githash]     # new commit
-  ]
-  for command in git_commands:
-    subprocess.check_call(command, cwd=options.node_path)
-
-def ParseOptions(args):
-  parser = argparse.ArgumentParser(description="Update V8 in Node.js")
-  parser.add_argument("v8_path", help="Path to V8 checkout")
-  parser.add_argument("node_path", help="Path to Node.js checkout")
-  parser.add_argument("--gclient", action="store_true", help="Run gclient sync")
-  parser.add_argument("--commit", action="store_true", help="Create commit")
-  parser.add_argument("--with-patch", action="store_true",
-                      help="Apply also staged files")
-  options = parser.parse_args(args)
-  assert os.path.isdir(options.v8_path)
-  options.v8_path = os.path.abspath(options.v8_path)
-  assert os.path.isdir(options.node_path)
-  options.node_path = os.path.abspath(options.node_path)
-  return options
-
-def Main(args):
-  options = ParseOptions(args)
-  if options.gclient:
-    RunGclient(options.v8_path)
-  # Commit patch on trybots to main V8 repository.
-  if options.with_patch:
-    CommitPatch(options)
-  # Update main V8 repository.
-  UpdateTarget([""], options)
-  # Patch .gitignore before updating sub-repositories.
-  UpdateGitIgnore(options)
-  for repo in SUB_REPOSITORIES:
-    UpdateTarget(repo, options)
-  if options.commit:
-    CreateCommit(options)
-
-if __name__ == "__main__":
-  Main(sys.argv[1:])
diff --git a/deps/v8/tools/run-deopt-fuzzer.gyp b/deps/v8/tools/run-deopt-fuzzer.gyp
deleted file mode 100644
index 9eb6b538bc2..00000000000
--- a/deps/v8/tools/run-deopt-fuzzer.gyp
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'run_deopt_fuzzer_run',
-          'type': 'none',
-          'dependencies': [
-            '../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../gypfiles/features.gypi',
-            '../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'run-deopt-fuzzer.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/tools/run-deopt-fuzzer.isolate b/deps/v8/tools/run-deopt-fuzzer.isolate
deleted file mode 100644
index 196fb5dbbc2..00000000000
--- a/deps/v8/tools/run-deopt-fuzzer.isolate
+++ /dev/null
@@ -1,19 +0,0 @@
-# Copyright 2016 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'command': [
-      'run-deopt-fuzzer.py',
-    ],
-    'files': [
-      'run-deopt-fuzzer.py',
-    ],
-  },
-  'includes': [
-    'testrunner/testrunner.isolate',
-    '../src/d8.isolate',
-    '../test/mjsunit/mjsunit.isolate',
-    '../test/webkit/webkit.isolate',
-  ],
-}
diff --git a/deps/v8/tools/run-deopt-fuzzer.py b/deps/v8/tools/run-deopt-fuzzer.py
deleted file mode 100755
index ac2344b530f..00000000000
--- a/deps/v8/tools/run-deopt-fuzzer.py
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/usr/bin/env python
-#
-# Copyright 2017 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-
-import sys
-
-from testrunner import deopt_fuzzer
-
-
-if __name__ == "__main__":
-  sys.exit(deopt_fuzzer.DeoptFuzzer().execute())
diff --git a/deps/v8/tools/run-num-fuzzer.gyp b/deps/v8/tools/run-num-fuzzer.gyp
deleted file mode 100644
index bd3b9d6423d..00000000000
--- a/deps/v8/tools/run-num-fuzzer.gyp
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2017 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['test_isolation_mode != "noop"', {
-      'targets': [
-        {
-          'target_name': 'run_num_fuzzer_run',
-          'type': 'none',
-          'dependencies': [
-            '../src/d8.gyp:d8_run',
-          ],
-          'includes': [
-            '../gypfiles/features.gypi',
-            '../gypfiles/isolate.gypi',
-          ],
-          'sources': [
-            'run-num-fuzzer.isolate',
-          ],
-        },
-      ],
-    }],
-  ],
-}
diff --git a/deps/v8/tools/run-num-fuzzer.isolate b/deps/v8/tools/run-num-fuzzer.isolate
deleted file mode 100644
index d0aca421a7a..00000000000
--- a/deps/v8/tools/run-num-fuzzer.isolate
+++ /dev/null
@@ -1,21 +0,0 @@
-# Copyright 2017 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'command': [
-      'run-deopt-fuzzer.py',
-    ],
-    'files': [
-      'run-deopt-fuzzer.py',
-      'run-gc-fuzzer.py',
-    ],
-  },
-  'includes': [
-    'testrunner/testrunner.isolate',
-    '../src/d8.isolate',
-    '../test/benchmarks/benchmarks.isolate',
-    '../test/mjsunit/mjsunit.isolate',
-    '../test/webkit/webkit.isolate',
-  ],
-}
diff --git a/deps/v8/tools/run-gc-fuzzer.py b/deps/v8/tools/run-num-fuzzer.py
similarity index 54%
rename from deps/v8/tools/run-gc-fuzzer.py
rename to deps/v8/tools/run-num-fuzzer.py
index 6311d4fd295..9b5a065158c 100755
--- a/deps/v8/tools/run-gc-fuzzer.py
+++ b/deps/v8/tools/run-num-fuzzer.py
@@ -1,14 +1,14 @@
 #!/usr/bin/env python
 #
-# Copyright 2017 the V8 project authors. All rights reserved.
+# Copyright 2018 the V8 project authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 
 import sys
 
-from testrunner import gc_fuzzer
+from testrunner import num_fuzzer
 
 
 if __name__ == "__main__":
-  sys.exit(gc_fuzzer.GCFuzzer().execute())
+  sys.exit(num_fuzzer.NumFuzzer().execute())
diff --git a/deps/v8/tools/run_perf.py b/deps/v8/tools/run_perf.py
index 3823eb510c3..2bd4372453d 100755
--- a/deps/v8/tools/run_perf.py
+++ b/deps/v8/tools/run_perf.py
@@ -793,6 +793,12 @@ def _PushExecutable(self, shell_dir, target_dir, binary):
         target_dir,
         skip_if_missing=True,
     )
+    self._PushFile(
+        shell_dir,
+        "snapshot_blob_trusted.bin",
+        target_dir,
+        skip_if_missing=True,
+    )
     self._PushFile(
         shell_dir,
         "icudtl.dat",
@@ -1116,7 +1122,8 @@ def NodeCB(node):
       # Traverse graph/trace tree and iterate over all runnables.
       for runnable in FlattenRunnables(root, NodeCB):
         runnable_name = "/".join(runnable.graphs)
-        if not runnable_name.startswith(options.filter):
+        if (not runnable_name.startswith(options.filter) and
+            runnable_name + "/" != options.filter):
           continue
         print ">>> Running suite: %s" % runnable_name
 
diff --git a/deps/v8/tools/testrunner/base_runner.py b/deps/v8/tools/testrunner/base_runner.py
index 8fc09eed7b0..cfea1527d4a 100644
--- a/deps/v8/tools/testrunner/base_runner.py
+++ b/deps/v8/tools/testrunner/base_runner.py
@@ -5,8 +5,10 @@
 
 from collections import OrderedDict
 import json
+import multiprocessing
 import optparse
 import os
+import shlex
 import sys
 
 
@@ -17,10 +19,14 @@
     os.path.dirname(os.path.abspath(__file__))))
 
 
-from local import testsuite
-from local import utils
-
-from testproc.shard import ShardProc
+from testrunner.local import testsuite
+from testrunner.local import utils
+from testrunner.test_config import TestConfig
+from testrunner.testproc import progress
+from testrunner.testproc.rerun import RerunProc
+from testrunner.testproc.shard import ShardProc
+from testrunner.testproc.sigproc import SignalProc
+from testrunner.testproc.timeout import TimeoutProc
 
 
 BASE_DIR = (
@@ -31,8 +37,6 @@
 
 DEFAULT_OUT_GN = 'out.gn'
 
-ARCH_GUESS = utils.DefaultArch()
-
 # Map of test name synonyms to lists of test suites. Should be ordered by
 # expected runtimes (suites with slow test cases first). These groups are
 # invoked in separate steps on the bots.
@@ -90,6 +94,16 @@
   ],
 }
 
+# Double the timeout for these:
+SLOW_ARCHS = ["arm",
+              "mips",
+              "mipsel",
+              "mips64",
+              "mips64el",
+              "s390",
+              "s390x",
+              "arm64"]
+
 
 class ModeConfig(object):
   def __init__(self, flags, timeout_scalefactor, status_mode, execution_mode):
@@ -138,6 +152,12 @@ def __init__(self, flags, timeout_scalefactor, status_mode, execution_mode):
   ),
 }
 
+PROGRESS_INDICATORS = {
+  'verbose': progress.VerboseProgressIndicator,
+  'dots': progress.DotsProgressIndicator,
+  'color': progress.ColorProgressIndicator,
+  'mono': progress.MonochromeProgressIndicator,
+}
 
 class TestRunnerError(Exception):
   pass
@@ -162,6 +182,10 @@ def __init__(self, build_config):
     self.predictable = build_config['v8_enable_verify_predictable']
     self.tsan = build_config['is_tsan']
     self.ubsan_vptr = build_config['is_ubsan_vptr']
+    # Export only for MIPS target
+    if self.arch in ['mips', 'mipsel', 'mips64', 'mips64el']:
+      self.mips_arch_variant = build_config['mips_arch_variant']
+      self.mips_use_msa = build_config['mips_use_msa']
 
   def __str__(self):
     detected_options = []
@@ -204,6 +228,10 @@ def execute(self, sys_args=None):
     try:
       parser = self._create_parser()
       options, args = self._parse_args(parser, sys_args)
+      if options.swarming:
+        # Swarming doesn't print how isolated commands are called. Lets make
+        # this less cryptic by printing it ourselves.
+        print ' '.join(sys.argv)
 
       self._load_build_config(options)
 
@@ -215,14 +243,19 @@ def execute(self, sys_args=None):
         raise
 
       args = self._parse_test_args(args)
-      suites = self._get_suites(args, options.verbose)
+      suites = self._get_suites(args, options)
+      self._prepare_suites(suites, options)
 
       self._setup_env()
-      return self._do_execute(suites, args, options)
+
+      print(">>> Running tests for %s.%s" % (self.build_config.arch,
+                                            self.mode_name))
+      tests = [t for s in suites for t in s.tests]
+      return self._do_execute(tests, args, options)
     except TestRunnerError:
-      return 1
+      return utils.EXIT_CODE_INTERNAL_ERROR
     except KeyboardInterrupt:
-      return 2
+      return utils.EXIT_CODE_INTERRUPTED
 
   def _create_parser(self):
     parser = optparse.OptionParser()
@@ -247,14 +280,63 @@ def _add_parser_default_options(self, parser):
                       " and buildbot builds): %s" % MODES.keys())
     parser.add_option("--shell-dir", help="DEPRECATED! Executables from build "
                       "directory will be used")
-    parser.add_option("-v", "--verbose", help="Verbose output",
-                      default=False, action="store_true")
-    parser.add_option("--shard-count",
-                      help="Split tests into this number of shards",
-                      default=1, type="int")
-    parser.add_option("--shard-run",
-                      help="Run this shard from the split up tests.",
-                      default=1, type="int")
+    parser.add_option("--total-timeout-sec", default=0, type="int",
+                      help="How long should fuzzer run")
+    parser.add_option("--swarming", default=False, action="store_true",
+                      help="Indicates running test driver on swarming.")
+
+    parser.add_option("-j", help="The number of parallel tasks to run",
+                      default=0, type=int)
+
+    # Shard
+    parser.add_option("--shard-count", default=1, type=int,
+                      help="Split tests into this number of shards")
+    parser.add_option("--shard-run", default=1, type=int,
+                      help="Run this shard from the split up tests.")
+
+    # Progress
+    parser.add_option("-p", "--progress",
+                      choices=PROGRESS_INDICATORS.keys(), default="mono",
+                      help="The style of progress indicator (verbose, dots, "
+                           "color, mono)")
+    parser.add_option("--json-test-results",
+                      help="Path to a file for storing json results.")
+    parser.add_option("--junitout", help="File name of the JUnit output")
+    parser.add_option("--junittestsuite", default="v8tests",
+                      help="The testsuite name in the JUnit output file")
+
+    # Rerun
+    parser.add_option("--rerun-failures-count", default=0, type=int,
+                      help="Number of times to rerun each failing test case. "
+                           "Very slow tests will be rerun only once.")
+    parser.add_option("--rerun-failures-max", default=100, type=int,
+                      help="Maximum number of failing test cases to rerun")
+
+    # Test config
+    parser.add_option("--command-prefix", default="",
+                      help="Prepended to each shell command used to run a test")
+    parser.add_option("--extra-flags", action="append", default=[],
+                      help="Additional flags to pass to each test command")
+    parser.add_option("--isolates", action="store_true", default=False,
+                      help="Whether to test isolates")
+    parser.add_option("--no-harness", "--noharness",
+                      default=False, action="store_true",
+                      help="Run without test harness of a given suite")
+    parser.add_option("--random-seed", default=0, type=int,
+                      help="Default seed for initializing random generator")
+    parser.add_option("-t", "--timeout", default=60, type=int,
+                      help="Timeout for single test in seconds")
+    parser.add_option("-v", "--verbose", default=False, action="store_true",
+                      help="Verbose output")
+
+    # TODO(machenbach): Temporary options for rolling out new test runner
+    # features.
+    parser.add_option("--mastername", default='',
+                      help="Mastername property from infrastructure. Not "
+                           "setting this option indicates manual usage.")
+    parser.add_option("--buildername", default='',
+                      help="Buildername property from infrastructure. Not "
+                           "setting this option indicates manual usage.")
 
   def _add_parser_options(self, parser):
     pass
@@ -378,6 +460,12 @@ def _process_default_options(self, options):
       print('Warning: --shell-dir is deprecated. Searching for executables in '
             'build directory (%s) instead.' % self.outdir)
 
+    if options.j == 0:
+      options.j = multiprocessing.cpu_count()
+
+    options.command_prefix = shlex.split(options.command_prefix)
+    options.extra_flags = sum(map(shlex.split, options.extra_flags), [])
+
   def _buildbot_to_v8_mode(self, config):
     """Convert buildbot build configs to configs understood by the v8 runner.
 
@@ -471,9 +559,9 @@ def expand_test_group(name):
 
     return reduce(list.__add__, map(expand_test_group, args), [])
 
-  def _get_suites(self, args, verbose=False):
+  def _get_suites(self, args, options):
     names = self._args_to_suite_names(args)
-    return self._load_suites(names, verbose)
+    return self._load_suites(names, options)
 
   def _args_to_suite_names(self, args):
     # Use default tests if no test configuration was provided at the cmd line.
@@ -484,21 +572,105 @@ def _args_to_suite_names(self, args):
   def _get_default_suite_names(self):
     return []
 
-  def _expand_test_group(self, name):
-    return TEST_MAP.get(name, [name])
-
-  def _load_suites(self, names, verbose=False):
+  def _load_suites(self, names, options):
+    test_config = self._create_test_config(options)
     def load_suite(name):
-      if verbose:
+      if options.verbose:
         print '>>> Loading test suite: %s' % name
       return testsuite.TestSuite.LoadTestSuite(
-          os.path.join(self.basedir, 'test', name))
+          os.path.join(self.basedir, 'test', name),
+          test_config)
     return map(load_suite, names)
 
+  def _prepare_suites(self, suites, options):
+    self._load_status_files(suites, options)
+    for s in suites:
+      s.ReadTestCases()
+
+  def _load_status_files(self, suites, options):
+    # simd_mips is true if SIMD is fully supported on MIPS
+    variables = self._get_statusfile_variables(options)
+    for s in suites:
+      s.ReadStatusFile(variables)
+
+  def _get_statusfile_variables(self, options):
+    simd_mips = (
+      self.build_config.arch in ['mipsel', 'mips', 'mips64', 'mips64el'] and
+      self.build_config.mips_arch_variant == "r6" and
+      self.build_config.mips_use_msa)
+
+    mips_arch_variant = (
+      self.build_config.arch in ['mipsel', 'mips', 'mips64', 'mips64el'] and
+      self.build_config.mips_arch_variant)
+
+    # TODO(all): Combine "simulator" and "simulator_run".
+    # TODO(machenbach): In GN we can derive simulator run from
+    # target_arch != v8_target_arch in the dumped build config.
+    return {
+      "arch": self.build_config.arch,
+      "asan": self.build_config.asan,
+      "byteorder": sys.byteorder,
+      "dcheck_always_on": self.build_config.dcheck_always_on,
+      "deopt_fuzzer": False,
+      "endurance_fuzzer": False,
+      "gc_fuzzer": False,
+      "gc_stress": False,
+      "gcov_coverage": self.build_config.gcov_coverage,
+      "isolates": options.isolates,
+      "mips_arch_variant": mips_arch_variant,
+      "mode": self.mode_options.status_mode,
+      "msan": self.build_config.msan,
+      "no_harness": options.no_harness,
+      "no_i18n": self.build_config.no_i18n,
+      "no_snap": self.build_config.no_snap,
+      "novfp3": False,
+      "predictable": self.build_config.predictable,
+      "simd_mips": simd_mips,
+      "simulator": utils.UseSimulator(self.build_config.arch),
+      "simulator_run": False,
+      "system": utils.GuessOS(),
+      "tsan": self.build_config.tsan,
+      "ubsan_vptr": self.build_config.ubsan_vptr,
+    }
+
+  def _create_test_config(self, options):
+    timeout = options.timeout * self._timeout_scalefactor(options)
+    return TestConfig(
+        command_prefix=options.command_prefix,
+        extra_flags=options.extra_flags,
+        isolates=options.isolates,
+        mode_flags=self.mode_options.flags,
+        no_harness=options.no_harness,
+        noi18n=self.build_config.no_i18n,
+        random_seed=options.random_seed,
+        shell_dir=self.outdir,
+        timeout=timeout,
+        verbose=options.verbose,
+    )
+
+  def _timeout_scalefactor(self, options):
+    factor = self.mode_options.timeout_scalefactor
+
+    # Simulators are slow, therefore allow a longer timeout.
+    if self.build_config.arch in SLOW_ARCHS:
+      factor *= 2
+
+    # Predictable mode is slower.
+    if self.build_config.predictable:
+      factor *= 2
+
+    return factor
+
   # TODO(majeski): remove options & args parameters
   def _do_execute(self, suites, args, options):
     raise NotImplementedError()
 
+  def _prepare_procs(self, procs):
+    procs = filter(None, procs)
+    for i in xrange(0, len(procs) - 1):
+      procs[i].connect_to(procs[i + 1])
+    procs[0].setup()
+
   def _create_shard_proc(self, options):
     myid, count = self._get_shard_info(options)
     if count == 1:
@@ -541,3 +713,29 @@ def _get_shard_info(self, options):
       return 1, 1
 
     return shard_run, shard_count
+
+  def _create_progress_indicators(self, options):
+    procs = [PROGRESS_INDICATORS[options.progress]()]
+    if options.junitout:
+      procs.append(progress.JUnitTestProgressIndicator(options.junitout,
+                                                       options.junittestsuite))
+    if options.json_test_results:
+      procs.append(progress.JsonTestProgressIndicator(
+        options.json_test_results,
+        self.build_config.arch,
+        self.mode_options.execution_mode))
+    return procs
+
+  def _create_timeout_proc(self, options):
+    if not options.total_timeout_sec:
+      return None
+    return TimeoutProc(options.total_timeout_sec)
+
+  def _create_signal_proc(self):
+    return SignalProc()
+
+  def _create_rerun_proc(self, options):
+    if not options.rerun_failures_count:
+      return None
+    return RerunProc(options.rerun_failures_count,
+                     options.rerun_failures_max)
diff --git a/deps/v8/tools/testrunner/deopt_fuzzer.py b/deps/v8/tools/testrunner/deopt_fuzzer.py
deleted file mode 100755
index 5e6b79f5e9b..00000000000
--- a/deps/v8/tools/testrunner/deopt_fuzzer.py
+++ /dev/null
@@ -1,336 +0,0 @@
-#!/usr/bin/env python
-#
-# Copyright 2017 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-
-from os.path import join
-import json
-import math
-import multiprocessing
-import os
-import random
-import shlex
-import sys
-import time
-
-# Adds testrunner to the path hence it has to be imported at the beggining.
-import base_runner
-
-from testrunner.local import execution
-from testrunner.local import progress
-from testrunner.local import testsuite
-from testrunner.local import utils
-from testrunner.local import verbose
-from testrunner.objects import context
-
-
-DEFAULT_SUITES = ["mjsunit", "webkit"]
-TIMEOUT_DEFAULT = 60
-
-# Double the timeout for these:
-SLOW_ARCHS = ["arm",
-              "mipsel"]
-MAX_DEOPT = 1000000000
-DISTRIBUTION_MODES = ["smooth", "random"]
-
-
-class DeoptFuzzer(base_runner.BaseTestRunner):
-  def __init__(self, *args, **kwargs):
-    super(DeoptFuzzer, self).__init__(*args, **kwargs)
-
-  class RandomDistribution:
-    def __init__(self, seed=None):
-      seed = seed or random.randint(1, sys.maxint)
-      print "Using random distribution with seed %d" % seed
-      self._random = random.Random(seed)
-
-    def Distribute(self, n, m):
-      if n > m:
-        n = m
-      return self._random.sample(xrange(1, m + 1), n)
-
-  class SmoothDistribution:
-    """Distribute n numbers into the interval [1:m].
-    F1: Factor of the first derivation of the distribution function.
-    F2: Factor of the second derivation of the distribution function.
-    With F1 and F2 set to 0, the distribution will be equal.
-    """
-    def __init__(self, factor1=2.0, factor2=0.2):
-      self._factor1 = factor1
-      self._factor2 = factor2
-
-    def Distribute(self, n, m):
-      if n > m:
-        n = m
-      if n <= 1:
-        return [ 1 ]
-
-      result = []
-      x = 0.0
-      dx = 1.0
-      ddx = self._factor1
-      dddx = self._factor2
-      for i in range(0, n):
-        result += [ x ]
-        x += dx
-        dx += ddx
-        ddx += dddx
-
-      # Project the distribution into the interval [0:M].
-      result = [ x * m / result[-1] for x in result ]
-
-      # Equalize by n. The closer n is to m, the more equal will be the
-      # distribution.
-      for (i, x) in enumerate(result):
-        # The value of x if it was equally distributed.
-        equal_x = i / float(n - 1) * float(m - 1) + 1
-
-        # Difference factor between actual and equal distribution.
-        diff = 1 - (x / equal_x)
-
-        # Equalize x dependent on the number of values to distribute.
-        result[i] = int(x + (i + 1) * diff)
-      return result
-
-
-  def _distribution(self, options):
-    if options.distribution_mode == "random":
-      return self.RandomDistribution(options.seed)
-    if options.distribution_mode == "smooth":
-      return self.SmoothDistribution(options.distribution_factor1,
-                                     options.distribution_factor2)
-
-
-  def _add_parser_options(self, parser):
-    parser.add_option("--command-prefix",
-                      help="Prepended to each shell command used to run a test",
-                      default="")
-    parser.add_option("--coverage", help=("Exponential test coverage "
-                      "(range 0.0, 1.0) - 0.0: one test, 1.0 all tests (slow)"),
-                      default=0.4, type="float")
-    parser.add_option("--coverage-lift", help=("Lifts test coverage for tests "
-                      "with a small number of deopt points (range 0, inf)"),
-                      default=20, type="int")
-    parser.add_option("--distribution-factor1", help=("Factor of the first "
-                      "derivation of the distribution function"), default=2.0,
-                      type="float")
-    parser.add_option("--distribution-factor2", help=("Factor of the second "
-                      "derivation of the distribution function"), default=0.7,
-                      type="float")
-    parser.add_option("--distribution-mode", help=("How to select deopt points "
-                      "for a given test (smooth|random)"),
-                      default="smooth")
-    parser.add_option("--dump-results-file", help=("Dump maximum number of "
-                      "deopt points per test to a file"))
-    parser.add_option("--extra-flags",
-                      help="Additional flags to pass to each test command",
-                      default="")
-    parser.add_option("--isolates", help="Whether to test isolates",
-                      default=False, action="store_true")
-    parser.add_option("-j", help="The number of parallel tasks to run",
-                      default=0, type="int")
-    parser.add_option("-p", "--progress",
-                      help=("The style of progress indicator"
-                            " (verbose, dots, color, mono)"),
-                      choices=progress.PROGRESS_INDICATORS.keys(),
-                      default="mono")
-    parser.add_option("--seed", help="The seed for the random distribution",
-                      type="int")
-    parser.add_option("-t", "--timeout", help="Timeout in seconds",
-                      default= -1, type="int")
-    parser.add_option("--random-seed", default=0, dest="random_seed",
-                      help="Default seed for initializing random generator")
-    parser.add_option("--fuzzer-random-seed", default=0,
-                      help="Default seed for initializing fuzzer random "
-                      "generator")
-    return parser
-
-
-  def _process_options(self, options):
-    # Special processing of other options, sorted alphabetically.
-    options.command_prefix = shlex.split(options.command_prefix)
-    options.extra_flags = shlex.split(options.extra_flags)
-    if options.j == 0:
-      options.j = multiprocessing.cpu_count()
-    while options.random_seed == 0:
-      options.random_seed = random.SystemRandom().randint(-2147483648,
-                                                          2147483647)
-    if not options.distribution_mode in DISTRIBUTION_MODES:
-      print "Unknown distribution mode %s" % options.distribution_mode
-      return False
-    if options.distribution_factor1 < 0.0:
-      print ("Distribution factor1 %s is out of range. Defaulting to 0.0"
-          % options.distribution_factor1)
-      options.distribution_factor1 = 0.0
-    if options.distribution_factor2 < 0.0:
-      print ("Distribution factor2 %s is out of range. Defaulting to 0.0"
-          % options.distribution_factor2)
-      options.distribution_factor2 = 0.0
-    if options.coverage < 0.0 or options.coverage > 1.0:
-      print ("Coverage %s is out of range. Defaulting to 0.4"
-          % options.coverage)
-      options.coverage = 0.4
-    if options.coverage_lift < 0:
-      print ("Coverage lift %s is out of range. Defaulting to 0"
-          % options.coverage_lift)
-      options.coverage_lift = 0
-    return True
-
-  def _calculate_n_tests(self, m, options):
-    """Calculates the number of tests from m deopt points with exponential
-    coverage.
-    The coverage is expected to be between 0.0 and 1.0.
-    The 'coverage lift' lifts the coverage for tests with smaller m values.
-    """
-    c = float(options.coverage)
-    l = float(options.coverage_lift)
-    return int(math.pow(m, (m * c + l) / (m + l)))
-
-  def _get_default_suite_names(self):
-    return DEFAULT_SUITES
-
-  def _do_execute(self, suites, args, options):
-    print(">>> Running tests for %s.%s" % (self.build_config.arch,
-                                           self.mode_name))
-
-    dist = self._distribution(options)
-
-    # Populate context object.
-    timeout = options.timeout
-    if timeout == -1:
-      # Simulators are slow, therefore allow a longer default timeout.
-      if self.build_config.arch in SLOW_ARCHS:
-        timeout = 2 * TIMEOUT_DEFAULT;
-      else:
-        timeout = TIMEOUT_DEFAULT;
-
-    timeout *= self.mode_options.timeout_scalefactor
-    ctx = context.Context(self.build_config.arch,
-                          self.mode_options.execution_mode,
-                          self.outdir,
-                          self.mode_options.flags, options.verbose,
-                          timeout, options.isolates,
-                          options.command_prefix,
-                          options.extra_flags,
-                          False,  # Keep i18n on by default.
-                          options.random_seed,
-                          True,  # No sorting of test cases.
-                          0,  # Don't rerun failing tests.
-                          0,  # No use of a rerun-failing-tests maximum.
-                          False,  # No no_harness mode.
-                          False,  # Don't use perf data.
-                          False)  # Coverage not supported.
-
-    # Find available test suites and read test cases from them.
-    variables = {
-      "arch": self.build_config.arch,
-      "asan": self.build_config.asan,
-      "byteorder": sys.byteorder,
-      "dcheck_always_on": self.build_config.dcheck_always_on,
-      "deopt_fuzzer": True,
-      "gc_fuzzer": False,
-      "gc_stress": False,
-      "gcov_coverage": self.build_config.gcov_coverage,
-      "isolates": options.isolates,
-      "mode": self.mode_options.status_mode,
-      "msan": self.build_config.msan,
-      "no_harness": False,
-      "no_i18n": self.build_config.no_i18n,
-      "no_snap": self.build_config.no_snap,
-      "novfp3": False,
-      "predictable": self.build_config.predictable,
-      "simulator": utils.UseSimulator(self.build_config.arch),
-      "simulator_run": False,
-      "system": utils.GuessOS(),
-      "tsan": self.build_config.tsan,
-      "ubsan_vptr": self.build_config.ubsan_vptr,
-    }
-    num_tests = 0
-    test_id = 0
-
-    # Remember test case prototypes for the fuzzing phase.
-    test_backup = dict((s, []) for s in suites)
-
-    for s in suites:
-      s.ReadStatusFile(variables)
-      s.ReadTestCases(ctx)
-      if len(args) > 0:
-        s.FilterTestCasesByArgs(args)
-      s.FilterTestCasesByStatus(False)
-
-      test_backup[s] = s.tests
-      analysis_flags = ["--deopt-every-n-times", "%d" % MAX_DEOPT,
-                        "--print-deopt-stress"]
-      s.tests = [t.create_variant(t.variant, analysis_flags, 'analysis')
-                 for t in s.tests]
-      num_tests += len(s.tests)
-      for t in s.tests:
-        t.id = test_id
-        t.cmd = t.get_command(ctx)
-        test_id += 1
-
-    if num_tests == 0:
-      print "No tests to run."
-      return 0
-
-    print(">>> Collection phase")
-    progress_indicator = progress.PROGRESS_INDICATORS[options.progress]()
-    runner = execution.Runner(suites, progress_indicator, ctx)
-
-    exit_code = runner.Run(options.j)
-
-    print(">>> Analysis phase")
-    num_tests = 0
-    test_id = 0
-    for s in suites:
-      test_results = {}
-      for t in s.tests:
-        for line in runner.outputs[t].stdout.splitlines():
-          if line.startswith("=== Stress deopt counter: "):
-            test_results[t.path] = MAX_DEOPT - int(line.split(" ")[-1])
-      for t in s.tests:
-        if t.path not in test_results:
-          print "Missing results for %s" % t.path
-      if options.dump_results_file:
-        results_dict = dict((t.path, n) for (t, n) in test_results.iteritems())
-        with file("%s.%d.txt" % (options.dump_results_file, time.time()),
-                  "w") as f:
-          f.write(json.dumps(results_dict))
-
-      # Reset tests and redistribute the prototypes from the collection phase.
-      s.tests = []
-      if options.verbose:
-        print "Test distributions:"
-      for t in test_backup[s]:
-        max_deopt = test_results.get(t.path, 0)
-        if max_deopt == 0:
-          continue
-        n_deopt = self._calculate_n_tests(max_deopt, options)
-        distribution = dist.Distribute(n_deopt, max_deopt)
-        if options.verbose:
-          print "%s %s" % (t.path, distribution)
-        for n, d in enumerate(distribution):
-          fuzzing_flags = ["--deopt-every-n-times", "%d" % d]
-          s.tests.append(t.create_variant(t.variant, fuzzing_flags, n))
-      num_tests += len(s.tests)
-      for t in s.tests:
-        t.id = test_id
-        t.cmd = t.get_command(ctx)
-        test_id += 1
-
-    if num_tests == 0:
-      print "No tests to run."
-      return exit_code
-
-    print(">>> Deopt fuzzing phase (%d test cases)" % num_tests)
-    progress_indicator = progress.PROGRESS_INDICATORS[options.progress]()
-    runner = execution.Runner(suites, progress_indicator, ctx)
-
-    code = runner.Run(options.j)
-    return exit_code or code
-
-
-if __name__ == '__main__':
-  sys.exit(DeoptFuzzer().execute())
diff --git a/deps/v8/tools/testrunner/gc_fuzzer.py b/deps/v8/tools/testrunner/gc_fuzzer.py
deleted file mode 100755
index 18be227d989..00000000000
--- a/deps/v8/tools/testrunner/gc_fuzzer.py
+++ /dev/null
@@ -1,280 +0,0 @@
-#!/usr/bin/env python
-#
-# Copyright 2017 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-
-from os.path import join
-import itertools
-import json
-import math
-import multiprocessing
-import os
-import random
-import shlex
-import sys
-import time
-
-# Adds testrunner to the path hence it has to be imported at the beggining.
-import base_runner
-
-from testrunner.local import execution
-from testrunner.local import progress
-from testrunner.local import testsuite
-from testrunner.local import utils
-from testrunner.local import verbose
-from testrunner.objects import context
-
-
-DEFAULT_SUITES = ["mjsunit", "webkit", "benchmarks"]
-TIMEOUT_DEFAULT = 60
-
-# Double the timeout for these:
-SLOW_ARCHS = ["arm",
-              "mipsel"]
-
-
-class GCFuzzer(base_runner.BaseTestRunner):
-  def __init__(self, *args, **kwargs):
-    super(GCFuzzer, self).__init__(*args, **kwargs)
-
-    self.fuzzer_rng = None
-
-  def _add_parser_options(self, parser):
-    parser.add_option("--command-prefix",
-                      help="Prepended to each shell command used to run a test",
-                      default="")
-    parser.add_option("--coverage", help=("Exponential test coverage "
-                      "(range 0.0, 1.0) - 0.0: one test, 1.0 all tests (slow)"),
-                      default=0.4, type="float")
-    parser.add_option("--coverage-lift", help=("Lifts test coverage for tests "
-                      "with a low memory size reached (range 0, inf)"),
-                      default=20, type="int")
-    parser.add_option("--dump-results-file", help="Dump maximum limit reached")
-    parser.add_option("--extra-flags",
-                      help="Additional flags to pass to each test command",
-                      default="")
-    parser.add_option("--isolates", help="Whether to test isolates",
-                      default=False, action="store_true")
-    parser.add_option("-j", help="The number of parallel tasks to run",
-                      default=0, type="int")
-    parser.add_option("-p", "--progress",
-                      help=("The style of progress indicator"
-                            " (verbose, dots, color, mono)"),
-                      choices=progress.PROGRESS_INDICATORS.keys(),
-                      default="mono")
-    parser.add_option("-t", "--timeout", help="Timeout in seconds",
-                      default= -1, type="int")
-    parser.add_option("--random-seed", default=0,
-                      help="Default seed for initializing random generator")
-    parser.add_option("--fuzzer-random-seed", default=0,
-                      help="Default seed for initializing fuzzer random "
-                      "generator")
-    parser.add_option("--stress-compaction", default=False, action="store_true",
-                      help="Enable stress_compaction_percentage flag")
-
-    parser.add_option("--distribution-factor1", help="DEPRECATED")
-    parser.add_option("--distribution-factor2", help="DEPRECATED")
-    parser.add_option("--distribution-mode", help="DEPRECATED")
-    parser.add_option("--seed", help="DEPRECATED")
-    return parser
-
-
-  def _process_options(self, options):
-    # Special processing of other options, sorted alphabetically.
-    options.command_prefix = shlex.split(options.command_prefix)
-    options.extra_flags = shlex.split(options.extra_flags)
-    if options.j == 0:
-      options.j = multiprocessing.cpu_count()
-    while options.random_seed == 0:
-      options.random_seed = random.SystemRandom().randint(-2147483648,
-                                                          2147483647)
-    while options.fuzzer_random_seed == 0:
-      options.fuzzer_random_seed = random.SystemRandom().randint(-2147483648,
-                                                                 2147483647)
-    self.fuzzer_rng = random.Random(options.fuzzer_random_seed)
-    return True
-
-  def _calculate_n_tests(self, m, options):
-    """Calculates the number of tests from m points with exponential coverage.
-    The coverage is expected to be between 0.0 and 1.0.
-    The 'coverage lift' lifts the coverage for tests with smaller m values.
-    """
-    c = float(options.coverage)
-    l = float(options.coverage_lift)
-    return int(math.pow(m, (m * c + l) / (m + l)))
-
-  def _get_default_suite_names(self):
-    return DEFAULT_SUITES
-
-  def _do_execute(self, suites, args, options):
-    print(">>> Running tests for %s.%s" % (self.build_config.arch,
-                                           self.mode_name))
-
-    # Populate context object.
-    timeout = options.timeout
-    if timeout == -1:
-      # Simulators are slow, therefore allow a longer default timeout.
-      if self.build_config.arch in SLOW_ARCHS:
-        timeout = 2 * TIMEOUT_DEFAULT;
-      else:
-        timeout = TIMEOUT_DEFAULT;
-
-    timeout *= self.mode_options.timeout_scalefactor
-    ctx = context.Context(self.build_config.arch,
-                          self.mode_options.execution_mode,
-                          self.outdir,
-                          self.mode_options.flags, options.verbose,
-                          timeout, options.isolates,
-                          options.command_prefix,
-                          options.extra_flags,
-                          False,  # Keep i18n on by default.
-                          options.random_seed,
-                          True,  # No sorting of test cases.
-                          0,  # Don't rerun failing tests.
-                          0,  # No use of a rerun-failing-tests maximum.
-                          False,  # No no_harness mode.
-                          False,  # Don't use perf data.
-                          False)  # Coverage not supported.
-
-    num_tests = self._load_tests(args, options, suites, ctx)
-    if num_tests == 0:
-      print "No tests to run."
-      return 0
-
-    test_backup = dict(map(lambda s: (s, s.tests), suites))
-
-    print('>>> Collection phase')
-    for s in suites:
-      analysis_flags = ['--fuzzer-gc-analysis']
-      s.tests = map(lambda t: t.create_variant(t.variant, analysis_flags,
-                                               'analysis'),
-                    s.tests)
-      for t in s.tests:
-        t.cmd = t.get_command(ctx)
-
-    progress_indicator = progress.PROGRESS_INDICATORS[options.progress]()
-    runner = execution.Runner(suites, progress_indicator, ctx)
-    exit_code = runner.Run(options.j)
-
-    print('>>> Analysis phase')
-    test_results = dict()
-    for s in suites:
-      for t in s.tests:
-        # Skip failed tests.
-        if t.output_proc.has_unexpected_output(runner.outputs[t]):
-          print '%s failed, skipping' % t.path
-          continue
-        max_limit = self._get_max_limit_reached(runner.outputs[t])
-        if max_limit:
-          test_results[t.path] = max_limit
-
-    runner = None
-
-    if options.dump_results_file:
-      with file("%s.%d.txt" % (options.dump_results_file, time.time()),
-                "w") as f:
-        f.write(json.dumps(test_results))
-
-    num_tests = 0
-    for s in suites:
-      s.tests = []
-      for t in test_backup[s]:
-        max_percent = test_results.get(t.path, 0)
-        if not max_percent or max_percent < 1.0:
-          continue
-        max_percent = int(max_percent)
-
-        subtests_count = self._calculate_n_tests(max_percent, options)
-
-        if options.verbose:
-          print ('%s [x%d] (max marking limit=%.02f)' %
-                 (t.path, subtests_count, max_percent))
-        for i in xrange(0, subtests_count):
-          fuzzer_seed = self._next_fuzzer_seed()
-          fuzzing_flags = [
-            '--stress_marking', str(max_percent),
-            '--fuzzer_random_seed', str(fuzzer_seed),
-          ]
-          if options.stress_compaction:
-            fuzzing_flags.append('--stress_compaction_random')
-          s.tests.append(t.create_variant(t.variant, fuzzing_flags, i))
-      for t in s.tests:
-        t.cmd = t.get_command(ctx)
-      num_tests += len(s.tests)
-
-    if num_tests == 0:
-      print "No tests to run."
-      return exit_code
-
-    print(">>> Fuzzing phase (%d test cases)" % num_tests)
-    progress_indicator = progress.PROGRESS_INDICATORS[options.progress]()
-    runner = execution.Runner(suites, progress_indicator, ctx)
-
-    return runner.Run(options.j) or exit_code
-
-  def _load_tests(self, args, options, suites, ctx):
-    # Find available test suites and read test cases from them.
-    variables = {
-      "arch": self.build_config.arch,
-      "asan": self.build_config.asan,
-      "byteorder": sys.byteorder,
-      "dcheck_always_on": self.build_config.dcheck_always_on,
-      "deopt_fuzzer": False,
-      "gc_fuzzer": True,
-      "gc_stress": False,
-      "gcov_coverage": self.build_config.gcov_coverage,
-      "isolates": options.isolates,
-      "mode": self.mode_options.status_mode,
-      "msan": self.build_config.msan,
-      "no_harness": False,
-      "no_i18n": self.build_config.no_i18n,
-      "no_snap": self.build_config.no_snap,
-      "novfp3": False,
-      "predictable": self.build_config.predictable,
-      "simulator": utils.UseSimulator(self.build_config.arch),
-      "simulator_run": False,
-      "system": utils.GuessOS(),
-      "tsan": self.build_config.tsan,
-      "ubsan_vptr": self.build_config.ubsan_vptr,
-    }
-
-    num_tests = 0
-    test_id = 0
-    for s in suites:
-      s.ReadStatusFile(variables)
-      s.ReadTestCases(ctx)
-      if len(args) > 0:
-        s.FilterTestCasesByArgs(args)
-      s.FilterTestCasesByStatus(False)
-
-      num_tests += len(s.tests)
-      for t in s.tests:
-        t.id = test_id
-        test_id += 1
-
-    return num_tests
-
-  # Parses test stdout and returns what was the highest reached percent of the
-  # incremental marking limit (0-100).
-  @staticmethod
-  def _get_max_limit_reached(output):
-    if not output.stdout:
-      return None
-
-    for l in reversed(output.stdout.splitlines()):
-      if l.startswith('### Maximum marking limit reached ='):
-        return float(l.split()[6])
-
-    return None
-
-  def _next_fuzzer_seed(self):
-    fuzzer_seed = None
-    while not fuzzer_seed:
-      fuzzer_seed = self.fuzzer_rng.randint(-2147483648, 2147483647)
-    return fuzzer_seed
-
-
-if __name__ == '__main__':
-  sys.exit(GCFuzzer().execute())
diff --git a/deps/v8/tools/testrunner/local/command.py b/deps/v8/tools/testrunner/local/command.py
index 93b1ac9497b..adc9c2e4523 100644
--- a/deps/v8/tools/testrunner/local/command.py
+++ b/deps/v8/tools/testrunner/local/command.py
@@ -4,6 +4,7 @@
 
 
 import os
+import signal
 import subprocess
 import sys
 import threading
@@ -17,6 +18,19 @@
 SEM_NOGPFAULTERRORBOX = 0x0002  # Microsoft Platform SDK WinBase.h
 
 
+def setup_testing():
+  """For testing only: We use threading under the hood instead of
+  multiprocessing to make coverage work. Signal handling is only supported
+  in the main thread, so we disable it for testing.
+  """
+  signal.signal = lambda *_: None
+
+
+class AbortException(Exception):
+  """Indicates early abort on SIGINT, SIGTERM or internal hard timeout."""
+  pass
+
+
 class BaseCommand(object):
   def __init__(self, shell, args=None, cmd_prefix=None, timeout=60, env=None,
                verbose=False):
@@ -35,10 +49,16 @@ def execute(self, **additional_popen_kwargs):
 
     process = self._start_process(**additional_popen_kwargs)
 
+    # Variable to communicate with the signal handler.
+    abort_occured = [False]
+    def handler(signum, frame):
+      self._abort(process, abort_occured)
+    signal.signal(signal.SIGTERM, handler)
+
     # Variable to communicate with the timer.
     timeout_occured = [False]
     timer = threading.Timer(
-        self.timeout, self._on_timeout, [process, timeout_occured])
+        self.timeout, self._abort, [process, timeout_occured])
     timer.start()
 
     start_time = time.time()
@@ -47,6 +67,9 @@ def execute(self, **additional_popen_kwargs):
 
     timer.cancel()
 
+    if abort_occured[0]:
+      raise AbortException()
+
     return output.Output(
       process.returncode,
       timeout_occured[0],
@@ -85,12 +108,12 @@ def _get_env(self):
   def _kill_process(self, process):
     raise NotImplementedError()
 
-  def _on_timeout(self, process, timeout_occured):
-    timeout_occured[0] = True
+  def _abort(self, process, abort_called):
+    abort_called[0] = True
     try:
       self._kill_process(process)
     except OSError:
-      sys.stderr.write('Error: Process %s already ended.\n' % process.pid)
+      pass
 
   def __str__(self):
     return self.to_string()
diff --git a/deps/v8/tools/testrunner/local/execution.py b/deps/v8/tools/testrunner/local/execution.py
deleted file mode 100644
index d6d07253650..00000000000
--- a/deps/v8/tools/testrunner/local/execution.py
+++ /dev/null
@@ -1,293 +0,0 @@
-# Copyright 2012 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-import collections
-import os
-import re
-import shutil
-import sys
-import traceback
-
-from . import command
-from . import perfdata
-from . import statusfile
-from . import utils
-from . pool import Pool
-from ..objects import predictable
-
-
-# Base dir of the v8 checkout.
-BASE_DIR = os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(
-    os.path.abspath(__file__)))))
-TEST_DIR = os.path.join(BASE_DIR, "test")
-
-
-# Structure that keeps global information per worker process.
-ProcessContext = collections.namedtuple(
-    'process_context', ['sancov_dir'])
-
-
-TestJobResult = collections.namedtuple(
-    'TestJobResult', ['id', 'outproc_result'])
-
-def MakeProcessContext(sancov_dir):
-  return ProcessContext(sancov_dir)
-
-
-# Global function for multiprocessing, because pickling a static method doesn't
-# work on Windows.
-def run_job(job, process_context):
-  return job.run(process_context)
-
-
-class Job(object):
-  """Stores data to be sent over the multi-process boundary.
-
-  All contained fields will be pickled/unpickled.
-  """
-
-  def run(self, process_context):
-    raise NotImplementedError()
-
-
-class TestJob(Job):
-  def __init__(self, test_id, cmd, outproc, run_num):
-    self.test_id = test_id
-    self.cmd = cmd
-    self.outproc = outproc
-    self.run_num = run_num
-
-  def _rename_coverage_data(self, out, sancov_dir):
-    """Rename coverage data.
-
-    Rename files with PIDs to files with unique test IDs, because the number
-    of tests might be higher than pid_max. E.g.:
-    d8.1234.sancov -> d8.test.42.1.sancov, where 1234 was the process' PID,
-    42 is the test ID and 1 is the attempt (the same test might be rerun on
-    failures).
-    """
-    if sancov_dir and out.pid is not None:
-      # Doesn't work on windows so basename is sufficient to get the shell name.
-      shell = os.path.basename(self.cmd.shell)
-      sancov_file = os.path.join(sancov_dir, "%s.%d.sancov" % (shell, out.pid))
-
-      # Some tests are expected to fail and don't produce coverage data.
-      if os.path.exists(sancov_file):
-        parts = sancov_file.split(".")
-        new_sancov_file = ".".join(
-            parts[:-2] +
-            ["test", str(self.test_id), str(self.run_num)] +
-            parts[-1:]
-        )
-        assert not os.path.exists(new_sancov_file)
-        os.rename(sancov_file, new_sancov_file)
-
-  def run(self, context):
-    output = self.cmd.execute()
-    self._rename_coverage_data(output, context.sancov_dir)
-    return TestJobResult(self.test_id, self.outproc.process(output))
-
-
-class Runner(object):
-
-  def __init__(self, suites, progress_indicator, context, outproc_factory=None):
-    self.datapath = os.path.join("out", "testrunner_data")
-    self.perf_data_manager = perfdata.GetPerfDataManager(
-        context, self.datapath)
-    self.perfdata = self.perf_data_manager.GetStore(context.arch, context.mode)
-    self.perf_failures = False
-    self.printed_allocations = False
-    self.outproc_factory = outproc_factory or (lambda test: test.output_proc)
-    self.tests = [t for s in suites for t in s.tests]
-
-    # TODO(majeski): Pass dynamically instead of keeping them in the runner.
-    # Maybe some observer?
-    self.outputs = {t: None for t in self.tests}
-
-    self.suite_names = [s.name for s in suites]
-
-    # Always pre-sort by status file, slowest tests first.
-    self.tests.sort(key=lambda t: t.is_slow, reverse=True)
-
-    # Sort by stored duration if not opted out.
-    if not context.no_sorting:
-      self.tests.sort(key=lambda t: self.perfdata.FetchPerfData(t) or 1.0,
-                      reverse=True)
-
-    self._CommonInit(suites, progress_indicator, context)
-
-  def _CommonInit(self, suites, progress_indicator, context):
-    self.total = 0
-    for s in suites:
-      for t in s.tests:
-        t.id = self.total
-        self.total += 1
-    self.indicator = progress_indicator
-    progress_indicator.SetRunner(self)
-    self.context = context
-    self.succeeded = 0
-    self.remaining = self.total
-    self.failed = []
-    self.crashed = 0
-    self.reran_tests = 0
-
-  def _RunPerfSafe(self, fun):
-    try:
-      fun()
-    except Exception, e:
-      print("PerfData exception: %s" % e)
-      self.perf_failures = True
-
-  def _MaybeRerun(self, pool, test, result):
-    if test.run <= self.context.rerun_failures_count:
-      # Possibly rerun this test if its run count is below the maximum per
-      # test. <= as the flag controls reruns not including the first run.
-      if test.run == 1:
-        # Count the overall number of reran tests on the first rerun.
-        if self.reran_tests < self.context.rerun_failures_max:
-          self.reran_tests += 1
-        else:
-          # Don't rerun this if the overall number of rerun tests has been
-          # reached.
-          return
-      if (test.run >= 2 and
-          result.output.duration > self.context.timeout / 20.0):
-        # Rerun slow tests at most once.
-        return
-
-      # Rerun this test.
-      test.run += 1
-      pool.add([
-          TestJob(test.id, test.cmd, self.outproc_factory(test), test.run)
-      ])
-      self.remaining += 1
-      self.total += 1
-
-  def _ProcessTest(self, test, result, pool):
-    self.outputs[test] = result.output
-    has_unexpected_output = result.has_unexpected_output
-    if has_unexpected_output:
-      self.failed.append(test)
-      if result.output.HasCrashed():
-        self.crashed += 1
-    else:
-      self.succeeded += 1
-    self.remaining -= 1
-    # For the indicator, everything that happens after the first run is treated
-    # as unexpected even if it flakily passes in order to include it in the
-    # output.
-    self.indicator.HasRun(test, result.output,
-                          has_unexpected_output or test.run > 1)
-    if has_unexpected_output:
-      # Rerun test failures after the indicator has processed the results.
-      self._VerbosePrint("Attempting to rerun test after failure.")
-      self._MaybeRerun(pool, test, result)
-    # Update the perf database if the test succeeded.
-    return not has_unexpected_output
-
-  def Run(self, jobs):
-    self.indicator.Starting()
-    self._RunInternal(jobs)
-    self.indicator.Done()
-    if self.failed:
-      return 1
-    elif self.remaining:
-      return 2
-    return 0
-
-  def _RunInternal(self, jobs):
-    pool = Pool(jobs)
-    test_map = {}
-    queued_exception = [None]
-    def gen_tests():
-      for test in self.tests:
-        assert test.id >= 0
-        test_map[test.id] = test
-        try:
-          yield [
-              TestJob(test.id, test.cmd, self.outproc_factory(test), test.run)
-          ]
-        except Exception, e:
-          # If this failed, save the exception and re-raise it later (after
-          # all other tests have had a chance to run).
-          queued_exception[0] = e, traceback.format_exc()
-          continue
-    try:
-      it = pool.imap_unordered(
-          fn=run_job,
-          gen=gen_tests(),
-          process_context_fn=MakeProcessContext,
-          process_context_args=[self.context.sancov_dir],
-      )
-      for result in it:
-        if result.heartbeat:
-          self.indicator.Heartbeat()
-          continue
-
-        job_result = result.value
-        test_id = job_result.id
-        outproc_result = job_result.outproc_result
-
-        test = test_map[test_id]
-        update_perf = self._ProcessTest(test, outproc_result, pool)
-        if update_perf:
-          self._RunPerfSafe(lambda: self.perfdata.UpdatePerfData(
-              test, outproc_result.output.duration))
-    except KeyboardInterrupt:
-      raise
-    except:
-      traceback.print_exc()
-      raise
-    finally:
-      self._VerbosePrint("Closing process pool.")
-      pool.terminate()
-      self._VerbosePrint("Closing database connection.")
-      self._RunPerfSafe(self.perf_data_manager.close)
-      if self.perf_failures:
-        # Nuke perf data in case of failures. This might not work on windows as
-        # some files might still be open.
-        print "Deleting perf test data due to db corruption."
-        shutil.rmtree(self.datapath)
-    if queued_exception[0]:
-      e, stacktrace = queued_exception[0]
-      print stacktrace
-      raise e
-
-  def _VerbosePrint(self, text):
-    if self.context.verbose:
-      print text
-      sys.stdout.flush()
-
-
-class BreakNowException(Exception):
-  def __init__(self, value):
-    super(BreakNowException, self).__init__()
-    self.value = value
-
-  def __str__(self):
-    return repr(self.value)
diff --git a/deps/v8/tools/testrunner/local/perfdata.py b/deps/v8/tools/testrunner/local/perfdata.py
deleted file mode 100644
index 4cb618b0bec..00000000000
--- a/deps/v8/tools/testrunner/local/perfdata.py
+++ /dev/null
@@ -1,141 +0,0 @@
-# Copyright 2012 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-import os
-import shelve
-import threading
-
-
-class PerfDataEntry(object):
-  def __init__(self):
-    self.avg = 0.0
-    self.count = 0
-
-  def AddResult(self, result):
-    kLearnRateLimiter = 99  # Greater value means slower learning.
-    # We use an approximation of the average of the last 100 results here:
-    # The existing average is weighted with kLearnRateLimiter (or less
-    # if there are fewer data points).
-    effective_count = min(self.count, kLearnRateLimiter)
-    self.avg = self.avg * effective_count + result
-    self.count = effective_count + 1
-    self.avg /= self.count
-
-
-class PerfDataStore(object):
-  def __init__(self, datadir, arch, mode):
-    filename = os.path.join(datadir, "%s.%s.perfdata" % (arch, mode))
-    self.database = shelve.open(filename, protocol=2)
-    self.closed = False
-    self.lock = threading.Lock()
-
-  def __del__(self):
-    self.close()
-
-  def close(self):
-    if self.closed: return
-    self.database.close()
-    self.closed = True
-
-  def FetchPerfData(self, test):
-    """Returns the observed duration for |test| as read from the store."""
-    key = test.get_id()
-    if key in self.database:
-      return self.database[key].avg
-    return None
-
-  def UpdatePerfData(self, test, duration):
-    """Updates the persisted value in the store with duration."""
-    testkey = test.get_id()
-    self.RawUpdatePerfData(testkey, duration)
-
-  def RawUpdatePerfData(self, testkey, duration):
-    with self.lock:
-      if testkey in self.database:
-        entry = self.database[testkey]
-      else:
-        entry = PerfDataEntry()
-      entry.AddResult(duration)
-      self.database[testkey] = entry
-
-
-class PerfDataManager(object):
-  def __init__(self, datadir):
-    self.datadir = os.path.abspath(datadir)
-    if not os.path.exists(self.datadir):
-      os.makedirs(self.datadir)
-    self.stores = {}  # Keyed by arch, then mode.
-    self.closed = False
-    self.lock = threading.Lock()
-
-  def __del__(self):
-    self.close()
-
-  def close(self):
-    if self.closed: return
-    for arch in self.stores:
-      modes = self.stores[arch]
-      for mode in modes:
-        store = modes[mode]
-        store.close()
-    self.closed = True
-
-  def GetStore(self, arch, mode):
-    with self.lock:
-      if not arch in self.stores:
-        self.stores[arch] = {}
-      modes = self.stores[arch]
-      if not mode in modes:
-        modes[mode] = PerfDataStore(self.datadir, arch, mode)
-      return modes[mode]
-
-
-class NullPerfDataStore(object):
-  def UpdatePerfData(self, test, duration):
-    pass
-
-  def FetchPerfData(self, test):
-    return None
-
-
-class NullPerfDataManager(object):
-  def __init__(self):
-    pass
-
-  def GetStore(self, *args, **kwargs):
-    return NullPerfDataStore()
-
-  def close(self):
-    pass
-
-
-def GetPerfDataManager(context, datadir):
-  if context.use_perf_data:
-    return PerfDataManager(datadir)
-  else:
-    return NullPerfDataManager()
diff --git a/deps/v8/tools/testrunner/local/pool.py b/deps/v8/tools/testrunner/local/pool.py
index 9199b62d8af..7c9a250bc38 100644
--- a/deps/v8/tools/testrunner/local/pool.py
+++ b/deps/v8/tools/testrunner/local/pool.py
@@ -4,42 +4,38 @@
 # found in the LICENSE file.
 
 from Queue import Empty
-from multiprocessing import Event, Process, Queue
+from contextlib import contextmanager
+from multiprocessing import Process, Queue
+import os
+import signal
+import time
 import traceback
 
+from . import command
+
 
 def setup_testing():
   """For testing only: Use threading under the hood instead of multiprocessing
   to make coverage work.
   """
   global Queue
-  global Event
   global Process
   del Queue
-  del Event
   del Process
   from Queue import Queue
-  from threading import Event
   from threading import Thread as Process
+  # Monkeypatch threading Queue to look like multiprocessing Queue.
+  Queue.cancel_join_thread = lambda self: None
 
 
 class NormalResult():
   def __init__(self, result):
     self.result = result
-    self.exception = False
-    self.break_now = False
-
+    self.exception = None
 
 class ExceptionResult():
-  def __init__(self):
-    self.exception = True
-    self.break_now = False
-
-
-class BreakResult():
-  def __init__(self):
-    self.exception = False
-    self.break_now = True
+  def __init__(self, exception):
+    self.exception = exception
 
 
 class MaybeResult():
@@ -56,26 +52,43 @@ def create_result(value):
     return MaybeResult(False, value)
 
 
-def Worker(fn, work_queue, done_queue, done,
+def Worker(fn, work_queue, done_queue,
            process_context_fn=None, process_context_args=None):
   """Worker to be run in a child process.
-  The worker stops on two conditions. 1. When the poison pill "STOP" is
-  reached or 2. when the event "done" is set."""
+  The worker stops when the poison pill "STOP" is reached.
+  """
   try:
     kwargs = {}
     if process_context_fn and process_context_args is not None:
       kwargs.update(process_context=process_context_fn(*process_context_args))
     for args in iter(work_queue.get, "STOP"):
-      if done.is_set():
-        break
       try:
         done_queue.put(NormalResult(fn(*args, **kwargs)))
+      except command.AbortException:
+        # SIGINT, SIGTERM or internal hard timeout.
+        break
       except Exception, e:
         traceback.print_exc()
         print(">>> EXCEPTION: %s" % e)
-        done_queue.put(ExceptionResult())
+        done_queue.put(ExceptionResult(e))
+    # When we reach here on normal tear down, all items have been pulled from
+    # the done_queue before and this should have no effect. On fast abort, it's
+    # possible that a fast worker left items on the done_queue in memory, which
+    # will never be pulled. This call purges those to avoid a deadlock.
+    done_queue.cancel_join_thread()
   except KeyboardInterrupt:
-    done_queue.put(BreakResult())
+    assert False, 'Unreachable'
+
+
+@contextmanager
+def without_sig():
+  int_handler = signal.signal(signal.SIGINT, signal.SIG_IGN)
+  term_handler = signal.signal(signal.SIGTERM, signal.SIG_IGN)
+  try:
+    yield
+  finally:
+    signal.signal(signal.SIGINT, int_handler)
+    signal.signal(signal.SIGTERM, term_handler)
 
 
 class Pool():
@@ -88,24 +101,28 @@ class Pool():
   # Necessary to not overflow the queue's pipe if a keyboard interrupt happens.
   BUFFER_FACTOR = 4
 
-  def __init__(self, num_workers, heartbeat_timeout=30):
+  def __init__(self, num_workers, heartbeat_timeout=1):
     self.num_workers = num_workers
     self.processes = []
     self.terminated = False
+    self.abort_now = False
 
-    # Invariant: count >= #work_queue + #done_queue. It is greater when a
-    # worker takes an item from the work_queue and before the result is
+    # Invariant: processing_count >= #work_queue + #done_queue. It is greater
+    # when a worker takes an item from the work_queue and before the result is
     # submitted to the done_queue. It is equal when no worker is working,
     # e.g. when all workers have finished, and when no results are processed.
     # Count is only accessed by the parent process. Only the parent process is
     # allowed to remove items from the done_queue and to add items to the
     # work_queue.
-    self.count = 0
-    self.work_queue = Queue()
-    self.done_queue = Queue()
-    self.done = Event()
+    self.processing_count = 0
     self.heartbeat_timeout = heartbeat_timeout
 
+    # Disable sigint and sigterm to prevent subprocesses from capturing the
+    # signals.
+    with without_sig():
+      self.work_queue = Queue()
+      self.done_queue = Queue()
+
   def imap_unordered(self, fn, gen,
                      process_context_fn=None, process_context_args=None):
     """Maps function "fn" to items in generator "gen" on the worker processes
@@ -123,58 +140,63 @@ def imap_unordered(self, fn, gen,
           process_context_fn. All arguments will be pickled and sent beyond the
           process boundary.
     """
+    if self.terminated:
+      return
     try:
       internal_error = False
       gen = iter(gen)
       self.advance = self._advance_more
 
-      for w in xrange(self.num_workers):
-        p = Process(target=Worker, args=(fn,
-                                         self.work_queue,
-                                         self.done_queue,
-                                         self.done,
-                                         process_context_fn,
-                                         process_context_args))
-        p.start()
-        self.processes.append(p)
+      # Disable sigint and sigterm to prevent subprocesses from capturing the
+      # signals.
+      with without_sig():
+        for w in xrange(self.num_workers):
+          p = Process(target=Worker, args=(fn,
+                                          self.work_queue,
+                                          self.done_queue,
+                                          process_context_fn,
+                                          process_context_args))
+          p.start()
+          self.processes.append(p)
 
       self.advance(gen)
-      while self.count > 0:
+      while self.processing_count > 0:
         while True:
           try:
-            result = self.done_queue.get(timeout=self.heartbeat_timeout)
-            break
-          except Empty:
-            # Indicate a heartbeat. The iterator will continue fetching the
-            # next result.
-            yield MaybeResult.create_heartbeat()
-        self.count -= 1
-        if result.exception:
-          # TODO(machenbach): Handle a few known types of internal errors
-          # gracefully, e.g. missing test files.
-          internal_error = True
-          continue
-        elif result.break_now:
-          # A keyboard interrupt happened in one of the worker processes.
-          raise KeyboardInterrupt
-        else:
-          yield MaybeResult.create_result(result.result)
+            # Read from result queue in a responsive fashion. If available,
+            # this will return a normal result immediately or a heartbeat on
+            # heartbeat timeout (default 1 second).
+            result = self._get_result_from_queue()
+          except:
+            # TODO(machenbach): Handle a few known types of internal errors
+            # gracefully, e.g. missing test files.
+            internal_error = True
+            continue
+
+          if self.abort_now:
+            # SIGINT, SIGTERM or internal hard timeout.
+            return
+
+          yield result
+          break
+
         self.advance(gen)
     except KeyboardInterrupt:
-      raise
+      assert False, 'Unreachable'
     except Exception as e:
       traceback.print_exc()
       print(">>> EXCEPTION: %s" % e)
     finally:
-      self.terminate()
+      self._terminate()
+
     if internal_error:
       raise Exception("Internal error in a worker process.")
 
   def _advance_more(self, gen):
-    while self.count < self.num_workers * self.BUFFER_FACTOR:
+    while self.processing_count < self.num_workers * self.BUFFER_FACTOR:
       try:
         self.work_queue.put(gen.next())
-        self.count += 1
+        self.processing_count += 1
       except StopIteration:
         self.advance = self._advance_empty
         break
@@ -185,27 +207,51 @@ def _advance_empty(self, gen):
   def add(self, args):
     """Adds an item to the work queue. Can be called dynamically while
     processing the results from imap_unordered."""
+    assert not self.terminated
+
     self.work_queue.put(args)
-    self.count += 1
+    self.processing_count += 1
+
+  def abort(self):
+    """Schedules abort on next queue read.
+
+    This is safe to call when handling SIGINT, SIGTERM or when an internal
+    hard timeout is reached.
+    """
+    self.abort_now = True
 
-  def terminate(self):
+  def _terminate(self):
+    """Terminates execution and cleans up the queues.
+
+    If abort() was called before termination, this also terminates the
+    subprocesses and doesn't wait for ongoing tests.
+    """
     if self.terminated:
       return
     self.terminated = True
 
-    # For exceptional tear down set the "done" event to stop the workers before
-    # they empty the queue buffer.
-    self.done.set()
+    # Drain out work queue from tests
+    try:
+      while True:
+        self.work_queue.get(True, 0.1)
+    except Empty:
+      pass
 
-    for p in self.processes:
+    # Make sure all processes stop
+    for _ in self.processes:
       # During normal tear down the workers block on get(). Feed a poison pill
       # per worker to make them stop.
       self.work_queue.put("STOP")
 
+    if self.abort_now:
+      for p in self.processes:
+        os.kill(p.pid, signal.SIGTERM)
+
     for p in self.processes:
       p.join()
 
-    # Drain the queues to prevent failures when queues are garbage collected.
+    # Drain the queues to prevent stderr chatter when queues are garbage
+    # collected.
     try:
       while True: self.work_queue.get(False)
     except:
@@ -214,3 +260,22 @@ def terminate(self):
       while True: self.done_queue.get(False)
     except:
       pass
+
+  def _get_result_from_queue(self):
+    """Attempts to get the next result from the queue.
+
+    Returns: A wrapped result if one was available within heartbeat timeout,
+        a heartbeat result otherwise.
+    Raises:
+        Exception: If an exception occured when processing the task on the
+            worker side, it is reraised here.
+    """
+    while True:
+      try:
+        result = self.done_queue.get(timeout=self.heartbeat_timeout)
+        self.processing_count -= 1
+        if result.exception:
+          raise result.exception
+        return MaybeResult.create_result(result.result)
+      except Empty:
+        return MaybeResult.create_heartbeat()
diff --git a/deps/v8/tools/testrunner/local/pool_unittest.py b/deps/v8/tools/testrunner/local/pool_unittest.py
old mode 100644
new mode 100755
index 235eca6393d..240cd563f80
--- a/deps/v8/tools/testrunner/local/pool_unittest.py
+++ b/deps/v8/tools/testrunner/local/pool_unittest.py
@@ -3,9 +3,16 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import os
+import sys
 import unittest
 
-from pool import Pool
+# Needed because the test runner contains relative imports.
+TOOLS_PATH = os.path.dirname(os.path.dirname(os.path.dirname(
+    os.path.abspath(__file__))))
+sys.path.append(TOOLS_PATH)
+
+from testrunner.local.pool import Pool
 
 def Run(x):
   if x == 10:
@@ -17,6 +24,9 @@ def testNormal(self):
     results = set()
     pool = Pool(3)
     for result in pool.imap_unordered(Run, [[x] for x in range(0, 10)]):
+      if result.heartbeat:
+        # Any result can be a heartbeat due to timings.
+        continue
       results.add(result.value)
     self.assertEquals(set(range(0, 10)), results)
 
@@ -25,6 +35,9 @@ def testException(self):
     pool = Pool(3)
     with self.assertRaises(Exception):
       for result in pool.imap_unordered(Run, [[x] for x in range(0, 12)]):
+        if result.heartbeat:
+          # Any result can be a heartbeat due to timings.
+          continue
         # Item 10 will not appear in results due to an internal exception.
         results.add(result.value)
     expect = set(range(0, 12))
@@ -35,8 +48,15 @@ def testAdd(self):
     results = set()
     pool = Pool(3)
     for result in pool.imap_unordered(Run, [[x] for x in range(0, 10)]):
+      if result.heartbeat:
+        # Any result can be a heartbeat due to timings.
+        continue
       results.add(result.value)
       if result.value < 30:
         pool.add([result.value + 20])
     self.assertEquals(set(range(0, 10) + range(20, 30) + range(40, 50)),
                       results)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/deps/v8/tools/testrunner/local/progress.py b/deps/v8/tools/testrunner/local/progress.py
deleted file mode 100644
index f6ebddf2e5d..00000000000
--- a/deps/v8/tools/testrunner/local/progress.py
+++ /dev/null
@@ -1,452 +0,0 @@
-# Copyright 2012 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-from functools import wraps
-import json
-import os
-import sys
-import time
-
-from . import junit_output
-from . import statusfile
-from ..testproc import progress as progress_proc
-
-
-class ProgressIndicator(object):
-
-  def __init__(self):
-    self.runner = None
-
-  def SetRunner(self, runner):
-    self.runner = runner
-
-  def Starting(self):
-    pass
-
-  def Done(self):
-    pass
-
-  def HasRun(self, test, output, has_unexpected_output):
-    pass
-
-  def Heartbeat(self):
-    pass
-
-  def PrintFailureHeader(self, test):
-    if test.output_proc.negative:
-      negative_marker = '[negative] '
-    else:
-      negative_marker = ''
-    print "=== %(label)s %(negative)s===" % {
-      'label': test,
-      'negative': negative_marker,
-    }
-
-  def ToProgressIndicatorProc(self):
-    print ('Warning: %s is not available as a processor' %
-           self.__class__.__name__)
-    return None
-
-
-class IndicatorNotifier(object):
-  """Holds a list of progress indicators and notifies them all on events."""
-  def __init__(self):
-    self.indicators = []
-
-  def Register(self, indicator):
-    self.indicators.append(indicator)
-
-  def ToProgressIndicatorProcs(self):
-    return [i.ToProgressIndicatorProc() for i in self.indicators]
-
-
-# Forge all generic event-dispatching methods in IndicatorNotifier, which are
-# part of the ProgressIndicator interface.
-for func_name in ProgressIndicator.__dict__:
-  func = getattr(ProgressIndicator, func_name)
-  if callable(func) and not func.__name__.startswith('_'):
-    def wrap_functor(f):
-      @wraps(f)
-      def functor(self, *args, **kwargs):
-        """Generic event dispatcher."""
-        for indicator in self.indicators:
-          getattr(indicator, f.__name__)(*args, **kwargs)
-      return functor
-    setattr(IndicatorNotifier, func_name, wrap_functor(func))
-
-
-class SimpleProgressIndicator(ProgressIndicator):
-  """Abstract base class for {Verbose,Dots}ProgressIndicator"""
-
-  def Starting(self):
-    print 'Running %i tests' % self.runner.total
-
-  def Done(self):
-    print
-    for failed in self.runner.failed:
-      output = self.runner.outputs[failed]
-      self.PrintFailureHeader(failed)
-      if output.stderr:
-        print "--- stderr ---"
-        print output.stderr.strip()
-      if output.stdout:
-        print "--- stdout ---"
-        print output.stdout.strip()
-      print "Command: %s" % failed.cmd.to_string()
-      if output.HasCrashed():
-        print "exit code: %d" % output.exit_code
-        print "--- CRASHED ---"
-      if output.HasTimedOut():
-        print "--- TIMEOUT ---"
-    if len(self.runner.failed) == 0:
-      print "==="
-      print "=== All tests succeeded"
-      print "==="
-    else:
-      print
-      print "==="
-      print "=== %i tests failed" % len(self.runner.failed)
-      if self.runner.crashed > 0:
-        print "=== %i tests CRASHED" % self.runner.crashed
-      print "==="
-
-
-class VerboseProgressIndicator(SimpleProgressIndicator):
-
-  def HasRun(self, test, output, has_unexpected_output):
-    if has_unexpected_output:
-      if output.HasCrashed():
-        outcome = 'CRASH'
-      else:
-        outcome = 'FAIL'
-    else:
-      outcome = 'pass'
-    print 'Done running %s: %s' % (test, outcome)
-    sys.stdout.flush()
-
-  def Heartbeat(self):
-    print 'Still working...'
-    sys.stdout.flush()
-
-  def ToProgressIndicatorProc(self):
-    return progress_proc.VerboseProgressIndicator()
-
-
-class DotsProgressIndicator(SimpleProgressIndicator):
-
-  def HasRun(self, test, output, has_unexpected_output):
-    total = self.runner.succeeded + len(self.runner.failed)
-    if (total > 1) and (total % 50 == 1):
-      sys.stdout.write('\n')
-    if has_unexpected_output:
-      if output.HasCrashed():
-        sys.stdout.write('C')
-        sys.stdout.flush()
-      elif output.HasTimedOut():
-        sys.stdout.write('T')
-        sys.stdout.flush()
-      else:
-        sys.stdout.write('F')
-        sys.stdout.flush()
-    else:
-      sys.stdout.write('.')
-      sys.stdout.flush()
-
-  def ToProgressIndicatorProc(self):
-    return progress_proc.DotsProgressIndicator()
-
-
-class CompactProgressIndicator(ProgressIndicator):
-  """Abstract base class for {Color,Monochrome}ProgressIndicator"""
-
-  def __init__(self, templates):
-    super(CompactProgressIndicator, self).__init__()
-    self.templates = templates
-    self.last_status_length = 0
-    self.start_time = time.time()
-
-  def Done(self):
-    self.PrintProgress('Done')
-    print ""  # Line break.
-
-  def HasRun(self, test, output, has_unexpected_output):
-    self.PrintProgress(str(test))
-    if has_unexpected_output:
-      self.ClearLine(self.last_status_length)
-      self.PrintFailureHeader(test)
-      stdout = output.stdout.strip()
-      if len(stdout):
-        print self.templates['stdout'] % stdout
-      stderr = output.stderr.strip()
-      if len(stderr):
-        print self.templates['stderr'] % stderr
-      print "Command: %s" % test.cmd.to_string()
-      if output.HasCrashed():
-        print "exit code: %d" % output.exit_code
-        print "--- CRASHED ---"
-      if output.HasTimedOut():
-        print "--- TIMEOUT ---"
-
-  def Truncate(self, string, length):
-    if length and (len(string) > (length - 3)):
-      return string[:(length - 3)] + "..."
-    else:
-      return string
-
-  def PrintProgress(self, name):
-    self.ClearLine(self.last_status_length)
-    elapsed = time.time() - self.start_time
-    progress = 0 if not self.runner.total else (
-        ((self.runner.total - self.runner.remaining) * 100) //
-          self.runner.total)
-    status = self.templates['status_line'] % {
-      'passed': self.runner.succeeded,
-      'progress': progress,
-      'failed': len(self.runner.failed),
-      'test': name,
-      'mins': int(elapsed) / 60,
-      'secs': int(elapsed) % 60
-    }
-    status = self.Truncate(status, 78)
-    self.last_status_length = len(status)
-    print status,
-    sys.stdout.flush()
-
-
-class ColorProgressIndicator(CompactProgressIndicator):
-
-  def __init__(self):
-    templates = {
-      'status_line': ("[%(mins)02i:%(secs)02i|"
-                      "\033[34m%%%(progress) 4d\033[0m|"
-                      "\033[32m+%(passed) 4d\033[0m|"
-                      "\033[31m-%(failed) 4d\033[0m]: %(test)s"),
-      'stdout': "\033[1m%s\033[0m",
-      'stderr': "\033[31m%s\033[0m",
-    }
-    super(ColorProgressIndicator, self).__init__(templates)
-
-  def ClearLine(self, last_line_length):
-    print "\033[1K\r",
-
-  def ToProgressIndicatorProc(self):
-    return progress_proc.ColorProgressIndicator()
-
-
-class MonochromeProgressIndicator(CompactProgressIndicator):
-
-  def __init__(self):
-    templates = {
-      'status_line': ("[%(mins)02i:%(secs)02i|%%%(progress) 4d|"
-                      "+%(passed) 4d|-%(failed) 4d]: %(test)s"),
-      'stdout': '%s',
-      'stderr': '%s',
-    }
-    super(MonochromeProgressIndicator, self).__init__(templates)
-
-  def ClearLine(self, last_line_length):
-    print ("\r" + (" " * last_line_length) + "\r"),
-
-  def ToProgressIndicatorProc(self):
-    return progress_proc.MonochromeProgressIndicator()
-
-
-class JUnitTestProgressIndicator(ProgressIndicator):
-  def __init__(self, junitout, junittestsuite):
-    super(JUnitTestProgressIndicator, self).__init__()
-    self.junitout = junitout
-    self.juinttestsuite = junittestsuite
-    self.outputter = junit_output.JUnitTestOutput(junittestsuite)
-    if junitout:
-      self.outfile = open(junitout, "w")
-    else:
-      self.outfile = sys.stdout
-
-  def Done(self):
-    self.outputter.FinishAndWrite(self.outfile)
-    if self.outfile != sys.stdout:
-      self.outfile.close()
-
-  def HasRun(self, test, output, has_unexpected_output):
-    fail_text = ""
-    if has_unexpected_output:
-      stdout = output.stdout.strip()
-      if len(stdout):
-        fail_text += "stdout:\n%s\n" % stdout
-      stderr = output.stderr.strip()
-      if len(stderr):
-        fail_text += "stderr:\n%s\n" % stderr
-      fail_text += "Command: %s" % test.cmd.to_string()
-      if output.HasCrashed():
-        fail_text += "exit code: %d\n--- CRASHED ---" % output.exit_code
-      if output.HasTimedOut():
-        fail_text += "--- TIMEOUT ---"
-    self.outputter.HasRunTest(
-        test_name=str(test),
-        test_cmd=test.cmd.to_string(relative=True),
-        test_duration=output.duration,
-        test_failure=fail_text)
-
-  def ToProgressIndicatorProc(self):
-    if self.outfile != sys.stdout:
-      self.outfile.close()
-    return progress_proc.JUnitTestProgressIndicator(self.junitout,
-                                                    self.junittestsuite)
-
-
-class JsonTestProgressIndicator(ProgressIndicator):
-
-  def __init__(self, json_test_results, arch, mode, random_seed):
-    super(JsonTestProgressIndicator, self).__init__()
-    self.json_test_results = json_test_results
-    self.arch = arch
-    self.mode = mode
-    self.random_seed = random_seed
-    self.results = []
-    self.tests = []
-
-  def ToProgressIndicatorProc(self):
-    return progress_proc.JsonTestProgressIndicator(
-        self.json_test_results, self.arch, self.mode, self.random_seed)
-
-  def Done(self):
-    complete_results = []
-    if os.path.exists(self.json_test_results):
-      with open(self.json_test_results, "r") as f:
-        # Buildbot might start out with an empty file.
-        complete_results = json.loads(f.read() or "[]")
-
-    duration_mean = None
-    if self.tests:
-      # Get duration mean.
-      duration_mean = (
-          sum(duration for (_, duration) in self.tests) /
-          float(len(self.tests)))
-
-    # Sort tests by duration.
-    self.tests.sort(key=lambda (_, duration): duration, reverse=True)
-    slowest_tests = [
-      {
-        "name": str(test),
-        "flags": test.cmd.args,
-        "command": test.cmd.to_string(relative=True),
-        "duration": duration,
-        "marked_slow": test.is_slow,
-      } for (test, duration) in self.tests[:20]
-    ]
-
-    complete_results.append({
-      "arch": self.arch,
-      "mode": self.mode,
-      "results": self.results,
-      "slowest_tests": slowest_tests,
-      "duration_mean": duration_mean,
-      "test_total": len(self.tests),
-    })
-
-    with open(self.json_test_results, "w") as f:
-      f.write(json.dumps(complete_results))
-
-  def HasRun(self, test, output, has_unexpected_output):
-    # Buffer all tests for sorting the durations in the end.
-    self.tests.append((test, output.duration))
-    if not has_unexpected_output:
-      # Omit tests that run as expected. Passing tests of reruns after failures
-      # will have unexpected_output to be reported here has well.
-      return
-
-    self.results.append({
-      "name": str(test),
-      "flags": test.cmd.args,
-      "command": test.cmd.to_string(relative=True),
-      "run": test.run,
-      "stdout": output.stdout,
-      "stderr": output.stderr,
-      "exit_code": output.exit_code,
-      "result": test.output_proc.get_outcome(output),
-      "expected": test.expected_outcomes,
-      "duration": output.duration,
-
-      # TODO(machenbach): This stores only the global random seed from the
-      # context and not possible overrides when using random-seed stress.
-      "random_seed": self.random_seed,
-      "target_name": test.get_shell(),
-      "variant": test.variant,
-    })
-
-
-class FlakinessTestProgressIndicator(ProgressIndicator):
-
-  def __init__(self, json_test_results):
-    super(FlakinessTestProgressIndicator, self).__init__()
-    self.json_test_results = json_test_results
-    self.results = {}
-    self.summary = {
-      "PASS": 0,
-      "FAIL": 0,
-      "CRASH": 0,
-      "TIMEOUT": 0,
-    }
-    self.seconds_since_epoch = time.time()
-
-  def Done(self):
-    with open(self.json_test_results, "w") as f:
-      json.dump({
-        "interrupted": False,
-        "num_failures_by_type": self.summary,
-        "path_delimiter": "/",
-        "seconds_since_epoch": self.seconds_since_epoch,
-        "tests": self.results,
-        "version": 3,
-      }, f)
-
-  def HasRun(self, test, output, has_unexpected_output):
-    key = test.get_id()
-    outcome = test.output_proc.get_outcome(output)
-    assert outcome in ["PASS", "FAIL", "CRASH", "TIMEOUT"]
-    if test.run == 1:
-      # First run of this test.
-      self.results[key] = {
-        "actual": outcome,
-        "expected": " ".join(test.expected_outcomes),
-        "times": [output.duration],
-      }
-      self.summary[outcome] = self.summary[outcome] + 1
-    else:
-      # This is a rerun and a previous result exists.
-      result = self.results[key]
-      result["actual"] = "%s %s" % (result["actual"], outcome)
-      result["times"].append(output.duration)
-
-
-PROGRESS_INDICATORS = {
-  'verbose': VerboseProgressIndicator,
-  'dots': DotsProgressIndicator,
-  'color': ColorProgressIndicator,
-  'mono': MonochromeProgressIndicator
-}
diff --git a/deps/v8/tools/testrunner/local/statusfile.py b/deps/v8/tools/testrunner/local/statusfile.py
index 988750d6b47..ecfbf008a23 100644
--- a/deps/v8/tools/testrunner/local/statusfile.py
+++ b/deps/v8/tools/testrunner/local/statusfile.py
@@ -34,8 +34,8 @@
 # Possible outcomes
 FAIL = "FAIL"
 PASS = "PASS"
-TIMEOUT = "TIMEOUT" # TODO(majeski): unused in status files
-CRASH = "CRASH" # TODO(majeski): unused in status files
+TIMEOUT = "TIMEOUT"
+CRASH = "CRASH"
 
 # Outcomes only for status file, need special handling
 FAIL_OK = "FAIL_OK"
@@ -59,7 +59,7 @@
             "android_arm", "android_arm64", "android_ia32", "android_x64",
             "arm", "arm64", "ia32", "mips", "mipsel", "mips64", "mips64el",
             "x64", "ppc", "ppc64", "s390", "s390x", "macos", "windows",
-            "linux", "aix"]:
+            "linux", "aix", "r1", "r2", "r3", "r5", "r6"]:
   VARIABLES[var] = var
 
 # Allow using variants as keywords.
diff --git a/deps/v8/tools/testrunner/local/testsuite.py b/deps/v8/tools/testrunner/local/testsuite.py
index 6a9e9831ce7..4bdfd008fe8 100644
--- a/deps/v8/tools/testrunner/local/testsuite.py
+++ b/deps/v8/tools/testrunner/local/testsuite.py
@@ -34,32 +34,12 @@
 from . import statusfile
 from . import utils
 from ..objects.testcase import TestCase
-from variants import ALL_VARIANTS, ALL_VARIANT_FLAGS
+from .variants import ALL_VARIANTS, ALL_VARIANT_FLAGS
 
 
 STANDARD_VARIANT = set(["default"])
 
 
-class LegacyVariantsGenerator(object):
-  def __init__(self, suite, variants):
-    self.suite = suite
-    self.all_variants = ALL_VARIANTS & variants
-    self.standard_variant = STANDARD_VARIANT & variants
-
-  def FilterVariantsByTest(self, test):
-    if test.only_standard_variant:
-      return self.standard_variant
-    return self.all_variants
-
-  def GetFlagSets(self, test, variant):
-    return ALL_VARIANT_FLAGS[variant]
-
-
-class StandardLegacyVariantsGenerator(LegacyVariantsGenerator):
-  def FilterVariantsByTest(self, testcase):
-    return self.standard_variant
-
-
 class VariantsGenerator(object):
   def __init__(self, variants):
     self._all_variants = [v for v in variants if v in ALL_VARIANTS]
@@ -80,45 +60,58 @@ def _get_variants(self, test):
     return self._all_variants
 
 
+class TestCombiner(object):
+  def get_group_key(self, test):
+    """To indicate what tests can be combined with each other we define a group
+    key for each test. Tests with the same group key can be combined. Test
+    without a group key (None) is not combinable with any other test.
+    """
+    raise NotImplementedError()
+
+  def combine(self, name, tests):
+    """Returns test combined from `tests`. Since we identify tests by their
+    suite and name, `name` parameter should be unique within one suite.
+    """
+    return self._combined_test_class()(name, tests)
+
+  def _combined_test_class(self):
+    raise NotImplementedError()
+
+
 class TestSuite(object):
   @staticmethod
-  def LoadTestSuite(root):
+  def LoadTestSuite(root, test_config):
     name = root.split(os.path.sep)[-1]
     f = None
     try:
       (f, pathname, description) = imp.find_module("testcfg", [root])
       module = imp.load_module(name + "_testcfg", f, pathname, description)
-      return module.GetSuite(name, root)
+      return module.GetSuite(name, root, test_config)
     finally:
       if f:
         f.close()
 
-  def __init__(self, name, root):
-    # Note: This might be called concurrently from different processes.
+  def __init__(self, name, root, test_config):
     self.name = name  # string
     self.root = root  # string containing path
+    self.test_config = test_config
     self.tests = None  # list of TestCase objects
     self.statusfile = None
+    self.suppress_internals = False
 
   def status_file(self):
     return "%s/%s.status" % (self.root, self.name)
 
-  def ListTests(self, context):
-    raise NotImplementedError
-
-  def _LegacyVariantsGeneratorFactory(self):
-    """The variant generator class to be used."""
-    return LegacyVariantsGenerator
+  def do_suppress_internals(self):
+    """Specifies if this test suite should suppress asserts based on internals.
 
-  def CreateLegacyVariantsGenerator(self, variants):
-    """Return a generator for the testing variants of this suite.
-
-    Args:
-      variants: List of variant names to be run as specified by the test
-                runner.
-    Returns: An object of type LegacyVariantsGenerator.
+    Internals are e.g. testing against the outcome of native runtime functions.
+    This is switched off on some fuzzers that violate these contracts.
     """
-    return self._LegacyVariantsGeneratorFactory()(self, set(variants))
+    self.suppress_internals = True
+
+  def ListTests(self):
+    raise NotImplementedError
 
   def get_variants_gen(self, variants):
     return self._variants_gen_class()(variants)
@@ -126,11 +119,26 @@ def get_variants_gen(self, variants):
   def _variants_gen_class(self):
     return VariantsGenerator
 
+  def test_combiner_available(self):
+    return bool(self._test_combiner_class())
+
+  def get_test_combiner(self):
+    cls = self._test_combiner_class()
+    if cls:
+      return cls()
+    return None
+
+  def _test_combiner_class(self):
+    """Returns Combiner subclass. None if suite doesn't support combining
+    tests.
+    """
+    return None
+
   def ReadStatusFile(self, variables):
     self.statusfile = statusfile.StatusFile(self.status_file(), variables)
 
-  def ReadTestCases(self, context):
-    self.tests = self.ListTests(context)
+  def ReadTestCases(self):
+    self.tests = self.ListTests()
 
 
   def FilterTestCasesByStatus(self,
@@ -196,8 +204,19 @@ def FilterTestCasesByArgs(self, args):
     self.tests = filtered
 
   def _create_test(self, path, **kwargs):
-    test = self._test_class()(self, path, self._path_to_name(path), **kwargs)
-    return test
+    if self.suppress_internals:
+      test_class = self._suppressed_test_class()
+    else:
+      test_class = self._test_class()
+    return test_class(self, path, self._path_to_name(path), self.test_config,
+                      **kwargs)
+
+  def _suppressed_test_class(self):
+    """Optional testcase that suppresses assertions. Used by fuzzers that are
+    only interested in dchecks or tsan and that might violate the assertions
+    through fuzzing.
+    """
+    return self._test_class()
 
   def _test_class(self):
     raise NotImplementedError
diff --git a/deps/v8/tools/testrunner/local/utils.py b/deps/v8/tools/testrunner/local/utils.py
index bf8c3d9f7e8..9834386d01d 100644
--- a/deps/v8/tools/testrunner/local/utils.py
+++ b/deps/v8/tools/testrunner/local/utils.py
@@ -36,6 +36,21 @@
 import urllib2
 
 
+### Exit codes and their meaning.
+# Normal execution.
+EXIT_CODE_PASS = 0
+# Execution with test failures.
+EXIT_CODE_FAILURES = 1
+# Execution with no tests executed.
+EXIT_CODE_NO_TESTS = 2
+# Execution aborted with SIGINT (Ctrl-C).
+EXIT_CODE_INTERRUPTED = 3
+# Execution aborted with SIGTERM.
+EXIT_CODE_TERMINATED = 4
+# Internal error.
+EXIT_CODE_INTERNAL_ERROR = 5
+
+
 def GetSuitePaths(test_root):
   return [ f for f in os.listdir(test_root) if isdir(join(test_root, f)) ]
 
diff --git a/deps/v8/tools/testrunner/local/variants.py b/deps/v8/tools/testrunner/local/variants.py
index f1e9ad301e8..1c29f1d1955 100644
--- a/deps/v8/tools/testrunner/local/variants.py
+++ b/deps/v8/tools/testrunner/local/variants.py
@@ -17,13 +17,35 @@
   "nooptimization": [["--noopt"]],
   "slow_path": [["--force-slow-path"]],
   "stress": [["--stress-opt", "--always-opt"]],
-  "stress_background_compile": [["--background-compile", "--stress-background-compile"]],
+  "stress_background_compile": [["--stress-background-compile"]],
   "stress_incremental_marking":  [["--stress-incremental-marking"]],
   # Trigger stress sampling allocation profiler with sample interval = 2^14
   "stress_sampling": [["--stress-sampling-allocation-profiler=16384"]],
   "trusted": [["--no-untrusted-code-mitigations"]],
-  "wasm_traps": [["--wasm_trap_handler", "--invoke-weak-callbacks", "--wasm-jit-to-native"]],
-  "wasm_no_native": [["--no-wasm-jit-to-native"]],
+  "wasm_traps": [["--wasm-trap-handler", "--invoke-weak-callbacks"]],
 }
 
-ALL_VARIANTS = set(ALL_VARIANT_FLAGS.keys())
+SLOW_VARIANTS = set([
+  'stress',
+  'nooptimization',
+])
+
+FAST_VARIANTS = set([
+  'default'
+])
+
+
+def _variant_order_key(v):
+  if v in SLOW_VARIANTS:
+    return 0
+  if v in FAST_VARIANTS:
+    return 100
+  return 50
+
+ALL_VARIANTS = sorted(ALL_VARIANT_FLAGS.keys(),
+                      key=_variant_order_key)
+
+# Check {SLOW,FAST}_VARIANTS entries
+for variants in [SLOW_VARIANTS, FAST_VARIANTS]:
+  for v in variants:
+    assert v in ALL_VARIANT_FLAGS
diff --git a/deps/v8/tools/testrunner/num_fuzzer.py b/deps/v8/tools/testrunner/num_fuzzer.py
new file mode 100755
index 00000000000..77effc18471
--- /dev/null
+++ b/deps/v8/tools/testrunner/num_fuzzer.py
@@ -0,0 +1,225 @@
+#!/usr/bin/env python
+#
+# Copyright 2017 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+
+import random
+import sys
+
+# Adds testrunner to the path hence it has to be imported at the beggining.
+import base_runner
+
+from testrunner.local import utils
+
+from testrunner.testproc import fuzzer
+from testrunner.testproc.base import TestProcProducer
+from testrunner.testproc.combiner import CombinerProc
+from testrunner.testproc.execution import ExecutionProc
+from testrunner.testproc.expectation import ForgiveTimeoutProc
+from testrunner.testproc.filter import StatusFileFilterProc, NameFilterProc
+from testrunner.testproc.loader import LoadProc
+from testrunner.testproc.progress import ResultsTracker, TestsCounter
+from testrunner.utils import random_utils
+
+
+DEFAULT_SUITES = ["mjsunit", "webkit", "benchmarks"]
+
+
+class NumFuzzer(base_runner.BaseTestRunner):
+  def __init__(self, *args, **kwargs):
+    super(NumFuzzer, self).__init__(*args, **kwargs)
+
+  def _add_parser_options(self, parser):
+    parser.add_option("--fuzzer-random-seed", default=0,
+                      help="Default seed for initializing fuzzer random "
+                      "generator")
+    parser.add_option("--tests-count", default=5, type="int",
+                      help="Number of tests to generate from each base test. "
+                           "Can be combined with --total-timeout-sec with "
+                           "value 0 to provide infinite number of subtests. "
+                           "When --combine-tests is set it indicates how many "
+                           "tests to create in total")
+
+    # Stress gc
+    parser.add_option("--stress-marking", default=0, type="int",
+                      help="probability [0-10] of adding --stress-marking "
+                           "flag to the test")
+    parser.add_option("--stress-scavenge", default=0, type="int",
+                      help="probability [0-10] of adding --stress-scavenge "
+                           "flag to the test")
+    parser.add_option("--stress-compaction", default=0, type="int",
+                      help="probability [0-10] of adding --stress-compaction "
+                           "flag to the test")
+    parser.add_option("--stress-gc", default=0, type="int",
+                      help="probability [0-10] of adding --random-gc-interval "
+                           "flag to the test")
+    parser.add_option("--stress-thread-pool-size", default=0, type="int",
+                      help="probability [0-10] of adding --thread-pool-size "
+                           "flag to the test")
+
+    # Stress deopt
+    parser.add_option("--stress-deopt", default=0, type="int",
+                      help="probability [0-10] of adding --deopt-every-n-times "
+                           "flag to the test")
+    parser.add_option("--stress-deopt-min", default=1, type="int",
+                      help="extends --stress-deopt to have minimum interval "
+                           "between deopt points")
+
+    # Stress interrupt budget
+    parser.add_option("--stress-interrupt-budget", default=0, type="int",
+                      help="probability [0-10] of adding --interrupt-budget "
+                           "flag to the test")
+
+    # Combine multiple tests
+    parser.add_option("--combine-tests", default=False, action="store_true",
+                      help="Combine multiple tests as one and run with "
+                           "try-catch wrapper")
+    parser.add_option("--combine-max", default=100, type="int",
+                      help="Maximum number of tests to combine")
+    parser.add_option("--combine-min", default=2, type="int",
+                      help="Minimum number of tests to combine")
+
+    return parser
+
+
+  def _process_options(self, options):
+    if not options.fuzzer_random_seed:
+      options.fuzzer_random_seed = random_utils.random_seed()
+
+    if options.total_timeout_sec:
+      options.tests_count = 0
+
+    if options.combine_tests:
+      if options.combine_min > options.combine_max:
+        print ('min_group_size (%d) cannot be larger than max_group_size (%d)' %
+               options.min_group_size, options.max_group_size)
+        raise base_runner.TestRunnerError()
+
+    return True
+
+  def _get_default_suite_names(self):
+    return DEFAULT_SUITES
+
+  def _timeout_scalefactor(self, options):
+    factor = super(NumFuzzer, self)._timeout_scalefactor(options)
+    if options.stress_interrupt_budget:
+      # TODO(machenbach): This should be moved to a more generic config.
+      # Fuzzers have too much timeout in debug mode.
+      factor = max(int(factor * 0.25), 1)
+    return factor
+
+  def _get_statusfile_variables(self, options):
+    variables = (
+        super(NumFuzzer, self)._get_statusfile_variables(options))
+    variables.update({
+      'deopt_fuzzer': bool(options.stress_deopt),
+      'endurance_fuzzer': bool(options.combine_tests),
+      'gc_stress': bool(options.stress_gc),
+      'gc_fuzzer': bool(max([options.stress_marking,
+                             options.stress_scavenge,
+                             options.stress_compaction,
+                             options.stress_gc,
+                             options.stress_thread_pool_size])),
+    })
+    return variables
+
+  def _do_execute(self, tests, args, options):
+    loader = LoadProc()
+    fuzzer_rng = random.Random(options.fuzzer_random_seed)
+
+    combiner = self._create_combiner(fuzzer_rng, options)
+    results = ResultsTracker()
+    execproc = ExecutionProc(options.j)
+    sigproc = self._create_signal_proc()
+    indicators = self._create_progress_indicators(options)
+    procs = [
+      loader,
+      NameFilterProc(args) if args else None,
+      StatusFileFilterProc(None, None),
+      # TODO(majeski): Improve sharding when combiner is present. Maybe select
+      # different random seeds for shards instead of splitting tests.
+      self._create_shard_proc(options),
+      ForgiveTimeoutProc(),
+      combiner,
+      self._create_fuzzer(fuzzer_rng, options),
+      sigproc,
+    ] + indicators + [
+      results,
+      self._create_timeout_proc(options),
+      self._create_rerun_proc(options),
+      execproc,
+    ]
+    self._prepare_procs(procs)
+    loader.load_tests(tests)
+
+    # TODO(majeski): maybe some notification from loader would be better?
+    if combiner:
+      combiner.generate_initial_tests(options.j * 4)
+
+    # This starts up worker processes and blocks until all tests are
+    # processed.
+    execproc.run()
+
+    for indicator in indicators:
+      indicator.finished()
+
+    print '>>> %d tests ran' % results.total
+    if results.failed:
+      return utils.EXIT_CODE_FAILURES
+
+    # Indicate if a SIGINT or SIGTERM happened.
+    return sigproc.exit_code
+
+  def _load_suites(self, names, options):
+    suites = super(NumFuzzer, self)._load_suites(names, options)
+    if options.combine_tests:
+      suites = [s for s in suites if s.test_combiner_available()]
+    if options.stress_interrupt_budget:
+      # Changing interrupt budget forces us to suppress certain test assertions.
+      for suite in suites:
+        suite.do_suppress_internals()
+    return suites
+
+  def _create_combiner(self, rng, options):
+    if not options.combine_tests:
+      return None
+    return CombinerProc(rng, options.combine_min, options.combine_max,
+                        options.tests_count)
+
+  def _create_fuzzer(self, rng, options):
+    return fuzzer.FuzzerProc(
+        rng,
+        self._tests_count(options),
+        self._create_fuzzer_configs(options),
+        self._disable_analysis(options),
+    )
+
+  def _tests_count(self, options):
+    if options.combine_tests:
+      return 1
+    return options.tests_count
+
+  def _disable_analysis(self, options):
+    """Disable analysis phase when options are used that don't support it."""
+    return options.combine_tests or options.stress_interrupt_budget
+
+  def _create_fuzzer_configs(self, options):
+    fuzzers = []
+    def add(name, prob, *args):
+      if prob:
+        fuzzers.append(fuzzer.create_fuzzer_config(name, prob, *args))
+
+    add('compaction', options.stress_compaction)
+    add('marking', options.stress_marking)
+    add('scavenge', options.stress_scavenge)
+    add('gc_interval', options.stress_gc)
+    add('threads', options.stress_thread_pool_size)
+    add('interrupt_budget', options.stress_interrupt_budget)
+    add('deopt', options.stress_deopt, options.stress_deopt_min)
+    return fuzzers
+
+
+if __name__ == '__main__':
+  sys.exit(NumFuzzer().execute())
diff --git a/deps/v8/tools/testrunner/objects/context.py b/deps/v8/tools/testrunner/objects/context.py
deleted file mode 100644
index a3dd56d2dda..00000000000
--- a/deps/v8/tools/testrunner/objects/context.py
+++ /dev/null
@@ -1,51 +0,0 @@
-# Copyright 2012 the V8 project authors. All rights reserved.
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-#       copyright notice, this list of conditions and the following
-#       disclaimer in the documentation and/or other materials provided
-#       with the distribution.
-#     * Neither the name of Google Inc. nor the names of its
-#       contributors may be used to endorse or promote products derived
-#       from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-class Context():
-  def __init__(self, arch, mode, shell_dir, mode_flags, verbose, timeout,
-               isolates, command_prefix, extra_flags, noi18n, random_seed,
-               no_sorting, rerun_failures_count, rerun_failures_max, no_harness,
-               use_perf_data, sancov_dir, infra_staging=False):
-    self.arch = arch
-    self.mode = mode
-    self.shell_dir = shell_dir
-    self.mode_flags = mode_flags
-    self.verbose = verbose
-    self.timeout = timeout
-    self.isolates = isolates
-    self.command_prefix = command_prefix
-    self.extra_flags = extra_flags
-    self.noi18n = noi18n
-    self.random_seed = random_seed
-    self.no_sorting = no_sorting
-    self.rerun_failures_count = rerun_failures_count
-    self.rerun_failures_max = rerun_failures_max
-    self.no_harness = no_harness
-    self.use_perf_data = use_perf_data
-    self.sancov_dir = sancov_dir
-    self.infra_staging = infra_staging
diff --git a/deps/v8/tools/testrunner/objects/output.py b/deps/v8/tools/testrunner/objects/output.py
index adc33c9f12d..74cec56a853 100644
--- a/deps/v8/tools/testrunner/objects/output.py
+++ b/deps/v8/tools/testrunner/objects/output.py
@@ -27,9 +27,11 @@
 
 
 import signal
+import copy
 
 from ..local import utils
 
+
 class Output(object):
 
   def __init__(self, exit_code, timed_out, stdout, stderr, pid, duration):
@@ -40,6 +42,13 @@ def __init__(self, exit_code, timed_out, stdout, stderr, pid, duration):
     self.pid = pid
     self.duration = duration
 
+  def without_text(self):
+    """Returns copy of the output without stdout and stderr."""
+    other = copy.copy(self)
+    other.stdout = None
+    other.stderr = None
+    return other
+
   def HasCrashed(self):
     if utils.IsWindows():
       return 0x80000000 & self.exit_code and not (0x3FFFFF00 & self.exit_code)
diff --git a/deps/v8/tools/testrunner/objects/predictable.py b/deps/v8/tools/testrunner/objects/predictable.py
index ad93077be90..48279d625ca 100644
--- a/deps/v8/tools/testrunner/objects/predictable.py
+++ b/deps/v8/tools/testrunner/objects/predictable.py
@@ -4,6 +4,7 @@
 
 from ..local import statusfile
 from ..outproc import base as outproc_base
+from ..testproc import base as testproc_base
 from ..testproc.result import Result
 
 
@@ -15,11 +16,7 @@
 
 
 def get_outproc(test):
-  output_proc = test.output_proc
-  if output_proc.negative or statusfile.FAIL in test.expected_outcomes:
-    # TODO(majeski): Skip these tests instead of having special outproc.
-    return NeverUnexpectedOutputOutProc(output_proc)
-  return OutProc(output_proc)
+  return OutProc(test.output_proc)
 
 
 class OutProc(outproc_base.BaseOutProc):
@@ -31,9 +28,6 @@ def __init__(self, _outproc):
     super(OutProc, self).__init__()
     self._outproc = _outproc
 
-  def process(self, output):
-    return Result(self.has_unexpected_output(output), output)
-
   def has_unexpected_output(self, output):
     return output.exit_code != 0
 
@@ -49,9 +43,7 @@ def expected_outcomes(self):
     return self._outproc.expected_outcomes
 
 
-class NeverUnexpectedOutputOutProc(OutProc):
-  """Output processor wrapper for tests that we will return False for
-  has_unexpected_output in the predictable mode.
-  """
-  def has_unexpected_output(self, output):
-    return False
+class PredictableFilterProc(testproc_base.TestProcFilter):
+  def _filter(self, test):
+    return (statusfile.FAIL in test.expected_outcomes or
+            test.output_proc.negative)
diff --git a/deps/v8/tools/testrunner/objects/testcase.py b/deps/v8/tools/testrunner/objects/testcase.py
index 06db32802c4..775ddfeb07b 100644
--- a/deps/v8/tools/testrunner/objects/testcase.py
+++ b/deps/v8/tools/testrunner/objects/testcase.py
@@ -40,7 +40,7 @@
 
 
 class TestCase(object):
-  def __init__(self, suite, path, name):
+  def __init__(self, suite, path, name, test_config):
     self.suite = suite        # TestSuite object
 
     self.path = path          # string, e.g. 'div-mod', 'test-api/foo'
@@ -49,60 +49,40 @@ def __init__(self, suite, path, name):
     self.variant = None       # name of the used testing variant
     self.variant_flags = []   # list of strings, flags specific to this test
 
-    self.id = None  # int, used to map result back to TestCase instance
-    self.run = 1  # The nth time this test is executed.
-    self.cmd = None
-
     # Fields used by the test processors.
     self.origin = None # Test that this test is subtest of.
     self.processor = None # Processor that created this subtest.
     self.procid = '%s/%s' % (self.suite.name, self.name) # unique id
     self.keep_output = False # Can output of this test be dropped
 
+    # Test config contains information needed to build the command.
+    self._test_config = test_config
+    self._random_seed = None # Overrides test config value if not None
+
+    # Outcomes
     self._statusfile_outcomes = None
-    self._expected_outcomes = None # optimization: None == [statusfile.PASS]
+    self.expected_outcomes = None
     self._statusfile_flags = None
+
     self._prepare_outcomes()
 
   def create_subtest(self, processor, subtest_id, variant=None, flags=None,
-                     keep_output=False):
+                     keep_output=False, random_seed=None):
     subtest = copy.copy(self)
     subtest.origin = self
     subtest.processor = processor
     subtest.procid += '.%s' % subtest_id
-    subtest.keep_output = keep_output
+    subtest.keep_output |= keep_output
+    if random_seed:
+      subtest._random_seed = random_seed
+    if flags:
+      subtest.variant_flags = subtest.variant_flags + flags
     if variant is not None:
       assert self.variant is None
       subtest.variant = variant
-      subtest.variant_flags = flags
       subtest._prepare_outcomes()
     return subtest
 
-  def create_variant(self, variant, flags, procid_suffix=None):
-    """Makes a shallow copy of the object and updates variant, variant flags and
-    all fields that depend on it, e.g. expected outcomes.
-
-    Args
-      variant       - variant name
-      flags         - flags that should be added to origin test's variant flags
-      procid_suffix - for multiple variants with the same name set suffix to
-        keep procid unique.
-    """
-    other = copy.copy(self)
-    if not self.variant_flags:
-      other.variant_flags = flags
-    else:
-      other.variant_flags = self.variant_flags + flags
-    other.variant = variant
-    if procid_suffix:
-      other.procid += '[%s-%s]' % (variant, procid_suffix)
-    else:
-      other.procid += '[%s]' % variant
-
-    other._prepare_outcomes(variant != self.variant)
-
-    return other
-
   def _prepare_outcomes(self, force_update=True):
     if force_update or self._statusfile_outcomes is None:
       def is_flag(outcome):
@@ -160,16 +140,17 @@ def is_pass_or_fail(self):
   def only_standard_variant(self):
     return statusfile.NO_VARIANTS in self._statusfile_outcomes
 
-  def get_command(self, context):
-    params = self._get_cmd_params(context)
+  def get_command(self):
+    params = self._get_cmd_params()
     env = self._get_cmd_env()
-    shell, shell_flags = self._get_shell_with_flags(context)
-    timeout = self._get_timeout(params, context.timeout)
-    return self._create_cmd(shell, shell_flags + params, env, timeout, context)
+    shell, shell_flags = self._get_shell_with_flags()
+    timeout = self._get_timeout(params)
+    return self._create_cmd(shell, shell_flags + params, env, timeout)
 
-  def _get_cmd_params(self, ctx):
+  def _get_cmd_params(self):
     """Gets command parameters and combines them in the following order:
       - files [empty by default]
+      - random seed
       - extra flags (from command line)
       - user flags (variant/fuzzer flags)
       - statusfile flags
@@ -180,23 +161,31 @@ def _get_cmd_params(self, ctx):
     methods for getting partial parameters.
     """
     return (
-        self._get_files_params(ctx) +
-        self._get_extra_flags(ctx) +
+        self._get_files_params() +
+        self._get_random_seed_flags() +
+        self._get_extra_flags() +
         self._get_variant_flags() +
         self._get_statusfile_flags() +
-        self._get_mode_flags(ctx) +
+        self._get_mode_flags() +
         self._get_source_flags() +
-        self._get_suite_flags(ctx)
+        self._get_suite_flags()
     )
 
   def _get_cmd_env(self):
     return {}
 
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     return []
 
-  def _get_extra_flags(self, ctx):
-    return ctx.extra_flags
+  def _get_random_seed_flags(self):
+    return ['--random-seed=%d' % self.random_seed]
+
+  @property
+  def random_seed(self):
+    return self._random_seed or self._test_config.random_seed
+
+  def _get_extra_flags(self):
+    return self._test_config.extra_flags
 
   def _get_variant_flags(self):
     return self.variant_flags
@@ -208,27 +197,26 @@ def _get_statusfile_flags(self):
     """
     return self._statusfile_flags
 
-  def _get_mode_flags(self, ctx):
-    return ctx.mode_flags
+  def _get_mode_flags(self):
+    return self._test_config.mode_flags
 
   def _get_source_flags(self):
     return []
 
-  def _get_suite_flags(self, ctx):
+  def _get_suite_flags(self):
     return []
 
-  def _get_shell_with_flags(self, ctx):
+  def _get_shell_with_flags(self):
     shell = self.get_shell()
     shell_flags = []
     if shell == 'd8':
       shell_flags.append('--test')
     if utils.IsWindows():
       shell += '.exe'
-    if ctx.random_seed:
-      shell_flags.append('--random-seed=%s' % ctx.random_seed)
     return shell, shell_flags
 
-  def _get_timeout(self, params, timeout):
+  def _get_timeout(self, params):
+    timeout = self._test_config.timeout
     if "--stress-opt" in params:
       timeout *= 4
     if "--noenable-vfp3" in params:
@@ -244,14 +232,14 @@ def get_shell(self):
   def _get_suffix(self):
     return '.js'
 
-  def _create_cmd(self, shell, params, env, timeout, ctx):
+  def _create_cmd(self, shell, params, env, timeout):
     return command.Command(
-      cmd_prefix=ctx.command_prefix,
-      shell=os.path.abspath(os.path.join(ctx.shell_dir, shell)),
+      cmd_prefix=self._test_config.command_prefix,
+      shell=os.path.abspath(os.path.join(self._test_config.shell_dir, shell)),
       args=params,
       env=env,
       timeout=timeout,
-      verbose=ctx.verbose
+      verbose=self._test_config.verbose
     )
 
   def _parse_source_flags(self, source=None):
@@ -281,18 +269,9 @@ def __cmp__(self, other):
     # Make sure that test cases are sorted correctly if sorted without
     # key function. But using a key function is preferred for speed.
     return cmp(
-        (self.suite.name, self.name, self.variant_flags),
-        (other.suite.name, other.name, other.variant_flags)
+        (self.suite.name, self.name, self.variant),
+        (other.suite.name, other.name, other.variant)
     )
 
-  def __hash__(self):
-    return hash((self.suite.name, self.name, ''.join(self.variant_flags)))
-
   def __str__(self):
     return self.suite.name + '/' + self.name
-
-  # TODO(majeski): Rename `id` field or `get_id` function since they're
-  # unrelated.
-  def get_id(self):
-    return '%s/%s %s' % (
-        self.suite.name, self.name, ' '.join(self.variant_flags))
diff --git a/deps/v8/tools/testrunner/outproc/base.py b/deps/v8/tools/testrunner/outproc/base.py
index 9a9db4e81d2..d1953dda994 100644
--- a/deps/v8/tools/testrunner/outproc/base.py
+++ b/deps/v8/tools/testrunner/outproc/base.py
@@ -2,24 +2,45 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-import collections
 import itertools
 
+from ..testproc.base import (
+    DROP_RESULT, DROP_OUTPUT, DROP_PASS_OUTPUT, DROP_PASS_STDOUT)
 from ..local import statusfile
 from ..testproc.result import Result
 
 
 OUTCOMES_PASS = [statusfile.PASS]
 OUTCOMES_FAIL = [statusfile.FAIL]
+OUTCOMES_PASS_OR_TIMEOUT = [statusfile.PASS, statusfile.TIMEOUT]
+OUTCOMES_FAIL_OR_TIMEOUT = [statusfile.FAIL, statusfile.TIMEOUT]
 
 
 class BaseOutProc(object):
-  def process(self, output):
-    return Result(self.has_unexpected_output(output), output)
+  def process(self, output, reduction=None):
+    has_unexpected_output = self.has_unexpected_output(output)
+    return self._create_result(has_unexpected_output, output, reduction)
 
   def has_unexpected_output(self, output):
     return self.get_outcome(output) not in self.expected_outcomes
 
+  def _create_result(self, has_unexpected_output, output, reduction):
+    """Creates Result instance. When reduction is passed it tries to drop some
+    parts of the result to save memory and time needed to send the result
+    across process boundary. None disables reduction and full result is created.
+    """
+    if reduction == DROP_RESULT:
+      return None
+    if reduction == DROP_OUTPUT:
+      return Result(has_unexpected_output, None)
+    if not has_unexpected_output:
+      if reduction == DROP_PASS_OUTPUT:
+        return Result(has_unexpected_output, None)
+      if reduction == DROP_PASS_STDOUT:
+        return Result(has_unexpected_output, output.without_text())
+
+    return Result(has_unexpected_output, output)
+
   def get_outcome(self, output):
     if output.HasCrashed():
       return statusfile.CRASH
diff --git a/deps/v8/tools/testrunner/standard_runner.py b/deps/v8/tools/testrunner/standard_runner.py
index 3be20992525..bea00476f4e 100755
--- a/deps/v8/tools/testrunner/standard_runner.py
+++ b/deps/v8/tools/testrunner/standard_runner.py
@@ -5,47 +5,34 @@
 # found in the LICENSE file.
 
 
-from collections import OrderedDict
-from os.path import join
-import multiprocessing
 import os
-import random
-import shlex
-import subprocess
+import re
 import sys
-import time
 
 # Adds testrunner to the path hence it has to be imported at the beggining.
 import base_runner
 
-from testrunner.local import execution
-from testrunner.local import progress
-from testrunner.local import testsuite
 from testrunner.local import utils
-from testrunner.local import verbose
 from testrunner.local.variants import ALL_VARIANTS
-from testrunner.objects import context
 from testrunner.objects import predictable
 from testrunner.testproc.execution import ExecutionProc
 from testrunner.testproc.filter import StatusFileFilterProc, NameFilterProc
 from testrunner.testproc.loader import LoadProc
-from testrunner.testproc.progress import (VerboseProgressIndicator,
-                                          ResultsTracker,
-                                          TestsCounter)
-from testrunner.testproc.rerun import RerunProc
+from testrunner.testproc.progress import ResultsTracker, TestsCounter
+from testrunner.testproc.seed import SeedProc
 from testrunner.testproc.variant import VariantProc
+from testrunner.utils import random_utils
 
 
-TIMEOUT_DEFAULT = 60
+ARCH_GUESS = utils.DefaultArch()
 
-# Variants ordered by expected runtime (slowest first).
 VARIANTS = ["default"]
 
 MORE_VARIANTS = [
-  "stress",
-  "stress_incremental_marking",
   "nooptimization",
+  "stress",
   "stress_background_compile",
+  "stress_incremental_marking",
   "wasm_traps",
 ]
 
@@ -65,15 +52,9 @@
                    "--concurrent-recompilation-delay=500",
                    "--concurrent-recompilation"]
 
-# Double the timeout for these:
-SLOW_ARCHS = ["arm",
-              "mips",
-              "mipsel",
-              "mips64",
-              "mips64el",
-              "s390",
-              "s390x",
-              "arm64"]
+RANDOM_GC_STRESS_FLAGS = ["--random-gc-interval=5000",
+                          "--stress-compaction-random"]
+
 
 PREDICTABLE_WRAPPER = os.path.join(
     base_runner.BASE_DIR, 'tools', 'predictable_wrapper.py')
@@ -84,72 +65,18 @@ def __init__(self, *args, **kwargs):
         super(StandardTestRunner, self).__init__(*args, **kwargs)
 
         self.sancov_dir = None
+        self._variants = None
 
     def _get_default_suite_names(self):
       return ['default']
 
-    def _do_execute(self, suites, args, options):
-      if options.swarming:
-        # Swarming doesn't print how isolated commands are called. Lets make
-        # this less cryptic by printing it ourselves.
-        print ' '.join(sys.argv)
-
-        if utils.GuessOS() == "macos":
-          # TODO(machenbach): Temporary output for investigating hanging test
-          # driver on mac.
-          print "V8 related processes running on this host:"
-          try:
-            print subprocess.check_output(
-              "ps -e | egrep 'd8|cctest|unittests'", shell=True)
-          except Exception:
-            pass
-
-      return self._execute(args, options, suites)
-
     def _add_parser_options(self, parser):
-      parser.add_option("--sancov-dir",
-                        help="Directory where to collect coverage data")
-      parser.add_option("--cfi-vptr",
-                        help="Run tests with UBSAN cfi_vptr option.",
-                        default=False, action="store_true")
       parser.add_option("--novfp3",
                         help="Indicates that V8 was compiled without VFP3"
                         " support",
                         default=False, action="store_true")
-      parser.add_option("--cat", help="Print the source of the tests",
-                        default=False, action="store_true")
-      parser.add_option("--slow-tests",
-                        help="Regard slow tests (run|skip|dontcare)",
-                        default="dontcare")
-      parser.add_option("--pass-fail-tests",
-                        help="Regard pass|fail tests (run|skip|dontcare)",
-                        default="dontcare")
-      parser.add_option("--gc-stress",
-                        help="Switch on GC stress mode",
-                        default=False, action="store_true")
-      parser.add_option("--command-prefix",
-                        help="Prepended to each shell command used to run a"
-                        " test",
-                        default="")
-      parser.add_option("--extra-flags",
-                        help="Additional flags to pass to each test command",
-                        action="append", default=[])
-      parser.add_option("--infra-staging", help="Use new test runner features",
-                        default=False, action="store_true")
-      parser.add_option("--isolates", help="Whether to test isolates",
-                        default=False, action="store_true")
-      parser.add_option("-j", help="The number of parallel tasks to run",
-                        default=0, type="int")
-      parser.add_option("--no-harness", "--noharness",
-                        help="Run without test harness of a given suite",
-                        default=False, action="store_true")
-      parser.add_option("--no-presubmit", "--nopresubmit",
-                        help='Skip presubmit checks (deprecated)',
-                        default=False, dest="no_presubmit", action="store_true")
-      parser.add_option("--no-sorting", "--nosorting",
-                        help="Don't sort tests according to duration of last"
-                        " run.",
-                        default=False, dest="no_sorting", action="store_true")
+
+      # Variants
       parser.add_option("--no-variants", "--novariants",
                         help="Deprecated. "
                              "Equivalent to passing --variants=default",
@@ -161,67 +88,80 @@ def _add_parser_options(self, parser):
                         default=False, action="store_true",
                         help="Deprecated. "
                              "Equivalent to passing --variants=exhaustive")
-      parser.add_option("-p", "--progress",
-                        help=("The style of progress indicator"
-                              " (verbose, dots, color, mono)"),
-                        choices=progress.PROGRESS_INDICATORS.keys(),
-                        default="mono")
+
+      # Filters
+      parser.add_option("--slow-tests", default="dontcare",
+                        help="Regard slow tests (run|skip|dontcare)")
+      parser.add_option("--pass-fail-tests", default="dontcare",
+                        help="Regard pass|fail tests (run|skip|dontcare)")
       parser.add_option("--quickcheck", default=False, action="store_true",
                         help=("Quick check mode (skip slow tests)"))
-      parser.add_option("--report", help="Print a summary of the tests to be"
-                        " run",
-                        default=False, action="store_true")
-      parser.add_option("--json-test-results",
-                        help="Path to a file for storing json results.")
-      parser.add_option("--flakiness-results",
-                        help="Path to a file for storing flakiness json.")
-      parser.add_option("--rerun-failures-count",
-                        help=("Number of times to rerun each failing test case."
-                              " Very slow tests will be rerun only once."),
-                        default=0, type="int")
-      parser.add_option("--rerun-failures-max",
-                        help="Maximum number of failing test cases to rerun.",
-                        default=100, type="int")
       parser.add_option("--dont-skip-slow-simulator-tests",
                         help="Don't skip more slow tests when using a"
                         " simulator.",
                         default=False, action="store_true",
                         dest="dont_skip_simulator_slow_tests")
-      parser.add_option("--swarming",
-                        help="Indicates running test driver on swarming.",
+
+      # Stress modes
+      parser.add_option("--gc-stress",
+                        help="Switch on GC stress mode",
+                        default=False, action="store_true")
+      parser.add_option("--random-gc-stress",
+                        help="Switch on random GC stress mode",
+                        default=False, action="store_true")
+      parser.add_option("--random-seed-stress-count", default=1, type="int",
+                        dest="random_seed_stress_count",
+                        help="Number of runs with different random seeds. Only "
+                             "with test processors: 0 means infinite "
+                             "generation.")
+
+      # Noop
+      parser.add_option("--cfi-vptr",
+                        help="Run tests with UBSAN cfi_vptr option.",
                         default=False, action="store_true")
+      parser.add_option("--infra-staging", help="Use new test runner features",
+                        dest='infra_staging', default=None,
+                        action="store_true")
+      parser.add_option("--no-infra-staging",
+                        help="Opt out of new test runner features",
+                        dest='infra_staging', default=None,
+                        action="store_false")
+      parser.add_option("--no-sorting", "--nosorting",
+                        help="Don't sort tests according to duration of last"
+                        " run.",
+                        default=False, dest="no_sorting", action="store_true")
+      parser.add_option("--no-presubmit", "--nopresubmit",
+                        help='Skip presubmit checks (deprecated)',
+                        default=False, dest="no_presubmit", action="store_true")
+
+      # Unimplemented for test processors
+      parser.add_option("--sancov-dir",
+                        help="Directory where to collect coverage data")
+      parser.add_option("--cat", help="Print the source of the tests",
+                        default=False, action="store_true")
+      parser.add_option("--flakiness-results",
+                        help="Path to a file for storing flakiness json.")
       parser.add_option("--time", help="Print timing information after running",
                         default=False, action="store_true")
-      parser.add_option("-t", "--timeout", help="Timeout in seconds",
-                        default=TIMEOUT_DEFAULT, type="int")
       parser.add_option("--warn-unused", help="Report unused rules",
                         default=False, action="store_true")
-      parser.add_option("--junitout", help="File name of the JUnit output")
-      parser.add_option("--junittestsuite",
-                        help="The testsuite name in the JUnit output file",
-                        default="v8tests")
-      parser.add_option("--random-seed", default=0, dest="random_seed",
-                        help="Default seed for initializing random generator",
-                        type=int)
-      parser.add_option("--random-seed-stress-count", default=1, type="int",
-                        dest="random_seed_stress_count",
-                        help="Number of runs with different random seeds")
+      parser.add_option("--report", default=False, action="store_true",
+                        help="Print a summary of the tests to be run")
 
-    def _process_options(self, options):
-      global VARIANTS
 
+    def _process_options(self, options):
       if options.sancov_dir:
         self.sancov_dir = options.sancov_dir
         if not os.path.exists(self.sancov_dir):
           print("sancov-dir %s doesn't exist" % self.sancov_dir)
           raise base_runner.TestRunnerError()
 
-      options.command_prefix = shlex.split(options.command_prefix)
-      options.extra_flags = sum(map(shlex.split, options.extra_flags), [])
-
       if options.gc_stress:
         options.extra_flags += GC_STRESS_FLAGS
 
+      if options.random_gc_stress:
+        options.extra_flags += RANDOM_GC_STRESS_FLAGS
+
       if self.build_config.asan:
         options.extra_flags.append("--invoke-weak-callbacks")
         options.extra_flags.append("--omit-quit")
@@ -265,31 +205,10 @@ def _process_options(self, options):
       if self.build_config.msan:
         options.variants = "default"
 
-      if options.j == 0:
-        options.j = multiprocessing.cpu_count()
-
-      if options.random_seed_stress_count <= 1 and options.random_seed == 0:
-        options.random_seed = self._random_seed()
-
-      # Use developer defaults if no variant was specified.
-      options.variants = options.variants or "dev"
-
       if options.variants == "infra_staging":
         options.variants = "exhaustive"
-        options.infra_staging = True
 
-      # Resolve variant aliases and dedupe.
-      # TODO(machenbach): Don't mutate global variable. Rather pass mutated
-      # version as local variable.
-      VARIANTS = list(set(reduce(
-          list.__add__,
-          (VARIANT_ALIASES.get(v, [v]) for v in options.variants.split(",")),
-          [],
-      )))
-
-      if not set(VARIANTS).issubset(ALL_VARIANTS):
-        print "All variants must be in %s" % str(ALL_VARIANTS)
-        raise base_runner.TestRunnerError()
+      self._variants = self._parse_variants(options.variants)
 
       def CheckTestMode(name, option):  # pragma: no cover
         if not option in ["run", "skip", "dontcare"]:
@@ -303,6 +222,23 @@ def CheckTestMode(name, option):  # pragma: no cover
         # TODO(machenbach): uncomment after infra side lands.
         # base_runner.TEST_MAP["d8_default"].remove("intl")
 
+    def _parse_variants(self, aliases_str):
+      # Use developer defaults if no variant was specified.
+      aliases_str = aliases_str or 'dev'
+      aliases = aliases_str.split(',')
+      user_variants = set(reduce(
+          list.__add__, [VARIANT_ALIASES.get(a, [a]) for a in aliases]))
+
+      result = [v for v in ALL_VARIANTS if v in user_variants]
+      if len(result) == len(user_variants):
+        return result
+
+      for v in user_variants:
+        if v not in ALL_VARIANTS:
+          print 'Unknown variant: %s' % v
+          raise base_runner.TestRunnerError()
+      assert False, 'Unreachable'
+
     def _setup_env(self):
       super(StandardTestRunner, self)._setup_env()
 
@@ -316,228 +252,39 @@ def _setup_env(self):
           "allow_user_segv_handler=1",
         ])
 
-    def _random_seed(self):
-      seed = 0
-      while not seed:
-        seed = random.SystemRandom().randint(-2147483648, 2147483647)
-      return seed
-
-    def _execute(self, args, options, suites):
-      print(">>> Running tests for %s.%s" % (self.build_config.arch,
-                                             self.mode_name))
-      # Populate context object.
-
-      # Simulators are slow, therefore allow a longer timeout.
-      if self.build_config.arch in SLOW_ARCHS:
-        options.timeout *= 2
+    def _get_statusfile_variables(self, options):
+      variables = (
+          super(StandardTestRunner, self)._get_statusfile_variables(options))
 
-      options.timeout *= self.mode_options.timeout_scalefactor
-
-      if self.build_config.predictable:
-        # Predictable mode is slower.
-        options.timeout *= 2
-
-      ctx = context.Context(self.build_config.arch,
-                            self.mode_options.execution_mode,
-                            self.outdir,
-                            self.mode_options.flags,
-                            options.verbose,
-                            options.timeout,
-                            options.isolates,
-                            options.command_prefix,
-                            options.extra_flags,
-                            self.build_config.no_i18n,
-                            options.random_seed,
-                            options.no_sorting,
-                            options.rerun_failures_count,
-                            options.rerun_failures_max,
-                            options.no_harness,
-                            use_perf_data=not options.swarming,
-                            sancov_dir=self.sancov_dir,
-                            infra_staging=options.infra_staging)
-
-      # TODO(all): Combine "simulator" and "simulator_run".
-      # TODO(machenbach): In GN we can derive simulator run from
-      # target_arch != v8_target_arch in the dumped build config.
       simulator_run = (
         not options.dont_skip_simulator_slow_tests and
         self.build_config.arch in [
           'arm64', 'arm', 'mipsel', 'mips', 'mips64', 'mips64el', 'ppc',
           'ppc64', 's390', 's390x'] and
-        bool(base_runner.ARCH_GUESS) and
-        self.build_config.arch != base_runner.ARCH_GUESS)
-      # Find available test suites and read test cases from them.
-      variables = {
-        "arch": self.build_config.arch,
-        "asan": self.build_config.asan,
-        "byteorder": sys.byteorder,
-        "dcheck_always_on": self.build_config.dcheck_always_on,
-        "deopt_fuzzer": False,
-        "gc_fuzzer": False,
-        "gc_stress": options.gc_stress,
-        "gcov_coverage": self.build_config.gcov_coverage,
-        "isolates": options.isolates,
-        "mode": self.mode_options.status_mode,
-        "msan": self.build_config.msan,
-        "no_harness": options.no_harness,
-        "no_i18n": self.build_config.no_i18n,
-        "no_snap": self.build_config.no_snap,
-        "novfp3": options.novfp3,
-        "predictable": self.build_config.predictable,
-        "simulator": utils.UseSimulator(self.build_config.arch),
-        "simulator_run": simulator_run,
-        "system": utils.GuessOS(),
-        "tsan": self.build_config.tsan,
-        "ubsan_vptr": self.build_config.ubsan_vptr,
-      }
-
-      progress_indicator = progress.IndicatorNotifier()
-      progress_indicator.Register(
-        progress.PROGRESS_INDICATORS[options.progress]())
-      if options.junitout:  # pragma: no cover
-        progress_indicator.Register(progress.JUnitTestProgressIndicator(
-            options.junitout, options.junittestsuite))
-      if options.json_test_results:
-        progress_indicator.Register(progress.JsonTestProgressIndicator(
-          options.json_test_results,
-          self.build_config.arch,
-          self.mode_options.execution_mode,
-          ctx.random_seed))
-      if options.flakiness_results:  # pragma: no cover
-        progress_indicator.Register(progress.FlakinessTestProgressIndicator(
-            options.flakiness_results))
-
-      if options.infra_staging:
-        for s in suites:
-          s.ReadStatusFile(variables)
-          s.ReadTestCases(ctx)
-
-        return self._run_test_procs(suites, args, options, progress_indicator,
-                                    ctx)
-
-      all_tests = []
-      num_tests = 0
-      for s in suites:
-        s.ReadStatusFile(variables)
-        s.ReadTestCases(ctx)
-        if len(args) > 0:
-          s.FilterTestCasesByArgs(args)
-        all_tests += s.tests
-
-        # First filtering by status applying the generic rules (tests without
-        # variants)
-        if options.warn_unused:
-          tests = [(t.name, t.variant) for t in s.tests]
-          s.statusfile.warn_unused_rules(tests, check_variant_rules=False)
-        s.FilterTestCasesByStatus(options.slow_tests, options.pass_fail_tests)
-
-        if options.cat:
-          verbose.PrintTestSource(s.tests)
-          continue
-        variant_gen = s.CreateLegacyVariantsGenerator(VARIANTS)
-        variant_tests = [ t.create_variant(v, flags)
-                          for t in s.tests
-                          for v in variant_gen.FilterVariantsByTest(t)
-                          for flags in variant_gen.GetFlagSets(t, v) ]
-
-        if options.random_seed_stress_count > 1:
-          # Duplicate test for random seed stress mode.
-          def iter_seed_flags():
-            for _ in range(0, options.random_seed_stress_count):
-              # Use given random seed for all runs (set by default in
-              # execution.py) or a new random seed if none is specified.
-              if options.random_seed:
-                yield []
-              else:
-                yield ["--random-seed=%d" % self._random_seed()]
-          s.tests = [
-            t.create_variant(t.variant, flags, 'seed-stress-%d' % n)
-            for t in variant_tests
-            for n, flags in enumerate(iter_seed_flags())
-          ]
-        else:
-          s.tests = variant_tests
-
-        # Second filtering by status applying also the variant-dependent rules.
-        if options.warn_unused:
-          tests = [(t.name, t.variant) for t in s.tests]
-          s.statusfile.warn_unused_rules(tests, check_variant_rules=True)
-
-        s.FilterTestCasesByStatus(options.slow_tests, options.pass_fail_tests)
-        s.tests = self._shard_tests(s.tests, options)
-
-        for t in s.tests:
-          t.cmd = t.get_command(ctx)
-
-        num_tests += len(s.tests)
-
-      if options.cat:
-        return 0  # We're done here.
-
-      if options.report:
-        verbose.PrintReport(all_tests)
-
-      # Run the tests.
-      start_time = time.time()
-
-      if self.build_config.predictable:
-        outproc_factory = predictable.get_outproc
-      else:
-        outproc_factory = None
-
-      runner = execution.Runner(suites, progress_indicator, ctx,
-                                outproc_factory)
-      exit_code = runner.Run(options.j)
-      overall_duration = time.time() - start_time
+        bool(ARCH_GUESS) and
+        self.build_config.arch != ARCH_GUESS)
 
-      if options.time:
-        verbose.PrintTestDurations(suites, runner.outputs, overall_duration)
+      variables.update({
+        'gc_stress': options.gc_stress or options.random_gc_stress,
+        'novfp3': options.novfp3,
+        'simulator_run': simulator_run,
+      })
+      return variables
 
-      if num_tests == 0:
-        print("Warning: no tests were run!")
-
-      if exit_code == 1 and options.json_test_results:
-        print("Force exit code 0 after failures. Json test results file "
-              "generated with failure information.")
-        exit_code = 0
-
-      if self.sancov_dir:
-        # If tests ran with sanitizer coverage, merge coverage files in the end.
-        try:
-          print "Merging sancov files."
-          subprocess.check_call([
-            sys.executable,
-            join(self.basedir, "tools", "sanitizers", "sancov_merger.py"),
-            "--coverage-dir=%s" % self.sancov_dir])
-        except:
-          print >> sys.stderr, "Error: Merging sancov files failed."
-          exit_code = 1
-
-      return exit_code
-
-    def _shard_tests(self, tests, options):
-      shard_run, shard_count = self._get_shard_info(options)
-
-      if shard_count < 2:
-        return tests
-      count = 0
-      shard = []
-      for test in tests:
-        if count % shard_count == shard_run - 1:
-          shard.append(test)
-        count += 1
-      return shard
-
-    def _run_test_procs(self, suites, args, options, progress_indicator,
-                        context):
+    def _do_execute(self, tests, args, options):
       jobs = options.j
 
       print '>>> Running with test processors'
       loader = LoadProc()
       tests_counter = TestsCounter()
       results = ResultsTracker()
-      indicators = progress_indicator.ToProgressIndicatorProcs()
-      execproc = ExecutionProc(jobs, context)
+      indicators = self._create_progress_indicators(options)
+
+      outproc_factory = None
+      if self.build_config.predictable:
+        outproc_factory = predictable.get_outproc
+      execproc = ExecutionProc(jobs, outproc_factory)
+      sigproc = self._create_signal_proc()
 
       procs = [
         loader,
@@ -545,54 +292,60 @@ def _run_test_procs(self, suites, args, options, progress_indicator,
         StatusFileFilterProc(options.slow_tests, options.pass_fail_tests),
         self._create_shard_proc(options),
         tests_counter,
-        VariantProc(VARIANTS),
+        VariantProc(self._variants),
         StatusFileFilterProc(options.slow_tests, options.pass_fail_tests),
+        self._create_predictable_filter(),
+        self._create_seed_proc(options),
+        sigproc,
       ] + indicators + [
         results,
-        self._create_rerun_proc(context),
+        self._create_timeout_proc(options),
+        self._create_rerun_proc(options),
         execproc,
       ]
 
-      procs = filter(None, procs)
-
-      for i in xrange(0, len(procs) - 1):
-        procs[i].connect_to(procs[i + 1])
-
-      tests = [t for s in suites for t in s.tests]
+      self._prepare_procs(procs)
       tests.sort(key=lambda t: t.is_slow, reverse=True)
 
-      loader.setup()
       loader.load_tests(tests)
 
       print '>>> Running %d base tests' % tests_counter.total
       tests_counter.remove_from_chain()
 
-      execproc.start()
+      # This starts up worker processes and blocks until all tests are
+      # processed.
+      execproc.run()
 
       for indicator in indicators:
         indicator.finished()
 
-      print '>>> %d tests ran' % results.total
+      print '>>> %d tests ran' % (results.total - results.remaining)
 
-      exit_code = 0
+      exit_code = utils.EXIT_CODE_PASS
       if results.failed:
-        exit_code = 1
-      if results.remaining:
-        exit_code = 2
+        exit_code = utils.EXIT_CODE_FAILURES
+      if not results.total:
+        exit_code = utils.EXIT_CODE_NO_TESTS
 
+      # Indicate if a SIGINT or SIGTERM happened.
+      exit_code = max(exit_code, sigproc.exit_code)
 
-      if exit_code == 1 and options.json_test_results:
+      if exit_code == utils.EXIT_CODE_FAILURES and options.json_test_results:
         print("Force exit code 0 after failures. Json test results file "
               "generated with failure information.")
-        exit_code = 0
+        exit_code = utils.EXIT_CODE_PASS
       return exit_code
 
-    def _create_rerun_proc(self, ctx):
-      if not ctx.rerun_failures_count:
+    def _create_predictable_filter(self):
+      if not self.build_config.predictable:
         return None
-      return RerunProc(ctx.rerun_failures_count,
-                       ctx.rerun_failures_max)
+      return predictable.PredictableFilterProc()
 
+    def _create_seed_proc(self, options):
+      if options.random_seed_stress_count == 1:
+        return None
+      return SeedProc(options.random_seed_stress_count, options.random_seed,
+                      options.j * 4)
 
 
 if __name__ == '__main__':
diff --git a/deps/v8/tools/testrunner/test_config.py b/deps/v8/tools/testrunner/test_config.py
new file mode 100644
index 00000000000..d9418fe9acc
--- /dev/null
+++ b/deps/v8/tools/testrunner/test_config.py
@@ -0,0 +1,32 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import random
+
+from .utils import random_utils
+
+
+class TestConfig(object):
+  def __init__(self,
+               command_prefix,
+               extra_flags,
+               isolates,
+               mode_flags,
+               no_harness,
+               noi18n,
+               random_seed,
+               shell_dir,
+               timeout,
+               verbose):
+    self.command_prefix = command_prefix
+    self.extra_flags = extra_flags
+    self.isolates = isolates
+    self.mode_flags = mode_flags
+    self.no_harness = no_harness
+    self.noi18n = noi18n
+    # random_seed is always not None.
+    self.random_seed = random_seed or random_utils.random_seed()
+    self.shell_dir = shell_dir
+    self.timeout = timeout
+    self.verbose = verbose
diff --git a/deps/v8/tools/testrunner/testproc/base.py b/deps/v8/tools/testrunner/testproc/base.py
index 1a87dbed551..5cb1182e89f 100644
--- a/deps/v8/tools/testrunner/testproc/base.py
+++ b/deps/v8/tools/testrunner/testproc/base.py
@@ -37,36 +37,12 @@
 DROP_PASS_OUTPUT = 2
 DROP_PASS_STDOUT = 3
 
-def get_reduce_result_function(requirement):
-  if requirement == DROP_RESULT:
-    return lambda _: None
-
-  if requirement == DROP_OUTPUT:
-    def f(result):
-      result.output = None
-      return result
-    return f
-
-  if requirement == DROP_PASS_OUTPUT:
-    def f(result):
-      if not result.has_unexpected_output:
-        result.output = None
-      return result
-    return f
-
-  if requirement == DROP_PASS_STDOUT:
-    def f(result):
-      if not result.has_unexpected_output:
-        result.output.stdout = None
-        result.output.stderr = None
-      return result
-    return f
-
 
 class TestProc(object):
   def __init__(self):
     self._prev_proc = None
     self._next_proc = None
+    self._stopped = False
     self._requirement = DROP_RESULT
     self._prev_requirement = None
     self._reduce_result = lambda result: result
@@ -90,8 +66,14 @@ def setup(self, requirement=DROP_RESULT):
     self._prev_requirement = requirement
     if self._next_proc:
       self._next_proc.setup(max(requirement, self._requirement))
-    if self._prev_requirement < self._requirement:
-      self._reduce_result = get_reduce_result_function(self._prev_requirement)
+
+    # Since we're not winning anything by droping part of the result we are
+    # dropping the whole result or pass it as it is. The real reduction happens
+    # during result creation (in the output processor), so the result is
+    # immutable.
+    if (self._prev_requirement < self._requirement and
+        self._prev_requirement == DROP_RESULT):
+      self._reduce_result = lambda _: None
 
   def next_test(self, test):
     """
@@ -111,6 +93,18 @@ def heartbeat(self):
     if self._prev_proc:
       self._prev_proc.heartbeat()
 
+  def stop(self):
+    if not self._stopped:
+      self._stopped = True
+      if self._prev_proc:
+        self._prev_proc.stop()
+      if self._next_proc:
+        self._next_proc.stop()
+
+  @property
+  def is_stopped(self):
+    return self._stopped
+
   ### Communication
 
   def _send_test(self, test):
@@ -119,7 +113,8 @@ def _send_test(self, test):
 
   def _send_result(self, test, result):
     """Helper method for sending result to the previous processor."""
-    result = self._reduce_result(result)
+    if not test.keep_output:
+      result = self._reduce_result(result)
     self._prev_proc.result_for(test, result)
 
 
diff --git a/deps/v8/tools/testrunner/testproc/combiner.py b/deps/v8/tools/testrunner/testproc/combiner.py
new file mode 100644
index 00000000000..50944e1e5e4
--- /dev/null
+++ b/deps/v8/tools/testrunner/testproc/combiner.py
@@ -0,0 +1,124 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+from collections import defaultdict
+import time
+
+from . import base
+from ..objects import testcase
+from ..outproc import base as outproc
+
+
+class CombinerProc(base.TestProc):
+  def __init__(self, rng, min_group_size, max_group_size, count):
+    """
+    Args:
+      rng: random number generator
+      min_group_size: minimum number of tests to combine
+      max_group_size: maximum number of tests to combine
+      count: how many tests to generate. 0 means infinite running
+    """
+    super(CombinerProc, self).__init__()
+
+    self._rng = rng
+    self._min_size = min_group_size
+    self._max_size = max_group_size
+    self._count = count
+
+    # Index of the last generated test
+    self._current_num = 0
+
+    # {suite name: instance of TestGroups}
+    self._groups = defaultdict(TestGroups)
+
+    # {suite name: instance of TestCombiner}
+    self._combiners = {}
+
+  def setup(self, requirement=base.DROP_RESULT):
+    # Combiner is not able to pass results (even as None) to the previous
+    # processor.
+    assert requirement == base.DROP_RESULT
+    self._next_proc.setup(base.DROP_RESULT)
+
+  def next_test(self, test):
+    group_key = self._get_group_key(test)
+    if not group_key:
+      # Test not suitable for combining
+      return
+
+    self._groups[test.suite.name].add_test(group_key, test)
+
+  def _get_group_key(self, test):
+    combiner =  self._get_combiner(test.suite)
+    if not combiner:
+      print ('>>> Warning: There is no combiner for %s testsuite' %
+             test.suite.name)
+      return None
+    return combiner.get_group_key(test)
+
+  def result_for(self, test, result):
+    self._send_next_test()
+
+  def generate_initial_tests(self, num=1):
+    for _ in xrange(0, num):
+      self._send_next_test()
+
+  def _send_next_test(self):
+    if self.is_stopped:
+      return
+
+    if self._count and self._current_num >= self._count:
+      return
+
+    combined_test = self._create_new_test()
+    if not combined_test:
+      # Not enough tests
+      return
+
+    self._send_test(combined_test)
+
+  def _create_new_test(self):
+    suite, combiner = self._select_suite()
+    groups = self._groups[suite]
+
+    max_size = self._rng.randint(self._min_size, self._max_size)
+    sample = groups.sample(self._rng, max_size)
+    if not sample:
+      return None
+
+    self._current_num += 1
+    return combiner.combine('%s-%d' % (suite, self._current_num), sample)
+
+  def _select_suite(self):
+    """Returns pair (suite name, combiner)."""
+    selected = self._rng.randint(0, len(self._groups) - 1)
+    for n, suite in enumerate(self._groups):
+      if n == selected:
+        return suite, self._combiners[suite]
+
+  def _get_combiner(self, suite):
+    combiner = self._combiners.get(suite.name)
+    if not combiner:
+      combiner = suite.get_test_combiner()
+      self._combiners[suite.name] = combiner
+    return combiner
+
+
+class TestGroups(object):
+  def __init__(self):
+    self._groups = defaultdict(list)
+    self._keys = []
+
+  def add_test(self, key, test):
+    self._groups[key].append(test)
+    self._keys.append(key)
+
+  def sample(self, rng, max_size):
+    # Not enough tests
+    if not self._groups:
+      return None
+
+    group_key = rng.choice(self._keys)
+    tests = self._groups[group_key]
+    return [rng.choice(tests) for _ in xrange(0, max_size)]
diff --git a/deps/v8/tools/testrunner/testproc/execution.py b/deps/v8/tools/testrunner/testproc/execution.py
index 021b02af3e9..2d1ea02cd0b 100644
--- a/deps/v8/tools/testrunner/testproc/execution.py
+++ b/deps/v8/tools/testrunner/testproc/execution.py
@@ -15,12 +15,12 @@ def run_job(job, process_context):
   return job.run(process_context)
 
 
-def create_process_context(requirement):
-  return ProcessContext(base.get_reduce_result_function(requirement))
+def create_process_context(result_reduction):
+  return ProcessContext(result_reduction)
 
 
 JobResult = collections.namedtuple('JobResult', ['id', 'result'])
-ProcessContext = collections.namedtuple('ProcessContext', ['reduce_result_f'])
+ProcessContext = collections.namedtuple('ProcessContext', ['result_reduction'])
 
 
 class Job(object):
@@ -32,9 +32,8 @@ def __init__(self, test_id, cmd, outproc, keep_output):
 
   def run(self, process_ctx):
     output = self.cmd.execute()
-    result = self.outproc.process(output)
-    if not self.keep_output:
-      result = process_ctx.reduce_result_f(result)
+    reduction = process_ctx.result_reduction if not self.keep_output else None
+    result = self.outproc.process(output, reduction)
     return JobResult(self.test_id, result)
 
 
@@ -44,49 +43,51 @@ class ExecutionProc(base.TestProc):
   sends results to the previous processor.
   """
 
-  def __init__(self, jobs, context):
+  def __init__(self, jobs, outproc_factory=None):
     super(ExecutionProc, self).__init__()
     self._pool = pool.Pool(jobs)
-    self._context = context
+    self._outproc_factory = outproc_factory or (lambda t: t.output_proc)
     self._tests = {}
 
   def connect_to(self, next_proc):
     assert False, 'ExecutionProc cannot be connected to anything'
 
-  def start(self):
-    try:
-      it = self._pool.imap_unordered(
+  def run(self):
+    it = self._pool.imap_unordered(
         fn=run_job,
         gen=[],
         process_context_fn=create_process_context,
         process_context_args=[self._prev_requirement],
-      )
-      for pool_result in it:
-        if pool_result.heartbeat:
-          continue
-
-        job_result = pool_result.value
-        test_id, result = job_result
-
-        test, result.cmd = self._tests[test_id]
-        del self._tests[test_id]
-        self._send_result(test, result)
-    except KeyboardInterrupt:
-      raise
-    except:
-      traceback.print_exc()
-      raise
-    finally:
-      self._pool.terminate()
+    )
+    for pool_result in it:
+      self._unpack_result(pool_result)
 
   def next_test(self, test):
+    if self.is_stopped:
+      return
+
     test_id = test.procid
-    cmd = test.get_command(self._context)
+    cmd = test.get_command()
     self._tests[test_id] = test, cmd
 
-    # TODO(majeski): Needs factory for outproc as in local/execution.py
-    outproc = test.output_proc
+    outproc = self._outproc_factory(test)
     self._pool.add([Job(test_id, cmd, outproc, test.keep_output)])
 
   def result_for(self, test, result):
     assert False, 'ExecutionProc cannot receive results'
+
+  def stop(self):
+    super(ExecutionProc, self).stop()
+    self._pool.abort()
+
+  def _unpack_result(self, pool_result):
+    if pool_result.heartbeat:
+      self.heartbeat()
+      return
+
+    job_result = pool_result.value
+    test_id, result = job_result
+
+    test, result.cmd = self._tests[test_id]
+    del self._tests[test_id]
+    self._send_result(test, result)
diff --git a/deps/v8/tools/testrunner/testproc/expectation.py b/deps/v8/tools/testrunner/testproc/expectation.py
new file mode 100644
index 00000000000..607c010cf38
--- /dev/null
+++ b/deps/v8/tools/testrunner/testproc/expectation.py
@@ -0,0 +1,27 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+from . import base
+
+from testrunner.local import statusfile
+from testrunner.outproc import base as outproc
+
+class ForgiveTimeoutProc(base.TestProcProducer):
+  """Test processor passing tests and results through and forgiving timeouts."""
+  def __init__(self):
+    super(ForgiveTimeoutProc, self).__init__('no-timeout')
+
+  def _next_test(self, test):
+    subtest = self._create_subtest(test, 'no_timeout')
+    if subtest.expected_outcomes == outproc.OUTCOMES_PASS:
+      subtest.expected_outcomes = outproc.OUTCOMES_PASS_OR_TIMEOUT
+    elif subtest.expected_outcomes == outproc.OUTCOMES_FAIL:
+      subtest.expected_outcomes = outproc.OUTCOMES_FAIL_OR_TIMEOUT
+    elif statusfile.TIMEOUT not in subtest.expected_outcomes:
+      subtest.expected_outcomes = (
+          subtest.expected_outcomes + [statusfile.TIMEOUT])
+    self._send_test(subtest)
+
+  def _result_for(self, test, subtest, result):
+    self._send_result(test, result)
diff --git a/deps/v8/tools/testrunner/testproc/fuzzer.py b/deps/v8/tools/testrunner/testproc/fuzzer.py
new file mode 100644
index 00000000000..624b9aac042
--- /dev/null
+++ b/deps/v8/tools/testrunner/testproc/fuzzer.py
@@ -0,0 +1,287 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+from collections import namedtuple
+import time
+
+from . import base
+
+
+class FuzzerConfig(object):
+  def __init__(self, probability, analyzer, fuzzer):
+    """
+    Args:
+      probability: of choosing this fuzzer (0; 10]
+      analyzer: instance of Analyzer class, can be None if no analysis is needed
+      fuzzer: instance of Fuzzer class
+    """
+    assert probability > 0 and probability <= 10
+
+    self.probability = probability
+    self.analyzer = analyzer
+    self.fuzzer = fuzzer
+
+
+class Analyzer(object):
+  def get_analysis_flags(self):
+    raise NotImplementedError()
+
+  def do_analysis(self, result):
+    raise NotImplementedError()
+
+
+class Fuzzer(object):
+  def create_flags_generator(self, rng, test, analysis_value):
+    """
+    Args:
+      rng: random number generator
+      test: test for which to create flags
+      analysis_value: value returned by the analyzer. None if there is no
+        corresponding analyzer to this fuzzer or the analysis phase is disabled
+    """
+    raise NotImplementedError()
+
+
+# TODO(majeski): Allow multiple subtests to run at once.
+class FuzzerProc(base.TestProcProducer):
+  def __init__(self, rng, count, fuzzers, disable_analysis=False):
+    """
+    Args:
+      rng: random number generator used to select flags and values for them
+      count: number of tests to generate based on each base test
+      fuzzers: list of FuzzerConfig instances
+      disable_analysis: disable analysis phase and filtering base on it. When
+        set, processor passes None as analysis result to fuzzers
+    """
+    super(FuzzerProc, self).__init__('Fuzzer')
+
+    self._rng = rng
+    self._count = count
+    self._fuzzer_configs = fuzzers
+    self._disable_analysis = disable_analysis
+    self._gens = {}
+
+  def setup(self, requirement=base.DROP_RESULT):
+    # Fuzzer is optimized to not store the results
+    assert requirement == base.DROP_RESULT
+    super(FuzzerProc, self).setup(requirement)
+
+  def _next_test(self, test):
+    if self.is_stopped:
+      return
+
+    analysis_subtest = self._create_analysis_subtest(test)
+    if analysis_subtest:
+      self._send_test(analysis_subtest)
+    else:
+      self._gens[test.procid] = self._create_gen(test)
+      self._try_send_next_test(test)
+
+  def _create_analysis_subtest(self, test):
+    if self._disable_analysis:
+      return None
+
+    analysis_flags = []
+    for fuzzer_config in self._fuzzer_configs:
+      if fuzzer_config.analyzer:
+        analysis_flags += fuzzer_config.analyzer.get_analysis_flags()
+
+    if analysis_flags:
+      analysis_flags = list(set(analysis_flags))
+      return self._create_subtest(test, 'analysis', flags=analysis_flags,
+                                  keep_output=True)
+
+
+  def _result_for(self, test, subtest, result):
+    if not self._disable_analysis:
+      if result is not None:
+        # Analysis phase, for fuzzing we drop the result.
+        if result.has_unexpected_output:
+          self._send_result(test, None)
+          return
+        self._gens[test.procid] = self._create_gen(test, result)
+
+    self._try_send_next_test(test)
+
+  def _create_gen(self, test, analysis_result=None):
+    # It will be called with analysis_result==None only when there is no
+    # analysis phase at all, so no fuzzer has it's own analyzer.
+    gens = []
+    indexes = []
+    for i, fuzzer_config in enumerate(self._fuzzer_configs):
+      analysis_value = None
+      if analysis_result and fuzzer_config.analyzer:
+        analysis_value = fuzzer_config.analyzer.do_analysis(analysis_result)
+        if not analysis_value:
+          # Skip fuzzer for this test since it doesn't have analysis data
+          continue
+      p = fuzzer_config.probability
+      flag_gen = fuzzer_config.fuzzer.create_flags_generator(self._rng, test,
+                                                             analysis_value)
+      indexes += [len(gens)] * p
+      gens.append((p, flag_gen))
+
+    if not gens:
+      # No fuzzers for this test, skip it
+      return
+
+    i = 0
+    while not self._count or i < self._count:
+      main_index = self._rng.choice(indexes)
+      _, main_gen = gens[main_index]
+
+      flags = next(main_gen)
+      for index, (p, gen) in enumerate(gens):
+        if index == main_index:
+          continue
+        if self._rng.randint(1, 10) <= p:
+          flags += next(gen)
+
+      flags.append('--fuzzer-random-seed=%s' % self._next_seed())
+      yield self._create_subtest(test, str(i), flags=flags)
+
+      i += 1
+
+  def _try_send_next_test(self, test):
+    if not self.is_stopped:
+      for subtest in self._gens[test.procid]:
+        self._send_test(subtest)
+        return
+
+    del self._gens[test.procid]
+    self._send_result(test, None)
+
+  def _next_seed(self):
+    seed = None
+    while not seed:
+      seed = self._rng.randint(-2147483648, 2147483647)
+    return seed
+
+
+class ScavengeAnalyzer(Analyzer):
+  def get_analysis_flags(self):
+    return ['--fuzzer-gc-analysis']
+
+  def do_analysis(self, result):
+    for line in reversed(result.output.stdout.splitlines()):
+      if line.startswith('### Maximum new space size reached = '):
+        return int(float(line.split()[7]))
+
+
+class ScavengeFuzzer(Fuzzer):
+  def create_flags_generator(self, rng, test, analysis_value):
+    while True:
+      yield ['--stress-scavenge=%d' % (analysis_value or 100)]
+
+
+class MarkingAnalyzer(Analyzer):
+  def get_analysis_flags(self):
+    return ['--fuzzer-gc-analysis']
+
+  def do_analysis(self, result):
+    for line in reversed(result.output.stdout.splitlines()):
+      if line.startswith('### Maximum marking limit reached = '):
+        return int(float(line.split()[6]))
+
+
+class MarkingFuzzer(Fuzzer):
+  def create_flags_generator(self, rng, test, analysis_value):
+    while True:
+      yield ['--stress-marking=%d' % (analysis_value or 100)]
+
+
+class GcIntervalAnalyzer(Analyzer):
+  def get_analysis_flags(self):
+    return ['--fuzzer-gc-analysis']
+
+  def do_analysis(self, result):
+    for line in reversed(result.output.stdout.splitlines()):
+      if line.startswith('### Allocations = '):
+        return int(float(line.split()[3][:-1]))
+
+
+class GcIntervalFuzzer(Fuzzer):
+  def create_flags_generator(self, rng, test, analysis_value):
+    if analysis_value:
+      value = analysis_value / 10
+    else:
+      value = 10000
+    while True:
+      yield ['--random-gc-interval=%d' % value]
+
+
+class CompactionFuzzer(Fuzzer):
+  def create_flags_generator(self, rng, test, analysis_value):
+    while True:
+      yield ['--stress-compaction-random']
+
+
+class ThreadPoolSizeFuzzer(Fuzzer):
+  def create_flags_generator(self, rng, test, analysis_value):
+    while True:
+      yield ['--thread-pool-size=%d' % rng.randint(1, 8)]
+
+
+class InterruptBudgetFuzzer(Fuzzer):
+  def create_flags_generator(self, rng, test, analysis_value):
+    while True:
+      limit = 1 + int(rng.random() * 144)
+      yield ['--interrupt-budget=%d' % rng.randint(1, limit * 1024)]
+
+
+class DeoptAnalyzer(Analyzer):
+  MAX_DEOPT=1000000000
+
+  def __init__(self, min_interval):
+    super(DeoptAnalyzer, self).__init__()
+    self._min = min_interval
+
+  def get_analysis_flags(self):
+    return ['--deopt-every-n-times=%d' % self.MAX_DEOPT,
+            '--print-deopt-stress']
+
+  def do_analysis(self, result):
+    for line in reversed(result.output.stdout.splitlines()):
+      if line.startswith('=== Stress deopt counter: '):
+        counter = self.MAX_DEOPT - int(line.split(' ')[-1])
+        if counter < self._min:
+          # Skip this test since we won't generate any meaningful interval with
+          # given minimum.
+          return None
+        return counter
+
+
+class DeoptFuzzer(Fuzzer):
+  def __init__(self, min_interval):
+    super(DeoptFuzzer, self).__init__()
+    self._min = min_interval
+
+  def create_flags_generator(self, rng, test, analysis_value):
+    while True:
+      if analysis_value:
+        value = analysis_value / 2
+      else:
+        value = 10000
+      interval = rng.randint(self._min, max(value, self._min))
+      yield ['--deopt-every-n-times=%d' % interval]
+
+
+FUZZERS = {
+  'compaction': (None, CompactionFuzzer),
+  'deopt': (DeoptAnalyzer, DeoptFuzzer),
+  'gc_interval': (GcIntervalAnalyzer, GcIntervalFuzzer),
+  'interrupt_budget': (None, InterruptBudgetFuzzer),
+  'marking': (MarkingAnalyzer, MarkingFuzzer),
+  'scavenge': (ScavengeAnalyzer, ScavengeFuzzer),
+  'threads': (None, ThreadPoolSizeFuzzer),
+}
+
+
+def create_fuzzer_config(name, probability, *args, **kwargs):
+  analyzer_class, fuzzer_class = FUZZERS[name]
+  return FuzzerConfig(
+      probability,
+      analyzer_class(*args, **kwargs) if analyzer_class else None,
+      fuzzer_class(*args, **kwargs),
+  )
diff --git a/deps/v8/tools/testrunner/testproc/progress.py b/deps/v8/tools/testrunner/testproc/progress.py
index 78514f72527..221c64bfdd4 100644
--- a/deps/v8/tools/testrunner/testproc/progress.py
+++ b/deps/v8/tools/testrunner/testproc/progress.py
@@ -103,6 +103,15 @@ def finished(self):
 
 
 class VerboseProgressIndicator(SimpleProgressIndicator):
+  def __init__(self):
+    super(VerboseProgressIndicator, self).__init__()
+    self._last_printed_time = time.time()
+
+  def _print(self, text):
+    print text
+    sys.stdout.flush()
+    self._last_printed_time = time.time()
+
   def _on_result_for(self, test, result):
     super(VerboseProgressIndicator, self)._on_result_for(test, result)
     # TODO(majeski): Support for dummy/grouped results
@@ -113,12 +122,13 @@ def _on_result_for(self, test, result):
         outcome = 'FAIL'
     else:
       outcome = 'pass'
-    print 'Done running %s: %s' % (test, outcome)
-    sys.stdout.flush()
+    self._print('Done running %s: %s' % (test, outcome))
 
   def _on_heartbeat(self):
-    print 'Still working...'
-    sys.stdout.flush()
+    if time.time() - self._last_printed_time > 30:
+      # Print something every 30 seconds to not get killed by an output
+      # timeout.
+      self._print('Still working...')
 
 
 class DotsProgressIndicator(SimpleProgressIndicator):
@@ -292,7 +302,7 @@ def finished(self):
 
 
 class JsonTestProgressIndicator(ProgressIndicator):
-  def __init__(self, json_test_results, arch, mode, random_seed):
+  def __init__(self, json_test_results, arch, mode):
     super(JsonTestProgressIndicator, self).__init__()
     # We want to drop stdout/err for all passed tests on the first try, but we
     # need to get outputs for all runs after the first one. To accommodate that,
@@ -303,7 +313,6 @@ def __init__(self, json_test_results, arch, mode, random_seed):
     self.json_test_results = json_test_results
     self.arch = arch
     self.mode = mode
-    self.random_seed = random_seed
     self.results = []
     self.tests = []
 
@@ -338,10 +347,7 @@ def process_results(self, test, results):
         "result": test.output_proc.get_outcome(output),
         "expected": test.expected_outcomes,
         "duration": output.duration,
-
-        # TODO(machenbach): This stores only the global random seed from the
-        # context and not possible overrides when using random-seed stress.
-        "random_seed": self.random_seed,
+        "random_seed": test.random_seed,
         "target_name": test.get_shell(),
         "variant": test.variant,
       })
diff --git a/deps/v8/tools/testrunner/testproc/rerun.py b/deps/v8/tools/testrunner/testproc/rerun.py
index 7f96e0260c8..a72bb3ebc67 100644
--- a/deps/v8/tools/testrunner/testproc/rerun.py
+++ b/deps/v8/tools/testrunner/testproc/rerun.py
@@ -34,7 +34,7 @@ def _result_for(self, test, subtest, result):
     results = self._results[test.procid]
     results.append(result)
 
-    if self._needs_rerun(test, result):
+    if not self.is_stopped and self._needs_rerun(test, result):
       self._rerun[test.procid] += 1
       if self._rerun_total_left is not None:
         self._rerun_total_left -= 1
diff --git a/deps/v8/tools/testrunner/testproc/seed.py b/deps/v8/tools/testrunner/testproc/seed.py
new file mode 100644
index 00000000000..3f40e79b34a
--- /dev/null
+++ b/deps/v8/tools/testrunner/testproc/seed.py
@@ -0,0 +1,58 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import random
+from collections import defaultdict
+
+from . import base
+from ..utils import random_utils
+
+
+class SeedProc(base.TestProcProducer):
+  def __init__(self, count, seed=None, parallel_subtests=1):
+    """
+    Args:
+      count: How many subtests with different seeds to create for each test.
+        0 means infinite.
+      seed: seed to use. None means random seed for each subtest.
+      parallel_subtests: How many subtest of each test to run at the same time.
+    """
+    super(SeedProc, self).__init__('Seed')
+    self._count = count
+    self._seed = seed
+    self._last_idx = defaultdict(int)
+    self._todo = defaultdict(int)
+    self._parallel_subtests = parallel_subtests
+    if count:
+      self._parallel_subtests = min(self._parallel_subtests, count)
+
+  def setup(self, requirement=base.DROP_RESULT):
+    super(SeedProc, self).setup(requirement)
+
+    # SeedProc is optimized for dropping the result
+    assert requirement == base.DROP_RESULT
+
+  def _next_test(self, test):
+    for _ in xrange(0, self._parallel_subtests):
+      self._try_send_next_test(test)
+
+  def _result_for(self, test, subtest, result):
+    self._todo[test.procid] -= 1
+    self._try_send_next_test(test)
+
+  def _try_send_next_test(self, test):
+    def create_subtest(idx):
+      seed = self._seed or random_utils.random_seed()
+      return self._create_subtest(test, idx, random_seed=seed)
+
+    num = self._last_idx[test.procid]
+    if not self._count or num < self._count:
+      num += 1
+      self._send_test(create_subtest(num))
+      self._todo[test.procid] += 1
+      self._last_idx[test.procid] = num
+    elif not self._todo.get(test.procid):
+      del self._last_idx[test.procid]
+      del self._todo[test.procid]
+      self._send_result(test, None)
diff --git a/deps/v8/tools/testrunner/testproc/sigproc.py b/deps/v8/tools/testrunner/testproc/sigproc.py
new file mode 100644
index 00000000000..e97fe7ece30
--- /dev/null
+++ b/deps/v8/tools/testrunner/testproc/sigproc.py
@@ -0,0 +1,31 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import signal
+
+from . import base
+from testrunner.local import utils
+
+
+class SignalProc(base.TestProcObserver):
+  def __init__(self):
+    super(SignalProc, self).__init__()
+    self.exit_code = utils.EXIT_CODE_PASS
+
+  def setup(self, *args, **kwargs):
+    super(SignalProc, self).setup(*args, **kwargs)
+    # It should be called after processors are chained together to not loose
+    # catched signal.
+    signal.signal(signal.SIGINT, self._on_ctrlc)
+    signal.signal(signal.SIGTERM, self._on_sigterm)
+
+  def _on_ctrlc(self, _signum, _stack_frame):
+    print '>>> Ctrl-C detected, early abort...'
+    self.exit_code = utils.EXIT_CODE_INTERRUPTED
+    self.stop()
+
+  def _on_sigterm(self, _signum, _stack_frame):
+    print '>>> SIGTERM received, early abort...'
+    self.exit_code = utils.EXIT_CODE_TERMINATED
+    self.stop()
diff --git a/deps/v8/tools/testrunner/testproc/timeout.py b/deps/v8/tools/testrunner/testproc/timeout.py
new file mode 100644
index 00000000000..84ddc656e2a
--- /dev/null
+++ b/deps/v8/tools/testrunner/testproc/timeout.py
@@ -0,0 +1,28 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import time
+
+from . import base
+
+
+class TimeoutProc(base.TestProcObserver):
+  def __init__(self, duration_sec):
+    super(TimeoutProc, self).__init__()
+    self._duration_sec = duration_sec
+    self._start = time.time()
+
+  def _on_next_test(self, test):
+    self._on_event()
+
+  def _on_result_for(self, test, result):
+    self._on_event()
+
+  def _on_heartbeat(self):
+    self._on_event()
+
+  def _on_event(self):
+    if not self.is_stopped:
+      if time.time() - self._start > self._duration_sec:
+        self.stop()
diff --git a/deps/v8/tools/testrunner/testrunner.isolate b/deps/v8/tools/testrunner/testrunner.isolate
deleted file mode 100644
index 56667c20215..00000000000
--- a/deps/v8/tools/testrunner/testrunner.isolate
+++ /dev/null
@@ -1,25 +0,0 @@
-# Copyright 2015 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-{
-  'variables': {
-    'command': [
-      '../run-tests.py',
-    ],
-    'files': [
-      '<(PRODUCT_DIR)/v8_build_config.json',
-      '../run-tests.py',
-      './'
-    ],
-  },
-  'conditions': [
-    ['coverage==1 and sanitizer_coverage=="bb,trace-pc-guard"', {
-      'variables': {
-        'files': [
-          '../sanitizers/sancov_merger.py',
-          '../../third_party/llvm/projects/compiler-rt/lib/sanitizer_common/scripts/sancov.py',
-        ],
-      },
-    }],
-  ],
-}
diff --git a/deps/v8/tools/testrunner/trycatch_loader.js b/deps/v8/tools/testrunner/trycatch_loader.js
new file mode 100644
index 00000000000..737c8e45dbe
--- /dev/null
+++ b/deps/v8/tools/testrunner/trycatch_loader.js
@@ -0,0 +1,42 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// Wrapper loading javascript tests passed as arguments used by gc fuzzer.
+// It ignores all exceptions and run tests in a separate namespaces.
+//
+// It can't prevent %AbortJS function from aborting execution, so it should be
+// used with d8's --disable-abortjs flag to ignore all possible errors inside
+// tests.
+
+// We use -- as an additional separator for test preamble files and test files.
+// The preamble files (before --) will be loaded in each realm before each
+// test.
+var separator = arguments.indexOf("--")
+var preamble = arguments.slice(0, separator)
+var tests = arguments.slice(separator + 1)
+
+var preambleString = ""
+for (let jstest of preamble) {
+  preambleString += "load(\"" + jstest + "\");"
+}
+
+for (let jstest of tests) {
+  print("Loading " + jstest);
+  let start = performance.now();
+
+  // anonymous function to not populate global namespace.
+  (function () {
+    let realm = Realm.create();
+    try {
+      Realm.eval(realm, preambleString + "load(\"" + jstest + "\");");
+    } catch (err) {
+      // ignore all errors
+    }
+    Realm.dispose(realm);
+  })();
+
+  let durationSec = ((performance.now() - start) / 1000.0).toFixed(2);
+  print("Duration " + durationSec + "s");
+}
diff --git a/deps/v8/tools/testrunner/utils/__init__.py b/deps/v8/tools/testrunner/utils/__init__.py
new file mode 100644
index 00000000000..44335385563
--- /dev/null
+++ b/deps/v8/tools/testrunner/utils/__init__.py
@@ -0,0 +1,3 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
diff --git a/deps/v8/tools/testrunner/utils/random_utils.py b/deps/v8/tools/testrunner/utils/random_utils.py
new file mode 100644
index 00000000000..0d2cb3fa95a
--- /dev/null
+++ b/deps/v8/tools/testrunner/utils/random_utils.py
@@ -0,0 +1,13 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import random
+
+
+def random_seed():
+  """Returns random, non-zero seed."""
+  seed = 0
+  while not seed:
+    seed = random.SystemRandom().randint(-2147483648, 2147483647)
+  return seed
diff --git a/deps/v8/tools/toolchain/BUILD.gn b/deps/v8/tools/toolchain/BUILD.gn
new file mode 100644
index 00000000000..b252c5eed53
--- /dev/null
+++ b/deps/v8/tools/toolchain/BUILD.gn
@@ -0,0 +1,93 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//build/toolchain/gcc_toolchain.gni")
+
+gcc_toolchain("mips-bundled") {
+  toolprefix = rebase_path("//tools/mips_toolchain/bin/mips-mti-linux-gnu-",
+                           root_build_dir)
+  cc = "${toolprefix}gcc"
+  cxx = "${toolprefix}g++"
+
+  readelf = "${toolprefix}readelf"
+  nm = "${toolprefix}nm"
+  ar = "${toolprefix}ar"
+  ld = cxx
+
+  # Flag that sets endianness
+  extra_ldflags = "-EB"
+  extra_cppflags = "-EB"
+
+  toolchain_args = {
+    current_cpu = "mips"
+    current_os = "linux"
+    is_clang = false
+  }
+}
+
+gcc_toolchain("mips64-bundled") {
+  toolprefix = rebase_path("//tools/mips_toolchain/bin/mips-mti-linux-gnu-",
+                           root_build_dir)
+  cc = "${toolprefix}gcc"
+  cxx = "${toolprefix}g++"
+
+  readelf = "${toolprefix}readelf"
+  nm = "${toolprefix}nm"
+  ar = "${toolprefix}ar"
+  ld = cxx
+
+  # Flag that sets endianness and ABI
+  extra_ldflags = "-EB -mabi=64"
+  extra_cppflags = "-EB -mabi=64"
+
+  toolchain_args = {
+    current_cpu = "mips64"
+    current_os = "linux"
+    is_clang = false
+  }
+}
+
+gcc_toolchain("mipsel-bundled") {
+  toolprefix = rebase_path("//tools/mips_toolchain/bin/mips-mti-linux-gnu-",
+                           root_build_dir)
+  cc = "${toolprefix}gcc"
+  cxx = "${toolprefix}g++"
+
+  readelf = "${toolprefix}readelf"
+  nm = "${toolprefix}nm"
+  ar = "${toolprefix}ar"
+  ld = cxx
+
+  # Flag that sets endianness
+  extra_ldflags = "-EL"
+  extra_cppflags = "-EL"
+
+  toolchain_args = {
+    current_cpu = "mipsel"
+    current_os = "linux"
+    is_clang = false
+  }
+}
+
+gcc_toolchain("mips64el-bundled") {
+  toolprefix = rebase_path("//tools/mips_toolchain/bin/mips-mti-linux-gnu-",
+                           root_build_dir)
+  cc = "${toolprefix}gcc"
+  cxx = "${toolprefix}g++"
+
+  readelf = "${toolprefix}readelf"
+  nm = "${toolprefix}nm"
+  ar = "${toolprefix}ar"
+  ld = cxx
+
+  # Flag that sets endianness and ABI
+  extra_ldflags = "-EL -mabi=64"
+  extra_cppflags = "-EL -mabi=64"
+
+  toolchain_args = {
+    current_cpu = "mips64el"
+    current_os = "linux"
+    is_clang = false
+  }
+}
diff --git a/deps/v8/tools/try_perf.py b/deps/v8/tools/try_perf.py
index cad836b2e35..b77ccafa63e 100755
--- a/deps/v8/tools/try_perf.py
+++ b/deps/v8/tools/try_perf.py
@@ -20,6 +20,12 @@
   '--nexus10': 'v8_nexus10_perf_try',
 }
 
+# This list will contain builder names that should be triggered on an internal
+# swarming bucket instead of internal Buildbot master.
+SWARMING_BOTS = [
+  'v8_linux64_perf_try',
+]
+
 DEFAULT_BOTS = [
   'v8_arm32_perf_try',
   'v8_linux32_perf_try',
@@ -50,6 +56,17 @@
 
 V8_BASE = os.path.abspath(os.path.dirname(os.path.dirname(__file__)))
 
+def _trigger_bots(bucket, bots, options):
+  cmd = ['git cl try']
+  cmd += ['-B', bucket]
+  cmd += ['-b %s' % bot for bot in bots]
+  if options.revision: cmd += ['-r %s' % options.revision]
+  benchmarks = ['"%s"' % benchmark for benchmark in options.benchmarks]
+  cmd += ['-p \'testfilter=[%s]\'' % ','.join(benchmarks)]
+  if options.extra_flags:
+    cmd += ['-p \'extra_flags="%s"\'' % options.extra_flags]
+  subprocess.check_call(' '.join(cmd), shell=True, cwd=V8_BASE)
+
 def main():
   parser = argparse.ArgumentParser(description='')
   parser.add_argument('benchmarks', nargs='+', help='The benchmarks to run.')
@@ -89,14 +106,13 @@ def main():
   subprocess.check_output(
       'update_depot_tools', shell=True, stderr=subprocess.STDOUT, cwd=V8_BASE)
 
-  cmd = ['git cl try -m internal.client.v8']
-  cmd += ['-b %s' % bot for bot in options.bots]
-  if options.revision: cmd += ['-r %s' % options.revision]
-  benchmarks = ['"%s"' % benchmark for benchmark in options.benchmarks]
-  cmd += ['-p \'testfilter=[%s]\'' % ','.join(benchmarks)]
-  if options.extra_flags:
-    cmd += ['-p \'extra_flags="%s"\'' % options.extra_flags]
-  subprocess.check_call(' '.join(cmd), shell=True, cwd=V8_BASE)
+  buildbot_bots = [bot for bot in options.bots if bot not in SWARMING_BOTS]
+  if buildbot_bots:
+    _trigger_bots('master.internal.client.v8', buildbot_bots, options)
+
+  swarming_bots = [bot for bot in options.bots if bot in SWARMING_BOTS]
+  if swarming_bots:
+    _trigger_bots('luci.v8-internal.try', swarming_bots, options)
 
 
 if __name__ == '__main__':  # pragma: no cover
diff --git a/deps/v8/tools/turbolizer/index.html b/deps/v8/tools/turbolizer/index.html
index 552e83783a1..2167d21a141 100644
--- a/deps/v8/tools/turbolizer/index.html
+++ b/deps/v8/tools/turbolizer/index.html
@@ -5,13 +5,13 @@
     <link rel="stylesheet" href="turbo-visualizer.css" />
   </head>
   <body>
-    <div id="left">
+    <div id="left" class="viewpane">
       <div id='source-text'>
         <pre id='source-text-pre'\>
       </div>
     </div>
     <div class="resizer-left"></div>
-    <div id="middle" class="resizable-pane">
+    <div id="middle" class="viewpane">
       <div id="graph-toolbox-anchor">
         <span id="graph-toolbox">
           <input id="layout" type="image" title="layout graph" src="layout-icon.png"
@@ -55,7 +55,7 @@
       </text></svg></div>
     </div>
     <div class="resizer-right"></div>
-    <div id="right">
+    <div id="right" class="viewpane">
       <div id='disassembly'>
         <pre id='disassembly-text-pre' class='prettyprint prettyprinted'>
           <ul id='disassembly-list' class='nolinenums noindent'>
diff --git a/deps/v8/tools/turbolizer/monkey.js b/deps/v8/tools/turbolizer/monkey.js
index 129f8b32684..29eaaebb36e 100644
--- a/deps/v8/tools/turbolizer/monkey.js
+++ b/deps/v8/tools/turbolizer/monkey.js
@@ -2,25 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-Array.prototype.getStaggeredFromMiddle = function(i) {
-  if (i >= this.length) {
-    throw("getStaggeredFromMiddle: OOB");
-  }
-  var middle = Math.floor(this.length / 2);
-  var index = middle + (((i % 2) == 0) ? (i / 2) : (((1 - i) / 2) - 1));
-  return this[index];
-}
-
-Array.prototype.contains = function(obj) {
-  var i = this.length;
-  while (i--) {
-    if (this[i] === obj) {
-      return true;
-    }
-  }
-  return false;
-}
-
 Math.alignUp = function(raw, multiple) {
   return Math.floor((raw + multiple - 1) / multiple) * multiple;
 }
diff --git a/deps/v8/tools/turbolizer/turbo-visualizer.css b/deps/v8/tools/turbolizer/turbo-visualizer.css
index 7fd9c4852a0..95fcba79289 100644
--- a/deps/v8/tools/turbolizer/turbo-visualizer.css
+++ b/deps/v8/tools/turbolizer/turbo-visualizer.css
@@ -242,15 +242,20 @@ span.linkable-text:hover {
 
 
 #left {
-    float: left; height: 100%; background-color: #FFFFFF;
+    float: left;
 }
 
 #middle {
-    float:left; height: 100%; background-color: #F8F8F8;
+    float:left; background-color: #F8F8F8;
 }
 
 #right {
-    float: right; background-color: #FFFFFF;
+    float: right;
+}
+
+.viewpane {
+    height: 100vh;
+    background-color: #FFFFFF;
 }
 
 
diff --git a/deps/v8/tools/turbolizer/turbo-visualizer.js b/deps/v8/tools/turbolizer/turbo-visualizer.js
index c04384810bb..0c720b22a44 100644
--- a/deps/v8/tools/turbolizer/turbo-visualizer.js
+++ b/deps/v8/tools/turbolizer/turbo-visualizer.js
@@ -65,18 +65,15 @@ class Snapper {
   }
 
   setDisassemblyExpanded(newState) {
-    console.log(newState)
     if (this.disassemblyExpand.classed("invisible") === newState) return;
     this.disassemblyExpandUpdate(newState);
     let resizer = this.resizer;
     if (newState) {
       resizer.sep_right = resizer.sep_right_snap;
       resizer.sep_right_snap = resizer.client_width;
-      console.log("set expand")
     } else {
       resizer.sep_right_snap = resizer.sep_right;
       resizer.sep_right = resizer.client_width;
-      console.log("set collapse")
     }
     resizer.updatePanes();
   }
diff --git a/deps/v8/tools/unittests/run_tests_test.py b/deps/v8/tools/unittests/run_tests_test.py
index f4ff3fe1f7f..4fb6aaff131 100755
--- a/deps/v8/tools/unittests/run_tests_test.py
+++ b/deps/v8/tools/unittests/run_tests_test.py
@@ -101,6 +101,8 @@ def run_tests(basedir, *args, **kwargs):
     sys_args = ['--command-prefix', sys.executable] + list(args)
     if kwargs.get('infra_staging', False):
       sys_args.append('--infra-staging')
+    else:
+      sys_args.append('--no-infra-staging')
     code = standard_runner.StandardTestRunner(
         basedir=basedir).execute(sys_args)
     return Result(stdout.getvalue(), stderr.getvalue(), code)
@@ -145,7 +147,9 @@ def setUpClass(cls):
     sys.path.append(TOOLS_ROOT)
     global standard_runner
     from testrunner import standard_runner
+    from testrunner.local import command
     from testrunner.local import pool
+    command.setup_testing()
     pool.setup_testing()
 
   @classmethod
@@ -170,10 +174,11 @@ def testPass(self):
           'sweet/bananas',
           'sweet/raspberries',
       )
-      self.assertIn('Running 4 tests', result.stdout, result)
+      self.assertIn('Running 2 base tests', result.stdout, result)
       self.assertIn('Done running sweet/bananas: pass', result.stdout, result)
-      self.assertIn('Total time:', result.stderr, result)
-      self.assertIn('sweet/bananas', result.stderr, result)
+      # TODO(majeski): Implement for test processors
+      # self.assertIn('Total time:', result.stderr, result)
+      # self.assertIn('sweet/bananas', result.stderr, result)
       self.assertEqual(0, result.returncode, result)
 
   def testShardedProc(self):
@@ -199,6 +204,7 @@ def testShardedProc(self):
           self.assertIn('Done running sweet/raspberries', result.stdout, result)
         self.assertEqual(0, result.returncode, result)
 
+  @unittest.skip("incompatible with test processors")
   def testSharded(self):
     """Test running a particular shard."""
     with temp_base() as basedir:
@@ -222,7 +228,7 @@ def testSharded(self):
   def testFailProc(self):
     self.testFail(infra_staging=True)
 
-  def testFail(self, infra_staging=False):
+  def testFail(self, infra_staging=True):
     """Test running only failing tests in two variants."""
     with temp_base() as basedir:
       result = run_tests(
@@ -269,7 +275,7 @@ def replace_variable_data(data):
   def testFailWithRerunAndJSONProc(self):
     self.testFailWithRerunAndJSON(infra_staging=True)
 
-  def testFailWithRerunAndJSON(self, infra_staging=False):
+  def testFailWithRerunAndJSON(self, infra_staging=True):
     """Test re-running a failing test and output to json."""
     with temp_base() as basedir:
       json_path = os.path.join(basedir, 'out.json')
@@ -303,12 +309,13 @@ def testFailWithRerunAndJSON(self, infra_staging=False):
       # flags field of the test result.
       # After recent changes we report all flags, including the file names.
       # This is redundant to the command. Needs investigation.
+      self.maxDiff = None
       self.check_cleaned_json_output('expected_test_results1.json', json_path)
 
   def testFlakeWithRerunAndJSONProc(self):
     self.testFlakeWithRerunAndJSON(infra_staging=True)
 
-  def testFlakeWithRerunAndJSON(self, infra_staging=False):
+  def testFlakeWithRerunAndJSON(self, infra_staging=True):
     """Test re-running a failing test and output to json."""
     with temp_base(baseroot='testroot2') as basedir:
       json_path = os.path.join(basedir, 'out.json')
@@ -334,6 +341,7 @@ def testFlakeWithRerunAndJSON(self, infra_staging=False):
             'Done running sweet/bananaflakes: pass', result.stdout, result)
         self.assertIn('All tests succeeded', result.stdout, result)
       self.assertEqual(0, result.returncode, result)
+      self.maxDiff = None
       self.check_cleaned_json_output('expected_test_results2.json', json_path)
 
   def testAutoDetect(self):
@@ -374,7 +382,7 @@ def testAutoDetect(self):
   def testSkipsProc(self):
     self.testSkips(infra_staging=True)
 
-  def testSkips(self, infra_staging=False):
+  def testSkips(self, infra_staging=True):
     """Test skipping tests in status file for a specific variant."""
     with temp_base() as basedir:
       result = run_tests(
@@ -390,12 +398,12 @@ def testSkips(self, infra_staging=False):
       else:
         self.assertIn('Running 1 base tests', result.stdout, result)
         self.assertIn('0 tests ran', result.stdout, result)
-      self.assertEqual(0, result.returncode, result)
+      self.assertEqual(2, result.returncode, result)
 
   def testDefaultProc(self):
     self.testDefault(infra_staging=True)
 
-  def testDefault(self, infra_staging=False):
+  def testDefault(self, infra_staging=True):
     """Test using default test suites, though no tests are run since they don't
     exist in a test setting.
     """
@@ -410,14 +418,14 @@ def testDefault(self, infra_staging=False):
       else:
         self.assertIn('Running 0 base tests', result.stdout, result)
         self.assertIn('0 tests ran', result.stdout, result)
-      self.assertEqual(0, result.returncode, result)
+      self.assertEqual(2, result.returncode, result)
 
   def testNoBuildConfig(self):
     """Test failing run when build config is not found."""
     with temp_base() as basedir:
       result = run_tests(basedir)
       self.assertIn('Failed to load build config', result.stdout, result)
-      self.assertEqual(1, result.returncode, result)
+      self.assertEqual(5, result.returncode, result)
 
   def testGNOption(self):
     """Test using gn option, but no gn build folder is found."""
@@ -433,7 +441,7 @@ def testInconsistentMode(self):
       result = run_tests(basedir, '--mode=Release')
       self.assertIn('execution mode (release) for release is inconsistent '
                     'with build config (debug)', result.stdout, result)
-      self.assertEqual(1, result.returncode, result)
+      self.assertEqual(5, result.returncode, result)
 
   def testInconsistentArch(self):
     """Test failing run when attempting to wrongly override the arch."""
@@ -442,13 +450,13 @@ def testInconsistentArch(self):
       self.assertIn(
           '--arch value (ia32) inconsistent with build config (x64).',
           result.stdout, result)
-      self.assertEqual(1, result.returncode, result)
+      self.assertEqual(5, result.returncode, result)
 
   def testWrongVariant(self):
     """Test using a bogus variant."""
     with temp_base() as basedir:
       result = run_tests(basedir, '--mode=Release', '--variants=meh')
-      self.assertEqual(1, result.returncode, result)
+      self.assertEqual(5, result.returncode, result)
 
   def testModeFromBuildConfig(self):
     """Test auto-detection of mode from build config."""
@@ -457,6 +465,7 @@ def testModeFromBuildConfig(self):
       self.assertIn('Running tests for x64.release', result.stdout, result)
       self.assertEqual(0, result.returncode, result)
 
+  @unittest.skip("not available with test processors")
   def testReport(self):
     """Test the report feature.
 
@@ -475,6 +484,7 @@ def testReport(self):
           result.stdout, result)
       self.assertEqual(1, result.returncode, result)
 
+  @unittest.skip("not available with test processors")
   def testWarnUnusedRules(self):
     """Test the unused-rules feature."""
     with temp_base() as basedir:
@@ -489,6 +499,7 @@ def testWarnUnusedRules(self):
       self.assertIn( 'Unused rule: regress/', result.stdout, result)
       self.assertEqual(1, result.returncode, result)
 
+  @unittest.skip("not available with test processors")
   def testCatNoSources(self):
     """Test printing sources, but the suite's tests have none available."""
     with temp_base() as basedir:
@@ -506,7 +517,7 @@ def testCatNoSources(self):
   def testPredictableProc(self):
     self.testPredictable(infra_staging=True)
 
-  def testPredictable(self, infra_staging=False):
+  def testPredictable(self, infra_staging=True):
     """Test running a test in verify-predictable mode.
 
     The test will fail because of missing allocation output. We verify that and
@@ -547,7 +558,10 @@ def testSlowArch(self):
       # timeout was used.
       self.assertEqual(0, result.returncode, result)
 
-  def testRandomSeedStressWithDefault(self):
+  def testRandomSeedStressWithDefaultProc(self):
+    self.testRandomSeedStressWithDefault(infra_staging=True)
+
+  def testRandomSeedStressWithDefault(self, infra_staging=True):
     """Test using random-seed-stress feature has the right number of tests."""
     with temp_base() as basedir:
       result = run_tests(
@@ -557,8 +571,13 @@ def testRandomSeedStressWithDefault(self):
           '--variants=default',
           '--random-seed-stress-count=2',
           'sweet/bananas',
+          infra_staging=infra_staging,
       )
-      self.assertIn('Running 2 tests', result.stdout, result)
+      if infra_staging:
+        self.assertIn('Running 1 base tests', result.stdout, result)
+        self.assertIn('2 tests ran', result.stdout, result)
+      else:
+        self.assertIn('Running 2 tests', result.stdout, result)
       self.assertEqual(0, result.returncode, result)
 
   def testRandomSeedStressWithSeed(self):
@@ -573,7 +592,8 @@ def testRandomSeedStressWithSeed(self):
           '--random-seed=123',
           'sweet/strawberries',
       )
-      self.assertIn('Running 2 tests', result.stdout, result)
+      self.assertIn('Running 1 base tests', result.stdout, result)
+      self.assertIn('2 tests ran', result.stdout, result)
       # We use a failing test so that the command is printed and we can verify
       # that the right random seed was passed.
       self.assertIn('--random-seed=123', result.stdout, result)
@@ -598,7 +618,8 @@ def testSpecificVariants(self):
       )
       # Both tests are either marked as running in only default or only
       # slow variant.
-      self.assertIn('Running 2 tests', result.stdout, result)
+      self.assertIn('Running 2 base tests', result.stdout, result)
+      self.assertIn('2 tests ran', result.stdout, result)
       self.assertEqual(0, result.returncode, result)
 
   def testStatusFilePresubmit(self):
@@ -611,7 +632,7 @@ def testStatusFilePresubmit(self):
   def testDotsProgressProc(self):
     self.testDotsProgress(infra_staging=True)
 
-  def testDotsProgress(self, infra_staging=False):
+  def testDotsProgress(self, infra_staging=True):
     with temp_base() as basedir:
       result = run_tests(
           basedir,
diff --git a/deps/v8/tools/unittests/testdata/expected_test_results1.json b/deps/v8/tools/unittests/testdata/expected_test_results1.json
index 172b87a5d6b..e889ecabcea 100644
--- a/deps/v8/tools/unittests/testdata/expected_test_results1.json
+++ b/deps/v8/tools/unittests/testdata/expected_test_results1.json
@@ -4,15 +4,15 @@
   "mode": "release", 
   "results": [
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --random-seed=123 strawberries --nohard-abort", 
+      "command": "/usr/bin/python out/Release/d8_mocked.py strawberries --random-seed=123 --nohard-abort", 
       "duration": 1, 
       "exit_code": 1, 
       "expected": [
         "PASS"
       ], 
       "flags": [
-        "--random-seed=123", 
         "strawberries", 
+        "--random-seed=123", 
         "--nohard-abort"
       ], 
       "name": "sweet/strawberries", 
@@ -20,20 +20,20 @@
       "result": "FAIL", 
       "run": 1, 
       "stderr": "", 
-      "stdout": "--random-seed=123 strawberries --nohard-abort\n", 
+      "stdout": "strawberries --random-seed=123 --nohard-abort\n", 
       "target_name": "d8_mocked.py", 
       "variant": "default"
     }, 
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --random-seed=123 strawberries --nohard-abort", 
+      "command": "/usr/bin/python out/Release/d8_mocked.py strawberries --random-seed=123 --nohard-abort", 
       "duration": 1, 
       "exit_code": 1, 
       "expected": [
         "PASS"
       ], 
       "flags": [
-        "--random-seed=123", 
         "strawberries", 
+        "--random-seed=123", 
         "--nohard-abort"
       ], 
       "name": "sweet/strawberries", 
@@ -41,20 +41,20 @@
       "result": "FAIL", 
       "run": 2, 
       "stderr": "", 
-      "stdout": "--random-seed=123 strawberries --nohard-abort\n", 
+      "stdout": "strawberries --random-seed=123 --nohard-abort\n", 
       "target_name": "d8_mocked.py", 
       "variant": "default"
     }, 
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --random-seed=123 strawberries --nohard-abort", 
+      "command": "/usr/bin/python out/Release/d8_mocked.py strawberries --random-seed=123 --nohard-abort", 
       "duration": 1, 
       "exit_code": 1, 
       "expected": [
         "PASS"
       ], 
       "flags": [
-        "--random-seed=123", 
         "strawberries", 
+        "--random-seed=123", 
         "--nohard-abort"
       ], 
       "name": "sweet/strawberries", 
@@ -62,40 +62,40 @@
       "result": "FAIL", 
       "run": 3, 
       "stderr": "", 
-      "stdout": "--random-seed=123 strawberries --nohard-abort\n", 
+      "stdout": "strawberries --random-seed=123 --nohard-abort\n", 
       "target_name": "d8_mocked.py", 
       "variant": "default"
     }
   ], 
   "slowest_tests": [
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --random-seed=123 strawberries --nohard-abort", 
+      "command": "/usr/bin/python out/Release/d8_mocked.py strawberries --random-seed=123 --nohard-abort", 
       "duration": 1, 
       "flags": [
-        "--random-seed=123", 
         "strawberries", 
+        "--random-seed=123", 
         "--nohard-abort"
       ], 
       "marked_slow": true, 
       "name": "sweet/strawberries"
     }, 
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --random-seed=123 strawberries --nohard-abort", 
+      "command": "/usr/bin/python out/Release/d8_mocked.py strawberries --random-seed=123 --nohard-abort", 
       "duration": 1, 
       "flags": [
-        "--random-seed=123", 
         "strawberries", 
+        "--random-seed=123", 
         "--nohard-abort"
       ], 
       "marked_slow": true, 
       "name": "sweet/strawberries"
     }, 
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --random-seed=123 strawberries --nohard-abort", 
+      "command": "/usr/bin/python out/Release/d8_mocked.py strawberries --random-seed=123 --nohard-abort", 
       "duration": 1, 
       "flags": [
-        "--random-seed=123", 
         "strawberries", 
+        "--random-seed=123", 
         "--nohard-abort"
       ], 
       "marked_slow": true, 
diff --git a/deps/v8/tools/unittests/testdata/expected_test_results2.json b/deps/v8/tools/unittests/testdata/expected_test_results2.json
index 7fcfe47f713..cdb4766e957 100644
--- a/deps/v8/tools/unittests/testdata/expected_test_results2.json
+++ b/deps/v8/tools/unittests/testdata/expected_test_results2.json
@@ -4,15 +4,15 @@
   "mode": "release", 
   "results": [
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --random-seed=123 bananaflakes --nohard-abort", 
+      "command": "/usr/bin/python out/Release/d8_mocked.py bananaflakes --random-seed=123 --nohard-abort", 
       "duration": 1, 
       "exit_code": 1, 
       "expected": [
         "PASS"
       ], 
       "flags": [
-        "--random-seed=123", 
         "bananaflakes", 
+        "--random-seed=123", 
         "--nohard-abort"
       ], 
       "name": "sweet/bananaflakes", 
@@ -20,20 +20,20 @@
       "result": "FAIL", 
       "run": 1, 
       "stderr": "", 
-      "stdout": "--random-seed=123 bananaflakes --nohard-abort\n", 
+      "stdout": "bananaflakes --random-seed=123 --nohard-abort\n", 
       "target_name": "d8_mocked.py", 
       "variant": "default"
     }, 
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --random-seed=123 bananaflakes --nohard-abort", 
+      "command": "/usr/bin/python out/Release/d8_mocked.py bananaflakes --random-seed=123 --nohard-abort", 
       "duration": 1, 
       "exit_code": 0, 
       "expected": [
         "PASS"
       ], 
       "flags": [
-        "--random-seed=123", 
         "bananaflakes", 
+        "--random-seed=123", 
         "--nohard-abort"
       ], 
       "name": "sweet/bananaflakes", 
@@ -41,29 +41,29 @@
       "result": "PASS", 
       "run": 2, 
       "stderr": "", 
-      "stdout": "--random-seed=123 bananaflakes --nohard-abort\n", 
+      "stdout": "bananaflakes --random-seed=123 --nohard-abort\n", 
       "target_name": "d8_mocked.py", 
       "variant": "default"
     }
   ], 
   "slowest_tests": [
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --random-seed=123 bananaflakes --nohard-abort", 
+      "command": "/usr/bin/python out/Release/d8_mocked.py bananaflakes --random-seed=123 --nohard-abort", 
       "duration": 1, 
       "flags": [
-        "--random-seed=123", 
         "bananaflakes", 
+        "--random-seed=123", 
         "--nohard-abort"
       ], 
       "marked_slow": false, 
       "name": "sweet/bananaflakes"
     }, 
     {
-      "command": "/usr/bin/python out/Release/d8_mocked.py --random-seed=123 bananaflakes --nohard-abort", 
+      "command": "/usr/bin/python out/Release/d8_mocked.py bananaflakes --random-seed=123 --nohard-abort", 
       "duration": 1, 
       "flags": [
-        "--random-seed=123", 
         "bananaflakes", 
+        "--random-seed=123", 
         "--nohard-abort"
       ], 
       "marked_slow": false, 
diff --git a/deps/v8/tools/unittests/testdata/testroot1/test/sweet/testcfg.py b/deps/v8/tools/unittests/testdata/testroot1/test/sweet/testcfg.py
index 115471ac727..1fcf2864b6d 100644
--- a/deps/v8/tools/unittests/testdata/testroot1/test/sweet/testcfg.py
+++ b/deps/v8/tools/unittests/testdata/testroot1/test/sweet/testcfg.py
@@ -10,7 +10,7 @@
 from testrunner.objects import testcase
 
 class TestSuite(testsuite.TestSuite):
-  def ListTests(self, context):
+  def ListTests(self):
     return map(
         self._create_test,
         ['bananas', 'apples', 'cherries', 'strawberries', 'raspberries'],
@@ -24,8 +24,8 @@ class TestCase(testcase.TestCase):
   def get_shell(self):
     return 'd8_mocked.py'
 
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     return [self.name]
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/tools/unittests/testdata/testroot2/test/sweet/testcfg.py b/deps/v8/tools/unittests/testdata/testroot2/test/sweet/testcfg.py
index 9407769b35f..a986af5c2fc 100644
--- a/deps/v8/tools/unittests/testdata/testroot2/test/sweet/testcfg.py
+++ b/deps/v8/tools/unittests/testdata/testroot2/test/sweet/testcfg.py
@@ -10,7 +10,7 @@
 from testrunner.objects import testcase
 
 class TestSuite(testsuite.TestSuite):
-  def ListTests(self, context):
+  def ListTests(self):
     return map(
         self._create_test,
         ['bananaflakes'],
@@ -24,8 +24,8 @@ class TestCase(testcase.TestCase):
   def get_shell(self):
     return 'd8_mocked.py'
 
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     return [self.name]
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/deps/v8/tools/v8heapconst.py b/deps/v8/tools/v8heapconst.py
index c96741a9a17..90b6cd61589 100644
--- a/deps/v8/tools/v8heapconst.py
+++ b/deps/v8/tools/v8heapconst.py
@@ -49,44 +49,68 @@
   145: "FIXED_FLOAT32_ARRAY_TYPE",
   146: "FIXED_FLOAT64_ARRAY_TYPE",
   147: "FIXED_UINT8_CLAMPED_ARRAY_TYPE",
-  148: "FIXED_DOUBLE_ARRAY_TYPE",
-  149: "FILLER_TYPE",
-  150: "ACCESS_CHECK_INFO_TYPE",
-  151: "ACCESSOR_INFO_TYPE",
-  152: "ACCESSOR_PAIR_TYPE",
-  153: "ALIASED_ARGUMENTS_ENTRY_TYPE",
-  154: "ALLOCATION_MEMENTO_TYPE",
-  155: "ALLOCATION_SITE_TYPE",
-  156: "ASYNC_GENERATOR_REQUEST_TYPE",
-  157: "CONTEXT_EXTENSION_TYPE",
-  158: "DEBUG_INFO_TYPE",
-  159: "FUNCTION_TEMPLATE_INFO_TYPE",
-  160: "INTERCEPTOR_INFO_TYPE",
-  161: "MODULE_INFO_ENTRY_TYPE",
-  162: "MODULE_TYPE",
-  163: "OBJECT_TEMPLATE_INFO_TYPE",
-  164: "PROMISE_REACTION_JOB_INFO_TYPE",
-  165: "PROMISE_RESOLVE_THENABLE_JOB_INFO_TYPE",
-  166: "PROTOTYPE_INFO_TYPE",
-  167: "SCRIPT_TYPE",
-  168: "STACK_FRAME_INFO_TYPE",
-  169: "TUPLE2_TYPE",
-  170: "TUPLE3_TYPE",
-  171: "FIXED_ARRAY_TYPE",
-  172: "DESCRIPTOR_ARRAY_TYPE",
-  173: "HASH_TABLE_TYPE",
-  174: "TRANSITION_ARRAY_TYPE",
-  175: "CELL_TYPE",
-  176: "CODE_DATA_CONTAINER_TYPE",
-  177: "FEEDBACK_VECTOR_TYPE",
-  178: "LOAD_HANDLER_TYPE",
-  179: "PROPERTY_ARRAY_TYPE",
-  180: "PROPERTY_CELL_TYPE",
-  181: "SHARED_FUNCTION_INFO_TYPE",
-  182: "SMALL_ORDERED_HASH_MAP_TYPE",
-  183: "SMALL_ORDERED_HASH_SET_TYPE",
-  184: "STORE_HANDLER_TYPE",
-  185: "WEAK_CELL_TYPE",
+  148: "FIXED_BIGINT64_ARRAY_TYPE",
+  149: "FIXED_BIGUINT64_ARRAY_TYPE",
+  150: "FIXED_DOUBLE_ARRAY_TYPE",
+  151: "FEEDBACK_METADATA_TYPE",
+  152: "FILLER_TYPE",
+  153: "ACCESS_CHECK_INFO_TYPE",
+  154: "ACCESSOR_INFO_TYPE",
+  155: "ACCESSOR_PAIR_TYPE",
+  156: "ALIASED_ARGUMENTS_ENTRY_TYPE",
+  157: "ALLOCATION_MEMENTO_TYPE",
+  158: "ALLOCATION_SITE_TYPE",
+  159: "ASYNC_GENERATOR_REQUEST_TYPE",
+  160: "CONTEXT_EXTENSION_TYPE",
+  161: "DEBUG_INFO_TYPE",
+  162: "FUNCTION_TEMPLATE_INFO_TYPE",
+  163: "INTERCEPTOR_INFO_TYPE",
+  164: "MODULE_INFO_ENTRY_TYPE",
+  165: "MODULE_TYPE",
+  166: "OBJECT_TEMPLATE_INFO_TYPE",
+  167: "PROMISE_CAPABILITY_TYPE",
+  168: "PROMISE_REACTION_TYPE",
+  169: "PROTOTYPE_INFO_TYPE",
+  170: "SCRIPT_TYPE",
+  171: "STACK_FRAME_INFO_TYPE",
+  172: "TUPLE2_TYPE",
+  173: "TUPLE3_TYPE",
+  174: "WASM_COMPILED_MODULE_TYPE",
+  175: "WASM_DEBUG_INFO_TYPE",
+  176: "WASM_SHARED_MODULE_DATA_TYPE",
+  177: "CALLABLE_TASK_TYPE",
+  178: "CALLBACK_TASK_TYPE",
+  179: "PROMISE_FULFILL_REACTION_JOB_TASK_TYPE",
+  180: "PROMISE_REJECT_REACTION_JOB_TASK_TYPE",
+  181: "PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE",
+  182: "FIXED_ARRAY_TYPE",
+  183: "BOILERPLATE_DESCRIPTION_TYPE",
+  184: "DESCRIPTOR_ARRAY_TYPE",
+  185: "HASH_TABLE_TYPE",
+  186: "SCOPE_INFO_TYPE",
+  187: "TRANSITION_ARRAY_TYPE",
+  188: "BLOCK_CONTEXT_TYPE",
+  189: "CATCH_CONTEXT_TYPE",
+  190: "DEBUG_EVALUATE_CONTEXT_TYPE",
+  191: "EVAL_CONTEXT_TYPE",
+  192: "FUNCTION_CONTEXT_TYPE",
+  193: "MODULE_CONTEXT_TYPE",
+  194: "NATIVE_CONTEXT_TYPE",
+  195: "SCRIPT_CONTEXT_TYPE",
+  196: "WITH_CONTEXT_TYPE",
+  197: "CELL_TYPE",
+  198: "CODE_DATA_CONTAINER_TYPE",
+  199: "FEEDBACK_CELL_TYPE",
+  200: "FEEDBACK_VECTOR_TYPE",
+  201: "LOAD_HANDLER_TYPE",
+  202: "PROPERTY_ARRAY_TYPE",
+  203: "PROPERTY_CELL_TYPE",
+  204: "SHARED_FUNCTION_INFO_TYPE",
+  205: "SMALL_ORDERED_HASH_MAP_TYPE",
+  206: "SMALL_ORDERED_HASH_SET_TYPE",
+  207: "STORE_HANDLER_TYPE",
+  208: "WEAK_CELL_TYPE",
+  209: "WEAK_FIXED_ARRAY_TYPE",
   1024: "JS_PROXY_TYPE",
   1025: "JS_GLOBAL_OBJECT_TYPE",
   1026: "JS_GLOBAL_PROXY_TYPE",
@@ -97,189 +121,168 @@
   1057: "JS_OBJECT_TYPE",
   1058: "JS_ARGUMENTS_TYPE",
   1059: "JS_ARRAY_BUFFER_TYPE",
-  1060: "JS_ARRAY_TYPE",
-  1061: "JS_ASYNC_FROM_SYNC_ITERATOR_TYPE",
-  1062: "JS_ASYNC_GENERATOR_OBJECT_TYPE",
-  1063: "JS_CONTEXT_EXTENSION_OBJECT_TYPE",
-  1064: "JS_DATE_TYPE",
-  1065: "JS_ERROR_TYPE",
-  1066: "JS_GENERATOR_OBJECT_TYPE",
-  1067: "JS_MAP_TYPE",
-  1068: "JS_MAP_KEY_ITERATOR_TYPE",
-  1069: "JS_MAP_KEY_VALUE_ITERATOR_TYPE",
-  1070: "JS_MAP_VALUE_ITERATOR_TYPE",
-  1071: "JS_MESSAGE_OBJECT_TYPE",
-  1072: "JS_PROMISE_TYPE",
-  1073: "JS_REGEXP_TYPE",
-  1074: "JS_SET_TYPE",
-  1075: "JS_SET_KEY_VALUE_ITERATOR_TYPE",
-  1076: "JS_SET_VALUE_ITERATOR_TYPE",
-  1077: "JS_STRING_ITERATOR_TYPE",
-  1078: "JS_WEAK_MAP_TYPE",
-  1079: "JS_WEAK_SET_TYPE",
-  1080: "JS_TYPED_ARRAY_TYPE",
-  1081: "JS_DATA_VIEW_TYPE",
-  1082: "JS_TYPED_ARRAY_KEY_ITERATOR_TYPE",
-  1083: "JS_FAST_ARRAY_KEY_ITERATOR_TYPE",
-  1084: "JS_GENERIC_ARRAY_KEY_ITERATOR_TYPE",
-  1085: "JS_UINT8_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1086: "JS_INT8_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1087: "JS_UINT16_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1088: "JS_INT16_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1089: "JS_UINT32_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1090: "JS_INT32_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1091: "JS_FLOAT32_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1092: "JS_FLOAT64_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1093: "JS_UINT8_CLAMPED_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1094: "JS_FAST_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1095: "JS_FAST_HOLEY_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1096: "JS_FAST_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1097: "JS_FAST_HOLEY_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1098: "JS_FAST_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1099: "JS_FAST_HOLEY_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1100: "JS_GENERIC_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  1101: "JS_UINT8_ARRAY_VALUE_ITERATOR_TYPE",
-  1102: "JS_INT8_ARRAY_VALUE_ITERATOR_TYPE",
-  1103: "JS_UINT16_ARRAY_VALUE_ITERATOR_TYPE",
-  1104: "JS_INT16_ARRAY_VALUE_ITERATOR_TYPE",
-  1105: "JS_UINT32_ARRAY_VALUE_ITERATOR_TYPE",
-  1106: "JS_INT32_ARRAY_VALUE_ITERATOR_TYPE",
-  1107: "JS_FLOAT32_ARRAY_VALUE_ITERATOR_TYPE",
-  1108: "JS_FLOAT64_ARRAY_VALUE_ITERATOR_TYPE",
-  1109: "JS_UINT8_CLAMPED_ARRAY_VALUE_ITERATOR_TYPE",
-  1110: "JS_FAST_SMI_ARRAY_VALUE_ITERATOR_TYPE",
-  1111: "JS_FAST_HOLEY_SMI_ARRAY_VALUE_ITERATOR_TYPE",
-  1112: "JS_FAST_ARRAY_VALUE_ITERATOR_TYPE",
-  1113: "JS_FAST_HOLEY_ARRAY_VALUE_ITERATOR_TYPE",
-  1114: "JS_FAST_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE",
-  1115: "JS_FAST_HOLEY_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE",
-  1116: "JS_GENERIC_ARRAY_VALUE_ITERATOR_TYPE",
-  1117: "WASM_INSTANCE_TYPE",
-  1118: "WASM_MEMORY_TYPE",
-  1119: "WASM_MODULE_TYPE",
-  1120: "WASM_TABLE_TYPE",
-  1121: "JS_BOUND_FUNCTION_TYPE",
-  1122: "JS_FUNCTION_TYPE",
+  1060: "JS_ARRAY_ITERATOR_TYPE",
+  1061: "JS_ARRAY_TYPE",
+  1062: "JS_ASYNC_FROM_SYNC_ITERATOR_TYPE",
+  1063: "JS_ASYNC_GENERATOR_OBJECT_TYPE",
+  1064: "JS_CONTEXT_EXTENSION_OBJECT_TYPE",
+  1065: "JS_DATE_TYPE",
+  1066: "JS_ERROR_TYPE",
+  1067: "JS_GENERATOR_OBJECT_TYPE",
+  1068: "JS_MAP_TYPE",
+  1069: "JS_MAP_KEY_ITERATOR_TYPE",
+  1070: "JS_MAP_KEY_VALUE_ITERATOR_TYPE",
+  1071: "JS_MAP_VALUE_ITERATOR_TYPE",
+  1072: "JS_MESSAGE_OBJECT_TYPE",
+  1073: "JS_PROMISE_TYPE",
+  1074: "JS_REGEXP_TYPE",
+  1075: "JS_SET_TYPE",
+  1076: "JS_SET_KEY_VALUE_ITERATOR_TYPE",
+  1077: "JS_SET_VALUE_ITERATOR_TYPE",
+  1078: "JS_STRING_ITERATOR_TYPE",
+  1079: "JS_WEAK_MAP_TYPE",
+  1080: "JS_WEAK_SET_TYPE",
+  1081: "JS_TYPED_ARRAY_TYPE",
+  1082: "JS_DATA_VIEW_TYPE",
+  1083: "WASM_INSTANCE_TYPE",
+  1084: "WASM_MEMORY_TYPE",
+  1085: "WASM_MODULE_TYPE",
+  1086: "WASM_TABLE_TYPE",
+  1087: "JS_BOUND_FUNCTION_TYPE",
+  1088: "JS_FUNCTION_TYPE",
 }
 
 # List of known V8 maps.
 KNOWN_MAPS = {
-  0x02201: (138, "FreeSpaceMap"),
-  0x02251: (132, "MetaMap"),
-  0x022a1: (131, "NullMap"),
-  0x022f1: (172, "DescriptorArrayMap"),
-  0x02341: (171, "FixedArrayMap"),
-  0x02391: (149, "OnePointerFillerMap"),
-  0x023e1: (149, "TwoPointerFillerMap"),
-  0x02431: (131, "UninitializedMap"),
-  0x02481: (8, "OneByteInternalizedStringMap"),
-  0x024d1: (131, "UndefinedMap"),
-  0x02521: (129, "HeapNumberMap"),
-  0x02571: (131, "TheHoleMap"),
-  0x025c1: (131, "BooleanMap"),
-  0x02611: (136, "ByteArrayMap"),
-  0x02661: (171, "FixedCOWArrayMap"),
-  0x026b1: (173, "HashTableMap"),
-  0x02701: (128, "SymbolMap"),
-  0x02751: (72, "OneByteStringMap"),
-  0x027a1: (171, "ScopeInfoMap"),
-  0x027f1: (181, "SharedFunctionInfoMap"),
-  0x02841: (133, "CodeMap"),
-  0x02891: (171, "FunctionContextMap"),
-  0x028e1: (175, "CellMap"),
-  0x02931: (185, "WeakCellMap"),
-  0x02981: (180, "GlobalPropertyCellMap"),
-  0x029d1: (135, "ForeignMap"),
-  0x02a21: (174, "TransitionArrayMap"),
-  0x02a71: (177, "FeedbackVectorMap"),
-  0x02ac1: (131, "ArgumentsMarkerMap"),
-  0x02b11: (131, "ExceptionMap"),
-  0x02b61: (131, "TerminationExceptionMap"),
-  0x02bb1: (131, "OptimizedOutMap"),
-  0x02c01: (131, "StaleRegisterMap"),
-  0x02c51: (171, "NativeContextMap"),
-  0x02ca1: (171, "ModuleContextMap"),
-  0x02cf1: (171, "EvalContextMap"),
-  0x02d41: (171, "ScriptContextMap"),
-  0x02d91: (171, "BlockContextMap"),
-  0x02de1: (171, "CatchContextMap"),
-  0x02e31: (171, "WithContextMap"),
-  0x02e81: (171, "DebugEvaluateContextMap"),
-  0x02ed1: (171, "ScriptContextTableMap"),
-  0x02f21: (171, "ArrayListMap"),
-  0x02f71: (148, "FixedDoubleArrayMap"),
-  0x02fc1: (134, "MutableHeapNumberMap"),
-  0x03011: (173, "OrderedHashMapMap"),
-  0x03061: (173, "OrderedHashSetMap"),
-  0x030b1: (173, "NameDictionaryMap"),
-  0x03101: (173, "GlobalDictionaryMap"),
-  0x03151: (173, "NumberDictionaryMap"),
-  0x031a1: (173, "StringTableMap"),
-  0x031f1: (173, "WeakHashTableMap"),
-  0x03241: (171, "SloppyArgumentsElementsMap"),
-  0x03291: (182, "SmallOrderedHashMapMap"),
-  0x032e1: (183, "SmallOrderedHashSetMap"),
-  0x03331: (176, "CodeDataContainerMap"),
-  0x03381: (1071, "JSMessageObjectMap"),
-  0x033d1: (1057, "ExternalMap"),
-  0x03421: (137, "BytecodeArrayMap"),
-  0x03471: (171, "ModuleInfoMap"),
-  0x034c1: (175, "NoClosuresCellMap"),
-  0x03511: (175, "OneClosureCellMap"),
-  0x03561: (175, "ManyClosuresCellMap"),
-  0x035b1: (179, "PropertyArrayMap"),
-  0x03601: (130, "BigIntMap"),
-  0x03651: (106, "NativeSourceStringMap"),
-  0x036a1: (64, "StringMap"),
-  0x036f1: (73, "ConsOneByteStringMap"),
-  0x03741: (65, "ConsStringMap"),
-  0x03791: (77, "ThinOneByteStringMap"),
-  0x037e1: (69, "ThinStringMap"),
-  0x03831: (67, "SlicedStringMap"),
-  0x03881: (75, "SlicedOneByteStringMap"),
-  0x038d1: (66, "ExternalStringMap"),
-  0x03921: (82, "ExternalStringWithOneByteDataMap"),
-  0x03971: (74, "ExternalOneByteStringMap"),
-  0x039c1: (98, "ShortExternalStringMap"),
-  0x03a11: (114, "ShortExternalStringWithOneByteDataMap"),
-  0x03a61: (0, "InternalizedStringMap"),
-  0x03ab1: (2, "ExternalInternalizedStringMap"),
-  0x03b01: (18, "ExternalInternalizedStringWithOneByteDataMap"),
-  0x03b51: (10, "ExternalOneByteInternalizedStringMap"),
-  0x03ba1: (34, "ShortExternalInternalizedStringMap"),
-  0x03bf1: (50, "ShortExternalInternalizedStringWithOneByteDataMap"),
-  0x03c41: (42, "ShortExternalOneByteInternalizedStringMap"),
-  0x03c91: (106, "ShortExternalOneByteStringMap"),
-  0x03ce1: (140, "FixedUint8ArrayMap"),
-  0x03d31: (139, "FixedInt8ArrayMap"),
-  0x03d81: (142, "FixedUint16ArrayMap"),
-  0x03dd1: (141, "FixedInt16ArrayMap"),
-  0x03e21: (144, "FixedUint32ArrayMap"),
-  0x03e71: (143, "FixedInt32ArrayMap"),
-  0x03ec1: (145, "FixedFloat32ArrayMap"),
-  0x03f11: (146, "FixedFloat64ArrayMap"),
-  0x03f61: (147, "FixedUint8ClampedArrayMap"),
-  0x03fb1: (169, "Tuple2Map"),
-  0x04001: (167, "ScriptMap"),
-  0x04051: (160, "InterceptorInfoMap"),
-  0x040a1: (151, "AccessorInfoMap"),
-  0x040f1: (150, "AccessCheckInfoMap"),
-  0x04141: (152, "AccessorPairMap"),
-  0x04191: (153, "AliasedArgumentsEntryMap"),
-  0x041e1: (154, "AllocationMementoMap"),
-  0x04231: (155, "AllocationSiteMap"),
-  0x04281: (156, "AsyncGeneratorRequestMap"),
-  0x042d1: (157, "ContextExtensionMap"),
-  0x04321: (158, "DebugInfoMap"),
-  0x04371: (159, "FunctionTemplateInfoMap"),
-  0x043c1: (161, "ModuleInfoEntryMap"),
-  0x04411: (162, "ModuleMap"),
-  0x04461: (163, "ObjectTemplateInfoMap"),
-  0x044b1: (164, "PromiseReactionJobInfoMap"),
-  0x04501: (165, "PromiseResolveThenableJobInfoMap"),
-  0x04551: (166, "PrototypeInfoMap"),
-  0x045a1: (168, "StackFrameInfoMap"),
-  0x045f1: (170, "Tuple3Map"),
+  ("MAP_SPACE", 0x02201): (138, "FreeSpaceMap"),
+  ("MAP_SPACE", 0x02259): (132, "MetaMap"),
+  ("MAP_SPACE", 0x022b1): (131, "NullMap"),
+  ("MAP_SPACE", 0x02309): (184, "DescriptorArrayMap"),
+  ("MAP_SPACE", 0x02361): (182, "FixedArrayMap"),
+  ("MAP_SPACE", 0x023b9): (152, "OnePointerFillerMap"),
+  ("MAP_SPACE", 0x02411): (152, "TwoPointerFillerMap"),
+  ("MAP_SPACE", 0x02469): (131, "UninitializedMap"),
+  ("MAP_SPACE", 0x024c1): (8, "OneByteInternalizedStringMap"),
+  ("MAP_SPACE", 0x02519): (131, "UndefinedMap"),
+  ("MAP_SPACE", 0x02571): (129, "HeapNumberMap"),
+  ("MAP_SPACE", 0x025c9): (131, "TheHoleMap"),
+  ("MAP_SPACE", 0x02621): (131, "BooleanMap"),
+  ("MAP_SPACE", 0x02679): (136, "ByteArrayMap"),
+  ("MAP_SPACE", 0x026d1): (182, "FixedCOWArrayMap"),
+  ("MAP_SPACE", 0x02729): (185, "HashTableMap"),
+  ("MAP_SPACE", 0x02781): (128, "SymbolMap"),
+  ("MAP_SPACE", 0x027d9): (72, "OneByteStringMap"),
+  ("MAP_SPACE", 0x02831): (186, "ScopeInfoMap"),
+  ("MAP_SPACE", 0x02889): (204, "SharedFunctionInfoMap"),
+  ("MAP_SPACE", 0x028e1): (133, "CodeMap"),
+  ("MAP_SPACE", 0x02939): (192, "FunctionContextMap"),
+  ("MAP_SPACE", 0x02991): (197, "CellMap"),
+  ("MAP_SPACE", 0x029e9): (208, "WeakCellMap"),
+  ("MAP_SPACE", 0x02a41): (203, "GlobalPropertyCellMap"),
+  ("MAP_SPACE", 0x02a99): (135, "ForeignMap"),
+  ("MAP_SPACE", 0x02af1): (187, "TransitionArrayMap"),
+  ("MAP_SPACE", 0x02b49): (200, "FeedbackVectorMap"),
+  ("MAP_SPACE", 0x02ba1): (131, "ArgumentsMarkerMap"),
+  ("MAP_SPACE", 0x02bf9): (131, "ExceptionMap"),
+  ("MAP_SPACE", 0x02c51): (131, "TerminationExceptionMap"),
+  ("MAP_SPACE", 0x02ca9): (131, "OptimizedOutMap"),
+  ("MAP_SPACE", 0x02d01): (131, "StaleRegisterMap"),
+  ("MAP_SPACE", 0x02d59): (194, "NativeContextMap"),
+  ("MAP_SPACE", 0x02db1): (193, "ModuleContextMap"),
+  ("MAP_SPACE", 0x02e09): (191, "EvalContextMap"),
+  ("MAP_SPACE", 0x02e61): (195, "ScriptContextMap"),
+  ("MAP_SPACE", 0x02eb9): (188, "BlockContextMap"),
+  ("MAP_SPACE", 0x02f11): (189, "CatchContextMap"),
+  ("MAP_SPACE", 0x02f69): (196, "WithContextMap"),
+  ("MAP_SPACE", 0x02fc1): (190, "DebugEvaluateContextMap"),
+  ("MAP_SPACE", 0x03019): (182, "ScriptContextTableMap"),
+  ("MAP_SPACE", 0x03071): (151, "FeedbackMetadataArrayMap"),
+  ("MAP_SPACE", 0x030c9): (182, "ArrayListMap"),
+  ("MAP_SPACE", 0x03121): (130, "BigIntMap"),
+  ("MAP_SPACE", 0x03179): (183, "BoilerplateDescriptionMap"),
+  ("MAP_SPACE", 0x031d1): (137, "BytecodeArrayMap"),
+  ("MAP_SPACE", 0x03229): (198, "CodeDataContainerMap"),
+  ("MAP_SPACE", 0x03281): (1057, "ExternalMap"),
+  ("MAP_SPACE", 0x032d9): (150, "FixedDoubleArrayMap"),
+  ("MAP_SPACE", 0x03331): (185, "GlobalDictionaryMap"),
+  ("MAP_SPACE", 0x03389): (199, "ManyClosuresCellMap"),
+  ("MAP_SPACE", 0x033e1): (1072, "JSMessageObjectMap"),
+  ("MAP_SPACE", 0x03439): (182, "ModuleInfoMap"),
+  ("MAP_SPACE", 0x03491): (134, "MutableHeapNumberMap"),
+  ("MAP_SPACE", 0x034e9): (185, "NameDictionaryMap"),
+  ("MAP_SPACE", 0x03541): (199, "NoClosuresCellMap"),
+  ("MAP_SPACE", 0x03599): (185, "NumberDictionaryMap"),
+  ("MAP_SPACE", 0x035f1): (199, "OneClosureCellMap"),
+  ("MAP_SPACE", 0x03649): (185, "OrderedHashMapMap"),
+  ("MAP_SPACE", 0x036a1): (185, "OrderedHashSetMap"),
+  ("MAP_SPACE", 0x036f9): (202, "PropertyArrayMap"),
+  ("MAP_SPACE", 0x03751): (185, "SimpleNumberDictionaryMap"),
+  ("MAP_SPACE", 0x037a9): (182, "SloppyArgumentsElementsMap"),
+  ("MAP_SPACE", 0x03801): (205, "SmallOrderedHashMapMap"),
+  ("MAP_SPACE", 0x03859): (206, "SmallOrderedHashSetMap"),
+  ("MAP_SPACE", 0x038b1): (185, "StringTableMap"),
+  ("MAP_SPACE", 0x03909): (209, "WeakFixedArrayMap"),
+  ("MAP_SPACE", 0x03961): (106, "NativeSourceStringMap"),
+  ("MAP_SPACE", 0x039b9): (64, "StringMap"),
+  ("MAP_SPACE", 0x03a11): (73, "ConsOneByteStringMap"),
+  ("MAP_SPACE", 0x03a69): (65, "ConsStringMap"),
+  ("MAP_SPACE", 0x03ac1): (77, "ThinOneByteStringMap"),
+  ("MAP_SPACE", 0x03b19): (69, "ThinStringMap"),
+  ("MAP_SPACE", 0x03b71): (67, "SlicedStringMap"),
+  ("MAP_SPACE", 0x03bc9): (75, "SlicedOneByteStringMap"),
+  ("MAP_SPACE", 0x03c21): (66, "ExternalStringMap"),
+  ("MAP_SPACE", 0x03c79): (82, "ExternalStringWithOneByteDataMap"),
+  ("MAP_SPACE", 0x03cd1): (74, "ExternalOneByteStringMap"),
+  ("MAP_SPACE", 0x03d29): (98, "ShortExternalStringMap"),
+  ("MAP_SPACE", 0x03d81): (114, "ShortExternalStringWithOneByteDataMap"),
+  ("MAP_SPACE", 0x03dd9): (0, "InternalizedStringMap"),
+  ("MAP_SPACE", 0x03e31): (2, "ExternalInternalizedStringMap"),
+  ("MAP_SPACE", 0x03e89): (18, "ExternalInternalizedStringWithOneByteDataMap"),
+  ("MAP_SPACE", 0x03ee1): (10, "ExternalOneByteInternalizedStringMap"),
+  ("MAP_SPACE", 0x03f39): (34, "ShortExternalInternalizedStringMap"),
+  ("MAP_SPACE", 0x03f91): (50, "ShortExternalInternalizedStringWithOneByteDataMap"),
+  ("MAP_SPACE", 0x03fe9): (42, "ShortExternalOneByteInternalizedStringMap"),
+  ("MAP_SPACE", 0x04041): (106, "ShortExternalOneByteStringMap"),
+  ("MAP_SPACE", 0x04099): (140, "FixedUint8ArrayMap"),
+  ("MAP_SPACE", 0x040f1): (139, "FixedInt8ArrayMap"),
+  ("MAP_SPACE", 0x04149): (142, "FixedUint16ArrayMap"),
+  ("MAP_SPACE", 0x041a1): (141, "FixedInt16ArrayMap"),
+  ("MAP_SPACE", 0x041f9): (144, "FixedUint32ArrayMap"),
+  ("MAP_SPACE", 0x04251): (143, "FixedInt32ArrayMap"),
+  ("MAP_SPACE", 0x042a9): (145, "FixedFloat32ArrayMap"),
+  ("MAP_SPACE", 0x04301): (146, "FixedFloat64ArrayMap"),
+  ("MAP_SPACE", 0x04359): (147, "FixedUint8ClampedArrayMap"),
+  ("MAP_SPACE", 0x043b1): (149, "FixedBigUint64ArrayMap"),
+  ("MAP_SPACE", 0x04409): (148, "FixedBigInt64ArrayMap"),
+  ("MAP_SPACE", 0x04461): (172, "Tuple2Map"),
+  ("MAP_SPACE", 0x044b9): (170, "ScriptMap"),
+  ("MAP_SPACE", 0x04511): (163, "InterceptorInfoMap"),
+  ("MAP_SPACE", 0x04569): (154, "AccessorInfoMap"),
+  ("MAP_SPACE", 0x045c1): (153, "AccessCheckInfoMap"),
+  ("MAP_SPACE", 0x04619): (155, "AccessorPairMap"),
+  ("MAP_SPACE", 0x04671): (156, "AliasedArgumentsEntryMap"),
+  ("MAP_SPACE", 0x046c9): (157, "AllocationMementoMap"),
+  ("MAP_SPACE", 0x04721): (158, "AllocationSiteMap"),
+  ("MAP_SPACE", 0x04779): (159, "AsyncGeneratorRequestMap"),
+  ("MAP_SPACE", 0x047d1): (160, "ContextExtensionMap"),
+  ("MAP_SPACE", 0x04829): (161, "DebugInfoMap"),
+  ("MAP_SPACE", 0x04881): (162, "FunctionTemplateInfoMap"),
+  ("MAP_SPACE", 0x048d9): (164, "ModuleInfoEntryMap"),
+  ("MAP_SPACE", 0x04931): (165, "ModuleMap"),
+  ("MAP_SPACE", 0x04989): (166, "ObjectTemplateInfoMap"),
+  ("MAP_SPACE", 0x049e1): (167, "PromiseCapabilityMap"),
+  ("MAP_SPACE", 0x04a39): (168, "PromiseReactionMap"),
+  ("MAP_SPACE", 0x04a91): (169, "PrototypeInfoMap"),
+  ("MAP_SPACE", 0x04ae9): (171, "StackFrameInfoMap"),
+  ("MAP_SPACE", 0x04b41): (173, "Tuple3Map"),
+  ("MAP_SPACE", 0x04b99): (174, "WasmCompiledModuleMap"),
+  ("MAP_SPACE", 0x04bf1): (175, "WasmDebugInfoMap"),
+  ("MAP_SPACE", 0x04c49): (176, "WasmSharedModuleDataMap"),
+  ("MAP_SPACE", 0x04ca1): (177, "CallableTaskMap"),
+  ("MAP_SPACE", 0x04cf9): (178, "CallbackTaskMap"),
+  ("MAP_SPACE", 0x04d51): (179, "PromiseFulfillReactionJobTaskMap"),
+  ("MAP_SPACE", 0x04da9): (180, "PromiseRejectReactionJobTaskMap"),
+  ("MAP_SPACE", 0x04e01): (181, "PromiseResolveThenableJobTaskMap"),
 }
 
 # List of known V8 objects.
@@ -301,34 +304,33 @@
   ("OLD_SPACE", 0x02519): "TerminationException",
   ("OLD_SPACE", 0x02579): "OptimizedOut",
   ("OLD_SPACE", 0x025d1): "StaleRegister",
-  ("OLD_SPACE", 0x02651): "EmptyByteArray",
-  ("OLD_SPACE", 0x02661): "EmptyFixedUint8Array",
-  ("OLD_SPACE", 0x02681): "EmptyFixedInt8Array",
-  ("OLD_SPACE", 0x026a1): "EmptyFixedUint16Array",
-  ("OLD_SPACE", 0x026c1): "EmptyFixedInt16Array",
-  ("OLD_SPACE", 0x026e1): "EmptyFixedUint32Array",
-  ("OLD_SPACE", 0x02701): "EmptyFixedInt32Array",
-  ("OLD_SPACE", 0x02721): "EmptyFixedFloat32Array",
-  ("OLD_SPACE", 0x02741): "EmptyFixedFloat64Array",
-  ("OLD_SPACE", 0x02761): "EmptyFixedUint8ClampedArray",
-  ("OLD_SPACE", 0x02781): "EmptyScript",
-  ("OLD_SPACE", 0x02809): "UndefinedCell",
-  ("OLD_SPACE", 0x02819): "EmptySloppyArgumentsElements",
-  ("OLD_SPACE", 0x02839): "EmptySlowElementDictionary",
-  ("OLD_SPACE", 0x02881): "EmptyOrderedHashMap",
-  ("OLD_SPACE", 0x028a9): "EmptyOrderedHashSet",
-  ("OLD_SPACE", 0x028d1): "EmptyPropertyCell",
-  ("OLD_SPACE", 0x028f9): "EmptyWeakCell",
-  ("OLD_SPACE", 0x02969): "NoElementsProtector",
-  ("OLD_SPACE", 0x02991): "IsConcatSpreadableProtector",
-  ("OLD_SPACE", 0x029a1): "SpeciesProtector",
-  ("OLD_SPACE", 0x029c9): "StringLengthProtector",
-  ("OLD_SPACE", 0x029d9): "FastArrayIterationProtector",
-  ("OLD_SPACE", 0x029e9): "ArrayIteratorProtector",
-  ("OLD_SPACE", 0x02a11): "ArrayBufferNeuteringProtector",
-  ("OLD_SPACE", 0x02a39): "InfinityValue",
-  ("OLD_SPACE", 0x02a49): "MinusZeroValue",
-  ("OLD_SPACE", 0x02a59): "MinusInfinityValue",
+  ("OLD_SPACE", 0x02661): "EmptyByteArray",
+  ("OLD_SPACE", 0x02681): "EmptyFixedUint8Array",
+  ("OLD_SPACE", 0x026a1): "EmptyFixedInt8Array",
+  ("OLD_SPACE", 0x026c1): "EmptyFixedUint16Array",
+  ("OLD_SPACE", 0x026e1): "EmptyFixedInt16Array",
+  ("OLD_SPACE", 0x02701): "EmptyFixedUint32Array",
+  ("OLD_SPACE", 0x02721): "EmptyFixedInt32Array",
+  ("OLD_SPACE", 0x02741): "EmptyFixedFloat32Array",
+  ("OLD_SPACE", 0x02761): "EmptyFixedFloat64Array",
+  ("OLD_SPACE", 0x02781): "EmptyFixedUint8ClampedArray",
+  ("OLD_SPACE", 0x027e1): "EmptyScript",
+  ("OLD_SPACE", 0x02879): "ManyClosuresCell",
+  ("OLD_SPACE", 0x02889): "EmptySloppyArgumentsElements",
+  ("OLD_SPACE", 0x028a9): "EmptySlowElementDictionary",
+  ("OLD_SPACE", 0x028f1): "EmptyOrderedHashMap",
+  ("OLD_SPACE", 0x02919): "EmptyOrderedHashSet",
+  ("OLD_SPACE", 0x02951): "EmptyPropertyCell",
+  ("OLD_SPACE", 0x02979): "EmptyWeakCell",
+  ("OLD_SPACE", 0x029e9): "NoElementsProtector",
+  ("OLD_SPACE", 0x02a11): "IsConcatSpreadableProtector",
+  ("OLD_SPACE", 0x02a21): "SpeciesProtector",
+  ("OLD_SPACE", 0x02a49): "StringLengthProtector",
+  ("OLD_SPACE", 0x02a59): "ArrayIteratorProtector",
+  ("OLD_SPACE", 0x02a81): "ArrayBufferNeuteringProtector",
+  ("OLD_SPACE", 0x02b09): "InfinityValue",
+  ("OLD_SPACE", 0x02b19): "MinusZeroValue",
+  ("OLD_SPACE", 0x02b29): "MinusInfinityValue",
 }
 
 # List of known V8 Frame Markers.
diff --git a/deps/v8/tools/valgrind/asan/dummy b/deps/v8/tools/valgrind/asan/dummy
new file mode 100644
index 00000000000..0e89814954c
--- /dev/null
+++ b/deps/v8/tools/valgrind/asan/dummy
@@ -0,0 +1,2 @@
+# src/base has some more tools in this folder, which we don't use. But we need
+# to have the folder so that the data deps we inherit doesn't error out.
\ No newline at end of file
diff --git a/deps/v8/tools/wasm/update-wasm-spec-tests.sh b/deps/v8/tools/wasm/update-wasm-spec-tests.sh
index c4d18a33335..92aaa8fd3c0 100755
--- a/deps/v8/tools/wasm/update-wasm-spec-tests.sh
+++ b/deps/v8/tools/wasm/update-wasm-spec-tests.sh
@@ -28,6 +28,9 @@ mkdir ${SPEC_TEST_DIR}/tmp
 ./tools/dev/gm.py x64.release d8
 
 cd ${V8_DIR}/test/wasm-js/interpreter
+
+# The next step requires that ocaml is installed. See the README.md in
+# ${V8_DIR}/test/wasm-js/interpreter/.
 make clean all
 
 cd ${V8_DIR}/test/wasm-js/test/core
@@ -42,4 +45,11 @@ echo
 echo "The following files will get uploaded:"
 ls tests
 echo
+
+# For the following command you first have to authenticate with google cloud
+# storage. For that you have to execute
+#
+# > gsutil.py config
+#
+# When the script asks you for your project-id, use 0.
 upload_to_google_storage.py -a -b v8-wasm-spec-tests tests
diff --git a/deps/v8/tools/whitespace.txt b/deps/v8/tools/whitespace.txt
index 83f006688cd..c404c018908 100644
--- a/deps/v8/tools/whitespace.txt
+++ b/deps/v8/tools/whitespace.txt
@@ -7,4 +7,4 @@ A Smi balks into a war and says:
 The doubles heard this and started to unbox.
 The Smi looked at them when a crazy v8-autoroll account showed up...
 The autoroller bought a round of Himbeerbrause. Suddenly...
-The bartender starts to shake the bottles.......................
+The bartender starts to shake the bottles...................
diff --git a/lib/internal/util/types.js b/lib/internal/util/types.js
index 4df62554d13..182625a9716 100644
--- a/lib/internal/util/types.js
+++ b/lib/internal/util/types.js
@@ -61,6 +61,14 @@ function isFloat64Array(value) {
   return TypedArrayProto_toStringTag(value) === 'Float64Array';
 }
 
+function isBigInt64Array(value) {
+  return TypedArrayProto_toStringTag(value) === 'BigInt64Array';
+}
+
+function isBigUint64Array(value) {
+  return TypedArrayProto_toStringTag(value) === 'BigUint64Array';
+}
+
 module.exports = {
   isArrayBufferView,
   isTypedArray,
@@ -72,5 +80,7 @@ module.exports = {
   isInt16Array,
   isInt32Array,
   isFloat32Array,
-  isFloat64Array
+  isFloat64Array,
+  isBigInt64Array,
+  isBigUint64Array
 };
diff --git a/node.gypi b/node.gypi
index ac043dac242..198425d2bde 100644
--- a/node.gypi
+++ b/node.gypi
@@ -56,12 +56,12 @@
     }],
 
     [ 'node_enable_d8=="true"', {
-      'dependencies': [ 'deps/v8/src/d8.gyp:d8' ],
+      'dependencies': [ 'deps/v8/gypfiles/d8.gyp:d8' ],
     }],
     [ 'node_use_bundled_v8=="true"', {
       'dependencies': [
-        'deps/v8/src/v8.gyp:v8',
-        'deps/v8/src/v8.gyp:v8_libplatform'
+        'deps/v8/gypfiles/v8.gyp:v8',
+        'deps/v8/gypfiles/v8.gyp:v8_libplatform'
       ],
     }],
     [ 'node_use_v8_platform=="true"', {
@@ -104,14 +104,14 @@
        target_arch=="ia32" or target_arch=="x32")', {
       'defines': [ 'NODE_ENABLE_VTUNE_PROFILING' ],
       'dependencies': [
-        'deps/v8/src/third_party/vtune/v8vtune.gyp:v8_vtune'
+        'deps/v8/gypfiles/v8vtune.gyp:v8_vtune'
       ],
     }],
     [ 'node_no_browser_globals=="true"', {
       'defines': [ 'NODE_NO_BROWSER_GLOBALS' ],
     } ],
     [ 'node_use_bundled_v8=="true" and v8_postmortem_support=="true"', {
-      'dependencies': [ 'deps/v8/src/v8.gyp:postmortem-metadata' ],
+      'dependencies': [ 'deps/v8/gypfiles/v8.gyp:postmortem-metadata' ],
       'conditions': [
         # -force_load is not applicable for the static library
         [ 'force_load=="true"', {
diff --git a/src/env.cc b/src/env.cc
index 16a24260f62..42e64a412ea 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -241,12 +241,12 @@ void Environment::CleanupHandles() {
 void Environment::StartProfilerIdleNotifier() {
   uv_prepare_start(&idle_prepare_handle_, [](uv_prepare_t* handle) {
     Environment* env = ContainerOf(&Environment::idle_prepare_handle_, handle);
-    env->isolate_data()->GetCpuProfiler()->SetIdle(true);
+    env->isolate()->SetIdle(true);
   });
 
   uv_check_start(&idle_check_handle_, [](uv_check_t* handle) {
     Environment* env = ContainerOf(&Environment::idle_check_handle_, handle);
-    env->isolate_data()->GetCpuProfiler()->SetIdle(false);
+    env->isolate()->SetIdle(false);
   });
 }
 
diff --git a/src/node_types.cc b/src/node_types.cc
index 4b9f86f0d54..99d5d239eea 100644
--- a/src/node_types.cc
+++ b/src/node_types.cc
@@ -13,6 +13,7 @@ namespace {
   V(External)                                                                 \
   V(Date)                                                                     \
   V(ArgumentsObject)                                                          \
+  V(BigIntObject)                                                             \
   V(BooleanObject)                                                            \
   V(NumberObject)                                                             \
   V(StringObject)                                                             \
diff --git a/src/node_version.h b/src/node_version.h
index fcafd4576be..ba6a58eb118 100644
--- a/src/node_version.h
+++ b/src/node_version.h
@@ -106,10 +106,11 @@
  * V8 6.3: 60
  * V8 6.4: 61
  * V8 6.5: 62
+ * V8 6.7: 64
  *
  * More information can be found at https://nodejs.org/en/download/releases/
  */
-#define NODE_MODULE_VERSION 62
+#define NODE_MODULE_VERSION 64
 
 // the NAPI_VERSION provided by this version of the runtime
 #define NAPI_VERSION  3
diff --git a/src/v8abbr.h b/src/v8abbr.h
index c4b244b5637..9e8920204a3 100644
--- a/src/v8abbr.h
+++ b/src/v8abbr.h
@@ -86,7 +86,7 @@
 #define V8_OFF_FUNC_SHARED  \
     V8_OFF_HEAP(V8DBG_CLASS_JSFUNCTION__SHARED__SHAREDFUNCTIONINFO)
 #define V8_OFF_RAW_NAME  \
-    V8_OFF_HEAP(V8DBG_CLASS_SHAREDFUNCTIONINFO__RAW_NAME__OBJECT)
+    V8_OFF_HEAP(V8DBG_CLASS_SHAREDFUNCTIONINFO__NAME_OR_SCOPE_INFO__OBJECT)
 #define V8_OFF_SHARED_IDENT  \
     V8_OFF_HEAP(V8DBG_CLASS_SHAREDFUNCTIONINFO__FUNCTION_IDENTIFIER__OBJECT)
 #define V8_OFF_SHARED_SCRIPT  \
diff --git a/test/.eslintrc.yaml b/test/.eslintrc.yaml
index a3fa2c2c8d0..a505c86d746 100644
--- a/test/.eslintrc.yaml
+++ b/test/.eslintrc.yaml
@@ -21,3 +21,6 @@ rules:
 # Global scoped methods and vars
 globals:
   WebAssembly: false
+  BigInt: false
+  BigInt64Array: false
+  BigUint64Array: false
diff --git a/test/message/unhandled_promise_trace_warnings.out b/test/message/unhandled_promise_trace_warnings.out
index 069e6cc678c..bb51f663823 100644
--- a/test/message/unhandled_promise_trace_warnings.out
+++ b/test/message/unhandled_promise_trace_warnings.out
@@ -34,6 +34,7 @@
     at *
 (node:*) PromiseRejectionHandledWarning: Promise rejection was handled asynchronously (rejection id: 1)
     at handledRejection (internal/process/promises.js:*)
+    at Promise.then *
     at Promise.catch *
     at Immediate.setImmediate (*test*message*unhandled_promise_trace_warnings.js:*)
     at *
diff --git a/test/parallel/test-postmortem-metadata.js b/test/parallel/test-postmortem-metadata.js
index 1f4cc7e6056..82dfb2c9a9f 100644
--- a/test/parallel/test-postmortem-metadata.js
+++ b/test/parallel/test-postmortem-metadata.js
@@ -93,13 +93,12 @@ function getExpectedSymbols() {
     'v8dbg_class_Script__source__Object',
     'v8dbg_class_SeqOneByteString__chars__char',
     'v8dbg_class_SeqTwoByteString__chars__char',
-    'v8dbg_class_SharedFunctionInfo__code__Code',
-    'v8dbg_class_SharedFunctionInfo__compiler_hints__int',
+    'v8dbg_class_SharedFunctionInfo__function_data__Object',
+    'v8dbg_class_SharedFunctionInfo__flags__int',
     'v8dbg_class_SharedFunctionInfo__end_position__int',
     'v8dbg_class_SharedFunctionInfo__function_identifier__Object',
     'v8dbg_class_SharedFunctionInfo__internal_formal_parameter_count__int',
-    'v8dbg_class_SharedFunctionInfo__raw_name__Object',
-    'v8dbg_class_SharedFunctionInfo__scope_info__ScopeInfo',
+    'v8dbg_class_SharedFunctionInfo__name_or_scope_info__Object',
     'v8dbg_class_SharedFunctionInfo__script__Object',
     'v8dbg_class_SharedFunctionInfo__start_position_and_type__int',
     'v8dbg_class_SlicedString__offset__SMI',
diff --git a/test/parallel/test-util-types.js b/test/parallel/test-util-types.js
index ac2f0349ec2..c5a45b28ec3 100644
--- a/test/parallel/test-util-types.js
+++ b/test/parallel/test-util-types.js
@@ -1,3 +1,4 @@
+// Flags: --harmony-bigint
 /* global SharedArrayBuffer */
 'use strict';
 const common = require('../common');
@@ -22,6 +23,7 @@ for (const [ value, _method ] of [
   [ new Number(), 'isNumberObject' ],
   [ new String(), 'isStringObject' ],
   [ Object(Symbol()), 'isSymbolObject' ],
+  [ Object(BigInt(0)), 'isBigIntObject' ],
   [ new Error(), 'isNativeError' ],
   [ new RegExp() ],
   [ async function() {}, 'isAsyncFunction' ],
@@ -44,6 +46,8 @@ for (const [ value, _method ] of [
   [ new Int32Array() ],
   [ new Float32Array() ],
   [ new Float64Array() ],
+  [ new BigInt64Array() ],
+  [ new BigUint64Array() ],
   [ Object.defineProperty(new Uint8Array(),
                           Symbol.toStringTag,
                           { value: 'foo' }) ],
@@ -145,7 +149,7 @@ try {
 const exclude = [
   'Undefined', 'Null', 'NullOrUndefined', 'True', 'False', 'Name', 'String',
   'Symbol', 'Function', 'Array', 'Object', 'Boolean', 'Number', 'Int32',
-  'Uint32'
+  'Uint32', 'BigInt'
 ];
 
 const start = v8_h.indexOf('Value : public Data');
diff --git a/test/parallel/test-v8-serdes-sharedarraybuffer.js b/test/parallel/test-v8-serdes-sharedarraybuffer.js
deleted file mode 100644
index 01db3081815..00000000000
--- a/test/parallel/test-v8-serdes-sharedarraybuffer.js
+++ /dev/null
@@ -1,26 +0,0 @@
-/* global SharedArrayBuffer */
-'use strict';
-
-const common = require('../common');
-const assert = require('assert');
-const v8 = require('v8');
-
-{
-  const sab = new SharedArrayBuffer(64);
-  const uint8array = new Uint8Array(sab);
-  const ID = 42;
-
-  const ser = new v8.Serializer();
-  ser._getSharedArrayBufferId = common.mustCall(() => ID);
-  ser.writeHeader();
-
-  ser.writeValue(uint8array);
-
-  const des = new v8.Deserializer(ser.releaseBuffer());
-  des.readHeader();
-  des.transferArrayBuffer(ID, sab);
-
-  const value = des.readValue();
-  assert.strictEqual(value.buffer, sab);
-  assert.notStrictEqual(value, uint8array);
-}
diff --git a/test/parallel/test-v8-stats.js b/test/parallel/test-v8-stats.js
index 02182e2816b..83689afc974 100644
--- a/test/parallel/test-v8-stats.js
+++ b/test/parallel/test-v8-stats.js
@@ -25,7 +25,8 @@ const expectedHeapSpaces = [
   'old_space',
   'code_space',
   'map_space',
-  'large_object_space'
+  'large_object_space',
+  'read_only_space'
 ];
 const heapSpaceStatistics = v8.getHeapSpaceStatistics();
 const actualHeapSpaceNames = heapSpaceStatistics.map((s) => s.space_name);